# Linux Local System Enumeration

> Techniques for enumerating local Linux systems post-access: users, groups, SUID binaries, cron jobs, kernel version, and privilege escalation vectors.

- **URL:** https://hackindex.io/platforms/linux/enumeration/local-system-enumeration
- **Path:** Linux > Enumeration
- **Up:** [Enumeration](https://hackindex.io/platforms/linux/enumeration.md)
- **Published:** 2026-03-15
- **Updated:** 2026-04-24

System enumeration establishes the full picture of the host: OS version, kernel, architecture, installed software, and environment. This feeds directly into kernel exploit selection, identifying installed tools you can use, and understanding what services are present. Run this early: before you start chasing privilege escalation paths.

Key areas for linux local system enumeration:

- OS version, kernel, and architecture
- Hostname, domain, and environment variables
- Installed packages and available binaries
- Container and virtualization detection
- SELinux/AppArmor status and writable directories

## Linux OS and Kernel Enumeration

```bash
uname -a
# Linux target 5.4.0-182-generic #202-Ubuntu SMP Fri Apr 26 12:29:36 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux
```

The kernel version and architecture are the two most actionable fields. The kernel version determines which local privilege escalation CVEs apply. See [Linux Kernel Local Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/kernel-local-privilege-escalation) and [Dirty Pipe (CVE-2022-0847)](https://hackindex.io/platforms/linux/privilege-escalation/dirty-pipe-cve-2022-0847).

```bash
cat /etc/os-release
cat /etc/issue
cat /etc/*release
```

These give the distribution name and version. Useful for identifying distribution-specific package versions and default configurations.

## Architecture

```bash
uname -m
arch
```

Determines which compiled exploit binaries or payloads to use. `x86_64` is the most common. `aarch64` or `armv7l` requires different binaries.

## Hostname and Domain

```bash
hostname
hostname -f
cat /etc/hostname
```

The FQDN (`hostname -f`) indicates whether the host is domain-joined. A hostname like `web01.corp.local` tells you the internal domain name without any active queries.

## Environment Variables

```bash
env
printenv
cat /proc/1/environ | tr '\0' '\n'
```

Environment variables frequently contain credentials, API keys, database connection strings, and application secrets: especially in containerized or cloud-hosted environments. `AWS_ACCESS_KEY_ID`, `DB_PASSWORD`, `SECRET_KEY`, and similar variables appear here regularly.

`/proc/1/environ` is the environment of PID 1 (init/systemd). It requires root to read on most systems, but the attempt itself tells you what access you have.

## Installed Packages

```bash
dpkg -l 2>/dev/null
rpm -qa 2>/dev/null
```

The package list reveals installed software versions, which feeds into CVE matching. Also check for security tools that indicate the host is monitored:

```bash
dpkg -l | grep -E 'fail2ban|auditd|ossec|aide|tripwire|rkhunter|chkrootkit'
rpm -qa | grep -E 'fail2ban|audit|ossec|aide|tripwire'
```

Their presence does not mean you stop: it means you work with more awareness of what generates alerts.

## Available Binaries and Tools

Knowing what is installed determines what post-exploitation and data transfer options are available without uploading anything.

```bash
which wget curl nc netcat ncat python3 python perl ruby php gcc make git socat screen tmux
find /usr/bin /usr/local/bin /opt -maxdepth 2 -type f -executable 2>/dev/null | sort
```

The presence of `gcc` or `make` means you can compile exploits locally. `python3`, `perl`, or `ruby` means interpreter-based payloads work. `wget` or `curl` means file transfer is straightforward.

## Running Shell and Terminal

```bash
echo $SHELL
echo $TERM
echo $PATH
```

`$PATH` shows where the shell resolves commands. Non-standard entries in PATH are worth noting: they feed directly into [Writable PATH Hijacking for Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/writable-path-hijacking).

## System Uptime and Load

```bash
uptime
cat /proc/uptime
```

Long uptime suggests a stable, unpatched system: kernel exploits become more viable. Recent reboots can indicate recent patching activity.

## Disk and Filesystem Usage

```bash
df -h
lsblk
```

`lsblk` lists all block devices including unmounted ones. Unmounted partitions are a specific privilege escalation vector covered in [Unmounted Filesystem Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/unmounted-filesystem-privilege-escalation).

## Container and Virtualization Detection

```bash
cat /proc/1/cgroup
systemd-detect-virt 2>/dev/null
ls /.dockerenv 2>/dev/null
```

If `/.dockerenv` exists, you are inside a Docker container. The cgroup path in `/proc/1/cgroup` typically contains `docker` or `lxc` if containerized. This changes the privilege escalation focus: container escape techniques apply rather than standard host privesc. See [Docker Container Escape and Host Privilege Escalation](https://hackindex.io/platforms/linux/privilege-escalation/docker-container-escape).

## SELinux and AppArmor

```bash
getenforce 2>/dev/null
sestatus 2>/dev/null
cat /etc/selinux/config 2>/dev/null
aa-status 2>/dev/null
```

Enforcing SELinux or AppArmor profiles restrict what exploits and techniques work. `Enforcing` means many filesystem and exec-based attacks will be blocked. `Permissive` logs but does not block. `Disabled` means no MAC restrictions apply.

## Writable Directories

Common writable staging locations for file upload and exploit compilation:

```bash
find / -writable -type d 2>/dev/null | grep -v proc | head -20
```

`/tmp`, `/dev/shm`, and `/var/tmp` are almost always writable. Non-standard writable directories in paths like `/opt` or `/var/www` are more interesting.