> For the complete documentation index, see [llms.txt](https://gitbook.nori-zamurai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.nori-zamurai.com/pentesting-cheatsheets/privesc/linux.md).

# Linux

## Cheatsheet

![](/files/-M6O-QH_0n6Yy5qo6JaF)

![](/files/-M6O-mavCK9RhpAUNic7)

![](/files/-M6O-rslJLyjUNubkzH9)

{% embed url="<https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/>" %}

## Sudo Rights (sudo -l)

![](https://i2.wp.com/2.bp.blogspot.com/-7HdHllzAXZU/WwZTV0yMDYI/AAAAAAAAXBA/6gOuaUG5b70GfAgtusuMxqPpX5Ji1rRCgCLcBGAs/s1600/2.1.png?w=687)

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-exploiting-sudo-rights/>" %}

## SUID (Set user ID) Binaries

![](/files/-M6kJJh4k2fhYRR9W00B)

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-suid-binaries/>" %}

## rbash (restricted shell)

### SSH login to bypass the loading of profile and access proper bash

```
ssh ignite@192.168.1.103 -t "bash --noprofile"
```

{% embed url="<https://www.hackingarticles.in/multiple-methods-to-bypass-restricted-shell/>" %}

{% embed url="<https://speakerdeck.com/knaps/escape-from-shellcatraz-breaking-out-of-restricted-unix-shells>" %}

## Processes executed by Root

### TMUX session

```
hype@Valentine:/dev/shm$ ls -la /.devs/dev_sess
srw-rw---- 1 root hype 0 Apr 27 01:12 /.devs/dev_sess

hype@Valentine:/dev/shm$ groups
hype cdrom dip plugdev sambashare

tmux -S /.devs/dev_sess 
```