> For the complete documentation index, see [llms.txt](https://infosecsanyam261.gitbook.io/tryharder/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://infosecsanyam261.gitbook.io/tryharder/priv-escalation/linux-priv-escalation.md).

# Linux Priv Escalation

```
# priv esc enumeration scripts
https://github.com/rebootuser/LinEnum
https://github.com/reider-roque/linpostexp/blob/master/linprivchecker.py
http://pentestmonkey.net/tools/audit/unix-privesc-check

# Kernel and OS
uname -a
uname -mrs
cat /etc/issue
cat /etc/lsb-release      # Debian based
cat /etc/redhat-release   # Redhat based

# running services and find services run boy root
ps aux
ps aux | grep root

# which applications are installed
dpkg -l
ls -alh /usr/bin/
ls -alh /sbin/

# scheduled tasks
crontab -l

# port forwarding
ssh -L 8080:127.0.0.1:80 root@192.168.1.7    # Local Port
ssh -R 8080:127.0.0.1:80 root@192.168.1.7    # Remote Port

# tunneling
ssh -D 127.0.0.1:9050 -N [username]@[ip]
proxychains ifconfig

# sensitive files
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/

# check home dirs
ls -ahlR /root/
ls -ahlR /home

# private key search
cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key


# Sticky Bits & SUID & GUID

find / -perm -1000 -type d 2>/dev/null   # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here.
find / -perm -g=s -type f 2>/dev/null    # SGID (chmod 2000) - run as the group, not the user who started it.
find / -perm -u=s -type f 2>/dev/null    # SUID (chmod 4000) - run as the owner, not the user who started it.
find / -perm -g=s -o -perm -u=s -type f 2>/dev/null    # SGID or SUID




```

### Linux Privilege Escalation Checklist 

![](https://3412915462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LkvnWByFHssLOYr3_77%2F-M45DNbLcWG-8Fe-sDMe%2F-M45DsEIFCM9tp-veast%2Fimage.png?alt=media\&token=7ab8855f-6fb9-4fd5-b8a4-b52a4b3c9ed4)

### Binaries/Programs Privilege Escalation

![](https://3412915462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LkvnWByFHssLOYr3_77%2F-M45DNbLcWG-8Fe-sDMe%2F-M45EAbfxPZ_j17uzQXL%2Fimage.png?alt=media\&token=18261337-bfb9-4820-8af4-9cf1c49014a2)

### Automated Script

![](https://3412915462-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-LkvnWByFHssLOYr3_77%2F-M45DNbLcWG-8Fe-sDMe%2F-M45EQjV6WH2UhWOR6QY%2Fimage.png?alt=media\&token=fe32a81a-c1e7-42ba-a292-d4ba9ebc076b)