Quick answer
In the “Users Information” section, LinPEAS runs sudo -l, reads /etc/sudoers and /etc/sudoers.d/, checks for reusable sudo tokens, and inspects pkexec/polkit and doas. A highlighted NOPASSWD rule or an abusable allowed binary is often the fastest route to root.
Where it appears#
Sudo checks are in the Users Information section (users_information). If you know a valid password, pass it with -P so sudo -l and the su checks can use it.
╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d
Matching Defaults entries for user:
env_reset, secure_path=...
User user may run the following commands:
(root) NOPASSWD: /usr/bin/findHow to read it#
- NOPASSWD rules and rules allowing shell-capable binaries are the highest-value leads.
- Look for wildcards,
env_keepof dangerous variables, and(ALL)runas. - A flagged sudo version may indicate a known CVE (e.g. Baron Samedit) — confirm the exact version.
Warning
Cross-check any allowed binary against GTFOBins. find, vim, less, awk, tar and many others can spawn a root shell when sudo-allowed.
Verify it yourself#
sudo -l
sudo --version | head -1Sources & references
- linPEAS README
- PEASS-ng release — reviewed 20260908-dffb9496
- HackTricks: Linux privilege escalation