Local Linux Enumeration & Privilege Escalation

Local Linux Enumeration & Privilege Escalation

The following post lists a few Linux commands that may come in useful when trying to escalate privileges on a target system. This is generally aimed at enumeration rather than specific vulnerabilities/exploits and I realise these are just the tip of the iceberg in terms of what’s available.

This will continually be updated with new/useful commands.

 Revision 1.0

Kernel, Operating System & Device Information:
Command     Result
uname -a    Print all available system information
uname -r    Kernel release
uname -n    System hostname
hostname    As above
uname -m    Linux kernel architecture (32 or 64 bit)
cat /proc/version   Kernel information
cat /etc/*-release  Distribution information
cat /etc/issue  As above
cat /proc/cpuinfo   CPU information
df -a   File system information



Users & Groups:
Command     Result
cat /etc/passwd     List all users on the system
cat /etc/group  List all groups on the system
cat /etc/shadow     Show user hashes – Privileged command
grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}'     List all super user accounts
finger  Users currently logged in
pinky   As above
users   As above
who -a  As above
w   Who is currently logged in and what they’re doing
last    Listing of last logged on users
lastlog     Information on when all users last logged in
lastlog –u %username%     Information on when the specified user last logged in



User & Privilege Information:
Command     Result
whoami  Current username
id  Current user information
cat /etc/sudoers    Who’s allowed to do what as root – Privileged command
sudo -l     Can the current user perform anything as root



Environmental Information:
Command     Result
env     Display environmental variables
set     As above
echo $PATH  Path information
history     Displays command history of current user
pwd     Print working directory, i.e. ‘where am I’
cat /etc/profile    Display default system variables



Interesting Files:
Command     Result
find / -perm -4000 -type f 2>/dev/null  Find SUID files
find / -uid 0 -perm -4000 -type f 2>/dev/null   Find SUID files owned by root
find / -perm -2000 -type f 2>/dev/null  Find files with GUID bit set
find / -perm -2 -type f 2>/dev/null     Find world-writable files
find / -perm -2 -type d 2>/dev/null     Find word-writable directories
find /home –name *.rhosts -print 2>/dev/null  Find rhost config files
ls -ahlR /root/     See if you can access other user directories to find interesting files  – Privileged command
cat ~/.bash_history     Show the current users’ command history
ls -la ~/.*_history     Show the current users’ various history files
ls -la ~/.ssh/  Check for interesting ssh files in the current users’ directory
ls -la /usr/sbin/in.*   Check Configuration of inetd services
grep -l -i pass /var/log/*.log 2>/dev/null  Check log files for keywords (‘pass’ in this example) and show positive matches
find /var/log -type f -exec ls -la {} \; 2>/dev/null    List files in specified directory (/var/log)
find /var/log -name *.log -type f -exec ls -la {} \; 2>/dev/null    List .log files in specified directory (/var/log)
find /etc/ -maxdepth 1 -name *.conf -type f -exec ls -la {} \; 2>/dev/null  List .conf files in /etc (recursive 1 level)
ls -la /etc/*.conf  As above
find / -maxdepth 4 -name *.conf -type f -exec grep -Hn password {} \; 2>/dev/null   Find .conf files (recursive 4 levels) and output line number where the word password is located
lsof -i -n  List open files (output will depend on account privileges)



Service Information:
Command     Result
ps aux | grep root  View services running as root
cat /etc/inetd.conf     List services managed by inetd
cat /etc/xinetd.conf    As above for xinetd



Jobs/Tasks:
Command     Result
crontab -l -u %username%    Display scheduled jobs for the specified user – Privileged command
ls -la /etc/cron*   Scheduled jobs overview (hourly, daily, monthly etc)
ls -aRl /etc/cron* | awk '$1 ~ /w.$/' 2>/dev/null   What can ‘others’ write in /etc/cron* directories
top     List of current tasks



Networking, Routing & Communications:
Command     Result
/sbin/ifconfig -a   List all network interfaces
cat /etc/network/interfaces     As above
arp -a  Display ARP communications
route   Display route information
cat /etc/resolv.conf    Show configured DNS sever addresses
netstat -antp   List all TCP sockets and related PIDs (-p Privileged command)
netstat -anup   List all UDP sockets and related PIDs (-p Privileged command)
iptables -L     List rules – Privileged command
cat /etc/services   View port numbers/services mappings



Programs Installed:
Command     Result
dpkg -l     Installed packages (Debian)
rpm -qa     Installed packages (Red Hat)
sudo -V     Sudo version – does an exploit exist?
httpd -v    Apache version
apache2 -v  As above
apache2ctl (or apachectl) -M    List loaded Apache modules
mysql --version     Installed MYSQL version details
perl -v     Installed Perl version details
java -version   Installed Java version details
python --version    Installed Python version details
ruby -v     Installed Ruby version details
find / -name %program_name% 2>/dev/null (i.e. nc, netcat, wget, nmap etc)   Locate ‘useful’ programs (netcat, wget etc)
which %program_name% (i.e. nc, netcat, wget, nmap etc)  As above



Common Shell Escape Sequences:
Command     Program(s)
:!bash  vi, vim
:set shell=/bin/bash:shell  vi, vim
!bash   man, more, less
find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' \;  find
awk 'BEGIN {system("/bin/bash")}'   awk
--interactive   nmap
perl -e 'exec "/bin/bash";'     Perl