post-exploit-linux

该技能与其声明目的高度一致，但其声明目的本身就是攻击性 Linux 后渗透：提权、凭据窃取、敏感数据搜集与横向移动。不存在明显伪装或隐藏 exfil 端点，但能力范围直接面向未授权入侵行为，并包含高风险下载执行与漏洞利用指导；应按高风险、恶意用途安全技能处理。

这是面向 Linux 提权、容器逃逸和凭据获取的攻击性操作指南，而非正常依赖库源代码。文档本身不会自动执行恶意行为，但其中命令明确指导高危系统修改、凭据收集和 root 权限获取；不应在未授权环境中执行。远程 exploit 下载和未经校验执行还增加了供应链风险。

该片段是面向 Linux 凭据发现和收集的操作指南，能够暴露大量高价值认证材料，尤其是 SSH 私钥、数据库密码、环境变量、/etc/shadow、Docker 和 Git 凭据。虽然没有发现网络外传或破坏系统行为，但其明确的凭据搜集目的使其具有明显的恶意使用潜力；不应在未授权主机上执行。

This fragment is not a software library; it is a Linux privilege-escalation guide containing explicit exploitation commands (sudo abuse via GTFOBins, SUID/capabilities checks, and cron hijacking). While it indicates potentially harmful intent if included in a software supply-chain artifact, the provided text alone does not show any actual malicious code that would execute on installation (no network/file/process execution logic as part of a dependency). If this text appears inside a package (e.g., in scripts, README with install hooks, or postinstall), it should still be treated as high-risk content and reviewed for hidden execution steps.

This module is a high-risk, offensively purposed instruction/evaluation template designed to generate or verify concrete Linux privilege-escalation and root/host-root breakout commands. It contains classic attacker payload patterns (sudo GTFOBins-style shell escape, sudo `find -exec` shell spawning, and docker-group host-root mount/chroot guidance) and forces inclusion of exploit substrings via `required_terms`. While not executable code by itself, its purpose and content make it directly actionable and therefore highly likely to facilitate malicious post-exploitation.