=== PRIVILEGE ESCALATION CHECK === --- 1. Kernel & OS --- Linux server.fernsconsulting.com 3.10.0-1160.119.1.vz7.224.4 #1 SMP Mon Sep 30 15:36:27 MSK 2024 x86_64 x86_64 x86_64 GNU/Linux NAME="AlmaLinux" VERSION="8.10 (Cerulean Leopard)" ID="almalinux" Linux version 3.10.0-1160.119.1.vz7.224.4 (mockbuild@builder5.eng.sw.ru) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) ) #1 SMP Mon Sep 30 15:36:27 MSK 2024 --- 2. Who am I? --- uid=1000(fernsc5) gid=1002(fernsc5) groups=1002(fernsc5) fernsc5 fernsc5 --- 3. Sudo rights --- We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. --- 4. SUID binaries --- /var/log/journal /var/log/journal/3cdd9d9813d14b4f841caa5044ebf2d4 /usr/sbin/mount.nfs /usr/sbin/suexec /usr/sbin/pam_timestamp_check /usr/sbin/unix_chkpwd /usr/sbin/exim /usr/sbin/sendmail /usr/sbin/usernetctl /usr/sbin/grub2-set-bootflag /usr/sbin/userhelper /usr/bin/mount /usr/bin/at /usr/bin/quota /usr/bin/gpasswd /usr/bin/write /usr/bin/newgrp /usr/bin/su /usr/bin/chfn /usr/bin/crontab /usr/bin/chage /usr/bin/passwd /usr/bin/screen /usr/bin/sudo /usr/bin/lockfile /usr/bin/umount /usr/bin/locate /usr/libexec/utempter/utempter /usr/libexec/dbus-1/dbus-daemon-launch-helper /usr/libexec/openssh/ssh-keysign --- 5. World-writable directories --- /var/tmp /opt/cpanel/ea-php80/root/var/tmp /opt/cpanel/ea-php80/root/tmp /opt/cpanel/ea-php74/root/var/tmp /opt/cpanel/ea-php74/root/tmp /opt/cpanel/ea-php82/root/var/tmp /opt/cpanel/ea-php82/root/tmp /opt/cpanel/ea-php83/root/var/tmp /opt/cpanel/ea-php83/root/tmp /opt/cpanel/ea-php81/root/var/tmp /opt/cpanel/ea-php81/root/tmp /opt/cpanel/ea-php72/root/var/tmp /opt/cpanel/ea-php72/root/tmp /opt/cpanel/ea-php73/root/var/tmp /opt/cpanel/ea-php73/root/tmp /tmp --- 6. Cron jobs --- -rw------- 1 root root 7 Oct 20 2016 /etc/cron.deny -rw-r--r-- 1 root root 600 May 2 2019 /etc/crontab /etc/cron.d: total 152 drwxr-xr-x 2 root root 4096 Aug 27 15:42 . drwxr-xr-x 116 root root 20480 Sep 1 05:20 .. -rw-r--r-- 1 root root 128 Apr 6 2024 0hourly -rw-r--r-- 1 root root 379 Aug 13 08:16 abuse-tracking.cron -rw-r--r-- 1 root root 129 Oct 31 2025 apf-fastload -rw-r--r-- 1 root root 547 Jul 14 06:34 backup_jobs_helper -rw-r--r-- 1 root root 433 Jul 14 06:34 comet_license_sync -rw------- 1 root root 130 Jun 21 2022 cpanel-analytics -rw------- 1 root root 76 Nov 13 2024 cpanel_autossl -rw------- 1 root root 57 Aug 27 15:42 cpanel_ssl_reissue -rw-r--r-- 1 root root 14 Feb 1 2013 csf-cron -rw-r--r-- 1 root root 397 May 2 2019 dailyjobs -rw-r--r-- 1 root root 74 Aug 27 15:41 lfd-cron -rw-r--r-- 1 root root 2103 May 2 11:41 mailman -rw-r--r-- 1 root root 254 Aug 13 08:16 sadata.cron -rw-r--r-- 1 root root 230 Jul 9 2024 sys-snap.cron -rw------- 1 root root 139 Sep 28 2016 sysstat.rpmsave -rw-r--r-- 1 root root 881 Jun 11 06:43 wp-toolkit-update.rpmsave /etc/cron.daily: total 40 drwxr-xr-x 2 root root 4096 Jul 22 09:29 . drwxr-xr-x 116 root root 20480 Sep 1 05:20 .. -rwx------ 1 root root 3317 Jul 26 2023 csget -rwxr-xr-x 1 root root 189 Jan 4 2018 logrotate /etc/cron.disabled: total 32 drwxr-xr-x 2 root root 4096 Jan 6 2025 . drwxr-xr-x 116 root root 20480 Sep 1 05:20 .. -rwx------ 1 root root 208 Apr 10 2018 mlocate /etc/cron.hourly: total 32 drwxr-xr-x 2 root root 4096 Apr 8 2021 . drwxr-xr-x 116 root root 20480 Sep 1 05:20 .. -rwxr-xr-x 1 root root 575 Apr 6 2024 0anacron /etc/cron.monthly: total 24 drwxr-xr-x 2 root root 4096 Apr 8 2021 . drwxr-xr-x 116 root root 20480 Sep 1 05:20 .. /etc/cron.weekly: total 24 drwxr-xr-x 2 root root 4096 Apr 8 2021 . drwxr-xr-x 116 root root 20480 Sep 1 05:20 .. SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root HOME=/ # For details see man 4 crontabs # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed # run-parts 41 1 * * * root run-parts /etc/cron.daily 25 0 * * 0 root run-parts /etc/cron.weekly 31 4 14 * * root run-parts /etc/cron.monthly # Run the hourly jobs SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root 01 * * * * root run-parts /etc/cron.hourly --- 7. Writable /etc/ files --- --- 8. Running processes as root --- root 1 0.0 0.0 312232 2980 ? Ss 2025 328:20 /usr/lib/systemd/systemd --system --deserialize 34 root 1500 0.0 0.0 235964 3124 ? SN Aug27 0:02 cpanellogd - sleeping for logs root 1552 0.0 0.1 421248 6808 ? Ss Aug27 0:47 php-fpm: master process (/usr/local/cpanel/etc/php-fpm.conf) root 1630 0.0 0.0 58444 636 ? Ss Aug27 0:00 /usr/sbin/saslauthd -m /run/saslauthd -a pam -n 2 root 1631 0.0 0.0 58444 660 ? S Aug27 0:00 /usr/sbin/saslauthd -m /run/saslauthd -a pam -n 2 root 1654 0.0 0.0 61068 3652 ? Ss Aug27 1:03 /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf root 1655 0.0 0.0 27528 2528 ? S Aug27 0:09 dovecot/anvil root 1686 0.0 0.0 50472 1180 ? Ss Aug27 0:00 /usr/sbin/smartd -n -q never root 1708 0.0 0.0 242372 2888 ? Ss Aug27 0:03 pure-ftpd (SERVER) root 1905 0.0 0.0 417892 1800 ? Ssl Aug27 0:49 /usr/sbin/rsyslogd -n root 1929 0.0 0.0 145720 5708 ? Ss Aug27 0:44 /usr/lib/systemd/systemd-journald root 1950 0.0 0.0 26188 1516 ? Ss Aug27 0:00 /usr/sbin/atd -f root 1971 0.0 0.0 91116 2912 ? Ss Aug27 0:00 /usr/lib/systemd/systemd-udevd root 1992 0.0 0.0 239852 1952 ? Ss Aug27 0:00 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/local/cpanel/bin/pureauth root 2784 0.0 2.6 308708 169712 ? Ss Aug27 1:02 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --max-spare=1 --max-children=3 --max-children=9 --max-spare=3 --allowed-ips=127.0.0.1,::1 --pidfile=/var/run/spamd.pid --listen=5 root 5807 0.0 0.0 46852 504 ? Ss Jul29 0:00 /usr/sbin/xinetd -stayalive -pidfile /var/run/xinetd.pid root 6085 0.0 0.0 6612 112 ? Ss+ Jul29 0:00 /sbin/agetty -o -p -- \u --noclear tty2 linux root 6202 0.0 0.0 314956 668 ? Ssl Jul29 0:01 /usr/sbin/gssproxy -D root 6235 0.0 0.0 219312 116 ? Ss+ Jul29 0:00 /sbin/agetty -o -p -- \u --noclear --keep-baud console 115200,38400,9600 linux root 8127 0.0 0.5 371864 35680 ? Ss Aug26 7:20 cpsrvd (SSL) - waiting for connections root 10302 0.0 0.1 295052 11380 ? Ss Aug27 0:08 queueprocd - waiting up to 60s to process a task root 11692 0.0 0.0 235724 2476 ? Ss Aug27 0:30 /usr/sbin/crond -n root 12691 0.0 0.0 166176 316 ? Ss Jul22 4:20 gpg-agent --homedir /etc/mail/spamassassin/sa-update-keys --use-standard-socket --daemon root 13892 0.0 0.0 76712 2844 ? Ss Aug27 0:00 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc -oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 -oGSSAPIKexAlgorithms=gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-,gss-gex-sha1-,gss-group14-sha1- -oKexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com -oPubkeyAcceptedKeyTypes=ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh --- 9. MySQL root access? --- mysql.user query denied --- 10. Check for cPanel root scripts --- total 6428 drwxr-xr-x 4 root root 36864 Aug 27 15:45 . drwx--x--x 41 root wheel 4096 Aug 31 21:14 .. -rwxr-xr-x 1 root root 2437 Apr 6 2022 MirrorSearch_pingtest -rwxr-xr-x 1 root root 1734 Apr 6 2022 activesync-invite-reply -rwxr-xr-x 1 root root 2418 Apr 6 2022 add_dns lrwxrwxrwx 1 root root 7 Oct 6 2016 adddns -> add_dns -rwxr-xr-x 1 root root 6228 Apr 6 2022 addpop -rwxr-xr-x 1 root root 3345 Apr 6 2022 addsystemuser -rwxr-xr-x 1 root root 92 Oct 6 2016 adduser --- 11. Check for backup files with passwords --- total 12 drwxr-xr-x 3 root root 4096 Sep 1 05:25 . dr-xr-xr-x 25 root root 4096 Jul 22 10:02 .. drwx--x--x 2 root root 4096 Sep 1 05:25 .meta --- 12. Find interesting files in /root --- ls: cannot open directory '/root/' --- 13. PHP version and extensions --- PHP 7.2.34 (cli) (built: Aug 11 2026 23:07:29) ( NTS ) mysqli mysqlnd pcntl PDO pdo_mysql pdo_sqlite posix --- 14. Check for writable scripts run as root --- --- 15. Check service configs for passwords --- /etc/GeoIP.conf /etc/nscd.conf /etc/sestatus.conf /etc/httpd/conf/httpd.conf /etc/libuser.conf /etc/nsswitch.conf /etc/apache2/conf.d/imh-modsec/21_spam_scripts.conf /etc/apache2/conf.d/imh-modsec/01_base_rules.conf /etc/apache2/conf.d/imh-modsec/05_additional_directives.conf /etc/apache2/conf.d/imh-modsec/40_wordpress.conf /etc/idmapd.conf /etc/dovecot/dovecot.conf /etc/authselect/user-nsswitch.conf /etc/selinux/minimum/setrans.conf /etc/selinux/semanage.conf /etc/security/pwquality.conf /etc/security/pwhistory.conf /etc/security/faillock.conf /etc/monarx-agent.conf /etc/exim.conf