unix-privesc-check

Overview

unix-privesc-check is a shell script (works on any Unix with /bin/sh) that audits a system for common privilege escalation misconfigurations. It’s a lightweight alternative to linpeas when you need something that works on minimal systems without curl or wget.

Basic Usage

# Download
wget https://pentestmonkey.net/tools/unix-privesc-check/unix-privesc-check-1.4.tar.gz
tar -xzf unix-privesc-check-1.4.tar.gz

Standard mode (less verbose)

./unix-privesc-check standard

Detailed mode (full output)

./unix-privesc-check detailed

Save output

./unix-privesc-check standard 2>&1 | tee output.txt

What It Checks

SUID/SGID Binaries:
  - Writable SUID binaries (immediate exploit)
  - SUID binaries in unusual locations
  - SGID writable binaries

Sudo Configuration:
  - NOPASSWD sudo rules
  - Sudo rules for shells or dangerous commands
  - World-readable sudoers file

Cron Jobs:
  - Root cron jobs with writable scripts
  - Cron scripts in world-writable directories
  - Cron PATH manipulation opportunities

File Permissions:
  - World-writable sensitive files (/etc/passwd, /etc/shadow)
  - World-readable /etc/shadow
  - Writable /etc/cron.* directories

Service Configurations:
  - NFS exports with no_root_squash
  - Writable config files for running services
  - Weak MySQL credentials
  - Writable PHP configuration

Network:
  - Open ports on localhost
  - Services running as root

Reading the Output

Look for “WARNING” lines — these are exploitable findings

./unix-privesc-check standard 2>&1 | grep -i "WARNING"

# Example warnings:
# WARNING: /usr/local/sbin/backup is SUID and writable by group admin
# WARNING: /etc/cron.daily/cleanup is writable by non-root
# WARNING: sudo NOPASSWD for /usr/bin/vim

# "OK" means the check passed (not a finding)
# "WARNING" means a potential vulnerability

Comparison with linpeas

unix-privesc-check:
  + Works on minimal systems (pure shell)
  + Very portable — runs anywhere with /bin/sh
  + Clear WARNING/OK output
  - Less comprehensive than linpeas
  - No color output

linpeas:
  + Much more comprehensive
  + Color-coded by severity
  + Regularly updated
  - Requires more resources
  - Can trigger AV/EDR

Tips

• Use when you can’t transfer linpeas — this works on almost any Unix system
• The “detailed” mode shows everything; “standard” shows only problems
• Combine with linpeas for comprehensive coverage on modern systems
• Focus on SUID+writable and sudo NOPASSWD findings first — these are directly exploitable

unix-privesc-check <mode>

mode:
  standard    Less verbose, shows only warnings and some info
  detailed    Full verbose output of all checks

Output:
  OK       Check passed (no vulnerability)
  WARNING  Potential privilege escalation vulnerability found
  INFO     Informational finding (may or may not be relevant)

Vue d’ensemble

unix-privesc-check est un script shell (fonctionne sur tout Unix disposant de /bin/sh) qui audite un système à la recherche de mauvaises configurations courantes de privilege escalation. C’est une alternative légère à linpeas quand vous avez besoin de quelque chose qui fonctionne sur des systèmes minimalistes sans curl ni wget.

Utilisation de base

# Télécharger
wget https://pentestmonkey.net/tools/unix-privesc-check/unix-privesc-check-1.4.tar.gz
tar -xzf unix-privesc-check-1.4.tar.gz

# Mode standard (moins verbeux)
./unix-privesc-check standard

# Mode détaillé (sortie complète)
./unix-privesc-check detailed

# Sauvegarder la sortie
./unix-privesc-check standard 2>&1 | tee output.txt

Ce qu’il vérifie

SUID/SGID Binaries:
  - Writable SUID binaries (immediate exploit)
  - SUID binaries in unusual locations
  - SGID writable binaries

Sudo Configuration:
  - NOPASSWD sudo rules
  - Sudo rules for shells or dangerous commands
  - World-readable sudoers file

Cron Jobs:
  - Root cron jobs with writable scripts
  - Cron scripts in world-writable directories
  - Cron PATH manipulation opportunities

File Permissions:
  - World-writable sensitive files (/etc/passwd, /etc/shadow)
  - World-readable /etc/shadow
  - Writable /etc/cron.* directories

Service Configurations:
  - NFS exports with no_root_squash
  - Writable config files for running services
  - Weak MySQL credentials
  - Writable PHP configuration

Network:
  - Open ports on localhost
  - Services running as root

Lecture de la sortie

Chercher les lignes “WARNING” : ce sont les findings exploitables

./unix-privesc-check standard 2>&1 | grep -i "WARNING"

# Exemples de warnings :
# WARNING: /usr/local/sbin/backup is SUID and writable by group admin
# WARNING: /etc/cron.daily/cleanup is writable by non-root
# WARNING: sudo NOPASSWD for /usr/bin/vim

# "OK" signifie que la vérification est passée (pas de finding)
# "WARNING" signifie une vulnérabilité potentielle

Comparaison avec linpeas

unix-privesc-check:
  + Fonctionne sur des systèmes minimalistes (shell pur)
  + Très portable : fonctionne partout où /bin/sh est disponible
  + Sortie WARNING/OK claire
  - Moins complet que linpeas
  - Pas de sortie en couleur

linpeas:
  + Beaucoup plus complet
  + Codé par couleur selon la sévérité
  + Régulièrement mis à jour
  - Nécessite plus de ressources
  - Peut déclencher AV/EDR

Conseils

• À utiliser quand vous ne pouvez pas transférer linpeas : celui-ci fonctionne sur presque tout système Unix
• Le mode “detailed” affiche tout ; “standard” ne montre que les problèmes
• Combiner avec linpeas pour une couverture complète sur les systèmes modernes
• Se concentrer d’abord sur les findings SUID+writable et sudo NOPASSWD : ils sont directement exploitables

unix-privesc-check <mode>

mode:
  standard    Less verbose, shows only warnings and some info
  detailed    Full verbose output of all checks

Output:
  OK       Check passed (no vulnerability)
  WARNING  Potential privilege escalation vulnerability found
  INFO     Informational finding (may or may not be relevant)