PEASS - Privilege Escalation Awesome Scripts SUITE (with colors)
This report summarizes scanner evidence for peass-ng/PEASS-ng, a C# project with 20,645 GitHub stars. SynthScan examined 352,934 lines of code across 1843 source files, recording 3133 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 9.6 (Moderate pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3054 finding(s).
Are imports declared and package/API names verified? 43 finding(s).
Are wrappers, guards, and repeated structures necessary? 892 finding(s).
Which changes need focused human review? 3133 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 3133 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | linPEAS/builder/README.md | 41 | ``` | COMMENT |
| LOW | …nPEAS/builder/linpeas_parts/2_container/6_LXD_group.sh | 1 | # Title: Container - LXD group root-equivalent access | COMMENT |
| LOW | …der/linpeas_parts/2_container/2_List_mounted_tokens.sh | 1 | # Title: Container - List mounted tokens | COMMENT |
| LOW | …r/linpeas_parts/2_container/7_RW_bind_mounts_nosuid.sh | 1 | # Title: Container - Possible shared writable mounts (SUID conditions) | COMMENT |
| LOW | …inpeas_parts/2_container/4_Docker_container_details.sh | 1 | # Title: Container - Docker Container details | COMMENT |
| LOW | …ilder/linpeas_parts/2_container/3_Container_details.sh | 1 | # Title: Container - Container details | COMMENT |
| LOW | …builder/linpeas_parts/2_container/1_Container_tools.sh | 1 | # Title: Container - Container Tools | COMMENT |
| LOW | …builder/linpeas_parts/2_container/1_Container_tools.sh | 21 | # - Privileged tool exploitation | COMMENT |
| LOW | …der/linpeas_parts/2_container/6_Kubernetes_surfaces.sh | 1 | # Title: Container - Kubernetes surfaces | COMMENT |
| LOW | …lder/linpeas_parts/2_container/5_Container_breakout.sh | 1 | # Title: Container - Container & breakout enumeration | COMMENT |
| LOW | …npeas_parts/7_software_information/Browser_profiles.sh | 1 | # Title: Software Information - Browser Profiles | COMMENT |
| LOW | …as_parts/7_software_information/Below_Log_Directory.sh | 1 | # Title: Software Information - Below log directory | COMMENT |
| LOW | …AS/builder/linpeas_parts/7_software_information/Omi.sh | 1 | # Title: Software Information - OMI management listener | COMMENT |
| LOW | …ilder/linpeas_parts/7_software_information/Logstash.sh | 1 | # Title: Software Information - Logstash | COMMENT |
| LOW | …builder/linpeas_parts/7_software_information/Consul.sh | 1 | # Title: Software Information - Consul agent script checks | COMMENT |
| LOW | …S/builder/linpeas_parts/7_software_information/Pamd.sh | 1 | # Title: Software Information - Pam.d | COMMENT |
| LOW | …r/linpeas_parts/7_software_information/Apache_nginx.sh | 1 | # Title: Software Information - Apache-Nginx | COMMENT |
| LOW | …ilder/linpeas_parts/7_software_information/Kerberos.sh | 1 | # Title: Software Information - Kerberos | COMMENT |
| LOW | …r/linpeas_parts/7_software_information/PHP_Sessions.sh | 1 | # Title: Software Information - PHP Sessions | COMMENT |
| LOW | …peas_parts/7_software_information/1_Useful_software.sh | 1 | # Title: Software Information - Useful Software | COMMENT |
| LOW | …er/linpeas_parts/7_software_information/2_Compilers.sh | 1 | # Title: Software Information - Compilers | COMMENT |
| LOW | …npeas_parts/7_software_information/Cached_AD_hashes.sh | 1 | # Title: Software Information - Cached AD Hashes | COMMENT |
| LOW | …lder/linpeas_parts/7_software_information/Vault_ssh.sh | 1 | # Title: Software Information - Vault-ssh | COMMENT |
| LOW | …der/linpeas_parts/7_software_information/Kcpassword.sh | 1 | # Title: Software Information - kcpassword | COMMENT |
| LOW | …AS/builder/linpeas_parts/7_software_information/Ssh.sh | 1 | # Title: Software Information - ssh files | COMMENT |
| LOW | …builder/linpeas_parts/7_software_information/Splunk.sh | 1 | # Title: Software Information - Splunk | COMMENT |
| LOW | …lder/linpeas_parts/7_software_information/Log4shell.sh | 1 | # Title: Software Information - Searching Log4Shell vulnerable libraries | COMMENT |
| LOW | …/builder/linpeas_parts/7_software_information/Mysql.sh | 1 | # Title: Software Information - Mysql | COMMENT |
| LOW | …S/builder/linpeas_parts/7_software_information/Gogs.sh | 1 | # Title: Software Information - Gogs privileged file writes | COMMENT |
| LOW | …uilder/linpeas_parts/7_software_information/FreeIPA.sh | 1 | # Title: Software Information - FreeIPA | COMMENT |
| LOW | …ilder/linpeas_parts/7_software_information/Awsvault.sh | 1 | # Title: Software Information - Check aws-vault | COMMENT |
| LOW | …der/linpeas_parts/7_software_information/Postgresql.sh | 1 | # Title: Software Information - PostgreSQL | COMMENT |
| LOW | …s_parts/7_software_information/Motion_Configuration.sh | 1 | # Title: Software Information - Motion configuration | COMMENT |
| LOW | …arts/7_software_information/PackageKit_Pack2TheRoot.sh | 1 | # Title: Software Information - PackageKit Pack2TheRoot (CVE-2026-41651) | COMMENT |
| LOW | …linpeas_parts/7_software_information/Extra_software.sh | 1 | # Title: Software Information - Extra sotftare | COMMENT |
| LOW | …der/linpeas_parts/7_software_information/Containerd.sh | 1 | # Title: Software Information - containerd installed | COMMENT |
| LOW | …inpeas_parts/7_software_information/Screen_sessions.sh | 1 | # Title: Software Information - Screen sessions | COMMENT |
| LOW | …uilder/linpeas_parts/7_software_information/YubiKey.sh | 1 | # Title: Software Information - YubiKey athentication | COMMENT |
| LOW | …S/builder/linpeas_parts/7_software_information/Tmux.sh | 1 | # Title: Software Information - Tmux | COMMENT |
| LOW | …S/builder/linpeas_parts/7_software_information/Runc.sh | 1 | # Title: Software Information - Runc | COMMENT |
| LOW | …builder/linpeas_parts/7_software_information/Gitlab.sh | 1 | # Title: Software Information - Gitlab | COMMENT |
| LOW | …uilder/linpeas_parts/7_software_information/PGP_GPG.sh | 1 | # Title: Software Information - PGP-GPG | COMMENT |
| LOW | …uilder/linpeas_parts/7_software_information/Dovecot.sh | 1 | # Title: Software Information - Dovecot | COMMENT |
| LOW | …builder/linpeas_parts/7_software_information/Docker.sh | 1 | # Title: Software Information - Docker | COMMENT |
| LOW | …S/builder/linpeas_parts/7_software_information/SKey.sh | 1 | # Title: Software Information - S/Key athentication | COMMENT |
| LOW | …ts/7_software_information/Postgresql_Event_Triggers.sh | 1 | # Title: Software Information - PostgreSQL Event Triggers | COMMENT |
| LOW | …oftware_information/3_Macos_writable_installed_apps.sh | 1 | # Title: Software Information - MacOS writable Installed Applications | COMMENT |
| LOW | …cs_crons_timers_srvcs_sockets/17_Deleted_open_files.sh | 1 | # Title: Processes & Cron & Services & Timers - Deleted open files | COMMENT |
| LOW | …_crons_timers_srvcs_sockets/16_Crontab_UI_misconfig.sh | 1 | # Title: Processes & Cron & Services & Timers - Crontab UI (root) Misconfiguration | COMMENT |
| LOW | …4_procs_crons_timers_srvcs_sockets/1_List_processes.sh | 1 | # Title: Processes & Cron & Services & Timers - List processes | COMMENT |
| LOW | …procs_crons_timers_srvcs_sockets/15_Rcommands_trust.sh | 1 | # Title: Processes & Cron & Services & Timers - Legacy r-commands and host-based trust | COMMENT |
| LOW | …4_procs_crons_timers_srvcs_sockets/14_DBus_analysis.sh | 1 | # Title: Processes & Cron & Services & Timers - D-Bus Analysis | COMMENT |
| LOW | …/4_procs_crons_timers_srvcs_sockets/12_Socket_files.sh | 1 | # Title: Processes & Cron & Services & Timers - Socket Files Analysis | COMMENT |
| LOW | …rons_timers_srvcs_sockets/13_Unix_sockets_listening.sh | 1 | # Title: Processes & Cron & Services & Timers - Unix Sockets Analysis | COMMENT |
| LOW | …ts/4_procs_crons_timers_srvcs_sockets/18_Xvfb_fbdir.sh | 1 | # Title: Processes & Cron & Services & Timers - Cross-user Xvfb framebuffer files | COMMENT |
| LOW | …_crons_timers_srvcs_sockets/18_Macos_updater_toctou.sh | 1 | # Title: Processes & Cron & Services & Timers - macOS privileged updater TOCTOU candidates | COMMENT |
| LOW | …arts/4_procs_crons_timers_srvcs_sockets/10_Services.sh | 1 | # Title: Processes & Cron & Services & Timers - Services and Service Files | COMMENT |
| LOW | …imers_srvcs_sockets/5_Files_open_process_other_user.sh | 1 | # Title: Processes & Cron & Services & Timers - Files opened by processes belonging to other users | COMMENT |
| LOW | …cs_crons_timers_srvcs_sockets/19_Erlang_ssh_daemons.sh | 1 | # Title: Processes & Cron & Services & Timers - Erlang SSH daemons | COMMENT |
| LOW | …_timers_srvcs_sockets/8_Macos_launch_agents_daemons.sh | 1 | # Title: Processes & Cron & Services & Timers - Third party LaunchAgents & LaunchDemons | COMMENT |
| 2059 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | linPEAS/tests/test_container_rw_mounts.py | 30 | def test_mountinfo_fields_and_constraints(self): | CODE |
| LOW | linPEAS/tests/test_container_rw_mounts.py | 69 | def test_uid_mapping_is_cautious(self): | CODE |
| LOW | linPEAS/tests/test_container_rw_mounts.py | 77 | def test_proc_mounts_fallback_is_generic(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 53 | def test_exact_root_policy_and_direct_relative_call(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 62 | def test_requires_shell_source_and_unrestricted_effective_policy(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 79 | def test_rejects_directory_changes_and_noncommand_mentions(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 91 | def test_deduplicates_and_parses(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 98 | def test_root_sudo_shell_cp_glob_is_conditional_candidate(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 111 | def test_cp_glob_requires_exact_policy_plain_glob_and_caller_cwd(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 137 | def test_python_literal_helper_under_exact_interpreter_rule(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 172 | def test_python_cue_requires_call_and_no_fixed_cwd(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 188 | def test_ruby_relative_yaml_under_exact_root_rule(self): | CODE |
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 222 | def test_go_wasm_gate_and_relative_shell_under_exact_root_rule(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sudo_terraform_override.py | 84 | def test_matching_writable_override_is_review_candidate(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sudo_terraform_override.py | 90 | def test_missing_or_nonroot_grant_and_other_subcommand(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sudo_terraform_override.py | 98 | def test_environment_and_source_mismatch(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sudo_terraform_override.py | 108 | def test_bounded_config_and_provider_access(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sudo_terraform_override.py | 113 | def test_symlinked_parent_paths_are_suppressed(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sudo_terraform_override.py | 118 | def test_yaml_lists_cli_config_without_dumping_contents(self): | CODE |
| LOW | linPEAS/tests/test_sudo_git_clamscan_highlight.py | 22 | def test_exact_command_and_anchored_sudoers_forms(self): | CODE |
| LOW | linPEAS/tests/test_sudo_git_clamscan_highlight.py | 33 | def test_lookalikes_negations_and_other_options(self): | CODE |
| LOW | linPEAS/tests/test_sudo_git_clamscan_highlight.py | 48 | def test_variable_module_shell_syntax(self): | CODE |
| LOW | linPEAS/tests/test_suse_pam_libblockdev.py | 72 | def test_suse_ssh_pam_path_reports_evidence_and_unknown_patch_status(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 84 | def test_disabled_user_environment_or_non_suse_is_suppressed(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 92 | def test_pam_path_requires_session_module(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 100 | def test_pam_patched_or_unknown_implicit_default_is_suppressed(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 108 | def test_explicit_setting_remains_a_candidate_after_pam_update(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 115 | def test_stale_auth_stack_with_old_pam_is_reported_after_config_update(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 122 | def test_leap_implicit_environment_with_both_old_packages_is_reported(self): | CODE |
| LOW | linPEAS/tests/test_suse_pam_libblockdev.py | 152 | def test_libblockdev_path_reports_passive_evidence(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 163 | def test_libblockdev_path_requires_active_policy_and_xfs_tool(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 173 | def test_libblockdev_patched_and_unknown_packages_are_suppressed(self): | CODE |
| LOW⚡ | linPEAS/tests/test_suse_pam_libblockdev.py | 181 | def test_generic_non_suse_package_does_not_get_a_cve_finding(self): | CODE |
| LOW | linPEAS/tests/test_minikube_crio_log_probe.py | 35 | def test_reports_only_bounded_historical_version(self): | CODE |
| LOW | linPEAS/tests/test_minikube_crio_log_probe.py | 46 | def test_rejects_links_and_nonregular_files(self): | CODE |
| LOW | linPEAS/tests/test_minikube_crio_log_probe.py | 71 | def test_caps_homes_bytes_and_lines(self): | CODE |
| LOW | linPEAS/tests/test_minikube_crio_log_probe.py | 84 | def test_rejects_unvalidated_versions(self): | CODE |
| LOW⚡ | linPEAS/tests/test_cifswitch.py | 77 | def test_complete_vulnerable_chain_is_reported_without_executing_helper(self): | CODE |
| LOW⚡ | linPEAS/tests/test_cifswitch.py | 87 | def test_backported_patch_marker_suppresses_finding(self): | CODE |
| LOW⚡ | linPEAS/tests/test_cifswitch.py | 95 | def test_fixed_upstream_stable_version_suppresses_finding(self): | CODE |
| LOW⚡ | linPEAS/tests/test_cifswitch.py | 103 | def test_upstream_fixed_version_boundaries(self): | CODE |
| LOW | linPEAS/tests/test_cifswitch.py | 144 | def test_inactive_upcall_rule_suppresses_finding(self): | CODE |
| LOW | linPEAS/tests/test_cifswitch.py | 152 | def test_unloaded_cifs_module_suppresses_finding(self): | CODE |
| LOW | linPEAS/tests/test_sudo_bee_backdrop.py | 63 | def test_root_grant_reports_once_without_executing_bee(self): | CODE |
| LOW | linPEAS/tests/test_sudo_bee_backdrop.py | 76 | def test_restricted_nonroot_negated_and_other_binary_are_not_candidates(self): | CODE |
| LOW | linPEAS/tests/test_sudo_bee_backdrop.py | 96 | def test_policy_limits_suppress_ambiguous_results(self): | CODE |
| LOW | linPEAS/tests/test_sudo_bee_backdrop.py | 101 | def test_backdrop_selector_is_path_only_and_preserves_drupal(self): | CODE |
| LOW | linPEAS/tests/test_sysv_shared_memory.py | 48 | def test_linux_numeric_modes_select_other_writable_root_only(self): | CODE |
| LOW | linPEAS/tests/test_sysv_shared_memory.py | 62 | def test_bsd_symbolic_modes_select_other_writable_root_only(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sysv_shared_memory.py | 75 | def test_empty_or_unrecognized_output_is_quiet(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sysv_shared_memory.py | 79 | def test_offline_filesystem_search_skips_ipc(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sysv_shared_memory.py | 89 | def test_candidate_limit_is_explicit(self): | CODE |
| LOW⚡ | linPEAS/tests/test_sysv_shared_memory.py | 97 | def test_input_line_limit_is_explicit(self): | CODE |
| LOW | linPEAS/tests/test_dirty_pipe_registry.py | 36 | def test_disjoint_upstream_fixed_boundaries(self): | STRING |
| LOW | linPEAS/tests/test_roundcube_sensitive_files.py | 29 | def test_four_keys_are_bounded_and_values_redacted(self): | CODE |
| LOW | linPEAS/tests/test_roundcube_sensitive_files.py | 50 | def test_generic_php_and_absent_config_have_no_output(self): | CODE |
| LOW | linPEAS/tests/test_roundcube_sensitive_files.py | 54 | def test_builder_emits_selector_in_existing_roundcube_section(self): | CODE |
| LOW | linPEAS/tests/test_systemd_environment_files.py | 32 | def test_oversized_unit_is_not_scanned(self): | CODE |
| LOW | linPEAS/tests/test_systemd_environment_files.py | 43 | def test_quoted_optional_path_reports_keys_without_values(self): | CODE |
| LOW | linPEAS/tests/test_systemd_environment_files.py | 72 | def test_optional_prefix_inside_quotes_is_supported(self): | CODE |
| 780 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | linPEAS/tests/test_cifswitch.py | 125 | f"echo {version}=yes || echo {version}=no" | CODE |
| HIGH | linPEAS/tests/test_diagspill.py | 188 | f"echo {version}=yes || echo {version}=no" | CODE |
| HIGH | linPEAS/tests/test_password_scan_bounds.py | 44 | ["/bin/sh", "-c", "command -v timeout || command -v gtimeout"], | CODE |
| HIGH | linPEAS/tests/test_snap_confine.py | 127 | f"echo {version}=yes || echo {version}=no" | CODE |
| HIGH⚡ | linPEAS/tests/test_php_mysqli_candidates.py | 60 | 'new mysqli("h", "u", null);\n' | CODE |
| HIGH⚡ | linPEAS/tests/test_doas.py | 46 | doas_version_lt 6.8 6.8.1 && echo lt=yes | STRING |
| HIGH⚡ | linPEAS/tests/test_doas.py | 47 | doas_version_ge 6.8.1 6.8.1 && echo ge=yes | STRING |
| HIGH⚡ | linPEAS/tests/test_doas.py | 48 | doas_version_le 6.8.2 6.8.2 && echo le=yes | STRING |
| HIGH⚡ | linPEAS/tests/test_doas.py | 49 | ! doas_version_lt 6.9 6.8.1 && echo newer=yes | STRING |
| HIGH | linPEAS/tests/test_doas.py | 73 | doas_rule_has_option "$rule" nopass && echo nopass=yes | STRING |
| HIGH⚡ | linPEAS/tests/test_doas.py | 95 | doas_rule_has_option "$rule" setenv && echo setenv=yes | STRING |
| HIGH⚡ | linPEAS/tests/test_needrestart.py | 166 | "lp_version_lt 3.7 3.8 && echo old=yes", | CODE |
| HIGH⚡ | linPEAS/tests/test_needrestart.py | 167 | "lp_version_lt 3.10 3.8 || echo new=yes", | CODE |
| HIGH | linPEAS/tests/test_builder.py | 224 | f'source "{base_file}" >/dev/null 2>&1 || true; ' | CODE |
| HIGH⚡ | linPEAS/tests/test_kubernetes_surfaces.py | 70 | result = self.run_shell('containerType=No; k8s_context_present && echo found', env=env) | CODE |
| HIGH⚡ | linPEAS/tests/test_kubernetes_surfaces.py | 457 | "k8s_kubectl config current-context || echo bounded", env=env | CODE |
| HIGH⚡ | linPEAS/tests/test_kubernetes_surfaces.py | 466 | 'k8s_kubectl config current-context || echo skipped' | CODE |
| HIGH⚡ | linPEAS/tests/test_kubernetes_surfaces.py | 474 | 'done; k8s_cap_has 0000000000000000 21 || echo "21 absent"' | CODE |
| HIGH | linPEAS/tests/test_kubernetes_surfaces.py | 329 | 'k8s_direct_token=SENSITIVE_TOKEN_VALUE; k8s_direct_ca=/dev/null; ' | CODE |
| HIGH | linPEAS/tests/test_sudo_npbackup_config.py | 52 | "n=$(cat \"$FAKE_DATE_STATE\" 2>/dev/null || echo 0)\n" | CODE |
| HIGH | linPEAS/tests/test_pg_basebackup_boundary.py | 48 | "pgbb_metadata() { case \"$1\" in \"$PG_TEST_ROOT\"/cron.d/*|\"$PG_TEST_ROOT\"/backup-wrapper|\"$PG_TEST | CODE |
| HIGH | linPEAS/tests/test_pg_basebackup_boundary.py | 48 | "pgbb_metadata() { case \"$1\" in \"$PG_TEST_ROOT\"/cron.d/*|\"$PG_TEST_ROOT\"/backup-wrapper|\"$PG_TEST | CODE |
| HIGH⚡ | linPEAS/tests/test_udisks.py | 171 | "lp_version_lt 2.10.91 2.11.2 && echo old=yes", | CODE |
| HIGH⚡ | linPEAS/tests/test_udisks.py | 172 | "lp_version_lt 2.11.10 2.11.2 || echo new=yes", | CODE |
| HIGH | linPEAS/tests/test_writable_scan_pruning.py | 49 | '. "$1" >/dev/null 2>/dev/null; ' | CODE |
| HIGH | linPEAS/builder/src/linpeasBuilder.py | 210 | calls.extend(f'{var}=$(cat "$FIND_CACHE_DIR/{var}" 2>/dev/null)' for var in variables) | CODE |
| HIGH | linPEAS/builder/src/linpeasBuilder.py | 350 | os.system(f"cd /tmp; tar -xvzf /tmp/bin_builder 2> /dev/null; rm /tmp/bin_builder; mv {tar_gz} /tmp/bin_buil | CODE |
| HIGH | winPEAS/winPEASps1/test_gmsa_reader_bounds.py | 84 | "$tokens=$null; $errors=$null; " | CODE |
| HIGH | parsers/tests/test_json2html.py | 21 | "clean_text": "[-] /usr/bin/echo && chmod 2>/dev/null", | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …PEASexe/winPEAS/TaskScheduler/JetBrains.Annotations.cs | 624 | /// <c>System.Web.Mvc.Html.ChildActionExtensions.RenderAction(HtmlHelper, String)</c>. | COMMENT |
| CRITICAL | …PEASexe/winPEAS/TaskScheduler/JetBrains.Annotations.cs | 642 | /// <c>System.Web.Mvc.Html.ChildActionExtensions.RenderAction(HtmlHelper, String)</c>. | COMMENT |
| CRITICAL | …PEASexe/winPEAS/TaskScheduler/JetBrains.Annotations.cs | 661 | /// <c>System.Web.Mvc.Html.ChildActionExtensions.RenderAction(HtmlHelper, String, String)</c>. | COMMENT |
| CRITICAL | …PEASexe/winPEAS/TaskScheduler/JetBrains.Annotations.cs | 694 | /// <c>System.Web.Mvc.Html.RenderPartialExtensions.RenderPartial(HtmlHelper, String)</c>. | COMMENT |
| CRITICAL | …PEASexe/winPEAS/TaskScheduler/JetBrains.Annotations.cs | 708 | /// <c>System.Web.Mvc.Html.DisplayExtensions.DisplayForModel(HtmlHelper, String)</c>. | COMMENT |
| CRITICAL | …PEASexe/winPEAS/TaskScheduler/JetBrains.Annotations.cs | 716 | /// <c>System.Web.Mvc.Html.EditorExtensions.EditorForModel(HtmlHelper, String)</c>. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …4_procs_crons_timers_srvcs_sockets/1_List_processes.sh | 182 | # Check if we can access the FD but not the target file | COMMENT |
| LOW | …/4_procs_crons_timers_srvcs_sockets/12_Socket_files.sh | 39 | # Check if socket file is writable (following symlinks) | COMMENT |
| LOW | …/4_procs_crons_timers_srvcs_sockets/12_Socket_files.sh | 59 | # Check if executable is writable (following symlinks) | COMMENT |
| LOW | …/4_procs_crons_timers_srvcs_sockets/12_Socket_files.sh | 89 | # Check if listener path is writable (following symlinks) | COMMENT |
| LOW | …arts/4_procs_crons_timers_srvcs_sockets/10_Services.sh | 74 | # Check if service runs with elevated privileges | COMMENT |
| LOW | …arts/4_procs_crons_timers_srvcs_sockets/10_Services.sh | 125 | # Check if service file is writable (following symlinks) | COMMENT |
| LOW | …_timers_srvcs_sockets/8_Macos_launch_agents_daemons.sh | 80 | # Check if plist is writable | COMMENT |
| LOW | …_timers_srvcs_sockets/8_Macos_launch_agents_daemons.sh | 92 | # Check if program is writable | COMMENT |
| LOW | …/4_procs_crons_timers_srvcs_sockets/9_System_timers.sh | 47 | # Check if the service runs with elevated privileges | COMMENT |
| LOW | …/4_procs_crons_timers_srvcs_sockets/9_System_timers.sh | 193 | # Check if timer file is writable (following symlinks) | COMMENT |
| LOW | …/4_procs_crons_timers_srvcs_sockets/9_System_timers.sh | 253 | # Check if timer file is writable | COMMENT |
| LOW | …arts/4_procs_crons_timers_srvcs_sockets/7_Cron_jobs.sh | 703 | # Check if it's a regular file | COMMENT |
| LOW | …arts/4_procs_crons_timers_srvcs_sockets/7_Cron_jobs.sh | 706 | # Check if it's writable and executable | COMMENT |
| LOW | …arts/4_procs_crons_timers_srvcs_sockets/7_Cron_jobs.sh | 814 | # # Check if the file is writable | COMMENT |
| LOW | …crons_timers_srvcs_sockets/3_Process_binaries_perms.sh | 31 | # Check if binary is writable | COMMENT |
| LOW | …imers_srvcs_sockets/4_Processes_PPID_different_user.sh | 55 | # Check if users are different and PPID user is not root | COMMENT |
| LOW | …der/linpeas_parts/linpeas_base/1_check_network_jobs.sh | 89 | #Check if IP and Netmask are correct and the use nc to find hosts. By default check ports: 22 80 443 445 3389 | COMMENT |
| LOW | …der/linpeas_parts/linpeas_base/1_check_network_jobs.sh | 158 | #Check if IP and Netmask are correct and the use fping or ping to find hosts | COMMENT |
| LOW | …der/linpeas_parts/linpeas_base/1_check_network_jobs.sh | 249 | #Check if LOCAL_PORT is a number | COMMENT |
| LOW | …der/linpeas_parts/linpeas_base/1_check_network_jobs.sh | 254 | #Check if REMOTE_PORT is a number | COMMENT |
| LOW | …lder/linpeas_parts/8_interesting_perms_files/1_SUID.sh | 141 | if [ ${#sline_first} -gt 2 ] && command -v "$sline_first" 2>/dev/null | grep -q '/' && echo "$sline_fi | CODE |
| LOW | …lder/linpeas_parts/8_interesting_perms_files/2_SGID.sh | 63 | if [ ${#sline_first} -gt 2 ] && command -v "$sline_first" 2>/dev/null | grep -q '/'; then #Check if ex | CODE |
| LOW | …der/linpeas_parts/5_network_information/9_Inetdconf.sh | 99 | # Check if inetd is installed | COMMENT |
| LOW | …der/linpeas_parts/5_network_information/9_Inetdconf.sh | 109 | # Check if inetd is running | COMMENT |
| LOW | …der/linpeas_parts/5_network_information/9_Inetdconf.sh | 148 | # Check if xinetd is installed | COMMENT |
| LOW | …der/linpeas_parts/5_network_information/9_Inetdconf.sh | 154 | # Check if xinetd is running | COMMENT |
| LOW | …der/linpeas_parts/5_network_information/9_Inetdconf.sh | 183 | # Check if service is enabled | COMMENT |
| LOW | …lder/linpeas_parts/5_network_information/8_Iptables.sh | 31 | # Check if iptables is available | COMMENT |
| LOW | …lder/linpeas_parts/5_network_information/8_Iptables.sh | 37 | # Check if we have permission to list rules | COMMENT |
| LOW | …lder/linpeas_parts/5_network_information/8_Iptables.sh | 74 | # Check if nft is available | COMMENT |
| LOW | …lder/linpeas_parts/5_network_information/8_Iptables.sh | 80 | # Check if we have permission to list rules | COMMENT |
| LOW | …lder/linpeas_parts/5_network_information/8_Iptables.sh | 110 | # Check if firewall-cmd is available | COMMENT |
| LOW | …lder/linpeas_parts/5_network_information/8_Iptables.sh | 116 | # Check if firewalld is running | COMMENT |
| LOW | …lder/linpeas_parts/5_network_information/8_Iptables.sh | 150 | # Check if ufw is available | COMMENT |
| LOW | …lder/linpeas_parts/5_network_information/8_Iptables.sh | 156 | # Check if UFW is running | COMMENT |
| LOW | linPEAS/builder/src/linpeasModule.py | 177 | # Check if the indicated dependencies are actually being used | COMMENT |
| LOW | linPEAS/builder/src/linpeasModule.py | 199 | # Check if all variables are correctly defined | COMMENT |
| LOW | linPEAS/builder/src/linpeasModule.py | 231 | # Check if other object is an instance of LinpeasModule | COMMENT |
| LOW | linPEAS/builder/src/linpeasModule.py | 252 | # Check if item is already a LinpeasModule object. | COMMENT |
| LOW | linPEAS/builder/src/linpeasBaseBuilder.py | 156 | sorted_funcs.index(d_func) # Check if it's there | CODE |
| LOW | linPEAS/builder/src/linpeasBaseBuilder.py | 195 | sorted_vars.index(d_var) # Check if it's there | CODE |
| LOW | …/winPEASexe/winPEAS/Info/WindowsCreds/AppCmd/AppCmd.cs | 8 | # Check if appcmd.exe exists | COMMENT |
| LOW | …/winPEASexe/winPEAS/Info/WindowsCreds/AppCmd/AppCmd.cs | 34 | # Check if credentials exists | COMMENT |
| LOW⚡ | …/winPEASexe/winPEAS/Info/WindowsCreds/AppCmd/AppCmd.cs | 55 | # Check if credentials exists | COMMENT |
| LOW⚡ | …/winPEASexe/winPEAS/Info/WindowsCreds/AppCmd/AppCmd.cs | 62 | # Check if any passwords were found | COMMENT |
| LOW⚡ | …/winPEASexe/winPEAS/Info/WindowsCreds/AppCmd/AppCmd.cs | 64 | # Display results in list view that can feed into the pipeline | COMMENT |
| LOW | build_lists/sensitive_files.yaml | 124 | check_extra_path: "" # Check if found files are in a specific path (linpeas; opt-in selectors on winpeas) | CODE |
| LOW | .github/workflows/artifacts_cleanup.yml | 14 | expire-in: 1days # Set this to 0 to delete all artifacts | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …ASexe/winPEAS/Info/NetworkInfo/InternetConnectivity.cs | 10 | // ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ASexe/winPEAS/Info/NetworkInfo/InternetConnectivity.cs | 12 | // ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ASexe/winPEAS/Info/NetworkInfo/InternetConnectivity.cs | 33 | // ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ASexe/winPEAS/Info/NetworkInfo/InternetConnectivity.cs | 35 | // ─────────────────────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ASexe/winPEAS/Info/NetworkInfo/InternetConnectivity.cs | 55 | // ─── Helpers ─────────────────────────────────────────────── | COMMENT |
| MEDIUM | …ASexe/winPEAS/Info/NetworkInfo/InternetConnectivity.cs | 159 | // ─── Main entry ─────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 13 | # ─── Section 1: System Information ──────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 29 | # ─── Section 2: Container ───────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 36 | # ─── Section 3: Cloud ───────────────────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 51 | # ─── Section 4: Processes / Crons / Timers / Services / Sockets ─────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 69 | # ─── Section 5: Network Information ─────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 81 | # ─── Section 6: Users Information ───────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 100 | # ─── Section 7: Software Information ────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 132 | # ─── Section 8: Interesting Permissions / Files ──────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 150 | # ─── Section 9: Interesting Files ───────────────────────────────────────── | COMMENT |
| MEDIUM | scripts/add_mitre_tags.py | 180 | # ─── Section 10: API Keys Regex ─────────────────────────────────────────── | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | linPEAS/builder/linpeas_builder.py | 25 | except FileNotFoundError: | CODE |
| HIGH | linPEAS/builder/src/linpeasBaseBuilder.py | 159 | except: | CODE |
| HIGH | linPEAS/builder/src/linpeasBaseBuilder.py | 198 | except: | CODE |
| HIGH | build_lists/update_windows_version_defs.py | 219 | except ValueError: | CODE |
| HIGH | build_lists/update_windows_version_defs.py | 225 | except ValueError: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 54 | except Exception: | CODE |
| LOW | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 64 | except Exception: | CODE |
| LOW | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 81 | except Exception: | CODE |
| LOW | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 115 | except Exception as e: | CODE |
| LOW | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 154 | except Exception: | CODE |
| LOW⚡ | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 208 | except Exception as e: | CODE |
| LOW⚡ | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 213 | except Exception: | CODE |
| LOW⚡ | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 220 | except Exception: | CODE |
| LOW⚡ | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 227 | except Exception: | CODE |
| LOW⚡ | …nPEAS/builder/linpeas_parts/functions/checkCopyFail.sh | 233 | except Exception: | CODE |
| MEDIUM | parsers/json2pdf.py | 167 | print("Error: Please pass the peas.json file and the path to save the pdf\njson2pdf.py <json_file> <pdf_file.pdf | CODE |
| MEDIUM | parsers/json2html.py | 374 | print("Error: Please pass the peas.json file and the path to save the html\njson2html.py <json_file.json> <HTML_ | CODE |
| MEDIUM | parsers/peas2json.py | 184 | print("Error: Please pass the peas.out file and the path to save the json\npeas2json.py <output_file> <json_file | CODE |
| MEDIUM | build_lists/download_regexes.py | 21 | print("Error: Unable to download the regexes file.") | CODE |
| LOW | .github/workflows/chack-agent-pr-triage.yml | 338 | except Exception: | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | linPEAS/tests/test_dirty_pipe_registry.py | 36 | CODE | |
| LOW | linPEAS/tests/test_gtfobins_archive_builder.py | 116 | CODE | |
| LOW | linPEAS/tests/test_ssh_control_sockets.py | 50 | CODE | |
| LOW | linPEAS/tests/test_sudo_python_tar.py | 17 | CODE | |
| LOW | linPEAS/builder/src/linpeasModule.py | 9 | CODE | |
| LOW | linPEAS/builder/src/linpeasBuilder.py | 164 | CODE | |
| LOW | linPEAS/builder/src/linpeasBuilder.py | 259 | CODE | |
| LOW | linPEAS/builder/src/linpeasBuilder.py | 359 | CODE | |
| LOW | linPEAS/builder/src/linpeasBuilder.py | 392 | CODE | |
| LOW | linPEAS/builder/src/linpeasBaseBuilder.py | 29 | CODE | |
| LOW | linPEAS/builder/src/linpeasBaseBuilder.py | 144 | CODE | |
| LOW | linPEAS/builder/src/linpeasBaseBuilder.py | 183 | CODE | |
| LOW | winPEAS/winPEASps1/test_lm_compatibility_policy.py | 13 | CODE | |
| LOW | parsers/json2pdf.py | 72 | CODE | |
| LOW | parsers/json2html.py | 9 | CODE | |
| LOW | parsers/peas2json.py | 48 | CODE | |
| LOW | parsers/peas2json.py | 104 | CODE | |
| LOW | build_lists/update_windows_version_defs.py | 167 | CODE | |
| LOW | build_lists/update_windows_version_defs.py | 410 | CODE | |
| LOW | build_lists/update_windows_version_defs.py | 579 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | .github/workflows/CI-master_tests.yml | 497 | # Create the release | COMMENT |
| MEDIUM⚡ | metasploit/peass.rb | 353 | # Create a RijndaelManaged object | COMMENT |
| MEDIUM⚡ | metasploit/peass.rb | 362 | # Create an encryptor to perform the stream transform. | COMMENT |
| MEDIUM⚡ | metasploit/peass.rb | 365 | # Create the streams used for encryption. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | linPEAS/tests/test_sudo_relative_cwd.py | 23 | CODE | |
| LOW | linPEAS/tests/test_sudo_terraform_override.py | 17 | CODE | |
| LOW | linPEAS/tests/test_sudo_python_local_import.py | 17 | CODE | |
| LOW | linPEAS/tests/test_crio_pinns_suid.py | 14 | CODE | |
| LOW | linPEAS/tests/test_sudo_gitpython_clone.py | 34 | CODE | |
| LOW | linPEAS/tests/test_macos_updater_toctou.py | 28 | CODE | |
| LOW | linPEAS/tests/test_sudo_python_bytecode_cache.py | 17 | CODE | |
| LOW | linPEAS/tests/test_systemd_writable_dropins.py | 22 | CODE | |
| LOW | linPEAS/tests/test_sudo_model_loader.py | 21 | CODE | |
| LOW | linPEAS/tests/test_system_timers.py | 23 | CODE | |
| LOW | linPEAS/tests/test_sudo_mktemp_dry_run.py | 27 | CODE | |
| LOW | linPEAS/tests/test_sudo_setenv_pythonpath.py | 22 | CODE | |
| LOW | linPEAS/tests/test_sudo_setenv_path.py | 22 | CODE | |
| LOW | linPEAS/tests/test_sudo_ps2pdf_nosafer.py | 24 | CODE | |
| LOW | linPEAS/tests/test_sudo_python_tar.py | 17 | CODE | |
| LOW | linPEAS/builder/src/fileRecord.py | 4 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …AS/winPEASexe/winPEAS/Properties/Resources.Designer.cs | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …PEASexe/winPEAS/3rdParty/AlphaFS/Resources.Designer.cs | 3 | // This code was generated by a tool. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | linPEAS/tests/test_sudo_gitpython_clone.py | 6 | CODE | |
| LOW | linPEAS/tests/test_builder.py | 1 | CODE | |
| LOW | linPEAS/tests/test_cups_retained_jobs.py | 3 | CODE | |
| LOW | linPEAS/builder/linpeas_builder.py | 4 | CODE | |
| LOW | linPEAS/builder/linpeas_builder.py | 4 | CODE | |
| LOW | parsers/json2pdf.py | 5 | CODE | |
| LOW | build_lists/update_windows_version_defs.py | 3 | CODE | |
| LOW | scripts/add_mitre_tags.py | 7 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …esystem/Native Methods/NativeMethods.FileManagement.cs | 156 | /// The default marshaling for bool is four bytes (to allow seamless integration with BOOL return values). | COMMENT |
| MEDIUM | …esystem/Native Methods/NativeMethods.FileManagement.cs | 175 | /// The default marshaling for bool is four bytes (to allow seamless integration with BOOL return values). | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | winPEAS/winPEASexe/winPEAS/Checks/ApplicationsInfo.cs | 111 | Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation | CODE |
| MEDIUM | winPEAS/winPEASexe/winPEAS/Checks/ServicesInfo.cs | 259 | Beaprint.LinkPrint("https://book.hacktricks.wiki/en/windows-hardening/windows-local-privilege-escalation | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | …lder/linpeas_parts/functions/enumerateDockerSockets.sh | 5 | # Description: Search interesting container runtime, orchestration, and build sockets that could expose high-impact APIs | COMMENT |