Linux Security

Notes on Linux security topics, authentication, and hardening.

Directory map

• Linux Authentication — PAM, /etc/passwd, /etc/shadow, login process, credential storage
• Linux Privilege Escalation — Services & Internals Enumeration — network interfaces, /etc/hosts, lastlog/w/history, cron jobs, /proc, installed packages, sudo version, GTFOBins cross-reference, strace, config files, scripts, ps by user
• Linux Privilege Escalation — Wildcard Abuse — tar –checkpoint-action exec, cron job wildcard hijack, GTFOBins wildcard entries
• Escaping Restricted Shells — rbash/rksh/rzsh, command injection, command substitution, command chaining, environment variables, shell functions
• Special Permissions (SUID/SGID) & GTFOBins — find -perm 4000/6000 enumeration, reverse engineering vs built-in feature abuse, apt-get Pre-Invoke example
• Linux Privilege Escalation — Sudo Rights Abuse — sudo -l, NOPASSWD entries, tcpdump -z postrotate-command GTFOBins abuse, sudoers best practices