skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

performing-privilege-escalation-on-linux

Enumerates and exploits Linux privilege escalation vectors to elevate from low-privilege users to root.

954|172|Updated Mar 13, 2026
Search Tags:#penetration testing#Linux#post-exploitation#sudo#Red Team#suid#Privilege escalation
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill performing-privilege-escalation-on-linux
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-privilege-escalation-on-linux
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/red-teaming/performing-privilege-escalation-on-linux
Command: npx skills add https://github.com/xalgord/xalgorix --skill performing-privilege-escalation-on-linux

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

During authorized penetration tests, gaining an initial foothold on a Linux system usually yields only a low-privilege shell, and testers need a systematic methodology to identify and exploit misconfigurations, vulnerable services, and kernel flaws to reach root access.

Core Features & Use Cases

  • Comprehensive Enumeration Guidance: Covers SUID/SGID binaries, sudo misconfigurations, Linux capabilities, cron jobs, writable systemd units, NFS no_root_squash, and kernel exploit matching.
  • Tool Integration: Directs use of LinPEAS, LinEnum, pspy, linux-exploit-suggester, and GTFOBins for automated and manual privilege escalation discovery.
  • MITRE ATT&CK Mapping: Maps techniques to T1548.001, T1548.003, T1068, T1574.006, T1053.003, and T1543.002 for structured adversary emulation reporting.
  • Use Case: A red team operator with a low-privilege shell on a target Linux host runs LinPEAS, finds a world-writable cron script, injects a payload, and confirms root access with id returning uid=0.

Quick Start

Ask the AI to enumerate privilege escalation vectors on the compromised Linux host and identify a path to root using SUID, sudo, capabilities, and cron checks.

Frequently Asked Questions about performing-privilege-escalation-on-linux

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I escalate privileges on Linux after getting a shell?▼

Start with automated enumeration using LinPEAS or LinEnum, then manually verify high-signal vectors: SUID binaries, sudo -l permissions, Linux capabilities, writable cron jobs, and systemd units. Confirm success when id returns uid=0(root).

What tools are used for Linux privilege escalation enumeration?▼

LinPEAS and LinEnum automate enumeration of misconfigurations, pspy monitors processes and cron jobs without root, linux-exploit-suggester matches kernel versions to CVEs, and GTFOBins documents exploitation of SUID and sudo binaries.

Which kernel exploits work for Linux privilege escalation?▼

Common kernel exploits include Dirty Cow (CVE-2016-5195) for older kernels, Dirty Pipe (CVE-2022-0847) for kernel 5.8+, PwnKit (CVE-2021-4034) for pkexec, and GameOver(lay) (CVE-2023-2640, CVE-2023-32629) for Ubuntu. Match uname -r output to known CVEs as a last resort.

How do I check sudo misconfigurations for privilege escalation?▼

Run sudo -l to list permitted commands, then check GTFOBins for exploitation methods of allowed binaries. Look for NOPASSWD entries, wildcard injection in sudo rules, and sudo versions vulnerable to CVE-2021-3156 (Baron Samedit).

Is Linux privilege escalation testing legal?▼

Privilege escalation testing is legal only on systems you own or have explicit written authorization to test. Unauthorized use against third-party systems violates computer fraud laws, so this skill is restricted to authorized security assessments and lab environments.

Related Skills

Explore More Software Engineering Skills→
utsavthakurutsavthakur

linux-privilege-escalation

Identify and exploit Linux vulnerabilities to escalate privileges to root access.

Community
Advanced
jayjpatel9717jayjpatel9717

Red Team Verification

Verify red team findings by executing commands and comparing outputs.

Community
Advanced
AeonDaveAeonDave
15

mimikatz

Extract Windows credentials and Kerberos tickets from LSASS memory.

Community
Advanced
blacklanternsecurityblacklanternsecurity
253

kerberos-delegation

Exploit Kerberos delegation misconfigurations in Active Directory for privilege escalation.

Official
Advanced