SSH-Angriff aus Andorra: BusyBox-Ausbruch und Hardware ausspähen

user='root' pass='123'
root@srv01:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
root@srv01:~$ uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo "")
Linux 5.10.103-v7l+ #1 SMP Wed Jun 24 14:21:04 BST 2020 octopi armv7l
root@srv01:~$ arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo "")
x86_64 )
aarch64 )
armv7l )
root@srv01:~$ uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)
221.45 1890.23
root@srv01:~$ cpus=$(nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c "^processor" /proc/cpuinfo 2>/dev/null)
4
root@srv01:~$ cpu_model=$( { lscpu 2>/dev/null | awk -F: '/Model name/ {print $2}'; grep -m1 -E "^model name" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; grep -m1 -E "^Hardware" /proc/cpuinfo 2>/dev/null | cut -d: -f2-; cat /proc/device-tree/model 2>/dev/null; } | sed '/^$/d; /unknown/d; s/^[[:space:]]*//; s/[[:space:]]*$//; s/ AArch64 Processor$//; s/ Processor$//; s/ CPU$//' | head -1 )
ARMv7 Processor rev 3 (v7l)
root@srv01:~$ gpu_info=$( (lspci 2>/dev/null | grep -i vga; lspci 2>/dev/null | grep -i nvidia; busybox lspci 2>/dev/null | grep -i vga; busybox lspci 2>/dev/null | grep -i nvidia) 2>/dev/null )
bash: lspci: command not found
root@srv01:~$ last_output=$(last 2>/dev/null)
bash: last: command not found
root@srv01:~$ filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev…
bash: filter: No such file or directory
===SHELL_BEHAVIOR===
root@srv01:~$ echo "UNAME:$uname"
UNAME:$uname
root@srv01:~$ echo "ARCH:$arch"
ARCH:$arch
root@srv01:~$ echo "UPTIME:$uptime"
UPTIME:$uptime
root@srv01:~$ echo "CPUS:$cpus"
CPUS:$cpus
root@srv01:~$ echo "CPU_MODEL:$cpu_model"
CPU_MODEL:$cpu_model
root@srv01:~$ echo "GPU:$gpu_info"
GPU:$gpu_info
root@srv01:~$ echo "LAST:$last_output"
root@srv01:~$ echo "FILTER:$filter_output"
root@srv01:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C
root@srv01:~$ uname=$(for c in uname /bin/uname /usr/bin/uname 'busybox uname' 'toybox uname'; do v=$($c -s -v -n -m 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; IFS= read -r v < /proc/version && printf '%s\n' "$v") 2>/dev/null
Linux octopi 5.10.103-v7l+ #1373 SMP Mon Jan 23 13:53:32 GMT 2023 armv7l
root@srv01:~$ arch=$(for c in uname /bin/uname /usr/bin/uname 'busybox uname' 'toybox uname'; do v=$($c -m 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; for c in arch 'busybox arch' 'toybox arch'; do v=$($c 2>/dev/null) && [ -n "$v" ] && { printf '%s\n' "$v"; exit; }; done; printf '%s\n' unknown)
armv7l
root@srv01:~$ uptime=$(IFS= read -r v < /proc/uptime && printf '%s\n' "$v" || cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null || toybox cat /proc/uptime 2>/dev/null) 2>/dev/null
19142400.00 19142400.00
root@srv01:~$ cpus=$(unset OMP_NUM_THREADS OMP_THREAD_LIMIT; for c in nproc /usr/bin/nproc 'busybox nproc' 'toybox nproc'; do v=$($c 2>/dev/null) || continue; case $v in ''|*[!0-9]*) continue ;; esac; [ "$v" -gt 0 ] 2>/dev/null && { printf '%s\n' "$v"; exit; }; done; for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; v=$($a 'function count(s, a,b,n,i,t,m) { …
4
root@srv01:~$ cpu_model=$(for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; r() { [ -r "$1" ] || return; while IFS= read -r s || [ -n "$s" ]; do printf '%s\n' "$s"; done < "$1"; }; v=$({ lscpu 2>/dev/null || busybox lscpu 2>/dev/null || toybox lscpu 2>/dev/null; printf '\n@@CPUINFO@@\n'; r /proc/cpuinfo; printf '\n@@MIDR@@\n'; for f in /sys/devices/system/c…
ARMv7 Processor rev 3 (v7l)
root@srv01:~$ gpu_info=$(for a in awk 'busybox awk' 'toybox awk'; do $a 'BEGIN { exit 0 }' </dev/null 2>/dev/null && break; done; r() { [ -r "$1" ] || return; while IFS= read -r s || [ -n "$s" ]; do printf '%s\n' "$s"; done < "$1"; }; v=$(for c in lspci 'busybox lspci' 'toybox lspci'; do p=$($c -Dnn 2>/dev/null) || p=; [ -n "$p" ] || { p=$($c -nn 2>/dev/null) || p=; }; [ -n "$p" ] || { p=$($c 2>/dev/null) || p=…
root@srv01:~$ last_output=$(last 2>/dev/null)
bash: last: command not found
root@srv01:~$ filter_output=$( ( export LANG=C LC_ALL=C; echo '===SHELL_BEHAVIOR==='; printf 'path_err='; ( ./xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev/null || dd bs=250 count=1 2>/dev/null ) | ( tr -d '\n' 2>/dev/null || busybox tr -d '\n' 2>/dev/null || cat ); printf '\n'; printf 'cmd_err='; ( xxxxxx 2>&1 || true ) | ( head -c 250 2>/dev/null || busybox head -c 250 2>/dev…
bash: filter: No such file or directory
===SHELL_BEHAVIOR===
root@srv01:~$ printf 'UNAME:%s\n' "$uname"
UNAME:Linux octopi 5.10.103-v7l+ #1373 SMP Mon Jan 23 13:53:32 GMT 2023 armv7l
root@srv01:~$ printf 'ARCH:%s\n' "$arch"
ARCH:armv7l
root@srv01:~$ printf 'UPTIME:%s\n' "$uptime"
UPTIME:19142400.00 19142400.00
root@srv01:~$ printf 'CPUS:%s\n' "$cpus"
CPUS:4
root@srv01:~$ printf 'CPU_MODEL:%s\n' "$cpu_model"
CPU_MODEL:ARMv7 Processor rev 3 (v7l)
root@srv01:~$ printf 'GPU:%s\n' "$gpu_info"
GPU:
root@srv01:~$ printf 'LAST:%s\n' "$last_output"
root@srv01:~$ printf 'FILTER:%s\n' "$filter_output"
root@srv01:~$ echo '123' | sudo -S sh -c 'nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c '\''^processor'\'' /proc/cpuinfo 2>/dev/null' || echo '123' | sudo -S nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null || grep -c '^processor' /proc/cpuinfo 2>/dev/null || sh -c 'nproc 2>/dev/null || /usr/bin/nproc 2>/dev/null || busybox nproc 2>/dev/null …
123
123
root@srv01:~$ export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH
root@srv01:~$ uname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v -n -m 2>/dev/null || /usr/bin/uname -s -v -n -m 2>/dev/null || busybox uname -s -v -n -m 2>/dev/null || ( [ -f /proc/version ] && head -1 /proc/version | cut -d' ' -f1 ) || ( [ -f /etc/os-release ] && grep '^ID=' /etc/os-release | cut -d= -f2 | tr -d '"' ) || echo "")
Linux 5.10.103-v7l+ #1 SMP Wed Jun 24 14:21:04 BST 2020 octopi armv7l
root@srv01:~$ arch=$(uname -m 2>/dev/null || /bin/uname -m 2>/dev/null || /usr/bin/uname -m 2>/dev/null || busybox uname -m 2>/dev/null || ( [ -f /proc/cpuinfo ] && grep -q "lm" /proc/cpuinfo && echo x86_64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 8" /proc/cpuinfo && echo aarch64 ) || ( [ -f /proc/cpuinfo ] && grep -q "CPU architecture: 7" /proc/cpuinfo && echo armv7l ) || echo "")
x86_64 )
aarch64 )
armv7l )
root@srv01:~$ uptime=$(cat /proc/uptime 2>/dev/null || busybox cat /proc/uptime 2>/dev/null)
221.45 1890.23