Post Exploitationprivilege-escalationunixlinuxsecurity-auditmisconfigurations

unix-privesc-check

Script that checks file permissions and other settings on Unix systems for local privilege escalation vectors. Identifies misconfigurations allowing unprivileged users to escalate to root or access local applications.

Description

Unix-privesc-check is a single shell script designed to detect simple privilege escalation vectors on Unix systems including Linux, Solaris, HPUX, and FreeBSD. It examines file permissions, security settings, and other configurations that could enable local unprivileged users to gain elevated privileges or access local apps like databases.

The tool is particularly useful during security assessments and penetration testing to identify privilege escalation opportunities. It can run as a normal user or root, performing more comprehensive checks when executed with elevated privileges due to increased file readability. Use is restricted to systems where legal permission for security assessment has been granted, and it is licensed under GPL v2.

Output should be searched for 'WARNING' indicators; absence of warnings means no problems were detected. The script is easy to deploy as it requires no compilation or installation beyond uploading and execution.

How It Works

The script performs speed-optimized checks of security settings in standard mode, or detailed checks including open file handles, shell script parsed files, and linked .so files in detailed mode. It records system information like hostname, uname, and interface IPs, then scans for misconfigurations in file permissions and other privilege escalation vectors across the Unix filesystem and processes.

Installation

bash
sudo apt install unix-privesc-check

Flags

standardSpeed-optimised check of lots of security settings.
detailedSame as standard mode, but also checks perms of open file handles and called files (e.g. parsed from shell scripts, linked .so files). This mode is slow and prone to false positives.
-hDisplay usage information and mode descriptions.

Examples

Runs standard mode for speed-optimized security checks on Unix system.
unix-privesc-check standard
Runs detailed mode for comprehensive checks including file handles and parsed files, though slower with potential false positives.
unix-privesc-check detailed
Displays help usage showing standard and detailed mode options.
unix-privesc-check -h
Runs as root in standard mode for better file access and more thorough checks.
sudo unix-privesc-check standard
Runs standard mode and filters output for privilege escalation warnings.
unix-privesc-check standard | grep WARNING
Executes detailed mode to find subtle flaws in third-party programs via file handle and dependency checks.
unix-privesc-check detailed
Updated 2026-04-16kali.org ↗