> For the complete documentation index, see [llms.txt](https://chinnidiwakar.gitbook.io/githubimport/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://chinnidiwakar.gitbook.io/githubimport/linux-unix/linux-privilege-escalation-checklist.md). # Checklist - Linux Privilege Escalation Checklist for privilege escalation in Linux ## **Best tool to look for Linux local privilege escalation vectors:** [**LinPEAS**](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/tree/master/linPEAS)\*\*\*\* ## [System Information](/githubimport/linux-unix/privilege-escalation.md#system-information) * [ ] Get **OS information** * [ ] Check the [**PATH**](/githubimport/linux-unix/privilege-escalation.md#path), any **writable folder**? * [ ] Check [**env variables**](/githubimport/linux-unix/privilege-escalation.md#env-info), any sensitive detail? * [ ] Search for [**kernel exploits**](/githubimport/linux-unix/privilege-escalation.md#kernel-exploits) **using scripts** (DirtyCow?) * [ ] **Check** if the [**sudo version** is vulnerable](/githubimport/linux-unix/privilege-escalation.md#sudo-version) * [ ] \*\*\*\*[**Dmesg** signature verification failed](/githubimport/linux-unix/privilege-escalation.md#dmesg-signature-verification-failed) error? * [ ] More system enum ([date, system stats, cpu info, printers](/githubimport/linux-unix/privilege-escalation.md#more-system-enumeration)) * [ ] [Enumerate more defenses](/githubimport/linux-unix/privilege-escalation.md#enumerate-possible-defenses) ## [Drives](/githubimport/linux-unix/privilege-escalation.md#drives) * [ ] **List mounted** drives * [ ] **Any unmounted drive?** * [ ] **Any creds in fstab?** ## \*\*\*\*[**Installed Software**](/githubimport/linux-unix/privilege-escalation.md#installed-software)\*\*\*\* * [ ] **Check for**[ **useful software**](/githubimport/linux-unix/privilege-escalation.md#useful-software) **installed** * [ ] **Check for** [**vulnerable software**](/githubimport/linux-unix/privilege-escalation.md#vulnerable-software-installed) **installed** ## \*\*\*\*[Processes](/githubimport/linux-unix/privilege-escalation.md#processes) * [ ] Is any **unknown software running**? * [ ] Is any software with **more privileges that it should have running**? * [ ] Search for **exploits for running processes** (specially if running of versions) * [ ] Can you **modify the binary** of any running process? * [ ] **Monitor processes** and check if any interesting process is running frequently * [ ] Can you **read** some interesting **process memory** (where passwords could be saved)? ## [Scheduled/Cron jobs?](/githubimport/linux-unix/privilege-escalation.md#scheduled-jobs) * [ ] Is the [**PATH** ](/githubimport/linux-unix/privilege-escalation.md#cron-path)being modified by some cron and you can **write** in it? * [ ] Any [**wildcard** ](/githubimport/linux-unix/privilege-escalation.md#cron-using-a-script-with-a-wildcard-wildcard-injection)in a cron job? * [ ] Some [**modifiable script** ](/githubimport/linux-unix/privilege-escalation.md#cron-script-overwriting-and-symlink)is being **executed** or is inside **modifiable folder**? * [ ] Have you detected that some **script** could be being [**executed** very **frequently**](/githubimport/linux-unix/privilege-escalation.md#frequent-cron-jobs)? (every 1, 2 or 5 minutes) ## [Services](/githubimport/linux-unix/privilege-escalation.md#services) * [ ] Any **writable .service** file? * [ ] Any **writable binary** executed by a **service**? * [ ] Any **writable folder in systemd PATH**? ## [Timers](/githubimport/linux-unix/privilege-escalation.md#timers) * [ ] Any **writable timer**? ## [Sockets](/githubimport/linux-unix/privilege-escalation.md#sockets) * [ ] Any **writable .socket** file? * [ ] Can you **communicate with any socket**? * [ ] **HTTP sockets** with interesting info? ## [D-Bus](/githubimport/linux-unix/privilege-escalation.md#d-bus) * [ ] Can you **communicate with any D-Bus**? ## [Network](/githubimport/linux-unix/privilege-escalation.md#network) * [ ] Enumerate the network to know where you are * [ ] **Open ports you couldn't access before** getting a shell inside the machine? * [ ] Can you **sniff traffic** using `tcpdump`? ## [Users](/githubimport/linux-unix/privilege-escalation.md#users) * [ ] Generic users/groups **enumeration** * [ ] Do you have a **very big UID**? Is the **machine** **vulnerable**? * [ ] Can you [**escalate privileges thanks to a group**](/githubimport/linux-unix/privilege-escalation/interesting-groups-linux-pe.md) you belong to? * [ ] **Clipboard** data? * [ ] Password Policy? * [ ] Try to **use** every **known password** that you have discovered previously to login **with each** possible **user**. Try to login also without password. ## [Writable PATH](/githubimport/linux-unix/privilege-escalation.md#writable-path-abuses) * [ ] If you have **write privileges over some folder in PATH** you may be able to escalate privileges ## [SUDO and SUID commands](/githubimport/linux-unix/privilege-escalation.md#sudo-and-suid) * [ ] Can you execute **any comand with sudo**? Can you use it to READ, WRITE or EXECUTE anything as root? ([**GTFOBins**](https://gtfobins.github.io/)) * [ ] Is any **exploitable suid binary**? ([**GTFOBins**](https://gtfobins.github.io/)) * [ ] Are [**sudo** commands **limited** by **path**? can you **bypass** the restrictions](/githubimport/linux-unix/privilege-escalation.md#sudo-execution-bypassing-paths)? * [ ] \*\*\*\*[**Sudo/SUID binary without path indicated**](/githubimport/linux-unix/privilege-escalation.md#sudo-command-suid-binary-without-command-path)? * [ ] \*\*\*\*[**SUID binary specifying path**](/githubimport/linux-unix/privilege-escalation.md#suid-binary-with-command-path)? Bypass * [ ] \*\*\*\*[**LD\_PRELOAD vuln**](/githubimport/linux-unix/privilege-escalation.md#ld_preload)\*\*\*\* * [ ] \*\*\*\*[**Lack of .so library in SUID binary**](/githubimport/linux-unix/privilege-escalation.md#suid-binary-so-injection) *\*\**from a writable folder? * [ ] \*\*\*\*[**SUDO tokens available**](/githubimport/linux-unix/privilege-escalation.md#reusing-sudo-tokens)? [**Can you create a SUDO token**](/githubimport/linux-unix/privilege-escalation.md#var-run-sudo-ts-less-than-username-greater-than)? * [ ] Can you [**read or modify sudoers files**](/githubimport/linux-unix/privilege-escalation.md#etc-sudoers-etc-sudoers-d)? * [ ] Can you [**modify /etc/ld.so.conf.d/**](/githubimport/linux-unix/privilege-escalation.md#etc-ld-so-conf-d)? * [ ] [**OpenBSD DOAS**](/githubimport/linux-unix/privilege-escalation.md#doas) *\*\**command ## [Capabilities](/githubimport/linux-unix/privilege-escalation.md#capabilities) * [ ] Has any binary any **unexpected capability**? ## [ACLs](/githubimport/linux-unix/privilege-escalation.md#acls) * [ ] Has any file any **unexpected ACL**? ## [Open Shell sessions](/githubimport/linux-unix/privilege-escalation.md#open-shell-sessions) * [ ] **screen**? * [ ] **tmux**? ## [SSH](/githubimport/linux-unix/privilege-escalation.md#ssh) * [ ] **Debian** [**OpenSSL Predictable PRNG - CVE-2008-0166**](/githubimport/linux-unix/privilege-escalation.md#debian-openssl-predictable-prng-cve-2008-0166)\*\*\*\* * [ ] \*\*\*\*[**SSH Interesting configuration values**](/githubimport/linux-unix/privilege-escalation.md#ssh-interesting-configuration-values)\*\*\*\* ## [Interesting Files](/githubimport/linux-unix/privilege-escalation.md#interesting-files) * [ ] **Profile files** - Read sensitive data? Write to privesc? * [ ] **passwd/shadow files** - Read sensitive data? Write to privesc? * [ ] **Check commonly interesting folders** for sensitive data * [ ] **Weird Localtion/Owned files,** you may have access or alter executable files * [ ] **Modified** in last mins * [ ] **Sqlite DB files** * [ ] **Hidden files** * [ ] **Script/Binaries in PATH** * [ ] **Web files** (passwords?) * [ ] **Backups**? * [ ] **Known files that contains passwords**: Use **Linpeas** and **LaZagne** * [ ] **Generic search** ## \*\*\*\*[**Writable Files**](/githubimport/linux-unix/privilege-escalation.md#writable-files)\*\*\*\* * [ ] **Modify python library** to execute arbitrary commands? * [ ] Can you **modify log files**? **Logtotten** exploit * [ ] Can you **modify /etc/sysconfig/network-scripts/**? Centos/Redhat exploit * [ ] Can you [**write in ini, int.d, systemd or rc.d files**](/githubimport/linux-unix/privilege-escalation.md#init-init-d-systemd-and-rc-d)? ## \*\*\*\*[**Other tricks**](/githubimport/linux-unix/privilege-escalation.md#other-tricks)\*\*\*\* * [ ] Can you [**abuse NFS to escalate privileges**](/githubimport/linux-unix/privilege-escalation.md#nfs-privilege-escalation)? * [ ] Do you need to [**escape from a restrictive shell**](/githubimport/linux-unix/privilege-escalation.md#escaping-from-restricted-shells)? If you want to **know** about my **latest modifications**/**additions** or you have **any suggestion for HackTricks or PEASS**, **join the** [**💬**](https://emojipedia.org/speech-balloon/) [**PEASS & HackTricks telegram group here**](https://t.me/peass), or **follow me on Twitter** [🐦](https://emojipedia.org/bird/)[**@carlospolopm**](https://twitter.com/carlospolopm)**.**\ If you want to **share some tricks with the community** you can also submit **pull requests** to **\*\*\[**) **\*\*that will be reflected in this book.**\ **Don't forget to** give ⭐ on the github\*\* to motivate me to continue developing this book. ![](https://4153509160-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-MaoGr_g3I50alM2whW0%2Fsync%2F4c4968b48f0ebf20a73e46cd07c9315dc629c00c.png?generation=1622227467459076\&alt=media) ​[**Buy me a coffee here**](https://www.buymeacoffee.com/carlospolop)\*\*\*\*