Enumerating Linux

Linux Privilege Escalation Checklist

Service Exploits (ex. MySQL User Defined Functions (UDFs) exploit)

Weak FIle Permissions (ex. Readable /etc/shadow - Crack hash)

Weak FIle Permissions (ex. Writable /etc/shadow - Replace hash with your own)

Weak FIle Permissions (ex. Writable /etc/passwd - Replace X with your hash)

Sudo - Shell Escape Sequences (sudo -l)

Sudo - Environment Variables (ex. env_keep)

Cron Jobs - File Permissions

Cron Jobs - PATH Environment Variable

Cron Jobs - Wildcards

SUID/SGID Executables - Known Exploits

SUID/SGID Executables - Shared Object Injection

SUID/SGID Executables - Environment Variables

SUID/SGID Executables - Abusing Shell Features

Passwords & Keys - History Files

Passwords & Keys - Config Files

Passwords & Keys - SSH Keys

Kernel Exploits

Manual Enumeration

Enumerating Users

Get username the shell is running as

whoami

Get more information about the username

id <username>

Getting information about the users on Linux

cat /etc/passwd

Enumerating the Hostname

Get hostname

hostname

Enumerating the Operating System Version and Architecture

Getting the version and architecture of the running operating system

cat /etc/issue

cat /etc/*-release

uname -a

Enumerating Running Processes and Services

Getting a list of running processes on the operating system and matching services

ps axu

Enumerating Networking Information

Listing the full TCP/IP configuration

ip a

Printing the routes

route

Listing all active network connections

ss -anp

Enumerating Firewall Status and Rules

List firewall rules

iptables

Firewall config files

/etc/iptables #search

Enumerating Scheduled Tasks

Listing all cron jobs

ls -lah /etc/cron*

Check scheduled tasks

cat /etc/crontab

cat /var/log/cron.log

Enumerating Installed Applications and Patch Levels

Listing all installed packages on a Debian Linux operating system

dpkg -l

Enumerating Readable/Writable Files and Directories

Listing all world writable directories on Linux

find / -writable -type d 2>/dev/null

Enumerating Unmounted Disks

Listing content of /etc/fstab and all mounted drives on Linux

cat /etc/fstab

mount

Listing all available drives

lsblk

Enumerating Device Drivers and Kernel Modules

Listing loaded drivers on Linux

lsmod

Listing additional information about a module on Linux

/sbin/modinfo $DRIVER

Enumerating Binaries That AutoElevate

List all files with SUID

find / -perm -u=s -type f 2>/dev/null

Automated Enumeration

Tools

unix-privesc-check

linpeas.sh

unix-privesc-check standard

./unix-privesc-check standard

linpeas.sh

./linpeas.sh

Open eClass – CVE-2024-26503: Unrestricted File Upload Leads to Remote Code Execution

During an assessment, I identified a severe security vulnerability within Open eClass, an e-learning platform extensively utilized across educational institutions, notably within Greece, where it is deployed by virtually all Greek Universities and educational entities. Open eClass, developed by GUnet (Greek Universities Network), is instrumental in delivering asynchronous e-learning services. The vulnerability, cataloged under CVE-2024-26503, involves an unrestricted file upload flaw that enables remote code execution (RCE), impacting versions 3.15 and earlier of the platform. This critical security lapse presents a significant risk, potentially allowing unauthorized access and control over the system, thereby compromising the integrity and security of the educational infrastructure. Affected Versions: ● version <= 3.15 CVSSv3.1 Base Score: 9.1 ( Critical ) CVSSv3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H Exploitation Guide The vulnerability can be exploited

How I Use Obsidian for Penetration Testing, CVE Hunting, and Studying

In the ever-evolving realm of cyber security, the tools and techniques at our disposal are as varied as the threats we aim to counteract. Among these tools, note-taking applications play a pivotal role, not just in organizing our thoughts but in streamlining our entire workflow. Today, I'm excited to share how Obsidian, a tool I embraced over two and a half years ago while preparing for my eJPT exam, has become an indispensable ally in my journey through penetration testing, CVE hunting, and continuous learning. If you're not yet familiar with Obsidian, it's a robust note-taking application that operates on a local collection of plain text Markdown files. What sets it apart is its capability to interlink ideas, forming an expansive web of knowledge that is both intuitive and comprehensive to explore. Through considerable customization, I've developed what I consider to be an ideal method for consolidating notes, insights, and projects into a unified workspace. Here'

CTF: Portfolio Walkthrough

Scenario A passionate web developer recently launched his personal portfolio website, proudly displaying his projects and sharing his thoughts through a vibrant blog. His focus on design and functionality has left glaring security holes. As his blog gains popularity, you, a skilled hacker, spot the perfect target. Your mission is clear: exploit the vulnerabilities, compromise his site, and expose his negligence. Every weakness is an opportunity, every oversight a path to control. In this CTF challenge, you are the hacker. Uncover the flaws, break through the defenses, and leave your mark on the developer’s digital pride. Welcome to "Portfolio CTF" The game is on. Good luck! You can download the OVA for the Portfolio CTF from this link SPOILER ALERT: Do not read further if you intend to solve the CTF challenge on your own. The write-up follows below. Introduction I created this Capture The Flag (CTF) machine with dual objectives: to provide a comprehensive training ground fo

Less Secure

Search This Blog