https://633k.org/tags/%E5%91%BD%E4%BB%A4%E6%B3%A8%E5%85%A5/ Recent content in 命令注入 on 633k Hugo zh-CN Tue, 23 Sep 2025 00:00:00 +0000 https://633k.org/posts/headless/ Tue, 23 Sep 2025 00:00:00 +0000 https://633k.org/posts/headless/ <h1 id="headlesshtb-easy">Headless（HTB Easy）</h1> <h2 id="基本信息">基本信息</h2> <ul> <li>IP：<code>10.10.11.8</code></li> <li>域名：<code>headless.htb</code></li> </ul> <h2 id="信息收集">信息收集</h2> <div class="highlight"><pre tabindex="0" style="color:#f8f8f2;background-color:#272822;-moz-tab-size:4;-o-tab-size:4;tab-size:4;"><code class="language-bash" data-lang="bash"><span style="display:flex;"><span>nmap -sT --min-rate <span style="color:#ae81ff">10000</span> -p- 10.10.11.8 --unprivileged </span></span></code></pre></div><pre tabindex="0"><code>PORT STATE SERVICE VERSION 22/tcp open ssh OpenSSH 9.2p1 Debian 2+deb12u2 (protocol 2.0) 5000/tcp open upnp? | fingerprint-strings: | GetRequest: | HTTP/1.1 200 OK | Server: Werkzeug/2.2.2 Python/3.11.2 | Set-Cookie: is_admin=InVzZXIi.uAlmXlTvm8vyihjNaPDWnvB_Zfs; Path=/ | &lt;title&gt;Under Construction&lt;/title&gt; </code></pre><p>5000 是 Flask/Werkzeug Web。映射 hosts：</p>