skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-privilege-escalation-assessment

Tests privilege escalation paths from low-privilege access to root or SYSTEM on Linux and Windows systems.

954|172|Updated Mar 13, 2026
Search Tags:#Linux#windows#post-exploitation#penetration-testing#privilege-escalation#gtfobins#linpeas
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-privilege-escalation-assessment
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-privilege-escalation-assessment
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/penetration-testing/performing-privilege-escalation-assessment
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-privilege-escalation-assessment

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

After gaining initial low-privilege access during an authorized penetration test, testers need a systematic way to demonstrate full system compromise. This Skill guides the enumeration and exploitation of misconfigurations, vulnerable services, kernel exploits, SUID binaries, token privileges, and stored credentials to escalate from a standard user to root or NT AUTHORITY\SYSTEM, with documented proof of impact.

Core Features & Use Cases

  • Structured enumeration workflow: Covers Linux checks (sudo -l, SUID/SGID, capabilities, cron, linPEAS) and Windows checks (whoami /priv, unquoted service paths, AlwaysInstallElevated, winPEAS) so no common vector is skipped.
  • Vector-specific exploitation guidance: Details GTFOBins sudo abuse, PrintSpoofer/GodPotato token impersonation, kernel exploits like DirtyPipe and PwnKit, DLL hijacking, and container/cloud escape via Docker sockets and metadata endpoints.
  • Reporting output format: Produces findings with severity, CVSS score, MITRE ATT&CK mapping, proof-of-concept evidence, and remediation steps.
  • Use Case: A tester with a www-data shell on an Ubuntu web server runs linPEAS, finds a NOPASSWD sudo entry for /usr/bin/find, escalates to root via GTFOBins, and documents access to 75,000 customer records as proven business impact.

Quick Start

Perform a privilege escalation assessment on the compromised Linux host where I have a low-privilege shell and document the escalation path with proof.

Frequently Asked Questions about performing-privilege-escalation-assessment

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I escalate privileges on Linux after getting a shell?▼

Start with enumeration: run sudo -l, find SUID binaries, check capabilities with getcap, and review cron jobs, then run linPEAS for automated coverage. Exploit misconfigurations like GTFOBins-listed sudo entries before attempting kernel exploits such as DirtyPipe or PwnKit.

How to escalate from a Windows service account to SYSTEM?▼

Check whoami /priv for SeImpersonatePrivilege or SeDebugPrivilege, which are common on service and IIS accounts. Use PrintSpoofer or GodPotato to impersonate a SYSTEM token and execute commands as NT AUTHORITY\SYSTEM.

Should I use kernel exploits for privilege escalation?▼

Kernel exploits should be a last resort because they risk kernel panics and system crashes on production hosts. Safer vectors like sudo misconfigurations, SUID binaries, writable cron scripts, and stored credentials usually achieve the same result reliably.

What tools are needed for privilege escalation enumeration?▼

linPEAS and Linux Smart Enumeration cover Linux targets, while winPEAS covers Windows. GTFOBins and LOLBAS serve as reference databases for abusing misconfigured binaries, and Linux Exploit Suggester matches kernel versions to known exploits.

Can privilege escalation work inside containers or cloud instances?▼

Yes, but check for container-specific vectors first: mounted Docker sockets, privileged mode, SYS_ADMIN capability, and Kubernetes service-account tokens. Also query the cloud metadata endpoint at 169.254.169.254 for IAM credentials that may enable further escalation.

When should I not run a privilege escalation assessment?▼

Do not proceed without written authorization, on production systems where exploitation could cause downtime, or when deploying kernel exploits without prior approval and rollback capability. Apparent root inside a container may also not represent real host compromise.

Related Skills

Explore More Software Engineering Skills→
0x0pointer0x0pointer
13

post-exploit

Escalate privileges, harvest credentials, and enumerate compromised Linux and Windows hosts.

Official
Advanced
jaskaranhundaljaskaranhundal
3

identity-access-risk

Analyze AWS IAM anomalies and privilege escalation attempts from CloudTrail logs.

Community
Advanced
Prohao42Prohao42
120

linux-lateral-movement

Automate lateral movement across Linux hosts using SSH agent hijacking and credential harvesting.

Community
Advanced
Prohao42Prohao42
120

windows-privilege-escalation

Exploit Windows system vulnerabilities to escalate privileges and gain administrative access.

Community
Advanced