hub

02 — Linux Hub

BLUF: Linux is the foundation of red team operations. Every engagement touches a Linux host — whether it's your C2 server, a web app target, or a pivot box. Master enumeration, privilege escalation, and persistence before anything else.

Note

🔴 OW64 — P1: Linux Action Items

Linux Enumeration Fundamentals · 2. SUID/SGID/Capabilities Abuse · 3. Cron & Systemd Abuse · 4. Kernel Exploit Identification · 5. SSH Pivoting & Key Harvesting · 6. Container Escape Techniques · 7. Linux Persistence Mechanisms · ✦ 8. Full Linux Attack Chain

Layer 0: start with foundations/linux/architecture (boot → userspace, process, memory, disk). Deep dives: 1.1a OPSEC · 1.1b PrivEsc · 1.1c Looting/C2.

Important

Authorized use only: Use these notes only in owned, explicitly authorized, or isolated lab environments.

Detection awareness: Assume commands, binaries, network calls, identity changes, and cloud or directory actions may be logged by endpoint tooling, audit frameworks, SIEM pipelines, proxy logs, DNS logs, auth logs, and platform telemetry.

Blue-team view: Treat every technique as a defender validation exercise too: note what artifacts it creates, what alerts or hunts could surface it, and what monitoring or hardening would prevent or contain it.

CTF/lab boundary: If a sandbox or CTF includes bypass-oriented exercises, keep them confined to that environment and translate the lesson into detection, prevention, and cleanup notes rather than real-world evasion guidance.

Attack Path Overview

graph TB
    Start([Initial Foothold]) --> Enum[Enumeration & Discovery]
    Enum --> PrivEsc{Privilege Escalation}
    PrivEsc --> SUID[SUID/SGID Abuse]
    PrivEsc --> Cron[Cron/Systemd Abuse]
    PrivEsc --> Kernel[Kernel Exploits]
    PrivEsc --> Container[Container Escape]
    PrivEsc --> Root([Root Access])
    Root --> Persist[Persistence Mechanisms]
    Root --> Pivot[SSH Pivot & Key Harvest]
    Root --> Chain[Full Attack Chain]
    style Start fill:#ff6600
    style Root fill:#ff0000
    style Chain fill:#00aa00

MITRE ATT&CK Mapping

Technique ID	Name	Tactic	Pillar Relevance
T1548.003	Sudo and Sudo Caching	Privilege Escalation	SUID/sudo abuse
T1053.003	Cron	Persistence	Cron job abuse
T1543.002	Systemd Service	Persistence	Service persistence
T1059.004	Unix Shell	Execution	Shell scripting
T1070.002	Clear Linux or Mac System Logs	Defense Evasion	Log clearing after access
T1003.008	/etc/passwd and /etc/shadow	Credential Access	Local credential harvesting
T1068	Exploitation for Privilege Escalation	Privilege Escalation	Kernel exploits
T1222.002	Linux and Mac File and Directory Permissions Modification	Defense Evasion	File permissions abuse

Layer 0 — Architecture

Read foundations/linux/architecture before Action Items: boot → interactive, privilege, process//proc, systemd, memory, disk/VFS, config, namespaces/cgroups, observe map.

Action Item index → deep dives

AI	Topic	Where
1	System & Environment Enumeration	foundations/linux/action-items + foundations/linux/architecture; OPSEC → foundations/linux/deep-dive-opsec
2	SUID/SGID/Capabilities	foundations/linux/deep-dive-privesc
3	Cron Job & Service Abuse	foundations/linux/deep-dive-privesc
4	Kernel Exploit Identification	foundations/linux/deep-dive-privesc
5	SSH Pivoting & Key Harvesting	foundations/linux/deep-dive-loot-persist
6	Container Escape	foundations/linux/deep-dive-loot-persist
7	Linux Persistence	foundations/linux/deep-dive-loot-persist
8	Full Linux Attack Chain	foundations/linux/deep-dive-loot-persist

Full Action Item checklists that previously sat in this hub now live in foundations/linux/action-items. Prefer architecture + deep dives for day-to-day study; use 1.2 when you need the original AI procedures.

Reading order

foundations/linux/architecture
This hub (map + MITRE)
1.1a → 1.1b → 1.1c

Part of Red Teaming 101.