Privilege Escalation
Deck 12. Horizontal and vertical privilege escalation on Linux, the passwd/group/shadow files, and escalation through weak file permissions, sudo shell-escapes, cron jobs and SUID binaries.
Privilege escalation means going from a lower permission to a higher one. It exploits a vulnerability, design flaw or misconfiguration in an OS or application to gain access to resources normally restricted from the user — often reaching system administrator (root) level.
Once escalated, an attacker can reset passwords, bypass access controls to reach protected data, edit software configurations, enable persistence (to return later), and change the privileges of other users.
Two directions of escalationSearch on YouTube
Horizontal privilege escalationSearch on YouTube
Taking over a different user at the same privilege level. For example, gaining access to another normal user who happens to have an SUID file in their home directory, which can then be used to reach super-user access.
Vertical privilege escalationSearch on YouTube
Going from a low privilege to a higher one. The attacker gets an initial limited shell as a basic user, enumerates the system to find a path to root, and on reaching root has full control of the Linux system.
Horizontal = sideways (same level, another user). Vertical = upward (low to root).
Common vertical escalation routes: weak file permissions, security misconfigurations, kernel-level exploits, shell-escape sequences, and cron jobs.
Three key account filesSearch on YouTube
| File | Contents |
|---|---|
/etc/passwd | Human-readable user account information. |
/etc/group | Group information and which users belong to which group. |
/etc/shadow | Encrypted password hashes and account-expiry info; normally root-only. |
/etc/passwd fieldsSearch on YouTube
Each line describes a user. The UID (user ID) ranges matter:
| UID | Meaning |
|---|---|
| 0 | root |
| 1-99 | predefined system accounts |
| 100-999 | system accounts for administrative purposes |
| 1000 | first non-system user (usually the admin) |
| 1001+ | each new user created afterwards |
GID (group ID): the first 100 GIDs are for system use; GID 0 is the root group; GID 1000 usually means normal users, and new groups start from 1000.
The GECOS field holds comma-separated details: the user's full name, contact/room information, the home directory (where the user's files live; / if none is set), and the login shell (the full path of the default shell that runs commands).
If /etc/passwd has write permission for all users, an attacker can edit it to gain root. This is a misconfiguration, not normal behaviour.
Misconfigured /etc/shadowSearch on YouTube
/etc/shadow holds password hashes and should be readable only by root. If it is misconfigured to allow global write access, an attacker can overwrite the root password hash with one they control, then log in as root.
Escalation technique: sudo shell-escape sequencesSearch on YouTube
If a user is allowed to run a program as root via sudo, that program may be abused to spawn a root shell. A beginner may see a sudo rule such as:
(ALL) /usr/bin/vimThis lets the user run vim as root. Many such programs (vim, less, find, etc.) have built-in ways to run shell commands, which then run as root. Always investigate whether an allowed program can be abused to obtain root. List what you can run with:
sudo -l # show commands the current user may run as rootGTFOBins is the reference idea here: a program trusted with sudo often has a documented "escape" that drops you into a root shell. The flaw is trusting the whole program, not just a safe action.
Escalation technique: cron jobsSearch on YouTube
Cron jobs schedule tasks to run commands at set times on the server. They are commonly used for sysadmin work such as backups and cleaning /tmp. The crontab lives in the /etc directory (/etc/crontab).
The risk: a root-owned cron job runs a script that a normal user can modify. The normal user edits the script so it performs an action with root privileges. Locate the script and check its permissions:
ls -l /etc/crontab # view scheduled jobs
ls -l /path/to/overwrite.sh # check who can write the scheduled scriptIf the script is world-writable, write code into it (for example, a reverse shell back to your machine). When the root-owned cron job runs it, you get a shell as root.
Escalation technique: SUID binariesSearch on YouTube
SUID (Set User ID) is a permission that lets a user run a file with the permissions of the file's owner, not their own. If a file is owned by root and has the SUID bit set, it runs with root privileges even when a normal user executes it.
In a permission string such as rwsr-xr-x, the s in the owner's execute position is the SUID bit (chmod 4755, versus a normal chmod 755 = rwxr-xr-x).
Find all SUID binaries:
find / -perm -u=s -type f 2>/dev/null-perm -u=s matches files with the SUID bit; -type f restricts to files; 2>/dev/null hides permission-denied errors. Check the result's ownership and permissions:
ls -l /path/to/mybackup # e.g. owned by root, SUID enabledIf an SUID root binary (such as a custom mybackup) has a security weakness, that weakness can be used to escalate to root.
- Keep
/etc/passwd,/etc/groupand/etc/shadowwith correct, restrictive permissions (shadow root-only, no world write). - Grant
sudoto specific safe commands only, and avoid programs with known shell escapes. - Make cron scripts root-owned and non-writable by others; never run a world-writable script as root.
- Audit SUID binaries regularly (
find / -perm -u=s -type f) and remove the bit where it is not needed. - Patch the kernel and services to close kernel-level and known-CVE escalation paths.
Lab (Linux Privilege Escalation, TryHackMe room). Practise enumerating a limited shell and escalating to root through weak file permissions, sudo -l shell escapes, writable cron scripts and SUID binaries — the same techniques above, used end to end. The Final Assessment combines these into a full attack-path report (methodology, commands/tools per step, findings and flags).
Quick self-testSearch on YouTube
What is the difference between horizontal and vertical privilege escalation?
Horizontal takes over another user at the same privilege level. Vertical raises your own privilege from a low level up to root.
What do /etc/passwd, /etc/group and /etc/shadow store?
/etc/passwd holds user account info, /etc/group holds group membership, and /etc/shadow holds encrypted password hashes and expiry info (root-only).
Which UID is root, and which is usually the first normal user?
UID 0 is root; UID 1000 is usually the first non-system (admin) user, with new users from 1001.
How can a writable /etc/passwd or /etc/shadow be abused?
If world-writable, an attacker can edit /etc/passwd to gain root, or overwrite the root password hash in /etc/shadow with one they control and log in as root.
What command lists the commands you may run as root via sudo?
sudo -l. If a listed program (like vim) has a shell escape, it can spawn a root shell.
When is a cron job a privilege-escalation risk?
When a root-owned cron job runs a script that a normal user can modify; the user edits the script so it runs their code as root.
What does the SUID bit do?
It lets a file run with the permissions of its owner instead of the user who runs it. An SUID root binary runs as root even for a normal user.
Write the command to find all SUID files on a system.
find / -perm -u=s -type f 2>/dev/null
In rwsr-xr-x, what does the s indicate?
The SUID bit (set in the owner's execute position), so the file runs with the owner's privileges.
List three routes to vertical privilege escalation.
Any three of: weak file permissions, security misconfigurations, kernel exploits, sudo shell-escape sequences, writable cron scripts, vulnerable SUID binaries.
- Privilege escalation exploits a flaw or misconfiguration to gain higher (often root) access.
- Horizontal = another user at the same level; vertical = low privilege up to root.
/etc/passwd(accounts),/etc/group(groups),/etc/shadow(hashes, root-only); UID 0 = root, 1000 = first normal user.- A world-writable passwd/shadow lets an attacker add a root user or overwrite the root hash.
- sudo shell escapes: a program allowed via
sudo(checksudo -l) can spawn a root shell. - Cron: a root-owned job running a user-writable script runs the user's code as root.
- SUID:
rwsr-xr-xruns as the owner; find them withfind / -perm -u=s -type f 2>/dev/null. - Defend with correct permissions, minimal sudo, non-writable cron scripts, SUID audits and patching.