Linux Privilege Escalation: Exploiting SUID, Sudo, Kernel Bugs, and Misconfigurations
A systematic playbook for identifying and exploiting vectors to escalate from low-privilege user to root on Linux systems.
1. The Linux Privilege Model
In Linux, user ID 0 (root) holds unrestricted administrative authority over hardware, filesystems, network sockets, and processes.
When an ethical hacker or attacker compromises a web service, the initial shell typically runs as a service account (such as `www-data` or `nobody`). Escalating to root is required to capture flags or audit enterprise defenses.
2. Discovering and Exploiting SUID Binaries
When the SUID bit is set on an executable, it runs with the file owner's privileges. While system utilities like `passwd` require this legitimately, misconfigurations can lead to immediate root access.
# Find all SUID binaries owned by root on the filesystem
find / -perm -4000 -user root -type f 2>/dev/null
# Example: If 'find' has SUID bit set (GTFOBins technique):
/usr/bin/find . -exec /bin/sh -p \; -quit
# You are now running an interactive root shell!3. Sudo Privileges and Misconfigured Rules
Running `sudo -l` is the first command every analyst executes upon landing on a Linux shell. It lists the commands the current user can execute as root.
If a binary like `vim`, `less`, `awk`, or `nmap` is present in `sudo -l` with `NOPASSWD`, an attacker can leverage built-in shell escape commands to spawn an elevated shell.
# Check sudo permissions
sudo -l
# If 'less' can be run as root without password:
sudo less /etc/profile
# Inside less, type: !/bin/sh and press Enter -> Root Shell!4. Automated Enumeration with LinPEAS
Scripts like LinPEAS (Linux Privilege Escalation Awesome Script) search for thousands of known misconfigurations, weak file permissions in `/etc/passwd`, vulnerable kernel releases, and unquoted cron paths within seconds.