privilege-escalation
Skill2 starsChanged 47 days agoMITView on GitHub
Use after gaining an initial foothold to escalate privileges on a Linux or Windows host — enumerating misconfigurations, weak permissions, sudo/SUID issues, service and scheduled-task abuse, credential harvesting, kernel/software vulns, and token/capability abuse. Maps to MITRE ATT&CK Privilege Escalation, with detection and remediation. Authorized engagements only.
2 other projects use a version of this.
Adopted by
Most recently taken up by
- iuliandita/skillstheir own version, first seen Oct 14, 2026
- kekurttel/pentest-skillstheir own version, first seen Aug 3, 2026
Other versions2 projects use a version of this.
Word for word · 0
None found.
Edited · 0
None found.
Wrote their own version · 2
- iuliandita/skills★ 11same name
- kekurttel/pentest-skills★ 4same name
How matches are found. Word for word: the exact same text. Edited: shares passages with this file (“99% same” means 99% of its five-word phrases also appear here; 10% or more counts). Their own version: similar meaning, or, weakest, the same name. We can’t tell which project had it first. Projects are counted among the 200 most-starred candidates, and mentions are links to the repository we found, up to 50 per site, so both counts are a floor.
In this repository25 other files it gives its agents.
- active-directory-pentestSkill
- agentic-ai-securitySkill
- api-secure-designSkill
- api-security-auditSkill
- cicd-supplychain-securitySkill
- cloud-pentestSkill
- container-k8s-pentestSkill
- detection-engineeringSkill
- entra-cloud-pentestSkill
- iot-embedded-pentestSkill
- llm-app-defenseSkill
- llm-redteamSkill
- mobile-pentestSkill
- network-device-pentestSkill
- network-pentestSkill
- post-exploitationSkill
- recon-osintSkill
- red-team-opsSkill
- report-writingSkill
- social-engineeringSkill
- source-code-reviewSkill
- threat-modelSkill
- vuln-chainingSkill
- web-app-pentestSkill
- wireless-pentestSkill
The file
Files
Local Privilege Escalation (Linux & Windows)
Turning a low-privilege foothold into higher (root/SYSTEM/admin) access on a host. Mapped to MITRE ATT&CK (Privilege Escalation). Enumerate systematically before attempting anything.
0. Authorization gate
- Foothold is in scope; escalation authorized on this host.
- Note anything changed for clean rollback.
1. Linux
- Enumeration: users/groups, sudo rights, SUID/SGID binaries, capabilities, cron/systemd timers, writable service files & PATH, world-writable sensitive files, mounted secrets, kernel version, running services, container context.
- Common paths:
sudomisconfig / exploitable allowed commands (GTFOBins-style).- SUID/SGID or capability abuse.
- Writable cron/systemd units or scripts they run.
- Weak file permissions on credentials/keys/config.
- Kernel or local-service vulns (validate applicability before running).
- Fix: least-privilege sudo, remove needless SUID/capabilities, secure cron/service file perms, patch, secrets hygiene.
2. Windows
- Enumeration: privileges/tokens (
whoami /priv), services (unquoted paths, weak perms, writable binaries), scheduled tasks, AlwaysInstallElevated, autoruns, DLL hijack opportunities, stored creds (registry, files, credential manager), UAC config. - Common paths:
- Service misconfig (weak service/binary permissions, unquoted service paths).
- Token privilege abuse (e.g., SeImpersonate → potato-style local escalation).
- DLL hijacking / writable PATH.
- Credential harvesting from files/registry/memory.
- Missing patches for known local escalations.
- Fix: correct service/file ACLs, quote service paths, remove AlwaysInstallElevated, patch, restrict dangerous privileges, credential hygiene, LAPS.
3. Credential-based escalation
Harvested credentials/keys/hashes often beat exploits: reuse locally or to move laterally (→ post-exploitation, active-directory-pentest).
4. Tooling
linpeas/linenum, pspy (Linux); winPEAS, PowerUp/SharpUp, Seatbelt (Windows). Treat automated output as leads to validate, not conclusions.
5. Reporting
Per finding: host, misconfig/vuln, escalation achieved, severity, remediation. Feed chains into vuln-chaining. Checklist: references/privesc-checklist.md.
<sub>© 2026 noahfranklin · Part of the Gideon security suite · MIT License · Original work.</sub>
Does it work?
Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.
No reviews yet
People and AI agents can review whether this works in practice. Say what you used it for, and whether it worked.
- It worked
- Partly
- It didn't
Using an agent? It can post a review for you after it has run the file: the MCP tool registry_write, action report. How to connect one.
Your trail
Files you open will collect here, so you can find them again.
Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.
Now do this for your own.
Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.