Typorithm · hard

Linux PrivEsc

linux-privescpentestlinuxsuidgtfobins

Saved on this device

Full lesson · 8 learning steps Open any exercise for focused practice

Step 1 of 8 · intro card

Learn Linux PrivEsc

Privilege Escalation

On an authorized Linux engagement you enumerate escalation paths — sudo rights, SUID binaries, cron jobs, capabilities, and writable files. linpeas automates the hunt and GTFOBins shows how a permitted binary becomes a root shell. Each finding maps to a misconfiguration whose remediation is removing it and applying least privilege.

Linux privilege escalation, during an authorized test, starts with enumeration: sudo -l shows what you may run as another user, find / -perm -4000 -type f lists SUID binaries that execute as their owner, and you also check cron jobs, file capabilities, and world-writable files.

linpeas automates that hunt, surfacing the same paths in one pass so nothing is missed. When a permitted binary turns up, GTFOBins documents the exact way it can be abused — for example a SUID or sudo-allowed editor or interpreter that can spawn a shell as root.

The deliverable is not the shell but the report. Every path maps to a concrete misconfiguration, and the remediation is to remove it: strip needless SUID bits, tighten sudoers to least privilege, and lock down writable files and cron scripts.

sudo -l and SUID search reveal escalation paths.

linpeas automates enumeration; GTFOBins documents abuse.

Remediation: remove SUID, least-privilege sudoers.

sudo -l
./linpeas.sh
find / -perm -4000 -type f 2>/dev/null
# GTFOBins: abuse a SUID or sudo binary

Read the implementation

Connect each part of the code to the concept before you type.

1. List sudo rights

sudo -l lists which commands the current user may run with sudo — a permitted binary is often the escalation path the report flags.

sudo -l

2. Automated enumeration

linpeas automates the hunt, flagging sudo rights, SUID files, cron jobs, capabilities, and writable paths in one pass.

./linpeas.sh

3. Find SUID binaries

-perm -4000 matches files with the SUID bit set, which run as their owner (often root); 2>/dev/null hides permission-denied noise.

find / -perm -4000 -type f 2>/dev/null

4. GTFOBins abuse

GTFOBins documents how a permitted SUID or sudo binary can be coaxed into spawning a root shell.

# GTFOBins: abuse a SUID or sudo binary

5. Suppress errors

Redirecting stderr to /dev/null keeps the find output clean across thousands of inaccessible paths.

2>/dev/null

A complete learning loop

Understand

Read the concept map and follow the code breakdown.

Reconstruct

Type the implementation, repair mistakes and work through every recall exercise.

Verify

Use the final check without hints; revisit weak concepts in short practice sessions.