Offensive Linux Privilege Escalation

A structured, hands-on reference on escalating from a low-privileged Linux foothold to root — enumeration and methodology, sudo and SUID abuse, capabilities, cron and systemd timers, kernel exploits, container and namespace escapes, and credential mining — written from an offensive-security perspective (escalate, then detect and defend).

Warning

Educational use only These are personal study notes. Every technique here is documented for use only against systems you own or are explicitly authorized to test (your own lab, a CTF, an authorized engagement). Escalating privileges on a host you do not have written permission to assess is unlawful in most jurisdictions. Examples use lab placeholders (10.10.14.7 attacker, a VM you control) — substitute your own.

What's inside

• 50+ notes organized by escalation vector, each in a consistent shape: concept → hands-on enumeration/exploitation (bash) → detection → defenses → related notes.
• Full vector coverage — automated enumeration (LinPEAS/LinEnum/pspy + an in-repo bash enum script), sudo misconfig & version bypasses (GTFOBins, LD_PRELOAD, Baron Samedit, sudo -u#-1), SUID/SGID & shared-library/PATH hijacking, Linux capabilities, cron & systemd-timer abuse, kernel LPEs (DirtyCow, DirtyPipe, OverlayFS, PwnKit), NFS no_root_squash, Docker/LXD group & namespace escapes, session/IPC abuse (screen/tmux, D-Bus), and credential mining (configs, history, backups, SSH keys, memory).
• A methodology checklist, a hardening consolidation, two guided labs + a lab-setup script, and two skills assessments.

Map of Content

Methodology & enumeration

Note	Covers
Enumeration Script (bash)	Dependency-free auto-discovery of every vector, mapped to its note
Enumeration & Analysis Tools	LinPEAS, LinEnum, linux-smart-enum, pspy, exploit-suggester
System & Kernel Enumeration · User Details · Applications & Services · Network Interfaces	Situational awareness
Finding Last-Edited Files · pspy Process Snooping	Spot changing files and root jobs

Sudo

Note	Covers
Sudo Privilege Escalation (index)	sudoers misconfig, shell escapes, GTFOBins
Spawning Root via Sudo · Custom binaries/scripts	Exploiting allowed commands
LD_PRELOAD via sudo · Version & Policy Bypasses	Env abuse; sudo -u#-1, Baron Samedit

SUID, permissions & capabilities

Note	Covers
Permissions in Linux (index)	SUID/SGID, ACLs, special permissions
Finding & Reviewing SUID/SGID · Special Permissions · Critical File Permissions · ACLs	Finding and abusing perms
SUID Privilege Escalation (index) · Shared-Library Misconfig · PATH Hijacking	SUID exploitation
Linux Capabilities	getcap, cap_setuid, cap_dac_*

Cron & systemd timers

Note	Covers
Cron Jobs & Systemd Timers (index)	Scheduled-task escalation
File Overwrite · PATH · Wildcards · Cron logs · Systemd Timers	Cron/timer techniques

Kernel exploits

Note	Covers
Dirty COW · DirtyPipe (CVE-2022-0847) · OverlayFS · PwnKit (CVE-2021-4034) · Baron Samedit (CVE-2021-3156)	Kernel/SUID-helper LPEs

Containers, NFS & IPC

Note	Covers
Container & Docker Escape · LXD/LXC Group · Namespace & Unshare Escape	Container/group/namespace escapes
NFS Root Squashing	no_root_squash to root
Screen & Tmux Hijacking · D-Bus	Session and IPC abuse
MySQL UDF Exploitation	DB-to-OS root

More techniques & recent CVEs

Note	Covers
Sudo chroot (CVE-2025-32462/63) · udisks/PAM (CVE-2025-6018/19) · Below symlink (CVE-2025-27591)	2025 local-root CVEs
Writable sudoers · SSH Agent Hijacking · Python Library-Path Hijacking	sudoers/agent/interpreter abuse
at & systemd-run Jobs · Rsync Wildcard Injection · Logrotate (Logrotten) · Snap Dirty Sock	schedulers, wildcards, log races, snapd

Credential mining

Note	Covers
Password Mining (index)	Config files, history/logs, backups, SSH keys, memory, home dirs

Defense & labs

Note	Covers
Linux Hardening	Defensive checklist closing every vector
Labs	Lab setup, guided walkthroughs, and skills assessments
Flashcards	Spaced-repetition revision decks (Q::A)

How to read

• On GitHub — every note is fully readable and its cross-references are relative Markdown links clickable in the GitHub web UI; tables and callouts render inline. Start here and follow the Map of Content.
• Also great in Obsidian — clone the repo and open the folder as a vault; the same relative links resolve, so click-through, backlinks, and graph view all work.

Conventions

• Commands target a Linux target with a Kali attacker unless noted; adapt IPs, paths, and usernames.
• Addresses, credentials, and filenames are lab placeholders — replace them with your own.
• PoCs that were not run in-place are marked with a # untested comment.
• Every technique note pairs detection and defense guidance — documented to be understood and defended against, not just executed.

License

Content is licensed under Creative Commons Attribution 4.0 International (CC BY 4.0) — you may share and adapt it with attribution. Published standalone at armourinfosec/Offensive-Linux-Privilege-Escalation. All techniques are documented for authorized testing and education only; verify every command in an isolated lab before use.