sudo -l
getcap -r / 2>/dev/null
cat /etc/crontab
Binaries by root:
find / -type f -perm -4000 2>/dev/null
Hunting for SUID binaries for current user
find / -type f -perm -u=s -ls 2>/dev/null
Are there any setuid binaries by another user like des?
find / -type f -perm -u=s -user des -ls 2>/dev/null
Other file has the group check one
Check user history
cat .bash_history
Aliases (Linux/bash — privesc hints):
alias
alias | grep -iE 'sudo|root|pass|su |chmod'
Find other process. Interanal Webpage or DB:
ps aux
Kernel Exploit
id
uname -a
Finding gold - loot:
iconv -f UTF-16LE -t UTF-8 all.txt > all-utf8.txt
grep -Ein "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login" all-utf8.txt
grep -Einr "password|passwd|secret|PRIVATE KEY|admin|user" ./*
run linpeas / linus exploit suggestor
Windows checklist:
whoami /priv
net user
systeminfo
schtasks
Windows: cmd:
findstr /I /N /R "password passwd secret token apikey api_key ssh admin user login PRIVATE CREATE INSERT
PS:
Select-String -Path .\all-utf8.txt `
-Pattern "password|passwd|secret|token|apikey|api_key|ssh|PRIVATE KEY|INSERT INTO|CREATE DATABASE|CREATE TABLE|admin|user|login" `
-AllMatches -CaseSensitive:$false | Format-Table LineNumber, Line -AutoSize
*.* - i think this is all files in dir?
winpeas / win exploit suggestor
Look for capabilities like:
🚨 High-risk caps
cap_setuid+ep
cap_setgid+ep
cap_dac_override+ep
cap_sys_admin+ep
cap_sys_ptrace+ep
These can often lead to full root compromise.
Ideas: giev root you pub id_rsa: /root/.ssh/authorized_keys
make a user sudo? through echo? deku ALL=NOPASSWD: ALL >> /etc/sudoers
change ip / location of a command. of whats it pingingfind / -type f -perm -4000 2>/dev/null
look at groups
do’s: export path
export PATH=PATH
some docker shii: https://medium.com/@CP4rrot/try-hack-me-the-market-place-907070bfac63