Beyond


This is the beyond page that an additional post enumeration and assessment are conducted as the root user after compromising the target system.

Crontab


root@sightless:~# crontab -l | grep -v '^#'
*/5 * * * * /root/scripts/clean_up/sqlpad/default_sqlpad.sh

/root/scripts/clean_up/sqlpad/default_sqlpad.sh


root@sightless:~# cat /root/scripts/clean_up/sqlpad/default_sqlpad.sh
#!/usr/bin/env bash
 
# remove sessions of sqlpad(kick off users) 
/usr/bin/rm -r /root/docker-volumes/sqlpad-postgres/sessions/* 2>/dev/null
# replace old databases
/usr/bin/cp /root/scripts/clean_up/sqlpad/sqlpad.sqlite /root/docker-volumes/sqlpad-postgres/sqlpad.sqlite