System/Kernel
www-data@friendzone:/var/www/admin$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=b636f50d85c3cca7cf2518030446660c1d90d660, stripped
linux friendzone 4.15.0-36-generic #39-ubuntu smp mon sep 24 16:19:09 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.1 LTS"
NAME="Ubuntu"
VERSION="18.04.1 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.1 LTS"
VERSION_ID="18.04"
home_url="https://www.ubuntu.com/"
support_url="https://help.ubuntu.com/"
bug_report_url="https://bugs.launchpad.net/ubuntu/"
privacy_policy_url="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic4.15.0-36-generic
Ubuntu 18.04.1 LTS (Bionic Beaver)
x86_64
Networks
www-data@FriendZone:/var/www/admin$ netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 10.10.10.123:53 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:53 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:953 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 10.10.10.123:38210 10.10.14.11:9999 ESTABLISHED 15684/sh
tcp 0 301 10.10.10.123:38550 10.10.14.11:9998 ESTABLISHED 15686/nc
tcp 32 0 10.10.10.123:443 10.10.14.11:60144 CLOSE_WAIT -
udp 13824 0 10.10.10.123:53 0.0.0.0:* -
udp 0 0 127.0.0.1:53 0.0.0.0:* -
udp 35328 0 127.0.0.53:53 0.0.0.0:* -
udp 24576 0 10.10.11.255:137 0.0.0.0:* -
udp 3840 0 10.10.10.123:137 0.0.0.0:* -
udp 24576 0 0.0.0.0:137 0.0.0.0:* -
udp 46080 0 10.10.11.255:138 0.0.0.0:* -
udp 0 0 10.10.10.123:138 0.0.0.0:* -
udp 46080 0 0.0.0.0:138 0.0.0.0:* - 127.0.0.1:25
127.0.0.1:953: DNS
Users & Groups
www-data@friendzone:/var/www/admin$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
uuidd:x:105:109::/run/uuidd:/usr/sbin/nologin
friend:x:1000:1000:friend,,,:/home/friend:/bin/bash
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
debian-exim:x:107:114::/var/spool/exim4:/usr/sbin/nologin
ftp:x:108:115:ftp daemon,,,:/srv/ftp:/usr/sbin/nologin
bind:x:109:116::/var/cache/bind:/usr/sbin/nologin
total 12K
4.0k drwxr-xr-x 5 friend friend 4.0k sep 13 17:53 friend
4.0k drwxr-xr-x 3 root root 4.0k sep 13 17:53 .
4.0k drwxr-xr-x 22 root root 4.0k sep 13 17:53 ..
friend
SUIDs
www-data@FriendZone:/var/www/admin$ find / -perm -04000 -ls -type f 2>/dev/null
24822 32 -rwsr-xr-x 1 root root 30800 Aug 11 2016 /bin/fusermount
24400 28 -rwsr-xr-x 1 root root 26696 May 16 2018 /bin/umount
24398 44 -rwsr-xr-x 1 root root 43088 May 16 2018 /bin/mount
24370 44 -rwsr-xr-x 1 root root 44664 Jan 25 2018 /bin/su
35568 144 -rwsr-xr-x 1 root root 146128 Nov 30 2017 /bin/ntfs-3g
24916 64 -rwsr-xr-x 1 root root 64424 Mar 10 2017 /bin/ping
132754 60 -rwsr-xr-x 1 root root 59640 Jan 25 2018 /usr/bin/passwd
152142 20 -rwsr-xr-x 1 root root 18448 Mar 10 2017 /usr/bin/traceroute6.iputils
132513 40 -rwsr-xr-x 1 root root 40344 Jan 25 2018 /usr/bin/newgrp
137412 148 -rwsr-xr-x 1 root root 149080 Jan 18 2018 /usr/bin/sudo
132752 76 -rwsr-xr-x 1 root root 75824 Jan 25 2018 /usr/bin/gpasswd
132750 44 -rwsr-xr-x 1 root root 44528 Jan 25 2018 /usr/bin/chsh
132749 76 -rwsr-xr-x 1 root root 76496 Jan 25 2018 /usr/bin/chfn
158918 1116 -rwsr-xr-x 1 root root 1140200 Feb 14 2018 /usr/sbin/exim4
136225 44 -rwsr-xr-- 1 root messagebus 42992 Nov 16 2017 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
136365 12 -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device
152609 428 -rwsr-xr-x 1 root root 436552 Feb 10 2018 /usr/lib/openssh/ssh-keysign/bin/ntfs-3g
/usr/sbin/exim4
SGIDs
www-data@friendzone:/var/www/admin$ find / -perm -02000 -ls -type f 2>/dev/null
find / -perm -02000 -ls -type f 2>/dev/null
164781 4 drwxr-sr-x 3 root bind 4096 Oct 6 2018 /etc/bind
164783 4 drwxr-sr-x 2 root bind 4096 Oct 6 2018 /etc/bind/zones
258 4 drwxrwsr-x 2 root staff 4096 sep 13 17:53 /var/local
321 4 drwxrwsr-x 2 root mail 4096 sep 13 17:53 /var/mail
24039 4 drwxr-s--- 2 debian-exim adm 4096 sep 13 17:53 /var/log/exim4
767 4 drwxr-sr-x 3 root systemd-journal 4096 sep 13 17:53 /var/log/journal
36311 4 drwxr-sr-x 2 root systemd-journal 4096 jan 25 23:15 /var/log/journal/375f313c89e044bc923af29b0d6042a6
24339 36 -rwxr-sr-x 1 root shadow 34816 Apr 5 2018 /sbin/pam_extrausers_chkpwd
24343 36 -rwxr-sr-x 1 root shadow 34816 Apr 5 2018 /sbin/unix_chkpwd
134224 4 drwxrwsr-x 3 root staff 4096 Oct 5 2018 /usr/local/lib/python3.6
134225 4 drwxrwsr-x 2 root staff 4096 Oct 5 2018 /usr/local/lib/python3.6/dist-packages
172978 4 drwxrwsr-x 4 root staff 4096 sep 13 17:53 /usr/local/lib/python2.7
180670 4 drwxrwsr-x 2 root staff 4096 Oct 6 2018 /usr/local/lib/python2.7/dist-packages
37564 4 drwxrwsr-x 2 root staff 4096 sep 13 17:53 /usr/local/lib/python2.7/site-packages
152603 356 -rwxr-sr-x 1 root ssh 362640 Feb 10 2018 /usr/bin/ssh-agent
131459 32 -rwxr-sr-x 1 root tty 30800 May 16 2018 /usr/bin/wall
132751 24 -rwxr-sr-x 1 root shadow 22808 Jan 25 2018 /usr/bin/expiry
152516 44 -rwxr-sr-x 1 root mlocate 43088 Mar 1 2018 /usr/bin/mlocate
159361 12 -rwxr-sr-x 1 root mail 10952 Nov 7 2017 /usr/bin/dotlock.mailutils
136190 40 -rwxr-sr-x 1 root crontab 39352 Nov 16 2017 /usr/bin/crontab
150548 16 -rwxr-sr-x 1 root tty 14328 Jan 17 2018 /usr/bin/bsd-write
132748 72 -rwxr-sr-x 1 root shadow 71816 Jan 25 2018 /usr/bin/chageProcesses
www-data@FriendZone:/var/www/admin$ ps -auxwww
ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.9 159568 9092 ? Ss Jan25 0:02 /sbin/init splash
root 224 0.0 1.2 201392 11320 ? Ssl Jan25 0:30 /usr/bin/vmtoolsd
root 225 0.0 1.0 95496 9408 ? S<s Jan25 0:01 /lib/systemd/systemd-journald
root 251 0.0 0.4 45064 3732 ? Ss Jan25 0:00 /lib/systemd/systemd-udevd
root 423 0.0 1.8 170408 17064 ? Ssl Jan25 0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
root 428 0.0 0.6 62004 5580 ? Ss Jan25 0:00 /lib/systemd/systemd-logind
root 429 0.0 0.7 287540 6864 ? Ssl Jan25 0:00 /usr/lib/accountsservice/accounts-daemon
root 432 0.0 0.3 31320 3256 ? Ss Jan25 0:00 /usr/sbin/cron -f
root 439 0.0 1.0 87888 9468 ? Ss Jan25 0:00 /usr/bin/VGAuthService
root 605 0.0 1.3 265344 12444 ? Ss Jan25 0:00 /usr/sbin/nmbd --foreground --no-process-group
root 624 0.0 0.7 72296 6524 ? Ss Jan25 0:00 /usr/sbin/sshd -D
root 626 0.0 0.3 28676 2984 ? Ss Jan25 0:00 /usr/sbin/vsftpd /etc/vsftpd.conf
root 678 0.0 0.2 16180 1888 tty1 Ss+ Jan25 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root 705 0.0 2.2 357068 20808 ? Ss Jan25 0:01 /usr/sbin/smbd --foreground --no-process-group
root 729 0.0 2.0 331712 19172 ? Ss Jan25 0:04 /usr/sbin/apache2 -k start
root 884 0.0 0.6 345028 6052 ? S Jan25 0:00 /usr/sbin/smbd --foreground --no-process-group
root 885 0.0 0.5 345052 4848 ? S Jan25 0:00 /usr/sbin/smbd --foreground --no-process-group
root 903 0.0 0.7 357052 6744 ? S Jan25 0:00 /usr/sbin/smbd --foreground --no-process-group
www-data 15791 0.0 0.3 36700 3204 pts/0 R+ 08:49 0:00 ps -auxwww/lib/systemd/systemd-udevd
/usr/sbin/cron -f
Cron & Systemd
www-data@friendzone:/var/www/admin$ crontab -l ; cat /etc/crontab ; systemctl list-timers --all
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED
thu 2023-01-26 09:09:00 EET 18min left Thu 2023-01-26 08:39:19 EET 11min ag
thu 2023-01-26 12:03:42 EET 3h 12min left Wed 2023-01-25 23:54:59 EET 8h ago
thu 2023-01-26 23:30:17 EET 14h left Wed 2023-01-25 23:30:17 EET 9h ago
fri 2023-01-27 04:57:00 EET 20h left Thu 2023-01-26 06:52:56 EET 1h 57min
fri 2023-01-27 06:30:36 EET 21h left Thu 2023-01-26 06:45:22 EET 2h 5min
mon 2023-01-30 00:00:00 EET 3 days left Wed 2023-01-25 23:15:10 EET 9h ago
n/a n/a n/a n/a
7 timers listed.Sudo Version
www-data@FriendZone:/var/www/admin$ sudo -V
Sudo version 1.8.21p2
Sudoers policy plugin version 1.8.21p2
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.21p2
Sudo version 1.8.21p2
Glibc Version
www-data@friendzone:/var/www/admin$ ldd --version
ldd (Ubuntu GLIBC 2.27-3ubuntu1) 2.27
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Ubuntu GLIBC 2.27-3ubuntu1) 2.27