From e014bf00bc740d3bbb7285b9d963fa870f40215c Mon Sep 17 00:00:00 2001 From: Carlos Polop Date: Tue, 13 Jul 2021 10:54:50 +0200 Subject: [PATCH] check_quto_flows --- linPEAS/README.md | 56 +---------------------------------------------- 1 file changed, 1 insertion(+), 55 deletions(-) diff --git a/linPEAS/README.md b/linPEAS/README.md index 0adad01..2189705 100755 --- a/linPEAS/README.md +++ b/linPEAS/README.md @@ -212,61 +212,7 @@ file="/tmp/linPE";RED='\033[0;31m';Y='\033[0;33m';B='\033[0;34m';NC='\033[0m';rm - [x] Password policy - **Software Information** - - [x] MySQl (Version, user being configured, loging as "root:root","root:toor","root:", user hashes extraction via DB and file, possible backup user configured, credentials in config, cmd exec library) - - [x] PostgreSQL (Version, try login in "template0" and "template1" as: "postgres:", "psql:", file DBs, Config) - - [x] Apache (Version) - - [x] PHP cookies - - [x] Wordpress (Database credentials) - - [x] Drupal (Database credentials) - - [x] Moodle (Database credentials) - - [x] Tomcat (Credentials) - - [x] Mongo (Version, Credentials) - - [x] Supervisor (Credentials) - - [x] Cesi (Credentials) - - [x] Rsyncd (Credentials) - - [x] Hostapd (Credentials) - - [x] Wifi (Credentials) - - [x] Anaconda-ks (Credentials) - - [x] VNC (Credentials) - - [x] LDAP database (Credentials) - - [x] Open VPN files (Credentials) - - [x] SSH (private keys, known_hosts, authorized_hosts, authorized_keys, main config parameters in sshd_config, certificates, agents) - - [X] PAM-SSH (Unexpected "auth" values) - - [x] Cloud Credentials (credenals-AWS-, credentials.gb-GC-, legacy_credentials-GC-, access_tokens.db-GC-, accessTokens.json-Azure-, azureProfile.json-Azure-) - - [x] NFS (privilege escalation misconfiguration) - - [x] Kerberos (configuration & tickets in /tmp) - - [x] Kibana (credentials) - - [x] Logstash (Username and possible code execution) - - [x] Elasticseach (Config info and Version via port 9200) - - [x] Vault-ssh (Config values, secrets list and .vault-token files) - - [x] screen and tmux sessions - - [x] Couchdb - - [x] Redis - - [x] Dovecot - - [x] Mosquitto - - [x] Neo4j - - [x] Cloud-Init - - [x] Erlang Cookie - - [X] GVM config - - [x] IPSEC files - - [x] IRSSI config file - - [x] Keyring files - - [x] Filelliza files - - [x] Backup-manager - - [x] Splunk - - [x] Gitlab - - [x] PGP/GPG files - - [x] Vim swp files - - [x] ctr - - [x] runc - - [x] Firefox user files - - [x] Google Chrome user files - - [x] Autologin files - - [x] S/Key - - [x] YubiKey - - [x] Passwords inside pam.d - - [x] FastCGI params - - [x] SNMPD + - [x] Check out [sensitive_files.yaml](https://github.com/carlospolop/privilege-escalation-awesome-scripts-suite/blob/master/build_lists/sensitive_files.yaml) - **Generic Interesting Files** - [x] SUID & SGID files