PaperlayerView exact revision on arXiv

Source-linked AI summary

PrivEscalate: Measuring and Augmenting the Threat of LLM-Automated Linux Privilege Escalation

Yixuan Liu, Zilong Zhen, Yin Wu, Yi Li

arXiv:2609.09087v1cs.CR

TL;DR

Prior Linux privilege-escalation evaluations were small and limited in reproducibility, coverage, and testing of environmental distractors. PrivEscalate constructs a Dockerized benchmark and evaluates six LLMs across agent architectures, finding heterogeneous model strengths, perturbation sensitivity, and architecture-dependent performance. The authors also introduce PrivEscAgent, a specialized wrapper that improves success rates without modifying the underlying LLM.

  • Problem

    Prior privilege-escalation evaluations relied on drifting online playgrounds or a narrow offline benchmark of 13 scenarios, limiting reproducible, broad comparisons and perturbation-sensitivity analysis.

    Source: §1 · p. 1

  • Method

    PrivEscalate provides 531 audited Dockerized scenarios across 14 sub-categories and 329 environmental variants, and evaluates six LLMs across agent architectures.

    Source: §1 · pp. 1–2

  • Results

    Model strengths differ across vulnerability classes, environmental success retention ranges from 59.0% to 78.2%, and agent architecture changes success rates and model rankings.

    Source: §1 · p. 2

  • Takeaways & Limitations

    PrivEscAgent raises success rates for all six evaluated models without modifying the underlying LLM, while the benchmark supports agent evaluation, defensive tool validation, and red-team training.

    Source: §1 · p. 2, §8 · p. 14

    The benchmark excludes kernel exploits, NFS root squashing, and service-specific exploits, and its category distribution is source-driven, with SUID/SGID and Sudo dominant.

    Source: §6.3 · pp. 12–13

Abstract

from arXiv · show

As Large Language Model (LLM) agents increasingly automate offensive operations across the cyber kill chain, their efficacy in complex local post-exploitation tasks remains inadequately quantified. Among these, Linux privilege escalation is a key step between initial access and full system compromise. However, existing evaluations for this task are limited by small sample sizes (fewer than 15 scenarios), lacking the scale to compare model capabilities under executable verification. To address this, we present PrivEscalate, a large-scale benchmark for Linux privilege escalation, comprising 531 Dockerized scenarios spanning 14 sub-categories. We additionally derive 329 parameterized variants to measure sensitivity to environmental distractors. Evaluating six LLMs across three agent architectures reveals: (i) model capability is heterogeneous across vulnerability classes, with no single model dominating across the high-prevalence classes, motivating multi-dimensional risk assessments; (ii) LLM successes are sensitive to environmental perturbation, so configuration rotation can disrupt some exploit attempts but does not eliminate the measured risk; and (iii) agent architectures can materially change success rates and reorder model rankings, though the magnitude is model-dependent. Leveraging these insights, we develop PrivEscAgent, a domain-specialized wrapper that augments a generic ReAct agent with deterministic enumeration, category matching, and step planning. PrivEscAgent improves over prior Linux privilege-escalation agent baselines without underlying LLM modifications. We release PrivEscalate as an open-source, Dockerized measurement instrument supporting LLM agent evaluation, defensive tool validation, and red-team training.

1 Introduction

Linux privilege escalation moves an attacker from a constrained foothold to root-level control, but prior evaluations lacked reproducible, broad coverage and tests of environmental distractors. PrivEscalate addresses these gaps and evaluates models, agent architectures, and a specialized agent wrapper.

1 Introduction

  • Prior privilege-escalation benchmarks were unreproducible or small and narrow, and they did not test sensitivity to environmental distractors.The offline hackingBuddyGPT benchmark had 13 manually constructed scenarios.Source: §1 · p. 1
  • PrivEscalate comprises 531 audited Docker-based scenarios across 14 sub-categories and 329 parameterized variants for perturbation testing.Its final corpus combines 523 retained scenarios from the automated pipeline and seed set with eight manually authored scenarios.Source: §1 · pp. 1–2
  • No single model leads across high-prevalence vulnerability classes; environmental success retention ranges from 59.0% to 78.2%, and agent architecture changes success rates and model rankings.PrivEscAgent raises the strongest non-reasoning model’s success rate by about 34 percentage points without modifying the underlying LLM.Source: §1 · p. 2
  • PrivEscAgent adds deterministic enumeration, category matching, and stepwise planning, raising success rates for all six evaluated models without modifying their underlying LLMs.It brings the weakest model to the level of the strongest wintermute baseline.Source: §1 · p. 2

2 Background

Privilege escalation converts a low-privilege Linux foothold into higher privileges, while LLM agents must discover and execute multi-step exploit chains through system interaction. The paper evaluates a post-initial-access agent under zero-knowledge conditions.

2.1 Privilege Escalation in the Cyber Kill Chain

  • Privilege escalation can turn a low-privilege foothold into root access, a decisive step between constrained attacker impact and full system compromise.Linux escalation can involve misconfigurations, environment hijacking, credential leaks, or kernel vulnerabilities, and typically involves enumeration, weakness identification, and exploit execution.Source: §2.1 · p. 2

2.2 LLM-Based Security Agents

  • LLM agents iteratively observe command output, reason about it, and act, enabling adaptive interpretation and multi-step exploit chains that challenge automation.The paper notes that privilege escalation requires integrating heterogeneous system signals and reasoning over multi-step chains.Source: §2.2 · p. 2, §2.1 · p. 2

2.3 Threat Model

  • The threat model assumes an autonomous agent with an unprivileged interactive Linux shell, no human assistance, and no hints about the vulnerability or exploit path.Cross-host lateral movement, kernel-CVE exploitation, and post-root objectives are excluded.Source: §2.3 · p. 3

3 Benchmark Design and Construction

PrivEscalate builds a reproducible Dockerized benchmark by organizing Linux privilege-escalation scenarios into a taxonomy, automating scenario construction and verification, and auditing the resulting corpus. The final benchmark contains 531 scenarios, with 329 additional environmental variants for perturbation testing.

3.1 Taxonomy

  • A four-step ATT&CK-based process yields 14 feasible sub-categories, grouped into five classes and cross-checked against GTFOBins, Exploit-DB, and hackingBuddyGPT scenarios.The classes are Misconfiguration, Environment, Scheduled Tasks, Credentials, and Container.Source: §3.1 · pp. 3–4

3.2 Automated Construction Pipeline

  • The construction pipeline ingests candidate vulnerabilities, scaffolds Dockerized environments, produces ground-truth exploits, and verifies scenarios through differential testing.The Scaffolder produces vulnerable and fixed Dockerfiles; verification checks that the exploit succeeds only in the vulnerable environment.Source: §3.2 · p. 4, §3.2.5 · p. 5

3.2.2 DataIngester.

  • The DataIngester converts heterogeneous vulnerability entries into a uniform ScenarioSpec and uses verified same-category examples to guide subsequent construction.It enumerates exploitable binaries and feasibility-filtered Exploit-DB entries without sampling.Source: §3.2.2 · p. 4

3.2.3 Scaffolder.

  • The Scaffolder combines base hardening with LLM-generated vulnerable and fixed Dockerfiles so the injected vulnerability is intended to be the sole escalation path.It also resolves and installs dependencies required by the target vulnerability and exploit approach.Source: §3.2.3 · p. 4

3.2.4 Exploiter.

  • The Exploiter selects retrieval, adaptation, or generation according to whether an exact or same-category reference exploit is available.Generation is the fallback when neither reference mode applies.Source: §3.2.4 · pp. 4–5

3.3 Construction Statistics

  • The pipeline verified 512 of 1,067 candidate templates (48.0%); common failures included build errors and exploits that failed to reach root.The most common specific failure modes included missing dependencies, absent pseudo-terminal allocation, and incomplete multi-step exploit scripts.Source: §3.3 · p. 5, Figure 3 · p. 5

3.4 Benchmark Quality Audit

  • The audit sampled 82 scenarios and, after adjudication, retained verified Dockerfile correctness for 79 and exploit validity for 80.The audit also led to two scenario removals and nine taxonomy-label corrections.Source: §3.4 · p. 6
  • The audited final benchmark contains 531 scenarios, with 329 perturbed variants generated from selected original scenarios.Audit adjustments removed two scenarios and corrected nine sub-category labels before the final set was named PrivEscalate.Source: §3.4 · p. 6

4 Measurement Study

Across six models and multiple agent architectures, Linux privilege-escalation success varies by vulnerability class, environmental perturbation, and agent design. The study also examines evaluation setup, attack cost, and steps to success.

4.1 Research Questions

  • The four research questions assess model performance, robustness to environment changes, architecture effects across model classes, and cost and success-step efficiency.The efficiency question frames successful attack steps as relevant to the defender’s detection window.Source: §4.1 · p. 6

4.2 Setup

  • Agents begin from a low-privilege SSH foothold, receive no vulnerability hints, and have at most 20 steps to reach root; success rate is the primary metric.RQ1 and RQ2 use wintermute; RQ3 and RQ4 compare it with HackSynth, with paired comparisons tested using McNemar’s test.Source: §4.2 · pp. 6–7

4.3 RQ1: Model Threat Ranking

  • 40.9% overall SR for GPT-5.4 versus Claude Sonnet 4.6’s 37.7%, but Sonnet leads Sudo (46.1%) while GPT-5.4 leads SUID/SGID (45.8%); the six-model union reaches 329/531 (62.0%).Two models, GPT-5.4 and Claude Sonnet 4.6, solve 298/531 (56.1%), or 90% of the six-model union.Source: Table 4 · p. 7, Figure 4 · p. 7, §4.3 · p. 7
  • Wrong-method dominates failures (81.6%), and four of six models fixate in 81–99% of failed episodes.GPT-5.4 uses 21.7% enumeration versus 42.0–72.4% for non-reasoning models; repeated enumeration dominates failed-run command budgets.Source: §4.3 · p. 7

4.4 RQ2: Variant Perturbation

  • Environmental perturbation removes 21.8–41.0% of previously demonstrated model successes; GPT-5.4 retains 128/217 (59.0%), the lowest retention despite leading RQ1 aggregate success rate.Figure 5 shows original–variant outcome overlap on the shared 154-pair panel.Source: §4.4 · p. 9, Figure 5 · p. 9

4.5 RQ3: Agent Architecture Impact

  • HackSynth improves five models but lowers DeepSeek v3.2 by 7.7 pp; Claude Sonnet 4.6 leads GPT-5.4 66.5% to 47.3%, reversing their wintermute ranking.The architecture’s effect varies by model; HackSynth-versus-wintermute gains are significant for Claude Sonnet 4.6 and Qwen-Plus, but not GPT-5.4.Source: Table 8 · p. 9, §4.5 · p. 9

4.6 RQ4: Cost and Efficiency

  • Under wintermute, DeepSeek v3.2 costs $0.02 per success versus GPT-5.4 at $1.22; Claude Haiku 4.5 succeeds in 7.3 commands on average.HackSynth changes per-success costs, and successful runs often finish before the step budget is exhausted, reducing time available for runtime detection.Source: Table 9 · p. 9, §4.6 · pp. 9–10

5 PrivEscAgent: Domain-Specialized Threat Amplification

PrivEscAgent wraps a ReAct agent with targeted modules for enumeration, category matching, strategy selection, and step planning. Its measured gains vary by model and module, making the full system’s cross-model comparison and ablations important.

5.1 Key Bottlenecks

  • Agents’ main bottlenecks are unfocused enumeration, missing exploit-specific knowledge, difficulty with coordinated multi-step exploits, and fixation on an initial strategy.These observed bottlenecks motivate the wrapper’s targeted modules.Source: §5.1 · p. 10

5.2 Architecture

  • The four-module preprocessing pipeline produces an exploitation plan for wintermute’s ReAct loop, with automated enumeration, ATT&CK category mapping, strategy ranking, and verifiable-step decomposition.StrategySelector pivots to the next candidate after execution failure.Source: §5.2 · p. 10, Figure 6 · p. 10

5.2.1 PrivEnum.

  • PrivEnum uses one deterministic, LLM-free shell script after foothold to gather taxonomy-aligned evidence, consolidating otherwise many unfocused enumeration steps.The collected evidence includes SUID/SGID binaries, sudo rules, Linux capabilities, and cron entries.Source: §5.2.1 · p. 10

5.2.2 CategoryMatcher.

  • CategoryMatcher maps enumeration output to likely ATT&CK categories using exact-match rules first and an LLM-assisted reasoner for ambiguous or uncovered cases.It emits ranked candidate exploitation strategies; StepPlanner decomposes chained exploits into verifiable steps with rollback on failure and skips single-step exploits.Source: §5.2.2 · p. 10, §5.2.3 · p. 10

5.2.4 StrategySelector.

  • StrategySelector ranks candidate strategies using category confidence weighted by per-category success-rate priors, then pivots after failure without restarting the episode.This targets strategy fixation and reduces steps spent on incorrect strategies.Source: §5.2.4 · p. 10

5.3 Effectiveness

  • PrivEscAgent is the top-SR framework for all six models, with gains over wintermute ranging from +13.7 pp for GPT-5.4 to +34.3 pp for Claude Sonnet 4.6.Qwen-Plus rises from 10.2% SR under wintermute to 39.5% with PrivEscAgent; gains concentrate in sudo, capabilities, and credentials, while SUID/SGID improvements are more model-dependent.Source: §5.3 · p. 11, Table 10 · p. 11

5.4 Cost and Strategy Compliance

  • PrivEscAgent lowers per-success cost versus HackSynth for all six models and versus wintermute for five, while strategy-hint use remains model-dependent.DeepSeek v3.2 is the exception to the cost reduction versus wintermute; Qwen-Plus succeeds on scenarios where GPT-5.4 and Claude Sonnet 4.6 fail despite identical hints.Source: §5.4 · p. 11, Table 11 · p. 11

5.5 Ablation Study

  • Removing PrivEnum causes the largest SR drop for five non-reasoning models, while StepPlanner and category-guided components have model-dependent effects.StepPlanner removal reduces Claude Sonnet 4.6 by 7.5 pp and Qwen-Plus by 11.4 pp; it or both CM and SP removed improves GPT-5.4 aggregate SR, though overlap analysis shows success-set exchanges.Source: §5.5 · pp. 11–12, Table 12 · p. 12, Figure 7 · p. 12

6 Discussion

Discussion findings identify persistent capability gaps, derive defensive measures from measured attack patterns, and delimit the benchmark’s coverage and statistical scope.

6.1 Adversarial Capability Limits

  • Of 531 scenarios, 61 (11.5%) remain unsolved across all evaluated configurations, chiefly due to controlling-TTY requirements and multi-step credential workflows.These account for 31 (51%) and 24 (39%) cases, respectively; SUID/SGID makes up 61% of the final unsolved set.Source: §6.1 · p. 12

6.2 Defensive Recommendations

  • Defensive priorities include hardening high-risk sudo, SUID/SGID, and capability configurations, alongside behavioral detection, mandatory access control, recurring scans, and audits.Configuration rotation alone is incomplete because some models retain success under environmental perturbation.Source: §6.2 · p. 12

6.3 Limitations

  • The study’s scope is shaped by taxonomy exclusions, source-driven category imbalance, mostly single-run evaluations, and a 20-step cap that may understate longer-chain cases.The comparisons are designed for relative LLM-agent evaluation, not human-agent comparison; frameworks with opaque or non-configurable control loops are left to future extensions.Source: §6.3 · pp. 12–13

7 Related Work

Prior LLM offensive agents and security benchmarks offer varied task settings, but systematic, reproducible Linux privilege-escalation evaluation remains limited. PrivEscalate addresses this gap with broad Dockerized coverage and a construction pipeline aimed at large-scale scenario materialization.

7.1 LLM Agents for Offensive Security

  • Prior offensive-security agents span workflow-oriented multi-stage penetration testing and capability-oriented execution of specific attack primitives, but evaluations remain restricted or inconsistent.ChainReactor uses classical planning but requires manual action and CVE-predicate encoding, limiting scalability across distributions and exploit families.Source: §7.1 · p. 13

7.2 Security Benchmarks for LLM Evaluation

  • HackingBuddyGPT’s 13 scenarios were insufficient for statistically meaningful cross-model or perturbation-sensitivity analysis; PrivEscalate provides 531 audited Dockerized scenarios across 14 ATT&CK-mapped sub-categories.Source: §7.2 · p. 13

7.3 Exploit Environment Construction

  • Existing environment-construction pipelines do not address large-scale Linux privilege escalation’s combined needs for dependency installation, vulnerable-versus-patched verification, and systematic ATT&CK coverage.PrivEscalate and PrivEscAgent are designed to fill this gap.Source: §7.3 · pp. 13–14

8 Conclusion

The conclusion presents PrivEscalate as a testbed and reports that measured escalation capability depends jointly on model, environment, and agent architecture. It also describes an open artifact release containing the benchmark materials and evaluation components.

8 Conclusion

  • Model, environment, and agent architecture jointly shape measured escalation capability, and PrivEscAgent raises success for all six evaluated models without altering their LLMs.Models differ in their strongest vulnerability classes, environmental changes degrade most models on clean-scenario successes, and agent framework can be as consequential as the model.Source: §8 · p. 14

A Open Science

  • The artifact release contains 531 audited Docker scenarios, 329 variants, the construction pipeline, evaluation adapters, manifests, prompts, and environment specifications.Source: A Open Science · p. 16

B Ethical Considerations

The authors describe dual-use risks and safeguards for PrivEscalate, including isolated execution and responsible-use guidance.

Ethical Considerations

  • All experiments run in isolated, ephemeral Docker containers without external network access or sensitive data, and the authors verified no evaluated vulnerability class enables container escape under their configuration.The SSH interface is bound to localhost.Source: B Ethical Considerations · p. 16
  • The benchmark consolidates publicly documented techniques and discloses no novel vulnerabilities or zero-days.The authors state that publishing results and agent architectures could inform adversarial use.Source: B Ethical Considerations · p. 16
  • The authors frame transparent measurement as supporting informed defense, map measured risks to hardening directions, and ask users to restrict use to defensive research, education, and authorized testing.They also ask users to follow responsible disclosure practices.Source: B Ethical Considerations · p. 16

C Datasheet for PrivEscalate

PrivEscalate comprises Docker-based Linux privilege-escalation scenarios and variants, with construction verification and expert review, and is intended for research, defense, education, and training.

Composition

  • The dataset contains 860 instances: 531 audited original scenarios and 329 variants across all 14 taxonomy sub-categories.The originals include 523 audit-retained, 2 weak-permissions, and 6 expert-authored scenarios.Source: C Datasheet for PrivEscalate · p. 16

Composition; Collection Process

  • Each instance is a Docker-based Linux system with one injected privilege-escalation vulnerability, a low-privilege account, and a ground-truth exploit script.Construction combines vulnerability discovery, reference-guided LLM Dockerfile generation, and build, exploit-differential, and consistency checks; every scenario received expert review.Source: C Datasheet for PrivEscalate · p. 16

Uses; Distribution and Maintenance

  • The dataset supports agent-architecture comparison, defense evaluation, security education, and reinforcement-learning training, with open-source release and community contributions planned.The authors maintain it, and its template-based architecture supports extensions through the same format and verification pipeline.Source: C Datasheet for PrivEscalate · p. 16

D Excluded Sub-techniques and Rationale

The paper distinguishes excluded ATT&CK sub-techniques from retained taxonomy entries and catalogs benchmark exploitation patterns by their trigger conditions and exploit chains.

D Excluded Sub-techniques and Rationale

E Per-Category Exploitation Patterns

  • SUID/SGID and sudo weaknesses exploit elevated binaries or permissive command grants, while capabilities, polkit, and D-Bus expose privileged operations to low-privilege users.The patterns include shell escapes, privileged file operations, capability use, authorized privileged actions, or unverified privileged service methods.Source: E Per-Category Exploitation Patterns · pp. 16–17
  • World-writable /etc/passwd or /etc/shadow can be altered to enable root authentication, relying on PAM’s nullok option on the stock distribution.Source: E Per-Category Exploitation Patterns · p. 17
  • Writable directories earlier in PATH can substitute attacker-controlled utilities, while preserved LD_PRELOAD can load an attacker-supplied library into a privileged process.The library constructor runs as root and spawns a shell.Source: E Per-Category Exploitation Patterns · p. 17
  • Writable root-owned cron scripts or systemd units allow attacker-controlled actions at the next scheduled execution or service activation.The service unit must be loaded and executed by root; the cron pattern typically grants root ownership to an interactive shell.Source: E Per-Category Exploitation Patterns · p. 17
  • Database credential reuse and accessible plaintext secrets let attackers recover credentials and authenticate as a privileged local account.Credentials may be found in database configuration, environment variables, shell history, or application configuration files.Source: E Per-Category Exploitation Patterns · p. 17
  • Over-broad container-runtime access can enable host-root escape, while a writable privileged account’s authorized_keys file allows key-based access.The Docker pattern launches a privileged auxiliary container mounting the host filesystem; the SSH pattern appends the attacker’s public key.Source: E Per-Category Exploitation Patterns · p. 17

F Backward Compatibility with hackingBuddyGPT

On the 13 overlapping hackingBuddyGPT scenarios, PrivEscalate reports model success rates and compares them with prior work. The results provide a compatibility check against legacy manually crafted scenarios.

Backward Compatibility with hackingBuddyGPT

G Expert Extension for Frontier Categories

The appendix supplements automated benchmark construction with eight expert-authored scenarios for pipeline gaps and records construction diagnostics, AI-use disclosures, and released prompt locations.

G Expert Extension for Frontier Categories

  • Eight expert-authored scenarios address six categories with no pipeline-verified outputs and two scenarios for weak-permission credential files absent from source indexes.All six generation-gap scenarios pass build and differential checks; the two credential-file scenarios replace audit-removed pipeline outputs.Source: G Expert Extension for Frontier… · p. 17

H Construction Pipeline Details

  • 296 Exploit-DB templates remain after four filters; GTFOBins passes through as 771 binary-to-exploit templates.The filters reduce 527 raw entries to 499 unique, 304 after keyword filtering, 303 Docker-feasible entries, and 296 after manual review. Verification requires a successful build, root acquisition on the vulnerable image, and blocking the same path on the fixed image.Source: H Construction Pipeline Details · p. 17

I Generative AI Usage Declaration

  • LLMs assist benchmark artifact generation and manuscript/code work, with generated artifacts triple-verified and writing and code edits reviewed by the authors.The authors also state that code was tested and that they take responsibility for the final work's accuracy and integrity.Source: I Generative AI Usage Declaration · pp. 17–18

J System Prompts

  • The complete construction-pipeline and PrivEscAgent prompts are released in the artifact under privescgen/prompts/ and privescagent/.Source: J System Prompts · p. 18
Loading 2609.09087v1…