Linux Privilege Escalation: Enumeration and Exploitation

Identifying Misconfigurations and Weaknesses

Once you have a map of the system, you look for the "low-hanging fruit"—misconfigurations that allow for easy escalation without needing a complex exploit.

SUID/GUID Binaries

One of the most common Linux escalation vectors involves SUID (Set User ID) or GUID (Set Group ID) bits. When a binary has the SUID bit set, it executes with the permissions of the file's owner rather than the user running it. For example, the passwd command has the SUID bit set so that users can modify the /etc/shadow file (which is owned by root) to change their own passwords.

If you find a custom script or a non-standard binary with the SUID bit set, it may be vulnerable to command injection or buffer overflows, allowing you to spawn a root shell. You can find these binaries using: find / -type f \( -perm -4000 -o -perm -2000 \) -exec ls -l {} \;.

Weak Permissions and Hardcoded Passwords

Permissions management is often imperfect. If a sensitive file or a directory used by an administrator is "world-writable," any user can modify it. An attacker might modify a script that a root-level cron job runs, effectively gaining root access the next time the job executes.

Additionally, look for hardcoded passwords. Developers often leave credentials in plain text within scripts, configuration files, or log files. You can search the entire filesystem for these using grep: grep -R -i "password" /.

Exam Tip: When searching for sensitive information, always check the command history (.bash_history) and SSH directories (~/.ssh/). System administrators sometimes leave private keys (id_rsa) lying around, which can be reused to access other accounts or even root.

Exploiting Services and the Kernel

If enumeration and misconfiguration checks fail, you must move toward more aggressive techniques: targeting services and the kernel itself.

Vulnerable Services

Services are often the "weakest link" because they are frequently left unpatched or configured with default, insecure settings. For instance, a database service like SQL might be running with root permissions and using default administrative credentials.

To find these, first list all running processes with ps -ef and identify which ones are running as root. Then, use package managers like dpkg -l or rpm -qa to find the version of the installed application and search for known vulnerabilities on databases like Exploit-DB.

Kernel Exploits

The "last resort" in privilege escalation is the kernel exploit. Because the kernel manages the entire system, a successful exploit can grant total control. However, kernel exploits are dangerous; they can cause the target system to behave unpredictably or crash entirely.

Common historical examples include:

• DirtyCow (CVE-2016-5195): Affecting Linux kernels < 3.9.
• CVE-2014-4014: Affecting Linux kernels <= 3.13.

Always verify the kernel version using uname -a before attempting an exploit to ensure compatibility.

Summary of the Escalation Workflow

To succeed in Linux privilege escalation, follow a structured methodology:

1. Enumerate: Identify user, kernel, and network context.
2. Search for Low-Hanging Fruit: Check SUID binaries, weak file permissions, and scheduled cron jobs.
3. Credential Hunting: Scour history files, environment variables, and configuration files for hardcoded passwords or SSH keys.
4. Service Analysis: Identify running services and check for unpatched versions or default credentials.
5. Kernel Exploitation: If all else fails, identify the kernel version and attempt a targeted exploit, exercising extreme caution.

Warning: Never use tools or exploits on live systems if you do not fully understand their function. Improperly executed exploits can break systems and cause significant operational damage.