escalate-linux-privilege skillA
escalate-linux-privilege is agent-read markdown (skill) from cha0upup/leoai: 在 Linux Puppet 立足点上以只读方式发现并排序本地提权候选路径，覆盖 sudo、SUID/SGID、cron、PATH、服务、容器、Docker socket、NFS 和版本风险。当红队任务需要扩大本机权限、突破容器边界或判断是否值得投入提权时使用；本 skill 不执行利用。.
Indexed from public GitHub and served as immutable, content-addressed versions. Install it pinned to an exact SHA-256 with the mdr CLI, and every file is verified against the hash recorded here before it reaches your agent. The deterministic audit below grades the latest version, and the same file always earns the same grade.
What the file says
# Linux 提权路径优选 目标不是罗列所有弱点，而是找出最可能、收益最高、噪声最低且能推进任务的提权路径。 ## 行动目标 - 确认当前权限是否阻碍演练目标。 - 发现本地或容器边界中的可操作提权候选。 - 对候选路径进行前提验证和红队优先级排序。 - 为后续人工或独立验证提供证据，不执行提权。 ## 授权与 ROE - 风险等级：medium；访问模式：read-only。 - 当前已是 root 时停止，转而评估目标达成或后续行动价值。 - 不执行利用、下载代码、编译载荷、写 cron、修改服务或触发崩溃风险测试。 - `sudo` 仅使用非交互模式，不提交密码。 - 摘要不保存可直接执行的利用代码。 ## OPSEC 预算 - 先执行高价值低噪声检查，再决定是否扩大搜索。 - SUID/SGID 优先限定标准二进制目录；全根文件系统搜索必须 `-xdev`、限时并限制输出。 - 版本匹配只作为候选，不运行 PoC 验证。 - 独立只读项并发执行；异步命令获取必要输出后调用 `stopTask` 释放资源。 ## 工作流 1. 读取侦察摘要，确认任务目标、当前身份、OS、内核和容器状态。 2. 判断提升权限是否会实际推进目标；若不会，建议停止而不是机械扫描。 3. 创建 4 步以内计划：身份与快速路径、配置与文件权限、容器与版本、排序与交接。 4. 执行第一轮低噪声检查；只在没有足够候选时扩大 SUID/cron/服务范围。 5. 对每个候选补齐证据、必要前提、预计收益、稳定性和检测面。 6. 只保留最多 5 条有行动价值的路径，写入一次摘要。 ## 快速检查 ```bash id; whoami; groups; uname -r; cat /etc/os-release 2>/dev/null sudo -n -l 2>/dev/null printf '%s\n' "$PATH" | tr ':' '\n' | while IFS= read -r dir; do [ -n "$dir" ] && [ -w "$dir" ] && echo "WRITABLE_PATH=$dir"; done ls -ld /etc/passwd /etc/shadow /etc/sudoers /etc/sudoers.d 2>/dev/null find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -xdev -type f \( -perm -4000 -o -perm -2000 \) -ls 2>/dev/null cat /etc/crontab 2>/dev/null; crontab -l 2>/dev/null …
Read the whole file at its exact version.
How to install
mdr add cha0upup/leoai/escalate-linux-privilege@git:20260801.6c9c129mdr add cha0upup/leoai/escalate-linux-privilege@sha256:363718cd751a6ffbPin to a label to follow the author's releases, or to a sha256 to freeze the exact bytes forever. Either way the resolved hash is written to mdr.lock, and mdr install reproduces it on any machine.
[](https://markdownregistry.com/a/art_x6wguwddudkhs65f)
1 badge views in 30 days
Versions
| version | committed | commit | size | audit | |
|---|---|---|---|---|---|
| git:20260801.6c9c129 latest | 2026-08-01 | 6c9c129 | 5,393 B | A | view · diff |
| git:20260619.8264b54 | 2026-06-19 | 8264b54 | 10,926 B | A | view · diff |
| git:20260616.da8811e | 2026-06-16 | da8811e | 10,874 B | A | view · diff |
| git:20260612.7254e06 | 2026-06-12 | 7254e06 | 10,833 B | A | view |
Audit of the latest version
- pass: Frontmatter block present
- pass: Frontmatter declares a name
- pass: Frontmatter declares a description
- pass: Size between 200 bytes and 200 KB (5393 bytes)
- pass: No zero-width or bidi control characters
- pass: No instruction hidden inside an HTML comment
- pass: No link to an exfiltration or paste host
- pass: No credential-shaped string
- pass: No instruction to send local credentials anywhere
- pass: No text hidden with inline styles
- pass: No prompt-injection phrasing
- pass: No curl or wget piped into a shell
- pass: No recursive delete of root, home or parent
- pass: No instruction to read or print local credentials
- pass: No base64 blob over 200 characters
- pass: No link to a raw IP address
- pass: No script tag
Source
cha0upup/leoai · 307 stars · license GPL-3.0 · pushed 2026-09-19 · branch main
API
GET https://markdownregistry.com/api/v1/artifacts/art_x6wguwddudkhs65f GET https://markdownregistry.com/api/v1/resolve?ref=cha0upup/leoai/escalate-linux-privilege GET https://markdownregistry.com/api/v1/blob/363718cd751a6ffb144315391c613a412da9b939d9a0203285b83f4213fee89d
Your agent does the legwork. You hear about the deals worth your word. Hand yours the standing instructions at modelranch.com and it joins the network that reads files like this one.