InfoSec LAB

Base_Initial_Foothold_UNIX

Created: 6 min read

Initial enumeration as the www-data user, Continuing the Post Enumeration

Kernel

www-data@base:/var/www/html/_uploaded$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=6386b644ab2d987986aeb40325a787a035a4f0d8, stripped
linux base 4.15.0-151-generic #157-ubuntu smp fri jul 9 23:07:57 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.6 LTS"
NAME="Ubuntu"
VERSION="18.04.6 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.6 LTS"
VERSION_ID="18.04"
home_url="https://www.ubuntu.com/"
support_url="https://help.ubuntu.com/"
bug_report_url="https://bugs.launchpad.net/ubuntu/"
privacy_policy_url="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

Networks

www-data@base:/var/www/html/_uploaded$ netstat -antup4
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0    301 10.129.95.184:54730     10.10.16.120:9999       ESTABLISHED 2792/sh             
udp        0      0 127.0.0.1:47784         127.0.0.53:53           ESTABLISHED -                   
udp        0      0 127.0.0.53:53           0.0.0.0:*                           -                   
udp        0      0 0.0.0.0:68              0.0.0.0:*                           -                   
udp        0      0 10.129.95.184:34990     1.1.1.1:53              ESTABLISHED -                   
udp        0      0 10.129.95.184:40396     8.8.8.8:53              ESTABLISHED -

Users & Groups

www-data@base:/var/www/html/_uploaded$ cat /etc/passwd ; ls -lasht /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
john:x:1000:1000:John:/home/john:/bin/bash
total 12K
4.0k drwxr-xr-x 23 root root 4.0k jun  4 17:58 ..
4.0K drwxr-xr-x  3 root root 4.0K Jul 26  2021 .
4.0K drwxr-xr-x  5 john john 4.0K Jul 26  2021 john

SUIDs

www-data@base:/var/www/html/_uploaded$ find / -perm -04000 -ls -type f 2>/dev/null
   137634    428 -rwsr-xr-x   1 root     root       436552 Mar 30  2022 /usr/lib/openssh/ssh-keysign
   134710     44 -rwsr-xr--   1 root     messagebus    42992 May  6 11:08 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
    10244    100 -rwsr-xr-x   1 root     root         100760 Nov 23  2018 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
   137533     16 -rwsr-xr-x   1 root     root          14328 Jan 12  2022 /usr/lib/policykit-1/polkit-agent-helper-1
   132301     12 -rwsr-xr-x   1 root     root          10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
   133343     76 -rwsr-xr-x   1 root     root          75824 Jan 25  2022 /usr/bin/gpasswd
   132791     40 -rwsr-xr-x   1 root     root          40344 Jan 25  2022 /usr/bin/newgrp
   131902     40 -rwsr-xr-x   1 root     root          37136 Jan 25  2022 /usr/bin/newgidmap
   132140    148 -rwsr-xr-x   1 root     root         149080 Jan 19  2021 /usr/bin/sudo
   133340     76 -rwsr-xr-x   1 root     root          76496 Jan 25  2022 /usr/bin/chfn
   133344     60 -rwsr-xr-x   1 root     root          59640 Jan 25  2022 /usr/bin/passwd
   132108     20 -rwsr-xr-x   1 root     root          18448 Jun 28  2019 /usr/bin/traceroute6.iputils
   131674     52 -rwsr-sr-x   1 daemon   daemon        51464 Feb 20  2018 /usr/bin/at
   132453     40 -rwsr-xr-x   1 root     root          37136 Jan 25  2022 /usr/bin/newuidmap
   133341     44 -rwsr-xr-x   1 root     root          44528 Jan 25  2022 /usr/bin/chsh
   132782     44 -rwsr-xr-x   1 root     root          44664 Jan 25  2022 /bin/su
   131875     28 -rwsr-xr-x   1 root     root          26696 Sep 16  2020 /bin/umount
   131191     64 -rwsr-xr-x   1 root     root          64424 Jun 28  2019 /bin/ping
   131140     32 -rwsr-xr-x   1 root     root          30800 Aug 11  2016 /bin/fusermount
   131874     44 -rwsr-xr-x   1 root     root          43088 Sep 16  2020 /bin/mount

SGIDs

www-data@base:/var/www/html/_uploaded$ find / -perm -04000 -ls -type f 2>/dev/null
   137634    428 -rwsr-xr-x   1 root     root       436552 Mar 30  2022 /usr/lib/openssh/ssh-keysign
   134710     44 -rwsr-xr--   1 root     messagebus    42992 may  6 11:08 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
    10244    100 -rwsr-xr-x   1 root     root         100760 Nov 23  2018 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
   137533     16 -rwsr-xr-x   1 root     root          14328 Jan 12  2022 /usr/lib/policykit-1/polkit-agent-helper-1
   132301     12 -rwsr-xr-x   1 root     root          10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
   133343     76 -rwsr-xr-x   1 root     root          75824 Jan 25  2022 /usr/bin/gpasswd
   132791     40 -rwsr-xr-x   1 root     root          40344 Jan 25  2022 /usr/bin/newgrp
   131902     40 -rwsr-xr-x   1 root     root          37136 Jan 25  2022 /usr/bin/newgidmap
   132140    148 -rwsr-xr-x   1 root     root         149080 Jan 19  2021 /usr/bin/sudo
   133340     76 -rwsr-xr-x   1 root     root          76496 Jan 25  2022 /usr/bin/chfn
   133344     60 -rwsr-xr-x   1 root     root          59640 Jan 25  2022 /usr/bin/passwd
   132108     20 -rwsr-xr-x   1 root     root          18448 Jun 28  2019 /usr/bin/traceroute6.iputils
   131674     52 -rwsr-sr-x   1 daemon   daemon        51464 Feb 20  2018 /usr/bin/at
   132453     40 -rwsr-xr-x   1 root     root          37136 Jan 25  2022 /usr/bin/newuidmap
   133341     44 -rwsr-xr-x   1 root     root          44528 Jan 25  2022 /usr/bin/chsh
   132782     44 -rwsr-xr-x   1 root     root          44664 Jan 25  2022 /bin/su
   131875     28 -rwsr-xr-x   1 root     root          26696 Sep 16  2020 /bin/umount
   131191     64 -rwsr-xr-x   1 root     root          64424 Jun 28  2019 /bin/ping
   131140     32 -rwsr-xr-x   1 root     root          30800 Aug 11  2016 /bin/fusermount
   131874     44 -rwsr-xr-x   1 root     root          43088 Sep 16  2020 /bin/mount

Processes

www-data@base:/tmp$ ps -aux | grep -i 'root' --color=auto
[...]
[...]
root       424  0.0  0.4  94716  8896 ?        S<s  10:48   0:00 /lib/systemd/systemd-journald
root       427  0.0  0.0  97712  1720 ?        Ss   10:48   0:00 /sbin/lvmetad -f
[...]
root       444  0.0  0.2  47084  5760 ?        Ss   10:48   0:01 /lib/systemd/systemd-udevd
root       557  0.0  0.4  89868  9848 ?        Ss   10:48   0:00 /usr/bin/VGAuthService
root       558  0.1  0.3 216936  7060 ?        S<sl 10:48   0:09 /usr/bin/vmtoolsd
[...]
root       928  0.0  0.1 110552  2076 ?        Ssl  10:48   0:00 /usr/sbin/irqbalance --foreground
root       930  0.0  0.1  30032  3064 ?        Ss   10:48   0:00 /usr/sbin/cron -f
root       932  0.0  0.0 604804  1704 ?        Ssl  10:48   0:00 /usr/bin/lxcfs /var/lib/lxcfs/
root      1036  0.0  0.3 286256  6776 ?        Ssl  10:48   0:00 /usr/lib/accountsservice/accounts-daemon
root      1039  0.0  0.2  61884  5268 ?        Ss   10:48   0:00 /lib/systemd/systemd-logind
root      1060  0.0  0.3  72304  6420 ?        Ss   10:48   0:00 /usr/sbin/sshd -D
root      1125  0.0  0.0  14896  1920 tty1     Ss+  10:48   0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root      1160  0.0  0.3 288884  6484 ?        Ssl  10:48   0:00 /usr/lib/policykit-1/polkitd --no-debug
root      1249  0.0  0.8 333732 16896 ?        Ss   10:48   0:01 /usr/sbin/apache2 -k start
[...]

Cron & Systemd

www-data@base:/var/www/html/_uploaded$ crontab -l ; cat /etc/crontab
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# m h dom mon dow user        command
17 *        * * *        root    cd / && run-parts --report /etc/cron.hourly
25 6        * * *        root        test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6        * * 7        root        test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6        1 * *        root        test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#

Interactive Graph View

Backlinks