---
name: "sucrack"
section: "1"
platform: "linux"
package: "sucrack"
version: "1.2.3-7"
release: "Debian 13 (Trixie)"
platforms: ["linux"]
url: "https://new.carta.tech/sucrack"
---

# sucrack(1)

is a multithreaded Linux/UNIX tool for brute-force cracking of local user accounts via su.

## NAME

**sucrack - is a multithreaded Linux/UNIX tool for brute-force cracking of local user accounts via su.**

## SYNOPSIS

**sucrack** \[options\] wordlist

## DESCRIPTION

**sucrack** is a multithreaded Linux/UNIX tool brute-force cracking tool that drives [su(1)](/su/1.md) with referencing a specific user and uses words from a wordlist as passwords. Running  **sucrack** does not require high privileges on the target system.

## OPTIONS

**sucrack** allows reading passwords from stdin. In that case, use '-' instead of a filename as wordlist parameter.

- **Common options:**

  - *-h*

  print help message

- *-a*

  use ansi escape codes for nice looking statistics (requires --enable-statistics configuration flag)

- *-s \<seconds\>*

  statistics display intervall (requires --enable-statistics configuration flag)

- *-c*

  only print statistics if a key other than \`q' is pressed

- *-r*

  enable rewriting of dictionary words (see rules below)

- *-w \<num\>*

  number of threads to run with.

- *-b \<size\>*

  size of the word list buffer

- *-u \<user\>*

  user account to su to

- *-l \<rules\>*

  specify certain rules for the rewriting process

- **Rewriting rules:**

  - *A*

  Rewrite word with only upper case characters

- *F*

  Rewrite word with first character as upper case

- *L*

  Rewrite word with last character as upper case

- *a*

  Rewrite word with only lower case characters

- *f*

  Rewrite word with first character as lower case

- *l*

  Rewrite word with last character as lower case

- *D*

  Prepend each digit (0-9) to the word

- *d*

  Append each digit (0-9) to the word

- *e*

  enleet the word

- *x*

  apply all rules to a word

## ENVIRONMENT VARIABLES

- *SUCRACK\_SU\_PATH*

  The path to su (usually /bin/su or /usr/bin/su)

- *SUCRACK\_AUTH\_FAILURE*

  The message su returns on an authentication failure (like "su: Authentication failure" or "su: Sorry")

- *SUCRACK\_AUTH\_SUCCESS*

  The message that indicates an authentication success. This message must not be a password listed in the wordlist (default is "SUCRACK\_SUCCESS")

## AUTHOR

- Nico Leidecker \<nfl@portcullis-security.com\>

  http://www.leidecker.info

## SEE ALSO

- **[su(1)](/su/1.md)**