command-line-murders/i-067653bae8b9ad6df
by SadServersMore by SadServers
-rw------- 1 admin admin 269 Jan 2 11:38 .bash_history -rw-r--r-- 1 admin admin 220 Aug 4 2021 .bash_logout -rw-r--r-- 1 admin admin 3526 Aug 4 2021 .bashrc drwxr-xr-x 3 admin admin 4096 Sep 20 2023 .config drwxr-xr-x 3 admin admin 4096 Jan 2 11:37 .local -rw-r--r-- 1 admin admin 807 Aug 4 2021 .profile drwx------ 2 admin admin 4096 Sep 17 2023 .ssh -rw-r--r-- 1 admin admin 1024 Jan 2 11:37 .webserver.py.swp drwxr-xr-x 2 admin root 4096 Sep 24 2023 agent -rwxrwx--- 1 root root 360 Sep 24 2023 webserver.py admin@i-0f995f369ab3b4d0d:~$ ls .config/ asciinema admin@i-0f995f369ab3b4d0d:~$ less .webserver.py.swp ".webserver.py.swp" may be a binary file. See it anyway? admin@i-0f995f369ab3b4d0d:~$ cat .bashr
paris/i-0f995f369ab3b4d0d 01:44
by SadServersty1 Ss+ 20:00 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux root 593 0.0 0.4 4396 2028 ttyS0 Ss+ 20:00 0:00 /sbin/agetty -o -p -- \u --keep-baud 115200,57 _chrony 595 0.0 0.7 10852 3716 ? S 20:00 0:00 /usr/sbin/chronyd -F 1 _chrony 596 0.0 0.1 10724 552 ? S 20:00 0:00 \_ /usr/sbin/chronyd -F 1 root 611 0.0 3.7 26612 17296 ? Ss 20:00 0:00 /usr/bin/python3 /usr/share/unattended-upgrade admin@i-020b6c81f12d03fba:~$ ca
paris/i-020b6c81f12d03fba 04:05
by SadServers-rwxrwx--- 1 root root 360 Sep 24 23:20 webserver.py admin@i-0dfc66e87222332a0:~$ sudo su We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. [sudo] password for admin: Sorry, try again. [sudo] password for admin: sudo: 1 incorrect password attempt admin@i-0dfc66e87222332a0:~$ ./
paris/i-0dfc66e87222332a0 06:02
by SadServersadmin@i-0eb97cd7b88e01b26:~$ ls agent webserver.py admin@i-0eb97cd7b88e01b26:~$ cd we bash: cd: we: No such file or directory admin@i-0eb97cd7b88e01b26:~$ ls agent/ check.sh sadagent sadagent.txt admin@i-0eb97cd7b88e01b26:~$ cd .. admin@i-0eb97cd7b88e01b26:/home$ ls