Guide · Agent skill
How to use the offensive-linux-privesc agent skill
Updated · written with AI from the project's own documentation and checked against our catalogue data
offensive-linux-privesc is an agent skill, a folder of instructions that an AI agent such as Claude loads when a task matches it. It gives the agent a structured playbook for raising its access on a Linux machine from an ordinary user account to root, on systems you are authorized to test. This guide explains what the skill does, how to install it, how to ask for it in plain language, and what to watch for before running it.
Linux Privilege Escalation MethodologySnailSploit/Claude-Red · MIT Download the skill Quick start
- 1Download the ZIP. Download the offensive-linux-privesc skill ZIP from this page and keep the file somewhere you can find it.
- 2Unzip into a skills folder. Unzip it into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder for one project.
- 3Or upload in Claude apps. In the Claude apps, open Settings, then Capabilities, then Skills, and upload the ZIP.
- 4State scope and permission. In your request, say the target is authorized and describe your low-privilege access, such as a standard user shell on a lab host.
- 5Ask for a specific task. Request enumeration first, for example checking sudo, SUID and capabilities, before asking for an exploitation path.
- 6Review before running. Read the enumeration output and any downloaded tools before running them, and check that the scripts will not affect monitored services.
- 7Document and clean up. Record each step of the escalation chain, note the defender-side visibility, and remove any artifacts you created.
What the skill makes the agent do
The skill is a methodology for a low-privilege shell on a Linux target. It moves from passive reconnaissance to more aggressive steps, and it starts with the highest-probability vectors: sudo rules, SUID/SGID binaries and Linux capabilities. Later steps cover cron jobs, PATH and library hijacking, NFS and Docker group weaknesses, and kernel exploits as a last resort.
The source material also describes how each technique looks to defenders, including detection signatures and defender-side visibility. That makes it useful for purple team work, where attackers and defenders review the same activity together.
- Automated enumeration with LinPEAS and linux-exploit-suggester, plus pspy for process monitoring
- SUID/SGID abuse, with binaries cross-checked against GTFOBins
- Linux capabilities such as cap_setuid, cap_dac_override and cap_dac_read_search
- Sudo misconfigurations, including NOPASSWD rules and Baron Samedit (CVE-2021-3156)
- Cron jobs with writable scripts, PATH hijacking and wildcard injection
- Kernel and software flaws such as DirtyPipe (CVE-2022-0847), DirtyCow (CVE-2016-5195) and PwnKit (CVE-2021-4034)
- Mapping to MITRE ATT&CK T1548 (Abuse Elevation Control Mechanism) and related sub-techniques
Install the offensive-linux-privesc skill
Download the skill ZIP from this page. The skill is a single SKILL.md file inside the offensive-linux-privesc folder. You can install it in one of two ways: for your own use across projects, or for a single project.
If you use Claude apps, you can instead upload the ZIP under Settings, then Capabilities, then Skills.
- Personal install: unzip the file into ~/.claude/skills/ so the offensive-linux-privesc folder sits inside it.
- Project install: unzip the file into the .claude/skills/ folder of your project.
- Claude apps: upload the ZIP under Settings → Capabilities → Skills.
Ask for the skill with natural requests
You do not need a special command. Describe the task and name the scope. The agent should match the request to the skill's description, which covers authorized penetration testing, red team engagements and CTF competitions where you already hold a low-privilege shell.
Always state that you have permission and where the target is. Vague requests with no scope are a poor fit for this skill.
- Use the offensive-linux-privesc skill. I have a low-privilege shell on an authorized lab box. Find the quickest path to root and list the evidence.
- I am on a CTF machine as user www-data. Walk through sudo, SUID and capability checks first.
- Our red team has written approval for this host. Check cron jobs and writable scripts for a privilege escalation path and document each step.
- Explain how a SUID binary abuse would appear in logs so our blue team can write a detection.
Run the automated enumeration safely
The skill begins with automated enumeration. LinPEAS and linux-exploit-suggester surface quick wins, and pspy watches processes without root. The skill's quiet LinPEAS option reduces noise on monitored systems. Output is written to files so you can review it offline.
The source's example downloads LinPEAS from GitHub at runtime with curl and pipes it to sh. Review what you download before running it, and prefer a copy you have checked yourself.
- Pipe output to a file in /dev/shm for offline review.
- Read LinPEAS output section by section and focus on red and yellow highlights.
- Cross-check any SUID binary you find against GTFOBins before trying it.
find / -perm -4000 -type f 2>/dev/nullWork through the common escalation paths
The skill checks the highest-probability paths first. Sudo rules come first, followed by SUID binaries and capabilities. Each area has enumeration commands and a short exploitation note. Exploitation steps in the source include commands that can change system files, so run them only inside your authorized scope.
Cron jobs, PATH ordering and writable scripts come next. Then the skill covers NFS no_root_squash, Docker group membership and kernel exploits as a last resort. The source notes that capabilities appear in LinPEAS output but deserve dedicated enumeration.
- Sudo: check sudo -l first, then NOPASSWD rules and writable scripts called through sudo.
- SUID/SGID: find binaries with find / -perm -4000, then look up each one in GTFOBins.
- Capabilities: list them with getcap -r / and check each capability against the skill's notes.
- Cron: review /etc/crontab, /etc/cron.d and user crontabs, and use pspy to find hidden jobs.
getcap -r / 2>/dev/nullValidate, document and clean up
The final step of the methodology is to validate the escalation path, document the chain and clean up artifacts. For a report, record each finding, the command used, the evidence of the result, and the defender-side visibility the skill describes.
Cleanup matters on any engagement. Remove files you dropped, such as copied tools and modified files, and note anything you could not revert.
- Record the exact chain from low-privilege user to root.
- Note which logs or processes would show each step.
- Remove test files and restore any file you changed, then say so in the report.
What people use it for
- A red team checks a lab host for a privilege escalation path from a standard user account to root and writes up the chain for the report.
- A CTF player works through sudo rules, SUID binaries and capabilities on a practice machine to find the fastest route to root.
- A blue team asks how a sudo NOPASSWD misconfiguration or cron job abuse would look in logs, then writes detection rules from the answer.
- A purple team exercise compares attacker enumeration steps with what the defenders' monitoring recorded during the same run.
Frequently asked questions
Is the offensive-linux-privesc skill free and what is its licence?
The skill is listed under the MIT licence on this page. The licence terms are what the source provides, so check the licence text in the repository before reusing the material. The skill itself is a SKILL.md instruction file.
What do I need to use the offensive-linux-privesc skill?
You need a Linux target where you hold a low-privilege shell and have written authorization to test it. The source also lists LinPEAS, linux-exploit-suggester, a pspy64 binary, the GTFOBins reference, public exploit code for specific CVEs, and compilers such as make and gcc on the target.
Where do I install an agent skill?
Unzip the skill into ~/.claude/skills/ for personal use, or into a project's .claude/skills/ folder. In the Claude apps you can upload the ZIP under Settings, then Capabilities, then Skills.
Does the skill run scripts and use the network?
Yes. The skill runs scripts and uses the network, for example to download LinPEAS from GitHub and to fetch public exploit code. Review scripts before running them and avoid production or monitored systems unless the owners have coordinated the test.
Can I use this skill on systems I do not own?
No. The skill is for authorized penetration testing, red team engagements and CTF competitions. Using these techniques on systems without permission is illegal.
What are the alternatives to this skill?
The source does not compare this skill with other tools, so this page cannot make a comparison. The tools it names, such as LinPEAS, linux-exploit-suggester, pspy and GTFOBins, can be used on their own.
New agent skills, repos and AI tools — every week
The best new skills and open-source projects, the fastest-growing repos, and one free prompt. Five minutes to read. Unsubscribe anytime.
Our verdict
Use this skill if you run authorized Linux penetration tests, red team exercises, CTF challenges or purple team work and want an agent to follow a structured escalation checklist with defender-side notes. Pick something else if you are learning Linux administration or hardening, since the content is attack-oriented and does not explain safe configuration in depth, or if you plan to test systems you are not authorized to test.
Download the skill