NAME           MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT                              nvme0n1        259:0    0    8G  0 disk                                         ├─nvme0n1p1    259:2    0  7.9G  0 part /                                       ├─nvme0n1p14   259:3    0    3M  0 part                                         └─nvme0n1p15   259:4    0  124M  0 part /boot/efi                               nvme1n1        259:1    0    1G  0 disk                                         └─VG_DATA-DATA 254:0    0    2G  0 lvm  /home/admin/data                        nvme2n1        259:5    0    1G  0 disk                                         └─VG_DATA-DATA 254:0    0    2G  0 lvm  /home/admin/data                        admin@i-0b1d3494c15b7bb61:~$ cd data                                            admin@i-0b1d3494c15b7bb61:~/data$ ls                                            lost+found                                                                      admin@i-0b1d3494c15b7bb61:~/data$ ls lost+found/                                ls: cannot open directory 'lost+found/': Permission denied                      admin@i-0b1d3494c15b7bb61:~/data$                                               

        ./main.go:64 +0x47d                                                     admin@i-0c3333eed07916caf:~$ ./kihei -verbose                                   Creating file /home/admin/data/newdatafile with size 1.5GB...                   panic: exit status 1                                                                                                                                            goroutine 1 [running]:                                                          main.main()                                                                             ./main.go:64 +0x47d                                                     admin@i-0c3333eed07916caf:~$ ps -aux | grep kihei                               admin        678  0.1  4.1  98320 19452 pts/0    S<l+ 14:22   0:00 /usr/bin/pythc -t kihei/i-0c3333eed07916caf -q -i 2 /var/log/cast/i-0c3333eed07916caf        admin        681  0.0  3.1  24456 14868 pts/0    S<+  14:22   0:00 /usr/bin/pythc -t kihei/i-0c3333eed07916caf -q -i 2 /var/log/cast/i-0c3333eed07916caf        admin        828  0.0  0.1   5264   640 pts/1    S<+  14:25   0:00 grep kihei   admin@i-0c3333eed07916caf:~$ df                                                 

~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               ~                                                                               (END)                                                                           

tcp    TIME-WAIT  0       0                                      172.31.45.67:46                              172.31.18.4:9000                                  tcp    TIME-WAIT  0       0                                      172.31.45.67:46                              172.31.18.4:9000                                  tcp    TIME-WAIT  0       0                                      172.31.45.67:45                              172.31.18.4:9000                                  tcp    LISTEN     0       4096                                              *:67                                        *:*                                     tcp    LISTEN     0       4096                                              *:80                                        *:*                                     tcp    LISTEN     0       128                                            [::]:22                                     [::]:*                                     tcp    ESTAB      0       0                             [::ffff:172.31.45.67]:80                   [::ffff:172.31.16.109]:59956                                 admin@i-00c8d7508d4dbeee3:~$ ss -lan                                            

                                                                                                                                                                Disk /dev/nvme1n1: 1 GiB, 1073741824 bytes, 2097152 sectors                     Disk model: Amazon Elastic Block Store                                          Units: sectors of 1 * 512 = 512 bytes                                           Sector size (logical/physical): 512 bytes / 512 bytes                           I/O size (minimum/optimal): 4096 bytes / 4096 bytes                                                                                                                                                                                             Disk /dev/nvme2n1: 1 GiB, 1073741824 bytes, 2097152 sectors                     Disk model: Amazon Elastic Block Store                                          Units: sectors of 1 * 512 = 512 bytes                                           Sector size (logical/physical): 512 bytes / 512 bytes                           I/O size (minimum/optimal): 4096 bytes / 4096 bytes                             admin@i-06e4118a8793fca70:~$                                                    

mp3|og[ag]|pls|m3u)" [texi2html]="!*.texi*" [hbpp]="!*.@([Pp][Rr][Gg]|[Cc][Ll][P|stw|sxg|sgl|doc?([mx])|dot?([mx])|rtf|txt|htm|html|?(f)odt|ott|odm|pdf)" [rpm2c="!*.@(sxc|stc|xls?([bmx])|xlw|xlt?([mx])|[ct]sv|?(f)ods|ots)" [hbrun]="!*.[Hh][o|so.!(conf|*/*)|[rs]pm|gif|jp?(e)g|mp3|mp?(e)g|avi|asf|ogg|class)" [latex]="!*.tx|dbj)" [view]="*.@([ao]|so|so.!(conf|*/*)|[rs]pm|gif|jp?(e)g|mp3|mp?(e)g|avi|a"!*.mp3" [compress]="*.Z" [pdfjadetex]="!*.@(?(la)tex|texi|dtx|ins|ltx|dbj)" [pblrunzip]="!*.lrz" [gunzip]="!*.@(Z|[gGd]z|t[ag]z)" [oowriter]="!*.@(sxw|stw|sxg||rtf|txt|htm|html|?(f)odt|ott|odm|pdf)" [epiphany]="!*.@(?([xX]|[sS])[hH][tT][mM.[pf]df" [znew]="*.Z" [kwrite]="*.@([ao]|so|so.!(conf|*/*)|[rs]pm|gif|jp?(e)g|mpss)" [xemacs]="*.@([ao]|so|so.!(conf|*/*)|[rs]pm|gif|jp?(e)g|mp3|mp?(e)g|avi|asf([ao]|so|so.!(conf|*/*)|[rs]pm|gif|jp?(e)g|mp3|mp?(e)g|avi|asf|ogg|class)" [lzfgless]="!*.@(tlz|lzma)" [cdiff]="!*.@(dif?(f)|?(d)patch)?(.@([gx]z|bz2|lzma))" [zx]ar|exe|pk3|wsz|zargo|xpi|s[tx][cdiw]|sx[gm]|o[dt][tspgfc]|od[bm]|oxt|epub|apk|[mx]|xl[st][xm]|pyz|whl)" [pdflatex]="!*.@(?(la)tex|texi|dtx|ins|ltx|dbj)" [port:                                                                               

< HTTP/1.1 404 NOT FOUND                                                        < Server: Werkzeug/2.3.7 Python/3.9.2                                           < Date: Fri, 07 Mar 2025 20:33:25 GMT                                           < Content-Type: text/html; charset=utf-8                                        < Content-Length: 207                                                           < Connection: close                                                             <                                                                               <!doctype html>                                                                 <html lang=en>                                                                  <title>404 Not Found</title>                                                    <h1>Not Found</h1>                                                              <p>The requested URL was not found on the server. If you entered the URL manualling and try again.</p>                                                          * Closing connection 0                                                          admin@i-0f702079919b1d844:~$ curl -v localhost:5000                             

                                                                                LISTEN       0         4096                              *:6767                  users:(("sadagent",pid=565,fd=7))                                              LISTEN       0         4096                              *:8080                  users:(("gotty",pid=564,fd=6))                                                 ESTAB        0         0             [::ffff:172.31.33.75]:8080          [::ffff users:(("gotty",pid=564,fd=7))                                                 admin@i-0fefafcf5226688e9:/proc/576$ watch 'ss -antp'                           admin@i-0fefafcf5226688e9:/proc/576$ cd ~                                       admin@i-0fefafcf5226688e9:~$ ls -l                                              total 8                                                                         drwxr-xr-x 2 admin root 4096 Sep 24  2023 agent                                 -rwxrwx--- 1 root  root  360 Sep 24  2023 webserver.py                          admin@i-0fefafcf5226688e9:~$ find / -perm ^C                                    admin@i-0fefafcf5226688e9:~$                                                    

admin        771     697  0 16:53 pts/1    00:00:00 more                        admin@i-09f185fddd1e81888:~$ history                                                1  2023-09-20T15:57:57 > /home/admin/.bash_history                              2  2023-09-20T15:58:02 exit                                                     3  2025-03-07T16:52:03 sudo su -                                                4  2025-03-07T16:52:06 ls -l                                                    5  2025-03-07T16:52:14 lsof -i :5000                                            6  2025-03-07T16:52:18 sudo lsof -i :5000                                       7  2025-03-07T16:52:22 ps -ef                                                   8  2025-03-07T16:52:38 nstat -tlnp                                              9  2025-03-07T16:52:44 netstat -tlnp                                           10  2025-03-07T16:52:56 systemctl status                                        11  2025-03-07T16:53:15 ps -ef  | more                                          12  2025-03-07T16:54:05 history                                              admin@i-09f185fddd1e81888:~$ ls -l /home/admin/webserver.py                     

/dev/nvme0n1p15  124M  5.9M  118M   5% /boot/efi                                admin@i-0d33944e5b01a1837:~$ df ./ -h                                           Filesystem      Size  Used Avail Use% Mounted on                                /dev/nvme0n1p1  7.7G  6.1G  1.2G  84% /                                         admin@i-0d33944e5b01a1837:~$ du ./ -h                                           11M     ./agent                                                                 4.0K    ./.ansible/tmp                                                          8.0K    ./.ansible                                                              4.0K    ./data                                                                  4.0K    ./.config/procps                                                        8.0K    ./.config/asciinema                                                     16K     ./.config                                                               8.0K    ./.ssh                                                                  5.1G    ./                                                                      admin@i-0d33944e5b01a1837:~$ du ./ -h                                           

admin@i-0de7a2efeec7e6379:~$ curl localhost:5000                                Unauthorizedadmin@i-0de7a2efeec7e6379:~$ curl localhost:5000                    

     20 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/1     22 root      20   0       0      0      0 I   0.0   0.0   0:00.01 kworker/u     23 root      20   0       0      0      0 S   0.0   0.0   0:00.00 kdevtmpfs     24 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 netns         25 root      20   0       0      0      0 S   0.0   0.0   0:00.10 kauditd       26 root      20   0       0      0      0 S   0.0   0.0   0:00.00 khungtask     27 root      20   0       0      0      0 S   0.0   0.0   0:00.00 oom_reape     28 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 writeback     29 root      20   0       0      0      0 S   0.0   0.0   0:00.00 kcompactd     30 root      25   5       0      0      0 S   0.0   0.0   0:00.00 ksmd          49 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kintegrit     50 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kblockd       51 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 blkcg_pun     52 root      20   0       0      0      0 I   0.0   0.0   0:00.02 kworker/1     53 root       0 -20       0      0      0 I   0.0   0.0   0:00.00 kworker/0

admin@i-06b8d56eeffe5186e:~$ curl http://localhost:5000                         Unauthorizedadmin@i-06b8d56eeffe5186e:~$ curl --user-agent "test"               

 latest revision: https://github.com/lsof-org/lsof                               latest FAQ: https://github.com/lsof-org/lsof/blob/master/00FAQ                  latest (non-formatted) man page: https://github.com/lsof-org/lsof/blob/master/L usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-E] [+|-e s] [+|-f[gG]] [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s]           [+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names]   Use the ``-h'' option to get more help information.                             admin@i-0d46f6faaf9ff441c:~$ lsof -n -i :5000                                   admin@i-0d46f6faaf9ff441c:~$ netstat -tulpn | grep 5000                         (Not all processes could be identified, non-owned process info                   will not be shown, you would have to be root to see it all.)                   tcp        0      0 127.0.0.1:5000          0.0.0.0:*               LISTEN      admin@i-0d46f6faaf9ff441c:~$ nc localhost 5000                                  ^C                                                                              admin@i-0d46f6faaf9ff441c:~$ tel