Performing Privilege Escalation on Linux

Overview

Linux privilege escalation involves elevating from a low-privilege user account to root access on a compromised system. Red teams exploit misconfigurations, vulnerable services, kernel exploits, and weak permissions to achieve root. This guide covers both manual enumeration techniques and automated tools for identifying and exploiting privilege escalation vectors.

MITRE ATT&CK Mapping

• T1548.001 - Abuse Elevation Control Mechanism: Setuid and Setgid
• T1548.003 - Abuse Elevation Control Mechanism: Sudo and Sudo Caching
• T1068 - Exploitation for Privilege Escalation
• T1574.006 - Hijack Execution Flow: Dynamic Linker Hijacking
• T1053.003 - Scheduled Task/Job: Cron
• T1543.002 - Create or Modify System Process: Systemd Service

Key Escalation Vectors

SUID/SGID Binaries

• Find SUID binaries: find / -perm -4000 -type f 2>/dev/null
• Check GTFOBins for exploitation methods
• Custom SUID binaries may have vulnerabilities

Sudo Misconfigurations

• sudo -l to list allowed commands
• Wildcards in sudo rules allow injection
• NOPASSWD entries for dangerous commands
• sudo versions vulnerable to CVE-2021-3156 (Baron Samedit)

Kernel Exploits

• Dirty Cow (CVE-2016-5195) for older kernels
• Dirty Pipe (CVE-2022-0847) for kernel 5.8+
• PwnKit (CVE-2021-4034) for pkexec
• GameOver(lay) (CVE-2023-2640, CVE-2023-32629) for Ubuntu

Cron Job Abuse

• World-writable cron scripts
• PATH hijacking in cron jobs
• Wildcard injection in cron commands

Capabilities

• getcap -r / 2>/dev/null to find binaries with capabilities
• cap_setuid allows UID manipulation
• cap_dac_override bypasses file permissions

Writable Service Files

• Systemd unit files with weak permissions
• Init scripts writable by non-root users
• Socket files in accessible locations

Tools and Resources

Tool	Purpose
LinPEAS	Automated privilege escalation enumeration
LinEnum	Linux enumeration script
linux-exploit-suggester	Kernel exploit matching
pspy	Process monitoring without root
GTFOBins	SUID/sudo binary exploitation reference
PEASS-ng	Privilege escalation awesome scripts suite

Validation Criteria

• [ ] Enumeration performed using automated tools
• [ ] Privilege escalation vector identified
• [ ] Root access achieved through identified vector
• [ ] Evidence documented (screenshots, command output)
• [ ] Alternative escalation paths identified

Compliance Framework Mapping

This skill supports compliance evidence collection across multiple frameworks:

• SOC 2: CC4.1 (Monitoring & Evaluation), CC7.1 (Monitoring)
• ISO 27001: A.14.2 (Secure Development), A.18.2 (Information Security Reviews)
• NIST 800-53: CA-8 (Penetration Testing), RA-5 (Vulnerability Scanning)
• NIST CSF: ID.RA (Risk Assessment), PR.IP (Information Protection)

Claw GRC Tip: When this skill is executed by a registered agent, compliance evidence is automatically captured and mapped to the relevant controls in your active frameworks.

Deploying This Skill with Claw GRC

Agent Execution

Register this skill with your Claw GRC agent for automated execution:

# Install via CLI
npx claw-grc skills add performing-privilege-escalation-on-linux

# Or load dynamically via MCP
grc.load_skill("performing-privilege-escalation-on-linux")

Audit Trail Integration

When executed through Claw GRC, every step of this skill generates tamper-evident audit records:

• SHA-256 chain hashing ensures no step can be modified after execution
• Evidence artifacts (configs, scan results, logs) are automatically attached to relevant controls
• Trust score impact — successful execution increases your agent's trust score

Continuous Compliance

Schedule this skill for recurring execution to maintain continuous compliance posture. Claw GRC monitors for drift and alerts when re-execution is needed.