eVD9Cmjg

1#####################################
2# InfoSecAddicts Intro to Linux     # 
3# By Joe McCray                     #
4#####################################
5
6
7
8##########
9# VMWare #
10##########
11- For this workshop you'll need the latest version of VMWare Workstation (Windows), Fusion (Mac), or Player.
12
13- http://www.vmware.com/ap/products/player.html
14
15
16- Although you can get the VM to run in VirtualBox, I will not be supporting this configuration for this class.
17
18
19##########################
20# Download the attack VM #
21##########################
22https://s3.amazonaws.com/StrategicSec-VMs/StrategicsecUbuntu14.zip
23user: strategicsec
24pass: strategicsec
25
26- Here is a good set of slides for getting started with Linux:
27http://www.slideshare.net/olafusimichael/linux-training-24086319
28
29
30
31
32- Log in to your Ubuntu host with the following credentials:
33	user: strategicsec
34	pass: strategicsec
35
36
37
38- I prefer to use Putty to SSH into my Ubuntu host on pentests and I'll be teaching this class in the same manner that I do pentests.
39- You can download Putty from here:
40- http://the.earth.li/~sgtatham/putty/latest/x86/putty.exe
41
42
43- For the purpose of this workshop 192.168.230.128 is my Ubuntu IP address so anytime you see that IP you'll know that's my Ubuntu host
44
45
46
47########################
48# Basic Linux Commands #
49########################
50
51pwd
52
53whereis pwd
54
55which pwd
56
57sudo find / -name pwd
58
59/bin/pwd
60
61mkdir test
62
63cd test
64
65touch one two three
66
67ls -l t		(without pressing the Enter key, press the Tab key twice. What happens?)
68
69h		(and again without pressing the Enter key, press the Tab key twice. What happens?)
70
71Press the 'Up arrow key'	(What happens?)
72
73Press 'Ctrl-A'			(What happens?)
74
75ls
76
77clear				(What happens?)
78
79echo one > one
80
81cat one				(What happens?)
82
83man cat				(What happens?)
84	q
85
86cat two
87
88cat one > two
89
90cat two
91
92cat one two > three
93
94cat three
95
96echo four >> three
97
98cat three 			(What happens?)
99
100wc -l three
101
102man wc
103	q
104
105cat three | grep four
106
107cat three | grep one
108
109man grep
110	q
111
112
113sudo grep eth[01] /etc/*	(What happens?)
114
115cat /etc/iftab
116
117
118man ps
119	q
120
121ps
122
123ps aux
124
125ps aux | less
126
127Press the 'Up arrow key'	(What happens?)
128
129Press the 'Down arrow key'	(What happens?)
130	q
131
132top
133
134
135
136#########
137# Files #
138#########
139Introduction
140
141After the previous section I'm sure you're keen and eager to get stuck into some more commands and start doing some actual playing about with the system. We will get to that shortly but first we need to cover some theory so that when we do start playing with the system you can fully understand why it is behaving the way it is and how you can take the commands you learn even further. That is what this section and the next intend to do. After that it will start getting interesting, I promise.
142
143Everything is a File
144
145Ok, the first thing we need to appreciate with linux is that under the hood, everything is actually a file. A text file is a file, a directory is a file, your keyboard is a file (one that the system reads from only), your monitor is a file (one that the system writes to only) etc. To begin with, this won't affect what we do too much but keep it in mind as it helps with understanding the behaviour of Linux as we manage files and directories.
146
147Linux is an Extensionless System
148
149This one can sometimes be hard to get your head around but as you work through the sections it will start to make more sense. A file extension is normally a set of 2 - 4 characters after a full stop at the end of a file, which denotes what type of file it is. The following are common extensions:
150
151file.exe - an executable file, or program.
152file.txt - a plain text file.
153file.png, file.gif, file.jpg - an image.
154In other systems such as Windows the extension is important and the system uses it to determine what type of file it is. Under Linux the system actually ignores the extension and looks inside the file to determine what type of file it is. So for instance I could have a file myself.png which is a picture of me. I could rename the file to myself.txt or just myself and Linux would still happily treat the file as an image file. As such it can sometimes be hard to know for certain what type of file a particular file is. Luckily there is a command called file which we can use to find this out.
155
156file [path]
157
158Now you may be wondering why I specified the command line argument above as path instead of file. If you remember from the previous section, whenever we specify a file or directory on the command line it is actually a path. Also because directories (as mentioned above) are actually just a special type of file, it would be more accurate to say that a path is a means to get to a particular location in the system and that location is a file.
159
160Linux is Case Sensitive
161
162This is very important and a common source of problems for people new to Linux. Other systems such as Windows are case insensitive when it comes to referring to files. Linux is not like this. As such it is possible to have two or more files and directories with the same name but letters of different case.
163
164ls Documents
165FILE1.txt File1.txt file1.TXT
166...
167file Documents/file1.txt
168Documents/file1.txt: ERROR: cannot open 'file1.txt' (No such file or directory)
169Linux sees these all as distinct and separate files.
170
171Also be aware of case sensitivity when dealing with command line options. For instance with the command ls there are two options s and S both of which do different things. A common mistake is to see an option which is upper case but enter it as lower case and wonder why the output doesn't match your expectation.
172
173Spaces in names
174
175Spaces in file and directory names are perfectly valid but we need to be a little careful with them. As you would remember, a space on the command line is how we seperate items. They are how we know what is the program name and can identify each command line argument. If we wanted to move into a directory called Holiday Photos for example the following would not work.
176
177ls Documents
178FILE1.txt File1.txt file1.TXT Holiday Photos
179...
180cd Holiday Photos
181bash: cd: Holiday: No such file or directory
182What happens is that Holiday Photos is seen as two command line arguments. cd moves into whichever directory is specified by the first command line argument only. To get around this we need to identify to the terminal that we wish Holiday Photos to be seen as a single command line argument. There are two ways to go about this, either way is just as valid.
183
184Quotes
185
186The first approach involves using quotes around the entire item. You may use either single or double quotes (later on we will see that there is a subtle difference between the two but for now that difference is not a problem). Anything inside quotes is considered a single item.
187
188cd 'Holiday Photos'
189pwd
190/home/ryan/Documents/Holiday Photos
191Escape Characters
192
193Another method is to use what is called an escape character, which is a backslash ( \ ). What the backslash does is escape (or nullify) the special meaning of the next character.
194
195cd Holiday\ Photos
196pwd
197/home/ryan/Documents/Holiday Photos
198In the above example the space between Holiday and Photos would normally have a special meaning which is to separate them as distinct command line arguments. Because we placed a backslash in front of it, that special meaning was removed.
199
200In the previous section we learnt about something called Tab Completion. If you use that before encountering the space in the directory name then the terminal will automatically escape any spaces in the name for you.
201
202Hidden Files and Directories
203
204Linux actually has a very simple and elegant mechanism for specifying that a file or directory is hidden. If the file or directory's name begins with a . (full stop) then it is considered to be hidden. You don't even need a special command or action to make a file hidden. Files and directories may be hidden for a variety of reasons. Configuration files for a particular user (which are normally stored in their home directory) are hidden for instance so that they don't get in the way of the user doing their everyday tasks.
205
206To make a file or directory hidden all you need to do is create the file or directory with it's name beginning with a . or rename it to be as such. Likewise you may rename a hidden file to remove the . and it will become unhidden. The command ls which we have seen in the previous section will not list hidden files and directories by default. We may modify it by including the command line option -a so that it does show hidden files and directories.
207
208ls Documents
209FILE1.txt File1.txt file1.TXT
210...
211ls -a Documents
212. .. FILE1.txt File1.txt file1.TXT .hidden .file.txt
213...
214In the above example you will see that when we listed all items in our current directory the first two items were . and .. If you're unsure what these are then you may wish to have a read over our previous section on Paths.
215
216Summary
217
218file
219obtain information about what type of file a file or directory is.
220ls -a
221List the contents of a directory, including hidden files.
222Everything is a file under Linux
223Even directories.
224Linux is an extensionless system
225Files can have any extension they like or none at all.
226Linux is case sensitive
227Beware of silly typos.
228Activities
229
230Right, now let's put this stuff into practice. Have a go at the following:
231
232Try running the command file giving it a few different entries. Make sure you use a variety of absolute and relative paths when doing this.
233Now issue a command that will list the contents of your home directory including hidden files and directories.
234
235
236
237############
238# VIM Demo #
239############
2401. Vim Line Navigation
241
242Following are the four navigation that can be done line by line.
243
244k – navigate upwards
245j – navigate downwards
246l – navigate right side
247h – navigate left side
248
249By using the repeat factor in VIM we can do this operation for N times. For example, when you want to
250go down by 10 lines, then type “10j”.
251
252Within a line if you want to navigate to different position, you have 4 other options.
253
2540 – go to the starting of the current line.
255^ – go to the first non blank character of the line.
256$ – go to the end of the current line.
257g_ – go to the last non blank character of the line.
2582. Vim Screen Navigation
259
260Following are the three navigation which can be done in relation to text shown in the screen.
261
262H – Go to the first line of current screen.
263M – Go to the middle line of current screen.
264L – Go to the last line of current screen.
265ctrl+f – Jump forward one full screen.
266ctrl+b – Jump backwards one full screen
267ctrl+d – Jump forward (down) a half screen
268ctrl+u – Jump back (up) one half screen
2693. Vim Special Navigation
270
271You may want to do some special navigation inside a file, which are:
272
273N% – Go to the Nth percentage line of the file.
274NG – Go to the Nth line of the file.
275G – Go to the end of the file.
276`” – Go to the position where you were in NORMAL MODE while last closing the file.
277`^ – Go to the position where you were in INSERT MODE while last closing the file.
278g – Go to the beginning of the file.
2794. Vim Word Navigation
280
281You may want to do several navigation in relation to the words, such as:
282
283e – go to the end of the current word.
284E – go to the end of the current WORD.
285b – go to the previous (before) word.
286B – go to the previous (before) WORD.
287w – go to the next word.
288W – go to the next WORD.
289
290WORD – WORD consists of a sequence of non-blank characters, separated with white space.
291word – word consists of a sequence of letters, digits and underscores.
292
293Example to show the difference between WORD and word
294
295192.168.1.1 – single WORD
296192.168.1.1 – seven words.
2975. Vim Paragraph Navigation
298
299{ – Go to the beginning of the current paragraph. By pressing { again and again move to the previous paragraph beginnings.
300} – Go to the end of the current paragraph. By pressing } again and again move to the next paragraph end, and again.
3016. Vim Search Navigation
302
303/i – Search for a pattern which will you take you to the next occurrence of it.
304?i – Search for a pattern which will you take you to the previous occurrence of it.
305* – Go to the next occurrence of the current word under the cursor.
306# – Go to the previous occurrence of the current word under the cursor.
3077. Vim Code Navigation
308
309% – Go to the matching braces, or parenthesis inside code.
310
3118. Vim Navigation from Command Line
312
313Vim +N filename: Go to the Nth line of the file after opening it.
314
315vim +10 /etc/passwd
316
317Vim +/pattern filename: Go to the particular pattern’s line inside the file, first occurrence from first. In the following example, it will open the README file and jump to the first occurrence of the word “install”.
318
319vim +/install README
320
321Vim +?patten filename: Go to the particular pattern’s line inside the file, first occurrence from last. In the following example, it will open the README file and jump to the last occurrence of the word “bug”.
322
323vim +?bug README
324
325These features are explained using 12 very practical and powerful text substitution examples.
326
327Syntax of the text substitution inside vim editor:
328
329:[range]s[ubstitute]/{pattern}/{string}/[flags] [count]
330
331Following are three possible flags.
332
333[c] Confirm each substitution.
334[g] Replace all occurrences in the line.
335[i] Ignore case for the pattern.
336Example 1. Substitute all occurrences of a text with another text in the whole file
337
338This is the basic fundamental usage of the text substitution inside Vi editor. When you want a specific text to be replaced with another text in the entire file then you can use the following sequence.
339
340:%s/old-text/new-text/g
341
342%s – specifies all lines. Specifying the range as ‘%’ means do substitution in the entire file.
343g – specifies all occurrences in the line. With the ‘g’ flag , you can make the whole line to be substituted. If this ‘g’ flag is not used then only first occurrence in the line only will be substituted.
344Example 2. Substitution of a text with another text within a single line
345
346When you want a specific text to be replaced with another text within a single line in a case insensitive manner. Specifying no range means, do substitution in the current line only. With the ‘i’ flag, you can make the substitute search text to be case insensitive.
347
348:s/I/We/gi
349Example 3. Substitution of a text with another text within a range of lines
350
351With the range, you can make only a range of line to be affected in the substitution. Specifying 1, 10 as range means, do substitution only in the lines 1 – 10.
352
353:1,10s/helo/hello/g
354Example 4. Substitution of a text with another text by visual selection of lines
355
356You can also select a specific lines by visually selecting those lines. Press CTRL + V in command mode, use navigation keys to select the part of the file you want to be substituted. Press ‘:’ which will automatically formed as :'<,’> Then you can use the normal substitute as
357
358:'<,'>s/helo/hello/g
359Example 5. Substitution of a text with another text only the 1st X number of lines
360
361Using count in substitution, If you specify the count N in the substitution then it means do substitution in N lines from the current position of the cursor. do substitution in 4 lines from the current line.
362
363:s/helo/hello/g 4
364Example 6. Substitute only the whole word and not partial match
365
366Let us assume that you want to change only the whole word ‘his’ to ‘her’ in the original text mentioned below. If you do the standard substitution, apart from changing his to her, it will also change This to Ther as shown below.
367
368Standard Subsitution
369Original Text: This is his idea
370
371:s/his/her/g
372
373Translated Text: Ther is her idea
374
375Whole Word Subsitution
376Original Text: This is his idea
377
378:s/\<his\>/her/
379
380Translated Text: This is her idea
381Note:: You should enclose the word with < and > , which will force the substitution to search only for the full word and not any partial match.
382
383Example 7. Substitute either word1 or word2 with a new word using regular expression
384
385In the following example, it will translate any occurrences of either good or nice will be replaced with awesome.
386
387Original Text: Linux is good. Life is nice.
388
389:%s/\(good\|nice\)/awesome/g
390
391Translated Text: Linux is awesome. Life is awesome.
392
393You can also do substitution by specifying regular expression. Following example does the substitution of hey or hi to hai. Please note that this does not do any substitution for the words ‘they’, ‘this’.
394
395:%s/\<\(hey\|hi\)\>/hai/g
396
397\< – word boundary.
398\| – “logical or” (in this case hey or hi)
399Example 8. Interactive Find and Replace in Vim Editor
400
401You can perform interactive find and replace using the ‘c’ flag in the substitute, which will ask for confirmation to do substitution or to skip it as explained below. In this example, Vim editor will do a global find the word ‘awesome’ and replace it with ‘wonderful’. But it will do the replacement only based on your input as explained below.
402
403:%s/awesome/wonderful/gc
404
405replace with wonderful (y/n/a/q/l/^E/^Y)?
406y – Will replace the current highlighted word. After replacing it will automatically highlight the next word that matched the search pattern
407n – Will not replace the current highlighted word. But it will automatically highlight the next word that matched the search pattern
408a – Will substitute all the highlighted words that matched the search criteria automatically.
409l – This will replace only the current highlighted word and terminate the find and replace effort.
410Example 9. Substituting all lines with its line number.
411
412When the string starts with ‘\=’, it should be evaluated as an expression. Using the ‘line’ function we can get the current line number. By combining both the functionality the substitution does the line numbering of all lines.
413
414:%s/^/\=line(".") . ". "/g
415
416Note: This is different from the “:set number” where it will not write the line numbers into the file. But when you use this substitution you are making these line number available inside the file permanently.
417
418Example 10. Substituting special character with its equivalent value.
419
420Substituting the ~ with $HOME variable value.
421
422Original Text: Current file path is ~/test/
423
424:%s!\~!\= expand($HOME)!g
425
426Translated Text: Current file path is /home/ramesh/test/
427You can use expand function to use all available predefined and user defined variables.
428
429Example 11. Alter sequence number in a numbered list while inserting a new item
430
431Assume that you have a numbered list like the following inside a text file. In this example, let us assume that you want to add a new line after Article 2. For this, you should change the number of all other articles accordingly.
432
433vi / vim tips & tricks series
434Article 1: Vi and Vim Editor: 3 Steps To Enable Thesaurus Option
435Article 2: Vim Autocommand: 3 Steps to Add Custom Header To Your File
436Article 3: 5 Awesome Examples For Automatic Word Completion Using Ctrl-X
437Article 4: Vi and Vim Macro Tutorial: How To Record and Play
438Article 5: Tutorial: Make Vim as Your C/C++ IDE Using c.vim Plugin
439Article 6: How To Add Bookmarks Inside Vim Editor
440Article 7: Make Vim as Your Bash-IDE Using bash-support Plugin
441Article 8: 3 Powerful Musketeers Of Vim Editor ? Macro, Mark and Map
442Article 9: 8 Essential Vim Editor Navigation Fundamentals
443Article 10: Vim Editor: How to Correct Spelling Mistakes Automatically
444Article 11: Transfer the Power of Vim Editor to Thunderbird for Email
445Article 12: Convert Vim Editor to Beautiful Source Code Browser
446
4473rd Article “Make Vim as Your Perl IDE Using perl-support.vim Plugin” got missed. So when you want
448to add it, then you want to change “Article 3” to “Article 4”, “Article 4” to “Article 5”, upto “Article 12” to “Article 13”.
449
450This can be achieved by the following vim substitution command.
451
452:4,$s/\d\+/\=submatch(0) + 1/
453
454Range: 4,$ – 4th line to last line.
455Pattern to Search – \d\+ – digits sequence
456Pattern to Replace – \=submatch(0) + 1 – gets the matched pattern and adds 1 to it.
457Flag – as there is no flag, by default it substitutes only the first occurrence.
458
459After executing the substitute statement the file will become like this, where you can
460add the 3rd Article.
461
462vi / vim tips & tricks series
463Article 1: Vi and Vim Editor: 3 Steps To Enable Thesaurus Option
464Article 2: Vim Autocommand: 3 Steps to Add Custom Header To Your File
465Article 4: 5 Awesome Examples For Automatic Word Completion Using Ctrl-X
466Article 5: Vi and Vim Macro Tutorial: How To Record and Play
467Article 6: Tutorial: Make Vim as Your C/C++ IDE Using c.vim Plugin
468Article 7: How To Add Bookmarks Inside Vim Editor
469Article 8: Make Vim as Your Bash-IDE Using bash-support Plugin
470Article 9: 3 Powerful Musketeers Of Vim Editor ? Macro, Mark and Map
471Article 10: 8 Essential Vim Editor Navigation Fundamentals
472Article 11: Vim Editor: How to Correct Spelling Mistakes Automatically
473Article 12: Transfer the Power of Vim Editor to Thunderbird for Email
474Article 13: Convert Vim Editor to Beautiful Source Code Browser
475Note: Check the substitution changed the 3 to 4, 4 to 5 and so on. Now we can add a new line mentioning it as Article 3, and no need to do any manual changes.
476
477Example 12. Substituting the sentence beginnings with upper case. ( i.e title case the entire document ).
478
479While formatting a document, making the title case is also an important thing. It can be done easily with substitution.
480
481:%s/\.\s*\w/\=toupper(submatch(0))/g
482
483\.\s*\w – Search Pattern – literal . ( dot ) followed by Zero or more space, and a word character.
484toupper – converts the given text to upper case.
485submatch(0) – returns the matched pattern.
486Text before substitution:
487Lot of vi/vim tips and tricks are available at thegeekstuff.com. reading
488these articles will make you very productive. following activities can be
489done very easily using vim editor.
490        a. source code walk through,
491        b. record and play command executions,
492        c. making the vim editor as ide for several languages,
493        d. and several other @ vi/vim tips & tricks.
494
495
496###############
497# Permissions #
498###############
499
500Introduction
501
502In this section we'll learn about how to set Linux permissions on files and directories. Permissions specify what a particular person may or may not do with respect to a file or directory. As such, permissions are important in creating a secure environment. For instance you don't want other people to be changing your files and you also want system files to be safe from damage (either accidental or deliberate). Luckily, permissions in a Linux system are quite easy to work with.
503
504So what are they?
505
506Linux permissions dictate 3 things you may do with a file, read, write and execute. They are referred to in Linux by a single letter each.
507
508r read - you may view the contents of the file.
509w write - you may change the contents of the file.
510x execute - you may execute or run the file if it is a program or script.
511For every file we define 3 sets of people for whom we may specify permissions.
512
513owner - a single person who owns the file. (typically the person who created the file but ownership may be granted to some one else by certain users)
514group - every file belongs to a single group.
515others - everyone else who is not in the group or the owner.
516Three persmissions and three groups of people. That's about all there is to permissions really. Now let's see how we can view and change them.
517
518View Permissions
519
520To view permissions for a file we use the long listing option for the command ls.
521
522ls -l [path]
523
524ls -l /home/ryan/linuxtutorialwork/frog.png
525-rwxr----x 1 harry users 2.7K Jan 4 07:32 /home/ryan/linuxtutorialwork/frog.png
526In the above example the first 10 characters of the output are what we look at to identify permissions.
527
528The first character identifies the file type. If it is a dash ( - ) then it is a normal file. If it is a d then it is a directory.
529The following 3 characters represent the permissions for the owner. A letter represents the presence of a permission and a dash ( - ) represents the absence of a permission. In this example the owner has all permissions (read, write and execute).
530The following 3 characters represent the permissions for the group. In this example the group has the ability to read but not write or execute. Note that the order of permissions is always read, then write then execute.
531Finally the last 3 characters represent the permissions for others (or everyone else). In this example they have the execute permission and nothing else.
532Change Permissions
533
534To change permissions on a file or directory we use a command called chmod It stands for change file mode bits which is a bit of a mouthfull but think of the mode bits as the permission indicators.
535
536chmod [permissions] [path]
537
538chmod has permission arguments that are made up of 3 components
539
540Who are we changing the permission for? [ugoa] - user (or owner), group, others, all
541Are we granting or revoking the permission - indicated with either a plus ( + ) or minus ( - )
542Which permission are we setting? - read ( r ), write ( w ) or execute ( x )
543The following examples will make their usage clearer.
544
545Grant the execute permission to the group. Then remove the write permission for the owner.
546
547ls -l frog.png
548-rwxr----x 1 harry users 2.7K Jan 4 07:32 frog.png
549chmod g+x frog.png
550ls -l frog.png
551-rwxr-x--x 1 harry users 2.7K Jan 4 07:32 frog.png
552chmod u-w frog.png
553ls -l frog.png
554-r-xr-x--x 1 harry users 2.7K Jan 4 07:32 frog.png
555Don't want to assign permissions individually? We can assign multiple permissions at once.
556
557ls -l frog.png
558-rwxr----x 1 harry users 2.7K Jan 4 07:32 frog.png
559chmod g+wx frog.png
560ls -l frog.png
561-rwxrwx--x 1 harry users 2.7K Jan 4 07:32 frog.png
562chmod go-x frog.png
563ls -l frog.png
564-rwxrw---- 1 harry users 2.7K Jan 4 07:32 frog.png
565It may seem odd that as the owner of a file we can remove our ability to read, write and execute that file but there are valid reasons we may wish to do this. Maybe we have a file with data in it we wish not to accidentally change for instance. While we may remove these permissions, we may not remove our ability to set those permissions and as such we always have control over every file under our ownership.
566
567Setting Permissions Shorthand
568
569The method outlined above is not too hard for setting permissions but it can be a little tedious if we have a specific set of permissions we sould like to apply regularly to certain files (scripts for instance that we'll see in section 13). Luckily, there is a shorthand way to specify permissions that makes this easy.
570
571To understand how this shorthand method works we first need a little background in number systems. Our typical number system is decimal. It is a base 10 number system and as such has 10 symbols (0 - 9) used. Another number system is octal which is base 8 (0-7). Now it just so happens that with 3 permissions and each being on or off, we have 8 possible combinations (2^3). Now we can also represent our numbers using binary which only has 2 symbols (0 and 1). The mapping of octal to binary is in the table below.
572
573Octal	Binary
5740	0 0 0
5751	0 0 1
5762	0 1 0
5773	0 1 1
5784	1 0 0
5795	1 0 1
5806	1 1 0
5817	1 1 1
582(To learn more about binary numbers check out our Binary Tutorial.)
583
584Now the interesting point to note is that we may represent all 8 octal values with 3 binary bits and that every possible combination of 1 and 0 is included in it. So we have 3 bits and we also have 3 permissions. If you think of 1 as representing on and 0 as off then a single octal number may be used to represent a set of permissions for a set of people. Three numbers and we can specify permissions for the user, group and others. Let's see some examples. (refer to the table above to see how they match)
585
586ls -l frog.png
587-rw-r----x 1 harry users 2.7K Jan 4 07:32 frog.png
588chmod 751 frog.png
589ls -l frog.png
590-rwxr-x--x 1 harry users 2.7K Jan 4 07:32 frog.png
591chmod 240 frog.png
592ls -l frog.png
593--w-r----- 1 harry users 2.7K Jan 4 07:32 frog.png
594People often remember commonly used number sequences for different types of files and find this method quite convenient. For example 755 or 750 are commonly used for scripts.
595
596Permissions for Directories
597
598The same series of permissions may be used for directories but they have a slightly different behaviour.
599
600r - you have the ability to read the contents of the directory (ie do an ls)
601w - you have the ability to write into the directory (ie create files and directories)
602x - you have the ability to enter that directory (ie cd)
603Let's see some of these in action
604
605ls testdir
606file1 file2 file3
607chmod 400 testdir
608ls -ld testdir
609-r-------- 1 ryan users 2.7K Jan 4 07:32 testdir
610cd testdir
611cd: testdir: Permission denied
612ls testdir
613file1 file2 file3
614chmod 100 testdir
615ls -ld testdir
616---x------ 1 ryan users 2.7K Jan 4 07:32 testdir
617cd testdir
618ls testdir
619ls: cannot open directory testdir/: Permission denied
620Note, on lines 5 and 14 above when we ran ls I included the -d option which stands for directory. Normally if we give ls an argument which is a directory it will list the contents of that directory. In this case however we are interested in the permissions of the directory directly and the -d option allows us to obtain that.
621
622These permissions can seem a little confusing at first. What we need to remember is that these permissions are for the directory itself, not the files within. So, for example, you may have a directory which you don't have the read permission for. It may have files within it which you do have the read permission for. As long as you know the file exists and it's name you can still read the file.
623
624ls -ld testdir
625--x------- 1 ryan users 2.7K Jan 4 07:32 testdir
626cd testdir
627ls testdir
628ls: cannot open directory .: Permission denied
629cat samplefile.txt
630Kyle 20
631Stan 11
632Kenny 37
633The root user
634
635On a Linux system there are only 2 people usually who may change the permissions of a file or directory. The owner of the file or directory and the root user. The root user is a superuser who is allowed to do anything and everything on the system. Typically the administrators of a system would be the only ones who have access to the root account and would use it to maintain the system. Typically normal users would mostly only have access to files and directories in their home directory and maybe a few others for the purposes of sharing and collaborating on work and this helps to maintain the security and stability of the system.
636
637Basic Security
638
639Your home directory is your own personal space on the system. You should make sure that it stays that way.
640
641Most users would give themselves full read, write and execute permissions for their home directory and no permissions for the group or others however some people for various reasons may have a slighly different set up.
642
643Normally, for optimal security, you should not give either the group or others write access to your home directory, but execute without read can come in handy sometimes. This allows people to get into your home directory but not allow them to see what is there. An example of when this is used is for personal web pages.
644
645It is typical for a system to run a webserver and allow users to each have their own web space. A common set up is that if you place a directory in your home directory called public_html then the webserver will read and display the contents of it. The webserver runs as a different user to you however so by default will not have access to get in and read those files. This is a situation where it is necessary to grant execute on your home directory so that the webserver user may access the required resources.
646
647Summary
648
649chmod
650Change permissions on a file or directory.
651ls -ld
652View the permissions for a specific directory.
653Security
654Correct permissions are important for the security of a system.
655Usage
656Setting the right permissions is important in the smooth running of certain tasks on Linux. (we will see an example of this in Section 13 on scripting)
657Activities
658
659Let's play with some permissions.
660
661First off, take a look at the permissions of your home directory, then have a look at the permissions of various files in there.
662Now let's go into your linuxtutorialwork directory and change the permissions of some of the files in there. Make sure you use both the shorthand and longhand form for setting permissions and that you also use a variety of absolute and relative paths. Try removing the read permission from a file then reading it. Or removing the write permission and then opening it in vi.
663Let's play with directories now. Create a directory and put some files into it. Now play about with removing various permissions from yourself on that directory and see what you can and can't do.
664Finally, have an explore around the system and see what the general permissions are for files in other system directories such as /etc and /bin
665
666
667######################
668# Process Management #
669######################
670
671Introduction
672
673Linux in general is a fairly stable system. Occasionally, things do go wrong however and sometimes we also wish to tweak the running of the system to better suit our needs. In this section we will take a brief look at how we may manage programs, or processes on a Linux system.
674
675So what are they?
676
677A program is a series of instructions that tell the computer what to do. When we run a program, those instructions are copied into memory and space is allocated for variables and other stuff required to manage its execution. This running instance of a program is called a process and it's processes which we manage.
678
679What is Currently Running?
680
681Linux, like most modern OS's is a multitasking operating system. This means that many processes can be running at the same time. As well as the processes we are running, there may be other users on the system also running stuff and the OS itself will usually also be running various processes which it uses to manage everything in general. If we would like to get a snapshot of what is currently happening on the system we may use a program called top.
682
683top
684
685Below is a simplified version of what you should see when you run this program.
686
687top
688Tasks: 174 total, 3 running, 171 sleeping, 0 stopped
689KiB Mem: 4050604 total, 3114428 used, 936176 free
690Kib Swap: 2104476 total, 18132 used, 2086344 free
691 
692 PID USER %CPU %MEM COMMAND
6936978 ryan 3.0  21.2 firefox
694  11 root 0.3   0.0 rcu_preempt
6956601 ryan 2.0   2.4 kwin
696...
697Let's break it down:
698
699Line 2 Tasks is just another name for processes. It's typical to have quite a few processes running on your system at any given time. Most of them will be system processes. Many of them will typically be sleeping. This is ok. It just means they are waiting until a particular event occurs, which they will then act upon.
700Line 3 This is a breakdown of working memory (RAM). Don't worry if a large amount of your memory is used. Linux keeps recently used programs in memory to speed up performance if they are run again. If another process needs that memory, they can easily be cleared to accommodate this.
701Line 4 This is a breakdown of Virtual memory on your system. If a large amount of this is in use, you may want to consider increasing it's size. For most people with most modern systems having gigabytes of RAM you shouldn't experience any issues here.
702Lines 6 - 10 Finally is a listing of the most resource intensive processes on the system (in order of resource usage). This list will update in real time and so is interesting to watch to get an idea of what is happening on your system. The two important columns to consider are memory and CPU usage. If either of these is high for a particular process over a period of time, it may be worth looking into why this is so.The USER column shows who owns the process and the PID column identifies a process's Process ID which is a unique identifier for that process.
703Top will give you a realtime view of the system and only show the number of processes which will fit on the screen. Another program to look at processes is called ps which stands for processes. In it's normal usage it will show you just the processes running in your current terminal (which is usually not very much). If we add the argument aux then it will show a complete system view which is a bit more helpful.
704
705ps [aux]
706
707It does give quite a bit of output so people usually pipe the output to grep to filter out just the data they are after. We will see in the next bit an example of this.
708
709Killing a Crashed Process
710
711It doesn't happen often, but when a program crashes, it can be quite annoying. Let's say we've got our browser running and all of a sudden it locks up. You try and close the window but nothing happens, it has become completely unresponsive. No worries, we can easily kill Firefox and then reopen it. To start off we need to identify the process id.
712
713ps aux | grep 'firefox'
714ryan 6978 8.8 23.5 2344096 945452 ? Sl 08:03 49:53 /usr/lib64/firefox/firefox
715It is the number next to the owner of the process that is the PID (Process ID). We will use this to identify which process to kill. To do so we use a program which is appropriately called kill.
716
717kill [signal] <PID>
718
719kill 6978
720ps aux | grep 'firefox'
721ryan 6978 8.8 23.5 2344096 945452 ? Sl 08:03 49:53 /usr/lib64/firefox/firefox
722Sometimes you are lucky and just running kill normally will get the process to stop and exit. When you do this kill sends the default signal ( 1 ) to the process which effectively asks the process nicely to quit. We always try this option first as a clean quit is the best option. Sometimes this does not work however. In the example above we ran ps again and saw that the process was still running. No worries, we can run kill again but this time supply a signal of 9 which effectively means, go in with a sledge hammer and make sure the process is well and truly gone.
723
724kill -9 6978
725ps aux | grep 'firefox'
726Normal users may only kill processes which they are the owner for. The root user on the system may kill anyones processes.
727
728My Desktop has locked up
729
730On rare occassions, when a process crashes and locks up, it can lock up the entire desktop. If this happens there is still hope.
731
732Linux actually runs several virtual consoles. Most of the time we only see console 7 which is the GUI but we can easily get to the others. If the GUI has locked up, and we are in luck, we can get to another console and kill the offending process from there. To switch between consoles you use the keyboard sequence CTRL + ALT + F<Console>. So CTRL + ALT F2 will get you to a console (if all goes well) where you can run the commands as above to identify process ids and kill them. Then CTRL + ALT F7 will get you back to the GUI to see if it has been fixed. The general approach is to keep killing processes until the lock up is fixed. Normally you can look for tell tale signs such as high CPU or Memory usage and start with those processes first. Sometimes this approach works, sometimes it doesn't and you need to restart the computer. Just depends how lucky you are.
733
734Foreground and Background Jobs
735
736You probably won't need to do too much with foreground and background jobs but it's worth knowing about them just for those rare occassions. When we run a program normally (like we have been doing so far) they are run in the foreground. Most of them run to completion in a fraction of a second as well. Maybe we wish to start a process that will take a bit of time and will happily do it's thing without intervention from us (processing a very large text file or compiling a program for instance). What we can do is run the program in the background and then we can continue working. We'll demonstrate this with a program called sleep. All sleep does is wait a given number of seconds and then quit. We can also use a program called jobs which lists currently running background jobs for us.
737
738jobs
739
740sleep 5
741If you run the above example yourself, you will notice that the terminal waits 5 seconds before presenting you with a prompt again. Now if we run the same command but instead put an ampersand ( & ) at the end of the command then we are telling the terminal to run this process in the background.
742
743sleep 5 &
744[1] 21634
745[1]+ Done sleep 5
746This time you will notice that it assigns the process a job number, and tells us what that number is, and gives us the prompt back straight away. We can continue working while the process runs in the background. If you wait 5 seconds or so and then hit ENTER you will see a message come up telling you the job has completed.
747
748We can move jobs between the foreground and background as well. If you press CTRL + z then the currently running foreground process will be paused and moved into the background. We can then use a program called fg which stands for foreground to bring background processes into the foreground.
749
750fg <job number>
751
752sleep 15 &
753[1] 21637
754sleep 10
755(you press CTRL + z, notice the prompt comes back.)
756jobs
757[1]- Running sleep 15 &
758[2]+ Stopped sleep 10
759fg 2
760[1] Done sleep 15
761CTRL + z is used in Windows but for the purpose of running the undo command. It is not uncommon for people coming from the Windows world to accidentally hit the key combo (especially in the editor VI for instance) and wonder why their program just dissappeared and the prompt returned. If you do this, don't worry, you can use jobs to identify which job it has been assigned to and then fg to bring it back and continue working.
762
763Summary
764
765top
766View real-time data about processes running on the system.
767ps
768Get a listing of processes running on the system.
769kill
770End the running of a process.
771jobs
772Display a list of current jobs running in the background.
773fg
774Move a background process into the foreground.
775ctrl + z
776Pause the current foreground process and move it into the background.
777Control
778We have quite a bit of control over the running of our programs.
779Activities
780
781Time for some fun:
782
783First off, start a few programs in your desktop. Then use ps to identify their PID and kill them.
784Now see if you can do the same, but switch to another virtual console first.
785Finally, play about with the command sleep and moving processes between the foreground and background.
786
787
788
789
790#################
791# IPTables Demo #
792#################
793- Reference:
794http://www.thegeekstuff.com/2011/06/iptables-rules-examples/
795
796- Delete Existing Rules
797---------------------
798sudo /sbin/iptables -F
799	(or)
800sudo /sbin/iptables --flush
801
802
803
804- Set Default Chain Policies
805--------------------------
806iptables -P INPUT DROP
807iptables -P FORWARD DROP
808iptables -P OUTPUT DROP
809
810
811
812- Delete Existing Rules
813---------------------
814sudo /sbin/iptables -F
815	(or)
816sudo /sbin/iptables --flush
817
818
819- Block a Specific ip-address
820---------------------------
821BLOCK_THIS_IP="1.2.3.4"
822iptables -A INPUT -s "$BLOCK_THIS_IP" -j DROP
823
824
825iptables -A INPUT -i eth0 -s "$BLOCK_THIS_IP" -j DROP
826iptables -A INPUT -i eth0 -p tcp -s "$BLOCK_THIS_IP" -j DROP
827
828
829- Allow ALL Incoming SSH
830----------------------
831iptables -A INPUT -i eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
832iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
833
834
835- Allow Incoming SSH only from a Sepcific Network
836-----------------------------------------------
837iptables -A INPUT -i eth0 -p tcp -s 192.168.100.0/24 --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
838iptables -A OUTPUT -o eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
839
840
841- Allow Incoming HTTP and HTTPS
842-----------------------------
843iptables -A INPUT -i eth0 -p tcp --dport 80 -m state --state NEW,ESTABLISHED -j ACCEPT
844iptables -A OUTPUT -o eth0 -p tcp --sport 80 -m state --state ESTABLISHED -j ACCEPT
845
846
847iptables -A INPUT -i eth0 -p tcp --dport 443 -m state --state NEW,ESTABLISHED -j ACCEPT
848iptables -A OUTPUT -o eth0 -p tcp --sport 443 -m state --state ESTABLISHED -j ACCEPT
849
850
851
852- Combine Multiple Rules Together using MultiPorts
853------------------------------------------------
854iptables -A INPUT -i eth0 -p tcp -m multiport --dports 22,80,443 -m state --state NEW,ESTABLISHED -j ACCEPT
855iptables -A OUTPUT -o eth0 -p tcp -m multiport --sports 22,80,443 -m state --state ESTABLISHED -j ACCEPT                                                                                                                                                                                 
856
857
858- Allow Outgoing SSH
859------------------
860iptables -A OUTPUT -o eth0 -p tcp --dport 22 -m state --state NEW,ESTABLISHED -j ACCEPT
861iptables -A INPUT -i eth0 -p tcp --sport 22 -m state --state ESTABLISHED -j ACCEPT
862
863
864
865
866
867
868
869
870
871####################
872# MD5 Hashing Demo #
873####################
874mkdir ~/demo
875cd ~/demo
876
877
878
879mkdir hashdemo
880cd hashdemo
881echo test > test.txt
882cat test.txt
883md5sum test.txt
884echo hello >> test.txt
885cat test.txt
886md5sum test.txt
887cd ..
888
889
890
891Reference:
892https://www.howtoforge.com/tutorial/linux-commandline-encryption-tools/
893
894
895#################################
896# Symmetric Key Encryption Demo #
897#################################
898mkdir gpgdemo
899cd gpgdemo
900echo test > test.txt
901cat test.txt
902gpg -c test.txt
903	password
904	password
905ls | grep test
906cat test.txt
907cat test.txt.gpg
908rm -rf test.txt
909ls | grep test
910gpg -o output.txt test.txt.gpg
911cat output.txt
912
913
914#########################################################################################################################
915# Asymmetric Key Encryption Demo 											                                            #
916#															                                                            #
917# Configure random number generator 											                                        #
918# https://www.howtoforge.com/helping-the-random-number-generator-to-gain-enough-entropy-with-rng-tools-debian-lenny	    #
919#########################################################################################################################
920
921sudo apt-get install rng-tools
922	strategicsec
923
924/etc/init.d/rng-tools start
925
926sudo rngd -r /dev/urandom
927	strategicsec
928
929
930echo hello > file1.txt
931echo goodbye > file2.txt
932echo green > file3.txt
933echo blue > file4.txt
934
935tar czf files.tar.gz *.txt
936
937gpg --gen-key
938	1
939	1024
940	0
941	y
942	John Doe
943	john@doe.com
944	--blank comment--
945	O
946		password
947		password	
948
949
950
951gpg --armor --output file-enc-pubkey.txt --export 'John Doe'
952
953cat file-enc-pubkey.txt
954
955gpg --armor --output file-enc-privkey.asc --export-secret-keys 'John Doe'
956
957cat file-enc-privkey.asc
958
959gpg --encrypt --recipient 'John Doe' files.tar.gz
960
961rm -rf files.tar.gz *.txt
962
963ls
964
965tar -zxvf files.tar.gz.gpg
966
967gpg --output output.tar.gz --decrypt files.tar.gz.gpg
968	password
969
970tar -zxvf output.tar.gz
971
972ls
973
974Reference:
975http://linoxide.com/security/gpg-comand-linux-how-to-encrypt-and-decrypt-file/
976
977
978
979############################
980# Encryption using OpenSSL #
981############################
982openssl genrsa -out private_key.pem 1024
983openssl rsa -in private_key.pem -out public_key.pem -outform PEM -pubout
984
985
986echo hello > encrypt.txt
987openssl rsautl -encrypt -inkey public_key.pem -pubin -in encrypt.txt -out encrypt.dat
988
989cat encrypt.dat
990
991rm -rf encrypt.txt
992
993ls
994
995openssl rsautl -decrypt -inkey private_key.pem -in encrypt.dat -out decrypt.txt
996
997cat decrypt.txt
998
999
1000
1001
1002##############################################
1003# Log Analysis with Linux command-line tools #
1004##############################################
1005- The following command line executables are found in the Mac as well as most Linux Distributions.
1006 
1007cat –  prints the content of a file in the terminal window
1008grep – searches and filters based on patterns
1009awk –  can sort each row into fields and display only what is needed
1010sed –  performs find and replace functions
1011sort – arranges output in an order
1012uniq – compares adjacent lines and can report, filter or provide a count of duplicates
1013 
1014 
1015 
1016###############
1017# Apache Logs #
1018###############
1019 
1020Reference:
1021http://www.the-art-of-web.com/system/logs/
1022 
1023wget https://s3.amazonaws.com/SecureNinja/Python/access_log
1024 
1025 
1026- You want to list all user agents ordered by the number of times they appear (descending order):
1027 
1028awk -F\" '{print $6}' access_log | sort | uniq -c | sort -fr
1029 
1030 
1031 
1032- Using the default separator which is any white-space (spaces or tabs) we get the following:
1033 
1034awk '{print $1}' access_log         # ip address (%h)
1035awk '{print $2}' access_log         # RFC 1413 identity (%l)
1036awk '{print $3}' access_log         # userid (%u)
1037awk '{print $4,5}' access_log       # date/time (%t)
1038awk '{print $9}' access_log         # status code (%>s)
1039awk '{print $10}' access_log        # size (%b)
1040 
1041- You might notice that we've missed out some items. To get to them we need to set the delimiter to the " character which changes the way the lines are 'exploded' and allows the following:
1042 
1043awk -F\" '{print $2}' access_log    # request line (%r)
1044awk -F\" '{print $4}' access_log    # referer
1045awk -F\" '{print $6}' access_log    # user agent
1046 
1047 
1048awk -F\" '{print $6}' access_log \
1049  | sed 's/(\([^;]\+; [^;]\+\)[^)]*)/(\1)/' \
1050  | sort | uniq -c | sort -fr
1051 
1052 
1053- The next step is to start filtering the output so you can narrow down on a certain page or referer. Would you like to know which pages Google has been requesting from your site?
1054 
1055awk -F\" '($6 ~ /Googlebot/){print $2}' access_log | awk '{print $2}'
1056Or who's been looking at your guestbook?
1057 
1058awk -F\" '($2 ~ /guestbook\.html/){print $6}' access_log
1059 
1060 
1061Reference:
1062https://blog.nexcess.net/2011/01/21/one-liners-for-apache-log-files/
1063 
1064# top 20 URLs from the last 5000 hits
1065tail -5000 ./access_log | awk '{print $7}' | sort | uniq -c | sort -rn | head -20
1066tail -5000 ./access_log | awk '{freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
1067 
1068# top 20 URLS excluding POST data from the last 5000 hits
1069tail -5000 ./access_log | awk -F"[ ?]" '{print $7}' | sort | uniq -c | sort -rn | head -20
1070tail -5000 ./access_log | awk -F"[ ?]" '{freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
1071 
1072# top 20 IPs from the last 5000 hits
1073tail -5000 ./access_log | awk '{print $1}' | sort | uniq -c | sort -rn | head -20
1074tail -5000 ./access_log | awk '{freq[$1]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
1075 
1076# top 20 URLs requested from a certain ip from the last 5000 hits
1077IP=1.2.3.4; tail -5000 ./access_log | grep $IP | awk '{print $7}' | sort | uniq -c | sort -rn | head -20
1078IP=1.2.3.4; tail -5000 ./access_log | awk -v ip=$IP ' $1 ~ ip {freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
1079 
1080# top 20 URLS requested from a certain ip excluding, excluding POST data, from the last 5000 hits
1081IP=1.2.3.4; tail -5000 ./access_log | fgrep $IP | awk -F "[ ?]" '{print $7}' | sort | uniq -c | sort -rn | head -20
1082IP=1.2.3.4; tail -5000 ./access_log | awk -F"[ ?]" -v ip=$IP ' $1 ~ ip {freq[$7]++} END {for (x in freq) {print freq[x], x}}' | sort -rn | head -20
1083 
1084# top 20 referrers from the last 5000 hits
1085tail -5000 ./access_log | awk '{print $11}' | tr -d '"' | sort | uniq -c | sort -rn | head -20
1086tail -5000 ./access_log | awk '{freq[$11]++} END {for (x in freq) {print freq[x], x}}' | tr -d '"' | sort -rn | head -20
1087 
1088# top 20 user agents from the last 5000 hits
1089tail -5000 ./access_log | cut -d\  -f12- | sort | uniq -c | sort -rn | head -20
1090 
1091# sum of data (in MB) transferred in the last 5000 hits
1092tail -5000 ./access_log | awk '{sum+=$10} END {print sum/1048576}'
1093 
1094 
1095##############
1096# Cisco Logs #
1097##############
1098 
1099wget https://s3.amazonaws.com/StrategicSec-Files/LogAnalysis/cisco.log
1100 
1101 
1102AWK Basics
1103----------
1104- To quickly demonstrate the print feature in awk, we can instruct it to show only the 5th word of each line. Here we will print $5. Only the last 4 lines are being shown for brevity.
1105 
1106cat cisco.log | awk '{print $5}' | tail -n 4
1107 
1108 
1109 
1110 
1111- Looking at a large file would still produce a large amount of output. A more useful thing to do might be to output every entry found in “$5”, group them together, count them, then sort them from the greatest to least number of occurrences. This can be done by piping the output through “sort“, using “uniq -c” to count the like entries, then using “sort -rn” to sort it in reverse order.
1112 
1113cat cisco.log | awk '{print $5}'| sort | uniq -c | sort -rn
1114 
1115 
1116 
1117 
1118- While that’s sort of cool, it is obvious that we have some garbage in our output. Evidently we have a few lines that aren’t conforming to the output we expect to see in $5. We can insert grep to filter the file prior to feeding it to awk. This insures that we are at least looking at lines of text that contain “facility-level-mnemonic”.
1119 
1120cat cisco.log | grep %[a-zA-Z]*-[0-9]-[a-zA-Z]* | awk '{print $5}' | sort | uniq -c | sort -rn
1121 
1122 
1123 
1124 
1125 
1126- Now that the output is cleaned up a bit, it is a good time to investigate some of the entries that appear most often. One way to see all occurrences is to use grep.
1127 
1128cat cisco.log | grep %LINEPROTO-5-UPDOWN:
1129 
1130cat cisco.log | grep %LINEPROTO-5-UPDOWN:| awk '{print $10}' | sort | uniq -c | sort -rn
1131 
1132cat cisco.log | grep %LINEPROTO-5-UPDOWN:| sed 's/,//g' | awk '{print $10}' | sort | uniq -c | sort -rn
1133 
1134cat cisco.log | grep %LINEPROTO-5-UPDOWN:| sed 's/,//g' | awk '{print $10 " changed to " $14}' | sort | uniq -c | sort -rn
1135
1136
1137
1138###########################
1139# Target IP Determination #
1140###########################
1141- This portion starts the actual workshop content
1142- Zone Transfer fails on most domains, but here is an example of one that works:
1143dig axfr heartinternet.co.uk  @ns.heartinternet.co.uk
1144
1145
1146- Usually you will need to do a DNS brute-force with something like blindcrawl or fierce
1147perl blindcrawl.pl -d motorola.com
1148	Look up the IP addresses at: 
1149	http://www.networksolutions.com/whois/index.jsp
1150
1151cd ~/toolz/fierce2
1152sudo apt-get install -y cpanminus cpan-listchanges cpanoutdated libappconfig-perl libyaml-appconfig-perl libnetaddr-ip-perl libnet-cidr-perl vim
1153	strategicsec
1154wget http://search.cpan.org/CPAN/authors/id/A/AB/ABW/Template-Toolkit-2.14.tar.gz
1155tar -zxvf Template-Toolkit-2.14.tar.gz
1156cd Template-Toolkit-2.14/
1157perl Makefile.PL
1158	y
1159	y
1160	n
1161	y
1162sudo make install
1163
1164sudo bash install.sh
1165
1166./fierce
1167
1168./fierce -dns motorola.com
1169
1170cd ~/toolz/
1171
1172
1173
1174
1175- Here we do a forward lookup against an entire IP range. Basically take every IP in the range and see what it's hostname is
1176cd ~/toolz/
1177./ipcrawl 148.87.1.1 148.87.1.254				(DNS forward lookup against an IP range)
1178
1179
1180sudo nmap -sL 148.87.1.0-255
1181sudo nmap -sL 148.87.1.0-255 | grep oracle
1182
1183
1184	
1185
1186
1187
1188###########################
1189# Load Balancer Detection #
1190###########################
1191
1192- Here are some options to use for identifying load balancers:
1193	- http://toolbar.netcraft.com/site_report/
1194	- Firefox LiveHTTP Headers
1195
1196
1197- Here are some command-line options to use for identifying load balancers:
1198
1199dig google.com
1200
1201cd ~/toolz
1202./lbd-0.1.sh google.com
1203
1204
1205halberd microsoft.com
1206halberd motorola.com
1207halberd oracle.com
1208
1209
1210
1211
1212
1213######################################
1214# Web Application Firewall Detection #
1215######################################
1216
1217cd ~/toolz/wafw00f
1218python wafw00f.py http://www.oracle.com
1219python wafw00f.py http://www.strategicsec.com
1220
1221
1222cd ~/toolz/
1223sudo nmap -p 80 --script http-waf-detect.nse oracle.com
1224
1225sudo nmap -p 80 --script http-waf-detect.nse healthcare.gov
1226
1227
1228#########################
1229# Playing with Nmap NSE #
1230#########################
1231
1232nmap -Pn -p80 --script ip-geolocation-* strategicsec.com 
1233
1234nmap -p80 --script dns-brute strategicsec.com
1235
1236nmap --script http-robtex-reverse-ip secore.info
1237
1238nmap -Pn -p80 --script=http-headers strategicsec.com
1239
1240
1241ls /usr/share/nmap/scripts | grep http
1242nmap -Pn -p80 --script=http-* strategicsec.com
1243
1244sudo nmap -Pn -n --open -p21 --script=banner,ftp-anon,ftp-bounce,ftp-proftpd-backdoor,ftp-vsftpd-backdoor 148.87.1.0/24
1245
1246sudo nmap -Pn -n --open -p22 --script=sshv1,ssh2-enum-algos 148.87.1.0/24
1247
1248sudo nmap -Pn -n -sU --open -p53 --script=dns-blacklist,dns-cache-snoop,dns-nsec-enum,dns-nsid,dns-random-srcport,dns-random-txid,dns-recursion,dns-service-discovery,dns-update,dns-zeustracker,dns-zone-transfer 148.87.1.0/24
1249
1250sudo nmap -Pn -n --open -p111 --script=nfs-ls,nfs-showmount,nfs-statfs,rpcinfo 148.87.1.0/24
1251
1252sudo nmap -Pn -n --open -p445 --script=msrpc-enum,smb-enum-domains,smb-enum-groups,smb-enum-processes,smb-enum-sessions,smb-enum-shares,smb-enum-users,smb-mbenum,smb-os-discovery,smb-security-mode,smb-server-stats,smb-system-info,smbv2-enabled,stuxnet-detect 148.87.1.0/24
1253
1254sudo nmap -Pn -n --open -p1433 --script=ms-sql-dump-hashes,ms-sql-empty-password,ms-sql-info 148.87.1.0/24
1255
1256sudo nmap -Pn -n --open -p1521 --script=oracle-sid-brute --script oracle-enum-users --script-args oracle-enum-users.sid=ORCL,userdb=orausers.txt 148.87.1.0/24
1257
1258sudo nmap -Pn -n --open -p3306 --script=mysql-databases,mysql-empty-password,mysql-info,mysql-users,mysql-variables 148.87.1.0/24
1259
1260sudo nmap -Pn -n --open -p3389 --script=rdp-vuln-ms12-020,rdp-enum-encryption 148.87.1.0/24
1261
1262sudo nmap -Pn -n --open -p5900 --script=realvnc-auth-bypass,vnc-info 148.87.1.0/24
1263
1264sudo nmap -Pn -n --open -p6000-6005 --script=x11-access 148.87.1.0/24
1265
1266sudo nmap -Pn -n --open -p27017 --script=mongodb-databases,mongodb-info 148.87.1.0/24  
1267
1268############
1269# Nmap NSE #
1270############
1271
1272- Reference for this tutorial is:
1273https://thesprawl.org/research/writing-nse-scripts-for-vulnerability-scanning/
1274
1275----------------------------------------------------------------------
1276sudo vi /usr/share/nmap/scripts/intro-nse.nse
1277
1278-- The Head Section --
1279-- The Rule Section --
1280portrule = function(host, port)
1281    return port.protocol == "tcp"
1282            and port.number == 80
1283            and port.state == "open"
1284end
1285
1286-- The Action Section --
1287action = function(host, port)
1288    return "Linux for InfoSec Professionals!"
1289end
1290----------------------------------------------------------------------
1291
1292- Ok, now that we've made that change let's run the script
1293sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
1294
1295
1296
1297
1298
1299
1300----------------------------------------------------------------------
1301sudo vi /usr/share/nmap/scripts/intro-nse.nse
1302
1303-- The Head Section --
1304local shortport = require "shortport"
1305
1306-- The Rule Section --
1307portrule = shortport.http
1308
1309
1310-- The Action Section --
1311action = function(host, port)
1312    return "Linux for InfoSec Professionals!"
1313end
1314----------------------------------------------------------------------
1315
1316- Ok, now that we've made that change let's run the script
1317sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
1318
1319
1320
1321
1322
1323
1324
1325----------------------------------------------------------------------
1326sudo vi /usr/share/nmap/scripts/intro-nse.nse
1327
1328-- The Head Section --
1329local shortport = require "shortport"
1330local http = require "http"
1331
1332-- The Rule Section --
1333portrule = shortport.http
1334
1335-- The Action Section --
1336action = function(host, port)
1337
1338    local uri = "/blog/2016/4/2/meterpreter-new-windows-powershell-extension/"
1339    local response = http.get(host, port, uri)
1340    return response.status
1341
1342end
1343----------------------------------------------------------------------
1344
1345- Ok, now that we've made that change let's run the script
1346sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
1347
1348
1349
1350
1351----------------------------------------------------------------------
1352sudo vi /usr/share/nmap/scripts/intro-nse.nse
1353
1354-- The Head Section --
1355local shortport = require "shortport"
1356local http = require "http"
1357
1358-- The Rule Section --
1359portrule = shortport.http
1360
1361-- The Action Section --
1362action = function(host, port)
1363
1364    local uri = "/blog/2016/4/2/meterpreter-new-windows-powershell-extension/"
1365    local response = http.get(host, port, uri)
1366
1367    if ( response.status == 200 ) then
1368        return response.body
1369    end
1370
1371end
1372----------------------------------------------------------------------
1373
1374- Ok, now that we've made that change let's run the script
1375sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
1376
1377
1378
1379
1380
1381
1382
1383
1384
1385----------------------------------------------------------------------
1386sudo vi /usr/share/nmap/scripts/intro-nse.nse
1387
1388-- The Head Section --
1389local shortport = require "shortport"
1390local http = require "http"
1391local string = require "string"
1392
1393-- The Rule Section --
1394portrule = shortport.http
1395
1396-- The Action Section --
1397action = function(host, port)
1398
1399    local uri = "/blog/2016/4/2/meterpreter-new-windows-powershell-extension/"
1400    local response = http.get(host, port, uri)
1401
1402    if ( response.status == 200 ) then
1403        local title = string.match(response.body, "Pentest Candidate Program")
1404        return title
1405    end
1406
1407end
1408----------------------------------------------------------------------
1409
1410- Ok, now that we've made that change let's run the script
1411sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
1412
1413
1414
1415
1416
1417
1418
1419----------------------------------------------------------------------
1420sudo vi /usr/share/nmap/scripts/intro-nse.nse
1421
1422-- The Head Section --
1423local shortport = require "shortport"
1424local http = require "http"
1425local string = require "string"
1426
1427-- The Rule Section --
1428portrule = shortport.http
1429
1430-- The Action Section --
1431action = function(host, port)
1432
1433    local uri = "/blog/2016/4/2/meterpreter-new-windows-powershell-extension/"
1434    local response = http.get(host, port, uri)
1435
1436    if ( response.status == 200 ) then
1437        local title = string.match(response.body, "Pentest Candidate Program")
1438
1439        if (title) then
1440            return "Vulnerable"
1441        else
1442            return "Not Vulnerable"
1443        end
1444    end
1445end
1446
1447----------------------------------------------------------------------
1448
1449- Ok, now that we've made that change let's run the script
1450sudo nmap --script=/usr/share/nmap/scripts/intro-nse.nse darkoperator.com -p 22,80,443
1451
1452
1453
1454
1455
1456
1457
1458######################
1459# Intro to scripting #
1460######################
1461
1462Introduction
1463
1464So this is the last section in this tutorial. Here we will introduce a concept called scripting.
1465
1466This will be a brief introduction to Bash scripting. There is a lot more you can do but my aim here is to get you started and give you just enough that you can do useful work.
1467
1468This section brings together a lot of what we learnt in previous sections (you'll see them referred to often). If some of this stuff doesn't really make sense, you may need to look back over previous sections and refresh your memory.
1469
1470See our Bash Scripting Tutorial for a more comprehensive look into Bash Scripting.
1471
1472So what are they?
1473
1474A Bash script in computing terms is similar to a script in theatrical terms. It is a document stating what to say and do. Here, instead of the script being read and acted upon by a person, it is read and acted upon (or executed) by the computer.
1475
1476A Bash script allows us to define a series of actions which the computer will then perform without us having to enter the commands ourselves. If a particular task is done often, or it is repetetive, then a script can be a useful tool.
1477
1478A Bash script is interpreted (read and acted upon) by something called an interpreter. There are various interpreters on a typical linux system but we have been learning the Bash shell so we'll introduce bash scripts here.
1479
1480Anything you can run on the command line you may place into a script and they will behave exactly the same. Vice versa, anything you can put into a script, you may run on the command line and again it will perform exactly the same.
1481
1482The above statement is important to understand when creating scripts. When testing different parts of your script, as you're building it, it is often easiest to just run your commands directly on the command line.
1483
1484A script is just a plain text file and it may have any name you like. You create them the same way you would any other text file, with just a plain old text editor (such as VI which we looked at in section 6).
1485
1486A Simple Example
1487
1488Below is a simple script. I recommend you create a similar file yourself and run it to get a feel for how they work. This script will print a message to the screen (using a program called echo) then give us a listing of what is in our current directory.
1489
1490echo <message>
1491
1492cat myscript.sh
1493#!/bin/bash
1494# A simple demonstration script
1495# Ryan 8/1/2017
1496 
1497echo Here are the files in your current directory:
1498ls
1499ls -l myscript.sh
1500-rwxr-xr-x 1 ryan users 2 Jun 4 2012 myscript.sh
1501./myscript.sh
1502Here are the files in your current directory:
1503barry.txt bob example.png firstfile foo1 myoutput video.mpeg
1504Let's break it down:
1505
1506Line 1 Let's start off by having a look at our script. Linux is an extensionless system so it is not required for scripts to have a .sh extension. It is common to put them on however to make them easy to identify.
1507Line 2 The very first line of a script should always be this line. This line identifies which interpreter should be used. The first two characters are referred to as a shebang. After that (important, no spaces) is the path to the interpreter.
1508Lines 3 and 4 Anything following a # is a comment. The interpreter will not run this, it is just here for our benefit. It is good practice to include your name, and the date you wrote the script as well as a one line quick description of what it does at the top of the script.
1509Line 6 We'll use a program called echo It will merely print whatever you place after it, as command line arguments, to the screen. Useful for printing messages.
1510Line 7 The next step of our script is to print the contents of our current directory.
1511Line 9 A script must have the execute permission before it may be run. Here I am just demonstrating that the file does have the right permissions..
1512Line 12 Now we run the script. I'll explain why we need the ./ a bit further down.
1513Lines 13 and 14 The output from running (or executing) our script.
1514Phew. A lot of important points were covered quite quickly there. Now let's have a look at them in more detail.
1515
1516Important Points
1517
1518The Shebang
1519
1520The very first line of a script should tell the system which interpreter should be used on this file. It is important that this is the very first line of the script. It is also important that there are no spaces. The first two characters #! (the shebang) tell the system that directly after it will be a path to the interpreter to be used. If we don't know where our interpreter is located then we may use a program called which to find out.
1521
1522which <program>
1523
1524which bash
1525/bin/bash
1526which ls
1527/usr/bin/ls
1528If we leave this line out then our Bash script may still work. Most shells (bash included) will assume they are the interpreter if one is not specified. It is good practice to always include the interpreter however. Later on, you, or someone else, may run your script in conditions under which bash is not the shell currently in use and this could lead to undesireable outcomes.
1529
1530The Name
1531
1532Linux is an extensionless system. That means we may call our script whatever we like and it will not affect it's running in any way. While it is typical to put a .sh extension on our scripts, this is purely for convenience and is not required. We could name our script above simply myscript or even myscript.jpg and it would still run quite happily.
1533
1534Comments
1535
1536A comment is just a note in the script that does not get run, it is merely there for your benefit. Comments are easy to put in, all you need to do is place a hash ( # ) then anything after that is considered a comment. A comment can be a whole line or at the end of a line.
1537
1538cat myscript.sh
1539#!/bin/bash
1540# A comment which takes up a whole line
1541ls # A comment at the end of the line
1542It is common practice to include a comment at the top of a script with a brief description of what the script does and also who wrote it and when. These are just basic things which people often wish to know about a script.
1543
1544For the rest of the script, it is not necessary to comment every line. Most lines it will be self explanatory what they do. Only put comments in for important lines or to explain a particular command whose operation may not be immediately obvious.
1545
1546Why the ./ ?
1547
1548Linux is set up the way it is, largely for logical reasons. This peculiarity actually makes the system a bit safer for us. First a bit of background knowledge. When we type a command on the command line, the system runs through a preset series of directories, looking for the program we specified. We may find out these directories by looking at a particular variable PATH (more on these in the next section).
1549
1550echo $PATH
1551/usr/local/bin:/usr/bin:/bin:/usr/bin/X11:/usr/X11R6/bin:/usr/games:/usr/lib/mit/bin:/usr/lib/mit/sbin
1552The system will look in the first directory and if it finds the program it will run it, if not it will check the second directory and so on. Directories are separated by a colon ( : ).
1553
1554The system will not look in any directories apart from these, it won't even look in your current directory. We can override this behaviour however by supplying a path. When we do so the system effectively says "Ah, you've told me where to look to find the script so I'll ignore the PATH and go straight to the location you've specified instead." You'll remember from section 2 (Basic Navigation) that a full stop ( . ) represents our current directory, so when we say ./myscript.sh we are actually tellling the system to look in our current directory to find the script. We could have used an absolute path as well ( /home/ryan/linuxtutorialwork/myscript.sh ) and it would have worked exactly the same, or a relative path if we are not currently in the same directory as the script ( ../linuxtutorialwork/myscript.sh ).
1555
1556If it were possible to run scripts in your current directory without this mechanism then it would be easy, for instance, for someone to create a malicious script in a particular directory and name it ls or something similar. People would inadventently run it if they wanted to see what was in that directory.
1557
1558Permissions
1559
1560A script must have the execute permission before we may run it (even if we are the owner of the file). For safety reasons, you don't have execute permission by default so you have to add it. A good command to run to ensure your script is set up right is chmod 755 <script>.
1561
1562Variables
1563
1564A variable is a container for a simple piece of data. They are useful if we need to work out a particular thing and then use it later on. Variables are easy to set and refer to but they have a specific syntax that must be followed exactly for them to work.
1565
1566When we set a variable, we specify it's name, followed directly by an equals sign ( = ) followed directly by the value. (So, no spaces on either side of the = sign.)
1567When we refer to a variable, we must place a dollar sign ( $ ) before the variable name.
1568A simple example.
1569
1570cat variableexample.sh
1571#!/bin/bash
1572# A simple demonstration of variables
1573# Ryan 8/1/2017
1574 
1575name='Ryan'
1576echo Hello $name
1577./variableexample.sh
1578Hello Ryan
1579Command line arguments and More
1580
1581When we run a script, there are several variables that get set automatically for us. Here are some of them:
1582
1583$0 - The name of the script.
1584$1 - $9 - Any command line arguments given to the script. $1 is the first argument, $2 the second and so on.
1585$# - How many command line arguments were given to the script.
1586$* - All of the command line arguments.
1587There are other variables but these should be enough to get you going for now.
1588
1589cat morevariables.sh
1590#!/bin/bash
1591# A simple demonstration of variables
1592# Ryan 8/1/2017
1593 
1594echo My name is $0 and I have been given $# command line arguments
1595echo Here they are: $*
1596echo And the 2nd command line argument is $2
1597./morevariables.sh bob fred sally
1598My name is morevariables.sh and I have been given 3 command line arguments
1599Here they are: bob fred sally
1600And the 2nd command line argument is fred
1601Back ticks
1602
1603It is also possible to save the output of a command to a variable and the mechanism we use for that is the backtick ( ` ) (Note it is a backtick not a single quote. Typically you'll find the backtick on the keybard to the left of the 1 (one) key.). Here is an example.
1604
1605cat backticks.sh
1606#!/bin/bash
1607# A simple demonstration of using backticks
1608# Ryan 8/1/2017
1609 
1610lines=`cat $1 | wc -l`
1611echo The number of lines in the file $1 is $lines
1612./backticks.sh testfile.txt
1613The number of lines in the file testfile.txt is 12
1614A Sample Backup Script
1615
1616Now let's put the stuff we've learnt so far into a script that actually does something useful. I keep all my projects in separate directories within a directory called projects in my home directory. I regularly take a backup of these projects and keep them in dated folders within a directory called projectbackups also in my home directory.
1617
1618cat projectbackup.sh
1619#!/bin/bash
1620# Backs up a single project directory
1621# Ryan 8/1/2017
1622 
1623date=`date +%F`
1624mkdir ~/projectbackups/$1_$date
1625cp -R ~/projects/$1 ~/projectbackups/$1_$date
1626echo Backup of $1 completed
1627./projectbackup.sh ocelot
1628Backup of ocelot completed
1629You'll notice that I have used relative paths in the above script. By doing this I have made the script more generic. If one of my workmates wished to use it I could give them a copy and it would work just as well for them without modification. You should always think about making your scripts flexible and generic so they may easily be used by other users or adapted to similar situations. The more reusable your scripts are, the more time goes on, the less work you have to do :)
1630
1631If Statements
1632
1633So the above backup script makes my life a little easier, but what if I make a mistake? The script may fall over in a mess of error messages. In the example below I will introduce if statements. I'll only touch on them briefly. You should be able to work out their usage from the example and notes below. If you would like to know more then check out our Bash Scripting Tutorial which goes into much more detail.
1634
1635(If this all seems too confusing, don't worry too much. Even with just the knowledge above you can still write quite useful and practical scripts to make your life easier.)
1636
1637cat projectbackup.sh
1638#!/bin/bash
1639# Backs up a single project directory
1640# Ryan 8/1/2017
1641 
1642if [ $# != 1 ]
1643then
1644    echo Usage: A single argument which is the directory to backup
1645    exit
1646fi
1647if [ ! -d ~/projects/$1 ]
1648then
1649    echo 'The given directory does not seem to exist (possible typo?)'
1650    exit
1651fi
1652date=`date +%F`
1653 
1654# Do we already have a backup folder for todays date?
1655if [ -d ~/projectbackups/$1_$date ]
1656then
1657    echo 'This project has already been backed up today, overwrite?'
1658    read answer
1659    if [ $answer != 'y' ]
1660    then
1661        exit
1662    fi
1663else
1664    mkdir ~/projectbackups/$1_$date
1665fi
1666cp -R ~/projects/$1 ~/projectbackups/$1_$date
1667echo Backup of $1 completed
1668Let's break it down:
1669
1670Line 6 Our first if statement. The formatting is important. Note where the spaces are as they are required for it to work properly. In this statement we are asking if the number of arguments ( $# ) is not equal to ( != ) one.
1671Line 8 If not then the script has not been properly invoked. Print a message explaining how it should be used.
1672Line 9 Because the script has not been invoked properly we wish to exit the script before going any further.
1673Line 10 To indicate the end of an if statement we have a single line which has fi (if backwards) on it.
1674Line 11 If statements can test a lot of different things. Here the exclamation mark ( ! ) means not, the -d means 'the path exists and is a directory'. So the line reads as 'If the given directory does not exist'
1675Line 22 It is possible to ask the user for input. The command we use for that is read. read takes a single argument which is the variable to store the answer in.
1676Line 23 Let's see how the user responded and act accordingly.
1677You'll notice that certain lines are indented in the above code. This is not necessary but is generally considered good practice as it makes the code a lot easier to read.
1678
1679If statements actually make use of a command called test. If you would like to know all the different comparisons you may perform then have a look at the manual page for test.
1680
1681This has been a very brief introduction to Bash Scripting. See our Bash Scripting Tutorial for a more comprehensive look into Bash Scripting.
1682
1683Summary
1684
1685#!
1686Shebang. Indicates which interpreter a script should be run with.
1687echo
1688Print a message to the screen.
1689which
1690Tells you the path to a particular program.
1691$
1692Placed before a variable name when we are referring to it's value.
1693` `
1694Backticks. Used to save the output of a program into a variable.
1695date
1696Prints the date.
1697if [ ] then else fi
1698Perform basic conditional logic.
1699Behaves the same
1700Anything you may do on the command line you may do in a script and it will behave exactly the same.
1701Formatting
1702Bash scripts are particularly picky when it comes to formatting. Make sure spaces are put where they are needed and not put when they are not needed.
1703Activities
1704
1705Let's automate:
1706
1707To solve these activities you'll need to bring together your skills and knowledge from this section and all the previous sections.
1708
1709First off, think about writing your own backup script. You can make it as simple or complex as you like. Maybe start off with a really simple one and progressively improve it.
1710Now see if you can write a script that will give you a report about a given directory. Things you could report on include
1711How many files are in the directory?
1712How many directories are in the directory?
1713What is the biggest file?
1714What is the most recently modified or created file?
1715A list of people who own files in the directory.
1716Anything else you can think of.
1717
1718
1719
1720
1721
1722
1723#############################
1724# Linux For InfoSe Homework #
1725#############################
1726In order to receive your certificate of attendance you must complete the all of the quizzes on the http://linuxsurvival.com/linux-tutorial-introduction/ website.
1727
1728
1729Submit the results via email in an MS Word document with (naming convention example: YourFirstName-YourLastName-Linux-For-InfoSec-Homework.docx)
1730
1731
1732
1733
1734##############################
1735# Linux For InfoSe Challenge #
1736##############################
1737
1738In order to receive your certificate of proficiency you must complete all of the tasks covered in the Linux For InfoSec pastebin (http://pastebin.com/b5SxBRf6).
1739
1740Submit the results via email in an MS Word document with (naming convention example: YourFirstName-YourLastName-Linux-For-InfoSec-Challenge.docx)
1741
1742
1743
1744
1745IMPORTANT NOTE:
1746Your homework/challenge must be submitted via email to both (joe-at-strategicsec-.-com and kasheia-at-strategicsec-.-com) by Sunday October 16th at midnight EST.
1747
1748
1749#########################################################################
1750# What kind of Linux am I on and how can I find out? 			        #
1751# Great reference: 							                            #
1752# https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation/ 	#
1753#########################################################################
1754- What’s the distribution type? What version?
1755-------------------------------------------
1756cat /etc/issue
1757cat /etc/*-release
1758cat /etc/lsb-release      		# Debian based
1759cat /etc/redhat-release   		# Redhat based
1760
1761
1762
1763- What’s the kernel version? Is it 64-bit?
1764-------------------------------------------
1765cat /proc/version
1766uname -a
1767uname -mrs
1768rpm -q kernel
1769dmesg | grep Linux
1770ls /boot | grep vmlinuz-
1771
1772
1773
1774- What can be learnt from the environmental variables?
1775----------------------------------------------------
1776cat /etc/profile
1777cat /etc/bashrc
1778cat ~/.bash_profile
1779cat ~/.bashrc
1780cat ~/.bash_logout
1781env
1782set
1783
1784
1785- What services are running? Which service has which user privilege?
1786------------------------------------------------------------------
1787ps aux
1788ps -ef
1789top
1790cat /etc/services
1791
1792
1793- Which service(s) are been running by root? Of these services, which are vulnerable - it’s worth a double check!
1794---------------------------------------------------------------------------------------------------------------
1795ps aux | grep root
1796ps -ef | grep root
1797
1798
1799
1800- What applications are installed? What version are they? Are they currently running?
1801------------------------------------------------------------------------------------
1802ls -alh /usr/bin/
1803ls -alh /sbin/
1804dpkg -l
1805rpm -qa
1806ls -alh /var/cache/apt/archivesO
1807ls -alh /var/cache/yum/
1808
1809
1810- Any of the service(s) settings misconfigured? Are any (vulnerable) plugins attached?
1811------------------------------------------------------------------------------------
1812cat /etc/syslog.conf
1813cat /etc/chttp.conf
1814cat /etc/lighttpd.conf
1815cat /etc/cups/cupsd.conf
1816cat /etc/inetd.conf
1817cat /etc/apache2/apache2.conf
1818cat /etc/my.conf
1819cat /etc/httpd/conf/httpd.conf
1820cat /opt/lampp/etc/httpd.conf
1821ls -aRl /etc/ | awk '$1 ~ /^.*r.*/
1822
1823
1824
1825- What jobs are scheduled?
1826------------------------
1827crontab -l
1828ls -alh /var/spool/cron
1829ls -al /etc/ | grep cron
1830ls -al /etc/cron*
1831cat /etc/cron*
1832cat /etc/at.allow
1833cat /etc/at.deny
1834cat /etc/cron.allow
1835cat /etc/cron.deny
1836cat /etc/crontab
1837cat /etc/anacrontab
1838cat /var/spool/cron/crontabs/root
1839
1840
1841- Any plain text usernames and/or passwords?
1842------------------------------------------
1843grep -i user [filename]
1844grep -i pass [filename]
1845grep -C 5 "password" [filename]
1846find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password"   		# Search for Joomla passwords
1847
1848
1849- What NIC(s) does the system have? Is it connected to another network?
1850---------------------------------------------------------------------
1851/sbin/ifconfig -a
1852cat /etc/network/interfaces
1853cat /etc/sysconfig/network
1854
1855
1856- What are the network configuration settings? What can you find out about this network? DHCP server? DNS server? Gateway?
1857------------------------------------------------------------------------------------------------------------------------
1858cat /etc/resolv.conf
1859cat /etc/sysconfig/network
1860cat /etc/networks
1861iptables -L
1862hostname
1863dnsdomainname
1864
1865- What other users & hosts are communicating with the system?
1866-----------------------------------------------------------
1867lsof -i
1868lsof -i :80
1869grep 80 /etc/services
1870netstat -antup
1871netstat -antpx
1872netstat -tulpn
1873chkconfig --list
1874chkconfig --list | grep 3:on
1875last
1876w
1877
1878
1879
1880- Whats cached? IP and/or MAC addresses
1881-------------------------------------
1882arp -e
1883route
1884/sbin/route -nee
1885
1886
1887- Who are you? Who is logged in? Who has been logged in? Who else is there? Who can do what?
1888------------------------------------------------------------------------------------------
1889id
1890who
1891w
1892last
1893cat /etc/passwd | cut -d:    # List of users
1894grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}'   # List of super users
1895awk -F: '($3 == "0") {print}' /etc/passwd   # List of super users
1896cat /etc/sudoers
1897sudo -l
1898
1899
1900
1901- What sensitive files can be found?
1902----------------------------------
1903cat /etc/passwd
1904cat /etc/group
1905cat /etc/shadow
1906ls -alh /var/mail/
1907
1908
1909
1910- Anything “interesting” in the home directorie(s)? If it’s possible to access
1911----------------------------------------------------------------------------
1912ls -ahlR /root/
1913ls -ahlR /home/
1914
1915
1916- Are there any passwords in; scripts, databases, configuration files or log files? Default paths and locations for passwords
1917---------------------------------------------------------------------------------------------------------------------------
1918cat /var/apache2/config.inc
1919cat /var/lib/mysql/mysql/user.MYD
1920cat /root/anaconda-ks.cfg
1921
1922
1923- What has the user being doing? Is there any password in plain text? What have they been edting?
1924-----------------------------------------------------------------------------------------------
1925cat ~/.bash_history
1926cat ~/.nano_history
1927cat ~/.atftp_history
1928cat ~/.mysql_history
1929cat ~/.php_history
1930
1931
1932
1933- What user information can be found?
1934-----------------------------------
1935cat ~/.bashrc
1936cat ~/.profile
1937cat /var/mail/root
1938cat /var/spool/mail/root
1939
1940
1941- Can private-key information be found?
1942-------------------------------------
1943cat ~/.ssh/authorized_keys
1944cat ~/.ssh/identity.pub
1945cat ~/.ssh/identity
1946cat ~/.ssh/id_rsa.pub
1947cat ~/.ssh/id_rsa
1948cat ~/.ssh/id_dsa.pub
1949cat ~/.ssh/id_dsa
1950cat /etc/ssh/ssh_config
1951cat /etc/ssh/sshd_config
1952cat /etc/ssh/ssh_host_dsa_key.pub
1953cat /etc/ssh/ssh_host_dsa_key
1954cat /etc/ssh/ssh_host_rsa_key.pub
1955cat /etc/ssh/ssh_host_rsa_key
1956cat /etc/ssh/ssh_host_key.pub
1957cat /etc/ssh/ssh_host_key
1958
1959
1960- Any settings/files (hidden) on website? Any settings file with database information?
1961------------------------------------------------------------------------------------
1962ls -alhR /var/www/
1963ls -alhR /srv/www/htdocs/
1964ls -alhR /usr/local/www/apache22/data/
1965ls -alhR /opt/lampp/htdocs/
1966ls -alhR /var/www/html/
1967
1968
1969- Is there anything in the log file(s) (Could help with “Local File Includes”!)
1970-----------------------------------------------------------------------------
1971cat /etc/httpd/logs/access_log
1972cat /etc/httpd/logs/access.log
1973cat /etc/httpd/logs/error_log
1974cat /etc/httpd/logs/error.log
1975cat /var/log/apache2/access_log
1976cat /var/log/apache2/access.log
1977cat /var/log/apache2/error_log
1978cat /var/log/apache2/error.log
1979cat /var/log/apache/access_log
1980cat /var/log/apache/access.log
1981cat /var/log/auth.log
1982cat /var/log/chttp.log
1983cat /var/log/cups/error_log
1984cat /var/log/dpkg.log
1985cat /var/log/faillog
1986cat /var/log/httpd/access_log
1987cat /var/log/httpd/access.log
1988cat /var/log/httpd/error_log
1989cat /var/log/httpd/error.log
1990cat /var/log/lastlog
1991cat /var/log/lighttpd/access.log
1992cat /var/log/lighttpd/error.log
1993cat /var/log/lighttpd/lighttpd.access.log
1994cat /var/log/lighttpd/lighttpd.error.log
1995cat /var/log/messages
1996cat /var/log/secure
1997cat /var/log/syslog
1998cat /var/log/wtmp
1999cat /var/log/xferlog
2000cat /var/log/yum.log
2001cat /var/run/utmp
2002cat /var/webmin/miniserv.log
2003cat /var/www/logs/access_log
2004cat /var/www/logs/access.log
2005ls -alh /var/lib/dhcp3/
2006ls -alh /var/log/postgresql/
2007ls -alh /var/log/proftpd/
2008ls -alh /var/log/samba/
2009
2010- Note: auth.log, boot, btmp, daemon.log, debug, dmesg, kern.log, mail.info, mail.log, mail.warn, messages, syslog, udev, wtmp