linux-file-path-abuse

Exploit writable files, NFS misconfigurations, and library hijacking for Linux privilege escalation.

253|37|Updated Feb 22, 2026
One-click install
npx skills add https://github.com/blacklanternsecurity/red-run --skill linux-file-path-abuse
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: linux-file-path-abuse
Source: https://github.com/blacklanternsecurity/red-run/tree/main/skills/privesc/linux-file-path-abuse
Command: npx skills add https://github.com/blacklanternsecurity/red-run --skill linux-file-path-abuse

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes scripts (resource) components.

What problem does it solve?

This Skill helps you gain higher privileges on a Linux system by exploiting common misconfigurations related to file permissions, group memberships, and executable paths.

Core Features & Use Cases

  • Writable File Exploitation: Leverages writable critical files like /etc/passwd or /etc/sudoers.
  • NFS & Group Privileges: Exploits no_root_squash NFS shares and privileged group memberships (docker, lxd, disk).
  • Path & Library Hijacking: Injects malicious code via writable PATH directories or shared library loading vulnerabilities.
  • Use Case: If you find that a user is part of the docker group, you can use this Skill to mount the host filesystem within a container and gain root access on the host.

Quick Start

Use the linux-file-path-abuse skill to exploit writable critical files on the target system.

Frequently Asked Questions about linux-file-path-abuse

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I exploit writable files for Linux privilege escalation?

Linux privilege escalation via writable files targets sensitive system files like /etc/passwd or /etc/sudoers. If a user has write access to these critical files, this Skill modifies them to grant elevated permissions, enabling unauthorized root access on the target system.

Can I get root access if my user is in the docker group?

Yes, docker group privileges allow root access on the host. This Skill exploits docker group membership by mounting the host filesystem within a container, directly granting full root control over the underlying host operating system.

What is NFS no_root_squash and how do I exploit it?

NFS no_root_squash misconfiguration allows remote root access to mounted shares. This Skill exploits this network file system setting using tools like showmount and debugfs to mount and write malicious files as root.

How does shared library hijacking work on Linux?

Shared library hijacking injects malicious code via writable PATH directories or vulnerable library loading configurations. This Skill uses tools like ldd, readelf, and strace to enumerate and exploit these shared library loading vulnerabilities.

Which Linux enumeration tools are required for file and path abuse?

Effective file and path abuse requires tools such as gcc, readelf, ldd, strace, docker, lxc, debugfs, showmount, and ldconfig. These utilities facilitate enumeration and exploitation of writable files, NFS shares, and privileged groups.

Does this privilege escalation method work with lxd and disk groups?

Yes, this Skill targets privileged group memberships including lxd and disk groups. Exploiting these elevated group memberships allows users to escalate privileges and gain unauthorized root access on the Linux system.