Linux Privilege Escalation: Enumeration Techniques

Hello! Welcome to the first lesson in our module on Privilege Escalation & Post-Exploitation.

In the previous module, you mastered the art of gaining initial access to a target by finding, exploiting, and even chaining web vulnerabilities. You've successfully breached the perimeter and have a shell on a remote machine. But what comes next? Often, this initial access is as a low-privilege user, like www-data or a standard user account. To truly take control of the system, you need to elevate your privileges to the highest level: root.

This lesson begins that journey. We will cover the learning outcome: Perform manual and automated enumeration on a compromised Linux host to identify privilege escalation vectors. This is the foundational step for every privilege escalation attempt. You will learn how to systematically gather information about a compromised Linux system to identify weaknesses that can be exploited to gain root access.

1. The Post-Exploitation Mindset: From Foothold to root

You've landed on the system, but you're not the administrator. Your goal is to find a flaw in the system's configuration that allows you to execute code or access files as the root user. This process is called Privilege Escalation (PrivEsc).

The first and most critical phase of any privilege escalation attempt is enumeration. Before you can attack, you must understand your environment. Your CS background gives you an advantage here; you already understand core Linux concepts like users, groups, permissions, and processes. Now, you'll learn to look at them through an attacker's lens.

We are primarily looking for misconfigurations in these key areas:

• System & Kernel: Outdated kernel or software versions vulnerable to known exploits.
• Users & Permissions: What can your current user do? Are there other users? Who can run commands with sudo?
• File System: Are there any sensitive files you can read or write? Do any scripts or configuration files contain passwords?
• Running Processes & Services: Are there any services running as root that you can interact with or that are misconfigured?
• Scheduled Tasks: Are there any cron jobs that run with higher privileges and can be manipulated?

2. Lay of the Land: Manual Enumeration

Before deploying automated tools, it's crucial to know how to perform quick manual checks. This helps you understand what the tools are doing under the hood and allows you to spot "low-hanging fruit" immediately.

A great way to structure your manual enumeration is to start with who you are and what your system is.

Running these manual commands gives you a quick baseline. Did you get lucky with sudo -l showing (ALL : ALL) NOPASSWD:? Is the kernel version ancient and likely vulnerable? This initial assessment guides your next steps.

3. The Need for Automation

Manual enumeration is fundamental, but it can be slow and you might miss something. To be efficient and thorough, penetration testers use automated scripts. These scripts run hundreds of checks, parse the results, and highlight potential vectors for you.

Here's a look at the landscape of common enumeration tools for both Linux and Windows. Today, we're focusing on the Linux side.

The general workflow for using these scripts is:

1. Gain initial access to the target.
2. Transfer the script from your attacker machine to the target (usually into a world-writable directory like /tmp).
3. Make the script executable (chmod +x script.sh).
4. Run the script and analyze its output.

4. Automated Enumeration in Practice

Let's see how this works with two of the most popular scripts.

4.1. LinEnum and Linux Exploit Suggester

LinEnum is one of the classic enumeration scripts. It's thorough and provides a detailed report of the system's configuration. Often, its output is used to find information that can be fed into another, more specific tool.

The video also demonstrates exploiting the sudo misconfiguration it finds. We will cover the exploitation of sudo rules in our next lesson. For now, the key takeaway is how the automated script made finding that vector trivial. Also, note the presenter's caution: kernel exploits can be unstable and should be handled carefully.

4.2. LinPEAS: Colorful and Effective

LinPEAS (Linux Privilege Escalation Awesome Script) is a more modern script that has become a favorite among testers. Its key feature is its color-coded output, which makes spotting high-probability vectors incredibly easy.

Conclusion

You now have a solid methodology for the first step of Linux privilege escalation: enumeration. You know how to perform quick manual checks for low-hanging fruit and how to deploy powerful automated scripts like LinEnum and LinPEAS to conduct a deep and efficient analysis of a target system. This ability to systematically find potential weaknesses is the most important part of the privilege escalation process.

Key Takeaways:

• Enumeration is the Foundation: You can't exploit what you can't find. Systematic enumeration is the key to successful privilege escalation.
• Start Manually, Finish Automatically: Always begin with a few quick manual commands (id, sudo -l, uname -a) to get your bearings. Then, deploy an automated script like LinPEAS for a thorough search.
• Recognize Key Vectors: Your enumeration efforts are focused on finding common misconfigurations: sudo privileges, SUID/GUID binaries, vulnerable kernel/software versions, writable sensitive files, and credentials in configuration files.
• Leverage Your Tools: Tools like LinPEAS are designed to make your job easier. Understanding their output, especially color-coding, allows you to quickly zero in on the most promising vectors.

Next Lesson Preview:

Now that you know how to find privilege escalation vectors, our next few lessons will focus on how to exploit them. We'll start with one of the most common and reliable paths to root that you've learned to identify today: Exploiting misconfigured sudo permissions.