Linux Privilege Escalation

Enumerate Linux systems for privilege escalation paths to root.

Updated Jan 12, 2026
One-click install
npx skills add https://github.com/jcastillotx/vibe-skeleton-app --skill linux-privilege-escalation-jcastillotx
Or copy as Structured Prompt for Agent
Please help me install this Agent Skill.
Skill: Linux Privilege Escalation
Source: https://github.com/jcastillotx/vibe-skeleton-app/tree/main/setup/skills/linux-privilege-escalation
Command: npx skills add https://github.com/jcastillotx/vibe-skeleton-app --skill linux-privilege-escalation-jcastillotx

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

This skill helps security practitioners and admins quickly identify and exploit privilege escalation paths on Linux systems, enabling thorough assessments or defenses.

Core Features & Use Cases

  • Systematic Linux enumeration to reveal misconfigurations and weaknesses that enable privilege escalation.
  • Detection of sudo misconfigurations, SUID/ SGID binaries, writable cron jobs, PATH hijacking, and kernel-related risk vectors.
  • Documentation of escalation paths, recommended mitigations, and remediation steps for hardening.
  • Use Case: A defender audits a Linux host for potential escalation paths and a red team demonstrates how they could gain root access to test defenses.

Quick Start

  • id
  • whoami
  • uname -a
  • sudo -l
  • find / -perm -u=s -type f 2>/dev/null
  • ps aux
  • grep -R "NOPASSWD" -n /etc/sudoers /etc/sudoers.d 2>/dev/null

Frequently Asked Questions about Linux Privilege Escalation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I find Linux privilege escalation vectors using SUID binaries and sudo misconfigurations?

Linux privilege escalation vectors are found by systematically enumerating sudo configurations, SUID/SGID binaries, writable cron jobs, and PATH hijacking opportunities to uncover actionable paths for elevating low-privilege users to root.

What is the best way to enumerate a Linux system for privilege escalation paths?

The best way to enumerate Linux privilege escalation paths involves checking kernel versions, sudo configurations, SUID binaries, cron jobs, capabilities, and NFS weaknesses across the target environment to document actionable escalation vectors and mitigations.

Can I use LinPEAS and LinEnum to identify kernel exploits and PATH hijacking vulnerabilities?

Yes, you can use external assessment tools like LinPEAS, LinEnum, LES, or GTFOBins alongside common system utilities to identify kernel exploits, PATH hijacking, and other privilege escalation weaknesses depending on the target environment.

How do I check sudoers for NOPASSWD entries to exploit sudo misconfigurations?

You check sudoers for NOPASSWD entries by running sudo -l to list allowed commands and using grep -R "NOPASSWD" against /etc/sudoers and /etc/sudoers.d to uncover sudo misconfigurations that enable privilege escalation.

What Linux commands help detect SUID binaries and writable cron jobs for privilege escalation?

Commands like find / -perm -u=s -type f detect SUID binaries, while ps aux and grep -R "NOPASSWD" reveal writable cron jobs and sudo misconfigurations to systematically uncover privilege escalation paths on Linux systems.

Does Linux privilege escalation require advanced knowledge to exploit NFS weaknesses and capabilities?

Yes, exploiting NFS weaknesses, capabilities, and kernel-related risk vectors assumes basic to advanced Linux knowledge to properly enumerate misconfigurations, document escalation paths, and apply recommended mitigations and remediation steps for hardening.