The commands you need most: download with curl -L … -o linpeas.sh, run with ./linpeas.sh, target sections with -o, control speed with -s or -a, and save output with | tee or -N >. Full per-flag detail is on the flags reference.
Flag names and defaults can change between releases. Everything here is verified against release 20260908-dffb9496; confirm with ./linpeas.sh -h on your copy.
In a hurry? The LinPEAS cheat sheet condenses the commands below onto one page, and the flags reference explains every option in detail.
Download#
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh # curl
wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -O linpeas.sh # wgetRun#
chmod +x linpeas.sh && ./linpeas.sh # default (fast) run
sh linpeas.sh # run without the execute bit| Goal | Command |
|---|---|
| Default audit | ./linpeas.sh |
| Quiet/fast first pass | ./linpeas.sh -s |
| Deep audit (lab/CTF) | ./linpeas.sh -a |
| Deep + secret regexes | ./linpeas.sh -a -r |
| No banner | ./linpeas.sh -q |
| Show help for your build | ./linpeas.sh -h |
Target specific sections#
Use -o with a comma-separated list to run only what you need. This is the fastest way to keep output manageable.
./linpeas.sh -o users_information,interesting_perms_files
./linpeas.sh -o system_information,container,cloud-o name | Section | Checks | ATT&CK | What it covers |
|---|---|---|---|---|
system_information | System Information | 23 | T1082, T1068, T1518.001 | OS and kernel details, sudo version, PATH, mounts and disks, environment, kernel modules, protections (AppArmor/SELinux/etc.), and known-kernel-exploit registry checks. |
container | Container | 7 | T1611, T1613 | Detects Docker/LXC/containerd context, mounted service tokens, writable bind mounts, and known container-breakout conditions. |
cloud | Cloud | 13 | T1552.005, T1580 | Detects and enumerates AWS (EC2/ECS/Lambda/CodeBuild), GCP, Azure (VM/App/Automation), DigitalOcean, Alibaba, IBM and Tencent metadata and credentials. |
procs_crons_timers_srvcs_sockets | Processes, Crons, Timers, Services, Sockets | 31 | T1053.003, T1543.002, T1057 | Running processes, credentials in process memory, cron jobs and frequent-job monitoring, systemd services/timers and PATH, sockets and D-Bus. |
network_information | Network Information | 17 | T1016, T1049 | Interfaces, hosts/DNS, neighbours, listening ports, firewall rules, and internet-access probes. |
users_information | Users Information | 23 | T1033, T1548.003, T1087.001 | Current user, sudo/sudoers and sudo tokens, pkexec/polkit, doas, UID 0 accounts, groups, login history, and optional su testing. |
software_information | Software Information | 131 | T1552.001, T1587.001 | Useful software and compilers, and configuration/credential analysis for a very large set of applications (databases, web servers, CI/CD, mail, VPN, SSH, cloud CLIs, and more). |
interesting_perms_files | Files with Interesting Permissions | 16 | T1548.001, T1574.010 | SUID/SGID binaries, file capabilities, ACLs, ld.so misconfigurations, writable init/service files, and writable root-owned executables. |
interesting_files | Other Interesting Files | 36 | T1083, T1552.001 | Scripts in PATH, unexpected files, writable logs, backups, databases, hidden files, and password/credential searches across the filesystem. |
api_keys_regex | API Keys Regex | 4 | T1552.001 | Regex searches for hashed passwords, raw hashes, API keys and other secrets. Runs only with -r. |
Save output#
./linpeas.sh | tee linpeas.out # keep colours
less -r linpeas.out # read colours back
./linpeas.sh -N > linpeas.txt # plain text, no coloursUseful one-liners#
The curl … | sh pattern runs code you have not reviewed. Use it only in labs; prefer download-and-review elsewhere. See is LinPEAS safe?
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh # run directly (lab only)
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh | tee linpeas.out # run directly and save./linpeas.sh -a > /dev/shm/linpeas.txt # write to memory-backed fs
less -r /dev/shm/linpeas.txtPassword-assisted checks#
If you know a valid password and are authorised, -P lets the sudo and su checks use it.
./linpeas.sh -P 'KnownPassword'A password passed on the command line can appear in shell history and the process list. Use this only in controlled lab/CTF contexts.
Use LinPEAS only on systems you own or are explicitly authorised to test, including legal training labs and CTF environments where testing is permitted. Unauthorised access to computer systems is illegal.
Sources & references
- linPEAS README — commands and parameters
- PEASS-ng releases — help text verified against 20260908-dffb9496