← retour aux outils back to tools

# unix-privesc-check

Script shell qui vérifie les mauvaises configurations courantes de privilege escalation sur Unix/Linux. Couvre les binaires SUID, les règles sudo, les tâches cron, les chemins accessibles en écriture et les configurations de services. Shell script that checks for common Unix/Linux privilege escalation misconfigurations. Covers SUID binaries, sudo rules, cron jobs, writable paths, and service configurations.

↗ https://pentestmonkey.net/tools/unix-privesc-check

## Overview

unix-privesc-check is a shell script (works on any Unix with /bin/sh) that audits a system for common privilege escalation misconfigurations. It’s a lightweight alternative to linpeas when you need something that works on minimal systems without curl or wget.

## Basic Usage

    # Download
    wget https://pentestmonkey.net/tools/unix-privesc-check/unix-privesc-check-1.4.tar.gz
    tar -xzf unix-privesc-check-1.4.tar.gz

Standard mode (less verbose)

    ./unix-privesc-check standard

Detailed mode (full output)

    ./unix-privesc-check detailed

Save output

    ./unix-privesc-check standard 2>&1 | tee output.txt

## What It Checks

    SUID/SGID Binaries:
      - Writable SUID binaries (immediate exploit)
      - SUID binaries in unusual locations
      - SGID writable binaries

    Sudo Configuration:
      - NOPASSWD sudo rules
      - Sudo rules for shells or dangerous commands
      - World-readable sudoers file

    Cron Jobs:
      - Root cron jobs with writable scripts
      - Cron scripts in world-writable directories
      - Cron PATH manipulation opportunities

    File Permissions:
      - World-writable sensitive files (/etc/passwd, /etc/shadow)
      - World-readable /etc/shadow
      - Writable /etc/cron.* directories

    Service Configurations:
      - NFS exports with no_root_squash
      - Writable config files for running services
      - Weak MySQL credentials
      - Writable PHP configuration

    Network:
      - Open ports on localhost
      - Services running as root

## Reading the Output

Look for “WARNING” lines — these are exploitable findings

    ./unix-privesc-check standard 2>&1 | grep -i "WARNING"

    # Example warnings:
    # WARNING: /usr/local/sbin/backup is SUID and writable by group admin
    # WARNING: /etc/cron.daily/cleanup is writable by non-root
    # WARNING: sudo NOPASSWD for /usr/bin/vim

    # "OK" means the check passed (not a finding)
    # "WARNING" means a potential vulnerability

## Comparison with linpeas

    unix-privesc-check:
      + Works on minimal systems (pure shell)
      + Very portable — runs anywhere with /bin/sh
      + Clear WARNING/OK output
      - Less comprehensive than linpeas
      - No color output

    linpeas:
      + Much more comprehensive
      + Color-coded by severity
      + Regularly updated
      - Requires more resources
      - Can trigger AV/EDR

## Tips

- Use when you can’t transfer linpeas — this works on almost any Unix system
- The “detailed” mode shows everything; “standard” shows only problems
- Combine with linpeas for comprehensive coverage on modern systems
- Focus on SUID+writable and sudo NOPASSWD findings first — these are directly exploitable

Help / Man page

    unix-privesc-check <mode>

    mode:
      standard    Less verbose, shows only warnings and some info
      detailed    Full verbose output of all checks

    Output:
      OK       Check passed (no vulnerability)
      WARNING  Potential privilege escalation vulnerability found
      INFO     Informational finding (may or may not be relevant)

## Vue d’ensemble

unix-privesc-check est un script shell (fonctionne sur tout Unix disposant de /bin/sh) qui audite un système à la recherche de mauvaises configurations courantes de privilege escalation. C’est une alternative légère à linpeas quand vous avez besoin de quelque chose qui fonctionne sur des systèmes minimalistes sans curl ni wget.

## Utilisation de base

    # Télécharger
    wget https://pentestmonkey.net/tools/unix-privesc-check/unix-privesc-check-1.4.tar.gz
    tar -xzf unix-privesc-check-1.4.tar.gz

    # Mode standard (moins verbeux)
    ./unix-privesc-check standard

    # Mode détaillé (sortie complète)
    ./unix-privesc-check detailed

    # Sauvegarder la sortie
    ./unix-privesc-check standard 2>&1 | tee output.txt

## Ce qu’il vérifie

    SUID/SGID Binaries:
      - Writable SUID binaries (immediate exploit)
      - SUID binaries in unusual locations
      - SGID writable binaries

    Sudo Configuration:
      - NOPASSWD sudo rules
      - Sudo rules for shells or dangerous commands
      - World-readable sudoers file

    Cron Jobs:
      - Root cron jobs with writable scripts
      - Cron scripts in world-writable directories
      - Cron PATH manipulation opportunities

    File Permissions:
      - World-writable sensitive files (/etc/passwd, /etc/shadow)
      - World-readable /etc/shadow
      - Writable /etc/cron.* directories

    Service Configurations:
      - NFS exports with no_root_squash
      - Writable config files for running services
      - Weak MySQL credentials
      - Writable PHP configuration

    Network:
      - Open ports on localhost
      - Services running as root

## Lecture de la sortie

Chercher les lignes “WARNING” : ce sont les findings exploitables

    ./unix-privesc-check standard 2>&1 | grep -i "WARNING"

    # Exemples de warnings :
    # WARNING: /usr/local/sbin/backup is SUID and writable by group admin
    # WARNING: /etc/cron.daily/cleanup is writable by non-root
    # WARNING: sudo NOPASSWD for /usr/bin/vim

    # "OK" signifie que la vérification est passée (pas de finding)
    # "WARNING" signifie une vulnérabilité potentielle

## Comparaison avec linpeas

    unix-privesc-check:
      + Fonctionne sur des systèmes minimalistes (shell pur)
      + Très portable : fonctionne partout où /bin/sh est disponible
      + Sortie WARNING/OK claire
      - Moins complet que linpeas
      - Pas de sortie en couleur

    linpeas:
      + Beaucoup plus complet
      + Codé par couleur selon la sévérité
      + Régulièrement mis à jour
      - Nécessite plus de ressources
      - Peut déclencher AV/EDR

## Conseils

- À utiliser quand vous ne pouvez pas transférer linpeas : celui-ci fonctionne sur presque tout système Unix
- Le mode “detailed” affiche tout ; “standard” ne montre que les problèmes
- Combiner avec linpeas pour une couverture complète sur les systèmes modernes
- Se concentrer d’abord sur les findings SUID+writable et sudo NOPASSWD : ils sont directement exploitables

Aide / Page de manuel

    unix-privesc-check <mode>

    mode:
      standard    Less verbose, shows only warnings and some info
      detailed    Full verbose output of all checks

    Output:
      OK       Check passed (no vulnerability)
      WARNING  Potential privilege escalation vulnerability found
      INFO     Informational finding (may or may not be relevant)