How to Prevent Linux Privilege Escalation? Critical Risks Every Junior Ops Should Know

Background and Problem

Privilege escalation (PE) is the process by which an attacker or malicious user gains higher privileges from a low‑privileged account. In real incidents attackers rarely obtain root directly; they first compromise a normal account and then use various PE techniques to become root. Ops engineers must understand these risks to protect servers and internal users.

1. SUID Program Escalation

1.1 SUID Mechanism

SUID (Set User ID) marks an executable so that it runs with the file owner’s privileges. For example, /usr/bin/passwd is owned by root and has the SUID bit, allowing any user to modify /etc/shadow when executing passwd.

# Find files with SUID bit
find / -perm -4000 -type f 2>/dev/null

# Show details of a specific SUID binary
ls -la /usr/bin/passwd
# Output shows -rwsr-xr-x (s replaces x)

1.2 Dangerous SUID Binaries

Not all SUID programs are required or safe. Common risky SUID binaries include:

nmap (old versions can execute arbitrary commands)

bash (SUID bash gives a root shell)

python / perl / ruby (if SUID, can run scripts as root)

find (‑exec can run any command)

vim/vi (can read/write any file)

# Example to locate risky SUID binaries
find / -perm -4000 -type f -name "nmap" 2>/dev/null
find / -perm -4000 -type f -name "bash" 2>/dev/null
find / -perm -4000 \( -name "python*" -o -name "perl*" -o -name "ruby*" \) 2>/dev/null
find / -perm -4000 -type f -name "find" 2>/dev/null
find / -perm -4000 -type f \( -name "vim" -o -name "vi" -o -name "nano" \) 2>/dev/null

1.3 SUID Exploitation Examples

# Bash SUID escalation
bash -p

# nmap interactive mode (old versions)
nmap --interactive
!sh

# Find command escalation
find . -exec /bin/sh -p \; -quit

# Vim escalation
vim -c ':!/bin/sh'

# Perl escalation
perl -e 'exec "/bin/sh";'

# Python escalation
python -c 'import os; os.system("/bin/sh")'

1.4 SUID Hardening

Principles: minimize the number of SUID binaries, regularly audit new SUID files, and remove unnecessary SUID bits.

# List all SUID programs for review
find / -perm -4000 -type f 2>/dev/null > /tmp/suid_files.txt
cat /tmp/suid_files.txt

# Remove SUID from a specific binary
chmod u-s /usr/bin/nmap
chmod u-s /usr/bin/bash

2. sudo Misconfiguration Escalation

2.1 Common sudo Mistakes

# View current user sudo rights
sudo -l

# View all sudo configurations (requires root)
cat /etc/sudoers
cat /etc/sudoers.d/*

# Dangerous patterns
username ALL=(ALL) ALL               # unrestricted
username ALL=(root) /bin/bash        # any root shell
username ALL=(ALL) NOPASSWD: ALL    # password‑less sudo
username ALL=(ALL) /usr/sbin/visudo # can edit sudoers
username ALL=(root) /usr/bin/vim    # vim can be used for escape

2.2 Exploiting sudo

# Using sudo vim to get a shell
sudo vim
:!/bin/sh

# Using sudo less to spawn a shell
sudo less /etc/passwd
!sh

# Using sudo find
sudo find . -exec /bin/sh -p \; -quit

# Using sudo wget to overwrite critical files (complex in practice)
sudo wget -F /etc/shadow

# Using sudo python
sudo python -c 'import os; os.system("/bin/sh")'

2.3 Secure sudo Configuration

# Minimal‑privilege example
username ALL=(root) /usr/bin/systemctl restart nginx, /usr/bin/systemctl restart php-fpm

# Disallow dangerous commands
username ALL=(root) ALL, !/bin/bash, !/usr/bin/vim, !/usr/bin/less

# Use sudoers.d for modular rules
# /etc/sudoers.d/custom (one rule per line)

# Log all sudo activity
Defaults logfile="/var/log/sudo.log"

3. Cron Job Escalation

3.1 Misconfigured Cron Tasks

# List system cron directories
ls -la /etc/cron.d/
ls -la /etc/cron.daily/
ls -la /etc/cron.hourly/
cat /etc/crontab

# List current user crontab
crontab -l

# List another user’s crontab (requires root)
crontab -u username -l

3.2 Cron Risks

Risk 1: Scripts executed by cron are writable by ordinary users, allowing them to modify the script and run arbitrary commands as root.

# Check script permissions
ls -la /etc/cron.daily/mybackup.sh
# Example output: -rwxrwxrwx 1 root root ... mybackup.sh (world‑writable)

Risk 2: Cron entries that use relative paths can be hijacked if the PATH contains user‑writable directories.

# Insecure example
@hourly /home/user/backup.sh

# Secure example (absolute path)
@hourly /usr/local/bin/backup.sh

Risk 3: Inherited insecure environment variables (e.g., PATH) can lead to execution of malicious binaries.

# View cron environment
cat /etc/pam.d/cron

3.3 Cron Hardening

# Ensure correct permissions on cron scripts
chmod 755 /etc/cron.daily/myscript.sh
chown root:root /etc/cron.daily/myscript.sh

# Always use absolute paths in crontab
*/5 * * * * /usr/local/bin/check_service.sh

# Restrict environment variables
CRON_TZ=UTC
PATH=/usr/bin:/bin

# Log cron activity (rsyslog example)
cron.* /var/log/cron.log
systemctl restart rsyslog

4. Password and SSH‑Key Risks

4.1 Password Hash Extraction

# Check /etc/shadow permissions
ls -la /etc/shadow
# Expected: -rw-r----- 1 root shadow ...

# If readable by non‑root, attacker can offline crack hashes
# Find any shadow files with world‑read permission
find / -perm -004 -name "shadow" 2>/dev/null

4.2 SSH Key Escalation

# Locate private keys
find / -name "*.pem" -o -name "id_rsa" -o -name "id_ed25519" -o -name "id_ecdsa" 2>/dev/null

# Verify key permissions (should be 600)
ls -la ~/.ssh/id_rsa

# Detect overly permissive keys
find /home -name "*.pem" -perm 0777 2>/dev/null

4.3 Password Hardening

# Strong password policy (pam_pwquality)
password    requisite    pam_pwquality.so retry=3 minlen=12 dcredit=-1 ucredit=-1 lcredit=-1 ocredit=-1

# Remember last 5 passwords
password    sufficient    pam_unix.so sha512 shadow nullok try_first_pass use_authtok remember=5

# Expiration settings (login.defs)
PASS_MAX_DAYS   90
PASS_MIN_DAYS   7
PASS_WARN_DAYS  14

# Apply to existing user
chage -M 90 -m 7 -W 14 username

5. Kernel and Software Vulnerabilities

5.1 Kernel Bugs

Well‑known kernel exploits such as Dirty COW (CVE‑2016‑5195) and Spectre/Meltdown allow privilege escalation.

# Show kernel version
uname -a
cat /proc/version

# Use linux‑exploit‑suggester to find known exploits
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
chmod +x linux-exploit-suggester.sh
./linux-exploit-suggester.sh

5.2 Software Bugs (sudo, OpenSSL, etc.)

# Check versions for known CVEs
sudo -V | head -3
openssl version
nginx -v
apache2 -v
mysql --version
php -v

# List security updates via package manager
apt list --upgradable 2>/dev/null | grep -i security
yum updateinfo list security 2>/dev/null

5.3 Update Process

# Debian/Ubuntu
apt update
apt list --upgradable
apt-get upgrade
apt-get dist-upgrade   # includes kernel

# RHEL/CentOS
yum check-update
yum update
yum update --security   # only security patches

# Automate with unattended‑upgrades (Debian)
apt-get install unattended-upgrades
dpkg-reconfigure unattended-upgrades

6. Container Escape Escalation

6.1 Docker Escape Risks

# Detect if running inside a container
cat /proc/1/cgroup | grep -i docker
ls -la /.dockerenv 2>/dev/null

# Check if Docker socket is mounted inside the container
ls -la /var/run/docker.sock 2>/dev/null
# Presence indicates insecure configuration

6.2 Escape Technique

# If socket is accessible, run a privileged container that mounts host root
docker -H unix:///var/run/docker.sock run -v /:/host ubuntu chroot /host bash
# This yields a root shell on the host

6.3 Container Hardening

# Do NOT mount Docker socket into containers
# In Kubernetes, set securityContext
securityContext:
  privileged: false
  readOnlyRootFilesystem: true

# Docker run with dropped capabilities
docker run --rm --cap-drop ALL --read-only nginx

# Avoid --privileged flag
# Use AppArmor or SELinux profiles
apparmor=unconfined
selinux enabled

# Keep base images up‑to‑date
docker pull ubuntu:22.04

7. File‑Permission Escalation

7.1 NFS Share Risks

# Inspect NFS exports
cat /etc/exports
showmount -e localhost

# List NFS mounts
mount | grep nfs

# Look for no_root_squash (allows client root to act as server root)
# Example: export ... *(rw,no_root_squash)

7.2 Sensitive File Permissions

# Verify critical system files
ls -la /etc/passwd /etc/shadow /etc/group /etc/gshadow
chmod 644 /etc/passwd   # readable, not writable
chmod 600 /etc/shadow   # root‑only read
chown root:shadow /etc/shadow
chmod 440 /etc/sudoers   # root‑only edit
chown root:root /etc/sudoers

7.3 Cron Directory Permissions

# Cron directories should be owned by root and not writable by others
ls -la /etc/cron.d/
# Expected mode: dr-xr-xr-x root root

# Secure deny files
chmod 600 /etc/cron.deny /etc/at.deny

8. General Defense Strategies

8.1 Principle of Least Privilege

# Audit users and groups
cat /etc/passwd
cat /etc/group

# Remove unnecessary accounts and groups
userdel username
groupdel groupname

# Review sudo rights
visudo   # remove unneeded entries

8.2 Regular Security Audits

# Run Lynis for system audit
apt-get install lynis
lynis audit system

# Check for rootkits
apt-get install chkrootkit
chkrootkit
apt-get install rkhunter
rkhunter --check

8.3 File Integrity Monitoring

# Install AIDE
apt-get install aide
aideinit
aide --check
# Schedule daily check via cron
#!/bin/bash
/usr/bin/aide --check

8.4 Intrusion Detection

# Install OSSEC or similar HIDS
# Use auditd to watch critical files
auditctl -w /etc/passwd -p wa -k passwd_changes
auditctl -w /etc/shadow -p wa -k shadow_changes
auditctl -w /etc/sudoers -p wa -k sudoers_changes
auditctl -w /usr/bin -p x -k execution

# Query audit logs
ausearch -k passwd_changes | tail -20

9. Quick Privilege‑Escalation Check Script

#!/bin/bash
# privilege_escalation_check.sh – quick audit

echo "=== Linux Privilege Escalation Check ==="

# 1. SUID binaries
echo "[1] SUID Programs:"
find / -perm -4000 -type f 2>/dev/null | head -20

# 2. sudo rights
echo "
[2] Current User Sudo Permissions:"
sudo -l 2>/dev/null

# 3. Cron tasks
echo "
[3] Cron Tasks:"
ls -la /etc/cron.d/ /etc/cron.daily/ /etc/cron.hourly/ 2>/dev/null | grep -v "^total"

# 4. /etc/passwd writable?
echo "
[4] /etc/passwd Writable:"
ls -la /etc/passwd
if [ -w /etc/passwd ]; then echo "WARNING: /etc/passwd is world‑writable!"; fi

# 5. /etc/shadow readable?
echo "
[5] /etc/shadow Permissions:"
ls -la /etc/shadow
if [ -r /etc/shadow ]; then echo "NOTE: /etc/shadow is readable by all"; fi

# 6. Docker socket
echo "
[6] Docker Socket:"
ls -la /var/run/docker.sock 2>/dev/null || echo "Docker socket not found"

# 7. Kernel version
echo "
[7] Kernel Version:"
uname -a

# 8. Writable /etc files
echo "
[8] Writable /etc files:"
find /etc -type f -perm -002 2>/dev/null | head -10

# 9. SSH keys permissions
echo "
[9] SSH Keys:"
find /home -name "*.pem" -o -name "id_*" 2>/dev/null | xargs ls -la 2>/dev/null

# 10. Running services
echo "
[10] Running Services:"
systemctl list-units --type=service --state=running | head -20

echo "
=== Check Complete ==="

10. Conclusion

Linux privilege escalation is a core security concern for operations. Understanding the common escalation paths—SUID binaries, sudo misconfigurations, insecure cron jobs, password/SSH‑key exposure, kernel and software bugs, container escape, and file‑permission mistakes—and applying layered defenses such as least‑privilege, depth‑in‑defense, and continuous monitoring are essential skills for every ops engineer.

References

Linux Privilege Escalation – PayloadsAllTheThings

GTFOBins – https://gtfobins.github.io/

man chmod, man chown, man visudo

CIS Benchmarks for Linux

NSA/CISA Linux Hardening Guide