Services & Internals Enumeration¶

# Network interfaces — dual-homed hosts = pivoting
ip a
# or
ifconfig

# Hosts file — internal hostnames, other systems
cat /etc/hosts

# Who is currently logged in (and from where)
w

# Alternative
who

# Last login time for all users — shows usage patterns
lastlog

# Recent login history
last -a | head -20

# Failed login attempts (if readable)
lastb 2>/dev/null | head -20

# Current user's history — passwords, SSH commands, creds
history

# Or read the file directly
cat ~/.bash_history

# All users' bash history (if readable)
find /home -name ".bash_history" -exec echo "=== {} ===" \; -exec cat {} \; 2>/dev/null

# Root's history (if readable)
cat /root/.bash_history 2>/dev/null

# Find all history files (bash, mysql, python, etc.)
find / -type f \( -name "*_hist" -o -name "*_history" \) -exec ls -l {} \; 2>/dev/null

# System crontab
cat /etc/crontab

# Per-user crontabs
ls -la /var/spool/cron/crontabs/ 2>/dev/null
# or
ls -la /var/spool/cron/ 2>/dev/null

# Cron directories
ls -la /etc/cron.d/
ls -la /etc/cron.daily/
ls -la /etc/cron.hourly/
ls -la /etc/cron.weekly/
ls -la /etc/cron.monthly/

# Systemd timers (modern replacement for cron)
systemctl list-timers --all 2>/dev/null

# Use pspy to catch processes you can't see in crontab
# Download: https://github.com/DominicBreuker/pspy
./pspy64

# Quick alternative without tools — watch for new processes
watch -n 1 'ps aux | grep -v watch'

# All running processes with full details
ps aux

# Processes running as root (your targets)
ps aux | grep root

# Process tree (shows parent-child relationships)
ps auxf

# Specific service check
ps aux | grep -i "apache\|nginx\|mysql\|postgres\|docker\|cron"

# Command lines of all running processes
find /proc -name cmdline -exec cat {} \; 2>/dev/null | tr "\0" " " | tr "\n" "\n"

# Or more readably
cat /proc/*/cmdline 2>/dev/null | tr "\0" " " | tr "\n\n" "\n"

# Specific process details
ls -la /proc/[PID]/
cat /proc/[PID]/cmdline | tr "\0" " "
cat /proc/[PID]/environ | tr "\0" "\n"   # Environment variables (may have secrets!)

# List all services
systemctl list-units --type=service

# List enabled services (start on boot)
systemctl list-unit-files --type=service | grep enabled

# Check specific service config
systemctl cat servicename

# Debian/Ubuntu
dpkg -l
apt list --installed 2>/dev/null

# RHEL/CentOS/Fedora
rpm -qa
yum list installed 2>/dev/null

# Save to file for later analysis
dpkg -l | tee installed_pkgs.list

sudo -V

# Check for useful tools already on the system
which nmap nc ncat netcat curl wget python python3 perl ruby gcc g++ cc 2>/dev/null

# Compilers available? (can compile kernel exploits on-target)
which gcc g++ cc make 2>/dev/null

# List all binaries in standard paths
ls -la /usr/local/bin/ /usr/bin/ /usr/sbin/ /bin/ /sbin/ 2>/dev/null

# Generate installed package list first
dpkg -l | awk '{print $2}' > installed_pkgs.list

# Cross-reference with GTFOBins (requires internet)
for i in $(curl -s https://gtfobins.github.io/+/info.json | jq -r '.[].functions | keys[]' 2>/dev/null); do
    if grep -qw "$i" installed_pkgs.list 2>/dev/null; then
        echo "[!] GTFOBin found: $i"
    fi
done

# Find all config files (readable by current user)
find / -type f \( -name "*.conf" -o -name "*.config" -o -name "*.cnf" -o -name "*.cfg" \) -exec ls -l {} \; 2>/dev/null

# Search config files for passwords
find / -type f \( -name "*.conf" -o -name "*.config" \) -exec grep -li "password\|passwd\|pass\|pwd" {} \; 2>/dev/null

# Find shell scripts (exclude system paths for noise reduction)
find / -type f -name "*.sh" 2>/dev/null | grep -v "src\|snap\|share\|lib"

# Find world-writable scripts (potential cron abuse)
find / -type f -name "*.sh" -writable 2>/dev/null

# Find scripts owned by root but writable by us
find / -type f -name "*.sh" -user root -writable 2>/dev/null

# Trace a command and look for interesting syscalls
strace -f ping -c1 10.10.10.1 2>&1 | grep -i "open\|connect\|read\|write"

# Trace a running process by PID
strace -p PID -f 2>&1

# Save output for analysis
strace -o /tmp/trace.txt -f -p PID

# Trace library calls instead
ltrace ./binary 2>&1

# Find SUID binaries (covered in depth in permissions enumeration)
find / -perm -4000 -type f 2>/dev/null

# Find writable files outside home directory
find / -writable -type f 2>/dev/null | grep -v "proc\|sys\|home"

# Find files modified in last 10 minutes (catch active cron jobs)
find / -mmin -10 -type f 2>/dev/null | grep -v "proc\|sys\|run"

# Find files modified in last 24 hours
find / -mtime 0 -type f 2>/dev/null | grep -v "proc\|sys\|run"

# List all open files / network connections
lsof -i 2>/dev/null
lsof -u root 2>/dev/null

# Capabilities on binaries (potential escalation)
getcap -r / 2>/dev/null