System/Kernel
www-data@mzeeav:/var/www/html/upload$ uname -a ; cat /etc/*release
Linux mzeeav 5.10.0-26-amd64 #1 SMP Debian 5.10.197-1 (2023-09-29) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"5.10.0-26-amd64x86_64Debian GNU/Linux 11 (bullseye)
Networks
www-data@mzeeav:/var/www/html/upload$ ip route ; arp -a
default via 192.168.190.254 dev ens192 onlink
192.168.190.0/24 dev ens192 proto kernel scope link src 192.168.190.33
? (192.168.190.254) at 00:50:56:9e:72:00 [ether] on ens192www-data@mzeeav:/var/www/html/upload$ netstat -antup
(Not all processes could be identified, non-owned process info
will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN -
tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN -
tcp 0 301 192.168.190.33:53752 192.168.45.249:9999 ESTABLISHED 1174/sh
tcp 0 0 192.168.190.33:80 192.168.45.249:36178 ESTABLISHED - Users & Groups
www-data@mzeeav:/var/www/html/upload$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:109::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
avuser:x:1001:1001::/home/avuser:/bin/sh
total 12K
4.0K drwxrwxr-x+ 2 avuser avuser 4.0K Nov 14 2023 avuser
4.0K drwxr-xr-x 3 root root 4.0K Nov 14 2023 .
4.0K drwxr-xr-x 18 root root 4.0K Nov 13 2023 ..avuser
www-data@mzeeav:/var/www/html/upload$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=101(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=102(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=103(messagebus) gid=109(messagebus) groups=109(messagebus)
uid=104(systemd-timesync) gid=110(systemd-timesync) groups=110(systemd-timesync)
uid=105(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)
uid=1001(avuser) gid=1001(avuser) groups=1001(avuser)uid=1001(avuser) gid=1001(avuser) groups=1001(avuser)
SUIDs
www-data@mzeeav:/var/www/html/upload$ find / -perm -04000 -ls -type f 2>/dev/null | grep -v '/snap'
130565 304 ---s--s--x 1 root root 311008 Nov 14 2023 /opt/fileS
136737 52 -rwsr-xr-- 1 root messagebus 51336 Jun 6 2023 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
136307 472 -rwsr-xr-x 1 root root 481608 Sep 23 2023 /usr/lib/openssh/ssh-keysign
652890 52 -rwsr-xr-x 1 root root 52880 Feb 7 2020 /usr/bin/chsh
652889 60 -rwsr-xr-x 1 root root 58416 Feb 7 2020 /usr/bin/chfn
664617 36 -rwsr-xr-x 1 root root 34896 Feb 26 2021 /usr/bin/fusermount
656361 44 -rwsr-xr-x 1 root root 44632 Feb 7 2020 /usr/bin/newgrp
656796 36 -rwsr-xr-x 1 root root 35040 Jan 20 2022 /usr/bin/umount
652893 64 -rwsr-xr-x 1 root root 63960 Feb 7 2020 /usr/bin/passwd
656505 72 -rwsr-xr-x 1 root root 71912 Jan 20 2022 /usr/bin/su
652892 88 -rwsr-xr-x 1 root root 88304 Feb 7 2020 /usr/bin/gpasswd
656794 56 -rwsr-xr-x 1 root root 55528 Jan 20 2022 /usr/bin/mount
653183 180 -rwsr-xr-x 1 root root 182600 Jan 14 2023 /usr/bin/sudo 130565 304 ---s--s--x 1 root root 311008 Nov 14 2023 /opt/fileS
SGIDs
www-data@mzeeav:/var/www/html/upload$ find / -perm -02000 -ls -type f 2>/dev/null | grep -v '/snap'
261355 4 drwxrwsr-x 2 root mail 4096 Jun 16 2022 /var/mail
261309 4 drwxrwsr-x 2 root staff 4096 Mar 19 2022 /var/local
261899 4 drwxr-sr-x 3 root systemd-journal 4096 Jun 16 2022 /var/log/journal
261177 4 drwxr-sr-x 2 root systemd-journal 4096 Apr 5 15:23 /var/log/journal/c71e29ed9c494834b5aab51454fe3ee0
130565 304 ---s--s--x 1 root root 311008 Nov 14 2023 /opt/fileS
652873 40 -rwxr-sr-x 1 root shadow 38912 Aug 26 2021 /usr/sbin/unix_chkpwd
660667 24 -rwxr-sr-x 1 root tty 22760 Jan 20 2022 /usr/bin/write.ul
652888 80 -rwxr-sr-x 1 root shadow 80256 Feb 7 2020 /usr/bin/chage
662575 24 -rwxr-sr-x 1 root mail 23040 Feb 4 2021 /usr/bin/dotlockfile
657970 44 -rwxr-sr-x 1 root crontab 43568 Feb 22 2021 /usr/bin/crontab
657613 348 -rwxr-sr-x 1 root ssh 354440 Sep 23 2023 /usr/bin/ssh-agent
654299 36 -rwxr-sr-x 1 root tty 35048 Jan 20 2022 /usr/bin/wall
652891 32 -rwxr-sr-x 1 root shadow 31160 Feb 7 2020 /usr/bin/expiry
342 0 drwxr-sr-x 2 root systemd-journal 40 Aug 2 2024 /run/log/journal 130565 304 ---s--s--x 1 root root 311008 Nov 14 2023 /opt/fileS
Capabilities
www-data@mzeeav:/var/www/html/upload$ getcap -r / 2>/dev/null
/usr/bin/ping cap_net_raw=epProcesses
www-data@mzeeav:/var/www/html/upload$ ps -auxwww
USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND
root 1 0.0 0.4 163804 10028 ? Ss 15:21 0:00 /sbin/init
root 218 0.0 0.9 64784 18192 ? Ss 15:21 0:00 /lib/systemd/systemd-journald
root 243 0.0 0.2 21720 5280 ? Ss 15:21 0:00 /lib/systemd/systemd-udevd
systemd+ 334 0.0 0.2 88436 6044 ? Ssl 15:21 0:00 /lib/systemd/systemd-timesyncd
root 336 0.0 0.5 47740 10296 ? Ss 15:21 0:00 /usr/bin/VGAuthService
root 338 0.0 0.5 236724 11664 ? Ssl 15:21 0:01 /usr/bin/vmtoolsd
root 445 0.0 0.1 6744 2724 ? Ss 15:21 0:00 /usr/sbin/cron -f
message+ 446 0.0 0.2 8272 4076 ? Ss 15:21 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root 454 0.0 0.2 13400 5456 ? Ss 15:21 0:00 /lib/systemd/systemd-logind
root 467 0.0 0.0 5844 1712 tty1 Ss+ 15:21 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root 500 0.0 0.3 13352 7596 ? Ss 15:21 0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root 600 0.0 0.3 220932 6456 ? Ssl 15:21 0:00 /usr/sbin/rsyslogd -n -iNONE
root 604 0.0 1.0 194040 20304 ? Ss 15:21 0:00 /usr/sbin/apache2 -k start
www-data 1005 0.0 0.6 194356 14044 ? S 15:31 0:00 /usr/sbin/apache2 -k start
www-data 1021 0.0 0.5 194620 11812 ? S 15:31 0:00 /usr/sbin/apache2 -k start
www-data 1026 22.0 0.8 194628 16968 ? S 15:31 8:31 /usr/sbin/apache2 -k start
www-data 1033 0.0 0.6 194620 14052 ? S 15:31 0:00 /usr/sbin/apache2 -k start
www-data 1037 0.0 0.7 194620 14572 ? S 15:32 0:00 /usr/sbin/apache2 -k start
www-data 1039 0.0 0.5 194356 11536 ? S 15:32 0:00 /usr/sbin/apache2 -k start
www-data 1042 0.0 0.5 194620 11808 ? S 15:32 0:00 /usr/sbin/apache2 -k start
www-data 1044 20.8 0.7 194356 14420 ? R 15:32 7:53 /usr/sbin/apache2 -k start
www-data 1049 0.0 0.5 194620 11816 ? S 15:33 0:00 /usr/sbin/apache2 -k start
www-data 1053 0.0 0.7 194628 14696 ? S 15:33 0:00 /usr/sbin/apache2 -k start
www-data 1174 0.0 0.0 2480 504 ? S 16:02 0:00 sh -c bash
www-data 1175 0.0 0.1 3896 2900 ? S 16:02 0:00 bash
www-data 1180 0.0 0.3 15196 7756 ? S 16:03 0:00 python3 -c import pty; pty.spawn("/bin/bash")
www-data 1181 0.0 0.1 7500 3688 pts/0 Ss 16:03 0:00 /bin/bash
www-data 1286 0.0 0.1 10280 3240 pts/0 R+ 16:10 0:00 ps -auxwwwroot 445 0.0 0.1 6744 2724 ? Ss 15:21 0:00 /usr/sbin/cron -f
Cron & Systemd
www-data@mzeeav:/var/www/html/upload$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
# Example of job definition:
# .---------------- minute (0 - 59)
# | .------------- hour (0 - 23)
# | | .---------- day of month (1 - 31)
# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...
# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# | | | | |
# * * * * * user-name command to be executed
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT LEFT LAST PASSED >
Sat 2025-04-05 16:39:00 EDT 27min left Sat 2025-04-05 16:09:29 EDT 1min 30s >
Sat 2025-04-05 16:44:12 EDT 33min left Tue 2023-12-12 22:34:50 EST 1 years 3>
Sat 2025-04-05 22:00:01 EDT 5h 49min left Tue 2023-11-14 22:23:41 EST 1 years 4>
Sun 2025-04-06 00:00:00 EDT 7h left Sat 2025-04-05 15:23:47 EDT 47min ago>
Sun 2025-04-06 00:00:00 EDT 7h left Sat 2025-04-05 15:23:47 EDT 47min ago>
Sun 2025-04-06 03:10:50 EDT 10h left Sat 2025-04-05 15:23:47 EDT 47min ago>
Sun 2025-04-06 06:16:55 EDT 14h left Sat 2025-04-05 15:40:05 EDT 30min ago>
Sun 2025-04-06 15:37:05 EDT 23h left Sat 2025-04-05 15:37:05 EDT 33min ago>
8 timers listed.
Pass --all to see loaded but inactive timers, too.Services
www-data@mzeeav:/var/www/html/upload$ systemctl list-units --state=running
UNIT LOAD ACTIVE SUB DESCRIPTION
proc-sys-fs-binfmt_misc.automount loaded active running Arbitrary Executable >
init.scope loaded active running System and Service Ma>
apache2.service loaded active running The Apache HTTP Server
cron.service loaded active running Regular background pr>
dbus.service loaded active running D-Bus System Message >
getty@tty1.service loaded active running Getty on tty1
open-vm-tools.service loaded active running Service for virtual m>
rsyslog.service loaded active running System Logging Service
ssh.service loaded active running OpenBSD Secure Shell >
systemd-journald.service loaded active running Journal Service
systemd-logind.service loaded active running User Login Management
systemd-timesyncd.service loaded active running Network Time Synchron>
systemd-udevd.service loaded active running Rule-based Manager fo>
vgauth.service loaded active running Authentication servic>
dbus.socket loaded active running D-Bus System Message >
syslog.socket loaded active running Syslog Socket
systemd-journald-audit.socket loaded active running Journal Audit Socket
systemd-journald-dev-log.socket loaded active running Journal Socket (/dev/>
systemd-journald.socket loaded active running Journal Socket
systemd-udevd-control.socket loaded active running udev Control Socket
systemd-udevd-kernel.socket loaded active running udev Kernel Socket
LOAD = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB = The low-level unit activation state, values depend on unit type.
21 loaded units listed.apache2.service
Sudo Version
www-data@mzeeav:/var/www/html/upload$ sudo --version
Sudo version 1.9.5p2
sudo: unable to resolve host mzeeav: Name or service not known
Sudoers policy plugin version 1.9.5p2
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.5p2
Sudoers audit plugin version 1.9.5p2Sudo version 1.9.5p2
Glibc Version
www-data@mzeeav:/var/www/html/upload$ ldd --version
ldd (Debian GLIBC 2.31-13+deb11u7) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions. There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.ldd (Debian GLIBC 2.31-13+deb11u7) 2.31