Linux hacking

[SephStorm]

Hi all.

While I have in the past been focused on Windows exploitation (and a beginner with that) I find myself having to expand my horizons. In keeping in line with my training, I need to enumerate information on the machine (vm) that I want to attack. Unfortunately I have little ideas where to start. The book I have access to at the moment seems fixed on Windows enumeration, and google has not been much better. I see results on Linux NIC enumeration.

Steps taken so far:
Scanned my network and found a "victim".
Scanned the host and performed port, OS and version detection.
"banner grabbing", connecting to the services with netcat.

at this point there is a gap in my knowledge. I know that eventually I will need to crack passwords and eventually gain access to the system, but I do know that if I want to gain access through one of the open services, I will need to enumerate the users and possibly other information on the machine. Can anyone point me in the right direction, or point me to some resources?

[cgelici]

Why don't you try a vulnerable linux machine to exploit, you can find some here: g0tmi1k: [Site News] Vulnerable by Design (Part 2)

Also if you want to research linux exploitation, sickn3ss has some paper's about that which you can find here: http://sickness.tor.hu/

Hope this can get you started.

[Sys7emR00t]

www.exploitdb.com also has a variety of papers and exploit code written for Linux systems. Use the search (for platform) page.

[shadowzero]

www.exploitdb.com also has a variety of papers and exploit code written for Linux systems. Use the search (for platform) page.

Just a tiny correction, I think you mean http://www.exploit-db.com

[Synth3tik0]

dont say victim

[hatlinux]

make your own hacking lab. you can create a small computer network using some computer or create virtual machine using vmware/virtualbox. Try to attack your own system to keep your nose safely.

[SephStorm]

Thank you all.

This is being done on a lab at home, on vm's, but they are pre-built, I have to learn how to exploit them. My initial issue was gaining access, none of the services were remotely exploitable, I had to run Hydra against the ftp service to gain user level access. (I was able to do this and gain all the non root account info, but I swear, I was lucky to happen to get those words in my lists. I looked at so many lists and was not able to find 1 with all three passwords, or the usernames. In this case, 1 username was in a dictionary included in the distro for another tool and I got the first PW. Then I cat'ed /etc/passwd to get the other user accounts. The second PW was in another dictionary, and I had to find a related dictionary to find the third. If anyone has a large dictionary of english words, please share.)

My current issue rates its own thread, i'll have that one shortly, thank you again.