linux privesc quickwins

The problem

Post-exploitation stalls when you land a low-privilege shell and lose momentum manual-searching for misconfigurations. Spending hours on kernel exploits before checking for basic misconfigurations like cap_setuid or writable cron jobs wastes critical engagement time.

What it does

• Executes a prioritized search for cap_setuid capabilities on interpreters like Python, Perl, and PHP for instant root.
• Audits SUID binaries and cross-references them against GTFOBins patterns.
• Scans for writable root-run paths and cron jobs to identify PATH hijacking or script injection opportunities.
• Extracts cleartext credentials from application configs, environment files, and shell histories.
• Identifies internal services running as root that provide file-write primitives for RCE.

Frameworks & tools

Linux, Bash, GTFOBins, getcap, systemctl, and standard Unix discovery utilities.

Why this beats prompting it yourself

Standard LLMs often provide generic or noisy commands that trigger EDR. This skill uses a strict, "cheapest-first" ladder that prioritizes high-yield, low-noise vectors like capabilities and config secrets over complex exploits, ensuring you don't miss the easy wins.

Use cases

• Escalating from a web shell to root on a misconfigured web server.
• Auditing internal dev environments for dangerous elevation wildcards.
• Identifying lateral movement paths via hardcoded credentials in /opt.

Known limitations

Requires an active shell on a Linux-based system. Does not include automated binary exploitation for memory corruption vulnerabilities.