Escalate Linux Privileges Systematically

Provides a systematic methodology for Linux privilege escalation assessments - identifying and exploiting misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root. It covers kernel vulnerabilities, sudo misconfigurations, SUID binaries, cron jobs, Linux capabilities, PATH hijacking, and NFS weaknesses. It is explicitly scoped to authorized security assessments, defensive validation, or controlled educational environments only.

Use only for authorized security assessments, defensive validation, or controlled educational environments per the skill's own banner, with written authorization required before testing and strict adherence to defined scope boundaries. Requires low-privilege shell access to the target, an attacker machine for payload hosting, and basic familiarity with Linux permissions, kernel versions, and compilation (gcc).

Deliverables: root shell access on the target, a privilege escalation path writeup, a system enumeration findings report, and remediation recommendations, backed by evidence artifacts (screenshots, command logs, identified vulnerability details, exploited config files).

The nine-phase methodology: System enumeration (hostname, kernel version, OS release, current user/groups, network interfaces, running processes, environment variables including PATH); automated enumeration via LinPEAS, LinEnum, Linux Smart Enumeration, and Linux Exploit Suggester, transferred to the target via a simple HTTP server; kernel exploits matched to version (Dirty COW/CVE-2016-5195, Double Fetch/CVE-2017-16995, Dirty Pipe/CVE-2022-0847), compiled with gcc and executed; sudo exploitation via sudo -l enumeration and GTFOBins-referenced techniques (vim, find, awk, python, less invoked with sudo to spawn a root shell) plus LD_PRELOAD abuse when env_keep permits it; SUID binary exploitation (finding SUID files via find / -perm -u=s, then using GTFOBins techniques like base64 for reading /etc/shadow or cp+chmod+s for a rooted bash copy); capabilities exploitation via getcap -r / followed by cap_setuid-abusing one-liners in python/vim/perl; cron job exploitation (enumerating /etc/crontab and cron directories, injecting a reverse-shell payload into a writable script a root cron job executes); PATH hijacking (reverse-engineering which external command a SUID binary calls, then placing a malicious binary earlier in PATH); and NFS exploitation (checking for no_root_squash in /etc/exports, mounting the share, and compiling a SUID shell binary on it from the attacker side).

A quick-reference table maps each enumeration goal to its command (kernel version, sudo rights, SUID files, capabilities, cron jobs, writable directories, NFS exports), and reverse shell one-liners are given for bash, Python, Netcat, and Perl.

Operational constraints: verify kernel exploits in a test environment first since failed attempts can crash the system; document all changes made during escalation; modern kernels may have exploit mitigations (ASLR, SMEP, SMAP) and AppArmor/SELinux may restrict techniques; container environments limit kernel-level exploits. Legal requirements: written authorization is required before testing, stay within scope, report critical findings immediately, and never access data beyond scope requirements.

Worked examples include sudo-to-root via a NOPASSWD find entry, shadow-file extraction via a SUID base64 binary followed by offline cracking with John the Ripper, and cron-script hijacking that plants a SUID bash copy.

References LinPEAS/PEASS-ng, LinEnum, Linux Smart Enumeration, Linux Exploit Suggester, GTFOBins for binary-exploitation techniques, and John the Ripper/Hashcat for offline password cracking.

Security testers and defenders conducting authorized Linux privilege escalation assessments who need a structured enumeration-to-exploitation methodology across kernel, sudo, SUID, capabilities, cron, PATH, and NFS attack surfaces, plus matching remediation guidance.