OPSECTLAS you are here: Linux
Linux

Decision Tree: Shell on Linux → What First?

reference

  1. Recon
  2. Enumerate
  3. Foothold
  4. PrivEsc
  5. Lateral
  6. Post-Ex

You landed a low-priv shell on the Linux host (www-data, a service user). Stabilize first, enumerate hard, then escalate in priority order.

start Low-priv shell on the Linux host (www-data or a user)

  1. 1
    Shell Stabilization (get a real PTY before anything else)
  2. 2
    System Enumeration (kernel, users, SUID, cron, writable paths)
  3. 3
    sudo -l → GTFOBins Workflow (check your sudo rights, escape any binary)
    • SUID Binary Exploitation (any unusual SUID-root binaries?)
    • Cron Job Exploitation (writable scripts running as root?)
  4. 4
    Password Hunting (creds in configs, history, and .ssh keys)
  5. 5
    LinPEAS & pspy Usage (automate the sweep, watch running processes)
    • Kernel Exploits (last resort, match the exact version)