Linux Privilege Escalation · theMailMan.Tech

Local Enumeration (Linux/Debian)

Local Users and Groups

Users

cat /etc/passwd

Local Groups

cat /etc/group

Current User Group Membership

groups

id

List All UIDs and Respective Memberships

for i in $(cat /etc/passwd 2>/dev/null | cut -d ":" -f 1); do id $i; done

Currently Logged On Users

who -a

who -q

finger

pinky

users

Last Logged on Users

last

lastlog

What is Currently Logged On User Doing

User Hashes

cat /etc/shadow

Current User Environment Variables

env

Path Information

echo $PATH

Current User Command History

history

cat ~/*history

Display All System Variables

cat /etc/profiles

Available Shells

cat /etc/shells

User Privileges (Sudo)

Sudo Permissions

sudo -l

Sudoers Group Members (Privileged Command)

cat /etc/sudoers

Sudo Version

sudo -V

System

Hostname

hostname

Kernel Information

cat /etc/issue

cat /etc/*-release

uname -a

Architecture

arch

uname -r

Network

Local Interfaces

ifconfig

ip a

DNS Servers

cat /etc/resolv.conf

Active Connections

netstat -aon

ss -anp

Listening Ports

ss -ntplu

Service/Port Mappings (For Refference Lookup)

cat /etc/services

Applications

Check Var or Opt Directories

ls /var

ls /opt

Installed Applications

dpkg -l

rpm -qa

Recently Installed Applications

grep install /var/log/dpkg.log

grep install /var/log/dpkg.log /var/log/dpkg.log.1

Apache Version

httpd -v

apache2 -v

Loaded Apache Modules

apache2ctl -M

apachectl -M

Sites Enabled (VHOST)

ls -la /etc/apache2/sites-available/

cat /etc/apache2/sites-enabled/*

Which Account is Apache Running As

ps aux | egrep '(apache|httpd)' | grep -v ^root | head -n1 | awk '{print $1}'

MYSQL Version

mysql --version

Postgres Version

psql -V

Perl Version

perl -v

Java Version

java --version

Python Version

python --version

python3 --version

Ruby Version

ruby -v

Available Compilers

dpkg --list 2>/dev/null| grep compiler |grep -v decompiler 2>/dev/null

yum list installed ‘gcc*’ 2>/dev/null| grep gcc 2>/dev/null

Processes

List All Processes

ps aux

Processes Running as Root

ps aux | grep -i root

Gathering Information on a Specific Process

ps u -C <command_run>

Query `inetd` Information

cat /etc/inetd.conf

cat /etc/xinetd.conf

Enumerating Full Information on Specific Process

cat /proc/<PID>/status

Inspecting the UID for Specific Process

grep UID /proc/1932/status

Inspecting the Processes with Watch

watch -n 1 "ps -aux | grep -i -E 'pass|pwd|user|-u|-p|cred'"

Scheduled Tasks

Current Jobs

top

htop

Listing All Cronjobs Directories

ls -lah /etc/cron*

List Default Crontab

cat /etc/crontab

List Current User Cronjobs

crontab -l

Listing Root User Cronjobs

sudo crontab -l

Reading the Cronjob Log File

grep -i "cron" /var/log/syslog

journalctl | grep -i "cron"

File/Directory && Permissions

Writable Directories for Current User

find / -writable -type d 2>/dev/null

Writable Directories for Specific User

find / -writable -user john -type d 2>/dev/null

SUID Binaries

find / -perm -u=s -type f 2>/dev/null

GUID Binaries

find / -perm -g=s -type f 2>/dev/null

Password/SSH Key Hunting

Rough Search for `pass` in Home Directory

for i in  $(find /home -type f \( -name "*.txt" -o -name "*.log" -o -name "*.csv" -o -name "*.ini" -o -name "*.log" \) 2>/dev/null);do grep -i pass $i 2>/dev/null; done

Search for SSH Files

find / -type f \( -name "*.pub" -o -name "id_dsa" -o -name "id_rsa" -o -name "*keys*" -o -name "known_hosts" -o -name "authorized_hosts" -o -name "authorized_keys"\) 2>/dev/null

ls -la ~/.ssh/

Check Log Files for Phrase: `pass`

grep -l -i pass /var/log/*.log 2>/dev/null

Find Configuration Files

find /etc/  -name *.conf -type f

List Open Files (Omitting Current User)

lsof | grep -v $(whoami)

Verify Access to Root’s Mail File

head /var/mail/root

Find `.plan` Files

find /home -iname *.plan 2>/dev/null

Find Rhosts File

find /home -name *.rhosts -type f  2>/dev/null

Capabilities

Recursive Search for Binaries with Capabilities

/usr/sbin/getcap -r / 2>/dev/null

Firewall

List Firewall Rules

iptables -Lf