LinPEAS Privilege Escalation ScannerStep-by-step reference: audit Linux and Windows hosts for privilege escalation paths with LinPEAS and WinPEAS. Educational use only.FAQ

What is LinPEAS?

LinPEAS is an open-source privilege escalation auditing script for Linux, part of the PEASS-ng suite by Carlos Polop. You run it on a machine you are authorized to test and it automatically checks hundreds of common misconfigurations — SUID binaries, sudo rights, cron jobs, writable paths, leaked credentials, running processes, and network exposure — then highlights the findings most likely to allow privilege escalation.

What is WinPEAS?

WinPEAS is the Windows companion to LinPEAS in the same PEASS-ng suite. It performs the equivalent audit on Windows: services with weak permissions, unquoted service paths, scheduled tasks, registry autoruns, stored credentials, and privilege-related system settings. Use the .bat version when executables are blocked and the .exe version for the fastest, most complete scan.

Is running LinPEAS legal?

LinPEAS itself is a legitimate open-source auditing tool. Running it on any system without explicit written permission is illegal. Use it only on machines you own, lab VMs, capture-the-flag boxes, or systems covered by a signed penetration testing authorization.

How do I install LinPEAS?

There is no installation: download the latest linpeas.sh from the PEASS-ng GitHub releases page with curl or wget, copy it to the target with scp or your file-transfer method of choice, then run chmod +x linpeas.sh. Always fetch a fresh copy from the official repository so you get the latest checks.

How do I run a LinPEAS scan?

Run ./linpeas.sh -a for the full audit including every check, which is the recommended first pass. Results print color-coded in the terminal: red and yellow lines deserve attention first. Save the output with ./linpeas.sh -a | tee peas.txt so you can review it after the session.

Which LinPEAS flags matter most?

The -a flag runs all checks and is the standard full audit. The -s flag runs a faster scan that skips the slowest checks. The -o flag limits output to operating-system information for a quick overview. The -N flag disables network checks when the target has no Internet access, and -D enables debug output when a check behaves unexpectedly.

What should I look for in LinPEAS output?

Start with the red and yellow highlights: SUID binaries you can abuse, sudo entries that run without a password, writable cron scripts and PATH directories, passwords in bash history or config files, and interesting processes running as root. Each finding maps to a privilege escalation technique — confirm it manually before attempting anything.

How is LinPEAS different from manual enumeration?

Manual enumeration means running dozens of individual commands and knowing what to look for. LinPEAS automates that checklist into one script that finishes in a couple of minutes and color-codes the results. It complements manual work rather than replacing it: use LinPEAS to find candidates fast, then verify each one by hand.

All tools · Sitemap · Games