System/Kernel
www-data@jarvis:/var/www/html$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=4be0cc32aba02ec4e0f010047be5ae9dee756960, stripped
Linux jarvis 4.9.0-8-amd64 #1 SMP Debian 4.9.144-3.1 (2019-02-19) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 9 (stretch)"
NAME="Debian GNU/Linux"
VERSION_ID="9"
VERSION="9 (stretch)"
ID=debian
home_url="https://www.debian.org/"
support_url="https://www.debian.org/support"
bug_report_url="https://bugs.debian.org/"4.9.0-8-amd64
Debian GNU/Linux 9 (stretch)
x86_64
Networks
www-data@jarvis:/var/www/html$ netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 301 10.10.10.143:34352 10.10.14.11:9999 ESTABLISHED 1619/nc
udp 0 0 10.10.10.143:47055 1.1.1.1:53 ESTABLISHED - 127.0.0.1:3306
Users & Groups
www-data@jarvis:/var/www/html$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
_apt:x:104:65534::/nonexistent:/bin/false
messagebus:x:105:110::/var/run/dbus:/bin/false
pepper:x:1000:1000:,,,:/home/pepper:/bin/bash
mysql:x:106:112:MySQL Server,,,:/nonexistent:/bin/false
sshd:x:107:65534::/run/sshd:/usr/sbin/nologin
total 12K
4.0k drwxr-xr-x 23 root root 4.0k may 9 05:31 ..
4.0k drwxr-xr-x 3 root root 4.0k may 9 05:10 .
4.0k drwxr-xr-x 4 pepper pepper 4.0k may 9 05:10 pepperpepper
SUIDs
www-data@jarvis:/var/www/html$ find / -perm -04000 -ls -type f 2>/dev/null
3969 32 -rwsr-xr-x 1 root root 30800 Aug 21 2018 /bin/fusermount
3827 44 -rwsr-xr-x 1 root root 44304 Mar 7 2018 /bin/mount
3924 60 -rwsr-xr-x 1 root root 61240 Nov 10 2016 /bin/ping
4225 172 -rwsr-x--- 1 root pepper 174520 Feb 17 2019 /bin/systemctl
3828 32 -rwsr-xr-x 1 root root 31720 Mar 7 2018 /bin/umount
3825 40 -rwsr-xr-x 1 root root 40536 May 17 2017 /bin/su
8187 40 -rwsr-xr-x 1 root root 40312 May 17 2017 /usr/bin/newgrp
5326 60 -rwsr-xr-x 1 root root 59680 May 17 2017 /usr/bin/passwd
5325 76 -rwsr-xr-x 1 root root 75792 May 17 2017 /usr/bin/gpasswd
5323 40 -rwsr-xr-x 1 root root 40504 May 17 2017 /usr/bin/chsh
17012 140 -rwsr-xr-x 1 root root 140944 Jun 5 2017 /usr/bin/sudo
5322 52 -rwsr-xr-x 1 root root 50040 May 17 2017 /usr/bin/chfn
23972 12 -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device
32974 432 -rwsr-xr-x 1 root root 440728 Mar 1 2019 /usr/lib/openssh/ssh-keysign
28091 44 -rwsr-xr-- 1 root messagebus 42992 Mar 2 2018 /usr/lib/dbus-1.0/dbus-daemon-launch-helper/bin/systemctl
SGIDs
www-data@jarvis:/var/www/html$ find / -perm -02000 -ls -type f 2>/dev/null
393393 4 drwxrwsr-x 2 root staff 4096 Feb 3 2019 /var/local
393444 4 drwxrwsr-x 2 root mail 4096 Mar 2 2019 /var/mail
395189 4 drwxr-s--- 2 mysql adm 4096 Mar 2 2019 /var/log/mysql
3753 36 -rwxr-sr-x 1 root shadow 35592 May 27 2017 /sbin/unix_chkpwd
10977 0 drwxr-sr-x 3 root systemd-journal 60 nov 5 11:53 /run/log/journal
10978 0 drwxr-s--- 2 root systemd-journal 220 nov 5 18:34 /run/log/journal/db2f18f29d9446cbbfd7ecfdaef4f42a
14986 352 -rwxr-sr-x 1 root ssh 358624 Mar 1 2019 /usr/bin/ssh-agent
9660 40 -rwxr-sr-x 1 root crontab 40264 Oct 7 2017 /usr/bin/crontab
14720 20 -rwxr-sr-x 1 root mail 19008 Jan 17 2017 /usr/bin/dotlockfile
5321 72 -rwxr-sr-x 1 root shadow 71856 May 17 2017 /usr/bin/chage
6184 28 -rwxr-sr-x 1 root tty 27448 Mar 7 2018 /usr/bin/wall
5324 24 -rwxr-sr-x 1 root shadow 22808 May 17 2017 /usr/bin/expiry
9246 16 -rwxr-sr-x 1 root tty 14768 Apr 12 2017 /usr/bin/bsd-write
[...REDACTED...]
38131 12 -rwxr-sr-x 1 root utmp 10232 Feb 18 2016 /usr/lib/x86_64-linux-gnu/utempter/utempterProcesses
www-data@jarvis:/var/www/html$ ps -auxwww
ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.6 138836 6628 ? Ss 10:14 0:00 /sbin/init
root 304 0.0 1.1 214052 11024 ? Ssl 10:14 0:06 /usr/bin/vmtoolsd
root 311 0.0 0.5 56800 5564 ? Ss 10:14 0:00 /lib/systemd/systemd-journald
root 337 0.0 0.3 45488 3648 ? Ss 10:14 0:00 /lib/systemd/systemd-udevd
systemd+ 525 0.0 0.4 127284 4184 ? Ssl 10:14 0:00 /lib/systemd/systemd-timesyncd
root 550 0.0 0.2 29664 2892 ? Ss 10:14 0:00 /usr/sbin/cron -f
root 551 0.0 0.3 250112 3224 ? Ssl 10:14 0:00 /usr/sbin/rsyslogd -n
root 552 0.0 1.8 153488 18324 ? Ss 10:14 0:00 /usr/bin/VGAuthService
root 553 0.0 0.4 37980 4208 ? Ss 10:14 0:00 /lib/systemd/systemd-logind
message+ 554 0.0 0.3 45116 3820 ? Ss 10:14 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
root 611 0.0 2.6 229376 26640 ? Ss 10:14 0:00 php-fpm: master process (/etc/php/7.0/fpm/php-fpm.conf)
root 613 1.3 1.6 61916 16948 ? Ss 10:14 2:06 python3 /root/sqli_defender.py
root 619 0.0 0.1 14524 1856 tty1 Ss+ 10:14 0:00 /sbin/agetty --noclear tty1 linux
root 630 0.0 0.6 69952 6188 ? Ss 10:14 0:00 /usr/sbin/sshd -D
root 716 0.0 2.5 271396 25744 ? Ss 10:14 0:00 /usr/sbin/apache2 -k start
mysql 802 0.1 8.1 654828 81948 ? Ssl 10:14 0:12 /usr/sbin/mysqld
www-data 1644 0.0 0.2 36632 2792 pts/0 R+ 12:47 0:00 ps -auxwww/usr/sbin/cron -f
python3 /root/sqli_defender.py
Cron & Systemd
www-data@jarvis:/var/www/html$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
bash: /bin/systemctl: Permission denied*Notice the permission denied error on systemctl *
Sudo Version
www-data@jarvis:/var/www/html$ sudsudo -V
Sudo version 1.8.19p1
Sudoers policy plugin version 1.8.19p1
Sudoers file grammar version 45
Sudoers I/O plugin version 1.8.19p1Sudo version 1.8.19p1
Glibc Version
www-data@jarvis:/var/www/html$ lddldd --version
ldd (Debian GLIBC 2.24-11+deb9u4) 2.24
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Debian GLIBC 2.24-11+deb9u4) 2.24