offensive-linux-privesc

1# Linux Privilege Escalation
2 
3You have a low-privilege shell on a Linux target. Your objective is to escalate to root through systematic enumeration and exploitation of misconfigurations, vulnerable software, and kernel flaws. This skill provides a structured methodology that moves from passive reconnaissance through increasingly aggressive techniques, prioritizing reliability and stealth.
4 
5Every engagement starts with situational awareness. Know what you have, what the system exposes, and what defenders can see. Chain low-severity findings into high-impact escalation paths.
6 
7## Quick Workflow
8 
91. Run automated enumeration (LinPEAS, linux-exploit-suggester) to surface quick wins.
102. Check sudo permissions, SUID/SGID binaries, and capabilities first -- these are the highest-probability vectors.
113. Enumerate cron jobs, writable scripts, and PATH ordering for hijack opportunities.
124. Inspect file permissions on /etc/passwd, /etc/shadow, service configs, and SSH keys.
135. Check for NFS shares with no_root_squash and Docker group membership.
146. Fingerprint the kernel version and search for applicable kernel exploits as a last resort.
157. Validate the escalation path, document the chain, and clean up artifacts.
16 
17---
18 
19## Automated Enumeration
20 
21Before manual inspection, run automated tools to surface the broadest set of findings. Pipe output to a file for offline review and cross-referencing.
22 
23```bash
24# LinPEAS -- transfer and execute
25…