unix-privesc-check – Unix/Linux User Privilege Escalation Scanner

Outsmart Malicious Hackers

Unix-privesc-checker is a Unix/Linux User privilege escalation scanner that runs on Unix systems (tested on Solaris 9, HPUX 11, Various Linuxes, FreeBSD 6.2). It tries to find misconfigurations that could allow local unprivileged users to escalate privileges to other users or to access local apps (e.g. databases).

It’s similar in some ways to – LinEnum – Linux Enumeration & Privilege Escalation Tool.

unix-privesc-check - Unix/Linux User Privilege Escalation Scanner

It is written as a single shell script so it can be easily uploaded and run (as opposed to un-tarred, compiled and installed). It can run either as a normal user or as root (obviously it does a better job when running as root because it can read more files).

unix-privesc-check is intended to be run by security auditors and penetration testers against systems they have been engaged to assess, and also by system administrators who want to check for “obvious” misconfiguration. It can even be run as a cron job so you can check regularly for misconfiguration that might be introduced.

The author wanted to write something that was at least partially useful to penetration testers when they gained access to a low-privilege account and wanted to escalate privileges. There are lots of things that pen-testers will check in this situation and one of the most tedious to check is weak file permissions – this of often one of the most fruitful, though, so there’s no avoiding it.

Checks Performed

  • Writable Home Directories
  • Readable /etc/shadow
  • Weak Permissions On Cron Jobs
  • Writable Configuration Files
  • Writable Device Files
  • Readable Files In Home Directories
  • Running Processes Correspond To Writable Programs
  • sudo Configuration
  • Accounts with no Password

You can download v2.1 here:


Or read more here.

Posted in: Linux Hacking, Security Software

, , , , , , , , , ,

Recent in Linux Hacking:
- BEURK – Linux Userland Preload Rootkit
- Linux kernel.org Hacker Arrested After Traffic Stop
- wildpwn – UNIX Wildcard Attack Tool

Related Posts:

Most Read in Linux Hacking:
- Kon-Boot – Reset Windows & Linux Passwords - 142,039 views
- Russix – LiveCD Linux Distro for Wireless Penetration Testing & WEP Cracking - 127,418 views
- BackTrack v2.0 – Hackers LiveCD Finally Released - 101,706 views

3 Responses to unix-privesc-check – Unix/Linux User Privilege Escalation Scanner

  1. Doug Royer June 23, 2015 at 6:52 am #

    It looks good. It incorrectly reports sym links as allowing world read/write access to the file it points to.

  2. Really June 24, 2015 at 4:42 am #

    Dude, this is like 7.5 yrs old already!

    • Darknet June 27, 2015 at 2:14 am #

      Yah because Linux architecture and file permissions have fundamentally changed in the past 7.5 years…

      Oh wait..