Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is there any way I can quickly and easily compare permissions/access between those two accounts?

share|improve this question

2 Answers 2

up vote 5 down vote accepted

Run sudo -l as a user to see what supplementary privileges that user may gain by running sudo. You'll have to know or collect the user's password to make use of these privileges, unless one of the sudoers rules is tagged NOPASSWD.

Run id to see what groups the user belongs to. You may then want to look around to see what these groups are worth.

These two are common ways to escalate access and easy to compare. Here are a few more areas you can look at with more work needed to get useful results.

Look around to see what files the user may access. Permissions can be granted via access control lists, not just ownership and group membership. The following commands list files that are respectively readable, writable and executable by the user but not by all users. The first two exclude the user's home directory (where it's unsurprising to have files that others can't access), and the third only targets setuid/setgid executables. These commands run on the root filesystem only, add more paths if there are more mounted filesystems (or remove -xdev and exclude /proc and perhaps /sys instead).

find -xdev / -path ~ -prune -o -readable ! -perm -a+r
find -xdev / -path ~ -prune -o -writable
find -xdev / -perm /u+s,g+s -executable ! -perm -a+x

Check the user's log and configuration files to see what kind of administration-related things they've been doing: shell commands in ~/.bash_history (or other files depending on the user's choice of shell and configuration), aliases in ~/.bashrc (likewise, or other files), scripts in ~/bin, …

Check if the user has SSH keys (in ~/.ssh/) that you may use to escalate your access to other machines (or occasionally to other accounts on the same machine). You may be able to see what sites the user has logged into by checking ~/.ssh/known_hosts, but by default the addresses are hashed so you can only verify guesses.

If this is a desktop machine, check for a running password manager. You're unlikely to find one on a server, but there instead check for an existing SSH connection that you may be able to piggyback onto (e.g. via X11 forwarding).

Emails may also give a clue. Check who administrative emails are forwarded to (/etc/aliases) and who has a local mailbox in /var/mail or /var/spool/mail.

share|improve this answer
    
awesome answer @Gilles! Thanks heaps :D the permissions are locked down enough that those commands dont help to much and they're both fairly new service accounts so not much to be gleaned but i grabbed some ssh keys so yeah! :) thanks! –  NULLZ Sep 10 '13 at 23:13
    
@VolkerSiegel In what shell does ! followed by a space cause problems? –  Gilles Sep 2 at 9:25
    
I see, no problems when followed by a space, thanks! (I do not use ! for history, normally - I see the side effects more often, but never checked the syntax description) –  Volker Siegel Sep 2 at 9:32

Check in which groups the user are present in. Check what those groups have access to with

find / -group yourgroup

You can also get all files a single user is owner of using using

find / -user user

Now compare those results. From here try to see what files in /etc and /var are world readable. Try to see if there is anything interesting in the logs as well (if you can access them).

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.