Linux exploit suggester manual#
Linux exploit suggester Patch#
Linux exploit suggester code#

linux-exploit-suggester.sh –uname “Linux taris 3.16.0-30-generic #40~14.04.1-Ubuntu SMP Thu Jan 15 17:43: x86_64 x86_64 x86_64 GNU/Linux”Īs previously but additionally package listing from a remote machine is provided for identifying possible priv esc vectors via installed packages (in terms of output its identical with executing. Kernel version and architecture (x86, x86_64) is taken into account when generating a list of applicable exploits: Uname -a string from a remote machine is provided. linux-exploit-suggester.sh -k 3.1 –fetch-sources

Kernel version number is taken from the command line (compatibility mode with Linux_Exploit_Suggester) additionally sources for applicable exploits are downloaded to the current directory: linux-exploit-suggester.sh –userspace-only Kernel version and package listing are taken directly from the current machine:Īs previously but only userspace exploits are displayed:

Identifying privilege escalation vectors via installed userspace programs should be treated as experimental feature for now.

Selected exploit almost certainly will need some customization to suit your target (at minimum: correct commit_creds/prepare_kernel_cred pointers) so knowledge about kernel exploitation techniques is needed.

Linux exploit suggester manual#

In addition to manual inspection, Oracle’s Ksplice Inspector could come handy with determining the previous one.

Linux exploit suggester Patch#

That’s the analyst job to determine whether given target at hand isn’t patched against generated list of candidate exploits (the script doesn’t look at distro patch level so obviously it won’t do that for you).

Remember that this script is only meant to assist the analyst in his auditing activities.

linux-exploit-suggester.sh is written in bash as opposed to Linux_Exploit_Suggester which was coded in Perl.

linux-exploit-suggester.sh has some additional minor features like -fetch-sources and -fetch-binaries.

Linux exploit suggester code#

exploits from Linux_Exploit_Suggester which have no download link (like elfcd, kdump, local26, ong_bak, pwned, py2, etc.) were dropped from linux-exploit-suggester.sh because there’s no point in keeping exploits with no source code available (if you have access to source code for these exploits please let me know).exploits that are applicable solely for kernels 2.4.x were dropped from linux-exploit-suggester.sh – I believe that 2.4 kernels are so rare these days that there’s no point in keeping them (if you don’t agree and you work with this kernel line regularly during your pen testing engagements please let me know).It uses the same exploits names, it supports -k flag and it has very similar output linux-exploit-suggester.sh tries to be as compatible with Linux_Exploit_Suggester as possible.You are more than welcome to send me the info on which distro you have successfully run particular exploit to make exploit tagging more complete and more accurate Tags comes from three main sources: exploit authors (they often indicate in exploit’s source on which distro they have developed/run/tested the exploit) from and from my own testing. This is an additional tip which is supposed to make chosing the right exploit for the target at hand easier and quicker. In linux-exploit-suggester.sh many exploits were tagged with the distribution name on which they have successfully run.On debian-based & redhat-based distros linux-exploit-suggester.sh checks for privilege escalation vectors also via installed userspace packages by parsing 'dpkg -l'/'rpm -qa' output and comparing it to contained list of publicly known privilege escalation exploits.linux-exploit-suggester.sh aims to contain list of all publicly known Linux kernel exploits applicable for kernels 2.6 and up.

Here’s the comparison between the linux-exploit-suggester.sh and Linux_Exploit_Suggester scripts:

assisting security analyst in identifying local priv esc attack vectors on target Linux machine.

maintaining an up-to-date list of Linux privilege escalation exploits and essential info about it.

It is also capable to identify possible privilege escalation vectors via installed userspace packages and comes with some additional minor features that make finding right exploit more time efficient. linux-exploit-suggester.sh on the other hand also contains all the latest (as of early 2017) publicly known Linux kernel exploits. The issue with Pentura’s script, however, is that it isn’t up to date anymore (the script was last updated in early 2014) so it lacks some recent Linux kernel exploits. Linux exploit suggester.sh was inspired by the excellent Linux_Exploit_Suggester script by PenturaLabs.