Linux Security

Notes on Linux security topics, authentication, and hardening.

Directory map

• Linux Authentication — PAM, /etc/passwd, /etc/shadow, login process, credential storage
• Linux Privilege Escalation — Services & Internals Enumeration — network interfaces, /etc/hosts, lastlog/w/history, cron jobs, /proc, installed packages, sudo version, GTFOBins cross-reference, strace, config files, scripts, ps by user
• Linux Privilege Escalation — Wildcard Abuse — tar –checkpoint-action exec, cron job wildcard hijack, GTFOBins wildcard entries
• Escaping Restricted Shells — rbash/rksh/rzsh, command injection, command substitution, command chaining, environment variables, shell functions
• Special Permissions (SUID/SGID) & GTFOBins — find -perm 4000/6000 enumeration, reverse engineering vs built-in feature abuse, apt-get Pre-Invoke example
• Miscellaneous Techniques — passive traffic capture (net-creds/PCredz), weak NFS no_root_squash SUID upload, tmux socket hijacking
• Shared Libraries (LD_PRELOAD) — static vs dynamic libraries, ldd, LD_PRELOAD sudo env_keep abuse, malicious .so compilation
• Shared Object Hijacking (RUNPATH) — ldd dependency inspection, readelf RUNPATH detection, writable library directory abuse, missing symbol identification, malicious .so compilation
• Linux Privilege Escalation — Sudo Rights Abuse — sudo -l, NOPASSWD entries, tcpdump -z postrotate-command GTFOBins abuse, sudoers best practices
• Linux Privilege Escalation — Kernel Exploits — Netfilter, CVE-2021-22555, CVE-2022-25636, CVE-2023-32233 nf_tables UAF