lpe-toolkit - Multi-architecture Linux privilege escalation tool

项目说明

Linux LPE Toolkit

Multi-architecture pri escalation toolkit with 29 exploits (amd64 pre-built; other architectures compiled via gcc at runtime). Supports amd64, arm64, 386, mips, mipsle, mips64, and mips64le. Detects kernel , filters patched exploits, and tries each in order until root is obtained.

Quick Start

Usage

| Flag | Description |
|------|-------------|
| --dry-run | Show which exploits are a/skipped |
| --just-build | Resolve all exploits, print paths, exit (useful for packaging) |
| --skip LIST | Comma-separated exploit names to skip |
| -c, --command CMD | Execute CMD as root instead of spawning an interacti |
| -q, --quiet | Suppress toolkit messages; only show root shell output or unsuccessful in getting root |
| -v, -- | Include exploit stdout/stderr in output (mutually exclusive with -q) |

Note: -v and -q are mutually exclusive — the toolkit exits with an error if both are specified.

Exploits

| # | Name | Target | Type |
|---|------|--------|------|
| 1 | Copy Fail C | AF_ALG + splice page-cache write | pre-built / compile |
| 2 | Dirty Frag C | xfrm-ESP/RxRPC page-cache write | pre-built / compile |
| 3 | Fragnesia C | espintcp splice page-cache corruption | pre-built / compile |
| 4 | DirtyDecrypt C | rxgk pagecache write | pre-built / compile |
| 5 | Fragnesia v2 | skb_segment GRO coalesce | pre-built / compile |
| 6 | PinTheft | RDS zerocopy + io_uring page-cache o | pre-built / compile |
| 7 | Dirty Pipe C | /etc/passwd page-cache o | pre-built / compile |
| 8 | CIFSwitch C | cifs.spnego + NSS namespace confusion | pre-built / compile |
| 9 | PwnKit C | pkexec en escape | pre-built / compile |
| 10 | O C | user-ns mount escape | pre-built / compile |
| 11 | OvFS+FUSE C | FUSE mount escape | pre-built / compile |
| 12 | Pack2TheRoot C | PackageKit D-Bus race → setuid root | pre-built / compile |
| 13 | Polkit D-Bus C | accounts-daemon race | pre-built / compile |
| 14 | Docker Socket | writable /var/run/docker.sock | pre-built / compile |
| 15 | netfilter OOB C | ip_tables corruption | pre-built / compile |
| 16 | nft UAF2 C | nftables chain UAF | pre-built / compile |
| 17 | pidfd race C | ssh-keysign/shadow FD theft | pre-built / compile |
| 18 | CPU Timer Race C | POSIX timer race (PoC) | pre-built / compile |
| 19 | nft UAF C | Notselwyn multi-file nftables | pre-built / compile |
| 20 | PEdit COW C | tc-pedit page-cache o su | pre-built / compile |
| 21 | DirtyClone C | ESP-in-UDP TEE page-cache passwd | pre-built / compile |
| 22 | Bad Epoll C | epoll close- race UAF | pre-built / compile |
| 23 | FUSE OOB C | FUSE readdir cache OOB -> passwd | pre-built / compile |
| 24 | RefluXFS C | XFS reflink CoW race -> passwd o | pre-built / compile |
| 25 | CrackArmor C+ | AppArmor confused-deputy -> sudo root | pre-built / compile |
| 26 | skb_shift C | TCP SACK flag loss -> ESP page-cache su | pre-built / compile |
| 27 | GRO Flag Loss C | GRO coalesce flag loss -> ESP page-cache su | pre-built / compile |
| 28 | snap-confine C | set-cap race -> udev rule -> setuid bash | pre-built / compile |
| 29 | GTFOBins | 80+ passwordless sudo techniques | go-handler |

Build from Source

Requirements: Go 1.21+, gcc, and cross-compilers for target architectures:

Pre-Compiled Binary Packaging

The --just-build flag resolves all usable exploits and prints their paths. Use it to what will be a at runtime.

The pre-compiled binary archive for each release includes a statically linked Go binary with embedded C exploits. All exploits are pre-compiled for all architectures.

Architecture

Notable Changes

New Exploits Added

2026 LPEs added (all end-to-end, no per-target grooming)

Deliberately excluded: C/81000/68121/74469 (only hea, target-pinned PoCs exist — exact kernels, vCPU/RAM shapes, destructive), C (working chain needs CAP_NET_RAW + K stages; Debian/Ubuntu default is DoS-only), C (no public weaponization), C (10–30 day time-gated trigger).

项目信息

开发语言：C

Star 数：404

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Multi-architecture Linux privilege escalation toolkit with 29 pre-built and runtime-compilable exploits. Auto-detects kernel version, filters patched exploits, tries each until root.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。