SKELETONKEY — Curated Linux LPE corpus with detection rules

Why this exists

Most Linux privesc tooling is broken in one of three ways:

linux-exploit-suggester / linpeas — tell you what might work, run nothing
auto-root-exploit / kernelpop — bundle exploits but ship no detection signatures and went stale years ago
Per-CVE PoC repos — one author, one distro, abandoned within months

SKELETONKEY is one binary, actively maintained, with detection rules for every CVE it bundles — same project for red and blue teams.

Corpus at a glance

28 verified modules

14 🟢 land root by default

14 🟡 primitive + opt-in chain

10y 2016 → 2026 coverage

🟢 Lands root on a vulnerable host

Structural exploits + page-cache writes. No per-kernel offsets needed.

copy_fail copy_fail_gcm dirty_frag_esp dirty_frag_esp6 dirty_frag_rxrpc dirty_pipe dirty_cow pwnkit overlayfs overlayfs_setuid cgroup_release_agent ptrace_traceme sudoedit_editor entrybleed

🟡 Fires kernel primitive · opt-in `--full-chain`

Default returns EXPLOIT_FAIL honestly. With --full-chain + resolved offsets, runs the shared modprobe_path finisher.

nf_tables nft_set_uaf nft_fwd_dup nft_payload netfilter_xtcompat af_packet af_packet2 af_unix_gc cls_route4 fuse_legacy stackrot sudo_samedit sequoia vmwgfx

Who it's for

🔴 Red team / pentesters

One tested binary. --auto ranks vulnerable modules by safety and runs the safest. Honest scope reporting — never claims root it didn't actually get. No more curating stale PoC repos.

🔵 Blue team / SOC

Auditd + sigma + yara + falco rules for every CVE. One command ships SIEM coverage: --detect-rules --format=auditd | sudo tee /etc/audit/rules.d/99-skeletonkey.rules.

🛠 Sysadmins

skeletonkey --scan (no sudo needed) tells you which boxes still need patching. JSON output for CI gates. Fleet-scan tool included. No SaaS, no telemetry.

🎓 CTF / training

Reproducible LPE environment with public CVEs across a 10-year timeline. Each module documents the bug, the trigger, and the fix. Detection rules let you practice both sides.

What it looks like

--auto on a vulnerable Ubuntu 22.04 box:

$ id
uid=1000(kara) gid=1000(kara) groups=1000(kara)

$ skeletonkey --auto --i-know
[*] auto: host=demo kernel=5.15.0-56-generic arch=x86_64
[*] auto: scanning 31 modules for vulnerabilities...
[+] auto: dirty_pipe             VULNERABLE (safety rank 90)
[+] auto: cgroup_release_agent   VULNERABLE (safety rank 98)
[+] auto: pwnkit                 VULNERABLE (safety rank 100)

[*] auto: 3 vulnerable modules found. Safest is 'pwnkit' (rank 100).
[*] auto: launching --exploit pwnkit...

[+] pwnkit: writing gconv-modules cache + payload.so...
[+] pwnkit: execve(pkexec) with NULL argv + crafted envp...
# id
uid=0(root) gid=0(root) groups=0(root)

Safety ranking goes structural escapes → page-cache writes → userspace cred-races → kernel primitives → kernel races. The goal is to never crash a production box looking for root.

The verified-vs-claimed bar

Most public PoC repos hardcode offsets for one kernel build and silently break elsewhere. SKELETONKEY refuses to ship fabricated offsets.

The shared --full-chain finisher returns EXPLOIT_OK only when a setuid bash sentinel file actually appears
Modules with a primitive but no portable cred-overwrite chain default to firing the primitive + grooming the slab + recording a witness, then return EXPLOIT_FAIL with diagnostic
Operators populate the offset table once per kernel via skeletonkey --dump-offsets (parses /proc/kallsyms or /boot/System.map) and upstream the entry via PR — see CONTRIBUTING.md

Quickstart commands

# Install (x86_64 / arm64; checksum-verified)
$ curl -sSL https://github.com/KaraZajac/SKELETONKEY/releases/latest/download/install.sh | sh

# What's this box vulnerable to?  (no sudo)
$ skeletonkey --scan

# Pick the safest LPE and run it
$ skeletonkey --auto --i-know

# Deploy detection rules (needs sudo to write into /etc/audit/rules.d/)
$ skeletonkey --detect-rules --format=auditd \
    | sudo tee /etc/audit/rules.d/99-skeletonkey.rules

# Fleet scan — many hosts via SSH, aggregated JSON for SIEM
$ ./tools/skeletonkey-fleet-scan.sh --binary skeletonkey \
    --ssh-key ~/.ssh/id_rsa hosts.txt

Status

v0.5.0 cut 2026-05-17. 28 verified modules build clean on Debian 13 (kernel 6.12) and refuse cleanly on patched hosts; 3 further modules (dirtydecrypt, fragnesia, pack2theroot) are ported from public PoCs but not yet VM-verified. Empirical end-to-end validation on a vulnerable-kernel VM matrix is the next roadmap item; until then, the corpus is best understood as "compiles + detects + structurally correct + honest on failure."

Read the roadmap How to contribute