B2: Enterprise Deep Ops

Linux Privilege Escalation Deep

A complete escalation methodology: identity, files, services, kernel, containers, sudo, SUID, capabilities, and secrets.

Advanced · 30 min · Hands-on lab

Open the interactive lesson & lab →

Linux privilege escalation is systematic. You are asking what this user can read, write, execute, schedule, influence, or inherit.

1. Orient: user, groups, shell, hostname, kernel, distro, environment, and network context.
2. Hunt permissions: sudo rules, SUID/SGID binaries, Linux capabilities, writable paths, cron/systemd timers, and PATH issues.
3. Hunt secrets: app configs, backups, shell history, SSH keys, database creds, cloud metadata, and deployment files.
4. Assess services: processes, listening ports, service accounts, writable service files, and local-only admin panels.
5. Check kernel/container boundary only after lower-risk paths are exhausted and only in lab or approved scope.

# Safe enumeration mindset for your own lab or authorized host
id
uname -a
sudo -l
find / -perm -4000 -type f 2>/dev/null
getcap -r / 2>/dev/null
find / -writable -type d 2>/dev/null | head

Take the quiz and try the live lab →