Auto-merge PR #724 (Chack Agent)

Co-authored-by: HackTricks News Bot <[email protected]>

linPEAS/README.md

@@ -104,6 +104,8 @@ This script doesn't have any dependency.
 
 ### Recent updates
 
+- **Sep 2026**: SUID/SGID enumeration now highlights privileged files in user-writable or unusual locations, replaceable parent directories, non-root ownership, and recent changes in unusual locations. High-risk file-capability combinations now include common interpreters and DAC-bypass tools.
+
 - **Dec 2025**: Added detection for sudo configurations that expose restic's `--password-command` helper, a common privilege escalation vector observed in real environments.
 
 - **Feb 2026**: Added a reminder that `linpeas` can be run with `-o` to execute targeted checks in long-running audits.

linPEAS/builder/linpeas_parts/8_interesting_perms_files/1_SUID.sh

@@ -1,15 +1,15 @@
 # Title: Interesting Permissions Files - SUID
 # ID: IP_SUID
-# Author: Carlos Polop
-# Last Update: 22-08-2023
-# Description: SUID - Check easy privesc, exploits and write perms
+# Author: Carlos Polop, HT Bot
+# Last Update: 25-09-2026
+# Description: SUID - Check easy privesc, exploits, write perms, and risky file placement
 # License: GNU GPL
-# Version: 1.0
+# Version: 1.1
 # Mitre: T1548.001
 # Functions Used: echo_not_found, print_2title, print_info
 # Global Variables: $IAMROOT, $LDD, $ROOT_FOLDER, $READELF, $sidB, $sidG1, $sidG2, $sidG3, $sidG4, $sidVB, $sidVB2, $STRACE, $STRINGS, $TIMEOUT, $Wfolders, $cfuncs
 # Initial Functions:
-# Generated Global Variables: $suids_files, $sname, $sline_first, $sline, $OLD_LD_LIBRARY_PATH, $LD_LIBRARY_PATH
+# Generated Global Variables: $suids_files, $sfile, $sname, $sowner, $sparent, $sunusual, $sline_first, $sline, $OLD_LD_LIBRARY_PATH, $LD_LIBRARY_PATH
 # Fat linpeas: 0
 # Small linpeas: 1
 
@@ -23,13 +23,15 @@ if ! [ "$STRACE" ]; then
   echo_not_found "strace"
 fi
 suids_files=$(find $ROOT_FOLDER -perm -4000 -type f ! -path "/dev/*" 2>/dev/null)
-printf "%s\n" "$suids_files" | while read s; do
-  [ -z "$s" ] && continue
-  s=$(ls -lahtr "$s")
+printf "%s\n" "$suids_files" | while IFS= read -r sfile; do
+  [ -z "$sfile" ] && continue
+  s=$(ls -lahtr "$sfile")
   #If starts like "total 332K" then no SUID bin was found and xargs just executed "ls" in the current folder
   if echo "$s" | grep -qE "^total"; then break; fi
 
-  sname="$(echo $s | awk '{print $9}')"
+  # Keep the path returned by find: parsing it from ls output breaks on whitespace.
+  sname="$sfile"
+  sowner="$(echo "$s" | awk '{print $3}')"
   if [ "$sname" = "."  ] || [ "$sname" = ".."  ]; then
     true #Don't do nothing
   elif ! [ "$IAMROOT" ] && [ -O "$sname" ]; then
@@ -99,5 +101,26 @@ printf "%s\n" "$suids_files" | while read s; do
       fi
     fi
   fi
+
+  # A privileged file in a user-controlled location is especially suspicious.
+  # Reuse the SUID enumeration above instead of performing another filesystem scan.
+  sunusual=""
+  case "$sname" in
+    "${ROOT_FOLDER}tmp/"*|"${ROOT_FOLDER}var/tmp/"*|"${ROOT_FOLDER}dev/shm/"*|"${ROOT_FOLDER}run/user/"*|"${ROOT_FOLDER}var/run/user/"*|"${ROOT_FOLDER}home/"*)
+      echo "SUID file in a user-writable or unusual location: $sname" | sed -${E} "s,.*,${SED_RED_YELLOW},"
+      sunusual="1"
+      ;;
+  esac
+
+  sparent="$(dirname "$sname")"
+  if ! [ "$IAMROOT" ] && [ -d "$sparent" ] && [ -w "$sparent" ] && [ -x "$sparent" ] && ! [ -k "$sparent" ]; then
+    echo "You can replace entries in the SUID file's parent directory: $sparent" | sed -${E} "s,.*,${SED_RED_YELLOW},"
+  fi
+  if [ "$sowner" ] && [ "$sowner" != "root" ]; then
+    echo "SUID file is owned by non-root user $sowner: $sname" | sed -${E} "s,.*,${SED_RED},"
+  fi
+  if [ "$sunusual" ] && find "$sname" -mtime -7 -print 2>/dev/null | grep -q .; then
+    echo "SUID file in an unusual location was modified in the last 7 days: $sname" | sed -${E} "s,.*,${SED_RED},"
+  fi
 done;
 echo ""

linPEAS/builder/linpeas_parts/8_interesting_perms_files/2_SGID.sh

@@ -1,15 +1,15 @@
 # Title: Interesting Permissions Files - SGID
 # ID: IP_SGID
-# Author: Carlos Polop
-# Last Update: 22-08-2023
-# Description: SGID
+# Author: Carlos Polop, HT Bot
+# Last Update: 25-09-2026
+# Description: SGID - Check easy privesc, write perms, and risky file placement
 # License: GNU GPL
-# Version: 1.0
+# Version: 1.1
 # Mitre: T1548.001
 # Functions Used: print_2title, print_info
 # Global Variables: $cfuncs, $IAMROOT, $LDD, $READELF, $ROOT_FOLDER, $sidB, $sidG1, $sidG2, $sidG3, $sidG4, $sidVB, $sidVB2, $STRACE, $STRINGS, $TIMEOUT, $Wfolders
 # Initial Functions:
-# Generated Global Variables: $sgids_files, $sname, $sline_first, $sline, $LD_LIBRARY_PATH, $OLD_LD_LIBRARY_PATH
+# Generated Global Variables: $sgids_files, $sfile, $sname, $sowner, $sparent, $sunusual, $sline_first, $sline, $LD_LIBRARY_PATH, $OLD_LD_LIBRARY_PATH
 # Fat linpeas: 0
 # Small linpeas: 1
 
@@ -17,13 +17,15 @@
 print_2title "SGID" "T1548.001"
 print_info "https://book.hacktricks.wiki/en/linux-hardening/linux-basics/linux-privilege-escalation/index.html#sudo-and-suid"
 sgids_files=$(find $ROOT_FOLDER -perm -2000 -type f ! -path "/dev/*" 2>/dev/null)
-printf "%s\n" "$sgids_files" | while read s; do
-  [ -z "$s" ] && continue
-  s=$(ls -lahtr "$s")
+printf "%s\n" "$sgids_files" | while IFS= read -r sfile; do
+  [ -z "$sfile" ] && continue
+  s=$(ls -lahtr "$sfile")
   #If starts like "total 332K" then no SUID bin was found and xargs just executed "ls" in the current folder
   if echo "$s" | grep -qE "^total";then break; fi
 
-  sname="$(echo $s | awk '{print $9}')"
+  # Keep the path returned by find: parsing it from ls output breaks on whitespace.
+  sname="$sfile"
+  sowner="$(echo "$s" | awk '{print $3}')"
   if [ "$sname" = "."  ] || [ "$sname" = ".."  ]; then
     true #Don't do nothing
   elif ! [ "$IAMROOT" ] && [ -O "$sname" ]; then
@@ -93,5 +95,26 @@ printf "%s\n" "$sgids_files" | while read s; do
       fi
     fi
   fi
+
+  # A privileged file in a user-controlled location is especially suspicious.
+  # Reuse the SGID enumeration above instead of performing another filesystem scan.
+  sunusual=""
+  case "$sname" in
+    "${ROOT_FOLDER}tmp/"*|"${ROOT_FOLDER}var/tmp/"*|"${ROOT_FOLDER}dev/shm/"*|"${ROOT_FOLDER}run/user/"*|"${ROOT_FOLDER}var/run/user/"*|"${ROOT_FOLDER}home/"*)
+      echo "SGID file in a user-writable or unusual location: $sname" | sed -${E} "s,.*,${SED_RED_YELLOW},"
+      sunusual="1"
+      ;;
+  esac
+
+  sparent="$(dirname "$sname")"
+  if ! [ "$IAMROOT" ] && [ -d "$sparent" ] && [ -w "$sparent" ] && [ -x "$sparent" ] && ! [ -k "$sparent" ]; then
+    echo "You can replace entries in the SGID file's parent directory: $sparent" | sed -${E} "s,.*,${SED_RED_YELLOW},"
+  fi
+  if [ "$sowner" ] && [ "$sowner" != "root" ]; then
+    echo "SGID file is owned by non-root user $sowner: $sname" | sed -${E} "s,.*,${SED_RED},"
+  fi
+  if [ "$sunusual" ] && find "$sname" -mtime -7 -print 2>/dev/null | grep -q .; then
+    echo "SGID file in an unusual location was modified in the last 7 days: $sname" | sed -${E} "s,.*,${SED_RED},"
+  fi
 done;
 echo ""

linPEAS/builder/linpeas_parts/variables/capsVB.sh

@@ -1,10 +1,10 @@
 # Title: Variables - capsVB
 # ID: capsVB
-# Author: Carlos Polop
-# Last Update: 22-08-2023
-# Description: Very dangerous capabilities to search
+# Author: Carlos Polop, HT Bot
+# Last Update: 25-09-2026
+# Description: Very dangerous capability and executable combinations to search
 # License: GNU GPL
-# Version: 1.0
+# Version: 1.1
 # Functions Used:
 # Global Variables:
 # Initial Functions:
@@ -13,10 +13,11 @@
 # Small linpeas: 1
 
 
-capsVB="cap_sys_admin:mount|python \
+capsVB="cap_sys_admin:mount|python|perl|ruby|php|node|lua|bash \
 cap_sys_ptrace:python \
 cap_sys_module:kmod|python \
-cap_dac_override:python|vim \
+cap_dac_override:python|perl|ruby|php|node|lua|bash|vim|cp|dd \
+cap_dac_read_search:python|perl|ruby|php|node|lua|bash|vim|cp|dd|tar \
 cap_chown:chown|python \
 cap_fowner:chown|python \
 cap_setfcap:python|perl|ruby|php|node|lua|bash \