Automated Enumeration
As we learned in the previous section, Linux systems contain
a wealth of information that can be used for further attacks.
However, collecting this detailed information manually
can be rather time-consuming.
Fortunately, we can use various scripts to automate this process.
To get an initial baseline of the target system,
we can use unix-privesc-check on UNIX derivatives such as Linux.
This Bash script is pre-installed on our local Kali machine,
and it performs a number of checks to find any system misconfigurations
that can be abused for local privilege escalation.
We can review the tool’s details by running the script without any arguments.
As shown, the script supports “standard” and “detailed” mode.
Based on the provided information,
the standard mode appears to perform a speed-optimized process and should provide
a reduced number of false positives.
Therefore, in the following example we are going to transfer
the script to the target system.
And use the script’s standard mode to redirect the entire output
to a file called output.txt.
The script performs numerous checks for permissions on common files.
For example, the output reveals a configuration file
that is writable by non-root users.
Anyone on the system can edit /etc/passwd.
This is quite significant as it allows attackers to easily elevate
their privileges or create user accounts on the target.
There are many other tools worth mentioning that are specifically tailored
for Linux privilege escalation information gathering,
including LinEnum and LinPeas,
which have been actively developed and enhanced over recent years.
Although these tools perform many automated checks,
we should bear in mind that every system is different,
and unique one-off system changes will often be missed by these types of tools.
For this reason, it’s important to check for unique configurations
that can only be caught by manual inspection,
as illustrated in the previous section.
In the next Learning Unit we are going to learn how to act on the information
we obtained through enumeration in order to elevate our privileges.