# Got Root? A Linux Priv-Esc Benchmark

arXiv: https://arxiv.org/abs/2405.02106 · HTML: https://mlsanity.com/paper/2405.02106/

## Key facts

- Cited by 4 papers in the map (data through 14 Oct 2026).
- First posted on arXiv 3 May 2024.

## Built on by (most cited first, 4 of 4)

- [OCCULT: Evaluating Large Language Models for Offensive Cyber Operation Capabilities](https://mlsanity.com/paper/2502.15797/) (2025)
- [CritBench: A Framework for Evaluating Cybersecurity Capabilities of Large Language Models in IEC 61850 Digital Substation Environments](https://mlsanity.com/paper/2604.06019/) (2026)
- [Enhancing Linux Privilege Escalation Attack Capabilities of Local LLM Agents](https://mlsanity.com/paper/2604.27143/) (2026)
- [ATLAS: Discovering Agent Strategies through LLM-Guided Abstraction and Automata Learning](https://mlsanity.com/paper/2608.14352/) (2026)

## Abstract (arXiv)

Linux systems are integral to the infrastructure of modern computing environments, necessitating robust security measures to prevent unauthorized access. Privilege escalation attacks represent a significant threat, typically allowing attackers to elevate their privileges from an initial low-privilege account to the all-powerful root account. A benchmark set of vulnerable systems is of high importance to evaluate the effectiveness of privilege-escalation techniques performed by both humans and automated tooling. Analyzing their behavior allows defenders to better fortify their entrusted Linux systems and thus protect their infrastructure from potentially devastating attacks. To address this gap, we developed a comprehensive benchmark for Linux privilege escalation. It provides a standardized platform to evaluate and compare the performance of human and synthetic actors, e.g., hacking scripts or automated tooling.