Local Root Exploit Toolkit

A collection of legacy Linux local privilege-escalation exploits and helper scripts for authorized security testing, vulnerability research, and CTF/lab environments.

Status: Work in progress / legacy research toolkit
Scope: Linux local privilege escalation
Use only on systems you own or are explicitly authorized to test.

Overview

This toolkit is intended for situations where you have obtained a non-interactive shell on a Linux host and need to assess whether the system is vulnerable to known local privilege-escalation issues.

For example, after obtaining a web shell without a reverse connection, the toolkit can attempt to build and execute a vulnerable local exploit. Successful exploitation may result in a setuid-root helper being created in the working directory.

The project is primarily an aggregation of previously published research, with wrapper scripts intended to simplify exploit detection and execution.

Included Exploits

CVE	Affected Versions / Component	Script
CVE-2013-2094	Linux 2.6.37 → 3.8.8, PERF_EVENTS	CVE-2013-2094.sh
CVE-2009-2698	Linux < 2.6.19, udp_sendmsg()	CVE-2009-2698.sh
CVE-2009-2908	Linux 2.6.19 → 2.6.31.1, eCryptfs	CVE-2009-2908.sh
CVE-2009-2692	Linux 2.x, sendpage()	CVE-2009-2692.sh
CVE-2010-3856	glibc ≤ 2.12.x, LD_AUDIT / libmemusage.so	CVE-2010-3856.sh

priv_esc

priv_esc is the toolkit's automatic detector and runner. It executes on the target Linux system, fingerprints relevant host characteristics, compares them against the bundled exploit conditions, and identifies potentially applicable exploits.

It checks information including:

• Kernel version
• CPU architecture
• glibc version
• mmap_min_addr
• SELinux / grsecurity configuration
• GCC availability
• Bundled CVE matching rules

When an applicable exploit is identified, the script can attempt to build and execute it. On successful execution, it reports the resulting helper and relevant usage information.

Usage

Automatic detection and exploitation

./priv_esc

Detection only

./priv_esc detect

List available exploits and matching rules

./priv_esc list

Run the exploitation loop explicitly

./priv_esc run [options]

Options

-c CVE-2013-2094   Only attempt the specified exploit
-a                 Attempt every applicable exploit
-y                 Skip the confirmation prompt
-w DIR             Specify the workspace directory
-K                 Keep the workspace after failure
-T SECS            Set the per-attempt timeout

The default timeout is 120 seconds and requires timeout(1).

Requirements

The toolkit expects:

• Linux
• bash
• gcc
• The bundled CVE-*.sh exploit scripts
• Appropriate permissions to compile and execute the required components

Copy the complete toolkit directory to the authorized test host and make the runner executable:

chmod +x priv_esc

Important Notes

This is a legacy research toolkit and should not be treated as a reliable modern privilege-escalation framework.

Some exploits may:

• Crash or destabilize the target system
• Depend on obsolete kernel versions
• Require specific system configurations
• Fail during compilation or execution
• Require a writable filesystem or other environmental conditions

The original project notes that the automated runner is intentionally simple and may cause a kernel panic under unsuitable conditions. Use isolated lab environments whenever possible.

Attribution

The toolkit is based substantially on previous Linux privilege-escalation research, including work by Karabo Kosi.

The project primarily consolidates existing research, adds wrapper scripts, and provides automated detection and execution functionality.

Disclaimer

This project is provided for authorized security research, education, penetration testing, and controlled laboratory environments.

Do not use these exploits against systems without explicit authorization. The maintainer and contributors are not responsible for damage, data loss, service disruption, or unauthorized activity resulting from misuse.

---

Local Root Exploit Toolkit
Linux privilege-escalation research collection