Local Privileges Escalation
Basic Enumeration
Local EnumerationAttack Vectors
Scheduled tasks
Scheduled tasksPassword Authentication
The /etc/passwd file can contain password hashes directly instead of an x, indicating that the password hash is stored in /etc/shadow. If /etc/passwd is writable, it allows the creation of arbitrary users with root privileges.
Monitor Process
It possible that the administrative user used command line with sensitive information exposed.
In this situation monitoring the process can reveal this sensitive information
SetUID Binaries and Capabilities
SetUID Binaries and CapabilitiesSudoers
it's possible to restrict a user's sudo permissions to specific commands or binaries. This is done by configuring the /etc/sudoers file, where certain users can be allowed to run only a defined set of commands with sudo.
Kernel Exploits
Kernel ExploitsReferences
Last updated
