9.2 Unix User Enumeration & Service Discovery

9.2 Unix User Enumeration & Service Discovery

Reconnaissance against Unix and Linux targets encompasses both external network-based interrogation and internal local environment auditing. On the network perimeter, legacy Unix services frequently disclose valid usernames, internal network structures, and operational habits. Once local access is obtained, systematic host auditing allows an analyst to evaluate automated tasks, environment variable inheritance, and system audit logs to uncover privilege escalation pathways and track administrative activity.

---

Network-Based User Enumeration

Compiling an accurate list of valid usernames is a pivotal phase of a penetration test. Valid accounts can be targeted with credential spraying attacks, analyzed for password reuse, or correlated with public data breaches. Historically, Unix systems implemented administrative protocols intended to foster academic and multi-user collaboration, creating widespread user enumeration vulnerabilities.

+-----------------------------------------------------------------------------+
|                   NETWORK-BASED USER ENUMERATION PROTOCOLS                  |
+-----------------------------------------------------------------------------+
| Protocol | Port   | Diagnostic Command / Vector   | Information Disclosed   |
+----------+--------+-------------------------------+-------------------------+
| Finger   | TCP 79 | finger @target, finger user   | Real name, shell, .plan |
| SMTP     | TCP 25 | VRFY, EXPN, RCPT TO:          | Mailbox existence       |
| Identd   | TCP 113| <client_port>, <server_port>  | Process owner username  |
| OpenSSH  | TCP 22 | Timing / CVE-2018-15473       | User validity via timing|
+-----------------------------------------------------------------------------+

1. The Finger Protocol (TCP Port 79, RFC 1288)

The Finger protocol was designed to provide status reports on computer users. When queried, a Finger daemon (fingerd) inspects local user session tables and account files, returning structured identity data.

• Targeted Query (finger user@target): Discloses the user's real name, home directory, login shell, current terminal (tty), idle duration, last login timestamp, unread mail status, and the raw text contents of ~/.plan, ~/.project, and ~/.forward files.
• Wildcard / Global Query (finger @target or finger ''@target): Prompts the daemon to dump a summary of all users currently logged in across the entire operating system.
• Security Significance: Penetration testers examine ~/.plan files because users historically stored personal notes, project schedules, internal telephone numbers, and administrative reminders inside them—yielding valuable OSINT and social engineering material.

# Querying a specific account on a Unix server
finger root@192.168.1.50
# Login: root           Name: SuperUser
# Directory: /root      Shell: /bin/bash
# On since Mon Sep 14 09:12 (EDT) on pts/0 from 192.168.1.10
# Plan:
# Reminder: Backup database before Wednesday maintenance window.

2. SMTP User Enumeration (TCP Port 25, RFC 5321)

Simple Mail Transfer Protocol (SMTP) daemons (such as Sendmail, Postfix, and Exim) implement commands intended for mail routing verification that can be repurposed to confirm the existence of local system accounts:

• VRFY <username> (Verify): Directly asks the mail server to verify whether a given username exists. A response of 250 2.1.5 User exists confirms validity, whereas 550 5.1.1 User unknown indicates an invalid account.
• EXPN <list> (Expand): Asks the mail server to expand a mailing list or alias into individual member email addresses, revealing internal usernames and distribution lists.
• RCPT TO:<user@domain> (Recipient Testing): Even when VRFY and EXPN are disabled, testers initiate a mock mail delivery sequence (HELO, MAIL FROM:<test@test.com>, RCPT TO:<target_user@domain>). Many mail servers validate recipient existence immediately, issuing a 550 error code for non-existent users before message body transmission.

# Automated enumeration using smtp-user-enum
smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 10.10.10.25

Hardening Remediation: In Postfix, set disable_vrfy_command = yes in /etc/postfix/main.cf and configure mail servers to return ambiguous 252 status codes ("Cannot VRFY user, but will accept message").

3. The Identification Protocol (Identd, TCP Port 113, RFC 1413)

The Identification Protocol allows a server to determine the identity of a user who initiated a specific TCP connection.

• Protocol Flow: When a client establishes a TCP connection to a server, the server transmits a query to the client's identd service on TCP port 113 containing <client_port>, <server_port>.
• Response: The daemon returns the operating system type and the exact username that owns the active socket:

  Query  : 41234, 80
  Reply  : 41234, 80 : USERID : UNIX : www-data
  

• Assessment Value: If an internal Unix system connects to an analyst's listening host (e.g., via a reverse shell, automated script, or network callback), querying TCP port 113 on the target reveals which user account spawned the connection without requiring host-level credentials.

4. SSH User Enumeration & Timing Attacks (CVE-2018-15473)

Modern Secure Shell (OpenSSH <= 7.7) implementations contain timing discrepancies during the authentication handshake. When an authentication request (such as public-key authentication or malformed packet payloads) is submitted for an invalid user, OpenSSH terminates processing early. For a valid user, the server performs full cryptographic parsing and verification.

By measuring microsecond response delays or detecting differences in packet rejection responses (SSH_MSG_USERAUTH_FAILURE), remote attackers can enumerate valid accounts even when password authentication is disabled.

---

Local System Enumeration & Auditing

Following initial compromise via an unprivileged shell, analysts conduct local enumeration to identify configuration vulnerabilities and privilege escalation paths.

+-----------------------------------------------------------------------------+
|                        LOCAL ENUMERATION ATTACK SURFACE                     |
+-----------------------------------------------------------------------------+
| Vector              | Mechanism                       | Risk Profile        |
+---------------------+---------------------------------+---------------------+
| PATH Hijacking      | Relative binary invocation      | SUID Root Execution |
| Cron Tasks          | Writable scripts / wildcards    | Automated Root Exec |
| Dynamic Linker      | LD_PRELOAD / LD_LIBRARY_PATH    | Shared Library Hijack|
| Log Files           | Plaintext / Binary accounting   | Operational Auditing|
+-----------------------------------------------------------------------------+

1. Environment Variables & PATH Hijacking

When an executable executes a system command without specifying an absolute path (e.g., invoking system("service apache2 restart") instead of /usr/sbin/service), the operating system searches the directories listed in the $PATH environment variable sequentially from left to right.

# Inspect current PATH
echo $PATH
# /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

The Hijacking Attack Chain:

1. An analyst identifies a custom SUID root binary (/usr/local/bin/statuscheck) that internally executes curl -s http://internal.lan without an absolute path.
2. The analyst creates a malicious executable named curl in a writable directory such as /tmp:

   echo -e '#!/bin/bash
   

/bin/bash -p' > /tmp/curl chmod +x /tmp/curl

3. The analyst prepends `/tmp` to the `$PATH` variable:
```bash
export PATH=/tmp:$PATH

1. Upon executing /usr/local/bin/statuscheck, the binary resolves curl to /tmp/curl rather than /usr/bin/curl, executing the attacker's script with effective root privileges.

Defensive Measure: Administrative utilities should always invoke binaries using fully qualified absolute paths, and /etc/sudoers should enforce secure_path to sanitize environment variables during privileged execution.

2. Scheduled Tasks: Cron Automation & Wildcard Injection

The Unix cron daemon executes scheduled commands defined in system-wide crontabs (/etc/crontab, /etc/cron.d/, /etc/cron.hourly/, /etc/cron.daily/) and user spool files (/var/spool/cron/crontabs/).

Crontab Format

# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12)
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7)
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
*/5  *  *  *  * root      /opt/maintenance/cleanup.sh

Exploitation Vector 1: Writable Cron Scripts

If /opt/maintenance/cleanup.sh is owned by root but configured with group or world-write permissions (0666 or 0777), an unprivileged attacker can append a reverse shell payload to the script. Within five minutes, the cron daemon executes the payload as root.

Exploitation Vector 2: Wildcard Command Injection (tar *)

When a cron job utilizes shell wildcards (*) in a shared directory, an attacker can manipulate command-line argument parsing. Consider the following root crontab entry:

cd /var/www/uploads && tar -czf /backups/backup.tar.gz *

The shell expands the wildcard * into all filenames in /var/www/uploads before passing them as arguments to tar. An attacker creates three specific files in /var/www/uploads:

# 1. Create a script containing the payload
echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' > /var/www/uploads/shell.sh
chmod +x /var/www/uploads/shell.sh

# 2. Create files whose names match tar command-line flags
touch '/var/www/uploads/--checkpoint=1'
touch '/var/www/uploads/--checkpoint-action=exec=sh shell.sh'

When tar executes, the expanded command becomes:

tar -czf /backups/backup.tar.gz --checkpoint=1 --checkpoint-action=exec=sh shell.sh shell.sh

The GNU tar binary parses --checkpoint=1 and --checkpoint-action=exec=sh shell.sh as command-line options rather than filenames, executing shell.sh with root authority.

---

System Log Files and Forensic Auditing

Understanding where Unix records administrative, authentication, and user activity is vital for detecting intrusions, performing forensic triage, and assessing log integrity.

# Auditing historical successful user logins and system reboots
last -n 10

# Auditing failed authentication attempts (brute force detection)
sudo lastb -n 10

# Checking currently logged-in users and their terminal tty
who -u

Anti-Forensics & Log Tampering

Intruders frequently attempt to erase their footprints by zeroing plaintext logs (e.g., > /var/log/auth.log or cat /dev/null > /var/log/auth.log). However, modern SIEM systems ingest logs in real time via remote syslog (syslog-ng, rsyslog over TLS), rendering local log wiping ineffective. Furthermore, unsetting HISTFILE (unset HISTFILE or export HISTSIZE=0) prevents the user's interactive command history from being written to ~/.bash_history.