Claude Skills · DevOps & Infrastructure
Privesc Linux
pale-knight/redteam-skillLinux local privilege escalation from a low-privilege shell to root. Covers quiet vs loud enumeration, sudo/GTFOBins, CVE-2025-32463 chwoot and CVE-2025-32462 host bypass, polkit/udisks CVE-2025-6018/6019, SUID/capabilities, systemd timers/units, cron/PATH/LD_PRELOAD, dangerous groups and docker.sock, host-local container escape, and version-gated kernel LPE including Copy Fail CVE-2026-31431. Use when the operator has a Linux foothold and needs root. Kubernetes RBAC stays in /k8s. Endpoint blocks hand off to /edr-bypass then return here.
At a glance
This skill is for DevOps & Infrastructure and helps you escalate privileges to root on linux, exploit suid binaries for privilege elevation, and bypass sudo restrictions.
git clone --depth 1 https://github.com/pale-knight/redteam-skill
cp -r redteam-skill/skills/privesc-linux ~/.claude/skills/privesc-linux
linuxPrivilege EscalationexploitationKernelContainer EscapeGtfobins
Also in pale-knight/redteam-skill
View the repoActive Directory exploitation after domain credentials exist: Kerberos (AS-REP/Kerberoast including cracking the ticket then using the accou...
Active Directory reconnaissance with or without credentials: user/group/computer enumeration, ACL/delegation, ADCS, modern Windows LAPS, Blo...
CI/CD pipeline and software-supply-chain exploitation: Jenkins, GitHub Actions, GitLab CI/CD, Azure DevOps, Gitea/Forgejo, self-hosted runne...
Cloud control-plane exploitation for AWS, Azure/Entra, GCP, and Alibaba Cloud: IAM/RAM privilege escalation, impersonation, cross-account tr...
Cloud control-plane reconnaissance for AWS, Azure/Entra, GCP, and Alibaba Cloud: identity, IAM/RAM, trust, resources, metadata, and managed-...
Credential operations: secret discovery, classification, extraction, conversion, offline cracking of hashes the operator already has as a cr...
Endpoint defense evasion after an operator-selected chain already has a valid execution path but AV/EDR/AMSI/WDAC/PPL/memory/kernel telemetr...
Kubernetes and container exploitation: identity/RBAC, secrets, kubelet/etcd, managed-cloud workload identities, container-to-node escape inc...
Client-side initial access and social-engineering attack module. Use when the operator selects a human/client/browser/identity-delivery atta...
OS post-exploitation after a stable host foothold: quiet host recon, host-native persistence (Windows Run/tasks/services/COM/WMI and Linux S...
Windows local privilege escalation from a low-privilege shell to Administrator or SYSTEM. Covers quiet vs loud enumeration, SeImpersonate/Po...
通用网络与资产信息收集。面向 IP、CIDR、主机名、企业/域名等尚未明确攻击面的目标，完成资产扩展、主机发现、TCP/UDP端口发现、服务/版本/协议识别...
Other DevOps & Infrastructure skills
Generate an interactive bash wizard that walks a human through a manual procedure — third-party setup, a one-off migration, an A→B state tra...
Set up Claude Code hooks to block dangerous git commands (push, reset --hard, clean, branch -D, etc.) before they execute. Use when user wan...
Configure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before f...
Wire dependency-cruiser into a TypeScript repo so each package is a deep module — implementation hidden in subfolders, reachable only throug...
Set up Husky pre-commit hooks with lint-staged (Prettier), type checking, and tests in the current repo. Use when user wants to add pre-comm...
Manage Azure Container Registry via the az acr CLI including registries, images, cloud builds, ACR Tasks, authentication, tokens, geo-replic...