---
# System prepended metadata

title: CTF Technique

---

# CTF Technique

# Defense

## Common

- Find sensitivefile
- 
locate password | more 
find / -name authorized_keys 2> /dev/null
find / -name id_rsa 2> /dev/null


- Find writeable files
find / -writable ! -user `whoami` -type f ! -path "/proc/*" ! -path "/sys/*" -exec ls -al {} \; 2>/dev/null
find / -perm -2 -type f 2>/dev/null
find / ! -path "*/proc/*" -perm -2 -type f -print 2>/dev/null


- Check all process to find uncommon process (note it as potential vuln app)
ps -ef --forest


- Check all port to find uncommon service (note it as potential vuln app)
netstat -a -p --unix


- Check privilege file and set least privilege
  - /etc/passwd
  - /etc/shadow
  - /etc/sudoers
  - /run/docker.sock (check docker)
  - env: SSH_AUTH_SOCK

sudo -l


- Find all SUID & GUID file
# Find
find / -perm -4000 -type f -exec ls -la {} 2>/dev/null \;
find / -uid 0 -perm -4000 -type f 2>/dev/null
# Fix
sudo chmod -s /tmp/x
 

- Cron
  - /etc/init.d
  - /etc/cron*
  - /etc/crontab
  - /etc/cron.allow
  - /etc/cron.d 
  - /etc/cron.deny
  - /etc/cron.daily
  - /etc/cron.hourly
  - /etc/cron.monthly
  - /etc/cron.weekly
  - /etc/sudoers
  - /etc/exports
  - /etc/anacrontab
  - /var/spool/cron
  - /var/spool/cron/crontabs/root

  - crontab -l
  - ls -alh /var/spool/cron;
  - ls -al /etc/ | grep cron
  - ls -al /etc/cron*
  - cat /etc/cron*
  - cat /etc/at.allow
  - cat /etc/at.deny
  - cat /etc/cron.allow
  - cat /etc/cron.deny*

- Systemd timers
systemctl list-timers --all


- Linux Cap
Capabilities name    Description
CAP_AUDIT_CONTROL    Allow to enable/disable kernel auditing
CAP_AUDIT_WRITE    Helps to write records to kernel auditing log
CAP_BLOCK_SUSPEND    This feature can block system suspends
CAP_CHOWN    Allow user to make arbitrary change to files UIDs and GIDs
CAP_DAC_OVERRIDE    This helps to bypass file read, write and execute permission checks
CAP_DAC_READ_SEARCH    This only bypass file and directory read/execute permission checks
CAP_FOWNER    This enables to bypass permission checks on operations that normally require the filesystem UID of the process to match the UID of the file
CAP_KILL    Allow the sending of signals to processes belonging to others
CAP_SETGID    Allow changing of the GID
CAP_SETUID    Allow changing of the UID
CAP_SETPCAP    Helps to transferring and removal of current set to any PID
CAP_IPC_LOCK    This helps to lock memory
CAP_MAC_ADMIN    Allow MAC configuration or state changes
CAP_NET_RAW    Use RAW and PACKET sockets
CAP_NET_BIND_SERVICE    SERVICE Bind a socket to internet domain privileged ports
# Find
/usr/bin/getcap -r  /usr/bin
# Fix
/usr/bin/setcap -r /bin/ping


- Hide command output (after finishing hardening)
exec >/dev/null