跳转至

信息收集

System Information

OS info

Let's start gaining some knowledge of the OS running

Bash
(cat /proc/version || uname -a ) 2>/dev/null
lsb_release -a 2>/dev/null # old, not by default on many systems
cat /etc/os-release 2>/dev/null # universal on modern systems

Path

If you have write permissions on any folder inside the PATH variable you may be able to hijack some libraries or binaries:

Bash
echo $PATH

Env info

Interesting information, passwords or API keys in the environment variables?

Bash
(env || set) 2>/dev/null

CPU

Bash
cat /proc/cpuinfo
lscpu #CPU info

hostname

Text Only
hostname

date

Bash
date 2>/dev/null #Date

system stats

Bash
(df -h || lsblk) #System stats

printers info

Bash
lpstat -a 2>/dev/null #Printers info

Enumerate possible defenses

AppArmor

Bash
if [ `which aa-status 2>/dev/null` ]; then
    aa-status
  elif [ `which apparmor_status 2>/dev/null` ]; then
    apparmor_status
  elif [ `ls -d /etc/apparmor* 2>/dev/null` ]; then
    ls -d /etc/apparmor*
  else
    echo "Not found AppArmor"
fi

Grsecurity

Bash
((uname -r | grep "\-grsec" >/dev/null 2>&1 || grep "grsecurity" /etc/sysctl.conf >/dev/null 2>&1) && echo "Yes" || echo "Not found grsecurity")

PaX

Bash
(which paxctl-ng paxctl >/dev/null 2>&1 && echo "Yes" || echo "Not found PaX")

Execshield

Bash
(grep "exec-shield" /etc/sysctl.conf || echo "Not found Execshield")

SElinux

Bash
 (sestatus 2>/dev/null || echo "Not found sestatus")

ASLR

Bash
cat /proc/sys/kernel/randomize_va_space 2>/dev/null
#If 0, not enabled

Drives

Check what is mounted and unmounted, where and why. If anything is unmounted you could try to mount it and check for private info

Bash
ls /dev 2>/dev/null | grep -i "sd"
cat /etc/fstab 2>/dev/null | grep -v "^#" | grep -Pv "\W*\#" 2>/dev/null
#Check if credentials in fstab
grep -E "(user|username|login|pass|password|pw|credentials)[=:]" /etc/fstab /etc/mtab 2>/dev/null

Users

Generic Enumeration

Check who you are, which privileges do you have, which users are in the systems, which ones can login and which ones have root privileges:

Bash
#Info about me
id || (whoami && groups) 2>/dev/null
#List all users
cat /etc/passwd | cut -d: -f1
#列出所有用户hash(with shell),like root
cat /etc/shadow
#查看是否存在空口令用户
awk -F: 'length($2)==0 {print $1}' /etc/shadow
#查看远程登录的账号
awk '/\$1|\$6/{print $1}' /etc/shadow
#查看具有sudo权限的用户
cat /etc/sudoers | grep -v "^#\|^$" | grep "ALL=(ALL)"
#列出目前用户可以使用sudo执行的命令
sudo -l
#List users with console
cat /etc/passwd | grep "sh$"
#List superusers
awk -F: '($3 == "0") {print}' /etc/passwd
grep :0 /etc/passwd
#Currently logged users
w
#Login history
last | tail
#Last log of each user
lastlog

#List all users and their groups
for i in $(cut -d":" -f1 /etc/passwd 2>/dev/null);do id $i;done 2>/dev/null | sort
#Current user PGP keys
gpg --list-keys 2>/dev/null

Big UID

Some Linux versions were affected by a bug that allows users with UID > INT_MAX to escalate privileges. More info: here, here and here. Exploit it using: systemd-run -t /bin/bash

Groups

Check if you are a member of some group that could grant you root privileges

Bash
cat /etc/group # list all groups

Clipboard

Check if anything interesting is located inside the clipboard (if possible)

Bash
if [ `which xclip 2>/dev/null` ]; then
    echo "Clipboard: "`xclip -o -selection clipboard 2>/dev/null`
    echo "Highlighted text: "`xclip -o 2>/dev/null`
  elif [ `which xsel 2>/dev/null` ]; then
    echo "Clipboard: "`xsel -ob 2>/dev/null`
    echo "Highlighted text: "`xsel -o 2>/dev/null`
  else echo "Not found xsel and xclip"
  fi

Password Policy

Bash
grep "^PASS_MAX_DAYS\|^PASS_MIN_DAYS\|^PASS_WARN_AGE\|^ENCRYPT_METHOD" /etc/login.defs

进程信息

  • 查看进程信息 ps aux
  • 资源占有情况 top -c
  • 查看进程关联文件 lsof -c $PID
  • 完整命令行信息 /proc/$PID/cmdline
  • 进程的命令名 /proc/$PID/comm
  • 进程当前工作目录的符号链接 /proc/$PID/cwd
  • 运行程序的符号链接 /proc/$PID/exe
  • 进程的环境变量 /proc/$PID/environ
  • 进程打开文件的情况 /proc/$PID/fd

服务信息

  • 由inetd管理的服务列表 cat /etc/inetd.conf
  • 由xinetd管理的服务列表 cat /etc/xinetd.conf
  • nfs服务器的配置 cat /etc/exports
  • 邮件信息 /var/log/mailog
  • ssh配置 sshd_config

计划任务

  • 显示指定用户的计划作业（root） crontab -l -u %user%
  • 计划任务
    • /var/spool/cron/*
    • /var/spool/anacron/*
    • /etc/crontab
    • /etc/anacrontab
    • /etc/cron.*
    • /etc/anacrontab
  • 开机启动项
    • /etc/rc.d/init.d/

Network

It's always interesting to enumerate the network and figure out the position of the machine.

Generic enumeration

Bash
#Hostname, hosts and DNS
cat /etc/hostname /etc/hosts /etc/resolv.conf
dnsdomainname

#Content of /etc/inetd.conf & /etc/xinetd.conf
cat /etc/inetd.conf /etc/xinetd.conf

#Interfaces
cat /etc/networks
(ifconfig || ip a)

#Neighbours
(arp -e || arp -a)
(route || ip n)

#Iptables rules
(timeout 1 iptables -L 2>/dev/null; cat /etc/iptables/* | grep -v "^#" | grep -Pv "\W*\#" 2>/dev/null)

#Files used by network services
lsof -i

Open ports

Always check network services running on the machine that you weren't able to interact with before accessing it:

Bash
(netstat -punta || ss --ntpu)
(netstat -punta || ss --ntpu) | grep "127.0"
netstat -anltp | grep $PID

Sniffing

Check if you can sniff traffic. If you can, you could be able to grab some credentials.

Text Only
timeout 1 tcpdump

端口服务映射

Bash
cat /etc/services

已安装程序

Useful software

Enumerate useful binaries

Bash
which nmap aws nc ncat netcat nc.traditional wget curl ping gcc g++ make gdb base64 socat python python2 python3 python2.7 python2.6 python3.6 python3.7 perl php ruby xterm doas sudo fetch docker lxc ctr runc rkt kubectl 2>/dev/null
  • rpm -qa --last Redhat
  • yum list | grep installed CentOS
  • ls -l /etc/yum.repos.d/
  • dpkg -l Debian
  • cat /etc/apt/sources.list Debian APT
  • pkg_info xBSD
  • pkginfo Solaris
  • pacman -Q Arch Linux
  • emerge Gentoo

Interesting Files

Profiles files

The file /etc/profile and the files under /etc/profile.d/ are scripts that are executed when a user runs a new shell. Therefore, if you can write or modify any of them you can escalate privileges.

Bash
ls -l /etc/profile /etc/profile.d/

If any weird profile script is found you should check it for sensitive details.

Passwd/Shadow Files

Depending on the OS the /etc/passwd and /etc/shadow files may be using a different name or there may be a backup. Therefore it's recommended find all of them and check if you can read them to see if there are hashes inside the files:

Bash
#Passwd equivalent files
cat /etc/passwd /etc/pwd.db /etc/master.passwd /etc/group 2>/dev/null
#Shadow equivalent files
cat /etc/shadow /etc/shadow- /etc/shadow~ /etc/gshadow /etc/gshadow- /etc/master.passwd /etc/spwd.db /etc/security/opasswd 2>/dev/null

In some occasions you can find password hashes inside the /etc/passwd (or equivalent) file

Bash
grep -v '^[^:]*:[x\*]' /etc/passwd /etc/pwd.db /etc/master.passwd /etc/group 2>/dev/null

Check Folders

The following folders may contain backups or interesting information: /tmp, /var/tmp, /var/backups, /var/mail, /var/spool/mail, /etc/exports, /root (Probably you won't be able to read the last one but try)

Bash
ls -a /tmp /var/tmp /var/backups /var/mail/ /var/spool/mail/ /root

Weird Location/Owned files

Bash
#root owned files in /home folders
find /home -user root 2>/dev/null
#Files owned by other users in folders owned by me
for d in `find /var /etc /home /root /tmp /usr /opt /boot /sys -type d -user $(whoami) 2>/dev/null`; do find $d ! -user `whoami` -exec ls -l {} \; 2>/dev/null; done
#Files owned by root, readable by me but not world readable
find / -type f -user root ! -perm -o=r 2>/dev/null
#Files owned by me or world writable
find / '(' -type f -or -type d ')' '(' '(' -user $USER ')' -or '(' -perm -o=w ')' ')' ! -path "/proc/*" ! -path "/sys/*" ! -path "$HOME/*" 2>/dev/null
#Writable files by each group I belong to
for g in `groups`;
      do printf "  Group $g:\n";
      find / '(' -type f -or -type d ')' -group $g -perm -g=w ! -path "/proc/*" ! -path "/sys/*" ! -path "$HOME/*" 2>/dev/null
      done
done

Modified files in last mins

Bash
find / -type f -mmin -5 ! -path "/proc/*" ! -path "/sys/*" ! -path "/run/*" ! -path "/dev/*" ! -path "/var/lib/*" 2>/dev/null

Sqlite DB files

Bash
find / -name '*.db' -o -name '*.sqlite' -o -name '*.sqlite3' 2>/dev/null

some interesting files

Bash
find / -type f \( -name "*_history" -o -name ".sudo_as_admin_successful" -o -name ".profile" -o -name "*bashrc" -o -name "httpd.conf" -o -name "*.plan" -o -name ".htpasswd" -o -name ".git-credentials" -o -name "*.rhosts" -o -name "hosts.equiv" -o -name "Dockerfile" -o -name "docker-compose.yml" \) 2>/dev/null

Hidden files

Bash
find / -type f -iname ".*" -ls 2>/dev/null

Script/Binaries in PATH

Bash
for d in `echo $PATH | tr ":" "\n"`; do find $d -name "*.sh" 2>/dev/null; done
for d in `echo $PATH | tr ":" "\n"`; do find $d -type f -executable 2>/dev/null; done

Web files

Bash
ls -alhR /var/www/ 2>/dev/null
ls -alhR /srv/www/htdocs/ 2>/dev/null
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/ 2>/dev/null

Backups

Bash
find /var /etc /bin /sbin /home /usr/local/bin /usr/local/sbin /usr/bin /usr/games /usr/sbin /root /tmp -type f \( -name "*backup*" -o -name "*\.bak" -o -name "*\.bck" -o -name "*\.bk" \) 2>/dev/null

Known files containing passwords

Read the code of linPEAS, it searches for several possible files that could contain passwords. Another interesting tool that you can use to do so is: LaZagne which is an open source application used to retrieve lots of passwords stored on a local computer for Windows, Linux & Mac.

Logs

If you can read logs, you may be able to find interesting/confidential information inside them. The more strange the log is, the more interesting it will be (probably). Also, some "bad" configured (backdoored?) audit logs may allow you to record passwords inside audit logs as explained in this post: https://www.redsiege.com/blog/2019/05/logging-passwords-on-linux/.

Bash
aureport --tty | grep -E "su |sudo " | sed -E "s,su|sudo,${C}[1;31m&${C}[0m,g"
grep -RE 'comm="su"|comm="sudo"' /var/log* 2>/dev/null

In order to read logs the group adm will be really helpful.

Shell files

Bash
~/.bash_profile # if it exists, read it once when you log in to the shell
~/.bash_login # if it exists, read it once if .bash_profile doesn't exist
~/.profile # if it exists, read once if the two above don't exist
/etc/profile # only read if none of the above exists
~/.bashrc # if it exists, read it every time you start a new shell
~/.bash_logout # if it exists, read when the login shell exits
~/.zlogin #zsh shell
~/.zshrc #zsh shell

公私钥信息

  • ~/.ssh
  • /etc/ssh

日志

  • /var/log/boot.log
  • /var/log/cron
  • /var/log/faillog
  • /var/log/lastlog
  • /var/log/messages
  • /var/log/secure
  • /var/log/syslog
  • /var/log/syslog
  • /var/log/wtmp
  • /var/log/wtmp
  • /var/run/utmp

虚拟环境检测

  • lsmod | grep -i "vboxsf\|vboxguest"
  • lsmod | grep -i "vmw_baloon\|vmxnet"
  • lsmod | grep -i "xen-vbd\|xen-vnif"
  • lsmod | grep -i "virtio_pci\|virtio_net"
  • lsmod | grep -i "hv_vmbus\|hv_blkvsc\|hv_netvsc\|hv_utils\|hv_storvsc"

容器内信息收集

  • capsh --print
  • cat /proc/1/cgroup
  • env | grep KUBE
  • ls -l .dockerenv
  • ls -l /run/secrets/Kubernetes.io/
  • mount
  • ps aux