performing-privilege-escalation-assessment

Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.

Jump to install

Repository: mukul975/Anthropic-Cybersecurity-Skills
Last source activity: June 1, 2026 at 10:13
Detected SKILL.md language: English
Stars: 27,732
Forks: 3,366

Install options

The review-first prompt is selected by default. You can switch to a direct command or download a local copy.

Review the source files

Read SKILL.md and any companion files shown by SkillsMP before deciding whether to install.

Back to search Back to installation

name	performing-privilege-escalation-assessment
description	Performs privilege escalation assessments on compromised Linux and Windows systems to identify paths from low-privilege access to root or SYSTEM-level control. The tester enumerates misconfigurations, vulnerable services, kernel exploits, SUID binaries, unquoted service paths, and credential stores to demonstrate the full impact of an initial compromise. Activates for requests involving privilege escalation testing, local exploitation, post-compromise escalation, or OS-level security assessment.
domain	cybersecurity
subdomain	penetration-testing
tags	["privilege-escalation","post-exploitation","Linux-privesc","Windows-privesc","local-exploitation"]
version	1.0.0
author	mahipal
license	Apache-2.0
d3fend_techniques	["Executable Denylisting","Execution Isolation","File Metadata Consistency Validation","Restore Access","Password Authentication"]
nist_csf	["ID.RA-01","ID.RA-06","GV.OV-02","DE.AE-07"]
mitre_attack	["T1595","T1190","T1059","T1078","T1068"]

Performing Privilege Escalation Assessment

When to Use

After gaining initial low-privilege access during a penetration test to demonstrate full system compromise
Assessing the security hardening of Linux and Windows servers against local privilege escalation attacks
Evaluating whether endpoint detection and response (EDR) tools detect common privilege escalation techniques
Testing the effectiveness of least-privilege policies and application whitelisting on endpoints
Validating that container breakout and VM escape controls are properly configured

Do not use without written authorization, against production systems where exploitation could cause downtime, or for deploying kernel exploits on systems without prior approval and rollback capability.

Prerequisites

Low-privilege shell access (reverse shell, SSH, RDP) to the target system obtained through authorized means
Privilege escalation enumeration scripts: linPEAS (Linux), winPEAS (Windows), Linux Smart Enumeration (LSE)
Compiled kernel exploits for common CVEs or access to compilation tools on the target
GTFOBins reference for Linux SUID/sudo binary abuse and LOLBAS reference for Windows living-off-the-land binaries
Precompiled post-exploitation binaries for the target architecture if compilation is not available on the target

Workflow

Step 1: System Enumeration

Gather comprehensive information about the target system:

Linux Enumeration:

id && whoami - Current user and group memberships
uname -a - Kernel version for kernel exploit identification
cat /etc/os-release - Distribution and version
sudo -l - Commands the current user can run as root via sudo
find / -perm -4000 -type f 2>/dev/null - SUID binaries
find / -perm -2000 -type f 2>/dev/null - SGID binaries
crontab -l && ls -la /etc/cron* - Scheduled tasks running as root
ps aux | grep root - Processes running as root
cat /etc/passwd - User accounts (look for additional users with UID 0)
find / -writable -type d 2>/dev/null - World-writable directories
Run linpeas.sh for automated comprehensive enumeration

Windows Enumeration:

Term	Definition
SUID Binary	A Linux binary with the Set User ID bit enabled, which executes with the file owner's privileges (typically root) regardless of who runs it
SeImpersonatePrivilege	A Windows privilege that allows a process to impersonate another user's security token, commonly abused by service accounts to escalate to SYSTEM
Kernel Exploit	An exploit targeting a vulnerability in the operating system kernel to gain ring-0 or root/SYSTEM-level access
GTFOBins	A curated list of Unix binaries that can be exploited for privilege escalation, file read/write, or shell escape when misconfigured
LOLBAS	Living Off The Land Binaries and Scripts; legitimate Windows binaries that can be abused for code execution, file operations, or persistence
DLL Hijacking	Exploiting the DLL search order on Windows to load a malicious DLL by placing it in a directory searched before the legitimate DLL location
Token Impersonation	A Windows technique where a compromised process with appropriate privileges captures and uses another user's access token to execute commands as that user

## Finding: Sudo Misconfiguration Allowing Root Escalation via find

**ID**: PRIV-001
**Severity**: Critical (CVSS 8.8)
**Affected Host**: web-prod-01 (10.10.5.15)
**OS**: Ubuntu 22.04 LTS
**Initial Access**: www-data (via PHP file upload - WEB-004)
**Escalation Technique**: MITRE ATT&CK T1548.003 - Sudo and Sudo Caching

**Description**:
The www-data user is configured in /etc/sudoers to execute /usr/bin/find as root
without a password. The find command supports the -exec flag which can spawn a
root shell, effectively granting www-data unrestricted root access.

**Proof of Concept**:
www-data@web-prod-01:~$ sudo -l
(root) NOPASSWD: /usr/bin/find
www-data@web-prod-01:~$ sudo find . -exec /bin/bash -p \; -quit
root@web-prod-01:~# id
uid=0(root) gid=0(root) groups=0(root)

**Impact**:
Full root access on the production web server. From root, the tester accessed
database credentials in /var/www/app/.env, connected to MySQL, and confirmed
read access to 75,000 customer records including names, emails, and addresses.

**Remediation**:
1. Remove the /usr/bin/find sudo entry for www-data
2. If find access is required, restrict it to specific directories with --no-exec
3. Audit all sudo entries for binaries listed in GTFOBins
4. Implement sudo logging with auditd for all privileged command execution