--os-release--
NAME="Rocky Linux"
VERSION="9.8 (Blue Onyx)"
RELEASE_TYPE="stable"
ID="rocky"
ID_LIKE="rhel centos fedora"
VERSION_ID="9.8"
PLATFORM_ID="platform:el9"
PRETTY_NAME="Rocky Linux 9.8 (Blue Onyx)"
ANSI_COLOR="0;32"
LOGO="fedora-logo-icon"
CPE_NAME="cpe:/o:rocky:rocky:9::baseos"
HOME_URL="https://rockylinux.org/"
VENDOR_NAME="RESF"
VENDOR_URL="https://resf.org/"
BUG_REPORT_URL="https://bugs.rockylinux.org/"
SUPPORT_END="2032-05-31"
ROCKY_SUPPORT_PRODUCT="Rocky-Linux-9"
ROCKY_SUPPORT_PRODUCT_VERSION="9.8"
REDHAT_SUPPORT_PRODUCT="Rocky Linux"
REDHAT_SUPPORT_PRODUCT_VERSION="9.8"
--id--
uid=0(root) gid=0(root) groups=0(root)
--pwd--
/
--uname--
Linux ws01.techvault.local 6.8.0-117-generic #117-Ubuntu SMP PREEMPT_DYNAMIC Tue May  5 19:26:24 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
--capabilities-pid1--
CapInh:	0000000000000000
CapPrm:	00000000a9a425fb
CapEff:	00000000a9a425fb
CapBnd:	00000000a9a425fb
CapAmb:	0000000000000000
0x00000000a9a425fb=cap_chown,cap_dac_override,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_net_bind_service,cap_net_raw,cap_sys_chroot,cap_sys_admin,cap_sys_nice,cap_sys_resource,cap_mknod,cap_audit_write,cap_setfcap
--environment--
DEBUGINFOD_IMA_CERT_PATH=/etc/keys/ima:
HISTCONTROL=ignoredups
HISTFILE=/var/log/bash_history.log
HISTFILESIZE=10000
HISTSIZE=10000
HISTTIMEFORMAT=%Y-%m-%d %H:%M:%S
HOME=/root
HOSTNAME=ws01.techvault.local
INSTALL_FALCO=true
INSTALL_WAZUH=true
INSTALL_XSIAM=false
LABADMIN_SSH_KEY_FILE=/keys/aptl_lab_key.pub
LANG=C.UTF-8
LESSOPEN=||/usr/bin/lesspipe.sh %s
LOGNAME=root
MAIL=/var/spool/mail/root
PATH=/root/.local/bin:/root/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
PROMPT_COMMAND=history -a
PWD=/
SHLVL=1
SIEM_IP=172.20.2.30
USER=root
_=/usr/bin/env
--listeners--
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:PortProcess
udp   UNCONN 0      0         127.0.0.11:60730      0.0.0.0:*
tcp   LISTEN 0      128          0.0.0.0:22         0.0.0.0:*    users:(("sshd",pid=56,fd=7))
tcp   LISTEN 0      4096      127.0.0.11:44517      0.0.0.0:*
tcp   LISTEN 0      128             [::]:22            [::]:*    users:(("sshd",pid=56,fd=8))
--sshd-effective-config--
authorizedkeysfile .ssh/authorized_keys
passwordauthentication yes
permitrootlogin no
permittty yes
port 22
pubkeyauthentication yes
usepam yes
--network-addresses--
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host proto kernel_lo
       valid_lft forever preferred_lft forever
2: eth0@if10582: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default
    link/ether d2:e8:eb:f8:fe:15 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 172.20.2.40/24 brd 172.20.2.255 scope global eth0
       valid_lft forever preferred_lft forever
--routes--
172.20.2.0/24 dev eth0 proto kernel scope link src 172.20.2.40
local 127.0.0.0/8 dev lo table local proto kernel scope host src 127.0.0.1
local 127.0.0.1 dev lo table local proto kernel scope host src 127.0.0.1
broadcast 127.255.255.255 dev lo table local proto kernel scope link src 127.0.0.1
local 172.20.2.40 dev eth0 table local proto kernel scope host src 172.20.2.40
broadcast 172.20.2.255 dev eth0 table local proto kernel scope link src 172.20.2.40
local ::1 dev lo table local proto kernel metric 0 pref medium
--dns--
# Generated by Docker Engine.
# This file can be edited; Docker Engine will not make further changes once it
# has been modified.

nameserver 127.0.0.11
search tail18b785.ts.net
options edns0 trust-ad ndots:0

# Based on host file: '/etc/resolv.conf' (internal resolver)
# ExtServers: [host(127.0.0.53)]
# Overrides: []
# Option ndots from: internal
--hosts--
127.0.0.1	localhost
::1	localhost ip6-localhost ip6-loopback
fe00::	ip6-localnet
ff00::	ip6-mcastprefix
ff02::1	ip6-allnodes
ff02::2	ip6-allrouters
172.20.2.40	ws01.techvault.local ws01
--hostname--
ws01.techvault.local
--mounts--
overlay on / type overlay (rw,relatime,lowerdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145368/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145213/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145212/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145211/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145210/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145209/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145207/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145205/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145204/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145203/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145202/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145201/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145200/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145199/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145194/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145193/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145191/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145189/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145188/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145187/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/119925/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106954/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106953/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106952/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106951/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106950/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106949/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106948/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106947/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/106946/fs:/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/370/fs,upperdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145371/fs,workdir=/var/lib/containerd/io.containerd.snapshotter.v1.overlayfs/snapshots/145371/work,nouserxattr)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
tmpfs on /dev type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=666)
sysfs on /sys type sysfs (ro,nosuid,nodev,noexec,relatime)
mqueue on /dev/mqueue type mqueue (rw,nosuid,nodev,noexec,relatime)
shm on /dev/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=65536k,inode64)
tmpfs on /run type tmpfs (rw,nosuid,nodev,noexec,relatime,mode=755,inode64)
tmpfs on /tmp type tmpfs (rw,nosuid,nodev,noexec,relatime,inode64)
/dev/md2 on /home type ext4 (rw,relatime)
/dev/md2 on /var/log type ext4 (rw,relatime)
/dev/md2 on /keys/aptl_lab_key.pub type ext4 (ro,relatime)
/dev/md2 on /keys/kali_pivot_key.pub type ext4 (ro,relatime)
/dev/md2 on /etc/resolv.conf type ext4 (rw,relatime)
/dev/md2 on /etc/hostname type ext4 (rw,relatime)
/dev/md2 on /etc/hosts type ext4 (rw,relatime)
cgroup2 on /sys/fs/cgroup type cgroup2 (rw,nosuid,nodev,noexec,relatime,nsdelegate,memory_recursiveprot)
proc on /proc/bus type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/fs type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/irq type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sys type proc (ro,nosuid,nodev,noexec,relatime)
proc on /proc/sysrq-trigger type proc (ro,nosuid,nodev,noexec,relatime)
tmpfs on /proc/acpi type tmpfs (ro,relatime,inode64)
tmpfs on /proc/interrupts type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/kcore type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/keys type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/latency_stats type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /proc/scsi type tmpfs (ro,relatime,inode64)
tmpfs on /proc/timer_list type tmpfs (rw,nosuid,size=65536k,mode=755,inode64)
tmpfs on /sys/devices/virtual/powercap type tmpfs (ro,relatime,inode64)
tmpfs on /sys/firmware type tmpfs (ro,relatime,inode64)
--users--
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:65534:65534:Kernel Overflow User:/:/sbin/nologin
tss:x:59:59:Account used for TPM access:/:/usr/sbin/nologin
systemd-coredump:x:999:999:systemd Core Dumper:/:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/usr/share/empty.sshd:/usr/sbin/nologin
labadmin:x:1000:1000::/home/labadmin:/bin/bash
dev-user:x:1001:1001::/home/dev-user:/bin/bash
wazuh:x:998:998::/var/ossec:/sbin/nologin
--groups--
root:x:0:
bin:x:1:
daemon:x:2:
sys:x:3:
adm:x:4:
tty:x:5:
disk:x:6:
lp:x:7:
mem:x:8:
kmem:x:9:
wheel:x:10:labadmin,dev-user
cdrom:x:11:
mail:x:12:
man:x:15:
dialout:x:18:
floppy:x:19:
games:x:20:
tape:x:33:
video:x:39:
ftp:x:50:
lock:x:54:
audio:x:63:
users:x:100:
nobody:x:65534:
utmp:x:22:
utempter:x:35:
tss:x:59:
ssh_keys:x:101:
input:x:104:
kvm:x:36:
render:x:105:
sgx:x:106:
systemd-journal:x:190:
systemd-coredump:x:999:
sshd:x:74:
labadmin:x:1000:
dev-user:x:1001:
wazuh:x:998:wazuh
--sudo-rules--
/etc/sudoers.d/dev-user
dev-user ALL=(ALL) NOPASSWD:ALL
/etc/sudoers.d/labadmin
labadmin ALL=(ALL) NOPASSWD:ALL
--systemd-services--
  UNIT                           LOAD   ACTIVE SUB     DESCRIPTION
● lab-install.service            loaded failed failed  Install Purple Team Lab Services on First Boot
● rsyslog.service                loaded failed failed  System Logging Service
  sshd.service                   loaded active running OpenSSH server daemon
  systemd-journald.service       loaded active running Journal Service
● systemd-tmpfiles-setup.service loaded failed failed  Create Volatile Files and Directories
  systemd-user-sessions.service  loaded active exited  Permit User Sessions

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.
6 loaded units listed.
--process-tree--
    PID    PPID USER     COMMAND
      1       0 root     /usr/sbin/init
     54       1 root     /usr/lib/systemd/systemd-journald
     56       1 root     sshd: /usr/sbin/sshd -D [listener] 0 of 10-100 startups
    516       0 root     bash -lc    set +e   echo --os-release--   cat /etc/os-release   echo --id--   id   echo --pwd--   pwd   echo --uname--   uname -a   echo --capabilities-pid1--   grep "^Cap" /proc/1/status || true   if command -v capsh >/dev/null 2>&1; then     capsh --decode="$(awk "/^CapEff:/ {print \$2}" /proc/1/status)" || true   fi   echo --environment--   env | sort   echo --listeners--   (ss -lntup || netstat -lntup || true) 2>&1   echo --sshd-effective-config--   sshd -T 2>/dev/null | sort | sed -n "/^acceptenv /p;/^allowusers /p;/^authorizedkeysfile /p;/^passwordauthentication /p;/^permitrootlogin /p;/^permittty /p;/^port /p;/^pubkeyauthentication /p;/^usepam /p"   echo --network-addresses--   ip addr show   echo --routes--   ip route show table all   echo --dns--   cat /etc/resolv.conf   echo --hosts--   cat /etc/hosts   echo --hostname--   cat /etc/hostname   echo --mounts--   mount | sed -n "1,220p"   echo --users--   getent passwd | sed -n "1,220p"   echo --groups--   getent group | sed -n "1,220p"   echo --sudo-rules--   find /etc/sudoers.d -maxdepth 1 -type f -print -exec sed -n "1,80p" {} \;   echo --systemd-services--   systemctl --no-pager --type=service --state=running,exited,failed || true   echo --process-tree--   ps -eo pid,ppid,user,args || true
    667     516 root     ps -eo pid,ppid,user,args
