System/Kernel
jhudson@gofer:/usr/bin$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=31c321f9f0c1f86a379f7efaaeb75f707998f27f, for GNU/Linux 3.2.0, stripped
Linux gofer.htb 5.10.0-23-amd64 #1 SMP Debian 5.10.179-2 (2023-07-14) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
home_url="https://www.debian.org/"
support_url="https://www.debian.org/support"
bug_report_url="https://bugs.debian.org/"5.10.0-23-amd64
Debian GNU/Linux 11 (bullseye)
x86_64
Networks
jhudson@gofer:/usr/bin$ netstat -antup4
netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:25 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:35754 127.0.0.1:80 TIME_WAIT -
tcp 0 301 10.10.11.225:37170 10.10.14.20:9999 ESTABLISHED 56356/sh
tcp 0 0 127.0.0.1:35764 127.0.0.1:80 TIME_WAIT -
udp 0 0 10.10.11.225:33459 8.8.8.8:53 ESTABLISHED -
udp 0 0 0.0.0.0:68 0.0.0.0:* -
udp 0 0 10.10.11.255:137 0.0.0.0:* -
udp 0 0 10.10.11.225:137 0.0.0.0:* -
udp 0 0 0.0.0.0:137 0.0.0.0:* -
udp 0 0 10.10.11.255:138 0.0.0.0:* -
udp 0 0 10.10.11.225:138 0.0.0.0:* -
udp 0 0 0.0.0.0:138 0.0.0.0:* - 127.0.0.1:25
Users & Groups
jhudson@gofer:/usr/bin$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:109::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
jhudson:x:1000:1000:Jocelyn Hudson,,,:/home/jhudson:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
postfix:x:106:113::/var/spool/postfix:/usr/sbin/nologin
jdavis:x:1001:1001::/home/jdavis:/bin/bash
tbuckley:x:1002:1002::/home/tbuckley:/bin/bash
ablake:x:1003:1003::/home/ablake:/bin/bash
tcpdump:x:107:117::/nonexistent:/usr/sbin/nologin
_laurel:x:998:998::/var/log/laurel:/bin/false
total 24K
4.0k drwxr-xr-x 6 jhudson jhudson 4.0k jul 26 11:38 jhudson
4.0k drwxr-xr-x 2 jdavis jdavis 4.0k jul 19 12:44 jdavis
4.0k drwxr-xr-x 6 root root 4.0k jul 19 12:44 .
4.0k drwxr-xr-x 18 root root 4.0k jul 19 12:44 ..
4.0k drwxr-xr-x 2 ablake ablake 4.0k jul 19 12:44 ablake
4.0k drwxr-xr-x 3 tbuckley tbuckley 4.0k jul 19 12:44 tbuckleyablake
tbuckley
jdavis
jhudson@gofer:/usr/bin$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=101(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=102(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=103(messagebus) gid=109(messagebus) groups=109(messagebus)
uid=104(systemd-timesync) gid=110(systemd-timesync) groups=110(systemd-timesync)
uid=105(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=1000(jhudson) gid=1000(jhudson) groups=1000(jhudson),108(netdev)
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)
uid=106(postfix) gid=113(postfix) groups=113(postfix)
uid=1001(jdavis) gid=1001(jdavis) groups=1001(jdavis)
uid=1002(tbuckley) gid=1002(tbuckley) groups=1002(tbuckley),1004(dev)
uid=1003(ablake) gid=1003(ablake) groups=1003(ablake)
uid=107(tcpdump) gid=117(tcpdump) groups=117(tcpdump)
uid=998(_laurel) gid=998(_laurel) groups=998(_laurel)uid=1000(jhudson) gid=1000(jhudson) groups=1000(jhudson),108(netdev)
uid=1002(tbuckley) gid=1002(tbuckley) groups=1002(tbuckley),1004(dev)
SUIDs
jhudson@gofer:/usr/bin$ find / -perm -04000 -ls -type f 2>/dev/null
132982 52 -rwsr-xr-- 1 root messagebus 51336 Oct 5 2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
141215 472 -rwsr-xr-x 1 root root 481608 Jul 1 2022 /usr/lib/openssh/ssh-keysign
166665 20 -rwsr-xr-x 1 root root 19040 Jan 13 2022 /usr/libexec/polkit-agent-helper-1
144339 36 -rwsr-xr-x 1 root root 34896 Feb 26 2021 /usr/bin/fusermount
134188 56 -rwsr-xr-x 1 root root 55528 Jan 20 2022 /usr/bin/mount
130154 64 -rwsr-xr-x 1 root root 63960 Feb 7 2020 /usr/bin/passwd
134190 36 -rwsr-xr-x 1 root root 35040 Jan 20 2022 /usr/bin/umount
130153 88 -rwsr-xr-x 1 root root 88304 Feb 7 2020 /usr/bin/gpasswd
130151 52 -rwsr-xr-x 1 root root 52880 Feb 7 2020 /usr/bin/chsh
166662 24 -rwsr-xr-x 1 root root 23448 Jan 13 2022 /usr/bin/pkexec
133877 72 -rwsr-xr-x 1 root root 71912 Jan 20 2022 /usr/bin/su
130150 60 -rwsr-xr-x 1 root root 58416 Feb 7 2020 /usr/bin/chfn
133733 44 -rwsr-xr-x 1 root root 44632 Feb 7 2020 /usr/bin/newgrp
136487 20 -rwsr-s--- 1 root dev 17168 Apr 28 16:06 /usr/local/bin/notes/usr/local/bin/notes
SGIDs
jhudson@gofer:/usr/bin$ find / -perm -02000 -ls -type f 2>/dev/null
622 0 drwxr-sr-x 2 root systemd-journal 40 jul 29 20:01 /run/log/journal
31117 4 drwxrwsr-x 2 root staff 4096 jul 19 12:44 /var/local
35194 4 drwx--s--- 2 postfix postdrop 4096 jul 29 20:01 /var/spool/postfix/public
31162 4 drwxrwsr-x 2 root mail 4096 jul 31 18:41 /var/mail
31696 4 drwxr-sr-x 3 root systemd-journal 4096 jul 19 12:44 /var/log/journal
30964 12 drwxr-sr-x 2 root systemd-journal 12288 jul 31 16:13 /var/log/journal/6fd26a41ea6c440ab7e34c05b322d707
141208 348 -rwxr-sr-x 1 root ssh 354440 Jul 1 2022 /usr/bin/ssh-agent
130149 80 -rwxr-sr-x 1 root shadow 80256 Feb 7 2020 /usr/bin/chage
130152 32 -rwxr-sr-x 1 root shadow 31160 Feb 7 2020 /usr/bin/expiry
133018 24 -rwxr-sr-x 1 root tty 22760 Jan 20 2022 /usr/bin/write.ul
140770 24 -rwxr-sr-x 1 root mail 23040 Feb 4 2021 /usr/bin/dotlockfile
131674 36 -rwxr-sr-x 1 root tty 35048 Jan 20 2022 /usr/bin/wall
135442 44 -rwxr-sr-x 1 root crontab 43568 Feb 22 2021 /usr/bin/crontab
152289 20 -r-xr-sr-x 1 root postdrop 18552 Jan 22 2023 /usr/sbin/postdrop
152298 24 -r-xr-sr-x 1 root postdrop 22600 Jan 22 2023 /usr/sbin/postqueue
130128 40 -rwxr-sr-x 1 root shadow 38912 Aug 26 2021 /usr/sbin/unix_chkpwd
136487 20 -rwsr-s--- 1 root dev 17168 apr 28 16:06 /usr/local/bin/notes
154851 4 drwxrwsr-x 2 root staff 4096 Oct 28 2022 /usr/local/share/fonts/usr/local/bin/notes
Processes
jhudson@gofer:/usr/bin$ ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.2 163796 10124 ? Ss Jul29 0:05 /sbin/init
root 522 0.0 4.1 232728 165064 ? Ss Jul29 0:54 /lib/systemd/systemd-journald
root 544 0.0 0.1 21852 5488 ? Ss Jul29 0:00 /lib/systemd/systemd-udevd
systemd+ 710 0.0 0.1 88436 5972 ? Ssl Jul29 0:13 /lib/systemd/systemd-timesyncd
root 711 0.0 0.2 47884 10484 ? Ss Jul29 0:00 /usr/bin/VGAuthService
root 712 0.1 0.1 162648 7380 ? Ssl Jul29 3:08 /usr/bin/vmtoolsd
root 713 0.0 0.0 87156 3056 ? S<sl Jul29 0:20 /sbin/auditd
_laurel 715 0.0 0.1 10000 5980 ? S< Jul29 0:29 /usr/local/sbin/laurel --config /etc/laurel/config.toml
root 742 0.0 0.0 6744 2956 ? Ss Jul29 0:02 /usr/sbin/cron -f
message+ 743 0.0 0.1 8260 4112 ? Ss Jul29 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 746 0.0 0.1 220796 6908 ? Ssl Jul29 0:04 /usr/sbin/rsyslogd -n -iNONE
root 747 0.0 0.1 13856 7204 ? Ss Jul29 0:00 /lib/systemd/systemd-logind
root 795 0.0 0.1 99884 7632 ? Ssl Jul29 0:00 /sbin/dhclient -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
root 898 0.0 0.4 68468 16556 ? Ss Jul29 0:05 /usr/sbin/nmbd --foreground --no-process-group
root 917 0.0 0.1 13352 7744 ? Ss Jul29 0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root 920 0.0 0.0 5844 1804 tty1 Ss+ Jul29 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root 930 0.0 0.6 205184 25360 ? Ss Jul29 0:17 /usr/sbin/apache2 -k start
root 944 0.0 0.6 82652 25124 ? Ss Jul29 0:01 /usr/sbin/smbd --foreground --no-process-group
root 955 0.0 0.2 80492 9988 ? S Jul29 0:00 /usr/sbin/smbd --foreground --no-process-group
root 956 0.0 0.2 80500 8080 ? S Jul29 0:00 /usr/sbin/smbd --foreground --no-process-group
root 961 0.0 0.2 82636 10448 ? S Jul29 0:00 /usr/sbin/smbd --foreground --no-process-group
root 1489 0.0 0.1 40052 4772 ? Ss Jul29 0:03 /usr/lib/postfix/sbin/master -w
postfix 1491 0.0 0.1 40496 6716 ? S Jul29 0:06 qmgr -l -t unix -u
postfix 49978 0.0 0.2 44112 9852 ? S 13:51 0:00 tlsmgr -l -t unix -u -c
www-data 53017 0.0 0.4 279684 17620 ? S 16:24 0:00 /usr/sbin/apache2 -k start
www-data 53050 0.0 0.4 279672 17612 ? S 16:24 0:00 /usr/sbin/apache2 -k start
www-data 53140 0.0 0.4 279668 17504 ? S 16:28 0:00 /usr/sbin/apache2 -k start
www-data 53144 0.0 0.4 279496 17276 ? S 16:28 0:00 /usr/sbin/apache2 -k start
www-data 53145 0.0 0.4 279652 17508 ? S 16:28 0:00 /usr/sbin/apache2 -k start
www-data 53147 0.0 0.4 279496 17276 ? S 16:28 0:00 /usr/sbin/apache2 -k start
www-data 53149 0.0 0.4 279496 17276 ? S 16:28 0:00 /usr/sbin/apache2 -k start
www-data 53155 0.0 0.4 279652 17512 ? S 16:28 0:00 /usr/sbin/apache2 -k start
www-data 53157 0.0 0.4 279796 17616 ? S 16:28 0:00 /usr/sbin/apache2 -k start
www-data 53162 0.0 0.4 279796 17628 ? S 16:28 0:00 /usr/sbin/apache2 -k start
postfix 55773 0.0 0.1 40416 6768 ? S 18:22 0:00 cleanup -z -t unix -u -c
postfix 56247 0.0 0.1 40340 6764 ? S 18:41 0:00 bounce -z -t unix -u -c
postfix 56274 0.0 0.1 40308 6736 ? S 18:42 0:00 pickup -l -t unix -u -c
postfix 56275 0.0 0.1 40300 6648 ? S 18:42 0:00 error -t unix -u -c
jhudson 56281 0.0 0.2 15296 8600 ? Ss 18:42 0:00 /lib/systemd/systemd --user
jhudson 56282 0.0 0.0 166752 2708 ? S 18:42 0:00 (sd-pam)
jhudson 56356 0.0 0.0 2492 580 ? S 18:42 0:00 sh
postfix 56477 0.0 0.1 40300 6696 ? S 18:44 0:00 error -t unix -u -c
postfix 56478 0.0 0.1 40340 6512 ? S 18:44 0:00 bounce -z -t unix -u -c
jhudson 56511 0.0 0.0 5416 648 ? S 18:46 0:00 script /dev/null -c bash
jhudson 56512 0.0 0.1 7944 4756 pts/0 Ss 18:46 0:00 bash
postfix 56665 0.0 0.1 40316 6744 ? S 18:54 0:00 trivial-rewrite -n rewrite -t unix -u -c
postfix 56727 0.0 0.1 40416 6744 ? S 18:57 0:00 cleanup -z -t unix -u -c
jhudson 56822 0.0 0.0 9944 3604 pts/0 R+ 19:00 0:00 ps -auxwww/usr/sbin/cron -f
Cron & Systemd
jhudson@gofer:/usr/bin$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for jhudson
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED >
mon 2023-07-31 19:09:00 BST 5min left Mon 2023-07-31 18:39:10 BST 23min ago>
mon 2023-07-31 20:15:50 BST 1h 12min left Sun 2023-07-30 20:15:50 BST 22h ago >
mon 2023-07-31 21:02:48 BST 1h 59min left Mon 2023-07-31 13:52:11 BST 5h 10min >
tue 2023-08-01 00:00:00 BST 4h 56min left Mon 2023-07-31 00:00:03 BST 19h ago >
tue 2023-08-01 00:00:00 BST 4h 56min left Mon 2023-07-31 00:00:03 BST 19h ago >
tue 2023-08-01 06:12:39 BST 11h left Mon 2023-07-31 06:34:07 BST 12h ago >
sun 2023-08-06 03:10:45 BST 5 days left Sun 2023-07-30 03:10:15 BST 1 day 15h>
mon 2023-08-07 00:31:02 BST 6 days left Mon 2023-07-31 00:22:02 BST 18h ago >
8 timers listed.
Pass --all to see loaded but inactive timers, too.
lines 1-12/12 (END)Sudo Version
jhudson@gofer:/usr/bin$ sudo --version
bash: sudo: command not foundDefault installation of Debian doesn’t have sudo installed
Glibc Version
jhudson@gofer:/usr/bin$ ldd --version
ldd (Debian GLIBC 2.31-13+deb11u6) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Debian GLIBC 2.31-13+deb11u6) 2.31