
You have code execution inside a Docker container or other containerized environment during an authorized penetration test. Reason through escape vectors.

**Situational Awareness**
- How do you detect that you are inside a container? (/.dockerenv, cgroup, hostname patterns)
- What does the container's mount table and network configuration reveal?
- How do you identify the host OS and kernel version from inside a container?

**Docker Socket Escape**
- What is the Docker socket (/var/run/docker.sock) and why is mounting it inside a container a critical vulnerability?
- How do you use the Docker socket to spawn a privileged container with host filesystem access?
- What is the Docker socket attack chain from container code execution to full host root?

**Privileged Container Escape**
- What does `--privileged` give a Docker container?
- How do you use `--privileged` to mount the host filesystem or access host devices?
- What is the cgroup release_agent escape and how does it work without --privileged but with specific capabilities?

**Capability Abuse**
- What Linux capabilities, if assigned to a container, enable escape? (CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN)
- How does CAP_SYS_ADMIN enable a container escape via cgroup v1?
- How does CAP_SYS_PTRACE enable process injection into host processes?

**Shared Namespace Escape**
- What happens when a container shares the host PID, network, or IPC namespace?
- How do you use shared PID namespace to access host processes?

Output:
- Container escape decision tree
- Docker socket exploit chain commands
- Capability-based escape techniques


Container & VM Escape Techniques


You have a low-privilege shell on a Linux system. Systematically reason through the privilege escalation attack surface.

**Initial Enumeration**
- What is your current user context? What groups are you in?
- What does `id`, `whoami`, `hostname`, `uname -a`, and `cat /etc/os-release` tell you?
- What environment variables are set? Are there any with credentials?

**SUID/SGID Binaries**
- How do you find all SUID binaries and which ones are interesting?
- How do you use GTFOBins to exploit a writable or SUID binary?
- What is the difference between a SUID binary that runs as root vs one that runs as another user?

**Sudo Configuration**
- What does `sudo -l` reveal?
- How do you exploit a sudo entry like `(ALL) NOPASSWD: /usr/bin/vim`?
- What is the sudoers `!root` bypass (CVE-2019-14287)?
- What does `(ALL, !root) NOPASSWD:` actually allow?

**Writable Files & Cron Jobs**
- How do you identify world-writable files that are executed by root?
- How do you find cron jobs running as root and exploit writable scripts?
- What is cron PATH hijacking?

**Kernel Exploits**
- How do you identify the kernel version and search for local privilege escalation exploits?
- Why are kernel exploits a last resort and what risks do they carry?

**Service Misconfigurations**
- What do weak service permissions allow on Linux?
- How do you exploit NFS with no_root_squash?

Output:
- Privilege escalation checklist (ordered by likelihood/impact)
- GTFOBins workflow
- linPEAS interpretation guide


Linux Privilege Escalation


You are a beginner learning Linux privilege escalation through SUID binaries and SUDO misconfigurations.

**Understanding SUID**
- What does the SUID bit mean and why is it dangerous on certain binaries?
- How does the kernel handle process effective UID when a SUID binary runs?
- Which SUID binaries are expected on a standard Linux system vs suspicious ones?

**Finding SUID Binaries**
- What find command locates all SUID binaries on a system?
- How do you quickly filter results to exclude standard system binaries?
- How do you look up a found binary on GTFOBins?

**Exploiting SUID via GTFOBins**
- Walk through exploiting SUID `find`, `vim`, `python`, `bash`, `cp`, and `nmap`
- What does each binary allow you to do differently? (shell, read, write, sudo)
- Why does `bash -p` not always work and when does it?

**Understanding SUDO**
- What does `sudo -l` output tell you?
- What is the difference between `(root)` and `(ALL)` in a sudo entry?
- What does `NOPASSWD` mean in practice for an attacker?

**SUDO Exploitation**
- Walk through exploiting: `sudo vim`, `sudo python3`, `sudo find`, `sudo awk`, `sudo less`
- What is the SUDO environment variable exploit (LD_PRELOAD)?
- What is the sudo heap overflow (CVE-2021-3156) and what systems are affected?

Output:
- SUID find command
- GTFOBins exploitation examples for 6 common binaries
- SUDO entry interpretation guide


SUID & SUDO Exploitation


You have a low-privilege shell on a Windows system. Reason through the privilege escalation attack surface systematically.

**User & System Context**
- What does `whoami /all` reveal about your current privileges?
- What privileges in the token are immediately exploitable? (SeImpersonatePrivilege, SeDebugPrivilege, SeBackupPrivilege)
- What does `systeminfo` reveal about the patch level and hotfixes?

**Service Misconfigurations**
- What is an unquoted service path and how do you exploit it?
- How do you identify services with weak file or folder permissions?
- What does a writable service binary allow you to do?
- How do you check service permissions using `accesschk`?

**Registry Misconfigurations**
- What registry keys controlling service binaries might be writable by your user?
- What is the AlwaysInstallElevated policy and how do you exploit it?
- How do you check AutoRun registry keys for writable paths?

**Token Privileges**
- Given SeImpersonatePrivilege, which Potato attack applies to your target Windows version?
- What does SeBackupPrivilege allow you to do for credential extraction?
- How does SeRestorePrivilege lead to privilege escalation?

**DLL Hijacking**
- How do you identify DLL hijacking opportunities in service startup?
- What is the Windows DLL search order and which positions are exploitable?
- What does Process Monitor show that reveals DLL hijacking candidates?

Output:
- Privilege escalation checklist with tool commands
- Privilege token decision tree
- WinPEAS output interpretation guide


Privilege Escalation

Container & VM Escape Techniques

Linux Privilege Escalation

SUID & SUDO Exploitation

Windows Privilege Escalation