L.E.A.P.

Linux Enumeration & Persistence Framework v1.1.0

L.E.A.P. is a modular, lightweight, and stealthy Bash framework designed to aid in post-exploitation enumeration, privilege escalation vectoring, and lateral movement across Linux-based environments. It seamlessly handles data compartmentalization and incorporates natively integrated exfiltration bindings.

Features

• Reconnaissance (-r): Gathers kernel builds, OS configurations, loaded environment variables, available languages/tools, and active user shell accounts.
• Enumeration (-e): Hunts for high-risk SUID/SGID binaries, writable critical paths, capabilities configurations, SSH keys, and password footprints located in bash histories.
• Network Auditing (-n): Maps out internal listening services, network interfaces, established sockets, arp caches, actively checks for open egress (DNS) ports, and generates active payload callbacks (Bash/Python/NC) on the fly.
• Container Context (-c): Actively detects Docker, LXC, and Kubernetes runtime signatures. Evaluates privileged container escape vectors via CapEff, dangerous host socket bindings, and exposed environment parameter secrets.
• Exfiltration (-x): Packages all aggregated loot (stored securely in memory via /dev/shm/.leap_*), compresses it, and streams it asynchronously to a remote C2 via nc or curl.
• Stealth Cleaning (-s): Erases presence trails by selectively wiping the configured ATTACKER_IP from critical authentication logs (auth.log, syslog, secure), trims anomalous interactive ~/.bash_history commands, forcefully rewrites original timestamps (touch -r), and invokes shred against the temporary logs.

Quick Start

Transfer leap along with its core/ and modules/ directories to your target environment. Configuration variables such as ATTACKER_IP and ATTACKER_PORT can be configured directly at the head of the leap wrapper script.

chmod +x leap
./leap -h

Options

Usage: ./leap [options]
  -a    Run ALL modules (Full Lifecycle)
  -r    Run Reconnaissance only
  -e    Run Enumeration (PrivEsc) only
  -c    Run Container checks only
  -n    Run Network Audit only
  -x    Exfiltrate collected data and Exit
  -s    Stealth Cleanup (CAUTION: Run last)

Disclaimer

This project is intended strictly for educational purposes, authorized security auditing, and red teaming engagements. The developers or authors assume no liability and are not responsible for any misuse, damage, or illegal activities caused by this tool. Usage of this tool for attacking targets without prior mutual consent is strictly prohibited.