Hey everybody welcomes the next video and this video I quickly want to go and talk about a tool that
I think is pretty useful.
Now this tool is called Linux probe checker.
If you've never heard of it before essentially what it is is it.
It kind of does all the pre reconnaissance for you like on a fresh system when you're not quite sure
where to start.
So it's a very very good script to just run right off the bat.
It's entirely self-contained in Python through the standalone modules nothing special has to be installed
other than Python.
So we're going to go ahead and go ahead and grab this.
So if we do w get CPS does Curtis download Linux print check or add up why now that perfect we're gonna
do is run go ahead and run it and we'll dump the file to output.
And that just will take just a second to run and then I ran this on the limited user admin but we're
gonna go ahead and open it up with leaf pad just so we can have a little bit better of an idea of what's
going on.
Something to make this just a little bit bigger
so to leave pad
so Linux project provides quite a bit of information.
So the first thing we see here are the kernel version the hostname the operating system the interfaces
anything with nets that then followed by some routing and then some mount information
and then we have our f f s tab entries and then all of our Akron's
too far on their.
So what we can see is here is we actually have a readable Cron.
So it actually goes and checks the user to see it would write about crimes it has checks the logged
in user activity the environment variables then it go ahead and grab all the users.
So you have an idea who you're on the box your current permissions and then it's looking for everything
that's world right.
All that's directories owned by root so you can see here we have our var w w w slash h t now which was
what we expected with our Apache instance.
So that would have been another way to find it.
Now we have world readable files so this is every file that is available by every user we can see here
we have one local been secret data age which is owned by root and ran by a service.
If you guys remember from that video so you could theoretically modify that.
Do you see how stuff like this starts to add up.
So it checks to see if the home root folder is accessible.
And so you can see that there's quite a bit of information here and it just goes to every sub directory
we'll go out and get through this.
So what we see here is the SEIU I.D. and SGI.
So the pseudo bed.
So we see here male PPD cron service Faunce all this is pretty standard stuff.
And then we see down here we've got our backup which is what we had already looked at.
We've got pseudo passed WD P.K. exact as you well.
All the good stuff and then we have logs containing passwords which there isn't any.
So and then we have config files that are containing passwords.
Now this isn't always going to work but it's always good to just briefly kind of go over it just to
kind of make sure that you might see something relevant.
A lot of it's going to be standard like default passwords and things.
So shadow filed cannot access the shadow file in any way shape or form enumerating applications installed
packages.
There really isn't that many current processes.
So here we have all of our processes and then we have our Apache version and modules and then it goes
ahead and pulls the Apache config file for us actually which is quite nice.
So as you can see this does quite a bit and you can see here that it looks like this the pseudo version
that we're running might be vulnerable to something.
So it actually gives us the exploit DB search for one point eight point to seven and then this identifies
any process and package running as root or any other user that's considered super user.
So you can see how this kind of just grabs everything for you and you can see here that we've got all
these tools at our disposal for building stuff up if we need to.
It even gives us some shell escapes based on what we have.
So we can see we have OK find V.I. Perl we have all of that here.
So it's going to handy just give us the shell escapes that we might need.
So you can see this one obviously doesn't work but there's another way.
Quick google search will find out some answers for you.
And based on your kernel version it goes and gives you a few ideas of some exploits for local privilege
escalation that you can work with.
So it is always good I always try to dump this on the machine that I'm compromised and I just run it
just for shits and giggles.
I want to see what.
I just want to see what it finds.
There's a lot of times where I'm already doing this stuff manually while it's rolling through but it
is good to have something that kind of puts it all together for you and this and the script kind of
does that pretty well.
What I would recommend doing is keeping a copy of this locally and building upon it as you need because
every environment's going to be a little different and some cases you might want to look for specific
things in a specific order and maybe format it a different way.
So the point is is you want to be able to be comfortable scripting stuff on your own and doing a lot
of this recon if you're going to do it every day all the time.
You're going to want to script all this.
I've got a rule.
I got to do something in the same way three or four times I'm going to go ahead and scripted.
So I recommend doing that script whatever you can if you even if it's something just as simple as you
found on authenticated Jenkins servers or Tomcat Apache stuff or or a particular vulnerability that
you recently found just write a tool that kind of scans the whole network for it.
You'll be thanking yourself that you've done that and make sure to write it.
So in case you're on a bigger network you can hit it in a reasonable amount of time.
But doing that just gives you it builds a toolset and with that tool set you can just quickly launch
through and just run everything all at once and just filter through the output after the fact of stuff
that you know is already ready to go.
And a lot of times you can get this stuff to the corporate security team or the production security
team and have them run it.
So in case anything does pop up they already know right away and they can get on fixing it.
So get comfortable writing your own tools get familiar with this tool it's very powerful and but also
go through the python code and make sure you understand exactly what it's doing.