Privilege Escalation (Linux)

Question 1

SUID/SGID (Linux Escalation)

Answer 1

• Set User ID, Set Group ID

* can allow a program to be used for privilege escalation

Question 2

Sticky Bit (Linux Escalation)

Answer 2

• used shared folders like /tmp

* allow users to create files, read, and execute files owned by other users, attack cannot remove files owned by others

Question 3

Unsecure SUDO (Linux Escalation)

Answer 3

• allows user to run programs with privileges of another user

Question 4

Ret2libc (Linux Escalation)

Answer 4

• relies on overwriting program stack to create a new stack frame that calls the system function