Остальные 90%

# Creates files cert.pem and key.pem
$ openssl req -x509 -keyout key.pem -out cert.pem \
    -days 365 -nodes -subj '/CN=localhost/'

# Check there is no SAN in certificate
$ openssl x509 -in cert.pem -noout -ext subjectAltName
No extensions in certificate

$ openssl s_server -key key.pem -cert cert.pem -WWW -port 4433

$ curl https://localhost:4433/cert.pem --cacert cert.pem
-----BEGIN CERTIFICATE-----
MIIDCTCCAfGgAwIBAgIUO6d0vnNmNST77...
...

# Using '--resolve' to avoid messing with /etc/hosts
$ curl https://example.com:4433/cert.pem --cacert cert.pem \
    --resolve 'example.com:4433:127.0.0.1'
curl: (60) SSL: certificate subject name 'localhost' does not match
    target host name 'example.com'

$ go version
go version go1.22.1 linux/amd64

$ CERT=cert.pem URL='https://localhost:4433/' go run main.go 
2025/12/22 00:33:23 Error making request: Get "https://localhost:4433/":
    tls: failed to verify certificate:
    x509: certificate relies on legacy Common Name field, use SANs instead
exit status 1

$ openssl req -x509 -keyout key.pem -out cert.pem \
    -days 365 -nodes -subj '/CN=localhost/' \
    -addext 'subjectAltName = DNS:localhost'

# Check SAN exists now
$ openssl x509 -in cert.pem -noout -ext subjectAltName
X509v3 Subject Alternative Name:
    DNS:localhost

$ openssl s_server -key key.pem -cert cert.pem -WWW -port 4433

$ CERT=cert.pem URL='https://localhost:4433/' go run main.go 
-----BEGIN CERTIFICATE-----
MIIDCTCCAfGgAwIBAgIUO6d0vnNmNST77...
...

DOCKER_HOST='ssh://mint@localhost' docker ps
error during connect: Get "http://docker.example.com/v1.50/containers/json": command [ssh -o ConnectTimeout=30 -T -l mint -- localhost docker system dial-stdio] has exited with exit status 255, ... 
Permission denied, please try again.
mint@localhost: Permission denied (publickey,password).

$ DOCKER_HOST='ssh://mint@localhost' docker ps
Cannot connect to the Docker daemon at http://docker.example.com. Is the docker daemon running?

# Manual check on a remote host:
$ curl --unix-socket /var/run/docker.sock 'http://docker.example.com/images/json'
curl: (7) Failed to connect to docker.example.com port 80 after 0 ms: Couldn't connect to server

$ DOCKER_HOST='ssh://mint@localhost' docker ps
CONTAINER ID   IMAGE  ...

$ docker pull python:3.13
...
$ docker save python:3.13 -o python.tar
$ docker -H 'ssh://user:next-host' docker load -i python.tar

# IPv4 of google.com?
$ getent ahostsv4 google.com
142.250.9.138   STREAM google.com
...

# IPv6 of google.com?
$ getent ahostsv6 google.com
2607:f8b0:4002:c11::65 STREAM google.com
...

# User entries for root and mint?
$ getent passwd root mint
root:x:0:0:root:/root:/bin/bash
mint:x:1000:1000:mint:/home/mint:/bin/bash

# Default ports?
$ getent services ssh ntp mail
ssh                   22/tcp
ntp                   123/udp
smtp                  25/tcp mail

$ sudo docker run -it --rm ubuntu
[sudo] password for mint:
root@0e7dbe8b1974:/# curl
bash: curl: command not found
root@0e7dbe8b1974:/# dig
bash: dig: command not found
root@0e7dbe8b1974:/# host
bash: host: command not found
root@0e7dbe8b1974:/# ping
bash: ping: command not found
root@0e7dbe8b1974:/# getent ahosts google.com
209.85.233.139  STREAM google.com
209.85.233.139  DGRAM
209.85.233.139  RAW
209.85.233.101  STREAM
209.85.233.101  DGRAM
209.85.233.101  RAW
...
root@0e7dbe8b1974:/#

# Hmm, is 'open' a binary or a script?

$ command -v open
/usr/bin/open
$ file -b /usr/bin/open
symbolic link to /etc/alternatives/open
$ file -b /etc/alternatives/open
symbolic link to /usr/bin/xdg-open
$ file -b /usr/bin/xdg-open
POSIX shell script, ASCII text executable

# Run all as root

# 1. Create 2 alternative scripts:
$ cat /usr/local/bin/alttest.1
echo 'Hello Elliot'

$ cat /usr/local/bin/alttest.2
echo 'Hello Darlene'

# 2. Install alternatives:
# now /usr/bin/alttest will point to scripts
$ update-alternatives --install /usr/bin/alttest alttest \
    /usr/local/bin/alttest.1 10
$ update-alternatives --install /usr/bin/alttest alttest \
    /usr/local/bin/alttest.2 20

$ alttest
Hello Darlene

$ update-alternatives --list alttest
/usr/local/bin/alttest.1
/usr/local/bin/alttest.2

# Set alttest.1 as default
$ update-alternatives --set alttest /usr/local/bin/alttest.1

$ update-alternatives --query alttest
...
Value: /usr/local/bin/alttest.1
...

$ alttest
Hello Elliot

# Clean up
$ update-alternatives --remove-all alttest
$ alttest
alttest: command not found

# Change contents of d.txt and update the file
$ echo 321 > a/b/c/d.txt
$ tar -rf archive.tar a/b/c/d.txt

# See 2 versions here
$ tar -vtf archive.tar
drwxrwxr-x mint/mint         0 2025-04-24 00:01 a/
drwxrwxr-x mint/mint         0 2025-04-24 00:01 a/b/
drwxrwxr-x mint/mint         0 2025-04-24 00:01 a/b/c/
-rw-rw-r-- mint/mint         4 2025-04-24 00:01 a/b/c/d.txt
-rw-rw-r-- mint/mint         4 2025-04-24 00:21 a/b/c/d.txt

# `tar -x` would create the last version of d.txt
$ rm -rf a/
$ tar -xf archive.tar
$ cat a/b/c/d.txt
321

$ tar -xf archive.tar a/b/c/d.txt -O
123
321

# Note creation time
$ tar -vtf archive.tar --occurrence=1 a/b/c/d.txt
-rw-rw-r-- mint/mint         4 2025-04-24 00:01 a/b/c/d.txt

# Extract file to stdout: old contents!
$ tar -xf archive.tar --occurrence=1 a/b/c/d.txt -O
123

# New contents are here as well
$ tar -xf archive.tar --occurrence=2 a/b/c/d.txt -O
321

$ tar -cf backup.tar a/ -V "Created at $(date)"

# --list shows the label!
$ tar -tf backup.tar
created at Thu Apr 24 23:23:04 MSK 2025
a/
a/b/
a/b/c/
a/b/c/d.txt

# Press `!` after prompt
$ tar -cf tmp.tar a/ -L 2
Prepare volume #2 for ‘tmp.tar’ and hit return: ~
$ echo SHLVL
2

# Create test file hier
$ mkdir -p a/b/c
$ echo 123 > a/b/c/d.txt
$ tar -cf archive.tar a/

# Show each stored file name
$ tar -tf archive.tar
a/
a/b/
a/b/c/
a/b/c/d.txt

# Add a secret string after 2 terminating zero blocks
$ echo 'Hello Elliot' >> archive.tar

# Nothing suspicious...
$ tar -tf archive.tar
a/
a/b/
a/b/c/
a/b/c/d.txt

# ...but secret string is still here!
$ tail -n1 archive.tar
Hello Elliot

# Create some archive
$ mkdir -p a/b/c
$ echo 123 > a/b/c/d
$ tar -cf some_archive.tar a

# Look at files inside
$ tar -tf some_archive.tar 
a/
a/b/
a/b/c/
a/b/c/d

# Try to unpack to a non-existent directory
$ tar -xf some_archive.tar -C tmp_dir
tar: tmp_dir: Cannot open: No such file or directory
tar: Error is not recoverable: exiting now

$ tar -tf some_archive.tar \
    --transform 's,^,tmp_dir/,' --show-transformed-names
tmp_dir/a/
tmp_dir/a/b/
tmp_dir/a/b/c/
tmp_dir/a/b/c/d

$ tar -xf some_archive.tar --transform 's,^,tmp_dir/,' 
$ cat tmp_dir/a/b/c/d
123

# Substitute b for tmp_dir
$ tar -tf some_archive.tar \
    --show-transformed-names --transform 's,b,tmp_dir,'
a/
a/tmp_dir/
a/tmp_dir/c/
a/tmp_dir/c/d

# Remove b subdirectory (// is the same as /)
$ tar -tf some_archive.tar \
    --show-transformed-names --transform 's,b,,'
a/
a//
a//c/
a//c/d

tar -tf some_archive.tar \
    --transform 's,^,/tmp/,' --show-transformed-names
tar: Removing leading `/' from member names
tmp/a/
tmp/a/b/
tmp/a/b/c/
tmp/a/b/c/d

$ tar -tf some_archive.tar \
    --transform 's,^,/tmp/,' --show-transformed-names -P
/tmp/a/
/tmp/a/b/
/tmp/a/b/c/
/tmp/a/b/c/d

$ ip route show
default via 192.168.1.1 dev wlp0s20f3 proto dhcp metric 600 
169.254.0.0/16 dev wlp0s20f3 scope link metric 1000 
172.17.0.0/16 dev docker0 proto kernel scope link src 172.17.0.1 linkdown 
192.168.1.0/24 dev wlp0s20f3 proto kernel scope link src 192.168.1.13 metric 600

# Note: interface 'netherlands' is up!
$ ip -br link
lo               UNKNOWN        00:00:00:00:00:00 
enp58s0          DOWN           95:85:36:4a:ee:7f 
wlp0s20f3        UP             2f:61:0a:d7:6f:59 
docker0          DOWN           05:b2:b8:f7:70:91 
netherlands      UNKNOWN        <POINTOPOINT,NOARP,UP,LOWER_UP>

$ ip rule
0: from all lookup local
32764: from all lookup main suppress_prefixlength 0
32765: not from all fwmark 0xca6c lookup 51820
32766: from all lookup main
32767: from all lookup default

# Use table number 51820 to see routes: here it is!
$ ip route show table 51820
default dev netherlands scope link

$ ip route get 1.1.1.1
1.1.1.1 dev netherlands table 51820 src 10.20.30.40 uid 1000
    cache
$ ip route get 192.168.1.12
192.168.1.12 dev wlp0s20f3 src 192.168.1.13 uid 1000
    cache

$ ls -1
main.py
utils.py

$ cat *
# main.py
import utils

print(utils.hi)

# utils.py
hi = 'hi'

$ python3 main.py
hi

$ ls -R1
.:
__pycache__
main.py
utils.py

./__pycache__:
utils.cpython-312.pyc

$ python3 -m py_compile main.py
$ ls -1 __pycache__
main.cpython-312.pyc
utils.cpython-312.pyc

# Remove source code
$ rm *.py

# Place .pyc-files in place of .py
$ mv __pycache__/* .
$ rm -rf __pycache__; ls -1
main.cpython-312.pyc
utils.cpython-312.pyc

# Run!
$ python3 main.cpython-312.pyc
hi

$ decompyle3 __pycache__/utils.cpython-312.pyc 
...
Unsupported Python version, 3.12.0, for decompilation
...

$ cat /etc/polkit-1/localauthority.conf.d/*
[Configuration]
AdminIdentities=unix-user:0
[Configuration]
AdminIdentities=unix-group:sudo;unix-group:admin

# cat 50-default.rules
polkit.addAdminRule(function(action, subject) {
    return ["unix-group:wheel"];
});

mint ALL =(ALL) !ALL
mint ALL = NOPASSWD: /usr/bin/ls

$ id -nG
mint adm sudo docker
$ sudo touch file.txt
Sorry, user mint is not allowed to execute '/usr/bin/touch' as root on this-host.
$ sudo ls
Audio
Desktop
...