Linux Privilege Escalation

You have a low-privilege shell on a Linux target. Your objective is to escalate to root through systematic enumeration and exploitation of misconfigurations, vulnerable software, and kernel flaws. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques, prioritizing reliability and stealth.

Every engagement starts with situational awareness. Know what you have, what the system exposes, and what defenders can see. Chain low-severity findings into high-impact escalation paths.

Quick Workflow

1. Run automated enumeration (LinPEAS, linux-exploit-suggester) to surface quick wins.
2. Check sudo permissions, SUID/SGID binaries, and capabilities first -- these are the highest-probability vectors.
3. Enumerate cron jobs, writable scripts, and PATH ordering for hijack opportunities.
4. Inspect file permissions on /etc/passwd, /etc/shadow, service configs, and SSH keys.
5. Check for NFS shares with no_root_squash and Docker group membership.
6. Fingerprint the kernel version and search for applicable kernel exploits as a last resort.
7. Validate the escalation path, document the chain, and clean up artifacts.

Automated Enumeration