Multi-architecture privilege escalation toolkit with 29 exploits (amd64 pre-built; other architectures compiled via gcc at runtime). Supports amd64, arm64, 386, mips, mipsle, mips64, and mips64le. Detects kernel version, filters patched exploits, and tries each in order until root is obtained.

# run directly (no gcc needed on target if pre-compiled binaries are embedded)
./lpe-toolkit

# dry-run: show exploit plan without executing
./lpe-toolkit --dry-run

# skip specific exploits
./lpe-toolkit --skip "dirtyfrag,dirtypipe"

# execute a command once root is achieved and show its output
./lpe-toolkit -c "id"

# silent automation: suppress all output except the command result
./lpe-toolkit -q -c "whoami"

# verbose output (includes exploit stdout/stderr)
./lpe-toolkit -v

Note: -v and -q are mutually exclusive — the toolkit exits with an error if both are specified.

# native build (pre-compile C exploits then embed in Go binary)
make

# cross-compile for all architectures (native arch's C exploits only)
make build-all

# run directly from source (compile exploits on target at runtime)
make run-source

# clean build artifacts
make clean

Requirements: Go 1.21+, gcc, and cross-compilers for target architectures:

• arm64: aarch64-linux-gnu-gcc
• 386: i686-linux-gnu-gcc
• mips: mips-linux-gnu-gcc
• mipsle: mipsel-linux-gnu-gcc
• mips64: mips64-linux-gnuabi64-gcc
• mips64le: mips64el-linux-gnuabi64-gcc

The --just-build flag resolves all usable exploits and prints their paths. Use it to verify what will be available at runtime.

The pre-compiled binary archive for each release includes a statically linked Go binary with embedded C exploits. All exploits are pre-compiled for all architectures.

• toolkit.go: Core exploit definitions, kernel version parsing, binary resolution, GTFOBins sudo abuse handler, execCommandAsRoot() for non-interactive command execution, msg()/say() verbosity helpers
• main.go: CLI entry point with flags (-c, -q, -v, --skip, --dry-run, --just-build) and signal handling
• build-exploits.sh: Cross-compilation script for C exploits
• exploits/: C source files and pre-compiled binaries embedded via //go:embed

• cve_2026_41651.c: Added Pack2TheRoot — raw D-Bus client (no libdbus) races PackageKit InstallFiles SIMULATE/NONE flags to trigger root-privileged postinst execution, drops setuid-root bash at /var/tmp/.suid_bash

• parseKernelVersion fixed: added parseIntPrefix to handle -rcN suffixes when comparing kernel versions

• bad_epoll.c rewritten with correct J-jaeyoung architecture: two epoll pairs, timerfd IRQ widening via 3000+ waiters, depth-3 oracle, acquire/release atomics on shared variables

• All exploits (including leak-only/PoC-only) now spawn a root shell or execute the requested command

• cve_2026_46333.c: Added try_passwd_root() — steals writable /etc/shadow fd from passwd, writes a known password hash, then spawns su -; falls back to leak-only methods

• cve_2025_38352.c: Added dirtypipe-style splice() overwrite of /etc/passwd → root::0:0: → spawns su -

• Command mode: Page-cache exploits use --corrupt-only to skip the interactive PTY bridge (also honored by refluxfs, crackarmor, skbshift, groflag, snapconfine); execCommandAsRoot() pipes the command to su stdin for shellcode-patched binaries (or SuStdin-flagged marker exploits), tries su - -c with an empty password for passwd-clearing exploits (RefluXFS), then a setuid helper shell (/var/tmp/.suid_bash, /var/tmp/cifswitch_rootsh), then falls back to sudo -n

• peditcow.c (CVE-2026-46331): tc-pedit page-cache write primitive overwrites su ELF entry with shellcode. v5.18–v7.1-rc6. Unprivileged user+net namespace gives CAP_NET_ADMIN.
• dirtyclone.c (CVE-2026-43503): DirtyClone Python port to C. ESP-in-UDP TEE netfilter target corrupts /etc/passwd. Self-contained AES-128-CBC implementation. v7.1-rc1–rc4.
• bad_epoll.c (CVE-2026-46242): Bad Epoll close-vs-close race UAF. Target-specific: default offsets target lts-6.12.67 (kernelCTF). Customize OFF_* and PIVOT* defines for your kernel. Requires /proc/kallsyms (kptr_restrict=0). Run on an unpatched kernel — the fix (commit a6dc643c6931, adds ep_clear_and_put) was backported to many distros including Ubuntu 22.04's 6.8 HWE.
• cve_2026_31694.c (CVE-2026-31694): FUSE readdir cache OOB write. Overflows 24 bytes into adjacent page-cache page to make /etc/passwd root passwordless. v6.15+. Requires fusermount3.

• refluxfs (CVE-2026-64600): XFS reflink CoW race clears the root password in seconds (Qualys PoC); -c runs commands via empty-password su.
• crackarmor (CVE-2026-23268+): AppArmor confused-deputy loads a sudo profile denying CAP_SETUID, triggering the sudo+Postfix fail-open to root; -c runs via sudo -n. Kernel-space paths (UAF/double-free) need per-target grooming and are not included.
• skbshift (CVE-2026-43503 TCP-SACK variant): missing SKBFL_SHARED_FRAG propagation in skb_shift() bypasses the Dirty Frag/Fragnesia patches; deterministic ESP-in-TCP byte-at-a-time su overwrite (~10s, v3.9–v7.1-rc4, all distros). -c runs via piped su (SuStdin).
• groflag (CVE-2026-43503 GRO variant): same primitive via skb_gro_receive() over veth; working PoC with in-loop verify (retry on partial write); also a container-escape angle. -c via piped su.
• snapconfine (CVE-2026-8933): set-capabilities snap-confine + FUSE/symlink/chmod races → udev PROGRAM rule → root command exec dropping a setuid bash; -c runs via the new setuid-helper fallback (also fixes -c for Pack2TheRoot/CIFSwitch helpers). Needs Ubuntu with set-cap snap-confine + firefox snap + FUSE + udevd.

Deliberately excluded: CVE-2026-80844/81000/68121/74469 (only heavily-groomed, target-pinned PoCs exist — exact kernels, vCPU/RAM shapes, destructive), CVE-2026-53362 (working chain needs CAP_NET_RAW + KVM/amdgpu stages; Debian/Ubuntu default is DoS-only), CVE-2026-53266 (no public weaponization), CVE-2026-3888 (10–30 day time-gated trigger).