Linux Privilege Escalation Cheatsheet

Linux Privilege Escalation

• Situational Awareness
  • enumerate-os-name-and-version-on-linux
  • path: echo $PATH
  • environment: (env || set) 2>/dev/null
  • am-i-inside-a-docker-container
  • groups?: groups
  • installed packages:
    • apt: apt list --manual-installed
    • dnf: dnf repoquery --userinstalled
    • pacman: pacman -Qe
  • listening services: ss -tulpn
  • defined hosts: cat /etc/hosts
  • find readable files owned by other users: find / ! -user <your-user> -readable | grep -vEi "^/(dev|proc|sys|run)/
  • check common directories:
    • ls -al /opt
    • ls -al /usr/local/bin
    • ls -al $HOME/.local/bin
    • ls -al ~/
  • sudo/doas? which sudo; which doas
  • defined hosts: cat /etc/hosts
  • running processes: ps aux
  • kernel version: uname -a

Related

Related Notes

All Related Notes

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "linux") OR contains(tags, "privesc")
SORT file.ctime DESC

linux

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "linux")
SORT file.ctime DESC

privesc

TABLE file.ctime as "Created", tags as "Tags"
FROM "New Notes"
WHERE contains(tags, "privesc")
SORT file.ctime DESC