Privesc Linux Gtfobins

Linux privesc via sudo / SUID / capabilities (GTFOBins)

When it applies

You have a low-priv Linux shell. The fastest root is almost always a misconfig — a sudo rule, a SUID binary, or a file capability that a known GTFOBins technique turns into a root shell or file read/write. Do this before kernel exploits.

Why it works

Many normal binaries can spawn shells, read/write files, or run commands. When such a binary runs with elevated rights — via sudo, the SUID bit, or a capability like cap_setuid — that power becomes yours. GTFOBins catalogs the exact escape for each binary.

Method

1. Enumerate the three vectors:
   • sudo -l — commands you can run as root/another user (even NOPASSWD).
   • find / -perm -4000 -type f 2>/dev/null — SUID binaries.
   • getcap -r / 2>/dev/null — file capabilities (cap_setuid, cap_dac_read_search).
2. Look up the binary on GTFOBins for the matching function (sudo / suid / capabilities) and run the exact escape (e.g. sudo vim -c ':!/bin/sh', find . -exec /bin/sh \; if SUID, a capability-based python -c 'import os;os.setuid(0);...').
3. Also check: writable cron jobs / scripts run as root (pspy to watch), writable PATH entries a root process calls, LD_PRELOAD/env_keep in sudo, wildcard injection in root scripts.
4. Stabilize the root shell and grab proof.

Gotchas

• sudo -l NOPASSWD entries are the quickest win — check first.
• A SUID binary that drops privileges is safe; GTFOBins tells you which escapes actually keep root.
• linpeas finds all three fast, but understand the vector before firing — some escapes need exact args.

Verify success

A shell/command running as root (id shows uid=0), or root-only file read/write, via the misconfig.

References

GTFOBins; linpeas; "Linux privilege escalation" (HackTricks); pspy.