26.3 Common Escalation Paths
sudo misconfiguration. If sudo -l shows you can run an editor, interpreter or shell as root, you can usually get a root shell. The site GTFOBins documents how each binary can be misused.
sudo -l # e.g. "(root) NOPASSWD: /usr/bin/find"
sudo find . -exec /bin/sh \; -quit # abuse find to spawn a root shell (lab example)
SUID binaries. A file with the SUID bit runs with its owner's rights. A misconfigured or vulnerable SUID root binary can give a root shell (check each one on GTFOBins).
find / -perm -4000 -type f 2>/dev/null
# example: an SUID 'nmap' (old interactive mode) or 'cp', 'vim', 'bash' can lead to root
Writable cron job / script. If root runs a script on a schedule and you can edit that script, your code runs as root.
cat /etc/crontab
ls -la /path/to/script/root/runs.sh # if you can write it, add a reverse shell line
Kernel exploits. A very old kernel may have a local exploit (for example the classic "Dirty COW"). Match uname -r to a known exploit with searchsploit – but kernel exploits can crash the box, so try safer paths first.
Kernel exploits can crash the system
Kernel exploits are the loudest and riskiest option – they can freeze the machine. That is why you take a snapshot first and prefer sudo/SUID/cron paths. In a real job these run only with explicit permission.
Ravindra Bagale's Tip
GTFOBins (gtfobins.github.io) ha privilege escalation cha "cheat sheet" aahe – konta binary root deu shakto te ithe pahaycha. Pan pathitar karu naka; aadhi samja to command kay karto. Interview madhe "SUID mhanje kay" ha prashna hamkhas yeto.
Lab
On Metasploitable 2, pick one SUID binary from your list, look it up on GTFOBins, and get a root shell using the documented method. Confirm with id that you are now uid=0(root). Restore the snapshot afterwards.