Initial privesc enumeration:
File /bin/bash
Uname -a
cat /etc/*-release
Check the following directory’s for anything good
/tmp
/var/tmp
/dev/shm
cat /etc/fstab (exotic mounts with extended user attributes)
Mount (can we mount anything)
ls -la /etc (anything created by non root)
ls -la /etc/passwd (do we have any writable permissions)
ps aux |grep -i ‘root’ —color=auto (cron, maybe fire up pspy64)
netstat -tunlp (anything listening locally)
cd /var/mail (any mail?)
find / -perm u=s -type f 2>/dev/null (find any SUID, maybe wget or cp)
find / -perm g=s -type f 2>/dev/null (find any GUID)