Linux Postexploit

Linux Post-Exploitation Methodology

Linux post-exploitation uses native tools and scripting for credential harvesting, privilege escalation, persistence, lateral movement, defense evasion, data exfiltration, and network attacks. After gaining a shell on a Linux target, these 118 programs across 8 categories provide comprehensive offensive capabilities — from /etc/shadow extraction to kernel exploit checks, from cron/systemd persistence to DNS tunnel exfiltration, from SELinux/AppArmor bypass to ARP spoofing.

Multi-Exec Engine

All 118 programs support multiple execution methods with automatic fallback:

linuxhook shadow_dump --exec sh
linuxhook kernel_exploit_check --exec auto

Stealth Modes

linuxhook shadow_dump --stealth base64
linuxhook cron_persist --stealth memfd --command CMD

Prerequisites

Before deploying linuxhook tools, verify:

1. Environment detection — run linuxhook detect_env FIRST to determine available tools and recommended exec method
2. Access level — check root/sudo status; most credential and persistence operations require elevated privileges
3. Security frameworks — run linuxhook security_framework to assess SELinux, AppArmor, seccomp, and audit status
4. Container check — run linuxhook container_detect to verify you're on the host, not in a container

# Step 0 — environment detection (ALWAYS run first)
linuxhook detect_env

# Step 1 — stealth capability check
linuxhook stealth_check_linux

Kill Chain Phases

Phase 1 — Reconnaissance

Comprehensive system and environment assessment.

Phase 2 — Credential Harvesting

Extract credentials from multiple sources.

Phase 3 — Privilege Escalation

Escalate from standard user to root via 25 techniques.

Phase 4 — Persistence

Establish persistent access via 22 mechanisms.

Phase 5 — Lateral Movement

Move laterally using Linux infrastructure.

Phase 6 — Defense Evasion

Evade monitoring and detection.

Phase 7 — Data Exfiltration

Stage and exfiltrate data through multiple channels.

Phase 8 — Network Attacks

Network-level attacks from compromised host.

Phase 9 — Cleanup (MANDATORY)

Always run cleanup before leaving a target.

linuxhook cleanup_linux

Removes CyberStrike artifacts: clears logs, removes persistence mechanisms, restores modified configs, cleans temp files.

Detection Considerations

Linux post-exploitation tools are detectable by:

• auditd — syscall monitoring, file access, process execution
• SELinux/AppArmor — mandatory access control enforcement
• AIDE/Tripwire — file integrity monitoring
• syslog/journald — authentication logs, system events
• Falco/Sysdig — runtime security monitoring
• OSSEC/Wazuh — host-based intrusion detection
• eBPF-based tools — kernel-level monitoring (Cilium, Tetragon)

Program Reference