linux-privilege-escalation
This skill covers systematic Linux privilege escalation from low-privilege shell access to root. It walks through enumeration, SUID/SGID binary exploitation, capability abuse, cron job manipulation, NFS misconfigurations, writable system files, LD_PRELOAD tricks, Docker group abuse, and library hijacking—with specific commands and exploitation tables for each vector.
Linux Privilege Escalation teaches you to escalate from low-privilege shell to root via SUID, capabilities, cron abuse, and kernel exploits.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-06-16
Linux Privilege Escalation teaches you to escalate from low-privilege shell to root via SUID, capabilities, cron abuse, and kernel exploits. This skill covers systematic Linux privilege escalation from low-privilege shell access to root. It walks through enumeration, SUID/SGID binary exploitation, capability abuse, cron job manipulation, NFS misconfigurations, writable system files, LD_PRELOAD tricks, Docker group abuse, and library hijacking—with specific commands and exploitation tables for each vector.
Use it when
- linux-privilege-escalation teaches SUID exploitation by first enumerating SUID binaries with find.
- linux-privilege-escalation explains that Linux capabilities split root privileges into granular units.
Verify before relying
Read SKILL.md below before installing (3 files). Open directory: indexed for reading, not audited.
Install
yaklang/hack-skills/linux-privilege-escalation · repository language: CSS
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
What are the main linux privilege escalation techniques?
linux-privilege-escalation covers five primary vectors: SUID/SGID binary exploitation (find files with `find / -perm -4000 2>/dev/null`), capability abuse (getcap -r / 2>/dev/null), cron job manipulation, kernel vulnerabilities, and writable system files like /etc/passwd. Each vector includes enumeration commands and exploitation tables to systematically identify and exploit misconfigurations from a low-privilege shell to root access.
How do you escalate privileges on linux using SUID binaries?
linux-privilege-escalation teaches SUID exploitation by first enumerating SUID binaries with find, then checking GTFOBins for known escape sequences. Common targets include sudo, vim, less, and custom applications. The skill provides exploitation tables mapping binary names to root-access methods, plus commands to verify file permissions and ownership before attempting escalation.
What is capabilities abuse linux and how does it enable root access?
linux-privilege-escalation explains that Linux capabilities split root privileges into granular units. Binaries with dangerous capabilities (cap_setuid, cap_sys_admin) can be exploited to gain root. The skill shows how to enumerate capabilities with getcap, identify vulnerable assignments, and use them to spawn root shells—often more reliable than SUID when present.
Can cron job privilege escalation lead to root access?
linux-privilege-escalation details cron exploitation through writable job files, wildcard injection in tar commands, and PATH manipulation. If a root cron job runs a script you can modify, or uses unquoted wildcards, you can inject commands to execute as root. The skill includes specific payloads for common cron patterns and detection methods using `crontab -l` and `/etc/cron.d` inspection.
How does LD_PRELOAD privilege escalation work on linux?
linux-privilege-escalation covers LD_PRELOAD as a library hijacking technique: if a SUID binary or sudo-wrapped command loads shared libraries, you can preload a malicious .so file to intercept function calls and gain root execution. The skill provides C code templates for crafting payloads and commands to verify if LD_PRELOAD is permitted in the target environment.
What docker group and NFS misconfigurations enable root access?
linux-privilege-escalation explains that membership in the docker group allows mounting the host filesystem inside a container to read/write root-owned files. NFS shares mounted with no_root_squash permit a low-privilege user to write files as root. The skill includes enumeration commands (groups, mount, showmount) and exploitation workflows for both vectors.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
SKILL: Linux Privilege Escalation — Expert Attack Playbook
> AI LOAD INSTRUCTION: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.
0. RELATED ROUTING
Before going deep, consider loading:
- container-escape-techniques when the target is a container and you need to escape to host
- linux-security-bypass when facing restricted shells, AppArmor, SELinux, or seccomp
- linux-lateral-movement after obtaining root for pivoting to adjacent hosts
- kubernetes-pentesting when the host is a Kubernetes node
(truncated - see the full file via the links below)
File tree — 3 files
skills/linux-privilege-escalation/KERNEL_EXPLOITS_CHECKLIST.md
skills/linux-privilege-escalation/SKILL.md
skills/linux-privilege-escalation/SUID_CAPABILITIES_TRICKS.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Escalate from low-privilege shell to root on Linux via SUID, capabilities, or cron”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill guides penetration testers through Linux privilege escalation via writable critical files, NFS exports, shared library hijacking, and group-based access. It covers assessment of available vectors, exploitation techniques for each path, and integration with engagement logging and state management.
This skill guides you through methodical privilege escalation assessments on Linux systems, covering enumeration of kernel exploits, sudo misconfigurations, SUID binaries, capabilities, cron jobs, PATH hijacking, and NFS weaknesses. It provides workflows for identifying attack vectors and executing exploitation techniques to achieve root-level access from a low-privilege shell.
This skill teaches penetration testers to identify and exploit scheduled tasks, system services, and inter-process communication mechanisms for privilege escalation. It covers writable cron scripts, PATH manipulation, wildcard injection attacks, systemd unit modification, and D-Bus service exploitation—all under explicit authorization.
Privesc Linpeas runs comprehensive post-exploitation scans to uncover privilege escalation opportunities on Linux systems, checking for SUID/SGID binaries, sudo misconfigurations, exposed credentials, and kernel vulnerabilities. Results are color-coded by severity and mapped to exploitation techniques, enabling rapid identification of the highest-confidence escalation paths during authorized penetration tests and red team engagements.
Linux Discovery helps penetration testers systematically identify privilege escalation opportunities on Linux hosts through enumeration of system configuration, sudo settings, group memberships, and kernel vulnerabilities. The skill gathers baseline system information, analyzes user context and permissions, and maps exploitable vectors while respecting scope boundaries and engagement logging.
Systematically identify and exploit sudo weaknesses, SUID/SGID binaries, and Linux capability misconfigurations to gain root access. The skill covers GTFOBins-based escapes, environment variable injection, CVE exploitation, and polkit vulnerabilities across multiple attack vectors.
More skills windows-privilege-escalation (MIT) · Linux Pentesting Commands (NOASSERTION) · Linux Pentester Practical Commands (NOASSERTION) · dynamic-linking (MIT) · privilege-escalation-methods (MIT) · sandbox-escape-techniques (MIT) · Linux Pentester Notes (NOASSERTION) · linux-lateral-movement (MIT)