hacktricks/linux-unix/linux-privilege-escalation-checklist.md

description
Checklist for privilege escalation in Linux

Checklist - Linux Privilege Escalation

Best tool to look for Linux local privilege escalation vectors: LinPEAS****

System Information

• Get OS information
• Check the PATH, any writable folder?
• Check env variables, any sensitive detail?
• Search for kernel exploits using scripts DirtyCow?
• Check if the sudo version is vulnerable
• ****Dmesg signature verification failed error?
• More system enum [date, system stats, cpu info, printers](privilege-escalation/#more-system-enumeration)
• Enumerate more defenses

Drives

• List mounted drives
• Any unmounted drive?
• Any creds in fstab?

****Installed Software****

1. Check for useful software installed
2. Check for vulnerable software installed

****Processes

• Is any unknown software running?
• Is any software with more privileges that it should have running?
• Search for exploits for running processes specially if running of versions
• Can you modify the binary of any running process?
• Monitor processes and check if any interesting process is running frequently
• Can you read some interesting process memory where passwords could be saved?

Scheduled/Cron jobs?

• Is the PATH being modified by some cron and you can write in it?
• Any wildcard in a cron job?
• Some modifiable script is being executed or is inside modifiable folder?
• Have you detected that some script could be being executed very frequently? every 1, 2 or 5 minutes

Services

• Any writable .service file?
• Any writable binary executed by a service?
• Any writable folder in systemd PATH?

Timers

• Any writable timer?

Sockets

• Any writable .socket file?
• Can you communicate with any socket?
• HTTP sockets with interesting info?

D-Bus

• Can you communicate with any D-Bus?

Network

• Enumerate the network to know where you are
• Open ports you couldn't access before getting a shell inside the machine?
• Can you sniff traffic using tcpdump?

Users

• Generic users/groups enumeration
• Do you have a very big UID? Is the machine vulnerable?
• Can you escalate privileges thanks to a group you belong to?
• Clipboard data?
• Password Policy?
• Try to use every known password that you have discovered previously to login with each possible user. Try to login also without password.

Writable PATH

• If you have write privileges over some folder in PATH you may be able to escalate privileges

SUDO and SUID commands

• Can you execute any comand with sudo? Can you use it to READ, WRITE or EXECUTE anything as root? [**GTFOBins**](https://gtfobins.github.io/)
• Is any exploitable suid binary? [**GTFOBins**](https://gtfobins.github.io/)
• Are sudo commands limited by path? can you bypass the restrictions?
• ****Sudo/SUID binary without path indicated?
• ****SUID binary specifying path? Bypass
• ****LD_PRELOAD vuln****
• ****Lack of .so library in SUID binary ****from a writable folder?
• ****SUDO tokens available? Can you create a SUDO token?
• Can you read or modify sudoers files?
• Can you modify /etc/ld.so.conf.d/?
• OpenBSD DOAS ****command

Capabilities

• Has any binary any unexpected capability?

ACLs

• Has any file any unexpected ACL?

Open Shell sessions

• screen?
• tmux?

SSH

• Debian OpenSSL Predictable PRNG - CVE-2008-0166****
• ****SSH Interesting configuration values****

Interesting Files

• Profile files - Read sensitive data? Write to privesc?
• passwd/shadow files - Read sensitive data? Write to privesc?
• Check commonly interesting folders for sensitive data
• Weird Localtion/Owned files, you may have access or alter executable files
• Modified in last mins
• Sqlite DB files
• Hidden files
• Script/Binaries in PATH
• Web files passwords?
• Backups?
• Known files that contains passwords: Use Linpeas and LaZagne
• Generic search

****Writable Files****

• Modify python library to execute arbitrary commands?
• Can you modify log files? Logtotten exploit
• Can you modify /etc/sysconfig/network-scripts/? Centos/Redhat exploit
• Can you write in ini, int.d, systemd or rc.d files?

****Other tricks****

• Can you abuse NFS to escalate privileges?
• Do you need to escape from a restrictive shell?

If you want to know about my latest modifications/additions or you have any suggestion for HackTricks or PEASS, join the PEASS & HackTricks telegram group here.
If you want to share some tricks with the community you can also submit pull requests to ****https://github.com/carlospolop/hacktricks ****that will be reflected in this book.
Don't forget to give ⭐ on the github to motivate me to continue developing this book.

​Buy me a coffee here****