mirror of
https://github.com/swisskyrepo/PayloadsAllTheThings.git
synced 2024-12-20 03:16:10 +00:00
87 lines
3.1 KiB
Markdown
87 lines
3.1 KiB
Markdown
# Linux - Privilege Escalation
|
||
|
||
## Tools
|
||
|
||
- [LinEnum - Scripted Local Linux Enumeration & Privilege Escalation Checks](https://github.com/rebootuser/LinEnum)
|
||
```powershell
|
||
./LinEnum.sh -s -k keyword -r report -e /tmp/ -t
|
||
```
|
||
- [BeRoot - Privilege Escalation Project - Windows / Linux / Mac](https://github.com/AlessandroZ/BeRoot)
|
||
- [linuxprivchecker.py - a Linux Privilege Escalation Check Script](https://gist.github.com/sh1n0b1/e2e1a5f63fbec3706123)
|
||
|
||
## Checklists
|
||
|
||
* Kernel and distribution release details
|
||
* System Information:
|
||
* Hostname
|
||
* Networking details:
|
||
* Current IP
|
||
* Default route details
|
||
* DNS server information
|
||
* User Information:
|
||
* Current user details
|
||
* Last logged on users
|
||
* Shows users logged onto the host
|
||
* List all users including uid/gid information
|
||
* List root accounts
|
||
* Extracts password policies and hash storage method information
|
||
* Checks umask value
|
||
* Checks if password hashes are stored in /etc/passwd
|
||
* Extract full details for ‘default’ uid’s such as 0, 1000, 1001 etc
|
||
* Attempt to read restricted files i.e. /etc/shadow
|
||
* List current users history files (i.e .bash_history, .nano_history etc.)
|
||
* Basic SSH checks
|
||
* Privileged access:
|
||
* Which users have recently used sudo
|
||
* Determine if /etc/sudoers is accessible
|
||
* Determine if the current user has Sudo access without a password
|
||
* Are known ‘good’ breakout binaries available via Sudo (i.e. nmap, vim etc.)
|
||
* Is root’s home directory accessible
|
||
* List permissions for /home/
|
||
* Environmental:
|
||
* Display current $PATH
|
||
* Displays env information
|
||
* Jobs/Tasks:
|
||
* List all cron jobs
|
||
* Locate all world-writable cron jobs
|
||
* Locate cron jobs owned by other users of the system
|
||
* List the active and inactive systemd timers
|
||
* Services:
|
||
* List network connections (TCP & UDP)
|
||
* List running processes
|
||
* Lookup and list process binaries and associated permissions
|
||
* List inetd.conf/xined.conf contents and associated binary file permissions
|
||
* List init.d binary permissions
|
||
* Version Information (of the following):
|
||
* Sudo
|
||
* MYSQL
|
||
* Postgres
|
||
* Apache
|
||
* Checks user config
|
||
* Shows enabled modules
|
||
* Checks for htpasswd files
|
||
* View www directories
|
||
* Default/Weak Credentials:
|
||
* Checks for default/weak Postgres accounts
|
||
* Checks for default/weak MYSQL accounts
|
||
* Searches:
|
||
* Locate all SUID/GUID files
|
||
* Locate all world-writable SUID/GUID files
|
||
* Locate all SUID/GUID files owned by root
|
||
* Locate ‘interesting’ SUID/GUID files (i.e. nmap, vim etc)
|
||
* Locate files with POSIX capabilities
|
||
* List all world-writable files
|
||
* Find/list all accessible *.plan files and display contents
|
||
* Find/list all accessible *.rhosts files and display contents
|
||
* Show NFS server details
|
||
* Locate *.conf and *.log files containing keyword supplied at script runtime
|
||
* List all *.conf files located in /etc
|
||
* Locate mail
|
||
* Platform/software specific tests:
|
||
* Checks to determine if we're in a Docker container
|
||
* Checks to see if the host has Docker installed
|
||
* Checks to determine if we're in an LXC container
|
||
|
||
## References
|
||
|
||
- []() |