System/Kernel
www-data@ubuntu:~/html/wordpress/wp-content/banners$ uname -a ; cat /etc/*release
Linux ubuntu 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.1 LTS"
NAME="Ubuntu"
VERSION="16.04.1 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.1 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
UBUNTU_CODENAME=xenial4.4.0-31-genericx86_64Ubuntu 16.04.1 LTS (Xenial Xerus)
Networks
www-data@ubuntu:~/html/wordpress/wp-content/banners$ ip route ; arp -a
default via 192.168.120.254 dev ens224 onlink
192.168.120.0/24 dev ens224 proto kernel scope link src 192.168.120.121
? (192.168.120.254) at 00:50:56:9e:fc:4d [ether] on ens224www-data@ubuntu:~/html/wordpress/wp-content/banners$ netstat -antup4
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN 2978/nginx: worker
tcp 0 0 192.168.120.121:80 192.168.45.235:35506 FIN_WAIT2 -
tcp 0 0 192.168.120.121:34248 192.168.45.235:9999 ESTABLISHED 3764/sh tcp 0 0 127.0.0.1:3306 0.0.0.0:* LISTEN -
Users & Groups
www-data@ubuntu:~/html/wordpress/wp-content/banners$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
messagebus:x:106:110::/var/run/dbus:/bin/false
uuidd:x:107:111::/run/uuidd:/bin/false
loly:x:1000:1000:sun,,,:/home/loly:/bin/bash
sshd:x:108:65534::/var/run/sshd:/usr/sbin/nologin
mysql:x:109:116:MySQL Server,,,:/nonexistent:/bin/false
total 12K
4.0K drwxr-xr-x 2 loly loly 4.0K Dec 7 2020 loly
4.0K drwxr-xr-x 22 root root 4.0K Dec 7 2020 ..
4.0K drwxr-xr-x 3 root root 4.0K Aug 19 2020 .loly
www-data@ubuntu:~/html/wordpress/wp-content/banners$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(systemd-timesync) gid=102(systemd-timesync) groups=102(systemd-timesync)
uid=101(systemd-network) gid=103(systemd-network) groups=103(systemd-network)
uid=102(systemd-resolve) gid=104(systemd-resolve) groups=104(systemd-resolve)
uid=103(systemd-bus-proxy) gid=105(systemd-bus-proxy) groups=105(systemd-bus-proxy)
uid=104(syslog) gid=108(syslog) groups=108(syslog),4(adm)
uid=105(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=106(messagebus) gid=110(messagebus) groups=110(messagebus)
uid=107(uuidd) gid=111(uuidd) groups=111(uuidd)
uid=1000(loly) gid=1000(loly) groups=1000(loly),4(adm),24(cdrom),30(dip),46(plugdev),114(lpadmin),115(sambashare)
uid=108(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=109(mysql) gid=116(mysql) groups=116(mysql)uid=33(www-data) gid=33(www-data) groups=33(www-data)uid=1000(loly) gid=1000(loly) groups=1000(loly),4(adm),24(cdrom),30(dip),46(plugdev),114(lpadmin),115(sambashare)
SUIDs
www-data@ubuntu:~/html/wordpress/wp-content/banners$ find / -perm -04000 -ls -type f 2>/dev/null | grep -v '/snap'
927583 44 -rwsr-xr-- 1 root messagebus 42992 Apr 1 2016 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
932323 420 -rwsr-xr-x 1 root root 428240 May 26 2020 /usr/lib/openssh/ssh-keysign
917862 12 -rwsr-xr-x 1 root root 10240 Feb 25 2014 /usr/lib/eject/dmcrypt-get-device
917539 52 -rwsr-xr-x 1 root root 49584 Mar 29 2016 /usr/bin/chfn
917541 40 -rwsr-xr-x 1 root root 40432 Mar 29 2016 /usr/bin/chsh
917666 40 -rwsr-xr-x 1 root root 39904 Mar 29 2016 /usr/bin/newgrp
917677 56 -rwsr-xr-x 1 root root 54256 Mar 29 2016 /usr/bin/passwd
931148 12 -rwsr-xr-x 1 root root 10624 May 8 2018 /usr/bin/vmware-user-suid-wrapper
917602 76 -rwsr-xr-x 1 root root 75304 Mar 29 2016 /usr/bin/gpasswd
917761 136 -rwsr-xr-x 1 root root 136808 May 4 2016 /usr/bin/sudo
131164 40 -rwsr-xr-x 1 root root 40128 Mar 29 2016 /bin/su
141604 140 -rwsr-xr-x 1 root root 142032 Feb 17 2016 /bin/ntfs-3g
131182 28 -rwsr-xr-x 1 root root 27608 May 26 2016 /bin/umount
131148 44 -rwsr-xr-x 1 root root 44680 May 7 2014 /bin/ping6
131147 44 -rwsr-xr-x 1 root root 44168 May 7 2014 /bin/ping
141599 32 -rwsr-xr-x 1 root root 30800 Mar 11 2016 /bin/fusermount
131133 40 -rwsr-xr-x 1 root root 40152 May 26 2016 /bin/mountSGIDs
www-data@ubuntu:~/html/wordpress/wp-content/banners$ find / -perm -02000 -ls -type f 2>/dev/null | grep -v '/snap'
927804 4 drwxrwsr-x 6 root staff 4096 Aug 19 2020 /usr/local/share/xml
927805 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/xml/misc
927807 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/xml/entities
927808 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/xml/schema
927806 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/xml/declaration
931150 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/fonts
928925 4 drwxrwsr-x 3 root staff 4096 Aug 19 2020 /usr/local/share/emacs
928926 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/emacs/site-lisp
927768 4 drwxrwsr-x 7 root staff 4096 Aug 19 2020 /usr/local/share/sgml
927772 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/sgml/misc
927771 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/sgml/entities
927770 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/sgml/stylesheet
927769 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/sgml/declaration
927773 4 drwxrwsr-x 2 root staff 4096 Aug 19 2020 /usr/local/share/sgml/dtd
920506 4 drwxrwsr-x 3 root staff 4096 Aug 19 2020 /usr/local/lib/python3.5
920507 4 drwxrwsr-x 2 root staff 4096 Jul 19 2016 /usr/local/lib/python3.5/dist-packages
928427 16 -rwxr-sr-x 1 root tty 14752 Mar 1 2016 /usr/bin/bsd-write
928655 40 -rwxr-sr-x 1 root mlocate 39520 Nov 17 2014 /usr/bin/mlocate
917587 24 -rwxr-sr-x 1 root shadow 22768 Mar 29 2016 /usr/bin/expiry
932317 352 -rwxr-sr-x 1 root ssh 358624 May 26 2020 /usr/bin/ssh-agent
917814 28 -rwxr-sr-x 1 root tty 27368 May 26 2016 /usr/bin/wall
917550 36 -rwxr-sr-x 1 root crontab 36080 Apr 5 2016 /usr/bin/crontab
917536 64 -rwxr-sr-x 1 root shadow 62336 Mar 29 2016 /usr/bin/chage
524486 36 -rwxr-sr-x 1 root shadow 35600 Mar 16 2016 /sbin/unix_chkpwd
524450 36 -rwxr-sr-x 1 root shadow 35632 Mar 16 2016 /sbin/pam_extrausers_chkpwd
275 0 drwxr-sr-x 3 root systemd-journal 60 Aug 2 2024 /run/log/journal
276 0 drwxr-s--- 2 root systemd-journal 80 Apr 27 06:50 /run/log/journal/629cbed1e4836652a99b64e85f3ccf04
525483 4 drwxrwsr-x 2 root staff 4096 Apr 12 2016 /var/local
542594 4 drwxr-s--- 2 mysql adm 4096 Dec 7 2020 /var/log/mysql
527216 4 drwxr-sr-x 2 man root 4096 Jan 12 2021 /var/cache/man
525499 4 drwxrwsr-x 2 root mail 4096 Jul 19 2016 /var/mailCapabilities
www-data@ubuntu:~/html/wordpress/wp-content/banners$ getcap -r / 2>/dev/null
getcap -r / 2>/dev/null
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/bin/systemd-detect-virt = cap_dac_override,cap_sys_ptrace+ep
/usr/bin/mtr = cap_net_raw+epProcesses
www-data@ubuntu:~/html/wordpress/wp-content/banners$ ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.2 37712 5844 ? Ss 06:45 0:00 /sbin/init noprompt
root 1148 0.0 0.1 29644 2804 ? Ss 06:45 0:00 /lib/systemd/systemd-journald
root 1215 0.0 0.2 45416 5020 ? Ss 06:45 0:00 /lib/systemd/systemd-udevd
root 1217 0.0 0.0 158624 284 ? Ssl 06:45 0:00 vmware-vmblock-fuse /run/vmblock-fuse -o rw,subtype=vmware-vmblock,default_permissions,allow_other,dev,suid
root 1230 0.0 0.5 194536 11020 ? Ssl 06:45 0:02 /usr/bin/vmtoolsd
systemd+ 1365 0.0 0.2 100324 4552 ? Ssl 06:45 0:00 /lib/systemd/systemd-timesyncd
root 2319 0.0 0.3 275760 6272 ? Ssl 06:45 0:00 /usr/lib/accountsservice/accounts-daemon
root 2323 0.0 0.1 29008 2936 ? Ss 06:45 0:00 /usr/sbin/cron -f
root 2330 0.0 0.0 20096 1284 ? Ss 06:45 0:00 /lib/systemd/systemd-logind
root 2340 0.0 0.4 85532 9780 ? Ss 06:45 0:00 /usr/bin/VGAuthService
syslog 2341 0.0 0.3 256392 7536 ? Ssl 06:45 0:00 /usr/sbin/rsyslogd -n
message+ 2345 0.0 0.1 42900 3684 ? Ss 06:45 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
root 2412 0.0 0.0 15936 1808 tty1 Ss+ 06:45 0:00 /sbin/agetty --noclear tty1 linux
root 2955 0.0 0.1 21168 3596 ? S 06:50 0:00 /bin/bash /usr/bin/mysqld_safe
root 2976 0.0 0.0 125208 1464 ? Ss 06:50 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on;
www-data 2978 1.2 0.2 125800 5248 ? S 06:50 1:05 nginx: worker process
mysql 3101 0.8 4.9 598900 100736 ? Sl 06:50 0:41 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib/mysql/plugin --user=mysql --skip-log-error --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/run/mysqld/mysqld.sock --port=3306
root 3102 0.0 0.0 26088 1372 ? S 06:50 0:00 logger -t mysqld -p daemon error
root 3103 0.0 1.7 380984 34980 ? Ss 06:50 0:00 php-fpm: master process (/etc/php/7.0/fpm/php-fpm.conf)
www-data 3551 5.7 2.5 460744 51320 ? S 07:11 3:45 php-fpm: pool www
www-data 3585 0.9 2.5 462472 51980 ? R 07:18 0:35 php-fpm: pool www
www-data 3586 6.5 2.2 458256 47048 ? S 07:18 3:52 php-fpm: pool www
www-data 3764 0.0 0.0 0 0 ? Z 08:11 0:00 [sh] <defunct>
www-data 3813 0.0 0.0 4504 784 ? S 08:14 0:00 sh -c bash
www-data 3814 0.0 0.1 18020 2772 ? S 08:14 0:00 bash
www-data 3815 0.0 0.4 35704 8708 ? S 08:14 0:00 python3 -c import pty; pty.spawn("/bin/bash")
www-data 3816 0.0 0.1 18236 3272 pts/0 Ss+ 08:14 0:00 /bin/bash
www-data 3872 0.0 0.0 4504 708 ? S 08:17 0:00 sh -c bash
www-data 3873 0.0 0.1 18020 2820 ? S 08:17 0:00 bash
www-data 3874 0.0 0.1 34424 2976 ? R 08:17 0:00 ps -auxwwwroot 2323 0.0 0.1 29008 2936 ? Ss 06:45 0:00 /usr/sbin/cron -froot 2955 0.0 0.1 21168 3596 ? S 06:50 0:00 /bin/bash /usr/bin/mysqld_safemysql 3101 0.8 4.9 598900 100736 ? Sl 06:50 0:41 /usr/sbin/mysqld --basedir=/usr --datadir=/var/lib/mysql --plugin-dir=/usr/lib/mysql/plugin --user=mysql --skip-log-error --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/run/mysqld/mysqld.sock --port=3306
Cron & Systemd
www-data@ubuntu:~/html/wordpress/wp-content/banners$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED
Mon 2025-04-28 02:40:24 PDT 18h left Sun 2025-04-27 06:50:31 PDT 1h 27min ago
Mon 2025-04-28 07:00:30 PDT 22h left Sun 2025-04-27 07:00:30 PDT 1h 17min ago
2 timers listed.
Pass --all to see loaded but inactive timers, too.Services
www-data@ubuntu:~/html/wordpress/wp-content/banners$ systemctl list-units --state=running
UNIT LOAD ACTIVE SUB DESCRIPTION
proc-sys-fs-binfmt_misc.automount loaded active running Arbitrary Executable Fil
init.scope loaded active running System and Service Manager
accounts-daemon.service loaded active running Accounts Service
cron.service loaded active running Regular background program pr
dbus.service loaded active running D-Bus System Message Bus
getty@tty1.service loaded active running Getty on tty1
mysql.service loaded active running LSB: Start and stop the mysql
nginx.service loaded active running A high performance web server
open-vm-tools.service loaded active running Service for virtual machines
php7.0-fpm.service loaded active running The PHP 7.0 FastCGI Process M
rsyslog.service loaded active running System Logging Service
systemd-journald.service loaded active running Journal Service
systemd-logind.service loaded active running Login Service
systemd-timesyncd.service loaded active running Network Time Synchronization
systemd-udevd.service loaded active running udev Kernel Device Manager
vgauth.service loaded active running Authentication service for vi
dbus.socket loaded active running D-Bus System Message Bus Sock
syslog.socket loaded active running Syslog Socket
systemd-journald-audit.socket loaded active running Journal Audit Socket
systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/log)
systemd-journald.socket loaded active running Journal Socket
systemd-udevd-control.socket loaded active running udev Control Socket
systemd-udevd-kernel.socket loaded active running udev Kernel Socket
LOAD = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB = The low-level unit activation state, values depend on unit type.
23 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.mysql.servicenginx.service
Sudo Version
www-data@ubuntu:~/html/wordpress/wp-content/banners$ sudo --version
Sudo version 1.8.16
Sudoers policy plugin version 1.8.16
Sudoers file grammar version 45
Sudoers I/O plugin version 1.8.16Sudo version 1.8.16
Glibc Version
www-data@ubuntu:~/html/wordpress/wp-content/banners$ ldd --version
ldd (Ubuntu GLIBC 2.23-0ubuntu3) 2.23
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Ubuntu GLIBC 2.23-0ubuntu3) 2.23