privesc-linpeas

name	privesc-linpeas
description	Linux privilege escalation enumeration and attack surface analysis using LinPEAS (Linux Privilege Escalation Awesome Script). Automates post-exploitation discovery of escalation vectors, misconfigurations, and credential exposure on Linux targets. Use when: (1) Enumerating privilege escalation vectors after initial access on a Linux system, (2) Identifying SUID/SGID binaries, sudo misconfigurations, and capability abuses, (3) Hunting for credentials in config files, history, and logs, (4) Detecting container breakout opportunities and writable service files, (5) Mapping kernel exploits and CVE exposure for a target system, (6) Conducting authorized CTF, red team, or penetration test post-exploitation phases.
version	0.1.0
maintainer	SirAppSec
category	offsec
tags	["privesc","linpeas","post-exploitation","linux","enumeration","red-team","privilege-escalation"]
frameworks	["MITRE-ATT&CK","PTES"]
dependencies	{"tools":["curl","bash","python3"],"optional":["wget"]}
references	["https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS","https://book.hacktricks.xyz/linux-hardening/privilege-escalation","https://attack.mitre.org/tactics/TA0004/","https://attack.mitre.org/tactics/TA0007/"]

LinPEAS Linux Privilege Escalation

Overview

LinPEAS (Linux Privilege Escalation Awesome Script) is the most comprehensive automated enumeration tool for identifying privilege escalation vectors on Linux systems. It checks 200+ attack vectors, color-codes findings by severity, and maps results to GTFOBins and MITRE ATT&CK.

IMPORTANT: Use only on systems where you have explicit written authorization. Unauthorized use constitutes computer fraud. All actions should be conducted within defined engagement scope.

Quick Start

# Download and run LinPEAS directly (no-install, in-memory)
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

# Save output for analysis
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh -a 2>&1 | tee /tmp/linpeas_output.txt

# Stealth / faster scan (skips time-consuming checks)
/tmp/linpeas.sh -s 2>&1 | tee /tmp/linpeas_fast.txt

Script variants (choose based on environment):

• linpeas.sh — default, includes linux exploit suggester
• linpeas_fat.sh — embeds third-party tools (no internet needed on target)
• linpeas_small.sh — essential checks only, smallest footprint

Use scripts/linpeas_runner.py for structured JSON output and automated triage.

Core Workflow

Post-Exploitation Enumeration Workflow

Progress: [ ] 1. Verify authorization and document scope [ ] 2. Transfer or fetch LinPEAS to target (curl, wget, or scp) [ ] 3. Execute scan: ./linpeas.sh -a 2>&1 | tee linpeas_output.txt [ ] 4. Triage findings by severity (RED = critical, YELLOW = medium) [ ] 5. Validate top vectors manually before exploitation [ ] 6. Attempt privilege escalation using highest-confidence vector [ ] 7. Verify privilege level: id && whoami [ ] 8. Document exploitation path and clean up artifacts

Severity Color Guide

Color	Meaning
RED+	95% escalation probability (exploit immediately)
RED	High confidence vector (validate then exploit)
YELLOW	Interesting finding (requires manual review)