> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/priv-esc/linux-privilege-escalation/linpeas.md). # Linpeas LinPEAS is a script that search for possible paths to escalate privileges on Linux/Unix\*/MacOS hosts. The checks are explained on [book.hacktricks.wiki](https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html) ## Different versions Differences between `linpeas_fat.sh`, `linpeas.sh` and `linpeas_small.sh`: * **linpeas\_fat.sh**: Contains all checks, even third party applications in base64 embedded. * **linpeas.sh**: Contains all checks, but only the third party application `linux exploit suggester` is embedded. This is the default `linpeas.sh`. * **linpeas\_small.sh**: Contains only the most *important* checks making its size smaller. ## Common parameters * **-a** (all checks except regex) - This will **execute also the check of processes during 1 min, will search more possible hashes inside files, and brute-force each user using `su` with the top2000 passwords.** * **-e** (extra enumeration) - This will execute **enumeration checkes that are avoided by default** * **-r** (regex checks) - This will search for **hundreds of API keys of different platforms in the Filesystem** * **-s** (superfast & stealth) - This will bypass some time consuming checks - **Stealth mode** (Nothing will be written to disk) * **-P** (Password) - Pass a password that will be used with `sudo -l` and bruteforcing other users * **-D** (Debug) - Print information about the checks that haven't discovered anything and about the time each check took * **-d/-p/-i/-t** (Local Network Enumeration) - Linpeas can also discover and port-scan local networks **It's recommended to use the params `-a` and `-r` if you are looking for a complete and intensive scan**. ## Colors LinPEAS uses colors to indicate where does each section begin. But **it also uses them the identify potencial misconfigurations**. * The **Red/Yellow** color is used for identifing configurations that lead to PE (99% sure). * The **Red** color is used for identifing suspicious configurations that could lead to privilege escalation. * The **Green** color is used for known good configurations (based on the name not on the content!) * The **Blue** color is used for: Users without shell & Mounted devices * The **Light Cyan** color is used for: Users with shell * The **Light Magenta** color is used for: Current username ## Different checks By default, these checks are executed in the following order: #### Basic Information * OS version * User & Groups * Hostname * [Useful software](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#useful-software) #### System Information * [Kernel version](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#kernel-exploits) * [Sudo version](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-version) * PATH * Date * System stats * Environment #### Devices * Any sd\* disk in /dev? * Unmounted file-system? #### Available Software * [Useful software](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#useful-software) #### Processes, Cron, Services, Timers & Sockets * Check weird & unexpected [proceses run by root](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#processes) * Binary processes permissions * [Cron jobs](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scheduledcron-jobs) * [Services](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#services) * Systemd PATH * [Timers](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#timers) * [Sockets](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sockets) #### Network Information * [Hostname, hosts and DNS](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#generic-enumeration) * Content of /etc/inetd.conf & /etc/xinetd.conf * Networks and neighbours * Iptables rules * [Active Ports](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#open-ports) #### Users Information * [Generic User Information](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#generic-enumeration-1) * [Groups](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html) * Do I have PGP keys? * [Clipboard](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#clipboard) or highlighted text? * [Testing 'sudo -l' without password](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid) & [/etc/sudoers](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#etcsudoers-etcsudoersd) * Checking Pkexec policy * Superusers * Users with console * All users & groups * Login now * Last logons * Last time logon each user * Password policy #### Software Information * MySQL version * MySQL connection using default root/root * MySQL connection using root/toor * MySQL connection using root/NOPASS * Looking for mysql credentials and exec * PostgreSQL version and pgadmin credentials * PostgreSQL connection to template0 using postgres/NOPASS * PostgreSQL connection to template1 using postgres/NOPASS * PostgreSQL connection to template0 using pgsql/NOPASS * PostgreSQL connection to template1 using pgsql/NOPASS * Apache server info * Looking for PHPCookies * Looking for Wordpress wp-config.php files * Looking for Drupal settings.php files * Looking for Tomcat users file * Mongo information * Looking for supervisord configuration file * Looking for cesi configuration file * Looking for Rsyncd config file * Looking for Hostapd config file * Looking for wifi conns file * Looking for Anaconda-ks config files * Looking for .vnc directories and their passwd files * Looking for ldap directories and their hashes * Looking for .ovpn files and credentials * Looking for ssl/ssh files * Looking for unexpected auth lines in /etc/pam.d/sshd * Looking for Cloud credentials (AWS, Azure, GC) * NFS exports? * Looking for kerberos conf files and tickets * Looking for Kibana yaml * Looking for Knock configuration * Looking for logstash files * Looking for elasticsearch files * Looking for Vault-ssh files * Looking for AD cached hashes * [Looking for screen sessions](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#screen-sessions-hijacking) * [Looking for tmux sessions](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#tmux-sessions-hijacking) * Looking for Couchdb directory * Looking for redis.conf * Looking for dovecot files #### Interesting Files * SUID - Check easy privesc, exploits and write perms * SGID * [Writable folders configured in /etc/ld.so.conf.d/](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#ldso) * [Capabilities](https://hacktricks.wiki/en/linux-hardening/privilege-escalation/linux-capabilities.html) * Users with capabilities * Files with ACLs * .sh files in path * Unexpected folders in root * Files (scripts) in /etc/profile.d/ * Hashes inside passwd file? * Hashes inside group file? * Credentials in fstab/mtab? * Can I read shadow files? * Can I read root folder? * Looking for root files in home dirs * Looking for others files in folders owned by me * Readable files belonging to root and readable by me but not world readable * Modified interesting files in the last 5mins * Writable log files (logrotten) * Files inside /home/\ * Files inside others home * Looking for installed mail applications * Mails * Backup files? * Looking for tables inside readable .db/.sqlite files * Web files? * Readable \*\_history, .sudo\_as\_admin\_successful, profile, bashrc, httpd.conf, .plan, .htpasswd, .gitconfig, .git-credentials, .git, .svn, .rhosts, hosts.equiv, Dockerfile, docker-compose.yml * All hidden files (not in /sys/ or the ones listed in the previous check) * Readable files inside /tmp, /var/tmp, /var/backups * Interesting writable files owned by me or writable by everyone * Interesting GROUP writable files (not in Home) * Searching passwords in config PHP files * Finding IPs inside logs * Finding passwords inside logs * Finding emails inside logs * Finding *password* or *credential* files in home * Finding 'pwd' or 'passw' variables inside /home /var/www /var/backups /tmp /etc /root /mnt * Finding possible password variables inside /home /var/www /var/backups /tmp /etc /root /mnt * Finding 'username' string inside /home /var/www /var/backups /tmp /etc /root /mnt * Looking for specific hashes inside files - less false positives ## Resources LinPEAS - GitHub: