Quick answer
In the “Processes, Crons, Timers, Services and Sockets” section, LinPEAS reads cron files and checks for writable cron scripts. With -a it also watches running processes for about a minute to catch frequently-run jobs that aren't listed in crontabs.
Where it appears#
Cron checks are in the procs_crons_timers_srvcs_sockets section. The process-monitoring check (which spots frequent cron-like jobs) runs only with -a, is noisy, and briefly writes a temp file.
╔══════════╣ Cron jobs
/etc/crontab
* * * * * root /opt/scripts/backup.sh
-> /opt/scripts/backup.sh is writable by you!How to read it#
- A root cron job pointing at a writable script is a direct escalation.
- Watch for bare command names (PATH hijack) and wildcards in writable directories.
- The “Different processes executed during 1 min” output (with
-a) hints at hidden frequent jobs.
Verify it yourself#
cat /etc/crontab
ls -la /etc/cron.d/ /etc/cron.daily/
crontab -l
find /etc/cron* -writable 2>/dev/nullSources & references
- linPEAS README
- PEASS-ng release — reviewed 20260908-dffb9496
- HackTricks: Linux privilege escalation