Links

Checklist - Linux Privilege Escalation

HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch Wed - 18.30(UTC) 🎙️ - 🎥 Youtube 🎥​
​Follow HackenProof to learn more about web3 bugs
🐞 Read web3 bug tutorials
🔔 Get notified about new bug bounties
💬 Participate in community discussions

Best tool to look for Linux local privilege escalation vectors: LinPEAS​

​System Information​

​Drives​

  • List mounted drives
  • Any unmounted drive?
  • Any creds in fstab?

​Installed Software​

​Processes​

  • Is any unknown software running?
  • Is any software running with more privileges than it should have?
  • Search for exploits of running processes (especially the version running).
  • Can you modify the binary of any running process?
  • Monitor processes and check if any interesting process is running frequently.
  • Can you read some interesting process memory (where passwords could be saved)?

​Services​

  • Any writable .service file?
  • Any writable binary executed by a service?
  • Any writable folder in systemd PATH?

​Timers​

  • Any writable timer?

​Sockets​

  • Any writable .socket file?
  • Can you communicate with any socket?
  • HTTP sockets with interesting info?

​D-Bus​

  • Can you communicate with any D-Bus?

​Network​

  • Enumerate the network to know where you are
  • Open ports you couldn't access before getting a shell inside the machine?
  • Can you sniff traffic using tcpdump?

​Users​

  • Generic users/groups enumeration
  • Do you have a very big UID? Is the machine vulnerable?
  • Clipboard data?
  • Password Policy?
  • Try to use every known password that you have discovered previously to login with each possible user. Try to login also without a password.

​Writable PATH​

  • If you have write privileges over some folder in PATH you may be able to escalate privileges

​Capabilities​

  • Has any binary any unexpected capability?

​ACLs​

  • Has any file any unexpected ACL?
  • screen
  • tmux

​SSH​

​Interesting Files​

  • Profile files - Read sensitive data? Write to privesc?
  • passwd/shadow files - Read sensitive data? Write to privesc?
  • Check commonly interesting folders for sensitive data
  • Weird Location/Owned files, you may have access to or alter executable files
  • Modified in last mins
  • Sqlite DB files
  • Hidden files
  • Script/Binaries in PATH
  • Web files (passwords?)
  • Backups?
  • Known files that contains passwords: Use Linpeas and LaZagne
  • Generic search

​Writable Files​

  • Modify python library to execute arbitrary commands?
  • Can you modify log files? Logtotten exploit
  • Can you modify /etc/sysconfig/network-scripts/? Centos/Redhat exploit

​Other tricks​

​Follow HackenProof to learn more about web3 bugs
🐞 Read web3 bug tutorials
🔔 Get notified about new bug bounties
💬 Participate in community discussions
HackTricks in 🐦 Twitter 🐦 - 🎙️ Twitch Wed - 18.30(UTC) 🎙️ - 🎥 Youtube 🎥​