What problem does this paper attempt to address?

This paper aims to build a benchmarking platform for Linux privilege escalation (PE) to evaluate the effectiveness of human and automated tools in conducting PE attacks against Linux systems. Linux systems are crucial in modern computing environments and require robust security measures to prevent unauthorized access. PE attacks pose a significant threat, allowing attackers to elevate their privileges from a low-privileged account to the all-powerful root account. The paper points out that existing benchmarking sets lack precise evaluation of such attacks, particularly the absence of standardized environments for comparing human and automated tool performance. To address this, the authors developed a comprehensive Linux PE benchmark that includes a virtual system with vulnerabilities that grant low-privileged access and can lead to root-level access. The testing environment should run within a local network and be isolated to ensure the security of the host system. Additionally, each virtual machine contains only a single vulnerability or attack path, and all virtual machines will be released in an open-source format to promote extensibility and transparency. The authors analyzed attack categories in CTF (Capture the Flag) competitions and online training platforms, selecting vulnerabilities based on configuration errors rather than specific software versions. The benchmark they created encompasses different vulnerability categories like SUID/Sudo files, privilege groups/Docker, information disclosure, etc., and maps these test cases to the MITRE ATT&CK framework. To simulate human hackers' behavior, hints are provided for each test case. With this new benchmark, researchers can gain in-depth insights into the capability of privilege escalation and improve defense strategies to better protect Linux systems from potential destructive attacks. The paper concludes by emphasizing that automation tools often focus on improving the efficiency of system enumeration while still relying on manual operations for analysis and exploitation, highlighting the crucial difference between automation and manual processes in Linux privilege escalation scenarios.

Got Root? A Linux Priv-Esc Benchmark

A Sandbox System in Linux Kernel

Defense of Hidden Backdoor Technology for Web

DirtyCred: Escalating Privilege in Linux Kernel

Linux security

Implementing the principle of least administrative privilege on operating systems: challenges and perspectives

Detecting Privilege Escalation Attacks through Instrumenting Web Application Source Code.

On Root Detection Strategies for Android Devices

Linux Security: A Survey

If It Looks Like a Rootkit and Deceives Like a Rootkit: A Critical Examination of Kernel-Level Anti-Cheat Systems

Cerberus: A Novel Hypervisor to Provide Trusted and Isolated Code Execution

Unleashing Unprivileged eBPF Potential with Dynamic Sandboxing

Implementation and Automatic Testing for Security Enhancement of Linux Based on Least Privilege

BULKHEAD: Secure, Scalable, and Efficient Kernel Compartmentalization with PKS

Beyond Control: Exploring Novel File System Objects for Data-Only Attacks on Linux Systems

LLMs as Hackers: Autonomous Linux Privilege Escalation Attacks

LPET -- Mining MS-Windows Software Privilege Escalation Vulnerabilities by Monitoring Interactive Behavior

Cross Layer Attacks and How to Use Them (for DNS Cache Poisoning, Device Tracking and More)

Windows And Linux Operating Systems From A Security Perspective

Ransomware: Analysis and Evaluation of Live Forensic Techniques and the Impact on Linux based IoT Systems