unix-privesc-check – Unix/Linux User Privilege Escalation Scanner


Unix-privesc-checker is a Unix/Linux User privilege escalation scanner that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2). It tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases).

It’s similar in some ways to – LinEnum – Linux Enumeration & Privilege Escalation Tool.

unix-privesc-check - Unix/Linux User Privilege Escalation Scanner

It is written as a single shell script so it can be easily uploaded and run (as opposed to un-tarred, compiled and installed). It can run either as a normal user or as root (obviously it does a better job when running as root because it can read more files).

unix-privesc-check is intended to be run by security auditors and penetration testers against systems they have been engaged to assess, and also by system administrators who want to check for “obvious” misconfiguration. It can even be run as a cron job so you can check regularly for misconfiguration that might be introduced.


The author wanted to write something that was at least partially useful to penetration testers when they gained access to a low-privilege account and wanted to escalate privileges. There are lots of things that pen-testers will check in this situation and one of the most tedious to check is weak file permissions – this of often one of the most fruitful, though, so there’s no avoiding it.

Checks Performed

  • Writable Home Directories
  • Readable /etc/shadow
  • Weak Permissions On Cron Jobs
  • Writable Configuration Files
  • Writable Device Files
  • Readable Files In Home Directories
  • Running Processes Correspond To Writable Programs
  • sudo Configuration
  • Accounts with no Password

You can download v2.1 here:

master.zip

Or read more here.

Posted in: Linux Hacking, Security Software


Latest Posts:


GitLab Watchman - Audit Gitlab For Sensitive Data & Credentials GitLab Watchman – Audit Gitlab For Sensitive Data & Credentials
GitLab Watchman is an app that uses the GitLab API to audit GitLab for sensitive data and credentials exposed internally, this includes code, commits, wikis etc
GKE Auditor - Detect Google Kubernetes Engine Misconfigurations GKE Auditor – Detect Google Kubernetes Engine Misconfigurations
GKE Auditor is a Java-based tool to detect Google Kubernetes Engine misconfigurations, it aims to help security & dev teams streamline the configuration process
zANTI - Android Wireless Hacking Tool Free Download zANTI – Android Wireless Hacking Tool Free Download
zANTI is an Android Wireless Hacking Tool that functions as a mobile penetration testing toolkit that lets you assess the risk level of a network using mobile.
HELK - Open Source Threat Hunting Platform HELK – Open Source Threat Hunting Platform
The Hunting ELK or simply the HELK is an Open-Source Threat Hunting Platform with advanced analytics capabilities such as SQL declarative language, graphing etc
trape - OSINT Analysis Tool For People Tracking Trape – OSINT Analysis Tool For People Tracking
Trape is an OSINT analysis tool, which allows people to track and execute intelligent social engineering attacks in real-time.
Fuzzilli - JavaScript Engine Fuzzing Library Fuzzilli – JavaScript Engine Fuzzing Library
Fuzzilii is a JavaScript engine fuzzing library, it's a coverage-guided fuzzer for dynamic language interpreters based on a custom intermediate language.


3 Responses to unix-privesc-check – Unix/Linux User Privilege Escalation Scanner

  1. Doug Royer June 23, 2015 at 6:52 am #

    It looks good. It incorrectly reports sym links as allowing world read/write access to the file it points to.

  2. Really June 24, 2015 at 4:42 am #

    Dude, this is like 7.5 yrs old already!
    Really?

    • Darknet June 27, 2015 at 2:14 am #

      Yah because Linux architecture and file permissions have fundamentally changed in the past 7.5 years…

      Oh wait..