Attacking Restricted Linux Shells

This Linux case study covers finding SSH servers, running dictionary attacks against weak passwords, then abusing overly permissive sudo rules on sh, vi, python, and nmap to escape to a root shell.

Walks through attacking insecure phpMyAdmin installs: finding exposed instances, dictionary-attacking weak passwords, uploading webshells, then pivoting to world-writable cron scripts for escalation.

Attacks misconfigured NFS exports: enumerating and mounting shares, spoofing UIDs to read protected files, and hunting setuid binaries to reach root, with a note on root squashing.

The first Linux case study targets insecure Rsync servers: enumerating shares on port 873, grabbing sensitive files, and creating a privileged user via shadow edits when the daemon runs as root.

A report on an arbitrary recursion bug in the Linux kernel, triggerable by a local user on Ubuntu systems installed with home directory encryption support, with exploit code published.

Provides penetration testers and red teams with an all-in-one, multi-architecture automated post-exploitation toolkit that simplifies Linux kernel privilege escalation without requiring on-target compilers.