command-line-murders/i-0b81acfb847178c03
by SadServersMore by SadServers
a.out agent webserver.py $ admin@i-072b43453825ba99a:~$ find / -perm -u=s -type f 2>/dev/null /usr/lib/openssh/ssh-keysign /usr/lib/dbus-1.0/dbus-daemon-launch-helper /usr/bin/chsh /usr/bin/umount /usr/bin/mount /usr/bin/passwd /usr/bin/newgrp /usr/bin/sudo /usr/bin/chfn /usr/bin/su /usr/bin/gpasswd admin@i-072b43453825ba99a:~$ ./a.out /usr/bin/su
paris/i-072b43453825ba99a 03:20
by SadServersSep 17 16:44:46 i-0632cd9440ade6896 useradd[568]: add 'admin' to shadow group 'cSep 17 16:44:46 i-0632cd9440ade6896 useradd[568]: add 'admin' to shadow group 'fSep 17 16:44:46 i-0632cd9440ade6896 useradd[568]: add 'admin' to shadow group 'sSep 17 16:44:46 i-0632cd9440ade6896 useradd[568]: add 'admin' to shadow group 'aSep 17 16:44:46 i-0632cd9440ade6896 useradd[568]: add 'admin' to shadow group 'dSep 17 16:44:46 i-0632cd9440ade6896 useradd[568]: add 'admin' to shadow group 'vSep 17 16:44:46 i-0632cd9440ade6896 useradd[568]: add 'admin' to shadow group 'pSep 17 16:44:46 i-0632cd9440ade6896 useradd[568]: add 'admin' to shadow group 'nSep 17 16:44:46 i-0632cd9440ade6896 dhclient[485]: XMT: Solicit on ens5, intervaSep 17 16:44:46 i-0632cd9440ade6896 passwd[575]: password for 'admin' changed bySep 17 16:44:47 i-0632cd9440ade6896 cloud-init[536]: Generating public/private rSep 17 16:44:47 i-0632cd9440ade6896 cloud-init[536]: Your identification has beeSep 17 16:44:47 i-0632cd9440ade6896 cloud-init[536]: Your public key has been saSep 17 16:44:47 i-0632cd9440ade6896 cloud-init[536]: The key fingerprint is: lines 601-640
paris/i-0992a0adcae627e51 05:12
by SadServersrm: cannot remove 'datafile': Permission denied admin@i-0726590fe1fcdef99:/mnt/new_partition$ sudo srm datafile sudo: srm: command not found admin@i-0726590fe1fcdef99:/mnt/new_partition$ sudo rm datafile admin@i-0726590fe1fcdef99:/mnt/new_partition$ ls lost+found admin@i-0726590fe1fcdef99:/mnt/new_partition$ cd / admin@i-0726590fe1fcdef99:/$ ls bin dev home lib32 libx32 media opt root sbin sys usr boot etc lib lib64 lost+found mnt proc run srv tmp var admin@i-0726590fe1fcdef99:/$ cd home/admin/ admin@i-0726590fe1fcdef99:~$ ls agent data datafile kihei admin@i-0726590fe1fcdef99:~$ ln -s /mnt/new_partition/ test admin@i-0726590fe1fcdef99:~$ ls