detecting-privilege-escalation
Detects privilege escalation vulnerabilities including setuid/setgid abuse, permission check bypasses, and unsafe privilege management. Use when analyzing setuid binaries, permission checks, or investigating privilege escalation paths.
When & Why to Use This Skill
This Claude skill provides a specialized security framework for detecting privilege escalation vulnerabilities, including setuid/setgid abuse, permission check bypasses, and unsafe privilege management. It automates the identification of critical security flaws in system binaries and access control models, helping security researchers and developers prevent unauthorized elevation of privileges.
Use Cases
- Case 1: Auditing setuid/setgid binaries to identify unsafe operations, environment variable manipulation, or path traversal vulnerabilities that could lead to root access.
- Case 2: Analyzing complex permission models to map privilege boundaries and detect logic flaws or bypasses in access control mechanisms.
- Case 3: Identifying race conditions and TOCTOU (Time-of-Check to Time-of-Use) vulnerabilities in file operations performed by privileged processes.
- Case 4: Evaluating environment-based escalation risks, such as LD_PRELOAD abuse, PATH manipulation, or insecure resource handling in /proc filesystem.
| name | detecting-privilege-escalation |
|---|---|
| description | Detects privilege escalation vulnerabilities including setuid/setgid abuse, permission check bypasses, and unsafe privilege management. Use when analyzing setuid binaries, permission checks, or investigating privilege escalation paths. |
Privilege Escalation Detection
Detection Workflow
- Identify privileged operations: Find setuid/setgid binaries, locate privilege checks, identify file operations with elevated privileges, map privilege boundaries
- Analyze permission model: Understand intended permission model, identify all privilege boundaries, map privilege escalation paths, assess access control mechanisms
- Check validation: Verify permission checks are correct, look for race conditions, assess validation completeness, identify TOCTOU issues
- Assess exploitability: Can attacker bypass checks? Is there a usable escalation path? What's the impact of successful escalation?
Key Patterns
- Setuid/setgid binaries: binaries with setuid/setgid bits set, unsafe operations in privileged binaries, environment variable usage, path traversal vulnerabilities
- Insecure permission checks: race conditions in permission checks, missing privilege validation, TOCTOU in file operations, weak access control implementations
- Environment-based escalation: environment variable manipulation, LD_PRELOAD/DT_RPATH abuse, PATH manipulation, IFS exploitation
- Resource manipulation: symlink attacks, hard link manipulation, file descriptor manipulation, /proc filesystem abuse
Output Format
Report with: id, type, subtype, severity, confidence, location, binary_info (path, setuid, setgid, owner), vulnerability, attack_path, exploitable, impact, mitigation.
Severity Guidelines
- CRITICAL: Direct path to root/admin access
- HIGH: Escalation to lower privileged user
- MEDIUM: Limited privilege escalation
- LOW: Information disclosure about privileges
See Also
patterns.md- Detailed detection patterns and exploitation scenariosexamples.md- Example analysis cases and code samplesreferences.md- CWE references and mitigation strategies