Agent skill · security · aiskillstore
privilege-escalation-knowledge
Comprehensive knowledge about Linux privilege escalation. Provides methodologies for enumerating and exploiting privesc vectors including SUID binaries, sudo permissions, capabilities, kernel exploits, cron jobs, and common misconfigurations. Includes systematic approach to capturing root flags.
Why this skill is useful
Includes detailed methodologies and executable scripts for privilege escalation that extend the AI's capabilities in cybersecurity.
What it needs
Requires curl, wget installed locally. About 8k tokens when loaded. Last updated 2026-08-07. 405 stars on the source repository.
What this skill does
Privilege Escalation Knowledge Base Purpose This knowledge base provides comprehensive privilege escalation methodologies for Linux systems. It covers escalating from low-privilege users (www-data, user) to root, then capturing the root flag. Layered Privilege Escalation Strategy Core Principle: Escalate systematically through 3 layers - from quick wins to exhaustive enumeration. Layer Framework: Escalation Triggers: Layer 1 finds nothing obvious → Run Layer 2 enumeration Layer 2 finds vectors but exploitation fails → Try Layer 3 alternatives Layer 3 fails → Re-examine reconnaissance, may have missed service/config Core Strategy Systematic execution: 1. Quick Wins (Layer 1): Check easy vectors first (sudo, SUID, capabilities) 2. Deep Enumeration (Layer 2): Use automated tools to find all vectors 3. Alternative Vectors (Layer 3): Kernel exploits, container escape, NFS 4. Exploitation: Execute chosen privesc method 5. Root Flag: Locate and read root.txt 6. Verification: Confirm root access with id, whoami Tools Available Enumeration Scripts linpeas.sh - Comprehensive automated enumeration linenum.sh - Alternative enumeration script pspy - Monitor processes without root Manual Commands sudo -l - Check sudo permissions find / -perm -4000 2>/dev/null - Find SUID binaries getcap -r / 2>/dev/null - Find capabilities crontab -l - Check user cron jobs cat /etc/crontab - Check system cron jobs References GTFOBins (https://gtfobins.github.io/) - SUID/sudo exploitation PayloadsAllTheThings - Privesc cheatsheet Enumeration Workflow Phase 1: Quick Manual Checks Execute these immediately: Phase 2: Automated Enumeration Download and run linpeas: If can't download, use one-liner: Common Privilege Escalation Vectors 1. Sudo Abuse (Most Common) 2. SUID Binaries 3. Capabilities 4. Writable /etc/passwd 5. Cron Jobs 6. Writable Service Files 7. Kernel Exploits (Last Resort) 8. Docker/Container Escape 9. Credentials in Files 10. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills aiskillstore/privilege-escalation-knowledge