From a28bbfd309eba3222d9938d9b3ce185fd1e8241e Mon Sep 17 00:00:00 2001 From: Raghuram Subramani Date: Sun, 4 Sep 2022 13:59:22 +0530 Subject: forgot to add hackervshacker --- hackervshacker/linlog | 1178 +++++++++++++++++++++++++++++++++++++++++++++++++ 1 file changed, 1178 insertions(+) create mode 100644 hackervshacker/linlog (limited to 'hackervshacker/linlog') diff --git a/hackervshacker/linlog b/hackervshacker/linlog new file mode 100644 index 0000000..23f8444 --- /dev/null +++ b/hackervshacker/linlog @@ -0,0 +1,1178 @@ + + + ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ + ▄▄▄▄▄▄▄             ▄▄▄▄▄▄▄▄ + ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄ + ▄▄▄▄     ▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄ + ▄    ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ + ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ + ▄▄▄▄▄▄▄▄▄▄▄          ▄▄▄▄▄▄               ▄▄▄▄▄▄ ▄ + ▄▄▄▄▄▄              ▄▄▄▄▄▄▄▄                 ▄▄▄▄  + ▄▄                  ▄▄▄ ▄▄▄▄▄                  ▄▄▄ + ▄▄                ▄▄▄▄▄▄▄▄▄▄▄▄                  ▄▄ + ▄            ▄▄ ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄   ▄▄ + ▄      ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ + ▄▄▄▄▄▄▄▄▄▄▄▄▄▄                                ▄▄▄▄ + ▄▄▄▄▄  ▄▄▄▄▄                       ▄▄▄▄▄▄     ▄▄▄▄ + ▄▄▄▄   ▄▄▄▄▄                       ▄▄▄▄▄      ▄ ▄▄ + ▄▄▄▄▄  ▄▄▄▄▄        ▄▄▄▄▄▄▄        ▄▄▄▄▄     ▄▄▄▄▄ + ▄▄▄▄▄▄  ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄      ▄▄▄▄▄▄▄   ▄▄▄▄▄  +  ▄▄▄▄▄▄▄▄▄▄▄▄▄▄        ▄          ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄  + ▄▄▄▄▄▄▄▄▄▄▄▄▄                       ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ + ▄▄▄▄▄▄▄▄▄▄▄                         ▄▄▄▄▄▄▄▄▄▄▄▄▄▄ + ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄            ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ + ▀▀▄▄▄   ▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄ ▄▄▄▄▄▄▄▀▀▀▀▀▀ + ▀▀▀▄▄▄▄▄      ▄▄▄▄▄▄▄▄▄▄  ▄▄▄▄▄▄▀▀ + ▀▀▀▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▄▀▀▀ + + /---------------------------------------------------------------------------------\ + | Do you like PEASS? | + |---------------------------------------------------------------------------------| + | Get the latest version : https://github.com/sponsors/carlospolop | + | Follow on Twitter : @carlospolopm | + | Respect on HTB : SirBroccoli  | + |---------------------------------------------------------------------------------| + | Thank you!  | + \---------------------------------------------------------------------------------/ + linpeas-ng by carlospolop + +ADVISORY: This script should be used for authorized penetration testing and/or educational purposes only. Any misuse of this software will not be the responsibility of the author or of any other collaborator. Use it at your own computers and/or with the computer owner's permission. + +Linux Privesc Checklist: https://book.hacktricks.xyz/linux-hardening/linux-privilege-escalation-checklist + LEGEND: + RED/YELLOW: 95% a PE vector + RED: You should take a look to it + LightCyan: Users with console + Blue: Users without console & mounted devs + Green: Common things (users, groups, SUID/SGID, mounts, .sh scripts, cronjobs) + LightMagenta: Your username + + Starting linpeas. Caching Writable Folders... + + ╔═══════════════════╗ +═══════════════════════════════╣ Basic information ╠═══════════════════════════════ + ╚═══════════════════╝ +OS: Linux version 5.4.0-109-generic (buildd@ubuntu) (gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1)) #123-Ubuntu SMP Fri Apr 8 09:10:54 UTC 2022 +User & Groups: uid=33(www-data) gid=33(www-data) groups=33(www-data) +Hostname: b2r +Writable folder: /dev/shm +[+] /usr/bin/ping is available for network discovery (linpeas can discover hosts, learn more with -h) +[+] /usr/bin/bash is available for network discovery & port scanning (linpeas can discover hosts and scan ports, learn more with -h) +[+] /usr/bin/nc is available for network discovery & port scanning (linpeas can discover hosts and scan ports, learn more with -h) + + + +Caching directories DONE + + ╔════════════════════╗ +══════════════════════════════╣ System Information ╠══════════════════════════════ + ╚════════════════════╝ +╔══════════╣ Operative system +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#kernel-exploits +Linux version 5.4.0-109-generic (buildd@ubuntu) (gcc version 9.4.0 (Ubuntu 9.4.0-1ubuntu1~20.04.1)) #123-Ubuntu SMP Fri Apr 8 09:10:54 UTC 2022 +Distributor ID: Ubuntu +Description: Ubuntu 20.04.4 LTS +Release: 20.04 +Codename: focal + +╔══════════╣ Sudo version +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-version +Sudo version 1.8.31 + +╔══════════╣ CVEs Check +Vulnerable to CVE-2021-3560 + + + +╔══════════╣ PATH +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-path-abuses +/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin +New path exported: /usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin + +╔══════════╣ Date & uptime +Sat Aug 20 15:33:46 UTC 2022 + 15:33:46 up 21 min, 0 users, load average: 0.40, 0.29, 0.73 + +╔══════════╣ Any sd*/disk* disk in /dev? (limit 20) +disk + +╔══════════╣ Unmounted file-system? +╚ Check if you can mount umounted devices +/dev/disk/by-id/dm-uuid-LVM-S0EQ4vI8gcwzDW214vbvDa0pSxD7eam0nrvgq4EdGPK983HC0NE8QF2Beac29VUP / ext4 defaults 0 1 +/dev/disk/by-uuid/befd1c80-fe6b-4b86-b4ca-2f372c253599 /boot ext4 defaults 0 1 + +╔══════════╣ Environment +╚ Any private information inside environment variables? +HISTFILESIZE=0 +OLDPWD=/ +APACHE_RUN_DIR=/var/run/apache2 +APACHE_PID_FILE=/var/run/apache2/apache2.pid +JOURNAL_STREAM=9:22753 +TERM=xterm +PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/snap/bin +INVOCATION_ID=b362df8aacaa413a9837f4b1748c8dd8 +APACHE_LOCK_DIR=/var/lock/apache2 +LANG=C +HISTSIZE=0 +APACHE_RUN_USER=www-data +APACHE_RUN_GROUP=www-data +APACHE_LOG_DIR=/var/log/apache2 +PWD=/dev/shm +HISTFILE=/dev/null + +╔══════════╣ Searching Signature verification failed in dmesg +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#dmesg-signature-verification-failed +dmesg Not Found + +╔══════════╣ Executing Linux Exploit Suggester +╚ https://github.com/mzet-/linux-exploit-suggester +[+] [CVE-2021-4034] PwnKit + + Details: https://www.qualys.com/2022/01/25/cve-2021-4034/pwnkit.txt + Exposure: probable + Tags: [ ubuntu=10|11|12|13|14|15|16|17|18|19|20|21 ],debian=7|8|9|10|11,fedora,manjaro + Download URL: https://codeload.github.com/berdav/CVE-2021-4034/zip/main + +[+] [CVE-2021-3156] sudo Baron Samedit + + Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt + Exposure: probable + Tags: mint=19,[ ubuntu=18|20 ], debian=10 + Download URL: https://codeload.github.com/blasty/CVE-2021-3156/zip/main + +[+] [CVE-2021-3156] sudo Baron Samedit 2 + + Details: https://www.qualys.com/2021/01/26/cve-2021-3156/baron-samedit-heap-based-overflow-sudo.txt + Exposure: probable + Tags: centos=6|7|8,[ ubuntu=14|16|17|18|19|20 ], debian=9|10 + Download URL: https://codeload.github.com/worawit/CVE-2021-3156/zip/main + +[+] [CVE-2021-22555] Netfilter heap out-of-bounds write + + Details: https://google.github.io/security-research/pocs/linux/cve-2021-22555/writeup.html + Exposure: probable + Tags: [ ubuntu=20.04 ]{kernel:5.8.0-*} + Download URL: https://raw.githubusercontent.com/google/security-research/master/pocs/linux/cve-2021-22555/exploit.c + ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2021-22555/exploit.c + Comments: ip_tables kernel module must be loaded + +[+] [CVE-2017-5618] setuid screen v4.5.0 LPE + + Details: https://seclists.org/oss-sec/2017/q1/184 + Exposure: less probable + Download URL: https://www.exploit-db.com/download/https://www.exploit-db.com/exploits/41154 + + +╔══════════╣ Executing Linux Exploit Suggester 2 +╚ https://github.com/jondonas/linux-exploit-suggester-2 + +╔══════════╣ Protections +═╣ AppArmor enabled? .............. You do not have enough privilege to read the profile set. +apparmor module is loaded. +═╣ grsecurity present? ............ grsecurity Not Found +═╣ PaX bins present? .............. PaX Not Found +═╣ Execshield enabled? ............ Execshield Not Found +═╣ SELinux enabled? ............... sestatus Not Found +═╣ Seccomp enabled? ............... disabled +═╣ AppArmor profile? .............. unconfined +═╣ User namespace? ................ enabled +═╣ Cgroup2 enabled? ............... enabled +═╣ Is ASLR enabled? ............... Yes +═╣ Printer? ....................... No +═╣ Is this a virtual machine? ..... Yes (xen) + + ╔═══════════╗ +═══════════════════════════════════╣ Container ╠═══════════════════════════════════ + ╚═══════════╝ +╔══════════╣ Container related tools present +/snap/bin/lxc +╔══════════╣ Am I Containered? +╔══════════╣ Container details +═╣ Is this a container? ........... No +═╣ Any running containers? ........ No + + + ╔═══════╗ +═════════════════════════════════════╣ Cloud ╠═════════════════════════════════════ + ╚═══════╝ +═╣ Google Cloud Platform? ............... No +═╣ AWS ECS? ............................. No +═╣ AWS EC2? ............................. Yes +═╣ AWS Lambda? .......................... No + +╔══════════╣ AWS EC2 Enumeration +ami-id: ami-08e1d45cf9c4f052a +instance-action: none +instance-id: i-0afcd77fb3fc17f27 +instance-life-cycle: on-demand +instance-type: t2.nano +region: eu-west-1 + +══╣ Account Info +{ + "Code" : "Success", + "LastUpdated" : "2022-08-20T15:11:30Z", + "AccountId" : "739930428441" +} + +══╣ Network Info +Mac: 02:d4:b2:e9:e2:e1/ +Owner ID: 739930428441 +Public Hostname: +Security Groups: AllowEverything +Private IPv4s: + +Subnet IPv4: 10.10.0.0/16 +PrivateIPv6s: + +Subnet IPv6: +Public IPv4s: + + + +══╣ IAM Role + + +══╣ User Data + + + ╔════════════════════════════════════════════════╗ +════════════════╣ Processes, Crons, Timers, Services and Sockets ╠════════════════ + ╚════════════════════════════════════════════════╝ +╔══════════╣ Cleaned processes +╚ Check weird & unexpected proceses run by root: https://book.hacktricks.xyz/linux-hardening/privilege-escalation#processes +root 1 2.1 2.1 167372 10204 ? Ss 15:12 0:27 /sbin/init maybe-ubiquity +root 343 0.3 1.9 35048 9232 ? S) + +╔══════════╣ D-Bus Service Objects list +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#d-bus +NAME PID PROCESS USER CONNECTION UNIT SESSION DESCRIPTION +:1.0 524 systemd-timesyn systemd-timesync :1.0 systemd-timesyncd.service - - +:1.1 581 systemd-resolve systemd-resolve :1.1 systemd-resolved.service - - +:1.10 636 snapd root :1.10 snapd.service - - +:1.11 627 networkd-dispat root :1.11 networkd-dispatcher.service - - +:1.13 785 unattended-upgr root :1.13 unattended-upgrades.service - - +:1.2 578 systemd-network systemd-network :1.2 systemd-networkd.service - - +:1.22 7785 busctl www-data :1.22 apache2.service - - +:1.3 1 systemd root :1.3 init.scope - - +:1.4 601 accounts-daemon[0m root :1.4 accounts-daemon.service - - +:1.5 629 polkitd root :1.5 polkit.service - - +:1.6 642 udisksd root :1.6 udisks2.service - - +:1.7 709 ModemManager root :1.7 ModemManager.service - - +:1.8 640 systemd-logind root :1.8 systemd-logind.service - - +com.ubuntu.LanguageSelector - - - (activatable) - - - +com.ubuntu.SoftwareProperties - - - (activatable) - - - +io.netplan.Netplan - - - (activatable) - - - +org.freedesktop.Accounts 601 accounts-daemon[0m root :1.4 accounts-daemon.service - - +org.freedesktop.DBus 1 systemd root - init.scope - - +org.freedesktop.ModemManager1 709 ModemManager root :1.7 ModemManager.service - - +org.freedesktop.PackageKit - - - (activatable) - - - +org.freedesktop.PolicyKit1 629 polkitd root :1.5 polkit.service - - +org.freedesktop.UDisks2 642 udisksd root :1.6 udisks2.service - - +org.freedesktop.UPower - - - (activatable) - - - +org.freedesktop.bolt - - - (activatable) - - - +org.freedesktop.fwupd - - - (activatable) - - - +org.freedesktop.hostname1 - - - (activatable) - - - +org.freedesktop.locale1 - - - (activatable) - - - +org.freedesktop.login1 640 systemd-logind root :1.8 systemd-logind.service - - +org.freedesktop.network1 578 systemd-network systemd-network :1.2 systemd-networkd.service - - +org.freedesktop.resolve1 581 systemd-resolve systemd-resolve :1.1 systemd-resolved.service - - +org.freedesktop.systemd1 1 systemd root :1.3 init.scope - - +org.freedesktop.thermald - - - (activatable) - - - +org.freedesktop.timedate1 - - - (activatable) - - - +org.freedesktop.timesync1 524 systemd-timesyn systemd-timesync :1.0 systemd-timesyncd.service - - + + + ╔═════════════════════╗ +══════════════════════════════╣ Network Information ╠══════════════════════════════ + ╚═════════════════════╝ +╔══════════╣ Hostname, hosts and DNS +b2r +127.0.0.1 localhost +127.0.1.1 b2r + +::1 ip6-localhost ip6-loopback +fe00::0 ip6-localnet +ff00::0 ip6-mcastprefix +ff02::1 ip6-allnodes +ff02::2 ip6-allrouters + +nameserver 127.0.0.53 +options edns0 trust-ad +search eu-west-1.compute.internal + +╔══════════╣ Interfaces +# symbolic names for networks, see networks(5) for more information +link-local 169.254.0.0 +1: lo: mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000 + link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00 + inet 127.0.0.1/8 scope host lo + valid_lft forever preferred_lft forever + inet6 ::1/128 scope host + valid_lft forever preferred_lft forever +2: eth0: mtu 9001 qdisc fq_codel state UP group default qlen 1000 + link/ether 02:d4:b2:e9:e2:e1 brd ff:ff:ff:ff:ff:ff + inet 10.10.177.92/16 brd 10.10.255.255 scope global dynamic eth0 + valid_lft 2420sec preferred_lft 2420sec + inet6 fe80::d4:b2ff:fee9:e2e1/64 scope link + valid_lft forever preferred_lft forever + +╔══════════╣ Active Ports +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-ports +tcp LISTEN 0 4096 127.0.0.53%lo:53 0.0.0.0:* +tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* +tcp LISTEN 0 511 *:80 *:* +tcp LISTEN 0 128 [::]:22 [::]:* + +╔══════════╣ Can I sniff with tcpdump? +No + + + + ╔═══════════════════╗ +═══════════════════════════════╣ Users Information ╠═══════════════════════════════ + ╚═══════════════════╝ +╔══════════╣ My user +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#users +uid=33(www-data) gid=33(www-data) groups=33(www-data) + +╔══════════╣ Do I have PGP keys? +/usr/bin/gpg +netpgpkeys Not Found +netpgp Not Found + +╔══════════╣ Checking 'sudo -l', /etc/sudoers, and /etc/sudoers.d +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid + +╔══════════╣ Checking sudo tokens +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#reusing-sudo-tokens +ptrace protection is enabled (1) +gdb wasn't found in PATH, this might still be vulnerable but linpeas won't be able to check it + +╔══════════╣ Checking Pkexec policy +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation/interesting-groups-linux-pe#pe-method-2 + +[Configuration] +AdminIdentities=unix-user:0 +[Configuration] +AdminIdentities=unix-group:sudo;unix-group:admin + +╔══════════╣ Superusers +root:x:0:0:root:/root:/bin/bash + +╔══════════╣ Users with console +lachlan:x:1001:1001::/home/lachlan:/bin/sh +root:x:0:0:root:/root:/bin/bash + +╔══════════╣ All users & groups +uid=0(root) gid=0(root) groups=0(root) +uid=1(daemon[0m) gid=1(daemon[0m) groups=1(daemon[0m) +uid=10(uucp) gid=10(uucp) groups=10(uucp) +uid=100(systemd-network) gid=102(systemd-network) groups=102(systemd-network) +uid=1001(lachlan) gid=1001(lachlan) groups=1001(lachlan) +uid=101(systemd-resolve) gid=103(systemd-resolve) groups=103(systemd-resolve) +uid=102(systemd-timesync) gid=104(systemd-timesync) groups=104(systemd-timesync) +uid=103(messagebus) gid=106(messagebus) groups=106(messagebus) +uid=104(syslog) gid=110(syslog) groups=110(syslog),4(adm),5(tty) +uid=105(_apt) gid=65534(nogroup) groups=65534(nogroup) +uid=106(tss) gid=111(tss) groups=111(tss) +uid=107(uuidd) gid=112(uuidd) groups=112(uuidd) +uid=108(tcpdump) gid=113(tcpdump) groups=113(tcpdump) +uid=109(landscape) gid=115(landscape) groups=115(landscape) +uid=110(pollinate) gid=1(daemon[0m) groups=1(daemon[0m) +uid=111(usbmux) gid=46(plugdev) groups=46(plugdev) +uid=112(sshd) gid=65534(nogroup) groups=65534(nogroup) +uid=13(proxy) gid=13(proxy) groups=13(proxy) +uid=2(bin) gid=2(bin) groups=2(bin) +uid=3(sys) gid=3(sys) groups=3(sys) +uid=33(www-data) gid=33(www-data) groups=33(www-data) +uid=34(backup) gid=34(backup) groups=34(backup) +uid=38(list) gid=38(list) groups=38(list) +uid=39(irc) gid=39(irc) groups=39(irc) +uid=4(sync) gid=65534(nogroup) groups=65534(nogroup) +uid=41(gnats) gid=41(gnats) groups=41(gnats) +uid=5(games) gid=60(games) groups=60(games) +uid=6(man) gid=12(man) groups=12(man) +uid=65534(nobody) gid=65534(nogroup) groups=65534(nogroup) +uid=7(lp) gid=7(lp) groups=7(lp) +uid=8(mail) gid=8(mail) groups=8(mail) +uid=9(news) gid=9(news) groups=9(news) +uid=998(lxd) gid=100(users) groups=100(users) +uid=999(systemd-coredump) gid=999(systemd-coredump) groups=999(systemd-coredump) + +╔══════════╣ Login now + 15:34:00 up 21 min, 0 users, load average: 0.46, 0.30, 0.73 +USER TTY FROM LOGIN@ IDLE JCPU PCPU WHAT + +╔══════════╣ Last logons +reboot system boot Sat Aug 20 15:12:59 2022 still running 0.0.0.0 +reboot system boot Thu May 5 04:55:21 2022 - Thu May 5 04:57:39 2022 (00:02) 0.0.0.0 +lachlan pts/0 Thu May 5 04:39:19 2022 - Thu May 5 04:39:27 2022 (00:00) 192.168.56.1 +setup tty1 Thu May 5 04:37:12 2022 - crash (00:18) 0.0.0.0 +reboot system boot Thu May 5 04:36:47 2022 - Thu May 5 04:57:39 2022 (00:20) 0.0.0.0 +setup tty1 Thu May 5 03:48:01 2022 - down (00:02) 0.0.0.0 +reboot system boot Thu May 5 03:46:00 2022 - Thu May 5 03:50:09 2022 (00:04) 0.0.0.0 + +wtmp begins Thu May 5 03:46:00 2022 + +╔══════════╣ Last time logon each user +Username Port From Latest +lachlan pts/0 192.168.56.1 Thu May 5 04:39:19 +0000 2022 + +╔══════════╣ Do not forget to test 'su' as any other user with shell: without password and with their names as password (I can't do it...) + +╔══════════╣ Do not forget to execute 'sudo -l' without password or with valid password (if you know it)!! + + + + ╔══════════════════════╗ +═════════════════════════════╣ Software Information ╠═════════════════════════════ + ╚══════════════════════╝ +╔══════════╣ Searching mysql credentials and exec + +╔══════════╣ Analyzing Apache-Nginx Files (limit 70) +Apache version: Server version: Apache/2.4.41 (Ubuntu) +Server built: 2022-03-16T16:52:53 +httpd Not Found + +Nginx version: nginx Not Found + +══╣ PHP exec extensions +drwxr-xr-x 2 root root 4096 May 5 04:38 /etc/apache2/sites-enabled +drwxr-xr-x 2 root root 4096 May 5 04:38 /etc/apache2/sites-enabled +lrwxrwxrwx 1 root root 35 May 5 04:38 /etc/apache2/sites-enabled/000-default.conf -> ../sites-available/000-default.conf + + ServerAdmin webmaster@localhost + DocumentRoot /var/www/html + ErrorLog ${APACHE_LOG_DIR}/error.log + CustomLog ${APACHE_LOG_DIR}/access.log combined + + + + + +╔══════════╣ Analyzing Rsync Files (limit 70) + + +╔══════════╣ Analyzing Ldap Files (limit 70) +The password hash is from the {SSHA} to 'structural' +drwxr-xr-x 2 root root 4096 Feb 23 08:54 /etc/ldap + + +╔══════════╣ Searching ssl/ssh files +ChallengeResponseAuthentication no +UsePAM yes +══╣ Some certificates were found (out limited): +/etc/pki/fwupd-metadata/LVFS-CA.pem +/etc/pki/fwupd/LVFS-CA.pem +/etc/pollinate/entropy.ubuntu.com.pem +/snap/core20/1328/etc/ssl/certs/ACCVRAIZ1.pem +/snap/core20/1328/etc/ssl/certs/AC_RAIZ_FNMT-RCM.pem +/snap/core20/1328/etc/ssl/certs/Actalis_Authentication_Root_CA.pem +/snap/core20/1328/etc/ssl/certs/AffirmTrust_Commercial.pem +/snap/core20/1328/etc/ssl/certs/AffirmTrust_Networking.pem +/snap/core20/1328/etc/ssl/certs/AffirmTrust_Premium.pem +/snap/core20/1328/etc/ssl/certs/AffirmTrust_Premium_ECC.pem +/snap/core20/1328/etc/ssl/certs/Amazon_Root_CA_1.pem +/snap/core20/1328/etc/ssl/certs/Amazon_Root_CA_2.pem +/snap/core20/1328/etc/ssl/certs/Amazon_Root_CA_3.pem +/snap/core20/1328/etc/ssl/certs/Amazon_Root_CA_4.pem +/snap/core20/1328/etc/ssl/certs/Atos_TrustedRoot_2011.pem +/snap/core20/1328/etc/ssl/certs/Autoridad_de_Certificacion_Firmaprofesional_CIF_A62634068.pem +/snap/core20/1328/etc/ssl/certs/Baltimore_CyberTrust_Root.pem +/snap/core20/1328/etc/ssl/certs/Buypass_Class_2_Root_CA.pem +/snap/core20/1328/etc/ssl/certs/Buypass_Class_3_Root_CA.pem +/snap/core20/1328/etc/ssl/certs/CA_Disig_Root_R2.pem +1803PSTORAGE_CERTSBIN + +══╣ Writable ssh and gpg agents +/etc/systemd/user/sockets.target.wants/gpg-agent-browser.socket +/etc/systemd/user/sockets.target.wants/gpg-agent-ssh.socket +/etc/systemd/user/sockets.target.wants/gpg-agent.socket +/etc/systemd/user/sockets.target.wants/gpg-agent-extra.socket +══╣ Some home ssh config file was found +/usr/share/openssh/sshd_config +Include /etc/ssh/sshd_config.d/*.conf +ChallengeResponseAuthentication no +UsePAM yes +X11Forwarding yes +PrintMotd no +AcceptEnv LANG LC_* +Subsystem sftp /usr/lib/openssh/sftp-server + +══╣ /etc/hosts.allow file found, trying to read the rules: +/etc/hosts.allow + + +Searching inside /etc/ssh/ssh_config for interesting info +Include /etc/ssh/ssh_config.d/*.conf +Host * + SendEnv LANG LC_* + HashKnownHosts yes + GSSAPIAuthentication yes + +╔══════════╣ Analyzing PAM Auth Files (limit 70) +drwxr-xr-x 2 root root 4096 May 5 04:38 /etc/pam.d +-rw-r--r-- 1 root root 2133 Dec 2 2021 /etc/pam.d/sshd + + + + +╔══════════╣ Searching tmux sessions +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#open-shell-sessions +tmux 3.0a + + +/tmp/tmux-33 +╔══════════╣ Analyzing Cloud Init Files (limit 70) + +╔══════════╣ Analyzing Keyring Files (limit 70) +drwxr-xr-x 2 root root 200 Jan 14 2022 /snap/core20/1328/usr/share/keyrings +drwxr-xr-x 2 root root 4096 May 5 03:48 /usr/share/keyrings + + + + +╔══════════╣ Searching uncommon passwd files (splunk) +passwd file: /etc/pam.d/passwd +passwd file: /etc/passwd +passwd file: /snap/core20/1328/etc/pam.d/passwd +passwd file: /snap/core20/1328/etc/passwd +passwd file: /snap/core20/1328/usr/share/bash-completion/completions/passwd +passwd file: /snap/core20/1328/usr/share/lintian/overrides/passwd +passwd file: /snap/core20/1328/var/lib/extrausers/passwd +passwd file: /usr/share/bash-completion/completions/passwd +passwd file: /usr/share/lintian/overrides/passwd + +╔══════════╣ Analyzing PGP-GPG Files (limit 70) +/usr/bin/gpg +gpg Not Found +netpgpkeys Not Found +netpgp Not Found + + + + +╔══════════╣ Analyzing Postfix Files (limit 70) + +╔══════════╣ Analyzing FTP Files (limit 70) + + + + + + + + +╔══════════╣ Analyzing Bind Files (limit 70) + +╔══════════╣ Analyzing Other Interesting Files (limit 70) + + + + + + + + + + + + ╔═══════════════════╗ +═══════════════════════════════╣ Interesting Files ╠═══════════════════════════════ + ╚═══════════════════╝ +╔══════════╣ SUID - Check easy privesc, exploits and write perms +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid +strings Not Found +-rwsr-xr-x 1 root root 140K Feb 23 18:25 /usr/lib/snapd/snap-confine ---> Ubuntu_snapd<2.37_dirty_sock_Local_Privilege_Escalation(CVE-2019-7304) +-rwsr-xr-x 1 root root 23K Feb 21 12:58 /usr/lib/policykit-1/polkit-agent-helper-1 +-rwsr-xr-- 1 root messagebus 51K Jun 11 2020 /usr/lib/dbus-1.0/dbus-daemon-launch-helper +-rwsr-xr-x 1 root root 463K Dec 2 2021 /usr/lib/openssh/ssh-keysign +-rwsr-xr-x 1 root root 15K Jul 8 2019 /usr/lib/eject/dmcrypt-get-device +-rwsr-xr-x 1 root root 39K Mar 7 2020 /usr/bin/fusermount +-rwsr-xr-x 1 root root 67K Feb 7 2022 /usr/bin/su +-rwsr-xr-x 1 root root 44K Jul 14 2021 /usr/bin/newgrp ---> HP-UX_10.20 +-rwsr-xr-x 1 root root 52K Jul 14 2021 /usr/bin/chsh +-rwsr-xr-x 1 root root 39K Feb 7 2022 /usr/bin/umount ---> BSD/Linux(08-1996) +-rwsr-xr-x 1 root root 67K Jul 14 2021 /usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997) +-rwsr-xr-x 1 root root 31K Feb 21 12:58 /usr/bin/pkexec ---> Linux4.10_to_5.1.17(CVE-2019-13272)/rhel_6(CVE-2011-1485) +-rwsr-xr-x 1 root root 163K Jan 19 2021 /usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable +-rwsr-xr-x 1 root root 55K Feb 7 2022 /usr/bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8 +-rwsr-xr-x 1 root root 87K Jul 14 2021 /usr/bin/gpasswd +-rwsr-xr-x 1 root root 84K Jul 14 2021 /usr/bin/chfn ---> SuSE_9.3/10 +-rwsr-sr-x 1 daemon daemon 55K Nov 12 2018 /usr/bin/at ---> RTru64_UNIX_4.0g(CVE-2002-1614) +-rwsr-xr-x 1 root root 121K Feb 15 2022 /snap/snapd/14978/usr/lib/snapd/snap-confine ---> Ubuntu_snapd<2.37_dirty_sock_Local_Privilege_Escalation(CVE-2019-7304) +-rwsr-xr-x 1 root root 84K Jul 14 2021 /snap/core20/1328/usr/bin/chfn ---> SuSE_9.3/10 +-rwsr-xr-x 1 root root 52K Jul 14 2021 /snap/core20/1328/usr/bin/chsh +-rwsr-xr-x 1 root root 87K Jul 14 2021 /snap/core20/1328/usr/bin/gpasswd +-rwsr-xr-x 1 root root 55K Jul 21 2020 /snap/core20/1328/usr/bin/mount ---> Apple_Mac_OSX(Lion)_Kernel_xnu-1699.32.7_except_xnu-1699.24.8 +-rwsr-xr-x 1 root root 44K Jul 14 2021 /snap/core20/1328/usr/bin/newgrp ---> HP-UX_10.20 +-rwsr-xr-x 1 root root 67K Jul 14 2021 /snap/core20/1328/usr/bin/passwd ---> Apple_Mac_OSX(03-2006)/Solaris_8/9(12-2004)/SPARC_8/9/Sun_Solaris_2.3_to_2.5.1(02-1997) +-rwsr-xr-x 1 root root 67K Jul 21 2020 /snap/core20/1328/usr/bin/su +-rwsr-xr-x 1 root root 163K Jan 19 2021 /snap/core20/1328/usr/bin/sudo ---> check_if_the_sudo_version_is_vulnerable +-rwsr-xr-x 1 root root 39K Jul 21 2020 /snap/core20/1328/usr/bin/umount ---> BSD/Linux(08-1996) +-rwsr-xr-- 1 root systemd-resolve 51K Jun 11 2020 /snap/core20/1328/usr/lib/dbus-1.0/dbus-daemon-launch-helper +-rwsr-xr-x 1 root root 463K Dec 2 2021 /snap/core20/1328/usr/lib/openssh/ssh-keysign + +╔══════════╣ SGID +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#sudo-and-suid +-rwxr-sr-x 1 root utmp 15K Sep 30 2019 /usr/lib/x86_64-linux-gnu/utempter/utempter +-rwxr-sr-x 1 root shadow 83K Jul 14 2021 /usr/bin/chage +-rwxr-sr-x 1 root crontab 43K Feb 13 2020 /usr/bin/crontab +-rwxr-sr-x 1 root tty 15K Mar 30 2020 /usr/bin/bsd-write +-rwxr-sr-x 1 root shadow 31K Jul 14 2021 /usr/bin/expiry +-rwxr-sr-x 1 root ssh 343K Dec 2 2021 /usr/bin/ssh-agent +-rwxr-sr-x 1 root tty 35K Feb 7 2022 /usr/bin/wall +-rwsr-sr-x 1 daemon daemon 55K Nov 12 2018 /usr/bin/at ---> RTru64_UNIX_4.0g(CVE-2002-1614) +-rwxr-sr-x 1 root shadow 43K Sep 17 2021 /usr/sbin/pam_extrausers_chkpwd +-rwxr-sr-x 1 root shadow 43K Sep 17 2021 /usr/sbin/unix_chkpwd +-rwxr-sr-x 1 root shadow 83K Jul 14 2021 /snap/core20/1328/usr/bin/chage +-rwxr-sr-x 1 root shadow 31K Jul 14 2021 /snap/core20/1328/usr/bin/expiry +-rwxr-sr-x 1 root crontab 343K Dec 2 2021 /snap/core20/1328/usr/bin/ssh-agent +-rwxr-sr-x 1 root tty 35K Jul 21 2020 /snap/core20/1328/usr/bin/wall +-rwxr-sr-x 1 root shadow 43K Sep 17 2021 /snap/core20/1328/usr/sbin/pam_extrausers_chkpwd +-rwxr-sr-x 1 root shadow 43K Sep 17 2021 /snap/core20/1328/usr/sbin/unix_chkpwd + +╔══════════╣ Checking misconfigurations of ld.so +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#ld-so +/etc/ld.so.conf +include /etc/ld.so.conf.d/*.conf + +/etc/ld.so.conf.d + /etc/ld.so.conf.d/libc.conf +/usr/local/lib + /etc/ld.so.conf.d/x86_64-linux-gnu.conf +/usr/local/lib/x86_64-linux-gnu +/lib/x86_64-linux-gnu +/usr/lib/x86_64-linux-gnu + +╔══════════╣ Capabilities +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities +Current env capabilities: +Current: = +Current proc capabilities: +CapInh: 0000000000000000 +CapPrm: 0000000000000000 +CapEff: 0000000000000000 +CapBnd: 0000003fffffffff +CapAmb: 0000000000000000 + +Parent Shell capabilities: +0x0000000000000000= + +Files with capabilities (limited to 50): +/usr/lib/x86_64-linux-gnu/gstreamer1.0/gstreamer-1.0/gst-ptp-helper = cap_net_bind_service,cap_net_admin+ep +/usr/bin/ping = cap_net_raw+ep +/usr/bin/mtr-packet = cap_net_raw+ep +/usr/bin/traceroute6.iputils = cap_net_raw+ep +/snap/core20/1328/usr/bin/ping = cap_net_raw+ep + +╔══════════╣ Users with capabilities +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#capabilities + +╔══════════╣ AppArmor binary profiles +-rw-r--r-- 1 root root 3222 Mar 11 2020 sbin.dhclient +-rw-r--r-- 1 root root 3202 Feb 25 2020 usr.bin.man +-rw-r--r-- 1 root root 28249 Feb 18 2022 usr.lib.snapd.snap-confine.real +-rw-r--r-- 1 root root 1575 Feb 11 2020 usr.sbin.rsyslogd +-rw-r--r-- 1 root root 1385 Dec 7 2019 usr.sbin.tcpdump + +╔══════════╣ Files with ACLs (limited to 50) +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#acls +files with acls in searched folders Not Found + +╔══════════╣ .sh files in path +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#script-binaries-in-path +/usr/bin/gettext.sh +/usr/bin/rescan-scsi-bus.sh + +╔══════════╣ Executable files added by user (limit 70) +2022-05-05+03:46:05.2439999400 /etc/console-setup/cached_setup_font.sh +2022-05-05+03:46:05.2439999400 /etc/console-setup/cached_setup_keyboard.sh +2022-05-05+03:46:05.2439999400 /etc/console-setup/cached_setup_terminal.sh +╔══════════╣ Unexpected in root + +╔══════════╣ Files (scripts) in /etc/profile.d/ +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#profiles-files +total 44 +drwxr-xr-x 2 root root 4096 May 5 03:48 . +drwxr-xr-x 102 root root 4096 May 5 04:55 .. +-rw-r--r-- 1 root root 96 Dec 5 2019 01-locale-fix.sh +-rw-r--r-- 1 root root 1557 Feb 17 2020 Z97-byobu.sh +-rwxr-xr-x 1 root root 3417 Nov 3 2021 Z99-cloud-locale-test.sh +-rwxr-xr-x 1 root root 873 Nov 3 2021 Z99-cloudinit-warnings.sh +-rw-r--r-- 1 root root 835 Feb 18 2022 apps-bin-path.sh +-rw-r--r-- 1 root root 729 Feb 2 2020 bash_completion.sh +-rw-r--r-- 1 root root 1003 Aug 13 2019 cedilla-portuguese.sh +-rw-r--r-- 1 root root 1107 Nov 3 2019 gawk.csh +-rw-r--r-- 1 root root 757 Nov 3 2019 gawk.sh + +╔══════════╣ Permissions in init, init.d, systemd, and rc.d +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#init-init-d-systemd-and-rc-d + +═╣ Hashes inside passwd file? ........... No +═╣ Writable passwd file? ................ No +═╣ Credentials in fstab/mtab? ........... No +═╣ Can I read shadow files? ............. No +═╣ Can I read shadow plists? ............ No +═╣ Can I write shadow plists? ........... No +═╣ Can I read opasswd file? ............. No +═╣ Can I write in network-scripts? ...... No +═╣ Can I read root folder? .............. No + +╔══════════╣ Searching root files in home dirs (limit 30) +/home/ +/root/ + +╔══════════╣ Searching folders owned by me containing others files on it (limit 100) + +╔══════════╣ Readable files belonging to root and readable by me but not world readable + +╔══════════╣ Modified interesting files in the last 5mins (limit 100) +/var/log/kern.log +/var/log/syslog +/var/log/auth.log +/var/log/journal/113cfd14aea5442b9c02d5a5f48b55bb/system.journal + +╔══════════╣ Writable log files (logrotten) (limit 50) +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#logrotate-exploitation +logrotate 3.14.0 + + Default mail command: /usr/bin/mail + Default compress command: /bin/gzip + Default uncompress command: /bin/gunzip + Default compress extension: .gz + Default state file path: /var/lib/logrotate/status + ACL support: yes + SELinux support: yes + +╔══════════╣ Files inside /home/www-data (limit 20) + +╔══════════╣ Files inside others home (limit 20) +/home/lachlan/.profile +/home/lachlan/.bash_logout +/home/lachlan/bin/backup.sh +/home/lachlan/.bashrc +/home/lachlan/.bash_history +/home/lachlan/user.txt + +╔══════════╣ Searching installed mail applications + +╔══════════╣ Mails (limit 50) + +╔══════════╣ Backup files (limited 100) +-rw-r--r-- 1 lachlan lachlan 56 May 5 04:38 /home/lachlan/bin/backup.sh +-rw-r--r-- 1 root root 9833 Apr 8 08:44 /usr/lib/modules/5.4.0-109-generic/kernel/drivers/power/supply/wm831x_backup.ko +-rw-r--r-- 1 root root 9073 Apr 8 08:44 /usr/lib/modules/5.4.0-109-generic/kernel/drivers/net/team/team_mode_activebackup.ko +-rw-r--r-- 1 root root 1413 May 5 03:48 /usr/lib/python3/dist-packages/sos/report/plugins/__pycache__/ovirt_engine_backup.cpython-38.pyc +-rw-r--r-- 1 root root 1802 Feb 15 2022 /usr/lib/python3/dist-packages/sos/report/plugins/ovirt_engine_backup.py +-rw-r--r-- 1 root root 44048 Oct 12 2021 /usr/lib/x86_64-linux-gnu/open-vm-tools/plugins/vmsvc/libvmbackup.so +-rwxr-xr-x 1 root root 1086 Nov 25 2019 /usr/src/linux-headers-5.4.0-109/tools/testing/selftests/net/tcp_fastopen_backup_key.sh +-rw-r--r-- 1 root root 237986 Apr 8 08:44 /usr/src/linux-headers-5.4.0-109-generic/.config.old +-rw-r--r-- 1 root root 0 Apr 8 08:44 /usr/src/linux-headers-5.4.0-109-generic/include/config/net/team/mode/activebackup.h +-rw-r--r-- 1 root root 0 Apr 8 08:44 /usr/src/linux-headers-5.4.0-109-generic/include/config/wm831x/backup.h +-rw-r--r-- 1 root root 2756 Feb 13 2020 /usr/share/man/man8/vgcfgbackup.8.gz +-rw-r--r-- 1 root root 11886 May 5 03:43 /usr/share/info/dir.old +-rw-r--r-- 1 root root 7867 Jul 16 1996 /usr/share/doc/telnet/README.old.gz +-rw-r--r-- 1 root root 392817 Feb 9 2020 /usr/share/doc/manpages/Changes.old.gz +-rwxr-xr-x 1 root root 226 Feb 17 2020 /usr/share/byobu/desktop/byobu.desktop.old +-rw-r--r-- 1 root root 2743 Feb 23 08:56 /etc/apt/sources.list.curtin.old + +╔══════════╣ Searching tables inside readable .db/.sql/.sqlite files (limit 100) +Found /var/lib/PackageKit/transactions.db: SQLite 3.x database, last written using SQLite version 3031001 +Found /var/lib/command-not-found/commands.db: SQLite 3.x database, last written using SQLite version 3031001 + + -> Extracting tables from /var/lib/PackageKit/transactions.db (limit 20) + -> Extracting tables from /var/lib/command-not-found/commands.db (limit 20) + +╔══════════╣ Web files?(output limit) +/var/www/: +total 12K +drwxr-xr-x 3 root root 4.0K May 5 04:38 . +drwxr-xr-x 14 root root 4.0K May 5 04:38 .. +drwxr-xr-x 6 www-data www-data 4.0K May 5 04:38 html + +/var/www/html: +total 32K +drwxr-xr-x 6 www-data www-data 4.0K May 5 04:38 . +drwxr-xr-x 3 root root 4.0K May 5 04:38 .. + +╔══════════╣ All hidden files (not in /sys/ or the ones listed in the previous check) (limit 70) +-rw-r--r-- 1 lachlan lachlan 220 Feb 25 2020 /home/lachlan/.bash_logout +-rw------- 1 root root 0 Jan 14 2022 /snap/core20/1328/etc/.pwd.lock +-rw-r--r-- 1 root root 220 Feb 25 2020 /snap/core20/1328/etc/skel/.bash_logout +-rw-r--r-- 1 landscape landscape 0 Feb 23 08:55 /var/lib/landscape/.cleanup.user +-rw-r--r-- 1 root root 220 Feb 25 2020 /etc/skel/.bash_logout +-rw------- 1 root root 0 Feb 23 08:50 /etc/.pwd.lock +-rw------- 1 root root 0 Aug 20 15:15 /run/snapd/lock/.lock +-rw-r--r-- 1 root root 20 Aug 20 15:14 /run/cloud-init/.instance-id +-rw-r--r-- 1 root root 2 Aug 20 15:13 /run/cloud-init/.ds-identify.result + +╔══════════╣ Readable files inside /tmp, /var/tmp, /private/tmp, /private/var/at/tmp, /private/var/tmp, and backup folders (limit 70) + +╔══════════╣ Interesting writable files owned by me or writable by everyone (not in Home) (max 500) +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files +/dev/mqueue +/dev/shm +/dev/shm/linlog +/dev/shm/linpeas.sh +/run/lock +/run/lock/apache2 +/run/screen +/snap/core20/1328/run/lock +/snap/core20/1328/tmp +/snap/core20/1328/var/tmp +/tmp +/tmp/tmux-33 +/var/cache/apache2/mod_cache_disk +/var/crash +/var/lib/php/sessions +/var/tmp +/var/www/html +/var/www/html/css +/var/www/html/css/custom.css +/var/www/html/cvs +/var/www/html/cvs/index.html +/var/www/html/cvs/shell.pdf.php +/var/www/html/dist +/var/www/html/dist/css +/var/www/html/dist/css/normalize.css +/var/www/html/dist/css/skeleton.css +/var/www/html/dist/images +/var/www/html/images +/var/www/html/index.html +/var/www/html/upload.php + +╔══════════╣ Interesting GROUP writable files (not in Home) (max 500) +╚ https://book.hacktricks.xyz/linux-hardening/privilege-escalation#writable-files + Group www-data: +/dev/shm/linlog +/dev/shm/linpeas.sh + +╔══════════╣ Searching passwords in history files +echo -e "dHY5pzmNYoETv7SUaY\nthisistheway123\nthisistheway123" | passwd + +╔══════════╣ Searching *password* or *credential* files in home (limit 70) +/etc/pam.d/common-password +/usr/bin/systemd-ask-password +/usr/bin/systemd-tty-ask-password-agent +/usr/lib/git-core/git-credential +/usr/lib/git-core/git-credential-cache +/usr/lib/git-core/git-credential-cache--daemon +/usr/lib/git-core/git-credential-store + #)There are more creds/passwds files in the previous parent folder + +/usr/lib/grub/i386-pc/password.mod +/usr/lib/grub/i386-pc/password_pbkdf2.mod +/usr/lib/python3/dist-packages/cloudinit/config/__pycache__/cc_set_passwords.cpython-38.pyc +/usr/lib/python3/dist-packages/cloudinit/config/cc_set_passwords.py +/usr/lib/python3/dist-packages/keyring/__pycache__/credentials.cpython-38.pyc +/usr/lib/python3/dist-packages/keyring/credentials.py +/usr/lib/python3/dist-packages/launchpadlib/__pycache__/credentials.cpython-38.pyc +/usr/lib/python3/dist-packages/launchpadlib/credentials.py +/usr/lib/python3/dist-packages/launchpadlib/tests/__pycache__/test_credential_store.cpython-38.pyc +/usr/lib/python3/dist-packages/launchpadlib/tests/test_credential_store.py +/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/__pycache__/client_credentials.cpython-38.pyc +/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/__pycache__/resource_owner_password_credentials.cpython-38.pyc +/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/client_credentials.py +/usr/lib/python3/dist-packages/oauthlib/oauth2/rfc6749/grant_types/resource_owner_password_credentials.py +/usr/lib/python3/dist-packages/twisted/cred/__pycache__/credentials.cpython-38.pyc +/usr/lib/python3/dist-packages/twisted/cred/credentials.py +/usr/lib/systemd/system/multi-user.target.wants/systemd-ask-password-wall.path +/usr/lib/systemd/system/sysinit.target.wants/systemd-ask-password-console.path +/usr/lib/systemd/system/systemd-ask-password-console.path +/usr/lib/systemd/system/systemd-ask-password-console.service +/usr/lib/systemd/system/systemd-ask-password-plymouth.path +/usr/lib/systemd/system/systemd-ask-password-plymouth.service + #)There are more creds/passwds files in the previous parent folder + +/usr/share/doc/git/contrib/credential +/usr/share/doc/git/contrib/credential/gnome-keyring/git-credential-gnome-keyring.c +/usr/share/doc/git/contrib/credential/libsecret/git-credential-libsecret.c +/usr/share/doc/git/contrib/credential/netrc/git-credential-netrc +/usr/share/doc/git/contrib/credential/netrc/t-git-credential-netrc.sh +/usr/share/doc/git/contrib/credential/osxkeychain/git-credential-osxkeychain.c +/usr/share/doc/git/contrib/credential/wincred/git-credential-wincred.c +/usr/share/man/man1/git-credential-cache--daemon.1.gz +/usr/share/man/man1/git-credential-cache.1.gz +/usr/share/man/man1/git-credential-store.1.gz +/usr/share/man/man1/git-credential.1.gz + #)There are more creds/passwds files in the previous parent folder + +/usr/share/man/man7/gitcredentials.7.gz +/usr/share/man/man8/systemd-ask-password-console.path.8.gz +/usr/share/man/man8/systemd-ask-password-console.service.8.gz + +╔══════════╣ Checking for TTY (sudo/su) passwords in audit logs + +╔══════════╣ Searching passwords inside logs (limit 70) + base-passwd depends on libc6 (>= 2.8); however: + base-passwd depends on libdebconfclient0 (>= 0.145); however: +2022-02-23 08:50:00 configure base-passwd:amd64 3.5.47 3.5.47 +2022-02-23 08:50:00 install base-passwd:amd64 3.5.47 +2022-02-23 08:50:00 status half-configured base-passwd:amd64 3.5.47 +2022-02-23 08:50:00 status half-installed base-passwd:amd64 3.5.47 +2022-02-23 08:50:00 status installed base-passwd:amd64 3.5.47 +2022-02-23 08:50:00 status unpacked base-passwd:amd64 3.5.47 +2022-02-23 08:50:05 status half-configured base-passwd:amd64 3.5.47 +2022-02-23 08:50:05 status half-installed base-passwd:amd64 3.5.47 +2022-02-23 08:50:05 status unpacked base-passwd:amd64 3.5.47 +2022-02-23 08:50:05 upgrade base-passwd:amd64 3.5.47 3.5.47 +2022-02-23 08:50:14 install passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:50:14 status half-installed passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:50:14 status unpacked passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:50:17 configure base-passwd:amd64 3.5.47 +2022-02-23 08:50:17 status half-configured base-passwd:amd64 3.5.47 +2022-02-23 08:50:17 status installed base-passwd:amd64 3.5.47 +2022-02-23 08:50:17 status unpacked base-passwd:amd64 3.5.47 +2022-02-23 08:50:20 configure passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:50:20 status half-configured passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:50:20 status installed passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:50:20 status unpacked passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:52:18 status half-configured passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:52:18 status half-installed passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:52:18 status unpacked passwd:amd64 1:4.8.1-1ubuntu5 +2022-02-23 08:52:18 upgrade passwd:amd64 1:4.8.1-1ubuntu5 1:4.8.1-1ubuntu5.20.04.1 +2022-02-23 08:52:19 configure passwd:amd64 1:4.8.1-1ubuntu5.20.04.1 +2022-02-23 08:52:19 status half-configured passwd:amd64 1:4.8.1-1ubuntu5.20.04.1 +2022-02-23 08:52:19 status installed passwd:amd64 1:4.8.1-1ubuntu5.20.04.1 +2022-02-23 08:52:19 status unpacked passwd:amd64 1:4.8.1-1ubuntu5.20.04.1 +2022-05-05 03:46:20,473 - cc_set_passwords.py[DEBUG]: Leaving SSH config 'PasswordAuthentication' unchanged. ssh_pwauth=None +2022-05-05 03:46:20,473 - handlers.py[DEBUG]: finish: modules-config/config-set-passwords: SUCCESS: config-set-passwords ran successfully +2022-05-05 03:46:20,473 - util.py[DEBUG]: Writing to /var/lib/cloud/instances/iid-datasource-none/sem/config_set_passwords - wb: [644] 25 bytes +2022-05-05 04:37:06,411 - handlers.py[DEBUG]: finish: modules-config/config-set-passwords: SUCCESS: config-set-passwords previously ran +2022-05-05 04:37:06,411 - helpers.py[DEBUG]: config-set-passwords already ran (freq=once-per-instance) +2022-05-05 04:55:41,029 - handlers.py[DEBUG]: finish: modules-config/config-set-passwords: SUCCESS: config-set-passwords previously ran +2022-05-05 04:55:41,029 - helpers.py[DEBUG]: config-set-passwords already ran (freq=once-per-instance) +2022-08-20 15:16:00,365 - handlers.py[DEBUG]: finish: modules-config/config-set-passwords: SUCCESS: config-set-passwords previously ran +2022-08-20 15:16:00,365 - helpers.py[DEBUG]: config-set-passwords already ran (freq=once-per-instance) +Preparing to unpack .../base-passwd_3.5.47_amd64.deb ... +Preparing to unpack .../passwd_1%3a4.8.1-1ubuntu5_amd64.deb ... +Selecting previously unselected package base-passwd. +Selecting previously unselected package passwd. +Setting up base-passwd (3.5.47) ... +Setting up passwd (1:4.8.1-1ubuntu5) ... +Shadow passwords are now on. +Unpacking base-passwd (3.5.47) ... +Unpacking base-passwd (3.5.47) over (3.5.47) ... +Unpacking passwd (1:4.8.1-1ubuntu5) ... +[ 9.076613] systemd[1]: Started Forward Password Requests to Wall Directory Watch. +[ 38.055933] systemd[1]: Started Forward Password Requests to Wall Directory Watch. +dpkg: base-passwd: dependency problems, but configuring anyway as you requested: + + + + ╔════════════════╗ +════════════════════════════════╣ API Keys Regex ╠════════════════════════════════ + ╚════════════════╝ +Regexes to search for API keys aren't activated, use param '-r' + + -- cgit v1.2.3