Privesc Linux Skill for Claude

Use when escalating privileges on a Linux host — SUID/SGID & GTFOBins, sudo LPE (CVE-2025-32462/32463), capabilities & LD_PRELOAD, kernel LPE (CVE-2024-1086, Dirty Pipe, GameOver(lay)), service misconfig (PwnKit, Looney Tunables), container/namespace escape

30k tokens

context cost

the whole folder, loaded on every use

files

ships runnable scripts

copies elsewhere

how many repositories repackaged it

334

stars on the repo

on the repository, not the skill itself

Install

one command, takes just this skill from the repository

npx skills add https://github.com/hypnguyen1209/offensive-claude --skill privesc-linux

What comes with it

109 650 bytes besides the instruction

references/container-namespace-escape.md

references/enumeration-tooling.md

references/kernel-exploits.md

references/service-misconfig-lpe.md

references/suid-sudo-capabilities.md

scripts/cap_suid_hunter.sh

scripts/container_escape_check.sh

scripts/kernel_exploit_suggester.py

scripts/linpriv_enum.py

scripts/sudo_cve_2025_check.sh

The instruction itself

6 sections, as written by the author

Linux Privilege Escalation

When to Activate

Gained an initial unprivileged shell on a Linux host and need root or a higher-privileged account
Post-exploitation lateral/vertical movement on Linux servers, workstations, CI runners, or appliances
Container / Kubernetes pod foothold that needs to escape to the host node
Triaging a host for misconfig-based LPE (SUID, sudo, capabilities, writable units/cron) before reaching for kernel 0-day
CTF / lab challenges requiring privilege escalation with a defensible, detection-aware methodology

Technique Map

|-----------|--------|-----|-----------|--------|

Quick Start

# 0. Stabilize shell + baseline context
python3 -c 'import pty;pty.spawn("/bin/bash")'; export TERM=xterm
id; uname -a; cat /etc/os-release

# 1. Fast, detection-aware enumeration (custom, no external download needed)
python3 linpriv_enum.py --quick            # quick wins triage
python3 linpriv_enum.py --full --json out.json   # full sweep -> JSON evidence

# 2. SUID / capabilities / sudo triage (maps directly to GTFOBins)
./cap_suid_hunter.sh                        # ranks exploitable SUID + caps + sudo -l

# 3. sudo 2025 LPE check (no creds needed; default-config killers)
./sudo_cve_2025_check.sh                    # tests CVE-2025-32462 / -32463 + PwnKit

# 4. Kernel + glibc CVE mapping for current host
python3 kernel_exploit_suggester.py        # uname/glibc/distro -> ranked modern LPEs

# 5. If containerized, check escape surface
./container_escape_check.sh                 # runc fd-leak, docker.sock, caps, k8s token

# 6. Validate root, then drop SUID backup or stable persistence per ROE
id; cp /bin/bash /tmp/.b && chmod 4755 /tmp/.b   # only if authorized

OPSEC & Detection (summary)

|-----------|-----------------|-----------------------|------------|

| LinPEAS / mass enum | Burst of find / -perm, hundreds of reads, which/getcap spam | auditd execve of linpeas; EDR file-scan anomaly | Prefer targeted enum (linpriv_enum.py --quick); avoid full FS walks on EDR hosts |

| SUID/GTFOBins escape | setuid() to 0 from non-root parent, shell with -p | auditd uid-change without login; Falco Run shell untrusted | Use the least-noisy binary; many GTFOBins one-liners are flagged by name |

| sudo CVE-2025-32463 | syslog sudo ... CHROOT=, NSS libnss_*.so from world-writable path | Elastic "Potential CVE-2025-32463 Sudo Chroot Execution"; auditd -R usage | chroot dir + fake nsswitch.conf are durable IOCs — clean the tree |

| sudo CVE-2025-32462 | sudo log with -h/HOST mismatch vs real hostname | auditd sudo with --host not paired with -l | leaves clean sudo log entry; blends with normal sudo |

| nf_tables CVE-2024-1086 | unshare/CLONE_NEWUSER + nftables from non-root; dmesg slab/UAF | Falco Unprivileged Delegation of Page Faults; auditd unshare+nft | namespace creation is logged; disable userns to neutralize |

| Looney Tunables CVE-2023-4911 | setuid exec with GLIBC_TUNABLES= containing =; core dumps | Elastic "Potential Privilege Escalation via CVE-2023-4911" | env var is recorded in auditd execve; unset before exec where possible |

| udisks CVE-2025-6019 | D-Bus Filesystem.Resize/Check, loop mount in /tmp w/o nosuid | auditd mount w/o nosuid; Falco mount-from-loop | leaves loop device + XFS image; detach + shred image |

| pkexec PwnKit | pkexec with argc==0, GCONV_PATH= env, /var/... GConv module | auditd pkexec + empty argv; Sigma proc_creation_lnx_pkexec | dropped GConv .so + dir are IOCs; remove them |

| Container escape (runc) | /proc/self/fd/* cwd, host paths from container, runc exec anomalies | Falco Container escape/Mount launched in container; CrowdStrike CWP | escapes are heavily monitored in CWP — confirm scope before running |

| cron/PATH/writable unit | new file in /etc/cron*, systemctl daemon-reload, PATH-prepended bin | auditd watch on /etc/cron*,/etc/systemd/*; Sigma cron tamper | revert file mtimes / remove dropped scripts post-exploit |

Detailed Sigma rules, auditd rule snippets and IOC lists live inside each reference file's Detection subsection.

Deep Dives

references/enumeration-tooling.md — LinPEAS/pspy/LES2/unix-privesc-check, the linpriv_enum.py methodology, quick-win checklists, and low-noise enumeration for EDR-monitored hosts.
references/suid-sudo-capabilities.md — SUID/SGID + GTFOBins, sudo misconfig escapes, sudo CVE-2025-32462 (host) and CVE-2025-32463 (chroot/NSS), Linux capabilities (cap_setuid/cap_dac_read_search/cap_sys_admin), and LD_PRELOAD/LD_LIBRARY_PATH sudo hijacking.
references/kernel-exploits.md — nf_tables CVE-2024-1086 (and 2026 nftables UAFs), io_uring CVE-2024-0582 / CVE-2025-21836, Dirty Pipe CVE-2022-0847, GameOver(lay) CVE-2023-2640, plus a kernel-CVE selection methodology and ROP/commit_creds primer.
references/service-misconfig-lpe.md — udisks/libblockdev CVE-2025-6018/6019 chain, Looney Tunables CVE-2023-4911, PwnKit CVE-2021-4034, polkit/D-Bus abuse, cron/systemd/PATH hijacking, writable /etc/passwd, and NFS no_root_squash.
references/container-namespace-escape.md — runc Leaky Vessels CVE-2024-21626, Docker socket / privileged-container / --pid=host / CAP_SYS_PTRACE escapes, cgroup-v1 release_agent, user namespaces, and Kubernetes service-account-token → pod escape.

Other skills for the same job

different authors, same section of the catalogue

Backend Security Coder

by ComeOnOliver

×2

Expert in secure backend coding practices specializing in input validation, authentication, and API security. Use PROACTIVELY for backend security implementations or security code reviews.

5k tokens

Cloud Penetration Testing

by ComeOnOliver

×2

This skill should be used when the user asks to "perform cloud penetration testing", "assess Azure or AWS or GCP security", "enumerate cloud resources", "exploit cloud misconfigurations", "test O365 security", "extract secrets from cloud environments", or "audit cloud infrastructure". It provides comprehensive techniques for security assessment across major cloud platforms.

16k tokens

Codebase Cleanup Deps Audit

by ComeOnOliver

×2

You are a dependency security expert specializing in vulnerability scanning, license compliance, and supply chain security. Analyze project dependencies for known vulnerabilities, licensing issues, outdated packages, and provide actionable remediation strategies.

Comprehensive Flow Nexus platform management - authentication, sandboxes, app deployment, payments, and challenges

14k tokens

Linux Privilege Escalation

by ComeOnOliver

×2

This skill should be used when the user asks to "escalate privileges on Linux", "find privesc vectors on Linux systems", "exploit sudo misconfigurations", "abuse SUID binaries", "exploit cron jobs for root access", "enumerate Linux systems for privilege escalation", or "gain root access from low-privilege shell". It provides comprehensive techniques for identifying and exploiting privilege escalation paths on Linux systems.

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

This skill should be used when the user asks to "use Metasploit for penetration testing", "exploit vulnerabilities with msfconsole", "create payloads with msfvenom", "perform post-exploitation", "use auxiliary modules for scanning", or "develop custom exploits". It provides comprehensive guidance for leveraging the Metasploit Framework in security assessments.

7k tokens

Mobile Security Coder

by ComeOnOliver

×2

Expert in secure mobile coding practices specializing in input validation, WebView security, and mobile-specific security patterns. Use PROACTIVELY for mobile security implementations or mobile security code reviews.

6k tokens

How to use it

Copy the folder

Take hypnguyen1209/privesc-linux from the repository into ~/.claude/skills for personal use, or into .claude/skills inside a project.

Check the name does not clash

The agent identifies a skill by the name field in its header. Two skills with the same name cannot sit side by side — one of them will be ignored.