What does this tool do?
The Unix Privilege Escalation Reference is a searchable catalogue of ~45 Unix/Linux binaries and techniques for privilege escalation, each with an explanation of why it works. Tools like find, vim, awk, python, perl, bash, tar, gdb, docker, systemctl, nmap and less are grouped by function — shell escape, sudo abuse, SUID, Linux capabilities, LD_PRELOAD and root file read/write. Everything runs in your browser with no data sent to any server; it is intended for authorized testing and educational use only.
How to use it
- Enter your listener IP and port.
- Pick the command or payload that fits your setup.
- Copy it and use it only on systems you are authorized to test.
Typical workflow
After landing a shell, enumerate first: 'sudo -l' for commands you can run without a password, 'find / -perm -4000 -type f 2>/dev/null' for SUID binaries, and 'getcap -r / 2>/dev/null' for files with capabilities. Search the resulting binary name in this reference to see, GTFOBins-style, which function (Shell, Sudo, SUID, Capabilities, File read/write) escalates it to root and the exact ready-to-run command.
Why these techniques work
Most rely on a privileged program handing the user arbitrary command or file access. A SUID 'find . -exec /bin/sh -p \; -quit' spawns a shell with the file owner's (root's) privileges; a Python binary with 'cap_setuid' resets the UID via 'os.setuid(0)'. LD_PRELOAD abuse loads your own shared library into a binary run through sudo when the 'env_keep' option leaks LD_PRELOAD.
Frequently asked questions
How do I find SUID binaries?
Run 'find / -perm -4000 -type f 2>/dev/null' to list every file with the set-uid bit; use '-perm -2000' for SGID. Compare the output against known-safe binaries and search the rest here — passwd, su and sudo are normal, but an unusual SUID binary like nmap, vim or base64 is often a quick path to root.
What are Linux capabilities and why do they matter?
Capabilities are fine-grained privileges that split root's power into pieces without granting it fully — 'cap_setuid' allows changing the UID, 'cap_dac_read_search' allows reading any file. List them with 'getcap -r / 2>/dev/null'; they are a quiet escalation vector because they are easily missed when you only check for SUID bits.
What is the difference between sudo and SUID exploitation?
Sudo exploitation abuses specific commands granted to you in 'sudo -l' output (e.g. ':!sh' from inside 'sudo vim') and usually needs a password or explicit authorization. SUID exploitation targets any on-disk binary owned by root that carries the set-uid bit, independent of sudo config; the '-p' flag is often required so the spawned shell keeps the elevated privilege instead of dropping it.
Is Unix Privilege Escalation Reference free?
Yes. Unix Privilege Escalation Reference and all 300+ tools on MagmaNex are completely free with no signup or account required.
Is my data safe?
Yes. Everything runs locally in your browser. The data you enter is never sent to a server, stored, or shared.
Does it work on mobile?
Yes. Unix Privilege Escalation Reference works on phones, tablets and desktops — no app download needed.
🔒 Privacy: everything runs in your browser, your data is never sent to a server.