InfoSec LAB

Escape_OffSec_Initial_Foothold_UNIX_a7c367c2113d

Created: 5 min read

System/Kernel

www-data@a7c367c2113d:/var/www/html/dev/uploads$ uname -a ; cat /etc/*release
Linux a7c367c2113d 4.15.0-124-generic #127-Ubuntu SMP Fri Nov 6 10:54:43 UTC 2020 x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 10 (buster)"
NAME="Debian GNU/Linux"
VERSION_ID="10"
VERSION="10 (buster)"
VERSION_CODENAME=buster
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
  • 4.15.0-124-generic
  • x86_64
  • Debian GNU/Linux 10 (buster)

Networks

www-data@a7c367c2113d:/var/www/html/dev/uploads$ ls /sys/class/net/
eth0  lo

2 network devices are present; eth0 and lo

www-data@a7c367c2113d:/var/www/html/dev/uploads$ cat /proc/net/fib_trie
Main:
  +-- 0.0.0.0/0 3 0 5
     |-- 0.0.0.0
        /0 universe UNICAST
     +-- 127.0.0.0/8 2 0 2
        +-- 127.0.0.0/31 1 0 0
           |-- 127.0.0.0
              /32 link BROADCAST
              /8 host LOCAL
           |-- 127.0.0.1
              /32 host LOCAL
        |-- 127.255.255.255
           /32 link BROADCAST
     +-- 172.17.0.0/16 2 0 2
        +-- 172.17.0.0/30 2 0 2
           |-- 172.17.0.0
              /32 link BROADCAST
              /16 link UNICAST
           |-- 172.17.0.2
              /32 host LOCAL
        |-- 172.17.255.255
           /32 link BROADCAST
Local:
  +-- 0.0.0.0/0 3 0 5
     |-- 0.0.0.0
        /0 universe UNICAST
     +-- 127.0.0.0/8 2 0 2
        +-- 127.0.0.0/31 1 0 0
           |-- 127.0.0.0
              /32 link BROADCAST
              /8 host LOCAL
           |-- 127.0.0.1
              /32 host LOCAL
        |-- 127.255.255.255
           /32 link BROADCAST
     +-- 172.17.0.0/16 2 0 2
        +-- 172.17.0.0/30 2 0 2
           |-- 172.17.0.0
              /32 link BROADCAST
              /16 link UNICAST
           |-- 172.17.0.2
              /32 host LOCAL
        |-- 172.17.255.255
           /32 link BROADCAST
 
www-data@a7c367c2113d:/var/www/html/dev/uploads$ cat /etc/hosts
 
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::0	ip6-localnet
ff00::0	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.17.0.2	a7c367c2113d

The IP address of the current host appears to be 172.17.0.2

www-data@a7c367c2113d:/var/www/html/dev/uploads$ cat /proc/net/arp
IP address       HW type     Flags       HW address            Mask     Device
172.17.0.1       0x1         0x2         02:42:7e:d3:9c:0e     *        eth0

Checking the ARP table, /proc/net/arp, reveals the host system; 172.17.0.1

Users & Groups

www-data@a7c367c2113d:/var/www/html/dev/uploads$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
total 8.0K
4.0K drwxr-xr-x 1 root root 4.0K Dec 21  2020 ..
4.0K drwxr-xr-x 2 root root 4.0K Sep 19  2020 .

root

www-data@a7c367c2113d:/var/www/html/dev/uploads$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)

SUIDs

www-data@a7c367c2113d:/var/www/html/dev/uploads$ find / -perm -04000 -ls -type f 2>/dev/null
   678916     64 -rwsr-xr-x   1 root     root        63736 Jul 27  2018 /usr/bin/passwd
   678817     44 -rwsr-xr-x   1 root     root        44528 Jul 27  2018 /usr/bin/chsh
   678906     44 -rwsr-xr-x   1 root     root        44440 Jul 27  2018 /usr/bin/newgrp
   678863     84 -rwsr-xr-x   1 root     root        84016 Jul 27  2018 /usr/bin/gpasswd
   678814     56 -rwsr-xr-x   1 root     root        54096 Jul 27  2018 /usr/bin/chfn
   678426     36 -rwsr-xr-x   1 root     root        34888 Jan 10  2019 /bin/umount
   678404     52 -rwsr-xr-x   1 root     root        51280 Jan 10  2019 /bin/mount
   678420     64 -rwsr-xr-x   1 root     root        63568 Jan 10  2019 /bin/su

SGIDs

www-data@a7c367c2113d:/var/www/html/dev/uploads$ find / -type f -perm -02000 -ls 2>/dev/null
   678811     72 -rwxr-sr-x   1 root     shadow      71816 Jul 27  2018 /usr/bin/chage
   678850     32 -rwxr-sr-x   1 root     shadow      31000 Jul 27  2018 /usr/bin/expiry
   678981     36 -rwxr-sr-x   1 root     tty         34896 Jan 10  2019 /usr/bin/wall
   678789     40 -rwxr-sr-x   1 root     shadow      39616 Feb 14  2019 /sbin/unix_chkpwd

Capabilities

www-data@a7c367c2113d:/var/www/html/dev/uploads$ /usr/sbin/getcap -r / 2>/dev/null

Processes

www-data@a7c367c2113d:/var/www/html/dev/uploads$ ps -auxwww
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  2.4  82892 24228 ?        Ss   11:37   0:00 apache2 -DFOREGROUND
www-data    16  0.0  1.2  83224 12268 ?        S    11:37   0:00 apache2 -DFOREGROUND
www-data    27  0.0  1.1  83208 11508 ?        S    12:27   0:00 apache2 -DFOREGROUND
www-data    35  0.0  1.1  83208 11348 ?        S    12:27   0:00 apache2 -DFOREGROUND
www-data    38  0.0  1.1  83208 11484 ?        S    12:28   0:00 apache2 -DFOREGROUND
www-data    90  0.0  1.0  83028 10664 ?        S    12:28   0:00 apache2 -DFOREGROUND
www-data    99  0.0  1.1  83208 11684 ?        S    12:29   0:00 apache2 -DFOREGROUND
www-data   101  0.6  1.2  83208 12340 ?        S    12:29   0:20 apache2 -DFOREGROUND
www-data   103  0.0  0.8  82964  8388 ?        S    12:30   0:00 apache2 -DFOREGROUND
www-data   104  0.0  1.1  83208 11608 ?        S    12:30   0:00 apache2 -DFOREGROUND
www-data   109 40.6  1.2  83400 12284 ?        R    12:30  21:37 apache2 -DFOREGROUND
www-data   114  0.0  0.0   2388   752 ?        S    13:02   0:00 sh -c bash
www-data   115  0.0  0.2   3736  2920 ?        S    13:02   0:00 bash
www-data   122  0.0  0.1   2592  1820 ?        S    13:03   0:00 script /dev/null -c bash
www-data   123  0.0  0.0   2388   748 pts/0    Ss   13:03   0:00 sh -c bash
www-data   124  0.0  0.3   3976  3260 pts/0    S    13:03   0:00 bash
www-data   236  0.0  0.2   7640  2680 pts/0    R+   13:23   0:00 ps -auxwww

Cron & Systemd

www-data@a7c367c2113d:/var/www/html/dev/uploads$ crontab -l ; cat /etc/crontab ; systemctl list-timers
 
bash: crontab: command not found
cat: /etc/crontab: No such file or directory
bash: systemctl: command not found

Services

www-data@a7c367c2113d:/var/www/html/dev/uploads$ systemctl list-units --state=running
bash: systemctl: command not found

Sudo Version

www-data@a7c367c2113d:/var/www/html/dev/uploads$ sudo --version
bash: sudo: command not found

Glibc Version

www-data@a7c367c2113d:/var/www/html/dev/uploads$ ldd --version
ldd (Debian GLIBC 2.28-10) 2.28
Copyright (C) 2018 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

Interactive Graph View

Backlinks