I've compromised two Linux user accounts on a RHEL machine (neither of which have root permissions) and I want to determine which account is more 'useful' to me in terms of access and privileges. Is there any way I can quickly and easily compare permissions/access between those two accounts?
2 Answers
Run sudo -l
as a user to see what supplementary privileges that user may gain by running sudo
. You'll have to know or collect the user's password to make use of these privileges, unless one of the sudoers rules is tagged NOPASSWD
.
Run id
to see what groups the user belongs to. You may then want to look around to see what these groups are worth.
These two are common ways to escalate access and easy to compare. Here are a few more areas you can look at with more work needed to get useful results.
Look around to see what files the user may access. Permissions can be granted via access control lists, not just ownership and group membership. The following commands list files that are respectively readable, writable and executable by the user but not by all users. The first two exclude the user's home directory (where it's unsurprising to have files that others can't access), and the third only targets setuid/setgid executables. These commands run on the root filesystem only, add more paths if there are more mounted filesystems (or remove -xdev
and exclude /proc
and perhaps /sys
instead).
find -xdev / -path ~ -prune -o -readable ! -perm -a+r
find -xdev / -path ~ -prune -o -writable
find -xdev / -perm /u+s,g+s -executable ! -perm -a+x
Check the user's log and configuration files to see what kind of administration-related things they've been doing: shell commands in ~/.bash_history
(or other files depending on the user's choice of shell and configuration), aliases in ~/.bashrc
(likewise, or other files), scripts in ~/bin
, …
Check if the user has SSH keys (in ~/.ssh/
) that you may use to escalate your access to other machines (or occasionally to other accounts on the same machine). You may be able to see what sites the user has logged into by checking ~/.ssh/known_hosts
, but by default the addresses are hashed so you can only verify guesses.
If this is a desktop machine, check for a running password manager. You're unlikely to find one on a server, but there instead check for an existing SSH connection that you may be able to piggyback onto (e.g. via X11 forwarding).
Emails may also give a clue. Check who administrative emails are forwarded to (/etc/aliases
) and who has a local mailbox in /var/mail
or /var/spool/mail
.
-
awesome answer @Gilles! Thanks heaps :D the permissions are locked down enough that those commands dont help to much and they're both fairly new service accounts so not much to be gleaned but i grabbed some ssh keys so yeah! :) thanks!– NULLZSep 10, 2013 at 23:13
-
@VolkerSiegel In what shell does
!
followed by a space cause problems? Sep 2, 2014 at 9:25 -
I see, no problems when followed by a space, thanks! (I do not use
!
for history, normally - I see the side effects more often, but never checked the syntax description) Sep 2, 2014 at 9:32
Check in which groups the user are present in. Check what those groups have access to with
find / -group yourgroup
You can also get all files a single user is owner of using using
find / -user user
Now compare those results. From here try to see what files in /etc
and /var
are world readable. Try to see if there is anything interesting in the logs as well (if you can access them).