Linux Infrastructure
Offensive and defensive reference for Linux hosts: permissions model, enumeration, local privilege escalation, container escapes, credential discovery, and persistence. This subcategory covers standalone and enterprise Linux systems (servers, workstations, containers).
This subcategory uses the two-track format (Offensive / Defensive). See the parent INFRASTRUCTURE README for the format skeleton.
Files
| # | File | Focus |
|---|---|---|
| 01 | Linux Fundamentals | Permissions, SUID/SGID, capabilities, systemd, kernel, namespaces |
| 02 | Enumeration and Misconfigurations | linPEAS, LinEnum, pspy, configs, cron, sudoers |
| 03 | Local Privilege Escalation | SUID/SGID, sudo, capabilities, cron, PATH, kernel exploits |
| 04 | Container and Namespace Escapes | Docker, LXC, host mounts, privileged containers, Kubernetes basics |
| 05 | Credentials and Secret Discovery | SSH keys, history, env vars, configs, agent forwarding |
| 06 | Persistence and Defense | cron, systemd, SSH keys, PAM, auditd, hardening |
Scope
In scope:
- Linux servers (RHEL/CentOS/Rocky, Debian/Ubuntu, SUSE, Alpine).
- Linux workstations.
- Containerized workloads (Docker, Podman, LXC/LXD).
- Kubernetes nodes and pods (attack surface from a compromised pod).
- Standalone and domain-joined Linux (SSSD, Winbind) - host-level attacks.
Out of scope:
- Active Directory attacks from Linux (Kerberos tooling on Linux) - see
01 Active Directory. - Cloud-hosted Linux (AWS EC2, Azure VM, GCP CE specific features) - see the CLOUD category.
- Hypervisor-level escapes - see the VIRTUALIZATION category.