--os-release--
PRETTY_NAME="Ubuntu 22.04.5 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.5 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
--id--
uid=0(root) gid=0(root) groups=0(root)
--pwd--
/
--uname--
Linux reverse-host 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Tue May  5 19:26:24 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
--capabilities-pid1--
CapInh:	0000000000000000
CapPrm:	00000000a9a425fb
CapEff:	00000000a9a425fb
CapBnd:	00000000a9a425fb
CapAmb:	0000000000000000
0x00000000a9a425fb=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_sys_admin,cap_sys_nice,cap_sys_resource,cap_mknod,cap_audit_write,cap_setfcap
--environment--
DEBIAN_FRONTEND=noninteractive
HOME=/root
HOSTNAME=reverse-host
LABADMIN_SSH_KEY_FILE=/keys/aptl_lab_key.pub
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PWD=/
SHLVL=0
SIEM_IP=172.20.0.10
_=/usr/bin/env
--listeners--
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
udp   UNCONN 0      0            0.0.0.0:41958      0.0.0.0:*
udp   UNCONN 0      0         127.0.0.11:54492      0.0.0.0:*
tcp   LISTEN 0      4096      127.0.0.11:43297      0.0.0.0:*
tcp   LISTEN 0      5            0.0.0.0:8765       0.0.0.0:*    users:(("falco",pid=3228,fd=7))
tcp   LISTEN 0      128          0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=40,fd=3))
tcp   LISTEN 0      128             [::]:22            [::]:*    users:(("sshd",pid=40,fd=4))
--sshd-effective-config--
acceptenv LANG
acceptenv LC_*
authorizedkeysfile .ssh/authorized_keys .ssh/authorized_keys2
passwordauthentication no
permitrootlogin no
permittty yes
port 22
pubkeyauthentication yes
usepam yes
--network-addresses--
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host
       valid_lft forever preferred_lft forever
2: eth0@if10583: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether 0e:69:21:a4:a6:37 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.20.0.27/24 brd 172.20.0.255 scope global eth0
       valid_lft forever preferred_lft forever
--routes--
default via 172.20.0.1 dev eth0
172.20.0.0/24 dev eth0 proto kernel scope link src 172.20.0.27
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
local 172.20.0.27 dev eth0 table local proto kernel scope host src 172.20.0.27
broadcast 172.20.0.255 dev eth0 table local proto kernel scope link src 172.20.0.27
local ::1 dev lo table local proto kernel metric 0 pref medium
--dns--
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.11
search tail18b785.ts.net
options edns0 trust-ad ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [host(127.0.0.53)]
# Overrides: []
# Option ndots from: internal
--hosts--
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::	ip6-localnet
ff00::	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.20.0.27	reverse-host
--hostname--
reverse-host
--mounts--
overlay on / type overlay (rw,relatime,lowerdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145366/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145265/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145264/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145263/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145262/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145261/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145260/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145259/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145258/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145257/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145256/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145255/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145254/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145253/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145252/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145251/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145250/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/119829/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/100751/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/100750/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/100749/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/100748/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/100747/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/100746/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/100745/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/100744/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/31540/fs,upperdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145369/fs,workdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145369/work,nouserxattr)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666)
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=65536k,inode64)
tmpfs on /run type tmpfs (rw,nosuid,nodev,noexec,relatime,mode=755,inode64)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime,inode64)
/dev/md2 on /home type ext4 (rw,relatime)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,inode64)
/dev/md2 on /keys/kali_pivot_key.pub type ext4 (ro,relatime)
/dev/md2 on /var/log type ext4 (rw,relatime)
/dev/md2 on /keys/aptl_lab_key.pub type ext4 (ro,relatime)
/dev/md2 on /etc/resolv.conf type ext4 (rw,relatime)
/dev/md2 on /etc/hostname type ext4 (rw,relatime)
/dev/md2 on /etc/hosts type ext4 (rw,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
proc on /proc/bus type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/fs type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/irq type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
tmpfs on /proc/acpi type tmpfs (ro,relatime,inode64)
tmpfs on /proc/interrupts type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/kcore type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/keys type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/latency_stats type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/scsi type tmpfs (ro,relatime,inode64)
tmpfs on /proc/timer_list type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /sys/devices/virtual/powercap type tmpfs (ro,relatime,inode64)
tmpfs on /sys/firmware type tmpfs (ro,relatime,inode64)
--users--
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
_apt:x:100:65534::/nonexistent:/usr/sbin/nologin
systemd-network:x:101:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
systemd-resolve:x:102:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
messagebus:x:103:104::/nonexistent:/usr/sbin/nologin
systemd-timesync:x:104:105:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
syslog:x:105:106::/home/syslog:/usr/sbin/nologin
sshd:x:106:65534::/run/sshd:/usr/sbin/nologin
labadmin:x:1000:1000::/home/labadmin:/bin/bash
wazuh:x:107:108::/var/ossec:/sbin/nologin
--groups--
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:
floppy:x:25:
tape:x:26:
sudo:x:27:labadmin
audio:x:29:
dip:x:30:
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:
sasl:x:45:
plugdev:x:46:
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
systemd-journal:x:101:
systemd-network:x:102:
systemd-resolve:x:103:
messagebus:x:104:
systemd-timesync:x:105:
syslog:x:106:
_ssh:x:107:
labadmin:x:1000:
wazuh:x:108:
--sudo-rules--
/etc/sudoers.d/README
#
# The default /etc/sudoers file created on installation of the
# sudo  package now includes the directive:
#
# 	@includedir /etc/sudoers.d
#
# This will cause sudo to read and parse any files in the /etc/sudoers.d
# directory that do not end in '~' or contain a '.' character.
#
# Note that there must be at least one file in the sudoers.d directory (this
# one will do).
#
# Note also, that because sudoers contents can vary widely, no attempt is
# made to add this directive to existing sudoers files on upgrade.  Feel free
# to add the above directive to the end of your /etc/sudoers file to enable
# this functionality for existing installations if you wish! Sudo
# versions older than the one in Debian 11 (bullseye) require the
# directive will only support the old syntax #includedir, and the current
# sudo will happily accept both @includedir and #includedir
#
# Finally, please note that using the visudo command is the recommended way
# to update sudoers content, since it protects against many failure modes.
# See the man page for visudo and sudoers for more information.
#
/etc/sudoers.d/labadmin
labadmin ALL=(ALL) NOPASSWD:ALL
--systemd-services--
  UNIT                             LOAD   ACTIVE SUB     DESCRIPTION
  dbus.service                     loaded active running D-Bus System Message Bus
  falco-modern-bpf.service         loaded active running Falco: Container Native Runtime Security with modern ebpf
  falcoctl-artifact-follow.service loaded active running Falcoctl Artifact Follow: automatic artifacts update service
  reverse-tools-install.service    loaded active exited  Install Reverse Engineering Tools Lab Services on First Boot
  rsyslog.service                  loaded active running System Logging Service
  ssh.service                      loaded active running OpenBSD Secure Shell server
  systemd-journald.service         loaded active running Journal Service
  systemd-logind.service           loaded active running User Login Management
  systemd-remount-fs.service       loaded active exited  Remount Root and Kernel File Systems
  systemd-user-sessions.service    loaded active exited  Permit User Sessions
  user-runtime-dir@1000.service    loaded active exited  User Runtime Directory /run/user/1000
  user@1000.service                loaded active running User Manager for UID 1000
  wazuh-agent.service              loaded active running Wazuh agent

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.
13 loaded units listed.
--process-tree--
    PID    PPID USER     COMMAND
      1       0 root     /usr/sbin/init
     33       1 root     /lib/systemd/systemd-journald
     34       1 syslog   /usr/sbin/rsyslogd -n -iNONE
     40       1 root     sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
    752       1 message+ @dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
    753       1 root     /lib/systemd/systemd-logind
   3228       1 root     /usr/bin/falco -o engine.kind=modern_ebpf
   3229       1 root     /usr/bin/falcoctl artifact follow --allowed-types=rulesfile
   4275       1 root     /var/ossec/bin/wazuh-execd
   4287       1 wazuh    /var/ossec/bin/wazuh-agentd
   4309       1 root     /var/ossec/bin/wazuh-syscheckd
   4323       1 root     /var/ossec/bin/wazuh-logcollector
   4503       1 root     /var/ossec/bin/wazuh-modulesd
  38867       1 labadmin /lib/systemd/systemd --user
  38868   38867 labadmin (sd-pam)
  38949       0 root     bash -c    set +e   echo --os-release--   cat /etc/os-release   echo --id--   id   echo --pwd--   pwd   echo --uname--   uname -a   echo --capabilities-pid1--   grep "^Cap" /proc/1/status || true   if command -v capsh >/dev/null 2>&1; then     capsh --decode="$(awk "/^CapEff:/ {print \$2}" /proc/1/status)" || true   fi   echo --environment--   env | sort   echo --listeners--   (ss -lntup || netstat -lntup || true) 2>&1   echo --sshd-effective-config--   sshd -T 2>/dev/null | sort | sed -n "/^acceptenv /p;/^allowusers /p;/^authorizedkeysfile /p;/^passwordauthentication /p;/^permitrootlogin /p;/^permittty /p;/^port /p;/^pubkeyauthentication /p;/^usepam /p"   echo --network-addresses--   ip addr show   echo --routes--   ip route show table all   echo --dns--   cat /etc/resolv.conf   echo --hosts--   cat /etc/hosts   echo --hostname--   cat /etc/hostname   echo --mounts--   mount | sed -n "1,220p"   echo --users--   getent passwd | sed -n "1,220p"   echo --groups--   getent group | sed -n "1,220p"   echo --sudo-rules--   find /etc/sudoers.d -maxdepth 1 -type f -print -exec sed -n "1,80p" {} \;   echo --systemd-services--   systemctl --no-pager --type=service --state=running,exited,failed || true   echo --process-tree--   ps -eo pid,ppid,user,args || true
  38983   38949 root     ps -eo pid,ppid,user,args
