Awesome

Privilege Escalation Cheatsheet (Vulnhub)

This cheatsheet is aimed at CTF players and beginners to help them understand the fundamentals of privilege escalation with examples. It is not a cheatsheet for enumeration using Linux Commands. Privilege escalation is all about proper enumeration. There are multiple ways to perform the same task. We have performed and compiled this list based on our experience. Please share this with your connections and direct queries and feedback to Hacking Articles.

Follow us on

Table of Contents

• Abusing Sudo Rights
• SUID Bit
• Kernel Exploit
• Path Variable
• Enumeration
• MySQL
• Cronjob
• Wildcard Injection
• Capabilities
• Writable /etc/passwd file
• Writable files or script
• Buffer Overflow
• Docker
• Chkrootkit
• Bruteforce
• Crack /etc/shadow
• NFS
• Json
• Redis
• LXD
• All
• Exim
• Apache2 Writable

<a name="sudo"></a>

Abusing Sudo Rights ⤴

<a name="suid"></a>

SUID Bit ⤴

<a name="kernel"></a>

Kernel Exploit ⤴

<a name="path"></a>

Path Variable ⤴

<a name="enum"></a>

Enumeration ⤴

<a name="mysql"></a>

MySQL ⤴

<a name="cronjob"></a>

Cronjob ⤴

<a name="wild"></a>

Wildcard Injection ⤴

<a name="capabilities"></a>

Capabilities ⤴

Writable /etc/passwd file ⤴

<a name="root"></a>

Writable files or script ⤴

<a name="buffer"></a>

Buffer Overflow ⤴

<a name="docker"></a>

Docker ⤴

<a name="chkrootkit"></a>

Chkrootkit ⤴

<a name="bruteforce"></a>

Bruteforce ⤴

<a name="shadow"></a>

Crack /etc/shadow ⤴

<a name="nfs"></a>

NFS ⤴

<a name="json"></a>

Json ⤴

<a name="redis"></a>

Redis ⤴

<a name="lxd"></a>

LXD ⤴

<a name="all"></a>

ALL ⤴

<a name="Exim"></a>

Exim⤴

<a name="apache2"></a>

Apache2 Writable ⤴