System enumeration
OS, kernel, sudo version, PATH, mounts, protections and known-exploit registry checks.
Linux Security Auditing & Enumeration
LinPEAS: Complete Linux Privilege Escalation & Security Auditing Guide
LinPEAS is a script that enumerates a Linux, Unix or macOS host and highlights possible privilege-escalation paths. This independent guide explains what it is, how to run it safely, what its output means, and the Linux concepts behind every check.
Open-source tool
Linux · Unix · macOS
PEASS-ng project
Educational & authorised use
$ ./linpeas.sh
╔═══════════════════╣ LinPEAS ╠═══════════════════╗
LEGEND: RED/YELLOW = 95% a PE vector GREEN = common
╔══════╣ System Information
OS: Linux 6.8.0-generic x86_64
Sudo version 1.9.15
╔══════╣ Files with Interesting Permissions
══╣ SUID
/usr/bin/find (GTFOBins: candidate)
/usr/bin/passwd
╔══════╣ Users Information
══╣ sudo -l
(root) NOPASSWD: /usr/bin/find
→ Highlighted = worth checking. Always verify manually.What is LinPEAS?#
Quick answer
LinPEAS (Linux Privilege Escalation Awesome Script) is an open-source enumeration script from the PEASS-ng project. Run on a Linux, Unix or macOS host, it collects system, user, permission, service and file information, then highlights configurations that may allow privilege escalation. It reports; it does not exploit.
It is maintained by Carlos Polop and contributors and is one of the most widely used tools for post-access enumeration in authorised penetration testing, CTFs and Linux security auditing. A highlighted result is a lead to investigate, not proof of a vulnerability — see how LinPEAS works and how to read its output.
Coverage
What LinPEAS checks#
LinPEAS groups its work into sections. Each card links to a deeper explanation of the concept and how LinPEAS reports it.
Users & groups
Accounts, UID 0 users, group memberships, login history and console users.
Sudo configuration
sudo -l, sudoers rules, sudo tokens, pkexec/polkit and doas.
SUID / SGID discovery
Set-UID and set-GID binaries, cross-referenced against known abuse techniques.
Linux capabilities
File and user capabilities that can grant root-equivalent power.
File permission auditing
Writable files, ACLs, ld.so misconfigurations and writable root-owned executables.
Cron job analysis
Scheduled tasks, writable cron scripts and frequent-job monitoring.
systemd services
Service and timer units, systemd PATH and writable unit files.
Credential discovery
Passwords, keys, tokens and secrets in files, history, logs and process memory.
Kernel information
Kernel version and modules, plus checks against a bundled exploit registry.
Network information
Interfaces, listening ports, firewall rules and connectivity probes.
Container detection
Docker/LXC/containerd context, mounted tokens and breakout conditions.
Cloud checks
Metadata and credential checks for AWS, GCP, Azure, DO, Alibaba, IBM and Tencent.
Interesting files
Backups, databases, hidden files, writable logs and unexpected files.
Software enumeration
Installed software and app-specific configuration checks across 100+ applications.
Process
How LinPEAS works#
LinPEAS runs a fixed sequence of read-only checks, then colours the results by how interesting they are. The final and most important step is yours: manual verification.
Get started
Install & run in one line#
LinPEAS is a script, not a package — there is no graphical installer. The most auditable approach is to download it, read it, then run it. The one-liner below is the quickest path for authorised labs; see the installation guide for safer patterns and offline use.
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
chmod +x linpeas.sh
./linpeas.sh | tee linpeas.outReview before you run
Piping a remote script straight into a shell (curl … | sh) runs code you have not read. Prefer download → review → run, especially outside a lab. A default run can also make outbound connections — see is LinPEAS safe?
Reading results
Understanding the output colours#
Colour marks how much attention a line deserves — not a verdict. In particular, green means “commonly seen” (matched by name), not “confirmed safe.”
| Colour | Runtime legend | How to read it |
|---|---|---|
| Red/Yellow | 95% a privilege-escalation vector (runtime legend). The README phrases this as 99%. | Highest-interest finding. Investigate first, then manually verify. |
| Red | You should take a look into it. | Suspicious configuration that may lead to escalation. Needs manual review. |
| Green | Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs). | Matched as commonly-seen BY NAME, not verified as safe by content. Green does not mean secure. |
| Light Cyan | Users with console (shell). | Accounts that can log in interactively. |
| Blue | Users without console and mounted devices. | Informational grouping. |
| Light Magenta | Your username. | Highlights the current user in the output. |
Reference
Sections you can target with -o#
You do not have to run everything. The -o flag limits LinPEAS to specific sections for faster, quieter audits. Each section is tagged with MITRE ATT&CK techniques.
-o name | Section | Checks | ATT&CK | What it covers |
|---|---|---|---|---|
system_information | System Information | 23 | T1082, T1068, T1518.001 | OS and kernel details, sudo version, PATH, mounts and disks, environment, kernel modules, protections (AppArmor/SELinux/etc.), and known-kernel-exploit registry checks. |
container | Container | 7 | T1611, T1613 | Detects Docker/LXC/containerd context, mounted service tokens, writable bind mounts, and known container-breakout conditions. |
cloud | Cloud | 13 | T1552.005, T1580 | Detects and enumerates AWS (EC2/ECS/Lambda/CodeBuild), GCP, Azure (VM/App/Automation), DigitalOcean, Alibaba, IBM and Tencent metadata and credentials. |
procs_crons_timers_srvcs_sockets | Processes, Crons, Timers, Services, Sockets | 31 | T1053.003, T1543.002, T1057 | Running processes, credentials in process memory, cron jobs and frequent-job monitoring, systemd services/timers and PATH, sockets and D-Bus. |
network_information | Network Information | 17 | T1016, T1049 | Interfaces, hosts/DNS, neighbours, listening ports, firewall rules, and internet-access probes. |
users_information | Users Information | 23 | T1033, T1548.003, T1087.001 | Current user, sudo/sudoers and sudo tokens, pkexec/polkit, doas, UID 0 accounts, groups, login history, and optional su testing. |
software_information | Software Information | 131 | T1552.001, T1587.001 | Useful software and compilers, and configuration/credential analysis for a very large set of applications (databases, web servers, CI/CD, mail, VPN, SSH, cloud CLIs, and more). |
interesting_perms_files | Files with Interesting Permissions | 16 | T1548.001, T1574.010 | SUID/SGID binaries, file capabilities, ACLs, ld.so misconfigurations, writable init/service files, and writable root-owned executables. |
interesting_files | Other Interesting Files | 36 | T1083, T1552.001 | Scripts in PATH, unexpected files, writable logs, backups, databases, hidden files, and password/credential searches across the filesystem. |
api_keys_regex | API Keys Regex | 4 | T1552.001 | Regex searches for hashed passwords, raw hashes, API keys and other secrets. Runs only with -r. |
Who uses it
Common use cases#
Authorised pentesting
Speed up post-access enumeration on engagements you are contracted to test.
CTF & training labs
Find footholds quickly on Hack The Box, TryHackMe and similar legal labs.
System hardening
Audit your own servers to find and fix misconfigurations before attackers do.
Learning Linux security
Use the output as a map of the Linux concepts worth understanding.
Comparison
LinPEAS vs other enumeration tools#
| Tool | Maintained | Scope | Containers | Cloud | Output |
|---|---|---|---|---|---|
| LinPEAS | Actively (frequent releases) | Linux/Unix/macOS | Yes | Yes | Colour-coded, ATT&CK-tagged, parsers to JSON/HTML/PDF |
| LinEnum | No (branch last updated 2020) | Linux | Minimal | No | Plain text |
| linux-smart-enumeration | Yes | Linux | Some | No | Verbosity levels 0/1/2 |
New here?
Beginner learning path#
LinPEAS output makes far more sense once you understand the concepts it reports. Follow this order, then come back and read a real scan.
Safety & authorised use
A default LinPEAS run can contact external services (a HackTricks host-checker request and internet-connectivity probes) and, in this build, the documented -n flag does not actually disable them. Only run LinPEAS on systems you own or are authorised to test, and account for outbound traffic in your rules of engagement. Details: is LinPEAS safe?
Questions
LinPEAS FAQ#
Is LinPEAS free and open-source?
Yes. LinPEAS is part of the open-source PEASS-ng project, released under the GNU GPL (v2 or later, with clarifications in the repository LICENSE). You can read the source before running it.
Does LinPEAS require root?
No. LinPEAS is designed to run as a normal user to find escalation paths. Running it as root changes some behaviour and skips the checks that look for ways to become root.
Does LinPEAS exploit vulnerabilities?
No. LinPEAS enumerates and highlights; it does not exploit. Confirming and exploiting a finding is a separate, manual step you perform only where authorised.
Is a red or red/yellow finding always a vulnerability?
No. Colour indicates how interesting a line is. Red/yellow means “very likely worth your time,” not “confirmed exploitable.” Every finding needs manual validation.
Is this the official LinPEAS website?
No. This is an independent educational resource. The official project lives at github.com/peass-ng/PEASS-ng.
Start with the fundamentals
Read what LinPEAS is, install it correctly, then learn to interpret every colour and section with confidence.