Pearson's OSCP Notebook

linuxprivchecker

Properties2
tagslinuxprivchecker, linux, privilege-escalation, enumeration, python, oscp
aliasesLinuxprivchecker, linuxprivchecker.py

3 min read

linuxprivchecker

Ctrl+F: linuxprivchecker.py · -w · -o · -s · python3 -m linuxprivchecker

Repo: sleventyeleven/linuxprivchecker

Original author: Mike Czumak (T_v3rn1x) — @SecuritySift
Maintainer: Michael Contino (@Sleventyeleven)

Run locally on the target to enumerate system info and hunt common privesc vectors: world-writable files, misconfigurations, cleartext passwords, and applicable exploits.

OSCP-safe design: Identifies areas to investigate — does not auto-exploit. Matches OSCP / HTB rules (self-directed exploitation). Use output as a checklist, then exploit manually via Linux.

→ Privesc Tools · lse - Linux Smart Enumeration · linux-exploit-suggester

📌 When to use

SituationAction
After LinPEAS / lse — want a second opinionRun linuxprivchecker, compare findings
Target has Python but bash enum scripts failPython alternative
Need a log file for offline grep on Kali-w -o linuxprivchecker.log
Exam box — avoid noisy/auto-exploit toolsThis script only lists vectors

📌 Install / transfer

Python 2.6/2.7 (legacy — single file)

wget https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
python linuxprivchecker.py -w -o linuxprivchecker.log

Python 3.x (pip — recommended on Kali for testing)

pip install linuxprivchecker
linuxprivchecker -w -o linuxprivchecker.log
# or
python3 -m linuxprivchecker -w -o linuxprivchecker.log

Transfer from Kali HTTP server

# Kali
wget https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
python3 -m http.server 8080
 
# Target
wget http://192.168.45.227:8080/linuxprivchecker.py
python3 linuxprivchecker.py -w -o /tmp/linuxprivchecker.log
# or: python linuxprivchecker.py -w -o /tmp/linuxprivchecker.log

→ File Transfer

📌 Usage & flags

usage: linuxprivchecker.py [-h] [-s] [-w] [-o OUTFILE]

optional arguments:
  -h, --help            Show help
  -s, --searches        Skip time-consuming / resource-intensive searches
  -w, --write           Write a log file (use with -o)
  -o OUTFILE, --outfile OUTFILE
                        Log path (must be writable by current user)

# Full run + log
python linuxprivchecker.py -w -o linuxprivchecker.log
 
# Faster — skip heavy searches
python linuxprivchecker.py -s -w -o linuxprivchecker.log
 
# No -w support (old argparser missing) — redirect stdout
python linuxprivchecker.py > linuxprivchecker.log 2>&1

Pull log to Kali:

# On target
cat linuxprivchecker.log
 
# Or exfil via HTTP / base64 / [[File Transfer]]

📌 What it checks (investigate, don’t auto-run)

CategoryExamples
System infoKernel, OS, users, groups
World-writable files/etc/passwd, scripts, cron paths
MisconfigurationsWeak permissions, risky services
Cleartext passwordsConfigs, history, env
Exploit hintsKernel / package versions → verify with linux-exploit-suggester and searchsploit

Maintainer notes: exploit list can be outdated — always confirm kernel/build before running a public exploit. Package→process linking uses keywords and may be inaccurate.

📌 OSCP workflow

1. Low shell → id; sudo -l; uname -a
2. LinPEAS or lse first (**[[Privesc Tools]]** / **[[lse - Linux Smart Enumeration]]**)
3. python linuxprivchecker.py -w -o /tmp/priv.log
4. Grep log for writable, sudo, passwords, kernel
5. Manual exploit path per **[[Linux]]**
6. Kernel candidate? Run **[[linux-exploit-suggester]]** on Kali with uname output

📌 vs other tools

ToolNotes
LinPEASPrimary OSCP default — broadest coverage
lse.shBash; gradual verbosity levels
linuxprivcheckerPython; good structured log; enumerate-only
LinEnumLegacy bash — prefer lse
linux-exploit-suggesterKernel exploit matching — run on Kali, not duplicate enum

📌 Quick cheat sheet

# Legacy one-file (Python 2/3 on target)
wget https://raw.githubusercontent.com/sleventyeleven/linuxprivchecker/master/linuxprivchecker.py
python linuxprivchecker.py -w -o linuxprivchecker.log
python linuxprivchecker.py -s -w -o linuxprivchecker.log    # skip heavy searches
 
# Python 3 via pip (Kali or target)
pip install linuxprivchecker
linuxprivchecker -w -o linuxprivchecker.log
 
# Fallback log
python linuxprivchecker.py 2>&1 | tee priv.out

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks