Linpeas

LinPEAS

Linux Privilege Escalation Awesome Suite — comprehensive system audit for privilege escalation assessment.

Quick Start

# Download and run in one line
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash

# Or local file
bash linpeas.sh

# Quiet mode (critical findings only)
bash linpeas.sh -q

# Export to file
bash linpeas.sh > enum_full.txt 2>&1

# Aggressive all-checks mode
bash linpeas.sh -a 2>&1 | tee linpeas_full.out

# Run as root (more thorough)
sudo bash linpeas.sh

Key Enumeration Areas

Core Flags

Common Workflows

Initial user-space enumeration

bash linpeas.sh -q 2>/dev/null | grep -i "root\|sudo\|exploit"
# Quick summary of exploitable paths

Full audit (from low-priv user)

bash linpeas.sh | tee /tmp/lp.txt
# Review output for:
# 1. SUID/SGID binaries with known exploits
# 2. Sudo entries without password
# 3. Writable system files / cron scripts
# 4. Kernel vulnerabilities
# 5. Unpatched services running as root

After gaining root, check for persistence vectors

sudo bash linpeas.sh
# Identify ways to maintain access:
# - Backdoor cron jobs
# - SSH key insertion
# - Rootkit opportunities
# - Hidden user accounts

Credential harvesting preparation

bash linpeas.sh -s
# Scans for plaintext passwords in common locations:
# - /home/*/.*profile / .bashrc / .zshrc
# - /etc/mysql/my.cnf
# - /etc/postgresql/postgresql.conf
# - Application configs

Key Findings Priority

🔴 CRITICAL — Immediate escalation:

• SUID binary with known public exploit matching kernel
• Sudo entry with NOPASSWD + command
• Unpatched kernel with PoC available
• World-writable cron script running as root
• Plaintext root password in config file

🟠 HIGH — Likely exploitable:

• SUID binary (even without known exploit, reverse engineer)
• Writable system binary / script
• Capability-based (cap_setuid on user tool)
• Sudo with wildcard or glob expansion
• /etc/shadow readable by current user

🟡 MEDIUM — Context-dependent:

• Weak cron script perms (depends on what it does)
• SSH keys with weak perms
• Database credentials in config

Output Interpretation

LinPEAS color codes findings:

• 🟢 Green — Not exploitable or low risk
• 🟡 Yellow — Worth investigating, potentially exploitable
• 🔴 Red — High priority, likely exploitable
• 💛 Red with [!] — Critical, exploitable now

Also prioritize lines flagged like 99% PE or equivalent high-confidence markers before spending time on weaker leads.

Findings are grep excerpts, not proof — read the full file before acting. LinPEAS often prints only the matching line (e.g. just the auth ... pam_permit.so line of /etc/pam.d/common-auth, or a single sudoers/cron line), which can read like a misconfiguration or auth bypass the complete file does not actually support. Confirm the whole file first. Its version-based CVE hits (Kernel Exploit Registry, and service LPEs like PackageKit/pkexec/sudo) are stronger, verifiable leads — a held-back package version is often the intended path.

Post-LinPEAS Workflow

1. Triage findings — focus on red/critical items first
2. Verify exploitability — manually test (can you write to that file? does sudo work?)
3. Build exploit — craft shell script, compile, or use existing tool (e.g., sudo -l, find SUID abuse)
4. Execute escalation — run exploit, verify root shell
5. Check for further privesc — re-run LinPEAS at root level, identify lateral movement or persistence

Combining with Other Tools

Resources