srl
Linux Privilege Escalation Enumeration
A consolidated reference for enumerating attack vectors on Linux targets, from first shell to root. Commands are grouped by category; exploitation primitives follow each enumeration section where relevant.
Table of Contents Helpful Tools Processes and Jobs Kernel and OS User-Related Network Related Finding Interesting Files and Directories Process Memory and Sudo Token Reuse Systemd Unit Abuse Logrotate ld.so.preload — Universal Linker Hijack SUID / SGID / Capabilities Sudo Abuse Kernel and Userland Exploits Container and Namespace Escape D-Bus, Screen, and Tmux Session Abuse SUID Shared-Library and Linker Abuse Writable /etc/passwd / /etc/shadow Credential Hunting Open File Descriptors Consolidated Enumeration One-Liners Priority Quick Actions Field Notes from the HTB List Helpful Tools Tool Notes LinPEAS Broad automated enumeration; default first pass LinEnum Lighter-weight shell alternative pspy Watches process spawns without root — exposes cron and systemd timer execution paths unix-privesc-check Legacy file-permission auditing linux-exploit-suggester Kernel exploit correlation lse.sh Linux smart enumeration CDK Container-specific enumeration and escape primitives deepce Docker/container enumeration from inside a container uptux Single-file Python script specialized in systemd, D-Bus, socket units, and writable unit paths SUDO_KILLER Focused on sudo misconfigurations, CVE detection, and token reuse privmap Graph-based path modeling — traces www-data → writable logrotate config → root cron → root, reporting paths rather than isolated findings # uptux wget https://raw.githubusercontent.com/initstring/uptux/master/uptux.py python3 uptux.py # SUDO_KILLER wget https://raw.githubusercontent.com/TH3xACE/SUDO_KILLER/master/SUDO_KILLER.sh bash SUDO_KILLER.sh # privmap pip install privmap sudo privmap Processes and Jobs Command Description ps aux | grep root See processes running as root ./pspy64 -pf -i 1000 View running processes with pspy cat /etc/crontab System-wide cron table ls -la /etc/cron.daily Check for daily Cron jobs ls -la /etc/cron.* /etc/at* /var/spool/cron/crontabs/ 2>/dev/null Enumerate all cron locations crontab -l Current user’s cron grep -i cron /var/log/syslog /var/log/cron 2>/dev/null Enumerate cron jobs (second file on RHEL/CentOS) journalctl -u cron --no-pager Cron activity on journald-only hosts systemctl list-timers --all systemd timers — frequently missed because they are not cron atq List queued at jobs ls -la /var/spool/cron/atjobs/ 2>/dev/null at job files busctl --system list D-Bus services that may expose privileged methods lpstat Active or queued print jobs (sensitive information) Cron exploitation notes: If a cron job runs a script that calls another binary by relative name, the job’s PATH or the script’s writable directory becomes the target. pspy is the fastest way to confirm a job is firing and to observe its exact command line and working directory. at/batch jobs are cron-adjacent and less scrutinized — a root-scheduled at job running a script in a writable directory is exploitable exactly like a writable cron script: