## https://sploitus.com/exploit?id=31E274DE-6F21-5A6A-BBA2-BA773E68A175
# Internal Privilege Escalation POC Library
This library provides tools for detecting and assessing privilege escalation risks during internal network penetration testing. Each risk point includes a detection command (code evidence) and a reproducible proof-of-concept (hard evidence). Only those truly exploitable privilege escalation vectors are included. ## Overview
Given a target system within the scope of the test (Linux host, Windows host, or AD domain), this library assesses which escalation vectors actually exist. Only those vectors where a detection command confirms the condition and a POC proves its exploitability are reported. Non-exploitable vectors are omitted. Each entry follows a five-element evidence standard: **detection** (a command that proves the condition exists), **POC** (a reproducible exploit), **prerequisites** (an exact version or configuration range), **target** (root / SYSTEM / domain controller), and **verification** (how to confirm success). ## Structure
```
internal-privesc-poc/
├── SKILL.md # Trigger conditions, evidence standards, Hard Evidence Rules, decision tree
├── README.md # This file
├── references/
│ ├── linux.md # Linux kernel CVEs, SUID/capabilities, configuration errors
│ ├── windows.md # Windows tokens, services, registry, kernel, UAC
│ └── ad.md # AD Roasting, delegation, ACL abuse, AD CS, shadow credentials
└── exploits/
├── dirtypipe.c # Dirty Pipe (CVE-2022-0847) – complete, compileable exploit
└── pwnkit.c # PwnKit (CVE-2021-4034) – complete, compileable exploit
```
## Coverage
The library covers 37 risk points, covering CVE-2016 to CVE-2026. | Platform | Count | Scope |
|---|---|---|
| Linux | 20 | 11 kernel CVEs (2016–2026), SUID/capabilities, configuration errors |
| Windows | 10 | Potato family, services, registry, kernel CVEs, token privileges, UAC bypass |
| AD | 7 | AS-REP/Kerberoasting, delegation, ACL abuse, AD CS, shadow credentials |
## Usage
This library works as a skill. Given a target system, it routes the process through the decision tree based on platform. For each potential vector, a detection command is run to confirm the prerequisites. Then, a POC is used as hard evidence to verify exploitability. ## Disclaimer
This repository is intended only for authorized security testing and defensive research. The techniques and proof-of-concept code documented here must only be used against systems you own or have explicit written permission to test. Using these techniques against unauthorized systems is illegal and may lead to criminal prosecution. The author assumes no liability for any misuse of this material.