System/Kernel
emily@pilgrimage:~$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=31c321f9f0c1f86a379f7efaaeb75f707998f27f, for GNU/Linux 3.2.0, stripped
Linux pilgrimage 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
home_url="https://www.debian.org/"
support_url="https://www.debian.org/support"
bug_report_url="https://bugs.debian.org/"Debian GNU/Linux 11 (bullseye)
5.10.0-23-amd64
x86_64
Networks
emily@pilgrimage:~$ netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 52 10.10.11.219:22 10.10.14.4:42032 ESTABLISHED -
udp 0 0 0.0.0.0:68 0.0.0.0:* -
udp 0 0 10.10.11.219:48945 8.8.8.8:53 ESTABLISHED - Users & Groups
emily@pilgrimage:~$ cat /etc/passwd ; ls -lasht /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:109::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
emily:x:1000:1000:emily,,,:/home/emily:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
_laurel:x:998:998::/var/log/laurel:/bin/false
total 12K
4.0k drwxr-xr-x 18 root root 4.0k jun 8 00:10 ..
4.0k drwxr-xr-x 4 emily emily 4.0k jun 8 00:10 emily
4.0k drwxr-xr-x 3 root root 4.0k jun 8 00:10 .emily@pilgrimage:~$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=101(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=102(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=103(messagebus) gid=109(messagebus) groups=109(messagebus)
uid=104(systemd-timesync) gid=110(systemd-timesync) groups=110(systemd-timesync)
uid=1000(emily) gid=1000(emily) groups=1000(emily)
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)
uid=105(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=998(_laurel) gid=998(_laurel) groups=998(_laurel)SUIDs
emily@pilgrimage:~$ find / -perm -04000 -ls -type f 2>/dev/null
17967 472 -rwsr-xr-x 1 root root 481608 Jul 2 2022 /usr/lib/openssh/ssh-keysign
11257 52 -rwsr-xr-- 1 root messagebus 51336 Oct 5 2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
3811 72 -rwsr-xr-x 1 root root 71912 Jan 21 2022 /usr/bin/su
155 52 -rwsr-xr-x 1 root root 52880 Feb 8 2020 /usr/bin/chsh
158 64 -rwsr-xr-x 1 root root 63960 Feb 8 2020 /usr/bin/passwd
21476 36 -rwsr-xr-x 1 root root 34896 Feb 27 2021 /usr/bin/fusermount
4178 56 -rwsr-xr-x 1 root root 55528 Jan 21 2022 /usr/bin/mount
154 60 -rwsr-xr-x 1 root root 58416 Feb 8 2020 /usr/bin/chfn
157 88 -rwsr-xr-x 1 root root 88304 Feb 8 2020 /usr/bin/gpasswd
3652 44 -rwsr-xr-x 1 root root 44632 Feb 8 2020 /usr/bin/newgrp
21465 180 -rwsr-xr-x 1 root root 182600 Jan 15 00:29 /usr/bin/sudo
4180 36 -rwsr-xr-x 1 root root 35040 Jan 21 2022 /usr/bin/umountSGIDs
emily@pilgrimage:~$ find / -perm -02000 -ls -type f 2>/dev/null
511 0 drwxr-sr-x 2 root systemd-journal 40 jun 28 13:38 /run/log/journal
23766 4 drwxrwsr-x 4 root staff 4096 jun 8 00:10 /usr/local/lib/python2.7
30690 4 drwxrwsr-x 2 root staff 4096 jun 8 00:10 /usr/local/lib/python2.7/site-packages
23767 4 drwxrwsr-x 2 root staff 4096 jun 8 00:10 /usr/local/lib/python2.7/dist-packages
30691 4 drwxrwsr-x 2 root staff 4096 jun 8 00:10 /usr/local/share/fonts
17960 348 -rwxr-sr-x 1 root ssh 354440 Jul 2 2022 /usr/bin/ssh-agent
16403 24 -rwxr-sr-x 1 root mail 23040 Feb 5 2021 /usr/bin/dotlockfile
156 32 -rwxr-sr-x 1 root shadow 31160 Feb 8 2020 /usr/bin/expiry
11289 24 -rwxr-sr-x 1 root tty 22760 Jan 21 2022 /usr/bin/write.ul
5729 44 -rwxr-sr-x 1 root crontab 43568 Feb 23 2021 /usr/bin/crontab
1572 36 -rwxr-sr-x 1 root tty 35048 Jan 21 2022 /usr/bin/wall
153 80 -rwxr-sr-x 1 root shadow 80256 Feb 8 2020 /usr/bin/chage
138 40 -rwxr-sr-x 1 root shadow 38912 Aug 27 2021 /usr/sbin/unix_chkpwd
41715 4 drwxr-sr-x 3 root systemd-journal 4096 jun 8 00:10 /var/log/journal
41031 4 drwxr-sr-x 2 root systemd-journal 4096 jun 28 18:56 /var/log/journal/fd4d635fbce94451b4c8e8b4ce6ace20
41186 4 drwxrwsr-x 2 root mail 4096 jun 8 00:10 /var/mail
41146 4 drwxrwsr-x 2 root staff 4096 jun 8 00:10 /var/local/usr/bin/write.ul
Processes
emily@pilgrimage:~$ find / -perm -02000 -ls -type f 2>/dev/null
511 0 drwxr-sr-x 2 root systemd-journal 40 Jun 28 13:38 /run/log/journal
23766 4 drwxrwsr-x 4 root staff 4096 Jun 8 00:10 /usr/local/lib/python2.7
30690 4 drwxrwsr-x 2 root staff 4096 Jun 8 00:10 /usr/local/lib/python2.7/site-packages
23767 4 drwxrwsr-x 2 root staff 4096 Jun 8 00:10 /usr/local/lib/python2.7/dist-packages
30691 4 drwxrwsr-x 2 root staff 4096 Jun 8 00:10 /usr/local/share/fonts
17960 348 -rwxr-sr-x 1 root ssh 354440 Jul 2 2022 /usr/bin/ssh-agent
16403 24 -rwxr-sr-x 1 root mail 23040 Feb 5 2021 /usr/bin/dotlockfile
156 32 -rwxr-sr-x 1 root shadow 31160 Feb 8 2020 /usr/bin/expiry
11289 24 -rwxr-sr-x 1 root tty 22760 Jan 21 2022 /usr/bin/write.ul
5729 44 -rwxr-sr-x 1 root crontab 43568 Feb 23 2021 /usr/bin/crontab
1572 36 -rwxr-sr-x 1 root tty 35048 Jan 21 2022 /usr/bin/wall
153 80 -rwxr-sr-x 1 root shadow 80256 Feb 8 2020 /usr/bin/chage
138 40 -rwxr-sr-x 1 root shadow 38912 Aug 27 2021 /usr/sbin/unix_chkpwd
41715 4 drwxr-sr-x 3 root systemd-journal 4096 Jun 8 00:10 /var/log/journal
41031 4 drwxr-sr-x 2 root systemd-journal 4096 Jun 28 18:56 /var/log/journal/fd4d635fbce94451b4c8e8b4ce6ace20
41186 4 drwxrwsr-x 2 root mail 4096 Jun 8 00:10 /var/mail
41146 4 drwxrwsr-x 2 root staff 4096 Jun 8 00:10 /var/local
emily@pilgrimage:~$ ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.2 98272 9884 ? Ss 13:38 0:02 /sbin/init
root 505 0.0 0.3 48412 12624 ? Ss 13:38 0:00 /lib/systemd/systemd-journald
root 526 0.0 0.1 21716 5480 ? Ss 13:38 0:00 /lib/systemd/systemd-udevd
systemd+ 583 0.0 0.1 88436 6104 ? Ssl 13:38 0:01 /lib/systemd/systemd-timesyncd
root 585 0.0 0.2 47748 10460 ? Ss 13:38 0:00 /usr/bin/VGAuthService
root 586 0.1 0.1 236796 7620 ? Ssl 13:38 0:22 /usr/bin/vmtoolsd
root 594 0.0 0.0 87060 2104 ? S<sl 13:38 0:00 /sbin/auditd
_laurel 599 0.0 0.1 9772 5504 ? S< 13:38 0:00 /usr/local/sbin/laurel --config /etc/laurel/config.toml
root 678 0.0 0.1 99884 5640 ? Ssl 13:38 0:00 /sbin/dhclient -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
root 701 0.0 0.0 6744 2876 ? Ss 13:38 0:00 /usr/sbin/cron -f
message+ 703 0.0 0.1 8260 4132 ? Ss 13:38 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 708 0.0 0.0 6816 2972 ? Ss 13:38 0:00 /bin/bash /usr/sbin/malwarescan.sh
root 710 0.0 0.6 209752 27304 ? Ss 13:38 0:01 php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf)
root 712 0.0 0.2 220796 8412 ? Ssl 13:38 0:00 /usr/sbin/rsyslogd -n -iNONE
root 719 0.0 0.1 13852 7040 ? Ss 13:38 0:00 /lib/systemd/systemd-logind
root 727 0.0 0.0 2516 780 ? S 13:38 0:00 /usr/bin/inotifywait -m -e create /var/www/pilgrimage.htb/shrunk/
root 728 0.0 0.0 6816 2464 ? S 13:38 0:00 /bin/bash /usr/sbin/malwarescan.sh
root 745 0.0 0.0 5844 1804 tty1 Ss+ 13:38 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root 766 0.0 0.1 13352 7592 ? Ss 13:38 0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root 796 0.0 0.0 56376 1628 ? Ss 13:38 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data 797 1.1 0.1 57504 6716 ? S 13:38 3:47 nginx: worker process
www-data 1311 0.0 0.4 210132 18080 ? S 14:52 0:01 php-fpm: pool www
root 1860 0.0 0.2 14712 8952 ? Ss 18:56 0:00 sshd: emily [priv]
emily 1863 0.0 0.2 15164 8636 ? Ss 18:56 0:00 /lib/systemd/systemd --user
emily 1864 0.0 0.0 101228 2520 ? S 18:56 0:00 (sd-pam)
emily 1882 0.0 0.1 14712 5884 ? S 18:56 0:00 sshd: emily@pts/0
emily 1883 0.0 0.1 8164 4908 pts/0 Ss 18:56 0:00 -bash
emily 1952 0.0 0.0 9940 3592 pts/0 R+ 19:03 0:00 ps -auxwww/usr/local/sbin/laurel --config /etc/laurel/config.toml
/usr/sbin/cron -f
/bin/bash /usr/sbin/malwarescan.sh
Cron & Systemd
emily@pilgrimage:~$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for emily
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED UNIT ACTIVATES
wed 2023-06-28 19:09:00 AEST 3min 30s left Wed 2023-06-28 18:39:01 AEST 26min ago phpsessionclean.timer phpsessionclea>
wed 2023-06-28 19:58:19 AEST 52min left Tue 2023-05-23 00:16:49 AEST 1 months 6 days ago apt-daily.timer apt-daily.serv>
thu 2023-06-29 00:00:00 AEST 4h 54min left Wed 2023-06-28 13:38:41 AEST 5h 26min ago logrotate.timer logrotate.serv>
thu 2023-06-29 00:00:00 AEST 4h 54min left Wed 2023-06-28 13:38:41 AEST 5h 26min ago man-db.timer man-db.service
thu 2023-06-29 06:07:36 AEST 11h left Wed 2023-06-28 13:52:32 AEST 5h 12min ago apt-daily-upgrade.timer apt-daily-upgr>
thu 2023-06-29 13:53:12 AEST 18h left Wed 2023-06-28 13:53:12 AEST 5h 12min ago systemd-tmpfiles-clean.timer systemd-tmpfil>
sun 2023-07-02 03:10:15 AEST 3 days left Wed 2023-06-28 13:39:41 AEST 5h 25min ago e2scrub_all.timer e2scrub_all.se>
mon 2023-07-03 00:33:00 AEST 4 days left Wed 2023-06-28 14:55:52 AEST 4h 9min ago fstrim.timer fstrim.service
8 timers listed.
Pass --all to see loaded but inactive timers, too.
lines 1-12/12 (END)Sudo Version
emily@pilgrimage:~$ sudo -V
Sudo version 1.9.5p2
Sudoers policy plugin version 1.9.5p2
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.5p2
Sudoers audit plugin version 1.9.5p2Sudo version 1.9.5p2
Glibc Version
emily@pilgrimage:~$ ldd --version
ldd (Debian GLIBC 2.31-13+deb11u6) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Debian GLIBC 2.31-13+deb11u6) 2.31