Linux Privilege Escalation Cheatsheet

Things to do during the privilege escalation phase of a Linux machine pentest

Stabilize your shell

• python3 -c "import pty; pty.spawn('/bin/bash')" -> spawn a bash session
• export TERM=xterm -> set shell to standard TERM value
• Fully stabilize into bash shell:

Remote:  python3 -c 'import pty; pty.spawn("/bin/bash")'
Remote:  export TERM=xterm
          Ctrl+Z
Local:   stty raw -echo; fg
          Enter
Remote:  reset

Automated Enum & PrivEsc Sweep

• Run LinEnum -> automates common local enumeration checks
• Run LinPeas -> automates local privesc checks.

While waiting for these to finish running, you can manually check for privilege escalation vectors in the following order:-

Manual Checks

• sudo -l -> lists utilities with root privileges that the current user can run

• find / -not -type l -perm -o+w -> lists all files editable by any user regardless of permissions

Enumerating system information (finding vulnerable versions):-

• hostname
• cat /etc/issue & cat /etc/*issue -> OS distribution info
• uname -a -> kernel distribution
• lscpu -> CPU information
• df -h -> file systems
• cat /etc/shells -> list of installed shells

Users and groups enumeration:-

• cat /etc/passwd -> all user and service accounts
• cat /etc/passwd | grep -v /nologin -> user accounts only
• w and who -> check who is currently logged on
• lastlog

Check for processes and cron jobs:-

• ps aux
• top -> lists all running processes
• crontab -l -> cron jobs for the current user
• cat /etc/crontab -> all cron jobs on the system
• Check /etc/cron.d directory

Examine network configuration of the machine (for pivoting etc.)

• ip a s -> all internet interfaces
• arp -a -> lists other devices on the network
• cat /etc/resolve.conf -> DNS information (e.g. primary nameserver)
• netstat -ano -> All Listening TCP and UDP connections