Unix is an operating system developed by Bell Labs. Basically, it works on a command-line interface, and is designed for large systems. This operating system is not free, but it is proprietary and portable. Linux is a Unix clone developed by Linus Torvalds in 1991. It is open source, and you can use it in anything that has a processor. Linux is flexible, and you can modify and implement it as it is licensed under a GNU General Public License (GPL).

In this subsection, let's open the command line and execute some basic commands. In every Linux host, there are command-line interfaces named shells that interpret and execute typed commands and scripts. There are many shell environments, such as...

Security models are specific mechanisms to represent security policies in a logical way. These models are based on the Trusted Computing Base (TCB), which is described in the US Department of Defense Standard 5200.28. This standard is also known as the Orange Book. It presents TCB as trusted system components that are responsible for the access control to any system. TCB is limited by an fictional boundary called a security perimeter. Every connection between the TCB and other subsystem should be possible using secure channels sometimes named security paths. Security models are present to prevent unauthorized information flow. In other words, they assert that the information is flowing from a low-level security to a high level, and not the opposite. There are also other models named noninterference models, which focus on the behaviors done on each subject and not...

Before exploring access controls, let's discover some important terms in security controls. By definition, a control as a noun means an entity that checks based on a standard. Security controls are divided into three main categories:

• Management security controls: These use managerial techniques and planning to reduce the following risks:
  • Vulnerability analysis
  • Pentesting
  • Risk analysis

• Technical security controls: This is also known as operational security controls. They use both technologies and awareness as safeguards. These are some examples:
  
  • Firewalls
  • Encryption
  • Intrusion detection systems
  • Antivirus
  • Training
• Physical security controls: These are the physical safeguards used to protect the following data:
  
  • Cameras
  • Gates
  • Biometrics
  • Sensors

An attack is an actual act by a threat agent against assets of an information system. The path used to attack the target is called an attack vector. There are three main types of attack vector and threat:

• Network threats: This refers to the threat against the networks of the organization
• Host threats: These are the threats against the host, including hardware and the operating system
• Application threats: This refers to the threat against the system programs

Enumeration is a key for every successful attack. It is a critical phase in hacking systems, and a vital part of information gathering. During this phase, the attacker establishes a connection between them and the target...

There are many motives for hacking, but nothing can be compared with the excitement of fully taking control of the systems. This can be done by exploiting the Linux kernel. Attacking the core of the system will make hackers feel on top of the world; that is why the kernel represents a high-priority target for every hacker.

Most operating systems rely on a ring protection model. This model represents superposed conceptual rings varying from high to low privileges. There are four layers numbered from 0 to 3:

• Ring 3: This layer is the usual interaction layer, with the user normally in the user mode.
• Ring 2: This layer contains operations with low privilege.
• Ring 1: This is...

There are many techniques implemented to avoid buffer overflow attacks. In the upcoming sections, we will cover some of the well-known mechanisms.

Address space layout randomization (ASLR) is a defense mechanism developed by the Pax Project against buffer overflow attacks. This memory-protection process randomizes the executable location when loaded in memory. Because, as we learned in the previous sections, if locations are predictable, then system exploitation will be easy. It started as a Linux patch in 2001, but later was integrated in many other operating systems. ASLR can be defeated using the following techniques:

• Bruteforcing all the possible...

In the previous sections, we discovered the required methods and tools to attack the Linux infrastructure. Now it is time to deploy safeguards and learn how to defend against these attacks and secure your infrastructure. To harden your Linux systems, you need to do the following:

• Update Linux kernel and applications
• Avoid using insecure services such as FTP and telnet and use SFTP and OpenSSH instead
• Minimize the attack surface by using only the needed applications and services
• If possible, use SELinux
• Use a strong password policy
• Keep an eye on faillog records
• Harden /etc/sysctl.conf
• Use an authentication server

Center of Internet Security (CIS) provides many hardening guides for a various number of operating systems including Linux. It is highly recommended to visit it: https://www.cisecurity.org/.

Now, download the benchmark of your Linux distribution from...

This chapter concluded the different attack surfaces of Linux infrastructure, starting from the basic Linux commands, especially those necessary to perform system footprinting and enumeration. In later sections, we had the chance not only to learn the latest Linux exploitation techniques in addition to real-world study cases, but to also understand the theories and concepts behind every Linux security layer. We didn't stop there; as penetration testers, we had the opportunity to discover how to exploit the inner core of a Linux infrastructure. At the end of this chapter, we gained skills to operate and secure a Linux infrastructure from both an attacker and a defender's perspective. The next chapter will broaden your vision, giving you a clear understanding about how to penetrate large corporate networks and databases, from networking refresher terminologies...