R01.06.01.04 · 任务小类

Shell操作与系统状态查询

Shell operations & system state queries

Answer questions about and change OS state with ad-hoc shell commands (control class).

20 条本项目编写的提案 · 分类 v1.1 · 新增基准运行 0 次。下方验证方式与部分得分规则是设计，不是执行结果。

典型应用: bash · zsh · PowerShell
小类 GUI 需求标签: CL · CLI 足够

任务提案 · 20

展开查看完整原文与建议检查方式；两种界面均保留提案英文原文。

R01.06.01.04-T01 Identify the process and unit listening on TCP 8443

原始指令

On the Ubuntu 24.04 VM something is listening on TCP 8443. Find the PID, executable path, owning user and systemd unit, and write them to /root/answer.json as {"pid":..,"exe":..,"user":..,"unit":..}.

平台: lin · Linux
应用: bash · ss · systemctl
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 1 / 5

建议验证方式

answer.json fields equal ground truth read by the grader from /proc and systemctl status at check time (decoy: a socket-activated unit on 8444 and a Docker proxy on 8080). Exact string match on exe and unit; pid must be the live listener.

建议部分得分

30% pid; 25% exe; 15% user; 30% unit

R01.06.01.04-T02 List stopped automatic services on Windows as CSV

原始指令

In PowerShell 7 on Windows 11, list every service with StartType Automatic (excluding Automatic Delayed Start and trigger-start services) that is currently Stopped. Write C:\out\stopped_auto.csv with columns Name,DisplayName,BinaryPath sorted by Name.

平台: win · Windows
应用: PowerShell
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP02 · 记录 / 表格
条件: 未声明
提案难度: 2 / 5

建议验证方式

Grader recomputes from the SCM (sc qc, registry DelayedAutostart and TriggerInfo keys) after seeding 4 stopped auto services, 2 delayed and 1 trigger-start decoy; CSV row set must match exactly with correct sort and header.

建议部分得分

20% header and sort; 60% row-set F1 vs truth; 20% BinaryPath values exact

R01.06.01.04-T03 Audit non-Apple launchd jobs that run at load

原始指令

On macOS 15 with zsh, list every launchd job in /Library/LaunchDaemons, /Library/LaunchAgents and ~/Library/LaunchAgents that has RunAtLoad true and whose program binary is not signed by Apple. Write ~/out/launchd_audit.json as a list of {label, plist, program, team_id}.

平台: mac · macOS
应用: zsh · plutil · codesign
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 4 / 5

建议验证方式

Grader seeds 5 qualifying jobs (2 with ProgramArguments only, 1 unsigned with team_id null), 3 RunAtLoad=false decoys and 2 Apple-signed decoys; output set compared by label with exact program path and team_id from codesign -dv.

建议部分得分

50% label set F1; 30% program paths exact; 20% team IDs exact

R01.06.01.04-T04 Top SSH brute-force sources from the journal

原始指令

From the systemd journal of the last 24 hours on the Linux VM, count failed SSH password and invalid-user attempts per source IP and write the top 5 to /root/ssh_top5.txt as 'ip count' lines, descending, ties broken by IP ascending.

平台: lin · Linux
应用: bash · journalctl · awk
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 2 / 5

建议验证方式

Grader-injected journal entries (incl. IPv6 sources, 'Connection closed by authenticating user' decoys and entries older than 24 h) define the truth; file must match exactly line by line.

建议部分得分

50% correct top-5 IP set; 30% exact counts; 20% ordering and tie-break

R01.06.01.04-T05 Clean up the Windows system PATH safely

原始指令

In PowerShell on Windows 11, append C:\tools\bin to the machine PATH exactly once, remove entries pointing to directories that do not exist, and remove exact duplicates keeping the first occurrence. Preserve order otherwise and keep REG_EXPAND_SZ variables like %SystemRoot% unexpanded.

平台: win · Windows
应用: PowerShell · reg
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

HKLM\...\Session Manager\Environment Path: value type REG_EXPAND_SZ, equals the grader's expected list (seed had 3 dead dirs, 2 duplicates, 4 %var% entries); a WM_SETTINGCHANGE broadcast lets a new shell see C:\tools\bin.

建议部分得分

25% C:\tools\bin present once; 30% dead entries removed; 20% duplicates removed in order; 25% type and unexpanded vars preserved

R01.06.01.04-T06 Find large recent files owned outside a group

原始指令

Under /srv on the Linux VM, find regular files modified in the last 7 days, larger than 50 MB, whose owner is not a member of group 'media'. Write /root/offenders.tsv with path, owner, size_bytes, mtime_iso, sorted by size descending. Do not follow symlinks.

平台: lin · Linux
应用: bash · find · getent
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP02 · 记录 / 表格
条件: 未声明
提案难度: 3 / 5

建议验证方式

Grader seeds 9 matches and decoys (symlinked big file, 49.9 MB file, member via supplementary group, file modified 8 days ago); TSV compared exactly (path set, sizes, ISO mtimes in UTC).

建议部分得分

60% path set exact; 25% size and mtime columns; 15% sort order

R01.06.01.04-T07 Create a deploy user with a narrow sudo rule

原始指令

Create user 'deploy' with UID 1500, primary group deploy, supplementary groups docker and www-data, shell /bin/bash, and an authorized key from /root/fixtures/deploy.pub. Allow it to run only 'systemctl restart app.service' and 'systemctl status app.service' as root without a password, via a file in /etc/sudoers.d.

平台: lin · Linux
应用: bash · useradd · visudo
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

getent passwd/group match; authorized_keys mode 600 owned by deploy; visudo -c passes; `sudo -l -U deploy` lists exactly the two commands NOPASSWD; grader as deploy can restart app.service but 'systemctl stop app.service' and 'sudo -i' fail.

建议部分得分

30% user, UID, groups and shell; 20% SSH key correct with modes; 50% sudo rule exact and not broader

R01.06.01.04-T08 Unexpected shutdowns in the last 30 days

原始指令

Using PowerShell on Windows Server 2022, find every unexpected shutdown in the last 30 days (System log Event ID 6008 and Kernel-Power 41) and write C:\out\crashes.csv with TimeCreated (ISO 8601 UTC), EventId and, for 41, BugcheckCode.

平台: win · Windows
应用: PowerShell · Get-WinEvent
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP02 · 记录 / 表格
条件: 未声明
提案难度: 3 / 5

建议验证方式

Grader injects events (incl. 2 older than 30 days and 1 Event ID 41 from another provider); CSV rows compared by timestamp to the second, EventId and BugcheckCode parsed from event XML.

建议部分得分

50% correct event set; 30% timestamps in UTC; 20% bugcheck codes

R01.06.01.04-T09 Which apps hold Full Disk Access and Accessibility

原始指令

On macOS 15 (Terminal has Full Disk Access), read the system and user TCC databases and write ~/out/tcc.json mapping each of the services kTCCServiceSystemPolicyAllFiles and kTCCServiceAccessibility to the sorted list of client bundle IDs or paths currently allowed (auth_value 2).

平台: mac · macOS
应用: zsh · sqlite3
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 3 / 5

建议验证方式

Grader-seeded TCC rows include denied (auth_value 0) and limited entries and a path-type client; JSON lists compared exactly against the grader's query of both TCC.db files.

建议部分得分

50% Full Disk Access list exact; 50% Accessibility list exact

R01.06.01.04-T10 Reclaim space held by deleted-but-open files

原始指令

df shows /data 100% full but du reports 40%. Find which processes hold deleted files open on /data, free the space by restarting only the responsible systemd service (not killing other processes), and write the service name and freed GB to /root/reclaim.txt.

平台: lin · Linux
应用: bash · lsof · systemctl
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

df /data <= 45% after; the guilty service restarted (new MainPID), the 3 decoy processes keep their PIDs and start times; reclaim.txt names the unit and a freed figure within 0.5 GB of measured.

建议部分得分

40% space reclaimed; 35% only the responsible service restarted; 25% report correct

R01.06.01.04-T11 Persistent systemd timer for a nightly backup

原始指令

Create a systemd service and timer so /opt/backup/run.sh runs daily at 02:30 local time with a randomized delay of up to 10 minutes, catches up after downtime (Persistent), runs as user 'backup' with Nice=10, and logs to the journal. Enable and start the timer.

平台: lin · Linux
应用: bash · systemctl
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

systemctl show: timer OnCalendar normalizes to *-*-* 02:30:00, RandomizedDelaySec=10min, Persistent=yes, enabled+active; service User=backup, Nice=10; systemd-analyze verify clean; grader triggers the service once and checks success in the journal.

建议部分得分

40% timer schedule, delay and persistence; 30% service user and nice; 30% enabled and a successful run

R01.06.01.04-T12 Find SYSTEM scheduled tasks running user-writable binaries

原始指令

Audit Windows scheduled tasks: list every task whose principal is SYSTEM and whose action executable (after expanding env vars and stripping quotes/args) sits in a directory writable by BUILTIN\Users or Authenticated Users. Write C:\out\weak_tasks.json with TaskPath, Exe, WritableBy.

平台: win · Windows
应用: PowerShell · icacls
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP12 · 答案 / 决策
条件: 未声明
提案难度: 5 / 5

建议验证方式

Grader seeds 4 vulnerable tasks (one quoted path with args, one %ProgramData% path, one inherited ACE) and 5 decoys (non-SYSTEM, read-only ACLs, COM handler actions); output compared by TaskPath with exact exe paths and principal names.

建议部分得分

60% task set F1; 25% exe paths exact; 15% WritableBy principals

R01.06.01.04-T13 Restrict HTTPS to the internal network with nftables

原始指令

On the Debian 12 VM, replace any ad-hoc rules with a persistent nftables ruleset: allow established/related, loopback, SSH from 10.0.0.0/8, HTTPS (443) from 10.0.0.0/8 and 192.168.50.0/24 only, ICMP echo, and drop everything else inbound. It must survive reboot and not cut your current SSH session.

平台: lin · Linux
应用: bash · nft · systemctl
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 4 / 5

建议验证方式

After grader reboot: nftables.service enabled; probes from 10.1.2.3 and 192.168.50.7 reach 443, from 172.16.0.9 do not; SSH from 10.x works, from 172.16.x times out; ping works; default input policy drop.

建议部分得分

30% ruleset persistent across reboot; 40% HTTPS allow-list probes correct; 30% SSH, ICMP and default-drop correct

R01.06.01.04-T14 Set hostname, timezone and NTP sources

原始指令

On the Ubuntu VM set the static hostname to 'lab-db-02' (and fix /etc/hosts), timezone to Europe/Berlin, and configure chrony to use ntp1.lab.test and ntp2.lab.test with iburst only (remove pool lines). Confirm the clock synchronizes.

平台: lin · Linux
应用: bash · hostnamectl · timedatectl · chronyc
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

hostnamectl static = lab-db-02 and /etc/hosts maps it to 127.0.1.1; timedatectl Time zone Europe/Berlin; chrony.conf has exactly the two server lines with iburst; chronyc sources shows one selected (^*) lab server within grader timeout.

建议部分得分

30% hostname and hosts; 20% timezone; 50% chrony sources exact and synced

R01.06.01.04-T15 Disk usage per file extension including hidden files

原始指令

With PowerShell, compute total bytes per file extension under D:\Projects including hidden and system files (extension lower-cased; files without extension as '(none)'), and write the top 10 to D:\out\ext_top10.csv as Extension,Bytes,Count sorted by Bytes descending.

平台: win · Windows
应用: PowerShell
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP02 · 记录 / 表格
条件: 未声明
提案难度: 3 / 5

建议验证方式

Grader recomputes with hidden/system files, mixed-case extensions, multi-dot names (.tar.gz counts as .gz) and a junction that must not be followed; CSV compared exactly.

建议部分得分

50% top-10 extension set and order; 35% byte totals exact; 15% counts exact

R01.06.01.04-T16 Battery and AC power schedule with pmset

原始指令

On the macOS laptop VM set display sleep to 10 min on battery and 30 min on AC, system sleep 20 min on battery and never on AC, disable Power Nap on battery only, and schedule a repeating wake/power-on at 07:00 on weekdays.

平台: mac · macOS
应用: zsh · pmset
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 3 / 5

建议验证方式

pmset -g custom: Battery displaysleep 10, sleep 20, powernap 0; AC Power displaysleep 30, sleep 0, powernap unchanged from seed (1); pmset -g sched shows repeating wakeorpoweron MTWRF at 7:00AM.

建议部分得分

40% display and system sleep per source; 20% Power Nap battery-only; 40% weekday schedule exact

R01.06.01.04-T17 Trace and remove a rogue HTTP_PROXY variable

原始指令

Every new login shell for user 'ana' has HTTP_PROXY=http://10.9.9.9:3128 set, breaking downloads. Find where it is set (it may be in a sourced file several levels deep), remove only that assignment, and write the file path and line number to /root/proxy_origin.txt.

平台: lin · Linux
应用: bash · grep
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

`sudo -iu ana env` lacks HTTP_PROXY and still has the 4 other seeded variables; the origin (e.g. a file sourced from /etc/profile.d via an include) has only that line removed (diff vs seed = 1 line); proxy_origin.txt names the right path:line; decoy commented assignments untouched.

建议部分得分

40% variable gone in login shells; 30% only that line removed; 30% origin reported correctly

R01.06.01.04-T18 Report and remove orphaned MSI uninstall entries

原始指令

On Windows 11, find Uninstall registry entries (HKLM 64/32-bit and HKCU) whose UninstallString uses MsiExec with a product code not registered in the Windows Installer database. Export them to C:\out\orphans.reg first, write their DisplayNames to C:\out\orphans.txt, then delete those keys.

平台: win · Windows
应用: PowerShell · reg
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: risk · 高风险 / 不可逆
提案难度: 4 / 5

建议验证方式

Grader seeds 3 orphans (one in WOW6432Node, one HKCU) and 6 valid MSI products; after run the 3 keys are absent and valid ones intact; orphans.reg re-imports those 3 keys exactly; orphans.txt names match.

建议部分得分

30% backup export complete; 30% names reported; 40% exactly the orphans deleted

R01.06.01.04-T19 Raise a service's memory limit after OOM kills

原始指令

app.service keeps getting OOM-killed. From the journal and cgroup memory events, determine the current MemoryMax and the peak usage before the last kill, then add a drop-in setting MemoryHigh=1.2G and MemoryMax=1.5G, reload and restart. Write the old limit and observed peak to /root/oom.json.

平台: lin · Linux
应用: bash · systemctl · journalctl
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP08 · 应用 / 系统状态
条件: 未声明
提案难度: 4 / 5

建议验证方式

systemctl show app.service: MemoryHigh=1288490188, MemoryMax=1610612736 via /etc/systemd/system/app.service.d/*.conf (unit file unchanged); service active; oom.json old limit equals seed (768M) and peak within 5 MB of the cgroup memory.peak the grader recorded.

建议部分得分

40% drop-in with exact limits; 20% unit file untouched and service active; 40% old limit and peak reported

R01.06.01.04-T20 Fleet inventory over SSH into one CSV

原始指令

From the jump host, collect for each host in ~/hosts.txt (3 Debian/Ubuntu containers, key auth set up): OpenSSL version, kernel release, uptime in seconds, and number of pending security updates. Write ~/fleet.csv with host,openssl,kernel,uptime_s,sec_updates. One host has a stale host key; handle it without disabling host-key checking globally.

平台: lin · Linux
应用: bash · ssh · apt
交互表面: term · 终端
GUI 需求 · 任务设定: CL · CLI 足够
GUI 需求 · 普通权限: CL · CLI 足够
交互原语: code · 代码与命令
工作产物: WP02 · 记录 / 表格
条件: interrupt · 中断
提案难度: 5 / 5

建议验证方式

Grader queries each host itself; openssl and kernel exact, uptime within 120 s, sec_updates exact (apt list --upgradable from -security pockets); known_hosts updated only for the changed host (ssh-keygen -R used, no StrictHostKeyChecking=no in ~/.ssh/config).

建议部分得分

20% stale host key handled correctly; 30% openssl and kernel; 15% uptime; 35% security update counts

已有研究映射

以下沿用研究目录中的基准与小类映射，不是逐题标注、执行记录或产品背书。

Shell操作与系统状态查询

任务提案 · 20

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

原始指令

建议验证方式

建议部分得分

已有研究映射

同工作流族的小类