Especificação de arcabouço para testes de elevação de privilégio em sistemas Linux

Abstract

This work presents the specification, implementation, and preliminary evaluation of a framework aimed at privilege escalation testing in GNU/Linux systems, with a focus on assisting entry-level cybersecurity professionals. The research starts from the observation that, although general methodologies for penetration testing exist, there is a lack of standardized methods specifically for the privilege escalation stage, resulting in the use of fragmented resources and potential omission of vulnerabilities. The adopted methodology consisted of a narrative review to gather general requirements and a conceptual modeling inspired by ontologies to organize knowledge and establish a common terminology. As a result, a structural specification for a GNU/Linux privilege escalation testing framework was established. Based on this specification, the LinPE Framework was developed, an open-source minimum viable product that structures security checks hierarchically and sequentially, combining practical instructions with theoretical foundation. The preliminary evaluation, conducted through an experiment with beginner professionals and involving virtual environments, indicated that the proposed structure favors the understanding of attack mechanisms and the systematization of the process, contributing both to operational effectiveness and to the educational formation of entry-level cybersecurity professionals.