Quick answer

On macOS, running linpeas.sh automatically executes the MacPEAS check set — LinPEAS detects a Darwin kernel and switches. Download it the same way as on Linux, make it executable, and run it. There are compiled linpeas_darwin_amd64 and linpeas_darwin_arm64 binaries too.

How the switch works#

LinPEAS checks the kernel name at startup. If uname reports Darwin, it runs MacPEAS — a check set tailored to macOS, covering things like LaunchAgents/LaunchDaemons, keychains, and macOS-specific permissions in addition to the shared checks. You can force the mode with -M (MacPEAS) or -L (LinPEAS) if needed.

Download and run#

Script on macOS
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

Or use the compiled binary for your CPU (Apple Silicon vs Intel):

Apple Silicon binary
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas_darwin_arm64 -o linpeas
chmod +x linpeas
./linpeas

Gatekeeper and permissions#

Gatekeeper

macOS Gatekeeper may block an unsigned downloaded binary. On a machine you own or are authorised to test, you can remove the quarantine attribute; do not do this on systems outside your authorisation.

Clear quarantine on a binary you trust
xattr -d com.apple.quarantine ./linpeas   # authorised systems only

Some macOS checks read privacy-protected locations and may be limited unless the terminal app has the relevant Full Disk Access permission. Missing access simply means some sections report less, not that the run fails.

Note

Verified against PEASS-ng release 20260908-dffb9496.

Sources & references

  1. PEASS-ng releases — reviewed 20260908-dffb9496
  2. linPEAS README — download and usage commands
  3. Kali peass-ng package — package name and paths