OSCP: Linux Privilege Escalation

What to know

Enumeration first and always: id, sudo -l, kernel and distribution version, SUID/SGID files (find / -perm -4000 -type f 2>/dev/null), file capabilities (getcap -r / 2>/dev/null), cron entries (/etc/crontab, /etc/cron.*, crontab -l, and pspy to watch for hidden jobs), writable files and directories, mounted shares, running services, and finally linpeas.sh for a broad sweep.

The recurring escalation vectors: sudo misconfiguration (NOPASSWD entries, GTFOBins abuse, LD_PRELOAD when env_keep allows it, sudoedit), SUID binaries mapped to GTFOBins payloads, capabilities such as cap_setuid on an interpreter, cron jobs that execute a script you can write, PATH hijacking of relative commands inside root-run scripts, a writable /etc/passwd, NFS exports with no_root_squash, membership in docker or lxd groups, leaked SSH keys, and password reuse. Kernel exploits are last, not first.

Traps

• Running a kernel exploit immediately and crashing the box; other users lose their work and you lose the lab.
• Expecting SUID bits on shell scripts to work; the kernel ignores setuid on scripts.
• Enumerating crontab -l only and missing system cron files and periodic directories.
• Assuming a sudo password is required when sudo -l shows NOPASSWD.

Rule of thumb

Any root-owned process that reads, writes, or executes something you control is a root shell. Trace what root touches on a schedule before reaching for exploits.