Exposed Confidential Information
Pentests are often time-constrained engagements and we should initially focus on quick-wins and low hanging fruit.
History Files
History files often hold clear-text user activity that might include sensitive information such as passwords or other authentication material.
Environment Variables
joe@debian-privesc:~$ env
...
XDG_SESSION_CLASS=user
TERM=xterm-256color
SCRIPT_CREDENTIALS=lab
USER=joe
LC_TERMINAL_VERSION=3.4.16
SHLVL=1
XDG_SESSION_ID=35
LC_CTYPE=UTF-8
XDG_RUNTIME_DIR=/run/user/1000
SSH_CLIENT=192.168.118.2 59808 22
PATH=/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1000/bus
MAIL=/var/mail/joe
SSH_TTY=/dev/pts/1
OLDPWD=/home/joe/.cache
_=/usr/bin/env.bashrc
The .bashrc script is executed when a new terminal window is opened from an existing login session or when a new shell instance is started from an existing login session. From inside this script, additional environment variables can be specified to be automatically set whenever a new user's shell is spawned.
Sometimes system administrators store credentials inside environment variables as a way to interact with custom scripts that require authentication.
BruteForcing passwords
With our knowledge of script credentials, we could try building a custom dictionary derived from the known password to attempt brute forcing eve's account.
We can do this by using the crunch command line tool to generate a custom wordlist. We'll set the minimum and maximum length to 6 characters, specify the pattern using the -t parameter, then hard-code the first three characters to Lab followed by three numeric digits.
System Daemons
System Daemons are Linux services that are spawned at boot time to perform specific operations without any need for user interaction. Linux servers are often configured to host numerous daemons like SSH, web servers, and databases, to mention a few.
System administrators often rely on custom daemons to execute ad-hoc tasks and they sometimes neglect security best practices.
Running Processes
We can enumerate all the running processes with the ps command and since it only takes a single snapshot of the active processes, we can refresh it using the watch command. In the following example, we will run the ps command every second via the watch utility and grep the results on any occurrence of the word "pass".
Capturing Network Traffic
tcpdump is the de facto command line standard for packet capture, and it requires administrative access since it operates on raw sockets. However, it's not uncommon to find IT personnel accounts have been given exclusive access to this tool for troubleshooting purposes
Last updated