Linux Privilege Escalation

You have a low-privilege shell on a Linux system. Systematically reason through the privilege escalation attack surface.

**Initial Enumeration**
- What is your current user context? What groups are you in?
- What does `id`, `whoami`, `hostname`, `uname -a`, and `cat /etc/os-release` tell you?
- What environment variables are set? Are there any with credentials?

**SUID/SGID Binaries**
- How do you find all SUID binaries and which ones are interesting?
- How do you use GTFOBins to exploit a writable or SUID binary?
- What is the difference between a SUID binary that runs as root vs one that runs as another user?

**Sudo Configuration**
- What does `sudo -l` reveal?
- How do you exploit a sudo entry like `(ALL) NOPASSWD: /usr/bin/vim`?
- What is the sudoers `!root` bypass (CVE-2019-14287)?
- What does `(ALL, !root) NOPASSWD:` actually allow?

**Writable Files & Cron Jobs**
- How do you identify world-writable files that are executed by root?
- How do you find cron jobs running as root and exploit writable scripts?
- What is cron PATH hijacking?

**Kernel Exploits**
- How do you identify the kernel version and search for local privilege escalation exploits?
- Why are kernel exploits a last resort and what risks do they carry?

**Service Misconfigurations**
- What do weak service permissions allow on Linux?
- How do you exploit NFS with no_root_squash?

Output:
- Privilege escalation checklist (ordered by likelihood/impact)
- GTFOBins workflow
- linPEAS interpretation guide