26.3 Common Escalation Paths

By Ravindra Bagale Last updated: 27 September 2026

sudo misconfiguration. If sudo -l shows you can run an editor, interpreter or shell as root, you can usually get a root shell. The site GTFOBins documents how each binary can be misused.

sudo -l                       # e.g. "(root) NOPASSWD: /usr/bin/find"
sudo find . -exec /bin/sh \; -quit   # abuse find to spawn a root shell (lab example)

SUID binaries. A file with the SUID bit runs with its owner's rights. A misconfigured or vulnerable SUID root binary can give a root shell (check each one on GTFOBins).

find / -perm -4000 -type f 2>/dev/null
# example: an SUID 'nmap' (old interactive mode) or 'cp', 'vim', 'bash' can lead to root

Writable cron job / script. If root runs a script on a schedule and you can edit that script, your code runs as root.

cat /etc/crontab
ls -la /path/to/script/root/runs.sh    # if you can write it, add a reverse shell line

Kernel exploits. A very old kernel may have a local exploit (for example the classic "Dirty COW"). Match uname -r to a known exploit with searchsploit – but kernel exploits can crash the box, so try safer paths first.

Kernel exploits can crash the system

Kernel exploits are the loudest and riskiest option – they can freeze the machine. That is why you take a snapshot first and prefer sudo/SUID/cron paths. In a real job these run only with explicit permission.

Ravindra Bagale's Tip

GTFOBins (gtfobins.github.io) is the "cheat sheet" of privilege escalation – it is where you check which binary can give root. But don't just memorise it; first understand what the command does. "What is SUID?" is a question that almost always comes up in interviews.

Lab

On Metasploitable 2, pick one SUID binary from your list, look it up on GTFOBins, and get a root shell using the documented method. Confirm with id that you are now uid=0(root). Restore the snapshot afterwards.