LearnPeas - Educational Linux privilege escalation script for

项目说明

LearnPEAS

A comprehensi pri escalation enumeration script designed for learning and understanding, not just finding . Every finding includes educational context explaining WHAT it is, WHY it matters, and HOW to exploit it.

⚠️ Important Notice

This project is not affiliated with or endorsed by the PEASS-ng project. LearnPEAS is an independent educational tool inspired by LinPEAS. All credit for the original PEAS enumeration framework and the exceptional work on LinPEAS goes to the PEASS-ng team. I deeply respect their contributions to the security community.

LearnPEAS is currently in acti and should be considered beta software. While functional and useful for educational purposes, features are being actively refined and expanded. The tool will continue to improve with enhanced detection capabilities, additional educational content, and performance optimizations. Feedback and contributions are welcome as I work to make this the most comprehensi pri escalation tool a.

⚠️ Legal Disclaimer

This tool is provided for educational and authorized testing purposes only.

LearnPEAS is designed exclusively for:

Capture The Flag (CTF) competitions - HackTheBox, TryHackMe, and similar platforms

Authorized penetration testing - With explicit written permission from system owners

Educational en - Academic courses, training labs, and personal learning

Personal systems - Systems you own or ha authority to test

You must not use this tool for:

Unauthorized access to computer systems

Testing systems without explicit written permission

Any illegal acti or malicious purposes

Circum security measures on systems you do not own or ha to test

By using LearnPEAS, you agree that:

You ha to test the target system

You understand applicable laws in your jurisdiction

You accept full responsibility for your actions

The author and contributors are not liable for any misuse

Unauthorized access to computer systems is illegal in most jurisdictions and may result in criminal prosecution.

🎯 Who Is This For?

LearnPEAS is built for penetration testing students, CTF players, and red teamers who want to:

Learn pri escalation concepts deeply, not just run commands

Understand the "why" behind each

Recognize patterns across different systems

Build mental models for pri escalation, not just checklists

Perfect for HackTheBox, TryHackMe, and OSCP preparation.

🔥 What Makes LearnPEAS Different?

Unlike other enumeration tools, LearnPEAS doesn't just list —it teaches you about them:

Every type includes:

WHAT: Clear definition of the

WHY: Why it exists and why it matters

HOW: Step-by-step exploitation guidance

Real Examples: Actual commands you can run immediately

🚨 Alert System

[!!! CRITICAL !!!] (Red background) - Instant pri escalation paths

[🚩 CTF FLAG 🚩] (Purple background) - CTF flag locations discovered (opt-in only)

[REQUIRES WORK] (Blue background) - Exploitable but requires additional steps (e.g., password cracking)

[] - Exploitable misconfigurations

[WARNING] - Potential security issues

[INFO] - General system information

[LEARN] - Educational explanations (can be disabled with --no-explain)

[OK] - Confirmations that security controls are working

⚡ Core Pri Escalation

Instant Root Access

NOPASSWD sudo entries with GTFOBins exploitation guides

Writable /etc/passwd, /etc/shadow, or /etc/sudoers

SUID interpreters (Python, Perl, Ruby with SUID bit)

Docker/LXD/Disk group membership with container escape techniques

Writable systemd service files or directories

Writable cron jobs and systemd timers

Dangerous Linux capabilities (CAP_SETUID, CAP_DAC_O, CAP_SYS_ADMIN)

Writable ExecStart scripts in systemd services

Pri containers with escape paths

Known exploitable SUID/SGID binaries with GTFOBins integration

Wildcard injection opportunities in scripts

PATH hijacking opportunities

Requires Compilation/Download

Sudo CVEs (Baron Samedit, sudoedit bypass, runas bypass) with checks

Kernel (DirtyCOW, Dirty Pipe, PwnKit, nf_tables) with backport detection

Custom SUID binaries requiring analysis and exploitation

📋 Comprehensi Modules

Core Checks

System fingerprinting with exploitation context

Enhanced network configuration with localhost service identification

- Identifies MySQL, PostgreSQL, Redis, MongoDB, Elasticsearch, Memcached, RabbitMQ
- Detects internal networks for pi
- Firewall detection (iptables, nftables, ufw, firewalld) with bypass techniques
- ARP cache analysis for lateral mo targets

User enumeration with anomaly detection

- Non-root UID 0 accounts
- Empty passwords
- System accounts with shells

Running processes with credential detection

- Passwords in command-line arguments
- Session hijacking (tmux/screen)

Comprehensive SUDO analysis with C

- C, C, C (Baron Samedit)
- C (Runas bypass), C (pwfeedback o)
- Quick checks for each CVE
- Backport detection warnings

SUID/SGID binaries with GTFOBins integration and custom binary analysis

Linux capabilities with detailed exploitation guides

- Whitelisted safe capabilities (reduced false positives)
- Binary-specific exploitation for each capability type

Cron jobs and systemd timers with wildcard injection detection

Systemd service analysis with comprehensi

- Writable service directories and files
- Writable ExecStart scripts
- Writable En detection
- Writable timer files
- Services with Restart=always (persistence)
- Relative path detection with safe binary filtering

Kernel exploit detection with checks and backport warnings

Container detection & escape techniques

- Intelligent internet detection for LXD/LXC (online methods)
- Complete offline exploitation with Alpine image building
- Multiple transfer methods (wget, base64, SCP)

Special group membership (docker, lxd, disk, video, sudo)

Writable sensiti (/etc/passwd, /etc/shadow, /etc/sudoers)

PATH hijacking opportunities

Wildcard injection in scripts (NEW - tar, rsync, chown, chmod with exploitation)

Cloud metadata services (AWS EC2, Azure, GCP) with IAM role detection

Language-specific credential discovery

- .en (Laravel, Node.js, Rails)
- package.json, composer.json, Gemfile
- Python en
- ASP.NET configurations

Enhanced database enumeration

- MySQL, PostgreSQL, MongoDB, Redis with authentication testing
- Database configuration files with credential extraction
- Database dump file discovery

Web application analysis

- Writable web roots and upload directories
- Configuration files with credentials (.en.php, database.yml)
- WordPress extended enumeration (plugins, themes, xmlrpc.php, REST API)
- Framework detection (Laravel, Django, Node.js, Rails, Spring Boot)
- Exposed .git directories with commit history analysis
- Apache Tomcat manager detection
- Spring Boot actuators
- Web server logs with credentials
- Existing web shell detection

CI/CD secret exposure

- Git configuration with embedded tokens
- GitLab CI, GitHub Actions workflows
- Jenkins credentials
- Docker registry credentials

API keys and token discovery (skippable, AWS, GitHub, Slack, Google, Stripe, JWT)

SMB/Samba shares with null session testing

Software checking (exploitation-focused)

- SUID interpreters (Python, Perl, Ruby, PHP, Node)
- CVEs (screen, exim, ansible)
- Interpreters used by root (tarfile, pickle )

Post-exploitation opportunities (persistence, credential har, lateral mo)

Network pi setup (SSH tunneling, internal network discovery)

Password and credential hunting

- Command history for all users
- SSH private keys
- Configuration files
- Mail spools
- Backup files

Interesting file discovery (skippable)

- SUID/SGID in unusual locations
- Recently modified sensiti (48 hours)
- Credential files with content
- Readable sensiti

Hidden files and directories

Process monitoring (skippable, 60-second watch for hidden cron jobs)

Polkit/pkexec analysis (PwnKit C)

Snap package security (devmode, classic confinement, Dirty_sock)

Python library path hijacking

LD.SO.PRELOAD analysis

AppArmor/SELinux writable profiles

Tool a categorized by exploitation value

- Compilers (gcc, make)
- Exploit languages (Python, Perl, Ruby)
- Download tools (wget, curl)
- Pi (nmap, socat, SSH)
- Container tools (docker, kubectl) with group membership
- Shell upgrade techniques (Python PTY, full interactive TTY)

🎮 Interacti

LearnPEAS respects your time with skippable long-running checks. Simply press ENTER to skip:

API key and token discovery - Searches through /home, /var/www, /opt, /etc, /tmp for AWS keys, GitHub tokens, API keys

Process monitoring - 60-second watch for hidden cron jobs

SUID binary search - Comprehensi scan

Recent file search - Modified files in last 48 hours

Credential file search - SSH keys, secrets, password files

This gives you control over scan duration while maintaining thoroughness.

🚀 Usage

Basic Usage

Enable CTF Flag Hunting

Important: Flag hunting is opt-in only. Without the --flags flag, the script will NOT search for or reveal CTF flags. This prevents accidental spoilers in learning en.

Quick Scan (Skip Slow Checks)

Command-Line Options

💡 How LearnPEAS Teaches You

LearnPEAS teaches you to think like a pri escalation expert:

Understand the "Why"

Don't just memorize commands - understand why exist:

Sudo misconfigurations: Why admins grant NOPASSWD and how that breaks security

SUID binaries: Why programs need elevated pri and how that creates attack surface

Container escapes: Why pri containers defeat isolation

Pattern Recognition

Learn to recognize similar issues across different systems:

Identify dangerous sudo entries at a glance

Spot suspicious SUID binaries in unusual locations

Recognize credential patterns in configuration files

Mental Models

Build frameworks for approaching pri escalation systematically:

How to analyze sudo permissions methodically

When to check for kernel exploits

How to prioritize findings (instant root work)

Manual

Always test findings manually - don't just trust automated tools:

Understand what each command does before running it

are actually exploitable

Learn from false positives

📊 Example Output

Critical Findings Summary

📚 Typical CTF/HTB Workflow

⚙️ Design Philosophy

This tool is designed for:

Authorized penetration testing - With explicit written permission

CTF competitions - HackTheBox, TryHackMe, similar platforms

Educational en - Academic courses, training labs

Personal lab systems - Systems you own or control

Never run on systems you don't own or ha permission to test.

⚠️ Important Notes

Performance Considerations

Full enumeration provides comprehensi but takes time

API key scanning can take several minutes on systems with large filesystems

Process monitoring runs for 60 seconds but can be skipped by pressing ENTER

Long-running checks (API keys, process monitoring, password hunting, SUID search, recent files) can be skipped by pressing ENTER

Use --quick mode if time is critical

Stealth Considerations

This script is not stealthy. On monitored systems:

Multiple find commands will be logged

Process enumeration is in logs

File access attempts are auditable

Extended searches trigger IDS/HIDS alerts

For real red team engagements, use targeted manual checks instead.

🤝 Contributing

Contributions welcome! Areas for impro:

Additional pri escalation

Better GTFOBins integration

More CTF-specific checks

Performance optimizations

Additional educational content

More C

Enhanced container escape techniques

🙏 Acknowledgments

Inspired by:

LinPEAS by PEASS-ng team - The gold standard for Linux enumeration

GTFOBins - In resource for exploitation techniques

The HackTheBox and TryHackMe communities

Additional Resources

GTFOBins - Unix binaries exploitation

HackTricks - Pentesting methodology

PayloadsAllTheThings - Exploit collection

Linux Exploit Suggester - Kernel exploit detection

📝 Final Thoughts

Remember: The goal is to learn and understand, not just to root boxes. Take time to read the explanations and understand why each exists. Building deep knowledge will make you a better penetration tester.

Happy learning! 🎓🔓

项目信息

开发语言：Shell

Star 数：64

技术要点

该项目属于CTF思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕Educational Linux privilege escalation script for CTFs/OSCP. Explains WHAT/WHY/HOW for every vulnerability found. Highlights critical findings with red alerts. Extended mode default: cloud metadata, databases, web apps, CI/CD secrets, CTF flags. Teaches privilege escalation patterns, not just commands.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。