Privilege Escalation (Educational Labs)

Overview

Privilege Escalation involves identifying configuration weaknesses, permission misalignments, or unpatched system utilities that allow an existing lower-privileged user account to execute commands with elevated rights (such as root or administrative service accounts). In defensive operations, understanding these vectors allows systems administrators to harden hosts and enforce least privilege.

Core Concepts

• Horizontal vs Vertical Escalation: Horizontal escalation accesses rights belonging to a peer user at the same privilege tier; vertical escalation elevates rights from unprivileged access to superuser/root.
• SetUID (SUID) Bit: When set on an executable file, the process executes with the permissions of the file owner (often root) rather than the invoking user.
• Sudo Rights Configuration: Defined in /etc/sudoers, specifying exact binaries, commands, and options that standard users may invoke as root.
• Scheduled Tasks (Cron Jobs): System maintenance scripts running as root on recurring intervals; writable cron scripts represent an escalation vulnerability.

Tools & Requirements

Built-in Linux system utilities: find, sudo, id, uname, cat, ls.

Commands & Practical Examples

1. Identifying User Identity & Group Memberships

Inspect current User ID (UID), Group ID (GID), and active group memberships (such as sudo or docker):

$ whoami && id

2. Checking Sudo Privileges

List allowed (and forbidden) commands for the invoking user on the current host:

$ sudo -l

3. Searching for SUID Binaries

Audit the filesystem for files configured with the SUID bit, redirecting permission denied errors to null:

$ find / -perm -u=s -type f 2>/dev/null

4. Inspecting Scheduled System Tasks

Review standard system cron directories and crontab definitions for scheduled root jobs:

$ cat /etc/crontab
$ ls -la /etc/cron.*

5. Auditing System & Kernel Information

Identify Linux distribution version, architecture, and kernel release for patch level research:

$ uname -a
$ cat /etc/os-release

Practical Workflow (Educational Lab Model)

1. Initial Discovery: Run id, whoami, and check group memberships.
2. Sudo Check: Check sudo -l to determine if any binaries can be executed with elevated privileges.
3. Binary Audit: Search for unusual or custom SUID binaries (find / -perm -u=s ...).
4. Task Inspection: Review crontab entries and inspect whether referenced scripts have world-writable permissions.
5. Remediation Verification: Document findings and apply correct permissions (e.g. chmod u-s <file>) to remediate the flaw.

Common Mistakes & Troubleshooting

• Missing Error Redirection: Forgetting 2>/dev/null when running find / floods the screen with hundreds of "Permission denied" errors.
• Overlooking Standard Binaries: Focus on non-standard binaries. Standard system SUID binaries like /usr/bin/passwd and /usr/bin/sudo are expected and normal.

Security Considerations & Scoping

Privilege escalation testing must occur exclusively on authorized virtual machines or dedicated lab platforms. Attempting privilege escalation on shared systems, production hosts, or multi-tenant clouds without permission violates acceptable use policies and security laws.

Related Topics

• Module 02: Linux Essentials for Practitioners
• Module 11: Linux System Security & Defensive Hardening
• Module 09: Controlled Exploitation & Post-Exploitation

Further Reading & TryHackMe Paths

• TryHackMe Path: Jr Penetration Tester (Linux Privilege Escalation track - currently in progress).
• Defensive Reference: Linux Hardening Guidelines and Least Privilege Principles.