InfoSec LAB

Ghost_Initial_Foothold_UNIX_LINUX-DEV-WS01

Created: 6 min read

System/Kernel

florence.ramirez@LINUX-DEV-WS01:~$ file /bin/bash ; uname -a ; cat /etc/*release
 
Linux LINUX-DEV-WS01 5.15.0-113-generic #123-Ubuntu SMP Mon Jun 10 08:16:17 UTC 2024 x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Networks

florence.ramirez@LINUX-DEV-WS01:/$ cat /proc/net/fib_trie
Main:
  +-- 0.0.0.0/0 3 0 5
     |-- 0.0.0.0
        /0 universe UNICAST
     +-- 127.0.0.0/8 2 0 2
        +-- 127.0.0.0/31 1 0 0
           |-- 127.0.0.0
              /8 host LOCAL
           |-- 127.0.0.1
              /32 host LOCAL
        |-- 127.255.255.255
           /32 link BROADCAST
     +-- 172.18.0.0/16 2 0 2
        +-- 172.18.0.0/30 2 0 2
           |-- 172.18.0.0
              /16 link UNICAST
           |-- 172.18.0.2
              /32 host LOCAL
        |-- 172.18.255.255
           /32 link BROADCAST
Local:
  +-- 0.0.0.0/0 3 0 5
     |-- 0.0.0.0
        /0 universe UNICAST
     +-- 127.0.0.0/8 2 0 2
        +-- 127.0.0.0/31 1 0 0
           |-- 127.0.0.0
              /8 host LOCAL
           |-- 127.0.0.1
              /32 host LOCAL
        |-- 127.255.255.255
           /32 link BROADCAST
     +-- 172.18.0.0/16 2 0 2
        +-- 172.18.0.0/30 2 0 2
           |-- 172.18.0.0
              /16 link UNICAST
           |-- 172.18.0.2
              /32 host LOCAL
        |-- 172.18.255.255
           /32 link BROADCAST

172.18.0.2

Users & Groups

florence.ramirez@LINUX-DEV-WS01:/$ cat /ecat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
sshd:x:100:65534::/run/sshd:/usr/sbin/nologin
total 12K
4.0K drwxr-xr-x 1 root root 4.0K Jul 16 07:33 ..
4.0K drwxrwxr-x 1 root root 4.0K Feb  1 23:47 .
4.0K drwxr-xr-x 3 root root 4.0K Feb  1 23:47 GHOST
 
florence.ramirez@LINUX-DEV-WS01:/home$ ll GHOll
total 12K
4.0K drwxr-xr-x 3 root root 4.0K Feb  1 23:47 .
4.0K drwxrwxr-x 1 root root 4.0K Feb  1 23:47 ..
4.0K drwxr-xr-x 2 root root 4.0K Feb  1 23:47 florence.ramirez

GHOST

florence.ramirez@LINUX-DEV-WS01:/$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=42(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(sshd) gid=65534(nogroup) groups=65534(nogroup)
 
florence.ramirez@LINUX-DEV-WS01:/dev/shm$ id
uid=50(florence.ramirez) gid=50(staff) groups=50(staff),51(it)

uid=50(florence.ramirez) gid=50(staff) groups=50(staff),51(it)

SUIDs

florence.ramirez@LINUX-DEV-WS01:/$ find / -perm -04000 -ls -type f 2>/dev/null
   954944     64 -rwsr-xr-x   1 root     root        62672 Mar 23  2023 /usr/bin/chfn
   954950     52 -rwsr-xr-x   1 root     root        52880 Mar 23  2023 /usr/bin/chsh
   955085     68 -rwsr-xr-x   1 root     root        68248 Mar 23  2023 /usr/bin/passwd
   955161     36 -rwsr-xr-x   1 root     root        35128 Mar 23  2023 /usr/bin/umount
   955074     48 -rwsr-xr-x   1 root     root        48896 Mar 23  2023 /usr/bin/newgrp
   955011     88 -rwsr-xr-x   1 root     root        88496 Mar 23  2023 /usr/bin/gpasswd
   955137     72 -rwsr-xr-x   1 root     root        72000 Mar 23  2023 /usr/bin/su
   955069     60 -rwsr-xr-x   1 root     root        59704 Mar 23  2023 /usr/bin/mount
   966494     56 -rwsr-xr-x   1 root     root        56520 Aug 14  2023 /usr/bin/ksu
   962055    640 -rwsr-xr-x   1 root     root       653888 Dec 19  2023 /usr/lib/openssh/ssh-keysign

SGIDs

florence.ramirez@LINUX-DEV-WS01:/$ find / -perm -02000 -ls -type f 2>/dev/null
   956608     40 -rwxr-sr-x   1 root     shadow      39160 Sep 21  2023 /usr/sbin/unix_chkpwd
   954995     32 -rwxr-sr-x   1 root     shadow      31184 Mar 23  2023 /usr/bin/expiry
   955171     40 -rwxr-sr-x   1 root     tty         39224 Mar 23  2023 /usr/bin/wall
   954941     80 -rwxr-sr-x   1 root     shadow      80376 Mar 23  2023 /usr/bin/chage
   962048    472 -rwxr-sr-x   1 root     _ssh       481664 Dec 19  2023 /usr/bin/ssh-agent
   961840     44 -rwxr-sr-x   1 root     crontab     43648 Mar  2  2023 /usr/bin/crontab
   961521      4 drwxrwsr-x   2 root     staff        4096 Dec  9  2023 /var/local
   961529      4 drwxrwsr-x   2 root     mail         4096 Dec 18  2023 /var/mail

Processes

florence.ramirez@LINUX-DEV-WS01:/$ ps -auxwww
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  1.6  36928 30208 ?        Ss   07:33   0:04 /usr/bin/python3 /usr/bin/supervisord -c /etc/supervisor/conf.d/supervisord.conf
root          17  0.0  0.1  15408  3548 ?        Ss   07:33   0:00 sshd: /usr/sbin/sshd [listener] 0 of 10-100 startups
root          20  0.0  0.8  67836 16020 ?        S    07:33   0:00 /usr/sbin/nmbd --daemon --foreground --debug-stdout --no-process-group
root          21  0.0  1.1  80716 22124 ?        S    07:33   0:00 /usr/sbin/smbd --daemon --foreground --debug-stdout --no-process-group
root          22  0.0  1.1  75632 20400 ?        SL   07:33   0:00 /usr/sbin/winbindd --daemon --foreground --debug-stdout --no-process-group
root          26  0.0  0.4  78924  9128 ?        S    07:33   0:00 /usr/sbin/smbd --daemon --foreground --debug-stdout --no-process-group
root          27  0.0  0.2  78916  4448 ?        S    07:33   0:00 /usr/sbin/smbd --daemon --foreground --debug-stdout --no-process-group
root          28  0.0  0.7  75732 13644 ?        S    07:33   0:00 winbindd: domain child [LINUX-DEV-WS01]
root          29  0.0  1.1  79376 21564 ?        SL   07:33   0:00 winbindd: domain child [GHOST]
root          43  0.0  0.5  76332 10232 ?        S    07:33   0:00 winbindd: idmap child
root          45  0.0  0.8  56428 15028 ?        SLs  07:34   0:00 sshd: florence.ramirez@ghost.htb [priv]
root          52  0.0  0.7  75724 14312 ?        S    07:34   0:00 winbindd: domain child [BUILTIN]
florenc+      57  0.0  0.4  56688  8584 ?        S    07:34   0:00 sshd: florence.ramirez@pts/0
florenc+     889  0.0  0.1   4432  3612 pts/0    Ss   11:47   0:00 -bash
florenc+     980  0.0  0.2   8304  4400 pts/0    R+   11:57   0:00 ps -auxwww

Cron & Systemd

florence.ramirez@LINUX-DEV-WS01:/$ crontab -l ; cat /etc/crontab 
no crontab for florence.ramirez
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *	* * *	root	cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; }
47 6	* * 7	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; }
52 6	1 * *	root	test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; }
#

Sudo Version

florence.ramirez@LINUX-DEV-WS01:/$ sudo --version
-bash: sudo: command not found

Glibc Version

florence.ramirez@LINUX-DEV-WS01:/$ ldd --version
ldd (Debian GLIBC 2.36-9+deb12u3) 2.36
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

ldd (Debian GLIBC 2.36-9+deb12u3) 2.36

Interactive Graph View

Backlinks