command-line-murders/i-0c746f7fa8176bf1c
by SadServersMore by SadServers
admin@i-001eda64855cc97ed:~$ id -a uid=1000(admin) gid=1000(admin) groups=1000(admin),4(adm),20(dialout),24(cdrom),udio),30(dip),44(video),46(plugdev),109(netdev) admin@i-001eda64855cc97ed:~$ sudo vim We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for admin: sudo: a password is required admin@i-001eda64855cc97ed:~$ sudo -l
paris/i-001eda64855cc97ed 03:34
by SadServerslsof: unknown protocol name (5000) in: -i 5000 lsof 4.93.2 latest revision: https://github.com/lsof-org/lsof latest FAQ: https://github.com/lsof-org/lsof/blob/master/00FAQ latest (non-formatted) man page: https://github.com/lsof-org/lsof/blob/master/L usage: [-?abhKlnNoOPRtUvVX] [+|-c c] [+|-d s] [+D D] [+|-E] [+|-e s] [+|-f[gG]] [-F [f]] [-g [s]] [-i [i]] [+|-L [l]] [+m [m]] [+|-M] [-o [o]] [-p s] [+|-r [t]] [-s [p:s]] [-S [t]] [-T [t]] [-u s] [+|-w] [-x [fl]] [--] [names] Use the ``-h'' option to get more help information. admin@i-0dd9ca4bd7a358734:~$ ^Cof -i 5000 admin@i-0dd9ca4bd7a358734:~$ ps aux | grep upnp admin 828 0.0 0.1 5264 632 pts/1 S<+ 00:54 0:00 grep upnp admin@i-0dd9ca4bd7a358734:~$ systemctl | grep upnp admin@i-0dd9ca4bd7a358734:~$ journalctl | grep upnp admin@i-0dd9ca4bd7a358734:~$ lsof -i TLS
paris/i-0dd9ca4bd7a358734 04:34
by SadServersa.out agent webserver.py $ admin@i-072b43453825ba99a:~$ find / -perm -u=s -type f 2>/dev/null /usr/lib/openssh/ssh-keysign /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/bin/chsh /usr/bin/umount /usr/bin/mount /usr/bin/passwd /usr/bin/newgrp /usr/bin/sudo /usr/bin/chfn /usr/bin/su /usr/bin/gpasswd admin@i-072b43453825ba99a:~$ ./a.out /usr/bin/su
paris/i-072b43453825ba99a 03:20
by SadServersSaving to: ‘index.html’ index.html 100%[====================== 2023-12-18 12:29:59 (230 KB/s) - ‘index.html’ saved [12/12] admin@i-0e0c49ce0b601c9b4:~$ cat index.html Unauthorizedadmin@i-0e0c49ce0b601c9b4:~$ ss -tlnp State Recv-Q Send-Q LISTEN 0 128 LISTEN 0 128 LISTEN 0 4096 LISTEN 0 4096 LISTEN 0 128 admin@i-0e0c49ce0b601c9b4:~$ wget