# priv esc enumeration scripts
https://github.com/rebootuser/LinEnum
https://github.com/reider-roque/linpostexp/blob/master/linprivchecker.py
http://pentestmonkey.net/tools/audit/unix-privesc-check
cat /etc/lsb-release # Debian based
cat /etc/redhat-release # Redhat based
# running services and find services run boy root
# which applications are installed
ssh -D 127.0.0.1:9050 -N [username]@[ip]
cat ~/.ssh/authorized_keys
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key
# Sticky Bits & SUID & GUID
find / -perm -1000 -type d 2>/dev/null # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here.
find / -perm -g=s -type f 2>/dev/null # SGID (chmod 2000) - run as the group, not the user who started it.
find / -perm -u=s -type f 2>/dev/null # SUID (chmod 4000) - run as the owner, not the user who started it.
find / -perm -g=s -o -perm -u=s -type f 2>/dev/null # SGID or SUID