Privilege escalation is how an attacker with limited initial access (a low-privilege account, a compromised application) attempts to gain full root/administrator control. Understanding common techniques helps you close these paths proactively.
What Privilege Escalation Means
Gaining higher-level access than initially obtained — an attacker who compromises a low-privilege web application account, for example, attempts privilege escalation to gain root access to the entire server, dramatically increasing the impact of the initial compromise.
Common Privilege Escalation Vectors
Misconfigured sudo Permissions
sudo -lReview what commands a user can run with sudo — overly broad sudo permissions (especially NOPASSWD for dangerous commands) can be exploited if that user's account is compromised.
Vulnerable SUID/SGID Binaries
find / -perm -4000 -o -perm -2000 2>/dev/nullSUID binaries run with the file owner's privileges regardless of who executes them — a custom or misconfigured SUID binary can be a direct privilege escalation path if it can be manipulated to execute arbitrary commands.
World-Writable Files Owned by Root or Privileged Processes
find / -perm -0002 -user root 2>/dev/nullIf a low-privilege user can modify a file that root later executes or reads in a privileged context, this is a direct escalation path.
Kernel Vulnerabilities
Unpatched kernel vulnerabilities can sometimes be directly exploited for privilege escalation — another strong reason for keeping the kernel updated (see How to Enable Automatic Security Updates on Ubuntu & Debian).
Cron Jobs Running as Root with Insecure Scripts
If a root-owned cron job executes a script that a lower-privileged user can modify, that's a direct escalation path — see How to Secure Cron Jobs and Scheduled Tasks.
Prevention: Apply the Principle of Least Privilege
See How to Implement the Principle of Least Privilege on a Linux VPS — the foundational defense; users and processes should have only the minimum access genuinely needed, limiting what any single compromise can actually achieve.
Prevention: Regular Permission Audits
See How to Audit and Fix File and Directory Permissions on a Linux VPS — regularly check for unexpected SUID binaries, world-writable files, and overly permissive sudo configurations.
Prevention: Restrict sudo Access Carefully
sudo visudoGrant sudo access to specific commands rather than blanket full sudo where possible, and avoid NOPASSWD for anything genuinely sensitive.
Prevention: Keep Everything Patched
Kernel and application vulnerabilities are regularly discovered and patched — timely patching (see relevant automatic update guides) closes known escalation vectors before they can be exploited.
Detection: Monitor for Escalation Attempts
See How to Monitor Auth Logs and Detect Intrusion Attempts on a Linux VPS and How to Set Up Audit Logging for Compliance Requirements — log and review sudo usage and privilege-related events, watching for unusual patterns.
Common Errors
Discovering an unexpected SUID binary you don't recognize — investigate its origin immediately; an unfamiliar SUID binary, especially one you didn't intentionally install, is a significant red flag potentially indicating existing compromise.
Continue Reading
- How to Implement the Principle of Least Privilege on a Linux VPS
- How to Audit and Fix File and Directory Permissions on a Linux VPS
- How to Secure Cron Jobs and Scheduled Tasks
Browse more articles in Server Security & Hardening.
