awesome-privilege-escalation - A curated list of awesome privilege escalation

项目说明

Awesome Pri Escalation

A curated list of awesome pri escalation

Table of Contents

* Linux
* Escape restricted shells
* SUDO and SUID
* Capabilities
* TTY Pushback / TIOCSTI injection
* Tools
* Find CVEs
* NFS
* Presentations
* Windows
* DLL Hijacking
* Potato
* Unquoted services with spaces
* Groups.xml
* NoFilter
* Tools
* Presentations
* Linux and Windows
* Docker
* Tools
* Presentations
* Cloud
* AWS
* GCP

Linux

- A guide to Linux Pri Escalation: by Rashid-Feroze
- Attack and Defend: LinuxPri Escalation Techniques of 2016: This paper will examine Linux pri escalation techniques used throughout 2016 in detail, highlighting how these techniques work and how ad are using them.
- Back To The Future: Unix Wildcards Gone Wild: This article will cover one interesting old-school Unix hacking technique, that will still work in 2013.
- Basic Linux Pri Escalation: by g0tmi1k
- Enumeration is the Key: by Marcos Tolosa
- Hackers Hut: Some random hacking hints, mainly from a Linux point of view.
- Hacking Linux Part I: Pri Escalation
- How pri work in operating systems?
- Linux ele of pri ToC
- Linux - Pri Escalation: Methodology from PayloadsAllTheThings
- Linux Pri Escalation: an introduction to Linux escalation techniques, mainly focusing on file/process permissions, but along with some other stuff too.
- Linux Pri Escalation: Linux Pri Escalation by lamontns.
- Linux Pri Escalation: by HackTricks
- Linux Pri Escalation: by reboare.
- Local Priv Esc - Linux: by Offsec Journey.
- Pri Linux: by h4rithd.
- Linux Pri Escalation – Exploiting User Groups: by Steflan Security.
- Linux Pri Escalation Linked Shared Object Library: How RPATH and Weak File Permissions can lead to a system compromise.
- Local Linux Enumeration & Pri Escalation Cheatsheet: a few Linux commands that may come in useful when trying to escalate pri on a target system.
- Local Linux Enumeration & Pri Escalation: a few Linux commands that may come in useful when trying to escalate pri on a target system.
- Local Linux pri escalation o: This article will give an o of the basic Linux pri escalation techniques. It separates the local Linux pri escalation in different scopes: kernel, process, mining credentials, sudo, cron, NFS, and file permission.
- Penetration-Testing-Grimoire/Pri Escalation/linux.md
- PENETRATION TESTING PRACTICE LAB - APPS / SYSTEMS
- Pentest Book - Pri Escalation: common Linux pri escalation techniques.
- POST CATEGORY : Pri Escalation: Pri escalation post category in Raj Chandel's Blog.
- Pri Escalation Cheatsheet (): This cheasheet is aimed at the CTF Players and Beginners to help them understand the fundamentals of Pri Escalation with examples.
- Pri escalation: Linux
- Pri Escalation & Post-Exploitation
- Reach the root! How to gain pri in Linux?
- Understanding Pri Escalation: Some techniques malicious users employ to escalate their pri on a Linux system.

Escape restricted shells

- Breaking out of rbash using scp
- Escaping from Restricted Shell and Gaining Root Access to SolarWinds Log & Event Manager (SIEM) Product
- Escaping Restricted Linux Shells: Resource for penetration testers to assist them when confronted with a restricted shell.
- Linux Restricted Shell Bypass
- Restricted Linux Shell Escaping Techniques: The focus of this article is on discussing and summarizing different techniques to escape common Linux restricted shells and also simple recommendations for administrators to protect against it.

SUDO and SUID

- Abusing SUDO: Some of the binary which helps you to escalate pri using the sudo command.
- Gaining a Root shell using MySQL User Defined Functions and SETUID Binaries: How a MySQL User Defined Function (UDF) and a SETUID binary can be used to elevate user pri to a root shell.
- GTFOBins: GTFOBins is a curated list of Unix binaries that can be exploited by an attacker to bypass local security restrictions.
- How I got root with Sudo
- Sudo (LD_PRELOAD): Pri Escalation from an LD_PRELOAD en .

Capabilities

- An Interesting Pri Escalation (getcap/setcap)
- Capabilities
- Exploiting capabilities: Parcel root power, the dark side of capabilities
- getcap, setcap and file capabilities
- Spicing up your own access with capabilities

TTY Pushback / TIOCSTI injection

- The oldest privesc: injecting careless administrators' terminals using TTY pushback: By Guillaume Quéré
- TIOCSTI injection: Abusing TIOCSTI to manipulate process file descriptors and execute arbitrary commands. By Krystian Bajno
- TIOCSTI is a kernel problem.: By Jonathan de Boyne Pollard.
- TTY Input Pushback Pri Escalation: When user working as root switches to another user with su and happens to execute the pushback program as that user, the tty input data pushed back is executed in the shell and context of user root.

Tools

- AutoLocalPri: An automated script that download potential exploit for linux kernel from exploitdb, and compile them automatically.
- BeRoot: BeRoot Project is a post exploitation tool to check common misconfigurations to find a way to escalate our pri.
exploits.
- exploit-suggester: This tool reads the output of “showrev -p” on Solaris machines and outputs a list of exploits that you might want to try.
is intended to be executed locally on a Linux box to enumerate basic system info and search for common pri escalation such as word writable files, misconfigurations, clear-text password and applicable
- GTFONow: Automatic pri escalation for misconfigured capabilities, sudo and suid binaries using GTFOBins.
- kernelpop: kernelpop is a framework for performing automated kernel enumeration and exploitation.
- LES: LES: Linux pri escalation auditing tool
- LinEnum: Scripted local Linux enumeration & pri escalation checks
- LinPEAS: Linux Pri Escalation Awesome Script
- Linux Exploit Suggester 2: Next-generation exploit suggester based on Linux_Exploit_Suggester
- Linux_Exploit_Suggester: Linux Exploit Suggester; based on operating system release number.
- linux-kernel-exploits
- Linuxpri.py: This script is intended to be executed locally on a Linux box to enumerate basic system info and search for common pri escalation such as world writable files, misconfigurations, clear-text passwords and applicable exploits.
- Linux Pri Escalation Check Script: Originally forked from the linuxpri.py (Mike Czumak), this script is intended to be executed locally on a Linux box to enumerate basic system info and search for common pri escalation such as word writable files, misconfigurations, clear-text password and applicable exploits.
- linux-smart-enumeration: Linux enumeration tools for pentesting and CTFs
- linux-soft-exploit-suggester: linux-soft-exploit-suggester finds exploits for all software in a system helping with the pri escalation.
- PrivEsc: A collection of Windows, Linux and MySQL pri escalation scripts and exploits.
- pspy: unpri Linux process snooping
- SUDO_KILLER : A tool designed to exploit a pri escalation in the sudo program on Unix-like systems.
- traitor: Automatically exploit low-hanging fruit to pop a root shell. Linux pri escalation made easy!
- ttyinject: Alice gets ROOT when ROOT does 'su alice'.
- unix-pri: Shell script to check for simple pri escalation on Unix systems
- Unix-Prits-Pack: Exploits for getting local root on Linux, BSD, AIX, HP-UX, Solaris, RHEL, SUSE etc.
- uptux: Specialized pri escalation checks for Linux systems.

#### Find CVEs
- acti: Checks a list of packages against the "active" (not yet patched) CVE's as listed in the Ubuntu C.
- Arch-Audit: A tool to check packages in Arch Linux.
- c: Original Automated C Tool.
- LPVS: Linux Package Scanner for CentOS and Ubuntu.

NFS

- Exploiting a Mis-Configured NFS Share
- Linux Pri Escalation using Misconfigured NFS: How to exploit a misconfigured NFS share to gain root access to a remote host machine.
- NFS weak permissions
- Linux Pri Escalation using weak NFS permissions: t Linux Pri Escalation using weak NFS permissions in “/etc/exports”. by Haider Mahmood

Presentations

- Linux pri escalation for fun, profit, and all around mischief: Examine opportunities for pri escalation that can vault you from zero to hero in a few easy steps.
- Linux Pri Escalation - Tradecraft Security Weekly #22: Methodology for performing pri escalation techniques against Linux-based systems.
- Pri Escalation FTW: Demonstrate pri escalation techniques that are possible primarily due to misconfigurations.

Windows

- awesome-windows-security
- LOLBAS: Living Off The Land Binaries and Scripts (and also Libraries)
- OSCP Windows PrivEsc - Part 1
- Pri Escalation: There are also other (local) exploits that can be used to also escalate pri.
- Pri Escalation Windows
- Pri escalation: Windows
- Windows ele of pri ToC
- Windows Local Pri Escalation: by HackTricks
- Windows Local Pri Escalation Cookbook: Windows Local Pri Escalation Cookbook by nickvourd.
- Windows Post Gather Modules: Metasploit offers a number of post exploitation modules that allow for further information gathering on your target network.
- Windows Priv Esc
- Windows Pri Escalation Fundamentals
- Windows Pri Escalation Guide
- Windows-Pri: Step-by-step windows privlege escalation methodology.
- Windows-Prices: Compilation of Resources from TCM's Windows Priv Esc Udemy Course. By Gr1mmie
- Windows - Pri Escalation
- Windows Pri Escalation
- Windows Pri Escalation: Windows Pri Escalation by lamontns.
- Windows Pri Escalations

DLL Hijacking

- DLL Hijacking: DLL Search Order Hijacking for pri escalation, code execution, etc. by Red Teaming Experiments
- DLL Hijacking: by PentestLab
- DLL Search Order Hijacking: by MITRE
- PrivEsc: DLL Hijacking: by GracefulSecurity
- Windows Pri Escalation via DLL Hijacking: Crystal-clear view on one of the most used techniques for pri escalation by the Threat Actors. by HacknPentest

Potato

- CertPotato: Using ADCS to privesc from and network service accounts to local system.
- Coerced potato: From Patate (LOCAL/NETWORK SERVICE) to SYSTEM by abusing SeImpersonatePri on Windows 10, Windows 11 and Server 2022.
- Hot Potato: Hot potato is the code name of a Windows pri escalation technique that was discovered by Stephen Breen. This technique is actually a combination of two known windows issues like NBNS spoofing and NTLM relay with the implementation of a fake WPAD proxy ser is running locally on the target host.
- Hot Potato: Windows 7, 8, 10, Server 2008, Server 2012 Pri Escalation in Metasploit & PowerShell.
- Hot Potato – Windows Pri Escalation: Pri Escalation on Windows 7, 8, 10, Server 2008, Server 2012 … and a new network attack.
- Juicy Potato (abusing the golden pri)
- No more JuicyPotato? Old story, welcome RoguePotato!: by decoder_it and splinter_code/antonioCoco
- Remote Potato: Remote Potato – From Domain User to Enterprise Admin
- Rotten Potato – Pri Escalation from Service Accounts to SYSTEM

Unquoted services with spaces

- Practical Guide to exploiting the unquoted service path in Windows
- PrivEsc: Unquoted Service Path
- Unquoted Service Path
- UNQUOTED SERVICE PATHS
- Windows Pri Escalation — Part 1 (Unquoted Service Path)
- Windows Pri Escalation – Unquoted Services
- Windows Pri Escalation Service Paths

Groups.xml

- Finding Passwords in SYSVOL & Exploiting Group Policy Preferences
- gpp-decrypt Package Description: A simple ruby script that will decrypt a given GPP encrypted string.

PrintNightmare

- Uni Pri Escalation and Persistence: The Print Spooler is responsible to manage and process printer jobs. It runs as a service with SYSTEM le on windows en.

NoFilter

- #NoFilter - Abusing Windows Filtering Platform for Pri Escalation: An e and undetected pri escalation technique that abuses the Windows Filtering Platform (WFP).

Tools

- ADAPE-Script: Acti Assessment and Pri Escalation Script by hausec
- GodPotato: GodPotato enables pri escalation in Windows 2012 - Windows 2022, now as long as you have "ImpersonatePri" permission.
- JAWS - Just Another Windows (Enum) Script: JAWS is PowerShell script designed to help penetration testers (and CTFers) quickly identify potential pri escalation on Windows systems. It is written using PowerShell 2.0 so 'should' run on every Windows since Windows 7.
- juicy-potato: A sugared of RottenPotatoNG, with a bit of juice, i.e. another Local Pri Escalation tool, from a Windows Service Accounts to NT AUTHORITY\SYSTEM.
- NoFilter: Tool for abusing the Windows Filtering Platform for pri escalation. It can launch a new console as "NT AUTHORITY\SYSTEM" or as another user that is logged on to the machine.
- Potato: Potato Pri Escalation on Windows 7, 8, 10, Server 2008, Server 2012.
- PowerSploit: PowerSploit is a collection of Microsoft PowerShell modules that can be used to aid penetration testers during all phases of an assessment.
- Pri: Enumerate common Windows security misconfigurations which can be le for pri escalation and gather information which might be useful for exploitation and/or post-exploitation, by itm4n.
- RemotePotato0: Just another "Won't Fix" Windows Pri Escalation from User to Domain Admin by antonioCoco.
- RoguePotato: Another Windows Local Pri Escalation from Service Account to System by splinter_code/antonioCoco
- RottenPotato: RottenPotato local pri escalation from service account to SYSTEM. (No longer maintained)
- RottenPotatoNG: New of RottenPotato as a C++ DLL and standalone C++ binary - no need for meterpreter or other tools.
- Seatbelt: Project that performs a number of security oriented host-survey "safety checks" relevant from both offensive and defensi perspectives.
- SessionGopher: SessionGopher is a PowerShell tool that finds and decrypts sa information for remote access tools.
- Sherlock: PowerShell script to quickly find missing software patches for local pri escalation . (Deprecated)
- SweetPotato: Local Service to SYSTEM pri escalation from Windows 7 to Windows 10 / Server 2019 by CCob
- Tater: Tater is a PowerShell implementation of the Hot Potato Windows Pri Escalation exploit.
- Watson: Watson is a .NET tool designed to enumerate missing KBs and suggest exploits for Pri Escalation .
- WindowsEnum: A Powershell Pri Escalation Enumeration Script.
- Windows-Exploit-Suggester: This tool compares a targets patch levels against the Microsoft database in order to detect potential missing patches on the target. It also notifies the user if there are public exploits and Metasploit modules a for the missing bulletins. By AonCyberLabs
- Windows Exploit Suggester - Next Generation (WES-NG): WES-NG is a tool based on the output of Windows' systeminfo utility which provides the list of the OS is to, including any exploits for these . Every Windows OS between Windows XP and Windows 10, including their Windows Ser, is supported. By bitsadmin
- windows-pri: Standalone executable that runs on Windows systems. It tries to find misconfigurations that could allow local unpri users to escalate pri to other users or to access local apps (e.g. databases).
- winPEAS: Windows Pri Escalation Awesome Scripts
- WinPwnage: UAC bypass, Elevate, Persistence and Execution methods. The goal of this repo is to study the Windows penetration techniques.

Presentations

- Level Up! Practical Windows Pri Escalation - Andrew Smith
- Level Up! - Practical Windows Pri Escalation (Presentation Slides)
- SANS Webcast: Pen Testing with PowerShell - Local Pri Escalation Techniques
- Windows Pri Escalation Techniques (Local) - Tradecraft Security Weekly #2
- Windows Pri Escalation Unquoted Service - Part 1
- Windows Pri Escalation Unquoted Service - Part 2
- Windows Pri Escalation Unquoted Service - Part 3

Linux and Windows

- Awesome-Hacking-Resources (Pri escalation section): A collection of hacking / penetration testing resources to make you better!
- Metasploit Local Exploit Suggester: Do Less, Get More!
- My 5 Top Ways to Escalate Pri: Bruno Oliveira's top 5 fa ways for accomplishing pri escalation in the most practical ways possible.
- Pri Escalation: Pri Escalation category by pentestlab.blog
- Recipe for Root: Your Cookbook for Pri Escalation
- Windows / Linux Local Pri Escalation Workshop

Docker

- Bypassing Docker Authz Plugin and Using Docker-Containerd for Privesc: by Staaldraad.
- Container security notes
- Dirty COW - (C) - Docker Container Escape
- Docker Breakout: by HackTricks
- Docker security checklist
- Don't expose the Docker socket (not even to a container)
- Escaping Docker Pri Containers: by Li
- Escaping Containers to Execute Commands on Play with Docker Servers
- Escaping Docker container using waitid() – C
- Escaping pri containers for fun: by Jordy/Oblivion/pwning.systems
- Escaping the Whale: Things you probably shouldn’t do with Docker (Part 1)
- Hack Allows Escape of Play-with-Docker Containers
- Hacking Docker the Easy way
- Understanding Docker container escapes: by Trail of Bits

Tools

- BOtB: BOtB is a container analysis and exploitation tool designed to be used by pentesters and engineers while also being CI/CD friendly with common CI/CD technologies.
- CDK: CDK is an open-sourced container penetration toolkit, offering stable exploitation in different slimmed containers without any OS dependency.
- Deepce: Docker Enumeration, Escalation of Pri and Container Escapes (DEEPCE)
- Dokcer-escape-tool: This tool will help identify if you're in a Docker container and try some quick escape techniques to help assess the security of your containers.
- Pri: A bash script to create an interacti from a pri docker container to the container host

Presentations

- Introduction to Docker Hacking: by NahamSec

Cloud

AWS

- AWS-IAM-Pri: A centralized source of all AWS IAM pri escalation methods released by Rhino Security Labs.

#### Tools
- Pacu: The AWS exploitation framework, designed for testing the security of Amazon Web Services en. By RhinoSecurityLabs.

GCP

- Tutorial on pri escalation and post exploitation tactics in Google Cloud Platform en: Very deep-dive into manual post-exploitation tactics and techniques for GCP.
- GCP-IAM-Pri: IAM Pri Escalation in GCP by RhinoSecurity.

#### Tools
- GCPBucketBrute: A script to enumerate Google Storage buckets, determine what access you have to them, and determine if they can be pri escalated. By RhinoSecurity.

项目信息

开发语言：未知

Star 数：1613

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕A curated list of awesome privilege escalation展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。