SadServers Joined on September 10, 2023

admin@i-01191606e4ecb5011:/proc/573$ cd fd                                      bash: cd: fd: Permission denied                                                 admin@i-01191606e4ecb5011:/proc/573$ ls                                         ls: cannot read symbolic link 'cwd': Permission denied                          ls: cannot read symbolic link 'root': Permission denied                         ls: cannot read symbolic link 'exe': Permission denied                          arch_status  clear_refs          cpuset   fdinfo    map_files  mountstats  oom_sattr         cmdline             cwd      gid_map   maps       net         oom_sautogroup    comm                environ  io        mem        ns          pagemauxv         coredump_filter     exe      limits    mountinfo  numa_maps   patchcgroup       cpu_resctrl_groups  fd       loginuid  mounts     oom_adj     persoadmin@i-01191606e4ecb5011:/proc/573$ cd ~                                       admin@i-01191606e4ecb5011:~$                                                    admin@i-01191606e4ecb5011:~$                                                    admin@i-01191606e4ecb5011:~$ curl localhost:5                                   

-rw-r-----  1 root    adm              19K Dec 27 19:31 cloud-init-output.log   -rw-r--r--  1 root    adm             431K Dec 27 19:31 cloud-init.log          -rw-rw-r--  1 root    utmp             67K Dec 27 19:31 wtmp                    drwxrwxrwx  2 admin   root            4.0K Dec 27 19:31 cast                    -rw-r-----  1 root    adm              382 Dec 27 19:34 auth.log                -rw-r--r--  1 root    root            1.7K Dec 27 19:35 minio.log               -rw-r-----  1 root    adm             5.7K Dec 27 19:35 syslog                  -rw-r-----  1 root    adm             4.8K Dec 27 19:35 daemon.log              admin@i-0b08defdd5c8ae4b9:~$                                                    admin@i-0b08defdd5c8ae4b9:~$ ls -ltrh                                           total 8.0K                                                                      -rwxrwx--- 1 root  root  360 Sep 24  2023 webserver.py                          drwxr-xr-x 2 admin root 4.0K Sep 24  2023 agent                                 admin@i-0b08defdd5c8ae4b9:~$                                                    admin@i-0b08defdd5c8ae4b9:~$ chmo                                               

lsof      690                    admin  mem       REG              259,3    1868nux-gnu/libdl-2.31.so                                                           lsof      690                    admin  mem       REG              259,3   61712nux-gnu/libpcre2-8.so.0.10.1                                                    lsof      690                    admin  mem       REG              259,3  190153nux-gnu/libc-2.31.so                                                            lsof      690                    admin  mem       REG              259,3   16612nux-gnu/libselinux.so.1                                                         lsof      690                    admin  mem       REG              259,3   17792nux-gnu/ld-2.31.so                                                              lsof      690                    admin    4r     FIFO               0,11      0tlsof      690                    admin    7w     FIFO               0,11      0tadmin@i-0d1968090649e4ae7:~$ strace hihei                                       strace: Can't stat 'hihei': No such file or directory                           admin@i-0d1968090649e4ae7:~$ strace ki                                          

root@i-0325143284d4058c7:~#                                                     root@i-0325143284d4058c7:~# pvs                                                   PV         VG Fmt  Attr PSize    PFree                                          /dev/sdb1     lvm2 ---  1022.98m 1022.98m                                     root@i-0325143284d4058c7:~#                                                     root@i-0325143284d4058c7:~# pvcreate /dev/nvme2n1p1                               Physical volume "/dev/nvme2n1p1" successfully created.                        root@i-0325143284d4058c7:~#                                                     root@i-0325143284d4058c7:~# pvs                                                   PV         VG Fmt  Attr PSize    PFree                                          /dev/sdb1     lvm2 ---  1022.98m 1022.98m                                       /dev/sdc1     lvm2 ---  1022.98m 1022.98m                                     root@i-0325143284d4058c7:~#                                                     root@i-0325143284d4058c7:~#                                                     root@i-0325143284d4058c7:~# vgcreate te                                         

nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin                      _apt:x:100:65534::/nonexistent:/usr/sbin/nologin                                messagebus:x:101:101::/nonexistent:/usr/sbin/nologin                            uuidd:x:102:102::/run/uuidd:/usr/sbin/nologin                                   tcpdump:x:103:103::/nonexistent:/usr/sbin/nologin                               _chrony:x:104:104:Chrony daemon,,,:/var/lib/chrony:/usr/sbin/nologin            systemd-network:x:105:106:systemd Network Management,,,:/run/systemd:/usr/sbin/nsystemd-resolve:x:106:107:systemd Resolver,,,:/run/systemd:/usr/sbin/nologin    sshd:x:107:65534::/run/sshd:/usr/sbin/nologin                                   systemd-timesync:x:999:999:systemd Time Synchronization:/:/usr/sbin/nologin     systemd-coredump:x:998:998:systemd Core Dumper:/:/usr/sbin/nologin              admin:x:1000:1000:Debian:/home/admin:/bin/bash                                  admin@i-0f0c9e55a5c0d9a6f:~$ ls                                                 agent  webserver.py                                                             admin@i-0f0c9e55a5c0d9a6f:~$ tcpdump                                            

ternal/cpu.maxExtendedFunctionInformationpath..inittaskpath.ErrBadPatterngo.itabuego.itab.*os.File,io.Writergo.itab.*strconv.NumError,errorgo.itab.*reflect.rtypag.durationValue,flag.Valuego.itab.*flag.float64Value,flag.Valuego.itab.*flag.in*flag.int64Value,flag.Valuego.itab.*flag.stringValue,flag.Valuego.itab.*flag.uin*flag.uint64Value,flag.Valuego.itab.*strings.Builder,io.Writergo.itab.*errors.ermt.wrapError,errorgo.itab.*fmt.pp,fmt.Statego.itab.*os.File,io.Readergo.itab.systab.*io/fs.PathError,errorgo.itab.*os.SyscallError,errorgo.itab.syscall.Errno,erio.Writergo.itab.*os.fileStat,io/fs.FileInfogo.itab.*io.LimitedReader,io.Readerggo.itab.*os/exec.ExitError,errorgo.itab.*os/exec.Error,errorgo.itab.*bufio.Reader.UnknownUserIdError,errorgo.itab.*internal/reflectlite.rtype,internal/reflectliizeError,errorgo.itab.*internal/fmtsort.SortedMap,sort.Interfacego.itab.runtime.t_cgo_thread_start_cgo_notify_runtime_init_done_cgo_callers_cgo_yield_cgo_mmap_cntime.mainPCgo.itab.*internal/poll.DeadlineExceededError,errorgo.itab.internal/pntime.defaultGOROOT.strruntime.buildVersion.strruntime.modinfo.strtype.*runtime.747fbb3138398c:~$                                                               

  -M,--ismountpoint     fulfill request only if NAME is a mount point             -n,--namespace SPACE  search in this name space (file, udp, or tcp)             -s,--silent           silent operation                                          -SIGNAL               send this signal instead of SIGKILL                       -u,--user             display user IDs                                          -v,--verbose          verbose output                                            -w,--writeonly        kill only processes with write access                     -V,--version          display version information                               -4,--ipv4             search IPv4 sockets only                                  -6,--ipv6             search IPv6 sockets only                                  -                     reset options                                                                                                                             udp/tcp names: [local_port][,[rmt_host][,[rmt_port]]]                                                                                                         admin@i-0c38afa742070df59:~$ fuser -a                                           

admin@i-0b1e982dbcc49e3f7:~$ ls                                                 agent  webserver.py                                                             admin@i-0b1e982dbcc49e3f7:~$                                                    

                                                                                    #1) Respect the privacy of others.                                              #2) Think before you type.                                                      #3) With great power comes great responsibility.                                                                                                            [sudo] password for admin:                                                      Sorry, try again.                                                               [sudo] password for admin:                                                      sudo: 1 incorrect password attempt                                              admin@i-07fd8f25e7494821e:~$ ls                                                 agent  webserver.py                                                             admin@i-07fd8f25e7494821e:~$ docker ps                                          bash: docker: command not found                                                 admin@i-07fd8f25e7494821e:~$ ^C                                                 admin@i-07fd8f25e7494821e:~$                                                    

admin@i-0c111f859fbef3091:/usr/lib$ ls                                          NetworkManager  ifupdown                              networkd-dispatcher  sudo X11             init                                  openssh              sysctapparmor        kernel                                os-release           systeapt             klibc                                 pam.d                sysusbinfmt.d        klibc-YUkGbOClhnaZRUUd4cUed0X2XZI.so  python2.7            tc   cloud-init      libsupp.a                             python3              termidbus-1.0        locale                                python3.9            tmpfidebug           lsb                                   rsyslog              udev dpkg            man-db                                runit-helper         valgrenvironment.d   mime                                  sasl2                x86_6file            modprobe.d                            sftp-server               groff           modules                               shim                      grub            modules-load.d                        ssl                       admin@i-0c111f859fbef3091:/usr/lib$ cd lib                                      

                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    943 admin      0 -20    9112   3552   3052 R   0.0   0.8   0:00.03 top -c                                                                                                                                                                                                                                                                                                                                        22 root      20   0       0      0      0 I   0.0   0.0   0:00.05 [kworker/

drwx------ 3 admin admin 4.0K Sep 17  2023 .ansible                             drwx------ 2 admin admin 4.0K Sep 17  2023 .ssh                                 drwxr-xr-x 3 root  root  4.0K Sep 17  2023 ..                                   -rw-r--r-- 1 admin admin  220 Aug  4  2021 .bash_logout                         -rw-r--r-- 1 admin admin 3.5K Aug  4  2021 .bashrc                              -rw-r--r-- 1 admin admin  807 Aug  4  2021 .profile                             admin@i-014a9a0de6543ced0:~$ df -h                                              Filesystem       Size  Used Avail Use% Mounted on                               udev             217M     0  217M   0% /dev                                     tmpfs             46M  368K   46M   1% /run                                     /dev/nvme0n1p1   7.7G  6.1G  1.2G  84% /                                        tmpfs            228M   12K  228M   1% /dev/shm                                 tmpfs            5.0M     0  5.0M   0% /run/lock                                /dev/nvme0n1p15  124M  5.9M  118M   5% /boot/efi                                admin@i-014a9a0de6543ced0:~$ sudo                                               

admin@i-0b074775878e035f8:~$                                                    

-rwxrwx--- 1 root  root   360 Sep 24  2023 webserver.py                         admin@i-03a2a2fdd7cb0df14:~$ ls /proc/571/                                      arch_status         cmdline             environ             limits                         root                smaps_rollup        task/                        attr/               comm                exe                 loginuid            _adj       sched               stack               timens_offsets               autogroup           coredump_filter     fd/                 map_files/                     schedstat           stat                timers                       auxv                cpu_resctrl_groups  fdinfo/             maps                te         sessionid           statm               timerslack_ns                cgroup              cpuset              gid_map             mem                 ty         setgroups           status              uid_map                      clear_refs          cwd                 io                  mountinfo           p          smaps               syscall             wchan                        admin@i-03a2a2fdd7cb0df14:~$ ls /proc/571/fd