linux-pentest

Linux Pentest

Prerequisites

• Linux targets or sessions are in scope.
• Container context: also load container-devops-pentest.
• Service attacks (SSH, FTP): load hacktricks-methodology or dedicated service skills.

Workflow

Task Progress:
- [ ] Enumerate OS, kernel, user, groups, sudo, cron, capabilities
- [ ] Run privesc checklist (SUID, writable paths, PATH, LD_PRELOAD)
- [ ] Check container breakout indicators if on Docker/K8s host
- [ ] Document escalation path and evidence

Phase 1: Enumeration

System info

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/gather/enum_system",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/linux/gather/enum_users_history",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)
msf_run_post_module(
  module_name="post/linux/gather/checkcontainer",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

cat /etc/os-release
uname -a
id
sudo -l

Automated: LinPEAS, LinEnum, linux-exploit-suggester, pspy.

SUID and capabilities

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/gather/enum_configs",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

CLI fallback:

find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
getcap -r / 2>/dev/null

Common abusable: find, vim, python, pkexec, doas. Check GTFOBins.

Cron and systemd

MSF MCP (preferred):

msf_run_post_module(
  module_name="post/linux/gather/enum_network",
  engagement_id="<id>",
  session_id=<sid>,
  options={}
)

General OS/kernel context is covered by post/linux/gather/enum_system in Phase 1; use enum_network here for scheduled-task and service reachability context.

CLI fallback:

cat /etc/crontab
ls -la /etc/cron.*
systemctl list-timers
systemctl list-unit-files --type=service
grep -r ExecStart /etc/systemd/system/ /lib/systemd/system/ 2>/dev/null