▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄ ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄ ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄ ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄  ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄ ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄ ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄ ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄ ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄ ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄ ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄ ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀ ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀ ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀ /---------------------------------------------------------------------------------\ | Do you like PEASS? | |---------------------------------------------------------------------------------| | Linux PE & Hardening : https://hacktricks-training.com/courses/lhe/ | | Learn Cloud Hacking : https://training.hacktricks.xyz  | | Follow on Twitter : @hacktricks_live | | Respect on HTB : SirBroccoli  | |---------------------------------------------------------------------------------| | Thank you!  | \---------------------------------------------------------------------------------/  LinPEAS-ng by carlospolop  ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.  Linux Privesc Checklist: https://book.hacktricks.wiki/en/linux-hardening/linux-privilege-escalation-checklist.html Best Linux PE & Hardening course: https://hacktricks-training.com/courses/lhe/  LEGEND: RED/YELLOW: 95% a PE vector RED: You should take a look into it LightCyan: Users with console Blue: Users without console & mounted devs Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) LightMagenta: Your username Starting LinPEAS. Caching Writable Folders...  ╔═══════════════════╗ ═══════════════════════════════╣ Basic information ╠═══════════════════════════════  ╚═══════════════════╝ OS: Linux version 6.8.0-49-generic (buildd@lcy02-amd64-028) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.2.0-23ubuntu4) 13.2.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #49-Ubuntu SMP PREEMPT_DYNAMIC Mon Nov 4 02:06:24 UTC 2024 User & Groups: uid=1006(abaone) gid=1007(abaone) groups=1007(abaone) Hostname: web Remember that you can use the '-t' option to call the Internet connectivity checks and automatic network recon! [+] /usr/bin/ping is available for network discovery (LinPEAS can discover hosts, learn more with -h) [+] /usr/bin/bash is available for network discovery, port scanning and port forwarding (LinPEAS can discover hosts, scan ports, and forward ports. Learn more with -h) [+] /usr/bin/nc is available for network discovery & port scanning (LinPEAS can discover hosts and scan ports, learn more with -h)  Caching directories DONE   ╔════════════════════╗ ══════════════════════════════╣ System Information ╠══════════════════════════════  ╚════════════════════╝ ╔══════════╣ Operative system (T1082) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#kernel-exploits Linux version 6.8.0-49-generic (buildd@lcy02-amd64-028) (x86_64-linux-gnu-gcc-13 (Ubuntu 13.2.0-23ubuntu4) 13.2.0, GNU ld (GNU Binutils for Ubuntu) 2.42) #49-Ubuntu SMP PREEMPT_DYNAMIC Mon Nov 4 02:06:24 UTC 2024 Distributor ID: Ubuntu Description: Ubuntu 24.04.3 LTS Release: 24.04 Codename: noble ╔══════════╣ Sudo version (T1548.003,T1068) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-version Sudo version 1.9.15p5 ╔══════════╣ PATH (T1574.007) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-path-abuses /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin ╔══════════╣ Date & uptime (T1082) Wed Sep 2 09:35:35 CEST 2026 09:35:35 up 345 days, 10:18, 4 users, load average: 0.23, 0.06, 0.02 ╔══════════╣ CPU info (T1082) Architecture: x86_64 CPU op-mode(s): 32-bit, 64-bit Address sizes: 52 bits physical, 57 bits virtual Byte Order: Little Endian CPU(s): 4 On-line CPU(s) list: 0-3 Vendor ID: AuthenticAMD Model name: AMD EPYC 9634 84-Core Processor CPU family: 25 Model: 17 Thread(s) per core: 1 Core(s) per socket: 4 Socket(s): 1 Stepping: 1 BogoMIPS: 4493.24 Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 ht syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm rep_good nopl cpuid extd_apicid tsc_known_freq pni pclmulqdq ssse3 fma cx16 pcid sse4_1 sse4_2 x2apic movbe popcnt tsc_deadline_timer aes xsave avx f16c rdrand hypervisor lahf_lm cmp_legacy cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw perfctr_core ssbd perfmon_v2 ibrs ibpb stibp ibrs_enhanced vmmcall fsgsbase tsc_adjust bmi1 avx2 smep bmi2 erms invpcid avx512f avx512dq rdseed adx smap avx512ifma clflushopt clwb avx512cd sha_ni avx512bw avx512vl xsaveopt xsavec xgetbv1 xsaves avx512_bf16 clzero xsaveerptr wbnoinvd arat avx512vbmi umip pku ospke avx512_vbmi2 gfni vaes vpclmulqdq avx512_vnni avx512_bitalg avx512_vpopcntdq la57 rdpid overflow_recov succor fsrm flush_l1d arch_capabilities Hypervisor vendor: KVM Virtualization type: full L1d cache: 256 KiB (4 instances) L1i cache: 256 KiB (4 instances) L2 cache: 2 MiB (4 instances) L3 cache: 64 MiB (4 instances) NUMA node(s): 1 NUMA node0 CPU(s): 0-3 Vulnerability Gather data sampling: Not affected Vulnerability Itlb multihit: Not affected Vulnerability L1tf: Not affected Vulnerability Mds: Not affected Vulnerability Meltdown: Not affected Vulnerability Mmio stale data: Not affected Vulnerability Reg file data sampling: Not affected Vulnerability Retbleed: Not affected Vulnerability Spec rstack overflow: Mitigation; Safe RET Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization Vulnerability Spectre v2: Mitigation; Enhanced / Automatic IBRS; IBPB conditional; STIBP disabled; RSB filling; PBRSB-eIBRS Not affected; BHI Not affected Vulnerability Srbds: Not affected Vulnerability Tsx async abort: Not affected ╔══════════╣ Unmounted file-system? (T1082,T1120) ╚ Check if you can mount umounted devices /dev/disk/by-uuid/0fc616ed-02e9-4dcb-a228-4886f310e501 / ext4 defaults 0 1 /dev/disk/by-uuid/e5990cea-1d17-47f1-b1f8-100820d9bfb5 /boot ext4 defaults 0 1 ╔══════════╣ Any sd*/disk* disk in /dev? (limit 20) (T1082) disk ╔══════════╣ System stats (T1082) Filesystem Size Used Avail Use% Mounted on tmpfs 795M 1.2M 793M 1% /run /dev/vda3 503G 22G 462G 5% / tmpfs 3.9G 0 3.9G 0% /dev/shm tmpfs 5.0M 0 5.0M 0% /run/lock /dev/vda2 974M 291M 616M 33% /boot tmpfs 795M 12K 795M 1% /run/user/1016 total used free shared buff/cache available Mem: 8130924 2469936 291240 233160 6052736 5660988 Swap: 2097148 569484 1527664 ╔══════════╣ Inode usage (T1082) Filesystem Inodes IUsed IFree IUse% Mounted on tmpfs 1016365 778 1015587 1% /run /dev/vda3 33488896 622134 32866762 2% / tmpfs 1016365 1 1016364 1% /dev/shm tmpfs 1016365 3 1016362 1% /run/lock /dev/vda2 65536 325 65211 1% /boot tmpfs 203273 32 203241 1% /run/user/1016 ╔══════════╣ Environment (T1082,T1552.007) ╚ Any private information inside environment variables? PWD=/home/abaone/htdocs/abaone.ch/media/com_sppagebuilder/assets/iconfont/ico5x4tov/fonts HOME=/home/abaone USER=abaone SHLVL=1 _=/usr/bin/env ╔══════════╣ Searching Signature verification failed in dmesg (T1082) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#dmesg-signature-verification-failed dmesg Not Found  ╔══════════╣ Protections (T1518.001) ═╣ AppArmor enabled? .............. You do not have enough privilege to read the profile set. apparmor module is loaded. ═╣ AppArmor profile? .............. unconfined ═╣ is linuxONE? ................... s390x Not Found ═╣ grsecurity present? ............ grsecurity Not Found ═╣ PaX bins present? .............. PaX Not Found ═╣ Execshield enabled? ............ Execshield Not Found ═╣ SELinux enabled? ............... sestatus Not Found ═╣ Seccomp enabled? ............... disabled ═╣ User namespace? ................ enabled ═╣ unpriv_userns_clone? ........... 1 ═╣ unpriv_bpf_disabled? ........... 2 ═╣ Cgroup2 enabled? ............... enabled ═╣ kptr_restrict? ................. 1 ═╣ dmesg_restrict? ................ 1 ═╣ ptrace_scope? .................. 1 ═╣ protected_symlinks? ............ 1 ═╣ protected_hardlinks? ........... 1 ═╣ perf_event_paranoid? ........... 4 ═╣ mmap_min_addr? ................. 65536 ═╣ lockdown mode? ................. [none] integrity confidentiality ═╣ Kernel hardening flags? ........ CONFIG_RANDOMIZE_BASE=y CONFIG_STACKPROTECTOR=y CONFIG_STACKPROTECTOR_STRONG=y CONFIG_SLAB_FREELIST_RANDOM=y CONFIG_SLAB_FREELIST_HARDENED=y # CONFIG_KASAN is not set ═╣ Fail2ban present? .............. Yes - installed (could not query jails, may need root) ═╣ CrowdSec present? .............. crowdsec Not Found ═╣ Pending reboot? ................ Yes - updates installed but not applied, the running kernel/libs may be outdated (check kernel exploits) libc6 linux-image-6.8.0-90-generic linux-base ═╣ Is ASLR enabled? ............... Yes ═╣ Printer? ....................... No ═╣ Is this a virtual machine? ..... Yes (kvm) ╔══════════╣ Kernel Modules Information (T1547.006) ══╣ Loaded kernel modules (T1547.006) Module Size Used by authencesn 12288 0 authenc 12288 1 authencesn algif_aead 16384 0 af_alg 32768 1 algif_aead tcp_diag 12288 0 inet_diag 28672 1 tcp_diag cpuid 12288 0 tls 155648 5 nft_reject_inet 12288 1 nft_reject 12288 1 nft_reject_inet qrtr 53248 2 cfg80211 1323008 0 ip6t_REJECT 12288 1 nf_reject_ipv6 24576 2 nft_reject_inet,ip6t_REJECT xt_hl 12288 22 ip6t_rt 16384 3 ipt_REJECT 12288 1 nf_reject_ipv4 12288 2 nft_reject_inet,ipt_REJECT xt_LOG 16384 10 nf_log_syslog 20480 10 xt_multiport 16384 2 nft_limit 16384 13 xt_limit 12288 0 xt_addrtype 12288 4 xt_tcpudp 16384 60 xt_conntrack 12288 16 intel_rapl_msr 20480 0 intel_rapl_common 40960 1 intel_rapl_msr binfmt_misc 24576 1 nf_conntrack 196608 1 xt_conntrack nf_defrag_ipv6 24576 1 nf_conntrack nf_defrag_ipv4 12288 1 nf_conntrack nft_compat 20480 119 nf_tables 372736 672 nft_compat,nft_reject_inet,nft_limit,nft_reject i2c_piix4 32768 0 input_leds 12288 0 joydev 32768 0 serio_raw 20480 0 mac_hid 12288 0 sch_fq_codel 24576 5 dm_multipath 45056 0 msr 12288 0 efi_pstore 12288 0 nfnetlink 20480 4 nft_compat,nf_tables dmi_sysfs 24576 0 qemu_fw_cfg 24576 0 ip_tables 32768 0 x_tables 65536 12 xt_conntrack,nft_compat,xt_LOG,xt_multiport,xt_tcpudp,xt_addrtype,ip6t_rt,ipt_REJECT,ip_tables,xt_limit,xt_hl,ip6t_REJECT autofs4 57344 2 btrfs 2019328 0 blake2b_generic 24576 0 raid10 73728 0 raid456 192512 0 async_raid6_recov 20480 1 raid456 async_memcpy 16384 2 raid456,async_raid6_recov async_pq 20480 2 raid456,async_raid6_recov async_xor 16384 3 async_pq,raid456,async_raid6_recov async_tx 16384 5 async_pq,async_memcpy,async_xor,raid456,async_raid6_recov xor 20480 2 async_xor,btrfs raid6_pq 126976 4 async_pq,btrfs,raid456,async_raid6_recov libcrc32c 12288 4 nf_conntrack,btrfs,nf_tables,raid456 raid1 57344 0 raid0 24576 0 crct10dif_pclmul 12288 1 crc32_pclmul 12288 0 polyval_clmulni 12288 0 polyval_generic 12288 1 polyval_clmulni ghash_clmulni_intel 16384 0 sha256_ssse3 32768 0 sha1_ssse3 32768 0 psmouse 217088 0 bochs 20480 0 drm_vram_helper 24576 1 bochs drm_ttm_helper 12288 2 bochs,drm_vram_helper ttm 110592 2 drm_vram_helper,drm_ttm_helper pata_acpi 12288 0 floppy 131072 0 hid_generic 12288 0 usbhid 77824 0 hid 180224 2 usbhid,hid_generic aesni_intel 356352 10 crypto_simd 16384 1 aesni_intel cryptd 24576 7 crypto_simd,ghash_clmulni_intel ══╣ Kernel modules with weak perms? (T1547.006)  ══╣ Kernel modules loadable? (T1547.006) Modules can be loaded ══╣ Module signature enforcement? (T1547.006) Not enforced ╔══════════╣ Checking for Copy Fail (CVE-2026-31431) (T1068) ╚ https://copy.fail/ ╚ https://www.cve.org/CVERecord?id=CVE-2026-31431 VULNERABLE: non-destructive AF_ALG/splice page-cache write triggered ╔══════════╣ Kernel Exploit Registry (T1068) ═╣ Operating system ............. Linux ═╣ Kernel release ............... 6.8.0-49-generic ═╣ Comparable version ........... 6.8.0.49 ═╣ Data chunk limit ............. max 25 rows per KERNEL_CVE_DATA_* variable (1..23) ═╣ Kernel config source ......... /boot/config-6.8.0-49-generic CVE: CVE-2025-38236 | Name: AF_UNIX MSG_OOB UAF | Match data: pkg=linux-kernel,ver>=6.7,ver<6.12.36 | Tags: 1 | Rank: Fixed in stable 6.12.36 CVE: CVE-2026-43503 | Name: DirtyClone | Match data: pkg=linux-kernel,ver>=6.7,ver<6.12.91 | Tags: 1 | Rank: Fixed in stable 6.12.91; exploit path is in the networking stack and may be mitigated by removing the relevant ESP modules CVE: CVE-2026-46331 | Name: pedit COW | Match data: pkg=linux-kernel,ver>=5.18,ver<6.12.94 | Tags: 1 | Rank: Fixed in stable 6.12.94; exploit path uses the traffic-control act_pedit subsystem CVE: CVE-2026-46333 | Name: ptrace exit-race | Match data: pkg=linux-kernel,ver>=6.7,ver<6.12.89,cmd:[ "$(cat /proc/sys/kernel/yama/ptrace_scope 2>/dev/null || echo 0)" -lt 2 ] | Tags: 1 | Rank: Upstream issue introduced in 4.10; fixed in 6.12.89; mitigated by kernel.yama.ptrace_scope >= 2 CVE: CVE-2026-43499 | Name: GhostLock rtmutex UAF | Match data: pkg=linux-kernel,ver>=6.7,ver<6.12.86,CONFIG_FUTEX_PI=y | Tags: 1 | Rank: Fixed in stable 6.12.86; priority-inheritance futexes must be enabled ═╣ Kernel vulns found: 5  ╔══════════╣ Checking for Dirty Frag (CVE-2026-43284 / CVE-2026-43500) (T1068) ╚ https://ubuntu.com/blog/dirty-frag-linux-vulnerability-fixes-available ╚ https://www.cve.org/CVERecord?id=CVE-2026-43284 ╚ https://www.cve.org/CVERecord?id=CVE-2026-43500 CVE-2026-43284 (xfrm-ESP): autoloadable: esp4 esp6 xfrm_user ipcomp6 CVE-2026-43500 (rxrpc): autoloadable: rxrpc modprobe mitigation (xfrm-ESP): not found modprobe mitigation (rxrpc): not found Unprivileged user namespaces: enabled Kernel build predates upstream fix (2026-05-08): likely unpatched unless distro backport. LIKELY VULNERABLE to CVE-2026-43284 (xfrm-ESP). LIKELY VULNERABLE to CVE-2026-43500 (rxrpc). Mitigation: 'install esp4/esp6/rxrpc /bin/false' in /etc/modprobe.d/, then rmmod; or sysctl kernel.unprivileged_userns_clone=0; or apply distro patches. ╔══════════╣ Package Vulnerabilities (T1082) ╚ This uses the optional HackTricks online lookup enabled with -V or -a. Output is capped at 50 vulnerable packages. Online package vulnerabilities found: 70 vulnerable package(s), checked 250. - apache2 2.4.58-1ubuntu8.10 [Ubuntu:24.04]: UBUNTU-CVE-2026-24072, UBUNTU-CVE-2026-28780, UBUNTU-CVE-2026-29167, UBUNTU-CVE-2026-29168, UBUNTU-CVE-2026-29169, UBUNTU-CVE-2026-29170, UBUNTU-CVE-2026-33006, UBUNTU-CVE-2026-33007, UBUNTU-CVE-2026-33523, UBUNTU-CVE-2026-33857, UBUNTU-CVE-2026-34032, UBUNTU-CVE-2026-34059, UBUNTU-CVE-2026-34355, UBUNTU-CVE-2026-34356, UBUNTU-CVE-2026-42535, UBUNTU-CVE-2026-42536, UBUNTU-CVE-2026-43951, UBUNTU-CVE-2026-44119, UBUNTU-CVE-2026-44185, UBUNTU-CVE-2026-44186 - busybox 1:1.36.1-6ubuntu3.1 [Ubuntu:24.04]: UBUNTU-CVE-2023-39810, UBUNTU-CVE-2023-42366, UBUNTU-CVE-2024-58251, UBUNTU-CVE-2025-46394, UBUNTU-CVE-2025-60876, UBUNTU-CVE-2026-26157, UBUNTU-CVE-2026-26158, UBUNTU-CVE-2026-29004, UBUNTU-CVE-2026-38752, UBUNTU-CVE-2026-38753, UBUNTU-CVE-2026-38754, UBUNTU-CVE-2026-38755, UBUNTU-CVE-2026-76014 - bind9 1:9.18.39-0ubuntu0.24.04.2 [Ubuntu:24.04]: UBUNTU-CVE-2026-10723, UBUNTU-CVE-2026-10822, UBUNTU-CVE-2026-11331, UBUNTU-CVE-2026-11622, UBUNTU-CVE-2026-11721, UBUNTU-CVE-2026-12617, UBUNTU-CVE-2026-13204, UBUNTU-CVE-2026-13321, UBUNTU-CVE-2026-1519, UBUNTU-CVE-2026-3039, UBUNTU-CVE-2026-3592, UBUNTU-CVE-2026-5946, UBUNTU-CVE-2026-5950, USN-8124-1, USN-8293-1, USN-8648-1, USN-8696-1 - apport 2.28.1-0ubuntu3.8 [Ubuntu:24.04]: UBUNTU-CVE-2022-28653 - binutils 2.42-4ubuntu2.8 [Ubuntu:24.04]: UBUNTU-CVE-2017-13716, UBUNTU-CVE-2025-1149, UBUNTU-CVE-2025-11495, UBUNTU-CVE-2025-1150, UBUNTU-CVE-2025-1151, UBUNTU-CVE-2025-1152, UBUNTU-CVE-2025-66861, UBUNTU-CVE-2025-66862, UBUNTU-CVE-2025-66863, UBUNTU-CVE-2025-66864, UBUNTU-CVE-2025-66865, UBUNTU-CVE-2025-66866, UBUNTU-CVE-2025-69644, UBUNTU-CVE-2025-69645, UBUNTU-CVE-2025-69646, UBUNTU-CVE-2025-69647, UBUNTU-CVE-2025-69648, UBUNTU-CVE-2025-69651, UBUNTU-CVE-2025-69652, UBUNTU-CVE-2026-15003 - bolt 0.9.7-1 [Ubuntu:24.04]: UBUNTU-CVE-2026-14587 - util-linux 2.39.3-9ubuntu6.4 [Ubuntu:24.04]: UBUNTU-CVE-2026-13595, UBUNTU-CVE-2026-27456, UBUNTU-CVE-2026-53612, UBUNTU-CVE-2026-53613, UBUNTU-CVE-2026-53614, UBUNTU-CVE-2026-53615, USN-8091-1, USN-8702-1 - amd64-microcode 3.20250311.1ubuntu0.24.04.1 [Ubuntu:24.04]: UBUNTU-CVE-2023-20585, UBUNTU-CVE-2024-21953, UBUNTU-CVE-2024-36347, UBUNTU-CVE-2024-36350, UBUNTU-CVE-2024-36357, UBUNTU-CVE-2025-0012, UBUNTU-CVE-2025-0031, UBUNTU-CVE-2025-0033, UBUNTU-CVE-2025-29934, UBUNTU-CVE-2025-29939, UBUNTU-CVE-2025-29943, UBUNTU-CVE-2025-29946, UBUNTU-CVE-2025-29948, UBUNTU-CVE-2025-29952, UBUNTU-CVE-2025-48509, UBUNTU-CVE-2025-48514, UBUNTU-CVE-2025-48517, UBUNTU-CVE-2025-52534, UBUNTU-CVE-2025-52536, UBUNTU-CVE-2025-54514 - acl 2.3.2-1build1.1 [Ubuntu:24.04]: UBUNTU-CVE-2026-54369, UBUNTU-CVE-2026-54370 - aom 3.8.2-2ubuntu0.1 [Ubuntu:24.04]: UBUNTU-CVE-2026-56208, UBUNTU-CVE-2026-56209, UBUNTU-CVE-2026-56210, UBUNTU-CVE-2026-56211 - apr-util 1.6.3-1.1ubuntu7 [Ubuntu:24.04]: UBUNTU-CVE-2025-49506, UBUNTU-CVE-2026-32327, UBUNTU-CVE-2026-34191, UBUNTU-CVE-2026-34501, UBUNTU-CVE-2026-34502 - attr 1:2.5.2-1build1.1 [Ubuntu:24.04]: UBUNTU-CVE-2026-54371, USN-8691-1 - avahi 0.8-13ubuntu6.1 [Ubuntu:24.04]: UBUNTU-CVE-2024-52615, UBUNTU-CVE-2024-52616, UBUNTU-CVE-2025-59529, UBUNTU-CVE-2026-24401, UBUNTU-CVE-2026-34933, USN-8269-1 - bzip2 1.0.8-5.1build0.1 [Ubuntu:24.04]: UBUNTU-CVE-2026-42250, USN-8685-1 - ca-certificates 20240203 [Ubuntu:24.04]: USN-8436-1 - coreutils 9.4-3ubuntu6.1 [Ubuntu:24.04]: UBUNTU-CVE-2016-2781, UBUNTU-CVE-2025-5278, USN-8697-1 - cpio 2.15+dfsg-1ubuntu2 [Ubuntu:24.04]: UBUNTU-CVE-2023-7216, UBUNTU-CVE-2026-66484, UBUNTU-CVE-2026-66485, UBUNTU-CVE-2026-66486, USN-8704-1 - cups 2.4.7-1.2ubuntu7.9 [Ubuntu:24.04]: UBUNTU-CVE-2026-27447, UBUNTU-CVE-2026-34978, UBUNTU-CVE-2026-34979, UBUNTU-CVE-2026-34980, UBUNTU-CVE-2026-34990, UBUNTU-CVE-2026-39314, UBUNTU-CVE-2026-39316, UBUNTU-CVE-2026-41079, USN-8405-1, USN-8405-2 - curl 8.5.0-2ubuntu10.6 [Ubuntu:24.04]: UBUNTU-CVE-2025-0167, UBUNTU-CVE-2025-10148, UBUNTU-CVE-2025-14017, UBUNTU-CVE-2025-14524, UBUNTU-CVE-2025-14819, UBUNTU-CVE-2025-15079, UBUNTU-CVE-2025-15224, UBUNTU-CVE-2026-10536, UBUNTU-CVE-2026-11856, UBUNTU-CVE-2026-1965, UBUNTU-CVE-2026-3783, UBUNTU-CVE-2026-3784, UBUNTU-CVE-2026-4873, UBUNTU-CVE-2026-5545, UBUNTU-CVE-2026-5773, UBUNTU-CVE-2026-6253, UBUNTU-CVE-2026-6276, UBUNTU-CVE-2026-6429, UBUNTU-CVE-2026-7168, UBUNTU-CVE-2026-8286 - dhcpcd 1:10.0.6-1ubuntu3.2 [Ubuntu:24.04]: UBUNTU-CVE-2025-70102, UBUNTU-CVE-2026-14258, UBUNTU-CVE-2026-56113, UBUNTU-CVE-2026-56114, UBUNTU-CVE-2026-56115, UBUNTU-CVE-2026-56116, UBUNTU-CVE-2026-56117 - diffutils 1:3.10-1build1 [Ubuntu:24.04]: UBUNTU-CVE-2026-53910, USN-8692-1 - dpkg 1.22.6ubuntu6.5 [Ubuntu:24.04]: UBUNTU-CVE-2026-2219, USN-8249-1 - dracut 060+5-1ubuntu3.3 [Ubuntu:24.04]: UBUNTU-CVE-2026-15816, UBUNTU-CVE-2026-16445, UBUNTU-CVE-2026-6893 - duktape 2.7.0+tests-0ubuntu3 [Ubuntu:24.04]: UBUNTU-CVE-2026-12216 - efivar 38-3.1build1 [Ubuntu:24.04]: UBUNTU-CVE-2026-6862 - elfutils 0.190-1.1ubuntu0.1 [Ubuntu:24.04]: UBUNTU-CVE-2025-1352, UBUNTU-CVE-2025-1376 - expat 2.6.1-2ubuntu0.3 [Ubuntu:24.04]: UBUNTU-CVE-2025-59375, UBUNTU-CVE-2025-66382, UBUNTU-CVE-2026-24515, UBUNTU-CVE-2026-25210, UBUNTU-CVE-2026-32776, UBUNTU-CVE-2026-32777, UBUNTU-CVE-2026-32778, UBUNTU-CVE-2026-41080, UBUNTU-CVE-2026-45186, UBUNTU-CVE-2026-4739, UBUNTU-CVE-2026-50219, UBUNTU-CVE-2026-56131, UBUNTU-CVE-2026-56132, UBUNTU-CVE-2026-56403, UBUNTU-CVE-2026-56404, UBUNTU-CVE-2026-56405, UBUNTU-CVE-2026-56406, UBUNTU-CVE-2026-56407, UBUNTU-CVE-2026-56408, UBUNTU-CVE-2026-56409 - freetype 2.13.2+dfsg-1build3 [Ubuntu:24.04]: UBUNTU-CVE-2026-23865, USN-8086-1 - gawk 1:5.2.1-2build3 [Ubuntu:24.04]: UBUNTU-CVE-2026-40467, UBUNTU-CVE-2026-40468, UBUNTU-CVE-2026-40469, USN-8588-1 - gifsicle 1.94-1 [Ubuntu:24.04]: UBUNTU-CVE-2020-19752, UBUNTU-CVE-2023-36193, UBUNTU-CVE-2023-46009 - git 1:2.43.0-1ubuntu7.3 [Ubuntu:24.04]: UBUNTU-CVE-2018-1000021, UBUNTU-CVE-2024-52005 - glib2.0 2.80.0-6ubuntu3.7 [Ubuntu:24.04]: UBUNTU-CVE-2026-1484, UBUNTU-CVE-2026-1485, UBUNTU-CVE-2026-1489, UBUNTU-CVE-2026-15588, UBUNTU-CVE-2026-16118, UBUNTU-CVE-2026-58010, UBUNTU-CVE-2026-58011, UBUNTU-CVE-2026-58012, UBUNTU-CVE-2026-58013, UBUNTU-CVE-2026-58014, UBUNTU-CVE-2026-58015, UBUNTU-CVE-2026-58016, USN-8017-1 - glibc 2.39-0ubuntu8.6 [Ubuntu:24.04]: UBUNTU-CVE-2016-20013, UBUNTU-CVE-2025-15281, UBUNTU-CVE-2026-0861, UBUNTU-CVE-2026-0915, UBUNTU-CVE-2026-18374, UBUNTU-CVE-2026-19499, UBUNTU-CVE-2026-19542, UBUNTU-CVE-2026-4046, UBUNTU-CVE-2026-4437, UBUNTU-CVE-2026-4438, UBUNTU-CVE-2026-5435, UBUNTU-CVE-2026-5450, UBUNTU-CVE-2026-5928, UBUNTU-CVE-2026-6238, UBUNTU-CVE-2026-6368, UBUNTU-CVE-2026-6791, UBUNTU-CVE-2026-77117, UBUNTU-CVE-2026-80489, USN-8005-1, USN-8611-1 - gnupg2 2.4.4-2ubuntu17.4 [Ubuntu:24.04]: UBUNTU-CVE-2022-3219, UBUNTU-CVE-2026-57062 - gnutls28 3.8.3-1.1ubuntu3.4 [Ubuntu:24.04]: UBUNTU-CVE-2025-14831, UBUNTU-CVE-2025-9820, UBUNTU-CVE-2026-33845, UBUNTU-CVE-2026-33846, UBUNTU-CVE-2026-3832, UBUNTU-CVE-2026-3833, UBUNTU-CVE-2026-42009, UBUNTU-CVE-2026-42010, UBUNTU-CVE-2026-42011, UBUNTU-CVE-2026-42012, UBUNTU-CVE-2026-42013, UBUNTU-CVE-2026-42014, UBUNTU-CVE-2026-42015, UBUNTU-CVE-2026-5260, UBUNTU-CVE-2026-5419, USN-8043-1, USN-8284-1 - gstreamer1.0 1.24.2-1ubuntu0.1 [Ubuntu:24.04]: UBUNTU-CVE-2026-18295, UBUNTU-CVE-2026-18296, UBUNTU-CVE-2026-18297, UBUNTU-CVE-2026-18298, UBUNTU-CVE-2026-18299 - gzip 1.12-1ubuntu3.1 [Ubuntu:24.04]: UBUNTU-CVE-2026-41991, UBUNTU-CVE-2026-41992, USN-8512-1 - icu 74.2-1ubuntu3.1 [Ubuntu:24.04]: UBUNTU-CVE-2025-5222 - imagemagick 8:6.9.12.98+dfsg1-5.2build2 [Ubuntu:24.04]: UBUNTU-CVE-2020-25664, UBUNTU-CVE-2025-43965, UBUNTU-CVE-2025-53014, UBUNTU-CVE-2025-53019, UBUNTU-CVE-2025-53101, UBUNTU-CVE-2025-55005, UBUNTU-CVE-2025-55154, UBUNTU-CVE-2025-55160, UBUNTU-CVE-2025-55212, UBUNTU-CVE-2025-55298, UBUNTU-CVE-2025-57803, UBUNTU-CVE-2025-57807, UBUNTU-CVE-2025-62171, UBUNTU-CVE-2025-66628, UBUNTU-CVE-2025-68469, UBUNTU-CVE-2025-68618, UBUNTU-CVE-2025-68950, UBUNTU-CVE-2025-69204, UBUNTU-CVE-2026-23874, UBUNTU-CVE-2026-23876 - inetutils 2:2.5-3ubuntu4 [Ubuntu:24.04]: UBUNTU-CVE-2026-19720, UBUNTU-CVE-2026-24061, UBUNTU-CVE-2026-28372, UBUNTU-CVE-2026-32746, UBUNTU-CVE-2026-32772, USN-7992-1, USN-8387-1 - intel-microcode 3.20250812.0ubuntu0.24.04.1 [Ubuntu:24.04]: UBUNTU-CVE-2025-31648, UBUNTU-CVE-2025-31936, UBUNTU-CVE-2025-31938, UBUNTU-CVE-2025-35973, UBUNTU-CVE-2025-35979, UBUNTU-CVE-2026-20707, UBUNTU-CVE-2026-20713, UBUNTU-CVE-2026-20716, UBUNTU-CVE-2026-20760, UBUNTU-CVE-2026-20901, UBUNTU-CVE-2026-20917, USN-8068-1 - jbig2dec 0.20-1build3 [Ubuntu:24.04]: UBUNTU-CVE-2026-38076, USN-8582-1 - jpegoptim 1.4.7-1 [Ubuntu:24.04]: UBUNTU-CVE-2018-11416, UBUNTU-CVE-2022-32325, UBUNTU-CVE-2023-27781 - jq 1.7.1-3ubuntu0.24.04.1 [Ubuntu:24.04]: UBUNTU-CVE-2025-9403, UBUNTU-CVE-2026-32316, UBUNTU-CVE-2026-33947, UBUNTU-CVE-2026-33948, UBUNTU-CVE-2026-39956, UBUNTU-CVE-2026-39979, UBUNTU-CVE-2026-40164, UBUNTU-CVE-2026-40612, UBUNTU-CVE-2026-41256, UBUNTU-CVE-2026-41257, UBUNTU-CVE-2026-43894, UBUNTU-CVE-2026-43895, UBUNTU-CVE-2026-43896, UBUNTU-CVE-2026-44777, UBUNTU-CVE-2026-47770, UBUNTU-CVE-2026-49839, UBUNTU-CVE-2026-54679, USN-8202-1 - kbd 2.6.4-2ubuntu2 [Ubuntu:24.04]: UBUNTU-CVE-2026-72693 - kmod 31+20240202-2ubuntu7.1 [Ubuntu:24.04]: USN-8226-1 - krb5 1.20.1-6ubuntu2.6 [Ubuntu:24.04]: UBUNTU-CVE-2026-11850, UBUNTU-CVE-2026-40355, UBUNTU-CVE-2026-40356, USN-8585-1 - lcms2 2.14-2build1 [Ubuntu:24.04]: UBUNTU-CVE-2026-41254, USN-8209-1 - libarchive 3.7.2-2ubuntu0.5 [Ubuntu:24.04]: UBUNTU-CVE-2025-5918, UBUNTU-CVE-2025-60753, UBUNTU-CVE-2026-14164, UBUNTU-CVE-2026-16517, UBUNTU-CVE-2026-4111, UBUNTU-CVE-2026-4424, UBUNTU-CVE-2026-4426, UBUNTU-CVE-2026-5121, UBUNTU-CVE-2026-5745, USN-8147-1, USN-8292-1, USN-8581-1 - libbpf 1.3.0-2build2 [Ubuntu:24.04]: UBUNTU-CVE-2025-29481 ... 20 more vulnerable package(s) not shown.  ╔═══════════╗ ═══════════════════════════════════╣ Container ╠═══════════════════════════════════  ╚═══════════╝ ╔══════════╣ Container related tools present (if any): (T1613) /usr/sbin/lxc /usr/sbin/apparmor_parser /usr/bin/nsenter /usr/bin/unshare /usr/sbin/chroot /usr/sbin/capsh /usr/sbin/setcap /usr/sbin/getcap ╔══════════╣ Container details (T1613,T1611) ═╣ Is this a container? ........... No ═╣ LXC version ................ lxc Not Found ═╣ LXC info ................... lxc Not Found ═╣ Interesting runtime sockets ... ═╣ Any running containers? ........ No   ╔═══════╗ ═════════════════════════════════════╣ Cloud ╠═════════════════════════════════════  ╚═══════╝ Learn and practice cloud hacking techniques in https://training.hacktricks.xyz  ═╣ GCP Virtual Machine? ................. No ═╣ GCP Cloud Funtion? ................... No ═╣ AWS ECS? ............................. No ═╣ AWS EC2? ............................. No ═╣ AWS EC2 Beanstalk? ................... No ═╣ AWS Lambda? .......................... No ═╣ AWS Codebuild? ....................... No ═╣ DO Droplet? .......................... No ═╣ IBM Cloud VM? ........................ No ═╣ Azure VM or Az metadata? ............. No ═╣ Azure APP or IDENTITY_ENDPOINT? ...... No ═╣ Azure Automation Account? ............ No ═╣ Aliyun ECS? .......................... No ═╣ Tencent CVM? ......................... No   ╔════════════════════════════════════════════════╗ ════════════════╣ Processes, Crons, Timers, Services and Sockets ╠════════════════  ╚════════════════════════════════════════════════╝ ╔══════════╣ Running processes (cleaned) (T1057) ╚ Check weird & unexpected processes run by root: https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#processes root 1 0.0 0.1 22596 10492 ? Ss 2025 178:40 /usr/lib/systemd/systemd --system --deserialize=82 message+ 739 0.0 0.0 10104 2816 ? Ss 2025 123:33 @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only └─(Caps) 0x0000000020000000=cap_audit_write root 748 0.0 0.0 32836 1536 ? Ss 2025 0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers root 766 0.0 0.0 18344 2944 ? Ss 2025 49:03 /usr/lib/systemd/systemd-logind root 919 0.0 0.0 110356 2944 ? Ssl 2025 0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal root 1261 0.0 0.0 6784 512 tty1 Ss+ 2025 0:00 /sbin/agetty -o -p -- u --noclear - linux syslog 3160705 0.0 0.0 222508 5376 ? Ssl Jan26 8:16 /usr/sbin/rsyslogd -n -iNONE root 3179601 0.0 0.0 29024 5996 ? Ss Jan26 0:25 /usr/lib/systemd/systemd-udevd systemd+ 3193063 0.0 0.0 21580 7168 ? Ss Jan26 0:27 /usr/lib/systemd/systemd-resolved └─(Caps) 0x0000000000002000=cap_net_raw root 3203456 0.0 0.0 80712 3328 ? Ssl Jan26 0:00 /usr/sbin/qemu-ga redis 3208665 0.1 0.1 67436 9844 ? Ssl Jan26 559:57 /usr/bin/redis-server 127.0.0.1:6379 root 3209392 0.0 0.3 288952 27008 ? SLsl Jan26 32:38 /sbin/multipathd -d -s polkitd 3222738 0.0 0.0 308164 6016 ? Ssl Jan26 8:10 /usr/lib/polkit-1/polkitd --no-debug root 3222752 0.0 0.0 392096 6144 ? Ssl Jan26 0:04 /usr/sbin/ModemManager root 3225764 0.0 0.0 468940 8064 ? Ssl Jan26 6:32 /usr/libexec/udisks2/udisksd mysql 3248175 0.3 7.2 3033852 589612 ? Ssl Jan26 1118:07 /usr/sbin/mariadbd └─(Caps) 0x0000000000004000=cap_ipc_lock root 3263831 0.0 0.9 191324 74332 ? S Jan26 1:32 nginx: master process /usr/sbin/nginx -g daemon[0m on; master_process on; root 1953110 0.0 0.6 261900 53548 ? Sl Sep01 0:01 _ nginx: worker process root 1953111 0.0 1.0 294796 86068 ? Sl Sep01 0:01 _ nginx: worker process root 1953112 0.0 0.8 278348 69684 ? Sl Sep01 0:01 _ nginx: worker process root 1953114 0.0 0.6 261900 53244 ? Sl Sep01 0:01 _ nginx: worker process root 3266855 0.0 0.1 888788 13060 ? Ss Jan26 20:32 php-fpm: master process (/home/clp/services/php-fpm/fpm/php-fpm.conf) root 3266860 0.0 0.0 22532 1772 ? Ss Jan26 0:00 nginx: master process /usr/sbin/nginx -g daemon[0m on; master_process on; -c /home/clp/services/nginx/nginx.conf clp 3266861 0.0 0.1 26700 10220 ? S Jan26 0:47 _ nginx: worker process clp 3266862 0.0 0.1 26864 10604 ? S Jan26 0:46 _ nginx: worker process clp 3266863 0.0 0.1 26816 10476 ? S Jan26 0:45 _ nginx: worker process clp 3266864 0.0 0.1 27224 10732 ? S Jan26 0:46 _ nginx: worker process root 3277163 0.0 0.1 894964 14432 ? Ss Jan26 22:38 php-fpm: master process (/etc/php/7.3/fpm/php-fpm.conf) root 3277174 0.0 0.1 895568 14508 ? Ss Jan26 22:03 php-fpm: master process (/etc/php/7.4/fpm/php-fpm.conf) root 3277186 0.0 0.6 902112 49040 ? Ss Jan26 39:04 php-fpm: master process (/etc/php/8.3/fpm/php-fpm.conf) root 3277196 0.0 0.1 895068 14068 ? Ss Jan26 22:20 php-fpm: master process (/etc/php/7.2/fpm/php-fpm.conf) root 3277209 0.0 0.1 899216 14824 ? Ss Jan26 22:22 php-fpm: master process (/etc/php/8.2/fpm/php-fpm.conf) root 3277220 0.0 0.1 898380 14556 ? Ss Jan26 22:15 php-fpm: master process (/etc/php/8.1/fpm/php-fpm.conf) root 3277231 0.0 0.2 968404 23244 ? Ss Jan26 25:25 php-fpm: master process (/etc/php/8.4/fpm/php-fpm.conf) root 3277242 0.0 0.1 891780 14296 ? Ss Jan26 22:37 php-fpm: master process (/etc/php/7.1/fpm/php-fpm.conf) root 3277255 0.0 0.1 906188 14188 ? Ss Jan26 22:19 php-fpm: master process (/etc/php/8.5/fpm/php-fpm.conf) root 3277266 0.0 0.1 897112 14248 ? Ss Jan26 22:03 php-fpm: master process (/etc/php/8.0/fpm/php-fpm.conf) root 3277367 0.0 0.0 8392 3456 ? Ss Jan26 7:02 /usr/sbin/cron -f -P root 3277383 0.0 1.1 181952 97276 ? S/dev/null 2>&1; do sleep 5; done echo " Build beendet" export PATH=$HOME/.nvm/versions/node/v22.23.2/bin:$PATH echo " BUILD_ID: $(cat ~/htdocs/bitneo.ch/.next/BUILD_ID 2>/dev/null || echo fehlt)" pm2 jlist 2>/dev/null | node -e "let d="";process.stdin.on("data",c=>d+=c).on("end",()=>{JSON.parse(d).forEach(x=>console.log(" pm2: "+x.name+" "+x.pm2_env.status+" uptime="+Math.round((Date.now()-x.pm2_env.pm_uptime)/1000)+"s"))})" bitneo 2013099 0.0 0.0 5648 2048 ? S 09:35 0:00 _ sleep 5 bitneo 15778 0.0 0.0 7276 3584 ? Ss Aug14 1:05 bash -c until grep -qE "Successfully saved|ELIFECYCLE|Build error" ~/htdocs/bitneo.ch/logs/deploy.log 2>/dev/null; do sleep 15; done grep -E "Compiled|Build error|ELIFECYCLE" ~/htdocs/bitneo.ch/logs/deploy.log | head -3 | sed "s/^/ /" bitneo 2008470 0.0 0.0 5648 2048 ? S 09:35 0:00 _ sleep 15 bitneo 17828 0.0 0.0 7276 3584 ? Ss Aug14 1:05 bash -c until grep -qE "Successfully saved|ELIFECYCLE|Build error" ~/htdocs/bitneo.ch/logs/deploy.log 2>/dev/null; do sleep 15; done grep -E "Compiled|Build error|ELIFECYCLE" ~/htdocs/bitneo.ch/logs/deploy.log | head -3 | sed "s/^/ /" bitneo 2013097 0.0 0.0 5648 2048 ? S 09:35 0:00 _ sleep 15 proftpd 1952899 0.0 0.0 21784 3844 ? Ss Sep01 0:01 proftpd: (accepting connections) root 1963063 0.0 0.1 1302652 13268 ? Ssl 02:15 0:10 /usr/sbin/clp-agent abaone 1993820 8.5 0.0 8244 7296 ? S 09:35 0:02 bash /tmp/lp.sh -a abaone 2013178 0.0 0.0 7728 5376 ? S 09:35 0:00 _ bash /tmp/lp.sh -a abaone 2013181 0.0 0.0 7892 4096 ? R 09:35 0:00 | _ ps fauxwww abaone 2013182 0.0 0.0 7728 5220 ? S 09:35 0:00 _ bash /tmp/lp.sh -a ╔══════════╣ Processes with unusual configurations (T1057) Process 3160705 (syslog) - /usr/sbin/rsyslogd -n -iNONE SELinux context: rsyslogd (enforce)\n └─ AppArmor profile: rsyslogd (enforce) Process 3277392 (_chrony) - /usr/sbin/chronyd -F 1 SELinux context: /usr/sbin/chronyd (enforce)\n └─ AppArmor profile: /usr/sbin/chronyd (enforce) Process 3277396 (_chrony) - /usr/sbin/chronyd -F 1 SELinux context: /usr/sbin/chronyd (enforce)\n └─ AppArmor profile: /usr/sbin/chronyd (enforce) ╔══════════╣ Processes with credentials in memory (root req) (T1003.007) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#credentials-from-process-memory gdm-password Not Found gnome-keyring-daemon Not Found lightdm Not Found vsftpd Not Found apache2 Not Found sshd: process found (dump creds from memory as root) mysql process found (dump creds from memory as root) postgres Not Found redis-server process found (dump creds from memory as root) mongod Not Found memcached process found (dump creds from memory as root) elasticsearch Not Found jenkins Not Found tomcat Not Found nginx process found (dump creds from memory as root) php-fpm process found (dump creds from memory as root) supervisord Not Found vncserver Not Found xrdp Not Found teamviewer Not Found  ╔══════════╣ Opened Files by processes (T1003.007) Process 1993820 (abaone) - bash /tmp/lp.sh -a └─ Has open files: └─ /tmp/lp_out.txt └─ /tmp/lp.sh Process 2022843 (abaone) - bash /tmp/lp.sh -a └─ Has open files: └─ pipe:[188493596] ╔══════════╣ Processes with memory-mapped credential files (T1003.007)  ╔══════════╣ Processes whose PPID belongs to a different user (not root) (T1134.004) ╚ You will know if a user can somehow spawn processes as a different user  ╔══════════╣ Files opened by processes belonging to other users (T1083) ╚ This is usually empty because of the lack of privileges to read other user processes information  ╔══════════╣ Different processes executed during 1 min (interesting is low number of repetitions) (T1057) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#frequent-cron-jobs  182 physio-+ php-fpm: pool physio-performance.ch 3 root sudo /usr/bin/clpctlWrapper db:master:password:show 3 abaone timeout 10 sudo /usr/bin/clpctlWrapper db:master:password:show 2 abaone sh -c -- timeout 10 sudo /usr/bin/clpctlWrapper list 2>&1; timeout 10 sudo /usr/bin/clpctlWrapper db:master:password:show 2>&1 2>&1 1 root sudo /usr/bin/clpctlWrapper --help 1 root sudo /usr/bin/clpctlWrapper 1 root /bin/bash /usr/bin/clpctlWrapper db:master:password:show 1 bitneo pgrep -f next build 1 abaone sh -c timeout 10 sudo /usr/bin/clpctlWrapper list 2>&1; timeout 10 sudo /usr/bin/clpctlWrapper db:master:password:show 2>&1 1 abaone sh -c -- sudo /usr/bin/clpctlWrapper 2>&1 2>&1 1 abaone sh -c -- sudo /usr/bin/clpctlWrapper --help 2>&1 | head -40 2>&1 1 abaone head -40 ╔══════════╣ Check for vulnerable cron jobs (T1053.003) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scheduledcron-jobs ══╣ Cron jobs list (T1053.003) /usr/bin/crontab incrontab Not Found -rw-r--r-- 1 root root    1136 Apr 23  2024 /etc/crontab  /etc/cron.d: total 52 drwxr-xr-x   2 root root  4096 Jan 26  2026 . drwxr-xr-x 128 root root 12288 Aug 13 22:13 .. -rw-r--r--   1 root root   102 Apr 23  2024 .placeholder -rw-r--r--   1 root root    10 Dec 29  2024 bitneo-crm -rw-r--r--   1 root root   995 Nov 26  2024 clp -rw-r--r--   1 root root   106 Dec  5  2024 clp-rclone -rw-r--r--   1 root root   201 Apr  8  2024 e2scrub_all -rw-r--r--   1 root root    50 Nov 29  2024 kernel -rw-r--r--   1 root root   712 Jul 13  2022 php -rw-r--r--   1 root root   102 May  7  2025 qqp-unique-auto -rw-r--r--   1 root root   396 Apr 23  2024 sysstat  /etc/cron.daily: total 48 drwxr-xr-x   2 root root  4096 Jan 26  2026 . drwxr-xr-x 128 root root 12288 Aug 13 22:13 .. -rw-r--r--   1 root root   102 Apr 23  2024 .placeholder -rwxr-xr-x   1 root root   376 Apr 19  2024 apport -rwxr-xr-x   1 root root  1478 Mar 22  2024 apt-compat -rwxr-xr-x   1 root root   253 Aug 29  2023 apt-show-versions -rwxr-xr-x   1 root root   595 Feb 25  2020 debsums -rwxr-xr-x   1 root root   123 Feb  5  2024 dpkg -rwxr-xr-x   1 root root  1395 Apr 23  2024 man-db -rwxr-xr-x   1 root root   518 Apr 23  2024 sysstat  /etc/cron.hourly: total 20 drwxr-xr-x   2 root root  4096 Apr 23  2024 . drwxr-xr-x 128 root root 12288 Aug 13 22:13 .. -rw-r--r--   1 root root   102 Apr 23  2024 .placeholder  /etc/cron.monthly: total 24 drwxr-xr-x   2 root root  4096 Nov 29  2024 . drwxr-xr-x 128 root root 12288 Aug 13 22:13 .. -rw-r--r--   1 root root   102 Apr 23  2024 .placeholder -rwxr-xr-x   1 root root   597 Feb 25  2020 debsums  /etc/cron.weekly: total 28 drwxr-xr-x   2 root root  4096 Nov 29  2024 . drwxr-xr-x 128 root root 12288 Aug 13 22:13 .. -rw-r--r--   1 root root   102 Apr 23  2024 .placeholder -rwxr-xr-x   1 root root   596 Feb 25  2020 debsums -rwxr-xr-x   1 root root  1055 Apr 23  2024 man-db  /etc/cron.yearly: total 20 drwxr-xr-x   2 root root  4096 Apr 23  2024 . drwxr-xr-x 128 root root 12288 Aug 13 22:13 .. -rw-r--r--   1 root root   102 Apr 23  2024 .placeholder SHELL=/bin/sh 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; } 47 6 * * 7 root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; } 52 6 1 * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; } /etc/cron.d/sysstat:3:PATH=/usr/lib/sysstat:/usr/sbin:/usr/sbin:/usr/bin:/sbin:/bin /etc/crontab:19:17 * * * * root cd / && run-parts --report /etc/cron.hourly /etc/crontab:20:25 6 * * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; } /etc/crontab:21:47 6 * * 7 root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; } /etc/crontab:22:52 6 1 * * root test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; } ══╣ Cron files with hidden carriage returns (T1053.003)  ══╣ Checking for specific cron jobs vulnerabilities (T1053.003) Checking cron directories... ══╣ run-parts executable entries (T1053.003) [/etc/cron.hourly] [/etc/cron.daily] /etc/cron.daily/apport /etc/cron.daily/apt-compat /etc/cron.daily/apt-show-versions /etc/cron.daily/debsums /etc/cron.daily/dpkg /etc/cron.daily/man-db /etc/cron.daily/sysstat [/etc/cron.weekly] /etc/cron.weekly/debsums /etc/cron.weekly/man-db [/etc/cron.monthly] /etc/cron.monthly/debsums ╔══════════╣ System timers (T1053.003) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#timers ══╣ Active timers: (T1053.003) NEXT LEFT LAST PASSED UNIT ACTIVATES Wed 2026-09-02 09:39:00 CEST 1min 36s Wed 2026-09-02 09:09:00 CEST 28min ago phpsessionclean.timer phpsessionclean.service Wed 2026-09-02 09:40:00 CEST 2min 36s Wed 2026-09-02 09:30:00 CEST 7min ago sysstat-collect.timer sysstat-collect.service Wed 2026-09-02 10:04:20 CEST 26min Wed 2026-09-02 09:08:35 CEST 28min ago fwupd-refresh.timer fwupd-refresh.service Wed 2026-09-02 11:02:28 CEST 1h 25min Tue 2026-09-01 11:02:28 CEST 22h ago update-notifier-download.timer update-notifier-download.service Wed 2026-09-02 12:12:55 CEST 2h 35min Tue 2026-09-01 22:15:25 CEST 11h ago apt-daily.timer apt-daily.service Wed 2026-09-02 17:57:16 CEST 8h Wed 2026-09-02 06:53:52 CEST 2h 43min ago motd-news.timer motd-news.service Wed 2026-09-02 23:36:08 CEST 13h Tue 2026-09-01 23:36:08 CEST 10h ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service Wed 2026-09-02 23:58:00 CEST 14h Tue 2026-09-01 23:58:00 CEST 9h ago logrotate.timer logrotate.service Thu 2026-09-03 00:00:00 CEST 14h Wed 2026-09-02 00:00:00 CEST 9h ago apt-show-versions.timer apt-show-versions.service Thu 2026-09-03 00:00:00 CEST 14h Wed 2026-09-02 00:00:00 CEST 9h ago dpkg-db-backup.timer dpkg-db-backup.service Thu 2026-09-03 00:07:00 CEST 14h Wed 2026-09-02 00:07:00 CEST 9h ago sysstat-summary.timer sysstat-summary.service Thu 2026-09-03 06:17:38 CEST 20h Wed 2026-09-02 06:06:46 CEST 3h 30min ago apt-daily-upgrade.timer apt-daily-upgrade.service Thu 2026-09-03 10:55:50 CEST 1 day 1h Wed 2026-09-02 04:40:05 CEST 4h 57min ago man-db.timer man-db.service Sun 2026-09-06 03:10:25 CEST 3 days Sun 2026-08-30 03:10:19 CEST 3 days ago e2scrub_all.timer e2scrub_all.service Mon 2026-09-07 01:39:11 CEST 4 days Mon 2026-08-31 01:11:08 CEST 2 days ago fstrim.timer fstrim.service Tue 2026-09-08 01:52:10 CEST 5 days Sun 2026-08-30 14:49:05 CEST 2 days ago update-notifier-motd.timer update-notifier-motd.service - - - - apport-autoreport.timer apport-autoreport.service - - - - snapd.snap-repair.timer snapd.snap-repair.service - - - - ua-timer.timer ua-timer.service ══╣ Disabled timers: (T1053.003) ══╣ Additional timer files: (T1053.003)  ╔══════════╣ Services and Service Files (T1543.002,T1007) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#services  ══╣ Active services: (T1543.002,T1007) apparmor.service loaded active exited Load AppArmor profiles apport.service loaded active exited automatic crash report generation blk-availability.service loaded active exited Availability of block devices chrony.service loaded active running chrony, an NTP client/server clp-agent.service loaded active running clp-agent Potential issue in service: clp-agent.service └─ RUNS_AS_ROOT: Service runs as root\n clp-nginx.service loaded active running A high performance web server and a reverse proxy server clp-php-fpm.service loaded active running The CLP PHP 8.1 FastCGI Process Manager console-setup.service loaded active exited Set console font and keymap cron.service loaded active running Regular background program processing daemon dbus.service loaded active running D-Bus System Message Bus Potential issue in service file: /usr/lib/systemd/system/dbus.service └─ RELATIVE_PATH: Could be executing some relative path\n dphys-swapfile.service loaded active exited dphys-swapfile - set up, mount/unmount, and delete a swap file fail2ban.service loaded active running Fail2Ban Service finalrd.service loaded active exited Create final runtime dir for shutdown pivot root fwupd.service loaded active running Firmware update daemon getty@tty1.service loaded active running Getty on tty1 keyboard-setup.service loaded active exited Set the console keyboard layout kmod-static-nodes.service loaded active exited Create List of Static Device Nodes lvm2-monitor.service loaded active exited Monitoring of LVM2 mirrors, snapshots etc. using dmeventd or progress polling mariadb.service loaded active running MariaDB 11.4.9 database server Potential issue in service file: /usr/lib/systemd/system/mariadb.service └─ RELATIVE_PATH: Could be executing some relative path\n memcached.service loaded active running memcached daemon ModemManager.service loaded active running Modem Manager Potential issue in service: ModemManager.service └─ RUNS_AS_ROOT: Service runs as root\n multipathd.service loaded active running Device-Mapper Multipath Device Controller networkd-dispatcher.service loaded active running Dispatcher daemon for systemd-networkd nginx.service loaded active running A high performance web server and a reverse proxy server php7.1-fpm.service loaded active running The PHP 7.1 FastCGI Process Manager php7.2-fpm.service loaded active running The PHP 7.2 FastCGI Process Manager php7.3-fpm.service loaded active running The PHP 7.3 FastCGI Process Manager php7.4-fpm.service loaded active running The PHP 7.4 FastCGI Process Manager php8.0-fpm.service loaded active running The PHP 8.0 FastCGI Process Manager php8.1-fpm.service loaded active running The PHP 8.1 FastCGI Process Manager php8.2-fpm.service loaded active running The PHP 8.2 FastCGI Process Manager php8.3-fpm.service loaded active running The PHP 8.3 FastCGI Process Manager php8.4-fpm.service loaded active running The PHP 8.4 FastCGI Process Manager php8.5-fpm.service loaded active running The PHP 8.5 FastCGI Process Manager polkit.service loaded active running Authorization Manager postfix.service loaded active exited Postfix Mail Transport Agent postfix@-.service loaded active running Postfix Mail Transport Agent (instance -) proftpd.service loaded active running ProFTPD FTP Server qemu-guest-agent.service loaded active running QEMU Guest Agent redis-server.service loaded active running Advanced key-value store Potential issue in service: redis-server.service └─ UNSAFE_CMD: Uses potentially dangerous commands\n rsyslog.service loaded active running System Logging Service setvtrgb.service loaded active exited Set console scheme snapd.apparmor.service loaded active exited Load AppArmor profiles managed internally by snapd snapd.seeded.service loaded active exited Wait until snapd is fully seeded ssh.service loaded active running OpenBSD Secure Shell server sysstat.service loaded active exited Resets System Activity Logs Potential issue in service: sysstat.service └─ RUNS_AS_ROOT: Service runs as root\n systemd-binfmt.service loaded active exited Set Up Additional Binary Formats systemd-fsck@dev-disk-by\x2duuid-e5990cea\x2d1d17\x2d47f1\x2db1f8\x2d100820d9bfb5.service loaded active exited File System Check on /dev/disk/by-uuid/e5990cea-1d17-47f1-b1f8-100820d9bfb5 systemd-journal-flush.service loaded active exited Flush Journal to Persistent Storage Potential issue in service file: /usr/lib/systemd/system/systemd-journal-flush.service └─ RELATIVE_PATH: Could be executing some relative path\n systemd-journald.service loaded active running Journal Service systemd-logind.service loaded active running User Login Management systemd-modules-load.service loaded active exited Load Kernel Modules systemd-networkd-wait-online.service loaded active exited Wait for Network to be Configured systemd-networkd.service loaded active running Network Configuration systemd-random-seed.service loaded active exited Load/Save OS Random Seed systemd-remount-fs.service loaded active exited Remount Root and Kernel File Systems Potential issue in service: systemd-remount-fs.service └─ UNSAFE_CMD: Uses potentially dangerous commands\n systemd-resolved.service loaded active running Network Name Resolution systemd-sysctl.service loaded active exited Apply Kernel Variables systemd-tmpfiles-setup-dev-early.service loaded active exited Create Static Device Nodes in /dev gracefully systemd-tmpfiles-setup-dev.service loaded active exited Create Static Device Nodes in /dev systemd-tmpfiles-setup.service loaded active exited Create Volatile Files and Directories systemd-udev-trigger.service loaded active exited Coldplug All udev Devices Potential issue in service file: /usr/lib/systemd/system/systemd-udev-trigger.service └─ RELATIVE_PATH: Could be executing some relative path\n Potential issue in service: systemd-udev-trigger.service └─ UNSAFE_CMD: Uses potentially dangerous commands\n systemd-udevd.service loaded active running Rule-based Manager for Device Events and Files systemd-update-utmp.service loaded active exited Record System Boot/Shutdown in UTMP systemd-user-sessions.service loaded active exited Permit User Sessions udisks2.service loaded active running Disk Manager ufw.service loaded active exited Uncomplicated firewall unattended-upgrades.service loaded active running Unattended Upgrades Shutdown upower.service loaded active running Daemon for power management user-runtime-dir@1016.service loaded active exited User Runtime Directory /run/user/1016 user@1016.service loaded active running User Manager for UID 1016 uwsgi.service loaded active exited LSB: Start/stop uWSGI server instance(s) varnish.service loaded active running Varnish Cache, a high-performance HTTP accelerator Legend: LOAD → Reflects whether the unit definition was properly loaded. ACTIVE → The high-level unit activation state, i.e. generalization of SUB. SUB → The low-level unit activation state, values depend on unit type. 73 loaded units listed. ══╣ Disabled services: (T1543.002,T1007) chrony-wait.service disabled enabled console-getty.service disabled disabled debug-shell.service disabled disabled iscsid.service disabled enabled mariadb@.service disabled enabled nftables.service disabled enabled postfix-resolvconf.service disabled enabled redis-server@.service disabled enabled rsync.service disabled enabled serial-getty@.service disabled enabled ssh.service disabled enabled systemd-boot-check-no-failures.service disabled disabled systemd-confext.service disabled enabled Potential issue in service file: /usr/lib/systemd/system/systemd-confext.service └─ RELATIVE_PATH: Could be executing some relative path\n systemd-network-generator.service disabled enabled systemd-networkd-wait-online@.service disabled enabled systemd-pcrlock-file-system.service disabled enabled systemd-pcrlock-firmware-code.service disabled enabled systemd-pcrlock-firmware-config.service disabled enabled systemd-pcrlock-machine-id.service disabled enabled systemd-pcrlock-make-policy.service disabled enabled systemd-pcrlock-secureboot-authority.service disabled enabled systemd-pcrlock-secureboot-policy.service disabled enabled systemd-sysext.service disabled enabled Potential issue in service file: /usr/lib/systemd/system/systemd-sysext.service └─ RELATIVE_PATH: Could be executing some relative path\n systemd-time-wait-sync.service disabled disabled upower.service disabled enabled varnishncsa.service disabled enabled 26 unit files listed. ══╣ Additional service files: (T1543.002,T1007)  Potential issue in service file: /etc/systemd/system/hibernate.target.wants/grub-common.service └─ RELATIVE_PATH: Could be executing some relative path\n Potential issue in service file: /etc/systemd/system/hybrid-sleep.target.wants/grub-common.service └─ RELATIVE_PATH: Could be executing some relative path\n Potential issue in service file: /etc/systemd/system/multi-user.target.wants/grub-common.service └─ RELATIVE_PATH: Could be executing some relative path\n Potential issue in service file: /etc/systemd/system/multi-user.target.wants/mariadb.service └─ RELATIVE_PATH: Could be executing some relative path\n ══╣ Service versions and status: (T1543.002,T1007)  [ + ] apparmor [ + ] apport [ + ] chrony [ - ] console-setup.sh [ + ] cron [ - ] cryptdisks [ - ] cryptdisks-early [ + ] dbus [ + ] dphys-swapfile [ + ] fail2ban [ - ] grub-common [ - ] iscsid [ - ] keyboard-setup.sh [ + ] kmod [ + ] mariadb [ + ] memcached [ + ] nginx [ - ] open-iscsi [ - ] open-vm-tools [ + ] php7.1-fpm [ + ] php7.2-fpm [ + ] php7.3-fpm [ + ] php7.4-fpm [ + ] php8.0-fpm [ + ] php8.1-fpm [ + ] php8.2-fpm [ + ] php8.3-fpm [ + ] php8.4-fpm [ + ] php8.5-fpm [ - ] plymouth [ - ] plymouth-log [ + ] postfix [ + ] procps [ + ] proftpd [ + ] qemu-guest-agent [ + ] redis-server [ - ] rsync [ - ] screen-cleanup [ + ] ssh [ + ] sysstat [ + ] ufw [ + ] unattended-upgrades [ - ] uuidd [ + ] uwsgi [ - ] x11-common You can't write on systemd PATH ╔══════════╣ Systemd Information (T1543.002) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#systemd-path---relative-paths ═╣ Systemd version and vulnerabilities? .............. 255.4 8.12 ═╣ Services running as root? .....  ═╣ Running services with dangerous capabilities? ...  ═╣ Services with writable paths? . mariadb.service: Uses relative path 'sync' (from # ExecStartPre=sync) mariadb.service: Uses relative path 'sysctl' (from # ExecStartPre=sysctl -q -w vm.drop_caches=3) mariadb.service: Uses relative path 'numactl' (from # Change ExecStart=numactl --interleave=all /usr/sbin/mariadbd......) ╔══════════╣ Systemd PATH (T1543.002) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#systemd-path---relative-paths PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/snap/bin ╔══════════╣ Analyzing .socket files (T1559) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sockets  ╔══════════╣ Unix Sockets Analysis (T1571,T1049) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sockets /run/clp-fm-php-fpm.sock └─( - Cannot Connect) └─(Owned by root) /run/clp-php-fpm.sock └─( - Cannot Connect) /run/dbus/system_bus_socket └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/fail2ban/fail2ban.sock └─( - Cannot Connect) └─(Owned by root) /run/lxd-installer.socket └─( - Cannot Connect) └─(Owned by root) /run/mysqld/mysqld.sock └─(Read Write Execute (Weak Permissions: 777) - Can Connect) /run/snapd-snap.socket └─(Read Write (Weak Permissions: 666) - Can Connect) └─ HTTP Socket (owned by root:root): └─ Response to /index (limit 30): {"type":"error","status-code":403,"status":"Forbidden","result":{"message":"access denied","kind":"login-required"}} └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/snapd.socket └─(Read Write (Weak Permissions: 666) - Can Connect) └─ HTTP Socket (owned by root:root): └─ Response to /index (limit 30): {"type":"sync","status-code":200,"status":"OK","result":["TBD"]} └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/systemd/fsck.progress └─( - Cannot Connect) └─(Owned by root) /run/systemd/inaccessible/sock └─( - Cannot Connect) └─(Owned by root) /run/systemd/io.systemd.ManagedOOM └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/systemd/io.systemd.sysext └─( - Cannot Connect) └─(Owned by root) /run/systemd/journal/dev-log └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/systemd/journal/io.systemd.journal └─( - Cannot Connect) └─(Owned by root) /run/systemd/journal/socket └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/systemd/journal/stdout └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/systemd/journal/syslog └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/systemd/notify └─(Read Write Execute (Weak Permissions: 777) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/systemd/private └─( - Cannot Connect) └─(Owned by root) /run/systemd/resolve/io.systemd.Resolve └─(Read Write (Weak Permissions: 666) - Can Connect) /run/systemd/resolve/io.systemd.Resolve.Monitor └─( - Cannot Connect) /run/systemd/userdb/io.systemd.DynamicUser └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /run/udev/control └─( - Cannot Connect) └─(Owned by root) /run/uuidd/request └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket /var/run/fail2ban/fail2ban.sock └─( - Cannot Connect) └─(Owned by root) /var/run/mysqld/mysqld.sock └─(Read Write Execute (Weak Permissions: 777) - Can Connect) /var/spool/postfix/dev/log └─(Read Write (Weak Permissions: 666) - Can Connect) └─(Owned by root)  └─High risk: root-owned and writable Unix socket ╔══════════╣ D-Bus Analysis (T1559.001) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#d-bus NAME PID PROCESS USER CONNECTION UNIT SESSION DESCRIPTION :1.10 919 unattended-upgr root :1.10 unattended-upgrades.service - - :1.11679 3193063 systemd-resolve systemd-resolve :1.11679 systemd-resolved.service - - :1.11680 3222738 polkitd polkitd :1.11680 polkit.service - - :1.11681 3222752 ModemManager root :1.11681 ModemManager.service - - :1.11682 3225764 udisksd root :1.11682 udisks2.service - - :1.11696 1 systemd root :1.11696 init.scope - - :1.11697 3277400 upowerd root :1.11697 upower.service - - :1.11698 3277393 systemd-network systemd-network :1.11698 systemd-networkd.service - - :1.11702 3279456 fwupd root :1.11702 fwupd.service - - :1.25691 4174931 systemd bitneo :1.25691 user@1016.service - - :1.27444 2037658 systemd-timedat root :1.27444 systemd-timedated.service - - :1.27445 2038221 busctl abaone :1.27445 php8.3-fpm.service - - :1.5 766 systemd-logind root :1.5 systemd-logind.service - - :1.7 748 networkd-dispat root :1.7 networkd-dispatcher.service - - com.ubuntu.SoftwareProperties - - - (activatable) - - - io.netplan.Netplan - - - (activatable) - - - org.freedesktop.DBus 1 systemd root - init.scope - - org.freedesktop.ModemManager1 3222752 ModemManager root :1.11681 ModemManager.service - - org.freedesktop.PackageKit - - - (activatable) - - - org.freedesktop.PolicyKit1 3222738 polkitd polkitd :1.11680 polkit.service - - org.freedesktop.UDisks2 3225764 udisksd root :1.11682 udisks2.service - - org.freedesktop.UPower 3277400 upowerd root :1.11697 upower.service - - org.freedesktop.bolt - - - (activatable) - - - org.freedesktop.fwupd 3279456 fwupd root :1.11702 fwupd.service - - org.freedesktop.hostname1 - - - (activatable) - - - org.freedesktop.locale1 - - - (activatable) - - - org.freedesktop.login1 766 systemd-logind root :1.5 systemd-logind.service - - org.freedesktop.network1 3277393 systemd-network systemd-network :1.11698 systemd-networkd.service - - org.freedesktop.resolve1 3193063 systemd-resolve systemd-resolve :1.11679 systemd-resolved.service - - org.freedesktop.systemd1 1 systemd root :1.11696 init.scope - - org.freedesktop.thermald - - - (activatable) - - - org.freedesktop.timedate1 2037658 systemd-timedat root :1.27444 systemd-timedated.service - - ╔══════════╣ D-Bus Configuration Files (T1559.001) Analyzing /etc/dbus-1/system.d/com.ubuntu.SoftwareProperties.conf: └─(Allow rules in default context) └─ /exe may indicate tampering, cleanup, or a useful runtime-only binary   ╔═════════════════════╗ ══════════════════════════════╣ Network Information ╠══════════════════════════════  ╚═════════════════════╝ ╔══════════╣ Interfaces (T1016) # symbolic names for networks, see networks(5) for more information link-local 169.254.0.0 eth0: flags=4163 mtu 1500 inet 152.53.49.228 netmask 255.255.252.0 broadcast 152.53.51.255 inet6 2a0a:4cc0:80:1138:9881:f2ff:fedf:8812 prefixlen 64 scopeid 0x0 inet6 fe80::9881:f2ff:fedf:8812 prefixlen 64 scopeid 0x20 ether 9a:81:f2:df:88:12 txqueuelen 1000 (Ethernet) RX packets 963169616 bytes 152370746003 (152.3 GB) RX errors 0 dropped 651420 overruns 0 frame 0 TX packets 295371499 bytes 1700586706822 (1.7 TB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73 mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10 loop txqueuelen 1000 (Local Loopback) RX packets 424260761 bytes 408780643867 (408.7 GB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 424260761 bytes 408780643867 (408.7 GB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ══╣ Routing & policy quick view (T1016) default via 152.53.48.1 dev eth0 proto static 152.53.48.0/22 dev eth0 proto kernel scope link src 152.53.49.228 2a0a:4cc0:80:1138::/64 dev eth0 proto kernel metric 256 pref medium fe80::/64 dev eth0 proto kernel metric 256 pref medium default via fe80::1 dev eth0 proto static metric 1024 onlink pref medium 0: from all lookup local 32766: from all lookup main 32767: from all lookup default ══╣ Virtual/overlay interfaces quick view (T1016) 1: lo: mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1000 2: eth0: mtu 1500 qdisc mq state UP mode DEFAULT group default qlen 1000 ══╣ Network namespaces quick view (T1016) ══╣ Forwarding status (T1016) net.ipv4.ip_forward = 0 net.ipv6.conf.all.forwarding = 0 ╔══════════╣ Hostname, hosts and DNS (T1016,T1018) ══╣ Hostname Information (T1016,T1018) System hostname: web FQDN: web.bitneo.ch ══╣ Hosts File Information (T1016,T1018) Contents of /etc/hosts: 127.0.0.1 localhost 127.0.1.1 web.bitneo.ch web ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters 152.53.49.228 web.bitneo.ch web ══╣ DNS Configuration (T1016,T1018) DNS Servers (resolv.conf): 46.38.225.230 46.38.252.230 2a03:4000:0:1::e1e6 Systemd-resolved configuration: [Resolve] DNS Domain Information: bitneo.ch (none) ╔══════════╣ Networks and neighbours (T1018,T1040) ══╣ Routing Information (T1018,T1040) default via 152.53.48.1 dev eth0 proto static 152.53.48.0/22 dev eth0 proto kernel scope link src 152.53.49.228 Neighbor table: 152.53.49.5 dev eth0 lladdr a6:9a:3f:a9:2b:99 STALE 152.53.48.1 dev eth0 lladdr 00:1c:73:00:00:99 REACHABLE 152.53.49.229 dev eth0 lladdr 66:4c:9e:5c:50:70 STALE 152.53.51.33 dev eth0 lladdr 6a:39:93:c2:3a:04 STALE 152.53.48.214 dev eth0 lladdr 9a:ac:c4:c0:1e:75 STALE 152.53.48.2 dev eth0 lladdr 84:03:28:62:88:32 STALE 152.53.48.179 dev eth0 lladdr 5a:b0:7c:c3:a9:f3 STALE 152.53.49.7 dev eth0 lladdr ca:52:af:f0:0f:60 STALE 152.53.50.15 dev eth0 lladdr 36:eb:1f:f8:29:85 STALE 152.53.48.78 dev eth0 lladdr 96:88:be:83:ab:82 STALE 152.53.48.3 dev eth0 lladdr 84:03:28:62:58:1a STALE 152.53.51.179 dev eth0 lladdr da:5b:50:92:d7:f4 STALE 152.53.49.76 dev eth0 lladdr ca:4b:98:e6:bf:9e STALE 152.53.50.189 dev eth0 lladdr ba:15:40:89:a8:de STALE fe80::e678:76ff:febe:4135 dev eth0 lladdr e4:78:76:be:41:35 router STALE fe80::2edd:e9ff:fe13:3d9 dev eth0 lladdr 2c:dd:e9:13:03:d9 router STALE fe80::2edd:e9ff:fe61:cd67 dev eth0 router FAILED fe80::b692:feff:fea5:56af dev eth0 router FAILED fe80::1 dev eth0 lladdr 00:1c:73:00:00:99 router REACHABLE fe80::2edd:e9ff:fe13:8a7 dev eth0 lladdr 2c:dd:e9:13:08:a7 router STALE 2a0a:4cc0:80:1000::3 dev eth0 FAILED fe80::200:5eff:fe00:300 dev eth0 lladdr 00:00:5e:00:03:00 router STALE fe80::2edd:e9ff:fe12:c7f3 dev eth0 lladdr 2c:dd:e9:12:c7:f3 router STALE fe80::c6ca:2bff:feb3:563f dev eth0 lladdr 00:1c:73:00:00:99 router STALE fe80::c6ca:2bff:feb4:200b dev eth0 lladdr c4:ca:2b:b4:20:0b router STALE 2a0a:4cc0:80:1000::2 dev eth0 FAILED fe80::8603:2807:d262:581a dev eth0 router FAILED fe80::c6ca:2bff:feb4:2aef dev eth0 lladdr c4:ca:2b:b4:2a:ef router STALE fe80::2edd:e9ff:fe13:de4d dev eth0 lladdr 2c:dd:e9:13:de:4d router STALE fe80::c6ca:2bff:feb3:5735 dev eth0 lladdr c4:ca:2b:b3:57:35 router STALE 2a0a:4cc0:80:1000::1 dev eth0 lladdr 00:1c:73:00:00:99 router STALE fe80::21c:73ff:fe00:99 dev eth0 lladdr 00:1c:73:00:00:99 router STALE fe80::8603:2807:d262:8832 dev eth0 router FAILED ══╣ ARP Information (T1018,T1040) Address HWtype HWaddress Flags Mask Iface v2202508292217370012.ha ether a6:9a:3f:a9:2b:99 C eth0 152.53.48.1 ether 00:1c:73:00:00:99 C eth0 v2202608406320508007.lu ether 66:4c:9e:5c:50:70 C eth0 webmaster1.rocksite.at ether 6a:39:93:c2:3a:04 C eth0 server2.orgnet.at ether 9a:ac:c4:c0:1e:75 C eth0 152.53.48.2 ether 84:03:28:62:88:32 C eth0 v2202609408630510308.be ether 5a:b0:7c:c3:a9:f3 C eth0 v2202608287065504888.su ether ca:52:af:f0:0f:60 C eth0 webmaster3.rocksite.at ether 36:eb:1f:f8:29:85 C eth0 webmaster2.rocksite.at ether 96:88:be:83:ab:82 C eth0 152.53.48.3 ether 84:03:28:62:58:1a C eth0 v2202507286491360596.be ether da:5b:50:92:d7:f4 C eth0 v1202603346553443753.yo ether ca:4b:98:e6:bf:9e C eth0 v2202411142479299334.ho ether ba:15:40:89:a8:de C eth0 ══╣ Additional Neighbor Information (T1018,T1040)  ╔══════════╣ Active Ports (T1049) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#open-ports ══╣ Active Ports (netstat) (T1049) tcp 0 0 127.0.0.1:42933 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:14000 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:18008 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:18002 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:18003 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:18000 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:18001 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:18004 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:18005 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:8080 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.54:53 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:3306 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.53:53 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:13000 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:17000 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:8443 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:80 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:21 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:25 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:16000 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:12000 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:443 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:20000 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:6081 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:6379 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:11211 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:15000 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:11000 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:19000 0.0.0.0:* LISTEN - tcp 0 0 127.0.0.1:19001 0.0.0.0:* LISTEN - tcp6 0 0 :::7777 :::* LISTEN - tcp6 0 0 :::8080 :::* LISTEN - tcp6 0 0 :::3306 :::* LISTEN - tcp6 0 0 :::8443 :::* LISTEN - tcp6 0 0 :::80 :::* LISTEN - tcp6 0 0 :::22 :::* LISTEN - tcp6 0 0 :::25 :::* LISTEN - tcp6 0 0 :::443 :::* LISTEN - tcp6 0 0 ::1:6379 :::* LISTEN - tcp6 0 0 :::6081 :::* LISTEN - tcp6 0 0 ::1:11211 :::* LISTEN - ══╣ Local-only listeners (loopback) (T1049) udp UNCONN 0 0 127.0.0.1:323 0.0.0.0:* tcp LISTEN 0 10 127.0.0.1:42933 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:14000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:18008 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:18002 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:18003 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:18000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:18001 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:18004 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:18005 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:13000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:17000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:16000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:12000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:20000 0.0.0.0:* tcp LISTEN 0 511 127.0.0.1:6379 0.0.0.0:* tcp LISTEN 0 1024 127.0.0.1:11211 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:15000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:11000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:19000 0.0.0.0:* tcp LISTEN 0 4096 127.0.0.1:19001 0.0.0.0:* ══╣ Unique listener bind addresses (T1049) * 0.0.0.0 127.0.0.1 127.0.0.53%lo 127.0.0.54 :: ::1 ══╣ Potential local forwarders/relays (T1049) abaone 2038781 0.0 0.0 3604 2048 ? S 09:37 0:00 sed -E s,socat|ssh|-L|-R|-D|ncat|nc,.[1;31;103m&.[0m,g ══╣ Additional Port Information (T1049) Unix Domain Sockets: /home/bitneo/.pm2/pub.sock /home/bitneo/.pm2/rpc.sock /run/chrony/chronyd.sock /run/clp-fm-php-fpm.sock /run/clp-php-fpm.sock /run/dbus/system_bus_socket /run/lvm/lvmpolld.socket /run/lxd-installer.socket /run/snapd-snap.socket /run/snapd.socket /run/systemd/fsck.progress /run/systemd/io.systemd.ManagedOOM /run/systemd/io.systemd.sysext /run/systemd/journal/dev-log /run/systemd/journal/io.systemd.journal /run/systemd/journal/socket /run/systemd/journal/stdout /run/systemd/journal/stdout (lp.sh) /run/systemd/journal/syslog /run/systemd/notify /run/systemd/private /run/systemd/resolve/io.systemd.Resolve /run/systemd/resolve/io.systemd.Resolve.Monitor /run/systemd/userdb/io.systemd.DynamicUser /run/udev/control /run/user/1016/bus /run/user/1016/gnupg/S.dirmngr /run/user/1016/gnupg/S.gpg-agent /run/user/1016/gnupg/S.gpg-agent.browser /run/user/1016/gnupg/S.gpg-agent.extra /run/user/1016/gnupg/S.gpg-agent.ssh /run/user/1016/gnupg/S.keyboxd /run/user/1016/pk-debconf-socket /run/user/1016/snapd-session-agent.socket /run/user/1016/systemd/notify /run/user/1016/systemd/private /run/uuidd/request /var/run/fail2ban/fail2ban.sock /var/run/mysqld/mysqld.sock /var/spool/postfix/dev/log @/org/kernel/linux/storage/multipathd @4261296cb7020f8d/bus/systemd-resolve/bus-api-resolve @4573fc00180c117/bus/systemd-logind/system @4f21a59f552e6a0/bus/systemd-network/bus-api-network @7d9bb6b7bb5f46cd/bus/systemd-timedat/system @ISCSIADM_ABSTRACT_NAMESPACE @cb9cf04be7e60bce/bus/systemd/bus-api-system @f2244aeebd5759ef/bus/systemd/bus-system Path private/anvil private/bounce private/defer private/discard private/error private/lmtp private/local private/proxymap private/proxywrite private/relay private/retry private/rewrite private/scache private/smtp private/tlsmgr private/trace private/uucp private/verify private/virtual public/cleanup public/flush public/pickup public/postlog public/qmgr public/showq Systemd Socket Units: 0.0.0.0:22 ssh.socket ssh.service @/org/kernel/linux/storage/multipathd multipathd.socket multipathd.service @ISCSIADM_ABSTRACT_NAMESPACE iscsid.socket iscsid.service [::]:22 ssh.socket ssh.service kobject-uevent 1 systemd-udevd-kernel.socket systemd-udevd.service route 1361 systemd-networkd.socket systemd-networkd.service /dev/rfkill systemd-rfkill.socket systemd-rfkill.service /run/dbus/system_bus_socket dbus.socket dbus.service /run/dmeventd-client dm-event.socket dm-event.service /run/dmeventd-server dm-event.socket dm-event.service /run/initctl systemd-initctl.socket systemd-initctl.service /run/lvm/lvmpolld.socket lvm2-lvmpolld.socket lvm2-lvmpolld.service /run/lxd-installer.socket lxd-installer.socket - /run/snapd-snap.socket snapd.socket snapd.service /run/snapd.socket snapd.socket snapd.service /run/systemd/fsck.progress systemd-fsckd.socket systemd-fsckd.service /run/systemd/io.systemd.sysext systemd-sysext.socket - /run/systemd/journal/dev-log systemd-journald-dev-log.socket systemd-journald.service /run/systemd/journal/socket systemd-journald.socket systemd-journald.service /run/systemd/journal/stdout systemd-journald.socket systemd-journald.service /run/systemd/journal/syslog syslog.socket rsyslog.service /run/udev/control systemd-udevd-control.socket systemd-udevd.service /run/uuidd/request uuidd.socket uuidd.service Pass --all to see loaded but inactive sockets, too. ╔══════════╣ Network Traffic Analysis Capabilities (T1040)  ══╣ Available Sniffing Tools (T1040) tcpdump is available tcpdump version 4.99.4 Sniffable interfaces according to tcpdump -D: 1.eth0 [Up, Running, Connected] 2.any (Pseudo-device that captures on all interfaces) [Up, Running] 3.lo [Up, Running, Loopback] 4.bluetooth-monitor (Bluetooth Linux Monitor) [Wireless] 5.nflog (Linux netfilter log (NFLOG) interface) [none] 6.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none] 7.dbus-system (D-Bus system bus) [none] 8.dbus-session (D-Bus session bus) [none] ══╣ Network Interfaces Sniffing Capabilities (T1040) Interface lo (loopback): Not sniffable Interface eth0: Not sniffable No sniffable interfaces found ══╣ Running sniffing/traffic reconstruction processes (T1040)  ══╣ Additional Network Analysis Information (T1040) Checking for network monitoring tools... iotop is available ╔══════════╣ Firewall Rules Analysis (T1016)  ══╣ Iptables Rules (T1016) No permission to list iptables rules ══╣ Nftables Rules (T1016) No permission to list nftables rules ══╣ Firewalld Rules (T1016) firewalld Not Found  ══╣ UFW Rules (T1016) UFW is not running ══╣ Forwarding and rp_filter (T1016) net.ipv4.ip_forward = 0 net.ipv6.conf.all.forwarding = 0 net.ipv4.conf.all.rp_filter = 2 ══╣ Additional Firewall Information (T1016) Checking for firewall configuration files... Found configuration file: /etc/nftables.conf Found configuration file: /etc/ufw/user.rules Found configuration file: /etc/ufw/user6.rules Checking for firewall management tools... ╔══════════╣ Inetd/Xinetd Services Analysis (T1049)  ══╣ Inetd Services (T1049) inetd Not Found  ══╣ Xinetd Services (T1049) xinetd Not Found  ══╣ Running Inetd/Xinetd Services (T1049) Active Services (from netstat): Active Services (from ss): Running Service Processes: ══╣ Additional Inetd/Xinetd Information (T1049) Checking for service logs... Found log file: /var/log/syslog Checking for related files... ╔══════════╣ Internet Access? (T1016,T1590) Port 443 is accessible Port 80 is accessible ICMP is accessible DNS accessible Port 443 is accessible with curl ╔══════════╣ Is hostname malicious or leaked? (T1016,T1590) ╚ This will check the public IP and hostname in known malicious lists and leaks to find any relevant information about the host. { "malicious": false, "results": [ { "target": "152.53.49.228", "normalized": "152.53.49.228", "kind": "ip", "malicious": false } ] } ══╣ Proxy discovery (T1016,T1590) ╚ Checking common proxy env vars and apt proxy config   ╔═══════════════════╗ ═══════════════════════════════╣ Users Information ╠═══════════════════════════════  ╚═══════════════════╝ ╔══════════╣ My user (T1033) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#users uid=1006(abaone) gid=1007(abaone) groups=1007(abaone) ╔══════════╣ PGP Keys and Related Files (T1552.004) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#pgp-keys GPG: GPG is installed, listing keys:  NetPGP: netpgpkeys Not Found  PGP Related Files: Found: /home/abaone/.gnupg total 16 drwx------ 2 abaone abaone 4096 Sep 2 09:37 . drwxrwx--- 8 abaone abaone 4096 Sep 2 09:37 .. -rw------- 1 abaone abaone 32 Sep 2 09:37 pubring.kbx -rw------- 1 abaone abaone 1200 Sep 2 09:37 trustdb.gpg ╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d (T1548.003) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid Matching Defaults entries for abaone on web: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty, !mail_badpass User abaone may run the following commands on web: (ALL) NOPASSWD: /usr/bin/clpctlWrapper Matching Defaults entries for abaone on web: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty, !mail_badpass User abaone may run the following commands on web: (ALL) NOPASSWD: /usr/bin/clpctlWrapper ╔══════════╣ Checking sudo tokens (T1548.003) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#reusing-sudo-tokens ptrace protection is enabled (1) Sudo token directory perms: drwx------ 2 root root 60 Jan 26 2026 /var/run/sudo/ts doas Not Found  ╔══════════╣ Checking Pkexec and Polkit (T1548.003,T1548.004,T1068) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#pe---method-2  ══╣ Polkit Binary (T1548.003,T1068)  ══╣ Polkit Policies (T1548.003) Checking /etc/polkit-1/rules.d/: Checking /usr/share/polkit-1/rules.d/: polkit.addAdminRule(function(action, subject) { return ["unix-group:sudo", "unix-group:admin"]; }); /* -*- mode: js; js-indent-level: 4; indent-tabs-mode: nil -*- */ // DO NOT EDIT THIS FILE, it will be overwritten on update // // Default rules for polkit // // See the polkit(8) man page for more information // about configuring polkit. polkit.addAdminRule(function(action, subject) { return ["unix-group:sudo"]; }); // -*- mode: js2 -*- polkit.addRule(function(action, subject) { if ((action.id === "org.freedesktop.bolt.enroll" || action.id === "org.freedesktop.bolt.authorize" || action.id === "org.freedesktop.bolt.manage") && subject.active === true && subject.local === true && subject.isInGroup("sudo")) { return polkit.Result.YES; } }); polkit.addRule(function(action, subject) { if (action.id == "org.freedesktop.fwupd.update-internal" && subject.active == true && subject.local == true && subject.isInGroup("sudo")) { return polkit.Result.YES; } }); polkit.addRule(function(action, subject) { if ((action.id == "org.freedesktop.packagekit.upgrade-system" || action.id == "org.freedesktop.packagekit.trigger-offline-update") && subject.active == true && subject.local == true && subject.isInGroup("sudo")) { return polkit.Result.YES; } }); // This file is part of systemd. // See systemd-networkd.service(8) and polkit(8) for more information. // Allow systemd-networkd to set timezone, get product UUID, // and transient hostname polkit.addRule(function(action, subject) { if ((action.id == "org.freedesktop.hostname1.set-hostname" || action.id == "org.freedesktop.hostname1.get-product-uuid" || action.id == "org.freedesktop.timedate1.set-timezone") && subject.user == "systemd-network") { return polkit.Result.YES; } }); ══╣ Polkit Authentication Agent (T1548.004) polkitd 3222738 0.0 0.0 308164 6016 ? Ssl Jan26 8:10 /usr/lib/polkit-1/polkitd --no-debug ╔══════════╣ Superusers and UID 0 Users (T1087.001) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html  ══╣ Users with UID 0 in /etc/passwd (T1087.001) root:x:0:0:root:/root:/bin/bash ══╣ Users with sudo privileges in sudoers (T1087.001)  ╔══════════╣ Users with console (T1087.001) abaone:x:1006:1007::/home/abaone:/bin/bash bitneo-clp:x:1012:1013::/home/bitneo-clp:/bin/bash bitneo-crm:x:1002:1003::/home/bitneo-crm:/bin/bash bitneo-mk:x:1013:1014::/home/bitneo-mk:/bin/bash bitneo:x:1016:1017::/home/bitneo:/bin/bash freeshark:x:1005:1006::/home/freeshark:/bin/bash i-clean:x:1003:1004::/home/i-clean:/bin/bash mradmin:x:1000:1000::/home/mradmin:/bin/bash physio-performance:x:1004:1005::/home/physio-performance:/bin/bash qqp-aba01:x:1007:1008::/home/qqp-aba01:/bin/bash qqp-hasel:x:1009:1010::/home/qqp-hasel:/bin/bash qqp-unique-auto:x:1015:1016::/home/qqp-unique-auto:/bin/bash root:x:0:0:root:/root:/bin/bash twolink:x:1008:1009::/home/twolink:/bin/bash ╔══════════╣ All users & groups (T1087.001,T1069.001) uid=0(root) gid=0(root) groups=0(root) uid=1(daemon[0m) gid=1(daemon[0m) groups=1(daemon[0m) uid=10(uucp) gid=10(uucp) groups=10(uucp) uid=100(dhcpcd) gid=65534(nogroup) groups=65534(nogroup) uid=1000(mradmin) gid=1000(mradmin) groups=1000(mradmin) uid=1001(clp) gid=1001(clp) groups=1001(clp) uid=1002(bitneo-crm) gid=1003(bitneo-crm) groups=1003(bitneo-crm) uid=1003(i-clean) gid=1004(i-clean) groups=1004(i-clean) uid=1004(physio-performance) gid=1005(physio-performance) groups=1005(physio-performance) uid=1005(freeshark) gid=1006(freeshark) groups=1006(freeshark) uid=1006(abaone) gid=1007(abaone) groups=1007(abaone) uid=1007(qqp-aba01) gid=1008(qqp-aba01) groups=1008(qqp-aba01) uid=1008(twolink) gid=1009(twolink) groups=1009(twolink) uid=1009(qqp-hasel) gid=1010(qqp-hasel) groups=1010(qqp-hasel) uid=101(messagebus) gid=102(messagebus) groups=102(messagebus) uid=1012(bitneo-clp) gid=1013(bitneo-clp) groups=1013(bitneo-clp) uid=1013(bitneo-mk) gid=1014(bitneo-mk) groups=1014(bitneo-mk) uid=1015(qqp-unique-auto) gid=1016(qqp-unique-auto) groups=1016(qqp-unique-auto) uid=1016(bitneo) gid=1017(bitneo) groups=1017(bitneo) uid=102(pollinate) gid=1(daemon[0m) groups=1(daemon[0m) uid=103(syslog) gid=104(syslog) groups=104(syslog),4(adm) uid=104(uuidd) gid=105(uuidd) groups=105(uuidd) uid=105(tcpdump) gid=107(tcpdump) groups=107(tcpdump) uid=106(tss) gid=108(tss) groups=108(tss) uid=107(landscape) gid=109(landscape) groups=109(landscape) uid=108(usbmux) gid=46(plugdev) groups=46(plugdev) uid=109(sshd) gid=65534(nogroup) groups=65534(nogroup) uid=110(_chrony) gid=110(_chrony) groups=110(_chrony) uid=111(redis) gid=111(redis) groups=111(redis) uid=112(postfix) gid=113(postfix) groups=113(postfix) uid=113(mysql) gid=115(mysql) groups=115(mysql) uid=114(memcache) gid=116(memcache) groups=116(memcache) uid=115(proftpd) gid=65534(nogroup) groups=65534(nogroup) uid=116(ftp) gid=65534(nogroup) groups=65534(nogroup) uid=117(varnish) gid=117(varnish) groups=117(varnish) uid=118(vcache) gid=117(varnish) groups=117(varnish) uid=119(varnishlog) gid=117(varnish) groups=117(varnish) uid=13(proxy) gid=13(proxy) groups=13(proxy) uid=2(bin) gid=2(bin) groups=2(bin) uid=3(sys) gid=3(sys) groups=3(sys) uid=33(www-data) gid=33(www-data) groups=33(www-data) uid=34(backup) gid=34(backup) groups=34(backup) uid=38(list) gid=38(list) groups=38(list) uid=39(irc) gid=39(irc) groups=39(irc) uid=4(sync) gid=65534(nogroup) groups=65534(nogroup) uid=42(_apt) gid=65534(nogroup) groups=65534(nogroup) uid=5(games) gid=60(games) groups=60(games) uid=6(man) gid=12(man) groups=12(man) uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup) uid=7(lp) gid=7(lp) groups=7(lp) uid=8(mail) gid=8(mail) groups=8(mail) uid=9(news) gid=9(news) groups=9(news) uid=989(fwupd-refresh) gid=989(fwupd-refresh) groups=989(fwupd-refresh) uid=991(polkitd) gid=991(polkitd) groups=991(polkitd) uid=992(systemd-resolve) gid=992(systemd-resolve) groups=992(systemd-resolve) uid=997(systemd-timesync) gid=997(systemd-timesync) groups=997(systemd-timesync) uid=998(systemd-network) gid=998(systemd-network) groups=998(systemd-network) ╔══════════╣ Currently Logged in Users (T1033)  ══╣ Basic user information (T1033)  09:37:57 up 345 days, 10:21, 4 users, load average: 0.51, 0.25, 0.10 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ══╣ Active sessions (T1033)  09:37:57 up 345 days, 10:21, 4 users, load average: 0.51, 0.25, 0.10 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ══╣ Logged in users (utmp) (T1033)  system boot Sep 21 23:16 run-level 5 Sep 21 23:16 LOGIN tty1 Sep 21 23:16 1261 id=tty1 pts/0 Feb 18 18:07 4076748 id=ts/0 term=0 exit=0 pts/1 Sep 2 09:37 2039661 id=ts/1 term=0 exit=0 pts/2 Jan 26 09:59 2879422 id=ts/2 term=0 exit=0 pts/3 Jan 26 09:47 2879474 id=ts/3 term=0 exit=0 ══╣ SSH sessions (T1033)  ══╣ Screen sessions (T1033) No Sockets found in /run/screen/S-abaone. ══╣ Tmux sessions (T1033)  ╔══════════╣ Last Logons and Login History (T1033)  ══╣ Last logins (T1033)  wtmp begins Tue Sep 1 23:58:02 2026 ══╣ Failed login attempts (T1033)  ══╣ Recent logins from auth.log (limit 20) (T1033)  ══╣ Last time logon each user (T1033) Username Port From Latest mradmin pts/0 157.143.100.122 Mon Jan 26 09:47:12 +0100 2026 bitneo-crm pts/0 88.218.25.172 Sun Dec 29 21:37:21 +0100 2024 qqp-unique-auto pts/1 157.143.100.122 Mon Feb 16 15:19:14 +0100 2026 ╔══════════╣ Password policy (T1201) PASS_MAX_DAYS 99999 PASS_MIN_DAYS 0 PASS_WARN_AGE 7 ENCRYPT_METHOD SHA512 ╔══════════╣ Testing 'su' as other users with shell using as passwords: null pwd, the username and top2000pwds   Bruteforcing user root...  You can login as root using password:   You can login as root using password: plymouth Bruteforcing user mradmin...  You can login as mradmin using password:   You can login as mradmin using password: plymouth Bruteforcing user bitneo-crm...  You can login as bitneo-crm using password:   You can login as bitneo-crm using password: plymouth Bruteforcing user i-clean...  You can login as i-clean using password:   You can login as i-clean using password: plymouth Bruteforcing user physio-performance...  You can login as physio-performance using password:   You can login as physio-performance using password: plymouth Bruteforcing user freeshark...  You can login as freeshark using password:   You can login as freeshark using password: plymouth Bruteforcing user abaone...  You can login as abaone using password:   You can login as abaone using password: plymouth Bruteforcing user qqp-aba01...  You can login as qqp-aba01 using password:   You can login as qqp-aba01 using password: plymouth Bruteforcing user twolink...  You can login as twolink using password:   You can login as twolink using password: plymouth Bruteforcing user qqp-hasel...  You can login as qqp-hasel using password:   You can login as qqp-hasel using password: plymouth Bruteforcing user bitneo-clp...  You can login as bitneo-clp using password:   You can login as bitneo-clp using password: plymouth Bruteforcing user bitneo-mk...  You can login as bitneo-mk using password:   You can login as bitneo-mk using password: plymouth Bruteforcing user qqp-unique-auto...  You can login as qqp-unique-auto using password:   You can login as qqp-unique-auto using password: plymouth Bruteforcing user bitneo...  You can login as bitneo using password:   You can login as bitneo using password: plymouth ╔══════════╣ Do not forget to execute 'sudo -l' without password or with valid password (if you know it)!!  ╔══════════╣ Actual Group Memberships via newgrp (T1069.001)   ╔══════════════════════╗ ═════════════════════════════╣ Software Information ╠═════════════════════════════  ╚══════════════════════╝ ╔══════════╣ Useful software (T1082) /usr/bin/base64 /usr/bin/curl /usr/bin/g++ /usr/bin/gcc /usr/sbin/lxc /usr/bin/make /usr/bin/nc /usr/bin/netcat /usr/bin/perl /usr/bin/php /usr/bin/ping /usr/bin/python3 /usr/bin/socat /usr/bin/sudo /usr/bin/wget ╔══════════╣ Installed Compilers (T1587.001) ii g++ 4:13.2.0-7ubuntu1 amd64 GNU C++ compiler ii g++-13 13.3.0-6ubuntu2~24.04 amd64 GNU C++ compiler ii g++-13-x86-64-linux-gnu 13.3.0-6ubuntu2~24.04 amd64 GNU C++ compiler for x86_64-linux-gnu architecture ii g++-x86-64-linux-gnu 4:13.2.0-7ubuntu1 amd64 GNU C++ compiler for the amd64 architecture ii gcc 4:13.2.0-7ubuntu1 amd64 GNU C compiler ii gcc-13 13.3.0-6ubuntu2~24.04 amd64 GNU C compiler ii gcc-13-x86-64-linux-gnu 13.3.0-6ubuntu2~24.04 amd64 GNU C compiler for the x86_64-linux-gnu architecture ii gcc-x86-64-linux-gnu 4:13.2.0-7ubuntu1 amd64 GNU C compiler for the amd64 architecture ii rpcsvc-proto 1.4.2-0ubuntu7 amd64 RPC protocol compiler and definitions /usr/bin/gcc /usr/bin/g++ ╔══════════╣ Analyzing Apache-Nginx Files (limit 70) Apache version: apache2 Not Found httpd Not Found  Nginx version: ══╣ Nginx modules ngx_http_auth_pam_module.so ngx_http_brotli_filter_module.so ngx_http_brotli_static_module.so ngx_http_dav_ext_module.so ngx_http_geoip_module.so ngx_http_image_filter_module.so ngx_http_subs_filter_module.so ngx_http_upstream_fair_module.so ngx_http_xslt_filter_module.so ngx_mail_module.so ngx_pagespeed.so ngx_stream_module.so ══╣ PHP exec extensions  -rw-r--r-- 1 root root 70782 May 9 2024 /etc/php/7.1/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On ibase.allow_persistent = 1 mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 71167 May 9 2024 /etc/php/7.1/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On ibase.allow_persistent = 1 mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 70640 May 8 2024 /etc/php/7.2/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On ibase.allow_persistent = 1 mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 71024 May 8 2024 /etc/php/7.2/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On ibase.allow_persistent = 1 mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 71629 May 8 2024 /etc/php/7.3/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On ibase.allow_persistent = 1 mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 72012 May 8 2024 /etc/php/7.3/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On ibase.allow_persistent = 1 mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73147 May 8 2024 /etc/php/7.4/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73542 May 8 2024 /etc/php/7.4/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 72593 May 8 2024 /etc/php/8.0/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73290 May 8 2024 /etc/php/8.0/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73072 Nov 21 2024 /etc/php/8.1/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73372 Jan 26 2026 /etc/php/8.1/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73379 Nov 21 2024 /etc/php/8.2/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73380 Nov 21 2024 /etc/php/8.2/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73870 Nov 21 2024 /etc/php/8.3/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 73871 Nov 21 2024 /etc/php/8.3/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 69521 Nov 21 2024 /etc/php/8.4/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 69522 Nov 21 2024 /etc/php/8.4/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 70707 Jan 22 2026 /etc/php/8.5/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 70708 Jan 22 2026 /etc/php/8.5/fpm/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 389 Nov 12 2024 /etc/default/nginx -rwxr-xr-x 1 root root 4579 Nov 12 2024 /etc/init.d/nginx -rw-r--r-- 1 root root 329 Nov 12 2024 /etc/logrotate.d/nginx drwx------ 12 root root 4096 Jan 26 2026 /etc/nginx -rw-r--r-- 1 root root 374 Nov 12 2024 /etc/ufw/applications.d/nginx drwxr-xr-x 3 root root 4096 Nov 29 2024 /usr/lib/nginx -rwxr-xr-x 1 root root 1379888 Apr 28 2025 /usr/sbin/nginx drwxr-xr-x 2 root root 4096 Jan 26 2026 /usr/share/doc/nginx drwxr-xr-x 4 root root 4096 Nov 29 2024 /usr/share/nginx -rw-r--r-- 1 root root 108 Apr 28 2025 /usr/share/nginx/modules-available/mod-ngx-brotli.conf load_module modules/ngx_http_brotli_filter_module.so; load_module modules/ngx_http_brotli_static_module.so; -rw-r--r-- 1 root root 42 Apr 28 2025 /usr/share/nginx/modules-available/mod-stream.conf load_module modules/ngx_stream_module.so; -rw-r--r-- 1 root root 46 Apr 28 2025 /usr/share/nginx/modules-available/mod-http-geoip.conf load_module modules/ngx_http_geoip_module.so; -rw-r--r-- 1 root root 54 Apr 28 2025 /usr/share/nginx/modules-available/mod-http-upstream-fair.conf load_module modules/ngx_http_upstream_fair_module.so; -rw-r--r-- 1 root root 52 Apr 28 2025 /usr/share/nginx/modules-available/mod-http-xslt-filter.conf load_module modules/ngx_http_xslt_filter_module.so; -rw-r--r-- 1 root root 40 Apr 28 2025 /usr/share/nginx/modules-available/mod-mail.conf load_module modules/ngx_mail_module.so; -rw-r--r-- 1 root root 49 Apr 28 2025 /usr/share/nginx/modules-available/mod-http-auth-pam.conf load_module modules/ngx_http_auth_pam_module.so; -rw-r--r-- 1 root root 48 Apr 28 2025 /usr/share/nginx/modules-available/mod-http-dav-ext.conf load_module modules/ngx_http_dav_ext_module.so; -rw-r--r-- 1 root root 52 Apr 28 2025 /usr/share/nginx/modules-available/mod-http-subs-filter.conf load_module modules/ngx_http_subs_filter_module.so; -rw-r--r-- 1 root root 53 Apr 28 2025 /usr/share/nginx/modules-available/mod-http-image-filter.conf load_module modules/ngx_http_image_filter_module.so; drwxrwxrwx 7 root root 4096 Nov 29 2024 /var/lib/nginx drwxr-xr-x 2 root adm 4096 Sep 1 23:58 /var/log/nginx ╔══════════╣ Browser Profiles (T1539,T1217) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#browser-data  ══╣ Needrestart interpreter-scanner LPE (CVE-2024-48990) (T1068) ╚ https://ubuntu.com/security/CVE-2024-48990 needrestart package: 3.6-7ubuntu4.5 (dpkg) Vendor fixed version for ubuntu noble: 3.6-7ubuntu4.3 needrestart 3.6-7ubuntu4.5 is not vulnerable to CVE-2024-48990 according to the known vendor/upstream fixed version Effective interpreter scanning: 1 (0=disabled mitigation, 1=enabled/default) ╔══════════╣ Analyzing MariaDB Files (limit 70) -rw-r--r-- 1 root root 1126 Oct 30 2024 /etc/mysql/mariadb.cnf [client-server] socket = /run/mysqld/mysqld.sock !includedir /etc/mysql/conf.d/ !includedir /etc/mysql/mariadb.conf.d/ -rw------- 1 root root 544 Nov 29 2024 /etc/mysql/debian.cnf ╔══════════╣ Analyzing Varnish Files (limit 70) -rw-r--r-- 1 root root 218 May 9 2024 /etc/logrotate.d/varnish drwxr-xr-x 2 root root 4096 Nov 29 2024 /etc/varnish -rw-r--r-- 1 root root 4406 May 9 2024 /etc/varnish/default.vcl drwxr-xr-x 3 root root 4096 Nov 29 2024 /usr/lib/varnish drwxr-xr-x 3 root root 4096 Nov 29 2024 /usr/share/doc/varnish -rw-r--r-- 1 root root 809 May 9 2024 /usr/share/lintian/overrides/varnish drwxr-xr-x 4 root root 4096 Nov 29 2024 /usr/share/varnish drwxr-xr-x 4 root root 4096 Nov 29 2024 /var/lib/varnish drwxr-x--- 2 varnishlog varnish 4096 Nov 29 2024 /var/log/varnish ╔══════════╣ Analyzing Mongo Files (limit 70) Version: mongo Not Found mongod Not Found  -rw-r--r-- 1 root root 2279 Nov 9 2022 /etc/fail2ban/filter.d/mongodb-auth.conf [Definition] failregex = ^\s+\[conn(?P<__connid>\d+)\] Failed to authenticate [^\n]+\s+\[conn(?P=__connid)\] end connection ignoreregex = [Init] maxlines = 10 ╔══════════╣ Analyzing Rsync Files (limit 70) -rw-r--r-- 1 root root 1044 Apr 12 2024 /usr/share/doc/rsync/examples/rsyncd.conf [ftp] comment = public archive path = /var/www/pub use chroot = yes lock file = /var/lock/rsyncd read only = yes list = yes uid = nobody gid = nogroup strict modes = yes ignore errors = no ignore nonreadable = yes transfer logging = no timeout = 600 refuse options = checksum dry-run dont compress = *.gz *.tgz *.zip *.z *.rpm *.deb *.iso *.bz2 *.tbz ╔══════════╣ Analyzing PAM Auth Files (limit 70) drwxr-xr-x 2 root root 4096 Jan 26 2026 /etc/pam.d -rw-r--r-- 1 root root 2164 Nov 29 2024 /etc/pam.d/sshd account required pam_access.so account required pam_nologin.so session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close session required pam_loginuid.so session optional pam_keyinit.so force revoke session optional pam_motd.so motd=/run/motd.dynamic session optional pam_motd.so noupdate session optional pam_mail.so standard noenv # [1] session required pam_limits.so session required pam_env.so # [1] session required pam_env.so user_readenv=1 envfile=/etc/default/locale session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open drwxr-xr-x 2 root root 4096 Jan 26 2026 /etc/pam.d -rw-r--r-- 1 root root 4118 Apr 9 2024 /etc/pam.d/login -rw-r--r-- 1 root root 92 Feb 22 2024 /etc/pam.d/chpasswd -rw-r--r-- 1 root root 581 Feb 22 2024 /etc/pam.d/chsh auth sufficient pam_rootok.so -rw-r--r-- 1 root root 137 Mar 3 2024 /etc/pam.d/su-l -rw-r--r-- 1 root root 138 Mar 3 2024 /etc/pam.d/runuser-l -rw-r--r-- 1 root root 92 Feb 22 2024 /etc/pam.d/passwd -rw-r--r-- 1 root root 1468 Jan 26 2026 /etc/pam.d/common-session session [default=1] pam_permit.so session required pam_permit.so -rw-r--r-- 1 root root 2164 Nov 29 2024 /etc/pam.d/sshd -rw-r--r-- 1 root root 384 Feb 22 2024 /etc/pam.d/chfn auth sufficient pam_rootok.so -rw-r--r-- 1 root root 315 Jan 29 2024 /etc/pam.d/sudo-i -rw-r--r-- 1 root root 1242 Jan 26 2026 /etc/pam.d/common-auth auth [success=1 default=ignore] pam_unix.so nullok auth required pam_permit.so -rw-r--r-- 1 root root 1620 Jan 26 2026 /etc/pam.d/common-password password required pam_permit.so -rw-r--r-- 1 root root 330 Jan 29 2024 /etc/pam.d/sudo -rw-r--r-- 1 root root 385 May 9 2024 /etc/pam.d/proftpd -rw-r--r-- 1 root root 606 Apr 23 2024 /etc/pam.d/cron -rw-r--r-- 1 root root 1435 Jan 26 2026 /etc/pam.d/common-session-noninteractive session [default=1] pam_permit.so session required pam_permit.so -rw-r--r-- 1 root root 520 Oct 13 2022 /etc/pam.d/other -rw-r--r-- 1 root root 143 Mar 3 2024 /etc/pam.d/runuser auth sufficient pam_rootok.so -rw-r--r-- 1 root root 2259 Mar 3 2024 /etc/pam.d/su auth sufficient pam_rootok.so -rw-r--r-- 1 root root 92 Feb 22 2024 /etc/pam.d/newusers -rw-r--r-- 1 root root 119 Apr 23 2024 /etc/pam.d/vmtoolsd -rw-r--r-- 1 root root 1208 Jan 26 2026 /etc/pam.d/common-account account required pam_permit.so ╔══════════╣ Analyzing Ldap Files (limit 70) The password hash is from the {SSHA} to 'structural' drwxr-xr-x 2 root root 4096 Jan 26 2026 /etc/ldap ╔══════════╣ Analyzing Cloud Init Files (limit 70) -rw-r--r-- 1 root root 3718 Sep 21 2024 /etc/cloud/cloud.cfg lock_passwd: True ╔══════════╣ Analyzing Keyring Files (limit 70) drwxr-xr-x 2 root root 4096 Mar 31 2024 /etc/apt/keyrings drwxr-xr-x 2 root root 4096 Jan 26 2026 /usr/share/keyrings ╔══════════╣ Analyzing Postfix Files (limit 70) -rw-r--r-- 1 root root 51 Nov 29 2024 /etc/aliases -rw-r--r-- 1 root root 2176 Feb 5 2024 /usr/share/X11/xkb/keycodes/aliases -rw-r--r-- 1 root root 12371 Apr 23 2024 /usr/share/mime/aliases -rwxr-xr-x 1 root root 3089 Mar 5 2024 /etc/init.d/postfix -rw-r--r-- 1 root root 30 Apr 8 2024 /etc/insserv.conf.d/postfix -rwxr-xr-x 1 root root 802 Apr 8 2024 /etc/network/if-down.d/postfix -rwxr-xr-x 1 root root 1185 Apr 8 2024 /etc/network/if-up.d/postfix drwxr-xr-x 5 root root 4096 Nov 29 2024 /etc/postfix -rw-r--r-- 1 root root 7048 Nov 29 2024 /etc/postfix/master.cf # flags=DRXhu user=vmail argv=/usr/bin/maildrop -d ${recipient} # flags=DRX user=cyrus argv=/cyrus/bin/deliver -e -r ${sender} -m ${extension} ${user} # flags=R user=cyrus argv=/cyrus/bin/deliver -e -m ${extension} ${user} flags=Fqhu user=uucp argv=uux -r -n -z -a$sender - $nexthop!rmail ($recipient) # flags=F user=ftn argv=/usr/lib/ifmail/ifmail -r $nexthop ($recipient) # flags=Fq. user=bsmtp argv=/usr/lib/bsmtp/bsmtp -t$nexthop -f$sender $recipient # flags=R user=scalemail argv=/usr/lib/scalemail/bin/scalemail-store ${nexthop} ${user} ${extension} # flags=FRX user=list argv=/usr/lib/mailman/bin/postfix-to-mailman.py ${nexthop} ${user} -rwxr-xr-x 1 root root 802 Apr 8 2024 /etc/ppp/ip-down.d/postfix -rwxr-xr-x 1 root root 1185 Apr 8 2024 /etc/ppp/ip-up.d/postfix -rwxr-xr-x 1 root root 441 Apr 8 2024 /etc/resolvconf/update-libc.d/postfix -rw-r--r-- 1 root root 361 Apr 8 2024 /etc/ufw/applications.d/postfix -rwxr-xr-x 1 root root 802 Apr 8 2024 /usr/lib/networkd-dispatcher/off.d/postfix -rwxr-xr-x 1 root root 1185 Apr 8 2024 /usr/lib/networkd-dispatcher/routable.d/postfix drwxr-xr-x 3 root root 4096 Nov 29 2024 /usr/lib/postfix -rw-r--r-- 1 root root 16251 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/logs/postfix -rwxr-xr-x 1 root root 18816 Apr 8 2024 /usr/sbin/postfix -rw-r--r-- 1 root root 761 Apr 23 2024 /usr/share/bash-completion/completions/postfix drwxr-xr-x 2 root root 4096 Nov 29 2024 /usr/share/doc/postfix -rw-r--r-- 1 root root 347 Mar 5 2024 /usr/share/lintian/overrides/postfix drwxr-xr-x 2 root root 4096 Nov 29 2024 /usr/share/postfix drwxr-xr-x 2 postfix postfix 4096 Nov 29 2024 /var/lib/postfix drwxr-xr-x 20 root root 4096 Nov 29 2024 /var/spool/postfix ╔══════════╣ Analyzing Htpasswd Files (limit 70) -rw-r--r-- 1 root root 47 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htpasswd username:$apr1$1f5oQUl4$21lLXSN7xQOPtNsj5s4Nk/ -rw-r--r-- 1 root root 47 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htpasswd username:$apr1$uUMsOjCQ$.BzXClI/B/vZKddgIAJCR. -rw-r--r-- 1 root root 62 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htpasswd username:digest private area:fad48d3a7c63f61b5b3567a4105bbb04 -rw-r--r-- 1 root root 117 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htpasswd username:digest anon:25e4077a9344ceb1a88f2a62c9fb60d8 05bbb04 anonymous:digest anon:faa4e5870970cf935bb9674776e6b26a -rw-r--r-- 1 root root 62 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htpasswd username:digest private area:fad48d3a7c63f61b5b3567a4105bbb04 -rw-r--r-- 1 root root 62 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htpasswd username:wrongrelm:99cd340e1283c6d0ab34734bd47bdc30 4105bbb04 ╔══════════╣ Analyzing Proxy Config Files (limit 70) -rw-r--r-- 1 root root 19 Nov 29 2024 /etc/environment ╔══════════╣ Analyzing FTP Files (limit 70) -rw-r--r-- 1 root root 637 Nov 9 2022 /etc/fail2ban/filter.d/vsftpd.conf -rw-r--r-- 1 root root 69 May 9 2024 /etc/php/7.1/mods-available/ftp.ini -rw-r--r-- 1 root root 69 May 8 2024 /etc/php/7.2/mods-available/ftp.ini -rw-r--r-- 1 root root 69 May 8 2024 /etc/php/7.3/mods-available/ftp.ini -rw-r--r-- 1 root root 69 May 8 2024 /etc/php/7.4/mods-available/ftp.ini -rw-r--r-- 1 root root 69 May 8 2024 /etc/php/8.0/mods-available/ftp.ini -rw-r--r-- 1 root root 69 Nov 21 2024 /etc/php/8.1/mods-available/ftp.ini -rw-r--r-- 1 root root 69 Nov 21 2024 /etc/php/8.2/mods-available/ftp.ini -rw-r--r-- 1 root root 69 Nov 21 2024 /etc/php/8.3/mods-available/ftp.ini -rw-r--r-- 1 root root 69 Nov 21 2024 /etc/php/8.4/mods-available/ftp.ini -rw-r--r-- 1 root root 69 Jan 22 2026 /etc/php/8.5/mods-available/ftp.ini -rw-r--r-- 1 root root 69 Jul 22 2025 /usr/share/php7.1-common/common/ftp.ini -rw-r--r-- 1 root root 69 Jul 22 2025 /usr/share/php7.2-common/common/ftp.ini -rw-r--r-- 1 root root 69 Jul 22 2025 /usr/share/php7.3-common/common/ftp.ini -rw-r--r-- 1 root root 69 Jul 22 2025 /usr/share/php7.4-common/common/ftp.ini -rw-r--r-- 1 root root 69 Jul 22 2025 /usr/share/php8.0-common/common/ftp.ini -rw-r--r-- 1 root root 69 Dec 30 2025 /usr/share/php8.1-common/common/ftp.ini -rw-r--r-- 1 root root 69 Dec 30 2025 /usr/share/php8.2-common/common/ftp.ini -rw-r--r-- 1 root root 69 Jan 22 2026 /usr/share/php8.3-common/common/ftp.ini -rw-r--r-- 1 root root 69 Jan 22 2026 /usr/share/php8.4-common/common/ftp.ini -rw-r--r-- 1 root root 69 Jan 22 2026 /usr/share/php8.5-common/common/ftp.ini ╔══════════╣ Analyzing DNS Files (limit 70) -rw-r--r-- 1 root root 826 Apr 23 2024 /usr/share/bash-completion/completions/bind -rw-r--r-- 1 root root 826 Apr 23 2024 /usr/share/bash-completion/completions/bind ╔══════════╣ Analyzing Cacti Files (limit 70) drwxr-xr-x 2 root root 4096 Nov 29 2024 /usr/share/doc/fail2ban/examples/cacti ╔══════════╣ Analyzing Interesting logs Files (limit 70) -rw-r----- 1 root adm 0 Nov 29 2024 /var/log/nginx/access.log -rw-r----- 1 root adm 92075 Sep 1 23:58 /var/log/nginx/error.log ╔══════════╣ Analyzing Other Interesting Files (limit 70) -rw-r--r-- 1 root root 3771 Mar 31 2024 /etc/skel/.bashrc -rw-r--r-- 1 root root 807 Mar 31 2024 /etc/skel/.profile ╔══════════╣ Analyzing Windows Files (limit 70)  lrwxrwxrwx 1 root root 22 Oct 30 2024 /etc/alternatives/my.cnf -> /etc/mysql/mariadb.cnf lrwxrwxrwx 1 root root 11 Nov 4 2025 /etc/mysql/my.cnf -> mariadb.cnf -rw-r--r-- 1 root root 52 Nov 29 2024 /var/lib/dpkg/alternatives/my.cnf ╔══════════╣ Analyzing FreeIPA Files (limit 70) drwxr-xr-x 2 root root 4096 Apr 26 2024 /usr/src/linux-headers-6.8.0-31/drivers/net/ipa drwxr-xr-x 2 root root 4096 Nov 29 2024 /usr/src/linux-headers-6.8.0-49/drivers/net/ipa drwxr-xr-x 2 root root 4096 Jan 26 2026 /usr/src/linux-headers-6.8.0-90/drivers/net/ipa ╔══════════╣ Searching mysql credentials and exec (T1552.001) Found readable /etc/mysql/my.cnf [client-server] socket = /run/mysqld/mysqld.sock !includedir /etc/mysql/conf.d/ !includedir /etc/mysql/mariadb.conf.d/ ╔══════════╣ MySQL version (T1552.001) mysql from 11.4.9-MariaDB, client 15.2 for debian-linux-gnu (x86_64) using EditLine wrapper ═╣ MySQL connection using default root/root ........... No ═╣ MySQL connection using root/toor ................... No ═╣ MySQL connection using root/NOPASS ................. No  MySQL process not found. ╔══════════╣ Analyzing PGP-GPG Files (limit 70) /usr/bin/gpg netpgpkeys Not Found netpgp Not Found  -rw-r--r-- 1 root root 1769 Jan 26 2026 /etc/apt/trusted.gpg.d/cloudpanel-keyring.gpg -rw-r--r-- 1 root root 4797 Nov 29 2024 /etc/apt/trusted.gpg.d/mariadb.gpg -rw-r--r-- 1 root root 1165 Nov 28 2023 /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg -rw-r--r-- 1 root root 1167 Nov 28 2023 /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg ╔══════════╣ Checking for PackageKit Pack2TheRoot (CVE-2026-41651) (T1068) ╚ https://github.security.telekom.com/2026/04/pack2theroot-linux-local-privilege-escalation.html PackageKit version detected: 1.2.8-2ubuntu1.4 Vulnerable to CVE-2026-41651 (Pack2TheRoot) - PackageKit 1.2.8-2ubuntu1.4 is below the Ubuntu 24.04 fixed version: 1.2.8-2ubuntu1.5 ══╣ PackageKit daemon reachability pkcon/pkmon present - daemon can be activated on demand via D-Bus ══╣ IOC: emitted_finished assertion failures No emitted_finished assertion failures found in PackageKit logs ╔══════════╣ Searching screen sessions (T1563) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#open-shell-sessions Screen version 4.09.01 (GNU) 20-Aug-23 No Sockets found in /run/screen/S-abaone.   /run/screen/S-abaone══╣ Checking other users screen sessions (T1563) User root screen sessions: Must run suid root for multiuser support.  User mradmin screen sessions: Must run suid root for multiuser support.  User bitneo-crm screen sessions: Must run suid root for multiuser support.  User i-clean screen sessions: Must run suid root for multiuser support.  User physio-performance screen sessions: Must run suid root for multiuser support.  User freeshark screen sessions: Must run suid root for multiuser support.  User qqp-aba01 screen sessions: Must run suid root for multiuser support.  User twolink screen sessions: Must run suid root for multiuser support.  User qqp-hasel screen sessions: Must run suid root for multiuser support.  User bitneo-clp screen sessions: Must run suid root for multiuser support.  User bitneo-mk screen sessions: Must run suid root for multiuser support.  User qqp-unique-auto screen sessions: Must run suid root for multiuser support.  User bitneo screen sessions: Must run suid root for multiuser support.  ╔══════════╣ Searching uncommon passwd files (splunk) (T1552.001) passwd file: /etc/pam.d/passwd passwd file: /etc/passwd passwd file: /usr/share/bash-completion/completions/passwd passwd file: /usr/share/lintian/overrides/passwd ╔══════════╣ Searching ssl/ssh files (T1552.004,T1021.004) ╔══════════╣ Analyzing SSH Files (limit 70)  -rw-r--r-- 1 root root 186 Nov 29 2024 /etc/ssh/ssh_host_ecdsa_key.pub -rw-r--r-- 1 root root 106 Nov 29 2024 /etc/ssh/ssh_host_ed25519_key.pub -rw-r--r-- 1 root root 578 Nov 29 2024 /etc/ssh/ssh_host_rsa_key.pub PermitRootLogin yes PermitRootLogin yes UsePAM yes PasswordAuthentication yes PermitRootLogin yes Port 5555 Port 22 ══╣ Some certificates were found (out limited): (T1552.004,T1021.004) /etc/pki/fwupd-metadata/LVFS-CA.pem /etc/pki/fwupd/LVFS-CA.pem /etc/pollinate/entropy.ubuntu.com.pem /etc/ssl/certs/ACCVRAIZ1.pem /etc/ssl/certs/AC_RAIZ_FNMT-RCM.pem /etc/ssl/certs/AC_RAIZ_FNMT-RCM_SERVIDORES_SEGUROS.pem /etc/ssl/certs/ANF_Secure_Server_Root_CA.pem /etc/ssl/certs/Actalis_Authentication_Root_CA.pem /etc/ssl/certs/AffirmTrust_Commercial.pem /etc/ssl/certs/AffirmTrust_Networking.pem /etc/ssl/certs/AffirmTrust_Premium.pem /etc/ssl/certs/AffirmTrust_Premium_ECC.pem /etc/ssl/certs/Amazon_Root_CA_1.pem /etc/ssl/certs/Amazon_Root_CA_2.pem /etc/ssl/certs/Amazon_Root_CA_3.pem /etc/ssl/certs/Amazon_Root_CA_4.pem /etc/ssl/certs/Atos_TrustedRoot_2011.pem /etc/ssl/certs/Atos_TrustedRoot_Root_CA_ECC_TLS_2021.pem /etc/ssl/certs/Atos_TrustedRoot_Root_CA_RSA_TLS_2021.pem /etc/ssl/certs/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem ══╣ Some SSH Agent files were found: (T1552.004,T1021.004) /run/systemd/units/invocation:clp-agent.service /run/systemd/units/invocation:qemu-guest-agent.service ══╣ Some home ssh config file was found (T1552.004,T1021.004) /usr/share/openssh/sshd_config Include /etc/ssh/sshd_config.d/*.conf KbdInteractiveAuthentication no UsePAM yes X11Forwarding yes PrintMotd no AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server ══╣ /etc/hosts.allow file found, trying to read the rules: (T1552.004,T1021.004) /etc/hosts.allow Searching inside /etc/ssh/ssh_config for interesting info Include /etc/ssh/ssh_config.d/*.conf Host * SendEnv LANG LC_* HashKnownHosts yes GSSAPIAuthentication yes ╔══════════╣ Searching tmux sessions ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#open-shell-sessions tmux 3.4   /tmp/tmux-1006  ╔════════════════════════════════════╗ ══════════════════════╣ Files with Interesting Permissions ╠══════════════════════  ╚════════════════════════════════════╝ ╔══════════╣ SUID - Check easy privesc, exploits and write perms (T1548.001) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid -rwsr-xr-- 1 root messagebus 35K Aug 9 2024 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 335K Aug 26 2025 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 19K Dec 2 2024 /usr/lib/polkit-1/polkit-agent-helper-1 -rwsr-xr-x 1 root root 44K May 30 2024 /usr/bin/chsh -rwsr-xr-x 1 root root 51K Sep 16 2025 /usr/bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8 -rwsr-xr-x 1 root root 39K Apr 8 2024 /usr/bin/fusermount3 -rwsr-xr-x 1 root root 63K May 30 2024 /usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997) -rwsr-xr-x 1 root root 72K May 30 2024 /usr/bin/chfn ---> SuSE_9.3/10 -rwsr-xr-x 1 root root 75K May 30 2024 /usr/bin/gpasswd -rwsr-xr-x 1 root root 272K Jun 25 2025 /usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable -rwsr-xr-x 1 root root 39K Sep 16 2025 /usr/bin/umount ---> BSD/Linux(08-1996) -rwsr-xr-x 1 root root 40K May 30 2024 /usr/bin/newgrp ---> HP-UX_10.20 -rwsr-xr-x 1 root root 55K Sep 16 2025 /usr/bin/su -rwsr-xr-x 1 root root 1.4M Sep 2 09:40 /var/tmp/.sysd (Unknown SUID binary!)  --- It looks like /var/tmp/.sysd is executing expr and you can impersonate it (strings line: expr ? expr : expr) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing bash and you can impersonate it (strings line: bash manual page for the complete specification.) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing find and you can impersonate it (strings line: find their way onto the list with the `pushd' command; you can get) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing last and you can impersonate it (strings line: last command executed within the function or script.) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing script and you can impersonate it (strings line: script run by the . or source builtins finishes executing. A SIGNAL_SPEC) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing which and you can impersonate it (strings line: which should be separated from it by white space.) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is using # --- It looks like /var/tmp/.sysd is using  --- It looks like /var/tmp/.sysd is using ,zZ/ and you can create it inside writable dir . (strings line: ,zZ/) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is using /dev/fd/H and you can create it inside writable dir /dev/fd (strings line: /dev/fd/H) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is using /dev/fd/I and you can create it inside writable dir /dev/fd (strings line: /dev/fd/I) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing bash and you can impersonate it (strings line: bash home page: ) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing chown and you can impersonate it (strings line: chown) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing dash and you can impersonate it (strings line: dash) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing iconv and you can impersonate it (strings line: iconv) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing last and you can impersonate it (strings line: last command: ) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing mktemp and you can impersonate it (strings line: mktemp) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is using o''/ and you can create it inside writable dir . (strings line: o''/) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is using o-Y/ and you can create it inside writable dir . (strings line: o-Y/) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is using o5a/ and you can create it inside writable dir . (strings line: o5a/) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is using o=i/ and you can create it inside writable dir . (strings line: o=i/) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing service and you can impersonate it (strings line: service) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing unlink and you can impersonate it (strings line: unlink) (https://tinyurl.com/suidpath)  --- It looks like /var/tmp/.sysd is executing x86_64 and you can impersonate it (strings line: x86_64) (https://tinyurl.com/suidpath)  --- Checking for writable dependencies of /var/tmp/.sysd... ---------------------------------------------------------------------------------------- --- Trying to execute /var/tmp/.sysd with strace in order to look for hijackable libraries... access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libtinfo.so.6", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/dev/tty", O_RDWR|O_NONBLOCK) = -1 ENXIO (No such device or address) connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) connect(3, {sa_family=AF_UNIX, sun_path="/var/run/nscd/socket"}, 110) = -1 ENOENT (No such file or directory) openat(AT_FDCWD, "/etc/nsswitch.conf", O_RDONLY|O_CLOEXEC) = 3 openat(AT_FDCWD, "/etc/passwd", O_RDONLY|O_CLOEXEC) = 3 ---------------------------------------------------------------------------------------- ╔══════════╣ SGID (T1548.001) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid -rwxr-sr-x 1 root utmp 15K Apr 23 2024 /usr/lib/x86_64-linux-gnu/utempter/utempter -rwxr-sr-x 1 root shadow 27K Sep 15 2025 /usr/sbin/pam_extrausers_chkpwd -r-xr-sr-x 1 root postdrop 23K Apr 8 2024 /usr/sbin/postqueue -rwxr-sr-x 1 root shadow 31K Sep 15 2025 /usr/sbin/unix_chkpwd -r-xr-sr-x 1 root postdrop 23K Apr 8 2024 /usr/sbin/postdrop -rwxr-sr-x 1 root mail 15K Apr 1 2024 /usr/bin/mlock -rwxr-sr-x 1 root mail 23K Apr 8 2024 /usr/bin/dotlockfile -rwxr-sr-x 1 root shadow 27K May 30 2024 /usr/bin/expiry -rwxr-sr-x 1 root _ssh 303K Aug 26 2025 /usr/bin/ssh-agent -rwxr-sr-x 1 root shadow 71K May 30 2024 /usr/bin/chage -rwxr-sr-x 1 root crontab 39K Apr 23 2024 /usr/bin/crontab ╔══════════╣ Files with ACLs (limited to 50) (T1222) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#acls files with acls in searched folders Not Found  ╔══════════╣ Capabilities (T1548.001) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#capabilities ══╣ Current shell capabilities (T1548.001) CapInh: 0x0000000000000000= CapPrm: 0x0000000000000000= CapEff: 0x0000000000000000= CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= ╚ Parent process capabilities CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= ══╣ Processes with capability sets (non-zero CapEff/CapAmb, limit 40) (T1548.001) PID 1 (systemd) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 2 (kthreadd) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 3 (pool_workqueue_release) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 4 (kworker/R-rcu_g) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 5 (kworker/R-rcu_p) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 6 (kworker/R-slub_) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 7 (kworker/R-netns) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 9 (kworker/0:0H-kblockd) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 12 (kworker/R-mm_pe) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 13 (rcu_tasks_kthread) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 14 (rcu_tasks_rude_kthread) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 15 (rcu_tasks_trace_kthread) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 16 (ksoftirqd/0) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 17 (rcu_preempt) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 18 (migration/0) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 19 (idle_inject/0) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 20 (cpuhp/0) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 21 (cpuhp/1) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 22 (idle_inject/1) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 23 (migration/1) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 24 (ksoftirqd/1) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 27 (cpuhp/2) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 28 (idle_inject/2) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 29 (migration/2) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 30 (ksoftirqd/2) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 32 (kworker/2:0H-events_highpri) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 33 (cpuhp/3) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 34 (idle_inject/3) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 35 (migration/3) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 36 (ksoftirqd/3) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 38 (kworker/3:0H-events_highpri) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 39 (kdevtmpfs) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 40 (kworker/R-inet_) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 42 (kauditd) user=root CapInh: 0x0000000000000000= CapPrm: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapEff: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapBnd: 0x000001ffffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read,cap_perfmon,cap_bpf,cap_checkpoint_restore CapAmb: 0x0000000000000000= PID 43 (khungtaskd) user=root CapInh: 0x0000000000000000= Files with capabilities (limited to 50): /usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper cap_net_bind_service,cap_net_admin,cap_sys_nice=ep /usr/lib/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p /usr/bin/mtr-packet cap_net_raw=ep /usr/bin/ping cap_net_raw=ep ══╣ Set-capabilities snap-confine (CVE-2026-8933) (T1068) ╚ https://ubuntu.com/security/CVE-2026-8933 /usr/lib/snapd/snap-confine cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_setgid,cap_setuid,cap_sys_chroot,cap_sys_ptrace,cap_sys_admin=p snap-confine version 2.73+ubuntu24.04 is not in the known CVE-2026-8933 vulnerable range ╔══════════╣ Users with capabilities (T1548.001) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#capabilities  ╚ Checking if PAM loads pam_cap.so /etc/pam.d/common-auth:25:auth optional pam_cap.so ╔══════════╣ Checking misconfigurations of ld.so (T1574.006) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#ldso /etc/ld.so.conf Content of /etc/ld.so.conf: include /etc/ld.so.conf.d/*.conf /etc/ld.so.conf.d  /etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf  - /usr/lib/x86_64-linux-gnu/libfakeroot  /etc/ld.so.conf.d/libc.conf  - /usr/local/lib  /etc/ld.so.conf.d/x86_64-linux-gnu.conf  - /lib/x86_64-linux-gnu  - /usr/lib/x86_64-linux-gnu /etc/ld.so.preload ╔══════════╣ Files (scripts) in /etc/profile.d/ (T1546.004) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#profiles-files total 48 drwxr-xr-x 2 root root 4096 Jan 26 2026 . drwxr-xr-x 128 root root 12288 Aug 13 22:13 .. -rw-r--r-- 1 root root 96 Apr 22 2024 01-locale-fix.sh -rw-r--r-- 1 root root 1557 Apr 23 2024 Z97-byobu.sh -rwxr-xr-x 1 root root 3396 Apr 6 2024 Z99-cloud-locale-test.sh -rwxr-xr-x 1 root root 841 Apr 6 2024 Z99-cloudinit-warnings.sh -rw-r--r-- 1 root root 840 Nov 21 2025 apps-bin-path.sh -rw-r--r-- 1 root root 726 Apr 23 2024 bash_completion.sh -rw-r--r-- 1 root root 1107 Mar 31 2024 gawk.csh -rw-r--r-- 1 root root 757 Mar 31 2024 gawk.sh ╔══════════╣ Permissions in init, init.d, systemd, and rc.d (T1543.002) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#init-initd-systemd-and-rcd  ╔══════════╣ AppArmor binary profiles (T1518.001) -rw-r--r-- 1 root root 3448 Apr 23 2024 usr.bin.man -rw-r--r-- 1 root root 1687 Apr 23 2024 usr.bin.tcpdump -rw-r--r-- 1 root root 32729 Nov 21 2025 usr.lib.snapd.snap-confine.real -rw-r--r-- 1 root root 2838 Jul 2 2024 usr.sbin.chronyd -rw-r--r-- 1 root root 730 Oct 30 2024 usr.sbin.mariadbd -rw-r--r-- 1 root root 1728 Mar 11 2025 usr.sbin.rsyslogd ═╣ Hashes inside passwd file? ........... No ═╣ Writable passwd file? ................ No ═╣ Credentials in fstab/mtab? ........... No ═╣ Can I read shadow files? ............. No ═╣ Can I read shadow plists? ............ No ═╣ Can I write shadow plists? ........... No ═╣ Can I read opasswd file? ............. No ═╣ Can I write in network-scripts? ...... No ═╣ Can I read root folder? .............. No  ╔══════════╣ Searching root files in home dirs (limit 30) (T1083) /home/ /root/ /var/www /var/www/html /var/www/html/index.nginx-debian.html ╔══════════╣ Searching folders owned by me containing others files on it (limit 100) (T1083)  ╔══════════╣ Readable files belonging to root and readable by me but not world readable (T1083) -rw-rw---- 1 root abaone 2590 Aug 15 16:45 /tmp/uploader.php ╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 200) (T1574.009,T1574.010) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-files /run/lock /run/screen /run/screen/S-abaone /tmp /tmp/clp_out.txt /tmp/les.sh /tmp/les_out.txt /tmp/linpeas_host_checker_1993820.err /tmp/linpeas_host_checker_1993820.json #)You_can_write_even_more_files_inside_last_directory  /var/crash /var/lib/nginx /var/lib/nginx/body /var/lib/nginx/fastcgi /var/lib/nginx/proxy /var/lib/nginx/scgi /var/lib/nginx/uwsgi /var/lib/php/sessions /var/tmp /var/tmp/cloud-init ╔══════════╣ Interesting GROUP writable files (not in Home) (max 200) (T1574.009,T1574.010) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-files  Group abaone: /tmp/uploader.php ╔══════════╣ Writable root-owned executables I can modify (max 200) (T1574.009,T1574.010) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-files Writable root-owned executables Not Found   ╔═════════════════════════╗ ════════════════════════════╣ Other Interesting Files ╠════════════════════════════  ╚═════════════════════════╝ ╔══════════╣ .sh files in path (T1574.007) ╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scriptbinaries-in-path /usr/bin/gettext.sh /usr/bin/socat-broker.sh /usr/bin/socat-mux.sh /usr/bin/rescan-scsi-bus.sh /usr/bin/socat-chain.sh ╔══════════╣ Executable files potentially added by user (limit 70) (T1083) 2026-09-02+09:40:01.1752637520 /var/tmp/.sysd 2026-09-02+09:35:59.2729130920 /tmp/les.sh 2026-09-02+09:32:54.5888730500 /tmp/traitor 2026-01-26+09:59:16.5265627750 /usr/sbin/clp-agent 2026-01-26+09:59:16.4555622080 /etc/update-motd.d/10-cloudpanel 2024-11-29+13:31:49.0060105370 /usr/local/bin/composer 2024-04-26+14:26:35.8699479640 /etc/cloud/clean.d/99-installer ╔══════════╣ Unexpected in root (T1083) /sbin.usr-is-merged /bin.usr-is-merged /lib.usr-is-merged ╔══════════╣ Modified interesting files in the last 5mins (limit 100) (T1083) /etc/systemd/system/ssh.socket.d/override.conf /var/log/auth.log /var/log/syslog /var/log/kern.log /var/log/sysstat/sa02 /var/log/journal/93e6f2dc9fa24bd79dbbb91da90dfc6b/system.journal /var/log/journal/93e6f2dc9fa24bd79dbbb91da90dfc6b/user-1006.journal /var/log/ufw.log /var/log/fail2ban.log /var/log/btmp /var/tmp/.sysd /tmp/lp_out.txt /tmp/pcrm-cron-lock ╔══════════╣ Syslog configuration (limit 50) (T1070.002)    module(load="imuxsock") # provides support for local system logging    module(load="imklog" permitnonkernelfacility="on")   $RepeatedMsgReduction on  $FileOwner syslog $FileGroup adm $FileCreateMode 0640 $DirCreateMode 0755 $Umask 0022 $PrivDropToUser syslog $PrivDropToGroup syslog  $WorkDirectory /var/spool/rsyslog  $IncludeConfig /etc/rsyslog.d/*.conf ╔══════════╣ Auditd configuration (limit 50) (T1070.002) auditd configuration Not Found ╔══════════╣ Log files with potentially weak perms (limit 50) (T1070.002)  133492 4 -rw-r----- 1 syslog adm 1233 Aug 10 22:45 /var/log/mail.log.4.gz  133726 0 -rw-r----- 1 syslog adm 0 Aug 13 23:58 /var/log/mail.log  133744 276 -rw-r----- 1 syslog adm 277387 Sep 2 09:43 /var/log/auth.log  131980 284 -rw-r----- 1 root adm 285249 Sep 1 23:56 /var/log/fail2ban.log.1  133754 748 -rw-r----- 1 syslog adm 761495 Sep 1 23:56 /var/log/auth.log.1  133753 1084 -rw-r----- 1 syslog adm 1103997 Sep 1 23:57 /var/log/kern.log.1  655740 160 -rw-r----- 1 root adm 162153 Sep 1 23:58 /var/log/nginx/error.log.1  656954 8 -rw-r----- 1 root adm 5022 Aug 20 23:58 /var/log/nginx/error.log.13.gz  656955 8 -rw-r----- 1 root adm 4581 Aug 31 23:58 /var/log/nginx/error.log.2.gz  656655 8 -rw-r----- 1 root adm 5102 Aug 25 23:58 /var/log/nginx/error.log.8.gz  656657 8 -rw-r----- 1 root adm 4898 Aug 30 23:58 /var/log/nginx/error.log.3.gz  655744 8 -rw-r----- 1 root adm 4737 Aug 26 23:58 /var/log/nginx/error.log.7.gz  655741 8 -rw-r----- 1 root adm 5055 Aug 22 23:58 /var/log/nginx/error.log.11.gz  656948 8 -rw-r----- 1 root adm 4797 Aug 19 23:58 /var/log/nginx/error.log.14.gz  689277 0 -rw-r----- 1 root adm 0 Nov 29 2024 /var/log/nginx/access.log  657177 8 -rw-r----- 1 root adm 5235 Aug 24 23:58 /var/log/nginx/error.log.9.gz  656945 8 -rw-r----- 1 root adm 4643 Aug 23 23:58 /var/log/nginx/error.log.10.gz  656952 8 -rw-r----- 1 root adm 5041 Aug 27 23:58 /var/log/nginx/error.log.6.gz  656959 8 -rw-r----- 1 root adm 4846 Aug 21 23:58 /var/log/nginx/error.log.12.gz  656949 8 -rw-r----- 1 root adm 4601 Aug 29 23:58 /var/log/nginx/error.log.4.gz  656652 92 -rw-r----- 1 root adm 92075 Sep 1 23:58 /var/log/nginx/error.log  656653 8 -rw-r----- 1 root adm 5294 Aug 28 23:58 /var/log/nginx/error.log.5.gz  133032 124 -rw-r----- 1 syslog adm 124372 Aug 30 23:57 /var/log/ufw.log.3.gz  133087 16 -rw-r----- 1 root adm 15668 Nov 29 2024 /var/log/dmesg.1.gz  133550 124 -rw-r----- 1 syslog adm 123836 Aug 31 23:57 /var/log/kern.log.2.gz  133255 28 -rw-r----- 1 root adm 25509 Aug 31 23:57 /var/log/fail2ban.log.2.gz  131379 16 -rw-r----- 1 root adm 15337 Nov 29 2024 /var/log/dmesg.2.gz  133697 108 -rw-r----- 1 syslog adm 110309 Aug 30 23:57 /var/log/auth.log.3.gz  133683 552 -rw-r----- 1 syslog adm 559723 Sep 2 09:44 /var/log/syslog  131392 0 -rw-r----- 1 root adm 0 Jan 26 2026 /var/log/apt/term.log  131424 20 -rw-r----- 1 root adm 18584 Jan 26 2026 /var/log/apt/term.log.1.gz  131779 16 -rw-r----- 1 root adm 16151 Nov 29 2024 /var/log/apt/term.log.2.gz  131858 124 -rw-r----- 1 syslog adm 123836 Aug 31 23:57 /var/log/ufw.log.2.gz  133737 452 -rw-r----- 1 syslog adm 454754 Sep 2 09:44 /var/log/kern.log  133495 120 -rw-r----- 1 syslog adm 120816 Aug 29 23:57 /var/log/kern.log.4.gz  133595 92 -rw-r----- 1 syslog adm 91494 Aug 31 23:57 /var/log/auth.log.2.gz  133734 1276 -rw-r----- 1 syslog adm 1302073 Sep 1 23:58 /var/log/syslog.1  133068 152 -rw-r----- 1 syslog adm 152061 Aug 30 23:58 /var/log/syslog.3.gz  133745 4 -rw-r----- 1 syslog adm 3717 Aug 13 13:20 /var/log/mail.log.1  131391 448 -rw-r----- 1 syslog adm 452925 Sep 2 09:44 /var/log/ufw.log  131512 92 -rw-r----- 1 root adm 89858 Sep 2 09:43 /var/log/fail2ban.log  131832 1084 -rw-r----- 1 syslog adm 1103997 Sep 1 23:57 /var/log/ufw.log.1  132152 120 -rw-r----- 1 syslog adm 120816 Aug 29 23:57 /var/log/ufw.log.4.gz  133256 24 -rw-r----- 1 root adm 23993 Aug 29 23:54 /var/log/fail2ban.log.4.gz  132159 148 -rw-r----- 1 syslog adm 150645 Aug 31 23:58 /var/log/syslog.2.gz  131677 32 -rw-r----- 1 root adm 29933 Aug 30 23:57 /var/log/fail2ban.log.3.gz  655745 4 -rw-r----- 1 root adm 197 Aug 30 23:58 /var/log/proftpd/proftpd.log.3.gz  656942 4 -rw-r----- 1 root adm 197 Aug 26 23:58 /var/log/proftpd/proftpd.log.7.gz  656946 4 -rw-r----- 1 root adm 196 Aug 27 23:58 /var/log/proftpd/proftpd.log.6.gz  656658 4 -rw-r----- 1 root adm 329 Sep 1 23:58 /var/log/proftpd/proftpd.log.1 ╔══════════╣ Files inside /home/abaone (limit 20) (T1083) total 48 drwxrwx--- 8 abaone abaone 4096 Sep 2 09:37 . drwx-----x 17 root root 4096 Aug 13 22:13 .. -rw------- 1 abaone abaone 89 Aug 15 16:48 .bash_history -rwxrwx--- 1 abaone abaone 182 Nov 29 2024 .bashrc drwx------ 3 abaone abaone 4096 Sep 2 09:43 .gnupg -rwxrwx--- 1 abaone abaone 675 Nov 29 2024 .profile drwx------ 2 abaone abaone 4096 Nov 29 2024 .ssh -rw-r--r-- 1 abaone abaone 215 Sep 2 09:35 .wget-hsts drwxrwx--- 3 abaone abaone 4096 Nov 29 2024 backups drwxrwx--- 3 abaone abaone 4096 Nov 29 2024 htdocs drwxrwx--- 4 abaone abaone 4096 Nov 29 2024 logs drwxrwx--- 2 abaone abaone 4096 Aug 15 02:00 tmp ╔══════════╣ Files inside others home (limit 20) (T1552.001) /var/www/html/index.nginx-debian.html ╔══════════╣ Searching installed mail applications (T1114.001) postfix postfix-add-filter postfix-add-policy postfix-collate sendmail ╔══════════╣ Mails (limit 50) (T1114.001)  131708 3336 -rw------- 1 i-clean mail 3407884 Jul 13 20:25 /var/mail/i-clean 135158 28 -rw------- 1 qqp-unique-auto mail 21809 Dec 3 2025 /var/mail/qqp-unique-auto 131413 12 -rw------- 1 root mail 8236 Jan 3 2025 /var/mail/root 131708 3336 -rw------- 1 i-clean mail 3407884 Jul 13 20:25 /var/spool/mail/i-clean 135158 28 -rw------- 1 qqp-unique-auto mail 21809 Dec 3 2025 /var/spool/mail/qqp-unique-auto 131413 12 -rw------- 1 root mail 8236 Jan 3 2025 /var/spool/mail/root ╔══════════╣ Backup folders (T1552.001) drwxr-xr-x 3 root root 4096 Nov 29 2024 /usr/lib/python3/dist-packages/botocore/data/backup total 4 drwxr-xr-x 2 root root 4096 Nov 29 2024 2018-11-15 drwxr-xr-x 2 root root 4096 Jan 27 2026 /var/backups total 1460 -rw-r--r-- 1 root root 61440 Jan 27 2026 alternatives.tar.0 -rw-r--r-- 1 root root 3123 Nov 30 2024 alternatives.tar.1.gz -rw-r--r-- 1 root root 63672 Jan 26 2026 apt.extended_states.0 -rw-r--r-- 1 root root 6290 Nov 29 2024 apt.extended_states.1.gz -rw-r--r-- 1 root root 0 Jan 27 2026 dpkg.arch.0 -rw-r--r-- 1 root root 32 Nov 30 2024 dpkg.arch.1.gz -rw-r--r-- 1 root root 1518 Jan 26 2026 dpkg.diversions.0 -rw-r--r-- 1 root root 312 Nov 29 2024 dpkg.diversions.1.gz -rw-r--r-- 1 root root 488 Nov 29 2024 dpkg.statoverride.0 -rw-r--r-- 1 root root 268 Nov 29 2024 dpkg.statoverride.1.gz -rw-r--r-- 1 root root 1088397 Jan 26 2026 dpkg.status.0 -rw-r--r-- 1 root root 244675 Nov 29 2024 dpkg.status.1.gz ╔══════════╣ Backup files (limited 100) (T1552.001) -rw-r--r-- 1 root root 43976 Sep 23 2025 /usr/lib/x86_64-linux-gnu/open-vm-tools/plugins/vmsvc/libvmbackup.so -rw-r--r-- 1 root root 1759 Jun 17 2025 /usr/lib/python3/dist-packages/sos/report/plugins/ovirt_engine_backup.py -rw-r--r-- 1 root root 1898 Jan 26 2026 /usr/lib/python3/dist-packages/sos/report/plugins/__pycache__/ovirt_engine_backup.cpython-312.pyc -rw-r--r-- 1 root root 4531 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest.py.bak -rw-r--r-- 1 root root 3494 Nov 1 2024 /usr/lib/modules/6.8.0-49-generic/kernel/drivers/power/supply/wm831x_backup.ko.zst -rw-r--r-- 1 root root 4342 Nov 1 2024 /usr/lib/modules/6.8.0-49-generic/kernel/drivers/net/team/team_mode_activebackup.ko.zst -rw-r--r-- 1 root root 3509 Nov 18 2025 /usr/lib/modules/6.8.0-90-generic/kernel/drivers/power/supply/wm831x_backup.ko.zst -rw-r--r-- 1 root root 4362 Nov 18 2025 /usr/lib/modules/6.8.0-90-generic/kernel/drivers/net/team/team_mode_activebackup.ko.zst -rw-r--r-- 1 root root 3506 Apr 19 2024 /usr/lib/modules/6.8.0-31-generic/kernel/drivers/power/supply/wm831x_backup.ko.zst -rw-r--r-- 1 root root 4352 Apr 19 2024 /usr/lib/modules/6.8.0-31-generic/kernel/drivers/net/team/team_mode_activebackup.ko.zst -rw-r--r-- 1 root root 154 Sep 26 2024 /usr/lib/systemd/system/dpkg-db-backup.timer -rw-r--r-- 1 root root 147 Sep 26 2024 /usr/lib/systemd/system/dpkg-db-backup.service -rwxr-xr-x 1 root root 53228 Nov 4 2025 /usr/bin/wsrep_sst_mariabackup -rwxr-xr-x 1 root root 226 Apr 23 2024 /usr/share/byobu/desktop/byobu.desktop.old -rw-r--r-- 1 root root 445715 Apr 23 2024 /usr/share/doc/manpages/Changes.old.gz -rw-r--r-- 1 root root 11936 Jan 26 2026 /usr/share/info/dir.old -rw-r--r-- 1 root root 347 Nov 4 2025 /usr/share/man/man1/wsrep_sst_mariabackup.1.gz -rw-r--r-- 1 root root 3132 Nov 27 2024 /usr/share/man/man8/vgcfgbackup.8.gz -rwxr-xr-x 1 root root 2586 Sep 18 2025 /usr/libexec/dpkg/dpkg-db-backup -rwxr-xr-x 1 root root 1086 Mar 10 2024 /usr/src/linux-headers-6.8.0-49/tools/testing/selftests/net/tcp_fastopen_backup_key.sh -rwxr-xr-x 1 root root 28003 Mar 10 2024 /usr/src/linux-headers-6.8.0-49/tools/testing/selftests/net/test_bridge_backup_port.sh -rwxr-xr-x 1 root root 1086 Mar 10 2024 /usr/src/linux-headers-6.8.0-90/tools/testing/selftests/net/tcp_fastopen_backup_key.sh -rwxr-xr-x 1 root root 28003 Mar 10 2024 /usr/src/linux-headers-6.8.0-90/tools/testing/selftests/net/test_bridge_backup_port.sh -rwxr-xr-x 1 root root 1086 Mar 10 2024 /usr/src/linux-headers-6.8.0-31/tools/testing/selftests/net/tcp_fastopen_backup_key.sh -rwxr-xr-x 1 root root 28003 Mar 10 2024 /usr/src/linux-headers-6.8.0-31/tools/testing/selftests/net/test_bridge_backup_port.sh -rw-r--r-- 1 root root 893 Jan 26 2026 /etc/xml/catalog.old -rw-r--r-- 1 root root 673 Apr 23 2024 /etc/xml/xml-core.xml.old -rw-r--r-- 1 root root 365 Jan 26 2026 /etc/xml/polkitd.xml.old -rw-r--r-- 1 root root 648 Apr 23 2024 /etc/.resolv.conf.systemd-resolved.bak -rw-r--r-- 1 root root 378 Jan 26 2026 /run/blkid/blkid.tab.old -rw-r--r-- 1 root root 159 Apr 26 2024 /var/lib/sgml-base/supercatalog.old -rw-r--r-- 1 root root 0 Sep 2 00:00 /var/lib/systemd/timers/stamp-dpkg-db-backup.timer -rw-r--r-- 1 root root 61 Jan 26 2026 /var/lib/systemd/deb-systemd-helper-enabled/dpkg-db-backup.timer.dsh-also -rw-r--r-- 1 root root 0 Apr 23 2024 /var/lib/systemd/deb-systemd-helper-enabled/timers.target.wants/dpkg-db-backup.timer -rw-r--r-- 1 root root 4691 Nov 5 2025 /var/log/nginx/error.log-2025110523.backup ╔══════════╣ Searching tables inside readable .db/.sql/.sqlite files (limit 100) (T1005) Found /etc/aliases.db: Berkeley DB (Hash, version 9, native byte-order) Found /var/lib/PackageKit/transactions.db: SQLite 3.x database, last written using SQLite version 3045001, file counter 5, database pages 8, cookie 0x4, schema 4, UTF-8, version-valid-for 5 Found /var/lib/command-not-found/commands.db: SQLite 3.x database, last written using SQLite version 3045001, file counter 5, database pages 972, cookie 0x4, schema 4, UTF-8, version-valid-for 5 Found /var/lib/fail2ban/fail2ban.sqlite3: regular file, no read permission Found /var/lib/fwupd/pending.db: SQLite 3.x database, last written using SQLite version 3045001, file counter 3, database pages 8, cookie 0x5, schema 4, UTF-8, version-valid-for 3 Found /var/lib/postfix/smtp_scache.db: regular file, no read permission  -> Extracting tables from /var/lib/PackageKit/transactions.db (limit 20)  -> Extracting tables from /var/lib/command-not-found/commands.db (limit 20)  -> Extracting tables from /var/lib/fwupd/pending.db (limit 20)  ╔══════════╣ Web files?(output limit) (T1005) /var/www/: total 12K drwxr-xr-x 3 root root 4.0K Nov 29 2024 . drwxr-xr-x 14 root root 4.0K Nov 29 2024 .. drwxr-xr-x 2 root root 4.0K Nov 29 2024 html /var/www/html: total 12K drwxr-xr-x 2 root root 4.0K Nov 29 2024 . drwxr-xr-x 3 root root 4.0K Nov 29 2024 .. ╔══════════╣ All relevant hidden files (not in /sys/ or the ones listed in the previous check) (limit 70) (T1564.001) -rw-r--r-- 1 root root 14 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/noentry/.htaccess -rw-r--r-- 1 root root 159 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest/.htaccess -rw-r--r-- 1 root root 179 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_wrongrelm/.htaccess -rw-r--r-- 1 root root 195 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_time/.htaccess -rw-r--r-- 1 root root 231 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/digest_anon/.htaccess -rw-r--r-- 1 root root 136 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/authz_owner/.htaccess -rw-r--r-- 1 root root 129 Nov 9 2022 /usr/lib/python3/dist-packages/fail2ban/tests/files/config/apache-auth/basic/file/.htaccess -rw-r--r-- 1 root root 414 Sep 5 2025 /usr/share/vim/vim91/pack/dist/opt/editorconfig/.editorconfig -rw-r--r-- 1 root root 11 Aug 27 2022 /usr/share/ieee-data/.lastupdate -rw------- 1 root root 0 Apr 23 2024 /etc/.pwd.lock -rw-r--r-- 1 root root 648 Apr 23 2024 /etc/.resolv.conf.systemd-resolved.bak -rw-r--r-- 1 root root 577 Nov 29 2024 /etc/.fstab -rw-r--r-- 1 root root 208 Apr 23 2024 /etc/.updated -rw-r--r-- 1 root root 220 Mar 31 2024 /etc/skel/.bash_logout -rw-r--r-- 1 root root 2 Sep 2 09:39 /run/cloud-init/.ds-identify.result -rw-r--r-- 1 landscape landscape 0 Apr 23 2024 /var/lib/landscape/.cleanup.user -rw-r--r-- 1 root root 208 Apr 23 2024 /var/.updated -rwsr-xr-x 1 root root 1446024 Sep 2 09:40 /var/tmp/.sysd ╔══════════╣ Readable files inside /tmp, /var/tmp, /private/tmp, /private/var/at/tmp, /private/var/tmp, and backup folders (limit 70) (T1552.001) -rw-r--r-- 1 abaone abaone 2713 Sep 2 09:36 /tmp/les_out.txt -rwxr-xr-x 1 abaone abaone 93960 Sep 2 09:35 /tmp/les.sh -rw-rw---- 1 root abaone 2590 Aug 15 16:45 /tmp/uploader.php -rw-r--r-- 1 abaone abaone 354912 Sep 2 09:44 /tmp/lp_out.txt ╔══════════╣ Searching *password* or *credential* files in home (limit 70) (T1552.001) /etc/apparmor.d/1password /etc/credstore /etc/credstore.encrypted /etc/pam.d/common-password /usr/bin/systemd-ask-password /usr/bin/systemd-tty-ask-password-agent /usr/lib/git-core/git-credential /usr/lib/git-core/git-credential-cache /usr/lib/git-core/git-credential-cache--daemon /usr/lib/git-core/git-credential-store #)There are more creds/passwds files in the previous parent folder /usr/lib/grub/i386-pc/password.mod /usr/lib/grub/i386-pc/password_pbkdf2.mod /usr/lib/mysql/plugin/caching_sha2_password.so /usr/lib/mysql/plugin/mysql_clear_password.so /usr/lib/mysql/plugin/password_reuse_check.so /usr/lib/mysql/plugin/sha256_password.so #)There are more creds/passwds files in the previous parent folder /usr/lib/python3/dist-packages/botocore/credentials.py /usr/lib/python3/dist-packages/cloudinit/config/__pycache__/cc_set_passwords.cpython-312.pyc /usr/lib/python3/dist-packages/cloudinit/config/cc_set_passwords.py /usr/lib/python3/dist-packages/launchpadlib/__pycache__/credentials.cpython-312.pyc /usr/lib/python3/dist-packages/launchpadlib/credentials.py /usr/lib/python3/dist-packages/launchpadlib/tests/__pycache__/test_credential_store.cpython-312.pyc /usr/lib/python3/dist-packages/launchpadlib/tests/test_credential_store.py /usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/__pycache__/client_credentials.cpython-312.pyc /usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/__pycache__/resource_owner_password_credentials.cpython-312.pyc /usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py /usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py /usr/lib/python3/dist-packages/twisted/cred/__pycache__/credentials.cpython-312.pyc /usr/lib/python3/dist-packages/twisted/cred/credentials.py /usr/lib/systemd/system/multi-user.target.wants/systemd-ask-password-wall.path /usr/lib/systemd/system/sysinit.target.wants/systemd-ask-password-console.path /usr/lib/systemd/system/systemd-ask-password-console.path /usr/lib/systemd/system/systemd-ask-password-console.service /usr/lib/systemd/system/systemd-ask-password-plymouth.path /usr/lib/systemd/system/systemd-ask-password-plymouth.service #)There are more creds/passwds files in the previous parent folder /usr/lib/tmpfiles.d/credstore.conf /usr/lib/x86_64-linux-gnu/libmariadb3/plugin/caching_sha2_password.so /usr/lib/x86_64-linux-gnu/libmariadb3/plugin/mysql_clear_password.so /usr/lib/x86_64-linux-gnu/libmariadb3/plugin/sha256_password.so /usr/share/doc/git/contrib/credential /usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret.c /usr/share/doc/git/contrib/credential/netrc/git-credential-netrc.perl /usr/share/doc/git/contrib/credential/netrc/t-git-credential-netrc.sh /usr/share/doc/git/contrib/credential/osxkeychain/git-credential-osxkeychain.c /usr/share/doc/git/contrib/credential/wincred/git-credential-wincred.c /usr/share/man/man1/git-credential-cache--daemon.1.gz /usr/share/man/man1/git-credential-cache.1.gz /usr/share/man/man1/git-credential-store.1.gz /usr/share/man/man1/git-credential.1.gz #)There are more creds/passwds files in the previous parent folder /usr/share/man/man7/gitcredentials.7.gz /usr/share/man/man7/systemd.system-credentials.7.gz /usr/share/man/man8/systemd-ask-password-console.path.8.gz /usr/share/man/man8/systemd-ask-password-console.service.8.gz /usr/share/man/man8/systemd-ask-password-wall.path.8.gz /usr/share/man/man8/systemd-ask-password-wall.service.8.gz #)There are more creds/passwds files in the previous parent folder /usr/share/pam/common-password.md5sums /var/cache/debconf/passwords.dat /var/lib/cloud/instances/v220241133217299349-1732882855/sem/config_set_passwords /var/lib/fwupd/pki/secret.key /var/lib/pam/password ╔══════════╣ Checking for TTY (sudo/su) passwords in audit logs (T1552.001)  ╔══════════╣ Checking for TTY (sudo/su) passwords in audit logs (T1083)  ╔══════════╣ Searching emails inside logs (limit 70) (T1114.001)  ╔══════════╣ Searching passwords inside logs (limit 70) (T1552.001)  ╔══════════╣ Searching possible password variables inside key folders (limit 140) (T1552.001) /etc/apparmor.d/1password:7:profile 1password /opt/1Password/1password flags=(unconfined) { /etc/cloud/cloud.cfg:96: lock_passwd: True /etc/cloud/cloud.cfg:99: sudo: ["ALL=(ALL) NOPASSWD:ALL"] /etc/debconf.conf:69:#BindPasswd: secret /etc/fail2ban/action.d/smtp.py:115: self.password =password /etc/fail2ban/action.d/smtp.py:162: if self.user and self.password: # pragma: no cover (ATM no tests covering that) /etc/fail2ban/action.d/smtp.py:78: self, jail, name, host="localhost", user=None, password=None, /etc/fail2ban/action.d/smtp.py:93: password : str, optional /etc/fail2ban/filter.d/dropbear.conf:29: ^[Bb]ad (PAM )?password attempt for .+ from (:\d+)?$ /etc/fail2ban/filter.d/gitlab.conf:6:failregex = ^: Failed Login: username=.+ ip=$ /etc/fail2ban/filter.d/murmur.conf:11:_usernameregex = [^>]+ /etc/fail2ban/filter.d/murmur.conf:19:_prefix = %(__prefix_line)s\s+\d+ => <\d+:%(_usernameregex)s\(-1\)> Rejected connection from :\d+: /etc/fail2ban/filter.d/mysqld-auth.conf:29:# 130322 11:26:54 [Warning] Access denied for user 'root'@'127.0.0.1' (using password: YES) /etc/fail2ban/filter.d/slapd.conf:3:# Detecting invalid credentials: error code 49 /etc/iscsi/iscsid.conf:79:#node.session.auth.username = username /etc/iscsi/iscsid.conf:80:#node.session.auth.password = password /etc/iscsi/iscsid.conf:84:#node.session.auth.username_in = username_in /etc/iscsi/iscsid.conf:85:#node.session.auth.password_in = password_in /etc/iscsi/iscsid.conf:93:#discovery.sendtargets.auth.username = username /etc/iscsi/iscsid.conf:94:#discovery.sendtargets.auth.password = password /etc/iscsi/iscsid.conf:98:#discovery.sendtargets.auth.username_in = username_in /etc/iscsi/iscsid.conf:99:#discovery.sendtargets.auth.password_in = password_in /etc/nsswitch.conf:7:passwd: files systemd /etc/overlayroot.conf:135:# crypt:dev=/dev/vdb,pass=somepassword,mkfs=0 /etc/overlayroot.conf:138:# $ MAPNAME="secure"; DEV="/dev/vdg"; PASSWORD="foobar" /etc/pam.d/common-password:25:password [success=1 default=ignore] pam_unix.so obscure yescrypt /etc/security/namespace.init:30: passwd=$(getent passwd "$user") /etc/security/namespace.init:31: homedir=$(echo "$passwd" | cut -f6 -d":") /etc/security/namespace.init:33: gid=$(echo "$passwd" | cut -f4 -d":") /etc/sos/sos.conf:25:#password = true /etc/ssl/openssl.cnf:152:# input_password = secret /etc/ssl/openssl.cnf:153:# output_password = secret /etc/ssl/openssl.cnf:196:challengePassword = A challenge password /etc/ssl/openssl.cnf:197:challengePassword_min = 4 /etc/ssl/openssl.cnf:198:challengePassword_max = 20 /etc/sudo_logsrvd.conf:182:#log_passwords = true /etc/systemd/system/dbus-org.freedesktop.resolve1.service:53:ImportCredential=network.dns /etc/systemd/system/dbus-org.freedesktop.resolve1.service:54:ImportCredential=network.search_domains /etc/systemd/system/getty.target.wants/getty@tty1.service:52:ImportCredential=agetty.* /etc/systemd/system/getty.target.wants/getty@tty1.service:53:ImportCredential=login.* /etc/systemd/system/sockets.target.wants/apport-forward.socket:11:PassCredentials=true /etc/systemd/system/sysinit.target.wants/systemd-resolved.service:53:ImportCredential=network.dns /etc/systemd/system/sysinit.target.wants/systemd-resolved.service:54:ImportCredential=network.search_domains /tmp/les.sh:1708:available: CONFIG_DEBUG_CREDENTIALS=y /tmp/lp.sh:107: P) PASSWORD=$OPTARG;; /tmp/lp.sh:11023: cat "$f" 2>/dev/null | sed -${E} "s,cache_credentials ?= ?[tT][rR][uU][eE],${SED_RED},"; /tmp/lp.sh:11073: echo "Potential file containing credentials:" /tmp/lp.sh:11346:pamdpass=$(grep -Ri "passwd" ${ROOT_FOLDER}etc/pam.d/ 2>/dev/null | grep -v ":#") /tmp/lp.sh:11349: grep -Ri "passwd" ${ROOT_FOLDER}etc/pam.d/ 2>/dev/null | grep -v ":#" | sed "s,passwd,${SED_RED}," /tmp/lp.sh:11492: cut -d: -f1,7 /etc/passwd 2>/dev/null | grep "sh$" | cut -d: -f1 | grep -v "^$USER$" | while read u; do /tmp/lp.sh:11512: echo "passwd file: $f" | sed "s,$f,${SED_RED}," /tmp/lp.sh:12774: search_for_regex "Basic Auth Credentials" "://[a-zA-Z0-9]+:[a-zA-Z0-9]+@[a-zA-Z0-9]+\\.[a-zA-Z]+" /tmp/lp.sh:12910: search_for_regex "Simple Passwords" "passw.*[=:].+" /tmp/lp.sh:3335: PASSWORDTRY=$2 /tmp/lp.sh:3338: echo " You can login as $BFUSER using password: $PASSWORDTRY" | sed -${E} "s,.*,${SED_RED_YELLOW}," /tmp/lp.sh:56:PASSWORD="" /tmp/lp.sh:5701: print_info "Trying IMDS tokens for WireServer-discovered client_id=$_az_vm_wire_client_id" /tmp/lp.sh:5702: az_vm_print_standard_tokens " for WireServer client_id $_az_vm_wire_client_id" "client_id=$_az_vm_wire_client_id" /tmp/lp.sh:5764: az_vm_print_standard_tokens " for UAI $_az_vm_uai_client_id" "client_id=$_az_vm_uai_client_id" /tmp/lp.sh:6325: echo " └─ Has memory-mapped credential files:" /tmp/lp.sh:6390: grep "^[^:]*:[^:]*:$1:" "/etc/passwd" 2>/dev/null | cut -d: -f1 /tmp/lp.sh:6428: grep "^[^:]*:[^:]*:$1:" "/etc/passwd" 2>/dev/null | cut -d: -f1 /tmp/lp.sh:6643: # username=$(basename "$user_crontab") /tmp/lp.sh:6644: # [ "$username" = "$USER" ] && continue /tmp/lp.sh:9393: sudo_l_password_output=$(printf "%s\n" "$PASSWORD" | "$TIMEOUT" 15 sudo -S -l 2>/dev/null) /tmp/lp.sh:9395: sudo_l_password_output=$(printf "%s\n" "$PASSWORD" | sudo -S -l 2>/dev/null) /tmp/lp.sh:9777: no_shells=$(grep -Ev "sh$" /etc/passwd 2>/dev/null | cut -d ':' -f 7 | sort | uniq) /tmp/lp.sh:985:processesDump="gdm-password|gnome-keyring-daemon|lightdm|vsftpd|apache2|sshd:" /tmp/lp.sh:9919: print_2title "Testing 'su' as other users with shell using as passwords: null pwd, the username and top2000pwds\n"$NC /tmp/lp.sh:9922: SHELLUSERS=$(cat /etc/passwd 2>/dev/null | grep -i "sh$" | cut -d ":" -f 1) ╔══════════╣ Searching possible password in config files (if k8s secrets are found you need to read the file) (T1552.001)  /etc/sysctl.d/10-ptrace.conf /etc/sysctl.d/10-ptrace.conf:4:credentials that exist in memory (re-using existing SSH connections,  /etc/security/faillock.conf /etc/security/faillock.conf:21:passwd and ignore centralized (AD, IdM, LDAP, etc.) users.  /etc/security/pwhistory.conf /etc/security/pwhistory.conf:20:passwd. /etc/security/pwhistory.conf:21:passwd  /etc/nsswitch.conf /etc/nsswitch.conf:7:passwd: files systemd  /etc/debconf.conf /etc/debconf.conf:69:Passwd: secret  /etc/fail2ban/action.d/firewallcmd-common.conf /etc/fail2ban/action.d/firewallcmd-common.conf:43:passwd ldap ldaps libvirt libvirt-tls mdns mosh mountd ms-wbt mysql nfs ntp openvpn pmcd pmproxy pmwebapi pmwebapis pop3s  /etc/fail2ban/filter.d/dropbear.conf /etc/fail2ban/filter.d/dropbear.conf:47:passwd.c  /etc/fail2ban/filter.d/dovecot.conf /etc/fail2ban/filter.d/dovecot.conf:21:credentials|[Pp]assword mismatch)  /etc/fail2ban/filter.d/slapd.conf /etc/fail2ban/filter.d/slapd.conf:3:credentials: error code 49 /etc/fail2ban/filter.d/slapd.conf:4:Credentials (49)  /etc/proftpd/modules.conf /etc/proftpd/modules.conf:59:passwd.c  /etc/proftpd/proftpd.conf /etc/proftpd/proftpd.conf:83:Passwd off  /etc/overlayroot.conf /etc/overlayroot.conf:52:passwd  /etc/ssl/openssl.cnf /etc/ssl/openssl.cnf:23:$ENV: ╔══════════╣ Checking all env variables in /proc/*/environ removing duplicates and filtering out useless env vars (T1552.007,T1082) HOME=/home/abaone PWD=/home/abaone/htdocs/abaone.ch/media/com_sppagebuilder/assets/iconfont/ico5x4tov/fonts SHLVL=1 USER=abaone _=/usr/bin/cat _=/usr/bin/grep _=/usr/bin/tr  ╔════════════════╗ ════════════════════════════════╣ API Keys Regex ╠════════════════════════════════  ╚════════════════╝ Regexes to search for API keys aren't activated, use param '-r'