LinEnum

by | May 24, 2018 | Blog

Es un shell para correr en un usuario de linux que ya tengas y te va a dar mucha información.

Scripted Local Linux Enumeration & Privilege Escalation Checks
https://github.com/rebootuser/LinEnum
1,988 forks.
6,937 stars.
25 open issues.

Recent commits:

Para hacerlo, bájala localmente, y subela, cambiale los permisos y ve que te dice.

meterpreter > upload '/root/Downloads/LinEnum-master/LinEnum.sh' 
[*] uploading  : /root/Downloads/LinEnum-master/LinEnum.sh -> LinEnum.sh
meterpreter > shell
Process 13098 created.
Channel 9 created.
./LinEnum.sh
/bin/sh: 1: ./LinEnum.sh: Permission denied
chmod 777 LinEnum.sh
./LinEnum.sh

#########################################################
# Local Linux Enumeration & Privilege Escalation Script #
#########################################################
# www.rebootuser.com
# 

ETC

particularmente interesante es esta parte 

[+] We can sudo without supplying a password!
Matching Defaults entries for shelly on Shocker:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User shelly may run the following commands on Shocker:
    (root) NOPASSWD: /usr/bin/perl

si no corre con ./ puedes intetnar con bash o sh