Black Hat Bash

The premise is that bash is already installed everywhere you will end up, and that a scripted version of a manual check is the difference between doing it once and doing it on every host. The book is a course in offensive scripting hung on a full engagement, from external reconnaissance through to exfiltration.

Two modules cite it - web reconnaissance and privilege escalation - which is a fair reflection of where it is strongest. The middle chapters on gaining a foothold are conventional; the enumeration and escalation chapters are unusually complete.

Why it is on this shelf

Because the moment after a CTF gives you code execution is the moment most players slow down, and it is entirely a checklist problem. What am I, what can I read, what runs as somebody else, what is scheduled, what is misconfigured. This book is that checklist with the commands attached.

Chapter 4, Reconnaissance

External enumeration written as scripts rather than as tool invocations: host discovery, port scanning, service identification, subdomain enumeration and directory discovery, with the output of each stage feeding the next.

The pipeline idea is what transfers. A single scan is a fact; a pipeline that turns hosts into ports into services into paths is a process you can rerun when the scope changes, and it is the same reason web recon and attack surface argues for a written record of the surface rather than a set of browser tabs. The directory scanner is the interactive version of the last stage.

Chapter 8, Local Information Gathering

What to look at once you are on the machine, in an order that goes from free to expensive. Identity and groups, the operating system and kernel version, mounted filesystems and their options, environment variables, running processes and who owns them, listening sockets, installed packages, scheduled jobs, readable configuration and history files.

Two of those repay attention in a competition. Mount options are one: a filesystem mounted nosuid neutralises an entire escalation route, and noticing that early saves you from a dead end. Scheduled jobs are the other: a cron entry running a script you can write to is one of the most common intended paths in a boot-to-root challenge, and it is only visible if you looked.

Chapter 9, Privilege Escalation

The escalation routes, one per section, each with the command that finds it. The sudo configuration first, because sudo -l answers the question directly: it prints exactly what you may run as somebody else, and a single permitted command with a shell escape is a full escalation.

• Sudo rules, including the ones scoped to a single binary or script.
• Setuid and setgid binaries, and what each one can be persuaded to do on your behalf.
• Writable scripts, units and cron jobs that a privileged account executes.
• Weak file and directory permissions on things that are read as root.
• Capabilities, which grant a subset of root without the setuid bit and are easy to miss.
• Credentials left in configuration, history, backups and key material.

The chapter also does something most treatments skip: brute-forcing recovered key material, in his example a passphrase-protected GnuPG private key driven from a wordlist in a loop. That is a useful reminder that an encrypted artefact found during enumeration is a lead rather than a wall - the same relationship hash cracking and the hash cracker have with a recovered digest.

Linux privilege escalation covers the same ground in CTF order, with the escapes for the common setuid binaries.

Where it stops

It is Linux, and it stays at the level of configuration and misconfiguration. There is no memory corruption, no kernel exploitation and no reversing - when the escalation route is a vulnerable binary rather than a permissive rule, this book has nothing to say and Practical Binary Analysis does.

The engagement framing also carries chapters on persistence, lateral movement and evasion that have no counterpart in a competition, and its lab is built on specific vulnerable images.

What to take into a challenge

Enumerate in one pass and write it down. The failure mode after getting a shell is running commands ad hoc, forgetting what you have already seen, and missing the one line that mattered. A fixed sequence, run once, with the output kept, beats improvisation every time - and it is the same discipline first hour triage applies to a file.