In a nutshell You've landed on a Linux box as a low user (often
www-data) and want root. Privilege escalation is a methodical hunt through a short list of usual suspects —sudorules, SUID binaries, cron jobs, writable files, forgotten credentials, an old kernel. It's 90% enumeration; the exploit is usually the last, small step.
The mindset: enumerate, then strike
Root rarely comes from a magic exploit — it comes from something misconfigured or forgotten (see Privilege escalation — the idea). The work is systematic checking; linpeas.sh runs the whole checklist in seconds, but you must understand each hit.
Analogy — searching a house for a spare key. You don't smash the safe. You check the usual hiding spots in order: under the mat, the drawer, the plant pot. The key (root) is almost always in one of the known spots.
The usual suspects — in order
id ; sudo -l # 1. who am I, what may I run as root?
find / -perm -4000 -type f 2>/dev/null # 2. SUID binaries
cat /etc/crontab ; ls -la /etc/cron.* # 3. root cron jobs
uname -a # 4. kernel version → known exploit?
grep -riE "password|secret" /var/www 2>/dev/null # 5. creds in files
cat ~/.bash_history # 5. creds in history
| Suspect | Why it wins | The move |
|---|---|---|
sudo -l |
you may run a tool as root | find, vim, less, python… can spawn a shell — see GTFOBins |
| SUID binary | runs as root | unexpected one → GTFOBins → root |
| root cron | runs on a schedule as root | if it runs a writable script, replace its contents and wait |
| writable trusted file | root process reads/runs it | swap in your command |
| stored creds | reuse is everywhere | config, .bash_history, .git, databases |
| old kernel/service | known CVE | powerful but noisier — check misconfigs first |
The single highest-value command
sudo -l lists what you may run as root — often without a password. If it names anything — even an "innocent" find, tar, awk or python — it's frequently game over, because these can be made to spawn a root shell. The site GTFOBins is the catalog of exactly which binaries, and the one-liner for each.
The defender's flip
Every path is a hardening rule
- grant sudo narrowly, require a password
- minimize & audit SUID binaries
- cron scripts not writable by others
...remove the misconfig
- no secrets in files
- patch the kernel and services
- then the low foothold stays low