linux提权常用命令

操作系统

系统版本相关

1
2
3
cat /etc/issue
cat /etc/*-release
lsb_release -a

系统内核版本

1
2
3
4
5
6
cat /proc/version
uname -a
uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-

环境变量

1
2
3
4
5
6
7
cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set

查看主机架构

1
arch --version

应用和服务

查看正在运行的程序和对应的权限

1
2
3
4
ps aux
ps -ef
top
cat /etc/services

查看安装的应用

1
2
3
4
5
6
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archives
ls -alh /var/cache/yum/

一些服务的配置

1
2
3
4
5
6
7
8
9
10
cat /etc/syslog.conf
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/cups/cupsd.conf
cat /etc/inetd.conf
cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/ | awk '$1 ~ /^.*r.*/'

计划任务

1
2
3
4
5
6
7
8
9
10
11
12
crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root

找用户明文存储的密码

1
2
3
grep -i user [filename]
grep -i pass [filename]
grep -C 5 "password" [filename]

通信和网络

查看当前网络地址

1
2
3
/sbin/ifconfig -a
cat /etc/network/interfaces
cat /etc/sysconfig/network

网络配置 DNS DHCP

1
2
3
4
5
6
cat  /etc/networks
cat /etc/hosts
cat /etc/resolv.conf
iptables -L
hostname
dnsdomainname

网络通信

1
2
3
4
5
6
7
8
lsof -i
lsof -i :80
grep 80 /etc/services
netstat -antup
netstat -antpx
netstat -tulpn
chkconfig --list
chkconfig --list | grep 3:on

查看缓存

1
2
3
arp -e
route
/sbin/route -nee

用户相关

用户信息

1
2
3
4
5
6
7
8
9
10
11
12
id
who
w
last
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/
grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}' # 列出超级用户
awk -F: '($3 == "0") {print}' /etc/passwd #列出超级用户
cat /etc/sudoers
sudo -l

其他用户的操作记录

1
2
3
4
5
cat ~/.bash_history
cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history
cat ~/.php_history

ssh私钥

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key

文件系统

查看网站文件

1
2
3
4
5
ls -alhR /var/www/
ls -alhR /srv/www/htdocs/
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/
ls -alhR /var/www/html/

常见日志文件

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
cat /etc/httpd/logs/access_log
cat /etc/httpd/logs/access.log
cat /etc/httpd/logs/error_log
cat /etc/httpd/logs/error.log
cat /var/log/apache2/access_log
cat /var/log/apache2/access.log
cat /var/log/apache2/error_log
cat /var/log/apache2/error.log
cat /var/log/apache/access_log
cat /var/log/apache/access.log
cat /var/log/auth.log
cat /var/log/chttp.log
cat /var/log/cups/error_log
cat /var/log/dpkg.log
cat /var/log/faillog
cat /var/log/httpd/access_log
cat /var/log/httpd/access.log
cat /var/log/httpd/error_log
cat /var/log/httpd/error.log
cat /var/log/lastlog
cat /var/log/lighttpd/access.log
cat /var/log/lighttpd/error.log
cat /var/log/lighttpd/lighttpd.access.log
cat /var/log/lighttpd/lighttpd.error.log
cat /var/log/messages
cat /var/log/secure
cat /var/log/syslog
cat /var/log/wtmp
cat /var/log/xferlog
cat /var/log/yum.log
cat /var/run/utmp
cat /var/webmin/miniserv.log
cat /var/www/logs/access_log
cat /var/www/logs/access.log
ls -alh /var/lib/dhcp3/
ls -alh /var/log/postgresql/
ls -alh /var/log/proftpd/
ls -alh /var/log/samba/

寻找目录

1
2
3
4
5
find / -writable -type d 2>/dev/null      # 可写目录
find / -perm -222 -type d 2>/dev/null # 可写目录
find / -perm -o w -type d 2>/dev/null # 可写目录
find / -perm -o x -type d 2>/dev/null # 可执行目录
find / \( -perm -o w -perm -o x \) -type d 2>/dev/null # 可写可执行

查看语言支持

1
2
3
4
find / -name perl*
find / -name python*
find / -name gcc*
find / -name cc

我觉得不如直接敲命令方便?

查看上传方式

1
2
3
4
5
find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp*
find / -name ftp

编译exp

1
2
3
4
which gcc
gcc exp.c -o exp
chmod +x ./exp
./exp

提权环境检查脚本

LinEnum

linuxprivchecker

参考:https://evi1cg.me/archives/Linux_Command.html