Показать сообщение отдельно

  #7  
Старый 14.09.2015, 07:24
Valer4ik
Новичок
Регистрация: 25.07.2015
Сообщений: 7
С нами: 5686166

Репутация: 0
По умолчанию

Есть root доступ в mysql и такой серв

Код:
:/var/www/user/data $ uname -a
Linux usertoys.com.ua 3.2.0-4-amd64 #1 SMP Debian 3.2.68-1+deb7u1 x86_64 GNU/Linux
:/var/www/user/data $ ls -la /boot
total 15161
drwxr-xr-x  4 root root     1024 May 12 13:06 .
drwxr-xr-x 23 root root     4096 Jul 30 06:32 ..
-rw-r--r--  1 root root  2114623 Apr 25 03:31 System.map-3.2.0-4-amd64
-rw-r--r--  1 root root   129281 Apr 25 03:31 config-3.2.0-4-amd64
drwxr-xr-x  3 root root     5120 May 12 13:07 grub
-rw-r--r--  1 root root 10347571 May 12 13:06 initrd.img-3.2.0-4-amd64
drwxr-xr-x  2 root root    12288 May 12 13:01 lost+found
-rw-r--r--  1 root root  2842400 Apr 25 03:22 vmlinuz-3.2.0-4-amd64
:/var/www/user/data $ ls -la --full-time /lib
total 264
drwxr-xr-x 13 root root  4096 2015-05-16 00:32:27.064340794 +0300 .
drwxr-xr-x 23 root root  4096 2015-07-30 06:32:55.250270001 +0300 ..
lrwxrwxrwx  1 root root    21 2015-05-16 00:32:27.052340698 +0300 cpp -> /etc/alternatives/cpp
drwxr-xr-x  2 root root  4096 2015-05-12 13:05:25.243433001 +0300 discover
drwxr-xr-x  7 root root  4096 2015-05-12 13:03:48.463433001 +0300 firmware
drwxr-xr-x  2 root root  4096 2015-05-12 13:03:13.543433001 +0300 init
-rwxr-xr-x  1 root root 72184 2012-11-12 18:58:05.000000000 +0200 klibc-2xtYrByCrj5OEwaInv4tMSjej98.so
lrwxrwxrwx  1 root root    17 2013-03-01 15:55:02.000000000 +0200 libip4tc.so.0 -> libip4tc.so.0.1.0
-rw-r--r--  1 root root 31384 2013-03-01 15:55:04.000000000 +0200 libip4tc.so.0.1.0
lrwxrwxrwx  1 root root    17 2013-03-01 15:55:02.000000000 +0200 libip6tc.so.0 -> libip6tc.so.0.1.0
-rw-r--r--  1 root root 31448 2013-03-01 15:55:04.000000000 +0200 libip6tc.so.0.1.0
lrwxrwxrwx  1 root root    15 2013-03-01 15:55:02.000000000 +0200 libipq.so.0 -> libipq.so.0.0.0
-rw-r--r--  1 root root 10544 2013-03-01 15:55:04.000000000 +0200 libipq.so.0.0.0
lrwxrwxrwx  1 root root    16 2013-03-01 15:55:02.000000000 +0200 libiptc.so.0 -> libiptc.so.0.0.0
-rw-r--r--  1 root root  5928 2013-03-01 15:55:04.000000000 +0200 libiptc.so.0.0.0
lrwxrwxrwx  1 root root    19 2013-03-01 15:55:02.000000000 +0200 libxtables.so.7 -> libxtables.so.7.0.0
-rw-r--r--  1 root root 47824 2013-03-01 15:55:04.000000000 +0200 libxtables.so.7.0.0
drwxr-xr-x  3 root root  4096 2015-05-12 13:03:13.911433001 +0300 lsb
drwxr-xr-x  2 root root  4096 2015-05-12 13:03:25.155433001 +0300 modprobe.d
drwxr-xr-x  3 root root  4096 2015-05-12 13:03:59.007433001 +0300 modules
drwxr-xr-x  3 root root  4096 2015-05-12 13:03:27.079433001 +0300 systemd
drwxr-xr-x 15 root root  4096 2015-05-12 13:03:06.719433001 +0300 terminfo
drwxr-xr-x  5 root root  4096 2015-05-12 13:03:27.463433001 +0300 udev
drwxr-xr-x  4 root root 12288 2015-05-29 10:37:18.893494371 +0300 x86_64-linux-gnu
drwxr-xr-x  2 root root  4096 2015-05-12 13:03:24.923433001 +0300 xtables
:/var/www/user/data $ mount
sysfs on /sys type sysfs (rw,nosuid,nodev,noexec,relatime)
proc on /proc type proc (rw,nosuid,nodev,noexec,relatime)
udev on /dev type devtmpfs (rw,relatime,size=10240k,nr_inodes=746519,mode=755)
devpts on /dev/pts type devpts (rw,nosuid,noexec,relatime,gid=5,mode=620,ptmxmode=000)
tmpfs on /run type tmpfs (rw,nosuid,noexec,relatime,size=598420k,mode=755)
/dev/disk/by-uuid/8038203e-749a-4f44-bc0c-032c3bb78470 on / type ext4 (rw,relatime,errors=remount-ro,user_xattr,barrier=1,data=ordered,usrquota,grpquota)
tmpfs on /run/lock type tmpfs (rw,nosuid,nodev,noexec,relatime,size=5120k)
tmpfs on /run/shm type tmpfs (rw,nosuid,nodev,noexec,relatime,size=1301280k)
/dev/vda1 on /boot type ext2 (rw,relatime,errors=continue)
rpc_pipefs on /var/lib/nfs/rpc_pipefs type rpc_pipefs (rw,relatime)
:/var/www/user/data $ df -h
Filesystem                                              Size  Used Avail Use% Mounted on
rootfs                                                   58G   26G   29G  48% /
udev                                                     10M     0   10M   0% /dev
tmpfs                                                   585M  232K  585M   1% /run
/dev/disk/by-uuid/8038203e-749a-4f44-bc0c-032c3bb78470   58G   26G   29G  48% /
tmpfs                                                   5.0M     0  5.0M   0% /run/lock
tmpfs                                                   1.3G     0  1.3G   0% /run/shm
/dev/vda1                                                89M   17M   67M  21% /boot
:/var/www/user/data $ cat /etc/issue
Debian GNU/Linux 7 \n \l
:/var/www/user/data $ cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user  command
17 *    * * *   root    cd / && run-parts --report /etc/cron.hourly
25 6    * * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6    * * 7   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6    1 * *   root    test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )
#
:/var/www/user/data $ ls -la /etc/cron.d
total 20
drwxr-xr-x  2 root root 4096 Jun 15 13:23 .
drwxr-xr-x 93 root root 4096 Aug 28 09:27 ..
-rw-r--r--  1 root root  102 Jul  4  2012 .placeholder
-rw-r--r--  1 root root  254 Jun 13  2012 awstats
-rw-r--r--  1 root root  510 Mar 25 10:47 php5
:/var/www/user/data $ ls -la /etc/cron.hourly
total 12
drwxr-xr-x  2 root root 4096 May 12 13:03 .
drwxr-xr-x 93 root root 4096 Aug 28 09:27 ..
-rw-r--r--  1 root root  102 Jul  4  2012 .placeholder
:/var/www/user/data $ la -la /etc/cron.monthly
sh: 1: la: not found
:/var/www/user/data $ la -la /etc/cron.weekly
sh: 1: la: not found
:/var/www/user/data $ cat /etc/cron.hourly/*
cat: /etc/cron.hourly/*: No such file or directory
:/var/www/user/data $ cat /etc/cron.monthly/*
cat: /etc/cron.monthly/*: No such file or directory
:/var/www/user/data $ cat /etc/cron.weekly/*
#!/bin/sh
#
# man-db cron weekly

set -e

iosched_idle=
# Don't try to change I/O priority in a vserver or OpenVZ.
if ! egrep -q '(envID|VxID):.*[1-9]' /proc/self/status && \
   ([ ! -d /proc/vz ] || [ -d /proc/bc ]); then
    dpkg_version="$(dpkg-query -W -f '${Version}' dpkg 2>/dev/null)"
    if dpkg --compare-versions "$dpkg_version" ge 1.15.0; then
        iosched_idle='--iosched idle'
    fi
fi

if ! [ -d /var/cache/man ]; then
    # Recover from deletion, per FHS.
    mkdir -p /var/cache/man
    chown man:root /var/cache/man || true
    chmod 2755 /var/cache/man
fi

# regenerate man database
if [ -x /usr/bin/mandb ]; then
    # --pidfile /dev/null so it always starts; mandb isn't really a daemon,
    # but we want to start it like one.
    start-stop-daemon --start --pidfile /dev/null \
                      --startas /usr/bin/mandb --oknodo --chuid man \
                      $iosched_idle \
                      -- --quiet
fi

exit 0
#!/bin/sh

RKHUNTER=/usr/bin/rkhunter

test -x $RKHUNTER || exit 0

# source our config
. /etc/default/rkhunter

case "$CRON_DB_UPDATE" in
        [YyTt]*)

                if [ ! -x /usr/bin/wget ] && [ ! -x /usr/bin/curl ] && [ ! -x /usr/bin/links ] && \
                   [ ! -x /usr/bin/elinks ] && [ ! -x /usr/bin/lynx ]; then
                     echo "No tool with which to download rkhunter updates was found on your system. Please install wget, curl, (e)links or lynx"
                     exit 1
                fi

                OUTFILE=`mktemp` || exit 1

                case "$DB_UPDATE_EMAIL" in
                    [YyTt]*)
                        (
                        echo "Subject: [rkhunter] $(hostname -f) - Weekly database update"
                        echo "To: $REPORT_EMAIL"
                        echo ""
                        $RKHUNTER --versioncheck --nocolors --appendlog
                        $RKHUNTER --update --nocolors --appendlog
                        ) | /usr/sbin/sendmail $REPORT_EMAIL
                    ;;
                    *)
                        $RKHUNTER --versioncheck --appendlog 1>/dev/null 2>$OUTFILE
                        $RKHUNTER --update --appendlog 1>/dev/null 2>>$OUTFILE
                    ;;
                esac

                if [ -s "$OUTFILE" ]; then
                    (
                    echo "Subject: [rkhunter] $(hostname -f) - Weekly rkhunter database update"
                    echo "To: $REPORT_EMAIL"
                    echo ""
                    cat $OUTFILE
                    ) | /usr/sbin/sendmail $REPORT_EMAIL
                fi
                rm -f $OUTFILE
        ;;

        *)
                exit 0
        ;;
esac
:/var/www/user/data $ cat /proc/version
Linux version 3.2.0-4-amd64 (debian-kernel@lists.debian.org) (gcc version 4.6.3 (Debian 4.6.3-14) ) #1 SMP Debian 3.2.68-1+deb7u1
:/var/www/user/data $ cat /proc/sys/vm/mmap_min_addr
65536
:/var/www/user/data $ pwd
/var/www/user/data
:/var/www/user/data $ find / -type f -perm -u+s -exec ls -la {} \; 2>/dev/null
:/var/www/user/data $ id
uid=500(user) gid=500(user) groups=500(user),1000(mgrsecure)
:/var/www/user/data $
пробовал читать файлы из mysql но много не прочитал

select load_file('');

И из эксплоитов пробовал, (чекер показал)

- Kernel ia32syscall Emulation Privilege Escalation Language=c

- Sendpage Local Privilege Escalation Language=ruby**

- CAP_SYS_ADMIN to Root Exploit 2 (32 and 64-bit) Language=c

- MySQL 4.x/5.0 User-Defined Function Local Privilege Escalation Exploit Language=c

- open-time Capability file_ns_capable() Privilege Escalation Language=c

- open-time Capability file_ns_capable() - Privilege Escalation Vulnerability Language=c
 
Ответить с цитированием