[MUSIC PLAYING]
Welcome to the Linux Local Enumeration
section of this course.
In this video, we're going to be taking a look at how
to enumerate system information on a Linux target
that you have compromised.
So again, this section is going to mirror the same process
or methodology that we used in the Windows Local Enumeration
section.
So we're going to be enumerating system information, users,
and groups--
network information services, as well as taking a
look at how to automate Linux Local Enumeration.
So we are now turning our attention
to enumerating system information on a Linux system.
So you should have a good idea as to why
we're performing system information enumeration
and how that information is important,
or why that information is important.
Now, in the context of Linux, we are
going to be looking for very different pieces of system
information, but really the same at a very abstracted layer,
right?
So on Windows, we were trying to identify
the actual version of Windows, as well as the operating system
architecture and so on and so forth.
In the case of Linux, we are going
to be looking for the host name of the system.
We also want to identify the distribution
and the distribution release version.
So why is this important?
Well, let me give you a brief history
as to what a Linux distribution is
and how that will affect the post-exploitation phase
of your penetration test when it comes down to Linux.
So if you have never used Linux before,
Linux is essentially an operating system kernel,
and a Linux distribution is the pairing
of software and utilities with the Linux kernel.
An example of a Linux distribution
is Ubuntu, Debian, Arch Linux, Manjaro, so on and so forth.
There are plenty of Linux distributions out there.
Now, the key thing to note here is
that distributions are designed differently and utilize
different utilities-- for example,
for package management.
So for example, if I exploit a Debian-based distribution
like Ubuntu, the default package manager
that's used on Debian-based distributions
is the aptitude package manager, which
is actually abbreviated to APD.
So if you've ever typed in sudo apt-get install,
that is the aptitude package manager.
Now, if I exploit a Linux system or a Linux target
running Arch Linux, or an Arch Linux-based distribution,
the default package manager is the Pacman package manager.
And this information is very important,
not just in the context of package managers,
but the way these operating systems are, or rather
these distributions are designed and developed--
and the different utilities they utilize.
So getting an idea of what exact distribution is running
on the Linux target system is very important, as well as
the distribution release version.
So again, let me just use another example.
If I exploit a Linux target running Ubuntu,
I also want to identify what specific version of Ubuntu
is running on the target, because Ubuntu
has multiple release versions.
So it has Ubuntu 12, 13, 14, 16, 18, 19, 20, 21, et cetera.
And all of this information is really pertinent to privilege
escalation.
So for example, again, if I exploit in Ubuntu
a Linux target running Ubuntu, I also
need to identify the specific version of Ubuntu running,
so that I can identify privilege escalation exploits that
are specific to that specific version of Ubuntu that is
installed on the target system.
In addition to the distribution and distribution release
version information, I also want to identify,
or we also need to identify the kernel
version and architecture.
Remember, I said that a Linux distribution
is the pairing of the Linux kernel
and additional utilities that make up
an operating system as a whole.
Well, the Linux kernel has a different versioning system
that is not tied to a specific distribution.
And if you have used Linux before,
you should have actually seen this before.
You have the ability to install other Linux kernels,
or modified Linux kernels on your Linux distribution.
So you need to identify the specific kernel
version and the architecture.
And the reason this information is important
is if you are trying to, for example,
perform privilege escalation via kernel exploit,
you need the specific kernel version
that's running on the target to essentially locate
kernel exploits for that specific kernel that is
installed on the target system.
We also want to identify the architecture of the kernel.
So this will give us an idea of what type of binaries
we can execute on the target system.
So is the kernel a 32-bit kernel?
Is it a 64-bit kernel, et cetera, et cetera?
We can also enumerate the CPU information,
so we can get an idea of what CPU is installed on the target
system, or what is running--
how many calls it has.
And this will give us an idea of the actual resource allocation
of the target system.
We can also identify or enumerate disk information
and mounted drives, so we can get
an idea of the current drives connected to the Linux target
system of compromise.
How much our storage has been consumed?
How much is left?
Are there any other drives that are
connected to the Linux target system, et cetera, et cetera?
And finally, we can also enumerate
the installed packages and software.
So this will give us an idea of what packages are
installed on the Linux system.
And again, this is also pertinent to privilege
escalation whereby we are going to be utilizing
this information to identify specific packages that
might be vulnerable to a privilege escalation
vulnerability.
So in the case of Linux, this can pretty much
be done manually without a Meterpreter session.
But of course, we'll also be exploring
how this can be automated at the end of this section.
With that being said, this video has a lab environment
attached to it, so all you need to do is fire it up.
This lab environment requires us to exploit the target system
first.
So that's what we're going to be doing.
After we've gained access to the Linux target system,
we're then going to perform system information
and enumeration.
So with that being said, I'll be seeing you
in the lab environment.
All right, so I am back within the lab environment.
And within this lab environment, you'll
not be provided with a graphical user interface.
Instead, you'll be provided with a terminal interface.
And this is your Kali Linux system, or your penetration
testing distribution.
And the next step would be to identify the target IP address.
And this can be done by typing in ifconfig and taking a look
at the interface ethernet1.
So this is the IP address of the Kali Linux system
that you're working on.
In your case, it's going to be different.
So do take that into consideration.
However, we can copy this and change the 2 right over here
to a 3.
And that is going to be the target IP address.
So in your case, the subnet will be different,
but the Kali Linux IP, or the Kali Linux system
will always be on the second IP within this subnet,
and the target system will be on the third IP.
So whatever the case, just copy this value here,
and remember to change the 2 to a 3,
and that's the target IP address.
Now that we've done that, the next step would
be to identify the vulnerable service that's
running on the target system, that we
can exploit or utilize or essentially
exploit to gain access.
So we are going to perform a simple Nmap service version
detection scan on the target IP.
So I'll paste in the IP that I copied, and I'll change
the 2 to 3, and I'll hit Enter.
And as you can see, the Nmap scan
is complete in a couple of seconds.
And we have the FTP port open on port 21, which
is the default FTP port.
And the actual service that's running
is vsftpd version 2.3.4.
Now this version of vsftpd 2.3.4 is
vulnerable to a backdoor command execution vulnerability,
or exploit.
And we can confirm this through the use
of the searchsploit utility.
So we can say, searchsploit vsftpd and hit Enter.
And at the bottom, you can see that there is a Metasploit
exploit module for this specific version of vsftpd, 2.3.4,
installed on the target.
So now that we have identified what exploit module we can use,
we can fire up msfconsole.
And this will just take a couple of seconds.
We can then search for the module.
And what I'll do is I'll just copy the target IP
address here, as we'll need it within Metasploit.
And we can then say search and vsftpd.
There we are.
And we can set the target IP address globally,
or we can configure the R Host option globally,
or set the R Host global variable,
by saying, setg R Hosts based in the target IP.
And what this will do is it will essentially
set the R Host value globally for all modules that you use.
So when we use this specific module,
the R Hosts option of the target IP will already be specified.
So I can say, use, paste in the module name there.
And if I show the options for this particular module,
you can see that the target IP has been configured.
And in the case of this exploit module,
we have the R port option, which is essentially
the port that has vsftpd 2.3.4 running on the target system--
which, again, is configured correctly to port 21.
So we can just type in exploit and give that
a couple of seconds.
And this should provide us with a command shell session,
that we can then upgrade to a Meterpreter session.
So you can see that the backdoor service has spawned,
and we will gain access to the target system.
It looks like we've gained access to the target system
as the root user.
The root user on Linux is the user account with the highest
privileges available.
It is the equivalent of the administrator
account on Windows.
So you can see whenever you get a command shell
session with Metasploit, it'll not give you a prompt
immediately, right?
However, this is an actual Linux terminal, or an actual Linux
shell session.
We can confirm that by saying LS.
And you can see that it will essentially
execute the command.
Now, whenever we're working on a Linux system,
we want to obtain a somewhat interactive session.
So we can, for example, spawn a bash session.
So I can say bin bash I. And you can now
see this will provide us with a proper bash
terminal on the target system.
So one of the great features of bash
is that it'll show you your current user
at the host name of the system.
So in this case, we have access to the target system.
The target system is called victim 1.
And we currently have access to the target system
as the root user, which means we do not need to perform
any privilege escalation.
All right.
So with that being said, we can also upgrade this
to an Meterpreter session.
So for example, I can hit Control-Z
to put this in the background.
And then if I type in, sessions, you
can see that we have our command shell session here.
And I can say, sessions hyphen u for upgrade.
And then I can specify the session ID.
So I'll set that to 1.
And once we hit Enter, we should receive a Meterpreter session.
So I'll just give this a couple of seconds.
There we are-- Meterpreter session 2 opened.
Don't worry if you get an error regarding the actual execution
of the following command.
If we type in, sessions, you can see that we have indeed
obtained a Meterpreter session.
So we can say, sessions 2, to utilize the Meterpreter
session.
And we can now get started with the process of performing
system information enumeration.
So with Meterpreter, as you already know,
you can type in, sysinfo, and that'll
give you a basic idea of what's running on the target
system in regards to the actual computer IP address,
or the host name.
As for the operating system, this is the actual distribution
name.
So it's running Debian.
And the distribution release version is 9.5.
And it'll also tell you the exact version of the Linux
kernel running on the target.
So in this case, the target system
is running Linux version 5.4.094 generic.
The architecture is x64, and the Meterpreter session
is a 32-bit Meterpreter session.
Now, we can also explore how to perform system information
enumeration manually, through the use of a standard bash
session on the Linux target.
So I'll type in, shell.
And then I'll say, bin bash I, to obtain a bash session.
There we are.
And what we can do is we can navigate to the home
directory of the root user.
So we can say CD root.
There we are.
And if we print our working directory, you can see,
we're currently within the root directory.
All right.
So let's start off firstly by identifying the hostname.
So we can do that by saying hostname.
You can see that the hostname of this system
is victim 1, which, as I said, is highlighted here in bash.
So we already know that.
If we want to identify the actual distribution itself--
so if we want to check and see what distribution is running,
we can do that by cat-ing the content of etc issue file.
So I can say, cat etc issue.
And you can see that it's running Debian Linux version 9.
If we want to identify more information regarding
the specific version of Debian that's running,
we can say cat etc, and we can use the asterisk option,
or the wildcard option here-- and say, release,
to display all information.
And you can now see that it'll display
the actual name of the distribution, as well
as the release version--
so version 9.
And it then provides you with the home URL support URL
and bug report URL for this distribution.
So we can see that it's running Debian 9, which
is coded named Stretch.
The actual version of Debian is 9, and there we are.
So we now know that the target system
is running Debian 9 Stretch.
We can also enumerate the kernel version
that's running by typing in the uname a command.
So if I type in uname a, you can see
that this will display a lot of information.
This is essentially going to display the actual host
name of the system--
the kernel version-- so 5.4.0.94 generic.
And it'll also display, right over here, the date and time--
and then, of course, the actual kernel architecture.
Now, if you want to clean up this output,
you can say uname r, to limit it to the kernel version.
And you can see right at the bottom
here, that's the kernel version.
So 5.4.094 generic.
All right, so that is how to enumerate
the distribution-- the distribution release version,
as well as the kernel version.
Now, you can also enumerate the environment variables
for a specific user, which I will be going over,
especially when we get to the privilege escalation
section of this course.
But that can be done by typing in env.
And that'll essentially display the environment variables
for the root user.
So this will provide you with the environment variables
for the root user, specifically.
So you can see it'll provide you with the path information.
The path environment variable specifies the directory
that is used by default whenever you type in a command,
or rather for binaries.
So you can see whenever you type in a command like cat,
it'll essentially check the local sbin directory
and see whether the cat binary is in there.
If it is in there, it'll execute it.
You can see that the working directory of the root user
is on the root, which was correct.
And we know just additional information
regarding this user accounts' environment variables.
Now let's talk a little bit about hardware resources,
or rather resource consumption.
So we can display the CPU information by saying, LS CPU--
very simple.
And you can see right over here, this
will tell you the architecture.
We then have the CPUs.
Because this is running on a server, there's 48 CPUs.
And it'll provide you with the threads
per core, the cores per socket.
The vendor ID, it'll tell you the actual manufacturer
of the CPU.
In this case, it's AMD.
The CPU family is 23.
The model name is AMD EPYC 7601 32-core processor, because this
is running in a data center.
It'll then give you the actual clock--
the clock speed of the processor, or rather one core
of this CPU.
And yeah, you can also get additional information,
like the hypervisor vendor, the virtualization type--
the L1, L2, and L3 cache, et cetera, et cetera.
We can also get an idea of how much RAM is being consumed
by typing in the free hyphen-H command,
to display how much RAM is being consumed.
In this case, you can see that the free command is not--
it's telling us, command not found.
That's because the utility is not installed.
But if it was installed, you'd be
able to identify that information.
Now, if I wanted to display a list of drives
or disks connected to the system,
I can utilize the df utility.
So df, and I can specify the output to be human readable.
And that can be done by saying df hyphen-H.
This will display a list of file systems,
as well as the size of these file systems--
the used storage-- available storage--
and where this has been mounted on.
So you can see that this right over here-- dev sda--
that's storage device A.
That is where this Linux system has been installed.
And it is actually mounted on etc hosts.
Now this might not be the same for all the Linux
systems that you will work on.
But this, again, is a special case,
because this is running in a data center.
You can also limit this to specific file extensions.
So if I was only interested in the x-t4 file extension, which
is the default file format for the Linux operating
system, that will display dev sda, which is storage device A.
This is the equivalent of the C drive for Linux.
And you can see that it's a 1.9 terabytes,
because there are other Linux systems running
on this main server.
You can see that the actual amount of storage that is used
is about 90%, so on and so forth.
You can also, again, display disk information
by typing in the command lsblk, and then grepping
the output-only display devices with the storage device
annotation.
So we can say, grab sd.
And right over here, you can see that this
will display sda and sdb.
So storage device B is a swap partition,
that is used for swap memory.
So again, this will give you an idea of what storage devices,
or rather the actual configuration and partitions
that are essentially configured on the Linux target system.
The final piece of information that we can enumerate
is, of course, the installed packages, or the installed
software.
Now given the fact that the target system is running
Debian, we can utilize the Debian package management
utility-- also known as dpkg.
And we can say, L, to list the installed packages
on this system.
So dpkgl.
And right over here, it'll display
all the installed packages
And on Linux, they're going to be quite a lot,
because every tool or utility or command
is considered a package.
So for example, bash, right over here,
it'll give you the exact version of bash.
And as I said within the slides, this information
is really important-- as, for example, in the case of bash,
specific versions of bash have actually
been found, or known to suffer from privilege escalation
vulnerabilities.
So all of this information is extremely important
and will be exploring how this information can
be contextualized in the case of identifying vulnerabilities
that affect the specific version of a particular utility that is
installed on a target system.
So we've been able to enumerate a lot of information
from the Linux target, and that is
going to conclude the practical demonstration
side of this video.
So we've been able to enumerate quite a lot of information
from the Linux target system.
In the next video, we're going to be exploring
the process of how to enumerate users
and groups on this same Linux target system.
With that being said, I'll be seeing you in the next video.