Linux Privilege Escalation TryHackMe

Overview

This room focuses on the first phase of Linux privilege escalation: enumeration. It explains why privilege escalation matters after initial access, what information to gather from a Linux target, which commands are most useful, and how kernel exploits fit into the escalation decision process.

Core idea: most Linux privilege escalation wins come from disciplined enumeration, not magic. You need to understand the host, the users, the services, the permissions, and only then choose the right escalation path.

1) What Privilege Escalation Means

Privilege escalation is the process of moving from a lower-privileged account to a higher-privileged one by abusing a vulnerability, design flaw, or configuration weakness.

In practice, this is important because it enables actions such as:

resetting passwords,
bypassing access controls,
editing system or software configurations,
establishing persistence,
changing user privileges,
executing administrative commands.

2) Enumeration First

The room emphasizes that enumeration is just as important after compromise as it is before initial access.

Do not assume the first foothold is enough.
Look for host role clues, vulnerable services, weak permissions, user misconfigurations, and local attack surface.
Treat each low-privilege shell as the start of another recon phase.

3) Core Host Information Commands

Several commands give you immediate context about the Linux target:

hostname: may reveal the system role.
uname -a: shows kernel and architecture details.
cat /proc/version: gives kernel details and may hint at compiler availability.
cat /etc/issue: may reveal operating system information.

Practical use: kernel version and distro details are especially important when assessing whether local kernel exploits are even worth considering.

4) Process, Environment, and Identity

The room calls out several commands that help you understand your current position on the host:

ps -A, ps axjf, ps aux: show running processes, owners, and process trees.
env: shows environment variables such as PATH.
sudo -l: lists commands your current user can run with sudo.
id: shows current user and group memberships.

These are often enough to expose sudo abuse, PATH abuse, interesting services, or extra group privileges.

5) Users, Files, and Command History

User and filesystem enumeration is a major part of Linux privilege escalation.

ls -la helps reveal hidden files and permission details.
cat /etc/passwd reveals user accounts and shells.
history may contain commands, paths, usernames, or even credentials.

The room also highlights that filtering /etc/passwd output for home directories can help separate real users from service accounts.

6) Network Enumeration After Compromise

A compromised Linux host may also be a pivot point, so local network visibility matters.

ifconfig shows interfaces and can reveal extra reachable networks.
ip route reveals routing information.
netstat -a, -l, -tp, -ano expose listening services and active connections.

Why this matters: a low-priv shell on one host may be your route into internal services you could not previously reach.

7) Using Find for Priv-Esc Discovery

find is one of the most useful Linux privilege escalation commands because it helps surface writable paths, unusual permissions, and development tooling.

Find world-writable directories.
Find executable paths.
Find user-owned files under home directories.
Find recently modified or accessed files.
Find large files that may hold data or backups.
Find interpreters and compilers such as Python, Perl, or GCC.
Find SUID files with find / -perm -u=s -type f 2>/dev/null.

Using 2>/dev/null keeps the output readable by suppressing permission errors.

8) Automated Enumeration Tools

The room mentions several popular automation helpers:

LinPEAS
LinEnum
Linux Exploit Suggester
Linux Smart Enumeration
Linux Priv Checker

Important limit: these tools save time, but they can miss paths. They should support manual enumeration, not replace it.

9) Kernel Exploits

Kernel exploits are one possible privilege escalation path, but they come with real risk.

Identify the kernel version.
Research whether a relevant exploit exists.
Assess the reliability and risk.
Only run it if it is acceptable within the engagement scope.

A failed kernel exploit can crash the target, so this should never be the first escalation technique you jump to without justification.

Exam Notes (PT1)

Privilege escalation usually starts with exhaustive local enumeration, not immediate exploitation.
Know the core Linux enumeration commands: hostname, uname -a, /proc/version, ps, env, sudo -l, id, ifconfig, ip route, netstat, and find.
Always use ls -la during local enumeration to avoid missing hidden files.
SUID files, writable directories, interesting PATH entries, sudo permissions, and command history are all common escalation leads.
Kernel exploits can lead to root, but they are higher risk and should be treated carefully.