Linux Hacking Case Studies Part 4: Sudo Horror Stories

The final Linux case studies post builds a vulnerable Kali lab server, recreating the Rsync, NFS, phpMyAdmin, and sudo misconfiguration scenarios from the series for safe hands-on practice at home.

Walks through attacking insecure phpMyAdmin installs: finding exposed instances, dictionary-attacking weak passwords, uploading webshells, then pivoting to world-writable cron scripts for escalation.

Attacks misconfigured NFS exports: enumerating and mounting shares, spoofing UIDs to read protected files, and hunting setuid binaries to reach root, with a note on root squashing.

The first Linux case study targets insecure Rsync servers: enumerating shares on port 873, grabbing sensitive files, and creating a privileged user via shadow edits when the daemon runs as root.

Instead of replacing SSH binaries on a compromised Linux host, testers can attach strace to running sshd via ptrace and read write() system calls to capture passwords and session content live.

Shows how to escape restricted chroot shells that grant root: find a writable-executable file, then use the classic breakout via echo and a saved directory file descriptor.