Linux

Exploitation

• usually a web app
• check open ports
• creds spraying

Privesc

• gather information
• check sudo -l
• check if the user has privileged groups
• check if we can abuse PATH to run our binaries
• wildcard abuse - tar in cronjobs, symlink zip file attacks
• Escape restricted shells
• Check special permissions on binaries - SETUID, SETGID
• check running processes using pspy
• check capabilities
• check vulnerable services
• check cron jobs
• check linux containers - LXC

Post Exploitation