enum

1. 1

   webdevs priv and env 用户的权限情况

   1
   webdev@coldstart:~$ id
   2
   uid=1001(webdev) gid=1001(webdev) groups=1001(webdev)
   3
   webdev@coldstart:~$ groups
   4
   webdev
   5
   webdev@coldstart:~$ env
   6
   SHELL=/bin/bash
   7
   PWD=/home/webdev
   8
   LOGNAME=webdev
   9
   XDG_SESSION_TYPE=tty
   10
   HOME=/home/webdev
   11
   LANG=C.UTF-8
   12
   LS_COLORS=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=00:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.avif=01;35:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.webp=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:*~=00;90:*#=00;90:*.bak=00;90:*.crdownload=00;90:*.dpkg-dist=00;90:*.dpkg-new=00;90:*.dpkg-old=00;90:*.dpkg-tmp=00;90:*.old=00;90:*.orig=00;90:*.part=00;90:*.rej=00;90:*.rpmnew=00;90:*.rpmorig=00;90:*.rpmsave=00;90:*.swp=00;90:*.tmp=00;90:*.ucf-dist=00;90:*.ucf-new=00;90:*.ucf-old=00;90:
   13
   SSH_CONNECTION=10.64.97.72 40908 10.64.188.6 22
   14
   LESSCLOSE=/usr/bin/lesspipe %s %s
   15
   XDG_SESSION_CLASS=user
   16
   TERM=xterm-256color
   17
   LESSOPEN=| /usr/bin/lesspipe %s
   18
   USER=webdev
   19
   SHLVL=1
   20
   XDG_SESSION_ID=46
   21
   XDG_RUNTIME_DIR=/run/user/1001
   22
   SSH_CLIENT=10.64.97.72 40908 22
   23
   XDG_DATA_DIRS=/usr/local/share:/usr/share:/var/lib/snapd/desktop
   24
   PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
   25
   DBUS_SESSION_BUS_ADDRESS=unix:path=/run/user/1001/bus
   26
   SSH_TTY=/dev/pts/0
   27
   _=/usr/bin/env

   sudo: 没有 sudo 权限

   1
   webdev@coldstart:~$ sudo -l
   2
   [sudo] password for webdev:
   3
   Sorry, user webdev may not run sudo on coldstart.

   writeable:

   1
   webdev@coldstart:~$ find / -writable -ls 2>/dev/null|grep -v home|grep -v proc|grep -v snap|grep dev|grep -v sys|grep -v '/dev'|grep -v run
   2
   524667      4 drwxrwx---   2 webdev           webdev               4096 May  9 23:14 /opt/backups
   3
   524668      4 -rw-r--r--   1 webdev           webdev                 12 May  9 23:14 /opt/backups/.keep

2. 2

   machine info Users:

   1
   webdev@coldstart:~$ cat /etc/passwd|grep 'sh$'
   2
   root:x:0:0:root:/root:/bin/bash
   3
   ubuntu:x:1000:1000:Ubuntu:/home/ubuntu:/bin/bash
   4
   webdev:x:1001:1001::/home/webdev:/bin/bash

   除去 webdev 还有一个有 bash 设置的非 root 用户

   conrtab

   1
   webdev@coldstart:~$ cat /etc/crontab
   2
   # /etc/crontab: system-wide crontab
   3
   # Unlike any other crontab you don't have to run the `crontab'
   4
   # command to install the new version when you edit this file
   5
   # and files in /etc/cron.d. These files also have username fields,
   6
   # that none of the other crontabs do.
   7
   
   8
   SHELL=/bin/sh
   9
   # You can also override PATH, but by default, newer versions inherit it from the environment
   10
   #PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
   11
   
   12
   # Example of job definition:
   13
   # .---------------- minute (0 - 59)
   14
   # |  .------------- hour (0 - 23)
   15
   # |  |  .---------- day of month (1 - 31)
   16
   # |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
   17
   # |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
   18
   # |  |  |  |  |
   19
   # *  *  *  *  * user-name command to be executed
   20
   17 *  * * *  root  cd / && run-parts --report /etc/cron.hourly
   21
   25 6  * * *  root  test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; }
   22
   47 6  * * 7  root  test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; }
   23
   52 6  1 * *  root  test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; }
   24
   #
   25
   webdev@coldstart:~$ ls /etc/cron*
   26
   /etc/crontab
   27
   /etc/cron.d:
   28
   e2scrub_all  sysstat  voltlabs-backup
   29
   /etc/cron.daily:
   30
   apport  apt-compat  bsdmainutils.dpkg-remove  dpkg  logrotate  man-db  sysstat
   31
   /etc/cron.hourly:
   32
   /etc/cron.monthly:
   33
   /etc/cron.weekly:
   34
   man-db
   35
   /etc/cron.yearly:

   有一个有趣的计划任务: voltlabs-backup, 以 root 权限每分钟执行的计划任务

   1
   webdev@coldstart:~$ cat  /etc/cron.d/voltlabs-backup
   2
   # Volt Labs staging backup - runs as root
   3
   SHELL=/bin/bash
   4
   PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
   5
   
   6
   * * * * * root cd /opt/backups && tar czf /var/backups/uploads.tgz *

   Service-Timer: 没啥有趣的

   1
   webdev@coldstart:~$ systemctl list-timers
   2
   NEXT                            LEFT LAST                             PASSED UNIT                           ACTIVATES
   3
   Sun 2026-09-13 02:51:44 UTC    13min Wed 2026-05-20 09:47:01 UTC           - fstrim.timer                   fstrim.service
   4
   Sun 2026-09-13 03:10:57 UTC    32min Sun 2026-09-13 01:32:58 UTC 1h 5min ago e2scrub_all.timer              e2scrub_all.service
   5
   Sun 2026-09-13 05:04:31 UTC 2h 26min Thu 2026-05-14 01:50:51 UTC           - apt-daily.timer                apt-daily.service
   6
   Sun 2026-09-13 06:14:28 UTC 3h 36min Sun 2026-09-13 02:27:26 UTC   10min ago apt-daily-upgrade.timer        apt-daily-upgrade.service
   7
   Sun 2026-09-13 08:15:50 UTC 5h 37min Wed 2026-05-13 10:40:01 UTC           - man-db.timer                   man-db.service
   8
   Sun 2026-09-13 10:47:38 UTC       8h Thu 2026-05-14 03:34:46 UTC           - motd-news.timer                motd-news.service
   9
   Mon 2026-09-14 00:00:00 UTC      21h Sun 2026-09-13 01:32:48 UTC 1h 5min ago dpkg-db-backup.timer           dpkg-db-backup.service
   10
   Mon 2026-09-14 00:00:00 UTC      21h Sun 2026-09-13 01:32:48 UTC 1h 5min ago logrotate.timer                logrotate.service
   11
   Mon 2026-09-14 01:37:40 UTC      22h Sun 2026-09-13 01:37:40 UTC 1h 0min ago update-notifier-download.timer update-notifier-download.service
   12
   Mon 2026-09-14 01:47:40 UTC      23h Sun 2026-09-13 01:47:40 UTC   50min ago systemd-tmpfiles-clean.timer   systemd-tmpfiles-clean.service
   13
   Sat 2026-09-19 21:14:50 UTC   6 days Wed 2026-05-13 09:25:51 UTC           - update-notifier-motd.timer     update-notifier-motd.service
   14
   
   15
   11 timers listed.
   16
   Pass --all to see loaded but inactive timers, too.

   process: 也没啥有趣的

   1
   voltapp      714     613  0 01:32 ?        00:00:22 /opt/voltlabs-preview/venv/bin/python3 /opt/voltlabs-preview/venv/bin/gunicorn -w 2 -b 0.0.0.0:80 app:app
   2
   voltapp      721     613  0 01:32 ?        00:00:22 /opt/voltlabs-preview/venv/bin/python3 /opt/voltlabs-preview/venv/bin/gunicorn -w 2 -b 0.0.0.0:80 app:app

3. 3

   Network 本机的网络设置:

   1
   webdev@coldstart:~$ ip a
   2
   1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
   3
       link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
   4
       inet 127.0.0.1/8 scope host lo
   5
          valid_lft forever preferred_lft forever
   6
       inet6 ::1/128 scope host noprefixroute
   7
          valid_lft forever preferred_lft forever
   8
   2: ens5: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 9001 qdisc mq state UP group default qlen 1000
   9
       link/ether 0a:ff:dd:e8:6a:fd brd ff:ff:ff:ff:ff:ff
   10
       altname enp0s5
   11
       inet 10.64.188.6/18 metric 100 brd 10.64.191.255 scope global dynamic ens5
   12
         valid_lft 2083sec preferred_lft 2083sec
   13
       inet6 fe80::8ff:ddff:fee8:6afd/64 scope link
   14
         valid_lft forever preferred_lft forever
   15
   webdev@coldstart:~$ ss -lntp
   16
   State                     Recv-Q                     Send-Q                                         Local Address:Port                                         Peer Address:Port                    Process
   17
   LISTEN                    0                          4096                                              127.0.0.54:53                                                0.0.0.0:*
   18
   LISTEN                    0                          4096                                                 0.0.0.0:22                                                0.0.0.0:*
   19
   LISTEN                    0                          32                                                   0.0.0.0:21                                                0.0.0.0:*
   20
   LISTEN                    0                          4096                                           127.0.0.53%lo:53                                                0.0.0.0:*
   21
   LISTEN                    0                          2048                                                 0.0.0.0:80                                                0.0.0.0:*
   22
   LISTEN                    0                          4096                                                    [::]:22                                                   [::]:*

   就一张网卡, 没有有趣的内部端口

4. 4

   privfile Suid: 没啥有趣的.

   1
   webdev@coldstart:~$ find / -type f -perm -04000 -ls 2>/dev/null
   2
   14580     36 -rwsr-xr--   1 root     messagebus         34960 Aug  9  2024 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
   3
   18107    336 -rwsr-xr-x   1 root     root              342632 Apr 28 00:29 /usr/lib/openssh/ssh-keysign
   4
   518279     20 -rwsr-xr-x   1 root     root               18736 Apr 10 10:57 /usr/lib/polkit-1/polkit-agent-helper-1
   5
    4587     72 -rwsr-xr-x   1 root     root               72792 May 30  2024 /usr/bin/chfn
   6
    8485    272 -rwsr-xr-x   1 root     root              277936 Mar  2  2026 /usr/bin/sudo
   7
    9153     40 -rwsr-xr-x   1 root     root               39296 Mar  6  2026 /usr/bin/umount
   8
    4695     64 -rwsr-xr-x   1 root     root               64152 May 30  2024 /usr/bin/passwd
   9
    4679     76 -rwsr-xr-x   1 root     root               76248 May 30  2024 /usr/bin/gpasswd
   10
    1573     40 -rwsr-xr-x   1 root     root               40664 May 30  2024 /usr/bin/newgrp
   11
    4589     44 -rwsr-xr-x   1 root     root               44760 May 30  2024 /usr/bin/chsh
   12
   13682     40 -rwsr-xr-x   1 root     root               39296 Apr  8  2024 /usr/bin/fusermount3
   13
    8197     56 -rwsr-xr-x   1 root     root               55680 Mar  6  2026 /usr/bin/su
   14
    9150     52 -rwsr-xr-x   1 root     root               51584 Mar  6  2026 /usr/bin/mount
   15
   ...

   Cap: 没啥有趣的

   1
   webdev@coldstart:~$ getcap -r / 2>/dev/null
   2
   /snap/core20/2379/usr/bin/ping cap_net_raw=ep
   3
   /snap/core20/2866/usr/bin/ping cap_net_raw=ep
   4
   /snap/core22/2411/usr/bin/ping cap_net_raw=ep
   5
   /snap/core22/1621/usr/bin/ping cap_net_raw=ep
   6
   /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin,cap_sys_nice=ep
   7
   /usr/lib/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin,cap_sys_resource=p
   8
   /usr/bin/mtr-packet cap_net_raw=ep
   9
   /usr/bin/ping cap_net_raw=ep