9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

Key Takeaways Explain This Topic AI

Remote exploitation targets a network-facing service to gain an initial shell; local exploitation then abuses a kernel or SUID flaw to escalate to root.

Dirty COW (CVE-2016-5195), PwnKit (CVE-2021-4034) and Sudo Baron Samedit (CVE-2021-3156) are widely exploited local privilege-escalation vulnerabilities with reliable public exploits.

Post-exploitation exfiltrates and cracks /etc/shadow hashes, whose algorithm is identified by the i d id i d prefix ( 1 1 1 MD5, 5 5 5 SHA-256, 6 6 6 SHA-512, y y y yescrypt).

Assessing patch level and deriving the missing-patch list from the package manager confirms which public exploits will succeed.

Reversion to previous state means removing tooling, restoring modified files and cleaning artefacts so the host is left as it was found.

Last updated: September 2026

9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

Syllabus item F2 is broad and practical. It requires: knowledge of recent or commonly found Linux vulnerabilities with public exploit code; use of remote exploit code and local exploit code to gain root access ; and the common post-exploitation activities — exfiltrate password hashes, crack password hashes, check patch levels, derive the list of missing security patches, and revert to the previous state.

This section ties together the enumeration from 9.1–9.5 into the exploitation and post-exploitation phases. Everything here assumes the host is in scope and the activity is authorised: gaining root on a client system is exactly what the Rules of Engagement and the Computer Misuse Act govern.

1. Remote vs Local Exploitation

The two words carry precise meaning:

Remote exploit — code delivered over the network against a listening service, requiring no prior access. It yields an initial foothold, typically as the unprivileged account the service runs as ( www-data , postgres , nobody ).

Local exploit — code that must be run on the host by an already-present user, abusing a kernel flaw, a SUID binary or a misconfiguration to escalate privilege , usually to root.

• The canonical chain is remote-to-root : Internet / network
• |
• v
• [ Remote exploit against a service ] --> shell as www-data (unprivileged)
• |
• v
• [ Local privilege-escalation exploit ] --> shell as root (uid 0)
• |
• v
• [ Post-exploitation: harvest, assess, revert ]

A well-patched host may be immune to the remote step but still vulnerable to the local step, which is why a credentialed assessment (given a low-privileged account) is so productive: it starts you where a remote exploit would land and tests the escalation surface directly.

2. Notable Linux Vulnerabilities With Public Exploits

The syllabus wants awareness of the classes and the landmark examples, not an exhaustive list.

Local Privilege Escalation (kernel and userland)

Vulnerability CVE Mechanism

Dirty COW CVE-2016-5195 Race condition in the kernel copy-on-write handler lets an unprivileged user write to read-only memory mappings, e.g. overwrite a SUID binary or /etc/passwd

PwnKit CVE-2021-4034 Memory corruption in polkit's pkexec (a SUID-root binary present by default) giving instant root

• Sudo Baron Samedit CVE-2021-3156 Heap overflow in sudo reachable by any local user regardless of sudoers entry
• Dirty Pipe CVE-2022-0847 Kernel pipe flaw allowing overwrite of read-only files
• OverlayFS / Netfilter various Recurring kernel LPE classes exploited by public tooling
• Remote Service Vulnerabilities

Vulnerability CVE Target

Shellshock CVE-2014-6271 Bash environment-variable parsing, reachable through CGI, DHCP clients and more — remote code execution

• Heartbleed CVE-2014-0160 OpenSSL memory disclosure (covered in 3.3) — leaks keys and session data
• Log4Shell CVE-2021-44228 JNDI lookup in Log4j — RCE via a logged string

Sudo/OpenSSH/Exim/Samba service RCEs various Version-specific remote flaws found by matching banners to advisories

The workflow is always the same: enumerate the exact version, match it to public exploit data, verify applicability, then exploit. searchsploit <product> <version> , the Exploit-DB, and linux-exploit-suggester / les.sh automate the matching against a captured uname -a and package list.

3. Post-Exploitation: Harvesting Credentials

Once root is obtained, the priority is credential material that enables lateral movement.

• Exfiltrate the Hashes # The credential files (readable as root)
• cp /etc/passwd /etc/shadow /tmp/loot/ # then exfiltrate
• unshadow /etc/passwd /etc/shadow > /tmp/loot/unshadowed.txt

The $id$ prefix in /etc/shadow identifies the hashing scheme, which determines cracking speed and tooling:

• Prefix Algorithm Note
• $1$ MD5-crypt Fast to crack; obsolete
• $2a$ / $2y$ bcrypt (Blowfish) Deliberately slow, work-factor tunable
• $5$ SHA-256-crypt 5000 rounds by default
• $6$ SHA-512-crypt 5000 rounds by default; long the Linux default
• $y$ yescrypt Memory-hard; the modern default on recent distros
• Crack the Hashes hashcat -m 1800 unshadowed.txt wordlist.txt # -m 1800 = sha512crypt ($6$)
• john --format=sha512crypt unshadowed.txt --wordlist=wordlist.txt

The mode number must match the prefix ( 500 for $1$ , 7400 for $5$ , 1800 for $6$ , 3200 for bcrypt). Beyond /etc/shadow , harvest SSH private keys ( ~/.ssh/id_* ), history files ( .bash_history , .mysql_history ), application configs with database and API credentials, and cached cloud credentials ( ~/.aws , ~/.kube , instance metadata).

• 4. Post-Exploitation: Patch-Level Assessment and the Missing-Patch List
• The same host-audit techniques from section 7.4 apply here, now with root: uname -a # kernel version and build
• rpm -qa --last | head # RHEL family: installed packages, newest first
• dpkg -l # Debian family
• yum updateinfo list security # outstanding security advisories (RHEL)
• apt list --upgradable # available updates (Debian/Ubuntu)

Deriving the missing-patch list means comparing installed package versions against the distribution's security advisory feed (RHSA/DSA/USN). Remember the backporting paradox from 7.4: on enterprise Linux the upstream version is frozen while fixes are added to the package release, so the missing-patch judgement must be made from the package build string and changelog, not the banner. The missing-patch list is what confirms, retrospectively, which of the public exploits above would actually have worked.

5. Post-Exploitation: Reversion to Previous State

"Reversion to previous state" is an explicit F2 requirement and a professional obligation. A penetration test must not leave the host weakened or littered with tooling:

Remove uploaded tooling and payloads — enumeration scripts, exploit binaries, netcat listeners, the /tmp/loot directory.

Restore any modified files — if you appended a line to /etc/passwd , backed up and edited a config, or replaced a binary during exploitation, restore the original. Keep a record of exactly what you changed (this is why record-keeping runs alongside exploitation).

Remove created accounts, cron jobs, SSH keys and SUID backdoors placed for persistence during the test.

Restore file permissions and ownership you altered.

Note anything that cannot be cleanly reverted — a rebooted host, a crashed daemon, a rotated log — and report it, so the client can verify state.

Crucially, preserve rather than destroy evidence : reversion means removing your artefacts and undoing your changes, not wiping logs to hide activity. Deleting the client's logs would both destroy the evidence trail the engagement depends on and cross the line from testing into anti-forensics. If an interim critical finding warrants it, escalate before continuing (see the record-keeping and escalation section).

• 6. The End-to-End Workflow 1. Enumerate service + version (9.2-9.5) -> attack surface
• 2. Match to public exploits searchsploit -> candidate remote/local exploits
• 3. Remote exploit over the network-> foothold as service account
• 4. Local enumeration LinPEAS, les.sh -> escalation candidates
• 5. Local exploit kernel/SUID -> root
• 6. Harvest credentials shadow, keys -> lateral movement material
• 7. Assess patch level package manager -> missing-patch list
• 8. Document + revert notes, cleanup -> host left as found

Each transition is evidence for the report: the exact exploit used, the account obtained at each step, the hashes recovered and cracked, and the missing patches that explain the exposure. That evidence — not the mere fact of "we got root" — is what lets the client prioritise remediation.