Once you have a foothold on a Linux box, privilege escalation is about turning a normal user into root. This is the checklist pentesters run, each tied to a free lab in the Linux Privilege Escalation course where you root a real machine in your browser. Only use these on systems you are authorised to test.
Enumerate first
id,sudo -l- who am I, what can I run as root?uname -a- kernel and OS versionfind / -perm -4000 -type f 2>/dev/null- every SUID binarycat /etc/crontab; ls -la /etc/cron.*- scheduled jobsgetcap -r / 2>/dev/null- file capabilities
Start with mapping the attack surface.
SUID binaries
A SUID binary runs as its owner (often root). If it is one that can spawn a shell or read files, you win. Check GTFOBins for the binary you found. Lab: root via a SUID binary.
sudo misconfigurations
sudo -l shows what you may run as root without a password. A single allowed editor,
pager or interpreter is usually enough. Lab:
root through sudo.
Cron jobs
A root cron job that runs a script you can write to - or uses a wildcard - hands you code execution as root. Lab: hijack a root cron job.
PATH hijacking
If a root-run program calls a command by name (not full path) and you control an earlier PATH entry, your binary runs as root. Lab: PATH hijack to root.
Writable credentials
A writable /etc/passwd or exposed secret can be the whole game. Lab:
abuse writable credentials, then put it
all together in the capstone.
Practise it properly
Reading this list is not the same as doing it. The free Linux Privilege Escalation course drops you on a real box for each technique - no VM, no setup. Brush up your Linux first with Learn Linux or the online terminal.