SadServers Joined on September 10, 2023

iter,io.Writergo.itab.*os.fileStat,io/fs.FileInfogo.itab.*io.LimitedReader,io.Resergo.itab.*os/exec.ExitError,errorgo.itab.*os/exec.Error,errorgo.itab.*bufio.Reer.UnknownUserIdError,errorgo.itab.*internal/reflectlite.rtype,internal/reflectlzeError,errorgo.itab.*internal/fmtsort.SortedMap,sort.Interfacego.itab.runtime.ego_thread_start_cgo_notify_runtime_init_done_cgo_callers_cgo_yield_cgo_mmap_cgo_.mainPCgo.itab.*internal/poll.DeadlineExceededError,errorgo.itab.internal/poll.eefaultGOROOT.strruntime.buildVersion.strruntime.modinfo.strtype.*runtime.textsec193fc:~$ ^C                                                                     admin@i-0c924a99f49c193fc:~$ ls                                                 agent  data  datafile  kihei                                                    admin@i-0c924a99f49c193fc:~$ strings kihei | head                               bash: strings: command not found                                                admin@i-0c924a99f49c193fc:~$ string kihei | head                                bash: string: command not found                                                 admin@i-0c924a99f49c193fc:~$                                                    

agent  webserver.py                                                             admin@i-04dca6e1ae246a837:~$ curl localhost:5000                                Unauthorizedadmin@i-04dca6e1ae246a837:~$ history | grep sudo                        5  2025-03-28T01:12:44 sudo cat webserver.py                                    8  2025-03-28T01:14:06 history | grep sudo                                  admin@i-04dca6e1ae246a837:~$ sudo udo grep -r "password" /etc/                                                                                                  We trust you have received the usual lecture from the local System              Administrator. It usually boils down to these three things:                                                                                                         #1) Respect the privacy of others.                                              #2) Think before you type.                                                      #3) With great power comes great responsibility.                                                                                                            [sudo] password for admin:                                                      

> Accept: */*                                                                   > Authorization: Bearer aboba                                                   >                                                                               * Mark bundle as not supporting multiuse                                        < HTTP/1.1 200 OK                                                               < Server: Werkzeug/2.3.7 Python/3.9.2                                           < Date: Thu, 27 Mar 2025 22:19:25 GMT                                           < Content-Type: text/html; charset=utf-8                                        < Content-Length: 12                                                            < Connection: close                                                             <                                                                               * Closing connection 0                                                          Unauthorizedadmin@i-0d9acc064ebecf96a:~$ cat /etc/                              Display all 153 possibilities? (y or n)                                         admin@i-0d9acc064ebecf96a:~$                                                    

admin@i-0af8cfecbf1963f99:~$ ls -la                                             total 5245080                                                                   drwxr-xr-x 7 admin admin       4096 Mar 27 09:37 .                              drwxr-xr-x 3 root  root        4096 Sep 17  2023 ..                             drwx------ 3 admin admin       4096 Sep 17  2023 .ansible                       -rw-r--r-- 1 admin admin        220 Aug  4  2021 .bash_logout                   -rw-r--r-- 1 admin admin       3526 Aug  4  2021 .bashrc                        drwxr-xr-x 3 admin admin       4096 Mar 27 09:37 .config                        -rw-r--r-- 1 admin admin        807 Aug  4  2021 .profile                       drwx------ 2 admin admin       4096 Sep 17  2023 .ssh                           drwxr-xr-x 2 admin root        4096 Sep 17  2023 agent                          drwxr-xr-x 2 admin root        4096 Sep 17  2023 data                           -rw-r--r-- 1 root  root  5368709120 Sep 17  2023 datafile                       -rwxr-xr-x 1 admin root     2207109 Sep 17  2023 kihei                          admin@i-0af8cfecbf1963f99:~$ ./kihei                                            

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                "datafile"admin@i-0a311f3366ce1c9fd:~$                                          

Filesystem       Size  Used Avail Use% Mounted on                               udev             217M     0  217M   0% /dev                                     tmpfs             46M  368K   46M   1% /run                                     /dev/nvme0n1p1   7.7G  6.1G  1.2G  84% /                                        tmpfs            228M   12K  228M   1% /dev/shm                                 tmpfs            5.0M     0  5.0M   0% /run/lock                                /dev/nvme0n1p15  124M  5.9M  118M   5% /boot/efi                                admin@i-020a8bfbc440cf1e3:~$ lvdisplay                                            WARNING: Running as a non-root user. Functionality may be unavailable.          /run/lock/lvm/P_global:aux: open failed: Permission denied                    admin@i-020a8bfbc440cf1e3:~$ sudo su                                            root@i-020a8bfbc440cf1e3:/home/admin# lvdisplay                                 root@i-020a8bfbc440cf1e3:/home/admin# vgdisplay                                 root@i-020a8bfbc440cf1e3:/home/admin# pvdisplay                                 root@i-020a8bfbc440cf1e3:/home/admin#                                           

admin@i-0fca219bec61c9a82:~$ ll                                                 total 5245080                                                                   drwxr-xr-x 7 admin admin       4096 Mar 26 01:55 .                              drwxr-xr-x 3 root  root        4096 Sep 17  2023 ..                             drwx------ 3 admin admin       4096 Sep 17  2023 .ansible                       -rw-r--r-- 1 admin admin        220 Aug  4  2021 .bash_logout                   -rw-r--r-- 1 admin admin       3526 Aug  4  2021 .bashrc                        drwxr-xr-x 3 admin admin       4096 Mar 26 01:55 .config                        -rw-r--r-- 1 admin admin        807 Aug  4  2021 .profile                       drwx------ 2 admin admin       4096 Sep 17  2023 .ssh                           drwxr-xr-x 2 admin root        4096 Sep 17  2023 agent                          drwxr-xr-x 2 admin root        4096 Mar 26 01:58 data                           -rw-r--r-- 1 root  root  5368709120 Sep 17  2023 datafile                       -rwxr-xr-x 1 admin root     2207109 Sep 17  2023 kihei                          admin@i-0fca219bec61c9a82:~$ find                                               

                                                                                [sudo] password for admin:                                                      ^Csudo: 1 incorrect password attempt                                                                                                                            admin@i-01f7e0002fae3d63a:~$ cat /etc/ap                                        apache2/    apparmor/   apparmor.d/ apt/                                        admin@i-01f7e0002fae3d63a:~$ cat /etc/ap                                        apache2/    apparmor/   apparmor.d/ apt/                                        admin@i-01f7e0002fae3d63a:~$ cat /etc/apache2/conf-available/javascript-common.cAlias /javascript /usr/share/javascript/                                                                                                                        <Directory "/usr/share/javascript/">                                                    Options FollowSymLinks MultiViews                                       </Directory>                                                                    admin@i-01f7e0002fae3d63a:~$ cat /etc/apache2/conf-available/javascript-common.c

    <head>                                                                              <meta http-equiv="Content-Type" content="text/html;charset=utf-8">              <title>Error response</title>                                               </head>                                                                         <body>                                                                              <h1>Error response</h1>                                                         <p>Error code: 400</p>                                                          <p>Message: Bad request syntax ('/GET').</p>                                    <p>Error code explanation: HTTPStatus.BAD_REQUEST - Bad request syntax o    </body>                                                                     </html>                                                                         GET /                                                                           admin@i-05c58840f2cef0922:~$ nc localhost 5000                                  GET /                                                                                                                                                           

asciinema 680                    admin  mem       REG              259,1    4156.9/lib-dynload/_lzma.cpython-39-x86_64-linux-gnu.so                             asciinema 680                    admin  mem       REG              259,1    1951.9/lib-dynload/_queue.cpython-39-x86_64-linux-gnu.so                            asciinema 680                    admin  DEL       REG               0,23        asciinema 680                    admin  DEL       REG               0,23        asciinema 680                    admin  mem       REG              259,1    1994.9/lib-dynload/_multiprocessing.cpython-39-x86_64-linux-gnu.so                  asciinema 680                    admin  mem       REG              259,1    7468linux-gnu/libbz2.so.1.0.4                                                       asciinema 680                    admin  mem       REG              259,1    2835.9/lib-dynload/_bz2.cpython-39-x86_64-linux-gnu.so                              asciinema 680                    admin  mem       REG              259,1    2700linux-gnu/gconv/gconv-modules.cache                                             :                                                                               

total 44                                                                        -rw-r--r-- 1 admin admin  807 Aug  4  2021 .profile                             -rw-r--r-- 1 admin admin 3526 Aug  4  2021 .bashrc                              -rw-r--r-- 1 admin admin  220 Aug  4  2021 .bash_logout                         drwxr-xr-x 3 root  root  4096 Sep 17  2023 ..                                   drwx------ 2 admin admin 4096 Sep 17  2023 .ssh                                 drwx------ 3 admin admin 4096 Sep 20  2023 .ansible                             drwxr-xr-x 3 admin admin 4096 Sep 20  2023 .config                              -rwxrwx--- 1 root  root   360 Sep 24  2023 webserver.py                         drwxr-xr-x 6 admin admin 4096 Sep 24  2023 .                                    drwxr-xr-x 2 admin root  4096 Sep 24  2023 agent                                -rw------- 1 admin admin  365 Mar 22 18:19 .bash_history                        admin@i-07f4b9072767bd934:~$ cat webserver.py                                   cat: webserver.py: Permission denied                                            admin@i-07f4b9072767bd934:~$ sudo su - roo                                      

-rw-r--r-- 1 admin admin  807 Aug  4  2021 .profile                             drwx------ 2 admin admin 4.0K Sep 17  2023 .ssh                                 drwxr-xr-x 2 admin root  4.0K Sep 17  2023 agent                                drwxr-xr-x 2 admin root  4.0K Mar 22 16:09 data                                 -rw-r--r-- 1 root  root  5.0G Sep 17  2023 datafile                             -rwxr-xr-x 1 admin root  2.2M Sep 17  2023 kihei                                admin@i-00334b7c84d10e2d4:~$  lsblk -l                                          NAME       MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT                                  nvme0n1    259:0    0    8G  0 disk                                             nvme0n1p1  259:1    0  7.9G  0 part /                                           nvme0n1p14 259:2    0    3M  0 part                                             nvme0n1p15 259:3    0  124M  0 part /boot/efi                                   nvme2n1    259:4    0    1G  0 disk                                             nvme1n1    259:5    0    1G  0 disk                                             admin@i-00334b7c84d10e2d4:~$ pvcreate /dev/n                                    

Creating file /home/admin/data/newdatafile with size 1.5GB...                   panic: exit status 1                                                                                                                                            goroutine 1 [running]:                                                          main.main()                                                                             ./main.go:64 +0x47d                                                     admin@i-09404e48458866442:~$ df -h                                              Filesystem       Size  Used Avail Use% Mounted on                               udev             217M     0  217M   0% /dev                                     tmpfs             46M  368K   46M   1% /run                                     /dev/nvme0n1p1   7.7G  6.1G  1.2G  84% /                                        tmpfs            228M   12K  228M   1% /dev/shm                                 tmpfs            5.0M     0  5.0M   0% /run/lock                                /dev/nvme0n1p15  124M  5.9M  118M   5% /boot/efi                                admin@i-09404e48458866442:~$                                                    

udev               221828       0    221828   0% /dev                           tmpfs               46636     368     46268   1% /run                           /dev/nvme0n1p1    8026128 6354488   1242384  84% /                              tmpfs              233168      12    233156   1% /dev/shm                       tmpfs                5120       0      5120   0% /run/lock                      /dev/nvme0n1p15    126678    6016    120662   5% /boot/efi                      admin@i-0ed3208f72b7149da:~$ df -i                                              Filesystem      Inodes IUsed  IFree IUse% Mounted on                            udev             55457   307  55150    1% /dev                                  tmpfs            58292   441  57851    1% /run                                  /dev/nvme0n1p1  516096 32800 483296    7% /                                     tmpfs            58292     4  58288    1% /dev/shm                              tmpfs            58292     3  58289    1% /run/lock                             /dev/nvme0n1p15      0     0      0     - /boot/efi                             admin@i-0ed3208f72b7149da:~$