Escalate on a Linux VM you weakened, by enumeration

short · 60 min · Objective 4.3

Task

Escalate from a restricted user to root on a Linux VM you built and deliberately weakened, finding the path by enumeration rather than by an exploit — because most escalations come from noticing what is already there, not from a CVE.

Steps

On the lab you own, build a disposable Linux VM and plant one escalation path: a misconfigured sudo rule, a SUID binary that should not be, a writable path in a privileged service, or a group membership that grants too much. Snapshot it.
Log in as a restricted user and enumerate first: who you are, your groups, what you can run with sudo, world-writable files in privileged locations, SUID binaries.
Identify the path you planted from the enumeration alone, and record how you spotted it in /tmp/path.md.
Escalate to root by that path.
Read the logs and note what a defender would have seen.
Revert to the snapshot.

Verify

id | grep -qE "uid=0|root" && echo "escalated: root" || echo "still restricted"
grep -ciE "sudo|suid|writable|group" /tmp/path.md
grep -ciE "log|auth|defender|observed" /tmp/defender-view.md

The first must print escalated: root when run in your escalated shell — the demonstrable outcome. The second must be non-zero: you recorded which enumeration finding revealed the path, because the skill is noticing it, not running an exploit. The third must be non-zero: you recorded the defender's view, which feeds the report's remediation.

Notes

Group membership is frequently the whole answer — a group with access to a container runtime, a virtualisation device or a backup tool is often equivalent to root. Escalation is mostly enumeration: the flaw is usually already there and the work is noticing it. This is also why credential dumping (lesson 29) follows escalation in practice — you usually need root first. Everything ran on a disposable VM you built.

This is an independent study companion for CompTIA PenTest+ PT0-003 and is not produced by or endorsed by CompTIA.