skills.rest
baljinnyamday
baljinnyamdayCOMMUNITY
Explore all skills by this author →
GitHub

performing-privilege-escalation-on-linux

Enumerates and exploits Linux privilege escalation vectors to elevate from low-privilege user to root access.

Updated May 27, 2026
Search Tags:#penetration testing#linux#privilege escalation#red team#post-exploitation#kernel exploit#suid
One-click install
npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill performing-privilege-escalation-on-linux-baljinnyamday
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: performing-privilege-escalation-on-linux
Source: https://github.com/baljinnyamday/autonomous-red-team-agent/tree/main/harness/src/agent_redteam/skill_library/performing-privilege-escalation-on-linux
Command: npx skills add https://github.com/baljinnyamday/autonomous-red-team-agent --skill performing-privilege-escalation-on-linux-baljinnyamday

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve? During authorized penetration tests, gaining an initial foothold usually yields only a low-privilege shell. This Skill guides the systematic enumeration and exploitation of Linux privilege escalation vectors so testers can reach root and demonstrate real impact. ## Core Features & Use Cases - Vector Coverage: Documents SUID/SGID binaries, sudo misconfigurations, kernel exploits (Dirty Cow, Dirty Pipe, PwnKit), cron job abuse, capabilities, and writable service files, each mapped to MITRE ATT&CK techniques. - Tooling Guidance: References LinPEAS, LinEnum, linux-exploit-suggester, pspy, GTFOBins, and PEASS-ng for automated enumeration and exploit matching. - Use Case: After compromising a web server as the www-data user, run LinPEAS to enumerate the host, identify a vulnerable sudo rule via sudo -l, and escalate to root while documenting evidence against the validation checklist. ## Quick Start Use this skill to enumerate privilege escalation vectors on the compromised Linux host and identify a path to root access.

Frequently Asked Questions about performing-privilege-escalation-on-linux

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I escalate privileges on Linux after getting a shell?▼

Start with automated enumeration using LinPEAS or LinEnum to identify misconfigurations, then check sudo permissions with sudo -l, find SUID binaries, and review cron jobs. Match findings against GTFOBins or kernel exploit suggesters to select an escalation path.

What tools find Linux privilege escalation vectors automatically?▼

LinPEAS and LinEnum automate enumeration of misconfigurations, permissions, and credentials. linux-exploit-suggester matches kernel versions against known exploits, and pspy monitors processes without root to reveal cron jobs and hidden activity.

Which kernel exploits work for Linux privilege escalation?▼

Common kernel exploits include Dirty Cow (CVE-2016-5195) for older kernels, Dirty Pipe (CVE-2022-0847) for kernel 5.8+, PwnKit (CVE-2021-4034) targeting pkexec, and GameOver(lay) (CVE-2023-2640, CVE-2023-32629) for Ubuntu systems.

Is it legal to use Linux privilege escalation techniques?▼

Privilege escalation testing is legal only on systems you own or have written authorization to test, such as lab environments or contracted penetration tests. Unauthorized use against third-party systems violates computer fraud laws.

Why does sudo -l not show exploitable permissions?▼

If sudo -l shows no NOPASSWD entries or dangerous commands, the sudo configuration may be properly hardened. Pivot to other vectors like SUID binaries, writable cron scripts, capabilities via getcap, or kernel exploits instead.

Related Skills

Explore More Software Engineering Skills→
wgpsecwgpsec
1.6k

post-exploit-linux

Plan and execute Linux post-exploitation workflows from initial access through privilege escalation.

Official
Advanced
aleister1102aleister1102

active-directory-attacks

Simulate authorized Active Directory attacks for red-team security assessments.

Community
Advanced
macaughmacaugh
5

Service Fingerprinting

Detect network services and versions on discovered hosts via active probing.

Community
Advanced
gigaverse-appgigaverse-app
4

nicegui-development

Guide NiceGUI UI development with layered architecture and reusable components.

Official
Advanced