SysSec TP1

Task 1: Bash

nithoalif@debian:~$ echo hello world
hello world

nithoalif@debian:~$ passwd
Changing password for nithoalif.
Current password:
passwd: Authentication token manipulation error
passwd: password unchanged

nithoalif@debian:~$ date
Sat 28 Mar 2020 08:56:01 AM CET

nithoalif@debian:~$ hostname
debian

nithoalif@debian:~$ arch
x86_64

nithoalif@debian:~$ uname -a
Linux debian 4.19.0-8-amd64 #1 SMP Debian 4.19.98-1 (2020-01-26) x86_64 GNU/Linux

nithoalif@debian:~$ dmesg | more
dmesg: read kernel buffer failed: Operation not permitted

nithoalif@debian:~$ sudo dmesg | more
[sudo] password for nithoalif:
[    0.000000] Linux version 4.19.0-8-amd64 ([email protected]) (gcc version 8.3.0 (Debian 8.3.0-6)) #1 SMP Debian 4.19.98-1 (2020-01-26)
[    0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-4.19.0-8-amd64 root=UUID=cbb42dcc-6d41-4cab-bf18-a2821f8cd887 ro quiet
[    0.000000] x86/fpu: Supporting XSAVE feature 0x001: 'x87 floating point registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x002: 'SSE registers'
[    0.000000] x86/fpu: Supporting XSAVE feature 0x004: 'AVX registers'
[    0.000000] x86/fpu: xstate_offset[2]:  576, xstate_sizes[2]:  256
[    0.000000] x86/fpu: Enabled xstate features 0x7, context size is 832 bytes, using 'standard' format.
[    0.000000] BIOS-provided physical RAM map:
[    0.000000] BIOS-e820: [mem 0x0000000000000000-0x000000000009ffff] usable
[    0.000000] BIOS-e820: [mem 0x0000000000100000-0x000000007dd63fff] usable
...

nithoalif@debian:~$ uptime
 08:56:30 up 1 min,  1 user,  load average: 0.02, 0.01, 0.00

nithoalif@debian:~$ whoami
nithoalif

nithoalif@debian:~$ who
nithoalif pts/0        2020-03-28 08:55 (10.10.10.1)

nithoalif@debian:~$ id
uid=1000(nithoalif) gid=1000(nithoalif) groups=1000(nithoalif),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),101(systemd-journal),109(netdev),111(bluetooth)

nithoalif@debian:~$ last
nithoali pts/0        10.10.10.1       Sat Mar 28 08:55   still logged in
reboot   system boot  4.19.0-8-amd64   Sat Mar 28 08:55   still running
nithoali pts/1        10.10.10.1       Fri Mar  6 16:25 - 16:29  (00:04)
nithoali pts/0        10.10.10.1       Fri Mar  6 16:19 - 16:51  (00:32)
reboot   system boot  4.19.0-8-amd64   Fri Mar  6 16:18   still running
nithoali pts/0        10.10.10.1       Sun Mar  1 00:46 - 00:50  (00:04)
reboot   system boot  4.19.0-6-amd64   Sun Mar  1 00:45 - 00:50  (00:05)
nithoali pts/0        10.10.10.1       Fri Feb 21 17:17 - 17:17  (00:00)
reboot   system boot  4.19.0-6-amd64   Fri Feb 21 16:21 - 17:17  (00:55)
nithoali pts/0        10.10.10.1       Fri Feb 14 19:01 - 19:01  (00:00)
...

nithoalif@debian:~$ dioerujt
-bash: dioerujt: command not found

nithoalif@debian:~$ w
 08:56:46 up 1 min,  1 user,  load average: 0.02, 0.01, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
nithoali pts/0    10.10.10.1       08:55    6.00s  0.02s  0.00s w

nithoalif@debian:~$ top
top - 08:56:50 up 1 min,  1 user,  load average: 0.02, 0.01, 0.00
Tasks:  69 total,   1 running,  68 sleeping,   0 stopped,   0 zombie
%Cpu(s):  0.0 us,  0.0 sy,  0.0 ni,100.0 id,  0.0 wa,  0.0 hi,  0.0 si,  0.0 st
MiB Mem :   1982.7 total,   1855.2 free,     59.6 used,     67.9 buff/cache
MiB Swap:   1953.0 total,   1953.0 free,      0.0 used.   1814.1 avail Mem

  PID USER      PR  NI    VIRT    RES    SHR S  %CPU  %MEM     TIME+ COMMAND
    1 root      20   0  103680   9888   7872 S   0.0   0.5   0:00.59 systemd
    2 root      20   0       0      0      0 S   0.0   0.0   0:00.00 kthreadd
    3 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 rcu_gp
...

nithoalif@debian:~$ echo $SHELL
/bin/bash

nithoalif@debian:~$ echo {con,pre}{sent,fer}{s,ed}
consents consented confers confered presents presented prefers prefered

nithoalif@debian:~$ man "how to succeed"
No manual entry for how to succeed

nithoalif@debian:~$ man ls

nithoalif@debian:~$ man who

nithoalif@debian:~$ clear

nithoalif@debian:~$ cal 2000
                            2000
      January               February               March
Su Mo Tu We Th Fr Sa  Su Mo Tu We Th Fr Sa  Su Mo Tu We Th Fr Sa
                   1         1  2  3  4  5            1  2  3  4
 2  3  4  5  6  7  8   6  7  8  9 10 11 12   5  6  7  8  9 10 11
 9 10 11 12 13 14 15  13 14 15 16 17 18 19  12 13 14 15 16 17 18
16 17 18 19 20 21 22  20 21 22 23 24 25 26  19 20 21 22 23 24 25
23 24 25 26 27 28 29  27 28 29              26 27 28 29 30 31
30 31

...

nithoalif@debian:~$ cal 9 1752
   September 1752
Su Mo Tu We Th Fr Sa
       1  2 14 15 16
17 18 19 20 21 22 23
24 25 26 27 28 29 30

nithoalif@debian:~$ time sleep 5

real    0m5.005s
user    0m0.001s
sys     0m0.000s

nithoalif@debian:~$ history
    1  sudo systemctl disable remote-fs.target
    2  ping 1.1.1.1
    3  sudo systemctl reboot
    4  ping 1.1.1.1
    5  ip addr
    6  route -n
    7  ip route
    8  sudo nano /etc/network/interfaces
    9  sudo systemctl restart networking
   10  journalctl -x
...

Task 2: Filesystems

1. Try the following command sequence:

nithoalif@debian:~$ cd

nithoalif@debian:~$ pwd
/home/nithoalif

nithoalif@debian:~$ ls -al
total 32
drwxr-xr-x 4 nithoalif nithoalif 4096 Feb  1 20:42 .
drwxr-xr-x 3 root      root      4096 Mar 28 09:07 ..
-rw------- 1 nithoalif nithoalif 2726 Mar  6 16:51 .bash_history
-rw-r--r-- 1 nithoalif nithoalif  220 Feb  1 20:21 .bash_logout
-rw-r--r-- 1 nithoalif nithoalif 3526 Feb  1 20:21 .bashrc
drwx------ 4 nithoalif nithoalif 4096 Mar 28 08:56 .config
-rw-r--r-- 1 nithoalif nithoalif  807 Feb  1 20:21 .profile
drwx------ 2 nithoalif nithoalif 4096 Feb  1 20:27 .ssh

nithoalif@debian:~$ cd .

nithoalif@debian:~$ pwd # we are still in the /home/$USER directory
/home/nithoalif

nithoalif@debian:~$ cd ..

nithoalif@debian:/home$ pwd
/home

nithoalif@debian:/home$ ls -al
total 12
drwxr-xr-x  3 root      root      4096 Mar 28 09:07 .
drwxr-xr-x 18 root      root      4096 Mar  1 00:48 ..
drwxr-xr-x  4 nithoalif nithoalif 4096 Feb  1 20:42 nithoalif

nithoalif@debian:/home$ cd ..

nithoalif@debian:/$ pwd
/

nithoalif@debian:/$ ls -al
total 68
drwxr-xr-x 18 root root  4096 Mar  1 00:48 .
drwxr-xr-x 18 root root  4096 Mar  1 00:48 ..
lrwxrwxrwx  1 root root     7 Feb  1 20:15 bin -> usr/bin
drwxr-xr-x  4 root root  4096 Mar  1 00:49 boot
drwxr-xr-x 17 root root  3180 Mar 28 08:55 dev
drwxr-xr-x 65 root root  4096 Mar 28 09:07 etc
drwxr-xr-x  3 root root  4096 Mar 28 09:07 home
lrwxrwxrwx  1 root root    30 Mar  1 00:48 initrd.img -> boot/initrd.img-4.19.0-8-amd64
lrwxrwxrwx  1 root root    30 Feb  1 20:17 initrd.img.old -> boot/initrd.img-4.19.0-6-amd64
lrwxrwxrwx  1 root root     7 Feb  1 20:15 lib -> usr/lib
lrwxrwxrwx  1 root root     9 Feb  1 20:15 lib32 -> usr/lib32
lrwxrwxrwx  1 root root     9 Feb  1 20:15 lib64 -> usr/lib64
lrwxrwxrwx  1 root root    10 Feb  1 20:15 libx32 -> usr/libx32
drwx------  2 root root 16384 Feb  1 20:15 lost+found
drwxr-xr-x  3 root root  4096 Feb  1 20:15 media
drwxr-xr-x  2 root root  4096 Feb  1 20:15 mnt
drwxr-xr-x  2 root root  4096 Feb  1 20:15 opt
dr-xr-xr-x 75 root root     0 Mar 28 08:55 proc
drwx------  3 root root  4096 Feb  1 20:26 root
drwxr-xr-x 16 root root   500 Mar 28 08:55 run
lrwxrwxrwx  1 root root     8 Feb  1 20:15 sbin -> usr/sbin
drwxr-xr-x  2 root root  4096 Feb  1 20:15 srv
dr-xr-xr-x 13 root root     0 Mar 28 08:55 sys
drwxrwxrwt  7 root root  4096 Mar 28 09:05 tmp
drwxr-xr-x 13 root root  4096 Feb  1 20:15 usr
drwxr-xr-x 11 root root  4096 Feb  1 20:15 var
lrwxrwxrwx  1 root root    27 Mar  1 00:48 vmlinuz -> boot/vmlinuz-4.19.0-8-amd64
lrwxrwxrwx  1 root root    27 Feb  1 20:17 vmlinuz.old -> boot/vmlinuz-4.19.0-6-amd64

nithoalif@debian:/$ cd ..

nithoalif@debian:/$ pwd # we are in the root directory
/

nithoalif@debian:/$ cd /etc

nithoalif@debian:/etc$ ls -al | more
total 612
drwxr-xr-x 65 root root    4096 Mar 28 09:07 .
drwxr-xr-x 18 root root    4096 Mar  1 00:48 ..
-rw-r--r--  1 root root    2981 Feb  7 16:37 adduser.conf
-rw-r--r--  1 root root      44 Feb  1 20:21 adjtime
drwxr-xr-x  2 root root    4096 Feb  1 20:46 alternatives
-rw-r--r--  1 root root     401 May 19  2019 anacrontab
drwxr-xr-x  2 root root    4096 Feb  1 20:17 apparmor
drwxr-xr-x  7 root root    4096 Feb  1 20:23 apparmor.d
drwxr-xr-x  7 root root    4096 Feb  1 20:21 apt
...

nithoalif@debian:/etc$ cat passwd
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
...

nithoalif@debian:/etc$ cd -
/

nithoalif@debian:/$ pwd
/

2. Continue to explore the filesystem tree using cd, ls, pwd, and cat. Look in /bin, /usr/bin, /sbin, /etc, and /boot. What do you see?

nithoalif@debian:/$ ls -al bin
lrwxrwxrwx 1 root root 7 Feb  1 20:15 bin -> usr/bin

nithoalif@debian:/$ cd /bin

nithoalif@debian:/bin$ ls | head -n 10
[
aa-enabled
aa-exec
addpart
addr2line
apropos
apt
apt-cache
apt-cdrom
apt-config
...

nithoalif@debian:/$ cd /sbin

nithoalif@debian:/sbin$ ls | head -n 10
aa-remove-unknown
aa-status
aa-teardown
accessdb
addgnupghome
addgroup
add-shell
adduser
agetty
anacron

nithoalif@debian:/sbin$ cat /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point>   <type>  <options>       <dump>  <pass>
# / was on /dev/sda2 during installation
UUID=cbb42dcc-6d41-4cab-bf18-a2821f8cd887 /               ext4    errors=remount-ro 0       1
# /boot/efi was on /dev/sda1 during installation
UUID=E514-8677  /boot/efi       vfat    umask=0077      0       1
# swap was on /dev/sda3 during installation
UUID=1a6e2417-dd1b-47c4-a7bb-5f422207b5a4 none            swap    sw              0       0
/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0

3. Display the type of files for /etc/passwd, /usr/include/stdio.h, and /bin/ls.

1
2
3
4
5
6
7
8
nithoalif@debian:/$ file /etc/passwd
/etc/passwd: ASCII text

nithoalif@debian:/$ file /usr/include/stdio.h
/usr/include/stdio.h: C source, ASCII text

nithoalif@debian:/$ file /bin/ls
/bin/ls: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=a65f86cd6394e8f583c14d786d13b3bcbe051b87, stripped

4. Explore /proc. Display the contents of the files interrupts, devices, cpuinfo, meminfo, and uptime. Can you see why we say /proc is a pseudofilesystem, that allows access to kernel data?

nithoalif@debian:/proc$ cat interrupts | head -n 10
           CPU0
  0:         30   IO-APIC   2-edge      timer
  1:          9   IO-APIC   1-edge      i8042
  8:          0   IO-APIC   8-edge      rtc0
  9:         13   IO-APIC   9-fasteoi   acpi
 12:        156   IO-APIC  12-edge      i8042
 14:          0   IO-APIC  14-edge      ata_piix
 15:       5347   IO-APIC  15-edge      ata_piix
 16:      20588   IO-APIC  16-fasteoi   enp0s8
 18:          2   IO-APIC  18-fasteoi   vmwgfx

nithoalif@debian:/proc$ cat interrupts | head -n ^C

nithoalif@debian:/proc$ cat devices | head -n 10
Character devices:
  1 mem
  4 /dev/vc/0
  4 tty
  4 ttyS
  5 /dev/tty
  5 /dev/console
  5 /dev/ptmx
  7 vcs
 10 misc

nithoalif@debian:/proc$ cat cpuinfo | head -n 10
processor       : 0
vendor_id       : GenuineIntel
cpu family      : 6
model           : 158
model name      : Intel(R) Core(TM) i7-8750H CPU @ 2.20GHz
stepping        : 10
cpu MHz         : 2207.998
cache size      : 9216 KB
physical id     : 0
siblings        : 1

nithoalif@debian:/proc$ cat meminfo | head -n 10
MemTotal:        2030240 kB
MemFree:         1418056 kB
MemAvailable:    1808236 kB
Buffers:           29480 kB
Cached:           472952 kB
SwapCached:            0 kB
Active:           101908 kB
Inactive:         413568 kB
Active(anon):      13264 kB
Inactive(anon):     2748 kB

nithoalif@debian:/proc$ cat uptime
5318.15 5268.22

# yes, `/proc` is a virtual/pseudo filesystem that is exposed by the kernel. It allows us to access the kernel data on the fly.

5. Use grep to isolate the line in /etc/passwd that contains your login details.

nithoalif@debian:/$ grep -i 'nitho' /etc/passwd
nithoalif:x:1000:1000:Nitho Alif Ibadurrahman,,,:/home/nithoalif:/bin/bash

Task 3: vi

Create a document and type in the following paragraph:

1
2
3
4
5
Joined the librarey. Got Care of the Skin, Origin of the Species, and a
book by a woman my mothere is always going on about. It is called Pride
and Prejudice Prejudice, by a womanne called Jane Austen. I could tell
the librarian was impressed. Perhaps she is an intellectual like me. She
didn't look at my spot, so perhaps it is getting smaller.
1
2
3
4
5
nithoalif@debian:~$ vi doc.txt
# press `a` to enter append mode
# copy & paste the text (ctrl+c, ctrl+shift+v)
# press `esc` to exit append mode
# press `:w` and `enter` to save file

1. Correct the three spelling errors in the first three lines of the first paragraph (one error perline) and remove the extra " Prejudice " in the 3 rd line.

1
2
3
4
nithoalif@debian:~$ vi doc.txt
# use arrow key to navigate to the typo characters
# press `x` to delete a character
# key combination `dw` can also be used to delete a word starting from the cursor position 

2. Add the words "About time!" to the end of the paragraph.

1
2
3
4
nithoalif@debian:~$ vi doc.txt
# use arrow key to navigate to the end of the paragraph
# press `a` to enter append mode
# insert the desired text

3. Delete the sentence "Perhaps she is an intellectual like me" and re-form the phrase (use your hidden literary talent).

1
2
3
4
5
nithoalif@debian:~$ vi doc.txt
# use arrow key to navigate to the charter `P` in the to-be-deleted sentence
# press key combination `d7w` to delete 7 words
# press `i` to enter insert mode
# insert the desired text

4. Replace all occurrences of "is" with "was".

1
2
3
nithoalif@debian:~$ vi doc.txt
# press `:%s/is/was/g` and `enter` to replace all `is` occurence with `was`
# press `:wq` and `enter` to save and exit
1
2
3
4
5
6
nithoalif@debian:~$ cat doc.txt
Joined the library. Got Care of the Skin, Origin of the Species, and a
book by a woman my mother was always going on about. It was called Pride
and Prejudice Prejudice, by a woman called Jane Austen. I could tell
the librarian was impressed. This is another sentence. She
didn't look at my spot, so perhaps it was getting smaller. About time!

Task 3: Pipes and redirections

1. Use ls and grep to display the files in /bin whose name:

  • Starts with "a" and the second letter is either "s" or "t".
    nithoalif@debian:/bin$ ls | grep -E '^a(s|t).*'
    as
    
  • Starts with "un" and ends with "t".
    nithoalif@debian:/bin$ ls | grep -E '^un.*t$'
    unicode_start
    
  • Contains "gre" or "st".
    nithoalif@debian:/bin$ ls | grep -E '(gre|st)'
    bzegrep
    bzfgrep
    bzgrep
    corelist
    ctstat
    debconf-apt-progress
    deb-systemd-helper
    deb-systemd-invoke
    dpkg-distaddfile
    dpkg-statoverride
    ...
    
  • Contains exactly two "m".
    ## YOUR EXERCISE
    
  • Contains at least 4 characters and one digit.
    ## YOUR EXERCISE
    
  • Is of length 2.
    nithoalif@debian:/bin$ ls | grep -E '^..$'
    ar
    as
    cc
    cp
    dd
    df
    du
    ex
    hd
    id
    ...
    

2. Create a file in which each line starts with by a number, followed by a slash (/) and some few words.

1
2
3
4
5
nithoalif@debian:~$ cat test.txt
9927279423/aaaaasd asdasda asdada
8230948209/jdadad asda
2304802/xsdad adada
938232892/mqeqmqeqm eqeqqe
  • Display the line of this file sorted.
    1
    2
    3
    4
    5
    nithoalif@debian:~$ sort -n test.txt
    2304802/xsdad adada
    938232892/mqeqmqeqm eqeqqe
    8230948209/jdadad asda
    9927279423/aaaaasd asdasda asdada
    
  • Display the lines while removing the number and the slash.
    1
    2
    3
    4
    5
    nithoalif@debian:~$ cut -d "/" -f 2 test.txt
    aaaaasd asdasda asdada
    jdadad asda
    xsdad adada
    mqeqmqeqm eqeqqe
    
  • Sort the lines alphabetically without x/.
    1
    2
    3
    4
    5
    nithoalif@debian:~$ cut -d "/" -f 2 test.txt | sort
    aaaaasd asdasda asdada
    jdadad asda
    mqeqmqeqm eqeqqe
    xsdad adada
    

3. How many configuration files (in /etc) do you have?

1
2
3
4
5
nithoalif@debian:/etc$ ls -p | grep -v '/$' | wc -l # top level files
73

nithoalif@debian:/etc$ ls -p -R | grep -v '/$' | wc -l # all files recursively
859

4. How many directories do contain /etc ?

1
2
3
4
5
nithoalif@debian:/etc$ ls -p | grep '/$' | wc -l # top level directory
65

nithoalif@debian:/etc$ ls -p -R | grep '/$' | wc -l # all directory recursively
131

5. How many words do contain the man page of cp the word “file”?

nithoalif@debian:~$ man cp | grep -c 'file'
18

6. What are the ten biggest files in /usr/bin?

nithoalif@debian:/usr/bin$ du -b * | sort -r -n | head -n 10
4877888 python3.7
3197768 perl
3113472 x86_64-linux-gnu-ld.gold
2876160 x86_64-linux-gnu-dwp
1785032 x86_64-linux-gnu-ld.bfd
1448248 systemd-analyze
1200696 vim.tiny
1168776 bash
1104760 x86_64-linux-gnu-g++-8
1104760 x86_64-linux-gnu-cpp-8

7. For each line in the file /etc/hosts:

1
2
3
4
5
6
7
8
nithoalif@debian:~$ cat /etc/hosts
127.0.0.1       localhost
127.0.1.1       debian

# The following lines are desirable for IPv6 capable hosts
::1     localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
  • Display the 5th character.
    1
    2
    3
    4
    5
    6
    7
    8
    nithoalif@debian:~$ cut -c5 /etc/hosts
    0
    0
    
    e
    
    :
    :
    
  • Display all characters after the 15th.
    1
    2
    3
    4
    5
    6
    7
    8
    nithoalif@debian:~$ cut -c15- /etc/hosts
    lhost
    an
    
    g lines are desirable for IPv6 capable hosts
    ost ip6-localhost ip6-loopback
    lnodes
    lrouters
    
  • Display the 5-10 characters, and the 13th one.
    1
    2
    3
    4
    5
    6
    7
    8
    nithoalif@debian:~$ cut -c5-10,13 /etc/hosts
    0.0.1   c
    0.1.1   b
    
    e folli
        lol
    ::1 ipa
    ::2 ipa
    

8. Use find to display the names of all files in the /home subdirectory tree. Can you do this without displaying errors for files you cannot read?

[nithoalif@centos home]$ find
.
./nithoalif
./nithoalif/.bash_logout
./nithoalif/.bash_profile
./nithoalif/.bashrc
./nithoalif/.config
./nithoalif/.config/htop
./nithoalif/.config/htop/htoprc
./nithoalif/.bash_history
./nithoalif/.ssh
./nithoalif/.ssh/authorized_keys
./charlie
find: ‘./charlie’: Permission denied

[nithoalif@centos home]$ find 2> /dev/null
.
./nithoalif
./nithoalif/.bash_logout
./nithoalif/.bash_profile
./nithoalif/.bashrc
./nithoalif/.config
./nithoalif/.config/htop
./nithoalif/.config/htop/htoprc
./nithoalif/.bash_history
./nithoalif/.ssh
./nithoalif/.ssh/authorized_keys
./charlie
Edit

Pub: 28 Mar 2020 15:25 UTC

Edit: 28 Mar 2020 15:32 UTC

Views: 70