A kernel thread with an open port
Something on web-04 is listening on a port nobody opened. Tie the socket to a process, see through its disguise, and find the binary and the account behind it.
Briefing
An internal scan found an unexpected open TCP port on web-04. The host should only serve HTTP, HTTPS, and SSH.
ss shows which process owns each listening socket. ps shows who started it and with which parent. Real kernel threads run as root, sit in square brackets, and use no memory.
web-04 · Processes and ports
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.