LinEsc.sh

#!/bin/bash
#
# A script designed to help aid in the process of escalating a user privalage to root!
#
#
# Usage = ./LinEsc
#
# Leon Teale (@leonteale)

## Setting Coloured variables
red=`echo -e "\033[31m"`
lcyan=`echo -e "\033[36m"`
yellow=`echo -e "\033[33m"`
green=`echo -e "\033[32m"`
blue=`echo -e "\033[34m"`
purple=`echo -e "\033[35m"`
normal=`echo -e "\033[m"`

#Funcetions
header () {
            clear
            echo "$yellow  _      _       ______          "
            echo " | |    (_)     |  ____|         "
            echo " | |     _ _ __ | |__   ___  ___ "
            echo " | |    | | '_ \|  __| / __|/ __|"
            echo " | |____| | | | | |____\__ \ (__ "
            echo " |______|_|_| |_|______|___/\___|$normal"
            echo " "
            echo "A script designed to aid the process of escilating user privalage to root"
            echo ""
        }



# Check that the user isnt  already root or running script as root
sudo_check () {
    if [ "$(id -u)" == "0" ]; then
        echo "$green You  already have root access! :D$normal" 1>&2
        exit 1
        echo ""
    fi
}

info () {
            echo "$yellow Current User$normal :  `whoami`"
            echo "$yellow uid/gid/group$normal:  `id 2>/dev/null`"
            echo "$yellow System  Info$normal :  `uname -a`"
            echo "$yellow Distribution$normal :  `cat /etc/issue`"
            echo "$yellow Hostname $normal    :  `hostname`"
            echo ""
}

# Check to see what sudo access the user has been granted
sudo_script_access  () {
                        CAN_I_RUN_SUDO=$(sudo -n uptime 2>&1|grep "load"|wc -l)
                        if [ ${CAN_I_RUN_SUDO} -gt 0 ]; then
                            if  sudo -l  | grep "may run the following commands on this host" 2>/dev/null;  then
                                echo "This user has access to $green"
                                sudo -l | grep root
                                echo "$normal"
                            fi
                        else
                            echo "$red  Current user has no sudo access$normal"
                            echo ""
                        fi
}

# Check for suid files
suid () {
            if  find / -perm -4000 -type f 2>/dev/null | grep -w 'nmap\|perl\|'awk'\|'find'\|'bash'\|'sh'\|'man'\|'more'\|'less'\|'vi'\|'vim'\|'nc'\|'netcat'\|python\|ruby\|lua\|irb\|pl'  ; then
                echo "$yellow  Possibly  interesting suid files: $green"
                find / -perm -4000 -type f 2>/dev/null | grep -w 'nmap\|perl\|'awk'\|'find'\|'bash'\|'sh'\|'man'\|'more'\|'less'\|'vi'\|'vim'\|'nc'\|'netcat'\|python\|ruby\|lua\|irb\|pl'
                echo "$normal"
            fi
                echo "$yellow uid files found$normal"
                find / -xdev \( -perm -4000 \) -type f -print0 2>/dev/null | xargs -0 ls -l
                echo ""
        }

# Check for world writable and executable files
wre () {
            echo "$yellow world writable & executable files found$normal"
            find / -perm -0002  -type f 2>/dev/null | grep -vE 'proc'
            echo " "
       }

# Check /etc/passwd for passwords
passwd () {
            passwd_check=$(cat /etc/passwd | cut -d : -f 2 |  grep  -vE 'x' | wc -l)
                if [ ${passwd_check} -gt 0 ]; then
                    echo "$yellow Possible password(s) found in /etc/passwd$green"
                    grep `cat /etc/passwd | cut -d : -f 2 |  grep  -w -vE 'x'` /etc/passwd
                    echo "$normal"
                fi
}

file_access () {
echo ""

}



# Run the script
header
sudo_check
info
sudo_script_access
suid
wre
passwd