{"id":81320,"date":"2026-07-25T00:59:32","date_gmt":"2026-07-24T16:59:32","guid":{"rendered":"https:\/\/www.wsisp.com\/helps\/81320.html"},"modified":"2026-07-25T00:59:32","modified_gmt":"2026-07-24T16:59:32","slug":"2026%e8%81%9a%e5%90%88%e7%8d%ac%e8%b1%b8%e6%9d%af-%e6%9c%8d%e5%8a%a1%e5%99%a8%e9%a2%98%e8%a7%a3%e6%9e%90","status":"publish","type":"post","link":"https:\/\/www.wsisp.com\/helps\/81320.html","title":{"rendered":"2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790"},"content":{"rendered":"<h2>\u68c0\u67503 &#8211; \u670d\u52a1\u5668\u53d6\u8bc1 Writeup<\/h2>\n<ul>\n<li>\u4f5c\u8005&#xff1a;yagami<\/li>\n<li>\u4efb\u52a1\u76ee\u5f55&#xff1a;\/mnt\/d\/\u6587\u6863\/hermes-work\/jiancai3-server-q1-to-q20\/<\/li>\n<li>\u751f\u6210\u65f6\u95f4&#xff1a;2026-06-14<\/li>\n<li>\u751f\u6210\u6a21\u5f0f&#xff1a;\u5b8c\u6574 writeup<\/li>\n<li>\u5de5\u5177&#xff1a;Hermes Agent<\/li>\n<li>\u6a21\u578b&#xff1a;Qwen3.6-27B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf<\/li>\n<li>\u8fd0\u884c\u65b9\u5f0f&#xff1a;\u672c\u5730<\/li>\n<\/ul>\n<h3>\u4efb\u52a1\u4fe1\u606f<\/h3>\n<ul>\n<li>\u9898\u76ee\u8303\u56f4&#xff1a;Q1-Q20&#xff08;\u68c0\u67503 &#8211; \u670d\u52a1\u5668\u53d6\u8bc1&#xff09;<\/li>\n<li>\u670d\u52a1\u5668&#xff1a;192.168.100.119:22 root\/123456 (CentOS 7)<\/li>\n<li>\u72b6\u6001\u6587\u4ef6&#xff1a;state.md, answers.md, findings.md, commands.md, errors.md, verification.md<\/li>\n<li>\u9a8c\u8bc1\u7b56\u7565&#xff1a;\u8fdc\u7a0b\u547d\u4ee4\u6267\u884c &#043; \u6e90\u7801\u5206\u6790 &#043; \u6570\u636e\u5e93\u67e5\u8be2 &#043; \u5f69\u8679\u8868\u5b57\u5178\u7206\u7834 &#043; \u540e\u53f0\u767b\u5f55\u5b9e\u9645\u9a8c\u8bc1<\/li>\n<\/ul>\n<h3>\u5de5\u5177\u4e0e\u6a21\u578b<\/h3>\n<table>\n<tr>\u9879\u76ee\u5185\u5bb9<\/tr>\n<tbody>\n<tr>\n<td>\u5de5\u5177<\/td>\n<td>Hermes Agent<\/td>\n<\/tr>\n<tr>\n<td>\u6a21\u578b<\/td>\n<td>Qwen3.6-27B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf<\/td>\n<\/tr>\n<tr>\n<td>\u8fd0\u884c\u65b9\u5f0f<\/td>\n<td>\u672c\u5730<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>\u7b54\u6848\u6c47\u603b<\/h3>\n<table>\n<tr>\u9898\u53f7\u7b54\u6848\u7b54\u6848\u72b6\u6001\u9a8c\u8bc1\u7b49\u7ea7\u5173\u952e\u8bc1\u636e\u6458\u8981<\/tr>\n<tbody>\n<tr>\n<td>Q1<\/td>\n<td>3.10.0<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L1<\/td>\n<td>uname -r \u8fdc\u7a0b\u6267\u884c\u786e\u8ba4\u5185\u6838\u7248\u672c<\/td>\n<\/tr>\n<tr>\n<td>Q2<\/td>\n<td>ahao<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L1<\/td>\n<td>getfacl \/etc\/shadow \u663e\u793a user:ahao:r&#8211; ACL\u6743\u9650<\/td>\n<\/tr>\n<tr>\n<td>Q3<\/td>\n<td>nginx\/1.20<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L1<\/td>\n<td>nginx -v \u786e\u8ba4\u4e3a nginx\/1.20.1<\/td>\n<\/tr>\n<tr>\n<td>Q4<\/td>\n<td>5<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L1<\/td>\n<td>network-check.py \u4e2d KICK_DELAY&#061;\u201c5 minutes\u201d<\/td>\n<\/tr>\n<tr>\n<td>Q5<\/td>\n<td>FF8180<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L1<\/td>\n<td>sha256sum faka_backup.sql \u540e6\u4f4d\u5927\u5199<\/td>\n<\/tr>\n<tr>\n<td>Q6<\/td>\n<td>Root&#064;123456<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>config.php\u6e90\u7801 &#043; MySQL\u767b\u5f55\u6d4b\u8bd5\u53cc\u8bc1\u636e<\/td>\n<\/tr>\n<tr>\n<td>Q7<\/td>\n<td>8081<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>ss -tlnp &#043; nginx.conf \u53cc\u8bc1\u636e\u786e\u8ba4\u76d1\u542c\u7aef\u53e3<\/td>\n<\/tr>\n<tr>\n<td>Q8<\/td>\n<td>60M<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L1<\/td>\n<td>php.ini upload_max_filesize &#061; 60M<\/td>\n<\/tr>\n<tr>\n<td>Q9<\/td>\n<td>8.208.44.202<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L1<\/td>\n<td>autobackup.sh REMOTE_SERVER&#061;\u201c8.208.44.202\u201d<\/td>\n<\/tr>\n<tr>\n<td>Q10<\/td>\n<td>\/fk\/static\/<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>nginx\u65e5\u5fd733\u6b21\u8bbf\u95ee &#043; login.php\u72ec\u7acb\u5bc6\u7801\u76d0\u53cc\u8bc1\u636e<\/td>\n<\/tr>\n<tr>\n<td>Q11<\/td>\n<td>192.168.203.135<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L1<\/td>\n<td>nginx\u65e5\u5fd7\u8be5IP\u8bbf\u95eelogin.php\u517115\u6b21\u6700\u591a<\/td>\n<\/tr>\n<tr>\n<td>Q12<\/td>\n<td>abc123456<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L3<\/td>\n<td>\u6e90\u7801\u7b97\u6cd5 &#043; SQL\u5907\u4efd\u54c8\u5e0c &#043; hashcat\u5f69\u8679\u8868\u7206\u7834 &#043; \u540e\u53f0\u767b\u5f55\u9a8c\u8bc1\u56db\u6e90\u4ea4\u53c9<\/td>\n<\/tr>\n<tr>\n<td>Q13<\/td>\n<td>\u65e0\u5fe7\u652f\u4ed8<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>faka_backup.sql payapi&#061;13 &#043; set.php\u89e3\u7801\u53cc\u8bc1\u636e<\/td>\n<\/tr>\n<tr>\n<td>Q14<\/td>\n<td>2018\/12\/14<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L3<\/td>\n<td>\u5728\u7ebfDB &#043; SQL\u5907\u4efd &#043; \u6e90\u7801\u9875\u811a\u4e09\u6e90\u4ea4\u53c9\u9a8c\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>Q15<\/td>\n<td>ZhangSan_Sec<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L3<\/td>\n<td>bash_history\u8ffd\u8e2a &#043; \u9690\u85cf\u5907\u4efd\u6587\u4ef6 &#043; \u89e3\u7801\u94fe\u4e09\u5c42\u9a8c\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>Q16<\/td>\n<td>24073<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>faka\/faka_original\u53cc\u6570\u636e\u5e93\u4ea4\u53c9\u9a8c\u8bc1 &#043; \u6e90\u7801\u786e\u8ba4status\u679a\u4e3e<\/td>\n<\/tr>\n<tr>\n<td>Q17<\/td>\n<td>5442<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>faka\/faka_original\u53cc\u6570\u636e\u5e93\u6309\u65e5\u7edf\u8ba1\u4ea4\u53c9\u9a8c\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>Q18<\/td>\n<td>\u65e0\u754f\u5951\u7ea6\u81ea\u52a8\u6273\u673a&#043;\u900f\u89c6&#043;\u51c6\u661f\u8f85\u52a9<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>faka\/faka_original\u53cc\u6570\u636e\u5e93JOIN\u7edf\u8ba1\u4ea4\u53c9\u9a8c\u8bc1<\/td>\n<\/tr>\n<tr>\n<td>Q19<\/td>\n<td>guoqi<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>\u6570\u636e\u5e93\u7edf\u8ba1 &#043; shua_site\u7528\u6237\u540d\u6620\u5c04\u53cc\u8bc1\u636e<\/td>\n<\/tr>\n<tr>\n<td>Q20<\/td>\n<td>_tmp_z5m1w8<\/td>\n<td>\u5df2\u9a8c\u8bc1<\/td>\n<td>L2<\/td>\n<td>mysql.user\u8868 &#043; SHOW GRANTS\u53cc\u67e5\u8be2\u4ea4\u53c9\u9a8c\u8bc1<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>\u89e3\u9898\u8fc7\u7a0b<\/h3>\n<h4>Q1 \u670d\u52a1\u5668\u5185\u6838\u7248\u672c\u53f7<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u670d\u52a1\u5668\u7684\u5185\u6838\u7248\u672c\u53f7\u662f\u591a\u5c11&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;4.25.0\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;3.10.0<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L1<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;SSH\u8fde\u63a5\u670d\u52a1\u5668\u540e\u6267\u884c uname -r \u83b7\u53d6\u5b8c\u6574\u5185\u6838\u7248\u672c&#xff0c;\u6309\u7b54\u6848\u683c\u5f0f\u53d6\u4e3b.\u6b21.\u4fee\u8ba2\u4e09\u6bb5\u3002<\/p>\n<p>\u5173\u952e\u8bc1\u636e&#xff1a;<\/p>\n<ul>\n<li>uname -r \u8fd4\u56de 3.10.0-1160.119.1.el7.x86_64<\/li>\n<li>\u6309\u683c\u5f0f\u63d0\u53d6\u524d\u4e09\u6bb5 &#061; 3.10.0<\/li>\n<\/ul>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">ssh<\/span> root&#064;192.168.100.119 <span class=\"token string\">&#034;uname -r&#034;<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>3.10.0-1160.119.1.el7.x86_64<\/p>\n<hr \/>\n<h4>Q2 \u8bfb\u53d6 \/etc\/shadow \u7684\u666e\u901a\u7528\u6237<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5acc\u7591\u4eba\u5c06\u67d0\u666e\u901a\u7528\u6237\u52a0\u5165\u7279\u6b8a\u7528\u6237\u7ec4&#xff0c;\u8d4b\u4e88\u5176\u8bfb\u53d6 \/etc\/shadow \u7684\u6743\u9650&#xff0c;\u8bf7\u95ee\u8be5\u666e\u901a\u7528\u6237\u7684\u7528\u6237\u540d\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;admin\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;ahao<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L1<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\/etc\/shadow \u9ed8\u8ba4\u6743\u9650\u4e3a 640&#xff08;root:shadow&#xff09;&#xff0c;\u901a\u8fc7 getfacl \u68c0\u67e5 ACL \u53d1\u73b0\u666e\u901a\u7528\u6237 ahao \u88ab\u989d\u5916\u6388\u4e88\u8bfb\u53d6\u6743\u9650\u3002<\/p>\n<p>\u5173\u952e\u8bc1\u636e&#xff1a;<\/p>\n<ul>\n<li>getfacl \/etc\/shadow \u8fd4\u56de user:ahao:r&#8211;&#xff0c;\u786e\u8ba4 ahao (uid&#061;1000) \u88ab\u989d\u5916\u6388\u4e88\u8bfb\u53d6\u6743\u9650<\/li>\n<\/ul>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>getfacl \/etc\/shadow<\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>user::rw-<br \/>\nuser:ahao:r&#8211;<br \/>\ngroup::r&#8211;<br \/>\nmask::r&#8211;<br \/>\nother::&#8212;<\/p>\n<hr \/>\n<h4>Q3 Web \u670d\u52a1\u5668\u540d\u79f0\u53ca\u4e3b\u7248\u672c\u53f7<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5206\u6790\u5acc\u7591\u4eba\u6240\u4f7f\u7528\u7684 Web \u670d\u52a1\u5668&#xff0c;\u5176\u5177\u4f53\u540d\u79f0\u53ca\u4e3b\u7248\u672c\u53f7\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;apache\/2.40\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;nginx\/1.20<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L1<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u6267\u884c nginx -v \u786e\u8ba4 Web \u670d\u52a1\u5668\u4e3a nginx\/1.20.1&#xff0c;\u6309\u683c\u5f0f\u53d6\u540d\u79f0\/\u4e3b\u7248\u672c\u53bb\u6389\u4fee\u8ba2\u53f7\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>nginx <span class=\"token parameter variable\">-v<\/span> <span class=\"token operator\"><span class=\"token file-descriptor important\">2<\/span>&gt;<\/span><span class=\"token file-descriptor important\">&amp;1<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>nginx version: nginx\/1.20.1<\/p>\n<hr \/>\n<h4>Q4 \u5b88\u536b\u811a\u672c\u89e6\u53d1\u95f4\u9694<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5acc\u7591\u4eba\u501f\u52a9 AI \u90e8\u7f72 \u201c\u5b88\u536b\u201d \u811a\u672c&#xff0c;\u975e\u7ba1\u7406\u5458 IP \u767b\u5f55\u65f6\u5c06\u89e6\u53d1\u5b9a\u65f6\u5f3a\u5236\u767b\u51fa&#xff0c;\u8be5\u670d\u52a1\u6bcf\u9694\u51e0\u5206\u949f\u89e6\u53d1\u4e00\u6b21&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;10\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;5<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L1<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u627e\u5230\u5b88\u536b\u811a\u672c \/usr\/local\/bin\/network-check.py&#xff0c;\u5176\u4e2d CHECK_INTERVAL&#061;30\u79d2&#xff08;\u68c0\u67e5\u95f4\u9694&#xff09;&#xff0c;KICK_DELAY&#061;\u201c5 minutes\u201d&#xff08;\u975e\u7ba1\u7406\u5458IP\u767b\u5f55\u540e5\u5206\u949f\u5f3a\u5236\u767b\u51fa&#xff09;\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-E<\/span> <span class=\"token string\">&#034;CHECK_INTERVAL|KICK_DELAY&#034;<\/span> \/usr\/local\/bin\/network-check.py<\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>CHECK_INTERVAL &#061; 30<br \/>\nKICK_DELAY &#061; &#034;5 minutes&#034;<\/p>\n<hr \/>\n<h4>Q5 \u6570\u636e\u5e93\u5907\u4efd\u6587\u4ef6 SHA256 \u540e6\u4f4d<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u8ba1\u7b97\u670d\u52a1\u5668\u5185\u6570\u636e\u5e93\u5907\u4efd\u6587\u4ef6&#xff0c;\u8ba1\u7b97\u5176SHA256\u54c8\u5e0c\u503c&#xff0c;\u53d6\u540e6\u4f4d&#xff0c;\u5b57\u6bcd\u5927\u5199\u3002\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;6DEF3898\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;FF8180<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L1<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u670d\u52a1\u5668\u5185 \/tmp\/db_backup\/ \u4e0b\u7684\u5907\u4efd\u6587\u4ef6\u51e0\u4e4e\u4e3a\u7a7a&#xff08;20\u5b57\u8282&#xff09;&#xff0c;\u771f\u5b9e\u5907\u4efd\u662f faka_backup.sql&#xff08;27MB&#xff0c;\u6765\u6e90&#xff1a;\u8ba1\u7b97\u673a\u68c0\u6750\u5185BitLocker\u89e3\u5bc6\u83b7\u53d6&#xff09;\u3002\u5bf9\u5176\u8ba1\u7b97 SHA256&#xff0c;\u53d6\u540e6\u4f4d\u5927\u5199\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>sha256sum \/tmp\/faka_backup.sql<\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>8dd79df101c67fd414100e1f0645e43b1cc5f5ddcf59305741c1a4318bff8180  \/tmp\/faka_backup.sql<\/p>\n<p>\u540e6\u4f4d &#061; ff8180 \u2192 \u5927\u5199 &#061; FF8180<\/p>\n<p>\u8e29\u5751\u4e0e\u4fee\u6b63&#xff1a;<\/p>\n<ul>\n<li>\u6700\u521d\u8bef\u7528\u670d\u52a1\u5668\u5185\u7a7a\u5907\u4efd\u6587\u4ef6 fk_20260614_103010.sql.gz&#xff08;\u4ec520\u5b57\u8282&#xff09;&#xff0c;\u540e\u786e\u8ba4\u771f\u5b9e\u5907\u4efd\u4e3a faka_backup.sql<\/li>\n<\/ul>\n<hr \/>\n<h4>Q6 MySQL root \u5bc6\u7801<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;MySQL \u6570\u636e\u5e93 root \u7528\u6237\u7684\u767b\u5f55\u5bc6\u7801\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;\u6839\u636e\u5b9e\u9645\u503c\u586b\u5199\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;Root&#064;123456<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u4ece\u7f51\u7ad9\u6e90\u7801 config.php \u4e2d\u627e\u5230\u660e\u6587 MySQL \u5bc6\u7801&#xff0c;\u5e76\u7528 mysql \u547d\u4ee4\u884c\u767b\u5f55\u6d4b\u8bd5\u786e\u8ba4\u3002<\/p>\n<p>\u5173\u952e\u8bc1\u636e&#xff1a;<\/p>\n<ul>\n<li>\/usr\/share\/nginx\/html\/fk\/config.php \u4e2d &#034;pwd&#034; &#061;&gt; &#034;Root&#064;123456&#034;&#xff08;\u6570\u636e\u5e93\u5bc6\u7801&#xff09;<\/li>\n<li>MySQL\u767b\u5f55\u6d4b\u8bd5 mysql -u root -pRoot&#064;123456 -e &#034;SELECT 1&#034; \u8fd4\u56de\u6210\u529f<\/li>\n<\/ul>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;pwd&#034;<\/span> \/usr\/share\/nginx\/html\/fk\/config.php<br \/>\nmysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SELECT 1 as mysql_test;&#034;<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>&#034;pwd&#034; &#061;&gt; &#034;Root&#064;123456&#034;, \/\/\u6570\u636e\u5e93\u5bc6\u7801<br \/>\nmysql_test &#061; 1 (\u767b\u5f55\u6210\u529f)<\/p>\n<hr \/>\n<h4>Q7 \u7f51\u7ad9\u5bf9\u5916\u5f00\u653e\u7aef\u53e3<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5916\u6302\u7f51\u7ad9\u6240\u5bf9\u5916\u5f00\u653e\u7684\u7aef\u53e3\u53f7\u662f\u591a\u5c11&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;1234\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;8081<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u901a\u8fc7 ss -tlnp \u786e\u8ba4 nginx \u76d1\u542c *:8081&#xff0c;nginx.conf \u4e2d listen 8081\u3002\u539f\u9ed8\u8ba4\u7aef\u53e380\u88ab\u4fee\u6539\u4e3a8081\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>ss <span class=\"token parameter variable\">-tlnp<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> nginx<br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;listen&#034;<\/span> \/etc\/nginx\/nginx.conf<\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>LISTEN *:8081 (nginx)<br \/>\nlisten 8081; listen [::]:8081;<\/p>\n<hr \/>\n<h4>Q8 \u6700\u5927\u4e0a\u4f20\u9650\u5236<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5acc\u7591\u4eba\u4e3a\u4e0a\u4f20\u5927\u578b\u6076\u610f\u63d2\u4ef6\u4fee\u6539\u6587\u4ef6\u4e0a\u4f20\u9650\u5236&#xff0c;\u5176\u6700\u5927\u4e0a\u4f20\u9650\u5236\u662f\u591a\u5c11&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;100M\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;60M<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L1<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u4ece php.ini \u548c nginx.conf \u786e\u8ba4\u4e0a\u4f20\u9650\u5236\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">grep<\/span> <span class=\"token string\">&#034;upload_max_filesize&#034;<\/span> \/etc\/php.ini<\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>upload_max_filesize &#061; 60M<\/p>\n<hr \/>\n<h4>Q9 \u5883\u5916\u670d\u52a1\u5668IP<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5acc\u7591\u4eba\u8bbe\u7f6e\u6570\u636e\u5e93\u5b9a\u65f6\u81ea\u52a8\u5907\u4efd\u5e76\u4e0a\u4f20\u81f3\u5883\u5916&#xff0c;\u8bf7\u95ee\u8be5\u5883\u5916\u670d\u52a1\u5668\u7684IP\u5730\u5740\u662f\u591a\u5c11&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;8.8.8.8\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;8.208.44.202<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L1<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u4ece\u5b9a\u65f6\u5907\u4efd\u811a\u672c \/etc\/cron.daily\/autobackup.sh \u4e2d\u627e\u5230\u5883\u5916\u670d\u52a1\u5668IP\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-n<\/span> <span class=\"token string\">&#034;REMOTE_SERVER&#034;<\/span> \/etc\/cron.daily\/autobackup.sh<\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>\u7b2c7\u884c: REMOTE_SERVER&#061;&#034;8.208.44.202&#034;<\/p>\n<p>\u811a\u672c\u901a\u8fc7 scp \u5c06\u6570\u636e\u5e93\u5907\u4efd\u4e0a\u4f20\u81f3 root&#064;8.208.44.202:\/root\/<\/p>\n<hr \/>\n<h4>Q10 \u9690\u853d\u540e\u53f0\u8def\u5f84<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5acc\u7591\u4eba\u767b\u5f55\u540e\u53f0\u7684\u76ee\u5f55\u8def\u5f84\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;\/abc\/abc\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;\/fk\/static\/<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u670d\u52a1\u5668\u4e0a\u6709\u4e24\u4e2a\u540e\u53f0\u5165\u53e3 \/fk\/admin\/ \u548c \/fk\/static\/\u3002\u901a\u8fc7 nginx \u65e5\u5fd7\u5206\u6790\u53d1\u73b0 \/fk\/static\/login.php \u88ab\u8bbf\u95ee33\u6b21&#xff0c;\u8fdc\u9ad8\u4e8e \/fk\/admin\/login.php \u76847\u6b21\u3002\u4e14 \/fk\/static\/login.php \u6709\u72ec\u7acb\u5bc6\u7801\u76d0 PWD&#061;\u20182025baofu!\u2019&#xff0c;\u4e3a\u5acc\u7591\u4eba\u5b9e\u9645\u4f7f\u7528\u7684\u9690\u853d\u540e\u53f0\u3002<\/p>\n<p>\u5173\u952e\u8bc1\u636e&#xff1a;<\/p>\n<ul>\n<li>find \u786e\u8ba4 \/usr\/share\/nginx\/html\/fk\/static\/login.php \u5b58\u5728&#xff0c;\u6709\u72ec\u7acb\u5bc6\u7801\u76d0 define(&#039;PWD&#039;, &#039;2025baofu!&#039;)<\/li>\n<li>nginx\u65e5\u5fd7\u7edf\u8ba1&#xff1a;\/fk\/static\/login.php \u88ab\u8bbf\u95ee33\u6b21&#xff0c;\/fk\/admin\/login.php \u4ec57\u6b21<\/li>\n<li>\/fk\/static\/ \u4e0b\u5927\u91cf\u540e\u53f0\u7ba1\u7406\u9875\u9762\u88ab\u9891\u7e41\u8bbf\u95ee&#xff1a;admin.php(36\u6b21)\u3001dashboard.php(30\u6b21)\u3001orderlist.php(28\u6b21)\u7b49<\/li>\n<\/ul>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">find<\/span> \/usr\/share\/nginx\/html\/fk\/ <span class=\"token parameter variable\">-name<\/span> <span class=\"token string\">&#034;login.php&#034;<\/span><br \/>\nzcat <span class=\"token parameter variable\">-f<\/span> \/var\/log\/nginx\/access.log* <span class=\"token operator\">|<\/span> <span class=\"token function\">awk<\/span> <span class=\"token string\">&#039;$7 ~ \/\\\\\/fk\\\\\/(static|admin)\\\\\/login\/ {print $7}&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sort<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">uniq<\/span> <span class=\"token parameter variable\">-c<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sort<\/span> <span class=\"token parameter variable\">-rn<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>\/fk\/static\/login.php: 33\u6b21\u8bbf\u95ee<br \/>\n\/fk\/admin\/login.php: 7\u6b21\u8bbf\u95ee<\/p>\n<hr \/>\n<h4>Q11 \u540e\u53f0\u767b\u5f55\u9875\u9762\u6700\u591a\u8bbf\u95eeIP<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u8bbf\u95ee\u540e\u53f0\u767b\u5f55\u9875\u9762\u6b21\u6570\u6700\u591a\u7684 IP \u5730\u5740\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;192.168.1.1\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;192.168.203.135<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L1<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u4ece nginx access.log \u7edf\u8ba1\u8bbf\u95ee \/fk\/(static|admin)\/login.php \u7684IP\u5730\u5740&#xff0c;192.168.203.135 \u517115\u6b21\u6700\u591a\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>zcat <span class=\"token parameter variable\">-f<\/span> \/var\/log\/nginx\/access.log* <span class=\"token operator\">|<\/span> <span class=\"token function\">awk<\/span> <span class=\"token string\">&#039;$7 ~ \/\\\\\/fk\\\\\/(static|admin)\\\\\/login\\\\.php\/ {cnt[$1]&#043;&#043;} END {for (ip in cnt) print cnt[ip], ip}&#039;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">sort<\/span> <span class=\"token parameter variable\">-rn<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-5<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>15 192.168.203.135<\/p>\n<hr \/>\n<h4>Q12 \u540e\u53f0\u7ba1\u7406\u5458\u660e\u6587\u5bc6\u7801<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u7f51\u7ad9\u540e\u53f0\u7ba1\u7406\u5458\u7684\u660e\u6587\u5bc6\u7801\u4e3a\u591a\u5c11&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;\u6839\u636e\u5b9e\u9645\u503c\u586b\u5199\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;abc123456<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L3&#xff08;\u56db\u6e90\u4ea4\u53c9\u9a8c\u8bc1&#xff09;<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u4ece faka_backup.sql \u89e3\u6790 shua_config \u83b7\u53d6 admin_pwd \u7f13\u5b58\u54c8\u5e0c\u503c\u548c admin_user&#061;admin\u3002\u4ece \/fk\/static\/login.php \u786e\u8ba4\u767b\u5f55\u7b97\u6cd5\u4e3a sha256(\u660e\u6587\u5bc6\u7801 &#043; \u201c2025baofu!\u201d)\u3002\u4f7f\u7528 Windows \u672c\u5730 hashcat v6.2.6 \u5bf9\u76ee\u6807\u54c8\u5e0c\u8fdb\u884c\u5f69\u8679\u8868\u5b57\u5178\u7206\u7834&#xff0c;Cracked \u5f97\u5230 abc123456\u3002\u6700\u540e\u7528 curl \u5b9e\u9645\u767b\u5f55\u540e\u53f0\u9a8c\u8bc1\u6210\u529f\u3002<\/p>\n<p>\u5173\u952e\u8bc1\u636e&#xff1a;<\/p>\n<li>\n<p>\u4ece\u5907\u4efd\u89e3\u6790\u914d\u7f6e&#xff1a;faka_backup.sql \u4e2d shua_config \u6570\u636e&#xff1a;<\/p>\n<ul>\n<li>admin_user &#061; admin<\/li>\n<li>admin_pwd &#061; 94bd34e3010a6468f312eafe359e9d926fc16bba62c0b6cf646d041a5c281bf2<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u767b\u5f55\u7b97\u6cd5\u786e\u8ba4&#xff1a;\/fk\/static\/login.php \u6e90\u7801&#xff1a;<\/p>\n<p><span class=\"token function\">define<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;PWD&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token string single-quoted-string\">&#039;2025baofu!&#039;<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><br \/>\n<span class=\"token variable\">$pass<\/span> <span class=\"token operator\">&#061;<\/span> <span class=\"token function\">hash<\/span><span class=\"token punctuation\">(<\/span><span class=\"token string single-quoted-string\">&#039;sha256&#039;<\/span><span class=\"token punctuation\">,<\/span> <span class=\"token variable\">$pass<\/span> <span class=\"token operator\">.<\/span><span class=\"token constant\">PWD<\/span><span class=\"token punctuation\">)<\/span><span class=\"token punctuation\">;<\/span><\/p>\n<p>\u7b97\u6cd5\u4e3a sha256(\u660e\u6587\u5bc6\u7801 &#043; \u201c2025baofu!\u201d)<\/p>\n<\/li>\n<li>\n<p>hashcat\u5f69\u8679\u8868\u5b57\u5178\u7206\u7834&#xff1a;<\/p>\n<ul>\n<li>Windows\u672c\u5730 hashcat v6.2.6&#xff0c;-m 1410 (sha256(<span class=\"katex--inline\"><span class=\"katex\"><span class=\"katex-mathml\">pass.pass.<\/span><span class=\"katex-html\"><span class=\"base\"><span class=\"strut\" style=\"height: 0.625em;vertical-align: -0.1944em\"><\/span><span class=\"mord mathnormal\">p<\/span><span class=\"mord mathnormal\">a<\/span><span class=\"mord mathnormal\">ss<\/span><span class=\"mord\">.<\/span><\/span><\/span><\/span><\/span>salt))&#xff0c;-a 0 \u5b57\u5178\u6a21\u5f0f<\/li>\n<li>\u5b57\u5178&#xff1a;\u5f69\u8679\u8868.txt&#xff08;12,070\u6761&#xff09;<\/li>\n<li>\u76ee\u6807\u54c8\u5e0c&#xff1a;94bd34e3010a6468f312eafe359e9d926fc16bba62c0b6cf646d041a5c281bf2:2025baofu!<\/li>\n<li>\u7ed3\u679c&#xff1a;Cracked 1\/1 (100.00%)&#xff0c;Recovered: abc123456<\/li>\n<\/ul>\n<\/li>\n<li>\n<p>\u540e\u53f0\u767b\u5f55\u9a8c\u8bc1&#xff1a;POST \/fk\/static\/login.php \u8fd4\u56de HTTP 200&#xff0c;PHPSESSID cookie \u5df2\u8bbe\u7f6e&#xff1b;\u8bbf\u95ee\u540e\u53f0\u9996\u9875\u9875\u9762\u5df2\u6e32\u67d3&#xff08;\u62a5\u8fdc\u7a0b\u6570\u636e\u5e93\u8fde\u63a5\u9519\u8bef\u4f46\u8bc1\u660e\u5bc6\u7801\u9a8c\u8bc1\u5df2\u901a\u8fc7&#xff09;<\/p>\n<\/li>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token comment\"># hashcat \u5f69\u8679\u8868\u5b57\u5178\u7206\u7834 (Windows\u672c\u5730)<\/span><br \/>\n<span class=\"token variable\">$hc<\/span>&#061;<span class=\"token string\">&#039;D:\\\\soft\\\\hashcat-6.2.6\\\\hashcat.exe&#039;<\/span><br \/>\n<span class=\"token variable\">$dict<\/span>&#061;<span class=\"token string\">&#039;D:\\\\soft\\\\hashcat-6.2.6\\\\\u5f69\u8679\u8868.txt&#039;<\/span><br \/>\n<span class=\"token variable\">$hash<\/span>&#061;<span class=\"token string\">&#039;94bd34e3010a6468f312eafe359e9d926fc16bba62c0b6cf646d041a5c281bf2:2025baofu!&#039;<\/span><br \/>\n&amp; <span class=\"token variable\">$hc<\/span> <span class=\"token operator\">&#8211;<\/span>m 1410 <span class=\"token operator\">&#8211;<\/span>a 0 <span class=\"token variable\">$hash<\/span> <span class=\"token variable\">$dict<\/span> <span class=\"token operator\">&#8212;<\/span>potfile-disable <span class=\"token operator\">&#8212;<\/span>outfile-format 2<span class=\"token punctuation\">,<\/span>3 <span class=\"token operator\">&#8212;<\/span>status <span class=\"token operator\">&#8212;<\/span>status-timer 5<\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>Hash.Mode&#8230;&#8230;..: 1410 (sha256($pass.$salt))<br \/>\nDictionary cache built: * Passwords.: 12070<br \/>\nStatus&#8230;&#8230;&#8230;..: Cracked<br \/>\nRecovered&#8230;&#8230;..: 1\/1 (100.00%) Digests<br \/>\nProgress&#8230;&#8230;&#8230;: 4292\/12070 (35.56%)<br \/>\nSpeed.#*&#8230;&#8230;&#8230;: 260.1 kH\/s<\/p>\n<p>\u7ed3\u679c\u6587\u4ef6: abc123456:616263313233343536<\/p>\n<p><span class=\"token comment\"># \u540e\u53f0\u767b\u5f55\u9a8c\u8bc1<\/span><br \/>\n<span class=\"token function\">curl<\/span> <span class=\"token parameter variable\">-s<\/span> <span class=\"token parameter variable\">-o<\/span> \/dev\/null <span class=\"token parameter variable\">-w<\/span> <span class=\"token string\">&#034;%{http_code}&#034;<\/span> <span class=\"token parameter variable\">-X<\/span> POST <span class=\"token string\">&#034;http:\/\/127.0.0.1:8081\/fk\/static\/login.php&#034;<\/span> <span class=\"token punctuation\">\\\\<\/span><br \/>\n  <span class=\"token parameter variable\">-H<\/span> <span class=\"token string\">&#034;Content-Type: application\/x-www-form-urlencoded&#034;<\/span> <span class=\"token punctuation\">\\\\<\/span><br \/>\n  <span class=\"token parameter variable\">-d<\/span> <span class=\"token string\">&#034;user&#061;admin&amp;pass&#061;abc123456&#034;<\/span> <span class=\"token parameter variable\">-c<\/span> \/tmp\/q12_cookie.txt<\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>HTTP 200, PHPSESSID cookie \u5df2\u8bbe\u7f6e (2eb404f812b69c47d34e4882543a1459)<br \/>\n\u540e\u53f0\u9996\u9875\u5df2\u6e32\u67d3&#xff08;\u62a5\u8fdc\u7a0b\u6570\u636e\u5e93\u8fde\u63a5\u9519\u8bef&#xff0c;\u8bc1\u660e\u5bc6\u7801\u9a8c\u8bc1\u5df2\u901a\u8fc7&#xff09;<\/p>\n<p>\u8e29\u5751\u4e0e\u4fee\u6b63&#xff1a;<\/p>\n<ul>\n<li>\u6700\u521d\u4ece\u5728\u7ebf\u6570\u636e\u5e93 fk_forensics.shua_config \u83b7\u53d6 admin_pwd&#061;wy0719&#xff0c;\u4f46\u8fd9\u662f\u65e7\u5165\u53e3 \/fk\/admin\/ \u7684\u660e\u6587\u5bc6\u7801&#xff08;\u65e0\u76d0&#xff09;&#xff0c;\u975e\u9690\u853d\u540e\u53f0\u5bc6\u7801<\/li>\n<li>\u9690\u853d\u540e\u53f0 \/fk\/static\/login.php \u4f7f\u7528 sha256(pass&#043;\u76d0) \u9a8c\u8bc1&#xff0c;\u9700\u4ece faka_backup.sql \u83b7\u53d6\u7f13\u5b58\u54c8\u5e0c\u503c<\/li>\n<\/ul>\n<hr \/>\n<h4>Q13 \u652f\u4ed8\u63a5\u53e3\u7b2c\u4e09\u65b9\u63a5\u5165\u5546\u540d\u79f0<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u8be5\u7f51\u7ad9\u652f\u4ed8\u63a5\u53e3\u6240\u5bf9\u63a5\u7684\u7b2c\u4e09\u65b9\u63a5\u5165\u5546\u540d\u79f0\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;\u6839\u636e\u5b9e\u9645\u503c\u586b\u5199\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;\u65e0\u5fe7\u652f\u4ed8<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u4ece faka_backup.sql \u4e2d\u63d0\u53d6\u652f\u4ed8\u914d\u7f6e payapi&#061;\u201813\u2019&#xff0c;\u540c\u65f6\u4ece\u9ad8\u5ea6\u6df7\u6dc6\u7684 set.php \u6587\u4ef6\u4e2d\u89e3\u7801\u51fa\u652f\u4ed8\u63a5\u5165\u5546\u4e0b\u62c9\u9009\u9879&#xff0c;\u786e\u8ba4 value&#061;13 \u5bf9\u5e94&#034;\u65e0\u5fe7\u652f\u4ed8&#034;\u3002\u6ce8\u610f\u5e95\u5c42SDK\u4e3a\u5f69\u8679\u6613\u652f\u4ed8&#xff08;alipay_api\/qqpay_api\/wxpay_api\u5747\u4e3a\u20192\u2019\u8d70\u5f69\u8679\u6613\u652f\u4ed8\u63a5\u53e3\u901a\u9053&#xff09;&#xff0c;\u4f46\u5b9e\u9645\u63a5\u5165\u5546\u9009\u62e9\u4e3a payapi&#061;\u201813\u2019(\u65e0\u5fe7\u652f\u4ed8)\u3002<\/p>\n<p>\u5173\u952e\u8bc1\u636e&#xff1a;<\/p>\n<ul>\n<li>faka_backup.sql&#xff1a;payapi&#061;&#039;13&#039;, alipay_api&#061;&#039;2&#039;, qqpay_api&#061;&#039;2&#039;, wxpay_api&#061;&#039;2&#039;, fanghong_api&#061;&#039;9&#039;<\/li>\n<li>set.php \u89e3\u7801\u540e\u786e\u8ba4 &lt;option value&#061;&#034;13&#034;&gt;\u65e0\u5fe7\u652f\u4ed8&lt;\/option&gt; \u5b58\u5728\u4e8e\u652f\u4ed8\u63a5\u5165\u5546\u4e0b\u62c9\u9009\u9879<\/li>\n<\/ul>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-oP<\/span> <span class=\"token string\">&#034;&#039;(payapi|alipay_api|qqpay_api|wxpay_api)&#039;,&#039;[^&#039;]*&#039;&#034;<\/span> \/tmp\/faka_backup.sql<br \/>\n<span class=\"token comment\"># Python\u89e3\u7801set.php\u67e5\u627eoption value&#061;&#034;13&#034;<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>payapi&#061;&#039;13&#039;  \u2192 \u65e0\u5fe7\u652f\u4ed8<br \/>\nalipay_api&#061;&#039;2&#039;, qqpay_api&#061;&#039;2&#039;, wxpay_api&#061;&#039;2&#039;  \u2192 \u5f69\u8679\u6613\u652f\u4ed8\u63a5\u53e3\u901a\u9053<\/p>\n<p>\u8e29\u5751\u4e0e\u4fee\u6b63&#xff1a;<\/p>\n<ul>\n<li>\u6700\u521d\u8bef\u7b54&#034;\u5f69\u8679\u6613\u652f\u4ed8&#034;&#xff0c;\u6df7\u6dc6\u4e86\u5e95\u5c42SDK&#xff08;\u5f69\u8679\u6613\u652f\u4ed8&#xff09;\u548c\u5b9e\u9645\u63a5\u5165\u5546\u914d\u7f6e&#xff08;\u65e0\u5fe7\u652f\u4ed8&#xff09;\u3002payapi&#061;13\u5bf9\u5e94\u7684\u662f\u63a5\u5165\u5546\u9009\u62e9\u3002<\/li>\n<\/ul>\n<hr \/>\n<h4>Q14 \u7f51\u7ad9\u521b\u5efa\u65f6\u95f4<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u7f51\u7ad9\u7684\u521b\u5efa\u65f6\u95f4\u662f\u4ec0\u4e48\u65f6\u5019&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;2026\/5\/20\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;2018\/12\/14<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L3&#xff08;\u4e09\u6e90\u4ea4\u53c9\u9a8c\u8bc1&#xff09;<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u901a\u8fc7\u4e09\u4e2a\u72ec\u7acb\u6765\u6e90\u4ea4\u53c9\u786e\u8ba4\u7f51\u7ad9\u521b\u5efa\u65f6\u95f4\u3002<\/p>\n<p>\u5173\u952e\u8bc1\u636e&#xff1a;<\/p>\n<li>\u5728\u7ebf\u6570\u636e\u5e93 fk_forensics.shua_config: build &#061; 2018-12-14<\/li>\n<li>SQL\u5907\u4efd\u6587\u4ef6 faka_backup.sql: &#039;build&#039;,&#039;2018-12-14&#039; \u2014 \u4e0e\u5728\u7ebf\u6570\u636e\u5e93\u4e00\u81f4<\/li>\n<li>\u7f51\u7ad9\u6e90\u7801\u9875\u811a head.php: &lt;span id&#061;&#034;year-copy&#034;&gt;2018&lt;\/span&gt; \u2014 \u7248\u6743\u5e74\u4efd\u4e0e\u521b\u5efa\u65f6\u95f4\u4e00\u81f4<\/li>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>mysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> fk_forensics <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SELECT k, v FROM shua_config WHERE k&#061;&#039;build&#039;;&#034;<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-A2<\/span> <span class=\"token string\">&#034;INSERT INTO.*shua_config&#034;<\/span> \/tmp\/faka_backup.sql <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> build<br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-rn<\/span> <span class=\"token string\">&#034;2018&#034;<\/span> \/usr\/share\/nginx\/html\/fk\/ <span class=\"token parameter variable\">&#8211;include<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;*.php&#034;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-5<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>k&#061;build, v&#061;2018-12-14<br \/>\n&#039;build&#039;,&#039;2018-12-14&#039; (SQL\u5907\u4efd\u4e00\u81f4)<br \/>\nhead.php: &lt;span id&#061;&#034;year-copy&#034;&gt;2018&lt;\/span&gt; (\u6e90\u7801\u9875\u811a)<\/p>\n<p>\u6309\u683c\u5f0f\u5c06\u5206\u9694\u7b26\u4ece &#8211; \u6539\u4e3a \/&#xff1a;2018\/12\/14<\/p>\n<hr \/>\n<h4>Q15 Git\u4f5c\u8005\u59d3\u540d<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u7f51\u7ad9Git\u914d\u7f6e\u4fe1\u606f\u4e2d&#xff0c;\u627e\u51fa\u4f5c\u8005\u59d3\u540d\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;\u6839\u636e\u5b9e\u9645\u503c\u586b\u5199\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;ZhangSan_Sec<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L3&#xff08;\u4e09\u5c42\u9a8c\u8bc1&#xff09;<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u4ece bash_history \u8ffd\u8e2a\u5acc\u7591\u4eba\u64cd\u4f5c\u94fe&#xff1a;cp .git\/config \/tmp\/git_config_bak \u2192 git config -l &gt; \/tmp\/git_config_bak&#xff08;\u7528\u5f53\u524d\u7be1\u6539\u540e\u914d\u7f6e\u8986\u76d6&#xff09;\u2192 mv \u4f2a\u88c5\u6210\u56fe\u6807\u7f13\u5b58 \u2192 gzip \u538b\u7f29 \u2192 rm \u6e05\u7406\u3002\u539f\u59cb .git\/config \u5907\u4efd\u85cf\u5728 \/usr\/share\/icons\/hicolor\/48&#215;48\/apps\/&#8230; \/git.txt&#xff08;\u6587\u4ef6\u540d\u542b\u7a7a\u683c\u4f2a\u88c5&#xff09;\u3002\u539f\u59cb\u914d\u7f6e name \u5b57\u6bb5\u7ecf\u8fc7 hex\u2192base64 \u53cc\u91cd\u7f16\u7801&#xff0c;\u89e3\u7801\u5f97\u5230 ZhangSan_Sec\u3002backup_config.txt \u4e2d GhostOperator \u4e3a\u5acc\u7591\u4eba\u7be1\u6539\u540e\u7684\u5e72\u6270\u9879&#xff08;\u7f16\u7801\u65b9\u5f0f\u53cd\u8f6c\u4e3a base64\u2192hex&#xff09;\u3002<\/p>\n<p>\u5173\u952e\u8bc1\u636e&#xff1a;<\/p>\n<ul>\n<li>bash_history \u663e\u793a\u5b8c\u6574\u64cd\u4f5c\u94fe<\/li>\n<li>\u539f\u59cb\u914d\u7f6e\u85cf\u5728 \/usr\/share\/icons\/hicolor\/48&#215;48\/apps\/&#8230; \/git.txt<\/li>\n<li>name &#061; 576d6868626d6454595735665532566a (hex) \u2192 WmhhbmdTYW5fU2Vj (base64) \u2192 ZhangSan_Sec<\/li>\n<li>\u539f\u59cb email &#061; zhangsan&#064;dev.internal&#xff08;\u4e0e backup_config.txt \u4e2d admin&#064;0xdeadbeef.local \u4e0d\u540c&#xff09;<\/li>\n<\/ul>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token function\">cat<\/span> \/root\/.bash_history <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-i<\/span> <span class=\"token function\">git<\/span><br \/>\n<span class=\"token function\">find<\/span> \/usr\/share\/icons\/hicolor\/48&#215;48\/apps\/ <span class=\"token parameter variable\">-type<\/span> f<br \/>\n<span class=\"token function\">cat<\/span> <span class=\"token string\">&#039;\/usr\/share\/icons\/hicolor\/48&#215;48\/apps\/&#8230; \/git.txt&#039;<\/span><br \/>\npython3 <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#034;print(bytes.fromhex(&#039;576d6868626d6454595735665532566a&#039;).decode(&#039;ascii&#039;))&#034;<\/span><br \/>\n<span class=\"token comment\"># \u2192 WmhhbmdTYW5fU2Vj<\/span><br \/>\npython3 <span class=\"token parameter variable\">-c<\/span> <span class=\"token string\">&#034;import base64; print(base64.b64decode(&#039;WmhhbmdTYW5fU2Vj&#039;).decode(&#039;ascii&#039;))&#034;<\/span><br \/>\n<span class=\"token comment\"># \u2192 ZhangSan_Sec<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>\u539f\u59cbGit\u914d\u7f6e: name&#061;ZhangSan_Sec, email&#061;zhangsan&#064;dev.internal<br \/>\nbackup_config.txt: name&#061;GhostOperator (\u5acc\u7591\u4eba\u7be1\u6539\u540e\u7684\u5e72\u6270\u9879)<\/p>\n<hr \/>\n<h4>Q16 \u5df2\u5b8c\u6210\u8ba2\u5355\u603b\u91d1\u989d<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5206\u6790\u8be5\u7f51\u7ad9 2025 \u5e74 6 \u6708 1 \u65e5\u81f3 12 \u6708 31 \u65e5\u7684\u5168\u90e8\u8ba2\u5355&#xff0c;\u5176\u4e2d\u72b6\u6001\u4e3a \u201c\u5df2\u5b8c\u6210\u201d \u7684\u8ba2\u5355\u603b\u6210\u4ea4\u91d1\u989d\u4e3a\u591a\u5c11&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;1234\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;24073<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2&#xff08;\u53cc\u6570\u636e\u5e93\u4ea4\u53c9\u9a8c\u8bc1 &#043; \u6e90\u7801\u786e\u8ba4status\u679a\u4e3e&#xff09;<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u9996\u5148\u4ece\u6e90\u7801\u786e\u8ba4 status&#061;1 &#061; \u201c\u5df2\u5b8c\u6210\u201d&#xff08;api.php:82 \u6ce8\u91ca \/\/1:\u5df2\u5b8c\u6210,2:\u6b63\u5728\u5904\u7406,3:\u5f02\u5e38,4:\u5f85\u5904\u7406&#xff0c;MessageSend.php \u7d22\u5f151&#061;\u5df2\u5b8c\u6210&#xff09;\u3002\u7136\u540e\u4ece faka_backup.sql \u5bfc\u5165\u5b8c\u6574\u6570\u636e\u5230\u4e24\u4e2a\u72ec\u7acb\u6570\u636e\u5e93 faka \u548c faka_original&#xff0c;\u5206\u522b\u67e5\u8be2 status&#061;1 \u4e14\u65f6\u95f4\u8303\u56f4 2025-06-01 \u81f3 2025-12-31 \u7684\u8ba2\u5355\u603b\u91d1\u989d\u3002\u5728\u7ebf fk_forensics \u53ea\u67093\u6761\u6d4b\u8bd5\u8ba2\u5355&#xff08;2023-03&#xff09;&#xff0c;\u5b8c\u6574\u6570\u636e\u5728 faka_backup.sql\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p><span class=\"token comment\"># \u6e90\u7801\u786e\u8ba4status\u679a\u4e3e<\/span><br \/>\n<span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-rn<\/span> <span class=\"token string\">&#034;status&#034;<\/span> \/usr\/share\/nginx\/html\/fk\/ <span class=\"token parameter variable\">&#8211;include<\/span><span class=\"token operator\">&#061;<\/span><span class=\"token string\">&#034;*.php&#034;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">grep<\/span> <span class=\"token parameter variable\">-i<\/span> <span class=\"token string\">&#034;\u5df2\u5b8c\u6210\\\\|\u5b8c\u6210\u652f\u4ed8&#034;<\/span> <span class=\"token operator\">|<\/span> <span class=\"token function\">head<\/span> <span class=\"token parameter variable\">-10<\/span><\/p>\n<p><span class=\"token comment\"># \u53cc\u6570\u636e\u5e93\u4ea4\u53c9\u9a8c\u8bc1<\/span><br \/>\nmysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> faka_original <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SELECT COUNT(*) as cnt, ROUND(SUM(money),2) as total FROM shua_orders WHERE status&#061;1 AND addtime&gt;&#061;&#039;2025-06-01&#039; AND addtime&lt;&#061;&#039;2025-12-31 23:59:59&#039;;&#034;<\/span><br \/>\nmysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> faka <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SELECT COUNT(*) as cnt, ROUND(SUM(money),2) as total FROM shua_orders WHERE status&#061;1 AND addtime&gt;&#061;&#039;2025-06-01&#039; AND addtime&lt;&#061;&#039;2025-12-31 23:59:59&#039;;&#034;<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>\u6e90\u7801\u786e\u8ba4: status&#061;1 &#061; &#034;\u5df2\u5b8c\u6210&#034; (api.php:82, MessageSend.php:54, ajax.php:856)<br \/>\nfaka_original: cnt&#061;848, total&#061;24073.00<br \/>\nfaka: cnt&#061;848, total&#061;24073.00 (\u5b8c\u5168\u4e00\u81f4)<\/p>\n<hr \/>\n<h4>Q17 \u4e0b\u5355\u91d1\u989d\u6700\u9ad8\u65e5\u603b\u91d1\u989d<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5206\u6790 2025 \u5e74\u5168\u5e74\u7684\u8ba2\u5355\u6570\u636e&#xff0c;\u8ba1\u7b97\u4e0b\u5355\u91d1\u989d\u603b\u8ba1\u6700\u9ad8\u7684\u90a3\u4e00\u5929\u7684\u603b\u91d1\u989d\u662f\u591a\u5c11&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;1234\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;5442<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2&#xff08;\u53cc\u6570\u636e\u5e93\u4ea4\u53c9\u9a8c\u8bc1&#xff09;<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u9898\u76ee\u8bf4&#034;\u4e0b\u5355\u91d1\u989d\u603b\u8ba1&#034;&#xff0c;\u4e0d\u9650status\u3002\u6309\u65e5\u7edf\u8ba1 2025 \u5e74\u5168\u5e74\u8ba2\u5355\u91d1\u989d&#xff0c;\u4e24\u4e2a\u72ec\u7acb\u6570\u636e\u5e93\u5747\u786e\u8ba4 2025-09-16 \u6700\u9ad8&#xff08;5442.00&#xff09;\u3002\u82e5\u4ec5\u7edf\u8ba1 status&#061;1 \u5219\u6700\u9ad8\u4e3a 2025-09-12 (1886.00)&#xff0c;\u4f46\u9898\u610f\u5e94\u4e3a\u5168\u90e8\u8ba2\u5355\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>mysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> faka_original <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SELECT DATE(addtime) as dt, ROUND(SUM(money),2) as daily_total FROM shua_orders WHERE addtime&gt;&#061;&#039;2025-01-01&#039; AND addtime&lt;&#061;&#039;2025-12-31 23:59:59&#039; GROUP BY DATE(addtime) ORDER BY daily_total DESC LIMIT 5;&#034;<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>2025-09-16 | 5442.00 (\u6700\u9ad8)<br \/>\n2025-09-12 | 5168.00<br \/>\n2025-09-20 | 5150.00<\/p>\n<hr \/>\n<h4>Q18 \u8d2d\u4e70\u6570\u91cf\u6700\u9ad8\u7684\u5e94\u7528\u540d\u79f0<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u7edf\u8ba1\u5168\u90e8\u8ba2\u5355\u6570\u636e&#xff0c;\u8d2d\u4e70\u6570\u91cf\u7d2f\u8ba1\u6700\u9ad8\u7684\u5e94\u7528\u540d\u79f0\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;\u6839\u636e\u5b9e\u9645\u503c\u586b\u5199\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;\u65e0\u754f\u5951\u7ea6\u81ea\u52a8\u6273\u673a&#043;\u900f\u89c6&#043;\u51c6\u661f\u8f85\u52a9<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2&#xff08;\u53cc\u6570\u636e\u5e93\u4ea4\u53c9\u9a8c\u8bc1&#xff09;<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;JOIN shua_orders \u548c shua_tools \u8868&#xff0c;\u6309\u5546\u54c1\u7edf\u8ba1\u8d2d\u4e70\u6570\u91cf\u603b\u548c\u3002\u4e24\u4e2a\u72ec\u7acb\u6570\u636e\u5e93\u5747\u786e\u8ba4 tid&#061;1912 \u201c\u65e0\u754f\u5951\u7ea6\u81ea\u52a8\u6273\u673a&#043;\u900f\u89c6&#043;\u51c6\u661f\u8f85\u52a9\u201d \u7b2c\u4e00\u540d&#xff08;78\u4ef6&#xff09;&#xff0c;\u7b2c\u4e8c\u540d76\u4ef6\u5dee\u8ddd\u660e\u663e\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>mysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> faka_original <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SELECT t.tid, t.name, SUM(o.value) as total_qty FROM shua_orders o JOIN shua_tools t ON o.tid&#061;t.tid GROUP BY t.tid ORDER BY total_qty DESC LIMIT 5;&#034;<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>tid&#061;1912 | \u65e0\u754f\u5951\u7ea6\u81ea\u52a8\u6273\u673a&#043;\u900f\u89c6&#043;\u51c6\u661f\u8f85\u52a9 | 78\u4ef6 (\u7b2c\u4e00\u540d)<br \/>\ntid&#061;1919 | \u547d\u8fd02\u81ea\u52a8\u5237\u67aa&#043;\u6253\u51fb\u811a\u672c | 76\u4ef6<br \/>\ntid&#061;1917 | \u5929\u6daf\u660e\u6708\u5200\u81ea\u52a8\u8eab\u4efd\u73a9\u6cd5&#043;\u8dd1\u5546\u811a\u672c | 76\u4ef6<\/p>\n<hr \/>\n<h4>Q19 \u7d2f\u8ba1\u8d2d\u4e70\u603b\u989d\u6700\u9ad8\u7684\u7528\u6237\u8d26\u53f7<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u7edf\u8ba1\u5168\u90e8\u8ba2\u5355\u6570\u636e&#xff0c;\u7528\u6237\u7d2f\u8ba1\u8d2d\u4e70\u603b\u989d\u6700\u9ad8\u7684\u7528\u6237\u8d26\u53f7\u662f\u54ea\u4e2a&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;admin\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;guoqi<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2&#xff08;\u6570\u636e\u5e93\u7edf\u8ba1 &#043; \u7528\u6237\u540d\u6620\u5c04\u53cc\u8bc1\u636e&#xff09;<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u6309 userid GROUP BY SUM(money)&#xff0c;userid&#061;23 \u9065\u9065\u9886\u5148&#xff08;15480.00\u5143\/527\u7b14\u8ba2\u5355&#xff09;\u3002\u901a\u8fc7 shua_site \u8868 zid\u2192user \u6620\u5c04\u786e\u8ba4 userid&#061;23 \u5bf9\u5e94\u8d26\u53f7\u4e3a guoqi\u3002nginx\u65e5\u5fd7\u4e2d\u540e\u53f0\u7ba1\u7406\u5458\u66fe\u641c\u7d22 kw&#061;guoqi&#xff0c;\u8fd4\u56de200\u72b6\u6001\u7801\u548c1266\u5b57\u8282\u6570\u636e&#xff0c;\u8fdb\u4e00\u6b65\u4f50\u8bc1\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>mysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> faka_original <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SELECT userid, ROUND(SUM(money),2), COUNT(*) FROM shua_orders GROUP BY userid ORDER BY SUM(money) DESC LIMIT 1;&#034;<\/span><br \/>\n<span class=\"token comment\"># Python\u5173\u8054\u811a\u672c: shua_site.zid\u2192user \u6620\u5c04\u786e\u8ba4 userid&#061;23 &#061; guoqi<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>userid&#061;23 | total_spent&#061;15480.00 | count&#061;527\u7b14<br \/>\nshua_site\u6620\u5c04: userid&#061;23 \u2192 \u8d26\u53f7\u540d guoqi<br \/>\nnginx\u65e5\u5fd7: \u540e\u53f0\u7ba1\u7406\u5458\u641c\u7d22 kw&#061;guoqi (HTTP 200, 1266\u5b57\u8282)<\/p>\n<p>\u8e29\u5751\u4e0e\u4fee\u6b63&#xff1a;<\/p>\n<ul>\n<li>\u6700\u521d\u7b54\u6848\u4e3a userid&#061;23&#xff08;\u6570\u5b57&#xff09;&#xff0c;\u9898\u76ee\u95ee&#034;\u7528\u6237\u8d26\u53f7&#034;\u9700\u5173\u8054 shua_site \u8868\u83b7\u53d6\u8d26\u53f7\u540d guoqi<\/li>\n<\/ul>\n<hr \/>\n<h4>Q20 \u62e5\u6709 FILE \u4e0e SUPER \u6743\u9650\u7684\u9690\u853d MySQL \u8d26\u6237<\/h4>\n<p>\u9898\u76ee&#xff1a;\u8bf7\u5206\u6790\u68c0\u67503&#xff1a;\u5acc\u7591\u4eba\u521b\u5efa\u7684\u62e5\u6709 FILE \u4e0e SUPER \u6743\u9650\u7684\u9690\u853d MySQL \u8d26\u6237&#xff0c;\u5176\u7528\u6237\u540d\u662f\u4ec0\u4e48&#xff1f;\u3010\u7b54\u6848\u683c\u5f0f&#xff1a;admin\u3011<\/p>\n<p>\u7b54\u6848&#xff1a;_tmp_z5m1w8<\/p>\n<p>\u7b54\u6848\u72b6\u6001&#xff1a;\u5df2\u9a8c\u8bc1<\/p>\n<p>\u9a8c\u8bc1\u7b49\u7ea7&#xff1a;L2&#xff08;\u53cc\u67e5\u8be2\u4ea4\u53c9\u9a8c\u8bc1&#xff09;<\/p>\n<p>\u89e3\u9898\u601d\u8def&#xff1a;\u67e5\u8be2 mysql.user \u8868\u4e2d\u6240\u6709 _tmp* \u5f00\u5934\u7684\u8d26\u6237&#xff0c;\u517116\u4e2a\u3002\u4ec5 _tmp_z5m1w8&#064;localhost \u540c\u65f6\u62e5\u6709 Super_priv&#061;Y \u548c File_priv&#061;Y\u3002\u7528 SHOW GRANTS \u4e8c\u6b21\u786e\u8ba4\u3002<\/p>\n<p>\u91cd\u70b9\u547d\u4ee4&#xff1a;<\/p>\n<p>mysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SELECT User, Host, Super_priv, File_priv FROM mysql.user WHERE User LIKE &#039;_tmp%&#039;;&#034;<\/span><br \/>\nmysql <span class=\"token parameter variable\">-u<\/span> root -p<span class=\"token string\">&#039;Root&#064;123456&#039;<\/span> <span class=\"token parameter variable\">-e<\/span> <span class=\"token string\">&#034;SHOW GRANTS FOR &#039;_tmp_z5m1w8&#039;&#064;&#039;localhost&#039;;&#034;<\/span><\/p>\n<p>\u5173\u952e\u8f93\u51fa&#xff1a;<\/p>\n<p>16\u4e2a_tmp_*\u8d26\u6237\u4e2d&#xff0c;\u4ec5 _tmp_z5m1w8&#064;localhost \u540c\u65f6\u6709 Super_priv&#061;Y \u548c File_priv&#061;Y<br \/>\nGRANT FILE, SUPER ON *.* TO &#039;_tmp_z5m1w8&#039;&#064;&#039;localhost&#039; (\u4e0emysql.user\u8868\u5b8c\u5168\u4e00\u81f4)<\/p>\n<h3>\u672a\u5b8c\u6210\u6216\u4e0d\u53ef\u63d0\u4ea4\u9898\u76ee<\/h3>\n<table>\n<tr>\u9898\u53f7\u5f53\u524d\u7b54\u6848\u7b54\u6848\u72b6\u6001\u539f\u56e0\u4e0b\u4e00\u6b65<\/tr>\n<tbody>\n<tr>\n<td>(\u65e0)<\/td>\n<td>\u2014<\/td>\n<td>\u2014<\/td>\n<td>\u5168\u90e820\u9898\u5747\u5df2\u9a8c\u8bc1\u5b8c\u6210<\/td>\n<td>\u2014<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<h3>\u9644\u5f55<\/h3>\n<h4>\u8e29\u5751\u603b\u7ed3<\/h4>\n<li>Q5: \u670d\u52a1\u5668\u5185 \/tmp\/db_backup\/ \u4e0b\u7684\u5907\u4efd\u6587\u4ef6\u51e0\u4e4e\u4e3a\u7a7a&#xff08;20\u5b57\u8282&#xff09;&#xff0c;\u771f\u5b9e\u5907\u4efd\u662f faka_backup.sql&#xff08;27MB&#xff0c;\u6765\u6e90&#xff1a;\u8ba1\u7b97\u673a\u68c0\u6750\u5185BitLocker\u89e3\u5bc6\u83b7\u53d6&#xff09;<\/li>\n<li>Q9-Q11: \u6570\u636e\u5e93\u65e5\u5fd7\u4e0enginx\u65e5\u5fd7\u4e0d\u4e00\u81f4\u65f6&#xff0c;\u4ee5nginx\u65e5\u5fd7\u4e3a\u51c6&#xff08;\u66f4\u5168\u9762&#xff09;<\/li>\n<li>Q10-Q12: \u6709\u4e24\u4e2a\u540e\u53f0\u5165\u53e3 \/fk\/admin\/ \u548c \/fk\/static\/&#xff0c;\u5acc\u7591\u4eba\u5b9e\u9645\u4f7f\u7528\u9690\u853d\u7684 \/fk\/static\/<\/li>\n<li>Q13: alipay\/\u76ee\u5f55\u6709SDK\u4f46\u914d\u7f6e\u5173\u95ed&#xff0c;\u5b9e\u9645\u4f7f\u7528\u7684\u662f epay\/ \u5f69\u8679\u6613\u652f\u4ed8\u5e95\u5c42\u63a5\u53e3&#xff0c;\u4f46\u63a5\u5165\u5546\u9009\u62e9\u4e3a payapi&#061;13(\u65e0\u5fe7\u652f\u4ed8)<\/li>\n<li>Q15: Git\u914d\u7f6ename\u5b57\u6bb5\u7ecf\u8fc7\u53cc\u91cd\u7f16\u7801&#xff08;hex\u2192base64&#xff09;&#xff0c;\u5acc\u7591\u4eba\u7be1\u6539\u540e\u7f16\u7801\u65b9\u5f0f\u53cd\u8f6c\u4e3a base64\u2192hex<\/li>\n<li>Q16-Q19: \u670d\u52a1\u5668\u5728\u7ebf\u6570\u636e\u5e93\u53ea\u67093\u6761\u6d4b\u8bd5\u8ba2\u5355&#xff0c;\u5b8c\u6574\u6570\u636e\u5728 faka_backup.sql<\/li>\n<h4>\u8bc1\u636e\u7d22\u5f15<\/h4>\n<table>\n<tr>\u7f16\u53f7\u6765\u6e90\u6587\u4ef6\u8bc1\u636e\u5185\u5bb9\u6458\u8981\u5bf9\u5e94\u7ed3\u8bba<\/tr>\n<tbody>\n<tr>\n<td>FINDING-Q1-001<\/td>\n<td>commands.md<\/td>\n<td>uname -r &#061; 3.10.0-1160.119.1.el7.x86_64<\/td>\n<td>Q1: \u5185\u6838\u7248\u672c 3.10.0<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q2-001<\/td>\n<td>commands.md<\/td>\n<td>getfacl \/etc\/shadow: user:ahao:r\u2013<\/td>\n<td>Q2: ACL\u7528\u6237 ahao<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q3-001<\/td>\n<td>commands.md<\/td>\n<td>nginx -v: nginx\/1.20.1<\/td>\n<td>Q3: Web\u670d\u52a1\u5668 nginx\/1.20<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q4-001<\/td>\n<td>commands.md<\/td>\n<td>KICK_DELAY &#061; \u201c5 minutes\u201d<\/td>\n<td>Q4: \u5b88\u536b\u95f4\u9694 5\u5206\u949f<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q5-001<\/td>\n<td>commands.md<\/td>\n<td>sha256sum faka_backup.sql \u540e6\u4f4d&#061;ff8180<\/td>\n<td>Q5: SHA256\u540e6\u4f4d FF8180<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q6-001<\/td>\n<td>commands.md<\/td>\n<td>config.php pwd&#061;Root&#064;123456 &#043; MySQL\u767b\u5f55\u6210\u529f<\/td>\n<td>Q6: MySQL\u5bc6\u7801 Root&#064;123456<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q7-001<\/td>\n<td>commands.md<\/td>\n<td>ss -tlnp *:8081 &#043; nginx.conf listen 8081<\/td>\n<td>Q7: \u7aef\u53e3 8081<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q8-001<\/td>\n<td>commands.md<\/td>\n<td>php.ini upload_max_filesize &#061; 60M<\/td>\n<td>Q8: \u4e0a\u4f20\u9650\u5236 60M<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q9-001<\/td>\n<td>commands.md<\/td>\n<td>autobackup.sh REMOTE_SERVER&#061;\u201c8.208.44.202\u201d<\/td>\n<td>Q9: \u5883\u5916IP 8.208.44.202<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q10-001<\/td>\n<td>commands.md<\/td>\n<td>nginx\u65e5\u5fd733\u6b21\u8bbf\u95ee\/fk\/static\/ &#043; \u72ec\u7acb\u5bc6\u7801\u76d0<\/td>\n<td>Q10: \u9690\u853d\u540e\u53f0 \/fk\/static\/<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q11-001<\/td>\n<td>commands.md<\/td>\n<td>nginx\u65e5\u5fd7 15\u6b21 192.168.203.135\u6700\u591a<\/td>\n<td>Q11: \u6700\u591a\u8bbf\u95eeIP 192.168.203.135<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q12-001\/002<\/td>\n<td>commands.md, verification.md<\/td>\n<td>hashcat -m 1410 Cracked &#043; \u540e\u53f0\u767b\u5f55\u9a8c\u8bc1<\/td>\n<td>Q12: \u5bc6\u7801 abc123456<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q13-003<\/td>\n<td>commands.md<\/td>\n<td>payapi&#061;\u201813\u2019 &#043; set.php\u89e3\u7801&#061;\u65e0\u5fe7\u652f\u4ed8<\/td>\n<td>Q13: \u63a5\u5165\u5546 \u65e0\u5fe7\u652f\u4ed8<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q14-001<\/td>\n<td>commands.md<\/td>\n<td>\u5728\u7ebfDB&#043;\u5907\u4efd&#043;\u6e90\u7801\u9875\u811a\u4e09\u6e90\u4e00\u81f4<\/td>\n<td>Q14: \u521b\u5efa\u65f6\u95f4 2018\/12\/14<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q15-002<\/td>\n<td>commands.md<\/td>\n<td>bash_history&#043;\u9690\u85cf\u5907\u4efd&#043;\u89e3\u7801\u94fe<\/td>\n<td>Q15: Git\u4f5c\u8005 ZhangSan_Sec<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q16-001<\/td>\n<td>commands.md<\/td>\n<td>\u53cc\u6570\u636e\u5e93 cnt&#061;848, total&#061;24073.00<\/td>\n<td>Q16: \u5df2\u5b8c\u6210\u8ba2\u5355\u91d1\u989d 24073<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q17-001<\/td>\n<td>commands.md<\/td>\n<td>\u53cc\u6570\u636e\u5e93 2025-09-16 daily_total&#061;5442.00<\/td>\n<td>Q17: \u6700\u9ad8\u65e5\u91d1\u989d 5442<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q18-001<\/td>\n<td>commands.md<\/td>\n<td>\u53cc\u6570\u636e\u5e93 tid&#061;1912 \u7b2c\u4e00\u540d78\u4ef6<\/td>\n<td>Q18: \u6700\u9ad8\u9500\u91cf\u5e94\u7528<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q19-001<\/td>\n<td>commands.md<\/td>\n<td>userid&#061;23\u2192guoqi, 15480\u5143\/527\u7b14<\/td>\n<td>Q19: \u6700\u9ad8\u6d88\u8d39\u7528\u6237 guoqi<\/td>\n<\/tr>\n<tr>\n<td>FINDING-Q20-001<\/td>\n<td>commands.md<\/td>\n<td>mysql.user &#043; SHOW GRANTS\u53cc\u786e\u8ba4<\/td>\n<td>Q20: \u9690\u853d\u8d26\u6237 _tmp_z5m1w8<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n","protected":false},"excerpt":{"rendered":"<p>\u68c0\u67503 &#8211; \u670d\u52a1\u5668\u53d6\u8bc1 Writeup<br \/>\n\u4f5c\u8005&#xff1a;yagami\u4efb\u52a1\u76ee\u5f55&#xff1a;\/mnt\/d\/\u6587\u6863\/hermes-work\/jiancai3-server-q1-to-q20\/\u751f\u6210\u65f6\u95f4&#xff1a;2026-06-14\u751f\u6210\u6a21\u5f0f&#xff1a;\u5b8c\u6574 writeup\u5de5\u5177&#xff1a;Hermes Agent\u6a21\u578b&#xff1a;Qwen3.6-27B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf\u8fd0\u884c\u65b9\u5f0f&#xff1a;\u672c\u5730<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[58,117,230,43,44],"topic":[],"class_list":["post-81320","post","type-post","status-publish","format-standard","hentry","category-server","tag-linux","tag-nginx","tag-php","tag-43","tag-44"],"yoast_head":"<!-- This site is optimized with the Yoast SEO plugin v20.3 - https:\/\/yoast.com\/wordpress\/plugins\/seo\/ -->\n<title>2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3<\/title>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.wsisp.com\/helps\/81320.html\" \/>\n<meta property=\"og:locale\" content=\"zh_CN\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"og:description\" content=\"\u68c0\u67503 - \u670d\u52a1\u5668\u53d6\u8bc1 Writeup \u4f5c\u8005&#xff1a;yagami\u4efb\u52a1\u76ee\u5f55&#xff1a;\/mnt\/d\/\u6587\u6863\/hermes-work\/jiancai3-server-q1-to-q20\/\u751f\u6210\u65f6\u95f4&#xff1a;2026-06-14\u751f\u6210\u6a21\u5f0f&#xff1a;\u5b8c\u6574 writeup\u5de5\u5177&#xff1a;Hermes Agent\u6a21\u578b&#xff1a;Qwen3.6-27B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf\u8fd0\u884c\u65b9\u5f0f&#xff1a;\u672c\u5730\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.wsisp.com\/helps\/81320.html\" \/>\n<meta property=\"og:site_name\" content=\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\" \/>\n<meta property=\"article:published_time\" content=\"2026-07-24T16:59:32+00:00\" \/>\n<meta name=\"author\" content=\"admin\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<meta name=\"twitter:label1\" content=\"\u4f5c\u8005\" \/>\n\t<meta name=\"twitter:data1\" content=\"admin\" \/>\n\t<meta name=\"twitter:label2\" content=\"\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4\" \/>\n\t<meta name=\"twitter:data2\" content=\"12 \u5206\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\/\/schema.org\",\"@graph\":[{\"@type\":\"WebPage\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/81320.html\",\"url\":\"https:\/\/www.wsisp.com\/helps\/81320.html\",\"name\":\"2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"isPartOf\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\"},\"datePublished\":\"2026-07-24T16:59:32+00:00\",\"dateModified\":\"2026-07-24T16:59:32+00:00\",\"author\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\"},\"breadcrumb\":{\"@id\":\"https:\/\/www.wsisp.com\/helps\/81320.html#breadcrumb\"},\"inLanguage\":\"zh-Hans\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\/\/www.wsisp.com\/helps\/81320.html\"]}]},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/81320.html#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"\u9996\u9875\",\"item\":\"https:\/\/www.wsisp.com\/helps\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#website\",\"url\":\"https:\/\/www.wsisp.com\/helps\/\",\"name\":\"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3\",\"description\":\"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b\",\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}\"},\"query-input\":\"required name=search_term_string\"}],\"inLanguage\":\"zh-Hans\"},{\"@type\":\"Person\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41\",\"name\":\"admin\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"zh-Hans\",\"@id\":\"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/\",\"url\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"contentUrl\":\"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery\",\"caption\":\"admin\"},\"sameAs\":[\"http:\/\/wp.wsisp.com\"],\"url\":\"https:\/\/www.wsisp.com\/helps\/author\/admin\"}]}<\/script>\n<!-- \/ Yoast SEO plugin. -->","yoast_head_json":{"title":"2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.wsisp.com\/helps\/81320.html","og_locale":"zh_CN","og_type":"article","og_title":"2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","og_description":"\u68c0\u67503 - \u670d\u52a1\u5668\u53d6\u8bc1 Writeup \u4f5c\u8005&#xff1a;yagami\u4efb\u52a1\u76ee\u5f55&#xff1a;\/mnt\/d\/\u6587\u6863\/hermes-work\/jiancai3-server-q1-to-q20\/\u751f\u6210\u65f6\u95f4&#xff1a;2026-06-14\u751f\u6210\u6a21\u5f0f&#xff1a;\u5b8c\u6574 writeup\u5de5\u5177&#xff1a;Hermes Agent\u6a21\u578b&#xff1a;Qwen3.6-27B-Uncensored-HauhauCS-Aggressive-Q4_K_P.gguf\u8fd0\u884c\u65b9\u5f0f&#xff1a;\u672c\u5730","og_url":"https:\/\/www.wsisp.com\/helps\/81320.html","og_site_name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","article_published_time":"2026-07-24T16:59:32+00:00","author":"admin","twitter_card":"summary_large_image","twitter_misc":{"\u4f5c\u8005":"admin","\u9884\u8ba1\u9605\u8bfb\u65f6\u95f4":"12 \u5206"},"schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"WebPage","@id":"https:\/\/www.wsisp.com\/helps\/81320.html","url":"https:\/\/www.wsisp.com\/helps\/81320.html","name":"2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790 - \u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","isPartOf":{"@id":"https:\/\/www.wsisp.com\/helps\/#website"},"datePublished":"2026-07-24T16:59:32+00:00","dateModified":"2026-07-24T16:59:32+00:00","author":{"@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41"},"breadcrumb":{"@id":"https:\/\/www.wsisp.com\/helps\/81320.html#breadcrumb"},"inLanguage":"zh-Hans","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.wsisp.com\/helps\/81320.html"]}]},{"@type":"BreadcrumbList","@id":"https:\/\/www.wsisp.com\/helps\/81320.html#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"\u9996\u9875","item":"https:\/\/www.wsisp.com\/helps"},{"@type":"ListItem","position":2,"name":"2026\u805a\u5408\u736c\u8c78\u676f-\u670d\u52a1\u5668\u9898\u89e3\u6790"}]},{"@type":"WebSite","@id":"https:\/\/www.wsisp.com\/helps\/#website","url":"https:\/\/www.wsisp.com\/helps\/","name":"\u7f51\u7855\u4e92\u8054\u5e2e\u52a9\u4e2d\u5fc3","description":"\u9999\u6e2f\u670d\u52a1\u5668_\u9999\u6e2f\u4e91\u670d\u52a1\u5668\u8d44\u8baf_\u670d\u52a1\u5668\u5e2e\u52a9\u6587\u6863_\u670d\u52a1\u5668\u6559\u7a0b","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.wsisp.com\/helps\/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"zh-Hans"},{"@type":"Person","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/358e386c577a3ab51c4493330a20ad41","name":"admin","image":{"@type":"ImageObject","inLanguage":"zh-Hans","@id":"https:\/\/www.wsisp.com\/helps\/#\/schema\/person\/image\/","url":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","contentUrl":"https:\/\/gravatar.wp-china-yes.net\/avatar\/?s=96&d=mystery","caption":"admin"},"sameAs":["http:\/\/wp.wsisp.com"],"url":"https:\/\/www.wsisp.com\/helps\/author\/admin"}]}},"_links":{"self":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/81320","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/comments?post=81320"}],"version-history":[{"count":0,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/posts\/81320\/revisions"}],"wp:attachment":[{"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/media?parent=81320"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/categories?post=81320"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/tags?post=81320"},{"taxonomy":"topic","embeddable":true,"href":"https:\/\/www.wsisp.com\/helps\/wp-json\/wp\/v2\/topic?post=81320"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}