Information gathering and exploitation

Enumeration

View patches

showrev -p

Installed packages:

Pkginfo OR pkginfo -x

Host information

uname -a

Show IP interface:

Ifconfig -a

Process list:

/usr/ucb/ps -auxww

Patch check analyser

http://www.par.univie.ac.at/solaris/pca/

Patch Check Advanced (PCA) generates lists of installed and missing patches for Oracle Solaris systems and optionally downloads patches. It resolves dependencies between patches and installs them in correct order. It can be the only tool you ever need for patch management, be it on a single machine or a complete network. Just one perl script, it doesn't need compilation nor installation, and it doesn't need root permissions to run. It works on all versions of Solaris, both SPARC and x86.

Usage:

./pca.pl –f . –l missings

will produce a list of missing patches, the following is an example. Note the ‘.’ Represents the current directory so ensure that the three files are in the same directory.

Common Solaris Vulnerabilities