DB.
Courses

Linux Privilege Escalation
OSCP · Chapter 14

Linux Privilege Escalation

Linux privilege escalation mirrors the Windows chapter conceptually but with different mechanisms: SUID binaries, sudo misconfigurations, cron jobs, and kernel exploits are the main avenues from a low-privileged shell to root.

Key concepts

  • SUID/SGID binaries that run as root but can be abused (via GTFOBins-style tricks) to spawn a root shell are one of the most common wins.
  • `sudo -l` reveals what commands the current user can run as root — misconfigured wildcard or path-less entries are frequently exploitable.
  • World-writable cron jobs or scripts run by root are a classic and quiet privilege escalation path.
  • Kernel exploits are a last resort — they are noisy, version-specific and can crash the box, so exhaust configuration-based vectors first.

Example

find / -perm -4000 -type f 2>/dev/null   # find SUID binaries
sudo -l                                    # list allowed sudo commands

Try it yourself

On a lab VM, run the SUID find command above and cross-reference any unusual binaries against GTFOBins to see if a known privilege-escalation technique exists for it.

ReferenceSearch video walkthroughs

@ Daniel Burlacu