AutoRecon VS pspy

pipx install git+https://github.com/Tib3rius/AutoRecon.git

Yeah it's been out for about a year now. Same repo, just a version update. https://github.com/Tib3rius/AutoRecon

smbmap - I believe so as it is a part of https://github.com/Tib3rius/AutoRecon

It sounds like you’re looking for something like AutoRecon.

I used AutoRecon (thanks tibs) and PEAS for both linux and windows privesc. But again, the reason I failed the first time was because I relied to heavily on these tools. I really like the disclaimer on the autorecon github:

Initial Recon/Exploitation - Initial scan your target with either autorecon (https://github.com/Tib3rius/AutoRecon) or an in-depth nmap scan. Then, for each port, enumerate with commands from hacktricks (https://book.hacktricks.xyz/), (https://fareedfauzi.gitbook.io/oscp-notes/services-enumeration/http-s/enumeration-checklist) and (https://web.archive.org/web/20200309204648/http://0daysecurity.com/penetration-testing/enumeration.html) but you could honestly just get away with hacktricks. If you see any sort of service, CMS, or whatever running, searchsploit it. Sometimes, you might get lucky and find an exploit that you can use or can keep in your back pocket for PE later. If you need help with how to actually do an exploit (https://ippsec.rocks/?#) is your friend. IPPSEC is the GOAT.

Credits to the creator of these resources - Tib3rius Privilege Escalation Courses (Windows & Linux) - Tib3rius AutoRecon: https://github.com/Tib3rius/AutoRecon - https://github.com/mchern1kov/pentest-everything - https://kashz.gitbook.io/kashz-jewels/ - https://book.hacktricks.xyz/

* https://github.com/DominicBreuker/pspy

When you deploy them they just work. Compare that to compiled C++ code you often face issues with the deployment in my experience. And production machines usually do not ship compilers.

Configure auditd to log everything. Then use ausearch and aureport to inspect the events. You could also configure rsyslog to send the logs to a remote grafana server. There're a lot of tools you could use: falco, tracee, osquery, go-auditd+elastic, pspy , ...

Literally using this right now on a pentest looking for privesc in some Linux boxes - the great thing about this tool is it's a shell script that's portable and does a significant amount of enumeration - big time saver. Feel as if it's better then the most others out there.

The second go-to tool after Linpeas is pspy which "allows you to see commands run by other users, cron jobs, etc. as they execute" [1]

[1] https://github.com/DominicBreuker/pspy

skipping processes (use tools such as pspy)

I also forgot https://github.com/DominicBreuker/pspy obviously for linux privesc


It’s not in crontab either. You need to use a tool like pspy to find it.

All you need to do is run a tool like ps or top often enough and eventually you'll catch a short-lived process exposing sensitive data in its command line. In fact, people wrote specialized scripts doing that at fast enough speed to catch them: https://github.com/DominicBreuker/pspy