Linux Hacking Case Studies Part 2: NFS

The final Linux case studies post builds a vulnerable Kali lab server, recreating the Rsync, NFS, phpMyAdmin, and sudo misconfiguration scenarios from the series for safe hands-on practice at home.

This Linux case study covers finding SSH servers, running dictionary attacks against weak passwords, then abusing overly permissive sudo rules on sh, vi, python, and nmap to escape to a root shell.

Walks through attacking insecure phpMyAdmin installs: finding exposed instances, dictionary-attacking weak passwords, uploading webshells, then pivoting to world-writable cron scripts for escalation.

The first Linux case study targets insecure Rsync servers: enumerating shares on port 873, grabbing sensitive files, and creating a privileged user via shadow edits when the daemon runs as root.

Shows how to escape restricted chroot shells that grant root: find a writable-executable file, then use the classic breakout via echo and a saved directory file descriptor.

A report on an arbitrary recursion bug in the Linux kernel, triggerable by a local user on Ubuntu systems installed with home directory encryption support, with exploit code published.