I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is there any way I can quickly and easily compare permissions/access between those two accounts?
These two are common ways to escalate access and easy to compare. Here are a few more areas you can look at with more work needed to get useful results.
Look around to see what files the user may access. Permissions can be granted via access control lists, not just ownership and group membership. The following commands list files that are respectively readable, writable and executable by the user but not by all users. The first two exclude the user's home directory (where it's unsurprising to have files that others can't access), and the third only targets setuid/setgid executables. These commands run on the root filesystem only, add more paths if there are more mounted filesystems (or remove
Check the user's log and configuration files to see what kind of administration-related things they've been doing: shell commands in
Check if the user has SSH keys (in
If this is a desktop machine, check for a running password manager. You're unlikely to find one on a server, but there instead check for an existing SSH connection that you may be able to piggyback onto (e.g. via X11 forwarding).
Emails may also give a clue. Check who administrative emails are forwarded to (
Check in which groups the user are present in. Check what those groups have access to with
You can also get all files a single user is owner of using using
Now compare those results. From here try to see what files in