Enumeration
A good enumeration helps in finding the right escalation technique
After gaining access to the system, enumeration is key to know the right exploitation/privilege escalation technique.
Finding host names
Using the hostname
command, we can find the host name associated with the target system.
Although this value can easily be changed or have a relatively meaningless string (e.g. Ubuntu-3487340239), in some cases, it can provide information about the target system’s role within the corporate network (e.g. SQL-PROD-01 for a production SQL server).
Kernel details using uname
The uname
command will print system information giving us additional detail about the kernel used by the system. This will be useful when searching for any potential kernel vulnerabilities that could lead to privilege escalation.
Information from the proc file system
The proc file system (procfs) provides information about the target system processes.
Finding system information from /etc/issue
Systems can also be identified by looking at the /etc/issue
file. This file usually contains some information about the operating system but can easily be customized or changed.
List of available shells by command-line
The /etc/shells file contains the available shells in the target.
Using the ps command
The ps
command is an effective way to see the running processes on a Linux system.
The aux
option will show processes for all users (a), display the user that launched the process (u), and show processes that are not attached to a terminal (x).
Dumping Environment variables
The env
command dumps all the environment variables available in the current shell session.
The PATH
variable may have a compiler or a scripting language (e.g. Python) that could be used to run code on the target system or leveraged for privilege escalation.
The sudo -l for Finding commands that the user can run with root privileges
The target system may be configured to allow users to run some (or all) commands with root privileges. The sudo -l
command can be used to list all commands your user can run using sudo
.
Finding User Id and Group Id
The id
command will provide a general overview of the user’s privilege level and group memberships. The id
command can also be used to obtain the same information for another user.
Infamous /etc/passwd
The /etc/passwd
can be use to dump out user information and their access levels.
This can be refined to find just the user names using:
Another approach is to grep for home
in the results.
Understanding /etc/passwd format
The /etc/passwd file contains one entry per line for each user (user account) of the system. All fields are separated by a colon : symbol. Total of seven fields as follows. Generally, /etc/passwd file entry looks as follows:
[as divided by colon (:)]
Username: It is used when user logs in. It should be between 1 and 32 characters in length.
Password: An
x
character indicates that encrypted password is stored in/etc/shadow
file. Please note that you need to use the passwd command to compute the hash of a password typed at the CLI or to store/update the hash of the password in/etc/shadow
file, in this case, the password hash is stored as anx
.User ID (UID): Each user must be assigned a user ID (UID). UID 0 (zero) is reserved for root and UIDs 1-99 are reserved for other predefined accounts. Further UID 100-999 are reserved by system for administrative and system accounts/groups.
Group ID (GID): The primary group ID (stored in
/etc/group
file)User ID Info: The comment field. It allow you to add extra information about the users such as user’s full name, phone number etc. This field use by finger command.
Home directory: The absolute path to the directory the user will be in when they log in. If this directory does not exists then users directory becomes
/
.Command/shell: The absolute path of a command or shell (
/bin/bash
). Typically, this is a shell. Please note that it does not have to be a shell.
Find users belonging to root group
Dumping Session history
The history command can be useful for finding secret keys and useful credentials within the shell session.
Confirm target as pivoting point and find adjacent machines
The target system may be a pivoting point to another network. The ifconfig
command will give us information about the network interfaces of the system.
Use the ip route
command to see which network routes exist.
Looking into existing communications
Using the netstat
command we can have information about the existing communications.
To find all the listening ports we can use -l
which list ports in “listening” mode. These ports are open and ready to accept incoming connections. This can be used with the t
option to list only ports that are listening using the TCP protocol.
To get the network usage statistics we can use the -s
flag with -t
or -u
To know about the interface statistics, like eth0
or tun0
, we can use the -i
flag.
The super command used by most is -ano
which means -a
Display all sockets -n
Do not resolve names -o
Display timers and -p
to show the PID.
Using the Find command
The find
command can be used to find some fascinating files.
Find development tools or languages of help
Find a simple file in current directory
Search the entire target for a file
Find a directory in the target
Find files that are readable, writable, and executable by all users
Find executables
Find all files under /home directory for a particular user
Find files modified by time index and size
Find world-writable folders
Find world executable folders
Find Files with SUID set
Find all scheduled scripts using crontab
Cron jobs are typically located in the spool directories. They are stored in tables called crontabs. The cron jobs or schedules scripts can be viewed by using the crontab
command.
But sometimes the above command may be disabled for a user.
In such situations, we can find them in /var/spool/cron/crontabs
. The tables contain the cron jobs for all users, except the root user.
We can dump the contents of the /etc/crontab
file which stores the root user cron job details (also known as system-wide crontabs).
Check if you are in a container environment
Check for the
/proc/1/cgroup
file:Run the following command:
If you see output that contains
/docker/
,/lxc/
, or/kubepods/
, it's likely that you are in a container. The exact string may vary depending on the container runtime being used (e.g., Docker, LXC, or Kubernetes).
Inspect the hostname:
Run the
hostname
command to check the hostname of the system.Container hostnames often have a random or autogenerated name, which may indicate that you are in a container.
Examine the process tree:
Run the
pstree -a
command to view the process tree.If the process tree looks isolated with only a few processes and lacks the typical system services, it might be a sign that you are in a container.
Check for container-specific environment variables:
Run
env
to list environment variables.Some containers set specific environment variables (e.g.,
DOCKER_CONTAINER
,KUBERNETES_POD_NAME
,KUBERNETES_SERVICE_HOST
, etc.) that can indicate containerization.
Look for container runtime commands:
Check if Docker, Podman, or another container runtime is installed and running on the system:
Inspect the filesystem:
Check the file system structure for signs of a container runtime's file layout. For example, Docker containers may have files in
/var/lib/docker
.
Examine network configuration:
Check the network configuration using commands like
ifconfig
,ip a
, ordocker network ls
. Containers often have isolated network namespaces.
Check for limited access to system resources:
Containers are typically isolated and have limited access to system resources. You can check resource limitations using tools like
ulimit
orcat /proc/<PID>/cgroup
.
Automatic Enumeration Scripts
LinPEAS
LinPEAS is a part of the PEASS project (https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS)
LinEnum
LinuxExploitSuggestor2
enum4linux
Last updated