unix-privesc-check – Unix/Linux User Privilege Escalation Scanner

Unix-privesc-checker is a Unix/Linux User privilege escalation scanner that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2). It tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases).

It’s similar in some ways to – LinEnum – Linux Enumeration & Privilege Escalation Tool.

It is written as a single shell script so it can be easily uploaded and run (as opposed to un-tarred, compiled and installed). It can run either as a normal user or as root (obviously it does a better job when running as root because it can read more files).

unix-privesc-check is intended to be run by security auditors and penetration testers against systems they have been engaged to assess, and also by system administrators who want to check for “obvious” misconfiguration. It can even be run as a cron job so you can check regularly for misconfiguration that might be introduced.

The author wanted to write something that was at least partially useful to penetration testers when they gained access to a low-privilege account and wanted to escalate privileges. There are lots of things that pen-testers will check in this situation and one of the most tedious to check is weak file permissions – this of often one of the most fruitful, though, so there’s no avoiding it.

Checks Performed

• Writable Home Directories
• Readable /etc/shadow
• Weak Permissions On Cron Jobs
• Writable Configuration Files
• Writable Device Files
• Readable Files In Home Directories
• Running Processes Correspond To Writable Programs
• sudo Configuration
• Accounts with no Password

You can download v2.1 here:

master.zip

Or read more here.