1
┌────────────────────── 用户态 ──────────────────────┐
2
│  进程        / 能力位  /  命名空间  / Cgroups       │
3
│     │            │         │            │           │
4
│     ▼            ▼         ▼            ▼           │
5
│  DAC ── MAC (SELinux/AppArmor) ── LSM Hook          │
6
└─────────────────────────┬───────────────────────────┘
7
                          │ syscall
8
                ┌─────────▼─────────┐
9
                │   Linux 内核       │
10
                │   系统调用表       │
11
                └─────────┬─────────┘
12
                          │ seccomp 过滤 → hardware
13
                          ▼
14
                     硬件/虚拟化

1
  -rwxr-xr--  1  alice  dev  4096  Apr 24 12:00  app
2
  │└┬┘└┬┘└┬┘     └─┬─┘ └┬┘
3
  │ │  │  │        │    └── 所属组 dev
4
  │ │  │  │        └── 所有者 alice
5
  │ │  │  └── other 权限 r--
6
  │ │  └── group 权限 r-x
7
  │ └── owner 权限 rwx
8
  └── 文件类型：- 普通、d 目录、l 链接、b/c 设备、s 套接字

1
find / -perm -4000 -type f 2>/dev/null   # 查找所有 SUID 程序 → 提权关注点
2
find / -perm -2000 -type f 2>/dev/null   # SGID

1
getcap -r / 2>/dev/null                  # 枚举带能力的二进制
2
setcap cap_net_raw+ep ./my_tool          # 赋予
3
capsh --print                            # 查看当前进程

1
Namespace     隔离对象                    常用工具
2
──────────────────────────────────────────────
3
pid           进程 ID                    unshare --pid
4
net           网络栈                     ip netns add net1
5
mnt           挂载点                     unshare --mount
6
uts           主机名                     unshare --uts
7
ipc           IPC 资源                   unshare --ipc
8
user          UID/GID 映射               unshare --user
9
cgroup        cgroup 根                  unshare --cgroup
10
time          CLOCK_MONOTONIC 偏移        5.6+

1
module myapp 1.0;
2

3
require {
4
    type init_t, httpd_t, http_port_t;
5
    class tcp_socket name_connect;
6
}
7

8
allow httpd_t http_port_t:tcp_socket name_connect;

1
#include <tunables/global>
2
/usr/bin/myapp {
3
  #include <abstractions/base>
4
  capability net_bind_service,
5
  network inet stream,
6
  /etc/myapp/ r,
7
  /etc/myapp/** r,
8
  /var/log/myapp.log w,
9
  deny /etc/shadow r,
10
  deny @{HOME}/.ssh/** rw,
11
}

1
auth       required   pam_faillock.so preauth deny=5 unlock_time=900
2
auth       required   pam_unix.so nullok_secure try_first_pass
3
auth       optional   pam_google_authenticator.so
4
account    required   pam_nologin.so
5
account    required   pam_unix.so
6
password   requisite  pam_pwquality.so retry=3 minlen=12 ucredit=-1
7
password   required   pam_unix.so sha512 shadow use_authtok
8
session    required   pam_limits.so
9
session    required   pam_unix.so

1
-w /etc/passwd -p wa -k identity
2
-w /etc/shadow -p wa -k identity
3
-w /etc/sudoers -p wa -k privilege
4
-a always,exit -F arch=b64 -S execve -F key=execve
5
-a always,exit -F arch=b64 -S connect -F key=net

1
bpftrace -e 'tracepoint:syscalls:sys_enter_execve {
2
    printf("%d %s\n", pid, str(args->filename));
3
}'

1
#!/usr/bin/env bash
2
set -euo pipefail
3

4
# 1. 更新
5
apt-get update && apt-get -y upgrade && apt-get -y dist-upgrade
6
apt-get -y install unattended-upgrades fail2ban apparmor-utils auditd ufw
7

8
# 2. SSH
9
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config
10
sed -i 's/^#\?PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
11
echo 'AllowUsers admin' >> /etc/ssh/sshd_config
12
systemctl restart sshd
13

14
# 3. sysctl
15
cat >/etc/sysctl.d/99-hardening.conf <<'EOF'
16
net.ipv4.tcp_syncookies=1
17
net.ipv4.conf.all.rp_filter=1
18
net.ipv4.conf.all.accept_redirects=0
19
net.ipv4.conf.all.send_redirects=0
20
net.ipv4.icmp_echo_ignore_broadcasts=1
21
kernel.randomize_va_space=2
22
kernel.kptr_restrict=2
23
kernel.dmesg_restrict=1
24
kernel.unprivileged_userns_clone=0
25
fs.protected_hardlinks=1
26
fs.protected_symlinks=1
27
EOF
28
sysctl --system
29

30
# 4. UFW
31
ufw default deny incoming
32
ufw default allow outgoing
33
ufw allow 22/tcp
34
ufw --force enable
35

36
# 5. auditd
37
cat >/etc/audit/rules.d/hard.rules <<'EOF'
38
-w /etc/passwd -p wa -k identity
39
-w /etc/shadow -p wa -k identity
40
-w /etc/sudoers -p wa -k privilege
41
-a always,exit -F arch=b64 -S execve -F key=execve
42
EOF
43
augenrules --load
44

45
# 6. fail2ban
46
cat >/etc/fail2ban/jail.d/sshd.conf <<'EOF'
47
[sshd]
48
enabled = true
49
maxretry = 5
50
findtime = 10m
51
bantime = 1h
52
EOF
53
systemctl restart fail2ban

1
// 关键：新增的 pipe_buf 未清 PIPE_BUF_FLAG_CAN_MERGE
2
static size_t copy_page_to_iter_pipe(struct page *page, size_t offset,
3
                                     size_t bytes, struct iov_iter *i) {
4
    struct pipe_inode_info *pipe = i->pipe;
5
    struct pipe_buffer *buf = &pipe->bufs[(pipe->head - 1) & (pipe->ring_size - 1)];
6
    if (offset == buf->offset + buf->len) {
7
        buf->len += bytes;
8
        i->iov_offset = offset + bytes;
9
        i->count -= bytes;
10
        return bytes;
11
    }
12
    ...
13
    // 新加入的 buf->flags 没被显式清 0
14
    buf->flags = PIPE_BUF_FLAG_CAN_MERGE; // ← 问题所在
15
}

1
int fd = open(path, O_RDONLY);
2
pipe2(p, 0);
3
splice(fd, &offset, p[1], NULL, 1, 0);   // page 进入 pipe，flags 被写入 CAN_MERGE
4
write(p[1], data, strlen(data));         // 数据落到只读文件的 page cache

1
buf->flags = PIPE_BUF_FLAG_CAN_MERGE;
2
buf->flags = 0;

1
// 漏洞版
2
for (to = user_args, av = NewArgv + 1; (from = *av); av++) {
3
    while (*from) {
4
        if (from[0] == '\\' && !isspace((unsigned char)from[1]))
5
            from++;                      // ← 越界读
6
        *to++ = *from++;
7
    }
8
    *to++ = ' ';
9
}

1
int main(int argc, char *argv[]) {
2
    n = 1;
3
    for (;;) {
4
        if (path[0] == '/') break;
5
        if (n >= argc) break;            // ← argc=0 时直接跳过
6
        ...
7
    }
8
}

1
char *const argv[] = { NULL };
2
char *const envp[] = { "pwn", "PATH=GCONV_PATH=.", "CHARSET=x", "SHELL=x", NULL };
3
execve("/usr/bin/pkexec", argv, envp);

1
1. 找可触发原语（UAF / heap overflow / OOB write）
2
2. 构造堆布局（msg_msg / simple_xattr / pipe_buffer 是经典喷射对象）
3
3. 劫持某个内核指针（cred / modprobe_path / core_pattern）
4
4. 提权：commit_creds(prepare_kernel_cred(0)) 或改写 modprobe_path 到 shell
5
5. 返回用户态并清理副作用

1
Access Token {
2
  User SID         (例：S-1-5-21-...-1105)
3
  Group SIDs       [多个]
4
  Privileges       (Luid, Attributes) 列表
5
  Owner / PrimaryGroup
6
  DefaultDacl
7
  LogonId
8
  TokenType        Primary / Impersonation
9
  ImpersonationLevel Anonymous/Identification/Impersonation/Delegation
10
}

1
// 简化伪代码
2
HRESULT RpcAddPrinterDriverEx(..., DRIVER_INFO_2 *pDriverInfo, DWORD dwFileCopyFlags) {
3
    if (!IsAdministrator() && !(dwFileCopyFlags & APD_COPY_FROM_DIRECTORY)) {
4
        // 原本应 require 管理员
5
        return ERROR_ACCESS_DENIED;
6
    }
7
    // ...
8
    LoadPrinterDriver(pDriverInfo->pDriverPath);    // 直接加载
9
}

1
外网钓鱼 / 暴露服务
2
      │ Foothold
3
      ▼
4
本地枚举 (Seatbelt / winPEAS)
5
      │ Local PrivEsc
6
      ▼
7
域内枚举 (BloodHound / PowerView)
8
      │
9
   ┌──┴──┐
10
   ▼     ▼
11
Kerberoast   AS-REP Roasting  → 离线爆破
12
      │
13
   NTLM Relay / Zerologon / PrintNightmare / ADCS ESC*
14
      │
15
      ▼
16
获取域管或 krbtgt
17
      │
18
      ▼
19
DCSync / Golden Ticket / Silver Ticket / DCShadow → 持久化

1
Client                               KDC                     Service
2
  │ AS-REQ (username, pre-auth) ──▶  │
3
  │ ◀── AS-REP (TGT enc/krbtgt, sess key) ─────────────────│
4
  │ TGS-REQ (TGT, SPN) ──────────▶  │
5
  │ ◀── TGS-REP (service ticket) ───│
6
  │ AP-REQ (service ticket) ─────────────────────────────▶ │
7
  │ ◀── AP-REP ────────────────────────────────────────── │

1
Ticket = Enc_Kkrbtgt {
2
    flags, key (session key), realm, cname,
3
    authtime, starttime, endtime, renew_till,
4
    PAC  ← Privilege Attribute Certificate (SID 清单、组、签名)
5
}

1
// 找到从"Kerberoastable 用户"到"Domain Admins"的最短路径
2
MATCH p=shortestPath(
3
    (u:User {hasspn: true})-[*1..]->(g:Group {name: "DOMAIN ADMINS@CORP.LOCAL"})
4
) RETURN p
5

6
// 有 DCSync 权限的账户
7
MATCH (n)-[:GetChanges|GetChangesAll]->(d:Domain)
8
RETURN n.name, d.name
9

10
// 横向：哪些用户对本机有 CanRDP
11
MATCH (u:User)-[:CanRDP]->(c:Computer {name:"WS01.CORP.LOCAL"})
12
RETURN u.name

1
<Sysmon schemaversion="4.82">
2
  <EventFiltering>
3
    <RuleGroup name="Critical Creds Dump" groupRelation="or">
4
      <ProcessAccess onmatch="include">
5
        <TargetImage condition="contains">lsass.exe</TargetImage>
6
        <GrantedAccess condition="contains">0x1010</GrantedAccess>
7
      </ProcessAccess>
8
    </RuleGroup>
9
    <RuleGroup name="Persistence" groupRelation="or">
10
      <RegistryEvent onmatch="include">
11
        <TargetObject condition="contains">\Run</TargetObject>
12
        <TargetObject condition="contains">\RunOnce</TargetObject>
13
      </RegistryEvent>
14
    </RuleGroup>
15
  </EventFiltering>
16
</Sysmon>

1
-- 查找 SUID 可执行文件
2
SELECT path, uid, mode FROM suid_bin;
3

4
-- 监控 /etc/hosts 变动
5
SELECT * FROM file_events
6
 WHERE target_path='/etc/hosts';
7

8
-- 异常 ssh 登录
9
SELECT * FROM logged_in_users WHERE tty NOT IN ('ssh','tty1','console');

1
bpftrace -e '
2
tracepoint:syscalls:sys_enter_execve {
3
    @cmd[pid] = str(args->filename);
4
}
5
tracepoint:syscalls:sys_exit_execve {
6
    if (strcontains(@cmd[pid], "/tmp/")) {
7
        printf("SUSPICIOUS EXEC from /tmp: pid=%d cmd=%s\n", pid, @cmd[pid]);
8
    }
9
    delete(@cmd[pid]);
10
}'

1
// file.c  用 clang 编译为 BPF 字节码
2
SEC("lsm/bprm_check_security")
3
int BPF_PROG(block_tmp_exec, struct linux_binprm *bprm, int ret) {
4
    char comm[16];
5
    bpf_current_comm(comm, sizeof(comm));
6
    if (bpf_strncmp(bprm->filename, 5, "/tmp/") == 0) {
7
        bpf_printk("[LSM] deny exec from /tmp: %s", comm);
8
        return -EPERM;
9
    }
10
    return ret;
11
}
12
char _license[] SEC("license") = "GPL";

1
PS script → amsi.dll!AmsiScanBuffer → 加载的 Provider (MpOav.dll)