Checklist - Linux Privilege Escalation

[ ] Is any unknown software running?
[ ] Is any software running with more privileges than it should have?
[ ] Search for exploits of running processes (especially the version running).
[ ] Can you modify the binary of any running process?
[ ] Monitor processes and check if any interesting process is running frequently.
[ ] Can you read some interesting process memory (where passwords could be saved)?

[ ] Is the PATH being modified by some cron and you can write in it?
[ ] Any wildcard in a cron job?
[ ] Some modifiable script is being executed or is inside modifiable folder?
[ ] Have you detected that some script could be or are being executed very frequently? (every 1, 2 or 5 minutes)

[ ] Any writable .service file?
[ ] Any writable binary executed by a service?
[ ] Any writable folder in systemd PATH?
[ ] Any writable systemd unit drop-in in /etc/systemd/system/<unit>.d/*.conf that can override ExecStart/User?

[ ] Enumerate the network to know where you are
[ ] Open ports you couldn't access before getting a shell inside the machine?
[ ] Can you sniff traffic using tcpdump?

[ ] Generic users/groups enumeration
[ ] Do you have a very big UID? Is the machine vulnerable?
[ ] Can you escalate privileges thanks to a group you belong to?
[ ] Clipboard data?
[ ] Password Policy?
[ ] Try to use every known password that you have discovered previously to login with each possible user. Try to login also without a password.

[ ] If you have write privileges over some folder in PATH you may be able to escalate privileges

[ ] Can you execute any command with sudo? Can you use it to READ, WRITE or EXECUTE anything as root? (GTFOBins)
[ ] If sudo -l allows sudoedit, check for sudoedit argument injection (CVE-2023-22809) via SUDO_EDITOR/VISUAL/EDITOR to edit arbitrary files on vulnerable versions (sudo -V < 1.9.12p2). Example: SUDO_EDITOR="vim -- /etc/sudoers" sudoedit /etc/hosts
[ ] Is any exploitable SUID binary? (GTFOBins)
[ ] Are sudo commands limited by path? can you bypass the restrictions?
[ ] Sudo/SUID binary without path indicated?
[ ] SUID binary specifying path? Bypass
[ ] LD_PRELOAD vuln
[ ] Lack of .so library in SUID binary from a writable folder?
[ ] SUDO tokens available? Can you create a SUDO token?
[ ] Can you read or modify sudoers files?
[ ] Can you modify /etc/ld.so.conf.d/?
[ ] OpenBSD DOAS command

[ ] Profile files - Read sensitive data? Write to privesc?
[ ] passwd/shadow files - Read sensitive data? Write to privesc?
[ ] Check commonly interesting folders for sensitive data
[ ] Weird Location/Owned files, you may have access to or alter executable files
[ ] Modified in last mins
[ ] Sqlite DB files
[ ] Hidden files
[ ] Script/Binaries in PATH
[ ] Web files (passwords?)
[ ] Backups?
[ ] Known files that contains passwords: Use Linpeas and LaZagne
[ ] Generic search

References