Ethical Hacking & Penetration Testing
Linux Privilege Escalation
Find and fix local privesc misconfigs — SUID, sudo, caps, cron, PATH, services, kernel, audits.
Eight defensive labs on authorized intentional-vuln VMs: SUID/SGID audit, sudoers wildcards/NOPASSWD, dangerous capabilities, writable cron, PATH hijack, writable systemd units, kernel CVE assessment without exploit PoCs, and LinPEAS/Lynis-style structured reporting. Focus is identification + remediation, not weaponized attack runbooks.
- Level
- Advanced
- Duration
- 4–6 weeks
- Modules
- 4 modules · 8 lessons
- Learning method
- Lessons + labs
What you will learn
- Audit and remediate dangerous SUID/SGID custom binaries and scripts
- Harden sudoers against NOPASSWD and shell-escape utilities
- Inventory file capabilities with getcap and strip dangerous caps
- Eliminate writable root cron and relative PATH hijack patterns
- Lock down systemd unit/ExecStart permissions and service accounts
- Triage kernel advisories with patch/reboot plans — no exploit PoCs
- Produce a prioritized structured local privesc audit report
Course curriculum
Expand each module for lessons, progress, and labs assigned to that module — not a flat topic dump.
Module 1
SUID/SGID and sudoers
Audit setuid bits and dangerous sudo rules; remediate with least privilege.
0/2 lessons
Module 1
SUID/SGID and sudoers
Audit setuid bits and dangerous sudo rules; remediate with least privilege.
0/2 lessons
Lessons
- 1. SUID and SGID Auditpreview~20 min
- 2. sudoers NOPASSWD and Wildcards~20 min
Enrol to unlock full lessons and track module progress.
Module 2
Capabilities and cron integrity
Dangerous file capabilities and writable root-scheduled scripts.
0/2 lessons
Module 2
Capabilities and cron integrity
Dangerous file capabilities and writable root-scheduled scripts.
0/2 lessons
Lessons
- 1. Linux Capabilities and getcap~20 min
- 2. Writable Cron Scripts~20 min
Enrol to unlock full lessons and track module progress.
Module 3
PATH hijack and systemd services
Relative commands in privileged jobs and writable service entrypoints.
0/2 lessons
Module 3
PATH hijack and systemd services
Relative commands in privileged jobs and writable service entrypoints.
0/2 lessons
Lessons
- 1. PATH Hijack and Absolute Paths~20 min
- 2. systemd Unit and Service Permissions~20 min
Enrol to unlock full lessons and track module progress.
Module 4
Kernel triage and structured audits
CVE assessment without exploit PoCs; LinPEAS/Lynis-style reporting.
0/2 lessons
Module 4
Kernel triage and structured audits
CVE assessment without exploit PoCs; LinPEAS/Lynis-style reporting.
0/2 lessons
Lessons
- 1. Kernel CVE Assessment and Hardening~20 min
- 2. Structured Privilege Escalation Reporting~20 min
Enrol to unlock full lessons and track module progress.
Inside this course
Labs · Quizzes · Certificate
Labs below are curated for this syllabus (shared engine, course-specific assignments). They unlock with enrol; quizzes match course topics; finish ≈90%+ to claim a CYNARKS Academy certificate.
Course labs
8 assigned labs · free with this course enrol
- SUID/SGID Misconfiguration AuditUnlock via course or plan
- sudo -l Wildcards and NOPASSWDUnlock via course or plan
- Dangerous File CapabilitiesUnlock via course or plan
- Writable Cron Script AuditUnlock via course or plan
- PATH Hijack — Relative vs AbsoluteUnlock via course or plan
- Writable systemd Unit / Service AccountUnlock via course or plan
- Kernel Version CVE Assessment & HardeningUnlock via course or plan
- Structured PrivEsc Audit ReportUnlock via course or plan
Track quiz
99 questions matched to this course topics
Knowledge checks for this track only — not a separate global quiz menu.
Start track quizCYNARKS certificate
Educational completion certificate · verify by ID
Your progress: 0% · enrol to unlock claim
Enrol in this course first.