command-line-murders/i-0d32d22f081218611
by SadServersMore by SadServers
drwx------ 5 root root 4096 Jan 25 19:49 root drwxr-xr-x 22 root root 620 Jan 25 19:49 run lrwxrwxrwx 1 root root 8 Sep 28 2021 sbin -> usr/sbin drwxr-xr-x 2 root root 4096 Sep 28 2021 srv dr-xr-xr-x 13 root root 0 Jan 25 19:48 sys drwxrwxrwt 9 root root 4096 Jan 25 19:49 tmp drwxr-xr-x 14 root root 4096 Sep 28 2021 usr drwxr-xr-x 11 root root 4096 Sep 28 2021 var admin@i-0f29e47a857c873d8:/$ ls opt admin@i-0f29e47a857c873d8:/$ ls run agetty.reload cloud-init dbus initramfs network sshblkid credentials dhclient.ens5.pid lock screen sshchrony crond.pid dhclient6.ens5.pid log sendsigs.omit.d sudchrony-dhcp crond.reboot initctl mount shm sysadmin@i-0f29e47a857c873d8:/$ cd run
paris/i-0f29e47a857c873d8 03:51
by SadServersopenat(AT_FDCWD, "/home/admin/webserver.py", O_RDONLY|O_CLOEXEC) = -1 EACCES (Pestat("/home/admin/webserver.py", {st_mode=S_IFREG|0770, st_size=360, ...}) = 0 readlink("/home/admin/webserver.py", 0x7ffcd0b15d90, 4096) = -1 EINVAL (Invalid lstat("/home", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 lstat("/home/admin", {st_mode=S_IFDIR|0755, st_size=4096, ...}) = 0 lstat("/home/admin/webserver.py", {st_mode=S_IFREG|0770, st_size=360, ...}) = 0 openat(AT_FDCWD, "/home/admin/webserver.py", O_RDONLY) = -1 EACCES (Permission dwrite(2, "python3: can't open file '/home/"..., 82python3: can't open file '/homrrno 13] Permission denied ) = 82 rt_sigaction(SIGINT, {sa_handler=SIG_DFL, sa_mask=[], sa_flags=SA_RESTORER, sa_r{sa_handler=0x6402c0, sa_mask=[], sa_flags=SA_RESTORER, sa_restorer=0x7f1915bdf1exit_group(2) = ? +++ exited with 2 +++ admin@i-0c85c5a418bb83a0e:/etc/systemd/system$ strace python3 /home/admin/webser
paris/i-0c85c5a418bb83a0e 02:08
by SadServersdrwxr-xr-x 2 admin root 4.0K Feb 9 15:03 data admin@i-01fc9903332152909:~$ admin@i-01fc9903332152909:~$ admin@i-01fc9903332152909:~$ more data *** data: directory *** admin@i-01fc9903332152909:~$ admin@i-01fc9903332152909:~$ admin@i-01fc9903332152909:~$ admin@i-01fc9903332152909:~$ admin@i-01fc9903332152909:~$ sudo chown admin:admin data admin@i-01fc9903332152909:~$ admin@i-01fc9903332152909:~$ admin@i-01fc9903332152909:~$