Privilege EscalationRed Team Playbook
Linux Privilege Escalation
Triage Linux privilege escalation through identity, sudo, SUID, capabilities, cron, and writable-path evidence.
LinuxPrivilege Escalationsudo
Purpose
Keep Linux escalation methodical and source-driven rather than jumping to random exploits.
Inputs
- - current user
- - hostname
- - kernel
- - sudo permissions
Prerequisites
- - Linux shell
- - User context
- - Permission to enumerate locally
Operator Assumptions
- - Start with built-in commands.
- - Exploit suggestions must match observed facts.
Commands
Identity
Target shellid && hostname && uname -aWhy: Record current context.
Expected: uid/gid, hostname, kernel.
Sudo rights
Target shellsudo -lWhy: Identify allowed privileged commands.
Expected: Allowed or denied sudo command list.
SUID files
Target shellfind / -perm -4000 -type f 2>/dev/nullWhy: Find SUID binaries for review.
Expected: SUID file list.
Decision Points
- - If sudo allows a specific binary, validate GTFOBins-like behavior against exact version.
- - If writable cron exists, preserve evidence before mutation.
- - If kernel looks old, verify distro patches before exploit claims.
Follow-On Actions
- - Privilege proof
- - Finding candidate
- - Remediation mapping
Evidence To Capture
- - id output
- - sudo -l
- - SUID/capability listings
- - file permission proof
Common Failures
- - TTY required for sudo
- - PATH differences
- - No password for sudo unavailable
Operational Cautions
- - Do not overwrite files blindly.
- - Do not infer root path without command output.