-iname is case sensitive
find / -name "term"[.txt, .conf]
for i in {1..254}; do ping -c 1 -W 1 [First three octets of IP].$i | grep 'from'; done
-iname is case sensitive
find / -name "term"[.txt, .conf]
for i in {1..254}; do ping -c 1 -W 1 [First three octets of IP].$i | grep 'from'; done
0 Halt Shuts Down the System
1 Single-User Mode Does not configure network interface, start daemons, or allow non-root logins
2 Multi-User Mode Does not configure network interfaces or start daemons
3 Multi-User Mode with Networking Start the system normally
4 Undefined Not used/ User-definable
5 X11 As run level 3 + display manager (X)
6 Reboot Reboots the system
Example:
john:$6$iTEFbMTM$CXmxPwErbEef9RUBvf1zv8EgXQdaZg2eOd5uXyvt4sFzi6G4lIqavLilTQgniAHm3Czw/LoaGzoFzaMm.YwOl/:17707:0:90:14:::
Username john
$ Salt $
Encrypted Password $6$iTEFbMTM$CXmxPwErbEef9 RUBvf1zv8EgXQdaZg2eOd5uXyvt4sFzi6G4lI qavLilTQgniAHm3Czw/LoaGzoFzaMm.YwOl/
Hash Types:
$1$ is MD5
$2a$ is Blowfish
$2y$ is Blowfish
$5$ is SHA-256
$6$ is SHA-512
Last Password Changed (since Jan 1, 1970) 17707
Minimum number of days required between password changes 0
Maximum number of days the password is valid (+ 7 days grace period) 90
Number of days before the password is to expire and user is warned to change 14
Number of days after password expires that account is disabled [blank field] *Johns account wont disable after password expires
Days since Jan 1, 1970 that account is disabled, absolute date when login may not be used [blank field] *Johns account will not be disabled
System Logs /var/log/systlog
Messages /var/log/messages
Administrator /var/log/adm
Everything about the system (firewall hints) /var/log/dmesg
Warning Data (kernel) /var/log/kern
Login Records /var/log/auth.log
Secure Logins /var/log/secure
Scheduled Tasks /var/log/cron
LastLog (binary not ascii) /var/log/lastlog
btmp (records bad login attempts) /var/log/syslog
sulog (logs use of su command) /var/log/sulog
Utmp (x) (who and W) record who logs in /var/log/utmp
wtmp (record of each time a user logged in) /var/log/wtmp
xferlog (logs ftp access) /var/log/xferlog
Syslog and messages (global system activity data startup messages) debian /var/log/syslog redhat /var/log/messages
Process accounting See below
Epoch Unit timestamp conversion from 1970 January 1st
last (users connection time) /var/log/last
sa (accounting information) /var/log/sa
lastcomm (prints out info about previously executed commands) /var/log/lastcomm
Audit Daemon auditd, controls the generation and location of audit trail files, syslog msgs
Syslog Config cat /etc/rsyslog.d/*.conf
Method of recording and summarizing commands executed on Linux
/var/account/acct FreeBSD / OpenBSD Default accounting file
/var/account/pacct Red Hat / RHEL / CentOS / Fedora Linux
/var/log/account/pacct Debian / Ubuntu Linux
/var/adm/psacct Sun Solaris UNIX Default accounting file
System in *nix to forward log messages.
Location
cat /etc/rsyslog.conf
double @@ tells rsyslogd to have its datagrams emitted in TCP datagrams, whereas a single @ would have it sent out in UDP datagrams.
If you find a website like [badguy:514] in rsyslog look in /var/www/html or etc/hosts. curl the html / look at log.
Check netstat for connections on port 514
netstat -auntp | grep "514"
=========================
= Start/End =
=========================
date; date -u
=====================================
= System Characterization =
=====================================
#kernel version
uname -a
#uptime
uptime
#OS information
cat /etc/*release*
#hostname
hostname
cat /etc/hostname
#numeric identifier for the current host
hostid
#kernel modules (linux)
lsmod
#kernel modules (solaris)
modinfo -c
#cpu (linux)
cat /proc/cpuinfo
#cpu (solaris)
psrinfo -v
=====================
= SysV =
=====================
#Startup scripts
cat /etc/inittab
cat /etc/rc.d/rc.sysinit
cat /etc/rc.d/rc.local
#Services
service --status-all
service <name> status
#What starts on boot
chkconfig --list
#runlevel
who -r
runlevel
=====================
= Upstart =
=====================
#Startup scripts
ls /etc/init | grep .conf
cat /etc/inittab
#Services
initctl list
initctl status <service>
update-rc.d <name> <enable_disable>
#What starts on boot
initctl show-config
#runlevel
who -r
runlevel
cat /etc/init/rc-sysinit.conf
=====================
= Systemd =
=====================
#Startup scripts
cat /etc/systemd/systemd
file /usr/lib/systemd/system
#Services
systemctl list-units
systemctl status <name>
systemctl list-unit-files -t service
#What services have been modified!
systemd-delta
#What starts on boot
systemctl list-unit-files -t service
#runlevel
who -r
runlevel
#default runlevel
systemctl get-default
cat /etc/systemd/system/default.target
=================
= SMF =
=================
#Startup scripts
cat /etc/inittab
#Services
svcs -a
svcs -l <service>
inetadm
#What starts on boot
svcs
svcs -a | egrep 'online|legacy_run.*rc[0123S]_d'
#runlevel
svcprop svc:/system/svc/restarter:default/:properties/options/milestone
#if 'doesn't match entities' default milestone is still multi-user-server
=========================
= Networking =
=========================
#current IP configuration
ifconfig -a
#interface configuration files or places to manually add routes to
cat /etc/sysconfig/network-scripts/ifcfg-*
cat /etc/sysconfig/network
cat /etc/rc.local
#Routing Tables
netstat -rn
route
ip route show
#How it resolves
cat /etc/nsswitch.conf
#local caches
cat /etc/hosts
cat /etc/resolv.conf
arp -an
#check databases
getent -s <database> <choice>
#current connections (linux)
netstat -natup
#current connections (solaris)
netstat -anP tcp
netstat -anP udp
#iptables
cat /etc/sysconfig/iptables
iptables -nL
#firewalld
firewall-cmd --direct --get-all-rules
fireawll-cmd --list-all-zones
#firewalld default and user configurations
ls /usr/lib/firewalld/
ls /etc/firewalld/*.conf
#ports with services
cat /etc/services
cat /etc/inet/services
#ports to services (Solaris)
for pid in $(netstat -an | egrep "\*\.[0-9]" | awk '{print $1}' | cut -d. -f2 | sort | uniq) ; do echo "Port: $pid" ; for f in $(ps -ef | sed 1d | awk '{print $2}') ; do pfiles $f 2>/dev/null | /usr/xpg4/bin/grep -q "port: $pid"; if [ $? -eq 0 ]; then ps -ef -o pid -o args | egrep -v "grep|pfiles" | grep $f ; fi ; done ; done ; rpcinfo -p
for pid in $(ls /proc); do check=$(pfiles /proc/$pid | grep -ic "port:"); if [ $check -gt 0 ]; then echo "===============================================================================================" && echo PID: $pid && echo PFILES RESULTS: && pfiles /proc/$pid | grep -i port; echo PS LIST: && ps -flp $pid; fi; done
pfiles /proc/*
=========================
= Processes =
=========================
#list all
ps -ef
ps -elf
ps -elf --sort start_time
ps -C <process>
#max PIDs (linux) (after boot) then (current)
cat /etc/sysctl.conf
cat /proc/sys/kernel/pid_max
#max PIDs (solaris) (after boot)
cat /etc/system
#files open by processes (linux)
lsof -p <pid>
lsof -u <user>
lsof <absolute_path>
lsof -RPni :<port>
lsof +L1
#specific file open by a process (linux)
for pid in $(ps -ef | awk '{print $2}'); do var=$(lsof -p $pid | grep -c "<file_name>" 2> /dev/null); if [ $var -gt 0 ]; then echo $pid; fi; done
#files open by processes (solaris)
pfiles `echo /proc/*`
#specific file open by a process (solaris)
for pid in $(ps -ef | awk '{print $2}'); do var=$(pfiles $pid | grep -c "<name>" 2> /dev/null); if [ $var -gt 0 ]; then echo $pid; fi; done
#processes on startup
cat /etc/inittab
cat /etc/inetd.conf
cat /etc/xinetd.conf
ls -lisahR /etc/xinetd.d/
=====================================
= Filesystem Information =
=====================================
#disk usage
df -h
df -i
#mounted devices
mount
#dump ext2/3/4 filesystem information
dumpe2fs <device>
=====================
= Users =
=====================
#basic information
cat /etc/passwd
cat /etc/shadow
cat /etc/group
id
w
chage -l <user>
groups <user>
#file mode creation mask
umask
for user in $(awk -F: '{print $1}' /etc/passwd); do printf "%-10s" "$user" ; su -c 'umask' -l $user 2>/dev/null; done
#default encryption algorithm
cat /etc/security/policy.conf (solaris)
cat /etc/login.defs (linux)
cat /etc/login.conf (bsd)
cat /etc/pam.d/password-auth-ac
#cronjobs/at
cat /etc/crontab
ls -lisahR /var/spool/at
cat /var/spool/crontab
ls -la /etc/cron.*
crontab -l
for user in $(cut -f1 -d: /etc/passwd); do echo “##### $user crontab is:”; cat /var/spool/cron/{crontabs/$user,$user} 2> /dev/null; done
for user in $(cat /etc/passwd | cut -d":" -f1); do crontab -u $user -l; done
#Check home dirs
echo; for user in $(cat /etc/passwd | cut -d ":" -f1); do if [ -e /home/$user ]; then echo "$user has a home directory"; fi; done
#SUID SGID files
find / -perm /4000
find / -perm /2000
#all user system-wide settings
cat /etc/profile
cat /etc/bashrc
cat /etc/login.defs
#User specific settings could override system-wide settings
cat /home/<user>/.bashrc
cat /home/<user>/.profile
#check profile.d files
ls /etc/profile.d/
=====================
= Logging =
=====================
#rsyslog
cat /etc/rsyslog.conf
cat /etc/rsyslog.d/*
#logrotate
cat /etc/logrotate.conf
#last
last
lastb
last -f <log_file>
#SELinux
sestatus
getenforce
cat /etc/selinux/config
#syslog
cat /etc/syslog.conf
#systemd logging
cat /etc/systemd/journald.conf
#systemd journalctl commands
journalctl -p <priority_emerg_alert_info>
journalctl --since <YYYY-MM-DD HH:MM:SS>
journalctl --until <YYYY-MM-DD HH:MM:SS>
journalctl -u <service>
#logrotate (linux)
cat /etc/logrotate.conf
ls -lisah /etc/logrotate.d/
#logrotate (Solaris)
cat /etc/logadm.conf
#Auditd
cat /etc/audit.conf
#auditd user configurations
cat /etc/audit/audit.rules
ls -lisah /etc/audit/rules.d
#ausearch (linux)
ausearch -x <executable> -i
auditctl -l
aureport
=====================
= Other =
=====================
#find files between a date
find / -type f -newermnt "YYYY-MM-DD HH:MM:SS" ! -newermnt "YYYY-MM-DD HH:MM:SS" 2> /dev/null
find / -type f -mmin <+-time> 2> /dev/null
find / -type f -name <name> -print -o -path "/proc" -prune
find / -type f -exec ls -l {} \; | grep "<something_date_owner_etc>" 2> /dev/null
#if newermnt isn't available
touch -t YYYYMMDDHHMM ts_start
touch -t YYYYMMDDHHMM ts_end
find / -newer /ts_start -a ! -newer /ts_end (solaris)
find / -newer /<path>/ts_start ! -newer /<path>/ts_end (linux)
#SUID (Solaris)
find / -type f -perm -4000 2> /dev/null
find / -type f -perm -2000 2> /dev/null
=================================
= Creature Comforts =
=================================
#vi
:set number
:set autoindent
:set shiftwidth=<some_number>
:set showmatch
#aliases
alias ls='ls -lisah'
#ls colors
testvar=$LS_COLORS; LS_COLORS="di=0;97"; export LS_COLORS
for i in `ps -ef | awk '{print $2}'`;do if pfles $i | grep port |> /dev/null;then (pfiles $i | grep $i);(pfiles $i | grep port);fi;done 2> /dev/null
#process has a space at the end
ls -alQ /proc/*/exe 2>/dev/null | awk -F '"' '{print $4}' | grep -v -e '^$' | sort | uniq | more
#checks for spaces at the end of the process
for file in $(ls -alQ /proc/*/exe 2>/dev/null | awk -F '"' '{print $4}' | grep -v -e '^$' | sort | uniq); do echo \"$file\"; done
for psname in $(ps -ef | awk '{print $8}'); do echo \"$psname\"; done
#process executables
ls -latriQ /proc/*/exe
ssh -S /tmp/t1 dummy@127.1 -D 9050 -NT -f