Linux Privilege Escalation Playbook: 7 Real-World Techniques We Use in Every Engagement
From SUID binaries to cron job hijacking, these are the seven privilege escalation techniques our red team uses most frequently on real Linux targets — with detection logic so your blue team can catch them.
Why Linux PrivEsc Matters in Enterprise Environments
Container orchestration, cloud workloads, web servers, database hosts — Linux dominates enterprise infrastructure. A low-privilege shell on a Linux system is the starting point, not the endpoint. Privilege escalation converts a foothold into control.
These are the seven techniques we find working most reliably across real engagements, along with detection guidance for each.
Technique 1: SUID Binary Abuse
SUID binaries run with the permissions of their owner, not the executing user. Find them: find / -perm -4000 -type f 2>/dev/null. GTFOBins documents exploitation paths for hundreds of common binaries. Detection: monitor execve syscalls from non-root users for known SUID binaries.
Technique 2: Sudo Misconfiguration
sudo -l reveals what commands the current user can run as root. Allowing sudo vim, sudo python3, or sudo find is equivalent to giving root access. Detection: audit /etc/sudoers changes and alert on sudo usage of interpreters.
Technique 3: Writable Cron Jobs
If a cron job runs a script as root and that script is world-writable, any user can inject commands into the next execution. ls -la /etc/cron* and check permissions. Detection: file integrity monitoring on all scripts referenced in cron entries.
Technique 4: NFS Root Squashing Disabled
NFS shares without root_squash allow root on the mounting system to write files as root on the share. Classic technique for dropping SUID shells onto mounted filesystems. Detection: audit /etc/exports for no_root_squash.
Technique 5: Environment Variable Injection in PATH
If a SUID binary calls system commands without absolute paths (e.g., system("ps")), injecting a malicious ps binary earlier in PATH achieves root execution. Detection: static analysis of SUID binary sources and enforced PATH sanitization.
Technique 6: Kernel Exploits
Unpatched kernels are a last resort but reliable. uname -r identifies the kernel version. searchsploit finds applicable exploits. Detection: mandatory kernel patching SLA, integrity monitoring for kernel modules.
Technique 7: Credentials in Config Files
Database connection strings, API keys, and hardcoded passwords in config files under /etc, /var/www, and application directories. Grep is your friend: grep -r "password" /etc/ 2>/dev/null. Detection: secrets scanning in CI/CD and periodic filesystem audits.
Cybersecurity expert at HorizonShield, specializing in threat intelligence, incident response, and enterprise security architecture.