Posts on: Linux

---

A consolidated reference for enumerating attack vectors on Linux targets, from first shell to root. Commands are grouped by category; exploitation primitives follow each enumeration section where relevant. Table of Contents Helpful Tools Processes and Jobs Kernel and OS User-Related Network Related Finding Interesting Files and Directories Process Memory and Sudo Token Reuse Systemd Unit Abuse Logrotate ld.so.preload — Universal Linker Hijack SUID / SGID / Capabilities Sudo Abuse Kernel and Userland Exploits Container and Namespace Escape D-Bus, Screen, and Tmux Session Abuse SUID Shared-Library and Linker Abuse Writable /etc/passwd / /etc/shadow Credential Hunting Open File Descriptors Consolidated Enumeration One-Liners Priority Quick Actions Field Notes from the HTB List Helpful Tools Tool Notes LinPEAS Broad automated enumeration; default first pass LinEnum Lighter-weight shell alternative pspy Watches process spawns without root — exposes cron and systemd timer execution paths unix-privesc-check Legacy file-permission auditing linux-exploit-suggester Kernel exploit correlation lse.sh Linux smart enumeration CDK Container-specific enumeration and escape primitives deepce Docker/container enumeration from inside a container uptux Single-file Python script specialized in systemd, D-Bus, socket units, and writable unit paths SUDO_KILLER Focused on sudo misconfigurations, CVE detection, and token reuse privmap Graph-based path modeling — traces www-data → writable logrotate config → root cron → root, reporting paths rather than isolated findings # uptux wget https://raw.githubusercontent.com/initstring/uptux/master/uptux.py python3 uptux.py # SUDO_KILLER wget https://raw.githubusercontent.com/TH3xACE/SUDO_KILLER/master/SUDO_KILLER.sh bash SUDO_KILLER.sh # privmap pip install privmap sudo privmap Processes and Jobs Command Description ps aux | grep root See processes running as root ./pspy64 -pf -i 1000 View running processes with pspy cat /etc/crontab System-wide cron table ls -la /etc/cron.daily Check for daily Cron jobs ls -la /etc/cron.* /etc/at* /var/spool/cron/crontabs/ 2>/dev/null Enumerate all cron locations crontab -l Current user’s cron grep -i cron /var/log/syslog /var/log/cron 2>/dev/null Enumerate cron jobs (second file on RHEL/CentOS) journalctl -u cron --no-pager Cron activity on journald-only hosts systemctl list-timers --all systemd timers — frequently missed because they are not cron atq List queued at jobs ls -la /var/spool/cron/atjobs/ 2>/dev/null at job files busctl --system list D-Bus services that may expose privileged methods lpstat Active or queued print jobs (sensitive information) Cron exploitation notes: If a cron job runs a script that calls another binary by relative name, the job’s PATH or the script’s writable directory becomes the target. pspy is the fastest way to confirm a job is firing and to observe its exact command line and working directory. at/batch jobs are cron-adjacent and less scrutinized — a root-scheduled at job running a script in a writable directory is exploitable exactly like a writable cron script:

Group membership is often the shortest path to root — shorter than any kernel exploit and far less risky. The critical first command after landing a shell is id or groups, because a single membership in docker, lxd, or disk is functionally equivalent to root. This file covers every group that grants a meaningful escalation primitive, ordered roughly by how directly it leads to root. 1. Docker Group Placing a user in the docker group is essentially equivalent to root-level access to the file system without requiring a password. Members can spawn new containers, and the Docker daemon runs as root.

Environment variables are the configuration plane that every process inherits. When a privileged process — a root cron job, a systemd unit, a sudo-allowed command — trusts its inherited environment, a low-privileged user can often turn that trust into root. The critical question is always whether the variable survives into the privileged process, which depends on sudo’s environment handling, the scheduler’s reset behaviour, and the binary’s own sanitisation. Why These Attacks Work (and Often Fail) The single most common reason an environment-variable attack fails is that the privileged process does not actually inherit the attacker’s environment:

What are Capabilities? Linux capabilities are a security feature that allows specific privileges to be granted to processes, enabling actions that would otherwise be restricted to root. Capabilities break up the monolithic root privilege into smaller, independently grantable units. Each unit can be assigned to a process or binary without granting full root. One common vulnerability is using capabilities to grant privileges to processes that are not adequately sandboxed or isolated, allowing privilege escalation and access to sensitive information. Another vulnerability is misuse or overuse: a process may hold more capabilities than it actually needs, widening the attack surface. Capabilities are stored as extended attributes (security.capability) and are not visible in ls -l — unlike SUID, they must be enumerated with getcap.

Consolidated index of 39 OSCP-like HTB Linux boxes — one path per box, the non-obvious steps that decide it, and the exact commands worth memorising. These are edge-case notes, not walkthroughs: every command must be adapted to the target (IPs, vhosts, ports, usernames, payload paths), and the source writeup remains the walkthrough of record. Companion pages: Command Checklist · Pattern Library · Methodology · Machine Index. How to use this page Start with a full TCP scan plus the UDP ports people skip (161, and NFS/mountd on dynamic ports), then fuzz vhosts before directory-brute-forcing the IP root. Treat every credential as a username+password pair and spray it at SSH, su and the application itself before hunting another bug. After landing a shell, run the triad — sudo -l, SUID/capabilities, and pspy/cron/timers — plus ss -tnl for localhost-only services. When an exploit fails, read the application’s own source and config (.git, backups, *.inc.php, JAR/ZIP contents) before assuming the target is patched. Enigma Path: NFS export /srv/nfs/onboarding holds an onboarding PDF with webmail creds → Roundcube mail001 → password reuse to a second mailbox → OpenSTAManager 2.9.8 support portal → www-data → DB hash → haris → OliveTin on 1337 → root.

Scheduled and supervised execution is the most consistent privilege-escalation surface on Linux. Root runs something on a timer, on boot, on log rotation, or on a process event — and if you can influence what it runs, where it runs it, or how it resolves it, you inherit root. This file covers every scheduler you will encounter: cron, anacron, at, systemd timers and units, transient systemd-run jobs, and logrotate. 1. Cron Job Abuse Scheduled jobs, typically used for administrative tasks — backups, cleanup, reporting. The crontab command creates a cron file that the cron daemon runs on the specified schedule.

Techniques in this file do not fit neatly into SUID, sudo, or cron. They are grouped by what you control — a library path, an export, a socket, an environment variable, or a file permission — because that is how you will find them during enumeration. 1. Shared Object Hijacking — RUNPATH / RPATH / $ORIGIN A binary that uses a custom library can be enumerated with: ldd /path/to/program readelf -d /path/to/program | grep -E 'RPATH|RUNPATH|NEEDED' RUNPATH and RPATH are baked into the binary and are searched before the default library paths. Unlike LD_LIBRARY_PATH, they are honoured for SUID binaries, which is what makes a writable RUNPATH directory a reliable escalation.

Working document — tick as you go. Commands are abbreviated; full detail is in the matching section of the notes. Stop at the first successful path. Work top-down: configuration and credential wins are faster and safer than kernel exploits. Kernel exploits last. CVE numbers are hints, not gospel — verify the version against the current NVD before committing to a CVE-specific path. The behavioural checks below are valid regardless. Target context — fill before starting: