Linux Pentesting: From Recon to Exploit Research
By: Pentester Academy
Tags: Cybersecurity, Linux, Edtech, Hacking, Security

Start with Linux basics

The Linux Operating System forms the basis of a huge number of the applications that we use every day on the Internet. Linux servers are configured for uses as varied as high-performance computing, storage, network routing, and web servers. This flexibility has meant that the management of a Linux server is a complex subject with plenty of room for error. A large number of deployments and configurations has also led to new vulnerabilities being discovered almost every day. To protect a deployment on Linux, a system administrator must ensure that the Linux servers are always up to date with the latest security patches. A single vulnerable service or a minor mistake in configuration could leave the server, and the data residing on it, vulnerable to attack.

As a pentester, it is important to know how to scout for vulnerabilities and the ways they can be exploited. But first, one has to know how Linux works. In our labs, you’ll be using a Kali/Ubuntu Attacker machine to attack other Linux-based target machines.

Our learning path thus starts with Linux Basics, where you will learn concepts, commands and tools required to interact with various Linux services and applications. Specifically, the path covers:

Understanding the Linux filesystem and users

Understanding the system and user crontabs

Learning the important Linux commands and tools

Fingerprinting web applications and network services such as FTP and SSH

Creating bi-directional connections with socat

Once you’re comfortable with Linux, we’ll move on to Linux pentesting and the five phases of hacking:

The 5 phases of hacking is a well-known methodology amongst security professionals, where attacks start with a reconnaissance phase and end with covering tracks. In our learning path, we expand on this methodology and show you how to perform additional phases such as Pivoting and Exploit Research.

Let’s dive right in!

Reconnaissance

Before attacking any application or service, it is important to gather as much information as possible. The more information an attacker has, the easier it will be to identify any misconfigurations and vulnerabilities. The objective of the reconnaissance section is to familiarize the student with the approach to follow for enumerating web applications and various network services, such as DNS, web servers, databases, caching systems, etc. Using the information, the attack vector and entry points can be identified and then used in the exploitation phase.

In our reconnaissance section, you’ll learn:

Identifying open ports on the machine

Identifying services running on the machine

Interacting with network services

Fingerprinting different types of services

Understanding service-specific misconfigurations

Enumerating files/directories on web applications

Scanning web application using popular scanners and identifying the entry points

Exploitation

The objective of the exploitation phase is to establish access to a system or resource by leveraging a vulnerability or bypassing a security restriction. In this section, the student will learn how to search for exploits based on the information acquired in the reconnaissance phase and use them to compromise the application or service. Once the attacker has compromised a machine, it is possible to attack other machines on the same network which may not be exposed to the Internet.

This section covers:

Performing dictionary attacks on various network services

Searching for exploit based on the results found in the reconnaissance phase

Exploiting vulnerable services and application using Metasploit

Performing manual exploitation on vulnerable web applications

Post-exploitation

A compromised system may contain sensitive information, such as user data, access keys, credentials etc. It may then be possible to use this information to compromise other machines on the same network. The attacker can also turn the machine into a zombie computer and use it to perform attacks on other machines in a planned attack on a future date. The objective of this section is to teach students how to look for sensitive information on a machine, crack password protected files and perform the lateral movement on the network.

For post-exploitation, we cover:

Using Metasploit modules to retrieve sensitive information from a compromised system

Extracting valuable information from browser preferences data

Compromising other machines on the same network

Privilege Escalation

On Linux systems, services may be running as a non-root user. For examples, by default, Apache and Nginx run as the user www-data. Therefore, even if a web application or the service itself is compromised, the attacker will only get access as the www-data user, which has limited privileges. To gain full control of a system, it is important to escalate privileges from a user with low privileges to the root user (vertical escalation).

It might not be always possible to escalate from the current user to the root user. In such cases, other users on the machine must be compromised (horizontal escalation), and then used to try to attain root privileges. The objective of this section is to teach the student the various techniques of privilege escalation in the Linux environment. You’ll learn:

Leveraging misconfigured Cron jobs for escalating privileges.

Leveraging SUID binaries for escalating privileges.

Performing Shared Library injection and escalate privileges.

Breaking out of restricted environments such as rbash and chroot.

Exploiting vulnerable services to escalate privileges.

Pivoting

In a corporate environment, most of the machines are behind a firewall, which makes it impossible to attack them directly. However, if there is a vulnerable machine exposed to the internet which is also connected to the internal network. It might be possible to pivot through the compromised machine and attack the machines on the internal network. The objective of this section is to teach the various pivoting techniques that can be used to attack machines behind a network, such as:

Pivoting through a machine by using ssh tunnels

Using the Meterpreter autoroute script to route traffic through a compromised machine

Using the Metasploit socks proxy module to proxy traffic through a machine

Pivoting through a machine by using reGorg

Maintaining Access

The aim of an attacker is not only to compromise the target machine but also to maintain access to it so that the machine can be used later in a planned attack. Maintaining access to the machine is not a trivial task since the attack vectors might trigger alarms and cause the system administrators to block the vulnerability. This section covers various techniques that can be used to maintain access to a compromised machine, specifically:

Maintaining access to database services such as PostgreSQL

Leveraging ssh keys for maintaining access

Leveraging cron jobs for maintaining access

Using tools such as netcat, socat and python for maintaining access

MITRE ATT&CK

Mitre ATT&CK (Adversarial Tactics, Techniques, and Common Knowledge) is a framework developed by Mitre corporation. It consists of threat tactics and techniques based on observations made from real-world attacks. With the Mitre ATT&CK framework, real-world attacks can be broken down into various categories and compared with other attacks. This section familiarizes students with the various techniques from the Mitre ATT&CK Matrix for Linux. Our syllabus covers:

Familiarity with Mitre ATT&CK Framework

Classification of various attack vectors and techniques used in APTs

Exploit Research

Based on the information found during the reconnaissance phase or in the post-exploitation phase, a public exploit might not exist for compromising the machine. In such cases, the attacker will have to analyze the files or output and write their own exploit code. In this section, the students will be taught how to debug a process and how to write code to exploit a buffer overflow vulnerability in a program. You’ll learn: