linEnum - privilege escalation

The art of privilege escalation is a skill that any competent hacker should possess. It's an entire field unto itself, and while it's good to know how to perform the techniques involved manually, it's often more efficient to have a script automate the process. LinEnum is one such script that can be incredibly useful for privilege escalation on Linux systems.


Privilege escalation is the method of exploiting specific bugs or flaws to obtain higher permissions relative to the current user. Usually, it involves going from a user-level shell to a root shell on Unix or a system shell on Windows.

There are a vast number of techniques out there for successful privilege escalation, and it can easily take years to master them all. On Linux, there are several basic methods used to try to escalate privileges as outlined in g0tmi1k's famous blog post. A lot of the commands can be automated, though, and that's exactly what LinEnum does.



See CHANGELOG.md for further details

High-level summary of the checks/tasks performed by LinEnum:

Kernel and distribution release details
System Information:
Hostname
Networking details:
Current IP
Default route details
DNS server information
User Information:
Current user details
Last logged on users
Shows users logged onto the host
List all users including uid/gid information
List root accounts
Extracts password policies and hash storage method information
Checks umask value
Checks if password hashes are stored in /etc/passwd
Extract full details for ‘default’ uid’s such as 0, 1000, 1001 etc
Attempt to read restricted files i.e. /etc/shadow
List current users history files (i.e .bash_history, .nano_history etc.)
Basic SSH checks
Privileged access:
Which users have recently used sudo
Determine if /etc/sudoers is accessible
Determine if the current user has Sudo access without a password
Are known ‘good’ breakout binaries available via Sudo (i.e. nmap, vim etc.)
Is root’s home directory accessible