# Privesc Linux Gtfobins

> Linux privilege escalation via sudo rules, SUID/SGID binaries, and capabilities using GTFOBins techniques. Load with a Linux shell needing root, on `sudo -l` output, SUID/`getcap` findings, or "escalate on Linux". Signals: allowed sudo commands, SUID binaries, file capabilities, cron/PATH abuse.

- Skill: `noorqureshi/privesc-linux-gtfobins` (Agent Skill)
- Install (CLI): `npx skillmds@latest add noorqureshi/privesc-linux-gtfobins`
- Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/privesc-linux-gtfobins/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: NoorQureshi (https://skillmd.com/u/noorqureshi)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/noorqureshi/privesc-linux-gtfobins

---


# Linux privesc via sudo / SUID / capabilities (GTFOBins)

## When it applies
You have a low-priv Linux shell. The fastest root is almost always a misconfig — a sudo rule, a
SUID binary, or a file capability that a known GTFOBins technique turns into a root shell or file
read/write. Do this before kernel exploits.

## Why it works
Many normal binaries can spawn shells, read/write files, or run commands. When such a binary runs
with elevated rights — via `sudo`, the SUID bit, or a capability like `cap_setuid` — that power
becomes yours. GTFOBins catalogs the exact escape for each binary.

## Method
1. **Enumerate the three vectors**:
   - `sudo -l` — commands you can run as root/another user (even NOPASSWD).
   - `find / -perm -4000 -type f 2>/dev/null` — SUID binaries.
   - `getcap -r / 2>/dev/null` — file capabilities (`cap_setuid`, `cap_dac_read_search`).
2. **Look up the binary on GTFOBins** for the matching function (sudo / suid / capabilities) and
   run the exact escape (e.g. `sudo vim -c ':!/bin/sh'`, `find . -exec /bin/sh \; ` if SUID, a
   capability-based `python -c 'import os;os.setuid(0);...'`).
3. **Also check**: writable cron jobs / scripts run as root (`pspy` to watch), writable `PATH`
   entries a root process calls, `LD_PRELOAD`/`env_keep` in sudo, wildcard injection in root scripts.
4. **Stabilize** the root shell and grab proof.

## Gotchas
- `sudo -l` NOPASSWD entries are the quickest win — check first.
- A SUID binary that drops privileges is safe; GTFOBins tells you which escapes actually keep root.
- `linpeas` finds all three fast, but understand the vector before firing — some escapes need exact args.

## Verify success
A shell/command running as root (`id` shows `uid=0`), or root-only file read/write, via the misconfig.

## References
GTFOBins; linpeas; "Linux privilege escalation" (HackTricks); pspy.