pentest-privesc

name	pentest-privesc
description	Privilege escalation methodology — Linux + Windows + container escape advisory. LinPEAS/WinPEAS analysis, SUID/capability abuse, kernel exploit selection. Triggers on privesc, privilege escalation, LinPEAS, WinPEAS, SUID, capability, sudo abuse, kernel exploit, Windows token, UAC bypass.
license	MIT
compatibility	Works with Claude Code
allowed-tools	Read Write Edit Bash Grep
metadata	{"author":"badi","homepage":"https://github.com/fatihkan/badi-skills/tree/main/skills/pentest-privesc","badi-version":">=1.24.0","category":"pentest","scope":"advisory","inspired-by":"0xSteph/pentest-ai-agents privesc-advisor"}

pentest-privesc

Linux + Windows + container privesc analysis. The user pastes LinPEAS/WinPEAS output; the skill prioritizes and suggests an exploit path.

Triggers

• "linpeas output"
• "winpeas output"
• "how to privesc"
• "SUID binary"
• "sudo abuse"
• "kernel exploit selection"
• "container escape"
• "UAC bypass"

Linux Privesc Vector List

Vector	Detection	Exploit Method
SUID binary	find / -perm -4000	GTFOBins lookup
Capability	getcap -r / 2>/dev/null	CAP_SETUID, CAP_DAC_READ_SEARCH
Sudo rule	sudo -l	GTFOBins (NOPASSWD bins)
Writable /etc/passwd	ls -la /etc/passwd	echo "evil:x:0:0..." >>
Writable cron	find /etc/cron* -writable	Add a script
Path injection	sudo + relative path	PATH=/tmp:$PATH; ./binary
Kernel exploit	uname -a	exploit-db version match
LD_PRELOAD	sudo env_keep	malicious .so
Docker socket	/var/run/docker.sock readable	Container break
NFS no_root_squash	mount source	UID 0 file create
systemd timer writable	/etc/systemd/*	Timer override
Wildcard injection	tar/rsync wildcard	--checkpoint-action

LinPEAS Output Analysis

# The user pastes the linpeas output, the skill reads it in this order:

1. SUID binary list -> filter exploitable per GTFOBins
2. Capability output -> CAP_SETUID / CAP_NET_ADMIN priority
3. Sudo rule -> NOPASSWD + GTFOBins
4. Cron + writable -> add-a-script path
5. PATH analysis -> is there a writable spot
6. Kernel version -> e.g. Dirty Pipe, OverlayFS, Sequoia

GTFOBins quick template: https://gtfobins.github.io — "shell", "sudo", "suid", "capabilities", "file write" filters.

Windows Privesc Vector

Vector	Detection	Exploit
Unquoted service path	wmic service get name,pathname	Space in path + binplant
AlwaysInstallElevated	reg query HKLM\Software\Policies\Microsoft\Windows\Installer	Elevation via MSI
Token impersonation	whoami /priv	SeImpersonate / SeAssignPrimaryToken
Stored creds	cmdkey /list, runas /savecred	Use the saved cred
Weak service ACL	accesschk.exe -uwcqv "Authenticated Users" *	Service modify
Registry autorun	HKLM...\Run writable	Persistence + elevation
Scheduled task	schtasks /query	Task command override
DLL hijacking	Process Monitor	Missing DLL plant
Local admin via UAC bypass	UAC level Auto	fodhelper.exe, eventvwr.exe
Print Spooler	PrintNightmare CVE-2021-1675	Local driver install

WinPEAS Output Analysis

WinPEAS colored output -> prioritize red/yellow. The skill gives a BROAD explanation for a red finding + context for a yellow finding.

Token Impersonation (Windows)

Is SeImpersonatePrivilege present?
  -> YES: JuicyPotato (Win 10 < 1809), RoguePotato, PrintSpoofer (modern)
  -> Local SYSTEM gain

SeAssignPrimaryToken:
  -> spawn SYSTEM via CreateProcessAsUser

Kernel Exploit Selection

# Linux
uname -r                            # version
cat /etc/os-release                 # distro
ldd $(which sh) | head -1           # libc

# Exploit-DB lookup (offline searchsploit)
searchsploit "Linux Kernel <version> Local"
searchsploit Sequoia                # CVE-2021-33909
searchsploit "Dirty Pipe"           # CVE-2022-0847
searchsploit PwnKit                 # CVE-2021-4034

# Windows
systeminfo                          # version, hotfix
wmic qfe                            # patch list

# Windows-Exploit-Suggester (offline)
python wes.py systeminfo.txt

Container Escape

# Pod RBAC check
kubectl auth can-i --list

# Privileged container detection
cat /proc/self/status | grep CapEff   # cap effective
ls /dev | grep -i sd                  # host disk mount
mount | grep /etc/hostname             # host mount izi

# Common escapes:
- privileged: true + mount host /
- hostPID: true + nsenter -t 1 ...
- Docker socket bind /var/run/docker.sock
- CAP_SYS_ADMIN + cgroups release_agent
- runc CVE-2024-21626 (leaking file descriptor)

Output Template

## Privesc Path — <target>

### Detection
- Linux Ubuntu 22.04.3 LTS, kernel 5.15.0-86
- User "webapp" -> NOPASSWD sudo for /usr/bin/find
- /etc/cron.d/backup writable

### Prioritization
1. [QUICK WIN] sudo find . -exec /bin/sh \; -quit  (GTFOBins)
   -> single command, instant root
2. [BACKUP] cron writable, automatic root cmd after 5 min
3. [KERNEL] PwnKit (CVE-2021-4034) — check whether the kernel is patched, skip by default

### Recommendation (defensive)
- Remove find from sudo (NOPASSWD scope too broad)
- cron permissions root:root 644
- pkexec /usr/bin/pkexec PIE + libc audit

Out-of-Scope

• Creating a persistent backdoor (outside the engagement)
• Modifying production systems after compromise
• Running exploits outside authorization