pwn.college - Linux Luminarium
These notes do not have the full course's content. They only contain what I thought was necessary to be written down for later checks.
Untangling Users
The nobody user on a Linux system is used to ensure that some programs
run without any special privileges.
Perceiving Permissions
ACLs -> map multiple processes to their rights on a specific file
Capability List -> map all the files and the rights a specific process has on them
Relations -> Multiple 3-element tuples -> (process, right, file)
change a file's group
chgrp <group-name> <target-file>
join a group using its password
newgrp <group-name>
example usages of chmod
u+r, as above, adds read access to the user's permissionsg+wxadds write and execute access to the group's permissionso-wremoves write access for other usersa-rwxremoves all permissions for the user, group, and worldu=rwsets read and write permissions for the user, and wipes the execute permissiono=xsets only executable permissions for the world, wiping read and writea=rwxsets read, write, and executable permissions for the user, group, and world!u=rw,g=r,o=-will set the user permissions to read and write, the group permissions to read-only, and the world permissions to nothing at allu+swill set "Set User ID" (SUID) bit on a file
Terminal Multiplexing
screen is a program that creates virtual terminals inside your terminal. It's somewhat like having multiple browser tabs, but for your command line!
exit- terminate a screenCtrl+A, d- detach from a screenscreen -r <session-name>- reattach to a screenCtrl-A c- Create a new windowCtrl-A n- Next windowCtrl-A p- Previous windowCtrl-A 0throughCtrl-A 9- Jump directly to window 0-9Ctrl-A "- bring up a selection menu of all of the windows
tmux
tmux is screen's modern alternative.
Instead of Ctrl-A, it uses Ctrl-B as its prefix
sessions
persistent workspaces that survive disconnects
tmux ls- List sessionsCtrl-b d- detach from sessiontmux attachortmux a- Reattach to sessionCtrl-b s- session selectorCtrl-b $- rename current session
windows
tabs within a session for organizing tasks
Ctrl-b c- Create a new windowCtrl-b n- Next windowCtrl-b p- Previous windowCtrl-b l- toggle last windowCtrl-b 0throughCtrl-B 9- Jump directly to window 0-9Ctrl-b w- bring up a selection menu of all of the windowsCtrl-b &- kill a windowCtrl-b ,- rename a window
panes
split regions within a window
Ctrl-b %- split horizontallyCtrl-b "- split verticallyCtrl-b up-down-left-right- navigates through panesCtrl-b o- cycle through panesCtrl-b ;- jump to last active paneCtrl-b ;- show pane numbers and type to jump to itCtrl-b z- toggle pane fullscreenCtrl-b Space- cycle through pane layoutsCtrl-b Ctrl-(up-down-left-right)- resize window by 1 cellCtrl-b x- kill pane
general commands
Ctrl-b ?- show all keybindsCtrl-b :- command modeCtrl-b t- show clockCtrl-b ~- show command message history
Silly Shenanigans
Writing into a file that we do not have rights to, but we do have rights to the file's directory:
hacker@dojo:~$ ls -l /tmp/collab/todo-list
-rw-r--r-- 1 zardus zardus 15 Jun 6 13:12 /tmp/collab/todo-list
hacker@dojo:~$ rm /tmp/collab/todo-list
rm: remove write-protected regular file '/tmp/collab/todo-list'? y
hacker@dojo:~$ echo "send hacker money" > /tmp/collab/todo-list
hacker@dojo:~$ ls -l /tmp/collab/todo-list
-rw-r--r-- 1 hacker hacker 18 Jun 6 13:12 /tmp/collab/todo-list
hacker@dojo:~$