E-LIN
linPEAS
Linux enumeration script that surfaces local privilege-escalation vectors: SUID binaries, cron jobs, credentials, and more.
OVERVIEW
linPEAS, part of the PEASS-ng monorepo, is a Linux (and Unix-like) enumeration script that checks dozens of categories in one pass: SUID/SGID binaries, sudo misconfigurations, cron jobs, world-writable files, capabilities, container-escape indicators, and credentials left in history files, configs, or memory. Output is color-coded so an analyst can scan a long report quickly instead of reading it line by line.
It ships as a single portable shell script with no dependencies beyond common Unix utilities, and pairs with winPEAS and the shared PEASS-ng notation, so a team running both Linux and Windows hosts in the same engagement gets a consistent report format across platforms.
USE CASES
Practical use cases
- 01
Running a first automated privilege-escalation sweep right after landing a shell on a Linux host.
- 02
Spotting SUID/SGID binaries, sudo misconfigurations, and exploitable cron jobs.
- 03
Finding credentials left in bash history, config files, or environment variables.
- 04
Flagging container or virtualization indicators worth escalating out of during a breakout test.
QUICK START
On a Linux host with a shell already established, to run a broad automated sweep for local privilege-escalation vectors before searching manually.
- Confirm local privilege-escalation enumeration is authorized on this host.
- Transfer linpeas.sh onto the target, or pipe it directly over an authorized channel.
- Run it and let the full check pass complete.
- Scan the color-coded output for red/yellow highlights first, then triage each one manually.
./linpeas.sh -a | tee linpeas_output.txtBEFORE YOU RUN IT
What to check before running it
linPEAS is signature-detected by many AV/EDR and file-integrity monitoring setups, and its output volume alone can stand out on a monitored host — consider tuning to a narrower set of checks if stealth matters.
It only reports what its checks are coded to look for; a hardened host with a logic-based or zero-day privesc path can come back clean.
The full report can be long and noisy: treat every highlighted finding as a lead to validate manually, not a confirmed vulnerability.