## https://sploitus.com/exploit?id=EE93979C-CEDA-5B38-9D08-B4C5C7D2EA9C
# privil_edge
[](https://github.com/Ianemwel679/privil_edge/actions/workflows/ci.yml)
[](https://www.shellcheck.net/)
[](LICENSE)
[](https://www.gnu.org/software/bash/)
[](#-authorised-use-only)
> A single-file **local privilege-escalation auditor** that enumerates a host's
> SUID/SGID binaries, sudo rights and file capabilities, cross-references them
> against [GTFOBins](https://gtfobins.org), and highlights the misconfigurations
> that lead to root — with ready-to-run PoCs and remediation.
```
_ _ _ _
_ __ _ __(_)_ _(_) | ___ __| | __ _ ___
| '_ \| '__| \ \ / / | | / _ \/ _` |/ _` |/ _ \
| |_) | | | |\ V /| | | | __/ (_| | (_| | __/
| .__/|_| |_| \_/ |_|_|____\___|\__,_|\__, |\___|
|_| |_____| |___/
privil_edge · local privesc auditor · author: N3m3_sys
```
---
## ⚖️ Authorised use only
`privil_edge` is a **defensive / authorised-pentest** tool. It is read-only: it
enumerates and reports misconfigurations so they can be **fixed**. Run it only
against systems you own or have **explicit written permission** to test.
Unauthorised access to computer systems is illegal in most jurisdictions. The
authors accept no liability for misuse — see the [LICENSE](LICENSE).
By design, `privil_edge` does **not** exploit, persist, tamper with logs,
disable defences, or hide processes. It finds problems; it does not weaponise
them.
---
## Features
- **Three core vectors, GTFOBins-aware**
- SUID/SGID binaries (`find -perm`)
- sudo rights (passive `sudoers` parse or `sudo -l`)
- file capabilities (`getcap`, `cap_setuid`/`cap_dac_*`/…)
- **Severity tiers by impact** — shell/command exec → **CRITICAL**, file-write
→ **HIGH**, file-read → **MEDIUM**; unknown-but-dangerous caps → review.
- **Deep sudo analysis** — PATH-relative (hijackable) commands, writable
sudo-allowed binaries, and dangerous `Defaults` (`env_keep` of `LD_PRELOAD`/
interpreter paths, `!env_reset`, `SETENV`).
- **Writable-surface checks** — `$PATH` dirs, world-writable executables,
cron files/scripts, and systemd unit/`ExecStart=` targets.
- **Kernel / known-CVE hints** — DirtyPipe, OverlayFS, Dirty COW, Baron Samedit,
PwnKit — reported as *hints to verify*, never as confirmations.
- **Ready PoCs** — each finding ships the exact GTFOBins payload (path filled in)
plus the canonical reference URL.
- **Low-footprint `--stealth` mode** — no temp files, passive sudoers read (no
auth-log entry), lowered I/O/CPU priority, scoped scan, timing jitter.
- **Multiple outputs** — coloured terminal, `--json` (automation/CI), `--md`
(pentest deliverables).
- **CI-friendly exit codes** — `2` = CRITICAL, `1` = HIGH, `0` = clean.
- **Zero dependencies** — one portable bash script; `sudo`/`getcap`/`ionice`
used when present and degraded gracefully when not.
## Requirements
- `bash` 4+
- coreutils and `find` (present on any Linux)
- Optional: `sudo`, `getcap` (libcap), `ionice`
> The script auto-re-execs under bash if it is launched with `sh`/`dash`.
## Install
```bash
git clone https://github.com/Ianemwel679/privil_edge.git
cd privil_edge
chmod +x privil_edge
./privil_edge --help
```
One-liner (review before running remote scripts, always):
```bash
curl -fsSL https://raw.githubusercontent.com/Ianemwel679/privil_edge/main/privil_edge -o privil_edge
chmod +x privil_edge && ./privil_edge
```
## Usage
```text
privil_edge [options]
--no-color Disable ANSI colour
--no-banner Suppress the ASCII banner
--json Emit findings as JSON (implies --no-color, --no-banner)
--md Emit a Markdown report (pentest deliverables)
--quick Only scan common bin dirs, skip slow full-FS SUID sweep
--paths "a b c" Space-separated roots for the SUID/SGID search
--no-suid Skip SUID/SGID scan
--no-sudo Skip sudo scan
--no-caps Skip file-capabilities scan
--no-extra Skip writable PATH/cron/systemd checks
--no-kernel Skip kernel / known-CVE hints
--stealth Low-footprint profile
--slow N Add up to N seconds of jitter between heavy steps
-h, --help This help
```
> **Run it as the unprivileged user you are testing from.** The writable-surface
> checks answer "can *this* user write it?" — running as root makes every path
> writable and the findings meaningless (privil_edge downgrades to world/group
> write bits when it detects it is root, but the intended context is non-root).
### Examples
```bash
./privil_edge # full coloured audit + banner
./privil_edge --quick # fast pass over standard bin dirs
./privil_edge --stealth # quiet, low-footprint authorised-engagement run
./privil_edge --json > loot.json # machine-readable
./privil_edge --md > report.md # Markdown deliverable
```
### Sample output
```text
▓▓ CRITICAL
SUID find /usr/bin/find
SUID/SGID bit set on a GTFOBins binary — shell / command execution as target user
PoC: /usr/bin/find . -exec /bin/sh -p \; -quit
ref: https://gtfobins.org/gtfobins/find/#suid
▓▓ MEDIUM
SUID cat /usr/bin/cat
SUID/SGID bit set on a GTFOBins binary — arbitrary file READ as target user (e.g. /etc/shadow, SSH keys)
ref: https://gtfobins.org/gtfobins/cat/#suid
Summary: 1 CRITICAL 0 HIGH 1 MEDIUM 0 review (2 total)
```
## How it works
`privil_edge` never assumes a binary is dangerous in the abstract — it looks for
the **intersection** of (1) a binary GTFOBins knows how to abuse for a given
*context* and (2) that same binary sitting in a *privileged context* on this
host. `vim` is harmless; `vim` with the SUID bit or in a sudoers rule is a root
shell. Each context is matched against the corresponding GTFOBins function
(SUID / Sudo / Capabilities), then severity is refined by whether the abuse
yields a shell, a file write, or a file read.
The GTFOBins membership lists are embedded (curated from
) so the tool has **no network dependency** and runs on
air-gapped hosts. To extend coverage, add a binary name to the relevant list at
the top of the script.
## Severity model
| Severity | Meaning | Example |
|---|---|---|
| **CRITICAL** | Direct shell/command exec as root, or full sudo | SUID `bash`, `sudo find`, `env_keep LD_PRELOAD` |
| **HIGH** | One step from root (arbitrary write, hijack) | SUID `tee`, writable `$PATH` dir, relative sudo cmd |
| **MEDIUM** | Info disclosure (arbitrary file read) | SUID `cat`, SUID `xz` |
| **review** | Needs manual judgement / unverified CVE hint | unknown capability, DirtyPipe kernel range |
## Stealth & OpSec
`--stealth` reduces the tool's **own** footprint for authorised red-team work:
- writes nothing to disk (in-memory only);
- reads `sudoers` passively instead of running `sudo -l` (which logs an auth event);
- lowers its I/O/CPU priority (`ionice`/`nice`) to avoid spiking monitoring;
- scopes the scan and adds timing jitter (`--slow`).
It **does not** wipe logs, disable security tooling, timestomp, or hide
processes. That is anti-forensics, it destroys the client's evidence, and it is
deliberately out of scope.
## Contributing
Issues and PRs welcome — see [CONTRIBUTING.md](CONTRIBUTING.md). All shell code
is linted with [ShellCheck](https://www.shellcheck.net/) in CI.
## License
[MIT](LICENSE) © 2026 N3m3_sys
## Acknowledgements
- [GTFOBins](https://gtfobins.org) by Emilio Pinna & Andrea Cardaci — the
dataset this tool is built around.