Skip to content

Commit

Permalink
更新图片链接
Browse files Browse the repository at this point in the history
  • Loading branch information
listenquiet authored Jun 13, 2022
1 parent 77563c2 commit 630e0a7
Showing 1 changed file with 7 additions and 7 deletions.
14 changes: 7 additions & 7 deletions readme.md
Original file line number Diff line number Diff line change
Expand Up @@ -74,11 +74,11 @@ python .\poc.py 192.168.144.128

![Image text](img/2021-09-28_10-44-31.png)

![Image text](https://raw.githubusercontent.com/listenquiet/cve-2017-2824-reverse-shell/main/img/2021-09-28_10-44-58.png)
![Image text](img/2021-09-28_10-44-58.png)

第一次执行没有hostid,第二次执行时,注册成功了,执行了命令。若不成功,多执行几次

![Image text](https://raw.githubusercontent.com/listenquiet/cve-2017-2824-reverse-shell/main/img/2021-09-28_10-45-45.png)
![Image text](img/2021-09-28_10-45-45.png)

## **0x08 漏洞利用**

Expand Down Expand Up @@ -134,21 +134,21 @@ for exp in exps:

第一次执行效果

![Image text](https://raw.githubusercontent.com/listenquiet/cve-2017-2824-reverse-shell/main/img/2021-09-28_15-54-30.png)
![Image text](img/2021-09-28_15-54-30.png)

第二次执行效果

![Image text](https://raw.githubusercontent.com/listenquiet/cve-2017-2824-reverse-shell/main/img/2021-09-28_15-54-54.png)
![Image text](img/2021-09-28_15-54-54.png)

第三次执行,提示连接超时,则可能是第二次已经反弹shell成功了,所以再去连接nc端口超时

![Image text](https://raw.githubusercontent.com/listenquiet/cve-2017-2824-reverse-shell/main/img/2021-09-28_15-55-22.png)
![Image text](img/2021-09-28_15-55-22.png)

![Image text](https://raw.githubusercontent.com/listenquiet/cve-2017-2824-reverse-shell/main/img/2021-09-28_15-56-34.png)
![Image text](img/2021-09-28_15-56-34.png)

查看反弹shell成功

![Image text](https://raw.githubusercontent.com/listenquiet/cve-2017-2824-reverse-shell/main/img/2021-09-28_15-58-49.png)
![Image text](img/2021-09-28_15-58-49.png)

但这种反弹shell不知道什么原因,会导致容器过一分钟左右退出。非容器环境未测试,使用需谨慎,使用此脚本导致业务受影响,本人概不负责。

Expand Down

0 comments on commit 630e0a7

Please sign in to comment.