{"enrichment":{"faq":[{"a":"linux-privilege-escalation covers five primary vectors: SUID/SGID binary exploitation (find files with `find / -perm -4000 2>/dev/null`), capability abuse (getcap -r / 2>/dev/null), cron job manipulation, kernel vulnerabilities, and writable system files like /etc/passwd. Each vector includes enumeration commands and exploitation tables to systematically identify and exploit misconfigurations from a low-privilege shell to root access.","q":"What are the main linux privilege escalation techniques?"},{"a":"linux-privilege-escalation teaches SUID exploitation by first enumerating SUID binaries with find, then checking GTFOBins for known escape sequences. Common targets include sudo, vim, less, and custom applications. The skill provides exploitation tables mapping binary names to root-access methods, plus commands to verify file permissions and ownership before attempting escalation.","q":"How do you escalate privileges on linux using SUID binaries?"},{"a":"linux-privilege-escalation explains that Linux capabilities split root privileges into granular units. Binaries with dangerous capabilities (cap_setuid, cap_sys_admin) can be exploited to gain root. The skill shows how to enumerate capabilities with getcap, identify vulnerable assignments, and use them to spawn root shells\u2014often more reliable than SUID when present.","q":"What is capabilities abuse linux and how does it enable root access?"},{"a":"linux-privilege-escalation details cron exploitation through writable job files, wildcard injection in tar commands, and PATH manipulation. If a root cron job runs a script you can modify, or uses unquoted wildcards, you can inject commands to execute as root. The skill includes specific payloads for common cron patterns and detection methods using `crontab -l` and `/etc/cron.d` inspection.","q":"Can cron job privilege escalation lead to root access?"},{"a":"linux-privilege-escalation covers LD_PRELOAD as a library hijacking technique: if a SUID binary or sudo-wrapped command loads shared libraries, you can preload a malicious .so file to intercept function calls and gain root execution. The skill provides C code templates for crafting payloads and commands to verify if LD_PRELOAD is permitted in the target environment.","q":"How does LD_PRELOAD privilege escalation work on linux?"},{"a":"linux-privilege-escalation explains that membership in the docker group allows mounting the host filesystem inside a container to read/write root-owned files. NFS shares mounted with no_root_squash permit a low-privilege user to write files as root. The skill includes enumeration commands (groups, mount, showmount) and exploitation workflows for both vectors.","q":"What docker group and NFS misconfigurations enable root access?"}],"shadow_tags":["post-exploitation","privilege-escalation","system-hardening","vulnerability-assessment","attack-methodology","binary-exploitation","access-control-bypass","persistence-techniques","enumeration-framework"],"summary_rewrite":"This skill covers systematic Linux privilege escalation from low-privilege shell access to root. It walks through enumeration, SUID/SGID binary exploitation, capability abuse, cron job manipulation, NFS misconfigurations, writable system files, LD_PRELOAD tricks, Docker group abuse, and library hijacking\u2014with specific commands and exploitation tables for each vector."},"files":[{"bytes":10641,"path":"skills/linux-privilege-escalation/SKILL.md","sha256":"dd8a2d397b5dc47f90204b4a816b97e817fa8f1dcfe508edfac0f6a63d033241","url":"https://skillfed.io/files/yaklang/hack-skills/linux-privilege-escalation/3166afa5/SKILL.md"}],"id":"yaklang/hack-skills/linux-privilege-escalation","links":{"html":"https://skillfed.io/yaklang/hack-skills/linux-privilege-escalation","md":"https://skillfed.io/yaklang/hack-skills/linux-privilege-escalation.md","repo":"https://github.com/yaklang/hack-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":196,"language":"CSS","last_updated":"2026-06-16","license":"MIT","name":"linux-privilege-escalation","publisher":"yaklang","stars":1480},"relations":{"similar":[{"id":"zebbern/claude-code-guide/linux-privilege-escalation"},{"id":"blacklanternsecurity/red-run/linux-discovery"},{"id":"blacklanternsecurity/red-run/linux-sudo-suid-capabilities"},{"id":"hypnguyen1209/offensive-claude/privesc-linux"},{"id":"blacklanternsecurity/red-run/linux-file-path-abuse"},{"id":"Aradotso/security-skills/linux-pentesting-commands"},{"id":"AgentSecOps/SecOpsAgentKit/privesc-linpeas"},{"id":"Aradotso/security-skills/linux-pentester-practical-commands"},{"id":"Aradotso/security-skills/linux-pentester-commands"},{"id":"Aradotso/security-skills/linux-pentester-notes"}]},"slug":{"owner":"yaklang","repo":"hack-skills","skill":"linux-privilege-escalation"},"version":"3166afa5"}