Practical Linux Privilege Escalation (with CTF challenges)

Define an operating system as software that manages hardware resources and provides abstractions for processes, memory, and devices, while distinguishing user space from kernel space via system calls in Linux.

Explore the history of Linux from Linus Torbalse's early hobby project to a dominant open source operating system, highlighting kernel and user space, GNU tools, and Android's rise.

Learn how Linux distributions differ mainly in package management, with rolling release and stable release models. Stay with one distribution, master its packages and commands, then switch if needed.

Explore Linux open source, view and study the source code, and compile your kernel and distribution; browse implementations like CBC and experiment with minimal kernels using KEMU and busybox.

Master the Linux shell, a command-line interface that interprets commands and interacts with the kernel. Explore sh and bash, and clarify terminal, TTY, and shell roles.

Explore the Linux file system by inspecting core directories like bin, boot, dev, and etc, and see how kernel images, bootloaders, and device files enable boot and operation.

Master essential linux shell commands using man pages, check kernel and PATH with uname and echo, navigate with pwd and cd, and manage aliases, history, and PS1 prompts.

Learn Linux file system commands to navigate and manage files and directories. List with ls, move with cd, create, copy, or delete using cp, mv, rm, including dot files.

Learn Linux file system permissions, reading and updating owner, group, and other access, with chmod, and understanding special cases like setuid, setgid, and sticky bits.

Explore Linux permission fundamentals, covering chown and chmod usage, user, group, and others ownership, recursive changes, and read, write, execute bits, with setuid note.

Explore Linux user management with passwd and shadow, learn how to read user data, and create, modify, or delete users and groups using commands like useradd, passwd, su, and chsh.

Master Linux resource management with uptime, top, htop, btop, mpstat, and free, and inspect disk, network, and processes using df, du, ip a, ps, and kill.

Learn to manage Linux packages with apt and apt-get: update metadata, install, simulate with -s, upgrade, remove or purge, and list, show, search, and clean downloaded package files.

Explore remote shell access as a precursor to privilege escalation, comparing bind shells and reverse shells, and why reverse shells with SSH are more practical due to outbound connections.

Explore file transfer commands for privilege escalation, using a lightweight http server, wget, curl, and language interpreters (perl, python, php) to move payloads to a compromised server and trigger shells.

Set up a bind shell by having the compromised host listen on a tcp port as the attacker connects. Use netcut with or without -e, or the socket utility.

Explore reverse shells and payload choices tied to installed tools. Learn how attackers listen on tcp ports and deploy multi-stage payloads with bash, python, perl, php, and ruby.

Upgrade a reverse shell by wrapping it with the LLLVrap utility to gain GNU readline features, including history and line editing, then spawn a PTY bash for an interactive session.

Explore Linux system enumeration as the first step in privilege escalation, covering hardware, kernel and distribution, users and groups, file systems, setuid binaries, local services, network interfaces, and automation scripts.

Explore cronjob enumeration in Linux privilege escalation. Learn cron configuration, enumeration methods, and exploitation using pspy and /proc, with a practical active box example.

Explore Linux capabilities, enable fine-grained privileges, and learn to enumerate and configure them with get cap and proc status, plus two privilege escalation examples using cap set uid and cap csp trace.

Learn how to escalate privileges by exploiting local services through ssh port forwarding, using local and remote port forwarding to access services bound to localhost.

Master path hijacking: exploit the shell's path resolution to run a malicious cut binary from the current directory, gaining root access. Defend by enforcing full paths or a safe PATH.

Explains how the set user ID bit lets a root-owned binary run with root privileges and access /etc/shadow, with examples like wget and ssh key gen.

Explore how to use the pseudo subsystem for root privilege escalation on Linux, guided by a docker setup and four practical misconfiguration exploits.

Explore how shell wildcard expansion enables privilege escalation by injecting malicious flags via crafted file names in tar, find, and rsync workflows, with practical attack scenarios.

Learn how to perform the unshadow attack by combining shadow and passwd files to crack password hashes, using salt and sha512-crypt, with John the Ripper and rockyou.txt.

Learn how to install and use GDB to inspect memory, registers, and control flow; disassemble, set breakpoints, view source and assembly, and leverage extensions for advanced debugging.

Explain how x86 32-bit and x86_64 calling conventions differ, showing 32-bit using the stack while 64-bit passes arguments in registers such as rdi and rsi.

Explore stack frames and the roles of rsp and rbp in function prologues and epilogues, and see how return addresses, arguments, and locals shape the call stack.

Shows a simple 32-bit buffer overflow on a vulnerable linux binary, hijacking the return address to spawn a shell. Includes nop sleds, shellcode, and a payload generator.

Explore memory protection mechanisms such as NX, stack canaries, ASLR, and PIE. Learn how these defenses shape binary exploitation and defense strategies.

Analyze how format string vulnerabilities arise when user input controls printf format strings, revealing how variadic functions and directives like %x and %n can leak registers, stack, or overwrite memory.

Explore Pwntools, a Python library that automates binary exploitation for local and remote targets, including shellcode generation and rop chains, with practical ctf-style examples.

Explore red to libc as a binary exploitation attack, with 32-bit and 64-bit demos showing nx and ASLR bypass, and using system calls and gadgets to spawn a shell.

disable aslr for a 32-bit ret2libc exercise, then craft a precise overflow payload to call system('/bin/sh') using libc base and offsets.

This lecture demonstrates a 64-bit ret2libc exploitation without ASLR by chaining gadgets like pop rdi and red, using roper to craft a payload that spawns a shell.

Automate a 64-bit ret2libc exploit using pwntools. Build a Python script that loads the binary and libc, finds gadgets, computes the offset, and crafts a payload to trigger system('/bin/sh').

Learn to bypass ASLR in 64-bit ret2libc by leaking a libc address with puts via plt/got, then spawn a shell.

this lecture demonstrates linux kernel exploitation with dirty cow, a copy-on-write race that enables privilege escalation by overwriting privileged files to create a root user.