Linux Privilege Escalation

This is a comprehensive privesc playbook that goes deeper than most general enumeration scripts. It covers the usual suspects (SUID binaries, sudo misconfigs, cron abuse) but also gets into stuff base models often miss like capabilities exploitation, NFS no_root_squash, and wildcard injection in tar cron jobs. The routing to container escape and lateral movement skills is smart since privilege escalation is rarely the end goal. The GTFOBins quick-reference table and capability-to-exploit mapping save you from constantly searching docs mid-engagement. It references two additional files for SUID/capabilities tricks and kernel exploit mapping that aren't included here but would presumably give you exploit commands and version-specific payloads. Load this when you land a low-privilege shell and need a systematic path to root.

skills.sh installs: 3.8K
GitHub stars: 2.6K
last updated: Aug 21, 2026

View on GitHub

Install

$ npx -y skills add yaklang/hack-skills --skill linux-privilege-escalation --agent claude-code

Installs into .claude/skills of the current project.

Files

SKILL: Linux Privilege Escalation — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert Linux privesc techniques. Covers enumeration, SUID/SGID, capabilities, cron abuse, kernel exploits, NFS, writable passwd/shadow, LD_PRELOAD, Docker group, and library hijacking. Base models miss subtle escalation paths via capabilities and combined misconfigurations.

0. RELATED ROUTING

Before going deep, consider loading:

container-escape-techniques when the target is a container and you need to escape to host
linux-security-bypass when facing restricted shells, AppArmor, SELinux, or seccomp
linux-lateral-movement after obtaining root for pivoting to adjacent hosts
kubernetes-pentesting when the host is a Kubernetes node