// Introduction
When conducting a privilege escalation assessment on Linux, the sequence of enumeration can drastically influence your success rate. Each layer of the system offers unique insights, and knowing where to start is key.
// Enumeration Order
A systematic approach to enumeration can be broken down into the following order:
1. User and Group Information Start by gathering user and group data to identify any unusual configurations or privileges.
cat /etc/passwd
cat /etc/group
id - cat /etc/passwd: Lists all user accounts. Look for users with UID 0 or any unexpected users. - cat /etc/group: Displays group memberships. Check for users in sudo, adm, or other privileged groups.
2. Sudo Rights Identifying users with sudo access can be critical.
sudo -l - This command lists allowed (and forbidden) commands for the invoking user. Pay special attention to commands allowing execution without a password.
3. Kernel Version and Exploits Knowing the kernel version helps identify potential exploits.
uname -r - Cross-reference the kernel version against public exploit databases (e.g., Exploit-DB).
4. File Permissions Examining file permissions can uncover writable scripts or binaries.
find / -writable -type f 2>/dev/null - This command finds all writable files. Investigate any suspicious files, especially in system directories like /usr/bin/ or /etc/.
5. Setuid and Setgid Binaries Search for binaries with the setuid or setgid bit set, as these can be exploited.
find / -perm -4000 -o -perm -2000 2>/dev/null - Check the output for any binaries that could be leveraged. Always verify the binaries with strings or ldd to analyze dependencies.
6. Cron Jobs and Scheduled Tasks Check for scheduled tasks that may run as root or have misconfigured permissions.
ls -la /etc/cron*
crontab -l - Look for scripts that execute with elevated privileges or are owned by users with high privileges.
7. Network Services Identify running services that could be exploited.
netstat -tulnp
ps aux | grep LISTEN - Look for services running as root or with unusual configurations.
// Realistic Scenario
Imagine you perform this enumeration on a test server and discover:
- A user account with a UID of 0 that shouldn't exist.
- A misconfigured sudo entry allowing execution of a script without a password.
- A setuid binary that runs a legacy application with known vulnerabilities.
From here, you can pivot to exploiting these weaknesses. For instance, if you have access to a vulnerable setuid binary, crafting a payload may grant you elevated privileges.
// Common Mistakes to Avoid
- Skipping user enumeration. Always begin with user and group information.
- Ignoring cron jobs and services. They can be overlooked yet provide significant escalations.
- Failing to validate binaries and scripts for their content or dependencies.
// Defensive Implications
Understanding this enumeration order is also beneficial from a defensive perspective. System administrators can tighten security by:
- Regularly auditing user accounts and permissions.
- Keeping kernel and software versions up-to-date to avoid known exploits.
- Restricting the use of setuid/setgid binaries wherever possible.
// Quick Checklist
- [ ] Gather user and group information.
- [ ] Check sudo rights and privileges.
- [ ] Verify kernel version and check for known vulnerabilities.
- [ ] List writable files and examine their purpose.
- [ ] Identify setuid/setgid binaries.
- [ ] Review cron jobs and scheduled tasks.
- [ ] Analyze network services and their configurations.
// Conclusion
A well-structured enumeration process increases your chances of uncovering privileged escalation vectors. Each step reveals critical system details that can lead to successful assessments. Always use this approach in disposable environments that you control, ensuring ethical and professional standards are upheld. The DaemonCore Academy curriculum offers free resources to further enhance your skills in this area.