You have the whole toolkit now
Every module was one branch of the same habit: ask the system a question, read the answer, follow anything that looks wrong. Here is the checklist, in the order worth running it:
| Check | Command | What you are looking for | ||||
|---|---|---|---|---|---|---|
['Who am I', 'id', 'groups (any sudo?)'] | ['Sudo rights', 'sudo -l', 'any allowed command, especially NOPASSWD'] | ['SUID binaries', 'find / -perm -4000 -type f 2>/dev/null', 'a tool that should not be SUID'] | ['Writable key files', 'ls -l /etc/passwd', 'a world-writable account database'] | ['Scheduled jobs', 'cat /etc/cron.d/*', 'a root job running a file you can write'] | ['How jobs call programs', 'read the scripts', 'a bare command name + a writable PATH dir'] | ['Leaked secrets', 'grep -ri pass /var/www /opt /etc 2>/dev/null', 'a password you can reuse'] |
Run it top to bottom and you will almost always find at least one way up. Real engagements add more checks — kernel version, capabilities, mounted shares, running services — but this core list carries you a long way.
Tip: Tools like LinPEAS and linenum.sh automate this whole sweep. They are fast, but learn to do it by hand first — you need to understand what they flag and why.