eJPT Junior Penetration Tester
ShopAuthorPatreonHTB Pro Labs
eCPPTv2 Certified Professional Penetration Tester
eCPPTv2 Certified Professional Penetration Tester
  • 🍕eCPPTv2 Study
  • Author
  • Certification
    • 🟢Exam Description
    • Register
  • RFS Tips
    • 🟢Before the Exam
    • 🟢Prepare your Setup
    • 🟢Questions?
    • 🎓Learn more... Get eCPPTv2
    • 🟢Start Hacking
  • Reports
    • PwnDoc Documentation
    • 🟢Templates
  • Methodology
    • 🟢To Scan a Network
    • 🟢To Attack a Linux Machine
    • 🟢To Attack a Windows Machine
    • 🟠Linux Privilege Escalation
    • Windows Privilege Escalation
    • Linux Post Exploitation
    • Windows Post Exploitation
    • Pivoting Methodology
  • Web Tools
    • Why these Tools
    • Rev Shells
    • MD5 Crack
    • CyberChef
    • SecLists
    • WADcoms
    • LOLBAS
    • GTFOBins
  • Network Security
    • Information Gathering
      • Intro
      • Passive / Active
      • OSINT
      • Social Media
      • Infrastructure
      • DNS
        • NSlookup
        • Dig
        • fierce
        • DNSenum
        • DNSmap
        • DNSrecon
      • Host Discovery
        • Fping
        • Hping
        • Nmap
      • Maltego
      • Foca
      • Breach Data
    • Scanning
      • Intro
      • Wireshark
        • Promiscuous Interface
        • 🟢Filters
        • Colors
        • Follow Stream
      • Scan Types
      • 🟢Hping3
      • Nmap
      • 💚eCPPTv2 - Firewall IDS Evasion
    • 🟢Enumeration
    • Sniffing & MitM Attacks
      • Passive
      • Active
      • MiTM
        • Local to Remote
        • DHCP Spoofing
        • LLMNR Poisoning
        • NBT-NS Poisoning
      • Tools
        • Dsniff
        • Wireshark
        • TCPDump
        • Ethercap
    • Exploitation
    • Post Exploitation
    • Social Engineering
    • Anonymity
  • Linux Exploitation
    • Introduction
    • Information Gathering
      • Remote Enumeration
        • Enum NFS
        • rpcbind
        • SMB
        • SMTP
      • Local Enumeration
        • Network Info
        • System Info
    • Exploitation over the Network
      • Samba
        • UserMap CVE-2007-2447
        • SymLink Directory Traversal
        • SambaCry CVE-2017-7494
        • Writeable Share to RCE
      • PHP CGI
      • Ruby DRB RMI port 8787
      • JAVA RMI Registry - port 1099
      • Exploiting Java Deserialization
      • TomCat
      • Password Spray Attack
      • Shellshock
      • Heartbleed
    • Post Exploitation
      • Intro
      • msfconsole scripts
      • Privilege Escalation
        • Docker
          • Unix Sockets Exploitation
        • Restricted Shells
        • Cracking Shadow File
        • 🟢Dump Memory Credentials
        • 🟢Dump SWAP Credentials
        • 🟢Shared Object Libraries
        • Kernel Exploits
          • Dirty Cow
          • Stack Clash
          • DCCP
          • Race Condition
          • msfconsole
      • Lateral Movement
        • Samba
          • Dump Samba Secrets
        • SSH
          • SSH Hijacking
          • Steal SSH credentials
        • VPNPivot
        • Dump Firefox Credentials
        • Sniffing
      • Data Exfiltration
      • Maintaining Access
        • HTTPS
        • Reverse Shells
        • Custom Services
  • Metasploit
    • Notes
    • 🟢Detect Live Hosts with Metasploit
    • 🟢Port Scanning with Metasploit
    • Network Services Scanning
    • Payloads
    • Exploitation with Metasploit
    • Post Exploitation with Metasploit
  • System Security
    • Page 5
  • Web App Security
    • Best Academy
    • HTTP
      • Basics
      • Encoding
      • Same Origin
      • Cookies
      • Sessions
      • Web Proxies
    • Enumerating
      • Infrastructure
      • Mapping Application
    • Tools
    • XSS
      • Free Courses
      • XSS Types
      • Attack Types
    • SQL Injection
    • CMSs
  • Powershell for Pentesters
    • Page 2
  • Wi-Fi Security
    • Page 6
  • Commands Notes
    • 🟢Information Gathering
    • 🟢Host Discovery
    • 🟢Scanning
    • 🟢Enumeration
    • 🟢MSFVenom
  • Pivoting
    • Tips
    • Socks4 vs Socks5
    • Pivoting Techniques
    • Meterpreter
    • SSH
    • Proxy Chains
    • 🟢Chisel
    • Socat
  • Buffer OverFlow
    • Tips for Bof in eCPPTv2
    • Computerphile - Buffer Overflow
    • The Cyber Mentor - BoF
  • 🟢TryHackMe Rooms
    • 🟢Privilege Escalation
      • LazyAdmin
      • LinuxPrivEsc
      • Empline
      • Windows 10 Privesc
    • 🟢Pivoting
      • Wreath Network
      • VulnNetInternal
    • 🟢Buffer Overflow
      • Gatekeeper
      • Buffer Overflow Prep
    • 🟢Metasploit
      • RP Metasploit
      • Metasploit Intro
  • Community Exam Tips
    • Exploits
    • Shells
    • PrivEsc
    • Report
    • BoF
    • Wordlists
    • 🟢Articles - Exam Reviews
    • 🟢Videos - Exam Reviews
  • Free Courses
    • Page 1
  • Paid Courses
    • Page 3
  • After Exam
    • Page 4
Powered by GitBook
On this page
  • Juice Information
  • SSH Service
  • FTP Service
  • Samba Service
  • DNS Service
  • MySQL Service
  • Web Servers
  • What do we want?

Was this helpful?

  1. Methodology

To Attack a Linux Machine

Methodology To Attack a Linux Machine

PreviousTo Scan a NetworkNextTo Attack a Windows Machine

Last updated 2 years ago

Was this helpful?

Ok after scanning the network we detect some Linux machines and now?

What do we need to investigate in order to get root on the remote machine?

First scan all 65535 TCP ports available, don't scan them all at once. Start by scanning the most common ones then go increasing the port ranges.

Do the same for all 65535 UDP ports.

After scanning all ports we hope to find some services running on them, grab all banners from remote services, and investigate them.

The objective is to find services that can allow us to connect to the machine without authentication or send files to the machine, or a web server since it gives us a lot more to investigate in order to find an entry point.

If we don't find anything useful running on the host it's time to run different scans against the host. Remember don't be noisy, prepare yourself for the next exams.

Juice Information

  1. Linux Kernel version

  2. The version of the Services running

  3. Sometimes we can detect users remotely

SSH Service

SSH is hard to exploit but can be brute forced, if you find a valid user try to brute force ssh.

Read more about here:

FTP Service

Old FTP can be an entry point into the remote system, maybe an anonymous user is allowed and we can get some files or better send files to the server.

Search for files inside the available folders in case you found a Web server folder send a PHP reverse shell.

Pay attention to hidden folders and the folder's names and paths as well.

Samba Service

DNS Service

MySQL Service

Web Servers

Remember! Users from web applications are different from system users.

Read More about hacking Web Servers here:

Read More about hacking Web Applications here:

What do we want?

A stable highly privileged shell of course. Root access!

Transfer files to the machine.

Download files from the machine.

Pivoting into other networks.

FTP is nice to be brute-forced if you have a valid user. If you want to learn more about read my full article about it!

SMB is the most common entry point it has tons of CVEs and most of the time is poorly configured, Check my article about and learn how o breach it!

FTP Penetration Testing
SMB Penetration testing
🟢
SSH Penetration Testing
DNS Penetration Testing
SSH Penetration Testing
MySQL Penetration Testing
Page cover image
SMB Penetration Testing
LogoWelcome!Hacking Web Applications
Hacking Web Applications
LogoThe Ultimate Guide to SMB Penetration Testing - 2023PopLabSec
LogoFree The Ultimate Guide to SSH Penetration Testing - 2023PopLabSec
LogoThe Ultimate Guide to FTP Penetration Testing - 2023PopLabSec
LogoWelcome!Hacking Web Servers
Hacking Web Servers