ANTICHAT — форум по информационной безопасности, OSINT и технологиям

Code:
Linux vps459476.ovh.net 3.10.0-862.14.4.el7.x86_64 #1 SMP Wed Sep 26 15:12:11 UTC 2018 x86_64 x86_64 x86_64 GNU/Linux

Code:
total 308208
dr-xr-xr-x.  5 root root     4096 Oct 31 15:50 .
dr-xr-xr-x. 19 root root     4096 Nov  7 03:01 ..
-rw-r--r--   1 root root      171 Jul  4  2017 .vmlinuz-3.10.0-514.26.2.el7.x86_64.hmac
-rw-r--r--   1 root root      171 Jan 25  2018 .vmlinuz-3.10.0-693.17.1.el7.x86_64.hmac
-rw-r--r--   1 root root      170 Sep 13  2017 .vmlinuz-3.10.0-693.2.2.el7.x86_64.hmac
-rw-r--r--   1 root root      171 Sep 26 17:15 .vmlinuz-3.10.0-862.14.4.el7.x86_64.hmac
-rw-r--r--   1 root root      170 May 22 01:50 .vmlinuz-3.10.0-862.3.2.el7.x86_64.hmac
-rw-------   1 root root  3114352 Jul  4  2017 System.map-3.10.0-514.26.2.el7.x86_64
-rw-------   1 root root  3232454 Jan 25  2018 System.map-3.10.0-693.17.1.el7.x86_64
-rw-------   1 root root  3228852 Sep 13  2017 System.map-3.10.0-693.2.2.el7.x86_64
-rw-------   1 root root  3414754 Sep 26 17:15 System.map-3.10.0-862.14.4.el7.x86_64
-rw-------   1 root root  3409912 May 22 01:50 System.map-3.10.0-862.3.2.el7.x86_64
-rw-r--r--   1 root root   137701 Jul  4  2017 config-3.10.0-514.26.2.el7.x86_64
-rw-r--r--   1 root root   140915 Jan 25  2018 config-3.10.0-693.17.1.el7.x86_64
-rw-r--r--   1 root root   140898 Sep 13  2017 config-3.10.0-693.2.2.el7.x86_64
-rw-r--r--   1 root root   147859 Sep 26 17:15 config-3.10.0-862.14.4.el7.x86_64
-rw-r--r--   1 root root   147823 May 22 01:50 config-3.10.0-862.3.2.el7.x86_64
drwxr-xr-x   3 root root     4096 Oct  2  2017 efi
drwxr-xr-x.  2 root root     4096 Oct 25  2016 grub
drwx------.  5 root root     4096 Oct  5 12:03 grub2
-rw-r--r--.  1 root root 40878462 Oct 25  2016 initramfs-0-rescue-41227fcee63d4c579f21e742e4225972.img
-rw-------   1 root root 49753219 Oct  2  2017 initramfs-0-rescue-bacc12ed2ab34144b90ba0c3fd7a4e64.img
-rw-------   1 root root 17882518 Oct  2  2017 initramfs-3.10.0-514.26.2.el7.x86_64.img
-rw-------   1 root root 18383893 Oct  2  2017 initramfs-3.10.0-514.26.2.el7.x86_64kdump.img
-rw-------   1 root root 18311470 May 23 09:05 initramfs-3.10.0-693.17.1.el7.x86_64.img
-rw-------   1 root root 12776420 May 23 09:04 initramfs-3.10.0-693.17.1.el7.x86_64kdump.img
-rw-------   1 root root 17643933 Mar  5  2018 initramfs-3.10.0-693.2.2.el7.x86_64.img
-rw-------   1 root root 18139075 Mar  5  2018 initramfs-3.10.0-693.2.2.el7.x86_64kdump.img
-rw-------   1 root root 18342351 Oct  5 12:03 initramfs-3.10.0-862.14.4.el7.x86_64.img
-rw-------   1 root root 12496997 Oct 31 15:50 initramfs-3.10.0-862.14.4.el7.x86_64kdump.img
-rw-------   1 root root 18342164 Oct  5 12:04 initramfs-3.10.0-862.3.2.el7.x86_64.img
-rw-------   1 root root 12496939 Oct  5 12:02 initramfs-3.10.0-862.3.2.el7.x86_64kdump.img
-rw-r--r--.  1 root root   610918 Oct  2  2017 initrd-plymouth.img
-rw-r--r--   1 root root   277955 Jul  4  2017 symvers-3.10.0-514.26.2.el7.x86_64.gz
-rw-r--r--   1 root root   293109 Jan 25  2018 symvers-3.10.0-693.17.1.el7.x86_64.gz
-rw-r--r--   1 root root   293064 Sep 13  2017 symvers-3.10.0-693.2.2.el7.x86_64.gz
-rw-r--r--   1 root root   305158 Sep 26 17:17 symvers-3.10.0-862.14.4.el7.x86_64.gz
-rw-r--r--   1 root root   304943 May 22 01:52 symvers-3.10.0-862.3.2.el7.x86_64.gz
-rwxr-xr-x.  1 root root  5156528 Oct 25  2016 vmlinuz-0-rescue-41227fcee63d4c579f21e742e4225972
-rwxr-xr-x   1 root root  5878848 Oct  2  2017 vmlinuz-0-rescue-bacc12ed2ab34144b90ba0c3fd7a4e64
-rwxr-xr-x   1 root root  5397008 Jul  4  2017 vmlinuz-3.10.0-514.26.2.el7.x86_64
-rwxr-xr-x   1 root root  5890720 Jan 25  2018 vmlinuz-3.10.0-693.17.1.el7.x86_64
-rwxr-xr-x   1 root root  5878848 Sep 13  2017 vmlinuz-3.10.0-693.2.2.el7.x86_64
-rwxr-xr-x   1 root root  6398144 Sep 26 17:15 vmlinuz-3.10.0-862.14.4.el7.x86_64
-rwxr-xr-x   1 root root  6228832 May 22 01:50 vmlinuz-3.10.0-862.3.2.el7.x86_64

Code:
lrwxrwxrwx 1 root root 7 2018-05-23 09:01:47.909343039 +0200 /lib -> usr/lib 
lrwxrwxrwx 1 root root 9 2018-05-23 09:01:47.909343039 +0200 /lib64 -> usr/lib64

Code:
/dev/vda1 on / type ext4 (rw,relatime,discard,errors=remount-ro,data=ordered)
devtmpfs on /dev type devtmpfs (rw,nosuid,size=3896920k,nr_inodes=974230,mode=755)
tmpfs on /dev/shm type tmpfs (rw,nosuid,nodev)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
mqueue on /dev/mqueue type mqueue (rw,relatime)
hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=31,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=10542)
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
securityfs on /sys/kernel/security type securityfs (rw,nosuid,nodev,noexec,relatime)
tmpfs on /sys/fs/cgroup type tmpfs (ro,nosuid,nodev,noexec,mode=755)
cgroup on /sys/fs/cgroup/systemd type cgroup (rw,nosuid,nodev,noexec,relatime,xattr,release_agent=/usr/lib/systemd/systemd-cgroups-agent,name=systemd)
cgroup on /sys/fs/cgroup/blkio type cgroup (rw,nosuid,nodev,noexec,relatime,blkio)
cgroup on /sys/fs/cgroup/memory type cgroup (rw,nosuid,nodev,noexec,relatime,memory)
cgroup on /sys/fs/cgroup/hugetlb type cgroup (rw,nosuid,nodev,noexec,relatime,hugetlb)
cgroup on /sys/fs/cgroup/pids type cgroup (rw,nosuid,nodev,noexec,relatime,pids)
cgroup on /sys/fs/cgroup/cpuset type cgroup (rw,nosuid,nodev,noexec,relatime,cpuset)
cgroup on /sys/fs/cgroup/cpu,cpuacct type cgroup (rw,nosuid,nodev,noexec,relatime,cpuacct,cpu)
cgroup on /sys/fs/cgroup/devices type cgroup (rw,nosuid,nodev,noexec,relatime,devices)
cgroup on /sys/fs/cgroup/net_cls,net_prio type cgroup (rw,nosuid,nodev,noexec,relatime,net_prio,net_cls)
cgroup on /sys/fs/cgroup/freezer type cgroup (rw,nosuid,nodev,noexec,relatime,freezer)
cgroup on /sys/fs/cgroup/perf_event type cgroup (rw,nosuid,nodev,noexec,relatime,perf_event)
pstore on /sys/fs/pstore type pstore (rw,nosuid,nodev,noexec,relatime)
configfs on /sys/kernel/config type configfs (rw,relatime)
debugfs on /sys/kernel/debug type debugfs (rw,relatime)
tmpfs on /run type tmpfs (rw,nosuid,nodev,mode=755)
/dev/vda1 on /tmp type ext4 (rw,relatime,discard,errors=remount-ro,data=ordered)
/dev/vda1 on /var/tmp type ext4 (rw,relatime,discard,errors=remount-ro,data=ordered)
tmpfs on /run/user/0 type tmpfs (rw,nosuid,nodev,relatime,size=781512k,mode=700)

Code:
Filesystem      Size  Used Avail Use% Mounted on
/dev/vda1        40G  7.2G   31G  20% /
devtmpfs        3.8G     0  3.8G   0% /dev
tmpfs           3.8G     0  3.8G   0% /dev/shm
tmpfs           3.8G     0  3.8G   0% /sys/fs/cgroup
tmpfs           3.8G   97M  3.7G   3% /run
tmpfs           764M     0  764M   0% /run/user/0

Code:
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root

Code:
/etc/cron.deny
/etc/crontab

/etc/cron.d:
0hourly
clamav-update
sa-update

/etc/cron.daily:
exim-tidydb
logrotate
man-db.cron
phpsess_cron

/etc/cron.hourly:
0anacron

/etc/cron.monthly:

Code:
$ cat /etc/cron.d/0hourly
# Run the hourly jobs
SHELL=/bin/bash
PATH=/sbin:/bin:/usr/sbin:/usr/bin
MAILTO=root
01 * * * * root run-parts /etc/cron.hourly
$ cat /etc/cron.d/clamav-update

$ cat /etc/cron.d/sa-update
# *** DO NOT MODIFY THIS FILE ***
### Spamassassin Rules Updates ###
#
# http://wiki.apache.org/spamassassin/RuleUpdates
#
# sa-update automatically updates your rules once per day if a spam daemon like
# spamd or amavisd are running.  You can force sa-update to run in
# /etc/sysconfig/sa-update
#
# /var/log/sa-update.log contains a history log of sa-update runs

10 4 * * * root /usr/share/spamassassin/sa-update.cron 2>&1 | tee -a /var/log/sa-update.log

Code:
$ cat /etc/cron.daily/exim-tidydb
#!/bin/bash

SPOOLDIR=/var/spool/exim

cd $SPOOLDIR/db
for a in retry misc wait-* callout ratelimit; do
    [ -r "$a" ] || continue
    [ "${a%%.lockfile}" = "$a" ] || continue
    /usr/sbin/exim_tidydb $SPOOLDIR $a >/dev/null
done
$ cat /etc/cron.daily/logrotate

$ cat /etc/cron.daily/man-db.cron
#!/bin/bash

if [ -e /etc/sysconfig/man-db ]; then
    . /etc/sysconfig/man-db
fi

if [ "$CRON" = "no" ]; then
   exit 0
fi

renice +19 -p $$ >/dev/null 2>&1
ionice -c3 -p $$ >/dev/null 2>&1

LOCKFILE=/var/lock/man-db.lock

# the lockfile is not meant to be perfect, it's just in case the
# two man-db cron scripts get run close to each other to keep
# them from stepping on each other's toes.  The worst that will
# happen is that they will temporarily corrupt the database
[[ -f $LOCKFILE ]] && exit 0

trap "{ rm -f $LOCKFILE ; exit 0; }" EXIT
touch $LOCKFILE
# create/update the mandb database
mandb $OPTS

exit 0
$ cat /etc/cron.daily/phpsess_cron
#!/bin/sh

# If You want to disable this task just comment next lines
if [ -x /usr/local/mgr5/sbin/phpsess_clean.sh ]; then
    ionice -c 3 /usr/local/mgr5/sbin/phpsess_clean.sh
fi

Code:
# Set to no to disable daily man-db update by /etc/cron.daily/man-db.cron
CRON="yes"

# Options used by mandb in /etc/cron.daily/man-db.cron,
# we use -q as default, too much noise without.
OPTS="-q"

Code:
#!/bin/sh
# Check whether 0anacron was run today already
if test -r /var/spool/anacron/cron.daily; then
    day=`cat /var/spool/anacron/cron.daily`
fi
if [ `date +%Y%m%d` = "$day" ]; then
    exit 0;
fi

# Do not run jobs when on battery power
if test -x /usr/bin/on_ac_power; then
    /usr/bin/on_ac_power >/dev/null 2>&1
    if test $? -eq 1; then
    exit 0
    fi
fi
/usr/sbin/anacron -s

Code:
Linux version 3.10.0-862.14.4.el7.x86_64 (mockbuild@kbuilder.bsys.centos.org) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-28) (GCC) ) #1 SMP Wed Sep 26 15:12:11 UTC 2018

Code:
-rwsr-x--- 1 root dbus 58016 Apr 11  2018 /usr/libexec/dbus-1/dbus-daemon-launch-helper
-rwsr-xr-x 1 root root 36280 Apr 11  2018 /usr/sbin/unix_chkpwd
-rwsr-xr-x 1 root root 11376 Sep 26 20:25 /usr/sbin/usernetctl
-rwsr-xr-x 1 root root 11216 Apr 11  2018 /usr/sbin/pam_timestamp_check
-rwsr-xr-x 1 root root 1357728 Mar 14  2018 /usr/sbin/exim
-rwsr-xr-x 1 root root 15432 Apr 11  2018 /usr/lib/polkit-1/polkit-agent-helper-1
-rwsr-xr-x 1 root root 78216 Nov  5  2016 /usr/bin/gpasswd
-rwsr-xr-x 1 root root 57576 Apr 11  2018 /usr/bin/crontab
-rwsr-x--x 1 root apache 11264 Jan 25  2016 /usr/bin/pwauth-isp
-rwsr-xr-x. 1 root root 27832 Jun 10  2014 /usr/bin/passwd
-rwsr-x--- 1 root apache 11256 Sep  1  2015 /usr/bin/pwauth
---s--x--x 1 root root 143248 Jun 27 20:03 /usr/bin/sudo
-rwsr-xr-x 1 root root 44320 Aug 16 20:47 /usr/bin/mount
-rwsr-xr-x 1 root root 32184 Aug 16 20:47 /usr/bin/su
-rwsr-xr-x 1 root root 27680 Apr 11  2018 /usr/bin/pkexec
-rws--x--x 1 root root 24048 Aug 16 20:47 /usr/bin/chfn
-rwsr-xr-x 1 root root 41776 Nov  5  2016 /usr/bin/newgrp
-rwsr-xr-x 1 root root 64240 Nov  5  2016 /usr/bin/chage
-rwsr-xr-x 1 root root 32048 Aug 16 20:47 /usr/bin/umount
-rwsr-xr-x 1 root root 52952 Apr 11  2018 /usr/bin/at
-rws--x--x 1 root root 23960 Aug 16 20:47 /usr/bin/chsh

Code:
Linux 3.13.0-37-generic #64-Ubuntu

Code:
EDB-ID:37292
CVE:2015-1328

Code:
The attached exploit gives a root shell by creating a world-writable
/etc/ld.so.preload file.