The Complete Linux Privilege Escalation Course

Create a TryHackMe account by clicking join now, entering a username, email, and password, and completing the verification steps, then verify your email and explore your dashboard.

Join the Lynch Privilege Escalation Trial Hackney Room from lecture resources, then download the OpenVPN configuration and connect to the cloud lab network.

Learn why and how to connect to the Army OpenVPN to access machines on the tri Acme network, enabling communication between networks by joining the same OpenVPN network.

Insecure permissions on the ETSI password file enable root access and credential manipulation to reveal the flag in a lab setting.

Explore how read-write access to /etc/shadow can enable privilege escalation by replacing root's sha-512 password hash with a crafted one, and why secure machines matter.

Practice Linux privilege escalation by exploiting misconfigured sudo permissions to spawn a root shell via vim, nano, or find, referencing GTFOBins to elevate privileges and explore ld preload.

Explore how environment variables such as ld_preload enable loading of cert libraries to influence programs and demonstrate privilege escalation via sudo to root.

explore wildcard injection in cron jobs and show how a non-privileged user could manipulate scripts to add themselves to the sudoers file and gain root access.

Navigate to the home directory, inspect the VPN files directory, and read the OpenVPN file to retrieve credentials via cat and cut. Understand how improper permissions expose usernames and passwords.

Examine how LXD combines container and virtual machine capabilities with image-based Linux distributions, built on LXC, and how the LXD socket can expose root access.

Explain how the network file system enables remote file access, how misconfigurations can allow privilege escalation to root, and the attacker steps to exploit an NFS service.

Identify and enumerate vulnerable NFS shares by inspecting the Nefesh service configuration and exports, using showmount and exports to reveal insecure mounts that could grant root access.

Explores how vulnerable NFS shares enable privilege escalation to root by mounting the remote share, copying and setting ownership and permissions on a binary, and executing it.

Identify suid vulnerabilities by scanning the Linux file system for scada binaries, spotting anomalies like nano, and preparing to learn how to gain root access with suid on nano.

Exploit the setuid permissions to gain root access by editing /etc/sudoers with nano, adding your user, then using sudo to become root and view the root flag.