What is LinPEAS?

If you have ever landed a low-privilege shell and wondered “what can I do from here?”, LinPEAS is the tool that answers most of that question in a few minutes instead of an hour of manual checks. It is part of the wider PEASS-ng (Privilege Escalation Awesome Scripts) suite, which also includes WinPEAS for Windows.

What does LinPEAS actually do?#

LinPEAS is a single shell script written in portable /bin/sh syntax. When you run it, it works through a fixed set of read-only checks and prints the results, colour-coded by how interesting they are. It does not install anything and, by default, does not write findings to disk.

Broadly, it looks at:

• System & kernel — OS version, kernel, sudo version, PATH, mounts, and known-exploit checks.
• Users & sudo — accounts, UID 0 users, groups, and sudo/sudoers configuration.
• Permissions — SUID/SGID binaries, capabilities, ACLs and writable files.
• Scheduled work — cron jobs, systemd services and timers, sockets.
• Files & secrets — config files, backups, history, logs and credential searches.
• Environment — containers, cloud metadata, and network information.

For the full catalogue, see how LinPEAS works, the commands reference, and the Linux security concepts behind each check. Together these map the ground covered by Linux privilege escalation as a whole.

Who uses LinPEAS?#

What LinPEAS is not#

• It is not an exploit tool. It will not escalate privileges for you.
• It is not a vulnerability scanner in the Nessus/OpenVAS sense; it focuses on local misconfiguration and post-access enumeration.
• It is not a guarantee. It can miss things and it can flag harmless configurations.

Is LinPEAS free?#

Yes. LinPEAS is open-source under the GNU GPL (v2 or later, with clarifications in the project's LICENSE file). You can read every line before you run it, which is exactly what we recommend.

A quick example#

Here is a trimmed, illustrative snippet of what LinPEAS output looks like. The real output is much longer; this shows the shape of it.

╔══════════╣ Checking 'sudo -l'
(root) NOPASSWD: /usr/bin/find

╔══════════╣ SUID - Check easy privesc
/usr/bin/find
/usr/bin/passwd

The find lines are highlighted because find can be abused to run commands as another user — but only if the configuration really allows it. That is the manual step. Learn the concept on the SUID guide and sudo guide.