WDavid404
commented
11 months ago Linux enumeration
System
user@TryHackMe$ ls /etc/*-release
/etc/centos-release /etc/os-release /etc/redhat-release /etc/system-release
$ cat /etc/os-release
NAME="CentOS Linux"
VERSION="7 (Core)"
[...]
hostname
cat /etc/passwd
cat /etc/group
cat /etc/shadow
//check mail directories
ls -lh /var/mail/
//To find the installed applications you can consider listing the files in /usr/bin/ and /sbin/:
ls -lh /usr/bin/
ls -lh /sbin/
//On an RPM-based Linux system, you can get a list of all installed packages using rpm -qa.
//The -qa indicates that we want to query all packages.
rpm -qa
//On a Debian-based Linux system (Ubuntu), you can get the list of installed packages using dpkg -l
dpkg -l
who
//shows who is logged in and what they are doing.
w
user@TryHackMe$ w
07:18:43 up 18:05, 3 users, load average: 0.00, 0.01, 0.05
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
root tty1 Wed13 17:52m 0.00s 0.00s less -s
jane pts/0 10.20.30.105 07:17 3.00s 0.01s 0.00s w
peter pts/1 10.20.30.113 07:13 5:23 0.00s 0.00s vi notes.txt
//To print the real and effective user and group IDS
id
// Displays a listing of the last logged-in users; moreover, we can see who logged out and how much they stayed connected.
user@TryHackMe$ last
jane pts/0 10.20.30.105 Thu May 19 07:17 still logged in
peter pts/1 10.20.30.113 Thu May 19 07:13 still logged in
michael pts/0 10.20.30.1 Thu May 19 05:12 - 05:17 (00:04)
randa pts/1 10.20.30.107 Wed May 18 14:18 - 07:08 (16:49)
root tty1 Wed May 18 13:24 still logged in
[...]
//To list the allowed command for the invoking user on the current system.
sudo -l
Network
//show IP info
ip address show (or 'ip a s', 'ifconfig -a')
//The DNS servers can be found in the /etc/resolv.conf
cat /etc/resolv.conf
//netstat -plt will return Programs Listening on TCP sockets.
netstat -plt
//netstat -atupn will show All TCP and UDP listening and established connections and the program names with addresses and ports in numeric format.
netstat -atupn
// To display only Internet and network connections
// lsof stands for List Open Files
sudo lsof -i
//lsof -i :25, to limit the output to those related to port 25
lsof -i :25
Running Services
ps -ef or ps -el
ps aux
ps axjf : to print a process tree.
post-exploitation enumeration