Talaria

What it is

Talaria (cetinkayaismail/talaria-privesc, MIT) is a single static Go binary that scans an unprivileged Linux shell for privilege-escalation vectors and builds attack chains to root. Beyond the catalog summary, the page documents its concrete invocation flags, output formats, and a specific claimed detection set.

How it works

Findings are linked into multi-stage chains using an embedded Dijkstra pathfinder over a directed acyclic graph, where each edge is an exploit transition carrying a confidence score and traversal weight, solving for goal:root. It correlates independent primitives — cron jobs running user-writable scripts, POSIX capabilities on interpreter binaries, Polkit JS rules, systemd EnvironmentFile overrides. The page also claims detection of "backport-aware 2026 Linux kernel vulnerabilities" it names Dirty Frag, Fragnesia, Copy Fail, DirtyClone, CIFSwitch, PinTheft, and pedit COW, plus relative-binary-execution flags in privileged binaries.

What to do

Install from a release binary or build statically:

curl -sSL https://github.com/cetinkayaismail/talaria-privesc/releases/latest/download/talaria_linux_amd64 -o talaria
chmod +x talaria

make build-static

Offensive mode emits exploit one-liners and cleartext credentials; audit mode (-p) masks credentials and prints CIS/NIST remediation commands:

./talaria --scan all --ctf
./talaria --scan all -p

Run only high-value modules:

./talaria --scan suid,capabilities,sudo,sudoers_d

Machine-readable output for SIEMs (Splunk, Elastic, Datadog) and GitHub Code Scanning:

./talaria --scan all -o report.json --format json
./talaria --scan all -o report.sarif --format sarif

Encrypt output at rest:

./talaria --scan all -o /tmp/audit.enc --encrypt "YourSecureInstitutionalPassphrase"

Note the SARIF path — this is the detail the summary omits: findings can be wired directly into GitHub Code Scanning as a CI/CD gate, not just used interactively.

Caveats

• The named 2026 kernel CVEs (Dirty Frag, Fragnesia, etc.) are page claims with no CVE identifiers, versions, or references given — treat detection coverage as unverified.
• --ctf prints cleartext credentials to the terminal; do not use it on shared or logged sessions.
• The --encrypt example writes to /tmp, which contradicts the "never touches disk / never writes to /tmp" claim; the read-only guarantee applies to scanning, not to output you explicitly ask it to save.
• The tool is for authorized assessment only; the page requires explicit owner permission.