command-line-murders/i-0dd3c3e8e9cdcb7b5
by SadServersMore by SadServers
# The program is typically sudo, sudoers.so, sudoreplay or visudo. # # Subsystems vary based on the program; "all" matches all subsystems. # Priority may be crit, err, warn, notice, diag, info, trace or debug. # Multiple subsystem@priority may be specified, separated by a comma. # #Debug sudo /var/log/sudo_debug all@debug #Debug sudoers.so /var/log/sudoers_debug all@debug admin@i-020f08eb573cc1e85:~$ ls agent webserver.py admin@i-020f08eb573cc1e85:~$ cat /etc/sudo sudo.conf sudo_logsrvd.conf sudoers sudoers.d/ admin@i-020f08eb573cc1e85:~$ cat /etc/sudoers cat: /etc/sudoers: Permission denied admin@i-020f08eb573cc1e85:~$
paris/i-020f08eb573cc1e85 06:02
by SadServers0:00 grep webserver admin@i-0f52b9b9e90050f5c:~$ ls -la total 44 drwxr-xr-x 6 admin admin 4096 Sep 24 23:20 . drwxr-xr-x 3 root root 4096 Sep 17 16:44 .. drwx------ 3 admin admin 4096 Sep 20 15:52 .ansible -rw------- 1 admin admin 454 Oct 4 14:29 .bash_history -rw-r--r-- 1 admin admin 220 Aug 4 2021 .bash_logout -rw-r--r-- 1 admin admin 3526 Aug 4 2021 .bashrc drwxr-xr-x 3 admin admin 4096 Sep 20 15:56 .config -rw-r--r-- 1 admin admin 807 Aug 4 2021 .profile drwx------ 2 admin admin 4096 Sep 17 16:44 .ssh drwxr-xr-x 2 admin root 4096 Sep 24 23:20 agent -rwxrwx--- 1 root root 360 Sep 24 23:20 webserver.py admin@i-0f52b9b9e90050f5c:~$
paris/i-0f52b9b9e90050f5c 02:03
by SadServersadmin@i-01f767c66f7761ca5:~$ cd /home/admin/ admin@i-01f767c66f7761ca5:~$ ls agent data datafile kihei admin@i-01f767c66f7761ca5:~$ ./kihei panic: exit status 1 goroutine 1 [running]: main.main() ./main.go:64 +0x47d admin@i-01f767c66f7761ca5:~$ nano kihei admin@i-01f767c66f7761ca5:~$
kihei/i-01f767c66f7761ca5 00:30
by SadServersadmin@i-00d4fc0ce03bf426d:~$ ss -lt State Recv-Q Send-Q Local Address:Port Peer AdLISTEN 0 128 127.0.0.1:5000 0.LISTEN 0 128 0.0.0.0:ssh 0.LISTEN 0 4096 *:6767 LISTEN 0 4096 *:http-alt LISTEN 0 128 [::]:ssh admin@i-00d4fc0ce03bf426d:~$ curl localhost:5000 Unauthorizedadmin@i-00d4fc0ce03bf426d:~$ nc localhost 5000 GET / Welcome! Password is FDZPmh5AX3oiJt admin@i-00d4fc0ce03bf426d:~nc