ExamFinch.com My Study

Study guide

9.2 Unix User Enumeration & Service Discovery

Practice this exam

CREST Practitioner Security Analyst CPSA

Track your progress as you read

Finished sections get a check mark.

1 Chapter 1: Soft Skills, Legal Framework & Assessment Management

1.1 The Penetration Testing Engagement Lifecycle & Scoping 1.2 Legal Framework: Computer Misuse Act & Compliance 1.3 Understanding, Explaining & Managing Technical Risk 1.4 Record Keeping, Interim Escalation & Reporting Standards

2 Chapter 2: Core Networking: IP Protocols & Network Architectures

2.1 IPv4 and IPv6 Addressing, Subnetting & Header Architecture 2.2 TCP and UDP Transport Protocols & Handshake Mechanics 2.3 ICMP Protocol, Network Diagnostics & Error Messages 2.4 Network Topologies, Switched Media & VLAN Segmentation 2.5 Network Media, Ethernet Standards & Physical Topologies

3 Chapter 3: Cryptography & Secure Communication Protocols

3.1 Symmetric & Asymmetric Cryptographic Algorithms 3.2 Cryptographic Hash Functions, MACs & Digital Signatures 3.3 Secure Protocols: SSL/TLS, IPsec & SSH

4 Chapter 4: Background Information Gathering & OSINT Reconnaissance

4.1 WHOIS Records, Domain Registrars & Autonomous Systems 4.2 DNS Infrastructure, Record Types & Zone Transfers 4.3 Search Engine Reconnaissance, Google Dorking & Information Leakage 4.4 Newsgroups, Mailing Lists & Public Archive Reconnaissance

5 Chapter 5: Networking Equipment & Infrastructure Protocols

5.1 Router & Switch Management: SNMP, SSH & Authentication 5.2 Layer 2 Protocols: ARP, CDP, STP, VTP & Redundancy 5.3 Core Network Services: DHCP, NTP & TFTP 5.4 Wireless Security (802.11) & VoIP Assessment 5.5 Out-of-Band Management, Console Access & Cisco Reverse Telnet

6 Chapter 6: Network Mapping, Nmap Techniques & Target Identification

6.1 Host Discovery Techniques & Ping Sweep Methodologies 6.2 Port Scanning Mechanics: TCP, UDP & Stealth Scans 6.3 OS Fingerprinting, Service Detection & Timing Templates 6.4 Firewall and IDS/IPS Evasion Techniques 6.5 Passive OS & Service Fingerprinting 6.6 Network Access Control Analysis & Firewall Rule Base Review

7 Chapter 7: Vulnerability Identification & Tool Output Analysis

7.1 Vulnerability Scanning Principles & Methodology 7.2 CVE Referencing, CVSS Scoring & Risk Prioritisation 7.3 Banner Grabbing, Service Verification & Manual Triage 7.4 Host Audit Techniques: Processes, Sockets, Patch Levels & Interesting Files

8 Chapter 8: Microsoft Windows Security Assessment & Active Directory

8.1 Active Directory Architecture & Domain Reconnaissance 8.2 Windows User & Group Enumeration via SMB & RPC 8.3 Windows Authentication: NTLM, Kerberos & Password Security 8.4 Windows Patch Management, Local Security & Common Services 8.5 Windows File System, Share & Registry Permissions 8.6 Desktop Lockdown, Citrix Breakout & Common Windows Applications

9 Chapter 9: Unix & Linux Security Assessment & Legacy Services

9.1 Linux/Unix Security Architecture, Permissions & Filesystem 9.2 Unix User Enumeration & Service Discovery 9.3 Network File System (NFS) & RPC Services Assessment 9.4 Legacy Unix Services: R-Services, X11, FTP & Modern SSH 9.5 Unix Remote Information Services: rusers, rwho, finger & systat 9.6 Unix Vulnerability Exploitation & Post-Exploitation Workflow

10 Chapter 10: Web Architectures, Technologies & Testing Methodologies

10.1 Web Server Architecture & the HTTP/HTTPS Protocol 10.2 Web Application Components, Frameworks & State Management 10.3 Web Reconnaissance, Content Discovery & Threat Modelling 10.4 Testing Authentication, Authorization & Session Management 10.5 Web Service Protocols: SOAP, REST & XML Messaging 10.6 Web APIs, Server Extensions & Client-Side Sub-Components

11 Chapter 11: Web Testing Techniques & OWASP Top Vulnerabilities

11.1 Input Validation Vulnerabilities & Parameter Manipulation 11.2 Cross-Site Scripting (XSS): Types, Impact & Defenses 11.3 Cross-Site Request Forgery (CSRF) & Client-Side Attacks 11.4 Command Injection, File Upload Vulnerabilities & API Flaws 11.5 Information Disclosure: Error Messages & Mark-up Leakage 11.6 Injection Beyond SQL: LDAP, XPath, Code & Template Injection 11.7 Source Code Review & Encoded/Cryptographic Value Analysis

12 Chapter 12: Database Security Assessment & SQL Injection

12.1 Database Architectures, Default Ports & Authentication 12.2 SQL Injection (SQLi) Foundations & In-Band Techniques 12.3 Blind SQL Injection & Database Enumeration 12.4 Database Attack Vectors, Stored Procedures & Hardening

9.2 Unix User Enumeration & Service Discovery

Key Takeaways Explain This Topic AI

Legacy network services such as Finger (TCP 79) and SMTP (TCP 25) expose explicit user verification primitives (e.g., VRFY, EXPN, RCPT TO) that allow remote attackers to compile high-confidence user account inventories.

The Identification Protocol (identd, TCP 113) leaks the exact Unix user account owning an active TCP socket, transforming unprivileged network daemons into user disclosure conduits.

Local privilege escalation frequently targets environment variable manipulation—specifically relative command execution in SUID binaries vulnerable to PATH hijacking—and cron automation misconfigurations such as wildcard injection (tar *).

Unix logging architecture segregates authentication events in /var/log/auth.log or /var/log/secure, while binary accounting files wtmp (last), utmp (who), and btmp (lastb) record historical sessions, current interactive logins, and failed authentication attempts.

Last updated: September 2026

9.2 Unix User Enumeration & Service Discovery

Reconnaissance against Unix and Linux targets encompasses both external network-based interrogation and internal local environment auditing. On the network perimeter, legacy Unix services frequently disclose valid usernames, internal network structures, and operational habits. Once local access is obtained, systematic host auditing allows an analyst to evaluate automated tasks, environment variable inheritance, and system audit logs to uncover privilege escalation pathways and track administrative activity.

Network-Based User Enumeration

Compiling an accurate list of valid usernames is a pivotal phase of a penetration test. Valid accounts can be targeted with credential spraying attacks, analyzed for password reuse, or correlated with public data breaches. Historically, Unix systems implemented administrative protocols intended to foster academic and multi-user collaboration, creating widespread user enumeration vulnerabilities. +-----------------------------------------------------------------------------+

  • | NETWORK-BASED USER ENUMERATION PROTOCOLS |
  • +-----------------------------------------------------------------------------+
  • | Protocol | Port | Diagnostic Command / Vector | Information Disclosed |
  • +----------+--------+-------------------------------+-------------------------+
  • | Finger | TCP 79 | finger @target, finger user | Real name, shell, .plan |
  • | SMTP | TCP 25 | VRFY, EXPN, RCPT TO: | Mailbox existence |
  • | Identd | TCP 113| <client_port>, <server_port> | Process owner username |
  • | OpenSSH | TCP 22 | Timing / CVE-2018-15473 | User validity via timing|
  • +-----------------------------------------------------------------------------+
  • 1. The Finger Protocol (TCP Port 79, RFC 1288)

The Finger protocol was designed to provide status reports on computer users. When queried, a Finger daemon ( fingerd ) inspects local user session tables and account files, returning structured identity data.

Targeted Query ( finger user@target ): Discloses the user's real name, home directory, login shell, current terminal ( tty ), idle duration, last login timestamp, unread mail status, and the raw text contents of ~/.plan , ~/.project , and ~/.forward files.

Wildcard / Global Query ( finger @target or finger ''@target ): Prompts the daemon to dump a summary of all users currently logged in across the entire operating system.

Security Significance: Penetration testers examine ~/.plan files because users historically stored personal notes, project schedules, internal telephone numbers, and administrative reminders inside them—yielding valuable OSINT and social engineering material. # Querying a specific account on a Unix server

  • finger root@192.168.1.50
  • # Login: root Name: SuperUser
  • # Directory: /root Shell: /bin/bash
  • # On since Mon Sep 14 09:12 (EDT) on pts/0 from 192.168.1.10

# Plan:

# Reminder: Backup database before Wednesday maintenance window.

2. SMTP User Enumeration (TCP Port 25, RFC 5321)

Simple Mail Transfer Protocol (SMTP) daemons (such as Sendmail, Postfix, and Exim) implement commands intended for mail routing verification that can be repurposed to confirm the existence of local system accounts:

VRFY <username> (Verify): Directly asks the mail server to verify whether a given username exists. A response of 250 2.1.5 User exists confirms validity, whereas 550 5.1.1 User unknown indicates an invalid account.

EXPN <list> (Expand): Asks the mail server to expand a mailing list or alias into individual member email addresses, revealing internal usernames and distribution lists.

RCPT TO:<user@domain> (Recipient Testing): Even when VRFY and EXPN are disabled, testers initiate a mock mail delivery sequence ( HELO , MAIL FROM:<test@test.com> , RCPT TO:<target_user@domain> ). Many mail servers validate recipient existence immediately, issuing a 550 error code for non-existent users before message body transmission. # Automated enumeration using smtp-user-enum

smtp-user-enum -M VRFY -U /usr/share/seclists/Usernames/Names/names.txt -t 10.10.10.25

Hardening Remediation: In Postfix, set disable_vrfy_command = yes in /etc/postfix/main.cf and configure mail servers to return ambiguous 252 status codes ("Cannot VRFY user, but will accept message").

3. The Identification Protocol (Identd, TCP Port 113, RFC 1413)

The Identification Protocol allows a server to determine the identity of a user who initiated a specific TCP connection.

Protocol Flow: When a client establishes a TCP connection to a server, the server transmits a query to the client's identd service on TCP port 113 containing <client_port>, <server_port> .

Response: The daemon returns the operating system type and the exact username that owns the active socket: Query : 41234, 80

Reply : 41234, 80 : USERID : UNIX : www-data

Assessment Value: If an internal Unix system connects to an analyst's listening host (e.g., via a reverse shell, automated script, or network callback), querying TCP port 113 on the target reveals which user account spawned the connection without requiring host-level credentials.

4. SSH User Enumeration & Timing Attacks (CVE-2018-15473)

Modern Secure Shell (OpenSSH <= 7.7) implementations contain timing discrepancies during the authentication handshake. When an authentication request (such as public-key authentication or malformed packet payloads) is submitted for an invalid user , OpenSSH terminates processing early. For a valid user , the server performs full cryptographic parsing and verification.

By measuring microsecond response delays or detecting differences in packet rejection responses ( SSH_MSG_USERAUTH_FAILURE ), remote attackers can enumerate valid accounts even when password authentication is disabled.

Local System Enumeration & Auditing

Following initial compromise via an unprivileged shell, analysts conduct local enumeration to identify configuration vulnerabilities and privilege escalation paths. +-----------------------------------------------------------------------------+

  • | LOCAL ENUMERATION ATTACK SURFACE |
  • +-----------------------------------------------------------------------------+
  • | Vector | Mechanism | Risk Profile |
  • +---------------------+---------------------------------+---------------------+
  • | PATH Hijacking | Relative binary invocation | SUID Root Execution |
  • | Cron Tasks | Writable scripts / wildcards | Automated Root Exec |
  • | Dynamic Linker | LD_PRELOAD / LD_LIBRARY_PATH | Shared Library Hijack|
  • | Log Files | Plaintext / Binary accounting | Operational Auditing|
  • +-----------------------------------------------------------------------------+
  • 1. Environment Variables & PATH Hijacking

When an executable executes a system command without specifying an absolute path (e.g., invoking system("service apache2 restart") instead of /usr/sbin/service ), the operating system searches the directories listed in the $PATH environment variable sequentially from left to right. # Inspect current PATH

  • echo $PATH
  • # /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin

The Hijacking Attack Chain:

An analyst identifies a custom SUID root binary ( /usr/local/bin/statuscheck ) that internally executes curl -s http://internal.lan without an absolute path.

The analyst creates a malicious executable named curl in a writable directory such as /tmp : echo -e '#!/bin/bash

/bin/bash -p' > /tmp/curl

chmod +x /tmp/curl 3. The analyst prepends `/tmp` to the `$PATH` variable:

  • ```bash
  • export PATH=/tmp:$PATH

Upon executing /usr/local/bin/statuscheck , the binary resolves curl to /tmp/curl rather than /usr/bin/curl , executing the attacker's script with effective root privileges.

Defensive Measure: Administrative utilities should always invoke binaries using fully qualified absolute paths, and /etc/sudoers should enforce secure_path to sanitize environment variables during privileged execution.

2. Scheduled Tasks: Cron Automation & Wildcard Injection

The Unix cron daemon executes scheduled commands defined in system-wide crontabs ( /etc/crontab , /etc/cron.d/ , /etc/cron.hourly/ , /etc/cron.daily/ ) and user spool files ( /var/spool/cron/crontabs/ ).

  • Crontab Format # .---------------- minute (0 - 59)
  • # | .------------- hour (0 - 23)
  • # | | .---------- day of month (1 - 31)
  • # | | | .------- month (1 - 12)
  • # | | | | .---- day of week (0 - 6) (Sunday=0 or 7)
  • # | | | | |
  • # * * * * * user-name command to be executed
  • */5 * * * * root /opt/maintenance/cleanup.sh
  • Exploitation Vector 1: Writable Cron Scripts

If /opt/maintenance/cleanup.sh is owned by root but configured with group or world-write permissions ( 0666 or 0777 ), an unprivileged attacker can append a reverse shell payload to the script. Within five minutes, the cron daemon executes the payload as root .

Exploitation Vector 2: Wildcard Command Injection ( tar * )

When a cron job utilizes shell wildcards ( * ) in a shared directory, an attacker can manipulate command-line argument parsing. Consider the following root crontab entry: cd /var/www/uploads && tar -czf /backups/backup.tar.gz *

The shell expands the wildcard * into all filenames in /var/www/uploads before passing them as arguments to tar . An attacker creates three specific files in /var/www/uploads : # 1. Create a script containing the payload

  • echo 'cp /bin/bash /tmp/rootbash && chmod +s /tmp/rootbash' > /var/www/uploads/shell.sh
  • chmod +x /var/www/uploads/shell.sh
  • # 2. Create files whose names match tar command-line flags
  • touch '/var/www/uploads/--checkpoint=1'
  • touch '/var/www/uploads/--checkpoint-action=exec=sh shell.sh'

When tar executes, the expanded command becomes: tar -czf /backups/backup.tar.gz --checkpoint=1 --checkpoint-action=exec=sh shell.sh shell.sh

The GNU tar binary parses --checkpoint=1 and --checkpoint-action=exec=sh shell.sh as command-line options rather than filenames, executing shell.sh with root authority.

System Log Files and Forensic Auditing

Understanding where Unix records administrative, authentication, and user activity is vital for detecting intrusions, performing forensic triage, and assessing log integrity.

Log File Format Associated Distributions Purpose & Auditing Utilities

/var/log/auth.log Plaintext Debian, Ubuntu, Kali Authentication events, SSH logins, sudo executions, PAM results

  • /var/log/secure Plaintext RHEL, CentOS, Fedora, Rocky Equivalent to auth.log for Red Hat family systems
  • /var/log/wtmp Binary All standard Linux / Unix Historical login/logout sessions, reboots; inspected via last

/var/log/utmp Binary All standard Linux / Unix Currently active user sessions, runlevels; inspected via who , w

  • /var/log/btmp Binary All standard Linux / Unix Failed login attempts; inspected via lastb (requires root)
  • /var/log/syslog Plaintext Debian, Ubuntu Central system messages, daemon logs, kernel alerts

/var/log/messages Plaintext RHEL, CentOS General system activity and non-critical daemon logs # Auditing historical successful user logins and system reboots

last -n 10

  • # Auditing failed authentication attempts (brute force detection)
  • sudo lastb -n 10
  • # Checking currently logged-in users and their terminal tty
  • who -u
  • Anti-Forensics & Log Tampering

Intruders frequently attempt to erase their footprints by zeroing plaintext logs (e.g., > /var/log/auth.log or cat /dev/null > /var/log/auth.log ). However, modern SIEM systems ingest logs in real time via remote syslog ( syslog-ng , rsyslog over TLS), rendering local log wiping ineffective. Furthermore, unsetting HISTFILE ( unset HISTFILE or export HISTSIZE=0 ) prevents the user's interactive command history from being written to ~/.bash_history .