lab@lab:/var/www/attack$ netstat -an | less
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address Foreign Address State
tcp6 0 0 :::80 :::* LISTEN
tcp6 0 0 :::22 :::* LISTEN
tcp6 0 0 ::ffff:202.107.195.5:22 ::ffff:60.55.164.1:1748 ESTABLISHED
lab@lab:/var/www/attack$ ps -ef
UID PID PPID C STIME TTY TIME CMD
root 1 0 0 Aug10 ? 00:00:03 init [2]
root 2 1 0 Aug10 ? 00:00:00 [ksoftirqd/0]
root 3 1 0 Aug10 ? 00:00:00 [events/0]
root 4 3 0 Aug10 ? 00:00:00 [khelper]
root 5 3 0 Aug10 ? 00:00:00 [kacpid]
root 38 3 0 Aug10 ? 00:00:00 [kblockd/0]
root 51 3 0 Aug10 ? 00:00:00 [aio/0]
root 50 1 0 Aug10 ? 00:00:04 [kswapd0]
root 187 1 0 Aug10 ? 00:00:00 [kseriod]
root 295 3 0 Aug10 ? 00:00:00 [reiserfs/0]
root 975 1 0 Aug10 ? 00:00:00 [khubd]
root 1165 1 0 Aug10 ? 00:00:00 [shpchpd_event]
root 1185 1 0 Aug10 ? 00:00:00 [pciehpd_event]
root 1968 1 0 Aug10 ? 00:00:10 /sbin/syslogd
root 1971 1 0 Aug10 ? 00:00:00 /sbin/klogd
root 1979 1 0 Aug10 ? 00:00:00 /usr/sbin/inetd
root 1987 1 0 Aug10 ? 00:00:16 /usr/sbin/sshd
root 2008 1 0 Aug10 ? 00:00:00 /usr/sbin/cron
root 6672 3 0 Aug20 ? 00:00:00 [pdflush]
root 6675 3 0 Aug20 ? 00:00:01 [pdflush]
root 22818 1 0 09:28 ? 00:00:00 /usr/sbin/apache2 -k start -DSSL
www-data 22819 22818 0 09:28 ? 00:00:00 /usr/sbin/apache2 -k start -DSSL
www-data 22820 22818 0 09:28 ? 00:00:00 /usr/sbin/apache2 -k start -DSSL
www-data 22827 22818 0 09:28 ? 00:00:00 /usr/sbin/apache2 -k start -DSSL
root 22946 1 0 09:37 tty1 00:00:00 /sbin/getty 38400 tty1
root 22987 1 0 09:37 tty2 00:00:00 /sbin/getty 38400 tty2
root 23028 1 0 09:37 tty4 00:00:00 /sbin/getty 38400 tty4
root 23069 1 0 09:37 tty5 00:00:00 /sbin/getty 38400 tty5
root 23103 1 0 09:37 tty6 00:00:00 /sbin/getty 38400 tty6
root 23151 1 0 09:38 tty3 00:00:00 /sbin/getty 38400 tty3
root 24189 1987 0 14:38 ? 00:00:00 sshd: lab [priv]
lab 24192 24189 0 14:38 ? 00:00:00 sshd: lab@pts/0
lab 24193 24192 0 14:38 pts/0 00:00:00 -bash
root 24225 1987 0 14:51 ? 00:00:00 sshd: lab [priv]
lab 24228 24225 0 14:51 ? 00:00:00 sshd: lab@pts/1
lab 24229 24228 0 14:51 pts/1 00:00:00 -bash
lab 24256 24229 0 14:53 pts/1 00:00:00 ps -ef
