Linux privilege escalation checklist

System & kernel#

• Kernel version and patch level — System Information. uname -a
• Enabled protections (AppArmor/SELinux) — System Information.
• PATH contents (writable dirs, '.') — PATH. echo $PATH
• Mounts & fstab for nosuid/nodev gaps — System Information.

Users & sudo#

• Extra UID 0 accounts — UID 0. awk -F: '($3==0)' /etc/passwd
• sudo -l rules — LinPEAS sudo.
• Powerful group membership (docker, lxd, disk, shadow) — id.
• Readable credential stores / password reuse — credentials.

Permissions & special bits#

• SUID binaries — LinPEAS SUID. find / -perm -4000 2>/dev/null
• SGID binaries — find / -perm -2000 2>/dev/null
• File capabilities — capabilities. getcap -r / 2>/dev/null
• Writable root-owned executables & world-writable files — file permissions.
• ld.so and ACL misconfigurations — Files with Interesting Permissions.

Scheduled tasks & services#

• Cron jobs and writable cron scripts — LinPEAS cron.
• systemd services/timers and writable units — LinPEAS systemd.
• Sockets and D-Bus services — Processes, Crons, Timers, Services and Sockets.

Credentials & files#

• Secrets in history, configs, logs and .env — credentials.
• SSH private keys and known_hosts — ls -la ~/.ssh.
• Backups and databases with readable secrets — Other Interesting Files.
• Dangerous environment variables (LD_PRELOAD) — env vars.

Containers & cloud#

• Container context and breakout conditions — Docker / containers.
• Mounted Docker socket or host paths — ls -la /var/run/docker.sock.
• Cloud metadata & credentials (authorised scope only) — cloud.