privesc-linux

Linux privilege escalation — SUID/SGID abuse, kernel exploits, capabilities, sudo misconfig, cron jobs, writable paths, container escape

hypnguyen1209/offensive-claude·0installs280stars

SKILL.md

Full skill instructions

Linux Privilege Escalation

When to Activate

Gained an initial unprivileged shell on a Linux host and need root or a higher-privileged account
Post-exploitation lateral/vertical movement on Linux servers, workstations, CI runners, or appliances
Container / Kubernetes pod foothold that needs to escape to the host node
Triaging a host for misconfig-based LPE (SUID, sudo, capabilities, writable units/cron) before reaching for kernel 0-day
CTF / lab challenges requiring privilege escalation with a defensible, detection-aware methodology

Technique Map

Technique	ATT&CK	CWE	Reference	Script
Automated + manual enumeration (LinPEAS/pspy/LES2)	T1082, T1057	CWE-200	references/enumeration-tooling.md	scripts/linpriv_enum.py
Detection-aware / low-noise enumeration	T1082	CWE-200	references/enumeration-tooling.md	scripts/linpriv_enum.py
SUID/SGID binary abuse (GTFOBins)	T1548.001	CWE-269	references/suid-sudo-capabilities.md	scripts/cap_suid_hunter.sh
sudo misconfig + GTFOBins escape	T1548.003	CWE-269	references/suid-sudo-capabilities.md	scripts/cap_suid_hunter.sh
sudo host option LPE (CVE-2025-32462)	T1548.003	CWE-863	references/suid-sudo-capabilities.md	scripts/sudo_cve_2025_check.sh
sudo chroot/NSS LPE (CVE-2025-32463)	T1548.003	CWE-829	references/suid-sudo-capabilities.md	scripts/sudo_cve_2025_check.sh
Linux capabilities abuse (setuid/dac_read/sys_admin)	T1548	CWE-250	references/suid-sudo-capabilities.md	scripts/cap_suid_hunter.sh
LD_PRELOAD / LD_LIBRARY_PATH sudo hijack	T1574.006	CWE-426	references/suid-sudo-capabilities.md	scripts/cap_suid_hunter.sh
nf_tables double-free LPE (CVE-2024-1086)	T1068	CWE-416	references/kernel-exploits.md	scripts/kernel_exploit_suggester.py
io_uring memory-sharing LPE (CVE-2024-0582/2025-21836)	T1068	CWE-416	references/kernel-exploits.md	scripts/kernel_exploit_suggester.py
Dirty Pipe page-cache overwrite (CVE-2022-0847)	T1068	CWE-787	references/kernel-exploits.md	scripts/kernel_exploit_suggester.py
GameOver(lay) OverlayFS (CVE-2023-2640/32629)	T1068	CWE-269	references/kernel-exploits.md	scripts/kernel_exploit_suggester.py
udisks/libblockdev loop-mount LPE (CVE-2025-6019)	T1068	CWE-250	references/service-misconfig-lpe.md	scripts/linpriv_enum.py
PAM allow_active bypass (CVE-2025-6018)	T1068	CWE-863	references/service-misconfig-lpe.md	scripts/linpriv_enum.py
glibc ld.so Looney Tunables (CVE-2023-4911)	T1068	CWE-787	references/service-misconfig-lpe.md	scripts/kernel_exploit_suggester.py
polkit pkexec PwnKit (CVE-2021-4034)	T1548.001	CWE-787	references/service-misconfig-lpe.md	scripts/linpriv_enum.py
Cron/systemd/PATH/writable-file abuse	T1053.003, T1574.007	CWE-732	references/service-misconfig-lpe.md	scripts/linpriv_enum.py
NFS no_root_squash SUID drop	T1222.002	CWE-732	references/service-misconfig-lpe.md	scripts/linpriv_enum.py
runc fd-leak container escape (CVE-2024-21626)	T1611	CWE-668	references/container-namespace-escape.md	scripts/container_escape_check.sh
Docker socket / privileged container escape	T1611, T1610	CWE-269	references/container-namespace-escape.md	scripts/container_escape_check.sh
cgroup release_agent / CAP_SYS_ADMIN escape	T1611	CWE-269	references/container-namespace-escape.md	scripts/container_escape_check.sh
Kubernetes pod/token escape	T1611	CWE-668	references/container-namespace-escape.md	scripts/container_escape_check.sh

Quick Start

# 0. Stabilize shell + baseline context
python3 -c 'import pty;pty.spawn("/bin/bash")'; export TERM=xterm
id; uname -a; cat /etc/os-release

# 1. Fast, detection-aware enumeration (custom, no external download needed)
python3 linpriv_enum.py --quick            # quick wins triage
python3 linpriv_enum.py --full --json out.json   # full sweep -> JSON evidence

# 2. SUID / capabilities / sudo triage (maps directly to GTFOBins)
./cap_suid_hunter.sh                        # ranks exploitable SUID + caps + sudo -l

# 3. sudo 2025 LPE check (no creds needed; default-config killers)
./sudo_cve_2025_check.sh                    # tests CVE-2025-32462 / -32463 + PwnKit

# 4. Kernel + glibc CVE mapping for current host
python3 kernel_exploit_suggester.py        # uname/glibc/distro -> ranked modern LPEs

# 5. If containerized, check escape surface
./container_escape_check.sh                 # runc fd-leak, docker.sock, caps, k8s token

# 6. Validate root, then drop SUID backup or stable persistence per ROE
id; cp /bin/bash /tmp/.b && chmod 4755 /tmp/.b   # only if authorized

OPSEC & Detection (summary)

Technique	Telemetry / IOC	Detection (Sigma/EDR)	OPSEC note
LinPEAS / mass enum	Burst of `find / -perm`, hundreds of reads, `which`/`getcap` spam	auditd `execve` of linpeas; EDR file-scan anomaly	Prefer targeted enum (`linpriv_enum.py --quick`); avoid full FS walks on EDR hosts
SUID/GTFOBins escape	`setuid()` to 0 from non-root parent, shell with `-p`	auditd uid-change without login; Falco `Run shell untrusted`	Use the least-noisy binary; many GTFOBins one-liners are flagged by name
sudo CVE-2025-32463	syslog `sudo ... CHROOT=`, NSS `libnss_*.so` from world-writable path	Elastic "Potential CVE-2025-32463 Sudo Chroot Execution"; auditd `-R` usage	chroot dir + fake `nsswitch.conf` are durable IOCs — clean the tree
sudo CVE-2025-32462	sudo log with `-h`/HOST mismatch vs real hostname	auditd sudo with `--host` not paired with `-l`	leaves clean sudo log entry; blends with normal sudo
nf_tables CVE-2024-1086	`unshare`/CLONE_NEWUSER + nftables from non-root; dmesg slab/UAF	Falco `Unprivileged Delegation of Page Faults`; auditd unshare+nft	namespace creation is logged; disable userns to neutralize
io_uring LPE	`io_uring_setup` syscall from unexpected proc	auditd syscall=io_uring_setup; eBPF LSM	many distros now ship `io_uring_disabled=2`
Looney Tunables CVE-2023-4911	setuid exec with `GLIBC_TUNABLES=` containing `=`; core dumps	Elastic "Potential Privilege Escalation via CVE-2023-4911"	env var is recorded in auditd execve; unset before exec where possible
udisks CVE-2025-6019	D-Bus `Filesystem.Resize/Check`, loop mount in `/tmp` w/o nosuid	auditd mount w/o `nosuid`; Falco mount-from-loop	leaves loop device + XFS image; detach + shred image
pkexec PwnKit	pkexec with `argc==0`, `GCONV_PATH=` env, `/var/...` GConv module	auditd `pkexec` + empty argv; Sigma proc_creation_lnx_pkexec	dropped GConv `.so` + dir are IOCs; remove them
Container escape (runc)	`/proc/self/fd/*` cwd, host paths from container, runc exec anomalies	Falco `Container escape`/`Mount launched in container`; CrowdStrike CWP	escapes are heavily monitored in CWP — confirm scope before running
cron/PATH/writable unit	new file in `/etc/cron*`, `systemctl daemon-reload`, PATH-prepended bin	auditd watch on `/etc/cron`,`/etc/systemd/`; Sigma cron tamper	revert file mtimes / remove dropped scripts post-exploit

Detailed Sigma rules, auditd rule snippets and IOC lists live inside each reference file's Detection subsection.

Deep Dives

references/enumeration-tooling.md — LinPEAS/pspy/LES2/unix-privesc-check, the linpriv_enum.py methodology, quick-win checklists, and low-noise enumeration for EDR-monitored hosts.
references/suid-sudo-capabilities.md — SUID/SGID + GTFOBins, sudo misconfig escapes, sudo CVE-2025-32462 (host) and CVE-2025-32463 (chroot/NSS), Linux capabilities (cap_setuid/cap_dac_read_search/cap_sys_admin), and LD_PRELOAD/LD_LIBRARY_PATH sudo hijacking.
references/kernel-exploits.md — nf_tables CVE-2024-1086 (and 2026 nftables UAFs), io_uring CVE-2024-0582 / CVE-2025-21836, Dirty Pipe CVE-2022-0847, GameOver(lay) CVE-2023-2640, plus a kernel-CVE selection methodology and ROP/commit_creds primer.
references/service-misconfig-lpe.md — udisks/libblockdev CVE-2025-6018/6019 chain, Looney Tunables CVE-2023-4911, PwnKit CVE-2021-4034, polkit/D-Bus abuse, cron/systemd/PATH hijacking, writable /etc/passwd, and NFS no_root_squash.
references/container-namespace-escape.md — runc Leaky Vessels CVE-2024-21626, Docker socket / privileged-container / --pid=host / CAP_SYS_PTRACE escapes, cgroup-v1 release_agent, user namespaces, and Kubernetes service-account-token → pod escape.