linux-privilege-escalation

Linux privilege escalation from a low-privilege shell involves systematically enumerating sudo rights, SUID binaries, capabilities, and cron jobs, then following a decision tree to select the most effective exploitation path to root.

The best way to enumerate Linux privilege escalation vectors is checking sudo misconfigurations, SUID/SGID binaries, capabilities, cron/timers, writable sensitive files, and credential locations to map available exploitation avenues.

Mapping Linux kernel versions to privilege escalation exploits requires identifying the kernel version and matching it to known kernel exploits, while considering compilation requirements and system stability to ensure reliable execution.

Yes, you can abuse Linux capabilities like cap_setuid and cap_sys_admin for privilege escalation by leveraging the specific privileges granted to binaries to execute commands with elevated permissions and bypass standard user boundaries.

Yes, being in the docker group allows privilege escalation on Linux because members can mount the host filesystem inside a container, granting root-level access to sensitive host files and system configurations.

Limitations of kernel exploits for Linux privilege escalation include potential system instability or crashes, requiring specific compilation or cross-compilation setups, and needing careful stability considerations to avoid rendering the target host unresponsive.