Linux Privilege Escalation

Linux privilege escalation is turning a low privilege shell into root. It is almost never an exploit; it is finding a misconfiguration the admin left behind. The first thing you do after landing on a host is enumerate: sudo rights, SUID binaries, cron jobs, writable paths and capabilities. One of those is usually the way up.

Enumerate before you attack

The single biggest difference between someone who escalates and someone who gets stuck is enumeration. You are looking for what the administrator misconfigured, so you check everything systematically before trying anything.

The first commands after a shell

id                 who am I, what groups
sudo -l            what can I run as root
find / -perm -4000 2>/dev/null    SUID binaries
crontab -l         scheduled jobs
uname -a           kernel version, last resort
cat /etc/passwd    users on the box

Sudo misconfiguration

sudo -l shows what the current user can run as root. A single misconfigured entry, a text editor, an interpreter, a file reader runnable as root, is often a direct path to a root shell. Many standard binaries can be abused this way when run as root.

SUID binaries

A SUID binary runs with the owner's privileges, usually root, regardless of who runs it. Find them, then check which can be abused to read protected files, write to them, or execute commands as root.

find / -perm -4000 -type f 2>/dev/null

An unusual SUID binary is a strong lead. The known abuse techniques for standard binaries are well documented.

Cron jobs

Scheduled tasks running as root are a classic path. If a root cron job runs a script you can write to, or references a command using a relative path you can hijack, you get code execution as root when it fires.

PATH and writable files

• A root script calling a command without a full path, where you control an earlier PATH entry
• World writable files that root reads or executes
• Writable service configuration
• Credentials in config files, history and backups

Capabilities

Linux capabilities grant slices of root power to specific binaries. A binary with the wrong capability set can be abused to escalate even without full SUID. Check them explicitly, they are easy to miss.

getcap -r / 2>/dev/null

Kernel exploits, the last resort

The kernel version might have a known exploit, but this is the last option, not the first. Kernel exploits are unstable and can crash a production system, which in a real engagement is a serious incident. Exhaust the misconfiguration paths first.

Automated enumeration

Scripts automate the checks and highlight likely paths, but understand what they report. A tool that says a SUID binary is interesting is useless if you do not know why. Learn the manual checks first, then let tools speed you up. Foundation in Linux commands for hackers.

Why this is a core skill

Privilege escalation is central to the OSCP exam and every real engagement. It is also almost entirely about understanding the Linux permission model deeply, which is why fundamentals matter. See the OSCP syllabus.

Practise this

Escalate to root on deliberately vulnerable machines. This is the skill you build only by doing. Free targets on Hacklido.