Edit

Useful thing to look for

passwd

investigator@10.10.224.80:~$ cat /etc/passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin

Identifying Groups

investigator@10.10.224.80:~$ cat /etc/group
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog,ubuntu,investigator

To determine which groups a specific user is a member of, we can run the following command:

investigator@ip-10-10-224-80:~$ groups sys
sys : sys
investigator@ip-10-10-224-80:~$ groups investigator
investigator : investigator adm dialout cdrom floppy sudo audio dip video plugdev netdev lxd
investigator@ip-10-10-224-80:~$ groups bob
bob : bob
investigator@ip-10-10-224-80:~$ groups root
root : root
investigator@ip-10-10-224-80:~$

Alternatively, to list all of the members of a specific group, we can run the following command:

User Logins and Activity

find stat of file

debsums

we provide the -e flag to only perform a configuration file check. In addition, we provide the -s flag to silence any error output that may fill the screen.

Chkrootkit

RKHunter

Check loggedin shell or Display All Processes in a Hierarchical Tree with ps Command

output:-

PreviousLinuxNextMobileApplicationPenetrationTestingNotes

Last updated