Most LinPEAS problems are environment issues, not bugs: a missing execute bit, a noexec filesystem, absent curl/wget, colour escape codes in saved files, or security software quarantining the script. Each fix below follows problem → cause → fix.
Permission denied#
- Problem
bash: ./linpeas.sh: Permission denied- Cause
- The file has no execute permission.
- Fix
- Add it with
chmod +x linpeas.sh, or bypass it by runningsh linpeas.sh.
- Problem
- Still permission denied after
chmod +x - Cause
- The filesystem is mounted
noexec(common for/tmpin hardened setups). - Fix
- Run via an interpreter:
sh linpeas.sh. Or copy to a location that permits execution, such as/dev/shm:cp linpeas.sh /dev/shm && cd /dev/shm && sh linpeas.sh.
Command not found#
- Problem
command not found: ./linpeas.sh- Cause
- You are not in the directory containing the file, or you omitted
./. - Fix
- Use the correct path, e.g.
./linpeas.shor/dev/shm/linpeas.sh.
- Problem
curl: command not found/wget: command not found- Cause
- The download tool is not installed on the target.
- Fix
- Use whichever exists. If neither does, transfer the file another way (SCP, a shared mount, or
cat < /dev/tcp/HOST/PORTfrom a listener you control).
The download disappears or is blocked#
- Problem
- The downloaded
linpeas.shvanishes or won't save - Cause
- Antivirus/EDR quarantined it. Enumeration scripts match detection signatures. (We saw Windows Defender remove it within seconds on a Windows host.)
- Fix
- On an authorised system, run from memory instead of writing to disk, use the
linpeas_small.shbuild, or add a scoped exclusion where policy permits. Expect alerts on monitored targets.
Colours look wrong#
- Problem
- Output file is full of
^[[1;31mstyle codes - Cause
- You saved colour output to a plain file.
- Fix
- Read it with
less -r linpeas.out, or re-run with-Nto save clean text:./linpeas.sh -N > linpeas.txt.
- Problem
- No colours at all in the terminal
- Cause
- The terminal or pager does not interpret ANSI codes.
- Fix
- Use a colour-capable terminal, pipe through
less -r, or accept plain output with-N.
Output is too large / scan too slow#
- Problem
- Output is overwhelming
- Cause
- Default runs are verbose by design.
- Fix
- Limit sections with
-o, e.g../linpeas.sh -o users_information,interesting_perms_files. Save to a file and search it.
- Problem
- The scan takes a very long time
- Cause
- Deep searches (especially
-aand-r) walk the whole filesystem; large disks and network mounts are slow. - Fix
- Use
-s(stealth/superfast) for a quick pass, avoid-runless you need secret searches, and use-Dto see which checks are slow.
Minimal environments#
- Problem
- Odd behaviour on BusyBox / minimal containers
- Cause
- Missing utilities and a limited shell mean some checks can't run.
- Fix
- This is expected; LinPEAS skips checks whose tools are absent. Use the binary build or
linpeas_small.sh, and treat gaps as environmental.
- Problem
sudo -lchecks do nothing- Cause
- No sudo present, or it needs a password you didn't supply.
- Fix
- If you know a valid password and are authorised, pass it with
-P(note it may appear in history/process list).
macOS differences#
- Problem
- Some macOS sections are empty
- Cause
- The terminal lacks Full Disk Access, or checks target privacy-protected paths.
- Fix
- Grant the terminal Full Disk Access on a machine you own, or accept reduced output. See the macOS guide.
Outdated copy#
- Problem
- A tutorial's flag or output doesn't match yours
- Cause
- You have a different (often older) release; flags and checks change frequently.
- Fix
- Re-download the latest release and run
./linpeas.sh -hto see your build's real options.
Why does antivirus flag LinPEAS?
Because it resembles enumeration and credential-searching activity. It is not malware, but it will trigger many AV/EDR products.
How do I run LinPEAS without writing to disk?
Download into memory and pipe to a shell, or use tee only where allowed. Note this reduces auditability; prefer reviewing the script first where possible.
LinPEAS says permission denied on a file it's scanning — is that a problem?
No. As a normal user it cannot read everything; those messages are expected and simply mean that check found nothing accessible.
Use LinPEAS only on systems you own or are explicitly authorised to test, including legal training labs and CTF environments where testing is permitted. Unauthorised access to computer systems is illegal.
Sources & references
- PEASS-ng releases — reviewed 20260908-dffb9496
- linPEAS README — download and usage commands
- Kali peass-ng package — package name and paths