## Simple Enum - simple checks ![[images/Pasted image 20251014153549.png]]![[images/Pasted image 20251014155919.png]]![[images/Pasted image 20251014154504.png]] - network interfaces![[images/Pasted image 20251014162707.png]] ![[images/Pasted image 20251014163528.png]] ## File System Goodies - poke around fs - interesting commands under `.bash_history` ![[images/Pasted image 20251014153722.png]]![[images/Pasted image 20251014154042.png]]![[images/Pasted image 20251014154120.png]]![[images/Pasted image 20251014154145.png]] - I can open the `lab_adm` home directory ![[images/Pasted image 20251014160128.png]] - Are we domain joined? ![[images/Pasted image 20251014154641.png]] ## Cred Hunting - search for scripts > nothing![[images/Pasted image 20251014160437.png]] - search for creds across cnf files > nothing - search for creds across conf files > nothing - search for creds across cfg files > nothing ![[images/Pasted image 20251014163432.png]] - search for dbs > none - jbetty crontab > nothing - `/etc/crontab` > nothing - search for interesting strings in logs > nothing - search for browser creds > nothing for firefox - transferred `mimipenguin.py` but must be run as root - transferred `lazagne.py` but issues when attempting to run ![[images/Pasted image 20251014162058.png]] - try to do a `git clone` from target box - box includes git but not pip