1521 lines
111 KiB
Plaintext
1521 lines
111 KiB
Plaintext
|
||
[38;5;238m▄[38;5;233m▄[38;5;235m▄[38;5;65m▄[48;5;239m[38;5;107m▄[48;5;234m[38;5;71m▄[48;5;233m[38;5;71m▄[48;5;232m[38;5;71m▄[48;5;0m[38;5;71m▄[48;5;232m[38;5;71m▄[48;5;232m[38;5;71m▄[48;5;233m[38;5;71m▄[48;5;233m[38;5;71m▄[48;5;235m[38;5;71m▄[48;5;240m[38;5;65m▄[0m[38;5;237m▄[38;5;234m▄[38;5;233m▄[38;5;232m▄[38;5;239m▄[0m
|
||
[38;5;233m▄[38;5;246m▄[48;5;234m[38;5;71m▄[48;5;237m[38;5;71m▄[48;5;71m [38;5;65m▄[48;5;71m[38;5;237m▄[48;5;71m[38;5;233m▄[48;5;71m[38;5;233m▄[48;5;71m[38;5;233m▄[48;5;71m[38;5;237m▄[48;5;71m[38;5;65m▄[48;5;71m [48;5;65m[38;5;71m▄[48;5;235m[38;5;71m▄[48;5;235m[38;5;71m▄[0m[38;5;237m▄[38;5;234m▄[0m
|
||
[38;5;245m▄[38;5;233m▄[48;5;233m[38;5;71m▄[48;5;239m[38;5;71m▄[48;5;71m [38;5;235m▄[48;5;71m[38;5;232m▄[48;5;236m[38;5;64m▄[48;5;234m[38;5;76m▄[48;5;232m[38;5;76m▄[48;5;234m[38;5;76m▄[48;5;2m[38;5;76m▄[48;5;64m[38;5;76m▄[48;5;70m[38;5;76m▄[48;5;70m[38;5;76m▄[48;5;64m[38;5;76m▄[48;5;2m[38;5;76m▄[48;5;22m[38;5;76m▄[48;5;232m[38;5;76m▄[48;5;232m[38;5;70m▄[48;5;234m[38;5;22m▄[48;5;65m[38;5;232m▄[48;5;71m[38;5;232m▄[48;5;71m[38;5;238m▄[48;5;71m [48;5;237m[38;5;71m▄[48;5;236m[38;5;71m▄[0m[38;5;234m▄[38;5;238m▄[0m
|
||
[38;5;239m▄[38;5;233m▄[48;5;235m[38;5;71m▄[48;5;238m[38;5;71m▄[48;5;71m [38;5;0m▄[48;5;236m[38;5;2m▄[48;5;232m[38;5;76m▄[48;5;70m[38;5;76m▄[48;5;76m [38;5;70m▄[48;5;76m[38;5;64m▄[48;5;76m[38;5;2m▄[48;5;76m[38;5;22m▄[48;5;76m[38;5;22m▄[48;5;76m[38;5;22m▄[48;5;76m[38;5;2m▄[48;5;76m[38;5;2m▄[48;5;76m[38;5;64m▄[48;5;76m[38;5;70m▄[48;5;76m [48;5;22m[38;5;76m▄[48;5;0m[38;5;76m▄[48;5;234m[38;5;64m▄[48;5;71m[38;5;232m▄[48;5;71m[38;5;235m▄[48;5;71m [48;5;234m[38;5;71m▄[48;5;234m[38;5;71m▄[0m[38;5;234m▄[38;5;233m▄[0m
|
||
[38;5;233m▄[38;5;71m▄[48;5;233m[38;5;71m▄[48;5;71m [38;5;235m▄[48;5;65m[38;5;235m▄[48;5;0m[38;5;255m▄[48;5;22m[38;5;15m▄[48;5;235m[38;5;15m▄[48;5;242m[38;5;15m▄[48;5;249m[38;5;15m▄[48;5;254m[38;5;15m▄[48;5;15m [38;5;255m▄[48;5;255m[38;5;234m▄[48;5;248m[38;5;251m▄[48;5;240m[38;5;15m▄[48;5;237m[38;5;15m▄[48;5;235m[38;5;15m▄[48;5;64m[38;5;15m▄[48;5;70m[38;5;251m▄[48;5;76m[38;5;8m▄[48;5;76m[38;5;237m▄[48;5;76m[38;5;2m▄[48;5;64m[38;5;70m▄[48;5;232m[38;5;76m▄[48;5;238m[38;5;2m▄[48;5;71m[38;5;233m▄[48;5;71m[38;5;65m▄[48;5;71m [48;5;237m[38;5;71m▄[0m
|
||
[38;5;233m▄[48;5;238m[38;5;71m▄[48;5;236m[38;5;71m▄[48;5;71m [38;5;65m▄[48;5;238m[38;5;234m▄[48;5;235m[38;5;255m▄[48;5;15m [38;5;233m▄[48;5;253m[38;5;0m▄[48;5;255m[38;5;232m▄[48;5;242m[38;5;238m▄[48;5;242m[38;5;233m▄[48;5;15m[38;5;237m▄[48;5;15m[38;5;255m▄[48;5;15m [48;5;255m[38;5;15m▄[48;5;145m[38;5;15m▄[48;5;237m[38;5;15m▄[48;5;22m[38;5;255m▄[48;5;70m[38;5;248m▄[48;5;234m[38;5;235m▄[48;5;234m[38;5;233m▄[48;5;71m[38;5;0m▄[48;5;71m[38;5;238m▄[48;5;71m [0m
|
||
[48;5;71m [38;5;234m▄[48;5;233m[38;5;251m▄[48;5;255m[38;5;15m▄[48;5;15m [48;5;243m[38;5;235m▄[48;5;0m [38;5;243m▄[48;5;249m[38;5;15m▄[48;5;15m [48;5;255m[38;5;15m▄[48;5;249m[38;5;15m▄[48;5;235m[38;5;15m▄[48;5;232m[38;5;15m▄[48;5;235m[38;5;145m▄[48;5;71m[38;5;0m▄[48;5;71m[38;5;232m▄[48;5;71m[38;5;233m▄[48;5;71m[38;5;237m▄[0m
|
||
[48;5;71m [48;5;65m[38;5;232m▄[48;5;241m[38;5;15m▄[48;5;15m [48;5;236m[38;5;245m▄[48;5;0m [48;5;247m[38;5;232m▄[48;5;15m [48;5;247m[38;5;15m▄[48;5;236m[38;5;235m▄[48;5;236m [48;5;237m[38;5;236m▄[0m
|
||
[48;5;71m [38;5;238m▄[48;5;234m[38;5;243m▄[48;5;253m[38;5;15m▄[48;5;15m [48;5;0m[38;5;7m▄[48;5;0m[38;5;239m▄[48;5;0m[38;5;102m▄[48;5;0m[38;5;234m▄[48;5;0m[38;5;232m▄[48;5;0m[38;5;252m▄[48;5;255m[38;5;15m▄[48;5;15m [48;5;239m[38;5;7m▄[48;5;236m[38;5;235m▄[48;5;236m [0m
|
||
[48;5;71m [38;5;236m▄[48;5;234m[38;5;250m▄[48;5;15m [38;5;255m▄[48;5;15m[38;5;250m▄[48;5;15m[38;5;102m▄[48;5;15m[38;5;238m▄[48;5;15m[38;5;235m▄[48;5;15m[38;5;236m▄[48;5;15m[38;5;236m▄[48;5;15m[38;5;2m▄[48;5;255m[38;5;2m▄[48;5;255m[38;5;64m▄[48;5;254m[38;5;70m▄[48;5;188m[38;5;70m▄[48;5;253m[38;5;70m▄[48;5;255m[38;5;70m▄[48;5;255m[38;5;70m▄[48;5;255m[38;5;70m▄[48;5;15m[38;5;28m▄[48;5;15m[38;5;64m▄[48;5;15m[38;5;236m▄[48;5;15m[38;5;237m▄[48;5;15m[38;5;236m▄[48;5;15m[38;5;237m▄[48;5;15m[38;5;240m▄[48;5;15m[38;5;102m▄[48;5;15m[38;5;251m▄[48;5;15m[38;5;255m▄[48;5;15m [48;5;255m[38;5;15m▄[48;5;234m[38;5;235m▄[48;5;236m [0m
|
||
[48;5;71m [38;5;233m▄[48;5;232m[38;5;70m▄[48;5;238m[38;5;76m▄[48;5;65m[38;5;76m▄[48;5;236m[38;5;76m▄[48;5;70m[38;5;76m▄[48;5;76m [48;5;70m[38;5;76m▄[48;5;28m[38;5;76m▄[48;5;234m[38;5;76m▄[48;5;235m[38;5;76m▄[48;5;240m[38;5;76m▄[48;5;145m[38;5;76m▄[48;5;15m[38;5;28m▄[48;5;15m[38;5;235m▄[48;5;15m[38;5;240m▄[48;5;15m[38;5;145m▄[48;5;15m[38;5;254m▄[48;5;15m [48;5;242m[38;5;251m▄[48;5;236m[38;5;235m▄[0m
|
||
[48;5;65m[38;5;232m▄[48;5;235m[38;5;64m▄[48;5;70m [48;5;76m [48;5;2m[38;5;76m▄[48;5;234m[38;5;76m▄[48;5;242m[38;5;76m▄[48;5;254m[38;5;64m▄[48;5;15m[38;5;234m▄[48;5;15m[38;5;243m▄[48;5;15m[38;5;253m▄[48;5;15m [48;5;255m[38;5;15m▄[48;5;233m [0m
|
||
[48;5;232m [48;5;237m [48;5;70m [48;5;76m [38;5;70m▄[48;5;76m[38;5;233m▄[48;5;76m[38;5;233m▄[48;5;76m[38;5;233m▄[48;5;76m[38;5;233m▄[48;5;76m [38;5;70m▄[48;5;76m[38;5;233m▄[48;5;76m[38;5;233m▄[48;5;76m[38;5;233m▄[48;5;76m[38;5;234m▄[48;5;76m[38;5;70m▄[48;5;76m [48;5;28m[38;5;76m▄[48;5;235m[38;5;76m▄[48;5;102m[38;5;236m▄[48;5;250m[38;5;235m▄[48;5;233m[38;5;232m▄[0m
|
||
[48;5;232m [48;5;237m [48;5;70m [48;5;76m [48;5;70m[38;5;76m▄[48;5;64m[38;5;76m▄[48;5;76m[38;5;64m▄[48;5;76m[38;5;233m▄[48;5;233m[38;5;76m▄[48;5;22m[38;5;76m▄[48;5;76m [48;5;22m[38;5;76m▄[48;5;233m[38;5;76m▄[48;5;76m[38;5;233m▄[48;5;76m[38;5;70m▄[48;5;28m[38;5;76m▄[48;5;76m [48;5;70m [48;5;236m [48;5;238m [48;5;236m[0m
|
||
[48;5;232m[38;5;236m▄[48;5;236m[38;5;233m▄[48;5;64m [48;5;76m [48;5;70m[38;5;76m▄[48;5;22m[38;5;76m▄[48;5;76m [38;5;64m▄[48;5;76m[38;5;0m▄[48;5;76m[38;5;232m▄[48;5;76m[38;5;232m▄[48;5;76m[38;5;0m▄[48;5;76m[38;5;70m▄[48;5;76m [48;5;233m[38;5;76m▄[48;5;70m[38;5;76m▄[48;5;76m [48;5;64m [48;5;236m [38;5;235m▄[0m
|
||
[48;5;71m [48;5;232m[38;5;65m▄[48;5;64m[38;5;233m▄[48;5;76m [38;5;107m▄[48;5;77m[38;5;107m▄[48;5;77m[38;5;107m▄[48;5;77m[38;5;107m▄[48;5;76m[38;5;77m▄[48;5;76m [48;5;0m[38;5;70m▄[48;5;0m[38;5;232m▄[48;5;0m[38;5;232m▄[48;5;0m[38;5;70m▄[48;5;76m [38;5;77m▄[48;5;76m[38;5;107m▄[48;5;76m[38;5;107m▄[48;5;76m[38;5;107m▄[48;5;76m[38;5;77m▄[48;5;76m [38;5;70m▄[48;5;236m [48;5;237m[38;5;238m▄[48;5;234m[38;5;235m▄[0m
|
||
[48;5;71m [48;5;235m[38;5;71m▄[48;5;64m[38;5;232m▄[48;5;76m [48;5;77m[38;5;76m▄[48;5;107m[38;5;77m▄[48;5;107m [38;5;77m▄[48;5;77m [48;5;76m [48;5;107m[38;5;77m▄[48;5;107m [48;5;71m[38;5;77m▄[48;5;76m [48;5;64m [48;5;236m[38;5;237m▄[48;5;237m[38;5;234m▄[0m
|
||
[48;5;71m [48;5;232m[38;5;239m▄[48;5;76m[38;5;232m▄[48;5;76m [48;5;70m[38;5;64m▄[48;5;237m[38;5;236m▄[48;5;238m[38;5;234m▄[48;5;235m[38;5;236m▄[0m
|
||
[48;5;71m [48;5;237m[38;5;71m▄[48;5;232m[38;5;235m▄[48;5;76m[38;5;232m▄[48;5;76m [48;5;70m[38;5;236m▄[48;5;236m [48;5;237m[38;5;234m▄[48;5;235m[38;5;236m▄[0m
|
||
[48;5;71m[38;5;237m▄[48;5;71m[38;5;65m▄[48;5;71m [48;5;236m[38;5;71m▄[48;5;232m[38;5;65m▄[48;5;70m[38;5;0m▄[48;5;76m[38;5;22m▄[48;5;76m [38;5;22m▄[48;5;76m[38;5;232m▄[48;5;70m[38;5;236m▄[48;5;236m[38;5;235m▄[48;5;235m[38;5;238m▄[48;5;235m[38;5;238m▄[48;5;235m[38;5;238m▄[48;5;235m[38;5;238m▄[48;5;236m[38;5;235m▄[48;5;236m[38;5;233m▄[0m
|
||
[38;5;233m▀[48;5;71m[38;5;232m▄[48;5;71m [48;5;236m[38;5;71m▄[48;5;0m[38;5;71m▄[48;5;2m[38;5;235m▄[48;5;76m[38;5;0m▄[48;5;76m[38;5;22m▄[48;5;76m [38;5;77m▄[48;5;76m[38;5;236m▄[48;5;76m[38;5;232m▄[48;5;76m[38;5;232m▄[48;5;22m[38;5;238m▄[48;5;232m[38;5;71m▄[48;5;65m[38;5;71m▄[48;5;71m [0m
|
||
[48;5;65m[38;5;238m▄[48;5;71m[38;5;234m▄[48;5;71m [48;5;235m[38;5;71m▄[48;5;0m[38;5;71m▄[48;5;232m[38;5;71m▄[48;5;233m[38;5;238m▄[48;5;65m[38;5;234m▄[48;5;70m[38;5;232m▄[48;5;77m[38;5;0m▄[48;5;76m[38;5;232m▄[48;5;76m[38;5;235m▄[48;5;76m[38;5;237m▄[48;5;76m[38;5;237m▄[48;5;76m[38;5;65m▄[48;5;76m[38;5;65m▄[48;5;76m[38;5;22m▄[48;5;76m[38;5;234m▄[48;5;76m[38;5;232m▄[48;5;76m[38;5;0m▄[48;5;76m[38;5;0m▄[48;5;71m[38;5;232m▄[48;5;237m[38;5;236m▄[48;5;233m[38;5;71m▄[48;5;0m[38;5;71m▄[48;5;234m[38;5;71m▄[48;5;65m[38;5;71m▄[48;5;71m [38;5;65m▄[48;5;71m[38;5;235m▄[48;5;71m[38;5;235m▄[48;5;71m[38;5;236m▄[48;5;71m[38;5;236m▄[48;5;71m[38;5;237m▄[0m
|
||
[38;5;232m▀[48;5;65m[38;5;236m▄[48;5;71m[38;5;234m▄[48;5;71m [48;5;65m[38;5;71m▄[48;5;237m[38;5;71m▄[48;5;234m[38;5;71m▄[48;5;233m[38;5;71m▄[48;5;234m[38;5;71m▄[48;5;237m[38;5;71m▄[48;5;65m[38;5;71m▄[48;5;65m[38;5;71m▄[48;5;71m [38;5;237m▄[48;5;71m[38;5;233m▄[48;5;65m[38;5;8m▄[0m[38;5;234m▀[38;5;234m▀[38;5;239m▀[0m
|
||
[38;5;234m▀[38;5;236m▀[48;5;71m[38;5;235m▄[48;5;71m[38;5;234m▄[48;5;71m[38;5;238m▄[48;5;71m[38;5;65m▄[48;5;71m [38;5;65m▄[48;5;71m[38;5;236m▄[48;5;71m[38;5;233m▄[48;5;71m[38;5;235m▄[48;5;65m[38;5;243m▄[0m[38;5;233m▀[38;5;235m▀[0m
|
||
[38;5;242m▀[38;5;233m▀[38;5;232m▀[38;5;234m▀[38;5;236m▀[48;5;65m[38;5;236m▄[48;5;65m[38;5;233m▄[48;5;71m[38;5;233m▄[48;5;71m[38;5;233m▄[48;5;71m[38;5;232m▄[48;5;71m[38;5;232m▄[48;5;71m[38;5;233m▄[48;5;65m[38;5;237m▄[48;5;237m[38;5;8m▄[0m[38;5;234m▀[38;5;232m▀[38;5;232m▀[38;5;59m▀[0m
|
||
|
||
[1;32m/---------------------------------------------------------------------------------\
|
||
| [1;34mDo you like PEASS?[1;32m |
|
||
|---------------------------------------------------------------------------------|
|
||
| [1;33mGet the latest version[1;32m : [1;31mhttps://github.com/sponsors/carlospolop[1;32m |
|
||
| [1;33mFollow on Twitter[1;32m : [1;31m@carlospolopm[1;32m |
|
||
| [1;33mRespect on HTB[1;32m : [1;31mSirBroccoli [1;32m |
|
||
|---------------------------------------------------------------------------------|
|
||
| [1;34mThank you! [1;32m |
|
||
\---------------------------------------------------------------------------------/
|
||
[1;34m macpeas-ng [1;33mby carlospolop
|
||
[0m
|
||
[1;33mADVISORY: [1;34mThis script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.
|
||
[0m
|
||
[1;34mLinux Privesc Checklist: [1;33mhttps://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist
|
||
[0m [1;4mLEGEND[0m:
|
||
[1;31;103mRED/YELLOW[0m: 95% a PE vector
|
||
[1;31mRED[0m: You should take a look to it
|
||
[1;96mLightCyan[0m: Users with console
|
||
[1;34mBlue[0m: Users without console & mounted devs
|
||
[1;32mGreen[0m: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs)
|
||
[1;95mLightMagenta[0m: Your username
|
||
|
||
[1;90mStarting macpeas. Caching Writable Folders...[0m
|
||
|
||
[1;34m ╔═══════════════════╗
|
||
═══════════════════════════════╣ [1;32mBasic information[1;34m ╠═══════════════════════════════
|
||
[1;34m ╚═══════════════════╝[0m
|
||
[1;37mOS: [0mLinux version 5.4.0-132-generic (buildd@lcy02-amd64-059) (gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1)) #148-Ubuntu SMP Mon Oct 17 16:02:06 UTC 2022
|
||
[1;37mUser & Groups: [0muid=1000([1;95mdiego[0m) gid=1000([1;95mdiego[0m) groups=1000([1;95mdiego[0m)
|
||
[1;37mHostname: [0mforgot
|
||
[1;37mWritable folder: [0m/dev/shm
|
||
[1;33m[+] [1;32m/usr/bin/ping[1;34m is available for network discovery[1;37m (macpeas can discover hosts, learn more with -h)
|
||
[0m[1;33m[+] [1;32m/usr/bin/bash[1;34m is available for network discovery, port scanning and port forwarding[1;37m (macpeas can discover hosts, scan ports, and forward ports. Learn more with -h)
|
||
[1;33m[+] [1;32m/usr/bin/nc[1;34m is available for network discovery & port scanning[1;37m (macpeas can discover hosts and scan ports, learn more with -h)
|
||
|
||
[0m
|
||
|
||
[1;32mCaching directories [0m[1;33mDONE
|
||
[0m
|
||
[1;34m ╔════════════════════╗
|
||
══════════════════════════════╣ [1;32mSystem Information[1;34m ╠══════════════════════════════
|
||
[1;34m ╚════════════════════╝[0m
|
||
[1;34m╔══════════╣ [1;32mOperative system
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#kernel-exploits
|
||
[0mLinux version 5.4.0-132-generic (buildd@lcy02-amd64-059) (gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1)) #148-Ubuntu SMP Mon Oct 17 16:02:06 UTC 2022
|
||
Distributor ID: Ubuntu
|
||
Description: Ubuntu 20.04.5 LTS
|
||
Release: 20.04
|
||
Codename: focal
|
||
[1;90msystem_profiler Not Found
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mSudo version
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-version
|
||
[0mSudo version [1;31m1.8.31[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mCVEs Check
|
||
[0m[1;31;103mVulnerable to CVE-2021-3560[0m
|
||
|
||
[1;31mPotentially Vulnerable to CVE-2022-2588[0m
|
||
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mPATH
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-path-abuses
|
||
[0m/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/system/bin:/system/sbin:/system/xbin
|
||
New path exported: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/system/bin:/system/sbin:/system/xbin
|
||
|
||
[1;34m╔══════════╣ [1;32mDate & uptime
|
||
[0mFri Feb 10 19:53:00 UTC 2023
|
||
19:53:00 up 42 min, 0 users, load average: 0.77, 0.52, 0.48
|
||
|
||
[1;34m╔══════════╣ [1;32mSystem stats
|
||
[0mFilesystem Size Used Avail Use% Mounted on
|
||
udev 1.9G 0 1.9G 0% /dev
|
||
tmpfs 394M 1.1M 393M 1% /run
|
||
/dev/sda1 8.8G 6.2G 2.5G 72% /
|
||
tmpfs 2.0G 0 2.0G 0% /dev/shm
|
||
tmpfs 5.0M 0 5.0M 0% /run/lock
|
||
tmpfs 2.0G 0 2.0G 0% /sys/fs/cgroup
|
||
tmpfs 394M 0 394M 0% /run/user/1000
|
||
total used free shared buff/cache available
|
||
Mem: 4026088 597140 2053364 1092 1375584 3132692
|
||
Swap: 1026044 0 1026044
|
||
|
||
[1;34m╔══════════╣ [1;32mCPU info
|
||
[0mArchitecture: x86_64
|
||
CPU op-mode(s): 32-bit, 64-bit
|
||
Byte Order: Little Endian
|
||
Address sizes: 43 bits physical, 48 bits virtual
|
||
CPU(s): 2
|
||
On-line CPU(s) list: 0,1
|
||
Thread(s) per core: 1
|
||
Core(s) per socket: 1
|
||
Socket(s): 2
|
||
NUMA node(s): 1
|
||
Vendor ID: AuthenticAMD
|
||
CPU family: 23
|
||
Model: 49
|
||
Model name: AMD EPYC 7302P 16-Core Processor
|
||
Stepping: 0
|
||
CPU MHz: 2994.375
|
||
BogoMIPS: 5988.75
|
||
Hypervisor vendor: VMware
|
||
Virtualization type: full
|
||
L1d cache: 64 KiB
|
||
L1i cache: 64 KiB
|
||
L2 cache: 1 MiB
|
||
L3 cache: 256 MiB
|
||
NUMA node0 CPU(s): 0,1
|
||
Vulnerability Itlb multihit: Not affected
|
||
Vulnerability L1tf: Not affected
|
||
Vulnerability Mds: Not affected
|
||
Vulnerability Meltdown: Not affected
|
||
Vulnerability Mmio stale data: Not affected
|
||
Vulnerability Retbleed: Vulnerable
|
||
Vulnerability Spec store bypass: Mitigation; Speculative Store Bypass disabled via prctl and seccomp
|
||
Vulnerability Spectre v1: Mitigation; usercopy/swapgs barriers and __user pointer sanitization
|
||
Vulnerability Spectre v2: Mitigation; Retpolines, IBPB conditional, STIBP disabled, RSB filling, PBRSB-eIBRS Not affected
|
||
Vulnerability Srbds: Not affected
|
||
Vulnerability Tsx async abort: Not affected
|
||
Flags: fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl tsc_reliable nonstop_tsc cpuid extd_apicid pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt clwb sha_ni xsaveopt xsavec xsaves clzero arat overflow_recov succor
|
||
|
||
[1;34m╔══════════╣ [1;32mAny sd*/disk* disk in /dev? (limit 20)
|
||
[0mdisk
|
||
sda
|
||
sda1
|
||
sda2
|
||
sda3
|
||
|
||
[1;34m╔══════════╣ [1;32mUnmounted file-system?
|
||
[0m[1;34m╚ [1;34m[3mCheck if you can mount umounted devices
|
||
[0m[1;34m/dev/disk/by-uuid/0e6aec1f-7be8-49b9-8e43-d83828f4d864[0m [1;34m/[0m ext4 defaults 0 0
|
||
[1;34m/dev[0m[1;34m/[0msda2 none [1;32mswap[0m sw 0 0
|
||
|
||
[1;34m╔══════════╣ [1;32mEnvironment
|
||
[0m[1;34m╚ [1;34m[3mAny private information inside environment variables?
|
||
[0mHISTSIZE=0
|
||
[1;31mPWD[0m=/home/diego
|
||
HOME=/home/diego
|
||
LANG=C
|
||
HISTFILE=/dev/null
|
||
USER=diego
|
||
SHLVL=1
|
||
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/system/bin:/system/sbin:/system/xbin
|
||
HISTFILESIZE=0
|
||
_=/usr/bin/env
|
||
|
||
[1;34m╔══════════╣ [1;32mSearching Signature verification failed in dmesg
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#dmesg-signature-verification-failed
|
||
[0m[1;90mdmesg Not Found
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mKernel Extensions not belonging to apple
|
||
[0m[1;34m╔══════════╣ [1;32mUnsigned Kernel Extensions
|
||
[0m[1;34m╔══════════╣ [1;32mExecuting Linux Exploit Suggester
|
||
[0m[1;34m╚ [1;34m[3mhttps://github.com/mzet-/linux-exploit-suggester
|
||
[0m[+] [1;31m[CVE-2022-2586] nft_object UAF[0m
|
||
|
||
Details: https://www.openwall.com/lists/oss-security/2022/08/29/5
|
||
Exposure: probable
|
||
Tags: [ ubuntu=(20.04) ]{kernel:5.12.13}
|
||
Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1
|
||
Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)
|
||
|
||
[+] [1;31m[CVE-2021-4034] PwnKit[0m
|
||
|
||
Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
|
||
Exposure: probable
|
||
Tags: [ ubuntu=10|11|12|13|14|15|16|17|18|19|20|21 ],debian=7|8|9|10|11,fedora,manjaro
|
||
Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main
|
||
|
||
[+] [1;31m[CVE-2021-3156] sudo Baron Samedit[0m
|
||
|
||
Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
|
||
Exposure: probable
|
||
Tags: mint=19,[ ubuntu=18|20 ], debian=10
|
||
Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main
|
||
|
||
[+] [1;31m[CVE-2021-3156] sudo Baron Samedit 2[0m
|
||
|
||
Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
|
||
Exposure: probable
|
||
Tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10
|
||
Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main
|
||
|
||
[+] [1;31m[CVE-2021-22555] Netfilter heap out-of-bounds write[0m
|
||
|
||
Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
|
||
Exposure: probable
|
||
Tags: [ ubuntu=20.04 ]{kernel:5.8.0-*}
|
||
Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
|
||
ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c
|
||
Comments: ip_tables kernel module must be loaded
|
||
|
||
[+] [1;31m[CVE-2022-32250] nft_object UAF (NFT_MSG_NEWSET)[0m
|
||
|
||
Details: https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/
|
||
https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/
|
||
Exposure: less probable
|
||
Tags: ubuntu=(22.04){kernel:5.15.0-27-generic}
|
||
Download URL: https://raw.githubusercontent.com/theori-io/CVE-2022-32250-exploit/main/exp.c
|
||
Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN)
|
||
|
||
[+] [1;31m[CVE-2017-5618] setuid screen v4.5.0 LPE[0m
|
||
|
||
Details: https://seclists.org/oss-sec/2017/q1/184
|
||
Exposure: less probable
|
||
Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mExecuting Linux Exploit Suggester 2
|
||
[0m[1;34m╚ [1;34m[3mhttps://github.com/jondonas/linux-exploit-suggester-2
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mProtections
|
||
[0m[1;34m═╣ [1;32mAppArmor enabled? .............. [0m[0mYou do not have enough privilege to read the profile set.
|
||
apparmor module is loaded.
|
||
[1;34m═╣ [1;32mgrsecurity present? ............ [0m[0m[1;90mgrsecurity Not Found
|
||
[0m[1;34m═╣ [1;32mPaX bins present? .............. [0m[0m[1;90mPaX Not Found
|
||
[0m[1;34m═╣ [1;32mExecshield enabled? ............ [0m[0m[1;90mExecshield Not Found
|
||
[0m[1;34m═╣ [1;32mSELinux enabled? ............... [0m[0m[1;90msestatus Not Found
|
||
[0m[1;34m═╣ [1;32mSeccomp enabled? ............... [0m[0m[1;31mdisabled[0m
|
||
[1;34m═╣ [1;32mAppArmor profile? .............. [0m[0munconfined
|
||
[1;34m═╣ [1;32mUser namespace? ................ [0m[0m[1;32menabled[0m
|
||
[1;34m═╣ [1;32mCgroup2 enabled? ............... [0m[0m[1;32menabled[0m
|
||
[1;34m═╣ [1;32mGatekeeper enabled? .......... [0m[0m[1;90msestatus Not Found
|
||
[0m[1;34m═╣ [1;32msleepimage encrypted? ........ [0m[0m[1;34m═╣ [1;32mXProtect? .................... [0m[0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mSIP enabled? ................. [0m[0m[1;34m═╣ [1;32mConnected to JAMF? ........... [0m[0m[1;90mjamf Not Found
|
||
[0m[1;34m═╣ [1;32mConnected to AD? ............. [0m[0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mIs ASLR enabled? ............... [0m[0m[1;32mYes[0m
|
||
[1;34m═╣ [1;32mPrinter? ....................... [0m[0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mIs this a virtual machine? ..... [0m[0m[1;31mYes (vmware)[0m
|
||
|
||
[1;34m ╔═══════════╗
|
||
═══════════════════════════════════╣ [1;32mContainer[1;34m ╠═══════════════════════════════════
|
||
[1;34m ╚═══════════╝[0m
|
||
[1;34m╔══════════╣ [1;32mContainer related tools present
|
||
[0m[1;34m╔══════════╣ [1;32mAm I Containered?
|
||
[0m[1;34m╔══════════╣ [1;32mContainer details
|
||
[0m[1;34m═╣ [1;32mIs this a container? ...........[0m [1;90mNo
|
||
[0m[0m[1;34m═╣ [1;32mAny running containers? ........ [0m[0m[1;90mNo
|
||
[0m
|
||
|
||
[1;34m ╔═══════╗
|
||
═════════════════════════════════════╣ [1;32mCloud[1;34m ╠═════════════════════════════════════
|
||
[1;34m ╚═══════╝[0m
|
||
[1;34m═╣ [1;32mGoogle Cloud Platform? ............... [1;32mNo[0m
|
||
[0m[0m[1;34m═╣ [1;32mAWS ECS? ............................. [1;32mNo[0m
|
||
[0m[0m[1;34m═╣ [1;32mAWS EC2? ............................. [1;32mNo[0m
|
||
[0m[0m[1;34m═╣ [1;32mAWS Lambda? .......................... [1;32mNo[0m
|
||
[0m[0m
|
||
|
||
|
||
[1;34m ╔════════════════════════════════════════════════╗
|
||
════════════════╣ [1;32mProcesses, Crons, Timers, Services and Sockets[1;34m ╠════════════════
|
||
[1;34m ╚════════════════════════════════════════════════╝[0m
|
||
[1;34m╔══════════╣ [1;32mCleaned processes
|
||
[0m[1;34m╚ [1;34m[3mCheck weird & unexpected proceses run by root: https://book.hacktricks.xyz/linux-hardening/privilege-escalation#processes
|
||
[0m[1;31mroot[0m 1 0.0 0.2 104352 11260 ? Ss 19:10 0:01 /sbin/init maybe-ubiquity
|
||
[1;31mroot[0m 469 2.8 4.8 308088 193584 ? R<sl 19:10 1:13 /lib/systemd/systemd-journald
|
||
[1;31mroot[0m 502 0.0 0.1 22592 6008 ? Ss 19:10 0:00 /lib/systemd/systemd-[1;32mudev[0md
|
||
[1;31mroot[0m 651 0.0 0.4 280136 17948 ? SLsl 19:10 0:00 /sbin/multipathd -d -s
|
||
[1;31mroot[0m 685 0.5 0.0 11356 1688 ? S<sl 19:10 0:13 /sbin/auditd
|
||
[1;32msystemd+[0m 688 0.0 0.1 90876 6072 ? Ssl 19:10 0:00 /lib/systemd/systemd-timesyncd
|
||
└─([1;90mCaps[0m) 0x0000000002000000=cap_sys_time
|
||
[1;31mroot[0m 705 0.0 0.2 47540 10708 ? Ss 19:10 0:00 /usr/bin[1;32m/VGAuthService[0m
|
||
[1;31mroot[0m 726 0.1 0.2 311508 8412 ? Ssl 19:10 0:03 /usr/bin[1;32m/vmtoolsd[0m
|
||
[1;31mroot[0m 729 0.0 0.1 99896 6120 ? Ssl 19:10 0:00 /sbin/dhclient -1 -4 -v -i -pf /run/dhclient.eth0.pid -lf /var/lib/dhcp/dhclient.eth0.leases -I -df /var/lib/dhcp/dhclient6.eth0.leases eth0
|
||
[1;31mroot[0m 775 0.0 0.1 235560 7116 ? Ssl 19:10 0:02 /usr/lib/accountsservice/accounts-daemon
|
||
[1;32mmessage+[0m 776 0.0 0.1 7596 4728 ? Ss 19:10 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
|
||
└─([1;90mCaps[0m) 0x0000000020000000=cap_audit_write
|
||
[1;31mroot[0m 786 0.0 0.0 81956 3828 ? Ssl 19:10 0:00 /usr/sbin/irqbalance --foreground
|
||
[1;31mroot[0m 789 0.0 0.1 232712 6820 ? Ssl 19:10 0:00 /usr/lib/policykit-1/polkitd --no-debug
|
||
[1;32msyslog[0m 790 0.4 0.1 224344 5680 ? Ssl 19:10 0:11 /usr/sbin/rsyslogd -n -iNONE
|
||
[1;31mroot[0m 798 0.0 0.9 801140 36376 ? Ssl 19:10 0:00 /usr/lib/snapd/snapd
|
||
[1;31mroot[0m 799 0.0 0.1 17344 7728 ? Ss 19:10 0:00 /lib/systemd/systemd-logind
|
||
[1;31mroot[0m 800 0.0 0.2 393056 11868 ? Ssl 19:10 0:00 /usr/lib/udisks2/udisksd
|
||
vcache 801 0.0 0.1 18932 5536 ? SLs 19:10 0:00 /usr/sbin/varnishd -j unix,user=vcache -F -a :80 -T localhost:6082 -f /etc/varnish/default.vcl -S /etc/varnish/secret -s malloc,256m
|
||
vcache 944 2.8 2.2 267592 92156 ? SLl 19:10 1:14 _ /usr/sbin/varnishd -j unix,user=vcache -F -a :80 -T localhost:6082 -f /etc/varnish/default.vcl -S /etc/varnish/secret -s malloc,256m
|
||
[1;31mroot[0m 843 0.0 0.2 315088 11276 ? Ssl 19:10 0:00 /usr/sbin/ModemManager
|
||
varnish+ 1069 1.1 2.0 86552 80960 ? Ss 19:10 0:29 /usr/bin/varnishncsa -a -w /var/log/varnish/varnishncsa.log -D -P /run/varnishncsa/varnishncsa.pid
|
||
[1;32msystemd+[0m 1184 0.0 0.3 24568 13196 ? Ss 19:10 0:00 /lib/systemd/systemd-resolved
|
||
[1;31mroot[0m 1228 0.0 0.0 6816 2884 ? Ss 19:10 0:00 /usr/sbin/[1;32mcron[0m -f
|
||
[1;32mdaemon [0m 1231 0.0 0.0 3796 2160 ? Ss 19:10 0:00 /usr/sbin/atd -f
|
||
[1;95mdiego[0m 65473 0.0 0.1 13928 5896 ? S 19:42 0:00 _ [1;31msshd:[0m diego@notty
|
||
[1;95mdiego[0m 65506 0.0 0.0 6972 3628 ? Ss 19:42 0:00 _ -bash
|
||
[1;95mdiego[0m 66447 0.0 0.0 2008 1912 ? Sl 19:42 0:00 _ [1;31m/tmp[0m/hFwWS
|
||
[1;95mdiego[0m 70897 0.0 0.0 2608 600 ? S 19:44 0:00 _ /bin/sh
|
||
[1;95mdiego[0m 71572 0.2 0.1 6780 5900 ? S 19:44 0:01 | _ bash [1;31m/tmp[0m/linpeas.sh
|
||
[1;95mdiego[0m 89973 0.0 0.0 2940 776 ? S 19:47 0:00 | | _ aureport --tty
|
||
[1;95mdiego[0m 89974 0.0 0.0 3304 660 ? S 19:47 0:00 | | _ grep -E su |sudo
|
||
[1;95mdiego[0m 71573 0.0 0.0 2516 580 ? S 19:44 0:00 | _ tee peas.log
|
||
[1;95mdiego[0m 97702 0.0 0.0 2608 596 ? S 19:52 0:00 _ /bin/sh
|
||
[1;95mdiego[0m 99219 0.8 0.1 6108 5224 ? S 19:52 0:00 _ bash [1;31m/tmp[0m/linpeas.sh -t -e -L -M -P dCb#1!x0%gjq
|
||
[1;95mdiego[0m 105791 0.0 0.0 6108 3732 ? S 19:53 0:00 | _ bash [1;31m/tmp[0m/linpeas.sh -t -e -L -M -P dCb#1!x0%gjq
|
||
[1;95mdiego[0m 105795 0.0 0.0 6216 3336 ? R 19:53 0:00 | | _ ps faux[1;32mwww[0m
|
||
[1;95mdiego[0m 105794 0.0 0.0 6108 2368 ? S 19:53 0:00 | _ bash [1;31m/tmp[0m/linpeas.sh -t -e -L -M -P dCb#1!x0%gjq
|
||
[1;95mdiego[0m 99220 0.0 0.0 2516 580 ? S 19:52 0:00 _ tee peas.log
|
||
[1;31mroot[0m 1249 0.0 0.0 5828 1840 tty1 Ss+ 19:10 0:00 /sbin/agetty -o -p -- u --noclear tty1 linux
|
||
mysql 1263 1.0 10.1 1800764 408508 ? Ssl 19:10 0:26 /usr/sbin/mysqld
|
||
[1;95mdiego[0m 38095 11.4 1.1 356056 46952 ? Ssl 19:30 2:37 /usr/bin/python3 [1;31m/home/diego/app[0m/app.py
|
||
[1;95mdiego[0m 65333 0.0 0.2 19012 9596 ? Ss 19:42 0:00 /lib/systemd/systemd --user
|
||
[1;95mdiego[0m 65334 0.0 0.0 103756 3316 ? S 19:42 0:00 _ (sd-pam)
|
||
[1;95mdiego[0m 80746 0.0 0.0 81196 3488 ? SLs 19:45 0:00 _ /usr/bin/gpg-agent --supervised
|
||
[1;95mdiego[0m 96180 0.5 0.1 6108 5240 ? S 19:52 0:00 bash [1;31m/tmp[0m/linpeas.sh -t -e -L -M -P dCb#1!x0%gjq
|
||
[1;95mdiego[0m 105601 1.0 0.0 6108 3988 ? S 19:53 0:00 _ bash [1;31m/tmp[0m/linpeas.sh -t -e -L -M -P dCb#1!x0%gjq
|
||
[1;95mdiego[0m 105763 0.0 0.0 6108 3800 ? S 19:53 0:00 _ bash [1;31m/tmp[0m/linpeas.sh -t -e -L -M -P dCb#1!x0%gjq
|
||
[1;95mdiego[0m 105764 0.0 0.2 21808 10964 ? S 19:53 0:00 _ curl -v --unix-socket /run/systemd/userdb/io.systemd.DynamicUser --max-time 1 http:/linpeas
|
||
[1;95mdiego[0m 105765 0.0 0.0 3304 656 ? S 19:53 0:00 _ grep -i Permission denied
|
||
|
||
[1;34m╔══════════╣ [1;32mBinary processes permissions (non 'root root' and not belonging to current user)
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#processes
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mFiles opened by processes belonging to other users
|
||
[0m[1;34m╚ [1;34m[3mThis is usually empty because of the lack of privileges to read other user processes information
|
||
[0mCOMMAND PID TID TASKCMD USER FD TYPE DEVICE SIZE/OFF NODE NAME
|
||
|
||
[1;34m╔══════════╣ [1;32mProcesses with credentials in memory (root req)
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#credentials-from-process-memory
|
||
[0m[1;90mgdm-password Not Found
|
||
[0m[1;90mgnome-keyring-daemon Not Found
|
||
[0m[1;90mlightdm Not Found
|
||
[0m[1;90mvsftpd Not Found
|
||
[0m[1;90mapache2 Not Found
|
||
[0m[1;31msshd:[0m process found (dump creds from memory as root)
|
||
|
||
[1;34m╔══════════╣ [1;32mCron jobs
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#scheduled-cron-jobs
|
||
[0m/usr/bin/crontab
|
||
* * * * * [1;31;103m/home/[1;95mdiego[0m[0m/bot.py
|
||
[1;90mincrontab Not Found
|
||
[0m[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m4[1;32m[0m2[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m1[1;32m[0m3[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32m[0m/[1;32m[0me[1;32m[0mt[1;32m[0mc[1;32m[0m/[1;32m[0mc[1;32m[0mr[1;32m[0mo[1;32m[0mn[1;32m[0mt[1;32m[0ma[1;32m[0mb[1;32m[0m
|
||
[1;32m[0m
|
||
[1;32m[0m/[1;32m[0me[1;32m[0mt[1;32m[0mc[1;32m[0m/[1;32m[0mc[1;32m[0mr[1;32m[0mo[1;32m[0mn[1;32m[0m.[1;32m[0md[1;32m[0m:[1;32m[0m
|
||
[1;32m[0mt[1;32m[0mo[1;32m[0mt[1;32m[0ma[1;32m[0ml[1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mN[1;32m[0mo[1;32m[0mv[1;32m[0m [1;32m[0m [1;32m[0m7[1;32m[0m [1;32m[0m1[1;32m[0m1[1;32m[0m:[1;32m[0m3[1;32m[0m7[1;32m[0m [1;32m[0m.[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m8[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mN[1;32m[0mo[1;32m[0mv[1;32m[0m [1;32m[0m1[1;32m[0m7[1;32m[0m [1;32m[0m1[1;32m[0m6[1;32m[0m:[1;32m[0m1[1;32m[0m1[1;32m[0m [1;32m[0m.[1;32m[0m.[1;32m[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m2[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m1[1;32m[0m3[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32m.placeholder[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m1[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m1[1;32m[0m4[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32me2scrub_all[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m9[1;32m[0m1[1;32m[0m [1;32m[0mA[1;32m[0mp[1;32m[0mr[1;32m[0m [1;32m[0m2[1;32m[0m3[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32mpopularity-contest[0m
|
||
[1;32m[0m
|
||
[1;32m[0m/[1;32m[0me[1;32m[0mt[1;32m[0mc[1;32m[0m/[1;32m[0mc[1;32m[0mr[1;32m[0mo[1;32m[0mn[1;32m[0m.[1;32m[0md[1;32m[0ma[1;32m[0mi[1;32m[0ml[1;32m[0my[1;32m[0m:[1;32m[0m
|
||
[1;32m[0mt[1;32m[0mo[1;32m[0mt[1;32m[0ma[1;32m[0ml[1;32m[0m [1;32m[0m4[1;32m[0m8[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mN[1;32m[0mo[1;32m[0mv[1;32m[0m [1;32m[0m [1;32m[0m7[1;32m[0m [1;32m[0m1[1;32m[0m1[1;32m[0m:[1;32m[0m3[1;32m[0m7[1;32m[0m [1;32m[0m.[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m8[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mN[1;32m[0mo[1;32m[0mv[1;32m[0m [1;32m[0m1[1;32m[0m7[1;32m[0m [1;32m[0m1[1;32m[0m6[1;32m[0m:[1;32m[0m1[1;32m[0m1[1;32m[0m [1;32m[0m.[1;32m[0m.[1;32m[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m2[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m1[1;32m[0m3[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32m.placeholder[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m3[1;32m[0m7[1;32m[0m6[1;32m[0m [1;32m[0mD[1;32m[0me[1;32m[0mc[1;32m[0m [1;32m[0m [1;32m[0m4[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m1[1;32m[0m9[1;32m[0m [1;32mapport[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m1[1;32m[0m4[1;32m[0m7[1;32m[0m8[1;32m[0m [1;32m[0mA[1;32m[0mp[1;32m[0mr[1;32m[0m [1;32m[0m [1;32m[0m9[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32mapt-compat[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m3[1;32m[0m5[1;32m[0m5[1;32m[0m [1;32m[0mD[1;32m[0me[1;32m[0mc[1;32m[0m [1;32m[0m2[1;32m[0m9[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m1[1;32m[0m7[1;32m[0m [1;32mbsdmainutils[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m1[1;32m[0m1[1;32m[0m8[1;32m[0m7[1;32m[0m [1;32m[0mS[1;32m[0me[1;32m[0mp[1;32m[0m [1;32m[0m [1;32m[0m5[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m1[1;32m[0m9[1;32m[0m [1;32mdpkg[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m3[1;32m[0m7[1;32m[0m7[1;32m[0m [1;32m[0mJ[1;32m[0ma[1;32m[0mn[1;32m[0m [1;32m[0m2[1;32m[0m1[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m1[1;32m[0m9[1;32m[0m [1;32mlogrotate[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m1[1;32m[0m1[1;32m[0m2[1;32m[0m3[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m2[1;32m[0m5[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32mman-db[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m5[1;32m[0m7[1;32m[0m4[1;32m[0m [1;32m[0mJ[1;32m[0mu[1;32m[0ml[1;32m[0m [1;32m[0m1[1;32m[0m8[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m1[1;32m[0m9[1;32m[0m [1;32mpopularity-contest[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m1[1;32m[0m4[1;32m[0m [1;32m[0mA[1;32m[0mp[1;32m[0mr[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32mupdate-notifier-common[0m
|
||
[1;32m[0m
|
||
[1;32m[0m/[1;32m[0me[1;32m[0mt[1;32m[0mc[1;32m[0m/[1;32m[0mc[1;32m[0mr[1;32m[0mo[1;32m[0mn[1;32m[0m.[1;32m[0mh[1;32m[0mo[1;32m[0mu[1;32m[0mr[1;32m[0ml[1;32m[0my[1;32m[0m:[1;32m[0m
|
||
[1;32m[0mt[1;32m[0mo[1;32m[0mt[1;32m[0ma[1;32m[0ml[1;32m[0m [1;32m[0m1[1;32m[0m2[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mJ[1;32m[0mu[1;32m[0ml[1;32m[0m [1;32m[0m2[1;32m[0m2[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m2[1;32m[0m [1;32m[0m.[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m8[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mN[1;32m[0mo[1;32m[0mv[1;32m[0m [1;32m[0m1[1;32m[0m7[1;32m[0m [1;32m[0m1[1;32m[0m6[1;32m[0m:[1;32m[0m1[1;32m[0m1[1;32m[0m [1;32m[0m.[1;32m[0m.[1;32m[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m2[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m1[1;32m[0m3[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32m.placeholder[0m
|
||
[1;32m[0m
|
||
[1;32m[0m/[1;32m[0me[1;32m[0mt[1;32m[0mc[1;32m[0m/[1;32m[0mc[1;32m[0mr[1;32m[0mo[1;32m[0mn[1;32m[0m.[1;32m[0mm[1;32m[0mo[1;32m[0mn[1;32m[0mt[1;32m[0mh[1;32m[0ml[1;32m[0my[1;32m[0m:[1;32m[0m
|
||
[1;32m[0mt[1;32m[0mo[1;32m[0mt[1;32m[0ma[1;32m[0ml[1;32m[0m [1;32m[0m1[1;32m[0m2[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mJ[1;32m[0mu[1;32m[0ml[1;32m[0m [1;32m[0m2[1;32m[0m2[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m2[1;32m[0m [1;32m[0m.[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m8[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mN[1;32m[0mo[1;32m[0mv[1;32m[0m [1;32m[0m1[1;32m[0m7[1;32m[0m [1;32m[0m1[1;32m[0m6[1;32m[0m:[1;32m[0m1[1;32m[0m1[1;32m[0m [1;32m[0m.[1;32m[0m.[1;32m[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m2[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m1[1;32m[0m3[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32m.placeholder[0m
|
||
[1;32m[0m
|
||
[1;32m[0m/[1;32m[0me[1;32m[0mt[1;32m[0mc[1;32m[0m/[1;32m[0mc[1;32m[0mr[1;32m[0mo[1;32m[0mn[1;32m[0m.[1;32m[0mw[1;32m[0me[1;32m[0me[1;32m[0mk[1;32m[0ml[1;32m[0my[1;32m[0m:[1;32m[0m
|
||
[1;32m[0mt[1;32m[0mo[1;32m[0mt[1;32m[0ma[1;32m[0ml[1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mN[1;32m[0mo[1;32m[0mv[1;32m[0m [1;32m[0m [1;32m[0m7[1;32m[0m [1;32m[0m1[1;32m[0m1[1;32m[0m:[1;32m[0m3[1;32m[0m7[1;32m[0m [1;32m[0m.[1;32m[0m
|
||
[1;32m[0md[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m8[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m9[1;32m[0m6[1;32m[0m [1;32m[0mN[1;32m[0mo[1;32m[0mv[1;32m[0m [1;32m[0m1[1;32m[0m7[1;32m[0m [1;32m[0m1[1;32m[0m6[1;32m[0m:[1;32m[0m1[1;32m[0m1[1;32m[0m [1;32m[0m.[1;32m[0m.[1;32m[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0mr[1;32m[0m-[1;32m[0m-[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m0[1;32m[0m2[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m1[1;32m[0m3[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32m.placeholder[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m8[1;32m[0m1[1;32m[0m3[1;32m[0m [1;32m[0mF[1;32m[0me[1;32m[0mb[1;32m[0m [1;32m[0m2[1;32m[0m5[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m0[1;32m[0m [1;32mman-db[0m
|
||
[1;32m[0m-[1;32m[0mr[1;32m[0mw[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0mr[1;32m[0m-[1;32m[0mx[1;32m[0m [1;32m[0m [1;32m[0m [1;32m[0m1[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0mr[1;32m[0mo[1;32m[0mo[1;32m[0mt[1;32m[0m [1;32m[0m [1;32m[0m4[1;32m[0m0[1;32m[0m3[1;32m[0m [1;32m[0mA[1;32m[0mp[1;32m[0mr[1;32m[0m [1;32m[0m2[1;32m[0m5[1;32m[0m [1;32m[0m [1;32m[0m2[1;32m[0m0[1;32m[0m2[1;32m[0m2[1;32m[0m [1;32mupdate-notifier-common[0m
|
||
|
||
SHELL=/bin/sh
|
||
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
|
||
|
||
17 * * * * [1;31mroot[0m cd / && run-parts --report /etc/cron.hourly
|
||
25 6 * * * [1;31mroot[0m test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
|
||
47 6 * * 7 [1;31mroot[0m test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
|
||
52 6 1 * * [1;31mroot[0m test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
|
||
* * * * * /home/diego/bot.py
|
||
|
||
[1;34m╔══════════╣ [1;32mThird party LaunchAgents & LaunchDemons
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/macos/macos-security-and-privilege-escalation#launchd
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mWritable System LaunchAgents & LaunchDemons
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mStartupItems
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/macos/macos-security-and-privilege-escalation#startup-items
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mLogin Items
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/macos/macos-security-and-privilege-escalation#login-items
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mSPStartupItemDataType
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mEmond scripts
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/macos/macos-security-and-privilege-escalation#emond
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mServices
|
||
[0m[1;34m╚ [1;34m[3mSearch for outdated versions
|
||
[0m [ + ] alsa-utils
|
||
[ + ] apparmor
|
||
[ + ] apport
|
||
[ + ] atd
|
||
[ + ] auditd
|
||
[ - ] console-setup.sh
|
||
[ + ] cron
|
||
[ - ] cryptdisks
|
||
[ - ] cryptdisks-early
|
||
[ + ] dbus
|
||
[ - ] grub-common
|
||
[ - ] hwclock.sh
|
||
[ + ] irqbalance
|
||
[ - ] iscsid
|
||
[ - ] keyboard-setup.sh
|
||
[ + ] kmod
|
||
[ - ] lvm2
|
||
[ - ] lvm2-lvmpolld
|
||
[ + ] multipath-tools
|
||
[ + ] mysql
|
||
[ + ] networking
|
||
[ - ] open-iscsi
|
||
[ + ] open-vm-tools
|
||
[ - ] plymouth
|
||
[ - ] plymouth-log
|
||
[ + ] procps
|
||
[ - ] rsync
|
||
[ + ] rsyslog
|
||
[ - ] screen-cleanup
|
||
[ + ] ssh
|
||
[ + ] udev
|
||
[ + ] uuidd
|
||
[ + ] varnish
|
||
[ + ] varnishncsa
|
||
[ - ] x11-common
|
||
|
||
[1;34m╔══════════╣ [1;32mSystemd PATH
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#systemd-path-relative-paths
|
||
[0mPATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing .service files
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#services
|
||
[0m/etc/systemd/system/multi-user.target.wants/atd.service is executing some relative path
|
||
/etc/systemd/system/multi-user.target.wants/grub-common.service is executing some relative path
|
||
/etc/systemd/system/sleep.target.wants/grub-common.service is executing some relative path
|
||
[1;32mYou can't write on systemd PATH[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mSystem timers
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#timers
|
||
[0mNEXT LEFT LAST PASSED UNIT ACTIVATES
|
||
Fri 2023-02-10 20:06:36 UTC 12min left n/a n/a [1;32mua-timer.timer[0m ua-timer.service
|
||
Fri 2023-02-10 21:03:07 UTC 1h 9min left Thu 2022-11-17 16:11:06 UTC 2 months 24 days ago [1;32mmotd-news.timer[0m motd-news.service
|
||
Sat 2023-02-11 00:00:00 UTC 4h 6min left Fri 2023-02-10 19:10:23 UTC 43min ago [1;32mlogrotate.timer[0m logrotate.service
|
||
Sat 2023-02-11 00:00:00 UTC 4h 6min left Fri 2023-02-10 19:10:23 UTC 43min ago [1;32mman-db.timer[0m man-db.service
|
||
Sat 2023-02-11 01:39:58 UTC 5h 46min left Mon 2022-11-14 14:17:24 UTC 2 months 27 days ago [1;32mapt-daily.timer[0m apt-daily.service
|
||
Sat 2023-02-11 02:52:38 UTC 6h left Mon 2022-11-14 14:44:15 UTC 2 months 27 days ago [1;32mfwupd-refresh.timer[0m fwupd-refresh.service
|
||
Sat 2023-02-11 06:42:09 UTC 10h left Fri 2023-02-10 19:15:48 UTC 38min ago [1;32mapt-daily-upgrade.timer[0m apt-daily-upgrade.service
|
||
Sat 2023-02-11 19:25:19 UTC 23h left Fri 2023-02-10 19:25:19 UTC 28min ago [1;32msystemd-tmpfiles-clean.timer[0m systemd-tmpfiles-clean.service
|
||
Sun 2023-02-12 03:10:31 UTC 1 day 7h left Fri 2023-02-10 19:11:18 UTC 42min ago [1;32me2scrub_all.timer[0m e2scrub_all.service
|
||
Mon 2023-02-13 00:00:00 UTC 2 days left Fri 2023-02-10 19:10:23 UTC 43min ago [1;32mfstrim.timer[0m fstrim.service
|
||
n/a n/a n/a n/a [1;32msnapd.snap-repair.timer[0m snapd.snap-repair.service
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing .timer files
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#timers
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mAnalyzing .socket files
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#sockets
|
||
[0m/etc/systemd/system/sockets.target.wants/uuidd.socket is calling this [1;31mwritable listener: /run/uuidd/request[0m
|
||
/usr/lib/systemd/system/dbus.socket is calling this [1;31mwritable listener: /var/run/dbus/system_bus_socket[0m
|
||
/usr/lib/systemd/system/sockets.target.wants/dbus.socket is calling this [1;31mwritable listener: /var/run/dbus/system_bus_socket[0m
|
||
/usr/lib/systemd/system/sockets.target.wants/systemd-journald-dev-log.socket is calling this [1;31mwritable listener: /run/systemd/journal/dev-log[0m
|
||
/usr/lib/systemd/system/sockets.target.wants/systemd-journald.socket is calling this [1;31mwritable listener: /run/systemd/journal/stdout[0m
|
||
/usr/lib/systemd/system/sockets.target.wants/systemd-journald.socket is calling this [1;31mwritable listener: /run/systemd/journal/socket[0m
|
||
/usr/lib/systemd/system/syslog.socket is calling this [1;31mwritable listener: /run/systemd/journal/syslog[0m
|
||
/usr/lib/systemd/system/systemd-journald-dev-log.socket is calling this [1;31mwritable listener: /run/systemd/journal/dev-log[0m
|
||
/usr/lib/systemd/system/systemd-journald.socket is calling this [1;31mwritable listener: /run/systemd/journal/stdout[0m
|
||
/usr/lib/systemd/system/systemd-journald.socket is calling this [1;31mwritable listener: /run/systemd/journal/socket[0m
|
||
/usr/lib/systemd/system/uuidd.socket is calling this [1;31mwritable listener: /run/uuidd/request[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mUnix Sockets Listening
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#sockets
|
||
[0m[1;31m/org/kernel/linux/storage/multipathd[0m
|
||
└─([1;31m - Can Connect[0m)
|
||
[1;31m/run/dbus/system_bus_socket[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/irqbalance//irqbalance786.sock[0m
|
||
└─([1;31mRead - [1;32mCannot Connect[0m[0m)
|
||
[1;31m/run/irqbalance/irqbalance786.sock[0m
|
||
└─([1;31mRead - [1;32mCannot Connect[0m[0m)
|
||
[1;31m/run/lvm/lvmpolld.socket[0m
|
||
└─([1;31m - [1;32mCannot Connect[0m[0m)
|
||
[1;31m/run/mysqld/mysqld.sock[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/mysqld/mysqlx.sock[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/snapd-snap.socket[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/snapd.socket[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/systemd/journal/dev-log[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/systemd/journal/io.systemd.journal[0m
|
||
└─([1;31m - [1;32mCannot Connect[0m[0m)
|
||
[1;31m/run/systemd/journal/socket[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/systemd/journal/stdout[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/systemd/journal/syslog[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/systemd/notify[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/systemd/private[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/systemd/userdb/io.systemd.DynamicUser[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/udev/control[0m
|
||
└─([1;31m - [1;32mCannot Connect[0m[0m)
|
||
[1;31m/run/user/1000/bus[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/gnupg/S.dirmngr[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/gnupg/S.gpg-agent[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/gnupg/S.gpg-agent.browser[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/gnupg/S.gpg-agent.extra[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/gnupg/S.gpg-agent.ssh[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/pk-debconf-socket[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/snapd-session-agent.socket[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/systemd/notify[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/user/1000/systemd/private[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/uuidd/request[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/run/vmware/guestServicePipe[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/var/run/mysqld/mysqld.sock[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/var/run/mysqld/mysqlx.sock[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/var/run/vmware/guestServicePipe[0m
|
||
└─([1;31mRead Write - Can Connect[0m)
|
||
[1;31m/var/snap/lxd/common/lxd-user/unix.socket[0m
|
||
└─([1;31m - [1;32mCannot Connect[0m[0m)
|
||
|
||
[1;34m╔══════════╣ [1;32mD-Bus config files
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#d-bus
|
||
[0mPossible weak user policy found on /etc/dbus-1/system.d/org.freedesktop.thermald.conf ( <policy group="power">)
|
||
|
||
[1;34m╔══════════╣ [1;32mD-Bus Service Objects list
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#d-bus
|
||
[0m[1;32mNAME[0m PID PROCESS USER CONNECTION UNIT SESSION DESCRIPTION
|
||
[1;32m:1.1[0m 688 systemd-timesyn systemd-timesync :1.1 systemd-timesyncd.service - -
|
||
[1;32m:1.10[0m 1184 systemd-resolve systemd-resolve :1.10 systemd-resolved.service - -
|
||
[1;32m:1.14[0m 65333 systemd [1;95mdiego[0m :1.14 user@1000.service - -
|
||
[1;32m:1.2[0m 775 accounts-[1;32mdaemon [0m[1;31mroot[0m :1.2 accounts-daemon.service - -
|
||
[1;32m:1.256[0m 110232 busctl [1;95mdiego[0m :1.256 session-45.scope 45 -
|
||
[1;32m:1.3[0m 789 polkitd [1;31mroot[0m :1.3 polkit.service - -
|
||
[1;32m:1.4[0m 800 udisksd [1;31mroot[0m :1.4 udisks2.service - -
|
||
[1;32m:1.5[0m 1 systemd [1;31mroot[0m :1.5 init.scope - -
|
||
[1;32m:1.6[0m 799 systemd-logind [1;31mroot[0m :1.6 systemd-logind.service - -
|
||
[1;32m:1.7[0m 843 ModemManager [1;31mroot[0m :1.7 ModemManager.service - -
|
||
[1;32m:1.8[0m 798 snapd [1;31mroot[0m :1.8 snapd.service - -
|
||
[1;32mcom.ubuntu.LanguageSelector[0m - - - (activatable) - - -
|
||
[1;32mcom.ubuntu.SoftwareProperties[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.Accounts[0m 775 accounts-[1;32mdaemon [0m[1;31mroot[0m :1.2 accounts-daemon.service - -
|
||
[1;32morg.freedesktop.DBus[0m 1 systemd [1;31mroot[0m - init.scope - -
|
||
[1;32morg.freedesktop.ModemManager1[0m 843 ModemManager [1;31mroot[0m :1.7 ModemManager.service - -
|
||
[1;32morg.freedesktop.PackageKit[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.PolicyKit1[0m 789 polkitd [1;31mroot[0m :1.3 polkit.service - -
|
||
[1;32morg.freedesktop.UDisks2[0m 800 udisksd [1;31mroot[0m :1.4 udisks2.service - -
|
||
[1;32morg.freedesktop.UPower[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.bolt[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.fwupd[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.hostname1[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.locale1[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.login1[0m 799 systemd-logind [1;31mroot[0m :1.6 systemd-logind.service - -
|
||
[1;32morg.freedesktop.network1[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.resolve1[0m 1184 systemd-resolve systemd-resolve :1.10 systemd-resolved.service - -
|
||
[1;32morg.freedesktop.systemd1[0m 1 systemd [1;31mroot[0m :1.5 init.scope - -
|
||
[1;32morg.freedesktop.thermald[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.timedate1[0m - - - (activatable) - - -
|
||
[1;32morg.freedesktop.timesync1[0m 688 systemd-timesyn systemd-timesync :1.1 systemd-timesyncd.service - -
|
||
|
||
|
||
[1;34m ╔═════════════════════╗
|
||
══════════════════════════════╣ [1;32mNetwork Information[1;34m ╠══════════════════════════════
|
||
[1;34m ╚═════════════════════╝[0m
|
||
[1;34m╔══════════╣ [1;32mHostname, hosts and DNS
|
||
[0mforgot
|
||
127.0.0.1 localhost forgot.htb
|
||
127.0.0.1 forgot
|
||
|
||
::1 ip6-localhost ip6-loopback
|
||
fe00::0 ip6-localnet
|
||
ff00::0 ip6-mcastprefix
|
||
ff02::1 ip6-allnodes
|
||
ff02::2 ip6-allrouters
|
||
|
||
nameserver 127.0.0.53
|
||
options edns0 trust-ad
|
||
|
||
[1;34m╔══════════╣ [1;32mContent of /etc/inetd.conf & /etc/xinetd.conf
|
||
[0m[1;90m/etc/inetd.conf Not Found
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mInterfaces
|
||
[0m# symbolic names for networks, see networks(5) for more information
|
||
link-local 169.254.0.0
|
||
eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST> mtu 1500
|
||
inet 10.10.11.188 netmask 255.255.254.0 broadcast 10.10.11.255
|
||
inet6 dead:beef::250:56ff:feb9:58de prefixlen 64 scopeid 0x0<global>
|
||
inet6 fe80::250:56ff:feb9:58de prefixlen 64 scopeid 0x20<link>
|
||
ether 00:50:56:b9:58:de txqueuelen 1000 (Ethernet)
|
||
RX packets 83685 bytes 22934800 (22.9 MB)
|
||
RX errors 0 dropped 0 overruns 0 frame 0
|
||
TX packets 83741 bytes 48288682 (48.2 MB)
|
||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||
|
||
lo: flags=73<UP,LOOPBACK,RUNNING> mtu 65536
|
||
inet 127.0.0.1 netmask 255.0.0.0
|
||
inet6 ::1 prefixlen 128 scopeid 0x10<host>
|
||
loop txqueuelen 1000 (Local Loopback)
|
||
RX packets 965750 bytes 108402164 (108.4 MB)
|
||
RX errors 0 dropped 0 overruns 0 frame 0
|
||
TX packets 965750 bytes 108402164 (108.4 MB)
|
||
TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mNetworks and neighbours
|
||
[0mKernel IP routing table
|
||
Destination Gateway Genmask Flags Metric Ref Use Iface
|
||
default 10.10.10.2 0.0.0.0 UG 0 0 0 eth0
|
||
10.10.10.0 0.0.0.0 255.255.254.0 U 0 0 0 eth0
|
||
Address HWtype HWaddress Flags Mask Iface
|
||
10.10.11.49 (incomplete) eth0
|
||
10.10.11.126 (incomplete) eth0
|
||
10.10.11.167 (incomplete) eth0
|
||
10.10.11.236 (incomplete) eth0
|
||
10.10.11.85 (incomplete) eth0
|
||
10.10.11.146 (incomplete) eth0
|
||
10.10.11.219 (incomplete) eth0
|
||
10.10.11.0 (incomplete) eth0
|
||
10.10.11.73 (incomplete) eth0
|
||
10.10.11.182 (incomplete) eth0
|
||
10.10.11.36 (incomplete) eth0
|
||
10.10.11.109 (incomplete) eth0
|
||
10.10.11.170 (incomplete) eth0
|
||
|
||
[1;34m╔══════════╣ [1;32mFirewall status
|
||
[0m[1;90msystem_profiler Not Found
|
||
[0m[1;34m╔══════════╣ [1;32mIptables rules
|
||
[0m[1;90miptables rules Not Found
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mActive Ports
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-ports
|
||
[0mtcp 0 0 [1;31m127.0.0.1[0m:3306 0.0.0.0:* LISTEN -
|
||
tcp 0 0 [1;31m127.0.0.1[0m:8080 0.0.0.0:* LISTEN 38095/python3
|
||
tcp 0 0 [1;31m0.0.0.0[0m:80 0.0.0.0:* LISTEN -
|
||
tcp 0 0 [1;31m127.0.0.53[0m:53 0.0.0.0:* LISTEN -
|
||
tcp 0 0 [1;31m0.0.0.0[0m:22 0.0.0.0:* LISTEN -
|
||
tcp 0 0 [1;31m127.0.0.1[0m:6082 0.0.0.0:* LISTEN -
|
||
tcp 0 0 [1;31m127.0.0.1[0m:33060 0.0.0.0:* LISTEN -
|
||
tcp6 0 0 [1;31m:::[0m80 :::* LISTEN -
|
||
tcp6 0 0 [1;31m:::[0m22 :::* LISTEN -
|
||
|
||
[1;34m╔══════════╣ [1;32mHardware Ports
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mVLANs
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mWifi Info
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mCheck Enabled Proxies
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mWifi Proxy URL
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mWifi Web Proxy
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mWifi FTP Proxy
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mCan I sniff with tcpdump?
|
||
[0m[1;90mNo
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mInternet Access?
|
||
[0mPing is not available
|
||
DNS not available
|
||
Port 443 is not accessible
|
||
Port 80 is not accessible
|
||
|
||
[1;34m╔══════════╣ [1;32mScanning local networks (using /24)
|
||
[0m[1;34m══╣ [1;32mDiscovering hosts in 10.10.11.188/24
|
||
[0mScanning top ports of 10.10.11.181
|
||
|
||
[+] Open port at: 10.10.11.181:135
|
||
[+] Open port at: 10.10.11.181:139
|
||
[+] Open port at: 10.10.11.181:3268
|
||
[+] Open port at: 10.10.11.181:3269
|
||
[+] Open port at: 10.10.11.181:389
|
||
[+] Open port at: 10.10.11.181:445
|
||
[+] Open port at: 10.10.11.181:464
|
||
[+] Open port at: 10.10.11.181:53
|
||
[+] Open port at: 10.10.11.181:593
|
||
[+] Open port at: 10.10.11.181:636
|
||
[+] Open port at: 10.10.11.181:80
|
||
[+] Open port at: 10.10.11.181:88
|
||
|
||
Scanning top ports of 10.10.11.186
|
||
|
||
[+] Open port at: 10.10.11.186:21
|
||
[+] Open port at: 10.10.11.186:22
|
||
[+] Open port at: 10.10.11.186:80
|
||
|
||
Scanning top ports of 10.10.11.188 (local)
|
||
|
||
[+] Open port at: 10.10.11.188:22
|
||
[+] Open port at: 10.10.11.188:80
|
||
|
||
Scanning top ports of 10.10.11.195
|
||
|
||
[+] Open port at: 10.10.11.195:22
|
||
[+] Open port at: 10.10.11.195:443
|
||
[+] Open port at: 10.10.11.195:80
|
||
|
||
Scanning top ports of 10.10.11.196
|
||
|
||
[+] Open port at: 10.10.11.196:22
|
||
[+] Open port at: 10.10.11.196:80
|
||
|
||
Scanning top ports of 10.10.11.197
|
||
|
||
[+] Open port at: 10.10.11.197:22
|
||
[+] Open port at: 10.10.11.197:80
|
||
|
||
|
||
[1;34m══╣ [1;32mScanning top ports of host.docker.internal
|
||
[0m
|
||
|
||
|
||
[1;34m ╔═══════════════════╗
|
||
═══════════════════════════════╣ [1;32mUsers Information[1;34m ╠═══════════════════════════════
|
||
[1;34m ╚═══════════════════╝[0m
|
||
[1;34m╔══════════╣ [1;32mMy user
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#users
|
||
[0muid=1000([1;95mdiego[0m) gid=1000([1;95mdiego[0m) groups=1000([1;95mdiego[0m)
|
||
|
||
[1;34m╔══════════╣ [1;32mCurrent user Login and Logout hooks
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mAll Login and Logout hooks
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mKeychains
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/macos/macos-security-and-privilege-escalation#chainbreaker
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mSystemKey
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mDo I have PGP keys?
|
||
[0m/usr/bin/gpg
|
||
[1;90mnetpgpkeys Not Found
|
||
[0m[1;90mnetpgp Not Found
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mChecking 'sudo -l', /etc/sudoers, and /etc/sudoers.d
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid
|
||
[0mMatching Defaults entries for [1;31mdiego[0m on forgot:
|
||
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
|
||
|
||
User [1;31mdiego[0m may run the following commands on forgot:
|
||
([1;31mALL[0m) [1;31mNOPASSWD[0m: /opt/security/ml_security.py
|
||
Matching Defaults entries for [1;31mdiego[0m on forgot:
|
||
env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
|
||
|
||
User [1;31mdiego[0m may run the following commands on forgot:
|
||
([1;31mALL[0m) [1;31mNOPASSWD[0m: /opt/security/ml_security.py
|
||
|
||
[1;34m╔══════════╣ [1;32mChecking sudo tokens
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#reusing-sudo-tokens
|
||
[0mptrace protection [1;32mis enabled[0m (1)
|
||
[1;32mgdb[0m wasn't found in PATH, this might still be vulnerable but linpeas won't be able to check it
|
||
|
||
[1;34m╔══════════╣ [1;32mChecking Pkexec policy
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe#pe-method-2
|
||
[0m
|
||
[Configuration]
|
||
AdminIdentities=unix-user:0
|
||
[Configuration]
|
||
AdminIdentities=unix-group:sudo;unix-group:admin
|
||
|
||
[1;34m╔══════════╣ [1;32mSuperusers
|
||
[0m[1;31mroot[0m:x:0:0:root:/root:/bin/bash
|
||
|
||
[1;34m╔══════════╣ [1;32mUsers with console
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mAll users & groups
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mLogin now
|
||
[0m 19:56:56 up 46 min, 0 users, load average: 26.82, 11.33, 4.59
|
||
USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT
|
||
|
||
[1;34m╔══════════╣ [1;32mLast logons
|
||
[0mreboot system boot Fri Feb 10 19:10:18 2023 still running 0.0.0.0
|
||
[1;95mdiego[0m pts/0 Fri Nov 18 10:51:30 2022 - Fri Nov 18 10:52:36 2022 (00:01) 10.10.14.40
|
||
reboot system boot Fri Nov 18 10:50:46 2022 - Fri Nov 18 10:52:38 2022 (00:01) 0.0.0.0
|
||
|
||
wtmp begins Fri Nov 18 10:50:46 2022
|
||
|
||
[1;34m╔══════════╣ [1;32mLast time logon each user
|
||
[0mUsername Port From Latest
|
||
[1;95mdiego[0m pts/0 10.10.14.40 Fri Nov 18 10:51:30 +0000 2022
|
||
|
||
[1;34m╔══════════╣ [1;32mPassword policy
|
||
[0mPASS_MAX_DAYS 99999
|
||
PASS_MIN_DAYS 0
|
||
PASS_WARN_AGE 7
|
||
ENCRYPT_METHOD SHA512
|
||
|
||
[1;34m╔══════════╣ [1;32mRelevant last user info and user configs
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mGuest user status
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mDo not forget to test 'su' as any other user with shell: without password and with their names as password (I can't do it...)
|
||
[0m
|
||
[0m[1;34m╔══════════╣ [1;32mDo not forget to execute 'sudo -l' without password or with valid password (if you know it)!!
|
||
[0m
|
||
[0m
|
||
|
||
[1;34m ╔══════════════════════╗
|
||
═════════════════════════════╣ [1;32mSoftware Information[1;34m ╠═════════════════════════════
|
||
[1;34m ╚══════════════════════╝[0m
|
||
[1;34m╔══════════╣ [1;32mUseful software
|
||
[0m/usr/bin/base64
|
||
/usr/bin/curl
|
||
/usr/bin/g++
|
||
/usr/bin/gcc
|
||
/usr/bin/make
|
||
/usr/bin/nc
|
||
/usr/bin/netcat
|
||
/usr/bin/perl
|
||
/usr/bin/ping
|
||
/usr/bin/python2
|
||
/usr/bin/python2.7
|
||
/usr/bin/python3
|
||
/usr/bin/sudo
|
||
/usr/bin/wget
|
||
|
||
[1;34m╔══════════╣ [1;32mInstalled Compilers
|
||
[0mii g++ 4:9.3.0-1ubuntu2 amd64 GNU C++ compiler
|
||
ii g++-9 9.4.0-1ubuntu1~20.04.1 amd64 GNU C++ compiler
|
||
ii gcc 4:9.3.0-1ubuntu2 amd64 GNU C compiler
|
||
ii gcc-9 9.4.0-1ubuntu1~20.04.1 amd64 GNU C compiler
|
||
/usr/bin/gcc
|
||
/usr/bin/g++
|
||
|
||
[1;34m╔══════════╣ [1;32mWritable Installed Applications
|
||
[0m[1;34m╔══════════╣ [1;32mMySQL version
|
||
[0mmysql Ver 8.0.31-0ubuntu0.20.04.1 for Linux on x86_64 ((Ubuntu))
|
||
|
||
|
||
[1;34m═╣ [1;32mMySQL connection using default root/root ........... [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mMySQL connection using root/toor ................... [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mMySQL connection using root/NOPASS ................. [0m[1;90mNo
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mSearching mysql credentials and exec
|
||
[0mFrom '/etc/mysql/mysql.conf.d/mysqld.cnf' Mysql user: user = mysql
|
||
Found readable /etc/mysql/my.cnf
|
||
!includedir /etc/mysql/conf.d/
|
||
!includedir /etc/mysql/mysql.conf.d/
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing MariaDB Files (limit 70)
|
||
[0m
|
||
-rw------- 1 root root 317 Nov 3 12:43 /etc/mysql/[1;31mdebian.cnf[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing Rsync Files (limit 70)
|
||
[0m-rw-r--r-- 1 root root 1044 Aug 16 18:48 /usr/share/doc/rsync/examples/[1;31mrsyncd.conf[0m
|
||
[ftp]
|
||
comment = public archive
|
||
path = /var/www/pub
|
||
use chroot = yes
|
||
lock file = /var/lock/rsyncd
|
||
read only = yes
|
||
list = yes
|
||
uid = nobody
|
||
gid = nogroup
|
||
strict modes = yes
|
||
ignore errors = no
|
||
ignore nonreadable = yes
|
||
transfer logging = no
|
||
timeout = 600
|
||
refuse options = checksum dry-run
|
||
dont compress = *.gz *.tgz *.zip *.z *.rpm *.deb *.iso *.bz2 *.tbz
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing Ldap Files (limit 70)
|
||
[0mThe password hash is from the {SSHA} to 'structural'
|
||
drwxr-xr-x 2 root root 4096 Nov 7 11:36 /etc/[1;31mldap[0m
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mSearching ssl/ssh files
|
||
[0m[1;31mPermitRootLogin yes[0m
|
||
ChallengeResponseAuthentication no
|
||
UsePAM yes
|
||
PasswordAuthentication yes
|
||
[1;34m══╣ [1;32mSome certificates were found (out limited):
|
||
[0m/etc/pki/fwupd-metadata/LVFS-CA.pem
|
||
/etc/pki/fwupd/LVFS-CA.pem
|
||
/etc/pollinate/entropy.ubuntu.com.pem
|
||
/var/lib/fwupd/pki/client.pem
|
||
99219PSTORAGE_CERTSBIN
|
||
|
||
[1;34m══╣ [1;32mWritable ssh and gpg agents
|
||
[0m/etc/systemd/user/sockets.target.wants/gpg-agent-ssh.socket
|
||
/etc/systemd/user/sockets.target.wants/gpg-agent-browser.socket
|
||
/etc/systemd/user/sockets.target.wants/gpg-agent-extra.socket
|
||
/etc/systemd/user/sockets.target.wants/gpg-agent.socket
|
||
[1;34m══╣ [1;32mSome home ssh config file was found
|
||
[0m[1;31m/usr/share/openssh/sshd_config[0m
|
||
Include /etc/ssh/sshd_config.d/*.conf
|
||
ChallengeResponseAuthentication no
|
||
UsePAM yes
|
||
X11Forwarding yes
|
||
PrintMotd no
|
||
AcceptEnv LANG LC_*
|
||
Subsystem sftp /usr/lib/openssh/sftp-server
|
||
|
||
[1;34m══╣ [1;32m/etc/hosts.allow file found, trying to read the rules:
|
||
[0m/etc/hosts.allow
|
||
|
||
|
||
Searching inside /etc/ssh/ssh_config for interesting info
|
||
Include /etc/ssh/ssh_config.d/*.conf
|
||
[1;31mHost[0m *
|
||
SendEnv LANG LC_*
|
||
HashKnown[1;31mHost[0ms yes
|
||
GSSAPIAuthentication yes
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing PAM Auth Files (limit 70)
|
||
[0mdrwxr-xr-x 2 root root 4096 Nov 7 11:37 /etc/[1;31mpam.d[0m
|
||
-rw-r--r-- 1 root root 2133 Feb 26 2020 /etc/pam.d/[1;31msshd[0m
|
||
|
||
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mSearching tmux sessions
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-shell-sessions
|
||
[0mtmux 3.0a
|
||
[1;31m[0m
|
||
[1;31m[0m
|
||
[1;31m/tmp/tmux-1000[0m
|
||
[1;34m╔══════════╣ [1;32mAnalyzing Keyring Files (limit 70)
|
||
[0mdrwxr-xr-x 2 root root 4096 Nov 8 11:23 /usr/share/[1;31mkeyrings[0m
|
||
|
||
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing Filezilla Files (limit 70)
|
||
[0m
|
||
-rw-r--r-- 1 root root 2928 Mar 22 2020 /usr/share/bleachbit/cleaners/[1;31mfilezilla.xml[0m
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mSearching uncommon passwd files (splunk)
|
||
[0mpasswd file: [1;31m/etc/pam.d/passwd[0m
|
||
passwd file: [1;31m/etc/passwd[0m
|
||
passwd file: [1;31m/usr/share/bash-completion/completions/passwd[0m
|
||
passwd file: [1;31m/usr/share/lintian/overrides/passwd[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing PGP-GPG Files (limit 70)
|
||
[0m/usr/bin/gpg
|
||
[1;90mnetpgpkeys Not Found
|
||
[0m[1;90mnetpgp Not Found
|
||
[0m
|
||
-rw-r--r-- 1 root root 2796 Mar 29 2021 /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-archive[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2794 Mar 29 2021 /etc/apt/trusted.gpg.d/ubuntu-keyring-2012-cdimage[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 1733 Mar 29 2021 /etc/apt/trusted.gpg.d/ubuntu-keyring-2018-archive[1;31m.gpg[0m
|
||
-rw------- 1 diego diego 1200 Feb 10 19:45 /home/diego/.gnupg/trustdb[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 3267 Jul 4 2022 /usr/share/gnupg/distsigkey[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2247 Feb 2 2022 /usr/share/keyrings/ubuntu-advantage-cc-eal[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2274 Feb 2 2022 /usr/share/keyrings/ubuntu-advantage-cis[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2236 Feb 2 2022 /usr/share/keyrings/ubuntu-advantage-esm-apps[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2264 Feb 2 2022 /usr/share/keyrings/ubuntu-advantage-esm-infra-trusty[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2275 Feb 2 2022 /usr/share/keyrings/ubuntu-advantage-fips[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2250 Oct 25 16:46 /usr/share/keyrings/ubuntu-advantage-realtime-kernel[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2235 Feb 2 2022 /usr/share/keyrings/ubuntu-advantage-ros[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 7399 Sep 17 2018 /usr/share/keyrings/ubuntu-archive-keyring[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 6713 Oct 27 2016 /usr/share/keyrings/ubuntu-archive-removed-keys[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 4097 Feb 6 2018 /usr/share/keyrings/ubuntu-cloudimage-keyring[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 0 Jan 17 2018 /usr/share/keyrings/ubuntu-cloudimage-removed-keys[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 1227 May 27 2010 /usr/share/keyrings/ubuntu-master-keyring[1;31m.gpg[0m
|
||
-rw-r--r-- 1 root root 2867 Feb 13 2020 /usr/share/popularity-contest/debian-popcon[1;31m.gpg[0m
|
||
|
||
drwx------ 4 diego diego 4096 Feb 10 19:56 /home/diego/[1;31m.gnupg[0m
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing Postfix Files (limit 70)
|
||
[0m-rw-r--r-- 1 root root 813 Feb 2 2020 /usr/share/bash-completion/completions/[1;31mpostfix[0m
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing Bind Files (limit 70)
|
||
[0m-rw-r--r-- 1 root root 832 Feb 2 2020 /usr/share/bash-completion/completions/[1;31mbind[0m
|
||
[1;31m-rw-r--r-- 1 root root 832 Feb 2 2020 /usr/share/bash-completion/completions/bind[0m
|
||
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing Windows Files (limit 70)
|
||
[0m
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
lrwxrwxrwx 1 root root 20 Nov 3 12:43 /etc/alternatives/my.cnf -> /etc/mysql/mysql.cnf
|
||
lrwxrwxrwx 1 root root 24 Nov 3 12:42 /etc/mysql/my.cnf -> /etc/alternatives/[1;31mmy.cnf[0m
|
||
-rw-r--r-- 1 root root 81 Nov 3 12:43 /var/lib/dpkg/alternatives/[1;31mmy.cnf[0m
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
[1;34m╔══════════╣ [1;32mAnalyzing Other Interesting Files (limit 70)
|
||
[0m-rw-r--r-- 1 root root 3771 Feb 25 2020 /etc/skel/[1;31m.bashrc[0m
|
||
-rw-r--r-- 1 diego diego 3771 Jun 28 2022 /home/diego/[1;31m.bashrc[0m
|
||
|
||
|
||
|
||
|
||
|
||
-rw-r--r-- 1 root root 807 Feb 25 2020 /etc/skel/[1;31m.profile[0m
|
||
-rw-r--r-- 1 diego diego 807 Jun 28 2022 /home/diego/[1;31m.profile[0m
|
||
|
||
|
||
|
||
|
||
|
||
|
||
[1;34m ╔═══════════════════╗
|
||
═══════════════════════════════╣ [1;32mInteresting Files[1;34m ╠═══════════════════════════════
|
||
[1;34m ╚═══════════════════╝[0m
|
||
[1;34m╔══════════╣ [1;32mSUID - Check easy privesc, exploits and write perms
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid
|
||
[0m-rwsr-xr-- 1 root messagebus 51K Oct 25 13:09 /usr/lib/dbus-1.0[1;32m/dbus-daemon-launch-helper[0m
|
||
-rwsr-xr-x 1 root root 15K Jul 8 2019 /usr/lib/eject[1;32m/dmcrypt-get-device[0m
|
||
-rwsr-xr-x 1 root root 144K Oct 17 16:25 /usr/lib/snapd[1;31m/snap-confine ---> Ubuntu_snapd<2.37_dirty_sock_Local_Privilege_Escalation(CVE-2019-7304)[0m
|
||
-rwsr-xr-x 1 root root 23K Feb 21 2022 /usr/lib/policykit-1[1;32m/polkit-agent-helper-1[0m
|
||
-rwsr-xr-x 1 root root 463K Mar 30 2022 /usr/lib/openssh[1;32m/ssh-keysign[0m
|
||
-rwsr-xr-x 1 root root 55K Feb 7 2022 /usr/bin[1;31m/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8[0m
|
||
-rwsr-xr-x 1 root root 163K Jan 19 2021 /usr/bin[1;31m/sudo ---> check_if_the_sudo_version_is_vulnerable[0m
|
||
-rwsr-xr-x 1 root root 87K Mar 14 2022 /usr/bin[1;32m/gpasswd[0m
|
||
-rwsr-xr-x 1 root root 39K Feb 7 2022 /usr/bin[1;31m/umount ---> BSD/Linux(08-1996)[0m
|
||
-rwsr-xr-x 1 root root 67K Mar 14 2022 /usr/bin[1;31m/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)[0m
|
||
-rwsr-xr-x 1 root root 39K Mar 7 2020 /usr/bin[1;32m/fusermount[0m
|
||
-rwsr-xr-x 1 root root 52K Mar 14 2022 /usr/bin[1;32m/chsh[0m
|
||
-rwsr-sr-x 1 daemon daemon 55K Nov 12 2018 /usr/bin[1;31m/at ---> RTru64_UNIX_4.0g(CVE-2002-1614)[0m
|
||
-rwsr-xr-x 1 root root 84K Mar 14 2022 /usr/bin[1;31m/chfn ---> SuSE_9.3/10[0m
|
||
-rwsr-xr-x 1 root root 44K Mar 14 2022 /usr/bin[1;31m/newgrp ---> HP-UX_10.20[0m
|
||
-rwsr-xr-x 1 root root 67K Feb 7 2022 /usr/bin[1;32m/su[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mSGID
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid
|
||
[0m-rwxr-sr-x 1 root shadow 43K Sep 17 2021 /usr/sbin[1;32m/pam_extrausers_chkpwd[0m
|
||
-rwxr-sr-x 1 root shadow 43K Sep 17 2021 /usr/sbin[1;32m/unix_chkpwd[0m
|
||
-rwxr-sr-x 1 root utmp 15K Sep 30 2019 /usr/lib/x86_64-linux-gnu/utempter[1;32m/utempter[0m
|
||
-rwxr-sr-x 1 root tty 35K Feb 7 2022 /usr/bin[1;32m/wall[0m
|
||
-rwxr-sr-x 1 root ssh 343K Mar 30 2022 /usr/bin[1;32m/ssh-agent[0m
|
||
-rwxr-sr-x 1 root shadow 31K Mar 14 2022 /usr/bin[1;32m/expiry[0m
|
||
-rwxr-sr-x 1 root tty 15K Mar 30 2020 /usr/bin[1;32m/bsd-write[0m
|
||
-rwxr-sr-x 1 root shadow 83K Mar 14 2022 /usr/bin[1;32m/chage[0m
|
||
-rwsr-sr-x 1 daemon daemon 55K Nov 12 2018 /usr/bin[1;31m/at ---> RTru64_UNIX_4.0g(CVE-2002-1614)[0m
|
||
-rwxr-sr-x 1 root crontab 43K Feb 13 2020 /usr/bin[1;32m/crontab[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mChecking misconfigurations of ld.so
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#ld-so
|
||
[0m[3m/etc/ld.so.conf
|
||
[0minclude /etc/ld.so.conf.d/*.conf
|
||
|
||
[3m/etc/ld.so.conf.d
|
||
[0m[3m /etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
|
||
[0m[1;32m/usr/lib/x86_64-linux-gnu/libfakeroot[0m
|
||
[3m /etc/ld.so.conf.d/libc.conf
|
||
[0m[1;32m/usr/local/lib[0m
|
||
[3m /etc/ld.so.conf.d/x86_64-linux-gnu.conf
|
||
[0m[1;32m/usr/local/lib/x86_64-linux-gnu[0m
|
||
[1;32m/lib/x86_64-linux-gnu[0m
|
||
[1;32m/usr/lib/x86_64-linux-gnu[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mCapabilities
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities
|
||
[0mCurrent env capabilities:
|
||
Current: =
|
||
Current proc capabilities:
|
||
[1;32mCapInh: 0000000000000000[0m
|
||
[1;32mCapPrm: 0000000000000000[0m
|
||
[1;32mCapEff: 0000000000000000[0m
|
||
[1;32mCapBnd: 0000003fffffffff[0m
|
||
[1;32mCapAmb: 0000000000000000[0m
|
||
|
||
Parent Shell capabilities:
|
||
0x0000000000000000=
|
||
|
||
Files with capabilities (limited to 50):
|
||
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = [1;31mcap_net_bind_service[0m,cap_net_admin+ep
|
||
/usr/bin/ping = [1;31mcap_net_raw[0m+ep
|
||
/usr/bin/mtr-packet = [1;31mcap_net_raw[0m+ep
|
||
/usr/bin/traceroute6.iputils = [1;31mcap_net_raw[0m+ep
|
||
|
||
[1;34m╔══════════╣ [1;32mUsers with capabilities
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mAppArmor binary profiles
|
||
[0m-rw-r--r-- 1 root root 3461 Jun 21 2022 sbin.dhclient
|
||
-rw-r--r-- 1 root root 9793 Oct 25 20:07 usr.bin.firefox
|
||
-rw-r--r-- 1 root root 3202 Feb 25 2020 usr.bin.man
|
||
-rw-r--r-- 1 root root 28376 Oct 17 16:25 usr.lib.snapd.snap-confine.real
|
||
-rw-r--r-- 1 root root 2006 Oct 19 11:35 usr.sbin.mysqld
|
||
-rw-r--r-- 1 root root 1575 Feb 11 2020 usr.sbin.rsyslogd
|
||
-rw-r--r-- 1 root root 1385 Dec 7 2019 usr.sbin.tcpdump
|
||
|
||
[1;34m╔══════════╣ [1;32mFiles with ACLs (limited to 50)
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#acls
|
||
[0m[1;90mfiles with acls in searched folders Not Found
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32m.sh files in path
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#script-binaries-in-path
|
||
[0m/usr/bin[1;32m/gettext.sh[0m
|
||
/usr/bin[1;32m/rescan-scsi-bus.sh[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mExecutable files potentially added by user (limit 70)
|
||
[0m2022-11-14+17:00:34.8890621780 /usr/local/sbin/laurel
|
||
2022-11-14+15:45:18.6905743680 /home/diego/bot.py
|
||
2022-11-14+15:32:32.4705947200 /opt/security/ml_security.py
|
||
2022-11-04+11:20:56.2201051380 /usr/local/bin/cmark
|
||
2022-11-04+11:20:56.1678832020 /usr/local/bin/pygmentize
|
||
2022-07-09+13:47:32.8162692890 /usr/local/bin/nltk
|
||
2022-07-09+13:47:31.5122698240 /usr/local/bin/tqdm
|
||
2022-07-09+13:47:25.2282723810 /usr/local/bin/f2py3.8
|
||
2022-07-09+13:47:25.2282723810 /usr/local/bin/f2py3
|
||
2022-07-09+13:47:25.2242723820 /usr/local/bin/f2py
|
||
2022-07-09+13:29:33.8846898820 /usr/local/bin/toco_from_protos
|
||
2022-07-09+13:29:33.8846898820 /usr/local/bin/toco
|
||
2022-07-09+13:29:33.8846898820 /usr/local/bin/tflite_convert
|
||
2022-07-09+13:29:33.8846898820 /usr/local/bin/tf_upgrade_v2
|
||
2022-07-09+13:29:33.8846898820 /usr/local/bin/tensorboard
|
||
2022-07-09+13:29:33.8846898820 /usr/local/bin/saved_model_cli
|
||
2022-07-09+13:29:33.8846898820 /usr/local/bin/import_pb_to_tensorboard
|
||
2022-07-09+13:29:33.8846898820 /usr/local/bin/estimator_ckpt_converter
|
||
2022-07-09+13:16:00.1010646620 /usr/local/bin/markdown_py
|
||
2022-07-09+13:16:00.0250644650 /usr/local/bin/wheel
|
||
2022-07-09+13:15:59.9890643700 /usr/local/bin/google-oauthlib-tool
|
||
2022-07-09+13:15:59.8810640710 /usr/local/bin/pyrsa-verify
|
||
2022-07-09+13:15:59.8810640710 /usr/local/bin/pyrsa-sign
|
||
2022-07-09+13:15:59.8810640710 /usr/local/bin/pyrsa-priv2pub
|
||
2022-07-09+13:15:59.8810640710 /usr/local/bin/pyrsa-keygen
|
||
2022-07-09+13:15:59.8810640710 /usr/local/bin/pyrsa-encrypt
|
||
2022-07-09+13:15:59.8810640710 /usr/local/bin/pyrsa-decrypt
|
||
2022-06-24+12:36:03.0241953670 /usr/local/bin/flask
|
||
2020-05-07+12:40:01.1333022800 /etc/console-setup/cached_setup_terminal.sh
|
||
2020-05-07+12:40:01.1333022800 /etc/console-setup/cached_setup_keyboard.sh
|
||
2020-05-07+12:40:01.1333022800 /etc/console-setup/cached_setup_font.sh
|
||
2020-05-07+12:38:26.8879969470 /etc/network/if-up.d/mtuipv6
|
||
2020-05-07+12:38:26.8879969470 /etc/network/if-pre-up.d/mtuipv6
|
||
|
||
[1;34m╔══════════╣ [1;32mUnsigned Applications
|
||
[0m[1;34m╔══════════╣ [1;32mUnexpected in /opt (usually empty)
|
||
[0mtotal 12
|
||
drwxr-xr-x 3 root root 4096 Jul 22 2022 .
|
||
drwxr-xr-x 20 root root 4096 Nov 7 12:13 ..
|
||
drwxr-xr-x 3 root root 4096 Nov 14 15:32 security
|
||
|
||
[1;34m╔══════════╣ [1;32mUnexpected in root
|
||
[0m[1;31m/snap[0m
|
||
[1;31m/boot[0m
|
||
[1;31m/tmp[0m
|
||
[1;31m/cdrom[0m
|
||
[1;31m/lost+found[0m
|
||
[1;31m/mnt[0m
|
||
[1;31m/media[0m
|
||
[1;31m/lib32[0m
|
||
[1;31m/sys[0m
|
||
[1;31m/lib64[0m
|
||
[1;31m/proc[0m
|
||
[1;31m/libx32[0m
|
||
[1;31m/root[0m
|
||
[1;31m/etc[0m
|
||
[1;31m/var[0m
|
||
[1;31m/lib[0m
|
||
[1;31m/run[0m
|
||
[1;31m/srv[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mFiles (scripts) in /etc/profile.d/
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#profiles-files
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mPermissions in init, init.d, systemd, and rc.d
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#init-init-d-systemd-and-rc-d
|
||
[0m
|
||
[1;34m═╣ [1;32mHashes inside passwd file? ........... [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mWritable passwd file? ................ [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mCredentials in fstab/mtab? ........... [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mCan I read shadow files? ............. [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mCan I read shadow plists? ............ [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mCan I write shadow plists? ........... [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mCan I read opasswd file? ............. [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mCan I write in network-scripts? ...... [0m[1;90mNo
|
||
[0m[1;34m═╣ [1;32mCan I read root folder? .............. [0m[1;90mNo
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mSearching root files in home dirs (limit 30)
|
||
[0m/home/
|
||
/home/[1;31mdiego[0m/app/app.py
|
||
/home/[1;31mdiego[0m/bot.py
|
||
/root/
|
||
|
||
[1;34m╔══════════╣ [1;32mSearching folders owned by me containing others files on it (limit 100)
|
||
[0m/home/[1;95mdiego[0m
|
||
/home/[1;95mdiego[0m/app
|
||
/sys/fs/cgroup/systemd/user.slice/user-1000.slice/user@1000.service
|
||
/sys/fs/cgroup/unified/user.slice/user-1000.slice/user@1000.service
|
||
|
||
[1;34m╔══════════╣ [1;32mReadable files belonging to root and readable by me but not world readable
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mModified interesting files in the last 5mins (limit 100)
|
||
[0m[1;31m/home/diego/app/flask_session[0m/c422b74f2fe2d270539eee0d1bebf5bc
|
||
[1;31m/home/diego/app/flask_session[0m/2029240f6d1128be89ddc32729463129
|
||
[1;31m/home/diego/app/flask_session[0m/02b67f99d0d47f7295c63e9208f57f66
|
||
[1;31m/home/diego/app/flask_session[0m/93fe96458920e46ccdd62caa9903114e
|
||
[1;31m/home/diego/app/flask_session[0m/5960a0811e9503d8ee4cebfdbdd5ca40
|
||
[1;31m/home/diego/app/flask_session[0m/cf8080fb6cc5cc1ab94c543db9a97a6b
|
||
[1;31m/home/diego[0m/peas.log
|
||
[1;31m/home/diego/.gnupg[0m/crls.d/DIR.txt
|
||
/var/log/syslog
|
||
/var/log/journal/8e7b2e7692df48faa4e42d6cfc791ed2/system.journal
|
||
/var/log/journal/8e7b2e7692df48faa4e42d6cfc791ed2/user-1000@b8dee92a64b443179990842dacf3d889-000000000010720f-0005f45dd9c301e0.journal
|
||
/var/log/journal/8e7b2e7692df48faa4e42d6cfc791ed2/user-1000@b8dee92a64b443179990842dacf3d889-00000000000e9045-0005f45dc1c7bb87.journal
|
||
/var/log/journal/8e7b2e7692df48faa4e42d6cfc791ed2/system@c7d1ee69c5ab40d48bd0b9a36509ccac-00000000000e7637-0005f45dc1b7b0c7.journal
|
||
/var/log/journal/8e7b2e7692df48faa4e42d6cfc791ed2/system@c7d1ee69c5ab40d48bd0b9a36509ccac-0000000000106d01-0005f45dd9b76fb4.journal
|
||
/var/log/journal/8e7b2e7692df48faa4e42d6cfc791ed2/user-1000.journal
|
||
/var/log/auth.log
|
||
|
||
[1;34m╔══════════╣ [1;32mWritable log files (logrotten) (limit 50)
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#logrotate-exploitation
|
||
[0mlogrotate 3.14.0
|
||
|
||
Default mail command: /usr/bin/mail
|
||
Default compress command: /bin/gzip
|
||
Default uncompress command: /bin/gunzip
|
||
Default compress extension: .gz
|
||
Default state file path: /var/lib/logrotate/status
|
||
ACL support: yes
|
||
SELinux support: yes
|
||
Writable:[1;31m /home/diego/peas.log
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mFiles inside /home/diego (limit 20)
|
||
[0mtotal 968
|
||
drwxr-xr-x 9 diego diego 4096 Feb 10 19:45 .
|
||
drwxr-xr-x 3 root root 4096 Jun 28 2022 ..
|
||
lrwxrwxrwx 1 diego diego 9 Jun 28 2022 .bash_history -> /dev/null
|
||
-rw-r--r-- 1 diego diego 220 Jun 28 2022 .bash_logout
|
||
-rw-r--r-- 1 diego diego 3771 Jun 28 2022 .bashrc
|
||
drwxrwxr-x 5 diego diego 4096 Jun 28 2022 .cache
|
||
drwx------ 4 diego diego 4096 Feb 10 19:56 .gnupg
|
||
drwxrwxr-x 2 diego diego 4096 Nov 14 12:58 .keras
|
||
drwxrwxr-x 4 diego diego 4096 Jun 28 2022 .local
|
||
drwx------ 3 diego diego 4096 Jun 28 2022 .mozilla
|
||
-rw-r--r-- 1 diego diego 807 Jun 28 2022 .profile
|
||
drwxrw-r-- 5 diego diego 4096 Nov 16 15:04 app
|
||
-rwxr-xr-x 1 root root 970 Nov 14 15:45 bot.py
|
||
-rw-rw-r-- 1 diego diego 828098 Feb 10 19:42 linpeas.sh
|
||
-rw-rw-r-- 1 diego diego 98956 Feb 10 19:57 peas.log
|
||
drwx------ 3 diego diego 4096 Nov 3 14:56 snap
|
||
-rw-r----- 1 diego diego 33 Feb 10 19:10 user.txt
|
||
|
||
[1;34m╔══════════╣ [1;32mFiles inside others home (limit 20)
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mSearching installed mail applications
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mMails (limit 50)
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mBackup files (limited 100)
|
||
[0m-rw-r--r-- 1 root staff 1422 Jul 9 2022 /usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/src/core/ext/filters/client_channel/[1;31mbackup[0m_poller.h
|
||
-rwxr-xr-x 1 root root 226 Feb 17 2020 /usr/share/byobu/desktop/byobu.desktop[1;31m.old[0m
|
||
-rw-r--r-- 1 root root 392817 Feb 9 2020 /usr/share/doc/manpages/Changes[1;31m.old[0m.gz
|
||
-rw-r--r-- 1 root root 7867 Jul 16 1996 /usr/share/doc/telnet/README[1;31m.old[0m.gz
|
||
-rw-r--r-- 1 root root 11886 Nov 7 11:38 /usr/share/info/dir[1;31m.old[0m
|
||
-rw-r--r-- 1 root root 2756 Feb 13 2020 /usr/share/man/man8/vgcfg[1;31mbackup[0m.8.gz
|
||
-rw-r--r-- 1 root root 0 Oct 17 15:19 /usr/src/linux-headers-5.4.0-132-generic/include/config/wm831x/[1;31mbackup[0m.h
|
||
-rw-r--r-- 1 root root 0 Oct 17 15:19 /usr/src/linux-headers-5.4.0-132-generic/include/config/net/team/mode/active[1;31mbackup[0m.h
|
||
-rw-r--r-- 1 root root 237863 Oct 17 15:19 /usr/src/linux-headers-5.4.0-132-generic/.config[1;31m.old[0m
|
||
-rwxr-xr-x 1 root root 1086 Nov 25 2019 /usr/src/linux-headers-5.4.0-132/tools/testing/selftests/net/tcp_fastopen_[1;31mbackup[0m_key.sh
|
||
-rw-r--r-- 1 root root 44048 Aug 16 13:23 /usr/lib/x86_64-linux-gnu/open-vm-tools/plugins/vmsvc/libvm[1;31mbackup[0m.so
|
||
-rw-r--r-- 1 root root 9833 Oct 17 15:19 /usr/lib/modules/5.4.0-132-generic/kernel/drivers/power/supply/wm831x_[1;31mbackup[0m.ko
|
||
-rw-r--r-- 1 root root 9073 Oct 17 15:19 /usr/lib/modules/5.4.0-132-generic/kernel/drivers/net/team/team_mode_active[1;31mbackup[0m.ko
|
||
-rw-r--r-- 1 root root 1802 Aug 15 20:07 /usr/lib/python3/dist-packages/sos/report/plugins/ovirt_engine_[1;31mbackup[0m.py
|
||
-rw-r--r-- 1 root root 1413 Nov 7 11:37 /usr/lib/python3/dist-packages/sos/report/plugins/__pycache__/ovirt_engine_[1;31mbackup[0m.cpython-38.pyc
|
||
-rw-r--r-- 1 root root 39448 Oct 19 11:35 /usr/lib/mysql/plugin/component_mysql[1;31mbackup[0m.so
|
||
-rw-r--r-- 1 root root 2743 Apr 23 2020 /etc/apt/sources.list.curtin[1;31m.old[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mReading messages database
|
||
[0m[1;34m╔══════════╣ [1;32mSearching tables inside readable .db/.sql/.sqlite files (limit 100)
|
||
[0mFound /var/lib/PackageKit/transactions[1;31m.db[0m: SQLite 3.x database, last written using SQLite version 3031001
|
||
Found /var/lib/command-not-found/commands[1;31m.db[0m: SQLite 3.x database, last written using SQLite version 3031001
|
||
Found /var/lib/fwupd/pending[1;31m.db[0m: SQLite 3.x database, last written using SQLite version 3031001
|
||
Found /var/lib/snapd/errtracker[1;31m.db[0m: regular file, no read permission
|
||
|
||
[1;32m -> Extracting tables from[0m /var/lib/PackageKit/transactions.db [1;90m(limit 20)
|
||
[0m[1;32m -> Extracting tables from[0m /var/lib/command-not-found/commands.db [1;90m(limit 20)
|
||
[0m[1;32m -> Extracting tables from[0m /var/lib/fwupd/pending.db [1;90m(limit 20)
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mDownloaded Files
|
||
[0m[1;34m╔══════════╣ [1;32mWeb files?(output limit)
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mAll hidden files (not in /sys/ or the ones listed in the previous check) (limit 70)
|
||
[0m-rw-r--r-- 1 root staff 29 Jul 9 2022 /usr/local/lib/python3.8/dist-packages/numpy/f2py/tests/src/assumed_shape/.f2py_f2cmap
|
||
-rw-r--r-- 1 diego diego 220 Jun 28 2022 /home/diego/.bash_logout
|
||
-rw-r--r-- 1 root root 220 Feb 25 2020 /etc/skel/.bash_logout
|
||
-rw------- 1 root root 0 Apr 23 2020 /etc/.pwd.lock
|
||
-rw-r--r-- 1 landscape landscape 0 Apr 23 2020 /var/lib/landscape/.cleanup.user
|
||
-rw-r--r-- 1 root root 0 Feb 10 19:10 /run/network/.ifstate.lock
|
||
|
||
[1;34m╔══════════╣ [1;32mReadable files inside /tmp, /var/tmp, /private/tmp, /private/var/at/tmp, /private/var/tmp, and backup folders (limit 70)
|
||
[0m-rw-rw-r-- 1 diego diego 828098 Feb 10 19:43 /tmp/linpeas.sh
|
||
-rw-r--r-- 1 root root 43086 Nov 17 16:27 /var/backups/apt.extended_states.0
|
||
-rw-r--r-- 1 root root 3874 Jun 24 2022 /var/backups/apt.extended_states.6.gz
|
||
-rw-r--r-- 1 root root 159577 Jun 24 2022 /var/backups/dpkg.status.4.gz
|
||
-rw-r--r-- 1 root root 4330 Jun 28 2022 /var/backups/apt.extended_states.4.gz
|
||
-rw-r--r-- 1 root root 4554 Nov 17 16:01 /var/backups/apt.extended_states.1.gz
|
||
-rw-r--r-- 1 root root 143786 May 7 2020 /var/backups/dpkg.status.6.gz
|
||
-rw-r--r-- 1 root root 3890 Jun 24 2022 /var/backups/apt.extended_states.5.gz
|
||
-rw-r--r-- 1 root root 140 Jun 24 2022 /var/backups/dpkg.statoverride.1.gz
|
||
-rw-r--r-- 1 root root 139 May 7 2020 /var/backups/dpkg.diversions.4.gz
|
||
-rw-r--r-- 1 root root 702817 Jun 28 2022 /var/backups/dpkg.status.0
|
||
-rw-r--r-- 1 root root 139 May 7 2020 /var/backups/dpkg.diversions.5.gz
|
||
-rw-r--r-- 1 root root 139 May 7 2020 /var/backups/dpkg.diversions.3.gz
|
||
-rw-r--r-- 1 root root 159577 Jun 24 2022 /var/backups/dpkg.status.3.gz
|
||
-rw-r--r-- 1 root root 159577 Jun 24 2022 /var/backups/dpkg.status.5.gz
|
||
-rw-r--r-- 1 root root 140 Jun 24 2022 /var/backups/dpkg.statoverride.2.gz
|
||
-rw-r--r-- 1 root root 159577 Jun 24 2022 /var/backups/dpkg.status.2.gz
|
||
-rw-r--r-- 1 root root 268 May 7 2020 /var/backups/dpkg.diversions.0
|
||
-rw-r--r-- 1 root root 140 Jun 24 2022 /var/backups/dpkg.statoverride.5.gz
|
||
-rw-r--r-- 1 root root 51200 Jun 25 2022 /var/backups/alternatives.tar.0
|
||
-rw-r--r-- 1 root root 140 Jun 24 2022 /var/backups/dpkg.statoverride.3.gz
|
||
-rw-r--r-- 1 root root 140 Jun 24 2022 /var/backups/dpkg.statoverride.4.gz
|
||
-rw-r--r-- 1 root root 4499 Nov 3 12:42 /var/backups/apt.extended_states.3.gz
|
||
-rw-r--r-- 1 root root 2190 May 8 2020 /var/backups/alternatives.tar.1.gz
|
||
-rw-r--r-- 1 root root 139 May 7 2020 /var/backups/dpkg.diversions.1.gz
|
||
-rw-r--r-- 1 root root 139 May 7 2020 /var/backups/dpkg.diversions.6.gz
|
||
-rw-r--r-- 1 root root 4548 Nov 8 11:23 /var/backups/apt.extended_states.2.gz
|
||
-rw-r--r-- 1 root root 174382 Jun 28 2022 /var/backups/dpkg.status.1.gz
|
||
-rw-r--r-- 1 root root 139 May 7 2020 /var/backups/dpkg.diversions.2.gz
|
||
-rw-r--r-- 1 root root 120 Apr 23 2020 /var/backups/dpkg.statoverride.6.gz
|
||
-rw-r--r-- 1 root root 140 Jun 24 2022 /var/backups/dpkg.statoverride.0
|
||
|
||
[1;34m╔══════════╣ [1;32mInteresting writable files owned by me or writable by everyone (not in Home) (max 500)
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files
|
||
[0m/dev/mqueue
|
||
/dev/shm
|
||
/home/diego
|
||
/run/lock
|
||
/run/screen
|
||
/run/user/1000
|
||
/run/user/1000/dbus-1
|
||
/run/user/1000/dbus-1/services
|
||
/run/user/1000/gnupg
|
||
/run/user/1000/inaccessible
|
||
/run/user/1000/systemd
|
||
/run/user/1000/systemd/units
|
||
/tmp
|
||
/tmp/.ICE-unix
|
||
/tmp/.Test-unix
|
||
/tmp/.X11-unix
|
||
/tmp/.XIM-unix
|
||
/tmp/.font-unix
|
||
[3m#)You_can_write_even_more_files_inside_last_directory
|
||
[0m
|
||
[1;31m/usr/bin[0m/geckodriver
|
||
/var/crash
|
||
/var/crash/_opt_security_ml_security.py.1000.crash
|
||
/var/tmp
|
||
|
||
[1;34m╔══════════╣ [1;32mInteresting GROUP writable files (not in Home) (max 500)
|
||
[0m[1;34m╚ [1;34m[3mhttps://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files
|
||
[0m Group [1;32mdiego:
|
||
[0m/tmp/linpeas[1;31m.sh[0m
|
||
|
||
[1;34m╔══════════╣ [1;32mSearching passwords in history files
|
||
[0m
|
||
[1;34m╔══════════╣ [1;32mSearching *password* or *credential* files in home (limit 70)
|
||
[0m/etc/pam.d/common-[1;31mpassword[0m
|
||
/usr/bin/systemd-ask-[1;31mpassword[0m
|
||
/usr/bin/systemd-tty-ask-[1;31mpassword[0m-agent
|
||
/usr/lib/git-core/git-[1;31mcredential[0m
|
||
/usr/lib/git-core/git-[1;31mcredential[0m-cache
|
||
/usr/lib/git-core/git-[1;31mcredential[0m-cache--daemon
|
||
/usr/lib/git-core/git-[1;31mcredential[0m-store
|
||
#)[3mThere are more creds/passwds files in the previous parent folder[0m
|
||
|
||
/usr/lib/grub/i386-pc/[1;31mpassword[0m.mod
|
||
/usr/lib/grub/i386-pc/[1;31mpassword[0m_pbkdf2.mod
|
||
/usr/lib/mysql/plugin/component_validate_[1;31mpassword[0m.so
|
||
/usr/lib/mysql/plugin/validate_[1;31mpassword[0m.so
|
||
/usr/lib/python3/dist-packages/keyring/__pycache__/[1;31mcredential[0ms.cpython-38.pyc
|
||
/usr/lib/python3/dist-packages/keyring/[1;31mcredential[0ms.py
|
||
/usr/lib/python3/dist-packages/launchpadlib/__pycache__/[1;31mcredential[0ms.cpython-38.pyc
|
||
/usr/lib/python3/dist-packages/launchpadlib/[1;31mcredential[0ms.py
|
||
/usr/lib/python3/dist-packages/launchpadlib/tests/__pycache__/test_[1;31mcredential[0m_store.cpython-38.pyc
|
||
/usr/lib/python3/dist-packages/launchpadlib/tests/test_[1;31mcredential[0m_store.py
|
||
/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/__pycache__/client_[1;31mcredential[0ms.cpython-38.pyc
|
||
/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/__pycache__/resource_owner_[1;31mpassword[0m_credentials.cpython-38.pyc
|
||
/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/client_[1;31mcredential[0ms.py
|
||
/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/resource_owner_[1;31mpassword[0m_credentials.py
|
||
/usr/lib/python3/dist-packages/twisted/cred/__pycache__/[1;31mcredential[0ms.cpython-38.pyc
|
||
/usr/lib/python3/dist-packages/twisted/cred/[1;31mcredential[0ms.py
|
||
/usr/lib/systemd/system/multi-user.target.wants/systemd-ask-[1;31mpassword[0m-wall.path
|
||
/usr/lib/systemd/system/sysinit.target.wants/systemd-ask-[1;31mpassword[0m-console.path
|
||
/usr/lib/systemd/system/systemd-ask-[1;31mpassword[0m-console.path
|
||
/usr/lib/systemd/system/systemd-ask-[1;31mpassword[0m-console.service
|
||
/usr/lib/systemd/system/systemd-ask-[1;31mpassword[0m-plymouth.path
|
||
/usr/lib/systemd/system/systemd-ask-[1;31mpassword[0m-plymouth.service
|
||
#)[3mThere are more creds/passwds files in the previous parent folder[0m
|
||
|
||
/usr/local/lib/python3.8/dist-packages/google/auth/__pycache__/_[1;31mcredential[0ms_async.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/google/auth/__pycache__/[1;31mcredential[0ms.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/google/auth/__pycache__/impersonated_[1;31mcredential[0ms.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/google/auth/_[1;31mcredential[0ms_async.py
|
||
/usr/local/lib/python3.8/dist-packages/google/auth/compute_engine/__pycache__/[1;31mcredential[0ms.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/google/auth/compute_engine/[1;31mcredential[0ms.py
|
||
/usr/local/lib/python3.8/dist-packages/google/auth/[1;31mcredential[0ms.py
|
||
/usr/local/lib/python3.8/dist-packages/google/auth/impersonated_[1;31mcredential[0ms.py
|
||
/usr/local/lib/python3.8/dist-packages/google/oauth2/__pycache__/_[1;31mcredential[0ms_async.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/google/oauth2/__pycache__/[1;31mcredential[0ms.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/google/oauth2/_[1;31mcredential[0ms_async.py
|
||
/usr/local/lib/python3.8/dist-packages/google/oauth2/[1;31mcredential[0ms.py
|
||
/usr/local/lib/python3.8/dist-packages/grpc/_cython/_[1;31mcredential[0ms
|
||
/usr/local/lib/python3.8/dist-packages/grpc/_cython/_[1;31mcredential[0ms/roots.pem
|
||
/usr/local/lib/python3.8/dist-packages/mysql/connector/plugins/__pycache__/caching_sha2_[1;31mpassword[0m.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/mysql/connector/plugins/__pycache__/mysql_clear_[1;31mpassword[0m.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/mysql/connector/plugins/__pycache__/mysql_native_[1;31mpassword[0m.cpython-38.pyc
|
||
/usr/local/lib/python3.8/dist-packages/mysql/connector/plugins/__pycache__/sha256_[1;31mpassword[0m.cpython-38.pyc
|
||
#)[3mThere are more creds/passwds files in the previous parent folder[0m
|
||
|
||
/usr/local/lib/python3.8/dist-packages/mysql/connector/plugins/mysql_clear_[1;31mpassword[0m.py
|
||
/usr/local/lib/python3.8/dist-packages/mysql/connector/plugins/mysql_native_[1;31mpassword[0m.py
|
||
/usr/local/lib/python3.8/dist-packages/mysql/connector/plugins/sha256_[1;31mpassword[0m.py
|
||
#)[3mThere are more creds/passwds files in the previous parent folder[0m
|
||
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/include/grpc++/security/server_[1;31mcredential[0ms.h
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/include/grpcpp/security/[1;31mcredential[0ms.h
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/include/grpcpp/security/[1;31mcredential[0ms_impl.h
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/include/grpcpp/security/server_[1;31mcredential[0ms.h
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/include/grpcpp/security/server_[1;31mcredential[0ms_impl.h
|
||
#)[3mThere are more creds/passwds files in the previous parent folder[0m
|
||
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/src/core/lib/security/[1;31mcredential[0ms/alts/alts_credentials.h
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/src/core/lib/security/[1;31mcredential[0ms/alts/grpc_alts_credentials_options.h
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/src/core/lib/security/[1;31mcredential[0ms/composite/composite_credentials.h
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/src/core/lib/security/[1;31mcredential[0ms/credentials.h
|
||
/usr/local/lib/python3.8/dist-packages/tensorflow/include/external/com_github_grpc_grpc/src/core/lib/security/[1;31mcredential[0ms/fake/fake_credentials.h
|
||
|
||
[1;34m╔══════════╣ [1;32mChecking for TTY (sudo/su) passwords in audit logs
|
||
[0m |