unix-privesc-check – Unix/Linux User Privilege Escalation Scanner

Use Netsparker


Unix-privesc-checker is a Unix/Linux User privilege escalation scanner that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2). It tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases).

It’s similar in some ways to – LinEnum – Linux Enumeration & Privilege Escalation Tool.

unix-privesc-check - Unix/Linux User Privilege Escalation Scanner

It is written as a single shell script so it can be easily uploaded and run (as opposed to un-tarred, compiled and installed). It can run either as a normal user or as root (obviously it does a better job when running as root because it can read more files).

unix-privesc-check is intended to be run by security auditors and penetration testers against systems they have been engaged to assess, and also by system administrators who want to check for “obvious” misconfiguration. It can even be run as a cron job so you can check regularly for misconfiguration that might be introduced.


The author wanted to write something that was at least partially useful to penetration testers when they gained access to a low-privilege account and wanted to escalate privileges. There are lots of things that pen-testers will check in this situation and one of the most tedious to check is weak file permissions – this of often one of the most fruitful, though, so there’s no avoiding it.

Checks Performed

  • Writable Home Directories
  • Readable /etc/shadow
  • Weak Permissions On Cron Jobs
  • Writable Configuration Files
  • Writable Device Files
  • Readable Files In Home Directories
  • Running Processes Correspond To Writable Programs
  • sudo Configuration
  • Accounts with no Password

You can download v2.1 here:

master.zip

Or read more here.

Posted in: Linux Hacking, Security Software


Latest Posts:


Acunetix Vulnerability Scanner For Linux Now Available Acunetix Vulnerability Scanner For Linux Now Available
Acunetix Vulnerability Scanner For Linux is now available, now you get all of the functionality of Acunetix, with all of the dependability of Linux.
Gerix WiFi Cracker - Wireless 802.11 Hacking Tool With GUI Gerix WiFi Cracker – Wireless 802.11 Hacking Tool With GUI
Gerix WiFi cracker is an easy to use Wireless 802.11 Hacking Tool with a GUI, it was originally made to run on BackTrack and this version has been updated for Kali (2018.1).
Malcom - Malware Communication Analyzer Malcom – Malware Communication Analyzer
Malcom is a Malware Communication Analyzer designed to analyze a system's network communication using graphical representations of network traffic.
WepAttack - WLAN 802.11 WEP Key Hacking Tool WepAttack – WLAN 802.11 WEP Key Hacking Tool
WepAttack is a WLAN open source Linux WEP key hacking tool for breaking 802.11 WEP keys using a wordlist based dictionary attack.
Eraser - Windows Secure Erase Hard Drive Wiper Eraser – Windows Secure Erase Hard Drive Wiper
Eraser is a hard drive wiper for Windows which allows you to run a secure erase and completely remove sensitive data from your hard drive by overwriting it several times with carefully selected patterns.
Insecure software versions are a problem Web Security Stats Show XSS & Outdated Software Are Major Problems
Netsparker just published some anonymized Web Security Stats about the security vulnerabilities their online solution identified on their users’ web applications and web services during the last 3 years.


3 Responses to unix-privesc-check – Unix/Linux User Privilege Escalation Scanner

  1. Doug Royer June 23, 2015 at 6:52 am #

    It looks good. It incorrectly reports sym links as allowing world read/write access to the file it points to.

  2. Really June 24, 2015 at 4:42 am #

    Dude, this is like 7.5 yrs old already!
    Really?

    • Darknet June 27, 2015 at 2:14 am #

      Yah because Linux architecture and file permissions have fundamentally changed in the past 7.5 years…

      Oh wait..