Once you land on a Linux system as a low-privilege user, the next goal is usually root. Privilege escalation is the art of turning limited access into full control by abusing misconfigurations. This beginner-friendly guide covers the essentials, for use only in authorized labs.
Always Start With Enumeration
You cannot exploit what you have not found. Begin by identifying your current user and groups, the OS and kernel version, running processes, scheduled jobs, and unusual file permissions. Automated scripts speed this up, but understanding manual enumeration makes you far more capable.
Common Escalation Paths
SUID Binaries
Some programs run with the owner’s privileges. Certain SUID binaries can be abused to execute commands as root, so enumerating them is a common early step.
Sudo Misconfigurations
Check what your user can run with sudo. Certain allowed binaries can be leveraged to spawn a root shell if misconfigured.
Writable Cron Jobs
If a root-run scheduled task calls a file you can edit, you may be able to hijack it to run your own commands.
Weak File Permissions
Sensitive files like backups or configuration files that are readable by your user may leak credentials you can reuse.
Kernel Exploits: A Last Resort
If misconfigurations do not pan out, a vulnerable kernel version may be exploitable. Treat this as a last resort in labs, since kernel exploits can crash the target and are noisy and risky.
Best Practices for Defenders
Defenders should minimize SUID binaries, restrict sudo rules, audit cron jobs, and keep kernels patched. Regular privilege audits close the exact gaps attackers look for.
Practice Legally
Sharpen these skills on platforms like TryHackMe and Hack The Box, never on systems you do not own or have permission to test.
Frequently Asked Questions
Do I need root to enumerate?
No. Enumeration is done as a low-privilege user; that is the whole point of finding a path upward.
Are automated tools enough?
They help, but understanding the underlying techniques lets you succeed when tools miss something.
Conclusion
Linux privilege escalation is mostly about thorough enumeration and recognizing common misconfigurations. Practice in authorized labs, and always confirm command syntax against current documentation.