Linux Post Exploitation Cheat Sheet

Commands DESCRIPTION /etc/resolv.conf Contains DNS servers /etc/motd Message of the day /etc/issue distribution version /etc/passwd User List ===

Information collection

Commands	DESCRIPTION
/etc/resolv.conf	Contains DNS servers
/etc/motd	Message of the day
/etc/issue	distribution version
/etc/passwd	User List
/etc/shadow	List of user hashes (requires root permissions)
/home/USER/.bash_history	Shows you the commands executed by the user

Commands	DESCRIPTION
join me -a	Shows kernel, architecture and distribution information
ps aux	List processes that are running
id	Current user and groups to which it belongs
uname -m	Processor architecture
w	Connected users
who -a	uptime, runlevel, tty, processes, etc.
gcc -v	GCC version
mysql –version	MySQL version
perl -v	perl version
ruby -v	Ruby version
python –version	python version
df -k	Mounted file systems
mount	Mounted file systems
last -a	Last connected users
getenforce	Get SElinux status
dmesg	Shows information about the last system boot
lspci	List all PCI devices
lsusb	List all USB devices
lscpu	Shows CPU information
lshw	List hardware information
cat /proc/cpuinfo	Shows information about the CPU
cat /proc/meminfo	Shows information about memory
du -h –max-depth=1 /	Shows the total capacity for a directory
which nmap	Locate where the NMAP command is
locate bin/nmap	Locate where the NMAP command is
locate bin/nc	Locate where the NC command is
java-version	Java version

Commands	DESCRIPTION
hostname -f	Server name
ip addr show	shows IP addressing
ip ro show	Shows IP addressing and gateway
ifconfig -a	Shows all interfaces with their IP addressing
route -n	Route information
cat /etc/network/interfaces	Network configuration under Debian-based distributions
iptables -L -n -v	Show iptables rules
iptables -t nat -L -n -v	Our iptables NAT rules
ip6tables -L -n -v	Shows ipv6 rules from iptables
iptables-save	Save existing ruleset
netstat -anop	List all established connections
netstat -r	Route information
netstat -nltupw	Connections established with sockets
arp -a	Show ARP table
lsof -nPi	Shows the process and the connection established
cat /proc/net/*	More discreetly, all the information provided by the above commands can be found by searching the files in /proc/net, and this approach is less likely to trigger monitoring or other things

COMMANDS	DESCRIPTION
cat /etc/passwd	Show all local users
cat /etc/shadow	List of user hashes (requires root permissions)
/etc/security/passwd	List of user hashes on AIX
cat /etc/group	List the groups
getent passwd	Dumps information from all local, LDAP and NIS users
getent group	Dumps information about all local groups, LDAP and NIS
pdbedit -L -w	SAMBA database
pdbedit -L -v	SAMBA database
cat /etc/aliases	Email aliases
find /etc -name aliases	Look for aliases within the /etc directory
getent aliases	Alias List
ypcat passwd	Show NIS password file

Commands	DESCRIPTION
ls -alh /home/*/	List all files within /home directories
ls -alh /home/*/.ssh/	Lists ssh contents within /home directories
cat /home/*/.ssh/authorized_keys	Show authorized_keys inside /home directories
cat /home/*/.ssh/known_hosts	Show DSA keys within /home directories
cat /home/*/.hist	Show the history of all users
find /home//.vnc /home//.subversion -type f	Search inside /home for .vnc or .subversion files
grep ^ssh /home/*/.hist	Search within history strings containing ssh
grep ^telnet `/home/*/.hist	Search within history strings containing telnet
grep ^mysql /home/*/.hist	Search within history strings containing mysql
cat /home/*/.viminfo	show content of .viminfo file
sudo -l	Show the permissions that a user has with sudo
crontab -l	List scheduled tasks
cat /home/*/.mysql_history	Show the contents of the .mysql_history file

file/COMMAND	DESCRIPTION
ls -aRl /etc/ * awk ‘$1 ~ /w.$/’ * grep -v lrwx 2>/dev/nullte	Show all configuration files
cat /etc/issue{,.net}	distribution version
cat /etc/master.passwd	Contains FreeBSD encrypted hashes
cat /etc/group	Show local groups
cat /etc/hosts	get a relationship between a hostname and an IP address
cat /etc/crontab	crontab configuration file
cat /etc/sysctl.conf	Kernel configuration file
for user in $(cut -f1 -d: /etc/passwd); do echo $user; crontab -u $user -l; donated	List all crontab files for all users
cat /etc/resolv.conf	DNS configuration file
cat /etc/syslog.conf	syslog configuration file
cat /etc/http.conf	Apache service configuration file
cat /etc/lighttpd.conf	lighttpd service configuration file
cat /etc/cups/cupsd.confcda	Printer Service Configuration File
cat /etc/inetd.conf	Network “supervisor” configuration file
cat /opt/lampp/etc/httpd.conf	XAMPP service apache configuration file
cat /etc/samba/smb.conf	SAMBA service configuration file
cat /etc/openldap/ldap.conf	OpenLDAP Service LDAP Configuration File
cat /etc/ldap/ldap.conf	LDAP configuration file
cat /etc/exports	File where NFS shared directories are exported
cat /etc/auto.master	NIS configuration file
cat /etc/auto_master	NIS configuration file
cat /etc/fstab	Configuration file where all file systems are mounted

Archive	DESCRIPTION
join me -a	We can see the distro in most Linux
lsb_release -d	Generic command for all LSB distributions
/etc/os-release	Generic for distributions using "systemd"
/etc/issue	Generic but often modified
cat /etc/*release
/etc/SUSE-release	Suse
/etc/redhat-release, /etc/redhat_version	Red Hat
/etc/fedora-release	fedora
/etc/slackware-release, /etc/slackware-version	Slackware
/etc/debian_release, /etc/debian_version	Debian
/etc/mandrake-release	Mandrake
/etc/sun-release	Sun JDS
/etc/release	Solaris/Sparc
/etc/gentoo-release	Gentoo
/etc/arch-release	ArchLinux
arch	OpenBSD; sample: “OpenBSD.amd64”

COMMANDS	DESCRIPTION
python -c ‘import pty;pty.spawn(«/bin/bash»)’	Get shell using python
echo os.system(‘/bin/bash’)	Get shell using Linux command
/bin/sh -i	Get shell using SH
perl -e 'exec "/bin/sh";'	Get shell using perl
perl: exec "/bin/sh";	Get shell using perl
ruby:exec "/bin/sh"	Get shell using ruby
exec “/bin/sh”	Get shell using exec
:!bash	Get shell using Linux command
:set shell=/bin/bash:shell	Get shell using Linux command
!sh	Get shell using Linux command

Script	URL
LinEnum	https://github.com/rebootuser/LinEnum
mimipenguin	https://github.com/huntergregal/mimipenguin
Linuxprivchecker	https://github.com/sleventyeleven/linuxprivchecker/
linux exploit suggester	https://github.com/mzet-/linux-exploit-suggester
Linux Exploit Suggester 2	https://github.com/jondonas/linux-exploit-suggester-2

:wq!