Z-Privesc - Linux privilege-escalation auditor — 17 probes, de

项目说明

<di="center">
<img src="assets/z-privesc.png" alt="Z-Privesc" width="120"/>
<h1>Z-Privesc</h1>
<p>
Linux pri auditor. Se probes.<br/>
Deterministic . Honest accuracy numbers.
</p>
<img src="
<img src="
<img src="
<img src="
<img src="
</div>

---

---

Table of Contents

---

Quick Start

---

Why Z-Privesc

Existing pri auditors make trade-offs:

| | Z-Privesc | LinPEAS | Lynis | linux-exploit-suggester |
|----------------------|:-------------:|:-----------:|:---------:|:---------------------------:|
| Static binary | Yes | No | No | No |
| Zero external deps | Yes | No | No | No |
| Deterministic | Yes | No | No | No |
| C risk scoring| Yes | No | No | No |
| 17 categories OOTB | Yes | Broad | Broad | Partial |
| Machine-readable JSON| v1 | None | None | None |
| Per-finding remediation| Yes | Partial | No | No |
| Offline/air-gapped | Yes | Yes | Yes | Yes |
| License | MIT | GPL-3 | GPL | MIT |

Z-Privesc fills the niche between broad compliance scanners (Lynis, LinPEAS)
and narrow exploit suggesters. It answers one question: **can an unpri
user on this box get root, right now?**

---

Architecture

Data Flow

Probe Pipeline

---

Probes

| # | Name | What it checks | Se |
|---|------|---------------|----------|
| 1 | suid | SUID/SGID binaries | CRITICAL |
| 2 | writable_path | World-writable $PATH entries | CRITICAL |
| 3 | capabilities | File/process Linux capabilities | HIGH |
| 4 | writable_etc | Writable /etc auth files | CRITICAL |
| 5 | docker_socket | Exposed Docker control socket | CRITICAL |
| 6 | polkit | polkit/pkexec misconfigurations | CRITICAL |
| 7 | world_writable | World-writable sensiti | CRITICAL |
| 8 | kernel_vuln | Kernel C | CRITICAL |
| 9 | cron | Cron job misconfigurations | CRITICAL |
| 10 | sudoers | Sudoers rule audit | CRITICAL |
| 11 | ssh_keys | SSH private key permissions | CRITICAL |
| 12 | groups | Pri group membership | CRITICAL |
| 13 | service | Systemd/SysV unit audit | CRITICAL |
| 14 | kernel_hardening | Weak sysctl | HIGH |
| 15 | process | Root process binary audit | CRITICAL |
| 16 | nfs | NFS export misconfigurations | CRITICAL |
| 17 | ld_preload | LD_PRELOAD/ld.so.conf audit | CRITICAL |

See docs/PROBES.md for rationale and false-positi.

---

Engine

The Truthimatics engine assigns each e chain one of three :

| | Meaning |
|---------|---------|
| DETERMINISTIC | Confirmed pri path |
| REJECT | No found by this probe |
| UNCERTAIN | Suspicious but not conclusive |

Risk is scored 0.0--10.0 (C) with per-finding, per-probe,
and system-wide labels: INFO / LOW / MEDIUM / HIGH / CRITICAL.

See docs/TRUTHIMATICS.md for the full specification.

---

Accuracy

Measured against a 37-target ground-truth corpus across two distros
(Kali WSL2 + Ubuntu 22.04 LTS multipass):

| Metric | Value |
|--------|-------|
| Detection recall | 1.000 (37/37) |
| Path recall | 0.943 (33/35) |
| Path precision | 0.971 (33/34) |
| False positives on planted targets | 0 |
| Brier score | 0.109 |
| Scan time (full) | 2.65 s |
| Obser | 353 |
| GTFOBins knowledge co | 0.8649 (32/37) |

Head-to-head (same Ubuntu 26.04 VM)

| Tool | | Scan time | Output |
|------|---------|-----------|--------|
| Z-Privesc | 1.0.0 | 2.65 s | 40 structured findings |
| Lynis | 3.1.6 | 100.45 s | 850 lines |
| LinPEAS | latest | 120.03 s | 378 lines |

(LinPEAS timings are capped at 120 s; unmeasured runs exceed that.)

See benchmarks.md for full methodology and
docs/E.md for reproduction.

---

Usage

| Flag | Description |
|------|-------------|
| --all | Run all 17 probes (default) |
| --probe=<name> | Run a single probe (repeatable) |
| --root=<dir> | Scan an alternate filesystem root (containers) |
| --json | Emit JSON audit report to stdout |
| --html | Emit HTML audit report to stdout |
| --quiet | Suppress progress output |
| -- | Enable debug logging |
| -- | Show and exit |
| --help | Show usage and exit |

Examples

Exit Codes

| Code | Meaning |
|------|---------|
| 0 | No pri paths found |
| 1 | Probe execution error |
| 2 | At least one DETERMINISTIC finding |
| 125 | Internal error |

---

Build & Install

Requirements

Commands

The binary is built as a Position Independent Executable with
-fstack-protector-strong, -D_FORTIFY_SOURCE=2, full RELRO,
-z now, and -Wl,--as-needed.

Compile-time Options

---

Testing

Quick Test (no root)

These don't need root and run in a few seconds.

Full Test Suite

Requires root for probing system state. The test suite covers:

| # | Test | What it tests |
|---|------|---------------|
| 1-58 | Unit tests (of 60 registered; 2 skip) | Probe logic, truthimatics engine, risk scoring |
| 1-37 | Integration tests | Real-world probes against ground-truth corpus |

---

Feature Comparison

| Capability | Z-Privesc | LinPEAS | Lynis |
|-----------|:---------:|:-------:|:-----:|
| Static binary, zero deps | Yes | No | No |
| Deterministic | Yes | No | No |
| C risk scoring | Yes | No | No |
| 17 categories out of the box | Yes | Broad | Broad |
| Machine-readable schema (JSON) | v1 | None | None |
| Per-finding remediation | Yes | Partial | No |
| Offline/air-gapped | Yes | Yes | Yes |
| License | MIT | GPL-3 | GPL |

---

Threat Model

In Scope

Out of Scope

---

Documentation

| File | Description |
|------|-------------|
| README.md | This file |
| docs/ARCHITECTURE.md | System design |
| docs/PROBES.md | Probe rationale and design |
| docs/TRUTHIMATICS.md | engine specification |
| docs/COMPOSITION.md | Exploitability graph |
| docs/E.md | Reproduction guide |
| benchmarks.md | Full benchmark data |
| docs/RELATED-WORK.md | Related work |
| docs/adr/ | Architecture Decision Records (4 docs) |
| man/z_privesc.1 | Man page |
| SECURITY.md | Security policy and reporting |
| CONTRIBUTING.md | How to contribute |
| CHANGELOG.md | Release history |
| ROADMAP.md | Future plans |
| HISTORY.md | De timeline |

---

Roadmap

v1 (current)

v2 (planned)

---

Security

Report security issues to
.
See SECURITY.md for disclosure policy.

---

License

MIT -- see LICENSE for the full text.

---

*Z-Privesc was built on WSL2 (Kali Linux, GCC 15.2.0), targeting Linux 5.4+.*
*Maintained by Di. Report issues at the issue tracker.*

项目信息

开发语言：C

Star 数：9

技术要点

该项目属于安全软件方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Linux privilege-escalation auditor — 17 probes, deterministic verdicts, 37/37 detection, 2.65s scan. Static C binary, zero deps, MIT.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。