Navigation



unix-privesc-check – Unix/Linux User Privilege Escalation Scanner

Last updated: September 9, 2015 | 7,494 views

Unix-privesc-checker is a Unix/Linux User privilege escalation scanner that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2). It tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases).

It’s similar in some ways to – LinEnum – Linux Enumeration & Privilege Escalation Tool.

unix-privesc-check - Unix/Linux User Privilege Escalation Scanner

It is written as a single shell script so it can be easily uploaded and run (as opposed to un-tarred, compiled and installed). It can run either as a normal user or as root (obviously it does a better job when running as root because it can read more files).

unix-privesc-check is intended to be run by security auditors and penetration testers against systems they have been engaged to assess, and also by system administrators who want to check for “obvious” misconfiguration. It can even be run as a cron job so you can check regularly for misconfiguration that might be introduced.


The author wanted to write something that was at least partially useful to penetration testers when they gained access to a low-privilege account and wanted to escalate privileges. There are lots of things that pen-testers will check in this situation and one of the most tedious to check is weak file permissions – this of often one of the most fruitful, though, so there’s no avoiding it.

Checks Performed

  • Writable Home Directories
  • Readable /etc/shadow
  • Weak Permissions On Cron Jobs
  • Writable Configuration Files
  • Writable Device Files
  • Readable Files In Home Directories
  • Running Processes Correspond To Writable Programs
  • sudo Configuration
  • Accounts with no Password

You can download v2.1 here:

master.zip

Or read more here.

Share62
Tweet95
Share42
Buffer
WhatsApp
Email
199 Shares
Posted in: Linux Hacking, Security Software


Latest Posts:


Karkinos - Beginner Friendly Penetration Testing Tool Karkinos – Beginner Friendly Penetration Testing Tool
Karkinos is a light-weight Beginner Friendly Penetration Testing Tool, which is basically a 'Swiss Army Knife' for pen-testing and/or hacking CTF's.
August 31, 2021 - 162 Shares
Aclpwn.Py - Exploit ACL Based Privilege Escalation Paths in Active Directory Aclpwn.Py – Exploit ACL Based Privilege Escalation Paths in Active Directory
Aclpwn.py is a tool that interacts with BloodHound< to identify and exploit ACL based privilege escalation paths.
July 7, 2021 - 148 Shares
Vulhub - Pre-Built Vulnerable Docker Environments For Learning To Hack Vulhub – Pre-Built Vulnerable Docker Environments For Learning To Hack
Vulhub is an open-source collection of pre-built vulnerable docker environments for learning to hack. No pre-existing knowledge of docker is required, just execute two simple commands.
May 27, 2021 - 266 Shares
LibInjection - Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) LibInjection – Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS)
LibInjection is a C library to Detect SQL Injection (SQLi) and Cross-Site Scripting (XSS) through lexical analysis of real-world Attacks.
May 7, 2021 - 140 Shares
Grype - Vulnerability Scanner For Container Images & Filesystems Grype – Vulnerability Scanner For Container Images & Filesystems
Grype is a vulnerability scanner for container images and filesystems with an easy to install binary that supports the packages for most major *nix based OS.
April 19, 2021 - 248 Shares
APT-Hunter - Threat Hunting Tool via Windows Event Log APT-Hunter – Threat Hunting Tool via Windows Event Log
APT-Hunter is a threat hunting tool for windows event logs made from the perspective of the purple team mindset to provide detection for APT movements hidden in the sea of windows event logs.
March 5, 2021 - 265 Shares


3 Responses to unix-privesc-check – Unix/Linux User Privilege Escalation Scanner

  1. Doug Royer June 23, 2015 at 6:52 am #

    It looks good. It incorrectly reports sym links as allowing world read/write access to the file it points to.

  2. Really June 24, 2015 at 4:42 am #

    Dude, this is like 7.5 yrs old already!
    Really?

    • Darknet June 27, 2015 at 2:14 am #

      Yah because Linux architecture and file permissions have fundamentally changed in the past 7.5 years…

      Oh wait..