Basic Linux commands for CTF: enumeration after the first shell
You have access to the machine through web vulnerability, SSH or reverse shell. The first wish is to look for the flag immediately. Don't give in. Enumeration (system exploration) determines the entire further path. In terms of MITRE ATT&CK, this is System Information Discovery (T1082) and File and Directory Discovery (T1083) – systematic information gathering before active action. Read more in our detailed analysis of linux for the pentester.
Start with three questions: who am I, where I am, what is here.
Who am I? whoami show the name of the current user. id will give more – UID, GID and group list. Groups here are critical: membership in docker, lxd or disk – it is almost guaranteed escalation of Linux privileges to root.
Where am I? hostname will give the name of the machine, uname -a – version of the core and architecture, cat /etc/os-release - distribution. The core version is especially important: old kernels (up to 4.8.3) are vulnerable to Dirty COW (CVE-2016-5195), which is more detailed in the section about kernel exploits.
What's in here? File /etc/passwd will show all users of the system – this is the technique /etc/passwd and /etc/shadow (T1003.008, Credential Access). Pay attention to users with UIDs above 1000 – they are not systemic, but real. User with UID 0 except root – an anomaly and attack vector.
Next, processes. ps aux | grep root show services that work from root. Obsolete software among them (Nagios below 4.2.4, for example – CVE-2016-9566, local escalation through a symlink attack on a log file) – a potential entry point.
whoami
id
uname -a
cat /etc/os-release
cat /etc/passwd | grep -v nologin
sudo -l
ls -la /home/
cat /etc/crontab
This sequence is brought to automatism. Each team takes seconds, but together they give a full picture. According to HTB Academy, checking other users' home directories (ls -la /home/) - one of the most effective steps: there are often SH keys, configs with passwords and .bash_history with commands that were performed earlier – including passwords in the open (T1552.003 Shell History, Credential Access).
Team What gives ATT&CK Technique
whoami / id Current user, groups T1082 System Information Discovery
uname -a Kernel version, architecture T1082 System Information Discovery
cat /etc/passwd List of System Users T1003.008 /etc/passwd and /etc/shadow
sudo -l Available sudo teams T1548.003 Sudo and Sudo Caching
ps aux \| grep root Processes from root T1082 System Information Discovery
ls -la /home/ Home Directories T1083 File and Directory Discovery
cat /etc/crontab Planned tasks T1083 File and Directory Discovery
Linux Access Rights: CTF Task Foundation
Nine out of ten newcomers are confused chmod and chown, do not understand the difference between SUID and sudo, do not know why Sticky Bit is needed. On CTF it costs flags: the tasks on privilege are built on the intricacies of the Linux access rights system.
chmod and chown — working with rights
Each file and directory in Linux has three rights groups: for the owner, the group (group) and the rest (others). Each group is assigned three types: reading (r), writing (w) and execution (x).
Launch ls -la – you will see a string of the view -rwxr-xr--. Parsing:
Position Significance Example
1 Type: - file, d directory, l link -
2-4 Owner's rights rwx (all allowed)
5-7 Group rights r-x (reading and execution)
8-10 Rights of the others r-- (read only)
For files intuitively: r — you can read the content, w — you can change, x — you can run as a program. But for directories - a nuance on which beginners stumble: x on the directory - the opportunity to enter it through cd, r — the ability to list content through ls. Directory with r, but without x – you see the names of the files, but you can’t contact them. Directory with x, but without r — you can refer to files by name, but do not see the list. Remember this difference – it pops up regularly on the CTF.
chmod changes rights. Numerical notation: r=4, w=2, x=1, values add up. chmod 755 script.sh – the owner receives full rights (7 = 4 + 2 + 1), the group and the rest - reading with execution (5 = 4 + 0 + 1). chown change the owner: chown user:group file.
Typical error: a beginner sees a file belonging to root with 777 rights and tries to change the owner through chown. No need – if the rights are 777, the file is already available to everyone to write. chmod changes the permits, chown - the owner. Different operations.
/etc/passwd in a normal configuration has rights -rw-r--r-- root can read and write, everyone else can read. As Delinea describes, that's why /etc/passwd available to any user for viewing, but only root can write in it. Discovered /etc/passwd with write rights for your user is a direct path to root: just add a line with UID 0.
/etc/shadow protected stricter: -rw-r-----, only root and shadow group can read it. Password hashes are stored there. Accessed /etc/shadow – unload the hashes and run overkill through hashcat or john.
SUID and SGID – Linux privileges in practice
Special bits of rights are the basis of most CTF tasks for escalating privilege. MITRE ATT&CK describes their operation as Setuid and Setgid (T1548.001, Privilege Escalation).
SUID (Set User ID) - when you start the file, the process is performed with the rights of the file holder, not the one who started it. The file belongs to the root and it is SUID - any user starts it with root rights. In the conclusion ls -la SUID is displayed as s instead of x in the position of the owner: -rwsr-xr-x.
Model example: /usr/bin/passwd. Ordinary user launches passwd to change the password - the program must write a new hash in /etc/shadow, and that belongs to the root. SUID on /usr/bin/passwd solves the problem: the process temporarily receives root rights for recording.
The problem arises when SUID stands on binary with the possibility of arbitrary execution of commands. find, vim, bash, python, nmap with SUID is the direct path to root. The full list of such binary with specific operating teams is collected on GTFOBins (gtfobins.github.io). SUID on bash – perform /bin/bash -p and get root shell. Everything.
SGID (Set Group ID) works similarly, but for the group. The process gets the rights of the file owner group.
Sticky Bit – usually stands on /tmp. Files in the directory can only be deleted by their owner, even if others have the rights to record. In the conclusion ls -la displayed as t in the position of the others: drwxrwxrwt.
Bit Numerical value On the file On the directory
SUID 4000 Launch on behalf of the owner No effect
SGID 2000 Launch on behalf of the group New files inherit the group
Sticky 1000 No effect Only the owner can remove
Search for Linux files through find and grep for CTF
find — file system exploration
find – the main file search tool in Linux for CTF. With its help, they are looking for SUID-binary, writable files, configurations with passwords and flags themselves. In MITRE ATT&CK, this is File and Directory Discovery (T1083, Discovery).
Key patterns that cover 90% of tasks:
Searching for SUID binary is the first thing you do after basic enumeration. As StrongDM notes, SUID binary exploitation remains one of the most frequent vectors of escalating privilege. Team: find / -perm -4000 -type f 2>/dev/null. Parsing: / – from the root, -perm -4000 – installed SUID-bit, -type f only files, 2>/dev/null – suppress access errors to closed directories.
Search for writable files – misconfigurement: find / -writable -type f -user root 2>/dev/null. Writable scripts belonging to root (especially from cron) are the direct vector of escalation.
Search by name – when you are looking for a flag: find / -name "flag*" -type f 2>/dev/null.
Search for modification time – if you know that the tack is recently configured: find / -mmin -30 -type f 2>/dev/null find files changed in the last 30 minutes.
grep – search for flags and credentials
find looking for files, grep looking for content. In CTF grep solves two problems: flag detection and account search (T1552.001 Credentials In Files, Credential Access).
Recursive search for a line: grep -ri "flag{" /home/ 2>/dev/null. Flag -r – recursion by subdirectories, -i – ignore the register.
Search for passwords in configurations: grep -ri "password" /etc/ /var/www/ /opt/ 2>/dev/null. Check separately grep -ri "password" /home/*/.bash_history 2>/dev/null – users often enter passwords directly in the Linux command line. According to HTB Academy, verification .bash_history – one of the most effective methods of searching credentials on CTF machines.
Useful combination find and grep: find / -name "*.conf" -exec grep -l "password" {} \; 2>/dev/null – first finds all .conf files, then checks if they contain the word “password” and outputs only file names with coincidence.
To search for IP addresses in logs: grep -rE "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" /var/log/. Regex Patterns in grep expand the possibilities of exploration and prospecting of non-standard artifacts.
Escalation of Linux privileges: privilege basics
Enumeration is complete, the system is studied - it's time to move on to the privileges. Let's look at the main vectors that work in most CTF-TASKs for beginner pentesters.
Sudo: fast path to root
sudo -l shows which programs the current user can run with increased sudo rights. This is the Sudo and Sudo Caching (T1548.003, Privilege Escalation) technique – and at the same time the first thing to check.
A typical output on a CTF machine: "User user1 may run the commands: (root) NOPASSWD: /usr/bin/vim". NOPASSWD – no password needed. Oh vim with root rights — instant escalation: launch sudo vim, inside the editor, type :!bash – and get root shell. That's so simple.
Another frequent case: sudo find / -exec /bin/bash \; -quit. For awk: sudo awk 'BEGIN {system("/bin/bash")}'. A complete catalog of binary with operation commands via sudo is collected on GTFOBins - there is a specific syntax for each utility.
Separate scenario: sudo -l shows (ALL) ALL without NOPASSWD. You can run any command from root, but you need the password of the current user. You know him - sudo su and the task is solved.
Another vector: if a variable is saved in sudoers LD_PRELOAD (seen in the conclusion sudo -l How env_keep+=LD_PRELOAD), you can create a malicious shared library and load it when you start any permitted sudo command. This trick works more often than you might think.
Cron and writable scripts
Cron is a Linux task scheduler. If the cron task starts the script from root, and the script is available for the recording to the usual user - the escalation is trivial. Check cat /etc/crontab, content /etc/cron.d/, /etc/cron.daily/ and user tasks through crontab -l.
Specific scenario: in /etc/crontab line * * * * * root /opt/scripts/backup.sh. The script belongs to the root, but has the rights of 777. Finish it with the command that creates a copy of the bash with the SUID-bit: cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash. After a minute, the cron executes the script from the root. Launching /tmp/rootbash -p – root shell is ready.
Another vector: a cron task causes a binary without an absolute path (e.g., tar instead of /usr/bin/tar). According to StrongDM, PATH variable manipulation works exactly when programs are called without a full path – create your script with this name in a directory that stands earlier in PATH.
Another technique that is often missed is wildcard injection. If the cron task performs tar cf /backup/archive.tar * in the directory where you can write – through the creation of files with names --checkpoint=1 and --checkpoint-action=exec=sh shell.sh achieve arbitrary code from root. Beautiful, right?
Kernels – Dirty COW and when everything else is closed
Kernels is the last milestone. They exploit vulnerabilities in the core itself and give root directly. But this is an extreme option: the exploit of the kernel can drop the system, and on the CTF - to nullify progress.
The most famous example is Dirty COW (CVE-2016-5195). According to NVD, it is a race condition in mm/gup.c Linux 2.x–4.x kernels to version 4.8.3. The vulnerability allows the local user to write in read-only memory mapping through incorrect processing of the copy-on-write mechanism. CVSS: 7.0 (HIGH), CVSS vector:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H:H — local attack, high complexity (AC:H), you need minimal privileges (PR:L), user actions are not required (UI:N). CWE-362 (Race Condition). The vulnerability has been exploited in the wild since October 2016 and is included in the CISA KEV directory with the SSVC solution: Act – patch immediately. EPSS scoring — 0.8352, percentile 0.9968, which corresponds to Top 1%.
The Exploit-DB published verified PoC: EDB-40611 (writing method through /proc/self/mem, author Phil Oester), EDB-40616 (SUID method, author of Robin Verton), EDB-40847 (method via /etc/passwd, author Gabriele Bonacini). On GitHub - repository scumjr/dirtycow-vdso (511 stars).
Algorithm: perform uname -r, check the version of the kernel with a range of vulnerable. For Dirty COW, the kernels are up to 4.8.3. Suitable – download PoC, compile on the target machine, run. The method via /etc/passwd (EDB-40847) allows you to add a user with UID 0 - the second root account.
Kernel is not the first step. First, check sudo, SUID, cron, writable files. The core is when the other vectors are closed. In real CTFs from HackTheBox and TryHack exploitMe kernel is usually explicitly implied by the task – often worth a headlet version of the kernel.
You have access to the machine through web vulnerability, SSH or reverse shell. The first wish is to look for the flag immediately. Don't give in. Enumeration (system exploration) determines the entire further path. In terms of MITRE ATT&CK, this is System Information Discovery (T1082) and File and Directory Discovery (T1083) – systematic information gathering before active action. Read more in our detailed analysis of linux for the pentester.
Start with three questions: who am I, where I am, what is here.
Who am I? whoami show the name of the current user. id will give more – UID, GID and group list. Groups here are critical: membership in docker, lxd or disk – it is almost guaranteed escalation of Linux privileges to root.
Where am I? hostname will give the name of the machine, uname -a – version of the core and architecture, cat /etc/os-release - distribution. The core version is especially important: old kernels (up to 4.8.3) are vulnerable to Dirty COW (CVE-2016-5195), which is more detailed in the section about kernel exploits.
What's in here? File /etc/passwd will show all users of the system – this is the technique /etc/passwd and /etc/shadow (T1003.008, Credential Access). Pay attention to users with UIDs above 1000 – they are not systemic, but real. User with UID 0 except root – an anomaly and attack vector.
Next, processes. ps aux | grep root show services that work from root. Obsolete software among them (Nagios below 4.2.4, for example – CVE-2016-9566, local escalation through a symlink attack on a log file) – a potential entry point.
whoami
id
uname -a
cat /etc/os-release
cat /etc/passwd | grep -v nologin
sudo -l
ls -la /home/
cat /etc/crontab
This sequence is brought to automatism. Each team takes seconds, but together they give a full picture. According to HTB Academy, checking other users' home directories (ls -la /home/) - one of the most effective steps: there are often SH keys, configs with passwords and .bash_history with commands that were performed earlier – including passwords in the open (T1552.003 Shell History, Credential Access).
Team What gives ATT&CK Technique
whoami / id Current user, groups T1082 System Information Discovery
uname -a Kernel version, architecture T1082 System Information Discovery
cat /etc/passwd List of System Users T1003.008 /etc/passwd and /etc/shadow
sudo -l Available sudo teams T1548.003 Sudo and Sudo Caching
ps aux \| grep root Processes from root T1082 System Information Discovery
ls -la /home/ Home Directories T1083 File and Directory Discovery
cat /etc/crontab Planned tasks T1083 File and Directory Discovery
Linux Access Rights: CTF Task Foundation
Nine out of ten newcomers are confused chmod and chown, do not understand the difference between SUID and sudo, do not know why Sticky Bit is needed. On CTF it costs flags: the tasks on privilege are built on the intricacies of the Linux access rights system.
chmod and chown — working with rights
Each file and directory in Linux has three rights groups: for the owner, the group (group) and the rest (others). Each group is assigned three types: reading (r), writing (w) and execution (x).
Launch ls -la – you will see a string of the view -rwxr-xr--. Parsing:
Position Significance Example
1 Type: - file, d directory, l link -
2-4 Owner's rights rwx (all allowed)
5-7 Group rights r-x (reading and execution)
8-10 Rights of the others r-- (read only)
For files intuitively: r — you can read the content, w — you can change, x — you can run as a program. But for directories - a nuance on which beginners stumble: x on the directory - the opportunity to enter it through cd, r — the ability to list content through ls. Directory with r, but without x – you see the names of the files, but you can’t contact them. Directory with x, but without r — you can refer to files by name, but do not see the list. Remember this difference – it pops up regularly on the CTF.
chmod changes rights. Numerical notation: r=4, w=2, x=1, values add up. chmod 755 script.sh – the owner receives full rights (7 = 4 + 2 + 1), the group and the rest - reading with execution (5 = 4 + 0 + 1). chown change the owner: chown user:group file.
Typical error: a beginner sees a file belonging to root with 777 rights and tries to change the owner through chown. No need – if the rights are 777, the file is already available to everyone to write. chmod changes the permits, chown - the owner. Different operations.
/etc/passwd in a normal configuration has rights -rw-r--r-- root can read and write, everyone else can read. As Delinea describes, that's why /etc/passwd available to any user for viewing, but only root can write in it. Discovered /etc/passwd with write rights for your user is a direct path to root: just add a line with UID 0.
/etc/shadow protected stricter: -rw-r-----, only root and shadow group can read it. Password hashes are stored there. Accessed /etc/shadow – unload the hashes and run overkill through hashcat or john.
SUID and SGID – Linux privileges in practice
Special bits of rights are the basis of most CTF tasks for escalating privilege. MITRE ATT&CK describes their operation as Setuid and Setgid (T1548.001, Privilege Escalation).
SUID (Set User ID) - when you start the file, the process is performed with the rights of the file holder, not the one who started it. The file belongs to the root and it is SUID - any user starts it with root rights. In the conclusion ls -la SUID is displayed as s instead of x in the position of the owner: -rwsr-xr-x.
Model example: /usr/bin/passwd. Ordinary user launches passwd to change the password - the program must write a new hash in /etc/shadow, and that belongs to the root. SUID on /usr/bin/passwd solves the problem: the process temporarily receives root rights for recording.
The problem arises when SUID stands on binary with the possibility of arbitrary execution of commands. find, vim, bash, python, nmap with SUID is the direct path to root. The full list of such binary with specific operating teams is collected on GTFOBins (gtfobins.github.io). SUID on bash – perform /bin/bash -p and get root shell. Everything.
SGID (Set Group ID) works similarly, but for the group. The process gets the rights of the file owner group.
Sticky Bit – usually stands on /tmp. Files in the directory can only be deleted by their owner, even if others have the rights to record. In the conclusion ls -la displayed as t in the position of the others: drwxrwxrwt.
Bit Numerical value On the file On the directory
SUID 4000 Launch on behalf of the owner No effect
SGID 2000 Launch on behalf of the group New files inherit the group
Sticky 1000 No effect Only the owner can remove
Search for Linux files through find and grep for CTF
find — file system exploration
find – the main file search tool in Linux for CTF. With its help, they are looking for SUID-binary, writable files, configurations with passwords and flags themselves. In MITRE ATT&CK, this is File and Directory Discovery (T1083, Discovery).
Key patterns that cover 90% of tasks:
Searching for SUID binary is the first thing you do after basic enumeration. As StrongDM notes, SUID binary exploitation remains one of the most frequent vectors of escalating privilege. Team: find / -perm -4000 -type f 2>/dev/null. Parsing: / – from the root, -perm -4000 – installed SUID-bit, -type f only files, 2>/dev/null – suppress access errors to closed directories.
Search for writable files – misconfigurement: find / -writable -type f -user root 2>/dev/null. Writable scripts belonging to root (especially from cron) are the direct vector of escalation.
Search by name – when you are looking for a flag: find / -name "flag*" -type f 2>/dev/null.
Search for modification time – if you know that the tack is recently configured: find / -mmin -30 -type f 2>/dev/null find files changed in the last 30 minutes.
grep – search for flags and credentials
find looking for files, grep looking for content. In CTF grep solves two problems: flag detection and account search (T1552.001 Credentials In Files, Credential Access).
Recursive search for a line: grep -ri "flag{" /home/ 2>/dev/null. Flag -r – recursion by subdirectories, -i – ignore the register.
Search for passwords in configurations: grep -ri "password" /etc/ /var/www/ /opt/ 2>/dev/null. Check separately grep -ri "password" /home/*/.bash_history 2>/dev/null – users often enter passwords directly in the Linux command line. According to HTB Academy, verification .bash_history – one of the most effective methods of searching credentials on CTF machines.
Useful combination find and grep: find / -name "*.conf" -exec grep -l "password" {} \; 2>/dev/null – first finds all .conf files, then checks if they contain the word “password” and outputs only file names with coincidence.
To search for IP addresses in logs: grep -rE "[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}" /var/log/. Regex Patterns in grep expand the possibilities of exploration and prospecting of non-standard artifacts.
Escalation of Linux privileges: privilege basics
Enumeration is complete, the system is studied - it's time to move on to the privileges. Let's look at the main vectors that work in most CTF-TASKs for beginner pentesters.
Sudo: fast path to root
sudo -l shows which programs the current user can run with increased sudo rights. This is the Sudo and Sudo Caching (T1548.003, Privilege Escalation) technique – and at the same time the first thing to check.
A typical output on a CTF machine: "User user1 may run the commands: (root) NOPASSWD: /usr/bin/vim". NOPASSWD – no password needed. Oh vim with root rights — instant escalation: launch sudo vim, inside the editor, type :!bash – and get root shell. That's so simple.
Another frequent case: sudo find / -exec /bin/bash \; -quit. For awk: sudo awk 'BEGIN {system("/bin/bash")}'. A complete catalog of binary with operation commands via sudo is collected on GTFOBins - there is a specific syntax for each utility.
Separate scenario: sudo -l shows (ALL) ALL without NOPASSWD. You can run any command from root, but you need the password of the current user. You know him - sudo su and the task is solved.
Another vector: if a variable is saved in sudoers LD_PRELOAD (seen in the conclusion sudo -l How env_keep+=LD_PRELOAD), you can create a malicious shared library and load it when you start any permitted sudo command. This trick works more often than you might think.
Cron and writable scripts
Cron is a Linux task scheduler. If the cron task starts the script from root, and the script is available for the recording to the usual user - the escalation is trivial. Check cat /etc/crontab, content /etc/cron.d/, /etc/cron.daily/ and user tasks through crontab -l.
Specific scenario: in /etc/crontab line * * * * * root /opt/scripts/backup.sh. The script belongs to the root, but has the rights of 777. Finish it with the command that creates a copy of the bash with the SUID-bit: cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash. After a minute, the cron executes the script from the root. Launching /tmp/rootbash -p – root shell is ready.
Another vector: a cron task causes a binary without an absolute path (e.g., tar instead of /usr/bin/tar). According to StrongDM, PATH variable manipulation works exactly when programs are called without a full path – create your script with this name in a directory that stands earlier in PATH.
Another technique that is often missed is wildcard injection. If the cron task performs tar cf /backup/archive.tar * in the directory where you can write – through the creation of files with names --checkpoint=1 and --checkpoint-action=exec=sh shell.sh achieve arbitrary code from root. Beautiful, right?
Kernels – Dirty COW and when everything else is closed
Kernels is the last milestone. They exploit vulnerabilities in the core itself and give root directly. But this is an extreme option: the exploit of the kernel can drop the system, and on the CTF - to nullify progress.
The most famous example is Dirty COW (CVE-2016-5195). According to NVD, it is a race condition in mm/gup.c Linux 2.x–4.x kernels to version 4.8.3. The vulnerability allows the local user to write in read-only memory mapping through incorrect processing of the copy-on-write mechanism. CVSS: 7.0 (HIGH), CVSS vector:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H:H — local attack, high complexity (AC:H), you need minimal privileges (PR:L), user actions are not required (UI:N). CWE-362 (Race Condition). The vulnerability has been exploited in the wild since October 2016 and is included in the CISA KEV directory with the SSVC solution: Act – patch immediately. EPSS scoring — 0.8352, percentile 0.9968, which corresponds to Top 1%.
The Exploit-DB published verified PoC: EDB-40611 (writing method through /proc/self/mem, author Phil Oester), EDB-40616 (SUID method, author of Robin Verton), EDB-40847 (method via /etc/passwd, author Gabriele Bonacini). On GitHub - repository scumjr/dirtycow-vdso (511 stars).
Algorithm: perform uname -r, check the version of the kernel with a range of vulnerable. For Dirty COW, the kernels are up to 4.8.3. Suitable – download PoC, compile on the target machine, run. The method via /etc/passwd (EDB-40847) allows you to add a user with UID 0 - the second root account.
Kernel is not the first step. First, check sudo, SUID, cron, writable files. The core is when the other vectors are closed. In real CTFs from HackTheBox and TryHack exploitMe kernel is usually explicitly implied by the task – often worth a headlet version of the kernel.
