=== PRIVILEGE ESCALATION CHECK === --- 1. Kernel & OS --- Linux server.fernsconsulting.com 3.10.0-1160.119.1.vz7.224.4 #1 SMP Mon Sep 30 15:36:27 MSK 2024 x86_64 x86_64 x86_64 GNU/Linux NAME="AlmaLinux" VERSION="8.10 (Cerulean Leopard)" ID="almalinux" Linux version 3.10.0-1160.119.1.vz7.224.4 (mockbuild@builder5.eng.sw.ru) (gcc version 4.8.5 20150623 (Red Hat 4.8.5-44) (GCC) ) #1 SMP Mon Sep 30 15:36:27 MSK 2024 --- 2. Who am I? --- uid=1000(fernsc5) gid=1002(fernsc5) groups=1002(fernsc5) fernsc5 fernsc5 --- 3. Sudo rights --- We trust you have received the usual lecture from the local System Administrator. It usually boils down to these three things: #1) Respect the privacy of others. #2) Think before you type. #3) With great power comes great responsibility. --- 4. SUID binaries --- /var/log/journal /var/log/journal/3cdd9d9813d14b4f841caa5044ebf2d4 /usr/sbin/mount.nfs /usr/sbin/suexec /usr/sbin/pam_timestamp_check /usr/sbin/unix_chkpwd /usr/sbin/exim /usr/sbin/sendmail /usr/sbin/usernetctl /usr/sbin/grub2-set-bootflag /usr/sbin/userhelper /usr/bin/mount /usr/bin/at /usr/bin/quota /usr/bin/gpasswd /usr/bin/write /usr/bin/newgrp /usr/bin/su /usr/bin/chfn /usr/bin/crontab /usr/bin/chage /usr/bin/passwd /usr/bin/screen /usr/bin/sudo /usr/bin/lockfile /usr/bin/umount /usr/bin/locate /usr/libexec/utempter/utempter /usr/libexec/dbus-1/dbus-daemon-launch-helper /usr/libexec/openssh/ssh-keysign --- 5. World-writable directories --- /var/tmp /opt/cpanel/ea-php80/root/var/tmp /opt/cpanel/ea-php80/root/tmp /opt/cpanel/ea-php74/root/var/tmp /opt/cpanel/ea-php74/root/tmp /opt/cpanel/ea-php82/root/var/tmp /opt/cpanel/ea-php82/root/tmp /opt/cpanel/ea-php83/root/var/tmp /opt/cpanel/ea-php83/root/tmp /opt/cpanel/ea-php81/root/var/tmp /opt/cpanel/ea-php81/root/tmp /opt/cpanel/ea-php72/root/var/tmp /opt/cpanel/ea-php72/root/tmp /opt/cpanel/ea-php73/root/var/tmp /opt/cpanel/ea-php73/root/tmp /tmp --- 6. Cron jobs --- -rw------- 1 root root 7 Oct 20 2016 /etc/cron.deny -rw-r--r-- 1 root root 600 May 2 2019 /etc/crontab /etc/cron.d: total 152 drwxr-xr-x 2 root root 4096 Aug 27 15:42 . drwxr-xr-x 116 root root 20480 Sep 3 08:40 .. -rw-r--r-- 1 root root 128 Apr 6 2024 0hourly -rw-r--r-- 1 root root 379 Aug 13 08:16 abuse-tracking.cron -rw-r--r-- 1 root root 129 Oct 31 2025 apf-fastload -rw-r--r-- 1 root root 547 Jul 14 06:34 backup_jobs_helper -rw-r--r-- 1 root root 433 Jul 14 06:34 comet_license_sync -rw------- 1 root root 130 Jun 21 2022 cpanel-analytics -rw------- 1 root root 76 Nov 13 2024 cpanel_autossl -rw------- 1 root root 57 Aug 27 15:42 cpanel_ssl_reissue -rw-r--r-- 1 root root 14 Feb 1 2013 csf-cron -rw-r--r-- 1 root root 397 May 2 2019 dailyjobs -rw-r--r-- 1 root root 74 Aug 27 15:41 lfd-cron -rw-r--r-- 1 root root 2103 May 2 11:41 mailman -rw-r--r-- 1 root root 254 Aug 13 08:16 sadata.cron -rw-r--r-- 1 root root 230 Jul 9 2024 sys-snap.cron -rw------- 1 root root 139 Sep 28 2016 sysstat.rpmsave -rw-r--r-- 1 root root 881 Jun 11 06:43 wp-toolkit-update.rpmsave /etc/cron.daily: total 40 drwxr-xr-x 2 root root 4096 Jul 22 09:29 . drwxr-xr-x 116 root root 20480 Sep 3 08:40 .. -rwx------ 1 root root 3317 Jul 26 2023 csget -rwxr-xr-x 1 root root 189 Jan 4 2018 logrotate /etc/cron.disabled: total 32 drwxr-xr-x 2 root root 4096 Jan 6 2025 . drwxr-xr-x 116 root root 20480 Sep 3 08:40 .. -rwx------ 1 root root 208 Apr 10 2018 mlocate /etc/cron.hourly: total 32 drwxr-xr-x 2 root root 4096 Apr 8 2021 . drwxr-xr-x 116 root root 20480 Sep 3 08:40 .. -rwxr-xr-x 1 root root 575 Apr 6 2024 0anacron /etc/cron.monthly: total 24 drwxr-xr-x 2 root root 4096 Apr 8 2021 . drwxr-xr-x 116 root root 20480 Sep 3 08:40 .. /etc/cron.weekly: total 24 drwxr-xr-x 2 root root 4096 Apr 8 2021 . drwxr-xr-x 116 root root 20480 Sep 3 08:40 .. SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root HOME=/ # For details see man 4 crontabs # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed # run-parts 41 1 * * * root run-parts /etc/cron.daily 25 0 * * 0 root run-parts /etc/cron.weekly 31 4 14 * * root run-parts /etc/cron.monthly # Run the hourly jobs SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root 01 * * * * root run-parts /etc/cron.hourly --- 7. Writable /etc/ files --- --- 8. Running processes as root --- root 1 0.0 0.0 312232 3392 ? Ss 2025 332:44 /usr/lib/systemd/systemd --system --deserialize 34 root 985 0.0 0.4 287388 30412 ? Ss 00:00 0:04 lfd - sleeping root 1500 0.0 0.0 235964 2216 ? SN Aug27 0:02 cpanellogd - sleeping for logs root 1552 0.0 0.0 421248 6196 ? Ss Aug27 1:24 php-fpm: master process (/usr/local/cpanel/etc/php-fpm.conf) root 1630 0.0 0.0 58444 636 ? Ss Aug27 0:00 /usr/sbin/saslauthd -m /run/saslauthd -a pam -n 2 root 1631 0.0 0.0 58444 660 ? S Aug27 0:00 /usr/sbin/saslauthd -m /run/saslauthd -a pam -n 2 root 1654 0.0 0.0 61068 3176 ? Ss Aug27 1:42 /usr/sbin/dovecot -F -c /etc/dovecot/dovecot.conf root 1655 0.0 0.0 27528 1208 ? S Aug27 0:15 dovecot/anvil root 1686 0.0 0.0 50472 1092 ? Ss Aug27 0:00 /usr/sbin/smartd -n -q never root 1708 0.0 0.0 242372 1080 ? Ss Aug27 0:04 pure-ftpd (SERVER) root 1905 0.0 0.0 441784 1788 ? Ssl Aug27 1:14 /usr/sbin/rsyslogd -n root 1929 0.0 0.2 170560 13180 ? Ss Aug27 1:07 /usr/lib/systemd/systemd-journald root 1950 0.0 0.0 26188 200 ? Ss Aug27 0:00 /usr/sbin/atd -f root 1971 0.0 0.0 91116 944 ? Ss Aug27 0:00 /usr/lib/systemd/systemd-udevd root 1992 0.0 0.0 239852 564 ? Ss Aug27 0:01 /usr/sbin/pure-authd -s /var/run/ftpd.sock -r /usr/local/cpanel/bin/pureauth root 2543 0.0 0.2 50180 14104 ? S 08:01 0:00 /usr/local/cpanel/3rdparty/bin/perl /usr/local/cpanel/bin/leechprotect root 2784 0.0 2.6 308708 168076 ? Ss Aug27 1:29 /usr/local/cpanel/3rdparty/perl/542/bin/perl -T -w /usr/local/cpanel/3rdparty/bin/spamd --max-spare=1 --max-children=3 --max-children=9 --max-spare=3 --allowed-ips=127.0.0.1,::1 --pidfile=/var/run/spamd.pid --listen=5 root 3253 4.1 3.1 336336 198548 ? S 08:08 1:20 spamd child root 3254 0.4 3.0 331224 193268 ? S 08:08 0:09 spamd child root 5807 0.0 0.0 46852 504 ? Ss Jul29 0:00 /usr/sbin/xinetd -stayalive -pidfile /var/run/xinetd.pid root 6085 0.0 0.0 6612 112 ? Ss+ Jul29 0:00 /sbin/agetty -o -p -- \u --noclear tty2 linux root 6165 0.0 0.1 77584 9480 ? S 08:38 0:00 dovecot/auth -w root 6202 0.0 0.0 314956 668 ? Ssl Jul29 0:01 /usr/sbin/gssproxy -D root 6235 0.0 0.0 219312 116 ? Ss+ Jul29 0:00 /sbin/agetty -o -p -- \u --noclear --keep-baud console 115200,38400,9600 linux root 6295 0.0 0.0 27504 3288 ? S 03:51 0:00 dovecot/log root 6300 0.0 0.0 87516 5808 ? S 03:51 0:00 dovecot/config root 8127 0.0 0.4 372116 31112 ? Ss Aug26 9:54 cpsrvd (SSL) - waiting for connections root 10302 0.0 0.1 295052 9936 ? Ss Aug27 0:12 queueprocd - waiting up to 60s to process a task root 11692 0.0 0.0 235724 1524 ? Ss Aug27 0:48 /usr/sbin/crond -n root 12691 0.0 0.0 166176 316 ? Ss Jul22 4:45 gpg-agent --homedir /etc/mail/spamassassin/sa-update-keys --use-standard-socket --daemon --- 9. MySQL root access? --- mysql.user query denied --- 10. Check for cPanel root scripts --- total 6428 drwxr-xr-x 4 root root 36864 Aug 27 15:45 . drwx--x--x 41 root wheel 4096 Sep 2 22:49 .. -rwxr-xr-x 1 root root 2437 Apr 6 2022 MirrorSearch_pingtest -rwxr-xr-x 1 root root 1734 Apr 6 2022 activesync-invite-reply -rwxr-xr-x 1 root root 2418 Apr 6 2022 add_dns lrwxrwxrwx 1 root root 7 Oct 6 2016 adddns -> add_dns -rwxr-xr-x 1 root root 6228 Apr 6 2022 addpop -rwxr-xr-x 1 root root 3345 Apr 6 2022 addsystemuser -rwxr-xr-x 1 root root 92 Oct 6 2016 adduser --- 11. Check for backup files with passwords --- total 12 drwxr-xr-x 3 root root 4096 Sep 3 06:42 . dr-xr-xr-x 25 root root 4096 Jul 22 10:02 .. drwx--x--x 2 root root 4096 Sep 3 06:42 .meta --- 12. Find interesting files in /root --- ls: cannot open directory '/root/' --- 13. PHP version and extensions --- PHP 7.2.34 (cli) (built: Aug 11 2026 23:07:29) ( NTS ) mysqli mysqlnd pcntl PDO pdo_mysql pdo_sqlite posix --- 14. Check for writable scripts run as root --- --- 15. Check service configs for passwords --- /etc/GeoIP.conf /etc/nscd.conf /etc/sestatus.conf /etc/httpd/conf/httpd.conf /etc/libuser.conf /etc/nsswitch.conf /etc/apache2/conf.d/imh-modsec/21_spam_scripts.conf /etc/apache2/conf.d/imh-modsec/01_base_rules.conf /etc/apache2/conf.d/imh-modsec/05_additional_directives.conf /etc/apache2/conf.d/imh-modsec/40_wordpress.conf /etc/idmapd.conf /etc/dovecot/dovecot.conf /etc/authselect/user-nsswitch.conf /etc/selinux/minimum/setrans.conf /etc/selinux/semanage.conf /etc/security/pwquality.conf /etc/security/pwhistory.conf /etc/security/faillock.conf /etc/monarx-agent.conf /etc/exim.conf