26. Privilege Escalation

26.2 Manual Linux Enumeration

By Ravindra Bagale · Last updated: 27 September 2026

Root honyaadhi attacker system "vachto" – kuthe chuk aahe te shodhto. He commands tumhi pahile chalava:

id                                  # who am I, which groups
sudo -l                             # what can I run with sudo (very important)
uname -a; cat /etc/os-release       # kernel and OS version (for known exploits)
find / -perm -4000 -type f 2>/dev/null   # SUID binaries (run as their owner, often root)
find / -writable -type d 2>/dev/null     # world-writable directories
cat /etc/crontab; ls -la /etc/cron.*     # scheduled jobs (may run as root)
ps aux | grep root                  # processes running as root
cat /etc/passwd                     # user accounts
history                             # commands the last user typed (sometimes passwords!)
ls -la /home/*                      # readable files in other homes
env                                 # environment variables (sometimes secrets)

The four most common findings:

1. sudo -l shows a command you can run as root – often a direct path to root.
2. A SUID binary you can misuse (a program that always runs as its owner, usually root).
3. A cron job running as root that calls a script you can edit.
4. A world-writable file that a root process reads or runs.