> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/linux-privilege-escalation/linux-privilege-escalation-checklist.md). # Linux Privilege Escalation Checklist ## Checklist for Linux ### Access and Permission Checks

Check user's sudo privileges

List what commands the user can run as root, especially if there is a `.sudo_as_admin_successful` file in the users home directory. ```bash sudo -l ```

Check for SUID/SGID Files

**SUID** Locate SUID files (list filenames only) ```bash find / -type f -perm /4000 2>/dev/null ``` Locate SUID files (`ls`-like listing) ```bash find / -type f -perm /4000 -ls 2>/dev/null ``` **SGID** Locate SGID files (list filenames only) ```bash find / -type f -perm /2000 2>/dev/null ``` Locate SGID files (`ls`-like listing) ```bash find / -type f -perm /2000 -ls 2>/dev/null ``` **SUID or SGID** Locate SUID or SGID files (`ls`-like listing) ```bash find / -type f -perm /6000 -ls 2>/dev/null ``` or ```bash find / -type f -a $ -perm -u+s -o -perm -g+s $ -ls 2> /dev/null ```

Check for capabilities

Search the whole file system recursively for files with capabilities ```bash getcap -r / 2>/dev/null ```

Check for weak file permissions

Check for writeable `/etc/passwd` or accessable (read or write) `/etc/shadow` file ```bash ls -l /etc/passwd ls -l /etc/shadow ``` Check for readable SSH private files ```bash ls -l /home//.ssh ls -l /root/.ssh ``` Check for writeable `/etc/sudoers` file ```bash ls -l /etc/sudoers echo "`whoami` ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers ```

### Credential Checks

Check for passwords in history files

Check for passwords in user's history files ```bash ls -l ~/.*history cat ~/.*history | more ```

Check for DB password in wp-config.php

Check for database password(s) in the file `/var/www/html/wp-config.php` if the machine is running Wordpress ```bash www-data@ColddBox-Easy:/var/www/html$ cat wp-config.php // ** MySQL settings - You can get this info from your web host ** // /** The name of the database for WordPress */ define('DB_NAME', 'colddbox'); /** MySQL database username */ define('DB_USER', 'c0ldd'); /** MySQL database password */ define('DB_PASSWORD', 'cybersecurity'); <---snip---> ``` Reference: Also check if the password can be re-used for SSH-login etc.

Check for passwords in config.php files

Search for `config.php` files under `/var/www/html` and `grep` for passwords ```bash find . -name config.php | xargs grep -i password ```

Check for passwords in script files

Search for passwords in various script files ```bash find / -iname '*.sh' -or -iname '*.py' -or -iname '*.php' -or -iname '*.pl' 2>/dev/null | xargs grep -C 2 -i password ```

Check for credentials in e-mails

Check for credentials in e-mails under these directories ```bash ls -l /var/mail ls -l /var/spool/mail/ ```

Check for passwords in environment variables

Check environment variables for credentials or any other interesting info ```bash env ```

Check for passwords in .env files

```bash find / -type f -name .env 2>/dev/null ```

### Processes, Services and Cron job Checks

Check for running processes

**List processes for specific user(s)** List processes running as UID 0 (root) ```bash ps u -u 0 ``` List processes running as `root` or `kali` ```bash ps u -u root,kali ``` **List ALL running processes** With Unix options ```bash ps -ef ``` With BSD options, list output ```bash ps aux ``` With BSD options, tree view ```bash ps axjf ```

Check for listening services

Check for TCP & UDP services listening on 127.0.0.1 only ```bash netstat -tunlp | grep 127.0.0.1 ``` ```bash sudo netstat -tunlp | grep 127.0.0.1 ``` Check for all TCP-services listening ```bash netstat -tln ``` Check for all UDP-services listening ```bash netstat -uln ```

Check for Cron jobs

Check for: * Writable scripts or services * Abnormal directories in PATH variable Check current crontab ```bash crontab -l ``` Check scheduled task files ```bash ls -lah /etc/cron* ``` Check system-wide crontab ```bash cat /etc/crontab ``` Check for CRON-messages in syslog file ```bash grep "CRON" /var/log/syslog ```

### Search for interesting files

Check for hidden files and directories

Check for hidden files under `/home` ```bash find /home -type f -name '.*' 2>/dev/null ``` Check for hidden directories (excluding `/home`) ```bash find / -type d -not -path '/home/*' -name '.*' 2>/dev/null ``` Check for hidden directories (entire file system) ```bash find / -type d -name '.*' 2>/dev/null ```

Check for script files

Check for script files ```bash find / -iname '*.sh' -or -iname '*.csh' -or -iname '*.zsh' -or -iname '*.py' 2>/dev/null ``` Check for **writable** script files ```bash find / -writable -iname '*.sh' -or -iname '*.csh' -or -iname '*.zsh' -or -iname '*.py' 2>/dev/null ```

Check for alternate groups

Check if the current user is a member of any additional groups ```bash weston@national-treasure:~$ id uid=1001(weston) gid=1001(weston) groups=1001(weston),1000(cage) ``` And then search for files belonging to this group ```bash find / -type f -group cage 2>/dev/null ```

### Exploit Checks

Check for vulnerable kernel version

Check if the kernel version is vulnerable to known exploits

uname -a

**Overlayfs**\ Version: 3.13.0 < 3.19\ CVE: [CVE-2015-1328](https://nvd.nist.gov/vuln/detail/CVE-2015-1328)\ Exploit: **Dirty Cow**\ Version: 2.6.18 - 4.8.0\ CVE: [CVE-2016-5195](https://nvd.nist.gov/vuln/detail/CVE-2016-5195)\ Exploit: \ Ref:

Check for vulnerable policykit

Check the versions of these packages ```bash apt list policykit-1 apt list polkit ``` **Pwnkit**\ Version: <= 0.105-31\ CVE: [CVE-2021-4034](https://nvd.nist.gov/vuln/detail/cve-2021-4034)\ Exploit: \ Ref:

### Miscellaneous Checks

Check for file systems and disks

Check for both mounted and available file systems ```bash mount ``` ```bash cat /etc/fstab ``` ```bash lsblk ```

## World-writable Directories The three most commonly cited world-writable directories in Linux (typically with mode 1777 - world-writable plus the sticky bit set) are: 1. **`/tmp`** – The standard temporary directory. Any user can create, read, and execute files here, though the sticky bit means only the file's owner (or root) can delete or rename it. 2. **`/var/tmp`** – Similar purpose to `/tmp`, but intended for temporary files that should persist across reboots (files here are typically not cleared on boot, unlike `/tmp` on many distros). 3. **`/dev/shm`** – A tmpfs-backed shared memory directory. It's world-writable and backed by RAM, often used for inter-process communication or as scratch space, and is notably attractive for "fileless" payload execution since it's memory-backed and doesn't touch disk. ## References APT Privilege Escalation - Hacking Articles: capabilities - Linux manual page: Capability-based security - Wikipedia: cron - Wikipedia: **crontab**(1) - Linux manual page: crontab(5) - Linux manual page: **find** - Linux manual page: fstab - Linux manual page: **getcap** - Linux manual page: Linux - Privilege Escalation - Internal All The Things: Linux Capabilities - HackTricks: Linux Privilege Escalation using Capabilities - Hacking Articles: **lsblk** - Linux manual page: **mount** - Linux manual page: **netstat** - Linux manual page: Setuid - Wikipedia: **sudo** - Wikipedia: **xargs** - Linux manual page: