Skip to content

Commit b522a04

Browse files
reschjonasreschjonas
authored
Add files via upload
0 parents  commit b522a04

File tree

16 files changed

+5725
-0
lines changed

16 files changed

+5725
-0
lines changed

‎LICENSE‎

Lines changed: 35 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,35 @@
1+
# Creative Commons Attribution-NonCommercial 4.0 International License (CC BY-NC 4.0)
2+
3+
This work is licensed under the Creative Commons Attribution-NonCommercial 4.0 International License.
4+
5+
To view a copy of this license, visit:
6+
https://creativecommons.org/licenses/by-nc/4.0/
7+
8+
or send a letter to:
9+
Creative Commons
10+
PO Box 1866
11+
Mountain View, CA 94042
12+
USA
13+
14+
## You are free to:
15+
16+
- **Share** — copy and redistribute the material in any medium or format
17+
- **Adapt** — remix, transform, and build upon the material
18+
19+
The licensor cannot revoke these freedoms as long as you follow the license terms.
20+
21+
## Under the following terms:
22+
23+
- **Attribution** — You must give appropriate credit, provide a link to the license, and indicate if changes were made. You may do so in any reasonable manner, but not in any way that suggests the licensor endorses you or your use.
24+
- **NonCommercial** — You may not use the material for commercial purposes.
25+
- **No additional restrictions** — You may not apply legal terms or technological measures that legally restrict others from doing anything the license permits.
26+
27+
## Notices:
28+
29+
You do not have to comply with the license for elements of the material in the public domain or where your use is permitted by an applicable exception or limitation.
30+
31+
No warranties are given. The license may not give you all of the permissions necessary for your intended use. For example, other rights such as publicity, privacy, or moral rights may limit how you use the material.
32+
33+
---
34+
35+
This is a human-readable summary of (and not a substitute for) the full license, which can be found at the link above.

‎README.md‎

Lines changed: 231 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,231 @@
1+
# EscalateX
2+
3+
A Linux privilege escalation scanner built to help security professionals find potential vectors for privilege escalation during penetration tests and security audits.
4+
5+
```
6+
███████╗███████╗ ██████╗ █████╗ ██╗ █████╗ ████████╗███████╗██╗ ██╗
7+
██╔════╝██╔════╝██╔════╝██╔══██╗██║ ██╔══██╗╚══██╔══╝██╔════╝╚██╗██╔╝
8+
█████╗ ███████╗██║ ███████║██║ ███████║ ██║ █████╗ ╚███╔╝
9+
██╔══╝ ╚════██║██║ ██╔══██║██║ ██╔══██║ ██║ ██╔══╝ ██╔██╗
10+
███████╗███████║╚██████╗██║ ██║███████╗██║ ██║ ██║ ███████╗██╔╝ ██╗
11+
╚══════╝╚══════╝ ╚═════╝╚═╝ ╚═╝╚══════╝╚═╝ ╚═╝ ╚═╝ ╚══════╝╚═╝ ╚═╝
12+
```
13+
14+
## About
15+
16+
EscalateX scans Linux systems for common privilege escalation vulnerabilities and misconfigurations. I built this tool after getting tired of manually checking the same things during every pentest engagement.
17+
18+
What it does:
19+
- Checks system configs, permissions, and security settings
20+
- Identifies SUID/SGID binaries and capabilities that could be abused
21+
- Finds writable files and directories in sensitive locations
22+
- Detects kernel vulnerabilities that might lead to privilege escalation
23+
- Evaluates container escape vectors
24+
25+
## Installation
26+
27+
Pretty simple setup:
28+
29+
```bash
30+
# Clone it
31+
git clone https://github.com/reschjonas/EscalateX.git
32+
33+
# Go to the directory
34+
cd EscalateX
35+
36+
# Make it executable
37+
chmod +x escalatex.sh
38+
```
39+
40+
### Requirements
41+
42+
Runs on most Linux distros with:
43+
- Bash 4.0+
44+
- Standard Unix tools (find, grep, ls, etc.)
45+
- The `timeout` command is nice to have but not required
46+
47+
## Usage
48+
49+
### Basic Usage
50+
51+
Just run it:
52+
53+
```bash
54+
./escalatex.sh
55+
```
56+
57+
### More Options
58+
59+
```bash
60+
# Run a more thorough scan (takes longer but finds more)
61+
./escalatex.sh --thorough
62+
63+
# Only check for specific things
64+
./escalatex.sh --only system_info,suid_sgid
65+
66+
# Use sudo to get more info
67+
./escalatex.sh --multi --password yourpassword
68+
69+
# The kitchen sink (all checks, maximum depth)
70+
./escalatex.sh --extreme
71+
```
72+
73+
### Command Line Options
74+
75+
#### Core Options
76+
- `-a, --all` - Run all checks (thorough mode)
77+
- `-t, --thorough` - More comprehensive but slower scan
78+
- `-x, --extreme` - Maximum depth scan for critical systems
79+
- `-o, --only CHECKS` - Run specific checks (comma-separated)
80+
- `-d, --dir PATH` - Check a specific directory
81+
- `-m, --multi` - Use multiple threads (default)
82+
- `-s, --single` - Single-threaded mode
83+
- `--threads N` - Set number of threads for multithreaded mode
84+
85+
#### Output Options
86+
- `-q, --quiet` - Minimal output
87+
- `-n, --no-color` - Turn off colors
88+
- `-w, --wait` - Pause between check groups
89+
90+
#### Advanced Options
91+
- `-p, --password PWD` - For sudo operations
92+
- `-S, --sudo-pass` - Prompt for sudo password for privilege escalation attempts
93+
- `-D, --debug` - Verbose logging
94+
- `-h, --help` - Show help
95+
96+
## What It Checks For
97+
98+
### System Information
99+
- OS details and kernel version
100+
- Security configurations and patch status
101+
- Hardware info and resource usage
102+
- Filesystem mounts and permissions
103+
- Boot configuration and services
104+
105+
### User & Permissions
106+
- Current user privileges
107+
- User enumeration and group memberships
108+
- Password policy issues
109+
- Sudo rules that could be abused
110+
- Home directory permissions
111+
112+
### Privilege Escalation Vectors
113+
- SUID/SGID binaries (especially exploitable ones)
114+
- Files with dangerous capabilities
115+
- Custom privilege escalation paths
116+
- Container security issues
117+
118+
### Filesystem Issues
119+
- Writable files in sensitive locations
120+
- Misconfigured home directory permissions
121+
- PATH manipulation vulnerabilities
122+
- Wildcard injection opportunities
123+
124+
## Sample Output
125+
126+
```
127+
┏━━━━━━━━━━━━━━━━━━━━━━━━━━ System Information ━━━━━━━━━━━━━━━━━━━━━━━━━━┓
128+
129+
╔════════[ Operating System Information ]════════╗
130+
[+] OS: Ubuntu 20.04.3 LTS (ubuntu)
131+
[+] Kernel version: 5.11.0-27-generic
132+
[+] Architecture: x86_64
133+
[+] Running on physical hardware
134+
135+
╔════════[ Hardware Information ]════════╗
136+
[+] CPU: Intel(R) Core(TM) i7-10700K CPU @ 3.80GHz (8 cores)
137+
[+] Memory: 6453MB / 16000MB (40% used)
138+
[+] Swap: 2048MB / 4096MB (50% used)
139+
140+
...
141+
142+
┏━━━━━━━━━━━━━━━━━━━━━━━━━━ SUID/SGID Binaries and Capabilities ━━━━━━━━━━━━━━━━━━━━━━━━━━┓
143+
144+
╔════════[ SUID/SGID Binaries ]════════╗
145+
[*] Looking for SUID binaries (might take a while)...
146+
[+] Found 35 SUID/SGID binaries:
147+
[!] /usr/bin/sudo [Owner: root]
148+
→ Purpose: Execute commands as root with proper permissions
149+
[!] /usr/bin/pkexec [Owner: root]
150+
→ Purpose: Execute commands as another user with policykit
151+
[CRITICAL] /usr/bin/python3 [Owner: root]
152+
→ Exploitable: python -c 'import os; os.execl("/bin/sh", "sh", "-p")'
153+
154+
...
155+
156+
┏━━━━━━━━━━━━━━━━━━━━━━━━━━ Scan Summary ━━━━━━━━━━━━━━━━━━━━━━━━━━┓
157+
158+
[*] EscalateX scan completed at Wed Feb 14 14:32:18 EST 2024
159+
[*] Remember to check the most promising privilege escalation vectors highlighted in red
160+
161+
Thank you for using EscalateX!
162+
```
163+
164+
## Custom Modules
165+
166+
You can write your own modules if you want to check for specific things. Here's how:
167+
168+
1. Create a script in the modules directory
169+
2. Use this basic structure:
170+
171+
```bash
172+
#!/bin/bash
173+
174+
# Title: My Custom Check
175+
# Description: What this thing does
176+
177+
check_something_interesting() {
178+
print_subtitle "My Interesting Check"
179+
180+
# Your check logic here
181+
print_info "Checking something..."
182+
183+
# Found something worth noting
184+
print_warning "Hmm, that's interesting"
185+
186+
# Found something bad
187+
print_critical "This is definitely exploitable"
188+
}
189+
190+
# Main function
191+
custom_checks() {
192+
print_title "My Custom Stuff"
193+
194+
# Run your checks
195+
check_something_interesting
196+
197+
# Pause if wait mode is on
198+
wait_for_user
199+
}
200+
```
201+
202+
3. Add your module to loader.sh
203+
204+
## Important Warning
205+
206+
This is a security tool. Use it responsibly:
207+
208+
- Only run it on systems you own or have permission to test
209+
- Some checks might trigger security alerts or monitoring
210+
- Be careful in production environments
211+
- Don't be a jerk - never use this for unauthorized access
212+
213+
## License
214+
215+
This project is licensed under the Creative Commons Attribution-NonCommercial 4.0 International License (CC BY-NC 4.0) - see the [LICENSE](LICENSE.md) file for details.
216+
217+
This means you can freely use, modify, and distribute this software, as long as:
218+
- You give appropriate credit to the original author
219+
- You don't use it for commercial purposes
220+
221+
For more information, visit: https://creativecommons.org/licenses/by-nc/4.0/
222+
223+
## Contributing
224+
225+
Contributions welcome! To contribute:
226+
227+
1. Fork the repo
228+
2. Create a branch (`git checkout -b cool-new-feature`)
229+
3. Commit your changes (`git commit -m 'Added some cool feature'`)
230+
4. Push to your branch (`git push origin cool-new-feature`)
231+
5. Open a PR

0 commit comments

Comments
 (0)