> For the complete documentation index, see [llms.txt](https://riteshs4hu.gitbook.io/infosec-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://riteshs4hu.gitbook.io/infosec-notes/internal-and-external-network-sec/privilege-escalation/linux/acl-exploitation.md).

# ACL Exploitation

**Access Control Lists (ACL)** allow more granular permissions than standard Unix file permissions. With ACLs, specific users or groups can be given read, write, or execute permissions on individual files or directories, beyond the traditional owner/group/others model.

***

### ACL Detection and Enumeration

#### Detect ACL Usage

When using `ls -lha`, files or directories that have ACLs applied will show a `+` at the end of the permission string:

Example:

```
drwxrwxr-x+  2 root root 4.0K Apr 10 20:45 example_dir
```

The `+` symbol indicates ACLs are present.

***

#### View ACLs on a File or Directory

```bash
getfacl <filename or directory>
```

Example:

```bash
getfacl /etc/passwd
```

Sample Output:

```
# file: /etc/passwd
# owner: root
# group: root
user::rw-
user:username:rw-
group::r--
mask::rw-
other::r--
```

***

### Managing ACLs

#### Set ACL for a User

```bash
setfacl -m u:username:rwx /path/to/file
```

#### Set ACL for a Group

```bash
setfacl -m g:groupname:rx /path/to/file
```

#### Remove ACL for a Specific User

```bash
setfacl -x u:username /path/to/file
```

#### Remove All ACLs from a File

```bash
setfacl -b /path/to/file
```

#### Apply ACL Recursively to a Directory

```bash
setfacl -Rm u:username:rwX /path/to/directory
```

***

### Privilege Escalation via ACL Misconfiguration

If ACLs are misconfigured, a low-privileged user may be able to access or modify sensitive files owned by root or other users. This can be abused to gain elevated privileges.

#### Reading Sensitive Files

If a user has read permission on files like `/etc/shadow`, password hashes can be extracted and cracked offline:

```bash
getfacl /etc/shadow
```

#### Modifying System Files

If a user has write access to `/etc/passwd`, they can inject a new root-level user with a known password hash.

Example entry:

```
root1:$6$abc123...:0:0:root:/root:/bin/bash
```