Skip to content

README.md

Latest commit

 

History

History
524 lines (389 loc) · 11.9 KB

README.md

File metadata and controls

524 lines (389 loc) · 11.9 KB
Raw

Privilege Escalation Analyzer v4.0

A comprehensive Linux privilege escalation assessment framework for authorized security testing and vulnerability research.

Overview

Privilege Escalation Analyzer is a professional security testing tool designed to identify and assess potential privilege escalation vulnerabilities in Linux systems. It performs deep system analysis, detects misconfigurations, and evaluates known CVE exploits.

Key Features

  • 35+ CVE Detection: Identifies known kernel vulnerabilities (2017-2025)
  • 24 Security Plugins: Modular exploit detection and analysis
  • Multi-Format Reporting: HTML, JSON, Markdown, and CSV reports
  • Ghost Mode: Anti-forensics and cleanup capabilities
  • Intelligent Analysis: Automatic vulnerability assessment and chaining
  • Cross-Platform Support: Linux, WSL, and compatible Unix systems

Installation

Prerequisites

# Required utilities
sudo apt-get install -y curl wget grep sed awk find

# Optional but recommended
sudo apt-get install -y gcc make python3 nikto

Setup

# Clone or download the tool
git clone https://github.com/medaminkh-dev/Privilege-Escalator.git
cd Privilege-Escalator

# Make executable
chmod +x privesc_analyzer.sh

# (Optional) Install globally
sudo cp privesc_analyzer.sh /usr/local/bin/Privilege-Escalator

Usage

Basic Execution

# Standard scan
./privesc_analyzer.sh

# With timeout (recommended)
timeout 60 ./privesc_analyzer.sh

# Verbose output
./privesc_analyzer.sh -v

Command Options

# Show help
./privesc_analyzer.sh -h

# Enable ghost mode (cleanup traces)
./privesc_analyzer.sh --ghost

# Custom report directory
./privesc_analyzer.sh --output /path/to/reports

# Quiet mode (minimal output)
./privesc_analyzer.sh -q

Output

The tool generates reports in multiple formats:

/tmp/.peu_reports_[TIMESTAMP]/
├── privesc_report_[TIMESTAMP].html      # Interactive HTML report
├── privesc_report_[TIMESTAMP].json      # Machine-readable JSON
├── privesc_report_[TIMESTAMP].md        # Markdown documentation
└── privesc_report_[TIMESTAMP].csv       # CSV data export

Understanding the Analysis

Scanning Phases

The analyzer performs 10 sequential assessment phases:

Phase Description
1 System Enumeration (OS, kernel, user context)
2 SUID/SGID Binary Analysis
3 Capability Analysis
4 Cron Job Enumeration
5 Writable File Detection
6 Service Configuration Review
7 Docker/Container Escape Assessment
8 Network Configuration Analysis
9 Credential Discovery
10 Report Generation

Vulnerability Categories

Critical (Immediate Action Required)

  • Kernel exploits with high success rates
  • Unsafe sudo configurations
  • World-writable SUID binaries

High (Priority)

  • Misconfigured capabilities
  • Insecure container configurations
  • Unencrypted credentials

Medium (Review)

  • Non-standard service permissions
  • Potential capability abuse
  • Credential storage issues

Low (Monitor)

  • Informational findings
  • Configuration notes
  • Best practice recommendations

CVE Detection

The analyzer identifies vulnerabilities including:

  • Kernel Exploits: CVE-2024-1086, CVE-2022-0492, CVE-2022-25636
  • Sudo Issues: CVE-2019-14287, CVE-2019-18634
  • eBPF/Netfilter: CVE-2022-0185, CVE-2017-16995
  • Container Escape: CVE-2019-13272, CVE-2017-1000112
  • Dirty COW: CVE-2016-5195
  • DirtyCow: CVE-2020-14386

Case Studies

Case Study 1: Misconfigured Sudo

Scenario: A system administrator grants sudo access without proper restrictions.

# Analysis Output
[+] CRITICAL: User 'kali' can run /bin/bash with NOPASSWD
    Impact: Full root privilege escalation
    Remediation: Remove NOPASSWD or restrict binaries

Exploitation Path:

sudo /bin/bash          # Instant root access

Prevention:

  • Use password requirement for sudo
  • Restrict allowed commands with sudoedit
  • Monitor sudo logs for unauthorized use

Case Study 2: SUID Binary Vulnerability

Scenario: A vulnerable SUID binary with known exploit.

# Analysis Output
[+] SUID Binary: /usr/bin/vulnerable_app (4755)
    Known CVE: CVE-2024-XXXXX
    Exploitation: Possible through race condition

Fix:

# Remove SUID bit or update application
sudo chmod u-s /usr/bin/vulnerable_app
# OR
sudo apt-get update && sudo apt-get upgrade vulnerable-app

Case Study 3: Writable System Files

Scenario: System files are world-writable, allowing modification.

# Analysis Output
[!] WRITABLE: /etc/ld.so.preload
    Risk: LD_PRELOAD privilege escalation
    Recommendation: chmod 644 /etc/ld.so.preload

Attack Chain:

  1. Write malicious library to writable path
  2. Set LD_PRELOAD to point to library
  3. Execute any system binary
  4. Gain root privileges via library functions

Mitigation:

# Proper permissions
sudo chmod 644 /etc/ld.so.preload
sudo chown root:root /etc/ld.so.preload

Case Study 4: Kernel CVE Exploitation

Scenario: System running outdated kernel with known exploits.

# Analysis Output
[+] CRITICAL: Kernel 5.10.0 vulnerable to CVE-2024-1086
    Type: eBPF Map Local Privilege Escalation
    Success Rate: High (95%)
    Remediation: Update kernel to 5.15.0 or later

Remediation Steps:

# Check current kernel
uname -r

# Update system
sudo apt-get update && sudo apt-get upgrade

# Optionally build new kernel
sudo apt-get install linux-image-generic linux-headers-generic

Case Study 5: Docker Escape

Scenario: User in docker group without proper restrictions.

# Analysis Output
[+] HIGH: User 'dev' in docker group
    Risk: Docker socket access allows container escape
    Impact: Full system compromise

Attack Vector:

docker run -v /:/rootfs -it alpine
# Mount root filesystem and modify /etc/passwd

Prevention:

# Remove user from docker group
sudo delgroup dev docker

# OR restrict docker socket
sudo chmod 660 /var/run/docker.sock
sudo chown root:docker /var/run/docker.sock

Report Interpretation

HTML Report

The HTML report provides an interactive dashboard with:

  • System overview and risk summary
  • Detailed vulnerability breakdown
  • Executive findings chart
  • Remediation recommendations

Access: Open in any web browser

firefox /tmp/.peu_reports_*/privesc_report_*.html

JSON Report

Machine-readable format for integration with other tools:

{
  "metadata": {
    "scan_time": "2026-02-03T20:04:40Z",
    "hostname": "kali",
    "kernel": "6.12.38+kali-amd64"
  },
  "findings": [
    {
      "severity": "CRITICAL",
      "type": "SUID_BINARY",
      "description": "Vulnerable SUID binary detected"
    }
  ]
}

CSV Report

For spreadsheet analysis and tracking:

Severity,Type,Description,Location,Remediation
CRITICAL,SUID_BINARY,Vulnerable binary,/usr/bin/app,Remove SUID bit
HIGH,SUDO_CONFIG,No password required,kali ALL=(ALL) NOPASSWD,Require password

Remediation Guide

Priority Matrix

┌─────────────────────────────────────┐
│    CRITICALITY vs DIFFICULTY        │
├─────────────────────────────────────┤
│ Quick Wins (High Impact/Easy)       │
│ - Fix sudo configurations           │
│ - Change file permissions           │
│                                     │
│ Strategic (High Impact/Hard)        │
│ - Kernel patching                   │
│ - Application updates               │
│                                     │
│ Low Priority (Low Impact/Easy)      │
│ - Documentation updates             │
│ - Monitoring improvements           │
└─────────────────────────────────────┘

Common Fixes

1. Fix Unsafe Sudo Configuration

# Remove NOPASSWD
sudo visudo  # Edit and remove NOPASSWD entries

# Restrict commands
# Instead of: kali ALL=(ALL) ALL
# Use: kali ALL=(ALL) /bin/ls, /bin/cat

2. Remove SUID from Unsafe Binaries

sudo find / -perm -4000 -type f 2>/dev/null | while read bin; do
    # Review each binary
    ls -la "$bin"
done

# Remove SUID if unnecessary
sudo chmod u-s /path/to/binary

3. Fix World-Writable System Files

# Find problematic permissions
find /etc /usr/bin /usr/sbin -perm -002 -type f 2>/dev/null

# Fix permissions
sudo chmod o-w /path/to/file

4. System Hardening

# Kernel parameter hardening (sysctl)
sudo sysctl kernel.unprivileged_userns_clone=0
sudo sysctl kernel.unprivileged_bpf_disabled=1

# Make permanent
echo "kernel.unprivileged_userns_clone=0" | sudo tee -a /etc/sysctl.conf

Disclaimer & Legal

Authorization Required

This tool is designed for authorized security testing only. Unauthorized access to computer systems is illegal.

Required Conditions:

  • ✅ Written authorization from system owner
  • ✅ Scope clearly defined
  • ✅ Testing performed on systems you own or have permission to test
  • ✅ All activities documented and reported

Prohibited Uses

  • ❌ Unauthorized system access
  • ❌ Privilege escalation without permission
  • ❌ Data theft or modification
  • ❌ Denial of service attacks
  • ❌ Reverse engineering without license

Liability

The authors and maintainers are NOT responsible for:

  • Misuse of this tool
  • Unauthorized system access
  • Data loss or corruption
  • Any legal consequences

Users assume all responsibility for their actions.

Troubleshooting

Script Hangs on Execution

Problem: Script appears to freeze during enumeration.

Solution:

# Use timeout to limit execution
timeout 60 ./privesc_analyzer.sh

# Or press Ctrl+C to interrupt

Permission Denied Errors

Problem: Script cannot read certain system files.

Solution:

# Run with elevated privileges
sudo ./privesc_analyzer.sh

# Note: Some findings require root access

Reports Not Generated

Problem: No report files created.

Solution:

# Check /tmp directory
ls -la /tmp/.peu_reports_*/

# Verify disk space
df -h /tmp

# Check script permissions
chmod +x privesc_analyzer.sh

Output Examples

Execution Summary

[+] Duration: 23s
[+] Plugins Loaded: 24
[+] Critical Findings: 42
[+] Total Findings: 168
[+] Vulnerabilities Found: 42
[+] Exploits Attempted: 0
[+] Exploits Successful: 0

System Information

[+] Operating System:
    Type                : linux
    Distribution        : Kali GNU/Linux
    Version             : 2025.3
    Kernel              : 6.12.38+kali-amd64
    Architecture        : x86_64

[+] User Context:
    Username            : kali
    UID/GID             : 1000/1000
    Groups              : kali,adm,dialout,sudo,...
    Home Directory      : /home/kali

Best Practices

For Security Teams

  • Schedule regular assessments
  • Track remediation progress
  • Establish baselines
  • Document all findings
  • Keep tool updated

For System Administrators

  • Run on test systems first
  • Review findings carefully
  • Create remediation plans
  • Implement fixes systematically
  • Verify fixes are effective

For Penetration Testers

  • Always obtain authorization
  • Keep detailed logs
  • Report findings professionally
  • Provide remediation guidance
  • Follow responsible disclosure

Contributing

Contributions are welcome! To contribute:

  1. Fork the repository
  2. Create a feature branch
  3. Submit a pull request with detailed description
  4. Ensure code follows project standards

License

MIT License - See LICENSE file for details

Authors

  • Security Research Team

⚠️ FOR AUTHORIZED SECURITY TESTING ONLY ⚠️

This tool is provided for defensive security assessment. Ensure you have explicit authorization before testing any systems.

Last Updated: February 3, 2026
Version: 4.0.0