linux-privilege-escalation

Fail

Audited by Gen Agent Trust Hub on Sep 15, 2026

Risk Level: CRITICALREMOTE_CODE_EXECUTIONPRIVILEGE_ESCALATIONCOMMAND_EXECUTIONCREDENTIALS_UNSAFEEXTERNAL_DOWNLOADSDATA_EXFILTRATIONPERSISTENCEDYNAMIC_EXECUTION
Full Analysis
  • [REMOTE_CODE_EXECUTION]: The skill provides commands to download scripts from external sources and pipe them directly into a shell interpreter, notably using curl -L ... | sh to execute LinPEAS from GitHub.
  • [PRIVILEGE_ESCALATION]: Extensive documentation of methodologies to gain root access, including SUID/SGID binary abuse, capability exploitation, kernel exploits, and Docker group manipulation.
  • [CREDENTIALS_UNSAFE]: Instructions for harvesting sensitive information, such as accessing /etc/shadow, environment variables, and private SSH keys from the filesystem.
  • [COMMAND_EXECUTION]: The playbook relies on the execution of high-risk shell commands, including the use of reverse shell patterns (e.g., nc -e /bin/sh) to establish remote access.
  • [EXTERNAL_DOWNLOADS]: Fetches multiple security auditing tools and exploit payloads from external GitHub repositories.
  • [DATA_EXFILTRATION]: Provides specific techniques for exfiltrating sensitive files like /etc/shadow via network operations to remote listeners.
  • [PERSISTENCE]: Includes instructions for maintaining access to a host system, such as planting SSH keys in the root user's authorized_keys file via Docker volume mounts.
  • [DYNAMIC_EXECUTION]: Instructions for runtime compilation of C source code into shared objects to facilitate privilege escalation via LD_PRELOAD and library hijacking.
Recommendations
  • HIGH: Downloads and executes remote code from: https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh - DO NOT USE without thorough review
  • CRITICAL: 1 file(s) identified as malware by FileRep - DO NOT USE
Audit Metadata
Risk Level
CRITICAL
Analyzed
Sep 15, 2026, 02:13 PM
Security Audit — agent-trust-hub — linux-privilege-escalation