This is alightweight quick check. If a full post-exploitation process is needed, use post-exploit-linux or post-exploit-windows。
Linux Privilege Escalation Checklist
Sorted by success rate, check item by item (use privesc_check_linux for automatic scanning, or manually):
| # | Check Item | Command | Privilege Escalation Method |
|---|---|---|---|
| 1 | sudo privileges | sudo -l |
GTFOBins corresponding command privilege escalation |
| 2 | SUID files | find / -perm -4000 2>/dev/null |
Non-standard SUID binaries → GTFOBins |
| 3 | Capabilities | getcap -r / 2>/dev/null |
python3+cap_setuid → privilege escalation |
| 4 | Writable cron | cat /etc/crontab; ls -la /etc/cron.* |
Modify root's cron script |
| 5 | Writable /etc/passwd | ls -la /etc/passwd |
Add root user |
| 6 | Docker group | id | grep docker |
docker run mounts host |
| 7 | Kernel version | uname -r |
DirtyPipe/DirtyCow/PwnKit |
Quick Judgment: If sudo -l has any NOPASSWD entries, there is an 80% chance of privilege escalation.
Windows Privilege Escalation Checklist
| # | Check Item | Command | Privilege Escalation Method |
|---|---|---|---|
| 1 | Token privileges | whoami /priv |
SeImpersonate → Potato |
| 2 | User groups | whoami /groups |
Administrators → UAC bypass |
| 3 | Service permissions | sc qc [service] |
Writable service binary → replace |
| 4 | Unquoted Path | wmic service get name,pathname |
Unquoted path containing spaces |
| 5 | AlwaysInstall | reg query HKLM\...\Installer |
MSI SYSTEM installation |
| 6 | Automatic logon | reg query "HKLM\...\Winlogon" |
DefaultPassword leak |
| 7 | Missing patches | systeminfo |
Kernel privilege escalation CVE |
Quick Judgment: Web shells usually have SeImpersonate → prioritize Potato privilege escalation.
Use privesc_suggest to get automatic suggestions
Pass the output of whoami /all(Windows) or uname -a && sudo -l(Linux) to privesc_suggestto get matching privilege escalation paths and CVEs.
Windows Quick Judgment
- SeImpersonatePrivilege: token impersonation privilege → Potato family privilege escalation
Tool Selection
- Scenario selection: use lightweight/full check tools as needed, use them complementarily