linPEAS & winPEAS

PEAS tools collect local configuration leads. The report uses linPEAS to discover an internal FTP listener and winPEAS to identify writable application files. Colour or a CVE suggestion is a lead; neither proves an attack succeeded.

Linux collection

Transfer a reviewed, version-recorded script, then run it as your current user:

id
bash ./linpeas.sh -h
bash ./linpeas.sh > linpeas.txt 2>&1
ss -lntup
sudo -l

Keep output private because it can contain passwords. Validate the listener’s process and configuration rather than attributing it to an unrelated FTP daemon based on a filename.

Windows collection

whoami /all
.\winPEASx64.exe --help
.\winPEASx64.exe > winpeas.txt 2>&1
Get-Service
Get-Acl 'C:\Lab\Application' | Format-List

Match binary architecture and prerequisites to the host. Confirm flags against the release you transferred. Compare file permissions and service identities with the proposed escalation; being able to list a file is different from modifying it.

Success: a specific lead survives a manual check, such as a readable secret file or a writable executable loaded by a privileged service. Record the supporting evidence and the change needed to fix it. An empty result does not prove the host is secure; access and tool coverage limit what can be collected.

Capture the host baseline first

id
uname -a
cat /etc/os-release
pwd
sha256sum linpeas.sh

whoami /all
Get-CimInstance Win32_OperatingSystem | Select-Object Caption,Version,BuildNumber
[Environment]::Is64BitProcess
Get-FileHash .\winPEASx64.exe -Algorithm SHA256

Record the release used, host and identity with each output file. PEAS output from a root/admin session describes a different visibility boundary from output collected under the original foothold.

Linux: turn leads into manual checks

Lead	Manual confirmation	Missing prerequisite to look for
Sudo command	`sudo -l`	Exact path, arguments and run-as identity
SUID binary	`stat /path/to/binary`	Relevant executable behaviour and target mount options
Capability	`getcap /path/to/binary`	Specific capability and how the program uses it
Writable task script	`namei -l /path/to/script`	Higher-privileged execution and task timing
Local listener	`ss -lntup`	Service identity, authentication and loopback reachability
Readable secret	`stat /path/to/file`	Usable value, scope and current validity

ss -lntup
namei -l /opt/lab/maintenance.sh
stat /opt/lab/maintenance.sh
getcap /usr/bin/python3
findmnt -T /opt/lab/maintenance.sh

The paths are examples; inspect the actual flagged object. Lack of process names in ss can be a permission limitation, not proof that a listener has no owner.

Windows: separate file control and service control

Get-CimInstance Win32_Service |
  Select-Object Name,StartName,State,PathName
Get-Acl 'C:\Lab\Application\service.exe' | Format-List
icacls 'C:\Lab\Application'
sc.exe qc LabService
sc.exe sdshow LabService

File ACLs describe control over the executable or directory. The service security descriptor describes who may change configuration or start/stop it. A writable executable becomes an escalation path only if a stronger identity will actually load it and the required trigger is reachable.

Rank what to investigate

Priority	Typical evidence
Direct, current permission	Confirmed unrestricted sudo callback, service configuration right or assigned token privilege
Credential/configuration lead	Readable secret tied to a named service and identity
Conditional chain	Writable file plus a proven privileged loader/trigger
Version-only suggestion	Kernel/application CVE hypothesis requiring advisory and patch checks

A colour-highlighted line is a convenience for triage. Prove one complete path before collecting more speculative candidates. Do not infer a vulnerable kernel only from a version string when distributions backport fixes.

Preserve output and complete the check

Keep the raw output private, then save a small redacted excerpt alongside manual commands and results. Note checks that could not run because tools, permissions or network access were missing. Remove transferred binaries/scripts after the exercise and retain their recorded digests. Continue with the Privilege Escalation workflow for a complete Linux/Windows decision path.

How attacks work. Examples use fictional lab values; replace placeholders only with values from the system you are testing.