β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„β–„             β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„β–„      β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„  β–„β–„β–„β–„ β–„β–„β–„β–„     β–„ β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„ β–„    β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„       β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„          β–„β–„β–„β–„β–„β–„               β–„β–„β–„β–„β–„β–„ β–„ β–„β–„β–„β–„β–„β–„              β–„β–„β–„β–„β–„β–„β–„β–„                 β–„β–„β–„β–„  β–„β–„                  β–„β–„β–„ β–„β–„β–„β–„β–„                  β–„β–„β–„ β–„β–„                β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„                  β–„β–„ β–„            β–„β–„ β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„   β–„β–„ β–„      β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„                                β–„β–„β–„β–„ β–„β–„β–„β–„β–„  β–„β–„β–„β–„β–„                       β–„β–„β–„β–„β–„β–„     β–„β–„β–„β–„ β–„β–„β–„β–„   β–„β–„β–„β–„β–„                       β–„β–„β–„β–„β–„      β–„ β–„β–„ β–„β–„β–„β–„β–„  β–„β–„β–„β–„β–„        β–„β–„β–„β–„β–„β–„β–„        β–„β–„β–„β–„β–„     β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„  β–„β–„β–„β–„β–„β–„β–„      β–„β–„β–„β–„β–„β–„β–„      β–„β–„β–„β–„β–„β–„β–„   β–„β–„β–„β–„β–„   β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„        β–„          β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„  β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„                       β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„                         β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„            β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–€β–€β–„β–„β–„   β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„ β–„β–„β–„β–„β–„β–„β–„β–€β–€β–€β–€β–€β–€ β–€β–€β–€β–„β–„β–„β–„β–„      β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„  β–„β–„β–„β–„β–„β–„β–€β–€ β–€β–€β–€β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–„β–€β–€β–€ /---------------------------------------------------------------------------------\ | Do you like PEASS? | |---------------------------------------------------------------------------------| | Learn Cloud Hacking : https://training.hacktricks.xyz | | Follow on Twitter : @hacktricks_live | | Respect on HTB : SirBroccoli  | |---------------------------------------------------------------------------------| | Thank you!  | \---------------------------------------------------------------------------------/  LinPEAS-ng by carlospolop  ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission.  Linux Privesc Checklist: https://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist  LEGEND: RED/YELLOW: 95% a PE vector RED: You should take a look to it LightCyan: Users with console Blue: Users without console & mounted devs Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) LightMagenta: Your username Starting LinPEAS. Caching Writable Folders...  ╔═══════════════════╗ ═══════════════════════════════╣ Basic information ╠═══════════════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• OS: Linux version 4.19.88-v7+ (dom@buildbot) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1284 SMP Wed Dec 11 13:46:41 GMT 2019 User & Groups: uid=33(www-data) gid=33(www-data) groups=33(www-data) Hostname: raspberrypi203 [+] /bin/ping is available for network discovery (LinPEAS can discover hosts, learn more with -h) [+] /bin/bash is available for network discovery, port scanning and port forwarding (LinPEAS can discover hosts, scan ports, and forward ports. Learn more with -h) [+] /bin/nc is available for network discovery & port scanning (LinPEAS can discover hosts and scan ports, learn more with -h)  Caching directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . uniq: write error: Broken pipe DONE   ╔════════════════════╗ ══════════════════════════════╣ System Information ╠══════════════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• ╔══════════╣ Operative system β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#kernel-exploits Linux version 4.19.88-v7+ (dom@buildbot) (gcc version 4.9.3 (crosstool-NG crosstool-ng-1.22.0-88-g8460611)) #1284 SMP Wed Dec 11 13:46:41 GMT 2019 Distributor ID: Raspbian Description: Raspbian GNU/Linux 9.13 (stretch) Release: 9.13 Codename: stretch ╔══════════╣ Sudo version β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-version Sudo version 1.8.19p1 ╔══════════╣ PATH β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-path-abuses /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin ╔══════════╣ Date & uptime Sun Dec 29 14:29:18 JST 2024 14:29:18 up 160 days, 16:12, 0 users, load average: 0.60, 0.18, 0.06 ╔══════════╣ Unmounted file-system? β•š Check if you can mount umounted devices proc /proc proc defaults 0 0 /dev/mmcblk0p6 /boot vfat defaults 0 2 /dev/mmcblk0p7 / ext4 defaults,noatime 0 1 ╔══════════╣ Any sd*/disk* disk in /dev? (limit 20) disk ╔══════════╣ Environment β•š Any private information inside environment variables? APACHE_RUN_DIR=/var/run/apache2 APACHE_PID_FILE=/var/run/apache2/apache2.pid JOURNAL_STREAM=8:13371 PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin INVOCATION_ID=2f201c7f22514404b130bf1291db94ab APACHE_LOCK_DIR=/var/lock/apache2 LANG=C APACHE_RUN_USER=www-data APACHE_RUN_GROUP=www-data APACHE_LOG_DIR=/var/log/apache2 PWD=/var/www ╔══════════╣ Searching Signature verification failed in dmesg β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#dmesg-signature-verification-failed dmesg Not Found  ╔══════════╣ Executing Linux Exploit Suggester β•š https://github.com/mzet-/linux-exploit-suggester [+] [CVE-2022-32250] nft_object UAF (NFT_MSG_NEWSET) Details: https://research.nccgroup.com/2022/09/01/settlers-of-netlink-exploiting-a-limited-uaf-in-nf_tables-cve-2022-32250/ https://blog.theori.io/research/CVE-2022-32250-linux-kernel-lpe-2022/ Exposure: less probable Tags: ubuntu=(22.04){kernel:5.15.0-27-generic} Download URL: https://raw.githubusercontent.com/theori-io/CVE-2022-32250-exploit/main/exp.c Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN) [+] [CVE-2022-2586] nft_object UAF Details: https://www.openwall.com/lists/oss-security/2022/08/29/5 Exposure: less probable Tags: ubuntu=(20.04){kernel:5.12.13} Download URL: https://www.openwall.com/lists/oss-security/2022/08/29/5/1 Comments: kernel.unprivileged_userns_clone=1 required (to obtain CAP_NET_ADMIN) [+] [CVE-2021-27365] linux-iscsi Details: https://blog.grimm-co.com/2021/03/new-old-bugs-in-linux-kernel.html Exposure: less probable Tags: RHEL=8 Download URL: https://codeload.github.com/grimm-co/NotQuite0DayFriday/zip/trunk Comments: CONFIG_SLAB_FREELIST_HARDENED must not be enabled [+] [CVE-2021-22555] Netfilter heap out-of-bounds write Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html Exposure: less probable Tags: ubuntu=20.04{kernel:5.8.0-*} Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c Comments: ip_tables kernel module must be loaded [+] [CVE-2019-15666] XFRM_UAF Details: https://duasynt.com/blog/ubuntu-centos-redhat-privesc Exposure: less probable Download URL: Comments: CONFIG_USER_NS needs to be enabled; CONFIG_XFRM needs to be enabled ╔══════════╣ Protections ═╣ AppArmor enabled? .............. AppArmor Not Found ═╣ AppArmor profile? .............. unconfined ═╣ is linuxONE? ................... s390x Not Found ═╣ grsecurity present? ............ grsecurity Not Found ═╣ PaX bins present? .............. PaX Not Found ═╣ Execshield enabled? ............ Execshield Not Found ═╣ SELinux enabled? ............... sestatus Not Found ═╣ Seccomp enabled? ............... disabled ═╣ User namespace? ................ enabled ═╣ Cgroup2 enabled? ............... enabled ═╣ Is ASLR enabled? ............... Yes ═╣ Printer? ....................... No ═╣ Is this a virtual machine? ..... No  ╔═══════════╗ ═══════════════════════════════════╣ Container ╠═══════════════════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β• ╔══════════╣ Container related tools present (if any): ╔══════════╣ Container details ═╣ Is this a container? ........... No ═╣ Any running containers? ........ No   ╔═══════╗ ═════════════════════════════════════╣ Cloud ╠═════════════════════════════════════  β•šβ•β•β•β•β•β•β•β• Learn and practice cloud hacking techniques in training.hacktricks.xyz  ═╣ GCP Virtual Machine? ................. No ═╣ GCP Cloud Funtion? ................... No ═╣ AWS ECS? ............................. No ═╣ AWS EC2? ............................. No ═╣ AWS EC2 Beanstalk? ................... No ═╣ AWS Lambda? .......................... No ═╣ AWS Codebuild? ....................... No ═╣ DO Droplet? .......................... No ═╣ IBM Cloud VM? ........................ No ═╣ Azure VM? ............................ No ═╣ Azure APP? ........................... No ═╣ Aliyun ECS? .......................... No ═╣ Tencent CVM? ......................... No   ╔════════════════════════════════════════════════╗ ════════════════╣ Processes, Crons, Timers, Services and Sockets ╠════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• ╔══════════╣ Running processes (cleaned) β•š Check weird & unexpected proceses run by root: https://book.hacktricks.xyz/linux-hardening/privilege-escalation#processes root 1 0.0 0.4 28072 4204 ? Ss Jul21 26:35 /sbin/init root 101 0.1 1.0 35092 9792 ? Ss Jul21 284:59 /lib/systemd/systemd-journald root 135 0.0 0.2 14424 2588 ? Ss Jul21 0:43 /lib/systemd/systemd-udevd systemd+ 261 0.0 0.2 17268 2816 ? Ssl Jul21 0:54 /lib/systemd/systemd-timesyncd └─(Caps) 0x0000000002000000=cap_sys_time root 297 0.0 0.3 7404 3120 ? Ss Jul21 1:13 /lib/systemd/systemd-logind root 298 0.0 0.3 23884 2892 ? Ssl Jul21 55:11 /usr/sbin/rsyslogd -n message+ 299 0.0 0.2 6376 2772 ? Ss Jul21 1:07 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation └─(Caps) 0x0000000020000000=cap_audit_write root 304 0.0 0.2 9992 2768 ? Ss Jul21 1:52 /sbin/wpa_supplicant -u -s -O /run/wpa_supplicant avahi 321 0.0 0.0 6388 300 ? S Jul21 0:00 _ avahi-daemon: chroot helper root 312 0.0 0.2 4800 2360 ? Ss Jul21 1:11 /usr/sbin/cron -f nobody 318 0.0 0.2 5288 2156 ? Ss Jul21 2:22 /usr/sbin/thd --triggers /etc/triggerhappy/triggers.d/ --socket /run/thd.socket --user nobody --deviceglob /dev/input/event* root 392 0.0 0.1 2872 1720 ? Ss Jul21 0:53 /sbin/dhcpcd -q -w root 416 0.0 0.1 3440 1528 ? Ss+ Jul21 0:00 /sbin/agetty --keep-baud 115200,38400,9600 ttyAMA0 vt220 root 417 0.0 0.1 3664 1244 tty1 Ss+ Jul21 0:00 /sbin/agetty --noclear tty1 linux root 419 0.0 0.5 10200 5080 ? Ss Jul21 57:24 /usr/sbin/sshd -D root 421 0.0 2.0 119952 19748 ? Ss Jul21 14:43 /usr/sbin/apache2 -k start www-data 21594 0.0 1.0 120284 9584 ? S 06:25 0:00 _ /usr/sbin/apache2 -k start www-data 21595 0.0 1.0 120284 9592 ? S 06:25 0:00 _ /usr/sbin/apache2 -k start www-data 21596 0.0 1.0 120284 9628 ? S 06:25 0:00 _ /usr/sbin/apache2 -k start www-data 21597 0.0 1.0 120276 9604 ? S 06:25 0:00 _ /usr/sbin/apache2 -k start www-data 21598 0.0 1.0 120284 9784 ? S 06:25 0:00 _ /usr/sbin/apache2 -k start www-data 22271 0.0 1.0 120288 9664 ? S 06:33 0:00 _ /usr/sbin/apache2 -k start www-data 29383 0.0 1.0 120276 9552 ? S 08:46 0:00 _ /usr/sbin/apache2 -k start www-data 12749 0.0 0.0 1888 412 ? S 14:28 0:00 | _ sh -c ./linpeas.sh > enum_results.txt 2>&1 www-data 12750 0.5 0.1 2424 1724 ? S 14:28 0:00 | _ /bin/sh ./linpeas.sh www-data 15172 0.0 0.0 2424 636 ? S 14:29 0:00 | _ /bin/sh ./linpeas.sh www-data 15175 0.0 0.2 6204 2592 ? R 14:29 0:00 | | _ ps fauxwww www-data 15176 0.0 0.0 2424 636 ? S 14:29 0:00 | _ /bin/sh ./linpeas.sh www-data 5150 0.0 1.0 120288 9680 ? S 11:17 0:00 _ /usr/sbin/apache2 -k start root 422 0.0 0.5 26188 5204 ? Ss Jul21 32:45 /usr/sbin/nmbd root 429 0.0 1.3 54680 12968 ? Ss Jul21 117:46 /usr/sbin/smbd root 430 0.0 0.5 38188 5616 ? S Jul21 0:27 _ /usr/sbin/smbd root 431 0.0 0.5 38200 4992 ? S Jul21 11:49 _ /usr/sbin/smbd root 435 0.0 0.5 54668 5688 ? S Jul21 1:42 _ /usr/sbin/smbd root 3362 0.0 1.2 55048 12156 ? S 10:27 0:00 _ /usr/sbin/smbd ╔══════════╣ Processes with credentials in memory (root req) β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#credentials-from-process-memory gdm-password Not Found gnome-keyring-daemon Not Found lightdm Not Found vsftpd Not Found apache2 process found (dump creds from memory as root) sshd Not Found  ╔══════════╣ Processes whose PPID belongs to a different user (not root) β•š You will know if a user can somehow spawn processes as a different user Proc 261 with ppid 1 is run by user systemd-timesync but the ppid user is root Proc 299 with ppid 1 is run by user messagebus but the ppid user is root Proc 306 with ppid 1 is run by user avahi but the ppid user is root Proc 318 with ppid 1 is run by user nobody but the ppid user is root Proc 5150 with ppid 421 is run by user www-data but the ppid user is root Proc 21594 with ppid 421 is run by user www-data but the ppid user is root Proc 21595 with ppid 421 is run by user www-data but the ppid user is root Proc 21596 with ppid 421 is run by user www-data but the ppid user is root Proc 21597 with ppid 421 is run by user www-data but the ppid user is root Proc 21598 with ppid 421 is run by user www-data but the ppid user is root Proc 22271 with ppid 421 is run by user www-data but the ppid user is root Proc 29383 with ppid 421 is run by user www-data but the ppid user is root ╔══════════╣ Files opened by processes belonging to other users β•š This is usually empty because of the lack of privileges to read other user processes information  ╔══════════╣ Systemd PATH β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#systemd-path-relative-paths PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin ╔══════════╣ Cron jobs β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#scheduled-cron-jobs /usr/bin/crontab incrontab Not Found -rw-r--r-- 1 root root     722 Oct  7  2017 /etc/crontab  /etc/cron.d: total 16 drwxr-xr-x  2 root root 4096 Jan 15  2022 . drwxr-xr-x 87 root root 4096 Sep 11  2022 .. -rw-r--r--  1 root root  102 Oct  7  2017 .placeholder -rw-r--r--  1 root root  712 Jan  2  2017 php  /etc/cron.daily: total 48 drwxr-xr-x  2 root root 4096 Sep 11  2022 . drwxr-xr-x 87 root root 4096 Sep 11  2022 .. -rw-r--r--  1 root root  102 Oct  7  2017 .placeholder -rwxr-xr-x  1 root root  539 Nov  3  2018 apache2 -rwxr-xr-x  1 root root 1474 Sep 14  2017 apt-compat -rwxr-xr-x  1 root root  314 Apr 19  2017 aptitude -rwxr-xr-x  1 root root  355 Oct 25  2016 bsdmainutils -rwxr-xr-x  1 root root 1597 Jun 26  2018 dpkg -rwxr-xr-x  1 root root   89 May  6  2015 logrotate -rwxr-xr-x  1 root root 1065 Dec 13  2016 man-db -rwxr-xr-x  1 root root  249 May 17  2017 passwd -rwxr-xr-x  1 root root  383 Nov 21  2018 samba  /etc/cron.hourly: total 16 drwxr-xr-x  2 root root 4096 Jan 15  2022 . drwxr-xr-x 87 root root 4096 Sep 11  2022 .. -rw-r--r--  1 root root  102 Oct  7  2017 .placeholder -rwxr-xr-x  1 root root  191 Feb 22  2012 fake-hwclock  /etc/cron.monthly: total 12 drwxr-xr-x  2 root root 4096 Jan 15  2022 . drwxr-xr-x 87 root root 4096 Sep 11  2022 .. -rw-r--r--  1 root root  102 Oct  7  2017 .placeholder  /etc/cron.weekly: total 16 drwxr-xr-x  2 root root 4096 Jan 15  2022 . drwxr-xr-x 87 root root 4096 Sep 11  2022 .. -rw-r--r--  1 root root  102 Oct  7  2017 .placeholder -rwxr-xr-x  1 root root  723 Dec 13  2016 man-db SHELL=/bin/sh PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) ╔══════════╣ System timers β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#timers NEXT LEFT LAST PASSED UNIT ACTIVATES Sun 2024-12-29 14:39:00 JST 9min left Sun 2024-12-29 14:09:10 JST 20min ago phpsessionclean.timer phpsessionclean.service Sun 2024-12-29 15:20:21 JST 50min left Sun 2024-12-29 03:57:21 JST 10h ago apt-daily.timer apt-daily.service Sun 2024-12-29 23:16:31 JST 8h left Sat 2024-12-28 23:16:31 JST 15h ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service Mon 2024-12-30 06:59:43 JST 16h left Sun 2024-12-29 06:05:46 JST 8h ago apt-daily-upgrade.timer apt-daily-upgrade.service ╔══════════╣ Analyzing .timer files β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#timers  ╔══════════╣ Analyzing .service files β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#services /etc/systemd/system/halt.target.wants/rpi-display-backlight.service could be executing some relative path /etc/systemd/system/multi-user.target.wants/networking.service could be executing some relative path /etc/systemd/system/multi-user.target.wants/sshswitch.service could be executing some relative path /etc/systemd/system/network-online.target.wants/networking.service could be executing some relative path /etc/systemd/system/poweroff.target.wants/rpi-display-backlight.service could be executing some relative path /etc/systemd/system/reboot.target.wants/rpi-display-backlight.service could be executing some relative path You can't write on systemd PATH ╔══════════╣ Analyzing .socket files β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sockets /etc/systemd/system/sockets.target.wants/avahi-daemon.socket is calling this writable listener: /var/run/avahi-daemon/socket /lib/systemd/system/avahi-daemon.socket is calling this writable listener: /var/run/avahi-daemon/socket /lib/systemd/system/dbus.socket is calling this writable listener: /var/run/dbus/system_bus_socket /lib/systemd/system/sockets.target.wants/dbus.socket is calling this writable listener: /var/run/dbus/system_bus_socket /lib/systemd/system/sockets.target.wants/systemd-journald-dev-log.socket is calling this writable listener: /run/systemd/journal/dev-log /lib/systemd/system/sockets.target.wants/systemd-journald.socket is calling this writable listener: /run/systemd/journal/stdout /lib/systemd/system/sockets.target.wants/systemd-journald.socket is calling this writable listener: /run/systemd/journal/socket /lib/systemd/system/syslog.socket is calling this writable listener: /run/systemd/journal/syslog /lib/systemd/system/systemd-journald-dev-log.socket is calling this writable listener: /run/systemd/journal/dev-log /lib/systemd/system/systemd-journald.socket is calling this writable listener: /run/systemd/journal/stdout /lib/systemd/system/systemd-journald.socket is calling this writable listener: /run/systemd/journal/socket ╔══════════╣ Unix Sockets Listening β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sockets sed: -e expression #1, char 0: no previous regular expression /run/avahi-daemon/socket └─(Read Write) /run/dbus/system_bus_socket └─(Read Write) /run/dhcpcd.sock /run/dhcpcd.unpriv.sock └─(Read Write) /run/samba/nmbd/unexpected └─(Read Write) /run/systemd/cgroups-agent /run/systemd/fsck.progress /run/systemd/journal/dev-log └─(Read Write) /run/systemd/journal/socket └─(Read Write) /run/systemd/journal/stdout └─(Read Write) /run/systemd/journal/syslog └─(Read Write) /run/systemd/notify └─(Read Write) /run/systemd/private └─(Read Write) /run/thd.socket └─(Read Write) /run/udev/control /var/run/avahi-daemon/socket └─(Read Write) /var/run/dbus/system_bus_socket └─(Read Write) /var/run/dhcpcd.sock /var/run/dhcpcd.unpriv.sock └─(Read Write) /var/run/samba/nmbd/unexpected └─(Read Write) ╔══════════╣ D-Bus Service Objects list β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#d-bus NAME PID PROCESS USER CONNECTION UNIT SESSION DESCRIPTION :1.0 1 systemd root :1.0 init.scope - - :1.1 297 systemd-logind root :1.1 systemd-logind.service - - :1.17 17813 busctl www-data :1.17 apache2.service - - :1.2 306 avahi-daemon  avahi :1.2 avahi-daemon.service - - :1.3 304 wpa_supplicant root :1.3 wpa_supplicant.service - - fi.epitest.hostap.WPASupplicant 304 wpa_supplicant root :1.3 wpa_supplicant.service - - fi.w1.wpa_supplicant1 304 wpa_supplicant root :1.3 wpa_supplicant.service - - org.bluez - - - (activatable) - - org.freedesktop.Avahi 306 avahi-daemon  avahi :1.2 avahi-daemon.service - - org.freedesktop.DBus 299 dbus-daemon[0m messagebus org.freedesktop.DBus dbus.service - - org.freedesktop.PolicyKit1 - - - (activatable) - - org.freedesktop.hostname1 - - - (activatable) - - org.freedesktop.locale1 - - - (activatable) - - org.freedesktop.login1 297 systemd-logind root :1.1 systemd-logind.service - - org.freedesktop.network1 - - - (activatable) - - org.freedesktop.resolve1 - - - (activatable) - - org.freedesktop.systemd1 1 systemd root :1.0 init.scope - - org.freedesktop.timedate1 - - - (activatable) - - ╔══════════╣ D-Bus config files β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#d-bus Possible weak user policy found on /etc/dbus-1/system.d/avahi-dbus.conf ( ) Possible weak user policy found on /etc/dbus-1/system.d/avahi-dbus.conf ( ) Possible weak user policy found on /etc/dbus-1/system.d/bluetooth.conf ( ) Possible weak user policy found on /etc/dbus-1/system.d/org.freedesktop.network1.conf ( ) Possible weak user policy found on /etc/dbus-1/system.d/org.freedesktop.resolve1.conf ( ) Possible weak user policy found on /etc/dbus-1/system.d/wpa_supplicant.conf ( )  ╔═════════════════════╗ ══════════════════════════════╣ Network Information ╠══════════════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• ╔══════════╣ Interfaces default 0.0.0.0 loopback 127.0.0.0 link-local 169.254.0.0 eth0: flags=4163 mtu 1500 inet 192.168.1.203 netmask 255.255.255.0 broadcast 192.168.1.255 inet6 fe80::ac39:fbdc:cc03:b62e prefixlen 64 scopeid 0x20 ether b8:27:eb:58:70:fe txqueuelen 1000 (Ethernet) RX packets 61688341 bytes 7575299583 (7.0 GiB) RX errors 0 dropped 13885027 overruns 0 frame 0 TX packets 38049070 bytes 11071666861 (10.3 GiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 lo: flags=73 mtu 65536 inet 127.0.0.1 netmask 255.0.0.0 inet6 ::1 prefixlen 128 scopeid 0x10 loop txqueuelen 1000 (Local Loopback) RX packets 79389 bytes 4971432 (4.7 MiB) RX errors 0 dropped 0 overruns 0 frame 0 TX packets 79389 bytes 4971432 (4.7 MiB) TX errors 0 dropped 0 overruns 0 carrier 0 collisions 0 ╔══════════╣ Hostname, hosts and DNS raspberrypi203 127.0.0.1 localhost ::1 localhost ip6-localhost ip6-loopback ff02::1 ip6-allnodes ff02::2 ip6-allrouters 127.0.1.1 raspberrypi203 nameserver 192.168.1.1 ╔══════════╣ Active Ports β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-ports tcp 0 0 0.0.0.0:445 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:139 0.0.0.0:* LISTEN - tcp 0 0 0.0.0.0:22 0.0.0.0:* LISTEN - tcp6 0 0 :::445 :::* LISTEN - tcp6 0 0 :::139 :::* LISTEN - tcp6 0 0 :::80 :::* LISTEN - tcp6 0 0 :::22 :::* LISTEN - ╔══════════╣ Can I sniff with tcpdump? No   ╔═══════════════════╗ ═══════════════════════════════╣ Users Information ╠═══════════════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• ╔══════════╣ My user β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#users uid=33(www-data) gid=33(www-data) groups=33(www-data) ╔══════════╣ Do I have PGP keys? /usr/bin/gpg netpgpkeys Not Found netpgp Not Found  ╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid  ╔══════════╣ Checking sudo tokens β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#reusing-sudo-tokens ptrace protection is enabled () ╔══════════╣ Checking Pkexec policy β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe#pe-method-2  [Configuration] AdminIdentities=unix-user:0 ╔══════════╣ Superusers root:x:0:0:root:/root:/bin/bash ╔══════════╣ Users with console ok:x:1001:1001:,,,:/home/ok:/bin/bash root:x:0:0:root:/root:/bin/bash ╔══════════╣ All users & groups uid=0(root) gid=0(root) groups=0(root) uid=1(daemon[0m) gid=1(daemon[0m) groups=1(daemon[0m) uid=10(uucp) gid=10(uucp) groups=10(uucp) uid=100(systemd-timesync) gid=103(systemd-timesync) groups=103(systemd-timesync) uid=1001(ok) gid=1001(ok) groups=1001(ok),4(adm),20(dialout),24(cdrom),27(sudo),29(audio),44(video),46(plugdev),60(games),100(users),101(input),108(netdev),1000(pi),999(spi),998(i2c),997(gpio) uid=101(systemd-network) gid=104(systemd-network) groups=104(systemd-network) uid=102(systemd-resolve) gid=105(systemd-resolve) groups=105(systemd-resolve) uid=103(systemd-bus-proxy) gid=106(systemd-bus-proxy) groups=106(systemd-bus-proxy) uid=104(_apt) gid=65534(nogroup) groups=65534(nogroup) uid=105(messagebus) gid=109(messagebus) groups=109(messagebus) uid=106(statd) gid=65534(nogroup) groups=65534(nogroup) uid=107(sshd) gid=65534(nogroup) groups=65534(nogroup) uid=108(avahi) gid=112(avahi) groups=112(avahi) uid=13(proxy) gid=13(proxy) groups=13(proxy) uid=2(bin) gid=2(bin) groups=2(bin) uid=3(sys) gid=3(sys) groups=3(sys) uid=33(www-data) gid=33(www-data) groups=33(www-data) uid=34(backup) gid=34(backup) groups=34(backup) uid=38(list) gid=38(list) groups=38(list) uid=39(irc) gid=39(irc) groups=39(irc) uid=4(sync) gid=65534(nogroup) groups=65534(nogroup) uid=41(gnats) gid=41(gnats) groups=41(gnats) uid=5(games) gid=60(games) groups=60(games) uid=6(man) gid=12(man) groups=12(man) uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup) uid=7(lp) gid=7(lp) groups=7(lp) uid=8(mail) gid=8(mail) groups=8(mail) uid=9(news) gid=9(news) groups=9(news) ╔══════════╣ Login now  14:29:58 up 160 days, 16:12, 0 users, load average: 0.91, 0.31, 0.11 USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT ╔══════════╣ Last logons  wtmp begins Sun Dec 1 06:25:03 2024 ╔══════════╣ Last time logon each user Username Port From Latest ok pts/0 192.168.1.108 Mon Jul 22 19:01:35 +0900 2024 ╔══════════╣ Do not forget to test 'su' as any other user with shell: without password and with their names as password (I don't do it in FAST mode...)  ╔══════════╣ Do not forget to execute 'sudo -l' without password or with valid password (if you know it)!!    ╔══════════════════════╗ ═════════════════════════════╣ Software Information ╠═════════════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• ╔══════════╣ Useful software /usr/bin/base64 /usr/bin/curl /usr/bin/g++ /usr/bin/gcc /usr/bin/gdb /usr/bin/lua /usr/bin/make /bin/nc /bin/nc.traditional /bin/netcat /usr/bin/perl /usr/bin/php /bin/ping /usr/bin/python /usr/bin/python2 /usr/bin/python2.7 /usr/bin/python3 /usr/bin/sudo /usr/bin/wget ╔══════════╣ Installed Compilers ii device-tree-compiler 1.4.4-1 armhf Device Tree Compiler for Flat Device Trees ii g++ 4:6.3.0-4 armhf GNU C++ compiler ii g++-6 6.3.0-18+rpi1+deb9u1 armhf GNU C++ compiler ii gcc 4:6.3.0-4 armhf GNU C compiler ii gcc-6 6.3.0-18+rpi1+deb9u1 armhf GNU C compiler ii luajit 2.0.4+dfsg-1+deb9u1 armhf Just in time compiler for Lua programming language version 5.1 /usr/bin/gcc ╔══════════╣ Analyzing Apache-Nginx Files (limit 70) Apache version: Server version: Apache/2.4.25 (Raspbian) Server built: 2022-03-18T12:54:25 httpd Not Found  Nginx version: nginx Not Found  /etc/apache2/mods-available/php7.0.conf- /etc/apache2/mods-available/php7.0.conf: SetHandler application/x-httpd-php -- /etc/apache2/mods-available/php7.0.conf- /etc/apache2/mods-available/php7.0.conf: SetHandler application/x-httpd-php-source -- /etc/apache2/apache2.conf- /etc/apache2/apache2.conf:#AddType application/x-httpd-php .php .html /etc/apache2/apache2.conf:AddHandler application/x-httpd-php .php .html .htm -- /etc/apache2/mods-enabled/php7.0.conf- /etc/apache2/mods-enabled/php7.0.conf: SetHandler application/x-httpd-php -- /etc/apache2/mods-enabled/php7.0.conf- /etc/apache2/mods-enabled/php7.0.conf: SetHandler application/x-httpd-php-source ══╣ PHP exec extensions drwxr-xr-x 2 root root 4096 Dec 17 2018 /etc/apache2/sites-enabled drwxr-xr-x 2 root root 4096 Dec 17 2018 /etc/apache2/sites-enabled lrwxrwxrwx 1 root root 35 Dec 17 2018 /etc/apache2/sites-enabled/000-default.conf -> ../sites-available/000-default.conf ServerAdmin webmaster@localhost DocumentRoot /var/www ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined AddHandler php7.0-script .html -rw-r--r-- 1 root root 1409 Dec 23 2018 /etc/apache2/sites-available/000-default.conf ServerAdmin webmaster@localhost DocumentRoot /var/www ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined AddHandler php7.0-script .html lrwxrwxrwx 1 root root 35 Dec 17 2018 /etc/apache2/sites-enabled/000-default.conf -> ../sites-available/000-default.conf ServerAdmin webmaster@localhost DocumentRoot /var/www ErrorLog ${APACHE_LOG_DIR}/error.log CustomLog ${APACHE_LOG_DIR}/access.log combined AddHandler php7.0-script .html -rw-r--r-- 1 root root 71537 Oct 25 2019 /etc/php/7.0/apache2/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On ibase.allow_persistent = 1 mysqli.allow_persistent = On pgsql.allow_persistent = On -rw-r--r-- 1 root root 71194 Oct 25 2019 /etc/php/7.0/cli/php.ini allow_url_fopen = On allow_url_include = Off odbc.allow_persistent = On ibase.allow_persistent = 1 mysqli.allow_persistent = On pgsql.allow_persistent = On ╔══════════╣ Searching AD cached hashes -rw------- 1 root root 430080 Dec 22 2018 /var/lib/samba/private/secrets.tdb ╔══════════╣ Analyzing Rsync Files (limit 70) -rw-r--r-- 1 root root 1044 Dec 10 2017 /usr/share/doc/rsync/examples/rsyncd.conf [ftp] comment = public archive path = /var/www/pub use chroot = yes lock file = /var/lock/rsyncd read only = yes list = yes uid = nobody gid = nogroup strict modes = yes ignore errors = no ignore nonreadable = yes transfer logging = no timeout = 600 refuse options = checksum dry-run dont compress = *.gz *.tgz *.zip *.z *.rpm *.deb *.iso *.bz2 *.tbz ╔══════════╣ Analyzing PAM Auth Files (limit 70) drwxr-xr-x 2 root root 4096 Sep 11 2022 /etc/pam.d -rw-r--r-- 1 root root 2133 Aug 21 2018 /etc/pam.d/sshd account required pam_nologin.so session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so close session required pam_loginuid.so session optional pam_keyinit.so force revoke session optional pam_motd.so motd=/run/motd.dynamic session optional pam_motd.so noupdate session optional pam_mail.so standard noenv # [1] session required pam_limits.so session required pam_env.so # [1] session required pam_env.so user_readenv=1 envfile=/etc/default/locale session [success=ok ignore=ignore module_unknown=ignore default=bad] pam_selinux.so open ╔══════════╣ Analyzing Ldap Files (limit 70) The password hash is from the {SSHA} to 'structural' drwxr-xr-x 2 root root 4096 Mar 6 2021 /etc/ldap ╔══════════╣ Analyzing Keyring Files (limit 70) drwxr-xr-x 2 root root 4096 Nov 13 2018 /usr/share/keyrings ╔══════════╣ Analyzing Postfix Files (limit 70) -rw-r--r-- 1 root root 694 Apr 12 2016 /usr/share/bash-completion/completions/postfix ╔══════════╣ Analyzing FTP Files (limit 70)  -rw-r--r-- 1 root root 69 Dec 7 2018 /etc/php/7.0/mods-available/ftp.ini -rw-r--r-- 1 root root 69 Oct 27 2021 /usr/share/php7.0-common/common/ftp.ini ╔══════════╣ Analyzing Samba Files (limit 70) smbstatus only works as root! -rw-r--r-- 1 root root 9627 Jul 23 2021 /etc/samba/smb.conf ; logon script = logon.cmd read only = no create mask = 0700 ; create mask = 0664 directory mask = 0700 ; directory mask = 0775 ; guest ok = yes ; # The path below should be writable by all users so that their ; ; ; create mask = 0600 ; directory mask = 0700 create mask = 0700 browseable = yes ; read only = no read only = no guest ok = yes create mask = 0775 directory mask = 0775 -rw-r--r-- 1 root root 9231 May 28 2021 /usr/share/samba/smb.conf ; logon script = logon.cmd create mask = 0700 directory mask = 0700 ; guest ok = yes ; # The path below should be writable by all users so that their ; ; ; create mask = 0600 ; directory mask = 0700 create mask = 0700 browseable = yes ╔══════════╣ Analyzing Other Interesting Files (limit 70) -rw-r--r-- 1 root root 3523 Nov 13 2018 /etc/skel/.bashrc -rw-r--r-- 1 ok ok 3523 Dec 17 2018 /home/ok/.bashrc -rw-r--r-- 1 root root 675 May 16 2017 /etc/skel/.profile -rw-r--r-- 1 ok ok 675 Dec 17 2018 /home/ok/.profile ╔══════════╣ Searching kerberos conf files and tickets β•š http://book.hacktricks.xyz/linux-hardening/privilege-escalation/linux-active-directory ptrace protection is enabled (), you need to disable it to search for tickets inside processes memory -rw-r--r-- 1 root root 89 Aug 11 2016 /usr/share/samba/setup/krb5.conf [libdefaults] default_realm = ${REALM} dns_lookup_realm = false dns_lookup_kdc = true tickets kerberos Not Found klist Not Found  ╔══════════╣ Analyzing PGP-GPG Files (limit 70) /usr/bin/gpg netpgpkeys Not Found netpgp Not Found  -rw-r--r-- 1 root root 2416 Nov 13 2018 /etc/apt/trusted.gpg -rw-r--r-- 1 root root 3452 Feb 8 2019 /usr/share/gnupg/distsigkey.gpg -rw-r--r-- 1 root root 1233 May 29 2012 /usr/share/keyrings/raspbian-archive-keyring.gpg ╔══════════╣ Searching uncommon passwd files (splunk) passwd file: /etc/pam.d/passwd passwd file: /etc/passwd passwd file: /usr/share/bash-completion/completions/passwd passwd file: /usr/share/lintian/overrides/passwd ╔══════════╣ Searching ssl/ssh files ╔══════════╣ Analyzing SSH Files (limit 70)  -rw-r--r-- 1 root root 606 Nov 13 2018 /etc/ssh/ssh_host_dsa_key.pub -rw-r--r-- 1 root root 178 Nov 13 2018 /etc/ssh/ssh_host_ecdsa_key.pub -rw-r--r-- 1 root root 98 Nov 13 2018 /etc/ssh/ssh_host_ed25519_key.pub -rw-r--r-- 1 root root 398 Nov 13 2018 /etc/ssh/ssh_host_rsa_key.pub ChallengeResponseAuthentication no UsePAM yes ══╣ Some certificates were found (out limited): /etc/ssl/certs/ACCVRAIZ1.pem /etc/ssl/certs/AC_RAIZ_FNMT-RCM.pem /etc/ssl/certs/Actalis_Authentication_Root_CA.pem /etc/ssl/certs/AffirmTrust_Commercial.pem /etc/ssl/certs/AffirmTrust_Networking.pem /etc/ssl/certs/AffirmTrust_Premium.pem /etc/ssl/certs/AffirmTrust_Premium_ECC.pem /etc/ssl/certs/Amazon_Root_CA_1.pem /etc/ssl/certs/Amazon_Root_CA_2.pem /etc/ssl/certs/Amazon_Root_CA_3.pem /etc/ssl/certs/Amazon_Root_CA_4.pem /etc/ssl/certs/Atos_TrustedRoot_2011.pem /etc/ssl/certs/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem /etc/ssl/certs/Baltimore_CyberTrust_Root.pem /etc/ssl/certs/Buypass_Class_2_Root_CA.pem /etc/ssl/certs/Buypass_Class_3_Root_CA.pem /etc/ssl/certs/CA_Disig_Root_R2.pem /etc/ssl/certs/CFCA_EV_ROOT.pem /etc/ssl/certs/COMODO_Certification_Authority.pem /etc/ssl/certs/COMODO_ECC_Certification_Authority.pem 12750PSTORAGE_CERTSBIN ══╣ Some home ssh config file was found /usr/share/openssh/sshd_config ChallengeResponseAuthentication no UsePAM yes X11Forwarding yes PrintMotd no AcceptEnv LANG LC_* Subsystem sftp /usr/lib/openssh/sftp-server ══╣ /etc/hosts.allow file found, trying to read the rules: /etc/hosts.allow Searching inside /etc/ssh/ssh_config for interesting info Host * SendEnv LANG LC_* HashKnownHosts yes GSSAPIAuthentication yes  ╔════════════════════════════════════╗ ══════════════════════╣ Files with Interesting Permissions ╠══════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• ╔══════════╣ SUID - Check easy privesc, exploits and write perms β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid -rwsr-xr-- 1 root messagebus 34K Jul 3 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper -rwsr-xr-x 1 root root 14K Jan 14 2022 /usr/lib/policykit-1/polkit-agent-helper-1 -rwsr-xr-x 1 root root 430K Jul 15 2019 /usr/lib/openssh/ssh-keysign -rwsr-xr-x 1 root root 31K Mar 17 2021 /usr/bin/newgrp ---> HP-UX_10.20 -rwsr-xr-x 1 root root 18K Jan 14 2022 /usr/bin/pkexec ---> Linux4.10_to_5.1.17(CVE-2019-13272)/rhel_6(CVE-2011-1485)/Generic_CVE-2021-4034 -rwsr-xr-x 1 root root 45K Mar 17 2021 /usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997) -rwsr-xr-x 1 root root 31K Mar 17 2021 /usr/bin/chsh -rwsr-xr-x 1 root root 57K Mar 17 2021 /usr/bin/gpasswd -rwsr-xr-x 1 root root 40K Mar 17 2021 /usr/bin/chfn ---> SuSE_9.3/10 -rwsr-xr-x 1 root root 133K Jan 23 2021 /usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable -rwsr-xr-x 1 root root 35K Mar 8 2018 /bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8 -rwsr-xr-x 1 root root 31K Mar 17 2021 /bin/su -rwsr-xr-x 1 root root 55K Nov 10 2016 /bin/ping -rwsr-xr-x 1 root root 22K Mar 8 2018 /bin/umount ---> BSD/Linux(08-1996) -rwsr-xr-x 1 root root 34K May 16 2022 /sbin/mount.cifs -rwsr-xr-x 1 root root 87K Jun 24 2020 /sbin/mount.nfs ╔══════════╣ SGID β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid -rwxr-sr-x 1 root tty 22K Mar 8 2018 /usr/bin/wall -rwxr-sr-x 1 root shadow 53K Mar 17 2021 /usr/bin/chage -rwxr-sr-x 1 root ssh 366K Jul 15 2019 /usr/bin/ssh-agent -rwxr-sr-x 1 root crontab 31K Oct 30 2021 /usr/bin/crontab -rwxr-sr-x 1 root tty 9.7K Apr 12 2017 /usr/bin/bsd-write -rwxr-sr-x 1 root shadow 18K Mar 17 2021 /usr/bin/expiry -rwxr-sr-x 1 root shadow 30K Jun 13 2017 /sbin/unix_chkpwd ╔══════════╣ Files with ACLs (limited to 50) β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#acls files with acls in searched folders Not Found  ╔══════════╣ Capabilities β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities ══╣ Current shell capabilities CapInh: 0x0000000000000000= CapPrm: 0x0000000000000000= CapEff: 0x0000000000000000= CapBnd: 0x0000003fffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read CapAmb: 0x0000000000000000= β•š Parent process capabilities CapInh: 0x0000000000000000= CapPrm: 0x0000000000000000= CapEff: 0x0000000000000000= CapBnd: 0x0000003fffffffff=cap_chown,cap_dac_override,cap_dac_read_search,cap_fowner,cap_fsetid,cap_kill,cap_setgid,cap_setuid,cap_setpcap,cap_linux_immutable,cap_net_bind_service,cap_net_broadcast,cap_net_admin,cap_net_raw,cap_ipc_lock,cap_ipc_owner,cap_sys_module,cap_sys_rawio,cap_sys_chroot,cap_sys_ptrace,cap_sys_pacct,cap_sys_admin,cap_sys_boot,cap_sys_nice,cap_sys_resource,cap_sys_time,cap_sys_tty_config,cap_mknod,cap_lease,cap_audit_write,cap_audit_control,cap_setfcap,cap_mac_override,cap_mac_admin,cap_syslog,cap_wake_alarm,cap_block_suspend,cap_audit_read CapAmb: 0x0000000000000000= Files with capabilities (limited to 50): ╔══════════╣ Checking misconfigurations of ld.so β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#ld.so /etc/ld.so.conf Content of /etc/ld.so.conf: include /etc/ld.so.conf.d/*.conf /etc/ld.so.conf.d  /etc/ld.so.conf.d/00-vmcs.conf  - /opt/vc/lib  /etc/ld.so.conf.d/arm-linux-gnueabihf.conf  - /lib/arm-linux-gnueabihf  - /usr/lib/arm-linux-gnueabihf  /etc/ld.so.conf.d/fakeroot-arm-linux-gnueabihf.conf  - /usr/lib/arm-linux-gnueabihf/libfakeroot  /etc/ld.so.conf.d/libc.conf  - /usr/local/lib /etc/ld.so.preload /usr/lib/arm-linux-gnueabihf/libarmmem.so ╔══════════╣ Files (scripts) in /etc/profile.d/ β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#profiles-files total 24 drwxr-xr-x 2 root root 4096 Dec 17 2018 . drwxr-xr-x 87 root root 4096 Sep 11 2022 .. -rw-r--r-- 1 root root 101 Nov 26 2018 at-dbus-fix.sh -rw-r--r-- 1 root root 663 Apr 12 2016 bash_completion.sh -rw-r--r-- 1 root root 324 Jun 13 2017 sshpwd.sh -rw-r--r-- 1 root root 473 Mar 12 2018 wifi-country.sh ╔══════════╣ Permissions in init, init.d, systemd, and rc.d β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#init-init-d-systemd-and-rc-d  ═╣ Hashes inside passwd file? ........... No ═╣ Writable passwd file? ................ No ═╣ Credentials in fstab/mtab? ........... No ═╣ Can I read shadow files? ............. No ═╣ Can I read shadow plists? ............ No ═╣ Can I write shadow plists? ........... No ═╣ Can I read opasswd file? ............. No ═╣ Can I write in network-scripts? ...... No ═╣ Can I read root folder? .............. No  ╔══════════╣ Searching root files in home dirs (limit 30) /home/ /root/ /var/www /var/www/html_bad /var/www/html_bad/index.html /var/www/html_bad/lab_of_time/0100_calender/.htaccess /var/www/html_asof_20240721a /var/www/html_asof_20240721a/lab_of_PC /var/www/html_asof_20240721a/lab_of_PC/0100_edit_movie /var/www/html_asof_20240721a/lab_of_PC/0100_edit_movie/0100_edit_movie.html60 /var/www/html_asof_20240721a/lab_of_PC/0100_edit_movie/Fotos.exe /var/www/html_asof_20240721a/lab_of_PC/System.exe /var/www/html_asof_20240721a/qualification /var/www/html_asof_20240721a/qualification/000_index_gualification.html /var/www/html_asof_20240721a/qualification/IPA-Common /var/www/html_asof_20240721a/qualification/IPA-Common/Disco.exe /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2015h27h_koudo_am1_ans.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2014h26h_koudo_am1_ans.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2015h27a_koudo_am1_ans.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2015h27h_koudo_am1_qs.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2015h27a_koudo_am1_qs.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2014h26a_koudo_am1_ans.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2017h29h_koudo_am1_qs.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2014h26h_koudo_am1_qs.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2016h28a_koudo_am1_ans.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2013h25a_koudo_am1_qs.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2013h25a_koudo_am1_ans.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2013h25h_koudo_am1_ans.pdf /var/www/html_asof_20240721a/qualification/IPA-Common/IPA-AMI_org/2014h26a_koudo_am1_qs.pdf ╔══════════╣ Searching folders owned by me containing others files on it (limit 100)  ╔══════════╣ Readable files belonging to root and readable by me but not world readable  ╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 200) β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files awk: write failure (Broken pipe) awk: close failed on file /dev/stdout (Broken pipe) /dev/mqueue /dev/shm /run/lock /run/lock/apache2 /tmp /tmp/phpbhCkKg /var/cache/apache2/mod_cache_disk /var/lib/php/sessions /var/spool/samba /var/tmp /var/www /var/www/.gnupg /var/www/.gnupg/private-keys-v1.d /var/www/.gnupg/pubring.kbx /var/www/.gnupg/trustdb.gpg /var/www/.wget-hsts /var/www/enum_results.txt /var/www/html_bad/$010_Hidemaru.lnk /var/www/html_bad/CG /var/www/html_bad/CG/000_launch_tokyo_twr_2016109 /var/www/html_bad/CG/000_launch_tokyo_twr_2016109/img /var/www/html_bad/CG/000_launch_tokyo_twr_2016109/launch.html /var/www/html_bad/CG/010_launch_mt_fuji_20160111 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img /var/www/html_bad/CG/010_launch_mt_fuji_20160111/launch_20160111.html /var/www/html_bad/CSS /var/www/html_bad/CSS/default_style.based_on_pukiukiplus.css.chekyshka /var/www/html_bad/CSS/default_style.css.chekyshka /var/www/html_bad/counter.dat /var/www/html_bad/counter.php.chekyshka /var/www/html_bad/footer.html /var/www/html_bad/header.html /var/www/html_bad/header_style.css.chekyshka #)You_can_write_even_more_files_inside_last_directory  /var/www/html_bad/history/history_of_this_pc.html60 /var/www/html_bad/index.html /var/www/html_bad/lab_of_PC /var/www/html_bad/lab_of_PC/0100_edit_movie /var/www/html_bad/lab_of_PC/0100_edit_movie/0100_edit_movie.html60 /var/www/html_bad/lab_of_leather_craft /var/www/html_bad/lab_of_leather_craft/default_style.css.chekyshka /var/www/html_bad/lab_of_leather_craft/drawings /var/www/html_bad/lab_of_leather_craft/drawings/001_BookCoverεž‹η΄™(A6ζ–‡εΊ«ζœ¬οΌ†ζ–°ζ›Έ).pdf.chekyshka /var/www/html_bad/lab_of_leather_craft/drawings/002_BookCoverεž‹η΄™(A5).pdf.chekyshka /var/www/html_bad/lab_of_leather_craft/leather_craft_001_bookcovers /var/www/html_bad/lab_of_leather_craft/leather_craft_001_bookcovers/leather_craft_001_bookcovers.html /var/www/html_bad/lab_of_space /var/www/html_bad/lab_of_space/0100_pref_nickname /var/www/html_bad/lab_of_space/0100_pref_nickname/default_style.css.chekyshka /var/www/html_bad/lab_of_space/0100_pref_nickname/pref_nickname.html /var/www/html_bad/lab_of_space/0100_pref_nickname/table_pref_nickname.txt120 /var/www/html_bad/lab_of_time /var/www/html_bad/lab_of_time/0100_calender /var/www/html_bad/lab_of_time/0100_calender/.htaccess /var/www/html_bad/lab_of_time/0100_calender/calender.html /var/www/html_bad/lab_of_time/0100_calender/default_style.css.chekyshka /var/www/html_bad/lab_of_time/0100_calender/year_table.txt120 /var/www/html_bad/lab_of_time/0200_unhappy_person_event_log /var/www/html_bad/lab_of_time/0200_unhappy_person_event_log/unhappy_person_event_log.html60 /var/www/html_bad/lab_of_time/0300_diary_reuse /var/www/html_bad/lab_of_time/0300_diary_reuse/diary_reuse.html /var/www/html_bad/lab_of_time/0500_24sekki /var/www/html_bad/lab_of_time/0500_24sekki/24sekki.html /var/www/html_bad/lab_of_time/0500_24sekki/24sekki.txt.chekyshka /var/www/html_bad/lab_of_time/0500_24sekki/v0.1 /var/www/html_bad/lab_of_time/0500_24sekki/v0.1/24sekki_v01.html /var/www/html_bad/lab_of_time/0500_24sekki/v0.1/24sekki_v01.txt.chekyshka /var/www/html_bad/lab_of_time/0500_24sekki/v0.2 /var/www/html_bad/lab_of_time/0500_24sekki/v0.2/24sekki.html /var/www/html_bad/lab_of_time/0500_24sekki/v0.2/24sekki.txt.chekyshka /var/www/html_bad/lab_of_time/0600_name_of_month /var/www/html_bad/lab_of_time/0600_name_of_month/bak /var/www/html_bad/lab_of_time/0600_name_of_month/bak/name_of_month - v05.html /var/www/html_bad/lab_of_time/0600_name_of_month/default_style.css.chekyshka /var/www/html_bad/lab_of_time/0600_name_of_month/name_of_month.html /var/www/html_bad/lab_of_time/0600_name_of_month/table01_name_of_month.txt120 /var/www/html_bad/lab_of_time/0600_name_of_month/table02_name_of_month_jp.txt120 /var/www/html_bad/lab_of_time/0700_biz_calender /var/www/html_bad/lab_of_time/0700_biz_calender/biz_calender.html /var/www/html_bad/lab_of_time/0700_biz_calender/default_style.css.chekyshka /var/www/html_bad/lab_of_time/0700_biz_calender/year_table.txt120 /var/www/html_bad/my_essay /var/www/html_bad/my_essay/creation_001_size_of_wire-net /var/www/html_bad/my_essay/creation_001_size_of_wire-net/creation_001_size_of_wire-net.html60 /var/www/html_bad/my_essay/default_style.css.chekyshka /var/www/html_bad/my_essay/gadget_001_NW-walkman-Z.0 /var/www/html_bad/my_essay/gadget_001_NW-walkman-Z.0/gadget_010_NW-walkman-Z.html60 /var/www/html_bad/my_essay/gadget_002.0 /var/www/html_bad/my_essay/gadget_002.0/gadget_020_activity_meter.html60 /var/www/html_bad/my_essay/gadget_003_ASUS_Nexus7_2013 /var/www/html_bad/my_essay/gadget_003_ASUS_Nexus7_2013/gadget_003_ASUS_Nexus7_2013.html60 /var/www/html_bad/my_essay/gadget_004_marcket_price.0 /var/www/html_bad/my_essay/gadget_004_marcket_price.0/gadget_004_market_price.html /var/www/html_bad/my_essay/gadget_004_marcket_price.0/old /var/www/html_bad/my_essay/gadget_004_marcket_price.0/old/gadget_004_market_price_3.html /var/www/html_bad/my_essay/gadget_005_Sumsung_SM951 /var/www/html_bad/my_essay/gadget_005_Sumsung_SM951/gadget_Sumsung_SM951.html60 /var/www/html_bad/my_essay/gadget_006_PQI_Air_Pen /var/www/html_bad/my_essay/gadget_006_PQI_Air_Pen/gadget_003_ASUS_Nexus7_2013.html60 /var/www/html_bad/my_essay/gadget_007_Amazon_FireHD_10_(gen7) /var/www/html_bad/my_essay/gadget_007_Amazon_FireHD_10_(gen7)/gadget_007_Amazon_FireHD_10_(gen7) - 00.html60 /var/www/html_bad/my_essay/gadget_007_Amazon_FireHD_10_(gen7)/gadget_007_Amazon_FireHD_10_(gen7).html60 /var/www/html_bad/my_essay/kangaegoto_001_kininaru_people /var/www/html_bad/my_essay/kangaegoto_001_kininaru_people/kangaegoto_001_kininaru_people - 00.html /var/www/html_bad/my_essay/kangaegoto_001_kininaru_people/kangaegoto_001_kininaru_people.html /var/www/html_bad/my_essay/my_essay_index - bak.html /var/www/html_bad/my_essay/my_essay_index.html /var/www/html_bad/my_essay/strategy_001_study_of_son-shi /var/www/html_bad/my_essay/strategy_001_study_of_son-shi/strategy_001_study_of_son-shi.html60 /var/www/html_bad/my_essay/strategy_001_study_of_son-shi/strategy_001_study_of_son-shi_v06.html60 /var/www/html_bad/my_essay/strategy_002_2017noMokuhyou /var/www/html_bad/my_essay/strategy_002_2017noMokuhyou/2017noMokuhyou.html /var/www/html_bad/my_essay/strategy_002_2017noMokuhyou/default_style.css.chekyshka /var/www/html_bad/my_php_tools /var/www/html_bad/my_php_tools/0000_templete /var/www/html_bad/my_php_tools/0000_templete/0001_templete_PHP /var/www/html_bad/my_php_tools/0000_templete/0001_templete_PHP/check.txt80 /var/www/html_bad/my_php_tools/0000_templete/0001_templete_PHP/style.css.chekyshka /var/www/html_bad/my_php_tools/0000_templete/0001_templete_PHP/traffic_signal.php.chekyshka /var/www/html_bad/my_php_tools/0000_templete/check.txt80 /var/www/html_bad/my_php_tools/0000_templete/sample.php.chekyshka /var/www/html_bad/my_php_tools/0010_phpinfo /var/www/html_bad/my_php_tools/0010_phpinfo/check.txt80 /var/www/html_bad/my_php_tools/0010_phpinfo/phpinfo.php.chekyshka /var/www/html_bad/my_php_tools/0030_counter /var/www/html_bad/my_php_tools/0030_counter/counter.dat /var/www/html_bad/my_php_tools/0030_counter/counter.php.chekyshka /var/www/html_bad/my_php_tools/0040_monthly_calendar /var/www/html_bad/my_php_tools/0040_monthly_calendar/check.txt80 /var/www/html_bad/my_php_tools/0040_monthly_calendar/style.css.chekyshka /var/www/html_bad/my_php_tools/0060_mini_calcurator /var/www/html_bad/my_php_tools/0060_mini_calcurator/check.txt80 /var/www/html_bad/my_php_tools/0060_mini_calcurator/mini_calcurator.html /var/www/html_bad/my_php_tools/0060_mini_calcurator/style.css.chekyshka /var/www/html_bad/my_php_tools/0070_lifegame /var/www/html_bad/my_php_tools/0070_lifegame/footer.html /var/www/html_bad/my_php_tools/0070_lifegame/gab /var/www/html_bad/my_php_tools/0070_lifegame/gab/lifegame.ini.chekyshka /var/www/html_bad/my_php_tools/0070_lifegame/header.html /var/www/html_bad/my_php_tools/0070_lifegame/header_style.css.chekyshka /var/www/html_bad/my_php_tools/0070_lifegame/lifegame.ini.chekyshka /var/www/html_bad/my_php_tools/0070_lifegame/lifegame_field.dat.chekyshka /var/www/html_bad/my_php_tools/0070_lifegame/lifegame_func.php.chekyshka #)You_can_write_even_more_files_inside_last_directory  /var/www/html_bad/my_php_tools/0080_bubble_sort /var/www/html_bad/my_php_tools/0080_bubble_sort/bubble_sort.html /var/www/html_bad/my_php_tools/0080_bubble_sort/bubble_sort.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/bubble_sort_func.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/bubble_sort_func22.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/bubble_sort_index.html #)You_can_write_even_more_files_inside_last_directory  /var/www/html_bad/my_php_tools/0080_bubble_sort/gab/bubble_sort2.html /var/www/html_bad/my_php_tools/0080_bubble_sort/gab/init_cells2.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/header.html /var/www/html_bad/my_php_tools/0080_bubble_sort/img /var/www/html_bad/my_php_tools/0080_bubble_sort/init_cells.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/jsphptest /var/www/html_bad/my_php_tools/0080_bubble_sort/jsphptest2 #)You_can_write_even_more_files_inside_last_directory  /var/www/html_bad/my_php_tools/0080_bubble_sort/old/bubble_sort_func22.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/old/bubble_sort_index22.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/old/bubble_sort_main22.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/old/bubble_sort_var_ini22.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/old/footer.html #)You_can_write_even_more_files_inside_last_directory  /var/www/html_bad/my_php_tools/0080_bubble_sort/old2 /var/www/html_bad/my_php_tools/0080_bubble_sort/old2/bubble_sort.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/old2/bubble_sort2.html /var/www/html_bad/my_php_tools/0080_bubble_sort/old2/header_style.css.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/old2/launch.html /var/www/html_bad/my_php_tools/0080_bubble_sort/style.css.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/test.html /var/www/html_bad/my_php_tools/0080_bubble_sort/test.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/test2.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort/ζ–°γ—γ„γƒ†γ‚­γ‚Ήγƒˆ ドキγƒ₯γƒ‘γƒ³γƒˆ.txt.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1 /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/bubble_sort.html /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/bubble_sort.js.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/bubble_sort.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/gab /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/gab/bubble_sort2.html /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/img /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/jsphptest /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/jsphptest2 /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/lifegame_field.dat.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/old /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/old/bubble_sort_func.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/old/bubble_sort_index.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/old/bubble_sort_main.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/old/bubble_sort_var_ini.php.chekyshka /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/old/footer.html #)You_can_write_even_more_files_inside_last_directory  /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/old2 /var/www/html_bad/my_php_tools/0080_bubble_sort_alt1/old2/bubble_sort.php.chekyshka ╔══════════╣ Interesting GROUP writable files (not in Home) (max 200) β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files   ╔═════════════════════════╗ ════════════════════════════╣ Other Interesting Files ╠════════════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• ╔══════════╣ .sh files in path β•š https://book.hacktricks.xyz/linux-hardening/privilege-escalation#script-binaries-in-path /usr/bin/gettext.sh ╔══════════╣ Executable files potentially added by user (limit 70) 2019-12-14+08:38:28.1485221140 /opt/vc/src/hello_pi/rebuild.sh 2019-12-14+08:37:49.0685577230 /opt/vc/bin/vcsmem 2019-12-14+08:37:49.0685577230 /opt/vc/bin/vcmailbox 2019-12-14+08:37:49.0685577230 /opt/vc/bin/vchiq_test 2019-12-14+08:37:49.0585577320 /opt/vc/bin/vcgencmd 2019-12-14+08:37:49.0585577320 /opt/vc/bin/vcdbg 2019-12-14+08:37:49.0585577320 /opt/vc/bin/tvservice 2019-12-14+08:37:49.0585577320 /opt/vc/bin/raspiyuv 2019-12-14+08:37:49.0485577410 /opt/vc/bin/raspividyuv 2019-12-14+08:37:49.0485577410 /opt/vc/bin/raspivid 2019-12-14+08:37:49.0485577410 /opt/vc/bin/raspistill 2019-12-14+08:37:49.0485577410 /opt/vc/bin/mmal_vc_diag 2019-12-14+08:37:49.0485577410 /opt/vc/bin/edidparser 2019-12-14+08:37:49.0385577500 /opt/vc/bin/dtoverlay-pre 2019-12-14+08:37:49.0385577500 /opt/vc/bin/dtoverlay-post 2019-12-14+08:37:49.0385577500 /opt/vc/bin/dtoverlay 2019-12-14+08:37:49.0385577500 /opt/vc/bin/dtmerge 2019-12-14+08:37:49.0385577500 /opt/vc/bin/containers_uri_pipe 2019-12-14+08:37:49.0385577500 /opt/vc/bin/containers_test_uri 2019-12-14+08:37:49.0385577500 /opt/vc/bin/containers_test_bits 2019-12-14+08:37:49.0385577500 /opt/vc/bin/containers_test 2019-12-14+08:37:49.0385577500 /opt/vc/bin/containers_stream_server 2019-12-14+08:37:49.0385577500 /opt/vc/bin/containers_stream_client 2019-12-14+08:37:49.0385577500 /opt/vc/bin/containers_rtp_decoder 2019-12-14+08:37:49.0285577590 /opt/vc/bin/containers_dump_pktfile 2019-12-14+08:37:49.0285577590 /opt/vc/bin/containers_datagram_sender 2019-12-14+08:37:49.0285577590 /opt/vc/bin/containers_datagram_receiver 2019-12-14+08:37:49.0285577590 /opt/vc/bin/containers_check_frame_int 2019-12-14+08:35:26.8286876120 /usr/bin/rpi-update 2019-07-06+08:30:23.7955653290 /var/www/html_bad/counter.dat 2019-07-06+03:40:45.6535248460 /var/www/html_bad/test/practice_02/test.php.chekyshka 2019-07-06+03:40:41.7425916400 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/05_img_mt_fuji_alt_15.849.jpg.chekyshka 2019-07-06+03:40:41.7406829920 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/19_img_mt_fuji_alt_398.107km.jpg.chekyshka 2019-07-06+03:40:41.7386438240 /var/www/html_bad/my_useful_links/style.css.chekyshka 2019-07-06+03:40:36.3330500820 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/12_img_mt_fuji_alt_79.433km.jpg.chekyshka 2019-07-06+03:40:34.9436705400 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/11_mg_mt_fuji_alt_63.096km.jpg.chekyshka 2019-07-06+03:40:34.9374253250 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/03_img_mt_fuji_alt_10km.jpg.chekyshka 2019-07-06+03:40:34.6681878630 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/14_img_mt_fuji_alt_125.893km.jpg.chekyshka 2019-07-06+03:40:34.6664561940 /var/www/html_bad/test/practice_00/test.txt.chekyshka 2019-07-06+03:40:34.6645457760 /var/www/html_bad/test/practice_00/fread_all.php.chekyshka 2019-07-06+03:40:32.3496836220 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/04_img_mt_fuji_alt_12.589km.jpg.chekyshka 2019-07-06+03:40:30.0514023710 /var/www/html_bad/lab_of_time/0500_24sekki/v0.1/24sekki_v01.txt.chekyshka 2019-07-06+03:40:24.0897717020 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/00_img_mt_fuji_alt_5km.jpg.chekyshka 2019-07-06+03:40:23.8139928790 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/15_img_mt_fuji_alt_158.489km.jpg.chekyshka 2019-07-06+03:40:23.8120523040 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/08_img_mt_fuji_alt_31.623km.jpg.chekyshka 2019-07-06+03:40:23.5432520300 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/01_img_mt_fuji_alt_6.310km.jpg.chekyshka 2019-07-06+03:40:23.5414540590 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/17_img_mt_fuji_alt_251.189km.jpg.chekyshka 2019-07-06+03:40:23.5397424430 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/18_mg_mt_fuji_alt_316.228km.jpg.chekyshka 2019-07-06+03:40:23.5379041600 /var/www/html_bad/test/practice_00/disp_file_data.php.chekyshka 2019-07-06+03:40:21.3719591880 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/16_img_mt_fuji_alt_200km.jpg.chekyshka 2019-07-06+03:40:21.0845604570 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/07_img_mt_fuji_alt_25.119km.jpg.chekyshka 2019-07-06+03:40:15.8319563420 /var/www/html_bad/test/practice_00/fread.php.chekyshka 2019-07-06+03:40:15.8301537880 /var/www/html_bad/lab_of_space/0100_pref_nickname/default_style.css.chekyshka 2019-07-06+03:40:15.8265548260 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/20_img_mt_fuji_alt_500km.jpg.chekyshka 2019-07-06+03:40:15.5568589770 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/09_img_mt_fuji_alt_39.811km.jpg.chekyshka 2019-07-06+03:40:15.5551206940 /var/www/html_bad/test/practice_00/cnt.php.chekyshka 2019-07-06+03:40:15.2927198530 /var/www/html_bad/lab_of_time/0500_24sekki/24sekki.txt.chekyshka 2019-07-06+03:40:13.2976058350 /var/www/html_bad/lab_of_time/0500_24sekki/v0.2/24sekki.txt.chekyshka 2019-07-06+03:40:12.7517094960 /var/www/html_bad/counter.php.chekyshka 2019-07-06+03:40:06.8037727400 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/02_img_mt_fuji_alt_7.943km.jpg.chekyshka 2019-07-06+03:40:06.5285548540 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/13_img_mt_fuji_alt_100km.jpg.chekyshka 2019-07-06+03:40:06.2354357530 /var/www/html_bad/phpinfo.php.chekyshka 2019-07-06+03:40:06.2336354380 /var/www/html_bad/my_php_tools/test/phpinfo01.php.chekyshka 2019-07-06+03:40:04.9126563790 /var/www/html_bad/CG/010_launch_mt_fuji_20160111/img/06_img_mt_fuji_alt_20km.jpg.chekyshka 2019-07-06+03:40:04.8985229790 /var/www/html_bad/test/practice_00/fgetc.php.chekyshka 2019-07-06+03:40:04.8967517800 /var/www/html_bad/myminicity/style.css.chekyshka 2019-07-06+03:40:00.0434333790 /var/www/html_bad/myminicity/myminicity_stat.txt.chekyshka 2019-07-06+03:40:00.0402880110 /var/www/html_bad/top_style.css.chekyshka 2019-07-06+03:39:53.5796563480 /var/www/html_bad/CSS/default_style.based_on_pukiukiplus.css.chekyshka 2019-07-06+03:39:53.3137882120 /var/www/html_bad/lab_of_time/0700_biz_calender/default_style.css.chekyshka sort: write failed: 'standard output': Broken pipe sort: write error ╔══════════╣ Unexpected in /opt (usually empty) total 12 drwxr-xr-x 3 root root 4096 Nov 13 2018 . drwxr-xr-x 22 root root 4096 Dec 17 2018 .. drwxr-xr-x 6 root root 4096 Mar 17 2019 vc ╔══════════╣ Unexpected in root /boot.bak ╔══════════╣ Modified interesting files in the last 5mins (limit 100) /var/log/btmp /var/log/auth.log /var/log/daemon.log /var/log/syslog /var/www/.gnupg/pubring.kbx /var/www/.gnupg/trustdb.gpg /var/www/enum_results.txt /tmp/phpbhCkKg logrotate 3.11.0 ╔══════════╣ Files inside /home/www-data (limit 20)  ╔══════════╣ Files inside others home (limit 20) /home/ok/.bash_history /home/ok/.profile /home/ok/.bashrc /home/ok/.bash_logout /var/www/html_bad/test.php.chekyshka /var/www/html_bad/lab_of_PC/!!!CHEKYSHKA_DECRYPT_README.TXT.nyton /var/www/html_bad/lab_of_PC/!DECRYPT_INSTRUCTION.TXT.chekyshka /var/www/html_bad/lab_of_PC/!NYTON_HELP.TXT.mars /var/www/html_bad/lab_of_PC/0100_edit_movie/!!!CHEKYSHKA_DECRYPT_README.TXT.nyton /var/www/html_bad/lab_of_PC/0100_edit_movie/0100_edit_movie.html60 /var/www/html_bad/lab_of_PC/0100_edit_movie/!DECRYPT_INSTRUCTION.TXT.chekyshka /var/www/html_bad/lab_of_PC/0100_edit_movie/!NYTON_HELP.TXT.mars /var/www/html_bad/lab_of_PC/0100_edit_movie/!!!MARS_DECRYPT.TXT /var/www/html_bad/lab_of_PC/0100_edit_movie/my works.exe /var/www/html_bad/lab_of_PC/!!!MARS_DECRYPT.TXT /var/www/html_bad/lab_of_PC/System.exe /var/www/html_bad/sidebar_style.css.chekyshka /var/www/html_bad/qualification/000_index_gualification.html /var/www/html_bad/qualification/020_sidebar_style.css.nyton /var/www/html_bad/qualification/IPA-Common/!!!CHEKYSHKA_DECRYPT_README.TXT.nyton grep: write error: Broken pipe ╔══════════╣ Searching installed mail applications  ╔══════════╣ Mails (limit 50)  ╔══════════╣ Backup folders drwxr-xr-x 2 root root 4096 Dec 29 06:25 /var/backups total 1516 -rw-r--r-- 1 root root 51200 Sep 12 2022 alternatives.tar.0 -rw-r--r-- 1 root root 2670 Jan 16 2022 alternatives.tar.1.gz -rw-r--r-- 1 root root 2672 Jul 24 2021 alternatives.tar.2.gz -rw-r--r-- 1 root root 2675 Dec 14 2020 alternatives.tar.3.gz -rw-r--r-- 1 root root 2676 Jul 19 2020 alternatives.tar.4.gz -rw-r--r-- 1 root root 2675 Mar 30 2020 alternatives.tar.5.gz -rw-r--r-- 1 root root 2677 Nov 23 2019 alternatives.tar.6.gz -rw-r--r-- 1 root root 12896 Dec 23 2018 apt.extended_states.0 -rw-r--r-- 1 root root 1464 Dec 17 2018 apt.extended_states.1.gz -rw-r--r-- 1 root root 1242 Nov 13 2018 apt.extended_states.2.gz -rw-r--r-- 1 root root 192 Nov 22 2019 dpkg.diversions.0 -rw-r--r-- 1 root root 130 Nov 22 2019 dpkg.diversions.1.gz -rw-r--r-- 1 root root 130 Nov 22 2019 dpkg.diversions.2.gz -rw-r--r-- 1 root root 130 Nov 22 2019 dpkg.diversions.3.gz -rw-r--r-- 1 root root 130 Nov 22 2019 dpkg.diversions.4.gz -rw-r--r-- 1 root root 130 Nov 22 2019 dpkg.diversions.5.gz -rw-r--r-- 1 root root 130 Nov 22 2019 dpkg.diversions.6.gz -rw-r--r-- 1 root root 172 Dec 17 2018 dpkg.statoverride.0 -rw-r--r-- 1 root root 161 Dec 17 2018 dpkg.statoverride.1.gz -rw-r--r-- 1 root root 161 Dec 17 2018 dpkg.statoverride.2.gz -rw-r--r-- 1 root root 161 Dec 17 2018 dpkg.statoverride.3.gz -rw-r--r-- 1 root root 161 Dec 17 2018 dpkg.statoverride.4.gz -rw-r--r-- 1 root root 161 Dec 17 2018 dpkg.statoverride.5.gz -rw-r--r-- 1 root root 161 Dec 17 2018 dpkg.statoverride.6.gz -rw-r--r-- 1 root root 488665 Sep 11 2022 dpkg.status.0 -rw-r--r-- 1 root root 145633 Sep 11 2022 dpkg.status.1.gz -rw-r--r-- 1 root root 145633 Sep 11 2022 dpkg.status.2.gz -rw-r--r-- 1 root root 145633 Sep 11 2022 dpkg.status.3.gz -rw-r--r-- 1 root root 145633 Sep 11 2022 dpkg.status.4.gz -rw-r--r-- 1 root root 145633 Sep 11 2022 dpkg.status.5.gz -rw-r--r-- 1 root root 145633 Sep 11 2022 dpkg.status.6.gz -rw------- 1 root root 785 Dec 17 2018 group.bak -rw------- 1 root shadow 654 Dec 17 2018 gshadow.bak -rw------- 1 root root 1483 Dec 17 2018 passwd.bak -rw------- 1 root shadow 982 Dec 18 2018 shadow.bak ╔══════════╣ Backup files (limited 100) -rw-r--r-- 1 root root 10714 Sep 11 2022 /usr/share/info/dir.old -rw-r--r-- 1 root root 331845 Mar 14 2017 /usr/share/doc/manpages/Changes.old.gz -rw-r--r-- 1 root root 1624 Oct 10 2016 /usr/share/man/man8/tdbbackup.tdbtools.8.gz -rwxr-xr-x 1 root root 9676 Oct 10 2016 /usr/bin/tdbbackup.tdbtools -rw-r--r-- 1 root root 19 Nov 13 2018 /etc/resolv.conf.bak -rw-r--r-- 1 root root 271 Dec 17 2018 /etc/network/interfaces.old -rw-r--r-- 1 root root 673 Nov 13 2018 /etc/xml/xml-core.xml.old -rw-r--r-- 1 root root 610 Nov 13 2018 /etc/xml/catalog.old -rw-r--r-- 1 root root 128 Nov 13 2018 /var/lib/sgml-base/supercatalog.old -rwxrw-r-- 1 ok ok 27165 Jul 6 02:55 /var/www/html_bad_20230716/Common/AutoBackup/SiteConfig.cfg.bak -rwxrw-r-- 1 ok ok 590 Jul 6 02:55 /var/www/html_bad_20230716/Common/AutoBackup/User.cfg.bak -rwxrw-r-- 1 ok ok 2090 Jul 6 02:55 /var/www/html_bad_20230716/Common/AutoBackup/Istripper.ope.bak -rwxrw-r-- 1 ok ok 441 Jul 6 02:55 /var/www/html_bad_20230716/Common/AutoBackup/Lock.cfg.bak ╔══════════╣ Searching tables inside readable .db/.sql/.sqlite files (limit 100) Found /var/lib/apt/listchanges-old.db: Berkeley DB (Hash, version 9, native byte-order) Found /var/lib/apt/listchanges.db: Berkeley DB (Hash, version 9, native byte-order) Found /var/www/html_bad_20230716/Common/GL/Results.db: SQLite 3.x database, last written using SQLite version 3008006  -> Extracting tables from /var/www/html_bad_20230716/Common/GL/Results.db (limit 20)  ╔══════════╣ Web files?(output limit) /var/www/: total 1004K drwxrwxrwx 10 root root 4.0K Dec 29 14:29 . drwxr-xr-x 12 root root 4.0K Dec 17 2018 .. -rwxrw-r-- 1 ok ok 6.1K Jan 18 2022 .DS_Store -rwxrw-r-- 1 ok ok 4.0K Jan 18 2022 ._.DS_Store drwx------ 3 www-data www-data 4.0K Dec 29 14:30 .gnupg -rw-r--r-- 1 www-data www-data 165 Dec 29 14:25 .wget-hsts -rw-r--r-- 1 www-data www-data 130K Dec 29 14:31 enum_results.txt drwxrwxr-x 20 ok ok 4.0K Dec 24 14:56 html ╔══════════╣ All relevant hidden files (not in /sys/ or the ones listed in the previous check) (limit 70) -rw------- 1 root root 0 Nov 13 2018 /etc/.pwd.lock -rw-r--r-- 1 root root 204 Nov 13 2018 /etc/.fstab -rw-r--r-- 1 root root 220 May 16 2017 /etc/skel/.bash_logout -rwxr-xr-x 1 root root 41 Dec 14 2019 /boot/.firmware_revision -rw-r--r-- 1 ok ok 220 Dec 17 2018 /home/ok/.bash_logout -rw-r--r-- 1 root root 0 Jul 21 22:16 /run/network/.ifstate.lock -rwxrw-r-- 1 ok ok 60 Dec 25 2018 /var/www/html_bad/history/.htaccess -rwxrw-r-- 1 ok ok 51 Dec 25 2018 /var/www/html_bad/my_php_tools/0060_mini_calcurator/.htaccess -rwxrw-r-- 1 ok ok 51 Dec 25 2018 /var/www/html_bad/myminicity/.htaccess -rwxrw-r-- 1 ok ok 59 Dec 25 2018 /var/www/html_bad/my_words/.htaccess -rwxrw-r-- 1 ok ok 51 Dec 25 2018 /var/www/html_bad/.htaccess -rwxrw-r-- 1 ok ok 61 Jan 8 2019 /var/www/html/my_php_tools/PHP_dojyo/.htaccess -rwxrw-r-- 1 ok ok 44 Mar 13 2016 /var/www/html/my_php_tools/0070_lifegame/.htaccess -rwxrw-r-- 1 ok ok 164 Jul 7 2019 /var/www/html/my_php_tools/0040_monthly_calendar/.htaccess -rwxrw-r-- 1 ok ok 44 Mar 13 2016 /var/www/html/my_php_tools/0000_templete/0001_templete_PHP/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html/my_php_tools/0100_mycalendar/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html/my_php_tools/0060_mini_calcurator/.htaccess -rwxrw-r-- 1 ok ok 364 Jan 2 2021 /var/www/html/myminicity/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html/my_toolbox/stationary/0010_templete_sheets_suits/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html/lab_of_time/0100_calendar/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html/lab_of_time/0600_name_of_month/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html/lab_of_time/0500_24sekki/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html/lab_of_space/0100_pref_nickname/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/my_php_tools/0040_monthly_calendar/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/my_php_tools/0100_mycalendar/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/myminicity/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/my_toolbox/stationary/0010_templete_sheets_suits/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/my_essay/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/lab_of_time/0100_calendar/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/lab_of_time/0600_name_of_month/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/lab_of_time/0500_24sekki/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad2/lab_of_space/0100_pref_nickname/.htaccess -rw-r--r-- 1 www-data www-data 165 Dec 29 14:25 /var/www/.wget-hsts -rwxrw-r-- 1 ok ok 8 Jul 6 02:56 /var/www/html_bad_20230716/WEFiles/Server/DB/.htaccess.upd -rwxrw-r-- 1 ok ok 13 Nov 7 2016 /var/www/html_bad_20230716/WEFiles/Server/DB/.htaccess -rwxrw-r-- 1 ok ok 61 Jan 8 2019 /var/www/html_bad_20230716/my_php_tools/PHP_dojyo/.htaccess -rwxrw-r-- 1 ok ok 44 Mar 13 2016 /var/www/html_bad_20230716/my_php_tools/0070_lifegame/.htaccess -rwxrw-r-- 1 ok ok 164 Jul 7 2019 /var/www/html_bad_20230716/my_php_tools/0040_monthly_calendar/.htaccess -rwxrw-r-- 1 ok ok 44 Mar 13 2016 /var/www/html_bad_20230716/my_php_tools/0000_templete/0001_templete_PHP/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad_20230716/my_php_tools/0100_mycalendar/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad_20230716/my_php_tools/0060_mini_calcurator/.htaccess -rwxrw-r-- 1 ok ok 8 Jul 6 02:56 /var/www/html_bad_20230716/Backup/.htaccess.upd -rwxrw-r-- 1 ok ok 33 Nov 7 2016 /var/www/html_bad_20230716/Backup/.htaccess -rwxrw-r-- 1 ok ok 364 Jan 2 2021 /var/www/html_bad_20230716/myminicity/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad_20230716/my_toolbox/stationary/0010_templete_sheets_suits/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad_20230716/lab_of_time/0100_calendar/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad_20230716/lab_of_time/0600_name_of_month/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad_20230716/lab_of_time/0500_24sekki/.htaccess -rwxrw-r-- 1 ok ok 8 Jul 6 02:56 /var/www/html_bad_20230716/Data/.htaccess.upd -rwxrw-r-- 1 ok ok 13 Nov 7 2016 /var/www/html_bad_20230716/Data/.htaccess -rwxrw-r-- 1 ok ok 52 Dec 25 2018 /var/www/html_bad_20230716/lab_of_space/0100_pref_nickname/.htaccess -rwxrw-r-- 1 ok ok 4096 Jan 18 2022 /var/www/._.DS_Store -rwxr--r-- 1 root root 61 Jul 21 22:04 /var/www/html_asof_20240721a/my_php_tools/PHP_dojyo/.htaccess -rwxr--r-- 1 root root 44 Jul 21 22:04 /var/www/html_asof_20240721a/my_php_tools/0070_lifegame/.htaccess -rwxr--r-- 1 root root 164 Jul 21 22:04 /var/www/html_asof_20240721a/my_php_tools/0040_monthly_calendar/.htaccess -rwxr--r-- 1 root root 44 Jul 21 22:04 /var/www/html_asof_20240721a/my_php_tools/0000_templete/0001_templete_PHP/.htaccess -rwxr--r-- 1 root root 52 Jul 21 22:04 /var/www/html_asof_20240721a/my_php_tools/0100_mycalendar/.htaccess -rwxr--r-- 1 root root 52 Jul 21 22:04 /var/www/html_asof_20240721a/my_php_tools/0060_mini_calcurator/.htaccess -rwxr--r-- 1 root root 364 Jul 21 22:04 /var/www/html_asof_20240721a/myminicity/.htaccess -rwxr--r-- 1 root root 52 Jul 21 22:04 /var/www/html_asof_20240721a/my_toolbox/stationary/0010_templete_sheets_suits/.htaccess -rwxr--r-- 1 root root 52 Jul 21 22:04 /var/www/html_asof_20240721a/lab_of_time/0100_calendar/.htaccess -rwxr--r-- 1 root root 52 Jul 21 22:04 /var/www/html_asof_20240721a/lab_of_time/0600_name_of_month/.htaccess -rwxr--r-- 1 root root 52 Jul 21 22:04 /var/www/html_asof_20240721a/lab_of_time/0500_24sekki/.htaccess -rwxr--r-- 1 root root 52 Jul 21 22:04 /var/www/html_asof_20240721a/lab_of_space/0100_pref_nickname/.htaccess -rwxrw-r-- 1 ok ok 6148 Jan 18 2022 /var/www/.DS_Store -rwxrw-r-- 1 ok ok 61 Jan 8 2019 /var/www/html_asof_20230223/my_php_tools/PHP_dojyo/.htaccess -rwxrw-r-- 1 ok ok 44 Mar 13 2016 /var/www/html_asof_20230223/my_php_tools/0070_lifegame/.htaccess -rwxrw-r-- 1 ok ok 164 Jul 7 2019 /var/www/html_asof_20230223/my_php_tools/0040_monthly_calendar/.htaccess -rwxrw-r-- 1 ok ok 44 Mar 13 2016 /var/www/html_asof_20230223/my_php_tools/0000_templete/0001_templete_PHP/.htaccess ╔══════════╣ Readable files inside /tmp, /var/tmp, /private/tmp, /private/var/at/tmp, /private/var/tmp, and backup folders (limit 70) -rw------- 1 www-data www-data 481 Dec 29 14:28 /tmp/phpbhCkKg -rw-r--r-- 1 root root 2677 Nov 23 2019 /var/backups/alternatives.tar.6.gz -rw-r--r-- 1 root root 2670 Jan 16 2022 /var/backups/alternatives.tar.1.gz -rw-r--r-- 1 root root 2676 Jul 19 2020 /var/backups/alternatives.tar.4.gz -rw-r--r-- 1 root root 51200 Sep 12 2022 /var/backups/alternatives.tar.0 -rw-r--r-- 1 root root 2675 Mar 30 2020 /var/backups/alternatives.tar.5.gz -rw-r--r-- 1 root root 2675 Dec 14 2020 /var/backups/alternatives.tar.3.gz -rw-r--r-- 1 root root 2672 Jul 24 2021 /var/backups/alternatives.tar.2.gz ╔══════════╣ Searching passwords in history files  ╔══════════╣ Searching passwords in config PHP files /var/www/html_asof_20230223/config.php: $passwd=$_REQUEST['passwd']; /var/www/html_asof_20230223/config.php: @mysql_connect($host, $usr, $passwd) or die("Connection Error: " . mysql_error()); /var/www/html_asof_20230223/config.php:password /var/www/html_asof_20230223/my_words/config.php: $passwd=$_REQUEST['passwd']; /var/www/html_asof_20230223/my_words/config.php: @mysql_connect($host, $usr, $passwd) or die("Connection Error: " . mysql_error()); /var/www/html_asof_20230223/my_words/config.php:password /var/www/html_asof_20240721a/config.php: $passwd=$_REQUEST['passwd']; /var/www/html_asof_20240721a/config.php: @mysql_connect($host, $usr, $passwd) or die("Connection Error: " . mysql_error()); /var/www/html_asof_20240721a/config.php:password /var/www/html_asof_20240721a/my_words/config.php: $passwd=$_REQUEST['passwd']; /var/www/html_asof_20240721a/my_words/config.php: @mysql_connect($host, $usr, $passwd) or die("Connection Error: " . mysql_error()); /var/www/html_asof_20240721a/my_words/config.php:password ╔══════════╣ Searching *password* or *credential* files in home (limit 70) /bin/systemd-ask-password /bin/systemd-tty-ask-password-agent /etc/pam.d/common-password /usr/lib/arm-linux-gnueabihf/libsamba-credentials.so.0 /usr/lib/arm-linux-gnueabihf/libsamba-credentials.so.0.0.1 /usr/lib/arm-linux-gnueabihf/samba/ldb/local_password.so /usr/lib/arm-linux-gnueabihf/samba/ldb/password_hash.so /usr/lib/arm-linux-gnueabihf/samba/libcmdline-credentials.so.0 /usr/lib/python2.7/dist-packages/samba/credentials.arm-linux-gnueabihf.so /usr/lib/python2.7/dist-packages/samba/tests/credentials.py /usr/lib/python2.7/dist-packages/samba/tests/credentials.pyc /usr/lib/python2.7/dist-packages/samba/tests/samba_tool/user_check_password_script.py /usr/lib/python2.7/dist-packages/samba/tests/samba_tool/user_check_password_script.pyc /usr/share/man/man1/systemd-ask-password.1.gz /usr/share/man/man1/systemd-tty-ask-password-agent.1.gz /usr/share/man/man7/credentials.7.gz /usr/share/man/man8/systemd-ask-password-console.path.8.gz /usr/share/man/man8/systemd-ask-password-console.service.8.gz /usr/share/man/man8/systemd-ask-password-wall.path.8.gz /usr/share/man/man8/systemd-ask-password-wall.service.8.gz #)There are more creds/passwds files in the previous parent folder /usr/share/pam/common-password.md5sums /var/cache/debconf/passwords.dat /var/lib/pam/password ╔══════════╣ Checking for TTY (sudo/su) passwords in audit logs  ╔══════════╣ Checking for TTY (sudo/su) passwords in audit logs  ╔══════════╣ Searching passwords inside logs (limit 70) [ OK ] Started Forward Password Requests to Plymouth Directory Watch.  ╔════════════════╗ ════════════════════════════════╣ API Keys Regex ╠════════════════════════════════  β•šβ•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β•β• Regexes to search for API keys aren't activated, use param '-r'