Ignitetechnologies/Privilege-Escalation

This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Privilege Escalation with examples.

3,645

164 commits

updated Mar 14, 2026

See the code

README

⬆️ Privilege Escalation for Pentesters

A practical Privilege Escalation cheat sheet and reference guide designed for CTF players, penetration testers, and cybersecurity learners to understand how attackers escalate privileges on compromised systems

🌐 Connect With Us

🔵 Telegram – Join Channel
⚫ Twitter/X – Follow Us
🟣 Discord – Join Server
💼 LinkedIn – Follow HackingArticles

🎓 Training Program

🚀 Join Our Cybersecurity Training Program

Hands-on training in Penetration Testing, Red Teaming, and Cybersecurity.

Table of Contents

Abusing Sudo Rights ⤴

No.Machine NameFiles/Binaries
1.Ted:1apt-get
2.KFIOFan : 1awk
3.21 LTR: Scene1cat
4.Skytowercat
5.Matrix : 1cp
6.Sputnik 1ed
7.Sunseted
8.DC-2git
9.Kioptrix : Level 1.2ht
10.Matrix-3manual
11.symfonos : 2MySQL
12.Developmentnano
13.SP ikenmap
14.DC6nmap
15.Dinaperl
16.Wakanda : 1pip
17.Violatorproftpd
18.Broken: Galleryreboot/timedatectl
19.DE-ICE:S1.120script
20.Fristileaksscript
21.DerpNStinkscript
22.Digitalworld.local : JOYscript
23.PumpkinFestivalscript
24.The Ether: Evil Sciencescript
25.HA:Rudrascript
26.djinn:1script
27.UA: Literally Vulnerablescript
28.PumpkinRaisingstrace
29.Unknowndevice64 : 1strace
30.Holynix: v1tar
31.Breach 2.1tcpdump
32.Temple of Doomtcpdump
33.Web Developer : 1tcpdump
34.DC-4teehee
35.Serial: 1vim
36.Zico 2zip
37.HA: Dhanushzip
38.Sunset: Nightfallcat
39.HA: Infinity Stonesftp
40.Sunset-Sunrisewine
41.Me and My Girlfreind:1php
42.Symfonos:5dpkg
43.Five86:2service
44.Tempus Fugit:1Diffrent for every user
45.DevRandom CTF:1.1dpkg
46.Zion: 1.1cp
47.Seppuku:1script
48.GitRoot: 1git
49.Tre:1shutdown
50.BlackRose: 1script
51.So Simple:1script
52.CryptoBank:1All
53.Star Wars:1All
54.Mercuryscript
55.Durian:1script
56.nyx:1gcc
57.Relevant:1node
58.Maskcrafter:1.1dpkg
59.Hogwarts:Bellatrixvim

SUID Bit ⤴

No.Machine NameSUID Bit
1.Kevgircp
2.digitalworld.local - BRAVERYcp
3.Happycorp : 1cp
4.FourAndSix : 2doas
5.DC-1find
6.dpwwn:2find
7.MinU: v2Micro Editor
8.Toppo:1python 2.7/mawk
9.Mr. Robotnmap
10.Covfefescript
11./dev/random : K2script
12.hackme1script
13.Sunset: dawnzsh
14.HA: Wordycp
15.bossplayersCTF 1find
16.In Plain Sight:1script
17.Five86:1script
18.Geisha:1base32
19.Victim:1nohup
20.eLection: 1script
21.Photographer 1php7.2
22.DMV :1script
23.ShellDredd #1 Hannahcpulimit
24.KB-Vuln:3systemctl
25.Cybox:1register

Kernel Exploit ⤴

No.Machine NameKernelExploit
1.pWnOS -1.0Linux Kernel 2.6.17 < 2.6.24.15092
2.LAMPSecurity: CTF 5Linux Kernel 2.4/2.69479
3.Kioptrix : Level 1.1CentOS 4.4/4.5 / Fedora Core 4/5/6 x86)9542
4.Hackademic-RTB1RDS Protocol' Local Privilege Escalation15285
5.Hackademic-RTB2RDS Protocol' Local Privilege Escalation15285
6.ch4inrulz : 1.0.1RDS Protocol' Local Privilege Escalation15285
7.Kioprtix: 5FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation28718
8.SimpleApport/Abrt (Ubuntu / Fedora)36746
9.SecOS: 1Ubuntu 12.04/14.04/14.10/15.0437292
10.DroopyUbuntu 12.04/14.04/14.10/15.0437292
11.VulnOS: 2.0Ubuntu 12.04/14.04/14.10/15.0437292
12.FartknockerUbuntu 12.04/14.04/14.10/15.0437292
13.Super MarioUbuntu 12.04/14.04/14.10/15.0437292
14.Golden Eye:1Ubuntu 12.04/14.04/14.10/15.0437292
15.Typhoon : 1.02Ubuntu 12.04/14.04/14.10/15.0437292
16.GrimTheRipper:1Ubuntu 12.04/14.04/14.10/15.0437292
17.6daysUbuntu 12.04/14.04/14.10/15.0437292
18.Lord of the RootUbuntu 14.04/15.1039166
19.Acid ReloadedUbuntu 14.04/15.1039166
20.StaplerUbuntu 16.0439772
21.SidneyUbuntu 16.0439772
22.DC-3Ubuntu 16.0439772
23.PluckDirty COW40616
24.Lampiao : 1Dirty COW /proc/self/mem' Race Condition40847
25.WinterMute : 1GNU Screen 4.5.041154
26.DC-5GNU Screen 4.5.041154
27.BTRSys:dv 2.1Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free41458
28.NightmareUbuntu 14.04/16.04 (KASLR / SMEP)43418
29.TrollcaveLinux Kernel < 4.4.0-116 (Ubuntu 16.04.4)44298
30.Prime: 1Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4)44298
31.LAMPSecurity: CTF6Linux Kernel 2.68478
32.My File Server:1Dirty COW40616
33.VulnUni 1.0.1GUnet OpenEclass E-learning platform 1.7.348106
34.Sumo: 1Dirty COW40839
35.CyberSploit: 1Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs'37292
36.Loly: 1Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)45010
37.Tomato: 1Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)45010

Path Variable ⤴

No.Path VariableFiles
1.PwnLabcat
2.USVcat
3.Zeus:1date
4.The Gemini incdate
5.EW-Skuzzyid
6.Nullbyteps
7.symfonos : 1curl
8.Silky-CTF: 0x01whoami
9.Beast 2whoami
10.HA:Arsenal Avengersifconfig
11.Inclusiveness:1whoami
12.MuzzyBox:1ls
13.TBBT:2sl
14.Sunset: Midnightservice
15.Healthcare:1fdisk

Enumeration ⤴

MySQL ⤴

Cronjob ⤴

Wildcard Injection ⤴

NoMachine Name
1.Milnet
2.Pipe

Capabilities ⤴

Writable /etc/passwd file ⤴

Writable files or script ⤴

Buffer Overflow ⤴

Docker ⤴

Chkrootkit ⤴

Bruteforce ⤴

Crack /etc/shadow ⤴

NFS ⤴

NoMachine Name
1.Orcus
2.FourAndSix

Json ⤴

NoMachine NameJson
1.MinU: 1Json Token
2.Symfonos:4Json Pickle

Redis ⤴

NoMachine Name
1.Gemini inc:2

LXD ⤴

NoMachine Name
1.AI: Web: 2
2.HA: Joker
3.CyNix:1

ALL ⤴

Exim⤴

NoMachine Name
1.DC:8

Apache2 Writable ⤴

NoMachine Name
1.Torment
2.HA: Armour
cheatsheet

|3.|HA: Natraj

cheatsheet
ctf
ctf-challenges
ctf-writeups
hack
hacking
oscp
oscp-journey
oscp-prep
privilege-escalation
vulnhub

Ignitetechnologies/Privilege-Escalation

This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Privilege Escalation with examples.

3,645

164 commits

updated Mar 14, 2026

See the code

README

⬆️ Privilege Escalation for Pentesters

A practical Privilege Escalation cheat sheet and reference guide designed for CTF players, penetration testers, and cybersecurity learners to understand how attackers escalate privileges on compromised systems

🌐 Connect With Us

🔵 Telegram – Join Channel
⚫ Twitter/X – Follow Us
🟣 Discord – Join Server
💼 LinkedIn – Follow HackingArticles

🎓 Training Program

🚀 Join Our Cybersecurity Training Program

Hands-on training in Penetration Testing, Red Teaming, and Cybersecurity.

Table of Contents

Abusing Sudo Rights ⤴

No.Machine NameFiles/Binaries
1.Ted:1apt-get
2.KFIOFan : 1awk
3.21 LTR: Scene1cat
4.Skytowercat
5.Matrix : 1cp
6.Sputnik 1ed
7.Sunseted
8.DC-2git
9.Kioptrix : Level 1.2ht
10.Matrix-3manual
11.symfonos : 2MySQL
12.Developmentnano
13.SP ikenmap
14.DC6nmap
15.Dinaperl
16.Wakanda : 1pip
17.Violatorproftpd
18.Broken: Galleryreboot/timedatectl
19.DE-ICE:S1.120script
20.Fristileaksscript
21.DerpNStinkscript
22.Digitalworld.local : JOYscript
23.PumpkinFestivalscript
24.The Ether: Evil Sciencescript
25.HA:Rudrascript
26.djinn:1script
27.UA: Literally Vulnerablescript
28.PumpkinRaisingstrace
29.Unknowndevice64 : 1strace
30.Holynix: v1tar
31.Breach 2.1tcpdump
32.Temple of Doomtcpdump
33.Web Developer : 1tcpdump
34.DC-4teehee
35.Serial: 1vim
36.Zico 2zip
37.HA: Dhanushzip
38.Sunset: Nightfallcat
39.HA: Infinity Stonesftp
40.Sunset-Sunrisewine
41.Me and My Girlfreind:1php
42.Symfonos:5dpkg
43.Five86:2service
44.Tempus Fugit:1Diffrent for every user
45.DevRandom CTF:1.1dpkg
46.Zion: 1.1cp
47.Seppuku:1script
48.GitRoot: 1git
49.Tre:1shutdown
50.BlackRose: 1script
51.So Simple:1script
52.CryptoBank:1All
53.Star Wars:1All
54.Mercuryscript
55.Durian:1script
56.nyx:1gcc
57.Relevant:1node
58.Maskcrafter:1.1dpkg
59.Hogwarts:Bellatrixvim

SUID Bit ⤴

No.Machine NameSUID Bit
1.Kevgircp
2.digitalworld.local - BRAVERYcp
3.Happycorp : 1cp
4.FourAndSix : 2doas
5.DC-1find
6.dpwwn:2find
7.MinU: v2Micro Editor
8.Toppo:1python 2.7/mawk
9.Mr. Robotnmap
10.Covfefescript
11./dev/random : K2script
12.hackme1script
13.Sunset: dawnzsh
14.HA: Wordycp
15.bossplayersCTF 1find
16.In Plain Sight:1script
17.Five86:1script
18.Geisha:1base32
19.Victim:1nohup
20.eLection: 1script
21.Photographer 1php7.2
22.DMV :1script
23.ShellDredd #1 Hannahcpulimit
24.KB-Vuln:3systemctl
25.Cybox:1register

Kernel Exploit ⤴

No.Machine NameKernelExploit
1.pWnOS -1.0Linux Kernel 2.6.17 < 2.6.24.15092
2.LAMPSecurity: CTF 5Linux Kernel 2.4/2.69479
3.Kioptrix : Level 1.1CentOS 4.4/4.5 / Fedora Core 4/5/6 x86)9542
4.Hackademic-RTB1RDS Protocol' Local Privilege Escalation15285
5.Hackademic-RTB2RDS Protocol' Local Privilege Escalation15285
6.ch4inrulz : 1.0.1RDS Protocol' Local Privilege Escalation15285
7.Kioprtix: 5FreeBSD 9.0 - Intel SYSRET Kernel Privilege Escalation28718
8.SimpleApport/Abrt (Ubuntu / Fedora)36746
9.SecOS: 1Ubuntu 12.04/14.04/14.10/15.0437292
10.DroopyUbuntu 12.04/14.04/14.10/15.0437292
11.VulnOS: 2.0Ubuntu 12.04/14.04/14.10/15.0437292
12.FartknockerUbuntu 12.04/14.04/14.10/15.0437292
13.Super MarioUbuntu 12.04/14.04/14.10/15.0437292
14.Golden Eye:1Ubuntu 12.04/14.04/14.10/15.0437292
15.Typhoon : 1.02Ubuntu 12.04/14.04/14.10/15.0437292
16.GrimTheRipper:1Ubuntu 12.04/14.04/14.10/15.0437292
17.6daysUbuntu 12.04/14.04/14.10/15.0437292
18.Lord of the RootUbuntu 14.04/15.1039166
19.Acid ReloadedUbuntu 14.04/15.1039166
20.StaplerUbuntu 16.0439772
21.SidneyUbuntu 16.0439772
22.DC-3Ubuntu 16.0439772
23.PluckDirty COW40616
24.Lampiao : 1Dirty COW /proc/self/mem' Race Condition40847
25.WinterMute : 1GNU Screen 4.5.041154
26.DC-5GNU Screen 4.5.041154
27.BTRSys:dv 2.1Linux Kernel 4.4.0 (Ubuntu) - DCCP Double-Free41458
28.NightmareUbuntu 14.04/16.04 (KASLR / SMEP)43418
29.TrollcaveLinux Kernel < 4.4.0-116 (Ubuntu 16.04.4)44298
30.Prime: 1Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4)44298
31.LAMPSecurity: CTF6Linux Kernel 2.68478
32.My File Server:1Dirty COW40616
33.VulnUni 1.0.1GUnet OpenEclass E-learning platform 1.7.348106
34.Sumo: 1Dirty COW40839
35.CyberSploit: 1Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs'37292
36.Loly: 1Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)45010
37.Tomato: 1Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27)45010

Path Variable ⤴

No.Path VariableFiles
1.PwnLabcat
2.USVcat
3.Zeus:1date
4.The Gemini incdate
5.EW-Skuzzyid
6.Nullbyteps
7.symfonos : 1curl
8.Silky-CTF: 0x01whoami
9.Beast 2whoami
10.HA:Arsenal Avengersifconfig
11.Inclusiveness:1whoami
12.MuzzyBox:1ls
13.TBBT:2sl
14.Sunset: Midnightservice
15.Healthcare:1fdisk

Enumeration ⤴

MySQL ⤴

Cronjob ⤴

Wildcard Injection ⤴

NoMachine Name
1.Milnet
2.Pipe

Capabilities ⤴

Writable /etc/passwd file ⤴

Writable files or script ⤴

Buffer Overflow ⤴

Docker ⤴

Chkrootkit ⤴

Bruteforce ⤴

Crack /etc/shadow ⤴

NFS ⤴

NoMachine Name
1.Orcus
2.FourAndSix

Json ⤴

NoMachine NameJson
1.MinU: 1Json Token
2.Symfonos:4Json Pickle

Redis ⤴

NoMachine Name
1.Gemini inc:2

LXD ⤴

NoMachine Name
1.AI: Web: 2
2.HA: Joker
3.CyNix:1

ALL ⤴

Exim⤴

NoMachine Name
1.DC:8

Apache2 Writable ⤴

NoMachine Name
1.Torment
2.HA: Armour
cheatsheet

|3.|HA: Natraj

cheatsheet
ctf
ctf-challenges
ctf-writeups
hack
hacking
oscp
oscp-journey
oscp-prep
privilege-escalation
vulnhub

Significant stargazers

g0tmi1k

3,562 followers · starred Aug 2019

Siddharth Balyan

415 followers · starred Aug 2021

Koen Rouwhorst

165 followers · starred Mar 2020

Terminal

65 followers · starred Aug 2019