I am aware of a number of good linux priv escalation scripts out there which i use for my hacking ( legal only, mainly practice for my OSCP ). I like Linux Priv Escalation Scripts . My prefered one uptil now has been "LinuxPrivChecker"

The script is great except that for suggesting applicable kernel exploits it relies on its own database which is barely updated and comprises of only 50 exploits. Also the script uses kernel, mount & process information to suggest exploits.

os = sysInfo["OS"]["results"][0]
version = sysInfo["KERNEL"]["results"][0].split(" ")[2].split("-")[0]
langs = devTools["TOOLS"]["results"]
procs = getAppProc["PROCS"]["results"]
kernel = str(sysInfo["KERNEL"]["results"][0])
mount = driveInfo["MOUNT"]["results"]

One notable thing is that it does not use installed package version to suggest exploits as the author notes.

#pkgs = getAppProc["PKGS"]["results"] # currently not using packages for sploit appicability but my in future

Not nitpicking because its a great work by the author but I would like to know if there are existing efforts that

i) have a larger database of exploits ( maybe crawl exploitdb to provide suggestions)

ii) take into consideration installed package versions while suggesting exploits

I have frequently missed out because of not being able to sieve through the installed package versions for detecting a exploit. I would like to fix it for the future.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.