0xConda-linux-priv-esc.md

0xConda's Linux Privilege Escalation mindmap

source 😽

Credential Access

• reused passwords

• credentials from configuration files

• credentials from local db

• credentials from bash history

• ssh keys

• sudo access

• group privileges (docker, LXD, etc)

Exploit

• services running on localhost

• kernel version

• binary file versions

Misconfiguration

• cron jobs

  • writeable cron job

  • writeable cron job dependency (file, python library, etc)

• SUID/SGID files

• interesting capabilities on binary

• sensitive files - writeable

  • /etc/passwd

  • /etc/shadow

  • /etc/sudoers

  • configuration files

• sensitive files - readable

  • /etc/shadow

  • /root/.ssh/id_rsa (ssh private keys)

• writeable PATH

  • root $PATH variable

  • directory in PATH is writeable

• LD_PRELOAD set in /etc/sudoers