InfoSec LAB

Weasel_Initial_Foothold_WIN-WSL

Created: 8 min read

System/Kernel

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ uname -a ; cat /etc/*release
Linux DEV-DATASCI-JUP 4.4.0-17763-Microsoft #2268-Microsoft Thu Oct 07 16:36:00 PST 2021 x86_64 x86_64 x86_64 GNU/Linux
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.4 LTS"
NAME="Ubuntu"
VERSION="20.04.4 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.4 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal
  • 4.4.0-17763-Microsoft
    • WSL
  • x86_64
  • Ubuntu 20.04.4 LTS (Focal Fossa)

Networks

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ ip route ; arp -a
none default via 10.10.0.1 dev eth0 proto unspec metric 0 
none 10.10.0.0/16 dev eth0 proto unspec metric 256 
none 10.10.232.68 dev eth0 proto unspec metric 256 
none 10.10.255.255 dev eth0 proto unspec metric 256 
none 169.254.169.123 via 10.60.0.1 dev eth0 proto unspec metric 15 
none 169.254.169.249 via 10.60.0.1 dev eth0 proto unspec metric 15 
none 169.254.169.250 via 10.60.0.1 dev eth0 proto unspec metric 15 
none 169.254.169.251 via 10.60.0.1 dev eth0 proto unspec metric 15 
none 169.254.169.253 via 10.60.0.1 dev eth0 proto unspec metric 15 
none 169.254.169.254 via 10.60.0.1 dev eth0 proto unspec metric 15 
none 224.0.0.0/4 dev eth0 proto unspec metric 256 
none 255.255.255.255 dev eth0 proto unspec metric 256 
none 127.0.0.0/8 dev lo proto unspec metric 256 
none 127.0.0.1 dev lo proto unspec metric 256 
none 127.255.255.255 dev lo proto unspec metric 256 
none 224.0.0.0/4 dev lo proto unspec metric 256 
none 255.255.255.255 dev lo proto unspec metric 256 
bash: line 10: arp: command not found
(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ netstat -antup
bash: line 13: netstat: command not found
ss -tunlp
Cannot open netlink socket: Protocol not supported
Cannot open netlink socket: Protocol not supported
Netid  State  Recv-Q  Send-Q   Local Address:Port   Peer Address:Port  Process

Users & Groups

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ cat /etc/passwd ; ls -lasht --color=auto /home
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
uuidd:x:107:112::/run/uuidd:/usr/sbin/nologin
tcpdump:x:108:113::/nonexistent:/usr/sbin/nologin
sshd:x:109:65534::/run/sshd:/usr/sbin/nologin
landscape:x:110:115::/var/lib/landscape:/usr/sbin/nologin
pollinate:x:111:1::/var/cache/pollinate:/bin/false
dev-datasci:x:1000:1000:,,,:/home/dev-datasci:/bin/bash
total 0
0 drwxr-xr-x 1 dev-datasci dev-datasci 4.0K Aug 25  2022 dev-datasci
0 drwxr-xr-x 1 root        root        4.0K Aug 25  2022 .
0 drwxr-xr-x 1 root        root        4.0K Aug 25  2022 ..
(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ cut -d: -f1 /etc/passwd | xargs -n1 id
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon) gid=1(daemon) groups=1(daemon)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=100(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=101(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=102(systemd-timesync) gid=104(systemd-timesync) groups=104(systemd-timesync)
uid=103(messagebus) gid=106(messagebus) groups=106(messagebus)
uid=104(syslog) gid=110(syslog) groups=110(syslog),4(adm),5(tty)
uid=105(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=106(tss) gid=111(tss) groups=111(tss)
uid=107(uuidd) gid=112(uuidd) groups=112(uuidd)
uid=108(tcpdump) gid=113(tcpdump) groups=113(tcpdump)
uid=109(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=110(landscape) gid=115(landscape) groups=115(landscape)
uid=111(pollinate) gid=1(daemon) groups=1(daemon)
uid=1000(dev-datasci) gid=1000(dev-datasci) groups=1000(dev-datasci),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),117(netdev)

uid=1000(dev-datasci) gid=1000(dev-datasci) groups=1000(dev-datasci),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),117(netdev)

SUIDs

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ find / -perm -04000 -ls -type f 2>/dev/null | grep -v '/snap'
281474976991394     56 -rwsr-sr-x   1 daemon   daemon      55560 Nov 12  2018 /usr/bin/at
281474976991410     16 -rwxr-sr-x   1 root     tty         14488 Mar 30  2020 /usr/bin/bsd-write
2814749767388047     84 -rwxr-sr-x   1 root     shadow      84512 Mar 14  2022 /usr/bin/chage
 281474976991514     44 -rwxr-sr-x   1 root     messagebus    43720 Feb 13  2020 /usr/bin/crontab
 844424930413567     32 -rwxr-sr-x   1 root     shadow        31312 Mar 14  2022 /usr/bin/expiry
 844424930544531     48 -rwxr-sr-x   1 root     mlocate       47344 Jul 16  2019 /usr/bin/mlocate
 562949953703161    344 -rwxr-sr-x   1 root     ssh          350504 Mar 30  2022 /usr/bin/ssh-agent
 281474976992264     36 -rwxr-sr-x   1 root     tty           35048 Feb  7  2022 /usr/bin/wall
 281474977003848     16 -rwxr-sr-x   1 root     utmp          14648 Sep 30  2019 /usr/lib/x86_64-linux-gnu/utempter/utempter
 281474977004000      0 drwxrwsr-x   1 root     staff          4096 Mar  8  2022 /usr/local/lib/python3.8
 281474977004001      0 drwxrwsr-x   1 root     staff          4096 Mar  8  2022 /usr/local/lib/python3.8/dist-packages
 281474977004006      0 drwxrwsr-x   1 root     staff          4096 Mar  8  2022 /usr/local/share/fonts
 281474977004250     44 -rwxr-sr-x   1 root     shadow        43168 Sep 16  2021 /usr/sbin/pam_extrausers_chkpwd
 281474977004324     44 -rwxr-sr-x   1 root     shadow        43160 Sep 16  2021 /usr/sbin/unix_chkpwd
 281474977030530      0 drwxrwsr-x   1 root     staff          4096 Apr 15  2020 /var/local
 281474977030541      0 drwxr-sr-x   1 root     systemd-journal     4096 Mar  8  2022 /var/log/journal
 281474977030546      0 drwxrwsr-x   1 root     mail                4096 Mar  8  2022 /var/mail

SGIDs

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ find / -perm -02000 -ls -type f 2>/dev/null | grep -v '/snap'
281474976991394     56 -rwsr-sr-x   1 daemon   daemon      55560 Nov 12  2018 /usr/bin/at
281474976991410     16 -rwxr-sr-x   1 root     tty         14488 Mar 30  2020 /usr/bin/bsd-write
2814749767388047     84 -rwxr-sr-x   1 root     shadow      84512 Mar 14  2022 /usr/bin/chage
 281474976991514     44 -rwxr-sr-x   1 root     messagebus    43720 Feb 13  2020 /usr/bin/crontab
 844424930413567     32 -rwxr-sr-x   1 root     shadow        31312 Mar 14  2022 /usr/bin/expiry
 844424930544531     48 -rwxr-sr-x   1 root     mlocate       47344 Jul 16  2019 /usr/bin/mlocate
 562949953703161    344 -rwxr-sr-x   1 root     ssh          350504 Mar 30  2022 /usr/bin/ssh-agent
 281474976992264     36 -rwxr-sr-x   1 root     tty           35048 Feb  7  2022 /usr/bin/wall
 281474977003848     16 -rwxr-sr-x   1 root     utmp          14648 Sep 30  2019 /usr/lib/x86_64-linux-gnu/utempter/utempter
 281474977004000      0 drwxrwsr-x   1 root     staff          4096 Mar  8  2022 /usr/local/lib/python3.8
 281474977004001      0 drwxrwsr-x   1 root     staff          4096 Mar  8  2022 /usr/local/lib/python3.8/dist-packages
 281474977004006      0 drwxrwsr-x   1 root     staff          4096 Mar  8  2022 /usr/local/share/fonts
 281474977004250     44 -rwxr-sr-x   1 root     shadow        43168 Sep 16  2021 /usr/sbin/pam_extrausers_chkpwd
 281474977004324     44 -rwxr-sr-x   1 root     shadow        43160 Sep 16  2021 /usr/sbin/unix_chkpwd
 281474977030530      0 drwxrwsr-x   1 root     staff          4096 Apr 15  2020 /var/local
 281474977030541      0 drwxr-sr-x   1 root     systemd-journal     4096 Mar  8  2022 /var/log/journal
 281474977030546      0 drwxrwsr-x   1 root     mail                4096 Mar  8  2022 /var/mail

N/A

Capabilities

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ getcap -r / 2>/dev/null
/usr/bin/mtr-packet = cap_net_raw+ep
/usr/bin/ping = cap_net_raw+ep
/usr/bin/traceroute6.iputils = cap_net_raw+ep
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep

Processes

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ ps -auxwww
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.0   8324   152 ?        Ss   04:20   0:00 /init
root         3  0.0  0.0   8324   152 tty1     Ss   04:20   0:00 /init
root         4  0.0  0.1  18924  2708 tty1     S    04:20   0:00 sudo /bin/su dev-datasci -c /home/dev-datasci/anaconda3/bin/jupyter notebook --config=/home/dev-datasci/.jupyter/jupyter_notebook_config.py --no-browser --notebook-dir=/home/dev-datasci/datasci-team/ &
root         5  0.0  0.1  18032  2096 tty1     S    04:20   0:00 /bin/su dev-datasci -c /home/dev-datasci/anaconda3/bin/jupyter notebook --config=/home/dev-datasci/.jupyter/jupyter_notebook_config.py --no-browser --notebook-dir=/home/dev-datasci/datasci-team/ &
dev-dat+     6  0.0  2.7 373756 57740 ?        Ssl  04:20   0:05 /home/dev-datasci/anaconda3/bin/python /home/dev-datasci/anaconda3/bin/jupyter-notebook --config=/home/dev-datasci/.jupyter/jupyter_notebook_config.py --no-browser --notebook-dir=/home/dev-datasci/datasci-team/
dev-dat+   287  0.2  2.0 670760 42488 ?        Ssl  06:11   0:00 /home/dev-datasci/anaconda3/bin/python -m ipykernel_launcher -f /home/dev-datasci/.local/share/jupyter/runtime/kernel-169b28b7-785f-447f-8b28-473ed481647c.json
dev-dat+   299  0.0  0.0  16664  1600 ?        S    06:11   0:00 bash
dev-dat+   302  0.0  0.3  24008  6756 ?        R    06:11   0:00 python3 -c import pty; pty.spawn("/bin/bash")
dev-dat+   303  0.0  0.1  17960  3512 pts/0    Ss   06:11   0:00 /bin/bash
dev-dat+   344  0.0  0.0  18900  2052 pts/0    R    06:18   0:00 ps -auxwww
  • root 4 0.0 0.1 18924 2708 tty1 S 04:20 0:00 sudo /bin/su dev-datasci -c /home/dev-datasci/anaconda3/bin/jupyter notebook --config=/home/dev-datasci/.jupyter/jupyter_notebook_config.py --no-browser --notebook-dir=/home/dev-datasci/datasci-team/ &

Cron & Systemd

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ crontab -l ; cat /etc/crontab ; systemctl list-timers
no crontab for dev-datasci
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.
 
SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
 
# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17 *	* * *	root    cd / && run-parts --report /etc/cron.hourly
25 6	* * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6	* * 7	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6	1 * *	root	test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
System has not been booted with systemd as init system (PID 1). Can't operate.
Failed to connect to bus: Host is down

Services

(base) dev-datasci@DEV-DATASCI-JUP:/dev/shm$ service --status-all
 [ - ]  apparmor
 [ ? ]  apport
 [ - ]  atd
 [ - ]  console-setup.sh
 [ - ]  cron
 [ ? ]  cryptdisks
 [ ? ]  cryptdisks-early
 [ - ]  dbus
 [ ? ]  hwclock.sh
 [ + ]  irqbalance
 [ - ]  iscsid
 [ - ]  keyboard-setup.sh
 [ - ]  kmod
 [ - ]  lvm2
 [ - ]  lvm2-lvmpolld
 [ - ]  multipath-tools
 [ + ]  open-iscsi
 [ - ]  open-vm-tools
 [ ? ]  plymouth
 [ ? ]  plymouth-log
 [ - ]  procps
 [ - ]  rsync
 [ - ]  rsyslog
 [ - ]  screen-cleanup
 [ - ]  ssh
 [ - ]  udev
 [ - ]  ufw
 [ - ]  unattended-upgrades
 [ - ]  uuidd
 [ - ]  x11-common

Sudo Version

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ sudo --version
Sudo version 1.8.31
Sudoers policy plugin version 1.8.31
Sudoers file grammar version 46
Sudoers I/O plugin version 1.8.31

Sudo version 1.8.31

Glibc Version

(base) dev-datasci@DEV-DATASCI-JUP:~/datasci-team$ ldd --version
ldd (Ubuntu GLIBC 2.31-0ubuntu9.9) 2.31
Copyright (C) 2020 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.

ldd (Ubuntu GLIBC 2.31-0ubuntu9.9) 2.31

Interactive Graph View

Backlinks