Physical attacks
Mobile Apps Pentesting
Pentesting

Checklist - Linux Privilege Escalation

Checklist for privilege escalation in Linux

Best tool to look for Linux local privilege escalation vectors: LinPEAS

  • Search for kernel exploits using scripts (linux.exploit-suggester.sh, inux-exploit-suggester2.pl, linuxprivcheckser.py)

  • Use Google to search for kernel exploits

  • Use searchsploit to search for kernel exploits

  • Is any unknown software running?

  • Is any software with more privileges that it should have running?

  • Search for exploits for running processes (specially if running of versions)

  • Can you read some interesting process memory (where passwords could be saved)?

  • Try to use every known password that you have discovered previously to login with each possible user. Try to login also without password.

  • Is the PATH being modified by some cron and you can write in it?

  • Some modifiable script is being executed or is inside modifiable folder?

  • Is some cron script calling other script that is modifiable by you? or using wildcards?

  • Have you detected that some script could be being executed very frequently? (every 1, 2 or 5 minutes)

  • Can you execute any comand with sudo? Can you use it to READ, WRITE or EXECUTE anything as root?

  • Is some wildcard used?

  • Is the binary specified without path?

  • Is env_keep+=LD_PRELOAD?

  • SUID any interesting command? Can you use it to READ, WRITE or EXECUTE anything as root?

  • Is some wildcard used?

  • Is the SUID binary executing some other binary without specifying the path? or specifying it?

  • Is it trying to load .so from writable folders?

  • Has any binary any uncommon capability?

  • screen?

  • tmux?

  • Can you read some interesting files? (files with passwords, *_history, backups...)

  • Are you able to write files that could grant you more privileges? (service conf files, shadow,a script that is executed by other users, libraries...)

  • You should check if any undiscovered service is running in some port/interface. Maybe it is running with more privileges that it should or it is vulnerable to some kind of privilege escalation vulnerability.

  • Can you sniff and get passwords from the network?

  1. Any well known missconfiguration? (NFS no_root_squash)