Skip to content

Commit ac9a668

Browse files
Ruby570bocaditoRuby570bocadito
committed
Auto-Privilege v1.0 — Rebrand and overhaul
- Renamed from Rise-Privilege/Peekaboo to Auto-Privilege - Struct Peekaboo → AutoPrivilege across all Go files - Added LICENSE (MIT) - Added CI pipeline (GitHub Actions: build + test + vet) - Updated .gitignore with all legacy binary names - Updated Docker container names (autoprivilege-*) - Renamed peekaboo_test.go → autoprivilege_test.go - All 9 tests passing, binary builds successfully
0 parents  commit ac9a668

20 files changed

Lines changed: 2816 additions & 0 deletions

‎.github/workflows/ci.yml‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,22 @@
1+
name: CI
2+
3+
on:
4+
push:
5+
branches: [main]
6+
pull_request:
7+
branches: [main]
8+
9+
jobs:
10+
build-and-test:
11+
runs-on: ubuntu-latest
12+
steps:
13+
- uses: actions/checkout@v4
14+
- uses: actions/setup-go@v5
15+
with:
16+
go-version: '1.24'
17+
- name: Build
18+
run: go build -v ./...
19+
- name: Test
20+
run: go test -v -count=1 ./...
21+
- name: Vet
22+
run: go vet ./...

‎.gitignore‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
Auto-Privilege
2+
Rise-Privilege
3+
peekaboo
4+
*.exe
5+
*.test
6+
brain/
7+

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2025 Auto-Privilege / Ruby570bocadito
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 251 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,251 @@
1+
<div align="center">
2+
<img src="https://capsule-render.vercel.app/api?type=waving&color=gradient&customColorList=0,2,3,6&height=220&section=header&text=Auto-Privilege&fontSize=60&fontColor=fff&animation=twinkling&desc=Automated%20Linux%20Privilege%20Escalation%20Suite&descSize=18&descAlignY=72" width="100%"/>
3+
4+
<a href="https://github.com/Ruby570bocadito/Auto-Privilege">
5+
<img src="https://readme-typing-svg.herokuapp.com?font=Fira+Code&weight=600&size=22&pause=1000&color=00FF00&center=true&vCenter=true&width=640&lines=10%2B+Scanners+%7C+60%2B+GTFOBins+Database+%7C+Auto-Root;Zero+Dependencies+%7C+Single+Binary+%7C+Go+Power;From+Peekaboo+to+Auto-Privilege;One+Shot.+One+Binary.+Root." alt="Typing SVG" />
6+
</a>
7+
8+
<br/>
9+
10+
<p>
11+
<img src="https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white" alt="Go"/>
12+
<img src="https://img.shields.io/badge/Linux-FCC624?style=flat-square&logo=linux&logoColor=black" alt="Linux"/>
13+
<img src="https://img.shields.io/badge/Security-Pentest-000000?style=flat-square&logo=kalilinux&logoColor=white" alt="Security"/>
14+
<img src="https://img.shields.io/github/license/Ruby570bocadito/Auto-Privilege?style=flat-square&color=blue" alt="License"/>
15+
<img src="https://img.shields.io/github/v/release/Ruby570bocadito/Auto-Privilege?style=flat-square&color=brightgreen" alt="Release"/>
16+
<img src="https://img.shields.io/github/go-mod/go-version/Ruby570bocadito/Auto-Privilege?style=flat-square&color=purple" alt="Go Version"/>
17+
<img src="https://img.shields.io/badge/dependencies-zero-success?style=flat-square" alt="Dependencies"/>
18+
<img src="https://img.shields.io/badge/PRs-Welcome-brightgreen?style=flat-square" alt="PRs"/>
19+
</p>
20+
21+
<br/>
22+
</div>
23+
24+
# ⚠️ Ethical Warning
25+
26+
> **This tool is designed for authorized security testing, CTF competitions, and educational purposes only.**
27+
>
28+
> - Only use on systems you own or have explicit written permission to test
29+
> - Misuse may violate local and international laws
30+
> - The author is not responsible for any damage caused by misuse
31+
>
32+
> **You have been warned.**
33+
34+
---
35+
36+
# 🚀 Overview
37+
38+
**Auto-Privilege** is an automated Linux privilege escalation suite that scans a target system, identifies misconfigurations, and **automatically exploits them** to gain root access — all in a **single, statically-linked Go binary with zero dependencies**.
39+
40+
| Phase | Action | Description |
41+
|-------|--------|-------------|
42+
| **1. SCAN** | Passive discovery | 10+ vulnerability scanners probe the system (read-only) |
43+
| **2. ENUMERATE** | Find → Exploit mapping | Matches findings against 60+ GTFOBins database |
44+
| **3. EXPLOIT** | Auto-root | Executes safest → most aggressive vector until root |
45+
46+
---
47+
48+
# 🔢 Features
49+
50+
## 10+ Vulnerability Scanners
51+
52+
| # | Scanner | Detection | Risk |
53+
|---|---------|-----------|------|
54+
| 1 | **SUID Binaries** | Scans 10+ directories for SUID bit | Low |
55+
| 2 | **Sudo Misconfig** | Parses `sudo -l`, finds NOPASSWD entries | Low |
56+
| 3 | **Writable Cron** | Checks cron dirs & referenced scripts (world-writable) | Medium |
57+
| 4 | **Docker Breakout** | Detects docker group membership, suggests escape | High |
58+
| 5 | **Capabilities** | Reads `/proc/self/status`, finds `cap_setuid`/`cap_sys_ptrace` | Medium |
59+
| 6 | **NFS no_root_squash** | Parses `/etc/exports`, finds exploitable exports | High |
60+
| 7 | **Writable PATH** | Checks PATH directories for world-writable locations | Low |
61+
| 8 | **Systemd Services** | Scans `/etc/systemd/system` for writable service files | Medium |
62+
| 9 | **/etc/passwd** | Checks if world-writable, injects root user | Critical |
63+
| 10 | **/etc/shadow** | Checks readability, cracks root hash | Critical |
64+
| 11 | **Kernel Info** | Grabs kernel version, flags known CVEs (6 CVEs: PwnKit, Baron Samedit, PolaKit, StackRot, nf_tables UAF, packet socket UAF) | Medium |
65+
| 12 | **Writable Scripts** | Detects world-writable shell scripts in cron/systemd | Medium |
66+
67+
## Escalation Techniques
68+
69+
| Technique | How It Works | Auto-Exploit | Risk |
70+
|-----------|-------------|:---:|:----:|
71+
| **SUID GTFOBins** | Spawn privileged shell via SUID binary (e.g., `python -c 'import os; os.execl("/bin/sh", "sh")'`) | ✅ | 🟢 SAFE |
72+
| **Sudo NOPASSWD** | `sudo` via GTFOBins without password | ✅ | 🟢 SAFE |
73+
| **Cron Injection** | Overwrite writable cron script with reverse shell | ✅ | 🟡 LOW |
74+
| **Docker Escape** | `docker run -v /:/mnt --privileged` | ✅ | 🟡 MEDIUM |
75+
| **Capabilities** | `cap_setuid+ep` binary → setuid(0) | ✅ | 🟡 MEDIUM |
76+
| **NFS no_root_squash** | Mount export as root, write SUID binary | ✅ | 🟡 MEDIUM |
77+
| **passwd Injection** | Append root user with known hash | ✅ | 🔴 HIGH |
78+
| **shadow Cracking** | Read hash → muestra hash root para crackear offline | ⚠️ Detect + show | 🔴 HIGH |
79+
| **PATH Hijack** | Place malicious binary in writable PATH dir | ✅ | 🟡 MEDIUM |
80+
| **Systemd Hijack** | Replace writable service ExecStart with payload | ✅ | 🟡 MEDIUM |
81+
82+
---
83+
84+
# 📦 Quick Start
85+
86+
### Installation
87+
88+
```bash
89+
# Option A: Go install (requires Go 1.26+)
90+
go install github.com/Ruby570bocadito/Auto-Privilege@latest
91+
92+
# Option B: Git clone & build
93+
git clone https://github.com/Ruby570bocadito/Auto-Privilege.git
94+
cd Auto-Privilege
95+
go build -o Auto-Privilege .
96+
97+
# Option C: Download pre-built binary from Releases
98+
```
99+
100+
### Basic Usage
101+
102+
```bash
103+
# Scan only (safe, read-only)
104+
./Auto-Privilege
105+
106+
# Auto-exploit found vectors
107+
./Auto-Privilege --exploit
108+
109+
# Auto-exploit with risk limit
110+
./Auto-Privilege --exploit --risk=medium
111+
112+
# Specific vectors only
113+
./Auto-Privilege --vector=suid,sudo,cron
114+
115+
# JSON output for automation
116+
./Auto-Privilege --json
117+
118+
# Quiet mode (exit code: 0=root, 1=fail)
119+
./Auto-Privilege --quiet
120+
```
121+
122+
---
123+
124+
# 🧠 Architecture
125+
126+
```mermaid
127+
flowchart LR
128+
A["🎯 Target System"] --> B["🔍 Scanner Engine"]
129+
B --> C["10+ Checks<br/>SUID · Sudo · Cron<br/>Docker · NFS · PATH"]
130+
C --> D{"Vulnerability<br/>Detected?"}
131+
D -->|"❌ No"| E["Report Findings"]
132+
D -->|"✅ Yes"| F["GTFOBins Matcher<br/>60+ Binaries"]
133+
F --> G["Risk Evaluator"]
134+
G --> H["🟢 SAFE"] --> K["Auto-Exploit"]
135+
G --> I["🟡 MEDIUM"] --> K
136+
G --> J["🔴 HIGH/DANGER"] --> K
137+
K --> L["💀 Root Shell<br/>or SUID Binary"]
138+
```
139+
140+
## File Structure
141+
142+
```
143+
Auto-Privilege/
144+
├── main.go CLI entry + orchestration
145+
├── scanner.go 10+ vulnerability scanners
146+
├── enumerate.go Findings → exploit vector mapping
147+
├── exploit.go Exploitation engine (safe→danger)
148+
├── gtfobins.go Embedded GTFOBins database (~60 binaries)
149+
├── gtfobins_update.go GTFOBins updater from upstream
150+
├── logger.go Logging and output formatting
151+
├── universe.go Types, constants, formatting
152+
├── autoprivilege_test.go Unit tests (9 tests)
153+
├── docker/
154+
│ ├── Dockerfile.vulnerable Target with 10 deliberate flaws
155+
│ ├── Dockerfile.clean Secure baseline system
156+
│ ├── Dockerfile.edgecases Edge case scenarios
157+
│ ├── docker-compose.yml Test network
158+
│ └── test_runner.sh Automated test runner
159+
└── README.md
160+
```
161+
162+
---
163+
164+
# 🐳 Docker Testing
165+
166+
```bash
167+
# Build all images
168+
cd docker
169+
docker compose build
170+
171+
# Start test network (vulnerable + clean + edgecases)
172+
docker compose up -d
173+
174+
# Run Auto-Privilege on vulnerable target
175+
docker exec autoprivilege-vulnerable ./Auto-Privilege --exploit
176+
177+
# Run on clean system (should find minimal vectors)
178+
docker exec autoprivilege-clean ./Auto-Privilege
179+
180+
# Run edge case scenarios
181+
docker exec autoprivilege-edgecases ./Auto-Privilege --vector=sudo
182+
183+
# Full test suite
184+
./docker/test_runner.sh
185+
```
186+
187+
---
188+
189+
# 🎯 GTFOBins Database
190+
191+
**60+ binaries** with exploitation commands, **embedded in the binary**. Zero network calls at runtime. Works air-gapped.
192+
193+
<details>
194+
<summary><b>Click to expand — all supported binaries</b></summary>
195+
196+
**Shell interpreters (SUID):** python, python2, python3, python3.8-3.13, perl, perl5, php, php5-8.2, ruby, ruby2-3, lua, lua5.3-5.4, node, nodejs, bash, dash, zsh, ksh, fish, sh
197+
198+
**Sudo-capable binaries:** find, vim, vi, less, more, man, awk, gawk, nawk, sed, gdb, nmap, tcpdump, tar, zip, unzip, rsync, scp, socat, env, nice, timeout, stdbuf, watch, make, pip, pip3, npm, gem, git, ssh, docker, lxc, apache2, cpan, ed, ex, ftp, wall, systemctl, journalctl, mysql, psql, sqlite3
199+
200+
</details>
201+
202+
---
203+
204+
# ⚡ All Commands
205+
206+
| Command | Description |
207+
|---------|-------------|
208+
| `./Auto-Privilege` | Scan only (no exploit) |
209+
| `./Auto-Privilege --exploit` | Auto-exploit safest vector first |
210+
| `./Auto-Privilege --exploit --risk=safe` | Only SAFE risk vectors |
211+
| `./Auto-Privilege --exploit --risk=danger` | Everything (including dangerous) |
212+
| `./Auto-Privilege --vector=suid,sudo,cron` | Specific vectors only |
213+
| `./Auto-Privilege --exploit --one-shot` | Stop after first success |
214+
| `./Auto-Privilege --json` | Machine-readable JSON output |
215+
| `./Auto-Privilege --quiet` | Exit code only (0=root, 1=fail) |
216+
| `./Auto-Privilege --rooteame ./rootkit.ko` | Load rootkit on success |
217+
| `./Auto-Privilege --stealth` | Slow scan (evades IDS) |
218+
| `./Auto-Privilege --dry-run` | Scan & enumerate only, no exploitation |
219+
| `./Auto-Privilege --update-gtfobins` | Update embedded GTFOBins database |
220+
| `./Auto-Privilege --lhost 10.0.0.1` | Set listener IP for reverse shells |
221+
| `./Auto-Privilege --lport 4444` | Set listener port for reverse shells |
222+
| `./Auto-Privilege --log json` | JSON log format (default: text) |
223+
224+
---
225+
226+
# 📊 Risk Levels
227+
228+
| Level | Examples | Auto-Exploit? | FS Changes? |
229+
|-------|----------|:---:|:---:|
230+
| 🟢 **SAFE** | python SUID → shell | ✅ Yes | No |
231+
| 🟡 **LOW** | find SUID, awk sudo | ✅ Yes | Minor |
232+
| 🟠 **MEDIUM** | cap_sys_ptrace, cron inject | ⚠️ Optional | May trigger alerts |
233+
| 🔴 **HIGH** | passwd injection, cron, docker | ⚠️ Optional | Yes |
234+
| 💀 **DANGER** | shadow overwrite, kernel exploits | ✋ Manual only | Yes, may crash |
235+
236+
---
237+
238+
<div align="center">
239+
<img src="https://capsule-render.vercel.app/api?type=waving&color=gradient&customColorList=0,2,3,6&height=120&section=footer&text=Root%20the%20box%20%E2%80%A2%20One%20shot&fontSize=24&fontColor=fff&animation=twinkling" width="100%"/>
240+
<br/><br/>
241+
<sub>Built with ❤️ by <a href="https://github.com/Ruby570bocadito">Ruby570bocadito</a></sub>
242+
<br/>
243+
<sub>Formerly known as <strong>Peekaboo</strong> — Now <strong>Auto-Privilege</strong></sub>
244+
<br/><br/>
245+
<img src="https://img.shields.io/badge/Go-1.26+-00ADD8?style=flat-square&logo=go&logoColor=white" alt="Go"/>
246+
<img src="https://img.shields.io/badge/Linux-red?style=flat-square&logo=linux&logoColor=white" alt="Linux"/>
247+
<img src="https://img.shields.io/github/stars/Ruby570bocadito/Auto-Privilege?style=flat-square&color=yellow" alt="Stars"/>
248+
<img src="https://img.shields.io/github/last-commit/Ruby570bocadito/Auto-Privilege?style=flat-square&color=blue" alt="Last Commit"/>
249+
<br/><br/>
250+
<sub>© 2026 Ruby570bocadito. MIT License.</sub>
251+
</div>

0 commit comments

Comments
 (0)