InfoSec LAB

University_Initial_Foothold_UNIX-lab-2.university.htb

Created: 7 min read

System/Kernel

wao@LAB-2:~$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=6386b644ab2d987986aeb40325a787a035a4f0d8, stripped
Linux LAB-2 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=18.04
DISTRIB_CODENAME=bionic
DISTRIB_DESCRIPTION="Ubuntu 18.04.6 LTS"
NAME="Ubuntu"
VERSION="18.04.6 LTS (Bionic Beaver)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 18.04.6 LTS"
VERSION_ID="18.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=bionic
UBUNTU_CODENAME=bionic
  • 64-bit
  • 4.15.0-213-generic
  • Ubuntu 18.04.6 LTS (Bionic Beaver)

Networks

wao@LAB-2:~$ ip route ; arp -a
192.168.99.0/24 dev eth0 proto kernel scope link src 192.168.99.12 
? (192.168.99.1) at 00:15:5d:05:80:01 [ether] on eth0

192.168.99.1

wao@LAB-2:~$ netstat -antup4
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0    612 192.168.99.12:22        192.168.99.1:64707      ESTABLISHED -                   
udp        0      0 127.0.0.53:53           0.0.0.0:*                           -

127.0.0.53:53

Users & Groups

wao@LAB-2:~$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd/netif:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd/resolve:/usr/sbin/nologin
syslog:x:102:106::/home/syslog:/usr/sbin/nologin
messagebus:x:103:107::/nonexistent:/usr/sbin/nologin
_apt:x:104:65534::/nonexistent:/usr/sbin/nologin
uuidd:x:105:109::/run/uuidd:/usr/sbin/nologin
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
wao:x:1001:1001:,,,:/home/wao:/bin/bash
steven:x:1002:1002:,,,:/home/steven:/bin/bash
emma:x:1003:1003:,,,:/home/emma:/bin/bash
total 20
drwxr-xr-x  5 root   root   4096 Sep 14 03:45 ./
drwxr-xr-x 22 root   root   4096 Sep 13 08:12 ../
drwxr-xr-x  4 emma   emma   4096 Sep 14 03:46 emma/
drwxr-xr-x  2 steven steven 4096 Sep 14 03:47 steven/
drwxr-xr-x  9 wao    wao    4096 Oct 21 17:09 wao/
  • emma
  • steven
wao@LAB-2:~$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=101(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=102(syslog) gid=106(syslog) groups=106(syslog),4(adm)
uid=103(messagebus) gid=107(messagebus) groups=107(messagebus)
uid=104(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=105(uuidd) gid=109(uuidd) groups=109(uuidd)
uid=106(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=1001(wao) gid=1001(wao) groups=1001(wao),27(sudo)
uid=1002(steven) gid=1002(steven) groups=1002(steven)
uid=1003(emma) gid=1003(emma) groups=1003(emma),27(sudo)
  • uid=1001(wao) gid=1001(wao) groups=1001(wao),27(sudo)
  • uid=1002(steven) gid=1002(steven) groups=1002(steven)
  • uid=1003(emma) gid=1003(emma) groups=1003(emma),27(sudo)

SUIDs

wao@LAB-2:~$ find / -perm -04000 -ls -type f 2>/dev/null
   135028     28 -rwsr-xr-x   1 root     root        26696 Sep 16  2020 /bin/umount
   154562     32 -rwsr-xr-x   1 root     root        30800 Aug 11  2016 /bin/fusermount
   135014     64 -rwsr-xr-x   1 root     root        64424 Jun 28  2019 /bin/ping
   131721     44 -rwsr-xr-x   1 root     root        44664 Nov 29  2022 /bin/su
   135027     44 -rwsr-xr-x   1 root     root        43088 Sep 16  2020 /bin/mount
   135716     44 -rwsr-xr--   1 root     messagebus    42992 Oct 25  2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
   270202    428 -rwsr-xr-x   1 root     root         436552 Mar 30  2022 /usr/lib/openssh/ssh-keysign
   136473     12 -rwsr-xr-x   1 root     root          10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
   137327     44 -rwsr-xr-x   1 root     root          44528 Nov 29  2022 /usr/bin/chsh
   137341     60 -rwsr-xr-x   1 root     root          59640 Nov 29  2022 /usr/bin/passwd
   131735     40 -rwsr-xr-x   1 root     root          40344 Nov 29  2022 /usr/bin/newgrp
   136932    148 -rwsr-xr-x   1 root     root         149080 Apr  4  2023 /usr/bin/sudo
   132554     76 -rwsr-xr-x   1 root     root          76496 Nov 29  2022 /usr/bin/chfn
   137338     76 -rwsr-xr-x   1 root     root          75824 Nov 29  2022 /usr/bin/gpasswd
   155489     20 -rwsr-xr-x   1 root     root          18448 Jun 28  2019 /usr/bin/traceroute6.iputils

SGIDs

wao@LAB-2:~$ find / -type f -perm -02000 -ls 2>/dev/null
      394     36 -rwxr-sr-x   1 root     shadow      34816 Feb  2  2023 /sbin/pam_extrausers_chkpwd
      402     36 -rwxr-sr-x   1 root     shadow      34816 Feb  2  2023 /sbin/unix_chkpwd
   157093    356 -rwxr-sr-x   1 root     ssh        362640 Mar 30  2022 /usr/bin/ssh-agent
   154322     16 -rwxr-sr-x   1 root     tty         14328 Jan 17  2018 /usr/bin/bsd-write
   137335     24 -rwxr-sr-x   1 root     shadow      22808 Nov 29  2022 /usr/bin/expiry
   131524     32 -rwxr-sr-x   1 root     tty         30800 Sep 16  2020 /usr/bin/wall
   131379     40 -rwxr-sr-x   1 root     crontab     39352 May 10  2022 /usr/bin/crontab
   157069     44 -rwxr-sr-x   1 root     mlocate     43088 Mar  1  2018 /usr/bin/mlocate
   132552     72 -rwxr-sr-x   1 root     shadow      71816 Nov 29  2022 /usr/bin/chage

Processes

wao@LAB-2:~$ ps -auxwww
USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root          1  0.0  1.9  77352  7920 ?        Ss   Oct27   0:05 /sbin/init splash
root        233  0.0  1.7  94652  7132 ?        S<s  Oct27   0:00 /lib/systemd/systemd-journald
root        255  0.0  1.2  46496  4988 ?        Ss   Oct27   0:00 /lib/systemd/systemd-udevd
systemd+    264  0.0  0.7 141788  2960 ?        Ssl  Oct27   0:01 /lib/systemd/systemd-timesyncd
systemd+    268  0.0  1.2  71728  4972 ?        Ss   Oct27   0:00 /lib/systemd/systemd-networkd
systemd+    308  0.0  1.1  70628  4724 ?        Ss   Oct27   0:03 /lib/systemd/systemd-resolved
message+    350  0.0  1.0  49932  4236 ?        Ss   Oct27   0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root        357  0.0  4.2 170816 16928 ?        Ssl  Oct27   0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
syslog      358  0.0  1.0 263048  4292 ?        Ssl  Oct27   0:00 /usr/sbin/rsyslogd -n
root        359  0.0  1.3  70468  5572 ?        Ss   Oct27   0:00 /lib/systemd/systemd-logind
root        381  0.0  0.6  31324  2660 ?        Ss   Oct27   0:00 /usr/sbin/cron -f
root        382  0.0  1.5 287548  6368 ?        Ssl  Oct27   0:00 /usr/lib/accountsservice/accounts-daemon
root        452  0.0  1.4  72304  5636 ?        Ss   Oct27   0:00 /usr/sbin/sshd -D
root        455  0.0  0.4  16188  1748 tty1     Ss+  Oct27   0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root        737  0.0  1.7 105692  6944 ?        Ss   03:46   0:00 sshd: wao [priv]
wao         739  0.0  1.8  76508  7252 ?        Ss   03:46   0:00 /lib/systemd/systemd --user
wao         740  0.0  0.4 111332  1740 ?        S    03:46   0:00 (sd-pam)
wao         767  0.0  1.3 107988  5532 ?        S    03:46   0:00 sshd: wao@pts/0
wao         768  0.0  1.1  22644  4568 pts/0    Ss   03:46   0:00 -bash
wao         836  0.0  0.8  39672  3596 pts/0    R+   03:54   0:00 ps -auxwww

/usr/sbin/cron -f

Cron & Systemd

wao@LAB-2:~$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for wao
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# m h dom mon dow user	command
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT                         LEFT          LAST                         PASSED       UNIT  
Mon 2024-10-28 06:36:24 EDT  2h 39min left Sun 2024-10-27 19:47:54 EDT  8h ago       apt-da
Mon 2024-10-28 15:32:17 EDT  11h left      Mon 2024-10-28 02:14:45 EDT  1h 42min ago motd-n
Mon 2024-10-28 17:47:24 EDT  13h left      Sun 2024-10-27 19:47:53 EDT  8h ago       apt-da
Mon 2024-10-28 20:02:36 EDT  16h left      Sun 2024-10-27 20:02:36 EDT  7h ago       system
Mon 2024-11-04 00:00:00 EST  6 days left   Mon 2024-10-28 00:00:18 EDT  3h 56min ago fstrim
 
5 timers listed.
Pass --all to see loaded but inactive timers, too.

Sudo Version

wao@LAB-2:~$ sudo --version
Sudo version 1.8.21p2
Sudoers policy plugin version 1.8.21p2
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.21p2

Sudo version 1.8.21p2

Glibc Version

wao@LAB-2:~$ ldd --version
ldd (Ubuntu GLIBC 2.27-3ubuntu1.6) 2.27
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

ldd (Ubuntu GLIBC 2.27-3ubuntu1.6) 2.27

Interactive Graph View

Backlinks