> For the complete documentation index, see [llms.txt](https://gitbook.nori-zamurai.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://gitbook.nori-zamurai.com/pentesting-cheatsheets/privesc/linux.md).

# Linux

## Cheatsheet

![](https://2774131807-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M64VB6Sr653y4KPdauj%2F-M6NxbxAE7prfB4OrRGb%2F-M6O-QH_0n6Yy5qo6JaF%2FLinux-file-system-hierarchy-Linux-file-structure-optimized.jpg?alt=media\&token=c5d4d1eb-0e69-4288-9a46-3b2acdce8077)

![](https://2774131807-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M64VB6Sr653y4KPdauj%2F-M6NxbxAE7prfB4OrRGb%2F-M6O-mavCK9RhpAUNic7%2Fimage.png?alt=media\&token=05036fe0-7935-49f1-a138-625854794d04)

![](https://2774131807-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M64VB6Sr653y4KPdauj%2F-M6NxbxAE7prfB4OrRGb%2F-M6O-rslJLyjUNubkzH9%2Fimage%20\(1\).png?alt=media\&token=d3557193-f19a-40ac-99bd-8e0356f4ac02)

{% embed url="<https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/>" %}

## Sudo Rights (sudo -l)

![](https://i2.wp.com/2.bp.blogspot.com/-7HdHllzAXZU/WwZTV0yMDYI/AAAAAAAAXBA/6gOuaUG5b70GfAgtusuMxqPpX5Ji1rRCgCLcBGAs/s1600/2.1.png?w=687)

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-exploiting-sudo-rights/>" %}

## SUID (Set user ID) Binaries

![](https://2774131807-files.gitbook.io/~/files/v0/b/gitbook-legacy-files/o/assets%2F-M64VB6Sr653y4KPdauj%2F-M6kIpbiEdYplq-oAcKo%2F-M6kJJh4k2fhYRR9W00B%2Fimage.png?alt=media\&token=ef700a3e-d265-4211-a4f9-32adcbfe938f)

{% embed url="<https://www.hackingarticles.in/linux-privilege-escalation-using-suid-binaries/>" %}

## rbash (restricted shell)

### SSH login to bypass the loading of profile and access proper bash

```
ssh ignite@192.168.1.103 -t "bash --noprofile"
```

{% embed url="<https://www.hackingarticles.in/multiple-methods-to-bypass-restricted-shell/>" %}

{% embed url="<https://speakerdeck.com/knaps/escape-from-shellcatraz-breaking-out-of-restricted-unix-shells>" %}

## Processes executed by Root

### TMUX session

```
hype@Valentine:/dev/shm$ ls -la /.devs/dev_sess
srw-rw---- 1 root hype 0 Apr 27 01:12 /.devs/dev_sess

hype@Valentine:/dev/shm$ groups
hype cdrom dip plugdev sambashare

tmux -S /.devs/dev_sess 
```