Enumerating Linux
System Information
User Context
When gaining initial access to a target, one of the first things we should identify is the user context.
joe@debian-privesc:~$ id
uid=1000(joe) gid=1000(joe) groups=1000(joe),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),112(bluetooth),116(lpadmin),117(scanner)Enumerate Local Users
joe@debian-privesc:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
...
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
...
dnsmasq:x:106:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
usbmux:x:107:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
rtkit:x:108:114:RealtimeKit,,,:/proc:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
...
Debian-gdm:x:117:124:Gnome Display Manager:/var/lib/gdm3:/bin/false
joe:x:1000:1000:joe,,,:/home/joe:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
eve:x:1001:1001:,,,:/home/eve:/bin/bashThe passwd file
The passwd file lists several user accounts, including accounts used by various services on the target machine such as www-data and sshd. This indicates that a web server and an SSH server are likely installed on the system.
We can now zoom in on our current user's data:
Login Name: "joe" - Indicates the username used for login.
Encrypted Password: "x" - This field typically contains the hashed version of the user's password. In this case, the value x means that the entire password hash is contained in the /etc/shadow file (more on that shortly).
UID: "1000" - Aside from the root user that has always a UID of 0, Linux starts counting regular user IDs from 1000. This value is also called real user ID.
GID: "1000" - Represents the user's specific Group ID.
Comment: "joe,,," - This field generally contains a description about the user, often simply repeating username information.
Home Folder: "/home/joe" - Describes the user's home directory prompted upon login.
Login Shell: "/bin/bash" - Indicates the default interactive shell, if one exists.
Hostname
A machine's hostname can often provide clues about its functional roles. More often than not, the hostnames will include identifiable abbreviations such as web for a web server, db for a database server, dc for a domain controller, etc.
Kernel Version
At some point during the privilege escalation process, we may need to rely on kernel exploits that specifically exploit vulnerabilities in the core of a target's operating system. These types of exploits are built for a very specific type of target, specified by a particular operating system and version combination. Since attacking a target with a mismatched kernel exploit can lead to system instability or even a crash, we must gather precise information about the target.
The issue and os-release files located in the /etc directory contain the operating system version (Debian 10) and release-specific information, including the distribution codename (buster). The command uname -a outputs the kernel version (4.19.0) and architecture (x86_64).
Running Processes and Services
Network Interfaces
Depending on the version of Linux, we can list the TCP/IP configuration of every network adapter with either ifconfig or ip. While the former command displays interface statistics, the latter provides a compact version of the same information. Both commands accept the a flag to display all information available.
Routes
We can display network routing tables with either route or routel, depending on the Linux distribution and version. Both commands provide similar information.
Active Connections and Listening Ports
Finally, we can display active network connections and listening ports using either netstat or ss, both of which accept the same arguments.
For example, we can list all connections with -a, avoid hostname resolution (which may stall the command execution) with -n, and list the process name the connection belongs to with -p. We can combine the arguments and simply run ss -anp:
Firewall Information
In general, we're primarily interested in a firewall's state, profile, and rules during the remote exploitation phase of an assessment. However, this information can also be useful during privilege escalation. For example, if a network service is not remotely accessible because it is blocked by the firewall, it is generally accessible locally via the loopback interface. If we can interact with these services locally, we may be able to exploit them to escalate our privileges on the local system.
On Linux-based systems, we must have root privileges to list firewall rules with iptables. However, depending on how the firewall is configured, we may be able to glean information about the rules as a standard user.
Scheduled Tasks
Systems acting as servers often periodically execute various automated, scheduled tasks. When these systems are misconfigured, or the user-created files are left with insecure permissions, we can modify these files that will be executed by the scheduling system at a high privilege level.
The Linux-based job scheduler is known as cron. Scheduled tasks are listed under the /etc/cron.* directories, where * represents the frequency at which the task will run. For example, tasks that will be run daily can be found under /etc/cron.daily. Each script is listed in its own subdirectory.
It is worth noting that system administrators often add their own scheduled tasks in the /etc/crontab file. These tasks should be inspected carefully for insecure file permissions, since most jobs in this particular file will run as root.
In the above output, only the commented instructions are present, meaning no cron job has been configured for the user joe. However, if we try to run the same command with the sudo prefix, we discover that a backup script is scheduled to run every minute.
Installed Applications
Make sure to note the version of each application. At some point we may need to leverage an exploit to escalate our local privileges.
Linux-based systems use a variety of package managers. For example, Debian-based Linux distributions, like the one in our lab, use dpkg, while Red Hat-based systems use rpm.
List Installed Applications
Check File Permissions
List Every Writable Directory
Unmounted Drives
On Linux-based systems, we can use mount to list all mounted filesystems. In addition, the /etc/fstab file lists all drives that will be mounted at boot time.
Unmounted Disks
Device Drivers & Kernel Modules
We can enumerate the loaded kernel modules using lsmod without any additional arguments
Once we have a list of loaded modules and identify ones we wish to investigate further, we can use modinfo to find more information.
Shortcuts and Low Hanging Fruit
setuid & setgid
If these two rights are set, either an uppercase or lowercase "s" will appear in the permissions. This allows the current user to execute the file with the rights of the owner (setuid) or the owner's group (setgid).
If SUID permissions are set, binaries will run with the permissions of the file owner. This means that if a binary is owned by root and has the SUID bit set, any local user will be able to execute that binary with root privileges.
Last updated