linux-privilege-escalation
This skill covers systematic Linux privilege escalation from low-privilege shell access to root. It walks through enumeration, SUID/SGID binary exploitation, capability abuse, cron job manipulation, NFS misconfigurations, writable system files, LD_PRELOAD tricks, Docker group abuse, and library hijacking—with specific commands and exploitation tables for each vector.
Linux Privilege Escalation teaches you to escalate from low-privilege shell to root via SUID, capabilities, cron abuse, and kernel exploits.
AI-generated summary based on this skill's SKILL.md
Install
yaklang/hack-skills/linux-privilege-escalation · repository language: CSS
git clone https://github.com/yaklang/hack-skills
cp -r hack-skills/skills/linux-privilege-escalation ~/.claude/skills/linux-privilege-escalationnpx skillfed install yaklang/hack-skills/linux-privilege-escalationFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are the main linux privilege escalation techniques?
linux-privilege-escalation covers five primary vectors: SUID/SGID binary exploitation (find files with `find / -perm -4000 2>/dev/null`), capability abuse (getcap -r / 2>/dev/null), cron job manipulation, kernel vulnerabilities, and writable system files like /etc/passwd. Each vector includes enumeration commands and exploitation tables to systematically identify and exploit misconfigurations from a low-privilege shell to root access.
How do you escalate privileges on linux using SUID binaries?
linux-privilege-escalation teaches SUID exploitation by first enumerating SUID binaries with find, then checking GTFOBins for known escape sequences. Common targets include sudo, vim, less, and custom applications. The skill provides exploitation tables mapping binary names to root-access methods, plus commands to verify file permissions and ownership before attempting escalation.
What is capabilities abuse linux and how does it enable root access?
linux-privilege-escalation explains that Linux capabilities split root privileges into granular units. Binaries with dangerous capabilities (cap_setuid, cap_sys_admin) can be exploited to gain root. The skill shows how to enumerate capabilities with getcap, identify vulnerable assignments, and use them to spawn root shells—often more reliable than SUID when present.
Can cron job privilege escalation lead to root access?
linux-privilege-escalation details cron exploitation through writable job files, wildcard injection in tar commands, and PATH manipulation. If a root cron job runs a script you can modify, or uses unquoted wildcards, you can inject commands to execute as root. The skill includes specific payloads for common cron patterns and detection methods using `crontab -l` and `/etc/cron.d` inspection.
How does LD_PRELOAD privilege escalation work on linux?
linux-privilege-escalation covers LD_PRELOAD as a library hijacking technique: if a SUID binary or sudo-wrapped command loads shared libraries, you can preload a malicious .so file to intercept function calls and gain root execution. The skill provides C code templates for crafting payloads and commands to verify if LD_PRELOAD is permitted in the target environment.
What docker group and NFS misconfigurations enable root access?
linux-privilege-escalation explains that membership in the docker group allows mounting the host filesystem inside a container to read/write root-owned files. NFS shares mounted with no_root_squash permit a low-privilege user to write files as root. The skill includes enumeration commands (groups, mount, showmount) and exploitation workflows for both vectors.
SKILL.md
rendered from the published skill — quoted content, verbatim
SKILL: Linux Privilege Escalation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.
0. RELATED ROUTING
Before going deep, consider loading:
- container-escape-techniques when the target is a container and you need to escape to host
- linux-security-bypass when facing restricted shells, AppArmor, SELinux, or seccomp
- linux-lateral-movement after obtaining root for pivoting to adjacent hosts
- kubernetes-pentesting when the host is a Kubernetes node
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 3 files
skills/linux-privilege-escalation/KERNEL_EXPLOITS_CHECKLIST.md
skills/linux-privilege-escalation/SKILL.md
skills/linux-privilege-escalation/SUID_CAPABILITIES_TRICKS.md