daemon-sec-cheatsheet

The cheatsheet vault for operators: AD, enumeration, exploitation, priv-esc, web, DFIR
git clone https://git.daemon-sec.xyz/daemon-sec-cheatsheet.git
Log | Files | Refs | README | LICENSE

linux-privilege-escalation.md (5067B)

      1 ---
      2 title: "Linux - Privilege Escalation"
      3 topic: "Methodology and Resources"
      4 topicSlug: "methodology-and-resources"
      5 sourcePath: "Methodology and Resources/Linux - Privilege Escalation.md"
      6 sourceUrl: "https://github.com/swisskyrepo/PayloadsAllTheThings/blob/3ac27901c711/Methodology%20and%20Resources/Linux%20-%20Privilege%20Escalation.md"
      7 sha: "3ac27901c711"
      8 isReadme: false
      9 ---
     10 
     11 # Linux - Privilege Escalation
     12 
     13 :warning: Content of this page has been moved to [InternalAllTheThings/redteam/persistence/linux-persistence](/internal/redteam/escalation/linux-privilege-escalation)
     14 
     15 - [Tools](/internal/redteam/escalation/linux-privilege-escalation#tools)
     16 - [Checklist](/internal/redteam/escalation/linux-privilege-escalation#checklists)
     17 - [Looting for passwords](/internal/redteam/escalation/linux-privilege-escalation#looting-for-passwords)
     18     - [Files containing passwords](/internal/redteam/escalation/linux-privilege-escalation#files-containing-passwords)
     19     - [Old passwords in /etc/security/opasswd](/internal/redteam/escalation/linux-privilege-escalation#old-passwords-in-etcsecurityopasswd)
     20     - [Last edited files](/internal/redteam/escalation/linux-privilege-escalation#last-edited-files)
     21     - [In memory passwords](/internal/redteam/escalation/linux-privilege-escalation#in-memory-passwords)
     22     - [Find sensitive files](/internal/redteam/escalation/linux-privilege-escalation#find-sensitive-files)
     23 - [SSH Key](/internal/redteam/escalation/linux-privilege-escalation#ssh-key)
     24     - [Sensitive files](/internal/redteam/escalation/linux-privilege-escalation#sensitive-files)
     25     - [SSH Key Predictable PRNG (Authorized_Keys) Process](/internal/redteam/escalation/linux-privilege-escalation#ssh-key-predictable-prng-authorized_keys-process)
     26 - [Scheduled tasks](/internal/redteam/escalation/linux-privilege-escalation#scheduled-tasks)
     27     - [Cron jobs](/internal/redteam/escalation/linux-privilege-escalation#cron-jobs)
     28     - [Systemd timers](/internal/redteam/escalation/linux-privilege-escalation#systemd-timers)
     29 - [SUID](/internal/redteam/escalation/linux-privilege-escalation#suid)
     30     - [Find SUID binaries](/internal/redteam/escalation/linux-privilege-escalation#find-suid-binaries)
     31     - [Create a SUID binary](/internal/redteam/escalation/linux-privilege-escalation#create-a-suid-binary)
     32 - [Capabilities](/internal/redteam/escalation/linux-privilege-escalation#capabilities)
     33     - [List capabilities of binaries](/internal/redteam/escalation/linux-privilege-escalation#list-capabilities-of-binaries)
     34     - [Edit capabilities](/internal/redteam/escalation/linux-privilege-escalation#edit-capabilities)
     35     - [Interesting capabilities](/internal/redteam/escalation/linux-privilege-escalation#interesting-capabilities)
     36 - [SUDO](/internal/redteam/escalation/linux-privilege-escalation#sudo)
     37     - [NOPASSWD](/internal/redteam/escalation/linux-privilege-escalation#nopasswd)
     38     - [LD_PRELOAD and NOPASSWD](/internal/redteam/escalation/linux-privilege-escalation#ld_preload-and-nopasswd)
     39     - [Doas](/internal/redteam/escalation/linux-privilege-escalation#doas)
     40     - [sudo_inject](/internal/redteam/escalation/linux-privilege-escalation#sudo_inject)
     41     - [CVE-2019-14287](/internal/redteam/escalation/linux-privilege-escalation#cve-2019-14287)
     42 - [GTFOBins](/internal/redteam/escalation/linux-privilege-escalation#gtfobins)
     43 - [Wildcard](/internal/redteam/escalation/linux-privilege-escalation#wildcard)
     44 - [Writable files](/internal/redteam/escalation/linux-privilege-escalation#writable-files)
     45     - [Writable /etc/passwd](/internal/redteam/escalation/linux-privilege-escalation#writable-etcpasswd)
     46     - [Writable /etc/sudoers](/internal/redteam/escalation/linux-privilege-escalation#writable-etcsudoers)
     47 - [NFS Root Squashing](/internal/redteam/escalation/linux-privilege-escalation#nfs-root-squashing)
     48 - [Shared Library](/internal/redteam/escalation/linux-privilege-escalation#shared-library)
     49     - [ldconfig](/internal/redteam/escalation/linux-privilege-escalation#ldconfig)
     50     - [RPATH](/internal/redteam/escalation/linux-privilege-escalation#rpath)
     51 - [Groups](/internal/redteam/escalation/linux-privilege-escalation#groups)
     52     - [Docker](/internal/redteam/escalation/linux-privilege-escalation#docker)
     53     - [LXC/LXD](/internal/redteam/escalation/linux-privilege-escalation#lxclxd)
     54 - [Hijack TMUX session](/internal/redteam/escalation/linux-privilege-escalation#hijack-tmux-session)
     55 - [Kernel Exploits](/internal/redteam/escalation/linux-privilege-escalation#kernel-exploits)
     56     - [CVE-2022-0847 (DirtyPipe)](/internal/redteam/escalation/linux-privilege-escalation#cve-2022-0847-dirtypipe)
     57     - [CVE-2016-5195 (DirtyCow)](/internal/redteam/escalation/linux-privilege-escalation#cve-2016-5195-dirtycow)
     58     - [CVE-2010-3904 (RDS)](/internal/redteam/escalation/linux-privilege-escalation#cve-2010-3904-rds)
     59     - [CVE-2010-4258 (Full Nelson)](/internal/redteam/escalation/linux-privilege-escalation#cve-2010-4258-full-nelson)
     60     - [CVE-2012-0056 (Mempodipper)](/internal/redteam/escalation/linux-privilege-escalation#cve-2012-0056-mempodipper)