I am aware of a number of good linux priv escalation scripts out there which i use for my hacking ( legal only, mainly practice for my OSCP ). I like Linux Priv Escalation Scripts . My prefered one uptil now has been "LinuxPrivChecker"

The script is great except that for suggesting applicable kernel exploits it relies on its own database which is barely updated and comprises of only 50 exploits. Also the script uses kernel, mount & process information to suggest exploits.

os = sysInfo["OS"]["results"][0]
version = sysInfo["KERNEL"]["results"][0].split(" ")[2].split("-")[0]
langs = devTools["TOOLS"]["results"]
procs = getAppProc["PROCS"]["results"]
kernel = str(sysInfo["KERNEL"]["results"][0])
mount = driveInfo["MOUNT"]["results"]

One notable thing is that it does not use installed package version to suggest exploits as the author notes.

#pkgs = getAppProc["PKGS"]["results"] # currently not using packages for sploit appicability but my in future

Not nitpicking because its a great work by the author but I would like to know if there are existing efforts that

i) have a larger database of exploits ( maybe crawl exploitdb to provide suggestions)

ii) take into consideration installed package versions while suggesting exploits

I have frequently missed out because of not being able to sieve through the installed package versions for detecting a exploit. I would like to fix it for the future.

  • Seems to be very close to this q&a -- security.stackexchange.com/a/101719/140
    – atdre
    Commented May 13, 2016 at 5:53
  • 1
    For general, local privilege escalation, I've always found unix-privesc-check to be pretty comprehensive on the misconfigurations side of things. That said, I might be biased, as I work with the guy who wrote it.
    – Polynomial
    Commented May 13, 2016 at 8:59


You must log in to answer this question.

Browse other questions tagged .