In the “Files with Interesting Permissions” section, LinPEAS lists SUID and SGID binaries and highlights ones with known abuse paths. A red/yellow SUID line is a high-priority lead — but you still confirm the binary is actually exploitable in your context before acting.
Where it appears#
SUID/SGID checks live in the Files with Interesting Permissions section (the interesting_perms_files target for -o). LinPEAS enumerates set-UID and set-GID binaries and compares them against a list of binaries with known privilege-escalation techniques.
╔══════════╣ SUID - Check easy privesc, exploits and write perms
╚ https://book.hacktricks.wiki/...#suid
/usr/bin/find
/usr/bin/pkexec
/usr/bin/passwd
/usr/bin/sudoHow to read it#
- Red/yellow — a binary with a known abuse path (e.g.
findcan run commands). Check first. - Red — suspicious or non-standard; worth investigating.
- Green — a common SUID binary matched by name (e.g.
passwd). Not automatically safe, but usually expected.
A highlighted SUID binary is only exploitable if its version and configuration allow it. pkexec, for instance, was famously exploitable via CVE-2021-4034 (PwnKit) but is fixed on patched systems. Verify the version.
Verify it yourself#
find / -perm -4000 -type f 2>/dev/null # SUID
find / -perm -2000 -type f 2>/dev/null # SGID
ls -l /usr/bin/findThen check whether the specific binary has a known technique on GTFOBins, and read the concept guide: what is SUID?
Sources & references
- linPEAS README
- PEASS-ng release — reviewed 20260908-dffb9496
- HackTricks: Linux privilege escalation