← FieldbookFIELD NOTE / LINUX PRIVILEGE ESCALATIONCore · Privilege Escalation
LINUX PRIVILEGE ESCALATION / PRIVILEGE ESCALATION

Linux sudo triage

Start privilege escalation with identity, sudo policy, environment, and reachable execution paths—not exploit guessing.

LEARNING OBJECTIVES

What you should be able to do

  • ✓Confirm current identity and effective privileges
  • ✓Interpret sudo rules and their constraints
  • ✓Prove a reachable privileged execution path in a lab
CORE CONCEPT

Understand before you run

A sudo entry only matters when the allowed command, arguments, environment, and writable inputs line up.

Version strings are leads; verify package state and the actual execution path.

Evidence should show the before and after identity, not merely an enumeration result.

COMMAND REFERENCE

Quick reference

SHELLLinux
id; sudo -l

Record identity, groups, and sudo policy

SHELLLinux
find / -perm -4000 -type f 2>/dev/null

Inventory SUID candidates for later validation

SHELLLinux
ss -tulpn; getcap -r / 2>/dev/null

Inspect local services and file capabilities

COMMON MISTAKES

Check yourself

  • Treating a writable file or SUID binary as escalation without proving privileged code reads it.
  • Running destructive commands during passive enumeration.
  • Ignoring the application's actual arguments and working directory.