Academy Node

Linux Local Privilege Escalation

Linux local privilege escalation turns a low-privileged shell into root by abusing sudo, SUID, capabilities, cron, PATH, weak permissions, credentials, or kernel issues.

Intermediate100 XPLinux PrivEsc

Why it matters

PEN-200 explicitly covers Linux privilege escalation through manual enumeration, automated enumeration, exposed confidential information, insecure permissions, SUID/capabilities, sudo, and kernel vulnerabilities.

How to identify it

Run id
Run sudo -l
Check SUID
Check capabilities
Check cron
Check interesting files

Linux commands

id

hostname; uname -a; cat /etc/os-release

sudo -l

find / -perm -4000 -type f 2>/dev/null

getcap -r / 2>/dev/null

find / -writable -type d 2>/dev/null | grep -vE '/proc|/sys|/dev'

ls -la /etc/cron* /var/spool/cron/crontabs 2>/dev/null

grep -RniE 'pass|pwd|cred|secret|token' /home /var/www /opt 2>/dev/null

Expected output

sudo rights
SUID binaries
capabilities
writable cron/script
stored credentials

Success looks like

root shell
proof.txt readable

Failure looks like

No obvious privesc after first pass

Troubleshooting

Run linpeas but read the output manually
Check app user context
Look for backups and scripts

Common mistakes

Skipping manual enum
Not checking app configs
Not checking PATH hijack

Alternative attacks

Credential reuse
Pivoting
Web config loot

What to try next

SUID/capabilities
sudo abuse
Cron abuse
Proof collection

Recommended next lessons

ASREP Roast

ASREP roasting abuses AD users with Kerberos pre-authentication disabled. You can request encrypted ASREP material and attempt to crack it offline.

Kerberoast

Kerberoasting targets domain users with SPNs. You request service tickets and crack them offline.

GenericWrite

GenericWrite means you can modify certain attributes on the target AD object.

GenericAll

GenericAll is effectively full control over the target AD object.