Initial enumeration
id # current uid/gid and groups
sudo -l # commands the user may run via sudo
uname -a # kernel and architecture
cat /etc/os-release # distribution and version
hostname; ip a # host and network info
ps aux --forest # running processes
Common vectors
| Vector | Find it | Notes |
|---|---|---|
| Sudo rights | sudo -l | Check the binary on GTFOBins for a shell escape |
| SUID binaries | find / -perm -4000 -type f 2>/dev/null | Root-owned SUID may be abusable |
| Capabilities | getcap -r / 2>/dev/null | e.g. cap_setuid on an interpreter |
| Cron jobs | cat /etc/crontab; ls -la /etc/cron.* | Writable scripts run by root |
| Writable PATH dirs | echo $PATH | Hijack a binary a privileged job calls |
| Passwords / keys | `grep -RiE "password | secret" /etc /var/www 2>/dev/null` |
| World-writable files | find / -writable -type f 2>/dev/null | Config or script tampering |
Useful references
- GTFOBins (https://gtfobins.github.io) — shell escapes for SUID/sudo binaries.
- LinPEAS (part of PEASS-ng) — automated enumeration script.
linux-exploit-suggester.sh— maps the kernel version to known local exploits.
Only run these against systems you own or are explicitly authorised to assess.