Skip to content
SudoSecurity

Sections

intermediate · privesc · 200 points · 0 working it

Privilege Escalation Enumeration

You have a low-privilege shell on a Linux box. Enumerate the classic escalation surface before touching anything.

  1. Check sudo rights first

    The fastest path to root is sudo misconfiguration. The first command every pentester runs after gaining a shell lists what the user may run as root.

    Which single command lists your sudo permissions?

    Hint

    Two words: sudo plus a flag letter.

    Sign in to verify this checkpoint.

  2. Read the account file

    Local accounts and their shells live in the system password file. Even unprivileged users can read it — world-readable by design.

    Which file lists every local account? (absolute path)

    Hint

    It sits in /etc.

    Sign in to verify this checkpoint.

  3. Hunt SUID binaries

    find / -perm -4000 2>/dev/null lists binaries that run with the file owner's privileges. GTFOBins documents which of them hand you a root shell. The permission bit name is the checkpoint.

    What is the name of the permission bit that makes a binary run as its owner?

    Hint

    Set user ___.

    Sign in to verify this checkpoint.