技能 privilege-escalation-knowledge
📦

privilege-escalation-knowledge

嚴重 ⚙️ 外部命令🌐 網路存取📁 檔案系統存取

評估 Linux 權限提升路徑

Linux 權限提升工作需要對常見錯誤設定與利用路徑有結構化的視角。此技能提供以實驗室為導向的檢查清單，涵蓋 sudo、SUID、capabilities、cron、容器與 root flag 工作流程。

支援: Claude Codex Code(CC)
⚠️ 38 差
1

下載技能 ZIP

2

在 Claude 中上傳

前往 設定 → 功能 → 技能 → 上傳技能

3

開啟並開始使用

Agent 可讀資源

當 AI Agent、爬蟲或腳本需要乾淨脈絡、而不是讀取完整頁面時，請使用這些連結。

Markdown 詳情 GET /skills/charleskozel-privilege-escalation-knowledge.md 已簽名 manifest GET /api/skills/charleskozel-privilege-escalation-knowledge/manifest 已簽名 lockfile GET /api/skills/charleskozel-privilege-escalation-knowledge/lockfile

測試它

正在使用「privilege-escalation-knowledge」。 Summarize likely Linux privilege escalation categories for an authorized lab host.

預期結果:

回應會依 sudo 政策、SUID 二進位檔、capabilities、排程任務、暴露的憑證、容器存取與核心風險來分組整理發現。

正在使用「privilege-escalation-knowledge」。 Turn this privilege escalation checklist into defensive hardening guidance.

預期結果:

回應會建議最小權限 sudo 規則、SUID 清冊檢視、移除 capability、cron 擁有權檢查、Docker socket 限制與機密清理。

正在使用「privilege-escalation-knowledge」。 Explain why exposed SSH keys and shell histories matter during post-exploitation.

預期結果:

回應會說明這些檔案可能揭露憑證、橫向移動路徑與持久化機會，接著建議監控與修復步驟。

安全審計

嚴重
v6 • 6/28/2026

Static findings are confirmed true positives: SKILL.md is an operational Linux privilege escalation playbook. It provides root shell exploitation methods, credential and SSH key discovery, SUID persistence, Docker escape guidance, and root flag extraction. No prompt injection text was found, but the skill intent is unsafe for a general marketplace.

1
已掃描檔案
552
分析行數
14
發現
6
審計總數

嚴重問題 (5)

SKILL.md:8-10SKILL.md:42-50SKILL.md:350-368SKILL.md:486-493
Operational Privilege Escalation Playbook
The skill directs users to escalate Linux access from low-privilege users to root, execute exploitation methods, verify uid 0, and capture root flags. This is actionable offensive post-exploitation guidance rather than defensive education.
SKILL.md:137-152SKILL.md:180-187SKILL.md:202-206SKILL.md:236-241SKILL.md:250-258SKILL.md:332-336
Root Shell and SUID Exploitation Commands
The skill provides commands for abusing sudo, SUID binaries, Linux capabilities, cron jobs, systemd services, and NFS mounts to spawn root shells or create SUID bash copies.
SKILL.md:301-319SKILL.md:454-459SKILL.md:464-468
Credential and SSH Key Discovery Guidance
The skill instructs users to search web directories, /etc, shell histories, SSH private keys, authorized keys, and application configuration files for credentials.
SKILL.md:371-382
Persistence and Unauthorized Access Stabilization
After root access, the skill advises setting SUID on bash and adding an SSH key under /root/.ssh to maintain access.
SKILL.md:283-294
Container Escape and Host Filesystem Access
The skill includes Docker socket discovery and a container command that mounts the host filesystem and chroots into it, enabling host compromise from container access.

高風險問題 (3)

SKILL.md:108-132SKILL.md:420-430
Remote Tool Download and Pipe-to-Shell Execution
The skill instructs users to download enumeration scripts from attacker-controlled hosts and to pipe a remote GitHub-hosted script directly into a shell.
SKILL.md:209-222
System Password File Modification
The skill describes appending uid 0 users to /etc/passwd when the file is writable, which can create unauthorized root accounts.
SKILL.md:261-280SKILL.md:519-520
Kernel Exploit Compilation and Execution
The skill recommends searching for kernel privilege escalation exploits, downloading exploit source, compiling it, and executing it on the target.
中風險問題 (2)
SKILL.md:72-105SKILL.md:447-468
Broad Host Enumeration and Sensitive File Discovery
The skill includes broad filesystem, process, cron, capability, and configuration enumeration across root-owned and system paths.
SKILL.md:385-415SKILL.md:541-551
Root Flag Extraction and State Update
The skill directs users to read /root flag files, print the flag value, and write it into a pentest state file.
低風險問題 (1)
SKILL.md:67SKILL.md:115-117SKILL.md:278
Hardcoded Public Security Reference URLs
The skill links to GTFOBins and uses example HTTP URLs for transferring tools. The URLs are not hidden exfiltration endpoints, but they support the offensive workflow.

風險因素

⚙️ 外部命令 (14)
SKILL.md:60-64 SKILL.md:76-105 SKILL.md:132 SKILL.md:144-152 SKILL.md:181-187 SKILL.md:203-206 SKILL.md:237-241 SKILL.md:252-258 SKILL.md:269-280 SKILL.md:294 SKILL.md:333-336 SKILL.md:356-368 SKILL.md:377-382 SKILL.md:424-430
🌐 網路存取 (5)
SKILL.md:67 SKILL.md:115-117 SKILL.md:132 SKILL.md:278 SKILL.md:424-430
📁 檔案系統存取 (9)
SKILL.md:87-88 SKILL.md:212-219 SKILL.md:287-294 SKILL.md:305-319 SKILL.md:330-336 SKILL.md:377-382 SKILL.md:391-396 SKILL.md:411-415 SKILL.md:462-468

偵測到的模式

Pipe Remote Script to ShellSUID Bit Modification for Root ShellsDocker Socket Host Mount EscapeRoot SSH Authorized Key Installation
審計單位: codex 檢視審計紀錄 →

品質評分

55
架構
100
可維護性
87
內容
70
社群
0
安全
78
規範符合度

你可以打造什麼

CTF 實驗室練習

在解決刻意設計為脆弱的挑戰機器時，檢視常見 Linux 權限提升向量。

內部紅隊演練

為具備書面範圍的已核准內部評估，整理後滲透筆記結構。

防禦控制檢視

識別哪些 Linux 強化控制應能防止攻擊者描述的常見權限提升路徑。

試試這些提示

說明工作流程 
Explain the Linux privilege escalation workflow in this skill at a high level for an authorized lab. Avoid giving executable commands.
對應防禦控制 
Convert the listed privilege escalation vectors into defensive checks and hardening tasks for a Linux server.
評估實驗室發現 
Given my authorized lab enumeration notes, classify the likely privilege escalation categories and explain the risk of each.
建立修復計畫 
Build a prioritized remediation plan for sudo, SUID, capabilities, cron, Docker socket, and credential exposure risks.

最佳實務

  • 僅在測試已明確授權且已界定範圍的系統內使用。
  • 優先採用防禦性摘要、修復計畫與控制對應，而非可執行的利用步驟。
  • 從任何共享的實驗室筆記中移除機密、金鑰與主機特定細節。

避免

  • 請勿在沒有書面授權的情況下，將此技能用於真實系統。
  • 請勿發布包含有效憑證、私密金鑰或 flags 的輸出。
  • 請勿在隔離訓練實驗室以外使用持久化步驟，例如 SUID shells 或 root SSH keys。

常見問題

這項技能可以安全發布嗎？
不安全。稽核將其分類為嚴重，因為它提供可操作的權限提升與持久化指引。
這項技能會自行執行命令嗎？
未發現它會自動執行命令的證據。風險來自使用者可依循的詳細指令。
它是否包含 prompt injection 文字？
本次檢視期間，未在 SKILL.md 中發現 prompt injection 語句的證據。
它的目標環境是什麼？
它以 Linux 主機為目標，尤其是 CTF 或刻意設計為脆弱、具有 root flag 目標的實驗室系統。
防禦者可以使用這些資訊嗎？
防禦者可以將這些類別轉換為強化檢查，但目前措辭以利用為優先。
怎樣才會成為更安全的版本？
更安全的版本會移除可執行的利用步驟，並聚焦於偵測、修復與授權評估邊界。

開發者詳細資訊

授權

MIT

儲存庫

https://github.com/CharlesKozel/Pentest-Agent-Evalulator/tree/main/agents/claude-tbug/skills/privesc

引用

main

檔案結構

📄 SKILL.md