> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfnote/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation.md).

# Linux Privilege Escalation

- [Linux Permissions](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/linux-permissions.md): rwx
- [Manual Enumeration](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/manual-enumeration.md): System, user, network, and password
- [Automated Tools](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/automated-tools.md): LinPEAS!
- [Kernel Exploits](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/kernel-exploits.md): Dirty Cow!
- [Passwords and File Permissions](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/passwords.md): Plaintext passwords vs. password hashes
- [SSH Keys](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/ssh-keys.md): id\_rsa, id\_rsa.pub, authorized\_keys
- [Sudo](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/sudo.md): sudo -l
- [SUID](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/suid.md): find / -perm -u=s -type f 2>/dev/null
- [Capabilities](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/capabilities.md): "Better" than SUID but vulnerable in the same way
- [Cron Jobs](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/cron-jobs.md): /etc/crontab
- [NFS Root Squashing](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/nfs-root-squashing.md): no\_root\_sqush
- [Docker](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/docker.md): docker run -v /:/mnt --rm -it bash chroot /mnt sh
- [GNU C Library](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/gnu-c-library.md): ldd --version
- [Exim](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/exim.md): which exim
- [Linux Privilege Escalation Course Capstone](https://ret2basic.gitbook.io/ctfnote/red-teaming/privilege-escalation/linux-privilege-escalation/linux-privilege-escalation-course-capstone.md): Five boxes from TryHackMe