Skip to content

Instantly share code, notes, and snippets.

@elijahgagne
Created March 16, 2019 15:36
Show Gist options
  • Save elijahgagne/3bdcbaab217ab9c2fba67d1d99e4b78a to your computer and use it in GitHub Desktop.
Save elijahgagne/3bdcbaab217ab9c2fba67d1d99e4b78a to your computer and use it in GitHub Desktop.
4543 11:33:54.397070 execve("/bin/ping", ["ping", "8.8.8.8", "-c", "1"], 0x7ffffb9e7ed8 /* 16 vars */) = 0
4543 11:33:54.402669 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.402925 brk(NULL) = 0x7fffc294d000
4543 11:33:54.403253 fcntl(0, F_GETFD) = 0
4543 11:33:54.403418 fcntl(1, F_GETFD) = 0
4543 11:33:54.403555 fcntl(2, F_GETFD) = 0
4543 11:33:54.403696 access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.403932 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.404205 access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.404425 openat(AT_FDCWD, "/etc/ld.so.cache", O_RDONLY|O_CLOEXEC) = 3
4543 11:33:54.404704 fstat(3, {st_mode=S_IFREG|0644, st_size=37928, ...}) = 0
4543 11:33:54.404889 mmap(NULL, 37928, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f4ef3e77000
4543 11:33:54.405270 close(3) = 0
4543 11:33:54.405562 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.405779 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libcap.so.2", O_RDONLY|O_CLOEXEC) = 3
4543 11:33:54.406124 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\20\30\0\0\0\0\0\0"..., 832) = 832
4543 11:33:54.406361 fstat(3, {st_mode=S_IFREG|0644, st_size=22768, ...}) = 0
4543 11:33:54.406520 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4ef3e70000
4543 11:33:54.406735 mmap(NULL, 2117976, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f4ef39f0000
4543 11:33:54.406964 mprotect(0x7f4ef39f4000, 2097152, PROT_NONE) = 0
4543 11:33:54.407420 mmap(0x7f4ef3bf4000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x4000) = 0x7f4ef3bf4000
4543 11:33:54.407690 close(3) = 0
4543 11:33:54.407930 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.408136 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libidn.so.11", O_RDONLY|O_CLOEXEC) = 3
4543 11:33:54.408638 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\0+\0\0\0\0\0\0"..., 832) = 832
4543 11:33:54.408968 fstat(3, {st_mode=S_IFREG|0644, st_size=206872, ...}) = 0
4543 11:33:54.409230 mmap(NULL, 2302000, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f4ef37b0000
4543 11:33:54.409598 mprotect(0x7f4ef37e2000, 2093056, PROT_NONE) = 0
4543 11:33:54.409774 mmap(0x7f4ef39e1000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x31000) = 0x7f4ef39e1000
4543 11:33:54.409974 close(3) = 0
4543 11:33:54.410182 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.410397 openat(AT_FDCWD, "/usr/lib/x86_64-linux-gnu/libnettle.so.6", O_RDONLY|O_CLOEXEC) = 3
4543 11:33:54.410794 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\340\200\0\0\0\0\0\0"..., 832) = 832
4543 11:33:54.411220 fstat(3, {st_mode=S_IFREG|0644, st_size=219304, ...}) = 0
4543 11:33:54.411580 mmap(NULL, 2314384, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f4ef3570000
4543 11:33:54.411858 mprotect(0x7f4ef35a4000, 2093056, PROT_NONE) = 0
4543 11:33:54.412070 mmap(0x7f4ef37a3000, 12288, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x33000) = 0x7f4ef37a3000
4543 11:33:54.412621 close(3) = 0
4543 11:33:54.413092 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.413499 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libresolv.so.2", O_RDONLY|O_CLOEXEC) = 3
4543 11:33:54.413863 read(3, "\177ELF\2\1\1\0\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\00008\0\0\0\0\0\0"..., 832) = 832
4543 11:33:54.414150 fstat(3, {st_mode=S_IFREG|0644, st_size=101168, ...}) = 0
4543 11:33:54.414469 mmap(NULL, 2206336, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f4ef3350000
4543 11:33:54.414679 mprotect(0x7f4ef3367000, 2097152, PROT_NONE) = 0
4543 11:33:54.414871 mmap(0x7f4ef3567000, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x17000) = 0x7f4ef3567000
4543 11:33:54.415117 mmap(0x7f4ef3569000, 6784, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4ef3569000
4543 11:33:54.415332 close(3) = 0
4543 11:33:54.415517 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory)
4543 11:33:54.415675 openat(AT_FDCWD, "/lib/x86_64-linux-gnu/libc.so.6", O_RDONLY|O_CLOEXEC) = 3
4543 11:33:54.415983 read(3, "\177ELF\2\1\1\3\0\0\0\0\0\0\0\0\3\0>\0\1\0\0\0\260\34\2\0\0\0\0\0"..., 832) = 832
4543 11:33:54.416164 fstat(3, {st_mode=S_IFREG|0755, st_size=2030544, ...}) = 0
4543 11:33:54.416319 mmap(NULL, 4131552, PROT_READ|PROT_EXEC, MAP_PRIVATE|MAP_DENYWRITE, 3, 0) = 0x7f4ef2f50000
4543 11:33:54.416515 mprotect(0x7f4ef3137000, 2097152, PROT_NONE) = 0
4543 11:33:54.416662 mmap(0x7f4ef3337000, 24576, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_DENYWRITE, 3, 0x1e7000) = 0x7f4ef3337000
4543 11:33:54.416846 mmap(0x7f4ef333d000, 15072, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_FIXED|MAP_ANONYMOUS, -1, 0) = 0x7f4ef333d000
4543 11:33:54.417015 close(3) = 0
4543 11:33:54.417226 mmap(NULL, 8192, PROT_READ|PROT_WRITE, MAP_PRIVATE|MAP_ANONYMOUS, -1, 0) = 0x7f4ef3e60000
4543 11:33:54.417389 arch_prctl(ARCH_SET_FS, 0x7f4ef3e60f00) = 0
4543 11:33:54.417755 mprotect(0x7f4ef3337000, 16384, PROT_READ) = 0
4543 11:33:54.417917 mprotect(0x7f4ef3567000, 4096, PROT_READ) = 0
4543 11:33:54.418237 mprotect(0x7f4ef37a3000, 8192, PROT_READ) = 0
4543 11:33:54.418527 mprotect(0x7f4ef39e1000, 4096, PROT_READ) = 0
4543 11:33:54.418694 mprotect(0x7f4ef3bf4000, 4096, PROT_READ) = 0
4543 11:33:54.418885 mprotect(0x7f4ef420e000, 4096, PROT_READ) = 0
4543 11:33:54.419062 mprotect(0x7f4ef3e27000, 4096, PROT_READ) = 0
4543 11:33:54.419203 munmap(0x7f4ef3e77000, 37928) = 0
4543 11:33:54.419538 brk(NULL) = 0x7fffc294d000
4543 11:33:54.419679 brk(0x7fffc296e000) = 0x7fffc296e000
4543 11:33:54.419848 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = -1 EFAULT (Bad address)
4543 11:33:54.420063 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND, permitted=1<<CAP_CHOWN|1<<CAP_DAC_OVERRIDE|1<<CAP_DAC_READ_SEARCH|1<<CAP_FOWNER|1<<CAP_FSETID|1<<CAP_KILL|1<<CAP_SETGID|1<<CAP_SETUID|1<<CAP_SETPCAP|1<<CAP_LINUX_IMMUTABLE|1<<CAP_NET_BIND_SERVICE|1<<CAP_NET_BROADCAST|1<<CAP_NET_ADMIN|1<<CAP_NET_RAW|1<<CAP_IPC_LOCK|1<<CAP_IPC_OWNER|1<<CAP_SYS_MODULE|1<<CAP_SYS_RAWIO|1<<CAP_SYS_CHROOT|1<<CAP_SYS_PTRACE|1<<CAP_SYS_PACCT|1<<CAP_SYS_ADMIN|1<<CAP_SYS_BOOT|1<<CAP_SYS_NICE|1<<CAP_SYS_RESOURCE|1<<CAP_SYS_TIME|1<<CAP_SYS_TTY_CONFIG|1<<CAP_MKNOD|1<<CAP_LEASE|1<<CAP_AUDIT_WRITE|1<<CAP_AUDIT_CONTROL|1<<CAP_SETFCAP|1<<CAP_MAC_OVERRIDE|1<<CAP_MAC_ADMIN|1<<CAP_SYSLOG|1<<CAP_WAKE_ALARM|1<<CAP_BLOCK_SUSPEND, inheritable=0}) = 0
4543 11:33:54.420238 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = -1 EFAULT (Bad address)
4543 11:33:54.420394 capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=0, permitted=1<<CAP_NET_ADMIN|1<<CAP_NET_RAW, inheritable=0}) = 0
4543 11:33:54.420553 prctl(PR_SET_KEEPCAPS, 1) = 0
4543 11:33:54.420709 getuid() = 0
4543 11:33:54.420849 setuid(0) = 0
4543 11:33:54.421002 prctl(PR_SET_KEEPCAPS, 0) = 0
4543 11:33:54.421232 getuid() = 0
4543 11:33:54.421514 geteuid() = 0
4543 11:33:54.421818 openat(AT_FDCWD, "/usr/lib/locale/locale-archive", O_RDONLY|O_CLOEXEC) = 3
4543 11:33:54.422183 fstat(3, {st_mode=S_IFREG|0644, st_size=1683056, ...}) = 0
4543 11:33:54.422342 mmap(NULL, 1683056, PROT_READ, MAP_PRIVATE, 3, 0) = 0x7f4ef3c8c000
4543 11:33:54.422531 close(3) = 0
4543 11:33:54.422774 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = -1 EFAULT (Bad address)
4543 11:33:54.422927 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=0, permitted=1<<CAP_NET_ADMIN|1<<CAP_NET_RAW, inheritable=0}) = 0
4543 11:33:54.423105 capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_NET_RAW, permitted=1<<CAP_NET_ADMIN|1<<CAP_NET_RAW, inheritable=0}) = 0
4543 11:33:54.423261 socket(AF_INET, SOCK_DGRAM, IPPROTO_ICMP) = -1 EACCES (Permission denied)
4543 11:33:54.423411 socket(AF_INET, SOCK_RAW, IPPROTO_ICMP) = 3
4543 11:33:54.423585 socket(AF_INET6, SOCK_DGRAM, IPPROTO_ICMPV6) = -1 EACCES (Permission denied)
4543 11:33:54.423725 socket(AF_INET6, SOCK_RAW, IPPROTO_ICMPV6) = 4
4543 11:33:54.423887 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, NULL) = -1 EFAULT (Bad address)
4543 11:33:54.424112 capget({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=1<<CAP_NET_RAW, permitted=1<<CAP_NET_ADMIN|1<<CAP_NET_RAW, inheritable=0}) = 0
4543 11:33:54.424274 capset({version=_LINUX_CAPABILITY_VERSION_3, pid=0}, {effective=0, permitted=1<<CAP_NET_ADMIN|1<<CAP_NET_RAW, inheritable=0}) = 0
4543 11:33:54.424478 socket(AF_INET, SOCK_DGRAM, IPPROTO_IP) = 5
4543 11:33:54.424877 connect(5, {sa_family=AF_INET, sin_port=htons(1025), sin_addr=inet_addr("8.8.8.8")}, 16) = 0
4543 11:33:54.425701 getsockname(5, {sa_family=AF_INET, sin_port=htons(52844), sin_addr=inet_addr("10.230.35.8")}, [16]) = 0
4543 11:33:54.426154 close(5) = 0
4543 11:33:54.426511 setsockopt(3, SOL_RAW, ICMP_FILTER, ~(1<<ICMP_ECHOREPLY|1<<ICMP_DEST_UNREACH|1<<ICMP_SOURCE_QUENCH|1<<ICMP_REDIRECT|1<<ICMP_TIME_EXCEEDED|1<<ICMP_PARAMETERPROB), 4) = 0
4543 11:33:54.426928 setsockopt(3, SOL_IP, IP_RECVERR, [1], 4) = 0
4543 11:33:54.427240 setsockopt(3, SOL_SOCKET, SO_SNDBUF, [324], 4) = 0
4543 11:33:54.427528 setsockopt(3, SOL_SOCKET, SO_RCVBUF, [65536], 4) = 0
4543 11:33:54.427900 getsockopt(3, SOL_SOCKET, SO_RCVBUF, [131072], [4]) = 0
4543 11:33:54.428432 fstat(1, {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 0), ...}) = 0
4543 11:33:54.428718 write(1, "PING 8.8.8.8 (8.8.8.8) 56(84) by"..., 45) = 45
4543 11:33:54.429249 setsockopt(3, SOL_SOCKET, SO_TIMESTAMP, [1], 4) = 0
4543 11:33:54.429598 setsockopt(3, SOL_SOCKET, SO_SNDTIMEO, "\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
4543 11:33:54.429805 setsockopt(3, SOL_SOCKET, SO_RCVTIMEO, "\1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0", 16) = 0
4543 11:33:54.430003 getpid() = 4543
4543 11:33:54.430165 rt_sigaction(SIGINT, {sa_handler=0x7f4ef4006440, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f4ef2f8ef20}, NULL, 8) = 0
4543 11:33:54.430400 rt_sigaction(SIGALRM, {sa_handler=0x7f4ef4006440, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f4ef2f8ef20}, NULL, 8) = 0
4543 11:33:54.430581 rt_sigaction(SIGQUIT, {sa_handler=0x7f4ef4006430, sa_mask=[], sa_flags=SA_RESTORER|SA_INTERRUPT, sa_restorer=0x7f4ef2f8ef20}, NULL, 8) = 0
4543 11:33:54.430735 rt_sigprocmask(SIG_SETMASK, [], NULL, 8) = 0
4543 11:33:54.430891 gettimeofday({tv_sec=1552750434, tv_usec=430952}, NULL) = 0
4543 11:33:54.431100 ioctl(1, TCGETS, {B38400 opost isig icanon echo ...}) = 0
4543 11:33:54.431256 ioctl(1, TIOCGWINSZ, {ws_row=39, ws_col=200, ws_xpixel=0, ws_ypixel=0}) = 0
4543 11:33:54.431419 gettimeofday({tv_sec=1552750434, tv_usec=431454}, NULL) = 0
4543 11:33:54.431568 gettimeofday({tv_sec=1552750434, tv_usec=431603}, NULL) = 0
4543 11:33:54.431785 sendto(3, "\10\0>c\21\277\0\1b\27\215\\\0\0\0\0\363\225\6\0\0\0\0\0\20\21\22\23\24\25\26\27"..., 64, 0, {sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("8.8.8.8")}, 16) = 64
4543 11:33:54.432320 setitimer(ITIMER_REAL, {it_interval={tv_sec=0, tv_usec=0}, it_value={tv_sec=10, tv_usec=0}}, NULL) = 0
4543 11:33:54.432556 recvmsg(3, {msg_name={sa_family=AF_INET, sin_port=htons(0), sin_addr=inet_addr("8.8.8.8")}, msg_namelen=128->16, msg_iov=[{iov_base="E\0\0T'O\0\0u\1\340\\\10\10\10\10\n\346#\10\0\0Fc\21\277\0\1b\27\215\\"..., iov_len=192}], msg_iovlen=1, msg_control=[{cmsg_len=32, cmsg_level=SOL_SOCKET, cmsg_type=SCM_TIMESTAMP, cmsg_data={tv_sec=1552750434, tv_usec=458431}}], msg_controllen=32, msg_flags=0}, 0) = 84
4543 11:33:54.458888 write(1, "64 bytes from 8.8.8.8: icmp_seq="..., 55) = 55
4543 11:33:54.459242 write(1, "\n", 1) = 1
4543 11:33:54.459506 write(1, "--- 8.8.8.8 ping statistics ---\n", 32) = 32
4543 11:33:54.459755 write(1, "1 packets transmitted, 1 receive"..., 60) = 60
4543 11:33:54.460028 write(1, "rtt min/avg/max/mdev = 26.828/26"..., 53) = 53
4543 11:33:54.460299 exit_group(0) = ?
4543 11:33:54.460879 +++ exited with 0 +++
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment