## https://sploitus.com/exploit?id=8D7A85F8-2982-5965-8EB2-117651E2FA1E
# Linux Privilege Escalation - Notes & Techniques
A comprehensive collection of Linux privilege escalation techniques, vectors, and exploitation methods for penetration testing and security auditing.
## Overview
This repository contains detailed notes on various Linux privilege escalation techniques, from misconfigurations to kernel exploits. Each section includes enumeration methods, exploitation techniques, and defensive measures.
## Topics Covered
### 1. [Sudo Misconfigurations](SUDO.md)
- `sudo -l` enumeration
- `NOPASSWD` and `ALL` rules
- Shell-spawnable binaries (vim, find, awk, less)
- GTFOBins exploitation
- CVE-2025-32462 and CVE-2025-32463
### 2. [SUID/SGID Binaries](SUID_SGID.md)
- Finding SUID/SGID binaries
- GTFOBins shell escapes
- Shared object hijacking (LD_PRELOAD)
- PATH hijacking
- Writable SUID binaries
- POSIX capabilities exploitation
### 3. [Linux Capabilities](CAPABILITIES.md)
- Understanding capability sets (E, P, I, B)
- Dangerous capabilities:
- `CAP_SETUID` / `CAP_SETGID`
- `CAP_SYS_ADMIN`
- `CAP_DAC_OVERRIDE`
- `CAP_SYS_PTRACE`
- `CAP_SYS_MODULE`
- File vs process capabilities
- Capability inheritance exploitation
### 4. [Cron Jobs](CRON.md)
- System-wide vs user crontabs
- Writable cron scripts
- Writable cron directories
- PATH hijacking in cron
- Wildcard injection (tar, chown, rm)
- Systemd timers
- Symbolic link attacks
### 5. [Writable System Files](WRITABLE_FILES.md)
- Critical system files:
- `/etc/sudoers`
- `/etc/passwd` / `/etc/shadow`
- `/etc/profile` / `/etc/bash.bashrc`
- PAM configuration
- SSH configuration
- `/etc/ld.so.preload` exploitation
- Writable libraries
- Writable kernel modules
- Profile and environment files
### 6. [PATH Hijacking](PATH_HIJACKING.md)
- Understanding PATH resolution order
- Finding writable PATH directories
- Cron and SUID binary exploitation
- Scripts with relative paths
- Symlink attacks
- PATH precedence exploitation
### 7. [Environment Variable Abuse](ENV_VARS.md)
- `LD_PRELOAD` and `LD_LIBRARY_PATH`
- `IFS` (Internal Field Separator)
- `EDITOR` / `VISUAL` exploitation
- `PAGER` hijacking
- `BASH_ENV` and `ENV`
- Python (`PYTHONPATH`), Perl (`PERL5LIB`), Node.js (`NODE_PATH`)
- SSH `PermitUserEnvironment`
### 8. [Kernel Vulnerabilities](KERNEL.md)
- Major CVEs:
- Dirty COW (CVE-2016-5195)
- Dirty Pipe (CVE-2022-0847)
- Copy Fail (CVE-2026-31431)
- DirtyCred (CVE-2022-2588)
- Dirty Frag (CVE-2026-43500/43284)
- RefluXFS (CVE-2026-64600)
- PwnKit (CVE-2021-4034)
- Exploit selection and execution
- Defensive measures (patching, live patching)
### 9. [Service Misconfigurations](SERVICES.md)
- Systemd service files
- Init scripts (`/etc/init.d/`)
- xinetd services
- Writable service binaries
- Service user misconfigurations
- Dangerous service options
- Socket activation
- Service dependencies
- Temporary file races
### 10. [NFS Misconfigurations](NFS.md)
- No root squash (`no_root_squash`)
- Writable NFS shares
- UID/GID mapping exploits
- Insecure export options
- SUID binary upload
- Chroot/jail escape
### 11. [Docker/Container Misconfigurations](DOCKER.md)
- Docker group membership (= root access)
- Privileged containers
- Mounted host directories (`-v /:/host`)
- Docker socket exploitation
- Dangerous capabilities
- Host namespace sharing (`--net=host`, `--pid=host`)
- Container escape techniques
- CVE-2019-5736 (runC)
## Tools & Resources
### Enumeration Scripts
- [LinPEAS](https://github.com/carlospolop/PEASS-ng) - Linux Privilege Escalation Awesome Script
- [LinEnum](https://github.com/rebootuser/LinEnum) - Linux Enumeration Script
- [Linux Exploit Suggester](https://github.com/mzet-/linux-exploit-suggester)
- [deepce](https://github.com/stealthcopter/deepce) - Docker Enumeration
### References
- [GTFOBins](https://gtfobins.github.io/) - Shell escape techniques
- [Exploit-DB](https://www.exploit-db.com/) - Public exploits
- [Linux Capabilities Guide](https://man7.org/linux/man-pages/man7/capabilities.7.html)