System/Kernel


mark@seventeen:~$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=6386b644ab2d987986aeb40325a787a035a4f0d8, stripped
linux seventeen 4.15.0-177-generic #186-ubuntu smp thu apr 14 20:23:07 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.6 LTS"
NAME="Ubuntu"
VERSION="18.04.6 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.6 LTS"
VERSION_ID="18.04"
home_url="https://www.ubuntu.com/"
support_url="https://help.ubuntu.com/"
bug_report_url="https://bugs.launchpad.net/ubuntu/"
privacy_policy_url="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic

Ubuntu 18.04.6 LTS (Bionic Beaver) 4.15.0-177-generic x86-64

Networks


mark@seventeen:~$ netstat -antup4 
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:4873          0.0.0.0:*               LISTEN      -                   
tcp        0      0 172.18.0.1:3306         0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:33323         0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:110           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:143           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6000          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:80              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6001          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:8081          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6002          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6003          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6004          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6005          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6006          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6007          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6008          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:6009          0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:993           0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:995           0.0.0.0:*               LISTEN      -                   
tcp        0    340 10.10.11.165:22         10.10.14.7:50914        ESTABLISHED -                   
udp        0      0 127.0.0.53:53           0.0.0.0:*                           -                   
udp        0      0 0.0.0.0:68              0.0.0.0:*                           -                   

127.0.0.53:53 127.0.0.1:110 127.0.0.1:143 127.0.0.1:993 127.0.0.1:995 127.0.0.1:4873 127.0.0.1:6000 127.0.0.1:6001 127.0.0.1:6002 127.0.0.1:6003 127.0.0.1:6004 127.0.0.1:6005 127.0.0.1:6006 127.0.0.1:6007 127.0.0.1:6008 127.0.0.1:6009 127.0.0.1:8081 127.0.0.1:33323

mark@seventeen:~$ arp -a
? (172.17.0.4) at 02:42:ac:11:00:04 [ether] on docker0
_gateway (10.10.10.2) at 00:50:56:b9:f3:30 [ether] on eth0
mark@seventeen:~$ ifconfig | grep -i inet
        inet 172.20.0.1  netmask 255.255.0.0  broadcast 172.20.255.255
        inet 172.18.0.1  netmask 255.255.0.0  broadcast 172.18.255.255
        inet 172.19.0.1  netmask 255.255.0.0  broadcast 172.19.255.255
        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255
        inet 10.10.11.165  netmask 255.255.254.0  broadcast 10.10.11.255
        inet 127.0.0.1  netmask 255.0.0.0

Users & Groups


mark@seventeen:~$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
lxd:x:105:65534::/var/lib/lxd/:/bin/false
uuidd:x:106:110::/run/uuidd:/usr/sbin/nologin
dnsmasq:x:107:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
landscape:x:108:112::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:109:1::/var/cache/pollinate:/bin/false
sshd:x:110:65534::/run/sshd:/usr/sbin/nologin
kavi:x:1000:1000:kavi:/home/kavi:/bin/bash
mysql:x:111:114:MySQL Server,,,:/nonexistent:/bin/false
dovecot:x:112:116:Dovecot mail server,,,:/usr/lib/dovecot:/usr/sbin/nologin
dovenull:x:113:117:Dovecot login user,,,:/nonexistent:/usr/sbin/nologin
mark:x:1001:1001:,,,:/home/mark:/bin/bash
total 16
drwxr-xr-x  4 root root 4096 Apr  8  2022 ./
drwxr-xr-x 26 root root 4096 May 23  2022 ../
drwxr-x---  7 kavi kavi 4096 May 11  2022 kavi/
drwxr-x---  5 mark mark 4096 May 11  2022 mark/

kavi

mark@seventeen:~$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=101(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=102(syslog) gid=106(syslog) groups=106(syslog),4(adm)
uid=103(messagebus) gid=107(messagebus) groups=107(messagebus)
uid=104(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=105(lxd) gid=65534(nogroup) groups=65534(nogroup)
uid=106(uuidd) gid=110(uuidd) groups=110(uuidd)
uid=107(dnsmasq) gid=65534(nogroup) groups=65534(nogroup)
uid=108(landscape) gid=112(landscape) groups=112(landscape)
uid=109(pollinate) gid=1(daemon) groups=1(daemon)
uid=110(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=1000(kavi) gid=1000(kavi) groups=1000(kavi)
uid=111(mysql) gid=114(mysql) groups=114(mysql)
uid=112(dovecot) gid=116(dovecot) groups=116(dovecot)
uid=113(dovenull) gid=117(dovenull) groups=117(dovenull)
uid=1001(mark) gid=1001(mark) groups=1001(mark)

SUIDs


mark@seventeen:~$ find / -perm -04000 -ls -type f 2>/dev/null
   261700     32 -rwsr-xr-x   1 root     root        30800 Aug 11  2016 /bin/fusermount
   270562     28 -rwsr-xr-x   1 root     root        26696 Sep 16  2020 /bin/umount
   261796     44 -rwsr-xr-x   1 root     root        44664 Jan 25  2022 /bin/su
   270561     44 -rwsr-xr-x   1 root     root        43088 Sep 16  2020 /bin/mount
   261751     64 -rwsr-xr-x   1 root     root        64424 Jun 28  2019 /bin/ping
   654511     76 -rwsr-xr-x   1 root     root        76496 Jan 25  2022 /usr/bin/chfn
   654512     44 -rwsr-xr-x   1 root     root        44528 Jan 25  2022 /usr/bin/chsh
   657680     40 -rwsr-xr-x   1 root     root        37136 Jan 25  2022 /usr/bin/newgidmap
   654514     76 -rwsr-xr-x   1 root     root        75824 Jan 25  2022 /usr/bin/gpasswd
   657681     40 -rwsr-xr-x   1 root     root        37136 Jan 25  2022 /usr/bin/newuidmap
   654784     60 -rwsr-xr-x   1 root     root        59640 Jan 25  2022 /usr/bin/passwd
   654950     20 -rwsr-xr-x   1 root     root        18448 Jun 28  2019 /usr/bin/traceroute6.iputils
   654867     40 -rwsr-xr-x   1 root     root        40344 Jan 25  2022 /usr/bin/newgrp
   654516     52 -rwsr-sr-x   1 daemon   daemon      51464 Feb 20  2018 /usr/bin/at
   656394    148 -rwsr-xr-x   1 root     root       149080 Jan 19  2021 /usr/bin/sudo
   655253    428 -rwsr-xr-x   1 root     root       436552 Mar 30  2022 /usr/lib/openssh/ssh-keysign
     9965    100 -rwsr-xr-x   1 root     root       100760 Nov 23  2018 /usr/lib/x86_64-linux-gnu/lxc/lxc-user-nic
   656485     16 -rwsr-xr-x   1 root     root        14328 Jan 12  2022 /usr/lib/policykit-1/polkit-agent-helper-1
   657513     44 -rwsr-xr--   1 root     messagebus    42992 May  6  2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
   655142     12 -rwsr-xr-x   1 root     root          10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device

SGIDs


mark@seventeen:~$ find / -perm -02000 -ls -type f 2>/dev/null
   523366     36 -rwxr-sr-x   1 root     shadow      34816 Apr  8  2021 /sbin/pam_extrausers_chkpwd
   523378     36 -rwxr-sr-x   1 root     shadow      34816 Apr  8  2021 /sbin/unix_chkpwd
   654513     24 -rwxr-sr-x   1 root     shadow      22808 Jan 25  2022 /usr/bin/expiry
   655247    356 -rwxr-sr-x   1 root     ssh        362640 Mar 30  2022 /usr/bin/ssh-agent
   654510     72 -rwxr-sr-x   1 root     shadow      71816 Jan 25  2022 /usr/bin/chage
   654527     16 -rwxr-sr-x   1 root     tty         14328 Jan 17  2018 /usr/bin/bsd-write
   663796     12 -rwxr-sr-x   1 root     mail        10232 Oct 17  2019 /usr/bin/mlock
   656306     32 -rwxr-sr-x   1 root     tty         30800 Sep 16  2020 /usr/bin/wall
   654522     40 -rwxr-sr-x   1 root     crontab     39352 May 10  2022 /usr/bin/crontab
   654763     44 -rwxr-sr-x   1 root     mlocate     43088 Mar  1  2018 /usr/bin/mlocate
   654516     52 -rwsr-sr-x   1 daemon   daemon      51464 Feb 20  2018 /usr/bin/at
    11141     12 -rwxr-sr-x   1 root     utmp        10232 Mar 11  2016 /usr/lib/x86_64-linux-gnu/utempter/utempter
   134154      4 drwxrwsr-x   2 root     staff               4096 Apr 24  2018 /var/local
   134156      4 drwxrwsr-x   2 root     mail                4096 Mar 24  2022 /var/mail

Processes


mark@seventeen:~$ ps -auxwww
USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
mark      82743  0.3  0.1  77020  7956 ?        Ss   06:11   0:07 /lib/systemd/systemd --user
mark      82832  0.0  0.1  21472  5148 pts/0    Ss   06:12   0:00 -bash

Privilege limitation

Cron & Systemd


mark@seventeen:~$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for mark
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# m h dom mon dow user	command
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT                         LEFT          LAST                         PASSED       UNIT                         ACTIVATES
tue 2023-06-20 07:09:00 UTC  14min left    Tue 2023-06-20 06:39:09 UTC  15min ago    phpsessionclean.timer        phpsessionclean.servic
tue 2023-06-20 09:40:01 UTC  2h 45min left Tue 2023-06-20 03:12:55 UTC  3h 41min ago ua-timer.timer               ua-timer.service
tue 2023-06-20 10:12:24 UTC  3h 18min left Tue 2023-06-20 02:19:46 UTC  4h 34min ago apt-daily.timer              apt-daily.service
tue 2023-06-20 20:27:04 UTC  13h left      Tue 2023-06-20 05:49:44 UTC  1h 4min ago  motd-news.timer              motd-news.service
wed 2023-06-21 02:34:36 UTC  19h left      Tue 2023-06-20 02:34:36 UTC  4h 19min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean
wed 2023-06-21 06:41:55 UTC  23h left      Tue 2023-06-20 06:30:12 UTC  24min ago    apt-daily-upgrade.timer      apt-daily-upgrade.serv
mon 2023-06-26 00:00:00 UTC  5 days left   Tue 2023-06-20 02:19:46 UTC  4h 34min ago fstrim.timer                 fstrim.service
 
7 timers listed.
Pass --all to see loaded but inactive timers, too.
lines 1-11/11 (END)

Sudo Version


mark@seventeen:~$ sudo --version
Sudo version 1.8.21p2
Sudoers policy plugin version 1.8.21p2
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.21p2

Sudo version 1.8.21p2

Glibc Version


mark@seventeen:~$ ldd --version
ldd (Ubuntu GLIBC 2.27-3ubuntu1.5) 2.27
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

ldd (Ubuntu GLIBC 2.27-3ubuntu1.5) 2.27