# Know your Enemy

hostname&#x20;

uname -a&#x20;

cat /proc/version

cat /etc/issue

lscpu&#x20;

for arch cpu core threads&#x20;

what kernel what arch forexploitation&#x20;

User Enum&#x20;

whoami

id

sudo -l

history&#x20;

cat /etc/passwd | grep sh

cat /etc/shadow

cat /etc/group

sudo su -

Network Info

ifconfig&#x20;

ip a

route&#x20;

ip route

arp -a

ip neigh

netstat -ona

look for loopback ports and existing open connections

netstat -antup

Look for password key word in files through out the system&#x20;

grep --color=auto -rnw '/' -ie "PASSWORD" --color=always 2>/dev/null

File Perms and Stored Passwords&#x20;

look for excessive perms ; can we modify something access something read something write somethings replace something&#x20;

ls -la  /etc/passwd /etc/shadow

normally read perms to passwd files are there and no access to shadow file&#x20;

both have potential to escalate  privs&#x20;

if passwd file editable then remove the password  holder :x: and su into root without password&#x20;

if shadow is readable ; crack the hashed password&#x20;

if writeable add new custom user there with custom hashed password&#x20;

history&#x20;

cat \~/.bash\_history | grep pass

cat \~/.bash\_history&#x20;

find . type f -exec grep -i I "PASSWORD" {} /dev/null \\;

grep&#x20;

copy password findings commands  from payload all the things to here &#x20;