command-line-murders/i-0f236d6280e875300
by SadServersMore by SadServers
total 44 -rw-r--r-- 1 admin admin 807 Aug 4 2021 .profile -rw-r--r-- 1 admin admin 3526 Aug 4 2021 .bashrc -rw-r--r-- 1 admin admin 220 Aug 4 2021 .bash_logout drwxr-xr-x 3 root root 4096 Sep 17 2023 .. drwx------ 2 admin admin 4096 Sep 17 2023 .ssh drwx------ 3 admin admin 4096 Sep 20 2023 .ansible drwxr-xr-x 3 admin admin 4096 Sep 20 2023 .config -rwxrwx--- 1 root root 360 Sep 24 2023 webserver.py drwxr-xr-x 6 admin admin 4096 Sep 24 2023 . drwxr-xr-x 2 admin root 4096 Sep 24 2023 agent -rw------- 1 admin admin 641 Feb 5 20:33 .bash_history admin@i-03c39b2616f8de2c3:~$ cat /etc/sudoers cat: /etc/sudoers: Permission denied admin@i-03c39b2616f8de2c3:~$ cd /etc/ng
paris/i-03c39b2616f8de2c3 03:22
by SadServersortname=mixed,utf8,errors=remount-ro) admin@i-0c2273d796d05920a:~$ mount / mount: /: must be superuser to use mount. admin@i-0c2273d796d05920a:~$ tune2fs --help tune2fs 1.46.2 (28-Feb-2021) tune2fs: invalid option -- '-' Usage: tune2fs [-c max_mounts_count] [-e errors_behavior] [-f] [-g group] [-i interval[d|m|w]] [-j] [-J journal_options] [-l] [-m reserved_blocks_percent] [-o [^]mount_options[,...]] [-r reserved_blocks_count] [-u user] [-C mount_count] [-L volume_label] [-M last_mounted_dir] [-O [^]feature[,...]] [-Q quota_options] [-E extended-option[,...]] [-T last_check_time] [-U UUID] [-I new_inode_size] [-z undo_file] device admin@i-0c2273d796d05920a:~$ tune2fs /
kihei/i-0c2273d796d05920a 01:10
by SadServers(Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) admin@i-0b9f3cd0094de1d6e:~$ netstat -anlp|grep 172 (Not all processes could be identified, non-owned process info will not be shown, you would have to be root to see it all.) tcp 0 0 172.31.42.227:59464 172.31.21.181:9000 TIME_WAIT tcp 0 0 172.31.42.227:59462 172.31.21.181:9000 TIME_WAIT tcp 0 0 172.31.42.227:59460 172.31.21.181:9000 TIME_WAIT tcp6 0 0 172.31.42.227:8080 172.31.16.109:54422 ESTABLISHED admin@i-0b9f3cd0094de1d6e:~$ curl ^C admin@i-0b9f3cd0094de1d6e:~$ nmap -sV 172.31.21.181 -p 9000 Starting Nmap 7.80 ( https://nmap.org ) at 2023-10-01 16:08 UTC Note: Host seems down. If it is really up, but blocking our ping probes, try -PnNmap done: 1 IP address (0 hosts up) scanned in 4.87 seconds admin@i-0b9f3cd0094de1d6e:~$ ip a
taipei/i-0b9f3cd0094de1d6e 04:20
by SadServersadmin 686 0.0 0.9 6740 4540 pts/0 S<s+ 22:25 0:00 bash -l admin 690 0.8 4.1 98188 19416 pts/0 D<l+ 22:25 0:00 /usr/bin/pyth-t paris/i-07602503257110b80 -q -i 2 /var/log/cast/i-076025032571 admin 693 0.0 3.0 24456 14444 pts/0 R<+ 22:25 0:00 /usr/bin/pyth-t paris/i-07602503257110b80 -q -i 2 /var/log/cast/i-076025032571 admin 694 0.0 0.1 2480 512 pts/1 S<s 22:25 0:00 sh -c /bin/baadmin 695 0.0 0.9 6820 4460 pts/1 S< 22:25 0:00 /bin/bash admin 730 0.0 0.6 8648 3160 pts/1 R<+ 22:26 0:00 ps aux admin@i-07602503257110b80:~$ ps aux | grep nginx admin 732 0.0 0.1 5264 640 pts/1 S<+ 22:26 0:00 grep nginx admin@i-07602503257110b80:~$ ps aux | grep apache admin 734 0.0 0.1 5264 640 pts/1 S<+ 22:26 0:00 grep apache admin@i-07602503257110b80:~$ ls agent webserver.py admin@i-07602503257110b80:~$ cat webserver.py