[MUSIC PLAYING]
Enumerating users and groups on a Linux target system.
In this video, we'll be exploring
the process of how to identify user accounts, as well
as service accounts on a Linux target system,
in addition to the actual groups that
have been set up or configured on the Linux system.
So again, you should have an idea
as to why this information is important,
as we already explored the same process,
with the exception that we were focusing
on how to do it on Windows.
In this case, we're essentially doing the same thing,
but on Linux.
So in terms of what information we're looking for,
we are looking for the current user account
that we have access to and the privileges associated
with that account.
We also want to identify other user accounts as well
as service accounts on the Linux system,
and we also want to identify the groups on the Linux system,
as well as the members of these groups.
With that being said, we're going
to be using the same lab environment
that we used in the previous video,
and that lab environment is attached to this video.
So all you need to do is just fire it up.
We still need to gain access to the target system.
And we already know what vulnerable service is running
on the target system, so we'll actually
streamline the exploitation process
so that we can essentially get down
to the actual business of the day, which is enumerating
users and groups on Linux.
So I'll be seeing you in the lab environment.
All right.
So I'm back within the lab environment,
and the first step, of course, is to identify the target IP
address, because every time you restart the lab,
the target IP address will be different.
So you can identify that by typing in ifconfig
and take a look at the interface ethernet 1.
Just copy this value here.
In your case, it's going to be different.
And just change the 2 to a 3, and that's the target IP.
So I'll copy that there.
We already know that the target system has a vsftpd 2.3.4
running on it on 0.21.
So we've already identified the Metasploit framework exploit
module that we will be using.
So I'll start up msf console, and we can then
set the global variable for the rhost option
to the target IP address so that we
don't have to type in or specify the target IP address
every time we utilize a specific exploit module.
So I'll change the 2 to a 3, and we can then say search vsftpd,
and we are going to use this exploit module here
to gain access.
So I'll say use, paste in the exploit module name,
and if I show the options, you can see the target
IP has already been set for me.
I can then type in exploit.
This will provide us with a command shell session.
And of course, we can also upgrade this to a Materpreter
session so that we also put this in the background using
the control and z keys on my keyboard.
So I'll say, yes, I want to put that into the background.
Let's start my sessions.
The command shall session is running or has an IP of 1.
So I can say sessions, upgrade, 1,
and that will provide me with a Meterpreter session.
There we are.
It looks like we've obtained it.
So if I now say sessions again, we'll have sessions 2,
or session 2, and I can interact with session 2
by typing in sessions 2.
And we now have a Meterpreter session.
So again, whenever you're performing or enumerating
user and group information, you can either go through it
or do it with Meterpreter.
Alternatively, you can do it manually.
With Meterpreter, you can pretty much just say get user ID,
and that will tell you the actual username.
And the way this information is displayed
might be a little bit confusing, because it's not
displaying the username.
It's instead displaying the user ID of the user account.
In this case, whenever it says 0, on Linux,
the user ID 0 is always reserved for the root user.
And as I mentioned in the previous video,
the root user is essentially the Linux equivalent
of the administrator account on Windows.
It's a user account with the highest level of privileges
available on the Linux operating system, or the Linux kernel.
So that means we have access to the target system with the root
user.
And we can open up a Shell session,
and I'll just open up a bash session here.
So bin bash I. And there we are.
All right, so I'll navigate to the home directory of the root
user here.
And we can type in who am I to identify
the current user that we have access to, which is root.
And you can see that that means we
don't have to perform any privilege escalation,
because we currently have access to the system through the root
user.
And again, the root user has the highest privileges
available on the Linux system.
Now, if I had access to the target system via another user
account, like Bob, then you'd need
to identify the privileges associated with that account.
And really, when it comes down to Linux,
the user account will either be a non privileged user account
or the user account will be part of the root group
or the sudo group on Ubuntu.
And if the user account is part of that group,
it means that they have administrative privileges
or root privileges and can run commands with root privileges.
So again, that can easily be done
by typing in the command groups and then specifying
the user account.
So for example, if there was a user account
or you gained access to a target system
with the user account of Bob, you would just say groups Bob.
And if it said that user account was
part of the root group or the sudo group,
then it meant that they have root privileges available.
We can type in groups and root to see what groups the root
user is a part of, and of course, it'll
tell you that the root user is a part of the root group.
So if you want to get an idea of the other users
on a Linux system, you can do that
by catting out the contents of the etc/passwd file.
And this will display a series of both user accounts
and service accounts.
So there's a difference between user accounts and service
accounts.
The easiest way to distinguish between the two
is that a user account, like the root account
here, at the end of it, it will have a specification
for the shell that has been configured
for this particular user account.
So if it's a user account, you'll
typically see that the shell will either be bin bash or bin
SSH for the Bourne shell.
If it is a service account, then the shell specified
will be user s bin no login.
The reason that is the case is because a service account
has not been set up to essentially provide
access for users to log into that account it has essentially
been set up to manage a particular service.
A good example of this is the data service account, which
again you can see has the shell specified
as user s bin no login.
This service account is used to manage the Apache web
server on a Linux system.
So a Linux system will have a collection of service accounts
that is used to manage specific services that you cannot
explicitly log into via SSH, for example.
And if you want to limit this list to only user accounts,
you can do that by, again, just cutting out
the content of the password file and then piping out the content
and grabbing essentially using the grep
utility to exclude the no login option or the no login string.
And once you hit Enter, you can see that these are really
the only user accounts, with the exception of these two,
which appear to be service accounts as well.
So if there were other user accounts on this Linux system,
they would be displayed right over here.
Now the structure of all user accounts
are specified within the etc/passwd file
is the following.
So firstly, you have the username.
You then have the user ID and the group ID.
So for the root user it's always going to be 0,
and for the root group it's always going to be 0 as well.
You'll then have the home directory
of that user, which is going to be in the case of the root
user under the root directory and then of course the shell.
Now, if there was another user account,
a standard user account, then the home directory
would be stored under the home directory.
So if I list out the contents of the home directory,
you can see there are no folders within that directory, which
means there are no other user accounts.
If there were other user accounts, then
they would be displayed here.
So for example, if I say user add,
and then I can add a user, like Bob, for example.
So I can say user add Bob and then
specify the SHA1 as being bash.
Because I'm the root user, I can create other users
on the system.
I don't recommend doing this in a real enterprise environment.
I'm just doing this for the purposes of demonstration.
You can see it's going to add that user.
Now if I say cat etc/passwd you can
see that the user account Bob is specified right over here.
And you can see the home directory is under home Bob.
So if I say LSAL and I specify or list
of the contents of the home directory,
you can now see that we have a folder called Bob.
In this case, it's not been created,
because we did not specify that when creating a user
or when creating the Bob user.
So I can say in this case, we can create another user here.
I can say user add m.
I'll specify the home directory, or we can just
use the m flag there, and I'll specify a new name, like John,
and the shell is going to be bin bash.
And now if I get all the content of the password file,
you can see we have the John user ls LSAL home.
You can see that the John home directory,
or the folder for the user John, has been created.
So again, as I said, I don't recommend
that you actually create users.
This is just for demonstration purposes.
Now, that is how to display the list of user accounts
as well as service accounts on a Linux system.
If you want to display the list of groups on a Linux system,
you can essentially just type in groups.
And in this case, the Linux system
only has one group right of here,
which is the root group, which makes sense.
If there were others then they would
be displayed there as well.
As I said, if you want to display the members of a group,
you can just say, for example, groups,
and then specify the user.
So I can say groups, and we can specify Bob,
for example, that we created.
And you can see that Bob is just part
of the Bob group, which means it's not
part of any other group.
Now, if I wanted to add Bob to a group,
and I'm just doing this for the purpose of demonstration,
I can say user mod, add to group,
and then I say, for example, I want
to add the user Bob to the root group,
I can say user mode ag root and Bob.
So we're specifying the group that we
would like to add Bob to and then the user name
or other the user that we would like to add to the root group.
I can then hit Enter, and now if I say groups Bob,
you can see that Bob is now part of the root group, which
means that he has the ability to run commands with root
privileges, or lack of a better word administrative privileges.
Now, if you also want to list out--
and this is very important, as we did it
on Windows as well-- a list of currently logged on users,
we can do that using the w command or we can type in W
or we can utilize the who utility.
Now, I don't think that the W utility and the
who utility is installed on the target system.
But if I hit Enter, you can see that command is not found.
I can then type in who, and that's not displaying
any information there.
We can also utilize the last command
to show a listing of the last users that
logged on to the system.
So last, and you can see that it doesn't display
any information, which means that no users have logged
on to the system legitimately.
You might be a little bit confused
because you're essentially looking at this lab environment
and you've gained access to the target system via the root
user, and you're saying, why isn't
that being reflected here?
Well, this command essentially only displays
legitimate authentication-- essentially,
connections or authentication that
has been made legitimately, either through SSH
or through a physical TTY session.
So that's why it's not displaying anything there.
We can also utilize the last log command
to essentially display a list of users that
have logged into the system.
And you can see that this will display or will sort out
the information based on the following columns.
So the username, the port, their IP
address they're connecting from, and when they logged in.
So in this case, because no user has ever logged in via SSH
or have logged in physically, it's not being reflected here.
However, if a user logged in via SSH, then
it would show you that information.
All right, so we've covered quite a lot
of system or other user and group enumeration,
so that is going to conclude the practical side of this video.
So now that we have an idea as to how
to enumerate user and group information on a Linux system,
we can now turn our attention to enumerating network information
on a Linux system.
So I'll be seeing you in the next video.