I85PREP
⌘ K
OSEP study materials
OSEP study resources

OSEP: Linux Post-Exploitation and Advanced Attack Tradecraft

OSEP · Work through your exam, one topic at a time.

All guide sections

Linux Post-Exploitation and Advanced Attack Tradecraft

Enumerate permissions, not exploits

Kernel exploits are the last resort and the wrong first answer in a scenario that hands you a misconfiguration. Manual enumeration order: identity and groups (id, sudo -l), SUID/SGID binaries and file capabilities, cron jobs and timers, writable service units and PATH directories, NFS exports with no_root_squash, readable credential material (~/.ssh, ~/.bash_history, config files, /etc/shadow), and group-based rights such as docker, lxd, disk, or adm. Automation (LinPEAS, pspy) is for speed, not for replacing judgement.

Persistence and credential harvesting

Linux persistence is cheap and quiet: user or system cron, a systemd unit or timer, authorized_keys, shell rc files, ~/.config/autostart, and the aggressive /etc/ld.so.preload or PAM module route. Credential harvesting means private keys, sudo cached credentials, cloud instance metadata tokens, application config files, and environment files. Timestomping and history editing sit in the same category and are frequently the discriminator between two otherwise identical answers.

Traps to expect

  • A SUID binary that calls another program by relative path is a PATH hijack; one that calls an absolute path is not. Shell functions and LD_PRELOAD require the privilege to survive sudo (env_keep), and SUID ignores LD_PRELOAD for security.
  • sudo NOPASSWD on an interpreter (find, vim, python, tar, awk) is full root; the answer is the escape syntax, not a kernel exploit.
  • Pivoting questions want a mechanism with direction: ssh -L (local forward), ssh -R (remote forward), ssh -D (SOCKS), or chisel/ligolo for a full tunnel.
  • Container escapes need a concrete primitive: --privileged, a mounted Docker socket, or a host path mount.

Worked example

sudo -l returns (root) NOPASSWD: /usr/bin/find. Run sudo find . -exec /bin/sh -p \; -quit and the shell inherits the effective UID. Rule of thumb: on Linux, read the permissions matrix out loud before you name an exploit, because the exam answer is almost always a configuration, not a CVE.