Linux Local System Enumeration

System enumeration establishes the full picture of the host: OS version, kernel, architecture, installed software, and environment. This feeds directly into kernel exploit selection, identifying installed tools you can use, and understanding what services are present. Run this early — before you start chasing privilege escalation paths.

OS and Kernel Version

The kernel version and architecture are the two most actionable fields. The kernel version determines which local privilege escalation CVEs apply. See Linux Kernel Local Privilege Escalation and Dirty Pipe (CVE-2022-0847).

These give the distribution name and version. Useful for identifying distribution-specific package versions and default configurations.

Architecture

Determines which compiled exploit binaries or payloads to use. x86_64 is the most common. aarch64 or armv7l requires different binaries.

Hostname and Domain

The FQDN (hostname -f) indicates whether the host is domain-joined. A hostname like web01.corp.local tells you the internal domain name without any active queries.

Environment Variables

Environment variables frequently contain credentials, API keys, database connection strings, and application secrets — especially in containerized or cloud-hosted environments. AWS_ACCESS_KEY_ID, DB_PASSWORD, SECRET_KEY, and similar variables appear here regularly.

/proc/1/environ is the environment of PID 1 (init/systemd). It requires root to read on most systems, but the attempt itself tells you what access you have.

Installed Packages

The package list reveals installed software versions, which feeds into CVE matching. Also check for security tools that indicate the host is monitored:

Their presence does not mean you stop — it means you work with more awareness of what generates alerts.

Available Binaries and Tools

Knowing what is installed determines what post-exploitation and data transfer options are available without uploading anything.

The presence of gcc or make means you can compile exploits locally. python3, perl, or ruby means interpreter-based payloads work. wget or curl means file transfer is straightforward.

Running Shell and Terminal

$PATH shows where the shell resolves commands. Non-standard entries in PATH are worth noting — they feed directly into Writable PATH Hijacking for Privilege Escalation.

System Uptime and Load

Long uptime suggests a stable, unpatched system — kernel exploits become more viable. Recent reboots can indicate recent patching activity.

Disk and Filesystem Usage

lsblk lists all block devices including unmounted ones. Unmounted partitions are a specific privilege escalation vector covered in Unmounted Filesystem Privilege Escalation.

Container and Virtualization Detection

If /.dockerenv exists, you are inside a Docker container. The cgroup path in /proc/1/cgroup typically contains docker or lxc if containerized. This changes the privilege escalation focus — container escape techniques apply rather than standard host privesc. See Docker Container Escape and Host Privilege Escalation.

SELinux and AppArmor

Enforcing SELinux or AppArmor profiles restrict what exploits and techniques work. Enforcing means many filesystem and exec-based attacks will be blocked. Permissive logs but does not block. Disabled means no MAC restrictions apply.

Writable Directories

Common writable staging locations for file upload and exploit compilation:

/tmp, /dev/shm, and /var/tmp are almost always writable. Non-standard writable directories in paths like /opt or /var/www are more interesting.