Linux Hacking Case Studies Part 1: Rsync

The final Linux case studies post builds a vulnerable Kali lab server, recreating the Rsync, NFS, phpMyAdmin, and sudo misconfiguration scenarios from the series for safe hands-on practice at home.

This Linux case study covers finding SSH servers, running dictionary attacks against weak passwords, then abusing overly permissive sudo rules on sh, vi, python, and nmap to escape to a root shell.

Walks through attacking insecure phpMyAdmin installs: finding exposed instances, dictionary-attacking weak passwords, uploading webshells, then pivoting to world-writable cron scripts for escalation.

Attacks misconfigured NFS exports: enumerating and mounting shares, spoofing UIDs to read protected files, and hunting setuid binaries to reach root, with a note on root squashing.

Shows how to escape restricted chroot shells that grant root: find a writable-executable file, then use the classic breakout via echo and a saved directory file descriptor.

A report on an arbitrary recursion bug in the Linux kernel, triggerable by a local user on Ubuntu systems installed with home directory encryption support, with exploit code published.