Below is a penetration testing memo for Linux machines; I came across it on the internet by chance and copied it over here.
Penetration testing a Linux machine#
| Command | Description |
|---|
| netstat -tulpn | Show network ports in Linux together with the corresponding ID (PID) |
| watch ss -stplu | Observe TCP and UDP ports in real time through sockets |
| lsof -i | Show established connections |
| macchanger -m MACADDR INTR | Change the MAC address on KALI Linux |
| ifconfig eth0 192.168.2.1/24 | Set the IP address in Linux |
| ifconfig eth0:192.168.2.3/24 | Add an IP address to an existing network interface in Linux |
| ifconfig eth0 hw ether MAC ADDR | Change the address in Linux using ifconfig |
| ifconfig eth0 mtu 1500 | Change the MTU size with ifconfig; change 1500 to the MTU you want |
| dig -x 192.168.1.1 | Perform a reverse lookup on an IP address |
| host 192.168.1.1 | Perform a reverse lookup on an IP address; useful when dig is not installed |
| dig @192.168.2.2 domain.com -t AXFR | Perform a DNS zone transfer with dig |
| host -l domain.com nameserver | Perform a DNS zone transfer with host |
| nbtstat -A x.x.x.x | Obtain the domain name corresponding to an IP address |
| ip addr add 192.168.2.22/24 dev eth0 | Add a hidden IP address that does not show up when running ifconfig |
| tcpkill -9 host goole.com | Block access to goole.com from the host |
| echo "1">/proc/sys/net/ipv4/ip_forward | Enable IP forwarding, turning the Linux box into a router — which makes it convenient to control the traffic routed through this box |
| echo "8.8.8.8">/etc/resolv.conf | Use Goole's DNS |
Very helpful for local enumeration
| Command | Description |
|---|
| whoami | Show the currently logged-in user on Linux |
| id | Show the currently logged-in user and group |
| last | Show the last logged-in users |
| mount | Show mounted drives |
| df -h | Show disk usage in human-readable output |
| echo "user:passwd" | chpasswd | Reset a password with a single command |
| getent passwd | List the users on Linux |
| strings /usr/local/bin/blah | Show the content of a non-text file, for example what is inside a binary |
| uname -ar | Show the running kernel version |
| PATH=$PATH:/my/new-path | Add a new path, making file system (FS) operations more convenient |
| history | Show the user's history of previously executed bash scripts, along with the commands typed |
Redhat/CentOS/RPM based distributions#
| Command | Description |
|---|
| cat /etc/redhat-release | Show the Redhat/CentOS version number |
| rpm -qa | List all installed RPM packages on RPM-based Linux |
| rpm -q --changelog openvpn | Check whether an installed RPM has been patched against a CVE; the grep command can be used to filter the output related to CVEs |
YUM commands#
| Command | Description |
|---|
| yum update | Update all RPM packages with YUM; it also shows which ones are outdated |
| yum update httpd | Update a single package, in this example HTTPD (Apache) |
| yum install package | Install a package with YUM |
| yum --exclude=package kernel* update | Exclude a package from being updated when using YUM |
| yum remove package | Remove a package with YUM |
| yum erase package | Remove a package with YUM |
| yum list package | List information about a YUM package |
| yum provides httpd | Show what a package provides |
| yum info httpd | Show package information, architecture, version and so on |
| yum local install blah.rpm | Use YUM to install a local RPM, installing from the repository |
| yum deplist package | Show the provider information of a package |
| yum list installed | more | List all installed packages |
| yum grouplist | more | Show all YUM groups |
| yum groupinstall 'Development Tools' | Install a YUM group |
Debian/Ubuntu/.deb based distributions#
| Command | Description |
|---|
| cat /etc/debian_version | Show the Debian version number |
| cat /etc/*-release | Show the Ubuntu version number |
| dpkg -l | List all installed packages on Debian/.deb based Linux distributions |
Linux user management#
| Command | Description |
|---|
| useradd new-user | Create a new Linux user |
| passwd username | Reset a Linux user's password; if you are the root user you only need to enter the password |
| userdel username | Delete a Linux user |
User creation commands#
adduser: automatically specifies the home directory and system shell version for the created user, and asks for the user password at creation time
useradd: the basic settings above must be specified with parameter options; if no parameters are used, the created user has no password, no home directory and no specified shell version
User deletion commands#
userdel: delete a user; adding the option -r deletes all files related to the user, and -f forces deletion of the user even if the user is logged in
deluser: remove a user from a group (that is, leave the user group) deluser username usergroup
Linux decompression commands#
| Command | Description |
|---|
| unzip archive.zip | Extract the files in a zip archive on Linux |
| zipgrep *.txt archive.zip | Search inside a zip archive |
| tar xf archive.tar | Extract the files in a tar archive on Linux |
| tar xvzf archive.tar.gz | Extract the files in a tar.gz archive on Linux |
| tar xjf archive.tar.bz2 | Extract the files in a tar.bz2 archive on Linux |
| tar ztvf file.tar.gz | grep blah | Search inside a tar.gz file |
| gzip -d archive.gz | Extract the file in a gzip archive on Linux |
| zcat archive.gz | Read a .gz file on Linux without decompressing it |
| zless archive.gz | Achieve the same functionality for a .gz archive with the less command |
| zgrep 'blah' /var/log/maillog*.gz | Search the contents of .gz archives on Linux, for example searching compressed log files |
| vim file.txt.gz | Read a .txt.gz file with vim |
Linux compression commands#
| Command | Description |
|---|
| zip -r file.zip /dir/* | Create a .zip file on Linux |
| tar cf archive.tar files | Create a .tar file on Linux |
| tar czf archive.tar.bz2 files | Create a tar.gz file on Linux |
| tar cjf archive.tar.bz2 files | Create a tar.bz2 file on Linux |
| gzip file | Create a .gz file on Linux |
| upx -9 -o output.exe input.exe | Compress an .exe file with UPX on Linux |
Linux file commands#
| Command | Description |
|---|
| df -h blah | Show the size of a file/directory on Linux |
| diff file1 file2 | Compare/show the difference between two files on Linux |
| md5sum file | Generate an MD5 digest on Linux |
| md5sum -c blah.iso.md5 | Check a file's MD5 digest on Linux, assuming the file and the .md5 are in the same path |
| file blah | Find out the type of a file on Linux; it also shows whether the file is 32 or 64 bit |
| dos2unix | Convert Windows line endings to Unix/Linux ones |
| base64 input-file output-file | Base64-encode the input file and output a Base64-encoded file named output-file |
| base64 -d input-file output-file | Base64-decode the input file and output a Base64-decoded file named output-file |
| touch -r ref-file new-file | Create a new file using the timestamp data from the reference file; drop -r to simply create a file |
| rm -rf | Delete files and directories without showing a confirmation prompt |
Misc commands#
| Command | Description |
|---|
| init 6 | Restart Linux from the command line |
| gcc -o output.c input.c | Compile C code |
| gcc -m32 -o output.c input.c | Cross-compile C code; on 64-bit Linux this compiles a 32-bit binary |
| unset HISTORYFILE | Turn off bash history logging |
| rdesktop x.x.x.x | Connect to an RDP server from Linux |
| kill -9 $$ | Kill the current session |
| chown user:group blah | Change the owner of a file or directory |
| chown -R user:group blah | Change the owner of a file or directory as well as the files/directories under it — recursively execute chown |
| chmod 600 file | Change the permission settings of a file/directory; see Linux file system permissions for details |
Clearing bash history#
$ ssh user@x.x.x.x | cat /dev/null > ~/.bash_history
The .bash_history file can hold many history entries; the number of saved commands can be reduced by setting the HISTFILESIZE and HISTSIZE parameters.
The meaning of the two parameters:
- HISTSIZE: defines the number of commands output by the history command
- HISTFILESIZE: defines the number of commands saved in the .bash_history file
$ HISTFILESIZE=<num>
$ HISTSIZE=<num>
The command history -c clears the commands output this time but does not clear the .bash_history file, so after logging in again the old commands will still appear.
Linux file permissions#
| Value | Meaning |
|---|
| 777 | rwxrwxrwx no restriction, fully readable, writable and executable (RWX); the user can do anything |
| 755 | rwxr-xr-x the owner has full access, others can only read and execute |
| 700 | rwx------ the owner has full access, no one else can access it |
| 666 | rw-rw-rw- everyone can read and write, but not execute |
| 644 | rw-r--r-- the owner can read and write, others can only read |
| 600 | rw------- the owner can read and write, no one else can access it |
Penetration testing memo for the Linux file system#
| Path | Description |
|---|
| / | / is also called "slash" or root |
| /bin | General programs shared by the system, the system administrator and users |
| /boot | Boot files, boot loader (grub), kernel, vmlinuz |
| /dev | Contains references to system devices, files with special attributes |
| /etc | Important system configuration files |
| /home | Home directories of system users |
| /lib | Library files, including files for all kinds of programs needed by both the system and users |
| /lost+found | Files from failed file operations are saved here |
| /mnt | Standard mount point for external file systems |
| /media | Mount point for external file systems (or for some distributions) |
| /net | Standard mount point for entire remote file systems — nfs |
| /opt | Generally contains some additional or third-party software |
| /proc | A virtual file system containing information related to system resources |
| /root | Home directory of the root user |
| /sbin | Programs used by the system and the system administrator |
| /tmp | Temporary space for the system's use, cleared on reboot |
| /usr | Programs, libraries, documentation and so on used by all user-related programs |
| /var | Stores all variable files and transient files created by users, such as log files, mail queues, print spoolers, web servers, databases and so on |
Some interesting files/directories in Linux#
Very helpful for privilege escalation / post-exploitation
| Path | Description |
|---|
| /etc/passwd | Contains the local Linux users |
| /etc/shadow | Contains the hashed local account passwords |
| /etc/group | Contains the local account groups |
| /etc/init.d/ | Contains the service initialization scripts — worth a look to see exactly what is installed |
| /etc/hostname | The system's hostname |
| /etc/network/interfaces | Network interfaces |
| /etc/resolv.conf | The system's DNS service |
| /etc/profile | The system's environment variables |
| ~/.ssh/ | SSH keys |
| ~/.bash_history | The user's bash history log |
| /var/log/ | Linux system log files are generally stored here |
| /var/adm/ | UNIX system log files are generally stored here |
| /var/log/apache2/access.log /var/log/httpd/access.log | The usual storage paths of the Apache access log files |
| /etc/fstab | Mounted file systems |
Breaking out of shell restrictions#
Python small tricks:
python -c 'import pty;pty.spawn("/bin/bash")'
echo os.system("/bin/bash")
/bin/sh -i
Samba commands#
Connecting to a Samba share from Linux:
$ smbmount //server/share /mnt/win -o user=username,password=password1
$ smbclient -U user \\\\server\\share
$ mount -t cifs -o username=user,password=password //x.x.x.x/share /mnt/share
Reference#
Linux enthusiasts