Kernel exploit suggesters: WES-NG, Windows Exploit Suggester, Linux Exploit Suggester

All three of these programs do the same job for different targets: take a system’s patch/kernel information and cross-reference it against a known-vulnerability database to shortlist which kernel exploits are worth trying, instead of guessing.

WES-NG (Windows Exploit Suggester - Next Generation)

wes.py --update                          # refresh its vulnerability database

# [target] capture systeminfo, then feed it to WES-NG on the attacker box
systeminfo > info.txt
wes.py info.txt --muc-lookup

# or generate the missing-KBs list directly on the target and feed that instead
# [target] .\missingkbs.ps1   (or missingkbs.vbs)
wes.py -m missing.txt

Windows Exploit Suggester (legacy)

windows-exploit-suggester.py --update                                    # builds an .xls database
windows-exploit-suggester.py --database database.xls --systeminfo systeminfo.txt

Linux Exploit Suggester

wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh
chmod +x linux-exploit-suggester.sh
./linux-exploit-suggester.sh

Comparison

Tool	Target	Notes
WES-NG	Windows	Actively maintained, takes systeminfo output
Windows Exploit Suggester	Windows	Legacy, Python 2, finicky .xls database
Linux Exploit Suggester	Linux	Single shell script, no dependencies

Also worth knowing: Metasploit’s own post/multi/recon/local_exploit_suggester module and meterpreter’s getsystem command both attempt a similar job automatically from an existing session, without needing to transfer a separate script.

Related

• Linux kernel privilege escalation — the workflow that uses Linux Exploit Suggester’s output
• Windows kernel privilege escalation — the workflow that uses WES-NG/Windows Exploit Suggester’s output
• Automated privesc enumeration — broader enumeration scripts that flag more than just kernel CVEs
• Meterpreter essentials — where getsystem and the local exploit suggester module are run from