Quick answer
LinPEAS enumerates systemd services and timers, prints the systemd PATH, and checks unit-file permissions. Writable unit files and relative-path ExecStart entries are the findings that matter, because they let a low-privilege user change what root runs.
Where it appears#
systemd checks are in the procs_crons_timers_srvcs_sockets section, alongside services, sockets and D-Bus.
╔══════════╣ Systemd Information
══╣ Systemd PATH
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin
══╣ Writable .service files
/etc/systemd/system/backup.service (writable)How to read it#
- A writable service/timer file is high priority — you control what root executes.
- A relative
ExecStartcan be hijacked if the systemd PATH has a writable entry. - Timers are the modern equivalent of cron; treat them the same way.
Verify it yourself#
systemctl list-units --type=service
systemctl list-timers --all
find /etc/systemd/ /lib/systemd/ -name '*.service' -writable 2>/dev/nullSources & references
- linPEAS README
- PEASS-ng release — reviewed 20260908-dffb9496
- HackTricks: Linux privilege escalation