随手记入

ping利用

echo '[whoami]' > hacker && ls >> hacker && history -d $(($HISTCMD-1)) && clear && ping baidu.com

echo 输入 > 保存的文件 && 命令利用 >> 保存文件 && history -d $(($HISTCMD-1)) && clear && 命令

新东方解密

课程地址 https://m.koolearn.com/product/c_34_68057.html?_mobile=true&wp_f=w_menu#syllabus

大字目录
68057 来自课程url
https://study.koolearn.com/tongyong/baseLessonOfProductInfo/68057?_=1611828418675

一级目录
pathId来自大字目录里面
https://study.koolearn.com/tongyong/course_kc_data/68057/0?pathId=99869&nodeId=-1&level=1&learningSubjectId=&_=1611828419404

https://study.koolearn.com/tongyong/course_kc_data/68057/0?pathId=99872&nodeId=-1&level=1&learningSubjectId=&_=1611828419415

https://study.koolearn.com/tongyong/course_kc_data/68057/0?pathId=99875&nodeId=-1&level=1&learningSubjectId=&_=1611828419420

https://study.koolearn.com/tongyong/course_kc_data/68057/0?pathId=99877&nodeId=-1&level=1&learningSubjectId=&_=1611828419431

二级目录
pathId与一级目录对应、nodeId在一级目录里面取
https://study.koolearn.com/tongyong/course_kc_data/68057/0?pathId=99869&nodeId=1903&level=2&learningSubjectId=1903&_=1611828419735

三级目录
pathId与一级目录对应、nodeId在一级目录里面取、learningSubjectId是二级目录的nodeId
https://study.koolearn.com/tongyong/course_kc_data/68057/0?pathId=99869&nodeId=7685678&level=3&learningSubjectId=1903&_=1611828420573

//时间戳一定要对应！
【get】
https://study.koolearn.com/common/learning/mobile-video-info?videoId=174408&version=4&_=1612777614640&callback=jsonp111
===》得到
【get】 要带cookie
https://pl.koolearn.com/api/hls/sgmt_m3u8_std?consumerType=1002001×tamp=1612777614640&tshttps=1&userId=0&videoId=174408&sign=-cx8g6i4TGFk69xA79FEV4PbjGQ

cookie为：
media-webapp-pl=c6d4beedf19f57ef2bcf62662bdadd59; __jsluid_s=2552a7a970e955a599bfb93cd553482e; ProductViewed=68057; KUID=buhyv01612001304852; log.session=2d2206b84f5bafc4fbddabeccecf8fb1; koo.line=34; _uuid=ff8080816f1494d3017752c3e5646ea4; easeMobId=koolearn1612001306300285288; easeMobPassword=koolearn1612001306300285288; JSESSIONID=3AB9EF9922B420384A68EA6B0EA65D43; prelogid=6546e2518ca48dbef513a24a8e7d38dc

得到key和ts【key使用winhex解密or转成十六进制解密！】
iv 固定！ 为  d9cba20cfaef97a1c0f310d4b7dfea4a

key：  70485169614C4F365344527563393841

openssl aes-128-cbc -d -in 2.ts  -out  new.mp4  -nosalt -iv d9cba20cfaef97a1c0f310d4b7dfea4a  -K 70485169614C4F365344527563393841