===== PRIVILEGE ESCALATION SCAN Thu Oct 15 12:19:03 UTC 2026 ===== ## 1) Kernel & OS (ابحث عن CVE-2021-4034, CVE-2022-0847 DirtyPipe, CVE-2016-5195 DirtyCow, CVE-2019-13272, CVE-2021-3156 sudo Baron Samedit, CVE-2021-33909 Sequoia) Linux myfifasalon 4.15.0-213-generic #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux NAME="Ubuntu" VERSION="18.04.3 LTS (Bionic Beaver)" ID=ubuntu ID_LIKE=debian PRETTY_NAME="Ubuntu 18.04.3 LTS" VERSION_ID="18.04" HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy" VERSION_CODENAME=bionic UBUNTU_CODENAME=bionic Linux version 4.15.0-213-generic (buildd@lcy02-amd64-079) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #224-Ubuntu SMP Mon Jun 19 13:30:12 UTC 2023 ## 2) sudo version (Baron Samedit = sudo < 1.9.5p2) Sudo version 1.8.21p2 Sudoers policy plugin version 1.8.21p2 Sudoers file grammar version 46 Sudo version 1.8.21p2 Sudoers policy plugin version 1.8.21p2 Sudoers file grammar version 46 ## 3) pkexec version (PwnKit = pkexec < 0.120) bash: line 9: pkexec: command not found ## 4) sudo -l (يخبرك هل لديك أي صلاحية sudo) sudo: a password is required ## 5) SUID binaries (كل برنامج يشتغل كـ root) 13885 44 -rwsr-xr-x 1 root root 43088 Sep 16 2020 /bin/mount 260 32 -rwsr-xr-x 1 root root 30800 Aug 11 2016 /bin/fusermount 10512 44 -rwsr-xr-x 1 root root 44664 Nov 29 2022 /bin/su 13908 28 -rwsr-xr-x 1 root root 26696 Sep 16 2020 /bin/umount 1870 64 -rwsr-xr-x 1 root root 64424 Jun 28 2019 /bin/ping 140698 60 -rwsr-xr-x 1 root root 59640 Nov 29 2022 /usr/bin/passwd 135509 76 -rwsr-xr-x 1 root root 76496 Nov 29 2022 /usr/bin/chfn 140697 76 -rwsr-xr-x 1 root root 75824 Nov 29 2022 /usr/bin/gpasswd 134139 148 -rwsr-xr-x 1 root root 149080 Apr 4 2023 /usr/bin/sudo 154304 20 -rwsr-xr-x 1 root root 18448 Jun 28 2019 /usr/bin/traceroute6.iputils 132099 40 -rwsr-xr-x 1 root root 40344 Nov 29 2022 /usr/bin/newgrp 139447 44 -rwsr-xr-x 1 root root 44528 Nov 29 2022 /usr/bin/chsh 137187 44 -rwsr-xr-- 1 root messagebus 42992 Oct 25 2022 /usr/lib/dbus-1.0/dbus-daemon-launch-helper 134415 12 -rwsr-xr-x 1 root root 10232 Mar 28 2017 /usr/lib/eject/dmcrypt-get-device 264611 428 -rwsr-xr-x 1 root root 436552 Aug 11 2021 /usr/lib/openssh/ssh-keysign ## 6) SGID binaries 5145 36 -rwxr-sr-x 1 root shadow 34816 Feb 2 2023 /sbin/pam_extrausers_chkpwd 5600 36 -rwxr-sr-x 1 root shadow 34816 Feb 2 2023 /sbin/unix_chkpwd 135341 40 -rwxr-sr-x 1 root crontab 39352 May 10 2022 /usr/bin/crontab 134966 72 -rwxr-sr-x 1 root shadow 71816 Nov 29 2022 /usr/bin/chage 140696 24 -rwxr-sr-x 1 root shadow 22808 Nov 29 2022 /usr/bin/expiry 171124 32 -rwxr-sr-x 1 root tty 30800 Sep 16 2020 /usr/bin/wall 156500 44 -rwxr-sr-x 1 root mlocate 43088 Mar 1 2018 /usr/bin/mlocate 135521 356 -rwxr-sr-x 1 root ssh 362640 Aug 11 2021 /usr/bin/ssh-agent 133012 16 -rwxr-sr-x 1 root tty 14328 Jan 17 2018 /usr/bin/bsd-write ## 7) Capabilities (selahei root بدون SUID) /usr/bin/mtr-packet = cap_net_raw+ep ## 8) ملفات قابلة للكتابة من الجميع تخص root 131358 4 -rwxrwxrwx 1 root root 2376 Oct 1 2025 /etc/nginx/conf.d/nginx_myfifasalon.conf.save ## 9) ملفات قابلة للكتابة منك وتخص root (writable by my user) 131358 4 -rwxrwxrwx 1 root root 2376 Oct 1 2025 /etc/nginx/conf.d/nginx_myfifasalon.conf.save ## 10) Cron jobs القابلة للكتابة (طريق شائع للترقية) /etc/cron.d: total 36 drwxr-xr-x 2 root root 4096 Dec 1 2022 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rw-r--r-- 1 root root 485 Oct 27 2020 certbot -rw-r--r-- 1 root root 712 Aug 14 2019 php -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder -rw-r--r-- 1 root root 191 Nov 28 2016 popularity-contest -rw-r--r-- 1 root root 396 Jan 27 2016 sysstat /etc/cron.daily: total 56 drwxr-xr-x 2 root root 4096 Jul 17 06:49 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rwxr-xr-x 1 root root 1478 Sep 3 2019 apt-compat -rwxr-xr-x 1 root root 355 May 22 2012 bsdmainutils -rwxr-xr-x 1 root root 1176 Sep 5 2019 dpkg -rwxr-xr-x 1 root root 372 May 6 2015 logrotate -rwxr-xr-x 1 root root 1065 Apr 7 2018 man-db -rwxr-xr-x 1 root root 538 Mar 1 2018 mlocate -rwxr-xr-x 1 root root 249 Nov 12 2015 passwd -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder -rwxr-xr-x 1 root root 3477 Feb 21 2018 popularity-contest -rwxr-xr-x 1 root root 441 Jan 27 2016 sysstat /etc/cron.hourly: total 20 drwxr-xr-x 2 root root 4096 May 12 2022 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder /etc/cron.monthly: total 20 drwxr-xr-x 2 root root 4096 May 12 2022 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder /etc/cron.weekly: total 24 drwxr-xr-x 2 root root 4096 May 12 2022 . drwxr-xr-x 99 root root 12288 Sep 30 21:12 .. -rwxr-xr-x 1 root root 723 Apr 7 2018 man-db -rw-r--r-- 1 root root 102 Apr 5 2016 .placeholder ## 11) خدمات systemd قابلة للكتابة ## 12) ملفات passwd/shadow/sudoers هل قابلة للكتابة -rw-r--r-- 1 root root 1587 Dec 13 2019 /etc/passwd -rw-r----- 1 root shadow 1139 Sep 30 21:12 /etc/shadow -r--r----- 1 root root 755 Aug 17 2016 /etc/sudoers drwxr-xr-x 2 root root 4096 Apr 13 2023 /etc/sudoers.d -rw-r--r-- 1 root root 750 Dec 13 2019 /etc/group -rw-r----- 1 root shadow 625 Dec 13 2019 /etc/gshadow ## 13) PATH hijacking (مجلدات PATH قابلة للكتابة) PATH=/home/myfifasalon/bin:/home/myfifasalon/.local/bin:/home/myfifasalon/.nvm/versions/node/v24.21.0/bin:/home/myfifasalon/bin:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:/usr/games:/usr/local/games:/snap/bin WRITABLE IN PATH: /home/myfifasalon/bin WRITABLE IN PATH: /home/myfifasalon/.local/bin WRITABLE IN PATH: /home/myfifasalon/.nvm/versions/node/v24.21.0/bin WRITABLE IN PATH: /home/myfifasalon/bin ## 14) NFS / mounts بدون noexec او nosuid /dev/vda1 on / type ext4 (rw,relatime,nobarrier,data=ordered) systemd-1 on /proc/sys/fs/binfmt_misc type autofs (rw,relatime,fd=27,pgrp=1,timeout=0,minproto=5,maxproto=5,direct,pipe_ino=12582) debugfs on /sys/kernel/debug type debugfs (rw,relatime) hugetlbfs on /dev/hugepages type hugetlbfs (rw,relatime,pagesize=2M) mqueue on /dev/mqueue type mqueue (rw,relatime) configfs on /sys/kernel/config type configfs (rw,relatime) fusectl on /sys/fs/fuse/connections type fusectl (rw,relatime) binfmt_misc on /proc/sys/fs/binfmt_misc type binfmt_misc (rw,relatime) ## 15) Docker / LXD (عضوية = root) bash: line 46: docker: command not found ## 16) عمليات تشتغل كـ root من مجلد قابل للكتابة (أخطر شي) root 576 0.0 2.2 2910556 22688 ? Ssl 2024 285:44 python3 /home/myfifasalon/Virtualka/myfifasalon/lib/python3.6/site-packages/pgadmin4/pgAdmin4.py root 595 0.0 0.0 35752 312 ? Ss 2024 62:24 /home/myfifasalon/Virtualka/myfifasalon/bin/uwsgi --emperor /home/uwsgi root 600 0.0 0.0 192044 368 ? S 2024 51:34 /home/myfifasalon/Virtualka/myfifasalon/bin/uwsgi --ini uwsgi_new_myfifasalon.ini root 601 0.0 0.1 191912 1240 ? S 2024 50:33 /home/myfifasalon/Virtualka/myfifasalon/bin/uwsgi --ini uwsgi_myfifasalon.ini root 755 0.0 4.6 223924 46432 ? S 2024 79:22 /home/myfifasalon/Virtualka/myfifasalon/bin/uwsgi --ini uwsgi_new_myfifasalon.ini root 756 0.5 5.8 276476 59388 ? S 2024 7272:21 /home/myfifasalon/Virtualka/myfifasalon/bin/uwsgi --ini uwsgi_myfifasalon.ini ## 17) ملفات .bashrc / .profile / .bash_profile هل فيها أوامر مشبوهة /home/myfifasalon/.bashrc:31:[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)" /home/myfifasalon/.bashrc:77: test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)" ## 18) SSH keys موجودة على السيرفر 802293 4 -rw------- 1 myfifasalon myfifasalon 883 Sep 17 11:31 /home/myfifasalon/.ssh/authorized_keys ## 19) SSH agent sockets (يمكن انتحال جلسة root) ## 20) Sockets مفتوحة للجميع ## 21) ملفات بصلاحية 777 في مجلدك 795470 8 -rwxrwxrwx 1 root root 5415 Sep 19 2018 /home/myfifasalon/Virtualka\ (\320\272\320\276\320\277\320\270\321\217)/myfifasalon_v3/lib/python3.5/site-packages/pgadmin4/pgAdmin4.py 1088640 8 -rwxrwxrwx 1 root root 6048 Mar 20 2019 /home/myfifasalon/myfifasalon/gulpfile.js 1050130 136 -rwxrwxrwx 1 root root 137460 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.ttf 1050139 136 -rwxrwxrwx 1 root root 137460 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/original-candara.ttf 1060474 704 -rwxrwxrwx 1 root root 719495 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.svg 1060477 8 -rwxrwxrwx 1 root root 7536 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/revicons.woff 1060478 12 -rwxrwxrwx 1 root root 11968 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/revicons.ttf 1060479 16 -rwxrwxrwx 1 root root 13691 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/revicons.svg 1060480 12 -rwxrwxrwx 1 root root 12136 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/revicons.eot 1060481 0 -rwxrwxrwx 1 root root 0 Sep 27 2015 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/revicons/index.php 1060497 156 -rwxrwxrwx 1 root root 159653 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.ttf 1060498 112 -rwxrwxrwx 1 root root 114516 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.woff 1060499 948 -rwxrwxrwx 1 root root 967042 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.svg 1060500 160 -rwxrwxrwx 1 root root 159819 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.eot 1060501 232 -rwxrwxrwx 1 root root 235528 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Regular/Candara-Regular.otf 1060521 80 -rwxrwxrwx 1 root root 80600 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.woff 1060536 60 -rwxrwxrwx 1 root root 60168 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.woff2 1060541 136 -rwxrwxrwx 1 root root 137626 Jul 11 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/candara.eot 1060546 112 -rwxrwxrwx 1 root root 114232 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.woff 1060547 232 -rwxrwxrwx 1 root root 237288 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.otf 1060548 160 -rwxrwxrwx 1 root root 161963 Jul 19 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.ttf 1060549 940 -rwxrwxrwx 1 root root 960464 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.svg 1060550 160 -rwxrwxrwx 1 root root 162133 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/fonts/Candara-Bold/Candara-Bold.eot 1062376 4 -rwxrwxrwx 1 root root 1145 Jun 3 2018 /home/myfifasalon/myfifasalon/static/theme/1default/1sass/reset.sass 1361021 4 -rwxrwxrwx 1 root root 1139 Jun 30 2017 /home/myfifasalon/myfifasalon/static/theme/1default/css/reset.css 1360997 16 -rwxrwxrwx 1 root root 13706 Jul 20 2017 /home/myfifasalon/myfifasalon/static/theme/1default/css/jquery.fancybox.min.css 1361008 96 -rwxrwxrwx 1 root root 96417 Nov 8 2018 /home/myfifasalon/myfifasalon/static/theme/1default/production/old/1jquery.min.js 1062368 96 -rwxrwxrwx 1 root root 96417 Nov 8 2018 /home/myfifasalon/myfifasalon/static/theme/1default/1production/old/1jquery.min.js 1060554 4 -rwxrwxrwx 1 root root 2513 Mar 14 2018 /home/myfifasalon/myfifasalon/static/theme/1default/js/map-contacts.js 1061706 88 -rwxrwxrwx 1 root root 86659 Jun 14 2018 /home/myfifasalon/myfifasalon/static/theme/1default/js/jquery-3.2.1.min.js ## 22) PostgreSQL/MySQL trust auth (طريق root عبر DB) total 20 drwxr-xr-x 4 postgres postgres 4096 Dec 13 2019 . drwxr-xr-x 50 root root 4096 Jul 17 06:48 .. drwxr-xr-x 3 postgres postgres 4096 Dec 13 2019 10 drwxr-xr-x 3 postgres postgres 4096 Mar 1 2018 9.5 -rw------- 1 postgres postgres 95 Aug 22 2018 .bash_history -rw------- 1 postgres postgres 0 Jun 8 2018 .psql_history List of roles Role name | Attributes | Member of -------------+------------------------------------------------------------+----------- myfifasalon | Superuser, Create role, Create DB | {} postgres | Superuser, Create role, Create DB, Replication, Bypass RLS | {} ## 23) نسخ احتياطية لـ /etc/passwd قديمة موجودة /sbin/shadowconfig /etc/passwd /etc/shadow /etc/pam.d/passwd /etc/shadow- /etc/passwd- /etc/cron.daily/passwd /var/backups/shadow.bak /var/backups/passwd.bak /var/lib/dpkg/info/passwd.preinst ## 24) getcap على ملفات في مجلدك ## 25) هل تستطيع قراءة auth.log؟ -rw-r----- 1 syslog adm 45332802 Oct 15 12:19 /var/log/auth.log ## 26) تاريخ آخر تحديث للنواة total 164776 drwxr-xr-x 3 root root 12288 Jul 1 2023 . drwxr-xr-x 22 root root 4096 Jun 30 2023 .. -rw-r--r-- 1 root root 217563 Mar 29 2022 config-4.15.0-176-generic -rw-r--r-- 1 root root 217558 May 23 2023 config-4.15.0-212-generic -rw-r--r-- 1 root root 217558 Jun 16 2023 config-4.15.0-213-generic drwxr-xr-x 5 root root 4096 Jul 1 2023 grub -rw-r--r-- 1 root root 41919363 Apr 21 2022 initrd.img-4.15.0-176-generic -rw-r--r-- 1 root root 44223299 Jun 3 2023 initrd.img-4.15.0-212-generic -rw-r--r-- 1 root root 44224692 Jun 30 2023 initrd.img-4.15.0-213-generic -rw------- 1 root root 4087542 Mar 29 2022 System.map-4.15.0-176-generic -rw------- 1 root root 4080574 May 23 2023 System.map-4.15.0-212-generic -rw------- 1 root root 4080574 Jun 16 2023 System.map-4.15.0-213-generic -rw------- 1 root root 8470176 Mar 29 2022 vmlinuz-4.15.0-176-generic -rw------- 1 root root 8474280 May 23 2023 vmlinuz-4.15.0-212-generic -rw------- 1 root root 8470184 Jun 16 2023 vmlinuz-4.15.0-213-generic ii linux-headers-4.15.0-176 4.15.0-176.185 all Header files related to Linux kernel version 4.15.0 ii linux-headers-4.15.0-176-generic 4.15.0-176.185 amd64 Linux kernel headers for version 4.15.0 on 64 bit x86 SMP ii linux-headers-4.15.0-212 4.15.0-212.223 all Header files related to Linux kernel version 4.15.0 ii linux-headers-4.15.0-212-generic 4.15.0-212.223 amd64 Linux kernel headers for version 4.15.0 on 64 bit x86 SMP ii linux-headers-4.15.0-213 4.15.0-213.224 all Header files related to Linux kernel version 4.15.0 ii linux-headers-4.15.0-213-generic 4.15.0-213.224 amd64 Linux kernel headers for version 4.15.0 on 64 bit x86 SMP ii linux-headers-generic 4.15.0.213.196 amd64 Generic Linux kernel headers rc linux-image-4.15.0-101-generic 4.15.0-101.102 amd64 Signed kernel image generic rc linux-image-4.15.0-106-generic 4.15.0-106.107 amd64 Signed kernel image generic rc linux-image-4.15.0-108-generic 4.15.0-108.109 amd64 Signed kernel image generic ===== END =====