Linux Basics

Foundational Linux concepts, system enumeration, and privilege escalation checklist for penetration testers

Overview

Linux is the dominant operating system in server environments, cloud infrastructure, and embedded systems. Understanding its internals is essential for both offensive security and hardening. This page covers the foundational concepts needed before diving into privilege escalation techniques.

This content is intended for authorized penetration testing, CTF competitions, and security research only. Always obtain proper written authorization before testing any system.

Privilege Escalation Checklist

The best automated tool for Linux local privilege escalation enumeration is LinPEAS.

System Information

1. Gather OS Information

   Identify the operating system, kernel version, and architecture.

   (cat /proc/version || uname -a) 2>/dev/null
   lsb_release -a 2>/dev/null
   cat /etc/os-release 2>/dev/null
   
2. Check PATH and Environment

   Look for writable folders in PATH and sensitive data in environment variables.

   echo $PATH
   (env || set) 2>/dev/null
   
3. Search for Kernel Exploits

   Check kernel version against known vulnerabilities like DirtyCow.

   cat /proc/version
   uname -a
   searchsploit "Linux Kernel"
   
4. Check Sudo Version

   Determine if the sudo version is vulnerable to known CVEs.

   sudo -V | grep "Sudo ver" | grep "1\.[01234567]\.[0-9]\+\|1\.8\.1[0-9]\*\|1\.8\.2[01234567]"
   
5. Enumerate Defenses

   Identify security mechanisms in place: AppArmor, SELinux, ASLR, etc.

   # AppArmor
   if [ `which aa-status 2>/dev/null` ]; then aa-status; fi
   # SELinux
   sestatus 2>/dev/null || echo "Not found"
   # ASLR
   cat /proc/sys/kernel/randomize_va_space 2>/dev/null
   

Key Checklist Areas

Drives and Filesystems

• List mounted and unmounted drives
• Check /etc/fstab for credentials
• Look for writable mount points

ls /dev 2>/dev/null | grep -i "sd"
cat /etc/fstab 2>/dev/null | grep -v "^#"
grep -E "(user|username|login|pass|password|pw|credentials)[=:]" /etc/fstab /etc/mtab 2>/dev/null

Installed Software and Processes

• Check for useful and vulnerable software
• Monitor running processes for privilege misconfigurations

which nmap aws nc ncat netcat wget curl python python3 perl php ruby docker lxc 2>/dev/null
dpkg -l    # Debian-based
rpm -qa    # CentOS/RHEL
ps aux
ps -ef

Scheduled Jobs (Cron)

• Look for writable cron scripts or PATH abuse
• Check for wildcard injection opportunities

crontab -l
ls -al /etc/cron* /etc/at*
cat /etc/cron* /etc/at* /etc/anacrontab /var/spool/cron/crontabs/root 2>/dev/null | grep -v "^#"

Services and Timers

• Check for writable .service files
• Look for writable binaries executed by services
• Enumerate systemd timers

systemctl show-environment
systemctl list-timers --all

Sockets and D-Bus

• Identify writable Unix domain sockets
• Check for exploitable D-Bus services

netstat -a -p --unix
nc -U /tmp/socket

Network Enumeration

• Map the network position and open ports
• Check for sniffable traffic

cat /etc/hostname /etc/hosts /etc/resolv.conf
(ifconfig || ip a)
(netstat -punta || ss --ntpu)
timeout 1 tcpdump

Users and Groups

• Enumerate all users, groups, and superusers
• Check clipboard and password policy

id || (whoami && groups) 2>/dev/null
cat /etc/passwd | cut -d: -f1
awk -F: '($3 == "0") {print}' /etc/passwd
grep "^PASS_MAX_DAYS\|^PASS_MIN_DAYS\|^PASS_WARN_AGE\|^ENCRYPT_METHOD" /etc/login.defs

SUDO and SUID

• Review sudo permissions with GTFOBins
• Find exploitable SUID binaries

sudo -l
find / -perm -4000 2>/dev/null
sudo awk 'BEGIN {system("/bin/sh")}'
sudo find /etc -exec sh -i \;

Capabilities and ACLs

• Check for unexpected Linux capabilities
• Look for unusual ACLs on files

getcap -r / 2>/dev/null
getfacl /etc/passwd 2>/dev/null

SSH and Interesting Files

• Review SSH configuration and keys
• Search profile files, shadow, and backup files

cat ~/.ssh/id_rsa 2>/dev/null
ls -la ~/.ssh/
find / -name "*.bak" -o -name "*.old" 2>/dev/null | head -20

Linux Security Mechanisms

AppArmor

Mandatory access control system that restricts program capabilities using per-program profiles.

SELinux

Security-Enhanced Linux provides fine-grained mandatory access control policies for processes and files.

ASLR

Address Space Layout Randomization randomizes memory addresses to mitigate memory exploitation.

Capabilities

Linux capabilities split root privileges into distinct units that can be independently granted.

CVE-2016-5195 (DirtyCow)

A classic kernel privilege escalation vulnerability affecting Linux kernels up to 3.19.0-73.8.

# Make DirtyCow stable
echo 0 > /proc/sys/vm/dirty_writeback_centisecs
g++ -Wall -pedantic -O2 -std=c++11 -pthread -o dcow 40847.cpp -lutil

References

• LinPEAS - Linux Privilege Escalation Awesome Script
• GTFOBins - Unix binaries for privilege escalation
• linux-exploit-suggester