# Privilege Escalation Techniques

> Use when escalating privileges on compromised systems.

- Skill: `loopyluci/privilege-escalation-techniques` (Agent Skill)
- Install (CLI): `npx skillmds@latest add loopyluci/privilege-escalation-techniques`
- Raw SKILL.md: https://api.skillmd.com/api/skills/loopyluci/privilege-escalation-techniques/raw
- Safety review: pending (external: skill-scanner PASS, skillspector CAUTION)
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- License: MIT
- Author: LoopyLuci (https://skillmd.com/u/loopyluci)
- Updated: 2026-09-08
- Page: https://skillmd.com/skills/loopyluci/privilege-escalation-techniques

---


# Privilege Escalation Techniques

Escalating privileges on compromised systems — from Windows (token manipulation, potato attacks, service abuse) through Linux (SUID, sudo, capabilities, kernel exploits).

## When to Use

- Escalating from user to admin/root after initial access
- Identifying privilege escalation paths during pentests
- Exploiting misconfigured services and permissions
- Using automated enumeration tools

## Windows PrivEsc

```python
WINDOWS_PRIVESC = {
    'token_abuse': 'SeImpersonatePrivilege, SeAssignPrimaryToken — RoguePotato, SweetPotato',
    'service_abuse': 'Weak service permissions, unquoted service paths, writable binaries',
    'scheduled_tasks': 'Writable scheduled task scripts, modifiable task definitions',
    'dll_hijacking': 'Missing DLL in PATH, writable folders in DLL search order',
    'always_install_elevated': 'MSI files install as SYSTEM when registry keys are set',
    'unattend_files': 'Unattend.xml may contain admin credentials in plaintext',
    'registry_keys': 'AutoRun keys, Debugger keys, AlwaysInstallElevated',
}

LINUX_PRIVESC = {
    'sudo': 'Passwordless sudo entries, LD_PRELOAD, env_keep, vulnerable binaries',
    'suid': 'Find all SUID binaries with known vulnerabilities (GTFOBins)',
    'capabilities': 'Exploitable capabilities (cap_setuid, cap_sys_admin, cap_dac_override)',
    'kernel': 'Linux kernel exploits (CVE-2021-4034 PwnKit, CVE-2022-0847 DirtyPipe)',
    'cron': 'Writable cron scripts, wildcard injection, PATH abuse',
    'docker': 'User in docker group = root access via docker socket',
    'lxd': 'User in lxd group can mount host filesystem',
}

# Automated enumeration
AUTO_ENUM = {
    'linux': 'LinEnum.sh, LinPEAS, linux-smart-enumeration',
    'windows': 'WinPEAS, PowerUp.ps1, Seatbelt.exe, PowerSploit',
}
```

## Verification Checklist

- [ ] Automated enumeration scripts run (WinPEAS/LinPEAS)
- [ ] Current user privileges and groups identified
- [ ] Kernel/OS version checked for known exploits
- [ ] Service misconfigurations checked (writable binaries, unquoted paths)
- [ ] Scheduled tasks/cron jobs with abuse opportunities
- [ ] SUID/sudo/capabilities checked (Linux) or token/ACLs checked (Windows)
- [ ] Credentials hunted (config files, history, registry, browsers)
- [ ] Escalation path proven (not just identified)
- [ ] AV/EDR bypass considered during escalation