任意文件读取的深度利用

任意文件读取的利用思路

有些文件需要高权限才能读取

1. /etc/passwd # 用户情况
2. /etc/shadow # 直接 John the Ripper
3. /etc/hosts # 主机信息
4. /root/.bashrc # 环境变量
5. /root/.bash_history # 还有root外的其他用户
6. /root/.viminfo # vim 信息
7. /root/.ssh/id_rsa # 拿私钥直接ssh
8. /proc/xxxx/cmdline # 进程状态枚举 xxxx 可以为0000-9999 使用burpsuite
9. 数据库 config 文件
10. web 日志 access.log, error.log
11. ssh 日志
12. /var/lib/php/sess_PHPSESSID # 非常规问题 session 文件( 参考 平安科技的一道session包含 http://www.jianshu.com/p/2c24ea34566b)

进一步推断系统版本

uname -a
lsb_release -d
cat /etc/issue
cat /proc/version
cat /etc/redhat-release 
cat /etc/debian_version
cat /etc/slackware_version
ls /etc/*version
cat /proc/cpuinfo

无痕反弹shell

kill -9 $$

常用默认路径整理

可以开虚拟机看看默认路径是什么

ssh

/root/.ssh/id_rsa
/root/.ssh/id_rsa.pub
/root/.ssh/authorized_keys
/etc/ssh/sshd_config
/var/log/secure

Nginx

/etc/nginx/nginx.conf
/var/www/html
/usr/local/services/nginx-1.6.2/logs/access.log
/usr/local/services/nginx-1.6.2/logs/error.log 
/usr/local/services/nginx-1.6.2/nginx.conf
/usr/local/services/nginx-1.6.2/conf/nginx.conf
/usr/local/services/nginx-1.6.2/conf/proxy.conf 
/usr/local/services/nginx-1.6.2/conf/extra/haolaiyao.conf

Apache

/home/httpd/
/home/httpd/www/

jetty

/usr/local/services/jetty-8.1.16/
/usr/local/services/jetty-8.1.16/logs/stderrout.log
/usr/local/services/jetty-8.1.16/etc/jetty.xml

resin

/usr/local/services/resin-4.0.44/
/usr/local/services/resin-4.0.44/conf/resin.xml
/usr/local/services/resin-4.0.44/conf/resin.properties

tomcat

/usr/local/services/apache-tomcat-8.0.23/logs
/usr/local/services/apache-tomcat-8.0.23/logs/catalina.out

svn

/home/svnroot/