14 1 Flashcards
___ - file that controls what and where facilities are logged. If remote logging is set, ‘@loghost’ syntax will be present
/etc/syslog.conf
Unix/Linux Rootkits:
___ - Replaces system application with rooted system files (ls, find, ps, netstat, login, and passwd commands) and inetd daemon services.
User-Mode
unix/linux syntax:
___ - outputs full, long list of active processes.
___ - prints current running processes
___ - prints processes in full list
ps
- e
- f
___ - this file is referenced for hostname resolution.
/etc/hosts
Unix/Linux Shell History File:
___ - History file is located in user’s home directory as .bash_history.
Bourne Again Shell (bash)
unix/linux syntax:
___ - (solaris only) displays information on all users (logged in or not) and system accounts. Output contains user, UID, group name, GUID, and comments.
logins
unix/linux syntax:
___ - prints network connections.
options:
___ - displays routing information
___ - displays IP instead of interface
___ - displays connections/listening ports
___ - display associated PID for connections/ports
netstat
- r
- n
- a
- o
Overwrite the file with nothing, thereby clearing out all history file content. syntax = ___
echo “” .bash_history
unix/linux syntax:
___ - displays logged in username, terminal, login time, and where user is logged in from.
who
Tool to be used to conceal files within target system.
touch -t
System Change Logs:
___ - searches inside text files for matching patterns.
grep
-v
unix/linux syntax:
___ - manages job scheduling with cron jobs.
___ - edit job
___ - list jobs
crontab
- e
- l
Unix/Linux Shell History File:
___ - No history file supported. Ideal shell; nothing is recorded or needs to be cleaned.
Bourne Shell (sh)
unix/linux syntax:
___ - searches for files across the filesystem.
___ - filename to search for
___ - type of file
___ - modified file time range in minutes
find
- name
- type
- mmin
Syntax; Unset history file variable in a bash shell.
unset HISTFILE
Unix/Linux Rootkits:
___ - Modifies or replaces firmware to hide below the OS. Very hard to detect. Gets started before the OS.
Firmware
unix/linux syntax:
___ - provides interactive monitoring of active processes on UNIX OSs. In Linux, ‘top’ provides the same output.
___ - print info about processes and users
prstat
-a
Syntax; Clear the history file in a bash shell.
history -c
command to use the unreal exploit
use exploit/unix/irc/unreal_ircd_3281_backdoor
unix/linux syntax:
___ - prints ARP cache.
arp
Unix/Linux Rootkits:
___ - Exploits functionality of Loadable Kernel Module (LKM) to hide itself below the Application Layer.
Kernel-Mode
System Change Logs:
The ___ or ___ can be used to edit plaintext files.
vi editor
or
grep
The ___ module exploits a buffer overflow vulnerability in the adm_build_path() function of sadmind.
sadmind_adm_build_path
unix/linux syntax:
___ - Display processor (type,processor,chip) info
___ - verbose mode, extra info
psrinfo
-v
unix/linux syntax:
___ - displays all system hardware and software revision info
___ - print only patch revision info
showrev
-p
unix/linux syntax:
___ - displays summary of system and user activity.
w
___ removes user’s last entry from WTMP, UTMP, LASTLOG, WTMPX, and UTMPX files. ___ attempts to remove a username from all possible files and binaries.
ZAP3
unix/linux syntax:
___ - displays software package information
___ - list in long format
pkginfo
-l
unix/linux syntax:
___ - display amount of disk space by file system
___ - prints block sizes
df
-k
ZAP3:
___ - uses /var/adm/wtmpx to display login/logout and system boot info; most recent entry at top.
last
unix/linux syntax:
___ - display current system information
___ - prints all system info
uname
-a
unix/linux syntax:
___ - (solaris only) displays logged in username, active process/CPU time owned by user, login time, machine name, and time of day.
whodo
___ are software programs and files designed to provide continued unauthorized root access to a system and hide any evidence of compromise.
Rootkits
Command to use the sadmind exploit
use exploit/solaris/sunrpc/sadmind_adm_build_path
Unix/Linux Enumeration:
___ - Displays logged in users information.
option:
___ - displays in long list format
finger
-l
Unix/Linus Enumeration:
___ - Displays logged in user information (similar to finger)
___ - display in long list format
rusers
-l
Unix/Linux Enumeration:
___ - Display target host RPC services by program, transport, service name, and owner.
option:
___ - Display associated port numbers.
rpcinfo
-p
Unix/Linux Enumeration:
___ - Displays a target hosts NFS exported file system.
option:
___ - Prints the list of shared file systems.
showmount
-e
___ (aka port forwarding) is the encapsulation of data for transmission through a network.
Tunneling
Tunnel Types:
___ tunnel opens a port on the AP and sends data through the redirector (pivot), who then sends it to the targets vulnerable port.
Forward tunnel
Tunnel Types:
___ tunnel opens a port on the redirector (pivot) and returns data to the AP.
Reverse tunnel
