Enumerating processes and cron jobs on Linux.
In this video, we will be exploring
the process of how to enumerate running processes and cron
jobs on Linux or rather enumerating cron jobs that
have been configured to run on a Linux target system.
So you should have a good idea as to why
enumerating this information is important in the context
of the post-exploitation phase of a penetration test.
And in the context of performing or enumerating
this information on Linux, what exactly are we looking for?
Well, firstly, we're looking for, or we have essentially--
we're going to be enumerating or identifying
the running services on the Linux system.
And the objective there is to identify
the services that are running as well as
their respective process IDs.
And of course, we'll also be taking a look
at how to enumerate the cron jobs that have been configured
to run on the Linux system.
So a cron job is essentially the Linux alternative or the Linux
implementation of scheduled tasks on Windows,
or cron job is essentially a task
that has been configured to run on a specified schedule.
Cron jobs are not just limited to specific commands
or scripts.
You can really also set up a cron job
to execute a specific command, a specific binary.
And of course, in most cases, cron jobs
are set up to execute a specific batch script or a Python script
at a specified schedule.
So you can configure a cron job to run every minute.
You can configure it to run every day, every month,
et cetera.
So in regards to the schedule that a cron job can
be configured to run on or with the options are endless, right?
And the reason we're trying to enumerate the actual cron
jobs that have been configured to run
is primarily down to privilege escalation whereby--
and we'll get to that section when we get there.
But we're going to be trying to identify
cron jobs that have been misconfigured
or are configured insecurely.
And we'll be exploring how we can utilize those cron
jobs to elevate our privileges.
With that being said, we're going
to be utilizing the same lab environment
that we used in the previous video within this section.
And again, we're going to need to gain access
to the target system first.
So we've already identified the vulnerable service that's
running on the target system.
So once we gain access, we can then
start enumerating the processes and the cron jobs that are
running on the target system.
So I'll see you within the lab environment.
All right, so I'm back within the lab environment.
And of course, the first step is going
to involve identifying the target IP that
can be done by typing in the ifconfig command
and taking a look at the interface ethernet 1.
All you need to do is just copy this inet value here.
In your case, it'll be different.
But all you need to do is just copy it
and make sure to change the 2 at the end here to a 3.
And that's the target IP.
Given the fact that we've already
identified the vulnerable service that's
running on the target system, which we know is VSFTPD 2.3.4,
we also know that it is vulnerable to a backdoor
command execution vulnerability that can
be exploited with Metasploit.
So I'm going to open up msfconsole here.
So msfconsole, and we'll give this a couple of seconds.
We then are going to set the global variable for the RHOSTS
option to the--
we'll essentially set the value to the target IP address.
So I'll say setg RHOSTS, and I'll paste in the IP
that I copied.
And I'll change the 2 to a 3.
This will essentially ensure that the target IP is specified
globally for the RHOSTS option so that whenever
we load a module, the target IP value is going to be specified.
Now that is done, we can search for the vsftpd module.
There it is.
So I'll just copy it.
And I'll say use.
And if I now show the options for this module,
you can see the target IP is already specified.
So I type in exploit.
And that should provide me with a command shell
session, which I'm then going to upgrade to a Meterpreter
session.
There we are.
I'll put this in the background using the key combination
Control and Z.
And I'll hit yes.
I'll list out my sessions.
You can see the command shell session is currently
has an idea of 1.
So I'll say sessions upgrade 1 to get a Meterpreter session.
And we'll give this a couple of seconds.
And you can see we get a Meterpreter session.
So I'll now list out my sessions,
and it's running on session 2.
So I'll say sessions 2, and we have our Meterpreter session.
So we can enumerate the list of running processes
with Meterpreter by typing in ps, right?
And before I do that, I actually want
to open up the actual documentation for Meterpreter.
And if I take a look at the system commands here,
you can see that in regards to processes,
it's fairly similar to what we did on Windows, where
we type in ps that will list the running processes.
We can also suspend or resume a list of processes,
we can also filter processes by their name.
And we can terminate a specific process.
So again, if I type in ps, you can
see that will display the process list.
And it's sorted based on process ID, the PPID,
the name of the process, the architecture, the user,
and of course, the path, right?
And of course, I've already explained these columns.
And you can see that we have quite a few processes here.
And more specifically, we can see that we
have the vsftpd process.
And it doesn't specify the actual binary here
or the path to the binary, which is very interesting.
And then of course, we can utilize the various system
commands for Meterpreter to essentially kill
a specific process if we want to do that.
We can also filter the processes by name.
So I can say pgrep.
And I can say vsftpd, for us looking
for a particular process.
And we also-- you can see we can-- if I filter that there,
it looks like we have two processes attached to vsftpd.
One of which has a process ID of 7.
The other one has a process ID of 9.
And you get the idea.
So that's a fairly simple to understand.
And I'm just going to open up a commercial session here.
And I'm going to open up a bash session.
So /bin/bash -i.
And again, to do this manually, we
can also utilize the Linux utility called ps.
So if I type in ps, that'll essentially
list out the list of processes.
In this case, it is not found.
But if I type in ps aux, you can see that it's still not found.
So the ps utility is not installed
on this target system.
As a result, what I can do to highlight the rest
or how to run this command, I will just exit,
or what I can do is let me just terminate
this particular channel.
So Control C terminate that channel.
And I'll put this in the background.
It looks like our Meterpreter session has died.
That's perfectly fine.
So I'm currently running within msfconsole.
And I can run the ps command on my Kali Linux system,
just to explain how this works.
So I can say ps.
And if I hit Enter, you can see that we'll
list out a list of processes.
And it'll sort it based on the process ID, the TTY session,
the time, and then the command that is being executed, right?
Now, I can also utilize the ps aux command
to display all processes and to also display information
that is important to us.
So in this case, you can see this has additional columns.
So for example, you have the user, the process ID, the CPU,
and memory consumption.
You also have the actual start time.
And then of course, you have the command that is being executed.
And in this case, we can actually
see the msfconsole process right over here.
And it provides us with information
regarding the process ID, et cetera, et cetera, right?
We can also limit or filter the processes
that we want to see based on specific parameters.
So for example, if I say ps aux, I can type out the output
and utilize grep to filter through and only display
information that we want.
So for example, I can also say if I wanted to essentially list
out a specific process like msfconsole,
you can see that it's going to display the processes based
on the keyword that I specified here.
And if I wanted to limit the output to a specific user
or to only display processes associated
with a specific user, I can say, for example, root.
So grep root.
Hit Enter.
And this will show me all processes
that belong to the root user right over here.
So the ps command or utility is quite useful.
However, in this case, as we were able to see,
it is not installed on the target system.
That is very rarely the case.
On most Linux systems that you will be gaining access to,
the ps utility will pretty much be installed
because it is extremely useful.
Another utility that you can utilize is the top command.
So let me just open up one of the actual command shell
session here.
So I'll say sessions 1, as we don't really
need them Meterpreter session at this point.
So I'll say /bin/bash -i.
That is the top command, which will essentially
display a list of processes.
And in this case, it's not installed on the target system,
so I'll just put that in the background.
And we can run the command on the Kali Linux system.
So I'll say top.
And you can see that the top utility will give you
a list of all running processes.
And this is a dynamic utility and that it
is showing you a list of processes
as they're actually being executed.
And it's also highlighting their resource consumption.
So you can see you have your CPU counter and your memory
counter.
And again, the top utility is quite useful
because it tells you how long the system has been up,
the users, the load average.
It also displays the amount of memory that's free.
So in this case, about 10 gigabytes.
I think that's in bytes.
I'm not really sure.
Yeah, that is in MiB, so that's the amount of memory
that is available, the amount that is free,
and the amount that is used.
So again, the top utility is quite useful.
And as I said, it's pretty much going to be installed.
For example, if I exploit an Ubuntu system,
the top utility comes pre-packaged with Ubuntu.
So that's the top utility.
Now, the other checks or the other piece of information
that we wanted to enumerate are cron jobs, right?
And I'll just navigate back into session 1.
And I'll open up a bash session here.
So /bin/bash -i.
And we can essentially display the cron jobs
for a specific user or the user that you
have access to or with on the target system
by typing in crontab -l.
So if I hit Enter, you can see that.
Again, in this case, the crontab utility is not installed.
So what?
We can do again.
And again, this is quite unfortunate.
But again, you can also do it on the Kali Linux system.
We can say crontab -l.
And this will display the list of cron jobs for the root user.
In this case, you can see that it says
no crontab for the root user.
So no cron jobs have been configured by the root user
or for the root user for that matter.
We can also display the contents of the etc directory,
but we're looking for all files with cron in the file name.
So we can use the asterisk command as a wildcard.
This will display all cron files.
And right here, you can see that cron sort it
based on daily cron jobs.
You also have your hourly cron jobs,
monthly, weekly, et cetera.
And we can also cat out the content.
And we can say cat /etc/cron and use the wild card again.
And right over here, this will tell us
that we really don't have any cron jobs configured.
If they were configured, this is typically how
or what a cron job would look like.
So you would essentially have your--
if you take a look at the job definition,
this is where the actual schedule is specified.
So again, you can specify whether you
want to run it every minute or what specific minute of an hour
you want to run it on, what hour of the day you want to run it
on, day of the month, month, day of the week, et cetera, right?
And of course, in this case, this video
is primarily focused on techniques.
When we actually get to privilege escalation,
we'll actually see or we'll be able to explore what
a real cron job looks like.
So yeah, that is going to conclude
the practical demonstration side of this video.
All right.
So we've been able to take a look at how to enumerate system
information on Linux, users, and groups, network information,
and now, services, and cron jobs, or rather, processes,
and cron jobs.
In the next video, we're going to take a look
at how to automate all of this.
And the way we're going to do that is through an automation
or rather, for lack of a better word, an automated enumeration
script for Linux, as we explored during the Windows section.
So we're essentially going to be utilizing a script
to automate all of these steps of local enumeration on Linux.
And again, the reason, as I said, that we're covering this
at the end of the video, is primarily
because or at the end of this section
is primarily because it's very important that you
learn how to perform local enumeration manually.
After you know how to perform local enumeration manually,
you can then automate the checks when
you're working or performing a real penetration test,
given the time constraints that you are under
or that you need to abide by.
With that being said, I'll be seeing you in the next video.