Can i compare linux user permissions without root access?

Question

I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is there any way I can quickly and easily compare permissions/access between those two accounts?

Answer 1

Run sudo -l as a user to see what supplementary privileges that user may gain by running sudo. You'll have to know or collect the user's password to make use of these privileges, unless one of the sudoers rules is tagged NOPASSWD.

Run id to see what groups the user belongs to. You may then want to look around to see what these groups are worth.

These two are common ways to escalate access and easy to compare. Here are a few more areas you can look at with more work needed to get useful results.

Look around to see what files the user may access. Permissions can be granted via access control lists, not just ownership and group membership. The following commands list files that are respectively readable, writable and executable by the user but not by all users. The first two exclude the user's home directory (where it's unsurprising to have files that others can't access), and the third only targets setuid/setgid executables. These commands run on the root filesystem only, add more paths if there are more mounted filesystems (or remove -xdev and exclude /proc and perhaps /sys instead).

find -xdev / -path ~ -prune -o -readable ! -perm -a+r
find -xdev / -path ~ -prune -o -writable
find -xdev / -perm /u+s,g+s -executable ! -perm -a+x

Check the user's log and configuration files to see what kind of administration-related things they've been doing: shell commands in ~/.bash_history (or other files depending on the user's choice of shell and configuration), aliases in ~/.bashrc (likewise, or other files), scripts in ~/bin, …

Check if the user has SSH keys (in ~/.ssh/) that you may use to escalate your access to other machines (or occasionally to other accounts on the same machine). You may be able to see what sites the user has logged into by checking ~/.ssh/known_hosts, but by default the addresses are hashed so you can only verify guesses.

If this is a desktop machine, check for a running password manager. You're unlikely to find one on a server, but there instead check for an existing SSH connection that you may be able to piggyback onto (e.g. via X11 forwarding).

Emails may also give a clue. Check who administrative emails are forwarded to (/etc/aliases) and who has a local mailbox in /var/mail or /var/spool/mail.

Answer 2

Check in which groups the user are present in. Check what those groups have access to with

find / -group yourgroup

You can also get all files a single user is owner of using using

find / -user user

Now compare those results. From here try to see what files in /etc and /var are world readable. Try to see if there is anything interesting in the logs as well (if you can access them).