InfoSec LAB

Cybermonday_Initial_Foothold_UNIX_Docker_Container

Created: 3 min read

System/Kernel

www-data@070370e2cdc4:~/html/public$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=0b6b11360e339f231f17484da2c87d0d78554e31, for GNU/Linux 3.2.0, stripped
Linux 070370e2cdc4 5.10.0-24-amd64 #1 SMP Debian 5.10.179-5 (2023-08-08) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
home_url="https://www.debian.org/"
support_url="https://www.debian.org/support"
bug_report_url="https://bugs.debian.org/"

5.10.0-24-amd64 Debian GNU/Linux 12 (bookworm) x86_64

Networks

www-data@070370e2cdc4:~/html/public$ netstat -antup4
bash: netstat: command not found
www-data@070370e2cdc4:~/html/public$ ifconfig
ifconfig
bash: ifconfig: command not found
www-data@070370e2cdc4:~/html/public$ ip a
ip a
bash: ip: command not found
www-data@070370e2cdc4:~/html/public$ cat /etc/hosts
cat /etc/hosts
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
ff00::0	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.18.0.5	070370e2cdc4

Docker container

Users & Groups

www-data@070370e2cdc4:~/html/public$ cat /etc/passwd ; ls -lasht /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
total 8.0K
4.0k drwxr-xr-x 1 root root 4.0k jul  3 05:00 ..
4.0k drwxr-xr-x 2 root root 4.0k mar  2 13:55 .
www-data@070370e2cdc4:~/html/public$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=42(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)

SUIDs

www-data@070370e2cdc4:~/html/public$ find / -perm -04000 -ls -type f 2>/dev/null
   176589    640 -rwsr-xr-x   1 root     root       653888 Feb  8  2023 /usr/lib/openssh/ssh-keysign
   152601     48 -rwsr-xr-x   1 root     root        48896 Mar 23 12:40 /usr/bin/newgrp
   152471     64 -rwsr-xr-x   1 root     root        62672 Mar 23 12:40 /usr/bin/chfn
   152612     68 -rwsr-xr-x   1 root     root        68248 Mar 23 12:40 /usr/bin/passwd
   152538     88 -rwsr-xr-x   1 root     root        88496 Mar 23 12:40 /usr/bin/gpasswd
   152596     60 -rwsr-xr-x   1 root     root        59704 Mar 23 10:02 /usr/bin/mount
   152477     52 -rwsr-xr-x   1 root     root        52880 Mar 23 12:40 /usr/bin/chsh
   152688     36 -rwsr-xr-x   1 root     root        35128 Mar 23 10:02 /usr/bin/umount
   152664     72 -rwsr-xr-x   1 root     root        72000 Mar 23 10:02 /usr/bin/su

SGIDs

www-data@070370e2cdc4:~/html/public$ find / -perm -02000 -ls -type f 2>/dev/null
   156465      4 drwxrwsr-x   2 root     mail         4096 jun 12 00:00 /var/mail
   156457      4 drwxrwsr-x   2 root     staff        4096 mar  2 13:55 /var/local
   152698     40 -rwxr-sr-x   1 root     tty         39224 mar 23 10:02 /usr/bin/wall
   152468     80 -rwxr-sr-x   1 root     shadow      80376 mar 23 12:40 /usr/bin/chage
   152522     32 -rwxr-sr-x   1 root     shadow      31184 mar 23 12:40 /usr/bin/expiry
   175012    472 -rwxr-sr-x   1 root     _ssh       481664 Feb  8  2023 /usr/bin/ssh-agent
   154135     40 -rwxr-sr-x   1 root     shadow      39160 Jan  3  2023 /usr/sbin/unix_chkpwd

Processes

www-data@070370e2cdc4:~/html/public$ ps -auxwww 
bash: ps: command not found

Cron & Systemd

www-data@070370e2cdc4:~/html/public$ crontab -l ; cat /etc/crontab ; systemctl list-timers
bash: crontab: command not found
cat: /etc/crontab: No such file or directory
bash: systemctl: command not found

Sudo Version

www-data@070370e2cdc4:~/html/public$ sudo --version
bash: sudo: command not found

Glibc Version

www-data@070370e2cdc4:~/html/public$ ldd --version
ldd (Debian GLIBC 2.36-9) 2.36
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Interactive Graph View

Backlinks