What is roothound?

Roothound is a tool for security testers and learners who have gained basic access to a Linux machine and want to figure out how to escalate to full administrator (root) access. When you land on a machine with limited permissions, you normally run an enumeration tool like LinPEAS, which prints out hundreds of lines of system information. Roothound takes that text output and turns it into a visual graph showing every possible path from your current user up to root, reading left to right. The graph uses color coding to help you prioritize. Confirmed paths, ones Roothound can verify are exploitable, appear in red. Likely leads that need manual checking appear in amber. You can click any node in the graph to see what the finding is and get a ready-to-copy command for exploiting it. The tool also handles multi-hop chains, meaning it can connect separate findings that form a sequence. For example, it might spot that you can modify a script, that script is run by a root-level scheduled task, and therefore you can reach root by combining those two facts. Roothound checks for a range of privilege escalation techniques. Its rulebook covers SUID and SGID binaries, sudo misconfigurations, Linux capabilities, dangerous group memberships, writable files, NFS exports, PATH hijacking, and matching known sudo and kernel vulnerabilities against public CVE entries. The rulebook is editable, so you can adjust what the tool looks for. The tool runs entirely offline with no internet connection and no external dependencies. It produces a single self-contained HTML file you open in a browser. To use it, you clone the repository or download a ZIP, then run a simple command pointing it at your LinPEAS output file. It generates an HTML report you open locally. The author includes a disclaimer that Roothound is meant only for authorized testing, such as capture the flag competitions, Hack The Box, or your own lab machines.