E-LIN
Linux Exploit Suggester
Suggests known Linux kernel and package privilege-escalation exploits based on version and patch level.
OVERVIEW
Linux Exploit Suggester (les.sh) fingerprints the target's kernel version and installed package versions, then cross-references them against a curated database of known local privilege-escalation and container-breakout CVEs, reporting which public exploits are likely to apply and, for many entries, a direct download link to the proof-of-concept.
It runs as a single Bash script with no dependencies beyond standard Unix tools, so it can be dropped onto almost any Linux target — including minimal containers — without installing anything, and includes a --checksec-like mode to also flag missing kernel-hardening mitigations.
USE CASES
Practical use cases
- 01
Getting a quick, version-accurate shortlist of known kernel privesc exploits after landing a shell.
- 02
Prioritizing which public exploit or PoC to try first instead of testing every known CVE against the host.
- 03
Checking a container or minimal Linux host for kernel-level breakout vulnerabilities.
- 04
Cross-checking a client's patch-management claims against the kernel and packages actually installed.
QUICK START
On a Linux host with a shell already established, to match kernel and package versions against known privilege-escalation exploits before searching manually.
- Get an initial shell (any privilege level) on the target Linux host.
- Transfer linux-exploit-suggester.sh to the target, or pipe it directly over an authorized channel.
- Run it with no arguments to fingerprint the kernel and list matching known exploits.
- Validate the top candidate exploit manually, ideally against a matching test VM, before relying on the suggestion.
./linux-exploit-suggester.shBEFORE YOU RUN IT
What to check before running it
It only reports what's in its curated CVE database as of the last update — cross-check findings against current advisories for kernels newer than that.
A version match doesn't guarantee the exploit works: distro backports often patch a CVE without bumping the reported kernel version, so treat every hit as a lead, not a confirmed finding.
Running an unfamiliar public kernel exploit can crash or panic the target — test against a matching disposable VM before running it on a live host.