Linux Privilege Escalation Course 2024

Enumerate users by using whoami and id to distinguish root from normal accounts; inspect /etc/passwd and /etc/shadow, check groups, and review sudo -l and command history for privilege discovery.

Explore network enumeration techniques by identifying interfaces with ifconfig, routing with ip route, and active connections using netstat -ano, revealing ip addresses, ports, and sockets during privilege escalation.

Explores the shadow file in Unix-like systems, its root-only permissions, and how encrypted password data supports authentication, including basic references to cracking hashes with John the Ripper.

This lecture explains how a writable shadow file allows replacing a user password using sha-512 by editing the shadow entry to set a new password.

Examine how a writable EDC password file, exposing the password field as x, enables privilege escalation by generating a new hash with openssl and testing root access.

Cron jobs schedule commands on Unix-like systems via the cron daemon and cron tab using a five-field syntax to run scripts at set times.

Explore how misconfigured cron job file permissions enable a normal user to modify override dot asset and spawn a reverse shell with netcat, granting root access.

Explore how cron jobs and the path environment variable can enable privilege escalation, illustrated by a home directory script that cron executes to obtain a root shell.

Explore how cron job wildcards can trigger command execution via tar operations, using a crafted shell payload to escalate from a normal user to root.

Learn how to locate setuid and setgid files with the find command, identify suspicious executables like exim, and use a known exim privilege escalation exploit to obtain a root shell.

Explains how shared object injection, involving suid/sgid binaries, can enable privilege escalation and a root shell by manipulating library loading and configurations.

Explore how environment variables and suid executables enable privilege escalation, using strings to discover payloads, compiling a service, and leveraging path manipulation to obtain root access.

You learn how older bash versions (less than 4.2) allow defining a shell function with a path-like name, exporting it, and abusing a service to spawn a root shell.

Explore the fundamentals of the kernel, its role in resource management and hardware interfaces, and kernel exploitation techniques, including common vulnerabilities like buffer overflows, use-after-free, and TOCTOU races.

Identify the kernel version, locate a suitable exploit like dirty cow, compile cow.c with gcc, and run the local privilege escalation to obtain root access, with caution.

Explore practical privilege escalation on a Linux system by inspecting binary capabilities with getcap, focusing on vim's cap_setuid, and demonstrating how misconfigured binaries can backdoor privileged access to root.

Explore a practical nfs misconfiguration involving no root squash, where an attacker mounts a tmp share, crafts a suid shell, and escalates privileges to root using msf.

Use automated scripts to identify vulnerabilities for Linux privilege escalation, and perform smart enumeration to reveal exploitable CVEs and sensitive system data.