渗透常用操作系统命令

转移自有道笔记->临时记录->操作时笔记
记录了渗透学习中linux和windows常用的命令,linux部分直接转载的,需要重新总结.

WIN

net

  • 查看共享连接net use
  • 增加远程共享net use \host /u:user pw
  • 查看域中当前主机列表net view /domain
  • 查看当前域中的用户net user /domain
  • 添加本地用户 net users name pw /add 其中的add也可以简写为ad(仅在win7下测试)
  • 添加本地用户到本地管理员组net localgroup Administrators username /add 其中的add也可以简写为ad(仅在win7下测试)
  • 查看组 net localgroup
  • 查看本地组net localgroup groupname
  • 查看域中组的信息net group /domain
  • 查看当前机器所在的域名net config workstation
  • 查看当前服务器所在域名net config server

系统信息相关

  • 显示系统信息(设备,补丁等)systeminfo
  • 查看远程主机的系统信息systeminfo /S ip /U domainuser /P pw
  • 显示进程和服务tasklist /svc
  • 显示所有进程和和Dll信息tasklist /m
  • 显示进程和所有者tasklist /v
  • 查看远程主机的进程列表tasklist /S ip /v
  • 搜索所有exe文件dir /a /s /b c:.exe
  • 显示服务信息sc query
  • 当前目录下(包含子目录,不区分大小写)找出内容包含’然并卵’字符串的文件findstr /si 然并卵 *.txt
  • 搜索当前目录下(包含子目录)敏感文件名称(还可以效防添加名称)dir /s *pass == *cred == *vnc == *.config
  • 设置当前配置禁用防火墙netsh advfirewall set currentprofile state off
  • 保存主机上所有wifi信息netsh wlan export profile folder=. key=clear
  • 设置端口转发netsh interface portproxy add v4tov4 listenport=3000 listenaddress=l.l.l.l connectport=4000 connectaddress=2.2.2.2
  • 启用远程访问reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server" /v fDenyTSConnections /t REG_DWORD /d 0 /f
  • 启用远程协助reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal Server" /v fAllowToGetHelp /t REG_DWORD /d 1 /f
  • 修改远程访问端口reg add "HKEY_LOCAL_MACHINESYSTEMCurrentControlSetControlTerminal ServerWinStationsRDP-Tcp" /v PortNumber /t REG_DWORD /d 12345 /f

注册表相关操作

  • 查找注册表中的密码reg query HKLM /f password /t REG_SZ /s

Linux

查看操作系统信息

  • 操作系统版本
1
2
3
4
cat /etc/issue
cat /etc/*-release
cat /etc/lsb-release # Debian
cat /etc/redhat-release # Redhat
  • 内核版本
1
2
3
4
5
6
cat /proc/version
uname -a
uname -mrs
rpm -q kernel
dmesg | grep Linux
ls /boot | grep vmlinuz-
  • 环境变量
1
2
3
4
5
6
7
cat /etc/profile
cat /etc/bashrc
cat ~/.bash_profile
cat ~/.bashrc
cat ~/.bash_logout
env
set

应用和服务

  • 正在运行的程序和权限
1
2
3
4
ps aux
ps -ef
top
cat /etc/services
  • 如果要查询root权限运行的进程,可以补充为
1
2
ps aux | grep root
ps -ef | grep root
  • 应用
1
2
3
4
5
6
ls -alh /usr/bin/
ls -alh /sbin/
dpkg -l
rpm -qa
ls -alh /var/cache/apt/archives
ls -alh /var/cache/yum/
  • 服务的配置文件
1
2
3
4
5
6
7
8
9
10
cat /etc/syslog.conf
cat /etc/chttp.conf
cat /etc/lighttpd.conf
cat /etc/cups/cupsd.conf
cat /etc/inetd.conf
cat /etc/apache2/apache2.conf
cat /etc/my.conf
cat /etc/httpd/conf/httpd.conf
cat /opt/lampp/etc/httpd.conf
ls -aRl /etc/ | awk '$1 ~ /^.*r.*/'
  • 计划任务
1
2
3
4
5
6
7
8
9
10
11
12
crontab -l
ls -alh /var/spool/cron
ls -al /etc/ | grep cron
ls -al /etc/cron*
cat /etc/cron*
cat /etc/at.allow
cat /etc/at.deny
cat /etc/cron.allow
cat /etc/cron.deny
cat /etc/crontab
cat /etc/anacrontab
cat /var/spool/cron/crontabs/root
  • 存储的明文用户名,密码
1
2
3
4
grep -i user [filename]
grep -i pass [filename]
grep -C 5 "password" [filename]
find . -name "*.php" -print0 | xargs -0 grep -i -n "var $password" # Joomla

网络相关

  • 网络地址
1
2
3
ifconfig -a
cat /etc/network/interfaces
cat /etc/sysconfig/network
  • 网络配置,DNS,DHCP,网关
1
2
3
4
5
6
cat /etc/resolv.conf
cat /etc/sysconfig/network
cat /etc/networks
iptables -L
hostname
dnsdomainname

-网络通信

1
2
3
4
5
6
7
8
9
10
lsof -i
lsof -i :80
grep 80 /etc/services
netstat -antup
netstat -antpx
netstat -tulpn
chkconfig --list
chkconfig --list | grep 3:on
last
w

-路由缓存

1
2
3
arp -e
route
route -nee

用户相关

  • 用户信息
1
2
3
4
5
6
7
8
9
10
11
12
id
who
w
last
cat /etc/passwd
cat /etc/group
cat /etc/shadow
ls -alh /var/mail/
grep -v -E "^#" /etc/passwd | awk -F: '$3 == 0 { print $1}' # 列出超级用户
awk -F: '($3 == "0") {print}' /etc/passwd #列出超级用户
cat /etc/sudoers
sudo -l
  • 列主目录
1
2
3
4
5
6
7
8
ls -ahlR /root/
ls -ahlR /home/
其他用户的操作记录
cat ~/.bash_history
cat ~/.nano_history
cat ~/.atftp_history
cat ~/.mysql_history
cat ~/.php_history
  • ssh私钥
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
cat ~/.ssh/authorized_keys
cat ~/.ssh/identity.pub
cat ~/.ssh/identity
cat ~/.ssh/id_rsa.pub
cat ~/.ssh/id_rsa
cat ~/.ssh/id_dsa.pub
cat ~/.ssh/id_dsa
cat /etc/ssh/ssh_config
cat /etc/ssh/sshd_config
cat /etc/ssh/ssh_host_dsa_key.pub
cat /etc/ssh/ssh_host_dsa_key
cat /etc/ssh/ssh_host_rsa_key.pub
cat /etc/ssh/ssh_host_rsa_key
cat /etc/ssh/ssh_host_key.pub
cat /etc/ssh/ssh_host_key

文件系统相关

  • 日志文件
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
ls -alh /var/log
ls -alh /var/mail
ls -alh /var/spool
ls -alh /var/spool/lpd
ls -alh /var/lib/pgsql
ls -alh /var/lib/mysql
cat /var/lib/dhcp3/dhclient.lea
cat /etc/httpd/logs/access_log
cat /etc/httpd/logs/access.log
cat /etc/httpd/logs/error_log
cat /etc/httpd/logs/error.log
cat /var/log/apache2/access_log
cat /var/log/apache2/access.log
cat /var/log/apache2/error_log
cat /var/log/apache2/error.log
cat /var/log/apache/access_log
cat /var/log/apache/access.log
cat /var/log/auth.log
cat /var/log/chttp.log
cat /var/log/cups/error_log
cat /var/log/dpkg.log
cat /var/log/faillog
cat /var/log/httpd/access_log
cat /var/log/httpd/access.log
cat /var/log/httpd/error_log
cat /var/log/httpd/error.log
cat /var/log/lastlog
cat /var/log/lighttpd/access.log
cat /var/log/lighttpd/error.log
cat /var/log/lighttpd/lighttpd.access.log
cat /var/log/lighttpd/lighttpd.error.log
cat /var/log/messages
cat /var/log/secure
cat /var/log/syslog
cat /var/log/wtmp
cat /var/log/xferlog
cat /var/log/yum.log
cat /var/run/utmp
cat /var/webmin/miniserv.log
cat /var/www/logs/access_log
cat /var/www/logs/access.log
ls -alh /var/lib/dhcp3/
ls -alh /var/log/postgresql/
ls -alh /var/log/proftpd/
ls -alh /var/log/samba/
  • 网站文件
1
2
3
4
5
ls -alhR /var/www/
ls -alhR /srv/www/htdocs/
ls -alhR /usr/local/www/apache22/data/
ls -alhR /opt/lampp/htdocs/
ls -alhR /var/www/html/
  • 文件挂载
1
2
3
mount
df -h
cat /etc/fstab
  • 可写目录
1
2
3
4
5
find / -writable -type d 2>/dev/null      # 可写目录
find / -perm -222 -type d 2>/dev/null # 可写目录
find / -perm -o w -type d 2>/dev/null # 可写目录
find / -perm -o x -type d 2>/dev/null # 可执行目录
find / \( -perm -o w -perm -o x \) -type d 2>/dev/null # 可写可执行目录

准备与攻击

  • 语言支持
1
2
3
4
find / -name perl*
find / -name python*
find / -name gcc*
find / -name cc
  • 上传方式
1
2
3
4
5
find / -name wget
find / -name nc*
find / -name netcat*
find / -name tftp*
find / -name ftp

参考

如果文章有问题欢迎指出,或者你也可以联系我
本文作者:E1se
本文链接: 2019/04/18/渗透常用操作系统命令/
版权声明: 本博客所有文章除特别声明外,均采用 CC BY-NC-SA 3.0 CN 许可协议。转载请注明出处!
-------------本文结束-------------
0%