ss 不显示与打开 SOL_SOCKET 的进程相关的套接字信息

ss 不显示与打开 SOL_SOCKET 的进程相关的套接字信息

我在 docker 容器内运行 python 代码,执行以下调用

import socket as s,subprocess as sp;s1=s.socket(s.AF_INET,s.SOCK_STREAM);
s1.setsockopt(s.SOL_SOCKET,s.SO_REUSEADDR, 1);s1.bind(("0.0.0.0",9001));s1.listen(1);c,a=s1.accept();

我正在尝试使用ss并查看打开的套接字来获取信息,但无法获取它们


docker run --rm --publish 9001:9001 -it --name python-app sample-python-app reverseshell.py

docker inspect --format='{{.State.Pid}}' python-app
1160502

> sudo ss -a -np | grep 9001 
tcp   LISTEN    0      4096                                                                              0.0.0.0:9001                0.0.0.0:*        users:(("docker-proxy",pid=1160459,fd=4))                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                
tcp   LISTEN    0      4096                                                                                 [::]:9001                   [::]:*        users:(("docker-proxy",pid=1160467,fd=4))                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   

然而 lsof 给了我更多信息:

> sudo lsof -p 1160502       
lsof: WARNING: can't stat() fuse.gvfsd-fuse file system /run/user/1000/gvfs
      Output information may be incomplete.
lsof: WARNING: can't stat() fuse.portal file system /run/user/1000/doc
      Output information may be incomplete.
COMMAND     PID   USER   FD   TYPE DEVICE SIZE/OFF     NODE NAME
python  1160502 dmitry  cwd    DIR 0,1364      108    19497 /workspace
python  1160502 dmitry  rtd    DIR 0,1364      188      256 /
python  1160502 dmitry  txt    REG 0,1364     6120     6529 /layers/paketo-buildpacks_cpython/cpython/bin/python3.10
python  1160502 dmitry  mem    REG   0,30              6529 /layers/paketo-buildpacks_cpython/cpython/bin/python3.10 (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              9492 /layers/paketo-buildpacks_cpython/cpython/lib/python3.10/lib-dynload/_posixsubprocess.cpython-310-x86_64-linux-gnu.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              9518 /layers/paketo-buildpacks_cpython/cpython/lib/python3.10/lib-dynload/fcntl.cpython-310-x86_64-linux-gnu.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              9514 /layers/paketo-buildpacks_cpython/cpython/lib/python3.10/lib-dynload/array.cpython-310-x86_64-linux-gnu.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              9527 /layers/paketo-buildpacks_cpython/cpython/lib/python3.10/lib-dynload/select.cpython-310-x86_64-linux-gnu.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              9520 /layers/paketo-buildpacks_cpython/cpython/lib/python3.10/lib-dynload/math.cpython-310-x86_64-linux-gnu.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              9499 /layers/paketo-buildpacks_cpython/cpython/lib/python3.10/lib-dynload/_socket.cpython-310-x86_64-linux-gnu.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30               634 /lib/x86_64-linux-gnu/libm-2.27.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30               692 /lib/x86_64-linux-gnu/libutil-2.27.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30               619 /lib/x86_64-linux-gnu/libdl-2.27.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30               670 /lib/x86_64-linux-gnu/libpthread-2.27.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30               609 /lib/x86_64-linux-gnu/libc-2.27.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              6705 /layers/paketo-buildpacks_cpython/cpython/lib/libpython3.10.so.1.0 (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30               591 /lib/x86_64-linux-gnu/ld-2.27.so (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              3735 /usr/lib/locale/locale-archive (path dev=0,32, inode=1544914)
python  1160502 dmitry  mem    REG   0,30              1365 /usr/lib/x86_64-linux-gnu/gconv/gconv-modules.cache (stat: No such file or directory)
python  1160502 dmitry  mem    REG   0,30              1091 /usr/lib/locale/C.UTF-8/LC_CTYPE (stat: No such file or directory)
python  1160502 dmitry    0u   CHR  136,0      0t0        3 /dev/pts/0
python  1160502 dmitry    1u   CHR  136,0      0t0        3 /dev/pts/0
python  1160502 dmitry    2u   CHR  136,0      0t0        3 /dev/pts/0
python  1160502 dmitry    3u  sock    0,8      0t0 75159952 protocol: TCP

至少我有这一行显示 fd=3 打开套接字 [75159952] 但没有实际的端口号。

python  1160502 dmitry    3u  sock    0,8      0t0 75159952 protocol: TCP

那么如何查找ss有关端口 9001 上未打开套接字的信息呢docker-proxy

答案1

您必须首先切换到正确的网络名称空间,因为套接字状态是每个名称空间(即每个网络命名空间)。例如通过使用nsentersudo必须先移动,因为nsenter也需要特权。在一行中(并使用ss自己的过滤功能),这将变为:

sudo nsenter -t $(docker inspect --format='{{.State.Pid}}' python-app) --net -- \
    ss -a -np sport == 9001

相关内容