Linux privilege escalation: enumeration

Enumeration before exploitation. This is the manual first pass I run on a fresh Linux foothold before reaching for an automated script — the automation misses context, and running these by hand builds the instinct for what "wrong" looks like. Everything here is read-only; nothing changes state on the target.

Note

Authorized testing and lab use only. Run these against systems you have written permission to test.

Who and where am I #

bash

id                      # uid, gid, and — importantly — supplementary groups
whoami
hostname
cat /etc/os-release     # distro and version → known-kernel/pkg CVEs
uname -a                # kernel version and architecture

Groups are the part people skim past. Membership in docker, lxd, disk, or sudo is frequently a direct path to root on its own — note them now.

Sudo rights #

bash

sudo -l                 # what this user may run as root, possibly passwordless

If anything comes back, check each binary against GTFOBins before anything else. A single misconfigured sudo entry often ends the escalation before it starts.

SUID and capabilities #

bash

# SUID binaries — runs as the file owner regardless of caller
find / -perm -4000 -type f 2>/dev/null

# File capabilities — a subtler equivalent people forget to check
getcap -r / 2>/dev/null

Compare the results against a stock install of the same distro. The interesting entries are the ones that shouldn't be there; a cap_setuid on an unexpected binary is as good as SUID root.

Cron and scheduled tasks #

bash

cat /etc/crontab
ls -la /etc/cron.* 2>/dev/null
cat /etc/cron.d/* 2>/dev/null

You're looking for a root-run job that touches a file or directory you can write to, or that calls a script by a relative path. Either turns a scheduled task into a scheduled shell.

Writable files that matter #

bash

# World-writable files, excluding the noise under /proc and /sys
find / -writable -type f 2>/dev/null | grep -vE '^/(proc|sys)'

# Can you write where you shouldn't?
ls -la /etc/passwd /etc/shadow /etc/sudoers 2>/dev/null

Credentials left lying around #

bash

# History files
cat ~/.bash_history 2>/dev/null

# Config and env files that tend to hold secrets
grep -rIl -e password -e secret -e api_key /etc /opt /var/www 2>/dev/null

# SSH keys
find / -name 'id_rsa*' -o -name '*.pem' 2>/dev/null

Network — what else is reachable #

bash

ss -tulpn               # listening sockets and the processes behind them
ip a
cat /etc/hosts

A service bound to 127.0.0.1 is one you can reach from this foothold but an external scan could not — often the most interesting thing on the box.

Reading the results #

Escalation rarely comes from one line of output. It comes from a chain: a writable script that a root cron job runs, or a group membership that unlocks a device that unlocks the filesystem. Collect everything first, then look for where two findings meet. The single-finding wins get patched; the chains are what survive to the engagement.