Privesc Lookup

What is privilege escalation?

Privilege escalation means obtaining higher permissions than those of the initial access, such as moving from a restricted account to root or administrator. It can exploit a vulnerability or a misconfiguration in sudo, SUID permissions, capabilities or services.

Sudo, SUID and capabilities: three ways to lend privileges

On Linux, a program normally runs with the rights of the user who starts it. Three mechanisms give it more, and each one turns an ordinary program into a way in as soon as it can run a command, read or write a file. sudo runs the command allowed by /etc/sudoers as the runas user (root by default): an allowed pager, editor or interpreter then opens a root shell. The rule’s tags matter: NOPASSWD skips the password, SETENV lets environment variables through, NOEXEC stops the program from starting others.

The SUID bit sets the effective UID to the file owner (usually root) while the program runs, while the real UID stays yours. bash, and dash since version 0.5.11, notice the mismatch at start-up and reset the effective UID to the real one, unless given -p. That is why GTFOBins’ SUID variants run /bin/sh -p, and why a program that goes through system() gives nothing on a distribution whose shell drops privileges. A SUID binary should also be called by its full path: the copy found in the PATH may be another one, without the bit.

Capabilities (capabilities(7)) split root’s powers into about forty units set on a file with setcap. cap_setuid=ep on an interpreter is enough: os.setuid(0), then a shell. cap_dac_read_search reads any file, cap_dac_override writes to it. The letters name the sets involved: e (effective), p (permitted), i (inheritable).

Enumerating on an engagement

sudo -l lists the current user’s rules along with the Defaults that apply; sudo -ll gives the same content in long form, which the tool also reads. SUID binaries are found with find / -perm -4000 -type f 2>/dev/null (and -perm -2000 for SGID), capabilities with getcap -r / 2>/dev/null. Paste all three outputs one after the other: the tool sorts contexts line by line, sets aside the SUID binaries shipped by the distribution and flags local binaries, which are often more interesting than the well-known ones.

linPEAS (from the PEASS-ng project) automates this enumeration and much more: cron jobs, writable files, services, vulnerable versions. It is a useful complement, at the cost of a noisy run on the target. Check the sudo version as well (sudo -V): CVE-2021-3156 (Baron Samedit) affects 1.8.2 to 1.8.31p2 and 1.9.0 to 1.9.5p1, CVE-2019-14287 versions before 1.8.28 with an (ALL, !root) runas, and CVE-2023-22809 sudoedit from 1.8.0 to 1.9.12p1. These checks belong inside the scope of an authorised test.

LD_PRELOAD, env_keep and SETENV

By default, sudo clears the environment (env_reset) and removes dangerous variables. When the Defaults contain env_keep+=LD_PRELOAD, or when a rule carries the SETENV tag, the user picks a library that the dynamic linker loads before the allowed command, with root’s rights. The command itself no longer matters: the library’s constructor runs first. The tool shows the matching minimal library when it spots either case. A kept LD_LIBRARY_PATH allows a variant: replace a library the command loads (ldd lists them) with one built for the purpose.

LOLBAS and application allowlisting

On Windows, the LOLBAS project lists Microsoft-signed binaries, libraries and scripts that do an attacker’s work: download (certutil, bitsadmin), proxy code execution (rundll32, regsvr32, mshta, ATT&CK technique T1218), compile, encode, extract credentials. Their value lies in the signature: an AppLocker or WDAC policy that trusts Microsoft binaries lets them run, and the EDR sees them every day. The AWL Bypass and Execute categories cover that bypass; UAC Bypass, Dump and Credentials assume elevated rights already, which the Privileges column states. Paste the output of dir C:\Windows\System32 to keep only those present on the machine.

Defending

• Write minimal sudo rules, with full paths, no editors, pagers or interpreters, and no wildcards in arguments. Prefer sudoedit to edit a file, add NOEXEC when the program has no reason to start others, and never keep LD_* in env_keep.
• Mount /home, /tmp, /var/tmp and /dev/shm with nosuid, and compare the SUID inventory with a baseline regularly: every difference needs an explanation.
• Audit capabilities with getcap -r / and remove them from interpreters (setcap -r). GTFOBins also works as a detection list: a shell spawned by find, less or vim started through sudo shows up in the logs (log_output, auditd).
• On Windows, LOLBAS entries link to Sigma, Elastic and Splunk rules, and to Microsoft’s recommended block rules for WDAC. Block what has no legitimate use in your environment (mshta, cmstp, regsvr32 pointed at a URL) and monitor the rest.