System/Kernel
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=ffe165dc81a64aea2b05beda07aeda8ad71f1e7c, stripped
Linux sneakymailer 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2 (2020-04-29) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
home_url="https://www.debian.org/"
support_url="https://www.debian.org/support"
bug_report_url="https://bugs.debian.org/"4.19.0-9-amd64
Debian GNU/Linux 10 (buster)
x86_64
Networks
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ netnetstat -antup4
netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:5000 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 772/nginx: worker p
tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN 772/nginx: worker p
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN -
tcp 0 0 127.0.0.1:5000 127.0.0.1:58428 TIME_WAIT -
tcp 0 0 127.0.0.1:39088 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:58402 127.0.0.1:5000 TIME_WAIT -
tcp 0 0 127.0.0.1:5000 127.0.0.1:58440 TIME_WAIT -
tcp 0 0 127.0.0.1:39026 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:5000 127.0.0.1:58390 TIME_WAIT -
tcp 0 0 127.0.0.1:38978 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:32836 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:38974 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:38990 127.0.0.1:8080 TIME_WAIT -
tcp 0 301 10.10.10.197:35154 10.10.14.4:9999 ESTABLISHED 10042/sh
tcp 0 0 127.0.0.1:32876 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:58414 127.0.0.1:5000 TIME_WAIT -
tcp 0 0 127.0.0.1:39014 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:32962 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:39062 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:32950 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:58366 127.0.0.1:5000 TIME_WAIT -
tcp 0 0 127.0.0.1:58354 127.0.0.1:5000 TIME_WAIT -
tcp 0 0 127.0.0.1:32852 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:32900 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:5000 127.0.0.1:58314 TIME_WAIT -
tcp 0 0 127.0.0.1:39050 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:58378 127.0.0.1:5000 TIME_WAIT -
tcp 0 0 127.0.0.1:32936 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:32924 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:5000 127.0.0.1:58342 TIME_WAIT -
tcp 0 0 127.0.0.1:32912 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:5000 127.0.0.1:58330 TIME_WAIT -
tcp 0 0 127.0.0.1:32888 127.0.0.1:143 TIME_WAIT -
tcp 0 0 127.0.0.1:39038 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:32864 127.0.0.1:143 TIME_WAIT -
tcp 0 0 10.10.10.197:80 10.10.14.4:41456 ESTABLISHED 772/nginx: worker p
tcp 0 0 127.0.0.1:58318 127.0.0.1:5000 TIME_WAIT -
tcp 0 0 127.0.0.1:39074 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:39002 127.0.0.1:8080 TIME_WAIT -
tcp 0 0 127.0.0.1:39100 127.0.0.1:8080 TIME_WAIT -
udp 0 0 10.10.10.197:39144 8.8.8.8:53 ESTABLISHED - 127.0.0.1:5000
Users & Groups
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:101:102:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
systemd-network:x:102:103:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:103:104:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:104:110::/nonexistent:/usr/sbin/nologin
avahi-autoipd:x:105:112:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
low:x:1000:1000:,,,:/home/low:/bin/bash
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
ftp:x:107:115:ftp daemon,,,:/srv/ftp:/usr/sbin/nologin
postfix:x:108:116::/var/spool/postfix:/usr/sbin/nologin
courier:x:109:118::/var/lib/courier:/usr/sbin/nologin
vmail:x:5000:5000::/home/vmail:/usr/sbin/nologin
developer:x:1001:1001:,,,:/var/www/dev.sneakycorp.htb:/bin/bash
pypi:x:998:998::/var/www/pypi.sneakycorp.htb:/usr/sbin/nologin
total 16K
4.0K drwxr-xr-x 8 low low 4.0K Jun 8 2020 low
4.0K drwx------ 5 vmail vmail 4.0K May 19 2020 vmail
4.0K drwxr-xr-x 4 root root 4.0K May 14 2020 .
4.0K drwxr-xr-x 18 root root 4.0K May 14 2020 ..low
vmail
developer
pypi
SUIDs
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ find / -perm -04000 -ls -type f 2>/dev/null
265813 64 -rwsr-xr-x 1 root root 63568 Jan 10 2019 /usr/bin/su
292766 36 -rwsr-xr-x 1 root root 34896 Apr 22 2020 /usr/bin/fusermount
266147 52 -rwsr-xr-x 1 root root 51280 Jan 10 2019 /usr/bin/mount
262196 44 -rwsr-xr-x 1 root root 44528 Jul 27 2018 /usr/bin/chsh
265666 44 -rwsr-xr-x 1 root root 44440 Jul 27 2018 /usr/bin/newgrp
262195 56 -rwsr-xr-x 1 root root 54096 Jul 27 2018 /usr/bin/chfn
266149 36 -rwsr-xr-x 1 root root 34888 Jan 10 2019 /usr/bin/umount
290908 156 -rwsr-xr-x 1 root root 157192 Feb 2 2020 /usr/bin/sudo
262198 84 -rwsr-xr-x 1 root root 84016 Jul 27 2018 /usr/bin/gpasswd
262200 64 -rwsr-xr-x 1 root root 63736 Jul 27 2018 /usr/bin/passwd
274937 52 -rwsr-xr-- 1 root messagebus 51184 Jun 9 2019 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
3089 12 -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device
278294 428 -rwsr-xr-x 1 root root 436552 Jan 31 2020 /usr/lib/openssh/ssh-keysignSGIDs
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ find / -perm -02000 -ls -type f 2>/dev/null
10051 0 drwxr-sr-x 3 root systemd-journal 60 mar 16 05:57 /run/log/journal
10052 0 drwxr-s--- 2 root systemd-journal 220 mar 16 10:25 /run/log/journal/da016d4687534834af912976d9836e16
212 4 drwxrwsr-x 2 root staff 4096 Feb 1 2020 /var/local
140334 4 drwx--s--- 2 postfix postdrop 4096 mar 16 05:57 /var/spool/postfix/public
275 4 drwxrwsr-x 2 root mail 4096 Jun 5 2020 /var/mail
263728 36 -rwxr-sr-x 1 root tty 34896 Jan 10 2019 /usr/bin/wall
278287 316 -rwxr-sr-x 1 root ssh 321672 Jan 31 2020 /usr/bin/ssh-agent
262194 72 -rwxr-sr-x 1 root shadow 71816 Jul 27 2018 /usr/bin/chage
292964 40 -rwxr-sr-x 1 root mlocate 39608 Nov 14 2018 /usr/bin/mlocate
288055 16 -rwxr-sr-x 1 root root 15048 Mar 14 2019 /usr/bin/dotlock.mailutils
267775 16 -rwxr-sr-x 1 root tty 14736 May 4 2018 /usr/bin/bsd-write
267840 44 -rwxr-sr-x 1 root crontab 43568 Oct 11 2019 /usr/bin/crontab
262197 32 -rwxr-sr-x 1 root shadow 31000 Jul 27 2018 /usr/bin/expiry
275137 20 -rwxr-sr-x 1 root mail 18944 Dec 3 2017 /usr/bin/dotlockfile
271407 4 drwxrwsr-x 4 root staff 4096 May 14 2020 /usr/local/lib/python2.7
271409 4 drwxrwsr-x 2 root staff 4096 May 14 2020 /usr/local/lib/python2.7/dist-packages
281249 4 drwxrwsr-x 2 root staff 4096 May 14 2020 /usr/local/lib/python2.7/site-packages
271016 4 drwxrwsr-x 3 root staff 4096 May 14 2020 /usr/local/lib/python3.7
271018 4 drwxrwsr-x 2 root staff 4096 May 14 2020 /usr/local/lib/python3.7/dist-packages
290475 4 drwxrwsr-x 2 root staff 4096 May 14 2020 /usr/local/share/fonts
291033 12 -rwxr-sr-x 1 root utmp 10232 Feb 18 2016 /usr/lib/x86_64-linux-gnu/utempter/utempter
285879 24 -r-xr-sr-x 1 root postdrop 22600 Mar 16 2020 /usr/sbin/postqueue
285870 20 -r-xr-sr-x 1 root postdrop 18552 Mar 16 2020 /usr/sbin/postdrop
263008 40 -rwxr-sr-x 1 root shadow 39616 Feb 14 2019 /usr/sbin/unix_chkpwdProcesses
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ ps -auxwww
ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.1 0.2 169476 10204 ? Ss 05:57 0:19 /sbin/init
root 350 0.2 0.4 48924 17348 ? Ss 05:57 0:48 /lib/systemd/systemd-journald
root 376 0.0 0.1 22056 5060 ? Ss 05:57 0:00 /lib/systemd/systemd-udevd
systemd+ 488 0.0 0.1 93080 6664 ? Ssl 05:57 0:01 /lib/systemd/systemd-timesyncd
root 489 0.0 0.2 48220 10900 ? Ss 05:57 0:00 /usr/bin/VGAuthService
root 490 0.0 0.2 122852 12072 ? Ssl 05:57 0:12 /usr/bin/vmtoolsd
message+ 551 0.0 0.1 9172 4588 ? Ss 05:57 0:08 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 552 0.0 0.1 19304 6420 ? Ss 05:57 0:02 /lib/systemd/systemd-logind
root 554 0.0 0.1 19768 5172 ? Ss 05:57 0:00 /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant
root 557 0.0 0.0 8504 2740 ? Ss 05:57 0:00 /usr/sbin/cron -f
root 565 0.0 0.0 2284 80 ? S 05:57 0:00 /usr/sbin/courierlogger -pid=/run/courier/authdaemon/pid -start /usr/lib/courier/courier-authlib/authdaemond
root 568 0.0 0.0 6324 3596 ? S 05:57 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 592 0.0 0.0 7136 2284 ? S 05:57 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 593 0.0 0.0 7136 2284 ? S 05:57 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 594 0.0 0.0 7344 2988 ? S 05:57 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 595 0.0 0.0 7136 2284 ? S 05:57 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 596 0.0 0.0 7136 2284 ? S 05:57 0:00 /usr/lib/courier/courier-authlib/authdaemond
root 644 0.0 0.0 2284 80 ? S 05:57 0:00 /usr/sbin/courierlogger -pid=/run/courier/imapd.pid -start -name=imapd /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=20 -access=/etc/courier/imapaccess.dat -nodnslookup -noidentlookup 143 /usr/lib/courier/courier/imaplogin /usr/bin/imapd Maildir
root 645 0.0 0.0 4768 1912 ? S 05:57 0:00 /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=20 -access=/etc/courier/imapaccess.dat -nodnslookup -noidentlookup 143 /usr/lib/courier/courier/imaplogin /usr/bin/imapd Maildir
root 673 0.0 0.0 2284 80 ? S 05:57 0:00 /usr/sbin/courierlogger -pid=/run/courier/imapd-ssl.pid -start -name=imapd-ssl /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=20 -access=/etc/courier/imapaccess.dat -nodnslookup -noidentlookup 993 /usr/bin/couriertls -server -tcpd -user=courier /usr/lib/courier/courier/imaplogin /usr/bin/imapd Maildir
root 674 0.0 0.0 4768 1848 ? S 05:57 0:00 /usr/sbin/couriertcpd -address=0 -maxprocs=40 -maxperip=20 -access=/etc/courier/imapaccess.dat -nodnslookup -noidentlookup 993 /usr/bin/couriertls -server -tcpd -user=courier /usr/lib/courier/courier/imaplogin /usr/bin/imapd Maildir
pypi 681 0.0 0.6 36804 25772 ? Ss 05:57 0:11 /var/www/pypi.sneakycorp.htb/venv/bin/python3 /var/www/pypi.sneakycorp.htb/venv/bin/pypi-server -i 127.0.0.1 -p 5000 -a update,download,list -P /var/www/pypi.sneakycorp.htb/.htpasswd --disable-fallback -o /var/www/pypi.sneakycorp.htb/packages
root 685 0.0 0.5 198404 21532 ? Ss 05:57 0:00 php-fpm: master process (/etc/php/7.3/fpm/php-fpm.conf)
root 698 0.0 0.0 6620 3052 ? Ss 05:57 0:00 /usr/sbin/vsftpd /etc/vsftpd.conf
root 703 0.0 0.0 5612 1672 tty1 Ss+ 05:57 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root 709 0.0 0.1 15852 7052 ? Ss 05:57 0:00 /usr/sbin/sshd -D
www-data 718 1.4 0.3 198896 13204 ? R 05:57 3:49 php-fpm: pool www
www-data 719 0.5 0.3 198896 14768 ? S 05:57 1:25 php-fpm: pool www
root 770 0.0 0.0 70444 1832 ? Ss 05:57 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data 772 1.2 0.1 70728 7288 ? S 05:57 3:18 nginx: worker process
www-data 773 0.5 0.1 70728 7292 ? S 05:57 1:34 nginx: worker process
root 993 0.0 0.1 43472 4472 ? Ss 05:57 0:00 /usr/lib/postfix/sbin/master -w
postfix 995 0.0 0.1 44372 8044 ? S 05:57 0:00 qmgr -l -t unix -u
root 1074 0.0 0.1 225960 5076 ? Ssl 05:57 0:10 /usr/sbin/rsyslogd -n -iNONE
low 1079 0.0 0.5 29952 20864 ? Ss 05:57 0:08 /home/low/venv/bin/python /opt/scripts/low/install-modules.py
postfix 1183 0.0 0.2 44004 9260 ? S 05:59 0:00 tlsmgr -l -t unix -u -c
postfix 8389 0.0 0.1 43820 7464 ? S 09:17 0:00 pickup -l -t unix -u -c
develop+ 9887 0.0 0.0 7128 2584 ? S 10:22 0:00 /usr/sbin/vsftpd /etc/vsftpd.conf
develop+ 10106 0.0 0.0 5260 684 ? Ss 10:27 0:00 /bin/sleep 60
vmail 10149 0.0 0.0 5260 740 ? Ss 10:28 0:00 /bin/sleep 10
vmail 10150 0.0 0.0 5260 680 ? Ss 10:28 0:00 /bin/sleep 10
www-data 10151 0.0 0.0 11116 3092 pts/0 R+ 10:28 0:00 ps -auxwww/usr/sbin/cron -f
/var/www/pypi.sneakycorp.htb/venv/bin/python3 /var/www/pypi.sneakycorp.htb/venv/bin/pypi-server -i 127.0.0.1 -p 5000 -a update,download,list -P /var/www/pypi.sneakycorp.htb/.htpasswd --disable-fallback -o /var/www/pypi.sneakycorp.htb/packages
/home/low/venv/bin/python /opt/scripts/low/install-modules.py
Cron & Systemd
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED
thu 2023-03-16 10:30:29 EDT 2min 5s left Thu 2023-03-16 09:31:28 EDT 56min ag
thu 2023-03-16 10:39:00 EDT 10min left Thu 2023-03-16 10:09:00 EDT 19min ag
thu 2023-03-16 14:17:00 EDT 3h 48min left Thu 2023-03-16 05:57:35 EDT 4h 30min
fri 2023-03-17 00:00:00 EDT 13h left Thu 2023-03-16 05:57:35 EDT 4h 30min
fri 2023-03-17 00:00:00 EDT 13h left Thu 2023-03-16 05:57:35 EDT 4h 30min
fri 2023-03-17 06:12:33 EDT 19h left Thu 2023-03-16 06:12:33 EDT 4h 15min
fri 2023-03-17 06:29:44 EDT 20h left Thu 2023-03-16 06:26:17 EDT 4h 2min
7 timers listed.
Pass --all to see loaded but inactive timers, too.
lines 1-11/11 (END)Sudo Version
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ sudo -V
Sudo version 1.8.27
sudo: unable to resolve host sneakymailer: Temporary failure in name resolution
Sudoers policy plugin version 1.8.27
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.27Sudo version 1.8.27
Glibc Version
www-data@sneakymailer:~/dev.sneakycorp.htb/dev$ ldd --version
ldd (Debian GLIBC 2.28-10) 2.28
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Debian GLIBC 2.28-10) 2.28