Linux Privilege Escalation

Methodology

Privilege Escalation is the exploitation of a vulnerability, design flaw, or misonfiguration in an operating system or application to gain unauthorized access to resources that are usually restricted from the users.

Things to look for:

• Is there an application or binary that you can run that has an elevated or even root permission?

• Can you exploit the application that has an elevated permission or abuse its functionality?

• Is there a custom script/application/scheduled task that can be run as root?

• Do you have necessary permissions to modify those files?

• Can you modify/create the code of those files to allow you place your own code to allow you to gain root access?

• Does the current user have unintended permissions to view/modify/run files?

• Is the application vulnerable to any existing privilege escalation exploits?

• Are there any files that contains sensitive information that you have access to?

Tools & Resources

Online Tools

• https://gtfobins.github.io/

• https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/

• https://swisskyrepo.github.io/InternalAllTheThings/redteam/escalation/linux-privilege-escalation/#summary

• TTY: https://swisskyrepo.github.io/InternalAllTheThings/cheatsheets/shell-reverse-cheatsheet/#spawn-tty-shell

• https://book.hacktricks.xyz/generic-methodologies-and-resources/reverse-shells/full-ttys

• https://github.com/RoqueNight/Reverse-Shell-TTY-Cheat-Sheet

• https://github.com/curtishoughton/Penetration-Testing-Cheat-Sheet/blob/master/Techniques/spawning-tty.md

• https://steflan-security.com/linux-tty-shell-cheat-sheet/

• https://exploit-notes.hdks.org/exploit/linux/privilege-escalation/

• https://github.com/Tib3rius/Pentest-Cheatsheets/blob/master/privilege-escalation/linux/linux.rst

Automated Tools

• https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS

• https://github.com/rebootuser/LinEnum

• https://github.com/The-Z-Labs/linux-exploit-suggester

• https://github.com/sleventyeleven/linuxprivchecker

• https://github.com/diego-treitos/linux-smart-enumeration

Resources

Sudo Exploits

• https://www.exploit-db.com/exploits/47502

Kernel Exploits

• https://github.com/lucyoa/kernel-exploits

• https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

Tools Documentation

• https://www.geeksforgeeks.org/strace-command-in-linux-with-examples/

• https://strace.io/

• https://linux.die.net/man/1/strings

• https://www.howtogeek.com/427805/how-to-use-the-strings-command-on-linux/

• https://www.geeksforgeeks.org/environment-variables-in-linux-unix/

• https://www.cherryservers.com/blog/how-to-set-list-and-manage-linux-environment-variables

• https://www.hackingarticles.in/linux-privilege-escalation-using-capabilities/

• https://mn3m.info/posts/suid-vs-capabilities/

• https://crontab.guru/#*_*_*_*_*

• https://www.geeksforgeeks.org/crontab-in-linux-with-examples/

Labs

• https://tryhackme.com/r/room/linuxprivescarena

• https://tryhackme.com/r/room/linuxprivesc

• https://tryhackme.com/r/room/linprivesc

• https://tryhackme.com/r/room/easyctf

• https://tryhackme.com/r/room/sudovulnsbypass

• https://tryhackme.com/r/room/sudovulnsbof

• https://tryhackme.com/r/room/vulnversity

• https://tryhackme.com/r/room/cmess

• https://tryhackme.com/r/room/ultratech1