Privilege escalation is turning limited access into higher access — typically from a normal user to root. On Linux it almost always exploits a misconfiguration: a permissive sudo rule, an abusable SUID binary or capability, a writable file a privileged process trusts, or a vulnerable kernel/service. Enumeration tools like LinPEAS map these paths so they can be found and fixed.
This guide is written for defenders and authorised testers. It explains categories of vector and how to harden them — not step-by-step exploitation.
Vertical vs. horizontal#
- Vertical escalation raises your privilege level (user → root).
- Horizontal escalation moves you to another account at the same level (useful for reaching that account's access).
The main categories of vector#
Almost every Linux escalation falls into one of these. Each links to the concept and to how LinPEAS reports it.
sudo misconfiguration
NOPASSWD rules, shell-capable allowed binaries, env_keep, wildcards.
SUID/SGID & capabilities
Binaries that run as root, or hold dangerous capabilities, and can be abused.
Writable files & PATH
Files a privileged process trusts, or a hijackable PATH/command.
Scheduled tasks
Writable cron scripts or systemd units that run as root.
Credentials & secrets
Reused passwords, private keys, tokens in files, history and memory.
Kernel & service exploits
Vulnerable kernels or privileged services with known CVEs.
How the process usually goes#
| Stage | What happens | How LinPEAS helps |
|---|---|---|
| Foothold | You have a low-privilege shell. | — |
| Enumerate | Map users, permissions, tasks, secrets, kernel. | Runs the checks in minutes and highlights leads. |
| Analyse | Decide which leads are real in this context. | Colour + ATT&CK tags help you prioritise. |
| Verify | Reproduce the condition manually. | You do this — LinPEAS does not exploit. |
| Act / report | Escalate (if authorised) or document for the fix. | Save output; parsers export JSON/HTML/PDF. |
Hardening: closing the paths#
- Keep sudoers minimal; avoid NOPASSWD and shell-capable allowed binaries.
- Remove unnecessary SUID/SGID bits and dangerous capabilities.
- Ensure privileged scripts, cron jobs and units are root-owned and not writable by others.
- Use absolute paths and explicit PATHs in privileged contexts.
- Store secrets in restricted files, not in the environment or world-readable configs.
- Patch the kernel and services; don't rely on version strings alone.
- Keep AppArmor/SELinux enforcing.
Use LinPEAS only on systems you own or are explicitly authorised to test, including legal training labs and CTF environments where testing is permitted. Unauthorised access to computer systems is illegal.
Sources & references
- HackTricks: Linux privesc checklist
- GTFOBins — binary abuse techniques
- PEASS-ng (LinPEAS) — reviewed 20260908-dffb9496