Linux LPE Toolkit

Multi-architecture privilege escalation toolkit with 24 exploits (amd64 pre-built; other architectures compiled via gcc at runtime). Supports amd64, arm64, 386, mips, mipsle, mips64, and mips64le. Detects kernel version, filters patched exploits, and tries each in order until root is obtained.

Quick Start

# run directly (no gcc needed on target if pre-compiled binaries are embedded)
./lpe-toolkit

# dry-run: show exploit plan without executing
./lpe-toolkit --dry-run

# skip specific exploits
./lpe-toolkit --skip "dirtyfrag,dirtypipe"

# execute a command once root is achieved and show its output
./lpe-toolkit -c "id"

# silent automation: suppress all output except the command result
./lpe-toolkit -q -c "whoami"

# verbose output (includes exploit stdout/stderr)
./lpe-toolkit -v

Usage

Note: -v and -q are mutually exclusive — the toolkit exits with an error if both are specified.

Exploits

Build from Source

# native build (pre-compile C exploits then embed in Go binary)
make

# cross-compile for all architectures (native arch's C exploits only)
make build-all

# run directly from source (compile exploits on target at runtime)
make run-source

# clean build artifacts
make clean

Requirements: Go 1.21+, gcc, and cross-compilers for target architectures:

• arm64: aarch64-linux-gnu-gcc
• 386: i686-linux-gnu-gcc
• mips: mips-linux-gnu-gcc
• mipsle: mipsel-linux-gnu-gcc
• mips64: mips64-linux-gnuabi64-gcc
• mips64le: mips64el-linux-gnuabi64-gcc

Pre-Compiled Binary Packaging

The --just-build flag resolves all usable exploits and prints their paths. Use it to verify what will be available at runtime.

The pre-compiled binary archive for each release includes a statically linked Go binary with embedded C exploits. All exploits are pre-compiled for all architectures.

Architecture

• toolkit.go: Core exploit definitions, kernel version parsing, binary resolution, GTFOBins sudo abuse handler, execCommandAsRoot() for non-interactive command execution, msg()/say() verbosity helpers
• main.go: CLI entry point with flags (-c, -q, -v, --skip, --dry-run, --just-build) and signal handling
• build-exploits.sh: Cross-compilation script for C exploits
• exploits/: C source files and pre-compiled binaries embedded via //go:embed

Notable Changes

• cve_2026_41651.c: Added Pack2TheRoot — raw D-Bus client (no libdbus) races PackageKit InstallFiles SIMULATE/NONE flags to trigger root-privileged postinst execution, drops setuid-root bash at /var/tmp/.suid_bash

• parseKernelVersion fixed: added parseIntPrefix to handle -rcN suffixes when comparing kernel versions

• bad_epoll.c rewritten with correct J-jaeyoung architecture: two epoll pairs, timerfd IRQ widening via 3000+ waiters, depth-3 oracle, acquire/release atomics on shared variables

• All exploits (including leak-only/PoC-only) now spawn a root shell or execute the requested command

• cve_2026_46333.c: Added try_passwd_root() — steals writable /etc/shadow fd from passwd, writes a known password hash, then spawns su -; falls back to leak-only methods

• cve_2025_38352.c: Added dirtypipe-style splice() overwrite of → → spawns

New Exploits Added

• peditcow.c (CVE-2026-46331): tc-pedit page-cache write primitive overwrites su ELF entry with shellcode. v5.18–v7.1-rc6. Unprivileged user+net namespace gives CAP_NET_ADMIN.
• dirtyclone.c (CVE-2026-43503): DirtyClone Python port to C. ESP-in-UDP TEE netfilter target corrupts /etc/passwd. Self-contained AES-128-CBC implementation. v7.1-rc1–rc4.
• bad_epoll.c (CVE-2026-46242): Bad Epoll close-vs-close race UAF. Target-specific: default offsets target lts-6.12.67 (kernelCTF). Customize OFF_* and PIVOT* defines for your kernel. Requires /proc/kallsyms (kptr_restrict=0). Run on an unpatched kernel — the fix (commit a6dc643c6931, adds ep_clear_and_put) was backported to many distros including Ubuntu 22.04's 6.8 HWE.
• cve_2026_31694.c (CVE-2026-31694): FUSE readdir cache OOB write. Overflows 24 bytes into adjacent page-cache page to make /etc/passwd root passwordless. v6.15+. Requires fusermount3.