Enumerating as the www-data user
Continuing Post Enumeration
System/Kernel
www-data@bashed:/var/www/html/dev$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=0428e4834e687e231fa865562d32fbb64ce45577, stripped
linux bashed 4.4.0-62-generic #83-ubuntu smp wed jan 18 14:10:15 UTC 2017 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.2 LTS"
NAME="Ubuntu"
VERSION="16.04.2 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.2 LTS"
VERSION_ID="16.04"
home_url="http://www.ubuntu.com/"
support_url="http://help.ubuntu.com/"
bug_report_url="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenialNetworks
www-data@bashed:/var/www/html/dev$ netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 297 10.10.10.68:40370 10.10.14.7:9999 ESTABLISHED 32463/python3Users
www-data@bashed:/var/www/html/dev$ cat /etc/passwd ; ls -lasht /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
messagebus:x:106:110::/var/run/dbus:/bin/false
uuidd:x:107:111::/run/uuidd:/bin/false
arrexel:x:1000:1000:arrexel,,,:/home/arrexel:/bin/bash
scriptmanager:x:1001:1001:,,,:/home/scriptmanager:/bin/bash
total 16K
4.0k drwxr-xr-x 6 scriptmanager scriptmanager 4.0k oct 12 14:14 scriptmanager
4.0k drwxr-xr-x 23 root root 4.0k jun 2 07:25 ..
4.0k drwxr-xr-x 4 arrexel arrexel 4.0k jun 2 07:18 arrexel
4.0K drwxr-xr-x 4 root root 4.0K Dec 4 2017 .scriptmanager
arrexel
SUIDs
www-data@bashed:/var/www/html/dev$ find / -perm -04000 -ls -type f 2>/dev/null
16000 40 -rwsr-xr-x 1 root root 40152 Dec 16 2016 /bin/mount
30632 32 -rwsr-xr-x 1 root root 30800 Jul 12 2016 /bin/fusermount
16031 40 -rwsr-xr-x 1 root root 40128 Mar 29 2016 /bin/su
16049 28 -rwsr-xr-x 1 root root 27608 Dec 16 2016 /bin/umount
16015 44 -rwsr-xr-x 1 root root 44680 May 7 2014 /bin/ping6
30420 140 -rwsr-xr-x 1 root root 142032 Jan 28 2017 /bin/ntfs-3g
16014 44 -rwsr-xr-x 1 root root 44168 May 7 2014 /bin/ping
162 40 -rwsr-xr-x 1 root root 40432 Mar 29 2016 /usr/bin/chsh
287 40 -rwsr-xr-x 1 root root 39904 Mar 29 2016 /usr/bin/newgrp
382 136 -rwsr-xr-x 1 root root 136808 Jan 20 2017 /usr/bin/sudo
160 52 -rwsr-xr-x 1 root root 49584 Mar 29 2016 /usr/bin/chfn
298 56 -rwsr-xr-x 1 root root 54256 Mar 29 2016 /usr/bin/passwd
223 76 -rwsr-xr-x 1 root root 75304 Mar 29 2016 /usr/bin/gpasswd
14432 12 -rwsr-xr-x 1 root root 10624 Feb 9 2017 /usr/bin/vmware-user-suid-wrapper
12171 44 -rwsr-xr-- 1 root messagebus 42992 Jan 12 2017 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
483 12 -rwsr-xr-x 1 root root 10240 Feb 25 2014 /usr/lib/eject/dmcrypt-get-device
13485 420 -rwsr-xr-x 1 root root 428240 Aug 11 2016 /usr/lib/openssh/ssh-keysignSGIDs
www-data@bashed:/var/www/html/dev$ find / -perm -02000 -ls -type f 2>/dev/null
[...]
87 36 -rwxr-sr-x 1 root shadow 35632 Mar 16 2016 /sbin/pam_extrausers_chkpwd
123 36 -rwxr-sr-x 1 root shadow 35600 Mar 16 2016 /sbin/unix_chkpwd
14438 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/fonts
12462 4 drwxrwsr-x 6 root staff 4096 Dec 4 2017 /usr/local/share/xml
12464 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/xml/declaration
12465 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/xml/entities
12463 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/xml/misc
12466 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/xml/schema
13748 4 drwxrwsr-x 3 root staff 4096 Dec 4 2017 /usr/local/share/emacs
13749 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/emacs/site-lisp
12426 4 drwxrwsr-x 7 root staff 4096 Dec 4 2017 /usr/local/share/sgml
12431 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/sgml/dtd
12427 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/sgml/declaration
12429 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/sgml/entities
12428 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/sgml/stylesheet
12430 4 drwxrwsr-x 2 root staff 4096 Dec 4 2017 /usr/local/share/sgml/misc
34135 4 drwxrwsr-x 4 root staff 4096 jun 2 07:19 /usr/local/lib/python2.7
34191 4 drwxrwsr-x 2 root staff 4096 jun 2 07:19 /usr/local/lib/python2.7/site-packages
34138 4 drwxrwsr-x 2 root staff 4096 jun 2 07:19 /usr/local/lib/python2.7/dist-packages
3134 4 drwxrwsr-x 3 root staff 4096 Dec 4 2017 /usr/local/lib/python3.5
3135 4 drwxrwsr-x 2 root staff 4096 Feb 15 2017 /usr/local/lib/python3.5/dist-packages
208 24 -rwxr-sr-x 1 root shadow 22768 Mar 29 2016 /usr/bin/expiry
171 36 -rwxr-sr-x 1 root crontab 36080 Apr 5 2016 /usr/bin/crontab
13477 352 -rwxr-sr-x 1 root ssh 358624 Aug 11 2016 /usr/bin/ssh-agent
157 64 -rwxr-sr-x 1 root shadow 62336 Mar 29 2016 /usr/bin/chage
435 28 -rwxr-sr-x 1 root tty 27368 Dec 16 2016 /usr/bin/wall
13217 16 -rwxr-sr-x 1 root tty 14752 Mar 1 2016 /usr/bin/bsd-write
13468 40 -rwxr-sr-x 1 root mlocate 39520 Nov 17 2014 /usr/bin/mlocateProcesses
www-data@bashed:/var/www/html/dev$ ps -auxww | grep -i 'root' --color=auto
ps -auxww | grep -i 'root' --color=auto
root 1 0.0 0.5 37848 5808 ? Ss 05:53 0:01 /sbin/init noprompt
root 329 0.0 0.3 28332 3292 ? Ss 05:53 0:00 /lib/systemd/systemd-journald
root 342 0.0 0.0 93088 276 ? Ssl 05:53 0:00 vmware-vmblock-fuse /run/vmblock-fuse -o rw,subtype=vmware-vmblock,default_permissions,allow_other,dev,suid
root 375 0.0 0.3 44256 3804 ? Ss 05:53 0:00 /lib/systemd/systemd-udevd
root 616 0.0 1.0 192232 10284 ? Ssl 05:53 0:22 /usr/bin/vmtoolsd
root 635 0.0 0.3 29008 3120 ? Ss 05:53 0:00 /usr/sbin/cron -f
root 637 0.0 0.1 20100 1172 ? Ss 05:53 0:00 /lib/systemd/systemd-logind
root 642 0.0 0.6 275864 6296 ? Ssl 05:53 0:00 /usr/lib/accountsservice/accounts-daemon
root 720 0.0 0.1 15940 1820 tty1 Ss+ 05:53 0:00 /sbin/agetty --noclear tty1 linux
root 842 0.0 2.4 255896 24752 ? Ss 05:53 0:01 /usr/sbin/apache2 -k start
www-data 11766 0.0 0.1 11284 1080 pts/0 S+ 14:14 0:00 grep -i root --color=auto
/usr/sbin/cron
/lib/systemd/systemd-udevd
Cron & Systemd
www-data@bashed:/var/www/html/dev$ crontab -l ; cat /etc/crontab ; systemctl list-timers --all
<ml/dev$ crontab -l ; cat /etc/crontab ; systemctl list-timers --all
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
warning: terminal is not fully functional
- (press RETURN)
NEXT LEFT LAST PASSED
sat 2023-01-14 03:51:55 PST 13h left Fri 2023-01-13 11:22:24 PST 2h 51min ago
sat 2023-01-14 06:08:48 PST 15h left Fri 2023-01-13 06:08:48 PST 8h ago
n/a n/a n/a n/a
3 timers listed.
Sudo Version
www-data@bashed:/var/www/html/dev$ sudo -V
Sudo version 1.8.16
Sudoers policy plugin version 1.8.16
Sudoers file grammar version 45
Sudoers I/O plugin version 1.8.16Sudo version 1.8.16
Glibc Version
www-data@bashed:/var/www/html/dev$ ldd --version
ldd (Ubuntu GLIBC 2.23-0ubuntu5) 2.23
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Ubuntu GLIBC 2.23-0ubuntu5) 2.23