the_open_door
coffee
ESEN
← Cheatsheets

Privilege escalation · Linux

Every Linux escalation vector seen across the boxes, with the exact command: sudo, SUID, capabilities, cron, services, PATH, files, kernel.

grep>

Enumeration

Enumeration24 commands
  • Quick / scripts
  • Files of interest
  • Credentials: search files
  • Credentials: tools
  • Credentials: browser
  • Credentials: encrypted archive
  • Writable
  • Disks & mounts

Permissions & binaries

sudo & GTFOBins43 commands
  • Enumerate
  • Direct shell (GTFOBins)
  • Read files
  • Write files
  • Via variables / libraries
  • CVE
SUID / SGID / capabilities26 commands
  • Enumerate
  • Shell with -p (GTFOBins)
  • Read files
  • Custom binary / PATH
  • capabilities
PATH & libraries10 commands
  • PATH hijack
  • LD_PRELOAD
  • LD_LIBRARY_PATH

Jobs & services

Cron & jobs12 commands
  • Enumerate
  • Script/task abuse
  • Tools
Services & systemd10 commands
  • Enumerate
  • Writable ExecStart
  • systemctl (sudo/pager)
  • Timers
  • Tools

Files & kernel

Files, groups & containers17 commands
  • /etc/passwd
  • Docker / LXC
  • NFS
  • Other
Kernel & local exploits13 commands
  • Identify
  • Suggesters
  • Known exploits