PWNMI

Guides

Script Privilege Escalation: An Analysis Checklist

Updated July 23, 2026 · Written by PWNMI — see About.

Most CTF privilege escalation challenges — and a fair number of real internal pentests — come down to a script running as root that does something it shouldn't. This is the checklist to actually run through when you land on a box with a promising cron job or a sudo entry: what to look for, in what order, and why each category of bug shows up as often as it does.

1. Locate & Scope

  • sudo -l — note any script you can run, NOPASSWD, and whether you control its arguments. See Sudo Misconfiguration for this exact technique worked end-to-end.
  • find / -perm -4000 2>/dev/null — SUID binaries, including custom scripts/wrappers. See SUID Binary Abuse for this exact technique worked end-to-end.
  • Cron: cat /etc/crontab, /etc/cron.d/*, ls -la /var/spool/cron/crontabs/. If unreadable, use pspy to catch root cron jobs you can't view directly. See Cron Job Hijacking for this exact technique worked end-to-end.
  • Running the whole box through linPEAS surfaces most of what's below automatically — useful as a first pass, but know what each finding actually means rather than just running the suggested one-liner it prints. The rest of this checklist is what to understand well enough to work through by hand when a tool isn't an option.
  • Check who can write the script itself, its parent directory, and any config/log files it reads or writes: ls -la <script> ls -la $(dirname <script>) If you can write the script and it runs as root — stop here, you're done.

2. Static Read-Through

Read the whole script once for context. Then re-scan specifically for each category below — don't just read top to bottom.

Command construction

  • Unquoted variables in commands (rm $file vs rm "$file") — word-splitting/argument injection.
  • User-influenced data reaching os.system, subprocess(shell=True), backticks, eval, exec.
  • Wildcard use with tar, chown, rsync, zip, chmod in a directory you can write to — check GTFOBins "wildcard" entries for exact payloads.

PATH / environment trust

  • Bare binary names (cp, find, curl) instead of absolute paths (/bin/cp) — if PATH isn't reset, you can shadow the binary.
  • sudo -l showing env_keep for LD_PRELOAD, LD_LIBRARY_PATH, PYTHONPATH, PERL5LIB — lets you hijack execution even if the script is clean.
  • Trusted bash functions/aliases, or IFS not reset before word-splitting.

File operations

  • Reads/writes in world-writable dirs (/tmp, /var/tmp) without ownership checks first — race condition / TOCTOU (write-then-check, or symlink swap between check and use).
  • Blindly following symlinks on a path you control.
  • Predictable temp/log filenames with weak permissions.

Language-specific traps

  • Python: pickle.load / yaml.load (not safe_load) on attacker-controlled data; subprocess.call(cmd, shell=True); eval()/input() on args.
  • Perl: two-arg open(FH, "$file") — lets you inject shell metacharacters via filename (e.g. | id |); backticks with interpolated vars.
  • Bash: source/. on a path you can influence; read into an array then eval-ing it.

Logic flaws

  • Validation based on filename/extension, not content.
  • Missing -- before user-supplied args (flag injection, e.g. tar --checkpoint-action trick).
  • Hardcoded creds/keys worth reusing elsewhere.

3. Verify

  • Test the candidate flaw in isolation before committing — confirm the exact execution context (root cron vs. sudo you invoke directly), since exploitation mechanics differ:
    • Cron: race conditions, symlink attacks, PATH hijacking.
    • Sudo: usually GTFOBins-style argument abuse if you control CLI args.
  • Cross-check any external binary the script calls against GTFOBins if sudo lets you run it with specific args.

Quick Triage Order

  1. Sudo args you control
  2. PATH / environment trust
  3. Wildcard injection
  4. Writable temp files / race conditions
  5. Unsafe eval / deserialization
  6. Symlink attacks

Most HTB script-based privescs resolve in the first three.

Next step

This assumes you're already comfortable with permissions and SUID basics — see Linux fundamentals if not. For the concepts behind why privesc works at all, and how this checklist relates to the Windows side, see Privilege Escalation Fundamentals. To practice each item on this list hands-on against a real, deliberately misconfigured container rather than just reading about it, see the Privilege Escalation Techniques labs — SUID abuse, sudo misconfiguration, cron hijacking, capabilities abuse, and a writable /etc/passwd, each built, exploited, and verified the same rigorous way as this site's CVE labs. For the Windows equivalent of this same checklist, see Windows Privilege Escalation; once you've escalated locally and want to move to the domain the box belongs to, see the Active Directory attack chain. If you want a priv window ready and waiting when you get there, see why I run every engagement through tmux.