ShellSpells
  • 🧙‍♂️Welcome!
    • ShellSpells
    • FAQs
    • License & Disclaimer
  • 🐧Linux
    • System Ops
      • Transcripts
      • Help
      • System Info
        • Date/Time
        • System Details
        • Patches & Updates
        • Init System Identification
        • Hostname / Host ID
        • Variables
        • Hardware & Resources
      • Filesystem
        • Traverse & Enumerate
        • Drives & Partitions
        • Shares
        • Packages
        • Connected Devices
        • Kernel Modules (Drivers)
      • Users & Groups
        • Enumerate
        • Modify
      • Network
        • Enumerate
        • Modify
      • Scheduled Jobs
        • Enumerate
        • Modify
      • Processes
        • Enumerate
        • Modify
        • Custom Script and Shared Object
        • Process I/O Redirection
      • Services
        • Enumerate
        • Modify
        • Create a Service
      • Startup/Boot Scripts
        • Enumerate
        • Modify
      • Security
        • Antivirus
        • Firewall
        • SSH Keys
      • History & Logs
        • History
        • Logs
    • File Ops
      • Search
        • Filename
        • Content
        • Users (Owners)
        • Time
        • Size
        • Permission
        • Hidden Files
        • Inode
        • Find + Exec
        • Notes
      • Enumerate Metadata
      • Modify Metadata
      • Read Content
      • Modify Content
      • Extract Content
      • Sort / Compare / Count
      • Move
      • Copy
      • Execute
      • Hash
      • Encode/Decode
      • Compress/Decompress
      • Working With Weird Filenames
    • Terminal Ops
      • Keyboard Shortcuts
      • Tmux Shortcuts
  • 🪟Windows
    • System Ops
      • Transcripts
      • Help
      • System Info
        • One-liners
        • Date/Time
        • System Details
        • Hotfixes
        • Domain or Workgroup
        • Data Execution Prevention
        • Variables
        • Hardware & Resources
      • Filesystem
        • Traverse & Enumerate
        • Drives & Partitions
        • Installed Software
        • Drivers
        • Shares
      • Registry
        • Enumerate
        • Modify
        • Forensically Relevant Keys
      • Users & Groups
        • Enumerate
        • Modify
      • Network
        • Enumerate
        • Modify
      • Scheduled Tasks
      • Processes
        • Enumerate
        • Modify
      • Services
        • Enumerate
        • Modify
      • Autorun / Startup
        • Enumerate
        • Modify
      • Security
        • Permissions
          • Enumerate
          • Page
        • Antivirus
        • Firewall
          • Enumerate
          • Modify
        • Audit Policies
        • Remoting
          • Enumerate
          • Modify
          • Registry Locations
        • Stored Credentials
      • Remote Command Execution
      • Active Directory
        • Enumerate
        • Modify
      • History & Logs
        • History
        • Logs
      • PowerShell Config
      • Scripting
      • WMIC Notes
    • File Ops
      • Search
        • Filename
        • Time
        • Size
        • Permissions
        • Attributes
        • Wildcarding
      • Enumerate Metadata
        • One Liners
        • Users (Owners)
        • Timestamps
        • Size
        • Permissions
        • Attributes
      • Modify Metadata
        • Change Owner
        • Timestamps
        • Size
        • Attributes
      • Read Content
      • Modify Content
        • Overwrite
        • Insert
        • Append
        • Replace / Remove
        • Convert Case
        • Alternate Data Streams
      • Extract Content
      • Sort / Compare / Count
        • Sort
        • Count
        • Compare
      • Move
      • Copy
      • Execute
      • Hash
      • Encode/Decode
      • Compress/Decompress
      • Working With Weird Filenames
      • Output Formatting / Filtering
      • File Formatting
      • Operators
  • ⛓️Network
    • Traffic Manipulation
      • iptables
        • Option List
        • General Commands
        • Filter Tables
        • NAT
        • Mangle
        • Filter for SSH Traffic (Example)
      • nftables
    • Packet Capture
      • Syntax
      • TCPDump Examples
    • Packet Analysis
      • Wireshark
  • 🚗Maneuver
    • SSH
    • Control Sockets
    • RDP
    • Windows Port Proxy
  • 🛩️Data Transfer
    • SCP
    • FTP
    • Netcat
      • Netcat Relays
    • Server Interactions
    • Alternate Methods
  • 🪄REGEX
    • Examples
Powered by GitBook
On this page
  • Enum Script
  • System-wide Startup Files
  • User-specific Startup Files
  • Bourne-Again Shell (bash)
  • Z Shell (zsh)
  • C Shell (csh) or TENEX C Shell (tcsh)
  • Korn Shell (ksh)
  • SysV Init
  • Systemd
  • Upstart

Was this helpful?

  1. Linux
  2. System Ops
  3. Startup/Boot Scripts

Enumerate

Enum Script

This script checks existence all potential startup script locations. It prints file path if it exists. It checks file permissions to see if current user can edit. If so, it colors it red.

This script is AI generated, NOT TESTED, and probably does not work.

I only included it because it has potentially useful sections that you can build from.

#!/bin/bash



# Define an array of potential autostart script locations
autostart_locations=(
    "/etc/rc.local"
    "/etc/rc.d/rc.local"
    "/etc/init.d"
    "/etc/systemd/system"
    "/etc/systemd/system/multi-user.target.wants/"
    "/etc/systemd/user"
    "/usr/lib/systemd/system"
    "/lib/systemd/system"
    "/etc/xdg/autostart"
    "/home/$USER/.config/autostart"
)

# Function to check file/directory and print details
check_and_print() {
    local path="$1"
    if [ -e "$path" ]; then
        # Check if the current user has write permission
        if [ -w "$path" ]; then
            # Print path in red with permissions
            echo -e "\033[31m$(ls -ld "$path")\033[0m"
        else
            # Print path with permissions
            echo "$(ls -ld "$path")"
        fi
    fi
}

# Iterate over locations and check each
for location in "${autostart_locations[@]}"; do
    if [ -d "$location" ]; then
        # If it's a directory, check each file in it
        for file in "$location"/*; do
            check_and_print "$file"
        done
    else
        # If it's a file, just check the file
        check_and_print "$location"
    fi
done

System-wide Startup Files

File/Directory
Description

/etc/inittab

(SysV init) Controls the boot process and launches initial scripts based on run levels.

/etc/systemd/system

(systemd) Contains systemd unit files defining services and processes to start at boot.

/etc/rc.local

(SysV init) Allows adding custom scripts to be executed at boot (may not be present or active on all systems).

/etc/default/*

Holds configuration files for various system services (e.g., /etc/default/syslog).

/etc/profile

System-wide shell configuration file, often sourced by other files.

/etc/bashrc

System-wide Bash shell configuration file.

/etc/zsh/zshrc

System-wide Zsh shell configuration file. (Other shells might have different files)

/etc/profile.d/

Files placed here are sourced for all users' login shells (similar to .profile).

/etc/bashrc.d/

Files here are specifically for bash login shells.

User-specific Startup Files

~/.profile User-specific shell configuration file, sourced at login.

~/.xsession or ~/.xinitrc Configuration for graphical login sessions (depending on the desktop environment).

Bourne-Again Shell (bash)

~/.bash_profile, ~/.bash_login, or ~/.profile (in order of preference) These files are read and executed when a bash login shell is started. ~/.bash_profile is the most commonly used file for login sessions.

~/.bashrc While not a login script per se, it's often sourced by the login scripts or interactive shells to configure the shell session. It's used mainly for interactive shell behavior, aliases, and functions.

Z Shell (zsh)

~/.zprofile Similar to ~/.bash_profile for bash, this file is executed for login shells.

~/.zshrc Executed for interactive shell sessions. It's common to place most shell customizations here.

C Shell (csh) or TENEX C Shell (tcsh)

~/.login Executed at the beginning of a csh or tcsh login shell session.

~/.cshrc (csh) or ~/.tcshrc (tcsh) Read and executed when an interactive shell session starts. It's used for setting up the shell environment.

Korn Shell (ksh)

~/.profile Executed for login shells. Ksh shares this file with Bourne Shell (sh) and bash when running as sh.

SysV Init

/etc/inittab Configuration file specifying the default runlevel and how the system initializes processes. Used by older Unix systems.

/etc/rc.d/ or /etc/init.d/ Directory containing startup scripts (init scripts) for various services and daemons.

/etc/rc.local A script that is executed at the end of the SysV init process. You can add custom startup commands here.

/etc/rc?.d Directories for runlevels 0-6, S (e.g., /etc/rc3.d). Scripts in these directories are symbolic links to scripts in /etc/init.d and are executed at different runlevel

Systemd

/etc/systemd/system/ Directory containing systemd service unit files.

/lib/systemd/system and /usr/lib/systemd/system Directories where packaged unit files are typically located. These should not be modified directly; instead, override files should be placed in /etc/systemd/system.

/lib/systemd/system and /usr/lib/systemd/system Directories where packaged unit files are typically located. These should not be modified directly; instead, override files should be placed in /etc/systemd/system.

/etc/systemd/system/* Directory containing systemd unit files for various services, including boot services.

/etc/systemd/system/default.target Symbolic link specifying the default target (runlevel) that systemd boots into. Equivalent to runlevels in SysV.

/etc/systemd/system/multi-user.target Unit file defining the multi-user target (runlevel equivalent). Units with "Requires=multi-user.target" Services dependent on the multi-user target, likely executed during boot.

/etc/systemd/system.conf Main configuration file for systemd.

~/.config/systemd/user/ User-specific systemd unit files for services started with the user's session.

/etc/systemd/system/multi-user.target.wants/, /etc/systemd/system/graphical.target.wants/, etc. Directories containing symlinks to unit files for services that should be started automatically under specific targets.

Upstart

/etc/init/ Directory containing Upstart job configuration files. Jobs define how services are started, stopped, and managed (not to be confused with /etc/init.d used by SysV).

/etc/init.d/ Directory containing SysV-style init scripts. For compatibility with SysV init scripts, Upstart systems may also include this directory. While Upstart itself does not use these scripts directly, it provides backward compatibility allowing administrators to manage services using traditional SysV init scripts. Upstart intercepts calls to the service and /etc/init.d/ scripts and translates them into appropriate Upstart events when possible.

/etc/init/rc-sysinit.conf Upstart configuration file responsible for initializing the system, similar to SysV's init scripts.

/etc/init/rc.conf Upstart configuration file specifying the default runlevel.

/etc/init/tty.conf* Upstart job configuration files for handling virtual terminals (ttys).

~/.init/ User-specific Upstart job configuration directory for custom jobs.

PreviousStartup/Boot ScriptsNextModify

Last updated 1 year ago

Was this helpful?

🐧