Linux中本地提权

1、1 什么是本地提权？

本地提权是指攻击者在已经取得文件访问权限的进程上下文中，利用该进程的权限来提升自己的权限，这种攻击方式通常发生在具有较高权限的进程中，例如root用户。

1、2 本地提权的原理

本地提权的原理是利用进程间的信息传递，将攻击者的代码注入到目标进程中，从而实现对目标进程的控制，这种攻击方式通常利用了程序运行时的环境，例如系统调用、库函数等。

1、3 本地提权的方法

常见的本地提权方法有：

使用C库函数setuid和setgid实现权限提升；

利用系统调用如open、read、write等实现代码注入；

利用动态链接库加载技术实现代码注入；

利用内存共享技术实现代码注入。

EXP(Execute and Read)利用

2、1 什么是EXP?

EXP是一种基于Linux内核漏洞的攻击手段，通过执行恶意代码并读取受影响的进程内存来实现对系统的控制，EXP利用了Linux内核中的一个设计缺陷，即某些系统调用允许任意进程执行任意代码。

2、2 EXP利用的原理

EXP利用的原理是利用Linux内核中的EXP(Execute and Read)漏洞，通过发送特制的系统调用参数，使目标进程执行恶意代码，一旦恶意代码成功执行，攻击者就可以进一步利用目标进程的权限进行其他操作。

2、3 EXP利用的方法

常见的EXP利用方法有：

构造特制的系统调用参数，使目标进程执行恶意代码；

在恶意代码中添加后门，以便在后续攻击中继续控制目标进程；

利用目标进程的内存空间存储敏感数据，以便后续攻击。

示例分析

3、1 示例一：使用setuid和setgid实现本地提权

include <unistd.h>
include <sys/types.h>
include <sys/stat.h>
include <fcntl.h>
include <stdio.h>
include <stdlib.h>
include <string.h>
include <sys/ptrace.h>
include <sys/wait.h>
include <errno.h>
include <sys/user.h>
include <sys/reg.h>
include <linux/seccomp.h>
include <sys/capability.h>
include <sys/prctl.h>
include <sys/types.h>
include <sys/xattr.h>
include <sys/time.h>
include <sys/resource.h>
include <sys/socket.h>
include <netinet/in.h>
include <arpa/inet.h>
include <netdb.h>
include <ifaddrs.h>
include <netinet/tcp.h>
include <signal.h>
include <ulimit.h>
include <locale.h>
include <dirent.h>
include <pwd.h>
include <grp.h>
define AT_FDCWD (-100)     /* file descriptor for current working directory */    /* see fcntl(2) */    /* POSIX.1-2001 */    /* removed in POSIX.1-2008 */    /* replaced by AT_SYMLINK_NOFOLLOW (since Linux 2.6.24) */    /* added in POSIX.1-2008 */                           /* removed in POSIX.1-2008 */                                /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                        /* added in POSIX.1-2008 */                                                       /* removed in POSIX.1-2008 */                                                                          /* replaced by AT_SYMLINK_NOFOLLOW (since Linux 2.6.24) */                                                                /* added in POSIX.1-2008 */                                                                                 /* removed in POSIX.1-2008 */                                                                                                   /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                             /* added in POSIX.1-2008 */                                                                                     /* removed in POSIX.1-2008 */                                                                                                                        /* replaced by AT_SYMLINK_NOFOLLOW (since Linux 2.6.24) */                                                                                                      /* added in POSIX.1-2008 */                                                                                                     /* removed in POSIX.1-2008 */                                                                                                      /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                                         /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_SYMLINK_NOFOLLOW (since Linux 2.6.24) */                                                                                                 /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                             /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                                                /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                                                /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                              /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                                                /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                             /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                                                /* added in POSIX.1-2008 */                                                                      /* removed in POSIX.1-2008 */                                                                                          /* replaced by AT_REMOVEDIR (since Linux 2.6.24) */                                                                                                                /* added in POSIX.1-2008 */                                                                      /* removed in POSIX