Escalation

SUID / SGID

Find all the SUID/SGID executables

find / -type f -a \( -perm -u+s -o -perm -g+s \) -exec ls -l {} \; 2> /dev/null
find / -user root -perm /4000
find / -user root -perm -4000 -exec ls -ldb {} \;
find / -perm -u=s -type f 2>/dev/null

Escaping Vim

User has sudo privilege to run Vim

sudo vi
:!sh
 
Poof! ...Shell

Popular Tools

LinPEAS

LinPEAS is a script that search for possible paths to escalate privileges on Linux/Unix*/MacOS hosts.

• https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS

LinEnum

LinEnum is a simple bash script that performs common commands related to privilege escalation.

• https://github.com/rebootuser/LinEnum?tab=readme-ov-file

GTFOBins

GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.

• https://gtfobins.github.io/

Almost all my Linux Escalation notes, such as the Vim example, are techniques used through GTFOBins and should be your main resource moving past enumeration.