Linux
方法
命令
uname -a;cat /etc/*-release
ps -aux | grep root
cat /etc/passwd | awk -F: '$3==0'
find / -perm -u=s -type f 2>/dev/null
find / -perm -g=s -type f 2>/dev/null
find / -writable -type d 2>/dev/null
find /etc/ -readable -type f 2>/dev/null
find / -writable -type f 2>/dev/null | grep -v "/proc/" | xargs ls -la | grep root
文件
~/.bashrc
~/.bash_history
~/.nano_history
~/.atftp_history
~/.mysql_history
~/.php_history
-----------------
/.ssh/*
/var/mail
/etc/cron*
/etc/group
/etc/passwd
/etc/shadow
/etc/sudoers
/etc/profile
链接
Kernel
BeRoot
GTFOBins
Windows
命令
systeminfo
net user
netstat -nao
tasklist -svc
schtasks /query /fo LIST /v
链接
Kernel
BeRoot
LOLBAS