Mane manesec

SeBackupPrivilege

Exploit with SeBackupPrivilege.

You need to setup NTFS Disk to support remote windows backup.

0x0 Pre-setup ntfs

# Create 2G Disk

Errors like this appear when you start elasticsearch in a container:

$ journalctl -xe
Dec 27 16:50:17 elasticsearch-03 mount[62]: mount: /sys/kernel/config: cannot mount configfs read-only.
Dec 27 16:50:17 elasticsearch-03 systemd-sysctl[63]: Couldn't write '262144' to 'vm/max_map_count', ignoring: Read-only file system
Dec 27 16:50:17 elasticsearch-03 systemd-sysctl[63]: Couldn't write '1' to 'fs/protected_hardlinks', ignoring: Read-only file system
Dec 27 16:50:17 elasticsearch-03 systemd-sysctl[63]: Couldn't write '1' to 'fs/protected_symlinks', ignoring: Read-only file system

$ /etc/init.d/elasticsearch status

	import time
	import os
	import ntplib
	client = ntplib.NTPClient()
	response = client.request('ntp4.aliyun.com')

	timestamp = int(response.tx_time)
	date_string = time.strftime('%d-%m-%Y', time.localtime(timestamp))
	print(date_string)
	os.system('date ' + date_string)

	#!/usr/bin/env python3

	"""Simple HTTP Server With Upload.

	This module builds on BaseHTTPServer by implementing the standard GET
	and HEAD requests in a fairly straightforward manner.

	see: https://gist.github.com/UniIsland/3346170
	"""

	#!/bin/bash

	# Usage: ./minio-upload my-bucket my-file.zip

	bucket=$1
	file=$2

	host=minio.example.com
	s3_key=svc_example_user
	s3_secret=svc_example_user_password

	# Based on:
	# https://gist.github.com/DakuTree/98c8362fb424351b803e
	# https://gist.github.com/jordan-wright/5770442
	# https://gist.github.com/DakuTree/428e5b737306937628f2944fbfdc4ffc
	# https://stackoverflow.com/questions/60416350/chrome-80-how-to-decode-cookies
	# https://stackoverflow.com/questions/43987779/python-module-crypto-cipher-aes-has-no-attribute-mode-ccm-even-though-pycry

	import os
	import json
	import base64

	{
	"log": {
	"level": "info",
	"timestamp": true
	},
	"dns": {
	"servers": [
	{
	"tag": "dns_proxy",
	"address": "tls://dns.google",

	#! /bin/bash

	interface="$(ip tuntap show \| cut -d : -f1 \| head -n 1)"
	gatewayip=`ip -j route list table all \| jq -r '.[] \| select(.dev=="'$interface'") \| .gateway' \| grep -v null \| head -n 1`
	localip=`ip -j route list table all \| jq -r '.[] \| select(.dev=="'$interface'") \| .prefsrc' \| grep -v null \| head -n 1`
	delay=`ping $gatewayip -W 1 -c 1\| awk -F'/' 'END{ print (/^rtt/? ""$5" ms":"") }'`

	if [[ $interface == '' ]]; then
	echo "" ;
	else

	#! /bin/bash

	# Please note that the script runs in base64 to prevent spoilers.
	# If you're done, you can decode the base64.

	# container port
	port=8888

	echo ' * This is script used to create Hackable sqli-lab container * '
	echo 'Please Note that: After patch it, You can get a root shell !!'

	#! /bin/python3
	# add crontab
	# * * * * * /bin/update_openwrt \| tee /update_openwrt.log

	import subprocess,sys,time,os
	from netaddr import IPAddress,IPNetwork

	# simple config openwrt in docker
	# by manesec