Use enumeration tools to generate manually testable candidates

Needs: Verified target UID and architecture, a working shell/runtime, a reviewed transferred tool and a writable report location

This form does not require an executable bit

For the early collector pass, transfer a reviewed LinPEAS copy, check the current UID/architecture and save its output. This form does not require an executable bit:

# This form does not require an executable bit
sh ./linpeas.sh | tee linpeas.txt

# Baseline
./linpeas.sh | tee linpeas.txt
./lse.sh | tee lse.txt
./lse.sh -l1 | tee lse-l1.txt
./unix-privesc-check standard > unix-privesc-check.txt

For every highlight

LinPEAS optional flags vary by build. Read the local ./linpeas.sh -h before selecting broader checks; they are not the automatic baseline. LSE progresses from default to -l1, then -l2 only if needed. unix-privesc-check detailed is slower and more false-positive-prone.

# For every highlight
exact object | effective permission | privileged consumer | identity | trigger | expected effect | manual verification

Verify → Read linpeas.txt. Confirm a reported sudo rule with sudo -l, a privileged path with namei/stat/getfacl, or a scheduled consumer with pspy before using that finding

If it fails → Script blocked or output empty: check the shell, transfer integrity and output path, then use the native checks for the observed rule/file/job. Empty collector output does not rule out escalation More detail ↓

If → then

A root-consumed file or directory appears writable → Prove effective file, directory, ACL and mount control
Needs: Effective access through every parent/ACL and mount; a privileged consumer and trigger are identified separately
Root-owned cron, systemd or recurring process activity uses a controllable object → Control a script, binary or configuration consumed by a privileged job/service
Needs: Effective object control, actual privileged consumer identity, correct path/environment and an available schedule/restart trigger
sudo -l grants an operation under a more useful identity → Use an allowed sudo operation to cross a privilege boundary
Needs: Exact executable/run-as/argument rule permits a useful primitive; password tags, environment and policy do not invalidate it

No useful finding → another task in this topic. Failed check → resolve the failure before ruling out the path.

Explanation & examples

Use enumeration tools to generate manually testable candidates

USE WHEN: A Linux foothold is available; run an early sweep for sudo rules, file capabilities, credentials and writable privileged paths
STARTING ACCESS: A verified Linux foothold with a known effective UID, groups and filesystem context
RESULT: Candidate permissions, credentials and consumers for manual validation

Recognize the clue

Use known manual gaps and the host/runtime context to choose a reviewed enumerator; inspect each highlighted finding against native evidence.

id
uname -m
command -v bash python3
ls -ld /tmp

SYNTHETIC EXAMPLE OUTPUT

Enumerator candidate: writable /opt/APP/script.sh
Consumer identity: unknown
Trigger: unknown

Means: The highlight supplies a candidate object, not the missing privileged consumer or execution trigger.

Confirm: Run the reviewed LinPEAS baseline and save its output. For sudo highlights run sudo -l; for a flagged file use stat/namei/getfacl; for jobs confirm the UID and command with pspy or systemctl. Open the matching technique only after that check.

After validation: The full manual chain validates: follow its owning method.
Ruled out in this context: Only a low-privileged process consumes the object: reject the escalation hypothesis.
Still inconclusive: Missing tools or restricted /proc can hide evidence; investigate application-specific paths manually.

Troubleshooting: Script blocked or output empty: check the shell, transfer integrity and output path, then use the native checks for the observed rule/file/job. Empty collector output does not rule out escalation

For the early collector pass, transfer a reviewed LinPEAS copy, check the current UID/architecture and save its output. This form does not require an executable bit:

Follow the named finding into the matching sudo, SUID/capability, writable-consumer or credential procedure. Use the local help for optional modes; broader/noisier checks are not the automatic baseline.

LinPEAS optional flags vary by build. Read the local ./linpeas.sh -h before selecting broader checks; they are not the automatic baseline. LSE progresses from default to -l1, then -l2 only if needed. unix-privesc-check detailed is slower and more false-positive-prone.

For every highlight:

Do not pipe an unverified Internet download into the target shell. Acquire a trusted copy, retain its source/hash, transfer deliberately and remove assessment artifacts when appropriate.

Why it works

Enumerators aggregate observations and heuristics. A highlighted path does not prove effective ACLs, privileged consumption, trigger or successful exploitation.

Worked example · hypothetical

Observation: LinPEAS highlights a writable path. Test: inspect its exact ACL, parent rights and consumer. Illustrative output: only an unprivileged process uses it. Interpretation: reject the escalation hypothesis while retaining the writable-path fact.

New identity, privilege, host or route? Re-enumerate → All topic tasks →

Study guide ↗Full procedure ↗Cheatsheet ↗