privesc - simple multi-platform privilege escalation library

55 points M0d3x 16 comments

Hey all!

As a part of my work on Quincy (VPN based on the QUIC protocol), I was very frustrated with the current state of multi-platform privilege escalation libraries on crates.io. There is runas, but it does not provide a good way to simply .spawn the command (e.g. not wait for its output immediately). There are some platform-specific libraries, such as windows-elevate, but I was looking for a singular dependency that would handle privilege escalation in a multi-platform manner, instead of multiple libraries with different interfaces.

This is why I decided to implement my own, small and multi-platform, library for privilege escalation - privesc.

The interface was kept relatively simple, similar to Command from std::process:

use privesc::PrivilegedCommand;

// wait immediately for output
let output = PrivilegedCommand::new("/usr/bin/cat")
    .args(["/etc/shadow", "/etc/passwd"])
    .gui(true)
    .prompt("Reading protected files")
    .run()?;

// spawn the command and wait for output later
let handle = PrivilegedCommand::new("/usr/bin/cat")
    .args(["/etc/shadow", "/etc/passwd"])
    .gui(true)
    .prompt("Reading protected files")
    .spawn()?;

let status = child.try_wait()?;

let output = child.wait()?;

Feel free to try it out! I would appreciate any feedback, preferably as issues on the GitHub repository.

Thank you!