Files

T

KaraZajac e457b22c1f release v0.9.9: install.sh needs no sudo + CVE metadata drift fix

install.sh never escalates to sudo. The installer defaulted to
/usr/local/bin and fell back to `sudo mv`, prompting for a password on
exactly the unprivileged accounts a privilege-escalation tool targets. It
now uses /usr/local/bin only when already writable and otherwise installs
to a per-user $HOME/.local/bin (honoring XDG_BIN_HOME), no sudo ever. An
explicit SKELETONKEY_PREFIX is honored and errors rather than escalating.
The documented one-liner prepends ~/.local/bin to PATH so it resolves on a
fresh login, and the quickstart drops the misleading sudo from --scan /
--audit / --auto.

CVE metadata drift (the failing weekly drift-check):
  - CVE-2022-0492 (cgroup_release_agent) entered CISA KEV 2026-06-02;
    corpus now 13 of 36 modules cover KEV-listed CVEs.
  - CVE-2026-46333 (ptrace_pidfd) gained CWE-269 from NVD (was unclassified
    at module-add time).
Refreshed CVE_METADATA.json, generated cve_metadata.c, and KEV_CROSSREF.md;
README + website KEV counts and version bumped to 0.9.9.

2026-06-08 10:16:24 -04:00

4.2 KiB

Raw Blame History

SKELETONKEY — launch post

Copy-pasteable for HN, lobste.rs, mastodon, blog. ~600 words.

SKELETONKEY: a curated Linux LPE corpus with detection rules baked in

The Linux privilege-escalation space is fragmented. Single-CVE PoC repos go stale within months. linux-exploit-suggester tells you what might work but doesn't run anything. auto-root-exploit and kernelpop bundle exploits but ship no detection signatures and haven't been maintained in years.

SKELETONKEY is one curated binary that:

Fingerprints the host's kernel / distro / sudo / userland.
Reports which of 28 bundled CVEs that host is still vulnerable to — covering 2016 through 2026.
With explicit --i-know authorization, runs the safest one and gets you root.
Ships matching auditd + sigma rules for every CVE so blue teams get the same coverage when they deploy it.

One command

curl -sSL https://github.com/KaraZajac/SKELETONKEY/releases/latest/download/install.sh | sh \
  && export PATH="$HOME/.local/bin:$PATH" \
  && skeletonkey --auto --i-know

--auto ranks vulnerable modules by exploit safety — structural escapes (no kernel state touched) first, then page-cache writes, then userspace cred-races, then kernel primitives, then kernel races last — and runs the safest match. If it fails it falls back gracefully and tells you the next candidates to try manually.

What's in the corpus

Userspace LPE: pwnkit (CVE-2021-4034), sudo Baron Samedit (CVE-2021-3156), sudoedit EDITOR escape (CVE-2023-22809)
Page-cache writes: dirty_pipe (CVE-2022-0847), dirty_cow (CVE-2016-5195), copy_fail family (CVE-2026-31431, 43284, 43500)
Container/namespace: cgroup_release_agent (CVE-2022-0492), overlayfs (CVE-2021-3493), overlayfs_setuid (CVE-2023-0386), fuse_legacy (CVE-2022-0185)
Kernel primitives: netfilter (4 CVEs from 2022→2024), af_packet (CVE-2017-7308, CVE-2020-14386), cls_route4 (CVE-2022-2588), netfilter_xtcompat (CVE-2021-22555)
Kernel races: stackrot (CVE-2023-3269), af_unix_gc (CVE-2023-4622), Sequoia (CVE-2021-33909)
Side channels: EntryBleed kbase leak (CVE-2023-0458)
Graphics: vmwgfx DRM OOB (CVE-2023-2008)
Userspace classic: PTRACE_TRACEME (CVE-2019-13272)

Full inventory at CVES.md.

The verified-vs-claimed bar

Most public PoC repos hardcode offsets for one kernel build and silently break elsewhere. SKELETONKEY refuses to ship fabricated offsets. Modules with a kernel primitive but no per-kernel cred-overwrite chain default to firing the primitive + grooming the slab + recording an empirical witness, then return EXPLOIT_FAIL honestly. The opt-in --full-chain engages the shared modprobe_path finisher with sentinel-arbitrated success (it only claims root when a setuid bash actually materializes).

When --full-chain needs kernel offsets, you populate them once on a target kernel via skeletonkey --dump-offsets (parses /proc/kallsyms or /boot/System.map) and either set env vars or upstream the entry to core/offsets.c kernel_table[] via PR.

For each side of the house

Red team: stop curating broken PoCs. One tested binary, fresh releases, honest scope reporting.
Sysadmins: one command, no SaaS, JSON output for CI gates. Fleet-scan tool included.
Blue team: skeletonkey --detect-rules --format=auditd | sudo tee /etc/audit/rules.d/99-skeletonkey.rules and you have coverage for every CVE in the bundle. Sigma + YARA + Falco output also supported.

Status + roadmap

v0.5.0 today: 28 modules, all build clean on Debian 13 / kernel 6.12, all refuse-on-patched verified. The embedded offset table is empty — operator-populated. Next: empirical validation on a multi-distro vuln-kernel VM matrix, then offset-table community seeding for common cloud builds.

MIT. Each module credits the original CVE reporter and PoC author in its NOTICE.md. The research credit belongs to the people who found the bugs; SKELETONKEY is the bundling layer.

Repo: https://github.com/KaraZajac/SKELETONKEY Release: https://github.com/KaraZajac/SKELETONKEY/releases/latest

Authorized testing only. Read docs/ETHICS.md before you point this at anything you don't own.

4.2 KiB Raw Blame History