PEASS-ng — Privilege Escalation Awesome Scripts Suite

Introduction

PEASS-ng (Privilege Escalation Awesome Scripts SUITE - new generation) is a collection of scripts that automatically search for local privilege escalation vectors on Linux, Windows, and macOS systems. It is designed for authorized penetration testers and security auditors who need to quickly identify misconfigurations and weaknesses.

What PEASS-ng Does

• Enumerates system information, users, groups, network configurations, and running processes
• Identifies SUID/SGID binaries, writable paths, cron jobs, and capability misconfigurations on Linux
• Detects unquoted service paths, registry AutoRun keys, and token privileges on Windows
• Highlights findings with color-coded output: red for critical, yellow for interesting, green for informational
• Checks for known CVEs and kernel exploits applicable to the target system version

Architecture Overview

PEASS-ng consists of two primary tools: LinPEAS (a Bash script for Linux/macOS) and WinPEAS (available as both a C# executable and a batch script for Windows). Each script performs hundreds of checks organized into categories such as system info, networking, users, software, interesting files, and container breakout vectors. Results are color-coded for rapid triage. The scripts are self-contained with no external dependencies.

Self-Hosting & Configuration

• Download pre-built releases from the GitHub Releases page for immediate use
• LinPEAS requires only Bash (sh-compatible); no additional packages needed
• WinPEAS is available as a compiled .exe (any CPU) or .bat script for environments where executables are restricted
• Use -a flag for thorough mode or -s for a quick scan on LinPEAS
• Host scripts on an internal web server for easy distribution during engagements

Key Features

• Performs over 600 automated checks across system, network, and file configurations
• Zero dependencies on target systems; runs with standard OS utilities
• Color-coded output enables rapid identification of high-priority findings
• Regularly updated with new checks for recently disclosed CVEs and attack techniques
• Supports Docker and container breakout enumeration for cloud-native environments

Comparison with Similar Tools

• LinEnum — a predecessor focused on Linux enumeration with fewer checks; PEASS-ng covers more vectors and includes Windows support
• linux-exploit-suggester — focuses specifically on kernel exploit suggestions; PEASS-ng covers kernel exploits plus misconfigurations
• Seatbelt — a C# Windows enumeration tool with a different check set; WinPEAS provides broader privilege escalation coverage
• BeRoot — checks for common privilege escalation paths; PEASS-ng performs deeper enumeration with color-coded output

FAQ

Q: Is PEASS-ng safe to run on production systems? A: PEASS-ng performs read-only enumeration and does not modify the system. However, it should only be used on systems you have explicit authorization to test.

Q: What is the difference between LinPEAS and WinPEAS? A: LinPEAS is a Bash script for Linux and macOS systems, while WinPEAS is a C# executable or batch script for Windows systems. Both perform privilege escalation enumeration for their respective platforms.

Q: Can PEASS-ng detect container escape opportunities? A: Yes, LinPEAS includes checks for Docker socket exposure, dangerous capabilities, and other container breakout vectors.

Q: How often are new checks added? A: The project receives frequent updates from its maintainers and community contributors, with new CVE checks typically added within weeks of disclosure.

Sources

• https://github.com/peass-ng/PEASS-ng
• https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html