INITIALIZING SYS KERNEL v4.10.1998 BYPASS FIREWALL 192.168.1.1 OK ACCESSING MAINFRAME GRANTED root@localhost:~# nmap -sS -O 192.168.0.0/24 Starting Nmap 7.94 scan report HOST_UP latency 0.0042s PORT STATE SERVICE 22/tcp open ssh 80/tcp open http 443/tcp open https 3306/tcp open mysql 8080/tcp open proxy # cat /etc/shadow | grep -v nologin root:$6$xyz$abc1234567890:19000:0:99999:7::: daemon:*:18375:0:99999:7::: # id && whoami uid=0(root) gid=0(root) root # find / -name "*.key" 2>/dev/null /etc/ssl/private/server.key /home/user/.ssh/id_rsa # openssl rsautl -decrypt -inkey server.key -in secret.enc DECRYPTED: PASSWORD=H4X0R_1998 # hexdump -C /dev/mem 00000000 53 ff 00 f0 53 ff 00 f0 c3 e2 00 f0 53 ff 00 f0 00000010 a0 5d 00 f0 70 60 00 f0 00 00 00 00 00 00 00 00 00000020 ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff ff # traceroute mainframe.gov 1 192.168.1.1 1.234ms 2 10.0.0.1 8.456ms 3 72.14.192.1 12.789ms 4 mainframe.gov 15.123ms # nc -lvnp 4444 Listening on 0.0.0.0:4444 Connection received SHELL SPAWNED uid=0 PRIVILEGE ESCALATION COMPLETE DOWNLOADING DATABASE [####################] 100% 2.4GB ENCRYPTING PAYLOAD AES-256-CBC COVERING TRACKS rm -rf /var/log/* /tmp/.session history -c MISSION COMPLETE ACCESS GRANTED WELCOME BACK INITIATING PHASE TWO UPLINK ESTABLISHED SATELLITE LOCKED TARGET ACQUIRED EXECUTING PAYLOAD KERNEL PANIC... just kidding :) REBOOTING MAINFRAME SYNCHRONIZING CLOCKS INJECTING SHELLCODE 0x41414141 BUFFER OVERFLOW DETECTED BYPASSING CANARY NOP SLED PLACED RET2LIBC GADGET FOUND STACK PIVOTED SIGRETURN CHAINED GOT OVERWRITE CONFIRMED LIBC BASE 0x7f3a2b1c0000 SYSTEM CALL rax=59 rdi=/bin/sh EXECVE ROOT SHELL OBTAINED

_