Linux Privilege Escalation 2026 — SUID, Sudo Misconfig & Cron Jobs Complete Guide | Hacking Course Day31

This article is a comprehensive guide to Linux privilege escalation techniques for Day 31 of a 100-day ethical hacking course. It covers four primary escalation vectors—SUID binary exploitation, sudo misconfiguration abuse, cron job manipulation, and PATH hijacking—along with enumeration tools and practical exercises. The article demonstrates that initial low-privilege shell access is insufficient; attackers must escalate to root to achieve meaningful system compromise and establish persistent access.

• Four Core Escalation VectorsThe article identifies SUID binaries (programs running as their owner regardless of executor), misconfigured sudo rules (commands executable as root without password), writable cron job scripts (scheduled tasks that can be replaced with malicious code), and PATH hijacking (executing malicious binaries when root-owned scripts use relative paths). These four vectors are presented as covering the vast majority of real-world Linux escalation scenarios.
• LinPEAS for Automated DiscoveryLinPEAS is an automated enumeration script downloaded from the PEASS-ng GitHub repository that color-codes findings by severity (RED for critical, YELLOW for interesting). The article instructs users to run LinPEAS first, save output to a file, then manually verify and exploit the highest-confidence RED findings using GTFOBins rather than attempting all findings simultaneously.
• GTFOBins as Exploitation ReferenceGTFOBins (gtfobins.github.io) is presented as the essential reference resource containing exact command examples for exploiting every discoverable binary for SUID escalation, sudo escalation, file operations, and shell spawning. The article emphasizes that every binary found in sudo rules or SUID results should be checked against GTFOBins before exploitation attempts.
• SUID Binary Exploitation TechniquesThe article provides specific exploit commands for common SUID binaries: Python uses `os.setuid(0)` to change effective UID before spawning bash; find uses the `-exec /bin/sh -p` flag; vim uses `:!/bin/bash` in command mode; and bash uses the `-p` flag to preserve SUID privileges. Python escalation is noted as fastest and most reliable for immediate interactive root shells.
• Sudo Rule Exploitation Despite RestrictionsThe article demonstrates that sudo rules restricting file access (such as `(root) NOPASSWD: /usr/bin/nano /var/log/app.log`) can still be exploited because file restrictions cannot prevent in-binary command execution. For example, nano allows spawning shells via Ctrl+R then Ctrl+X followed by `reset; sh 1>&0 2>&0`, and vim allows `:!/bin/bash`. Every binary in a sudo rule must be checked in GTFOBins for its command execution capabilities.
• Cron Job Abuse Through Writable ScriptsThe article explains that root-owned cron scripts with world-writable file permissions (such as `-rwxrwxrwx`) can be replaced entirely with malicious payloads. A script running every 5 minutes can be overwritten with a reverse shell, guaranteeing root access but requiring up to 5 minutes of wait time. This is identified as highest-impact but lower-speed compared to immediate SUID exploitation.
• PATH Hijacking in Root-Run ScriptsPATH hijacking exploits root-owned scripts that use relative paths (such as `ping -c 1 localhost` instead of `/bin/ping`) combined with world-writable directories in the PATH environment variable. An attacker creates a malicious binary with the same name in a writable PATH directory; when the root script executes, it runs the attacker's binary instead, providing root-level code execution at the next scheduled execution.
• MITRE ATT&CK Mapping for ReportingThe article specifies that professional penetration test reporting requires mapping each privilege escalation finding to MITRE ATT&CK technique IDs: T1548.001 for SUID, T1548.003 for sudo, T1053.003 for cron abuse, and T1574.007 for PATH hijacking. The article states that findings without MITRE references are less actionable for blue team threat intelligence and detection capabilities.

Bottom line: Successful Linux privilege escalation requires systematic enumeration using LinPEAS, identification of vulnerable binaries and misconfigurations using GTFOBins cross-reference, and exploitation prioritized by speed and reliability—with SUID Python offering immediate root access while cron job abuse guarantees root but requires waiting. Root access (uid=0) is not merely a technical goal but the prerequisite for meaningful persistence and system compromise.